From 5b6f8353fe2af6c270a30dc8c38791cf03fd265d Mon Sep 17 00:00:00 2001
From: Robert Marko <robimarko@gmail.com>
Date: Wed, 20 Nov 2024 13:51:53 +0100
Subject: [PATCH 001/225] include/package-pack: actually call
 default_postinist/prerm when using APK

Currently, when you install a package that ships uci-defaults scripts they
are not getting executed during package installation.

For example, if you install a new LuCI theme it ships a uci-defaults script
to add it to the UCI LuCI config so the theme is actually selectable but
that does not happen until the device is rebooted so that uci-defaults
script is actually executed.

It turns out that the recipe for post-install is the issue since it will
include contents of postinst-pkg before the call to default_postinist.
This is an issue since postinst-pkg will exit with code 0 before we ever
reach the call to default_postinist.

So, lets simply make the call to default_postinist before postinst-pkg
inclusion which is what OPKG based installation does.

The same issue affects pre-deinstall script but its not actually being hit
since we dont seem to be actually even generating prerm-pkg scripts but
lets fix this theoretical issue as well.

Fixes: #16987
Fixes: d788ab376f85 ("build: add APK package build capabilities")
Link: https://github.com/openwrt/openwrt/pull/17023
Signed-off-by: Robert Marko <robimarko@gmail.com>
---
 include/package-pack.mk | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/package-pack.mk b/include/package-pack.mk
index 3ac7a036f9de70..1f1b8c73f95a68 100644
--- a/include/package-pack.mk
+++ b/include/package-pack.mk
@@ -294,8 +294,8 @@ else
 		echo 'export root="$$$${IPKG_INSTROOT}"'; \
 		echo 'export pkgname="$(1)"'; \
 		echo "add_group_and_user"; \
-		[ ! -f $$(ADIR_$(1))/postinst-pkg ] || cat "$$(ADIR_$(1))/postinst-pkg"; \
 		echo "default_postinst"; \
+		[ ! -f $$(ADIR_$(1))/postinst-pkg ] || cat "$$(ADIR_$(1))/postinst-pkg"; \
 	) > $$(ADIR_$(1))/post-install;
 
 	( \
@@ -304,8 +304,8 @@ else
 		echo ". \$$$${IPKG_INSTROOT}/lib/functions.sh"; \
 		echo 'export root="$$$${IPKG_INSTROOT}"'; \
 		echo 'export pkgname="$(1)"'; \
-		[ ! -f $$(ADIR_$(1))/prerm-pkg ] || cat "$$(ADIR_$(1))/prerm-pkg"; \
 		echo "default_prerm"; \
+		[ ! -f $$(ADIR_$(1))/prerm-pkg ] || cat "$$(ADIR_$(1))/prerm-pkg"; \
 	) > $$(ADIR_$(1))/pre-deinstall;
 
 	if [ -n "$(USERID)" ]; then echo $(USERID) > $$(IDIR_$(1))/lib/apk/packages/$(1).rusers; fi;

From fc2ba101089117d72903f9464269da73763ded42 Mon Sep 17 00:00:00 2001
From: Robert Marko <robimarko@gmail.com>
Date: Thu, 21 Nov 2024 14:34:03 +0100
Subject: [PATCH 002/225] include/package-pack: add support for postrm with APK

Currently, postrm scripts are not being executed when package is removed
with APK since they are not being included at all.

So, lets use APK-s support for post-deinstall scripts and ship our postrm
scripts if packages define them.

Fixes: d788ab376f85 ("build: add APK package build capabilities")
Link: https://github.com/openwrt/openwrt/pull/17023
Signed-off-by: Robert Marko <robimarko@gmail.com>
---
 include/package-pack.mk | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/include/package-pack.mk b/include/package-pack.mk
index 1f1b8c73f95a68..a36d6909016e6e 100644
--- a/include/package-pack.mk
+++ b/include/package-pack.mk
@@ -110,6 +110,13 @@ endif
     IDIR_$(1):=$(PKG_BUILD_DIR)/ipkg-$(PKGARCH)/$(1)
     ADIR_$(1):=$(PKG_BUILD_DIR)/apk-$(PKGARCH)/$(1)
     KEEP_$(1):=$(strip $(call Package/$(1)/conffiles))
+    APK_SCRIPTS_$(1):=\
+    --script "post-install:$$(ADIR_$(1))/post-install" \
+    --script "pre-deinstall:$$(ADIR_$(1))/pre-deinstall"
+
+    ifdef Package/$(1)/postrm
+        APK_SCRIPTS_$(1)+=--script "post-deinstall:$$(ADIR_$(1))/postrm"
+    endif
 
     TARGET_VARIANT:=$$(if $(ALL_VARIANTS),$$(if $$(VARIANT),$$(filter-out *,$$(VARIANT)),$(firstword $(ALL_VARIANTS))))
     ifeq ($(BUILD_VARIANT),$$(if $$(TARGET_VARIANT),$$(TARGET_VARIANT),$(BUILD_VARIANT)))
@@ -360,8 +367,7 @@ else
 		), \
 		$$(prov) )" \
 	  $(if $(DEFAULT_VARIANT),--info "provider-priority:100",$(if $(PROVIDES),--info "provider-priority:1")) \
-	  --script "post-install:$$(ADIR_$(1))/post-install" \
-	  --script "pre-deinstall:$$(ADIR_$(1))/pre-deinstall" \
+	  $$(APK_SCRIPTS_$(1)) \
 	  --info "depends:$$(foreach depends,$$(subst $$(comma),$$(space),$$(subst $$(space),,$$(subst $$(paren_right),,$$(subst $$(paren_left),,$$(Package/$(1)/DEPENDS))))),$$(depends))" \
 	  --files "$$(IDIR_$(1))" \
 	  --output "$$(PACK_$(1))" \

From 2784f78c6c22c0731ef551e4fcd42295f08a07a5 Mon Sep 17 00:00:00 2001
From: Eric Fahlgren <ericfahlgren@gmail.com>
Date: Thu, 21 Nov 2024 05:50:21 -0800
Subject: [PATCH 003/225] build: fix filtering of non-upgradable packages

Add anchor to name search so that we don't inadvertently filter out
packages containing, say, "kernel-" as part of their name.

Fixes: openwrt/packages#25372
Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17032
Signed-off-by: Robert Marko <robimarko@gmail.com>
---
 package/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package/Makefile b/package/Makefile
index 3c6621b81c3c13..ca43eb7e01642b 100644
--- a/package/Makefile
+++ b/package/Makefile
@@ -131,7 +131,7 @@ ifneq ($(CONFIG_USE_APK),)
 			--keys-dir $(TOPDIR) \
 			--sign $(BUILD_KEY_APK_SEC) \
 			--output packages.adb \
-			$$(ls *.apk | grep -v 'base-files-\|kernel-\|libc-'); \
+			$$(ls *.apk | grep -vE '^(base-files-|kernel-|libc-)'); \
 		echo -n '{"architecture": "$(ARCH_PACKAGES)", "packages":{' > index.json; \
 		$(STAGING_DIR_HOST)/bin/apk adbdump packages.adb | \
 			awk '/- name: / {pkg = $$NF} ; / version: / {printf "\"%s\": \"%s\", ", pkg, $$NF}' | \

From 3467ea905b40f0df87700a15b716b1f5a4efc955 Mon Sep 17 00:00:00 2001
From: Mikhail Kshevetskiy <mikhail.kshevetskiy@gmail.com>
Date: Fri, 15 Nov 2024 03:17:07 +0300
Subject: [PATCH 004/225] mediatek: fix pwn fan settings for sinovoip bpi-r3

Popular bpi-r3 pwm fans like this one

  https://www.amazon.com/youyeetoo-Barebone-Fan-BPI-R3-Integrated/dp/B0CCCTY8PS

will not work properly with current openwrt-23.05/24.10 firmware.
Trying different pwm setting

  echo $value > /sys/devices/platform/pwm-fan/hwmon/hwmon1/pwm1

I found:

  pwm1 value     fan rotation speed   cpu temperature     notes
  -----------------------------------------------------------------
    0            maximal              31.5 Celsius        too noisy
   40            optimal              35.2 Celsius        no noise hearable
   95            minimal
   above 95      does not rotate      55.5 Celsius
  -----------------------------------------------------------------

At the moment we have following cooling levels:

  cooling-levels = <255 96 0>;

for cpu-active-high, cpu-active-medium and cpu-active-low modes correspondingly.
Thus only cpu-active-high and cpu-active-low are usable. I think this is wrong.

This patch fixes cpu-active-medium settings for bpi-r3 board.

PS: I know, the patch is not ideal as it can break pwm fan for some users.
    There are some peoples that use handmade cooling solutions, but:
      * discussed cooler is the only 'official' pwm cooler for bpi-r3
        available on the market.
      * most peoples will use passive cooling available on the market or
        the discussed cooler.
      * the pwm-fan dts section was added before the official cooler
        appears on the market.
    Thus it should not be a lot of harm from this fix.

Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16974
Signed-off-by: Robert Marko <robimarko@gmail.com>
---
 ...96-dts-mt7986a-bpi-r3-pwm-fan-cooling-levels.patch | 11 +++++++++++
 1 file changed, 11 insertions(+)
 create mode 100644 target/linux/mediatek/patches-5.15/196-dts-mt7986a-bpi-r3-pwm-fan-cooling-levels.patch

diff --git a/target/linux/mediatek/patches-5.15/196-dts-mt7986a-bpi-r3-pwm-fan-cooling-levels.patch b/target/linux/mediatek/patches-5.15/196-dts-mt7986a-bpi-r3-pwm-fan-cooling-levels.patch
new file mode 100644
index 00000000000000..267c654f350426
--- /dev/null
+++ b/target/linux/mediatek/patches-5.15/196-dts-mt7986a-bpi-r3-pwm-fan-cooling-levels.patch
@@ -0,0 +1,11 @@
+--- a/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts
+@@ -46,7 +46,7 @@
+ 		compatible = "pwm-fan";
+ 		#cooling-cells = <2>;
+ 		/* cooling level (0, 1, 2) - pwm inverted */
+-		cooling-levels = <255 96 0>;
++		cooling-levels = <255 40 0>;
+ 		pwms = <&pwm 0 10000>;
+ 		status = "okay";
+ 	};

From 52b6c9247997e51a97f13bb9e94749bc34e2d52e Mon Sep 17 00:00:00 2001
From: Robert Marko <robimarko@gmail.com>
Date: Thu, 21 Nov 2024 22:04:41 +0100
Subject: [PATCH 005/225] Revert "mediatek: fix pwn fan settings for sinovoip
 bpi-r3"

This reverts commit 3467ea905b40f0df87700a15b716b1f5a4efc955.

I merged it by accident.

Signed-off-by: Robert Marko <robimarko@gmail.com>
---
 ...96-dts-mt7986a-bpi-r3-pwm-fan-cooling-levels.patch | 11 -----------
 1 file changed, 11 deletions(-)
 delete mode 100644 target/linux/mediatek/patches-5.15/196-dts-mt7986a-bpi-r3-pwm-fan-cooling-levels.patch

diff --git a/target/linux/mediatek/patches-5.15/196-dts-mt7986a-bpi-r3-pwm-fan-cooling-levels.patch b/target/linux/mediatek/patches-5.15/196-dts-mt7986a-bpi-r3-pwm-fan-cooling-levels.patch
deleted file mode 100644
index 267c654f350426..00000000000000
--- a/target/linux/mediatek/patches-5.15/196-dts-mt7986a-bpi-r3-pwm-fan-cooling-levels.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts
-+++ b/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts
-@@ -46,7 +46,7 @@
- 		compatible = "pwm-fan";
- 		#cooling-cells = <2>;
- 		/* cooling level (0, 1, 2) - pwm inverted */
--		cooling-levels = <255 96 0>;
-+		cooling-levels = <255 40 0>;
- 		pwms = <&pwm 0 10000>;
- 		status = "okay";
- 	};

From adf958c9192d94fbeeb0ec8e16800b0071455909 Mon Sep 17 00:00:00 2001
From: Hauke Mehrtens <hauke@hauke-m.de>
Date: Sat, 23 Nov 2024 00:34:30 +0100
Subject: [PATCH 006/225] wifi-scripts: Fix parsing of Capabilities

Fixup capabilities parsing in iw output.

In addition to the normal capabilities iw now also outputs HE MAC, HE
PHY and EHT MAC and EHT PHY capabilities. Exclude them in the parsing.

The grep returns this with mac80211-hwsim:
```
root@OpenWrt:~# iw phy phy0 info | grep 'Capabilities:'
		Capabilities: 0x107e
			HE PHY Capabilities: (0x02bfce0000000000000000):
			EHT PHY Capabilities: (0x7c0000feffff7f01):
			HE PHY Capabilities: (0x02bfce0000000000000000):
			EHT PHY Capabilities: (0x7c0000feffff7f01):
			HE PHY Capabilities: (0x02bf000000000000000000):
		Capabilities: 0x107e
			HE PHY Capabilities: (0x1cbfce0000000000000000):
			EHT PHY Capabilities: (0xfc1f3ffeffff7f37):
			HE PHY Capabilities: (0x1cbfce0000000000000000):
			EHT PHY Capabilities: (0xfc1f3ffeffff7f37):
			HE PHY Capabilities: (0x1cbf000000000000000000):
			HE PHY Capabilities: (0x1cbfce0000000000000000):
			EHT PHY Capabilities: (0xfefffffeffffff7f):
			HE PHY Capabilities: (0x1cbfce0000000000000000):
			EHT PHY Capabilities: (0xfefffffeffffff7f):
			HE PHY Capabilities: (0x1cbf000000000000000000):
		Capabilities: 0x107e
```

With busybox 1.36.1 the ht_cap_mask variable will be set to
-72057598332895361. With busybox 1.37.0 it will be set to -1.
Both values are wrong, after this change it will be set to 4222
(0x107E).

Link: https://github.com/openwrt/openwrt/pull/17043
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 .../config/wifi-scripts/files/lib/netifd/wireless/mac80211.sh   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package/network/config/wifi-scripts/files/lib/netifd/wireless/mac80211.sh b/package/network/config/wifi-scripts/files/lib/netifd/wireless/mac80211.sh
index 9998e26ec13189..3d953eff74d2fa 100755
--- a/package/network/config/wifi-scripts/files/lib/netifd/wireless/mac80211.sh
+++ b/package/network/config/wifi-scripts/files/lib/netifd/wireless/mac80211.sh
@@ -208,7 +208,7 @@ mac80211_hostapd_setup_base() {
 				dsss_cck_40:1
 
 			ht_cap_mask=0
-			for cap in $(iw phy "$phy" info | grep 'Capabilities:' | cut -d: -f2); do
+			for cap in $(iw phy "$phy" info | grep -E '^\s*Capabilities:' | cut -d: -f2); do
 				ht_cap_mask="$(($ht_cap_mask | $cap))"
 			done
 

From 611bfa4d72c87e8163d7193d9557479fc7312467 Mon Sep 17 00:00:00 2001
From: John Audia <therealgraysky@proton.me>
Date: Sun, 17 Nov 2024 14:33:47 -0500
Subject: [PATCH 007/225] kernel: bump 6.6 to 6.6.62

Changelog: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.62

All patches automatically rebased.

Build system: x86/64
Build-tested: x86/64/AMD Cezanne, flogic/glinet_gl-mt6000, flogic/xiaomi_redmi-router-ax6000-ubootmod, ramips/tplink_archer-a6-v3
Run-tested: x86/64/AMD Cezanne, flogic/glinet_gl-mt6000, flogic/xiaomi_redmi-router-ax6000-ubootmod, ramips/tplink_archer-a6-v3

Signed-off-by: John Audia <therealgraysky@proton.me>
Link: https://github.com/openwrt/openwrt/pull/16997
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 include/kernel-6.6                                     |  4 ++--
 ...-Add-device-quirks-for-Freeway-Airmouse-T3-an.patch |  2 +-
 ..._alloc-cma-introduce-a-customisable-threshold.patch |  2 +-
 ...-Allow-override-of-kernel-s-default-NUMA-poli.patch | 10 +++++-----
 4 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/include/kernel-6.6 b/include/kernel-6.6
index d870747f8362d5..dfb1e855f8de02 100644
--- a/include/kernel-6.6
+++ b/include/kernel-6.6
@@ -1,2 +1,2 @@
-LINUX_VERSION-6.6 = .61
-LINUX_KERNEL_HASH-6.6.61 = 418fc24df9190f1c3ed9906dc3b7651c2a2eae5c1cb9ab4a6348e20faf047c0b
+LINUX_VERSION-6.6 = .62
+LINUX_KERNEL_HASH-6.6.62 = e2c35611775534941b9d4dd871f3ae5b988b6594dc9033b5ca784366e07d9336
diff --git a/target/linux/bcm27xx/patches-6.6/950-0169-hid-usb-Add-device-quirks-for-Freeway-Airmouse-T3-an.patch b/target/linux/bcm27xx/patches-6.6/950-0169-hid-usb-Add-device-quirks-for-Freeway-Airmouse-T3-an.patch
index 5301066196f53b..6e9ca2261bb087 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0169-hid-usb-Add-device-quirks-for-Freeway-Airmouse-T3-an.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0169-hid-usb-Add-device-quirks-for-Freeway-Airmouse-T3-an.patch
@@ -33,7 +33,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
  #define USB_VENDOR_ID_BELKIN		0x050d
  #define USB_DEVICE_ID_FLIP_KVM		0x3201
  
-@@ -1404,6 +1407,9 @@
+@@ -1405,6 +1408,9 @@
  #define USB_VENDOR_ID_XIAOMI		0x2717
  #define USB_DEVICE_ID_MI_SILENT_MOUSE	0x5014
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0359-mm-page_alloc-cma-introduce-a-customisable-threshold.patch b/target/linux/bcm27xx/patches-6.6/950-0359-mm-page_alloc-cma-introduce-a-customisable-threshold.patch
index 8c39ae9931e8ba..f8baf9befc5b0f 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0359-mm-page_alloc-cma-introduce-a-customisable-threshold.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0359-mm-page_alloc-cma-introduce-a-customisable-threshold.patch
@@ -48,7 +48,7 @@ Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
  /*
   * A cached value of the page's pageblock's migratetype, used when the page is
   * put on a pcplist. Used to avoid the pageblock migratetype lookup when
-@@ -2095,12 +2116,13 @@ __rmqueue(struct zone *zone, unsigned in
+@@ -2094,12 +2115,13 @@ __rmqueue(struct zone *zone, unsigned in
  	if (IS_ENABLED(CONFIG_CMA)) {
  		/*
  		 * Balance movable allocations between regular and CMA areas by
diff --git a/target/linux/bcm27xx/patches-6.6/950-1340-mm-numa-Allow-override-of-kernel-s-default-NUMA-poli.patch b/target/linux/bcm27xx/patches-6.6/950-1340-mm-numa-Allow-override-of-kernel-s-default-NUMA-poli.patch
index f0de0ce9d59b1e..dceb6df45f86da 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1340-mm-numa-Allow-override-of-kernel-s-default-NUMA-poli.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1340-mm-numa-Allow-override-of-kernel-s-default-NUMA-poli.patch
@@ -23,7 +23,7 @@ Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
 
 --- a/mm/mempolicy.c
 +++ b/mm/mempolicy.c
-@@ -2974,7 +2974,9 @@ void __init numa_policy_init(void)
+@@ -2963,7 +2963,9 @@ void __init numa_policy_init(void)
  /* Reset policy of current process to default */
  void numa_default_policy(void)
  {
@@ -34,7 +34,7 @@ Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
  }
  
  /*
-@@ -2992,7 +2994,6 @@ static const char * const policy_modes[]
+@@ -2981,7 +2983,6 @@ static const char * const policy_modes[]
  };
  
  
@@ -42,7 +42,7 @@ Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
  /**
   * mpol_parse_str - parse string to mempolicy, for tmpfs mpol mount option.
   * @str:  string containing mempolicy to parse
-@@ -3005,13 +3006,18 @@ static const char * const policy_modes[]
+@@ -2994,13 +2995,18 @@ static const char * const policy_modes[]
   */
  int mpol_parse_str(char *str, struct mempolicy **mpol)
  {
@@ -62,7 +62,7 @@ Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
  	if (flags)
  		*flags++ = '\0';	/* terminate mode string */
  
-@@ -3090,9 +3096,16 @@ int mpol_parse_str(char *str, struct mem
+@@ -3079,9 +3085,16 @@ int mpol_parse_str(char *str, struct mem
  			goto out;
  	}
  
@@ -82,7 +82,7 @@ Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
  
  	/*
  	 * Save nodes for mpol_to_str() to show the tmpfs mount options
-@@ -3125,7 +3138,29 @@ out:
+@@ -3114,7 +3127,29 @@ out:
  		*mpol = new;
  	return err;
  }

From eb395585ae1b7560bbcea9544f428db2a9105152 Mon Sep 17 00:00:00 2001
From: John Audia <therealgraysky@proton.me>
Date: Fri, 22 Nov 2024 10:53:37 -0500
Subject: [PATCH 008/225] kernel: bump 6.6 to 6.6.63

Changelog: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.63

Manually rebased:
	bcm27xx/patches-6.6/950-0297-staging-vchiq_arm-Add-36-bit-address-support.patch

All other patches automatically rebased.

Build system: x86/64
Build-tested: x86/64/AMD Cezanne, flogic/xiaomi_redmi-router-ax6000-ubootmod, ramips/tplink_archer-a6-v3
Run-tested: x86/64/AMD Cezanne, flogic/xiaomi_redmi-router-ax6000-ubootmod, ramips/tplink_archer-a6-v3

Signed-off-by: John Audia <therealgraysky@proton.me>
Link: https://github.com/openwrt/openwrt/pull/16997
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 include/kernel-6.6                            |  4 +--
 .../900-unaligned_access_hacks.patch          |  4 +--
 ...m-Register-vcsm-cma-as-a-platform-dr.patch |  4 +--
 ...m-Register-bcm2835-codec-as-a-platfo.patch |  4 +--
 ...m-Set-up-dma-ranges-on-child-devices.patch |  2 +-
 ...e-the-old-dma-controller-for-OF-conf.patch |  4 +--
 ...hiq_arm-Give-vchiq-children-DT-nodes.patch |  2 +-
 ...q-Load-bcm2835_isp-driver-from-vchiq.patch |  4 +--
 ...vchiq_arm-Add-36-bit-address-support.patch | 30 +++++++++----------
 ...chiq_arm-children-inherit-DMA-config.patch |  2 +-
 ...q_arm-Usa-a-DMA-pool-for-small-bulks.patch | 14 ++++-----
 11 files changed, 37 insertions(+), 37 deletions(-)

diff --git a/include/kernel-6.6 b/include/kernel-6.6
index dfb1e855f8de02..0cfe052e651ad1 100644
--- a/include/kernel-6.6
+++ b/include/kernel-6.6
@@ -1,2 +1,2 @@
-LINUX_VERSION-6.6 = .62
-LINUX_KERNEL_HASH-6.6.62 = e2c35611775534941b9d4dd871f3ae5b988b6594dc9033b5ca784366e07d9336
+LINUX_VERSION-6.6 = .63
+LINUX_KERNEL_HASH-6.6.63 = d1054ab4803413efe2850f50f1a84349c091631ec50a1cf9e891d1b1f9061835
diff --git a/target/linux/ath79/patches-6.6/900-unaligned_access_hacks.patch b/target/linux/ath79/patches-6.6/900-unaligned_access_hacks.patch
index c5b01b7daddfc4..dd57c53a18101a 100644
--- a/target/linux/ath79/patches-6.6/900-unaligned_access_hacks.patch
+++ b/target/linux/ath79/patches-6.6/900-unaligned_access_hacks.patch
@@ -557,7 +557,7 @@ SVN-Revision: 35130
  static inline struct neighbour *__ipv6_neigh_lookup_noref(struct net_device *dev, const void *pkey)
 --- a/net/sched/cls_u32.c
 +++ b/net/sched/cls_u32.c
-@@ -157,7 +157,7 @@ next_knode:
+@@ -167,7 +167,7 @@ next_knode:
  			data = skb_header_pointer(skb, toff, 4, &hdata);
  			if (!data)
  				goto out;
@@ -566,7 +566,7 @@ SVN-Revision: 35130
  				n = rcu_dereference_bh(n->next);
  				goto next_knode;
  			}
-@@ -208,8 +208,8 @@ check_terminal:
+@@ -218,8 +218,8 @@ check_terminal:
  						  &hdata);
  			if (!data)
  				goto out;
diff --git a/target/linux/bcm27xx/patches-6.6/950-0184-staging-vchiq_arm-Register-vcsm-cma-as-a-platform-dr.patch b/target/linux/bcm27xx/patches-6.6/950-0184-staging-vchiq_arm-Register-vcsm-cma-as-a-platform-dr.patch
index 102931650446f4..741d377fc8d3be 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0184-staging-vchiq_arm-Register-vcsm-cma-as-a-platform-dr.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0184-staging-vchiq_arm-Register-vcsm-cma-as-a-platform-dr.patch
@@ -22,7 +22,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  
  struct vchiq_drvdata {
  	const unsigned int cache_line_size;
-@@ -1838,6 +1839,7 @@ static int vchiq_probe(struct platform_d
+@@ -1825,6 +1826,7 @@ static int vchiq_probe(struct platform_d
  		goto error_exit;
  	}
  
@@ -30,7 +30,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  	bcm2835_camera = vchiq_register_child(pdev, "bcm2835-camera");
  	bcm2835_audio = vchiq_register_child(pdev, "bcm2835_audio");
  
-@@ -1853,6 +1855,7 @@ static void vchiq_remove(struct platform
+@@ -1840,6 +1842,7 @@ static void vchiq_remove(struct platform
  {
  	platform_device_unregister(bcm2835_audio);
  	platform_device_unregister(bcm2835_camera);
diff --git a/target/linux/bcm27xx/patches-6.6/950-0185-staging-vchiq_arm-Register-bcm2835-codec-as-a-platfo.patch b/target/linux/bcm27xx/patches-6.6/950-0185-staging-vchiq_arm-Register-bcm2835-codec-as-a-platfo.patch
index ab4fb514d6dd28..5a3c91b7800471 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0185-staging-vchiq_arm-Register-bcm2835-codec-as-a-platfo.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0185-staging-vchiq_arm-Register-bcm2835-codec-as-a-platfo.patch
@@ -22,7 +22,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  static struct platform_device *vcsm_cma;
  
  struct vchiq_drvdata {
-@@ -1840,6 +1841,7 @@ static int vchiq_probe(struct platform_d
+@@ -1827,6 +1828,7 @@ static int vchiq_probe(struct platform_d
  	}
  
  	vcsm_cma = vchiq_register_child(pdev, "vcsm-cma");
@@ -30,7 +30,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  	bcm2835_camera = vchiq_register_child(pdev, "bcm2835-camera");
  	bcm2835_audio = vchiq_register_child(pdev, "bcm2835_audio");
  
-@@ -1855,6 +1857,7 @@ static void vchiq_remove(struct platform
+@@ -1842,6 +1844,7 @@ static void vchiq_remove(struct platform
  {
  	platform_device_unregister(bcm2835_audio);
  	platform_device_unregister(bcm2835_camera);
diff --git a/target/linux/bcm27xx/patches-6.6/950-0190-staging-vchiq_arm-Set-up-dma-ranges-on-child-devices.patch b/target/linux/bcm27xx/patches-6.6/950-0190-staging-vchiq_arm-Set-up-dma-ranges-on-child-devices.patch
index b008f909468268..3abc4f19bf77fb 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0190-staging-vchiq_arm-Set-up-dma-ranges-on-child-devices.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0190-staging-vchiq_arm-Set-up-dma-ranges-on-child-devices.patch
@@ -18,7 +18,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
 
 --- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
 +++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
-@@ -1790,6 +1790,12 @@ vchiq_register_child(struct platform_dev
+@@ -1777,6 +1777,12 @@ vchiq_register_child(struct platform_dev
  		child = NULL;
  	}
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0191-staging-vchiq-Use-the-old-dma-controller-for-OF-conf.patch b/target/linux/bcm27xx/patches-6.6/950-0191-staging-vchiq-Use-the-old-dma-controller-for-OF-conf.patch
index 85d1174a60e553..e5c5fdbc0b775a 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0191-staging-vchiq-Use-the-old-dma-controller-for-OF-conf.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0191-staging-vchiq-Use-the-old-dma-controller-for-OF-conf.patch
@@ -17,7 +17,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
 
 --- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
 +++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
-@@ -1776,6 +1776,7 @@ vchiq_register_child(struct platform_dev
+@@ -1763,6 +1763,7 @@ vchiq_register_child(struct platform_dev
  {
  	struct platform_device_info pdevinfo;
  	struct platform_device *child;
@@ -25,7 +25,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
  
  	memset(&pdevinfo, 0, sizeof(pdevinfo));
  
-@@ -1791,10 +1792,20 @@ vchiq_register_child(struct platform_dev
+@@ -1778,10 +1779,20 @@ vchiq_register_child(struct platform_dev
  	}
  
  	/*
diff --git a/target/linux/bcm27xx/patches-6.6/950-0194-staging-vchiq_arm-Give-vchiq-children-DT-nodes.patch b/target/linux/bcm27xx/patches-6.6/950-0194-staging-vchiq_arm-Give-vchiq-children-DT-nodes.patch
index eab0710367f632..9dba2dffca16a1 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0194-staging-vchiq_arm-Give-vchiq-children-DT-nodes.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0194-staging-vchiq_arm-Give-vchiq-children-DT-nodes.patch
@@ -16,7 +16,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
 +++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
-@@ -1785,12 +1785,20 @@ vchiq_register_child(struct platform_dev
+@@ -1772,12 +1772,20 @@ vchiq_register_child(struct platform_dev
  	pdevinfo.id = PLATFORM_DEVID_NONE;
  	pdevinfo.dma_mask = DMA_BIT_MASK(32);
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0209-staging-vchiq-Load-bcm2835_isp-driver-from-vchiq.patch b/target/linux/bcm27xx/patches-6.6/950-0209-staging-vchiq-Load-bcm2835_isp-driver-from-vchiq.patch
index a33b39967f857f..b5f912c85b0aad 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0209-staging-vchiq-Load-bcm2835_isp-driver-from-vchiq.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0209-staging-vchiq-Load-bcm2835_isp-driver-from-vchiq.patch
@@ -21,7 +21,7 @@ Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
  
  struct vchiq_drvdata {
  	const unsigned int cache_line_size;
-@@ -1869,6 +1870,7 @@ static int vchiq_probe(struct platform_d
+@@ -1856,6 +1857,7 @@ static int vchiq_probe(struct platform_d
  	bcm2835_codec = vchiq_register_child(pdev, "bcm2835-codec");
  	bcm2835_camera = vchiq_register_child(pdev, "bcm2835-camera");
  	bcm2835_audio = vchiq_register_child(pdev, "bcm2835_audio");
@@ -29,7 +29,7 @@ Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
  
  	return 0;
  
-@@ -1880,6 +1882,7 @@ error_exit:
+@@ -1867,6 +1869,7 @@ error_exit:
  
  static void vchiq_remove(struct platform_device *pdev)
  {
diff --git a/target/linux/bcm27xx/patches-6.6/950-0297-staging-vchiq_arm-Add-36-bit-address-support.patch b/target/linux/bcm27xx/patches-6.6/950-0297-staging-vchiq_arm-Add-36-bit-address-support.patch
index 0c1ee62fab2670..11147d9fd9615a 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0297-staging-vchiq_arm-Add-36-bit-address-support.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0297-staging-vchiq_arm-Add-36-bit-address-support.patch
@@ -36,10 +36,10 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 +	.use_36bit_addrs = true,
 +};
 +
- struct vchiq_2835_state {
- 	int inited;
- 	struct vchiq_arm_state arm_state;
-@@ -147,10 +153,12 @@ static void __iomem *g_regs;
+ struct vchiq_pagelist_info {
+ 	struct pagelist *pagelist;
+ 	size_t pagelist_buffer_size;
+@@ -142,10 +148,12 @@ static void __iomem *g_regs;
   * of 32.
   */
  static unsigned int g_cache_line_size = 32;
@@ -52,7 +52,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  
  static DEFINE_SEMAPHORE(g_free_fragments_mutex, 1);
  
-@@ -180,7 +188,7 @@ static void
+@@ -175,7 +183,7 @@ static void
  cleanup_pagelistinfo(struct vchiq_instance *instance, struct vchiq_pagelist_info *pagelistinfo)
  {
  	if (pagelistinfo->scatterlist_mapped) {
@@ -61,7 +61,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  			     pagelistinfo->num_pages, pagelistinfo->dma_dir);
  	}
  
-@@ -340,7 +348,7 @@ create_pagelist(struct vchiq_instance *i
+@@ -335,7 +343,7 @@ create_pagelist(struct vchiq_instance *i
  		count -= len;
  	}
  
@@ -70,7 +70,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  				 scatterlist,
  				 num_pages,
  				 pagelistinfo->dma_dir);
-@@ -354,22 +362,61 @@ create_pagelist(struct vchiq_instance *i
+@@ -349,22 +357,61 @@ create_pagelist(struct vchiq_instance *i
  
  	/* Combine adjacent blocks for performance */
  	k = 0;
@@ -148,7 +148,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	}
  
  	/* Partial cache lines (fragments) require special measures */
-@@ -413,7 +460,7 @@ free_pagelist(struct vchiq_instance *ins
+@@ -408,7 +455,7 @@ free_pagelist(struct vchiq_instance *ins
  	 * NOTE: dma_unmap_sg must be called before the
  	 * cpu can touch any of the data/pages.
  	 */
@@ -157,7 +157,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  		     pagelistinfo->num_pages, pagelistinfo->dma_dir);
  	pagelistinfo->scatterlist_mapped = 0;
  
-@@ -468,6 +515,7 @@ free_pagelist(struct vchiq_instance *ins
+@@ -463,6 +510,7 @@ free_pagelist(struct vchiq_instance *ins
  static int vchiq_platform_init(struct platform_device *pdev, struct vchiq_state *state)
  {
  	struct device *dev = &pdev->dev;
@@ -165,7 +165,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	struct vchiq_drvdata *drvdata = platform_get_drvdata(pdev);
  	struct rpi_firmware *fw = drvdata->fw;
  	struct vchiq_slot_zero *vchiq_slot_zero;
-@@ -489,6 +537,24 @@ static int vchiq_platform_init(struct pl
+@@ -484,6 +532,24 @@ static int vchiq_platform_init(struct pl
  	g_cache_line_size = drvdata->cache_line_size;
  	g_fragments_size = 2 * g_cache_line_size;
  
@@ -190,7 +190,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	/* Allocate space for the channels in coherent memory */
  	slot_mem_size = PAGE_ALIGN(TOTAL_SLOTS * VCHIQ_SLOT_SIZE);
  	frag_mem_size = PAGE_ALIGN(g_fragments_size * MAX_FRAGMENTS);
-@@ -501,13 +567,14 @@ static int vchiq_platform_init(struct pl
+@@ -496,13 +562,14 @@ static int vchiq_platform_init(struct pl
  	}
  
  	WARN_ON(((unsigned long)slot_mem & (PAGE_SIZE - 1)) != 0);
@@ -206,7 +206,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	vchiq_slot_zero->platform_data[VCHIQ_PLATFORM_FRAGMENTS_COUNT_IDX] =
  		MAX_FRAGMENTS;
  
-@@ -541,7 +608,6 @@ static int vchiq_platform_init(struct pl
+@@ -536,7 +603,6 @@ static int vchiq_platform_init(struct pl
  	}
  
  	/* Send the base address of the slots to VideoCore */
@@ -214,7 +214,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	err = rpi_firmware_property(fw, RPI_FIRMWARE_VCHIQ_INIT,
  				    &channelbase, sizeof(channelbase));
  	if (err) {
-@@ -555,6 +621,8 @@ static int vchiq_platform_init(struct pl
+@@ -550,6 +616,8 @@ static int vchiq_platform_init(struct pl
  		return -ENXIO;
  	}
  
@@ -223,7 +223,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	vchiq_log_info(vchiq_arm_log_level, "vchiq_init - done (slots %pK, phys %pad)",
  		       vchiq_slot_zero, &slot_phys);
  
-@@ -1768,6 +1836,7 @@ void vchiq_platform_conn_state_changed(s
+@@ -1755,6 +1823,7 @@ void vchiq_platform_conn_state_changed(s
  static const struct of_device_id vchiq_of_match[] = {
  	{ .compatible = "brcm,bcm2835-vchiq", .data = &bcm2835_drvdata },
  	{ .compatible = "brcm,bcm2836-vchiq", .data = &bcm2836_drvdata },
@@ -231,7 +231,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	{},
  };
  MODULE_DEVICE_TABLE(of, vchiq_of_match);
-@@ -1800,22 +1869,8 @@ vchiq_register_child(struct platform_dev
+@@ -1787,22 +1856,8 @@ vchiq_register_child(struct platform_dev
  
  	child->dev.of_node = np;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0298-staging-vchiq_arm-children-inherit-DMA-config.patch b/target/linux/bcm27xx/patches-6.6/950-0298-staging-vchiq_arm-children-inherit-DMA-config.patch
index b6fb2e9eda2f55..87bea65fc76523 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0298-staging-vchiq_arm-children-inherit-DMA-config.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0298-staging-vchiq_arm-children-inherit-DMA-config.patch
@@ -15,7 +15,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
 +++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
-@@ -1869,8 +1869,18 @@ vchiq_register_child(struct platform_dev
+@@ -1856,8 +1856,18 @@ vchiq_register_child(struct platform_dev
  
  	child->dev.of_node = np;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0299-staging-vchiq_arm-Usa-a-DMA-pool-for-small-bulks.patch b/target/linux/bcm27xx/patches-6.6/950-0299-staging-vchiq_arm-Usa-a-DMA-pool-for-small-bulks.patch
index bcd9dae853d5ab..162d333c6127e8 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0299-staging-vchiq_arm-Usa-a-DMA-pool-for-small-bulks.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0299-staging-vchiq_arm-Usa-a-DMA-pool-for-small-bulks.patch
@@ -37,7 +37,7 @@ Signed-off-by: Oliver Gjoneski <ogjoneski@gmail.com>
  /* Override the default prefix, which would be vchiq_arm (from the filename) */
  #undef MODULE_PARAM_PREFIX
  #define MODULE_PARAM_PREFIX DEVICE_NAME "."
-@@ -133,6 +136,7 @@ struct vchiq_pagelist_info {
+@@ -128,6 +131,7 @@ struct vchiq_pagelist_info {
  	struct pagelist *pagelist;
  	size_t pagelist_buffer_size;
  	dma_addr_t dma_addr;
@@ -45,7 +45,7 @@ Signed-off-by: Oliver Gjoneski <ogjoneski@gmail.com>
  	enum dma_data_direction dma_dir;
  	unsigned int num_pages;
  	unsigned int pages_need_release;
-@@ -153,6 +157,7 @@ static void __iomem *g_regs;
+@@ -148,6 +152,7 @@ static void __iomem *g_regs;
   * of 32.
   */
  static unsigned int g_cache_line_size = 32;
@@ -53,7 +53,7 @@ Signed-off-by: Oliver Gjoneski <ogjoneski@gmail.com>
  static unsigned int g_use_36bit_addrs = 0;
  static unsigned int g_fragments_size;
  static char *g_fragments_base;
-@@ -195,8 +200,13 @@ cleanup_pagelistinfo(struct vchiq_instan
+@@ -190,8 +195,13 @@ cleanup_pagelistinfo(struct vchiq_instan
  	if (pagelistinfo->pages_need_release)
  		unpin_user_pages(pagelistinfo->pages, pagelistinfo->num_pages);
  
@@ -69,7 +69,7 @@ Signed-off-by: Oliver Gjoneski <ogjoneski@gmail.com>
  }
  
  static inline bool
-@@ -231,6 +241,7 @@ create_pagelist(struct vchiq_instance *i
+@@ -226,6 +236,7 @@ create_pagelist(struct vchiq_instance *i
  	u32 *addrs;
  	unsigned int num_pages, offset, i, k;
  	int actual_pages;
@@ -77,7 +77,7 @@ Signed-off-by: Oliver Gjoneski <ogjoneski@gmail.com>
  	size_t pagelist_size;
  	struct scatterlist *scatterlist, *sg;
  	int dma_buffers;
-@@ -260,8 +271,14 @@ create_pagelist(struct vchiq_instance *i
+@@ -255,8 +266,14 @@ create_pagelist(struct vchiq_instance *i
  	/* Allocate enough storage to hold the page pointers and the page
  	 * list
  	 */
@@ -94,7 +94,7 @@ Signed-off-by: Oliver Gjoneski <ogjoneski@gmail.com>
  
  	vchiq_log_trace(vchiq_arm_log_level, "%s - %pK", __func__, pagelist);
  
-@@ -282,6 +299,7 @@ create_pagelist(struct vchiq_instance *i
+@@ -277,6 +294,7 @@ create_pagelist(struct vchiq_instance *i
  	pagelistinfo->pagelist = pagelist;
  	pagelistinfo->pagelist_buffer_size = pagelist_size;
  	pagelistinfo->dma_addr = dma_addr;
@@ -102,7 +102,7 @@ Signed-off-by: Oliver Gjoneski <ogjoneski@gmail.com>
  	pagelistinfo->dma_dir =  (type == PAGELIST_WRITE) ?
  				  DMA_TO_DEVICE : DMA_FROM_DEVICE;
  	pagelistinfo->num_pages = num_pages;
-@@ -622,6 +640,13 @@ static int vchiq_platform_init(struct pl
+@@ -617,6 +635,13 @@ static int vchiq_platform_init(struct pl
  	}
  
  	g_dma_dev = dma_dev ?: dev;

From 7bb99bca3dfd878e6ad950b218c0cb96d36d14f4 Mon Sep 17 00:00:00 2001
From: Shiji Yang <yangshiji66@qq.com>
Date: Fri, 22 Nov 2024 18:12:12 +0800
Subject: [PATCH 009/225] ramips: sync upstream Ralink clock patches

1. Add sdhc clock for MT7620 and MT76x8 SoCs.
2. Fix clock driver warning for RT2880, RT305x and RT3883.

Link: https://lore.kernel.org/all/20240910044024.120009-1-sergio.paracuellos@gmail.com/
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Link: https://github.com/openwrt/openwrt/pull/17037
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 target/linux/ramips/dts/mt7620a.dtsi          |  27 ++--
 target/linux/ramips/dts/mt7620n.dtsi          |  14 +-
 target/linux/ramips/dts/mt7628an.dtsi         |  23 ++--
 target/linux/ramips/dts/rt3883.dtsi           |  20 +--
 ...-fix-clock-plan-for-Ralink-SoC-RT38.patch} |  15 ++-
 ...s-fix-clocks-probe-order-in-oldest-r.patch | 124 ++++++++++++++++++
 ...s-add-mmc-related-clocks-for-SoCs-MT.patch | 101 ++++++++++++++
 7 files changed, 269 insertions(+), 55 deletions(-)
 rename target/linux/ramips/patches-6.6/{100-clk-ralink-mtmips-fix-clock-plan-for-Ralink-SoC-RT3883.patch => 002-01-v6.13-clk-ralink-mtmips-fix-clock-plan-for-Ralink-SoC-RT38.patch} (75%)
 create mode 100644 target/linux/ramips/patches-6.6/002-02-v6.13-clk-ralink-mtmips-fix-clocks-probe-order-in-oldest-r.patch
 create mode 100644 target/linux/ramips/patches-6.6/002-03-v6.13-clk-ralink-mtmips-add-mmc-related-clocks-for-SoCs-MT.patch

diff --git a/target/linux/ramips/dts/mt7620a.dtsi b/target/linux/ramips/dts/mt7620a.dtsi
index bcc7f4be3fa967..93b4286193a8e1 100644
--- a/target/linux/ramips/dts/mt7620a.dtsi
+++ b/target/linux/ramips/dts/mt7620a.dtsi
@@ -32,13 +32,6 @@
 		compatible = "mti,cpu-interrupt-controller";
 	};
 
-	mmc_clk: mmc-clock {
-		compatible = "fixed-clock";
-		#clock-cells = <0>;
-		clock-frequency = <48000000>;
-		clock-accuracy = <100>;
-	};
-
 	mmc_reg_1v8: regulator-1v8 {
 		compatible = "regulator-fixed";
 
@@ -80,7 +73,7 @@
 			compatible = "ralink,rt2880-timer";
 			reg = <0x100 0x20>;
 
-			clocks = <&sysc 5>;
+			clocks = <&sysc 7>;
 
 			interrupt-parent = <&intc>;
 			interrupts = <1>;
@@ -90,7 +83,7 @@
 			compatible = "ralink,rt2880-wdt";
 			reg = <0x120 0x10>;
 
-			clocks = <&sysc 6>;
+			clocks = <&sysc 8>;
 
 			resets = <&sysc 8>;
 			reset-names = "wdt";
@@ -122,7 +115,7 @@
 			compatible = "ralink,mt7620a-uart", "ralink,rt2880-uart", "ns16550a";
 			reg = <0x500 0x100>;
 
-			clocks = <&sysc 7>;
+			clocks = <&sysc 9>;
 
 			resets = <&sysc 12>;
 
@@ -216,7 +209,7 @@
 			compatible = "ralink,rt2880-i2c";
 			reg = <0x900 0x100>;
 
-			clocks = <&sysc 8>;
+			clocks = <&sysc 10>;
 
 			resets = <&sysc 16>;
 			reset-names = "i2c";
@@ -234,7 +227,7 @@
 			compatible = "mediatek,mt7620-i2s";
 			reg = <0xa00 0x100>;
 
-			clocks = <&sysc 9>;
+			clocks = <&sysc 11>;
 
 			resets = <&sysc 17>;
 			reset-names = "i2s";
@@ -256,7 +249,7 @@
 			compatible = "ralink,rt2880-spi";
 			reg = <0xb00 0x40>;
 
-			clocks = <&sysc 10>;
+			clocks = <&sysc 12>;
 
 			resets = <&sysc 18>;
 			reset-names = "spi";
@@ -274,7 +267,7 @@
 			compatible = "ralink,rt2880-spi";
 			reg = <0xb40 0x60>;
 
-			clocks = <&sysc 11>;
+			clocks = <&sysc 13>;
 
 			resets = <&sysc 18>;
 			reset-names = "spi";
@@ -292,7 +285,7 @@
 			compatible = "ralink,mt7620a-uart", "ralink,rt2880-uart", "ns16550a";
 			reg = <0xc00 0x100>;
 
-			clocks = <&sysc 12>;
+			clocks = <&sysc 14>;
 
 			resets = <&sysc 19>;
 
@@ -539,7 +532,7 @@
 		cap-mmc-highspeed;
 		cap-sd-highspeed;
 
-		clocks = <&mmc_clk>, <&mmc_clk>;
+		clocks = <&sysc 15>, <&sysc 15>;
 		clock-names = "source", "hclk";
 
 		disable-wp;
@@ -645,7 +638,7 @@
 		compatible = "ralink,rt7620-wmac", "ralink,rt2880-wmac";
 		reg = <0x10180000 0x40000>;
 
-		clocks = <&sysc 13>;
+		clocks = <&sysc 16>;
 
 		interrupt-parent = <&cpuintc>;
 		interrupts = <6>;
diff --git a/target/linux/ramips/dts/mt7620n.dtsi b/target/linux/ramips/dts/mt7620n.dtsi
index b284119961418a..64dbd0a50ea635 100644
--- a/target/linux/ramips/dts/mt7620n.dtsi
+++ b/target/linux/ramips/dts/mt7620n.dtsi
@@ -51,7 +51,7 @@
 			compatible = "ralink,rt2880-timer";
 			reg = <0x100 0x20>;
 
-			clocks = <&sysc 5>;
+			clocks = <&sysc 7>;
 
 			interrupt-parent = <&intc>;
 			interrupts = <1>;
@@ -61,7 +61,7 @@
 			compatible = "ralink,rt2880-wdt";
 			reg = <0x120 0x10>;
 
-			clocks = <&sysc 6>;
+			clocks = <&sysc 8>;
 
 			resets = <&sysc 8>;
 			reset-names = "wdt";
@@ -171,7 +171,7 @@
 			compatible = "ralink,rt2880-i2c";
 			reg = <0x900 0x100>;
 
-			clocks = <&sysc 8>;
+			clocks = <&sysc 10>;
 
 			resets = <&sysc 16>;
 			reset-names = "i2c";
@@ -189,7 +189,7 @@
 			compatible = "ralink,rt2880-spi";
 			reg = <0xb00 0x40>;
 
-			clocks = <&sysc 10>;
+			clocks = <&sysc 12>;
 
 			resets = <&sysc 18>;
 			reset-names = "spi";
@@ -207,7 +207,7 @@
 			compatible = "ralink,rt2880-spi";
 			reg = <0xb40 0x60>;
 
-			clocks = <&sysc 11>;
+			clocks = <&sysc 13>;
 
 			resets = <&sysc 18>;
 			reset-names = "spi";
@@ -225,7 +225,7 @@
 			compatible = "ralink,mt7620a-uart", "ralink,rt2880-uart", "ns16550a";
 			reg = <0xc00 0x100>;
 
-			clocks = <&sysc 12>;
+			clocks = <&sysc 14>;
 
 			resets = <&sysc 19>;
 
@@ -372,7 +372,7 @@
 		compatible = "ralink,rt7620-wmac", "ralink,rt2880-wmac";
 		reg = <0x10180000 0x40000>;
 
-		clocks = <&sysc 13>;
+		clocks = <&sysc 16>;
 
 		interrupt-parent = <&cpuintc>;
 		interrupts = <6>;
diff --git a/target/linux/ramips/dts/mt7628an.dtsi b/target/linux/ramips/dts/mt7628an.dtsi
index 445c53081509c1..239211b1e18bf3 100644
--- a/target/linux/ramips/dts/mt7628an.dtsi
+++ b/target/linux/ramips/dts/mt7628an.dtsi
@@ -30,13 +30,6 @@
 		compatible = "mti,cpu-interrupt-controller";
 	};
 
-	mmc_clk: mmc-clock {
-		compatible = "fixed-clock";
-		#clock-cells = <0>;
-		clock-frequency = <48000000>;
-		clock-accuracy = <100>;
-	};
-
 	mmc_reg_1v8: regulator-1v8 {
 		compatible = "regulator-fixed";
 
@@ -121,7 +114,7 @@
 			compatible = "mediatek,mt7621-i2c";
 			reg = <0x900 0x100>;
 
-			clocks = <&sysc 7>;
+			clocks = <&sysc 9>;
 			clock-names = "i2c";
 
 			resets = <&sysc 16>;
@@ -140,7 +133,7 @@
 			compatible = "mediatek,mt7628-i2s";
 			reg = <0xa00 0x100>;
 
-			clocks = <&sysc 8>;
+			clocks = <&sysc 10>;
 
 			resets = <&sysc 17>;
 			reset-names = "i2s";
@@ -162,7 +155,7 @@
 			compatible = "ralink,mt7621-spi";
 			reg = <0xb00 0x100>;
 
-			clocks = <&sysc 9>;
+			clocks = <&sysc 11>;
 			clock-names = "spi";
 
 			resets = <&sysc 18>;
@@ -185,7 +178,7 @@
 			reg-io-width = <4>;
 			no-loopback-test;
 
-			clocks = <&sysc 11>;
+			clocks = <&sysc 13>;
 
 			resets = <&sysc 12>;
 
@@ -204,7 +197,7 @@
 			reg-io-width = <4>;
 			no-loopback-test;
 
-			clocks = <&sysc 12>;
+			clocks = <&sysc 14>;
 
 			resets = <&sysc 19>;
 
@@ -225,7 +218,7 @@
 			reg-io-width = <4>;
 			no-loopback-test;
 
-			clocks = <&sysc 13>;
+			clocks = <&sysc 15>;
 
 			resets = <&sysc 20>;
 
@@ -393,7 +386,7 @@
 		cap-mmc-highspeed;
 		cap-sd-highspeed;
 
-		clocks = <&mmc_clk>, <&mmc_clk>;
+		clocks = <&sysc 16>, <&sysc 16>;
 		clock-names = "source", "hclk";
 
 		disable-wp;
@@ -516,7 +509,7 @@
 		compatible = "mediatek,mt7628-wmac";
 		reg = <0x10300000 0x100000>;
 
-		clocks = <&sysc 14>;
+		clocks = <&sysc 17>;
 
 		interrupt-parent = <&cpuintc>;
 		interrupts = <6>;
diff --git a/target/linux/ramips/dts/rt3883.dtsi b/target/linux/ramips/dts/rt3883.dtsi
index 509d1c21e84d36..363b1959b67bf3 100644
--- a/target/linux/ramips/dts/rt3883.dtsi
+++ b/target/linux/ramips/dts/rt3883.dtsi
@@ -51,7 +51,7 @@
 			compatible = "ralink,rt2880-timer";
 			reg = <0x100 0x20>;
 
-			clocks = <&sysc 4>;
+			clocks = <&sysc 5>;
 
 			interrupt-parent = <&intc>;
 			interrupts = <1>;
@@ -61,7 +61,7 @@
 			compatible = "ralink,rt2880-wdt";
 			reg = <0x120 0x10>;
 
-			clocks = <&sysc 5>;
+			clocks = <&sysc 6>;
 
 			resets = <&sysc 8>;
 			reset-names = "wdt";
@@ -93,7 +93,7 @@
 			compatible = "ralink,rt3883-uart", "ralink,rt2880-uart", "ns16550a";
 			reg = <0x500 0x100>;
 
-			clocks = <&sysc 6>;
+			clocks = <&sysc 7>;
 
 			resets = <&sysc 12>;
 
@@ -187,7 +187,7 @@
 			compatible = "ralink,rt2880-i2c";
 			reg = <0x900 0x100>;
 
-			clocks = <&sysc 7>;
+			clocks = <&sysc 8>;
 
 			resets = <&sysc 16>;
 			reset-names = "i2c";
@@ -205,7 +205,7 @@
 			compatible = "ralink,rt3883-i2s";
 			reg = <0xa00 0x100>;
 
-			clocks = <&sysc 8>;
+			clocks = <&sysc 9>;
 
 			resets = <&sysc 17>;
 			reset-names = "i2s";
@@ -229,7 +229,7 @@
 			#address-cells = <1>;
 			#size-cells = <0>;
 
-			clocks = <&sysc 9>;
+			clocks = <&sysc 10>;
 
 			resets = <&sysc 18>;
 			reset-names = "spi";
@@ -246,7 +246,7 @@
 			#address-cells = <1>;
 			#size-cells = <0>;
 
-			clocks = <&sysc 10>;
+			clocks = <&sysc 11>;
 
 			resets = <&sysc 18>;
 			reset-names = "spi";
@@ -261,7 +261,7 @@
 			compatible = "ralink,rt3883-uart", "ralink,rt2880-uart", "ns16550a";
 			reg = <0xc00 0x100>;
 
-			clocks = <&sysc 11>;
+			clocks = <&sysc 12>;
 
 			resets = <&sysc 19>;
 
@@ -343,7 +343,7 @@
 		#size-cells = <0>;
 		reg = <0x10100000 0x10000>;
 
-		clocks = <&sysc 12>;
+		clocks = <&sysc 13>;
 
 		resets = <&sysc 21>;
 		reset-names = "fe";
@@ -463,7 +463,7 @@
 		compatible = "ralink,rt3883-wmac", "ralink,rt2880-wmac";
 		reg = <0x10180000 0x40000>;
 
-		clocks = <&sysc 13>;
+		clocks = <&sysc 14>;
 
 		interrupt-parent = <&cpuintc>;
 		interrupts = <6>;
diff --git a/target/linux/ramips/patches-6.6/100-clk-ralink-mtmips-fix-clock-plan-for-Ralink-SoC-RT3883.patch b/target/linux/ramips/patches-6.6/002-01-v6.13-clk-ralink-mtmips-fix-clock-plan-for-Ralink-SoC-RT38.patch
similarity index 75%
rename from target/linux/ramips/patches-6.6/100-clk-ralink-mtmips-fix-clock-plan-for-Ralink-SoC-RT3883.patch
rename to target/linux/ramips/patches-6.6/002-01-v6.13-clk-ralink-mtmips-fix-clock-plan-for-Ralink-SoC-RT38.patch
index a3d58b78f6de73..422b6dcfb07799 100644
--- a/target/linux/ramips/patches-6.6/100-clk-ralink-mtmips-fix-clock-plan-for-Ralink-SoC-RT3883.patch
+++ b/target/linux/ramips/patches-6.6/002-01-v6.13-clk-ralink-mtmips-fix-clock-plan-for-Ralink-SoC-RT38.patch
@@ -1,6 +1,7 @@
-Subject: [PATCH] clk: ralink: mtmips: fix clock plan for Ralink SoC RT3883
-Date: Tue,  6 Aug 2024 16:29:02 +0200
-Message-Id: <20240806142902.224164-1-sergio.paracuellos@gmail.com>
+From 33239152305567b3e9bf052f71fd4baecd626341 Mon Sep 17 00:00:00 2001
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Date: Tue, 10 Sep 2024 06:40:22 +0200
+Subject: [PATCH 1/3] clk: ralink: mtmips: fix clock plan for Ralink SoC RT3883
 
 Clock plan for Ralink SoC RT3883 needs an extra 'periph' clock to properly
 set some peripherals that has this clock as their parent. When this driver
@@ -14,6 +15,8 @@ properly working clock plan for this SoC.
 
 Fixes: 6f3b15586eef ("clk: ralink: add clock and reset driver for MTMIPS SoCs")
 Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Link: https://lore.kernel.org/r/20240910044024.120009-2-sergio.paracuellos@gmail.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
 ---
  drivers/clk/ralink/clk-mtmips.c | 9 +++++++--
  1 file changed, 7 insertions(+), 2 deletions(-)
@@ -24,7 +27,7 @@ Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
  	CLK_FIXED("xtal", NULL, 40000000)
  };
  
-+static struct mtmips_clk_fixed rt3383_fixed_clocks[] = {
++static struct mtmips_clk_fixed rt3883_fixed_clocks[] = {
 +	CLK_FIXED("xtal", NULL, 40000000),
 +	CLK_FIXED("periph", "xtal", 40000000)
 +};
@@ -38,8 +41,8 @@ Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
  	.num_clk_base = ARRAY_SIZE(rt3883_clks_base),
 -	.clk_fixed = rt305x_fixed_clocks,
 -	.num_clk_fixed = ARRAY_SIZE(rt305x_fixed_clocks),
-+	.clk_fixed = rt3383_fixed_clocks,
-+	.num_clk_fixed = ARRAY_SIZE(rt3383_fixed_clocks),
++	.clk_fixed = rt3883_fixed_clocks,
++	.num_clk_fixed = ARRAY_SIZE(rt3883_fixed_clocks),
  	.clk_factor = NULL,
  	.num_clk_factor = 0,
  	.clk_periph = rt5350_pherip_clks,
diff --git a/target/linux/ramips/patches-6.6/002-02-v6.13-clk-ralink-mtmips-fix-clocks-probe-order-in-oldest-r.patch b/target/linux/ramips/patches-6.6/002-02-v6.13-clk-ralink-mtmips-fix-clocks-probe-order-in-oldest-r.patch
new file mode 100644
index 00000000000000..3268a18dac704f
--- /dev/null
+++ b/target/linux/ramips/patches-6.6/002-02-v6.13-clk-ralink-mtmips-fix-clocks-probe-order-in-oldest-r.patch
@@ -0,0 +1,124 @@
+From d34db686a3d74bd564bfce2ada15011c556269fc Mon Sep 17 00:00:00 2001
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Date: Tue, 10 Sep 2024 06:40:23 +0200
+Subject: [PATCH 2/3] clk: ralink: mtmips: fix clocks probe order in oldest
+ ralink SoCs
+
+Base clocks are the first in being probed and are real dependencies of the
+rest of fixed, factor and peripheral clocks. For old ralink SoCs RT2880,
+RT305x and RT3883 'xtal' must be defined first since in any other case,
+when fixed clocks are probed they are delayed until 'xtal' is probed so the
+following warning appears:
+
+ WARNING: CPU: 0 PID: 0 at drivers/clk/ralink/clk-mtmips.c:499 rt3883_bus_recalc_rate+0x98/0x138
+ Modules linked in:
+ CPU: 0 PID: 0 Comm: swapper Not tainted 6.6.43 #0
+ Stack : 805e58d0 00000000 00000004 8004f950 00000000 00000004 00000000 00000000
+ 80669c54 80830000 80700000 805ae570 80670068 00000001 80669bf8 00000000
+ 00000000 00000000 805ae570 80669b38 00000020 804db7dc 00000000 00000000
+ 203a6d6d 80669b78 80669e48 70617773 00000000 805ae570 00000000 00000009
+ 00000000 00000001 00000004 00000001 00000000 00000000 83fe43b0 00000000
+ ...
+ Call Trace:
+ [<800065d0>] show_stack+0x64/0xf4
+ [<804bca14>] dump_stack_lvl+0x38/0x60
+ [<800218ac>] __warn+0x94/0xe4
+ [<8002195c>] warn_slowpath_fmt+0x60/0x94
+ [<80259ff8>] rt3883_bus_recalc_rate+0x98/0x138
+ [<80254530>] __clk_register+0x568/0x688
+ [<80254838>] of_clk_hw_register+0x18/0x2c
+ [<8070b910>] rt2880_clk_of_clk_init_driver+0x18c/0x594
+ [<8070b628>] of_clk_init+0x1c0/0x23c
+ [<806fc448>] plat_time_init+0x58/0x18c
+ [<806fdaf0>] time_init+0x10/0x6c
+ [<806f9bc4>] start_kernel+0x458/0x67c
+
+ ---[ end trace 0000000000000000 ]---
+
+When this driver was mainlined we could not find any active users of old
+ralink SoCs so we cannot perform any real tests for them. Now, one user
+of a Belkin f9k1109 version 1 device which uses RT3883 SoC appeared and
+reported some issues in openWRT:
+- https://github.com/openwrt/openwrt/issues/16054
+
+Thus, define a 'rt2880_xtal_recalc_rate()' just returning the expected
+frequency 40Mhz and use it along the old ralink SoCs to have a correct
+boot trace with no warnings and a working clock plan from the beggining.
+
+Fixes: 6f3b15586eef ("clk: ralink: add clock and reset driver for MTMIPS SoCs")
+Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Link: https://lore.kernel.org/r/20240910044024.120009-3-sergio.paracuellos@gmail.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+---
+ drivers/clk/ralink/clk-mtmips.c | 21 +++++++++++++--------
+ 1 file changed, 13 insertions(+), 8 deletions(-)
+
+--- a/drivers/clk/ralink/clk-mtmips.c
++++ b/drivers/clk/ralink/clk-mtmips.c
+@@ -263,10 +263,6 @@ err_clk_unreg:
+ 		.rate = _rate		 \
+ 	}
+ 
+-static struct mtmips_clk_fixed rt305x_fixed_clocks[] = {
+-	CLK_FIXED("xtal", NULL, 40000000)
+-};
+-
+ static struct mtmips_clk_fixed rt3883_fixed_clocks[] = {
+ 	CLK_FIXED("xtal", NULL, 40000000),
+ 	CLK_FIXED("periph", "xtal", 40000000)
+@@ -371,6 +367,12 @@ static inline struct mtmips_clk *to_mtmi
+ 	return container_of(hw, struct mtmips_clk, hw);
+ }
+ 
++static unsigned long rt2880_xtal_recalc_rate(struct clk_hw *hw,
++					     unsigned long parent_rate)
++{
++	return 40000000;
++}
++
+ static unsigned long rt5350_xtal_recalc_rate(struct clk_hw *hw,
+ 					     unsigned long parent_rate)
+ {
+@@ -682,10 +684,12 @@ static unsigned long mt76x8_cpu_recalc_r
+ }
+ 
+ static struct mtmips_clk rt2880_clks_base[] = {
++	{ CLK_BASE("xtal", NULL, rt2880_xtal_recalc_rate) },
+ 	{ CLK_BASE("cpu", "xtal", rt2880_cpu_recalc_rate) }
+ };
+ 
+ static struct mtmips_clk rt305x_clks_base[] = {
++	{ CLK_BASE("xtal", NULL, rt2880_xtal_recalc_rate) },
+ 	{ CLK_BASE("cpu", "xtal", rt305x_cpu_recalc_rate) }
+ };
+ 
+@@ -695,6 +699,7 @@ static struct mtmips_clk rt3352_clks_bas
+ };
+ 
+ static struct mtmips_clk rt3883_clks_base[] = {
++	{ CLK_BASE("xtal", NULL, rt2880_xtal_recalc_rate) },
+ 	{ CLK_BASE("cpu", "xtal", rt3883_cpu_recalc_rate) },
+ 	{ CLK_BASE("bus", "cpu", rt3883_bus_recalc_rate) }
+ };
+@@ -751,8 +756,8 @@ err_clk_unreg:
+ static const struct mtmips_clk_data rt2880_clk_data = {
+ 	.clk_base = rt2880_clks_base,
+ 	.num_clk_base = ARRAY_SIZE(rt2880_clks_base),
+-	.clk_fixed = rt305x_fixed_clocks,
+-	.num_clk_fixed = ARRAY_SIZE(rt305x_fixed_clocks),
++	.clk_fixed = NULL,
++	.num_clk_fixed = 0,
+ 	.clk_factor = rt2880_factor_clocks,
+ 	.num_clk_factor = ARRAY_SIZE(rt2880_factor_clocks),
+ 	.clk_periph = rt2880_pherip_clks,
+@@ -762,8 +767,8 @@ static const struct mtmips_clk_data rt28
+ static const struct mtmips_clk_data rt305x_clk_data = {
+ 	.clk_base = rt305x_clks_base,
+ 	.num_clk_base = ARRAY_SIZE(rt305x_clks_base),
+-	.clk_fixed = rt305x_fixed_clocks,
+-	.num_clk_fixed = ARRAY_SIZE(rt305x_fixed_clocks),
++	.clk_fixed = NULL,
++	.num_clk_fixed = 0,
+ 	.clk_factor = rt305x_factor_clocks,
+ 	.num_clk_factor = ARRAY_SIZE(rt305x_factor_clocks),
+ 	.clk_periph = rt305x_pherip_clks,
diff --git a/target/linux/ramips/patches-6.6/002-03-v6.13-clk-ralink-mtmips-add-mmc-related-clocks-for-SoCs-MT.patch b/target/linux/ramips/patches-6.6/002-03-v6.13-clk-ralink-mtmips-add-mmc-related-clocks-for-SoCs-MT.patch
new file mode 100644
index 00000000000000..b90a19b7ca2548
--- /dev/null
+++ b/target/linux/ramips/patches-6.6/002-03-v6.13-clk-ralink-mtmips-add-mmc-related-clocks-for-SoCs-MT.patch
@@ -0,0 +1,101 @@
+From 198675bbc03d437fb80a35d781ad13d622d0ff68 Mon Sep 17 00:00:00 2001
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Date: Tue, 10 Sep 2024 06:40:24 +0200
+Subject: [PATCH 3/3] clk: ralink: mtmips: add mmc related clocks for SoCs
+ MT7620, MT7628 and MT7688
+
+Original architecture clock code from where this driver was derived did not
+include nothing related to mmc clocks. OpenWRT people started to use mtk-sd
+upstream driver recently and they were forced to use a dts 'fixed-clock'
+node with 48 MHz clock:
+- https://github.com/openwrt/openwrt/pull/15896
+The proper thing to do to avoid that is to add the mmc related clocks to the
+driver to avoid a dts with fixed clocks nodes. The minimal documentation in
+the mt7620 programming guide says that there is a BBP_PLL clock of 480 MHz
+derived from the 40 MHz XTAL and from there a clock divider by ten produces
+the desired SDHC clock of 48 MHz for the mmc. Hence add a fixed clock 'bbppll'
+and factor clock 'sdhc' ten divider child to properly set the 'mmc' peripheral
+clock with the desired 48 Mhz rate.
+
+Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Link: https://lore.kernel.org/r/20240910044024.120009-4-sergio.paracuellos@gmail.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+---
+ drivers/clk/ralink/clk-mtmips.c | 30 +++++++++++++++++++++++-------
+ 1 file changed, 23 insertions(+), 7 deletions(-)
+
+--- a/drivers/clk/ralink/clk-mtmips.c
++++ b/drivers/clk/ralink/clk-mtmips.c
+@@ -207,6 +207,7 @@ static struct mtmips_clk mt7620_pherip_c
+ 	{ CLK_PERIPH("10000b00.spi", "bus") },
+ 	{ CLK_PERIPH("10000b40.spi", "bus") },
+ 	{ CLK_PERIPH("10000c00.uartlite", "periph") },
++	{ CLK_PERIPH("10130000.mmc", "sdhc") },
+ 	{ CLK_PERIPH("10180000.wmac", "xtal") }
+ };
+ 
+@@ -220,6 +221,7 @@ static struct mtmips_clk mt76x8_pherip_c
+ 	{ CLK_PERIPH("10000c00.uart0", "periph") },
+ 	{ CLK_PERIPH("10000d00.uart1", "periph") },
+ 	{ CLK_PERIPH("10000e00.uart2", "periph") },
++	{ CLK_PERIPH("10130000.mmc", "sdhc") },
+ 	{ CLK_PERIPH("10300000.wmac", "xtal") }
+ };
+ 
+@@ -272,8 +274,13 @@ static struct mtmips_clk_fixed rt3352_fi
+ 	CLK_FIXED("periph", "xtal", 40000000)
+ };
+ 
++static struct mtmips_clk_fixed mt7620_fixed_clocks[] = {
++	CLK_FIXED("bbppll", "xtal", 480000000)
++};
++
+ static struct mtmips_clk_fixed mt76x8_fixed_clocks[] = {
+-	CLK_FIXED("pcmi2s", "xtal", 480000000),
++	CLK_FIXED("bbppll", "xtal", 480000000),
++	CLK_FIXED("pcmi2s", "bbppll", 480000000),
+ 	CLK_FIXED("periph", "xtal", 40000000)
+ };
+ 
+@@ -328,6 +335,15 @@ static struct mtmips_clk_factor rt305x_f
+ 	CLK_FACTOR("bus", "cpu", 1, 3)
+ };
+ 
++static struct mtmips_clk_factor mt7620_factor_clocks[] = {
++	CLK_FACTOR("sdhc", "bbppll", 1, 10)
++};
++
++static struct mtmips_clk_factor mt76x8_factor_clocks[] = {
++	CLK_FACTOR("bus", "cpu", 1, 3),
++	CLK_FACTOR("sdhc", "bbppll", 1, 10)
++};
++
+ static int mtmips_register_factor_clocks(struct clk_hw_onecell_data *clk_data,
+ 					 struct mtmips_clk_priv *priv)
+ {
+@@ -811,10 +827,10 @@ static const struct mtmips_clk_data rt53
+ static const struct mtmips_clk_data mt7620_clk_data = {
+ 	.clk_base = mt7620_clks_base,
+ 	.num_clk_base = ARRAY_SIZE(mt7620_clks_base),
+-	.clk_fixed = NULL,
+-	.num_clk_fixed = 0,
+-	.clk_factor = NULL,
+-	.num_clk_factor = 0,
++	.clk_fixed = mt7620_fixed_clocks,
++	.num_clk_fixed = ARRAY_SIZE(mt7620_fixed_clocks),
++	.clk_factor = mt7620_factor_clocks,
++	.num_clk_factor = ARRAY_SIZE(mt7620_factor_clocks),
+ 	.clk_periph = mt7620_pherip_clks,
+ 	.num_clk_periph = ARRAY_SIZE(mt7620_pherip_clks),
+ };
+@@ -824,8 +840,8 @@ static const struct mtmips_clk_data mt76
+ 	.num_clk_base = ARRAY_SIZE(mt76x8_clks_base),
+ 	.clk_fixed = mt76x8_fixed_clocks,
+ 	.num_clk_fixed = ARRAY_SIZE(mt76x8_fixed_clocks),
+-	.clk_factor = rt305x_factor_clocks,
+-	.num_clk_factor = ARRAY_SIZE(rt305x_factor_clocks),
++	.clk_factor = mt76x8_factor_clocks,
++	.num_clk_factor = ARRAY_SIZE(mt76x8_factor_clocks),
+ 	.clk_periph = mt76x8_pherip_clks,
+ 	.num_clk_periph = ARRAY_SIZE(mt76x8_pherip_clks),
+ };

From 75af6a0d736a696ca726cb44d813791858c29f0c Mon Sep 17 00:00:00 2001
From: Til Kaiser <mail@tk154.de>
Date: Fri, 15 Nov 2024 16:49:14 +0100
Subject: [PATCH 010/225] x86: add all ports to the Gowin 1U default network
 config

Commit e52c57bb1b30375e0bcc5523db76a672a4a8b4a4 renamed all
network ports to match the faceplate of the Gowin 1U Rack
Mount Server and added the br-lan bridge for the eth* ports.

This commit adds the PoE port to the br-lan bridge and a
br-wan bridge for the two SFP ports so that all ports are
part of the default network configuration.

Signed-off-by: Til Kaiser <mail@tk154.de>
Link: https://github.com/openwrt/openwrt/pull/16965
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 target/linux/x86/base-files/etc/board.d/02_network | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/linux/x86/base-files/etc/board.d/02_network b/target/linux/x86/base-files/etc/board.d/02_network
index dc744db05d6315..b3d1855764be11 100644
--- a/target/linux/x86/base-files/etc/board.d/02_network
+++ b/target/linux/x86/base-files/etc/board.d/02_network
@@ -58,7 +58,7 @@ gowin-solution-co-ltd-gw-mb-u01)
 		ucidef_set_network_device_path_port "sfp2" "$sfp_device/$sfp_port" "0"
 	fi
 
-	ucidef_set_interface_lan "eth1 eth2 eth3 eth4"
+	ucidef_set_interfaces_lan_wan "eth1 eth2 eth3 eth4 poe" "sfp1 sfp2"
 	;;
 pc-engines-apu1|pc-engines-apu2|pc-engines-apu3)
 	ucidef_set_interfaces_lan_wan "eth1 eth2" "eth0"

From d8a9669093359d60f4d6f183b58a22f24cf01731 Mon Sep 17 00:00:00 2001
From: Romanov Danila <pervokur@gmail.com>
Date: Mon, 21 Oct 2024 21:34:34 +0300
Subject: [PATCH 011/225] mediatek: change Routerich AX3000 ubi size All new
 routers are shipped with ubi size 112MB since early September. Bootloader
 update required (ask vendor , see wiki)

These partitions weren't used:
firmware_backup
zrsave
config2

Signed-off-by: Romanov Danila <pervokur@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16686
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 .../mediatek/dts/mt7981b-routerich-ax3000.dts | 20 +------------------
 .../base-files/etc/board.d/05_compat-version  |  3 +++
 target/linux/mediatek/image/filogic.mk        |  5 +++++
 3 files changed, 9 insertions(+), 19 deletions(-)

diff --git a/target/linux/mediatek/dts/mt7981b-routerich-ax3000.dts b/target/linux/mediatek/dts/mt7981b-routerich-ax3000.dts
index dfe44843b9df79..aa6a15ee1d1209 100644
--- a/target/linux/mediatek/dts/mt7981b-routerich-ax3000.dts
+++ b/target/linux/mediatek/dts/mt7981b-routerich-ax3000.dts
@@ -226,25 +226,7 @@
 
 			partition@580000 {
 				label = "ubi";
-				reg = <0x580000 0x4000000>;
-			};
-
-			partition@4580000 {
-				label = "firmware_backup";
-				reg = <0x4580000 0x2000000>;
-				read-only;
-			};
-
-			partition@6580000 {
-				label = "zrsave";
-				reg = <0x6580000 0x100000>;
-				read-only;
-			};
-
-			partition@6680000 {
-				label = "config2";
-				reg = <0x6680000 0x100000>;
-				read-only;
+				reg = <0x580000 0x7000000>;
 			};
 		};
 	};
diff --git a/target/linux/mediatek/filogic/base-files/etc/board.d/05_compat-version b/target/linux/mediatek/filogic/base-files/etc/board.d/05_compat-version
index d0cfd8f0a1232e..9b704b983cb7f0 100644
--- a/target/linux/mediatek/filogic/base-files/etc/board.d/05_compat-version
+++ b/target/linux/mediatek/filogic/base-files/etc/board.d/05_compat-version
@@ -8,6 +8,9 @@ case "$(board_name)" in
 	bananapi,bpi-r3)
 		ucidef_set_compat_version "1.2"
 		;;
+	routerich,ax3000)
+		ucidef_set_compat_version "1.1"
+		;;
 esac
 
 board_config_flush
diff --git a/target/linux/mediatek/image/filogic.mk b/target/linux/mediatek/image/filogic.mk
index 739fd543085c60..cb5c102b1e2b64 100644
--- a/target/linux/mediatek/image/filogic.mk
+++ b/target/linux/mediatek/image/filogic.mk
@@ -1173,6 +1173,11 @@ define Device/routerich_ax3000
   DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware kmod-usb3
   IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
   SUPPORTED_DEVICES += mediatek,mt7981-spim-snand-rfb
+  DEVICE_COMPAT_VERSION := 1.1
+  DEVICE_COMPAT_MESSAGE := Partition layout has been changed. Bootloader MUST be \
+	upgraded to avoid data corruption and getting bricked. \
+	Please, contact your vendor and follow the guide: \
+	https://openwrt.org/toh/routerich/ax3000#web_ui_method
 endef
 TARGET_DEVICES += routerich_ax3000
 

From dedb90e8f82a179ad67b6eac3b6f8862b9183077 Mon Sep 17 00:00:00 2001
From: Thomas Richard <thomas.richard@bootlin.com>
Date: Thu, 26 Sep 2024 16:10:26 +0200
Subject: [PATCH 012/225] build: add generic build template for optee-os
 packages

Add a generic template include/optee-os.mk to build OP-TEE.

Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
Link: https://github.com/openwrt/openwrt/pull/16716
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 include/optee-os.mk | 113 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 113 insertions(+)
 create mode 100644 include/optee-os.mk

diff --git a/include/optee-os.mk b/include/optee-os.mk
new file mode 100644
index 00000000000000..396d2406bfac92
--- /dev/null
+++ b/include/optee-os.mk
@@ -0,0 +1,113 @@
+include $(INCLUDE_DIR)/prereq.mk
+
+PKG_NAME ?= optee-os
+
+ifndef PKG_SOURCE_PROTO
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL_FILE:=$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL = https://github.com/OP-TEE/optee_os/archive/refs/tags/
+TAR_OPTIONS+= --transform 's/optee_os/$(PKG_NAME)/'
+endif
+
+PKG_BUILD_DIR = $(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION)
+
+PKG_TARGETS := bin
+PKG_FLAGS:=nonshared
+
+PKG_LICENSE:=BSD 2-Clause
+PKG_LICENSE_FILES:=LICENSE
+
+PKG_BUILD_PARALLEL ?= 1
+
+$(eval $(call TestHostCommand,python3-cryptography, \
+  Please install the Python3 cryptography module, \
+  $(STAGING_DIR_HOST)/bin/python3 -c 'import cryptography'))
+
+$(eval $(call TestHostCommand,python3-pyelftools, \
+    Please install the Python3 pyelftools module, \
+    $(STAGING_DIR_HOST)/bin/python3 -c 'import elftools'))
+
+export GCC_HONOUR_COPTS=s
+
+define Package/optee-os/install/default
+	$(CP) $(patsubst %,$(PKG_BUILD_DIR)/out/arm-plat-$(PLAT)/core/%,$(OPTEE_IMAGE)) $(1)/
+endef
+
+Package/optee-os/install = $(Package/optee-os/install/default)
+
+define Optee-os/Init
+  BUILD_TARGET:=
+  BUILD_SUBTARGET:=
+  BUILD_DEVICES:=
+  NAME:=
+  DEPENDS:=
+  HIDDEN:=
+  DEFAULT:=
+  VARIANT:=$(1)
+  PLAT:=$(1)
+  PLAT_FLAVOR:=
+  OPTEE_IMAGE:=tee-header_v2.bin tee-pager_v2.bin tee-pageable_v2.bin
+endef
+
+TARGET_DEP = TARGET_$(BUILD_TARGET)$(if $(BUILD_SUBTARGET),_$(BUILD_SUBTARGET))
+
+define Build/Optee-os/Target
+  $(eval $(call Optee-os/Init,$(1)))
+  $(eval $(call Optee-os/Default,$(1)))
+  $(eval $(call Optee-os/$(1),$(1)))
+
+  define Package/optee-os-$(1)
+    SECTION:=boot
+    CATEGORY:=Boot Loaders
+    TITLE:=OPTEE-OS for $(NAME)
+    VARIANT:=$(VARIANT)
+    DEPENDS:=@!IN_SDK $(DEPENDS)
+    HIDDEN:=$(HIDDEN)
+    ifneq ($(BUILD_TARGET),)
+      DEPENDS += @$(TARGET_DEP)
+      ifneq ($(BUILD_DEVICES),)
+        DEFAULT := y if ($(TARGET_DEP)_Default \
+		$(patsubst %,|| $(TARGET_DEP)_DEVICE_%,$(BUILD_DEVICES)) \
+		$(patsubst %,|| $(patsubst TARGET_%,TARGET_DEVICE_%,$(TARGET_DEP))_DEVICE_%,$(BUILD_DEVICES)))
+      endif
+    endif
+    $(if $(DEFAULT),DEFAULT:=$(DEFAULT))
+    URL:=https://optee.readthedocs.io
+  endef
+
+  define Package/optee-os-$(1)/install
+	$$(Package/optee-os/install)
+  endef
+endef
+
+define Build/Configure/Optee-os
+endef
+
+define Build/Compile/Optee-os
+	+$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) \
+		PATH=$(LINUX_DIR)/scripts/dtc/:$(PATH) \
+		CROSS_COMPILE=$(TARGET_CROSS) \
+		CROSS_COMPILE_core="$(TARGET_CROSS)" \
+		CROSS_COMPILE_ta_arm64="$(TARGET_CROSS)" \
+		CROSS_COMPILE_ta_arm32="$(TARGET_CROSS)" \
+		$(if $(CONFIG_ARCH_64BIT), CFG_ARM64_core=y CFG_USER_TA_TARGETS=ta_arm64, CFG_ARM32_core=y) \
+		PLATFORM="$(PLAT)" \
+		PLATFORM_FLAVOR="$(call qstrip,$(PLAT_FLAVOR))" \
+		$(OPTEE_MAKE_FLAGS)
+endef
+
+define BuildPackage/Optee-os/Defaults
+  Build/Configure/Default = $$$$(Build/Configure/Optee-os)
+  Build/Compile/Default = $$$$(Build/Compile/Optee-os)
+endef
+
+define BuildPackage/Optee-os
+  $(eval $(call BuildPackage/Optee-os/Defaults))
+  $(foreach type,$(if $(DUMP),$(OPTEE_TARGETS),$(BUILD_VARIANT)), \
+    $(eval $(call Build/Optee-os/Target,$(type)))
+  )
+  $(eval $(call Build/DefaultTargets))
+  $(foreach type,$(if $(DUMP),$(OPTEE_TARGETS),$(BUILD_VARIANT)), \
+    $(call BuildPackage,optee-os-$(type))
+  )
+endef

From fae25d4001bcbae0bb1ce60b676bd421e97d78fc Mon Sep 17 00:00:00 2001
From: Thomas Richard <thomas.richard@bootlin.com>
Date: Thu, 26 Sep 2024 16:19:35 +0200
Subject: [PATCH 013/225] optee-os-stm32: add OP-TEE for stm32 boards

Add OP-TEE for stm32 boards, with the first being STM32MP135F-DK.

Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
Link: https://github.com/openwrt/openwrt/pull/16716
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 package/boot/optee-os-stm32/Makefile | 49 ++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 package/boot/optee-os-stm32/Makefile

diff --git a/package/boot/optee-os-stm32/Makefile b/package/boot/optee-os-stm32/Makefile
new file mode 100644
index 00000000000000..9e681127e6a1b2
--- /dev/null
+++ b/package/boot/optee-os-stm32/Makefile
@@ -0,0 +1,49 @@
+#
+# Copyright (C) 2024 Bootlin
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_VERSION:=4.3.0
+PKG_RELEASE:=1
+
+PKG_HASH:=390b271905c828d6def9fa6a77bbaa425f3b434d733c8eb18f582ccbc6896096
+PKG_MAINTAINER:=Thomas Richard <thomas.richard@bootlin.com>
+
+OPTEE_USE_INTREE_DTC:=1
+
+include $(INCLUDE_DIR)/kernel.mk
+include $(INCLUDE_DIR)/optee-os.mk
+include $(INCLUDE_DIR)/package.mk
+
+define Optee-os/Default
+  BUILD_TARGET:=stm32
+endef
+
+define Optee-os/stm32mp1
+  BUILD_SUBTARGET:=stm32mp1
+  PLAT:=stm32mp1
+endef
+
+define Optee-os/stm32mp135f-dk
+  $(call Optee-os/stm32mp1)
+  NAME:=STM32MP135F-DK
+  PLAT_FLAVOR:=135F_DK
+endef
+
+OPTEE_TARGETS := stm32mp135f-dk
+
+define Package/optee-os/install/default
+endef
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(STAGING_DIR_IMAGE)
+	$(foreach img,$(OPTEE_IMAGE), \
+		$(CP) $(PKG_BUILD_DIR)/out/arm-plat-$(PLAT)/core/$(img) $(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-$(img); \
+	)
+endef
+
+$(eval $(call BuildPackage/Optee-os))

From ac79ad0757764028a138d0138c8d9aa74420f9ed Mon Sep 17 00:00:00 2001
From: Thomas Richard <thomas.richard@bootlin.com>
Date: Thu, 26 Sep 2024 16:24:26 +0200
Subject: [PATCH 014/225] uboot-stm32: add U-Boot for stm32 boards

Add U-Boot for stm32 boards, with the first being STM32MP135F-DK.

Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
Link: https://github.com/openwrt/openwrt/pull/16716
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 package/boot/uboot-stm32/Makefile | 51 +++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100644 package/boot/uboot-stm32/Makefile

diff --git a/package/boot/uboot-stm32/Makefile b/package/boot/uboot-stm32/Makefile
new file mode 100644
index 00000000000000..58754aedd5a7c5
--- /dev/null
+++ b/package/boot/uboot-stm32/Makefile
@@ -0,0 +1,51 @@
+#
+# Copyright (C) 2024 Bootlin
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_VERSION:=2024.07
+PKG_RELEASE:=1
+
+PKG_HASH:=f591da9ab90ef3d6b3d173766d0ddff90c4ed7330680897486117df390d83c8f
+PKG_MAINTAINER:=Thomas Richard <thomas.richard@bootlin.com>
+
+UBOOT_USE_INTREE_DTC:=1
+
+include $(INCLUDE_DIR)/u-boot.mk
+include $(INCLUDE_DIR)/package.mk
+
+define U-Boot/Default
+  BUILD_TARGET:=stm32
+  UBOOT_IMAGE:=u-boot.bin u-boot.dtb
+endef
+
+define U-Boot/stm32mp13
+  BUILD_SUBTARGET:=stm32mp1
+  UBOOT_CONFIG:=stm32mp13
+endef
+
+define U-Boot/stm32mp135f-dk
+  $(call U-Boot/stm32mp13)
+  NAME:=STM32MP135F-DK
+  DEVICE_TREE:=stm32mp135f-dk
+endef
+
+UBOOT_TARGETS := stm32mp135f-dk
+
+UBOOT_MAKE_FLAGS += DEVICE_TREE=$(DEVICE_TREE)
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(STAGING_DIR_IMAGE)
+	$(foreach img,$(UBOOT_IMAGE), \
+		$(CP) $(PKG_BUILD_DIR)/$(img) $(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-$(img); \
+	)
+endef
+
+define Package/u-boot/install/default
+endef
+
+$(eval $(call BuildPackage/U-Boot))

From 08dcb73c8d05aa774957422731bfed1b322648d7 Mon Sep 17 00:00:00 2001
From: Thomas Richard <thomas.richard@bootlin.com>
Date: Thu, 26 Sep 2024 16:29:41 +0200
Subject: [PATCH 015/225] arm-trusted-firmware-stm32: add ATF for stm32 boards

Add ATF for stm32 boards, with the first being STM32MP135F-DK.

Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
Link: https://github.com/openwrt/openwrt/pull/16716
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 .../boot/arm-trusted-firmware-stm32/Makefile  | 63 +++++++++++++++++++
 1 file changed, 63 insertions(+)
 create mode 100644 package/boot/arm-trusted-firmware-stm32/Makefile

diff --git a/package/boot/arm-trusted-firmware-stm32/Makefile b/package/boot/arm-trusted-firmware-stm32/Makefile
new file mode 100644
index 00000000000000..75a92f15af6a37
--- /dev/null
+++ b/package/boot/arm-trusted-firmware-stm32/Makefile
@@ -0,0 +1,63 @@
+#
+# Copyright (C) 2024 Bootlin
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_VERSION:=2.10
+PKG_RELEASE:=1
+
+PKG_HASH:=88215a62291b9ba87da8e50b077741103cdc08fb6c9e1ebd34dfaace746d3201
+PKG_MAINTAINER:=Thomas Richard <thomas.richard@bootlin.com>
+
+include $(INCLUDE_DIR)/kernel.mk
+include $(INCLUDE_DIR)/trusted-firmware-a.mk
+include $(INCLUDE_DIR)/package.mk
+
+define Trusted-Firmware-A/Default
+  BUILD_TARGET:=stm32
+  BUILD_DEVICES:=$(1)
+  DEPENDS:=+u-boot-$(1) +optee-os-$(1)
+endef
+
+define Trusted-Firmware-A/stm32mp1
+  BUILD_SUBTARGET:=stm32mp1
+  PLAT:=stm32mp1
+  MAKE_ARGS += BL32_EXTRA2=$(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-tee-pageable_v2.bin \
+	       STM32MP_USB_PROGRAMMER=1 \
+	       STM32MP1_OPTEE_IN_SYSRAM=1 \
+	       ARM_ARCH_MAJOR=7
+endef
+
+define Trusted-Firmware-A/stm32mp135f-dk
+  $(call Trusted-Firmware-A/stm32mp1)
+  NAME:=STM32MP135F-DK
+  DTB_FILE_NAME=stm32mp135f-dk.dtb
+endef
+
+TFA_TARGETS := stm32mp135f-dk
+
+TFA_MAKE_FLAGS += \
+		ARCH=aarch32 AARCH32_SP=optee \
+		BL32=$(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-tee-header_v2.bin \
+		BL32_EXTRA1=$(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-tee-pager_v2.bin \
+		BL33=$(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-u-boot.bin \
+		BL33_CFG=$(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-u-boot.dtb \
+		DTB_FILE_NAME=$(DTB_FILE_NAME) \
+		STM32MP_SDMMC=1 \
+		TARGET_BOARD="" \
+		$(MAKE_ARGS) \
+		all fip
+
+define Package/trusted-firmware-a/install
+	$(INSTALL_DIR) $(STAGING_DIR_IMAGE)
+	$(CP) $(PKG_BUILD_DIR)/build/$(PLAT)/release/tf-a-$(BUILD_VARIANT).stm32 \
+		$(STAGING_DIR_IMAGE)/tf-a-$(BUILD_VARIANT).stm32
+	$(CP) $(PKG_BUILD_DIR)/build/$(PLAT)/release/fip.bin \
+		$(STAGING_DIR_IMAGE)/fip-$(BUILD_VARIANT).bin
+endef
+
+$(eval $(call BuildPackage/Trusted-Firmware-A))

From 456e0aad97413816aee41e68b3d3cfdfadc2fd43 Mon Sep 17 00:00:00 2001
From: Thomas Richard <thomas.richard@bootlin.com>
Date: Tue, 24 Sep 2024 18:06:28 +0200
Subject: [PATCH 016/225] mac80211: enable CONFIG_BRCMFMAC_SDIO for stm32

All stm32 devices use BCM43430 Wi-Fi interface in SDIO mode.

Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
Link: https://github.com/openwrt/openwrt/pull/16716
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 package/kernel/mac80211/broadcom.mk | 1 +
 1 file changed, 1 insertion(+)

diff --git a/package/kernel/mac80211/broadcom.mk b/package/kernel/mac80211/broadcom.mk
index a6f42cd19af21b..444d705ab31bfc 100644
--- a/package/kernel/mac80211/broadcom.mk
+++ b/package/kernel/mac80211/broadcom.mk
@@ -437,6 +437,7 @@ define KernelPackage/brcmfmac/config
 		default y if TARGET_starfive
 		default y if TARGET_rockchip
 		default y if TARGET_sunxi
+		default y if TARGET_stm32
 		default n
 		help
 		  Enable support for cards attached to an SDIO bus.

From 960f5f94d7cefe89abd41347124fd3f0fbb945ae Mon Sep 17 00:00:00 2001
From: Thomas Richard <thomas.richard@bootlin.com>
Date: Thu, 10 Oct 2024 17:19:38 +0200
Subject: [PATCH 017/225] murata-firmware: add new package

This package contains firmwares provided by Murata.
See https://community.murata.com/.

Murata firmwares are used by wifi chip on stm32 boards.

Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
Link: https://github.com/openwrt/openwrt/pull/16716
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 package/firmware/murata-firmware/Makefile | 57 +++++++++++++++++++++++
 1 file changed, 57 insertions(+)
 create mode 100644 package/firmware/murata-firmware/Makefile

diff --git a/package/firmware/murata-firmware/Makefile b/package/firmware/murata-firmware/Makefile
new file mode 100644
index 00000000000000..1d9efda576201c
--- /dev/null
+++ b/package/firmware/murata-firmware/Makefile
@@ -0,0 +1,57 @@
+#
+# Copyright (C) 2024 Bootlin
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=murata-firmware
+PKG_RELEASE:=1
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_DATE:=2024-09-12
+PKG_SOURCE_URL:=https://github.com/murata-wireless/cyw-fmac-fw.git
+PKG_MIRROR_HASH:=26f8a2df800666daab183b2842e5b3d591b1e5b31769d5429f9d70527f43d152
+PKG_SOURCE_VERSION:=50ac17bb65b2342cd954d49d9bc492709d431c3c
+
+PKG_MAINTAINER:=Thomas Richard <thomas.richard@bootlin.com>
+PKG_LICENSE_FILES:=LICENCE
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/murata-firmware-default
+  SECTION:=firmware
+  CATEGORY:=Firmware
+  URL:=https://community.murata.com/
+endef
+
+define Build/Compile
+endef
+
+define Package/murata-firmware-43430-sdio
+  $(Package/murata-firmware-default)
+  TITLE:=BCM43430 FullMac SDIO firmware
+  CONFLICTS:=cypress-firmware-43430-sdio
+endef
+
+define Package/murata-firmware-43430-sdio/install
+	$(INSTALL_DIR) $(1)/lib/firmware/murata
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/cyfmac43430-sdio.bin \
+		$(1)/lib/firmware/murata/
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/cyfmac43430-sdio.1DX.clm_blob \
+		$(1)/lib/firmware/murata/
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(LN) \
+		../murata/cyfmac43430-sdio.bin \
+		$(1)/lib/firmware/brcm/brcmfmac43430-sdio.bin
+	$(LN) \
+		../murata/cyfmac43430-sdio.1DX.clm_blob \
+		$(1)/lib/firmware/brcm/brcmfmac43430-sdio.clm_blob
+endef
+
+$(eval $(call BuildPackage,murata-firmware-43430-sdio))
+

From be937952fdf8f78fb45ea001258074ddb45e0891 Mon Sep 17 00:00:00 2001
From: Thomas Richard <thomas.richard@bootlin.com>
Date: Thu, 10 Oct 2024 17:21:16 +0200
Subject: [PATCH 018/225] murata-nvram: add new package

This package contains nvram files for Murata's Wi-Fi/Bluetooth modules.

Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
Link: https://github.com/openwrt/openwrt/pull/16716
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 package/firmware/murata-nvram/Makefile        | 48 +++++++++++++++++++
 .../files/cyfmac43430-sdio.1DX.stm32.txt      | 47 ++++++++++++++++++
 2 files changed, 95 insertions(+)
 create mode 100644 package/firmware/murata-nvram/Makefile
 create mode 100755 package/firmware/murata-nvram/files/cyfmac43430-sdio.1DX.stm32.txt

diff --git a/package/firmware/murata-nvram/Makefile b/package/firmware/murata-nvram/Makefile
new file mode 100644
index 00000000000000..daf382e3bc003d
--- /dev/null
+++ b/package/firmware/murata-nvram/Makefile
@@ -0,0 +1,48 @@
+#
+# Copyright (C) 2024 Bootlin
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=murata-nvram
+PKG_RELEASE:=1
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_DATE:=2024-09-28
+PKG_SOURCE_URL:=https://github.com/murata-wireless/cyw-fmac-nvram.git
+PKG_MIRROR_HASH:=e2fc6f1f9898edfd67f5495e615882700f03b42a75efa2e3f4e2d524aed0efb8
+PKG_SOURCE_VERSION:=255819aab07572d87576a13329ef9d4c654167aa
+
+PKG_MAINTAINER:=Thomas Richard <thomas.richard@bootlin.com>
+PKG_LICENSE_FILES:=LICENCE.cypress
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/murata-nvram-default
+  SECTION:=firmware
+  CATEGORY:=Firmware
+  URL:=https://community.murata.com/
+endef
+
+define Build/Compile
+endef
+
+define Package/murata-nvram-43430-sdio
+  $(Package/murata-nvram-default)
+  TITLE:=BCM43430 SDIO NVRAM
+  CONFLICTS:=brcmfmac-nvram-43430-sdio
+endef
+
+define Package/murata-nvram-43430-sdio/install
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DATA)	./files/cyfmac43430-sdio.1DX.stm32.txt \
+		$(1)/lib/firmware/brcm/
+	$(LN) \
+		cyfmac43430-sdio.1DX.stm32.txt \
+		$(1)/lib/firmware/brcm/brcmfmac43430-sdio.st,stm32mp135f-dk.txt
+endef
+
+$(eval $(call BuildPackage,murata-nvram-43430-sdio))
diff --git a/package/firmware/murata-nvram/files/cyfmac43430-sdio.1DX.stm32.txt b/package/firmware/murata-nvram/files/cyfmac43430-sdio.1DX.stm32.txt
new file mode 100755
index 00000000000000..f06abf03808e94
--- /dev/null
+++ b/package/firmware/murata-nvram/files/cyfmac43430-sdio.1DX.stm32.txt
@@ -0,0 +1,47 @@
+# This NVRAM file is based on cyfmac43430-sdio.1DX.txt, except that the muxenab
+# parameter was unset to enable IB IRQ (OOB IRQ is not stable on STM32
+# platforms).
+# 2.4 GHz, 20 MHz BW mode
+manfid=0x2d0
+prodid=0x0726
+vendid=0x14e4
+devid=0x43e2
+boardtype=0x0726
+boardrev=0x1202
+boardnum=22
+macaddr=00:90:4c:c5:12:38
+sromrev=11
+boardflags=0x00404201
+boardflags3=0x08000000
+xtalfreq=37400
+nocrc=1
+ag0=0
+aa2g=1
+ccode=ALL
+#pa0itssit=0x20
+extpagain2g=0
+pa2ga0=-145,6667,-751
+AvVmid_c0=0x0,0xc8
+cckpwroffset0=2
+maxp2ga0=74
+#txpwrbckof=6
+cckbw202gpo=0
+legofdmbw202gpo=0x88888888
+mcsbw202gpo=0xaaaaaaaa
+propbw202gpo=0xdd
+ofdmdigfilttype=18
+ofdmdigfilttypebe=18
+papdmode=1
+papdvalidtest=1
+pacalidx2g=48
+papdepsoffset=-22
+papdendidx=58
+il0macaddr=00:90:4c:c5:12:38
+wl0id=0x431b
+# muxenab defined to enable OOB IRQ. Level sensitive interrupt via WL_HOST_WAKE line. 
+# muxenab=0x10
+#BT COEX deferral limit setting
+#btc_params 8 45000
+#btc_params 10 20000
+#spurconfig=0x3
+# End of NVRAM - do not remove this line #

From ff96bd84ce0bae633007cf0de82d69796cf3508a Mon Sep 17 00:00:00 2001
From: Thomas Richard <thomas.richard@bootlin.com>
Date: Fri, 25 Oct 2024 15:20:38 +0200
Subject: [PATCH 019/225] kernel: package industrialio-hw-consumer driver

It is needed for the stm32/stm32mp1 subtarget.

Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
Link: https://github.com/openwrt/openwrt/pull/16716
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 package/kernel/linux/modules/iio.mk | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/package/kernel/linux/modules/iio.mk b/package/kernel/linux/modules/iio.mk
index e46544b79cc65c..b9bcaad5b20623 100644
--- a/package/kernel/linux/modules/iio.mk
+++ b/package/kernel/linux/modules/iio.mk
@@ -46,6 +46,23 @@ endef
 $(eval $(call KernelPackage,iio-kfifo-buf))
 
 
+define KernelPackage/industrialio-hw-consumer
+  TITLE:=Provides a bonding way to an other device in hardware
+  KCONFIG:=CONFIG_IIO_BUFFER_HW_CONSUMER
+  FILES:=$(LINUX_DIR)/drivers/iio/buffer/industrialio-hw-consumer.ko
+  AUTOLOAD:=$(call AutoLoad,55,industrialio-hw-consumer)
+  $(call AddDepends/iio,+kmod-iio-kfifo-buf)
+endef
+
+define KernelPackage/industrialio-hw-consumer/description
+ Provides a way to bonding when an IIO device has a direct connection
+ to another device in hardware. In this case buffers for data transfers
+ are handled by hardware.
+endef
+
+$(eval $(call KernelPackage,industrialio-hw-consumer))
+
+
 define KernelPackage/industrialio-triggered-buffer
   TITLE:=Provides helper functions for setting up triggered buffers.
   DEPENDS:=+kmod-iio-kfifo-buf

From e606366a2e018e0a3b25e3dd4b3a937bb53c70e1 Mon Sep 17 00:00:00 2001
From: Thomas Richard <thomas.richard@bootlin.com>
Date: Fri, 25 Oct 2024 15:21:57 +0200
Subject: [PATCH 020/225] kernel: package snd-soc-dmic driver

It is needed for the stm32/stm32mp1 subtarget.

Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
Link: https://github.com/openwrt/openwrt/pull/16716
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 package/kernel/linux/modules/sound.mk | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/package/kernel/linux/modules/sound.mk b/package/kernel/linux/modules/sound.mk
index 623f65ac59add1..f3e44e01eee82d 100644
--- a/package/kernel/linux/modules/sound.mk
+++ b/package/kernel/linux/modules/sound.mk
@@ -314,6 +314,17 @@ endef
 $(eval $(call KernelPackage,sound-soc-spdif))
 
 
+define KernelPackage/sound-soc-dmic
+  TITLE:=Generic Digital Microphone CODEC
+  KCONFIG:=CONFIG_SND_SOC_DMIC
+  FILES:=$(LINUX_DIR)/sound/soc/codecs/snd-soc-dmic.ko
+  AUTOLOAD:=$(call AutoProbe,snd-soc-dmic)
+  $(call AddDepends/sound,+kmod-sound-soc-core)
+endef
+
+$(eval $(call KernelPackage,sound-soc-dmic))
+
+
 define KernelPackage/pcspkr
   DEPENDS:=@TARGET_x86 +kmod-input-core
   TITLE:=PC speaker support

From 6b9df468f05fefa21a8cbce2fdb2e59692b4d246 Mon Sep 17 00:00:00 2001
From: Thomas Richard <thomas.richard@bootlin.com>
Date: Fri, 25 Oct 2024 15:23:26 +0200
Subject: [PATCH 021/225] kernel: unset CONFIG_DEVFREQ_THERMAL in kmod-thermal
 package

It is needed for the stm32/stm32mp1 subtarget.

Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
Link: https://github.com/openwrt/openwrt/pull/16716
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 package/kernel/linux/modules/other.mk | 1 +
 1 file changed, 1 insertion(+)

diff --git a/package/kernel/linux/modules/other.mk b/package/kernel/linux/modules/other.mk
index bbebcf37ec1adb..7b64985fd69e7d 100644
--- a/package/kernel/linux/modules/other.mk
+++ b/package/kernel/linux/modules/other.mk
@@ -961,6 +961,7 @@ define KernelPackage/thermal
 	CONFIG_THERMAL=y \
 	CONFIG_THERMAL_OF=y \
 	CONFIG_CPU_THERMAL=y \
+	CONFIG_DEVFREQ_THERMAL=n \
 	CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y \
 	CONFIG_THERMAL_DEFAULT_GOV_FAIR_SHARE=n \
 	CONFIG_THERMAL_DEFAULT_GOV_USER_SPACE=n \

From 7bcc68ede36dcc66ec6cdb45c3201e0af0f90708 Mon Sep 17 00:00:00 2001
From: Thomas Richard <thomas.richard@bootlin.com>
Date: Tue, 5 Nov 2024 10:38:49 +0100
Subject: [PATCH 022/225] kernel: package crypto_engine driver

It is needed for the stm32/stm32mp1 subtarget.

Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
Link: https://github.com/openwrt/openwrt/pull/16716
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 package/kernel/linux/modules/crypto.mk | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/package/kernel/linux/modules/crypto.mk b/package/kernel/linux/modules/crypto.mk
index ce221635470302..2257a36c802cda 100644
--- a/package/kernel/linux/modules/crypto.mk
+++ b/package/kernel/linux/modules/crypto.mk
@@ -249,6 +249,15 @@ endef
 
 $(eval $(call KernelPackage,crypto-echainiv))
 
+define KernelPackage/crypto-engine
+  TITLE:=Crypto engine
+  KCONFIG:=CONFIG_CRYPTO_ENGINE
+  FILES:=$(LINUX_DIR)/crypto/crypto_engine.ko
+  AUTOLOAD:=$(call AutoLoad,09,crypto_engine)
+  $(call AddDepends/crypto, +kmod-crypto-rsa +kmod-crypto-kpp)
+endef
+
+$(eval $(call KernelPackage,crypto-engine))
 
 define KernelPackage/crypto-essiv
   TITLE:=ESSIV support for block encryption

From b0adf5e0fdc0d4b449bced9191a95bf08124c1ac Mon Sep 17 00:00:00 2001
From: Thomas Richard <thomas.richard@bootlin.com>
Date: Tue, 5 Nov 2024 10:39:47 +0100
Subject: [PATCH 023/225] kernel: package industrialio-buffer-cb driver

It is needed for the stm32/stm32mp1 subtarget.

Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
Link: https://github.com/openwrt/openwrt/pull/16716
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 package/kernel/linux/modules/iio.mk | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/package/kernel/linux/modules/iio.mk b/package/kernel/linux/modules/iio.mk
index b9bcaad5b20623..e98a6830da0342 100644
--- a/package/kernel/linux/modules/iio.mk
+++ b/package/kernel/linux/modules/iio.mk
@@ -63,6 +63,21 @@ endef
 $(eval $(call KernelPackage,industrialio-hw-consumer))
 
 
+define KernelPackage/industrialio-buffer-cb
+  TITLE:=Provides callback buffer used for push in-kernel interfaces
+  KCONFIG:=CONFIG_IIO_BUFFER_CB
+  FILES:=$(LINUX_DIR)/drivers/iio/buffer/industrialio-buffer-cb.ko
+  AUTOLOAD:=$(call AutoLoad,55,industrialio-triggered-buffer-cb)
+  $(call AddDepends/iio)
+endef
+
+define KernelPackage/industrialio-buffer-cb/description
+ Should be selected by any drivers that do in-kernel push usage.
+endef
+
+$(eval $(call KernelPackage,industrialio-buffer-cb))
+
+
 define KernelPackage/industrialio-triggered-buffer
   TITLE:=Provides helper functions for setting up triggered buffers.
   DEPENDS:=+kmod-iio-kfifo-buf

From bb3418f21f7b8fe0dcd335375d183dd2a81772bf Mon Sep 17 00:00:00 2001
From: Thomas Richard <thomas.richard@bootlin.com>
Date: Tue, 5 Nov 2024 11:10:44 +0100
Subject: [PATCH 024/225] kernel: package media controller driver

It is needed for the stm32/stm32mp1 subtarget.

Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
Link: https://github.com/openwrt/openwrt/pull/16716
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 package/kernel/linux/modules/video.mk | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/package/kernel/linux/modules/video.mk b/package/kernel/linux/modules/video.mk
index f2fa82fd039c78..486b9b9ab1f0b7 100644
--- a/package/kernel/linux/modules/video.mk
+++ b/package/kernel/linux/modules/video.mk
@@ -12,6 +12,28 @@ V4L2_DIR=v4l2-core
 V4L2_USB_DIR=usb
 V4L2_MEM2MEM_DIR=platform
 
+#
+# Media
+#
+define KernelPackage/media-controller
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=Media Controller API
+  KCONFIG:= \
+	CONFIG_MEDIA_SUPPORT \
+	CONFIG_MEDIA_CONTROLLER=y
+  FILES:= \
+	$(LINUX_DIR)/drivers/media/mc/mc.ko
+  AUTOLOAD:=$(call AutoProbe,mc)
+endef
+
+define KernelPackage/media-controller/description
+ Kernel modules for media controller API used to query media devices
+ internal topology and configure it dynamically.
+endef
+
+$(eval $(call KernelPackage,media-controller))
+
+
 #
 # Video Display
 #
@@ -601,9 +623,8 @@ $(eval $(call KernelPackage,drm-radeon))
 define KernelPackage/video-core
   SUBMENU:=$(VIDEO_MENU)
   TITLE=Video4Linux support
-  DEPENDS:=+PACKAGE_kmod-i2c-core:kmod-i2c-core
+  DEPENDS:=+PACKAGE_kmod-i2c-core:kmod-i2c-core +kmod-media-controller
   KCONFIG:= \
-	CONFIG_MEDIA_SUPPORT \
 	CONFIG_MEDIA_CAMERA_SUPPORT=y \
 	CONFIG_VIDEO_DEV \
 	CONFIG_V4L_PLATFORM_DRIVERS=y \

From 109592524663ae8bbda47e4ad51a124153a1c903 Mon Sep 17 00:00:00 2001
From: Thomas Richard <thomas.richard@bootlin.com>
Date: Tue, 5 Nov 2024 11:23:36 +0100
Subject: [PATCH 025/225] kernel: add kmod-media-controller dependency for
 kmod-usb-audio

The snd-usb-audio drivers uses media controller if media controller is set.
So add kmod-media-controller as dependency.

Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
Link: https://github.com/openwrt/openwrt/pull/16716
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 package/kernel/linux/modules/usb.mk | 1 +
 1 file changed, 1 insertion(+)

diff --git a/package/kernel/linux/modules/usb.mk b/package/kernel/linux/modules/usb.mk
index 458c8c4ba68f86..466c547e8ab2dd 100644
--- a/package/kernel/linux/modules/usb.mk
+++ b/package/kernel/linux/modules/usb.mk
@@ -576,6 +576,7 @@ define KernelPackage/usb-audio
 	CONFIG_SND_USB_AUDIO
   $(call AddDepends/usb)
   $(call AddDepends/sound)
+  DEPENDS+=kmod-media-controller
   FILES:= \
 	$(LINUX_DIR)/sound/usb/snd-usbmidi-lib.ko \
 	$(LINUX_DIR)/sound/usb/snd-usb-audio.ko

From e109831e07e398cc50839a30a1cf18c4436983f4 Mon Sep 17 00:00:00 2001
From: Thomas Richard <thomas.richard@bootlin.com>
Date: Tue, 5 Nov 2024 11:13:34 +0100
Subject: [PATCH 026/225] kernel: package v4l2-async and v4l2-fwnode drivers

These packages are needed for the stm32/stm32mp1 subtarget.

Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
Link: https://github.com/openwrt/openwrt/pull/16716
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 package/kernel/linux/modules/video.mk | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/package/kernel/linux/modules/video.mk b/package/kernel/linux/modules/video.mk
index 486b9b9ab1f0b7..9bb030bf57fd0d 100644
--- a/package/kernel/linux/modules/video.mk
+++ b/package/kernel/linux/modules/video.mk
@@ -680,6 +680,25 @@ endef
 
 $(eval $(call KernelPackage,video-videobuf2))
 
+define KernelPackage/video-async
+  TITLE:=V4L2 ASYNC support
+  KCONFIG:=CONFIG_V4L2_ASYNC
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_DIR)/v4l2-async.ko
+  $(call AddDepends/video)
+  AUTOLOAD:=$(call AutoProbe,v4l2-async)
+endef
+
+$(eval $(call KernelPackage,video-async))
+
+define KernelPackage/video-fwnode
+  TITLE:=V4L2 FWNODE support
+  KCONFIG:=CONFIG_V4L2_FWNODE
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_DIR)/v4l2-fwnode.ko
+  $(call AddDepends/video,+kmod-video-async)
+  AUTOLOAD:=$(call AutoProbe,v4l2-fwnode)
+endef
+
+$(eval $(call KernelPackage,video-fwnode))
 
 define KernelPackage/video-cpia2
   TITLE:=CPIA2 video driver

From 851e7f77e424f24cda8531330f2d82ebc942c0a4 Mon Sep 17 00:00:00 2001
From: Thomas Richard <thomas.richard@bootlin.com>
Date: Thu, 26 Sep 2024 16:55:22 +0200
Subject: [PATCH 027/225] stm32: add new stm32 target

New stm32 target introduces support for stm32mp1 based devices.
For now it includes an initial support of the STM32MP135F-DK device.
The specifications bellow only list supported features.

Specifications
--------------

SOC: STM32MP135FAF7
RAM: 512 MiB
Storage: SD Card
Ethernet: 2x 100 Mbps
Wireless: 2.4GHz Cypress CYW43455 (802.11b/g/n)
LEDs: Heartbeat (Blue)
Buttons: 1x Reset, 1x User (USER2)
USB: 4x 2.0 Type-A

Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
Link: https://github.com/openwrt/openwrt/pull/16716
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 target/linux/stm32/Makefile                   |   24 +
 .../stm32/base-files/etc/board.d/02_network   |   18 +
 .../base-files/lib/preinit/79_move_config     |   15 +
 .../stm32/base-files/lib/upgrade/platform.sh  |  181 +++
 target/linux/stm32/image/Makefile             |   63 +
 target/linux/stm32/image/extlinux.conf        |    4 +
 .../linux/stm32/image/gen_stm32_sdcard_img.sh |   35 +
 target/linux/stm32/modules.mk                 |  256 ++++
 ...-stm32-use-devm_stmmac_probe_config_.patch |   69 +
 ...ac-dwmac-stm32-refactor-clock-config.patch |  241 ++++
 ...-stm32-Separate-out-external-clock-r.patch |  125 ++
 ...-stm32-Separate-out-external-clock-s.patch |  132 ++
 ...mac-stm32-Extract-PMCR-configuration.patch |   71 +
 ...wmac-stm32-Clean-up-the-debug-prints.patch |   83 ++
 ...-stm32-Mask-support-for-PMCR-configu.patch |  101 ++
 ...-stm32-add-management-of-stm32mp13-f.patch |   94 ++
 ...d-ETZPC-as-a-system-bus-for-STM32MP1.patch | 1192 +++++++++++++++++
 ...t-ETZPC-as-an-access-controller-for-.patch |  265 ++++
 ...d-ethernet1-2-RMII-pins-for-STM32MP1.patch |  126 ++
 ...d-ethernet1-and-ethernet2-support-on.patch |  108 ++
 ...d-ethernet1-for-STM32MP135F-DK-board.patch |   58 +
 ...tm32-add-SDIO-in-band-interrupt-mode.patch |  166 +++
 ...32-add-pinctrl-and-pinmux-interfaces.patch |  189 +++
 ...-Low-Speed-Clock-Output-LSCO-support.patch |  253 ++++
 ...c-add-pin-to-provide-LSCO-on-stm32mp.patch |   31 +
 ...c-add-LSCO-to-WLAN-BT-module-on-stm3.patch |   34 +
 ...d-support-of-WLAN-BT-on-stm32mp135f-.patch |   84 ++
 ...-stm32-add-support-of-phy-supply-pro.patch |  106 ++
 ...d-ethernet2-for-STM32MP135F-DK-board.patch |   53 +
 target/linux/stm32/stm32mp1/config-6.6        |  485 +++++++
 target/linux/stm32/stm32mp1/target.mk         |   12 +
 31 files changed, 4674 insertions(+)
 create mode 100644 target/linux/stm32/Makefile
 create mode 100644 target/linux/stm32/base-files/etc/board.d/02_network
 create mode 100644 target/linux/stm32/base-files/lib/preinit/79_move_config
 create mode 100644 target/linux/stm32/base-files/lib/upgrade/platform.sh
 create mode 100644 target/linux/stm32/image/Makefile
 create mode 100644 target/linux/stm32/image/extlinux.conf
 create mode 100755 target/linux/stm32/image/gen_stm32_sdcard_img.sh
 create mode 100644 target/linux/stm32/modules.mk
 create mode 100644 target/linux/stm32/patches-6.6/001-net-stmmac-dwmac-stm32-use-devm_stmmac_probe_config_.patch
 create mode 100644 target/linux/stm32/patches-6.6/002-net-stmmac-dwmac-stm32-refactor-clock-config.patch
 create mode 100644 target/linux/stm32/patches-6.6/003-net-stmmac-dwmac-stm32-Separate-out-external-clock-r.patch
 create mode 100644 target/linux/stm32/patches-6.6/004-net-stmmac-dwmac-stm32-Separate-out-external-clock-s.patch
 create mode 100644 target/linux/stm32/patches-6.6/005-net-stmmac-dwmac-stm32-Extract-PMCR-configuration.patch
 create mode 100644 target/linux/stm32/patches-6.6/006-net-stmmac-dwmac-stm32-Clean-up-the-debug-prints.patch
 create mode 100644 target/linux/stm32/patches-6.6/007-net-stmmac-dwmac-stm32-Mask-support-for-PMCR-configu.patch
 create mode 100644 target/linux/stm32/patches-6.6/008-net-stmmac-dwmac-stm32-add-management-of-stm32mp13-f.patch
 create mode 100644 target/linux/stm32/patches-6.6/009-ARM-dts-stm32-add-ETZPC-as-a-system-bus-for-STM32MP1.patch
 create mode 100644 target/linux/stm32/patches-6.6/010-ARM-dts-stm32-put-ETZPC-as-an-access-controller-for-.patch
 create mode 100644 target/linux/stm32/patches-6.6/011-ARM-dts-stm32-add-ethernet1-2-RMII-pins-for-STM32MP1.patch
 create mode 100644 target/linux/stm32/patches-6.6/012-ARM-dts-stm32-add-ethernet1-and-ethernet2-support-on.patch
 create mode 100644 target/linux/stm32/patches-6.6/013-ARM-dts-stm32-add-ethernet1-for-STM32MP135F-DK-board.patch
 create mode 100644 target/linux/stm32/patches-6.6/020-mmc-mmci-stm32-add-SDIO-in-band-interrupt-mode.patch
 create mode 100644 target/linux/stm32/patches-6.6/030-rtc-stm32-add-pinctrl-and-pinmux-interfaces.patch
 create mode 100644 target/linux/stm32/patches-6.6/031-rtc-stm32-add-Low-Speed-Clock-Output-LSCO-support.patch
 create mode 100644 target/linux/stm32/patches-6.6/032-ARM-dts-stm32-rtc-add-pin-to-provide-LSCO-on-stm32mp.patch
 create mode 100644 target/linux/stm32/patches-6.6/033-ARM-dts-stm32-rtc-add-LSCO-to-WLAN-BT-module-on-stm3.patch
 create mode 100644 target/linux/stm32/patches-6.6/034-ARM-dts-stm32-add-support-of-WLAN-BT-on-stm32mp135f-.patch
 create mode 100644 target/linux/stm32/patches-6.6/700-net-stmmac-dwmac-stm32-add-support-of-phy-supply-pro.patch
 create mode 100644 target/linux/stm32/patches-6.6/900-ARM-dts-stm32-add-ethernet2-for-STM32MP135F-DK-board.patch
 create mode 100644 target/linux/stm32/stm32mp1/config-6.6
 create mode 100644 target/linux/stm32/stm32mp1/target.mk

diff --git a/target/linux/stm32/Makefile b/target/linux/stm32/Makefile
new file mode 100644
index 00000000000000..3020d0b2b8e5b7
--- /dev/null
+++ b/target/linux/stm32/Makefile
@@ -0,0 +1,24 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2024 Bootlin
+#
+
+include $(TOPDIR)/rules.mk
+
+BOARD:=stm32
+BOARDNAME:=STMicroelectronics STM32
+FEATURES:=boot-part emmc ext4 gpio rtc usb
+SUBTARGETS:=stm32mp1
+CPU_TYPE:=
+
+KERNEL_PATCHVER:=6.6
+
+include $(INCLUDE_DIR)/target.mk
+
+DEFAULT_PACKAGES += blockdev kmod-gpio-button-hotplug
+
+define Target/Description
+	Build firmware image for STM32 devices
+endef
+
+$(eval $(call BuildTarget))
diff --git a/target/linux/stm32/base-files/etc/board.d/02_network b/target/linux/stm32/base-files/etc/board.d/02_network
new file mode 100644
index 00000000000000..a96fada9a4e332
--- /dev/null
+++ b/target/linux/stm32/base-files/etc/board.d/02_network
@@ -0,0 +1,18 @@
+
+. /lib/functions/uci-defaults.sh
+. /lib/functions.sh
+. /lib/functions/system.sh
+
+board_config_update
+
+board=$(board_name)
+
+case "$board" in
+st,stm32mp135f-dk)
+	ucidef_set_interfaces_lan_wan "eth0" "eth1"
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/stm32/base-files/lib/preinit/79_move_config b/target/linux/stm32/base-files/lib/preinit/79_move_config
new file mode 100644
index 00000000000000..bc7db4c7828f6a
--- /dev/null
+++ b/target/linux/stm32/base-files/lib/preinit/79_move_config
@@ -0,0 +1,15 @@
+
+move_config() {
+	. /lib/upgrade/common.sh
+	. /lib/upgrade/platform.sh
+
+	if export_bootdevice && export_partdevice partdev 4; then
+		mount -t ext4 -o rw,noatime "/dev/$partdev" /mnt
+		if [ -f "/mnt/$BACKUP_FILE" ]; then
+			mv -f "/mnt/$BACKUP_FILE" /
+		fi
+		umount /mnt
+	fi
+}
+
+boot_hook_add preinit_mount_root move_config
diff --git a/target/linux/stm32/base-files/lib/upgrade/platform.sh b/target/linux/stm32/base-files/lib/upgrade/platform.sh
new file mode 100644
index 00000000000000..4cd88ab6bd383e
--- /dev/null
+++ b/target/linux/stm32/base-files/lib/upgrade/platform.sh
@@ -0,0 +1,181 @@
+REQUIRE_IMAGE_METADATA=1
+
+UBOOT_ENV_PART=3
+BOOT_PART=4
+ROOTFS_PART=5
+
+RAMFS_COPY_BIN='blockdev'
+
+export_bootdevice() {
+	local cmdline uuid blockdev uevent line class
+	local MAJOR MINOR DEVNAME DEVTYPE
+	local rootpart="$(cmdline_get_var root)"
+
+	case "$rootpart" in
+		PARTUUID=????????-????-????-????-??????????0?/PARTNROFF=1 | \
+		PARTUUID=????????-????-????-????-??????????05)
+			uuid="${rootpart#PARTUUID=}"
+			uuid="${uuid%/PARTNROFF=1}"
+			uuid="${uuid%0?}00"
+			for disk in $(find /dev -type b); do
+				set -- $(dd if=$disk bs=1 skip=568 count=16 2>/dev/null | hexdump -v -e '8/1 "%02x "" "2/1 "%02x""-"6/1 "%02x"')
+				if [ "$4$3$2$1-$6$5-$8$7-$9" = "$uuid" ]; then
+					uevent="/sys/class/block/${disk##*/}/uevent"
+					break
+				fi
+			done
+		;;
+	esac
+
+	if [ -e "$uevent" ]; then
+		while read line; do
+			export -n "$line"
+		done < "$uevent"
+		export BOOTDEV_MAJOR=$MAJOR
+		export BOOTDEV_MINOR=$MINOR
+		return 0
+	fi
+
+	return 1
+}
+
+platform_check_image() {
+	local diskdev partdev diff
+
+        [ "$#" -gt 1 ] && return 1
+
+	export_bootdevice && export_partdevice diskdev 0 || {
+		v "platform_check_image: Unable to determine upgrade device"
+		return 1
+	}
+
+	get_partitions "/dev/$diskdev" bootdisk
+
+	v "Extract the boot sector from the image"
+	get_image_dd "$1" of=/tmp/image.bs count=63 bs=512b
+
+	get_partitions /tmp/image.bs image
+
+	#compare tables
+	diff="$(grep -F -x -v -f /tmp/partmap.bootdisk /tmp/partmap.image)"
+
+	rm -f /tmp/image.bs /tmp/partmap.bootdisk /tmp/partmap.image
+
+	if [ -n "$diff" ]; then
+		echo "Partition layout has changed. Full image will be written."
+		ask_bool 0 "Abort" && exit 1
+		return 0
+	fi
+}
+
+platform_do_upgrade() {
+	local diskdev partdev diff partlabel
+
+	export_bootdevice && export_partdevice diskdev 0 || {
+		v "platform_do_upgrade: Unable to determine upgrade device"
+		return 1
+	}
+
+	sync
+
+	if [ "$UPGRADE_OPT_SAVE_PARTITIONS" = "1" ]; then
+		get_partitions "/dev/$diskdev" bootdisk
+
+		v "Extract boot sector from the image"
+		get_image_dd "$1" of=/tmp/image.bs count=63 bs=512b
+
+		get_partitions /tmp/image.bs image
+
+		#compare tables
+		diff="$(grep -F -x -v -f /tmp/partmap.bootdisk /tmp/partmap.image)"
+	else
+		diff=1
+	fi
+
+	if [ -n "$diff" ]; then
+		rm -rf /tmp/ubootenv
+
+		if export_partdevice partdev $UBOOT_ENV_PART; then
+			v "Saving u-boot env (/dev/$partdev) before to write image"
+			get_image_dd "/dev/$partdev" of=/tmp/ubootenv
+		fi
+
+		v "Writing image to /dev/$diskdev..."
+		get_image_dd "$1" of="/dev/$diskdev" conv=fsync
+
+		blockdev --rereadpt "/dev/$diskdev"
+
+		[ -f /tmp/ubootenv ] && {
+			# iterate over each partition from the image to find the
+			# u-boot-env partition and restore u-boot env.
+			while read part start size; do
+				if export_partdevice partdev $part; then
+					while read line; do
+						eval "local l$line"
+					done < "/sys/class/block/$partdev/uevent"
+
+					[ "$lPARTNAME" = "u-boot-env" ] || continue
+
+					v "Writting u-boot env to /dev/$partdev"
+					get_image_dd /tmp/ubootenv of="/dev/$partdev" conv=fsync
+
+					return 0
+				fi
+			done < /tmp/partmap.image
+		}
+		return 0
+	fi
+
+	#iterate over each partition from the image and write it to the boot disk
+	while read part start size; do
+		if export_partdevice partdev $part; then
+			# do not erase u-boot env
+			[ "$part" = "$UBOOT_ENV_PART" ] && continue
+
+			v "Writing image to /dev/$partdev..."
+			v "Normal partition, doing DD"
+			get_image_dd "$1" of="/dev/$partdev" ibs=512 obs=1M skip="$start" \
+				count="$size" conv=fsync
+		else
+			v "Unable to find partition $part device, skipped."
+		fi
+	done < /tmp/partmap.image
+
+	if export_partdevice partdev "$BOOT_PART"; then
+		mount -t ext4 -o rw,noatime "/dev/$partdev" /mnt
+		local partuuid="$(cmdline_get_var root)"
+		v "Setting rootfs ${partuuid}"
+		sed -i "s/PARTUUID=[a-f0-9-]\+/${partuuid}/ig" \
+			/mnt/extlinux/extlinux.conf
+		umount /mnt
+	fi
+}
+
+platform_copy_config() {
+	local partdev
+
+	# Iterate over each partition from the image to find the boot partition
+	# and copy the config tarball.
+	# The partlabel is used to find the partition.
+	# An hardcoded partition number cannot be used, as it could be wrong if
+	# the partition table changed, and the full image was written.
+	while read part start size; do
+		# config is copied in the boot partition, as for squashfs image, the
+		# rootfs partition is not writable.
+		if export_partdevice partdev "$part"; then
+			while read line; do
+				eval "local l$line"
+			done < "/sys/class/block/$partdev/uevent"
+
+			[ "$lPARTNAME" = "boot" ] || continue
+
+			mount -t ext4 -o rw,noatime "/dev/$partdev" /mnt
+			cp -af "$UPGRADE_BACKUP" "/mnt/$BACKUP_FILE"
+			umount /mnt
+			return 0
+		else
+			v "ERROR: Unable to find partition to copy config data to"
+		fi
+	done < /tmp/partmap.image
+}
+
diff --git a/target/linux/stm32/image/Makefile b/target/linux/stm32/image/Makefile
new file mode 100644
index 00000000000000..77c25edaf892ad
--- /dev/null
+++ b/target/linux/stm32/image/Makefile
@@ -0,0 +1,63 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2024 Bootlin
+#
+
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/image.mk
+
+define Build/boot-img-ext4
+	rm -fR $@.boot
+	mkdir -p $@.boot
+	$(foreach dts,$(DEVICE_DTS), $(CP) $(KDIR)/image-$(dts).dtb $@.boot/$(dts).dtb;)
+	$(CP) $(IMAGE_KERNEL) $@.boot/$(KERNEL_IMG)
+	$(INSTALL_DIR) $@.boot/extlinux
+	$(CP) ./extlinux.conf $@.boot/extlinux/
+	$(SED) 's/@KERNEL@/$(KERNEL_IMG)/' $@.boot/extlinux/extlinux.conf
+	$(SED) 's/@DEVICE@/$(DEVICE_NAME)/' $@.boot/extlinux/extlinux.conf
+	$(SED) 's/@DTS@/$(DEVICE_DTS)/' $@.boot/extlinux/extlinux.conf
+	$(SED) 's/@ROOT@/PARTUUID=$(shell echo $(IMG_PART_DISKGUID) | sed 's/00$$/05/')/' $@.boot/extlinux/extlinux.conf
+
+	make_ext4fs -J -L kernel -l $(CONFIG_TARGET_KERNEL_PARTSIZE)M \
+		$(if $(SOURCE_DATE_EPOCH),-T $(SOURCE_DATE_EPOCH)) \
+		$@.bootimg $@.boot
+endef
+
+define Build/sdcard-img
+	GUID=$(IMG_PART_DISKGUID) ./gen_stm32_sdcard_img.sh \
+	     $@ $(STAGING_DIR_IMAGE)/tf-a-$(DEVICE_NAME).stm32 \
+	     $(STAGING_DIR_IMAGE)/fip-$(DEVICE_NAME).bin $@.bootimg $(IMAGE_ROOTFS) \
+	     $(ENV_SIZE) $(CONFIG_TARGET_KERNEL_PARTSIZE) $(CONFIG_TARGET_ROOTFS_PARTSIZE)
+endef
+
+define Device/Default
+  PROFILES := Default
+  DEVICE_VENDOR := STMicroelectronics
+  IMAGES := factory.img.gz sysupgrade.img.gz
+  IMAGE/factory.img.gz := boot-img-ext4 | sdcard-img | gzip
+  IMAGE/sysupgrade.img.gz := boot-img-ext4 | sdcard-img | gzip | append-metadata
+  KERNEL := kernel-bin
+  KERNEL_NAME := zImage
+  KERNEL_IMG := zImage
+  DEVICE_DTS_DIR := $(DTS_DIR)/st
+  ENV_SIZE := 0x200000
+  DEVICE_PACKAGES := kmod-brcmfmac \
+		     murata-firmware-43430-sdio \
+		     murata-nvram-43430-sdio \
+		     wpad-basic-mbedtls \
+		     kmod-phy-stm32-usbphyc \
+		     kmod-usb2 \
+		     kmod-usb-storage \
+		     kmod-usb-ledtrig-usbport \
+		     -mtd
+endef
+
+define Device/stm32mp135f-dk
+  DEVICE_MODEL := STM32MP135F-DK
+  DEVICE_DTS := stm32mp135f-dk
+  SUPPORTED_DEVICES := st,stm32mp135f-dk
+endef
+
+TARGET_DEVICES += stm32mp135f-dk
+
+$(eval $(call BuildImage))
diff --git a/target/linux/stm32/image/extlinux.conf b/target/linux/stm32/image/extlinux.conf
new file mode 100644
index 00000000000000..5c7773c2a82792
--- /dev/null
+++ b/target/linux/stm32/image/extlinux.conf
@@ -0,0 +1,4 @@
+label @DEVICE@-openwrt
+  kernel /@KERNEL@
+  devicetree /@DTS@.dtb
+  append root=@ROOT@ rootwait
diff --git a/target/linux/stm32/image/gen_stm32_sdcard_img.sh b/target/linux/stm32/image/gen_stm32_sdcard_img.sh
new file mode 100755
index 00000000000000..9af891694a4531
--- /dev/null
+++ b/target/linux/stm32/image/gen_stm32_sdcard_img.sh
@@ -0,0 +1,35 @@
+#!/bin/sh
+# Copyright (C) 2024 Bootlin
+
+set -ex
+[ $# -eq 8 ] || {
+    echo "SYNTAX: $0 <file> <fsbl> <fip> <bootfs image> <rootfs image> <env size> <bootfs size> <rootfs size>"
+    exit 1
+}
+
+OUTPUT="${1}"
+FSBL="${2}"
+FIP="${3}"
+BOOTFS="${4}"
+ROOTFS="${5}"
+ENVSIZE="$((${6} / 1024))"
+BOOTFSSIZE="${7}"
+ROOTFSSIZE="${8}"
+
+set $(ptgen -o "${OUTPUT}" -g -a 4 -l 2048 -G ${GUID} -N fsbla -p 2M -N fip -p 3M -N u-boot-env -p "${ENVSIZE}" -N boot -p${BOOTFSSIZE}M -N rootfs -p ${ROOTFSSIZE}M)
+FSBLAOFFSET="$((${1} / 512))"
+FSBLASIZE="$((${2} / 512))"
+FIPOFFSET="$((${3} / 512))"
+FIPSIZE="$((${4} / 512))"
+ENVOFFSET="$((${5} / 512))"
+ENVSIZE="$((${6} / 512))"
+BOOTFSOFFSET="$((${7} / 512))"
+BOOTFSSIZE="$((${8} / 512))"
+ROOTFSOFFSET="$((${9} / 512))"
+ROOTFSSIZE="$((${10} / 512))"
+
+dd bs=512 if="${FSBL}" of="${OUTPUT}" seek="${FSBLAOFFSET}" conv=notrunc
+dd bs=512 if="${FIP}"  of="${OUTPUT}" seek="${FIPOFFSET}" conv=notrunc
+dd bs=512 if=/dev/zero of="${OUTPUT}" seek="${ENVOFFSET}" count="${ENVSIZE}" conv=notrunc
+dd bs=512 if="${BOOTFS}" of="${OUTPUT}" seek="${BOOTFSOFFSET}" conv=notrunc
+dd bs=512 if="${ROOTFS}" of="${OUTPUT}" seek="${ROOTFSOFFSET}" conv=notrunc
diff --git a/target/linux/stm32/modules.mk b/target/linux/stm32/modules.mk
new file mode 100644
index 00000000000000..baba80baba43aa
--- /dev/null
+++ b/target/linux/stm32/modules.mk
@@ -0,0 +1,256 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2024 Bootlin
+
+define KernelPackage/phy-stm32-usbphyc
+  TITLE:=STM32 USB HS PHY Controller driver
+  DEPENDS:=@TARGET_stm32
+  KCONFIG:=CONFIG_PHY_STM32_USBPHYC
+  FILES:=$(LINUX_DIR)/drivers/phy/st/phy-stm32-usbphyc.ko
+  AUTOLOAD:=$(call AutoProbe,phy-stm32-usbphyc,)
+endef
+
+define KernelPackage/phy-stm32-usbphyc/description
+  Kernel module for STM32 USB HS PHY Controller
+endef
+
+$(eval $(call KernelPackage,phy-stm32-usbphyc))
+
+
+define KernelPackage/bxcan
+  TITLE:=STM32 Basic Extended CAN (bxCAN) devices
+  KCONFIG:=CONFIG_CAN_BXCAN
+  FILES=$(LINUX_DIR)/drivers/net/can/bxcan.ko
+  AUTOLOAD:=$(call AutoProbe,bxcan)
+  $(call AddDepends/can,@TARGET_stm32)
+endef
+
+$(eval $(call KernelPackage,bxcan))
+
+
+define KernelPackage/spi-stm32
+  SUBMENU=$(SPI_MENU)
+  TITLE:=STM32 SPI controller
+  DEPENDS:=@TARGET_stm32
+  KCONFIG:=CONFIG_SPI_STM32 \
+	   CONFIG_SPI=y \
+	   CONFIG_SPI_MASTER=y \
+	   CONFIG_SPI_SLAVE_TIME=n \
+	   CONFIG_SPI_SLAVE_SYSTEM_CONTROL=n
+  FILES=$(LINUX_DIR)/drivers/spi/spi-stm32.ko
+  AUTOLOAD:=$(call AutoProbe,spi-stm32)
+endef
+
+define KernelPackage/spi-stm32/description
+  SPI driver for STMicroelectronics STM32 SoCs.
+endef
+
+$(eval $(call KernelPackage,spi-stm32))
+
+
+define KernelPackage/scmi-hwmon
+  TITLE:=ARM SCMI Sensors
+  KCONFIG:=CONFIG_SENSORS_ARM_SCMI
+  FILES:=$(LINUX_DIR)/drivers/hwmon/scmi-hwmon.ko
+  AUTOLOAD:=$(call AutoProbe,scmi-hwmon)
+  $(call AddDepends/hwmon,@TARGET_stm32 +kmod-thermal)
+endef
+
+$(eval $(call KernelPackage,scmi-hwmon))
+
+
+define KernelPackage/stm32-dcmi
+  TITLE:=STM32 Digital Camera Memory Interface support
+  KCONFIG:=CONFIG_VIDEO_STM32_DCMI
+  FILES:=$(LINUX_DIR)/drivers/media/platform/st/stm32/stm32-dcmi.ko
+  AUTOLOAD:=$(call AutoProbe,stm32-dcmi)
+  $(call AddDepends/video,@TARGET_stm32 +kmod-video-videobuf2 +kmod-video-dma-contig +kmod-video-async +kmod-video-fwnode)
+endef
+
+$(eval $(call KernelPackage,stm32-dcmi))
+
+
+define KernelPackage/sound-soc-stm32-sai
+  TITLE:=STM32 SAI interface (Serial Audio Interface) support
+  KCONFIG:=CONFIG_SND_SOC_STM32_SAI
+  FILES:=$(LINUX_DIR)/sound/soc/stm/snd-soc-stm32-sai-sub.ko \
+	 $(LINUX_DIR)/sound/soc/stm/snd-soc-stm32-sai.ko
+  AUTOLOAD:=$(call AutoProbe,snd-soc-stm32-sai-sub snd-soc-stm32-sai)
+  $(call AddDepends/sound,@TARGET_stm32 +kmod-sound-soc-core)
+endef
+
+$(eval $(call KernelPackage,sound-soc-stm32-sai))
+
+
+define KernelPackage/sound-soc-stm32-i2s
+  TITLE:=STM32 I2S interface (SPI/I2S block) support
+  KCONFIG:=CONFIG_SND_SOC_STM32_I2S
+  FILES:=$(LINUX_DIR)/sound/soc/stm/snd-soc-stm32-i2s.ko
+  AUTOLOAD:=$(call AutoProbe,snd-soc-stm32-i2s)
+  $(call AddDepends/sound,@TARGET_stm32 +kmod-sound-soc-core)
+endef
+
+$(eval $(call KernelPackage,sound-soc-stm32-i2s))
+
+
+define KernelPackage/sound-soc-stm32-spdifrx
+  TITLE:=STM32 S/PDIF receiver (SPDIFRX) support
+  KCONFIG:=CONFIG_SND_SOC_STM32_SPDIFRX
+  FILES:=$(LINUX_DIR)/sound/soc/stm/snd-soc-stm32-spdifrx.ko
+  AUTOLOAD:=$(call AutoProbe,snd-soc-stm32-spdifrx)
+  $(call AddDepends/sound,@TARGET_stm32 +kmod-sound-soc-core)
+endef
+
+$(eval $(call KernelPackage,sound-soc-stm32-spdifrx))
+
+
+define KernelPackage/sound-soc-stm32-dfsdm
+  TITLE:=SoC Audio support for STM32 DFSDM
+  KCONFIG:=CONFIG_SND_SOC_STM32_DFSDM
+  FILES:=$(LINUX_DIR)/sound/soc/stm/stm32_adfsdm.ko
+  AUTOLOAD:=$(call AutoProbe,stm32_adfsdm)
+  $(call AddDepends/sound,@TARGET_stm32 +kmod-sound-soc-core +kmod-stm32-dfsdm-adc +kmod-industrialio-buffer-cb)
+endef
+
+$(eval $(call KernelPackage,sound-soc-stm32-dfsdm))
+
+
+define KernelPackage/stm32-timers
+  TITLE:=STM32 Timers
+  DEPENDS:=@TARGET_stm32 +kmod-mfd
+  KCONFIG:=CONFIG_MFD_STM32_TIMERS
+  FILES:=$(LINUX_DIR)/drivers/mfd/stm32-timers.ko
+  AUTOLOAD:=$(call AutoProbe,stm32-timers)
+endef
+
+$(eval $(call KernelPackage,stm32-timers))
+
+
+define KernelPackage/stm32-timer-trigger
+  TITLE:=STM32 Timer Trigger
+  KCONFIG:=CONFIG_IIO_STM32_TIMER_TRIGGER
+  FILES:=$(LINUX_DIR)/drivers/iio/trigger/stm32-timer-trigger.ko
+  AUTOLOAD:=$(call AutoProbe,stm32-timer-trigger)
+  $(call AddDepends/iio,@TARGET_stm32 +kmod-stm32-timers)
+endef
+
+$(eval $(call KernelPackage,stm32-timer-trigger))
+
+
+define KernelPackage/stm32-adc
+  TITLE:=STM32 ADC
+  KCONFIG:=CONFIG_STM32_ADC_CORE \
+	   CONFIG_STM32_ADC
+  FILES:=$(LINUX_DIR)/drivers/iio/adc/stm32-adc-core.ko \
+	 $(LINUX_DIR)/drivers/iio/adc/stm32-adc.ko
+  AUTOLOAD:=$(call AutoProbe,stm32-adc-core stm32-adc)
+  $(call AddDepends/iio,@TARGET_stm32 +kmod-stm32-timer-trigger +kmod-industrialio-triggered-buffer)
+endef
+
+$(eval $(call KernelPackage,stm32-adc))
+
+
+define KernelPackage/stm32-dfsdm-adc
+  TITLE:=STM32 DFSDM ADC
+  KCONFIG:=CONFIG_STM32_DFSDM_CORE \
+	   CONFIG_STM32_DFSDM_ADC
+  FILES:=$(LINUX_DIR)/drivers/iio/adc/stm32-dfsdm-core.ko \
+	 $(LINUX_DIR)/drivers/iio/adc/stm32-dfsdm-adc.ko
+  AUTOLOAD:=$(call AutoProbe,stm32-dfsdm-core stm32-dfsdm-adc)
+  $(call AddDepends/iio,@TARGET_stm32 +kmod-stm32-timer-trigger +kmod-industrialio-triggered-buffer +kmod-industrialio-hw-consumer)
+endef
+
+$(eval $(call KernelPackage,stm32-dfsdm-adc))
+
+
+define KernelPackage/scmi-iio
+  TITLE:=IIO SCMI
+  KCONFIG=CONFIG_IIO_SCMI
+  FILES:=$(LINUX_DIR)/drivers/iio/common/scmi_sensors/scmi_iio.ko
+  AUTOLOAD:=$(call AutoProbe,scmi_iio)
+  $(call AddDepends/iio,@TARGET_stm32 +kmod-iio-kfifo-buf)
+endef
+
+$(eval $(call KernelPackage,scmi-iio))
+
+
+define KernelPackage/stm32-dac
+  TITLE:=STM32 DAC
+  DEPENDS:=@TARGET_stm32
+  KCONFIG:=CONFIG_STM32_DAC_CORE \
+	   CONFIG_STM32_DAC
+  FILES:=$(LINUX_DIR)/drivers/iio/dac/stm32-dac-core.ko \
+	 $(LINUX_DIR)/drivers/iio/dac/stm32-dac.ko
+  AUTOLOAD:=$(call AutoProbe,stm32-dac-core stm32-dac)
+  $(call AddDepends/iio,@TARGET_stm32)
+endef
+
+$(eval $(call KernelPackage,stm32-dac))
+
+
+define KernelPackage/nvmem-stm32-romem
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=STM32 factory-programmed memory support
+  DEPENDS:=@TARGET_stm32
+  KCONFIG:=CONFIG_NVMEM_STM32_ROMEM
+  FILES:=$(LINUX_DIR)/drivers/nvmem/nvmem_stm32_romem.ko
+  AUTOLOAD:=$(call AutoProbe,nvmem-stm32-romem)
+endef
+
+$(eval $(call KernelPackage,nvmem-stm32-romem))
+
+
+define KernelPackage/stm32-crc32
+  TITLE:=Support for STM32 crc accelerators
+  KCONFIG:=CONFIG_CRYPTO_DEV_STM32_CRC \
+	   CONFIG_CRYPTO_HW=y
+  FILES:=$(LINUX_DIR)/drivers/crypto/stm32/stm32-crc32.ko
+  AUTOLOAD:=$(call AutoProbe,stm32-crc32)
+  $(call AddDepends/crypto,@TARGET_stm32 +kmod-crypto-crc32)
+endef
+
+$(eval $(call KernelPackage,stm32-crc32))
+
+
+define KernelPackage/stm32-hash
+  SUBMENU:=$(CRYPTO_MENU)
+  TITLE:=Support for STM32 hash accelerators
+  DEPENDS:=@TARGET_stm32 \
+	   +kmod-crypto-md5 \
+	   +kmod-crypto-sha1 \
+	   +kmod-crypto-sha256 \
+	   +kmod-crypto-sha3 \
+	   +kmod-crypto-rsa
+  KCONFIG:=CONFIG_CRYPTO_DEV_STM32_HASH \
+	   CONFIG_CRYPTO_ENGINE=y \
+  FILES:=$(LINUX_DIR)/drivers/crypto/stm32/stm32-hash.ko
+  AUTOLOAD:=$(call AutoProbe,stm32-hash)
+endef
+
+$(eval $(call KernelPackage,stm32-hash))
+
+
+define KernelPackage/stm32-cryp
+  TITLE:=Support for STM32 cryp accelerators
+  KCONFIG:=CONFIG_CRYPTO_DEV_STM32_CRYP \
+	   CONFIG_CRYPTO_LIB_DES=y
+  FILES:=$(LINUX_DIR)/drivers/crypto/stm32/stm32-cryp.ko
+  AUTOLOAD:=$(call AutoProbe,stm32-cryp)
+  $(call AddDepends/crypto,@TARGET_stm32 +kmod-crypto-hash +kmod-crypto-des +kmod-crypto-engine)
+endef
+
+$(eval $(call KernelPackage,stm32-cryp))
+
+
+define KernelPackage/st-thermal
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Thermal sensors on STMicroelectronics STi series of SoCs
+  KCONFIG:=CONFIG_ST_THERMAL \
+	   CONFIG_ST_THERMAL_MEMMAP
+  DEPENDS:=@TARGET_stm32 +kmod-thermal
+  FILES:=$(LINUX_DIR)/drivers/thermal/st/st_thermal.ko \
+	 $(LINUX_DIR)/drivers/thermal/st/st_thermal_memmap.ko
+  AUTOLOAD:=$(call AutoProbe,st_thermal st_thermal_memmap)
+endef
+
+$(eval $(call KernelPackage,st-thermal))
diff --git a/target/linux/stm32/patches-6.6/001-net-stmmac-dwmac-stm32-use-devm_stmmac_probe_config_.patch b/target/linux/stm32/patches-6.6/001-net-stmmac-dwmac-stm32-use-devm_stmmac_probe_config_.patch
new file mode 100644
index 00000000000000..cf192fdef483dd
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/001-net-stmmac-dwmac-stm32-use-devm_stmmac_probe_config_.patch
@@ -0,0 +1,69 @@
+From 1ddced59ac1f7c739f21e930d87b126a30c561bb Mon Sep 17 00:00:00 2001
+From: Jisheng Zhang <jszhang@kernel.org>
+Date: Sat, 16 Sep 2023 15:58:23 +0800
+Subject: [PATCH 1/8] net: stmmac: dwmac-stm32: use
+ devm_stmmac_probe_config_dt()
+
+Simplify the driver's probe() function by using the devres
+variant of stmmac_probe_config_dt().
+
+Signed-off-by: Jisheng Zhang <jszhang@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ .../net/ethernet/stmicro/stmmac/dwmac-stm32.c   | 17 ++++++-----------
+ 1 file changed, 6 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
+@@ -372,21 +372,18 @@ static int stm32_dwmac_probe(struct plat
+ 	if (ret)
+ 		return ret;
+ 
+-	plat_dat = stmmac_probe_config_dt(pdev, stmmac_res.mac);
++	plat_dat = devm_stmmac_probe_config_dt(pdev, stmmac_res.mac);
+ 	if (IS_ERR(plat_dat))
+ 		return PTR_ERR(plat_dat);
+ 
+ 	dwmac = devm_kzalloc(&pdev->dev, sizeof(*dwmac), GFP_KERNEL);
+-	if (!dwmac) {
+-		ret = -ENOMEM;
+-		goto err_remove_config_dt;
+-	}
++	if (!dwmac)
++		return -ENOMEM;
+ 
+ 	data = of_device_get_match_data(&pdev->dev);
+ 	if (!data) {
+ 		dev_err(&pdev->dev, "no of match data provided\n");
+-		ret = -EINVAL;
+-		goto err_remove_config_dt;
++		return -EINVAL;
+ 	}
+ 
+ 	dwmac->ops = data;
+@@ -395,14 +392,14 @@ static int stm32_dwmac_probe(struct plat
+ 	ret = stm32_dwmac_parse_data(dwmac, &pdev->dev);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "Unable to parse OF data\n");
+-		goto err_remove_config_dt;
++		return ret;
+ 	}
+ 
+ 	plat_dat->bsp_priv = dwmac;
+ 
+ 	ret = stm32_dwmac_init(plat_dat);
+ 	if (ret)
+-		goto err_remove_config_dt;
++		return ret;
+ 
+ 	ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+ 	if (ret)
+@@ -412,8 +409,6 @@ static int stm32_dwmac_probe(struct plat
+ 
+ err_clk_disable:
+ 	stm32_dwmac_clk_disable(dwmac);
+-err_remove_config_dt:
+-	stmmac_remove_config_dt(pdev, plat_dat);
+ 
+ 	return ret;
+ }
diff --git a/target/linux/stm32/patches-6.6/002-net-stmmac-dwmac-stm32-refactor-clock-config.patch b/target/linux/stm32/patches-6.6/002-net-stmmac-dwmac-stm32-refactor-clock-config.patch
new file mode 100644
index 00000000000000..dd791dab6a0615
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/002-net-stmmac-dwmac-stm32-refactor-clock-config.patch
@@ -0,0 +1,241 @@
+From 73c350e3fb32e9598b66f61081c7e06a7fba49f8 Mon Sep 17 00:00:00 2001
+From: Ben Wolsieffer <ben.wolsieffer@hefring.com>
+Date: Mon, 9 Oct 2023 10:59:04 -0400
+Subject: [PATCH 2/8] net: stmmac: dwmac-stm32: refactor clock config
+
+Currently, clock configuration is spread throughout the driver and
+partially duplicated for the STM32MP1 and STM32 MCU variants. This makes
+it difficult to keep track of which clocks need to be enabled or disabled
+in various scenarios.
+
+This patch adds symmetric stm32_dwmac_clk_enable/disable() functions
+that handle all clock configuration, including quirks required while
+suspending or resuming. syscfg_clk and clk_eth_ck are not present on
+STM32 MCUs, but it is fine to try to configure them anyway since NULL
+clocks are ignored.
+
+Signed-off-by: Ben Wolsieffer <ben.wolsieffer@hefring.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ .../net/ethernet/stmicro/stmmac/dwmac-stm32.c | 113 +++++++-----------
+ 1 file changed, 45 insertions(+), 68 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
+@@ -98,7 +98,6 @@ struct stm32_dwmac {
+ 
+ struct stm32_ops {
+ 	int (*set_mode)(struct plat_stmmacenet_data *plat_dat);
+-	int (*clk_prepare)(struct stm32_dwmac *dwmac, bool prepare);
+ 	int (*suspend)(struct stm32_dwmac *dwmac);
+ 	void (*resume)(struct stm32_dwmac *dwmac);
+ 	int (*parse_data)(struct stm32_dwmac *dwmac,
+@@ -107,62 +106,55 @@ struct stm32_ops {
+ 	bool clk_rx_enable_in_suspend;
+ };
+ 
+-static int stm32_dwmac_init(struct plat_stmmacenet_data *plat_dat)
++static int stm32_dwmac_clk_enable(struct stm32_dwmac *dwmac, bool resume)
+ {
+-	struct stm32_dwmac *dwmac = plat_dat->bsp_priv;
+ 	int ret;
+ 
+-	if (dwmac->ops->set_mode) {
+-		ret = dwmac->ops->set_mode(plat_dat);
+-		if (ret)
+-			return ret;
+-	}
+-
+ 	ret = clk_prepare_enable(dwmac->clk_tx);
+ 	if (ret)
+-		return ret;
++		goto err_clk_tx;
+ 
+-	if (!dwmac->ops->clk_rx_enable_in_suspend ||
+-	    !dwmac->dev->power.is_suspended) {
++	if (!dwmac->ops->clk_rx_enable_in_suspend || !resume) {
+ 		ret = clk_prepare_enable(dwmac->clk_rx);
+-		if (ret) {
+-			clk_disable_unprepare(dwmac->clk_tx);
+-			return ret;
+-		}
++		if (ret)
++			goto err_clk_rx;
+ 	}
+ 
+-	if (dwmac->ops->clk_prepare) {
+-		ret = dwmac->ops->clk_prepare(dwmac, true);
+-		if (ret) {
+-			clk_disable_unprepare(dwmac->clk_rx);
+-			clk_disable_unprepare(dwmac->clk_tx);
+-		}
++	ret = clk_prepare_enable(dwmac->syscfg_clk);
++	if (ret)
++		goto err_syscfg_clk;
++
++	if (dwmac->enable_eth_ck) {
++		ret = clk_prepare_enable(dwmac->clk_eth_ck);
++		if (ret)
++			goto err_clk_eth_ck;
+ 	}
+ 
+ 	return ret;
++
++err_clk_eth_ck:
++	clk_disable_unprepare(dwmac->syscfg_clk);
++err_syscfg_clk:
++	if (!dwmac->ops->clk_rx_enable_in_suspend || !resume)
++		clk_disable_unprepare(dwmac->clk_rx);
++err_clk_rx:
++	clk_disable_unprepare(dwmac->clk_tx);
++err_clk_tx:
++	return ret;
+ }
+ 
+-static int stm32mp1_clk_prepare(struct stm32_dwmac *dwmac, bool prepare)
++static int stm32_dwmac_init(struct plat_stmmacenet_data *plat_dat, bool resume)
+ {
+-	int ret = 0;
++	struct stm32_dwmac *dwmac = plat_dat->bsp_priv;
++	int ret;
+ 
+-	if (prepare) {
+-		ret = clk_prepare_enable(dwmac->syscfg_clk);
++	if (dwmac->ops->set_mode) {
++		ret = dwmac->ops->set_mode(plat_dat);
+ 		if (ret)
+ 			return ret;
+-		if (dwmac->enable_eth_ck) {
+-			ret = clk_prepare_enable(dwmac->clk_eth_ck);
+-			if (ret) {
+-				clk_disable_unprepare(dwmac->syscfg_clk);
+-				return ret;
+-			}
+-		}
+-	} else {
+-		clk_disable_unprepare(dwmac->syscfg_clk);
+-		if (dwmac->enable_eth_ck)
+-			clk_disable_unprepare(dwmac->clk_eth_ck);
+ 	}
+-	return ret;
++
++	return stm32_dwmac_clk_enable(dwmac, resume);
+ }
+ 
+ static int stm32mp1_set_mode(struct plat_stmmacenet_data *plat_dat)
+@@ -252,13 +244,15 @@ static int stm32mcu_set_mode(struct plat
+ 				 dwmac->ops->syscfg_eth_mask, val << 23);
+ }
+ 
+-static void stm32_dwmac_clk_disable(struct stm32_dwmac *dwmac)
++static void stm32_dwmac_clk_disable(struct stm32_dwmac *dwmac, bool suspend)
+ {
+ 	clk_disable_unprepare(dwmac->clk_tx);
+-	clk_disable_unprepare(dwmac->clk_rx);
++	if (!dwmac->ops->clk_rx_enable_in_suspend || !suspend)
++		clk_disable_unprepare(dwmac->clk_rx);
+ 
+-	if (dwmac->ops->clk_prepare)
+-		dwmac->ops->clk_prepare(dwmac, false);
++	clk_disable_unprepare(dwmac->syscfg_clk);
++	if (dwmac->enable_eth_ck)
++		clk_disable_unprepare(dwmac->clk_eth_ck);
+ }
+ 
+ static int stm32_dwmac_parse_data(struct stm32_dwmac *dwmac,
+@@ -397,7 +391,7 @@ static int stm32_dwmac_probe(struct plat
+ 
+ 	plat_dat->bsp_priv = dwmac;
+ 
+-	ret = stm32_dwmac_init(plat_dat);
++	ret = stm32_dwmac_init(plat_dat, false);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -408,7 +402,7 @@ static int stm32_dwmac_probe(struct plat
+ 	return 0;
+ 
+ err_clk_disable:
+-	stm32_dwmac_clk_disable(dwmac);
++	stm32_dwmac_clk_disable(dwmac, false);
+ 
+ 	return ret;
+ }
+@@ -421,7 +415,7 @@ static void stm32_dwmac_remove(struct pl
+ 
+ 	stmmac_dvr_remove(&pdev->dev);
+ 
+-	stm32_dwmac_clk_disable(priv->plat->bsp_priv);
++	stm32_dwmac_clk_disable(dwmac, false);
+ 
+ 	if (dwmac->irq_pwr_wakeup >= 0) {
+ 		dev_pm_clear_wake_irq(&pdev->dev);
+@@ -431,18 +425,7 @@ static void stm32_dwmac_remove(struct pl
+ 
+ static int stm32mp1_suspend(struct stm32_dwmac *dwmac)
+ {
+-	int ret = 0;
+-
+-	ret = clk_prepare_enable(dwmac->clk_ethstp);
+-	if (ret)
+-		return ret;
+-
+-	clk_disable_unprepare(dwmac->clk_tx);
+-	clk_disable_unprepare(dwmac->syscfg_clk);
+-	if (dwmac->enable_eth_ck)
+-		clk_disable_unprepare(dwmac->clk_eth_ck);
+-
+-	return ret;
++	return clk_prepare_enable(dwmac->clk_ethstp);
+ }
+ 
+ static void stm32mp1_resume(struct stm32_dwmac *dwmac)
+@@ -450,14 +433,6 @@ static void stm32mp1_resume(struct stm32
+ 	clk_disable_unprepare(dwmac->clk_ethstp);
+ }
+ 
+-static int stm32mcu_suspend(struct stm32_dwmac *dwmac)
+-{
+-	clk_disable_unprepare(dwmac->clk_tx);
+-	clk_disable_unprepare(dwmac->clk_rx);
+-
+-	return 0;
+-}
+-
+ #ifdef CONFIG_PM_SLEEP
+ static int stm32_dwmac_suspend(struct device *dev)
+ {
+@@ -468,6 +443,10 @@ static int stm32_dwmac_suspend(struct de
+ 	int ret;
+ 
+ 	ret = stmmac_suspend(dev);
++	if (ret)
++		return ret;
++
++	stm32_dwmac_clk_disable(dwmac, true);
+ 
+ 	if (dwmac->ops->suspend)
+ 		ret = dwmac->ops->suspend(dwmac);
+@@ -485,7 +464,7 @@ static int stm32_dwmac_resume(struct dev
+ 	if (dwmac->ops->resume)
+ 		dwmac->ops->resume(dwmac);
+ 
+-	ret = stm32_dwmac_init(priv->plat);
++	ret = stm32_dwmac_init(priv->plat, true);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -500,13 +479,11 @@ static SIMPLE_DEV_PM_OPS(stm32_dwmac_pm_
+ 
+ static struct stm32_ops stm32mcu_dwmac_data = {
+ 	.set_mode = stm32mcu_set_mode,
+-	.suspend = stm32mcu_suspend,
+ 	.syscfg_eth_mask = SYSCFG_MCU_ETH_MASK
+ };
+ 
+ static struct stm32_ops stm32mp1_dwmac_data = {
+ 	.set_mode = stm32mp1_set_mode,
+-	.clk_prepare = stm32mp1_clk_prepare,
+ 	.suspend = stm32mp1_suspend,
+ 	.resume = stm32mp1_resume,
+ 	.parse_data = stm32mp1_parse_data,
diff --git a/target/linux/stm32/patches-6.6/003-net-stmmac-dwmac-stm32-Separate-out-external-clock-r.patch b/target/linux/stm32/patches-6.6/003-net-stmmac-dwmac-stm32-Separate-out-external-clock-r.patch
new file mode 100644
index 00000000000000..bcdd23b4ebf9a6
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/003-net-stmmac-dwmac-stm32-Separate-out-external-clock-r.patch
@@ -0,0 +1,125 @@
+From 23c08dc4ff28b5ca1aa5ee745a5e9688561e8f6a Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marex@denx.de>
+Date: Tue, 11 Jun 2024 10:36:00 +0200
+Subject: [PATCH 3/8] net: stmmac: dwmac-stm32: Separate out external clock
+ rate validation
+
+Pull the external clock frequency validation into a separate function,
+to avoid conflating it with external clock DT property decoding and
+clock mux register configuration. This should make the code easier to
+read and understand.
+
+This does change the code behavior slightly. The clock mux PMCR register
+setting now depends solely on the DT properties which configure the clock
+mux between external clock and internal RCC generated clock. The mux PMCR
+register settings no longer depend on the supplied clock frequency, that
+supplied clock frequency is now only validated, and if the clock frequency
+is invalid for a mode, it is rejected.
+
+Previously, the code would switch the PMCR register clock mux to internal
+RCC generated clock if external clock couldn't provide suitable frequency,
+without checking whether the RCC generated clock frequency is correct. Such
+behavior is risky at best, user should have configured their clock correctly
+in the first place, so this behavior is removed here.
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Christophe Roullier <christophe.roullier@foss.st.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ .../net/ethernet/stmicro/stmmac/dwmac-stm32.c | 51 +++++++++++++++----
+ 1 file changed, 41 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
+@@ -157,25 +157,54 @@ static int stm32_dwmac_init(struct plat_
+ 	return stm32_dwmac_clk_enable(dwmac, resume);
+ }
+ 
++static int stm32mp1_validate_ethck_rate(struct plat_stmmacenet_data *plat_dat)
++{
++	struct stm32_dwmac *dwmac = plat_dat->bsp_priv;
++	const u32 clk_rate = clk_get_rate(dwmac->clk_eth_ck);
++
++	switch (plat_dat->mac_interface) {
++	case PHY_INTERFACE_MODE_MII:
++	case PHY_INTERFACE_MODE_GMII:
++		if (clk_rate == ETH_CK_F_25M)
++			return 0;
++		break;
++	case PHY_INTERFACE_MODE_RMII:
++		if (clk_rate == ETH_CK_F_25M || clk_rate == ETH_CK_F_50M)
++			return 0;
++		break;
++	case PHY_INTERFACE_MODE_RGMII:
++	case PHY_INTERFACE_MODE_RGMII_ID:
++	case PHY_INTERFACE_MODE_RGMII_RXID:
++	case PHY_INTERFACE_MODE_RGMII_TXID:
++		if (clk_rate == ETH_CK_F_25M || clk_rate == ETH_CK_F_125M)
++			return 0;
++		break;
++	default:
++		break;
++	}
++
++	dev_err(dwmac->dev, "Mode %s does not match eth-ck frequency %d Hz",
++		phy_modes(plat_dat->mac_interface), clk_rate);
++	return -EINVAL;
++}
++
+ static int stm32mp1_set_mode(struct plat_stmmacenet_data *plat_dat)
+ {
+ 	struct stm32_dwmac *dwmac = plat_dat->bsp_priv;
+-	u32 reg = dwmac->mode_reg, clk_rate;
+-	int val;
++	u32 reg = dwmac->mode_reg;
++	int val, ret;
+ 
+-	clk_rate = clk_get_rate(dwmac->clk_eth_ck);
+ 	dwmac->enable_eth_ck = false;
+ 	switch (plat_dat->mac_interface) {
+ 	case PHY_INTERFACE_MODE_MII:
+-		if (clk_rate == ETH_CK_F_25M && dwmac->ext_phyclk)
++		if (dwmac->ext_phyclk)
+ 			dwmac->enable_eth_ck = true;
+ 		val = SYSCFG_PMCR_ETH_SEL_MII;
+ 		pr_debug("SYSCFG init : PHY_INTERFACE_MODE_MII\n");
+ 		break;
+ 	case PHY_INTERFACE_MODE_GMII:
+ 		val = SYSCFG_PMCR_ETH_SEL_GMII;
+-		if (clk_rate == ETH_CK_F_25M &&
+-		    (dwmac->eth_clk_sel_reg || dwmac->ext_phyclk)) {
++		if (dwmac->eth_clk_sel_reg || dwmac->ext_phyclk) {
+ 			dwmac->enable_eth_ck = true;
+ 			val |= SYSCFG_PMCR_ETH_CLK_SEL;
+ 		}
+@@ -183,8 +212,7 @@ static int stm32mp1_set_mode(struct plat
+ 		break;
+ 	case PHY_INTERFACE_MODE_RMII:
+ 		val = SYSCFG_PMCR_ETH_SEL_RMII;
+-		if ((clk_rate == ETH_CK_F_25M || clk_rate == ETH_CK_F_50M) &&
+-		    (dwmac->eth_ref_clk_sel_reg || dwmac->ext_phyclk)) {
++		if (dwmac->eth_ref_clk_sel_reg || dwmac->ext_phyclk) {
+ 			dwmac->enable_eth_ck = true;
+ 			val |= SYSCFG_PMCR_ETH_REF_CLK_SEL;
+ 		}
+@@ -195,8 +223,7 @@ static int stm32mp1_set_mode(struct plat
+ 	case PHY_INTERFACE_MODE_RGMII_RXID:
+ 	case PHY_INTERFACE_MODE_RGMII_TXID:
+ 		val = SYSCFG_PMCR_ETH_SEL_RGMII;
+-		if ((clk_rate == ETH_CK_F_25M || clk_rate == ETH_CK_F_125M) &&
+-		    (dwmac->eth_clk_sel_reg || dwmac->ext_phyclk)) {
++		if (dwmac->eth_clk_sel_reg || dwmac->ext_phyclk) {
+ 			dwmac->enable_eth_ck = true;
+ 			val |= SYSCFG_PMCR_ETH_CLK_SEL;
+ 		}
+@@ -209,6 +236,10 @@ static int stm32mp1_set_mode(struct plat
+ 		return -EINVAL;
+ 	}
+ 
++	ret = stm32mp1_validate_ethck_rate(plat_dat);
++	if (ret)
++		return ret;
++
+ 	/* Need to update PMCCLRR (clear register) */
+ 	regmap_write(dwmac->regmap, reg + SYSCFG_PMCCLRR_OFFSET,
+ 		     dwmac->ops->syscfg_eth_mask);
diff --git a/target/linux/stm32/patches-6.6/004-net-stmmac-dwmac-stm32-Separate-out-external-clock-s.patch b/target/linux/stm32/patches-6.6/004-net-stmmac-dwmac-stm32-Separate-out-external-clock-s.patch
new file mode 100644
index 00000000000000..2e8f76158d41a4
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/004-net-stmmac-dwmac-stm32-Separate-out-external-clock-s.patch
@@ -0,0 +1,132 @@
+From d23ba64e733580db2809e6f6dbf6f093fbd1b91b Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marex@denx.de>
+Date: Tue, 11 Jun 2024 10:36:01 +0200
+Subject: [PATCH 4/8] net: stmmac: dwmac-stm32: Separate out external clock
+ selector
+
+Pull the external clock selector into a separate function, to avoid
+conflating it with external clock rate validation and clock mux
+register configuration. This should make the code easier to read and
+understand.
+
+The dwmac->enable_eth_ck variable in the end indicates whether the MAC
+clock are supplied by external oscillator (true) or internal RCC clock
+IP (false). The dwmac->enable_eth_ck value is set based on multiple DT
+properties, some of them deprecated, some of them specific to bus mode.
+
+The following DT properties and variables are taken into account. In
+each case, if the property is present or true, MAC clock is supplied
+by external oscillator.
+- "st,ext-phyclk", assigned to variable dwmac->ext_phyclk
+  - Used in any mode (MII/RMII/GMII/RGMII)
+  - The only non-deprecated DT property of the three
+- "st,eth-clk-sel", assigned to variable dwmac->eth_clk_sel_reg
+  - Valid only in GMII/RGMII mode
+  - Deprecated property, backward compatibility only
+- "st,eth-ref-clk-sel", assigned to variable dwmac->eth_ref_clk_sel_reg
+  - Valid only in RMII mode
+  - Deprecated property, backward compatibility only
+
+The stm32mp1_select_ethck_external() function handles the aforementioned
+DT properties and sets dwmac->enable_eth_ck accordingly.
+
+The stm32mp1_set_mode() is adjusted to call stm32mp1_select_ethck_external()
+first and then only use dwmac->enable_eth_ck to determine hardware clock mux
+settings.
+
+No functional change intended.
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Christophe Roullier <christophe.roullier@foss.st.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ .../net/ethernet/stmicro/stmmac/dwmac-stm32.c | 50 ++++++++++++++-----
+ 1 file changed, 38 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
+@@ -157,6 +157,37 @@ static int stm32_dwmac_init(struct plat_
+ 	return stm32_dwmac_clk_enable(dwmac, resume);
+ }
+ 
++static int stm32mp1_select_ethck_external(struct plat_stmmacenet_data *plat_dat)
++{
++	struct stm32_dwmac *dwmac = plat_dat->bsp_priv;
++
++	switch (plat_dat->mac_interface) {
++	case PHY_INTERFACE_MODE_MII:
++		dwmac->enable_eth_ck = dwmac->ext_phyclk;
++		return 0;
++	case PHY_INTERFACE_MODE_GMII:
++		dwmac->enable_eth_ck = dwmac->eth_clk_sel_reg ||
++				       dwmac->ext_phyclk;
++		return 0;
++	case PHY_INTERFACE_MODE_RMII:
++		dwmac->enable_eth_ck = dwmac->eth_ref_clk_sel_reg ||
++				       dwmac->ext_phyclk;
++		return 0;
++	case PHY_INTERFACE_MODE_RGMII:
++	case PHY_INTERFACE_MODE_RGMII_ID:
++	case PHY_INTERFACE_MODE_RGMII_RXID:
++	case PHY_INTERFACE_MODE_RGMII_TXID:
++		dwmac->enable_eth_ck = dwmac->eth_clk_sel_reg ||
++				       dwmac->ext_phyclk;
++		return 0;
++	default:
++		dwmac->enable_eth_ck = false;
++		dev_err(dwmac->dev, "Mode %s not supported",
++			phy_modes(plat_dat->mac_interface));
++		return -EINVAL;
++	}
++}
++
+ static int stm32mp1_validate_ethck_rate(struct plat_stmmacenet_data *plat_dat)
+ {
+ 	struct stm32_dwmac *dwmac = plat_dat->bsp_priv;
+@@ -194,28 +225,25 @@ static int stm32mp1_set_mode(struct plat
+ 	u32 reg = dwmac->mode_reg;
+ 	int val, ret;
+ 
+-	dwmac->enable_eth_ck = false;
++	ret = stm32mp1_select_ethck_external(plat_dat);
++	if (ret)
++		return ret;
++
+ 	switch (plat_dat->mac_interface) {
+ 	case PHY_INTERFACE_MODE_MII:
+-		if (dwmac->ext_phyclk)
+-			dwmac->enable_eth_ck = true;
+ 		val = SYSCFG_PMCR_ETH_SEL_MII;
+ 		pr_debug("SYSCFG init : PHY_INTERFACE_MODE_MII\n");
+ 		break;
+ 	case PHY_INTERFACE_MODE_GMII:
+ 		val = SYSCFG_PMCR_ETH_SEL_GMII;
+-		if (dwmac->eth_clk_sel_reg || dwmac->ext_phyclk) {
+-			dwmac->enable_eth_ck = true;
++		if (dwmac->enable_eth_ck)
+ 			val |= SYSCFG_PMCR_ETH_CLK_SEL;
+-		}
+ 		pr_debug("SYSCFG init : PHY_INTERFACE_MODE_GMII\n");
+ 		break;
+ 	case PHY_INTERFACE_MODE_RMII:
+ 		val = SYSCFG_PMCR_ETH_SEL_RMII;
+-		if (dwmac->eth_ref_clk_sel_reg || dwmac->ext_phyclk) {
+-			dwmac->enable_eth_ck = true;
++		if (dwmac->enable_eth_ck)
+ 			val |= SYSCFG_PMCR_ETH_REF_CLK_SEL;
+-		}
+ 		pr_debug("SYSCFG init : PHY_INTERFACE_MODE_RMII\n");
+ 		break;
+ 	case PHY_INTERFACE_MODE_RGMII:
+@@ -223,10 +251,8 @@ static int stm32mp1_set_mode(struct plat
+ 	case PHY_INTERFACE_MODE_RGMII_RXID:
+ 	case PHY_INTERFACE_MODE_RGMII_TXID:
+ 		val = SYSCFG_PMCR_ETH_SEL_RGMII;
+-		if (dwmac->eth_clk_sel_reg || dwmac->ext_phyclk) {
+-			dwmac->enable_eth_ck = true;
++		if (dwmac->enable_eth_ck)
+ 			val |= SYSCFG_PMCR_ETH_CLK_SEL;
+-		}
+ 		pr_debug("SYSCFG init : PHY_INTERFACE_MODE_RGMII\n");
+ 		break;
+ 	default:
diff --git a/target/linux/stm32/patches-6.6/005-net-stmmac-dwmac-stm32-Extract-PMCR-configuration.patch b/target/linux/stm32/patches-6.6/005-net-stmmac-dwmac-stm32-Extract-PMCR-configuration.patch
new file mode 100644
index 00000000000000..b28884df586ef7
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/005-net-stmmac-dwmac-stm32-Extract-PMCR-configuration.patch
@@ -0,0 +1,71 @@
+From bb7ab910631ee0ade0758a3c4aa8dadc3b6934b6 Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marex@denx.de>
+Date: Tue, 11 Jun 2024 10:36:02 +0200
+Subject: [PATCH 5/8] net: stmmac: dwmac-stm32: Extract PMCR configuration
+
+Pull the PMCR clock mux configuration into a separate function. This is
+the final change of three, which moves external clock rate validation,
+external clock selector decoding, and clock mux configuration into
+separate functions. This should make the code easier to understand.
+No functional change intended.
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Christophe Roullier <christophe.roullier@foss.st.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ .../net/ethernet/stmicro/stmmac/dwmac-stm32.c | 27 ++++++++++++-------
+ 1 file changed, 17 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
+@@ -219,15 +219,11 @@ static int stm32mp1_validate_ethck_rate(
+ 	return -EINVAL;
+ }
+ 
+-static int stm32mp1_set_mode(struct plat_stmmacenet_data *plat_dat)
++static int stm32mp1_configure_pmcr(struct plat_stmmacenet_data *plat_dat)
+ {
+ 	struct stm32_dwmac *dwmac = plat_dat->bsp_priv;
+ 	u32 reg = dwmac->mode_reg;
+-	int val, ret;
+-
+-	ret = stm32mp1_select_ethck_external(plat_dat);
+-	if (ret)
+-		return ret;
++	int val;
+ 
+ 	switch (plat_dat->mac_interface) {
+ 	case PHY_INTERFACE_MODE_MII:
+@@ -262,10 +258,6 @@ static int stm32mp1_set_mode(struct plat
+ 		return -EINVAL;
+ 	}
+ 
+-	ret = stm32mp1_validate_ethck_rate(plat_dat);
+-	if (ret)
+-		return ret;
+-
+ 	/* Need to update PMCCLRR (clear register) */
+ 	regmap_write(dwmac->regmap, reg + SYSCFG_PMCCLRR_OFFSET,
+ 		     dwmac->ops->syscfg_eth_mask);
+@@ -275,6 +267,21 @@ static int stm32mp1_set_mode(struct plat
+ 				 dwmac->ops->syscfg_eth_mask, val);
+ }
+ 
++static int stm32mp1_set_mode(struct plat_stmmacenet_data *plat_dat)
++{
++	int ret;
++
++	ret = stm32mp1_select_ethck_external(plat_dat);
++	if (ret)
++		return ret;
++
++	ret = stm32mp1_validate_ethck_rate(plat_dat);
++	if (ret)
++		return ret;
++
++	return stm32mp1_configure_pmcr(plat_dat);
++}
++
+ static int stm32mcu_set_mode(struct plat_stmmacenet_data *plat_dat)
+ {
+ 	struct stm32_dwmac *dwmac = plat_dat->bsp_priv;
diff --git a/target/linux/stm32/patches-6.6/006-net-stmmac-dwmac-stm32-Clean-up-the-debug-prints.patch b/target/linux/stm32/patches-6.6/006-net-stmmac-dwmac-stm32-Clean-up-the-debug-prints.patch
new file mode 100644
index 00000000000000..45050ae0775ed6
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/006-net-stmmac-dwmac-stm32-Clean-up-the-debug-prints.patch
@@ -0,0 +1,83 @@
+From 0476213f50452446fedd1a918b7bc72eb39a4c46 Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marex@denx.de>
+Date: Tue, 11 Jun 2024 10:36:03 +0200
+Subject: [PATCH 6/8] net: stmmac: dwmac-stm32: Clean up the debug prints
+
+Use dev_err()/dev_dbg() and phy_modes() to print PHY mode instead of
+pr_debug() and hand-written PHY mode decoding. This way, each debug
+print has associated device with it and duplicated mode decoding is
+removed.
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Christophe Roullier <christophe.roullier@foss.st.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ .../net/ethernet/stmicro/stmmac/dwmac-stm32.c  | 18 ++++++++----------
+ 1 file changed, 8 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
+@@ -228,19 +228,16 @@ static int stm32mp1_configure_pmcr(struc
+ 	switch (plat_dat->mac_interface) {
+ 	case PHY_INTERFACE_MODE_MII:
+ 		val = SYSCFG_PMCR_ETH_SEL_MII;
+-		pr_debug("SYSCFG init : PHY_INTERFACE_MODE_MII\n");
+ 		break;
+ 	case PHY_INTERFACE_MODE_GMII:
+ 		val = SYSCFG_PMCR_ETH_SEL_GMII;
+ 		if (dwmac->enable_eth_ck)
+ 			val |= SYSCFG_PMCR_ETH_CLK_SEL;
+-		pr_debug("SYSCFG init : PHY_INTERFACE_MODE_GMII\n");
+ 		break;
+ 	case PHY_INTERFACE_MODE_RMII:
+ 		val = SYSCFG_PMCR_ETH_SEL_RMII;
+ 		if (dwmac->enable_eth_ck)
+ 			val |= SYSCFG_PMCR_ETH_REF_CLK_SEL;
+-		pr_debug("SYSCFG init : PHY_INTERFACE_MODE_RMII\n");
+ 		break;
+ 	case PHY_INTERFACE_MODE_RGMII:
+ 	case PHY_INTERFACE_MODE_RGMII_ID:
+@@ -249,15 +246,16 @@ static int stm32mp1_configure_pmcr(struc
+ 		val = SYSCFG_PMCR_ETH_SEL_RGMII;
+ 		if (dwmac->enable_eth_ck)
+ 			val |= SYSCFG_PMCR_ETH_CLK_SEL;
+-		pr_debug("SYSCFG init : PHY_INTERFACE_MODE_RGMII\n");
+ 		break;
+ 	default:
+-		pr_debug("SYSCFG init :  Do not manage %d interface\n",
+-			 plat_dat->mac_interface);
++		dev_err(dwmac->dev, "Mode %s not supported",
++			phy_modes(plat_dat->mac_interface));
+ 		/* Do not manage others interfaces */
+ 		return -EINVAL;
+ 	}
+ 
++	dev_dbg(dwmac->dev, "Mode %s", phy_modes(plat_dat->mac_interface));
++
+ 	/* Need to update PMCCLRR (clear register) */
+ 	regmap_write(dwmac->regmap, reg + SYSCFG_PMCCLRR_OFFSET,
+ 		     dwmac->ops->syscfg_eth_mask);
+@@ -291,19 +289,19 @@ static int stm32mcu_set_mode(struct plat
+ 	switch (plat_dat->mac_interface) {
+ 	case PHY_INTERFACE_MODE_MII:
+ 		val = SYSCFG_MCU_ETH_SEL_MII;
+-		pr_debug("SYSCFG init : PHY_INTERFACE_MODE_MII\n");
+ 		break;
+ 	case PHY_INTERFACE_MODE_RMII:
+ 		val = SYSCFG_MCU_ETH_SEL_RMII;
+-		pr_debug("SYSCFG init : PHY_INTERFACE_MODE_RMII\n");
+ 		break;
+ 	default:
+-		pr_debug("SYSCFG init :  Do not manage %d interface\n",
+-			 plat_dat->mac_interface);
++		dev_err(dwmac->dev, "Mode %s not supported",
++			phy_modes(plat_dat->mac_interface));
+ 		/* Do not manage others interfaces */
+ 		return -EINVAL;
+ 	}
+ 
++	dev_dbg(dwmac->dev, "Mode %s", phy_modes(plat_dat->mac_interface));
++
+ 	return regmap_update_bits(dwmac->regmap, reg,
+ 				 dwmac->ops->syscfg_eth_mask, val << 23);
+ }
diff --git a/target/linux/stm32/patches-6.6/007-net-stmmac-dwmac-stm32-Mask-support-for-PMCR-configu.patch b/target/linux/stm32/patches-6.6/007-net-stmmac-dwmac-stm32-Mask-support-for-PMCR-configu.patch
new file mode 100644
index 00000000000000..336378abb34380
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/007-net-stmmac-dwmac-stm32-Mask-support-for-PMCR-configu.patch
@@ -0,0 +1,101 @@
+From 796669a85c5c4fa80cb8790e9adcccbbd99750e8 Mon Sep 17 00:00:00 2001
+From: Christophe Roullier <christophe.roullier@foss.st.com>
+Date: Tue, 11 Jun 2024 10:36:05 +0200
+Subject: [PATCH 7/8] net: stmmac: dwmac-stm32: Mask support for PMCR
+ configuration
+
+Add possibility to have second argument in syscon property to manage
+mask. This mask will be used to address right BITFIELDS of PMCR register.
+
+Signed-off-by: Christophe Roullier <christophe.roullier@foss.st.com>
+Reviewed-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ .../net/ethernet/stmicro/stmmac/dwmac-stm32.c | 28 +++++++++++++------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
+@@ -90,6 +90,7 @@ struct stm32_dwmac {
+ 	int eth_ref_clk_sel_reg;
+ 	int irq_pwr_wakeup;
+ 	u32 mode_reg;		 /* MAC glue-logic mode register */
++	u32 mode_mask;
+ 	struct regmap *regmap;
+ 	u32 speed;
+ 	const struct stm32_ops *ops;
+@@ -102,8 +103,8 @@ struct stm32_ops {
+ 	void (*resume)(struct stm32_dwmac *dwmac);
+ 	int (*parse_data)(struct stm32_dwmac *dwmac,
+ 			  struct device *dev);
+-	u32 syscfg_eth_mask;
+ 	bool clk_rx_enable_in_suspend;
++	u32 syscfg_clr_off;
+ };
+ 
+ static int stm32_dwmac_clk_enable(struct stm32_dwmac *dwmac, bool resume)
+@@ -256,13 +257,16 @@ static int stm32mp1_configure_pmcr(struc
+ 
+ 	dev_dbg(dwmac->dev, "Mode %s", phy_modes(plat_dat->mac_interface));
+ 
++	/* Shift value at correct ethernet MAC offset in SYSCFG_PMCSETR */
++	val <<= ffs(dwmac->mode_mask) - ffs(SYSCFG_MP1_ETH_MASK);
++
+ 	/* Need to update PMCCLRR (clear register) */
+-	regmap_write(dwmac->regmap, reg + SYSCFG_PMCCLRR_OFFSET,
+-		     dwmac->ops->syscfg_eth_mask);
++	regmap_write(dwmac->regmap, dwmac->ops->syscfg_clr_off,
++		     dwmac->mode_mask);
+ 
+ 	/* Update PMCSETR (set register) */
+ 	return regmap_update_bits(dwmac->regmap, reg,
+-				 dwmac->ops->syscfg_eth_mask, val);
++				 dwmac->mode_mask, val);
+ }
+ 
+ static int stm32mp1_set_mode(struct plat_stmmacenet_data *plat_dat)
+@@ -303,7 +307,7 @@ static int stm32mcu_set_mode(struct plat
+ 	dev_dbg(dwmac->dev, "Mode %s", phy_modes(plat_dat->mac_interface));
+ 
+ 	return regmap_update_bits(dwmac->regmap, reg,
+-				 dwmac->ops->syscfg_eth_mask, val << 23);
++				 SYSCFG_MCU_ETH_MASK, val << 23);
+ }
+ 
+ static void stm32_dwmac_clk_disable(struct stm32_dwmac *dwmac, bool suspend)
+@@ -348,8 +352,15 @@ static int stm32_dwmac_parse_data(struct
+ 		return PTR_ERR(dwmac->regmap);
+ 
+ 	err = of_property_read_u32_index(np, "st,syscon", 1, &dwmac->mode_reg);
+-	if (err)
++	if (err) {
+ 		dev_err(dev, "Can't get sysconfig mode offset (%d)\n", err);
++		return err;
++	}
++
++	dwmac->mode_mask = SYSCFG_MP1_ETH_MASK;
++	err = of_property_read_u32_index(np, "st,syscon", 2, &dwmac->mode_mask);
++	if (err)
++		dev_dbg(dev, "Warning sysconfig register mask not set\n");
+ 
+ 	return err;
+ }
+@@ -540,8 +551,7 @@ static SIMPLE_DEV_PM_OPS(stm32_dwmac_pm_
+ 	stm32_dwmac_suspend, stm32_dwmac_resume);
+ 
+ static struct stm32_ops stm32mcu_dwmac_data = {
+-	.set_mode = stm32mcu_set_mode,
+-	.syscfg_eth_mask = SYSCFG_MCU_ETH_MASK
++	.set_mode = stm32mcu_set_mode
+ };
+ 
+ static struct stm32_ops stm32mp1_dwmac_data = {
+@@ -549,7 +559,7 @@ static struct stm32_ops stm32mp1_dwmac_d
+ 	.suspend = stm32mp1_suspend,
+ 	.resume = stm32mp1_resume,
+ 	.parse_data = stm32mp1_parse_data,
+-	.syscfg_eth_mask = SYSCFG_MP1_ETH_MASK,
++	.syscfg_clr_off = 0x44,
+ 	.clk_rx_enable_in_suspend = true
+ };
+ 
diff --git a/target/linux/stm32/patches-6.6/008-net-stmmac-dwmac-stm32-add-management-of-stm32mp13-f.patch b/target/linux/stm32/patches-6.6/008-net-stmmac-dwmac-stm32-add-management-of-stm32mp13-f.patch
new file mode 100644
index 00000000000000..c2526019e2c7a9
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/008-net-stmmac-dwmac-stm32-add-management-of-stm32mp13-f.patch
@@ -0,0 +1,94 @@
+From 8d28aaf5d5dbfd1f452286fa6ac571df0bcf00ad Mon Sep 17 00:00:00 2001
+From: Christophe Roullier <christophe.roullier@foss.st.com>
+Date: Tue, 11 Jun 2024 10:36:06 +0200
+Subject: [PATCH 8/8] net: stmmac: dwmac-stm32: add management of stm32mp13 for
+ stm32
+
+Add Ethernet support for STM32MP13.
+STM32MP13 is STM32 SOC with 2 GMACs instances.
+GMAC IP version is SNPS 4.20.
+GMAC IP configure with 1 RX and 1 TX queue.
+DMA HW capability register supported
+RX Checksum Offload Engine supported
+TX Checksum insertion supported
+Wake-Up On Lan supported
+TSO supported
+
+Signed-off-by: Christophe Roullier <christophe.roullier@foss.st.com>
+Reviewed-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ .../net/ethernet/stmicro/stmmac/dwmac-stm32.c | 32 ++++++++++++++++---
+ 1 file changed, 28 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
+@@ -104,6 +104,7 @@ struct stm32_ops {
+ 	int (*parse_data)(struct stm32_dwmac *dwmac,
+ 			  struct device *dev);
+ 	bool clk_rx_enable_in_suspend;
++	bool is_mp13;
+ 	u32 syscfg_clr_off;
+ };
+ 
+@@ -224,11 +225,18 @@ static int stm32mp1_configure_pmcr(struc
+ {
+ 	struct stm32_dwmac *dwmac = plat_dat->bsp_priv;
+ 	u32 reg = dwmac->mode_reg;
+-	int val;
++	int val = 0;
+ 
+ 	switch (plat_dat->mac_interface) {
+ 	case PHY_INTERFACE_MODE_MII:
+-		val = SYSCFG_PMCR_ETH_SEL_MII;
++		/*
++		 * STM32MP15xx supports both MII and GMII, STM32MP13xx MII only.
++		 * SYSCFG_PMCSETR ETH_SELMII is present only on STM32MP15xx and
++		 * acts as a selector between 0:GMII and 1:MII. As STM32MP13xx
++		 * supports only MII, ETH_SELMII is not present.
++		 */
++		if (!dwmac->ops->is_mp13)  /* Select MII mode on STM32MP15xx */
++			val |= SYSCFG_PMCR_ETH_SEL_MII;
+ 		break;
+ 	case PHY_INTERFACE_MODE_GMII:
+ 		val = SYSCFG_PMCR_ETH_SEL_GMII;
+@@ -359,8 +367,12 @@ static int stm32_dwmac_parse_data(struct
+ 
+ 	dwmac->mode_mask = SYSCFG_MP1_ETH_MASK;
+ 	err = of_property_read_u32_index(np, "st,syscon", 2, &dwmac->mode_mask);
+-	if (err)
+-		dev_dbg(dev, "Warning sysconfig register mask not set\n");
++	if (err) {
++		if (dwmac->ops->is_mp13)
++			dev_err(dev, "Sysconfig register mask must be set (%d)\n", err);
++		else
++			dev_dbg(dev, "Warning sysconfig register mask not set\n");
++	}
+ 
+ 	return err;
+ }
+@@ -560,12 +572,24 @@ static struct stm32_ops stm32mp1_dwmac_d
+ 	.resume = stm32mp1_resume,
+ 	.parse_data = stm32mp1_parse_data,
+ 	.syscfg_clr_off = 0x44,
++	.is_mp13 = false,
++	.clk_rx_enable_in_suspend = true
++};
++
++static struct stm32_ops stm32mp13_dwmac_data = {
++	.set_mode = stm32mp1_set_mode,
++	.suspend = stm32mp1_suspend,
++	.resume = stm32mp1_resume,
++	.parse_data = stm32mp1_parse_data,
++	.syscfg_clr_off = 0x08,
++	.is_mp13 = true,
+ 	.clk_rx_enable_in_suspend = true
+ };
+ 
+ static const struct of_device_id stm32_dwmac_match[] = {
+ 	{ .compatible = "st,stm32-dwmac", .data = &stm32mcu_dwmac_data},
+ 	{ .compatible = "st,stm32mp1-dwmac", .data = &stm32mp1_dwmac_data},
++	{ .compatible = "st,stm32mp13-dwmac", .data = &stm32mp13_dwmac_data},
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(of, stm32_dwmac_match);
diff --git a/target/linux/stm32/patches-6.6/009-ARM-dts-stm32-add-ETZPC-as-a-system-bus-for-STM32MP1.patch b/target/linux/stm32/patches-6.6/009-ARM-dts-stm32-add-ETZPC-as-a-system-bus-for-STM32MP1.patch
new file mode 100644
index 00000000000000..f00001bc473daa
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/009-ARM-dts-stm32-add-ETZPC-as-a-system-bus-for-STM32MP1.patch
@@ -0,0 +1,1192 @@
+From d788961c5b25d9d822c4230bfbc536a6736b91ff Mon Sep 17 00:00:00 2001
+From: Gatien Chevallier <gatien.chevallier@foss.st.com>
+Date: Fri, 5 Jan 2024 14:04:03 +0100
+Subject: [PATCH 1/5] ARM: dts: stm32: add ETZPC as a system bus for STM32MP13x
+ boards
+
+ETZPC is a firewall controller. Put all peripherals filtered by the
+ETZPC as ETZPC subnodes and keep the "simple-bus" compatible for
+backward compatibility.
+
+Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+---
+ arch/arm/boot/dts/st/stm32mp131.dtsi  | 1020 +++++++++++++------------
+ arch/arm/boot/dts/st/stm32mp133.dtsi  |   50 +-
+ arch/arm/boot/dts/st/stm32mp13xc.dtsi |   18 +-
+ arch/arm/boot/dts/st/stm32mp13xf.dtsi |   18 +-
+ 4 files changed, 569 insertions(+), 537 deletions(-)
+
+--- a/arch/arm/boot/dts/st/stm32mp131.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp131.dtsi
+@@ -745,340 +745,6 @@
+ 			dma-channels = <16>;
+ 		};
+ 
+-		adc_2: adc@48004000 {
+-			compatible = "st,stm32mp13-adc-core";
+-			reg = <0x48004000 0x400>;
+-			interrupts = <GIC_SPI 19 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc ADC2>, <&rcc ADC2_K>;
+-			clock-names = "bus", "adc";
+-			interrupt-controller;
+-			#interrupt-cells = <1>;
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			status = "disabled";
+-
+-			adc2: adc@0 {
+-				compatible = "st,stm32mp13-adc";
+-				#io-channel-cells = <1>;
+-				#address-cells = <1>;
+-				#size-cells = <0>;
+-				reg = <0x0>;
+-				interrupt-parent = <&adc_2>;
+-				interrupts = <0>;
+-				dmas = <&dmamux1 10 0x400 0x80000001>;
+-				dma-names = "rx";
+-				status = "disabled";
+-
+-				channel@13 {
+-					reg = <13>;
+-					label = "vrefint";
+-				};
+-				channel@14 {
+-					reg = <14>;
+-					label = "vddcore";
+-				};
+-				channel@16 {
+-					reg = <16>;
+-					label = "vddcpu";
+-				};
+-				channel@17 {
+-					reg = <17>;
+-					label = "vddq_ddr";
+-				};
+-			};
+-		};
+-
+-		usbotg_hs: usb@49000000 {
+-			compatible = "st,stm32mp15-hsotg", "snps,dwc2";
+-			reg = <0x49000000 0x40000>;
+-			clocks = <&rcc USBO_K>;
+-			clock-names = "otg";
+-			resets = <&rcc USBO_R>;
+-			reset-names = "dwc2";
+-			interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_HIGH>;
+-			g-rx-fifo-size = <512>;
+-			g-np-tx-fifo-size = <32>;
+-			g-tx-fifo-size = <256 16 16 16 16 16 16 16>;
+-			dr_mode = "otg";
+-			otg-rev = <0x200>;
+-			usb33d-supply = <&scmi_usb33>;
+-			status = "disabled";
+-		};
+-
+-		usart1: serial@4c000000 {
+-			compatible = "st,stm32h7-uart";
+-			reg = <0x4c000000 0x400>;
+-			interrupts-extended = <&exti 26 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc USART1_K>;
+-			resets = <&rcc USART1_R>;
+-			wakeup-source;
+-			dmas = <&dmamux1 41 0x400 0x5>,
+-			       <&dmamux1 42 0x400 0x1>;
+-			dma-names = "rx", "tx";
+-			status = "disabled";
+-		};
+-
+-		usart2: serial@4c001000 {
+-			compatible = "st,stm32h7-uart";
+-			reg = <0x4c001000 0x400>;
+-			interrupts-extended = <&exti 27 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc USART2_K>;
+-			resets = <&rcc USART2_R>;
+-			wakeup-source;
+-			dmas = <&dmamux1 43 0x400 0x5>,
+-			       <&dmamux1 44 0x400 0x1>;
+-			dma-names = "rx", "tx";
+-			status = "disabled";
+-		};
+-
+-		i2s4: audio-controller@4c002000 {
+-			compatible = "st,stm32h7-i2s";
+-			reg = <0x4c002000 0x400>;
+-			#sound-dai-cells = <0>;
+-			interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>;
+-			dmas = <&dmamux1 83 0x400 0x01>,
+-			       <&dmamux1 84 0x400 0x01>;
+-			dma-names = "rx", "tx";
+-			status = "disabled";
+-		};
+-
+-		spi4: spi@4c002000 {
+-			compatible = "st,stm32h7-spi";
+-			reg = <0x4c002000 0x400>;
+-			interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc SPI4_K>;
+-			resets = <&rcc SPI4_R>;
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			dmas = <&dmamux1 83 0x400 0x01>,
+-			       <&dmamux1 84 0x400 0x01>;
+-			dma-names = "rx", "tx";
+-			status = "disabled";
+-		};
+-
+-		spi5: spi@4c003000 {
+-			compatible = "st,stm32h7-spi";
+-			reg = <0x4c003000 0x400>;
+-			interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc SPI5_K>;
+-			resets = <&rcc SPI5_R>;
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			dmas = <&dmamux1 85 0x400 0x01>,
+-			       <&dmamux1 86 0x400 0x01>;
+-			dma-names = "rx", "tx";
+-			status = "disabled";
+-		};
+-
+-		i2c3: i2c@4c004000 {
+-			compatible = "st,stm32mp13-i2c";
+-			reg = <0x4c004000 0x400>;
+-			interrupt-names = "event", "error";
+-			interrupts = <GIC_SPI 73 IRQ_TYPE_LEVEL_HIGH>,
+-				     <GIC_SPI 74 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc I2C3_K>;
+-			resets = <&rcc I2C3_R>;
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			dmas = <&dmamux1 73 0x400 0x1>,
+-			       <&dmamux1 74 0x400 0x1>;
+-			dma-names = "rx", "tx";
+-			st,syscfg-fmp = <&syscfg 0x4 0x4>;
+-			i2c-analog-filter;
+-			status = "disabled";
+-		};
+-
+-		i2c4: i2c@4c005000 {
+-			compatible = "st,stm32mp13-i2c";
+-			reg = <0x4c005000 0x400>;
+-			interrupt-names = "event", "error";
+-			interrupts = <GIC_SPI 93 IRQ_TYPE_LEVEL_HIGH>,
+-				     <GIC_SPI 94 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc I2C4_K>;
+-			resets = <&rcc I2C4_R>;
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			dmas = <&dmamux1 75 0x400 0x1>,
+-			       <&dmamux1 76 0x400 0x1>;
+-			dma-names = "rx", "tx";
+-			st,syscfg-fmp = <&syscfg 0x4 0x8>;
+-			i2c-analog-filter;
+-			status = "disabled";
+-		};
+-
+-		i2c5: i2c@4c006000 {
+-			compatible = "st,stm32mp13-i2c";
+-			reg = <0x4c006000 0x400>;
+-			interrupt-names = "event", "error";
+-			interrupts = <GIC_SPI 114 IRQ_TYPE_LEVEL_HIGH>,
+-				     <GIC_SPI 115 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc I2C5_K>;
+-			resets = <&rcc I2C5_R>;
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			dmas = <&dmamux1 115 0x400 0x1>,
+-			       <&dmamux1 116 0x400 0x1>;
+-			dma-names = "rx", "tx";
+-			st,syscfg-fmp = <&syscfg 0x4 0x10>;
+-			i2c-analog-filter;
+-			status = "disabled";
+-		};
+-
+-		timers12: timer@4c007000 {
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			compatible = "st,stm32-timers";
+-			reg = <0x4c007000 0x400>;
+-			interrupts = <GIC_SPI 104 IRQ_TYPE_LEVEL_HIGH>;
+-			interrupt-names = "global";
+-			clocks = <&rcc TIM12_K>;
+-			clock-names = "int";
+-			status = "disabled";
+-
+-			pwm {
+-				compatible = "st,stm32-pwm";
+-				#pwm-cells = <3>;
+-				status = "disabled";
+-			};
+-
+-			timer@11 {
+-				compatible = "st,stm32h7-timer-trigger";
+-				reg = <11>;
+-				status = "disabled";
+-			};
+-		};
+-
+-		timers13: timer@4c008000 {
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			compatible = "st,stm32-timers";
+-			reg = <0x4c008000 0x400>;
+-			interrupts = <GIC_SPI 111 IRQ_TYPE_LEVEL_HIGH>;
+-			interrupt-names = "global";
+-			clocks = <&rcc TIM13_K>;
+-			clock-names = "int";
+-			status = "disabled";
+-
+-			pwm {
+-				compatible = "st,stm32-pwm";
+-				#pwm-cells = <3>;
+-				status = "disabled";
+-			};
+-
+-			timer@12 {
+-				compatible = "st,stm32h7-timer-trigger";
+-				reg = <12>;
+-				status = "disabled";
+-			};
+-		};
+-
+-		timers14: timer@4c009000 {
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			compatible = "st,stm32-timers";
+-			reg = <0x4c009000 0x400>;
+-			interrupts = <GIC_SPI 112 IRQ_TYPE_LEVEL_HIGH>;
+-			interrupt-names = "global";
+-			clocks = <&rcc TIM14_K>;
+-			clock-names = "int";
+-			status = "disabled";
+-
+-			pwm {
+-				compatible = "st,stm32-pwm";
+-				#pwm-cells = <3>;
+-				status = "disabled";
+-			};
+-
+-			timer@13 {
+-				compatible = "st,stm32h7-timer-trigger";
+-				reg = <13>;
+-				status = "disabled";
+-			};
+-		};
+-
+-		timers15: timer@4c00a000 {
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			compatible = "st,stm32-timers";
+-			reg = <0x4c00a000 0x400>;
+-			interrupts = <GIC_SPI 101 IRQ_TYPE_LEVEL_HIGH>;
+-			interrupt-names = "global";
+-			clocks = <&rcc TIM15_K>;
+-			clock-names = "int";
+-			dmas = <&dmamux1 105 0x400 0x1>,
+-			       <&dmamux1 106 0x400 0x1>,
+-			       <&dmamux1 107 0x400 0x1>,
+-			       <&dmamux1 108 0x400 0x1>;
+-			dma-names = "ch1", "up", "trig", "com";
+-			status = "disabled";
+-
+-			pwm {
+-				compatible = "st,stm32-pwm";
+-				#pwm-cells = <3>;
+-				status = "disabled";
+-			};
+-
+-			timer@14 {
+-				compatible = "st,stm32h7-timer-trigger";
+-				reg = <14>;
+-				status = "disabled";
+-			};
+-		};
+-
+-		timers16: timer@4c00b000 {
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			compatible = "st,stm32-timers";
+-			reg = <0x4c00b000 0x400>;
+-			interrupts = <GIC_SPI 102 IRQ_TYPE_LEVEL_HIGH>;
+-			interrupt-names = "global";
+-			clocks = <&rcc TIM16_K>;
+-			clock-names = "int";
+-			dmas = <&dmamux1 109 0x400 0x1>,
+-			       <&dmamux1 110 0x400 0x1>;
+-			dma-names = "ch1", "up";
+-			status = "disabled";
+-
+-			pwm {
+-				compatible = "st,stm32-pwm";
+-				#pwm-cells = <3>;
+-				status = "disabled";
+-			};
+-
+-			timer@15 {
+-				compatible = "st,stm32h7-timer-trigger";
+-				reg = <15>;
+-				status = "disabled";
+-			};
+-		};
+-
+-		timers17: timer@4c00c000 {
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			compatible = "st,stm32-timers";
+-			reg = <0x4c00c000 0x400>;
+-			interrupts = <GIC_SPI 103 IRQ_TYPE_LEVEL_HIGH>;
+-			interrupt-names = "global";
+-			clocks = <&rcc TIM17_K>;
+-			clock-names = "int";
+-			dmas = <&dmamux1 111 0x400 0x1>,
+-			       <&dmamux1 112 0x400 0x1>;
+-			dma-names = "ch1", "up";
+-			status = "disabled";
+-
+-			pwm {
+-				compatible = "st,stm32-pwm";
+-				#pwm-cells = <3>;
+-				status = "disabled";
+-			};
+-
+-			timer@16 {
+-				compatible = "st,stm32h7-timer-trigger";
+-				reg = <16>;
+-				status = "disabled";
+-			};
+-		};
+-
+ 		rcc: rcc@50000000 {
+ 			compatible = "st,stm32mp13-rcc", "syscon";
+ 			reg = <0x50000000 0x1000>;
+@@ -1105,69 +771,6 @@
+ 			clocks = <&rcc SYSCFG>;
+ 		};
+ 
+-		lptimer2: timer@50021000 {
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			compatible = "st,stm32-lptimer";
+-			reg = <0x50021000 0x400>;
+-			interrupts-extended = <&exti 48 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc LPTIM2_K>;
+-			clock-names = "mux";
+-			wakeup-source;
+-			status = "disabled";
+-
+-			pwm {
+-				compatible = "st,stm32-pwm-lp";
+-				#pwm-cells = <3>;
+-				status = "disabled";
+-			};
+-
+-			trigger@1 {
+-				compatible = "st,stm32-lptimer-trigger";
+-				reg = <1>;
+-				status = "disabled";
+-			};
+-
+-			counter {
+-				compatible = "st,stm32-lptimer-counter";
+-				status = "disabled";
+-			};
+-
+-			timer {
+-				compatible = "st,stm32-lptimer-timer";
+-				status = "disabled";
+-			};
+-		};
+-
+-		lptimer3: timer@50022000 {
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			compatible = "st,stm32-lptimer";
+-			reg = <0x50022000 0x400>;
+-			interrupts-extended = <&exti 50 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc LPTIM3_K>;
+-			clock-names = "mux";
+-			wakeup-source;
+-			status = "disabled";
+-
+-			pwm {
+-				compatible = "st,stm32-pwm-lp";
+-				#pwm-cells = <3>;
+-				status = "disabled";
+-			};
+-
+-			trigger@2 {
+-				compatible = "st,stm32-lptimer-trigger";
+-				reg = <2>;
+-				status = "disabled";
+-			};
+-
+-			timer {
+-				compatible = "st,stm32-lptimer-timer";
+-				status = "disabled";
+-			};
+-		};
+-
+ 		lptimer4: timer@50023000 {
+ 			compatible = "st,stm32-lptimer";
+ 			reg = <0x50023000 0x400>;
+@@ -1220,79 +823,10 @@
+ 			dma-requests = <48>;
+ 		};
+ 
+-		fmc: memory-controller@58002000 {
+-			compatible = "st,stm32mp1-fmc2-ebi";
+-			reg = <0x58002000 0x1000>;
+-			ranges = <0 0 0x60000000 0x04000000>, /* EBI CS 1 */
+-				 <1 0 0x64000000 0x04000000>, /* EBI CS 2 */
+-				 <2 0 0x68000000 0x04000000>, /* EBI CS 3 */
+-				 <3 0 0x6c000000 0x04000000>, /* EBI CS 4 */
+-				 <4 0 0x80000000 0x10000000>; /* NAND */
+-			#address-cells = <2>;
+-			#size-cells = <1>;
+-			clocks = <&rcc FMC_K>;
+-			resets = <&rcc FMC_R>;
+-			status = "disabled";
+-
+-			nand-controller@4,0 {
+-				compatible = "st,stm32mp1-fmc2-nfc";
+-				reg = <4 0x00000000 0x1000>,
+-				      <4 0x08010000 0x1000>,
+-				      <4 0x08020000 0x1000>,
+-				      <4 0x01000000 0x1000>,
+-				      <4 0x09010000 0x1000>,
+-				      <4 0x09020000 0x1000>;
+-				#address-cells = <1>;
+-				#size-cells = <0>;
+-				interrupts = <GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>;
+-				dmas = <&mdma 24 0x2 0x12000a02 0x0 0x0>,
+-				       <&mdma 24 0x2 0x12000a08 0x0 0x0>,
+-				       <&mdma 25 0x2 0x12000a0a 0x0 0x0>;
+-				dma-names = "tx", "rx", "ecc";
+-				status = "disabled";
+-			};
+-		};
+-
+-		qspi: spi@58003000 {
+-			compatible = "st,stm32f469-qspi";
+-			reg = <0x58003000 0x1000>, <0x70000000 0x10000000>;
+-			reg-names = "qspi", "qspi_mm";
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			interrupts = <GIC_SPI 91 IRQ_TYPE_LEVEL_HIGH>;
+-			dmas = <&mdma 26 0x2 0x10100002 0x0 0x0>,
+-			       <&mdma 26 0x2 0x10100008 0x0 0x0>;
+-			dma-names = "tx", "rx";
+-			clocks = <&rcc QSPI_K>;
+-			resets = <&rcc QSPI_R>;
+-			status = "disabled";
+-		};
+-
+-		sdmmc1: mmc@58005000 {
+-			compatible = "st,stm32-sdmmc2", "arm,pl18x", "arm,primecell";
+-			arm,primecell-periphid = <0x20253180>;
+-			reg = <0x58005000 0x1000>, <0x58006000 0x1000>;
+-			interrupts = <GIC_SPI 50 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc SDMMC1_K>;
+-			clock-names = "apb_pclk";
+-			resets = <&rcc SDMMC1_R>;
+-			cap-sd-highspeed;
+-			cap-mmc-highspeed;
+-			max-frequency = <130000000>;
+-			status = "disabled";
+-		};
+-
+-		sdmmc2: mmc@58007000 {
+-			compatible = "st,stm32-sdmmc2", "arm,pl18x", "arm,primecell";
+-			arm,primecell-periphid = <0x20253180>;
+-			reg = <0x58007000 0x1000>, <0x58008000 0x1000>;
+-			interrupts = <GIC_SPI 108 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc SDMMC2_K>;
+-			clock-names = "apb_pclk";
+-			resets = <&rcc SDMMC2_R>;
+-			cap-sd-highspeed;
+-			cap-mmc-highspeed;
+-			max-frequency = <130000000>;
++		crc1: crc@58009000 {
++			compatible = "st,stm32f7-crc";
++			reg = <0x58009000 0x400>;
++			clocks = <&rcc CRC1>;
+ 			status = "disabled";
+ 		};
+ 
+@@ -1323,29 +857,6 @@
+ 			status = "disabled";
+ 		};
+ 
+-		usbphyc: usbphyc@5a006000 {
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			#clock-cells = <0>;
+-			compatible = "st,stm32mp1-usbphyc";
+-			reg = <0x5a006000 0x1000>;
+-			clocks = <&rcc USBPHY_K>;
+-			resets = <&rcc USBPHY_R>;
+-			vdda1v1-supply = <&scmi_reg11>;
+-			vdda1v8-supply = <&scmi_reg18>;
+-			status = "disabled";
+-
+-			usbphyc_port0: usb-phy@0 {
+-				#phy-cells = <0>;
+-				reg = <0>;
+-			};
+-
+-			usbphyc_port1: usb-phy@1 {
+-				#phy-cells = <1>;
+-				reg = <1>;
+-			};
+-		};
+-
+ 		rtc: rtc@5c004000 {
+ 			compatible = "st,stm32mp1-rtc";
+ 			reg = <0x5c004000 0x400>;
+@@ -1374,6 +885,529 @@
+ 			};
+ 		};
+ 
++		etzpc: bus@5c007000 {
++			compatible = "simple-bus";
++			reg = <0x5c007000 0x400>;
++			#address-cells = <1>;
++			#size-cells = <1>;
++			ranges;
++
++			adc_2: adc@48004000 {
++				compatible = "st,stm32mp13-adc-core";
++				reg = <0x48004000 0x400>;
++				interrupts = <GIC_SPI 19 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&rcc ADC2>, <&rcc ADC2_K>;
++				clock-names = "bus", "adc";
++				interrupt-controller;
++				#interrupt-cells = <1>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++				status = "disabled";
++
++				adc2: adc@0 {
++					compatible = "st,stm32mp13-adc";
++					#io-channel-cells = <1>;
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <0x0>;
++					interrupt-parent = <&adc_2>;
++					interrupts = <0>;
++					dmas = <&dmamux1 10 0x400 0x80000001>;
++					dma-names = "rx";
++					status = "disabled";
++
++					channel@13 {
++						reg = <13>;
++						label = "vrefint";
++					};
++					channel@14 {
++						reg = <14>;
++						label = "vddcore";
++					};
++					channel@16 {
++						reg = <16>;
++						label = "vddcpu";
++					};
++					channel@17 {
++						reg = <17>;
++						label = "vddq_ddr";
++					};
++				};
++			};
++
++			usbotg_hs: usb@49000000 {
++				compatible = "st,stm32mp15-hsotg", "snps,dwc2";
++				reg = <0x49000000 0x40000>;
++				clocks = <&rcc USBO_K>;
++				clock-names = "otg";
++				resets = <&rcc USBO_R>;
++				reset-names = "dwc2";
++				interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_HIGH>;
++				g-rx-fifo-size = <512>;
++				g-np-tx-fifo-size = <32>;
++				g-tx-fifo-size = <256 16 16 16 16 16 16 16>;
++				dr_mode = "otg";
++				otg-rev = <0x200>;
++				usb33d-supply = <&scmi_usb33>;
++				status = "disabled";
++			};
++
++			usart1: serial@4c000000 {
++				compatible = "st,stm32h7-uart";
++				reg = <0x4c000000 0x400>;
++				interrupts-extended = <&exti 26 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&rcc USART1_K>;
++				resets = <&rcc USART1_R>;
++				wakeup-source;
++				dmas = <&dmamux1 41 0x400 0x5>,
++				<&dmamux1 42 0x400 0x1>;
++				dma-names = "rx", "tx";
++				status = "disabled";
++			};
++
++			usart2: serial@4c001000 {
++				compatible = "st,stm32h7-uart";
++				reg = <0x4c001000 0x400>;
++				interrupts-extended = <&exti 27 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&rcc USART2_K>;
++				resets = <&rcc USART2_R>;
++				wakeup-source;
++				dmas = <&dmamux1 43 0x400 0x5>,
++				<&dmamux1 44 0x400 0x1>;
++				dma-names = "rx", "tx";
++				status = "disabled";
++			};
++
++			i2s4: audio-controller@4c002000 {
++				compatible = "st,stm32h7-i2s";
++				reg = <0x4c002000 0x400>;
++				#sound-dai-cells = <0>;
++				interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>;
++				dmas = <&dmamux1 83 0x400 0x01>,
++				<&dmamux1 84 0x400 0x01>;
++				dma-names = "rx", "tx";
++				status = "disabled";
++			};
++
++			spi4: spi@4c002000 {
++				compatible = "st,stm32h7-spi";
++				reg = <0x4c002000 0x400>;
++				interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&rcc SPI4_K>;
++				resets = <&rcc SPI4_R>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++				dmas = <&dmamux1 83 0x400 0x01>,
++				       <&dmamux1 84 0x400 0x01>;
++				dma-names = "rx", "tx";
++				status = "disabled";
++			};
++
++			spi5: spi@4c003000 {
++				compatible = "st,stm32h7-spi";
++				reg = <0x4c003000 0x400>;
++				interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&rcc SPI5_K>;
++				resets = <&rcc SPI5_R>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++				dmas = <&dmamux1 85 0x400 0x01>,
++				       <&dmamux1 86 0x400 0x01>;
++				dma-names = "rx", "tx";
++				status = "disabled";
++			};
++
++			i2c3: i2c@4c004000 {
++				compatible = "st,stm32mp13-i2c";
++				reg = <0x4c004000 0x400>;
++				interrupt-names = "event", "error";
++				interrupts = <GIC_SPI 73 IRQ_TYPE_LEVEL_HIGH>,
++					     <GIC_SPI 74 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&rcc I2C3_K>;
++				resets = <&rcc I2C3_R>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++				dmas = <&dmamux1 73 0x400 0x1>,
++				       <&dmamux1 74 0x400 0x1>;
++				dma-names = "rx", "tx";
++				st,syscfg-fmp = <&syscfg 0x4 0x4>;
++				i2c-analog-filter;
++				status = "disabled";
++			};
++
++			i2c4: i2c@4c005000 {
++				compatible = "st,stm32mp13-i2c";
++				reg = <0x4c005000 0x400>;
++				interrupt-names = "event", "error";
++				interrupts = <GIC_SPI 93 IRQ_TYPE_LEVEL_HIGH>,
++					     <GIC_SPI 94 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&rcc I2C4_K>;
++				resets = <&rcc I2C4_R>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++				dmas = <&dmamux1 75 0x400 0x1>,
++				       <&dmamux1 76 0x400 0x1>;
++				dma-names = "rx", "tx";
++				st,syscfg-fmp = <&syscfg 0x4 0x8>;
++				i2c-analog-filter;
++				status = "disabled";
++			};
++
++			i2c5: i2c@4c006000 {
++				compatible = "st,stm32mp13-i2c";
++				reg = <0x4c006000 0x400>;
++				interrupt-names = "event", "error";
++				interrupts = <GIC_SPI 114 IRQ_TYPE_LEVEL_HIGH>,
++					     <GIC_SPI 115 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&rcc I2C5_K>;
++				resets = <&rcc I2C5_R>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++				dmas = <&dmamux1 115 0x400 0x1>,
++				       <&dmamux1 116 0x400 0x1>;
++				dma-names = "rx", "tx";
++				st,syscfg-fmp = <&syscfg 0x4 0x10>;
++				i2c-analog-filter;
++				status = "disabled";
++			};
++
++			timers12: timer@4c007000 {
++				#address-cells = <1>;
++				#size-cells = <0>;
++				compatible = "st,stm32-timers";
++				reg = <0x4c007000 0x400>;
++				interrupts = <GIC_SPI 104 IRQ_TYPE_LEVEL_HIGH>;
++				interrupt-names = "global";
++				clocks = <&rcc TIM12_K>;
++				clock-names = "int";
++				status = "disabled";
++
++				pwm {
++					compatible = "st,stm32-pwm";
++					#pwm-cells = <3>;
++					status = "disabled";
++				};
++
++				timer@11 {
++					compatible = "st,stm32h7-timer-trigger";
++					reg = <11>;
++					status = "disabled";
++				};
++			};
++
++			timers13: timer@4c008000 {
++				#address-cells = <1>;
++				#size-cells = <0>;
++				compatible = "st,stm32-timers";
++				reg = <0x4c008000 0x400>;
++				interrupts = <GIC_SPI 111 IRQ_TYPE_LEVEL_HIGH>;
++				interrupt-names = "global";
++				clocks = <&rcc TIM13_K>;
++				clock-names = "int";
++				status = "disabled";
++
++				pwm {
++					compatible = "st,stm32-pwm";
++					#pwm-cells = <3>;
++					status = "disabled";
++				};
++
++				timer@12 {
++					compatible = "st,stm32h7-timer-trigger";
++					reg = <12>;
++					status = "disabled";
++				};
++			};
++
++			timers14: timer@4c009000 {
++				#address-cells = <1>;
++				#size-cells = <0>;
++				compatible = "st,stm32-timers";
++				reg = <0x4c009000 0x400>;
++				interrupts = <GIC_SPI 112 IRQ_TYPE_LEVEL_HIGH>;
++				interrupt-names = "global";
++				clocks = <&rcc TIM14_K>;
++				clock-names = "int";
++				status = "disabled";
++
++				pwm {
++					compatible = "st,stm32-pwm";
++					#pwm-cells = <3>;
++					status = "disabled";
++				};
++
++				timer@13 {
++					compatible = "st,stm32h7-timer-trigger";
++					reg = <13>;
++					status = "disabled";
++				};
++			};
++
++			timers15: timer@4c00a000 {
++				#address-cells = <1>;
++				#size-cells = <0>;
++				compatible = "st,stm32-timers";
++				reg = <0x4c00a000 0x400>;
++				interrupts = <GIC_SPI 101 IRQ_TYPE_LEVEL_HIGH>;
++				interrupt-names = "global";
++				clocks = <&rcc TIM15_K>;
++				clock-names = "int";
++				dmas = <&dmamux1 105 0x400 0x1>,
++				<&dmamux1 106 0x400 0x1>,
++				<&dmamux1 107 0x400 0x1>,
++				<&dmamux1 108 0x400 0x1>;
++				dma-names = "ch1", "up", "trig", "com";
++				status = "disabled";
++
++				pwm {
++					compatible = "st,stm32-pwm";
++					#pwm-cells = <3>;
++					status = "disabled";
++				};
++
++				timer@14 {
++					compatible = "st,stm32h7-timer-trigger";
++					reg = <14>;
++					status = "disabled";
++				};
++			};
++
++			timers16: timer@4c00b000 {
++				#address-cells = <1>;
++				#size-cells = <0>;
++				compatible = "st,stm32-timers";
++				reg = <0x4c00b000 0x400>;
++				interrupts = <GIC_SPI 102 IRQ_TYPE_LEVEL_HIGH>;
++				interrupt-names = "global";
++				clocks = <&rcc TIM16_K>;
++				clock-names = "int";
++				dmas = <&dmamux1 109 0x400 0x1>,
++				<&dmamux1 110 0x400 0x1>;
++				dma-names = "ch1", "up";
++				status = "disabled";
++
++				pwm {
++					compatible = "st,stm32-pwm";
++					#pwm-cells = <3>;
++					status = "disabled";
++				};
++
++				timer@15 {
++					compatible = "st,stm32h7-timer-trigger";
++					reg = <15>;
++					status = "disabled";
++				};
++			};
++
++			timers17: timer@4c00c000 {
++				#address-cells = <1>;
++				#size-cells = <0>;
++				compatible = "st,stm32-timers";
++				reg = <0x4c00c000 0x400>;
++				interrupts = <GIC_SPI 103 IRQ_TYPE_LEVEL_HIGH>;
++				interrupt-names = "global";
++				clocks = <&rcc TIM17_K>;
++				clock-names = "int";
++				dmas = <&dmamux1 111 0x400 0x1>,
++				       <&dmamux1 112 0x400 0x1>;
++				dma-names = "ch1", "up";
++				status = "disabled";
++
++				pwm {
++					compatible = "st,stm32-pwm";
++					#pwm-cells = <3>;
++					status = "disabled";
++				};
++
++				timer@16 {
++					compatible = "st,stm32h7-timer-trigger";
++					reg = <16>;
++					status = "disabled";
++				};
++			};
++
++			lptimer2: timer@50021000 {
++				#address-cells = <1>;
++				#size-cells = <0>;
++				compatible = "st,stm32-lptimer";
++				reg = <0x50021000 0x400>;
++				interrupts-extended = <&exti 48 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&rcc LPTIM2_K>;
++				clock-names = "mux";
++				wakeup-source;
++				status = "disabled";
++
++				pwm {
++					compatible = "st,stm32-pwm-lp";
++					#pwm-cells = <3>;
++					status = "disabled";
++				};
++
++				trigger@1 {
++					compatible = "st,stm32-lptimer-trigger";
++					reg = <1>;
++					status = "disabled";
++				};
++
++				counter {
++					compatible = "st,stm32-lptimer-counter";
++					status = "disabled";
++				};
++
++				timer {
++					compatible = "st,stm32-lptimer-timer";
++					status = "disabled";
++				};
++			};
++
++			lptimer3: timer@50022000 {
++				#address-cells = <1>;
++				#size-cells = <0>;
++				compatible = "st,stm32-lptimer";
++				reg = <0x50022000 0x400>;
++				interrupts-extended = <&exti 50 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&rcc LPTIM3_K>;
++				clock-names = "mux";
++				wakeup-source;
++				status = "disabled";
++
++				pwm {
++					compatible = "st,stm32-pwm-lp";
++					#pwm-cells = <3>;
++					status = "disabled";
++				};
++
++				trigger@2 {
++					compatible = "st,stm32-lptimer-trigger";
++					reg = <2>;
++					status = "disabled";
++				};
++
++				timer {
++					compatible = "st,stm32-lptimer-timer";
++					status = "disabled";
++				};
++			};
++
++			hash: hash@54003000 {
++				compatible = "st,stm32mp13-hash";
++				reg = <0x54003000 0x400>;
++				interrupts = <GIC_SPI 81 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&rcc HASH1>;
++				resets = <&rcc HASH1_R>;
++				dmas = <&mdma 30 0x2 0x1000a02 0x0 0x0>;
++				dma-names = "in";
++				status = "disabled";
++			};
++
++			rng: rng@54004000 {
++				compatible = "st,stm32mp13-rng";
++				reg = <0x54004000 0x400>;
++				clocks = <&rcc RNG1_K>;
++				resets = <&rcc RNG1_R>;
++				status = "disabled";
++			};
++
++			fmc: memory-controller@58002000 {
++				compatible = "st,stm32mp1-fmc2-ebi";
++				reg = <0x58002000 0x1000>;
++				ranges = <0 0 0x60000000 0x04000000>, /* EBI CS 1 */
++					 <1 0 0x64000000 0x04000000>, /* EBI CS 2 */
++					 <2 0 0x68000000 0x04000000>, /* EBI CS 3 */
++					 <3 0 0x6c000000 0x04000000>, /* EBI CS 4 */
++					 <4 0 0x80000000 0x10000000>; /* NAND */
++				#address-cells = <2>;
++				#size-cells = <1>;
++				clocks = <&rcc FMC_K>;
++				resets = <&rcc FMC_R>;
++				status = "disabled";
++
++				nand-controller@4,0 {
++					compatible = "st,stm32mp1-fmc2-nfc";
++					reg = <4 0x00000000 0x1000>,
++					      <4 0x08010000 0x1000>,
++					      <4 0x08020000 0x1000>,
++					      <4 0x01000000 0x1000>,
++					      <4 0x09010000 0x1000>,
++					      <4 0x09020000 0x1000>;
++					#address-cells = <1>;
++					#size-cells = <0>;
++					interrupts = <GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>;
++					dmas = <&mdma 24 0x2 0x12000a02 0x0 0x0>,
++					       <&mdma 24 0x2 0x12000a08 0x0 0x0>,
++					       <&mdma 25 0x2 0x12000a0a 0x0 0x0>;
++					dma-names = "tx", "rx", "ecc";
++					status = "disabled";
++				};
++			};
++
++			qspi: spi@58003000 {
++				compatible = "st,stm32f469-qspi";
++				reg = <0x58003000 0x1000>, <0x70000000 0x10000000>;
++				reg-names = "qspi", "qspi_mm";
++				#address-cells = <1>;
++				#size-cells = <0>;
++				interrupts = <GIC_SPI 91 IRQ_TYPE_LEVEL_HIGH>;
++				dmas = <&mdma 26 0x2 0x10100002 0x0 0x0>,
++				       <&mdma 26 0x2 0x10100008 0x0 0x0>;
++				dma-names = "tx", "rx";
++				clocks = <&rcc QSPI_K>;
++				resets = <&rcc QSPI_R>;
++				status = "disabled";
++			};
++
++			sdmmc1: mmc@58005000 {
++				compatible = "st,stm32-sdmmc2", "arm,pl18x", "arm,primecell";
++				arm,primecell-periphid = <0x20253180>;
++				reg = <0x58005000 0x1000>, <0x58006000 0x1000>;
++				interrupts = <GIC_SPI 50 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&rcc SDMMC1_K>;
++				clock-names = "apb_pclk";
++				resets = <&rcc SDMMC1_R>;
++				cap-sd-highspeed;
++				cap-mmc-highspeed;
++				max-frequency = <130000000>;
++				status = "disabled";
++			};
++
++			sdmmc2: mmc@58007000 {
++				compatible = "st,stm32-sdmmc2", "arm,pl18x", "arm,primecell";
++				arm,primecell-periphid = <0x20253180>;
++				reg = <0x58007000 0x1000>, <0x58008000 0x1000>;
++				interrupts = <GIC_SPI 108 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&rcc SDMMC2_K>;
++				clock-names = "apb_pclk";
++				resets = <&rcc SDMMC2_R>;
++				cap-sd-highspeed;
++				cap-mmc-highspeed;
++				max-frequency = <130000000>;
++				status = "disabled";
++			};
++
++			usbphyc: usbphyc@5a006000 {
++				#address-cells = <1>;
++				#size-cells = <0>;
++				#clock-cells = <0>;
++				compatible = "st,stm32mp1-usbphyc";
++				reg = <0x5a006000 0x1000>;
++				clocks = <&rcc USBPHY_K>;
++				resets = <&rcc USBPHY_R>;
++				vdda1v1-supply = <&scmi_reg11>;
++				vdda1v8-supply = <&scmi_reg18>;
++				status = "disabled";
++
++				usbphyc_port0: usb-phy@0 {
++					#phy-cells = <0>;
++					reg = <0>;
++				};
++
++				usbphyc_port1: usb-phy@1 {
++					#phy-cells = <1>;
++					reg = <1>;
++				};
++			};
++		};
++
+ 		/*
+ 		 * Break node order to solve dependency probe issue between
+ 		 * pinctrl and exti.
+--- a/arch/arm/boot/dts/st/stm32mp133.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp133.dtsi
+@@ -33,35 +33,37 @@
+ 			bosch,mram-cfg = <0x1400 0 0 32 0 0 2 2>;
+ 			status = "disabled";
+ 		};
++	};
++};
++
++&etzpc {
++	adc_1: adc@48003000 {
++		compatible = "st,stm32mp13-adc-core";
++		reg = <0x48003000 0x400>;
++		interrupts = <GIC_SPI 18 IRQ_TYPE_LEVEL_HIGH>;
++		clocks = <&rcc ADC1>, <&rcc ADC1_K>;
++		clock-names = "bus", "adc";
++		interrupt-controller;
++		#interrupt-cells = <1>;
++		#address-cells = <1>;
++		#size-cells = <0>;
++		status = "disabled";
+ 
+-		adc_1: adc@48003000 {
+-			compatible = "st,stm32mp13-adc-core";
+-			reg = <0x48003000 0x400>;
+-			interrupts = <GIC_SPI 18 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc ADC1>, <&rcc ADC1_K>;
+-			clock-names = "bus", "adc";
+-			interrupt-controller;
+-			#interrupt-cells = <1>;
++		adc1: adc@0 {
++			compatible = "st,stm32mp13-adc";
++			#io-channel-cells = <1>;
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
++			reg = <0x0>;
++			interrupt-parent = <&adc_1>;
++			interrupts = <0>;
++			dmas = <&dmamux1 9 0x400 0x80000001>;
++			dma-names = "rx";
+ 			status = "disabled";
+ 
+-			adc1: adc@0 {
+-				compatible = "st,stm32mp13-adc";
+-				#io-channel-cells = <1>;
+-				#address-cells = <1>;
+-				#size-cells = <0>;
+-				reg = <0x0>;
+-				interrupt-parent = <&adc_1>;
+-				interrupts = <0>;
+-				dmas = <&dmamux1 9 0x400 0x80000001>;
+-				dma-names = "rx";
+-				status = "disabled";
+-
+-				channel@18 {
+-					reg = <18>;
+-					label = "vrefint";
+-				};
++			channel@18 {
++				reg = <18>;
++				label = "vrefint";
+ 			};
+ 		};
+ 	};
+--- a/arch/arm/boot/dts/st/stm32mp13xc.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp13xc.dtsi
+@@ -4,15 +4,13 @@
+  * Author: Alexandre Torgue <alexandre.torgue@foss.st.com> for STMicroelectronics.
+  */
+ 
+-/ {
+-	soc {
+-		cryp: crypto@54002000 {
+-			compatible = "st,stm32mp1-cryp";
+-			reg = <0x54002000 0x400>;
+-			interrupts = <GIC_SPI 80 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc CRYP1>;
+-			resets = <&rcc CRYP1_R>;
+-			status = "disabled";
+-		};
++&etzpc {
++	cryp: crypto@54002000 {
++		compatible = "st,stm32mp1-cryp";
++		reg = <0x54002000 0x400>;
++		interrupts = <GIC_SPI 80 IRQ_TYPE_LEVEL_HIGH>;
++		clocks = <&rcc CRYP1>;
++		resets = <&rcc CRYP1_R>;
++		status = "disabled";
+ 	};
+ };
+--- a/arch/arm/boot/dts/st/stm32mp13xf.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp13xf.dtsi
+@@ -4,15 +4,13 @@
+  * Author: Alexandre Torgue <alexandre.torgue@foss.st.com> for STMicroelectronics.
+  */
+ 
+-/ {
+-	soc {
+-		cryp: crypto@54002000 {
+-			compatible = "st,stm32mp1-cryp";
+-			reg = <0x54002000 0x400>;
+-			interrupts = <GIC_SPI 80 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc CRYP1>;
+-			resets = <&rcc CRYP1_R>;
+-			status = "disabled";
+-		};
++&etzpc {
++	cryp: crypto@54002000 {
++		compatible = "st,stm32mp1-cryp";
++		reg = <0x54002000 0x400>;
++		interrupts = <GIC_SPI 80 IRQ_TYPE_LEVEL_HIGH>;
++		clocks = <&rcc CRYP1>;
++		resets = <&rcc CRYP1_R>;
++		status = "disabled";
+ 	};
+ };
diff --git a/target/linux/stm32/patches-6.6/010-ARM-dts-stm32-put-ETZPC-as-an-access-controller-for-.patch b/target/linux/stm32/patches-6.6/010-ARM-dts-stm32-put-ETZPC-as-an-access-controller-for-.patch
new file mode 100644
index 00000000000000..e6a4eee0571b23
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/010-ARM-dts-stm32-put-ETZPC-as-an-access-controller-for-.patch
@@ -0,0 +1,265 @@
+From 21ca3d7c59595d76237faebeff4f6a979cf7ae82 Mon Sep 17 00:00:00 2001
+From: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Date: Fri, 5 Apr 2024 13:45:24 +0200
+Subject: [PATCH 2/5] ARM: dts: stm32: put ETZPC as an access controller for
+ STM32MP13x boards
+
+Reference ETZPC as an access-control-provider.
+
+For more information on which peripheral is securable or supports MCU
+isolation, please read the STM32MP13 reference manual
+
+Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+---
+ arch/arm/boot/dts/st/stm32mp131.dtsi  | 28 ++++++++++++++++++++++++++-
+ arch/arm/boot/dts/st/stm32mp133.dtsi  |  1 +
+ arch/arm/boot/dts/st/stm32mp13xc.dtsi |  1 +
+ arch/arm/boot/dts/st/stm32mp13xf.dtsi |  1 +
+ 4 files changed, 30 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/st/stm32mp131.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp131.dtsi
+@@ -886,10 +886,11 @@
+ 		};
+ 
+ 		etzpc: bus@5c007000 {
+-			compatible = "simple-bus";
++			compatible = "st,stm32-etzpc", "simple-bus";
+ 			reg = <0x5c007000 0x400>;
+ 			#address-cells = <1>;
+ 			#size-cells = <1>;
++			#access-controller-cells = <1>;
+ 			ranges;
+ 
+ 			adc_2: adc@48004000 {
+@@ -902,6 +903,7 @@
+ 				#interrupt-cells = <1>;
+ 				#address-cells = <1>;
+ 				#size-cells = <0>;
++				access-controllers = <&etzpc 33>;
+ 				status = "disabled";
+ 
+ 				adc2: adc@0 {
+@@ -949,6 +951,7 @@
+ 				dr_mode = "otg";
+ 				otg-rev = <0x200>;
+ 				usb33d-supply = <&scmi_usb33>;
++				access-controllers = <&etzpc 34>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -962,6 +965,7 @@
+ 				dmas = <&dmamux1 41 0x400 0x5>,
+ 				<&dmamux1 42 0x400 0x1>;
+ 				dma-names = "rx", "tx";
++				access-controllers = <&etzpc 16>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -975,6 +979,7 @@
+ 				dmas = <&dmamux1 43 0x400 0x5>,
+ 				<&dmamux1 44 0x400 0x1>;
+ 				dma-names = "rx", "tx";
++				access-controllers = <&etzpc 17>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -986,6 +991,7 @@
+ 				dmas = <&dmamux1 83 0x400 0x01>,
+ 				<&dmamux1 84 0x400 0x01>;
+ 				dma-names = "rx", "tx";
++				access-controllers = <&etzpc 13>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -1000,6 +1006,7 @@
+ 				dmas = <&dmamux1 83 0x400 0x01>,
+ 				       <&dmamux1 84 0x400 0x01>;
+ 				dma-names = "rx", "tx";
++				access-controllers = <&etzpc 18>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -1014,6 +1021,7 @@
+ 				dmas = <&dmamux1 85 0x400 0x01>,
+ 				       <&dmamux1 86 0x400 0x01>;
+ 				dma-names = "rx", "tx";
++				access-controllers = <&etzpc 19>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -1032,6 +1040,7 @@
+ 				dma-names = "rx", "tx";
+ 				st,syscfg-fmp = <&syscfg 0x4 0x4>;
+ 				i2c-analog-filter;
++				access-controllers = <&etzpc 20>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -1050,6 +1059,7 @@
+ 				dma-names = "rx", "tx";
+ 				st,syscfg-fmp = <&syscfg 0x4 0x8>;
+ 				i2c-analog-filter;
++				access-controllers = <&etzpc 21>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -1068,6 +1078,7 @@
+ 				dma-names = "rx", "tx";
+ 				st,syscfg-fmp = <&syscfg 0x4 0x10>;
+ 				i2c-analog-filter;
++				access-controllers = <&etzpc 22>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -1080,6 +1091,7 @@
+ 				interrupt-names = "global";
+ 				clocks = <&rcc TIM12_K>;
+ 				clock-names = "int";
++				access-controllers = <&etzpc 23>;
+ 				status = "disabled";
+ 
+ 				pwm {
+@@ -1104,6 +1116,7 @@
+ 				interrupt-names = "global";
+ 				clocks = <&rcc TIM13_K>;
+ 				clock-names = "int";
++				access-controllers = <&etzpc 24>;
+ 				status = "disabled";
+ 
+ 				pwm {
+@@ -1128,6 +1141,7 @@
+ 				interrupt-names = "global";
+ 				clocks = <&rcc TIM14_K>;
+ 				clock-names = "int";
++				access-controllers = <&etzpc 25>;
+ 				status = "disabled";
+ 
+ 				pwm {
+@@ -1157,6 +1171,7 @@
+ 				<&dmamux1 107 0x400 0x1>,
+ 				<&dmamux1 108 0x400 0x1>;
+ 				dma-names = "ch1", "up", "trig", "com";
++				access-controllers = <&etzpc 26>;
+ 				status = "disabled";
+ 
+ 				pwm {
+@@ -1184,6 +1199,7 @@
+ 				dmas = <&dmamux1 109 0x400 0x1>,
+ 				<&dmamux1 110 0x400 0x1>;
+ 				dma-names = "ch1", "up";
++				access-controllers = <&etzpc 27>;
+ 				status = "disabled";
+ 
+ 				pwm {
+@@ -1211,6 +1227,7 @@
+ 				dmas = <&dmamux1 111 0x400 0x1>,
+ 				       <&dmamux1 112 0x400 0x1>;
+ 				dma-names = "ch1", "up";
++				access-controllers = <&etzpc 28>;
+ 				status = "disabled";
+ 
+ 				pwm {
+@@ -1235,6 +1252,7 @@
+ 				clocks = <&rcc LPTIM2_K>;
+ 				clock-names = "mux";
+ 				wakeup-source;
++				access-controllers = <&etzpc 1>;
+ 				status = "disabled";
+ 
+ 				pwm {
+@@ -1269,6 +1287,7 @@
+ 				clocks = <&rcc LPTIM3_K>;
+ 				clock-names = "mux";
+ 				wakeup-source;
++				access-controllers = <&etzpc 2>;
+ 				status = "disabled";
+ 
+ 				pwm {
+@@ -1297,6 +1316,7 @@
+ 				resets = <&rcc HASH1_R>;
+ 				dmas = <&mdma 30 0x2 0x1000a02 0x0 0x0>;
+ 				dma-names = "in";
++				access-controllers = <&etzpc 41>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -1305,6 +1325,7 @@
+ 				reg = <0x54004000 0x400>;
+ 				clocks = <&rcc RNG1_K>;
+ 				resets = <&rcc RNG1_R>;
++				access-controllers = <&etzpc 40>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -1320,6 +1341,7 @@
+ 				#size-cells = <1>;
+ 				clocks = <&rcc FMC_K>;
+ 				resets = <&rcc FMC_R>;
++				access-controllers = <&etzpc 54>;
+ 				status = "disabled";
+ 
+ 				nand-controller@4,0 {
+@@ -1353,6 +1375,7 @@
+ 				dma-names = "tx", "rx";
+ 				clocks = <&rcc QSPI_K>;
+ 				resets = <&rcc QSPI_R>;
++				access-controllers = <&etzpc 55>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -1367,6 +1390,7 @@
+ 				cap-sd-highspeed;
+ 				cap-mmc-highspeed;
+ 				max-frequency = <130000000>;
++				access-controllers = <&etzpc 50>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -1381,6 +1405,7 @@
+ 				cap-sd-highspeed;
+ 				cap-mmc-highspeed;
+ 				max-frequency = <130000000>;
++				access-controllers = <&etzpc 51>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -1394,6 +1419,7 @@
+ 				resets = <&rcc USBPHY_R>;
+ 				vdda1v1-supply = <&scmi_reg11>;
+ 				vdda1v8-supply = <&scmi_reg18>;
++				access-controllers = <&etzpc 5>;
+ 				status = "disabled";
+ 
+ 				usbphyc_port0: usb-phy@0 {
+--- a/arch/arm/boot/dts/st/stm32mp133.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp133.dtsi
+@@ -47,6 +47,7 @@
+ 		#interrupt-cells = <1>;
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
++		access-controllers = <&etzpc 32>;
+ 		status = "disabled";
+ 
+ 		adc1: adc@0 {
+--- a/arch/arm/boot/dts/st/stm32mp13xc.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp13xc.dtsi
+@@ -11,6 +11,7 @@
+ 		interrupts = <GIC_SPI 80 IRQ_TYPE_LEVEL_HIGH>;
+ 		clocks = <&rcc CRYP1>;
+ 		resets = <&rcc CRYP1_R>;
++		access-controllers = <&etzpc 42>;
+ 		status = "disabled";
+ 	};
+ };
+--- a/arch/arm/boot/dts/st/stm32mp13xf.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp13xf.dtsi
+@@ -11,6 +11,7 @@
+ 		interrupts = <GIC_SPI 80 IRQ_TYPE_LEVEL_HIGH>;
+ 		clocks = <&rcc CRYP1>;
+ 		resets = <&rcc CRYP1_R>;
++		access-controllers = <&etzpc 42>;
+ 		status = "disabled";
+ 	};
+ };
diff --git a/target/linux/stm32/patches-6.6/011-ARM-dts-stm32-add-ethernet1-2-RMII-pins-for-STM32MP1.patch b/target/linux/stm32/patches-6.6/011-ARM-dts-stm32-add-ethernet1-2-RMII-pins-for-STM32MP1.patch
new file mode 100644
index 00000000000000..123bde88417e28
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/011-ARM-dts-stm32-add-ethernet1-2-RMII-pins-for-STM32MP1.patch
@@ -0,0 +1,126 @@
+From b1468a44e0c0f43a06e027efeff4183b3aee0cf7 Mon Sep 17 00:00:00 2001
+From: Christophe Roullier <christophe.roullier@foss.st.com>
+Date: Mon, 10 Jun 2024 10:03:08 +0200
+Subject: [PATCH 3/5] ARM: dts: stm32: add ethernet1/2 RMII pins for
+ STM32MP13F-DK board
+
+Those pins are used for Ethernet 1 and 2 on STM32MP13F-DK board.
+ethernet1: RMII with crystal.
+ethernet2: RMII without crystal.
+Add analog gpio pin configuration ("sleep") to manage power mode on
+stm32mp13.
+
+Signed-off-by: Christophe Roullier <christophe.roullier@foss.st.com>
+Reviewed-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+---
+ arch/arm/boot/dts/st/stm32mp13-pinctrl.dtsi | 98 +++++++++++++++++++++
+ 1 file changed, 98 insertions(+)
+
+--- a/arch/arm/boot/dts/st/stm32mp13-pinctrl.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp13-pinctrl.dtsi
+@@ -13,6 +13,104 @@
+ 		};
+ 	};
+ 
++	eth1_rgmii_pins_a: eth1-rgmii-0 {
++		pins1 {
++			pinmux = <STM32_PINMUX('G', 13, AF11)>, /* ETH_RGMII_TXD0 */
++				 <STM32_PINMUX('G', 14, AF11)>, /* ETH_RGMII_TXD1 */
++				 <STM32_PINMUX('C', 2, AF11)>, /* ETH_RGMII_TXD2 */
++				 <STM32_PINMUX('E', 5, AF10)>, /* ETH_RGMII_TXD3 */
++				 <STM32_PINMUX('B', 11, AF11)>, /* ETH_RGMII_TX_CTL */
++				 <STM32_PINMUX('C', 1, AF11)>, /* ETH_RGMII_GTX_CLK */
++				 <STM32_PINMUX('A', 2, AF11)>, /* ETH_MDIO */
++				 <STM32_PINMUX('G', 2, AF11)>; /* ETH_MDC */
++			bias-disable;
++			drive-push-pull;
++			slew-rate = <2>;
++		};
++
++		pins2 {
++			pinmux = <STM32_PINMUX('C', 4, AF11)>, /* ETH_RGMII_RXD0 */
++				 <STM32_PINMUX('C', 5, AF11)>, /* ETH_RGMII_RXD1 */
++				 <STM32_PINMUX('B', 0, AF11)>, /* ETH_RGMII_RXD2 */
++				 <STM32_PINMUX('B', 1, AF11)>, /* ETH_RGMII_RXD3 */
++				 <STM32_PINMUX('A', 7, AF11)>, /* ETH_RGMII_RX_CTL */
++				 <STM32_PINMUX('D', 7, AF10)>; /* ETH_RGMII_RX_CLK */
++			bias-disable;
++		};
++
++	};
++
++	eth1_rmii_pins_a: eth1-rmii-0 {
++		pins1 {
++			pinmux = <STM32_PINMUX('G', 13, AF11)>, /* ETH_RMII_TXD0 */
++				 <STM32_PINMUX('G', 14, AF11)>, /* ETH_RMII_TXD1 */
++				 <STM32_PINMUX('B', 11, AF11)>, /* ETH_RMII_TX_EN */
++				 <STM32_PINMUX('A', 1, AF11)>, /* ETH_RMII_REF_CLK */
++				 <STM32_PINMUX('A', 2, AF11)>, /* ETH_MDIO */
++				 <STM32_PINMUX('G', 2, AF11)>; /* ETH_MDC */
++			bias-disable;
++			drive-push-pull;
++			slew-rate = <1>;
++		};
++
++		pins2 {
++			pinmux = <STM32_PINMUX('C', 4, AF11)>, /* ETH_RMII_RXD0 */
++				 <STM32_PINMUX('C', 5, AF11)>, /* ETH_RMII_RXD1 */
++				 <STM32_PINMUX('C', 1, AF10)>; /* ETH_RMII_CRS_DV */
++			bias-disable;
++		};
++
++	};
++
++	eth1_rmii_sleep_pins_a: eth1-rmii-sleep-0 {
++		pins1 {
++			pinmux = <STM32_PINMUX('G', 13, ANALOG)>, /* ETH_RMII_TXD0 */
++				 <STM32_PINMUX('G', 14, ANALOG)>, /* ETH_RMII_TXD1 */
++				 <STM32_PINMUX('B', 11, ANALOG)>, /* ETH_RMII_TX_EN */
++				 <STM32_PINMUX('A', 1, ANALOG)>, /* ETH_RMII_REF_CLK */
++				 <STM32_PINMUX('A', 2, ANALOG)>, /* ETH_MDIO */
++				 <STM32_PINMUX('G', 2, ANALOG)>, /* ETH_MDC */
++				 <STM32_PINMUX('C', 4, ANALOG)>, /* ETH_RMII_RXD0 */
++				 <STM32_PINMUX('C', 5, ANALOG)>, /* ETH_RMII_RXD1 */
++				 <STM32_PINMUX('C', 1, ANALOG)>; /* ETH_RMII_CRS_DV */
++		};
++	};
++
++	eth2_rmii_pins_a: eth2-rmii-0 {
++		pins1 {
++			pinmux = <STM32_PINMUX('F', 7, AF11)>, /* ETH_RMII_TXD0 */
++				 <STM32_PINMUX('G', 11, AF10)>, /* ETH_RMII_TXD1 */
++				 <STM32_PINMUX('G', 8, AF13)>, /* ETH_RMII_ETHCK */
++				 <STM32_PINMUX('F', 6, AF11)>, /* ETH_RMII_TX_EN */
++				 <STM32_PINMUX('B', 2, AF11)>, /* ETH_MDIO */
++				 <STM32_PINMUX('G', 5, AF10)>; /* ETH_MDC */
++			bias-disable;
++			drive-push-pull;
++			slew-rate = <1>;
++		};
++
++		pins2 {
++			pinmux = <STM32_PINMUX('F', 4, AF11)>, /* ETH_RMII_RXD0 */
++				 <STM32_PINMUX('E', 2, AF10)>, /* ETH_RMII_RXD1 */
++				 <STM32_PINMUX('A', 12, AF11)>; /* ETH_RMII_CRS_DV */
++			bias-disable;
++		};
++	};
++
++	eth2_rmii_sleep_pins_a: eth2-rmii-sleep-0 {
++		pins1 {
++			pinmux = <STM32_PINMUX('F', 7, ANALOG)>, /* ETH_RMII_TXD0 */
++				 <STM32_PINMUX('G', 11, ANALOG)>, /* ETH_RMII_TXD1 */
++				 <STM32_PINMUX('G', 8, ANALOG)>, /* ETH_RMII_ETHCK */
++				 <STM32_PINMUX('F', 6, ANALOG)>, /* ETH_RMII_TX_EN */
++				 <STM32_PINMUX('B', 2, ANALOG)>, /* ETH_MDIO */
++				 <STM32_PINMUX('G', 5, ANALOG)>, /* ETH_MDC */
++				 <STM32_PINMUX('F', 4, ANALOG)>, /* ETH_RMII_RXD0 */
++				 <STM32_PINMUX('E', 2, ANALOG)>, /* ETH_RMII_RXD1 */
++				 <STM32_PINMUX('A', 12, ANALOG)>; /* ETH_RMII_CRS_DV */
++		};
++	};
++
+ 	i2c1_pins_a: i2c1-0 {
+ 		pins {
+ 			pinmux = <STM32_PINMUX('D', 12, AF5)>, /* I2C1_SCL */
diff --git a/target/linux/stm32/patches-6.6/012-ARM-dts-stm32-add-ethernet1-and-ethernet2-support-on.patch b/target/linux/stm32/patches-6.6/012-ARM-dts-stm32-add-ethernet1-and-ethernet2-support-on.patch
new file mode 100644
index 00000000000000..947b1413244e33
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/012-ARM-dts-stm32-add-ethernet1-and-ethernet2-support-on.patch
@@ -0,0 +1,108 @@
+From fcf6ca2da4650d0a7a9cd62c8c72341860931159 Mon Sep 17 00:00:00 2001
+From: Christophe Roullier <christophe.roullier@foss.st.com>
+Date: Mon, 10 Jun 2024 10:03:07 +0200
+Subject: [PATCH 4/5] ARM: dts: stm32: add ethernet1 and ethernet2 support on
+ stm32mp13
+
+Both instances ethernet based on GMAC SNPS IP on stm32mp13.
+GMAC IP version is SNPS 4.20.
+
+Signed-off-by: Christophe Roullier <christophe.roullier@foss.st.com>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+---
+ arch/arm/boot/dts/st/stm32mp131.dtsi | 38 ++++++++++++++++++++++++++++
+ arch/arm/boot/dts/st/stm32mp133.dtsi | 31 +++++++++++++++++++++++
+ 2 files changed, 69 insertions(+)
+
+--- a/arch/arm/boot/dts/st/stm32mp131.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp131.dtsi
+@@ -883,6 +883,12 @@
+ 			ts_cal2: calib@5e {
+ 				reg = <0x5e 0x2>;
+ 			};
++			ethernet_mac1_address: mac1@e4 {
++				reg = <0xe4 0x6>;
++			};
++			ethernet_mac2_address: mac2@ea {
++				reg = <0xea 0x6>;
++			};
+ 		};
+ 
+ 		etzpc: bus@5c007000 {
+@@ -1409,6 +1415,38 @@
+ 				status = "disabled";
+ 			};
+ 
++			ethernet1: ethernet@5800a000 {
++				compatible = "st,stm32mp13-dwmac", "snps,dwmac-4.20a";
++				reg = <0x5800a000 0x2000>;
++				reg-names = "stmmaceth";
++				interrupts-extended = <&intc GIC_SPI 62 IRQ_TYPE_LEVEL_HIGH>,
++						      <&exti 68 1>;
++				interrupt-names = "macirq", "eth_wake_irq";
++				clock-names = "stmmaceth",
++					      "mac-clk-tx",
++					      "mac-clk-rx",
++					      "ethstp",
++					      "eth-ck";
++				clocks = <&rcc ETH1MAC>,
++					 <&rcc ETH1TX>,
++					 <&rcc ETH1RX>,
++					 <&rcc ETH1STP>,
++					 <&rcc ETH1CK_K>;
++				st,syscon = <&syscfg 0x4 0xff0000>;
++				snps,mixed-burst;
++				snps,pbl = <2>;
++				snps,axi-config = <&stmmac_axi_config_1>;
++				snps,tso;
++				access-controllers = <&etzpc 48>;
++				status = "disabled";
++
++				stmmac_axi_config_1: stmmac-axi-config {
++					snps,blen = <0 0 0 0 16 8 4>;
++					snps,rd_osr_lmt = <0x7>;
++					snps,wr_osr_lmt = <0x7>;
++				};
++			};
++
+ 			usbphyc: usbphyc@5a006000 {
+ 				#address-cells = <1>;
+ 				#size-cells = <0>;
+--- a/arch/arm/boot/dts/st/stm32mp133.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp133.dtsi
+@@ -68,4 +68,35 @@
+ 			};
+ 		};
+ 	};
++
++	ethernet2: ethernet@5800e000 {
++		compatible = "st,stm32mp13-dwmac", "snps,dwmac-4.20a";
++		reg = <0x5800e000 0x2000>;
++		reg-names = "stmmaceth";
++		interrupts-extended = <&intc GIC_SPI 97 IRQ_TYPE_LEVEL_HIGH>;
++		interrupt-names = "macirq";
++		clock-names = "stmmaceth",
++			      "mac-clk-tx",
++			      "mac-clk-rx",
++			      "ethstp",
++			      "eth-ck";
++		clocks = <&rcc ETH2MAC>,
++			 <&rcc ETH2TX>,
++			 <&rcc ETH2RX>,
++			 <&rcc ETH2STP>,
++			 <&rcc ETH2CK_K>;
++		st,syscon = <&syscfg 0x4 0xff000000>;
++		snps,mixed-burst;
++		snps,pbl = <2>;
++		snps,axi-config = <&stmmac_axi_config_2>;
++		snps,tso;
++		access-controllers = <&etzpc 49>;
++		status = "disabled";
++
++		stmmac_axi_config_2: stmmac-axi-config {
++			snps,blen = <0 0 0 0 16 8 4>;
++			snps,rd_osr_lmt = <0x7>;
++			snps,wr_osr_lmt = <0x7>;
++		};
++	};
+ };
diff --git a/target/linux/stm32/patches-6.6/013-ARM-dts-stm32-add-ethernet1-for-STM32MP135F-DK-board.patch b/target/linux/stm32/patches-6.6/013-ARM-dts-stm32-add-ethernet1-for-STM32MP135F-DK-board.patch
new file mode 100644
index 00000000000000..79408c5badeb9d
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/013-ARM-dts-stm32-add-ethernet1-for-STM32MP135F-DK-board.patch
@@ -0,0 +1,58 @@
+From b255afeeb33efaa974b1b2454b1f58252d783b67 Mon Sep 17 00:00:00 2001
+From: Christophe Roullier <christophe.roullier@foss.st.com>
+Date: Mon, 10 Jun 2024 10:03:09 +0200
+Subject: [PATCH 5/5] ARM: dts: stm32: add ethernet1 for STM32MP135F-DK board
+
+Ethernet1: RMII with crystal
+Ethernet2: RMII with no cristal, need "phy-supply" property to work,
+today this property was managed by Ethernet glue, but should be present
+and managed in PHY node. So I will push second Ethernet in next step.
+
+PHYs used are SMSC (LAN8742A)
+
+Signed-off-by: Christophe Roullier <christophe.roullier@foss.st.com>
+Reviewed-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+---
+ arch/arm/boot/dts/st/stm32mp135f-dk.dts | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+--- a/arch/arm/boot/dts/st/stm32mp135f-dk.dts
++++ b/arch/arm/boot/dts/st/stm32mp135f-dk.dts
+@@ -19,6 +19,7 @@
+ 	compatible = "st,stm32mp135f-dk", "st,stm32mp135";
+ 
+ 	aliases {
++		ethernet0 = &ethernet1;
+ 		serial0 = &uart4;
+ 		serial1 = &usart1;
+ 		serial2 = &uart8;
+@@ -92,6 +93,28 @@
+ 		};
+ 	};
+ };
++
++&ethernet1 {
++	status = "okay";
++	pinctrl-0 = <&eth1_rmii_pins_a>;
++	pinctrl-1 = <&eth1_rmii_sleep_pins_a>;
++	pinctrl-names = "default", "sleep";
++	phy-mode = "rmii";
++	phy-handle = <&phy0_eth1>;
++
++	mdio {
++		#address-cells = <1>;
++		#size-cells = <0>;
++		compatible = "snps,dwmac-mdio";
++
++		phy0_eth1: ethernet-phy@0 {
++			compatible = "ethernet-phy-id0007.c131";
++			reg = <0>;
++			reset-gpios = <&mcp23017 9 GPIO_ACTIVE_LOW>;
++			wakeup-source;
++		};
++	};
++};
+ 
+ &i2c1 {
+ 	pinctrl-names = "default", "sleep";
diff --git a/target/linux/stm32/patches-6.6/020-mmc-mmci-stm32-add-SDIO-in-band-interrupt-mode.patch b/target/linux/stm32/patches-6.6/020-mmc-mmci-stm32-add-SDIO-in-band-interrupt-mode.patch
new file mode 100644
index 00000000000000..235efb57168826
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/020-mmc-mmci-stm32-add-SDIO-in-band-interrupt-mode.patch
@@ -0,0 +1,166 @@
+From 1bcfbfd7c9aa716f61a01682345a1b329f6a6e66 Mon Sep 17 00:00:00 2001
+From: Christophe Kerello <christophe.kerello@foss.st.com>
+Date: Wed, 8 Nov 2023 15:16:37 +0100
+Subject: [PATCH] mmc: mmci: stm32: add SDIO in-band interrupt mode
+
+Add the support of SDIO in-band interrupt mode for STM32 and Ux500
+variants.
+It allows the SD I/O card to interrupt the host on SDMMC_D1 data line.
+It is not enabled by default on Ux500 variant as this is unstable and
+Ux500 users should use out-of-band IRQs.
+
+Signed-off-by: Christophe Kerello <christophe.kerello@foss.st.com>
+Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20231108141637.119497-1-yann.gautier@foss.st.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+---
+ drivers/mmc/host/mmci.c | 69 +++++++++++++++++++++++++++++++++++++++--
+ drivers/mmc/host/mmci.h |  2 ++
+ 2 files changed, 69 insertions(+), 2 deletions(-)
+
+--- a/drivers/mmc/host/mmci.c
++++ b/drivers/mmc/host/mmci.c
+@@ -272,6 +272,7 @@ static struct variant_data variant_stm32
+ 	.datactrl_mask_sdio	= MCI_DPSM_ST_SDIOEN,
+ 	.stm32_idmabsize_mask	= GENMASK(12, 5),
+ 	.stm32_idmabsize_align	= BIT(5),
++	.supports_sdio_irq	= true,
+ 	.busy_timeout		= true,
+ 	.busy_detect		= true,
+ 	.busy_detect_flag	= MCI_STM32_BUSYD0,
+@@ -299,6 +300,7 @@ static struct variant_data variant_stm32
+ 	.datactrl_mask_sdio	= MCI_DPSM_ST_SDIOEN,
+ 	.stm32_idmabsize_mask	= GENMASK(16, 5),
+ 	.stm32_idmabsize_align	= BIT(5),
++	.supports_sdio_irq	= true,
+ 	.dma_lli		= true,
+ 	.busy_timeout		= true,
+ 	.busy_detect		= true,
+@@ -327,6 +329,7 @@ static struct variant_data variant_stm32
+ 	.datactrl_mask_sdio	= MCI_DPSM_ST_SDIOEN,
+ 	.stm32_idmabsize_mask	= GENMASK(16, 6),
+ 	.stm32_idmabsize_align	= BIT(6),
++	.supports_sdio_irq	= true,
+ 	.dma_lli		= true,
+ 	.busy_timeout		= true,
+ 	.busy_detect		= true,
+@@ -420,8 +423,9 @@ void mmci_write_pwrreg(struct mmci_host
+  */
+ static void mmci_write_datactrlreg(struct mmci_host *host, u32 datactrl)
+ {
+-	/* Keep busy mode in DPSM if enabled */
+-	datactrl |= host->datactrl_reg & host->variant->busy_dpsm_flag;
++	/* Keep busy mode in DPSM and SDIO mask if enabled */
++	datactrl |= host->datactrl_reg & (host->variant->busy_dpsm_flag |
++					  host->variant->datactrl_mask_sdio);
+ 
+ 	if (host->datactrl_reg != datactrl) {
+ 		host->datactrl_reg = datactrl;
+@@ -1761,6 +1765,25 @@ static irqreturn_t mmci_pio_irq(int irq,
+ 	return IRQ_HANDLED;
+ }
+ 
++static void mmci_write_sdio_irq_bit(struct mmci_host *host, int enable)
++{
++	void __iomem *base = host->base;
++	u32 mask = readl_relaxed(base + MMCIMASK0);
++
++	if (enable)
++		writel_relaxed(mask | MCI_ST_SDIOITMASK, base + MMCIMASK0);
++	else
++		writel_relaxed(mask & ~MCI_ST_SDIOITMASK, base + MMCIMASK0);
++}
++
++static void mmci_signal_sdio_irq(struct mmci_host *host, u32 status)
++{
++	if (status & MCI_ST_SDIOIT) {
++		mmci_write_sdio_irq_bit(host, 0);
++		sdio_signal_irq(host->mmc);
++	}
++}
++
+ /*
+  * Handle completion of command and data transfers.
+  */
+@@ -1805,6 +1828,9 @@ static irqreturn_t mmci_irq(int irq, voi
+ 			mmci_data_irq(host, host->data, status);
+ 		}
+ 
++		if (host->variant->supports_sdio_irq)
++			mmci_signal_sdio_irq(host, status);
++
+ 		/*
+ 		 * Busy detection has been handled by mmci_cmd_irq() above.
+ 		 * Clear the status bit to prevent polling in IRQ context.
+@@ -2041,6 +2067,35 @@ static int mmci_sig_volt_switch(struct m
+ 	return ret;
+ }
+ 
++static void mmci_enable_sdio_irq(struct mmc_host *mmc, int enable)
++{
++	struct mmci_host *host = mmc_priv(mmc);
++	unsigned long flags;
++
++	if (enable)
++		/* Keep the SDIO mode bit if SDIO irqs are enabled */
++		pm_runtime_get_sync(mmc_dev(mmc));
++
++	spin_lock_irqsave(&host->lock, flags);
++	mmci_write_sdio_irq_bit(host, enable);
++	spin_unlock_irqrestore(&host->lock, flags);
++
++	if (!enable) {
++		pm_runtime_mark_last_busy(mmc_dev(mmc));
++		pm_runtime_put_autosuspend(mmc_dev(mmc));
++	}
++}
++
++static void mmci_ack_sdio_irq(struct mmc_host *mmc)
++{
++	struct mmci_host *host = mmc_priv(mmc);
++	unsigned long flags;
++
++	spin_lock_irqsave(&host->lock, flags);
++	mmci_write_sdio_irq_bit(host, 1);
++	spin_unlock_irqrestore(&host->lock, flags);
++}
++
+ static struct mmc_host_ops mmci_ops = {
+ 	.request	= mmci_request,
+ 	.pre_req	= mmci_pre_request,
+@@ -2316,6 +2371,16 @@ static int mmci_probe(struct amba_device
+ 		mmc->caps |= MMC_CAP_WAIT_WHILE_BUSY;
+ 	}
+ 
++	if (variant->supports_sdio_irq && host->mmc->caps & MMC_CAP_SDIO_IRQ) {
++		mmc->caps2 |= MMC_CAP2_SDIO_IRQ_NOTHREAD;
++
++		mmci_ops.enable_sdio_irq = mmci_enable_sdio_irq;
++		mmci_ops.ack_sdio_irq	= mmci_ack_sdio_irq;
++
++		mmci_write_datactrlreg(host,
++				       host->variant->datactrl_mask_sdio);
++	}
++
+ 	/* Variants with mandatory busy timeout in HW needs R1B responses. */
+ 	if (variant->busy_timeout)
+ 		mmc->caps |= MMC_CAP_NEED_RSP_BUSY;
+--- a/drivers/mmc/host/mmci.h
++++ b/drivers/mmc/host/mmci.h
+@@ -331,6 +331,7 @@ enum mmci_busy_state {
+  *	       register.
+  * @opendrain: bitmask identifying the OPENDRAIN bit inside MMCIPOWER register
+  * @dma_lli: true if variant has dma link list feature.
++ * @supports_sdio_irq: allow SD I/O card to interrupt the host
+  * @stm32_idmabsize_mask: stm32 sdmmc idma buffer size.
+  */
+ struct variant_data {
+@@ -376,6 +377,7 @@ struct variant_data {
+ 	u32			start_err;
+ 	u32			opendrain;
+ 	u8			dma_lli:1;
++	bool			supports_sdio_irq;
+ 	u32			stm32_idmabsize_mask;
+ 	u32			stm32_idmabsize_align;
+ 	void (*init)(struct mmci_host *host);
diff --git a/target/linux/stm32/patches-6.6/030-rtc-stm32-add-pinctrl-and-pinmux-interfaces.patch b/target/linux/stm32/patches-6.6/030-rtc-stm32-add-pinctrl-and-pinmux-interfaces.patch
new file mode 100644
index 00000000000000..e06ea134c5a1bc
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/030-rtc-stm32-add-pinctrl-and-pinmux-interfaces.patch
@@ -0,0 +1,189 @@
+From c15671ce05a038b8c92a6f1e24b0b850a154ba59 Mon Sep 17 00:00:00 2001
+From: Valentin Caron <valentin.caron@foss.st.com>
+Date: Mon, 22 Jul 2024 18:00:20 +0200
+Subject: [PATCH] rtc: stm32: add pinctrl and pinmux interfaces
+
+STM32 RTC is capable to handle 3 specific pins of the soc.
+"out1, out2 and out2_rmp". To handle this, we use pinctrl framework.
+There is a single pin per group.
+
+Signed-off-by: Valentin Caron <valentin.caron@foss.st.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20240722160022.454226-3-valentin.caron@foss.st.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+---
+ drivers/rtc/Kconfig     |   5 ++
+ drivers/rtc/rtc-stm32.c | 120 ++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 125 insertions(+)
+
+--- a/drivers/rtc/Kconfig
++++ b/drivers/rtc/Kconfig
+@@ -1887,6 +1887,11 @@ config RTC_DRV_STM32
+ 	tristate "STM32 RTC"
+ 	select REGMAP_MMIO
+ 	depends on ARCH_STM32 || COMPILE_TEST
++	depends on OF
++	depends on PINCTRL
++	select PINMUX
++	select PINCONF
++	select GENERIC_PINCONF
+ 	help
+ 	   If you say yes here you get support for the STM32 On-Chip
+ 	   Real Time Clock.
+--- a/drivers/rtc/rtc-stm32.c
++++ b/drivers/rtc/rtc-stm32.c
+@@ -12,6 +12,9 @@
+ #include <linux/mfd/syscon.h>
+ #include <linux/module.h>
+ #include <linux/of.h>
++#include <linux/pinctrl/pinctrl.h>
++#include <linux/pinctrl/pinconf-generic.h>
++#include <linux/pinctrl/pinmux.h>
+ #include <linux/platform_device.h>
+ #include <linux/pm_wakeirq.h>
+ #include <linux/regmap.h>
+@@ -94,6 +97,14 @@
+ /* STM32 RTC driver time helpers */
+ #define SEC_PER_DAY		(24 * 60 * 60)
+ 
++/* STM32 RTC pinctrl helpers */
++#define STM32_RTC_PINMUX(_name, _action, ...) { \
++	.name = (_name), \
++	.action = (_action), \
++	.groups = ((const char *[]){ __VA_ARGS__ }), \
++	.num_groups = ARRAY_SIZE(((const char *[]){ __VA_ARGS__ })), \
++}
++
+ struct stm32_rtc;
+ 
+ struct stm32_rtc_registers {
+@@ -149,6 +160,106 @@ static void stm32_rtc_wpr_lock(struct st
+ 	writel_relaxed(RTC_WPR_WRONG_KEY, rtc->base + regs->wpr);
+ }
+ 
++enum stm32_rtc_pin_name {
++	NONE,
++	OUT1,
++	OUT2,
++	OUT2_RMP
++};
++
++static const struct pinctrl_pin_desc stm32_rtc_pinctrl_pins[] = {
++	PINCTRL_PIN(OUT1, "out1"),
++	PINCTRL_PIN(OUT2, "out2"),
++	PINCTRL_PIN(OUT2_RMP, "out2_rmp"),
++};
++
++static int stm32_rtc_pinctrl_get_groups_count(struct pinctrl_dev *pctldev)
++{
++	return ARRAY_SIZE(stm32_rtc_pinctrl_pins);
++}
++
++static const char *stm32_rtc_pinctrl_get_group_name(struct pinctrl_dev *pctldev,
++						    unsigned int selector)
++{
++	return stm32_rtc_pinctrl_pins[selector].name;
++}
++
++static int stm32_rtc_pinctrl_get_group_pins(struct pinctrl_dev *pctldev,
++					    unsigned int selector,
++					    const unsigned int **pins,
++					    unsigned int *num_pins)
++{
++	*pins = &stm32_rtc_pinctrl_pins[selector].number;
++	*num_pins = 1;
++	return 0;
++}
++
++static const struct pinctrl_ops stm32_rtc_pinctrl_ops = {
++	.dt_node_to_map		= pinconf_generic_dt_node_to_map_all,
++	.dt_free_map		= pinconf_generic_dt_free_map,
++	.get_groups_count	= stm32_rtc_pinctrl_get_groups_count,
++	.get_group_name		= stm32_rtc_pinctrl_get_group_name,
++	.get_group_pins		= stm32_rtc_pinctrl_get_group_pins,
++};
++
++struct stm32_rtc_pinmux_func {
++	const char *name;
++	const char * const *groups;
++	const unsigned int num_groups;
++	int (*action)(struct pinctrl_dev *pctl_dev, unsigned int pin);
++};
++
++static const struct stm32_rtc_pinmux_func stm32_rtc_pinmux_functions[] = {
++};
++
++static int stm32_rtc_pinmux_get_functions_count(struct pinctrl_dev *pctldev)
++{
++	return ARRAY_SIZE(stm32_rtc_pinmux_functions);
++}
++
++static const char *stm32_rtc_pinmux_get_fname(struct pinctrl_dev *pctldev, unsigned int selector)
++{
++	return stm32_rtc_pinmux_functions[selector].name;
++}
++
++static int stm32_rtc_pinmux_get_groups(struct pinctrl_dev *pctldev, unsigned int selector,
++				       const char * const **groups, unsigned int * const num_groups)
++{
++	*groups = stm32_rtc_pinmux_functions[selector].groups;
++	*num_groups = stm32_rtc_pinmux_functions[selector].num_groups;
++	return 0;
++}
++
++static int stm32_rtc_pinmux_set_mux(struct pinctrl_dev *pctldev, unsigned int selector,
++				    unsigned int group)
++{
++	struct stm32_rtc_pinmux_func selected_func = stm32_rtc_pinmux_functions[selector];
++	struct pinctrl_pin_desc pin = stm32_rtc_pinctrl_pins[group];
++
++	/* Call action */
++	if (selected_func.action)
++		return selected_func.action(pctldev, pin.number);
++
++	return -EINVAL;
++}
++
++static const struct pinmux_ops stm32_rtc_pinmux_ops = {
++	.get_functions_count	= stm32_rtc_pinmux_get_functions_count,
++	.get_function_name	= stm32_rtc_pinmux_get_fname,
++	.get_function_groups	= stm32_rtc_pinmux_get_groups,
++	.set_mux		= stm32_rtc_pinmux_set_mux,
++	.strict			= true,
++};
++
++static struct pinctrl_desc stm32_rtc_pdesc = {
++	.name = DRIVER_NAME,
++	.pins = stm32_rtc_pinctrl_pins,
++	.npins = ARRAY_SIZE(stm32_rtc_pinctrl_pins),
++	.owner = THIS_MODULE,
++	.pctlops = &stm32_rtc_pinctrl_ops,
++	.pmxops = &stm32_rtc_pinmux_ops,
++};
++
+ static int stm32_rtc_enter_init_mode(struct stm32_rtc *rtc)
+ {
+ 	const struct stm32_rtc_registers *regs = &rtc->data->regs;
+@@ -723,6 +834,7 @@ static int stm32_rtc_probe(struct platfo
+ {
+ 	struct stm32_rtc *rtc;
+ 	const struct stm32_rtc_registers *regs;
++	struct pinctrl_dev *pctl;
+ 	int ret;
+ 
+ 	rtc = devm_kzalloc(&pdev->dev, sizeof(*rtc), GFP_KERNEL);
+@@ -834,6 +946,14 @@ static int stm32_rtc_probe(struct platfo
+ 		goto err;
+ 	}
+ 
++	ret = devm_pinctrl_register_and_init(&pdev->dev, &stm32_rtc_pdesc, rtc, &pctl);
++	if (ret)
++		return dev_err_probe(&pdev->dev, ret, "pinctrl register failed");
++
++	ret = pinctrl_enable(pctl);
++	if (ret)
++		return dev_err_probe(&pdev->dev, ret, "pinctrl enable failed");
++
+ 	/*
+ 	 * If INITS flag is reset (calendar year field set to 0x00), calendar
+ 	 * must be initialized
diff --git a/target/linux/stm32/patches-6.6/031-rtc-stm32-add-Low-Speed-Clock-Output-LSCO-support.patch b/target/linux/stm32/patches-6.6/031-rtc-stm32-add-Low-Speed-Clock-Output-LSCO-support.patch
new file mode 100644
index 00000000000000..1ac097457217e5
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/031-rtc-stm32-add-Low-Speed-Clock-Output-LSCO-support.patch
@@ -0,0 +1,253 @@
+From 229476a4de2e237ebadddca8a82d20afa9298f71 Mon Sep 17 00:00:00 2001
+From: Valentin Caron <valentin.caron@foss.st.com>
+Date: Mon, 22 Jul 2024 18:00:21 +0200
+Subject: [PATCH] rtc: stm32: add Low Speed Clock Output (LSCO) support
+
+RTC is able to output on a pin the "LSE" internal clock.
+
+STM32 RTC is now registered as a clock provider.
+It provides rtc_lsco clock, that means RTC_LSCO is output on either
+RTC_OUT1 or RTC_OUT2_RMP, depending on pinmux DT property.
+The clock is marked as CLK_IGNORE_UNUSED and CLK_IS_CRITICAL because
+RTC_LSCO can be early required by devices needed it to init.
+
+Add LSCO in pinmux functions.
+
+Add "stm32_rtc_clean_outs" to disable LSCO. As RTC is part of "backup"
+power domain, it is not reset during shutdown or reboot. So force LSCO
+disable at probe.
+
+Co-developed-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Signed-off-by: Valentin Caron <valentin.caron@foss.st.com>
+Link: https://lore.kernel.org/r/20240722160022.454226-4-valentin.caron@foss.st.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+---
+ drivers/rtc/Kconfig     |  1 +
+ drivers/rtc/rtc-stm32.c | 99 +++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 100 insertions(+)
+
+--- a/drivers/rtc/Kconfig
++++ b/drivers/rtc/Kconfig
+@@ -1892,6 +1892,7 @@ config RTC_DRV_STM32
+ 	select PINMUX
+ 	select PINCONF
+ 	select GENERIC_PINCONF
++	depends on COMMON_CLK
+ 	help
+ 	   If you say yes here you get support for the STM32 On-Chip
+ 	   Real Time Clock.
+--- a/drivers/rtc/rtc-stm32.c
++++ b/drivers/rtc/rtc-stm32.c
+@@ -6,6 +6,7 @@
+ 
+ #include <linux/bcd.h>
+ #include <linux/clk.h>
++#include <linux/clk-provider.h>
+ #include <linux/errno.h>
+ #include <linux/iopoll.h>
+ #include <linux/ioport.h>
+@@ -44,6 +45,10 @@
+ #define STM32_RTC_CR_FMT		BIT(6)
+ #define STM32_RTC_CR_ALRAE		BIT(8)
+ #define STM32_RTC_CR_ALRAIE		BIT(12)
++#define STM32_RTC_CR_OSEL		GENMASK(22, 21)
++#define STM32_RTC_CR_COE		BIT(23)
++#define STM32_RTC_CR_TAMPOE		BIT(26)
++#define STM32_RTC_CR_OUT2EN		BIT(31)
+ 
+ /* STM32_RTC_ISR/STM32_RTC_ICSR bit fields */
+ #define STM32_RTC_ISR_ALRAWF		BIT(0)
+@@ -80,6 +85,12 @@
+ /* STM32_RTC_SR/_SCR bit fields */
+ #define STM32_RTC_SR_ALRA		BIT(0)
+ 
++/* STM32_RTC_CFGR bit fields */
++#define STM32_RTC_CFGR_OUT2_RMP		BIT(0)
++#define STM32_RTC_CFGR_LSCOEN		GENMASK(2, 1)
++#define STM32_RTC_CFGR_LSCOEN_OUT1	1
++#define STM32_RTC_CFGR_LSCOEN_OUT2_RMP	2
++
+ /* STM32_RTC_VERR bit fields */
+ #define STM32_RTC_VERR_MINREV_SHIFT	0
+ #define STM32_RTC_VERR_MINREV		GENMASK(3, 0)
+@@ -117,6 +128,7 @@ struct stm32_rtc_registers {
+ 	u16 wpr;
+ 	u16 sr;
+ 	u16 scr;
++	u16 cfgr;
+ 	u16 verr;
+ };
+ 
+@@ -131,6 +143,7 @@ struct stm32_rtc_data {
+ 	bool has_pclk;
+ 	bool need_dbp;
+ 	bool need_accuracy;
++	bool has_lsco;
+ };
+ 
+ struct stm32_rtc {
+@@ -143,6 +156,7 @@ struct stm32_rtc {
+ 	struct clk *rtc_ck;
+ 	const struct stm32_rtc_data *data;
+ 	int irq_alarm;
++	struct clk *clk_lsco;
+ };
+ 
+ static void stm32_rtc_wpr_unlock(struct stm32_rtc *rtc)
+@@ -209,7 +223,68 @@ struct stm32_rtc_pinmux_func {
+ 	int (*action)(struct pinctrl_dev *pctl_dev, unsigned int pin);
+ };
+ 
++static int stm32_rtc_pinmux_lsco_available(struct pinctrl_dev *pctldev, unsigned int pin)
++{
++	struct stm32_rtc *rtc = pinctrl_dev_get_drvdata(pctldev);
++	struct stm32_rtc_registers regs = rtc->data->regs;
++	unsigned int cr = readl_relaxed(rtc->base + regs.cr);
++	unsigned int cfgr = readl_relaxed(rtc->base + regs.cfgr);
++	unsigned int calib = STM32_RTC_CR_COE;
++	unsigned int tampalrm = STM32_RTC_CR_TAMPOE | STM32_RTC_CR_OSEL;
++
++	switch (pin) {
++	case OUT1:
++		if ((!(cr & STM32_RTC_CR_OUT2EN) &&
++		     ((cr & calib) || cr & tampalrm)) ||
++		     ((cr & calib) && (cr & tampalrm)))
++			return -EBUSY;
++		break;
++	case OUT2_RMP:
++		if ((cr & STM32_RTC_CR_OUT2EN) &&
++		    (cfgr & STM32_RTC_CFGR_OUT2_RMP) &&
++		    ((cr & calib) || (cr & tampalrm)))
++			return -EBUSY;
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	if (clk_get_rate(rtc->rtc_ck) != 32768)
++		return -ERANGE;
++
++	return 0;
++}
++
++static int stm32_rtc_pinmux_action_lsco(struct pinctrl_dev *pctldev, unsigned int pin)
++{
++	struct stm32_rtc *rtc = pinctrl_dev_get_drvdata(pctldev);
++	struct stm32_rtc_registers regs = rtc->data->regs;
++	struct device *dev = rtc->rtc_dev->dev.parent;
++	u8 lscoen;
++	int ret;
++
++	if (!rtc->data->has_lsco)
++		return -EPERM;
++
++	ret = stm32_rtc_pinmux_lsco_available(pctldev, pin);
++	if (ret)
++		return ret;
++
++	lscoen = (pin == OUT1) ? STM32_RTC_CFGR_LSCOEN_OUT1 : STM32_RTC_CFGR_LSCOEN_OUT2_RMP;
++
++	rtc->clk_lsco = clk_register_gate(dev, "rtc_lsco", __clk_get_name(rtc->rtc_ck),
++					  CLK_IGNORE_UNUSED | CLK_IS_CRITICAL,
++					  rtc->base + regs.cfgr, lscoen, 0, NULL);
++	if (IS_ERR(rtc->clk_lsco))
++		return PTR_ERR(rtc->clk_lsco);
++
++	of_clk_add_provider(dev->of_node, of_clk_src_simple_get, rtc->clk_lsco);
++
++	return 0;
++}
++
+ static const struct stm32_rtc_pinmux_func stm32_rtc_pinmux_functions[] = {
++	STM32_RTC_PINMUX("lsco", &stm32_rtc_pinmux_action_lsco, "out1", "out2_rmp"),
+ };
+ 
+ static int stm32_rtc_pinmux_get_functions_count(struct pinctrl_dev *pctldev)
+@@ -664,6 +739,7 @@ static const struct stm32_rtc_data stm32
+ 	.has_pclk = false,
+ 	.need_dbp = true,
+ 	.need_accuracy = false,
++	.has_lsco = false,
+ 	.regs = {
+ 		.tr = 0x00,
+ 		.dr = 0x04,
+@@ -674,6 +750,7 @@ static const struct stm32_rtc_data stm32
+ 		.wpr = 0x24,
+ 		.sr = 0x0C, /* set to ISR offset to ease alarm management */
+ 		.scr = UNDEF_REG,
++		.cfgr = UNDEF_REG,
+ 		.verr = UNDEF_REG,
+ 	},
+ 	.events = {
+@@ -686,6 +763,7 @@ static const struct stm32_rtc_data stm32
+ 	.has_pclk = true,
+ 	.need_dbp = true,
+ 	.need_accuracy = false,
++	.has_lsco = false,
+ 	.regs = {
+ 		.tr = 0x00,
+ 		.dr = 0x04,
+@@ -696,6 +774,7 @@ static const struct stm32_rtc_data stm32
+ 		.wpr = 0x24,
+ 		.sr = 0x0C, /* set to ISR offset to ease alarm management */
+ 		.scr = UNDEF_REG,
++		.cfgr = UNDEF_REG,
+ 		.verr = UNDEF_REG,
+ 	},
+ 	.events = {
+@@ -717,6 +796,7 @@ static const struct stm32_rtc_data stm32
+ 	.has_pclk = true,
+ 	.need_dbp = false,
+ 	.need_accuracy = true,
++	.has_lsco = true,
+ 	.regs = {
+ 		.tr = 0x00,
+ 		.dr = 0x04,
+@@ -727,6 +807,7 @@ static const struct stm32_rtc_data stm32
+ 		.wpr = 0x24,
+ 		.sr = 0x50,
+ 		.scr = 0x5C,
++		.cfgr = 0x60,
+ 		.verr = 0x3F4,
+ 	},
+ 	.events = {
+@@ -743,6 +824,19 @@ static const struct of_device_id stm32_r
+ };
+ MODULE_DEVICE_TABLE(of, stm32_rtc_of_match);
+ 
++static void stm32_rtc_clean_outs(struct stm32_rtc *rtc)
++{
++	struct stm32_rtc_registers regs = rtc->data->regs;
++
++	if (regs.cfgr != UNDEF_REG) {
++		unsigned int cfgr = readl_relaxed(rtc->base + regs.cfgr);
++
++		cfgr &= ~STM32_RTC_CFGR_LSCOEN;
++		cfgr &= ~STM32_RTC_CFGR_OUT2_RMP;
++		writel_relaxed(cfgr, rtc->base + regs.cfgr);
++	}
++}
++
+ static int stm32_rtc_init(struct platform_device *pdev,
+ 			  struct stm32_rtc *rtc)
+ {
+@@ -946,6 +1040,8 @@ static int stm32_rtc_probe(struct platfo
+ 		goto err;
+ 	}
+ 
++	stm32_rtc_clean_outs(rtc);
++
+ 	ret = devm_pinctrl_register_and_init(&pdev->dev, &stm32_rtc_pdesc, rtc, &pctl);
+ 	if (ret)
+ 		return dev_err_probe(&pdev->dev, ret, "pinctrl register failed");
+@@ -992,6 +1088,9 @@ static void stm32_rtc_remove(struct plat
+ 	const struct stm32_rtc_registers *regs = &rtc->data->regs;
+ 	unsigned int cr;
+ 
++	if (!IS_ERR_OR_NULL(rtc->clk_lsco))
++		clk_unregister_gate(rtc->clk_lsco);
++
+ 	/* Disable interrupts */
+ 	stm32_rtc_wpr_unlock(rtc);
+ 	cr = readl_relaxed(rtc->base + regs->cr);
diff --git a/target/linux/stm32/patches-6.6/032-ARM-dts-stm32-rtc-add-pin-to-provide-LSCO-on-stm32mp.patch b/target/linux/stm32/patches-6.6/032-ARM-dts-stm32-rtc-add-pin-to-provide-LSCO-on-stm32mp.patch
new file mode 100644
index 00000000000000..1d5bedbad37af5
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/032-ARM-dts-stm32-rtc-add-pin-to-provide-LSCO-on-stm32mp.patch
@@ -0,0 +1,31 @@
+From 92483a156238078562d187f527de6b358cb53a08 Mon Sep 17 00:00:00 2001
+From: Valentin Caron <valentin.caron@foss.st.com>
+Date: Tue, 27 Aug 2024 16:04:48 +0200
+Subject: [PATCH] ARM: dts: stm32: rtc, add pin to provide LSCO on
+ stm32mp13
+
+Declare pin for LSCO in stm32-pinctrl provider node to reserve this pin
+for RTC OUT2_RMP, in stm32mp13-pinctrl.dtsi.
+
+Signed-off-by: Valentin Caron <valentin.caron@foss.st.com>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+---
+ arch/arm/boot/dts/st/stm32mp13-pinctrl.dtsi | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/arch/arm/boot/dts/st/stm32mp13-pinctrl.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp13-pinctrl.dtsi
+@@ -212,6 +212,13 @@
+ 		};
+ 	};
+ 
++	/omit-if-no-ref/
++	rtc_rsvd_pins_a: rtc-rsvd-0 {
++		pins {
++			pinmux = <STM32_PINMUX('I', 1, ANALOG)>; /* RTC_OUT2_RMP */
++		};
++	};
++
+ 	sdmmc1_b4_pins_a: sdmmc1-b4-0 {
+ 		pins {
+ 			pinmux = <STM32_PINMUX('C', 8, AF12)>, /* SDMMC1_D0 */
diff --git a/target/linux/stm32/patches-6.6/033-ARM-dts-stm32-rtc-add-LSCO-to-WLAN-BT-module-on-stm3.patch b/target/linux/stm32/patches-6.6/033-ARM-dts-stm32-rtc-add-LSCO-to-WLAN-BT-module-on-stm3.patch
new file mode 100644
index 00000000000000..ec6a086a7d0b8b
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/033-ARM-dts-stm32-rtc-add-LSCO-to-WLAN-BT-module-on-stm3.patch
@@ -0,0 +1,34 @@
+From d6e424f926397e682fc44a952d5b3a1e34b2cd73 Mon Sep 17 00:00:00 2001
+From: Valentin Caron <valentin.caron@foss.st.com>
+Date: Tue, 27 Aug 2024 16:04:50 +0200
+Subject: [PATCH] ARM: dts: stm32: rtc, add LSCO to WLAN/BT module on
+ stm32mp135f-dk
+
+On stm32mp135f-dk board, WLAN/BT module LPO_IN pin is wired to
+RTC OUT2_RMP pin.
+
+Provide a pinctrl configuration to enable LSCO on OUT2_RMP.
+
+Signed-off-by: Valentin Caron <valentin.caron@foss.st.com>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+---
+ arch/arm/boot/dts/st/stm32mp135f-dk.dts | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/arch/arm/boot/dts/st/stm32mp135f-dk.dts
++++ b/arch/arm/boot/dts/st/stm32mp135f-dk.dts
+@@ -184,7 +184,14 @@
+ };
+ 
+ &rtc {
++	pinctrl-names = "default";
++	pinctrl-0 = <&rtc_rsvd_pins_a>;
+ 	status = "okay";
++
++	rtc_lsco_pins_a: rtc-lsco-0 {
++		pins = "out2_rmp";
++		function = "lsco";
++	};
+ };
+ 
+ &scmi_regu {
diff --git a/target/linux/stm32/patches-6.6/034-ARM-dts-stm32-add-support-of-WLAN-BT-on-stm32mp135f-.patch b/target/linux/stm32/patches-6.6/034-ARM-dts-stm32-add-support-of-WLAN-BT-on-stm32mp135f-.patch
new file mode 100644
index 00000000000000..e2b69ac8c77277
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/034-ARM-dts-stm32-add-support-of-WLAN-BT-on-stm32mp135f-.patch
@@ -0,0 +1,84 @@
+From 6b44fdef4c7ad112e17d7cbd64d7d522a426d6e4 Mon Sep 17 00:00:00 2001
+From: Christophe Roullier <christophe.roullier@foss.st.com>
+Date: Tue, 27 Aug 2024 16:04:52 +0200
+Subject: [PATCH] ARM: dts: stm32: add support of WLAN/BT on stm32mp135f-dk
+
+Add support of WLAN/BT Murata Type 1DX module:
+- usart2 is used for Bluetooth interface
+- sdmmc2 is used for WLAN (sdio) interface
+
+Signed-off-by: Christophe Roullier <christophe.roullier@foss.st.com>
+Signed-off-by: Valentin Caron <valentin.caron@foss.st.com>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+---
+ arch/arm/boot/dts/st/stm32mp135f-dk.dts | 45 +++++++++++++++++++++++++
+ 1 file changed, 45 insertions(+)
+
+--- a/arch/arm/boot/dts/st/stm32mp135f-dk.dts
++++ b/arch/arm/boot/dts/st/stm32mp135f-dk.dts
+@@ -67,6 +67,19 @@
+ 			default-state = "off";
+ 		};
+ 	};
++
++	v3v3_ao: v3v3-ao {
++		compatible = "regulator-fixed";
++		regulator-name = "v3v3_ao";
++		regulator-min-microvolt = <3300000>;
++		regulator-max-microvolt = <3300000>;
++		regulator-always-on;
++	};
++
++	wifi_pwrseq: wifi-pwrseq {
++		compatible = "mmc-pwrseq-simple";
++		reset-gpios = <&mcp23017 11 GPIO_ACTIVE_LOW>;
++	};
+ };
+ 
+ &adc_1 {
+@@ -230,6 +243,30 @@
+ 	status = "okay";
+ };
+ 
++/* Wifi */
++&sdmmc2 {
++	pinctrl-names = "default", "opendrain", "sleep";
++	pinctrl-0 = <&sdmmc2_b4_pins_a &sdmmc2_clk_pins_a>;
++	pinctrl-1 = <&sdmmc2_b4_od_pins_a &sdmmc2_clk_pins_a>;
++	pinctrl-2 = <&sdmmc2_b4_sleep_pins_a>;
++	non-removable;
++	cap-sdio-irq;
++	st,neg-edge;
++	bus-width = <4>;
++	vmmc-supply = <&v3v3_ao>;
++	mmc-pwrseq = <&wifi_pwrseq>;
++	#address-cells = <1>;
++	#size-cells = <0>;
++	status = "okay";
++
++	brcmf: bcrmf@1 {
++		reg = <1>;
++		compatible = "brcm,bcm4329-fmac";
++		pinctrl-names = "default";
++		pinctrl-0 = <&rtc_lsco_pins_a>;
++	};
++};
++
+ &spi5 {
+ 	pinctrl-names = "default", "sleep";
+ 	pinctrl-0 = <&spi5_pins_a>;
+@@ -332,6 +369,14 @@
+ 	pinctrl-2 = <&usart2_idle_pins_a>;
+ 	uart-has-rtscts;
+ 	status = "okay";
++
++	bluetooth {
++		shutdown-gpios = <&mcp23017 13 GPIO_ACTIVE_HIGH>;
++		compatible = "brcm,bcm43438-bt";
++		max-speed = <3000000>;
++		vbat-supply = <&v3v3_ao>;
++		vddio-supply = <&v3v3_ao>;
++	};
+ };
+ 
+ &usbh_ehci {
diff --git a/target/linux/stm32/patches-6.6/700-net-stmmac-dwmac-stm32-add-support-of-phy-supply-pro.patch b/target/linux/stm32/patches-6.6/700-net-stmmac-dwmac-stm32-add-support-of-phy-supply-pro.patch
new file mode 100644
index 00000000000000..57d2a26c1af5b1
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/700-net-stmmac-dwmac-stm32-add-support-of-phy-supply-pro.patch
@@ -0,0 +1,106 @@
+From 7bfe3404a02923ca3858abf56b18a098b4be33b2 Mon Sep 17 00:00:00 2001
+From: Christophe Roullier <christophe.roullier@st.com>
+Date: Wed, 10 Nov 2021 17:39:40 +0100
+Subject: [PATCH] net: ethernet: stmmac: stm32: support the phy-supply
+ regulator binding
+
+Configure the phy regulator if defined by the "phy-supply" DT phandle.
+
+Signed-off-by: Christophe Roullier <christophe.roullier@foss.st.com>
+---
+ .../net/ethernet/stmicro/stmmac/dwmac-stm32.c | 51 ++++++++++++++++++-
+ 1 file changed, 50 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
+@@ -14,6 +14,7 @@
+ #include <linux/of_net.h>
+ #include <linux/phy.h>
+ #include <linux/platform_device.h>
++#include <linux/regulator/consumer.h>
+ #include <linux/pm_wakeirq.h>
+ #include <linux/regmap.h>
+ #include <linux/slab.h>
+@@ -92,6 +93,7 @@ struct stm32_dwmac {
+ 	u32 mode_reg;		 /* MAC glue-logic mode register */
+ 	u32 mode_mask;
+ 	struct regmap *regmap;
++	struct regulator *regulator;
+ 	u32 speed;
+ 	const struct stm32_ops *ops;
+ 	struct device *dev;
+@@ -374,6 +376,16 @@ static int stm32_dwmac_parse_data(struct
+ 			dev_dbg(dev, "Warning sysconfig register mask not set\n");
+ 	}
+ 
++	dwmac->regulator = devm_regulator_get_optional(dev, "phy");
++	if (IS_ERR(dwmac->regulator)) {
++		if (PTR_ERR(dwmac->regulator) == -EPROBE_DEFER) {
++			dev_dbg(dev, "phy regulator is not available yet, deferred probing\n");
++			return -EPROBE_DEFER;
++		}
++		dev_dbg(dev, "no regulator found\n");
++		dwmac->regulator = NULL;
++	}
++
+ 	return err;
+ }
+ 
+@@ -439,6 +451,28 @@ static int stm32mp1_parse_data(struct st
+ 	return err;
+ }
+ 
++static int phy_power_on(struct stm32_dwmac *bsp_priv, bool enable)
++{
++	int ret;
++	struct device *dev = bsp_priv->dev;
++
++	if (!bsp_priv->regulator)
++		return 0;
++
++	if (enable) {
++		ret = regulator_enable(bsp_priv->regulator);
++		if (ret)
++			dev_err(dev, "fail to enable phy-supply\n");
++	} else {
++		ret = regulator_disable(bsp_priv->regulator);
++		if (ret)
++			dev_err(dev, "fail to disable phy-supply\n");
++	}
++
++	return 0;
++}
++
++
+ static int stm32_dwmac_probe(struct platform_device *pdev)
+ {
+ 	struct plat_stmmacenet_data *plat_dat;
+@@ -480,12 +514,18 @@ static int stm32_dwmac_probe(struct plat
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
++	ret = phy_power_on(plat_dat->bsp_priv, true);
+ 	if (ret)
+ 		goto err_clk_disable;
+ 
++	ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
++	if (ret)
++		goto err_gmac_powerdown;
++
+ 	return 0;
+ 
++err_gmac_powerdown:
++	phy_power_on(plat_dat->bsp_priv, false);
+ err_clk_disable:
+ 	stm32_dwmac_clk_disable(dwmac, false);
+ 
+@@ -506,6 +546,8 @@ static void stm32_dwmac_remove(struct pl
+ 		dev_pm_clear_wake_irq(&pdev->dev);
+ 		device_init_wakeup(&pdev->dev, false);
+ 	}
++
++	phy_power_on(priv->plat->bsp_priv, false);
+ }
+ 
+ static int stm32mp1_suspend(struct stm32_dwmac *dwmac)
diff --git a/target/linux/stm32/patches-6.6/900-ARM-dts-stm32-add-ethernet2-for-STM32MP135F-DK-board.patch b/target/linux/stm32/patches-6.6/900-ARM-dts-stm32-add-ethernet2-for-STM32MP135F-DK-board.patch
new file mode 100644
index 00000000000000..48fa446bd86220
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/900-ARM-dts-stm32-add-ethernet2-for-STM32MP135F-DK-board.patch
@@ -0,0 +1,53 @@
+From 63c84f846ec5b794a6c90a1c5813cdb0ae75daf6 Mon Sep 17 00:00:00 2001
+From: Thomas Richard <thomas.richard@bootlin.com>
+Date: Thu, 26 Sep 2024 16:48:52 +0200
+Subject: [PATCH] ARM: dts: stm32: add ethernet2 for STM32MP135F-DK board
+
+This patch is based on the stm32mp135f-dk devicetree from 6.6 ST kernel.
+
+Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
+---
+ arch/arm/boot/dts/st/stm32mp135f-dk.dts | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+--- a/arch/arm/boot/dts/st/stm32mp135f-dk.dts
++++ b/arch/arm/boot/dts/st/stm32mp135f-dk.dts
+@@ -20,6 +20,7 @@
+ 
+ 	aliases {
+ 		ethernet0 = &ethernet1;
++		ethernet1 = &ethernet2;
+ 		serial0 = &uart4;
+ 		serial1 = &usart1;
+ 		serial2 = &uart8;
+@@ -129,6 +130,30 @@
+ 	};
+ };
+ 
++&ethernet2 {
++	status = "okay";
++	pinctrl-0 = <&eth2_rmii_pins_a>;
++	pinctrl-1 = <&eth2_rmii_sleep_pins_a>;
++	pinctrl-names = "default", "sleep";
++	phy-mode = "rmii";
++	phy-handle = <&phy0_eth2>;
++	st,ext-phyclk;
++	phy-supply = <&scmi_v3v3_sw>;
++
++	mdio1 {
++		#address-cells = <1>;
++		#size-cells = <0>;
++		compatible = "snps,dwmac-mdio";
++		phy0_eth2: ethernet-phy@0 {
++			compatible = "ethernet-phy-id0007.c131";
++			reset-gpios = <&mcp23017 10 GPIO_ACTIVE_LOW>;
++			reg = <0>;
++		};
++	};
++};
++
++
++
+ &i2c1 {
+ 	pinctrl-names = "default", "sleep";
+ 	pinctrl-0 = <&i2c1_pins_a>;
diff --git a/target/linux/stm32/stm32mp1/config-6.6 b/target/linux/stm32/stm32mp1/config-6.6
new file mode 100644
index 00000000000000..946649ef9b9e94
--- /dev/null
+++ b/target/linux/stm32/stm32mp1/config-6.6
@@ -0,0 +1,485 @@
+CONFIG_ALIGNMENT_TRAP=y
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_FORCE_MAX_ORDER=12
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y
+CONFIG_ARCH_MULTIPLATFORM=y
+CONFIG_ARCH_MULTI_V6_V7=y
+CONFIG_ARCH_MULTI_V7=y
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX=y
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX_DEFAULT=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_STACKWALK=y
+CONFIG_ARCH_STM32=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARM=y
+CONFIG_ARM_AMBA=y
+CONFIG_ARM_APPENDED_DTB=y
+CONFIG_ARM_ARCH_TIMER=y
+CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
+CONFIG_ARM_ATAG_DTB_COMPAT=y
+CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_FROM_BOOTLOADER=y
+CONFIG_ARM_CPU_SUSPEND=y
+CONFIG_ARM_ERRATA_430973=y
+CONFIG_ARM_ERRATA_643719=y
+CONFIG_ARM_ERRATA_720789=y
+CONFIG_ARM_ERRATA_754322=y
+CONFIG_ARM_ERRATA_754327=y
+CONFIG_ARM_ERRATA_764369=y
+CONFIG_ARM_ERRATA_775420=y
+CONFIG_ARM_ERRATA_798181=y
+CONFIG_ARM_ERRATA_814220=y
+CONFIG_ARM_GIC=y
+CONFIG_ARM_HAS_GROUP_RELOCS=y
+# CONFIG_ARM_HIGHBANK_CPUIDLE is not set
+CONFIG_ARM_L1_CACHE_SHIFT=6
+CONFIG_ARM_L1_CACHE_SHIFT_6=y
+CONFIG_ARM_PATCH_IDIV=y
+CONFIG_ARM_PATCH_PHYS_VIRT=y
+# CONFIG_ARM_PL172_MPMC is not set
+CONFIG_ARM_PSCI=y
+CONFIG_ARM_PSCI_CPUIDLE=y
+CONFIG_ARM_PSCI_CPUIDLE_DOMAIN=y
+CONFIG_ARM_PSCI_FW=y
+CONFIG_ARM_SCMI_CPUFREQ=y
+CONFIG_ARM_SCMI_HAVE_MSG=y
+CONFIG_ARM_SCMI_HAVE_SHMEM=y
+CONFIG_ARM_SCMI_HAVE_TRANSPORT=y
+# CONFIG_ARM_SCMI_POWER_CONTROL is not set
+CONFIG_ARM_SCMI_POWER_DOMAIN=y
+CONFIG_ARM_SCMI_PROTOCOL=y
+# CONFIG_ARM_SCMI_RAW_MODE_SUPPORT is not set
+CONFIG_ARM_SCMI_TRANSPORT_OPTEE=y
+CONFIG_ARM_SCMI_TRANSPORT_SMC=y
+# CONFIG_ARM_SCMI_TRANSPORT_SMC_ATOMIC_ENABLE is not set
+CONFIG_ARM_SMCCC_SOC_ID=y
+CONFIG_ARM_SMC_WATCHDOG=y
+# CONFIG_ARM_SMMU is not set
+CONFIG_ARM_THUMB=y
+CONFIG_ARM_THUMBEE=y
+CONFIG_ARM_UNWIND=y
+CONFIG_ARM_VIRT_EXT=y
+CONFIG_AUTO_ZRELADDR=y
+CONFIG_BINFMT_FLAT_ARGVP_ENVP_ON_STACK=y
+# CONFIG_BLK_DEV_INITRD is not set
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_PM=y
+CONFIG_BOUNCE=y
+CONFIG_BUFFER_HEAD=y
+# CONFIG_CACHE_L2X0 is not set
+CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
+CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
+CONFIG_CC_NO_ARRAY_BOUNDS=y
+CONFIG_CHR_DEV_SG=y
+CONFIG_CLKSRC_MMIO=y
+CONFIG_CLKSRC_STM32=y
+CONFIG_CLK_ICST=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_CMA=y
+CONFIG_CMA_ALIGNMENT=8
+CONFIG_CMA_AREAS=7
+# CONFIG_CMA_DEBUG is not set
+# CONFIG_CMA_DEBUGFS is not set
+CONFIG_CMA_SIZE_MBYTES=64
+# CONFIG_CMA_SIZE_SEL_MAX is not set
+CONFIG_CMA_SIZE_SEL_MBYTES=y
+# CONFIG_CMA_SIZE_SEL_MIN is not set
+# CONFIG_CMA_SIZE_SEL_PERCENTAGE is not set
+# CONFIG_CMA_SYSFS is not set
+CONFIG_CMDLINE_PARTITION=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMMON_CLK_SCMI=y
+CONFIG_COMMON_CLK_STM32MP135=y
+CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_CONTEXT_TRACKING=y
+CONFIG_CONTEXT_TRACKING_IDLE=y
+CONFIG_CONTIG_ALLOC=y
+CONFIG_COREDUMP=y
+CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS=y
+CONFIG_CPUFREQ_DT=y
+CONFIG_CPUFREQ_DT_PLATDEV=y
+CONFIG_CPU_32v6K=y
+CONFIG_CPU_32v7=y
+CONFIG_CPU_ABRT_EV7=y
+CONFIG_CPU_CACHE_V7=y
+CONFIG_CPU_CACHE_VIPT=y
+CONFIG_CPU_COPY_V6=y
+CONFIG_CPU_CP15=y
+CONFIG_CPU_CP15_MMU=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+CONFIG_CPU_FREQ_GOV_ATTR_SET=y
+CONFIG_CPU_FREQ_GOV_COMMON=y
+# CONFIG_CPU_FREQ_GOV_CONSERVATIVE is not set
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_HAS_ASID=y
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_IDLE_MULTIPLE_DRIVERS=y
+CONFIG_CPU_ISOLATION=y
+CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_CPU_MITIGATIONS=y
+CONFIG_CPU_PABRT_V7=y
+CONFIG_CPU_PM=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_SPECTRE=y
+CONFIG_CPU_THUMB_CAPABLE=y
+CONFIG_CPU_TLB_V7=y
+CONFIG_CPU_V7=y
+CONFIG_CRC16=y
+CONFIG_CROSS_MEMORY_ATTACH=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_GF128MUL=y
+CONFIG_CRYPTO_LIB_SHA1=y
+CONFIG_CRYPTO_LIB_UTILS=y
+CONFIG_CRYPTO_SHA1=y
+CONFIG_CURRENT_POINTER_IN_TPIDRURO=y
+CONFIG_DCACHE_WORD_ACCESS=y
+CONFIG_DEBUG_ALIGN_RODATA=y
+CONFIG_DEBUG_INFO=y
+CONFIG_DEBUG_LL_INCLUDE="mach/debug-macro.S"
+CONFIG_DEVFREQ_GOV_PASSIVE=y
+# CONFIG_DEVFREQ_GOV_PERFORMANCE is not set
+# CONFIG_DEVFREQ_GOV_POWERSAVE is not set
+CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=y
+# CONFIG_DEVFREQ_GOV_USERSPACE is not set
+CONFIG_DMADEVICES=y
+CONFIG_DMA_CMA=y
+CONFIG_DMA_ENGINE=y
+CONFIG_DMA_OF=y
+CONFIG_DMA_OPS=y
+CONFIG_DMA_SHARED_BUFFER=y
+CONFIG_DMA_VIRTUAL_CHANNELS=y
+CONFIG_DNOTIFY=y
+CONFIG_DTC=y
+CONFIG_DT_IDLE_GENPD=y
+CONFIG_DT_IDLE_STATES=y
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_DWMAC_DWC_QOS_ETH=y
+CONFIG_DWMAC_GENERIC=y
+CONFIG_DWMAC_STM32=y
+CONFIG_DW_DMAC=y
+CONFIG_DW_DMAC_CORE=y
+CONFIG_EDAC=y
+CONFIG_EDAC_ATOMIC_SCRUB=y
+# CONFIG_EDAC_DEBUG is not set
+CONFIG_EDAC_LEGACY_SYSFS=y
+CONFIG_EDAC_SUPPORT=y
+CONFIG_ELF_CORE=y
+CONFIG_EXCLUSIVE_SYSTEM_RAM=y
+CONFIG_EXT4_FS=y
+CONFIG_FIXED_PHY=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_FREEZER=y
+CONFIG_FS_IOMAP=y
+CONFIG_FS_MBCACHE=y
+CONFIG_FUNCTION_ALIGNMENT=0
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_CACHE=y
+# CONFIG_FW_LOADER_USER_HELPER is not set
+CONFIG_GCC10_NO_ARRAY_BOUNDS=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_ARCH_TOPOLOGY=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IDLE_POLL_SETUP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_MIGRATION=y
+CONFIG_GENERIC_IRQ_MULTI_HANDLER=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GENERIC_VDSO_32=y
+CONFIG_GLOB=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_GENERIC_PLATFORM=y
+CONFIG_GPIO_SYSCON=y
+# CONFIG_GPIO_SYSFS is not set
+CONFIG_HARDEN_BRANCH_PREDICTOR=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HAVE_SMP=y
+CONFIG_HIGHMEM=y
+CONFIG_HIGHPTE=y
+CONFIG_HOTPLUG_CORE_SYNC=y
+CONFIG_HOTPLUG_CORE_SYNC_DEAD=y
+CONFIG_HOTPLUG_CPU=y
+CONFIG_HW_CONSOLE=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_OPTEE=y
+# CONFIG_HW_RANDOM_STM32 is not set
+CONFIG_HZ_FIXED=0
+CONFIG_I2C=y
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_COMPAT=y
+CONFIG_I2C_DEMUX_PINCTRL=y
+CONFIG_I2C_HELPER_AUTO=y
+CONFIG_I2C_MUX=y
+CONFIG_I2C_MUX_GPIO=y
+CONFIG_I2C_MUX_PCA954x=y
+CONFIG_I2C_MUX_PINCTRL=y
+CONFIG_I2C_SLAVE=y
+# CONFIG_I2C_SLAVE_TESTUNIT is not set
+CONFIG_I2C_SMBUS=y
+# CONFIG_I2C_STM32F4 is not set
+CONFIG_I2C_STM32F7=y
+CONFIG_INPUT=y
+# CONFIG_IOMMUFD is not set
+# CONFIG_IOMMU_DEBUGFS is not set
+CONFIG_IOMMU_IO_PGTABLE=y
+# CONFIG_IOMMU_IO_PGTABLE_ARMV7S is not set
+CONFIG_IOMMU_IO_PGTABLE_LPAE=y
+# CONFIG_IOMMU_IO_PGTABLE_LPAE_SELFTEST is not set
+CONFIG_IOMMU_SUPPORT=y
+CONFIG_IRQCHIP=y
+CONFIG_IRQSTACKS=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_WORK=y
+CONFIG_JBD2=y
+CONFIG_KERNEL_GZIP=y
+# CONFIG_KERNEL_XZ is not set
+CONFIG_KMAP_LOCAL=y
+CONFIG_KMAP_LOCAL_NON_LINEAR_PTE_ARRAY=y
+# CONFIG_LEDS_BRIGHTNESS_HW_CHANGED is not set
+# CONFIG_LEDS_CLASS_MULTICOLOR is not set
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_TRIGGER_CPU=y
+CONFIG_LEDS_TRIGGER_ONESHOT=y
+CONFIG_LEDS_TRIGGER_TRANSIENT=y
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LOCK_SPIN_ON_OWNER=y
+CONFIG_LOG_BUF_SHIFT=16
+# CONFIG_LRU_GEN is not set
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MACH_STM32MP13=y
+# CONFIG_MACH_STM32MP157 is not set
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_MAGIC_SYSRQ_SERIAL=y
+CONFIG_MDIO_BITBANG=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+# CONFIG_MDIO_GPIO is not set
+CONFIG_MEMORY=y
+CONFIG_MEMORY_ISOLATION=y
+# CONFIG_MFD_STM32_LPTIMER is not set
+# CONFIG_MFD_STM32_TIMERS is not set
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGHT_HAVE_CACHE_L2X0=y
+CONFIG_MIGRATION=y
+CONFIG_MMC=y
+CONFIG_MMC_ARMMMCI=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_BLOCK_MINORS=16
+CONFIG_MMC_STM32_SDMMC=y
+CONFIG_MMU_LAZY_TLB_REFCOUNT=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MUTEX_SPIN_ON_OWNER=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_SRCU_NMI_SAFE=y
+CONFIG_NEON=y
+CONFIG_NET_EGRESS=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_INGRESS=y
+CONFIG_NET_PTP_CLASSIFY=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NET_XGRESS=y
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NR_CPUS=2
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_DYNAMIC=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_OF_OVERLAY=y
+CONFIG_OF_RESOLVE=y
+CONFIG_OLD_SIGACTION=y
+CONFIG_OLD_SIGSUSPEND3=y
+CONFIG_OPTEE=y
+CONFIG_PADATA=y
+CONFIG_PAGE_OFFSET=0xC0000000
+CONFIG_PAGE_POOL=y
+CONFIG_PAGE_POOL_STATS=y
+CONFIG_PAGE_SIZE_LESS_THAN_256KB=y
+CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
+# CONFIG_PANIC_ON_OOPS is not set
+CONFIG_PANIC_ON_OOPS_VALUE=0
+CONFIG_PANIC_TIMEOUT=0
+CONFIG_PCPU_DEV_REFCNT=y
+CONFIG_PCS_XPCS=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLIB_LEDS=y
+CONFIG_PHYLINK=y
+# CONFIG_PHY_STM32_USBPHYC is not set
+CONFIG_PINCTRL=y
+CONFIG_PINCTRL_MCP23S08=y
+CONFIG_PINCTRL_MCP23S08_I2C=y
+CONFIG_PINCTRL_STM32=y
+CONFIG_PINCTRL_STM32MP135=y
+# CONFIG_PL353_SMC is not set
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_DEVFREQ=y
+CONFIG_PM_DEVFREQ_EVENT=y
+CONFIG_PM_GENERIC_DOMAINS=y
+CONFIG_PM_GENERIC_DOMAINS_OF=y
+CONFIG_PM_GENERIC_DOMAINS_SLEEP=y
+CONFIG_PM_OPP=y
+CONFIG_PM_SLEEP=y
+CONFIG_PM_SLEEP_SMP=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_POSIX_MQUEUE_SYSCTL=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_GPIO=y
+CONFIG_POWER_RESET_GPIO_RESTART=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_POWER_RESET_SYSCON_POWEROFF=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PPS=y
+CONFIG_PREEMPT_NONE_BUILD=y
+CONFIG_PRINTK_TIME=y
+CONFIG_PTP_1588_CLOCK=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_RANDSTRUCT_NONE=y
+CONFIG_RAS=y
+CONFIG_RATIONAL=y
+# CONFIG_RAVE_SP_CORE is not set
+CONFIG_REGMAP=y
+CONFIG_REGMAP_I2C=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_ARM_SCMI=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_GPIO=y
+# CONFIG_REGULATOR_STM32_BOOSTER is not set
+# CONFIG_REGULATOR_STM32_PWR is not set
+# CONFIG_REGULATOR_STM32_VREFBUF is not set
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RESET_SCMI=y
+CONFIG_RESET_SIMPLE=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+CONFIG_RTC_CLASS=y
+# CONFIG_RTC_DRV_CMOS is not set
+# CONFIG_RTC_DRV_OPTEE is not set
+CONFIG_RTC_DRV_STM32=y
+CONFIG_RTC_I2C_AND_SPI=y
+CONFIG_RWSEM_SPIN_ON_OWNER=y
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+# CONFIG_SERIAL_8250 is not set
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_DEV_BUS=y
+CONFIG_SERIAL_DEV_CTRL_TTYPORT=y
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SERIAL_STM32=y
+CONFIG_SERIAL_STM32_CONSOLE=y
+CONFIG_SERIO=y
+CONFIG_SERIO_LIBPS2=y
+CONFIG_SERIO_SERPORT=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SG_POOL=y
+CONFIG_SMP=y
+CONFIG_SMP_ON_UP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SOC_BUS=y
+CONFIG_SOFTIRQ_ON_OWN_STACK=y
+CONFIG_SPARSE_IRQ=y
+CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU=y
+# CONFIG_SQUASHFS_EMBEDDED is not set
+CONFIG_SQUASHFS_FILE_CACHE=y
+# CONFIG_SQUASHFS_FILE_DIRECT is not set
+CONFIG_SQUASHFS_LZO=y
+CONFIG_SQUASHFS_ZLIB=y
+CONFIG_STM32_DMA=y
+CONFIG_STM32_DMAMUX=y
+CONFIG_STM32_EXTI=y
+# CONFIG_STM32_FMC2_EBI is not set
+CONFIG_STM32_MDMA=y
+CONFIG_STM32_WATCHDOG=y
+CONFIG_STMMAC_ETH=y
+CONFIG_STMMAC_PLATFORM=y
+# CONFIG_STRIP_ASM_SYMS is not set
+CONFIG_SUSPEND=y
+CONFIG_SUSPEND_FREEZER=y
+CONFIG_SWPHY=y
+CONFIG_SWP_EMULATE=y
+CONFIG_SYS_SUPPORTS_APM_EMULATION=y
+CONFIG_TEE=y
+CONFIG_THREAD_INFO_IN_TASK=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_TRUSTED_FOUNDATIONS=y
+# CONFIG_UCLAMP_TASK is not set
+# CONFIG_UEVENT_HELPER is not set
+CONFIG_UNCOMPRESS_INCLUDE="debug/uncompress.h"
+CONFIG_UNWINDER_ARM=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USELIB=y
+CONFIG_USE_OF=y
+CONFIG_VFP=y
+CONFIG_VFPv3=y
+CONFIG_VMAP_STACK=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+CONFIG_VT_CONSOLE_SLEEP=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
+CONFIG_WATCHDOG_CORE=y
+# CONFIG_WQ_POWER_EFFICIENT_DEFAULT is not set
+CONFIG_XPS=y
+CONFIG_XZ_DEC_ARM=y
+CONFIG_XZ_DEC_ARMTHUMB=y
+CONFIG_XZ_DEC_BCJ=y
+CONFIG_ZBOOT_ROM_BSS=0x0
+CONFIG_ZBOOT_ROM_TEXT=0x0
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
diff --git a/target/linux/stm32/stm32mp1/target.mk b/target/linux/stm32/stm32mp1/target.mk
new file mode 100644
index 00000000000000..c41055d5b52462
--- /dev/null
+++ b/target/linux/stm32/stm32mp1/target.mk
@@ -0,0 +1,12 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2024 Bootlin
+#
+
+BOARDNAME:=STM32MP1 boards
+ARCH:=arm
+CPU_TYPE:=cortex-a7
+CPU_SUBTYPE=neon-vfpv4
+FEATURES+=fpu
+KERNEL_IMAGES:=zImage
+

From 5eb25dddb17fa3cf4958e91dfc9fc868c9eb03ac Mon Sep 17 00:00:00 2001
From: Antonio Pastor <antonio.pastor@gmail.com>
Date: Sat, 16 Nov 2024 15:09:49 -0500
Subject: [PATCH 028/225] kernel: modules: appletalk: add for Netatalk v4

Netatalk v4 reintroduces AppleTalk and this module is required for
layer 3 protocol support.

Module was removed in kernel 4.14 for OpenWrt 18.06 (commmit
14a0131, 22/02/2018). At the time nothing used it as Netatalk v3
did not support AppleTalk.

Not building ipddp feature/module like it was in the past, as
recommended by upstream Netatalk maintainers.

Signed-off-by: Antonio Pastor <antonio.pastor@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16979
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 package/kernel/linux/modules/netsupport.mk | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/package/kernel/linux/modules/netsupport.mk b/package/kernel/linux/modules/netsupport.mk
index 9f349d34ee229b..3551a89a9b2e91 100644
--- a/package/kernel/linux/modules/netsupport.mk
+++ b/package/kernel/linux/modules/netsupport.mk
@@ -42,6 +42,24 @@ endef
 $(eval $(call KernelPackage,atmtcp))
 
 
+define KernelPackage/appletalk
+  SUBMENU:=$(NETWORK_SUPPORT_MENU)
+  TITLE:=Appletalk protocol support
+  KCONFIG:= \
+        CONFIG_ATALK \
+        CONFIG_DEV_APPLETALK \
+        CONFIG_IPDDP=n
+  FILES:=$(LINUX_DIR)/net/appletalk/appletalk.ko
+  AUTOLOAD:=$(call AutoLoad,40,appletalk)
+endef
+
+define KernelPackage/appletalk/description
+  Kernel module for AppleTalk protocol.
+endef
+
+$(eval $(call KernelPackage,appletalk))
+
+
 define KernelPackage/bonding
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
   TITLE:=Ethernet bonding driver

From 55644397cd3cb3d8c77d74c9d22872502d091257 Mon Sep 17 00:00:00 2001
From: Rosen Penev <rosenp@gmail.com>
Date: Tue, 22 Oct 2024 17:07:44 -0700
Subject: [PATCH 029/225] mxs: run kernel_oldconfig

small change.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16913
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 target/linux/mxs/config-6.6 | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/target/linux/mxs/config-6.6 b/target/linux/mxs/config-6.6
index b954ea25486579..e01e266c0d3fdf 100644
--- a/target/linux/mxs/config-6.6
+++ b/target/linux/mxs/config-6.6
@@ -53,6 +53,7 @@ CONFIG_CPU_IDLE=y
 CONFIG_CPU_IDLE_GOV_LADDER=y
 CONFIG_CPU_IDLE_GOV_MENU=y
 CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_CPU_MITIGATIONS=y
 CONFIG_CPU_PABRT_LEGACY=y
 CONFIG_CPU_PM=y
 CONFIG_CPU_THUMB_CAPABLE=y
@@ -70,6 +71,7 @@ CONFIG_CRYPTO_LIB_GF128MUL=y
 CONFIG_CRYPTO_LIB_SHA1=y
 CONFIG_CRYPTO_LIB_UTILS=y
 CONFIG_DEBUG_ALIGN_RODATA=y
+CONFIG_DEBUG_INFO=y
 CONFIG_DEBUG_LL_INCLUDE="mach/debug-macro.S"
 CONFIG_DMADEVICES=y
 CONFIG_DMA_ENGINE=y
@@ -84,6 +86,7 @@ CONFIG_EXTCON=y
 CONFIG_FEC=y
 CONFIG_FIXED_PHY=y
 CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_FORCE_NR_CPUS=y
 CONFIG_FS_IOMAP=y
 CONFIG_FS_MBCACHE=y
 CONFIG_FUNCTION_ALIGNMENT=0
@@ -206,6 +209,7 @@ CONFIG_PPS=y
 CONFIG_PREEMPT_NONE_BUILD=y
 CONFIG_PTP_1588_CLOCK=y
 CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_RANDSTRUCT_NONE=y
 CONFIG_RATIONAL=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
@@ -231,6 +235,7 @@ CONFIG_SPI=y
 CONFIG_SPI_MASTER=y
 CONFIG_SPI_MXS=y
 CONFIG_SPLIT_PTLOCK_CPUS=999999
+CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU=y
 CONFIG_STMP3XXX_RTC_WATCHDOG=y
 CONFIG_STMP_DEVICE=y
 CONFIG_SWPHY=y

From 6280b4abfbc087157bc233083a67a42bffa31010 Mon Sep 17 00:00:00 2001
From: Rosen Penev <rosenp@gmail.com>
Date: Fri, 18 Oct 2024 19:19:50 -0700
Subject: [PATCH 030/225] mvebu: devm for mutex_init

It's common to avoid calling mutex_destroy when done. It's not correct
strictly speaking.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16753
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 ...-mfd-Add-a-driver-for-IEI-WT61P803-PUZZLE-MCU.patch | 10 +++++++---
 ...-hwmon-Add-the-IEI-WT61P803-PUZZLE-HWMON-driv.patch |  6 ++++--
 ...910-drivers-leds-wt61p803-puzzle-improvements.patch |  6 ++++--
 3 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/target/linux/mvebu/patches-6.6/902-drivers-mfd-Add-a-driver-for-IEI-WT61P803-PUZZLE-MCU.patch b/target/linux/mvebu/patches-6.6/902-drivers-mfd-Add-a-driver-for-IEI-WT61P803-PUZZLE-MCU.patch
index 1046b15e4b79dc..2aac515eb192da 100644
--- a/target/linux/mvebu/patches-6.6/902-drivers-mfd-Add-a-driver-for-IEI-WT61P803-PUZZLE-MCU.patch
+++ b/target/linux/mvebu/patches-6.6/902-drivers-mfd-Add-a-driver-for-IEI-WT61P803-PUZZLE-MCU.patch
@@ -54,7 +54,7 @@ Cc: Robert Marko <robert.marko@sartura.hr>
  obj-$(CONFIG_INTEL_SOC_PMIC_BXTWC)	+= intel_soc_pmic_bxtwc.o
 --- /dev/null
 +++ b/drivers/mfd/iei-wt61p803-puzzle.c
-@@ -0,0 +1,908 @@
+@@ -0,0 +1,912 @@
 +// SPDX-License-Identifier: GPL-2.0-only
 +/* IEI WT61P803 PUZZLE MCU Driver
 + * System management microcontroller for fan control, temperature sensor reading,
@@ -894,8 +894,12 @@ Cc: Robert Marko <robert.marko@sartura.hr>
 +	mcu->serdev = serdev;
 +	mcu->dev = dev;
 +	init_completion(&mcu->reply->received);
-+	mutex_init(&mcu->reply_lock);
-+	mutex_init(&mcu->lock);
++	ret = devm_mutex_init(dev, &mcu->reply_lock);
++	if (ret)
++		return ret;
++	ret = devm_mutex_init(dev, &mcu->lock);
++	if (ret)
++		return ret;
 +
 +	/* Setup UART interface */
 +	serdev_device_set_drvdata(serdev, mcu);
diff --git a/target/linux/mvebu/patches-6.6/903-drivers-hwmon-Add-the-IEI-WT61P803-PUZZLE-HWMON-driv.patch b/target/linux/mvebu/patches-6.6/903-drivers-hwmon-Add-the-IEI-WT61P803-PUZZLE-HWMON-driv.patch
index 983434e66620cf..eca2bb81e48d50 100644
--- a/target/linux/mvebu/patches-6.6/903-drivers-hwmon-Add-the-IEI-WT61P803-PUZZLE-HWMON-driv.patch
+++ b/target/linux/mvebu/patches-6.6/903-drivers-hwmon-Add-the-IEI-WT61P803-PUZZLE-HWMON-driv.patch
@@ -53,7 +53,7 @@ Cc: Robert Marko <robert.marko@sartura.hr>
  obj-$(CONFIG_SENSORS_IBMPOWERNV)+= ibmpowernv.o
 --- /dev/null
 +++ b/drivers/hwmon/iei-wt61p803-puzzle-hwmon.c
-@@ -0,0 +1,445 @@
+@@ -0,0 +1,447 @@
 +// SPDX-License-Identifier: GPL-2.0-only
 +/* IEI WT61P803 PUZZLE MCU HWMON Driver
 + *
@@ -457,7 +457,9 @@ Cc: Robert Marko <robert.marko@sartura.hr>
 +
 +	mcu_hwmon->mcu = mcu;
 +	platform_set_drvdata(pdev, mcu_hwmon);
-+	mutex_init(&mcu_hwmon->lock);
++	ret = devm_mutex_init(dev, &mcu_hwmon->lock);
++	if (ret)
++		return ret;
 +
 +	hwmon_dev = devm_hwmon_device_register_with_info(dev, "iei_wt61p803_puzzle",
 +							 mcu_hwmon,
diff --git a/target/linux/mvebu/patches-6.6/910-drivers-leds-wt61p803-puzzle-improvements.patch b/target/linux/mvebu/patches-6.6/910-drivers-leds-wt61p803-puzzle-improvements.patch
index 150a65498cd3d4..8de403773a0891 100644
--- a/target/linux/mvebu/patches-6.6/910-drivers-leds-wt61p803-puzzle-improvements.patch
+++ b/target/linux/mvebu/patches-6.6/910-drivers-leds-wt61p803-puzzle-improvements.patch
@@ -47,7 +47,7 @@
  
  	ret = iei_wt61p803_puzzle_write_command(priv->mcu, led_power_cmd,
  						sizeof(led_power_cmd),
-@@ -90,39 +106,166 @@ static enum led_brightness iei_wt61p803_
+@@ -90,39 +106,168 @@ static enum led_brightness iei_wt61p803_
  	return led_state;
  }
  
@@ -194,7 +194,9 @@
 +			goto put_child_node;
 +		}
 +
-+		mutex_init(&priv->lock);
++		ret = devm_mutex_init(dev, &priv->lock);
++		if (ret)
++			goto put_child_node;
 +
 +		dev_set_drvdata(dev, priv);
 +

From 3a9752ea027b8969750c0dd7f89b6afc357dcffa Mon Sep 17 00:00:00 2001
From: Vaclav Svoboda <svoboda@neng.cz>
Date: Mon, 11 Nov 2024 22:34:00 +0100
Subject: [PATCH 031/225] ramips: mt76x8: Add support for Zbtlink ZBT-WE2426-B

The Zbtlink ZBT-WE2426-B is an indoor dual band WiFi router
with 4 external non detachable antennas and 5 Fast Ethernet ports.

Hardware of ZBT-WE2426-B:
- SoC: MT7628AN
- RAM: 64 MB (Winbond W9751G6K8-25)
- Storage: 8 MB SPI flash (S25FL064K)
- Ethernet: 5x 10/100 Mbps LAN1,LAN2,LAN3,LAN4 & WAN
- Wireless: 2.4GHz: on SoC (802.11b/g/n)
- Wireless: 5GHz: Mediatek MT7612EN (802.11n/ac)
- LEDs: 8x
- Buttons: 1x reset
- USB: 1x 2.0
- MicroSD slot: 1x
- Power: 9 VDC, 1 A
- Uart: GND TX RX PWR - J1 on the PCB
- Board silkscreen: "ZBT-WE2426-C V04" "2018-02-28" "CTT" "13 18"

Backup the stock firmware, settings and calibration data:
This router comes with PandoraBox OpenWrt firmware, so it is
possible to get all MTD partitions using scp.

Installation:
- Using the bootloader web server. Hold the reset button while turning
  the power on. Upload the sysupgrade image on http://192.168.1.1.
- Using the sysupgrade command in PandoraBox OpenWrt.

LEDs:
- LAN1,LAN2,LAN3,LAN4,WAN,WLAN2G use GPIO pins of the MT7628AN SoC
  (GPIOs 43,42,41,40,39,44)
- WLAN5G uses pin of MT7612EN.
- The POWER LED is directly connected to the VCC. It can be reconnected to
  the GPIO 37 of the MT7628AN SoC by resoldering SMD resistor on the PCB.

Buttons:
- The RESET button is connected to the GPIO 38 of the MT7628AN SoC.

MAC addresses as verified by OEM firmware:
use   address   source
2g    *:b0      factory 0x4 (label)
5g    *:b1      factory 0x8004
LAN   *:b2      factory 0x28
WAN   *:b3      factory 0x2e

Signed-off-by: Vaclav Svoboda <svoboda@neng.cz>
Link: https://github.com/openwrt/openwrt/pull/16927
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 .../dts/mt7628an_zbtlink_zbt-we2426-b.dts     | 183 ++++++++++++++++++
 target/linux/ramips/image/mt76x8.mk           |   8 +
 .../mt76x8/base-files/etc/board.d/01_leds     |   7 +
 .../mt76x8/base-files/etc/board.d/02_network  |   6 +-
 4 files changed, 202 insertions(+), 2 deletions(-)
 create mode 100644 target/linux/ramips/dts/mt7628an_zbtlink_zbt-we2426-b.dts

diff --git a/target/linux/ramips/dts/mt7628an_zbtlink_zbt-we2426-b.dts b/target/linux/ramips/dts/mt7628an_zbtlink_zbt-we2426-b.dts
new file mode 100644
index 00000000000000..6dfdb2617c36b2
--- /dev/null
+++ b/target/linux/ramips/dts/mt7628an_zbtlink_zbt-we2426-b.dts
@@ -0,0 +1,183 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7628an.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "zbtlink,zbt-we2426-b", "mediatek,mt7628an-soc";
+	model = "Zbtlink ZBT-WE2426-B";
+
+	aliases {
+		led-boot = &led_wlan;
+		led-failsafe = &led_wlan;
+		led-upgrade = &led_wlan;
+		label-mac-device = &wmac;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 38 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		lan1 {
+			gpios = <&gpio 43 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <1>;
+		};
+
+		lan2 {
+			gpios = <&gpio 42 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <2>;
+		};
+
+		lan3 {
+			gpios = <&gpio 41 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <3>;
+		};
+
+		lan4 {
+			gpios = <&gpio 40 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <4>;
+		};
+
+		wan {
+			gpios = <&gpio 39 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WAN;
+		};
+
+		led_wlan: wlan2g {
+			gpios = <&gpio 44 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WLAN;
+			linux,default-trigger = "phy0tpt";
+		};
+
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-boot-env";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			factory: partition@40000 {
+				label = "factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					eeprom_factory_0: eeprom@0 {
+						reg = <0x0 0x400>;
+					};
+
+					eeprom_factory_8000: eeprom@8000 {
+						reg = <0x8000 0x200>;
+					};
+
+					macaddr_factory_28: macaddr@28 {
+						reg = <0x28 0x6>;
+					};
+				};
+			};
+
+			partition@50000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x50000 0x7b0000>;
+			};
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "i2s", "refclk", "wdt", "p4led_an",
+				"p3led_an", "p2led_an",
+				"p1led_an", "p0led_an",
+				"wled_an";
+		function = "gpio";
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		nvmem-cells = <&eeprom_factory_8000>;
+		nvmem-cell-names = "eeprom";
+		ieee80211-freq-limit = <5000000 6000000>;
+
+		led {
+			led-sources = <2>;
+			led-active-low;
+		};
+	};
+};
+
+&wmac {
+	status = "okay";
+
+	nvmem-cells = <&eeprom_factory_0>;
+	nvmem-cell-names = "eeprom";
+};
+
+&ethernet {
+	nvmem-cells = <&macaddr_factory_28>;
+	nvmem-cell-names = "mac-address";
+};
+
+&esw {
+	mediatek,portmap = <0x2f>;
+};
+
+&sdhci {
+	status = "okay";
+};
diff --git a/target/linux/ramips/image/mt76x8.mk b/target/linux/ramips/image/mt76x8.mk
index 8ad840ddfead64..7e343bf0164fb0 100644
--- a/target/linux/ramips/image/mt76x8.mk
+++ b/target/linux/ramips/image/mt76x8.mk
@@ -1158,6 +1158,14 @@ define Device/zbtlink_zbt-we1226
 endef
 TARGET_DEVICES += zbtlink_zbt-we1226
 
+define Device/zbtlink_zbt-we2426-b
+  IMAGE_SIZE := 7872k
+  DEVICE_VENDOR := Zbtlink
+  DEVICE_MODEL := ZBT-WE2426-B
+  DEVICE_PACKAGES := kmod-mt76x2 kmod-usb2 kmod-usb-ohci
+endef
+TARGET_DEVICES += zbtlink_zbt-we2426-b
+
 define Device/zyxel_keenetic-extra-ii
   IMAGE_SIZE := 29824k
   DEVICE_VENDOR := Zyxel
diff --git a/target/linux/ramips/mt76x8/base-files/etc/board.d/01_leds b/target/linux/ramips/mt76x8/base-files/etc/board.d/01_leds
index 5ea668de012624..00e5086bb3fea5 100644
--- a/target/linux/ramips/mt76x8/base-files/etc/board.d/01_leds
+++ b/target/linux/ramips/mt76x8/base-files/etc/board.d/01_leds
@@ -186,6 +186,13 @@ zbtlink,zbt-we1226)
 	ucidef_set_led_switch "lan2" "LAN2" "green:lan2" "switch0" "0x02"
 	ucidef_set_led_switch "wan" "WAN" "green:wan" "switch0" "0x10"
 	;;
+zbtlink,zbt-we2426-b)
+	ucidef_set_led_switch "wan" "wan" "green:wan" "switch0" "0x10"
+	ucidef_set_led_switch "lan1" "lan1" "green:lan-1" "switch0" "0x01"
+	ucidef_set_led_switch "lan2" "lan2" "green:lan-2" "switch0" "0x02"
+	ucidef_set_led_switch "lan3" "lan3" "green:lan-3" "switch0" "0x04"
+	ucidef_set_led_switch "lan4" "lan4" "green:lan-4" "switch0" "0x08"
+	;;
 zyxel,keenetic-extra-ii)
 	ucidef_set_led_netdev "wifi_led" "wifi" "green:wifi" "wlan0"
 	ucidef_set_led_switch "internet" "internet" "green:internet" "switch0" "0x01"
diff --git a/target/linux/ramips/mt76x8/base-files/etc/board.d/02_network b/target/linux/ramips/mt76x8/base-files/etc/board.d/02_network
index cb0983b9dc133b..616baa80c055c7 100644
--- a/target/linux/ramips/mt76x8/base-files/etc/board.d/02_network
+++ b/target/linux/ramips/mt76x8/base-files/etc/board.d/02_network
@@ -148,7 +148,8 @@ ramips_setup_interfaces()
 	netgear,r6020|\
 	netgear,r6080|\
 	netgear,r6120|\
-	wavlink,wl-wn531a3)
+	wavlink,wl-wn531a3|\
+	zbtlink,zbt-we2426-b)
 		ucidef_add_switch "switch0" \
 			"0:lan:4" "1:lan:3" "2:lan:2" "3:lan:1" "4:wan" "6@eth0"
 		;;
@@ -244,7 +245,8 @@ ramips_setup_macs()
 	hilink,hlk-7688a|\
 	wavlink,wl-wn531a3|\
 	wavlink,wl-wn577a2|\
-	wavlink,wl-wn578a2)
+	wavlink,wl-wn578a2|\
+	zbtlink,zbt-we2426-b)
 		wan_mac=$(mtd_get_mac_binary factory 0x2e)
 		label_mac=$(mtd_get_mac_binary factory 0x4)
 		;;

From 832cc8ce04122ea726178687b5168187b2465f7f Mon Sep 17 00:00:00 2001
From: Tim Noack <tim@noack.id>
Date: Mon, 21 Oct 2024 12:21:41 +0000
Subject: [PATCH 032/225] ath79: refactor dts of TP-Link CPE710-v1

This is done in preparation of adding support for the CPE710-v2,
which uses a similiar device tree.

Signed-off-by: Tim Noack <tim@noack.id>
Link: https://github.com/openwrt/openwrt/pull/16637
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 .../ath79/dts/qca9563_tplink_cpe710-v1.dts    | 151 +----------------
 .../ath79/dts/qca9563_tplink_cpe710.dtsi      | 160 ++++++++++++++++++
 2 files changed, 161 insertions(+), 150 deletions(-)
 create mode 100644 target/linux/ath79/dts/qca9563_tplink_cpe710.dtsi

diff --git a/target/linux/ath79/dts/qca9563_tplink_cpe710-v1.dts b/target/linux/ath79/dts/qca9563_tplink_cpe710-v1.dts
index 6d1b58f95fae48..31e04232ab6c5a 100644
--- a/target/linux/ath79/dts/qca9563_tplink_cpe710-v1.dts
+++ b/target/linux/ath79/dts/qca9563_tplink_cpe710-v1.dts
@@ -1,151 +1,13 @@
 // SPDX-License-Identifier: GPL-2.0-or-later OR MIT
 
-#include "qca956x.dtsi"
-
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/input/input.h>
-#include <dt-bindings/leds/common.h>
+#include "qca9563_tplink_cpe710.dtsi"
 
 / {
 	model = "TP-Link CPE710 v1";
 	compatible = "tplink,cpe710-v1", "qca,qca9563";
-
-	aliases {
-		label-mac-device = &eth0;
-		led-boot = &led_lan;
-		led-failsafe = &led_lan;
-		led-upgrade = &led_lan;
-	};
-
-	leds {
-		compatible = "gpio-leds";
-
-		led_lan: lan {
-			function = LED_FUNCTION_LAN;
-			color = <LED_COLOR_ID_BLUE>;
-			gpios = <&gpio 5 GPIO_ACTIVE_LOW>;
-		};
-
-		wlan5g {
-			label = "blue:wlan5g";
-			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
-			linux,default-trigger = "phy0tpt";
-		};
-	};
-
-	keys {
-		compatible = "gpio-keys";
-
-		reset {
-			label = "Reset button";
-			linux,code = <KEY_RESTART>;
-			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
-			debounce-interval = <60>;
-		};
-	};
-};
-
-&pcie {
-	status = "okay";
-
-	wifi@0,0 {
-		compatible = "qcom,ath10k";
-		reg = <0x0000 0 0 0 0>;
-		nvmem-cells = <&precal_art_5000>, <&macaddr_info_8>;
-		nvmem-cell-names = "pre-calibration", "mac-address";
-	};
-};
-
-&spi {
-	status = "okay";
-
-	flash@0 {
-		compatible = "jedec,spi-nor";
-		reg = <0>;
-		spi-max-frequency = <40000000>;
-
-		partitions {
-			compatible = "fixed-partitions";
-			#address-cells = <1>;
-			#size-cells = <1>;
-
-			partition@0 {
-				label = "u-boot";
-				reg = <0x000000 0x040000>;
-				read-only;
-			};
-
-			partition@40000 {
-				label = "u-boot-env";
-				reg = <0x040000 0x010000>;
-			};
-
-			partition@50000 {
-				label = "partition-table";
-				reg = <0x050000 0x010000>;
-				read-only;
-			};
-
-			info: partition@60000 {
-				label = "info";
-				reg = <0x060000 0x010000>;
-				read-only;
-
-				nvmem-layout {
-					compatible = "fixed-layout";
-					#address-cells = <1>;
-					#size-cells = <1>;
-
-					macaddr_info_8: macaddr@8 {
-						reg = <0x8 0x6>;
-					};
-				};
-			};
-
-			partition@70000 {
-				compatible = "denx,uimage";
-				label = "firmware";
-				reg = <0x070000 0xf50000>;
-			};
-
-			partition@fc0000 {
-				label = "config";
-				reg = <0xfc0000 0x030000>;
-				read-only;
-			};
-
-			partition@ff0000 {
-				label = "art";
-				reg = <0xff0000 0x010000>;
-				read-only;
-
-				nvmem-layout {
-					compatible = "fixed-layout";
-					#address-cells = <1>;
-					#size-cells = <1>;
-
-					precal_art_5000: pre-calibration@5000 {
-						reg = <0x5000 0x2f20>;
-					};
-				};
-			};
-		};
-	};
-};
-
-&pinmux {
-	mdio_pins: mdio_pins {
-		/* GPIO 10 as MDIO(0x20), GPIO 8 as MDC(0x21) */
-		pinctrl-single,bits = <0x8 0x00200021 0x00ff00ff>;
-	};
 };
 
 &mdio0 {
-	status = "okay";
-
-	pinctrl-names = "default";
-	pinctrl-0 = <&mdio_pins>;
-
 	phy4: ethernet-phy@4 {
 		reg = <4>;
 		reset-gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
@@ -153,17 +15,6 @@
 };
 
 &eth0 {
-	status = "okay";
-
 	phy-handle = <&phy4>;
 	phy-mode = "sgmii";
-
-	nvmem-cells = <&macaddr_info_8>;
-	nvmem-cell-names = "mac-address";
-
-	qca956x-serdes-fixup;
-
-	gmac-config {
-		device = <&gmac>;
-	};
 };
diff --git a/target/linux/ath79/dts/qca9563_tplink_cpe710.dtsi b/target/linux/ath79/dts/qca9563_tplink_cpe710.dtsi
new file mode 100644
index 00000000000000..9de36f3b6635f5
--- /dev/null
+++ b/target/linux/ath79/dts/qca9563_tplink_cpe710.dtsi
@@ -0,0 +1,160 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca956x.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	aliases {
+		led-boot = &led_lan;
+		led-failsafe = &led_lan;
+		led-upgrade = &led_lan;
+		label-mac-device = &eth0;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_lan: lan {
+			function = LED_FUNCTION_LAN;
+			color = <LED_COLOR_ID_BLUE>;
+			gpios = <&gpio 5 GPIO_ACTIVE_LOW>;
+		};
+
+		wlan5g {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WLAN_5GHZ;
+			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "Reset button";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+
+	wifi@0,0 {
+		compatible = "qcom,ath10k";
+		reg = <0x0000 0 0 0 0>;
+		nvmem-cells = <&precal_art_5000>, <&macaddr_info_8>;
+		nvmem-cell-names = "pre-calibration", "mac-address";
+	};
+};
+
+&spi {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <40000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x000000 0x040000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "u-boot-env";
+				reg = <0x040000 0x010000>;
+				read-only;
+			};
+
+			partition@50000 {
+				label = "partition-table";
+				reg = <0x050000 0x010000>;
+				read-only;
+			};
+
+			partition@60000 {
+				label = "info";
+				reg = <0x060000 0x010000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					macaddr_info_8: macaddr@8 {
+						reg = <0x8 0x6>;
+					};
+				};
+			};
+
+			partition@70000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x070000 0xf50000>;
+			};
+
+			partition@fc0000 {
+				label = "config";
+				reg = <0xfc0000 0x030000>;
+				read-only;
+			};
+
+			partition@ff0000 {
+				label = "art";
+				reg = <0xff0000 0x010000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					precal_art_5000: pre-calibration@5000 {
+						reg = <0x5000 0x2f20>;
+					};
+				};
+			};
+		};
+	};
+};
+
+&pinmux {
+	mdio_pins: mdio_pins {
+		/* GPIO 10 as MDIO(0x20), GPIO 8 as MDC(0x21) */
+		pinctrl-single,bits = <0x8 0x00200021 0x00ff00ff>;
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&mdio_pins>;
+};
+
+&eth0 {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_info_8>;
+	nvmem-cell-names = "mac-address";
+
+	qca956x-serdes-fixup;
+
+	gmac-config {
+		device = <&gmac>;
+	};
+};

From 5572e0196a93604716ec36ebb8db6737fc6677aa Mon Sep 17 00:00:00 2001
From: Tim Noack <tim@noack.id>
Date: Mon, 21 Oct 2024 12:21:59 +0000
Subject: [PATCH 033/225] ath79: add support for TP-Link CPE710-v2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

TP-Link CPE710-v2 is an outdoor wireless CPE for 5 GHz with one Ethernet
port based on the AP152 reference board. Compared to the CPE710-v1, the
only change observed in hardware is that the mdio address of the ethernet
physical changed from 0x4 to 0x0.

Specifications:
- SoC: QCA9563-AL3A MIPS 74kc @ 775MHz, AHB @ 258MHz
- RAM: 128MiB DDR2 @ 650MHz
- Flash: 16MiB SPI NOR Based on the GD25Q128
- Wi-Fi 5Ghz: ath10k chip (802.11ac for up to 867Mbps on 5GHz wireless
  data rate), based on the QCA9896
- Ethernet: one 1GbE port
- 23dBi high-gain directional 2×2 MIMO parabolic antenna
- Power, LAN, WLAN5G Blue LEDs

Flashing instructions:
Flash factory image through stock firmware WEB UI or through TFTP
To get to TFTP recovery just hold reset button while powering on for around
30-40 seconds and release.
Rename factory image to recovery.bin
Stock TFTP server IP:192.168.0.100
Stock device TFTP address:192.168.0.254

Signed-off-by: Tim Noack <tim@noack.id>
Link: https://github.com/openwrt/openwrt/pull/16637
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 .../ath79/dts/qca9563_tplink_cpe710-v2.dts    | 20 +++++++++++++++++++
 .../generic/base-files/etc/board.d/01_leds    |  3 ++-
 .../generic/base-files/etc/board.d/02_network |  1 +
 target/linux/ath79/image/generic-tp-link.mk   | 11 ++++++++++
 4 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100644 target/linux/ath79/dts/qca9563_tplink_cpe710-v2.dts

diff --git a/target/linux/ath79/dts/qca9563_tplink_cpe710-v2.dts b/target/linux/ath79/dts/qca9563_tplink_cpe710-v2.dts
new file mode 100644
index 00000000000000..fe277fc549d5b5
--- /dev/null
+++ b/target/linux/ath79/dts/qca9563_tplink_cpe710-v2.dts
@@ -0,0 +1,20 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca9563_tplink_cpe710.dtsi"
+
+/ {
+	model = "TP-Link CPE710 v2";
+	compatible = "tplink,cpe710-v2", "qca,qca9563";
+};
+
+&mdio0 {
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		reset-gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
+	};
+};
+
+&eth0 {
+	phy-handle = <&phy0>;
+	phy-mode = "sgmii";
+};
diff --git a/target/linux/ath79/generic/base-files/etc/board.d/01_leds b/target/linux/ath79/generic/base-files/etc/board.d/01_leds
index 0e5731dd743186..6409adb78ad825 100644
--- a/target/linux/ath79/generic/base-files/etc/board.d/01_leds
+++ b/target/linux/ath79/generic/base-files/etc/board.d/01_leds
@@ -222,7 +222,8 @@ openmesh,mr900-v1|\
 openmesh,mr900-v2|\
 openmesh,mr1750-v1|\
 openmesh,mr1750-v2|\
-tplink,cpe710-v1)
+tplink,cpe710-v1|\
+tplink,cpe710-v2)
 	ucidef_set_led_netdev "lan" "LAN" "blue:lan" "eth0"
 	;;
 compex,wpj344-16m|\
diff --git a/target/linux/ath79/generic/base-files/etc/board.d/02_network b/target/linux/ath79/generic/base-files/etc/board.d/02_network
index 8f79a3fad8114d..2bd97442d956dc 100644
--- a/target/linux/ath79/generic/base-files/etc/board.d/02_network
+++ b/target/linux/ath79/generic/base-files/etc/board.d/02_network
@@ -89,6 +89,7 @@ ath79_setup_interfaces()
 	tplink,cpe610-v1|\
 	tplink,cpe610-v2|\
 	tplink,cpe710-v1|\
+	tplink,cpe710-v2|\
 	tplink,eap225-outdoor-v1|\
 	tplink,eap225-outdoor-v3|\
 	tplink,eap225-v1|\
diff --git a/target/linux/ath79/image/generic-tp-link.mk b/target/linux/ath79/image/generic-tp-link.mk
index 643de76f7c2ba7..c42338db783203 100644
--- a/target/linux/ath79/image/generic-tp-link.mk
+++ b/target/linux/ath79/image/generic-tp-link.mk
@@ -391,6 +391,17 @@ define Device/tplink_cpe710-v1
 endef
 TARGET_DEVICES += tplink_cpe710-v1
 
+define Device/tplink_cpe710-v2
+  $(Device/tplink-safeloader-uimage)
+  SOC := qca9563
+  IMAGE_SIZE := 15680k
+  DEVICE_MODEL := CPE710
+  DEVICE_VARIANT := v2
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9888-ct
+  TPLINK_BOARD_ID := CPE710V2
+endef
+TARGET_DEVICES += tplink_cpe710-v2
+
 define Device/tplink-eap2x5
   $(Device/tplink-safeloader)
   LOADER_TYPE := elf

From c89ed7acc897794b06b61f10d8f641ee06fbaacf Mon Sep 17 00:00:00 2001
From: Joerg Bayer <sg-o@live.de>
Date: Sat, 13 Apr 2024 16:05:24 +0200
Subject: [PATCH 034/225] linux-firmware: Add support for Intel AX411

Add support for Intel AX411 CNVio2 device.

Signed-off-by: Joerg Bayer <sg-o@live.de>
Link: https://github.com/openwrt/openwrt/pull/15153
[squashed and updated commit description, update to version 89]
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 package/firmware/linux-firmware/intel.mk | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/package/firmware/linux-firmware/intel.mk b/package/firmware/linux-firmware/intel.mk
index 4c9e04cd3d344c..eb5ac29159aecf 100644
--- a/package/firmware/linux-firmware/intel.mk
+++ b/package/firmware/linux-firmware/intel.mk
@@ -199,6 +199,14 @@ define Package/iwlwifi-firmware-ax210/install
 endef
 $(eval $(call BuildPackage,iwlwifi-firmware-ax210))
 
+Package/iwlwifi-firmware-ax411 = $(call Package/firmware-default,Intel AX411 firmware)
+define Package/iwlwifi-firmware-ax411/install
+	$(INSTALL_DIR) $(1)/lib/firmware
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-so-a0-gf4-a0-89.ucode $(1)/lib/firmware
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-so-a0-gf4-a0.pnvm $(1)/lib/firmware
+endef
+$(eval $(call BuildPackage,iwlwifi-firmware-ax411))
+
 Package/iwlwifi-firmware-be200 = $(call Package/firmware-default,Intel BE200 firmware)
 define Package/iwlwifi-firmware-be200/install
 	$(INSTALL_DIR) $(1)/lib/firmware

From ce3b36b3d5374709b9b091390cb9053657be17fa Mon Sep 17 00:00:00 2001
From: George Oldfort <openwrt@10099.de>
Date: Mon, 11 Nov 2024 09:25:56 +0100
Subject: [PATCH 035/225] mediatek: split Acer/W6 dts into W6 common dtsi and
 device specific dts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In order to prepare OpenWrt support for other Acer W6 devices, this commit
moves all device tree components that are used by all Acer W6/W6e/W6d/W6m
routers from mt7986a-acer-predator-w6.dts to mt7986a-acer-w6-common.dtsi
(new file) and includes this dtsi file in mt7986a-acer-predator-w6.dts.

Minor changes had to be made to the device tree in order to improve clarity
and – notably – to reduce the number of dtc warnings:
- replace (obviously wrong) led@<N> gpio led entities by led-<N>
- remove unnecessary (default-state = "off") gpio led statements
- rename entity “memory” to “memory@0”
- add missing #address-cells and #address-size in /soc/mmc@11230000
- add missing #address-cells and #address-size in /soc/pcie@11280000
- introduce symbols “nvmem” and “swport0” in dtsi (referenced in dts)

The changes were checked with `diff -BEZbdtwy --suppress-common-lines ...`
(comparing two dts files created using old and new fdt-1 blobs again), see
https://github.com/openwrt/openwrt/pull/16861/#issuecomment-2455680020 .

This is the first of four commits into which the original commit was split
to make reviews easier and more targeted.

Signed-off-by: George Oldfort <openwrt@10099.de>
Link: https://github.com/openwrt/openwrt/pull/16861
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 .../mediatek/dts/mt7986a-acer-predator-w6.dts | 475 ++----------------
 .../mediatek/dts/mt7986a-acer-w6-common.dtsi  | 387 ++++++++++++++
 2 files changed, 430 insertions(+), 432 deletions(-)
 create mode 100644 target/linux/mediatek/dts/mt7986a-acer-w6-common.dtsi

diff --git a/target/linux/mediatek/dts/mt7986a-acer-predator-w6.dts b/target/linux/mediatek/dts/mt7986a-acer-predator-w6.dts
index c27264a8d2e84c..8c86fd31d85459 100644
--- a/target/linux/mediatek/dts/mt7986a-acer-predator-w6.dts
+++ b/target/linux/mediatek/dts/mt7986a-acer-predator-w6.dts
@@ -1,11 +1,7 @@
-// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
 
 /dts-v1/;
-#include <dt-bindings/input/input.h>
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/leds/common.h>
-
-#include "mt7986a.dtsi"
+#include "mt7986a-acer-w6-common.dtsi"
 
 / {
 	model = "Acer Predator W6";
@@ -19,531 +15,146 @@
 		led-upgrade = &led_status;
 	};
 
-	chosen {
-		stdout-path = "serial0:115200n8";
-		bootargs = "dm-mod.create=\"dm-verity,,,ro,0 31544 verity 1 PARTLABEL=rootfs PARTLABEL=rootfs 4096 4096 3943 3944 sha256 2f969fa9e9e4e20b37746f22633e85b178f5db7c143e11f92733a704299cc933 2dd56e34b15c6c84573cf26c4392028421061d2c808975217b45e9a5b49d2087\" rootfstype=squashfs,ext4 rootwait root=/dev/mmcblk0p6 fstools_ignore_partname=1";
-	};
-
-	memory {
-		reg = <0 0x40000000 0 0x20000000>;
-	};
-
-	reg_1p8v: regulator-1p8v {
-		compatible = "regulator-fixed";
-		regulator-name = "fixed-1.8V";
-		regulator-min-microvolt = <1800000>;
-		regulator-max-microvolt = <1800000>;
-		regulator-boot-on;
-		regulator-always-on;
-	};
-
-	reg_3p3v: regulator-3p3v {
-		compatible = "regulator-fixed";
-		regulator-name = "fixed-3.3V";
-		regulator-min-microvolt = <3300000>;
-		regulator-max-microvolt = <3300000>;
-		regulator-boot-on;
-		regulator-always-on;
-	};
-
-	reg_5v: regulator-5v {
-		compatible = "regulator-fixed";
-		regulator-name = "fixed-5V";
-		regulator-min-microvolt = <5000000>;
-		regulator-max-microvolt = <5000000>;
-		regulator-boot-on;
-		regulator-always-on;
-	};
-
-	gpio-keys {
-		compatible = "gpio-keys";
-
-		factory {
-			label = "factory";
-			linux,code = <KEY_RESTART>;
-			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
-		};
-
-		wps {
-			label = "wps";
-			linux,code = <KEY_WPS_BUTTON>;
-			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
-		};
-	};
-
-
 	leds {
 		compatible = "gpio-leds";
 
-		led_status: led@0 {
+		led_status: led-0 {
 			label = "ant0:red";
 			gpios = <&pio 1 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@1 {
+		led-1 {
 			label = "ant0:green";
 			gpios = <&pio 2 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@2 {
+		led-2 {
 			label = "ant0:blue";
 			gpios = <&pio 36 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@3 {
+		led-3 {
 			label = "ant1:red";
 			gpios = <&pio 35 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@4 {
+		led-4 {
 			label = "ant1:green";
 			gpios = <&pio 34 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@5 {
+		led-5 {
 			label = "ant1:blue";
 			gpios = <&pio 33 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@6 {
+		led-6 {
 			label = "ant2:red";
 			gpios = <&pio 38 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@7 {
+		led-7 {
 			label = "ant2:green";
 			gpios = <&pio 37 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@8 {
+		led-8 {
 			label = "ant2:blue";
 			gpios = <&pio 26 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@9 {
+		led-9 {
 			label = "ant3:red";
 			gpios = <&pio 25 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@10 {
+		led-10 {
 			label = "ant3:green";
 			gpios = <&pio 24 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@11 {
+		led-11 {
 			label = "ant3:blue";
 			gpios = <&pio 23 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@12 {
+		led-12 {
 			label = "ant4:red";
 			gpios = <&pio 28 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@13 {
+		led-13 {
 			label = "ant4:green";
 			gpios = <&pio 27 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@14 {
+		led-14 {
 			label = "ant4:blue";
 			gpios = <&pio 32 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@15 {
+		led-15 {
 			label = "ant5:red";
 			gpios = <&pio 45 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@16 {
+		led-16 {
 			label = "ant5:green";
 			gpios = <&pio 44 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@17 {
+		led-17 {
 			label = "ant5:blue";
 			gpios = <&pio 43 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 	};
-
 };
 
-&eth {
+&ssusb {
+	vusb33-supply = <&reg_3p3v>;
+	vbus-supply = <&reg_5v>;
 	status = "okay";
+};
 
-	gmac0: mac@0 {
-		/* LAN */
-		compatible = "mediatek,eth-mac";
-		reg = <0>;
-		phy-mode = "2500base-x";
+&nvmem {
+	eeprom_factory_a0000: eeprom@a0000 {
+		reg = <0xa0000 0x1000>;
+	};
+};
 
-		fixed-link {
-			speed = <2500>;
-			full-duplex;
-			pause;
-		};
+&slot0 {
+	radio0: mt7915@0,0 {
+		reg = <0x0000 0 0 0 0>;
+		nvmem-cells = <&eeprom_factory_a0000>;
+		nvmem-cell-names = "eeprom";
 	};
+};
 
+&usb_phy {
+	status = "okay";
+};
+
+&eth {
 	gmac1: mac@1 {
-		/* WAN */
 		compatible = "mediatek,eth-mac";
 		reg = <1>;
 		phy-mode = "2500base-x";
 		phy-handle = <&phy6>;
 	};
-
-	mdio: mdio-bus {
-		#address-cells = <1>;
-		#size-cells = <0>;
-	};
 };
 
 &mdio {
 	phy6: phy@6 {
 		compatible = "ethernet-phy-ieee802.3-c45";
 		reg = <6>;
-
 		reset-gpios = <&pio 6 GPIO_ACTIVE_LOW>;
 		reset-assert-us = <10000>;
 		reset-deassert-us = <10000>;
-
-		/* LED0: nc ; LED1: nc ; LED2: Amber ; LED3: Green */
+		/* LED0: nc ; LED1: nc ; LED2: amber ; LED3: green */
 		mxl,led-config = <0x0 0x0 0x370 0x80>;
 	};
-
-	switch: switch@1f {
-		compatible = "mediatek,mt7531";
-		reg = <31>;
-
-		reset-gpios = <&pio 5 GPIO_ACTIVE_HIGH>;
-		reset-assert-us = <10000>;
-		reset-deassert-us = <10000>;
-	};
-};
-
-&pio {
-	mmc0_pins_default: mmc0-pins {
-		mux {
-			function = "emmc";
-			groups = "emmc_51";
-		};
-		conf-cmd-dat {
-			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
-			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
-			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
-			input-enable;
-			drive-strength = <4>;
-			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
-		};
-		conf-clk {
-			pins = "EMMC_CK";
-			drive-strength = <6>;
-			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
-		};
-		conf-ds {
-			pins = "EMMC_DSL";
-			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
-		};
-		conf-rst {
-			pins = "EMMC_RSTB";
-			drive-strength = <4>;
-			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
-		};
-	};
-
-	mmc0_pins_uhs: mmc0-uhs-pins {
-		mux {
-			function = "emmc";
-			groups = "emmc_51";
-		};
-		conf-cmd-dat {
-			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
-			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
-			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
-			input-enable;
-			drive-strength = <4>;
-			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
-		};
-		conf-clk {
-			pins = "EMMC_CK";
-			drive-strength = <6>;
-			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
-		};
-		conf-ds {
-			pins = "EMMC_DSL";
-			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
-		};
-		conf-rst {
-			pins = "EMMC_RSTB";
-			drive-strength = <4>;
-			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
-		};
-	};
-
-	pcie_pins: pcie-pins {
-		mux {
-			function = "pcie";
-			groups = "pcie_pereset";
-		};
-	};
-
-	wf_2g_5g_pins: wf_2g_5g-pins {
-		mux {
-			function = "wifi";
-			groups = "wf_2g", "wf_5g";
-		};
-		conf {
-			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
-			       "WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
-			       "WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
-			       "WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
-			       "WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
-			       "WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
-			       "WF1_TOP_CLK", "WF1_TOP_DATA";
-			drive-strength = <4>;
-		};
-	};
-
-	wf_dbdc_pins: wf-dbdc-pins {
-		mux {
-			function = "wifi";
-			groups = "wf_dbdc";
-		};
-		conf {
-			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
-				"WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
-				"WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
-				"WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
-				"WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
-				"WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
-				"WF1_TOP_CLK", "WF1_TOP_DATA";
-			drive-strength = <4>;
-		};
-	};
 };
 
-&switch {
-	ports {
-		#address-cells = <1>;
-		#size-cells = <0>;
-
-		port@0 {
-			reg = <0>;
-			label = "game";
-			phy-handle = <&swphy0>;
-		};
-
-		port@1 {
-			reg = <1>;
-			label = "lan1";
-			phy-handle = <&swphy1>;
-		};
-
-		port@2 {
-			reg = <2>;
-			label = "lan2";
-			phy-handle = <&swphy2>;
-		};
-
-		port@3 {
-			reg = <3>;
-			label = "lan3";
-			phy-handle = <&swphy3>;
-		};
-
-		port@6 {
-			reg = <6>;
-			label = "cpu";
-			ethernet = <&gmac0>;
-			phy-mode = "2500base-x";
-
-			fixed-link {
-				speed = <2500>;
-				full-duplex;
-				pause;
-			};
-		};
-	};
-
-	mdio {
-		#address-cells = <1>;
-		#size-cells = <0>;
-
-		swphy0: phy@0 {
-			reg = <0>;
-
-			mediatek,led-config = <
-				0x21 0x8009 /* BASIC_CTRL */
-				0x22 0x0c00 /* ON_DURATION */
-				0x23 0x1400 /* BLINK_DURATION */
-				0x24 0xc001 /* LED0_ON_CTRL */
-				0x25 0x0000 /* LED0_BLINK_CTRL */
-				0x26 0xc007 /* LED1_ON_CTRL */
-				0x27 0x003f /* LED1_BLINK_CTRL */
-			>;
-		};
-
-		swphy1: phy@1 {
-			reg = <1>;
-
-			mediatek,led-config = <
-				0x21 0x8009 /* BASIC_CTRL */
-				0x22 0x0c00 /* ON_DURATION */
-				0x23 0x1400 /* BLINK_DURATION */
-				0x24 0xc001 /* LED0_ON_CTRL */
-				0x25 0x0000 /* LED0_BLINK_CTRL */
-				0x26 0xc007 /* LED1_ON_CTRL */
-				0x27 0x003f /* LED1_BLINK_CTRL */
-			>;
-		};
-
-		swphy2: phy@2 {
-			reg = <2>;
-
-			mediatek,led-config = <
-				0x21 0x8009 /* BASIC_CTRL */
-				0x22 0x0c00 /* ON_DURATION */
-				0x23 0x1400 /* BLINK_DURATION */
-				0x24 0xc001 /* LED0_ON_CTRL */
-				0x25 0x0000 /* LED0_BLINK_CTRL */
-				0x26 0xc007 /* LED1_ON_CTRL */
-				0x27 0x003f /* LED1_BLINK_CTRL */
-			>;
-		};
-
-		swphy3: phy@3 {
-			reg = <3>;
-
-			mediatek,led-config = <
-				0x21 0x8009 /* BASIC_CTRL */
-				0x22 0x0c00 /* ON_DURATION */
-				0x23 0x1400 /* BLINK_DURATION */
-				0x24 0xc001 /* LED0_ON_CTRL */
-				0x25 0x0000 /* LED0_BLINK_CTRL */
-				0x26 0xc007 /* LED1_ON_CTRL */
-				0x27 0x003f /* LED1_BLINK_CTRL */
-			>;
-		};
-	};
-};
-
-&wifi {
-	nvmem-cells = <&eeprom_factory_0>;
-	nvmem-cell-names = "eeprom";
-	pinctrl-names = "default", "dbdc";
-	pinctrl-0 = <&wf_2g_5g_pins>;
-	pinctrl-1 = <&wf_dbdc_pins>;
-	status = "okay";
-};
-
-&trng {
-	status = "okay";
-};
-
-&watchdog {
-	status = "okay";
-};
-
-&crypto {
-	status = "okay";
-};
-
-&uart0 {
-	status = "okay";
-};
-
-&ssusb {
-	vusb33-supply = <&reg_3p3v>;
-	vbus-supply = <&reg_5v>;
-	status = "okay";
-};
-
-&usb_phy {
-	status = "okay";
-};
-
-&mmc0 {
-	status = "okay";
-	pinctrl-names = "default", "state_uhs";
-	pinctrl-0 = <&mmc0_pins_default>;
-	pinctrl-1 = <&mmc0_pins_uhs>;
-	bus-width = <0x08>;
-	max-frequency = <200000000>;
-	cap-mmc-highspeed;
-	mmc-hs200-1_8v;
-	mmc-hs400-1_8v;
-	hs400-ds-delay = <0x14014>;
-	vmmc-supply = <&reg_3p3v>;
-	vqmmc-supply = <&reg_1p8v>;
-	non-removable;
-	no-sd;
-	no-sdio;
-
-	card@0 {
-		compatible = "mmc-card";
-		reg = <0>;
-
-		block {
-			compatible = "block-device";
-
-			partitions {
-				block-partition-factory {
-					partname = "factory";
-
-					nvmem-layout {
-						compatible = "fixed-layout";
-						#address-cells = <1>;
-						#size-cells = <1>;
-
-						eeprom_factory_0: eeprom@0 {
-							reg = <0x0 0x1000>;
-						};
-
-						eeprom_factory_a0000: eeprom@a0000 {
-							reg = <0xa0000 0x1000>;
-						};
-					};
-				};
-			};
-		};
-	};
-};
-
-&pcie {
-	pinctrl-names = "default";
-	pinctrl-0 = <&pcie_pins>;
-	status = "okay";
-
-	slot0: pcie@0,0 {
-		reg = <0x0000 0 0 0 0>;
-
-		radio0: mt7915@0,0 {
-			reg = <0x0000 0 0 0 0>;
-
-			nvmem-cells = <&eeprom_factory_a0000>;
-			nvmem-cell-names = "eeprom";
-		};
-	};
-};
-
-&pcie_phy {
-	status = "okay";
+&swport0 {
+	label = "game";
 };
diff --git a/target/linux/mediatek/dts/mt7986a-acer-w6-common.dtsi b/target/linux/mediatek/dts/mt7986a-acer-w6-common.dtsi
new file mode 100644
index 00000000000000..cca03684fb6f79
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7986a-acer-w6-common.dtsi
@@ -0,0 +1,387 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+
+#include "mt7986a.dtsi"
+
+/ {
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs = "dm-mod.create=\"dm-verity,,,ro,0 31544 verity 1 PARTLABEL=rootfs PARTLABEL=rootfs 4096 4096 3943 3944 sha256 2f969fa9e9e4e20b37746f22633e85b178f5db7c143e11f92733a704299cc933 2dd56e34b15c6c84573cf26c4392028421061d2c808975217b45e9a5b49d2087\" rootfstype=squashfs,ext4 rootwait root=/dev/mmcblk0p6 fstools_ignore_partname=1";
+	};
+
+	memory@0 {
+		reg = <0 0x40000000 0 0x20000000>;
+	};
+
+	reg_1p8v: regulator-1p8v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-1.8V";
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <1800000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	reg_3p3v: regulator-3p3v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-3.3V";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	reg_5v: regulator-5v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-5V";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		factory {
+			label = "factory";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&pio {
+	mmc0_pins_default: mmc0-pins {
+		mux {
+			function = "emmc";
+			groups = "emmc_51";
+		};
+
+		conf-cmd-dat {
+			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
+			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
+			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
+			input-enable;
+			drive-strength = <4>;
+			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
+		};
+
+		conf-clk {
+			pins = "EMMC_CK";
+			drive-strength = <6>;
+			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
+		};
+
+		conf-ds {
+			pins = "EMMC_DSL";
+			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
+		};
+
+		conf-rst {
+			pins = "EMMC_RSTB";
+			drive-strength = <4>;
+			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
+		};
+	};
+
+	mmc0_pins_uhs: mmc0-uhs-pins {
+		mux {
+			function = "emmc";
+			groups = "emmc_51";
+		};
+
+		conf-cmd-dat {
+			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
+			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
+			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
+			input-enable;
+			drive-strength = <4>;
+			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
+		};
+
+		conf-clk {
+			pins = "EMMC_CK";
+			drive-strength = <6>;
+			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
+		};
+
+		conf-ds {
+			pins = "EMMC_DSL";
+			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
+		};
+
+		conf-rst {
+			pins = "EMMC_RSTB";
+			drive-strength = <4>;
+			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
+		};
+	};
+
+	pcie_pins: pcie-pins {
+		mux {
+			function = "pcie";
+			groups = "pcie_pereset";
+		};
+	};
+
+	wf_2g_5g_pins: wf_2g_5g-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_2g", "wf_5g";
+		};
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+			       "WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+			       "WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+			       "WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+			       "WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+			       "WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+			       "WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <4>;
+		};
+	};
+
+	wf_dbdc_pins: wf-dbdc-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_dbdc";
+		};
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+				"WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+				"WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+				"WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+				"WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+				"WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+				"WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <4>;
+		};
+	};
+};
+
+&trng {
+	status = "okay";
+};
+
+&crypto {
+	status = "okay";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&mmc0 {
+	status = "okay";
+	pinctrl-names = "default", "state_uhs";
+	pinctrl-0 = <&mmc0_pins_default>;
+	pinctrl-1 = <&mmc0_pins_uhs>;
+	bus-width = <0x08>;
+	max-frequency = <200000000>;
+	cap-mmc-highspeed;
+	mmc-hs200-1_8v;
+	mmc-hs400-1_8v;
+	hs400-ds-delay = <0x14014>;
+	vmmc-supply = <&reg_3p3v>;
+	vqmmc-supply = <&reg_1p8v>;
+	non-removable;
+	no-sd;
+	no-sdio;
+	#address-cells = <1>;
+	#size-cells = <0>;
+
+	card@0 {
+		compatible = "mmc-card";
+		reg = <0>;
+
+		block {
+			compatible = "block-device";
+
+			partitions {
+				block-partition-factory {
+					partname = "factory";
+
+					nvmem: nvmem-layout {
+						compatible = "fixed-layout";
+						#address-cells = <1>;
+						#size-cells = <1>;
+
+						eeprom_factory_0: eeprom@0 {
+							reg = <0x0 0x1000>;
+						};
+					};
+				};
+			};
+		};
+	};
+};
+
+&pcie {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie_pins>;
+	status = "okay";
+
+	slot0: pcie@0,0 {
+		reg = <0x0000 0 0 0 0>;
+		#address-cells = <0x03>; 
+		#size-cells = <0x02>;
+	};
+};
+
+&pcie_phy {
+	status = "okay";
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	mdio: mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		switch: switch@1f {
+			compatible = "mediatek,mt7531";
+			reg = <31>;
+			reset-gpios = <&pio 5 GPIO_ACTIVE_HIGH>;
+			reset-assert-us = <10000>;
+			reset-deassert-us = <10000>;
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				swport0: port@0 {
+					reg = <0>;
+					phy-handle = <&swphy0>;
+				};
+
+				port@1 {
+					reg = <1>;
+					label = "lan1";
+					phy-handle = <&swphy1>;
+				};
+
+				port@2 {
+					reg = <2>;
+					label = "lan2";
+					phy-handle = <&swphy2>;
+				};
+
+				port@3 {
+					reg = <3>;
+					label = "lan3";
+					phy-handle = <&swphy3>;
+				};
+
+				port@6 {
+					reg = <6>;
+					label = "cpu";
+					ethernet = <&gmac0>;
+					phy-mode = "2500base-x";
+
+					fixed-link {
+						speed = <2500>;
+						full-duplex;
+						pause;
+					};
+				};
+			};
+
+			mdio {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				swphy0: phy@0 {
+					reg = <0>;
+
+					mediatek,led-config = <
+						0x21 0x8009 /* BASIC_CTRL */
+						0x22 0x0c00 /* ON_DURATION */
+						0x23 0x1400 /* BLINK_DURATION */
+						0x24 0xc001 /* LED0_ON_CTRL */
+						0x25 0x0000 /* LED0_BLINK_CTRL */
+						0x26 0xc007 /* LED1_ON_CTRL */
+						0x27 0x003f /* LED1_BLINK_CTRL */
+					>;
+				};
+
+				swphy1: phy@1 {
+					reg = <1>;
+
+					mediatek,led-config = <
+						0x21 0x8009 /* BASIC_CTRL */
+						0x22 0x0c00 /* ON_DURATION */
+						0x23 0x1400 /* BLINK_DURATION */
+						0x24 0xc001 /* LED0_ON_CTRL */
+						0x25 0x0000 /* LED0_BLINK_CTRL */
+						0x26 0xc007 /* LED1_ON_CTRL */
+						0x27 0x003f /* LED1_BLINK_CTRL */
+					>;
+				};
+
+				swphy2: phy@2 {
+					reg = <2>;
+
+					mediatek,led-config = <
+						0x21 0x8009 /* BASIC_CTRL */
+						0x22 0x0c00 /* ON_DURATION */
+						0x23 0x1400 /* BLINK_DURATION */
+						0x24 0xc001 /* LED0_ON_CTRL */
+						0x25 0x0000 /* LED0_BLINK_CTRL */
+						0x26 0xc007 /* LED1_ON_CTRL */
+						0x27 0x003f /* LED1_BLINK_CTRL */
+					>;
+				};
+
+				swphy3: phy@3 {
+					reg = <3>;
+
+					mediatek,led-config = <
+						0x21 0x8009 /* BASIC_CTRL */
+						0x22 0x0c00 /* ON_DURATION */
+						0x23 0x1400 /* BLINK_DURATION */
+						0x24 0xc001 /* LED0_ON_CTRL */
+						0x25 0x0000 /* LED0_BLINK_CTRL */
+						0x26 0xc007 /* LED1_ON_CTRL */
+						0x27 0x003f /* LED1_BLINK_CTRL */
+					>;
+				};
+			};
+		};
+	};
+};
+
+&wifi {
+	nvmem-cells = <&eeprom_factory_0>;
+	nvmem-cell-names = "eeprom";
+	pinctrl-names = "default", "dbdc";
+	pinctrl-0 = <&wf_2g_5g_pins>;
+	pinctrl-1 = <&wf_dbdc_pins>;
+	status = "okay";
+};

From e7aaba2587e57dbd157899f7a2215ec6b7af5f89 Mon Sep 17 00:00:00 2001
From: George Oldfort <openwrt@10099.de>
Date: Mon, 11 Nov 2024 10:14:55 +0100
Subject: [PATCH 036/225] mediatek: make use of Acer Predator Connect W6's
 u-boot environment

In order to prepare OpenWrt support for other Acer W6 devices and to adapt
the procedure to read and set mac addresses which other devices of the same
target are using (instead of needing an additional script and creating an
additional structure in the file system), this commit
- reads device mac addresses from u-boot environment
- avoids the detour via the file system to set the mac addresses
- drops redundant file /lib/preinit/05_extract_factory_data.sh

The idea and the implementation were thankfully taken from PR #16410.

This is the second of four commits into which the original commit was split
to make reviews easier and more targeted.

Signed-off-by: George Oldfort <openwrt@10099.de>
Link: https://github.com/openwrt/openwrt/pull/16861
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 .../uboot-envtools/files/mediatek_filogic     | 15 +++++------
 .../filogic/base-files/etc/board.d/02_network |  4 +++
 .../etc/hotplug.d/ieee80211/11_fix_wifi_mac   |  7 +++---
 .../lib/preinit/05_extract_factory_data.sh    | 25 -------------------
 .../base-files/lib/preinit/10_fix_eth_mac.sh  | 13 +++++-----
 5 files changed, 22 insertions(+), 42 deletions(-)
 delete mode 100644 target/linux/mediatek/filogic/base-files/lib/preinit/05_extract_factory_data.sh

diff --git a/package/boot/uboot-envtools/files/mediatek_filogic b/package/boot/uboot-envtools/files/mediatek_filogic
index 9de1a4d75ddc96..7571af002094ea 100644
--- a/package/boot/uboot-envtools/files/mediatek_filogic
+++ b/package/boot/uboot-envtools/files/mediatek_filogic
@@ -49,6 +49,14 @@ xiaomi,redmi-router-ax6000-ubootmod|\
 zyxel,ex5601-t0-ubootmod)
 	ubootenv_add_ubi_default
 	;;
+acer,predator-w6|\
+glinet,gl-mt2500|\
+glinet,gl-mt6000|\
+glinet,gl-x3000|\
+glinet,gl-xe3000)
+	local envdev=$(find_mmc_part "u-boot-env")
+	ubootenv_add_uci_config "$envdev" "0x0" "0x80000"
+	;;
 asus,rt-ax59u)
 	ubootenv_add_uci_config "/dev/mtd0" "0x100000" "0x20000" "0x20000"
 	;;
@@ -89,13 +97,6 @@ dlink,aquila-pro-ai-m30-a1)
 gatonetworks,gdsp)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x10000" "0x10000"
 	;;
-glinet,gl-x3000|\
-glinet,gl-xe3000|\
-glinet,gl-mt2500|\
-glinet,gl-mt6000)
-	local envdev=$(find_mmc_part "u-boot-env")
-	ubootenv_add_uci_config "$envdev" "0x0" "0x80000"
-	;;
 glinet,gl-mt3000)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x80000" "0x20000"
 	;;
diff --git a/target/linux/mediatek/filogic/base-files/etc/board.d/02_network b/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
index fff39006da82bc..2bcead83045912 100644
--- a/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
+++ b/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
@@ -132,6 +132,10 @@ mediatek_setup_macs()
 	local label_mac=""
 
 	case $board in
+	acer,predator-w6)
+		wan_mac=$(mmc_get_mac_ascii u-boot-env WANMAC)
+		lan_mac=$(mmc_get_mac_ascii u-boot-env LANMAC)
+		;;
 	bananapi,bpi-r3|\
 	bananapi,bpi-r3-mini|\
 	bananapi,bpi-r4)
diff --git a/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac b/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
index 3042858353a7cf..f7f00c9a83bd71 100644
--- a/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
+++ b/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
@@ -18,10 +18,9 @@ case "$board" in
 		[ "$PHYNBR" = "1" ] && macaddr_setbit_la $addr > /sys${DEVPATH}/macaddress
 		;;
 	acer,predator-w6)
-		key_path="/var/qcidata/data"
-		[ "$PHYNBR" = "0" ] && cat $key_path/2gMAC > /sys${DEVPATH}/macaddress
-		[ "$PHYNBR" = "1" ] && cat $key_path/6gMAC > /sys${DEVPATH}/macaddress
-		[ "$PHYNBR" = "2" ] && cat $key_path/5gMAC > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "0" ] && mmc_get_mac_ascii u-boot-env 2gMAC > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && mmc_get_mac_ascii u-boot-env 6gMAC > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "2" ] && mmc_get_mac_ascii u-boot-env 5gMAC > /sys${DEVPATH}/macaddress
 		;;
 	asus,rt-ax59u)
 		CI_UBIPART="UBI_DEV"
diff --git a/target/linux/mediatek/filogic/base-files/lib/preinit/05_extract_factory_data.sh b/target/linux/mediatek/filogic/base-files/lib/preinit/05_extract_factory_data.sh
deleted file mode 100644
index 87287a7d1c1c98..00000000000000
--- a/target/linux/mediatek/filogic/base-files/lib/preinit/05_extract_factory_data.sh
+++ /dev/null
@@ -1,25 +0,0 @@
-. /lib/functions/system.sh
-
-predator_w6_factory_extract() {
-	local mmc_part
-
-	mmc_part="$(find_mmc_part qcidata)"
-
-	mkdir -p /var/qcidata/data
-	mkdir -p /var/qcidata/mount
-
-	mount -r "$mmc_part" /var/qcidata/mount
-
-	cp /var/qcidata/mount/factory/*MAC "/var/qcidata/data/"
-	umount "/var/qcidata/mount"
-}
-
-preinit_extract_factory() {
-	case $(board_name) in
-	acer,predator-w6)
-		predator_w6_factory_extract
-		;;
-	esac
-}
-
-boot_hook_add preinit_main preinit_extract_factory
diff --git a/target/linux/mediatek/filogic/base-files/lib/preinit/10_fix_eth_mac.sh b/target/linux/mediatek/filogic/base-files/lib/preinit/10_fix_eth_mac.sh
index 0497d7dfa2474f..0d7da89ceaabf5 100644
--- a/target/linux/mediatek/filogic/base-files/lib/preinit/10_fix_eth_mac.sh
+++ b/target/linux/mediatek/filogic/base-files/lib/preinit/10_fix_eth_mac.sh
@@ -3,12 +3,13 @@
 preinit_set_mac_address() {
 	case $(board_name) in
 	acer,predator-w6)
-		key_path="/var/qcidata/data"
-		ip link set dev lan1 address "$(cat $key_path/LANMAC)"
-		ip link set dev lan2 address "$(cat $key_path/LANMAC)"
-		ip link set dev lan3 address "$(cat $key_path/LANMAC)"
-		ip link set dev game address "$(cat $key_path/LANMAC)"
-		ip link set dev eth1 address "$(cat $key_path/WANMAC)"
+		$(mmc_get_mac_ascii u-boot-env WANMAC)
+		$(mmc_get_mac_ascii u-boot-env LANMAC)
+		ip link set dev lan1 address "$lan_mac"
+		ip link set dev lan2 address "$lan_mac"
+		ip link set dev lan3 address "$lan_mac"
+		ip link set dev game address "$lan_mac"
+		ip link set dev eth1 address "$wan_mac"
 		;;
 	asus,tuf-ax4200|\
 	asus,tuf-ax6000)

From d42075dcefa407a03a30663879688475bb912729 Mon Sep 17 00:00:00 2001
From: George Oldfort <openwrt@10099.de>
Date: Mon, 11 Nov 2024 10:40:45 +0100
Subject: [PATCH 037/225] mediatek: improve device tree for Acer Predator
 Connect W6
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In order to prepare for OpenWrt support other Acer W6 devices and to get
a step further to full hardware support for Acer Predator Connect W6, this
commit
- adjusts the product name ("Acer Predator Connect W6")
- updates gpio LED labels to function/color scheme
- show router status by using first rgb led instead of it's red color only
  (blue: booting/failsafe mode; red: sysupgrade; green: running – was: red)
- changes switch/eth1 led configuration to reflect RX/TX activity and speed
  (green: full 1Gbps/2.5Gbps speed; amber: lower speed; blink: RX/TX)
- shortens dummy dm-mod.create string in bootargs
- enables W6's i2c interface

This is the third of four commits into which the original commit was split
to make reviews easier and more targeted.

Signed-off-by: George Oldfort <openwrt@10099.de>
Link: https://github.com/openwrt/openwrt/pull/16861
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 .../mediatek/dts/mt7986a-acer-predator-w6.dts | 90 +++++++++++++------
 .../mediatek/dts/mt7986a-acer-w6-common.dtsi  | 47 ++++++----
 target/linux/mediatek/image/filogic.mk        |  2 +-
 3 files changed, 94 insertions(+), 45 deletions(-)

diff --git a/target/linux/mediatek/dts/mt7986a-acer-predator-w6.dts b/target/linux/mediatek/dts/mt7986a-acer-predator-w6.dts
index 8c86fd31d85459..5002326d70fbce 100644
--- a/target/linux/mediatek/dts/mt7986a-acer-predator-w6.dts
+++ b/target/linux/mediatek/dts/mt7986a-acer-predator-w6.dts
@@ -4,107 +4,143 @@
 #include "mt7986a-acer-w6-common.dtsi"
 
 / {
-	model = "Acer Predator W6";
+	model = "Acer Predator Connect W6";
 	compatible = "acer,predator-w6", "mediatek,mt7986a";
 
 	aliases {
 		serial0 = &uart0;
-		led-boot = &led_status;
-		led-failsafe = &led_status;
-		led-running = &led_status;
-		led-upgrade = &led_status;
+		led-boot = &led_status_blue;
+		led-failsafe = &led_status_blue;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_red;
 	};
 
 	leds {
 		compatible = "gpio-leds";
 
-		led_status: led-0 {
-			label = "ant0:red";
+		led_status_red: led-0 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <0>;
 			gpios = <&pio 1 GPIO_ACTIVE_HIGH>;
 		};
 
-		led-1 {
-			label = "ant0:green";
+		led_status_green: led-1 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <0>;
 			gpios = <&pio 2 GPIO_ACTIVE_HIGH>;
 		};
 
-		led-2 {
-			label = "ant0:blue";
+		led_status_blue: led-2 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <0>;
 			gpios = <&pio 36 GPIO_ACTIVE_HIGH>;
 		};
 
 		led-3 {
-			label = "ant1:red";
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <1>;
 			gpios = <&pio 35 GPIO_ACTIVE_HIGH>;
 		};
 
 		led-4 {
-			label = "ant1:green";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <1>;
 			gpios = <&pio 34 GPIO_ACTIVE_HIGH>;
 		};
 
 		led-5 {
-			label = "ant1:blue";
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <1>;
 			gpios = <&pio 33 GPIO_ACTIVE_HIGH>;
 		};
 
 		led-6 {
-			label = "ant2:red";
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <2>;
 			gpios = <&pio 38 GPIO_ACTIVE_HIGH>;
 		};
 
 		led-7 {
-			label = "ant2:green";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <2>;
 			gpios = <&pio 37 GPIO_ACTIVE_HIGH>;
 		};
 
 		led-8 {
-			label = "ant2:blue";
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <2>;
 			gpios = <&pio 26 GPIO_ACTIVE_HIGH>;
 		};
 
 		led-9 {
-			label = "ant3:red";
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <3>;
 			gpios = <&pio 25 GPIO_ACTIVE_HIGH>;
 		};
 
 		led-10 {
-			label = "ant3:green";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <3>;
 			gpios = <&pio 24 GPIO_ACTIVE_HIGH>;
 		};
 
 		led-11 {
-			label = "ant3:blue";
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <3>;
 			gpios = <&pio 23 GPIO_ACTIVE_HIGH>;
 		};
 
 		led-12 {
-			label = "ant4:red";
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <4>;
 			gpios = <&pio 28 GPIO_ACTIVE_HIGH>;
 		};
 
 		led-13 {
-			label = "ant4:green";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <4>;
 			gpios = <&pio 27 GPIO_ACTIVE_HIGH>;
 		};
 
 		led-14 {
-			label = "ant4:blue";
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <4>;
 			gpios = <&pio 32 GPIO_ACTIVE_HIGH>;
 		};
 
 		led-15 {
-			label = "ant5:red";
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <5>;
 			gpios = <&pio 45 GPIO_ACTIVE_HIGH>;
 		};
 
 		led-16 {
-			label = "ant5:green";
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <5>;
 			gpios = <&pio 44 GPIO_ACTIVE_HIGH>;
 		};
 
 		led-17 {
-			label = "ant5:blue";
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <5>;
 			gpios = <&pio 43 GPIO_ACTIVE_HIGH>;
 		};
 	};
@@ -151,7 +187,7 @@
 		reset-assert-us = <10000>;
 		reset-deassert-us = <10000>;
 		/* LED0: nc ; LED1: nc ; LED2: amber ; LED3: green */
-		mxl,led-config = <0x0 0x0 0x370 0x80>;
+		mxl,led-config = <0x0 0x0 0x370 0x380>;
 	};
 };
 
diff --git a/target/linux/mediatek/dts/mt7986a-acer-w6-common.dtsi b/target/linux/mediatek/dts/mt7986a-acer-w6-common.dtsi
index cca03684fb6f79..03913f04e101cd 100644
--- a/target/linux/mediatek/dts/mt7986a-acer-w6-common.dtsi
+++ b/target/linux/mediatek/dts/mt7986a-acer-w6-common.dtsi
@@ -9,7 +9,7 @@
 / {
 	chosen {
 		stdout-path = "serial0:115200n8";
-		bootargs = "dm-mod.create=\"dm-verity,,,ro,0 31544 verity 1 PARTLABEL=rootfs PARTLABEL=rootfs 4096 4096 3943 3944 sha256 2f969fa9e9e4e20b37746f22633e85b178f5db7c143e11f92733a704299cc933 2dd56e34b15c6c84573cf26c4392028421061d2c808975217b45e9a5b49d2087\" rootfstype=squashfs,ext4 rootwait root=/dev/mmcblk0p6 fstools_ignore_partname=1";
+		bootargs = "dm-mod.create=\"acer,,,ro,0 1 zero 1 0 0 0\" rootfstype=squashfs,ext4 rootwait root=/dev/mmcblk0p6 fstools_ignore_partname=1";
 	};
 
 	memory@0 {
@@ -171,6 +171,13 @@
 			drive-strength = <4>;
 		};
 	};
+
+	i2c_pins: i2c-pins {
+		mux {
+			function = "i2c";
+			groups = "i2c";
+		};
+	};
 };
 
 &trng {
@@ -185,6 +192,12 @@
 	status = "okay";
 };
 
+&i2c0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c_pins>;
+	status = "okay";
+};
+
 &mmc0 {
 	status = "okay";
 	pinctrl-names = "default", "state_uhs";
@@ -321,13 +334,13 @@
 					reg = <0>;
 
 					mediatek,led-config = <
-						0x21 0x8009 /* BASIC_CTRL */
+						0x21 0x8008 /* BASIC_CTRL */
 						0x22 0x0c00 /* ON_DURATION */
 						0x23 0x1400 /* BLINK_DURATION */
 						0x24 0xc001 /* LED0_ON_CTRL */
-						0x25 0x0000 /* LED0_BLINK_CTRL */
-						0x26 0xc007 /* LED1_ON_CTRL */
-						0x27 0x003f /* LED1_BLINK_CTRL */
+						0x25 0x0003 /* LED0_BLINK_CTRL */
+						0x26 0xc006 /* LED1_ON_CTRL */
+						0x27 0x003c /* LED1_BLINK_CTRL */
 					>;
 				};
 
@@ -335,13 +348,13 @@
 					reg = <1>;
 
 					mediatek,led-config = <
-						0x21 0x8009 /* BASIC_CTRL */
+						0x21 0x8008 /* BASIC_CTRL */
 						0x22 0x0c00 /* ON_DURATION */
 						0x23 0x1400 /* BLINK_DURATION */
 						0x24 0xc001 /* LED0_ON_CTRL */
-						0x25 0x0000 /* LED0_BLINK_CTRL */
-						0x26 0xc007 /* LED1_ON_CTRL */
-						0x27 0x003f /* LED1_BLINK_CTRL */
+						0x25 0x0003 /* LED0_BLINK_CTRL */
+						0x26 0xc006 /* LED1_ON_CTRL */
+						0x27 0x003c /* LED1_BLINK_CTRL */
 					>;
 				};
 
@@ -349,13 +362,13 @@
 					reg = <2>;
 
 					mediatek,led-config = <
-						0x21 0x8009 /* BASIC_CTRL */
+						0x21 0x8008 /* BASIC_CTRL */
 						0x22 0x0c00 /* ON_DURATION */
 						0x23 0x1400 /* BLINK_DURATION */
 						0x24 0xc001 /* LED0_ON_CTRL */
-						0x25 0x0000 /* LED0_BLINK_CTRL */
-						0x26 0xc007 /* LED1_ON_CTRL */
-						0x27 0x003f /* LED1_BLINK_CTRL */
+						0x25 0x0003 /* LED0_BLINK_CTRL */
+						0x26 0xc006 /* LED1_ON_CTRL */
+						0x27 0x003c /* LED1_BLINK_CTRL */
 					>;
 				};
 
@@ -363,13 +376,13 @@
 					reg = <3>;
 
 					mediatek,led-config = <
-						0x21 0x8009 /* BASIC_CTRL */
+						0x21 0x8008 /* BASIC_CTRL */
 						0x22 0x0c00 /* ON_DURATION */
 						0x23 0x1400 /* BLINK_DURATION */
 						0x24 0xc001 /* LED0_ON_CTRL */
-						0x25 0x0000 /* LED0_BLINK_CTRL */
-						0x26 0xc007 /* LED1_ON_CTRL */
-						0x27 0x003f /* LED1_BLINK_CTRL */
+						0x25 0x0003 /* LED0_BLINK_CTRL */
+						0x26 0xc006 /* LED1_ON_CTRL */
+						0x27 0x003c /* LED1_BLINK_CTRL */
 					>;
 				};
 			};
diff --git a/target/linux/mediatek/image/filogic.mk b/target/linux/mediatek/image/filogic.mk
index cb5c102b1e2b64..838a433bf4a5ac 100644
--- a/target/linux/mediatek/image/filogic.mk
+++ b/target/linux/mediatek/image/filogic.mk
@@ -152,7 +152,7 @@ TARGET_DEVICES += acelink_ew-7886cax
 
 define Device/acer_predator-w6
   DEVICE_VENDOR := Acer
-  DEVICE_MODEL := Predator W6
+  DEVICE_MODEL := Predator Connect W6
   DEVICE_DTS := mt7986a-acer-predator-w6
   DEVICE_DTS_DIR := ../dts
   DEVICE_DTS_LOADADDR := 0x47000000

From 2898d1d1269a841e5bb8673801bd2a04ad120031 Mon Sep 17 00:00:00 2001
From: George Oldfort <openwrt@10099.de>
Date: Mon, 11 Nov 2024 11:18:19 +0100
Subject: [PATCH 038/225] mediatek: add support for Acer Predator W6d and Acer
 Vero W6m

This commit adds support for two variants of the already supported router
Acer Predator Connect W6: The Acer Predator Connect W6d (W6 without 6 GHz
wifi) and the Acer Connect Vero W6m (W6 without 2.5G eth1 port, usb3 port,
and the 6 on-board gpio RGB LEDs, and with a KTD2026 RGB LED controller
instead of the KTD2061 LED controller of the W6/W6d).

The device tree for the W6m refers to the KTD202x driver suggested in
PR #16860.

Patching target/linux/mediatek/filogic/base-files/lib/upgrade/platform.sh
removes the code repetition in (old) lines 121 to 124 on the occasion.

This is the last of four commits into which the original commit was split
to make reviews easier and more targeted.

Signed-off-by: George Oldfort <openwrt@10099.de>
Link: https://github.com/openwrt/openwrt/pull/16861
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 .../uboot-envtools/files/mediatek_filogic     |   2 +
 .../dts/mt7986a-acer-predator-w6d.dts         | 182 ++++++++++++++++++
 .../mediatek/dts/mt7986a-acer-vero-w6m.dts    |  66 +++++++
 .../filogic/base-files/etc/board.d/02_network |  10 +-
 .../etc/hotplug.d/ieee80211/11_fix_wifi_mac   |   7 +-
 .../base-files/lib/preinit/10_fix_eth_mac.sh  |  11 +-
 .../base-files/lib/upgrade/platform.sh        |  16 +-
 target/linux/mediatek/image/filogic.mk        |  30 +++
 8 files changed, 312 insertions(+), 12 deletions(-)
 create mode 100644 target/linux/mediatek/dts/mt7986a-acer-predator-w6d.dts
 create mode 100644 target/linux/mediatek/dts/mt7986a-acer-vero-w6m.dts

diff --git a/package/boot/uboot-envtools/files/mediatek_filogic b/package/boot/uboot-envtools/files/mediatek_filogic
index 7571af002094ea..b637f4328778a1 100644
--- a/package/boot/uboot-envtools/files/mediatek_filogic
+++ b/package/boot/uboot-envtools/files/mediatek_filogic
@@ -50,6 +50,8 @@ zyxel,ex5601-t0-ubootmod)
 	ubootenv_add_ubi_default
 	;;
 acer,predator-w6|\
+acer,predator-w6d|\
+acer,vero-w6m|\
 glinet,gl-mt2500|\
 glinet,gl-mt6000|\
 glinet,gl-x3000|\
diff --git a/target/linux/mediatek/dts/mt7986a-acer-predator-w6d.dts b/target/linux/mediatek/dts/mt7986a-acer-predator-w6d.dts
new file mode 100644
index 00000000000000..b2c35a61974921
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7986a-acer-predator-w6d.dts
@@ -0,0 +1,182 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+#include "mt7986a-acer-w6-common.dtsi"
+
+/ {
+	model = "Acer Predator Connect W6d";
+	compatible = "acer,predator-w6d", "mediatek,mt7986a";
+
+	aliases {
+		serial0 = &uart0;
+		led-boot = &led_status_blue;
+		led-failsafe = &led_status_blue;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_red;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_red: led-0 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <0>;
+			gpios = <&pio 1 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_green: led-1 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <0>;
+			gpios = <&pio 2 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_blue: led-2 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <0>;
+			gpios = <&pio 36 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-3 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <1>;
+			gpios = <&pio 35 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-4 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <1>;
+			gpios = <&pio 34 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-5 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <1>;
+			gpios = <&pio 33 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-6 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <2>;
+			gpios = <&pio 38 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-7 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <2>;
+			gpios = <&pio 37 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-8 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <2>;
+			gpios = <&pio 26 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-9 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <3>;
+			gpios = <&pio 25 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-10 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <3>;
+			gpios = <&pio 24 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-11 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <3>;
+			gpios = <&pio 23 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-12 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <4>;
+			gpios = <&pio 28 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-13 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <4>;
+			gpios = <&pio 27 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-14 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <4>;
+			gpios = <&pio 32 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-15 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <5>;
+			gpios = <&pio 45 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-16 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <5>;
+			gpios = <&pio 44 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-17 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <5>;
+			gpios = <&pio 43 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&ssusb {
+	vusb33-supply = <&reg_3p3v>;
+	vbus-supply = <&reg_5v>;
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&eth {
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "2500base-x";
+		phy-handle = <&phy6>;
+	};
+};
+
+&mdio {
+	phy6: phy@6 {
+		compatible = "ethernet-phy-ieee802.3-c45";
+		reg = <6>;
+		reset-gpios = <&pio 6 GPIO_ACTIVE_LOW>;
+		reset-assert-us = <10000>;
+		reset-deassert-us = <10000>;
+		/* LED0: nc ; LED1: nc ; LED2: amber ; LED3: green */
+		mxl,led-config = <0x0 0x0 0x370 0x380>;
+	};
+};
+
+&swport0 {
+	label = "game";
+};
diff --git a/target/linux/mediatek/dts/mt7986a-acer-vero-w6m.dts b/target/linux/mediatek/dts/mt7986a-acer-vero-w6m.dts
new file mode 100644
index 00000000000000..7927efcb003cae
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7986a-acer-vero-w6m.dts
@@ -0,0 +1,66 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+#include "mt7986a-acer-w6-common.dtsi"
+
+/ {
+	model = "Acer Connect Vero W6m";
+	compatible = "acer,vero-w6m", "mediatek,mt7986a";
+
+	aliases {
+		serial0 = &uart0;
+		led-boot = &led_status;
+		led-failsafe = &led_status;
+		led-running = &led_status;
+		led-upgrade = &led_status;
+	};
+};
+
+&i2c0 {
+	led-controller@30 {
+		compatible = "kinetic,ktd2026";
+		reg = <0x30>;
+		vin-supply = <&reg_5v>;
+		vio-supply = <&reg_3p3v>;
+
+		led_status: multi-led {
+			color = <LED_COLOR_ID_RGB>;
+			function = LED_FUNCTION_STATUS;
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			led@0 {
+				reg = <0>;
+				color = <LED_COLOR_ID_RED>;
+			};
+
+			led@1 {
+				reg = <1>;
+				color = <LED_COLOR_ID_GREEN>;
+			};
+
+			led@2 {
+				reg = <2>;
+				color = <LED_COLOR_ID_BLUE>;
+			};
+		};
+	};
+};
+
+&nvmem {
+	eeprom_factory_a0000: eeprom@a0000 {
+		reg = <0xa0000 0x1000>;
+	};
+};
+
+&slot0 {
+	radio0: mt7915@0,0 {
+		reg = <0x0000 0 0 0 0>;
+		nvmem-cells = <&eeprom_factory_a0000>;
+		nvmem-cell-names = "eeprom";
+	};
+};
+
+&swport0 {
+       label = "internet";
+};
diff --git a/target/linux/mediatek/filogic/base-files/etc/board.d/02_network b/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
index 2bcead83045912..7bfc61a26902a2 100644
--- a/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
+++ b/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
@@ -18,9 +18,13 @@ mediatek_setup_interfaces()
 	acelink,ew-7886cax)
 		ucidef_set_interface_lan "eth0" "dhcp"
 		;;
-	acer,predator-w6)
+	acer,predator-w6|\
+	acer,predator-w6d)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 game" eth1
 		;;
+	acer,vero-w6m)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3" internet
+		;;
 	arcadyan,mozart)
 		ucidef_set_interfaces_lan_wan "lan0 eth1" eth2
 		;;
@@ -132,7 +136,9 @@ mediatek_setup_macs()
 	local label_mac=""
 
 	case $board in
-	acer,predator-w6)
+	acer,predator-w6|\
+	acer,predator-w6d|\
+	acer,vero-w6m)
 		wan_mac=$(mmc_get_mac_ascii u-boot-env WANMAC)
 		lan_mac=$(mmc_get_mac_ascii u-boot-env LANMAC)
 		;;
diff --git a/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac b/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
index f7f00c9a83bd71..f87cc0646edbb2 100644
--- a/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
+++ b/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
@@ -17,11 +17,16 @@ case "$board" in
 		[ "$PHYNBR" = "0" ] && macaddr_add $addr 1 > /sys${DEVPATH}/macaddress
 		[ "$PHYNBR" = "1" ] && macaddr_setbit_la $addr > /sys${DEVPATH}/macaddress
 		;;
-	acer,predator-w6)
+	acer,predator-w6|\
+	acer,vero-w6m)
 		[ "$PHYNBR" = "0" ] && mmc_get_mac_ascii u-boot-env 2gMAC > /sys${DEVPATH}/macaddress
 		[ "$PHYNBR" = "1" ] && mmc_get_mac_ascii u-boot-env 6gMAC > /sys${DEVPATH}/macaddress
 		[ "$PHYNBR" = "2" ] && mmc_get_mac_ascii u-boot-env 5gMAC > /sys${DEVPATH}/macaddress
 		;;
+	acer,predator-w6d)
+		[ "$PHYNBR" = "0" ] && mmc_get_mac_ascii u-boot-env 2gMAC > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && mmc_get_mac_ascii u-boot-env 5gMAC > /sys${DEVPATH}/macaddress
+		;;
 	asus,rt-ax59u)
 		CI_UBIPART="UBI_DEV"
 		addr=$(mtd_get_mac_binary_ubi "Factory" 0x4)
diff --git a/target/linux/mediatek/filogic/base-files/lib/preinit/10_fix_eth_mac.sh b/target/linux/mediatek/filogic/base-files/lib/preinit/10_fix_eth_mac.sh
index 0d7da89ceaabf5..9d279898ac58cd 100644
--- a/target/linux/mediatek/filogic/base-files/lib/preinit/10_fix_eth_mac.sh
+++ b/target/linux/mediatek/filogic/base-files/lib/preinit/10_fix_eth_mac.sh
@@ -2,7 +2,8 @@
 
 preinit_set_mac_address() {
 	case $(board_name) in
-	acer,predator-w6)
+	acer,predator-w6|\
+	acer,predator-w6d)
 		$(mmc_get_mac_ascii u-boot-env WANMAC)
 		$(mmc_get_mac_ascii u-boot-env LANMAC)
 		ip link set dev lan1 address "$lan_mac"
@@ -11,6 +12,14 @@ preinit_set_mac_address() {
 		ip link set dev game address "$lan_mac"
 		ip link set dev eth1 address "$wan_mac"
 		;;
+	acer,vero-w6m)
+		wan_mac=$(mmc_get_mac_ascii u-boot-env WANMAC)
+		lan_mac=$(mmc_get_mac_ascii u-boot-env LANMAC)
+		ip link set dev lan1 address "$lan_mac"
+		ip link set dev lan2 address "$lan_mac"
+		ip link set dev lan3 address "$lan_mac"
+		ip link set dev internet address "$wan_mac"
+		;;
 	asus,tuf-ax4200|\
 	asus,tuf-ax6000)
 		CI_UBIPART="UBI_DEV"
diff --git a/target/linux/mediatek/filogic/base-files/lib/upgrade/platform.sh b/target/linux/mediatek/filogic/base-files/lib/upgrade/platform.sh
index cfd77b62d7affb..ce334b2c8eecbb 100755
--- a/target/linux/mediatek/filogic/base-files/lib/upgrade/platform.sh
+++ b/target/linux/mediatek/filogic/base-files/lib/upgrade/platform.sh
@@ -91,7 +91,13 @@ platform_do_upgrade() {
 		fit_do_upgrade "$1"
 		;;
 	acer,predator-w6|\
+	acer,predator-w6d|\
+	acer,vero-w6m|\
 	arcadyan,mozart|\
+	glinet,gl-mt2500|\
+	glinet,gl-mt6000|\
+	glinet,gl-x3000|\
+	glinet,gl-xe3000|\
 	smartrg,sdg-8612|\
 	smartrg,sdg-8614|\
 	smartrg,sdg-8622|\
@@ -115,14 +121,6 @@ platform_do_upgrade() {
 	yuncore,ax835)
 		default_do_upgrade "$1"
 		;;
-	glinet,gl-mt2500|\
-	glinet,gl-mt6000|\
-	glinet,gl-x3000|\
-	glinet,gl-xe3000)
-		CI_KERNPART="kernel"
-		CI_ROOTPART="rootfs"
-		emmc_do_upgrade "$1"
-		;;
 	mercusys,mr90x-v1|\
 	tplink,re6000xd)
 		CI_UBIPART="ubi0"
@@ -204,6 +202,8 @@ platform_copy_config() {
 		fi
 		;;
 	acer,predator-w6|\
+	acer,predator-w6d|\
+	acer,vero-w6m|\
 	arcadyan,mozart|\
 	glinet,gl-mt2500|\
 	glinet,gl-mt6000|\
diff --git a/target/linux/mediatek/image/filogic.mk b/target/linux/mediatek/image/filogic.mk
index 838a433bf4a5ac..072cae0d1f47ed 100644
--- a/target/linux/mediatek/image/filogic.mk
+++ b/target/linux/mediatek/image/filogic.mk
@@ -165,6 +165,36 @@ define Device/acer_predator-w6
 endef
 TARGET_DEVICES += acer_predator-w6
 
+define Device/acer_predator-w6d
+  DEVICE_VENDOR := Acer
+  DEVICE_MODEL := Predator Connect W6d
+  DEVICE_DTS := mt7986a-acer-predator-w6d
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_DTS_LOADADDR := 0x47000000
+  DEVICE_PACKAGES := kmod-usb3 kmod-mt7915e kmod-mt7916-firmware kmod-mt7986-firmware mt7986-wo-firmware e2fsprogs f2fsck mkf2fs
+  IMAGES := sysupgrade.bin
+  KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += acer_predator-w6d
+
+define Device/acer_vero-w6m
+  DEVICE_VENDOR := Acer
+  DEVICE_MODEL := Connect Vero W6m
+  DEVICE_DTS := mt7986a-acer-vero-w6m
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_DTS_LOADADDR := 0x47000000
+  DEVICE_PACKAGES := kmod-leds-ktd202x kmod-mt7915e kmod-mt7916-firmware kmod-mt7986-firmware mt7986-wo-firmware e2fsprogs f2fsck mkf2fs
+  IMAGES := sysupgrade.bin
+  KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += acer_vero-w6m
+
 define Device/adtran_smartrg
   DEVICE_VENDOR := Adtran
   DEVICE_DTS_DIR := ../dts

From b8b658bc0d22df31e7ac2d07cdd2af7155d12630 Mon Sep 17 00:00:00 2001
From: David Bauer <mail@david-bauer.net>
Date: Sat, 23 Nov 2024 20:00:57 +0100
Subject: [PATCH 039/225] mediatek: fix Cudy AP3000 Outdoor label-mac

The label-mac does not match the one assigned to the ethernet interface.
Use the mac-address assigned to the wifi interface instead, as it
matches the one found on the device label.

Signed-off-by: David Bauer <mail@david-bauer.net>
---
 target/linux/mediatek/dts/mt7981b-cudy-ap3000outdoor-v1.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/linux/mediatek/dts/mt7981b-cudy-ap3000outdoor-v1.dts b/target/linux/mediatek/dts/mt7981b-cudy-ap3000outdoor-v1.dts
index 62e406394755ac..a1eb9c6e1e981a 100644
--- a/target/linux/mediatek/dts/mt7981b-cudy-ap3000outdoor-v1.dts
+++ b/target/linux/mediatek/dts/mt7981b-cudy-ap3000outdoor-v1.dts
@@ -11,7 +11,7 @@
 	compatible = "cudy,ap3000outdoor-v1", "mediatek,mt7981-spim-snand-rfb";
 
 	aliases {
-		label-mac-device = &gmac1;
+		label-mac-device = &wifi;
 		led-boot = &led_status_green;
 		led-failsafe = &led_status_red;
 		led-running = &led_status_green;

From faf4b3e0f7a583a8fa1a65b302ac74457e48575f Mon Sep 17 00:00:00 2001
From: David Ignjic <ignjic@gmail.com>
Date: Wed, 13 Nov 2024 11:20:27 +0100
Subject: [PATCH 040/225] mediatek: filogic: add support for Cudy WR3000S v1

Hardware
--------
MediaTek MT7981 WiSoC
256MB DDR3 RAM
128MB SPI-NAND (XMC XM25QH128C)
MediaTek MT7981 2x2 DBDC 802.11ax 2T2R (2.4 / 5)
UART: 115200 8N1 3.3V

MAC:
LAN MAC: label mac
WAN MAC: label mac + 1
2.4G MAC: label mac
5G MAC: label mac + 1 with LA bit set

Installation
------------

1. Connect to the serial port as described in the "Hardware" section.

2. Power on the device + press reset pin. Keep pressing reset pin to enter the U-Boot  shell.

3. Download the OpenWrt initramfs image. Place it on an TFTP server
   connected to the Cudy LAN ports. Make sure the server is reachable at
   192.168.1.88. Rename the image to "cudy3000s.bin"

4. Download and boot the OpenWrt initramfs image.

   $ tftpboot 0x46000000 cudy3000s.bin; bootm 0x46000000

5. Transfer the OpenWrt sysupgrade image to the device using scp.
   Install with sysupgrade.

Signed-off-by: David Ignjic <ignjic@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16939
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 .../mediatek/dts/mt7981b-cudy-wr3000s-v1.dts  | 283 ++++++++++++++++++
 .../etc/hotplug.d/ieee80211/11_fix_wifi_mac   |   1 +
 target/linux/mediatek/image/filogic.mk        |  17 ++
 3 files changed, 301 insertions(+)
 create mode 100644 target/linux/mediatek/dts/mt7981b-cudy-wr3000s-v1.dts

diff --git a/target/linux/mediatek/dts/mt7981b-cudy-wr3000s-v1.dts b/target/linux/mediatek/dts/mt7981b-cudy-wr3000s-v1.dts
new file mode 100644
index 00000000000000..a6439694943352
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-cudy-wr3000s-v1.dts
@@ -0,0 +1,283 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+
+/dts-v1/;
+
+#include <dt-bindings/leds/common.h>
+
+#include "mt7981.dtsi"
+
+/ {
+	model = "Cudy WR3000S v1";
+	compatible = "cudy,wr3000s-v1", "mediatek,mt7981-spim-snand-rfb";
+
+	aliases {
+		label-mac-device = &gmac0;
+		led-boot = &led_status;
+		led-failsafe = &led_status;
+		led-running = &led_status;
+		led-upgrade = &led_status;
+		serial0 = &uart0;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status: led@0 {
+			function = LED_FUNCTION_STATUS;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+		};
+
+
+		led_internet {
+			function = LED_FUNCTION_WAN_ONLINE;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		led_wps {
+			function = LED_FUNCTION_WPS;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+
+		led_wlan2g {
+			function = LED_FUNCTION_WLAN_2GHZ;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 6 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		led_wlan5g {
+			function = LED_FUNCTION_WLAN_5GHZ;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 7 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&eth {
+	pinctrl-names = "default";
+	pinctrl-0 = <&mdio_pins>;
+
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_bdinfo_de00 0>;
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+};
+
+&mdio_bus {
+	switch: switch@1f {
+		compatible = "mediatek,mt7531";
+		reg = <31>;
+		reset-gpios = <&pio 39 GPIO_ACTIVE_HIGH>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		interrupt-parent = <&pio>;
+		interrupts = <38 IRQ_TYPE_LEVEL_HIGH>;
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	status = "okay";
+
+	spi_nand: flash@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "spi-nand";
+		reg = <0>;
+		spi-max-frequency = <52000000>;
+
+		spi-cal-enable;
+		spi-cal-mode = "read-data";
+		spi-cal-datalen = <7>;
+		spi-cal-data = /bits/ 8 <0x53 0x50 0x49 0x4E 0x41 0x4E 0x44>;
+		spi-cal-addrlen = <5>;
+		spi-cal-addr = /bits/ 32 <0x0 0x0 0x0 0x0 0x0>;
+
+		spi-tx-bus-width = <4>;
+		spi-rx-bus-width = <4>;
+		mediatek,nmbm;
+		mediatek,bmt-max-ratio = <1>;
+		mediatek,bmt-max-reserved-blocks = <64>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "BL2";
+				reg = <0x00000 0x0100000>;
+				read-only;
+			};
+
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x0100000 0x0080000>;
+				read-only;
+			};
+
+			factory: partition@180000 {
+				label = "Factory";
+				reg = <0x180000 0x0200000>;
+				read-only;
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					eeprom_factory_0: eeprom@0 {
+						reg = <0x0 0x1000>;
+					};
+				};
+			};
+
+			partition@380000 {
+				label = "bdinfo";
+				reg = <0x380000 0x0040000>;
+				read-only;
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					macaddr_bdinfo_de00: macaddr@de00 {
+						compatible = "mac-base";
+						reg = <0xde00 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+				};
+			};
+
+			partition@3C0000 {
+				label = "FIP";
+				reg = <0x3C0000 0x0200000>;
+				read-only;
+			};
+
+			partition@580000 {
+				label = "ubi";
+				reg = <0x5C0000 0x4000000>;
+				compatible = "linux,ubi";
+			};
+		};
+	};
+};
+
+&pio {
+	spi0_flash_pins: spi0-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
+		};
+	};
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			label = "wan";
+
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_bdinfo_de00 1>;
+		};
+
+		port@1 {
+			reg = <1>;
+			label = "lan1";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan2";
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan3";
+		};
+
+		port@4 {
+			reg = <4>;
+			label = "lan4";
+		};
+
+		port@6 {
+			reg = <6>;
+			label = "cpu";
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
+&wifi {
+	status = "okay";
+	nvmem-cells = <&eeprom_factory_0>;
+	nvmem-cell-names = "eeprom";
+};
diff --git a/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac b/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
index f87cc0646edbb2..7402bfc71babb8 100644
--- a/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
+++ b/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
@@ -81,6 +81,7 @@ case "$board" in
 		;;
 	cudy,ap3000outdoor-v1|\
 	cudy,m3000-v1|\
+	cudy,wr3000s-v1|\
 	cudy,wr3000-v1)
 		addr=$(mtd_get_mac_binary bdinfo 0xde00)
 		# Originally, phy0 is phy1 mac with LA bit set. However, this would conflict
diff --git a/target/linux/mediatek/image/filogic.mk b/target/linux/mediatek/image/filogic.mk
index 072cae0d1f47ed..f366a9b9202a7c 100644
--- a/target/linux/mediatek/image/filogic.mk
+++ b/target/linux/mediatek/image/filogic.mk
@@ -667,6 +667,23 @@ define Device/cudy_wr3000-v1
 endef
 TARGET_DEVICES += cudy_wr3000-v1
 
+define Device/cudy_wr3000s-v1
+  DEVICE_VENDOR := Cudy
+  DEVICE_MODEL := WR3000S
+  DEVICE_VARIANT := v1
+  DEVICE_DTS := mt7981b-cudy-wr3000s-v1
+  DEVICE_DTS_DIR := ../dts
+  SUPPORTED_DEVICES += R59
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 65536k
+  KERNEL_IN_UBI := 1
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+endef
+TARGET_DEVICES += cudy_wr3000s-v1
+
 define Device/dlink_aquila-pro-ai-m30-a1
   DEVICE_VENDOR := D-Link
   DEVICE_MODEL := AQUILA PRO AI M30

From a48ec449ccab0069e84a72837bf06ba543e53aec Mon Sep 17 00:00:00 2001
From: Robert Marko <robimarko@gmail.com>
Date: Sat, 23 Nov 2024 14:29:49 +0100
Subject: [PATCH 041/225] config: rename SECCOMP to USE_SECCOMP

It seems that we have some kind of a symbol name conflict which causes
CONFIG_SECCOMP to always be read as y.

Unfortunatelly, I could not figure out what is causing this, but simply
renaming SECCOMP to USE_SECCOMP seems to properly work and leaves the
symbol unset unless arch dependencies are satisfied.

This fixes qoriq and others that dont support seccomp from failing due
to procd-seccomp package being selected to get included but it cannot be
built for them:
ERROR: unable to select packages:
  procd-seccomp (no such package):
    required by: base-files-1637~52b6c92479[procd-seccomp]

Fixes: 4c65359af49b ("build: fix including busybox, procd and apk/opkg in imagebuilder")
Link: https://github.com/openwrt/openwrt/pull/17048
Signed-off-by: Robert Marko <robimarko@gmail.com>
---
 config/Config-build.in        | 2 +-
 include/toplevel.mk           | 2 +-
 package/base-files/Makefile   | 2 +-
 package/system/procd/Makefile | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/config/Config-build.in b/config/Config-build.in
index 6db2354e88c54f..2a95891ecf5542 100644
--- a/config/Config-build.in
+++ b/config/Config-build.in
@@ -423,7 +423,7 @@ menu "Global build settings"
 
 	endchoice
 
-	config SECCOMP
+	config USE_SECCOMP
 		bool "Enable SECCOMP"
 		select KERNEL_SECCOMP
 		select PACKAGE_procd-seccomp
diff --git a/include/toplevel.mk b/include/toplevel.mk
index e5f5e0fecd8de4..a52c56832eca03 100644
--- a/include/toplevel.mk
+++ b/include/toplevel.mk
@@ -78,7 +78,7 @@ _ignore = $(foreach p,$(IGNORE_PACKAGES),--ignore $(p))
 # Config that will invalidate the .targetinfo as they will affect
 # DEFAULT_PACKAGES.
 # Keep DYNAMIC_DEF_PKG_CONF in sync with target.mk to reflect the same configs
-DYNAMIC_DEF_PKG_CONF := CONFIG_USE_APK CONFIG_SELINUX CONFIG_SMALL_FLASH CONFIG_SECCOMP
+DYNAMIC_DEF_PKG_CONF := CONFIG_USE_APK CONFIG_SELINUX CONFIG_SMALL_FLASH CONFIG_USE_SECCOMP
 check-dynamic-def-pkg: FORCE
 	@+DEF_PKG_CONFS=""; \
 	if [ -f $(TOPDIR)/.config ]; then \
diff --git a/package/base-files/Makefile b/package/base-files/Makefile
index a2ea3c5d00847e..ff7891f18cb0c7 100644
--- a/package/base-files/Makefile
+++ b/package/base-files/Makefile
@@ -42,7 +42,7 @@ define Package/base-files
   DEPENDS:= \
 	+netifd +libc +jsonfilter +SIGNED_PACKAGES:usign +SIGNED_PACKAGES:openwrt-keyring \
 	+NAND_SUPPORT:ubi-utils +fstools +fwtool \
-	+SELINUX:procd-selinux +!SELINUX:procd +SECCOMP:procd-seccomp \
+	+SELINUX:procd-selinux +!SELINUX:procd +USE_SECCOMP:procd-seccomp \
 	+SELINUX:busybox-selinux +!SELINUX:busybox +!SMALL_FLASH:procd-ujail
   TITLE:=Base filesystem for OpenWrt
   URL:=http://openwrt.org/
diff --git a/package/system/procd/Makefile b/package/system/procd/Makefile
index 81e133f55bc482..b9099a5ba52433 100644
--- a/package/system/procd/Makefile
+++ b/package/system/procd/Makefile
@@ -71,7 +71,7 @@ endef
 define Package/procd-seccomp
   SECTION:=base
   CATEGORY:=Base system
-  DEPENDS:=@SECCOMP +libubox +libblobmsg-json
+  DEPENDS:=@USE_SECCOMP +libubox +libblobmsg-json
   TITLE:=OpenWrt process seccomp helper + utrace
 endef
 

From a4bd42b79015af251694a84bc2bbb7d42b34f47b Mon Sep 17 00:00:00 2001
From: Robert Marko <robimarko@gmail.com>
Date: Sat, 23 Nov 2024 14:46:29 +0100
Subject: [PATCH 042/225] config: dont select procd-seccomp via USE_SECCOMP

base-files is including procd-secccomp as a dependency when USE_SECCOMP
is selected, so there is no point in selecting the package directly here
as well.

Link: https://github.com/openwrt/openwrt/pull/17048
Signed-off-by: Robert Marko <robimarko@gmail.com>
---
 config/Config-build.in | 1 -
 1 file changed, 1 deletion(-)

diff --git a/config/Config-build.in b/config/Config-build.in
index 2a95891ecf5542..c8739afa8770c5 100644
--- a/config/Config-build.in
+++ b/config/Config-build.in
@@ -426,7 +426,6 @@ menu "Global build settings"
 	config USE_SECCOMP
 		bool "Enable SECCOMP"
 		select KERNEL_SECCOMP
-		select PACKAGE_procd-seccomp
 		depends on (aarch64 || arm || armeb || mips || mipsel || mips64 || mips64el || i386 || powerpc || x86_64)
 		depends on !TARGET_uml
 		default y

From ed523454454965da07c9c7a009ae0a3995aa7c33 Mon Sep 17 00:00:00 2001
From: Hauke Mehrtens <hauke@hauke-m.de>
Date: Sun, 24 Nov 2024 14:39:57 +0100
Subject: [PATCH 043/225] x86: Deactivate kernel options with extra overhead

Deactivate CONFIG_CONTEXT_TRACKING_USER_FORCE: Force user context
tracking: This is a testing feature which should not be activate in
production environments according to the Kconfig help. It adds an extra
overhead.

Deactivate CONFIG_RCU_NOCB_CPU_DEFAULT_ALL: Offload RCU callback
processing from all CPUs by default: This option should only be used in
aggressive HPC or real-time workloads which we do not have in OpenWrt.
For normal workloads it increases the number of context switches.

In the default Arch Linux kernel both options are not activated.

Fixes: 31111680f6fc ("x86: switch config to a tickless kernel")
Link: https://github.com/openwrt/openwrt/pull/17057
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 target/linux/x86/config-6.6 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/linux/x86/config-6.6 b/target/linux/x86/config-6.6
index b3d15bc1047494..c416bb6a08dd7b 100644
--- a/target/linux/x86/config-6.6
+++ b/target/linux/x86/config-6.6
@@ -46,7 +46,7 @@ CONFIG_COMPAT_32=y
 CONFIG_COMPAT_32BIT_TIME=y
 # CONFIG_COMPAT_VDSO is not set
 CONFIG_CONSOLE_TRANSLATIONS=y
-CONFIG_CONTEXT_TRACKING_USER_FORCE=y
+# CONFIG_CONTEXT_TRACKING_USER_FORCE is not set
 # CONFIG_CPU5_WDT is not set
 CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
@@ -334,7 +334,7 @@ CONFIG_PTP_1588_CLOCK_OPTIONAL=y
 CONFIG_RANDSTRUCT_NONE=y
 CONFIG_RATIONAL=y
 CONFIG_RCU_LAZY=y
-CONFIG_RCU_NOCB_CPU_DEFAULT_ALL=y
+# CONFIG_RCU_NOCB_CPU_DEFAULT_ALL is not set
 CONFIG_RD_BZIP2=y
 CONFIG_RD_GZIP=y
 CONFIG_RETHUNK=y

From a9d3c5b4c9bf910d4b3b42109161b1f6526b76eb Mon Sep 17 00:00:00 2001
From: Hauke Mehrtens <hauke@hauke-m.de>
Date: Sat, 23 Nov 2024 22:32:03 +0100
Subject: [PATCH 044/225] dropbear: bump to 2024.86

- update dropbear to latest stable 2024.86;
  for the changes see https://matt.ucc.asn.au/dropbear/CHANGES

Link: https://github.com/openwrt/openwrt/pull/17053
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 package/network/services/dropbear/Makefile                  | 6 +++---
 .../network/services/dropbear/patches/110-change_user.patch | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package/network/services/dropbear/Makefile b/package/network/services/dropbear/Makefile
index 1918e7dec6d6ce..e13b6c2145b716 100644
--- a/package/network/services/dropbear/Makefile
+++ b/package/network/services/dropbear/Makefile
@@ -8,14 +8,14 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dropbear
-PKG_VERSION:=2024.85
-PKG_RELEASE:=2
+PKG_VERSION:=2024.86
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:= \
 	https://matt.ucc.asn.au/dropbear/releases/ \
 	https://dropbear.nl/mirror/releases/
-PKG_HASH:=86b036c433a69d89ce51ebae335d65c47738ccf90d13e5eb0fea832e556da502
+PKG_HASH:=e78936dffc395f2e0db099321d6be659190966b99712b55c530dd0a1822e0a5e
 
 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE libtomcrypt/LICENSE libtommath/LICENSE
diff --git a/package/network/services/dropbear/patches/110-change_user.patch b/package/network/services/dropbear/patches/110-change_user.patch
index 9cb073cf940d46..9ef8f0cfbc4981 100644
--- a/package/network/services/dropbear/patches/110-change_user.patch
+++ b/package/network/services/dropbear/patches/110-change_user.patch
@@ -1,6 +1,6 @@
 --- a/src/svr-chansession.c
 +++ b/src/svr-chansession.c
-@@ -987,12 +987,12 @@ static void execchild(const void *user_d
+@@ -984,12 +984,12 @@ static void execchild(const void *user_d
  	/* We can only change uid/gid as root ... */
  	if (getuid() == 0) {
  

From eb7aa07a0e23e931579de07e0dbdec735b8e35b2 Mon Sep 17 00:00:00 2001
From: Hauke Mehrtens <hauke@hauke-m.de>
Date: Sun, 24 Nov 2024 14:52:22 +0100
Subject: [PATCH 045/225] CI: labeler: Add stm32 target

Add a label for changes in the stm32 target.

Fixes: 851e7f77e424 ("stm32: add new stm32 target")
Link: https://github.com/openwrt/openwrt/pull/17058
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 .github/labeler.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/labeler.yml b/.github/labeler.yml
index ede4bb5a02fce7..129357df2bf3bc 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -180,6 +180,13 @@
 - changed-files:
   - any-glob-to-any-file:
     - "target/linux/starfive/**"
+"target/stm32":
+- changed-files:
+  - any-glob-to-any-file:
+    - "target/linux/stm32/**"
+    - "package/boot/arm-trusted-firmware-stm32/**"
+    - "package/boot/optee-os-stm32/**"
+    - "package/boot/uboot-stm32/**"
 "target/sunxi":
 - changed-files:
   - any-glob-to-any-file:

From ea2c860225b8bbda98ed0526dc670825866835b6 Mon Sep 17 00:00:00 2001
From: Hauke Mehrtens <hauke@hauke-m.de>
Date: Sun, 24 Nov 2024 14:53:47 +0100
Subject: [PATCH 046/225] stm32: Remove unnecessary kernel options

These options are filtered out since some weeks, remove them also from
the new stm32 target.

Fixes: 851e7f77e424 ("stm32: add new stm32 target")
Link: https://github.com/openwrt/openwrt/pull/17058
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 target/linux/stm32/stm32mp1/config-6.6 | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/target/linux/stm32/stm32mp1/config-6.6 b/target/linux/stm32/stm32mp1/config-6.6
index 946649ef9b9e94..e19abcc7dcc4be 100644
--- a/target/linux/stm32/stm32mp1/config-6.6
+++ b/target/linux/stm32/stm32mp1/config-6.6
@@ -70,8 +70,6 @@ CONFIG_BOUNCE=y
 CONFIG_BUFFER_HEAD=y
 # CONFIG_CACHE_L2X0 is not set
 CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CHR_DEV_SG=y
 CONFIG_CLKSRC_MMIO=y
 CONFIG_CLKSRC_STM32=y
@@ -189,7 +187,6 @@ CONFIG_FUNCTION_ALIGNMENT=0
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_CACHE=y
 # CONFIG_FW_LOADER_USER_HELPER is not set
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ARCH_TOPOLOGY=y
 CONFIG_GENERIC_BUG=y

From b7dd70a0d708b7f8fe9f5c95d09013245e3dcb6b Mon Sep 17 00:00:00 2001
From: Hauke Mehrtens <hauke@hauke-m.de>
Date: Sun, 24 Nov 2024 14:57:19 +0100
Subject: [PATCH 047/225] kernel: usb: kmod-usb-audio: Fix dependency

Change the dependency on the kmod-media-controller from depends to
select.

Fixes: 109592524663 ("kernel: add kmod-media-controller dependency for kmod-usb-audio")
Link: https://github.com/openwrt/openwrt/pull/17058
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 package/kernel/linux/modules/usb.mk | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package/kernel/linux/modules/usb.mk b/package/kernel/linux/modules/usb.mk
index 466c547e8ab2dd..734df050cd6cdc 100644
--- a/package/kernel/linux/modules/usb.mk
+++ b/package/kernel/linux/modules/usb.mk
@@ -576,7 +576,7 @@ define KernelPackage/usb-audio
 	CONFIG_SND_USB_AUDIO
   $(call AddDepends/usb)
   $(call AddDepends/sound)
-  DEPENDS+=kmod-media-controller
+  DEPENDS+=+kmod-media-controller
   FILES:= \
 	$(LINUX_DIR)/sound/usb/snd-usbmidi-lib.ko \
 	$(LINUX_DIR)/sound/usb/snd-usb-audio.ko

From 0c57510cedeff9caf795930ff86a436aa54bcc6d Mon Sep 17 00:00:00 2001
From: Shiji Yang <yangshiji66@qq.com>
Date: Sun, 3 Nov 2024 12:30:21 +0800
Subject: [PATCH 048/225] ramips: mt76x8: disable unused Ralink systick driver

The mt76x8 series SoCs use the MIPS generic systick timer. Sync the
upstream Ralink systick driver changes and disable it for mt76x8
target to reduce the kernel size.

Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Link: https://github.com/openwrt/openwrt/pull/16844
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 target/linux/ramips/mt7620/config-6.6         |   2 +-
 target/linux/ramips/mt76x8/config-6.6         |   6 +-
 ...ers-ralink-Add-Ralink-System-Tick-Co.patch | 384 ++++++++++++++++++
 ...e-to-enable-disable-the-cevt-r4k-irq.patch |  36 +-
 ...IPS-ralink-add-cpu-frequency-scaling.patch |  35 +-
 ...-select-illegal-access-driver-by-def.patch |   4 +-
 target/linux/ramips/rt305x/config-6.6         |   2 +-
 7 files changed, 426 insertions(+), 43 deletions(-)
 create mode 100644 target/linux/ramips/patches-6.6/001-v6.13-clocksource-drivers-ralink-Add-Ralink-System-Tick-Co.patch

diff --git a/target/linux/ramips/mt7620/config-6.6 b/target/linux/ramips/mt7620/config-6.6
index edd64a642cdd6f..3e1ef761e029b9 100644
--- a/target/linux/ramips/mt7620/config-6.6
+++ b/target/linux/ramips/mt7620/config-6.6
@@ -8,7 +8,6 @@ CONFIG_ARCH_SUSPEND_POSSIBLE=y
 CONFIG_BLK_MQ_PCI=y
 CONFIG_CEVT_R4K=y
 CONFIG_CEVT_SYSTICK_QUIRK=y
-CONFIG_CLKEVT_RT3352=y
 CONFIG_CLKSRC_MMIO=y
 CONFIG_CLK_MTMIPS=y
 CONFIG_CLONE_BACKWARDS=y
@@ -180,6 +179,7 @@ CONFIG_PINCTRL_MTK_MTMIPS=y
 CONFIG_PREEMPT_NONE_BUILD=y
 CONFIG_PTP_1588_CLOCK_OPTIONAL=y
 CONFIG_RALINK=y
+CONFIG_RALINK_TIMER=y
 CONFIG_RALINK_WDT=y
 CONFIG_RANDSTRUCT_NONE=y
 CONFIG_RATIONAL=y
diff --git a/target/linux/ramips/mt76x8/config-6.6 b/target/linux/ramips/mt76x8/config-6.6
index 31dc4a980f948e..f40d18efcce523 100644
--- a/target/linux/ramips/mt76x8/config-6.6
+++ b/target/linux/ramips/mt76x8/config-6.6
@@ -6,9 +6,6 @@ CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
 CONFIG_ARCH_SUSPEND_POSSIBLE=y
 CONFIG_BLK_MQ_PCI=y
 CONFIG_CEVT_R4K=y
-CONFIG_CEVT_SYSTICK_QUIRK=y
-CONFIG_CLKEVT_RT3352=y
-CONFIG_CLKSRC_MMIO=y
 CONFIG_CLK_MTMIPS=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_CMDLINE="rootfstype=squashfs,jffs2"
@@ -173,6 +170,7 @@ CONFIG_PINCTRL_MTK_MTMIPS=y
 CONFIG_PREEMPT_NONE_BUILD=y
 CONFIG_PTP_1588_CLOCK_OPTIONAL=y
 CONFIG_RALINK=y
+# CONFIG_RALINK_TIMER is not set
 # CONFIG_RALINK_WDT is not set
 CONFIG_RANDSTRUCT_NONE=y
 CONFIG_RATIONAL=y
@@ -215,8 +213,6 @@ CONFIG_SYS_SUPPORTS_MIPS16=y
 CONFIG_SYS_SUPPORTS_ZBOOT=y
 CONFIG_TARGET_ISA_REV=2
 CONFIG_TICK_CPU_ACCOUNTING=y
-CONFIG_TIMER_OF=y
-CONFIG_TIMER_PROBE=y
 CONFIG_TINY_SRCU=y
 CONFIG_USB_SUPPORT=y
 CONFIG_USE_OF=y
diff --git a/target/linux/ramips/patches-6.6/001-v6.13-clocksource-drivers-ralink-Add-Ralink-System-Tick-Co.patch b/target/linux/ramips/patches-6.6/001-v6.13-clocksource-drivers-ralink-Add-Ralink-System-Tick-Co.patch
new file mode 100644
index 00000000000000..cd2a90826c767d
--- /dev/null
+++ b/target/linux/ramips/patches-6.6/001-v6.13-clocksource-drivers-ralink-Add-Ralink-System-Tick-Co.patch
@@ -0,0 +1,384 @@
+From 57cbfd333c9d65bfab1a06b49c75536ee28dc2ce Mon Sep 17 00:00:00 2001
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Date: Mon, 28 Oct 2024 21:36:43 +0100
+Subject: clocksource/drivers/ralink: Add Ralink System Tick Counter driver
+
+System Tick Counter is present on Ralink SoCs RT3352 and MT7620. This
+driver has been in 'arch/mips/ralink' directory since the beggining of
+Ralink architecture support. However, it can be moved into a more proper
+place in 'drivers/clocksource'. Hence add it here adding also support for
+compile test targets and reducing LOC in architecture code folder.
+
+Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Link: https://lore.kernel.org/r/20241028203643.191268-2-sergio.paracuellos@gmail.com
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+---
+ arch/mips/ralink/Kconfig           |   7 --
+ arch/mips/ralink/Makefile          |   2 -
+ arch/mips/ralink/cevt-rt3352.c     | 153 -------------------------------------
+ drivers/clocksource/Kconfig        |   9 +++
+ drivers/clocksource/Makefile       |   1 +
+ drivers/clocksource/timer-ralink.c | 150 ++++++++++++++++++++++++++++++++++++
+ 6 files changed, 160 insertions(+), 162 deletions(-)
+ delete mode 100644 arch/mips/ralink/cevt-rt3352.c
+ create mode 100644 drivers/clocksource/timer-ralink.c
+
+--- a/arch/mips/ralink/Kconfig
++++ b/arch/mips/ralink/Kconfig
+@@ -1,13 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ if RALINK
+ 
+-config CLKEVT_RT3352
+-	bool
+-	depends on SOC_RT305X || SOC_MT7620
+-	default y
+-	select TIMER_OF
+-	select CLKSRC_MMIO
+-
+ config RALINK_ILL_ACC
+ 	bool
+ 	depends on SOC_RT305X
+--- a/arch/mips/ralink/Makefile
++++ b/arch/mips/ralink/Makefile
+@@ -10,8 +10,6 @@ ifndef CONFIG_MIPS_GIC
+ 	obj-y += clk.o timer.o
+ endif
+ 
+-obj-$(CONFIG_CLKEVT_RT3352) += cevt-rt3352.o
+-
+ obj-$(CONFIG_RALINK_ILL_ACC) += ill_acc.o
+ 
+ obj-$(CONFIG_IRQ_INTC) += irq.o
+--- a/arch/mips/ralink/cevt-rt3352.c
++++ /dev/null
+@@ -1,153 +0,0 @@
+-/*
+- * This file is subject to the terms and conditions of the GNU General Public
+- * License.  See the file "COPYING" in the main directory of this archive
+- * for more details.
+- *
+- * Copyright (C) 2013 by John Crispin <john@phrozen.org>
+- */
+-
+-#include <linux/clockchips.h>
+-#include <linux/clocksource.h>
+-#include <linux/interrupt.h>
+-#include <linux/reset.h>
+-#include <linux/init.h>
+-#include <linux/time.h>
+-#include <linux/of.h>
+-#include <linux/of_irq.h>
+-#include <linux/of_address.h>
+-
+-#include <asm/mach-ralink/ralink_regs.h>
+-
+-#define SYSTICK_FREQ		(50 * 1000)
+-
+-#define SYSTICK_CONFIG		0x00
+-#define SYSTICK_COMPARE		0x04
+-#define SYSTICK_COUNT		0x08
+-
+-/* route systick irq to mips irq 7 instead of the r4k-timer */
+-#define CFG_EXT_STK_EN		0x2
+-/* enable the counter */
+-#define CFG_CNT_EN		0x1
+-
+-struct systick_device {
+-	void __iomem *membase;
+-	struct clock_event_device dev;
+-	int irq_requested;
+-	int freq_scale;
+-};
+-
+-static int systick_set_oneshot(struct clock_event_device *evt);
+-static int systick_shutdown(struct clock_event_device *evt);
+-
+-static int systick_next_event(unsigned long delta,
+-				struct clock_event_device *evt)
+-{
+-	struct systick_device *sdev;
+-	u32 count;
+-
+-	sdev = container_of(evt, struct systick_device, dev);
+-	count = ioread32(sdev->membase + SYSTICK_COUNT);
+-	count = (count + delta) % SYSTICK_FREQ;
+-	iowrite32(count, sdev->membase + SYSTICK_COMPARE);
+-
+-	return 0;
+-}
+-
+-static void systick_event_handler(struct clock_event_device *dev)
+-{
+-	/* noting to do here */
+-}
+-
+-static irqreturn_t systick_interrupt(int irq, void *dev_id)
+-{
+-	struct clock_event_device *dev = (struct clock_event_device *) dev_id;
+-
+-	dev->event_handler(dev);
+-
+-	return IRQ_HANDLED;
+-}
+-
+-static struct systick_device systick = {
+-	.dev = {
+-		/*
+-		 * cevt-r4k uses 300, make sure systick
+-		 * gets used if available
+-		 */
+-		.rating			= 310,
+-		.features		= CLOCK_EVT_FEAT_ONESHOT,
+-		.set_next_event		= systick_next_event,
+-		.set_state_shutdown	= systick_shutdown,
+-		.set_state_oneshot	= systick_set_oneshot,
+-		.event_handler		= systick_event_handler,
+-	},
+-};
+-
+-static int systick_shutdown(struct clock_event_device *evt)
+-{
+-	struct systick_device *sdev;
+-
+-	sdev = container_of(evt, struct systick_device, dev);
+-
+-	if (sdev->irq_requested)
+-		free_irq(systick.dev.irq, &systick.dev);
+-	sdev->irq_requested = 0;
+-	iowrite32(0, systick.membase + SYSTICK_CONFIG);
+-
+-	return 0;
+-}
+-
+-static int systick_set_oneshot(struct clock_event_device *evt)
+-{
+-	const char *name = systick.dev.name;
+-	struct systick_device *sdev;
+-	int irq = systick.dev.irq;
+-
+-	sdev = container_of(evt, struct systick_device, dev);
+-
+-	if (!sdev->irq_requested) {
+-		if (request_irq(irq, systick_interrupt,
+-				IRQF_PERCPU | IRQF_TIMER, name, &systick.dev))
+-			pr_err("Failed to request irq %d (%s)\n", irq, name);
+-	}
+-	sdev->irq_requested = 1;
+-	iowrite32(CFG_EXT_STK_EN | CFG_CNT_EN,
+-		  systick.membase + SYSTICK_CONFIG);
+-
+-	return 0;
+-}
+-
+-static int __init ralink_systick_init(struct device_node *np)
+-{
+-	int ret;
+-
+-	systick.membase = of_iomap(np, 0);
+-	if (!systick.membase)
+-		return -ENXIO;
+-
+-	systick.dev.name = np->name;
+-	clockevents_calc_mult_shift(&systick.dev, SYSTICK_FREQ, 60);
+-	systick.dev.max_delta_ns = clockevent_delta2ns(0x7fff, &systick.dev);
+-	systick.dev.max_delta_ticks = 0x7fff;
+-	systick.dev.min_delta_ns = clockevent_delta2ns(0x3, &systick.dev);
+-	systick.dev.min_delta_ticks = 0x3;
+-	systick.dev.irq = irq_of_parse_and_map(np, 0);
+-	if (!systick.dev.irq) {
+-		pr_err("%pOFn: request_irq failed", np);
+-		return -EINVAL;
+-	}
+-
+-	ret = clocksource_mmio_init(systick.membase + SYSTICK_COUNT, np->name,
+-				    SYSTICK_FREQ, 301, 16,
+-				    clocksource_mmio_readl_up);
+-	if (ret)
+-		return ret;
+-
+-	clockevents_register_device(&systick.dev);
+-
+-	pr_info("%pOFn: running - mult: %d, shift: %d\n",
+-			np, systick.dev.mult, systick.dev.shift);
+-
+-	return 0;
+-}
+-
+-TIMER_OF_DECLARE(systick, "ralink,cevt-systick", ralink_systick_init);
+--- a/drivers/clocksource/Kconfig
++++ b/drivers/clocksource/Kconfig
+@@ -732,4 +732,13 @@ config GOLDFISH_TIMER
+ 	help
+ 	  Support for the timer/counter of goldfish-rtc
+ 
++config RALINK_TIMER
++	bool "Ralink System Tick Counter"
++	depends on SOC_RT305X || SOC_MT7620 || COMPILE_TEST
++	select CLKSRC_MMIO
++	select TIMER_OF
++	help
++	  Enables support for system tick counter present on
++	  Ralink SoCs RT3352 and MT7620.
++
+ endmenu
+--- a/drivers/clocksource/Makefile
++++ b/drivers/clocksource/Makefile
+@@ -89,3 +89,4 @@ obj-$(CONFIG_MSC313E_TIMER)		+= timer-ms
+ obj-$(CONFIG_GOLDFISH_TIMER)		+= timer-goldfish.o
+ obj-$(CONFIG_GXP_TIMER)			+= timer-gxp.o
+ obj-$(CONFIG_CLKSRC_LOONGSON1_PWM)	+= timer-loongson1-pwm.o
++obj-$(CONFIG_RALINK_TIMER)		+= timer-ralink.o
+--- /dev/null
++++ b/drivers/clocksource/timer-ralink.c
+@@ -0,0 +1,150 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Ralink System Tick Counter driver present on RT3352 and MT7620 SoCs.
++ *
++ * Copyright (C) 2013 by John Crispin <john@phrozen.org>
++ */
++
++#include <linux/clockchips.h>
++#include <linux/clocksource.h>
++#include <linux/interrupt.h>
++#include <linux/reset.h>
++#include <linux/init.h>
++#include <linux/time.h>
++#include <linux/of.h>
++#include <linux/of_irq.h>
++#include <linux/of_address.h>
++
++#define SYSTICK_FREQ		(50 * 1000)
++
++#define SYSTICK_CONFIG		0x00
++#define SYSTICK_COMPARE		0x04
++#define SYSTICK_COUNT		0x08
++
++/* route systick irq to mips irq 7 instead of the r4k-timer */
++#define CFG_EXT_STK_EN		0x2
++/* enable the counter */
++#define CFG_CNT_EN		0x1
++
++struct systick_device {
++	void __iomem *membase;
++	struct clock_event_device dev;
++	int irq_requested;
++	int freq_scale;
++};
++
++static int systick_set_oneshot(struct clock_event_device *evt);
++static int systick_shutdown(struct clock_event_device *evt);
++
++static int systick_next_event(unsigned long delta,
++			      struct clock_event_device *evt)
++{
++	struct systick_device *sdev;
++	u32 count;
++
++	sdev = container_of(evt, struct systick_device, dev);
++	count = ioread32(sdev->membase + SYSTICK_COUNT);
++	count = (count + delta) % SYSTICK_FREQ;
++	iowrite32(count, sdev->membase + SYSTICK_COMPARE);
++
++	return 0;
++}
++
++static void systick_event_handler(struct clock_event_device *dev)
++{
++	/* noting to do here */
++}
++
++static irqreturn_t systick_interrupt(int irq, void *dev_id)
++{
++	struct clock_event_device *dev = (struct clock_event_device *)dev_id;
++
++	dev->event_handler(dev);
++
++	return IRQ_HANDLED;
++}
++
++static struct systick_device systick = {
++	.dev = {
++		/*
++		 * cevt-r4k uses 300, make sure systick
++		 * gets used if available
++		 */
++		.rating			= 310,
++		.features		= CLOCK_EVT_FEAT_ONESHOT,
++		.set_next_event		= systick_next_event,
++		.set_state_shutdown	= systick_shutdown,
++		.set_state_oneshot	= systick_set_oneshot,
++		.event_handler		= systick_event_handler,
++	},
++};
++
++static int systick_shutdown(struct clock_event_device *evt)
++{
++	struct systick_device *sdev;
++
++	sdev = container_of(evt, struct systick_device, dev);
++
++	if (sdev->irq_requested)
++		free_irq(systick.dev.irq, &systick.dev);
++	sdev->irq_requested = 0;
++	iowrite32(0, systick.membase + SYSTICK_CONFIG);
++
++	return 0;
++}
++
++static int systick_set_oneshot(struct clock_event_device *evt)
++{
++	const char *name = systick.dev.name;
++	struct systick_device *sdev;
++	int irq = systick.dev.irq;
++
++	sdev = container_of(evt, struct systick_device, dev);
++
++	if (!sdev->irq_requested) {
++		if (request_irq(irq, systick_interrupt,
++				IRQF_PERCPU | IRQF_TIMER, name, &systick.dev))
++			pr_err("Failed to request irq %d (%s)\n", irq, name);
++	}
++	sdev->irq_requested = 1;
++	iowrite32(CFG_EXT_STK_EN | CFG_CNT_EN,
++		  systick.membase + SYSTICK_CONFIG);
++
++	return 0;
++}
++
++static int __init ralink_systick_init(struct device_node *np)
++{
++	int ret;
++
++	systick.membase = of_iomap(np, 0);
++	if (!systick.membase)
++		return -ENXIO;
++
++	systick.dev.name = np->name;
++	clockevents_calc_mult_shift(&systick.dev, SYSTICK_FREQ, 60);
++	systick.dev.max_delta_ns = clockevent_delta2ns(0x7fff, &systick.dev);
++	systick.dev.max_delta_ticks = 0x7fff;
++	systick.dev.min_delta_ns = clockevent_delta2ns(0x3, &systick.dev);
++	systick.dev.min_delta_ticks = 0x3;
++	systick.dev.irq = irq_of_parse_and_map(np, 0);
++	if (!systick.dev.irq) {
++		pr_err("%pOFn: request_irq failed", np);
++		return -EINVAL;
++	}
++
++	ret = clocksource_mmio_init(systick.membase + SYSTICK_COUNT, np->name,
++				    SYSTICK_FREQ, 301, 16,
++				    clocksource_mmio_readl_up);
++	if (ret)
++		return ret;
++
++	clockevents_register_device(&systick.dev);
++
++	pr_info("%pOFn: running - mult: %d, shift: %d\n",
++			np, systick.dev.mult, systick.dev.shift);
++
++	return 0;
++}
++
++TIMER_OF_DECLARE(systick, "ralink,cevt-systick", ralink_systick_init);
diff --git a/target/linux/ramips/patches-6.6/311-MIPS-use-set_mode-to-enable-disable-the-cevt-r4k-irq.patch b/target/linux/ramips/patches-6.6/311-MIPS-use-set_mode-to-enable-disable-the-cevt-r4k-irq.patch
index 36925b83267cf4..d59a71af88b0a9 100644
--- a/target/linux/ramips/patches-6.6/311-MIPS-use-set_mode-to-enable-disable-the-cevt-r4k-irq.patch
+++ b/target/linux/ramips/patches-6.6/311-MIPS-use-set_mode-to-enable-disable-the-cevt-r4k-irq.patch
@@ -1,13 +1,11 @@
-From ce3d4a4111a5f7e6b4e74bceae5faa6ce388e8ec Mon Sep 17 00:00:00 2001
 From: John Crispin <blogic@openwrt.org>
 Date: Sun, 14 Jul 2013 23:08:11 +0200
-Subject: [PATCH 05/53] MIPS: use set_mode() to enable/disable the cevt-r4k
- irq
+Subject: [PATCH 1/2] MIPS: use set_mode() to enable/disable the cevt-r4k irq
 
 Signed-off-by: John Crispin <blogic@openwrt.org>
 ---
  arch/mips/kernel/cevt-r4k.c | 43 +++++++++++++++++++++++++++++++++++++
- arch/mips/ralink/Kconfig    |  5 +++++
+ drivers/clocksource/Kconfig |  5 +++++
  2 files changed, 48 insertions(+)
 
 --- a/arch/mips/kernel/cevt-r4k.c
@@ -96,23 +94,21 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	return 0;
  }
---- a/arch/mips/ralink/Kconfig
-+++ b/arch/mips/ralink/Kconfig
-@@ -1,12 +1,17 @@
- # SPDX-License-Identifier: GPL-2.0
- if RALINK
- 
+--- a/drivers/clocksource/Kconfig
++++ b/drivers/clocksource/Kconfig
+@@ -731,10 +731,15 @@ config GOLDFISH_TIMER
+ 	depends on RTC_DRV_GOLDFISH
+ 	help
+ 	  Support for the timer/counter of goldfish-rtc
++ 
 +config CEVT_SYSTICK_QUIRK
 +	bool
 +	default n
-+
- config CLKEVT_RT3352
- 	bool
- 	depends on SOC_RT305X || SOC_MT7620
- 	default y
- 	select TIMER_OF
- 	select CLKSRC_MMIO
-+	select CEVT_SYSTICK_QUIRK
  
- config RALINK_ILL_ACC
- 	bool
+ config RALINK_TIMER
+ 	bool "Ralink System Tick Counter"
+ 	depends on SOC_RT305X || SOC_MT7620 || COMPILE_TEST
++	select CEVT_SYSTICK_QUIRK
+ 	select CLKSRC_MMIO
+ 	select TIMER_OF
+ 	help
diff --git a/target/linux/ramips/patches-6.6/312-MIPS-ralink-add-cpu-frequency-scaling.patch b/target/linux/ramips/patches-6.6/312-MIPS-ralink-add-cpu-frequency-scaling.patch
index 0d70770941ecf8..6acdfff837cca3 100644
--- a/target/linux/ramips/patches-6.6/312-MIPS-ralink-add-cpu-frequency-scaling.patch
+++ b/target/linux/ramips/patches-6.6/312-MIPS-ralink-add-cpu-frequency-scaling.patch
@@ -1,19 +1,26 @@
-From bd30f19a006fb52bac80c6463c49dd2f4159f4ac Mon Sep 17 00:00:00 2001
 From: John Crispin <blogic@openwrt.org>
 Date: Sun, 28 Jul 2013 16:26:41 +0200
-Subject: [PATCH 06/53] MIPS: ralink: add cpu frequency scaling
+Subject: [PATCH 2/2] MIPS: ralink: add cpu frequency scaling
 
 This feature will break udelay() and cause the delay loop to have longer delays
 when the frequency is scaled causing a performance hit.
 
 Signed-off-by: John Crispin <blogic@openwrt.org>
 ---
- arch/mips/ralink/cevt-rt3352.c |   38 ++++++++++++++++++++++++++++++++++++++
- 1 file changed, 38 insertions(+)
+ drivers/clocksource/timer-ralink.c | 117 ++++++++++++++++++++++-------
+ 1 file changed, 89 insertions(+), 28 deletions(-)
 
---- a/arch/mips/ralink/cevt-rt3352.c
-+++ b/arch/mips/ralink/cevt-rt3352.c
-@@ -29,6 +29,10 @@
+--- a/drivers/clocksource/timer-ralink.c
++++ b/drivers/clocksource/timer-ralink.c
+@@ -5,6 +5,7 @@
+  * Copyright (C) 2013 by John Crispin <john@phrozen.org>
+  */
+ 
++#include <asm/mach-ralink/ralink_regs.h>
+ #include <linux/clockchips.h>
+ #include <linux/clocksource.h>
+ #include <linux/interrupt.h>
+@@ -26,6 +27,10 @@
  /* enable the counter */
  #define CFG_CNT_EN		0x1
  
@@ -24,7 +31,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  struct systick_device {
  	void __iomem *membase;
  	struct clock_event_device dev;
-@@ -36,21 +40,53 @@ struct systick_device {
+@@ -33,21 +38,53 @@ struct systick_device {
  	int freq_scale;
  };
  
@@ -64,7 +71,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 +}
 +
  static int systick_next_event(unsigned long delta,
- 				struct clock_event_device *evt)
+ 			      struct clock_event_device *evt)
  {
  	struct systick_device *sdev;
 -	u32 count;
@@ -83,18 +90,18 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  }
  
  static void systick_event_handler(struct clock_event_device *dev)
-@@ -60,20 +96,25 @@ static void systick_event_handler(struct
+@@ -57,20 +94,25 @@ static void systick_event_handler(struct
  
  static irqreturn_t systick_interrupt(int irq, void *dev_id)
  {
--	struct clock_event_device *dev = (struct clock_event_device *) dev_id;
+-	struct clock_event_device *dev = (struct clock_event_device *)dev_id;
 +	int ret = 0;
 +	struct clock_event_device *cdev;
 +	struct systick_device *sdev;
  
 -	dev->event_handler(dev);
 +	if (read_c0_cause() & STATUSF_IP7) {
-+		cdev = (struct clock_event_device *) dev_id;
++		cdev = (struct clock_event_device *)dev_id;
 +		sdev = container_of(cdev, struct systick_device, dev);
 +
 +		/* Clear Count/Compare Interrupt */
@@ -117,7 +124,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  		.features		= CLOCK_EVT_FEAT_ONESHOT,
  		.set_next_event		= systick_next_event,
  		.set_state_shutdown	= systick_shutdown,
-@@ -91,7 +132,13 @@ static int systick_shutdown(struct clock
+@@ -88,7 +130,13 @@ static int systick_shutdown(struct clock
  	if (sdev->irq_requested)
  		free_irq(systick.dev.irq, &systick.dev);
  	sdev->irq_requested = 0;
@@ -132,7 +139,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	return 0;
  }
-@@ -116,33 +163,46 @@ static int systick_set_oneshot(struct cl
+@@ -113,33 +161,46 @@ static int systick_set_oneshot(struct cl
  	return 0;
  }
  
diff --git a/target/linux/ramips/patches-6.6/316-arch-mips-do-not-select-illegal-access-driver-by-def.patch b/target/linux/ramips/patches-6.6/316-arch-mips-do-not-select-illegal-access-driver-by-def.patch
index 1dc54ccf232627..85680416709616 100644
--- a/target/linux/ramips/patches-6.6/316-arch-mips-do-not-select-illegal-access-driver-by-def.patch
+++ b/target/linux/ramips/patches-6.6/316-arch-mips-do-not-select-illegal-access-driver-by-def.patch
@@ -11,8 +11,8 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 
 --- a/arch/mips/ralink/Kconfig
 +++ b/arch/mips/ralink/Kconfig
-@@ -14,9 +14,9 @@ config CLKEVT_RT3352
- 	select CEVT_SYSTICK_QUIRK
+@@ -2,9 +2,9 @@
+ if RALINK
  
  config RALINK_ILL_ACC
 -	bool
diff --git a/target/linux/ramips/rt305x/config-6.6 b/target/linux/ramips/rt305x/config-6.6
index 6f7b7ea2a1741a..33efcba6332f06 100644
--- a/target/linux/ramips/rt305x/config-6.6
+++ b/target/linux/ramips/rt305x/config-6.6
@@ -6,7 +6,6 @@ CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
 CONFIG_ARCH_SUSPEND_POSSIBLE=y
 CONFIG_CEVT_R4K=y
 CONFIG_CEVT_SYSTICK_QUIRK=y
-CONFIG_CLKEVT_RT3352=y
 CONFIG_CLKSRC_MMIO=y
 CONFIG_CLK_MTMIPS=y
 CONFIG_CLONE_BACKWARDS=y
@@ -160,6 +159,7 @@ CONFIG_PREEMPT_NONE_BUILD=y
 CONFIG_PTP_1588_CLOCK_OPTIONAL=y
 CONFIG_RALINK=y
 # CONFIG_RALINK_ILL_ACC is not set
+CONFIG_RALINK_TIMER=y
 CONFIG_RALINK_WDT=y
 CONFIG_RANDSTRUCT_NONE=y
 CONFIG_RATIONAL=y

From ec839c786ca56c6143257b89f146aeafbb6cfd3a Mon Sep 17 00:00:00 2001
From: Mauri Sandberg <maukka@ext.kapsi.fi>
Date: Mon, 28 Oct 2024 22:13:04 +0200
Subject: [PATCH 049/225] ramips: dna_valokuitu-plus-ex400: clean-up image
 creation

Code cleanup. Simplify and unify how kernel image is passed to
Build/dna-bootfs

Signed-off-by: Mauri Sandberg <maukka@ext.kapsi.fi>
Link: https://github.com/openwrt/openwrt/pull/16811
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 target/linux/ramips/image/mt7621.mk | 22 ++++++----------------
 1 file changed, 6 insertions(+), 16 deletions(-)

diff --git a/target/linux/ramips/image/mt7621.mk b/target/linux/ramips/image/mt7621.mk
index 1dc1219d241e46..eb7dacefefb793 100644
--- a/target/linux/ramips/image/mt7621.mk
+++ b/target/linux/ramips/image/mt7621.mk
@@ -94,18 +94,9 @@ endef
 define Build/dna-bootfs
 	mkdir -p $@.ubifs-dir/boot
 
-	# populate the boot fs with the dtb and with either initramfs kernel or
-	# the normal kernel
+	# populate the boot fs with the dtb and the kernel image
 	$(CP) $(KDIR)/image-$(firstword $(DEVICE_DTS)).dtb $@.ubifs-dir/boot/dtb
-
-	$(if $(findstring with-initrd,$(word 1,$(1))),\
-		( \
-			$(CP) $@ $@.ubifs-dir/boot/uImage \
-		) , \
-		( \
-			$(CP) $(IMAGE_KERNEL) $@.ubifs-dir/boot/uImage \
-		) \
-	)
+	$(CP) $@ $@.ubifs-dir/boot/uImage
 
 	# create ubifs
 	$(STAGING_DIR_HOST)/bin/mkfs.ubifs ${MKUBIFS_OPTS} -r $@.ubifs-dir/ -o $@.new
@@ -1060,17 +1051,16 @@ define Device/dna_valokuitu-plus-ex400
   IMAGE_SIZE := 117m
   PAGESIZE := 2048
   MKUBIFS_OPTS := --min-io-size=$$(PAGESIZE) --leb-size=124KiB --max-leb-cnt=96 \
-  		  --log-lebs=2 --space-fixup --squash-uids
+	--log-lebs=2 --space-fixup --squash-uids
   DEVICE_VENDOR := DNA
   DEVICE_MODEL := Valokuitu Plus EX400
   KERNEL := kernel-bin | lzma | uImage lzma
   KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | uImage lzma
   IMAGES += factory.bin
   IMAGE/factory.bin := append-image-stage initramfs-kernel.bin | \
-                       dna-bootfs with-initrd | dna-header | \
-                       append-md5sum-ascii-salted
-  IMAGE/sysupgrade.bin := dna-bootfs | sysupgrade-tar kernel=$$$$@ | check-size | \
-  			  append-metadata
+	dna-bootfs | dna-header | append-md5sum-ascii-salted
+  IMAGE/sysupgrade.bin := append-kernel | dna-bootfs | \
+  	sysupgrade-tar kernel=$$$$@ | check-size | append-metadata
   DEVICE_IMG_NAME = $$(DEVICE_IMG_PREFIX)-$$(2)
   DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615-firmware kmod-usb3
 endef

From c0581520b1c53fe2fc4a310f916590dcc428474a Mon Sep 17 00:00:00 2001
From: Mikhail Zhilkin <csharper2005@gmail.com>
Date: Sat, 26 Oct 2024 09:34:43 +0000
Subject: [PATCH 050/225] uboot-mediatek: add Routerich AX3000 support

Add U-Boot replacement loader for Routerich AX3000.

Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16791
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 package/boot/uboot-mediatek/Makefile          |  13 +
 .../patches/460-add-routerich-ax3000.patch    | 362 ++++++++++++++++++
 2 files changed, 375 insertions(+)
 create mode 100644 package/boot/uboot-mediatek/patches/460-add-routerich-ax3000.patch

diff --git a/package/boot/uboot-mediatek/Makefile b/package/boot/uboot-mediatek/Makefile
index d2a03277d4057d..fa314da3998e65 100644
--- a/package/boot/uboot-mediatek/Makefile
+++ b/package/boot/uboot-mediatek/Makefile
@@ -413,6 +413,18 @@ define U-Boot/mt7981_rfb-snfi
   DEPENDS:=+trusted-firmware-a-mt7981-snand-ddr3
 endef
 
+define U-Boot/mt7981_routerich_ax3000
+  NAME:=Routerich AX3000
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=routerich_ax3000-ubootmod
+  UBOOT_CONFIG:=mt7981_routerich_ax3000
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=spim-nand
+  BL2_SOC:=mt7981
+  BL2_DDRTYPE:=ddr3
+  DEPENDS:=+trusted-firmware-a-mt7981-spim-nand-ddr3
+endef
+
 define U-Boot/mt7981_qihoo_360t7
   NAME:=Qihoo 360T7
   BUILD_SUBTARGET:=filogic
@@ -823,6 +835,7 @@ UBOOT_TARGETS := \
 	mt7981_rfb-nor \
 	mt7981_rfb-sd \
 	mt7981_rfb-snfi \
+	mt7981_routerich_ax3000 \
 	mt7981_qihoo_360t7 \
 	mt7981_xiaomi_mi-router-ax3000t \
 	mt7981_xiaomi_mi-router-wr30u \
diff --git a/package/boot/uboot-mediatek/patches/460-add-routerich-ax3000.patch b/package/boot/uboot-mediatek/patches/460-add-routerich-ax3000.patch
new file mode 100644
index 00000000000000..9aa31843deaa06
--- /dev/null
+++ b/package/boot/uboot-mediatek/patches/460-add-routerich-ax3000.patch
@@ -0,0 +1,362 @@
+--- /dev/null
++++ b/configs/mt7981_routerich_ax3000_defconfig
+@@ -0,0 +1,107 @@
++CONFIG_ARM=y
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
++CONFIG_POSITION_INDEPENDENT=y
++CONFIG_ARCH_MEDIATEK=y
++CONFIG_TEXT_BASE=0x41e00000
++CONFIG_SYS_MALLOC_F_LEN=0x4000
++CONFIG_NR_DRAM_BANKS=1
++CONFIG_DEFAULT_DEVICE_TREE="mt7981-routerich_ax3000"
++CONFIG_OF_LIBFDT_OVERLAY=y
++CONFIG_TARGET_MT7981=y
++CONFIG_PRE_CON_BUF_ADDR=0x4007ef00
++CONFIG_DEBUG_UART_BASE=0x11002000
++CONFIG_DEBUG_UART_CLOCK=40000000
++CONFIG_SYS_LOAD_ADDR=0x46000000
++CONFIG_DEBUG_UART=y
++CONFIG_FIT=y
++CONFIG_BOOTDELAY=30
++CONFIG_AUTOBOOT_KEYED=y
++CONFIG_AUTOBOOT_MENU_SHOW=y
++CONFIG_DEFAULT_FDT_FILE="mediatek/mt7981-routerich_ax3000.dtb"
++CONFIG_LOGLEVEL=7
++CONFIG_PRE_CONSOLE_BUFFER=y
++CONFIG_LOG=y
++CONFIG_BOARD_LATE_INIT=y
++CONFIG_HUSH_PARSER=y
++CONFIG_SYS_PROMPT="MT7981> "
++CONFIG_CMD_CPU=y
++CONFIG_CMD_LICENSE=y
++CONFIG_CMD_BOOTMENU=y
++CONFIG_CMD_ASKENV=y
++CONFIG_CMD_ERASEENV=y
++CONFIG_CMD_ENV_FLAGS=y
++CONFIG_CMD_STRINGS=y
++CONFIG_CMD_DM=y
++CONFIG_CMD_GPIO=y
++CONFIG_CMD_GPT=y
++CONFIG_CMD_MTD=y
++CONFIG_CMD_PART=y
++CONFIG_CMD_DHCP=y
++CONFIG_CMD_TFTPSRV=y
++CONFIG_CMD_RARP=y
++CONFIG_CMD_PING=y
++CONFIG_CMD_CDP=y
++CONFIG_CMD_SNTP=y
++CONFIG_CMD_DNS=y
++CONFIG_CMD_LINK_LOCAL=y
++CONFIG_CMD_PXE=y
++CONFIG_CMD_CACHE=y
++CONFIG_CMD_PSTORE=y
++CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
++CONFIG_CMD_UUID=y
++CONFIG_CMD_HASH=y
++CONFIG_CMD_SMC=y
++CONFIG_CMD_UBI=y
++CONFIG_CMD_UBI_RENAME=y
++CONFIG_OF_EMBED=y
++CONFIG_ENV_OVERWRITE=y
++CONFIG_ENV_IS_IN_UBI=y
++CONFIG_SYS_REDUNDAND_ENVIRONMENT=y
++CONFIG_ENV_UBI_PART="ubi"
++CONFIG_ENV_UBI_VOLUME="ubootenv"
++CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
++CONFIG_SYS_RELOC_GD_ENV_ADDR=y
++CONFIG_USE_DEFAULT_ENV_FILE=y
++CONFIG_DEFAULT_ENV_FILE="routerich_ax3000_env"
++CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
++CONFIG_VERSION_VARIABLE=y
++CONFIG_NET_RANDOM_ETHADDR=y
++CONFIG_NETCONSOLE=y
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.254"
++CONFIG_REGMAP=y
++CONFIG_SYSCON=y
++CONFIG_BUTTON=y
++CONFIG_BUTTON_GPIO=y
++CONFIG_CLK=y
++CONFIG_GPIO_HOG=y
++CONFIG_LED=y
++CONFIG_LED_BLINK=y
++CONFIG_LED_GPIO=y
++# CONFIG_MMC is not set
++CONFIG_MTD=y
++CONFIG_DM_MTD=y
++CONFIG_MTD_SPI_NAND=y
++CONFIG_MTD_UBI_FASTMAP=y
++CONFIG_PHY_FIXED=y
++CONFIG_MEDIATEK_ETH=y
++CONFIG_PHY=y
++CONFIG_PHY_MTK_TPHY=y
++CONFIG_PINCTRL=y
++CONFIG_PINCONF=y
++CONFIG_PINCTRL_MT7981=y
++CONFIG_POWER_DOMAIN=y
++CONFIG_MTK_POWER_DOMAIN=y
++CONFIG_DM_REGULATOR=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_DM_REGULATOR_GPIO=y
++CONFIG_RAM=y
++CONFIG_DM_SERIAL=y
++CONFIG_MTK_SERIAL=y
++CONFIG_SPI=y
++CONFIG_DM_SPI=y
++CONFIG_MTK_SPIM=y
++CONFIG_ZSTD=y
++CONFIG_HEXDUMP=y
++CONFIG_LMB_MAX_REGIONS=64
+--- /dev/null
++++ b/arch/arm/dts/mt7981-routerich_ax3000.dts
+@@ -0,0 +1,187 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright (c) 2022 MediaTek Inc.
++ * Author: Sam Shih <sam.shih@mediatek.com>
++ */
++
++/dts-v1/;
++#include "mt7981.dtsi"
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/input/linux-event-codes.h>
++
++/ {
++	#address-cells = <1>;
++	#size-cells = <1>;
++	model = "Routerich AX3000";
++	compatible = "routerich,ax3000", "mediatek,mt7981";
++
++	chosen {
++		stdout-path = &uart0;
++		tick-timer = &timer0;
++	};
++
++	memory@40000000 {
++		device_type = "memory";
++		reg = <0x40000000 0x10000000>;
++	};
++
++	keys {
++		compatible = "gpio-keys";
++
++		button-0 {
++			label = "mesh";
++			linux,code = <BTN_0>;
++			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
++		};
++
++		button-1 {
++			label = "reset";
++			linux,code = <KEY_RESTART>;
++			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	leds {
++		compatible = "gpio-leds";
++
++		led-0 {
++			label = "red:wlan5g";
++			gpios = <&gpio 5 GPIO_ACTIVE_LOW>;
++		};
++
++		led-1 {
++			label = "red:wan";
++			gpios = <&gpio 6 GPIO_ACTIVE_HIGH>;
++		};
++
++		led-2 {
++			label = "blue:power";
++			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
++		};
++
++		led-3 {
++			label = "blue:lan1";
++			gpios = <&gpio 9 GPIO_ACTIVE_LOW>;
++		};
++
++		led-4 {
++			label = "blue:lan2";
++			gpios = <&gpio 10 GPIO_ACTIVE_LOW>;
++		};
++
++		led-5 {
++			label = "blue:lan3";
++			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
++		};
++
++		led-6 {
++			label = "blue:wan";
++			gpios = <&gpio 12 GPIO_ACTIVE_LOW>;
++		};
++
++		led-7 {
++			label = "blue:wlan2g";
++			gpios = <&gpio 34 GPIO_ACTIVE_LOW>;
++		};
++
++		led-8 {
++			label = "blue:mesh";
++			gpios = <&gpio 35 GPIO_ACTIVE_LOW>;
++		};
++	};
++};
++
++&uart0 {
++	mediatek,force-highspeed;
++	status = "okay";
++};
++
++&eth {
++	status = "okay";
++	mediatek,gmac-id = <0>;
++	phy-mode = "2500base-x";
++	mediatek,switch = "mt7531";
++	reset-gpios = <&gpio 39 GPIO_ACTIVE_HIGH>;
++
++	fixed-link {
++		speed = <2500>;
++		full-duplex;
++	};
++};
++
++&pinctrl {
++	spi_flash_pins: spi0-pins-func-1 {
++		mux {
++			function = "flash";
++			groups = "spi0", "spi0_wp_hold";
++		};
++
++		conf-pu {
++			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
++			drive-strength = <MTK_DRIVE_8mA>;
++			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
++		};
++
++		conf-pd {
++			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
++			drive-strength = <MTK_DRIVE_8mA>;
++			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
++		};
++	};
++};
++
++&spi0 {
++	#address-cells = <1>;
++	#size-cells = <0>;
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi_flash_pins>;
++	status = "okay";
++	must_tx;
++	enhance_timing;
++	dma_ext;
++	ipm_design;
++	support_quad;
++	tick_dly = <2>;
++	sample_sel = <0>;
++
++	spi_nand@0 {
++		compatible = "spi-nand";
++		reg = <0>;
++		spi-max-frequency = <52000000>;
++
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			partition@0 {
++				label = "bl2";
++				reg = <0x0 0x100000>;
++			};
++
++			partition@100000 {
++				label = "uboot-env-orig";
++				reg = <0x100000 0x80000>;
++			};
++
++			partition@160000 {
++				label = "Factory";
++				reg = <0x180000 0x200000>;
++			};
++
++			partition@380000 {
++				label = "fip";
++				reg = <0x380000 0x200000>;
++			};
++
++			partition@580000 {
++				label = "ubi";
++				reg = <0x580000 0x7a80000>;
++			};
++		};
++	};
++};
++
++&watchdog {
++	status = "disabled";
++};
+--- /dev/null
++++ b/routerich_ax3000_env
+@@ -0,0 +1,58 @@
++ipaddr=192.168.1.1
++serverip=192.168.1.254
++loadaddr=0x46000000
++console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
++bootcmd=run check_buttons ; if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
++bootconf=config-1
++bootdelay=0
++bootfile=openwrt-mediatek-filogic-routerich_ax3000-ubootmod-initramfs-recovery.itb
++bootfile_bl2=openwrt-mediatek-filogic-routerich_ax3000-ubootmod-preloader.bin
++bootfile_fip=openwrt-mediatek-filogic-routerich_ax3000-ubootmod-bl31-uboot.fip
++bootfile_upg=openwrt-mediatek-filogic-routerich_ax3000-ubootmod-squashfs-sysupgrade.itb
++bootled_pwr=blue:power
++bootled_rec=blue:power
++bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
++bootmenu_default=0
++bootmenu_delay=0
++bootmenu_title=      ( ( ( OpenWrt ) ) )
++bootmenu_0=Initialize environment.=run _firstboot
++bootmenu_0d=Run default boot command.=run boot_default
++bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
++bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
++bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
++bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_6=Load BL31+U-Boot FIP via TFTP then write to NAND.=run boot_tftp_write_fip ; run bootmenu_confirm_return
++bootmenu_7=Load BL2 preloader via TFTP then write to NAND.=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
++bootmenu_8=Reboot.=reset
++bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
++boot_first=if button reset ; then led $bootled_rec on ; run boot_default ; fi ; bootmenu
++boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
++boot_production=led $bootled_pwr on ; run ubi_read_production && bootm $loadaddr#$bootconf ; led $bootled_pwr off
++boot_recovery=led $bootled_rec on ; run ubi_read_recovery && bootm $loadaddr#$bootconf ; led $bootled_rec off
++boot_ubi=run boot_production ; run boot_recovery ; run boot_tftp_forever
++boot_tftp_forever=led $bootled_rec on ; while true ; do run boot_tftp ; sleep 1 ; done
++boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
++boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
++boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
++check_buttons=if button reset ; then run boot_tftp ; fi
++ethaddr_factory=mtd read Factory 0x40080000 0x0 0x20000 && env readmem -b ethaddr 0x40080004 0x6 ; setenv ethaddr_factory
++part_default=production
++part_recovery=recovery
++reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
++mtd_write_fip=mtd erase fip && mtd write fip $loadaddr
++mtd_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr
++ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x100000 dynamic || run ubi_format ; ubi check ubootenv2 || ubi create ubootenv2 0x100000 dynamic || run ubi_format
++ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
++ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
++ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs
++ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
++ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
++ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic && ubi write $loadaddr fit $filesize
++ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic && ubi write $loadaddr recovery $filesize
++_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
++_firstboot=setenv _firstboot ; run ethaddr_factory ; run _switch_to_menu ; run _init_env ; run boot_first
++_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
++_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       $ver"

From d413163832df93c321eef3fce8c4f72c350d5308 Mon Sep 17 00:00:00 2001
From: Mikhail Zhilkin <csharper2005@gmail.com>
Date: Sat, 26 Oct 2024 09:37:14 +0000
Subject: [PATCH 051/225] mediatek: Routerich AX3000: add OpenWrt U-Boot layout

This commit adds OpenWrt U-Boot layout support for Routerich AX3000. The
aims:
1. Get open-source U-Boot;
2. Get maximum available free space in OpenWrt.

Install
-------
1. Copy OpenWrt ubootmod-bl31-uboot.fip, ubootmod-preloader.bin, to the
   /tmp folder of the router using scp.

2. Make mtd partitions backups:
   http://192.168.1.1/cgi-bin/luci/admin/system/flash -> Save mtdblock
   contents

3. Install kmod-mtd-rw:
```
opkg update && opkg install kmod-mtd-rw
```

4. Write FIP and preloader:
```
insmod mtd-rw i_want_a_brick=1
mtd unlock BL2
mtd erase BL2
mtd write /tmp/ubootmod-preloader.bin BL2
mtd unlock FIP
mtd erase FIP
mtd write /tmp/ubootmod-bl31-uboot.fip FIP
```

5. Copy OpenWrt ubootmod-initramfs-recovery.itb to the tftp server root
   with IP 192.168.1.254.

6. Reboot router:
```
reboot
```
U-Boot will automatically download from the tftp server and boot OpenWrt
initramfs system.

7. Copy OpenWrt ubootmod-squashfs-sysupgrade.itb to the /tmp dir of the
   router using scp.

8. Run sysupgrade:
```
sysupgrade -n /tmp/squashfs-sysupgrade.itb
```

Recovery
--------
1. Place OpenWrt initramfs-recovery.itb image (with original name) on the
   tftp server (IP: 192.168.1.254).
2. Press "reset" button and power on the router. After ~10 sec release the
   button.
3. Use OpenWrt initramfs system for recovery.

BL2 and FIP recovery
--------------------
Use mtk_uartboot and UART connection if BL2 or FIP in UBI is destroyed:
Link: https://github.com/981213/mtk_uartboot

Return to stock:
----------------
1. Copy partition backups (BL2.bin and FIP.bin) to the /tmp dir of the
   router using scp.

2. Install kmod-mtd-rw:
```
opkg update && opkg install kmod-mtd-rw
```

3. Restore stock U-Boot and reboot:
```
insmod mtd-rw i_want_a_brick=1
mtd unlock BL2
mtd erase BL2
mtd write /tmp/BL2.bin BL2
mtd unlock FIP
mtd erase FIP
mtd write /tmp/FIP.bin FIP
reboot
```

4. Open U-Boot web recovery, upload stock firmware image and start
   upgrade.
Link: http://192.168.1.1

Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16791
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 .../uboot-envtools/files/mediatek_filogic     |   1 +
 .../dts/mt7981b-routerich-ax3000-common.dtsi  | 302 ++++++++++++++++++
 .../dts/mt7981b-routerich-ax3000-ubootmod.dts |  52 +++
 .../mediatek/dts/mt7981b-routerich-ax3000.dts | 119 +------
 .../filogic/base-files/etc/board.d/01_leds    |   3 +-
 .../filogic/base-files/etc/board.d/02_network |   3 +-
 .../etc/hotplug.d/ieee80211/11_fix_wifi_mac   |   1 +
 .../base-files/lib/upgrade/platform.sh        |   1 +
 target/linux/mediatek/image/filogic.mk        |  25 ++
 9 files changed, 400 insertions(+), 107 deletions(-)
 create mode 100644 target/linux/mediatek/dts/mt7981b-routerich-ax3000-common.dtsi
 create mode 100644 target/linux/mediatek/dts/mt7981b-routerich-ax3000-ubootmod.dts

diff --git a/package/boot/uboot-envtools/files/mediatek_filogic b/package/boot/uboot-envtools/files/mediatek_filogic
index b637f4328778a1..58db7dad281c0c 100644
--- a/package/boot/uboot-envtools/files/mediatek_filogic
+++ b/package/boot/uboot-envtools/files/mediatek_filogic
@@ -39,6 +39,7 @@ jcg,q30-pro|\
 netcore,n60|\
 nokia,ea0326gmp|\
 qihoo,360t7|\
+routerich,ax3000-ubootmod|\
 tplink,tl-xdr4288|\
 tplink,tl-xdr6086|\
 tplink,tl-xdr6088|\
diff --git a/target/linux/mediatek/dts/mt7981b-routerich-ax3000-common.dtsi b/target/linux/mediatek/dts/mt7981b-routerich-ax3000-common.dtsi
new file mode 100644
index 00000000000000..f0b0b9365b68e3
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-routerich-ax3000-common.dtsi
@@ -0,0 +1,302 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+
+/dts-v1/;
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+#include "mt7981.dtsi"
+
+/ {
+	aliases {
+		label-mac-device = &wan;
+
+		led-boot = &led_power_blue;
+		led-failsafe = &led_power_blue;
+		led-running = &led_power_blue;
+		led-upgrade = &led_power_blue;
+
+		serial0 = &uart0;
+	};
+
+	chosen: chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		button-0 {
+			label = "mesh";
+			linux,input-type = <EV_SW>;
+			linux,code = <BTN_0>;
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+
+		button-1 {
+			label = "reset";
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led-0 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_WLAN;
+			function-enumerator = <50>;
+			gpios = <&pio 5 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		led-1 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_WAN;
+			gpios = <&pio 6 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_power_blue: led-2 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_POWER;
+			gpios = <&pio 7 GPIO_ACTIVE_LOW>;
+		};
+
+		led-3 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <1>;
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+
+		led-4 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <2>;
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+		};
+
+		led-5 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <3>;
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		led-6 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WAN;
+			gpios = <&pio 12 GPIO_ACTIVE_LOW>;
+		};
+
+		led-7 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WLAN;
+			function-enumerator = <24>;
+			gpios = <&pio 34 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		led-8 {
+			color = <LED_COLOR_ID_BLUE>;
+			/* LED_FUNCTION_MESH isn't implemented yet */
+			function = "mesh";
+			gpios = <&pio 35 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	memory {
+		reg = <0 0x40000000 0 0x10000000>;
+	};
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_factory_4 (-1)>;
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+};
+
+&mdio_bus {
+	switch: switch@1f {
+		compatible = "mediatek,mt7531";
+		reg = <0x1f>;
+		reset-gpios = <&pio 39 GPIO_ACTIVE_HIGH>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		interrupt-parent = <&pio>;
+		interrupts = <38 IRQ_TYPE_LEVEL_HIGH>;
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	status = "okay";
+
+	/* ESMT F50L1G41LB (128M) */
+	spi: spi_nand@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "spi-nand";
+		reg = <0>;
+
+		spi-max-frequency = <52000000>;
+		spi-tx-bus-width = <4>;
+		spi-rx-bus-width = <4>;
+
+		spi-cal-enable;
+		spi-cal-mode = "read-data";
+		spi-cal-datalen = <7>;
+		spi-cal-data = /bits/ 8 <0x53 0x50 0x49 0x4e 0x41 0x4e 0x44>;
+		spi-cal-addrlen = <5>;
+		spi-cal-addr = /bits/ 32 <0x0 0x0 0x0 0x0 0x0>;
+
+		partitions: partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0_all {
+				label = "spi0.0";
+				reg = <0x0 0x8000000>;
+				read-only;
+			};
+
+			partition@0 {
+				label = "BL2";
+				reg = <0x0 0x100000>;
+				read-only;
+			};
+
+			partition@180000 {
+				label = "Factory";
+				reg = <0x180000 0x200000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					eeprom_factory_0: eeprom@0 {
+						reg = <0x0 0x1000>;
+					};
+
+					macaddr_factory_4: macaddr@4 {
+						compatible = "mac-base";
+						reg = <0x4 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+				};
+			};
+
+			partition@380000 {
+				label = "FIP";
+				reg = <0x380000 0x200000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			label = "lan1";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan2";
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan3";
+		};
+
+		wan: port@4 {
+			reg = <4>;
+			label = "wan";
+
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_factory_4 (-2)>;
+		};
+
+		port@6 {
+			reg = <6>;
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
+&pio {
+	spi0_flash_pins: spi0-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&wifi {
+	status = "okay";
+	nvmem-cell-names = "eeprom";
+	nvmem-cells = <&eeprom_factory_0>;
+};
+
+&xhci {
+	status = "okay";
+	mediatek,u3p-dis-msk = <0x1>;
+};
diff --git a/target/linux/mediatek/dts/mt7981b-routerich-ax3000-ubootmod.dts b/target/linux/mediatek/dts/mt7981b-routerich-ax3000-ubootmod.dts
new file mode 100644
index 00000000000000..dfdb78936d8c46
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-routerich-ax3000-ubootmod.dts
@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+
+#include "mt7981b-routerich-ax3000-common.dtsi"
+
+/ {
+	model = "Routerich AX3000 (OpenWrt U-Boot layout)";
+	compatible = "routerich,ax3000-ubootmod", "mediatek,mt7981";
+};
+
+&chosen {
+	rootdisk = <&ubi_fit_volume>;
+};
+
+&partitions {
+	partition@100000 {
+		label = "u-boot-env-orig";
+		reg = <0x100000 0x80000>;
+		read-only;
+	};
+
+	partition@580000 {
+		label = "ubi";
+		reg = <0x580000 0x7a80000>;
+		compatible = "linux,ubi";
+
+		volumes {
+			ubi_fit_volume: ubi-volume-fit {
+				volname = "fit";
+			};
+
+			ubi_ubootenv: ubi-volume-ubootenv {
+				volname = "ubootenv";
+			};
+
+			ubi_ubootenv2: ubi-volume-ubootenv2 {
+				volname = "ubootenv2";
+			};
+		};
+	};
+};
+
+&ubi_ubootenv {
+	nvmem-layout {
+		compatible = "u-boot,env-redundant-bool";
+	};
+};
+
+&ubi_ubootenv2 {
+	nvmem-layout {
+		compatible = "u-boot,env-redundant-bool";
+	};
+};
diff --git a/target/linux/mediatek/dts/mt7981b-routerich-ax3000.dts b/target/linux/mediatek/dts/mt7981b-routerich-ax3000.dts
index aa6a15ee1d1209..c0a10b3fc86bb0 100644
--- a/target/linux/mediatek/dts/mt7981b-routerich-ax3000.dts
+++ b/target/linux/mediatek/dts/mt7981b-routerich-ax3000.dts
@@ -1,118 +1,27 @@
 // SPDX-License-Identifier: GPL-2.0-only OR MIT
 
-/dts-v1/;
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/input/input.h>
-#include <dt-bindings/leds/common.h>
-
-#include "mt7981.dtsi"
+#include "mt7981b-routerich-ax3000-common.dtsi"
 
 / {
 	model = "Routerich AX3000";
 	compatible = "routerich,ax3000", "mediatek,mt7981";
+};
 
-	aliases {
-		label-mac-device = &wan;
-
-		led-boot = &led_power_blue;
-		led-failsafe = &led_power_blue;
-		led-running = &led_power_blue;
-		led-upgrade = &led_power_blue;
-
-		serial0 = &uart0;
-	};
-
-	chosen {
-		stdout-path = "serial0:115200n8";
-	};
-
-	gpio-keys {
-		compatible = "gpio-keys";
-
-		button-0 {
-			label = "mesh";
-			linux,input-type = <EV_SW>;
-			linux,code = <BTN_0>;
-			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
-			debounce-interval = <60>;
-		};
-
-		button-1 {
-			label = "reset";
-			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
-			linux,code = <KEY_RESTART>;
-			debounce-interval = <60>;
-		};
-	};
-
-	leds {
-		compatible = "gpio-leds";
-
-		led-0 {
-			color = <LED_COLOR_ID_RED>;
-			function = LED_FUNCTION_WLAN;
-			function-enumerator = <50>;
-			gpios = <&pio 5 GPIO_ACTIVE_LOW>;
-			linux,default-trigger = "phy1tpt";
-		};
-
-		led-1 {
-			color = <LED_COLOR_ID_RED>;
-			function = LED_FUNCTION_WAN;
-			gpios = <&pio 6 GPIO_ACTIVE_HIGH>;
-		};
-
-		led_power_blue: led-2 {
-			color = <LED_COLOR_ID_BLUE>;
-			function = LED_FUNCTION_POWER;
-			gpios = <&pio 7 GPIO_ACTIVE_LOW>;
-		};
-
-		led-3 {
-			color = <LED_COLOR_ID_BLUE>;
-			function = LED_FUNCTION_LAN;
-			function-enumerator = <1>;
-			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
-		};
-
-		led-4 {
-			color = <LED_COLOR_ID_BLUE>;
-			function = LED_FUNCTION_LAN;
-			function-enumerator = <2>;
-			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
-		};
-
-		led-5 {
-			color = <LED_COLOR_ID_BLUE>;
-			function = LED_FUNCTION_LAN;
-			function-enumerator = <3>;
-			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
-		};
-
-		led-6 {
-			color = <LED_COLOR_ID_BLUE>;
-			function = LED_FUNCTION_WAN;
-			gpios = <&pio 12 GPIO_ACTIVE_LOW>;
-		};
-
-		led-7 {
-			color = <LED_COLOR_ID_BLUE>;
-			function = LED_FUNCTION_WLAN;
-			function-enumerator = <24>;
-			gpios = <&pio 34 GPIO_ACTIVE_LOW>;
-			linux,default-trigger = "phy0tpt";
-		};
+&spi {
+	mediatek,nmbm;
+	mediatek,bmt-max-ratio = <1>;
+	mediatek,bmt-max-reserved-blocks = <64>;
+};
 
-		led-8 {
-			color = <LED_COLOR_ID_BLUE>;
-			/* LED_FUNCTION_MESH isn't implemented yet */
-			function = "mesh";
-			gpios = <&pio 35 GPIO_ACTIVE_LOW>;
-		};
+&partitions {
+	partition@100000 {
+		label = "u-boot-env";
+		reg = <0x100000 0x80000>;
 	};
 
-	memory {
-		reg = <0 0x40000000 0 0x10000000>;
+	partition@580000 {
+		label = "ubi";
+		reg = <0x580000 0x7000000>;
 	};
 };
 
diff --git a/target/linux/mediatek/filogic/base-files/etc/board.d/01_leds b/target/linux/mediatek/filogic/base-files/etc/board.d/01_leds
index dad5c293dec377..38c4b7525b60e7 100644
--- a/target/linux/mediatek/filogic/base-files/etc/board.d/01_leds
+++ b/target/linux/mediatek/filogic/base-files/etc/board.d/01_leds
@@ -75,7 +75,8 @@ openwrt,one)
 	ucidef_set_led_netdev "lanact" "LANACT" "green:lan" "eth1" "rx tx"
 	ucidef_set_led_netdev "lanlink" "LANLINK" "amber:lan" "eth1" "link"
 	;;
-routerich,ax3000)
+routerich,ax3000|\
+routerich,ax3000-ubootmod)
 	ucidef_set_led_netdev "lan-1" "lan-1" "blue:lan-1" "lan1" "link tx rx"
 	ucidef_set_led_netdev "lan-2" "lan-2" "blue:lan-2" "lan2" "link tx rx"
 	ucidef_set_led_netdev "lan-3" "lan-3" "blue:lan-3" "lan3" "link tx rx"
diff --git a/target/linux/mediatek/filogic/base-files/etc/board.d/02_network b/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
index 7bfc61a26902a2..1480dbcbc78c23 100644
--- a/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
+++ b/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
@@ -34,7 +34,8 @@ mediatek_setup_interfaces()
 	cudy,wr3000-v1|\
 	jcg,q30-pro|\
 	qihoo,360t7|\
-	routerich,ax3000)
+	routerich,ax3000|\
+	routerich,ax3000-ubootmod)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3" wan
 		;;
 	asus,tuf-ax4200|\
diff --git a/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac b/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
index 7402bfc71babb8..5e83a167de9704 100644
--- a/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
+++ b/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
@@ -158,6 +158,7 @@ case "$board" in
 		[ "$PHYNBR" = "1" ] && macaddr_add $addr 1 > /sys${DEVPATH}/macaddress
 		;;
 	routerich,ax3000|\
+	routerich,ax3000-ubootmod|\
 	zbtlink,zbt-z8102ax|\
 	zbtlink,zbt-z8103ax|\
 	zyxel,ex5601-t0|\
diff --git a/target/linux/mediatek/filogic/base-files/lib/upgrade/platform.sh b/target/linux/mediatek/filogic/base-files/lib/upgrade/platform.sh
index ce334b2c8eecbb..0040ffbb266627 100755
--- a/target/linux/mediatek/filogic/base-files/lib/upgrade/platform.sh
+++ b/target/linux/mediatek/filogic/base-files/lib/upgrade/platform.sh
@@ -80,6 +80,7 @@ platform_do_upgrade() {
 	openwrt,one|\
 	netcore,n60|\
 	qihoo,360t7|\
+	routerich,ax3000-ubootmod|\
 	tplink,tl-xdr4288|\
 	tplink,tl-xdr6086|\
 	tplink,tl-xdr6088|\
diff --git a/target/linux/mediatek/image/filogic.mk b/target/linux/mediatek/image/filogic.mk
index f366a9b9202a7c..672790f1a77698 100644
--- a/target/linux/mediatek/image/filogic.mk
+++ b/target/linux/mediatek/image/filogic.mk
@@ -1228,6 +1228,31 @@ define Device/routerich_ax3000
 endef
 TARGET_DEVICES += routerich_ax3000
 
+define Device/routerich_ax3000-ubootmod
+  DEVICE_VENDOR := Routerich
+  DEVICE_MODEL := AX3000 (OpenWrt U-Boot layout)
+  DEVICE_DTS := mt7981b-routerich-ax3000-ubootmod
+  DEVICE_DTS_DIR := ../dts
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_IN_UBI := 1
+  UBOOTENV_IN_UBI := 1
+  IMAGES := sysupgrade.itb
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.itb := append-kernel | \
+	fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-static-with-rootfs | \
+	append-metadata
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware kmod-usb3 mt7981-wo-firmware
+  ARTIFACTS := preloader.bin bl31-uboot.fip
+  ARTIFACT/preloader.bin := mt7981-bl2 spim-nand-ddr3
+  ARTIFACT/bl31-uboot.fip := mt7981-bl31-uboot routerich_ax3000
+endef
+TARGET_DEVICES += routerich_ax3000-ubootmod
+
 define Device/ruijie_rg-x60-pro
   DEVICE_VENDOR := Ruijie
   DEVICE_MODEL := RG-X60 Pro

From eed39d45c2ff901b5327c7ab63c9131166e3140e Mon Sep 17 00:00:00 2001
From: John Audia <therealgraysky@proton.me>
Date: Sun, 29 Oct 2023 04:32:21 -0400
Subject: [PATCH 052/225] kernel: enable pressure interface

PSI provides a canonical way to see resource pressure increases as
they develop, with pressure metrics for three major resources:
memory, CPU, and IO. PSI stats are like barometers that provide
fair warning of impending resource shortages, enabling users to
take more proactive, granular, and nuanced steps when resources
start becoming scarce.

References:
* https://www.kernel.org/doc/html/latest/accounting/psi.html
* https://lwn.net/Articles/759781/

Build system: x86/64
Build-tested: x86/64/AMD Cezanne, flogic/glinet_gl-mt6000
Run-tested: x86/64/AMD Cezanne, flogic/glinet_gl-mt6000

Signed-off-by: John Audia <therealgraysky@proton.me>
Link: https://github.com/openwrt/openwrt/pull/13819
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 config/Config-kernel.in         | 19 +++++++++++++++++++
 target/linux/generic/config-6.6 |  1 +
 2 files changed, 20 insertions(+)

diff --git a/config/Config-kernel.in b/config/Config-kernel.in
index 0fa039db404b78..91678cf2a660c8 100644
--- a/config/Config-kernel.in
+++ b/config/Config-kernel.in
@@ -333,6 +333,25 @@ if KERNEL_TASKSTATS
 
 endif
 
+config KERNEL_PSI
+	bool "Compile the kernel with pressure stall information tracking"
+	help
+	  Collect metrics that indicate how overcommitted the CPU, memory,
+	  and IO capacity are in the system.
+
+	  If you say Y here, the kernel will create /proc/pressure/ with the
+	  pressure statistics files cpu, memory, and io. These will indicate
+	  the share of walltime in which some or all tasks in the system are
+	  delayed due to contention of the respective resource.
+
+	  In kernels with cgroup support, cgroups (cgroup2 only) will
+	  have cpu.pressure, memory.pressure, and io.pressure files,
+	  which aggregate pressure stalls for the grouped tasks only.
+
+	  For more details see Documentation/accounting/psi.rst.
+
+	  Say N if unsure.
+
 config KERNEL_KALLSYMS
 	bool "Compile the kernel with symbol table information"
 	default y if !SMALL_FLASH
diff --git a/target/linux/generic/config-6.6 b/target/linux/generic/config-6.6
index 9eec780b53ae85..105dc0d344fa82 100644
--- a/target/linux/generic/config-6.6
+++ b/target/linux/generic/config-6.6
@@ -4758,6 +4758,7 @@ CONFIG_PROC_SYSCTL=y
 # CONFIG_PSB6970_PHY is not set
 # CONFIG_PSE_CONTROLLER is not set
 # CONFIG_PSI is not set
+# CONFIG_PSI_DEFAULT_DISABLED is not set
 # CONFIG_PSTORE is not set
 # CONFIG_PSTORE_BLK is not set
 # CONFIG_PSTORE_COMPRESS is not set

From 1f53b7fb75265d182e809ef3e3cbaca0c43dd3ec Mon Sep 17 00:00:00 2001
From: Robert Marko <robimarko@gmail.com>
Date: Sun, 24 Nov 2024 23:50:22 +0100
Subject: [PATCH 053/225] qualcommax: ipq60xx: remove source-only flag

Its been a while since we added ipq60xx as source-only, it is now
quite usable so lets remove the source-only flag to start building
official images.

I also plan to merge additional popular boards rather soon.

Link: https://github.com/openwrt/openwrt/pull/17065
Signed-off-by: Robert Marko <robimarko@gmail.com>
---
 target/linux/qualcommax/ipq60xx/target.mk | 1 -
 1 file changed, 1 deletion(-)

diff --git a/target/linux/qualcommax/ipq60xx/target.mk b/target/linux/qualcommax/ipq60xx/target.mk
index dc3a2ceff607b7..06a85ab5e4fbbc 100644
--- a/target/linux/qualcommax/ipq60xx/target.mk
+++ b/target/linux/qualcommax/ipq60xx/target.mk
@@ -1,5 +1,4 @@
 SUBTARGET:=ipq60xx
-FEATURES += source-only
 BOARDNAME:=Qualcomm Atheros IPQ60xx
 DEFAULT_PACKAGES += ath11k-firmware-ipq6018
 

From 118c657bd160fb68c29cade49e726128b1c0fa8b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
Date: Mon, 4 Nov 2024 09:02:19 +0000
Subject: [PATCH 054/225] Revert "openwrt-keyring: fix missing 24.10 usign key
 by installing it"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This reverts commit 37784c48e93c663dafc99454c24bebf4e258556f as the
preference is to have single explicit key for each release/branch.

Signed-off-by: Petr Štetiar <ynezz@true.cz>
Link: https://github.com/openwrt/openwrt/pull/16852
Signed-off-by: Robert Marko <robimarko@gmail.com>
---
 package/system/openwrt-keyring/Makefile | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/package/system/openwrt-keyring/Makefile b/package/system/openwrt-keyring/Makefile
index e499fc0beb5d45..029463817b85dd 100644
--- a/package/system/openwrt-keyring/Makefile
+++ b/package/system/openwrt-keyring/Makefile
@@ -3,7 +3,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=openwrt-keyring
-PKG_RELEASE:=2
+PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/keyring.git
@@ -40,8 +40,6 @@ define Package/openwrt-keyring/install
 	$(INSTALL_DIR) $(1)/etc/opkg/keys/
 	# Public usign key for unattended snapshot builds
 	$(INSTALL_DATA) $(PKG_BUILD_DIR)/usign/b5043e70f9a75cde $(1)/etc/opkg/keys/
-	# Public usign key for 24.10 release builds
-	$(INSTALL_DATA) $(PKG_BUILD_DIR)/usign/d310c6f2833e97f7 $(1)/etc/opkg/keys/
 endef
 endif
 

From 72dec105fb99a949d7ecf2a3d0ac29880007d602 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
Date: Mon, 4 Nov 2024 09:04:04 +0000
Subject: [PATCH 055/225] openwrt-keyring: apk: use just snapshot key
 explicitly
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently we're going to ship all the apk keys in the keyring, but the
preference is to ship and use single release/branch specific key so lets
use openwrt-snapshots.pem for apk explicitly as well.

Fixes: 2cea05002489 ("openwrt-keyring: add apk public key for signing of package indexes")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Link: https://github.com/openwrt/openwrt/pull/16852
Signed-off-by: Robert Marko <robimarko@gmail.com>
---
 package/system/openwrt-keyring/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package/system/openwrt-keyring/Makefile b/package/system/openwrt-keyring/Makefile
index 029463817b85dd..7f237ed9fa0c1a 100644
--- a/package/system/openwrt-keyring/Makefile
+++ b/package/system/openwrt-keyring/Makefile
@@ -33,7 +33,7 @@ Build/Compile=
 ifneq ($(CONFIG_USE_APK),)
 define Package/openwrt-keyring/install
 	$(INSTALL_DIR) $(1)/etc/apk/keys/
-	$(INSTALL_DATA) $(PKG_BUILD_DIR)/apk/*.pem $(1)/etc/apk/keys/
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/apk/openwrt-snapshots.pem $(1)/etc/apk/keys/
 endef
 else
 define Package/openwrt-keyring/install

From 5695267847c2fe51290fdbde6ecd7114654f7988 Mon Sep 17 00:00:00 2001
From: Robert Marko <robimarko@gmail.com>
Date: Sun, 24 Nov 2024 21:15:08 +0100
Subject: [PATCH 056/225] ramips: mt7621: support openwrt,netdev-name for
 renaming interfaces

Edgerouter X currently has its eth1 port on the switch missing since there
is a naming conflict currently.

So, as the root cause is mixing kernel support for DSA interfaces having
predictable names set via "label" property vs others having it assigned
dynamically lets avoid the conflict by using our own custom property as
suggested upstream [1].

So, add support via "openwrt,netdev-name" property and use it on ERX.

Fixes: 2a25c6ace8d8 ("ramips: get rid of downstream network device label patch")
Fixes: #15643
Link: https://github.com/openwrt/openwrt/pull/17062
Signed-off-by: Robert Marko <robimarko@gmail.com>
---
 .../ramips/dts/mt7621_ubnt_edgerouter-x-sfp.dts |  3 ++-
 .../ramips/dts/mt7621_ubnt_edgerouter-x.dts     |  2 +-
 .../ramips/dts/mt7621_ubnt_edgerouter-x.dtsi    | 17 +++++++++++------
 .../base-files/lib/preinit/04_set_netdev_label  |  8 ++++++++
 4 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/target/linux/ramips/dts/mt7621_ubnt_edgerouter-x-sfp.dts b/target/linux/ramips/dts/mt7621_ubnt_edgerouter-x-sfp.dts
index 50a77c3877a055..9f1e0a8d20c675 100644
--- a/target/linux/ramips/dts/mt7621_ubnt_edgerouter-x-sfp.dts
+++ b/target/linux/ramips/dts/mt7621_ubnt_edgerouter-x-sfp.dts
@@ -69,11 +69,12 @@
 	ports {
 		port@5 {
 			reg = <5>;
-			label = "eth5";
+			openwrt,netdev-name = "eth5";
 			phy-handle = <&ephy7>;
 			phy-mode = "rgmii-rxid";
 			nvmem-cells = <&macaddr_factory_22 5>;
 			nvmem-cell-names = "mac-address";
+			/delete-property/ label;
 		};
 	};
 };
diff --git a/target/linux/ramips/dts/mt7621_ubnt_edgerouter-x.dts b/target/linux/ramips/dts/mt7621_ubnt_edgerouter-x.dts
index 80467c88e98343..c0230e13b42393 100644
--- a/target/linux/ramips/dts/mt7621_ubnt_edgerouter-x.dts
+++ b/target/linux/ramips/dts/mt7621_ubnt_edgerouter-x.dts
@@ -7,7 +7,7 @@
 
 &gmac1 {
 	status = "okay";
-	label = "eth0";
+	openwrt,netdev-name = "eth0";
 	phy-handle = <&ethphy0>;
 
 	nvmem-cells = <&macaddr_factory_22 0>;
diff --git a/target/linux/ramips/dts/mt7621_ubnt_edgerouter-x.dtsi b/target/linux/ramips/dts/mt7621_ubnt_edgerouter-x.dtsi
index dc9908ba34c6a1..40433c1c43b23d 100644
--- a/target/linux/ramips/dts/mt7621_ubnt_edgerouter-x.dtsi
+++ b/target/linux/ramips/dts/mt7621_ubnt_edgerouter-x.dtsi
@@ -22,42 +22,47 @@
 &gmac0 {
 	nvmem-cells = <&macaddr_factory_22 0>;
 	nvmem-cell-names = "mac-address";
-	label = "dsa";
+	openwrt,netdev-name = "dsa";
 };
 
 &switch0 {
 	ports {
 		port@0 {
 			status = "okay";
-			label = "eth0";
+			openwrt,netdev-name = "eth0";
+			/delete-property/ label;
 		};
 
 		port@1 {
 			status = "okay";
-			label = "eth1";
+			openwrt,netdev-name = "eth1";
 			nvmem-cells = <&macaddr_factory_22 1>;
 			nvmem-cell-names = "mac-address";
+			/delete-property/ label;
 		};
 
 		port@2 {
 			status = "okay";
-			label = "eth2";
+			openwrt,netdev-name = "eth2";
 			nvmem-cells = <&macaddr_factory_22 2>;
 			nvmem-cell-names = "mac-address";
+			/delete-property/ label;
 		};
 
 		port@3 {
 			status = "okay";
-			label = "eth3";
+			openwrt,netdev-name = "eth3";
 			nvmem-cells = <&macaddr_factory_22 3>;
 			nvmem-cell-names = "mac-address";
+			/delete-property/ label;
 		};
 
 		port@4 {
 			status = "okay";
-			label = "eth4";
+			openwrt,netdev-name = "eth4";
 			nvmem-cells = <&macaddr_factory_22 4>;
 			nvmem-cell-names = "mac-address";
+			/delete-property/ label;
 		};
 	};
 };
diff --git a/target/linux/ramips/mt7621/base-files/lib/preinit/04_set_netdev_label b/target/linux/ramips/mt7621/base-files/lib/preinit/04_set_netdev_label
index 110e023b962d3d..2c5e420f93bd17 100644
--- a/target/linux/ramips/mt7621/base-files/lib/preinit/04_set_netdev_label
+++ b/target/linux/ramips/mt7621/base-files/lib/preinit/04_set_netdev_label
@@ -10,6 +10,14 @@ set_netdev_labels() {
 		[ "$netdev" = "$label" ] && continue
 		ip link set "$netdev" name "$label"
 	done
+
+	for dir in /sys/class/net/*; do
+		[ -r "$dir/of_node/openwrt,netdev-name" ] || continue
+		read -r label < "$dir/of_node/openwrt,netdev-name"
+		netdev="${dir##*/}"
+		[ "$netdev" = "$label" ] && continue
+		ip link set "$netdev" name "$label"
+	done
 }
 
 boot_hook_add preinit_main set_netdev_labels

From 341cc047b9174280d89f1b5494a42837ccbadb12 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
Date: Mon, 25 Nov 2024 21:23:54 +0000
Subject: [PATCH 057/225] Revert "target,base-files: unify handling of
 procd-ujail"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This reverts commit ac640718aa0ceae55969bb9e7e45d00bb7bc228a as it
removes base-files package when KERNEL_NAMESPACES is deselected, as
base-files depends on procd-ujail which needs KERNEL_NAMESPACES.

Fixes: #17075
Link: https://github.com/openwrt/openwrt/pull/17081
Link: https://github.com/openwrt/openwrt/pull/17081
Signed-off-by: Petr Štetiar <ynezz@true.cz>
---
 include/target.mk           | 5 +++++
 package/base-files/Makefile | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/include/target.mk b/include/target.mk
index 1b32bf905d6d3c..02ea68b15c8121 100644
--- a/include/target.mk
+++ b/include/target.mk
@@ -90,6 +90,11 @@ else
   endif
 endif
 
+# include ujail on systems with enough storage
+ifeq ($(filter small_flash,$(FEATURES)),)
+  DEFAULT_PACKAGES+=procd-ujail
+endif
+
 # Add device specific packages (here below to allow device type set from subtarget)
 DEFAULT_PACKAGES += $(DEFAULT_PACKAGES.$(DEVICE_TYPE))
 
diff --git a/package/base-files/Makefile b/package/base-files/Makefile
index ff7891f18cb0c7..b90ee3a64ebca2 100644
--- a/package/base-files/Makefile
+++ b/package/base-files/Makefile
@@ -43,7 +43,7 @@ define Package/base-files
 	+netifd +libc +jsonfilter +SIGNED_PACKAGES:usign +SIGNED_PACKAGES:openwrt-keyring \
 	+NAND_SUPPORT:ubi-utils +fstools +fwtool \
 	+SELINUX:procd-selinux +!SELINUX:procd +USE_SECCOMP:procd-seccomp \
-	+SELINUX:busybox-selinux +!SELINUX:busybox +!SMALL_FLASH:procd-ujail
+	+SELINUX:busybox-selinux +!SELINUX:busybox
   TITLE:=Base filesystem for OpenWrt
   URL:=http://openwrt.org/
   VERSION:=$(PKG_RELEASE)~$(lastword $(subst -, ,$(REVISION)))

From 1bdb6d84046ec1c47f28c57651358470ed212ec3 Mon Sep 17 00:00:00 2001
From: George Oldfort <openwrt@10099.de>
Date: Tue, 26 Nov 2024 06:42:25 +0100
Subject: [PATCH 058/225] mediatek: remove ktd-202x driver filogic image (Aer
 Vero W6m)

Image build fails with PR #16861 merged while PR #16860 not merged.

Removing kmod-leds-ktd202x from filogic.mk will fix the build process.

Fixes: 2898d1d1269a ("mediatek: add support for Acer Predator W6d and Acer Vero W6m")
Signed-off-by: George Oldfort <openwrt@10099.de>
Link: https://github.com/openwrt/openwrt/pull/17087
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 target/linux/mediatek/image/filogic.mk | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/linux/mediatek/image/filogic.mk b/target/linux/mediatek/image/filogic.mk
index 672790f1a77698..3a36fbc46b8dcb 100644
--- a/target/linux/mediatek/image/filogic.mk
+++ b/target/linux/mediatek/image/filogic.mk
@@ -186,7 +186,7 @@ define Device/acer_vero-w6m
   DEVICE_DTS := mt7986a-acer-vero-w6m
   DEVICE_DTS_DIR := ../dts
   DEVICE_DTS_LOADADDR := 0x47000000
-  DEVICE_PACKAGES := kmod-leds-ktd202x kmod-mt7915e kmod-mt7916-firmware kmod-mt7986-firmware mt7986-wo-firmware e2fsprogs f2fsck mkf2fs
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7916-firmware kmod-mt7986-firmware mt7986-wo-firmware e2fsprogs f2fsck mkf2fs
   IMAGES := sysupgrade.bin
   KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
   KERNEL_INITRAMFS := kernel-bin | lzma | \

From c857145e034f623e31ab2028049a547ecd94ce85 Mon Sep 17 00:00:00 2001
From: Eric Fahlgren <ericfahlgren@gmail.com>
Date: Fri, 22 Nov 2024 09:00:25 -0800
Subject: [PATCH 059/225] build: profiles.json: add kernel version information
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently downstream tools like ASU lack information about kernel
version to find out the relevant kmod build folder on downloads server.

So lets fix it by providing a new `linux_kernel` JSON array which would
for the start provide Linux kernel version, revision and vermagic
information.

  "linux_kernel": {
     "release": "1",
     "vermagic": "b57450c07d3a786158c3601fc5cee57d",
     "version": "6.6.61"
   },

Fixes: openwrt/openwrt#17036
Fixes: efahl/owut#9
Co-developed-by: Petr Štetiar <ynezz@true.cz>
Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17042
Signed-off-by: Petr Štetiar <ynezz@true.cz>
---
 scripts/json_overview_image_info.py | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/scripts/json_overview_image_info.py b/scripts/json_overview_image_info.py
index 0d2cf7f1ef5134..96921c27430a86 100755
--- a/scripts/json_overview_image_info.py
+++ b/scripts/json_overview_image_info.py
@@ -47,7 +47,13 @@ def get_initial_output(image_info):
 
 
 if output:
-    default_packages, output["arch_packages"] = run(
+    (
+        default_packages,
+        output["arch_packages"],
+        linux_version,
+        linux_release,
+        linux_vermagic,
+    ) = run(
         [
             "make",
             "--no-print-directory",
@@ -55,6 +61,9 @@ def get_initial_output(image_info):
             "target/linux/",
             "val.DEFAULT_PACKAGES",
             "val.ARCH_PACKAGES",
+            "val.LINUX_VERSION",
+            "val.LINUX_RELEASE",
+            "val.LINUX_VERMAGIC",
             "V=s",
         ],
         stdout=PIPE,
@@ -64,7 +73,11 @@ def get_initial_output(image_info):
     ).stdout.splitlines()
 
     output["default_packages"] = sorted(default_packages.split())
-
+    output["linux_kernel"] = {
+        "version": linux_version,
+        "release": linux_release,
+        "vermagic": linux_vermagic,
+    }
     output_path.write_text(json.dumps(output, sort_keys=True, separators=(",", ":")))
 else:
     print("JSON info file script could not find any JSON files for target")

From c19c31f7aa6f9952b5d5e1b313eca79d4e7ed59c Mon Sep 17 00:00:00 2001
From: Paul Spooren <mail@aparcar.org>
Date: Wed, 27 Nov 2024 17:09:30 +0100
Subject: [PATCH 060/225] base-files: add migration information for APK

If the `apk` package manager is installed, show a table of common
commands to deal with the system.

Signed-off-by: Paul Spooren <mail@aparcar.org>
---
 package/base-files/files/etc/profile | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/package/base-files/files/etc/profile b/package/base-files/files/etc/profile
index 76b149b9fae5e5..e892a5a605fd64 100644
--- a/package/base-files/files/etc/profile
+++ b/package/base-files/files/etc/profile
@@ -38,3 +38,24 @@ in order to prevent unauthorized SSH logins.
 --------------------------------------------------
 EOF
 fi
+
+if [ -x /usr/bin/apk ]; then
+cat << EOF
+
+ OpenWrt recently switched to the "apk" package manger!
+
+ OPKG Command           APK Equivalent      Description
+ ------------------------------------------------------------------
+ opkg install <pkg>     apk add <pkg>       Install a package
+ opkg remove <pkg>      apk del <pkg>       Remove a package
+ opkg upgrade           apk upgrade         Upgrade all packages
+ opkg files <pkg>       apk info -L <pkg>   List package contents
+ opkg list-installed    apk info            List installed packages
+ opkg update            apk update          Update package lists
+ opkg search <pkg>      apk search <pkg>    Search for packages
+ ------------------------------------------------------------------
+
+For more https://openwrt.org/docs/guide-user/additional-software/opkg-to-apk-cheatsheet
+
+EOF
+fi

From 3929ef4c21844189d5db8d14e7e6dc6ba983d571 Mon Sep 17 00:00:00 2001
From: Christian Marangi <ansuelsmth@gmail.com>
Date: Wed, 27 Nov 2024 22:20:54 +0100
Subject: [PATCH 061/225] uci: update to Git HEAD (2024-11-26)

10f7996ec294 file: Ignore config file with '.' in name

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
---
 package/system/uci/Makefile | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package/system/uci/Makefile b/package/system/uci/Makefile
index c8f661c68434f8..6b902a9c24f9d3 100644
--- a/package/system/uci/Makefile
+++ b/package/system/uci/Makefile
@@ -13,9 +13,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/uci.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2023-08-10
-PKG_SOURCE_VERSION:=5781664d5087ccc4b5ab58505883231212dbedbc
-PKG_MIRROR_HASH:=0ca4a29c077e85a7cfe69916c3ceb2bee98662b6268befc3c02519939647f984
+PKG_SOURCE_DATE:=2024-11-26
+PKG_SOURCE_VERSION:=10f7996ec29449915640acca5d65b592365a4b14
+PKG_MIRROR_HASH:=8556add0dd77b85a5702faa94feb811606390c045d7f5004317a4ab3e07f773b
 
 PKG_LICENSE:=LGPL-2.1
 PKG_LICENSE_FILES:=

From f4492b6b1c5373a27c911ad675e96ccf1ce542d2 Mon Sep 17 00:00:00 2001
From: Paul Donald <newtwen+github@gmail.com>
Date: Mon, 25 Nov 2024 15:24:54 +0100
Subject: [PATCH 062/225] netifd: update to Git
 768027c5a7640137857f412f554227abd6160cdd (2024-11-27)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

86da5cbcdb9d system-linux: do not pull ifindex/flags from netlink messages on rtnl events
cd96f61ba63e proto-shell: fix spurious interface teardowns with host deps
a39fe3a8b150 wireless: add support for adding a list of devices for a wifi-iface
d29cf707478c iprule: add ipproto property
768027c5a764 system-linux: restore reading flags from netlink messages

Signed-off-by: Paul Donald <newtwen+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17074
Signed-off-by: Petr Štetiar <ynezz@true.cz>
---
 package/network/config/netifd/Makefile | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package/network/config/netifd/Makefile b/package/network/config/netifd/Makefile
index a4400c9516eca6..82a04adecd9320 100644
--- a/package/network/config/netifd/Makefile
+++ b/package/network/config/netifd/Makefile
@@ -5,9 +5,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/netifd.git
-PKG_SOURCE_DATE:=2024-11-08
-PKG_SOURCE_VERSION:=34eb11eb6f5c62de480d6192f0ca840093127fee
-PKG_MIRROR_HASH:=c4c2bc626426d2cd73c9ece54b22ada6ed6254afa992f51b8725312aca240cfd
+PKG_SOURCE_DATE:=2024-11-27
+PKG_SOURCE_VERSION:=768027c5a7640137857f412f554227abd6160cdd
+PKG_MIRROR_HASH:=5f74dc10470c64b42caa2d1fda3b80672293cf39676aa5c0b9f8c89880a15270
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 
 PKG_LICENSE:=GPL-2.0

From 6f9384f4a495c7e19934eb842cc29c1fdd093a1c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
Date: Thu, 28 Nov 2024 08:10:44 +0000
Subject: [PATCH 063/225] base-files: fix manger->manager typo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It was reported, that a small typo sneaked in, so lets fix it.

Reported-by: @dave14305
Fixes: c19c31f7aa6f ("base-files: add migration information for APK")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
---
 package/base-files/files/etc/profile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package/base-files/files/etc/profile b/package/base-files/files/etc/profile
index e892a5a605fd64..f9acdb439fa630 100644
--- a/package/base-files/files/etc/profile
+++ b/package/base-files/files/etc/profile
@@ -42,7 +42,7 @@ fi
 if [ -x /usr/bin/apk ]; then
 cat << EOF
 
- OpenWrt recently switched to the "apk" package manger!
+ OpenWrt recently switched to the "apk" package manager!
 
  OPKG Command           APK Equivalent      Description
  ------------------------------------------------------------------

From ee9eb91e0a69aa90c69cd34efef44badbc16d416 Mon Sep 17 00:00:00 2001
From: Daniel Golle <daniel@makrotopia.org>
Date: Wed, 27 Nov 2024 21:43:26 +0100
Subject: [PATCH 064/225] gmp: use same source tarball for tools/gmp and
 package/libs/gmp

tools/gmp was using the .tar.xz while package/libs/gmp was using the
.tar.gz archive of the GMP release. Use the .tar.gz for both of them.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
---
 package/libs/gmp/Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/libs/gmp/Makefile b/package/libs/gmp/Makefile
index 6bcee784ed8081..f2cacc942c66eb 100644
--- a/package/libs/gmp/Makefile
+++ b/package/libs/gmp/Makefile
@@ -11,9 +11,9 @@ PKG_NAME:=gmp
 PKG_VERSION:=6.3.0
 PKG_RELEASE:=1
 
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)$(PKG_REVISION).tar.xz
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=@GNU/gmp/
-PKG_HASH:=a3c2b80201b89e68616f4ad30bc66aee4927c3ce50e33929ca819d5c43538898
+PKG_HASH:=e56fd59d76810932a0555aa15a14b61c16bed66110d3c75cc2ac49ddaa9ab24c
 
 PKG_BUILD_PARALLEL:=1
 PKG_INSTALL:=1

From e48903a9ffff256817c18ebf9af8050163c28240 Mon Sep 17 00:00:00 2001
From: Daniel Golle <daniel@makrotopia.org>
Date: Wed, 27 Nov 2024 21:37:57 +0100
Subject: [PATCH 065/225] meson: honor MESON_ARGS and MESON_HOST_ARGS when
 calling ninja

Set MESON_ARGS and MESON_HOST_ARGS when calling ninja for building.
This is required eg. to be able to set PYTHONPATH= not just for the
Meson (==configure) run but also for the build phase itself.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
---
 include/meson.mk | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/meson.mk b/include/meson.mk
index ff452d8b01fa4c..fdb94b65425ab3 100644
--- a/include/meson.mk
+++ b/include/meson.mk
@@ -108,7 +108,7 @@ define Host/Configure/Meson
 endef
 
 define Host/Compile/Meson
-	+$(NINJA) -C $(MESON_HOST_BUILD_DIR) $(1)
+	+$(MESON_HOST_VARS) $(NINJA) -C $(MESON_HOST_BUILD_DIR) $(1)
 endef
 
 define Host/Install/Meson
@@ -135,7 +135,7 @@ define Build/Configure/Meson
 endef
 
 define Build/Compile/Meson
-	+$(NINJA) -C $(MESON_BUILD_DIR) $(1)
+	+$(MESON_VARS) $(NINJA) -C $(MESON_BUILD_DIR) $(1)
 endef
 
 define Build/Install/Meson

From 08f12283c7436814cdd10d93b5cb913f49acad3e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
Date: Thu, 28 Nov 2024 16:30:07 +0000
Subject: [PATCH 066/225] tools: ccache update to 4.10.2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes since 4.10:

 * Fixed detection of Fmt version 11 and newer.
 * Fixed prefix command lookup from PATH.

Suggested-by: Jen Wolf <jenwolf@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/17105
Signed-off-by: Petr Štetiar <ynezz@true.cz>
---
 tools/ccache/Makefile                       | 4 ++--
 tools/ccache/patches/100-honour-copts.patch | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/ccache/Makefile b/tools/ccache/Makefile
index 47c24a5c98864a..447bc3ea432f04 100644
--- a/tools/ccache/Makefile
+++ b/tools/ccache/Makefile
@@ -7,11 +7,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ccache
-PKG_VERSION:=4.10
+PKG_VERSION:=4.10.2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/ccache/ccache/releases/download/v$(PKG_VERSION)
-PKG_HASH:=16972ba62c8499045edc3ae7d7b8a0b419a961567f5ff0f01bf5a44194204775
+PKG_HASH:=108100960bb7e64573ea925af2ee7611701241abb36ce0aae3354528403a7d87
 
 include $(INCLUDE_DIR)/host-build.mk
 include $(INCLUDE_DIR)/cmake.mk
diff --git a/tools/ccache/patches/100-honour-copts.patch b/tools/ccache/patches/100-honour-copts.patch
index a40665ea25836c..c07c8ce8eb3a25 100644
--- a/tools/ccache/patches/100-honour-copts.patch
+++ b/tools/ccache/patches/100-honour-copts.patch
@@ -1,6 +1,6 @@
 --- a/src/ccache/ccache.cpp
 +++ b/src/ccache/ccache.cpp
-@@ -1906,6 +1906,7 @@ get_manifest_key(Context& ctx, Hash& has
+@@ -1914,6 +1914,7 @@ get_manifest_key(Context& ctx, Hash& has
      "OBJCPLUS_INCLUDE_PATH",        // Clang
      "CLANG_CONFIG_FILE_SYSTEM_DIR", // Clang
      "CLANG_CONFIG_FILE_USER_DIR",   // Clang

From 620a7ef47f0ba0e5d8769eed808a2875474e05d4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
Date: Thu, 28 Nov 2024 18:36:06 +0000
Subject: [PATCH 067/225] config: build: remove experimental warning from
 USE_APK option
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

apk package manager is default for some time, so lets remove the
EXPERIMENTAL warning from the related option.

Signed-off-by: Petr Štetiar <ynezz@true.cz>
---
 config/Config-build.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/Config-build.in b/config/Config-build.in
index c8739afa8770c5..ec3a8d1f8033c1 100644
--- a/config/Config-build.in
+++ b/config/Config-build.in
@@ -70,7 +70,7 @@ menu "Global build settings"
 
 	config USE_APK
 		imply PACKAGE_apk-mbedtls
-		bool "Use APK instead of OPKG to build distribution (EXPERIMENTAL)"
+		bool "Use APK instead of OPKG to build distribution"
 		default y
 
 	comment "General build options"

From 56d97fff55f3d384eeb00b021c43fecb380a5bdd Mon Sep 17 00:00:00 2001
From: George Oldfort <openwrt@10099.de>
Date: Tue, 26 Nov 2024 15:04:45 +0100
Subject: [PATCH 068/225] generic: backport support for KTD2026/7 rgb(w) led
 controller

This commit adds the Linux kernel mainline driver "leds-ktd202x" for the
KinetIC KTD2026 and KTD2027 RGB/RBGW controller with I2C interface that was
introduced in kernel version 6.7, last changed in mainline on 2024-05-31.

At least the Acer Connect Vero W6m (a variant of the Acer Predator Connect
W6 without 2.5G eth1 port, usb3 port, and the 6 on-board gpio RGB LEDs) is
equipped with a KTD2026 (and a single RGB LED attached to it used by the
stock firmware as status LED), and maybe other router devices also are.

Signed-off-by: George Oldfort <openwrt@10099.de>
Link: https://github.com/openwrt/openwrt/pull/16860
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 package/kernel/linux/modules/leds.mk          |  18 +
 .../860-v6.7-leds-add-ktd202x-driver.patch    | 682 ++++++++++++++++++
 ...get-device-properties-through-fwnode.patch | 221 ++++++
 ...x-i2c-id-tables-for-ktd2026-and-2027.patch |  49 ++
 ...eds-ktd202x-initialize-mutex-earlier.patch |  62 ++
 5 files changed, 1032 insertions(+)
 create mode 100644 target/linux/generic/backport-6.6/860-v6.7-leds-add-ktd202x-driver.patch
 create mode 100644 target/linux/generic/backport-6.6/861-v6.10-leds-rgb-leds-ktd202x-get-device-properties-through-fwnode.patch
 create mode 100644 target/linux/generic/backport-6.6/862-v6.10-leds-rgb-leds-ktd202x-i2c-id-tables-for-ktd2026-and-2027.patch
 create mode 100644 target/linux/generic/backport-6.6/863-v6.10-leds-rgb-leds-ktd202x-initialize-mutex-earlier.patch

diff --git a/package/kernel/linux/modules/leds.mk b/package/kernel/linux/modules/leds.mk
index 8b24cb0ef88e94..0c42895bb2f3c9 100644
--- a/package/kernel/linux/modules/leds.mk
+++ b/package/kernel/linux/modules/leds.mk
@@ -147,6 +147,24 @@ endef
 $(eval $(call KernelPackage,leds-apu))
 
 
+define KernelPackage/leds-ktd202x
+  SUBMENU:=LED modules
+  TITLE:=LED support for KTD202x Chips
+  DEPENDS:=+kmod-i2c-core +kmod-regmap-i2c
+  KCONFIG:=CONFIG_LEDS_KTD202X
+  FILES:= $(LINUX_DIR)/drivers/leds/rgb/leds-ktd202x.ko
+  AUTOLOAD:=$(call AutoProbe,leds-ktd202x,1)
+endef
+
+define KernelPackage/leds-ktd202x/description
+  This option enables support for the Kinetic KTD2026/KTD2027
+  RGB/White LED driver found in different BQ mobile phones.
+  It is a 3 or 4 channel LED driver programmed via an I2C interface.
+endef
+
+$(eval $(call KernelPackage,leds-ktd202x))
+
+
 define KernelPackage/leds-mlxcpld
   SUBMENU:=$(LEDS_MENU)
   TITLE:=LED support for the Mellanox boards
diff --git a/target/linux/generic/backport-6.6/860-v6.7-leds-add-ktd202x-driver.patch b/target/linux/generic/backport-6.6/860-v6.7-leds-add-ktd202x-driver.patch
new file mode 100644
index 00000000000000..fb767c5d9998be
--- /dev/null
+++ b/target/linux/generic/backport-6.6/860-v6.7-leds-add-ktd202x-driver.patch
@@ -0,0 +1,682 @@
+From 0ebdb7210943eb345992bea9892adbd15a206193 Mon Sep 17 00:00:00 2001
+From: André Apitzsch <git@apitzsch.eu>
+Date: Mon, 2 Oct 2023 18:48:28 +0200
+Subject: leds: Add ktd202x driver
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This commit adds support for Kinetic KTD2026/7 RGB/White LED driver.
+
+Signed-off-by: André Apitzsch <git@apitzsch.eu>
+Link: https://lore.kernel.org/r/20231002-ktd202x-v6-2-26be8eefeb88@apitzsch.eu
+Signed-off-by: Lee Jones <lee@kernel.org>
+---
+ drivers/leds/rgb/Kconfig        |  13 +
+ drivers/leds/rgb/Makefile       |   1 +
+ drivers/leds/rgb/leds-ktd202x.c | 625 ++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 639 insertions(+)
+ create mode 100644 drivers/leds/rgb/leds-ktd202x.c
+
+(limited to 'drivers/leds/rgb')
+
+--- a/drivers/leds/rgb/Kconfig
++++ b/drivers/leds/rgb/Kconfig
+@@ -14,6 +14,19 @@ config LEDS_GROUP_MULTICOLOR
+ 	  To compile this driver as a module, choose M here: the module
+ 	  will be called leds-group-multicolor.
+ 
++config LEDS_KTD202X
++	tristate "LED support for KTD202x Chips"
++	depends on I2C
++	depends on OF
++	select REGMAP_I2C
++	help
++	  This option enables support for the Kinetic KTD2026/KTD2027
++	  RGB/White LED driver found in different BQ mobile phones.
++	  It is a 3 or 4 channel LED driver programmed via an I2C interface.
++
++	  To compile this driver as a module, choose M here: the module
++	  will be called leds-ktd202x.
++
+ config LEDS_PWM_MULTICOLOR
+ 	tristate "PWM driven multi-color LED Support"
+ 	depends on PWM
+--- a/drivers/leds/rgb/Makefile
++++ b/drivers/leds/rgb/Makefile
+@@ -1,6 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ 
+ obj-$(CONFIG_LEDS_GROUP_MULTICOLOR)	+= leds-group-multicolor.o
++obj-$(CONFIG_LEDS_KTD202X)		+= leds-ktd202x.o
+ obj-$(CONFIG_LEDS_PWM_MULTICOLOR)	+= leds-pwm-multicolor.o
+ obj-$(CONFIG_LEDS_QCOM_LPG)		+= leds-qcom-lpg.o
+ obj-$(CONFIG_LEDS_MT6370_RGB)		+= leds-mt6370-rgb.o
+--- /dev/null
++++ b/drivers/leds/rgb/leds-ktd202x.c
+@@ -0,0 +1,625 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * Kinetic KTD2026/7 RGB/White LED driver with I2C interface
++ *
++ * Copyright 2023 André Apitzsch <git@apitzsch.eu>
++ *
++ * Datasheet: https://www.kinet-ic.com/uploads/KTD2026-7-04h.pdf
++ */
++
++#include <linux/i2c.h>
++#include <linux/led-class-multicolor.h>
++#include <linux/module.h>
++#include <linux/mutex.h>
++#include <linux/of.h>
++#include <linux/of_device.h>
++#include <linux/regmap.h>
++#include <linux/regulator/consumer.h>
++
++#define KTD2026_NUM_LEDS 3
++#define KTD2027_NUM_LEDS 4
++#define KTD202X_MAX_LEDS 4
++
++/* Register bank */
++#define KTD202X_REG_RESET_CONTROL	0x00
++#define KTD202X_REG_FLASH_PERIOD	0x01
++#define KTD202X_REG_PWM1_TIMER		0x02
++#define KTD202X_REG_PWM2_TIMER		0x03
++#define KTD202X_REG_CHANNEL_CTRL	0x04
++#define KTD202X_REG_TRISE_FALL		0x05
++#define KTD202X_REG_LED_IOUT(x)		(0x06 + (x))
++
++/* Register 0 */
++#define KTD202X_TIMER_SLOT_CONTROL_TSLOT1	0x00
++#define KTD202X_TIMER_SLOT_CONTROL_TSLOT2	0x01
++#define KTD202X_TIMER_SLOT_CONTROL_TSLOT3	0x02
++#define KTD202X_TIMER_SLOT_CONTROL_TSLOT4	0x03
++#define KTD202X_RSTR_RESET			0x07
++
++#define KTD202X_ENABLE_CTRL_WAKE	0x00 /* SCL High & SDA High */
++#define KTD202X_ENABLE_CTRL_SLEEP	0x08 /* SCL High & SDA Toggling */
++
++#define KTD202X_TRISE_FALL_SCALE_NORMAL		0x00
++#define KTD202X_TRISE_FALL_SCALE_SLOW_X2	0x20
++#define KTD202X_TRISE_FALL_SCALE_SLOW_X4	0x40
++#define KTD202X_TRISE_FALL_SCALE_FAST_X8	0x60
++
++/* Register 1 */
++#define KTD202X_FLASH_PERIOD_256_MS_LOG_RAMP	0x00
++
++/* Register 2-3 */
++#define KTD202X_FLASH_ON_TIME_0_4_PERCENT	0x01
++
++/* Register 4 */
++#define KTD202X_CHANNEL_CTRL_MASK(x) (BIT(2 * (x)) | BIT(2 * (x) + 1))
++#define KTD202X_CHANNEL_CTRL_OFF 0x00
++#define KTD202X_CHANNEL_CTRL_ON(x) BIT(2 * (x))
++#define KTD202X_CHANNEL_CTRL_PWM1(x) BIT(2 * (x) + 1)
++#define KTD202X_CHANNEL_CTRL_PWM2(x) (BIT(2 * (x)) | BIT(2 * (x) + 1))
++
++/* Register 5 */
++#define KTD202X_RAMP_TIMES_2_MS			0x00
++
++/* Register 6-9 */
++#define KTD202X_LED_CURRENT_10_mA		0x4f
++
++#define KTD202X_FLASH_PERIOD_MIN_MS 256
++#define KTD202X_FLASH_PERIOD_STEP_MS 128
++#define KTD202X_FLASH_PERIOD_MAX_STEPS 126
++#define KTD202X_FLASH_ON_MAX 256
++
++#define KTD202X_MAX_BRIGHTNESS 192
++
++static const struct reg_default ktd202x_reg_defaults[] = {
++	{ KTD202X_REG_RESET_CONTROL, KTD202X_TIMER_SLOT_CONTROL_TSLOT1 |
++		KTD202X_ENABLE_CTRL_WAKE | KTD202X_TRISE_FALL_SCALE_NORMAL },
++	{ KTD202X_REG_FLASH_PERIOD, KTD202X_FLASH_PERIOD_256_MS_LOG_RAMP },
++	{ KTD202X_REG_PWM1_TIMER, KTD202X_FLASH_ON_TIME_0_4_PERCENT },
++	{ KTD202X_REG_PWM2_TIMER, KTD202X_FLASH_ON_TIME_0_4_PERCENT },
++	{ KTD202X_REG_CHANNEL_CTRL, KTD202X_CHANNEL_CTRL_OFF },
++	{ KTD202X_REG_TRISE_FALL, KTD202X_RAMP_TIMES_2_MS },
++	{ KTD202X_REG_LED_IOUT(0), KTD202X_LED_CURRENT_10_mA },
++	{ KTD202X_REG_LED_IOUT(1), KTD202X_LED_CURRENT_10_mA },
++	{ KTD202X_REG_LED_IOUT(2), KTD202X_LED_CURRENT_10_mA },
++	{ KTD202X_REG_LED_IOUT(3), KTD202X_LED_CURRENT_10_mA },
++};
++
++struct ktd202x_led {
++	struct ktd202x *chip;
++	union {
++		struct led_classdev cdev;
++		struct led_classdev_mc mcdev;
++	};
++	u32 index;
++};
++
++struct ktd202x {
++	struct mutex mutex;
++	struct regulator_bulk_data regulators[2];
++	struct device *dev;
++	struct regmap *regmap;
++	bool enabled;
++	int num_leds;
++	struct ktd202x_led leds[] __counted_by(num_leds);
++};
++
++static int ktd202x_chip_disable(struct ktd202x *chip)
++{
++	int ret;
++
++	if (!chip->enabled)
++		return 0;
++
++	regmap_write(chip->regmap, KTD202X_REG_RESET_CONTROL, KTD202X_ENABLE_CTRL_SLEEP);
++
++	ret = regulator_bulk_disable(ARRAY_SIZE(chip->regulators), chip->regulators);
++	if (ret) {
++		dev_err(chip->dev, "Failed to disable regulators: %d\n", ret);
++		return ret;
++	}
++
++	chip->enabled = false;
++	return 0;
++}
++
++static int ktd202x_chip_enable(struct ktd202x *chip)
++{
++	int ret;
++
++	if (chip->enabled)
++		return 0;
++
++	ret = regulator_bulk_enable(ARRAY_SIZE(chip->regulators), chip->regulators);
++	if (ret) {
++		dev_err(chip->dev, "Failed to enable regulators: %d\n", ret);
++		return ret;
++	}
++	chip->enabled = true;
++
++	ret = regmap_write(chip->regmap, KTD202X_REG_RESET_CONTROL, KTD202X_ENABLE_CTRL_WAKE);
++
++	if (ret) {
++		dev_err(chip->dev, "Failed to enable the chip: %d\n", ret);
++		ktd202x_chip_disable(chip);
++	}
++
++	return ret;
++}
++
++static bool ktd202x_chip_in_use(struct ktd202x *chip)
++{
++	int i;
++
++	for (i = 0; i < chip->num_leds; i++) {
++		if (chip->leds[i].cdev.brightness)
++			return true;
++	}
++
++	return false;
++}
++
++static int ktd202x_brightness_set(struct ktd202x_led *led,
++				  struct mc_subled *subleds,
++				  unsigned int num_channels)
++{
++	bool mode_blink = false;
++	int channel;
++	int state;
++	int ret;
++	int i;
++
++	if (ktd202x_chip_in_use(led->chip)) {
++		ret = ktd202x_chip_enable(led->chip);
++		if (ret)
++			return ret;
++	}
++
++	ret = regmap_read(led->chip->regmap, KTD202X_REG_CHANNEL_CTRL, &state);
++	if (ret)
++		return ret;
++
++	/*
++	 * In multicolor case, assume blink mode if PWM is set for at least one
++	 * channel because another channel cannot be in state ON at the same time
++	 */
++	for (i = 0; i < num_channels; i++) {
++		int channel_state;
++
++		channel = subleds[i].channel;
++		channel_state = (state >> 2 * channel) & KTD202X_CHANNEL_CTRL_MASK(0);
++		if (channel_state == KTD202X_CHANNEL_CTRL_OFF)
++			continue;
++		mode_blink = channel_state == KTD202X_CHANNEL_CTRL_PWM1(0);
++		break;
++	}
++
++	for (i = 0; i < num_channels; i++) {
++		enum led_brightness brightness;
++		int mode;
++
++		brightness = subleds[i].brightness;
++		channel = subleds[i].channel;
++
++		if (brightness) {
++			/* Register expects brightness between 0 and MAX_BRIGHTNESS - 1 */
++			ret = regmap_write(led->chip->regmap, KTD202X_REG_LED_IOUT(channel),
++					   brightness - 1);
++			if (ret)
++				return ret;
++
++			if (mode_blink)
++				mode = KTD202X_CHANNEL_CTRL_PWM1(channel);
++			else
++				mode = KTD202X_CHANNEL_CTRL_ON(channel);
++		} else {
++			mode = KTD202X_CHANNEL_CTRL_OFF;
++		}
++		ret = regmap_update_bits(led->chip->regmap, KTD202X_REG_CHANNEL_CTRL,
++					 KTD202X_CHANNEL_CTRL_MASK(channel), mode);
++		if (ret)
++			return ret;
++	}
++
++	if (!ktd202x_chip_in_use(led->chip))
++		return ktd202x_chip_disable(led->chip);
++
++	return 0;
++}
++
++static int ktd202x_brightness_single_set(struct led_classdev *cdev,
++					 enum led_brightness value)
++{
++	struct ktd202x_led *led = container_of(cdev, struct ktd202x_led, cdev);
++	struct mc_subled info;
++	int ret;
++
++	cdev->brightness = value;
++
++	mutex_lock(&led->chip->mutex);
++
++	info.brightness = value;
++	info.channel = led->index;
++	ret = ktd202x_brightness_set(led, &info, 1);
++
++	mutex_unlock(&led->chip->mutex);
++
++	return ret;
++}
++
++static int ktd202x_brightness_mc_set(struct led_classdev *cdev,
++				     enum led_brightness value)
++{
++	struct led_classdev_mc *mc = lcdev_to_mccdev(cdev);
++	struct ktd202x_led *led = container_of(mc, struct ktd202x_led, mcdev);
++	int ret;
++
++	cdev->brightness = value;
++
++	mutex_lock(&led->chip->mutex);
++
++	led_mc_calc_color_components(mc, value);
++	ret = ktd202x_brightness_set(led, mc->subled_info, mc->num_colors);
++
++	mutex_unlock(&led->chip->mutex);
++
++	return ret;
++}
++
++static int ktd202x_blink_set(struct ktd202x_led *led, unsigned long *delay_on,
++			     unsigned long *delay_off, struct mc_subled *subleds,
++			     unsigned int num_channels)
++{
++	unsigned long delay_total_ms;
++	int ret, num_steps, on;
++	u8 ctrl_mask = 0;
++	u8 ctrl_pwm1 = 0;
++	u8 ctrl_on = 0;
++	int i;
++
++	mutex_lock(&led->chip->mutex);
++
++	for (i = 0; i < num_channels; i++) {
++		int channel = subleds[i].channel;
++
++		ctrl_mask |= KTD202X_CHANNEL_CTRL_MASK(channel);
++		ctrl_on |= KTD202X_CHANNEL_CTRL_ON(channel);
++		ctrl_pwm1 |= KTD202X_CHANNEL_CTRL_PWM1(channel);
++	}
++
++	/* Never off - brightness is already set, disable blinking */
++	if (!*delay_off) {
++		ret = regmap_update_bits(led->chip->regmap, KTD202X_REG_CHANNEL_CTRL,
++					 ctrl_mask, ctrl_on);
++		goto out;
++	}
++
++	/* Convert into values the HW will understand. */
++
++	/* Integer representation of time of flash period */
++	num_steps = (*delay_on + *delay_off - KTD202X_FLASH_PERIOD_MIN_MS) /
++		    KTD202X_FLASH_PERIOD_STEP_MS;
++	num_steps = clamp(num_steps, 0, KTD202X_FLASH_PERIOD_MAX_STEPS);
++
++	/* Integer representation of percentage of LED ON time */
++	on = (*delay_on * KTD202X_FLASH_ON_MAX) / (*delay_on + *delay_off);
++
++	/* Actually used delay_{on,off} values */
++	delay_total_ms = num_steps * KTD202X_FLASH_PERIOD_STEP_MS + KTD202X_FLASH_PERIOD_MIN_MS;
++	*delay_on = (delay_total_ms * on) / KTD202X_FLASH_ON_MAX;
++	*delay_off = delay_total_ms - *delay_on;
++
++	/* Set timings */
++	ret = regmap_write(led->chip->regmap, KTD202X_REG_FLASH_PERIOD, num_steps);
++	if (ret)
++		goto out;
++
++	ret = regmap_write(led->chip->regmap, KTD202X_REG_PWM1_TIMER, on);
++	if (ret)
++		goto out;
++
++	ret = regmap_update_bits(led->chip->regmap, KTD202X_REG_CHANNEL_CTRL,
++				 ctrl_mask, ctrl_pwm1);
++out:
++	mutex_unlock(&led->chip->mutex);
++	return ret;
++}
++
++static int ktd202x_blink_single_set(struct led_classdev *cdev,
++				    unsigned long *delay_on,
++				    unsigned long *delay_off)
++{
++	struct ktd202x_led *led = container_of(cdev, struct ktd202x_led, cdev);
++	struct mc_subled info;
++	int ret;
++
++	if (!cdev->brightness) {
++		ret = ktd202x_brightness_single_set(cdev, KTD202X_MAX_BRIGHTNESS);
++		if (ret)
++			return ret;
++	}
++
++	/* If no blink specified, default to 1 Hz. */
++	if (!*delay_off && !*delay_on) {
++		*delay_off = 500;
++		*delay_on = 500;
++	}
++
++	/* Never on - just set to off */
++	if (!*delay_on)
++		return ktd202x_brightness_single_set(cdev, LED_OFF);
++
++	info.channel = led->index;
++
++	return ktd202x_blink_set(led, delay_on, delay_off, &info, 1);
++}
++
++static int ktd202x_blink_mc_set(struct led_classdev *cdev,
++				unsigned long *delay_on,
++				unsigned long *delay_off)
++{
++	struct led_classdev_mc *mc = lcdev_to_mccdev(cdev);
++	struct ktd202x_led *led = container_of(mc, struct ktd202x_led, mcdev);
++	int ret;
++
++	if (!cdev->brightness) {
++		ret = ktd202x_brightness_mc_set(cdev, KTD202X_MAX_BRIGHTNESS);
++		if (ret)
++			return ret;
++	}
++
++	/* If no blink specified, default to 1 Hz. */
++	if (!*delay_off && !*delay_on) {
++		*delay_off = 500;
++		*delay_on = 500;
++	}
++
++	/* Never on - just set to off */
++	if (!*delay_on)
++		return ktd202x_brightness_mc_set(cdev, LED_OFF);
++
++	return ktd202x_blink_set(led, delay_on, delay_off, mc->subled_info,
++				 mc->num_colors);
++}
++
++static int ktd202x_setup_led_rgb(struct ktd202x *chip, struct device_node *np,
++				 struct ktd202x_led *led, struct led_init_data *init_data)
++{
++	struct led_classdev *cdev;
++	struct device_node *child;
++	struct mc_subled *info;
++	int num_channels;
++	int i = 0;
++
++	num_channels = of_get_available_child_count(np);
++	if (!num_channels || num_channels > chip->num_leds)
++		return -EINVAL;
++
++	info = devm_kcalloc(chip->dev, num_channels, sizeof(*info), GFP_KERNEL);
++	if (!info)
++		return -ENOMEM;
++
++	for_each_available_child_of_node(np, child) {
++		u32 mono_color;
++		u32 reg;
++		int ret;
++
++		ret = of_property_read_u32(child, "reg", &reg);
++		if (ret != 0 || reg >= chip->num_leds) {
++			dev_err(chip->dev, "invalid 'reg' of %pOFn\n", child);
++			of_node_put(child);
++			return -EINVAL;
++		}
++
++		ret = of_property_read_u32(child, "color", &mono_color);
++		if (ret < 0 && ret != -EINVAL) {
++			dev_err(chip->dev, "failed to parse 'color' of %pOF\n", child);
++			of_node_put(child);
++			return ret;
++		}
++
++		info[i].color_index = mono_color;
++		info[i].channel = reg;
++		info[i].intensity = KTD202X_MAX_BRIGHTNESS;
++		i++;
++	}
++
++	led->mcdev.subled_info = info;
++	led->mcdev.num_colors = num_channels;
++
++	cdev = &led->mcdev.led_cdev;
++	cdev->brightness_set_blocking = ktd202x_brightness_mc_set;
++	cdev->blink_set = ktd202x_blink_mc_set;
++
++	return devm_led_classdev_multicolor_register_ext(chip->dev, &led->mcdev, init_data);
++}
++
++static int ktd202x_setup_led_single(struct ktd202x *chip, struct device_node *np,
++				    struct ktd202x_led *led, struct led_init_data *init_data)
++{
++	struct led_classdev *cdev;
++	u32 reg;
++	int ret;
++
++	ret = of_property_read_u32(np, "reg", &reg);
++	if (ret != 0 || reg >= chip->num_leds) {
++		dev_err(chip->dev, "invalid 'reg' of %pOFn\n", np);
++		return -EINVAL;
++	}
++	led->index = reg;
++
++	cdev = &led->cdev;
++	cdev->brightness_set_blocking = ktd202x_brightness_single_set;
++	cdev->blink_set = ktd202x_blink_single_set;
++
++	return devm_led_classdev_register_ext(chip->dev, &led->cdev, init_data);
++}
++
++static int ktd202x_add_led(struct ktd202x *chip, struct device_node *np, unsigned int index)
++{
++	struct ktd202x_led *led = &chip->leds[index];
++	struct led_init_data init_data = {};
++	struct led_classdev *cdev;
++	u32 color;
++	int ret;
++
++	/* Color property is optional in single color case */
++	ret = of_property_read_u32(np, "color", &color);
++	if (ret < 0 && ret != -EINVAL) {
++		dev_err(chip->dev, "failed to parse 'color' of %pOF\n", np);
++		return ret;
++	}
++
++	led->chip = chip;
++	init_data.fwnode = of_fwnode_handle(np);
++
++	if (color == LED_COLOR_ID_RGB) {
++		cdev = &led->mcdev.led_cdev;
++		ret = ktd202x_setup_led_rgb(chip, np, led, &init_data);
++	} else {
++		cdev = &led->cdev;
++		ret = ktd202x_setup_led_single(chip, np, led, &init_data);
++	}
++
++	if (ret) {
++		dev_err(chip->dev, "unable to register %s\n", cdev->name);
++		return ret;
++	}
++
++	cdev->max_brightness = KTD202X_MAX_BRIGHTNESS;
++
++	return 0;
++}
++
++static int ktd202x_probe_dt(struct ktd202x *chip)
++{
++	struct device_node *np = dev_of_node(chip->dev), *child;
++	int count;
++	int i = 0;
++
++	chip->num_leds = (int)(unsigned long)of_device_get_match_data(chip->dev);
++
++	count = of_get_available_child_count(np);
++	if (!count || count > chip->num_leds)
++		return -EINVAL;
++
++	regmap_write(chip->regmap, KTD202X_REG_RESET_CONTROL, KTD202X_RSTR_RESET);
++
++	/* Allow the device to execute the complete reset */
++	usleep_range(200, 300);
++
++	for_each_available_child_of_node(np, child) {
++		int ret = ktd202x_add_led(chip, child, i);
++
++		if (ret) {
++			of_node_put(child);
++			return ret;
++		}
++		i++;
++	}
++
++	return 0;
++}
++
++static const struct regmap_config ktd202x_regmap_config = {
++	.reg_bits = 8,
++	.val_bits = 8,
++	.max_register = 0x09,
++	.cache_type = REGCACHE_FLAT,
++	.reg_defaults = ktd202x_reg_defaults,
++	.num_reg_defaults = ARRAY_SIZE(ktd202x_reg_defaults),
++};
++
++static int ktd202x_probe(struct i2c_client *client)
++{
++	struct device *dev = &client->dev;
++	struct ktd202x *chip;
++	int count;
++	int ret;
++
++	count = device_get_child_node_count(dev);
++	if (!count || count > KTD202X_MAX_LEDS)
++		return dev_err_probe(dev, -EINVAL, "Incorrect number of leds (%d)", count);
++
++	chip = devm_kzalloc(dev, struct_size(chip, leds, count), GFP_KERNEL);
++	if (!chip)
++		return -ENOMEM;
++
++	chip->dev = dev;
++	i2c_set_clientdata(client, chip);
++
++	chip->regmap = devm_regmap_init_i2c(client, &ktd202x_regmap_config);
++	if (IS_ERR(chip->regmap)) {
++		ret = dev_err_probe(dev, PTR_ERR(chip->regmap),
++				    "Failed to allocate register map.\n");
++		return ret;
++	}
++
++	chip->regulators[0].supply = "vin";
++	chip->regulators[1].supply = "vio";
++	ret = devm_regulator_bulk_get(dev, ARRAY_SIZE(chip->regulators), chip->regulators);
++	if (ret < 0) {
++		dev_err_probe(dev, ret, "Failed to request regulators.\n");
++		return ret;
++	}
++
++	ret = regulator_bulk_enable(ARRAY_SIZE(chip->regulators), chip->regulators);
++	if (ret) {
++		dev_err_probe(dev, ret, "Failed to enable regulators.\n");
++		return ret;
++	}
++
++	ret = ktd202x_probe_dt(chip);
++	if (ret < 0) {
++		regulator_bulk_disable(ARRAY_SIZE(chip->regulators), chip->regulators);
++		return ret;
++	}
++
++	ret = regulator_bulk_disable(ARRAY_SIZE(chip->regulators), chip->regulators);
++	if (ret) {
++		dev_err_probe(dev, ret, "Failed to disable regulators.\n");
++		return ret;
++	}
++
++	mutex_init(&chip->mutex);
++
++	return 0;
++}
++
++static void ktd202x_remove(struct i2c_client *client)
++{
++	struct ktd202x *chip = i2c_get_clientdata(client);
++
++	ktd202x_chip_disable(chip);
++
++	mutex_destroy(&chip->mutex);
++}
++
++static void ktd202x_shutdown(struct i2c_client *client)
++{
++	struct ktd202x *chip = i2c_get_clientdata(client);
++
++	/* Reset registers to make sure all LEDs are off before shutdown */
++	regmap_write(chip->regmap, KTD202X_REG_RESET_CONTROL, KTD202X_RSTR_RESET);
++}
++
++static const struct of_device_id ktd202x_match_table[] = {
++	{ .compatible = "kinetic,ktd2026", .data = (void *)KTD2026_NUM_LEDS },
++	{ .compatible = "kinetic,ktd2027", .data = (void *)KTD2027_NUM_LEDS },
++	{},
++};
++MODULE_DEVICE_TABLE(of, ktd202x_match_table);
++
++static struct i2c_driver ktd202x_driver = {
++	.driver = {
++		.name = "leds-ktd202x",
++		.of_match_table = ktd202x_match_table,
++	},
++	.probe = ktd202x_probe,
++	.remove = ktd202x_remove,
++	.shutdown = ktd202x_shutdown,
++};
++module_i2c_driver(ktd202x_driver);
++
++MODULE_AUTHOR("André Apitzsch <git@apitzsch.eu>");
++MODULE_DESCRIPTION("Kinetic KTD2026/7 LED driver");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/generic/backport-6.6/861-v6.10-leds-rgb-leds-ktd202x-get-device-properties-through-fwnode.patch b/target/linux/generic/backport-6.6/861-v6.10-leds-rgb-leds-ktd202x-get-device-properties-through-fwnode.patch
new file mode 100644
index 00000000000000..92b20c3b9c2ea2
--- /dev/null
+++ b/target/linux/generic/backport-6.6/861-v6.10-leds-rgb-leds-ktd202x-get-device-properties-through-fwnode.patch
@@ -0,0 +1,221 @@
+From f14aa5ea415b8add245e976bfab96a12986c6843 Mon Sep 17 00:00:00 2001
+From: Kate Hsuan <hpa@redhat.com>
+Date: Fri, 31 May 2024 13:41:19 +0200
+Subject: leds: rgb: leds-ktd202x: Get device properties through fwnode to
+ support ACPI
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This LED controller is installed on a Xiaomi pad2 and it is an x86
+platform. The original driver is based on the device tree and can't be
+used for this ACPI based system. This patch migrated the driver to use
+fwnode to access the properties. Moreover, the fwnode API supports the
+device tree so this work won't affect the original implementations.
+
+Signed-off-by: Kate Hsuan <hpa@redhat.com>
+Tested-by: André Apitzsch <git@apitzsch.eu> # on BQ Aquaris M5
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20240531114124.45346-2-hdegoede@redhat.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+---
+ drivers/leds/rgb/Kconfig        |  1 -
+ drivers/leds/rgb/leds-ktd202x.c | 64 ++++++++++++++++++++++-------------------
+ 2 files changed, 34 insertions(+), 31 deletions(-)
+
+(limited to 'drivers/leds/rgb')
+
+--- a/drivers/leds/rgb/Kconfig
++++ b/drivers/leds/rgb/Kconfig
+@@ -17,7 +17,6 @@ config LEDS_GROUP_MULTICOLOR
+ config LEDS_KTD202X
+ 	tristate "LED support for KTD202x Chips"
+ 	depends on I2C
+-	depends on OF
+ 	select REGMAP_I2C
+ 	help
+ 	  This option enables support for the Kinetic KTD2026/KTD2027
+--- a/drivers/leds/rgb/leds-ktd202x.c
++++ b/drivers/leds/rgb/leds-ktd202x.c
+@@ -99,7 +99,7 @@ struct ktd202x {
+ 	struct device *dev;
+ 	struct regmap *regmap;
+ 	bool enabled;
+-	int num_leds;
++	unsigned long num_leds;
+ 	struct ktd202x_led leds[] __counted_by(num_leds);
+ };
+ 
+@@ -381,16 +381,19 @@ static int ktd202x_blink_mc_set(struct l
+ 				 mc->num_colors);
+ }
+ 
+-static int ktd202x_setup_led_rgb(struct ktd202x *chip, struct device_node *np,
++static int ktd202x_setup_led_rgb(struct ktd202x *chip, struct fwnode_handle *fwnode,
+ 				 struct ktd202x_led *led, struct led_init_data *init_data)
+ {
++	struct fwnode_handle *child;
+ 	struct led_classdev *cdev;
+-	struct device_node *child;
+ 	struct mc_subled *info;
+ 	int num_channels;
+ 	int i = 0;
+ 
+-	num_channels = of_get_available_child_count(np);
++	num_channels = 0;
++	fwnode_for_each_available_child_node(fwnode, child)
++		num_channels++;
++
+ 	if (!num_channels || num_channels > chip->num_leds)
+ 		return -EINVAL;
+ 
+@@ -398,22 +401,22 @@ static int ktd202x_setup_led_rgb(struct
+ 	if (!info)
+ 		return -ENOMEM;
+ 
+-	for_each_available_child_of_node(np, child) {
++	fwnode_for_each_available_child_node(fwnode, child) {
+ 		u32 mono_color;
+ 		u32 reg;
+ 		int ret;
+ 
+-		ret = of_property_read_u32(child, "reg", &reg);
++		ret = fwnode_property_read_u32(child, "reg", &reg);
+ 		if (ret != 0 || reg >= chip->num_leds) {
+-			dev_err(chip->dev, "invalid 'reg' of %pOFn\n", child);
+-			of_node_put(child);
+-			return -EINVAL;
++			dev_err(chip->dev, "invalid 'reg' of %pfw\n", child);
++			fwnode_handle_put(child);
++			return ret;
+ 		}
+ 
+-		ret = of_property_read_u32(child, "color", &mono_color);
++		ret = fwnode_property_read_u32(child, "color", &mono_color);
+ 		if (ret < 0 && ret != -EINVAL) {
+-			dev_err(chip->dev, "failed to parse 'color' of %pOF\n", child);
+-			of_node_put(child);
++			dev_err(chip->dev, "failed to parse 'color' of %pfw\n", child);
++			fwnode_handle_put(child);
+ 			return ret;
+ 		}
+ 
+@@ -433,16 +436,16 @@ static int ktd202x_setup_led_rgb(struct
+ 	return devm_led_classdev_multicolor_register_ext(chip->dev, &led->mcdev, init_data);
+ }
+ 
+-static int ktd202x_setup_led_single(struct ktd202x *chip, struct device_node *np,
++static int ktd202x_setup_led_single(struct ktd202x *chip, struct fwnode_handle *fwnode,
+ 				    struct ktd202x_led *led, struct led_init_data *init_data)
+ {
+ 	struct led_classdev *cdev;
+ 	u32 reg;
+ 	int ret;
+ 
+-	ret = of_property_read_u32(np, "reg", &reg);
++	ret = fwnode_property_read_u32(fwnode, "reg", &reg);
+ 	if (ret != 0 || reg >= chip->num_leds) {
+-		dev_err(chip->dev, "invalid 'reg' of %pOFn\n", np);
++		dev_err(chip->dev, "invalid 'reg' of %pfw\n", fwnode);
+ 		return -EINVAL;
+ 	}
+ 	led->index = reg;
+@@ -454,7 +457,7 @@ static int ktd202x_setup_led_single(stru
+ 	return devm_led_classdev_register_ext(chip->dev, &led->cdev, init_data);
+ }
+ 
+-static int ktd202x_add_led(struct ktd202x *chip, struct device_node *np, unsigned int index)
++static int ktd202x_add_led(struct ktd202x *chip, struct fwnode_handle *fwnode, unsigned int index)
+ {
+ 	struct ktd202x_led *led = &chip->leds[index];
+ 	struct led_init_data init_data = {};
+@@ -463,21 +466,21 @@ static int ktd202x_add_led(struct ktd202
+ 	int ret;
+ 
+ 	/* Color property is optional in single color case */
+-	ret = of_property_read_u32(np, "color", &color);
++	ret = fwnode_property_read_u32(fwnode, "color", &color);
+ 	if (ret < 0 && ret != -EINVAL) {
+-		dev_err(chip->dev, "failed to parse 'color' of %pOF\n", np);
++		dev_err(chip->dev, "failed to parse 'color' of %pfw\n", fwnode);
+ 		return ret;
+ 	}
+ 
+ 	led->chip = chip;
+-	init_data.fwnode = of_fwnode_handle(np);
++	init_data.fwnode = fwnode;
+ 
+ 	if (color == LED_COLOR_ID_RGB) {
+ 		cdev = &led->mcdev.led_cdev;
+-		ret = ktd202x_setup_led_rgb(chip, np, led, &init_data);
++		ret = ktd202x_setup_led_rgb(chip, fwnode, led, &init_data);
+ 	} else {
+ 		cdev = &led->cdev;
+-		ret = ktd202x_setup_led_single(chip, np, led, &init_data);
++		ret = ktd202x_setup_led_single(chip, fwnode, led, &init_data);
+ 	}
+ 
+ 	if (ret) {
+@@ -490,15 +493,14 @@ static int ktd202x_add_led(struct ktd202
+ 	return 0;
+ }
+ 
+-static int ktd202x_probe_dt(struct ktd202x *chip)
++static int ktd202x_probe_fw(struct ktd202x *chip)
+ {
+-	struct device_node *np = dev_of_node(chip->dev), *child;
++	struct fwnode_handle *child;
++	struct device *dev = chip->dev;
+ 	int count;
+ 	int i = 0;
+ 
+-	chip->num_leds = (int)(unsigned long)of_device_get_match_data(chip->dev);
+-
+-	count = of_get_available_child_count(np);
++	count = device_get_child_node_count(dev);
+ 	if (!count || count > chip->num_leds)
+ 		return -EINVAL;
+ 
+@@ -507,11 +509,11 @@ static int ktd202x_probe_dt(struct ktd20
+ 	/* Allow the device to execute the complete reset */
+ 	usleep_range(200, 300);
+ 
+-	for_each_available_child_of_node(np, child) {
++	device_for_each_child_node(dev, child) {
+ 		int ret = ktd202x_add_led(chip, child, i);
+ 
+ 		if (ret) {
+-			of_node_put(child);
++			fwnode_handle_put(child);
+ 			return ret;
+ 		}
+ 		i++;
+@@ -554,6 +556,8 @@ static int ktd202x_probe(struct i2c_clie
+ 		return ret;
+ 	}
+ 
++	chip->num_leds = (unsigned long)i2c_get_match_data(client);
++
+ 	chip->regulators[0].supply = "vin";
+ 	chip->regulators[1].supply = "vio";
+ 	ret = devm_regulator_bulk_get(dev, ARRAY_SIZE(chip->regulators), chip->regulators);
+@@ -568,7 +572,7 @@ static int ktd202x_probe(struct i2c_clie
+ 		return ret;
+ 	}
+ 
+-	ret = ktd202x_probe_dt(chip);
++	ret = ktd202x_probe_fw(chip);
+ 	if (ret < 0) {
+ 		regulator_bulk_disable(ARRAY_SIZE(chip->regulators), chip->regulators);
+ 		return ret;
+@@ -605,7 +609,7 @@ static void ktd202x_shutdown(struct i2c_
+ static const struct of_device_id ktd202x_match_table[] = {
+ 	{ .compatible = "kinetic,ktd2026", .data = (void *)KTD2026_NUM_LEDS },
+ 	{ .compatible = "kinetic,ktd2027", .data = (void *)KTD2027_NUM_LEDS },
+-	{},
++	{}
+ };
+ MODULE_DEVICE_TABLE(of, ktd202x_match_table);
+ 
diff --git a/target/linux/generic/backport-6.6/862-v6.10-leds-rgb-leds-ktd202x-i2c-id-tables-for-ktd2026-and-2027.patch b/target/linux/generic/backport-6.6/862-v6.10-leds-rgb-leds-ktd202x-i2c-id-tables-for-ktd2026-and-2027.patch
new file mode 100644
index 00000000000000..223ccd8f50c764
--- /dev/null
+++ b/target/linux/generic/backport-6.6/862-v6.10-leds-rgb-leds-ktd202x-i2c-id-tables-for-ktd2026-and-2027.patch
@@ -0,0 +1,49 @@
+From 75bd07aef47e1a984229e6ec702e8b9aee0226e4 Mon Sep 17 00:00:00 2001
+From: Kate Hsuan <hpa@redhat.com>
+Date: Fri, 31 May 2024 13:41:20 +0200
+Subject: leds: rgb: leds-ktd202x: I2C ID tables for KTD2026 and 2027
+
+Add an i2c_device_id id_table to match manually instantiated
+(non device-tree / ACPI instantiated) KTD202x controllers as
+found on some x86 boards.
+
+This table shows the maximum support LED channel for KTD2026
+(three LEDs) and KTD-2027 (4 LEDs).
+
+Link: https://www.kinet-ic.com/uploads/KTD2026-7-04h.pdf
+Signed-off-by: Kate Hsuan <hpa@redhat.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20240531114124.45346-3-hdegoede@redhat.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+---
+ drivers/leds/rgb/leds-ktd202x.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+(limited to 'drivers/leds/rgb')
+
+--- a/drivers/leds/rgb/leds-ktd202x.c
++++ b/drivers/leds/rgb/leds-ktd202x.c
+@@ -606,6 +606,13 @@ static void ktd202x_shutdown(struct i2c_
+ 	regmap_write(chip->regmap, KTD202X_REG_RESET_CONTROL, KTD202X_RSTR_RESET);
+ }
+ 
++static const struct i2c_device_id ktd202x_id[] = {
++	{"ktd2026", KTD2026_NUM_LEDS},
++	{"ktd2027", KTD2027_NUM_LEDS},
++	{}
++};
++MODULE_DEVICE_TABLE(i2c, ktd202x_id);
++
+ static const struct of_device_id ktd202x_match_table[] = {
+ 	{ .compatible = "kinetic,ktd2026", .data = (void *)KTD2026_NUM_LEDS },
+ 	{ .compatible = "kinetic,ktd2027", .data = (void *)KTD2027_NUM_LEDS },
+@@ -621,6 +628,7 @@ static struct i2c_driver ktd202x_driver
+ 	.probe = ktd202x_probe,
+ 	.remove = ktd202x_remove,
+ 	.shutdown = ktd202x_shutdown,
++	.id_table = ktd202x_id,
+ };
+ module_i2c_driver(ktd202x_driver);
+ 
diff --git a/target/linux/generic/backport-6.6/863-v6.10-leds-rgb-leds-ktd202x-initialize-mutex-earlier.patch b/target/linux/generic/backport-6.6/863-v6.10-leds-rgb-leds-ktd202x-initialize-mutex-earlier.patch
new file mode 100644
index 00000000000000..533b0f0e170749
--- /dev/null
+++ b/target/linux/generic/backport-6.6/863-v6.10-leds-rgb-leds-ktd202x-initialize-mutex-earlier.patch
@@ -0,0 +1,62 @@
+From e1b08c6f5b92d408a9fcc1030a340caeb9852250 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Fri, 31 May 2024 13:41:21 +0200
+Subject: leds: rgb: leds-ktd202x: Initialize mutex earlier
+
+The mutex must be initialized before the LED class device is registered
+otherwise there is a race where it may get used before it is initialized:
+
+ DEBUG_LOCKS_WARN_ON(lock->magic != lock)
+ WARNING: CPU: 2 PID: 2045 at kernel/locking/mutex.c:587 __mutex_lock
+ ...
+ RIP: 0010:__mutex_lock+0x7db/0xc10
+ ...
+ set_brightness_delayed_set_brightness.part.0+0x17/0x60
+ set_brightness_delayed+0xf1/0x100
+ process_one_work+0x222/0x5a0
+
+Move the mutex_init() call earlier to avoid this race condition and
+switch to devm_mutex_init() to avoid the need to add error-exit
+cleanup to probe() if probe() fails later on.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Link: https://lore.kernel.org/r/20240531114124.45346-4-hdegoede@redhat.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+---
+ drivers/leds/rgb/leds-ktd202x.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+(limited to 'drivers/leds/rgb')
+
+--- a/drivers/leds/rgb/leds-ktd202x.c
++++ b/drivers/leds/rgb/leds-ktd202x.c
+@@ -556,6 +556,10 @@ static int ktd202x_probe(struct i2c_clie
+ 		return ret;
+ 	}
+ 
++	ret = devm_mutex_init(dev, &chip->mutex);
++	if (ret)
++		return ret;
++
+ 	chip->num_leds = (unsigned long)i2c_get_match_data(client);
+ 
+ 	chip->regulators[0].supply = "vin";
+@@ -584,8 +588,6 @@ static int ktd202x_probe(struct i2c_clie
+ 		return ret;
+ 	}
+ 
+-	mutex_init(&chip->mutex);
+-
+ 	return 0;
+ }
+ 
+@@ -594,8 +596,6 @@ static void ktd202x_remove(struct i2c_cl
+ 	struct ktd202x *chip = i2c_get_clientdata(client);
+ 
+ 	ktd202x_chip_disable(chip);
+-
+-	mutex_destroy(&chip->mutex);
+ }
+ 
+ static void ktd202x_shutdown(struct i2c_client *client)

From e44180d45cc4aa24d2d8df55de49b3627ea4d168 Mon Sep 17 00:00:00 2001
From: George Oldfort <openwrt@10099.de>
Date: Tue, 26 Nov 2024 15:14:56 +0100
Subject: [PATCH 069/225] mediatek: filogic: add KTD2026/7 driver to Acer
 Connect Vero W6m

This commit adds kmod-leds-ktd202x to the OpenWrt image for the device
"Acer Connect Vero W6m" which is equipped with one KTD2026 controlling the
device's status LED via I2C.

Signed-off-by: George Oldfort <openwrt@10099.de>
Link: https://github.com/openwrt/openwrt/pull/16860
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 target/linux/mediatek/image/filogic.mk | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/linux/mediatek/image/filogic.mk b/target/linux/mediatek/image/filogic.mk
index 3a36fbc46b8dcb..672790f1a77698 100644
--- a/target/linux/mediatek/image/filogic.mk
+++ b/target/linux/mediatek/image/filogic.mk
@@ -186,7 +186,7 @@ define Device/acer_vero-w6m
   DEVICE_DTS := mt7986a-acer-vero-w6m
   DEVICE_DTS_DIR := ../dts
   DEVICE_DTS_LOADADDR := 0x47000000
-  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7916-firmware kmod-mt7986-firmware mt7986-wo-firmware e2fsprogs f2fsck mkf2fs
+  DEVICE_PACKAGES := kmod-leds-ktd202x kmod-mt7915e kmod-mt7916-firmware kmod-mt7986-firmware mt7986-wo-firmware e2fsprogs f2fsck mkf2fs
   IMAGES := sysupgrade.bin
   KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
   KERNEL_INITRAMFS := kernel-bin | lzma | \

From 30ae0b3f1e331646054d8110e931dfaa32f7b414 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
Date: Wed, 27 Nov 2024 08:39:46 +0000
Subject: [PATCH 070/225] mediatek: filogic: Cudy WR3000S v1: fix CRLF line
 endings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

DTS file for this device seems to be using CRLF line endings, so lets
convert them into Unix-style LF.

Fixes: faf4b3e0f7a5 ("mediatek: filogic: add support for Cudy WR3000S v1")
Link: https://github.com/openwrt/openwrt/pull/17096
Signed-off-by: Petr Štetiar <ynezz@true.cz>
---
 .../mediatek/dts/mt7981b-cudy-wr3000s-v1.dts  | 566 +++++++++---------
 1 file changed, 283 insertions(+), 283 deletions(-)

diff --git a/target/linux/mediatek/dts/mt7981b-cudy-wr3000s-v1.dts b/target/linux/mediatek/dts/mt7981b-cudy-wr3000s-v1.dts
index a6439694943352..cf2f79b40770f9 100644
--- a/target/linux/mediatek/dts/mt7981b-cudy-wr3000s-v1.dts
+++ b/target/linux/mediatek/dts/mt7981b-cudy-wr3000s-v1.dts
@@ -1,283 +1,283 @@
-// SPDX-License-Identifier: (GPL-2.0 OR MIT)
-
-/dts-v1/;
-
-#include <dt-bindings/leds/common.h>
-
-#include "mt7981.dtsi"
-
-/ {
-	model = "Cudy WR3000S v1";
-	compatible = "cudy,wr3000s-v1", "mediatek,mt7981-spim-snand-rfb";
-
-	aliases {
-		label-mac-device = &gmac0;
-		led-boot = &led_status;
-		led-failsafe = &led_status;
-		led-running = &led_status;
-		led-upgrade = &led_status;
-		serial0 = &uart0;
-	};
-
-	chosen {
-		stdout-path = "serial0:115200n8";
-	};
-
-	gpio-keys {
-		compatible = "gpio-keys";
-
-		reset {
-			label = "reset";
-			linux,code = <KEY_RESTART>;
-			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
-		};
-
-		wps {
-			label = "wps";
-			linux,code = <KEY_WPS_BUTTON>;
-			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
-		};
-	};
-
-	leds {
-		compatible = "gpio-leds";
-
-		led_status: led@0 {
-			function = LED_FUNCTION_STATUS;
-			color = <LED_COLOR_ID_WHITE>;
-			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
-		};
-
-
-		led_internet {
-			function = LED_FUNCTION_WAN_ONLINE;
-			color = <LED_COLOR_ID_WHITE>;
-			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
-		};
-
-		led_wps {
-			function = LED_FUNCTION_WPS;
-			color = <LED_COLOR_ID_WHITE>;
-			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
-		};
-
-		led_wlan2g {
-			function = LED_FUNCTION_WLAN_2GHZ;
-			color = <LED_COLOR_ID_WHITE>;
-			gpios = <&pio 6 GPIO_ACTIVE_LOW>;
-			linux,default-trigger = "phy0tpt";
-		};
-
-		led_wlan5g {
-			function = LED_FUNCTION_WLAN_5GHZ;
-			color = <LED_COLOR_ID_WHITE>;
-			gpios = <&pio 7 GPIO_ACTIVE_LOW>;
-			linux,default-trigger = "phy1tpt";
-		};
-	};
-};
-
-&uart0 {
-	status = "okay";
-};
-
-&watchdog {
-	status = "okay";
-};
-
-&eth {
-	pinctrl-names = "default";
-	pinctrl-0 = <&mdio_pins>;
-
-	status = "okay";
-
-	gmac0: mac@0 {
-		compatible = "mediatek,eth-mac";
-		reg = <0>;
-		phy-mode = "2500base-x";
-
-		nvmem-cell-names = "mac-address";
-		nvmem-cells = <&macaddr_bdinfo_de00 0>;
-
-		fixed-link {
-			speed = <2500>;
-			full-duplex;
-			pause;
-		};
-	};
-};
-
-&mdio_bus {
-	switch: switch@1f {
-		compatible = "mediatek,mt7531";
-		reg = <31>;
-		reset-gpios = <&pio 39 GPIO_ACTIVE_HIGH>;
-		interrupt-controller;
-		#interrupt-cells = <1>;
-		interrupt-parent = <&pio>;
-		interrupts = <38 IRQ_TYPE_LEVEL_HIGH>;
-	};
-};
-
-&spi0 {
-	pinctrl-names = "default";
-	pinctrl-0 = <&spi0_flash_pins>;
-	status = "okay";
-
-	spi_nand: flash@0 {
-		#address-cells = <1>;
-		#size-cells = <1>;
-		compatible = "spi-nand";
-		reg = <0>;
-		spi-max-frequency = <52000000>;
-
-		spi-cal-enable;
-		spi-cal-mode = "read-data";
-		spi-cal-datalen = <7>;
-		spi-cal-data = /bits/ 8 <0x53 0x50 0x49 0x4E 0x41 0x4E 0x44>;
-		spi-cal-addrlen = <5>;
-		spi-cal-addr = /bits/ 32 <0x0 0x0 0x0 0x0 0x0>;
-
-		spi-tx-bus-width = <4>;
-		spi-rx-bus-width = <4>;
-		mediatek,nmbm;
-		mediatek,bmt-max-ratio = <1>;
-		mediatek,bmt-max-reserved-blocks = <64>;
-
-		partitions {
-			compatible = "fixed-partitions";
-			#address-cells = <1>;
-			#size-cells = <1>;
-
-			partition@0 {
-				label = "BL2";
-				reg = <0x00000 0x0100000>;
-				read-only;
-			};
-
-			partition@100000 {
-				label = "u-boot-env";
-				reg = <0x0100000 0x0080000>;
-				read-only;
-			};
-
-			factory: partition@180000 {
-				label = "Factory";
-				reg = <0x180000 0x0200000>;
-				read-only;
-				nvmem-layout {
-					compatible = "fixed-layout";
-					#address-cells = <1>;
-					#size-cells = <1>;
-
-					eeprom_factory_0: eeprom@0 {
-						reg = <0x0 0x1000>;
-					};
-				};
-			};
-
-			partition@380000 {
-				label = "bdinfo";
-				reg = <0x380000 0x0040000>;
-				read-only;
-				nvmem-layout {
-					compatible = "fixed-layout";
-					#address-cells = <1>;
-					#size-cells = <1>;
-
-					macaddr_bdinfo_de00: macaddr@de00 {
-						compatible = "mac-base";
-						reg = <0xde00 0x6>;
-						#nvmem-cell-cells = <1>;
-					};
-				};
-			};
-
-			partition@3C0000 {
-				label = "FIP";
-				reg = <0x3C0000 0x0200000>;
-				read-only;
-			};
-
-			partition@580000 {
-				label = "ubi";
-				reg = <0x5C0000 0x4000000>;
-				compatible = "linux,ubi";
-			};
-		};
-	};
-};
-
-&pio {
-	spi0_flash_pins: spi0-pins {
-		mux {
-			function = "spi";
-			groups = "spi0", "spi0_wp_hold";
-		};
-		conf-pu {
-			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
-			drive-strength = <MTK_DRIVE_8mA>;
-			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
-		};
-
-		conf-pd {
-			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
-			drive-strength = <MTK_DRIVE_8mA>;
-			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
-		};
-	};
-};
-
-&switch {
-	ports {
-		#address-cells = <1>;
-		#size-cells = <0>;
-
-		port@0 {
-			reg = <0>;
-			label = "wan";
-
-			nvmem-cell-names = "mac-address";
-			nvmem-cells = <&macaddr_bdinfo_de00 1>;
-		};
-
-		port@1 {
-			reg = <1>;
-			label = "lan1";
-		};
-
-		port@2 {
-			reg = <2>;
-			label = "lan2";
-		};
-
-		port@3 {
-			reg = <3>;
-			label = "lan3";
-		};
-
-		port@4 {
-			reg = <4>;
-			label = "lan4";
-		};
-
-		port@6 {
-			reg = <6>;
-			label = "cpu";
-			ethernet = <&gmac0>;
-			phy-mode = "2500base-x";
-
-			fixed-link {
-				speed = <2500>;
-				full-duplex;
-				pause;
-			};
-		};
-	};
-};
-
-&wifi {
-	status = "okay";
-	nvmem-cells = <&eeprom_factory_0>;
-	nvmem-cell-names = "eeprom";
-};
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+
+/dts-v1/;
+
+#include <dt-bindings/leds/common.h>
+
+#include "mt7981.dtsi"
+
+/ {
+	model = "Cudy WR3000S v1";
+	compatible = "cudy,wr3000s-v1", "mediatek,mt7981-spim-snand-rfb";
+
+	aliases {
+		label-mac-device = &gmac0;
+		led-boot = &led_status;
+		led-failsafe = &led_status;
+		led-running = &led_status;
+		led-upgrade = &led_status;
+		serial0 = &uart0;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status: led@0 {
+			function = LED_FUNCTION_STATUS;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+		};
+
+
+		led_internet {
+			function = LED_FUNCTION_WAN_ONLINE;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		led_wps {
+			function = LED_FUNCTION_WPS;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+
+		led_wlan2g {
+			function = LED_FUNCTION_WLAN_2GHZ;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 6 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		led_wlan5g {
+			function = LED_FUNCTION_WLAN_5GHZ;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 7 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&eth {
+	pinctrl-names = "default";
+	pinctrl-0 = <&mdio_pins>;
+
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_bdinfo_de00 0>;
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+};
+
+&mdio_bus {
+	switch: switch@1f {
+		compatible = "mediatek,mt7531";
+		reg = <31>;
+		reset-gpios = <&pio 39 GPIO_ACTIVE_HIGH>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		interrupt-parent = <&pio>;
+		interrupts = <38 IRQ_TYPE_LEVEL_HIGH>;
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	status = "okay";
+
+	spi_nand: flash@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "spi-nand";
+		reg = <0>;
+		spi-max-frequency = <52000000>;
+
+		spi-cal-enable;
+		spi-cal-mode = "read-data";
+		spi-cal-datalen = <7>;
+		spi-cal-data = /bits/ 8 <0x53 0x50 0x49 0x4E 0x41 0x4E 0x44>;
+		spi-cal-addrlen = <5>;
+		spi-cal-addr = /bits/ 32 <0x0 0x0 0x0 0x0 0x0>;
+
+		spi-tx-bus-width = <4>;
+		spi-rx-bus-width = <4>;
+		mediatek,nmbm;
+		mediatek,bmt-max-ratio = <1>;
+		mediatek,bmt-max-reserved-blocks = <64>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "BL2";
+				reg = <0x00000 0x0100000>;
+				read-only;
+			};
+
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x0100000 0x0080000>;
+				read-only;
+			};
+
+			factory: partition@180000 {
+				label = "Factory";
+				reg = <0x180000 0x0200000>;
+				read-only;
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					eeprom_factory_0: eeprom@0 {
+						reg = <0x0 0x1000>;
+					};
+				};
+			};
+
+			partition@380000 {
+				label = "bdinfo";
+				reg = <0x380000 0x0040000>;
+				read-only;
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					macaddr_bdinfo_de00: macaddr@de00 {
+						compatible = "mac-base";
+						reg = <0xde00 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+				};
+			};
+
+			partition@3C0000 {
+				label = "FIP";
+				reg = <0x3C0000 0x0200000>;
+				read-only;
+			};
+
+			partition@580000 {
+				label = "ubi";
+				reg = <0x5C0000 0x4000000>;
+				compatible = "linux,ubi";
+			};
+		};
+	};
+};
+
+&pio {
+	spi0_flash_pins: spi0-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
+		};
+	};
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			label = "wan";
+
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_bdinfo_de00 1>;
+		};
+
+		port@1 {
+			reg = <1>;
+			label = "lan1";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan2";
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan3";
+		};
+
+		port@4 {
+			reg = <4>;
+			label = "lan4";
+		};
+
+		port@6 {
+			reg = <6>;
+			label = "cpu";
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
+&wifi {
+	status = "okay";
+	nvmem-cells = <&eeprom_factory_0>;
+	nvmem-cell-names = "eeprom";
+};

From 79db5d65ca5a19fb37e7fb428dec798f713a8632 Mon Sep 17 00:00:00 2001
From: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
Date: Mon, 3 Jun 2024 18:52:49 +0300
Subject: [PATCH 071/225] ramips: move zyimage creation to
 include/image-commands.mk

This is required for upcoming Keenetic KN-3911 support

Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16830
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 include/image-commands.mk          | 4 ++++
 target/linux/ramips/image/Makefile | 4 ----
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/image-commands.mk b/include/image-commands.mk
index 2568fb3ade5f3d..a627ffc202cc0a 100644
--- a/include/image-commands.mk
+++ b/include/image-commands.mk
@@ -732,6 +732,10 @@ define Build/zip
 	rm -rf $@.tmp
 endef
 
+define Build/zyimage
+	$(STAGING_DIR_HOST)/bin/zyimage $(1) $@
+endef
+
 define Build/zyxel-ras-image
 	let \
 		newsize="$(call exp_units,$(RAS_ROOTFS_SIZE))"; \
diff --git a/target/linux/ramips/image/Makefile b/target/linux/ramips/image/Makefile
index 569717694345c4..53b9c314ef65ec 100644
--- a/target/linux/ramips/image/Makefile
+++ b/target/linux/ramips/image/Makefile
@@ -167,10 +167,6 @@ define Build/wrg-header
 	mv $@.new $@
 endef
 
-define Build/zyimage
-	$(STAGING_DIR_HOST)/bin/zyimage $(1) $@
-endef
-
 define Device/Default
   PROFILES = Default
   BLOCKSIZE := 64k

From 0d651dd302cf2b6968268f27a084363b9b398760 Mon Sep 17 00:00:00 2001
From: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
Date: Thu, 31 Oct 2024 12:27:54 +0300
Subject: [PATCH 072/225] mediatek/filogic: enable mtd virtual concat support

This is required for upcoming Keenetic KN-3911 support

Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16830
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 target/linux/mediatek/filogic/config-6.6 | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/linux/mediatek/filogic/config-6.6 b/target/linux/mediatek/filogic/config-6.6
index 408ac5483e59c3..85e7367f41cfe5 100644
--- a/target/linux/mediatek/filogic/config-6.6
+++ b/target/linux/mediatek/filogic/config-6.6
@@ -269,6 +269,7 @@ CONFIG_MTD_UBI_BLOCK=y
 CONFIG_MTD_UBI_FASTMAP=y
 CONFIG_MTD_UBI_NVMEM=y
 CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_MTD_VIRT_CONCAT=y
 # CONFIG_MTK_CMDQ is not set
 CONFIG_MTK_CPUX_TIMER=y
 # CONFIG_MTK_CQDMA is not set

From 5a4eb56a7bc7d1d8028d103d50b0dba2ff7808c4 Mon Sep 17 00:00:00 2001
From: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
Date: Thu, 31 Oct 2024 10:30:08 +0300
Subject: [PATCH 073/225] mediatek/filogic: add Keenetic KN-3911 support

Specification:
 - MT7981 CPU using 2.4GHz and 5GHz WiFi (both AX)
 - 512MB RAM
 - 128MB SPI NAND
 - 2 LEDs (green, orange)
 - 3 buttons (fn, reset, wps)
 - 2 2.5Gbit ethernet ports based on Airoha EN8811H phy

Serial Interface:
 - 3 Pins GND, RX, TX
 - Settings: 115200, 8N1

Notes:
 - The device supports dual boot mode

Flash instruction:
The only way to flash OpenWrt image is to use tftp recovery mode in U-Boot:

1. Configure PC with static IP 192.168.1.2/24 and tftp server.
2. Rename "openwrt-mediatek-filogic-keenetic_kn-3911-squashfs-factory.bin"
   to "KN-3911_recovery.bin" and place it in tftp server directory.
3. Connect PC with ethernet port, press the reset button, power up
   the device and keep button pressed until status led start blinking.
4. Device will download file from server, write it to flash and reboot.

Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16830
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 .../mediatek/dts/mt7981b-keenetic-kn-3911.dts | 300 ++++++++++++++++++
 .../filogic/base-files/etc/board.d/02_network |  13 +-
 .../etc/hotplug.d/ieee80211/11_fix_wifi_mac   |   4 +
 target/linux/mediatek/image/filogic.mk        |  20 ++
 4 files changed, 331 insertions(+), 6 deletions(-)
 create mode 100644 target/linux/mediatek/dts/mt7981b-keenetic-kn-3911.dts

diff --git a/target/linux/mediatek/dts/mt7981b-keenetic-kn-3911.dts b/target/linux/mediatek/dts/mt7981b-keenetic-kn-3911.dts
new file mode 100644
index 00000000000000..8a9bf0f1a9bf45
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-keenetic-kn-3911.dts
@@ -0,0 +1,300 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+
+/dts-v1/;
+
+#include "mt7981.dtsi"
+
+/ {
+	model = "Keenetic KN-3911";
+	compatible = "keenetic,kn-3911", "mediatek,mt7981";
+
+	aliases {
+		label-mac-device = &gmac0;
+		led-boot = &status_led;
+		led-failsafe = &status_led;
+		led-running = &status_led;
+		led-upgrade = &status_led;
+		serial0 = &uart0;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		button-fn {
+			label = "fn";
+			linux,code = <BTN_0>;
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+		};
+
+		button-reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 24 GPIO_ACTIVE_LOW>;
+		};
+
+		button-wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&pio 29 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		status_led: led-0 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&pio 11 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-1 {
+			color = <LED_COLOR_ID_ORANGE>;
+			function = LED_FUNCTION_WPS;
+			gpios = <&pio 12 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	virtual_flash {
+		compatible = "mtd-concat";
+		devices = <&firmware1 &firmware2>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "kernel";
+				reg = <0x0 0x600000>;
+			};
+
+			partition@400000 {
+				label = "ubi";
+				reg = <0x600000 0x0>;
+			};
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&eth {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&mdio_pins>;
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+		phy-handle = <&phy10>;
+		label = "lan";
+
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_factory_4 0>;
+	};
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "2500base-x";
+		phy-handle = <&phy11>;
+		label = "wan";
+
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_factory_a 0>;
+	};
+};
+
+&mdio_bus {
+	phy10: ethernet-phy@a {
+		reg = <0xa>;
+		interrupt-parent = <&pio>;
+		interrupts = <38 IRQ_TYPE_EDGE_FALLING>;
+		reset-gpios = <&pio 22 GPIO_ACTIVE_LOW>;
+		reset-assert-us = <10000>;
+		reset-deassert-us = <20000>;
+	};
+
+	phy11: ethernet-phy@b {
+		reg = <0xb>;
+		interrupt-parent = <&pio>;
+		interrupts = <23 IRQ_TYPE_EDGE_FALLING>;
+		reset-gpios = <&pio 27 GPIO_ACTIVE_LOW>;
+		reset-assert-us = <10000>;
+		reset-deassert-us = <20000>;
+	};
+};
+
+&pio {
+	spi0_flash_pins: spi0-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
+		};
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	status = "okay";
+
+	/* Winbond W25N01GVZEIG (128M) */
+	spi_nand@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "spi-nand";
+		reg = <0>;
+
+		spi-max-frequency = <52000000>;
+		spi-tx-buswidth = <4>;
+		spi-rx-buswidth = <4>;
+
+		spi-cal-enable;
+		spi-cal-mode = "read-data";
+		spi-cal-datalen = <7>;
+		spi-cal-data = /bits/ 8 <0x53 0x50 0x49 0x4e 0x41 0x4e 0x44>;
+		spi-cal-addrlen = <5>;
+		spi-cal-addr = /bits/ 32 <0x0 0x0 0x0 0x0 0x0>;
+
+		mediatek,nmbm;
+		mediatek,bmt-max-ratio = <1>;
+		mediatek,bmt-max-reserved-blocks = <64>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			/* bl2 */
+			partition@0 {
+				label = "preloader";
+				reg = <0x0 0x80000>;
+				read-only;
+			};
+
+			/* fip */
+			partition@80000 {
+				label = "u-boot";
+				reg = <0x80000 0x200000>;
+				read-only;
+			};
+
+			partition@280000 {
+				label = "u-config";
+				reg = <0x280000 0x80000>;
+				read-only;
+			};
+
+			partition@300000 {
+				label = "rf-eeprom";
+				reg = <0x300000 0x200000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					eeprom_factory_0: eeprom@0 {
+						reg = <0x0 0x1000>;
+					};
+
+					/* lan mac */
+					macaddr_factory_4: macaddr@4 {
+						compatible = "mac-base";
+						reg = <0x4 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+
+					/* wan mac */
+					macaddr_factory_a: macaddr@a {
+						compatible = "mac-base";
+						reg = <0xa 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+				};
+			};
+
+			firmware1: partition@500000 {
+				label = "firmware_1";
+				reg = <0x500000 0x3500000>;
+			};
+
+			partition@3a00000 {
+				label = "config_1";
+				reg = <0x3a00000 0x80000>;
+				read-only;
+			};
+
+			partition@3a80000 {
+				label = "dump";
+				reg = <0x3a80000 0x80000>;
+				read-only;
+			};
+
+			partition@3c00000 {
+				label = "u-state";
+				reg = <0x3c00000 0x20000>;
+				read-only;
+			};
+
+			partition@3e80000 {
+				label = "u-config_res";
+				reg = <0x3e80000 0x80000>;
+				read-only;
+			};
+
+			partition@3f00000 {
+				label = "rf-eeprom_res";
+				reg = <0x3f00000 0x200000>;
+				read-only;
+			};
+
+			firmware2: partition@4100000 {
+				label = "firmware_2";
+				reg = <0x4140000 0x3500000>;
+			};
+
+			partition@7600000 {
+				label = "config_2";
+				reg = <0x7600000 0x80000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&wifi {
+	nvmem-cell-names = "eeprom";
+	nvmem-cells = <&eeprom_factory_0>;
+	status = "okay";
+};
+
+&sgmiisys0 {
+	/delete-node/ mediatek,pnswap;
+};
diff --git a/target/linux/mediatek/filogic/base-files/etc/board.d/02_network b/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
index 1480dbcbc78c23..953d96d09c5de9 100644
--- a/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
+++ b/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
@@ -90,6 +90,13 @@ mediatek_setup_interfaces()
 	dlink,aquila-pro-ai-m30-a1)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" internet
 		;;
+	keenetic,kn-3911|\
+	smartrg,sdg-8622|\
+	smartrg,sdg-8632|\
+	smartrg,sdg-8733a|\
+	yuncore,ax835)
+		ucidef_set_interfaces_lan_wan lan wan
+		;;
 	mediatek,mt7986a-rfb)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4 lan6" "eth1 wan"
 		;;
@@ -102,12 +109,6 @@ mediatek_setup_interfaces()
 	mercusys,mr90x-v1)
 		ucidef_set_interfaces_lan_wan "lan0 lan1 lan2" eth1
 		;;
-	smartrg,sdg-8622|\
-	smartrg,sdg-8632|\
-	smartrg,sdg-8733a|\
-	yuncore,ax835)
-		ucidef_set_interfaces_lan_wan lan wan
-		;;
 	tplink,tl-xdr6086|\
 	wavlink,wl-wn586x3)
 		ucidef_set_interfaces_lan_wan "lan1 lan2" eth1
diff --git a/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac b/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
index 5e83a167de9704..a3b76712232936 100644
--- a/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
+++ b/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
@@ -115,6 +115,10 @@ case "$board" in
 	jdcloud,re-cp-03)
 		[ "$PHYNBR" = "1" ] && mmc_get_mac_binary factory 0xa > /sys${DEVPATH}/macaddress
 		;;
+	keenetic,kn-3911)
+		[ "$PHYNBR" = "1" ] && \
+			macaddr_setbit_la "$(mtd_get_mac_binary rf-eeprom 0x4)" > /sys${DEVPATH}/macaddress
+		;;
 	mercusys,mr90x-v1|\
 	tplink,re6000xd)
 		addr=$(get_mac_binary "/tmp/tp_data/default-mac" 0)
diff --git a/target/linux/mediatek/image/filogic.mk b/target/linux/mediatek/image/filogic.mk
index 672790f1a77698..ddd23f4d640a4a 100644
--- a/target/linux/mediatek/image/filogic.mk
+++ b/target/linux/mediatek/image/filogic.mk
@@ -887,6 +887,26 @@ define Device/jdcloud_re-cp-03
 endef
 TARGET_DEVICES += jdcloud_re-cp-03
 
+define Device/keenetic_kn-3911
+  DEVICE_VENDOR := Keenetic
+  DEVICE_MODEL := KN-3911
+  DEVICE_DTS := mt7981b-keenetic-kn-3911
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware kmod-phy-airoha-en8811h
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_SIZE := 6144k
+  IMAGE_SIZE := 108544k
+  KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb | \
+	append-squashfs4-fakeroot
+  IMAGES += factory.bin
+  IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | \
+	append-ubi | check-size | zyimage -d 0x803911 -v "KN-3911"
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += keenetic_kn-3911
+
 define Device/mediatek_mt7981-rfb
   DEVICE_VENDOR := MediaTek
   DEVICE_MODEL := MT7981 rfb

From 0a7912b55efdc6b2e49df378fd7970e0825df253 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sun, 14 Jul 2024 18:47:43 -0400
Subject: [PATCH 074/225] feeds: Add nss-packages repo

feeds: Switch to fork that requires nss qdisc

Without it, NSS based SQM doesn't work.
---
 feeds.conf.default | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/feeds.conf.default b/feeds.conf.default
index fc679335e0e47f..4527c3215a827e 100644
--- a/feeds.conf.default
+++ b/feeds.conf.default
@@ -2,6 +2,8 @@ src-git packages https://git.openwrt.org/feed/packages.git
 src-git luci https://git.openwrt.org/project/luci.git
 src-git routing https://git.openwrt.org/feed/routing.git
 src-git telephony https://git.openwrt.org/feed/telephony.git
+src-git nss_packages https://github.com/qosmio/nss-packages.git;NSS-12.4-K6.1
+src-git sqm_scripts_nss https://github.com/qosmio/sqm-scripts-nss.git
 #src-git video https://github.com/openwrt/video.git
 #src-git targets https://github.com/openwrt/targets.git
 #src-git oldpackages http://git.openwrt.org/packages.git

From c0fcca644fe80b7e7c1fa0abc4767800da813a48 Mon Sep 17 00:00:00 2001
From: bitthief <bitthief@protonmail.ch>
Date: Sat, 4 Feb 2023 01:30:08 +0200
Subject: [PATCH 075/225] nat46: patches for QCA NSS ECM

Signed-off-by: bitthief <bitthief@protonmail.ch>

package: kernel: nat46: add kernel 6.1 support

Signed-off-by: bitthief <bitthief@protonmail.ch>
Co-Developed-by: Sean Khan <datapronix@protonmail.com>
---
 package/kernel/nat46/Makefile                 |  10 +-
 .../kernel/nat46/patches/101-skb-reset.patch  |  30 +
 package/kernel/nat46/patches/102-mapt.patch   | 209 ++++++
 package/kernel/nat46/patches/103-tos.patch    |  39 ++
 package/kernel/nat46/patches/104-icmp.patch   | 439 ++++++++++++
 .../patches/105-longest-prefix-match.patch    | 640 ++++++++++++++++++
 .../nat46/patches/106-dummy_header.patch      | 104 +++
 package/kernel/nat46/patches/107-stats.patch  | 136 ++++
 .../kernel/nat46/patches/108-ce_port.patch    | 134 ++++
 ...agment_if_not_df_and_larger_than_mtu.patch |  30 +
 .../patches/110-icmp_error_not_handled.patch  | 100 +++
 .../111-fix_null_point_reference.patch        |  40 ++
 .../nat46/patches/112-fix_icmp_crash.patch    |  40 ++
 .../patches/116-rate-limit-the-print.patch    |  34 +
 .../patches/117-fix-icmp-no-payload-bug.patch |  34 +
 .../nat46/patches/118-performance_fix.patch   | 415 ++++++++++++
 .../patches/120-sleeping_backtrace.patch      |  57 ++
 .../kernel/nat46/patches/121-tos-fix.patch    |  27 +
 18 files changed, 2517 insertions(+), 1 deletion(-)
 create mode 100644 package/kernel/nat46/patches/101-skb-reset.patch
 create mode 100644 package/kernel/nat46/patches/102-mapt.patch
 create mode 100644 package/kernel/nat46/patches/103-tos.patch
 create mode 100644 package/kernel/nat46/patches/104-icmp.patch
 create mode 100644 package/kernel/nat46/patches/105-longest-prefix-match.patch
 create mode 100644 package/kernel/nat46/patches/106-dummy_header.patch
 create mode 100644 package/kernel/nat46/patches/107-stats.patch
 create mode 100644 package/kernel/nat46/patches/108-ce_port.patch
 create mode 100644 package/kernel/nat46/patches/109-fragment_if_not_df_and_larger_than_mtu.patch
 create mode 100644 package/kernel/nat46/patches/110-icmp_error_not_handled.patch
 create mode 100644 package/kernel/nat46/patches/111-fix_null_point_reference.patch
 create mode 100644 package/kernel/nat46/patches/112-fix_icmp_crash.patch
 create mode 100644 package/kernel/nat46/patches/116-rate-limit-the-print.patch
 create mode 100644 package/kernel/nat46/patches/117-fix-icmp-no-payload-bug.patch
 create mode 100644 package/kernel/nat46/patches/118-performance_fix.patch
 create mode 100644 package/kernel/nat46/patches/120-sleeping_backtrace.patch
 create mode 100644 package/kernel/nat46/patches/121-tos-fix.patch

diff --git a/package/kernel/nat46/Makefile b/package/kernel/nat46/Makefile
index 296ef5a058e83e..32ea3a4516d4e0 100644
--- a/package/kernel/nat46/Makefile
+++ b/package/kernel/nat46/Makefile
@@ -12,6 +12,8 @@ PKG_SOURCE_VERSION:=4c5beee236841724219598fabb1edc93d4f08ce5
 PKG_MAINTAINER:=Hans Dedecker <dedeckeh@gmail.com>
 PKG_LICENSE:=GPL-2.0
 
+PKG_BUILD_PARALLEL:=1
+
 include $(INCLUDE_DIR)/package.mk
 
 define KernelPackage/nat46
@@ -25,11 +27,17 @@ endef
 
 include $(INCLUDE_DIR)/kernel-defaults.mk
 
+define Build/InstallDev
+	mkdir -p -m 0777 $(STAGING_DIR)/usr/include/nat46
+	$(CP) $(PKG_BUILD_DIR)/nat46/modules/*.h  $(STAGING_DIR)/usr/include/nat46/
+endef
+
 define Build/Compile
-	$(KERNEL_MAKE) M="$(PKG_BUILD_DIR)/nat46/modules" \
+	+$(KERNEL_MAKE) M="$(PKG_BUILD_DIR)/nat46/modules" \
 		MODFLAGS="-DMODULE -mlong-calls" \
 		EXTRA_CFLAGS="-DNAT46_VERSION=\\\"$(PKG_SOURCE_VERSION)\\\"" \
 		modules
+	cp $(PKG_BUILD_DIR)/nat46/modules/Module.symvers $(PKG_BUILD_DIR)/Module.symvers
 endef
 
 $(eval $(call KernelPackage,nat46))
diff --git a/package/kernel/nat46/patches/101-skb-reset.patch b/package/kernel/nat46/patches/101-skb-reset.patch
new file mode 100644
index 00000000000000..14cf2d75a07d88
--- /dev/null
+++ b/package/kernel/nat46/patches/101-skb-reset.patch
@@ -0,0 +1,30 @@
+Author:  Pavithra R <pavir@codeaurora.org>
+Date:    Sun Sep 20 13:33:42 2020 +0530
+
+nat46: Add skb_ext_reset to reset skb extensions
+
+This patch adds support to reset the skb extensions before
+resetting the netfilter. Without the change, conntrack
+is in invalid state and traffic gets dropped.
+
+Change-Id: I24ee6fe8a9a9dec09d61d8e716fff587f65e4e4f
+Signed-off-by: Pavithra R <pavir@codeaurora.org>
+
+--- a/nat46/modules/nat46-core.c
++++ b/nat46/modules/nat46-core.c
+@@ -1710,6 +1710,7 @@ int nat46_ipv6_input(struct sk_buff *old
+ #if LINUX_VERSION_CODE < KERNEL_VERSION(5,4,0)
+   nf_reset(new_skb);
+ #else
++  skb_ext_reset(new_skb);
+   nf_reset_ct(new_skb);
+ #endif
+ 
+@@ -1936,6 +1937,7 @@ int nat46_ipv4_input(struct sk_buff *old
+ #if LINUX_VERSION_CODE < KERNEL_VERSION(5,4,0)
+   nf_reset(new_skb);
+ #else
++  skb_ext_reset(new_skb);
+   nf_reset_ct(new_skb);
+ #endif
+ 
diff --git a/package/kernel/nat46/patches/102-mapt.patch b/package/kernel/nat46/patches/102-mapt.patch
new file mode 100644
index 00000000000000..1e83481c967f8b
--- /dev/null
+++ b/package/kernel/nat46/patches/102-mapt.patch
@@ -0,0 +1,209 @@
+Author:  Pavithra R <pavir@codeaurora.org>
+Date:    Sat Aug 1 13:27:20 2020 +0530
+
+nat46: Export APIs for acceleration engine support in nat46 for kernel 5.4
+
+This patch is propagated from kernel 4.4 commit
+861e64a607fd22d5af089cf56539f42a2e31d581
+
+The patch defines and exports APIs in nat46 to be used for accelaration.
+
+Change-Id: I7934b15544953f870d3595b8b359433b4fff7c30
+Signed-off-by: Pavithra R <pavir@codeaurora.org>
+
+--- a/nat46/modules/nat46-core.c
++++ b/nat46/modules/nat46-core.c
+@@ -1497,7 +1497,6 @@ static uint16_t nat46_fixup_icmp_dest_un
+   return 0;
+ }
+ 
+-
+ /* Fixup ICMP->ICMP6 before IP header translation, according to http://tools.ietf.org/html/rfc6145 */
+ 
+ static uint16_t nat46_fixup_icmp(nat46_instance_t *nat46, struct iphdr *iph, struct sk_buff *old_skb) {
+@@ -1579,6 +1578,10 @@ int pairs_xlate_v6_to_v4_outer(nat46_ins
+   return ( (xlate_src >= 0) && (xlate_dst >= 0) );
+ }
+ 
++int xlate_6_to_4(struct net_device *dev, struct ipv6hdr *ip6h, uint16_t proto, __u32 *pv4saddr, __u32 *pv4daddr) {
++	return pairs_xlate_v6_to_v4_outer(netdev_nat46_instance(dev), ip6h, proto, pv4saddr, pv4daddr);
++}
++EXPORT_SYMBOL(xlate_6_to_4);
+ 
+ int nat46_ipv6_input(struct sk_buff *old_skb) {
+   struct ipv6hdr *ip6h = ipv6_hdr(old_skb);
+@@ -1733,6 +1736,10 @@ int nat46_ipv6_input(struct sk_buff *old
+ 
+   nat46debug(5, "about to send v4 packet, flags: %02x",  IPCB(new_skb)->flags);
+   nat46_netdev_count_xmit(new_skb, old_skb->dev);
++
++  /* set skb->iif */
++  new_skb->skb_iif = old_skb->skb_iif;
++
+   netif_rx(new_skb);
+ 
+   /* TBD: should copy be released here? */
+@@ -1841,6 +1848,10 @@ int pairs_xlate_v4_to_v6_outer(nat46_ins
+   return 0;
+ }
+ 
++int xlate_4_to_6(struct net_device *dev, struct iphdr *hdr4, uint16_t sport, uint16_t dport, void *v6saddr, void *v6daddr) {
++	return pairs_xlate_v4_to_v6_outer(netdev_nat46_instance(dev), hdr4, &sport, &dport, v6saddr, v6daddr);
++}
++EXPORT_SYMBOL(xlate_4_to_6);
+ 
+ int nat46_ipv4_input(struct sk_buff *old_skb) {
+   nat46_instance_t *nat46 = get_nat46_instance(old_skb);
+@@ -1981,6 +1992,10 @@ int nat46_ipv4_input(struct sk_buff *old
+ 
+   nat46debug(5, "about to send v6 packet, flags: %02x",  IP6CB(new_skb)->flags);
+   nat46_netdev_count_xmit(new_skb, old_skb->dev);
++
++  /* set skb->iif */
++  new_skb->skb_iif = old_skb->skb_iif;
++
+   netif_rx(new_skb);
+ 
+ done:
+@@ -1988,4 +2003,22 @@ done:
+   return err;
+ }
+ 
++int nat46_get_npairs(struct net_device *dev) {
++	nat46_instance_t *nat46 = netdev_nat46_instance(dev);
++	return nat46->npairs;
++}
++EXPORT_SYMBOL(nat46_get_npairs);
+ 
++bool nat46_get_rule_config(struct net_device *dev, nat46_xlate_rulepair_t **nat46_rule_pair, int *count) {
++	nat46_instance_t *nat46 = netdev_nat46_instance(dev);
++	if (nat46->npairs < 1) {
++		/*
++		 * no rules ?
++		 */
++		return false;
++	}
++	*count = nat46->npairs;
++	*nat46_rule_pair = nat46->pairs;
++	return true;
++}
++EXPORT_SYMBOL(nat46_get_rule_config);
+--- a/nat46/modules/nat46-core.h
++++ b/nat46/modules/nat46-core.h
+@@ -42,18 +42,18 @@ typedef enum {
+ #define NAT46_SIGNATURE 0x544e3634
+ #define FREED_NAT46_SIGNATURE 0xdead544e
+ 
+-typedef struct {
++typedef struct nat46_xlate_rule {
+   nat46_xlate_style_t style;
+   struct in6_addr v6_pref;
+-  int 		  v6_pref_len;
+-  u32		  v4_pref;
+-  int             v4_pref_len;
+-  int		  ea_len;
+-  int             psid_offset;
+-  int             fmr_flag;
++  int v6_pref_len;
++  u32 v4_pref;
++  int v4_pref_len;
++  int ea_len;
++  int psid_offset;
++  int fmr_flag;
+ } nat46_xlate_rule_t;
+ 
+-typedef struct {
++typedef struct nat46_xlate_rulepair {
+   nat46_xlate_rule_t local;
+   nat46_xlate_rule_t remote;
+ } nat46_xlate_rulepair_t;
+@@ -82,4 +82,9 @@ nat46_instance_t *get_nat46_instance(str
+ nat46_instance_t *alloc_nat46_instance(int npairs, nat46_instance_t *old, int from_ipair, int to_ipair, int remove_ipair);
+ void release_nat46_instance(nat46_instance_t *nat46);
+ 
++int xlate_6_to_4(struct net_device *dev, struct ipv6hdr *ip6h, uint16_t proto, __u32 *pv4saddr, __u32 *pv4daddr);
++int xlate_4_to_6(struct net_device *dev, struct iphdr *hdr4, uint16_t sport, uint16_t dport, void *v6saddr, void *v6daddr);
++bool nat46_get_rule_config(struct net_device *dev, nat46_xlate_rulepair_t **nat46_rule_pair, int *count);
++int nat46_get_npairs(struct net_device *dev);
++
+ #endif
+--- a/nat46/modules/nat46-netdev.c
++++ b/nat46/modules/nat46-netdev.c
+@@ -24,10 +24,12 @@
+ #include <net/ip6_route.h>
+ #include <net/ipv6.h>
+ #include <linux/version.h>
++#include <linux/radix-tree.h>
+ #include "nat46-core.h"
+ #include "nat46-module.h"
+ 
+ #define NETDEV_DEFAULT_NAME "nat46."
++static RADIX_TREE(netdev_tree, GFP_ATOMIC);
+ 
+ typedef struct {
+   u32 sig;
+@@ -83,6 +85,18 @@ void nat46_netdev_count_xmit(struct sk_b
+ 	dev->stats.tx_bytes += skb->len;
+ }
+ 
++void nat46_update_stats(struct net_device *dev, uint32_t rx_packets, uint32_t rx_bytes,
++			uint32_t tx_packets, uint32_t tx_bytes, uint32_t rx_dropped, uint32_t tx_dropped)
++{
++	dev->stats.rx_packets += rx_packets;
++	dev->stats.rx_bytes += rx_bytes;
++	dev->stats.tx_packets += tx_packets;
++	dev->stats.tx_bytes += tx_bytes;
++	dev->stats.rx_dropped += rx_dropped;
++	dev->stats.tx_dropped += tx_dropped;
++}
++EXPORT_SYMBOL(nat46_update_stats);
++
+ void *netdev_nat46_instance(struct net_device *dev) {
+ 	nat46_netdev_priv_t *priv = netdev_priv(dev);
+ 	return priv->nat46;
+@@ -159,6 +173,11 @@ int nat46_netdev_create(char *basename,
+ 	printk("nat46: netdevice nat46 '%s' created successfully.\n", devname);
+ 	kfree(devname);
+ 
++	/*
++	 * add this netdevice to list
++	 */
++	radix_tree_insert(&netdev_tree, (*dev)->ifindex, (void *)*dev);
++
+ 	return 0;
+ 
+ err_register_dev:
+@@ -175,10 +194,24 @@ void nat46_netdev_destroy(struct net_dev
+ 	netif_stop_queue(dev);
+ 	netdev_nat46_set_instance(dev, NULL);
+ 	unregister_netdev(dev);
++	radix_tree_delete(&netdev_tree, dev->ifindex);
+ 	free_netdev(dev);
+ 	printk("nat46: Destroying nat46 device.\n");
+ }
+ 
++bool is_map_t_dev(struct net_device *dev)
++{
++	if(!dev) {
++		return false;
++	}
++
++	if(radix_tree_lookup(&netdev_tree, dev->ifindex)) {
++		return true;
++	}
++	return false;
++}
++EXPORT_SYMBOL(is_map_t_dev);
++
+ static int is_nat46(struct net_device *dev) {
+ 	nat46_netdev_priv_t *priv = netdev_priv(dev);
+ 	return (priv && (NAT46_DEVICE_SIGNATURE == priv->sig));
+--- a/nat46/modules/nat46-netdev.h
++++ b/nat46/modules/nat46-netdev.h
+@@ -26,3 +26,6 @@ void nat64_show_all_configs(struct seq_f
+ void nat46_netdev_count_xmit(struct sk_buff *skb, struct net_device *dev);
+ void *netdev_nat46_instance(struct net_device *dev);
+ 
++void nat46_update_stats(struct net_device *dev, uint32_t rx_packets, uint32_t rx_bytes, uint32_t tx_packets, uint32_t tx_bytes,
++							uint32_t rx_dropped, uint32_t tx_dropped);
++bool is_map_t_dev(struct net_device *dev);
diff --git a/package/kernel/nat46/patches/103-tos.patch b/package/kernel/nat46/patches/103-tos.patch
new file mode 100644
index 00000000000000..60ffcb2fae802a
--- /dev/null
+++ b/package/kernel/nat46/patches/103-tos.patch
@@ -0,0 +1,39 @@
+Author:  Pavithra R <pavir@codeaurora.org>
+Date:    Sat Aug 1 13:55:33 2020 +0530
+
+nat46: Set IPv6 traffic class from IPv4 ToS value
+
+Set IPv6 traffic class from IPv4 ToS value during
+IPv4 to IPv6 translation and vice-versa.
+
+This patch is propagated from kernel 4.4 commit
+1cd3b55b059d4513649bb73bc69da931ed3beb7b
+
+Change-Id: Ia14e53447e829c8648c01656237ac902ad8674ec
+Signed-off-by: Pavithra R <pavir@codeaurora.org>
+
+--- a/nat46/modules/nat46-core.c
++++ b/nat46/modules/nat46-core.c
+@@ -886,11 +886,12 @@ void *get_next_header_ptr6(void *pv6, in
+ }
+ 
+ void fill_v4hdr_from_v6hdr(struct iphdr * iph, struct ipv6hdr *ip6h, __u32 v4saddr, __u32 v4daddr, __u16 id, __u16 frag_off, __u16 proto, int l3_payload_len) {
++  uint32_t ver_class_flow = ntohl(*(__be32 *)ip6h);
+   iph->ttl = ip6h->hop_limit;
+   iph->saddr = v4saddr;
+   iph->daddr = v4daddr;
+   iph->protocol = proto;
+-  *((__be16 *)iph) = htons((4 << 12) | (5 << 8) | (0x00/*tos*/ & 0xff));
++  *((__be16 *)iph) = htons((4 << 12) | (5 << 8) | ((ver_class_flow >> 20) & 0xff));
+   iph->frag_off = frag_off;
+   iph->id = id;
+   iph->tot_len = htons( l3_payload_len + IPV4HDRSIZE );
+@@ -1859,7 +1860,7 @@ int nat46_ipv4_input(struct sk_buff *old
+   uint16_t sport = 0, dport = 0;
+ 
+   int err = 0;
+-  int tclass = 0;
++  uint8_t tclass = 0;
+   int flowlabel = 0;
+   int check_for_l4 = 0;
+   int having_l4 = 0;
diff --git a/package/kernel/nat46/patches/104-icmp.patch b/package/kernel/nat46/patches/104-icmp.patch
new file mode 100644
index 00000000000000..7907a66726005b
--- /dev/null
+++ b/package/kernel/nat46/patches/104-icmp.patch
@@ -0,0 +1,439 @@
+Author:  Pavithra R <pavir@codeaurora.org>
+Date:    Mon Aug 3 17:03:37 2020 +0530
+
+nat46: Fix for icmp translation issues.
+
+This patch is propagated from kernel 4.4 commit
+45fce10ba0105515289930b3e3f9df57bf3c22b6.
+
+Fixed icmpv4 to icmpv6 and vice-versa translation issues, in accordance with RFC6145.
+
+The change covers:
+1. Translation of ICMP errors from IPv4 to IPv6 and vice-versa.
+2. Translation of inner L3 packet header {Eth:IPv4:ICMP:IPv4:ICMP} in ICMP error messages.
+3. Address translation for packets not having port numbers, hence CE/BR needs to fetch this
+   information from inner header (atleast 28 bytes (IP hdr + 8 bytes) of orignal packet received
+   that is transmitted back will be there in response).
+
+Change-Id: I677474728aeaee656376fdb1edcb9476783d5b40
+Signed-off-by: Pavithra R <pavir@codeaurora.org>
+
+--- a/nat46/modules/nat46-core.c
++++ b/nat46/modules/nat46-core.c
+@@ -29,6 +29,9 @@
+ #include "nat46-core.h"
+ #include "nat46-module.h"
+ 
++static uint16_t xlate_pkt_in_err_v4_to_v6(nat46_instance_t *nat46, struct iphdr *iph,
++			struct sk_buff *old_skb, uint16_t *sport, uint16_t *dport);
++
+ void
+ nat46debug_dump(nat46_instance_t *nat46, int level, void *addr, int len)
+ {
+@@ -885,6 +888,14 @@ void *get_next_header_ptr6(void *pv6, in
+   return ret;
+ }
+ 
++void fill_v6hdr_from_v4hdr(struct iphdr *iph, struct ipv6hdr *ip6h) {
++  *((__be16 *)ip6h) = htons((6 << 12) | (iph->tos << 4));	/* Version, Traffic Class */
++  memset(&(ip6h->flow_lbl), 0, sizeof(ip6h->flow_lbl));		/* Flowlabel */
++  ip6h->payload_len = htons(ntohs(iph->tot_len) - IPV4HDRSIZE);
++  ip6h->nexthdr = iph->protocol;
++  ip6h->hop_limit = iph->ttl;
++}
++
+ void fill_v4hdr_from_v6hdr(struct iphdr * iph, struct ipv6hdr *ip6h, __u32 v4saddr, __u32 v4daddr, __u16 id, __u16 frag_off, __u16 proto, int l3_payload_len) {
+   uint32_t ver_class_flow = ntohl(*(__be32 *)ip6h);
+   iph->ttl = ip6h->hop_limit;
+@@ -1212,10 +1223,14 @@ static void nat46_fixup_icmp6_paramprob(
+                           16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, -1 };
+   u32 *pptr6 = icmp6_parameter_ptr(icmp6h);
+   u8 *pptr4 = icmp_parameter_ptr((struct icmphdr *)icmp6h);
+-  int new_pptr = -1;
++  u8 new_pptr = -1;
+   int len = ntohs(ip6h->payload_len)-sizeof(*icmp6h);
+ 
+   switch(icmp6h->icmp6_code) {
++    case 1:
++      update_icmp6_type_code(nat46, icmp6h, 3, 2);
++      break;
++
+     case 0:
+       if(*pptr6 < sizeof(ptr6_4)/sizeof(ptr6_4[0])) {
+         new_pptr = ptr6_4[*pptr6];
+@@ -1224,27 +1239,21 @@ static void nat46_fixup_icmp6_paramprob(
+           *pptr4 = 0xff & new_pptr;
+           update_icmp6_type_code(nat46, icmp6h, 12, 0);
+           len = xlate_payload6_to4(nat46, (icmp6h + 1), get_next_header_ptr6((icmp6h + 1), len), len, &icmp6h->icmp6_cksum, ptailTruncSize);
+-        } else {
+-          ip6h->nexthdr = NEXTHDR_NONE;
++          update_icmp6_type_code(nat46, icmp6h, 12, 0);
++	  break;
+         }
+-      } else {
+-        ip6h->nexthdr = NEXTHDR_NONE;
+       }
+-      break;
+-    case 1:
+-      icmp6h->icmp6_cksum = csum16_upd(icmp6h->icmp6_cksum, ((*pptr6 >> 16) & 0xffff), 0);
+-      icmp6h->icmp6_cksum = csum16_upd(icmp6h->icmp6_cksum, (*pptr6 & 0xffff), 0);
+-      *pptr6 = 0;
+-      update_icmp6_type_code(nat46, icmp6h, 3, 2);
+-      len = xlate_payload6_to4(nat46, (icmp6h + 1), get_next_header_ptr6((icmp6h + 1), len), len, &icmp6h->icmp6_cksum, ptailTruncSize);
+-      break;
++#if __has_attribute(__fallthrough__)
++      __attribute__((__fallthrough__));
++#endif
+     case 2: /* fallthrough to default */
+     default:
+       ip6h->nexthdr = NEXTHDR_NONE;
++      return;
+   }
++  len = xlate_payload6_to4(nat46, (icmp6h + 1), get_next_header_ptr6((icmp6h + 1), len), len, &icmp6h->icmp6_cksum, ptailTruncSize);
+ }
+ 
+-
+ /* Fixup ICMP6->ICMP before IP header translation, according to http://tools.ietf.org/html/rfc6145 */
+ 
+ static void nat46_fixup_icmp6(nat46_instance_t *nat46, struct ipv6hdr *ip6h, struct icmp6hdr *icmp6h, struct sk_buff *old_skb, int *ptailTruncSize) {
+@@ -1299,17 +1308,19 @@ int ip6_input_not_interested(nat46_insta
+   return 0;
+ }
+ 
+-static uint16_t nat46_fixup_icmp_time_exceeded(nat46_instance_t *nat46, struct iphdr *iph, struct icmphdr *icmph, struct sk_buff *old_skb) {
++static uint16_t nat46_fixup_icmp_time_exceeded(nat46_instance_t *nat46, struct iphdr *iph,
++			struct icmphdr *icmph, struct sk_buff *old_skb, uint16_t *sport, uint16_t *dport) {
+   /*
+    * Set the Type to 3, and adjust the
+    * ICMP checksum both to take the type change into account and
+    * to include the ICMPv6 pseudo-header.  The Code is unchanged.
+    */
+   icmph->type = 3;
+-  return 0;
++  return xlate_pkt_in_err_v4_to_v6(nat46, iph, old_skb, sport, dport);
+ }
+ 
+-static uint16_t nat46_fixup_icmp_parameterprob(nat46_instance_t *nat46, struct iphdr *iph, struct icmphdr *icmph, struct sk_buff *old_skb) {
++static uint16_t nat46_fixup_icmp_parameterprob(nat46_instance_t *nat46, struct iphdr *iph,
++			struct icmphdr *icmph, struct sk_buff *old_skb, uint16_t *sport, uint16_t *dport) {
+   /*
+    * Set the Type to 4, and adjust the
+    * ICMP checksum both to take the type/code change into account
+@@ -1352,27 +1363,33 @@ static uint16_t nat46_fixup_icmp_paramet
+    */
+   static int ptr4_6[] = { 0, 1, 4, 4, -1, -1, -1, -1, 7, 6, -1, -1, 8, 8, 8, 8, 24, 24, 24, 24, -1 };
+   u8 *icmp_pptr = icmp_parameter_ptr(icmph);
+-  int new_pptr = -1;
++  u32 *icmp6_pptr = icmp6_parameter_ptr((struct icmp6hdr *)icmph);
++  int8_t new_pptr = -1;
++
++  icmph->type = 4;
++
+   switch (icmph->code) {
+     case 0:
+     case 2:
+       if (*icmp_pptr < (sizeof(ptr4_6)/sizeof(ptr4_6[0]))) {
+         icmph->code = 0;
+         new_pptr = ptr4_6[*icmp_pptr];
+-        if(new_pptr >= 0) {
+-          /* FIXME: update the parameter pointer in ICMPv6 with new_pptr value */
++        if (new_pptr >= 0) {
++          *icmp6_pptr = new_pptr;
++          return xlate_pkt_in_err_v4_to_v6(nat46, iph, old_skb, sport, dport);
+         }
+-      } else {
+-        iph->protocol = NEXTHDR_NONE;
+       }
+-      break;
++#if __has_attribute(__fallthrough__)
++      __attribute__((__fallthrough__));
++#endif
+     default:
+       iph->protocol = NEXTHDR_NONE;
+   }
+   return 0;
+ }
+ 
+-static uint16_t nat46_fixup_icmp_dest_unreach(nat46_instance_t *nat46, struct iphdr *iph, struct icmphdr *icmph, struct sk_buff *old_skb) {
++static uint16_t nat46_fixup_icmp_dest_unreach(nat46_instance_t *nat46, struct iphdr *iph,
++			struct icmphdr *icmph, struct sk_buff *old_skb, uint16_t *sport, uint16_t *dport) {
+   /*
+    *    Translate the Code as
+    *    described below, set the Type to 1, and adjust the ICMP
+@@ -1435,16 +1452,21 @@ static uint16_t nat46_fixup_icmp_dest_un
+ 
+   u16 *pmtu = ((u16 *)icmph) + 3; /* IPv4-compatible MTU value is 16 bit */
+ 
++  icmph->type = 1;
++
+   switch (icmph->code) {
+     case 0:
+     case 1:
+       icmph->code = 0;
+       break;
+-    case 2:
+-      /* FIXME: set ICMPv6 parameter pointer to 6 */
++    case 2: {
++      u32 *icmp6_pptr = icmp6_parameter_ptr((struct icmp6hdr *)icmph);
++      *icmp6_pptr = 6; /* Offset to Next Proto field in IPv6 header. */
+       icmph->type = 4;
+       icmph->code = 1;
++      nat46debug(3, "ICMP Proto Unreachable translated into IPv6 Param Prob.\n");
+       break;
++    }
+     case 3:
+       icmph->code = 4;
+       break;
+@@ -1494,13 +1516,15 @@ static uint16_t nat46_fixup_icmp_dest_un
+       break;
+     default:
+       iph->protocol = NEXTHDR_NONE;
++      return 0;
+   }
+-  return 0;
++  return xlate_pkt_in_err_v4_to_v6(nat46, iph, old_skb, sport, dport);
+ }
+ 
+ /* Fixup ICMP->ICMP6 before IP header translation, according to http://tools.ietf.org/html/rfc6145 */
+-
+-static uint16_t nat46_fixup_icmp(nat46_instance_t *nat46, struct iphdr *iph, struct sk_buff *old_skb) {
++static uint16_t nat46_fixup_icmp(nat46_instance_t *nat46, struct iphdr *iph,
++			struct sk_buff *old_skb, uint16_t *sport, uint16_t *dport)
++{
+   struct icmphdr *icmph = (struct icmphdr *)(iph+1);
+   uint16_t ret = 0;
+ 
+@@ -1509,22 +1533,22 @@ static uint16_t nat46_fixup_icmp(nat46_i
+   switch(icmph->type) {
+     case ICMP_ECHO:
+       icmph->type = ICMPV6_ECHO_REQUEST;
+-      ret = icmph->un.echo.id;
++      *sport = *dport = icmph->un.echo.id;
+       nat46debug(3, "ICMP echo request translated into IPv6, id: %d", ntohs(ret));
+       break;
+     case ICMP_ECHOREPLY:
+       icmph->type = ICMPV6_ECHO_REPLY;
+-      ret = icmph->un.echo.id;
++      *sport = *dport = icmph->un.echo.id;
+       nat46debug(3, "ICMP echo reply translated into IPv6, id: %d", ntohs(ret));
+       break;
+     case ICMP_TIME_EXCEEDED:
+-      ret = nat46_fixup_icmp_time_exceeded(nat46, iph, icmph, old_skb);
++      ret = nat46_fixup_icmp_time_exceeded(nat46, iph, icmph, old_skb, sport, dport);
+       break;
+     case ICMP_PARAMETERPROB:
+-      ret = nat46_fixup_icmp_parameterprob(nat46, iph, icmph, old_skb);
++      ret = nat46_fixup_icmp_parameterprob(nat46, iph, icmph, old_skb, sport, dport);
+       break;
+     case ICMP_DEST_UNREACH:
+-      ret = nat46_fixup_icmp_dest_unreach(nat46, iph, icmph, old_skb);
++      ret = nat46_fixup_icmp_dest_unreach(nat46, iph, icmph, old_skb, sport, dport);
+       break;
+     default:
+       /* Silently drop. */
+@@ -1544,11 +1568,13 @@ int pairs_xlate_v6_to_v4_outer(nat46_ins
+ 
+     if(-1 == xlate_dst) {
+       if (xlate_v6_to_v4(nat46, &apair->local, &ip6h->daddr, pv4daddr)) {
++        nat46debug(5, "Dst addr %pI6 to %pI4 \n", &ip6h->daddr, pv4daddr);
+         xlate_dst = ipair;
+       }
+     }
+     if(-1 == xlate_src) {
+       if (xlate_v6_to_v4(nat46, &apair->remote, &ip6h->saddr, pv4saddr)) {
++        nat46debug(5, "Src addr %pI6 to %pI4 \n", &ip6h->saddr, pv4saddr);
+         xlate_src = ipair;
+       }
+     }
+@@ -1659,6 +1685,7 @@ int nat46_ipv6_input(struct sk_buff *old
+   }
+ 
+   if(!pairs_xlate_v6_to_v4_outer(nat46, ip6h, proto, &v4saddr, &v4daddr)) {
++    nat46debug(0, "[nat46] Could not translate v6->v4");
+     goto done;
+   }
+ 
+@@ -1821,11 +1848,13 @@ int pairs_xlate_v4_to_v6_outer(nat46_ins
+ 
+     if(-1 == xlate_src) {
+       if(xlate_v4_to_v6(nat46, &apair->local, &hdr4->saddr, v6saddr, sport)) {
++        nat46debug(5, "Src addr %pI4 to %pI6 \n", &hdr4->saddr, v6saddr);
+         xlate_src = ipair;
+       }
+     }
+     if(-1 == xlate_dst) {
+       if(xlate_v4_to_v6(nat46, &apair->remote, &hdr4->daddr, v6daddr, dport)) {
++        nat46debug(5, "Dst addr %pI4 to %pI6 \n", &hdr4->daddr, v6daddr);
+         xlate_dst = ipair;
+       }
+     }
+@@ -1854,10 +1883,145 @@ int xlate_4_to_6(struct net_device *dev,
+ }
+ EXPORT_SYMBOL(xlate_4_to_6);
+ 
++/* FIXME: This is a workaround, till the LPM is not added. The sport & dport in inner header will be dport & sport of the outer
++ * header, respectively. Hence, dest. and source ips of inner header will be found in local & remote rules, respectively.
++ * Will work only for a pair of local & remote rules. Once LPM is brought in, this method can be removed and
++ * pairs_xlate_v4_to_v6_outer be used instead.
++ */
++int pairs_xlate_v4_to_v6_inner(nat46_instance_t *nat46, struct iphdr *iph,
++		uint16_t sport, uint16_t dport, void *v6saddr, void *v6daddr) {
++	int ipair = 0;
++	nat46_xlate_rulepair_t *apair = NULL;
++	int xlate_src = -1;
++	int xlate_dst = -1;
++
++	for (ipair = 0; ipair < nat46->npairs; ipair++) {
++		apair = &nat46->pairs[ipair];
++
++		if (-1 == xlate_dst) {
++			if (xlate_v4_to_v6(nat46, &apair->local, &iph->daddr, v6daddr, &dport)) {
++				nat46debug(3, "Dst addr %pI4 to %pI6 \n", &iph->daddr, v6daddr);
++				xlate_dst = ipair;
++			}
++		}
++		if (-1 == xlate_src) {
++			if(xlate_v4_to_v6(nat46, &apair->remote, &iph->saddr, v6saddr, &sport)) {
++				nat46debug(3, "Src addr %pI4 to %pI6 \n", &iph->saddr, v6saddr);
++				xlate_src = ipair;
++			}
++		}
++		if ((xlate_src >= 0) && (xlate_dst >= 0)) {
++			/* we did manage to translate it */
++			nat46debug(5, "[nat46] Inner header xlate results: src %d dst %d", xlate_src, xlate_dst);
++			return 1;
++		} else {
++			/* We did not match fully and there are more rules */
++			if((ipair+1 < nat46->npairs) && is_last_pair_in_group(apair)) {
++				xlate_src = -1;
++				xlate_dst = -1;
++			}
++		}
++}
++
++	nat46debug(1, "[nat46] Could not find a translation pair v4->v6");
++	return 0;
++}
++
++static uint16_t xlate_pkt_in_err_v4_to_v6(nat46_instance_t *nat46, struct iphdr *iph,
++					struct sk_buff *old_skb, uint16_t *sport, uint16_t *dport) {
++	struct ipv6hdr ip6h;
++	char v6saddr[16], v6daddr[16];
++	uint16_t temp_port = 0;
++	int ret = 0;
++	struct icmphdr *icmph = (struct icmphdr *)(iph + 1);
++	struct iphdr *iiph = (struct iphdr *)(icmph + 1);
++
++	switch (iiph->protocol) {
++	case IPPROTO_TCP: {
++		struct tcphdr *th = (struct tcphdr *)(iiph + 1);
++		*sport = th->source;
++		*dport = th->dest;
++		iiph->protocol = NEXTHDR_TCP;
++		break;
++	}
++	case IPPROTO_UDP: {
++		struct udphdr *udp = (struct udphdr *)(iiph + 1);
++		*sport = udp->source;
++		*dport = udp->dest;
++		iiph->protocol = NEXTHDR_UDP;
++		break;
++	}
++	case IPPROTO_ICMP: {
++		struct icmphdr *icmph = (struct icmphdr *)(iiph + 1);
++		iiph->protocol = NEXTHDR_ICMP;
++		switch (icmph->type) {
++		case ICMP_ECHO:
++			icmph->type = ICMPV6_ECHO_REQUEST;
++			*sport = *dport = icmph->un.echo.id;
++			break;
++		case ICMP_ECHOREPLY:
++			icmph->type = ICMPV6_ECHO_REPLY;
++			*sport = *dport = icmph->un.echo.id;
++			break;
++		default:
++			nat46debug(3, "ICMP Error message can't be inside another ICMP Error messgae.");
++			*sport = *dport = 0;
++			return 0;
++		}
++		break;
++	}
++	default:
++		nat46debug(3, "[ICMPv4] Next header: %u. Only TCP, UDP, and ICMP are supported.", iiph->protocol);
++		*sport = *dport = 0;
++		return 0;
++	}
++
++	nat46debug(3, "Retrieved from pkt in error: dest port %d, and src port %d.", ntohs(*dport), ntohs(*sport));
++
++	if (!pairs_xlate_v4_to_v6_inner(nat46, iiph, *sport, *dport, v6saddr, v6daddr)) {
++		nat46debug(0, "[nat46] Could not translate inner header v4->v6");
++		*sport = *dport = 0;
++		return 0;
++	}
++
++	fill_v6hdr_from_v4hdr (iiph, &ip6h);
++	memcpy(&ip6h.saddr, v6saddr, sizeof(ip6h.saddr));
++	memcpy(&ip6h.daddr, v6daddr, sizeof(ip6h.daddr));
++
++	if (skb_tailroom(old_skb) >= IPV6V4HDRDELTA){
++		skb_put(old_skb, IPV6V4HDRDELTA);
++		memmove(((char *)iiph + IPV6HDRSIZE), (iiph + 1), ntohs(iiph->tot_len) - IPV4HDRSIZE);
++		memcpy(iiph, &ip6h, IPV6HDRSIZE);
++	}
++	else {
++		ret = pskb_expand_head(old_skb, 0, IPV6V4HDRDELTA, GFP_ATOMIC);
++		if (unlikely(ret)) {
++			nat46debug(0, "[nat46] Could not copy v4 skb");
++			*sport = *dport = 0;
++			return 0;
++		}
++
++		skb_put(old_skb, IPV6V4HDRDELTA);
++		iiph = (struct iphdr *)(icmp_hdr(old_skb) + 1);
++		memmove(((char *)iiph + IPV6HDRSIZE), (iiph + 1), ntohs(iiph->tot_len) - IPV4HDRSIZE);
++		memcpy(iiph, &ip6h, IPV6HDRSIZE);
++		nat46 = get_nat46_instance(old_skb);
++		iph = ip_hdr(old_skb);
++	}
++
++	/* Swapping Ports for outer header */
++	/* Another work-around till LPM is not present. */
++	temp_port = *sport;
++	*sport = *dport;
++	*dport = temp_port;
++
++	return 1;
++}
++
+ int nat46_ipv4_input(struct sk_buff *old_skb) {
+   nat46_instance_t *nat46 = get_nat46_instance(old_skb);
+   struct sk_buff *new_skb;
+-  uint16_t sport = 0, dport = 0;
++  uint16_t sport = 0, dport = 0, ret = 0;
+ 
+   int err = 0;
+   uint8_t tclass = 0;
+@@ -1879,7 +2043,7 @@ int nat46_ipv4_input(struct sk_buff *old
+   }
+   nat46debug(1, "nat46_ipv4_input packet");
+   nat46debug(5, "nat46_ipv4_input protocol: %d, len: %d, flags: %02x", hdr4->protocol, old_skb->len, IPCB(old_skb)->flags);
+-  if(0 == (ntohs(hdr4->frag_off) & 0x3FFF) ) {
++  if (0 == (ntohs(hdr4->frag_off) & 0x3FFF)) {
+     check_for_l4 = 1;
+   } else if (IPPROTO_ICMP == hdr4->protocol) {
+     /*
+@@ -1916,9 +2080,10 @@ int nat46_ipv4_input(struct sk_buff *old
+ 	break;
+ 	}
+       case IPPROTO_ICMP:
+-	sport = dport = nat46_fixup_icmp(nat46, hdr4, old_skb);
+-	having_l4 = 1;
+-	break;
++        ret = nat46_fixup_icmp(nat46, hdr4, old_skb, &sport, &dport);
++        nat46debug(3, "ICMP translated to dest port %d, and src port %d.", ntohs(dport), ntohs(sport));
++        having_l4 = 1;
++        break;
+       default:
+ 	break;
+     }
diff --git a/package/kernel/nat46/patches/105-longest-prefix-match.patch b/package/kernel/nat46/patches/105-longest-prefix-match.patch
new file mode 100644
index 00000000000000..95fe6af973f45b
--- /dev/null
+++ b/package/kernel/nat46/patches/105-longest-prefix-match.patch
@@ -0,0 +1,640 @@
+Author:  Pavithra R <pavir@codeaurora.org>
+Date:    Tue Aug 4 10:33:59 2020 +0530
+
+nat46: Adding support for multiple MAP-T rules.
+
+This patch is propagated from kernel 4.4 commit
+05a122b0cb0d3a99f040c94b3f626e7350f1445b
+
+This change covers:
+1. Support for adding maximum of 32 MAP-T rules (DMR + FMRs).
+2. Support for rule lookup based on Longest Prefix Match method.
+3. Support for validation of new rules being inserted.
+
+Change-Id: Id87448a8f544273b40c20aaab6e5c63b0dbd72e
+Signed-off-by: Pavithra R <pavir@codeaurora.org>
+
+--- a/nat46/modules/nat46-core.c
++++ b/nat46/modules/nat46-core.c
+@@ -128,6 +128,13 @@ int try_parse_ipv6_prefix(struct in6_add
+     *arg_plen++ = 0;
+     if (pref_len) {
+       *pref_len = simple_strtol(arg_plen, NULL, 10);
++
++      /*
++       * ipv6 prefix should be <= 128
++       */
++      if (*pref_len > IPV6_BITS_MAX) {
++        return -1;
++      }
+     }
+   }
+   err = (1 != in6_pton(arg, -1, (u8 *)pref, '\0', NULL));
+@@ -141,6 +148,13 @@ int try_parse_ipv4_prefix(u32 *v4addr, i
+     *arg_plen++ = 0;
+     if (pref_len) {
+       *pref_len = simple_strtol(arg_plen, NULL, 10);
++
++      /*
++       * ipv4 prefix len should be <= 32
++       */
++      if (*pref_len > IPV4_BITS_MAX) {
++        return -1;
++      }
+     }
+   }
+   err = (1 != in4_pton(arg, -1, (u8 *)v4addr, '/', NULL));
+@@ -183,11 +197,127 @@ int try_parse_rule_arg(nat46_xlate_rule_
+   return err;
+ }
+ 
+-/* 
+- * Parse the config commands in the buffer, 
+- * destructive (puts zero between the args) 
++static inline void nat46_swap(nat46_xlate_rulepair_t *var1, nat46_xlate_rulepair_t *var2) {
++	nat46_xlate_rulepair_t temp;
++	temp = *var1;
++	*var1 = *var2;
++	*var2 = temp;
++}
++
++/*
++ * Sort rule pairs based on prefix length.
+  */
++void nat46_sort_rule_array(nat46_instance_t *nat46) {
++	int i, j;
++	int nelem = nat46->npairs;
++	nat46_xlate_rulepair_t *array = NULL;
++
++	memcpy(nat46->sorted_ipv4_local_pairs, nat46->pairs, nelem * sizeof(nat46_xlate_rulepair_t));
++	memcpy(nat46->sorted_ipv4_remote_pairs, nat46->pairs, nelem * sizeof(nat46_xlate_rulepair_t));
++	memcpy(nat46->sorted_ipv6_local_pairs, nat46->pairs, nelem * sizeof(nat46_xlate_rulepair_t));
++	memcpy(nat46->sorted_ipv6_remote_pairs, nat46->pairs, nelem * sizeof(nat46_xlate_rulepair_t));
++
++	array = &nat46->sorted_ipv4_local_pairs[0];
++	for (i = 0; i < nelem - 1; i++) {
++		for (j = 0; j < nelem - i - 1; j++) {
++			if (array[j].local.v4_pref_len < array[j+1].local.v4_pref_len) {
++				nat46_swap (&array[j], &array[j+1]);
++			}
++		}
++	}
++
++	array = &nat46->sorted_ipv4_remote_pairs[0];
++	for (i = 0; i < nelem - 1; i++) {
++		for (j = 0; j < nelem - i - 1; j++) {
++			if (array[j].remote.v4_pref_len < array[j+1].remote.v4_pref_len) {
++				nat46_swap (&array[j], &array[j+1]);
++			}
++		}
++	}
+ 
++	array = &nat46->sorted_ipv6_local_pairs[0];
++	for (i = 0; i < nelem - 1; i++) {
++		for (j = 0; j < nelem - i - 1; j++) {
++			if (array[j].local.v6_pref_len < array[j+1].local.v6_pref_len) {
++				nat46_swap (&array[j], &array[j+1]);
++			}
++		}
++	}
++
++	array = &nat46->sorted_ipv6_remote_pairs[0];
++	for (i = 0; i < nelem - 1; i++) {
++		for (j = 0; j < nelem - i - 1; j++) {
++			if (array[j].remote.v6_pref_len < array[j+1].remote.v6_pref_len) {
++				nat46_swap (&array[j], &array[j+1]);
++			}
++		}
++	}
++}
++
++bool nat46_validate_RFC6052_style(nat46_instance_t *nat46, nat46_xlate_rule_t rule)
++{
++	if (rule.style == NAT46_XLATE_RFC6052) {
++		if (!((rule.v6_pref_len == 32) || (rule.v6_pref_len == 40) ||
++					(rule.v6_pref_len == 48) || (rule.v6_pref_len == 56) ||
++					(rule.v6_pref_len == 64) || (rule.v6_pref_len == 96))) {
++			nat46debug(3, "IPv6 prefix len is invalid");
++			return false;
++		}
++	}
++	return true;
++}
++
++bool nat46_validate_MAP_style(nat46_instance_t *nat46, nat46_xlate_rule_t rule)
++{
++	int psid_len;
++	if (rule.style == NAT46_XLATE_MAP) {
++
++		/*
++		 * max ea_len is 48
++		 */
++		if (rule.ea_len > EA_LEN_MAX) {
++			nat46debug(3, "EA-length should not exceed 48");
++			return false;
++		}
++
++		if (rule.v4_pref_len + rule.ea_len > IPV4_BITS_MAX) {
++			psid_len = rule.ea_len - (IPV4_BITS_MAX - rule.v4_pref_len);
++		} else {
++			psid_len = 0;
++		}
++
++		if (psid_len + rule.psid_offset > PSID_LEN_MAX) {
++			nat46debug(3, "psid_len + psid_offset should not exceed 16");
++			return false;
++		}
++	}
++	return true;
++}
++
++int nat46_validate_ipair_config(nat46_instance_t *nat46, nat46_xlate_rulepair_t *apair)
++{
++	if (!nat46_validate_RFC6052_style(nat46, apair->local)) {
++		return -1;
++	}
++
++	if (!nat46_validate_RFC6052_style(nat46, apair->remote)) {
++		return -1;
++	}
++
++	if (!nat46_validate_MAP_style(nat46, apair->local)) {
++		return -1;
++	}
++
++	if (!nat46_validate_MAP_style(nat46, apair->remote)) {
++		return -1;
++	}
++	return 0;
++}
++
++/*
++ * Parse the config commands in the buffer,
++ * destructive (puts zero between the args)
++ */
+ int nat46_set_ipair_config(nat46_instance_t *nat46, int ipair, char *buf, int count) {
+   char *tail = buf;
+   char *arg_name;
+@@ -217,7 +347,18 @@ int nat46_set_ipair_config(nat46_instanc
+       err = try_parse_rule_arg(&apair->remote, arg_name, &tail);
+     }
+   }
+-  return err;
++
++  err = nat46_validate_ipair_config(nat46, apair);
++  if (err) {
++    return err;
++  }
++
++  /*
++   * sort nat46->pairs based on prefix length.
++   */
++  nat46_sort_rule_array(nat46);
++
++  return 0;
+ }
+ 
+ int nat46_set_config(nat46_instance_t *nat46, char *buf, int count) {
+@@ -933,37 +1074,120 @@ int is_last_pair_in_group(nat46_xlate_ru
+   return ( (apair->local.style != NAT46_XLATE_NONE) && (apair->remote.style != NAT46_XLATE_NONE) );
+ }
+ 
++nat46_xlate_rulepair_t *nat46_lpm(nat46_instance_t *nat46, nat46_rule_type_t type, void *paddr) {
++	int ipair = 0;
++	nat46_xlate_rulepair_t *apair = NULL;
++	uint32_t mask = 0;
++	uint8_t *pa1;
++	uint8_t *pa2;
++
++	if(!nat46 || !paddr) {
++		return NULL;
++	}
++
++	switch (type) {
++	case NAT46_IPV4_LOCAL:
++		for (ipair = 0; ipair < nat46->npairs; ipair++) {
++			apair = &nat46->sorted_ipv4_local_pairs[ipair];
++
++			/*
++			 * For a 32-bit number, if the shift count is 32, then the
++			 * result of the left shift operation is always 0.
++			 */
++			if (apair->local.v4_pref_len) {
++				mask = htonl(U32_MASK << (IPV4_BITS_MAX - apair->local.v4_pref_len));
++			}
++
++			if((*(uint32_t *)paddr & mask) == (apair->local.v4_pref & mask)) {
++				return apair;
++			}
++		}
++		break;
++	case NAT46_IPV4_REMOTE:
++		for (ipair = 0; ipair < nat46->npairs; ipair++) {
++			apair = &nat46->sorted_ipv4_remote_pairs[ipair];
++
++			/*
++			 * For a 32-bit number, if the shift count is 32, then the
++			 * result of the left shift operation is always 0.
++			 */
++			if (apair->remote.v4_pref_len) {
++				mask = htonl(U32_MASK << (IPV4_BITS_MAX - apair->remote.v4_pref_len));
++			}
++
++			if((*(uint32_t *)paddr & mask) == (apair->remote.v4_pref & mask)) {
++				return apair;
++			}
++		}
++		break;
++	case NAT46_IPV6_LOCAL:
++		for (ipair = 0; ipair < nat46->npairs; ipair++) {
++			apair = &nat46->sorted_ipv6_local_pairs[ipair];
++			if(memcmp(paddr, &apair->local.v6_pref, apair->local.v6_pref_len / BITS_PER_BYTE)) {
++				continue;
++			}
++			if(apair->local.v6_pref_len % BITS_PER_BYTE) {
++				mask = U8_MASK << (BITS_PER_BYTE - (apair->local.v6_pref_len % BITS_PER_BYTE));
++				pa1 = (uint8_t *)paddr + (apair->local.v6_pref_len / BITS_PER_BYTE);
++				pa2 = (uint8_t *)&apair->local.v6_pref + (apair->local.v6_pref_len / BITS_PER_BYTE);
++
++				if ((*pa1 & mask) == (*pa2 & mask)) {
++					return apair;
++				}
++			}
++			else
++				return apair;
++		}
++		break;
++	case NAT46_IPV6_REMOTE:
++		for (ipair = 0; ipair < nat46->npairs; ipair++) {
++			apair = &nat46->sorted_ipv6_remote_pairs[ipair];
++			if(memcmp(paddr, &apair->remote.v6_pref, apair->remote.v6_pref_len / BITS_PER_BYTE)) {
++				continue;
++			}
++			if(apair->remote.v6_pref_len % BITS_PER_BYTE) {
++				mask = U8_MASK << (BITS_PER_BYTE - (apair->remote.v6_pref_len % BITS_PER_BYTE));
++				pa1 = (uint8_t *)paddr + (apair->remote.v6_pref_len / BITS_PER_BYTE);
++				pa2 = (uint8_t *)&apair->remote.v6_pref + (apair->remote.v6_pref_len / BITS_PER_BYTE);
++
++				if((*pa1 & mask) == (*pa2 & mask)) {
++					return apair;
++				}
++			}
++			else
++				return apair;
++		}
++		break;
++	default:
++		nat46debug(0, "%s : Invalid prefix type.\n", __func__);
++	}
++	return NULL;
++}
++
+ void pairs_xlate_v6_to_v4_inner(nat46_instance_t *nat46, struct ipv6hdr *ip6h, __u32 *pv4saddr, __u32 *pv4daddr) {
+   int ipair = 0;
+   nat46_xlate_rulepair_t *apair = NULL;
+   int xlate_src = -1;
+   int xlate_dst = -1;
+ 
+-  for(ipair = 0; ipair < nat46->npairs; ipair++) {
+-    apair = &nat46->pairs[ipair];
++  apair = nat46_lpm(nat46, NAT46_IPV6_REMOTE, &ip6h->daddr);
++  if (!apair) {
++    return;
++  }
+ 
+-    if(-1 == xlate_dst) {
+-      if(xlate_v6_to_v4(nat46, &apair->remote, &ip6h->daddr, pv4daddr)) {
+-        xlate_dst = ipair;
+-      }
+-    }
+-    if(-1 == xlate_src) {
+-      if(xlate_v6_to_v4(nat46, &apair->local, &ip6h->saddr, pv4saddr)) {
+-        xlate_src = ipair;
+-      }
+-    }
+-    if((xlate_src >= 0) && (xlate_dst >= 0)) {
+-      /* we did manage to translate it */
+-      break;
+-    } else {
+-      /* We did not match fully and there are more rules */
+-      if((ipair+1 < nat46->npairs) && is_last_pair_in_group(apair)) {
+-        xlate_src = -1;
+-        xlate_dst = -1;
+-      }
+-    }
++  if (xlate_v6_to_v4(nat46, &apair->remote, &ip6h->daddr, pv4daddr)) {
++    xlate_dst = ipair;
++  }
++  if (xlate_v6_to_v4(nat46, &apair->local, &ip6h->saddr, pv4saddr)) {
++    xlate_src = ipair;
++  }
++
++  if ((xlate_src >= 0) && (xlate_dst >= 0)) {
++    /* we did manage to translate it */
++    nat46debug(5, "[nat46payload] xlate results: src %d dst %d", xlate_src, xlate_dst);
++  } else {
++    nat46debug(1, "[nat46] Could not find a translation pair v6->v4 src %pI6c dst %pI6c", &ip6h->saddr, &ip6h->daddr);
+   }
+-  nat46debug(5, "[nat46payload] xlate results: src %d dst %d", xlate_src, xlate_dst);
+ }
+ 
+ /*
+@@ -1557,40 +1781,31 @@ static uint16_t nat46_fixup_icmp(nat46_i
+   return ret;
+ }
+ 
+-int pairs_xlate_v6_to_v4_outer(nat46_instance_t *nat46, struct ipv6hdr *ip6h, uint16_t proto, __u32 *pv4saddr, __u32 *pv4daddr) {
++int pairs_xlate_v6_to_v4_outer(nat46_instance_t *nat46, nat46_xlate_rulepair_t *apair,
++		struct ipv6hdr *ip6h, uint16_t proto, __u32 *pv4saddr, __u32 *pv4daddr) {
+   int ipair = 0;
+-  nat46_xlate_rulepair_t *apair = NULL;
+   int xlate_src = -1;
+   int xlate_dst = -1;
+ 
+   for(ipair = 0; ipair < nat46->npairs; ipair++) {
+-    apair = &nat46->pairs[ipair];
+-
+-    if(-1 == xlate_dst) {
+-      if (xlate_v6_to_v4(nat46, &apair->local, &ip6h->daddr, pv4daddr)) {
+-        nat46debug(5, "Dst addr %pI6 to %pI4 \n", &ip6h->daddr, pv4daddr);
+-        xlate_dst = ipair;
+-      }
++    apair = nat46_lpm(nat46, NAT46_IPV6_REMOTE, &ip6h->saddr);
++    if (!apair) {
++      return 0;
+     }
+-    if(-1 == xlate_src) {
+-      if (xlate_v6_to_v4(nat46, &apair->remote, &ip6h->saddr, pv4saddr)) {
+-        nat46debug(5, "Src addr %pI6 to %pI4 \n", &ip6h->saddr, pv4saddr);
+-        xlate_src = ipair;
+-      }
++
++    if (xlate_v6_to_v4(nat46, &apair->local, &ip6h->daddr, pv4daddr)) {
++      nat46debug(5, "Dst addr %pI6 to %pI4 \n", &ip6h->daddr, pv4daddr);
++      xlate_dst = ipair;
+     }
+-    if( (xlate_src >= 0) && (xlate_dst >= 0) ) {
+-      break;
+-    } else {
+-      /* We did not match fully and there are more rules */
+-      if((ipair+1 < nat46->npairs) && is_last_pair_in_group(apair)) {
+-        xlate_src = -1;
+-        xlate_dst = -1;
+-      }
++
++    if (xlate_v6_to_v4(nat46, &apair->remote, &ip6h->saddr, pv4saddr)) {
++      nat46debug(5, "Src addr %pI6 to %pI4 \n", &ip6h->saddr, pv4saddr);
++      xlate_src = ipair;
+     }
+   }
+   if (xlate_dst >= 0) {
+     if (xlate_src < 0) {
+-      if(proto == NEXTHDR_ICMP) {
++      if (proto == NEXTHDR_ICMP) {
+         nat46debug(1, "[nat46] Could not translate remote address v6->v4, ipair %d, for ICMP6 use dest addr", ipair);
+         *pv4saddr = *pv4daddr;
+         xlate_src = xlate_dst;
+@@ -1606,12 +1821,14 @@ int pairs_xlate_v6_to_v4_outer(nat46_ins
+ }
+ 
+ int xlate_6_to_4(struct net_device *dev, struct ipv6hdr *ip6h, uint16_t proto, __u32 *pv4saddr, __u32 *pv4daddr) {
+-	return pairs_xlate_v6_to_v4_outer(netdev_nat46_instance(dev), ip6h, proto, pv4saddr, pv4daddr);
++	nat46_xlate_rulepair_t apair;
++	return pairs_xlate_v6_to_v4_outer(netdev_nat46_instance(dev), &apair, ip6h, proto, pv4saddr, pv4daddr);
+ }
+ EXPORT_SYMBOL(xlate_6_to_4);
+ 
+ int nat46_ipv6_input(struct sk_buff *old_skb) {
+   struct ipv6hdr *ip6h = ipv6_hdr(old_skb);
++  nat46_xlate_rulepair_t apair;
+   nat46_instance_t *nat46 = get_nat46_instance(old_skb);
+   uint16_t proto;
+   uint16_t frag_off;
+@@ -1684,7 +1901,7 @@ int nat46_ipv6_input(struct sk_buff *old
+     check_for_l4 = 1;
+   }
+ 
+-  if(!pairs_xlate_v6_to_v4_outer(nat46, ip6h, proto, &v4saddr, &v4daddr)) {
++  if (!pairs_xlate_v6_to_v4_outer(nat46, &apair, ip6h, proto, &v4saddr, &v4daddr)) {
+     nat46debug(0, "[nat46] Could not translate v6->v4");
+     goto done;
+   }
+@@ -1837,56 +2054,44 @@ int ip4_input_not_interested(nat46_insta
+   return 0;
+ }
+ 
+-int pairs_xlate_v4_to_v6_outer(nat46_instance_t *nat46, struct iphdr *hdr4, uint16_t *sport, uint16_t *dport, void *v6saddr, void *v6daddr) {
++int pairs_xlate_v4_to_v6_outer(nat46_instance_t *nat46, nat46_xlate_rulepair_t *apair,
++		struct iphdr *hdr4, uint16_t *sport, uint16_t *dport, void *v6saddr, void *v6daddr) {
+   int ipair = 0;
+-  nat46_xlate_rulepair_t *apair = NULL;
+   int xlate_src = -1;
+   int xlate_dst = -1;
++  int ret = 0;
+ 
+-  for(ipair = 0; ipair < nat46->npairs; ipair++) {
+-    apair = &nat46->pairs[ipair];
++  apair = nat46_lpm(nat46, NAT46_IPV4_REMOTE, &hdr4->daddr);
++  if (!apair) {
++    return 0;
++  }
+ 
+-    if(-1 == xlate_src) {
+-      if(xlate_v4_to_v6(nat46, &apair->local, &hdr4->saddr, v6saddr, sport)) {
+-        nat46debug(5, "Src addr %pI4 to %pI6 \n", &hdr4->saddr, v6saddr);
+-        xlate_src = ipair;
+-      }
+-    }
+-    if(-1 == xlate_dst) {
+-      if(xlate_v4_to_v6(nat46, &apair->remote, &hdr4->daddr, v6daddr, dport)) {
+-        nat46debug(5, "Dst addr %pI4 to %pI6 \n", &hdr4->daddr, v6daddr);
+-        xlate_dst = ipair;
+-      }
+-    }
+-    if( (xlate_src >= 0) && (xlate_dst >= 0) ) {
+-      break;
+-    } else {
+-      /* We did not match fully and there are more rules */
+-      if((ipair+1 < nat46->npairs) && is_last_pair_in_group(apair)) {
+-        xlate_src = -1;
+-        xlate_dst = -1;
+-      }
+-    }
++  if (xlate_v4_to_v6(nat46, &apair->local, &hdr4->saddr, v6saddr, sport)) {
++    nat46debug(5, "Src addr %pI4 to %pI6 \n", &hdr4->saddr, v6saddr);
++    xlate_src = ipair;
++  }
++  if (xlate_v4_to_v6(nat46, &apair->remote, &hdr4->daddr, v6daddr, dport)) {
++    nat46debug(5, "Dst addr %pI4 to %pI6 \n", &hdr4->daddr, v6daddr);
++    xlate_dst = ipair;
+   }
+   nat46debug(5, "[nat46] pairs_xlate_v4_to_v6_outer result: src %d dst %d", xlate_src, xlate_dst);
+   if ( (xlate_src >= 0) && (xlate_dst >= 0) ) {
+-    return 1;
++    ret = 1;
++  } else {
++    nat46debug(1, "[nat46] Could not find a translation pair v4->v6");
+   }
+-
+-  nat46debug(1, "[nat46] Could not find a translation pair v4->v6");
+-
+-  return 0;
++  return ret;
+ }
+ 
+ int xlate_4_to_6(struct net_device *dev, struct iphdr *hdr4, uint16_t sport, uint16_t dport, void *v6saddr, void *v6daddr) {
+-	return pairs_xlate_v4_to_v6_outer(netdev_nat46_instance(dev), hdr4, &sport, &dport, v6saddr, v6daddr);
++	nat46_xlate_rulepair_t apair;
++	return pairs_xlate_v4_to_v6_outer(netdev_nat46_instance(dev), &apair, hdr4, &sport, &dport, v6saddr, v6daddr);
+ }
+ EXPORT_SYMBOL(xlate_4_to_6);
+ 
+-/* FIXME: This is a workaround, till the LPM is not added. The sport & dport in inner header will be dport & sport of the outer
+- * header, respectively. Hence, dest. and source ips of inner header will be found in local & remote rules, respectively.
+- * Will work only for a pair of local & remote rules. Once LPM is brought in, this method can be removed and
+- * pairs_xlate_v4_to_v6_outer be used instead.
++/*
++ * The sport & dport in inner header will be dport & sport of the outer header, respectively.
++ * Hence, dest. and source ips of inner header will be found in local & remote rules, respectively.
+  */
+ int pairs_xlate_v4_to_v6_inner(nat46_instance_t *nat46, struct iphdr *iph,
+ 		uint16_t sport, uint16_t dport, void *v6saddr, void *v6daddr) {
+@@ -1895,35 +2100,27 @@ int pairs_xlate_v4_to_v6_inner(nat46_ins
+ 	int xlate_src = -1;
+ 	int xlate_dst = -1;
+ 
+-	for (ipair = 0; ipair < nat46->npairs; ipair++) {
+-		apair = &nat46->pairs[ipair];
++	apair = nat46_lpm(nat46, NAT46_IPV4_REMOTE, &iph->saddr);
++	if (!apair) {
++		return 0;
++	}
+ 
+-		if (-1 == xlate_dst) {
+-			if (xlate_v4_to_v6(nat46, &apair->local, &iph->daddr, v6daddr, &dport)) {
+-				nat46debug(3, "Dst addr %pI4 to %pI6 \n", &iph->daddr, v6daddr);
+-				xlate_dst = ipair;
+-			}
+-		}
+-		if (-1 == xlate_src) {
+-			if(xlate_v4_to_v6(nat46, &apair->remote, &iph->saddr, v6saddr, &sport)) {
+-				nat46debug(3, "Src addr %pI4 to %pI6 \n", &iph->saddr, v6saddr);
+-				xlate_src = ipair;
+-			}
+-		}
+-		if ((xlate_src >= 0) && (xlate_dst >= 0)) {
+-			/* we did manage to translate it */
+-			nat46debug(5, "[nat46] Inner header xlate results: src %d dst %d", xlate_src, xlate_dst);
+-			return 1;
+-		} else {
+-			/* We did not match fully and there are more rules */
+-			if((ipair+1 < nat46->npairs) && is_last_pair_in_group(apair)) {
+-				xlate_src = -1;
+-				xlate_dst = -1;
+-			}
+-		}
+-}
++	if (xlate_v4_to_v6(nat46, &apair->local, &iph->daddr, v6daddr, &dport)) {
++		nat46debug(3, "Dst addr %pI4 to %pI6 \n", &iph->daddr, v6daddr);
++		xlate_dst = ipair;
++	}
++	if (xlate_v4_to_v6(nat46, &apair->remote, &iph->saddr, v6saddr, &sport)) {
++		nat46debug(3, "Src addr %pI4 to %pI6 \n", &iph->saddr, v6saddr);
++		xlate_src = ipair;
++	}
++	if ((xlate_src >= 0) && (xlate_dst >= 0)) {
++		/* we did manage to translate it */
++		nat46debug(5, "[nat46] Inner header xlate results: src %d dst %d", xlate_src, xlate_dst);
++		return 1;
++	} else {
++		nat46debug(1, "[nat46] Could not find a translation pair v4->v6");
++	}
+ 
+-	nat46debug(1, "[nat46] Could not find a translation pair v4->v6");
+ 	return 0;
+ }
+ 
+@@ -2020,6 +2217,7 @@ static uint16_t xlate_pkt_in_err_v4_to_v
+ 
+ int nat46_ipv4_input(struct sk_buff *old_skb) {
+   nat46_instance_t *nat46 = get_nat46_instance(old_skb);
++  nat46_xlate_rulepair_t apair;
+   struct sk_buff *new_skb;
+   uint16_t sport = 0, dport = 0, ret = 0;
+ 
+@@ -2097,7 +2295,7 @@ int nat46_ipv4_input(struct sk_buff *old
+     having_l4 = 1;
+   }
+ 
+-  if(!pairs_xlate_v4_to_v6_outer(nat46, hdr4, having_l4 ? &sport : NULL, having_l4 ? &dport : NULL, v6saddr, v6daddr)) {
++  if(!pairs_xlate_v4_to_v6_outer(nat46, &apair, hdr4, having_l4 ? &sport : NULL, having_l4 ? &dport : NULL, v6saddr, v6daddr)) {
+     nat46debug(0, "[nat46] Could not translate v4->v6");
+     goto done;
+   }
+--- a/nat46/modules/nat46-core.h
++++ b/nat46/modules/nat46-core.h
+@@ -23,6 +23,15 @@
+ // #define nat46debug(level, format, ...)
+ #define nat46debug(level, format, ...) do { if(nat46->debug >= level) { printk(format "\n", ##__VA_ARGS__); } } while (0)
+ 
++#define U8_MASK (uint8_t)(0xFF)
++#define U32_MASK (uint32_t)(~0U)
++#define BITS_PER_BYTE 8
++#define PSID_LEN_MAX 16
++#define NUM_RULE_PAIRS_MAX 32
++#define IPV4_BITS_MAX 32
++#define EA_LEN_MAX 48
++#define IPV6_BITS_MAX 128
++
+ #define IPV6HDRSIZE 40
+ #define IPV4HDRSIZE 20
+ #define IPV6V4HDRDELTA (IPV6HDRSIZE - IPV4HDRSIZE)
+@@ -39,6 +48,17 @@ typedef enum {
+   NAT46_XLATE_RFC6052
+ } nat46_xlate_style_t;
+ 
++/*
++ * Enumeration for sorting pairs based on
++ * type of prefix length.
++ */
++typedef enum {
++  NAT46_IPV4_LOCAL = 0,
++  NAT46_IPV4_REMOTE,
++  NAT46_IPV6_LOCAL,
++  NAT46_IPV6_REMOTE
++} nat46_rule_type_t;
++
+ #define NAT46_SIGNATURE 0x544e3634
+ #define FREED_NAT46_SIGNATURE 0xdead544e
+ 
+@@ -64,7 +84,11 @@ typedef struct {
+   int debug;
+ 
+   int npairs;
+-  nat46_xlate_rulepair_t pairs[0]; /* npairs */
++  nat46_xlate_rulepair_t pairs[NUM_RULE_PAIRS_MAX]; /* npairs */
++  nat46_xlate_rulepair_t sorted_ipv4_local_pairs[NUM_RULE_PAIRS_MAX]; /* npairs */
++  nat46_xlate_rulepair_t sorted_ipv4_remote_pairs[NUM_RULE_PAIRS_MAX]; /* npairs */
++  nat46_xlate_rulepair_t sorted_ipv6_local_pairs[NUM_RULE_PAIRS_MAX]; /* npairs */
++  nat46_xlate_rulepair_t sorted_ipv6_remote_pairs[NUM_RULE_PAIRS_MAX]; /* npairs */
+ } nat46_instance_t;
+ 
+ int nat46_ipv6_input(struct sk_buff *old_skb);
+--- a/nat46/modules/nat46-netdev.c
++++ b/nat46/modules/nat46-netdev.c
+@@ -270,7 +270,14 @@ int nat46_insert(char *devname, char *bu
+ 	int ret = -1;
+ 	if(dev) {
+ 		nat46_instance_t *nat46 = netdev_nat46_instance(dev);
+-		nat46_instance_t *nat46_new = alloc_nat46_instance(nat46->npairs+1, nat46, 0, 1, -1);
++		nat46_instance_t *nat46_new;
++
++		if(nat46->npairs == NUM_RULE_PAIRS_MAX) {
++			printk("Could not insert a new rule on device %s\n", devname);
++			return ret;
++		}
++
++		nat46_new = alloc_nat46_instance(nat46->npairs+1, nat46, 0, 1, -1);
+ 		if(nat46_new) {
+ 			netdev_nat46_set_instance(dev, nat46_new);
+ 			ret = nat46_set_ipair_config(nat46_new, 0, buf, strlen(buf));
diff --git a/package/kernel/nat46/patches/106-dummy_header.patch b/package/kernel/nat46/patches/106-dummy_header.patch
new file mode 100644
index 00000000000000..1d4351166fb963
--- /dev/null
+++ b/package/kernel/nat46/patches/106-dummy_header.patch
@@ -0,0 +1,104 @@
+Author:  Pavithra R <pavir@codeaurora.org>
+Date:      Wed Aug 5 10:09:45 2020 +0530
+
+nat46: Add dummy fragment header for DF=0 IPv4 packet.
+
+This patch is propagated from 4.4 kernel commit
+b45f19e86ebcc19ea26d5e014bfdcb837148f99e.
+
+Add dummy fragment header to IPv6 translated packet for
+every DF=0 IPv4 packet.
+
+Change-Id: Id72945eefac030e95e4fd18305e48c46e525def3
+Signed-off-by: Pavithra R <pavir@codeaurora.org>
+
+--- a/nat46/modules/nat46-core.c
++++ b/nat46/modules/nat46-core.c
+@@ -1996,6 +1996,27 @@ done:
+ 
+ 
+ 
++/*
++ * Function to get MAP-T rules and flags.
++ */
++bool nat46_get_info(struct net_device *dev, nat46_xlate_rulepair_t **nat46_rule_pair,
++		 int *count, u8 *flag) {
++	if ((!dev) || (!nat46_rule_pair) || (!count) || (!flag)) {
++		return false;
++	}
++
++	if (!nat46_get_rule_config(dev, nat46_rule_pair, count)) {
++		return false;
++	}
++
++	/* Check add dummy header flag */
++	if (add_dummy_header) {
++		*flag = ADD_DUMMY_HEADER;
++	}
++	return true;
++}
++EXPORT_SYMBOL(nat46_get_info);
++
+ void ip6_update_csum(struct sk_buff * skb, struct ipv6hdr * ip6hdr, int do_atomic_frag)
+ {
+   u32 sum1=0;
+@@ -2254,6 +2275,11 @@ int nat46_ipv4_input(struct sk_buff *old
+     }
+     hdr4 = ip_hdr(old_skb);
+     check_for_l4 = 1;
++    if (add_dummy_header) {
++      if (0 == (ntohs(hdr4->frag_off) & IP_DF)) {
++        add_frag_header = 1;
++      }
++    }
+   } else {
+     add_frag_header = 1;
+     if (0 == (ntohs(hdr4->frag_off) & 0x1FFF)) {
+--- a/nat46/modules/nat46-core.h
++++ b/nat46/modules/nat46-core.h
+@@ -32,6 +32,9 @@
+ #define EA_LEN_MAX 48
+ #define IPV6_BITS_MAX 128
+ 
++/* Flag definations for MAP-T */
++#define ADD_DUMMY_HEADER 0x01
++
+ #define IPV6HDRSIZE 40
+ #define IPV4HDRSIZE 20
+ #define IPV6V4HDRDELTA (IPV6HDRSIZE - IPV4HDRSIZE)
+@@ -110,5 +113,6 @@ int xlate_6_to_4(struct net_device *dev,
+ int xlate_4_to_6(struct net_device *dev, struct iphdr *hdr4, uint16_t sport, uint16_t dport, void *v6saddr, void *v6daddr);
+ bool nat46_get_rule_config(struct net_device *dev, nat46_xlate_rulepair_t **nat46_rule_pair, int *count);
+ int nat46_get_npairs(struct net_device *dev);
+-
++bool nat46_get_info(struct net_device *dev, nat46_xlate_rulepair_t **nat46_rule_pair,
++		int *count, u8 *flag);
+ #endif
+--- a/nat46/modules/nat46-module.c
++++ b/nat46/modules/nat46-module.c
+@@ -56,12 +56,16 @@ MODULE_AUTHOR("Andrew Yourtchenko <ayour
+ MODULE_DESCRIPTION("NAT46 stateless translation");
+ 
+ int debug = 0;
++bool add_dummy_header = 0;
+ int zero_csum_pass = 0;
+ int ip_tos_ignore = 0;
+ 
+ module_param(debug, int, 0);
+ MODULE_PARM_DESC(debug, "debugging messages level (default=0)");
+ 
++module_param(add_dummy_header, bool, 0);
++MODULE_PARM_DESC(add_dummy_header, "Add dummy fragment header");
++
+ module_param(zero_csum_pass, int, 0);
+ MODULE_PARM_DESC(zero_csum_pass, "pass all-zero checksum unchanged (default=0)");
+ 
+--- a/nat46/modules/nat46-module.h
++++ b/nat46/modules/nat46-module.h
+@@ -14,5 +14,6 @@
+  */
+ 
+ extern int debug;
++extern bool add_dummy_header;
+ extern int zero_csum_pass;
+ extern int ip_tos_ignore;
diff --git a/package/kernel/nat46/patches/107-stats.patch b/package/kernel/nat46/patches/107-stats.patch
new file mode 100644
index 00000000000000..4667613d8f540e
--- /dev/null
+++ b/package/kernel/nat46/patches/107-stats.patch
@@ -0,0 +1,136 @@
+Author:  Pavithra R <pavir@codeaurora.org>
+Date:    Wed Aug 5 10:57:25 2020 +0530
+
+nat46: Add support for 64-bits stats.
+
+This patch is propagated from 4.4 kernel commit
+4a2d1dd9bc9331392c7a4947126c361217c82e0c
+
+Add 64-bits stats functionality for MAP-T interface.
+
+Change-Id: I4a6f9c7ed3554ac0ec672aa5fa283be2e95cfdc0
+Signed-off-by: Pavithra R <pavir@codeaurora.org>
+
+--- a/nat46/modules/nat46-netdev.c
++++ b/nat46/modules/nat46-netdev.c
+@@ -24,6 +24,7 @@
+ #include <net/ip6_route.h>
+ #include <net/ipv6.h>
+ #include <linux/version.h>
++#include <net/ip_tunnels.h>
+ #include <linux/radix-tree.h>
+ #include "nat46-core.h"
+ #include "nat46-module.h"
+@@ -40,16 +41,40 @@ static u8 netdev_count = 0;
+ 
+ static int nat46_netdev_up(struct net_device *dev);
+ static int nat46_netdev_down(struct net_device *dev);
+-
++static int nat46_netdev_init(struct net_device *dev);
++static void nat46_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *tot);
+ static netdev_tx_t nat46_netdev_xmit(struct sk_buff *skb, struct net_device *dev);
+ 
+ 
+ static const struct net_device_ops nat46_netdev_ops = {
++	.ndo_init       = nat46_netdev_init,	/* device specific initialization */
+ 	.ndo_open       = nat46_netdev_up,      /* Called at ifconfig nat46 up */
+ 	.ndo_stop       = nat46_netdev_down,    /* Called at ifconfig nat46 down */
+ 	.ndo_start_xmit = nat46_netdev_xmit,    /* REQUIRED, must return NETDEV_TX_OK */
++	.ndo_get_stats64 = nat46_get_stats64,	/* 64 bit device stats */
+ };
+ 
++static int nat46_netdev_init(struct net_device *dev)
++{
++	int i;
++	dev->tstats = alloc_percpu(struct pcpu_sw_netstats);
++	if (!dev->tstats) {
++		return -ENOMEM;
++	}
++
++	for_each_possible_cpu(i) {
++		struct pcpu_sw_netstats *ipt_stats;
++		ipt_stats = per_cpu_ptr(dev->tstats, i);
++		u64_stats_init(&ipt_stats->syncp);
++	}
++	return 0;
++}
++
++static void nat46_netdev_resource_free(struct net_device *dev)
++{
++	free_percpu(dev->tstats);
++}
++
+ static int nat46_netdev_up(struct net_device *dev)
+ {
+ 	netif_start_queue(dev);
+@@ -65,9 +90,14 @@ static int nat46_netdev_down(struct net_
+ static netdev_tx_t nat46_netdev_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ 	int ret = 0;
++	struct pcpu_sw_netstats *tstats = get_cpu_ptr(dev->tstats);
++
++	u64_stats_update_begin(&tstats->syncp);
++	u64_stats_inc(&tstats->rx_packets);
++	u64_stats_add(&tstats->rx_bytes, skb->len);
++	u64_stats_update_end(&tstats->syncp);
++	put_cpu_ptr(tstats);
+ 
+-	dev->stats.rx_packets++;
+-	dev->stats.rx_bytes += skb->len;
+ 	if(ETH_P_IP == ntohs(skb->protocol)) {
+ 		ret = nat46_ipv4_input(skb);
+ 	}
+@@ -81,22 +111,39 @@ static netdev_tx_t nat46_netdev_xmit(str
+ }
+ 
+ void nat46_netdev_count_xmit(struct sk_buff *skb, struct net_device *dev) {
+-	dev->stats.tx_packets++;
+-	dev->stats.tx_bytes += skb->len;
++	struct pcpu_sw_netstats *tstats = get_cpu_ptr(dev->tstats);
++
++	u64_stats_update_begin(&tstats->syncp);
++	u64_stats_inc(&tstats->tx_packets);
++	u64_stats_add(&tstats->tx_bytes, skb->len);
++	u64_stats_update_end(&tstats->syncp);
++	put_cpu_ptr(tstats);
+ }
+ 
+ void nat46_update_stats(struct net_device *dev, uint32_t rx_packets, uint32_t rx_bytes,
+ 			uint32_t tx_packets, uint32_t tx_bytes, uint32_t rx_dropped, uint32_t tx_dropped)
+ {
+-	dev->stats.rx_packets += rx_packets;
+-	dev->stats.rx_bytes += rx_bytes;
+-	dev->stats.tx_packets += tx_packets;
+-	dev->stats.tx_bytes += tx_bytes;
++	struct pcpu_sw_netstats *tstats = get_cpu_ptr(dev->tstats);
++
++	u64_stats_update_begin(&tstats->syncp);
++	u64_stats_add(&tstats->rx_packets, rx_packets);
++	u64_stats_add(&tstats->rx_bytes, rx_bytes);
++	u64_stats_add(&tstats->tx_packets, tx_packets);
++	u64_stats_add(&tstats->tx_bytes, tx_bytes);
+ 	dev->stats.rx_dropped += rx_dropped;
+ 	dev->stats.tx_dropped += tx_dropped;
++	u64_stats_update_end(&tstats->syncp);
++	put_cpu_ptr(tstats);
+ }
+ EXPORT_SYMBOL(nat46_update_stats);
+ 
++static void nat46_get_stats64(struct net_device *dev,
++		struct rtnl_link_stats64 *tot)
++{
++	netdev_stats_to_stats64(tot, &dev->stats);
++	dev_fetch_sw_netstats(tot, dev->tstats);
++}
++
+ void *netdev_nat46_instance(struct net_device *dev) {
+ 	nat46_netdev_priv_t *priv = netdev_priv(dev);
+ 	return priv->nat46;
+@@ -120,6 +167,7 @@ static void nat46_netdev_setup(struct ne
+ 	priv->nat46 = nat46;
+ 
+ 	dev->netdev_ops = &nat46_netdev_ops;
++	dev->priv_destructor = nat46_netdev_resource_free;
+ 	dev->type = ARPHRD_NONE;
+ 	dev->hard_header_len = 0;
+ 	dev->addr_len = 0;
diff --git a/package/kernel/nat46/patches/108-ce_port.patch b/package/kernel/nat46/patches/108-ce_port.patch
new file mode 100644
index 00000000000000..ab6ab37b986e07
--- /dev/null
+++ b/package/kernel/nat46/patches/108-ce_port.patch
@@ -0,0 +1,134 @@
+Author:  Pavithra R <pavir@codeaurora.org>
+Date:    Wed Aug 5 18:59:20 2020 +0530
+
+nat46: Copy CE's port number to IPv6 fragment header.
+
+This patch is propagated from kernel 4.4 commit
+7886fd3eb081c7767b02685593bc1d19deaecba8
+
+Copy CE's port number to the lower 16-bits of IPv6 identification
+number.
+
+Change-Id: I6946e93bf8bed4c1378d19e75db0729097e0d9eb
+Signed-off-by: Pavithra R <pavir@codeaurora.org>
+
+--- a/nat46/modules/nat46-core.c
++++ b/nat46/modules/nat46-core.c
+@@ -31,6 +31,7 @@
+ 
+ static uint16_t xlate_pkt_in_err_v4_to_v6(nat46_instance_t *nat46, struct iphdr *iph,
+ 			struct sk_buff *old_skb, uint16_t *sport, uint16_t *dport);
++static DEFINE_SPINLOCK(port_id_lock);
+ 
+ void
+ nat46debug_dump(nat46_instance_t *nat46, int level, void *addr, int len)
+@@ -2236,6 +2237,73 @@ static uint16_t xlate_pkt_in_err_v4_to_v
+ 	return 1;
+ }
+ 
++/* Return the port number from CE's port set */
++static uint16_t nat46_get_ce_port(nat46_xlate_rulepair_t *pair, uint16_t sport)
++{
++	/*
++	 * 'psid_bits_len' represents number of bits in PSID.
++	 * 'offset' represents offset of PSID in a port number.
++	 */
++	uint8_t psid_bits_len, offset, port_set_bitmask;
++
++	/*
++	 * 'psid16' represent PSID value.
++	 * 'm' represents number of bits in excluded port set.
++	 * 'a' represents number of bits in a 16-bit port number after PSID.
++	 *     It is used to control number of port in one contiguous port set.
++	 *
++	 * Name of a variable 'a' and 'm' is as per Appendix B of [RFC7597].
++	 */
++	uint16_t psid16, value, m, a;
++	nat46_xlate_rule_t *rule;
++
++	/* stores to last port number from CE's port set */
++	static uint16_t port_num;
++
++	rule = &pair->local;
++	offset = rule->psid_offset;
++
++	if (rule->ea_len + rule->v4_pref_len > IPV4_BITS_MAX) {
++		psid_bits_len = rule->ea_len - (IPV4_BITS_MAX - rule->v4_pref_len);
++	} else {
++		return 0;
++	}
++	a = PSID_LEN_MAX - offset - psid_bits_len;
++	psid16 = (ntohs(sport) >> a) & (0xffff >> (PSID_LEN_MAX - psid_bits_len));
++
++	spin_lock(&port_id_lock);
++
++	/* Start case */
++	if (0 == port_num) {
++		m = (offset) ? 1 : 0;
++		port_num = (m << (PSID_LEN_MAX - offset)) | (psid16 << a);
++		value = port_num;
++		spin_unlock(&port_id_lock);
++		return value;
++	}
++
++	/* End of one port set */
++	port_set_bitmask = (1 << a) - 1;
++	value = port_num & port_set_bitmask;
++	if (0 == (value ^ port_set_bitmask)) {
++		m = port_num >> (PSID_LEN_MAX - offset);
++		m++;
++		/* End case */
++		if (m >= (1 << offset)) {
++			m = (offset) ? 1 : 0;
++		}
++		port_num = (m << (PSID_LEN_MAX - offset)) | (psid16 << a);
++		value = port_num;
++		spin_unlock(&port_id_lock);
++		return value;
++	}
++
++	port_num++;
++	value = port_num;
++	spin_unlock(&port_id_lock);
++	return value;
++}
++
+ int nat46_ipv4_input(struct sk_buff *old_skb) {
+   nat46_instance_t *nat46 = get_nat46_instance(old_skb);
+   nat46_xlate_rulepair_t apair;
+@@ -2368,9 +2436,34 @@ int nat46_ipv4_input(struct sk_buff *old
+ 
+   if (add_frag_header) {
+     struct frag_hdr *fh = (struct frag_hdr*)(hdr6 + 1);
++    uint16_t ce_port_num = 0;
++
++    /* Flag to represent whether PSID is assigned to MAP-T node or not */
++    bool is_psid = false;
++
+     fh->frag_off = htons(((ntohs(hdr4->frag_off) >> 13) & 7) + ((ntohs(hdr4->frag_off) & 0x1FFF) << 3));
+     fh->nexthdr = hdr4->protocol;
+-    fh->identification = htonl(ntohs(hdr4->id));
++
++    /*
++     * PSID assigned MAP-T node will have non-zero ea_len and we are currently
++     * only supporting NAT46_XLATE_MAP as the CE's rule style.
++     */
++    is_psid = (apair.local.style == NAT46_XLATE_MAP) && apair.local.ea_len;
++    if (is_psid) {
++      ce_port_num = nat46_get_ce_port(nat46->pairs, sport);
++      nat46debug(10, "\n ce port number is %02x\n", ce_port_num);
++
++      /* Assign CE's port number as the fragment identifier */
++      if (ce_port_num) {
++        fh->identification = htonl(ce_port_num);
++      } else {
++        fh->identification = htonl(ntohs(hdr4->id));
++      }
++    } else {
++      fh->identification = htonl(ntohs(hdr4->id));
++    }
++
++
+   }
+   ip6_update_csum(new_skb, hdr6, add_frag_header);
+ 
diff --git a/package/kernel/nat46/patches/109-fragment_if_not_df_and_larger_than_mtu.patch b/package/kernel/nat46/patches/109-fragment_if_not_df_and_larger_than_mtu.patch
new file mode 100644
index 00000000000000..333228a97496c3
--- /dev/null
+++ b/package/kernel/nat46/patches/109-fragment_if_not_df_and_larger_than_mtu.patch
@@ -0,0 +1,30 @@
+Author:  Pavithra R <pavir@codeaurora.org>
+Date:    Wed Aug 5 19:26:48 2020 +0530
+
+nat46:  Fix the issue of packets not fragmented
+
+This patch is propagated from the kernel 4.4 commit
+e598f9c249092abd7c7978fe99b6690884f225c9
+
+when packets size is larger than the MTU of dst, if DF flag is not set,
+fragment it instead of dropping it with PktTooBig ICMPv6 message.
+
+Change-Id: I380d42f59bb4f46a45e542f251f5710f2cca8b62
+Signed-off-by: Pavithra R <pavir@codeaurora.org>
+
+--- a/nat46/modules/nat46-core.c
++++ b/nat46/modules/nat46-core.c
+@@ -2343,10 +2343,11 @@ int nat46_ipv4_input(struct sk_buff *old
+     }
+     hdr4 = ip_hdr(old_skb);
+     check_for_l4 = 1;
+-    if (add_dummy_header) {
+-      if (0 == (ntohs(hdr4->frag_off) & IP_DF)) {
++    if (0 == (ntohs(hdr4->frag_off) & IP_DF)) {
++      if (add_dummy_header) {
+         add_frag_header = 1;
+       }
++      old_skb->ignore_df = 1;
+     }
+   } else {
+     add_frag_header = 1;
diff --git a/package/kernel/nat46/patches/110-icmp_error_not_handled.patch b/package/kernel/nat46/patches/110-icmp_error_not_handled.patch
new file mode 100644
index 00000000000000..5697c609732ccf
--- /dev/null
+++ b/package/kernel/nat46/patches/110-icmp_error_not_handled.patch
@@ -0,0 +1,100 @@
+Author:  Pavithra R <pavir@codeaurora.org>
+Date:    Wed Aug 5 20:16:27 2020 +0530
+
+nat46: fix ICMPv6 error message dropped locally
+
+This patch is propagated from the kernel 4.4 commit
+1b96bd0e9ee9182566b119741854c03bf4b94a99
+
+While routing IPv6 packets from a customer-side translated device (CLAT)
+to a provider-side translated device (PLAT), it is possible that the IPv6
+destination is unknown. In such a scenario, the IPv6 stack must send back
+an ICMP error. However, the source IPv6 address of this error message does
+not have a MAP-T translation. According to RFC2473, the translation layer
+should use the tunnel's own IPv4 address for the IPv6 ICMP packet's source
+address.
+
+Change-Id: I784473cddf9214843c466d10763cb66852139ef6
+Signed-off-by: Pavithra R <pavir@codeaurora.org>
+
+--- a/nat46/modules/nat46-core.c
++++ b/nat46/modules/nat46-core.c
+@@ -1782,11 +1782,12 @@ static uint16_t nat46_fixup_icmp(nat46_i
+   return ret;
+ }
+ 
+-int pairs_xlate_v6_to_v4_outer(nat46_instance_t *nat46, nat46_xlate_rulepair_t *apair,
++int pairs_xlate_v6_to_v4_outer(nat46_instance_t *nat46, nat46_xlate_rulepair_t **papair,
+ 		struct ipv6hdr *ip6h, uint16_t proto, __u32 *pv4saddr, __u32 *pv4daddr) {
+   int ipair = 0;
+   int xlate_src = -1;
+   int xlate_dst = -1;
++  nat46_xlate_rulepair_t *apair;
+ 
+   for(ipair = 0; ipair < nat46->npairs; ipair++) {
+     apair = nat46_lpm(nat46, NAT46_IPV6_REMOTE, &ip6h->saddr);
+@@ -1794,6 +1795,7 @@ int pairs_xlate_v6_to_v4_outer(nat46_ins
+       return 0;
+     }
+ 
++    *papair = apair;
+     if (xlate_v6_to_v4(nat46, &apair->local, &ip6h->daddr, pv4daddr)) {
+       nat46debug(5, "Dst addr %pI6 to %pI4 \n", &ip6h->daddr, pv4daddr);
+       xlate_dst = ipair;
+@@ -1822,14 +1824,14 @@ int pairs_xlate_v6_to_v4_outer(nat46_ins
+ }
+ 
+ int xlate_6_to_4(struct net_device *dev, struct ipv6hdr *ip6h, uint16_t proto, __u32 *pv4saddr, __u32 *pv4daddr) {
+-	nat46_xlate_rulepair_t apair;
++	nat46_xlate_rulepair_t *apair;
+ 	return pairs_xlate_v6_to_v4_outer(netdev_nat46_instance(dev), &apair, ip6h, proto, pv4saddr, pv4daddr);
+ }
+ EXPORT_SYMBOL(xlate_6_to_4);
+ 
+ int nat46_ipv6_input(struct sk_buff *old_skb) {
+   struct ipv6hdr *ip6h = ipv6_hdr(old_skb);
+-  nat46_xlate_rulepair_t apair;
++  nat46_xlate_rulepair_t *apair;
+   nat46_instance_t *nat46 = get_nat46_instance(old_skb);
+   uint16_t proto;
+   uint16_t frag_off;
+@@ -1903,8 +1905,37 @@ int nat46_ipv6_input(struct sk_buff *old
+   }
+ 
+   if (!pairs_xlate_v6_to_v4_outer(nat46, &apair, ip6h, proto, &v4saddr, &v4daddr)) {
+-    nat46debug(0, "[nat46] Could not translate v6->v4");
+-    goto done;
++    if (proto == NEXTHDR_ICMP) {
++      struct icmp6hdr *icmp6h = add_offset(ip6h, v6packet_l3size);
++      struct ipv6hdr *ip6h_inner = (struct ipv6hdr *) (icmp6h + 1);
++      struct ipv6hdr hdr6;
++      switch(icmp6h->icmp6_type) {
++        case ICMPV6_DEST_UNREACH:
++        case ICMPV6_PKT_TOOBIG:
++        case ICMPV6_TIME_EXCEED:
++        case ICMPV6_PARAMPROB:
++          /*
++           * For icmpv6 error message, using the original message
++           * address to  locate the apair one more time according
++           * to the RFC 2473, and use the ipv4 address of the
++           * tunnel as SRC ipv4 address
++           */
++          memcpy(&hdr6.saddr, &ip6h_inner->daddr, 16);
++          memcpy(&hdr6.daddr, &ip6h_inner->saddr, 16);
++          if (!pairs_xlate_v6_to_v4_outer(nat46, &apair, &hdr6, proto, &v4saddr, &v4daddr)) {
++            nat46debug(0, "[nat46] Could not translate v6->v4");
++            goto done;
++          }
++          v4saddr = apair->local.v4_pref;
++          break;
++        default:
++          nat46debug(0, "[nat46] Could not translate v6->v4");
++          goto done;
++      }
++    } else {
++      nat46debug(0, "[nat46] Could not translate v6->v4");
++      goto done;
++    }
+   }
+ 
+   if (check_for_l4) {
diff --git a/package/kernel/nat46/patches/111-fix_null_point_reference.patch b/package/kernel/nat46/patches/111-fix_null_point_reference.patch
new file mode 100644
index 00000000000000..4cef9db199d639
--- /dev/null
+++ b/package/kernel/nat46/patches/111-fix_null_point_reference.patch
@@ -0,0 +1,40 @@
+Author:  Pavithra R <pavir@codeaurora.org>
+Date:    Wed Aug 5 20:35:00 2020 +0530
+
+nat46: Fix null pointer dereference issue
+
+This patch is propagated from the kernel 4.4 commit
+5bdf9bd5500c45ab5a3fd43e60c40a09d5e5a13d
+
+get_nat46_instance possibly returns null point, before using the returning
+point, caller needs to check if it is null.
+
+Change-Id: Id407a71ca8eccd60a713c34429e7e3f16e2cdd12
+Signed-off-by: Pavithra R <pavir@codeaurora.org>
+
+--- a/nat46/modules/nat46-core.c
++++ b/nat46/modules/nat46-core.c
+@@ -1847,6 +1847,11 @@ int nat46_ipv6_input(struct sk_buff *old
+   int l3_infrag_payload_len = ntohs(ip6h->payload_len);
+   int check_for_l4 = 0;
+ 
++  if (nat46 == NULL) {
++    printk("nat46:%p skb is dropped for no valid instance found\n", old_skb);
++    return err;
++  }
++
+   nat46debug(4, "nat46_ipv6_input packet");
+ 
+   if(ip6_input_not_interested(nat46, ip6h, old_skb)) {
+@@ -2353,6 +2358,11 @@ int nat46_ipv4_input(struct sk_buff *old
+ 
+   char v6saddr[16], v6daddr[16];
+ 
++  if (nat46 == NULL) {
++    printk("nat46:%p skb is dropped for no valid instance found\n", old_skb);
++    return err;
++  }
++
+   memset(v6saddr, 1, 16);
+   memset(v6daddr, 2, 16);
+ 
diff --git a/package/kernel/nat46/patches/112-fix_icmp_crash.patch b/package/kernel/nat46/patches/112-fix_icmp_crash.patch
new file mode 100644
index 00000000000000..5d34697a45b84d
--- /dev/null
+++ b/package/kernel/nat46/patches/112-fix_icmp_crash.patch
@@ -0,0 +1,40 @@
+Author:  Pavithra R <pavir@codeaurora.org>
+Date:    Wed Aug 5 20:57:33 2020 +0530
+
+Fix crash of free skb
+
+This patch is propagated from the 4.4 kernel commit
+b959b0d45c66ae004a5bfc1687980093fa5b8cc3.
+
+This is caused by the translation of the inner ipv6 header, it
+move memory by the inner head's tot_len which is not exact that
+inner packet will be trimmed for icmp error packets size no more
+than 576.
+
+Change-Id: Id5d41fa0721acdf6ea76721c45415fe3be432207
+Signed-off-by: Pavithra R <pavir@codeaurora.org>
+
+--- a/nat46/modules/nat46-core.c
++++ b/nat46/modules/nat46-core.c
+@@ -2245,7 +2245,9 @@ static uint16_t xlate_pkt_in_err_v4_to_v
+ 
+ 	if (skb_tailroom(old_skb) >= IPV6V4HDRDELTA){
+ 		skb_put(old_skb, IPV6V4HDRDELTA);
+-		memmove(((char *)iiph + IPV6HDRSIZE), (iiph + 1), ntohs(iiph->tot_len) - IPV4HDRSIZE);
++		/* ErrorICMP size is less than 576, the inner ipv4 packet will be trimmed */
++		memmove(((char *)iiph + IPV6HDRSIZE), (iiph + 1),
++		ntohs(iph->tot_len) - 2 * IPV4HDRSIZE - sizeof(struct icmphdr));
+ 		memcpy(iiph, &ip6h, IPV6HDRSIZE);
+ 	}
+ 	else {
+@@ -2258,7 +2260,9 @@ static uint16_t xlate_pkt_in_err_v4_to_v
+ 
+ 		skb_put(old_skb, IPV6V4HDRDELTA);
+ 		iiph = (struct iphdr *)(icmp_hdr(old_skb) + 1);
+-		memmove(((char *)iiph + IPV6HDRSIZE), (iiph + 1), ntohs(iiph->tot_len) - IPV4HDRSIZE);
++		/* ErrorICMP size is less than 576, the inner ipv4 packet will be trimmed */
++		memmove(((char *)iiph + IPV6HDRSIZE), (iiph + 1),
++		ntohs(iph->tot_len) - 2 * IPV4HDRSIZE - sizeof(struct icmphdr));
+ 		memcpy(iiph, &ip6h, IPV6HDRSIZE);
+ 		nat46 = get_nat46_instance(old_skb);
+ 		iph = ip_hdr(old_skb);
diff --git a/package/kernel/nat46/patches/116-rate-limit-the-print.patch b/package/kernel/nat46/patches/116-rate-limit-the-print.patch
new file mode 100644
index 00000000000000..d857d0e6cb0a05
--- /dev/null
+++ b/package/kernel/nat46/patches/116-rate-limit-the-print.patch
@@ -0,0 +1,34 @@
+Author:  Pavithra R <pavir@codeaurora.org>
+Date:    Wed Sep 30 14:05:50 2020 +0530
+
+nat46: Add rate limit to a print.
+
+This patch is propagated from the kernel 4.4 commit
+d47f62508d2c105f236470e56bedbe279db0e6f1
+
+Change-Id: I2119fbe54d630c3ed39535f1cb1b8a0d9d3199b4
+Signed-off-by: Pavithra R <pavir@codeaurora.org>
+--- a/nat46/modules/nat46-core.c
++++ b/nat46/modules/nat46-core.c
+@@ -1928,7 +1928,9 @@ int nat46_ipv6_input(struct sk_buff *old
+           memcpy(&hdr6.saddr, &ip6h_inner->daddr, 16);
+           memcpy(&hdr6.daddr, &ip6h_inner->saddr, 16);
+           if (!pairs_xlate_v6_to_v4_outer(nat46, &apair, &hdr6, proto, &v4saddr, &v4daddr)) {
+-            nat46debug(0, "[nat46] Could not translate v6->v4");
++            if (net_ratelimit()) {
++              nat46debug(0, "[nat46] Could not translate v6->v4");
++            }
+             goto done;
+           }
+           v4saddr = apair->local.v4_pref;
+@@ -2436,7 +2438,9 @@ int nat46_ipv4_input(struct sk_buff *old
+   }
+ 
+   if(!pairs_xlate_v4_to_v6_outer(nat46, &apair, hdr4, having_l4 ? &sport : NULL, having_l4 ? &dport : NULL, v6saddr, v6daddr)) {
+-    nat46debug(0, "[nat46] Could not translate v4->v6");
++    if (net_ratelimit()) {
++      nat46debug(0, "[nat46] Could not translate v4->v6");
++    }
+     goto done;
+   }
+ 
diff --git a/package/kernel/nat46/patches/117-fix-icmp-no-payload-bug.patch b/package/kernel/nat46/patches/117-fix-icmp-no-payload-bug.patch
new file mode 100644
index 00000000000000..a8bff4a945457c
--- /dev/null
+++ b/package/kernel/nat46/patches/117-fix-icmp-no-payload-bug.patch
@@ -0,0 +1,34 @@
+Author:  Pavithra R <pavir@codeaurora.org>
+Date:    Wed Sep 30 14:27:37 2020 +0530
+
+nat46: Fix for ICMP error packets with no payload.
+
+This patch is propagated from the kernel 4.4 commit
+d8b29a8e31f948a5d7338aa69c36e0f654fcb9e4
+
+When no payload is attached to the original packet, any
+ICMP error message generated in response to such packets
+gets dropped due to malformed packet at CE.
+
+During the translation of packet-in-error in ICMP,
+the IPv6 header in ICMPv6 payload gets corrupted.
+Hence, the translated packet gets dropped at CE.
+
+This fix updates the outer IPv4 header's total length
+before translating to IPv6 header.
+
+Change-Id: Ifd9802afb50771de39b4c6fb734d36b0801613ec
+Signed-off-by: Pavithra R <pavir@codeaurora.org>
+--- a/nat46/modules/nat46-core.c
++++ b/nat46/modules/nat46-core.c
+@@ -2266,9 +2266,8 @@ static uint16_t xlate_pkt_in_err_v4_to_v
+ 		memmove(((char *)iiph + IPV6HDRSIZE), (iiph + 1),
+ 		ntohs(iph->tot_len) - 2 * IPV4HDRSIZE - sizeof(struct icmphdr));
+ 		memcpy(iiph, &ip6h, IPV6HDRSIZE);
+-		nat46 = get_nat46_instance(old_skb);
+-		iph = ip_hdr(old_skb);
+ 	}
++	iph->tot_len = htons(ntohs(iph->tot_len) + IPV6V4HDRDELTA);
+ 
+ 	/* Swapping Ports for outer header */
+ 	/* Another work-around till LPM is not present. */
diff --git a/package/kernel/nat46/patches/118-performance_fix.patch b/package/kernel/nat46/patches/118-performance_fix.patch
new file mode 100644
index 00000000000000..5de4906ef99f7f
--- /dev/null
+++ b/package/kernel/nat46/patches/118-performance_fix.patch
@@ -0,0 +1,415 @@
+Author: Suruchi Agarwal <quic_suruchia@quicinc.com>
+Date: Fri Dec 17 13:37:15 2021 -0800
+
+    nat46: Performance fix
+
+    Avoid allocating new skb and copy for map-t translation
+
+    Change-Id: I621b90609b4642d64b6e4cfb98b105b3fcbb0365
+    Signed-off-by: Suruchi Agarwal <quic_suruchia@quicinc.com>
+
+--- a/nat46/modules/nat46-core.c
++++ b/nat46/modules/nat46-core.c
+@@ -118,7 +118,7 @@ char *get_next_arg(char **ptail) {
+   return pc;
+ }
+ 
+-/* 
++/*
+  * Parse an IPv6 address (if pref_len is NULL), or prefix (if it isn't).
+  * parses destructively (places \0 between address and prefix len)
+  */
+@@ -163,7 +163,7 @@ int try_parse_ipv4_prefix(u32 *v4addr, i
+ }
+ 
+ 
+-/* 
++/*
+  * parse a rule argument and put config into a rule.
+  * advance the tail to prepare for the next arg parsing.
+  * destructive.
+@@ -384,7 +384,7 @@ char *xlate_style_to_string(nat46_xlate_
+   return "unknown";
+ }
+ 
+-/* 
++/*
+  * Get the nat46 configuration into a supplied buffer (if non-null).
+  */
+ int nat46_get_ipair_config(nat46_instance_t *nat46, int ipair, char *buf, int count) {
+@@ -985,6 +985,28 @@ __sum16 csum_ipv6_unmagic(nat46_instance
+   return csum;
+ }
+ 
++/* Update UDP with incremental checksum */
++__sum16 csum_ipv6_udp_remagic(struct ipv6hdr *ip6hdr, u32 csum) {
++    uint32_t sum;
++    sum = csum_partial(ip6hdr->saddr.s6_addr16, 2 * sizeof(ip6hdr->saddr), ~csum);
++    sum = ((sum >> 16) & 0xffff) + (sum & 0xffff);
++    sum += ((sum >> 16) & 0xffff);
++    return (u16)(~sum);
++}
++
++/* Undo the IPv4 pseudoheader inclusion into the checksum */
++__sum16 csum_ipv4_unmagic(__be32 saddr, __be32 daddr,
++                        u32 csum) {
++  u32 s;
++  uint32_t addr_csum;
++  csum = ntohs(~csum);
++  addr_csum =  (saddr & 0xffff)  + (saddr >> 16) + (daddr & 0xffff) + (daddr >> 16);
++  s= csum + ntohs(~addr_csum);
++  s = ((s >> 16) & 0xffff) + (s & 0xffff);
++  s += ((s >> 16) & 0xffff);
++  return htons((u16)(~s));
++}
++
+ /* Update ICMPv6 type/code with incremental checksum adjustment */
+ void update_icmp6_type_code(nat46_instance_t *nat46, struct icmp6hdr *icmp6h, u8 type, u8 code) {
+   u16 old_tc = *((u16 *)icmp6h);
+@@ -1038,9 +1060,8 @@ void fill_v6hdr_from_v4hdr(struct iphdr
+   ip6h->hop_limit = iph->ttl;
+ }
+ 
+-void fill_v4hdr_from_v6hdr(struct iphdr * iph, struct ipv6hdr *ip6h, __u32 v4saddr, __u32 v4daddr, __u16 id, __u16 frag_off, __u16 proto, int l3_payload_len) {
+-  uint32_t ver_class_flow = ntohl(*(__be32 *)ip6h);
+-  iph->ttl = ip6h->hop_limit;
++void fill_v4hdr_from_v6hdr(struct iphdr * iph, uint32_t ver_class_flow, uint8_t hop_limit, __u32 v4saddr, __u32 v4daddr, __u16 id, __u16 frag_off, __u16 proto, int l3_payload_len) {
++  iph->ttl = hop_limit;
+   iph->saddr = v4saddr;
+   iph->daddr = v4daddr;
+   iph->protocol = proto;
+@@ -1198,6 +1219,8 @@ void pairs_xlate_v6_to_v4_inner(nat46_in
+  */
+ int xlate_payload6_to4(nat46_instance_t *nat46, void *pv6, void *ptrans_hdr, int v6_len, u16 *ul_sum, int *ptailTruncSize) {
+   struct ipv6hdr *ip6h = pv6;
++  uint32_t ver_class_flow;
++  uint8_t hop_limit;
+   __u32 v4saddr, v4daddr;
+   struct iphdr new_ipv4;
+   struct iphdr *iph = &new_ipv4;
+@@ -1274,7 +1297,10 @@ int xlate_payload6_to4(nat46_instance_t
+     }
+   }
+ 
+-  fill_v4hdr_from_v6hdr(iph, ip6h, v4saddr, v4daddr, ipid, ipflags, proto, infrag_payload_len);
++  ver_class_flow = ntohl(*(__be32 *)ip6h);
++  hop_limit = ip6h->hop_limit;
++
++  fill_v4hdr_from_v6hdr(iph, ver_class_flow, hop_limit, v4saddr, v4daddr, ipid, ipflags, proto, infrag_payload_len);
+   if(ul_sum) {
+     *ul_sum = unchecksum16(pv6, (((u8 *)ptrans_hdr)-((u8 *)pv6))/2, *ul_sum);
+     *ul_sum = rechecksum16(iph, 10, *ul_sum);
+@@ -1831,6 +1857,8 @@ EXPORT_SYMBOL(xlate_6_to_4);
+ 
+ int nat46_ipv6_input(struct sk_buff *old_skb) {
+   struct ipv6hdr *ip6h = ipv6_hdr(old_skb);
++  uint32_t ver_class_flow;
++  uint8_t hop_limit;
+   nat46_xlate_rulepair_t *apair;
+   nat46_instance_t *nat46 = get_nat46_instance(old_skb);
+   uint16_t proto;
+@@ -1839,22 +1867,20 @@ int nat46_ipv6_input(struct sk_buff *old
+ 
+   struct iphdr * iph;
+   __u32 v4saddr, v4daddr;
+-  struct sk_buff * new_skb = 0;
+   int err = 0;
+-  int truncSize = 0;
+   int tailTruncSize = 0;
+   int v6packet_l3size = sizeof(*ip6h);
+   int l3_infrag_payload_len = ntohs(ip6h->payload_len);
+   int check_for_l4 = 0;
+ 
+-  if (nat46 == NULL) {
++  if (unlikely(nat46 == NULL)) {
+     printk("nat46:%p skb is dropped for no valid instance found\n", old_skb);
+     return err;
+   }
+ 
+   nat46debug(4, "nat46_ipv6_input packet");
+ 
+-  if(ip6_input_not_interested(nat46, ip6h, old_skb)) {
++  if(unlikely(ip6_input_not_interested(nat46, ip6h, old_skb))) {
+     nat46debug(1, "nat46_ipv6_input not interested");
+     goto done;
+   }
+@@ -1985,47 +2011,45 @@ int nat46_ipv6_input(struct sk_buff *old
+     }
+   }
+ 
+-  new_skb = skb_copy(old_skb, GFP_ATOMIC); // other possible option: GFP_ATOMIC
+-  if (!new_skb) {
+-    nat46debug(0, "[nat46] Could not copy v6 skb");
+-    goto done;
+-  }
++  ver_class_flow = ntohl(*(__be32 *)ip6h);
++  hop_limit = ip6h->hop_limit;
+ 
+   /* Remove any debris in the socket control block */
+-  memset(IPCB(new_skb), 0, sizeof(struct inet_skb_parm));
++  memset(IPCB(old_skb), 0, sizeof(struct inet_skb_parm));
++
+   /* Remove netfilter references to IPv6 packet, new netfilter references will be created based on IPv4 packet */
+ #if LINUX_VERSION_CODE < KERNEL_VERSION(5,4,0)
+-  nf_reset(new_skb);
++  nf_reset(old_skb);
+ #else
+-  skb_ext_reset(new_skb);
+-  nf_reset_ct(new_skb);
++  skb_ext_reset(old_skb);
++  nf_reset_ct(old_skb);
+ #endif
+ 
+   /* modify packet: actual IPv6->IPv4 transformation */
+-  truncSize = v6packet_l3size - sizeof(struct iphdr); /* chop first 20 bytes */
+-  skb_pull(new_skb, truncSize);
+-  skb_put(new_skb, -tailTruncSize);
++  skb_pull(old_skb, sizeof(struct iphdr));
+   l3_infrag_payload_len -= tailTruncSize;
+-  skb_reset_network_header(new_skb);
+-  skb_set_transport_header(new_skb,IPV4HDRSIZE); /* transport (TCP/UDP/ICMP/...) header starts after 20 bytes */
++  skb_reset_mac_header(old_skb);
++  skb_reset_network_header(old_skb);
++  skb_set_transport_header(old_skb,IPV4HDRSIZE); /* transport (TCP/UDP/ICMP/...) header starts after 20 bytes */
+ 
+   /* build IPv4 header */
+-  iph = ip_hdr(new_skb);
+-  fill_v4hdr_from_v6hdr(iph, ip6h, v4saddr, v4daddr, frag_id, frag_off, proto, l3_infrag_payload_len);
+-  new_skb->protocol = htons(ETH_P_IP);
++  iph = ip_hdr(old_skb);
++  fill_v4hdr_from_v6hdr(iph, ver_class_flow, hop_limit, v4saddr, v4daddr, frag_id, frag_off, proto, l3_infrag_payload_len);
++  old_skb->protocol = htons(ETH_P_IP);
+ 
+   if (ntohs(iph->tot_len) >= 2000) {
+     nat46debug(0, "Too big IP len: %d", ntohs(iph->tot_len));
+   }
+ 
+-  nat46debug(5, "about to send v4 packet, flags: %02x",  IPCB(new_skb)->flags);
+-  nat46_netdev_count_xmit(new_skb, old_skb->dev);
++  nat46debug(5, "about to send v4 packet, flags: %02x",  IPCB(old_skb)->flags);
++  nat46_netdev_count_xmit(old_skb, old_skb->dev);
+ 
+-  /* set skb->iif */
+-  new_skb->skb_iif = old_skb->skb_iif;
+-
+-  netif_rx(new_skb);
++  netif_rx(old_skb);
+ 
++  /*
++   * skb was consumed in the ipv4 format, don't release later.
++   */
++  err = 1;
+   /* TBD: should copy be released here? */
+ 
+ done:
+@@ -2056,7 +2080,7 @@ bool nat46_get_info(struct net_device *d
+ }
+ EXPORT_SYMBOL(nat46_get_info);
+ 
+-void ip6_update_csum(struct sk_buff * skb, struct ipv6hdr * ip6hdr, int do_atomic_frag)
++void ip6_update_csum(struct sk_buff * skb, struct ipv6hdr * ip6hdr, uint32_t v4saddr, uint32_t v4daddr, int do_atomic_frag)
+ {
+   u32 sum1=0;
+   u16 sum2=0;
+@@ -2079,12 +2103,13 @@ void ip6_update_csum(struct sk_buff * sk
+       struct udphdr *udp = udp_hdr(skb);
+       unsigned udplen = ntohs(ip6hdr->payload_len) - (do_atomic_frag?8:0); /* UDP hdr + payload */
+ 
+-      oldsum = udp->check;
+-      udp->check = 0;
+-
+-      sum1 = csum_partial((char*)udp, udplen, 0); /* calculate checksum for UDP hdr+payload */
+-      sum2 = csum_ipv6_magic(&ip6hdr->saddr, &ip6hdr->daddr, udplen, ip6hdr->nexthdr, sum1); /* add pseudoheader */
+-
++      if (!udp->check) {
++          sum1 = csum_partial((char*)udp, udplen, 0); /* calculate checksum for UDP hdr+payload */
++          sum2 = csum_ipv6_magic(&ip6hdr->saddr, &ip6hdr->daddr, udplen, ip6hdr->nexthdr, sum1); /* add pseudoheader */
++      } else {
++          sum1 = csum_ipv4_unmagic(v4saddr, v4daddr, udp->check);
++          sum2 = csum_ipv6_udp_remagic(ip6hdr, sum1);
++      }
+       udp->check = sum2;
+ 
+       break;
+@@ -2348,7 +2373,6 @@ static uint16_t nat46_get_ce_port(nat46_
+ int nat46_ipv4_input(struct sk_buff *old_skb) {
+   nat46_instance_t *nat46 = get_nat46_instance(old_skb);
+   nat46_xlate_rulepair_t apair;
+-  struct sk_buff *new_skb;
+   uint16_t sport = 0, dport = 0, ret = 0;
+ 
+   int err = 0;
+@@ -2360,10 +2384,15 @@ int nat46_ipv4_input(struct sk_buff *old
+ 
+   struct ipv6hdr * hdr6;
+   struct iphdr * hdr4 = ip_hdr(old_skb);
++  uint32_t v4saddr, v4daddr;
++  uint8_t ttl;
++  uint16_t tot_len;
++  uint8_t protocol;
++  uint16_t frag_off, id;
+ 
+   char v6saddr[16], v6daddr[16];
+ 
+-  if (nat46 == NULL) {
++  if (unlikely(nat46 == NULL)) {
+     printk("nat46:%p skb is dropped for no valid instance found\n", old_skb);
+     return err;
+   }
+@@ -2443,31 +2472,39 @@ int nat46_ipv4_input(struct sk_buff *old
+     goto done;
+   }
+ 
+-  new_skb = skb_copy(old_skb, GFP_ATOMIC);
+-  if (!new_skb) {
+-    nat46debug(0, "[nat46] Could not copy v4 skb");
+-    goto done;
+-  }
++  v4saddr = hdr4->saddr;
++  v4daddr = hdr4->daddr;
++  protocol = hdr4->protocol;
++  tot_len = hdr4->tot_len;
++  ttl = hdr4->ttl;
++  frag_off = hdr4->frag_off;
++  id = hdr4->id;
+ 
+   /* Remove any debris in the socket control block */
+-  memset(IP6CB(new_skb), 0, sizeof(struct inet6_skb_parm));
++  memset(IP6CB(old_skb), 0, sizeof(struct inet6_skb_parm));
+   /* Remove netfilter references to IPv4 packet, new netfilter references will be created based on IPv6 packet */
+ #if LINUX_VERSION_CODE < KERNEL_VERSION(5,4,0)
+-  nf_reset(new_skb);
++  nf_reset(old_skb);
+ #else
+-  skb_ext_reset(new_skb);
+-  nf_reset_ct(new_skb);
++  skb_ext_reset(old_skb);
++  nf_reset_ct(old_skb);
+ #endif
+ 
+   /* expand header (add 20 extra bytes at the beginning of sk_buff) */
+-  pskb_expand_head(new_skb, IPV6HDRSIZE - (hdr4->ihl << 2) + (add_frag_header?8:0), 0, GFP_ATOMIC);
++  if (skb_headroom(old_skb) < IPV6V4HDRDELTA) {
++    ret = pskb_expand_head(old_skb, IPV6V4HDRDELTA + (add_frag_header?8:0), 0, GFP_ATOMIC);
++    if (unlikely(ret)) {
++      nat46debug(0, "[nat46] Could not expand skb header");
++      goto done;
++    }
++  }
+ 
+-  skb_push(new_skb, IPV6HDRSIZE - (hdr4->ihl << 2) + (add_frag_header?8:0)); /* push boundary by extra 20 bytes */
++  skb_push(old_skb, IPV6HDRSIZE - (hdr4->ihl << 2) + (add_frag_header?8:0)); /* push boundary by extra 20 bytes */
+ 
+-  skb_reset_network_header(new_skb);
+-  skb_set_transport_header(new_skb, IPV6HDRSIZE + (add_frag_header?8:0) ); /* transport (TCP/UDP/ICMP/...) header starts after 40 bytes */
++  skb_reset_network_header(old_skb);
++  skb_set_transport_header(old_skb, IPV6HDRSIZE + (add_frag_header?8:0) ); /* transport (TCP/UDP/ICMP/...) header starts after 40 bytes */
+ 
+-  hdr6 = ipv6_hdr(new_skb);
++  hdr6 = ipv6_hdr(old_skb);
+   memset(hdr6, 0, sizeof(*hdr6) + (add_frag_header?8:0));
+ 
+   /* build IPv6 header */
+@@ -2475,13 +2512,14 @@ int nat46_ipv4_input(struct sk_buff *old
+   *(__be32 *)hdr6 = htonl(0x60000000 | (tclass << 20)) | flowlabel; /* version, priority, flowlabel */
+ 
+   /* IPv6 length is a payload length, IPv4 is hdr+payload */
+-  hdr6->payload_len = htons(ntohs(hdr4->tot_len) - (hdr4->ihl << 2) + (add_frag_header?8:0));
+-  hdr6->nexthdr = hdr4->protocol;
+-  hdr6->hop_limit = hdr4->ttl;
++  hdr6->payload_len = htons(ntohs(tot_len) - sizeof(struct iphdr) + (add_frag_header?8:0));
++  hdr6->nexthdr = protocol;
++  hdr6->hop_limit = ttl;
++
+   memcpy(&hdr6->saddr, v6saddr, 16);
+   memcpy(&hdr6->daddr, v6daddr, 16);
+ 
+-  new_skb->protocol = htons(ETH_P_IPV6);
++  old_skb->protocol = htons(ETH_P_IPV6);
+ 
+   if (add_frag_header) {
+     struct frag_hdr *fh = (struct frag_hdr*)(hdr6 + 1);
+@@ -2490,8 +2528,8 @@ int nat46_ipv4_input(struct sk_buff *old
+     /* Flag to represent whether PSID is assigned to MAP-T node or not */
+     bool is_psid = false;
+ 
+-    fh->frag_off = htons(((ntohs(hdr4->frag_off) >> 13) & 7) + ((ntohs(hdr4->frag_off) & 0x1FFF) << 3));
+-    fh->nexthdr = hdr4->protocol;
++    fh->frag_off = htons(((ntohs(frag_off) >> 13) & 7) + ((ntohs(frag_off) & 0x1FFF) << 3));
++    fh->nexthdr = protocol;
+ 
+     /*
+      * PSID assigned MAP-T node will have non-zero ea_len and we are currently
+@@ -2506,29 +2544,30 @@ int nat46_ipv4_input(struct sk_buff *old
+       if (ce_port_num) {
+         fh->identification = htonl(ce_port_num);
+       } else {
+-        fh->identification = htonl(ntohs(hdr4->id));
++        fh->identification = htonl(ntohs(id));
+       }
+     } else {
+-      fh->identification = htonl(ntohs(hdr4->id));
++      fh->identification = htonl(ntohs(id));
+     }
+ 
+ 
+   }
+-  ip6_update_csum(new_skb, hdr6, add_frag_header);
++  ip6_update_csum(old_skb, hdr6, v4saddr, v4daddr, add_frag_header);
+ 
+-  hdr6->nexthdr = add_frag_header ? NEXTHDR_FRAGMENT : hdr4->protocol;
++  hdr6->nexthdr = add_frag_header ? NEXTHDR_FRAGMENT : protocol;
+ 
+ 
+   // FIXME: check if you can not fit the packet into the cached MTU
+-  // if (dst_mtu(skb_dst(new_skb))==0) { }
+-
+-  nat46debug(5, "about to send v6 packet, flags: %02x",  IP6CB(new_skb)->flags);
+-  nat46_netdev_count_xmit(new_skb, old_skb->dev);
++  // if (dst_mtu(skb_dst(old_skb))==0) { }
+ 
+-  /* set skb->iif */
+-  new_skb->skb_iif = old_skb->skb_iif;
++  nat46debug(5, "about to send v6 packet, flags: %02x",  IPCB(old_skb)->flags);
++  nat46_netdev_count_xmit(old_skb, old_skb->dev);
++  netif_rx(old_skb);
+ 
+-  netif_rx(new_skb);
++  /*
++   * skb was reused, needn't free it later.
++   */
++  err = 1;
+ 
+ done:
+   release_nat46_instance(nat46);
+--- a/nat46/modules/nat46-core.h
++++ b/nat46/modules/nat46-core.h
+@@ -39,7 +39,7 @@
+ #define IPV4HDRSIZE 20
+ #define IPV6V4HDRDELTA (IPV6HDRSIZE - IPV4HDRSIZE)
+ 
+-/* 
++/*
+  * A generic v4<->v6 translation structure.
+  * The currently supported translation styles:
+  */
+--- a/nat46/modules/nat46-netdev.c
++++ b/nat46/modules/nat46-netdev.c
+@@ -100,8 +100,7 @@ static netdev_tx_t nat46_netdev_xmit(str
+ 
+ 	if(ETH_P_IP == ntohs(skb->protocol)) {
+ 		ret = nat46_ipv4_input(skb);
+-	}
+-	if(ETH_P_IPV6 == ntohs(skb->protocol)) {
++	}else if(ETH_P_IPV6 == ntohs(skb->protocol)) {
+ 		ret = nat46_ipv6_input(skb);
+ 	}
+ 	if(0 == ret) {
+@@ -174,6 +173,7 @@ static void nat46_netdev_setup(struct ne
+ 	dev->mtu = 16384; /* iptables does reassembly. Rather than using ETH_DATA_LEN, let's try to get as much mileage as we can with the Linux stack */
+ 	dev->features = NETIF_F_NETNS_LOCAL;
+ 	dev->flags = IFF_NOARP | IFF_POINTOPOINT;
++	dev->priv_flags_ext = IFF_EXT_MAPT;
+ }
+ 
+ int nat46_netdev_create(char *basename, struct net_device **dev)
diff --git a/package/kernel/nat46/patches/120-sleeping_backtrace.patch b/package/kernel/nat46/patches/120-sleeping_backtrace.patch
new file mode 100644
index 00000000000000..5963af2b0365d7
--- /dev/null
+++ b/package/kernel/nat46/patches/120-sleeping_backtrace.patch
@@ -0,0 +1,57 @@
+commit 9457a8be6e700f39e6b545f8db0edd30c0693700
+Author: Ken Zhu <quic_guigenz@quicinc.com>
+Date:   Tue Sep 6 11:11:20 2022 -0700
+
+    nat46: fix sleeping warning back trace
+
+    use spin_lock instead of mutex_lock since
+    mutex_lock could sleep in the kernel packet process.
+
+    Change-Id: I65c15a9f618ef296159884a0d6d742e66aaf6623
+    Signed-off-by: Ken Zhu <quic_guigenz@quicinc.com>
+
+--- a/nat46/modules/nat46-glue.c
++++ b/nat46/modules/nat46-glue.c
+@@ -18,7 +18,7 @@
+ #include "nat46-glue.h"
+ #include "nat46-core.h"
+ 
+-static DEFINE_MUTEX(ref_lock);
++static DEFINE_SPINLOCK(ref_lock);
+ int is_valid_nat46(nat46_instance_t *nat46) {
+   return (nat46 && (nat46->sig == NAT46_SIGNATURE));
+ }
+@@ -47,28 +47,27 @@ nat46_instance_t *alloc_nat46_instance(i
+   return nat46;
+ }
+ 
+-
+ nat46_instance_t *get_nat46_instance(struct sk_buff *sk) {
+   nat46_instance_t *nat46 = netdev_nat46_instance(sk->dev);
+-  mutex_lock(&ref_lock);
++  spin_lock_bh(&ref_lock);
+   if (is_valid_nat46(nat46)) {
+     nat46->refcount++;
+-    mutex_unlock(&ref_lock);
++    spin_unlock_bh(&ref_lock);
+     return nat46;
+   } else {
+     printk("[nat46] get_nat46_instance: Could not find a valid NAT46 instance!");
+-    mutex_unlock(&ref_lock);
++    spin_unlock_bh(&ref_lock);
+     return NULL;
+   }
+ }
+ 
+ void release_nat46_instance(nat46_instance_t *nat46) {
+-  mutex_lock(&ref_lock);
++  spin_lock_bh(&ref_lock);
+   nat46->refcount--;
+   if(0 == nat46->refcount) {
+     printk("[nat46] release_nat46_instance: freeing nat46 instance with %d pairs\n", nat46->npairs);
+     nat46->sig = FREED_NAT46_SIGNATURE;
+     kfree(nat46);
+   }
+-  mutex_unlock(&ref_lock);
++  spin_unlock_bh(&ref_lock);
+ }
diff --git a/package/kernel/nat46/patches/121-tos-fix.patch b/package/kernel/nat46/patches/121-tos-fix.patch
new file mode 100644
index 00000000000000..6b265886f5b70b
--- /dev/null
+++ b/package/kernel/nat46/patches/121-tos-fix.patch
@@ -0,0 +1,27 @@
+Author: Ramkishan Gurjar <quic_rgurjar@quicinc.com>
+Date:   Thu Nov 16 15:30:04 2023 +0530
+
+    nat46: Fix traffic class is not set in ipv6 Header from ipv4 tos value.
+
+    Change-Id: I781d7af8bc9751dd23f6c3f4195644b3f9025fcb
+    Signed-off-by: Ramkishan Gurjar <quic_rgurjar@quicinc.com>
+
+--- a/nat46/modules/nat46-core.c
++++ b/nat46/modules/nat46-core.c
+@@ -2397,6 +2397,8 @@ int nat46_ipv4_input(struct sk_buff *old
+     return err;
+   }
+ 
++  tclass = ip_tos_ignore ? 0 : hdr4->tos; /* traffic class */
++
+   memset(v6saddr, 1, 16);
+   memset(v6daddr, 2, 16);
+ 
+@@ -2508,7 +2510,6 @@ int nat46_ipv4_input(struct sk_buff *old
+   memset(hdr6, 0, sizeof(*hdr6) + (add_frag_header?8:0));
+ 
+   /* build IPv6 header */
+-  tclass = ip_tos_ignore ? 0 : hdr4->tos; /* traffic class */
+   *(__be32 *)hdr6 = htonl(0x60000000 | (tclass << 20)) | flowlabel; /* version, priority, flowlabel */
+ 
+   /* IPv6 length is a payload length, IPv4 is hdr+payload */

From cbf38c6e568ff81728892803d009cd803c8d5437 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Mon, 6 May 2024 00:33:46 -0400
Subject: [PATCH 076/225] package: kernel: nat46: use standard build functions

Instead of 'install', 'cp', use standard build functions

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 package/kernel/nat46/Makefile | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package/kernel/nat46/Makefile b/package/kernel/nat46/Makefile
index 32ea3a4516d4e0..dd1d55b84eef02 100644
--- a/package/kernel/nat46/Makefile
+++ b/package/kernel/nat46/Makefile
@@ -28,8 +28,8 @@ endef
 include $(INCLUDE_DIR)/kernel-defaults.mk
 
 define Build/InstallDev
-	mkdir -p -m 0777 $(STAGING_DIR)/usr/include/nat46
-	$(CP) $(PKG_BUILD_DIR)/nat46/modules/*.h  $(STAGING_DIR)/usr/include/nat46/
+	$(INSTALL_DIR) $(STAGING_DIR)/usr/include/nat46
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/nat46/modules/*.h  $(STAGING_DIR)/usr/include/nat46/
 endef
 
 define Build/Compile
@@ -37,7 +37,7 @@ define Build/Compile
 		MODFLAGS="-DMODULE -mlong-calls" \
 		EXTRA_CFLAGS="-DNAT46_VERSION=\\\"$(PKG_SOURCE_VERSION)\\\"" \
 		modules
-	cp $(PKG_BUILD_DIR)/nat46/modules/Module.symvers $(PKG_BUILD_DIR)/Module.symvers
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/nat46/modules/Module.symvers $(PKG_BUILD_DIR)/Module.symvers
 endef
 
 $(eval $(call KernelPackage,nat46))

From a1e52ba89e688a8f4075e35a7eaaee0e2f0321be Mon Sep 17 00:00:00 2001
From: bitthief <bitthief@protonmail.ch>
Date: Sat, 4 Feb 2023 01:28:51 +0200
Subject: [PATCH 077/225] iproute2: add NSS QDISC support

Signed-off-by: bitthief <bitthief@protonmail.ch>
Co-Developed-by: Sean Khan <datapronix@protonmail.com>
---
 .../iproute2/patches/400-add-nss-qdisc.patch  | 2093 +++++++++++++++++
 .../iproute2/patches/500-add-nssmirred.patch  |  243 ++
 2 files changed, 2336 insertions(+)
 create mode 100644 package/network/utils/iproute2/patches/400-add-nss-qdisc.patch
 create mode 100644 package/network/utils/iproute2/patches/500-add-nssmirred.patch

diff --git a/package/network/utils/iproute2/patches/400-add-nss-qdisc.patch b/package/network/utils/iproute2/patches/400-add-nss-qdisc.patch
new file mode 100644
index 00000000000000..299710f79169d0
--- /dev/null
+++ b/package/network/utils/iproute2/patches/400-add-nss-qdisc.patch
@@ -0,0 +1,2093 @@
+--- a/include/uapi/linux/pkt_sched.h
++++ b/include/uapi/linux/pkt_sched.h
+@@ -119,6 +119,251 @@ enum {
+ 
+ #define TCA_STAB_MAX (__TCA_STAB_MAX - 1)
+ 
++enum {
++	TCA_NSS_ACCEL_MODE_NSS_FW,
++	TCA_NSS_ACCEL_MODE_PPE,
++	TCA_NSS_ACCEL_MODE_MAX
++};
++
++/* NSSFIFO section */
++
++enum {
++	TCA_NSSFIFO_UNSPEC,
++	TCA_NSSFIFO_PARMS,
++	__TCA_NSSFIFO_MAX
++};
++
++#define TCA_NSSFIFO_MAX	(__TCA_NSSFIFO_MAX - 1)
++
++struct tc_nssfifo_qopt {
++	__u32	limit;		/* Queue length: bytes for bfifo, packets for pfifo */
++	__u8	set_default;	/* Sets qdisc to be the default qdisc for enqueue */
++	__u8	accel_mode;	/* Dictates which data plane offloads the qdisc */
++};
++
++/* NSSWRED section */
++
++enum {
++	TCA_NSSWRED_UNSPEC,
++	TCA_NSSWRED_PARMS,
++	__TCA_NSSWRED_MAX
++};
++
++#define TCA_NSSWRED_MAX (__TCA_NSSWRED_MAX - 1)
++#define NSSWRED_CLASS_MAX 6
++struct tc_red_alg_parameter {
++	__u32	min;	/* qlen_avg < min: pkts are all enqueued */
++	__u32	max;	/* qlen_avg > max: pkts are all dropped */
++	__u32	probability;/* Drop probability at qlen_avg = max */
++	__u32	exp_weight_factor;/* exp_weight_factor for calculate qlen_avg */
++};
++
++struct tc_nsswred_traffic_class {
++	__u32 limit;			/* Queue length */
++	__u32 weight_mode_value;	/* Weight mode value */
++	struct tc_red_alg_parameter rap;/* Parameters for RED alg */
++};
++
++/*
++ * Weight modes for WRED
++ */
++enum tc_nsswred_weight_modes {
++	TC_NSSWRED_WEIGHT_MODE_DSCP = 0,/* Weight mode is DSCP */
++	TC_NSSWRED_WEIGHT_MODES,	/* Must be last */
++};
++typedef enum tc_nsswred_weight_modes tc_nsswred_weight_mode_t;
++
++struct tc_nsswred_qopt {
++	__u32	limit;			/* Queue length */
++	enum tc_nsswred_weight_modes weight_mode;
++					/* Weight mode */
++	__u32	traffic_classes;	/* How many traffic classes: DPs */
++	__u32	def_traffic_class;	/* Default traffic if no match: def_DP */
++	__u32	traffic_id;		/* The traffic id to be configured: DP */
++	__u32	weight_mode_value;	/* Weight mode value */
++	struct tc_red_alg_parameter rap;/* RED algorithm parameters */
++	struct tc_nsswred_traffic_class tntc[NSSWRED_CLASS_MAX];
++					/* Traffic settings for dumpping */
++	__u8	ecn;			/* Setting ECN bit or dropping */
++	__u8	set_default;		/* Sets qdisc to be the default for enqueue */
++	__u8	accel_mode;		/* Dictates which data plane offloads the qdisc */
++};
++
++/* NSSCODEL section */
++
++enum {
++	TCA_NSSCODEL_UNSPEC,
++	TCA_NSSCODEL_PARMS,
++	__TCA_NSSCODEL_MAX
++};
++
++#define TCA_NSSCODEL_MAX	(__TCA_NSSCODEL_MAX - 1)
++
++struct tc_nsscodel_qopt {
++	__u32	target;		/* Acceptable queueing delay */
++	__u32	limit;		/* Max number of packets that can be held in the queue */
++	__u32	interval;	/* Monitoring interval */
++	__u32	flows;		/* Number of flow buckets */
++	__u32	quantum;	/* Weight (in bytes) used for DRR of flow buckets */
++	__u8	ecn;		/* 0 - disable ECN, 1 - enable ECN */
++	__u8	set_default;	/* Sets qdisc to be the default qdisc for enqueue */
++	__u8	accel_mode;	/* Dictates which data plane offloads the qdisc */
++};
++
++struct tc_nsscodel_xstats {
++	__u32 peak_queue_delay;	/* Peak delay experienced by a dequeued packet */
++	__u32 peak_drop_delay;	/* Peak delay experienced by a dropped packet */
++};
++
++/* NSSFQ_CODEL section */
++
++struct tc_nssfq_codel_xstats {
++	__u32 new_flow_count;	/* Total number of new flows seen */
++	__u32 new_flows_len;	/* Current number of new flows */
++	__u32 old_flows_len;	/* Current number of old flows */
++	__u32 ecn_mark;		/* Number of packets marked with ECN */
++	__u32 drop_overlimit;	/* Number of packets dropped due to overlimit */
++	__u32 maxpacket;	/* The largest packet seen so far in the queue */
++};
++
++/* NSSTBL section */
++
++enum {
++	TCA_NSSTBL_UNSPEC,
++	TCA_NSSTBL_PARMS,
++	__TCA_NSSTBL_MAX
++};
++
++#define TCA_NSSTBL_MAX	(__TCA_NSSTBL_MAX - 1)
++
++struct tc_nsstbl_qopt {
++	__u32	burst;		/* Maximum burst size */
++	__u32	rate;		/* Limiting rate of TBF */
++	__u32	peakrate;	/* Maximum rate at which TBF is allowed to send */
++	__u32	mtu;		/* Max size of packet, or minumim burst size */
++	__u8	accel_mode;	/* Dictates which data plane offloads the qdisc */
++};
++
++/* NSSPRIO section */
++
++#define TCA_NSSPRIO_MAX_BANDS 256
++
++enum {
++	TCA_NSSPRIO_UNSPEC,
++	TCA_NSSPRIO_PARMS,
++	__TCA_NSSPRIO_MAX
++};
++
++#define TCA_NSSPRIO_MAX	(__TCA_NSSPRIO_MAX - 1)
++
++struct tc_nssprio_qopt {
++	__u32	bands;		/* Number of bands */
++	__u8	accel_mode;	/* Dictates which data plane offloads the qdisc */
++};
++
++/* NSSBF section */
++
++enum {
++	TCA_NSSBF_UNSPEC,
++	TCA_NSSBF_CLASS_PARMS,
++	TCA_NSSBF_QDISC_PARMS,
++	__TCA_NSSBF_MAX
++};
++
++#define TCA_NSSBF_MAX	(__TCA_NSSBF_MAX - 1)
++
++struct tc_nssbf_class_qopt {
++	__u32	burst;		/* Maximum burst size */
++	__u32	rate;		/* Allowed bandwidth for this class */
++	__u32	mtu;		/* MTU of the associated interface */
++	__u32	quantum;	/* Quantum allocation for DRR */
++};
++
++struct tc_nssbf_qopt {
++	__u16	defcls;		/* Default class value */
++	__u8	accel_mode;	/* Dictates which data plane offloads the qdisc */
++};
++
++/* NSSWRR section */
++
++enum {
++	TCA_NSSWRR_UNSPEC,
++	TCA_NSSWRR_CLASS_PARMS,
++	TCA_NSSWRR_QDISC_PARMS,
++	__TCA_NSSWRR_MAX
++};
++
++#define TCA_NSSWRR_MAX	(__TCA_NSSWRR_MAX - 1)
++
++struct tc_nsswrr_class_qopt {
++	__u32	quantum;	/* Weight associated to this class */
++};
++
++struct tc_nsswrr_qopt {
++	__u8	accel_mode;	/* Dictates which data plane offloads the qdisc */
++};
++
++/* NSSWFQ section */
++
++enum {
++	TCA_NSSWFQ_UNSPEC,
++	TCA_NSSWFQ_CLASS_PARMS,
++	TCA_NSSWFQ_QDISC_PARMS,
++	__TCA_NSSWFQ_MAX
++};
++
++#define TCA_NSSWFQ_MAX	(__TCA_NSSWFQ_MAX - 1)
++
++struct tc_nsswfq_class_qopt {
++	__u32	quantum;	/* Weight associated to this class */
++};
++
++struct tc_nsswfq_qopt {
++	__u8	accel_mode;	/* Dictates which data plane offloads the qdisc */
++};
++
++/* NSSHTB section */
++
++enum {
++	TCA_NSSHTB_UNSPEC,
++	TCA_NSSHTB_CLASS_PARMS,
++	TCA_NSSHTB_QDISC_PARMS,
++	__TCA_NSSHTB_MAX
++};
++
++#define TCA_NSSHTB_MAX	(__TCA_NSSHTB_MAX - 1)
++
++struct tc_nsshtb_class_qopt {
++	__u32	burst;		/* Allowed burst size */
++	__u32	rate;		/* Allowed bandwidth for this class */
++	__u32	cburst;		/* Maximum burst size */
++	__u32	crate;		/* Maximum bandwidth for this class */
++	__u32	quantum;	/* Quantum allocation for DRR */
++	__u32	priority;	/* Priority value associated with this class */
++	__u32	overhead;	/* Overhead in bytes per packet */
++};
++
++struct tc_nsshtb_qopt {
++	__u32	r2q;		/* Rate to quantum ratio */
++	__u8	accel_mode;	/* Dictates which data plane offloads the qdisc */
++};
++
++/* NSSBLACKHOLE section */
++
++enum {
++	TCA_NSSBLACKHOLE_UNSPEC,
++	TCA_NSSBLACKHOLE_PARMS,
++	__TCA_NSSBLACKHOLE_MAX
++};
++
++#define TCA_NSSBLACKHOLE_MAX	(__TCA_NSSBLACKHOLE_MAX - 1)
++
++struct tc_nssblackhole_qopt {
++	__u8	set_default;	/* Sets qdisc to be the default qdisc for enqueue */
++	__u8	accel_mode;	/* Dictates which data plane offloads the qdisc */
++};
++
++
+ /* FIFO section */
+ 
+ struct tc_fifo_qopt {
+--- a/tc/Makefile
++++ b/tc/Makefile
+@@ -77,6 +77,7 @@ TCMODULES += q_etf.o
+ TCMODULES += q_taprio.o
+ TCMODULES += q_plug.o
+ TCMODULES += q_ets.o
++TCMODULES += q_nss.o
+ 
+ TCSO :=
+ 
+--- /dev/null
++++ b/tc/q_nss.c
+@@ -0,0 +1,1826 @@
++/*
++ **************************************************************************
++ * Copyright (c) 2015, 2018 The Linux Foundation. All rights reserved.
++ * Permission to use, copy, modify, and/or distribute this software for
++ * any purpose with or without fee is hereby granted, provided that the
++ * above copyright notice and this permission notice appear in all copies.
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
++ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
++ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
++ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ **************************************************************************
++ */
++
++#include <stdio.h>
++#include <stdlib.h>
++#include <unistd.h>
++#include <syslog.h>
++#include <fcntl.h>
++#include <sys/socket.h>
++#include <netinet/in.h>
++#include <arpa/inet.h>
++#include <string.h>
++#include <math.h>
++
++#include "utils.h"
++#include "tc_util.h"
++#include "tc_red.h"
++
++/* ======================== NSSWRED =======================*/
++
++static void nssred_explain(void)
++{
++	fprintf(stderr, "Usage: ...  nssred limit BYTES avpkt BYTES [ min BYTES ] [ max BYTES ] [ probability VALUE ]\n");
++	fprintf(stderr, "                   [ burst PACKETS ] [ecn] [ set_default ] [ accel_mode ]\n");
++}
++
++static void nsswred_explain(void)
++{
++	fprintf(stderr, "Usage: ...  nsswred setup DPs NUMBER dp_default NUMBER [ weight_mode dscp ] [ecn] [ set_default ] [ accel_mode ]\n");
++	fprintf(stderr, "            nsswred limit BYTES DP NUMBER min BYTES max BYTES avpkt BYTES dscp NUMBER [ probability VALUE ] [ burst PACKETS ]\n");
++}
++
++static int nsswred_setup(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++{
++	struct rtattr *tail;
++	struct tc_nsswred_qopt opt;
++
++	memset(&opt, 0, sizeof(opt));
++	unsigned int dps = 0;
++	unsigned int def_dp = 0;
++	bool accel_mode = false;
++
++	while (argc > 0) {
++		if (strcmp(*argv, "DPs") == 0) {
++			NEXT_ARG();
++			if (get_unsigned(&dps, *argv, 0) || dps > NSSWRED_CLASS_MAX) {
++
++				fprintf(stderr, "DPs should be between 1 - %d\n", NSSWRED_CLASS_MAX);
++				return -1;
++			}
++		} else if (strcmp(*argv, "weight_mode") == 0) {
++			NEXT_ARG();
++			if (strcmp(*argv, "dscp") == 0) {
++				opt.weight_mode = TC_NSSWRED_WEIGHT_MODE_DSCP;
++			} else {
++				fprintf(stderr, "Illegal \"weight_mode\", we only support dscp at this moment\n");
++			}
++		} else if (strcmp(*argv, "ecn") == 0) {
++			opt.ecn = 1;
++		} else if (strcmp(*argv, "dp_default") == 0) {
++			NEXT_ARG();
++			if (get_unsigned(&def_dp, *argv, 0) || def_dp > dps) {
++				fprintf(stderr, "Illegal dp_default value\n");
++				return -1;
++			}
++		} else if (strcmp(*argv, "help") == 0) {
++			nsswred_explain();
++			return -1;
++		} else if (strcmp(*argv, "set_default") == 0) {
++			opt.set_default = 1;
++		} else if (strcmp(*argv, "accel_mode") == 0) {
++			NEXT_ARG();
++			if (get_u8(&opt.accel_mode, *argv, 0)) {
++				fprintf(stderr, "Illegal accel_mode value\n");
++				return -1;
++			}
++			accel_mode = true;
++		} else {
++			fprintf(stderr, "What is \"%s\"?\n", *argv);
++			nsswred_explain();
++			return -1;
++		}
++		argc--; argv++;
++	}
++
++	if (!accel_mode) {
++		opt.accel_mode = TCA_NSS_ACCEL_MODE_NSS_FW;
++	} else if (opt.accel_mode != TCA_NSS_ACCEL_MODE_NSS_FW) {
++		fprintf(stderr, "accel_mode should be %d\n", TCA_NSS_ACCEL_MODE_NSS_FW);
++		return -1;
++	}
++
++	if (!dps || !def_dp) {
++		fprintf(stderr, "Illegal nsswred setup parameters\n");
++		return -1;
++	}
++	opt.traffic_classes = dps;
++	opt.def_traffic_class = def_dp;
++
++	tail = NLMSG_TAIL(n);
++	addattr_l(n, 1024, TCA_OPTIONS, NULL, 0);
++	addattr_l(n, 1024, TCA_NSSWRED_PARMS, &opt, sizeof(opt));
++	tail->rta_len = (void *) NLMSG_TAIL(n) - (void *) tail;
++
++	return 0;
++}
++
++static int nsswred_parse_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++{
++	struct rtattr *tail;
++	struct tc_nsswred_qopt opt;
++
++	int total_args = argc;
++	unsigned burst = 0;
++	unsigned avpkt = 0;
++	double probability = 0.0;
++	unsigned char weighted = (strcmp(qu->id, "nsswred") == 0);
++	bool accel_mode = false;
++
++	memset(&opt, 0, sizeof(opt));
++
++	while (argc > 0) {
++		if (strcmp(*argv, "limit") == 0) {
++			NEXT_ARG();
++			if (get_size(&opt.limit, *argv)) {
++				fprintf(stderr, "Illegal \"limit\"\n");
++				return -1;
++			}
++		} else if (strcmp(*argv, "set_default") == 0) {
++			opt.set_default = 1;
++		} else if (strcmp(*argv, "min") == 0) {
++			NEXT_ARG();
++			if (get_size(&opt.rap.min, *argv)) {
++				fprintf(stderr, "Illegal \"min\"\n");
++				return -1;
++			}
++		} else if (strcmp(*argv, "max") == 0) {
++			NEXT_ARG();
++			if (get_size(&opt.rap.max, *argv)) {
++				fprintf(stderr, "Illegal \"max\"\n");
++				return -1;
++			}
++		} else if (strcmp(*argv, "burst") == 0) {
++			NEXT_ARG();
++			if (get_unsigned(&burst, *argv, 0)) {
++				fprintf(stderr, "Illegal \"burst\"\n");
++				return -1;
++			}
++		} else if (strcmp(*argv, "avpkt") == 0) {
++			NEXT_ARG();
++			if (get_size(&avpkt, *argv)) {
++				fprintf(stderr, "Illegal \"avpkt\"\n");
++				return -1;
++			}
++		} else if (strcmp(*argv, "probability") == 0) {
++			NEXT_ARG();
++			if (sscanf(*argv, "%lg", &probability) != 1) {
++				fprintf(stderr, "Illegal \"probability\"\n");
++				return -1;
++			}
++		} else if (strcmp(*argv, "ecn") == 0) {
++			opt.ecn = 1;
++		} else if (strcmp(*argv, "accel_mode") == 0) {
++			NEXT_ARG();
++			if (get_u8(&opt.accel_mode, *argv, 0)) {
++				fprintf(stderr, "Illegal accel_mode value\n");
++				return -1;
++			}
++			accel_mode = true;
++		} else if (strcmp(*argv, "help") == 0) {
++			if (weighted) {
++				nsswred_explain();
++			} else {
++				nssred_explain();
++			}
++			return -1;
++		} else if (weighted) {
++			if (strcmp(*argv, "setup") == 0) {
++				if (argc != total_args) {
++					fprintf(stderr, "Setup command must be the first parameter\n");
++					return -1;
++				}
++				return nsswred_setup(qu, argc-1, argv+1, n);
++			} else if (strcmp(*argv, "DP") == 0) {
++				NEXT_ARG();
++				if (get_unsigned(&opt.traffic_id, *argv, 0)) {
++					fprintf(stderr, "Illegal \"DP\"");
++					return -1;
++				}
++			} else if (strcmp(*argv, "dscp") == 0) {
++				NEXT_ARG();
++				if (get_unsigned(&opt.weight_mode_value, *argv, 0)) {
++					fprintf(stderr, "Illegal \"dscp\" value\n");
++					return -1;
++				}
++			}
++		} else {
++			fprintf(stderr, "What is \"%s\"?\n", *argv);
++			if (weighted) {
++				nsswred_explain();
++			} else {
++				nssred_explain();
++			}
++			return -1;
++		}
++		argc--; argv++;
++	}
++
++	if (!accel_mode) {
++		opt.accel_mode = TCA_NSS_ACCEL_MODE_PPE;
++	} else if (opt.accel_mode >= TCA_NSS_ACCEL_MODE_MAX) {
++		fprintf(stderr, "Accel_mode should be < %d\n", TCA_NSS_ACCEL_MODE_MAX);
++		return -1;
++	}
++
++	if (weighted) {
++		if (!opt.limit || !opt.rap.min || !opt.rap.max || !opt.traffic_id || !avpkt || !opt.weight_mode_value) {
++			fprintf(stderr, "Require limit, min, max, avpkt, DP, weight_mode_value\n");
++			return -1;
++		}
++	} else {
++		if (!opt.limit || !avpkt) {
++			fprintf(stderr, "Require limit, avpkt");
++			return -1;
++		}
++	}
++
++	/*
++	 * Compute default min/max thresholds based on
++	 * Sally Floyd's recommendations:
++	 * http://www.icir.org/floyd/REDparameters.txt
++	 */
++	if (!opt.rap.max)
++		opt.rap.max = opt.rap.min ? opt.rap.min * 3 : opt.limit / 4;
++	if (!opt.rap.min)
++		opt.rap.min = opt.rap.max / 3;
++	if (!burst)
++		burst = (2 * opt.rap.min + opt.rap.max) / (3 * avpkt);
++	if ((opt.rap.exp_weight_factor = tc_red_eval_ewma(opt.rap.min, burst, avpkt)) < 0) {
++		fprintf(stderr, "Failed to calculate EWMA constant.\n");
++		return -1;
++	}
++
++	/*
++	 * project [0.0-1.0] to [0-255] to avoid floating point calculation
++	 */
++	opt.rap.probability = probability * (pow(2, 8)-1);
++
++	tail = NLMSG_TAIL(n);
++	addattr_l(n, 1024, TCA_OPTIONS, NULL, 0);
++	addattr_l(n, 1024, TCA_NSSWRED_PARMS, &opt, sizeof(opt));
++	tail->rta_len = (void *) NLMSG_TAIL(n) - (void *) tail;
++
++	return 0;
++}
++
++static int nsswred_print_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++{
++	struct rtattr *tb[TCA_NSSWRED_MAX + 1];
++	struct tc_nsswred_qopt *qopt;
++	int i;
++
++	if (opt == NULL)
++		return 0;
++
++	parse_rtattr_nested(tb, TCA_NSSWRED_MAX, opt);
++
++	if (tb[TCA_NSSWRED_PARMS] == NULL)
++		return -1;
++
++	if (RTA_PAYLOAD(tb[TCA_NSSWRED_PARMS]) < sizeof(*qopt))
++		return -1;
++
++	qopt = RTA_DATA(tb[TCA_NSSWRED_PARMS]);
++
++	if (strcmp(qu->id, "nsswred") == 0) {
++		fprintf(f, "DPs %d def_DP %d weight mode: " , qopt->traffic_classes, qopt->def_traffic_class);
++		if (qopt->weight_mode == TC_NSSWRED_WEIGHT_MODE_DSCP)
++			fprintf(f, "DSCP\n");
++		else
++			fprintf(f, "Unknown\n");
++		for (i = 0;i < qopt->traffic_classes; i ++) {
++			if (qopt->tntc[i].rap.exp_weight_factor) {
++				double prob = (double)qopt->tntc[i].rap.probability;
++				fprintf(f, "DP %d: limit %d, weight mode value: %d min: %d max: %d exp_weight_factor: %d probability %.2f\n",
++						i + 1, qopt->tntc[i].limit, qopt->tntc[i].weight_mode_value
++						, qopt->tntc[i].rap.min,qopt->tntc[i].rap.max,qopt->tntc[i].rap.exp_weight_factor,prob/255);
++			}
++		}
++	} else {
++		double prob = (double)qopt->rap.probability;
++		fprintf(f, "limit %d, min: %d max: %d exp_weight_factor: %d probability %.2f\n",
++				qopt->limit, qopt->rap.min,qopt->rap.max,qopt->rap.exp_weight_factor,prob/255);
++	}
++
++	if (qopt->ecn)
++		fprintf(f, "ECN enabled ");
++        if (qopt->set_default)
++                fprintf(f, "set_default ");
++
++	fprintf(f, "accel_mode: %d ", qopt->accel_mode);
++
++	return 0;
++}
++
++struct qdisc_util nssred_qdisc_util = {
++	.id		= "nssred",
++	.parse_qopt	= nsswred_parse_opt,
++	.print_qopt	= nsswred_print_opt,
++};
++
++struct qdisc_util nsswred_qdisc_util = {
++	.id		= "nsswred",
++	.parse_qopt	= nsswred_parse_opt,
++	.print_qopt	= nsswred_print_opt,
++};
++
++/* ======================== NSSFIFO =======================*/
++
++static void nssfifo_explain(void)
++{
++	fprintf(stderr, "Usage: ...  nsspfifo [ limit PACKETS ] [ set_default ] [ accel_mode ]\n");
++}
++
++static int nssfifo_parse_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++{
++	struct rtattr *tail;
++	struct tc_nssfifo_qopt opt;
++	bool accel_mode = false;
++
++	memset(&opt, 0, sizeof(opt));
++
++	while (argc > 0) {
++		if (strcmp(*argv, "limit") == 0) {
++			NEXT_ARG();
++			if (get_size(&opt.limit, *argv) || opt.limit == 0) {
++				fprintf(stderr, "Illegal \"limit\"\n");
++				return -1;
++			}
++		} else if (strcmp(*argv, "set_default") == 0) {
++			opt.set_default = 1;
++		} else if (strcmp(*argv, "accel_mode") == 0) {
++			NEXT_ARG();
++			if (get_u8(&opt.accel_mode, *argv, 0)) {
++				fprintf(stderr, "Illegal accel_mode value\n");
++				return -1;
++			}
++			accel_mode = true;
++		} else if (strcmp(*argv, "help") == 0) {
++			nssfifo_explain();
++			return -1;
++		} else {
++			fprintf(stderr, "What is \"%s\"?\n", *argv);
++			nssfifo_explain();
++			return -1;
++		}
++		argc--; argv++;
++	}
++
++	if (!accel_mode) {
++		opt.accel_mode = TCA_NSS_ACCEL_MODE_PPE;
++	} else if (opt.accel_mode >= TCA_NSS_ACCEL_MODE_MAX) {
++		fprintf(stderr, "accel_mode should be < %d\n", TCA_NSS_ACCEL_MODE_MAX);
++		return -1;
++	}
++
++	tail = NLMSG_TAIL(n);
++	addattr_l(n, 1024, TCA_OPTIONS, NULL, 0);
++	addattr_l(n, 1024, TCA_NSSFIFO_PARMS, &opt, sizeof(opt));
++	tail->rta_len = (void *) NLMSG_TAIL(n) - (void *) tail;
++
++	return 0;
++}
++
++static int nssfifo_print_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++{
++	struct rtattr *tb[TCA_NSSFIFO_MAX + 1];
++	struct tc_nssfifo_qopt *qopt;
++	SPRINT_BUF(b1);
++
++	if (opt == NULL)
++		return 0;
++
++	parse_rtattr_nested(tb, TCA_NSSFIFO_MAX, opt);
++
++	if (tb[TCA_NSSFIFO_PARMS] == NULL)
++		return -1;
++
++	if (RTA_PAYLOAD(tb[TCA_NSSFIFO_PARMS]) < sizeof(*qopt))
++		return -1;
++
++	qopt = RTA_DATA(tb[TCA_NSSFIFO_PARMS]);
++
++	if (strcmp(qu->id, "nssbfifo") == 0)
++		fprintf(f, "limit %s ", sprint_size(qopt->limit, b1));
++	else
++		fprintf(f, "limit %up ", qopt->limit);
++
++	if (qopt->set_default)
++		fprintf(f, "set_default ");
++
++	fprintf(f, "accel_mode %d ", qopt->accel_mode);
++
++	return 0;
++}
++
++struct qdisc_util nsspfifo_qdisc_util = {
++	.id		= "nsspfifo",
++	.parse_qopt	= nssfifo_parse_opt,
++	.print_qopt	= nssfifo_print_opt,
++};
++
++struct qdisc_util nssbfifo_qdisc_util = {
++	.id		= "nssbfifo",
++	.parse_qopt	= nssfifo_parse_opt,
++	.print_qopt	= nssfifo_print_opt,
++};
++
++/* ======================== NSSFQ_CODEL =======================*/
++
++static void nssfq_codel_explain(void)
++{
++	fprintf(stderr, "Usage: ... nssfq_codel target TIME interval TIME [ flows NUMBER ] [ quantum BYTES ]"
++				"[ limit PACKETS ] [ set_default ] [ accel_mode ]\n");
++}
++
++static void nssfq_codel_explain_err1(void)
++{
++	fprintf(stderr, "Value of target and interval should be greater than 1ms\n");
++}
++
++static int nssfq_codel_parse_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++{
++	struct rtattr *tail;
++	struct tc_nsscodel_qopt opt;
++	bool accel_mode = false;
++
++	memset(&opt, 0, sizeof(opt));
++
++	while (argc > 0) {
++		if (strcmp(*argv, "target") == 0) {
++			NEXT_ARG();
++			if (get_time(&opt.target, *argv)) {
++				fprintf(stderr, "Illegal \"target\"\n");
++				return -1;
++			}
++		} else if (strcmp(*argv, "limit") == 0) {
++			NEXT_ARG();
++			if (get_size(&opt.limit, *argv) || opt.limit == 0) {
++				fprintf(stderr, "Illegal \"limit\"\n");
++				return -1;
++			}
++		} else if (strcmp(*argv, "flows") == 0) {
++			NEXT_ARG();
++			if (get_size(&opt.flows, *argv) || opt.flows == 0) {
++				fprintf(stderr, "Illegal \"flows\"\n");
++				return -1;
++			}
++		} else if (strcmp(*argv, "quantum") == 0) {
++			NEXT_ARG();
++			if (get_size(&opt.quantum, *argv) || opt.quantum == 0) {
++				fprintf(stderr, "Illegal \"quantum\"\n");
++				return -1;
++			}
++		} else if (strcmp(*argv, "interval") == 0) {
++			NEXT_ARG();
++			if (get_time(&opt.interval, *argv)) {
++				fprintf(stderr, "Illegal \"interval\"\n");
++				return -1;
++			}
++		} else if (strcmp(*argv, "ecn") == 0) {
++			fprintf(stderr, "Illegal, ECN not supported\n");
++			nssfq_codel_explain();
++			return -1;
++		} else if (strcmp(*argv, "set_default") == 0) {
++			opt.set_default = 1;
++		} else if (strcmp(*argv, "accel_mode") == 0) {
++			NEXT_ARG();
++			if (get_u8(&opt.accel_mode, *argv, 0)) {
++				fprintf(stderr, "Illegal accel_mode value\n");
++				return -1;
++			}
++			accel_mode = true;
++		} else if (strcmp(*argv, "help") == 0) {
++			nssfq_codel_explain();
++			return -1;
++		} else {
++			fprintf(stderr, "What is \"%s\"?\n", *argv);
++			nssfq_codel_explain();
++			return -1;
++		}
++		argc--; argv++;
++	}
++
++	if (!accel_mode) {
++		opt.accel_mode = TCA_NSS_ACCEL_MODE_NSS_FW;
++	} else if (opt.accel_mode != TCA_NSS_ACCEL_MODE_NSS_FW) {
++		fprintf(stderr, "accel_mode should be %d\n", TCA_NSS_ACCEL_MODE_NSS_FW);
++		return -1;
++	}
++
++	if (!opt.target || !opt.interval) {
++		nssfq_codel_explain();
++		return -1;
++	}
++
++	if (opt.target < 1000 || opt.interval < 1000) {
++		nssfq_codel_explain_err1();
++		return -1;
++	}
++
++	tail = NLMSG_TAIL(n);
++	addattr_l(n, 1024, TCA_OPTIONS, NULL, 0);
++	addattr_l(n, 1024, TCA_NSSCODEL_PARMS, &opt, sizeof(opt));
++	tail->rta_len = (void *) NLMSG_TAIL(n) - (void *) tail;
++
++	return 0;
++}
++
++static int nssfq_codel_print_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++{
++	struct rtattr *tb[TCA_NSSCODEL_MAX + 1];
++	struct tc_nsscodel_qopt *qopt;
++	SPRINT_BUF(b1);
++	SPRINT_BUF(b2);
++
++	if (opt == NULL)
++		return 0;
++
++	parse_rtattr_nested(tb, TCA_NSSCODEL_MAX, opt);
++
++	if (tb[TCA_NSSCODEL_PARMS] == NULL)
++		return -1;
++
++	if (RTA_PAYLOAD(tb[TCA_NSSCODEL_PARMS]) < sizeof(*qopt))
++		return -1;
++
++	qopt = RTA_DATA(tb[TCA_NSSCODEL_PARMS]);
++
++	fprintf(f, "target %s limit %up interval %s flows %u quantum %u ",
++		sprint_time(qopt->target, b1),
++		qopt->limit,
++		sprint_time(qopt->interval, b2),
++		qopt->flows,
++		qopt->quantum);
++
++	if (qopt->ecn)
++		fprintf(f, "ecn ");
++
++	if (qopt->set_default)
++		fprintf(f, "set_default ");
++
++	fprintf(f, "accel_mode %d ", qopt->accel_mode);
++
++	return 0;
++}
++
++static int nssfq_codel_print_xstats(struct qdisc_util *qu, FILE *f, struct rtattr *xstats)
++{
++	struct tc_nssfq_codel_xstats *st;
++
++	if (xstats == NULL)
++		return 0;
++
++	if (RTA_PAYLOAD(xstats) < sizeof(*st))
++		return -1;
++
++	st = RTA_DATA(xstats);
++	fprintf(f, " maxpacket %u drop_overlimit %u new_flow_count %u ecn_mark %u\n",
++			st->maxpacket, st->drop_overlimit, st->new_flow_count, st->ecn_mark);
++	fprintf(f, " new_flows_len %u old_flows_len %u", st->new_flows_len, st->old_flows_len);
++
++	return 0;
++}
++
++struct qdisc_util nssfq_codel_qdisc_util = {
++	.id		= "nssfq_codel",
++	.parse_qopt	= nssfq_codel_parse_opt,
++	.print_qopt	= nssfq_codel_print_opt,
++	.print_xstats	= nssfq_codel_print_xstats,
++};
++
++/* ======================== NSSCODEL =======================*/
++
++static void nsscodel_explain(void)
++{
++	fprintf(stderr, "Usage: ... nsscodel target TIME interval TIME [ limit PACKETS ] [ set_default ] [ accel_mode ]\n");
++}
++
++static void nsscodel_explain_err1(void)
++{
++	fprintf(stderr, "Value of target and interval should be greater than 1ms\n");
++}
++
++static int nsscodel_parse_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++{
++	struct rtattr *tail;
++	struct tc_nsscodel_qopt opt;
++	bool accel_mode = false;
++
++	memset(&opt, 0, sizeof(opt));
++
++	while (argc > 0) {
++		if (strcmp(*argv, "target") == 0) {
++			NEXT_ARG();
++			if (get_time(&opt.target, *argv)) {
++				fprintf(stderr, "Illegal \"target\"\n");
++				return -1;
++			}
++		} else if (strcmp(*argv, "limit") == 0) {
++			NEXT_ARG();
++			if (get_size(&opt.limit, *argv) || opt.limit == 0) {
++				fprintf(stderr, "Illegal \"limit\"\n");
++				return -1;
++			}
++		} else if (strcmp(*argv, "interval") == 0) {
++			NEXT_ARG();
++			if (get_time(&opt.interval, *argv)) {
++				fprintf(stderr, "Illegal \"interval\"\n");
++				return -1;
++			}
++		} else if (strcmp(*argv, "set_default") == 0) {
++			opt.set_default = 1;
++		} else if (strcmp(*argv, "accel_mode") == 0) {
++			NEXT_ARG();
++			if (get_u8(&opt.accel_mode, *argv, 0)) {
++				fprintf(stderr, "Illegal accel_mode value\n");
++				return -1;
++			}
++			accel_mode = true;
++		} else if (strcmp(*argv, "help") == 0) {
++			nsscodel_explain();
++			return -1;
++		} else {
++			fprintf(stderr, "What is \"%s\"?\n", *argv);
++			nsscodel_explain();
++			return -1;
++		}
++		argc--; argv++;
++	}
++
++	if (!accel_mode) {
++		opt.accel_mode = TCA_NSS_ACCEL_MODE_NSS_FW;
++	} else if (opt.accel_mode != TCA_NSS_ACCEL_MODE_NSS_FW) {
++		fprintf(stderr, "accel_mode should be %d\n", TCA_NSS_ACCEL_MODE_NSS_FW);
++		return -1;
++	}
++
++	if (!opt.target || !opt.interval) {
++		nsscodel_explain();
++		return -1;
++	}
++
++	if (opt.target < 1000 || opt.interval < 1000) {
++		nsscodel_explain_err1();
++		return -1;
++	}
++
++	tail = NLMSG_TAIL(n);
++	addattr_l(n, 1024, TCA_OPTIONS, NULL, 0);
++	addattr_l(n, 1024, TCA_NSSCODEL_PARMS, &opt, sizeof(opt));
++	tail->rta_len = (void *) NLMSG_TAIL(n) - (void *) tail;
++
++	return 0;
++}
++
++static int nsscodel_print_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++{
++	struct rtattr *tb[TCA_NSSCODEL_MAX + 1];
++	struct tc_nsscodel_qopt *qopt;
++	SPRINT_BUF(b1);
++	SPRINT_BUF(b2);
++
++	if (opt == NULL)
++		return 0;
++
++	parse_rtattr_nested(tb, TCA_NSSCODEL_MAX, opt);
++
++	if (tb[TCA_NSSCODEL_PARMS] == NULL)
++		return -1;
++
++	if (RTA_PAYLOAD(tb[TCA_NSSCODEL_PARMS]) < sizeof(*qopt))
++		return -1;
++
++	qopt = RTA_DATA(tb[TCA_NSSCODEL_PARMS]);
++
++	fprintf(f, "target %s limit %up interval %s ",
++		sprint_time(qopt->target, b1),
++		qopt->limit,
++		sprint_time(qopt->interval, b2));
++
++	if (qopt->set_default)
++		fprintf(f, "set_default ");
++
++	fprintf(f, "accel_mode %d ", qopt->accel_mode);
++
++	return 0;
++}
++
++static int nsscodel_print_xstats(struct qdisc_util *qu, FILE *f, struct rtattr *xstats)
++{
++	struct tc_nsscodel_xstats *st;
++
++	if (xstats == NULL)
++		return 0;
++
++	if (RTA_PAYLOAD(xstats) < sizeof(*st))
++		return -1;
++
++	st = RTA_DATA(xstats);
++	fprintf(f, " peak queue delay %ums peak drop delay %ums",
++			st->peak_queue_delay, st->peak_drop_delay);
++
++	return 0;
++}
++
++struct qdisc_util nsscodel_qdisc_util = {
++	.id		= "nsscodel",
++	.parse_qopt	= nsscodel_parse_opt,
++	.print_qopt	= nsscodel_print_opt,
++	.print_xstats	= nsscodel_print_xstats,
++};
++
++/* ======================== NSSTBL =======================*/
++
++static void nsstbl_explain(void)
++{
++	fprintf(stderr, "Usage: ... nsstbl burst BYTES rate BPS [ mtu BYTES ] [ accel_mode ]\n");
++}
++
++static int nsstbl_parse_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++{
++	int ok = 0;
++	struct rtattr *tail;
++	struct tc_nsstbl_qopt opt;
++	bool accel_mode = false;
++
++	memset(&opt, 0, sizeof(opt));
++
++	while (argc > 0) {
++		if (strcmp(*argv, "burst") == 0 ||
++			   strcmp(*argv, "buffer") == 0 ||
++			   strcmp(*argv, "maxburst") == 0) {
++			NEXT_ARG();
++			if (opt.burst) {
++				fprintf(stderr, "Double \"buffer/burst\" spec\n");
++				return -1;
++			}
++			if (get_size(&opt.burst, *argv)) {
++				fprintf(stderr, "Illegal \"burst\"\n");
++				return -1;
++			}
++			ok++;
++		} else if (strcmp(*argv, "mtu") == 0 ||
++			   strcmp(*argv, "minburst") == 0) {
++			NEXT_ARG();
++			if (opt.mtu) {
++				fprintf(stderr, "Double \"mtu/minburst\" spec\n");
++				return -1;
++			}
++			if (get_size(&opt.mtu, *argv)) {
++				fprintf(stderr, "Illegal \"mtu\"\n");
++				return -1;
++			}
++			ok++;
++		} else if (strcmp(*argv, "rate") == 0) {
++			NEXT_ARG();
++			if (opt.rate) {
++				fprintf(stderr, "Double \"rate\" spec\n");
++				return -1;
++			}
++			if (get_rate(&opt.rate, *argv)) {
++				fprintf(stderr, "Illegal \"rate\"\n");
++				return -1;
++			}
++			ok++;
++		} else if (strcmp(*argv, "accel_mode") == 0) {
++			NEXT_ARG();
++			if (get_u8(&opt.accel_mode, *argv, 0)) {
++				fprintf(stderr, "Illegal accel_mode value\n");
++				return -1;
++			}
++			accel_mode = true;
++		} else if (strcmp(*argv, "help") == 0) {
++			nsstbl_explain();
++			return -1;
++		} else {
++			fprintf(stderr, "What is \"%s\"?\n", *argv);
++			nsstbl_explain();
++			return -1;
++		}
++		argc--; argv++;
++	}
++
++	if (!ok) {
++		nsstbl_explain();
++		return -1;
++	}
++
++	if (!accel_mode) {
++		opt.accel_mode = TCA_NSS_ACCEL_MODE_PPE;
++	} else if (opt.accel_mode >= TCA_NSS_ACCEL_MODE_MAX) {
++		fprintf(stderr, "accel_mode should be < %d\n", TCA_NSS_ACCEL_MODE_MAX);
++		return -1;
++	}
++
++	if (!opt.rate || !opt.burst) {
++		fprintf(stderr, "Both \"rate\" and \"burst\" are required.\n");
++		return -1;
++	}
++
++	/*
++	 * Peakrate is currently not supported, but we keep the infrastructure
++	 * for future use. However, we have disabled taking input for this.
++	 */
++	if (opt.peakrate) {
++		if (!opt.mtu) {
++			fprintf(stderr, "\"mtu\" is required, if \"peakrate\" is requested.\n");
++			return -1;
++		}
++	}
++
++	tail = NLMSG_TAIL(n);
++	addattr_l(n, 1024, TCA_OPTIONS, NULL, 0);
++	addattr_l(n, 1024, TCA_NSSTBL_PARMS, &opt, sizeof(opt));
++	tail->rta_len = (void *) NLMSG_TAIL(n) - (void *) tail;
++
++	return 0;
++}
++
++static int nsstbl_print_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++{
++	struct rtattr *tb[TCA_NSSTBL_MAX + 1];
++	struct tc_nsstbl_qopt *qopt;
++
++	if (opt == NULL)
++		return 0;
++
++	parse_rtattr_nested(tb, TCA_NSSTBL_MAX, opt);
++
++	if (tb[TCA_NSSTBL_PARMS] == NULL)
++		return -1;
++
++	if (RTA_PAYLOAD(tb[TCA_NSSTBL_PARMS]) < sizeof(*qopt))
++		return -1;
++
++	qopt = RTA_DATA(tb[TCA_NSSTBL_PARMS]);
++
++	print_size(PRINT_FP, NULL, "buffer/maxburst %s ", qopt->burst);
++	tc_print_rate(PRINT_FP, NULL, "rate %s ", qopt->rate);
++	print_size(PRINT_FP, NULL, "mtu %s ", qopt->mtu);
++	fprintf(f, "accel_mode %d ", qopt->accel_mode);
++
++	return 0;
++}
++
++struct qdisc_util nsstbl_qdisc_util = {
++	.id		= "nsstbl",
++	.parse_qopt	= nsstbl_parse_opt,
++	.print_qopt	= nsstbl_print_opt,
++};
++
++/* ======================== NSSPRIO =======================*/
++
++static void nssprio_explain(void)
++{
++	fprintf(stderr, "Usage: ... nssprio [ bands NUMBER (default 256) ] [ accel_mode ]\n");
++}
++
++static int nssprio_parse_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++{
++	int ok = 0;
++	struct rtattr *tail;
++	struct tc_nssprio_qopt opt;
++	bool accel_mode = false;
++
++	memset(&opt, 0, sizeof(opt));
++
++	while (argc > 0) {
++		if (strcmp(*argv, "bands") == 0) {
++			NEXT_ARG();
++			if (get_unsigned(&opt.bands, *argv, 0)) {
++				fprintf(stderr, "Illegal \"limit\"\n");
++				return -1;
++			}
++			ok++;
++		} else if (strcmp(*argv, "accel_mode") == 0) {
++			NEXT_ARG();
++			if (get_u8(&opt.accel_mode, *argv, 0)) {
++				fprintf(stderr, "Illegal accel_mode value\n");
++				return -1;
++			}
++			accel_mode = true;
++		} else if (strcmp(*argv, "help") == 0) {
++			nssprio_explain();
++			return -1;
++		} else {
++			fprintf(stderr, "What is \"%s\"?\n", *argv);
++			nssprio_explain();
++			return -1;
++		}
++		argc--; argv++;
++	}
++
++	if (!ok) {
++		opt.bands = TCA_NSSPRIO_MAX_BANDS;
++	} else if (opt.bands > TCA_NSSPRIO_MAX_BANDS) {
++		nssprio_explain();
++		return -1;
++	}
++
++        if (!accel_mode) {
++                opt.accel_mode = TCA_NSS_ACCEL_MODE_PPE;
++        } else if (opt.accel_mode >= TCA_NSS_ACCEL_MODE_MAX) {
++                fprintf(stderr, "accel_mode should be < %d\n", TCA_NSS_ACCEL_MODE_MAX);
++                return -1;
++        }
++
++	tail = NLMSG_TAIL(n);
++	addattr_l(n, 1024, TCA_OPTIONS, NULL, 0);
++	addattr_l(n, 1024, TCA_NSSPRIO_PARMS, &opt, sizeof(opt));
++	tail->rta_len = (void *) NLMSG_TAIL(n) - (void *) tail;
++
++	return 0;
++}
++
++static int nssprio_print_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++{
++	struct rtattr *tb[TCA_NSSPRIO_MAX + 1];
++	struct tc_nssprio_qopt *qopt;
++
++	if (opt == NULL)
++		return 0;
++
++	parse_rtattr_nested(tb, TCA_NSSPRIO_MAX, opt);
++
++	if (tb[TCA_NSSPRIO_PARMS] == NULL)
++		return -1;
++
++	if (RTA_PAYLOAD(tb[TCA_NSSPRIO_PARMS]) < sizeof(*qopt))
++		return -1;
++
++	qopt = RTA_DATA(tb[TCA_NSSPRIO_PARMS]);
++
++	fprintf(f, "bands %u ", qopt->bands);
++	fprintf(f, "accel_mode %d ", qopt->accel_mode);
++
++	return 0;
++}
++
++struct qdisc_util nssprio_qdisc_util = {
++	.id		= "nssprio",
++	.parse_qopt	= nssprio_parse_opt,
++	.print_qopt	= nssprio_print_opt,
++};
++
++/* ======================== NSSBF =======================*/
++
++static void nssbf_explain_qdisc(void)
++{
++	fprintf(stderr,
++		"Usage: ... nssbf [ accel_mode ]\n"
++	);
++}
++
++static void nssbf_explain_class(void)
++{
++	fprintf(stderr, "Usage: ... nssbf rate BPS burst BYTES [ mtu BYTES ]\n");
++	fprintf(stderr, "                 [ quantum BYTES ]\n");
++}
++
++static void nssbf_explain1(char *arg)
++{
++	fprintf(stderr, "NSSBF: Illegal \"%s\"\n", arg);
++}
++
++static int nssbf_parse_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++{
++	struct tc_nssbf_qopt opt;
++	struct rtattr *tail;
++	bool accel_mode = false;
++
++	memset(&opt, 0, sizeof(opt));
++
++	while (argc > 0) {
++		if (matches(*argv, "default") == 0) {
++			NEXT_ARG();
++			if (opt.defcls != 0) {
++				fprintf(stderr, "NSSBF: Double \"default\"\n");
++				return -1;
++			}
++			if (get_u16(&opt.defcls, *argv, 16) < 0) {
++				nssbf_explain1("default");
++				return -1;
++			}
++		} else if (strcmp(*argv, "accel_mode") == 0) {
++			NEXT_ARG();
++			if (get_u8(&opt.accel_mode, *argv, 0)) {
++				fprintf(stderr, "Illegal accel_mode value\n");
++				return -1;
++			}
++			accel_mode = true;
++		} else if (matches(*argv, "help") == 0) {
++			nssbf_explain_qdisc();
++			return -1;
++		} else {
++			fprintf(stderr, "NSSBF: What is \"%s\" ?\n", *argv);
++			nssbf_explain_qdisc();
++			return -1;
++		}
++		argc--, argv++;
++	}
++
++	if (!accel_mode) {
++		opt.accel_mode = TCA_NSS_ACCEL_MODE_NSS_FW;
++	} else if (opt.accel_mode != TCA_NSS_ACCEL_MODE_NSS_FW) {
++		fprintf(stderr, "accel_mode should be %d\n", TCA_NSS_ACCEL_MODE_NSS_FW);
++		return -1;
++	}
++
++	tail = NLMSG_TAIL(n);
++	addattr_l(n, 1024, TCA_OPTIONS, NULL, 0);
++	addattr_l(n, 1024, TCA_NSSBF_QDISC_PARMS, &opt, sizeof(opt));
++	tail->rta_len = (void *) NLMSG_TAIL(n) - (void *) tail;
++
++	return 0;
++}
++
++static int nssbf_print_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++{
++	struct rtattr *tb[TCA_NSSBF_MAX + 1];
++	struct tc_nssbf_qopt *qopt;
++
++	if (opt == NULL)
++		return 0;
++
++	parse_rtattr_nested(tb, TCA_NSSBF_MAX, opt);
++
++	if (tb[TCA_NSSBF_QDISC_PARMS] == NULL)
++		return -1;
++
++	if (RTA_PAYLOAD(tb[TCA_NSSBF_QDISC_PARMS]) < sizeof(*qopt))
++		return -1;
++
++	qopt = RTA_DATA(tb[TCA_NSSBF_QDISC_PARMS]);
++
++	fprintf(f, "accel_mode %d ", qopt->accel_mode);
++
++	return 0;
++}
++
++static int nssbf_parse_class_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++{
++	int ok = 0;
++	struct rtattr *tail;
++	struct tc_nssbf_class_qopt opt;
++
++	memset(&opt, 0, sizeof(opt));
++
++	while (argc > 0) {
++		if (strcmp(*argv, "burst") == 0 ||
++			   strcmp(*argv, "buffer") == 0 ||
++			   strcmp(*argv, "maxburst") == 0) {
++			NEXT_ARG();
++			if (opt.burst) {
++				fprintf(stderr, "Double \"buffer/burst\" spec\n");
++				return -1;
++			}
++			if (get_size(&opt.burst, *argv)) {
++				fprintf(stderr, "Illegal \"burst\"\n");
++				return -1;
++			}
++			ok++;
++		} else if (strcmp(*argv, "mtu") == 0) {
++			NEXT_ARG();
++			if (opt.mtu) {
++				fprintf(stderr, "Double \"mtu\" spec\n");
++				return -1;
++			}
++			if (get_size(&opt.mtu, *argv)) {
++				fprintf(stderr, "Illegal \"mtu\"\n");
++				return -1;
++			}
++			ok++;
++		} else if (strcmp(*argv, "quantum") == 0) {
++			NEXT_ARG();
++			if (opt.quantum) {
++				fprintf(stderr, "Double \"quantum\" spec\n");
++				return -1;
++			}
++			if (get_size(&opt.quantum, *argv)) {
++				fprintf(stderr, "Illegal \"quantum\"\n");
++				return -1;
++			}
++			ok++;
++		} else if (strcmp(*argv, "rate") == 0) {
++			NEXT_ARG();
++			if (opt.rate) {
++				fprintf(stderr, "Double \"rate\" spec\n");
++				return -1;
++			}
++			if (get_rate(&opt.rate, *argv)) {
++				fprintf(stderr, "Illegal \"rate\"\n");
++				return -1;
++			}
++			ok++;
++		} else if (strcmp(*argv, "help") == 0) {
++			nssbf_explain_class();
++			return -1;
++		} else {
++			fprintf(stderr, "What is \"%s\"?\n", *argv);
++			nssbf_explain_class();
++			return -1;
++		}
++		argc--; argv++;
++	}
++
++	if (!ok) {
++		nssbf_explain_class();
++		return -1;
++	}
++
++	if (!opt.rate || !opt.burst) {
++		fprintf(stderr, "Both \"rate\" and \"burst\" are required.\n");
++		return -1;
++	}
++
++	tail = NLMSG_TAIL(n);
++	addattr_l(n, 1024, TCA_OPTIONS, NULL, 0);
++	addattr_l(n, 1024, TCA_NSSBF_CLASS_PARMS, &opt, sizeof(opt));
++	tail->rta_len = (void *) NLMSG_TAIL(n) - (void *) tail;
++
++	return 0;
++}
++
++static int nssbf_print_class_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++{
++	struct rtattr *tb[TCA_NSSBF_MAX + 1];
++	struct tc_nssbf_class_qopt *qopt;
++
++	if (opt == NULL)
++		return 0;
++
++	parse_rtattr_nested(tb, TCA_NSSBF_MAX, opt);
++
++	if (tb[TCA_NSSBF_CLASS_PARMS] == NULL)
++		return -1;
++
++	if (RTA_PAYLOAD(tb[TCA_NSSBF_CLASS_PARMS]) < sizeof(*qopt))
++		return -1;
++
++	qopt = RTA_DATA(tb[TCA_NSSBF_CLASS_PARMS]);
++
++	print_size(PRINT_FP, NULL, "burst %s ", qopt->burst);
++	tc_print_rate(PRINT_FP, NULL, "rate %s ", qopt->rate);
++	print_size(PRINT_FP, NULL, "quantum %s ", qopt->quantum);
++	print_size(PRINT_FP, NULL, "mtu %s ", qopt->mtu);
++
++	return 0;
++}
++
++struct qdisc_util nssbf_qdisc_util = {
++	.id		= "nssbf",
++	.parse_qopt	= nssbf_parse_opt,
++	.print_qopt	= nssbf_print_opt,
++	.parse_copt	= nssbf_parse_class_opt,
++	.print_copt	= nssbf_print_class_opt,
++};
++
++/* ======================== NSSWRR =======================*/
++
++static void nsswrr_explain_qdisc(void)
++{
++	fprintf(stderr,	"Usage (qdisc): ... nsswrr [ accel_mode ]\n");
++}
++
++static void nsswrr_explain_class(void)
++{
++	fprintf(stderr, "Usage (class): ... nsswrr quantum PACKETS ]\n");
++}
++
++static int nsswrr_parse_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++{
++	struct tc_nsswrr_qopt opt;
++	bool accel_mode = false;
++	struct rtattr *tail;
++
++	memset(&opt, 0, sizeof(opt));
++
++	while (argc > 0) {
++		if (strcmp(*argv, "accel_mode") == 0) {
++			NEXT_ARG();
++			if (get_u8(&opt.accel_mode, *argv, 0)) {
++				fprintf(stderr, "Illegal accel_mode value\n");
++				return -1;
++			}
++			accel_mode = true;
++		} else if (matches(*argv, "help") == 0) {
++			nsswrr_explain_qdisc();
++			return -1;
++		} else {
++			fprintf(stderr, "What is \"%s\" ?\n", *argv);
++			nsswrr_explain_qdisc();
++			return -1;
++		}
++		argc--, argv++;
++	}
++
++	if (!accel_mode) {
++		opt.accel_mode = TCA_NSS_ACCEL_MODE_PPE;
++	} else if (opt.accel_mode >= TCA_NSS_ACCEL_MODE_MAX) {
++		fprintf(stderr, "accel_mode should be < %d\n", TCA_NSS_ACCEL_MODE_MAX);
++		return -1;
++	}
++
++	tail = NLMSG_TAIL(n);
++	addattr_l(n, 1024, TCA_OPTIONS, NULL, 0);
++	addattr_l(n, 1024, TCA_NSSWRR_QDISC_PARMS, &opt, sizeof(opt));
++	tail->rta_len = (void *) NLMSG_TAIL(n) - (void *) tail;
++
++	return 0;
++}
++
++static int nsswrr_print_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++{
++	struct rtattr *tb[TCA_NSSWRR_MAX + 1];
++	struct tc_nsswrr_qopt *qopt;
++
++	if (opt == NULL)
++		return 0;
++
++	parse_rtattr_nested(tb, TCA_NSSWRR_MAX, opt);
++
++	if (tb[TCA_NSSWRR_QDISC_PARMS] == NULL)
++		return -1;
++
++	if (RTA_PAYLOAD(tb[TCA_NSSWRR_QDISC_PARMS]) < sizeof(*qopt))
++		return -1;
++
++	qopt = RTA_DATA(tb[TCA_NSSWRR_QDISC_PARMS]);
++	fprintf(f, "accel_mode %d ", qopt->accel_mode);
++
++	return 0;
++}
++
++static int nsswrr_parse_class_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++{
++	int ok = 0;
++	struct rtattr *tail;
++	struct tc_nsswrr_class_qopt opt;
++
++	memset(&opt, 0, sizeof(opt));
++
++	while (argc > 0) {
++		if (strcmp(*argv, "quantum") == 0) {
++			NEXT_ARG();
++			if (get_u32(&opt.quantum, *argv, 10)) {
++				fprintf(stderr, "Illegal \"quantum\"\n");
++				return -1;
++			}
++			ok++;
++		} else if (strcmp(*argv, "help") == 0) {
++			nsswrr_explain_class();
++			return -1;
++		} else {
++			fprintf(stderr, "What is \"%s\"?\n", *argv);
++			nsswrr_explain_class();
++			return -1;
++		}
++		argc--; argv++;
++	}
++
++	if (!ok) {
++		nsswrr_explain_class();
++		return -1;
++	}
++
++	tail = NLMSG_TAIL(n);
++	addattr_l(n, 1024, TCA_OPTIONS, NULL, 0);
++	addattr_l(n, 1024, TCA_NSSWRR_CLASS_PARMS, &opt, sizeof(opt));
++	tail->rta_len = (void *) NLMSG_TAIL(n) - (void *) tail;
++
++	return 0;
++}
++
++static int nsswrr_print_class_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++{
++	struct rtattr *tb[TCA_NSSWRR_MAX + 1];
++	struct tc_nsswrr_class_qopt *qopt;
++
++	if (opt == NULL)
++		return 0;
++
++	parse_rtattr_nested(tb, TCA_NSSWRR_MAX, opt);
++
++	if (tb[TCA_NSSWRR_CLASS_PARMS] == NULL)
++		return -1;
++
++	if (RTA_PAYLOAD(tb[TCA_NSSWRR_CLASS_PARMS]) < sizeof(*qopt))
++		return -1;
++
++	qopt = RTA_DATA(tb[TCA_NSSWRR_CLASS_PARMS]);
++
++	fprintf(f, "quantum %up ", qopt->quantum);
++	return 0;
++}
++
++struct qdisc_util nsswrr_qdisc_util = {
++	.id		= "nsswrr",
++	.parse_qopt	= nsswrr_parse_opt,
++	.print_qopt	= nsswrr_print_opt,
++	.parse_copt	= nsswrr_parse_class_opt,
++	.print_copt	= nsswrr_print_class_opt,
++};
++
++/* ======================== NSSWFQ =======================*/
++
++static void nsswfq_explain_qdisc(void)
++{
++	fprintf(stderr, "Usage (qdisc): ... nsswfq [ accel_mode ]\n");
++}
++
++static void nsswfq_explain_class(void)
++{
++	fprintf(stderr, "Usage (class): ... nsswfq quantum BYTES ]\n");
++}
++
++static int nsswfq_parse_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++{
++	struct tc_nsswfq_qopt opt;
++	bool accel_mode = false;
++	struct rtattr *tail;
++
++	memset(&opt, 0, sizeof(opt));
++
++	while (argc > 0) {
++		if (strcmp(*argv, "accel_mode") == 0) {
++			NEXT_ARG();
++			if (get_u8(&opt.accel_mode, *argv, 0)) {
++				fprintf(stderr, "Illegal accel_mode value\n");
++				return -1;
++			}
++			accel_mode = true;
++		} else if (matches(*argv, "help") == 0) {
++			nsswfq_explain_qdisc();
++			return -1;
++		} else {
++			fprintf(stderr, "NSSWFQ: What is \"%s\" ?\n", *argv);
++			nsswfq_explain_qdisc();
++			return -1;
++		}
++		argc--, argv++;
++	}
++
++	if (!accel_mode) {
++		opt.accel_mode = TCA_NSS_ACCEL_MODE_PPE;
++	} else if (opt.accel_mode >= TCA_NSS_ACCEL_MODE_MAX) {
++		fprintf(stderr, "accel_mode should be < %d\n", TCA_NSS_ACCEL_MODE_MAX);
++		return -1;
++	}
++
++	tail = NLMSG_TAIL(n);
++	addattr_l(n, 1024, TCA_OPTIONS, NULL, 0);
++	addattr_l(n, 1024, TCA_NSSWFQ_QDISC_PARMS, &opt, sizeof(opt));
++	tail->rta_len = (void *) NLMSG_TAIL(n) - (void *) tail;
++
++	return 0;
++}
++
++static int nsswfq_print_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++{
++	struct rtattr *tb[TCA_NSSWFQ_MAX + 1];
++	struct tc_nsswfq_qopt *qopt;
++
++	if (opt == NULL)
++		return 0;
++
++	parse_rtattr_nested(tb, TCA_NSSWFQ_MAX, opt);
++
++	if (tb[TCA_NSSWFQ_QDISC_PARMS] == NULL)
++		return -1;
++
++	if (RTA_PAYLOAD(tb[TCA_NSSWFQ_QDISC_PARMS]) < sizeof(*qopt))
++		return -1;
++
++	qopt = RTA_DATA(tb[TCA_NSSWFQ_QDISC_PARMS]);
++	fprintf(f, "accel_mode %d ", qopt->accel_mode);
++
++	return 0;
++}
++
++static int nsswfq_parse_class_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++{
++	int ok = 0;
++	struct rtattr *tail;
++	struct tc_nsswfq_class_qopt opt;
++
++	memset(&opt, 0, sizeof(opt));
++
++	while (argc > 0) {
++		if (strcmp(*argv, "quantum") == 0) {
++			NEXT_ARG();
++			if (get_size(&opt.quantum, *argv)) {
++				fprintf(stderr, "Illegal \"quantum\"\n");
++				return -1;
++			}
++			ok++;
++		} else if (strcmp(*argv, "help") == 0) {
++			nsswfq_explain_class();
++			return -1;
++		} else {
++			fprintf(stderr, "What is \"%s\"?\n", *argv);
++			nsswfq_explain_class();
++			return -1;
++		}
++		argc--; argv++;
++	}
++
++	if (!ok) {
++		nsswfq_explain_class();
++		return -1;
++	}
++
++	tail = NLMSG_TAIL(n);
++	addattr_l(n, 1024, TCA_OPTIONS, NULL, 0);
++	addattr_l(n, 1024, TCA_NSSWFQ_CLASS_PARMS, &opt, sizeof(opt));
++	tail->rta_len = (void *) NLMSG_TAIL(n) - (void *) tail;
++
++	return 0;
++}
++
++static int nsswfq_print_class_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++{
++	struct rtattr *tb[TCA_NSSWFQ_MAX + 1];
++	struct tc_nsswfq_class_qopt *qopt;
++	SPRINT_BUF(b1);
++
++	if (opt == NULL)
++		return 0;
++
++	parse_rtattr_nested(tb, TCA_NSSWFQ_MAX, opt);
++
++	if (tb[TCA_NSSWFQ_CLASS_PARMS] == NULL)
++		return -1;
++
++	if (RTA_PAYLOAD(tb[TCA_NSSWFQ_CLASS_PARMS]) < sizeof(*qopt))
++		return -1;
++
++	qopt = RTA_DATA(tb[TCA_NSSWFQ_CLASS_PARMS]);
++
++	fprintf(f, "quantum %s ", sprint_size(qopt->quantum, b1));
++
++	return 0;
++}
++
++struct qdisc_util nsswfq_qdisc_util = {
++	.id		= "nsswfq",
++	.parse_qopt	= nsswfq_parse_opt,
++	.print_qopt	= nsswfq_print_opt,
++	.parse_copt	= nsswfq_parse_class_opt,
++	.print_copt	= nsswfq_print_class_opt,
++};
++
++/* ======================== NSSHTB =======================*/
++
++static void nsshtb_explain_qdisc(void)
++{
++	fprintf(stderr,
++		"Usage: ... nsshtb [ r2q ] [ accel_mode ]\n"
++	);
++}
++
++static void nsshtb_explain_class(void)
++{
++	fprintf(stderr, "Usage: ... nsshtb priority 0-3 [ quantum BYTES ] [ rate BPS ] [ burst BYTES ] [crate BPS ] [ cburst BYTES ]\n");
++	fprintf(stderr, "                 [ overhead BYTES ] \n");
++}
++
++static void nsshtb_explain1(char *arg)
++{
++	fprintf(stderr, "NSSHTB: Illegal \"%s\"\n", arg);
++}
++
++static int nsshtb_parse_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++{
++	struct tc_nsshtb_qopt opt;
++	struct rtattr *tail;
++	bool accel_mode = false;
++
++	memset(&opt, 0, sizeof(opt));
++
++	while (argc > 0) {
++		if (strcmp(*argv, "r2q") == 0) {
++			NEXT_ARG();
++			if (opt.r2q != 0) {
++				fprintf(stderr, "NSSHTB: Double \"r2q\"\n");
++				return -1;
++			}
++			if (get_u32(&opt.r2q, *argv, 10) < 0) {
++				nsshtb_explain1("r2q");
++				return -1;
++			}
++		} else if (strcmp(*argv, "accel_mode") == 0) {
++			NEXT_ARG();
++			if (get_u8(&opt.accel_mode, *argv, 0)) {
++				fprintf(stderr, "Illegal accel_mode value\n");
++				return -1;
++			}
++			accel_mode = true;
++		} else if (strcmp(*argv, "help") == 0) {
++			nsshtb_explain_qdisc();
++			return -1;
++		} else {
++			fprintf(stderr, "NSSHTB: What is \"%s\" ?\n", *argv);
++			nsshtb_explain_qdisc();
++			return -1;
++		}
++		argc--, argv++;
++	}
++
++	if (!accel_mode) {
++		opt.accel_mode = TCA_NSS_ACCEL_MODE_PPE;
++	} else if (opt.accel_mode >= TCA_NSS_ACCEL_MODE_MAX) {
++		fprintf(stderr, "accel_mode should be < %d\n", TCA_NSS_ACCEL_MODE_MAX);
++		return -1;
++	}
++
++	tail = NLMSG_TAIL(n);
++	addattr_l(n, 1024, TCA_OPTIONS, NULL, 0);
++	addattr_l(n, 1024, TCA_NSSHTB_QDISC_PARMS, &opt, sizeof(opt));
++	tail->rta_len = (void *) NLMSG_TAIL(n) - (void *) tail;
++
++	return 0;
++}
++
++static int nsshtb_print_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++{
++	struct rtattr *tb[TCA_NSSHTB_MAX + 1];
++	struct tc_nsshtb_qopt *qopt;
++
++	if (opt == NULL)
++		return 0;
++
++	parse_rtattr_nested(tb, TCA_NSSHTB_MAX, opt);
++
++	if (tb[TCA_NSSHTB_QDISC_PARMS] == NULL)
++		return -1;
++
++	if (RTA_PAYLOAD(tb[TCA_NSSHTB_QDISC_PARMS]) < sizeof(*qopt))
++		return -1;
++
++	qopt = RTA_DATA(tb[TCA_NSSHTB_QDISC_PARMS]);
++
++	if (qopt->r2q != 0)
++		fprintf(f, "r2q %u ", qopt->r2q);
++
++	fprintf(f, "accel_mode %d ", qopt->accel_mode);
++
++	return 0;
++}
++
++static int nsshtb_parse_class_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++{
++	int ok = 0;
++	struct rtattr *tail;
++	struct tc_nsshtb_class_qopt opt;
++	int crate = 0;
++
++	memset(&opt, 0, sizeof(opt));
++
++	while (argc > 0) {
++		if (strcmp(*argv, "burst") == 0) {
++			NEXT_ARG();
++			if (opt.burst) {
++				fprintf(stderr, "Double \"burst\" spec\n");
++				return -1;
++			}
++			if (get_size(&opt.burst, *argv)) {
++				fprintf(stderr, "Illegal \"burst\"\n");
++				return -1;
++			}
++			ok++;
++		} else if (strcmp(*argv, "rate") == 0) {
++			NEXT_ARG();
++			if (opt.rate) {
++				fprintf(stderr, "Double \"rate\" spec\n");
++				return -1;
++			}
++			if (get_rate(&opt.rate, *argv)) {
++				fprintf(stderr, "Illegal \"rate\"\n");
++				return -1;
++			}
++			ok++;
++		} else if (strcmp(*argv, "cburst") == 0) {
++			NEXT_ARG();
++			if (opt.cburst) {
++				fprintf(stderr, "Double \"cburst\" spec\n");
++				return -1;
++			}
++			if (get_size(&opt.cburst, *argv)) {
++				fprintf(stderr, "Illegal \"cburst\"\n");
++				return -1;
++			}
++			ok++;
++		} else if (strcmp(*argv, "crate") == 0) {
++			NEXT_ARG();
++			if (opt.crate) {
++				fprintf(stderr, "Double \"crate\" spec\n");
++				return -1;
++			}
++			if (get_rate(&opt.crate, *argv)) {
++				fprintf(stderr, "Illegal \"crate\"\n");
++				return -1;
++			}
++			crate++;
++			ok++;
++		} else if (strcmp(*argv, "priority") == 0) {
++			NEXT_ARG();
++			if (opt.priority) {
++				fprintf(stderr, "Double \"priority\" spec\n");
++				return -1;
++			}
++			if (get_u32(&opt.priority, *argv, 10) < 0) {
++				fprintf(stderr, "Illegal \"priority\"\n");
++				return -1;
++			}
++			ok++;
++		} else if (strcmp(*argv, "quantum") == 0) {
++			NEXT_ARG();
++			if (opt.quantum) {
++				fprintf(stderr, "Double \"quantum\" spec\n");
++				return -1;
++			}
++			if (get_size(&opt.quantum, *argv)) {
++				fprintf(stderr, "Illegal \"quantum\"\n");
++				return -1;
++			}
++			ok++;
++		} else if (strcmp(*argv, "overhead") == 0) {
++			NEXT_ARG();
++			if (opt.overhead) {
++				fprintf(stderr, "Double \"overhead\" spec\n");
++				return -1;
++			}
++			if (get_size(&opt.overhead, *argv)) {
++				fprintf(stderr, "Illegal \"overhead\"\n");
++				return -1;
++			}
++			ok++;
++		} else if (strcmp(*argv, "help") == 0) {
++			nsshtb_explain_class();
++			return -1;
++		} else {
++			fprintf(stderr, "What is \"%s\"?\n", *argv);
++			nsshtb_explain_class();
++			return -1;
++		}
++		argc--; argv++;
++	}
++
++	if (!ok) {
++		nsshtb_explain_class();
++		return -1;
++	}
++
++	if (opt.rate && !opt.burst) {
++		fprintf(stderr, "\"burst\" required if \"rate\" is specified.\n");
++		return -1;
++	}
++
++	if (!crate) {
++		fprintf(stderr, "\"crate\" is required.\n");
++		return -1;
++	}
++
++	if (opt.crate && !opt.cburst) {
++		fprintf(stderr, "\"cburst\" required if \"crate\" is non-zero.\n");
++		return -1;
++	}
++
++	if (opt.priority > 3) {
++		fprintf(stderr, "\"priority\" should be an integer between 0 and 3.\n");
++		return -1;
++	}
++
++	tail = NLMSG_TAIL(n);
++	addattr_l(n, 1024, TCA_OPTIONS, NULL, 0);
++	addattr_l(n, 1024, TCA_NSSHTB_CLASS_PARMS, &opt, sizeof(opt));
++	tail->rta_len = (void *) NLMSG_TAIL(n) - (void *) tail;
++
++	return 0;
++}
++
++static int nsshtb_print_class_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++{
++	struct rtattr *tb[TCA_NSSHTB_MAX + 1];
++	struct tc_nsshtb_class_qopt *qopt;
++	SPRINT_BUF(b1);
++
++	if (opt == NULL)
++		return 0;
++
++	parse_rtattr_nested(tb, TCA_NSSHTB_MAX, opt);
++
++	if (tb[TCA_NSSHTB_CLASS_PARMS] == NULL)
++		return -1;
++
++	if (RTA_PAYLOAD(tb[TCA_NSSHTB_CLASS_PARMS]) < sizeof(*qopt))
++		return -1;
++
++	qopt = RTA_DATA(tb[TCA_NSSHTB_CLASS_PARMS]);
++
++	print_size(PRINT_FP, NULL, "burst %s ", qopt->burst);
++	tc_print_rate(PRINT_FP, NULL, "rate %s ", qopt->rate);
++	print_size(PRINT_FP, NULL, "cburst %s ", qopt->cburst);
++	tc_print_rate(PRINT_FP, NULL, "crate %s ", qopt->crate);
++	fprintf(f, "priority %u ", qopt->priority);
++	print_size(PRINT_FP, NULL, "quantum %s ", qopt->quantum);
++	print_size(PRINT_FP, NULL, "overhead %s ", qopt->overhead);
++
++	return 0;
++}
++
++struct qdisc_util nsshtb_qdisc_util = {
++	.id		= "nsshtb",
++	.parse_qopt	= nsshtb_parse_opt,
++	.print_qopt	= nsshtb_print_opt,
++	.parse_copt	= nsshtb_parse_class_opt,
++	.print_copt	= nsshtb_print_class_opt,
++};
++
++/* ======================== NSSBLACKHOLE ======================= */
++
++static void nssblackhole_explain(void)
++{
++	fprintf(stderr, "Usage: ...  nssblackhole [ set_default ] [ accel_mode ]\n");
++}
++
++static int nssblackhole_parse_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++{
++	struct rtattr *tail;
++	struct tc_nssblackhole_qopt opt;
++	bool accel_mode = false;
++
++	memset(&opt, 0, sizeof(opt));
++
++	while (argc > 0) {
++		if (strcmp(*argv, "set_default") == 0) {
++			opt.set_default = 1;
++		} else if (strcmp(*argv, "accel_mode") == 0) {
++			NEXT_ARG();
++			if (get_u8(&opt.accel_mode, *argv, 0)) {
++				fprintf(stderr, "Illegal accel_mode value\n");
++				return -1;
++			}
++			accel_mode = true;
++		} else if (strcmp(*argv, "help") == 0) {
++			nssblackhole_explain();
++			return -1;
++		} else {
++			fprintf(stderr, "What is \"%s\"?\n", *argv);
++			nssblackhole_explain();
++			return -1;
++		}
++		argc--; argv++;
++	}
++
++	if (!accel_mode) {
++		opt.accel_mode = TCA_NSS_ACCEL_MODE_PPE;
++	} else if (opt.accel_mode >= TCA_NSS_ACCEL_MODE_MAX) {
++		fprintf(stderr, "accel_mode should be < %d\n", TCA_NSS_ACCEL_MODE_MAX);
++		return -1;
++	}
++
++	tail = NLMSG_TAIL(n);
++	addattr_l(n, 1024, TCA_OPTIONS, NULL, 0);
++	addattr_l(n, 1024, TCA_NSSBLACKHOLE_PARMS, &opt, sizeof(opt));
++	tail->rta_len = (void *) NLMSG_TAIL(n) - (void *) tail;
++
++	return 0;
++}
++
++static int nssblackhole_print_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++{
++	struct rtattr *tb[TCA_NSSBLACKHOLE_MAX + 1];
++	struct tc_nssblackhole_qopt *qopt;
++
++	if (opt == NULL)
++		return 0;
++
++	parse_rtattr_nested(tb, TCA_NSSBLACKHOLE_MAX, opt);
++
++	if (tb[TCA_NSSBLACKHOLE_PARMS] == NULL)
++		return -1;
++
++	if (RTA_PAYLOAD(tb[TCA_NSSBLACKHOLE_PARMS]) < sizeof(*qopt))
++		return -1;
++
++	qopt = RTA_DATA(tb[TCA_NSSBLACKHOLE_PARMS]);
++
++	if (qopt->set_default)
++		fprintf(f, "set_default ");
++
++	fprintf(f, "accel_mode %d ", qopt->accel_mode);
++
++	return 0;
++}
++
++struct qdisc_util nssblackhole_qdisc_util = {
++	.id		= "nssblackhole",
++	.parse_qopt	= nssblackhole_parse_opt,
++	.print_qopt	= nssblackhole_print_opt,
++};
diff --git a/package/network/utils/iproute2/patches/500-add-nssmirred.patch b/package/network/utils/iproute2/patches/500-add-nssmirred.patch
new file mode 100644
index 00000000000000..f4c3bc587d124c
--- /dev/null
+++ b/package/network/utils/iproute2/patches/500-add-nssmirred.patch
@@ -0,0 +1,243 @@
+--- a/tc/Makefile
++++ b/tc/Makefile
+@@ -50,6 +50,7 @@ TCMODULES += m_tunnel_key.o
+ TCMODULES += m_sample.o
+ TCMODULES += m_ct.o
+ TCMODULES += m_gate.o
++TCMODULES += m_nssmirred.o
+ TCMODULES += p_ip.o
+ TCMODULES += p_ip6.o
+ TCMODULES += p_icmp.o
+--- /dev/null
++++ b/tc/m_nssmirred.c
+@@ -0,0 +1,183 @@
++/*
++ **************************************************************************
++ * Copyright (c) 2019 The Linux Foundation. All rights reserved.
++ * Permission to use, copy, modify, and/or distribute this software for
++ * any purpose with or without fee is hereby granted, provided that the
++ * above copyright notice and this permission notice appear in all copies.
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
++ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
++ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
++ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ **************************************************************************
++ */
++
++#include <stdio.h>
++#include <stdlib.h>
++#include <unistd.h>
++#include <syslog.h>
++#include <fcntl.h>
++#include <sys/socket.h>
++#include <netinet/in.h>
++#include <arpa/inet.h>
++#include <string.h>
++#include "utils.h"
++#include "tc_util.h"
++#include "tc_common.h"
++#include <linux/tc_act/tc_nssmirred.h>
++
++/*
++ * explain()
++ *	API to print the explaination of nssmirred action statement's
++ *	elements.
++ */
++static void explain(void)
++{
++	fprintf(stderr, "Usage: nssmirred redirect <dev TO_DEVICENAME fromdev FROM_DEVICENAME> \n");
++	fprintf(stderr, "where: \n");
++	fprintf(stderr, "\tTO_DEVICENAME is the devicename to redirect to\n");
++	fprintf(stderr, "\tFROM_DEVICENAME is the devicename to redirect from\n");
++}
++
++/*
++ * usage()
++ *	API to show the usage of the nssmirred action.
++ */
++static void usage(void)
++{
++	explain();
++	exit(-1);
++}
++
++/*
++ * parse_nss_mirred()
++ *	Parse and validate the nssmirred action statement.
++ */
++static int parse_nss_mirred(struct action_util *a, int *argc_p, char ***argv_p,
++	     int tca_id, struct nlmsghdr *n)
++{
++	int idx, argc = *argc_p;
++	char **argv = *argv_p;
++	struct tc_nss_mirred p;
++	struct rtattr *tail;
++
++	if (argc < 0) {
++		fprintf(stderr, "nssmirred bad argument count %d. Try option \"help\"\n", argc);
++		goto error;
++	}
++
++	if (matches(*argv, "nssmirred")) {
++		fprintf(stderr, "nssmirred bad argument %s. Try option \"help\"\n", *argv);
++		goto error;
++	}
++
++	NEXT_ARG();
++	if (!matches(*argv, "help")) {
++		usage();
++	}
++
++	if (matches(*argv, "redirect")) {
++		fprintf(stderr, "nssmirred bad argument %s. Try option \"help\"\n", *argv);
++		goto error;
++	}
++
++	NEXT_ARG();
++	if (matches(*argv, "dev")) {
++		fprintf(stderr, "nssmirred: bad value %s. Try option \"help\"\n", *argv);
++		goto error;
++	}
++
++	NEXT_ARG();
++	memset(&p, 0, sizeof(struct tc_nss_mirred));
++	if ((idx = ll_name_to_index(*argv)) == 0) {
++		fprintf(stderr, "Cannot find to device \"%s\"\n", *argv);
++		goto error;
++	}
++
++	p.to_ifindex = idx;
++	NEXT_ARG();
++	if (matches(*argv, "fromdev")) {
++		fprintf(stderr, "nssmirred: bad value %s. Try option \"help\"\n", *argv);
++		goto error;
++	}
++
++	NEXT_ARG();
++	if ((idx = ll_name_to_index(*argv)) == 0) {
++		fprintf(stderr, "Cannot find from device \"%s\"\n", *argv);
++		goto error;
++	}
++
++	p.from_ifindex = idx;
++	p.action = TC_ACT_STOLEN;
++	tail = NLMSG_TAIL(n);
++	addattr_l(n, MAX_MSG, tca_id, NULL, 0);
++	addattr_l(n, MAX_MSG, TCA_NSS_MIRRED_PARMS, &p, sizeof (p));
++	tail->rta_len = (void *) NLMSG_TAIL(n) - (void *) tail;
++	argc--;
++	argv++;
++	*argc_p = argc;
++	*argv_p = argv;
++	return 0;
++
++error:
++	return -1;
++}
++
++/*
++ * print_nss_mirred()
++ *	Print information related to nssmirred action.
++ */
++static int print_nss_mirred(struct action_util *au, FILE * f, struct rtattr *arg)
++{
++	struct tc_nss_mirred *p;
++	struct rtattr *tb[TCA_NSS_MIRRED_MAX + 1];
++	const char *from_dev, *to_dev;
++
++	if (arg == NULL) {
++		return -1;
++	}
++
++	parse_rtattr_nested(tb, TCA_NSS_MIRRED_MAX, arg);
++
++	if (tb[TCA_NSS_MIRRED_PARMS] == NULL) {
++		fprintf(f, "[NULL nssmirred parameters]");
++		goto error;
++	}
++
++	p = RTA_DATA(tb[TCA_NSS_MIRRED_PARMS]);
++	if ((from_dev = ll_index_to_name(p->from_ifindex)) == 0) {
++		fprintf(stderr, "Invalid interface (index: %d)\n", p->from_ifindex);
++		goto error;
++	}
++
++	if ((to_dev = ll_index_to_name(p->to_ifindex)) == 0) {
++		fprintf(stderr, "Invalid interface (index: %d)\n", p->to_ifindex);
++		goto error;
++	}
++
++	fprintf(f, "nssmirred (%s to device %s) stolen\n", from_dev, to_dev);
++	fprintf(f, "\tindex %d ref %d bind %d\n",p->index,p->refcnt,p->bindcnt);
++
++	if (show_stats) {
++		if (tb[TCA_NSS_MIRRED_TM]) {
++			struct tcf_t *tm = RTA_DATA(tb[TCA_NSS_MIRRED_TM]);
++			print_tm(f,tm);
++		}
++	}
++	return 0;
++
++error:
++	return -1;
++}
++
++/*
++ * nssmirred_action_util
++ *	nssmirred action utility structure.
++ */
++struct action_util nssmirred_action_util = {
++	.id = "nssmirred",
++	.parse_aopt = parse_nss_mirred,
++	.print_aopt = print_nss_mirred,
++};
+--- /dev/null
++++ b/include/linux/tc_act/tc_nssmirred.h
+@@ -0,0 +1,44 @@
++/*
++ **************************************************************************
++ * Copyright (c) 2019 The Linux Foundation. All rights reserved.
++ * Permission to use, copy, modify, and/or distribute this software for
++ * any purpose with or without fee is hereby granted, provided that the
++ * above copyright notice and this permission notice appear in all copies.
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
++ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
++ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
++ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ **************************************************************************
++ */
++
++#ifndef __LINUX_TC_NSS_MIR_H
++#define __LINUX_TC_NSS_MIR_H
++
++#include <linux/types.h>
++#include <linux/pkt_cls.h>
++
++/*
++ * tc_nss_mirred
++ *	Structure for nssmirred action.
++ */
++struct tc_nss_mirred {
++	tc_gen;
++	__u32                   from_ifindex;  /* ifindex of the port to be redirected from */
++	__u32                   to_ifindex;  /* ifindex of the port to be redirected to */
++};
++
++/*
++ * Types of nssmirred action parameters.
++ */
++enum {
++	TCA_NSS_MIRRED_UNSPEC,
++	TCA_NSS_MIRRED_TM,
++	TCA_NSS_MIRRED_PARMS,
++	__TCA_NSS_MIRRED_MAX
++};
++#define TCA_NSS_MIRRED_MAX (__TCA_NSS_MIRRED_MAX - 1)
++
++#endif	/* __LINUX_TC_NSS_MIR_H */

From ed5493ca637358276c3b5ce53b01e9d9806a308c Mon Sep 17 00:00:00 2001
From: bitthief <bitthief@protonmail.ch>
Date: Tue, 18 Jul 2023 02:01:58 +0300
Subject: [PATCH 078/225] qualcommax: dts: add NSS nodes to IPQ807x devices

Signed-off-by: bitthief <bitthief@protonmail.ch>

qualcommax: dts: provide label for NSS reserved-memory

Provide a label for the NSS reserved-memory node so it can be easily passed
to the NSS DRV instead of having to global match by name which is fragile.

Signed-off-by: bitthief <bitthief@protonmail.ch>
---
 .../arm64/boot/dts/qcom/ipq8070-cax1800.dts   |   1 +
 .../arm64/boot/dts/qcom/ipq8071-ax3600.dtsi   |   1 +
 .../arm64/boot/dts/qcom/ipq8071-eap102.dts    |   1 +
 .../arch/arm64/boot/dts/qcom/ipq8072-301w.dts |   1 +
 .../arm64/boot/dts/qcom/ipq8072-ax9000.dts    |   1 +
 .../arm64/boot/dts/qcom/ipq8072-dl-wrx36.dts  |   1 +
 .../arch/arm64/boot/dts/qcom/ipq8072-haze.dts |   1 +
 .../arm64/boot/dts/qcom/ipq8072-wax218.dts    |   1 +
 .../arm64/boot/dts/qcom/ipq8072-wax620.dts    |   1 +
 .../arm64/boot/dts/qcom/ipq8072-wpq873.dts    |   1 +
 .../arm64/boot/dts/qcom/ipq8074-nbg7815.dts   |   1 +
 .../arch/arm64/boot/dts/qcom/ipq8074-nss.dtsi | 271 ++++++++++++++++++
 .../arm64/boot/dts/qcom/ipq8074-rax120v2.dts  |   1 +
 .../arm64/boot/dts/qcom/ipq8074-wax630.dts    |   1 +
 .../boot/dts/qcom/ipq8074-wxr-5950ax12.dts    |   1 +
 ...ts-ipq8074-add-reserved-memory-nodes.patch |   6 +-
 16 files changed, 288 insertions(+), 3 deletions(-)
 create mode 100644 target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-nss.dtsi

diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8070-cax1800.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8070-cax1800.dts
index e62ae314fb5d82..4359c3d5b1c8fd 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8070-cax1800.dts
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8070-cax1800.dts
@@ -6,6 +6,7 @@
 #include "ipq8074-512m.dtsi"
 #include "ipq8074-ac-cpu.dtsi"
 #include "ipq8074-ess.dtsi"
+#include "ipq8074-nss.dtsi"
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8071-ax3600.dtsi b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8071-ax3600.dtsi
index 6afafb35546e00..c2c5f4ce8362c0 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8071-ax3600.dtsi
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8071-ax3600.dtsi
@@ -4,6 +4,7 @@
 #include "ipq8074-512m.dtsi"
 #include "ipq8074-ac-cpu.dtsi"
 #include "ipq8074-ess.dtsi"
+#include "ipq8074-nss.dtsi"
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8071-eap102.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8071-eap102.dts
index f8fe6b42f80893..bcf028522009d9 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8071-eap102.dts
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8071-eap102.dts
@@ -6,6 +6,7 @@
 #include "ipq8074.dtsi"
 #include "ipq8074-ac-cpu.dtsi"
 #include "ipq8074-ess.dtsi"
+#include "ipq8074-nss.dtsi"
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/leds/common.h>
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-301w.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-301w.dts
index 2fe723591e77f4..0c80020cd1b373 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-301w.dts
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-301w.dts
@@ -6,6 +6,7 @@
 #include "ipq8074.dtsi"
 #include "ipq8074-hk-cpu.dtsi"
 #include "ipq8074-ess.dtsi"
+#include "ipq8074-nss.dtsi"
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/leds/common.h>
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-ax9000.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-ax9000.dts
index ec66d47d16a93f..fe5a1367226177 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-ax9000.dts
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-ax9000.dts
@@ -6,6 +6,7 @@
 #include "ipq8074.dtsi"
 #include "ipq8074-hk-cpu.dtsi"
 #include "ipq8074-ess.dtsi"
+#include "ipq8074-nss.dtsi"
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/leds/common.h>
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-dl-wrx36.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-dl-wrx36.dts
index c5c089c00f7dd4..24dd51b47fc585 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-dl-wrx36.dts
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-dl-wrx36.dts
@@ -6,6 +6,7 @@
 #include "ipq8074.dtsi"
 #include "ipq8074-hk-cpu.dtsi"
 #include "ipq8074-ess.dtsi"
+#include "ipq8074-nss.dtsi"
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/leds/common.h>
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-haze.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-haze.dts
index 289680d678be07..3c63c0b00350bc 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-haze.dts
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-haze.dts
@@ -5,6 +5,7 @@
 #include "ipq8074.dtsi"
 #include "ipq8074-hk-cpu.dtsi"
 #include "ipq8074-ess.dtsi"
+#include "ipq8074-nss.dtsi"
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/leds/common.h>
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-wax218.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-wax218.dts
index 0e71faea72a220..2c1e0f5e472fdb 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-wax218.dts
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-wax218.dts
@@ -3,6 +3,7 @@
 #include "ipq8074.dtsi"
 #include "ipq8074-hk-cpu.dtsi"
 #include "ipq8074-ess.dtsi"
+#include "ipq8074-nss.dtsi"
 
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/leds/common.h>
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-wax620.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-wax620.dts
index f410f79495ef18..5762899889d126 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-wax620.dts
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-wax620.dts
@@ -5,6 +5,7 @@
 #include "ipq8074.dtsi"
 #include "ipq8074-hk-cpu.dtsi"
 #include "ipq8074-ess.dtsi"
+#include "ipq8074-nss.dtsi"
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/gpio/gpio.h>
 
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-wpq873.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-wpq873.dts
index 5b2c1d570fd943..ebc68e15a840e1 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-wpq873.dts
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-wpq873.dts
@@ -6,6 +6,7 @@
 #include "ipq8074.dtsi"
 #include "ipq8074-hk-cpu.dtsi"
 #include "ipq8074-ess.dtsi"
+#include "ipq8074-nss.dtsi"
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/leds/common.h>
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-nbg7815.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-nbg7815.dts
index b18f38cc6cf4dc..1390b3a286b166 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-nbg7815.dts
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-nbg7815.dts
@@ -9,6 +9,7 @@
 #include "ipq8074.dtsi"
 #include "ipq8074-hk-cpu.dtsi"
 #include "ipq8074-ess.dtsi"
+#include "ipq8074-nss.dtsi"
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/leds/common.h>
 #include <dt-bindings/input/input.h>
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-nss.dtsi b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-nss.dtsi
new file mode 100644
index 00000000000000..d85a37230a0e04
--- /dev/null
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-nss.dtsi
@@ -0,0 +1,271 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+/ {
+	nss_dummy_reg: nss-regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "nss-reg";
+		regulator-min-microvolt = <848000>;
+		regulator-max-microvolt = <848000>;
+		regulator-always-on;
+		regulator-boot-on;
+	};
+};
+
+&soc {
+	nss-common {
+		compatible = "qcom,nss-common";
+		reg = <0x01868010 0x1000>;
+		reg-names = "nss-misc-reset";
+		memory-region = <&nss_region>;
+	};
+
+	nss0: nss@40000000 {
+		compatible = "qcom,nss";
+		interrupts = <GIC_SPI 377 IRQ_TYPE_EDGE_RISING>,
+			     	 <GIC_SPI 378 IRQ_TYPE_EDGE_RISING>,
+			     	 <GIC_SPI 379 IRQ_TYPE_EDGE_RISING>,
+			     	 <GIC_SPI 380 IRQ_TYPE_EDGE_RISING>,
+			     	 <GIC_SPI 381 IRQ_TYPE_EDGE_RISING>,
+			     	 <GIC_SPI 382 IRQ_TYPE_EDGE_RISING>,
+			     	 <GIC_SPI 383 IRQ_TYPE_EDGE_RISING>,
+			     	 <GIC_SPI 384 IRQ_TYPE_EDGE_RISING>,
+			     	 <GIC_SPI 385 IRQ_TYPE_EDGE_RISING>,
+			     	 <GIC_SPI 386 IRQ_TYPE_EDGE_RISING>;
+		reg = <0x39000000 0x1000>,
+		      <0x38000000 0x30000>,
+		      <0x0b111000 0x1000>;
+		reg-names = "nphys", "vphys", "qgic-phys";
+		clocks = <&gcc GCC_NSS_NOC_CLK>,
+			 	 <&gcc GCC_NSS_PTP_REF_CLK>,
+			 	 <&gcc GCC_NSS_CSR_CLK>,
+				 <&gcc GCC_NSS_CFG_CLK>,
+			 	 <&gcc GCC_NSS_IMEM_CLK>,
+			 	 <&gcc GCC_NSSNOC_QOSGEN_REF_CLK>,
+			 	 <&gcc GCC_MEM_NOC_NSS_AXI_CLK>,
+			 	 <&gcc GCC_NSSNOC_SNOC_CLK>,
+			 	 <&gcc GCC_NSSNOC_TIMEOUT_REF_CLK>,
+			 	 <&gcc GCC_NSS_CE_AXI_CLK>,
+			 	 <&gcc GCC_NSS_CE_APB_CLK>,
+			 	 <&gcc GCC_NSSNOC_CE_AXI_CLK>,
+			 	 <&gcc GCC_NSSNOC_CE_APB_CLK>,
+			 	 <&gcc GCC_NSSNOC_UBI0_AHB_CLK>,
+			 	 <&gcc GCC_UBI0_CORE_CLK>,
+			 	 <&gcc GCC_UBI0_AHB_CLK>,
+			 	 <&gcc GCC_UBI0_AXI_CLK>,
+			 	 <&gcc GCC_UBI0_MPT_CLK>,
+			 	 <&gcc GCC_UBI0_NC_AXI_CLK>;
+		clock-names = "nss-noc-clk",
+					  "nss-ptp-ref-clk",
+			      	  "nss-csr-clk",
+					  "nss-cfg-clk",
+					  "nss-imem-clk",
+					  "nss-nssnoc-qosgen-ref-clk",
+					  "nss-mem-noc-nss-axi-clk",
+					  "nss-nssnoc-snoc-clk",
+					  "nss-nssnoc-timeout-ref-clk",
+					  "nss-ce-axi-clk",
+					  "nss-ce-apb-clk",
+					  "nss-nssnoc-ce-axi-clk",
+					  "nss-nssnoc-ce-apb-clk",
+					  "nss-nssnoc-ahb-clk",
+					  "nss-core-clk",
+					  "nss-ahb-clk",
+					  "nss-axi-clk",
+					  "nss-mpt-clk",
+					  "nss-nc-axi-clk";
+		qcom,id = <0>;
+		qcom,num-queue = <4>;
+		qcom,num-irq = <10>;
+		qcom,num-pri = <4>;
+		qcom,load-addr = <0x40000000>;
+		qcom,low-frequency = <187200000>;
+		qcom,mid-frequency = <748800000>;
+		qcom,max-frequency = <1689600000>;
+		qcom,bridge-enabled;
+		qcom,ipv4-enabled;
+		qcom,ipv4-reasm-enabled;
+		qcom,ipv6-enabled;
+		qcom,ipv6-reasm-enabled;
+		qcom,wlanredirect-enabled;
+		qcom,tun6rd-enabled;
+		qcom,l2tpv2-enabled;
+		qcom,gre-enabled;
+		qcom,gre-redir-enabled;
+		qcom,gre-redir-mark-enabled;
+		qcom,map-t-enabled;
+		qcom,portid-enabled;
+		qcom,ppe-enabled;
+		qcom,pppoe-enabled;
+		qcom,pptp-enabled;
+		qcom,tunipip6-enabled;
+		qcom,shaping-enabled;
+		qcom,wlan-dataplane-offload-enabled;
+		qcom,vlan-enabled;
+		qcom,igs-enabled;
+		qcom,vxlan-enabled;
+		qcom,match-enabled;
+		qcom,mirror-enabled;
+		qcom,udp-st-enabled;
+		mx-supply = <&nss_dummy_reg>;
+		npu-supply = <&nss_dummy_reg>;
+	};
+
+	nss1: nss@40800000 {
+		compatible = "qcom,nss";
+		interrupts = <GIC_SPI 390 IRQ_TYPE_EDGE_RISING>,
+					 <GIC_SPI 391 IRQ_TYPE_EDGE_RISING>,
+					 <GIC_SPI 392 IRQ_TYPE_EDGE_RISING>,
+					 <GIC_SPI 393 IRQ_TYPE_EDGE_RISING>,
+					 <GIC_SPI 394 IRQ_TYPE_EDGE_RISING>,
+					 <GIC_SPI 395 IRQ_TYPE_EDGE_RISING>,
+					 <GIC_SPI 396 IRQ_TYPE_EDGE_RISING>,
+					 <GIC_SPI 397 IRQ_TYPE_EDGE_RISING>,
+					 <GIC_SPI 398 IRQ_TYPE_EDGE_RISING>;
+		reg = <0x39400000 0x1000>,
+		      <0x38030000 0x30000>,
+		      <0x0b111000 0x1000>;
+		reg-names = "nphys", "vphys", "qgic-phys";
+		clocks = <&gcc GCC_NSS_NOC_CLK>,
+				 <&gcc GCC_NSS_PTP_REF_CLK>,
+				 <&gcc GCC_NSS_CSR_CLK>,
+				 <&gcc GCC_NSS_CFG_CLK>,
+				 <&gcc GCC_NSS_IMEM_CLK>,
+				 <&gcc GCC_NSSNOC_QOSGEN_REF_CLK>,
+				 <&gcc GCC_MEM_NOC_NSS_AXI_CLK>,
+				 <&gcc GCC_NSSNOC_SNOC_CLK>,
+				 <&gcc GCC_NSSNOC_TIMEOUT_REF_CLK>,
+				 <&gcc GCC_NSS_CE_AXI_CLK>,
+				 <&gcc GCC_NSS_CE_APB_CLK>,
+				 <&gcc GCC_NSSNOC_CE_AXI_CLK>,
+				 <&gcc GCC_NSSNOC_CE_APB_CLK>,
+				 <&gcc GCC_NSSNOC_UBI1_AHB_CLK>,
+				 <&gcc GCC_UBI1_CORE_CLK>,
+				 <&gcc GCC_UBI1_AHB_CLK>,
+				 <&gcc GCC_UBI1_AXI_CLK>,
+				 <&gcc GCC_UBI1_MPT_CLK>,
+				 <&gcc GCC_UBI1_NC_AXI_CLK>;
+		clock-names = "nss-noc-clk",
+					  "nss-ptp-ref-clk",
+					  "nss-csr-clk",
+					  "nss-cfg-clk",
+					  "nss-imem-clk",
+					  "nss-nssnoc-qosgen-ref-clk",
+					  "nss-mem-noc-nss-axi-clk",
+					  "nss-nssnoc-snoc-clk",
+					  "nss-nssnoc-timeout-ref-clk",
+					  "nss-ce-axi-clk",
+					  "nss-ce-apb-clk",
+					  "nss-nssnoc-ce-axi-clk",
+					  "nss-nssnoc-ce-apb-clk",
+					  "nss-nssnoc-ahb-clk",
+					  "nss-core-clk",
+					  "nss-ahb-clk",
+					  "nss-axi-clk",
+					  "nss-mpt-clk",
+					  "nss-nc-axi-clk";
+		qcom,id = <1>;
+		qcom,num-queue = <4>;
+		qcom,num-irq = <9>;
+		qcom,num-pri = <4>;
+		qcom,load-addr = <0x40800000>;
+		qcom,capwap-enabled;
+		qcom,dtls-enabled;
+		qcom,tls-enabled;
+		qcom,crypto-enabled;
+		qcom,ipsec-enabled;
+		qcom,qvpn-enabled;
+		qcom,pvxlan-enabled;
+		qcom,clmap-enabled;
+		qcom,rmnet_rx-enabled;
+	};
+
+	nss_crypto: qcom,nss_crypto {
+		compatible = "qcom,nss-crypto";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		qcom,max-contexts = <64>;
+		qcom,max-context-size = <32>;
+		ranges;
+
+		eip197_node {
+			compatible = "qcom,eip197";
+			reg-names = "crypto_pbase";
+			reg = <0x39800000 0x7ffff>;
+			clocks = <&gcc GCC_NSS_CRYPTO_CLK>,
+				 	 <&gcc GCC_NSSNOC_CRYPTO_CLK>,
+				 	 <&gcc GCC_CRYPTO_PPE_CLK>;
+			clock-names = "crypto_clk",
+				      	  "crypto_nocclk",
+				      	  "crypto_ppeclk";
+			clock-frequency = /bits/ 64 <600000000 600000000 300000000>;
+			qcom,dma-mask = <0xff>;
+			qcom,transform-enabled;
+			qcom,aes128-cbc;
+			qcom,aes192-cbc;
+			qcom,aes256-cbc;
+			qcom,aes128-ctr;
+			qcom,aes192-ctr;
+			qcom,aes256-ctr;
+			qcom,aes128-ecb;
+			qcom,aes192-ecb;
+			qcom,aes256-ecb;
+			qcom,3des-cbc;
+			qcom,md5-hash;
+			qcom,sha160-hash;
+			qcom,sha224-hash;
+			qcom,sha384-hash;
+			qcom,sha512-hash;
+			qcom,sha256-hash;
+			qcom,md5-hmac;
+			qcom,sha160-hmac;
+			qcom,sha224-hmac;
+			qcom,sha256-hmac;
+			qcom,sha384-hmac;
+			qcom,sha512-hmac;
+			qcom,aes128-gcm-gmac;
+			qcom,aes192-gcm-gmac;
+			qcom,aes256-gcm-gmac;
+			qcom,aes128-cbc-md5-hmac;
+			qcom,aes128-cbc-sha160-hmac;
+			qcom,aes192-cbc-md5-hmac;
+			qcom,aes192-cbc-sha160-hmac;
+			qcom,aes256-cbc-md5-hmac;
+			qcom,aes256-cbc-sha160-hmac;
+			qcom,aes128-ctr-sha160-hmac;
+			qcom,aes192-ctr-sha160-hmac;
+			qcom,aes256-ctr-sha160-hmac;
+			qcom,aes128-ctr-md5-hmac;
+			qcom,aes192-ctr-md5-hmac;
+			qcom,aes256-ctr-md5-hmac;
+			qcom,3des-cbc-md5-hmac;
+			qcom,3des-cbc-sha160-hmac;
+			qcom,aes128-cbc-sha256-hmac;
+			qcom,aes192-cbc-sha256-hmac;
+			qcom,aes256-cbc-sha256-hmac;
+			qcom,aes128-ctr-sha256-hmac;
+			qcom,aes192-ctr-sha256-hmac;
+			qcom,aes256-ctr-sha256-hmac;
+			qcom,3des-cbc-sha256-hmac;
+			qcom,aes128-cbc-sha384-hmac;
+			qcom,aes192-cbc-sha384-hmac;
+			qcom,aes256-cbc-sha384-hmac;
+			qcom,aes128-ctr-sha384-hmac;
+			qcom,aes192-ctr-sha384-hmac;
+			qcom,aes256-ctr-sha384-hmac;
+			qcom,aes128-cbc-sha512-hmac;
+			qcom,aes192-cbc-sha512-hmac;
+			qcom,aes256-cbc-sha512-hmac;
+			qcom,aes128-ctr-sha512-hmac;
+			qcom,aes192-ctr-sha512-hmac;
+			qcom,aes256-ctr-sha512-hmac;
+
+			engine0 {
+				reg_offset = <0x80000>;
+				qcom,ifpp-enabled;
+				qcom,ipue-enabled;
+				qcom,ofpp-enabled;
+				qcom,opue-enabled;
+			};
+		};
+	};
+};
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-rax120v2.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-rax120v2.dts
index 36e315cc8078bd..5331f985875dc7 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-rax120v2.dts
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-rax120v2.dts
@@ -4,6 +4,7 @@
 
 #include "ipq8074.dtsi"
 #include "ipq8074-ess.dtsi"
+#include "ipq8074-nss.dtsi"
 #include "ipq8074-hk-cpu.dtsi"
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/gpio/gpio.h>
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-wax630.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-wax630.dts
index 3393efd7b550f3..d241ae642acbac 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-wax630.dts
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-wax630.dts
@@ -5,6 +5,7 @@
 #include "ipq8074.dtsi"
 #include "ipq8074-hk-cpu.dtsi"
 #include "ipq8074-ess.dtsi"
+#include "ipq8074-nss.dtsi"
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/leds/common.h>
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-wxr-5950ax12.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-wxr-5950ax12.dts
index 347bb6e8abe539..5f463b6c62e2cc 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-wxr-5950ax12.dts
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-wxr-5950ax12.dts
@@ -5,6 +5,7 @@
 #include "ipq8074.dtsi"
 #include "ipq8074-hk-cpu.dtsi"
 #include "ipq8074-ess.dtsi"
+#include "ipq8074-nss.dtsi"
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/leds/common.h>
 #include <dt-bindings/input/input.h>
diff --git a/target/linux/qualcommax/patches-6.6/0102-arm64-dts-ipq8074-add-reserved-memory-nodes.patch b/target/linux/qualcommax/patches-6.6/0102-arm64-dts-ipq8074-add-reserved-memory-nodes.patch
index 6d97641f658cc1..64f8da87aadedb 100644
--- a/target/linux/qualcommax/patches-6.6/0102-arm64-dts-ipq8074-add-reserved-memory-nodes.patch
+++ b/target/linux/qualcommax/patches-6.6/0102-arm64-dts-ipq8074-add-reserved-memory-nodes.patch
@@ -22,8 +22,8 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
 @@ -86,6 +86,16 @@
  		#size-cells = <2>;
  		ranges;
- 
-+		nss@40000000 {
+
++		nss_region: nss@40000000 {
 +			no-map;
 +			reg = <0x0 0x40000000 0x0 0x01000000>;
 +		};
@@ -56,5 +56,5 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
 +			reg = <0x0 0x51000000 0x0 0x100000>;
 +		};
  	};
- 
+
  	firmware {

From 5e9f04d1b4ea602da919e5e085cb97dd55d3e4e3 Mon Sep 17 00:00:00 2001
From: bitthief <bitthief@protonmail.ch>
Date: Tue, 18 Jul 2023 01:24:45 +0300
Subject: [PATCH 079/225] qualcommax: net: QCA NSS igs support

Signed-off-by: bitthief <bitthief@protonmail.ch>
---
 .../include/uapi/linux/tc_act/tc_nss_mirred.h | 36 +++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 target/linux/qualcommax/files/include/uapi/linux/tc_act/tc_nss_mirred.h

diff --git a/target/linux/qualcommax/files/include/uapi/linux/tc_act/tc_nss_mirred.h b/target/linux/qualcommax/files/include/uapi/linux/tc_act/tc_nss_mirred.h
new file mode 100644
index 00000000000000..3a368fcc8c17ee
--- /dev/null
+++ b/target/linux/qualcommax/files/include/uapi/linux/tc_act/tc_nss_mirred.h
@@ -0,0 +1,36 @@
+#ifndef __LINUX_TC_NSS_MIRRED_H
+#define __LINUX_TC_NSS_MIRRED_H
+
+#include <linux/pkt_cls.h>
+
+/*
+ * Type of nss mirred action.
+ */
+#define TCA_ACT_MIRRED_NSS 17
+
+/*
+ * Types of parameters for nss mirred action.
+ */
+enum {
+	TC_NSS_MIRRED_UNSPEC,
+	TC_NSS_MIRRED_TM,
+	TC_NSS_MIRRED_PARMS,
+	__TC_NSS_MIRRED_MAX
+};
+#define TC_NSS_MIRRED_MAX (__TC_NSS_MIRRED_MAX - 1)
+
+/*
+ * tc_nss_mirred
+ *	tc command structure for nss mirred action.
+ */
+struct tc_nss_mirred {
+	tc_gen;			/* General tc structure. */
+	__u32 from_ifindex;	/* ifindex of the port from which traffic
+				 * will be redirected.
+				 */
+	__u32 to_ifindex;	/* ifindex of the port to which traffic
+				 * will be redirected.
+				 */
+};
+
+#endif	/* __LINUX_TC_NSS_MIRRED_H */

From c8ed4895073b69120d5060b779f7116540e7ab64 Mon Sep 17 00:00:00 2001
From: bitthief <bitthief@protonmail.ch>
Date: Tue, 18 Jul 2023 01:25:01 +0300
Subject: [PATCH 080/225] qualcommax: net: QCA NSS qdisc ifb support

Signed-off-by: bitthief <bitthief@protonmail.ch>
---
 .../netfilter/nf_conntrack_dscpremark_ext.h   | 95 +++++++++++++++++++
 .../netfilter/nf_conntrack_dscpremark_ext.c   | 61 ++++++++++++
 2 files changed, 156 insertions(+)
 create mode 100644 target/linux/qualcommax/files/include/net/netfilter/nf_conntrack_dscpremark_ext.h
 create mode 100644 target/linux/qualcommax/files/net/netfilter/nf_conntrack_dscpremark_ext.c

diff --git a/target/linux/qualcommax/files/include/net/netfilter/nf_conntrack_dscpremark_ext.h b/target/linux/qualcommax/files/include/net/netfilter/nf_conntrack_dscpremark_ext.h
new file mode 100644
index 00000000000000..dc6a5004ef6d7a
--- /dev/null
+++ b/target/linux/qualcommax/files/include/net/netfilter/nf_conntrack_dscpremark_ext.h
@@ -0,0 +1,95 @@
+/*
+ **************************************************************************
+ * Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022, Qualcomm Innovation Center, Inc. All rights reserved.
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all copies.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ **************************************************************************
+ */
+
+/* DSCP remark conntrack extension APIs. */
+
+#ifndef _NF_CONNTRACK_DSCPREMARK_H
+#define _NF_CONNTRACK_DSCPREMARK_H
+
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_extend.h>
+
+/* Rule flags */
+#define NF_CT_DSCPREMARK_EXT_DSCP_RULE_VALID 0x1
+
+/* Rule validity */
+#define NF_CT_DSCPREMARK_EXT_RULE_VALID 0x1
+#define NF_CT_DSCPREMARK_EXT_RULE_NOT_VALID 0x0
+
+/* Which QoS features are set flags */
+#define NF_CT_DSCPREMARK_EXT_PRIO 0x1
+#define NF_CT_DSCPREMARK_EXT_DSCP 0x2
+#define NF_CT_DSCPREMARK_EXT_IGS_QOS 0x4
+#define NF_CT_DSCPREMARK_EXT_MARK 0x8
+
+/*
+ * DSCP remark conntrack extension structure.
+ */
+struct nf_ct_dscpremark_ext {
+	__u32 flow_priority;	/* Original direction packet priority */
+	__u32 reply_priority;	/* Reply direction packet priority */
+	__u32 flow_mark;	/* Original direction packet mark */
+	__u32 reply_mark;	/* Reply direction packet mark */
+	__u16 igs_flow_qos_tag;	/* Original direction ingress packet priority */
+	__u16 igs_reply_qos_tag;	/* Reply direction ingress packet priority */
+	__u8 flow_dscp;		/* IP DSCP value for original direction */
+	__u8 reply_dscp;	/* IP DSCP value for reply direction */
+	__u16 rule_flags;	/* Rule Validity flags */
+	__u16 flow_set_flags;	/* Original direction set flags */
+	__u16 return_set_flags;	/* Reply direction set flags */
+};
+
+/*
+ * nf_ct_dscpremark_ext_find()
+ *	Finds the extension data of the conntrack entry if it exists.
+ */
+static inline struct nf_ct_dscpremark_ext *
+nf_ct_dscpremark_ext_find(const struct nf_conn *ct)
+{
+#ifdef CONFIG_NF_CONNTRACK_DSCPREMARK_EXT
+	return nf_ct_ext_find(ct, NF_CT_EXT_DSCPREMARK);
+#else
+	return NULL;
+#endif
+}
+
+/*
+ * nf_ct_dscpremark_ext_add()
+ *	Adds the extension data to the conntrack entry.
+ */
+static inline
+struct nf_ct_dscpremark_ext *nf_ct_dscpremark_ext_add(struct nf_conn *ct,
+						      gfp_t gfp)
+{
+#ifdef CONFIG_NF_CONNTRACK_DSCPREMARK_EXT
+	struct nf_ct_dscpremark_ext *ncde;
+
+	ncde = nf_ct_ext_add(ct, NF_CT_EXT_DSCPREMARK, gfp);
+	if (!ncde)
+		return NULL;
+
+	return ncde;
+#else
+	return NULL;
+#endif
+};
+
+#ifdef CONFIG_NF_CONNTRACK_DSCPREMARK_EXT
+extern int nf_conntrack_dscpremark_ext_set_dscp_rule_valid(struct nf_conn *ct);
+extern int nf_conntrack_dscpremark_ext_get_dscp_rule_validity(struct nf_conn *ct);
+#endif /* CONFIG_NF_CONNTRACK_DSCPREMARK_EXT */
+#endif /* _NF_CONNTRACK_DSCPREMARK_H */
diff --git a/target/linux/qualcommax/files/net/netfilter/nf_conntrack_dscpremark_ext.c b/target/linux/qualcommax/files/net/netfilter/nf_conntrack_dscpremark_ext.c
new file mode 100644
index 00000000000000..678d27ac9df9c2
--- /dev/null
+++ b/target/linux/qualcommax/files/net/netfilter/nf_conntrack_dscpremark_ext.c
@@ -0,0 +1,61 @@
+/*
+ **************************************************************************
+ * Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all copies.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ **************************************************************************
+ */
+
+/* DSCP remark handling conntrack extension registration. */
+
+#include <linux/netfilter.h>
+#include <linux/slab.h>
+#include <linux/kernel.h>
+#include <linux/moduleparam.h>
+#include <linux/export.h>
+
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_extend.h>
+#include <net/netfilter/nf_conntrack_dscpremark_ext.h>
+
+/* nf_conntrack_dscpremark_ext_set_dscp_rule_valid()
+ *	Set DSCP rule validity flag in the extension
+ */
+int nf_conntrack_dscpremark_ext_set_dscp_rule_valid(struct nf_conn *ct)
+{
+	struct nf_ct_dscpremark_ext *ncde;
+
+	ncde = nf_ct_dscpremark_ext_find(ct);
+	if (!ncde)
+		return -1;
+
+	ncde->rule_flags = NF_CT_DSCPREMARK_EXT_DSCP_RULE_VALID;
+	return 0;
+}
+EXPORT_SYMBOL(nf_conntrack_dscpremark_ext_set_dscp_rule_valid);
+
+/* nf_conntrack_dscpremark_ext_get_dscp_rule_validity()
+ *	Check if the DSCP rule flag is valid from the extension
+ */
+int nf_conntrack_dscpremark_ext_get_dscp_rule_validity(struct nf_conn *ct)
+{
+	struct nf_ct_dscpremark_ext *ncde;
+
+	ncde = nf_ct_dscpremark_ext_find(ct);
+	if (!ncde)
+		return NF_CT_DSCPREMARK_EXT_RULE_NOT_VALID;
+
+	if (ncde->rule_flags & NF_CT_DSCPREMARK_EXT_DSCP_RULE_VALID)
+		return NF_CT_DSCPREMARK_EXT_RULE_VALID;
+
+	return NF_CT_DSCPREMARK_EXT_RULE_NOT_VALID;
+}
+EXPORT_SYMBOL(nf_conntrack_dscpremark_ext_get_dscp_rule_validity);

From a0f4a24a05b0598fba1a84efa2433f822387be2b Mon Sep 17 00:00:00 2001
From: Qosmio <datapronix@protonmail.com>
Date: Sat, 16 Dec 2023 18:09:40 -0500
Subject: [PATCH 081/225] ath11k-nss: Add NSS WiFi feature
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Attempt at getting NSS WiFi Offload working on kernel 6.1 (backport 6.5)

These patches are a mix of @ansuel branch for 5.15 (ipq807x-5.15-ecm-wifi)
https://github.com/Ansuel/openwrt/commit/3ecaee768e8d08d20eaf2a554eb2bf1da9bbf21b

And QUIC's upstream NSS patches on [NHSS.QSDK.12.4.5.r3](https://git.codelinaro.org/clo/qsdk/oss/system/feeds/wlan-open.git)
For the actual package setup (Makfiles,ath.mk) Qualcomm's branch is under 'wlan-open/NHSS.QSDK.12.4.5.r3'

Looks like they've swtiched to using backports 6.5-rc3, and figured to
use a mix of their patches on 'NHSS.QSDK.12.4.5.r3' (nss)
'wlan-open/NHSS.QSDK.12.4.5.r3' (syncing with openwrt main).

Booting with "nss_offload=1 frame_mode=2"

Logs show:
[   16.606282] WARNING: CPU: 2 PID: 3524 at ath11k_nss_tx+0x1d4/0x1e0 [ath11k]
[   16.611060] Modules linked in: ecm pppoe ppp_async nft_fib_inet nf_flow_table_inet ath11k_ahb ath11k pptp pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_objref nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_fullcone nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_compat nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack_netlink nf_conntrack mac80211 iptable_mangle iptable_filter ipt_REJECT ipt_ECN ip_tables cfg80211 xt_time xt_tcpudp xt_tcpmss xt_statistic xt_multiport xt_mark xt_mac xt_limit xt_length xt_hl xt_ecn xt_dscp xt_comment xt_TCPMSS xt_LOG xt_HL xt_DSCP xt_CLASSIFY x_tables wireguard slhc sch_cake qrtr_smd qrtr qmi_helpers nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv4 mhi libcrc32c libchacha20poly1305 compat sch_tbf sch_ingress sch_htb sch_hfsc em_u32 cls_u32 cls_route cls_matchall cls_fw cls_flow cls_basic act_skbedit act_mirred act_gact qca_nss_cfi_cryptoapi
[   16.611215]  qca_nss_crypto qca_nss_qdisc qca_nss_wifi_meshmgr qca_nss_gre ledtrig_usbport qca_mcs bonding ip6_gre ip_gre gre ifb nat46 nf_defrag_ipv6 sit qca_nss_drv ip6_tunnel tunnel6 tunnel4 nls_utf8 nls_iso8859_1 nls_cp437 vxlan seqiv michael_mic uas usb_storage leds_gpio xhci_plat_hcd xhci_pci xhci_hcd dwc3 dwc3_qcom qca_nss_dp qca_ssdk ramoops reed_solomon pstore gpio_button_hotplug ext4 mbcache jbd2 aquantia hwmon crc_ccitt crc32c_generic
[   16.721723] CPU: 2 PID: 3524 Comm: hostapd Not tainted 6.1.68 #0
[   16.743958] Hardware name: Dynalink DL-WRX36 (DT)
[   16.750032] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   16.754635] pc : ath11k_nss_tx+0x1d4/0x1e0 [ath11k]
[   16.761403] lr : ath11k_nss_tx+0x1bc/0x1e0 [ath11k]
[   16.766264] sp : ffffffc00b1db790
[   16.771122] x29: ffffffc00b1db790 x28: 0000000000000038 x27: 0000000000000000
[   16.774602] x26: ffffff8006dd7430 x25: ffffff8007ea9dc8 x24: 0000000060000012
[   16.781719] x23: ffffff8005c6a060 x22: ffffff8005c6a060 x21: ffffff80072f12d8
[   16.788837] x20: ffffff8007ea9dc8 x19: ffffff8006082800 x18: 0000000000000005
[   16.795957] x17: 6976312065707974 x16: 207061636e652062 x15: 6b73207874207373
[   16.803075] x14: ffffffc00a0dd518 x13: 000000000000018b x12: 000000000000018b
[   16.810192] x11: 00000000ffffffea x10: ffffffc00a135518 x9 : 0000000000000001
[   16.817310] x8 : 0000000000000001 x7 : 0000000000017fe8 x6 : c0000000ffffefff
[   16.824429] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
[   16.831547] x2 : ffffff80072f1370 x1 : 0000000000000000 x0 : 0000000000000001
[   16.838665] Call trace:
[   16.845774]  ath11k_nss_tx+0x1d4/0x1e0 [ath11k]
[   16.848035]  ath11k_mac_tx_mgmt_pending_free+0x3034/0x9600 [ath11k]
[   16.852551]  ieee80211_handle_wake_tx_queue+0x68/0xb10 [mac80211]
[   16.858801]  ieee80211_probereq_get+0xca4/0x11f0 [mac80211]
[   16.865049]  ieee80211_tx_prepare_skb+0x1dc/0x240 [mac80211]
[   16.870432]  ieee80211_xmit+0xcc/0x120 [mac80211]
[   16.876333]  __ieee80211_subif_start_xmit+0x2b8/0x380 [mac80211]
[   16.880937]  ieee80211_subif_start_xmit+0x40/0x3b0 [mac80211]
[   16.887013]  ieee80211_subif_start_xmit_8023+0xb8/0x430 [mac80211]
[   16.892656]  dev_hard_start_xmit+0x8c/0x110
[   16.898728]  __dev_queue_xmit+0x1f0/0xbc0
[   16.902808]  dev_queue_xmit+0x14/0x20
[   16.906975]  packet_sendmsg+0x768/0x1260
[   16.910620]  __sys_sendto+0xdc/0x140
[   16.914613]  __arm64_sys_sendto+0x28/0x40
[   16.918174]  invoke_syscall.constprop.0+0x5c/0x110
[   16.922081]  do_el0_svc+0x58/0x170
[   16.926765]  el0_svc+0x18/0x60
[   16.930149]  el0t_64_sync_handler+0x114/0x120
[   16.933190]  el0t_64_sync+0x174/0x178
[   16.933197] ---[ end trace 0000000000000000 ]---
[   16.933230] ath11k c000000.wifi: failed to transmit frame -22
[   17.041495] ath11k c000000.wifi: encap mismatch in nss tx skb encap type 1vif encap type 2
[   17.041578] ath11k c000000.wifi: failed to transmit frame -22

Which is confusing since the parameter is definitley set to '2'.
➤ cat /sys/module/ath11k/parameters/frame_mode
2

Booting with either "nss_offload=1 frame_mode=3" (RAW), or "nss_offload=1 frame_mode=1" (Native Wifi)
Results in:

[   15.644742] ath11k c000000.wifi: peer not found for nss peer delete
[   15.744742] ath11k c000000.wifi: peer not found for nss peer delete
[   15.745742] ath11k c000000.wifi: peer not found for nss peer delete
[   15.746682] ath11k c000000.wifi: peer not found for nss peer delete

Clients connect and then are immediately kicked off, stuck in a loop.

ath11k-nss: Wifi offloading working (unstable)

Wifi offloading seems to be working, however it is not stable. Logs will
initially show a lot of flooding.

```
[Sun Dec 17 02:43:25 2023] ath11k c000000.wifi: peer not found for nss peer delete
[Sun Dec 17 02:43:28 2023] ath11k c000000.wifi: peer not found for nss peer delete
[Sun Dec 17 02:43:30 2023] ath11k c000000.wifi: peer not found for nss peer delete
[Sun Dec 17 02:43:32 2023] ath11k c000000.wifi: peer not found for nss peer delete
[Sun Dec 17 02:43:34 2023] ath11k c000000.wifi: peer not found for nss peer delete
[Sun Dec 17 02:43:40 2023] ath11k c000000.wifi: peer not found for nss peer delete
[Sun Dec 17 02:43:41 2023] ath11k c000000.wifi: peer not found for nss peer delete
[Sun Dec 17 02:43:46 2023] ath11k c000000.wifi: peer not found for nss peer delete
```

But eventually ends up subsiding. Needs heavy testing...

ath11k_nss: Add mac address to debug `nss peer delete` warnings

also delete ath10k patch, and refresh.

ath11k_nss: FIX `nss peer delete` + encap errors

This should hopefullly fix the following errors:

```
[Sun Dec 24 22:03:21 2023] ath11k c000000.wifi: encap mismatch in nss tx skb encap type 1vif encap type 2
[Sun Dec 24 22:03:21 2023] ath11k c000000.wifi: failed to transmit frame -22
[Sun Dec 24 22:08:25 2023] ath11k c000000.wifi: encap mismatch in nss tx skb encap type 1vif encap type 2
[Sun Dec 24 22:08:25 2023] ath11k c000000.wifi: failed to transmit frame -22
```

Clients should also be able to switch between 2Ghz and 5Ghz AP, as well
as join using password (no longer required to boot with NSS off first,
connect the client to acquire PSK, and reboot back with nss wifi offload
enabled).

Uptime has been 5 hours and so far no issues.

ath11k_nss: Remove unecessary clang-tidy formatting

ath11k_nss: add 'debug_mode' flag quiet warnings

Will properly handle:
```
[Mon Dec 25 16:51:34 2023] ath11k c000000.wifi: encap mismatch in nss tx skb encap type 1 vif encap type 2
```

should take the path for native wifi encap

ath11k_nss: Rework depends, make `nss_redirect` optional

1.) Added a reworked `qca-nss-pbuf` init script from QSDK that will set sysctl
    NSS `n2hcfg` wifi options based on board type and available
    RAM.

2.) ath11k is fully capable of offloading wifi, it does not need
    mac80211 to create any NSS vifs. This lowers overhead and has actually
    shown considerable speed improvements for CPU programs on the router
    side (i.e. SMB). I believe ax3600's IoT (ath10k) would require it
    for offloading.

    I've added 2 new makemenu options, `MAC80211_NSS_SUPPORT` which enables
    NSS related features, and `MAC80211_NSS_REDIRECT` which provides the option to
    autoload the module on boot with `nss_redirect=1`.

3.) Reverted the option that deafulted `ATH11K_MEM_PROFILE_512M` to
    true. This was not required for platforms with 1GB or more memory
    (which is most of them). The default is 1GB. Select for platforms
    like Xiaomi AX3600.

ath11k_nss: remove requirement for '/sys/kernel/debug/ath11k'

ath11k_nss: set default values lower to avoid eating up memory

ath11k_nss: Add NSS VLAN support + improvements

1) tweaked qca-nss-pbuf script to better handle different board configs
2) added some QSDK NSS patches for dynamic vlan, WDS.
3) added QSDK fixes for beacon, and bt-coex

For devices that keep getting disconnected (mostly on 2G). It is
recommended to use the following settings for wifi. Change for your
country.

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'platform/soc/c000000.wifi'
	option band '5g'
	option txpower '24'
	option country 'PA'
	option channel '100'
	option htmode 'HE160'
	option cell_density '0'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'lan'
	option mode 'ap'
	option encryption 'psk2'
	option key 'SOME_PASSWORD'
	option ssid 'EXAMPLE_5G'
	option dtim_period '3'
	option max_inactivity '86400'
	option disassoc_low_ack '0'

config wifi-device 'radio1'
	option type 'mac80211'
	option path 'platform/soc/c000000.wifi+1'
	option band '2g'
	option htmode 'HT20'
	option channel '1'
	option txpower '36'
	option country 'PA'
	option cell_density '0'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option ssid 'EXAMPLE_2G'
	option encryption 'psk2'
	option key 'SOME_PASSWORD'
	option max_inactivity '86400'
	option dtim_period '3'
	option disassoc_low_ack '0'

WPA3 should be disabled, and left as WPA2. Experimenting with max_inactivity, dtim_period, and disassoc_low_ack to hopefully resolve the deauth disconnects.
---
 package/kernel/mac80211/Makefile              |   32 +-
 package/kernel/mac80211/ath.mk                |   33 +-
 .../mac80211/files/etc/init.d/qca-nss-pbuf    |   91 +
 ...th11k-fix-for-peer-memory-corruption.patch |   48 +
 ...dma-counter-increamenting-improperly.patch |   51 +
 ...nitor-crash-if-tx-offload-is-enabled.patch |   60 +
 .../107-ath11k-tid-counter-fix.patch          |   21 +
 .../113-ath11k-add-8023-undecap-support.patch |   55 +
 ...-adding-support-for-mgmt-frame-stats.patch |  292 ++
 ...-when-using-encapsulation-offloading.patch |   12 +
 ...91-ath11k-add-mgmt-and-data-ack-rssi.patch |   48 +
 .../199-001-mac80211-add-nss-support.patch    |  461 +++
 ...-ath11k_nss-add-nss-driver-interface.patch | 3020 +++++++++++++++++
 .../199-003-ath11k-add-nss-support.patch      | 1283 +++++++
 ...t-callback-when-hwencap-enable-in-st.patch |   35 +
 ...-ath11k-Add-support-for-dynamic-vlan.patch |   60 +
 ...th11k-Enable-512MB-profile-in-ath11k.patch |  332 ++
 ...07-mac80211-add-nss-redirect-support.patch |  268 ++
 .../211-ath11k-add-obss-pd-support.patch      |   56 +
 ...14-ath11k-qos-null-frame-tx-over-wmi.patch |  519 +++
 ...11k-Disable-rx_header-tlv-for-2K-SKB.patch |  906 +++++
 ...01-ath11k-account-tx-rx-packets-flow.patch |  494 +++
 ...-mac80211-account-tx-rx-packets-flow.patch |  369 ++
 ...th11k-Add-support-for-beacon-tx-mode.patch |   45 +
 ...80211-Add-support-for-beacon-tx-mode.patch |  159 +
 ...dd-provision-to-configure-rx-hashmap.patch |  208 ++
 ...dst-ring-descriptors-from-cacheable-.patch |  147 +
 ...ow-fast-rx-by-bypassing-stats-update.patch |  412 +++
 .../ath11k_nss/245-compilation_fix.patch      |  192 ++
 .../245-revert-dev-sw-netstats-txrx-add.patch |  145 +
 ...-nss-thread-priority-during-pdev_ini.patch |  109 +
 ...avoid-stack-corrupt-in-nwifi-undecap.patch |   11 +
 ...e-free-of-peer-rx_tid-during-reo-cmd.patch |   40 +
 ...-0005-mac80211-simple-tx-for-AP-mode.patch |   99 +
 ...1k-skip-status-ring-entry-processing.patch |  191 ++
 ...ccess-of-the-dma-buffer-back-to-dma-.patch |   28 +
 ...mac80211-fix-unconditional-sta-usage.patch |   50 +
 ...-fix-clear-peer-keys-during-disassoc.patch |   50 +
 ...-fix-tkip-encryption-traffic-failure.patch |   25 +
 ...-event-handler-support-for-link-desc.patch |   73 +
 ...unused-RX_FLAGS-from-mac80211_rx_fla.patch |   85 +
 .../640-006-mac80211-add-eht-radiotap.patch   |  506 +++
 ...ncapsulation-of-EAPOL-frames-if-OFFL.patch |  232 ++
 .../702-ath11k-fix-memory-leak-in-dp-rx.patch |   48 +
 ...-the-frame-to-driver-tx-ops-directly.patch |   74 +
 ...se-HW-checksum-offload-only-for-ethm.patch |  140 +
 .../patches/ath11k_nss/900-fix-build.patch    |  236 ++
 ...N-iftype-support-on-NSS-offload-case.patch |  206 ++
 ...load-changes-to-NSS-driver-interface.patch |  701 ++++
 ...-dynamic-VLAN-support-on-NSS-offload.patch |  102 +
 ...-support-on-NSS-offload-for-STA-mode.patch |  973 ++++++
 ...02-ath11k-add-HE-stats-in-peer-stats.patch |  777 +++++
 .../902-ath11k-add-btcoex-config.patch        |  612 ++++
 ...vdev-in-NSS-for-AP_VLAN-vif-handling.patch |  784 +++++
 ...pport-for-WDS-offload-in-NSS-offload.patch |  575 ++++
 ...dev-in-NSS-for-dynamic-VLAN-handling.patch |  213 ++
 ...-dynamic-VLAN-support-in-NSS-offload.patch |  557 +++
 .../patches-6.6/9999-add-btcoex-dts.patch     |   30 +
 58 files changed, 17376 insertions(+), 5 deletions(-)
 create mode 100755 package/kernel/mac80211/files/etc/init.d/qca-nss-pbuf
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/033-ath11k-fix-for-peer-memory-corruption.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/087-ath11k-fix-ul-ofdma-counter-increamenting-improperly.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/105-ath11k-fix-monitor-crash-if-tx-offload-is-enabled.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/107-ath11k-tid-counter-fix.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/113-ath11k-add-8023-undecap-support.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/142-ath11k-adding-support-for-mgmt-frame-stats.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/146-mac80211-enable-TKIP-when-using-encapsulation-offloading.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/191-ath11k-add-mgmt-and-data-ack-rssi.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/199-001-mac80211-add-nss-support.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/199-002-ath11k_nss-add-nss-driver-interface.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/199-003-ath11k-add-nss-support.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/199-mac80211-fix-xmit-callback-when-hwencap-enable-in-st.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Add-support-for-dynamic-vlan.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Enable-512MB-profile-in-ath11k.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/207-mac80211-add-nss-redirect-support.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/211-ath11k-add-obss-pd-support.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/214-ath11k-qos-null-frame-tx-over-wmi.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/234-001-ath11k-account-tx-rx-packets-flow.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/234-002-mac80211-account-tx-rx-packets-flow.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/235-001-ath11k-Add-support-for-beacon-tx-mode.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/235-002-mac80211-Add-support-for-beacon-tx-mode.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/237-002-ath11k-Add-provision-to-configure-rx-hashmap.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/237-003-ath11k-allocate-dst-ring-descriptors-from-cacheable-.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/245-compilation_fix.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/245-revert-dev-sw-netstats-txrx-add.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/311-ath11k-configure-nss-thread-priority-during-pdev_ini.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/318-ath11k-avoid-stack-corrupt-in-nwifi-undecap.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/319-ath11k-fix-double-free-of-peer-rx_tid-during-reo-cmd.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/335-0005-mac80211-simple-tx-for-AP-mode.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/336-ath11k-skip-status-ring-entry-processing.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/342-ath11k-provide-access-of-the-dma-buffer-back-to-dma-.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/342-mac80211-fix-unconditional-sta-usage.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/357-ath11k-fix-clear-peer-keys-during-disassoc.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/359-ath11k-fix-tkip-encryption-traffic-failure.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/376-ath11k-Add-nss-event-handler-support-for-link-desc.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/640-006-mac80211-add-eht-radiotap.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/702-ath11k-fix-memory-leak-in-dp-rx.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/718-e-mac80211-Deliver-the-frame-to-driver-tx-ops-directly.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/900-fix-build.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/902-000-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/902-001-ath11k-add-WDS-offload-changes-to-NSS-driver-interface.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/902-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/902-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/902-ath11k-add-HE-stats-in-peer-stats.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/902-ath11k-add-btcoex-config.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/903-002-ath11k-add-support-for-ext-vdev-in-NSS-for-AP_VLAN-vif-handling.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/903-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/904-002-ath11k-extend-ext-vdev-in-NSS-for-dynamic-VLAN-handling.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/904-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch
 create mode 100644 target/linux/qualcommax/patches-6.6/9999-add-btcoex-dts.patch

diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile
index 22cd0e97b41770..ad38b331c40e1b 100644
--- a/package/kernel/mac80211/Makefile
+++ b/package/kernel/mac80211/Makefile
@@ -36,6 +36,8 @@ PKG_CONFIG_DEPENDS:= \
 	CONFIG_PACKAGE_MAC80211_DEBUGFS \
 	CONFIG_PACKAGE_MAC80211_MESH \
 	CONFIG_PACKAGE_MAC80211_TRACING \
+	CONFIG_PACKAGE_MAC80211_NSS_SUPPORT \
+	CONFIG_PACKAGE_MAC80211_NSS_REDIRECT \
 	CONFIG_PACKAGE_IWLWIFI_DEBUG \
 	CONFIG_PACKAGE_IWLWIFI_DEBUGFS \
 	CONFIG_PACKAGE_RTLWIFI_DEBUG \
@@ -129,10 +131,15 @@ define KernelPackage/mac80211
   $(call KernelPackage/mac80211/Default)
   TITLE:=Linux 802.11 Wireless Networking Stack
   # +kmod-crypto-cmac is a runtime only dependency of net/mac80211/aes_cmac.c
-  DEPENDS+= +kmod-cfg80211 +kmod-crypto-cmac +kmod-crypto-ccm +kmod-crypto-gcm +hostapd-common
+  DEPENDS+= +kmod-cfg80211 +kmod-crypto-cmac +kmod-crypto-ccm +kmod-crypto-gcm +hostapd-common \
+  +ATH11K_NSS_SUPPORT:kmod-qca-nss-drv
   KCONFIG:=\
 	CONFIG_AVERAGE=y
   FILES:= $(PKG_BUILD_DIR)/net/mac80211/mac80211.ko
+ifdef CONFIG_PACKAGE_MAC80211_NSS_REDIRECT
+  AUTOLOAD:=$(call AutoProbe, mac80211)
+  MODPARAMS.mac80211:=nss_redirect=1
+endif
   ABI_VERSION:=$(PKG_VERSION)-$(PKG_RELEASE)
   MENU:=1
 endef
@@ -140,6 +147,21 @@ endef
 define KernelPackage/mac80211/config
   if PACKAGE_kmod-mac80211
 
+  if PACKAGE_kmod-qca-nss-drv
+		config PACKAGE_MAC80211_NSS_SUPPORT
+			bool "Enable NSS support"
+			default y
+			help
+				This option enables support for NSS in QCA boards.
+		config PACKAGE_MAC80211_NSS_REDIRECT
+			bool "Enable autoloading with 'nss_redirect=1' (not needed on ath11k)"
+			depends on PACKAGE_MAC80211_NSS_SUPPORT
+			default n
+			help
+				This option enables autoloading mac80211 with 'nss_redirect=1'.
+				However, it is not required for wifi offloading.
+  endif
+
 	config PACKAGE_MAC80211_DEBUGFS
 		bool "Export mac80211 internals in DebugFS"
 		select KERNEL_DEBUG_FS
@@ -281,6 +303,12 @@ ifeq ($(BUILD_VARIANT),smallbuffers)
 	C_DEFINES+= -DCONFIG_ATH10K_SMALLBUFFERS
 endif
 
+ifdef CONFIG_ATH11K_NSS_SUPPORT
+	IREMAP_CFLAGS+=-I$(STAGING_DIR)/usr/include/qca-nss-drv -I$(STAGING_DIR)/usr/include/qca-nss-clients
+endif
+
+config-$(CONFIG_PACKAGE_MAC80211_NSS_SUPPORT) += MAC80211_NSS_SUPPORT
+
 MAKE_OPTS:= \
 	$(subst -C $(LINUX_DIR),-C "$(PKG_BUILD_DIR)",$(KERNEL_MAKEOPTS)) \
 	EXTRA_CFLAGS="-I$(PKG_BUILD_DIR)/include $(IREMAP_CFLAGS) $(C_DEFINES)" \
@@ -349,6 +377,7 @@ define Build/Patch
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath10k,ath10k/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath11k,ath11k/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath12k,ath12k/)
+	$(if $(CONFIG_ATH11K_NSS_SUPPORT),$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath11k_nss,ath11k_nss/))
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rt2x00,rt2x00/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mt7601u,mt7601u/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mwl,mwl/)
@@ -366,6 +395,7 @@ define Quilt/Refresh/Package
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath10k,ath10k/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath11k,ath11k/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath12k,ath12k/)
+	$(if $(CONFIG_ATH11K_NSS_SUPPORT),$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath11k_nss,ath11k_nss/))
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rt2x00,rt2x00/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mt7601u,mt7601u/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mwl,mwl/)
diff --git a/package/kernel/mac80211/ath.mk b/package/kernel/mac80211/ath.mk
index 5b13b6aac4ad99..d6f38884c398e0 100644
--- a/package/kernel/mac80211/ath.mk
+++ b/package/kernel/mac80211/ath.mk
@@ -13,7 +13,10 @@ PKG_CONFIG_DEPENDS += \
 	CONFIG_ATH10K_LEDS \
 	CONFIG_ATH10K_THERMAL \
 	CONFIG_ATH11K_THERMAL \
-	CONFIG_ATH_USER_REGD
+	CONFIG_ATH_USER_REGD \
+	CONFIG_ATH11K_MEM_PROFILE_512M \
+	CONFIG_ATH11K_NSS_SUPPORT \
+	CONFIG_ATH11K_SMART_ANT_ALG
 
 ifdef CONFIG_PACKAGE_MAC80211_DEBUGFS
   config-y += \
@@ -59,6 +62,9 @@ config-$(CONFIG_ATH9K_UBNTHSR) += ATH9K_UBNTHSR
 config-$(CONFIG_ATH10K_LEDS) += ATH10K_LEDS
 config-$(CONFIG_ATH10K_THERMAL) += ATH10K_THERMAL
 config-$(CONFIG_ATH11K_THERMAL) += ATH11K_THERMAL
+config-$(CONFIG_ATH11K_MEM_PROFILE_512M) += ATH11K_MEM_PROFILE_512M
+config-$(CONFIG_ATH11K_NSS_SUPPORT) += ATH11K_NSS_SUPPORT
+config-$(CONFIG_ATH11K_SMART_ANT_ALG) += ATH11K_SMART_ANT_ALG
 
 config-$(call config_package,ath9k-htc) += ATH9K_HTC
 config-$(call config_package,ath10k,regular) += ATH10K ATH10K_PCI
@@ -309,9 +315,14 @@ define KernelPackage/ath11k
   TITLE:=Qualcomm 802.11ax wireless chipset support (common code)
   URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath11k
   DEPENDS+= +kmod-ath +@DRIVER_11AC_SUPPORT +@DRIVER_11AX_SUPPORT \
-  +kmod-crypto-michael-mic +ATH11K_THERMAL:kmod-hwmon-core \
-  +ATH11K_THERMAL:kmod-thermal +kmod-qcom-qmi-helpers
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath11k/ath11k.ko
+  +kmod-crypto-michael-mic +ATH11K_THERMAL:kmod-hwmon-core +ATH11K_THERMAL:kmod-thermal \
+  +ATH11K_NSS_SUPPORT:kmod-qca-nss-drv
+  FILES:=$(PKG_BUILD_DIR)/drivers/soc/qcom/qmi_helpers.ko \
+  $(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath11k/ath11k.ko
+ifdef CONFIG_ATH11K_NSS_SUPPORT
+  AUTOLOAD:=$(call AutoProbe,ath11k)
+  MODPARAMS.ath11k:=nss_offload=1 frame_mode=2
+endif
 endef
 
 define KernelPackage/ath11k/description
@@ -326,6 +337,20 @@ define KernelPackage/ath11k/config
                depends on PACKAGE_kmod-ath11k
                default y if TARGET_qualcommax
 
+       config ATH11K_NSS_SUPPORT
+               bool "Enable NSS WiFi offload"
+               default y if TARGET_qualcommax
+
+       config ATH11K_MEM_PROFILE_512M
+               bool "Use limits for the 512MB memory size"
+               default n
+               help
+                  This allows selecting the ath11k memory size profile to be used.
+
+       config ATH11K_SMART_ANT_ALG
+               bool "Enable smart antenna"
+               depends on PACKAGE_ATH_DEBUG
+               default n
 endef
 
 define KernelPackage/ath11k-ahb
diff --git a/package/kernel/mac80211/files/etc/init.d/qca-nss-pbuf b/package/kernel/mac80211/files/etc/init.d/qca-nss-pbuf
new file mode 100755
index 00000000000000..40f05c46fb28fb
--- /dev/null
+++ b/package/kernel/mac80211/files/etc/init.d/qca-nss-pbuf
@@ -0,0 +1,91 @@
+#!/bin/sh /etc/rc.common
+#
+# Copyright (c) 2021 The Linux Foundation. All rights reserved.
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+
+START=20
+
+apply_sysctl() {
+  [ $(sysctl -n -e dev.nss.general.redirect) = "0" ] && /etc/init.d/qca-nss-ecm start
+
+  logger -t ath11k_nss "$board - setting dev.nss.n2hcfg.extra_pbuf_core0=$extra_pbuf_core0"
+  sysctl -w dev.nss.n2hcfg.extra_pbuf_core0=$extra_pbuf_core0 > /dev/null 2> /dev/null
+
+  logger -t ath11k_nss "$board - setting dev.nss.n2hcfg.n2h_high_water_core0=$n2h_high_water_core0"
+  sysctl -w dev.nss.n2hcfg.n2h_high_water_core0=$n2h_high_water_core0 > /dev/null 2> /dev/null
+
+  logger -t ath11k_nss "$board - setting dev.nss.n2hcfg.n2h_wifi_pool_buf=$n2h_wifi_pool_buf"
+  sysctl -w dev.nss.n2hcfg.n2h_wifi_pool_buf=$n2h_wifi_pool_buf > /dev/null 2> /dev/null
+
+}
+
+apply_nss_config() {
+
+  sysctl -w dev.nss.n2hcfg.n2h_queue_limit_core0=256 > /dev/null 2> /dev/null
+  sysctl -w dev.nss.n2hcfg.n2h_queue_limit_core1=256 > /dev/null 2> /dev/null
+
+  board=$(board_name)
+
+  case "$board" in
+    # 1GB+ profile
+    buffalo,wxr-5950ax12 | \
+    dynalink,dl-wrx36 | \
+    edgecore,eap102 | \
+    linksys,mx5300 | \
+    linksys,mx4200v2 | \
+    netgear,rax120v2 | \
+    netgear,wax620 | \
+    netgear,wax630 | \
+    prpl,haze | \
+    qnap,301w | \
+    xiaomi,ax9000 | \
+    zyxel,nbg7815)
+      extra_pbuf_core0=10000000 n2h_high_water_core0=72512 n2h_wifi_pool_buf=36864 apply_sysctl
+      ;;
+    # 512MB profile
+    edimax,cax1800 | \
+    linksys,mx4200v1 | \
+    xiaomi,ax3600) # 512MB profile
+      extra_pbuf_core0=3100000 n2h_high_water_core0=30624 n2h_wifi_pool_buf=8192 apply_sysctl
+      ;;
+    # 256MB profile
+    netgear,wax218)
+      extra_pbuf_core0=3100000 n2h_high_water_core0=30258 n2h_wifi_pool_buf=4096 apply_sysctl
+      ;;
+  esac
+}
+
+start() {
+  if [ ! -r /sys/module/ath11k/parameters/nss_offload ]; then
+    logger -t ath11k_nss "Module parameter '/sys/module/ath11k/parameters/nss_offload' does NOT exist. Skipping applying wifi nss configs"
+    exit 1
+  fi
+
+  enable_nss_offload=$(cat /sys/module/ath11k/parameters/nss_offload)
+
+  if [ "$enable_nss_offload" = "0" ]; then
+    logger -t ath11k_nss "Module parameter 'nss_offload=0'. Skipping applying wifi nss configs"
+    exit 1
+  fi
+
+  # Running this script multiple times is useless, as extra_pbuf_core0
+  # can't be changed if it is allocated, assume it's already been run.
+  extra_pbuf_core0=$(sysctl -n -e dev.nss.n2hcfg.extra_pbuf_core0)
+
+  if [ "$extra_pbuf_core0" = "0" ]; then
+    apply_nss_config
+  else
+    logger -t ath11k_nss "Sysctl key 'extra_pbuf_core0' already set to '"$extra_pbuf_core0"'. Skipping applying wifi nss configs"
+  fi
+}
diff --git a/package/kernel/mac80211/patches/ath11k_nss/033-ath11k-fix-for-peer-memory-corruption.patch b/package/kernel/mac80211/patches/ath11k_nss/033-ath11k-fix-for-peer-memory-corruption.patch
new file mode 100644
index 00000000000000..5c9c723913b09a
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/033-ath11k-fix-for-peer-memory-corruption.patch
@@ -0,0 +1,48 @@
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -4178,22 +4178,28 @@ static int ath11k_clear_peer_keys(struct
+ 	int ret;
+ 	int i;
+ 	u32 flags = 0;
++	struct ieee80211_key_conf *keys[WMI_MAX_KEY_INDEX + 1];
+ 
+ 	lockdep_assert_held(&ar->conf_mutex);
+ 
+ 	spin_lock_bh(&ab->base_lock);
+ 	peer = ath11k_peer_find(ab, arvif->vdev_id, addr);
+-	spin_unlock_bh(&ab->base_lock);
+-
+-	if (!peer)
++	if (!peer) {
++		spin_unlock_bh(&ab->base_lock);
+ 		return -ENOENT;
++	}
++	for (i = 0; i < ARRAY_SIZE(keys); i++) {
++		keys[i]= peer->keys[i];
++		peer->keys[i]= NULL;
++	}
++	spin_unlock_bh(&ab->base_lock);
+ 
+-	for (i = 0; i < ARRAY_SIZE(peer->keys); i++) {
+-		if (!peer->keys[i])
++	for (i = 0; i < ARRAY_SIZE(keys); i++) {
++		if (!keys[i])
+ 			continue;
+ 
+ 		/* key flags are not required to delete the key */
+-		ret = ath11k_install_key(arvif, peer->keys[i],
++		ret = ath11k_install_key(arvif, keys[i],
+ 					 DISABLE_KEY, addr, flags);
+ 		if (ret < 0 && first_errno == 0)
+ 			first_errno = ret;
+@@ -4201,10 +4207,6 @@ static int ath11k_clear_peer_keys(struct
+ 		if (ret < 0)
+ 			ath11k_warn(ab, "failed to remove peer key %d: %d\n",
+ 				    i, ret);
+-
+-		spin_lock_bh(&ab->base_lock);
+-		peer->keys[i] = NULL;
+-		spin_unlock_bh(&ab->base_lock);
+ 	}
+ 
+ 	return first_errno;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/087-ath11k-fix-ul-ofdma-counter-increamenting-improperly.patch b/package/kernel/mac80211/patches/ath11k_nss/087-ath11k-fix-ul-ofdma-counter-increamenting-improperly.patch
new file mode 100644
index 00000000000000..326db09145b342
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/087-ath11k-fix-ul-ofdma-counter-increamenting-improperly.patch
@@ -0,0 +1,51 @@
+ drivers/net/wireless/ath/ath11k/dp_rx.c  | 3 ++-
+ drivers/net/wireless/ath/ath11k/hal_rx.c | 3 +++
+ drivers/net/wireless/ath/ath11k/hal_rx.h | 2 ++
+ 3 files changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -5242,8 +5242,11 @@ int ath11k_dp_rx_process_mon_status(stru
+ 			goto next_skb;
+ 		}
+ 
+-		arsta = ath11k_sta_to_arsta(peer->sta);
+-		ath11k_dp_rx_update_peer_stats(arsta, ppdu_info);
++		if ((ppdu_info->fc_valid) &&
++		    (ppdu_info->ast_index != HAL_AST_IDX_INVALID)) {
++			arsta = (struct ath11k_sta *)peer->sta->drv_priv;
++			ath11k_dp_rx_update_peer_stats(arsta, ppdu_info);
++		}
+ 
+ 		if (ath11k_debugfs_is_pktlog_peer_valid(ar, peer->addr))
+ 			trace_ath11k_htt_rxdesc(ar, skb->data, log_type, rx_buf_sz);
+--- a/drivers/net/wireless/ath/ath11k/hal_rx.c
++++ b/drivers/net/wireless/ath/ath11k/hal_rx.c
+@@ -900,6 +900,9 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+ 		ppdu_info->ast_index =
+ 			FIELD_GET(HAL_RX_PPDU_END_USER_STATS_INFO2_AST_INDEX,
+ 				  __le32_to_cpu(eu_stats->info2));
++		ppdu_info->fc_valid =
++			FIELD_GET(HAL_RX_PPDU_END_USER_STATS_INFO1_FC_VALID,
++				  __le32_to_cpu(eu_stats->info1));
+ 		ppdu_info->tid =
+ 			ffs(FIELD_GET(HAL_RX_PPDU_END_USER_STATS_INFO7_TID_BITMAP,
+ 				      __le32_to_cpu(eu_stats->info7))) - 1;
+--- a/drivers/net/wireless/ath/ath11k/hal_rx.h
++++ b/drivers/net/wireless/ath/ath11k/hal_rx.h
+@@ -66,6 +66,7 @@ enum hal_rx_reception_type {
+ };
+ 
+ #define HAL_RX_FCS_LEN                          4
++#define HAL_AST_IDX_INVALID                     0xFFFF
+ 
+ enum hal_rx_mon_status {
+ 	HAL_RX_MON_STATUS_PPDU_NOT_DONE,
+@@ -150,6 +151,7 @@ struct hal_rx_mon_ppdu_info {
+ 	u8 rssi_comb;
+ 	u8 rssi_chain_pri20[HAL_RX_MAX_NSS];
+ 	u16 tid;
++	u8 fc_valid;
+ 	u16 ht_flags;
+ 	u16 vht_flags;
+ 	u16 he_flags;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/105-ath11k-fix-monitor-crash-if-tx-offload-is-enabled.patch b/package/kernel/mac80211/patches/ath11k_nss/105-ath11k-fix-monitor-crash-if-tx-offload-is-enabled.patch
new file mode 100644
index 00000000000000..9304833c87d1c3
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/105-ath11k-fix-monitor-crash-if-tx-offload-is-enabled.patch
@@ -0,0 +1,60 @@
+ drivers/net/wireless/ath/ath11k/dp_tx.c | 20 +++++++++++++++++---
+ 1 file changed, 17 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -322,6 +322,8 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
+ 	struct ath11k_skb_cb *skb_cb;
+ 	struct ath11k *ar;
+ 	struct ath11k_peer *peer;
++	struct ieee80211_vif *vif;
++	u8 flags = 0;
+ 
+ 	spin_lock(&tx_ring->tx_idr_lock);
+ 	msdu = idr_remove(&tx_ring->txbuf_idr, ts->msdu_id);
+@@ -348,6 +350,14 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
+ 		return;
+ 	}
+ 
++	if (!skb_cb->vif) {
++		dev_kfree_skb_any(msdu);
++		return;
++	}
++
++	flags = skb_cb->flags;
++	vif = skb_cb->vif;
++
+ 	memset(&info->status, 0, sizeof(info->status));
+ 
+ 	if (ts->acked) {
+@@ -555,6 +565,8 @@ static void ath11k_dp_tx_complete_msdu(s
+ 	struct ath11k_peer *peer;
+ 	struct ath11k_sta *arsta;
+ 	struct rate_info rate;
++	struct ieee80211_vif *vif;
++	u8 flags = 0;
+ 
+ 	if (WARN_ON_ONCE(ts->buf_rel_source != HAL_WBM_REL_SRC_MODULE_TQM)) {
+ 		/* Must not happen */
+@@ -575,6 +587,9 @@ static void ath11k_dp_tx_complete_msdu(s
+ 		return;
+ 	}
+ 
++	flags = skb_cb->flags;
++	vif = skb_cb->vif;
++
+ 	info = IEEE80211_SKB_CB(msdu);
+ 	memset(&info->status, 0, sizeof(info->status));
+ 
+@@ -641,7 +656,10 @@ static void ath11k_dp_tx_complete_msdu(s
+ 
+ 	spin_unlock_bh(&ab->base_lock);
+ 
+-	ieee80211_tx_status_ext(ar->hw, &status);
++	if (flags & ATH11K_SKB_HW_80211_ENCAP)
++		ieee80211_tx_status_8023(ar->hw, vif, msdu);
++	else
++		ieee80211_tx_status_ext(ar->hw, &status);
+ }
+ 
+ static inline void ath11k_dp_tx_status_parse(struct ath11k_base *ab,
diff --git a/package/kernel/mac80211/patches/ath11k_nss/107-ath11k-tid-counter-fix.patch b/package/kernel/mac80211/patches/ath11k_nss/107-ath11k-tid-counter-fix.patch
new file mode 100644
index 00000000000000..1826e64bbcba05
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/107-ath11k-tid-counter-fix.patch
@@ -0,0 +1,21 @@
+From e227e5896dc8fe69d63334819c5fbada9caddc50 Mon Sep 17 00:00:00 2001
+From: Miles Hu <milehu@codeaurora.org>
+Date: Tue, 14 Jan 2020 14:29:53 -0800
+Subject: [PATCH] tid fix
+
+---
+ drivers/net/wireless/ath/ath11k/hal_rx.c | 2 +-
+ drivers/net/wireless/ath/ath11k/hal_rx.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/hal_rx.c
++++ b/drivers/net/wireless/ath/ath11k/hal_rx.c
+@@ -905,7 +905,7 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+ 				  __le32_to_cpu(eu_stats->info1));
+ 		ppdu_info->tid =
+ 			ffs(FIELD_GET(HAL_RX_PPDU_END_USER_STATS_INFO7_TID_BITMAP,
+-				      __le32_to_cpu(eu_stats->info7))) - 1;
++				      __le32_to_cpu(eu_stats->rsvd2[0]))) - 1;
+ 		ppdu_info->tcp_msdu_count =
+ 			FIELD_GET(HAL_RX_PPDU_END_USER_STATS_INFO4_TCP_MSDU_CNT,
+ 				  __le32_to_cpu(eu_stats->info4));
diff --git a/package/kernel/mac80211/patches/ath11k_nss/113-ath11k-add-8023-undecap-support.patch b/package/kernel/mac80211/patches/ath11k_nss/113-ath11k-add-8023-undecap-support.patch
new file mode 100644
index 00000000000000..8ef3d9ba7c4d91
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/113-ath11k-add-8023-undecap-support.patch
@@ -0,0 +1,55 @@
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -2163,6 +2163,42 @@ static void ath11k_dp_rx_h_undecap_eth(s
+ 	ether_addr_copy(ieee80211_get_SA(hdr), sa);
+ }
+ 
++static void ath11k_dp_rx_h_undecap_snap(struct ath11k *ar,
++				        struct sk_buff *msdu,
++				        u8 *first_hdr,
++				        enum hal_encrypt_type enctype,
++				        struct ieee80211_rx_status *status)
++{
++	struct ieee80211_hdr *hdr;
++	size_t hdr_len;
++	u8 l3_pad_bytes;
++	struct hal_rx_desc *rx_desc;
++
++	/* Delivered decapped frame:
++	 * [amsdu header] <-- replaced with 802.11 hdr
++	 * [rfc1042/llc]
++	 * [payload]
++	 */
++
++	rx_desc = (void *)msdu->data - sizeof(*rx_desc);
++	l3_pad_bytes = ath11k_dp_rx_h_msdu_end_l3pad(ar->ab, rx_desc);
++
++	skb_put(msdu, l3_pad_bytes);
++	skb_pull(msdu, sizeof(struct ath11k_dp_amsdu_subframe_hdr) + l3_pad_bytes);
++
++	hdr = (struct ieee80211_hdr *)first_hdr;
++	hdr_len = ieee80211_hdrlen(hdr->frame_control);
++
++	if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
++		memcpy(skb_push(msdu,
++				ath11k_dp_rx_crypto_param_len(ar, enctype)),
++		       (void *)hdr + hdr_len,
++			ath11k_dp_rx_crypto_param_len(ar, enctype));
++	}
++
++	memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
++}
++
+ static void ath11k_dp_rx_h_undecap(struct ath11k *ar, struct sk_buff *msdu,
+ 				   struct hal_rx_desc *rx_desc,
+ 				   enum hal_encrypt_type enctype,
+@@ -2204,7 +2240,8 @@ static void ath11k_dp_rx_h_undecap(struc
+ 						   enctype, status);
+ 		break;
+ 	case DP_RX_DECAP_TYPE_8023:
+-		/* TODO: Handle undecap for these formats */
++		ath11k_dp_rx_h_undecap_snap(ar, msdu, first_hdr,
++					    enctype, status);
+ 		break;
+ 	}
+ }
diff --git a/package/kernel/mac80211/patches/ath11k_nss/142-ath11k-adding-support-for-mgmt-frame-stats.patch b/package/kernel/mac80211/patches/ath11k_nss/142-ath11k-adding-support-for-mgmt-frame-stats.patch
new file mode 100644
index 00000000000000..f1dfc0f7b9a887
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/142-ath11k-adding-support-for-mgmt-frame-stats.patch
@@ -0,0 +1,292 @@
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -311,6 +311,16 @@ struct ath11k_rekey_data {
+ 	bool enable_offload;
+ };
+ 
++#define ATH11K_STATS_MGMT_FRM_TYPE_MAX 16
++
++struct ath11k_mgmt_frame_stats {
++	u32 tx_succ_cnt[ATH11K_STATS_MGMT_FRM_TYPE_MAX];
++	u32 tx_fail_cnt[ATH11K_STATS_MGMT_FRM_TYPE_MAX];
++	u32 rx_cnt[ATH11K_STATS_MGMT_FRM_TYPE_MAX];
++	u32 tx_compl_succ[ATH11K_STATS_MGMT_FRM_TYPE_MAX];
++	u32 tx_compl_fail[ATH11K_STATS_MGMT_FRM_TYPE_MAX];
++};
++
+ struct ath11k_vif {
+ 	u32 vdev_id;
+ 	enum wmi_vdev_type vdev_type;
+@@ -369,6 +379,8 @@ struct ath11k_vif {
+ #ifdef CPTCFG_ATH11K_DEBUGFS
+ 	struct dentry *debugfs_twt;
+ #endif /* CPTCFG_ATH11K_DEBUGFS */
++
++	struct ath11k_mgmt_frame_stats mgmt_stats;
+ };
+ 
+ struct ath11k_vif_iter {
+--- a/drivers/net/wireless/ath/ath11k/debugfs.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs.c
+@@ -1588,6 +1588,87 @@ static const struct file_operations fops
+ 	.llseek = default_llseek,
+ };
+ 
++static ssize_t ath11k_dump_mgmt_stats(struct file *file, char __user *ubuf,
++				      size_t count, loff_t *ppos)
++{
++	struct ath11k *ar = file->private_data;
++	struct ath11k_vif *arvif = NULL;
++	struct ath11k_mgmt_frame_stats *mgmt_stats;
++	int len = 0, ret, i;
++	int size = (TARGET_NUM_VDEVS - 1) * 1500;
++	char *buf;
++	const char *mgmt_frm_type[ATH11K_STATS_MGMT_FRM_TYPE_MAX-1] = {"assoc_req", "assoc_resp",
++								       "reassoc_req", "reassoc_resp",
++								       "probe_req", "probe_resp",
++								       "timing_advertisement", "reserved",
++								       "beacon", "atim", "disassoc",
++								       "auth", "deauth", "action", "action_no_ack"};
++
++	if (ar->state != ATH11K_STATE_ON)
++		return -ENETDOWN;
++
++	buf = kzalloc(size, GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
++
++	mutex_lock(&ar->conf_mutex);
++	spin_lock_bh(&ar->data_lock);
++
++	list_for_each_entry (arvif, &ar->arvifs, list) {
++		if (!arvif)
++			break;
++
++		if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR)
++			continue;
++
++		mgmt_stats = &arvif->mgmt_stats;
++		len += scnprintf(buf + len, size - len, "MGMT frame stats for vdev %u :\n",
++				 arvif->vdev_id);
++		len += scnprintf(buf + len, size - len, "  TX stats :\n ");
++		len += scnprintf(buf + len, size - len, "  Success frames:\n");
++		for (i = 0; i < ATH11K_STATS_MGMT_FRM_TYPE_MAX-1; i++)
++			len += scnprintf(buf + len, size - len, "	%s: %d\n", mgmt_frm_type[i],
++					 mgmt_stats->tx_succ_cnt[i]);
++
++		len += scnprintf(buf + len, size - len, "  Failed frames:\n");
++
++		for (i = 0; i < ATH11K_STATS_MGMT_FRM_TYPE_MAX-1; i++)
++			len += scnprintf(buf + len, size - len, "	%s: %d\n", mgmt_frm_type[i],
++					 mgmt_stats->tx_fail_cnt[i]);
++
++		len += scnprintf(buf + len, size - len, "  RX stats :\n");
++		len += scnprintf(buf + len, size - len, "  Success frames:\n");
++		for (i = 0; i < ATH11K_STATS_MGMT_FRM_TYPE_MAX-1; i++)
++			len += scnprintf(buf + len, size - len, "	%s: %d\n", mgmt_frm_type[i],
++					 mgmt_stats->rx_cnt[i]);
++
++		len += scnprintf(buf + len, size - len, " Tx completion stats :\n");
++		len += scnprintf(buf + len, size - len, " success completions:\n");
++		for (i = 0; i < ATH11K_STATS_MGMT_FRM_TYPE_MAX-1; i++)
++			len += scnprintf(buf + len, size - len, "       %s: %d\n", mgmt_frm_type[i],
++					 mgmt_stats->tx_compl_succ[i]);
++		len += scnprintf(buf + len, size - len, " failure completions:\n");
++		for (i = 0; i < ATH11K_STATS_MGMT_FRM_TYPE_MAX-1; i++)
++			len += scnprintf(buf + len, size - len, "       %s: %d\n", mgmt_frm_type[i],
++					 mgmt_stats->tx_compl_fail[i]);
++	}
++
++	spin_unlock_bh(&ar->data_lock);
++
++	if (len > size)
++		len = size;
++
++	ret = simple_read_from_buffer(ubuf, count, ppos, buf, len);
++	mutex_unlock(&ar->conf_mutex);
++	kfree(buf);
++	return ret;
++}
++
++static const struct file_operations fops_dump_mgmt_stats = {
++	.read = ath11k_dump_mgmt_stats,
++	.open = simple_open
++};
++
+ int ath11k_debugfs_register(struct ath11k *ar)
+ {
+ 	struct ath11k_base *ab = ar->ab;
+@@ -1620,6 +1701,9 @@ int ath11k_debugfs_register(struct ath11
+ 	debugfs_create_file("fw_dbglog_config", 0600,
+ 			    ar->debug.debugfs_pdev, ar,
+ 			    &fops_fw_dbglog);
++	debugfs_create_file("dump_mgmt_stats", 0644,
++			    ar->debug.debugfs_pdev, ar,
++			    &fops_dump_mgmt_stats);
+ 
+ 	if (ar->hw->wiphy->bands[NL80211_BAND_5GHZ]) {
+ 		debugfs_create_file("dfs_simulate_radar", 0200,
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -6148,9 +6148,9 @@ static int ath11k_mac_mgmt_tx(struct ath
+ 	 */
+ 	if (is_prb_rsp &&
+ 	    atomic_read(&ar->num_pending_mgmt_tx) > ATH11K_PRB_RSP_DROP_THRESHOLD) {
+-		ath11k_warn(ar->ab,
++		ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
+ 			    "dropping probe response as pending queue is almost full\n");
+-		return -ENOSPC;
++		return -EBUSY;
+ 	}
+ 
+ 	if (skb_queue_len_lockless(q) >= ATH11K_TX_MGMT_NUM_PENDING_MAX) {
+@@ -6176,9 +6176,11 @@ static void ath11k_mac_op_tx(struct ieee
+ 	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+ 	struct ieee80211_key_conf *key = info->control.hw_key;
++	struct ath11k_mgmt_frame_stats *mgmt_stats = &arvif->mgmt_stats;
+ 	struct ath11k_sta *arsta = NULL;
+ 	u32 info_flags = info->flags;
+ 	bool is_prb_rsp;
++	u16 frm_type = 0;
+ 	int ret;
+ 
+ 	memset(skb_cb, 0, sizeof(*skb_cb));
+@@ -6192,12 +6194,21 @@ static void ath11k_mac_op_tx(struct ieee
+ 	if (info_flags & IEEE80211_TX_CTL_HW_80211_ENCAP) {
+ 		skb_cb->flags |= ATH11K_SKB_HW_80211_ENCAP;
+ 	} else if (ieee80211_is_mgmt(hdr->frame_control)) {
++		frm_type = FIELD_GET(IEEE80211_FCTL_STYPE, hdr->frame_control);
+ 		is_prb_rsp = ieee80211_is_probe_resp(hdr->frame_control);
+ 		ret = ath11k_mac_mgmt_tx(ar, skb, is_prb_rsp);
+ 		if (ret) {
+-			ath11k_warn(ar->ab, "failed to queue management frame %d\n",
+-				    ret);
++			if (ret != -EBUSY)
++				ath11k_warn(ar->ab, "failed to queue management frame %d\n",
++					    ret);
+ 			ieee80211_free_txskb(ar->hw, skb);
++			spin_lock_bh(&ar->data_lock);
++			mgmt_stats->tx_fail_cnt[frm_type]++;
++			spin_unlock_bh(&ar->data_lock);
++		} else {
++			spin_lock_bh(&ar->data_lock);
++			mgmt_stats->tx_succ_cnt[frm_type]++;
++			spin_unlock_bh(&ar->data_lock);
+ 		}
+ 		return;
+ 	}
+--- a/drivers/net/wireless/ath/ath11k/peer.c
++++ b/drivers/net/wireless/ath/ath11k/peer.c
+@@ -444,6 +444,7 @@ int ath11k_peer_create(struct ath11k *ar
+ 
+ 	peer->sec_type = HAL_ENCRYPT_TYPE_OPEN;
+ 	peer->sec_type_grp = HAL_ENCRYPT_TYPE_OPEN;
++	peer->vif = arvif->vif;
+ 
+ 	if (sta) {
+ 		arsta = ath11k_sta_to_arsta(sta);
+--- a/drivers/net/wireless/ath/ath11k/peer.h
++++ b/drivers/net/wireless/ath/ath11k/peer.h
+@@ -10,6 +10,7 @@
+ struct ath11k_peer {
+ 	struct list_head list;
+ 	struct ieee80211_sta *sta;
++	struct ieee80211_vif *vif;
+ 	int vdev_id;
+ 	u8 addr[ETH_ALEN];
+ 	int peer_id;
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -5823,6 +5823,12 @@ static int wmi_process_mgmt_tx_comp(stru
+ 	struct sk_buff *msdu;
+ 	struct ieee80211_tx_info *info;
+ 	struct ath11k_skb_cb *skb_cb;
++	struct ieee80211_hdr *hdr;
++	struct ath11k_peer *peer;
++	struct ieee80211_vif *vif;
++	struct ath11k_vif *arvif;
++	struct ath11k_mgmt_frame_stats *mgmt_stats;
++	u16 frm_type;
+ 	int num_mgmt;
+ 
+ 	spin_lock_bh(&ar->txmgmt_idr_lock);
+@@ -5850,6 +5856,31 @@ static int wmi_process_mgmt_tx_comp(stru
+ 			info->status.ack_signal = tx_compl_param->ack_rssi;
+ 	}
+ 
++	hdr = (struct ieee80211_hdr *)msdu->data;
++	frm_type = FIELD_GET(IEEE80211_FCTL_STYPE, hdr->frame_control);
++
++	spin_lock_bh(&ar->ab->base_lock);
++	peer = ath11k_peer_find_by_addr(ar->ab, hdr->addr2);
++	if (!peer) {
++		spin_unlock_bh(&ar->ab->base_lock);
++		ath11k_warn(ar->ab, "failed to find peer to update txcompl mgmt stats\n");
++		goto skip_mgmt_stats;
++	}
++
++	vif = peer->vif;
++	spin_unlock_bh(&ar->ab->base_lock);
++
++	spin_lock_bh(&ar->data_lock);
++	arvif = ath11k_vif_to_arvif(vif);
++	mgmt_stats = &arvif->mgmt_stats;
++
++	if (!status)
++		mgmt_stats->tx_compl_succ[frm_type]++;
++	else
++		mgmt_stats->tx_compl_fail[frm_type]++;
++	spin_unlock_bh(&ar->data_lock);
++
++skip_mgmt_stats:
+ 	ieee80211_tx_status_irqsafe(ar->hw, msdu);
+ 
+ 	num_mgmt = atomic_dec_if_positive(&ar->num_pending_mgmt_tx);
+@@ -7519,6 +7550,11 @@ static void ath11k_mgmt_rx_event(struct
+ 	struct ieee80211_hdr *hdr;
+ 	u16 fc;
+ 	struct ieee80211_supported_band *sband;
++	struct ath11k_peer *peer;
++	struct ieee80211_vif *vif;
++	struct ath11k_vif *arvif;
++	struct ath11k_mgmt_frame_stats *mgmt_stats;
++	u16 frm_type = 0;
+ 
+ 	if (ath11k_pull_mgmt_rx_params_tlv(ab, skb, &rx_ev) != 0) {
+ 		ath11k_warn(ab, "failed to extract mgmt rx event");
+@@ -7584,7 +7620,34 @@ static void ath11k_mgmt_rx_event(struct
+ 
+ 	hdr = (struct ieee80211_hdr *)skb->data;
+ 	fc = le16_to_cpu(hdr->frame_control);
++	frm_type = FIELD_GET(IEEE80211_FCTL_STYPE, fc);
++
++	spin_lock_bh(&ab->base_lock);
++
++	peer = ath11k_peer_find_by_addr(ab, hdr->addr1);
++	if(!peer)
++		peer = ath11k_peer_find_by_addr(ab, hdr->addr3);
++	if (!peer) {
++		spin_unlock_bh(&ab->base_lock);
++		goto skip_mgmt_stats;
++	}
++
++	vif = peer->vif;
++
++	spin_unlock_bh(&ab->base_lock);
++
++	if (!vif)
++		goto skip_mgmt_stats;
++
++	spin_lock_bh(&ar->data_lock);
++
++	arvif = ath11k_vif_to_arvif(vif);
++	mgmt_stats = &arvif->mgmt_stats;
++	mgmt_stats->rx_cnt[frm_type]++;
++
++	spin_unlock_bh(&ar->data_lock);
+ 
++skip_mgmt_stats:
+ 	/* Firmware is guaranteed to report all essential management frames via
+ 	 * WMI while it can deliver some extra via HTT. Since there can be
+ 	 * duplicates split the reporting wrt monitor/sniffing.
diff --git a/package/kernel/mac80211/patches/ath11k_nss/146-mac80211-enable-TKIP-when-using-encapsulation-offloading.patch b/package/kernel/mac80211/patches/ath11k_nss/146-mac80211-enable-TKIP-when-using-encapsulation-offloading.patch
new file mode 100644
index 00000000000000..82d8c4e05bb11f
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/146-mac80211-enable-TKIP-when-using-encapsulation-offloading.patch
@@ -0,0 +1,12 @@
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -4686,8 +4686,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+ 	if (!key)
+ 		key = rcu_dereference(sdata->default_unicast_key);
+ 
+-	if (key && (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) ||
+-		    key->conf.cipher == WLAN_CIPHER_SUITE_TKIP))
++	if (key && (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)))
+ 		goto skip_offload;
+ 
+ 	sk_pacing_shift_update(skb->sk, sdata->local->hw.tx_sk_pacing_shift);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/191-ath11k-add-mgmt-and-data-ack-rssi.patch b/package/kernel/mac80211/patches/ath11k_nss/191-ath11k-add-mgmt-and-data-ack-rssi.patch
new file mode 100644
index 00000000000000..dea5600324f536
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/191-ath11k-add-mgmt-and-data-ack-rssi.patch
@@ -0,0 +1,48 @@
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -9571,6 +9571,8 @@ static int __ath11k_mac_register(struct
+ 		wiphy_ext_feature_set(ar->hw->wiphy,
+ 				      NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
+ 
++	wiphy_ext_feature_set(ar->hw->wiphy, NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
++
+ 	ar->hw->queues = ATH11K_HW_MAX_QUEUES;
+ 	ar->hw->wiphy->tx_queue_len = ATH11K_QUEUE_LEN;
+ 	ar->hw->offchannel_tx_hw_queue = ATH11K_HW_MAX_QUEUES - 1;
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -4065,6 +4065,7 @@ ath11k_wmi_copy_resource_config(struct w
+ 	wmi_cfg->max_bssid_rx_filters = tg_cfg->max_bssid_rx_filters;
+ 	wmi_cfg->use_pdev_id = tg_cfg->use_pdev_id;
+ 	wmi_cfg->flag1 = tg_cfg->flag1;
++	wmi_cfg->flag1 |= WMI_RSRC_CFG_FLAG1_ACK_RSSI;
+ 	wmi_cfg->peer_map_unmap_v2_support = tg_cfg->peer_map_unmap_v2_support;
+ 	wmi_cfg->sched_params = tg_cfg->sched_params;
+ 	wmi_cfg->twt_ap_pdev_count = tg_cfg->twt_ap_pdev_count;
+@@ -5874,7 +5875,7 @@ static int wmi_process_mgmt_tx_comp(stru
+ 	arvif = ath11k_vif_to_arvif(vif);
+ 	mgmt_stats = &arvif->mgmt_stats;
+ 
+-	if (!status)
++	if (!tx_compl_param->status)
+ 		mgmt_stats->tx_compl_succ[frm_type]++;
+ 	else
+ 		mgmt_stats->tx_compl_fail[frm_type]++;
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -4539,6 +4539,7 @@ struct wmi_pdev_bss_chan_info_event {
+ 	u32 rx_bss_cycle_count_low;
+ 	u32 rx_bss_cycle_count_high;
+ 	u32 pdev_id;
++	u32 ack_rssi;
+ } __packed;
+ 
+ #define WMI_VDEV_INSTALL_KEY_COMPL_STATUS_SUCCESS 0
+@@ -4890,7 +4891,6 @@ struct wmi_mgmt_tx_compl_event {
+ 	u32 desc_id;
+ 	u32 status;
+ 	u32 pdev_id;
+-	u32 ppdu_id;
+ 	u32 ack_rssi;
+ } __packed;
+ 
diff --git a/package/kernel/mac80211/patches/ath11k_nss/199-001-mac80211-add-nss-support.patch b/package/kernel/mac80211/patches/ath11k_nss/199-001-mac80211-add-nss-support.patch
new file mode 100644
index 00000000000000..0b017ec97ad24d
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/199-001-mac80211-add-nss-support.patch
@@ -0,0 +1,461 @@
+From 193bfea2185a0ee976f54812e41ace77e6ee85e4 Mon Sep 17 00:00:00 2001
+From: Sriram R <srirrama@codeaurora.org>
+Date: Fri, 10 Jul 2020 12:46:12 +0530
+Subject: [PATCH 1/3] mac80211: add nss support
+
+Add Support for NSS Offload if the HW supports it.
+New flag is introduced to indicate HW support for NSS
+offload
+
+Signed-off-by: Sriram R <srirrama@codeaurora.org>
+---
+ include/net/mac80211.h | 13 +++++++++++++
+ net/mac80211/debugfs.c |  1 +
+ net/mac80211/util.c    | 16 ++++++++++++++++
+ 3 files changed, 30 insertions(+)
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -380,6 +380,20 @@ enum ieee80211_bss_change {
+ 	/* when adding here, make sure to change ieee80211_reconfig */
+ };
+ 
++/**
++ * enum ieee80211_nss_bss_change - NSS BSS change notification flags
++ *
++ * These flags are used with the nss_bss_info_changed() callback
++ * to indicate which NSS BSS parameter changed.
++ *
++ * @BSS_CHANGED_NSS_AP_ISOLATE: AP Isolate feature in NSS mode
++ *
++ */
++
++enum ieee80211_nss_bss_change {
++	BSS_CHANGED_NSS_AP_ISOLATE  = BIT(0),
++};
++
+ /*
+  * The maximum number of IPv4 addresses listed for ARP filtering. If the number
+  * of addresses for an interface increase beyond this value, hardware ARP
+@@ -683,6 +697,7 @@ struct ieee80211_fils_discovery {
+  *	beamformee
+  * @eht_mu_beamformer: in AP-mode, does this BSS enable operation as an EHT MU
+  *	beamformer
++ * @nss_ap_isolate: Used for notifying the NSS host about AP isolate feature
+  */
+ struct ieee80211_bss_conf {
+ 	struct ieee80211_vif *vif;
+@@ -776,6 +791,7 @@ struct ieee80211_bss_conf {
+ 	bool eht_su_beamformer;
+ 	bool eht_su_beamformee;
+ 	bool eht_mu_beamformer;
++	bool nss_ap_isolate;
+ };
+ 
+ /**
+@@ -1406,7 +1422,7 @@ ieee80211_tx_info_clear_status(struct ie
+  * @RX_FLAG_AMPDU_EOF_BIT_KNOWN: The EOF value is known
+  * @RX_FLAG_RADIOTAP_HE: HE radiotap data is present
+  *	(&struct ieee80211_radiotap_he, mac80211 will fill in
+- *	
++ *
+  *	 - DATA3_DATA_MCS
+  *	 - DATA3_DATA_DCM
+  *	 - DATA3_CODING
+@@ -1414,7 +1430,7 @@ ieee80211_tx_info_clear_status(struct ie
+  *	 - DATA5_DATA_BW_RU_ALLOC
+  *	 - DATA6_NSTS
+  *	 - DATA3_STBC
+- *	
++ *
+  *	from the RX info data, so leave those zeroed when building this data)
+  * @RX_FLAG_RADIOTAP_HE_MU: HE MU radiotap data is present
+  *	(&struct ieee80211_radiotap_he_mu)
+@@ -1987,6 +2003,16 @@ static inline bool lockdep_vif_mutex_hel
+ 			      lockdep_vif_mutex_held(vif))
+ 
+ /**
++ * ieee80211_vif_to_wdev_relaxed - return a wdev struct from a vif
++ * @vif: the vif to get the wdev for
++ *
++ * This function is similar to ieee80211_vif_to_wdev, but the wdev
++ * is returned even if sdata is not running.
++ *
++ */
++struct wireless_dev *ieee80211_vif_to_wdev_relaxed(struct ieee80211_vif *vif);
++
++/**
+  * enum ieee80211_key_flags - key flags
+  *
+  * These flags are used for communication about keys between the driver
+@@ -2677,6 +2703,8 @@ struct ieee80211_txq {
+  * @IEEE80211_HW_MLO_MCAST_MULTI_LINK_TX: Hardware/driver handles transmitting
+  *	multicast frames on all links, mac80211 should not do that.
+  *
++ *  @IEEE80211_HW_SUPPORTS_NSS_OFFLOAD: Hardware/driver supports NSS offload
++ *
+  * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
+  */
+ enum ieee80211_hw_flags {
+@@ -2734,6 +2762,7 @@ enum ieee80211_hw_flags {
+ 	IEEE80211_HW_SUPPORTS_CONC_MON_RX_DECAP,
+ 	IEEE80211_HW_DETECTS_COLOR_COLLISION,
+ 	IEEE80211_HW_MLO_MCAST_MULTI_LINK_TX,
++	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
+ 
+ 	/* keep last, obviously */
+ 	NUM_IEEE80211_HW_FLAGS
+@@ -3746,6 +3775,10 @@ struct ieee80211_prep_tx_info {
+  *	non-MLO connections.
+  *	The callback can sleep.
+  *
++ * @nss_bss_info_changed: Handler for configuration requests related to NSS BSS
++ * parameters that may vary during BSS's lifespan, and may affect low level
++ * driver.
++ *
+  * @prepare_multicast: Prepare for multicast filter configuration.
+  *	This callback is optional, and its return value is passed
+  *	to configure_filter(). This callback must be atomic.
+@@ -4297,7 +4330,9 @@ struct ieee80211_ops {
+ 				  struct ieee80211_vif *vif,
+ 				  struct ieee80211_bss_conf *info,
+ 				  u64 changed);
+-
++	void (*nss_bss_info_changed)(struct ieee80211_hw *hw,
++				     struct ieee80211_vif *vif,
++				     u64 changed);
+ 	int (*start_ap)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 			struct ieee80211_bss_conf *link_conf);
+ 	void (*stop_ap)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -4602,7 +4637,7 @@ struct ieee80211_ops {
+ 	int (*reset_tid_config)(struct ieee80211_hw *hw,
+ 				struct ieee80211_vif *vif,
+ 				struct ieee80211_sta *sta, u8 tids);
+-	void (*update_vif_offload)(struct ieee80211_hw *hw,
++	int (*update_vif_offload)(struct ieee80211_hw *hw,
+ 				   struct ieee80211_vif *vif);
+ 	void (*sta_set_4addr)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 			      struct ieee80211_sta *sta, bool enabled);
+--- a/net/mac80211/debugfs.c
++++ b/net/mac80211/debugfs.c
+@@ -496,6 +496,7 @@ static const char *hw_flag_names[] = {
+ 	FLAG(SUPPORTS_CONC_MON_RX_DECAP),
+ 	FLAG(DETECTS_COLOR_COLLISION),
+ 	FLAG(MLO_MCAST_MULTI_LINK_TX),
++	FLAG(SUPPORTS_NSS_OFFLOAD),
+ #undef FLAG
+ };
+ 
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -868,6 +868,22 @@ struct wireless_dev *ieee80211_vif_to_wd
+ }
+ EXPORT_SYMBOL_GPL(ieee80211_vif_to_wdev);
+ 
++struct wireless_dev *ieee80211_vif_to_wdev_relaxed(struct ieee80211_vif *vif)
++{
++	struct ieee80211_sub_if_data *sdata;
++
++	if (!vif)
++		return NULL;
++
++	sdata = vif_to_sdata(vif);
++
++	if (sdata)
++		return &sdata->wdev;
++
++	return NULL;
++}
++EXPORT_SYMBOL(ieee80211_vif_to_wdev_relaxed);
++
+ /*
+  * Nothing should have been stuffed into the workqueue during
+  * the suspend->resume cycle. Since we can't check each caller
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -291,6 +291,17 @@ void ieee80211_link_info_change_notify(s
+ 	drv_link_info_changed(local, sdata, link->conf, link->link_id, changed);
+ }
+ 
++void ieee80211_nss_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
++                                         u64 changed)
++{
++       struct ieee80211_local *local = sdata->local;
++
++       if (!changed || sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
++               return;
++
++       drv_nss_bss_info_changed(local, sdata, &sdata->vif.bss_conf, changed);
++}
++
+ u64 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata)
+ {
+ 	sdata->vif.bss_conf.use_cts_prot = false;
+@@ -694,12 +705,6 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+ 			   NL80211_FEATURE_FULL_AP_CLIENT_STATE;
+ 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_FILS_STA);
+ 	wiphy_ext_feature_set(wiphy,
+-			      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211);
+-	wiphy_ext_feature_set(wiphy,
+-			      NL80211_EXT_FEATURE_CONTROL_PORT_NO_PREAUTH);
+-	wiphy_ext_feature_set(wiphy,
+-			      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211_TX_STATUS);
+-	wiphy_ext_feature_set(wiphy,
+ 			      NL80211_EXT_FEATURE_SCAN_FREQ_KHZ);
+ 	wiphy_ext_feature_set(wiphy,
+ 			      NL80211_EXT_FEATURE_POWERED_ADDR_CHANGE);
+@@ -1007,6 +1012,18 @@ int ieee80211_register_hw(struct ieee802
+ 			return -EINVAL;
+ 	}
+ 
++	/* Control port over nl80211 is disabled for nss offload as
++	 * sending per packet tx status is not supported and only
++	 * rx over netdev from driver is done currently */
++	if (!ieee80211_hw_check(hw, SUPPORTS_NSS_OFFLOAD)) {
++		wiphy_ext_feature_set(hw->wiphy,
++				      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211);
++		wiphy_ext_feature_set(hw->wiphy,
++				      NL80211_EXT_FEATURE_CONTROL_PORT_NO_PREAUTH);
++		wiphy_ext_feature_set(hw->wiphy,
++				      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211_TX_STATUS);
++	}
++
+ #ifdef CONFIG_PM
+ 	if (hw->wiphy->wowlan && (!local->ops->suspend || !local->ops->resume))
+ 		return -EINVAL;
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -2379,6 +2379,9 @@ sta_get_last_rx_stats(struct sta_info *s
+ 	struct ieee80211_sta_rx_stats *stats = &sta->deflink.rx_stats;
+ 	int cpu;
+ 
++	if (ieee80211_hw_check(&sta->local->hw, SUPPORTS_NSS_OFFLOAD))
++		return stats;
++
+ 	if (!sta->deflink.pcpu_rx_stats)
+ 		return stats;
+ 
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1028,11 +1028,23 @@ ieee80211_tx_h_stats(struct ieee80211_tx
+ {
+ 	struct sk_buff *skb;
+ 	int ac = -1;
++	struct ieee80211_hdr *hdr;
++	bool nss_offload;
+ 
+ 	if (!tx->sta)
+ 		return TX_CONTINUE;
+ 
++	nss_offload = ieee80211_hw_check(&tx->local->hw, SUPPORTS_NSS_OFFLOAD);
++
+ 	skb_queue_walk(&tx->skbs, skb) {
++		/* Do not increment stats for data packets if NSS offload is enabled.
++		 * As we use the stats from NSS, this will be a duplication
++		 */
++		if (nss_offload) {
++			hdr = (void *) skb->data;
++			if (ieee80211_is_data(hdr->frame_control))
++				continue;
++		}
+ 		ac = skb_get_queue_mapping(skb);
+ 		tx->sta->deflink.tx_stats.bytes[ac] += skb->len;
+ 	}
+@@ -2857,7 +2869,9 @@ static struct sk_buff *ieee80211_build_h
+ 
+ 	if (unlikely(!multicast && ((skb->sk &&
+ 		     skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS) ||
+-		     ctrl_flags & IEEE80211_TX_CTL_REQ_TX_STATUS)))
++		     ctrl_flags & IEEE80211_TX_CTL_REQ_TX_STATUS) &&
++		     !(ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD) &&
++		       ieee80211_is_data(fc) && !ieee80211_is_qos_nullfunc(fc))))
+ 		info_id = ieee80211_store_ack_skb(local, skb, &info_flags,
+ 						  cookie);
+ 
+@@ -4639,13 +4653,16 @@ static void ieee80211_8023_xmit(struct i
+ 	}
+ 
+ 	if (unlikely(skb->sk &&
+-		     skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS))
++		     skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS &&
++		     !ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD)))
+ 		info->ack_frame_id = ieee80211_store_ack_skb(local, skb,
+ 							     &info->flags, NULL);
+ 
+ 	dev_sw_netstats_tx_add(dev, skbs, len);
+-	sta->deflink.tx_stats.packets[queue] += skbs;
+-	sta->deflink.tx_stats.bytes[queue] += len;
++	if (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD)) {
++		sta->deflink.tx_stats.packets[queue] += skbs;
++		sta->deflink.tx_stats.bytes[queue] += len;
++	}
+ 
+ 	ieee80211_tpt_led_trig_tx(local, len);
+ 
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -2447,6 +2447,9 @@ bool cfg80211_does_bw_fit_range(const st
+ 
+ int cfg80211_sinfo_alloc_tid_stats(struct station_info *sinfo, gfp_t gfp)
+ {
++	if(sinfo->pertid)
++		return 0;
++
+ 	sinfo->pertid = kcalloc(IEEE80211_NUM_TIDS + 1,
+ 				sizeof(*(sinfo->pertid)),
+ 				gfp);
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -2675,7 +2675,7 @@ static int ieee80211_change_bss(struct w
+ 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+ 	struct ieee80211_link_data *link;
+ 	struct ieee80211_supported_band *sband;
+-	u64 changed = 0;
++	u32 changed = 0, nss_changed = 0;
+ 
+ 	link = ieee80211_link_or_deflink(sdata, params->link_id, true);
+ 	if (IS_ERR(link))
+@@ -2725,6 +2725,8 @@ static int ieee80211_change_bss(struct w
+ 			sdata->flags |= IEEE80211_SDATA_DONT_BRIDGE_PACKETS;
+ 		else
+ 			sdata->flags &= ~IEEE80211_SDATA_DONT_BRIDGE_PACKETS;
++		sdata->vif.bss_conf.nss_ap_isolate = params->ap_isolate;
++		nss_changed |= BSS_CHANGED_NSS_AP_ISOLATE;
+ 		ieee80211_check_fast_rx_iface(sdata);
+ 	}
+ 
+@@ -2753,6 +2755,8 @@ static int ieee80211_change_bss(struct w
+ 
+ 	ieee80211_link_info_change_notify(sdata, link, changed);
+ 
++	ieee80211_nss_bss_info_change_notify(sdata, nss_changed);
++
+ 	return 0;
+ }
+ 
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -172,6 +172,23 @@ void drv_link_info_changed(struct ieee80
+ 			   struct ieee80211_bss_conf *info,
+ 			   int link_id, u64 changed);
+ 
++static inline void drv_nss_bss_info_changed(struct ieee80211_local *local,
++					struct ieee80211_sub_if_data *sdata,
++					struct ieee80211_bss_conf *info,
++					u32 changed)
++{
++	might_sleep();
++
++	if (!check_sdata_in_driver(sdata))
++		return;
++
++	trace_drv_nss_bss_info_changed(local, sdata, info, changed);
++	if (local->ops->nss_bss_info_changed) {
++		local->ops->nss_bss_info_changed(&local->hw, &sdata->vif, changed);
++	}
++	trace_drv_nss_return_void(local);
++}
++
+ static inline u64 drv_prepare_multicast(struct ieee80211_local *local,
+ 					struct netdev_hw_addr_list *mc_list)
+ {
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1845,6 +1845,8 @@ void ieee80211_vif_cfg_change_notify(str
+ void ieee80211_link_info_change_notify(struct ieee80211_sub_if_data *sdata,
+ 				       struct ieee80211_link_data *link,
+ 				       u64 changed);
++void ieee80211_nss_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
++					  u64 changed);
+ void ieee80211_configure_filter(struct ieee80211_local *local);
+ u64 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata);
+ 
+--- a/net/mac80211/trace.h
++++ b/net/mac80211/trace.h
+@@ -389,6 +389,38 @@ TRACE_EVENT(drv_config,
+ 		LOCAL_PR_ARG, __entry->changed, CHANDEF_PR_ARG
+ 	)
+ );
++TRACE_EVENT(drv_nss_bss_info_changed,
++	TP_PROTO(struct ieee80211_local *local,
++		 struct ieee80211_sub_if_data *sdata,
++		 struct ieee80211_bss_conf *info,
++		 u32 changed),
++
++	TP_ARGS(local, sdata, info, changed),
++
++	TP_STRUCT__entry(
++		LOCAL_ENTRY
++		VIF_ENTRY
++		__field(u32, changed)
++		__field(bool, nss_ap_isolate);
++	),
++
++	TP_fast_assign(
++		LOCAL_ASSIGN;
++		VIF_ASSIGN;
++		__entry->changed = changed;
++		__entry->nss_ap_isolate = info->nss_ap_isolate;
++	),
++
++	TP_printk(
++		LOCAL_PR_FMT  VIF_PR_FMT " changed:%#x",
++		LOCAL_PR_ARG, VIF_PR_ARG, __entry->changed
++	)
++);
++
++DEFINE_EVENT(local_only_evt, drv_nss_return_void,
++	TP_PROTO(struct ieee80211_local *local),
++	TP_ARGS(local)
++);
+ 
+ TRACE_EVENT(drv_vif_cfg_changed,
+ 	TP_PROTO(struct ieee80211_local *local,
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -969,7 +969,8 @@ static bool ieee80211_set_sdata_offload_
+ 		    local->hw.wiphy->frag_threshold != (u32)-1)
+ 			flags &= ~IEEE80211_OFFLOAD_ENCAP_ENABLED;
+ 
+-		if (local->monitors)
++		if (local->monitors &&
++		    !ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD))
+ 			flags &= ~IEEE80211_OFFLOAD_ENCAP_ENABLED;
+ 	} else {
+ 		flags &= ~IEEE80211_OFFLOAD_ENCAP_ENABLED;
+--- a/net/mac80211/Kconfig
++++ b/net/mac80211/Kconfig
+@@ -104,6 +104,15 @@ menuconfig MAC80211_DEBUG_MENU
+ 	help
+ 	  This option collects various mac80211 debug settings.
+ 
++config MAC80211_NSS_SUPPORT
++	bool "QTI mac80211 nss support"
++	depends on ATH11K_NSS_SUPPORT
++	default n
++	---help---
++	  Enables NSS offload support for ATH11K driver
++
++	  If unsure, say Y to enable NSS offload support.
++
+ config MAC80211_NOINLINE
+ 	bool "Do not inline TX/RX handlers"
+ 	depends on MAC80211_DEBUG_MENU
+--- a/local-symbols
++++ b/local-symbols
+@@ -65,6 +65,7 @@ MAC80211_MESH_PS_DEBUG=
+ MAC80211_TDLS_DEBUG=
+ MAC80211_DEBUG_COUNTERS=
+ MAC80211_STA_HASH_MAX_SIZE=
++MAC80211_NSS_SUPPORT=
+ QCOM_AOSS_QMP=
+ QCOM_COMMAND_DB=
+ QCOM_CPR=
+@@ -174,6 +175,7 @@ ATH11K_DEBUGFS=
+ ATH11K_TRACING=
+ ATH11K_SPECTRAL=
+ ATH11K_THERMAL=
++ATH11K_MEM_PROFILE_512M=
+ ATH12K=
+ ATH12K_DEBUG=
+ ATH12K_TRACING=
diff --git a/package/kernel/mac80211/patches/ath11k_nss/199-002-ath11k_nss-add-nss-driver-interface.patch b/package/kernel/mac80211/patches/ath11k_nss/199-002-ath11k_nss-add-nss-driver-interface.patch
new file mode 100644
index 00000000000000..beee16098f14c3
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/199-002-ath11k_nss-add-nss-driver-interface.patch
@@ -0,0 +1,3020 @@
+From 0fa55ca418c8afd6da242407a184c23548c553dc Mon Sep 17 00:00:00 2001
+From: Sriram R <srirrama@codeaurora.org>
+Date: Fri, 5 Jun 2020 12:21:15 +0530
+Subject: [PATCH 2/3] ath11k: Add nss driver interface
+
+This patch adds interface support for accessing nss driver with
+support for initialization, teardown, vap up/down, peer create/delete,
+tx/rx. NSS Stats addition is not part of this version.
+
+Signed-off-by: Sriram R <srirrama@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/Kconfig  |    9 +
+ drivers/net/wireless/ath/ath11k/Makefile |    1 +
+ drivers/net/wireless/ath/ath11k/nss.c    | 1762 ++++++++++++++++++++++++++++++
+ drivers/net/wireless/ath/ath11k/nss.h    |  217 ++++
+ 4 files changed, 1989 insertions(+)
+ create mode 100644 drivers/net/wireless/ath/ath11k/nss.c
+ create mode 100644 drivers/net/wireless/ath/ath11k/nss.h
+
+--- a/drivers/net/wireless/ath/ath11k/Kconfig
++++ b/drivers/net/wireless/ath/ath11k/Kconfig
+@@ -13,6 +13,16 @@ config ATH11K
+ 
+ 	  If you choose to build a module, it'll be called ath11k.
+ 
++config ATH11K_NSS_SUPPORT
++	bool "QCA ath11k nss support"
++	depends on ATH11K
++	default n
++	select MAC80211_NSS_SUPPORT
++	---help---
++	  Enables NSS offload support for ATH11K driver
++
++	  If unsure, say Y to enable NSS offload support.
++
+ config ATH11K_AHB
+ 	tristate "Atheros ath11k AHB support"
+ 	depends on m
+--- a/drivers/net/wireless/ath/ath11k/Makefile
++++ b/drivers/net/wireless/ath/ath11k/Makefile
+@@ -25,6 +25,7 @@ ath11k-$(CPTCFG_ATH11K_TRACING) += trace
+ ath11k-$(CPTCFG_ATH11K_THERMAL) += thermal.o
+ ath11k-$(CPTCFG_ATH11K_SPECTRAL) += spectral.o
+ ath11k-$(CONFIG_PM) += wow.o
++ath11k-$(CPTCFG_ATH11K_NSS_SUPPORT) += nss.o
+ 
+ obj-$(CPTCFG_ATH11K_AHB) += ath11k_ahb.o
+ ath11k_ahb-y += ahb.o
+--- /dev/null
++++ b/drivers/net/wireless/ath/ath11k/nss.c
+@@ -0,0 +1,2392 @@
++// SPDX-License-Identifier: BSD-3-Clause-Clear
++/*
++ * Copyright (c) 2020 The Linux Foundation. All rights reserved.
++ */
++
++#include "debug.h"
++#include "mac.h"
++#include "nss.h"
++#include "core.h"
++#include "peer.h"
++#include "hif.h"
++#include "wmi.h"
++#include "../../../../../net/mac80211/sta_info.h"
++
++/*-----------------------------ATH11K-NSS Helpers--------------------------*/
++
++static enum ath11k_nss_opmode
++ath11k_nss_get_vdev_opmode(struct ath11k_vif *arvif)
++{
++	switch (arvif->vdev_type) {
++	case WMI_VDEV_TYPE_AP:
++		return ATH11K_NSS_OPMODE_AP;
++	case WMI_VDEV_TYPE_STA:
++		return ATH11K_NSS_OPMODE_STA;
++	default:
++		ath11k_warn(arvif->ar->ab, "unsupported nss vdev type %d\n",
++			    arvif->vdev_type);
++	}
++
++	return ATH11K_NSS_OPMODE_UNKNOWN;
++}
++
++static void ath11k_nss_wifili_stats_sync(struct ath11k_base *ab,
++					 struct nss_wifili_stats_sync_msg *wlsoc_stats)
++{
++	struct nss_wifili_device_stats *devstats = &wlsoc_stats->stats;
++	struct ath11k_soc_dp_stats *soc_stats = &ab->soc_stats;
++	int i;
++
++	spin_lock_bh(&ab->base_lock);
++
++	soc_stats->err_ring_pkts += devstats->rxwbm_stats.err_src_rxdma;
++	soc_stats->invalid_rbm += devstats->rxwbm_stats.invalid_buf_mgr;
++
++	for (i = 0; i < HAL_REO_ENTR_RING_RXDMA_ECODE_MAX; i++)
++		soc_stats->rxdma_error[i] += devstats->rxwbm_stats.err_dma_codes[i];
++
++	for (i = 0; i < HAL_REO_DEST_RING_ERROR_CODE_MAX; i++)
++		soc_stats->reo_error[i] += devstats->rxwbm_stats.err_reo_codes[i];
++
++	for (i = 0; i < DP_REO_DST_RING_MAX; i++)
++		soc_stats->hal_reo_error[i] += devstats->rxreo_stats[i].ring_error;
++
++	for (i = 0; i < DP_TCL_NUM_RING_MAX; i++)
++		soc_stats->tx_err.desc_na[i] += devstats->tcl_stats[i].tcl_ring_full;
++
++
++	for (i = 0; i < NSS_WIFILI_MAX_TCL_DATA_RINGS_MSG; i++)
++		atomic_add(devstats->txcomp_stats[i].invalid_bufsrc
++			  + devstats->txcomp_stats[i].invalid_cookie
++			  + devstats->tx_sw_pool_stats[i].desc_alloc_fail
++			  + devstats->tx_ext_sw_pool_stats[i].desc_alloc_fail,
++			  &soc_stats->tx_err.misc_fail);
++
++	for (i = 0; i < DP_TCL_NUM_RING_MAX; i++)
++		atomic_add(devstats->tx_data_stats[i].tx_send_fail_cnt,
++			   &soc_stats->tx_err.misc_fail);
++
++	spin_unlock_bh(&ab->base_lock);
++}
++
++static void ath11k_nss_get_peer_stats(struct ath11k_base *ab, struct nss_wifili_peer_stats *stats)
++{
++	struct ath11k_peer *peer;
++	struct nss_wifili_peer_ctrl_stats *pstats = NULL;
++	int i, j;
++	u64 tx_packets, tx_bytes, tx_dropped = 0;
++	u64 rx_packets, rx_bytes, rx_dropped;
++
++	if (!ab->nss.stats_enabled)
++		return;
++
++	for (i = 0; i < stats->npeers; i++) {
++		pstats = &stats->wpcs[i];
++
++		rcu_read_lock();
++		spin_lock_bh(&ab->base_lock);
++
++		peer = ath11k_peer_find_by_id(ab, pstats->peer_id);
++		if (!peer || !peer->sta) {
++			ath11k_dbg(ab, ATH11K_DBG_NSS, "nss wifili: unable to find peer %d\n", pstats->peer_id);
++			spin_unlock_bh(&ab->base_lock);
++			rcu_read_unlock();
++			continue;
++		}
++
++		if (!peer->nss.nss_stats) {
++			spin_unlock_bh(&ab->base_lock);
++			rcu_read_unlock();
++			return;
++		}
++
++		if (pstats->tx.tx_success_cnt)
++			peer->nss.nss_stats->last_ack = jiffies;
++
++		if (pstats->rx.rx_recvd) {
++			peer->nss.nss_stats->last_rx = jiffies;
++		}
++
++		tx_packets = pstats->tx.tx_mcast_cnt +
++			pstats->tx.tx_ucast_cnt +
++			pstats->tx.tx_bcast_cnt;
++		peer->nss.nss_stats->tx_packets += tx_packets;
++		tx_bytes = pstats->tx.tx_mcast_bytes +
++			pstats->tx.tx_ucast_bytes +
++			pstats->tx.tx_bcast_bytes;
++		peer->nss.nss_stats->tx_bytes += tx_bytes;
++		peer->nss.nss_stats->tx_retries += pstats->tx.retries;
++
++		for (j = 0; j < NSS_WIFILI_TQM_RR_MAX; j++)
++			tx_dropped += pstats->tx.dropped.drop_stats[j];
++
++		peer->nss.nss_stats->tx_failed += tx_dropped;
++
++		ATH11K_NSS_TXRX_NETDEV_STATS(tx, peer->vif, tx_bytes, tx_packets);
++
++		rx_packets = pstats->rx.rx_recvd;
++		peer->nss.nss_stats->rx_packets += rx_packets;
++		rx_bytes = pstats->rx.rx_recvd_bytes;
++		peer->nss.nss_stats->rx_bytes += rx_bytes;
++		rx_dropped = pstats->rx.err.mic_err +
++			pstats->rx.err.decrypt_err;
++		peer->nss.nss_stats->rx_dropped += rx_dropped;
++
++		ATH11K_NSS_TXRX_NETDEV_STATS(rx, peer->vif, rx_bytes, rx_packets);
++
++		spin_unlock_bh(&ab->base_lock);
++		rcu_read_unlock();
++	}
++}
++
++void ath11k_nss_ext_rx_stats(struct ath11k_base *ab, struct htt_rx_ring_tlv_filter *tlv_filter)
++{
++	if (ab->nss.enabled)
++		tlv_filter->rx_filter |= HTT_RX_FILTER_TLV_FLAGS_PPDU_END_USER_STATS;
++}
++
++static u32 ath11k_nss_cipher_type(struct ath11k_base *ab, u32 cipher)
++{
++	switch (cipher) {
++	case WLAN_CIPHER_SUITE_CCMP:
++		return PEER_SEC_TYPE_AES_CCMP;
++	case WLAN_CIPHER_SUITE_TKIP:
++		return PEER_SEC_TYPE_TKIP;
++	case WLAN_CIPHER_SUITE_CCMP_256:
++		return PEER_SEC_TYPE_AES_CCMP_256;
++	case WLAN_CIPHER_SUITE_GCMP:
++		return PEER_SEC_TYPE_AES_GCMP;
++	case WLAN_CIPHER_SUITE_GCMP_256:
++		return PEER_SEC_TYPE_AES_GCMP_256;
++	default:
++		ath11k_warn(ab, "unknown cipher type %d\n", cipher);
++		return PEER_SEC_TYPE_NONE;
++	}
++}
++
++static void ath11k_nss_tx_encap_nwifi(struct sk_buff *skb)
++{
++	struct ieee80211_hdr *hdr = (void *)skb->data;
++	u8 *qos_ctl;
++
++	if (!ieee80211_is_data_qos(hdr->frame_control))
++		return;
++
++	qos_ctl = ieee80211_get_qos_ctl(hdr);
++	memmove(skb->data + IEEE80211_QOS_CTL_LEN,
++		skb->data, (void *)qos_ctl - (void *)skb->data);
++	skb_pull(skb, IEEE80211_QOS_CTL_LEN);
++
++	hdr = (void *)skb->data;
++	hdr->frame_control &= ~__cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
++}
++
++static void ath11k_nss_tx_encap_raw(struct sk_buff *skb)
++{
++	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
++	struct ieee80211_hdr *hdr = (void *)skb->data;
++	u32 cipher;
++
++	if (!ieee80211_has_protected(hdr->frame_control) || !info->control.hw_key)
++		return;
++
++	/* Include length for MIC */
++	skb_put(skb, IEEE80211_CCMP_MIC_LEN);
++
++	/* Include length for ICV if TKIP is used */
++	cipher = info->control.hw_key->cipher;
++	if (cipher == WLAN_CIPHER_SUITE_TKIP)
++		skb_put(skb, IEEE80211_TKIP_ICV_LEN);
++}
++
++static void ath11k_nss_peer_mem_free(struct ath11k_base *ab, u32 peer_id)
++{
++	struct ath11k_peer *peer;
++
++	spin_lock_bh(&ab->base_lock);
++
++	peer = ath11k_peer_find_by_id(ab, peer_id);
++	if (!peer) {
++		spin_unlock_bh(&ab->base_lock);
++		ath11k_warn(ab, "ath11k_nss: unable to free peer mem, peer_id:%d\n",
++			    peer_id);
++		return;
++	}
++
++	dma_unmap_single(ab->dev, peer->nss.paddr,
++			 WIFILI_NSS_PEER_BYTE_SIZE, DMA_FROM_DEVICE);
++
++	kfree(peer->nss.vaddr);
++	if (peer->nss.nss_stats) {
++		kfree(peer->nss.nss_stats);
++		peer->nss.nss_stats = NULL;
++	}
++
++	complete(&peer->nss.complete);
++	spin_unlock_bh(&ab->base_lock);
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS, "nss peer %d mem freed\n", peer_id);
++}
++
++/*-----------------------------Events/Callbacks------------------------------*/
++
++void ath11k_nss_wifili_event_receive(struct ath11k_base *ab, struct nss_wifili_msg *msg)
++{
++	u32 msg_type = msg->cm.type;
++	enum nss_cmn_response response = msg->cm.response;
++	u32 error =  msg->cm.error;
++	u32 peer_id;
++	struct nss_wifili_peer_stats *peer_stats;
++
++	if (!ab)
++		return;
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS, "nss wifili event received %d response %d error %d\n",
++		   msg_type, response, error);
++
++	switch (msg_type) {
++	case NSS_WIFILI_INIT_MSG:
++	case NSS_WIFILI_PDEV_INIT_MSG:
++	case NSS_WIFILI_START_MSG:
++	case NSS_WIFILI_SOC_RESET_MSG:
++	case NSS_WIFILI_STOP_MSG:
++	case NSS_WIFILI_PDEV_DEINIT_MSG:
++		ab->nss.response = response;
++		complete(&ab->nss.complete);
++		break;
++
++	case NSS_WIFILI_PEER_CREATE_MSG:
++		if (response != NSS_CMN_RESPONSE_EMSG)
++			break;
++
++		peer_id = (&msg->msg.peermsg)->peer_id;
++
++		/* free peer memory allocated during peer create due to failure */
++		ath11k_nss_peer_mem_free(ab, peer_id);
++		break;
++	case NSS_WIFILI_PEER_DELETE_MSG:
++		peer_id = (&msg->msg.peermsg)->peer_id;
++
++		if (response == NSS_CMN_RESPONSE_EMSG)
++			ath11k_warn(ab, "ath11k_nss: peer delete failed%d\n",
++				    peer_id);
++
++		/* free peer memory allocated during peer create irrespective of
++		 * delete status
++		 */
++		ath11k_nss_peer_mem_free(ab, peer_id);
++		break;
++	case NSS_WIFILI_PEER_SECURITY_TYPE_MSG:
++		if (response == NSS_CMN_RESPONSE_EMSG)
++			ath11k_warn(ab, "peer securty config failed\n");
++
++		break;
++	case NSS_WIFILI_PEER_UPDATE_AUTH_FLAG:
++		if (response == NSS_CMN_RESPONSE_EMSG)
++			ath11k_warn(ab, "peer authorize config failed\n");
++
++		break;
++	case NSS_WIFILI_STATS_MSG:
++		if (response == NSS_CMN_RESPONSE_EMSG) {
++			ath11k_warn(ab, "soc_dp_stats failed to get updated\n");
++			break;
++		}
++		ath11k_nss_wifili_stats_sync(ab, &msg->msg.wlsoc_stats);
++		break;
++	case NSS_WIFILI_PEER_STATS_MSG:
++		peer_stats = &msg->msg.peer_stats.stats;
++		if (response == NSS_CMN_RESPONSE_EMSG) {
++			ath11k_warn(ab, "peer stats msg failed with error = %u\n", error);
++			break;
++		}
++		ath11k_nss_get_peer_stats(ab, peer_stats);
++		break;
++	case NSS_WIFILI_TID_REOQ_SETUP_MSG:
++		/* TODO setup tidq */
++		break;
++	default:
++		ath11k_dbg(ab, ATH11K_DBG_NSS, "unhandled event %d\n", msg_type);
++		break;
++	}
++}
++
++void ath11k_nss_process_mic_error(struct ath11k_base *ab, struct sk_buff *skb)
++{
++	struct ath11k_vif *arvif;
++	struct ath11k_peer *peer = NULL;
++	struct hal_rx_desc *desc = (struct hal_rx_desc *)skb->data;
++	struct wireless_dev *wdev;
++	u16 peer_id;
++	u8 peer_addr[ETH_ALEN];
++	u8 ucast_keyidx, mcast_keyidx;
++	bool is_mcbc;
++
++	if (!ath11k_dp_rx_h_msdu_end_first_msdu(ab, desc))
++		goto fail;
++
++	is_mcbc = ath11k_dp_rx_h_attn_is_mcbc(ab, desc);
++	peer_id = ath11k_dp_rx_h_mpdu_start_peer_id(ab, desc);
++
++	spin_lock_bh(&ab->base_lock);
++	peer = ath11k_peer_find_by_id(ab, peer_id);
++	if (!peer) {
++		ath11k_info(ab, "ath11k_nss:peer not found");
++		spin_unlock_bh(&ab->base_lock);
++		goto fail;
++	}
++
++	if (!peer->vif) {
++		ath11k_warn(ab, "ath11k_nss:vif not found");
++		spin_unlock_bh(&ab->base_lock);
++		goto fail;
++	}
++
++	ether_addr_copy(peer_addr, peer->addr);
++	mcast_keyidx = peer->mcast_keyidx;
++	ucast_keyidx = peer->ucast_keyidx;
++	arvif = ath11k_vif_to_arvif(peer->vif);
++	spin_unlock_bh(&ab->base_lock);
++
++	if (!arvif->is_started) {
++		ath11k_warn(ab, "ath11k_nss:arvif not started");
++		goto fail;
++	}
++
++	wdev = ieee80211_vif_to_wdev_relaxed(arvif->vif);
++	if (!wdev) {
++		ath11k_warn(ab, "ath11k_nss: wdev is null\n");
++		goto fail;
++	}
++
++	if (!wdev->netdev) {
++		ath11k_warn(ab, "ath11k_nss: netdev is null\n");
++		goto fail;
++	}
++
++	cfg80211_michael_mic_failure(wdev->netdev, peer_addr,
++				     is_mcbc ? NL80211_KEYTYPE_GROUP :
++				     NL80211_KEYTYPE_PAIRWISE,
++				     is_mcbc ? mcast_keyidx : ucast_keyidx,
++				     NULL, GFP_ATOMIC);
++	dev_kfree_skb_any(skb);
++	return;
++
++fail:
++	dev_kfree_skb_any(skb);
++	ath11k_warn(ab, "ath11k_nss: Failed to handle mic error\n");
++	return;
++}
++
++static void
++ath11k_nss_wifili_ext_callback_fn(struct ath11k_base *ab, struct sk_buff *skb,
++				  __attribute__((unused)) struct napi_struct *napi)
++{
++	struct nss_wifili_soc_per_packet_metadata *wepm;
++
++	wepm = (struct nss_wifili_soc_per_packet_metadata *)(skb->head +
++					      NSS_WIFILI_SOC_PER_PACKET_METADATA_OFFSET);
++
++	switch (wepm->pkt_type) {
++	case NSS_WIFILI_SOC_EXT_DATA_PKT_MIC_ERROR:
++		ath11k_nss_process_mic_error(ab, skb);
++		break;
++	default:
++		kfree(skb);
++		break;
++	}
++}
++
++void ath11k_nss_vdev_cfg_cb(void *app_data, struct nss_cmn_msg *msg)
++{
++	struct ath11k_vif *arvif = (struct ath11k_vif *)app_data;
++
++	if (!arvif)
++		return;
++
++	ath11k_dbg(arvif->ar->ab, ATH11K_DBG_NSS, "vdev cfg msg callback received msg:%d rsp:%d\n",
++		   msg->type, msg->response);
++
++	complete(&arvif->nss.complete);
++}
++
++static void ath11k_nss_vdev_event_receive(void *dev, struct nss_cmn_msg *vdev_msg)
++{
++	/*TODO*/
++}
++
++static void
++ath11k_nss_vdev_special_data_receive(struct net_device *dev, struct sk_buff *skb,
++				     __attribute__((unused)) struct napi_struct *napi)
++{
++	/* TODO */
++}
++
++/* TODO: move to mac80211 after cleanups/refactoring required after feature completion */
++static int ath11k_nss_deliver_rx(struct ieee80211_vif *vif, struct sk_buff *skb,
++				 bool eth,  int data_offs, struct napi_struct *napi)
++{
++	struct sk_buff_head subframe_list;
++	struct ieee80211_hdr *hdr;
++	struct sk_buff *subframe;
++	struct net_device *dev;
++	int hdr_len;
++	u8 *qc;
++
++	dev = skb->dev;
++
++	if (eth)
++		goto deliver_msdu;
++
++	hdr = (struct ieee80211_hdr *)skb->data;
++	hdr_len = ieee80211_hdrlen(hdr->frame_control);
++
++	if (ieee80211_is_data_qos(hdr->frame_control)) {
++		qc = ieee80211_get_qos_ctl(hdr);
++		if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
++			goto deliver_amsdu;
++	}
++
++	if (ieee80211_data_to_8023_exthdr(skb, NULL, vif->addr, vif->type,
++					  data_offs - hdr_len, false)) {
++		dev_kfree_skb_any(skb);
++		return -EINVAL;
++	}
++
++deliver_msdu:
++	skb->protocol = eth_type_trans(skb, dev);
++	napi_gro_receive(napi, skb);
++	return 0;
++
++deliver_amsdu:
++	/* Move to the start of the first subframe */
++	skb_pull(skb, data_offs);
++
++	__skb_queue_head_init(&subframe_list);
++
++	/* create list containing all the subframes */
++	ieee80211_amsdu_to_8023s(skb, &subframe_list, NULL,
++				 vif->type, 0, NULL, NULL);
++
++	/* This shouldn't happen, indicating error during defragmentation */
++	if (skb_queue_empty(&subframe_list))
++		return -EINVAL;
++
++	while (!skb_queue_empty(&subframe_list)) {
++		subframe = __skb_dequeue(&subframe_list);
++		subframe->protocol = eth_type_trans(subframe, dev);
++		napi_gro_receive(napi, subframe);
++	}
++
++	return 0;
++}
++
++static int ath11k_nss_undecap_raw(struct ath11k_vif *arvif, struct sk_buff *skb,
++				  int *data_offset)
++{
++	struct ath11k_base *ab = arvif->ar->ab;
++	struct ath11k *ar = arvif->ar;
++	enum hal_encrypt_type enctype;
++	struct ath11k_peer *peer = NULL;
++	struct ieee80211_hdr *hdr;
++	int hdr_len;
++
++	hdr = (struct ieee80211_hdr *)skb->data;
++	hdr_len = ieee80211_hdrlen(hdr->frame_control);
++
++	*data_offset = hdr_len;
++
++	/* FCS is included in the raw mode skb, we can trim it, fcs error
++	 * packets are not expected to be received in this path
++	 */
++	skb_trim(skb, skb->len - FCS_LEN);
++
++	spin_lock_bh(&ab->base_lock);
++
++	peer = ath11k_peer_find_by_addr(ab, hdr->addr2);
++	if (!peer) {
++		ath11k_warn(ab, "peer not found for raw/nwifi undecap, drop this packet\n");
++		spin_unlock_bh(&ab->base_lock);
++		return -EINVAL;
++	}
++	enctype = peer->sec_type;
++
++	spin_unlock_bh(&ab->base_lock);
++
++	*data_offset += ath11k_dp_rx_crypto_param_len(ar, enctype);
++
++	/* Strip ICV, MIC, MMIC */
++	skb_trim(skb, skb->len -
++		 ath11k_dp_rx_crypto_mic_len(ar, enctype));
++
++	skb_trim(skb, skb->len -
++		 ath11k_dp_rx_crypto_icv_len(ar, enctype));
++
++	if (enctype == HAL_ENCRYPT_TYPE_TKIP_MIC)
++		skb_trim(skb, skb->len - IEEE80211_CCMP_MIC_LEN);
++
++	return 0;
++}
++
++static int ath11k_nss_undecap_nwifi(struct ath11k_vif *arvif, struct sk_buff *skb,
++				    int *data_offset)
++{
++	struct ieee80211_hdr *hdr;
++	int hdr_len;
++
++	hdr = (struct ieee80211_hdr *)skb->data;
++	hdr_len = ieee80211_hdrlen(hdr->frame_control);
++
++	*data_offset = hdr_len;
++
++	/* We dont receive the IV from nss host on slow path
++	 * hence we can return only the header length as offset.
++	 **/
++	return 0;
++}
++
++static void
++ath11k_nss_vdev_data_receive(struct net_device *dev, struct sk_buff *skb,
++			     __attribute__((unused)) struct napi_struct *napi)
++{
++	enum ath11k_hw_txrx_mode decap_type;
++	struct wireless_dev *wdev;
++	struct ieee80211_vif *vif;
++	struct ath11k_vif *arvif;
++	struct ath11k_base *ab;
++	bool eth_decap = false;
++	int data_offs = 0;
++	int ret;
++
++	if (!dev) {
++		dev_kfree_skb_any(skb);
++		return;
++	}
++
++	wdev = dev->ieee80211_ptr;
++	if (!wdev) {
++		dev_kfree_skb_any(skb);
++		return;
++	}
++
++	vif = wdev_to_ieee80211_vif(wdev);
++	if (!vif) {
++		dev_kfree_skb_any(skb);
++		return;
++	}
++
++	arvif = (struct ath11k_vif *)vif->drv_priv;
++	if (!arvif) {
++		dev_kfree_skb_any(skb);
++		return;
++	}
++
++	ab = arvif->ar->ab;
++
++	skb->dev = dev;
++
++	/* log the original skb received from nss */
++	ath11k_dbg_dump(ab, ATH11K_DBG_DP_RX, "", "dp rx msdu from nss: ",
++			skb->data, skb->len);
++
++	decap_type = arvif->nss.decap;
++
++	switch (decap_type) {
++	case ATH11K_HW_TXRX_RAW:
++		ret = ath11k_nss_undecap_raw(arvif, skb, &data_offs);
++		break;
++	case ATH11K_HW_TXRX_NATIVE_WIFI:
++		ret = ath11k_nss_undecap_nwifi(arvif, skb, &data_offs);
++		break;
++	case ATH11K_HW_TXRX_ETHERNET:
++		/* no changes required for ethernet decap */
++		ret = 0;
++		eth_decap = true;
++		break;
++	default:
++		ret = -EINVAL;
++		break;
++	}
++
++	if (ret) {
++		ath11k_warn(ab, "error in nss rx undecap, type %d err %d\n", decap_type,
++			    ret);
++		dev_kfree_skb_any(skb);
++		return;
++	}
++
++	ath11k_nss_deliver_rx(arvif->vif, skb, eth_decap, data_offs, napi);
++}
++
++int ath11k_nss_tx(struct ath11k_vif *arvif, struct sk_buff *skb)
++{
++	struct ath11k *ar = arvif->ar;
++	nss_tx_status_t status;
++	int encap_type = ath11k_dp_tx_get_encap_type(arvif, skb);
++	struct ath11k_soc_dp_stats *soc_stats = &ar->ab->soc_stats;
++
++	if (!arvif->ar->ab->nss.debug_mode && encap_type != arvif->nss.encap) {
++		ath11k_warn(ar->ab, "encap mismatch in nss tx skb encap type %d" \
++			    " vif encap type %d\n", encap_type, arvif->nss.encap);
++		goto drop;
++	}
++
++	if (encap_type == HAL_TCL_ENCAP_TYPE_ETHERNET)
++		goto send;
++
++	if (encap_type == HAL_TCL_ENCAP_TYPE_RAW)
++		ath11k_nss_tx_encap_raw(skb);
++	else
++		ath11k_nss_tx_encap_nwifi(skb);
++
++send:
++	ath11k_dbg_dump(ar->ab, ATH11K_DBG_DP_TX, "", "nss tx msdu: ",
++			skb->data, skb->len);
++
++	status = nss_wifi_vdev_tx_buf(arvif->ar->nss.ctx, skb, arvif->nss.if_num);
++
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_dbg(ar->ab, (ATH11K_DBG_NSS | ATH11K_DBG_DP_TX),
++			   "nss tx failure: %d\n", status);
++		atomic_inc(&soc_stats->tx_err.nss_tx_fail);
++	}
++
++	return status;
++drop:
++	atomic_inc(&soc_stats->tx_err.misc_fail);
++	WARN_ON_ONCE(1);
++	return -EINVAL;
++}
++
++int ath11k_nss_vdev_set_cmd(struct ath11k_vif *arvif, int cmd, int val)
++{
++	struct nss_wifi_vdev_msg *vdev_msg = NULL;
++	struct nss_wifi_vdev_cmd_msg *vdev_cmd;
++	struct ath11k *ar = arvif->ar;
++	nss_tx_status_t status;
++
++	if (!ar->ab->nss.enabled)
++		return 0;
++
++	/* Monitor interface is not offloaded to nss */
++	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR)
++		return 0;
++
++	vdev_msg = kzalloc(sizeof(*vdev_msg), GFP_ATOMIC);
++	if (!vdev_msg)
++		return -ENOMEM;
++
++	/* TODO: Convert to function for conversion in case of many
++	 * such commands
++	 */
++	if (cmd == NSS_WIFI_VDEV_SECURITY_TYPE_CMD)
++		val = ath11k_nss_cipher_type(ar->ab, val);
++
++	if (cmd == NSS_WIFI_VDEV_ENCAP_TYPE_CMD)
++		arvif->nss.encap = val;
++	else if (cmd == NSS_WIFI_VDEV_DECAP_TYPE_CMD)
++		arvif->nss.decap = val;
++
++	vdev_cmd = &vdev_msg->msg.vdev_cmd;
++	vdev_cmd->cmd = cmd;
++	vdev_cmd->value = val;
++
++	nss_wifi_vdev_msg_init(vdev_msg, arvif->nss.if_num,
++			       NSS_WIFI_VDEV_INTERFACE_CMD_MSG,
++			       sizeof(struct nss_wifi_vdev_cmd_msg),
++			       NULL, NULL);
++
++	status = nss_wifi_vdev_tx_msg(ar->nss.ctx, vdev_msg);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ar->ab, "nss vdev set cmd failure cmd:%d val:%d",
++			    cmd, val);
++		goto free;
++	}
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_NSS, "nss vdev set cmd success cmd:%d val:%d\n",
++		   cmd, val);
++free:
++	kfree(vdev_msg);
++	return status;
++}
++
++static int ath11k_nss_vdev_configure(struct ath11k_vif *arvif)
++{
++	struct ath11k *ar = arvif->ar;
++	struct nss_wifi_vdev_msg *vdev_msg;
++	struct nss_wifi_vdev_config_msg *vdev_cfg;
++	nss_tx_status_t status;
++	int ret;
++
++	vdev_msg = kzalloc(sizeof(struct nss_wifi_vdev_msg), GFP_ATOMIC);
++	if (!vdev_msg)
++		return -ENOMEM;
++
++	vdev_cfg = &vdev_msg->msg.vdev_config;
++
++	vdev_cfg->radio_ifnum = ar->nss.if_num;
++	vdev_cfg->vdev_id = arvif->vdev_id;
++
++	vdev_cfg->opmode = ath11k_nss_get_vdev_opmode(arvif);
++
++	ether_addr_copy(vdev_cfg->mac_addr, arvif->vif->addr);
++
++	reinit_completion(&arvif->nss.complete);
++
++	nss_wifi_vdev_msg_init(vdev_msg, arvif->nss.if_num,
++			       NSS_WIFI_VDEV_INTERFACE_CONFIGURE_MSG,
++			       sizeof(struct nss_wifi_vdev_config_msg),
++			       (nss_wifi_vdev_msg_callback_t *)ath11k_nss_vdev_cfg_cb,
++			       arvif);
++
++	status = nss_wifi_vdev_tx_msg(ar->nss.ctx, vdev_msg);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ar->ab, "failed to configure nss vdev nss_err:%d\n",
++			    status);
++		ret = -EINVAL;
++		goto free;
++	}
++
++	ret = wait_for_completion_timeout(&arvif->nss.complete,
++					  msecs_to_jiffies(ATH11K_NSS_MSG_TIMEOUT_MS));
++	if (!ret) {
++		ath11k_warn(ar->ab, "timeout in receiving nss vdev cfg response\n");
++		ret = -ETIMEDOUT;
++		goto free;
++	}
++
++	ret = 0;
++free:
++	kfree(vdev_msg);
++
++	return ret;
++}
++
++static void ath11k_nss_vdev_unregister(struct ath11k_vif *arvif)
++{
++	struct ath11k_base *ab = arvif->ar->ab;
++
++	switch (arvif->vif->type) {
++	case NL80211_IFTYPE_AP:
++	case NL80211_IFTYPE_STATION:
++		nss_unregister_wifi_vdev_if(arvif->nss.if_num);
++		ath11k_dbg(ab, ATH11K_DBG_NSS, "unregistered nss vdev %d \n",
++			   arvif->nss.if_num);
++		break;
++	default:
++		ath11k_warn(ab, "unsupported interface type %d for nss vdev unregister\n",
++			    arvif->vif->type);
++		return;
++	}
++}
++
++static int ath11k_nss_vdev_register(struct ath11k_vif *arvif,
++				    struct net_device *netdev)
++{
++	struct ath11k *ar = arvif->ar;
++	struct ath11k_base *ab = ar->ab;
++	nss_tx_status_t status;
++	u32 features = 0;
++
++	switch (arvif->vif->type) {
++	case NL80211_IFTYPE_AP:
++	case NL80211_IFTYPE_STATION:
++		status = nss_register_wifi_vdev_if(ar->nss.ctx,
++					arvif->nss.if_num,
++					ath11k_nss_vdev_data_receive,
++					ath11k_nss_vdev_special_data_receive,
++					ath11k_nss_vdev_event_receive,
++					netdev, features);
++		if (status != NSS_TX_SUCCESS) {
++			ath11k_warn(ab, "failed to register nss vdev if_num %d nss_err:%d\n",
++				    arvif->nss.if_num, status);
++			return -EINVAL;
++		}
++
++		ath11k_dbg(ab, ATH11K_DBG_NSS, "registered nss vdev if_num %d\n",
++			   arvif->nss.if_num);
++
++		break;
++	default:
++		ath11k_warn(ab, "unsupported interface type %d for nss vdev register\n",
++			    arvif->vif->type);
++		return -ENOTSUPP;
++	}
++
++	return 0;
++}
++
++void ath11k_nss_vdev_free(struct ath11k_vif *arvif)
++{
++	struct ath11k_base *ab = arvif->ar->ab;
++	nss_tx_status_t status;
++
++	switch (arvif->vif->type) {
++	case NL80211_IFTYPE_AP:
++	case NL80211_IFTYPE_STATION:
++		status = nss_dynamic_interface_dealloc_node(
++						arvif->nss.if_num,
++						NSS_DYNAMIC_INTERFACE_TYPE_VAP);
++		if (status != NSS_TX_SUCCESS)
++			ath11k_warn(ab, "failed to free nss vdev nss_err:%d\n",
++				    status);
++		else
++			ath11k_dbg(ab, ATH11K_DBG_NSS,
++				   "nss vdev interface deallocated\n");
++
++		return;
++	default:
++		ath11k_warn(ab, "unsupported interface type %d for nss vdev dealloc\n",
++			    arvif->vif->type);
++		return;
++	}
++}
++
++static int ath11k_nss_vdev_alloc(struct ath11k_vif *arvif)
++{
++	struct ath11k_base *ab = arvif->ar->ab;
++	enum nss_dynamic_interface_type if_type;
++	int if_num;
++
++	/* Initialize completion for verifying NSS message response */
++	init_completion(&arvif->nss.complete);
++
++	switch (arvif->vif->type) {
++	case NL80211_IFTYPE_AP:
++	case NL80211_IFTYPE_STATION:
++		if_type = NSS_DYNAMIC_INTERFACE_TYPE_VAP;
++		/* allocate interface context with NSS driver for the new vdev */
++		if_num = nss_dynamic_interface_alloc_node(if_type);
++		if (if_num < 0) {
++			ath11k_warn(ab, "failed to allocate nss vdev\n");
++			return -EINVAL;
++		}
++
++		arvif->nss.if_num = if_num;
++
++		ath11k_dbg(ab, ATH11K_DBG_NSS, "allocated nss vdev if_num %d\n",
++			   arvif->nss.if_num);
++
++		break;
++	default:
++		ath11k_warn(ab, "unsupported interface type %d for nss vdev alloc\n",
++			    arvif->vif->type);
++		return -ENOTSUPP;
++	}
++
++	return 0;
++}
++
++int ath11k_nss_vdev_create(struct ath11k_vif *arvif)
++{
++	struct ath11k *ar = arvif->ar;
++	struct ath11k_base *ab = ar->ab;
++	struct wireless_dev *wdev;
++	int ret;
++
++	if (!ab->nss.enabled)
++		return 0;
++
++	/* Monitor interface is not offloaded to nss */
++	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR)
++		return 0;
++
++	if (arvif->nss.created)
++		return 0;
++
++	wdev = ieee80211_vif_to_wdev_relaxed(arvif->vif);
++	if (!wdev) {
++		ath11k_warn(ab, "ath11k_nss: wdev is null\n");
++		return -EINVAL;
++	}
++
++	if (!wdev->netdev) {
++		ath11k_warn(ab, "ath11k_nss: netdev is null\n");
++		return -EINVAL;
++	}
++
++	ret = ath11k_nss_vdev_alloc(arvif);
++	if (ret)
++		return ret;
++
++	ret = ath11k_nss_vdev_register(arvif, wdev->netdev);
++	if (ret)
++		goto free_vdev;
++
++	switch (arvif->vif->type) {
++	case NL80211_IFTYPE_AP:
++	case NL80211_IFTYPE_STATION:
++		ret = ath11k_nss_vdev_configure(arvif);
++		if (ret)
++			goto unregister_vdev;
++
++		break;
++	default:
++		ret = -ENOTSUPP;
++		goto unregister_vdev;
++	}
++
++	arvif->nss.created = true;
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS,
++		   "nss vdev interface created ctx %pK, ifnum %d\n",
++		   ar->nss.ctx, arvif->nss.if_num);
++
++	return ret;
++
++unregister_vdev:
++	ath11k_nss_vdev_unregister(arvif);
++free_vdev:
++	ath11k_nss_vdev_free(arvif);
++
++	return ret;
++}
++
++void ath11k_nss_vdev_delete(struct ath11k_vif *arvif)
++{
++	if (!arvif->ar->ab->nss.enabled)
++		return;
++
++	/* Monitor interface is not offloaded to nss */
++	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR)
++		return;
++
++	if (!arvif->nss.created)
++		return;
++
++	ath11k_nss_vdev_unregister(arvif);
++
++	ath11k_nss_vdev_free(arvif);
++
++	arvif->nss.created = false;
++}
++
++int ath11k_nss_vdev_up(struct ath11k_vif *arvif)
++{
++	struct nss_wifi_vdev_msg *vdev_msg = NULL;
++	struct nss_wifi_vdev_enable_msg *vdev_en;
++	struct ath11k *ar = arvif->ar;
++	nss_tx_status_t status;
++	int ret = 0;
++
++	if (!ar->ab->nss.enabled)
++		return 0;
++
++	/* Monitor interface is not offloaded to nss */
++	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR)
++		return 0;
++
++	vdev_msg = kzalloc(sizeof(struct nss_wifi_vdev_msg), GFP_ATOMIC);
++	if (!vdev_msg)
++		return -ENOMEM;
++
++	vdev_en = &vdev_msg->msg.vdev_enable;
++
++	ether_addr_copy(vdev_en->mac_addr, arvif->vif->addr);
++
++	nss_wifi_vdev_msg_init(vdev_msg, arvif->nss.if_num,
++			       NSS_WIFI_VDEV_INTERFACE_UP_MSG,
++			       sizeof(struct nss_wifi_vdev_enable_msg),
++			       NULL, NULL);
++
++	status = nss_wifi_vdev_tx_msg(ar->nss.ctx, vdev_msg);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ar->ab, "nss vdev up tx msg error %d\n", status);
++		ret = -EINVAL;
++		goto free;
++	}
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_NSS, "nss vdev up tx msg success\n");
++free:
++	kfree(vdev_msg);
++	return ret;
++}
++
++int ath11k_nss_vdev_down(struct ath11k_vif *arvif)
++{
++	struct nss_wifi_vdev_msg *vdev_msg = NULL;
++	struct ath11k *ar = arvif->ar;
++	nss_tx_status_t status;
++	int ret = 0;
++
++	if (!ar->ab->nss.enabled)
++		return 0;
++
++	/* Monitor interface is not offloaded to nss */
++	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR)
++		return 0;
++
++	vdev_msg = kzalloc(sizeof(struct nss_wifi_vdev_msg), GFP_ATOMIC);
++	if (!vdev_msg)
++		return -ENOMEM;
++
++	nss_wifi_vdev_msg_init(vdev_msg, arvif->nss.if_num,
++			       NSS_WIFI_VDEV_INTERFACE_DOWN_MSG,
++			       sizeof(struct nss_wifi_vdev_disable_msg),
++			       NULL, NULL);
++
++	status = nss_wifi_vdev_tx_msg(ar->nss.ctx, vdev_msg);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ar->ab, "nss vdev down tx msg error %d\n", status);
++		ret = -EINVAL;
++		goto free;
++	}
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_NSS, "nss vdev down tx msg success\n");
++free:
++	kfree(vdev_msg);
++	return ret;
++}
++
++/*----------------------------Peer Setup/Config -----------------------------*/
++
++int ath11k_nss_set_peer_sec_type(struct ath11k *ar,
++				 struct ath11k_peer *peer,
++				 struct ieee80211_key_conf *key_conf)
++{
++	struct nss_wifili_peer_security_type_msg *sec_msg;
++	nss_wifili_msg_callback_t msg_cb;
++	struct nss_wifili_msg *wlmsg;
++	nss_tx_status_t status;
++	u8 *mic_key;
++
++	if (!ar->ab->nss.enabled)
++		return 0;
++
++	wlmsg = kzalloc(sizeof(struct nss_wifili_msg), GFP_ATOMIC);
++	if (!wlmsg)
++		return -ENOMEM;
++
++	sec_msg = &wlmsg->msg.securitymsg;
++	sec_msg->peer_id = peer->peer_id;
++
++	/* 0 -unicast , 1 - mcast/unicast */
++	sec_msg->pkt_type = !(key_conf->flags & IEEE80211_KEY_FLAG_PAIRWISE);
++
++	sec_msg->security_type = ath11k_nss_cipher_type(ar->ab,
++							key_conf->cipher);
++
++	if (sec_msg->security_type == PEER_SEC_TYPE_TKIP) {
++		mic_key = &key_conf->key[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY];
++		memcpy(&sec_msg->mic_key[0], mic_key, NSS_WIFILI_MIC_KEY_LEN);
++	}
++
++	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++
++	nss_cmn_msg_init(&wlmsg->cm, ar->ab->nss.if_num,
++			 NSS_WIFILI_PEER_SECURITY_TYPE_MSG,
++			 sizeof(struct nss_wifili_peer_security_type_msg),
++			 msg_cb, NULL);
++
++	status = nss_wifili_tx_msg(ar->nss.ctx, wlmsg);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ar->ab, "nss peer %d security cfg fail %d\n",
++			    peer->peer_id, status);
++		goto free;
++	}
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_NSS, "nss peer id %d security cfg complete\n",
++		   peer->peer_id);
++free:
++	kfree(wlmsg);
++	return status;
++}
++
++int ath11k_nss_set_peer_authorize(struct ath11k *ar, u16 peer_id)
++{
++	struct nss_wifili_peer_update_auth_flag *auth_msg;
++	nss_wifili_msg_callback_t msg_cb;
++	struct nss_wifili_msg *wlmsg;
++	nss_tx_status_t status;
++
++	if (!ar->ab->nss.enabled)
++		return 0;
++
++	wlmsg = kzalloc(sizeof(struct nss_wifili_msg), GFP_ATOMIC);
++	if (!wlmsg)
++		return -ENOMEM;
++
++	auth_msg = &wlmsg->msg.peer_auth;
++	auth_msg->peer_id = peer_id;
++	auth_msg->auth_flag = 1;
++
++	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++
++	nss_cmn_msg_init(&wlmsg->cm, ar->ab->nss.if_num,
++			 NSS_WIFILI_PEER_UPDATE_AUTH_FLAG,
++			 sizeof(struct nss_wifili_peer_update_auth_flag),
++			 msg_cb, NULL);
++
++	status = nss_wifili_tx_msg(ar->nss.ctx, wlmsg);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ar->ab, "nss peer %d auth cfg fail %d\n",
++			    peer_id, status);
++		goto free;
++	}
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_NSS, "nss peer id %d auth cfg complete\n",
++		   peer_id);
++free:
++	kfree(wlmsg);
++	return status;
++}
++
++void ath11k_nss_update_sta_stats(struct station_info *sinfo,
++				 struct ieee80211_sta *sta,
++				 struct ath11k_sta *arsta)
++{
++	struct sta_info *stainfo;
++	struct ath11k_peer *peer;
++	int tid_idx;
++	struct ath11k *ar = arsta->arvif->ar;
++	struct ath11k_base *ab = ar->ab;
++
++	if (!ab->nss.enabled)
++		return;
++
++	spin_lock_bh(&ab->base_lock);
++	peer = ath11k_peer_find_by_addr(arsta->arvif->ar->ab, sta->addr);
++	if (!peer) {
++		ath11k_dbg(ab, ATH11K_DBG_NSS, "unable to find peer %pM\n",
++					sta->addr);
++		goto exit;
++	}
++
++	if (!peer->nss.nss_stats)
++		goto exit;
++
++	stainfo = container_of(sta, struct sta_info, sta);
++	if (peer->nss.nss_stats->last_rx &&
++			time_after((unsigned long)peer->nss.nss_stats->last_rx, stainfo->deflink.rx_stats.last_rx))
++		stainfo->deflink.rx_stats.last_rx = peer->nss.nss_stats->last_rx;
++
++	if (peer->nss.nss_stats->last_ack &&
++			time_after((unsigned long)peer->nss.nss_stats->last_ack, stainfo->deflink.status_stats.last_ack))
++		stainfo->deflink.status_stats.last_ack = peer->nss.nss_stats->last_ack;
++
++	stainfo->deflink.rx_stats.dropped += peer->nss.nss_stats->rx_dropped -
++		peer->nss.nss_stats->last_rxdrop;
++	peer->nss.nss_stats->last_rxdrop = peer->nss.nss_stats->rx_dropped;
++
++	sinfo->tx_packets = 0;
++	/* Add only ac-0 count as mgmt packets uses WME_AC_BE */
++	sinfo->tx_packets += stainfo->deflink.tx_stats.packets[WME_AC_BE];
++	sinfo->tx_packets += peer->nss.nss_stats->tx_packets;
++	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
++	sinfo->tx_bytes = 0;
++
++	/* Add only ac-0 count as mgmt packets uses WME_AC_BE */
++	sinfo->tx_bytes += stainfo->deflink.tx_stats.bytes[WME_AC_BE];
++	sinfo->tx_bytes += peer->nss.nss_stats->tx_bytes;
++	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES);
++
++	sinfo->tx_failed = stainfo->deflink.status_stats.retry_failed +
++		peer->nss.nss_stats->tx_failed;
++	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
++
++	sinfo->tx_retries = stainfo->deflink.status_stats.retry_count +
++		peer->nss.nss_stats->tx_retries;
++	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
++
++	sinfo->rx_packets = stainfo->deflink.rx_stats.packets +
++		peer->nss.nss_stats->rx_packets;
++	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS);
++
++	sinfo->rx_bytes = stainfo->deflink.rx_stats.bytes +
++		peer->nss.nss_stats->rx_bytes;
++	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES);
++
++	if (peer->nss.nss_stats->rxrate.legacy || peer->nss.nss_stats->rxrate.nss) {
++		if (peer->nss.nss_stats->rxrate.legacy) {
++			sinfo->rxrate.legacy = peer->nss.nss_stats->rxrate.legacy;
++		} else {
++			sinfo->rxrate.mcs = peer->nss.nss_stats->rxrate.mcs;
++			sinfo->rxrate.nss = peer->nss.nss_stats->rxrate.nss;
++			sinfo->rxrate.bw = peer->nss.nss_stats->rxrate.bw;
++			sinfo->rxrate.he_gi = peer->nss.nss_stats->rxrate.he_gi;
++			sinfo->rxrate.he_dcm = peer->nss.nss_stats->rxrate.he_dcm;
++			sinfo->rxrate.he_ru_alloc = peer->nss.nss_stats->rxrate.he_ru_alloc;
++		}
++		sinfo->rxrate.flags = peer->nss.nss_stats->rxrate.flags;
++		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
++	}
++
++exit:
++	spin_unlock_bh(&ab->base_lock);
++}
++
++void ath11k_nss_update_sta_rxrate(struct hal_rx_mon_ppdu_info *ppdu_info,
++				  struct ath11k_peer *peer,
++				  struct hal_rx_user_status *user_stats)
++{
++	struct ath11k_sta *arsta = (struct ath11k_sta *)peer->sta->drv_priv;
++	u16 ath11k_hal_rx_legacy_rates[] =
++	{ 10, 20, 55, 60, 90, 110, 120, 180, 240, 360, 480, 540 };
++	u16 rate = 0;
++	u32 preamble_type;
++	u8 mcs, nss;
++	struct ath11k *ar = arsta->arvif->ar;
++	struct ath11k_base *ab = ar->ab;
++
++	if (!ab->nss.enabled)
++		return;
++
++	if (!peer->nss.nss_stats)
++		return;
++
++	if (user_stats) {
++		mcs = user_stats->mcs;
++		nss = user_stats->nss;
++		preamble_type = user_stats->preamble_type;
++	} else {
++		mcs = ppdu_info->mcs;
++		nss = ppdu_info->nss;
++		preamble_type = ppdu_info->preamble_type;
++	}
++
++        if ((preamble_type == WMI_RATE_PREAMBLE_CCK ||
++                preamble_type == WMI_RATE_PREAMBLE_OFDM) &&
++                (ppdu_info->rate < ATH11K_LEGACY_NUM)) {
++		rate = ath11k_hal_rx_legacy_rates[ppdu_info->rate];
++	}
++
++	memset(&peer->nss.nss_stats->rxrate, 0, sizeof(peer->nss.nss_stats->rxrate));
++
++	switch (preamble_type) {
++	case WMI_RATE_PREAMBLE_OFDM:
++		peer->nss.nss_stats->rxrate.legacy = rate;
++		break;
++	case WMI_RATE_PREAMBLE_CCK:
++		peer->nss.nss_stats->rxrate.legacy = rate;
++		break;
++	case WMI_RATE_PREAMBLE_HT:
++		if (mcs >= ATH11K_HT_MCS_NUM) {
++			ath11k_dbg(ar->ab, ATH11K_DBG_NSS,
++				    "Received invalid mcs in HT mode %d\n", mcs);
++			return;
++		}
++		peer->nss.nss_stats->rxrate.mcs = mcs;
++		peer->nss.nss_stats->rxrate.flags = RATE_INFO_FLAGS_MCS;
++		if (ppdu_info->gi)
++			peer->nss.nss_stats->rxrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
++		break;
++	case WMI_RATE_PREAMBLE_VHT:
++		if (mcs > ATH11K_VHT_MCS_MAX) {
++			ath11k_dbg(ar->ab, ATH11K_DBG_NSS,
++				    "Received invalid mcs in VHT mode %d\n", mcs);
++			return;
++		}
++		peer->nss.nss_stats->rxrate.mcs = mcs;
++		peer->nss.nss_stats->rxrate.flags = RATE_INFO_FLAGS_VHT_MCS;
++		if (ppdu_info->gi)
++			peer->nss.nss_stats->rxrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
++		break;
++	case WMI_RATE_PREAMBLE_HE:
++		if (mcs > ATH11K_HE_MCS_MAX) {
++			ath11k_dbg(ar->ab, ATH11K_DBG_NSS,
++				    "Received invalid mcs in HE mode %d\n", mcs);
++			return;
++		}
++		peer->nss.nss_stats->rxrate.mcs = mcs;
++		peer->nss.nss_stats->rxrate.flags = RATE_INFO_FLAGS_HE_MCS;
++		peer->nss.nss_stats->rxrate.he_dcm = ppdu_info->dcm;
++		peer->nss.nss_stats->rxrate.he_gi = ath11k_he_gi_to_nl80211_he_gi(ppdu_info->gi);
++		peer->nss.nss_stats->rxrate.he_ru_alloc = ppdu_info->ru_alloc;
++		break;
++	}
++
++	peer->nss.nss_stats->rxrate.nss = nss;
++	peer->nss.nss_stats->rxrate.bw = ath11k_mac_bw_to_mac80211_bw(ppdu_info->bw);
++}
++
++int ath11k_nss_peer_delete(struct ath11k_base *ab, const u8 *addr)
++{
++	struct nss_wifili_peer_msg *peer_msg;
++	struct nss_wifili_msg *wlmsg = NULL;
++	struct ath11k_peer *peer;
++	nss_wifili_msg_callback_t msg_cb;
++	nss_tx_status_t status;
++	int ret;
++
++	if (!ab->nss.enabled)
++		return 0;
++
++	spin_lock_bh(&ab->base_lock);
++
++	peer = ath11k_peer_find_by_addr(ab, addr);
++	if (!peer) {
++		ath11k_warn(ab, "peer (%pM) not found for nss peer delete\n", addr);
++		spin_unlock_bh(&ab->base_lock);
++		return -EINVAL;
++	}
++
++	if (!peer->nss.vaddr) {
++		ath11k_warn(ab, "peer already deleted or peer create failed %pM\n",
++			    addr);
++		spin_unlock_bh(&ab->base_lock);
++		return -EINVAL;
++	}
++
++	wlmsg = kzalloc(sizeof(struct nss_wifili_msg), GFP_ATOMIC);
++	if (!wlmsg) {
++		ath11k_warn(ab, "nss send peer delete msg alloc failure\n");
++		ret = -ENOMEM;
++		goto free_peer;
++	}
++
++	peer_msg = &wlmsg->msg.peermsg;
++
++	peer_msg->vdev_id = peer->vdev_id;
++	peer_msg->peer_id = peer->peer_id;
++
++	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++
++	nss_cmn_msg_init(&wlmsg->cm, ab->nss.if_num,
++			 NSS_WIFILI_PEER_DELETE_MSG,
++			 sizeof(struct nss_wifili_peer_msg),
++			 msg_cb, NULL);
++
++	reinit_completion(&peer->nss.complete);
++
++	status = nss_wifili_tx_msg(ab->nss.ctx, wlmsg);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ab, "nss send peer (%pM) delete msg tx error %d\n",
++			    addr, status);
++		ret = -EINVAL;
++		kfree(wlmsg);
++		goto free_peer;
++	} else {
++		ath11k_dbg(ab, ATH11K_DBG_NSS, "nss peer delete message success : peer_id %d\n",
++			   peer->peer_id);
++		ret = 0;
++	}
++
++	spin_unlock_bh(&ab->base_lock);
++
++	kfree(wlmsg);
++
++	/* No need to return failure or free up here, since the msg was tx succesfully
++	 * the peer delete response would be received from NSS which will free up
++	 * the allocated memory
++	 */
++	ret = wait_for_completion_timeout(&peer->nss.complete,
++					  msecs_to_jiffies(ATH11K_NSS_MSG_TIMEOUT_MS));
++	if (!ret)
++		ath11k_warn(ab, "timeout while waiting for nss peer delete msg response\n");
++
++	return 0;
++
++free_peer:
++	dma_unmap_single(ab->dev, peer->nss.paddr,
++		 WIFILI_NSS_PEER_BYTE_SIZE, DMA_FROM_DEVICE);
++	kfree(peer->nss.vaddr);
++	if (peer->nss.nss_stats) {
++		kfree(peer->nss.nss_stats);
++		peer->nss.nss_stats = NULL;
++	}
++	spin_unlock_bh(&ab->base_lock);
++	return ret;
++}
++
++int ath11k_nss_peer_create(struct ath11k_base *ab, struct ath11k_peer *peer)
++{
++	struct nss_wifili_peer_msg *peer_msg;
++	struct nss_wifili_msg *wlmsg = NULL;
++	nss_wifili_msg_callback_t msg_cb;
++	nss_tx_status_t status;
++	int ret;
++
++	if (!ab->nss.enabled)
++		return -ENOTSUPP;
++
++	wlmsg = kzalloc(sizeof(struct nss_wifili_msg), GFP_ATOMIC);
++	if (!wlmsg)
++		return -ENOMEM;
++
++	peer_msg = &wlmsg->msg.peermsg;
++
++	peer_msg->vdev_id = peer->vdev_id;
++	peer_msg->peer_id = peer->peer_id;
++	peer_msg->hw_ast_idx = peer->hw_peer_id;
++	peer_msg->tx_ast_hash = peer->ast_hash;
++	ether_addr_copy(peer_msg->peer_mac_addr, peer->addr);
++
++	peer->nss.vaddr = kzalloc(WIFILI_NSS_PEER_BYTE_SIZE, GFP_ATOMIC);
++
++	/* Initialize completion for verifying Peer NSS message response */
++	init_completion(&peer->nss.complete);
++
++	if (!peer->nss.vaddr) {
++		ath11k_warn(ab, "failed to allocate memory for nss peer info\n");
++		kfree(wlmsg);
++		return -ENOMEM;
++	}
++
++	peer->nss.paddr = dma_map_single(ab->dev, peer->nss.vaddr,
++					 WIFILI_NSS_PEER_BYTE_SIZE, DMA_TO_DEVICE);
++
++	ret = dma_mapping_error(ab->dev, peer->nss.paddr);
++	if (ret) {
++		ath11k_warn(ab, "error during nss peer info  memalloc\n");
++		kfree(peer->nss.vaddr);
++		ret = -ENOMEM;
++		goto msg_free;
++	}
++
++	peer_msg->nss_peer_mem = peer->nss.paddr;
++	peer_msg->psta_vdev_id = peer->vdev_id;
++
++	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++
++	nss_cmn_msg_init(&wlmsg->cm, ab->nss.if_num,
++			 NSS_WIFILI_PEER_CREATE_MSG,
++			 sizeof(struct nss_wifili_peer_msg),
++			 msg_cb, NULL);
++
++	status = nss_wifili_tx_msg(ab->nss.ctx, wlmsg);
++	if (status != NSS_TX_SUCCESS) {
++		ret = -EINVAL;
++		ath11k_warn(ab, "nss send peer (%pM) create msg tx error\n",
++			    peer->addr);
++		goto peer_mem_free;
++	}
++
++	ret = 0;
++	ath11k_dbg(ab, ATH11K_DBG_NSS,
++		   "nss peer_create msg success mac:%pM vdev:%d peer_id:%d hw_ast_idx:%d ast_hash:%d\n",
++		   peer_msg->peer_mac_addr, peer_msg->vdev_id, peer_msg->peer_id,
++		   peer_msg->hw_ast_idx, peer_msg->tx_ast_hash);
++
++	peer->nss.nss_stats = kzalloc(sizeof(*peer->nss.nss_stats), GFP_ATOMIC);
++	if (!peer->nss.nss_stats) {
++		ret = -ENOMEM;
++		ath11k_warn(ab, "Unable to create nss stats memory\n");
++		goto peer_mem_free;
++	}
++
++	goto msg_free;
++
++peer_mem_free:
++	dma_unmap_single(ab->dev, peer->nss.paddr,
++			 WIFILI_NSS_PEER_BYTE_SIZE, DMA_FROM_DEVICE);
++	kfree(peer->nss.vaddr);
++msg_free:
++	kfree(wlmsg);
++	return ret;
++}
++
++/*-------------------------------INIT/DEINIT---------------------------------*/
++
++static int ath11k_nss_radio_buf_cfg(struct ath11k *ar, int range, int buf_sz)
++{
++	struct nss_wifili_radio_buf_cfg_msg *buf_cfg;
++	struct nss_wifili_radio_cfg_msg *radio_buf_cfg_msg;
++	struct nss_wifili_msg *wlmsg = NULL;
++	nss_tx_status_t status;
++	int ret = 0;
++
++	wlmsg = kzalloc(sizeof(struct nss_wifili_msg), GFP_ATOMIC);
++	if (!wlmsg)
++		return -ENOMEM;
++
++	radio_buf_cfg_msg = &wlmsg->msg.radiocfgmsg;
++
++	radio_buf_cfg_msg->radio_if_num = ar->nss.if_num;
++	buf_cfg = &wlmsg->msg.radiocfgmsg.radiomsg.radiobufcfgmsg;
++	buf_cfg->range = range;
++	buf_cfg->buf_cnt = buf_sz;
++
++	nss_cmn_msg_init(&wlmsg->cm, ar->ab->nss.if_num,
++			 NSS_WIFILI_RADIO_BUF_CFG,
++			 sizeof(struct nss_wifili_radio_buf_cfg_msg),
++			 NULL, NULL);
++
++	status = nss_wifili_tx_msg(ar->nss.ctx, wlmsg);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ar->ab, "nss radio buf cfg send failed %d\n", status);
++		ret = -EINVAL;
++	} else {
++		ath11k_dbg(ar->ab, ATH11K_DBG_NSS,
++			   "nss radio cfg message range:%d buf_sz:%d if_num:%d ctx:%p\n",
++			   range, buf_sz, ar->nss.if_num, ar->nss.ctx);
++	}
++
++	kfree(wlmsg);
++	return ret;
++}
++
++static void ath11k_nss_fill_srng_info(struct ath11k_base *ab, int ring_id,
++				      struct nss_wifili_hal_srng_info *hsi)
++{
++	struct ath11k_hal *hal = &ab->hal;
++	struct hal_srng *srng;
++	u32 offset;
++	int i;
++
++	if (ring_id < 0) {
++		ath11k_warn(ab, "Invalid ring id used for nss init\n");
++		WARN_ON(1);
++		return;
++	}
++
++	srng = &hal->srng_list[ring_id];
++
++	hsi->ring_id = srng->ring_id;
++	hsi->ring_dir = srng->ring_dir;
++	hsi->ring_base_paddr = srng->ring_base_paddr;
++	hsi->entry_size = srng->entry_size;
++	hsi->num_entries = srng->num_entries;
++	hsi->flags = srng->flags;
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS,
++		   "Ring info to send to nss - ring_id:%d ring_dir:%d ring_paddr:%d entry_size:%d num_entries:%d flags:%d\n",
++		   hsi->ring_id, hsi->ring_dir, hsi->ring_base_paddr,
++		   hsi->entry_size, hsi->num_entries, hsi->flags);
++
++	for (i = 0; i < HAL_SRNG_NUM_REG_GRP; i++) {
++		offset = srng->hwreg_base[i];
++
++		/* For PCI based devices, get the umac ring base address offset
++		 * based on window register configuration.
++		 */
++		if (!(srng->flags & HAL_SRNG_FLAGS_LMAC_RING))
++			offset = ath11k_hif_get_window_offset(ab, srng->hwreg_base[i]);
++
++		hsi->hwreg_base[i]  = (u32)ab->mem_pa + offset;
++
++		ath11k_dbg(ab, ATH11K_DBG_NSS, "SRNG Register %d address %d\n",
++			   i, hsi->hwreg_base[i]);
++	}
++}
++
++static void ath11k_nss_tx_desc_mem_free(struct ath11k_base *ab)
++{
++	int i;
++
++	for (i = 0; i < ATH11K_NSS_MAX_NUMBER_OF_PAGE; i++) {
++		if (!ab->nss.tx_desc_paddr[i])
++			continue;
++
++		dma_free_coherent(ab->dev,
++				  ab->nss.tx_desc_size[i],
++				  ab->nss.tx_desc_vaddr[i],
++				  ab->nss.tx_desc_paddr[i]);
++		ab->nss.tx_desc_vaddr[i] = NULL;
++	}
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS, "allocated tx desc mem freed\n");
++}
++
++static int ath11k_nss_tx_desc_mem_alloc(struct ath11k_base *ab, u32 required_size, u32 *page_idx)
++{
++	int i, alloc_size;
++	int curr_page_idx;
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS, "tx desc mem alloc size: %d\n", required_size);
++
++	curr_page_idx = *page_idx;
++
++	for (i = 0, alloc_size = 0; i < required_size; i += alloc_size) {
++		alloc_size = required_size - i;
++
++		if (alloc_size > WIFILI_NSS_MAX_MEM_PAGE_SIZE)
++			alloc_size = WIFILI_NSS_MAX_MEM_PAGE_SIZE;
++
++		ab->nss.tx_desc_vaddr[curr_page_idx] =
++					dma_alloc_coherent(ab->dev, alloc_size,
++							   &ab->nss.tx_desc_paddr[curr_page_idx],
++							   GFP_KERNEL);
++
++		if (!ab->nss.tx_desc_vaddr[curr_page_idx])
++			return -ENOMEM;
++
++		ab->nss.tx_desc_size[curr_page_idx] = alloc_size;
++		curr_page_idx++;
++
++		ath11k_dbg(ab, ATH11K_DBG_NSS,
++			   "curr page %d, allocated %d, total allocated %d\n",
++			   curr_page_idx, alloc_size, i + alloc_size);
++
++		if (curr_page_idx == ATH11K_NSS_MAX_NUMBER_OF_PAGE) {
++			ath11k_warn(ab, "max page number reached while tx desc mem allocation\n");
++			return -EINVAL;
++		}
++	}
++	*page_idx = curr_page_idx;
++	return 0;
++}
++
++static int ath11k_nss_fill_tx_desc_info(struct ath11k_base *ab,
++					struct nss_wifili_init_msg *wim)
++{
++	struct nss_wifili_tx_desc_addtnl_mem_msg *dam;
++	u32 required_size, required_size_ext;
++	struct nss_wifili_tx_desc_init_msg *dim;
++	u32 tx_desc_limit_0 = 0;
++	u32 tx_desc_limit_1 = 0;
++	u32 tx_desc_limit_2 = 0;
++	u32 dam_page_idx = 0;
++	int page_idx = 0;
++	int i;
++
++	wim->tx_sw_internode_queue_size = ATH11K_WIFIILI_MAX_TX_PROCESSQ;
++
++	dim = &wim->wtdim;
++	dam = &wim->wtdam;
++
++	dim->num_pool = ab->num_radios;
++	dim->num_tx_device_limit = ATH11K_WIFILI_MAX_TX_DESC;
++
++	//TODO Revisit below calc based on platform/mem cfg
++	switch (dim->num_pool) {
++	case 1:
++		tx_desc_limit_0 = ATH11K_WIFILI_DBDC_NUM_TX_DESC;
++		break;
++	case 2:
++		tx_desc_limit_0 = ATH11K_WIFILI_DBDC_NUM_TX_DESC;
++		tx_desc_limit_1 = ATH11K_WIFILI_DBDC_NUM_TX_DESC;
++		break;
++	case 3:
++		tx_desc_limit_0 = ATH11K_WIFILI_DBTC_NUM_TX_DESC;
++		tx_desc_limit_1 = ATH11K_WIFILI_DBTC_NUM_TX_DESC;
++		tx_desc_limit_2 = ATH11K_WIFILI_DBTC_NUM_TX_DESC;
++		break;
++	default:
++		ath11k_warn(ab, "unexpected num radios during tx desc alloc\n");
++		return -EINVAL;
++	}
++
++	dim->num_tx_desc = tx_desc_limit_0;
++	dim->num_tx_desc_ext = tx_desc_limit_0;
++	dim->num_tx_desc_2 = tx_desc_limit_1;
++	dim->num_tx_desc_ext_2 = tx_desc_limit_1;
++	dim->num_tx_desc_3 = tx_desc_limit_2;
++	dim->num_tx_desc_ext_3 = tx_desc_limit_2;
++
++	required_size = (dim->num_tx_desc + dim->num_tx_desc_2 +
++			 dim->num_tx_desc_3 +
++			 dim->num_pool) * WIFILI_NSS_TX_DESC_SIZE;
++
++	required_size_ext = (dim->num_tx_desc_ext + dim->num_tx_desc_ext_2 +
++			     dim->num_tx_desc_ext_3 +
++			     dim->num_pool) * WIFILI_NSS_TX_EXT_DESC_SIZE;
++
++	if (ath11k_nss_tx_desc_mem_alloc(ab, required_size, &page_idx)) {
++		ath11k_warn(ab, "memory allocation for tx desc of size %d failed\n",
++			    required_size);
++		return -ENOMEM;
++	}
++
++	/* Fill the page number from where extension tx descriptor is available */
++	dim->ext_desc_page_num  = page_idx;
++
++	if (ath11k_nss_tx_desc_mem_alloc(ab, required_size_ext, &page_idx)) {
++		ath11k_warn(ab, "memory allocation for extension tx desc of size %d failed\n",
++			    required_size_ext);
++		return -ENOMEM;
++	}
++
++	for (i = 0; i < page_idx; i++)	{
++		if (i < NSS_WIFILI_MAX_NUMBER_OF_PAGE_MSG) {
++			dim->memory_addr[i] = (u32)ab->nss.tx_desc_paddr[i];
++			dim->memory_size[i] = (u32)ab->nss.tx_desc_size[i];
++			dim->num_memaddr++;
++		} else {
++			dam_page_idx = i - NSS_WIFILI_MAX_NUMBER_OF_PAGE_MSG;
++			dam->addtnl_memory_addr[dam_page_idx] = (u32)ab->nss.tx_desc_paddr[i];
++			dam->addtnl_memory_size[dam_page_idx] = (u32)ab->nss.tx_desc_size[i];
++			dam->num_addtnl_addr++;
++		}
++	}
++
++	if (i > NSS_WIFILI_MAX_NUMBER_OF_PAGE_MSG)
++		wim->flags |= WIFILI_ADDTL_MEM_SEG_SET;
++
++	return 0;
++}
++
++static int ath11k_nss_get_target_type(struct ath11k_base *ab)
++{
++	switch (ab->hw_rev) {
++	case ATH11K_HW_IPQ8074:
++		return ATH11K_WIFILI_TARGET_TYPE_QCA8074V2;
++	case ATH11K_HW_IPQ6018_HW10:
++		return ATH11K_WIFILI_TARGET_TYPE_QCA6018;
++	case ATH11K_HW_QCN9074_HW10:
++		return ATH11K_WIFILI_TARGET_TYPE_QCN9074;
++	default:
++		ath11k_warn(ab, "NSS Offload not supported for this HW\n");
++		return ATH11K_WIFILI_TARGET_TYPE_UNKNOWN;
++	}
++}
++
++static int ath11k_nss_get_interface_type(struct ath11k_base *ab)
++{
++	switch (ab->hw_rev) {
++	case ATH11K_HW_IPQ8074:
++	case ATH11K_HW_IPQ6018_HW10:
++		return NSS_WIFILI_INTERNAL_INTERFACE;
++	case ATH11K_HW_QCN9074_HW10:
++		return nss_get_available_wifili_external_if();
++	default:
++		/* This can't happen since we validated target type earlier */
++		WARN_ON(1);
++		return NSS_MAX_NET_INTERFACES;
++	}
++}
++
++static int ath11k_nss_get_dynamic_interface_type(struct ath11k_base *ab)
++{
++	switch (ab->nss.if_num) {
++	case NSS_WIFILI_INTERNAL_INTERFACE:
++		return NSS_DYNAMIC_INTERFACE_TYPE_WIFILI_INTERNAL;
++	case NSS_WIFILI_EXTERNAL_INTERFACE0:
++		return NSS_DYNAMIC_INTERFACE_TYPE_WIFILI_EXTERNAL0;
++	case NSS_WIFILI_EXTERNAL_INTERFACE1:
++		return NSS_DYNAMIC_INTERFACE_TYPE_WIFILI_EXTERNAL1;
++	default:
++		ath11k_warn(ab, "NSS Offload invalid interface\n");
++		return NSS_DYNAMIC_INTERFACE_TYPE_NONE;
++	}
++}
++
++static int ath11k_nss_init(struct ath11k_base *ab)
++{
++	struct nss_wifili_init_msg *wim = NULL;
++	struct nss_wifili_msg *wlmsg = NULL;
++	struct nss_ctx_instance *nss_contex;
++	nss_wifili_msg_callback_t msg_cb;
++	u32 target_type;
++	u32 features = 0;
++	nss_tx_status_t status;
++	struct ath11k_dp *dp;
++	int i, ret;
++
++	dp = &ab->dp;
++
++	target_type = ath11k_nss_get_target_type(ab);
++
++	if (target_type == ATH11K_WIFILI_TARGET_TYPE_UNKNOWN)
++		return -ENOTSUPP;
++
++	wlmsg = kzalloc(sizeof(struct nss_wifili_msg), GFP_ATOMIC);
++	if (!wlmsg)
++		return -ENOMEM;
++
++	wim = &wlmsg->msg.init;
++
++	wim->target_type = target_type;
++
++	/* fill rx parameters to initialize rx context */
++	wim->wrip.tlv_size = ab->hw_params.hal_desc_sz;
++	wim->wrip.rx_buf_len = DP_RX_BUFFER_SIZE;
++
++	/* fill hal srng message */
++	wim->hssm.dev_base_addr = (u32)ab->mem_pa;
++	wim->hssm.shadow_rdptr_mem_addr = (u32)ab->hal.rdp.paddr;
++	wim->hssm.shadow_wrptr_mem_addr = (u32)ab->hal.wrp.paddr;
++	wim->hssm.lmac_rings_start_id = HAL_SRNG_RING_ID_LMAC1_ID_START;
++
++	/* fill TCL data/completion ring info */
++	wim->num_tcl_data_rings = DP_TCL_NUM_RING_MAX;
++	for (i = 0; i < DP_TCL_NUM_RING_MAX; i++) {
++		ath11k_nss_fill_srng_info(ab, dp->tx_ring[i].tcl_data_ring.ring_id,
++					  &wim->tcl_ring_info[i]);
++		ath11k_nss_fill_srng_info(ab, dp->tx_ring[i].tcl_comp_ring.ring_id,
++					  &wim->tx_comp_ring[i]);
++	}
++
++	/* allocate tx desc memory for NSS and fill corresponding info */
++	ret = ath11k_nss_fill_tx_desc_info(ab, wim);
++	if (ret)
++		goto free;
++
++	/* fill reo dest ring info */
++	wim->num_reo_dest_rings = DP_REO_DST_RING_MAX;
++	for (i = 0; i < DP_REO_DST_RING_MAX; i++) {
++		ath11k_nss_fill_srng_info(ab, dp->reo_dst_ring[i].ring_id,
++					  &wim->reo_dest_ring[i]);
++	}
++
++	/* fill reo reinject ring info */
++	ath11k_nss_fill_srng_info(ab, dp->reo_reinject_ring.ring_id,
++				  &wim->reo_reinject_ring);
++
++	/* fill reo release ring info */
++	ath11k_nss_fill_srng_info(ab, dp->rx_rel_ring.ring_id,
++				  &wim->rx_rel_ring);
++
++	/* fill reo exception ring info */
++	ath11k_nss_fill_srng_info(ab, dp->reo_except_ring.ring_id,
++				  &wim->reo_exception_ring);
++
++	ab->nss.if_num = ath11k_nss_get_interface_type(ab);
++
++	ath11k_info(ab, "nss init soc nss if_num %d userpd_id %d\n", ab->nss.if_num, ab->userpd_id);
++
++	if (ab->nss.if_num >= NSS_MAX_NET_INTERFACES) {
++		ath11k_warn(ab, "NSS invalid interface\n");
++		goto free;
++	}
++
++	/* register callbacks for events and exceptions with nss */
++	nss_contex = nss_register_wifili_if(ab->nss.if_num, NULL,
++					    (nss_wifili_callback_t)ath11k_nss_wifili_ext_callback_fn,
++					    (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive,
++					    (struct net_device *)ab, features);
++
++	if (!nss_contex) {
++		ath11k_warn(ab, "nss wifili register failure\n");
++		goto free;
++	}
++
++	if (nss_cmn_get_state(nss_contex) != NSS_STATE_INITIALIZED) {
++		ath11k_warn(ab, "nss state in default init state\n");
++		goto free;
++	}
++
++	/* The registered soc context is stored in ab, and will be used for
++	 * all soc related messages with nss
++	 */
++	ab->nss.ctx = nss_contex;
++
++	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++
++	/* Initialize the common part of the wlmsg */
++	nss_cmn_msg_init(&wlmsg->cm, ab->nss.if_num,
++			 NSS_WIFILI_INIT_MSG,
++			 sizeof(struct nss_wifili_init_msg),
++			 msg_cb, NULL);
++
++	reinit_completion(&ab->nss.complete);
++
++	/* Note: response is contention free during init sequence */
++	ab->nss.response = ATH11K_NSS_MSG_ACK;
++
++	status = nss_wifili_tx_msg(nss_contex, wlmsg);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ab, "failure to send nss init msg\n");
++		goto unregister;
++	}
++
++	ret = wait_for_completion_timeout(&ab->nss.complete,
++					  msecs_to_jiffies(ATH11K_NSS_MSG_TIMEOUT_MS));
++	if (!ret) {
++		ath11k_warn(ab, "timeout while waiting for nss init msg response\n");
++		goto unregister;
++	}
++
++	/* Check if the response is success from the callback */
++	if (ab->nss.response != ATH11K_NSS_MSG_ACK)
++		goto unregister;
++
++	kfree(wlmsg);
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS, "NSS Init Message TX Success %p %d\n",
++		   ab->nss.ctx, ab->nss.if_num);
++	return 0;
++
++unregister:
++	nss_unregister_wifili_if(ab->nss.if_num);
++free:
++	ath11k_nss_tx_desc_mem_free(ab);
++	kfree(wlmsg);
++	return -EINVAL;
++}
++
++static int ath11k_nss_stats_cfg(struct ath11k *ar, int nss_msg, int enable)
++{
++	struct nss_wifili_msg *wlmsg = NULL;
++	struct nss_wifili_stats_cfg_msg *stats_cfg;
++	nss_wifili_msg_callback_t msg_cb;
++	nss_tx_status_t status;
++	struct ath11k_base *ab = ar->ab;
++	int ret = 0;
++
++	wlmsg = kzalloc(sizeof(struct nss_wifili_msg), GFP_ATOMIC);
++	if (!wlmsg)
++		return -ENOMEM;
++
++	stats_cfg = &wlmsg->msg.scm;
++	stats_cfg->cfg = enable;
++
++	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++
++	nss_cmn_msg_init(&wlmsg->cm, ab->nss.if_num,
++			 nss_msg,
++			 sizeof(struct nss_wifili_stats_cfg_msg),
++			 msg_cb, NULL);
++
++	status = nss_wifili_tx_msg(ar->nss.ctx, wlmsg);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ab, "nss stats cfg %d msg tx failure\n", nss_msg);
++		ret = -EINVAL;
++		goto free;
++	}
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS, "nss stats %d enable %d\n", nss_msg, enable);
++
++free:
++	kfree(wlmsg);
++	return ret;
++}
++
++static void ath11k_nss_sojourn_stats_disable(struct ath11k *ar)
++{
++	ath11k_nss_stats_cfg(ar, NSS_WIFILI_STATS_V2_CFG_MSG,
++			     ATH11K_NSS_STATS_DISABLE);
++}
++
++void ath11k_nss_peer_stats_disable(struct ath11k *ar)
++{
++	ath11k_nss_stats_cfg(ar, NSS_WIFILI_STATS_CFG_MSG,
++			     ATH11K_NSS_STATS_DISABLE);
++}
++
++void ath11k_nss_peer_stats_enable(struct ath11k *ar)
++{
++	ath11k_nss_stats_cfg(ar, NSS_WIFILI_STATS_CFG_MSG,
++			     ATH11K_NSS_STATS_ENABLE);
++}
++
++int ath11k_nss_pdev_init(struct ath11k_base *ab, int radio_id)
++{
++	struct ath11k *ar = ab->pdevs[radio_id].ar;
++	struct nss_wifili_pdev_init_msg *pdevmsg;
++	struct nss_wifili_msg *wlmsg = NULL;
++	nss_wifili_msg_callback_t msg_cb;
++	nss_tx_status_t status;
++	int radio_if_num = -1;
++	int refill_ring_id;
++	int features = 0;
++	int dyn_if_type;
++	int ret, i;
++
++	dyn_if_type = ath11k_nss_get_dynamic_interface_type(ab);
++
++	/* Allocate a node for dynamic interface */
++	radio_if_num = nss_dynamic_interface_alloc_node(dyn_if_type);
++
++	if (radio_if_num < 0)
++		return -EINVAL;
++
++	/* The ifnum and registered radio context is stored in ar and used
++	 * for messages related to vdev/radio
++	 */
++	ar->nss.if_num = radio_if_num;
++
++	/* No callbacks are registered for radio specific events/data */
++	ar->nss.ctx = nss_register_wifili_radio_if((u32)radio_if_num, NULL,
++						   NULL, NULL, (struct net_device *)ar,
++						   features);
++
++	if (!ar->nss.ctx) {
++		ath11k_warn(ab, "failure during nss pdev register\n");
++		ret = -EINVAL;
++		goto dealloc;
++	}
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS, "nss pdev init - id:%d init ctxt:%p ifnum:%d\n",
++		   ar->pdev->pdev_id, ar->nss.ctx, ar->nss.if_num);
++
++	wlmsg = kzalloc(sizeof(struct nss_wifili_msg), GFP_ATOMIC);
++	if (!wlmsg) {
++		ret = -ENOMEM;
++		goto unregister;
++	}
++
++	pdevmsg = &wlmsg->msg.pdevmsg;
++
++	pdevmsg->radio_id = radio_id;
++	pdevmsg->lmac_id = ar->lmac_id;
++	pdevmsg->target_pdev_id = ar->pdev->pdev_id;
++	pdevmsg->num_rx_swdesc = WIFILI_RX_DESC_POOL_WEIGHT * DP_RXDMA_BUF_RING_SIZE;
++
++	/* Store rxdma ring info to the message */
++	refill_ring_id = ar->dp.rx_refill_buf_ring.refill_buf_ring.ring_id;
++	ath11k_nss_fill_srng_info(ab, refill_ring_id, &pdevmsg->rxdma_ring);
++
++	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++
++	nss_cmn_msg_init(&wlmsg->cm, ab->nss.if_num,
++			 NSS_WIFILI_PDEV_INIT_MSG,
++			 sizeof(struct nss_wifili_pdev_init_msg),
++			 msg_cb, NULL);
++
++	reinit_completion(&ab->nss.complete);
++
++	/* Note: response is contention free during init sequence */
++	ab->nss.response = ATH11K_NSS_MSG_ACK;
++
++	status = nss_wifili_tx_msg(ar->nss.ctx, wlmsg);
++
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ab, "nss send pdev msg tx error : %d\n", status);
++		ret = -EINVAL;
++		goto free;
++	}
++
++	ret = wait_for_completion_timeout(&ab->nss.complete,
++					  msecs_to_jiffies(ATH11K_NSS_MSG_TIMEOUT_MS));
++	if (!ret) {
++		ath11k_warn(ab, "timeout while waiting for pdev init msg response\n");
++		ret = -ETIMEDOUT;
++		goto free;
++	}
++
++	/* Check if the response is success from the callback */
++	if (ab->nss.response != ATH11K_NSS_MSG_ACK) {
++		ret = -EINVAL;
++		goto free;
++	}
++
++	kfree(wlmsg);
++
++	/* Disable nss sojourn stats by default */
++	ath11k_nss_sojourn_stats_disable(ar);
++	/* Enable nss wifili peer stats by default */
++	ath11k_nss_peer_stats_enable(ar);
++
++	/*TODO CFG Tx buffer limit as per no clients range per radio
++	 * this needs to be based on target/mem cfg
++	 * similar to tx desc cfg at soc init per radio
++	 */
++
++	for (i = 0; i < ATH11K_NSS_RADIO_TX_LIMIT_RANGE; i++)
++		ath11k_nss_radio_buf_cfg(ar, i, ATH11K_NSS_RADIO_TX_LIMIT_RANGE3);
++
++	return 0;
++
++free:
++	kfree(wlmsg);
++unregister:
++	nss_unregister_wifili_radio_if(ar->nss.if_num);
++dealloc:
++	nss_dynamic_interface_dealloc_node(ar->nss.if_num, dyn_if_type);
++	return ret;
++}
++
++/* TODO : Check if start, reset and stop messages can be done using single function as
++ * body is similar, having it now for clarity */
++
++int ath11k_nss_start(struct ath11k_base *ab)
++{
++	struct nss_wifili_msg *wlmsg = NULL;
++	nss_wifili_msg_callback_t msg_cb;
++	nss_tx_status_t status;
++	int ret;
++
++	wlmsg = kzalloc(sizeof(struct nss_wifili_msg), GFP_ATOMIC);
++	if (!wlmsg)
++		return -ENOMEM;
++
++	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++
++	/* Empty message for NSS Start message */
++	nss_cmn_msg_init(&wlmsg->cm, ab->nss.if_num,
++			 NSS_WIFILI_START_MSG,
++			 0,
++			 msg_cb, NULL);
++
++	reinit_completion(&ab->nss.complete);
++
++	/* Note: response is contention free during init sequence */
++	ab->nss.response = ATH11K_NSS_MSG_ACK;
++
++	status = nss_wifili_tx_msg(ab->nss.ctx, wlmsg);
++
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ab, "nss send start msg tx error %d\n", status);
++		ret = -EINVAL;
++		goto free;
++	}
++
++	ret = wait_for_completion_timeout(&ab->nss.complete,
++					  msecs_to_jiffies(ATH11K_NSS_MSG_TIMEOUT_MS));
++	if (!ret) {
++		ath11k_warn(ab, "timeout while waiting for response for nss start msg\n");
++		ret = -ETIMEDOUT;
++		goto free;
++	}
++
++	/* Check if the response is success from the callback */
++	if (ab->nss.response != ATH11K_NSS_MSG_ACK) {
++		ret = -EINVAL;
++		goto free;
++	}
++
++	/* NSS Start success */
++	ret = 0;
++	ath11k_dbg(ab, ATH11K_DBG_NSS, "nss start success\n");
++
++free:
++	kfree(wlmsg);
++	return ret;
++}
++
++static void ath11k_nss_reset(struct ath11k_base *ab)
++{
++	struct nss_wifili_msg *wlmsg = NULL;
++	nss_wifili_msg_callback_t msg_cb;
++	nss_tx_status_t status;
++	int ret;
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS, "NSS reset\n");
++	wlmsg = kzalloc(sizeof(struct nss_wifili_msg), GFP_ATOMIC);
++	if (!wlmsg) {
++		ath11k_warn(ab, "mem allocation failure during nss reset\n");
++		return;
++	}
++
++	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++
++	/* Empty message for NSS Reset message */
++	nss_cmn_msg_init(&wlmsg->cm, ab->nss.if_num,
++			 NSS_WIFILI_SOC_RESET_MSG,
++			 0,
++			 msg_cb, NULL);
++
++	reinit_completion(&ab->nss.complete);
++
++	/* Note: response is contention free during deinit sequence */
++	ab->nss.response = ATH11K_NSS_MSG_ACK;
++
++	status = nss_wifili_tx_msg(ab->nss.ctx, wlmsg);
++
++	/* Add a retry mechanism to reset nss until success */
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ab, "nss send reset msg tx error %d\n", status);
++		goto free;
++	}
++
++	ret = wait_for_completion_timeout(&ab->nss.complete,
++					  msecs_to_jiffies(ATH11K_NSS_MSG_TIMEOUT_MS));
++	if (!ret) {
++		ath11k_warn(ab, "timeout while waiting for response for nss reset msg\n");
++		goto free;
++	}
++
++	/* Check if the response is success from the callback */
++	if (ab->nss.response != ATH11K_NSS_MSG_ACK) {
++		ath11k_warn(ab, "failure response during nss reset %d\n", ab->nss.response);
++		goto free;
++	}
++
++	/* Unregister wifili interface */
++	nss_unregister_wifili_if(ab->nss.if_num);
++
++free:
++	kfree(wlmsg);
++}
++
++static int ath11k_nss_stop(struct ath11k_base *ab)
++{
++	struct nss_wifili_msg *wlmsg = NULL;
++	nss_wifili_msg_callback_t msg_cb;
++	nss_tx_status_t status;
++	int ret;
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS, "NSS stop\n");
++	wlmsg = kzalloc(sizeof(struct nss_wifili_msg), GFP_ATOMIC);
++	if (!wlmsg)
++		return -ENOMEM;
++
++	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++
++	/* Empty message for Stop command */
++	nss_cmn_msg_init(&wlmsg->cm, ab->nss.if_num,
++			 NSS_WIFILI_STOP_MSG,
++			 0,
++			 msg_cb, NULL);
++
++	reinit_completion(&ab->nss.complete);
++
++	/* Note: response is contention free during deinit sequence */
++	ab->nss.response = ATH11K_NSS_MSG_ACK;
++
++	status = nss_wifili_tx_msg(ab->nss.ctx, wlmsg);
++
++	/* Add a retry mechanism to stop nss until success */
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ab, "nss send stop msg tx error %d\n", status);
++		ret = -EINVAL;
++		goto free;
++	}
++
++	ret = wait_for_completion_timeout(&ab->nss.complete,
++					  msecs_to_jiffies(ATH11K_NSS_MSG_TIMEOUT_MS));
++	if (!ret) {
++		ath11k_warn(ab, "timeout while waiting for response for nss stop msg\n");
++		ret = -ETIMEDOUT;
++		goto free;
++	}
++
++	/* Check if the response is success from the callback */
++	if (ab->nss.response != ATH11K_NSS_MSG_ACK) {
++		ret = -EINVAL;
++		goto free;
++	}
++
++	/* NSS Stop success */
++	ret = 0;
++free:
++	kfree(wlmsg);
++	return ret;
++}
++
++int ath11k_nss_pdev_deinit(struct ath11k_base *ab, int radio_id)
++{
++	struct ath11k *ar = ab->pdevs[radio_id].ar;
++	struct nss_wifili_pdev_deinit_msg *deinit;
++	struct nss_wifili_msg *wlmsg = NULL;
++	nss_wifili_msg_callback_t msg_cb;
++	nss_tx_status_t status;
++	int dyn_if_type;
++	int ret;
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS, "NSS pdev %d deinit\n", radio_id);
++	dyn_if_type = ath11k_nss_get_dynamic_interface_type(ab);
++
++	/* Disable NSS wifili peer stats before teardown */
++	if (ab->nss.stats_enabled)
++		ath11k_nss_peer_stats_disable(ar);
++
++	wlmsg = kzalloc(sizeof(struct nss_wifili_msg), GFP_ATOMIC);
++	if (!wlmsg)
++		return -ENOMEM;
++
++	deinit = &wlmsg->msg.pdevdeinit;
++	deinit->ifnum = radio_id;
++
++	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++
++	nss_cmn_msg_init(&wlmsg->cm, ab->nss.if_num,
++			 NSS_WIFILI_PDEV_DEINIT_MSG,
++			 sizeof(struct nss_wifili_pdev_deinit_msg),
++			 msg_cb, NULL);
++
++	reinit_completion(&ab->nss.complete);
++
++	/* Note: response is contention free during deinit sequence */
++	ab->nss.response = ATH11K_NSS_MSG_ACK;
++
++	status = nss_wifili_tx_msg(ar->nss.ctx, wlmsg);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ab, "nss send pdev deinit msg tx error %d\n", status);
++		ret = -EINVAL;
++		goto free;
++	}
++
++	ret = wait_for_completion_timeout(&ab->nss.complete,
++					  msecs_to_jiffies(ATH11K_NSS_MSG_TIMEOUT_MS));
++	if (!ret) {
++		ath11k_warn(ab, "timeout while waiting for pdev deinit msg response\n");
++		ret = -ETIMEDOUT;
++		goto free;
++	}
++
++	/* Check if the response is success from the callback */
++	if (ab->nss.response != ATH11K_NSS_MSG_ACK) {
++		ret = -EINVAL;
++		goto free;
++	}
++
++	/* pdev deinit msg success, dealloc, deregister and return */
++	ret = 0;
++
++	nss_dynamic_interface_dealloc_node(ar->nss.if_num, dyn_if_type);
++	nss_unregister_wifili_radio_if(ar->nss.if_num);
++free:
++	kfree(wlmsg);
++	return ret;
++}
++
++int ath11k_nss_teardown(struct ath11k_base *ab)
++{
++	int i, ret;
++
++	if (!ab->nss.enabled)
++		return 0;
++
++	ath11k_nss_stop(ab);
++
++	for (i = 0; i < ab->num_radios ; i++) {
++		ret = ath11k_nss_pdev_deinit(ab, i);
++		if (ret)
++			ath11k_warn(ab, "failure during pdev%d deinit\n", i);
++	}
++
++	ath11k_nss_reset(ab);
++	ath11k_nss_tx_desc_mem_free(ab);
++	ath11k_dbg(ab, ATH11K_DBG_NSS, "NSS Teardown Complete\n");
++
++	return 0;
++}
++
++int ath11k_nss_setup(struct ath11k_base *ab)
++{
++	int i;
++	int ret = 0;
++	u32 target_type;
++
++	if (!ab->nss.enabled)
++		return 0;
++
++	target_type = ath11k_nss_get_target_type(ab);
++
++	if (target_type == ATH11K_WIFILI_TARGET_TYPE_UNKNOWN)
++		return -ENOTSUPP;
++
++	/* Verify NSS support is enabled */
++	if (nss_cmn_get_nss_enabled() == false) {
++		ath11k_warn(ab, "NSS offload support disabled, falling back to default mode\n");
++		return -ENOTSUPP;
++	}
++
++	/* Initialize completion for verifying NSS message response */
++	init_completion(&ab->nss.complete);
++
++	/* Setup common resources for NSS */
++	ret = ath11k_nss_init(ab);
++	if (ret) {
++		ath11k_warn(ab, "NSS SOC Initialization Failed :%d\n", ret);
++		goto fail;
++	}
++
++	/* Setup pdev related resources for NSS */
++	for (i = 0; i < ab->num_radios; i++) {
++		ret = ath11k_nss_pdev_init(ab, i);
++		if (ret) {
++			ath11k_warn(ab, "NSS PDEV %d Initialization Failed :%d\n", i, ret);
++			goto pdev_deinit;
++		}
++	}
++
++	/* Set the NSS statemachine to start */
++	ret = ath11k_nss_start(ab);
++	if (ret) {
++		ath11k_warn(ab, "NSS Start Failed : %d\n", ret);
++		goto pdev_deinit;
++	}
++
++	/* Default nexthop interface is set to ETH RX */
++	ret = nss_wifi_vdev_base_set_next_hop(ab->nss.ctx, NSS_ETH_RX_INTERFACE);
++	if (ret != NSS_TX_SUCCESS) {
++		ath11k_warn(ab, "Failure to set default next hop : %d\n", ret);
++		goto stop;
++	}
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS, "NSS Setup Complete\n");
++	return ret;
++
++stop:
++	ath11k_nss_stop(ab);
++
++pdev_deinit:
++	for (i -= 1; i >= 0; i--)
++		ath11k_nss_pdev_deinit(ab, i);
++
++	ath11k_nss_reset(ab);
++	ath11k_nss_tx_desc_mem_free(ab);
++fail:
++	return ret;
++}
+--- /dev/null
++++ b/drivers/net/wireless/ath/ath11k/nss.h
+@@ -0,0 +1,307 @@
++/* SPDX-License-Identifier: BSD-3-Clause-Clear */
++/*
++ * Copyright (c) 2020 The Linux Foundation. All rights reserved.
++ */
++
++#ifndef ATH11K_NSS_H
++#define ATH11K_NSS_H
++
++#include "net/cfg80211.h"
++#ifdef CPTCFG_ATH11K_NSS_SUPPORT
++#include <nss_api_if.h>
++#include <nss_cmn.h>
++
++#endif
++struct ath11k;
++struct ath11k_base;
++struct ath11k_vif;
++struct ath11k_peer;
++struct ath11k_sta;
++struct hal_rx_mon_ppdu_info;
++struct hal_rx_user_status;
++
++/* NSS DBG macro is not included as part of debug enum to avoid
++ * frequent changes during upgrade*/
++#define ATH11K_DBG_NSS	0x80000000
++
++/* WIFILI Supported Target Types */
++#define ATH11K_WIFILI_TARGET_TYPE_UNKNOWN   0xFF
++#define ATH11K_WIFILI_TARGET_TYPE_QCA8074   20
++#define ATH11K_WIFILI_TARGET_TYPE_QCA8074V2 24
++#define ATH11K_WIFILI_TARGET_TYPE_QCA6018   25
++#define ATH11K_WIFILI_TARGET_TYPE_QCN9074   26
++#define ATH11K_WIFILI_TARGET_TYPE_QCA5018   29
++
++/* Max limit for NSS Queue */
++#define ATH11K_WIFIILI_MAX_TX_PROCESSQ 1024
++
++/* Max TX Desc limit */
++#define ATH11K_WIFILI_MAX_TX_DESC	65536
++
++/* TX Desc related info */
++/*TODO : Check this again during experiments for lowmem or
++ changes for platforms based on num radios supported */
++#define ATH11K_WIFILI_DBDC_NUM_TX_DESC (1024 * 8)
++#define ATH11K_WIFILI_DBTC_NUM_TX_DESC (1024 * 8)
++
++// TODO Revisit these page size calc
++#define WIFILI_NSS_TX_DESC_SIZE 20*4
++#define WIFILI_NSS_TX_EXT_DESC_SIZE 40*4
++/* Number of desc per page(12bit) should be<4096, page limit per 1024 byte is 80*3=240 */
++#define WIFILI_NSS_TX_DESC_PAGE_LIMIT 240
++#define WIFILI_NSS_MAX_MEM_PAGE_SIZE (WIFILI_NSS_TX_DESC_PAGE_LIMIT * 1024)
++#define WIFILI_NSS_MAX_EXT_MEM_PAGE_SIZE  (WIFILI_NSS_TX_DESC_PAGE_LIMIT * 1024)
++#define WIFILI_RX_DESC_POOL_WEIGHT 3
++
++/* Status of the NSS messages sent from driver */
++#define ATH11K_NSS_MSG_ACK	0
++/* Timeout for waiting for response from NSS on TX msg */
++#define ATH11K_NSS_MSG_TIMEOUT_MS 5000
++
++/* Init Flags */
++#define WIFILI_NSS_CCE_DISABLED 0x1
++#define WIFILI_ADDTL_MEM_SEG_SET 0x000000002
++
++/* ATH11K NSS PEER Info */
++/* Host memory allocated for peer info storage in nss */
++#define WIFILI_NSS_PEER_BYTE_SIZE NSS_WIFILI_PEER_SIZE
++
++/* ATH11K NSS Stats */
++#define ATH11K_NSS_STATS_ENABLE 1
++#define ATH11K_NSS_STATS_DISABLE 0
++
++/* TX Buf cfg range */
++#define ATH11K_NSS_RADIO_TX_LIMIT_RANGE 4
++
++/* TODO : Analysis based on platform */
++/* TX Limit till 64 clients */
++#define ATH11K_NSS_RADIO_TX_LIMIT_RANGE0 8192
++/* TX Limit till 128 clients */
++#define ATH11K_NSS_RADIO_TX_LIMIT_RANGE1 8192
++/* TX Limit till 256 clients */
++#define ATH11K_NSS_RADIO_TX_LIMIT_RANGE2 8192
++/* TX Limit > 256 clients */
++#define ATH11K_NSS_RADIO_TX_LIMIT_RANGE3 8192
++
++#define ATH11K_NSS_MAX_NUMBER_OF_PAGE 96
++
++#define NSS_TX_TID_MAX 8
++
++#define ATH11K_NSS_TXRX_NETDEV_STATS(txrx, vif, len, pkt_count) \
++do {	\
++	struct wireless_dev *wdev = ieee80211_vif_to_wdev(vif);	\
++	struct pcpu_sw_netstats *tstats;	\
++	\
++	if (!wdev)	\
++		break;	\
++	tstats = this_cpu_ptr(netdev_tstats(wdev->netdev));	\
++	u64_stats_update_begin(&tstats->syncp);	\
++	u64_stats_add(&tstats->txrx ## _packets, pkt_count); \
++	u64_stats_add(&tstats->txrx ## _bytes, len); \
++	u64_stats_update_end(&tstats->syncp);	\
++} while (0)
++
++enum ath11k_nss_opmode {
++	ATH11K_NSS_OPMODE_UNKNOWN,
++	ATH11K_NSS_OPMODE_AP,
++	ATH11K_NSS_OPMODE_IBSS,
++	ATH11K_NSS_OPMODE_STA,
++	ATH11K_NSS_OPMODE_MONITOR,
++};
++
++struct peer_stats {
++	u64 last_rx;
++	u64 last_ack;
++	u32 tx_packets;
++	u32 tx_bytes;
++	u32 tx_retries;
++	u32 tx_failed;
++	u32 rx_packets;
++	u32 rx_bytes;
++	u32 rx_dropped;
++	u32 last_rxdrop;
++	struct rate_info rxrate;
++};
++
++enum ath11k_nss_peer_sec_type {
++	PEER_SEC_TYPE_NONE,
++	PEER_SEC_TYPE_WEP128,
++	PEER_SEC_TYPE_WEP104,
++	PEER_SEC_TYPE_WEP40,
++	PEER_SEC_TYPE_TKIP,
++	PEER_SEC_TYPE_TKIP_NOMIC,
++	PEER_SEC_TYPE_AES_CCMP,
++	PEER_SEC_TYPE_WAPI,
++	PEER_SEC_TYPE_AES_CCMP_256,
++	PEER_SEC_TYPE_AES_GCMP,
++	PEER_SEC_TYPE_AES_GCMP_256,
++	PEER_SEC_TYPES_MAX
++};
++
++/* this holds the memory allocated for nss managed peer info */
++struct ath11k_nss_peer {
++	uint32_t *vaddr;
++	dma_addr_t paddr;
++	struct peer_stats *nss_stats;
++	struct completion complete;
++};
++
++/* Structure to hold the vif related info for nss offload support */
++struct arvif_nss {
++	/* dynamic ifnum allocated by nss driver for vif */
++	int if_num;
++	/* Used for completion status for vdev config nss messages */
++	struct completion complete;
++	/* Keep the copy of encap type for nss */
++	int encap;
++	/* Keep the copy of decap type for nss */
++	int decap;
++	bool created;
++};
++
++/* Structure to hold the pdev/radio related info for nss offload support */
++struct ath11k_nss {
++	/* dynamic ifnum allocated by nss driver for pdev */
++	int if_num;
++	/* Radio/pdev Context obtained on pdev register */
++	void* ctx;
++};
++
++/* Structure to hold the soc related info for nss offload support */
++struct ath11k_soc_nss {
++	/* turn on/off nss offload support in ath11k */
++	bool enabled;
++	/* turn on/off nss stats support in ath11k */
++	bool stats_enabled;
++	/* soc nss ctx */
++	void* ctx;
++	/* if_num to be used for soc related nss messages */
++	int if_num;
++	/* debug mode to disable the regular mesh configuration from mac80211 */
++	bool debug_mode;
++	/* Completion to nss message response */
++	struct completion complete;
++	/* Response to nss messages are stored here on msg callback
++	* used only in contention free messages during init */
++	int response;
++	/* Below is used for identifying allocated tx descriptors */
++	dma_addr_t tx_desc_paddr[ATH11K_NSS_MAX_NUMBER_OF_PAGE];
++	uint32_t * tx_desc_vaddr[ATH11K_NSS_MAX_NUMBER_OF_PAGE];
++	uint32_t tx_desc_size[ATH11K_NSS_MAX_NUMBER_OF_PAGE];
++};
++
++#ifdef CPTCFG_ATH11K_NSS_SUPPORT
++int ath11k_nss_tx(struct ath11k_vif *arvif, struct sk_buff *skb);
++int ath11k_nss_vdev_set_cmd(struct ath11k_vif *arvif, int cmd, int val);
++int ath11k_nss_vdev_create(struct ath11k_vif *arvif);
++void ath11k_nss_vdev_delete(struct ath11k_vif *arvif);
++int ath11k_nss_vdev_up(struct ath11k_vif *arvif);
++int ath11k_nss_vdev_down(struct ath11k_vif *arvif);
++int ath11k_nss_peer_delete(struct ath11k_base *ab, const u8 *addr);
++int ath11k_nss_set_peer_authorize(struct ath11k *ar, u16 peer_id);
++int ath11k_nss_peer_create(struct ath11k_base *ab, struct ath11k_peer *peer);
++void ath11k_nss_peer_stats_enable(struct ath11k *ar);
++void ath11k_nss_peer_stats_disable(struct ath11k *ar);
++int ath11k_nss_set_peer_sec_type(struct ath11k *ar, struct ath11k_peer *peer,
++				 struct ieee80211_key_conf *key_conf);
++void ath11k_nss_update_sta_stats(struct station_info *sinfo,
++				 struct ieee80211_sta *sta,
++				 struct ath11k_sta *arsta);
++void ath11k_nss_update_sta_rxrate(struct hal_rx_mon_ppdu_info *ppdu_info,
++				  struct ath11k_peer *peer,
++				  struct hal_rx_user_status *user_stats);
++int ath11k_nss_setup(struct ath11k_base *ab);
++int ath11k_nss_teardown(struct ath11k_base *ab);
++void ath11k_nss_ext_rx_stats(struct ath11k_base *ab, struct htt_rx_ring_tlv_filter *tlv_filter);
++#else
++static inline int ath11k_nss_tx(struct ath11k_vif *arvif, struct sk_buff *skb)
++{
++	return 0;
++}
++
++static inline int ath11k_nss_vdev_set_cmd(struct ath11k_vif *arvif, int cmd, int val)
++{
++	return 0;
++}
++
++static inline int ath11k_nss_vdev_create(struct ath11k_vif *arvif)
++{
++	return 0;
++}
++
++static inline int ath11k_nss_set_peer_authorize(struct ath11k *ar, u16 peer_id)
++{
++	return 0;
++}
++
++static inline void ath11k_nss_vdev_delete(struct ath11k_vif *arvif)
++{
++}
++
++static inline void ath11k_nss_update_sta_stats(struct station_info *sinfo,
++					       struct ieee80211_sta *sta,
++					       struct ath11k_sta *arsta)
++{
++	return;
++}
++
++static inline void ath11k_nss_update_sta_rxrate(struct hal_rx_mon_ppdu_info *ppdu_info,
++						struct ath11k_peer *peer,
++						struct hal_rx_user_status *user_stats)
++{
++	return;
++}
++
++static inline int ath11k_nss_vdev_up(struct ath11k_vif *arvif)
++{
++	return 0;
++}
++
++static inline int ath11k_nss_vdev_down(struct ath11k_vif *arvif)
++{
++	return 0;
++}
++
++static inline int ath11k_nss_peer_delete(struct ath11k_base *ab, const u8 *addr)
++{
++	return 0;
++}
++
++static inline int ath11k_nss_peer_create(struct ath11k_base *ab, struct ath11k_peer *peer)
++{
++	return 0;
++}
++
++static inline void ath11k_nss_peer_stats_enable(struct ath11k *ar)
++{
++	return;
++}
++
++static inline void ath11k_nss_peer_stats_disable(struct ath11k *ar)
++{
++	return;
++}
++
++static inline int ath11k_nss_set_peer_sec_type(struct ath11k *ar, struct ath11k_peer *peer,
++					       struct ieee80211_key_conf *key_conf)
++{
++	return 0;
++}
++
++static inline int ath11k_nss_setup(struct ath11k_base *ab)
++{
++	return 0;
++}
++
++static inline int ath11k_nss_teardown(struct ath11k_base *ab)
++{
++	return 0;
++}
++
++static inline void ath11k_nss_ext_rx_stats(struct ath11k_base *ab,
++					   struct htt_rx_ring_tlv_filter *tlv_filter)
++{
++	return;
++}
++#endif /* CPTCFG_ATH11K_NSS_SUPPORT */
++#endif
+--- a/drivers/net/wireless/ath/ath11k/hif.h
++++ b/drivers/net/wireless/ath/ath11k/hif.h
+@@ -30,6 +30,7 @@ struct ath11k_hif_ops {
+ 	void (*ce_irq_enable)(struct ath11k_base *ab);
+ 	void (*ce_irq_disable)(struct ath11k_base *ab);
+ 	void (*get_ce_msi_idx)(struct ath11k_base *ab, u32 ce_id, u32 *msi_idx);
++	u32 (*get_window_offset)(struct ath11k_base *ab, u32 offset);
+ };
+ 
+ static inline void ath11k_hif_ce_irq_enable(struct ath11k_base *ab)
+@@ -136,6 +137,14 @@ static inline void ath11k_get_msi_addres
+ 	ab->hif.ops->get_msi_address(ab, msi_addr_lo, msi_addr_hi);
+ }
+ 
++static inline u32 ath11k_hif_get_window_offset(struct ath11k_base *ab, u32 offset)
++{
++	if (ab->hif.ops->get_window_offset)
++		return ab->hif.ops->get_window_offset(ab, offset);
++
++	return offset;
++}
++
+ static inline void ath11k_get_ce_msi_idx(struct ath11k_base *ab, u32 ce_id,
+ 					 u32 *msi_data_idx)
+ {
+--- a/drivers/net/wireless/ath/ath11k/pci.c
++++ b/drivers/net/wireless/ath/ath11k/pci.c
+@@ -67,6 +67,20 @@ static u32 ath11k_pci_get_window_start(s
+ 		return ATH11K_PCI_WINDOW_START;
+ }
+ 
++static inline u32 ath11k_pci_get_window_offset(struct ath11k_base *ab,
++					       u32 offset)
++{
++	u32 window_start;
++
++	if (ab->hw_params.static_window_map) {
++		window_start = ath11k_pci_get_window_start(ab, offset);
++
++		if (window_start)
++			offset = window_start + (offset & ATH11K_PCI_WINDOW_RANGE_MASK);
++	}
++	return offset;
++}
++
+ static inline void ath11k_pci_select_window(struct ath11k_pci *ab_pci, u32 offset)
+ {
+ 	struct ath11k_base *ab = ab_pci->ab;
+@@ -708,6 +722,7 @@ static const struct ath11k_hif_ops ath11
+ 	.map_service_to_pipe = ath11k_pcic_map_service_to_pipe,
+ 	.ce_irq_enable = ath11k_pci_hif_ce_irq_enable,
+ 	.ce_irq_disable = ath11k_pci_hif_ce_irq_disable,
++	.get_window_offset = ath11k_pci_get_window_offset,
+ 	.get_ce_msi_idx = ath11k_pcic_get_ce_msi_idx,
+ };
+ 
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -992,6 +992,29 @@ unlock_exit:
+ 	spin_unlock_bh(&ab->base_lock);
+ }
+ 
++/* Sends WMI config to filter packets to route packets to WBM release ring */
++int ath11k_dp_rx_pkt_type_filter(struct ath11k *ar, enum ath11k_routing_pkt_type pkt_type, u32 meta_data)
++{
++	struct ath11k_wmi_pkt_route_param param;
++	int ret;
++
++	/* Routing Eapol packets to CCE is only allowed now */
++	if (pkt_type != ATH11K_PKT_TYPE_EAP)
++		return -EINVAL;
++
++	param.opcode = ATH11K_WMI_PKTROUTE_ADD;
++	param.meta_data = meta_data;
++	param.dst_ring = ATH11K_ROUTE_WBM_RELEASE;
++	param.dst_ring_handler = ATH11K_WMI_PKTROUTE_USE_CCE;
++	param.route_type_bmap = 1 << pkt_type;
++
++	ret = ath11k_wmi_send_pdev_pkt_route(ar, &param);
++	if (ret)
++		ath11k_warn(ar->ab, "failed to configure pkt route %d", ret);
++
++	return ret;
++}
++
+ int ath11k_peer_rx_tid_setup(struct ath11k *ar, const u8 *peer_mac, int vdev_id,
+ 			     u8 tid, u32 ba_win_sz, u16 ssn,
+ 			     enum hal_pn_type pn_type)
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -1164,6 +1164,44 @@ int ath11k_wmi_send_pdev_set_regdomain(s
+ 	return ret;
+ }
+ 
++int ath11k_wmi_send_pdev_pkt_route(struct ath11k *ar, struct ath11k_wmi_pkt_route_param *param)
++{
++	struct ath11k_pdev_wmi *wmi = ar->wmi;
++	struct wmi_pdev_pkt_route_cmd *cmd;
++	struct sk_buff *skb;
++	int ret;
++
++	skb = ath11k_wmi_alloc_skb(wmi->wmi_ab, sizeof(*cmd));
++	if (!skb)
++		return -ENOMEM;
++
++	cmd = (struct wmi_pdev_pkt_route_cmd *)skb->data;
++	cmd->tlv_header = FIELD_PREP(WMI_TLV_TAG,
++				     WMI_TAG_PDEV_UPDATE_PKT_ROUTING_CMD) |
++			  FIELD_PREP(WMI_TLV_LEN, sizeof(*cmd) - TLV_HDR_SIZE);
++
++	cmd->pdev_id = ar->pdev->pdev_id;
++	cmd->opcode = param->opcode;
++	cmd->route_type_bmap = param->route_type_bmap;
++	cmd->dst_ring = param->dst_ring;
++	cmd->meta_data = param->meta_data;
++	cmd->dst_ring_handler = param->dst_ring_handler;
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_WMI,
++		   "WMI pdev pkt route opcode %d route_bmap %d dst_ring %d meta_datan %d dst_ringg_handler %d\n",
++		   param->opcode, param->route_type_bmap,
++		   param->dst_ring, param->meta_data, param->dst_ring_handler);
++
++	ret = ath11k_wmi_cmd_send(wmi, skb, WMI_PDEV_UPDATE_PKT_ROUTING_CMDID);
++	if (ret) {
++		ath11k_warn(ar->ab,
++			    "failed to send WMI_PDEV_UPDATE_PKT_ROUTING cmd\n");
++		dev_kfree_skb(skb);
++	}
++
++	return ret;
++}
++
+ int ath11k_wmi_set_peer_param(struct ath11k *ar, const u8 *peer_addr,
+ 			      u32 vdev_id, u32 param_id, u32 param_val)
+ {
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -2873,6 +2873,27 @@ struct pdev_set_regdomain_params {
+ 	u32 pdev_id;
+ };
+ 
++ /* Defines various options for routing policy */
++enum wmi_pdev_dest_ring_handler_type {
++	ATH11K_WMI_PKTROUTE_USE_CCE  = 0,
++	ATH11K_WMI_PKTROUTE_USE_ASPT = 1,
++	ATH11K_WMI_PKTROUTE_USE_FSE  = 2,
++	ATH11K_WMI_PKTROUTE_USE_CCE2 = 3,
++};
++
++enum ath11k_wmi_pkt_route_opcode {
++	ATH11K_WMI_PKTROUTE_ADD,
++	ATH11K_WMI_PKTROUTE_DEL,
++};
++
++struct ath11k_wmi_pkt_route_param {
++	enum ath11k_wmi_pkt_route_opcode opcode;
++	u32 route_type_bmap;
++	u32 dst_ring_handler;
++	u32 dst_ring;
++	u32 meta_data;
++};
++
+ struct rx_reorder_queue_remove_params {
+ 	u8 *peer_macaddr;
+ 	u16 vdev_id;
+@@ -3121,6 +3142,16 @@ struct wmi_pdev_set_regdomain_cmd {
+ 	u32 dfs_domain;
+ } __packed;
+ 
++struct wmi_pdev_pkt_route_cmd {
++	u32 tlv_header;
++	u32 pdev_id;
++	u32 opcode;
++	u32 route_type_bmap;
++	u32 dst_ring;
++	u32 meta_data;
++	u32 dst_ring_handler;
++} __packed;
++
+ struct wmi_peer_set_param_cmd {
+ 	u32 tlv_header;
+ 	u32 vdev_id;
+@@ -6362,6 +6393,8 @@ int ath11k_wmi_send_peer_create_cmd(stru
+ int ath11k_wmi_vdev_set_param_cmd(struct ath11k *ar, u32 vdev_id,
+ 				  u32 param_id, u32 param_value);
+ 
++int ath11k_wmi_send_pdev_pkt_route(struct ath11k *ar,
++				   struct ath11k_wmi_pkt_route_param *param);
+ int ath11k_wmi_set_sta_ps_param(struct ath11k *ar, u32 vdev_id,
+ 				u32 param, u32 param_value);
+ int ath11k_wmi_force_fw_hang_cmd(struct ath11k *ar, u32 type, u32 delay_time_ms);
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.h
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.h
+@@ -20,6 +20,34 @@
+ #define DP_RX_MPDU_ERR_MPDU_LEN			BIT(6)
+ #define DP_RX_MPDU_ERR_UNENCRYPTED_FRAME	BIT(7)
+ 
++/* different supported pkt types for routing */
++enum ath11k_routing_pkt_type {
++	ATH11K_PKT_TYPE_ARP_IPV4,
++	ATH11K_PKT_TYPE_NS_IPV6,
++	ATH11K_PKT_TYPE_IGMP_IPV4,
++	ATH11K_PKT_TYPE_MLD_IPV6,
++	ATH11K_PKT_TYPE_DHCP_IPV4,
++	ATH11K_PKT_TYPE_DHCP_IPV6,
++	ATH11K_PKT_TYPE_DNS_TCP_IPV4,
++	ATH11K_PKT_TYPE_DNS_TCP_IPV6,
++	ATH11K_PKT_TYPE_DNS_UDP_IPV4,
++	ATH11K_PKT_TYPE_DNS_UDP_IPV6,
++	ATH11K_PKT_TYPE_ICMP_IPV4,
++	ATH11K_PKT_TYPE_ICMP_IPV6,
++	ATH11K_PKT_TYPE_TCP_IPV4,
++	ATH11K_PKT_TYPE_TCP_IPV6,
++	ATH11K_PKT_TYPE_UDP_IPV4,
++	ATH11K_PKT_TYPE_UDP_IPV6,
++	ATH11K_PKT_TYPE_IPV4,
++	ATH11K_PKT_TYPE_IPV6,
++	ATH11K_PKT_TYPE_EAP,
++	ATH11K_PKT_TYPE_MAX
++};
++
++#define ATH11K_RX_PROTOCOL_TAG_START_OFFSET  128
++#define ATH11K_ROUTE_WBM_RELEASE	5
++#define ATH11K_ROUTE_EAP_METADATA	(ATH11K_RX_PROTOCOL_TAG_START_OFFSET + ATH11K_PKT_TYPE_EAP)
++
+ enum dp_rx_decap_type {
+ 	DP_RX_DECAP_TYPE_RAW,
+ 	DP_RX_DECAP_TYPE_NATIVE_WIFI,
+@@ -56,6 +84,9 @@ void ath11k_peer_rx_tid_delete(struct at
+ int ath11k_peer_rx_tid_setup(struct ath11k *ar, const u8 *peer_mac, int vdev_id,
+ 			     u8 tid, u32 ba_win_sz, u16 ssn,
+ 			     enum hal_pn_type pn_type);
++int ath11k_dp_rx_pkt_type_filter(struct ath11k *ar,
++				  enum ath11k_routing_pkt_type pkt_type,
++				  u32 meta_data);
+ void ath11k_dp_htt_htc_t2h_msg_handler(struct ath11k_base *ab,
+ 				       struct sk_buff *skb);
+ int ath11k_dp_pdev_reo_setup(struct ath11k_base *ab);
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -6367,6 +6367,16 @@ static int ath11k_mac_op_start(struct ie
+ 		goto err;
+ 	}
+ 
++	/* nss offload requires eapol packets to be routed to wbm release ring */
++	if (ab->nss.enabled) {
++		ret = ath11k_dp_rx_pkt_type_filter(ar, ATH11K_PKT_TYPE_EAP,
++						   ATH11K_ROUTE_EAP_METADATA);
++		if (ret) {
++			ath11k_err(ar->ab, "failed to configure EAP pkt route: %d\n", ret);
++			goto err;
++		}
++	}
++
+ 	__ath11k_set_antenna(ar, ar->cfg_tx_chainmask, ar->cfg_rx_chainmask);
+ 
+ 	/* TODO: Do we need to enable ANI? */
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -913,6 +913,7 @@ struct ath11k_base {
+ 	struct list_head peers;
+ 	wait_queue_head_t peer_mapping_wq;
+ 	u8 mac_addr[ETH_ALEN];
++	int userpd_id;
+ 	int irq_num[ATH11K_IRQ_NUM_MAX];
+ 	struct ath11k_ext_irq_grp ext_irq_grp[ATH11K_EXT_IRQ_GRP_NUM_MAX];
+ 	struct ath11k_targ_cap target_caps;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/199-003-ath11k-add-nss-support.patch b/package/kernel/mac80211/patches/ath11k_nss/199-003-ath11k-add-nss-support.patch
new file mode 100644
index 00000000000000..cfe11083939837
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/199-003-ath11k-add-nss-support.patch
@@ -0,0 +1,1283 @@
+From 65c511e3aeb9afb84a3c6c8ac34353af91b880e9 Mon Sep 17 00:00:00 2001
+From: Sriram R <srirrama@codeaurora.org>
+Date: Fri, 10 Jul 2020 12:50:21 +0530
+Subject: [PATCH 3/3] ath11k: add nss support
+
+  Add NSS Offload support for ath11k driver.
+
+Signed-off-by: Sriram R <srirrama@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/ahb.c    | 18 ++++++--
+ drivers/net/wireless/ath/ath11k/core.c   | 24 ++++++++++
+ drivers/net/wireless/ath/ath11k/core.h   | 14 +++++-
+ drivers/net/wireless/ath/ath11k/dp.c     | 21 ++++++---
+ drivers/net/wireless/ath/ath11k/dp.h     |  1 +
+ drivers/net/wireless/ath/ath11k/dp_rx.c  | 17 +++++--
+ drivers/net/wireless/ath/ath11k/dp_rx.h  |  6 +++
+ drivers/net/wireless/ath/ath11k/hal.h    |  2 +
+ drivers/net/wireless/ath/ath11k/hal_rx.c | 10 +++-
+ drivers/net/wireless/ath/ath11k/mac.c    | 78 +++++++++++++++++++++++++++++++-
+ drivers/net/wireless/ath/ath11k/peer.c   |  9 +++-
+ drivers/net/wireless/ath/ath11k/peer.h   |  6 ++-
+ local-symbols                            |  1 +
+ 13 files changed, 186 insertions(+), 21 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/ahb.c
++++ b/drivers/net/wireless/ath/ath11k/ahb.c
+@@ -525,6 +525,12 @@ static int ath11k_ahb_config_ext_irq(str
+ 	int i, j;
+ 	int irq;
+ 	int ret;
++	bool nss_offload;
++
++	/* TCL Completion, REO Dest, ERR, Exception and h2rxdma rings are offloaded
++	 * to nss when its enabled, hence don't enable these interrupts
++	 */
++	nss_offload = ab->nss.enabled;
+ 
+ 	for (i = 0; i < ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {
+ 		struct ath11k_ext_irq_grp *irq_grp = &ab->ext_irq_grp[i];
+@@ -537,20 +543,20 @@ static int ath11k_ahb_config_ext_irq(str
+ 			       ath11k_ahb_ext_grp_napi_poll);
+ 
+ 		for (j = 0; j < ATH11K_EXT_IRQ_NUM_MAX; j++) {
+-			if (ab->hw_params.ring_mask->tx[i] & BIT(j)) {
++			if (!nss_offload && ab->hw_params.ring_mask->tx[i] & BIT(j)) {
+ 				irq_grp->irqs[num_irq++] =
+ 					wbm2host_tx_completions_ring1 - j;
+ 			}
+ 
+-			if (ab->hw_params.ring_mask->rx[i] & BIT(j)) {
++			if (!nss_offload && ab->hw_params.ring_mask->rx[i] & BIT(j)) {
+ 				irq_grp->irqs[num_irq++] =
+ 					reo2host_destination_ring1 - j;
+ 			}
+ 
+-			if (ab->hw_params.ring_mask->rx_err[i] & BIT(j))
++			if (!nss_offload && ab->hw_params.ring_mask->rx_err[i] & BIT(j))
+ 				irq_grp->irqs[num_irq++] = reo2host_exception;
+ 
+-			if (ab->hw_params.ring_mask->rx_wbm_rel[i] & BIT(j))
++			if (!nss_offload && ab->hw_params.ring_mask->rx_wbm_rel[i] & BIT(j))
+ 				irq_grp->irqs[num_irq++] = wbm2host_rx_release;
+ 
+ 			if (ab->hw_params.ring_mask->reo_status[i] & BIT(j))
+@@ -563,7 +569,7 @@ static int ath11k_ahb_config_ext_irq(str
+ 						ath11k_hw_get_mac_from_pdev_id(hw, j);
+ 				}
+ 
+-				if (ab->hw_params.ring_mask->host2rxdma[i] & BIT(j)) {
++				if (!nss_offload && ab->hw_params.ring_mask->host2rxdma[i] & BIT(j)) {
+ 					irq_grp->irqs[num_irq++] =
+ 						host2rxdma_host_buf_ring_mac1 -
+ 						ath11k_hw_get_mac_from_pdev_id(hw, j);
+@@ -904,6 +910,7 @@ static int ath11k_ahb_setup_resources(st
+ 	}
+ 
+ 	ab->mem = mem;
++	ab->mem_pa = mem_res->start;
+ 	ab->mem_len = resource_size(mem_res);
+ 
+ 	return 0;
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -17,6 +17,12 @@
+ #include "hif.h"
+ #include "wow.h"
+ 
++unsigned int nss_offload;
++#ifdef CPTCFG_ATH11K_NSS_SUPPORT
++module_param_named(nss_offload, nss_offload, uint, 0644);
++MODULE_PARM_DESC(nss_offload, "Enable NSS Offload support");
++#endif
++
+ unsigned int ath11k_debug_mask;
+ EXPORT_SYMBOL(ath11k_debug_mask);
+ module_param_named(debug_mask, ath11k_debug_mask, uint, 0644);
+@@ -1528,10 +1534,16 @@ static int ath11k_core_pdev_create(struc
+ 		goto err_pdev_debug;
+ 	}
+ 
++	ret = ath11k_nss_setup(ab);
++	if (ret) {
++		ath11k_err(ab, "failed to setup nss driver interface%d", ret);
++		goto err_dp_pdev_free;
++	}
++
+ 	ret = ath11k_mac_register(ab);
+ 	if (ret) {
+ 		ath11k_err(ab, "failed register the radio with mac80211: %d\n", ret);
+-		goto err_dp_pdev_free;
++		goto err_nss_tear;
+ 	}
+ 
+ 	ret = ath11k_thermal_register(ab);
+@@ -1553,6 +1565,8 @@ err_thermal_unregister:
+ 	ath11k_thermal_unregister(ab);
+ err_mac_unregister:
+ 	ath11k_mac_unregister(ab);
++err_nss_tear:
++	ath11k_nss_teardown(ab);
+ err_dp_pdev_free:
+ 	ath11k_dp_pdev_free(ab);
+ err_pdev_debug:
+@@ -1566,6 +1580,10 @@ static void ath11k_core_pdev_destroy(str
+ 	ath11k_spectral_deinit(ab);
+ 	ath11k_thermal_unregister(ab);
+ 	ath11k_mac_unregister(ab);
++
++	ath11k_nss_teardown(ab);
++	ab->nss.enabled = false;
++
+ 	ath11k_hif_irq_disable(ab);
+ 	ath11k_dp_pdev_free(ab);
+ 	ath11k_debugfs_pdev_destroy(ab);
+@@ -1772,6 +1790,10 @@ static int ath11k_core_reconfigure_on_cr
+ 	int ret;
+ 
+ 	mutex_lock(&ab->core_lock);
++
++	ath11k_nss_teardown(ab);
++	ab->nss.enabled = false;
++
+ 	ath11k_thermal_unregister(ab);
+ 	ath11k_hif_irq_disable(ab);
+ 	ath11k_dp_pdev_free(ab);
+@@ -2095,6 +2117,10 @@ int ath11k_core_pre_init(struct ath11k_b
+ 		ath11k_err(ab, "failed to get hw params: %d\n", ret);
+ 		return ret;
+ 	}
++	ab->nss.enabled = nss_offload;
++
++	if (nss_offload)
++		ab->nss.stats_enabled = 1;
+ 
+ 	return 0;
+ }
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -29,6 +29,7 @@
+ #include "dbring.h"
+ #include "spectral.h"
+ #include "wow.h"
++#include "nss.h"
+ 
+ #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
+ 
+@@ -381,6 +382,9 @@ struct ath11k_vif {
+ #endif /* CPTCFG_ATH11K_DEBUGFS */
+ 
+ 	struct ath11k_mgmt_frame_stats mgmt_stats;
++#ifdef CPTCFG_ATH11K_NSS_SUPPORT
++	struct arvif_nss nss;
++#endif
+ };
+ 
+ struct ath11k_vif_iter {
+@@ -520,6 +524,9 @@ struct ath11k_sta {
+ #endif
+ 
+ 	bool use_4addr_set;
++#ifdef CPTCFG_ATH11K_NSS_SUPPORT
++	struct ath11k_nss_sta_stats *nss_stats;
++#endif
+ 	u16 tcl_metadata;
+ 
+ 	/* Protected with ar->data_lock */
+@@ -610,6 +617,9 @@ struct ath11k {
+ 	struct ieee80211_hw *hw;
+ 	struct ieee80211_ops *ops;
+ 	struct ath11k_pdev_wmi *wmi;
++#ifdef CPTCFG_ATH11K_NSS_SUPPORT
++	struct ath11k_nss nss;
++#endif
+ 	struct ath11k_pdev_dp dp;
+ 	u8 mac_addr[ETH_ALEN];
+ 	struct ath11k_he ar_he;
+@@ -827,6 +837,7 @@ struct ath11k_soc_dp_tx_err_stats {
+ 	 * idr unavailable etc.
+ 	 */
+ 	atomic_t misc_fail;
++	atomic_t nss_tx_fail;
+ };
+ 
+ struct ath11k_soc_dp_stats {
+@@ -868,9 +879,11 @@ struct ath11k_base {
+ 	struct ath11k_htc htc;
+ 
+ 	struct ath11k_dp dp;
++	struct ath11k_soc_nss nss;
+ 
+ 	void __iomem *mem;
+ 	void __iomem *mem_ce;
++	dma_addr_t mem_pa;
+ 	unsigned long mem_len;
+ 
+ 	struct {
+--- a/drivers/net/wireless/ath/ath11k/dp.c
++++ b/drivers/net/wireless/ath/ath11k/dp.c
+@@ -47,12 +47,17 @@ int ath11k_dp_peer_setup(struct ath11k *
+ 	struct ath11k_peer *peer;
+ 	u32 reo_dest;
+ 	int ret = 0, tid;
++	bool rx_hash_enable = DP_RX_HASH_ENABLE;
++
++	/* RX Hash based steering is disabled for NSS Offload */
++	if (ar->ab->nss.enabled)
++		rx_hash_enable = DP_RX_HASH_DISABLE;
+ 
+ 	/* NOTE: reo_dest ring id starts from 1 unlike mac_id which starts from 0 */
+ 	reo_dest = ar->dp.mac_id + 1;
+ 	ret = ath11k_wmi_set_peer_param(ar, addr, vdev_id,
+ 					WMI_PEER_SET_DEFAULT_ROUTING,
+-					DP_RX_HASH_ENABLE | (reo_dest << 1));
++					rx_hash_enable | (reo_dest << 1));
+ 
+ 	if (ret) {
+ 		ath11k_warn(ab, "failed to set default routing %d peer :%pM vdev_id :%d\n",
+@@ -132,6 +137,18 @@ static int ath11k_dp_srng_calculate_msi_
+ {
+ 	const u8 *grp_mask;
+ 
++	if (ab->nss.enabled) {
++		switch (type) {
++		case HAL_REO_STATUS:
++		case HAL_RXDMA_MONITOR_STATUS:
++		case HAL_RXDMA_MONITOR_DST:
++		case HAL_RXDMA_MONITOR_BUF:
++			break;
++		default:
++			return -ENOENT;
++		}
++	}
++
+ 	switch (type) {
+ 	case HAL_WBM2SW_RELEASE:
+ 		if (ring_num == DP_RX_RELEASE_RING_NUM) {
+@@ -778,14 +795,16 @@ int ath11k_dp_service_srng(struct ath11k
+ 	int work_done = 0;
+ 	int i, j;
+ 	int tot_work_done = 0;
++	bool nss_offload;
+ 
+-	for (i = 0; i < ab->hw_params.max_tx_ring; i++) {
+-		if (BIT(ab->hw_params.hal_params->tcl2wbm_rbm_map[i].wbm_ring_num) &
+-		    ab->hw_params.ring_mask->tx[grp_id])
+-			ath11k_dp_tx_completion_handler(ab, i);
++	nss_offload = ab->nss.enabled;
++
++	if (!nss_offload && ab->hw_params.ring_mask->tx[grp_id]) {
++		i = __fls(ab->hw_params.ring_mask->tx[grp_id]);
++		ath11k_dp_tx_completion_handler(ab, i);
+ 	}
+ 
+-	if (ab->hw_params.ring_mask->rx_err[grp_id]) {
++	if (!nss_offload && ab->hw_params.ring_mask->rx_err[grp_id]) {
+ 		work_done = ath11k_dp_process_rx_err(ab, napi, budget);
+ 		budget -= work_done;
+ 		tot_work_done += work_done;
+@@ -793,7 +812,7 @@ int ath11k_dp_service_srng(struct ath11k
+ 			goto done;
+ 	}
+ 
+-	if (ab->hw_params.ring_mask->rx_wbm_rel[grp_id]) {
++	if (!nss_offload && ab->hw_params.ring_mask->rx_wbm_rel[grp_id]) {
+ 		work_done = ath11k_dp_rx_process_wbm_err(ab,
+ 							 napi,
+ 							 budget);
+@@ -804,7 +823,7 @@ int ath11k_dp_service_srng(struct ath11k
+ 			goto done;
+ 	}
+ 
+-	if (ab->hw_params.ring_mask->rx[grp_id]) {
++	if (!nss_offload && ab->hw_params.ring_mask->rx[grp_id]) {
+ 		i =  fls(ab->hw_params.ring_mask->rx[grp_id]) - 1;
+ 		work_done = ath11k_dp_process_rx(ab, i, napi,
+ 						 budget);
+@@ -838,7 +857,7 @@ int ath11k_dp_service_srng(struct ath11k
+ 	if (ab->hw_params.ring_mask->reo_status[grp_id])
+ 		ath11k_dp_process_reo_status(ab);
+ 
+-	for (i = 0; i < ab->num_radios; i++) {
++	for (i = 0; !nss_offload && i < ab->num_radios; i++) {
+ 		for (j = 0; j < ab->hw_params.num_rxmda_per_pdev; j++) {
+ 			int id = i * ab->hw_params.num_rxmda_per_pdev + j;
+ 
+--- a/drivers/net/wireless/ath/ath11k/dp.h
++++ b/drivers/net/wireless/ath/ath11k/dp.h
+@@ -194,6 +194,7 @@ struct ath11k_pdev_dp {
+ #define DP_AVG_MSDUS_PER_MPDU 4
+ 
+ #define DP_RX_HASH_ENABLE	1 /* Enable hash based Rx steering */
++#define DP_RX_HASH_DISABLE	0 /* Disable hash based Rx steering */
+ 
+ #define DP_BA_WIN_SZ_MAX	256
+ 
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -17,6 +17,7 @@
+ #include "hal_rx.h"
+ #include "dp_tx.h"
+ #include "peer.h"
++#include "nss.h"
+ 
+ #define ATH11K_DP_RX_FRAGMENT_TIMEOUT_MS (2 * HZ)
+ 
+@@ -213,8 +214,8 @@ static inline u8 ath11k_dp_rx_h_mpdu_sta
+ 	return ab->hw_params.hw_ops->rx_desc_get_mpdu_tid(desc);
+ }
+ 
+-static inline u16 ath11k_dp_rx_h_mpdu_start_peer_id(struct ath11k_base *ab,
+-						    struct hal_rx_desc *desc)
++u16 ath11k_dp_rx_h_mpdu_start_peer_id(struct ath11k_base *ab,
++				      struct hal_rx_desc *desc)
+ {
+ 	return ab->hw_params.hw_ops->rx_desc_get_mpdu_peer_id(desc);
+ }
+@@ -225,8 +226,8 @@ static inline u8 ath11k_dp_rx_h_msdu_end
+ 	return ab->hw_params.hw_ops->rx_desc_get_l3_pad_bytes(desc);
+ }
+ 
+-static inline bool ath11k_dp_rx_h_msdu_end_first_msdu(struct ath11k_base *ab,
+-						      struct hal_rx_desc *desc)
++bool ath11k_dp_rx_h_msdu_end_first_msdu(struct ath11k_base *ab,
++					struct hal_rx_desc *desc)
+ {
+ 	return ab->hw_params.hw_ops->rx_desc_get_first_msdu(desc);
+ }
+@@ -283,7 +284,7 @@ static inline void ath11k_dp_rxdesc_set_
+ 	ab->hw_params.hw_ops->rx_desc_set_msdu_len(desc, len);
+ }
+ 
+-static bool ath11k_dp_rx_h_attn_is_mcbc(struct ath11k_base *ab,
++bool ath11k_dp_rx_h_attn_is_mcbc(struct ath11k_base *ab,
+ 					struct hal_rx_desc *desc)
+ {
+ 	struct rx_attention *attn = ath11k_dp_rx_get_attention(ab, desc);
+@@ -498,7 +499,9 @@ static int ath11k_dp_rxdma_pdev_buf_setu
+ 	struct dp_rxdma_ring *rx_ring = &dp->rx_refill_buf_ring;
+ 	int i;
+ 
+-	ath11k_dp_rxdma_ring_buf_setup(ar, rx_ring, HAL_RXDMA_BUF);
++	/* RXDMA BUF ring is offloaded to NSS */
++	if (!ar->ab->nss.enabled)
++		ath11k_dp_rxdma_ring_buf_setup(ar, rx_ring, HAL_RXDMA_BUF);
+ 
+ 	if (ar->ab->hw_params.rxdma1_enable) {
+ 		rx_ring = &dp->rxdma_mon_buf_ring;
+@@ -1893,7 +1896,7 @@ static void ath11k_dp_rx_h_csum_offload(
+ 			  CHECKSUM_NONE : CHECKSUM_UNNECESSARY;
+ }
+ 
+-static int ath11k_dp_rx_crypto_mic_len(struct ath11k *ar,
++int ath11k_dp_rx_crypto_mic_len(struct ath11k *ar,
+ 				       enum hal_encrypt_type enctype)
+ {
+ 	switch (enctype) {
+@@ -1920,7 +1923,7 @@ static int ath11k_dp_rx_crypto_mic_len(s
+ 	return 0;
+ }
+ 
+-static int ath11k_dp_rx_crypto_param_len(struct ath11k *ar,
++int ath11k_dp_rx_crypto_param_len(struct ath11k *ar,
+ 					 enum hal_encrypt_type enctype)
+ {
+ 	switch (enctype) {
+@@ -1948,7 +1951,7 @@ static int ath11k_dp_rx_crypto_param_len
+ 	return 0;
+ }
+ 
+-static int ath11k_dp_rx_crypto_icv_len(struct ath11k *ar,
++int ath11k_dp_rx_crypto_icv_len(struct ath11k *ar,
+ 				       enum hal_encrypt_type enctype)
+ {
+ 	switch (enctype) {
+@@ -5239,7 +5242,7 @@ int ath11k_dp_rx_process_mon_status(stru
+ 	struct sk_buff *skb;
+ 	struct sk_buff_head skb_list;
+ 	struct ath11k_peer *peer;
+-	struct ath11k_sta *arsta;
++	struct ath11k_sta *arsta = NULL;
+ 	int num_buffs_reaped = 0;
+ 	u32 rx_buf_sz;
+ 	u16 log_type;
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.h
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.h
+@@ -126,4 +126,16 @@ int ath11k_peer_rx_frag_setup(struct ath
+ int ath11k_dp_rx_pktlog_start(struct ath11k_base *ab);
+ int ath11k_dp_rx_pktlog_stop(struct ath11k_base *ab, bool stop_timer);
+ 
++int ath11k_dp_rx_crypto_mic_len(struct ath11k *ar,
++				       enum hal_encrypt_type enctype);
++int ath11k_dp_rx_crypto_param_len(struct ath11k *ar,
++					 enum hal_encrypt_type enctype);
++int ath11k_dp_rx_crypto_icv_len(struct ath11k *ar,
++				       enum hal_encrypt_type enctype);
++bool ath11k_dp_rx_h_msdu_end_first_msdu(struct ath11k_base *ab,
++					struct hal_rx_desc *desc);
++bool ath11k_dp_rx_h_attn_is_mcbc(struct ath11k_base *ab,
++				 struct hal_rx_desc *desc);
++u16 ath11k_dp_rx_h_mpdu_start_peer_id(struct ath11k_base *ab,
++				      struct hal_rx_desc *desc);
+ #endif /* ATH11K_DP_RX_H */
+--- a/drivers/net/wireless/ath/ath11k/hal.h
++++ b/drivers/net/wireless/ath/ath11k/hal.h
+@@ -424,6 +424,8 @@ enum hal_srng_ring_id {
+ #define HAL_SRNG_RING_ID_MAX    (HAL_SRNG_RING_ID_UMAC_ID_END + \
+ 				 HAL_SRNG_NUM_LMAC_RINGS)
+ 
++#define HAL_SRNG_REO_ALTERNATE_SELECT 0x7
++
+ enum hal_ring_type {
+ 	HAL_REO_DST,
+ 	HAL_REO_EXCEPTION,
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -24,6 +24,7 @@
+ #include "debugfs_sta.h"
+ #include "hif.h"
+ #include "wow.h"
++#include "nss.h"
+ 
+ #define CHAN2G(_channel, _freq, _flags) { \
+ 	.band                   = NL80211_BAND_2GHZ, \
+@@ -1603,6 +1604,11 @@ static void ath11k_control_beaconing(str
+ 	lockdep_assert_held(&arvif->ar->conf_mutex);
+ 
+ 	if (!info->enable_beacon) {
++
++		ret = ath11k_nss_vdev_down(arvif);
++		if(ret)
++			ath11k_warn(ar->ab, "failure in nss vdev down %d\r\n",ret);
++
+ 		ret = ath11k_wmi_vdev_down(ar, arvif->vdev_id);
+ 		if (ret)
+ 			ath11k_warn(ar->ab, "failed to down vdev_id %i: %d\n",
+@@ -1642,6 +1648,12 @@ static void ath11k_control_beaconing(str
+ 
+ 	arvif->is_up = true;
+ 
++	ret = ath11k_nss_vdev_up(arvif);
++	if(ret) {
++		ath11k_warn(ar->ab, "failure in nss vdev up %d\r\n",ret);
++		return;
++	}
++
+ 	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "vdev %d up\n", arvif->vdev_id);
+ }
+ 
+@@ -3075,6 +3087,12 @@ static void ath11k_bss_assoc(struct ieee
+ 		   "vdev %d up (associated) bssid %pM aid %d\n",
+ 		   arvif->vdev_id, bss_conf->bssid, vif->cfg.aid);
+ 
++	ret = ath11k_nss_vdev_up(arvif);
++	if(ret) {
++		ath11k_warn(ar->ab, "failure in nss vdev up %d\r\n",ret);
++		return;
++	}
++
+ 	spin_lock_bh(&ar->ab->base_lock);
+ 
+ 	peer = ath11k_peer_find(ar->ab, arvif->vdev_id, arvif->bssid);
+@@ -3117,6 +3135,10 @@ static void ath11k_bss_disassoc(struct i
+ 
+ 	lockdep_assert_held(&ar->conf_mutex);
+ 
++	ret = ath11k_nss_vdev_down(arvif);
++	if(ret)
++		ath11k_warn(ar->ab, "failure in nss vdev down %d\r\n",ret);
++
+ 	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "vdev %i disassoc bssid %pM\n",
+ 		   arvif->vdev_id, arvif->bssid);
+ 
+@@ -3397,6 +3419,28 @@ static int ath11k_mac_config_obss_pd(str
+ 	return 0;
+ }
+ 
++static void ath11k_mac_op_nss_bss_info_changed(struct ieee80211_hw *hw,
++					   struct ieee80211_vif *vif,
++					   u32 changed)
++{
++	struct ath11k *ar = hw->priv;
++	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
++	int ret = 0;
++
++	mutex_lock(&ar->conf_mutex);
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "Setting ap_isolate %d to NSS\n",
++		   arvif->vif->bss_conf.nss_ap_isolate);
++	if (changed & BSS_CHANGED_NSS_AP_ISOLATE) {
++		ret = ath11k_nss_vdev_set_cmd(arvif, ATH11K_NSS_WIFI_VDEV_CFG_AP_BRIDGE_CMD,
++					      !arvif->vif->bss_conf.nss_ap_isolate);
++		if(ret)
++			ath11k_warn(ar->ab, "failed to set ap_isolate in nss %d\n", ret);
++	}
++
++	mutex_unlock(&ar->conf_mutex);
++}
++
+ static void ath11k_mac_op_bss_info_changed(struct ieee80211_hw *hw,
+ 					   struct ieee80211_vif *vif,
+ 					   struct ieee80211_bss_conf *info,
+@@ -4295,6 +4339,26 @@ static int ath11k_mac_op_set_key(struct
+ 
+ 	spin_lock_bh(&ab->base_lock);
+ 	peer = ath11k_peer_find(ab, arvif->vdev_id, peer_addr);
++
++	/* TODO: Check if vdev specific security cfg is mandatory */
++	ret = ath11k_nss_vdev_set_cmd(arvif, ATH11K_NSS_WIFI_VDEV_SECURITY_TYPE_CMD, key->cipher);
++	if (ret) {
++		ath11k_warn(ab, "failure to set vdev security type in nss");
++		goto unlock;
++	}
++
++	ret = ath11k_nss_set_peer_sec_type(ar, peer, key);
++	if (ret) {
++		ath11k_warn(ab, "failure to set peer security type in nss");
++		goto unlock;
++	}
++
++	ret = ath11k_nss_set_peer_authorize(ar, peer->peer_id);
++	if (ret) {
++		ath11k_warn(ab, "failure to authorize peer in nss");
++		goto unlock;
++	}
++
+ 	if (peer && cmd == SET_KEY) {
+ 		peer->keys[key->keyidx] = key;
+ 		if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
+@@ -4333,9 +4397,8 @@ static int ath11k_mac_op_set_key(struct
+ 			break;
+ 		}
+ 	}
+-
++unlock:
+ 	spin_unlock_bh(&ab->base_lock);
+-
+ exit:
+ 	mutex_unlock(&ar->conf_mutex);
+ 	return ret;
+@@ -6216,10 +6279,16 @@ static void ath11k_mac_op_tx(struct ieee
+ 	if (control->sta)
+ 		arsta = ath11k_sta_to_arsta(control->sta);
+ 
+-	ret = ath11k_dp_tx(ar, arvif, arsta, skb);
++	if (ar->ab->nss.enabled) {
++		arvif->ar->ab->nss.debug_mode = true;
++		ret = ath11k_nss_tx(arvif, skb);
++  }
++	else
++		ret = ath11k_dp_tx(ar, arvif, arsta, skb);
+ 	if (unlikely(ret)) {
+ 		ath11k_warn(ar->ab, "failed to transmit frame %d\n", ret);
+ 		ieee80211_free_txskb(ar->hw, skb);
++		return;
+ 	}
+ }
+ 
+@@ -6241,6 +6310,8 @@ static int ath11k_mac_config_mon_status_
+ 
+ 	if (enable) {
+ 		tlv_filter = ath11k_mac_mon_status_filter_default;
++		ath11k_nss_ext_rx_stats(ar->ab, &tlv_filter);
++
+ 		if (ath11k_debugfs_rx_filter(ar))
+ 			tlv_filter.rx_filter = ath11k_debugfs_rx_filter(ar);
+ 	}
+@@ -6539,7 +6610,7 @@ static int ath11k_mac_setup_vdev_create_
+ 	return 0;
+ }
+ 
+-static void ath11k_mac_op_update_vif_offload(struct ieee80211_hw *hw,
++static int ath11k_mac_op_update_vif_offload(struct ieee80211_hw *hw,
+ 					     struct ieee80211_vif *vif)
+ {
+ 	struct ath11k *ar = hw->priv;
+@@ -6585,6 +6656,8 @@ static void ath11k_mac_op_update_vif_off
+ 			    arvif->vdev_id, ret);
+ 		vif->offload_flags &= ~IEEE80211_OFFLOAD_DECAP_ENABLED;
+ 	}
++
++	return ret;
+ }
+ 
+ static bool ath11k_mac_vif_ap_active_any(struct ath11k_base *ab)
+@@ -6715,6 +6788,8 @@ static int ath11k_mac_vdev_delete(struct
+ 
+ 	reinit_completion(&ar->vdev_delete_done);
+ 
++	ath11k_nss_vdev_delete(arvif);
++
+ 	ret = ath11k_wmi_vdev_delete(ar, arvif->vdev_id);
+ 	if (ret) {
+ 		ath11k_warn(ar->ab, "failed to delete WMI vdev %d: %d\n",
+@@ -6855,7 +6930,34 @@ static int ath11k_mac_op_add_interface(s
+ 	list_add(&arvif->list, &ar->arvifs);
+ 	spin_unlock_bh(&ar->data_lock);
+ 
+-	ath11k_mac_op_update_vif_offload(hw, vif);
++	ret = ath11k_nss_vdev_create(arvif);
++	if(ret) {
++		ath11k_warn(ab, "failed to create nss vdev %d\n", ret);
++		goto err_vdev_del;
++	}
++
++	if (ath11k_mac_op_update_vif_offload(hw, vif))
++		goto err_vdev_del;
++
++	if (vif->offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED)
++		param_value = ATH11K_HW_TXRX_ETHERNET;
++	else if (test_bit(ATH11K_FLAG_RAW_MODE, &ab->dev_flags))
++		param_value = ATH11K_HW_TXRX_RAW;
++	else
++		param_value = ATH11K_HW_TXRX_NATIVE_WIFI;
++
++	ret = ath11k_nss_vdev_set_cmd(arvif, ATH11K_NSS_WIFI_VDEV_ENCAP_TYPE_CMD, param_value);
++
++	if(ret) {
++		ath11k_warn(ab, "failed to set encap type in nss %d\n", ret);
++		goto err_vdev_del;
++	}
++
++	ret = ath11k_nss_vdev_set_cmd(arvif, ATH11K_NSS_WIFI_VDEV_DECAP_TYPE_CMD, param_value);
++	if(ret) {
++		ath11k_warn(ab, "failed to set decap type in nss %d\n", ret);
++		goto err_vdev_del;
++	}
+ 
+ 	nss = get_num_chains(ar->cfg_tx_chainmask) ? : 1;
+ 	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id,
+@@ -6979,6 +7081,7 @@ err_peer_del:
+ 	}
+ 
+ err_vdev_del:
++	ath11k_nss_vdev_delete(arvif);
+ 	ath11k_mac_vdev_delete(ar, arvif);
+ 	spin_lock_bh(&ar->data_lock);
+ 	list_del(&arvif->list);
+@@ -7489,6 +7592,10 @@ ath11k_mac_update_vif_chan(struct ath11k
+ 				    arvif->vdev_id, ret);
+ 			continue;
+ 		}
++
++		ret = ath11k_nss_vdev_up(arvif);
++		if(ret)
++			ath11k_warn(ar->ab, "failure in nss vdev up %d\r\n",ret);
+ 	}
+ 
+ 	/* Restart the internal monitor vdev on new channel */
+@@ -8717,6 +8824,8 @@ static void ath11k_mac_op_sta_statistics
+ 	sinfo->signal_avg = ewma_avg_rssi_read(&arsta->avg_rssi) +
+ 		ATH11K_DEFAULT_NOISE_FLOOR;
+ 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
++
++	ath11k_nss_update_sta_stats(sinfo, sta, arsta);
+ }
+ 
+ #if IS_ENABLED(CONFIG_IPV6)
+@@ -9136,6 +9245,7 @@ static const struct ieee80211_ops ath11k
+ 	.update_vif_offload		= ath11k_mac_op_update_vif_offload,
+ 	.config                         = ath11k_mac_op_config,
+ 	.bss_info_changed               = ath11k_mac_op_bss_info_changed,
++	.nss_bss_info_changed           = ath11k_mac_op_nss_bss_info_changed,
+ 	.configure_filter		= ath11k_mac_op_configure_filter,
+ 	.hw_scan                        = ath11k_mac_op_hw_scan,
+ 	.cancel_hw_scan                 = ath11k_mac_op_cancel_hw_scan,
+@@ -9521,7 +9631,8 @@ static int __ath11k_mac_register(struct
+ 		ieee80211_hw_set(ar->hw, TX_AMPDU_SETUP_IN_HW);
+ 		ieee80211_hw_set(ar->hw, SUPPORTS_REORDERING_BUFFER);
+ 		ieee80211_hw_set(ar->hw, SUPPORTS_AMSDU_IN_AMPDU);
+-		ieee80211_hw_set(ar->hw, USES_RSS);
++		if(!ab->nss.enabled)
++			ieee80211_hw_set(ar->hw, USES_RSS);
+ 	}
+ 
+ 	ar->hw->wiphy->features |= NL80211_FEATURE_STATIC_SMPS;
+@@ -9636,6 +9747,9 @@ static int __ath11k_mac_register(struct
+ 	    ab->hw_params.bios_sar_capa)
+ 		ar->hw->wiphy->sar_capa = ab->hw_params.bios_sar_capa;
+ 
++	if (ab->nss.enabled)
++		ieee80211_hw_set(ar->hw, SUPPORTS_NSS_OFFLOAD);
++
+ 	ret = ieee80211_register_hw(ar->hw);
+ 	if (ret) {
+ 		ath11k_err(ar->ab, "ieee80211 registration failed: %d\n", ret);
+--- a/drivers/net/wireless/ath/ath11k/peer.c
++++ b/drivers/net/wireless/ath/ath11k/peer.c
+@@ -7,6 +7,7 @@
+ #include "core.h"
+ #include "peer.h"
+ #include "debug.h"
++#include "nss.h"
+ 
+ static struct ath11k_peer *ath11k_peer_find_list_by_id(struct ath11k_base *ab,
+ 						       int peer_id)
+@@ -136,6 +137,8 @@ void ath11k_peer_map_event(struct ath11k
+ 		ether_addr_copy(peer->addr, mac_addr);
+ 		list_add(&peer->list, &ab->peers);
+ 		wake_up(&ab->peer_mapping_wq);
++		if (ab->nss.enabled)
++			ath11k_nss_peer_create(ab, peer);
+ 	}
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_DP_HTT, "peer map vdev %d peer %pM id %d\n",
+@@ -298,17 +301,13 @@ static int __ath11k_peer_delete(struct a
+ 
+ 	lockdep_assert_held(&ar->conf_mutex);
+ 
++	reinit_completion(&ar->peer_delete_done);
++	ath11k_nss_peer_delete(ar->ab, addr);
++
+ 	mutex_lock(&ab->tbl_mtx_lock);
+ 	spin_lock_bh(&ab->base_lock);
+ 
+ 	peer = ath11k_peer_find_by_addr(ab, addr);
+-	/* Check if the found peer is what we want to remove.
+-	 * While the sta is transitioning to another band we may
+-	 * have 2 peer with the same addr assigned to different
+-	 * vdev_id. Make sure we are deleting the correct peer.
+-	 */
+-	if (peer && peer->vdev_id == vdev_id)
+-		ath11k_peer_rhash_delete(ab, peer);
+ 
+ 	/* Fallback to peer list search if the correct peer can't be found.
+ 	 * Skip the deletion of the peer from the rhash since it has already
+@@ -327,10 +326,17 @@ static int __ath11k_peer_delete(struct a
+ 		return -EINVAL;
+ 	}
+ 
++	/* Check if the found peer is what we want to remove.
++	 * While the sta is transitioning to another band we may
++	 * have 2 peer with the same addr assigned to different
++	 * vdev_id. Make sure we are deleting the correct peer.
++	 */
++	if (peer && peer->vdev_id == vdev_id)
++		ath11k_peer_rhash_delete(ab, peer);
++
+ 	spin_unlock_bh(&ab->base_lock);
+ 	mutex_unlock(&ab->tbl_mtx_lock);
+ 
+-	reinit_completion(&ar->peer_delete_done);
+ 
+ 	ret = ath11k_wmi_send_peer_delete_cmd(ar, addr, vdev_id);
+ 	if (ret) {
+@@ -446,6 +452,7 @@ int ath11k_peer_create(struct ath11k *ar
+ 	peer->sec_type_grp = HAL_ENCRYPT_TYPE_OPEN;
+ 	peer->vif = arvif->vif;
+ 
++
+ 	if (sta) {
+ 		arsta = ath11k_sta_to_arsta(sta);
+ 		arsta->tcl_metadata |= FIELD_PREP(HTT_TCL_META_DATA_TYPE, 0) |
+--- a/drivers/net/wireless/ath/ath11k/peer.h
++++ b/drivers/net/wireless/ath/ath11k/peer.h
+@@ -17,6 +17,7 @@ struct ath11k_peer {
+ 	u16 ast_hash;
+ 	u8 pdev_idx;
+ 	u16 hw_peer_id;
++	struct ath11k_nss_peer nss;
+ 
+ 	/* protected by ab->data_lock */
+ 	struct ieee80211_key_conf *keys[WMI_MAX_KEY_INDEX + 1];
+--- a/drivers/net/wireless/ath/ath11k/pci.c
++++ b/drivers/net/wireless/ath/ath11k/pci.c
+@@ -570,6 +570,7 @@ static int ath11k_pci_claim(struct ath11
+ 	}
+ 
+ 	ab->mem_ce = ab->mem;
++	ab->mem_pa = pci_resource_start(pdev, ATH11K_PCI_BAR_NUM);
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_BOOT, "pci_mem 0x%p\n", ab->mem);
+ 	return 0;
+--- a/drivers/net/wireless/ath/ath11k/debugfs.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs.c
+@@ -10,11 +10,10 @@
+ #include "core.h"
+ #include "debug.h"
+ #include "wmi.h"
+-#include "hal_rx.h"
+ #include "dp_tx.h"
+ #include "debugfs_htt_stats.h"
+-#include "peer.h"
+ #include "hif.h"
++#include "qmi.h"
+ 
+ static const char *htt_bp_umac_ring[HTT_SW_UMAC_RING_IDX_MAX] = {
+ 	"REO2SW1_RING",
+@@ -663,6 +662,7 @@ static ssize_t ath11k_write_extd_rx_stat
+ 			HTT_RX_FP_DATA_FILTER_FLASG3;
+ 	} else {
+ 		tlv_filter = ath11k_mac_mon_status_filter_default;
++		ath11k_nss_ext_rx_stats(ar->ab, &tlv_filter);
+ 	}
+ 
+ 	ar->debug.rx_filter = tlv_filter.rx_filter;
+@@ -1669,72 +1669,6 @@ static const struct file_operations fops
+ 	.open = simple_open
+ };
+ 
+-int ath11k_debugfs_register(struct ath11k *ar)
+-{
+-	struct ath11k_base *ab = ar->ab;
+-	char pdev_name[10];
+-	char buf[100] = {0};
+-
+-	snprintf(pdev_name, sizeof(pdev_name), "%s%u", "mac", ar->pdev_idx);
+-
+-	ar->debug.debugfs_pdev = debugfs_create_dir(pdev_name, ab->debugfs_soc);
+-	if (IS_ERR(ar->debug.debugfs_pdev))
+-		return PTR_ERR(ar->debug.debugfs_pdev);
+-
+-	/* Create a symlink under ieee80211/phy* */
+-	snprintf(buf, 100, "../../ath11k/%pd2", ar->debug.debugfs_pdev);
+-	debugfs_create_symlink("ath11k", ar->hw->wiphy->debugfsdir, buf);
+-
+-	ath11k_debugfs_htt_stats_init(ar);
+-
+-	ath11k_debugfs_fw_stats_init(ar);
+-
+-	debugfs_create_file("ext_tx_stats", 0644,
+-			    ar->debug.debugfs_pdev, ar,
+-			    &fops_extd_tx_stats);
+-	debugfs_create_file("ext_rx_stats", 0644,
+-			    ar->debug.debugfs_pdev, ar,
+-			    &fops_extd_rx_stats);
+-	debugfs_create_file("pktlog_filter", 0644,
+-			    ar->debug.debugfs_pdev, ar,
+-			    &fops_pktlog_filter);
+-	debugfs_create_file("fw_dbglog_config", 0600,
+-			    ar->debug.debugfs_pdev, ar,
+-			    &fops_fw_dbglog);
+-	debugfs_create_file("dump_mgmt_stats", 0644,
+-			    ar->debug.debugfs_pdev, ar,
+-			    &fops_dump_mgmt_stats);
+-
+-	if (ar->hw->wiphy->bands[NL80211_BAND_5GHZ]) {
+-		debugfs_create_file("dfs_simulate_radar", 0200,
+-				    ar->debug.debugfs_pdev, ar,
+-				    &fops_simulate_radar);
+-		debugfs_create_bool("dfs_block_radar_events", 0200,
+-				    ar->debug.debugfs_pdev,
+-				    &ar->dfs_block_radar_events);
+-	}
+-
+-	if (ab->hw_params.dbr_debug_support)
+-		debugfs_create_file("enable_dbr_debug", 0200, ar->debug.debugfs_pdev,
+-				    ar, &fops_dbr_debug);
+-
+-	debugfs_create_file("ps_state_enable", 0600, ar->debug.debugfs_pdev, ar,
+-			    &fops_ps_state_enable);
+-
+-	if (test_bit(WMI_TLV_SERVICE_PEER_POWER_SAVE_DURATION_SUPPORT,
+-		     ar->ab->wmi_ab.svc_map)) {
+-		debugfs_create_file("ps_timekeeper_enable", 0600,
+-				    ar->debug.debugfs_pdev, ar,
+-				    &fops_ps_timekeeper_enable);
+-
+-		debugfs_create_file("reset_ps_duration", 0200,
+-				    ar->debug.debugfs_pdev, ar,
+-				    &fops_reset_ps_duration);
+-	}
+-
+-	return 0;
+-}
+-
+ void ath11k_debugfs_unregister(struct ath11k *ar)
+ {
+ 	struct ath11k_debug_dbr *dbr_debug;
+@@ -1977,6 +1911,144 @@ static const struct file_operations ath1
+ 	.open = simple_open
+ };
+ 
++static ssize_t ath11k_write_nss_stats(struct file *file,
++				      const char __user *ubuf,
++				      size_t count, loff_t *ppos)
++{
++	struct ath11k *ar = file->private_data;
++	struct ath11k_base *ab = ar->ab;
++	u32 nss_stats;
++	int ret;
++
++	if (!ab->nss.enabled) {
++		ath11k_warn(ab, "nss offload not enabled\n");
++		return -EINVAL;
++	}
++
++	if (kstrtouint_from_user(ubuf, count, 0, &nss_stats))
++		return -EINVAL;
++
++	mutex_lock(&ar->conf_mutex);
++
++	if (ar->state != ATH11K_STATE_ON) {
++		ret = -ENETDOWN;
++		goto out;
++	}
++
++	if (nss_stats == ab->nss.stats_enabled) {
++		ret = count;
++		goto out;
++	}
++
++	if (nss_stats > 0) {
++		ab->nss.stats_enabled = 1;
++		ath11k_nss_peer_stats_enable(ar);
++	} else {
++		ab->nss.stats_enabled = 0;
++		ath11k_nss_peer_stats_disable(ar);
++	}
++
++	ret = count;
++out:
++	mutex_unlock(&ar->conf_mutex);
++	return ret;
++}
++
++static ssize_t ath11k_read_nss_stats(struct file *file,
++				     char __user *ubuf,
++				     size_t count, loff_t *ppos)
++
++{
++	char buf[32] = {0};
++	struct ath11k *ar = file->private_data;
++	struct ath11k_base *ab = ar->ab;
++	int len = 0;
++
++	mutex_lock(&ar->conf_mutex);
++	len = scnprintf(buf, sizeof(buf) - len, "%08x\n",
++			ab->nss.stats_enabled);
++	mutex_unlock(&ar->conf_mutex);
++
++	return simple_read_from_buffer(ubuf, count, ppos, buf, len);
++}
++
++static const struct file_operations fops_nss_stats = {
++	.read = ath11k_read_nss_stats,
++	.write = ath11k_write_nss_stats,
++	.open = simple_open,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++};
++
++int ath11k_debugfs_register(struct ath11k *ar)
++{
++	struct ath11k_base *ab = ar->ab;
++	char pdev_name[10];
++	char buf[100] = {0};
++
++	snprintf(pdev_name, sizeof(pdev_name), "%s%u", "mac", ar->pdev_idx);
++
++	ar->debug.debugfs_pdev = debugfs_create_dir(pdev_name, ab->debugfs_soc);
++	if (IS_ERR(ar->debug.debugfs_pdev))
++		return PTR_ERR(ar->debug.debugfs_pdev);
++
++	/* Create a symlink under ieee80211/phy* */
++	snprintf(buf, 100, "../../ath11k/%pd2", ar->debug.debugfs_pdev);
++	debugfs_create_symlink("ath11k", ar->hw->wiphy->debugfsdir, buf);
++
++	ath11k_debugfs_htt_stats_init(ar);
++
++	ath11k_debugfs_fw_stats_init(ar);
++
++	debugfs_create_file("ext_tx_stats", 0644,
++			    ar->debug.debugfs_pdev, ar,
++			    &fops_extd_tx_stats);
++	debugfs_create_file("ext_rx_stats", 0644,
++			    ar->debug.debugfs_pdev, ar,
++			    &fops_extd_rx_stats);
++	debugfs_create_file("pktlog_filter", 0644,
++			    ar->debug.debugfs_pdev, ar,
++			    &fops_pktlog_filter);
++	debugfs_create_file("fw_dbglog_config", 0600,
++			    ar->debug.debugfs_pdev, ar,
++			    &fops_fw_dbglog);
++	debugfs_create_file("dump_mgmt_stats", 0644,
++			    ar->debug.debugfs_pdev, ar,
++			    &fops_dump_mgmt_stats);
++
++	if (ar->hw->wiphy->bands[NL80211_BAND_5GHZ]) {
++		debugfs_create_file("dfs_simulate_radar", 0200,
++				    ar->debug.debugfs_pdev, ar,
++				    &fops_simulate_radar);
++		debugfs_create_bool("dfs_block_radar_events", 0200,
++				    ar->debug.debugfs_pdev,
++				    &ar->dfs_block_radar_events);
++	}
++
++	if (ab->hw_params.dbr_debug_support)
++		debugfs_create_file("enable_dbr_debug", 0200, ar->debug.debugfs_pdev,
++				    ar, &fops_dbr_debug);
++
++	debugfs_create_file("ps_state_enable", 0600, ar->debug.debugfs_pdev, ar,
++			    &fops_ps_state_enable);
++
++	if (test_bit(WMI_TLV_SERVICE_PEER_POWER_SAVE_DURATION_SUPPORT,
++		     ar->ab->wmi_ab.svc_map)) {
++		debugfs_create_file("ps_timekeeper_enable", 0600,
++				    ar->debug.debugfs_pdev, ar,
++				    &fops_ps_timekeeper_enable);
++
++		debugfs_create_file("reset_ps_duration", 0200,
++				    ar->debug.debugfs_pdev, ar,
++				    &fops_reset_ps_duration);
++	}
++
++	if (ab->nss.enabled)
++		debugfs_create_file("nss_peer_stats_config", 0644,
++				    ar->debug.debugfs_pdev, ar, &fops_nss_stats);
++
++	return 0;
++}
+ void ath11k_debugfs_add_interface(struct ath11k_vif *arvif)
+ {
+ 	struct ath11k_base *ab = arvif->ar->ab;
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -12,7 +12,7 @@
+ #include "peer.h"
+ #include "mac.h"
+ 
+-static enum hal_tcl_encap_type
++enum hal_tcl_encap_type
+ ath11k_dp_tx_get_encap_type(struct ath11k_vif *arvif, struct sk_buff *skb)
+ {
+ 	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.h
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.h
+@@ -38,6 +38,8 @@ int ath11k_dp_tx_htt_rx_filter_setup(str
+ 				     int mac_id, enum hal_ring_type ring_type,
+ 				     int rx_buf_size,
+ 				     struct htt_rx_ring_tlv_filter *tlv_filter);
++enum hal_tcl_encap_type
++ath11k_dp_tx_get_encap_type(struct ath11k_vif *arvif, struct sk_buff *skb);
+ 
+ int ath11k_dp_tx_htt_rx_full_mon_setup(struct ath11k_base *ab, int mac_id,
+ 				       bool config);
+--- a/drivers/net/wireless/ath/ath11k/nss.c
++++ b/drivers/net/wireless/ath/ath11k/nss.c
+@@ -8,6 +8,8 @@
+ #include "nss.h"
+ #include "core.h"
+ #include "peer.h"
++#include "dp_rx.h"
++#include "dp_tx.h"
+ #include "hif.h"
+ #include "wmi.h"
+ #include "../../../../../net/mac80211/sta_info.h"
+@@ -465,7 +467,7 @@ deliver_amsdu:
+ 
+ 	/* create list containing all the subframes */
+ 	ieee80211_amsdu_to_8023s(skb, &subframe_list, NULL,
+-				 vif->type, 0, NULL, NULL);
++				 vif->type, 0, NULL, NULL, false);
+ 
+ 	/* This shouldn't happen, indicating error during defragmentation */
+ 	if (skb_queue_empty(&subframe_list))
+@@ -657,12 +659,14 @@ drop:
+ 	return -EINVAL;
+ }
+ 
+-int ath11k_nss_vdev_set_cmd(struct ath11k_vif *arvif, int cmd, int val)
++int ath11k_nss_vdev_set_cmd(struct ath11k_vif *arvif, enum ath11k_nss_vdev_cmd nss_cmd,
++			    int val)
+ {
+ 	struct nss_wifi_vdev_msg *vdev_msg = NULL;
+ 	struct nss_wifi_vdev_cmd_msg *vdev_cmd;
+ 	struct ath11k *ar = arvif->ar;
+ 	nss_tx_status_t status;
++	int cmd;
+ 
+ 	if (!ar->ab->nss.enabled)
+ 		return 0;
+@@ -675,6 +679,22 @@ int ath11k_nss_vdev_set_cmd(struct ath11
+ 	if (!vdev_msg)
+ 		return -ENOMEM;
+ 
++	switch(nss_cmd) {
++	case ATH11K_NSS_WIFI_VDEV_CFG_AP_BRIDGE_CMD:
++		cmd = NSS_WIFI_VDEV_CFG_AP_BRIDGE_CMD;
++		break;
++	case ATH11K_NSS_WIFI_VDEV_SECURITY_TYPE_CMD:
++		cmd = NSS_WIFI_VDEV_SECURITY_TYPE_CMD;
++		break;
++	case ATH11K_NSS_WIFI_VDEV_ENCAP_TYPE_CMD:
++		cmd = NSS_WIFI_VDEV_ENCAP_TYPE_CMD;
++		break;
++	case ATH11K_NSS_WIFI_VDEV_DECAP_TYPE_CMD:
++		cmd = NSS_WIFI_VDEV_DECAP_TYPE_CMD;
++		break;
++	default:
++		return -EINVAL;
++	}
+ 	/* TODO: Convert to function for conversion in case of many
+ 	 * such commands
+ 	 */
+@@ -1136,7 +1156,6 @@ void ath11k_nss_update_sta_stats(struct
+ {
+ 	struct sta_info *stainfo;
+ 	struct ath11k_peer *peer;
+-	int tid_idx;
+ 	struct ath11k *ar = arsta->arvif->ar;
+ 	struct ath11k_base *ab = ar->ab;
+ 
+@@ -1230,6 +1249,9 @@ void ath11k_nss_update_sta_rxrate(struct
+ 	if (!ab->nss.enabled)
+ 		return;
+ 
++	if (!ieee80211_is_data(__cpu_to_le16(ppdu_info->frame_control)))
++		return;
++
+ 	if (!peer->nss.nss_stats)
+ 		return;
+ 
+@@ -1289,7 +1311,7 @@ void ath11k_nss_update_sta_rxrate(struct
+ 		peer->nss.nss_stats->rxrate.mcs = mcs;
+ 		peer->nss.nss_stats->rxrate.flags = RATE_INFO_FLAGS_HE_MCS;
+ 		peer->nss.nss_stats->rxrate.he_dcm = ppdu_info->dcm;
+-		peer->nss.nss_stats->rxrate.he_gi = ath11k_he_gi_to_nl80211_he_gi(ppdu_info->gi);
++		peer->nss.nss_stats->rxrate.he_gi = ath11k_mac_he_gi_to_nl80211_he_gi(ppdu_info->gi);
+ 		peer->nss.nss_stats->rxrate.he_ru_alloc = ppdu_info->ru_alloc;
+ 		break;
+ 	}
+--- a/drivers/net/wireless/ath/ath11k/nss.h
++++ b/drivers/net/wireless/ath/ath11k/nss.h
+@@ -101,6 +101,13 @@ do {	\
+ 	u64_stats_update_end(&tstats->syncp);	\
+ } while (0)
+ 
++enum ath11k_nss_vdev_cmd {
++	ATH11K_NSS_WIFI_VDEV_CFG_AP_BRIDGE_CMD,
++	ATH11K_NSS_WIFI_VDEV_SECURITY_TYPE_CMD,
++	ATH11K_NSS_WIFI_VDEV_ENCAP_TYPE_CMD,
++	ATH11K_NSS_WIFI_VDEV_DECAP_TYPE_CMD,
++};
++
+ enum ath11k_nss_opmode {
+ 	ATH11K_NSS_OPMODE_UNKNOWN,
+ 	ATH11K_NSS_OPMODE_AP,
+@@ -192,7 +199,8 @@ struct ath11k_soc_nss {
+ 
+ #ifdef CPTCFG_ATH11K_NSS_SUPPORT
+ int ath11k_nss_tx(struct ath11k_vif *arvif, struct sk_buff *skb);
+-int ath11k_nss_vdev_set_cmd(struct ath11k_vif *arvif, int cmd, int val);
++int ath11k_nss_vdev_set_cmd(struct ath11k_vif *arvif, enum ath11k_nss_vdev_cmd cmd,
++			    int val);
+ int ath11k_nss_vdev_create(struct ath11k_vif *arvif);
+ void ath11k_nss_vdev_delete(struct ath11k_vif *arvif);
+ int ath11k_nss_vdev_up(struct ath11k_vif *arvif);
+@@ -219,7 +227,8 @@ static inline int ath11k_nss_tx(struct a
+ 	return 0;
+ }
+ 
+-static inline int ath11k_nss_vdev_set_cmd(struct ath11k_vif *arvif, int cmd, int val)
++static inline int ath11k_nss_vdev_set_cmd(struct ath11k_vif *arvif, enum ath11k_nss_vdev_cmd cmd,
++					  int val)
+ {
+ 	return 0;
+ }
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -104,8 +104,10 @@ static void ath11k_init_wmi_config_qca63
+ 
+ static void ath11k_hw_ipq8074_reo_setup(struct ath11k_base *ab)
+ {
++	u8 frag_dest_ring = HAL_SRNG_RING_ID_REO2SW1;
+ 	u32 reo_base = HAL_SEQ_WCSS_UMAC_REO_REG;
+ 	u32 val;
++
+ 	/* Each hash entry uses three bits to map to a particular ring. */
+ 	u32 ring_hash_map = HAL_HASH_ROUTING_RING_SW1 << 0 |
+ 		HAL_HASH_ROUTING_RING_SW2 << 3 |
+@@ -116,11 +118,14 @@ static void ath11k_hw_ipq8074_reo_setup(
+ 		HAL_HASH_ROUTING_RING_SW3 << 18 |
+ 		HAL_HASH_ROUTING_RING_SW4 << 21;
+ 
++	if (ab->nss.enabled)
++		frag_dest_ring = HAL_SRNG_REO_ALTERNATE_SELECT;
++
+ 	val = ath11k_hif_read32(ab, reo_base + HAL_REO1_GEN_ENABLE);
+ 
+ 	val &= ~HAL_REO1_GEN_ENABLE_FRAG_DST_RING;
+ 	val |= FIELD_PREP(HAL_REO1_GEN_ENABLE_FRAG_DST_RING,
+-			HAL_SRNG_RING_ID_REO2SW1) |
++			  frag_dest_ring) |
+ 		FIELD_PREP(HAL_REO1_GEN_ENABLE_AGING_LIST_ENABLE, 1) |
+ 		FIELD_PREP(HAL_REO1_GEN_ENABLE_AGING_FLUSH_ENABLE, 1);
+ 	ath11k_hif_write32(ab, reo_base + HAL_REO1_GEN_ENABLE, val);
+@@ -134,6 +139,10 @@ static void ath11k_hw_ipq8074_reo_setup(
+ 	ath11k_hif_write32(ab, reo_base + HAL_REO1_AGING_THRESH_IX_3(ab),
+ 			   HAL_DEFAULT_REO_TIMEOUT_USEC);
+ 
++	/* REO Dest ring setup is not required in NSS offload case */
++	if (ab->nss.enabled)
++		return;
++
+ 	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_0,
+ 			   FIELD_PREP(HAL_REO_DEST_RING_CTRL_HASH_RING_MAP,
+ 				      ring_hash_map));
+@@ -758,8 +767,10 @@ static u8 *ath11k_hw_wcn6855_rx_desc_mpd
+ 
+ static void ath11k_hw_wcn6855_reo_setup(struct ath11k_base *ab)
+ {
++	u8 frag_dest_ring = HAL_SRNG_RING_ID_REO2SW1;
+ 	u32 reo_base = HAL_SEQ_WCSS_UMAC_REO_REG;
+ 	u32 val;
++
+ 	/* Each hash entry uses four bits to map to a particular ring. */
+ 	u32 ring_hash_map = HAL_HASH_ROUTING_RING_SW1 << 0 |
+ 		HAL_HASH_ROUTING_RING_SW2 << 4 |
+@@ -770,6 +781,9 @@ static void ath11k_hw_wcn6855_reo_setup(
+ 		HAL_HASH_ROUTING_RING_SW3 << 24 |
+ 		HAL_HASH_ROUTING_RING_SW4 << 28;
+ 
++	if (ab->nss.enabled)
++		frag_dest_ring = HAL_SRNG_REO_ALTERNATE_SELECT;
++
+ 	val = ath11k_hif_read32(ab, reo_base + HAL_REO1_GEN_ENABLE);
+ 	val |= FIELD_PREP(HAL_REO1_GEN_ENABLE_AGING_LIST_ENABLE, 1) |
+ 		FIELD_PREP(HAL_REO1_GEN_ENABLE_AGING_FLUSH_ENABLE, 1);
+@@ -777,7 +791,7 @@ static void ath11k_hw_wcn6855_reo_setup(
+ 
+ 	val = ath11k_hif_read32(ab, reo_base + HAL_REO1_MISC_CTL(ab));
+ 	val &= ~HAL_REO1_MISC_CTL_FRAGMENT_DST_RING;
+-	val |= FIELD_PREP(HAL_REO1_MISC_CTL_FRAGMENT_DST_RING, HAL_SRNG_RING_ID_REO2SW1);
++	val |= FIELD_PREP(HAL_REO1_MISC_CTL_FRAGMENT_DST_RING, frag_dest_ring);
+ 	ath11k_hif_write32(ab, reo_base + HAL_REO1_MISC_CTL(ab), val);
+ 
+ 	ath11k_hif_write32(ab, reo_base + HAL_REO1_AGING_THRESH_IX_0(ab),
+@@ -789,6 +803,10 @@ static void ath11k_hw_wcn6855_reo_setup(
+ 	ath11k_hif_write32(ab, reo_base + HAL_REO1_AGING_THRESH_IX_3(ab),
+ 			   HAL_DEFAULT_REO_TIMEOUT_USEC);
+ 
++	/* REO Dest ring setup is not required in NSS offload case */
++	if (ab->nss.enabled)
++		return;
++
+ 	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_2,
+ 			   ring_hash_map);
+ 	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_3,
+--- a/drivers/net/wireless/ath/ath11k/pcic.c
++++ b/drivers/net/wireless/ath/ath11k/pcic.c
+@@ -571,6 +571,12 @@ static int ath11k_pcic_ext_irq_config(st
+ 		netif_napi_add(&irq_grp->napi_ndev, &irq_grp->napi,
+ 			       ath11k_pcic_ext_grp_napi_poll);
+ 
++		/* tcl, reo, rx_err, wbm release, rxdma rings are offloaded to nss. */
++		if (ab->nss.enabled &&
++		    !(ab->hw_params.ring_mask->reo_status[i] ||
++		      ab->hw_params.ring_mask->rx_mon_status[i]))
++			continue;
++
+ 		if (ab->hw_params.ring_mask->tx[i] ||
+ 		    ab->hw_params.ring_mask->rx[i] ||
+ 		    ab->hw_params.ring_mask->rx_err[i] ||
+--- a/local-symbols
++++ b/local-symbols
+@@ -170,6 +170,7 @@ WCN36XX_DEBUGFS=
+ ATH11K=
+ ATH11K_AHB=
+ ATH11K_PCI=
++ATH11K_NSS_SUPPORT=
+ ATH11K_DEBUG=
+ ATH11K_DEBUGFS=
+ ATH11K_TRACING=
diff --git a/package/kernel/mac80211/patches/ath11k_nss/199-mac80211-fix-xmit-callback-when-hwencap-enable-in-st.patch b/package/kernel/mac80211/patches/ath11k_nss/199-mac80211-fix-xmit-callback-when-hwencap-enable-in-st.patch
new file mode 100644
index 00000000000000..87c2a52b676f21
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/199-mac80211-fix-xmit-callback-when-hwencap-enable-in-st.patch
@@ -0,0 +1,35 @@
+From c3389f87ea09dea804cda2483922e03ad3eb6c79 Mon Sep 17 00:00:00 2001
+From: P Praneesh <ppranees@codeaurora.org>
+Date: Thu, 18 Jun 2020 00:07:15 +0530
+Subject: [PATCH] mac80211: fix xmit callback when hwencap enable in sta
+
+Since transmit control port uses same callback for both
+(ieee80211_subif_start_xmit) ethernet mode and native
+wifi mode, which cause regression in ethernet mode
+when we use DUT as a STA with encryption(psk2+ccmp).
+
+Added hardware encap check to filter out ethernet mode
+packets to follow ieee80211_subif_start_xmit_8023 callback.
+
+Signed-off-by: P Praneesh <ppranees@codeaurora.org>
+---
+ net/mac80211/tx.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -6213,7 +6213,13 @@ start_xmit:
+ 	mutex_lock(&local->mtx);
+ 
+ 	local_bh_disable();
+-	__ieee80211_subif_start_xmit(skb, skb->dev, flags, ctrl_flags, cookie);
++
++	/* added hardware encap check for ethernet mode */
++	if (sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED)
++		ieee80211_subif_start_xmit_8023(skb, skb->dev);
++	else
++		__ieee80211_subif_start_xmit(skb, skb->dev, flags, ctrl_flags, cookie);
++
+ 	local_bh_enable();
+ 
+ 	mutex_unlock(&local->mtx);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Add-support-for-dynamic-vlan.patch b/package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Add-support-for-dynamic-vlan.patch
new file mode 100644
index 00000000000000..af46c8f0bfa05e
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Add-support-for-dynamic-vlan.patch
@@ -0,0 +1,60 @@
+From f013e1e9829ec346fa0a215552eef51953b46bf0 Mon Sep 17 00:00:00 2001
+From: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+Date: Fri, 7 Aug 2020 18:24:32 +0530
+Subject: [PATCH] ath11k: Add support for dynamic vlan
+
+This patch adds support for dynamic vlan. VLAN group traffics
+are encrypted in software. vlan unicast packets shall be taking
+8023 xmit path if encap offload is enabled and mcast/bcast will
+be using 80211 xmit path.
+
+Metadata info in dp_tx added to notify firmware that the
+multicast/broadcast packets are encrypted in sw.
+
+Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
+---
+ net/mac80211/tx.c                       |  14 +++
+ 1 files changed, 14 insertions(+)
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -37,6 +37,9 @@
+ #include "wme.h"
+ #include "rate.h"
+ 
++static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
++				struct net_device *dev, struct sta_info *sta,
++				struct ieee80211_key *key, struct sk_buff *skb);
+ /* misc utils */
+ 
+ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
+@@ -4268,6 +4271,8 @@ void __ieee80211_subif_start_xmit(struct
+ 	struct sta_info *sta;
+ 	struct sk_buff *next;
+ 	int len = skb->len;
++	struct ieee80211_key *key = NULL;
++	struct ieee80211_sub_if_data *ap_sdata;
+ 
+ 	if (unlikely(!ieee80211_sdata_running(sdata) || skb->len < ETH_HLEN)) {
+ 		kfree_skb(skb);
+@@ -4289,6 +4294,19 @@ void __ieee80211_subif_start_xmit(struct
+ 	if (IS_ERR(sta))
+ 		sta = NULL;
+ 
++        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
++                ap_sdata = container_of(sdata->bss,
++                                        struct ieee80211_sub_if_data, u.ap);
++                if (ap_sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED &&
++                    !is_multicast_ether_addr(skb->data)) {
++                        if (sta)
++                                key = rcu_dereference(sta->ptk[sta->ptk_idx]);
++                        ieee80211_8023_xmit(sdata, dev, sta, key, skb);
++                        rcu_read_unlock();
++                        return;
++                }
++        }
++
+ 	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, sta, skb));
+ 	ieee80211_aggr_check(sdata, sta, skb);
+ 
diff --git a/package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Enable-512MB-profile-in-ath11k.patch b/package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Enable-512MB-profile-in-ath11k.patch
new file mode 100644
index 00000000000000..0e7ddb8539a207
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Enable-512MB-profile-in-ath11k.patch
@@ -0,0 +1,332 @@
+From 1b402e444ff99efe84d09a084b96c39826783a8e Mon Sep 17 00:00:00 2001
+From: Ramya Gnanasekar <rgnanase@codeaurora.org>
+Date: Thu, 10 Sep 2020 13:33:55 +0530
+Subject: [PATCH] ath11k: Enable 512MB profile in ath11k
+
+Below changes are made to enable 512MB mem mode in ath11k
+        * Makefile changes to implement compilation flag when
+                512MB mem profile is configured.
+        * Enabling 512MB mem profile by default from Makefile
+                for IPQ5018. This can be removed later once
+                512MB profile config is supported.
+        * Update target_mem_mode, number of stations, peer and vap
+                during compile time
+
+Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/Kconfig |  7 +++++++
+ drivers/net/wireless/ath/ath11k/hw.h    | 14 +++++++++++---
+ drivers/net/wireless/ath/ath11k/qmi.c   |  2 +-
+ drivers/net/wireless/ath/ath11k/qmi.h   |  6 +++++-
+ 4 files changed, 24 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/Kconfig
++++ b/drivers/net/wireless/ath/ath11k/Kconfig
+@@ -23,6 +23,13 @@ config ATH11K_NSS_SUPPORT
+ 
+ 	  If unsure, say Y to enable NSS offload support.
+ 
++config ATH11K_MEM_PROFILE_512M
++	bool "ath11k enable 512MB memory profile"
++	depends on ATH11K
++	default n
++	---help---
++	Enables 512MB memory profile for ath11k
++
+ config ATH11K_AHB
+ 	tristate "Atheros ath11k AHB support"
+ 	depends on m
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -11,11 +11,30 @@
+ #include "wmi.h"
+ 
+ /* Target configuration defines */
++#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
+ 
++#define TARGET_NUM_VDEVS(ab)	8
++#define TARGET_NUM_PEERS_PDEV(ab)	(128 + TARGET_NUM_VDEVS(ab))
++/* Max num of stations (per radio) */
++#define TARGET_NUM_STATIONS(ab)	128
++#define ATH11K_QMI_TARGET_MEM_MODE	ATH11K_QMI_TARGET_MEM_MODE_512M
++#define ATH11K_DP_TX_COMP_RING_SIZE	8192
++#define ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE	512
++#define ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE	128
++#define ATH11K_DP_RXDMA_MONITOR_DST_RING_SIZE	128
++#else
+ /* Num VDEVS per radio */
+ #define TARGET_NUM_VDEVS(ab)	(ab->hw_params.num_vdevs)
+ 
+ #define TARGET_NUM_PEERS_PDEV(ab) (ab->hw_params.num_peers + TARGET_NUM_VDEVS(ab))
++/* Max num of stations (per radio) */
++#define TARGET_NUM_STATIONS(ab) (ab->hw_params.num_peers)
++#define ATH11K_QMI_TARGET_MEM_MODE		ATH11K_QMI_TARGET_MEM_MODE_DEFAULT
++#define ATH11K_DP_TX_COMP_RING_SIZE		32768
++#define ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE	1024
++#define ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE	4096
++#define ATH11K_DP_RXDMA_MONITOR_DST_RING_SIZE	2048
++#endif
+ 
+ /* Num of peers for Single Radio mode */
+ #define TARGET_NUM_PEERS_SINGLE(ab) (TARGET_NUM_PEERS_PDEV(ab))
+@@ -26,9 +45,6 @@
+ /* Num of peers for DBS_SBS */
+ #define TARGET_NUM_PEERS_DBS_SBS(ab)	(3 * TARGET_NUM_PEERS_PDEV(ab))
+ 
+-/* Max num of stations (per radio) */
+-#define TARGET_NUM_STATIONS(ab)	(ab->hw_params.num_peers)
+-
+ #define TARGET_NUM_PEERS(ab, x)	TARGET_NUM_PEERS_##x(ab)
+ #define TARGET_NUM_PEER_KEYS	2
+ #define TARGET_NUM_TIDS(ab, x)	(2 * TARGET_NUM_PEERS(ab, x) +	\
+--- a/drivers/net/wireless/ath/ath11k/qmi.h
++++ b/drivers/net/wireless/ath/ath11k/qmi.h
+@@ -29,6 +29,12 @@
+ #define ATH11K_QMI_BDF_EXT_STR_LENGTH		0x20
+ #define ATH11K_QMI_FW_MEM_REQ_SEGMENT_CNT	5
+ 
++#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
++#define ATH11K_QMI_IPQ8074_M3_DUMP_ADDRESS     0x4E800000
++#else
++#define ATH11K_QMI_IPQ8074_M3_DUMP_ADDRESS     0x51000000
++#endif
++
+ #define QMI_WLFW_REQUEST_MEM_IND_V01		0x0035
+ #define QMI_WLFW_FW_MEM_READY_IND_V01		0x0037
+ #define QMI_WLFW_COLD_BOOT_CAL_DONE_IND_V01	0x003E
+@@ -519,4 +525,10 @@ int ath11k_qmi_init_service(struct ath11
+ void ath11k_qmi_free_resource(struct ath11k_base *ab);
+ int ath11k_qmi_fwreset_from_cold_boot(struct ath11k_base *ab);
+ 
++enum ath11k_target_mem_mode {
++  ATH11K_QMI_TARGET_MEM_MODE_DEFAULT = 0,
++  ATH11K_QMI_TARGET_MEM_MODE_512M,
++  ATH11K_QMI_TARGET_MEM_MODE_256M,
++};
++
+ #endif
+--- a/local-symbols
++++ b/local-symbols
+@@ -171,6 +171,7 @@ ATH11K=
+ ATH11K_AHB=
+ ATH11K_PCI=
+ ATH11K_NSS_SUPPORT=
++ATH11K_MEM_PROFILE_512M=
+ ATH11K_DEBUG=
+ ATH11K_DEBUGFS=
+ ATH11K_TRACING=
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -863,6 +863,11 @@ struct ath11k_msi_config {
+ 	u16 hw_rev;
+ };
+ 
++struct ath11k_num_vdevs_peers {
++  u32 num_vdevs;
++  u32 num_peers;
++};
++
+ /* Master structure to hold the hw data which may be used in core module */
+ struct ath11k_base {
+ 	enum ath11k_hw_rev hw_rev;
+@@ -1016,6 +1021,9 @@ struct ath11k_base {
+ 	} testmode;
+ #endif
+ 
++	atomic_t num_max_allowed;
++	struct ath11k_num_vdevs_peers *num_vdevs_peers;
++
+ 	/* must be last */
+ 	u8 drv_priv[] __aligned(sizeof(void *));
+ };
+--- a/drivers/net/wireless/ath/ath11k/dp.h
++++ b/drivers/net/wireless/ath/ath11k/dp.h
+@@ -206,8 +206,9 @@ struct ath11k_pdev_dp {
+ #define DP_WBM_RELEASE_RING_SIZE	64
+ #define DP_TCL_DATA_RING_SIZE		512
+ #define DP_TCL_DATA_RING_SIZE_WCN6750	2048
+-#define DP_TX_COMP_RING_SIZE		32768
++#define DP_TX_COMP_RING_SIZE		ATH11K_DP_TX_COMP_RING_SIZE
+ #define DP_TX_IDR_SIZE			DP_TX_COMP_RING_SIZE
++#define DP_TX_COMP_MAX_ALLOWED			DP_TX_COMP_RING_SIZE
+ #define DP_TCL_CMD_RING_SIZE		32
+ #define DP_TCL_STATUS_RING_SIZE		32
+ #define DP_REO_DST_RING_MAX		4
+@@ -220,9 +221,9 @@ struct ath11k_pdev_dp {
+ #define DP_RXDMA_BUF_RING_SIZE		4096
+ #define DP_RXDMA_REFILL_RING_SIZE	2048
+ #define DP_RXDMA_ERR_DST_RING_SIZE	1024
+-#define DP_RXDMA_MON_STATUS_RING_SIZE	1024
+-#define DP_RXDMA_MONITOR_BUF_RING_SIZE	4096
+-#define DP_RXDMA_MONITOR_DST_RING_SIZE	2048
++#define DP_RXDMA_MON_STATUS_RING_SIZE	ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE
++#define DP_RXDMA_MONITOR_BUF_RING_SIZE	ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE
++#define DP_RXDMA_MONITOR_DST_RING_SIZE	ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE
+ #define DP_RXDMA_MONITOR_DESC_RING_SIZE	4096
+ 
+ #define DP_RX_RELEASE_RING_NUM	3
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -265,6 +265,7 @@ tcl_ring_sel:
+ 			skb->data, skb->len);
+ 
+ 	atomic_inc(&ar->dp.num_tx_pending);
++	atomic_inc(&ab->num_max_allowed);
+ 
+ 	return 0;
+ 
+@@ -309,6 +310,7 @@ static void ath11k_dp_tx_free_txbuf(stru
+ 	ar = ab->pdevs[mac_id].ar;
+ 	if (atomic_dec_and_test(&ar->dp.num_tx_pending))
+ 		wake_up(&ar->dp.tx_empty_waitq);
++	atomic_dec(&ab->num_max_allowed);
+ }
+ 
+ static void
+@@ -342,6 +344,7 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
+ 
+ 	if (atomic_dec_and_test(&ar->dp.num_tx_pending))
+ 		wake_up(&ar->dp.tx_empty_waitq);
++	atomic_dec(&ab->num_max_allowed);
+ 
+ 	dma_unmap_single(ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
+ 
+@@ -769,6 +772,7 @@ void ath11k_dp_tx_completion_handler(str
+ 			wake_up(&ar->dp.tx_empty_waitq);
+ 
+ 		ath11k_dp_tx_complete_msdu(ar, msdu, &ts);
++		atomic_dec(&ab->num_max_allowed);
+ 	}
+ }
+ 
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -9,6 +9,7 @@
+ #include <linux/remoteproc.h>
+ #include <linux/firmware.h>
+ #include <linux/of.h>
++#include <linux/of_platform.h>
+ 
+ #include "core.h"
+ #include "dp_tx.h"
+@@ -16,6 +17,7 @@
+ #include "debug.h"
+ #include "hif.h"
+ #include "wow.h"
++#include "ahb.h"
+ 
+ unsigned int nss_offload;
+ #ifdef CPTCFG_ATH11K_NSS_SUPPORT
+@@ -42,6 +44,8 @@ bool ath11k_ftm_mode;
+ module_param_named(ftm_mode, ath11k_ftm_mode, bool, 0444);
+ MODULE_PARM_DESC(ftm_mode, "Boots up in factory test mode");
+ 
++static const struct ath11k_num_vdevs_peers ath11k_vdevs_peers[];
++
+ static struct ath11k_hw_params ath11k_hw_params[] = {
+ 	{
+ 		.hw_rev = ATH11K_HW_IPQ8074,
+@@ -100,6 +104,7 @@ static struct ath11k_hw_params ath11k_hw
+ 		.num_peers = 512,
+ 		.supports_suspend = false,
+ 		.hal_desc_sz = sizeof(struct hal_rx_desc_ipq8074),
++		.reo_dest_ring_map_shift = HAL_REO_DEST_RING_CTRL_HASH_RING_SHIFT,
+ 		.supports_regdb = false,
+ 		.fix_l1ss = true,
+ 		.credit_flow = false,
+@@ -177,7 +182,7 @@ static struct ath11k_hw_params ath11k_hw
+ 		.coldboot_cal_mm = true,
+ 		.coldboot_cal_ftm = true,
+ 		.cbcal_restart_fw = true,
+-		.fw_mem_mode = 0,
++		.fw_mem_mode = ATH11K_QMI_TARGET_MEM_MODE,
+ 		.num_vdevs = 16 + 1,
+ 		.num_peers = 512,
+ 		.supports_suspend = false,
+@@ -259,7 +264,7 @@ static struct ath11k_hw_params ath11k_hw
+ 		.coldboot_cal_mm = false,
+ 		.coldboot_cal_ftm = false,
+ 		.cbcal_restart_fw = false,
+-		.fw_mem_mode = 0,
++		.fw_mem_mode = ATH11K_QMI_TARGET_MEM_MODE,
+ 		.num_vdevs = 16 + 1,
+ 		.num_peers = 512,
+ 		.supports_suspend = true,
+@@ -426,7 +431,7 @@ static struct ath11k_hw_params ath11k_hw
+ 		.coldboot_cal_mm = false,
+ 		.coldboot_cal_ftm = false,
+ 		.cbcal_restart_fw = false,
+-		.fw_mem_mode = 0,
++		.fw_mem_mode = ATH11K_QMI_TARGET_MEM_MODE,
+ 		.num_vdevs = 16 + 1,
+ 		.num_peers = 512,
+ 		.supports_suspend = true,
+@@ -509,7 +514,7 @@ static struct ath11k_hw_params ath11k_hw
+ 		.coldboot_cal_mm = false,
+ 		.coldboot_cal_ftm = false,
+ 		.cbcal_restart_fw = false,
+-		.fw_mem_mode = 0,
++		.fw_mem_mode = ATH11K_QMI_TARGET_MEM_MODE,
+ 		.num_vdevs = 16 + 1,
+ 		.num_peers = 512,
+ 		.supports_suspend = true,
+@@ -593,7 +598,7 @@ static struct ath11k_hw_params ath11k_hw
+ 		.coldboot_cal_mm = true,
+ 		.coldboot_cal_ftm = true,
+ 		.cbcal_restart_fw = false,
+-		.fw_mem_mode = 0,
++		.fw_mem_mode = ATH11K_QMI_TARGET_MEM_MODE,
+ 		.num_vdevs = 16 + 1,
+ 		.num_peers = 512,
+ 		.supports_suspend = false,
+@@ -672,7 +677,7 @@ static struct ath11k_hw_params ath11k_hw
+ 		.supports_monitor = false,
+ 		.supports_sta_ps = false,
+ 		.supports_shadow_regs = false,
+-		.fw_mem_mode = 0,
++		.fw_mem_mode = ATH11K_QMI_TARGET_MEM_MODE,
+ 		.num_vdevs = 16 + 1,
+ 		.num_peers = 512,
+ 		.supports_regdb = false,
+@@ -710,7 +715,23 @@ static struct ath11k_hw_params ath11k_hw
+ 	},
+ };
+ 
+-static inline struct ath11k_pdev *ath11k_core_get_single_pdev(struct ath11k_base *ab)
++static const struct ath11k_num_vdevs_peers ath11k_vdevs_peers[] = {
++	{
++		.num_vdevs = (16 + 1),
++		.num_peers = 512,
++	},
++	{
++		.num_vdevs = (8 + 1),
++		.num_peers = 128,
++	},
++	{
++		.num_vdevs = 8,
++		.num_peers = 128,
++	},
++};
++
++static inline struct ath11k_pdev *
++ath11k_core_get_single_pdev(struct ath11k_base *ab)
+ {
+ 	WARN_ON(!ab->hw_params.single_pdev_only);
+ 
+--- a/drivers/net/wireless/ath/ath11k/debugfs.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs.c
+@@ -1592,10 +1592,13 @@ static ssize_t ath11k_dump_mgmt_stats(st
+ 				      size_t count, loff_t *ppos)
+ {
+ 	struct ath11k *ar = file->private_data;
++#ifndef CPTCFG_ATH11K_MEM_PROFILE_512M
++	struct ath11k_base *ab = ar->ab;
++#endif
+ 	struct ath11k_vif *arvif = NULL;
+ 	struct ath11k_mgmt_frame_stats *mgmt_stats;
+ 	int len = 0, ret, i;
+-	int size = (TARGET_NUM_VDEVS - 1) * 1500;
++	int size = (TARGET_NUM_VDEVS(ab) - 1) * 1500;
+ 	char *buf;
+ 	const char *mgmt_frm_type[ATH11K_STATS_MGMT_FRM_TYPE_MAX-1] = {"assoc_req", "assoc_resp",
+ 								       "reassoc_req", "reassoc_resp",
diff --git a/package/kernel/mac80211/patches/ath11k_nss/207-mac80211-add-nss-redirect-support.patch b/package/kernel/mac80211/patches/ath11k_nss/207-mac80211-add-nss-redirect-support.patch
new file mode 100644
index 00000000000000..c9a12d5f127cbe
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/207-mac80211-add-nss-redirect-support.patch
@@ -0,0 +1,268 @@
+From 3acca4ecfe25a7d97e7cb820fd8c7c6324a1f318 Mon Sep 17 00:00:00 2001
+From: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
+Date: Tue, 18 Aug 2020 16:17:25 +0530
+Subject: [PATCH] ath11k : Add NSS redirect support
+
+Add NSS Redirect support for ath11k. Tested on ipq8074
+Most of the changes are similar to the one done for ath10k with
+minor changes to send to nss with eth header
+
+Redirect can be enabled by setting nss_redirect module param during
+mac80211 insmod followed by ecm start
+insmod mac80211.ko nss_redirect=1
+/etc/init.d/qca-nss-ecm start
+
+Check for ipv4_hash_hits counts in ipv4 stats and eth_rx
+in qca-nss-drv to check whether packets are redirected or not.
+
+Verified both in nwifi and ethernet mode by running tcp and udp
+traffic.
+
+Co-developed by: Sriram R <srirrama@codeaurora.org>
+Signed-off-by: Sriram R <srirrama@codeaurora.org>
+Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
+---
+ net/mac80211/ieee80211_i.h |  2 ++
+ net/mac80211/iface.c       | 43 ++++++++++++++++++++++++++++++++
+ net/mac80211/rx.c          | 61 +++++++++++++++++++++++++++++++++++++---------
+ net/mac80211/tx.c          | 32 ++++++++++++++++++++++++
+ 4 files changed, 126 insertions(+), 12 deletions(-)
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -34,6 +34,9 @@
+ #include "sta_info.h"
+ #include "debug.h"
+ #include "drop.h"
++#ifdef CPTCFG_MAC80211_NSS_SUPPORT
++#include <nss_api_if.h>
++#endif
+ 
+ extern const struct cfg80211_ops mac80211_config_ops;
+ 
+@@ -1120,6 +1123,9 @@ struct ieee80211_sub_if_data {
+ 		struct dentry *default_beacon_key;
+ 	} debugfs;
+ #endif
++#ifdef CPTCFG_MAC80211_NSS_SUPPORT
++	struct nss_virt_if_handle *nssctx;
++#endif
+ 
+ 	/* must be last, dynamically sized area in this! */
+ 	struct ieee80211_vif vif;
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -27,6 +27,12 @@
+ #include "wme.h"
+ #include "rate.h"
+ 
++#ifdef CPTCFG_MAC80211_NSS_SUPPORT
++bool nss_redirect = false;
++module_param(nss_redirect, bool, 0644);
++MODULE_PARM_DESC(nss_redirect, "module param to enable NSS Redirect; 1-enable, 0-disable");
++#endif
++
+ /**
+  * DOC: Interface list locking
+  *
+@@ -752,6 +758,13 @@ static int ieee80211_stop(struct net_dev
+ 
+ 	cancel_work_sync(&sdata->activate_links_work);
+ 
++#ifdef CPTCFG_MAC80211_NSS_SUPPORT
++	if (sdata->nssctx) {
++		nss_virt_if_destroy_sync(sdata->nssctx);
++		sdata_info(sdata, "Destroyed NSS virtual interface\n");
++	}
++#endif
++
+ 	wiphy_lock(sdata->local->hw.wiphy);
+ 	ieee80211_do_stop(sdata, true);
+ 	wiphy_unlock(sdata->local->hw.wiphy);
+@@ -1219,6 +1232,34 @@ void ieee80211_del_virtual_monitor(struc
+ 	kfree(sdata);
+ }
+ 
++#ifdef CPTCFG_MAC80211_NSS_SUPPORT
++/* This callback is registered for nss redirect to receive packet exceptioned from nss in Rx path.
++ * When packet does not match any of the ecm rules is redirected back here.
++ */
++void receive_from_nss(struct net_device *dev, struct sk_buff *sk_buff, struct napi_struct *napi)
++{
++	struct net_device *netdev;
++	struct sk_buff *skb;
++	struct ieee80211_sub_if_data *sdata;
++
++	if (!dev) {
++		kfree(sk_buff);
++		return;
++	}
++
++	netdev = (struct net_device *)dev;
++	sdata = netdev_priv(netdev);
++	if (sdata->dev != dev) {
++		kfree(sk_buff);
++		return;
++	}
++	skb = (struct sk_buff *)sk_buff;
++	skb->dev = netdev;
++	skb->protocol = eth_type_trans(skb, netdev);
++	napi_gro_receive(napi, skb);
++}
++#endif
++
+ /*
+  * NOTE: Be very careful when changing this function, it must NOT return
+  * an error on interface type changes that have been pre-checked, so most
+@@ -1450,6 +1491,19 @@ int ieee80211_do_open(struct wireless_de
+ 
+ 	ieee80211_recalc_ps(local);
+ 
++#ifdef CPTCFG_MAC80211_NSS_SUPPORT
++       sdata->nssctx = NULL;
++       if (nss_redirect) {
++               sdata->nssctx = nss_virt_if_create_sync(dev);
++               if (sdata->nssctx) {
++                       sdata_info(sdata, "Created a NSS virtual interface\n");
++                       nss_virt_if_register(sdata->nssctx, receive_from_nss, sdata->dev);
++               } else {
++                       sdata_info(sdata, "Failed to create a NSS virtual interface\n");
++               }
++       }
++#endif
++
+ 	set_bit(SDATA_STATE_RUNNING, &sdata->state);
+ 
+ 	return 0;
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2570,6 +2570,54 @@ static bool ieee80211_frame_allowed(stru
+ 	return true;
+ }
+ 
++#ifdef CPTCFG_MAC80211_NSS_SUPPORT
++#define case_rtn_string(val) case val: return #val
++
++static const char *nss_tx_status_str(nss_tx_status_t status)
++{
++	switch (status) {
++		case_rtn_string(NSS_TX_SUCCESS);
++		case_rtn_string(NSS_TX_FAILURE);
++		case_rtn_string(NSS_TX_FAILURE_QUEUE);
++		case_rtn_string(NSS_TX_FAILURE_NOT_READY);
++		case_rtn_string(NSS_TX_FAILURE_TOO_LARGE);
++		case_rtn_string(NSS_TX_FAILURE_TOO_SHORT);
++		case_rtn_string(NSS_TX_FAILURE_NOT_SUPPORTED);
++		case_rtn_string(NSS_TX_FAILURE_BAD_PARAM);
++	default:
++		return "Unknown NSS TX status";
++	}
++}
++
++static void netif_rx_nss(struct ieee80211_rx_data *rx,
++			 struct sk_buff *skb)
++{
++	struct ieee80211_sub_if_data *sdata = rx->sdata;
++	int ret;
++
++	if (!sdata->nssctx)
++		goto out;
++
++	/* NSS expects ethernet header in skb data so resetting here */
++	skb_push(skb, ETH_HLEN);
++	ret = nss_virt_if_tx_buf(sdata->nssctx, skb);
++	if (ret) {
++		if (net_ratelimit()) {
++			sdata_err(sdata, "NSS TX failed with error: %s\n",
++				  nss_tx_status_str(ret));
++		}
++		goto out;
++	}
++
++	return;
++out:
++	if (rx->napi)
++		napi_gro_receive(rx->napi, skb);
++	else
++		netif_receive_skb(skb);
++}
++#endif
++
+ static void ieee80211_deliver_skb_to_local_stack(struct sk_buff *skb,
+ 						 struct ieee80211_rx_data *rx)
+ {
+@@ -2609,11 +2657,15 @@ static void ieee80211_deliver_skb_to_loc
+ 			     !ether_addr_equal(ehdr->h_dest, sdata->vif.addr)))
+ 			ether_addr_copy(ehdr->h_dest, sdata->vif.addr);
+ 
++#ifdef CPTCFG_MAC80211_NSS_SUPPORT
++		netif_rx_nss(rx, skb);
++#else
+ 		/* deliver to local stack */
+ 		if (rx->list)
+ 			list_add_tail(&skb->list, rx->list);
+ 		else
+ 			netif_receive_skb(skb);
++#endif
+ 	}
+ }
+ 
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -4501,6 +4501,35 @@ static void ieee80211_mlo_multicast_tx(s
+ 	kfree_skb(skb);
+ }
+ 
++#ifdef CPTCFG_MAC80211_NSS_SUPPORT
++void ieee80211_xmit_nss_fixup(struct sk_buff *skb,
++			      struct net_device *dev)
++{
++	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
++
++	/* Packets from NSS does not have valid protocol, priority and other
++	 * network stack values. Derive required parameters (priority
++	 * and network_header) from payload for QoS header.
++	 * XXX: Here the assumption is that packet are in 802.3 format.
++	 * As of now priority is handled only for IPv4 and IPv6.
++	 */
++
++	if (sdata->nssctx && likely(!skb->protocol)) {
++		skb_set_network_header(skb, 14);
++		switch (((struct ethhdr *)skb->data)->h_proto) {
++		case htons(ETH_P_IP):
++			skb->priority = (ipv4_get_dsfield(ip_hdr(skb)) &
++					 0xfc) >> 5;
++			break;
++		case htons(ETH_P_IPV6):
++			skb->priority = (ipv6_get_dsfield(ipv6_hdr(skb)) &
++					 0xfc) >> 5;
++			break;
++		}
++	}
++}
++#endif
++
+ /**
+  * ieee80211_subif_start_xmit - netif start_xmit function for 802.3 vifs
+  * @skb: packet to be sent
+@@ -4514,6 +4543,10 @@ netdev_tx_t ieee80211_subif_start_xmit(s
+ 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+ 	const struct ethhdr *eth = (void *)skb->data;
+ 
++#ifdef CPTCFG_MAC80211_NSS_SUPPORT
++	ieee80211_xmit_nss_fixup(skb, dev);
++#endif
++
+ 	if (likely(!is_multicast_ether_addr(eth->h_dest)))
+ 		goto normal;
+ 
+@@ -4700,6 +4733,9 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+ 	struct ieee80211_key *key;
+ 	struct sta_info *sta;
+ 
++#ifdef CPTCFG_MAC80211_NSS_SUPPORT
++       ieee80211_xmit_nss_fixup(skb, dev);
++#endif
+ 	if (unlikely(!ieee80211_sdata_running(sdata) || skb->len < ETH_HLEN)) {
+ 		kfree_skb(skb);
+ 		return NETDEV_TX_OK;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/211-ath11k-add-obss-pd-support.patch b/package/kernel/mac80211/patches/ath11k_nss/211-ath11k-add-obss-pd-support.patch
new file mode 100644
index 00000000000000..ddae9fcbc50e7d
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/211-ath11k-add-obss-pd-support.patch
@@ -0,0 +1,56 @@
+From 81694575884dc69535252a6f44128323fd6a2504 Mon Sep 17 00:00:00 2001
+From: Rajkumar Manoharan <rmanohar@codeaurora.org>
+Date: Sat, 26 Sep 2020 23:17:03 -0700
+Subject: [PATCH 1/3] nl80211: fix OBSS PD min and max offset validation
+
+The SRG minimum and maximum offset doesn't present when the SR control field
+of Spatial Reuse Parameter Set element set SRG Information Present to 0.
+Both attributes are 1-byte values so use appropriate nla_get function.
+
+Signed-off-by: Rajkumar Manoharan <rmanohar@codeaurora.org>
+---
+ net/wireless/nl80211.c | 21 ++++++++++-----------
+ 1 file changed, 10 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -3272,7 +3272,8 @@ static int ath11k_mac_config_obss_pd(str
+ {
+ 	u32 bitmap[2], param_id, param_val, pdev_id;
+ 	int ret;
+-	s8 non_srg_th = 0, srg_th = 0;
++	s8 non_srg_th = ATH11K_OBSS_PD_THRESHOLD_DISABLED;
++	s8 srg_th = 0;
+ 
+ 	pdev_id = ar->pdev->pdev_id;
+ 
+@@ -3301,8 +3302,6 @@ static int ath11k_mac_config_obss_pd(str
+ 		if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_NON_SRG_OFFSET_PRESENT)
+ 			non_srg_th = (ATH11K_OBSS_PD_MAX_THRESHOLD +
+ 				      he_obss_pd->non_srg_max_offset);
+-		else
+-			non_srg_th = ATH11K_OBSS_PD_NON_SRG_MAX_THRESHOLD;
+ 
+ 		param_val |= ATH11K_OBSS_PD_NON_SRG_EN;
+ 	}
+@@ -3317,7 +3316,8 @@ static int ath11k_mac_config_obss_pd(str
+ 		param_val |= ATH11K_OBSS_PD_THRESHOLD_IN_DBM;
+ 		param_val |= FIELD_PREP(GENMASK(15, 8), srg_th);
+ 	} else {
+-		non_srg_th -= ATH11K_DEFAULT_NOISE_FLOOR;
++		if ((non_srg_th & 0xff) != ATH11K_OBSS_PD_THRESHOLD_DISABLED)
++			non_srg_th -= ATH11K_DEFAULT_NOISE_FLOOR;
+ 		/* SRG not supported and threshold in dB */
+ 		param_val &= ~(ATH11K_OBSS_PD_SRG_EN |
+ 			       ATH11K_OBSS_PD_THRESHOLD_IN_DBM);
+--- a/drivers/net/wireless/ath/ath11k/mac.h
++++ b/drivers/net/wireless/ath/ath11k/mac.h
+@@ -121,7 +121,7 @@ struct ath11k_generic_iter {
+ #define ATH11K_PEER_RX_NSS_80_80MHZ		GENMASK(5, 3)
+ 
+ #define ATH11K_OBSS_PD_MAX_THRESHOLD			-82
+-#define ATH11K_OBSS_PD_NON_SRG_MAX_THRESHOLD		-62
++#define ATH11K_OBSS_PD_THRESHOLD_DISABLED		128
+ #define ATH11K_OBSS_PD_THRESHOLD_IN_DBM			BIT(29)
+ #define ATH11K_OBSS_PD_SRG_EN				BIT(30)
+ #define ATH11K_OBSS_PD_NON_SRG_EN			BIT(31)
diff --git a/package/kernel/mac80211/patches/ath11k_nss/214-ath11k-qos-null-frame-tx-over-wmi.patch b/package/kernel/mac80211/patches/ath11k_nss/214-ath11k-qos-null-frame-tx-over-wmi.patch
new file mode 100644
index 00000000000000..a69c5b2af244f8
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/214-ath11k-qos-null-frame-tx-over-wmi.patch
@@ -0,0 +1,519 @@
+From 0e29b669153f100b60107d5f6b3fe407b71ba79a Mon Sep 17 00:00:00 2001
+From: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
+Date: Wed, 30 Sep 2020 22:33:42 +0530
+Subject: [PATCH] ath11k: QOS null frame tx over wmi
+
+Added support to send qos null frame through FW.
+NSS driver does not support QOS null frame tx.
+Hence this is brought for nss offload case to send 
+qos null frame. QOS null packet queued from mac80211
+is sent to FW through wmi interface. This happens only if FW supports
+qos null tx, this is based on service bit received in ext2 service
+event from FW. On successful transmission of QOS null frame status
+is set 0 in the event received for this wmi message. This is status
+is sent to mac80211 for further handling.
+
+Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/mac.c |  28 ++++-
+ drivers/net/wireless/ath/ath11k/wmi.c | 200 ++++++++++++++++++++++++++--------
+ drivers/net/wireless/ath/ath11k/wmi.h |  46 +++++++-
+ 3 files changed, 220 insertions(+), 54 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -6129,6 +6129,16 @@ static int ath11k_mac_mgmt_tx_wmi(struct
+ 
+ 	ATH11K_SKB_CB(skb)->paddr = paddr;
+ 
++	if (ieee80211_is_qos_nullfunc(hdr->frame_control)) {
++		ret = ath11k_wmi_qos_null_send(ar, arvif->vdev_id, buf_id, skb);
++		if (ret) {
++			ath11k_warn(ar->ab, "failed to send qos null frame over wmi: %d\n", ret);
++			goto err_unmap_buf;
++		}
++
++		return 0;
++	}
++
+ 	ret = ath11k_wmi_mgmt_send(ar, arvif->vdev_id, buf_id, skb);
+ 	if (ret) {
+ 		ath11k_warn(ar->ab, "failed to send mgmt frame: %d\n", ret);
+@@ -6196,8 +6206,8 @@ static void ath11k_mgmt_over_wmi_tx_work
+ 	}
+ }
+ 
+-static int ath11k_mac_mgmt_tx(struct ath11k *ar, struct sk_buff *skb,
+-			      bool is_prb_rsp)
++static int ath11k_mac_tx_over_wmi(struct ath11k *ar, struct sk_buff *skb,
++				  bool is_prb_rsp)
+ {
+ 	struct sk_buff_head *q = &ar->wmi_mgmt_tx_queue;
+ 
+@@ -6259,7 +6269,7 @@ static void ath11k_mac_op_tx(struct ieee
+ 	} else if (ieee80211_is_mgmt(hdr->frame_control)) {
+ 		frm_type = FIELD_GET(IEEE80211_FCTL_STYPE, hdr->frame_control);
+ 		is_prb_rsp = ieee80211_is_probe_resp(hdr->frame_control);
+-		ret = ath11k_mac_mgmt_tx(ar, skb, is_prb_rsp);
++		ret = ath11k_mac_tx_over_wmi(ar, skb, is_prb_rsp);
+ 		if (ret) {
+ 			if (ret != -EBUSY)
+ 				ath11k_warn(ar->ab, "failed to queue management frame %d\n",
+@@ -6274,6 +6284,20 @@ static void ath11k_mac_op_tx(struct ieee
+ 			spin_unlock_bh(&ar->data_lock);
+ 		}
+ 		return;
++	} else if (ar->ab->nss.enabled &&
++		   ieee80211_is_qos_nullfunc(hdr->frame_control) &&
++		   test_bit(WMI_TLV_SERVICE_QOS_NULL_FRAME_TX_OVER_WMI,
++			    ar->ab->wmi_ab.svc_map)) {
++		/* NSS driver does not support tx qos null pkt hence it is offload
++		 * to fw via wmi path similar to mgmt frames
++		 */
++		ret = ath11k_mac_tx_over_wmi(ar, skb, false);
++		if (ret) {
++			ath11k_warn(ar->ab, "failed to queue qos null frame %d\n",
++				    ret);
++			ieee80211_free_txskb(ar->hw, skb);
++		}
++		return;
+ 	}
+ 
+ 	if (control->sta)
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -23,6 +23,7 @@
+ 
+ struct wmi_tlv_policy {
+ 	size_t min_len;
++	char policy[40];
+ };
+ 
+ struct wmi_tlv_svc_ready_parse {
+@@ -91,69 +92,69 @@ struct wmi_tlv_mgmt_rx_parse {
+ 
+ static const struct wmi_tlv_policy wmi_tlv_policies[] = {
+ 	[WMI_TAG_ARRAY_BYTE]
+-		= { .min_len = 0 },
++		= { .min_len = 0, .policy = "WMI_TAG_ARRAY_BYTE" },
+ 	[WMI_TAG_ARRAY_UINT32]
+-		= { .min_len = 0 },
++		= { .min_len = 0, .policy = "WMI_TAG_ARRAY_UINT32" },
+ 	[WMI_TAG_SERVICE_READY_EVENT]
+-		= { .min_len = sizeof(struct wmi_service_ready_event) },
++		= { .min_len = sizeof(struct wmi_service_ready_event), .policy = "wmi_service_ready_event" },
+ 	[WMI_TAG_SERVICE_READY_EXT_EVENT]
+-		= { .min_len =  sizeof(struct wmi_service_ready_ext_event) },
++		= { .min_len =  sizeof(struct wmi_service_ready_ext_event), .policy = "wmi_service_ready_ext_event" },
+ 	[WMI_TAG_SOC_MAC_PHY_HW_MODE_CAPS]
+-		= { .min_len = sizeof(struct wmi_soc_mac_phy_hw_mode_caps) },
++		= { .min_len = sizeof(struct wmi_soc_mac_phy_hw_mode_caps), .policy = "wmi_soc_mac_phy_hw_mode_caps" },
+ 	[WMI_TAG_SOC_HAL_REG_CAPABILITIES]
+-		= { .min_len = sizeof(struct wmi_soc_hal_reg_capabilities) },
++		= { .min_len = sizeof(struct wmi_soc_hal_reg_capabilities), .policy = "wmi_soc_hal_reg_capabilities" },
+ 	[WMI_TAG_VDEV_START_RESPONSE_EVENT]
+-		= { .min_len = sizeof(struct wmi_vdev_start_resp_event) },
++		= { .min_len = sizeof(struct wmi_vdev_start_resp_event), .policy = "wmi_vdev_start_resp_event" },
+ 	[WMI_TAG_PEER_DELETE_RESP_EVENT]
+-		= { .min_len = sizeof(struct wmi_peer_delete_resp_event) },
++		= { .min_len = sizeof(struct wmi_peer_delete_resp_event), .policy = "wmi_peer_delete_resp_event" },
+ 	[WMI_TAG_OFFLOAD_BCN_TX_STATUS_EVENT]
+-		= { .min_len = sizeof(struct wmi_bcn_tx_status_event) },
++		= { .min_len = sizeof(struct wmi_bcn_tx_status_event), .policy = "wmi_bcn_tx_status_event" },
+ 	[WMI_TAG_VDEV_STOPPED_EVENT]
+-		= { .min_len = sizeof(struct wmi_vdev_stopped_event) },
++		= { .min_len = sizeof(struct wmi_vdev_stopped_event), .policy = "wmi_vdev_stopped_event" },
+ 	[WMI_TAG_REG_CHAN_LIST_CC_EVENT]
+-		= { .min_len = sizeof(struct wmi_reg_chan_list_cc_event) },
++		= { .min_len = sizeof(struct wmi_reg_chan_list_cc_event), .policy = "wmi_reg_chan_list_cc_event" },
+ 	[WMI_TAG_REG_CHAN_LIST_CC_EXT_EVENT]
+-		= { .min_len = sizeof(struct wmi_reg_chan_list_cc_ext_event) },
++		= { .min_len = sizeof(struct wmi_reg_chan_list_cc_ext_event), .policy = "wmi_reg_chan_list_cc_ext_event" },
+ 	[WMI_TAG_MGMT_RX_HDR]
+-		= { .min_len = sizeof(struct wmi_mgmt_rx_hdr) },
++		= { .min_len = sizeof(struct wmi_mgmt_rx_hdr), .policy = "wmi_mgmt_rx_hdr" },
+ 	[WMI_TAG_MGMT_TX_COMPL_EVENT]
+-		= { .min_len = sizeof(struct wmi_mgmt_tx_compl_event) },
++		= { .min_len = sizeof(struct wmi_tx_compl_event), .policy = "wmi_tx_compl_event" },
+ 	[WMI_TAG_SCAN_EVENT]
+-		= { .min_len = sizeof(struct wmi_scan_event) },
++		= { .min_len = sizeof(struct wmi_scan_event), .policy = "wmi_scan_event" },
+ 	[WMI_TAG_PEER_STA_KICKOUT_EVENT]
+-		= { .min_len = sizeof(struct wmi_peer_sta_kickout_event) },
++		= { .min_len = sizeof(struct wmi_peer_sta_kickout_event), .policy = "wmi_peer_sta_kickout_event" },
+ 	[WMI_TAG_ROAM_EVENT]
+-		= { .min_len = sizeof(struct wmi_roam_event) },
++		= { .min_len = sizeof(struct wmi_roam_event), .policy = "wmi_roam_event" },
+ 	[WMI_TAG_CHAN_INFO_EVENT]
+-		= { .min_len = sizeof(struct wmi_chan_info_event) },
++		= { .min_len = sizeof(struct wmi_chan_info_event), .policy = "wmi_chan_info_event" },
+ 	[WMI_TAG_PDEV_BSS_CHAN_INFO_EVENT]
+-		= { .min_len = sizeof(struct wmi_pdev_bss_chan_info_event) },
++		= { .min_len = sizeof(struct wmi_pdev_bss_chan_info_event), .policy = "wmi_pdev_bss_chan_info_event" },
+ 	[WMI_TAG_VDEV_INSTALL_KEY_COMPLETE_EVENT]
+-		= { .min_len = sizeof(struct wmi_vdev_install_key_compl_event) },
++		= { .min_len = sizeof(struct wmi_vdev_install_key_compl_event), .policy = "wmi_vdev_install_key_compl_event" },
+ 	[WMI_TAG_READY_EVENT] = {
+-		.min_len = sizeof(struct wmi_ready_event_min) },
++		.min_len = sizeof(struct wmi_ready_event_min), .policy = "wmi_ready_event_min" },
+ 	[WMI_TAG_SERVICE_AVAILABLE_EVENT]
+-		= {.min_len = sizeof(struct wmi_service_available_event) },
++		= {.min_len = sizeof(struct wmi_service_available_event), .policy = "wmi_service_available_event" },
+ 	[WMI_TAG_PEER_ASSOC_CONF_EVENT]
+-		= { .min_len = sizeof(struct wmi_peer_assoc_conf_event) },
++		= { .min_len = sizeof(struct wmi_peer_assoc_conf_event), .policy = "wmi_peer_assoc_conf_event" },
+ 	[WMI_TAG_STATS_EVENT]
+-		= { .min_len = sizeof(struct wmi_stats_event) },
++		= { .min_len = sizeof(struct wmi_stats_event), .policy = "wmi_stats_event" },
+ 	[WMI_TAG_PDEV_CTL_FAILSAFE_CHECK_EVENT]
+-		= { .min_len = sizeof(struct wmi_pdev_ctl_failsafe_chk_event) },
++		= { .min_len = sizeof(struct wmi_pdev_ctl_failsafe_chk_event), .policy = "wmi_pdev_ctl_failsafe_chk_event" },
+ 	[WMI_TAG_HOST_SWFDA_EVENT] = {
+-		.min_len = sizeof(struct wmi_fils_discovery_event) },
++		.min_len = sizeof(struct wmi_fils_discovery_event), .policy = "wmi_fils_discovery_event" },
+ 	[WMI_TAG_OFFLOAD_PRB_RSP_TX_STATUS_EVENT] = {
+-		.min_len = sizeof(struct wmi_probe_resp_tx_status_event) },
++		.min_len = sizeof(struct wmi_probe_resp_tx_status_event), .policy = "wmi_probe_resp_tx_status_event" },
+ 	[WMI_TAG_VDEV_DELETE_RESP_EVENT] = {
+-		.min_len = sizeof(struct wmi_vdev_delete_resp_event) },
++		.min_len = sizeof(struct wmi_vdev_delete_resp_event), .policy = "wmi_vdev_delete_resp_event" },
+ 	[WMI_TAG_OBSS_COLOR_COLLISION_EVT] = {
+-		.min_len = sizeof(struct wmi_obss_color_collision_event) },
++		.min_len = sizeof(struct wmi_obss_color_collision_event), .policy = "wmi_obss_color_collision_event" },
+ 	[WMI_TAG_11D_NEW_COUNTRY_EVENT] = {
+-		.min_len = sizeof(struct wmi_11d_new_cc_ev) },
++		.min_len = sizeof(struct wmi_11d_new_cc_ev), .policy = "wmi_11d_new_cc_ev" },
+ 	[WMI_TAG_PER_CHAIN_RSSI_STATS] = {
+-		.min_len = sizeof(struct wmi_per_chain_rssi_stats) },
++		.min_len = sizeof(struct wmi_per_chain_rssi_stats), .policy = "wmi_per_chain_rssi_stats" },
+ 	[WMI_TAG_TWT_ADD_DIALOG_COMPLETE_EVENT] = {
+-		.min_len = sizeof(struct wmi_twt_add_dialog_event) },
++		.min_len = sizeof(struct wmi_twt_add_dialog_event), .policy = "wmi_twt_add_dialog_event" },
+ };
+ 
+ #define PRIMAP(_hw_mode_) \
+@@ -203,8 +204,8 @@ ath11k_wmi_tlv_iter(struct ath11k_base *
+ 		if (tlv_tag < ARRAY_SIZE(wmi_tlv_policies) &&
+ 		    wmi_tlv_policies[tlv_tag].min_len &&
+ 		    wmi_tlv_policies[tlv_tag].min_len > tlv_len) {
+-			ath11k_err(ab, "wmi tlv parse failure of tag %u at byte %zd (%u bytes is less than min length %zu)\n",
+-				   tlv_tag, ptr - begin, tlv_len,
++			ath11k_err(ab, "wmi tlv parse failure of tag %u (%s) at byte %zd (%u bytes is less than min length %zu)\n",
++				   tlv_tag, wmi_tlv_policies[tlv_tag].policy, ptr - begin, tlv_len,
+ 				   wmi_tlv_policies[tlv_tag].min_len);
+ 			return -EINVAL;
+ 		}
+@@ -697,6 +698,55 @@ int ath11k_wmi_mgmt_send(struct ath11k *
+ 	return ret;
+ }
+ 
++int ath11k_wmi_qos_null_send(struct ath11k *ar, u32 vdev_id, u32 buf_id,
++			     struct sk_buff *frame)
++{
++	struct ath11k_pdev_wmi *wmi = ar->wmi;
++	struct wmi_qos_null_tx_cmd *cmd;
++	struct wmi_tlv *frame_tlv;
++	struct sk_buff *skb;
++	u32 buf_len;
++	int len, ret = 0;
++
++	buf_len = frame->len < WMI_QOS_NULL_SEND_BUF_LEN ?
++		  frame->len : WMI_QOS_NULL_SEND_BUF_LEN;
++
++	len = sizeof(*cmd) + sizeof(*frame_tlv) + roundup(buf_len, 4);
++
++	skb = ath11k_wmi_alloc_skb(wmi->wmi_ab, len);
++	if (!skb)
++		return -ENOMEM;
++
++	cmd = (struct wmi_qos_null_tx_cmd *)skb->data;
++	cmd->tlv_header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_QOS_NULL_FRAME_TX_SEND) |
++			  FIELD_PREP(WMI_TLV_LEN, sizeof(*cmd) - TLV_HDR_SIZE);
++	cmd->vdev_id = vdev_id;
++	cmd->desc_id = buf_id;
++	cmd->paddr_lo = lower_32_bits(ATH11K_SKB_CB(frame)->paddr);
++	cmd->paddr_hi = upper_32_bits(ATH11K_SKB_CB(frame)->paddr);
++	cmd->frame_len = frame->len;
++	cmd->buf_len = buf_len;
++
++	frame_tlv = (struct wmi_tlv *)(skb->data + sizeof(*cmd));
++	frame_tlv->header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_ARRAY_BYTE) |
++			    FIELD_PREP(WMI_TLV_LEN, buf_len);
++
++	memcpy(frame_tlv->value, frame->data, buf_len);
++
++	ath11k_ce_byte_swap(frame_tlv->value, buf_len);
++
++	ret = ath11k_wmi_cmd_send(wmi, skb, WMI_QOS_NULL_FRAME_TX_SEND_CMDID);
++	if (ret) {
++		ath11k_warn(ar->ab,
++			    "failed to submit WMI_QOS_NULL_FRAME_TX_SEND_CMDID cmd\n");
++		dev_kfree_skb(skb);
++	}
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_WMI,
++		   "wmi QOS null tx send cmd sent successfully\n");
++	return ret;
++}
++
+ int ath11k_wmi_vdev_create(struct ath11k *ar, u8 *macaddr,
+ 			   struct vdev_create_params *param)
+ {
+@@ -4103,7 +4153,6 @@ ath11k_wmi_copy_resource_config(struct w
+ 	wmi_cfg->max_bssid_rx_filters = tg_cfg->max_bssid_rx_filters;
+ 	wmi_cfg->use_pdev_id = tg_cfg->use_pdev_id;
+ 	wmi_cfg->flag1 = tg_cfg->flag1;
+-	wmi_cfg->flag1 |= WMI_RSRC_CFG_FLAG1_ACK_RSSI;
+ 	wmi_cfg->peer_map_unmap_v2_support = tg_cfg->peer_map_unmap_v2_support;
+ 	wmi_cfg->sched_params = tg_cfg->sched_params;
+ 	wmi_cfg->twt_ap_pdev_count = tg_cfg->twt_ap_pdev_count;
+@@ -5856,8 +5905,8 @@ static int ath11k_pull_mgmt_rx_params_tl
+ 	return 0;
+ }
+ 
+-static int wmi_process_mgmt_tx_comp(struct ath11k *ar,
+-				    struct wmi_mgmt_tx_compl_event *tx_compl_param)
++static int wmi_process_tx_comp(struct ath11k *ar,
++				    struct wmi_tx_compl_event *tx_compl_param)
+ {
+ 	struct sk_buff *msdu;
+ 	struct ieee80211_tx_info *info;
+@@ -5895,6 +5944,11 @@ static int wmi_process_mgmt_tx_comp(stru
+ 			info->status.ack_signal = tx_compl_param->ack_rssi;
+ 	}
+ 
++	/* dont update rates in this path, qos null data tx completions also can
++	 * take this path in case of nss offload and can update invalid rates.
++	 */
++	info->status.rates[0].idx = -1;
++
+ 	hdr = (struct ieee80211_hdr *)msdu->data;
+ 	frm_type = FIELD_GET(IEEE80211_FCTL_STYPE, hdr->frame_control);
+ 
+@@ -5913,10 +5967,13 @@ static int wmi_process_mgmt_tx_comp(stru
+ 	arvif = ath11k_vif_to_arvif(vif);
+ 	mgmt_stats = &arvif->mgmt_stats;
+ 
+-	if (!tx_compl_param->status)
+-		mgmt_stats->tx_compl_succ[frm_type]++;
+-	else
+-		mgmt_stats->tx_compl_fail[frm_type]++;
++	if (ieee80211_is_mgmt(hdr->frame_control)) {
++		if (!tx_compl_param->status)
++			mgmt_stats->tx_compl_succ[frm_type]++;
++		else
++			mgmt_stats->tx_compl_fail[frm_type]++;
++	}
++
+ 	spin_unlock_bh(&ar->data_lock);
+ 
+ skip_mgmt_stats:
+@@ -5938,12 +5995,13 @@ skip_mgmt_stats:
+ 	return 0;
+ }
+ 
+-static int ath11k_pull_mgmt_tx_compl_param_tlv(struct ath11k_base *ab,
+-					       struct sk_buff *skb,
+-					       struct wmi_mgmt_tx_compl_event *param)
++static int ath11k_pull_tx_compl_param_tlv(struct ath11k_base *ab,
++					  struct sk_buff *skb,
++					  struct wmi_tx_compl_event *param,
++					  int event_id)
+ {
+ 	const void **tb;
+-	const struct wmi_mgmt_tx_compl_event *ev;
++	const struct wmi_tx_compl_event *ev;
+ 	int ret;
+ 
+ 	tb = ath11k_wmi_tlv_parse_alloc(ab, skb->data, skb->len, GFP_ATOMIC);
+@@ -5953,7 +6011,7 @@ static int ath11k_pull_mgmt_tx_compl_par
+ 		return ret;
+ 	}
+ 
+-	ev = tb[WMI_TAG_MGMT_TX_COMPL_EVENT];
++	ev = tb[event_id];
+ 	if (!ev) {
+ 		ath11k_warn(ab, "failed to fetch mgmt tx compl ev");
+ 		kfree(tb);
+@@ -7730,10 +7788,11 @@ exit:
+ 
+ static void ath11k_mgmt_tx_compl_event(struct ath11k_base *ab, struct sk_buff *skb)
+ {
+-	struct wmi_mgmt_tx_compl_event tx_compl_param = {0};
++	struct wmi_tx_compl_event tx_compl_param = {0};
+ 	struct ath11k *ar;
+ 
+-	if (ath11k_pull_mgmt_tx_compl_param_tlv(ab, skb, &tx_compl_param) != 0) {
++	if (ath11k_pull_tx_compl_param_tlv(ab, skb, &tx_compl_param,
++					   WMI_TAG_MGMT_TX_COMPL_EVENT) != 0) {
+ 		ath11k_warn(ab, "failed to extract mgmt tx compl event");
+ 		return;
+ 	}
+@@ -7746,7 +7805,7 @@ static void ath11k_mgmt_tx_compl_event(s
+ 		goto exit;
+ 	}
+ 
+-	wmi_process_mgmt_tx_comp(ar, &tx_compl_param);
++	wmi_process_tx_comp(ar, &tx_compl_param);
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_MGMT,
+ 		   "event mgmt tx compl ev pdev_id %d, desc_id %d, status %d ack_rssi %d",
+@@ -7757,6 +7816,36 @@ exit:
+ 	rcu_read_unlock();
+ }
+ 
++static void ath11k_qos_null_compl_event(struct ath11k_base *ab, struct sk_buff *skb)
++{
++	struct wmi_tx_compl_event tx_compl_param = {0};
++	struct ath11k *ar;
++
++	if (ath11k_pull_tx_compl_param_tlv(ab, skb, &tx_compl_param,
++					   WMI_TAG_QOS_NULL_FRAME_TX_STATUS) != 0) {
++		ath11k_warn(ab, "failed to extract qos null tx compl event");
++		return;
++	}
++
++	rcu_read_lock();
++	ar = ath11k_mac_get_ar_by_pdev_id(ab, tx_compl_param.pdev_id);
++	if (!ar) {
++		ath11k_warn(ab, "invalid pdev id %d in qos_null_tx_compl_event\n",
++			    tx_compl_param.pdev_id);
++		goto exit;
++	}
++
++	wmi_process_tx_comp(ar, &tx_compl_param);
++
++	ath11k_dbg(ab, ATH11K_DBG_WMI,
++		   "QOS null tx compl ev pdev_id %d, desc_id %d, status %d",
++		   tx_compl_param.pdev_id, tx_compl_param.desc_id,
++		   tx_compl_param.status);
++
++exit:
++	rcu_read_unlock();
++}
++
+ static struct ath11k *ath11k_get_ar_on_scan_state(struct ath11k_base *ab,
+ 						  u32 vdev_id,
+ 						  enum ath11k_scan_state state)
+@@ -8843,6 +8932,9 @@ static void ath11k_wmi_tlv_op_rx(struct
+ 	case WMI_GTK_OFFLOAD_STATUS_EVENTID:
+ 		ath11k_wmi_gtk_offload_status_event(ab, skb);
+ 		break;
++	case WMI_QOS_NULL_FRAME_TX_COMPLETION_EVENTID:
++		ath11k_qos_null_compl_event(ab, skb);
++		break;
+ 	default:
+ 		ath11k_dbg(ab, ATH11K_DBG_WMI, "unsupported event id 0x%x\n", id);
+ 		break;
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -363,6 +363,7 @@ enum wmi_tlv_cmd_id {
+ 	WMI_BSS_COLOR_CHANGE_ENABLE_CMDID,
+ 	WMI_VDEV_BCN_OFFLOAD_QUIET_CONFIG_CMDID,
+ 	WMI_FILS_DISCOVERY_TMPL_CMDID,
++	WMI_QOS_NULL_FRAME_TX_SEND_CMDID,
+ 	WMI_ADDBA_CLEAR_RESP_CMDID = WMI_TLV_CMD(WMI_GRP_BA_NEG),
+ 	WMI_ADDBA_SEND_CMDID,
+ 	WMI_ADDBA_STATUS_CMDID,
+@@ -693,6 +694,8 @@ enum wmi_tlv_event_id {
+ 	WMI_TBTTOFFSET_EXT_UPDATE_EVENTID,
+ 	WMI_OFFCHAN_DATA_TX_COMPLETION_EVENTID,
+ 	WMI_HOST_FILS_DISCOVERY_EVENTID,
++	WMI_HOST_SWBA_V2_EVENTID,
++	WMI_QOS_NULL_FRAME_TX_COMPLETION_EVENTID,
+ 	WMI_TX_DELBA_COMPLETE_EVENTID = WMI_TLV_CMD(WMI_GRP_BA_NEG),
+ 	WMI_TX_ADDBA_COMPLETE_EVENTID,
+ 	WMI_BA_RSP_SSN_EVENTID,
+@@ -1880,6 +1883,9 @@ enum wmi_tlv_tag {
+ 	WMI_TAG_REG_CHAN_LIST_CC_EXT_EVENT,
+ 	WMI_TAG_PDEV_SET_BIOS_SAR_TABLE_CMD = 0x3D8,
+ 	WMI_TAG_PDEV_SET_BIOS_GEO_TABLE_CMD,
++	/* TODO add all the missing cmds */
++	WMI_TAG_QOS_NULL_FRAME_TX_SEND = 0x3A6,
++	WMI_TAG_QOS_NULL_FRAME_TX_STATUS,
+ 	WMI_TAG_MAX
+ };
+ 
+@@ -2107,7 +2113,17 @@ enum wmi_tlv_service {
+ 	WMI_TLV_SERVICE_PEER_POWER_SAVE_DURATION_SUPPORT = 246,
+ 	WMI_TLV_SERVICE_SRG_SRP_SPATIAL_REUSE_SUPPORT = 249,
+ 	WMI_TLV_SERVICE_MBSS_PARAM_IN_VDEV_START_SUPPORT = 253,
++	WMI_TLV_SERVICE_CONFIGURE_ROAM_TRIGGER_PARAM_SUPPORT = 254,
++	WMI_TLV_SERVICE_CFR_TA_RA_AS_FP_SUPPORT = 255,
++	WMI_TLV_SERVICE_CFR_CAPTURE_COUNT_SUPPORT = 256,
++	WMI_TLV_SERVICE_OCV_SUPPORT = 257,
++	WMI_TLV_SERVICE_LL_STATS_PER_CHAN_RX_TX_TIME_SUPPORT = 258,
++	WMI_TLV_SERVICE_THERMAL_MULTI_CLIENT_SUPPORT = 259,
++	WMI_TLV_SERVICE_NAN_SEND_NAN_ENABLE_RESPONSE_TO_HOST = 260,
++	WMI_TLV_SERVICE_UNIFIED_LL_GET_STA_CMD_SUPPORT = 261,
++	WMI_TLV_SERVICE_FSE_CMEM_ALLOC_SUPPORT = 262,
+ 	WMI_TLV_SERVICE_PASSIVE_SCAN_START_TIME_ENHANCE = 263,
++	WMI_TLV_SERVICE_QOS_NULL_FRAME_TX_OVER_WMI = 264,
+ 
+ 	/* The second 128 bits */
+ 	WMI_MAX_EXT_SERVICE = 256,
+@@ -3814,6 +3830,7 @@ struct wmi_scan_prob_req_oui_cmd {
+ }  __packed;
+ 
+ #define WMI_MGMT_SEND_DOWNLD_LEN	64
++#define WMI_QOS_NULL_SEND_BUF_LEN	64
+ 
+ #define WMI_TX_PARAMS_DWORD0_POWER		GENMASK(7, 0)
+ #define WMI_TX_PARAMS_DWORD0_MCS_MASK		GENMASK(19, 8)
+@@ -3824,9 +3841,10 @@ struct wmi_scan_prob_req_oui_cmd {
+ #define WMI_TX_PARAMS_DWORD1_BW_MASK		GENMASK(14, 8)
+ #define WMI_TX_PARAMS_DWORD1_PREAMBLE_TYPE	GENMASK(19, 15)
+ #define WMI_TX_PARAMS_DWORD1_FRAME_TYPE		BIT(20)
+-#define WMI_TX_PARAMS_DWORD1_RSVD		GENMASK(31, 21)
++#define WMI_TX_PARAMS_DWORD1_CFR_CAPTURE	BIT(21)
++#define WMI_TX_PARAMS_DWORD1_RSVD		GENMASK(31, 22)
+ 
+-struct wmi_mgmt_send_params {
++struct wmi_tx_send_params {
+ 	u32 tlv_header;
+ 	u32 tx_params_dword0;
+ 	u32 tx_params_dword1;
+@@ -4570,7 +4588,6 @@ struct wmi_pdev_bss_chan_info_event {
+ 	u32 rx_bss_cycle_count_low;
+ 	u32 rx_bss_cycle_count_high;
+ 	u32 pdev_id;
+-	u32 ack_rssi;
+ } __packed;
+ 
+ #define WMI_VDEV_INSTALL_KEY_COMPL_STATUS_SUCCESS 0
+@@ -4918,7 +4935,7 @@ struct wmi_rssi_ctl_ext {
+ 	u32 rssi_ctl_ext[MAX_ANTENNA_EIGHT - ATH_MAX_ANTENNA];
+ };
+ 
+-struct wmi_mgmt_tx_compl_event {
++struct wmi_tx_compl_event {
+ 	u32 desc_id;
+ 	u32 status;
+ 	u32 pdev_id;
+@@ -5748,6 +5765,17 @@ struct wmi_debug_log_config_cmd_fixed_pa
+ 	u32 value;
+ } __packed;
+ 
++struct wmi_qos_null_tx_cmd {
++	u32 tlv_header;
++	u32 vdev_id;
++	u32 desc_id;
++	u32 paddr_lo;
++	u32 paddr_hi;
++	u32 frame_len;
++	u32 buf_len;
++	u32 tx_params_valid;
++} __packed;
++
+ #define WMI_MAX_MEM_REQS 32
+ 
+ #define MAX_RADIOS 3
+@@ -6358,6 +6386,8 @@ int ath11k_wmi_cmd_send(struct ath11k_pd
+ struct sk_buff *ath11k_wmi_alloc_skb(struct ath11k_wmi_base *wmi_sc, u32 len);
+ int ath11k_wmi_mgmt_send(struct ath11k *ar, u32 vdev_id, u32 buf_id,
+ 			 struct sk_buff *frame);
++int ath11k_wmi_qos_null_send(struct ath11k *ar, u32 vdev_id, u32 buf_id,
++			     struct sk_buff *frame);
+ int ath11k_wmi_bcn_tmpl(struct ath11k *ar, u32 vdev_id,
+ 			struct ieee80211_mutable_offsets *offs,
+ 			struct sk_buff *bcn, u32 ema_param);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch b/package/kernel/mac80211/patches/ath11k_nss/233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
new file mode 100644
index 00000000000000..0b9d559a4857ae
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
@@ -0,0 +1,906 @@
+From 30f54666ae15128f26fbad787a35253885a10513 Mon Sep 17 00:00:00 2001
+From: Ramya Gnanasekar <rgnanase@codeaurora.org>
+Date: Fri, 25 Dec 2020 16:11:06 +0530
+Subject: [PATCH] ath11k: Disable rx_header tlv for 2K SKB
+
+On low memory platform hdr_status in hal_rx_desc is not subscribed to
+get a savings of 128bytes in skb. This is required to reduce the skb
+size from 4K to 2K. Use HTT_H2T_MSG_TYPE_RX_RING_SELECTION_CFG message
+to unsubscribe rx_pkt_header tlv for rxdma ring.
+
+Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
+
+--- a/drivers/net/wireless/ath/ath11k/debugfs.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs.c
+@@ -666,6 +666,7 @@ static ssize_t ath11k_write_extd_rx_stat
+ 	}
+ 
+ 	ar->debug.rx_filter = tlv_filter.rx_filter;
++	tlv_filter.offset_valid = false;
+ 
+ 	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
+ 		ring_id = ar->dp.rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
+@@ -1111,6 +1112,7 @@ static ssize_t ath11k_write_pktlog_filte
+ 	}
+ 
+ 	/* Clear rx filter set for monitor mode and rx status */
++	tlv_filter.offset_valid = false;
+ 	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
+ 		ring_id = ar->dp.rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
+ 		ret = ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id, ar->dp.mac_id,
+--- a/drivers/net/wireless/ath/ath11k/dp.h
++++ b/drivers/net/wireless/ath/ath11k/dp.h
+@@ -219,7 +219,8 @@ struct ath11k_pdev_dp {
+ #define DP_REO_CMD_RING_SIZE		256
+ #define DP_REO_STATUS_RING_SIZE		2048
+ #define DP_RXDMA_BUF_RING_SIZE		4096
+-#define DP_RXDMA_REFILL_RING_SIZE	2048
++#define DP_RXDMA_REFILL_RING_SIZE	ATH11K_DP_RXDMA_REFILL_RING_SIZE
++#define DP_RXDMA_NSS_REFILL_RING_SIZE	ATH11K_DP_RXDMA_NSS_REFILL_RING_SIZE
+ #define DP_RXDMA_ERR_DST_RING_SIZE	1024
+ #define DP_RXDMA_MON_STATUS_RING_SIZE	ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE
+ #define DP_RXDMA_MONITOR_BUF_RING_SIZE	ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE
+@@ -609,7 +610,7 @@ enum htt_ppdu_stats_tag_type {
+  *
+  *    |31       26|25|24|23            16|15             8|7             0|
+  *    |-----------------+----------------+----------------+---------------|
+- *    |   rsvd1   |PS|SS|     ring_id    |     pdev_id    |    msg_type   |
++ *    |   rsvd1|OV|PS|SS|     ring_id    |     pdev_id    |    msg_type   |
+  *    |-------------------------------------------------------------------|
+  *    |              rsvd2               |           ring_buffer_size     |
+  *    |-------------------------------------------------------------------|
+@@ -623,6 +624,14 @@ enum htt_ppdu_stats_tag_type {
+  *    |-------------------------------------------------------------------|
+  *    |                         tlv_filter_in_flags                       |
+  *    |-------------------------------------------------------------------|
++ *    |         rx_header_offset         |       rx_packet_offset         |
++ *    |-------------------------------------------------------------------|
++ *    |       rx_mpdu_start_offset       |      rx_mpdu_end_offset        |
++ *    |-------------------------------------------------------------------|
++ *    |       rx_msdu_start_offset       |      rx_msdu_end_offset        |
++ *    |-------------------------------------------------------------------|
++ *    |              rsvd3               |      rx_attention_offset       |
++ *    |-------------------------------------------------------------------|
+  * Where:
+  *     PS = pkt_swap
+  *     SS = status_swap
+@@ -636,6 +645,9 @@ enum htt_ppdu_stats_tag_type {
+  *                    More details can be got from enum htt_srng_ring_id
+  *          b'24    - status_swap: 1 is to swap status TLV
+  *          b'25    - pkt_swap:  1 is to swap packet TLV
++ *          b'26    - rx_offset_valid (OV): flag to indicate rx offsets
++ *                    configuration fields are valid
++ *
+  *          b'26:31 - rsvd1:  reserved for future use
+  * dword1 - b'0:16  - ring_buffer_size: size of buffers referenced by rx ring,
+  *                    in byte units.
+@@ -665,6 +677,42 @@ enum htt_ppdu_stats_tag_type {
+  * dword6 - b'0:31 -  tlv_filter_in_flags:
+  *                    Filter in Attention/MPDU/PPDU/Header/User tlvs
+  *                    Refer to CFG_TLV_FILTER_IN_FLAG defs
++ * dword7 - b'0:15 -  rx_packet_offset: rx_packet_offset in byte units
++ *		      Valid only for HW_TO_SW_RING and SW_TO_HW_RING
++ *		      A value of 0 will be considered as ignore this config.
++ *		      Refer to BUF_RING_CFG_1 defs within HW .h files,
++ *		      e.g. wmac_top_reg_seq_hwioreg.h
++ *	  - b'16:31 - rx_header_offset: rx_header_offset in byte units
++ *		      Valid only for HW_TO_SW_RING and SW_TO_HW_RING
++ *		      A value of 0 will be considered as ignore this config.
++ *		      Refer to BUF_RING_CFG_1 defs within HW .h files,
++ *		      e.g. wmac_top_reg_seq_hwioreg.h
++ * dword8 - b'0:15 -  rx_mpdu_end_offset: rx_mpdu_end_offset in byte units
++ *	              Valid only for HW_TO_SW_RING and SW_TO_HW_RING
++ *		      A value of 0 will be considered as ignore this config.
++ *		      Refer to BUF_RING_CFG_2 defs within HW .h files,
++ *		      e.g. wmac_top_reg_seq_hwioreg.h
++ *	  - b'16:31 - rx_mpdu_start_offset: rx_mpdu_start_offset in byte units
++ *		      Valid only for HW_TO_SW_RING and SW_TO_HW_RING
++ *		      A value of 0 will be considered as ignore this config.
++ *		      Refer to BUF_RING_CFG_2 defs within HW .h files,
++ *		      e.g. wmac_top_reg_seq_hwioreg.h
++ * dword9 - b'0:15 -  rx_msdu_end_offset: rx_msdu_end_offset in byte units
++ *		      Valid only for HW_TO_SW_RING and SW_TO_HW_RING
++ *		      A value of 0 will be considered as ignore this config.
++ *		      Refer to BUF_RING_CFG_3 defs within HW .h files,
++ *		      e.g. wmac_top_reg_seq_hwioreg.h
++ *	  - b'16:31 - rx_msdu_start_offset: rx_msdu_start_offset in byte units
++ *		      Valid only for HW_TO_SW_RING and SW_TO_HW_RING
++ *		      A value of 0 will be considered as ignore this config.
++ *		      Refer to BUF_RING_CFG_3 defs within HW .h files,
++ *		      e.g. wmac_top_reg_seq_hwioreg.h
++ * dword10- b'0:15  - rx_attention_offset: rx_attention_offset in byte units
++ *		      Valid only for HW_TO_SW_RING and SW_TO_HW_RING
++ *		      A value of 0 will be considered as ignore this config.
++ *		      Refer to BUF_RING_CFG_4 defs within HW .h files,
++ *		      e.g. wmac_top_reg_seq_hwioreg.h
++ *	  - b'16:31 - rsvd3 for future use
+  */
+ 
+ #define HTT_RX_RING_SELECTION_CFG_CMD_INFO0_MSG_TYPE	GENMASK(7, 0)
+@@ -672,8 +720,16 @@ enum htt_ppdu_stats_tag_type {
+ #define HTT_RX_RING_SELECTION_CFG_CMD_INFO0_RING_ID	GENMASK(23, 16)
+ #define HTT_RX_RING_SELECTION_CFG_CMD_INFO0_SS		BIT(24)
+ #define HTT_RX_RING_SELECTION_CFG_CMD_INFO0_PS		BIT(25)
++#define HTT_RX_RING_SELECTION_CFG_CMD_OFFSET_VALID      BIT(26)
+ 
+ #define HTT_RX_RING_SELECTION_CFG_CMD_INFO1_BUF_SIZE	GENMASK(15, 0)
++#define HTT_RX_RING_SELECTION_CFG_RX_PACKET_OFFSET      GENMASK(15, 0)
++#define HTT_RX_RING_SELECTION_CFG_RX_HEADER_OFFSET      GENMASK(31, 16)
++#define HTT_RX_RING_SELECTION_CFG_RX_MPDU_END_OFFSET    GENMASK(15, 0)
++#define HTT_RX_RING_SELECTION_CFG_RX_MPDU_START_OFFSET  GENMASK(31, 16)
++#define HTT_RX_RING_SELECTION_CFG_RX_MSDU_END_OFFSET    GENMASK(15, 0)
++#define HTT_RX_RING_SELECTION_CFG_RX_MSDU_START_OFFSET  GENMASK(31, 16)
++#define HTT_RX_RING_SELECTION_CFG_RX_ATTENTION_OFFSET   GENMASK(15, 0)
+ 
+ enum htt_rx_filter_tlv_flags {
+ 	HTT_RX_FILTER_TLV_FLAGS_MPDU_START		= BIT(0),
+@@ -977,6 +1033,14 @@ enum htt_rx_data_pkt_filter_tlv_flasg3 {
+ 		HTT_RX_FILTER_TLV_FLAGS_PER_MSDU_HEADER | \
+ 		HTT_RX_FILTER_TLV_FLAGS_ATTENTION)
+ 
++#define HTT_RX_RXDMA_FILTER_TLV_FLAGS_BUF_RING \
++		(HTT_RX_FILTER_TLV_FLAGS_MPDU_START | \
++		HTT_RX_FILTER_TLV_FLAGS_MSDU_START | \
++		HTT_RX_FILTER_TLV_FLAGS_RX_PACKET | \
++		HTT_RX_FILTER_TLV_FLAGS_MSDU_END | \
++		HTT_RX_FILTER_TLV_FLAGS_MPDU_END | \
++		HTT_RX_FILTER_TLV_FLAGS_ATTENTION)
++
+ struct htt_rx_ring_selection_cfg_cmd {
+ 	u32 info0;
+ 	u32 info1;
+@@ -985,6 +1049,10 @@ struct htt_rx_ring_selection_cfg_cmd {
+ 	u32 pkt_type_en_flags2;
+ 	u32 pkt_type_en_flags3;
+ 	u32 rx_filter_tlv;
++	u32 rx_packet_offset;
++	u32 rx_mpdu_offset;
++	u32 rx_msdu_offset;
++	u32 rx_attn_offset;
+ } __packed;
+ 
+ struct htt_rx_ring_tlv_filter {
+@@ -993,6 +1061,14 @@ struct htt_rx_ring_tlv_filter {
+ 	u32 pkt_filter_flags1; /* MGMT */
+ 	u32 pkt_filter_flags2; /* CTRL */
+ 	u32 pkt_filter_flags3; /* DATA */
++	bool offset_valid;
++	u16 rx_packet_offset;
++	u16 rx_header_offset;
++	u16 rx_mpdu_end_offset;
++	u16 rx_mpdu_start_offset;
++	u16 rx_msdu_end_offset;
++	u16 rx_msdu_start_offset;
++	u16 rx_attn_offset;
+ };
+ 
+ #define HTT_RX_FULL_MON_MODE_CFG_CMD_INFO0_MSG_TYPE	GENMASK(7, 0)
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -70,6 +70,12 @@ static inline bool ath11k_dp_rx_h_mpdu_s
+ 	return ab->hw_params.hw_ops->rx_desc_get_mpdu_fc_valid(desc);
+ }
+ 
++static u16 ath11k_dp_rxdesc_get_mpdu_frame_ctrl(struct ath11k_base *ab,
++						struct hal_rx_desc *desc)
++{
++	return ab->hw_params.hw_ops->rx_desc_get_mpdu_frame_ctl(desc);
++}
++
+ static inline bool ath11k_dp_rx_h_mpdu_start_more_frags(struct ath11k_base *ab,
+ 							struct sk_buff *skb)
+ {
+@@ -306,6 +312,35 @@ static u8 *ath11k_dp_rxdesc_mpdu_start_a
+ 	return ab->hw_params.hw_ops->rx_desc_mpdu_start_addr2(desc);
+ }
+ 
++#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
++static void ath11k_dp_get_rx_header_offset(struct ath11k_base *ab,
++					   struct htt_rx_ring_tlv_filter *tlv_filter)
++{
++	ab->hw_params.hw_ops->rx_desc_get_offset(tlv_filter);
++}
++#endif
++
++static bool ath11k_dp_rx_desc_dot11_hdr_fields_valid(struct ath11k_base *ab,
++						     struct hal_rx_desc *desc)
++{
++	return ab->hw_params.hw_ops->rx_desc_dot11_hdr_fields_valid(desc);
++}
++
++static void ath11k_dp_rx_desc_get_dot11_hdr(struct ath11k_base *ab,
++					    struct hal_rx_desc *desc,
++					    struct ieee80211_hdr *hdr)
++{
++	ab->hw_params.hw_ops->rx_desc_get_dot11_hdr(desc, hdr);
++}
++
++static void ath11k_dp_rx_desc_get_crypto_header(struct ath11k_base *ab,
++						struct hal_rx_desc *desc,
++						u8 *crypto_hdr,
++						enum hal_encrypt_type enctype)
++{
++	ab->hw_params.hw_ops->rx_desc_get_crypto_header(desc, crypto_hdr, enctype);
++}
++
+ static void ath11k_dp_service_mon_ring(struct timer_list *t)
+ {
+ 	struct ath11k_base *ab = from_timer(ab, t, mon_reap_timer);
+@@ -1976,6 +2011,49 @@ int ath11k_dp_rx_crypto_icv_len(struct a
+ 	return 0;
+ }
+ 
++static void ath11k_get_dot11_hdr_from_rx_desc(struct ath11k *ar,
++					      struct sk_buff *msdu,
++					      struct ath11k_skb_rxcb *rxcb,
++					      struct ieee80211_rx_status *status,
++					      enum hal_encrypt_type enctype)
++{
++	struct hal_rx_desc *rx_desc = rxcb->rx_desc;
++	struct ath11k_base *ab = ar->ab;
++	size_t hdr_len, crypto_len;
++	struct ieee80211_hdr *hdr;
++	u16 fc, qos_ctl = 0;
++	u8 *crypto_hdr;
++
++	if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
++		crypto_len = ath11k_dp_rx_crypto_param_len(ar, enctype);
++		crypto_hdr = skb_push(msdu, crypto_len);
++		ath11k_dp_rx_desc_get_crypto_header(ab, rx_desc, crypto_hdr, enctype);
++	}
++
++	fc = ath11k_dp_rxdesc_get_mpdu_frame_ctrl(ab, rx_desc);
++	hdr_len = ieee80211_hdrlen(fc);
++	skb_push(msdu, hdr_len);
++	hdr = (struct ieee80211_hdr *)msdu->data;
++	hdr->frame_control = fc;
++
++	/* Get wifi header from rx_desc */
++	ath11k_dp_rx_desc_get_dot11_hdr(ab, rx_desc, hdr);
++
++	if (rxcb->is_mcbc)
++		status->flag &= ~RX_FLAG_PN_VALIDATED;
++
++	/* Add QOS header */
++	if (ieee80211_is_data_qos(hdr->frame_control)) {
++		qos_ctl = rxcb->tid;
++		if (ath11k_dp_rx_h_msdu_start_mesh_ctl_present(ab, rx_desc))
++			qos_ctl |= IEEE80211_QOS_CTL_MESH_CONTROL_PRESENT;
++
++		/* TODO Add other QoS ctl fields when required */
++		memcpy(msdu->data + (hdr_len - IEEE80211_QOS_CTL_LEN),
++		       &qos_ctl, IEEE80211_QOS_CTL_LEN);
++	}
++}
++
+ static void ath11k_dp_rx_h_undecap_nwifi(struct ath11k *ar,
+ 					 struct sk_buff *msdu,
+ 					 u8 *first_hdr,
+@@ -1989,7 +2067,8 @@ static void ath11k_dp_rx_h_undecap_nwifi
+ 	u8 da[ETH_ALEN];
+ 	u8 sa[ETH_ALEN];
+ 	u16 qos_ctl = 0;
+-	u8 *qos;
++	u8 *qos, *crypto_hdr;
++	bool add_qos_ctrl = false;
+ 
+ 	/* copy SA & DA and pull decapped header */
+ 	hdr = (struct ieee80211_hdr *)msdu->data;
+@@ -1998,7 +2077,7 @@ static void ath11k_dp_rx_h_undecap_nwifi
+ 	ether_addr_copy(sa, ieee80211_get_SA(hdr));
+ 	skb_pull(msdu, ieee80211_hdrlen(hdr->frame_control));
+ 
+-	if (rxcb->is_first_msdu) {
++	if (rxcb->is_first_msdu && first_hdr) {
+ 		/* original 802.11 header is valid for the first msdu
+ 		 * hence we can reuse the same header
+ 		 */
+@@ -2028,16 +2107,23 @@ static void ath11k_dp_rx_h_undecap_nwifi
+ 
+ 		/* copy decap header before overwriting for reuse below */
+ 		memcpy(decap_hdr, (uint8_t *)hdr, hdr_len);
++		add_qos_ctrl = true;
+ 	}
+ 
+ 	if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
+-		memcpy(skb_push(msdu,
+-				ath11k_dp_rx_crypto_param_len(ar, enctype)),
+-		       (void *)hdr + hdr_len,
+-		       ath11k_dp_rx_crypto_param_len(ar, enctype));
++		if (first_hdr) {
++			memcpy(skb_push(msdu,
++					ath11k_dp_rx_crypto_param_len(ar, enctype)),
++					(void *)hdr + hdr_len,
++					ath11k_dp_rx_crypto_param_len(ar, enctype));
++		} else {
++			crypto_hdr = skb_push(msdu, ath11k_dp_rx_crypto_param_len(ar, enctype));
++			ath11k_dp_rx_desc_get_crypto_header(ar->ab,
++							    rxcb->rx_desc, crypto_hdr, enctype);
++		}
+ 	}
+ 
+-	if (!rxcb->is_first_msdu) {
++	if (!rxcb->is_first_msdu || add_qos_ctrl) {
+ 		memcpy(skb_push(msdu,
+ 				IEEE80211_QOS_CTL_LEN), &qos_ctl,
+ 				IEEE80211_QOS_CTL_LEN);
+@@ -2153,6 +2239,20 @@ static void ath11k_dp_rx_h_undecap_eth(s
+ 	u8 da[ETH_ALEN];
+ 	u8 sa[ETH_ALEN];
+ 	void *rfc1042;
++	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
++	struct ath11k_dp_rfc1042_hdr rfc = {0xaa, 0xaa, 0x03, {0x00, 0x00, 0x00}};
++
++	if (!first_hdr) {
++		eth = (struct ethhdr *)msdu->data;
++		ether_addr_copy(da, eth->h_dest);
++		ether_addr_copy(sa, eth->h_source);
++		rfc.snap_type = eth->h_proto;
++		skb_pull(msdu, sizeof(struct ethhdr));
++		memcpy(skb_push(msdu, sizeof(struct ath11k_dp_rfc1042_hdr)), &rfc,
++		       sizeof(struct ath11k_dp_rfc1042_hdr));
++		ath11k_get_dot11_hdr_from_rx_desc(ar, msdu, rxcb, status, enctype);
++		goto exit;
++	}
+ 
+ 	rfc1042 = ath11k_dp_rx_h_find_rfc1042(ar, msdu, enctype);
+ 	if (WARN_ON_ONCE(!rfc1042))
+@@ -2181,6 +2281,7 @@ static void ath11k_dp_rx_h_undecap_eth(s
+ 
+ 	memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
+ 
++exit:
+ 	/* original 802.11 header has a different DA and in
+ 	 * case of 4addr it may also have different SA
+ 	 */
+@@ -2199,6 +2300,7 @@ static void ath11k_dp_rx_h_undecap_snap(
+ 	size_t hdr_len;
+ 	u8 l3_pad_bytes;
+ 	struct hal_rx_desc *rx_desc;
++	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
+ 
+ 	/* Delivered decapped frame:
+ 	 * [amsdu header] <-- replaced with 802.11 hdr
+@@ -2212,6 +2314,11 @@ static void ath11k_dp_rx_h_undecap_snap(
+ 	skb_put(msdu, l3_pad_bytes);
+ 	skb_pull(msdu, sizeof(struct ath11k_dp_amsdu_subframe_hdr) + l3_pad_bytes);
+ 
++	if (!first_hdr) {
++		ath11k_get_dot11_hdr_from_rx_desc(ar, msdu, rxcb, status, enctype);
++		return;
++	}
++
+ 	hdr = (struct ieee80211_hdr *)first_hdr;
+ 	hdr_len = ieee80211_hdrlen(hdr->frame_control);
+ 
+@@ -2608,6 +2715,20 @@ static int ath11k_dp_rx_process_msdu(str
+ 		goto free_out;
+ 	}
+ 
++	hdr_status = ath11k_dp_rx_h_80211_hdr(ab, rx_desc);
++	/* wifi hdr fields validation for 512M::
++	 * Mcast packets in ethernet frame mode
++	 * will need wifi hdr in msdu to validate PN.
++	 * Header will be added in undecap routine.
++	 * Validation on wifi hdr fields from rx_desc.
++	 */
++	if (!hdr_status && ath11k_dp_rx_h_attn_is_mcbc(ab, rx_desc) &&
++	    !ath11k_dp_rx_desc_dot11_hdr_fields_valid(ab, rx_desc)) {
++		ath11k_warn(ab, "One or more invalid dot11 header fields\n");
++		ret = -EIO;
++		goto free_out;
++	}
++
+ 	rxcb = ATH11K_SKB_RXCB(msdu);
+ 	rxcb->rx_desc = rx_desc;
+ 	msdu_len = ath11k_dp_rx_h_msdu_start_msdu_len(ab, rx_desc);
+@@ -2620,8 +2741,9 @@ static int ath11k_dp_rx_process_msdu(str
+ 			hdr_status = ath11k_dp_rx_h_80211_hdr(ab, rx_desc);
+ 			ret = -EINVAL;
+ 			ath11k_warn(ab, "invalid msdu len %u\n", msdu_len);
+-			ath11k_dbg_dump(ab, ATH11K_DBG_DATA, NULL, "", hdr_status,
+-					sizeof(struct ieee80211_hdr));
++			if (hdr_status)
++				ath11k_dbg_dump(ab, ATH11K_DBG_DATA, NULL, "", hdr_status,
++						sizeof(struct ieee80211_hdr));
+ 			ath11k_dbg_dump(ab, ATH11K_DBG_DATA, NULL, "", rx_desc,
+ 					sizeof(struct hal_rx_desc));
+ 			goto free_out;
+@@ -3283,6 +3405,7 @@ static int ath11k_dp_rx_h_verify_tkip_mi
+ 
+ 	hdr = (struct ieee80211_hdr *)(msdu->data + hal_rx_desc_sz);
+ 	hdr_len = ieee80211_hdrlen(hdr->frame_control);
++
+ 	head_len = hdr_len + hal_rx_desc_sz + IEEE80211_TKIP_IV_LEN;
+ 	tail_len = IEEE80211_CCMP_MIC_LEN + IEEE80211_TKIP_ICV_LEN + FCS_LEN;
+ 
+@@ -3563,8 +3686,8 @@ static void ath11k_dp_rx_h_sort_frags(st
+ 
+ static u64 ath11k_dp_rx_h_get_pn(struct ath11k *ar, struct sk_buff *skb)
+ {
+-	struct ieee80211_hdr *hdr;
+ 	u64 pn = 0;
++	struct ieee80211_hdr *hdr;
+ 	u8 *ehdr;
+ 	u32 hal_rx_desc_sz = ar->ab->hw_params.hal_desc_sz;
+ 
+@@ -3794,8 +3917,9 @@ ath11k_dp_process_rx_err_buf(struct ath1
+ 	if ((msdu_len + hal_rx_desc_sz) > DP_RX_BUFFER_SIZE) {
+ 		hdr_status = ath11k_dp_rx_h_80211_hdr(ar->ab, rx_desc);
+ 		ath11k_warn(ar->ab, "invalid msdu leng %u", msdu_len);
+-		ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "", hdr_status,
+-				sizeof(struct ieee80211_hdr));
++		if (hdr_status)
++			ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "", hdr_status,
++					sizeof(struct ieee80211_hdr));
+ 		ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "", rx_desc,
+ 				sizeof(struct hal_rx_desc));
+ 		dev_kfree_skb_any(msdu);
+@@ -4418,6 +4542,47 @@ void ath11k_dp_rx_pdev_free(struct ath11
+ 	ath11k_dp_rxdma_pdev_buf_free(ar);
+ }
+ 
++#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
++static int ath11k_dp_rxdma_ring_sel_config(struct ath11k *ar)
++{
++	struct ath11k_pdev_dp *dp = &ar->dp;
++	struct htt_rx_ring_tlv_filter tlv_filter = {0};
++	u32 ring_id;
++	int ret;
++	u32 hal_rx_desc_sz = ar->ab->hw_params.hal_desc_sz;
++
++	ring_id = dp->rx_refill_buf_ring.refill_buf_ring.ring_id;
++
++	tlv_filter.rx_filter = HTT_RX_RXDMA_FILTER_TLV_FLAGS_BUF_RING;
++	tlv_filter.pkt_filter_flags2 = HTT_RX_FP_CTRL_PKT_FILTER_TLV_FLAGS2_BAR;
++	tlv_filter.pkt_filter_flags3 = HTT_RX_FP_DATA_PKT_FILTER_TLV_FLASG3_MCAST |
++					HTT_RX_FP_DATA_PKT_FILTER_TLV_FLASG3_UCAST;
++	tlv_filter.offset_valid = true;
++	tlv_filter.rx_packet_offset = hal_rx_desc_sz;
++	tlv_filter.rx_header_offset = 0;
++
++	ath11k_dp_get_rx_header_offset(ar->ab, &tlv_filter);
++
++	if (!ar->ab->nss.enabled)
++		ret = ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id, dp->mac_id,
++						       HAL_RXDMA_BUF,
++						       DP_RXDMA_REFILL_RING_SIZE,
++						       &tlv_filter);
++	else
++		ret = ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id, dp->mac_id,
++						       HAL_RXDMA_BUF,
++						       DP_RXDMA_NSS_REFILL_RING_SIZE,
++						       &tlv_filter);
++
++	return ret;
++}
++#else
++static int ath11k_dp_rxdma_ring_sel_config(struct ath11k *ar)
++{
++	return 0;
++}
++#endif
++
+ int ath11k_dp_rx_pdev_alloc(struct ath11k_base *ab, int mac_id)
+ {
+ 	struct ath11k *ar = ab->pdevs[mac_id].ar;
+@@ -4511,6 +4676,12 @@ config_refill_ring:
+ 		}
+ 	}
+ 
++	ret = ath11k_dp_rxdma_ring_sel_config(ar);
++	if (ret) {
++		ath11k_warn(ab, "failed to setup rxdma ring selection config\n");
++		return ret;
++	}
++
+ 	return 0;
+ }
+ 
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -1127,6 +1127,8 @@ int ath11k_dp_tx_htt_rx_filter_setup(str
+ 				 !!(params.flags & HAL_SRNG_FLAGS_MSI_SWAP));
+ 	cmd->info0 |= FIELD_PREP(HTT_RX_RING_SELECTION_CFG_CMD_INFO0_PS,
+ 				 !!(params.flags & HAL_SRNG_FLAGS_DATA_TLV_SWAP));
++	cmd->info0 |= FIELD_PREP(HTT_RX_RING_SELECTION_CFG_CMD_OFFSET_VALID,
++				tlv_filter->offset_valid);
+ 
+ 	cmd->info1 = FIELD_PREP(HTT_RX_RING_SELECTION_CFG_CMD_INFO1_BUF_SIZE,
+ 				rx_buf_size);
+@@ -1136,6 +1138,26 @@ int ath11k_dp_tx_htt_rx_filter_setup(str
+ 	cmd->pkt_type_en_flags3 = tlv_filter->pkt_filter_flags3;
+ 	cmd->rx_filter_tlv = tlv_filter->rx_filter;
+ 
++	if (tlv_filter->offset_valid) {
++		cmd->rx_packet_offset = FIELD_PREP(HTT_RX_RING_SELECTION_CFG_RX_PACKET_OFFSET,
++						   tlv_filter->rx_packet_offset);
++		cmd->rx_packet_offset |= FIELD_PREP(HTT_RX_RING_SELECTION_CFG_RX_HEADER_OFFSET,
++						    tlv_filter->rx_header_offset);
++
++		cmd->rx_mpdu_offset = FIELD_PREP(HTT_RX_RING_SELECTION_CFG_RX_MPDU_END_OFFSET,
++						 tlv_filter->rx_mpdu_end_offset);
++		cmd->rx_mpdu_offset |= FIELD_PREP(HTT_RX_RING_SELECTION_CFG_RX_MPDU_START_OFFSET,
++						  tlv_filter->rx_mpdu_start_offset);
++
++		cmd->rx_msdu_offset = FIELD_PREP(HTT_RX_RING_SELECTION_CFG_RX_MSDU_END_OFFSET,
++						 tlv_filter->rx_msdu_end_offset);
++		cmd->rx_msdu_offset |= FIELD_PREP(HTT_RX_RING_SELECTION_CFG_RX_MSDU_START_OFFSET,
++						  tlv_filter->rx_msdu_start_offset);
++
++		cmd->rx_attn_offset = FIELD_PREP(HTT_RX_RING_SELECTION_CFG_RX_ATTENTION_OFFSET,
++						 tlv_filter->rx_attn_offset);
++	}
++
+ 	ret = ath11k_htc_send(&ab->htc, ab->dp.eid, skb);
+ 	if (ret)
+ 		goto err_free;
+@@ -1214,6 +1236,7 @@ int ath11k_dp_tx_htt_monitor_mode_ring_c
+ 	}
+ 
+ 	ring_id = dp->rxdma_mon_buf_ring.refill_buf_ring.ring_id;
++	tlv_filter.offset_valid = false;
+ 
+ 	if (!reset) {
+ 		tlv_filter.rx_filter = HTT_RX_MON_FILTER_TLV_FLAGS_MON_BUF_RING;
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -260,7 +260,11 @@ static u8 ath11k_hw_ipq8074_rx_desc_get_
+ 
+ static u8 *ath11k_hw_ipq8074_rx_desc_get_hdr_status(struct hal_rx_desc *desc)
+ {
++#ifndef CPTCFG_ATH11K_MEM_PROFILE_512M
+ 	return desc->u.ipq8074.hdr_status;
++#else
++	return NULL;
++#endif
+ }
+ 
+ static bool ath11k_hw_ipq8074_rx_desc_encrypt_valid(struct hal_rx_desc *desc)
+@@ -395,26 +399,132 @@ static void ath11k_hw_ipq8074_rx_desc_se
+ 	desc->u.ipq8074.msdu_start.info1 = __cpu_to_le32(info);
+ }
+ 
++static
++struct rx_attention *ath11k_hw_ipq8074_rx_desc_get_attention(struct hal_rx_desc *desc)
++{
++	return &desc->u.ipq8074.attention;
++}
++
++static u8 *ath11k_hw_ipq8074_rx_desc_get_msdu_payload(struct hal_rx_desc *desc)
++{
++	return &desc->u.ipq8074.msdu_payload[0];
++}
++
++#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
++static void ath11k_hw_ipq8074_rx_desc_get_offset(struct htt_rx_ring_tlv_filter *tlv_filter)
++{
++	tlv_filter->rx_mpdu_end_offset = __le16_to_cpu(offsetof
++			(struct hal_rx_desc_ipq8074, mpdu_end_tag));
++	tlv_filter->rx_mpdu_start_offset = __le16_to_cpu(offsetof
++			(struct hal_rx_desc_ipq8074, mpdu_start_tag));
++	tlv_filter->rx_msdu_end_offset = __le16_to_cpu(offsetof
++			(struct hal_rx_desc_ipq8074, msdu_end_tag));
++	tlv_filter->rx_msdu_start_offset = __le16_to_cpu(offsetof
++			(struct hal_rx_desc_ipq8074, msdu_start_tag));
++	tlv_filter->rx_attn_offset = __le16_to_cpu(offsetof
++			(struct hal_rx_desc_ipq8074, rx_attn_tag));
++}
++#endif
++
++static u16 ath11k_hw_ipq8074_rx_desc_get_mpdu_frame_ctl(struct hal_rx_desc *desc)
++{
++	return __le16_to_cpu(desc->u.ipq8074.mpdu_start.frame_ctrl);
++}
++
+ static bool ath11k_hw_ipq8074_rx_desc_mac_addr2_valid(struct hal_rx_desc *desc)
+ {
+ 	return __le32_to_cpu(desc->u.ipq8074.mpdu_start.info1) &
+ 	       RX_MPDU_START_INFO1_MAC_ADDR2_VALID;
+ }
+ 
+-static u8 *ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2(struct hal_rx_desc *desc)
++static u8* ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2(struct hal_rx_desc *desc)
+ {
+ 	return desc->u.ipq8074.mpdu_start.addr2;
+ }
+ 
+-static
+-struct rx_attention *ath11k_hw_ipq8074_rx_desc_get_attention(struct hal_rx_desc *desc)
++static bool ath11k_hw_ipq8074_rx_desc_dot11_hdr_fields_valid(struct hal_rx_desc *desc)
+ {
+-	return &desc->u.ipq8074.attention;
++	if ((ath11k_hw_ipq8074_rx_desc_get_mpdu_seq_ctl_vld(desc) &&
++	     ath11k_hw_ipq8074_rx_desc_get_mpdu_fc_valid(desc) &&
++	     __le32_to_cpu(desc->u.ipq8074.mpdu_start.info1) &
++			   RX_MPDU_START_INFO1_MAC_ADDR1_VALID &&
++	     ath11k_hw_ipq8074_rx_desc_mac_addr2_valid(desc) &&
++	     __le32_to_cpu(desc->u.ipq8074.mpdu_start.info1) &
++			   RX_MPDU_START_INFO1_MAC_ADDR3_VALID &&
++	     FIELD_GET((RX_MPDU_START_INFO1_MPDU_DUR_VALID),
++			__le32_to_cpu(desc->u.ipq8074.mpdu_start.info1)))) {
++		return true;
++	}
++	return false;
++}
++
++static void ath11k_hw_ipq8074_rx_desc_get_dot11_hdr(struct hal_rx_desc *desc,
++						    struct ieee80211_hdr *hdr)
++{
++	hdr->frame_control = __le16_to_cpu(desc->u.ipq8074.mpdu_start.frame_ctrl);
++	hdr->duration_id = __le16_to_cpu(desc->u.ipq8074.mpdu_start.duration);
++	ether_addr_copy(hdr->addr1, desc->u.ipq8074.mpdu_start.addr1);
++	ether_addr_copy(hdr->addr2, desc->u.ipq8074.mpdu_start.addr2);
++	ether_addr_copy(hdr->addr3, desc->u.ipq8074.mpdu_start.addr3);
++	if (__le32_to_cpu(desc->u.ipq8074.mpdu_start.info1) &
++			RX_MPDU_START_INFO1_MAC_ADDR4_VALID) {
++		ether_addr_copy(hdr->addr4, desc->u.ipq8074.mpdu_start.addr4);
++	}
++	hdr->seq_ctrl = __le16_to_cpu(desc->u.ipq8074.mpdu_start.seq_ctrl);
++}
++
++static void ath11k_hw_ipq8074_rx_desc_get_crypto_hdr(struct hal_rx_desc *desc,
++						     u8 *crypto_hdr,
++						     enum hal_encrypt_type enctype)
++{
++	unsigned int key_id;
++
++	switch (enctype) {
++	case HAL_ENCRYPT_TYPE_OPEN:
++		return;
++	case HAL_ENCRYPT_TYPE_TKIP_NO_MIC:
++	case HAL_ENCRYPT_TYPE_TKIP_MIC:
++		crypto_hdr[0] =
++			HAL_RX_MPDU_INFO_PN_GET_BYTE2(desc->u.ipq8074.mpdu_start.pn[0]);
++		crypto_hdr[1] = 0;
++		crypto_hdr[2] =
++			HAL_RX_MPDU_INFO_PN_GET_BYTE1(desc->u.ipq8074.mpdu_start.pn[0]);
++		break;
++	case HAL_ENCRYPT_TYPE_CCMP_128:
++	case HAL_ENCRYPT_TYPE_CCMP_256:
++	case HAL_ENCRYPT_TYPE_GCMP_128:
++	case HAL_ENCRYPT_TYPE_AES_GCMP_256:
++		crypto_hdr[0] =
++			HAL_RX_MPDU_INFO_PN_GET_BYTE1(desc->u.ipq8074.mpdu_start.pn[0]);
++		crypto_hdr[1] =
++			HAL_RX_MPDU_INFO_PN_GET_BYTE2(desc->u.ipq8074.mpdu_start.pn[0]);
++		crypto_hdr[2] = 0;
++		break;
++	case HAL_ENCRYPT_TYPE_WEP_40:
++	case HAL_ENCRYPT_TYPE_WEP_104:
++	case HAL_ENCRYPT_TYPE_WEP_128:
++	case HAL_ENCRYPT_TYPE_WAPI_GCM_SM4:
++	case HAL_ENCRYPT_TYPE_WAPI:
++		return;
++	}
++	key_id        = FIELD_GET(RX_MPDU_START_INFO5_KEY_ID,
++				  __le32_to_cpu(desc->u.ipq8074.mpdu_start.info5));
++	crypto_hdr[3] = 0x20 | (key_id << 6);
++	crypto_hdr[4] = HAL_RX_MPDU_INFO_PN_GET_BYTE3(desc->u.ipq8074.mpdu_start.pn[0]);
++	crypto_hdr[5] = HAL_RX_MPDU_INFO_PN_GET_BYTE4(desc->u.ipq8074.mpdu_start.pn[0]);
++	crypto_hdr[6] = HAL_RX_MPDU_INFO_PN_GET_BYTE1(desc->u.ipq8074.mpdu_start.pn[1]);
++	crypto_hdr[7] = HAL_RX_MPDU_INFO_PN_GET_BYTE2(desc->u.ipq8074.mpdu_start.pn[1]);
+ }
+ 
+-static u8 *ath11k_hw_ipq8074_rx_desc_get_msdu_payload(struct hal_rx_desc *desc)
++static bool ath11k_hw_qcn9074_rx_desc_mac_addr2_valid(struct hal_rx_desc *desc)
+ {
+-	return &desc->u.ipq8074.msdu_payload[0];
++        return __le32_to_cpu(desc->u.qcn9074.mpdu_start.info11) &
++	       RX_MPDU_START_INFO11_MAC_ADDR2_VALID;
++}
++
++static u8* ath11k_hw_qcn9074_rx_desc_mpdu_start_addr2(struct hal_rx_desc *desc)
++{
++        return desc->u.qcn9074.mpdu_start.addr2;
+ }
+ 
+ static bool ath11k_hw_qcn9074_rx_desc_get_first_msdu(struct hal_rx_desc *desc)
+@@ -437,7 +547,11 @@ static u8 ath11k_hw_qcn9074_rx_desc_get_
+ 
+ static u8 *ath11k_hw_qcn9074_rx_desc_get_hdr_status(struct hal_rx_desc *desc)
+ {
++#ifndef CPTCFG_ATH11K_MEM_PROFILE_512M
+ 	return desc->u.qcn9074.hdr_status;
++#else
++	return NULL;
++#endif
+ }
+ 
+ static bool ath11k_hw_qcn9074_rx_desc_encrypt_valid(struct hal_rx_desc *desc)
+@@ -614,7 +728,11 @@ static u8 ath11k_hw_wcn6855_rx_desc_get_
+ 
+ static u8 *ath11k_hw_wcn6855_rx_desc_get_hdr_status(struct hal_rx_desc *desc)
+ {
++#ifndef CPTCFG_ATH11K_MEM_PROFILE_512M
+ 	return desc->u.wcn6855.hdr_status;
++#else
++	return NULL;
++#endif
+ }
+ 
+ static bool ath11k_hw_wcn6855_rx_desc_encrypt_valid(struct hal_rx_desc *desc)
+@@ -956,6 +1074,13 @@ const struct ath11k_hw_ops ipq8074_ops =
+ 	.rx_desc_mac_addr2_valid = ath11k_hw_ipq8074_rx_desc_mac_addr2_valid,
+ 	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2,
+ 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
++#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
++	.rx_desc_get_offset = ath11k_hw_ipq8074_rx_desc_get_offset,
++#endif
++	.rx_desc_get_mpdu_frame_ctl = ath11k_hw_ipq8074_rx_desc_get_mpdu_frame_ctl,
++	.rx_desc_dot11_hdr_fields_valid = ath11k_hw_ipq8074_rx_desc_dot11_hdr_fields_valid,
++	.rx_desc_get_dot11_hdr = ath11k_hw_ipq8074_rx_desc_get_dot11_hdr,
++	.rx_desc_get_crypto_header = ath11k_hw_ipq8074_rx_desc_get_crypto_hdr,
+ };
+ 
+ const struct ath11k_hw_ops ipq6018_ops = {
+@@ -1043,6 +1168,8 @@ const struct ath11k_hw_ops qcn9074_ops =
+ 	.wmi_init_config = ath11k_init_wmi_config_ipq8074,
+ 	.mac_id_to_pdev_id = ath11k_hw_mac_id_to_pdev_id_ipq8074,
+ 	.mac_id_to_srng_id = ath11k_hw_mac_id_to_srng_id_ipq8074,
++	.rx_desc_mac_addr2_valid = ath11k_hw_qcn9074_rx_desc_mac_addr2_valid,
++	.rx_desc_mpdu_start_addr2 = ath11k_hw_qcn9074_rx_desc_mpdu_start_addr2,
+ 	.tx_mesh_enable = ath11k_hw_qcn9074_tx_mesh_enable,
+ 	.rx_desc_get_first_msdu = ath11k_hw_qcn9074_rx_desc_get_first_msdu,
+ 	.rx_desc_get_last_msdu = ath11k_hw_qcn9074_rx_desc_get_last_msdu,
+@@ -1073,8 +1200,6 @@ const struct ath11k_hw_ops qcn9074_ops =
+ 	.rx_desc_get_msdu_payload = ath11k_hw_qcn9074_rx_desc_get_msdu_payload,
+ 	.reo_setup = ath11k_hw_ipq8074_reo_setup,
+ 	.mpdu_info_get_peerid = ath11k_hw_qcn9074_mpdu_info_get_peerid,
+-	.rx_desc_mac_addr2_valid = ath11k_hw_ipq9074_rx_desc_mac_addr2_valid,
+-	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq9074_rx_desc_mpdu_start_addr2,
+ 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
+ };
+ 
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -22,6 +22,11 @@
+ #define ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE	512
+ #define ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE	128
+ #define ATH11K_DP_RXDMA_MONITOR_DST_RING_SIZE	128
++#define ATH11K_DP_RXDMA_REFILL_RING_SIZE	2048
++/* 256b desc TLV + 4b(rounded) Pad + 30byte max nwifi header +
++ * 18byte mesh hdr + 8byte snap + 1500 eth payload
++ */
++#define ATH11K_DP_RXDMA_NSS_REFILL_RING_SIZE	1816
+ #else
+ /* Num VDEVS per radio */
+ #define TARGET_NUM_VDEVS(ab)	(ab->hw_params.num_vdevs)
+@@ -34,6 +39,8 @@
+ #define ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE	1024
+ #define ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE	4096
+ #define ATH11K_DP_RXDMA_MONITOR_DST_RING_SIZE	2048
++#define ATH11K_DP_RXDMA_REFILL_RING_SIZE	2048
++#define ATH11K_DP_RXDMA_NSS_REFILL_RING_SIZE	2048
+ #endif
+ 
+ /* Num of peers for Single Radio mode */
+@@ -129,6 +136,8 @@ enum ath11k_bus {
+ 
+ struct hal_rx_desc;
+ struct hal_tcl_data_cmd;
++struct htt_rx_ring_tlv_filter;
++enum hal_encrypt_type;
+ 
+ struct ath11k_hw_ring_mask {
+ 	u8 tx[ATH11K_EXT_IRQ_GRP_NUM_MAX];
+@@ -218,6 +227,7 @@ struct ath11k_hw_params {
+ 	const struct ath11k_hw_hal_params *hal_params;
+ 	bool supports_dynamic_smps_6ghz;
+ 	bool alloc_cacheable_memory;
++	u8 reo_dest_ring_map_shift;
+ 	bool supports_rssi_stats;
+ 	bool fw_wmi_diag_event;
+ 	bool current_cc_support;
+@@ -285,6 +295,16 @@ struct ath11k_hw_ops {
+ 	bool (*rx_desc_mac_addr2_valid)(struct hal_rx_desc *desc);
+ 	u8* (*rx_desc_mpdu_start_addr2)(struct hal_rx_desc *desc);
+ 	u32 (*get_ring_selector)(struct sk_buff *skb);
++#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
++	void (*rx_desc_get_offset)(struct htt_rx_ring_tlv_filter *tlv_filter);
++#endif
++	u16 (*rx_desc_get_mpdu_frame_ctl)(struct hal_rx_desc *desc);
++	bool (*rx_desc_dot11_hdr_fields_valid)(struct hal_rx_desc *desc);
++	void (*rx_desc_get_dot11_hdr)(struct hal_rx_desc *desc,
++				      struct ieee80211_hdr *hdr);
++	void (*rx_desc_get_crypto_header)(struct hal_rx_desc *desc,
++					  u8 *crypto_hdr,
++					  enum hal_encrypt_type enctype);
+ };
+ 
+ extern const struct ath11k_hw_ops ipq8074_ops;
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -3421,7 +3421,7 @@ static int ath11k_mac_config_obss_pd(str
+ 
+ static void ath11k_mac_op_nss_bss_info_changed(struct ieee80211_hw *hw,
+ 					   struct ieee80211_vif *vif,
+-					   u32 changed)
++					   u64 changed)
+ {
+ 	struct ath11k *ar = hw->priv;
+ 	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
+@@ -6340,6 +6340,7 @@ static int ath11k_mac_config_mon_status_
+ 			tlv_filter.rx_filter = ath11k_debugfs_rx_filter(ar);
+ 	}
+ 
++	tlv_filter.offset_valid = false;
+ 	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
+ 		ring_id = ar->dp.rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
+ 		ret = ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id,
+@@ -9716,8 +9717,6 @@ static int __ath11k_mac_register(struct
+ 		wiphy_ext_feature_set(ar->hw->wiphy,
+ 				      NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
+ 
+-	wiphy_ext_feature_set(ar->hw->wiphy, NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
+-
+ 	ar->hw->queues = ATH11K_HW_MAX_QUEUES;
+ 	ar->hw->wiphy->tx_queue_len = ATH11K_QUEUE_LEN;
+ 	ar->hw->offchannel_tx_hw_queue = ATH11K_HW_MAX_QUEUES - 1;
+--- a/drivers/net/wireless/ath/ath11k/rx_desc.h
++++ b/drivers/net/wireless/ath/ath11k/rx_desc.h
+@@ -1442,9 +1442,11 @@ struct hal_rx_desc_ipq8074 {
+ 	__le32 mpdu_end_tag;
+ 	struct rx_mpdu_end mpdu_end;
+ 	u8 rx_padding1[HAL_RX_DESC_PADDING1_BYTES];
++#ifndef CPTCFG_ATH11K_MEM_PROFILE_512M
+ 	__le32 hdr_status_tag;
+ 	__le32 phy_ppdu_id;
+ 	u8 hdr_status[HAL_RX_DESC_HDR_STATUS_LEN];
++#endif
+ 	u8 msdu_payload[];
+ } __packed;
+ 
+@@ -1461,9 +1463,11 @@ struct hal_rx_desc_qcn9074 {
+ 	__le32 mpdu_end_tag;
+ 	struct rx_mpdu_end mpdu_end;
+ 	u8 rx_padding1[HAL_RX_DESC_PADDING1_BYTES];
++#ifndef CPTCFG_ATH11K_MEM_PROFILE_512M
+ 	__le32 hdr_status_tag;
+ 	__le32 phy_ppdu_id;
+ 	u8 hdr_status[HAL_RX_DESC_HDR_STATUS_LEN];
++#endif
+ 	u8 msdu_payload[];
+ } __packed;
+ 
+@@ -1480,9 +1484,11 @@ struct hal_rx_desc_wcn6855 {
+ 	__le32 mpdu_end_tag;
+ 	struct rx_mpdu_end mpdu_end;
+ 	u8 rx_padding1[HAL_RX_DESC_PADDING1_BYTES];
++#ifndef CPTCFG_ATH11K_MEM_PROFILE_512M
+ 	__le32 hdr_status_tag;
+ 	__le32 phy_ppdu_id;
+ 	u8 hdr_status[HAL_RX_DESC_HDR_STATUS_LEN];
++#endif
+ 	u8 msdu_payload[];
+ } __packed;
+ 
+@@ -1502,4 +1508,17 @@ struct hal_rx_desc {
+ #define RU_484 18
+ #define RU_996 37
+ 
++#define HAL_RX_MPDU_INFO_PN_GET_BYTE1(__val) \
++	FIELD_GET(GENMASK(7, 0), __le32_to_cpu(__val))
++
++#define HAL_RX_MPDU_INFO_PN_GET_BYTE2(__val) \
++	FIELD_GET(GENMASK(15, 8), __le32_to_cpu(__val))
++
++#define HAL_RX_MPDU_INFO_PN_GET_BYTE3(__val) \
++	FIELD_GET(GENMASK(23, 16), __le32_to_cpu(__val))
++
++#define HAL_RX_MPDU_INFO_PN_GET_BYTE4(__val) \
++	FIELD_GET(GENMASK(31, 24), __le32_to_cpu(__val))
++
++
+ #endif /* ATH11K_RX_DESC_H */
+--- a/drivers/net/wireless/ath/ath11k/nss.c
++++ b/drivers/net/wireless/ath/ath11k/nss.c
+@@ -1800,7 +1800,7 @@ static int ath11k_nss_init(struct ath11k
+ 
+ 	/* fill rx parameters to initialize rx context */
+ 	wim->wrip.tlv_size = ab->hw_params.hal_desc_sz;
+-	wim->wrip.rx_buf_len = DP_RX_BUFFER_SIZE;
++	wim->wrip.rx_buf_len = DP_RXDMA_NSS_REFILL_RING_SIZE;
+ 
+ 	/* fill hal srng message */
+ 	wim->hssm.dev_base_addr = (u32)ab->mem_pa;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/234-001-ath11k-account-tx-rx-packets-flow.patch b/package/kernel/mac80211/patches/ath11k_nss/234-001-ath11k-account-tx-rx-packets-flow.patch
new file mode 100644
index 00000000000000..08e158a407ca8f
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/234-001-ath11k-account-tx-rx-packets-flow.patch
@@ -0,0 +1,494 @@
+From d6d86c0c48c8d114e94c5b5f749c97d629d727ef Mon Sep 17 00:00:00 2001
+From: Maharaja Kennadyrajan <mkenna@codeaurora.org>
+Date: Mon, 4 Jan 2021 23:49:21 +0530
+Subject: [PATCH 1/2] ath11k/mac80211: Add support to account Tx and Rx flow
+ packets
+
+Added support to log the inflow and outflow of the Tx and Rx
+packets in netif and host driver.
+
+Command to dump the Tx pkts flow in driver:
+cat
+/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
+XX\:XX\:XX\:XX\:XX\:XX/driver_tx_pkts_flow
+
+Command to dump the Rx pkts flow in driver:
+cat
+/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
+XX\:XX\:XX\:XX\:XX\:XX/driver_rx_pkts_flow
+
+Commands to reset the Tx/Rx pkts flow in driver:
+echo 1 >
+/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
+XX\:XX\:XX\:XX\:XX\:XX/reset_tx_stats
+
+echo 1 >
+/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
+XX\:XX\:XX\:XX\:XX\:XX/reset_rx_stats
+
+Command to dump the Tx pkts flow in mac80211:
+cat
+/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
+XX\:XX\:XX\:XX\:XX\:XX/mac80211_tx_pkts_flow
+
+Command to dump the Rx pkts flow in mac80211:
+cat
+/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
+XX\:XX\:XX\:XX\:XX\:XX/mac80211_rx_pkts_flow
+
+Commands to reset the Tx/Rx pkts flow in mac80211:
+echo 1 >
+/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
+XX\:XX\:XX\:XX\:XX\:XX/reset_mac80211_tx_pkts_flow
+
+echo 1 >
+/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
+XX\:XX\:XX\:XX\:XX\:XX/reset_mac80211_rx_pkts_flow
+
+Sample output after running the Tx and Rx traffic.
+
+root@OpenWrt:/# cat sys/kernel/debug/ieee80211/phy0/netdev\:
+wlan0/stations/8c\:fd\:f0\:06\:23\:41/driver_tx_pkts_flow
+Tx packets inflow from mac80211: 20
+Tx packets outflow to HW: 20
+
+root@OpenWrt:/# cat sys/kernel/debug/ieee80211/phy0/netdev\:
+wlan0/stations/8c\:fd\:f0\:06\:23\:41/mac80211_tx_pkts_flow
+Tx packets outflow from netif: 20
+Tx packets inflow in mac80211: 20
+
+root@OpenWrt:/# cat sys/kernel/debug/ieee80211/phy0/netdev\:
+wlan0/stations/8c\:fd\:f0\:06\:23\:41/driver_rx_pkts_flow
+Rx packets inflow from HW: 28
+Rx packets outflow from driver: 28
+
+root@OpenWrt:/# cat sys/kernel/debug/ieee80211/phy0/netdev\:
+wlan0/stations/8c\:fd\:f0\:06\:23\:41/mac80211_rx_pkts_flow
+Rx packets inflow in mac80211: 28
+Rx packets inflow in netif: 26
+Rx forwarded packets in bridge: 2
+
+Signed-off-by: Maharaja Kennadyrajan <mkenna@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/core.h        |  12 ++
+ drivers/net/wireless/ath/ath11k/debugfs.h       |   2 +
+ drivers/net/wireless/ath/ath11k/debugfs_sta.c | 145 +++++++++++++++++-
+ drivers/net/wireless/ath/ath11k/dp_rx.c       |  38 +++++
+ drivers/net/wireless/ath/ath11k/mac.c         |  11 ++
+ 5 files changed, 207 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -494,6 +494,17 @@ struct ath11k_per_ppdu_tx_stats {
+ 
+ DECLARE_EWMA(avg_rssi, 10, 8)
+ 
++struct ath11k_driver_tx_pkts_flow {
++	atomic_t pkts_in;
++	atomic_t pkts_out;
++};
++
++struct ath11k_driver_rx_pkts_flow {
++	atomic_t pkts_frm_hw;
++	atomic_t pkts_out;
++	atomic_t pkts_out_to_netif;
++};
++
+ struct ath11k_sta {
+ 	struct ath11k_vif *arvif;
+ 
+@@ -527,6 +538,8 @@ struct ath11k_sta {
+ #ifdef CPTCFG_ATH11K_NSS_SUPPORT
+ 	struct ath11k_nss_sta_stats *nss_stats;
+ #endif
++	struct ath11k_driver_tx_pkts_flow drv_tx_pkts;
++	struct ath11k_driver_rx_pkts_flow drv_rx_pkts;
+ 	u16 tcl_metadata;
+ 
+ 	/* Protected with ar->data_lock */
+--- a/drivers/net/wireless/ath/ath11k/debugfs.h
++++ b/drivers/net/wireless/ath/ath11k/debugfs.h
+@@ -98,7 +98,7 @@ struct ath_pktlog_hdr {
+ };
+ 
+ #define ATH11K_HTT_PEER_STATS_RESET BIT(16)
+-
++#define ATH11K_DRV_TX_STATS_SIZE      1024
+ #define ATH11K_HTT_STATS_BUF_SIZE (1024 * 512)
+ #define ATH11K_FW_STATS_BUF_SIZE (1024 * 1024)
+ 
+--- a/drivers/net/wireless/ath/ath11k/debugfs_sta.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs_sta.c
+@@ -146,9 +146,6 @@ static ssize_t ath11k_dbg_sta_dump_tx_st
+ 	const int size = 2 * 4096;
+ 	char *buf;
+ 
+-	if (!arsta->tx_stats)
+-		return -ENOENT;
+-
+ 	buf = kzalloc(size, GFP_KERNEL);
+ 	if (!buf)
+ 		return -ENOMEM;
+@@ -156,6 +153,12 @@ static ssize_t ath11k_dbg_sta_dump_tx_st
+ 	mutex_lock(&ar->conf_mutex);
+ 
+ 	spin_lock_bh(&ar->data_lock);
++
++	if (!arsta->tx_stats) {
++		retval = -ENOENT;
++		goto end;
++	}
++
+ 	for (k = 0; k < ATH11K_STATS_TYPE_MAX; k++) {
+ 		for (j = 0; j < ATH11K_COUNTER_TYPE_MAX; j++) {
+ 			stats = &arsta->tx_stats->stats[k];
+@@ -229,6 +232,11 @@ static ssize_t ath11k_dbg_sta_dump_tx_st
+ 
+ 	mutex_unlock(&ar->conf_mutex);
+ 	return retval;
++end:
++	spin_unlock_bh(&ar->data_lock);
++	mutex_unlock(&ar->conf_mutex);
++	kfree(buf);
++	return retval;
+ }
+ 
+ static const struct file_operations fops_tx_stats = {
+@@ -847,17 +855,211 @@ static const struct file_operations fops
+ 	.llseek = default_llseek,
+ };
+ 
++static ssize_t ath11k_dbg_sta_reset_rx_stats(struct file *file,
++					     const char __user *buf,
++					     size_t count, loff_t *ppos)
++{
++	struct ieee80211_sta *sta = file->private_data;
++	struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv;
++	struct ath11k *ar = arsta->arvif->ar;
++	int ret, reset;
++
++	if (!arsta->rx_stats)
++		return -ENOENT;
++
++	ret = kstrtoint_from_user(buf, count, 0, &reset);
++	if (ret)
++		return ret;
++
++	if (!reset || reset > 1)
++		return -EINVAL;
++
++	spin_lock_bh(&ar->ab->base_lock);
++	memset(arsta->rx_stats, 0, sizeof(*arsta->rx_stats));
++	atomic_set(&arsta->drv_rx_pkts.pkts_frm_hw, 0);
++	atomic_set(&arsta->drv_rx_pkts.pkts_out, 0);
++	atomic_set(&arsta->drv_rx_pkts.pkts_out_to_netif, 0);
++	spin_unlock_bh(&ar->ab->base_lock);
++
++	ret = count;
++	return ret;
++}
++
++static const struct file_operations fops_reset_rx_stats = {
++	.write = ath11k_dbg_sta_reset_rx_stats,
++	.open = simple_open,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++};
++
++static ssize_t
++ath11k_dbg_sta_dump_driver_tx_pkts_flow(struct file *file,
++					char __user *user_buf,
++					size_t count, loff_t *ppos)
++{
++	struct ieee80211_sta *sta = file->private_data;
++	struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv;
++	struct ath11k *ar = arsta->arvif->ar;
++	int len = 0, ret_val;
++	const int size = ATH11K_DRV_TX_STATS_SIZE;
++	char *buf;
++
++	buf = kzalloc(ATH11K_DRV_TX_STATS_SIZE, GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
++
++	mutex_lock(&ar->conf_mutex);
++	spin_lock_bh(&ar->ab->base_lock);
++
++	if (!arsta->tx_stats) {
++		ret_val = -ENOENT;
++		goto end;
++	}
++
++	len += scnprintf(buf + len, size - len,
++			 "Tx packets inflow from mac80211: %u\n",
++			 atomic_read(&arsta->drv_tx_pkts.pkts_in));
++	len += scnprintf(buf + len, size - len,
++			 "Tx packets outflow to HW: %u\n",
++			 atomic_read(&arsta->drv_tx_pkts.pkts_out));
++	spin_unlock_bh(&ar->ab->base_lock);
++
++	if (len > size)
++		len = size;
++
++	ret_val = simple_read_from_buffer(user_buf, count, ppos, buf, len);
++	kfree(buf);
++
++	mutex_unlock(&ar->conf_mutex);
++	return ret_val;
++end:
++	spin_unlock_bh(&ar->ab->base_lock);
++	mutex_unlock(&ar->conf_mutex);
++	kfree(buf);
++	return ret_val;
++}
++
++static const struct file_operations fops_driver_tx_pkts_flow = {
++	.read = ath11k_dbg_sta_dump_driver_tx_pkts_flow,
++	.open = simple_open,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++};
++
++static ssize_t ath11k_dbg_sta_reset_tx_stats(struct file *file,
++					     const char __user *buf,
++					     size_t count, loff_t *ppos)
++{
++	struct ieee80211_sta *sta = file->private_data;
++	struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv;
++	struct ath11k *ar = arsta->arvif->ar;
++	int ret, reset;
++
++	ret = kstrtoint_from_user(buf, count, 0, &reset);
++	if (ret)
++		return ret;
++
++	if (!reset || reset > 1)
++		return -EINVAL;
++
++	spin_lock_bh(&ar->ab->base_lock);
++
++	if (!arsta->tx_stats) {
++		spin_unlock_bh(&ar->ab->base_lock);
++		return -ENOENT;
++	}
++
++	memset(arsta->tx_stats, 0, sizeof(*arsta->tx_stats));
++	atomic_set(&arsta->drv_tx_pkts.pkts_in, 0);
++	atomic_set(&arsta->drv_tx_pkts.pkts_out, 0);
++	spin_unlock_bh(&ar->ab->base_lock);
++
++	ret = count;
++	return ret;
++}
++
++static const struct file_operations fops_reset_tx_stats = {
++	.write = ath11k_dbg_sta_reset_tx_stats,
++	.open = simple_open,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++};
++
++static ssize_t
++ath11k_dbg_sta_dump_driver_rx_pkts_flow(struct file *file,
++					char __user *user_buf,
++					size_t count, loff_t *ppos)
++{
++	struct ieee80211_sta *sta = file->private_data;
++	struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv;
++	struct ath11k *ar = arsta->arvif->ar;
++	struct ath11k_rx_peer_stats *rx_stats = arsta->rx_stats;
++	int len = 0, ret_val = 0;
++	const int size = 1024;
++	char *buf;
++
++	if (!rx_stats)
++		return -ENOENT;
++
++	buf = kzalloc(size, GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
++
++	mutex_lock(&ar->conf_mutex);
++	spin_lock_bh(&ar->ab->base_lock);
++
++	len += scnprintf(buf + len, size - len,
++			 "Rx packets inflow from HW: %u\n",
++			 atomic_read(&arsta->drv_rx_pkts.pkts_frm_hw));
++	len += scnprintf(buf + len, size - len,
++			 "Rx packets outflow from driver: %u\n",
++			 atomic_read(&arsta->drv_rx_pkts.pkts_out));
++	len += scnprintf(buf + len, size - len,
++			 "Rx packets outflow from driver to netif in Fast rx: %u\n",
++			 atomic_read(&arsta->drv_rx_pkts.pkts_out_to_netif));
++
++	len += scnprintf(buf + len, size - len, "\n");
++
++	spin_unlock_bh(&ar->ab->base_lock);
++
++	if (len > size)
++		len = size;
++
++	ret_val = simple_read_from_buffer(user_buf, count, ppos, buf, len);
++	kfree(buf);
++
++	mutex_unlock(&ar->conf_mutex);
++	return ret_val;
++}
++
++static const struct file_operations fops_driver_rx_pkts_flow = {
++	.read = ath11k_dbg_sta_dump_driver_rx_pkts_flow,
++	.open = simple_open,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++};
++
+ void ath11k_debugfs_sta_op_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 			       struct ieee80211_sta *sta, struct dentry *dir)
+ {
+ 	struct ath11k *ar = hw->priv;
+ 
+-	if (ath11k_debugfs_is_extd_tx_stats_enabled(ar))
+-		debugfs_create_file("tx_stats", 0400, dir, sta,
+-				    &fops_tx_stats);
+-	if (ath11k_debugfs_is_extd_rx_stats_enabled(ar))
++	if (ath11k_debugfs_is_extd_tx_stats_enabled(ar)) {
++ 		debugfs_create_file("tx_stats", 0400, dir, sta,
++ 				    &fops_tx_stats);
++		debugfs_create_file("reset_tx_stats", 0600, dir, sta,
++				    &fops_reset_tx_stats);
++		debugfs_create_file("driver_tx_pkts_flow", 0400, dir, sta,
++				    &fops_driver_tx_pkts_flow);
++	}
++	if (ath11k_debugfs_is_extd_rx_stats_enabled(ar)) {
+ 		debugfs_create_file("rx_stats", 0400, dir, sta,
+ 				    &fops_rx_stats);
++		debugfs_create_file("reset_rx_stats", 0600, dir, sta,
++				    &fops_reset_rx_stats);
++		debugfs_create_file("driver_rx_pkts_flow", 0400, dir, sta,
++				    &fops_driver_rx_pkts_flow);
++ 	}
+ 
+ 	debugfs_create_file("htt_peer_stats", 0400, dir, sta,
+ 			    &fops_htt_peer_stats);
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -2416,6 +2416,7 @@ static void ath11k_dp_rx_h_mpdu(struct a
+ 	struct rx_attention *rx_attention;
+ 	u32 err_bitmap;
+ 
++
+ 	/* PN for multicast packets will be checked in mac80211 */
+ 	rxcb = ATH11K_SKB_RXCB(msdu);
+ 	fill_crypto_hdr = ath11k_dp_rx_h_attn_is_mcbc(ar->ab, rx_desc);
+@@ -2609,6 +2610,7 @@ static void ath11k_dp_rx_deliver_msdu(st
+ 	struct ieee80211_rx_status *rx_status;
+ 	struct ieee80211_radiotap_he *he = NULL;
+ 	struct ieee80211_sta *pubsta = NULL;
++	struct ath11k_sta *arsta = NULL;
+ 	struct ath11k_peer *peer;
+ 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
+ 	u8 decap = DP_RX_DECAP_TYPE_RAW;
+@@ -2674,6 +2676,18 @@ static void ath11k_dp_rx_deliver_msdu(st
+ 		rx_status->flag |= RX_FLAG_8023;
+ 
+ 	ieee80211_rx_napi(ar->hw, pubsta, msdu, napi);
++
++	if (ath11k_debugfs_is_extd_rx_stats_enabled(ar)) {
++		if (!(status->flag & RX_FLAG_ONLY_MONITOR)) {
++			spin_lock_bh(&ar->ab->base_lock);
++			if (peer && peer->sta)
++				arsta =
++				(struct ath11k_sta *)peer->sta->drv_priv;
++			spin_unlock_bh(&ar->ab->base_lock);
++			if (arsta)
++				atomic_inc(&arsta->drv_rx_pkts.pkts_out);
++		}
++	}
+ }
+ 
+ static int ath11k_dp_rx_process_msdu(struct ath11k *ar,
+@@ -2820,6 +2834,8 @@ int ath11k_dp_process_rx(struct ath11k_b
+ 	int total_msdu_reaped = 0;
+ 	struct hal_srng *srng;
+ 	struct sk_buff *msdu;
++	struct ath11k_peer *peer = NULL;
++	struct ath11k_sta *arsta = NULL;
+ 	bool done = false;
+ 	int buf_id, mac_id;
+ 	struct ath11k *ar;
+@@ -2893,6 +2909,19 @@ try_again:
+ 		rxcb->tid = FIELD_GET(HAL_REO_DEST_RING_INFO0_RX_QUEUE_NUM,
+ 				      desc->info0);
+ 
++		if (ath11k_debugfs_is_extd_rx_stats_enabled(ar) && rxcb->peer_id) {
++			rcu_read_lock();
++			spin_lock_bh(&ab->base_lock);
++			peer = ath11k_peer_find_by_id(ab, rxcb->peer_id);
++			if (peer && peer->sta)
++				arsta =
++				(struct ath11k_sta *)peer->sta->drv_priv;
++			spin_unlock_bh(&ab->base_lock);
++			if (arsta)
++				atomic_inc(&arsta->drv_rx_pkts.pkts_frm_hw);
++			rcu_read_unlock();
++		}
++
+ 		rxcb->mac_id = mac_id;
+ 		__skb_queue_tail(&msdu_list[mac_id], msdu);
+ 
+@@ -4084,7 +4113,10 @@ static int ath11k_dp_rx_h_null_q_desc(st
+ 	struct rx_attention *rx_attention;
+ 	u8 l3pad_bytes;
+ 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
++	struct ath11k_peer *peer = NULL;
++	struct ath11k_sta *arsta = NULL;
+ 	u32 hal_rx_desc_sz = ar->ab->hw_params.hal_desc_sz;
++	u32 peer_id;
+ 
+ 	msdu_len = ath11k_dp_rx_h_msdu_start_msdu_len(ar->ab, desc);
+ 
+@@ -4136,6 +4168,18 @@ static int ath11k_dp_rx_h_null_q_desc(st
+ 	 * rx with mac80211. Need not worry about cleaning up amsdu_list.
+ 	 */
+ 
++	if (ath11k_debugfs_is_extd_rx_stats_enabled(ar)) {
++		peer_id = ath11k_dp_rx_h_mpdu_start_peer_id(ar->ab, desc);
++		spin_lock_bh(&ar->ab->base_lock);
++		if (peer_id)
++			peer = ath11k_peer_find_by_id(ar->ab, rxcb->peer_id);
++		if (peer && peer->sta)
++			arsta = (struct ath11k_sta *)peer->sta->drv_priv;
++		spin_unlock_bh(&ar->ab->base_lock);
++		if (arsta)
++			atomic_inc(&arsta->drv_rx_pkts.pkts_frm_hw);
++	}
++
+ 	return 0;
+ }
+ 
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -6252,6 +6252,7 @@ static void ath11k_mac_op_tx(struct ieee
+ 	struct ath11k_mgmt_frame_stats *mgmt_stats = &arvif->mgmt_stats;
+ 	struct ath11k_sta *arsta = NULL;
+ 	u32 info_flags = info->flags;
++	struct ieee80211_sta *sta = control->sta;
+ 	bool is_prb_rsp;
+ 	u16 frm_type = 0;
+ 	int ret;
+@@ -6314,6 +6315,15 @@ static void ath11k_mac_op_tx(struct ieee
+ 		ieee80211_free_txskb(ar->hw, skb);
+ 		return;
+ 	}
++
++	if (ath11k_debugfs_is_extd_tx_stats_enabled(ar) && sta) {
++		arsta = (struct ath11k_sta *)sta->drv_priv;
++		if (arsta) {
++			atomic_inc(&arsta->drv_tx_pkts.pkts_in);
++			if (!ret)
++				atomic_inc(&arsta->drv_tx_pkts.pkts_out);
++		}
++	}
+ }
+ 
+ void ath11k_mac_drain_tx(struct ath11k *ar)
diff --git a/package/kernel/mac80211/patches/ath11k_nss/234-002-mac80211-account-tx-rx-packets-flow.patch b/package/kernel/mac80211/patches/ath11k_nss/234-002-mac80211-account-tx-rx-packets-flow.patch
new file mode 100644
index 00000000000000..7488f0c2bfce6b
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/234-002-mac80211-account-tx-rx-packets-flow.patch
@@ -0,0 +1,369 @@
+From 26bf6027fe93346f47358e8933e613ac1ece3455 Mon Sep 17 00:00:00 2001
+From: Maharaja Kennadyrajan <mkenna@codeaurora.org>
+Date: Mon, 4 Jan 2021 23:50:37 +0530
+Subject: [PATCH 2/2] ath11k/mac80211: Add support to account Tx and Rx flow
+ packets
+
+Added support to log the inflow and outflow of the Tx and Rx
+packets in netif and host driver.
+
+Command to dump the Tx pkts flow in driver:
+cat
+/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
+XX\:XX\:XX\:XX\:XX\:XX/driver_tx_pkts_flow
+
+Command to dump the Rx pkts flow in driver:
+cat
+/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
+XX\:XX\:XX\:XX\:XX\:XX/driver_rx_pkts_flow
+
+Commands to reset the Tx/Rx pkts flow in driver:
+echo 1 >
+/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
+XX\:XX\:XX\:XX\:XX\:XX/reset_tx_stats
+
+echo 1 >
+/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
+XX\:XX\:XX\:XX\:XX\:XX/reset_rx_stats
+
+Command to dump the Tx pkts flow in mac80211:
+cat
+/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
+XX\:XX\:XX\:XX\:XX\:XX/mac80211_tx_pkts_flow
+
+Command to dump the Rx pkts flow in mac80211:
+cat
+/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
+XX\:XX\:XX\:XX\:XX\:XX/mac80211_rx_pkts_flow
+
+Commands to reset the Tx/Rx pkts flow in mac80211:
+echo 1 >
+/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
+XX\:XX\:XX\:XX\:XX\:XX/reset_mac80211_tx_pkts_flow
+
+echo 1 >
+/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
+XX\:XX\:XX\:XX\:XX\:XX/reset_mac80211_rx_pkts_flow
+
+Sample output after running the Tx and Rx traffic.
+
+root@OpenWrt:/# cat sys/kernel/debug/ieee80211/phy0/netdev\:
+wlan0/stations/8c\:fd\:f0\:06\:23\:41/driver_tx_pkts_flow
+Tx packets inflow from mac80211: 20
+Tx packets outflow to HW: 20
+
+root@OpenWrt:/# cat sys/kernel/debug/ieee80211/phy0/netdev\:
+wlan0/stations/8c\:fd\:f0\:06\:23\:41/mac80211_tx_pkts_flow
+Tx packets outflow from netif: 20
+Tx packets inflow in mac80211: 20
+
+root@OpenWrt:/# cat sys/kernel/debug/ieee80211/phy0/netdev\:
+wlan0/stations/8c\:fd\:f0\:06\:23\:41/driver_rx_pkts_flow
+Rx packets inflow from HW: 28
+Rx packets outflow from driver: 28
+
+root@OpenWrt:/# cat sys/kernel/debug/ieee80211/phy0/netdev\:
+wlan0/stations/8c\:fd\:f0\:06\:23\:41/mac80211_rx_pkts_flow
+Rx packets inflow in mac80211: 28
+Rx packets inflow in netif: 26
+Rx forwarded packets in bridge: 2
+
+Signed-off-by: Maharaja Kennadyrajan <mkenna@codeaurora.org>
+---
+ net/mac80211/debugfs_sta.c | 174 +++++++++++++++++++++++++++++++++++++
+ net/mac80211/rx.c          |  13 +++
+ net/mac80211/sta_info.h    |   7 ++
+ net/mac80211/tx.c          |   8 ++
+ 4 files changed, 202 insertions(+)
+
+--- a/net/mac80211/debugfs_sta.c
++++ b/net/mac80211/debugfs_sta.c
+@@ -1219,6 +1219,176 @@ out:
+ }
+ LINK_STA_OPS(eht_capa);
+ 
++static ssize_t
++sta_reset_mac80211_tx_pkts_flow_read(struct file *file,
++				     char __user *userbuf,
++				     size_t count, loff_t *ppos)
++{
++	size_t bufsz = 30;
++	char *buf = kzalloc(bufsz, GFP_KERNEL), *p = buf;
++	ssize_t rv;
++
++	if (!buf)
++		return -ENOMEM;
++
++	p += scnprintf(p, bufsz + buf - p, "write 1 to reset the stats\n");
++
++	rv = simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
++	kfree(buf);
++	return rv;
++}
++
++static ssize_t
++sta_reset_mac80211_tx_pkts_flow_write(struct file *file,
++				      const char __user *userbuf,
++				      size_t count, loff_t *ppos)
++{
++	struct sta_info *sta = file->private_data;
++	unsigned long tx_stats_reset;
++	int ret;
++	char _buf[2] = {}, *buf = _buf;
++
++	if (count > sizeof(_buf))
++		return -EINVAL;
++
++	if (copy_from_user(buf, userbuf, count))
++		return -EFAULT;
++
++	buf[sizeof(_buf) - 1] = '\0';
++	if (sscanf(buf, "%lu", &tx_stats_reset) != 1)
++		return -EINVAL;
++
++	ret = kstrtoul(buf, 0, &tx_stats_reset);
++	if (ret || tx_stats_reset != 1)
++		return -EINVAL;
++
++	atomic_set(&sta->tx_drv_pkts, 0);
++	atomic_set(&sta->tx_netif_pkts, 0);
++
++	return count;
++}
++STA_OPS_RW(reset_mac80211_tx_pkts_flow);
++
++static ssize_t
++sta_reset_mac80211_rx_pkts_flow_read(struct file *file,
++				     char __user *userbuf,
++				     size_t count, loff_t *ppos)
++{
++	size_t bufsz = 30;
++	char *buf = kzalloc(bufsz, GFP_KERNEL), *p = buf;
++	ssize_t rv;
++
++	if (!buf)
++		return -ENOMEM;
++
++	p += scnprintf(p, bufsz + buf - p, "write 1 to reset the stats\n");
++
++	rv = simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
++	kfree(buf);
++	return rv;
++}
++
++static ssize_t
++sta_reset_mac80211_rx_pkts_flow_write(struct file *file,
++				      const char __user *userbuf,
++				      size_t count, loff_t *ppos)
++{
++	struct sta_info *sta = file->private_data;
++	unsigned long rx_stats_reset;
++	int ret;
++	char _buf[2] = {}, *buf = _buf;
++
++	if (count > sizeof(_buf))
++		return -EINVAL;
++
++	if (copy_from_user(buf, userbuf, count))
++		return -EFAULT;
++
++	buf[sizeof(_buf) - 1] = '\0';
++	if (sscanf(buf, "%lu", &rx_stats_reset) != 1)
++		return -EINVAL;
++
++	ret = kstrtoul(buf, 0, &rx_stats_reset);
++	if (ret || rx_stats_reset != 1)
++		return -EINVAL;
++
++	atomic_set(&sta->rx_drv_pkts, 0);
++	atomic_set(&sta->rx_netif_pkts, 0);
++	atomic_set(&sta->rx_forwarded_pkts, 0);
++
++	return count;
++}
++STA_OPS_RW(reset_mac80211_rx_pkts_flow);
++
++static ssize_t sta_mac80211_tx_pkts_flow_read(struct file *file,
++					      char __user *userbuf,
++					      size_t count, loff_t *ppos)
++{
++	struct sta_info *sta = file->private_data;
++	int retval = 0, len = 0;
++	const int size = 256;
++	char *buf;
++
++	buf = kzalloc(size, GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
++
++	rcu_read_lock();
++
++	len += scnprintf(buf + len, size - len,
++			 "Tx packets outflow from netif: %u\n",
++			 atomic_read(&sta->tx_netif_pkts));
++	len += scnprintf(buf + len, size - len,
++			 "Tx packets outflow from mac80211: %u\n",
++			 atomic_read(&sta->tx_drv_pkts));
++	rcu_read_unlock();
++
++	if (len > size)
++		len = size;
++
++	retval = simple_read_from_buffer(userbuf, count, ppos, buf, len);
++	kfree(buf);
++
++	return retval;
++}
++STA_OPS(mac80211_tx_pkts_flow);
++
++static ssize_t sta_mac80211_rx_pkts_flow_read(struct file *file,
++					      char __user *userbuf,
++					      size_t count, loff_t *ppos)
++{
++	struct sta_info *sta = file->private_data;
++	int retval = 0, len = 0;
++	const int size = 512;
++	char *buf;
++
++	buf = kzalloc(size, GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
++
++	rcu_read_lock();
++
++	len += scnprintf(buf + len, size - len,
++			 "Rx packets inflow in mac80211: %u\n",
++			 atomic_read(&sta->rx_drv_pkts));
++	len += scnprintf(buf + len, size - len,
++			 "Rx packets inflow in netif: %u\n",
++			 atomic_read(&sta->rx_netif_pkts));
++	len += scnprintf(buf + len, size - len,
++			 "Rx forwarded packets in bridge: %u\n",
++			 atomic_read(&sta->rx_forwarded_pkts));
++
++	rcu_read_unlock();
++
++	if (len > size)
++		len = size;
++	retval = simple_read_from_buffer(userbuf, count, ppos, buf, len);
++	kfree(buf);
++
++	return retval;
++}
++STA_OPS(mac80211_rx_pkts_flow);
++
+ #define DEBUGFS_ADD(name) \
+ 	debugfs_create_file(#name, 0400, \
+ 		sta->debugfs_dir, sta, &sta_ ##name## _ops)
+@@ -1254,6 +1424,10 @@ void ieee80211_sta_debugfs_add(struct st
+ 	DEBUGFS_ADD(num_ps_buf_frames);
+ 	DEBUGFS_ADD(last_seq_ctrl);
+ 	DEBUGFS_ADD(agg_status);
++	DEBUGFS_ADD(reset_mac80211_tx_pkts_flow);
++	DEBUGFS_ADD(reset_mac80211_rx_pkts_flow);
++	DEBUGFS_ADD(mac80211_tx_pkts_flow);
++	DEBUGFS_ADD(mac80211_rx_pkts_flow);
+ 	/* FIXME: Kept here as the statistics are only done on the deflink */
+ 	DEBUGFS_ADD_COUNTER(tx_filtered, deflink.status_stats.filtered);
+ 
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2623,6 +2623,7 @@ static void ieee80211_deliver_skb_to_loc
+ {
+ 	struct ieee80211_sub_if_data *sdata = rx->sdata;
+ 	struct net_device *dev = sdata->dev;
++	struct sta_info *sta = rx->sta;
+ 
+ 	if (unlikely((skb->protocol == sdata->control_port_protocol ||
+ 		     (skb->protocol == cpu_to_be16(ETH_P_PREAUTH) &&
+@@ -2666,6 +2667,7 @@ static void ieee80211_deliver_skb_to_loc
+ 		else
+ 			netif_receive_skb(skb);
+ #endif
++		atomic_inc(&sta->rx_netif_pkts);
+ 	}
+ }
+ 
+@@ -2724,6 +2726,7 @@ ieee80211_deliver_skb(struct ieee80211_r
+ 				 */
+ 				xmit_skb = skb;
+ 				skb = NULL;
++				atomic_inc(&rx->sta->rx_forwarded_pkts);
+ 			}
+ 		}
+ 	}
+@@ -4836,6 +4839,7 @@ static void ieee80211_rx_8023(struct iee
+ 			skb_reset_network_header(xmit_skb);
+ 			skb_reset_mac_header(xmit_skb);
+ 			dev_queue_xmit(xmit_skb);
++			atomic_inc(&rx->sta->rx_forwarded_pkts);
+ 		}
+ 
+ 		if (!skb)
+@@ -5332,9 +5336,18 @@ void ieee80211_rx_list(struct ieee80211_
+ 	struct ieee80211_supported_band *sband;
+ 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
++	struct sta_info *sta = NULL;
+ 
+ 	WARN_ON_ONCE(softirq_count() == 0);
+ 
++	if (pubsta) {
++		sta = container_of(pubsta, struct sta_info, sta);
++		if (sta && napi) {
++			if (!(status->flag & RX_FLAG_ONLY_MONITOR))
++				atomic_inc(&sta->rx_drv_pkts);
++		}
++	}
++
+ 	if (WARN_ON(status->band >= NUM_NL80211_BANDS))
+ 		goto drop;
+ 
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -724,6 +724,13 @@ struct sta_info {
+ 	struct link_sta_info deflink;
+ 	struct link_sta_info __rcu *link[IEEE80211_MLD_MAX_NUM_LINKS];
+ 
++	atomic_t tx_drv_pkts;
++	atomic_t tx_netif_pkts;
++	atomic_t rx_drv_pkts;
++	atomic_t rx_netif_pkts;
++	/* Rx packets forwarded to bridge */
++	atomic_t rx_forwarded_pkts;
++
+ 	/* keep last! */
+ 	struct ieee80211_sta sta;
+ };
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -4294,6 +4294,9 @@ void __ieee80211_subif_start_xmit(struct
+ 	if (IS_ERR(sta))
+ 		sta = NULL;
+ 
++	if (sta)
++		atomic_inc(&sta->tx_netif_pkts);
++
+         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
+                 ap_sdata = container_of(sdata->bss,
+                                         struct ieee80211_sub_if_data, u.ap);
+@@ -4614,6 +4617,9 @@ static bool __ieee80211_tx_8023(struct i
+ 
+ 	drv_tx(local, &control, skb);
+ 
++	if (sta)
++		atomic_inc(&sta->tx_drv_pkts);
++
+ 	return true;
+ }
+ 
+@@ -4719,6 +4725,9 @@ static void ieee80211_8023_xmit(struct i
+ 
+ 	ieee80211_tx_8023(sdata, skb, sta, false);
+ 
++	if (sta)
++		atomic_inc(&sta->tx_netif_pkts);
++
+ 	return;
+ 
+ out_free:
diff --git a/package/kernel/mac80211/patches/ath11k_nss/235-001-ath11k-Add-support-for-beacon-tx-mode.patch b/package/kernel/mac80211/patches/ath11k_nss/235-001-ath11k-Add-support-for-beacon-tx-mode.patch
new file mode 100644
index 00000000000000..a95308a74ed223
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/235-001-ath11k-Add-support-for-beacon-tx-mode.patch
@@ -0,0 +1,45 @@
+From a297f43a9ad6d8c95cf8b984337ffb410f3eb92c Mon Sep 17 00:00:00 2001
+From: Maharaja Kennadyrajan <mkenna@codeaurora.org>
+Date: Tue, 12 Jan 2021 18:07:51 +0530
+Subject: [PATCH] ath11k: Add support for beacon tx mode
+
+User can configure the beacon tx mode while bring-up the
+AP via hostapd configuration.
+
+Use the below configuration in the hostapd to configure
+the beacon tx mode.
+
+"beacon_tx_mode=N", where N = 0 for STAGGERED beacon mode
+and N = 1 for BURST beacon mode.
+
+Signed-off-by: Maharaja Kennadyrajan <mkenna@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -3483,7 +3483,10 @@ static void ath11k_mac_op_bss_info_chang
+ 
+ 	if (changed & BSS_CHANGED_BEACON) {
+ 		param_id = WMI_PDEV_PARAM_BEACON_TX_MODE;
+-		param_value = WMI_BEACON_STAGGERED_MODE;
++		if (info->beacon_tx_mode == NL80211_BEACON_BURST_MODE)
++			param_value = WMI_BEACON_BURST_MODE;
++		else
++			param_value = WMI_BEACON_STAGGERED_MODE;
+ 		ret = ath11k_wmi_pdev_set_param(ar, param_id,
+ 						param_value, ar->pdev->pdev_id);
+ 		if (ret)
+@@ -3491,8 +3494,9 @@ static void ath11k_mac_op_bss_info_chang
+ 				    arvif->vdev_id);
+ 		else
+ 			ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
+-				   "Set staggered beacon mode for VDEV: %d\n",
+-				   arvif->vdev_id);
++				   "Set %s beacon mode for VDEV: %d mode: %d\n",
++				   param_value ? "burst" : "staggered",
++				   arvif->vdev_id, param_value);
+ 
+ 		if (!arvif->do_not_send_tmpl || !arvif->bcca_zero_sent) {
+ 			ret = ath11k_mac_setup_bcn_tmpl(arvif);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/235-002-mac80211-Add-support-for-beacon-tx-mode.patch b/package/kernel/mac80211/patches/ath11k_nss/235-002-mac80211-Add-support-for-beacon-tx-mode.patch
new file mode 100644
index 00000000000000..6fb460f6b4f740
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/235-002-mac80211-Add-support-for-beacon-tx-mode.patch
@@ -0,0 +1,159 @@
+From f8e7ec408c357d6438abd980f700353a7efcac7e Mon Sep 17 00:00:00 2001
+From: Maharaja Kennadyrajan <mkenna@codeaurora.org>
+Date: Tue, 12 Jan 2021 18:11:33 +0530
+Subject: [PATCH] mac80211: Add support for beacon tx mode
+
+User can configure the beacon tx mode while bring-up the
+AP via hostapd configuration.
+
+Use the below configuration in the hostapd to configure
+the beacon tx mode.
+
+"beacon_tx_mode=N", where N = 0 for STAGGERED beacon mode
+and N = 1 for BURST beacon mode.
+
+Signed-off-by: Maharaja Kennadyrajan <mkenna@codeaurora.org>
+---
+ include/net/cfg80211.h       | 2 +-
+ include/net/mac80211.h       | 1 +
+ include/uapi/linux/nl80211.h | 2 ++
+ net/mac80211/cfg.c           | 1 +
+ net/wireless/nl80211.c       | 7 ++++++-
+ 5 files changed, 11 insertions(+), 2 deletions(-)
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -1443,6 +1443,7 @@ struct cfg80211_unsol_bcast_probe_resp {
+  * @punct_bitmap: Preamble puncturing bitmap. Each bit represents
+  *	a 20 MHz channel, lowest bit corresponding to the lowest channel.
+  *	Bit set to 1 indicates that the channel is punctured.
++ * @beacon_tx_mode: Beacon Tx Mode setting
+  */
+ struct cfg80211_ap_settings {
+ 	struct cfg80211_chan_def chandef;
+@@ -1478,6 +1479,7 @@ struct cfg80211_ap_settings {
+ 	struct cfg80211_unsol_bcast_probe_resp unsol_bcast_probe_resp;
+ 	struct cfg80211_mbssid_config mbssid_config;
+ 	u16 punct_bitmap;
++	enum nl80211_beacon_tx_mode beacon_tx_mode;
+ };
+ 
+ /**
+@@ -2436,6 +2438,7 @@ struct mesh_config {
+  *	to operate on DFS channels.
+  * @control_port_over_nl80211: TRUE if userspace expects to exchange control
+  *	port frames over NL80211 instead of the network interface.
++ * @beacon_tx_mode: Beacon Tx Mode setting.
+  *
+  * These parameters are fixed when the mesh is created.
+  */
+@@ -2459,6 +2462,7 @@ struct mesh_setup {
+ 	struct cfg80211_bitrate_mask beacon_rate;
+ 	bool userspace_handles_dfs;
+ 	bool control_port_over_nl80211;
++	enum nl80211_beacon_tx_mode beacon_tx_mode;
+ };
+ 
+ /**
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -698,6 +698,7 @@ struct ieee80211_fils_discovery {
+  * @eht_mu_beamformer: in AP-mode, does this BSS enable operation as an EHT MU
+  *	beamformer
+  * @nss_ap_isolate: Used for notifying the NSS host about AP isolate feature
++ * @beacon_tx_mode: Beacon Tx Mode setting.
+  */
+ struct ieee80211_bss_conf {
+ 	struct ieee80211_vif *vif;
+@@ -792,6 +793,7 @@ struct ieee80211_bss_conf {
+ 	bool eht_su_beamformee;
+ 	bool eht_mu_beamformer;
+ 	bool nss_ap_isolate;
++	enum nl80211_beacon_tx_mode beacon_tx_mode;
+ };
+ 
+ /**
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -2814,7 +2814,9 @@ enum nl80211_commands {
+  *
+  * @NL80211_ATTR_MLO_LINK_DISABLED: Flag attribute indicating that the link is
+  *	disabled.
+- *
++ * @NL80211_ATTR_BEACON_TX_MODE: used to configure the beacon tx mode as
++ *	staggered mode = 1 or burst mode = 2 in %NL80211_CMD_START_AP or
++ *	%NL80211_CMD_JOIN_MESH from user-space.
+  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
+  * @NL80211_ATTR_MAX: highest attribute number currently defined
+  * @__NL80211_ATTR_AFTER_LAST: internal use
+@@ -3353,6 +3355,8 @@ enum nl80211_attrs {
+ 
+ 	NL80211_ATTR_MLO_LINK_DISABLED,
+ 
++	NL80211_ATTR_BEACON_TX_MODE,
++
+ 	/* add attributes here, update the policy in nl80211.c */
+ 
+ 	__NL80211_ATTR_AFTER_LAST,
+@@ -7840,4 +7844,12 @@ enum nl80211_ap_settings_flags {
+ 	NL80211_AP_SETTINGS_SA_QUERY_OFFLOAD_SUPPORT	= 1 << 1,
+ };
+ 
++/**
++ * enum nl80211_beacon_tx_mode - Beacon Tx Mode enum.
++ * 	Used to configure beacon staggered mode or beacon burst mode.
++ */
++enum nl80211_beacon_tx_mode {
++	NL80211_BEACON_STAGGERED_MODE = 1,
++	NL80211_BEACON_BURST_MODE = 2,
++};
+ #endif /* __LINUX_NL80211_H */
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1294,6 +1294,7 @@ static int ieee80211_start_ap(struct wip
+ 
+ 	prev_beacon_int = link_conf->beacon_int;
+ 	link_conf->beacon_int = params->beacon_interval;
++	link_conf->beacon_tx_mode = params->beacon_tx_mode;
+ 
+ 	if (params->ht_cap)
+ 		link_conf->ht_ldpc =
+@@ -2490,6 +2491,7 @@ static int copy_mesh_setup(struct ieee80
+ 
+ 	sdata->vif.bss_conf.beacon_int = setup->beacon_interval;
+ 	sdata->vif.bss_conf.dtim_period = setup->dtim_period;
++	sdata->vif.bss_conf.beacon_tx_mode = setup->beacon_tx_mode;
+ 
+ 	sdata->beacon_rate_set = false;
+ 	if (wiphy_ext_feature_isset(sdata->local->hw.wiphy,
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -811,6 +811,7 @@ static const struct nla_policy nl80211_p
+ 	[NL80211_ATTR_HW_TIMESTAMP_ENABLED] = { .type = NLA_FLAG },
+ 	[NL80211_ATTR_EMA_RNR_ELEMS] = { .type = NLA_NESTED },
+ 	[NL80211_ATTR_MLO_LINK_DISABLED] = { .type = NLA_FLAG },
++	[NL80211_ATTR_BEACON_TX_MODE] = NLA_POLICY_RANGE(NLA_U32, 1, 2),
+ };
+ 
+ /* policy for the key attributes */
+@@ -5941,6 +5942,9 @@ static int nl80211_start_ap(struct sk_bu
+ 		nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
+ 	params->dtim_period =
+ 		nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
++	if (info->attrs[NL80211_ATTR_BEACON_TX_MODE])
++		params->beacon_tx_mode =
++			nla_get_u32(info->attrs[NL80211_ATTR_BEACON_TX_MODE]);
+ 
+ 	err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
+ 					   params->beacon_interval);
+@@ -13037,6 +13041,10 @@ static int nl80211_join_mesh(struct sk_b
+ 			return -EINVAL;
+ 	}
+ 
++	if (info->attrs[NL80211_ATTR_BEACON_TX_MODE])
++		setup.beacon_tx_mode =
++			nla_get_u32(info->attrs[NL80211_ATTR_BEACON_TX_MODE]);
++
+ 	if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
+ 		/* parse additional setup parameters if given */
+ 		err = nl80211_parse_mesh_setup(info, &setup);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/237-002-ath11k-Add-provision-to-configure-rx-hashmap.patch b/package/kernel/mac80211/patches/ath11k_nss/237-002-ath11k-Add-provision-to-configure-rx-hashmap.patch
new file mode 100644
index 00000000000000..83c019b871e81b
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/237-002-ath11k-Add-provision-to-configure-rx-hashmap.patch
@@ -0,0 +1,208 @@
+From 60d0a63d537c280ff9501296cefd322b981b88f5 Mon Sep 17 00:00:00 2001
+From: P Praneesh <ppranees@codeaurora.org>
+Date: Mon, 14 Dec 2020 19:13:49 +0530
+Subject: [PATCH] ath11k: Add provision to configure rx hashmap
+
+Currently the hashmap is set to default during REO
+setup and all REO rings are equally distributed across
+32 hash values.
+
+Add provision to configure the hashmap so that destination
+rings can be controlled. Setting 0 will disable hash based
+steering.
+
+echo "hashmap" > /sys/kernel/debug/ath11k/ipq8074\ hw2.0/rx_hash
+
+Signed-off-by: Sriram R <srirrama@codeaurora.org>
+Signed-off-by: P Praneesh <ppranees@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/core.h   |  2 ++
+ drivers/net/wireless/ath/ath11k/debugfs.c  | 51 ++++++++++++++++++++++++++++++++
+ drivers/net/wireless/ath/ath11k/dp.c     |  4 ++-
+ drivers/net/wireless/ath/ath11k/hal.h    |  1 +
+ drivers/net/wireless/ath/ath11k/hal_rx.c | 30 +++++++++++--------
+ 5 files changed, 74 insertions(+), 14 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -65,6 +65,7 @@ extern bool ath11k_ftm_mode;
+ #define ATH11K_RECONFIGURE_TIMEOUT_HZ (10 * HZ)
+ #define ATH11K_RECOVER_START_TIMEOUT_HZ (20 * HZ)
+ 
++#define HAL_REO_DEST_RING_CTRL_HASH_RING_SHIFT                  8
+ enum ath11k_supported_bw {
+ 	ATH11K_BW_20	= 0,
+ 	ATH11K_BW_40	= 1,
+@@ -1037,6 +1038,8 @@ struct ath11k_base {
+ 	atomic_t num_max_allowed;
+ 	struct ath11k_num_vdevs_peers *num_vdevs_peers;
+ 
++	u32 rx_hash;
++
+ 	/* must be last */
+ 	u8 drv_priv[] __aligned(sizeof(void *));
+ };
+--- a/drivers/net/wireless/ath/ath11k/debugfs.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs.c
+@@ -972,6 +972,54 @@ static const struct file_operations fops
+ 	.llseek = default_llseek,
+ };
+ 
++static ssize_t ath11k_write_rx_hash(struct file *file,
++				    const char __user *ubuf,
++				    size_t count, loff_t *ppos)
++{
++	struct ath11k_base *ab = file->private_data;
++	struct ath11k_pdev *pdev;
++	u32 rx_hash;
++	u8 buf[128] = {0};
++	int ret, i, radioup = 0;
++
++	for (i = 0; i < ab->num_radios; i++) {
++		pdev = &ab->pdevs[i];
++		if (pdev && pdev->ar) {
++			radioup = 1;
++			break;
++		}
++	}
++
++	if (radioup == 0) {
++		ath11k_err(ab, "radio is not up\n");
++		ret = -ENETDOWN;
++		goto exit;
++	}
++
++	ret = simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, ubuf, count);
++	if (ret < 0)
++		goto exit;
++
++	buf[ret] = '\0';
++	ret = sscanf(buf, "%x", &rx_hash);
++	if (!ret) {
++		ret = -EINVAL;
++		goto exit;
++	}
++
++	if (rx_hash != ab->rx_hash) {
++		ab->rx_hash = rx_hash;
++		if (rx_hash)
++			ath11k_hal_reo_hash_setup(ab, rx_hash);
++	}
++	ret = count;
++exit:
++	return ret;
++}
++static const struct file_operations fops_soc_rx_hash = {
++	.open = simple_open,
++	.write = ath11k_write_rx_hash,
++};
+ int ath11k_debugfs_pdev_create(struct ath11k_base *ab)
+ {
+ 	if (test_bit(ATH11K_FLAG_REGISTERED, &ab->dev_flags))
+@@ -987,6 +1035,10 @@ int ath11k_debugfs_pdev_create(struct at
+ 		debugfs_create_file("sram", 0400, ab->debugfs_soc, ab,
+ 				    &fops_sram_dump);
+ 
++		debugfs_create_file("rx_hash", 0600, ab->debugfs_soc, ab,
++			    &fops_soc_rx_hash);
++
++
+ 	return 0;
+ }
+ 
+--- a/drivers/net/wireless/ath/ath11k/dp.c
++++ b/drivers/net/wireless/ath/ath11k/dp.c
+@@ -50,7 +50,7 @@ int ath11k_dp_peer_setup(struct ath11k *
+ 	bool rx_hash_enable = DP_RX_HASH_ENABLE;
+ 
+ 	/* RX Hash based steering is disabled for NSS Offload */
+-	if (ar->ab->nss.enabled)
++	if (ar->ab->nss.enabled || !ab->rx_hash)
+ 		rx_hash_enable = DP_RX_HASH_DISABLE;
+ 
+ 	/* NOTE: reo_dest ring id starts from 1 unlike mac_id which starts from 0 */
+--- a/drivers/net/wireless/ath/ath11k/hal.h
++++ b/drivers/net/wireless/ath/ath11k/hal.h
+@@ -922,6 +922,7 @@ void ath11k_hal_reo_qdesc_setup(void *va
+ 				u32 start_seq, enum hal_pn_type type);
+ void ath11k_hal_reo_init_cmd_ring(struct ath11k_base *ab,
+ 				  struct hal_srng *srng);
++void ath11k_hal_reo_hash_setup(struct ath11k_base *ab, u32 ring_hash_map);
+ void ath11k_hal_setup_link_idle_list(struct ath11k_base *ab,
+ 				     struct hal_wbm_idle_scatter_list *sbuf,
+ 				     u32 nsbufs, u32 tot_link_desc,
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -102,6 +102,23 @@ static void ath11k_init_wmi_config_qca63
+ 	config->flag1 |= WMI_RSRC_CFG_FLAG1_BSS_CHANNEL_INFO_64;
+ }
+ 
++void ath11k_hal_reo_hash_setup(struct ath11k_base *ab, u32 ring_hash_map)
++{
++	u32 reo_base = HAL_SEQ_WCSS_UMAC_REO_REG;
++	u8 reo_dest_hash_shift = ab->hw_params.reo_dest_ring_map_shift;
++
++	ab->rx_hash = ring_hash_map;
++
++	/* These registers use only 24bits(3 bits x 8 hash values) for
++	 * mapping the dest rings and remaining bits are reserved/not used
++	 * so its safe to write them completely.
++	 */
++	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_2,
++			   ring_hash_map << reo_dest_hash_shift);
++	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_3,
++			   ring_hash_map << reo_dest_hash_shift);
++}
++
+ static void ath11k_hw_ipq8074_reo_setup(struct ath11k_base *ab)
+ {
+ 	u8 frag_dest_ring = HAL_SRNG_RING_ID_REO2SW1;
+@@ -143,18 +160,7 @@ static void ath11k_hw_ipq8074_reo_setup(
+ 	if (ab->nss.enabled)
+ 		return;
+ 
+-	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_0,
+-			   FIELD_PREP(HAL_REO_DEST_RING_CTRL_HASH_RING_MAP,
+-				      ring_hash_map));
+-	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_1,
+-			   FIELD_PREP(HAL_REO_DEST_RING_CTRL_HASH_RING_MAP,
+-				      ring_hash_map));
+-	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_2,
+-			   FIELD_PREP(HAL_REO_DEST_RING_CTRL_HASH_RING_MAP,
+-				      ring_hash_map));
+-	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_3,
+-			   FIELD_PREP(HAL_REO_DEST_RING_CTRL_HASH_RING_MAP,
+-				      ring_hash_map));
++	ath11k_hal_reo_hash_setup(ab, ring_hash_map);
+ }
+ 
+ static void ath11k_init_wmi_config_ipq8074(struct ath11k_base *ab,
+@@ -925,10 +931,7 @@ static void ath11k_hw_wcn6855_reo_setup(
+ 	if (ab->nss.enabled)
+ 		return;
+ 
+-	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_2,
+-			   ring_hash_map);
+-	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_3,
+-			   ring_hash_map);
++	ath11k_hal_reo_hash_setup(ab, ring_hash_map);
+ }
+ 
+ static void ath11k_hw_ipq5018_reo_setup(struct ath11k_base *ab)
+@@ -963,15 +966,7 @@ static void ath11k_hw_ipq5018_reo_setup(
+ 			   HAL_DEFAULT_REO_TIMEOUT_USEC);
+ 	ath11k_hif_write32(ab, reo_base + HAL_REO1_AGING_THRESH_IX_3(ab),
+ 			   HAL_DEFAULT_REO_TIMEOUT_USEC);
+-
+-	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_0,
+-			   ring_hash_map);
+-	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_1,
+-			   ring_hash_map);
+-	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_2,
+-			   ring_hash_map);
+-	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_3,
+-			   ring_hash_map);
++	ath11k_hal_reo_hash_setup(ab, ring_hash_map);
+ }
+ 
+ static u16
diff --git a/package/kernel/mac80211/patches/ath11k_nss/237-003-ath11k-allocate-dst-ring-descriptors-from-cacheable-.patch b/package/kernel/mac80211/patches/ath11k_nss/237-003-ath11k-allocate-dst-ring-descriptors-from-cacheable-.patch
new file mode 100644
index 00000000000000..c054ee146f748a
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/237-003-ath11k-allocate-dst-ring-descriptors-from-cacheable-.patch
@@ -0,0 +1,147 @@
+From 61342ee83df7fa0b90d5ece88e3f83dea426802c Mon Sep 17 00:00:00 2001
+From: P Praneesh <ppranees@codeaurora.org>
+Date: Mon, 14 Dec 2020 20:22:22 +0530
+Subject: [PATCH] ath11k: allocate dst ring descriptors from cacheable
+ memory
+
+tcl_data and reo_dst rings are currently being allocated
+using dma_allocate_coherent() which is non cachable.
+
+Allocating ring memory from cacheable memory area
+allows cached descriptor access and prefetch next
+descriptors to optimize CPU usage during
+descriptor processing on NAPI.
+
+Signed-off-by: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
+Signed-off-by: Sriram R <srirrama@codeaurora.org>
+Signed-off-by: P Praneesh <ppranees@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/dp.c  | 39 ++++++++++++++++++++++++++++++-----
+ drivers/net/wireless/ath/ath11k/dp.h  |  1 +
+ drivers/net/wireless/ath/ath11k/hal.c | 33 ++++++++++++++++++++++++++---
+ drivers/net/wireless/ath/ath11k/hal.h |  1 +
+ 4 files changed, 66 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -705,6 +705,7 @@ void ath11k_dp_tx_completion_handler(str
+ 	struct sk_buff *msdu;
+ 	struct hal_tx_status ts = { 0 };
+ 	struct dp_tx_ring *tx_ring = &dp->tx_ring[ring_id];
++	int valid_entries;
+ 	u32 *desc;
+ 	u32 msdu_id;
+ 	u8 mac_id;
+@@ -713,9 +714,18 @@ void ath11k_dp_tx_completion_handler(str
+ 
+ 	ath11k_hal_srng_access_begin(ab, status_ring);
+ 
++	valid_entries = ath11k_hal_srng_dst_num_free(ab, status_ring, false);
++	if (!valid_entries) {
++		ath11k_hal_srng_access_end(ab, status_ring);
++		spin_unlock_bh(&status_ring->lock);
++		return;
++	}
++
++	ath11k_hal_srng_dst_invalidate_entry(ab, status_ring, valid_entries);
++
+ 	while ((ATH11K_TX_COMPL_NEXT(tx_ring->tx_status_head) !=
+ 		tx_ring->tx_status_tail) &&
+-	       (desc = ath11k_hal_srng_dst_get_next_entry(ab, status_ring))) {
++	       (desc = ath11k_hal_srng_dst_get_next_cache_entry(ab, status_ring))) {
+ 		memcpy(&tx_ring->tx_status[tx_ring->tx_status_head],
+ 		       desc, sizeof(struct hal_wbm_release_ring));
+ 		tx_ring->tx_status_head =
+--- a/drivers/net/wireless/ath/ath11k/hal.c
++++ b/drivers/net/wireless/ath/ath11k/hal.c
+@@ -653,7 +653,8 @@ u32 *ath11k_hal_srng_dst_get_next_entry(
+ 
+ 	desc = srng->ring_base_vaddr + srng->u.dst_ring.tp;
+ 
+-	srng->u.dst_ring.tp += srng->entry_size;
++	srng->u.dst_ring.tp = (srng->u.dst_ring.tp + srng->entry_size) %
++			      srng->ring_size;
+ 
+ 	/* wrap around to start of ring*/
+ 	if (srng->u.dst_ring.tp == srng->ring_size)
+@@ -666,8 +667,63 @@ u32 *ath11k_hal_srng_dst_get_next_entry(
+ 	return desc;
+ }
+ 
++u32 *ath11k_hal_srng_dst_get_next_cache_entry(struct ath11k_base *ab,
++					      struct hal_srng *srng)
++{
++	u32 *desc,*desc_next;
++	lockdep_assert_held(&srng->lock);
++
++	if (srng->u.dst_ring.tp == srng->u.dst_ring.cached_hp)
++		return NULL;
++
++	desc = srng->ring_base_vaddr + srng->u.dst_ring.tp;
++
++	srng->u.dst_ring.tp = (srng->u.dst_ring.tp + srng->entry_size) %
++		srng->ring_size;
++
++	/* Try to prefetch the next descriptor in the ring */
++	if (srng->u.dst_ring.tp != srng->u.dst_ring.cached_hp) {
++		/* prefetch only if desc is available */
++		desc_next = srng->ring_base_vaddr + srng->u.dst_ring.tp;
++		prefetch(desc_next);
++	}
++	return desc;
++}
++
++void ath11k_hal_srng_dst_invalidate_entry(struct ath11k_base *ab,
++					struct hal_srng *srng, int entries)
++{
++	u32 *desc;
++	u32 tp, hp;
++
++	lockdep_assert_held(&srng->lock);
++
++	if (!(srng->flags & HAL_SRNG_FLAGS_CACHED) || !entries)
++		return;
++
++	tp = srng->u.dst_ring.tp;
++	hp = srng->u.dst_ring.cached_hp;
++
++	desc = srng->ring_base_vaddr + tp;
++	if (hp > tp) {
++		dma_sync_single_for_cpu(ab->dev, virt_to_phys(desc),
++				entries * srng->entry_size * sizeof(u32),
++				DMA_FROM_DEVICE);
++	} else {
++		entries = srng->ring_size - tp;
++		dma_sync_single_for_cpu(ab->dev, virt_to_phys(desc),
++				entries * sizeof(u32),
++				DMA_FROM_DEVICE);
++
++		entries = hp;
++		dma_sync_single_for_cpu(ab->dev, virt_to_phys(srng->ring_base_vaddr),
++				entries * sizeof(u32),
++				DMA_FROM_DEVICE);
++	}
++}
++
+ int ath11k_hal_srng_dst_num_free(struct ath11k_base *ab, struct hal_srng *srng,
+-				 bool sync_hw_ptr)
++				bool sync_hw_ptr)
+ {
+ 	u32 tp, hp;
+ 
+--- a/drivers/net/wireless/ath/ath11k/hal.h
++++ b/drivers/net/wireless/ath/ath11k/hal.h
+@@ -946,8 +946,12 @@ void ath11k_hal_srng_get_params(struct a
+ u32 *ath11k_hal_srng_dst_get_next_entry(struct ath11k_base *ab,
+ 					struct hal_srng *srng);
+ u32 *ath11k_hal_srng_dst_peek(struct ath11k_base *ab, struct hal_srng *srng);
++u32 *ath11k_hal_srng_dst_get_next_cache_entry(struct ath11k_base *ab,
++					      struct hal_srng *srng);
+ int ath11k_hal_srng_dst_num_free(struct ath11k_base *ab, struct hal_srng *srng,
+-				 bool sync_hw_ptr);
++				  bool sync_hw_ptr);
++void ath11k_hal_srng_dst_invalidate_entry(struct ath11k_base *ab,
++					  struct hal_srng *srng, int entries);
+ u32 *ath11k_hal_srng_src_peek(struct ath11k_base *ab, struct hal_srng *srng);
+ u32 *ath11k_hal_srng_src_get_next_reaped(struct ath11k_base *ab,
+ 					 struct hal_srng *srng);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch b/package/kernel/mac80211/patches/ath11k_nss/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
new file mode 100644
index 00000000000000..bb46abada6b9e3
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
@@ -0,0 +1,412 @@
+From 594992a7ef169aa406e7fc025df2455af5d226be Mon Sep 17 00:00:00 2001
+From: P Praneesh <ppranees@codeaurora.org>
+Date: Tue, 15 Dec 2020 10:31:30 +0530
+Subject: [PATCH] ath11k: Allow fast rx by bypassing stats update
+
+Add a provision to disable stats and enable fast rx support
+for a peer when it is connected to an AP with ethernet decap support.
+All valid IP packets are directly passed to the net core stack
+bypassing mac80211 stats update
+
+Signed-off-by: Sriram R <srirrama@codeaurora.org>
+Signed-off-by: P Praneesh <ppranees@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/core.h  |  3 ++
+ drivers/net/wireless/ath/ath11k/debugfs.c | 76 +++++++++++++++++++++++++++++++++
+ drivers/net/wireless/ath/ath11k/dp.c    | 45 +++++++++++++++++++
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 54 ++++++++++++++++++++---
+ drivers/net/wireless/ath/ath11k/hw.c    | 25 +++++++++++
+ drivers/net/wireless/ath/ath11k/hw.h    |  1 +
+ drivers/net/wireless/ath/ath11k/mac.c   |  2 +
+ drivers/net/wireless/ath/ath11k/peer.h  |  1 +
+ 8 files changed, 201 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -135,6 +135,7 @@ struct ath11k_skb_rxcb {
+ 	u8 tid;
+ 	u16 peer_id;
+ 	u16 seq_no;
++	struct napi_struct *napi;
+ };
+ 
+ enum ath11k_hw_rev {
+@@ -1039,6 +1040,7 @@ struct ath11k_base {
+ 	struct ath11k_num_vdevs_peers *num_vdevs_peers;
+ 
+ 	u32 rx_hash;
++	bool stats_disable;
+ 
+ 	/* must be last */
+ 	u8 drv_priv[] __aligned(sizeof(void *));
+--- a/drivers/net/wireless/ath/ath11k/debugfs.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs.c
+@@ -1020,6 +1020,80 @@ static const struct file_operations fops
+ 	.open = simple_open,
+ 	.write = ath11k_write_rx_hash,
+ };
++
++static void ath11k_debug_config_mon_status(struct ath11k *ar, bool enable)
++{
++	struct htt_rx_ring_tlv_filter tlv_filter = {0};
++	struct ath11k_base *ab = ar->ab;
++	int i;
++	u32 ring_id;
++
++	if (enable)
++		tlv_filter = ath11k_mac_mon_status_filter_default;
++
++	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
++		ring_id = ar->dp.rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
++		ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id,
++						 ar->dp.mac_id + i,
++						 HAL_RXDMA_MONITOR_STATUS,
++						 DP_RX_BUFFER_SIZE,
++						 &tlv_filter);
++	}
++}
++
++static ssize_t ath11k_write_stats_disable(struct file *file,
++					  const char __user *user_buf,
++					  size_t count, loff_t *ppos)
++{
++	struct ath11k_base *ab = file->private_data;
++	struct ath11k_pdev *pdev;
++	bool disable;
++	int ret, i, radioup = 0;
++	u32 mask = 0;
++
++	for (i = 0; i < ab->num_radios; i++) {
++		pdev = &ab->pdevs[i];
++		if (pdev && pdev->ar) {
++			radioup = 1;
++			break;
++		}
++	}
++
++	if (radioup == 0) {
++		ath11k_err(ab, "radio is not up\n");
++		ret = -ENETDOWN;
++		goto exit;
++	}
++
++	if (kstrtobool_from_user(user_buf, count, &disable))
++		 return -EINVAL;
++
++	 if (disable != ab->stats_disable) {
++		ab->stats_disable = disable;
++		for (i = 0; i < ab->num_radios; i++) {
++			pdev = &ab->pdevs[i];
++			if (pdev && pdev->ar) {
++				ath11k_debug_config_mon_status(pdev->ar, !disable);
++
++				if (!disable)
++					mask = HTT_PPDU_STATS_TAG_DEFAULT;
++
++				ath11k_dp_tx_htt_h2t_ppdu_stats_req(pdev->ar, mask);
++			}
++		}
++	 }
++
++	ret = count;
++
++exit:
++	return ret;
++}
++
++static const struct file_operations fops_soc_stats_disable = {
++	.open = simple_open,
++	.write = ath11k_write_stats_disable,
++};
++
+ int ath11k_debugfs_pdev_create(struct ath11k_base *ab)
+ {
+ 	if (test_bit(ATH11K_FLAG_REGISTERED, &ab->dev_flags))
+@@ -1035,7 +1109,7 @@ int ath11k_debugfs_pdev_create(struct at
+ 		debugfs_create_file("sram", 0400, ab->debugfs_soc, ab,
+ 				    &fops_sram_dump);
+ 
+-		debugfs_create_file("rx_hash", 0600, ab->debugfs_soc, ab,
++	debugfs_create_file("rx_hash", 0600, ab->debugfs_soc, ab,
+ 			    &fops_soc_rx_hash);
+ 
+ 
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -375,6 +375,12 @@ static int ath11k_dp_purge_mon_ring(stru
+ 	return -ETIMEDOUT;
+ }
+ 
++static inline u8 ath11k_dp_rx_h_msdu_start_ip_valid(struct ath11k_base *ab,
++						     struct hal_rx_desc *desc)
++{
++	return ab->hw_params.hw_ops->rx_desc_get_ip_valid(desc);
++}
++
+ /* Returns number of Rx buffers replenished */
+ int ath11k_dp_rxbufs_replenish(struct ath11k_base *ab, int mac_id,
+ 			       struct dp_rxdma_ring *rx_ring,
+@@ -2402,10 +2408,60 @@ ath11k_dp_rx_h_find_peer(struct ath11k_b
+ 	return peer;
+ }
+ 
++static bool ath11k_dp_rx_check_fast_rx(struct ath11k *ar,
++				       struct sk_buff *msdu,
++				       struct hal_rx_desc *rx_desc,
++				       struct ath11k_peer *peer)
++{
++	struct ethhdr *ehdr;
++	struct ath11k_peer *f_peer;
++	struct ath11k_skb_rxcb *rxcb;
++	u8 decap;
++
++	lockdep_assert_held(&ar->ab->base_lock);
++
++	decap = ath11k_dp_rx_h_msdu_start_decap_type(ar->ab, rx_desc);
++	rxcb = ATH11K_SKB_RXCB(msdu);
++
++	if (!ar->ab->stats_disable ||
++	    decap != DP_RX_DECAP_TYPE_ETHERNET2_DIX ||
++	    peer->vif->type != NL80211_IFTYPE_AP)
++		return false;
++
++	/* mcbc packets go through mac80211 for PN validation */
++	if (rxcb->is_mcbc)
++		return false;
++
++	if (!peer->is_authorized)
++		return false;
++
++	if (!ath11k_dp_rx_h_msdu_start_ip_valid(ar->ab, rx_desc))
++		return false;
++
++	/* fast rx is supported only on ethernet decap, so
++	 * we can directly gfet the ethernet header
++	 */
++	ehdr = (struct ethhdr *)msdu->data;
++
++	/* requires rebroadcast from mac80211 */
++	if (is_multicast_ether_addr(ehdr->h_dest))
++		return false;
++
++	/* check if the msdu needs to be bridged to our connected peer */
++	f_peer = ath11k_peer_find_by_addr(ar->ab, ehdr->h_dest);
++
++	if (f_peer && f_peer != peer)
++		return false;
++
++	/* allow direct rx */
++	return true;
++}
++
+ static void ath11k_dp_rx_h_mpdu(struct ath11k *ar,
+ 				struct sk_buff *msdu,
+ 				struct hal_rx_desc *rx_desc,
+-				struct ieee80211_rx_status *rx_status)
++				struct ieee80211_rx_status *rx_status,
++				bool *fast_rx)
+ {
+ 	bool  fill_crypto_hdr;
+ 	enum hal_encrypt_type enctype;
+@@ -2417,6 +2473,9 @@ static void ath11k_dp_rx_h_mpdu(struct a
+ 	u32 err_bitmap;
+ 
+ 
++	struct wireless_dev *wdev = NULL;
++	struct ath11k_sta *arsta = NULL;
++
+ 	/* PN for multicast packets will be checked in mac80211 */
+ 	rxcb = ATH11K_SKB_RXCB(msdu);
+ 	fill_crypto_hdr = ath11k_dp_rx_h_attn_is_mcbc(ar->ab, rx_desc);
+@@ -2430,6 +2489,30 @@ static void ath11k_dp_rx_h_mpdu(struct a
+ 	spin_lock_bh(&ar->ab->base_lock);
+ 	peer = ath11k_dp_rx_h_find_peer(ar->ab, msdu);
+ 	if (peer) {
++		/* If the pkt is a valid IP packet and peer supports
++		 * fast rx, deliver directly to net, also note that
++		 * pkts with crypto error are not expected to arrive in this
++		 * path, so its safe to skip checking errors here */
++		if (*fast_rx &&
++		    ath11k_dp_rx_check_fast_rx(ar, msdu, rx_desc, peer)) {
++			wdev = ieee80211_vif_to_wdev(peer->vif);
++			if (wdev) {
++		        	spin_unlock_bh(&ar->ab->base_lock);
++				ath11k_dp_rx_h_csum_offload(ar, msdu);
++				msdu->dev = wdev->netdev;
++				msdu->protocol = eth_type_trans(msdu, msdu->dev);
++				napi_gro_receive(rxcb->napi, msdu);
++				if (peer->sta)
++					arsta =
++					(struct ath11k_sta *)peer->sta->drv_priv;
++				if (arsta)
++					atomic_inc(&arsta->drv_rx_pkts.pkts_out_to_netif);
++				return;
++			}
++		}
++
++		*fast_rx = false;
++
+ 		if (rxcb->is_mcbc)
+ 			enctype = peer->sec_type_grp;
+ 		else
+@@ -2693,7 +2776,8 @@ static void ath11k_dp_rx_deliver_msdu(st
+ static int ath11k_dp_rx_process_msdu(struct ath11k *ar,
+ 				     struct sk_buff *msdu,
+ 				     struct sk_buff_head *msdu_list,
+-				     struct ieee80211_rx_status *rx_status)
++				     struct ieee80211_rx_status *rx_status,
++				     bool *fast_rx)
+ {
+ 	struct ath11k_base *ab = ar->ab;
+ 	struct hal_rx_desc *rx_desc, *lrx_desc;
+@@ -2775,8 +2859,13 @@ static int ath11k_dp_rx_process_msdu(str
+ 		}
+ 	}
+ 
++	ath11k_dp_rx_h_mpdu(ar, msdu, rx_desc, rx_status, fast_rx);
++	if (*fast_rx) {
++		ab->soc_stats.invalid_rbm++;
++		return 0;
++	}
++
+ 	ath11k_dp_rx_h_ppdu(ar, rx_desc, rx_status);
+-	ath11k_dp_rx_h_mpdu(ar, msdu, rx_desc, rx_status);
+ 
+ 	rx_status->flag |= RX_FLAG_SKIP_MONITOR | RX_FLAG_DUP_VALIDATED;
+ 
+@@ -2791,10 +2880,12 @@ static void ath11k_dp_rx_process_receive
+ 						  struct sk_buff_head *msdu_list,
+ 						  int mac_id)
+ {
++	struct ath11k_skb_rxcb *rxcb;
+ 	struct sk_buff *msdu;
+ 	struct ath11k *ar;
+ 	struct ieee80211_rx_status rx_status = {0};
+ 	int ret;
++	bool fast_rx;
+ 
+ 	if (skb_queue_empty(msdu_list))
+ 		return;
+@@ -2811,7 +2902,12 @@ static void ath11k_dp_rx_process_receive
+ 	}
+ 
+ 	while ((msdu = __skb_dequeue(msdu_list))) {
+-		ret = ath11k_dp_rx_process_msdu(ar, msdu, msdu_list, &rx_status);
++		rxcb = ATH11K_SKB_RXCB(msdu);
++		/* Enable fast rx by default, the value will cahnge based on peer cap
++		 * and packet type */
++		fast_rx = true;
++		rxcb->napi = napi;
++		ret = ath11k_dp_rx_process_msdu(ar, msdu, msdu_list, &rx_status, &fast_rx);
+ 		if (unlikely(ret)) {
+ 			ath11k_dbg(ab, ATH11K_DBG_DATA,
+ 				   "Unable to process msdu %d", ret);
+@@ -2819,7 +2915,10 @@ static void ath11k_dp_rx_process_receive
+ 			continue;
+ 		}
+ 
+-		ath11k_dp_rx_deliver_msdu(ar, napi, msdu, &rx_status);
++		/* msdu is already delivered directectly */
++		if (!fast_rx)
++			ath11k_dp_rx_deliver_msdu(ar, napi, msdu, &rx_status);
++
+ 	}
+ }
+ 
+@@ -4117,6 +4216,7 @@ static int ath11k_dp_rx_h_null_q_desc(st
+ 	struct ath11k_sta *arsta = NULL;
+ 	u32 hal_rx_desc_sz = ar->ab->hw_params.hal_desc_sz;
+ 	u32 peer_id;
++	bool fast_rx;
+ 
+ 	msdu_len = ath11k_dp_rx_h_msdu_start_msdu_len(ar->ab, desc);
+ 
+@@ -4160,7 +4260,8 @@ static int ath11k_dp_rx_h_null_q_desc(st
+ 	}
+ 	ath11k_dp_rx_h_ppdu(ar, desc, status);
+ 
+-	ath11k_dp_rx_h_mpdu(ar, msdu, desc, status);
++	fast_rx = false;
++	ath11k_dp_rx_h_mpdu(ar, msdu, desc, status, &fast_rx);
+ 
+ 	rxcb->tid = ath11k_dp_rx_h_mpdu_start_tid(ar->ab, desc);
+ 
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -303,6 +303,16 @@ static bool ath11k_hw_ipq8074_rx_desc_ge
+ 			 __le32_to_cpu(desc->u.ipq8074.msdu_start.info2));
+ }
+ 
++static u8 ath11k_hw_ipq8074_rx_desc_get_ip_valid(struct hal_rx_desc *desc)
++{
++	bool ipv4, ipv6;
++	ipv4 = FIELD_GET(RX_MSDU_START_INFO2_IPV4,
++			 __le32_to_cpu(desc->u.ipq8074.msdu_start.info2));
++	ipv6 = FIELD_GET(RX_MSDU_START_INFO2_IPV6,
++			 __le32_to_cpu(desc->u.ipq8074.msdu_start.info2));
++	return (ipv4 || ipv6);
++}
++
+ static bool ath11k_hw_ipq8074_rx_desc_get_mpdu_seq_ctl_vld(struct hal_rx_desc *desc)
+ {
+ 	return !!FIELD_GET(RX_MPDU_START_INFO1_MPDU_SEQ_CTRL_VALID,
+@@ -590,6 +600,16 @@ static bool ath11k_hw_qcn9074_rx_desc_ge
+ 			 __le32_to_cpu(desc->u.qcn9074.msdu_start.info2));
+ }
+ 
++static u8 ath11k_hw_qcn9074_rx_desc_get_ip_valid(struct hal_rx_desc *desc)
++{
++	bool ipv4 , ipv6;
++	ipv4 = FIELD_GET(RX_MSDU_START_INFO2_IPV4,
++			 __le32_to_cpu(desc->u.qcn9074.msdu_start.info2));
++	ipv6 = FIELD_GET(RX_MSDU_START_INFO2_IPV6,
++			 __le32_to_cpu(desc->u.qcn9074.msdu_start.info2));
++	return (ipv4 || ipv6);
++}
++
+ static bool ath11k_hw_qcn9074_rx_desc_get_mpdu_seq_ctl_vld(struct hal_rx_desc *desc)
+ {
+ 	return !!FIELD_GET(RX_MPDU_START_INFO11_MPDU_SEQ_CTRL_VALID,
+@@ -1132,6 +1152,7 @@ const struct ath11k_hw_ops qca6390_ops =
+ 	.rx_desc_get_encrypt_type = ath11k_hw_ipq8074_rx_desc_get_encrypt_type,
+ 	.rx_desc_get_decap_type = ath11k_hw_ipq8074_rx_desc_get_decap_type,
+ 	.rx_desc_get_mesh_ctl = ath11k_hw_ipq8074_rx_desc_get_mesh_ctl,
++	.rx_desc_get_ip_valid = ath11k_hw_ipq8074_rx_desc_get_ip_valid,
+ 	.rx_desc_get_ldpc_support = ath11k_hw_ipq8074_rx_desc_get_ldpc_support,
+ 	.rx_desc_get_mpdu_seq_ctl_vld = ath11k_hw_ipq8074_rx_desc_get_mpdu_seq_ctl_vld,
+ 	.rx_desc_get_mpdu_fc_valid = ath11k_hw_ipq8074_rx_desc_get_mpdu_fc_valid,
+@@ -1293,6 +1314,7 @@ const struct ath11k_hw_ops ipq5018_ops =
+ 	.rx_desc_get_encrypt_type = ath11k_hw_qcn9074_rx_desc_get_encrypt_type,
+ 	.rx_desc_get_decap_type = ath11k_hw_qcn9074_rx_desc_get_decap_type,
+ 	.rx_desc_get_mesh_ctl = ath11k_hw_qcn9074_rx_desc_get_mesh_ctl,
++	.rx_desc_get_ip_valid = ath11k_hw_qcn9074_rx_desc_get_ip_valid,
+ 	.rx_desc_get_ldpc_support = ath11k_hw_qcn9074_rx_desc_get_ldpc_support,
+ 	.rx_desc_get_mpdu_seq_ctl_vld = ath11k_hw_qcn9074_rx_desc_get_mpdu_seq_ctl_vld,
+ 	.rx_desc_get_mpdu_fc_valid = ath11k_hw_qcn9074_rx_desc_get_mpdu_fc_valid,
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -270,6 +270,7 @@ struct ath11k_hw_ops {
+ 	u32 (*rx_desc_get_encrypt_type)(struct hal_rx_desc *desc);
+ 	u8 (*rx_desc_get_decap_type)(struct hal_rx_desc *desc);
+ 	u8 (*rx_desc_get_mesh_ctl)(struct hal_rx_desc *desc);
++	u8 (*rx_desc_get_ip_valid)(struct hal_rx_desc *desc);
+ 	bool (*rx_desc_get_ldpc_support)(struct hal_rx_desc *desc);
+ 	bool (*rx_desc_get_mpdu_seq_ctl_vld)(struct hal_rx_desc *desc);
+ 	bool (*rx_desc_get_mpdu_fc_valid)(struct hal_rx_desc *desc);
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -5197,6 +5197,14 @@ static int ath11k_mac_op_sta_state(struc
+ 		}
+ 	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
+ 		   new_state == IEEE80211_STA_ASSOC) {
++
++		spin_lock_bh(&ar->ab->base_lock);
++		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
++		if (peer)
++			peer->is_authorized = false;
++		spin_unlock_bh(&ar->ab->base_lock);
++	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
++		   new_state == IEEE80211_STA_ASSOC) {
+ 		spin_lock_bh(&ar->ab->base_lock);
+ 
+ 		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/245-compilation_fix.patch b/package/kernel/mac80211/patches/ath11k_nss/245-compilation_fix.patch
new file mode 100644
index 00000000000000..b4a735f10fc0e6
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/245-compilation_fix.patch
@@ -0,0 +1,192 @@
+From 9cdb8bae50aca80b593d0f53be5b8efedfc91324 Mon Sep 17 00:00:00 2001
+From: Tamizh Chelvam <tamizhr@codeaurora.org>
+Date: Sun, 7 Mar 2021 22:49:26 +0530
+Subject: [PATCH] backport: Compile fix
+
+Adding these changes to fix compilation issue due to
+package upgrade
+
+Signed-off-by: Tamizh Chelvam <tamizhr@codeaurora.org>
+Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
+---
+ include/linux/backport-refcount.h        |  4 +--
+ include/net/fq.h                         | 10 +++++-
+ net/mac80211/cfg.c                       |  4 +--
+ net/mac80211/ieee80211_i.h               |  4 ++-
+ net/mac80211/iface.c                     |  2 --
+ net/mac80211/rx.c                        | 23 +++++++++-----
+ net/mac80211/tx.c                        | 54 ++++++++++++++++++++++----------
+ 7 files changed, 40 insertions(+), 23 deletions(-)
+
+--- a/include/linux/backport-refcount.h
++++ b/include/linux/backport-refcount.h
+@@ -247,7 +247,7 @@ static inline __must_check bool refcount
+ 
+ static inline void __refcount_inc(refcount_t *r, int *oldp)
+ {
+-	__refcount_add(1, r, oldp);
++	refcount_add(1, r);
+ }
+ 
+ /**
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -207,6 +207,7 @@ enum ieee80211_rx_flags {
+ };
+ 
+ struct ieee80211_rx_data {
++	struct napi_struct *napi;
+ 	struct list_head *list;
+ 	struct sk_buff *skb;
+ 	struct ieee80211_local *local;
+@@ -292,6 +293,7 @@ struct unsol_bcast_probe_resp_data {
+ 	u8 data[];
+ };
+ 
++
+ struct ps_data {
+ 	/* yes, this looks ugly, but guarantees that we can later use
+ 	 * bitmap_empty :)
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -1705,7 +1705,6 @@ static void ieee80211_iface_work(struct
+ 
+ 	/* first process frames */
+ 	while ((skb = skb_dequeue(&sdata->skb_queue))) {
+-		kcov_remote_start_common(skb_get_kcov_handle(skb));
+ 
+ 		if (skb->protocol == cpu_to_be16(ETH_P_TDLS))
+ 			ieee80211_process_tdls_channel_switch(sdata, skb);
+@@ -1713,17 +1712,14 @@ static void ieee80211_iface_work(struct
+ 			ieee80211_iface_process_skb(local, sdata, skb);
+ 
+ 		kfree_skb(skb);
+-		kcov_remote_stop();
+ 	}
+ 
+ 	/* process status queue */
+ 	while ((skb = skb_dequeue(&sdata->status_queue))) {
+-		kcov_remote_start_common(skb_get_kcov_handle(skb));
+ 
+ 		ieee80211_iface_process_status(sdata, skb);
+ 		kfree_skb(skb);
+ 
+-		kcov_remote_stop();
+ 	}
+ 
+ 	/* then other type-dependent work */
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -4668,19 +4668,21 @@ static void ieee80211_8023_xmit(struct i
+ 
+ 	ieee80211_aggr_check(sdata, sta, skb);
+ 
+-	tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
+-	tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
+-	if (tid_tx) {
+-		if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) {
+-			/* fall back to non-offload slow path */
+-			__ieee80211_subif_start_xmit(skb, dev, 0,
+-						     IEEE80211_TX_CTRL_MLO_LINK_UNSPEC,
+-						     NULL);
+-			return;
+-		}
++	if (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD)) {
++		tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
++		tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
++		if (tid_tx) {
++			if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) {
++				/* fall back to non-offload slow path */
++				__ieee80211_subif_start_xmit(skb, dev, 0,
++						     	IEEE80211_TX_CTRL_MLO_LINK_UNSPEC,
++						     	NULL);
++				return;
++			}
+ 
+-		if (tid_tx->timeout)
+-			tid_tx->last_tx = jiffies;
++			if (tid_tx->timeout)
++				tid_tx->last_tx = jiffies;
++		}
+ 	}
+ 
+ 	skb = ieee80211_tx_skb_fixup(skb, ieee80211_sdata_netdev_features(sdata));
+@@ -4739,7 +4741,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+ {
+ 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+ 	struct ethhdr *ehdr = (struct ethhdr *)skb->data;
+-	struct ieee80211_key *key;
++	struct ieee80211_key *key = NULL;
+ 	struct sta_info *sta;
+ 
+ #ifdef CPTCFG_MAC80211_NSS_SUPPORT
+@@ -4757,9 +4759,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+ 		goto out;
+ 	}
+ 
+-	if (unlikely(IS_ERR_OR_NULL(sta) || !sta->uploaded ||
+-	    !test_sta_flag(sta, WLAN_STA_AUTHORIZED) ||
+-	    sdata->control_port_protocol == ehdr->h_proto))
++	if (ieee80211_hw_check(&sdata->local->hw, SUPPORTS_NSS_OFFLOAD)) {
++		if (unlikely(IS_ERR_OR_NULL(sta) || !sta->uploaded))
++			sta = NULL;
++		goto tx_offload;
++	} else if (unlikely(IS_ERR_OR_NULL(sta) || !sta->uploaded ||
++		   !test_sta_flag(sta, WLAN_STA_AUTHORIZED) ||
++		   sdata->control_port_protocol == ehdr->h_proto))
+ 		goto skip_offload;
+ 
+ 	key = rcu_dereference(sta->ptk[sta->ptk_idx]);
+@@ -4770,6 +4776,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+ 		goto skip_offload;
+ 
+ 	sk_pacing_shift_update(skb->sk, sdata->local->hw.tx_sk_pacing_shift);
++tx_offload:
+ 	ieee80211_8023_xmit(sdata, dev, sta, key, skb);
+ 	goto out;
+ 
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -5342,7 +5342,7 @@ void ieee80211_rx_list(struct ieee80211_
+ 
+ 	if (pubsta) {
+ 		sta = container_of(pubsta, struct sta_info, sta);
+-		if (sta && napi) {
++		if (sta) {
+ 			if (!(status->flag & RX_FLAG_ONLY_MONITOR))
+ 				atomic_inc(&sta->rx_drv_pkts);
+ 		}
+@@ -5442,8 +5442,6 @@ void ieee80211_rx_list(struct ieee80211_
+ 
+ 	status->rx_flags = 0;
+ 
+-	kcov_remote_start_common(skb_get_kcov_handle(skb));
+-
+ 	/*
+ 	 * Frames with failed FCS/PLCP checksum are not returned,
+ 	 * all other frames are returned without radiotap header
+@@ -5463,7 +5461,6 @@ void ieee80211_rx_list(struct ieee80211_
+ 			__ieee80211_rx_handle_packet(hw, pubsta, skb, list);
+ 	}
+ 
+-	kcov_remote_stop();
+ 	return;
+  drop:
+ 	kfree_skb(skb);
+--- a/backport-include/linux/skbuff.h
++++ b/backport-include/linux/skbuff.h
+@@ -24,14 +24,6 @@ static inline void *backport___skb_push(
+ }
+ #define __skb_push LINUX_BACKPORT(__skb_push)
+ 
+-static inline void *__skb_put_zero(struct sk_buff *skb, unsigned int len)
+-{
+-	void *tmp = __skb_put(skb, len);
+-
+-	memset(tmp, 0, len);
+-	return tmp;
+-}
+-
+ static inline void *skb_put_zero(struct sk_buff *skb, unsigned int len)
+ {
+ 	void *tmp = skb_put(skb, len);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/245-revert-dev-sw-netstats-txrx-add.patch b/package/kernel/mac80211/patches/ath11k_nss/245-revert-dev-sw-netstats-txrx-add.patch
new file mode 100644
index 00000000000000..6f7c1aadd95b64
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/245-revert-dev-sw-netstats-txrx-add.patch
@@ -0,0 +1,145 @@
+From 3be7ae2d65b6638c4165d66c1c4b5d82d95517d9 Mon Sep 17 00:00:00 2001
+From: Tamizh Chelvam <tamizhr@codeaurora.org>
+Date: Wed, 10 Mar 2021 12:21:49 +0530
+Subject: [PATCH] Revert "net: mac80211: use core API for updating TX/RX stats"
+
+This reverts 36ec144f041bedc2f14b32faa2da11d4d9660003 commit
+in QSDK since 4.4 backports does not support netstats APIs
+for tx/rx stats and retaining the original logic for calculating
+tx/rx stats.
+
+Signed-off-by: Tamizh Chelvam <tamizhr@codeaurora.org>
+---
+ net/mac80211/rx.c | 18 ++++++++++++++----
+ net/mac80211/tx.c | 16 +++++++++++++---
+ 2 files changed, 27 insertions(+), 7 deletions(-)
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -33,6 +33,18 @@
+ #include "wme.h"
+ #include "rate.h"
+ 
++static inline void ieee80211_rx_stats(struct net_device *dev, u32 len)
++{
++	struct pcpu_sw_netstats *tstats = this_cpu_ptr(netdev_tstats(dev));
++
++	u64_stats_update_begin(&tstats->syncp);
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 1, 0))
++	tstats->rx_packets++;
++	tstats->rx_bytes += len;
++#endif
++	u64_stats_update_end(&tstats->syncp);
++}
++
+ /*
+  * monitor mode reception
+  *
+@@ -50,7 +62,11 @@ static struct sk_buff *ieee80211_clean_s
+ 
+ 	if (present_fcs_len)
+ 		__pskb_trim(skb, skb->len - present_fcs_len);
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 1, 0))
++	__pskb_pull(skb, rtap_space);
++#else
+ 	pskb_pull(skb, rtap_space);
++#endif
+ 
+ 	/* After pulling radiotap header, clear all flags that indicate
+ 	 * info in skb->data.
+@@ -83,7 +99,11 @@ static struct sk_buff *ieee80211_clean_s
+ 
+ 	memmove(skb->data + IEEE80211_HT_CTL_LEN, skb->data,
+ 		hdrlen - IEEE80211_HT_CTL_LEN);
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 1, 0))
++	__pskb_pull(skb, IEEE80211_HT_CTL_LEN);
++#else
+ 	pskb_pull(skb, IEEE80211_HT_CTL_LEN);
++#endif
+ 
+ 	return skb;
+ }
+@@ -853,7 +873,7 @@ ieee80211_rx_monitor(struct ieee80211_lo
+ 
+ 			if (skb) {
+ 				skb->dev = sdata->dev;
+-				dev_sw_netstats_rx_add(skb->dev, skb->len);
++				ieee80211_rx_stats(skb->dev, skb->len);
+ 				netif_receive_skb(skb);
+ 			}
+ 		}
+@@ -2686,7 +2706,7 @@ ieee80211_deliver_skb(struct ieee80211_r
+ 	skb = rx->skb;
+ 	xmit_skb = NULL;
+ 
+-	dev_sw_netstats_rx_add(dev, skb->len);
++	ieee80211_rx_stats(dev, skb->len);
+ 
+ 	if (rx->sta) {
+ 		/* The seqno index has the same property as needed
+@@ -4098,7 +4118,7 @@ static void ieee80211_rx_cooked_monitor(
+ 		}
+ 
+ 		prev_dev = sdata->dev;
+-		dev_sw_netstats_rx_add(sdata->dev, skb->len);
++		ieee80211_rx_stats(sdata->dev, skb->len);
+ 	}
+ 
+ 	if (prev_dev) {
+@@ -4806,7 +4826,7 @@ static void ieee80211_rx_8023(struct iee
+ 
+ 	skb->dev = fast_rx->dev;
+ 
+-	dev_sw_netstats_rx_add(fast_rx->dev, skb->len);
++	ieee80211_rx_stats(fast_rx->dev, skb->len);
+ 
+ 	/* The seqno index has the same property as needed
+ 	 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -40,6 +40,18 @@
+ static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
+ 				struct net_device *dev, struct sta_info *sta,
+ 				struct ieee80211_key *key, struct sk_buff *skb);
++
++static inline void ieee80211_tx_stats(struct net_device *dev, u32 len)
++{
++	struct pcpu_sw_netstats *tstats = this_cpu_ptr(netdev_tstats(dev));
++
++	u64_stats_update_begin(&tstats->syncp);
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 1, 0))
++	tstats->tx_packets++;
++	tstats->tx_bytes += len;
++#endif
++	u64_stats_update_end(&tstats->syncp);
++}
+ /* misc utils */
+ 
+ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
+@@ -3557,7 +3569,7 @@ ieee80211_xmit_fast_finish(struct ieee80
+ 	if (key)
+ 		info->control.hw_key = &key->conf;
+ 
+-	dev_sw_netstats_tx_add(skb->dev, 1, skb->len);
++	ieee80211_tx_stats(skb->dev, skb->len);
+ 
+ 	if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
+ 		tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
+@@ -4346,7 +4358,7 @@ void __ieee80211_subif_start_xmit(struct
+ 			goto out;
+ 		}
+ 
+-		dev_sw_netstats_tx_add(dev, 1, skb->len);
++		ieee80211_tx_stats(dev, skb->len);
+ 
+ 		ieee80211_xmit(sdata, sta, skb);
+ 	}
+@@ -4717,7 +4729,7 @@ static void ieee80211_8023_xmit(struct i
+ 		info->ack_frame_id = ieee80211_store_ack_skb(local, skb,
+ 							     &info->flags, NULL);
+ 
+-	dev_sw_netstats_tx_add(dev, skbs, len);
++	ieee80211_tx_stats(dev, len);
+ 	if (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD)) {
+ 		sta->deflink.tx_stats.packets[queue] += skbs;
+ 		sta->deflink.tx_stats.bytes[queue] += len;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/311-ath11k-configure-nss-thread-priority-during-pdev_ini.patch b/package/kernel/mac80211/patches/ath11k_nss/311-ath11k-configure-nss-thread-priority-during-pdev_ini.patch
new file mode 100644
index 00000000000000..0a7dcf5e845780
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/311-ath11k-configure-nss-thread-priority-during-pdev_ini.patch
@@ -0,0 +1,109 @@
+From 246e530a47d9adab9106fb6f2b92197cace17e53 Mon Sep 17 00:00:00 2001
+From: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+Date: Fri, 21 May 2021 14:16:22 +0530
+Subject: [PATCH] ath11k: configure nss radio priority during pdev_init
+
+pdev's priority value is read from dts. Get scheme_id
+using pdev priority. Configure scheme_id during pdev_init.
+
+Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/nss.c | 20 +++++++++++++++++++-
+ drivers/net/wireless/ath/ath11k/nss.h |  3 +++
+ 2 files changed, 22 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/nss.c
++++ b/drivers/net/wireless/ath/ath11k/nss.c
+@@ -2,6 +2,7 @@
+ /*
+  * Copyright (c) 2020 The Linux Foundation. All rights reserved.
+  */
++#include <linux/of.h>
+ 
+ #include "debug.h"
+ #include "mac.h"
+@@ -1782,6 +1783,7 @@ static int ath11k_nss_init(struct ath11k
+ 	nss_tx_status_t status;
+ 	struct ath11k_dp *dp;
+ 	int i, ret;
++	struct device *dev = ab->dev;
+ 
+ 	dp = &ab->dp;
+ 
+@@ -1801,6 +1803,8 @@ static int ath11k_nss_init(struct ath11k
+ 	/* fill rx parameters to initialize rx context */
+ 	wim->wrip.tlv_size = ab->hw_params.hal_desc_sz;
+ 	wim->wrip.rx_buf_len = DP_RXDMA_NSS_REFILL_RING_SIZE;
++	if (of_property_read_bool(dev->of_node, "nss-radio-priority"))
++		wim->flags |= WIFILI_MULTISOC_THREAD_MAP_ENABLE;
+ 
+ 	/* fill hal srng message */
+ 	wim->hssm.dev_base_addr = (u32)ab->mem_pa;
+@@ -1977,11 +1981,13 @@ int ath11k_nss_pdev_init(struct ath11k_b
+ 	struct nss_wifili_msg *wlmsg = NULL;
+ 	nss_wifili_msg_callback_t msg_cb;
+ 	nss_tx_status_t status;
++	struct device *dev = ab->dev;
+ 	int radio_if_num = -1;
+ 	int refill_ring_id;
+ 	int features = 0;
+ 	int dyn_if_type;
+-	int ret, i;
++	int ret, i, scheme_id = 0;
++	u32 nss_radio_priority;
+ 
+ 	dyn_if_type = ath11k_nss_get_dynamic_interface_type(ab);
+ 
+@@ -2010,6 +2016,15 @@ int ath11k_nss_pdev_init(struct ath11k_b
+ 	ath11k_dbg(ab, ATH11K_DBG_NSS, "nss pdev init - id:%d init ctxt:%p ifnum:%d\n",
+ 		   ar->pdev->pdev_id, ar->nss.ctx, ar->nss.if_num);
+ 
++	if (!of_property_read_u32(dev->of_node, "nss-radio-priority", &nss_radio_priority)) {
++		scheme_id = nss_wifili_thread_scheme_alloc(ab->nss.ctx, ar->nss.if_num, nss_radio_priority);
++		if (scheme_id == WIFILI_SCHEME_ID_INVALID) {
++			ath11k_warn(ab, "received invalid scheme_id, configuring default value\n");
++			scheme_id = 0;
++		}
++	}
++	ath11k_dbg(ab, ATH11K_DBG_NSS, "ifnum: %d scheme_id: %d nss_radio_priority: %d\n", ar->nss.if_num, scheme_id, nss_radio_priority);
++
+ 	wlmsg = kzalloc(sizeof(struct nss_wifili_msg), GFP_ATOMIC);
+ 	if (!wlmsg) {
+ 		ret = -ENOMEM;
+@@ -2022,6 +2037,7 @@ int ath11k_nss_pdev_init(struct ath11k_b
+ 	pdevmsg->lmac_id = ar->lmac_id;
+ 	pdevmsg->target_pdev_id = ar->pdev->pdev_id;
+ 	pdevmsg->num_rx_swdesc = WIFILI_RX_DESC_POOL_WEIGHT * DP_RXDMA_BUF_RING_SIZE;
++	pdevmsg->scheme_id = scheme_id;
+ 
+ 	/* Store rxdma ring info to the message */
+ 	refill_ring_id = ar->dp.rx_refill_buf_ring.refill_buf_ring.ring_id;
+@@ -2315,6 +2331,9 @@ int ath11k_nss_pdev_deinit(struct ath11k
+ 	/* pdev deinit msg success, dealloc, deregister and return */
+ 	ret = 0;
+ 
++	/* reset thread scheme*/
++	nss_wifili_thread_scheme_dealloc(ab->nss.ctx, ar->nss.if_num);
++
+ 	nss_dynamic_interface_dealloc_node(ar->nss.if_num, dyn_if_type);
+ 	nss_unregister_wifili_radio_if(ar->nss.if_num);
+ free:
+--- a/drivers/net/wireless/ath/ath11k/nss.h
++++ b/drivers/net/wireless/ath/ath11k/nss.h
+@@ -61,6 +61,7 @@ struct hal_rx_user_status;
+ /* Init Flags */
+ #define WIFILI_NSS_CCE_DISABLED 0x1
+ #define WIFILI_ADDTL_MEM_SEG_SET 0x000000002
++#define WIFILI_MULTISOC_THREAD_MAP_ENABLE 0x10
+ 
+ /* ATH11K NSS PEER Info */
+ /* Host memory allocated for peer info storage in nss */
+@@ -108,6 +109,8 @@ enum ath11k_nss_vdev_cmd {
+ 	ATH11K_NSS_WIFI_VDEV_DECAP_TYPE_CMD,
+ };
+ 
++#define WIFILI_SCHEME_ID_INVALID	-1
++
+ enum ath11k_nss_opmode {
+ 	ATH11K_NSS_OPMODE_UNKNOWN,
+ 	ATH11K_NSS_OPMODE_AP,
diff --git a/package/kernel/mac80211/patches/ath11k_nss/318-ath11k-avoid-stack-corrupt-in-nwifi-undecap.patch b/package/kernel/mac80211/patches/ath11k_nss/318-ath11k-avoid-stack-corrupt-in-nwifi-undecap.patch
new file mode 100644
index 00000000000000..9189729b77f595
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/318-ath11k-avoid-stack-corrupt-in-nwifi-undecap.patch
@@ -0,0 +1,11 @@
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.h
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.h
+@@ -9,7 +9,7 @@
+ #include "rx_desc.h"
+ #include "debug.h"
+ 
+-#define DP_MAX_NWIFI_HDR_LEN	30
++#define DP_MAX_NWIFI_HDR_LEN	36
+ 
+ #define DP_RX_MPDU_ERR_FCS			BIT(0)
+ #define DP_RX_MPDU_ERR_DECRYPT			BIT(1)
diff --git a/package/kernel/mac80211/patches/ath11k_nss/319-ath11k-fix-double-free-of-peer-rx_tid-during-reo-cmd.patch b/package/kernel/mac80211/patches/ath11k_nss/319-ath11k-fix-double-free-of-peer-rx_tid-during-reo-cmd.patch
new file mode 100644
index 00000000000000..7ea6b471e340aa
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/319-ath11k-fix-double-free-of-peer-rx_tid-during-reo-cmd.patch
@@ -0,0 +1,40 @@
+From 210b20357989ace8bb5c861b37e25b6c986c816d Mon Sep 17 00:00:00 2001
+From: Sathishkumar Muruganandam <murugana@codeaurora.org>
+Date: Thu, 1 Jul 2021 13:08:54 +0530
+Subject: [PATCH] ath11k: fix double free of peer rx_tid during reo cmd failure
+
+Peer rx_tid is locally copied thrice during peer_rx_tid_cleanup to send
+REO_CMD_UPDATE_RX_QUEUE followed by REO_CMD_FLUSH_CACHE to flush all
+aged REO descriptors from HW cache.
+
+When sending REO_CMD_FLUSH_CACHE fails, we do dma unmap of already
+mapped rx_tid->vaddr and free it. This is not checked during
+reo_cmd_list_cleanup() and dp_reo_cmd_free() before trying to free and
+unmap again.
+
+Fix this by setting rx_tid->vaddr NULL in rx tid delete and also wherever
+freeing it to check in reo_cmd_list_cleanup() and reo_cmd_free() before
+trying to free again.
+
+Prevent REO cmd failures causing double free by increasing REO cmd
+ring size and moving REO status ring mask to IRQ group 3 from group
+0 to separate from tx completion ring on IRQ group 0 which may delay
+reo status processing.
+
+Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/dp.h    |  2 +-
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 66 ++++++++++++++++++-------
+ drivers/net/wireless/ath/ath11k/hw.c    |  1 +
+ 3 files changed, 49 insertions(+), 20 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -1435,6 +1435,7 @@ const struct ath11k_hw_ring_mask ath11k_
+ 		ATH11K_RX_WBM_REL_RING_MASK_0,
+ 	},
+ 	.reo_status = {
++		0, 0, 0,
+ 		ATH11K_REO_STATUS_RING_MASK_0,
+ 	},
+ 	.rxdma2host = {
diff --git a/package/kernel/mac80211/patches/ath11k_nss/335-0005-mac80211-simple-tx-for-AP-mode.patch b/package/kernel/mac80211/patches/ath11k_nss/335-0005-mac80211-simple-tx-for-AP-mode.patch
new file mode 100644
index 00000000000000..d859d038003196
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/335-0005-mac80211-simple-tx-for-AP-mode.patch
@@ -0,0 +1,99 @@
+From 190652ce1b56a41ed3a99d9f9c9160deba34810b Mon Sep 17 00:00:00 2001
+From: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
+Date: Thu, 18 Nov 2021 12:28:31 +0530
+Subject: [PATCH] mac80211: simple tx for AP mode
+
+Introduced new API ieee80211_8023_xmit_ap to make tx simple and
+to avoid unnecessary checks for AP mode.
+
+Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
+Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
+---
+ net/mac80211/tx.c | 40 ++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 40 insertions(+)
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -4748,6 +4748,70 @@ out_free:
+ 	kfree_skb(skb);
+ }
+ 
++void ieee80211_8023_xmit_ap(struct ieee80211_sub_if_data *sdata,
++			    struct net_device *dev, struct sta_info *sta,
++			    struct ieee80211_key *key, struct sk_buff *skb)
++{
++	struct ieee80211_tx_info *info;
++	struct ieee80211_local *local = sdata->local;
++	struct ieee80211_sta *pubsta = NULL;
++	struct ieee80211_tx_control control = {};
++	unsigned long flags;
++	int q;
++	u16 q_map;
++
++	/*
++	 * If the skb is shared we need to obtain our own copy.
++	 */
++	skb = skb_share_check(skb, GFP_ATOMIC);
++
++	if (unlikely(!skb))
++		return;
++
++	info = IEEE80211_SKB_CB(skb);
++	memset(info, 0, sizeof(*info));
++
++	if (unlikely(skb->sk &&
++		     skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS))
++		info->ack_frame_id = ieee80211_store_ack_skb(local, skb,
++							     &info->flags, NULL);
++
++	info->flags |= IEEE80211_TX_CTL_HW_80211_ENCAP;
++	info->control.vif = &sdata->vif;
++
++	if (key)
++		info->control.hw_key = &key->conf;
++
++	q_map = skb_get_queue_mapping(skb);
++	q = sdata->vif.hw_queue[q_map];
++
++	if (sta) {
++		sta->deflink.tx_stats.bytes[q_map] += skb->len;
++		sta->deflink.tx_stats.packets[q_map]++;
++		atomic_inc(&sta->tx_netif_pkts);
++	}
++
++	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
++
++	if (local->queue_stop_reasons[q] || !skb_queue_empty(&local->pending[q])) {
++		skb_queue_tail(&local->pending[q], skb);
++		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
++		return;
++	}
++
++	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
++
++	if (sta && sta->uploaded)
++		pubsta = &sta->sta;
++
++	control.sta = pubsta;
++
++	drv_tx(local, &control, skb);
++
++	if (sta)
++		atomic_inc(&sta->tx_drv_pkts);
++}
++
+ netdev_tx_t ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
+ 					    struct net_device *dev)
+ {
+@@ -4787,6 +4851,11 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+ 	if (key && (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)))
+ 		goto skip_offload;
+ 
++	if (sdata->vif.type == NL80211_IFTYPE_AP) {
++		ieee80211_8023_xmit_ap(sdata, dev, sta, key, skb);
++		goto out;
++	}
++
+ 	sk_pacing_shift_update(skb->sk, sdata->local->hw.tx_sk_pacing_shift);
+ tx_offload:
+ 	ieee80211_8023_xmit(sdata, dev, sta, key, skb);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/336-ath11k-skip-status-ring-entry-processing.patch b/package/kernel/mac80211/patches/ath11k_nss/336-ath11k-skip-status-ring-entry-processing.patch
new file mode 100644
index 00000000000000..2e874d321d0ad1
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/336-ath11k-skip-status-ring-entry-processing.patch
@@ -0,0 +1,191 @@
+From 0e79fe8c6937e080816230892d5382af5a5a86c6 Mon Sep 17 00:00:00 2001
+From: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
+Date: Mon, 29 Nov 2021 11:07:53 +0530
+Subject: [PATCH] ath11k: skip status ring entry processing
+
+If STATUS_BUFFER_DONE is not set for a monitor status ring entry,
+we don't process the status ring until STATUS_BUFFER_DONE set
+for that status ring entry.
+
+During LMAC reset it may happnen that HW will not write
+STATUS_BUFFER_DONE tlv in status buffer, in that case we end up
+waiting for STATUS_BUFFER_DONE leading to backpressure on monitor
+status ring.
+
+As per MAC team's suggestion, when HP + 1 entry is peeked and if DMA
+is not done and if HP + 2 entry's DMA done is set,
+replenish HP + 1 entry and start processing in next interrupt.
+If HP + 2 entry's DMA done is not set,
+poll onto HP + 1 entry DMA done to be set.
+
+Also, During monitor attach HP points to the end of the ring and TP
+points to the start of the ring. Using ath11k_hal_srng_src_peek()
+may result in processing invali buffer for the very first interrupt.
+Since, HW starts writing buffer from TP.
+
+Hence, replaced ath11k_hal_srng_src_peek() with
+ath11k_hal_srng_src_next_peek().
+
+Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 92 ++++++++++++++++++++++++++++-----
+ drivers/net/wireless/ath/ath11k/hal.c   | 30 +++++++++++
+ drivers/net/wireless/ath/ath11k/hal.h   |  4 ++
+ 3 files changed, 113 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -3296,6 +3296,46 @@ ath11k_dp_rx_mon_update_status_buf_state
+ 	}
+ }
+ 
++enum dp_mon_status_buf_state
++dp_rx_mon_handle_status_buf_done(struct ath11k_base *ab, struct hal_srng *srng,
++				 struct dp_rxdma_ring *rx_ring)
++{
++	void *status_desc;
++	struct sk_buff *skb;
++	struct ath11k_skb_rxcb *rxcb;
++	struct hal_tlv_hdr *tlv;
++	dma_addr_t paddr;
++	u32 cookie;
++	int buf_id;
++	u8 rbm;
++
++	status_desc = ath11k_hal_srng_src_next_peek(ab, srng);
++	if (!status_desc)
++		return DP_MON_STATUS_NO_DMA;
++
++	ath11k_hal_rx_buf_addr_info_get(status_desc, &paddr, &cookie, &rbm);
++
++	buf_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_BUF_ID, cookie);
++
++	spin_lock_bh(&rx_ring->idr_lock);
++	skb = idr_find(&rx_ring->bufs_idr, buf_id);
++	spin_unlock_bh(&rx_ring->idr_lock);
++
++	if (!skb)
++		return DP_MON_STATUS_NO_DMA;
++
++	rxcb = ATH11K_SKB_RXCB(skb);
++	dma_sync_single_for_cpu(ab->dev, rxcb->paddr,
++			skb->len + skb_tailroom(skb),
++			DMA_FROM_DEVICE);
++
++	tlv = (struct hal_tlv_hdr *)skb->data;
++	if (FIELD_GET(HAL_TLV_HDR_TAG, tlv->tl) != HAL_RX_STATUS_BUFFER_DONE)
++		return DP_MON_STATUS_NO_DMA;
++
++	return DP_MON_STATUS_REPLINISH;
++}
++
+ static int ath11k_dp_rx_reap_mon_status_ring(struct ath11k_base *ab, int mac_id,
+ 					     int *budget, struct sk_buff_head *skb_list)
+ {
+@@ -3309,6 +3349,7 @@ static int ath11k_dp_rx_reap_mon_status_
+ 	struct sk_buff *skb;
+ 	struct ath11k_skb_rxcb *rxcb;
+ 	struct hal_tlv_hdr *tlv;
++	enum dp_mon_status_buf_state reap_status;
+ 	u32 cookie;
+ 	int buf_id, srng_id;
+ 	dma_addr_t paddr;
+@@ -3328,8 +3369,7 @@ static int ath11k_dp_rx_reap_mon_status_
+ 	ath11k_hal_srng_access_begin(ab, srng);
+ 	while (*budget) {
+ 		*budget -= 1;
+-		rx_mon_status_desc =
+-			ath11k_hal_srng_src_peek(ab, srng);
++		rx_mon_status_desc = ath11k_hal_srng_src_peek(ab, srng);
+ 		if (!rx_mon_status_desc) {
+ 			pmon->buf_state = DP_MON_STATUS_REPLINISH;
+ 			break;
+@@ -3360,18 +3400,43 @@ static int ath11k_dp_rx_reap_mon_status_
+ 			tlv = (struct hal_tlv_hdr *)skb->data;
+ 			if (FIELD_GET(HAL_TLV_HDR_TAG, tlv->tl) !=
+ 					HAL_RX_STATUS_BUFFER_DONE) {
+-				ath11k_warn(ab, "mon status DONE not set %lx, buf_id %d\n",
+-					    FIELD_GET(HAL_TLV_HDR_TAG,
+-						      tlv->tl), buf_id);
+-				/* If done status is missing, hold onto status
+-				 * ring until status is done for this status
+-				 * ring buffer.
+-				 * Keep HP in mon_status_ring unchanged,
+-				 * and break from here.
+-				 * Check status for same buffer for next time
++				/* RxDMA status done bit might not be set even
++				 * though tp is moved by HW.
+ 				 */
+-				pmon->buf_state = DP_MON_STATUS_NO_DMA;
+-				break;
++
++				/* If done status is missing:
++				 * 1. As per MAC team's suggestion,
++				 *    when HP + 1 entry is peeked and if DMA
++				 *    is not done and if HP + 2 entry's DMA done
++				 *    is set. skip HP + 1 entry and
++				 *    start processing in next interrupt.
++				 * 2. If HP + 2 entry's DMA done is not set,
++				 *    poll onto HP + 1 entry DMA done to be set.
++				 *    Check status for same buffer for next time
++				 *    dp_rx_mon_status_srng_process
++				 */
++
++				reap_status = dp_rx_mon_handle_status_buf_done(ab, srng,
++									       rx_ring);
++				if (reap_status == DP_MON_STATUS_NO_DMA) {
++					continue;
++				} else if (reap_status == DP_MON_STATUS_REPLINISH) {
++					ath11k_warn(ab, "mon status DONE not set %lx, buf_id %d\n",
++						    FIELD_GET(HAL_TLV_HDR_TAG, tlv->tl),
++						    buf_id);
++
++					spin_lock_bh(&rx_ring->idr_lock);
++					idr_remove(&rx_ring->bufs_idr, buf_id);
++					spin_unlock_bh(&rx_ring->idr_lock);
++
++					dma_unmap_single(ab->dev, rxcb->paddr,
++							 skb->len + skb_tailroom(skb),
++							 DMA_FROM_DEVICE);
++
++					dev_kfree_skb_any(skb);
++					pmon->buf_state = DP_MON_STATUS_REPLINISH;
++					goto move_next;
++				}
+ 			}
+ 
+ 			spin_lock_bh(&rx_ring->idr_lock);
+--- a/drivers/net/wireless/ath/ath11k/hal.c
++++ b/drivers/net/wireless/ath/ath11k/hal.c
+@@ -837,6 +837,20 @@ u32 *ath11k_hal_srng_src_get_next_reaped
+ 	return desc;
+ }
+ 
++u32 *ath11k_hal_srng_src_next_peek(struct ath11k_base *ab, struct hal_srng *srng)
++{
++	u32 next_hp;
++
++	lockdep_assert_held(&srng->lock);
++
++	next_hp = (srng->u.src_ring.hp + srng->entry_size) % srng->ring_size;
++
++	if (next_hp != srng->u.src_ring.cached_tp)
++		return srng->ring_base_vaddr + next_hp;
++
++	return NULL;
++}
++
+ u32 *ath11k_hal_srng_src_peek(struct ath11k_base *ab, struct hal_srng *srng)
+ {
+ 	lockdep_assert_held(&srng->lock);
+--- a/drivers/net/wireless/ath/ath11k/hal.h
++++ b/drivers/net/wireless/ath/ath11k/hal.h
+@@ -953,6 +953,8 @@ int ath11k_hal_srng_dst_num_free(struct
+ void ath11k_hal_srng_dst_invalidate_entry(struct ath11k_base *ab,
+ 					  struct hal_srng *srng, int entries);
+ u32 *ath11k_hal_srng_src_peek(struct ath11k_base *ab, struct hal_srng *srng);
++u32 *ath11k_hal_srng_src_next_peek(struct ath11k_base *ab,
++				   struct hal_srng *srng);
+ u32 *ath11k_hal_srng_src_get_next_reaped(struct ath11k_base *ab,
+ 					 struct hal_srng *srng);
+ u32 *ath11k_hal_srng_src_reap_next(struct ath11k_base *ab,
diff --git a/package/kernel/mac80211/patches/ath11k_nss/342-ath11k-provide-access-of-the-dma-buffer-back-to-dma-.patch b/package/kernel/mac80211/patches/ath11k_nss/342-ath11k-provide-access-of-the-dma-buffer-back-to-dma-.patch
new file mode 100644
index 00000000000000..db779080b71f96
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/342-ath11k-provide-access-of-the-dma-buffer-back-to-dma-.patch
@@ -0,0 +1,28 @@
+From a12157095a8a59eeaeb7c9efe70495288140159c Mon Sep 17 00:00:00 2001
+From: Hari Chandrakanthan <quic_haric@quicinc.com>
+Date: Mon, 10 Jan 2022 12:38:10 +0530
+Subject: [PATCH] ath11k: provide access of the dma buffer back to dma device
+
+In ath11k_dbring_bufs_replenish, after accessing paddr which is a member of
+ath11k_dbring_element, provide the access of the buffer back to
+dma device by using dma_sync_single_for_device.
+
+Also the gfp flag to used inside ath11k_dbring_fill_bufs is changed
+from GFP_KERNEL to GFP_ATOMIC as the buffers are allocated inside spin lock.
+
+Signed-off-by: Hari Chandrakanthan <quic_haric@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/dbring.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dbring.c
++++ b/drivers/net/wireless/ath/ath11k/dbring.c
+@@ -80,6 +80,8 @@ static int ath11k_dbring_bufs_replenish(
+ 
+ 	buff->paddr = paddr;
+ 
++	dma_sync_single_for_device(ab->dev, paddr, ring->buf_sz, DMA_FROM_DEVICE);
++
+ 	cookie = FIELD_PREP(DP_RXDMA_BUF_COOKIE_PDEV_ID, ar->pdev_idx) |
+ 		 FIELD_PREP(DP_RXDMA_BUF_COOKIE_BUF_ID, buf_id);
+ 
diff --git a/package/kernel/mac80211/patches/ath11k_nss/342-mac80211-fix-unconditional-sta-usage.patch b/package/kernel/mac80211/patches/ath11k_nss/342-mac80211-fix-unconditional-sta-usage.patch
new file mode 100644
index 00000000000000..e4890a3654c3b3
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/342-mac80211-fix-unconditional-sta-usage.patch
@@ -0,0 +1,50 @@
+From 479096a023928cc75aa38953b7170a8984acd0da Mon Sep 17 00:00:00 2001
+From: Tamizh Chelvam <quic_tamizhr@quicinc.com>
+Date: Tue, 11 Jan 2022 14:04:09 +0530
+Subject: [PATCH] mac80211: Fix kernel panic due to unsafe sta usage
+
+Observing below crash in dynamic vlan scneario when
+abruptly killing hostapd while ping or any traffic to stations
+are going on.
+
+[  753.307213] Unable to handle kernel NULL pointer dereference at virtual address 0000058c
+[  753.309137] pgd = 7514769a
+[  753.317392] [0000058c] *pgd=00000000
+[  753.319892] Internal error: Oops: 5 [#1] PREEMPT SMP ARM
+[  753.604280] PC is at __ieee80211_subif_start_xmit+0xc58/0xe48 [mac80211]
+[  753.608954] LR is at __ieee80211_subif_start_xmit+0xc3c/0xe48 [mac80211]
+[  753.615729] pc : [<a18b0718>]    lr : [<a18b06fc>]    psr: 40000013
+[  753.622411] sp : 843b5940  ip : 98e7d348  fp : 99463e42
+[  753.628398] r10: 98e7d318  r9 : 92d0e000  r8 : 00000000
+[  753.633606] r7 : 963c8d20  r6 : 92d0e580  r5 : 00000000  r4 : 98e7d300
+[  753.638819] r3 : 00000163  r2 : fffffff0  r1 : 00000000  r0 : 98e7d318
+[  753.645416] Flags: nZcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
+[  753.651928] Control: 10c0383d  Table: 5db8806a  DAC: 00000055
+[  753.659135] Process ping (pid: 4436, stack limit = 0xf466aee4)
+
+Its due to accessing the sta pointer
+unconditionally. Fix that by checking sta pointer is
+available or not before using.
+
+Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
+---
+ net/mac80211/tx.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -4725,12 +4725,12 @@ static void ieee80211_8023_xmit(struct i
+ 
+ 	if (unlikely(skb->sk &&
+ 		     skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS &&
+-		     !ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD)))
++		     !ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD) && sta))
+ 		info->ack_frame_id = ieee80211_store_ack_skb(local, skb,
+ 							     &info->flags, NULL);
+ 
+ 	ieee80211_tx_stats(dev, len);
+-	if (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD)) {
++	if (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD) && sta) {
+ 		sta->deflink.tx_stats.packets[queue] += skbs;
+ 		sta->deflink.tx_stats.bytes[queue] += len;
+ 	}
diff --git a/package/kernel/mac80211/patches/ath11k_nss/357-ath11k-fix-clear-peer-keys-during-disassoc.patch b/package/kernel/mac80211/patches/ath11k_nss/357-ath11k-fix-clear-peer-keys-during-disassoc.patch
new file mode 100644
index 00000000000000..5050192acc64ae
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/357-ath11k-fix-clear-peer-keys-during-disassoc.patch
@@ -0,0 +1,50 @@
+From 451cd8d4f107750d86a51c3cf750015676991d17 Mon Sep 17 00:00:00 2001
+From: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Date: Thu, 11 Aug 2022 21:27:16 +0530
+Subject: [PATCH] ath11k: fix clearing peer keys during sta state auth to assoc
+
+During station state change from AUTHORIZED to ASSOC, driver must clear its key
+from hw. Ath11k clearing the keys during ASSOC to AUTH which is not a
+valid sequence and there is a chance of accessing ptr after free.
+
+Clear the peer keys while the state of station changes from AUTHORIZED
+to ASSOC.
+
+Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 37 ++++++++++++++++++++---------------
+ 1 file changed, 21 insertions(+), 16 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -4708,12 +4708,6 @@ static int ath11k_station_disassoc(struc
+ 			return ret;
+ 	}
+ 
+-	ret = ath11k_clear_peer_keys(arvif, sta->addr);
+-	if (ret) {
+-		ath11k_warn(ar->ab, "failed to clear all peer keys for vdev %i: %d\n",
+-			    arvif->vdev_id, ret);
+-		return ret;
+-	}
+ 	return 0;
+ }
+ 
+@@ -5176,6 +5170,17 @@ static int ath11k_mac_op_sta_state(struc
+ 		arsta->bw = ath11k_mac_ieee80211_sta_bw_to_wmi(ar, sta);
+ 		arsta->bw_prev = arsta->bw;
+ 		spin_unlock_bh(&ar->data_lock);
++
++		/* Driver should clear the peer keys during mac80211's ref ptr
++		 * gets cleared in __sta_info_destroy_part2 (trans from
++		 * IEEE80211_STA_AUTHORIZED to IEEE80211_STA_ASSOC)
++		 */
++		ret = ath11k_clear_peer_keys(arvif, sta->addr);
++		if (ret) {
++			ath11k_warn(ar->ab, "failed to clear all peer keys for vdev %i: %d\n",
++					arvif->vdev_id, ret);
++			return ret;
++		}
+ 	} else if (old_state == IEEE80211_STA_ASSOC &&
+ 		   new_state == IEEE80211_STA_AUTHORIZED) {
+ 		spin_lock_bh(&ar->ab->base_lock);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/359-ath11k-fix-tkip-encryption-traffic-failure.patch b/package/kernel/mac80211/patches/ath11k_nss/359-ath11k-fix-tkip-encryption-traffic-failure.patch
new file mode 100644
index 00000000000000..d8c907556645cf
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/359-ath11k-fix-tkip-encryption-traffic-failure.patch
@@ -0,0 +1,25 @@
+From e4f2f898dcbe2bf82b9e8fb4f3d306c98d82e5bd Mon Sep 17 00:00:00 2001
+From: Ramya Gnanasekar <quic_rgnanase@quicinc.com>
+Date: Wed, 7 Dec 2022 17:29:50 +0530
+Subject: [PATCH] ath11k: fix tkip encryption traffic failure
+
+Fast rx is not assigned in case of TKIP cipher and hence
+packets are dropped in fast path.
+
+Handle the rx decap for TKIP so frames will be handled in
+normal rx path.
+
+Signed-off-by: Ramya Gnanasekar <quic_rgnanase@quicinc.com>
+
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -2364,7 +2364,8 @@ static void ath11k_dp_rx_h_undecap(struc
+ 		ehdr = (struct ethhdr *)msdu->data;
+ 
+ 		/* mac80211 allows fast path only for authorized STA */
+-		if (ehdr->h_proto == cpu_to_be16(ETH_P_PAE)) {
++		if (ehdr->h_proto == cpu_to_be16(ETH_P_PAE) ||
++		    enctype == HAL_ENCRYPT_TYPE_TKIP_MIC) {
+ 			ATH11K_SKB_RXCB(msdu)->is_eapol = true;
+ 			ath11k_dp_rx_h_undecap_eth(ar, msdu, first_hdr,
+ 						   enctype, status);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/376-ath11k-Add-nss-event-handler-support-for-link-desc.patch b/package/kernel/mac80211/patches/ath11k_nss/376-ath11k-Add-nss-event-handler-support-for-link-desc.patch
new file mode 100644
index 00000000000000..7b3df32c05b69e
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/376-ath11k-Add-nss-event-handler-support-for-link-desc.patch
@@ -0,0 +1,73 @@
+From 69356d5f6947c8a6182e1c6283478ad40c6df37b Mon Sep 17 00:00:00 2001
+From: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
+Date: Wed, 21 Jun 2023 20:26:02 +0530
+Subject: [PATCH] ath11k: Add nss event handler support for link desc
+
+Add NSS event handler support for NSS_WIFILI_LINK_DESC_INFO_MSG.
+This event will be given to host from NSS for releasing
+link descriptor which used for fragmentation. This needs to be
+handled to release the link descriptor back to hardware for
+other usage.
+
+Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/nss.c | 43 +++++++++++++++++++++++++++
+ 1 file changed, 43 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/nss.c
++++ b/drivers/net/wireless/ath/ath11k/nss.c
+@@ -72,6 +72,43 @@ static void ath11k_nss_wifili_stats_sync
+ 	spin_unlock_bh(&ab->base_lock);
+ }
+ 
++static void ath11k_nss_wifili_link_desc_set(struct ath11k_base *ab, void *desc,
++					    struct ath11k_buffer_addr *buf_addr_info,
++					    enum hal_wbm_rel_bm_act action)
++{
++	struct hal_wbm_release_ring *dst_desc = desc;
++
++	dst_desc->buf_addr_info = *buf_addr_info;
++	dst_desc->info0 |= FIELD_PREP(HAL_WBM_RELEASE_INFO0_REL_SRC_MODULE,
++				      HAL_WBM_REL_SRC_MODULE_SW) |
++			   FIELD_PREP(HAL_WBM_RELEASE_INFO0_BM_ACTION, action) |
++			   FIELD_PREP(HAL_WBM_RELEASE_INFO0_DESC_TYPE,
++				      HAL_WBM_REL_DESC_TYPE_MSDU_LINK);
++}
++
++static void ath11k_nss_wifili_link_desc_return(struct ath11k_base *ab,
++					       struct ath11k_buffer_addr *buf_addr_info)
++{
++	struct ath11k_dp *dp = &ab->dp;
++	struct hal_srng *srng;
++	u32 *desc;
++
++	srng = &ab->hal.srng_list[dp->wbm_desc_rel_ring.ring_id];
++	spin_lock_bh(&srng->lock);
++
++	ath11k_hal_srng_access_begin(ab, srng);
++	desc = ath11k_hal_srng_src_get_next_entry(ab, srng);
++
++	if (!desc)
++		goto exit;
++
++	ath11k_nss_wifili_link_desc_set(ab, desc, buf_addr_info, HAL_WBM_REL_BM_ACT_PUT_IN_IDLE);
++
++exit:
++	ath11k_hal_srng_access_end(ab, srng);
++	spin_unlock(&srng->lock);
++}
++
+ static void ath11k_nss_get_peer_stats(struct ath11k_base *ab, struct nss_wifili_peer_stats *stats)
+ {
+ 	struct ath11k_peer *peer;
+@@ -307,6 +344,10 @@ void ath11k_nss_wifili_event_receive(str
+ 	case NSS_WIFILI_TID_REOQ_SETUP_MSG:
+ 		/* TODO setup tidq */
+ 		break;
++	case NSS_WIFILI_LINK_DESC_INFO_MSG:
++		ath11k_nss_wifili_link_desc_return(ab,
++						   (void *)&msg->msg.linkdescinfomsg);
++		break;
+ 	default:
+ 		ath11k_dbg(ab, ATH11K_DBG_NSS, "unhandled event %d\n", msg_type);
+ 		break;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch b/package/kernel/mac80211/patches/ath11k_nss/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
new file mode 100644
index 00000000000000..2d1fbc097df375
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
@@ -0,0 +1,85 @@
+From 11d0cce62afc157468e1d97ea80a2510091ea2c2 Mon Sep 17 00:00:00 2001
+From: P Praneesh <quic_ppranees@quicinc.com>
+Date: Fri, 1 Jul 2022 11:57:00 +0530
+Subject: [PATCH] mac80211: Remove unused RX_FLAGS from mac80211_rx_flags
+
+Remove unused RX_FLAG_AMPDU_DELIM_CRC_KNOWN flag from
+mac80211_rx_flags to provide space for new EHT flags.
+
+Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
+---
+ include/net/mac80211.h | 33 +++++++++++++++------------------
+ net/mac80211/rx.c      |  7 +------
+ 2 files changed, 16 insertions(+), 24 deletions(-)
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1385,8 +1385,6 @@ ieee80211_tx_info_clear_status(struct ie
+  * @RX_FLAG_AMPDU_IS_LAST: this subframe is the last subframe of the A-MPDU
+  * @RX_FLAG_AMPDU_DELIM_CRC_ERROR: A delimiter CRC error has been detected
+  *	on this subframe
+- * @RX_FLAG_AMPDU_DELIM_CRC_KNOWN: The delimiter CRC field is known (the CRC
+- *	is stored in the @ampdu_delimiter_crc field)
+  * @RX_FLAG_MIC_STRIPPED: The mic was stripped of this packet. Decryption was
+  *	done by the hardware
+  * @RX_FLAG_ONLY_MONITOR: Report frame only to monitor interfaces without
+@@ -1458,22 +1456,21 @@ enum mac80211_rx_flags {
+ 	RX_FLAG_AMPDU_LAST_KNOWN	= BIT(12),
+ 	RX_FLAG_AMPDU_IS_LAST		= BIT(13),
+ 	RX_FLAG_AMPDU_DELIM_CRC_ERROR	= BIT(14),
+-	RX_FLAG_AMPDU_DELIM_CRC_KNOWN	= BIT(15),
+-	RX_FLAG_MACTIME_END		= BIT(16),
+-	RX_FLAG_ONLY_MONITOR		= BIT(17),
+-	RX_FLAG_SKIP_MONITOR		= BIT(18),
+-	RX_FLAG_AMSDU_MORE		= BIT(19),
+-	RX_FLAG_RADIOTAP_TLV_AT_END	= BIT(20),
+-	RX_FLAG_MIC_STRIPPED		= BIT(21),
+-	RX_FLAG_ALLOW_SAME_PN		= BIT(22),
+-	RX_FLAG_ICV_STRIPPED		= BIT(23),
+-	RX_FLAG_AMPDU_EOF_BIT		= BIT(24),
+-	RX_FLAG_AMPDU_EOF_BIT_KNOWN	= BIT(25),
+-	RX_FLAG_RADIOTAP_HE		= BIT(26),
+-	RX_FLAG_RADIOTAP_HE_MU		= BIT(27),
+-	RX_FLAG_RADIOTAP_LSIG		= BIT(28),
+-	RX_FLAG_NO_PSDU			= BIT(29),
+-	RX_FLAG_8023			= BIT(30),
++	RX_FLAG_MACTIME_END             = BIT(15),
++	RX_FLAG_ONLY_MONITOR            = BIT(16),
++	RX_FLAG_SKIP_MONITOR            = BIT(17),
++	RX_FLAG_AMSDU_MORE              = BIT(18),
++	RX_FLAG_RADIOTAP_TLV_AT_END     = BIT(19),
++	RX_FLAG_MIC_STRIPPED            = BIT(20),
++	RX_FLAG_ALLOW_SAME_PN           = BIT(21),
++	RX_FLAG_ICV_STRIPPED            = BIT(22),
++	RX_FLAG_AMPDU_EOF_BIT           = BIT(23),
++	RX_FLAG_AMPDU_EOF_BIT_KNOWN     = BIT(24),
++	RX_FLAG_RADIOTAP_HE             = BIT(25),
++	RX_FLAG_RADIOTAP_HE_MU          = BIT(26),
++	RX_FLAG_RADIOTAP_LSIG           = BIT(27),
++	RX_FLAG_NO_PSDU                 = BIT(28),
++	RX_FLAG_8023                    = BIT(29),
+ };
+ 
+ /**
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -527,18 +527,13 @@ ieee80211_add_rx_radiotap_header(struct
+ 			flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
+ 		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
+ 			flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
+-		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
+-			flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN;
+ 		if (status->flag & RX_FLAG_AMPDU_EOF_BIT_KNOWN)
+ 			flags |= IEEE80211_RADIOTAP_AMPDU_EOF_KNOWN;
+ 		if (status->flag & RX_FLAG_AMPDU_EOF_BIT)
+ 			flags |= IEEE80211_RADIOTAP_AMPDU_EOF;
+ 		put_unaligned_le16(flags, pos);
+ 		pos += 2;
+-		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
+-			*pos++ = status->ampdu_delimiter_crc;
+-		else
+-			*pos++ = 0;
++		*pos++ = 0;
+ 		*pos++ = 0;
+ 	}
+ 
diff --git a/package/kernel/mac80211/patches/ath11k_nss/640-006-mac80211-add-eht-radiotap.patch b/package/kernel/mac80211/patches/ath11k_nss/640-006-mac80211-add-eht-radiotap.patch
new file mode 100644
index 00000000000000..b8d2b614dd4759
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/640-006-mac80211-add-eht-radiotap.patch
@@ -0,0 +1,506 @@
+From f76abd98383dbd350f4e41b400beaaff2130254a Mon Sep 17 00:00:00 2001
+From: P Praneesh <quic_ppranees@quicinc.com>
+Date: Sun, 3 Jul 2022 19:31:44 +0530
+Subject: [PATCH] mac80211: add EHT radiotap header construction logic
+
+Driver advertises U_SIG and EHT info in the flag under rx_status
+structure. Based on this flag, corresponding EHT and U_SIG
+information are added in the radiotap header.
+
+Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
+---
+ include/net/ieee80211_radiotap.h | 160 +++++++++++++++++++++++++++++++++++++++
+ include/net/mac80211.h           |   9 +++
+ net/mac80211/rx.c                |  88 +++++++++++++++++++++
+ 3 files changed, 257 insertions(+)
+
+--- a/include/net/ieee80211_radiotap.h
++++ b/include/net/ieee80211_radiotap.h
+@@ -92,6 +92,11 @@ enum ieee80211_radiotap_presence {
+ 	IEEE80211_RADIOTAP_EHT = 34,
+ };
+ 
++enum ieee80211_radiotap_presence_ext {
++	IEEE80211_RADIOTAP_USIG_INFO	= 1,
++	IEEE80211_RADIOTAP_EHT_INFO	= 2,
++};
++
+ /* for IEEE80211_RADIOTAP_FLAGS */
+ enum ieee80211_radiotap_flags {
+ 	IEEE80211_RADIOTAP_F_CFP = 0x01,
+@@ -406,128 +411,6 @@ struct ieee80211_radiotap_eht_usig {
+ 	__le32 mask;
+ } __packed;
+ 
+-/* ieee80211_radiotap_eht - content of EHT tlv (type 34)
+- * see www.radiotap.org/fields/EHT.html for details
+- */
+-struct ieee80211_radiotap_eht {
+-	__le32 known;
+-	__le32 data[9];
+-	__le32 user_info[];
+-} __packed;
+-
+-/* Known field for EHT TLV
+- * The ending defines for what the field applies as following
+- * O - OFDMA (including TB), M - MU-MIMO, S - EHT sounding.
+- */
+-enum ieee80211_radiotap_eht_known {
+-	IEEE80211_RADIOTAP_EHT_KNOWN_SPATIAL_REUSE		= 0x00000002,
+-	IEEE80211_RADIOTAP_EHT_KNOWN_GI				= 0x00000004,
+-	IEEE80211_RADIOTAP_EHT_KNOWN_EHT_LTF			= 0x00000010,
+-	IEEE80211_RADIOTAP_EHT_KNOWN_LDPC_EXTRA_SYM_OM		= 0x00000020,
+-	IEEE80211_RADIOTAP_EHT_KNOWN_PRE_PADD_FACOR_OM		= 0x00000040,
+-	IEEE80211_RADIOTAP_EHT_KNOWN_PE_DISAMBIGUITY_OM		= 0x00000080,
+-	IEEE80211_RADIOTAP_EHT_KNOWN_DISREGARD_O		= 0x00000100,
+-	IEEE80211_RADIOTAP_EHT_KNOWN_DISREGARD_S		= 0x00000200,
+-	IEEE80211_RADIOTAP_EHT_KNOWN_CRC1			= 0x00002000,
+-	IEEE80211_RADIOTAP_EHT_KNOWN_TAIL1			= 0x00004000,
+-	IEEE80211_RADIOTAP_EHT_KNOWN_CRC2_O			= 0x00008000,
+-	IEEE80211_RADIOTAP_EHT_KNOWN_TAIL2_O			= 0x00010000,
+-	IEEE80211_RADIOTAP_EHT_KNOWN_NSS_S			= 0x00020000,
+-	IEEE80211_RADIOTAP_EHT_KNOWN_BEAMFORMED_S		= 0x00040000,
+-	IEEE80211_RADIOTAP_EHT_KNOWN_NR_NON_OFDMA_USERS_M	= 0x00080000,
+-	IEEE80211_RADIOTAP_EHT_KNOWN_ENCODING_BLOCK_CRC_M	= 0x00100000,
+-	IEEE80211_RADIOTAP_EHT_KNOWN_ENCODING_BLOCK_TAIL_M	= 0x00200000,
+-	IEEE80211_RADIOTAP_EHT_KNOWN_RU_MRU_SIZE_OM		= 0x00400000,
+-	IEEE80211_RADIOTAP_EHT_KNOWN_RU_MRU_INDEX_OM		= 0x00800000,
+-	IEEE80211_RADIOTAP_EHT_KNOWN_RU_ALLOC_TB_FMT		= 0x01000000,
+-	IEEE80211_RADIOTAP_EHT_KNOWN_PRIMARY_80			= 0x02000000,
+-};
+-
+-enum ieee80211_radiotap_eht_data {
+-	/* Data 0 */
+-	IEEE80211_RADIOTAP_EHT_DATA0_SPATIAL_REUSE		= 0x00000078,
+-	IEEE80211_RADIOTAP_EHT_DATA0_GI				= 0x00000180,
+-	IEEE80211_RADIOTAP_EHT_DATA0_LTF			= 0x00000600,
+-	IEEE80211_RADIOTAP_EHT_DATA0_EHT_LTF			= 0x00003800,
+-	IEEE80211_RADIOTAP_EHT_DATA0_LDPC_EXTRA_SYM_OM		= 0x00004000,
+-	IEEE80211_RADIOTAP_EHT_DATA0_PRE_PADD_FACOR_OM		= 0x00018000,
+-	IEEE80211_RADIOTAP_EHT_DATA0_PE_DISAMBIGUITY_OM		= 0x00020000,
+-	IEEE80211_RADIOTAP_EHT_DATA0_DISREGARD_S		= 0x000c0000,
+-	IEEE80211_RADIOTAP_EHT_DATA0_DISREGARD_O		= 0x003c0000,
+-	IEEE80211_RADIOTAP_EHT_DATA0_CRC1_O			= 0x03c00000,
+-	IEEE80211_RADIOTAP_EHT_DATA0_TAIL1_O			= 0xfc000000,
+-	/* Data 1 */
+-	IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE			= 0x0000001f,
+-	IEEE80211_RADIOTAP_EHT_DATA1_RU_INDEX			= 0x00001fe0,
+-	IEEE80211_RADIOTAP_EHT_DATA1_RU_ALLOC_CC_1_1_1		= 0x003fe000,
+-	IEEE80211_RADIOTAP_EHT_DATA1_RU_ALLOC_CC_1_1_1_KNOWN	= 0x00400000,
+-	IEEE80211_RADIOTAP_EHT_DATA1_PRIMARY_80			= 0xc0000000,
+-	/* Data 2 */
+-	IEEE80211_RADIOTAP_EHT_DATA2_RU_ALLOC_CC_2_1_1		= 0x000001ff,
+-	IEEE80211_RADIOTAP_EHT_DATA2_RU_ALLOC_CC_2_1_1_KNOWN	= 0x00000200,
+-	IEEE80211_RADIOTAP_EHT_DATA2_RU_ALLOC_CC_1_1_2		= 0x0007fc00,
+-	IEEE80211_RADIOTAP_EHT_DATA2_RU_ALLOC_CC_1_1_2_KNOWN	= 0x00080000,
+-	IEEE80211_RADIOTAP_EHT_DATA2_RU_ALLOC_CC_2_1_2		= 0x1ff00000,
+-	IEEE80211_RADIOTAP_EHT_DATA2_RU_ALLOC_CC_2_1_2_KNOWN	= 0x20000000,
+-	/* Data 3 */
+-	IEEE80211_RADIOTAP_EHT_DATA3_RU_ALLOC_CC_1_2_1		= 0x000001ff,
+-	IEEE80211_RADIOTAP_EHT_DATA3_RU_ALLOC_CC_1_2_1_KNOWN	= 0x00000200,
+-	IEEE80211_RADIOTAP_EHT_DATA3_RU_ALLOC_CC_2_2_1		= 0x0007fc00,
+-	IEEE80211_RADIOTAP_EHT_DATA3_RU_ALLOC_CC_2_2_1_KNOWN	= 0x00080000,
+-	IEEE80211_RADIOTAP_EHT_DATA3_RU_ALLOC_CC_1_2_2		= 0x1ff00000,
+-	IEEE80211_RADIOTAP_EHT_DATA3_RU_ALLOC_CC_1_2_2_KNOWN	= 0x20000000,
+-	/* Data 4 */
+-	IEEE80211_RADIOTAP_EHT_DATA4_RU_ALLOC_CC_2_2_2		= 0x000001ff,
+-	IEEE80211_RADIOTAP_EHT_DATA4_RU_ALLOC_CC_2_2_2_KNOWN	= 0x00000200,
+-	IEEE80211_RADIOTAP_EHT_DATA4_RU_ALLOC_CC_1_2_3		= 0x0007fc00,
+-	IEEE80211_RADIOTAP_EHT_DATA4_RU_ALLOC_CC_1_2_3_KNOWN	= 0x00080000,
+-	IEEE80211_RADIOTAP_EHT_DATA4_RU_ALLOC_CC_2_2_3		= 0x1ff00000,
+-	IEEE80211_RADIOTAP_EHT_DATA4_RU_ALLOC_CC_2_2_3_KNOWN	= 0x20000000,
+-	/* Data 5 */
+-	IEEE80211_RADIOTAP_EHT_DATA5_RU_ALLOC_CC_1_2_4		= 0x000001ff,
+-	IEEE80211_RADIOTAP_EHT_DATA5_RU_ALLOC_CC_1_2_4_KNOWN	= 0x00000200,
+-	IEEE80211_RADIOTAP_EHT_DATA5_RU_ALLOC_CC_2_2_4		= 0x0007fc00,
+-	IEEE80211_RADIOTAP_EHT_DATA5_RU_ALLOC_CC_2_2_4_KNOWN	= 0x00080000,
+-	IEEE80211_RADIOTAP_EHT_DATA5_RU_ALLOC_CC_1_2_5		= 0x1ff00000,
+-	IEEE80211_RADIOTAP_EHT_DATA5_RU_ALLOC_CC_1_2_5_KNOWN	= 0x20000000,
+-	/* Data 6 */
+-	IEEE80211_RADIOTAP_EHT_DATA6_RU_ALLOC_CC_2_2_5		= 0x000001ff,
+-	IEEE80211_RADIOTAP_EHT_DATA6_RU_ALLOC_CC_2_2_5_KNOWN	= 0x00000200,
+-	IEEE80211_RADIOTAP_EHT_DATA6_RU_ALLOC_CC_1_2_6		= 0x0007fc00,
+-	IEEE80211_RADIOTAP_EHT_DATA6_RU_ALLOC_CC_1_2_6_KNOWN	= 0x00080000,
+-	IEEE80211_RADIOTAP_EHT_DATA6_RU_ALLOC_CC_2_2_6		= 0x1ff00000,
+-	IEEE80211_RADIOTAP_EHT_DATA6_RU_ALLOC_CC_2_2_6_KNOWN	= 0x20000000,
+-	/* Data 7 */
+-	IEEE80211_RADIOTAP_EHT_DATA7_CRC2_O			= 0x0000000f,
+-	IEEE80211_RADIOTAP_EHT_DATA7_TAIL_2_O			= 0x000003f0,
+-	IEEE80211_RADIOTAP_EHT_DATA7_NSS_S			= 0x0000f000,
+-	IEEE80211_RADIOTAP_EHT_DATA7_BEAMFORMED_S		= 0x00010000,
+-	IEEE80211_RADIOTAP_EHT_DATA7_NUM_OF_NON_OFDMA_USERS	= 0x000e0000,
+-	IEEE80211_RADIOTAP_EHT_DATA7_USER_ENCODING_BLOCK_CRC	= 0x00f00000,
+-	IEEE80211_RADIOTAP_EHT_DATA7_USER_ENCODING_BLOCK_TAIL	= 0x3f000000,
+-	/* Data 8 */
+-	IEEE80211_RADIOTAP_EHT_DATA8_RU_ALLOC_TB_FMT_PS_160	= 0x00000001,
+-	IEEE80211_RADIOTAP_EHT_DATA8_RU_ALLOC_TB_FMT_B0		= 0x00000002,
+-	IEEE80211_RADIOTAP_EHT_DATA8_RU_ALLOC_TB_FMT_B7_B1	= 0x000001fc,
+-};
+-
+-enum ieee80211_radiotap_eht_user_info {
+-	IEEE80211_RADIOTAP_EHT_USER_INFO_STA_ID_KNOWN		= 0x00000001,
+-	IEEE80211_RADIOTAP_EHT_USER_INFO_MCS_KNOWN		= 0x00000002,
+-	IEEE80211_RADIOTAP_EHT_USER_INFO_CODING_KNOWN		= 0x00000004,
+-	IEEE80211_RADIOTAP_EHT_USER_INFO_NSS_KNOWN_O		= 0x00000010,
+-	IEEE80211_RADIOTAP_EHT_USER_INFO_BEAMFORMING_KNOWN_O	= 0x00000020,
+-	IEEE80211_RADIOTAP_EHT_USER_INFO_SPATIAL_CONFIG_KNOWN_M	= 0x00000040,
+-	IEEE80211_RADIOTAP_EHT_USER_INFO_DATA_FOR_USER		= 0x00000080,
+-	IEEE80211_RADIOTAP_EHT_USER_INFO_STA_ID			= 0x0007ff00,
+-	IEEE80211_RADIOTAP_EHT_USER_INFO_CODING			= 0x00080000,
+-	IEEE80211_RADIOTAP_EHT_USER_INFO_MCS			= 0x00f00000,
+-	IEEE80211_RADIOTAP_EHT_USER_INFO_NSS_O			= 0x0f000000,
+-	IEEE80211_RADIOTAP_EHT_USER_INFO_BEAMFORMING_O		= 0x20000000,
+-	IEEE80211_RADIOTAP_EHT_USER_INFO_SPATIAL_CONFIG_M	= 0x3f000000,
+-	IEEE80211_RADIOTAP_EHT_USER_INFO_RESEVED_c0000000	= 0xc0000000,
+-};
+-
+ enum ieee80211_radiotap_eht_usig_common {
+ 	IEEE80211_RADIOTAP_EHT_USIG_COMMON_PHY_VER_KNOWN	= 0x00000001,
+ 	IEEE80211_RADIOTAP_EHT_USIG_COMMON_BW_KNOWN		= 0x00000002,
+@@ -573,6 +456,161 @@ enum ieee80211_radiotap_eht_usig_tb {
+ 	IEEE80211_RADIOTAP_EHT_USIG2_TB_B20_B25_TAIL		= 0xfc000000,
+ };
+ 
++enum ieee80211_radiotap_usig_common {
++	IEEE80211_RADIOTAP_USIG_CMN_PHY_VERSION			= 0x00000001,
++	IEEE80211_RADIOTAP_USIG_CMN_BW_KNOWN			= 0x00000002,
++	IEEE80211_RADIOTAP_USIG_CMN_UL_DL_KNOWN			= 0x00000004,
++	IEEE80211_RADIOTAP_USIG_CMN_BSS_COLOR_KNOWN		= 0x00000008,
++	IEEE80211_RADIOTAP_USIG_CMN_TXOP_KNOWN			= 0x00000010,
++	IEEE80211_RADIOTAP_USIG_CMN_BAD_CRC			= 0x00000020,
++	IEEE80211_RADIOTAP_USIG_CMN_PHY_VERSION_ID		= 0x00007000,
++	IEEE80211_RADIOTAP_USIG_CMN_BW				= 0x00038000,
++	IEEE80211_RADIOTAP_USIG_CMN_UL_DL			= 0x00040000,
++	IEEE80211_RADIOTAP_USIG_CMN_BSS_COLOR			= 0x01f80000,
++	IEEE80211_RADIOTAP_USIG_CMN_TXOP			= 0xfe000000,
++};
++
++enum ieee80211_radiotap_usig_eht_mu_ppdu {
++	IEEE80211_RADIOTAP_USIG_EHT_MU_DISREGARD		= 0x0000001f,
++	IEEE80211_RADIOTAP_USIG_EHT_MU_DISREGARD_VALIDATE	= 0x00000020,
++	IEEE80211_RADIOTAP_USIG_EHT_MU_PPDU_TYPE_COMP_MODE	= 0x000000c0,
++	IEEE80211_RADIOTAP_USIG_EHT_MU_PPDU_COMP_VALIDATE	= 0x00000100,
++	IEEE80211_RADIOTAP_USIG_EHT_MU_PUNCTURED_CHAN_INFO	= 0x00003e00,
++	IEEE80211_RADIOTAP_USIG_EHT_MU_PUNCTURED_CHAN_VALIDATE	= 0x00004000,
++	IEEE80211_RADIOTAP_USIG_EHT_MU_MCS			= 0x00018000,
++	IEEE80211_RADIOTAP_USIG_EHT_MU_NUM_SYMBOLS		= 0x003e0000,
++	IEEE80211_RADIOTAP_USIG_EHT_MU_CRC			= 0x03c00000,
++	IEEE80211_RADIOTAP_USIG_EHT_MU_TAIL			= 0xfc000000,
++};
++
++enum ieee80211_radiotap_usig_eht_tb_ppdu {
++	IEEE80211_RADIOTAP_USIG_EHT_TB_DISREGARD		= 0x0000003f,
++	IEEE80211_RADIOTAP_USIG_EHT_TB_PPDU_TYPE_COMP_MODE	= 0x000000c0,
++	IEEE80211_RADIOTAP_USIG_EHT_TB_VALIDATE			= 0x00000100,
++	IEEE80211_RADIOTAP_USIG_EHT_TB_SPATIAL_REUSE1		= 0x00001e00,
++	IEEE80211_RADIOTAP_USIG_EHT_TB_SPATIAL_REUSE2		= 0x0001e000,
++	IEEE80211_RADIOTAP_USIG_EHT_TB_DISREGARD1		= 0x003e0000,
++	IEEE80211_RADIOTAP_USIG_EHT_TB_CRC			= 0x03c00000,
++	IEEE80211_RADIOTAP_USIG_EHT_TB_TAIL			= 0xfc000000,
++};
++
++struct ieee80211_radiotap_usig {
++	__le32 usig_cmn;
++	__le32 eht_mu_ppdu;
++	__le32 eht_tb_ppdu;
++};
++
++enum ieee80211_radiotap_eht_known {
++	IEEE80211_RADIOTAP_EHT_SPATIAL_REUSE_KNOWN	= 0x00000002,
++	IEEE80211_RADIOTAP_EHT_GUARD_INTERVAL_KNOWN	= 0x00000004,
++	IEEE80211_RADIOTAP_EHT_LTF_KNOWN		= 0x00000008,
++	IEEE80211_RADIOTAP_EHT_EHT_LTF_KNOWN		= 0x00000010,
++	IEEE80211_RADIOTAP_EHT_LDPC_EXTRA_SYM_SEG_KNOWN	= 0x00000020,
++	IEEE80211_RADIOTAP_EHT_PRE_FEC_PAD_FACTOR_KNOWN	= 0x00000040,
++	IEEE80211_RADIOTAP_EHT_PE_DISAMBIGUITY_KNOWN	= 0x00000080,
++	IEEE80211_RADIOTAP_EHT_DISREGARD_KNOWN		= 0x00000100,
++	IEEE80211_RADIOTAP_EHT_SOUNDING_DISREGARD_KNOWN	= 0x00000200,
++	IEEE80211_RADIOTAP_EHT_CRC1_KNOWN		= 0x00002000,
++	IEEE80211_RADIOTAP_EHT_TAIL1_KNOWN		= 0x00004000,
++	IEEE80211_RADIOTAP_EHT_CRC2_KNOWN		= 0x00008000,
++	IEEE80211_RADIOTAP_EHT_TAIL2_KNOWN		= 0x00010000,
++	IEEE80211_RADIOTAP_EHT_NSS_KNOWN		= 0x00020000,
++	IEEE80211_RADIOTAP_EHT_BEAMFORMED_KNOWN		= 0x00040000,
++	IEEE80211_RADIOTAP_EHT_NUM_NON_OFDMA_USR_KNOWN	= 0x00080000,
++	IEEE80211_RADIOTAP_EHT_USR_ENC_BLK_CRC_KNOWN	= 0x00100000,
++	IEEE80211_RADIOTAP_EHT_USR_ENC_BLK_TAIL_KNOWN	= 0x00200000,
++	IEEE80211_RADIOTAP_EHT_RU_SIZE_KNOWN		= 0x00400000,
++	IEEE80211_RADIOTAP_EHT_RU_INDEX_KNOWN		= 0x00800000,
++	IEEE80211_RADIOTAP_EHT_RU_ALLOCATION		= 0x01000000,
++	IEEE80211_RADIOTAP_EHT_PRI80_CHAN_POS_KNOWN	= 0x02000000,
++};
++
++enum ieee80211_radiotap_eht_data0 {
++	IEEE80211_RADIOTAP_EHT_DATA0_SPATIAL_REUSE		= 0x00000078,
++	IEEE80211_RADIOTAP_EHT_DATA0_GI				= 0x00000180,
++	IEEE80211_RADIOTAP_EHT_DATA0_LTF			= 0x00000600,
++	IEEE80211_RADIOTAP_EHT_DATA0_EHT_LTF			= 0x00003800,
++	IEEE80211_RADIOTAP_EHT_DATA0_LDPC_EXTRA_SYM_SEG		= 0x00004000,
++	IEEE80211_RADIOTAP_EHT_DATA0_PRE_FEC_PAD_FACTOR		= 0x00018000,
++	IEEE80211_RADIOTAP_EHT_DATA0_PE_DISAMBIGUITY		= 0x00020000,
++	IEEE80211_RADIOTAP_EHT_DATA0_DISREGARD_EHT_SOUND	= 0x000c0000,
++	IEEE80211_RADIOTAP_EHT_DATA0_DISREGARD_NON_EHT_SOUND	= 0x003c0000,
++	IEEE80211_RADIOTAP_EHT_DATA0_CRC1			= 0x03c00000,
++	IEEE80211_RADIOTAP_EHT_DATA0_TAIL1			= 0xfc000000,
++};
++
++enum ieee80211_radiotap_eht_data1 {
++	IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE			= 0x0000001f,
++		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_26			= 0,
++		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_52			= 1,
++		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_106		= 2,
++		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_242		= 3,
++		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_484		= 4,
++		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_996		= 5,
++		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_2x996		= 6,
++		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_4x996		= 7,
++		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_52P26		= 8,
++		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_106P26		= 9,
++		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_484P242		= 10,
++		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_996P484		= 11,
++		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_996P484P242	= 12,
++		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_2x996P484		= 13,
++		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_3x996		= 14,
++		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_3x996P484		= 15,
++
++	IEEE80211_RADIOTAP_EHT_DATA1_RU_INDEX			= 0x00001fe0,
++	IEEE80211_RADIOTAP_EHT_DATA1_RU_ALLOCATION1		= 0x003fe000,
++	IEEE80211_RADIOTAP_EHT_DATA1_RU_PRIMARY_80MHZ_CHAN_POS	= 0xc0000000,
++};
++
++enum ieee80211_radiotap_eht_data2_to_data6 {
++	IEEE80211_RADIOTAP_EHT_DATA2_6_RU_ALLOCATION_X		= 0x000001ff,
++	IEEE80211_RADIOTAP_EHT_DATA2_6_RU_ALLOCATION_X_KNOWN	= 0x00000200,
++	IEEE80211_RADIOTAP_EHT_DATA2_6_RU_ALLOCATION_XP1	= 0x0007fc00,
++	IEEE80211_RADIOTAP_EHT_DATA2_6_RU_ALLOCATION_XP1_KNOWN	= 0x00080000,
++	IEEE80211_RADIOTAP_EHT_DATA2_6_RU_ALLOCATION_XP2	= 0x1ff00000,
++	IEEE80211_RADIOTAP_EHT_DATA2_6_RU_ALLOCATION_XP2_KNOWN	= 0x20000000,
++};
++
++enum ieee80211_radiotap_eht_data7 {
++	IEEE80211_RADIOTAP_EHT_DATA7_CRC2			= 0x0000000f,
++	IEEE80211_RADIOTAP_EHT_DATA7_TAIL2			= 0x000003f0,
++	IEEE80211_RADIOTAP_EHT_DATA7_NSS			= 0x0000f000,
++	IEEE80211_RADIOTAP_EHT_DATA7_BEAMFORMED			= 0x00010000,
++	IEEE80211_RADIOTAP_EHT_DATA7_NUM_NON_OFDMA_USERS	= 0x000e0000,
++	IEEE80211_RADIOTAP_EHT_DATA7_USR_ENC_BLK_CRC		= 0x00f00000,
++	IEEE80211_RADIOTAP_EHT_DATA7_USR_ENC_BLK_TAIL		= 0x3f000000,
++};
++
++enum ieee80211_radiotap_eht_data8 {
++	IEEE80211_RADIOTAP_EHT_DATA8_RU_ALLOCATION_PS160	= 0x00000001,
++	IEEE80211_RADIOTAP_EHT_DATA8_RU_ALLOCATION_TB_FORMAT1	= 0x00000002,
++	IEEE80211_RADIOTAP_EHT_DATA8_RU_ALLOCATION_TB_FORMAT2	= 0x000001fc,
++};
++
++enum ieee80211_radiotap_eht_user_info {
++	IEEE80211_RADIOTAP_EHT_USER_INFO_STA_ID_KNOWN		= 0x00000001,
++	IEEE80211_RADIOTAP_EHT_USER_INFO_MCS_KNOWN		= 0x00000002,
++	IEEE80211_RADIOTAP_EHT_USER_INFO_CODING_KNOWN		= 0x00000004,
++	IEEE80211_RADIOTAP_EHT_USER_INFO_RSVD_KNOWN		= 0x00000008,
++	IEEE80211_RADIOTAP_EHT_USER_INFO_NSS_KNOWN		= 0x00000010,
++	IEEE80211_RADIOTAP_EHT_USER_INFO_BEAMFORMING_KNOWN	= 0x00000020,
++	IEEE80211_RADIOTAP_EHT_USER_INFO_SPATIAL_CONFIG_KNOWN	= 0x00000040,
++	IEEE80211_RADIOTAP_EHT_USER_INFO_DATA_CAPTURE		= 0x00000080,
++	IEEE80211_RADIOTAP_EHT_USER_INFO_STA_ID			= 0x0007ff00,
++	IEEE80211_RADIOTAP_EHT_USER_INFO_CODING			= 0x00080000,
++	IEEE80211_RADIOTAP_EHT_USER_INFO_MCS			= 0x00f00000,
++	IEEE80211_RADIOTAP_EHT_USER_INFO_NSS			= 0x0f000000,
++	IEEE80211_RADIOTAP_EHT_USER_INFO_BEAMFORMING		= 0x20000000,
++	IEEE80211_RADIOTAP_EHT_USER_INFO_SPATIAL_CONFIG		= 0x3f000000,
++};
++
++struct ieee80211_radiotap_eht {
++	__le32 known;
++	__le32 data[9];
++	__le32 user_info[];
++};
++
+ /**
+  * ieee80211_get_radiotap_len - get radiotap header length
+  */
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1439,7 +1439,11 @@ ieee80211_tx_info_clear_status(struct ie
+  *	known the frame shouldn't be reported.
+  * @RX_FLAG_8023: the frame has an 802.3 header (decap offload performed by
+  *	hardware or driver)
++ * @RX_FLAG_USIG_HEADER: Universal field carries information necessary to
++ *	interpret EHT PPDUs.
++ * @RX_FLAG_EHT_HEADER: EHT radiotap data is present.
+  */
++
+ enum mac80211_rx_flags {
+ 	RX_FLAG_MMIC_ERROR		= BIT(0),
+ 	RX_FLAG_DECRYPTED		= BIT(1),
+@@ -1471,6 +1475,8 @@ enum mac80211_rx_flags {
+ 	RX_FLAG_RADIOTAP_LSIG           = BIT(27),
+ 	RX_FLAG_NO_PSDU                 = BIT(28),
+ 	RX_FLAG_8023                    = BIT(29),
++	RX_FLAG_USIG_HEADER             = BIT(30),
++	RX_FLAG_EHT_HEADER              = BIT(31),
+ };
+ 
+ /**
+@@ -1538,6 +1544,7 @@ enum mac80211_rx_encoding {
+  *	HT or VHT is used (%RX_FLAG_HT/%RX_FLAG_VHT)
+  * @nss: number of streams (VHT, HE and EHT only)
+  * @flag: %RX_FLAG_\*
++ * @ext_flag: %RX_FLAG_\*
+  * @encoding: &enum mac80211_rx_encoding
+  * @bw: &enum rate_info_bw
+  * @enc_flags: uses bits from &enum mac80211_rx_encoding_flags
+@@ -1591,6 +1598,7 @@ struct ieee80211_rx_status {
+ 	u8 ampdu_delimiter_crc;
+ 	u8 zero_length_psdu_type;
+ 	u8 link_valid:1, link_id:4;
++	u8 eht_num_user;
+ };
+ 
+ static inline u32
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -143,6 +143,12 @@ ieee80211_rx_radiotap_hdrlen(struct ieee
+ 	/* always present fields */
+ 	len = sizeof(struct ieee80211_radiotap_header) + 8;
+ 
++	/* EHT present fields */
++	if ((status->flag & RX_FLAG_EHT_HEADER) ||
++	    (status->flag & RX_FLAG_USIG_HEADER)) {
++		len += 4;
++	}
++
+ 	/* allocate extra bitmaps */
+ 	if (status->chains)
+ 		len += 4 * hweight8(status->chains);
+@@ -202,6 +208,20 @@ ieee80211_rx_radiotap_hdrlen(struct ieee
+ 		BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_lsig) != 4);
+ 	}
+ 
++	if (status->flag & RX_FLAG_USIG_HEADER &&
++	    status->encoding == RX_ENC_EHT) {
++		len = ALIGN(len, 4);
++		len += 12;
++		BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_usig) != 12);
++	}
++
++	if (status->flag & RX_FLAG_EHT_HEADER &&
++	    status->encoding == RX_ENC_EHT) {
++		len = ALIGN(len, 4);
++		len += 40;
++		len += status->eht_num_user * 4;
++	}
++
+ 	if (status->chains) {
+ 		/* antenna and antenna signal fields */
+ 		len += 2 * hweight8(status->chains);
+@@ -223,6 +243,15 @@ ieee80211_rx_radiotap_hdrlen(struct ieee
+ 		if (status->flag & RX_FLAG_RADIOTAP_LSIG)
+ 			tlv_offset +=
+ 				sizeof(struct ieee80211_radiotap_lsig);
++		if (status->flag & RX_FLAG_USIG_HEADER)
++			tlv_offset +=
++				sizeof(struct ieee80211_radiotap_usig);
++		if (status->flag & RX_FLAG_EHT_HEADER) {
++			tlv_offset +=
++				sizeof(struct ieee80211_radiotap_eht);
++			tlv_offset +=
++				status->eht_num_user * sizeof(u32);
++		}
+ 
+ 		/* ensure 4 byte alignment for TLV */
+ 		len = ALIGN(len, 4);
+@@ -330,6 +359,14 @@ ieee80211_add_rx_radiotap_header(struct
+ 	struct ieee80211_radiotap_he he = {};
+ 	struct ieee80211_radiotap_he_mu he_mu = {};
+ 	struct ieee80211_radiotap_lsig lsig = {};
++	struct ieee80211_radiotap_usig usig = {};
++	struct ieee80211_radiotap_eht eht = {};
++	u32 *user_info;
++	bool rhdr_ext = false;
++
++	if ((status->flag & RX_FLAG_USIG_HEADER) ||
++	    (status->flag & RX_FLAG_EHT_HEADER))
++		rhdr_ext = true;
+ 
+ 	if (status->flag & RX_FLAG_RADIOTAP_HE) {
+ 		he = *(struct ieee80211_radiotap_he *)skb->data;
+@@ -352,6 +389,20 @@ ieee80211_add_rx_radiotap_header(struct
+ 		tlvs_len = skb_mac_header(skb) - skb->data;
+ 	}
+ 
++	if (status->flag & RX_FLAG_USIG_HEADER) {
++		usig = *(struct ieee80211_radiotap_usig *)skb->data;
++		skb_pull(skb, sizeof(usig));
++		WARN_ON_ONCE(status->encoding != RX_ENC_EHT);
++	}
++
++	if (status->flag & RX_FLAG_EHT_HEADER) {
++		eht = *(struct ieee80211_radiotap_eht *)skb->data;
++		skb_pull(skb, sizeof(eht));
++		user_info = (u32 *)skb->data;
++		skb_pull(skb, status->eht_num_user * sizeof(u32));
++		WARN_ON_ONCE(status->encoding != RX_ENC_EHT);
++	}
++
+ 	mpdulen = skb->len;
+ 	if (!(has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)))
+ 		mpdulen += FCS_LEN;
+@@ -382,6 +433,19 @@ ieee80211_add_rx_radiotap_header(struct
+ 	if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END)
+ 		it_present_val |= BIT(IEEE80211_RADIOTAP_TLV);
+ 
++	if (rhdr_ext) {
++		it_present_val |= BIT(IEEE80211_RADIOTAP_EXT);
++		put_unaligned_le32(it_present_val, it_present);
++		it_present_val = 0;
++		it_present++;
++		/* IEEE80211_RADIOTAP_USIG */
++		if (status->flag & RX_FLAG_USIG_HEADER)
++			it_present_val |= BIT(IEEE80211_RADIOTAP_USIG_INFO);
++		/* IEEE80211_RADIOTAP_EHT */
++		if (status->flag & RX_FLAG_EHT_HEADER)
++			it_present_val |= BIT(IEEE80211_RADIOTAP_EHT_INFO);
++	}
++
+ 	put_unaligned_le32(it_present_val, it_present);
+ 
+ 	/* This references through an offset into it_optional[] rather
+@@ -706,6 +770,22 @@ ieee80211_add_rx_radiotap_header(struct
+ 		*pos++ = status->chain_signal[chain];
+ 		*pos++ = chain;
+ 	}
++
++	if (status->flag & RX_FLAG_USIG_HEADER) {
++		while ((pos - (u8 *)rthdr) & 1)
++			pos++;
++		memcpy(pos, &usig, sizeof(usig));
++		pos += sizeof(usig);
++	}
++
++	if (status->flag & RX_FLAG_EHT_HEADER) {
++		while ((pos - (u8 *)rthdr) & 1)
++			pos++;
++		memcpy(pos, &eht, sizeof(eht));
++		pos += sizeof(eht);
++		memcpy(pos, user_info, (status->eht_num_user * sizeof(u32)));
++		pos += status->eht_num_user * sizeof(u32);
++	}
+ }
+ 
+ static struct sk_buff *
+@@ -800,6 +880,14 @@ ieee80211_rx_monitor(struct ieee80211_lo
+ 	if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END)
+ 		rtap_space += skb_mac_header(origskb) - &origskb->data[rtap_space];
+ 
++	if (status->flag & RX_FLAG_USIG_HEADER)
++		rtap_space += sizeof(struct ieee80211_radiotap_usig);
++
++	if (status->flag & RX_FLAG_EHT_HEADER) {
++		rtap_space += sizeof(struct ieee80211_radiotap_eht);
++		rtap_space += (status->eht_num_user * sizeof(u32));
++	}
++
+ 	min_head_len = rtap_space;
+ 
+ 	/*
diff --git a/package/kernel/mac80211/patches/ath11k_nss/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch b/package/kernel/mac80211/patches/ath11k_nss/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
new file mode 100644
index 00000000000000..b64643140a14b1
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
@@ -0,0 +1,232 @@
+From f2c96599c02eb0d47602d000fe0f40358c10c892 Mon Sep 17 00:00:00 2001
+From: Aaradhana Sahu <quic_aarasahu@quicinc.com>
+Date: Fri, 26 Aug 2022 17:54:37 +0530
+Subject: [PATCH] mac80211: Avoid encapsulation of EAPOL frames if OFFLOAD_ENCAP is enabled
+
+EAP Frames over NL80211 Control port are 802.11 Native WiFi
+encapsulated by default, but for a vdev operating in 802.3, when FW doesn’t
+advertise WMI_SERVICE_EAPOL_OVER_NWIFI, it cannot accept an 802.11
+Native WiFi frame.
+
+Allow EAP Frames over NL80211 Control port to be passed as 802.3
+if vif has IEEE80211_OFFLOAD_ENCAP_ENABLED set.
+
+Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
+Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
+---
+ net/mac80211/ieee80211_i.h |  5 ++++
+ net/mac80211/tx.c          | 58 ++++++++++++++++++++++++++------------
+ 2 files changed, 45 insertions(+), 18 deletions(-)
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -2062,6 +2062,11 @@ netdev_tx_t ieee80211_subif_start_xmit(s
+ 				       struct net_device *dev);
+ netdev_tx_t ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
+ 					    struct net_device *dev);
++netdev_tx_t __ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
++					      struct net_device *dev,
++					      u32 info_flags,
++					      u32 ctrl_flags,
++					      u64 *cookie);
+ void __ieee80211_subif_start_xmit(struct sk_buff *skb,
+ 				  struct net_device *dev,
+ 				  u32 info_flags,
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -39,7 +39,8 @@
+ 
+ static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
+ 				struct net_device *dev, struct sta_info *sta,
+-				struct ieee80211_key *key, struct sk_buff *skb);
++				struct ieee80211_key *key, struct sk_buff *skb,
++				u32 info_flags, u32 ctrl_flags, u64 *cookie);
+ 
+ static inline void ieee80211_tx_stats(struct net_device *dev, u32 len)
+ {
+@@ -4310,13 +4311,18 @@ void __ieee80211_subif_start_xmit(struct
+ 		atomic_inc(&sta->tx_netif_pkts);
+ 
+         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
+-                ap_sdata = container_of(sdata->bss,
+-                                        struct ieee80211_sub_if_data, u.ap);
++                if (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD))
++                        ap_sdata = container_of(sdata->bss,
++                                                struct ieee80211_sub_if_data,
++                                                u.ap);
++                else
++                        ap_sdata = sdata;
++
+                 if (ap_sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED &&
+                     !is_multicast_ether_addr(skb->data)) {
+                         if (sta)
+                                 key = rcu_dereference(sta->ptk[sta->ptk_idx]);
+-                        ieee80211_8023_xmit(sdata, dev, sta, key, skb);
++                        ieee80211_8023_xmit(sdata, dev, sta, key, skb, info_flags, ctrl_flags, cookie);
+                         rcu_read_unlock();
+                         return;
+                 }
+@@ -4657,19 +4663,29 @@ static bool ieee80211_tx_8023(struct iee
+ 
+ static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
+ 				struct net_device *dev, struct sta_info *sta,
+-				struct ieee80211_key *key, struct sk_buff *skb)
++				struct ieee80211_key *key, struct sk_buff *skb,
++				u32 info_flags, u32 ctrl_flags, u64 *cookie)
+ {
+ 	struct ieee80211_tx_info *info;
++	struct ethhdr *ehdr = (struct ethhdr *)skb->data;
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct tid_ampdu_tx *tid_tx;
+ 	struct sk_buff *seg, *next;
+ 	unsigned int skbs = 0, len = 0;
+ 	u16 queue;
++	unsigned char *ra = ehdr->h_dest;
++	bool multicast;
+ 	u8 tid;
+ 
+ 	queue = ieee80211_select_queue(sdata, sta, skb);
+ 	skb_set_queue_mapping(skb, queue);
+ 
++	multicast = is_multicast_ether_addr(ra);
++
++	if (multicast && sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
++	    !atomic_read(&sdata->u.vlan.num_mcast_sta))
++		goto out_free;
++
+ 	if (unlikely(test_bit(SCAN_SW_SCANNING, &local->scanning)) &&
+ 	    test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))
+ 		goto out_free;
+@@ -4704,6 +4720,7 @@ static void ieee80211_8023_xmit(struct i
+ 	info = IEEE80211_SKB_CB(skb);
+ 	memset(info, 0, sizeof(*info));
+ 
++	info->flags |= info_flags;
+ 	info->hw_queue = sdata->vif.hw_queue[queue];
+ 
+ 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+@@ -4723,9 +4740,10 @@ static void ieee80211_8023_xmit(struct i
+ 			memcpy(IEEE80211_SKB_CB(seg), info, sizeof(*info));
+ 	}
+ 
+-	if (unlikely(skb->sk &&
+-		     skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS &&
+-		     !ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD) && sta))
++	if (unlikely(((skb->sk &&
++		       skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS) ||
++		      ((ctrl_flags & IEEE80211_TX_CTL_REQ_TX_STATUS) && !multicast)) &&
++		     !ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD)))
+ 		info->ack_frame_id = ieee80211_store_ack_skb(local, skb,
+ 							     &info->flags, NULL);
+ 
+@@ -4750,7 +4768,8 @@ out_free:
+ 
+ void ieee80211_8023_xmit_ap(struct ieee80211_sub_if_data *sdata,
+ 			    struct net_device *dev, struct sta_info *sta,
+-			    struct ieee80211_key *key, struct sk_buff *skb)
++			    struct ieee80211_key *key, struct sk_buff *skb,
++			    u32 info_flags, u32 ctrl_flags, u64 *cookie)
+ {
+ 	struct ieee80211_tx_info *info;
+ 	struct ieee80211_local *local = sdata->local;
+@@ -4759,6 +4778,9 @@ void ieee80211_8023_xmit_ap(struct ieee8
+ 	unsigned long flags;
+ 	int q;
+ 	u16 q_map;
++	struct ethhdr *ehdr = (struct ethhdr *)skb->data;
++	unsigned char *ra = ehdr->h_dest;
++	bool multicast = is_multicast_ether_addr(ra);
+ 
+ 	/*
+ 	 * If the skb is shared we need to obtain our own copy.
+@@ -4770,11 +4792,13 @@ void ieee80211_8023_xmit_ap(struct ieee8
+ 
+ 	info = IEEE80211_SKB_CB(skb);
+ 	memset(info, 0, sizeof(*info));
++	info->flags |= info_flags;
+ 
+-	if (unlikely(skb->sk &&
+-		     skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS))
++	if (unlikely((skb->sk &&
++		     skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS) ||
++		     ((ctrl_flags & IEEE80211_TX_CTL_REQ_TX_STATUS) && !multicast)))
+ 		info->ack_frame_id = ieee80211_store_ack_skb(local, skb,
+-							     &info->flags, NULL);
++							     &info->flags, cookie);
+ 
+ 	info->flags |= IEEE80211_TX_CTL_HW_80211_ENCAP;
+ 	info->control.vif = &sdata->vif;
+@@ -4811,14 +4835,23 @@ void ieee80211_8023_xmit_ap(struct ieee8
+ 	if (sta)
+ 		atomic_inc(&sta->tx_drv_pkts);
+ }
+-
+ netdev_tx_t ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
+ 					    struct net_device *dev)
+ {
++	return __ieee80211_subif_start_xmit_8023(skb, dev, 0, 0, NULL);
++}
++
++netdev_tx_t __ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
++					      struct net_device *dev,
++					      u32 info_flags,
++					      u32 ctrl_flags,
++					      u64 *cookie)
++{
+ 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+ 	struct ethhdr *ehdr = (struct ethhdr *)skb->data;
+ 	struct ieee80211_key *key = NULL;
+ 	struct sta_info *sta;
++	bool is_eapol;
+ 
+ #ifdef CPTCFG_MAC80211_NSS_SUPPORT
+        ieee80211_xmit_nss_fixup(skb, dev);
+@@ -4834,14 +4867,15 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+ 		kfree_skb(skb);
+ 		goto out;
+ 	}
++	is_eapol = (sdata->control_port_protocol == ehdr->h_proto);
+ 
+ 	if (ieee80211_hw_check(&sdata->local->hw, SUPPORTS_NSS_OFFLOAD)) {
+ 		if (unlikely(IS_ERR_OR_NULL(sta) || !sta->uploaded))
+ 			sta = NULL;
+ 		goto tx_offload;
+ 	} else if (unlikely(IS_ERR_OR_NULL(sta) || !sta->uploaded ||
+-		   !test_sta_flag(sta, WLAN_STA_AUTHORIZED) ||
+-		   sdata->control_port_protocol == ehdr->h_proto))
++		(!test_sta_flag(sta, WLAN_STA_AUTHORIZED) && !is_eapol) ||
++		(is_eapol && !(sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED))))
+ 		goto skip_offload;
+ 
+ 	key = rcu_dereference(sta->ptk[sta->ptk_idx]);
+@@ -4852,13 +4886,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+ 		goto skip_offload;
+ 
+ 	if (sdata->vif.type == NL80211_IFTYPE_AP) {
+-		ieee80211_8023_xmit_ap(sdata, dev, sta, key, skb);
++		ieee80211_8023_xmit_ap(sdata, dev, sta, key, skb, info_flags, ctrl_flags, cookie);
+ 		goto out;
+ 	}
+ 
+ 	sk_pacing_shift_update(skb->sk, sdata->local->hw.tx_sk_pacing_shift);
+ tx_offload:
+-	ieee80211_8023_xmit(sdata, dev, sta, key, skb);
++	ieee80211_8023_xmit(sdata, dev, sta, key, skb, info_flags, ctrl_flags, cookie);
+ 	goto out;
+ 
+ skip_offload:
+@@ -6364,13 +6398,10 @@ start_xmit:
+ 	mutex_lock(&local->mtx);
+ 
+ 	local_bh_disable();
+-
+-	/* added hardware encap check for ethernet mode */
+ 	if (sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED)
+-		ieee80211_subif_start_xmit_8023(skb, skb->dev);
++		__ieee80211_subif_start_xmit_8023(skb, skb->dev, flags, ctrl_flags, cookie);
+ 	else
+ 		__ieee80211_subif_start_xmit(skb, skb->dev, flags, ctrl_flags, cookie);
+-
+ 	local_bh_enable();
+ 
+ 	mutex_unlock(&local->mtx);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/702-ath11k-fix-memory-leak-in-dp-rx.patch b/package/kernel/mac80211/patches/ath11k_nss/702-ath11k-fix-memory-leak-in-dp-rx.patch
new file mode 100644
index 00000000000000..1bfa9b89b45c5f
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/702-ath11k-fix-memory-leak-in-dp-rx.patch
@@ -0,0 +1,48 @@
+From 9e4857cfe7f646c239fde030eb16b3d6520c34d8 Mon Sep 17 00:00:00 2001
+From: Hari Chandrakanthan <quic_haric@quicinc.com>
+Date: Fri, 6 Jan 2023 12:49:44 +0530
+Subject: [PATCH] ath11k: fix memory leak in dp rx
+
+In dp rx path, by default, fast_rx is set as true.
+And if peer supports fast rx, the frame is sent to upper layer
+through napi_gro_receive.
+
+If peer doesn't support fast rx, the frames need to be processed in
+ath11k_dp_rx_deliver_msdu and sent to mac80211 using ieee80211_rx_napi.
+In dp rx path, the api ath11k_dp_rx_h_mpdu checks whether peer supports
+fast rx.
+
+If peer find fails in ath11k_dp_rx_h_mpdu, the skb is not sent to network stack
+as well as mac80211. Because the argument fast_rx is not set to false in ath11k_dp_rx_h_mpdu
+when peer find fails.
+
+This can lead to memory leak.
+
+Fix it by setting argument fast_rx as false in ath11k_dp_rx_h_mpdu
+so that the skb is sent to mac80211 through ath11k_dp_rx_deliver_msdu.
+
+Signed-off-by: Hari Chandrakanthan <quic_haric@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -2512,8 +2512,6 @@ static void ath11k_dp_rx_h_mpdu(struct a
+ 			}
+ 		}
+ 
+-		*fast_rx = false;
+-
+ 		if (rxcb->is_mcbc)
+ 			enctype = peer->sec_type_grp;
+ 		else
+@@ -2523,6 +2521,8 @@ static void ath11k_dp_rx_h_mpdu(struct a
+ 	}
+ 	spin_unlock_bh(&ar->ab->base_lock);
+ 
++	*fast_rx = false;
++
+ 	rx_attention = ath11k_dp_rx_get_attention(ar->ab, rx_desc);
+ 	err_bitmap = ath11k_dp_rx_h_attn_mpdu_err(rx_attention);
+ 	if (enctype != HAL_ENCRYPT_TYPE_OPEN && !err_bitmap)
diff --git a/package/kernel/mac80211/patches/ath11k_nss/718-e-mac80211-Deliver-the-frame-to-driver-tx-ops-directly.patch b/package/kernel/mac80211/patches/ath11k_nss/718-e-mac80211-Deliver-the-frame-to-driver-tx-ops-directly.patch
new file mode 100644
index 00000000000000..31db236d5fd4ef
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/718-e-mac80211-Deliver-the-frame-to-driver-tx-ops-directly.patch
@@ -0,0 +1,74 @@
+From f37e9b4a68d32d03346cbfc3cb4178b186c8f2a4 Mon Sep 17 00:00:00 2001
+From: Ramanathan Choodamani <quic_rchoodam@quicinc.com>
+Date: Fri, 17 Feb 2023 03:08:29 -0800
+Subject: [PATCH 5/7] mac80211: Deliver the frame to driver tx ops
+ directly
+
+Deliver the frame to driver directly in the forwarding path
+to improve the throughput performance.
+
+Reset the fast xmit flag in ieee80211 datapath to ensure
+other features handled as normal through the ath12k_dp_tx
+function
+
+Signed-off-by: Balamurugan Mahalingam <quic_bmahalin@quicinc.com>
+Signed-off-by: Ramanathan Choodamani <quic_rchoodam@quicinc.com>
+---
+ net/mac80211/tx.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -4567,6 +4567,7 @@ netdev_tx_t ieee80211_subif_start_xmit(s
+ #ifdef CPTCFG_MAC80211_NSS_SUPPORT
+ 	ieee80211_xmit_nss_fixup(skb, dev);
+ #endif
++	skb->fast_xmit = 0;
+ 
+ 	if (likely(!is_multicast_ether_addr(eth->h_dest)))
+ 		goto normal;
+@@ -4838,7 +4839,43 @@ void ieee80211_8023_xmit_ap(struct ieee8
+ netdev_tx_t ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
+ 					    struct net_device *dev)
+ {
+-	return __ieee80211_subif_start_xmit_8023(skb, dev, 0, 0, NULL);
++	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
++	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
++	struct ieee80211_tx_control control = {};
++	struct sta_info *sta;
++	struct ieee80211_sta *pubsta = NULL;
++
++	info->control.vif = &sdata->vif;
++
++	if (skb->fast_xmit) {
++		info->control.flags = u32_encode_bits(IEEE80211_LINK_UNSPECIFIED,
++						      IEEE80211_TX_CTRL_MLO_LINK);
++		info->flags = IEEE80211_TX_CTL_HW_80211_ENCAP;
++
++		if (hweight16(sdata->vif.valid_links) > 1) {
++			rcu_read_lock();
++
++			if (ieee80211_lookup_ra_sta(sdata, skb, &sta)) {
++				kfree_skb(skb);
++				goto out;
++			}
++
++			if (!IS_ERR_OR_NULL(sta) && sta->uploaded)
++				pubsta = &sta->sta;
++
++			control.sta = pubsta;
++			drv_tx(sdata->local, &control,  skb);
++out:
++			rcu_read_unlock();
++		} else {
++			control.sta = NULL;
++			drv_tx(sdata->local, &control,  skb);
++		}
++
++		return NETDEV_TX_OK;
++	} else {
++		return __ieee80211_subif_start_xmit_8023(skb, dev, 0, 0, NULL);
++	}
+ }
+ 
+ netdev_tx_t __ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
diff --git a/package/kernel/mac80211/patches/ath11k_nss/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch b/package/kernel/mac80211/patches/ath11k_nss/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
new file mode 100644
index 00000000000000..e5b4d7d9e7ef4e
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
@@ -0,0 +1,140 @@
+From d4ddaebe2132dbb169f78da3666b11a21f645ea0 Mon Sep 17 00:00:00 2001
+From: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
+Date: Fri, 21 Apr 2023 12:28:21 +0530
+Subject: [PATCH] mac80211: Advertise HW checksum offload only for ethmode
+
+Upper(NSS/SFE) layer might remove checksum offset from a skb
+for the net device which advertise HW checksum offload
+feature. This would create an issue if any software encrypted
+packet or for the netdev which don't support IEEE80211_OFFLOAD_*.
+Avoid this by advertising the HW checksum offload feature
+only for the netdev which supports IEEE80211_OFFLOAD_*
+and have an check before checking checksum offset for the
+exceptional packets getting called from 8023_xmit API.
+
+Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
+---
+ net/mac80211/ieee80211_i.h |  3 ++-
+ net/mac80211/iface.c       |  4 ++++
+ net/mac80211/tdls.c        |  2 +-
+ net/mac80211/tx.c          | 19 ++++++++++---------
+ 4 files changed, 17 insertions(+), 11 deletions(-)
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -37,6 +37,8 @@
+ #include "wme.h"
+ #include "rate.h"
+ 
++#define IS_HW_CSUM_NOT_ENABLED(dev)             (!((dev)->features & NETIF_F_HW_CSUM))
++
+ static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
+ 				struct net_device *dev, struct sta_info *sta,
+ 				struct ieee80211_key *key, struct sk_buff *skb,
+@@ -3633,7 +3635,7 @@ ieee80211_sdata_netdev_features(struct i
+ }
+ 
+ static struct sk_buff *
+-ieee80211_tx_skb_fixup(struct sk_buff *skb, netdev_features_t features)
++ieee80211_tx_skb_fixup(struct sk_buff *skb, netdev_features_t features, struct net_device *dev)
+ {
+ 	if (skb_is_gso(skb)) {
+ 		struct sk_buff *segs;
+@@ -3651,7 +3653,7 @@ ieee80211_tx_skb_fixup(struct sk_buff *s
+ 	if (skb_needs_linearize(skb, features) && __skb_linearize(skb))
+ 		goto free;
+ 
+-	if (skb->ip_summed == CHECKSUM_PARTIAL) {
++	if (skb->ip_summed == CHECKSUM_PARTIAL && IS_HW_CSUM_NOT_ENABLED(dev)) {
+ 		int ofs = skb_checksum_start_offset(skb);
+ 
+ 		if (skb->encapsulation)
+@@ -3797,7 +3799,7 @@ static bool ieee80211_xmit_fast(struct i
+ 	memcpy(&eth, skb->data, ETH_HLEN - 2);
+ 
+ 	/* after this point (skb is modified) we cannot return false */
+-	skb = ieee80211_tx_skb_fixup(skb, ieee80211_sdata_netdev_features(sdata));
++	skb = ieee80211_tx_skb_fixup(skb, ieee80211_sdata_netdev_features(sdata), sdata->dev);
+ 	if (!skb)
+ 		return true;
+ 
+@@ -4345,7 +4347,7 @@ void __ieee80211_subif_start_xmit(struct
+ 	 * things so we cannot really handle checksum or GSO offload.
+ 	 * fix it up in software before we handle anything else.
+ 	 */
+-	skb = ieee80211_tx_skb_fixup(skb, 0);
++	skb = ieee80211_tx_skb_fixup(skb, 0, dev);
+ 	if (!skb) {
+ 		len = 0;
+ 		goto out;
+@@ -4567,7 +4569,6 @@ netdev_tx_t ieee80211_subif_start_xmit(s
+ #ifdef CPTCFG_MAC80211_NSS_SUPPORT
+ 	ieee80211_xmit_nss_fixup(skb, dev);
+ #endif
+-	skb->fast_xmit = 0;
+ 
+ 	if (likely(!is_multicast_ether_addr(eth->h_dest)))
+ 		goto normal;
+@@ -4714,7 +4715,7 @@ static void ieee80211_8023_xmit(struct i
+ 		}
+ 	}
+ 
+-	skb = ieee80211_tx_skb_fixup(skb, ieee80211_sdata_netdev_features(sdata));
++	skb = ieee80211_tx_skb_fixup(skb, ieee80211_sdata_netdev_features(sdata), dev);
+ 	if (!skb)
+ 		return;
+ 
+@@ -4839,6 +4840,7 @@ void ieee80211_8023_xmit_ap(struct ieee8
+ netdev_tx_t ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
+ 					    struct net_device *dev)
+ {
++#ifdef CPTCFG_MAC80211_SFE_SUPPORT
+ 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 	struct ieee80211_tx_control control = {};
+@@ -4873,9 +4875,10 @@ out:
+ 		}
+ 
+ 		return NETDEV_TX_OK;
+-	} else {
+-		return __ieee80211_subif_start_xmit_8023(skb, dev, 0, 0, NULL);
+ 	}
++#endif
++	return __ieee80211_subif_start_xmit_8023(skb, dev, 0, 0, NULL);
++
+ }
+ 
+ netdev_tx_t __ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -2250,6 +2250,10 @@ int ieee80211_if_add(struct ieee80211_lo
+ 
+ 		ndev->features |= local->hw.netdev_features;
+ 		ndev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
++		if ((type == NL80211_IFTYPE_AP || type == NL80211_IFTYPE_STATION) &&
++		    ieee80211_hw_check(&local->hw, SUPPORTS_TX_ENCAP_OFFLOAD) && !params->use_4addr)
++			ndev->features |= NETIF_F_HW_CSUM;
++
+ 		ndev->hw_features |= ndev->features &
+ 					MAC80211_SUPPORTED_FEATURES_TX;
+ 		sdata->vif.netdev_features = local->hw.netdev_features;
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -13,6 +13,8 @@
+ #include "wme.h"
+ #include "driver-ops.h"
+ 
++#define IS_HW_CSUM_NOT_ENABLED(dev)             (!((dev)->features & NETIF_F_HW_CSUM))
++
+ static int mesh_allocated;
+ static struct kmem_cache *rm_cache;
+ 
+@@ -797,7 +799,7 @@ bool ieee80211_mesh_xmit_fast(struct iee
+ 	if (skb->sk && skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS)
+ 		return false;
+ 
+-	if (skb->ip_summed == CHECKSUM_PARTIAL) {
++	if (skb->ip_summed == CHECKSUM_PARTIAL && IS_HW_CSUM_NOT_ENABLED(sdata->dev)) {
+ 		skb_set_transport_header(skb, skb_checksum_start_offset(skb));
+ 		if (skb_checksum_help(skb))
+ 			return false;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/900-fix-build.patch b/package/kernel/mac80211/patches/ath11k_nss/900-fix-build.patch
new file mode 100644
index 00000000000000..67d6e5285bdd94
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/900-fix-build.patch
@@ -0,0 +1,236 @@
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -2305,6 +2305,7 @@ static void ath11k_dp_rx_h_undecap_snap(
+ 	struct ieee80211_hdr *hdr;
+ 	size_t hdr_len;
+ 	u8 l3_pad_bytes;
++	int expand_by;
+ 	struct hal_rx_desc *rx_desc;
+ 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
+ 
+@@ -2329,12 +2330,22 @@ static void ath11k_dp_rx_h_undecap_snap(
+ 	hdr_len = ieee80211_hdrlen(hdr->frame_control);
+ 
+ 	if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
+-		memcpy(skb_push(msdu,
+-				ath11k_dp_rx_crypto_param_len(ar, enctype)),
+-		       (void *)hdr + hdr_len,
+-			ath11k_dp_rx_crypto_param_len(ar, enctype));
++		int crypto_param_len = ath11k_dp_rx_crypto_param_len(ar, enctype);
++
++		if (skb_headroom(msdu) < crypto_param_len) {
++			expand_by = crypto_param_len - skb_headroom(msdu);
++			if (WARN_ON_ONCE(pskb_expand_head(msdu, expand_by, 0, GFP_ATOMIC)))
++				return;
++		}
++		memcpy(skb_push(msdu, crypto_param_len),
++		       (void *)hdr + hdr_len, crypto_param_len);
+ 	}
+ 
++	if (skb_headroom(msdu) < hdr_len) {
++		expand_by = hdr_len - skb_headroom(msdu);
++		if (WARN_ON_ONCE(pskb_expand_head(msdu, expand_by, 0, GFP_ATOMIC)))
++			return;
++	}
+ 	memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
+ }
+ 
+@@ -2464,7 +2475,7 @@ static void ath11k_dp_rx_h_mpdu(struct a
+ 				struct ieee80211_rx_status *rx_status,
+ 				bool *fast_rx)
+ {
+-	bool  fill_crypto_hdr;
++	bool fill_crypto_hdr = 0;
+ 	enum hal_encrypt_type enctype;
+ 	bool is_decrypted = false;
+ 	struct ath11k_skb_rxcb *rxcb;
+@@ -2479,7 +2490,8 @@ static void ath11k_dp_rx_h_mpdu(struct a
+ 
+ 	/* PN for multicast packets will be checked in mac80211 */
+ 	rxcb = ATH11K_SKB_RXCB(msdu);
+-	fill_crypto_hdr = ath11k_dp_rx_h_attn_is_mcbc(ar->ab, rx_desc);
++	if (!ar->ab->nss.enabled)
++		fill_crypto_hdr = ath11k_dp_rx_h_attn_is_mcbc(ar->ab, rx_desc);
+ 	rxcb->is_mcbc = fill_crypto_hdr;
+ 
+ 	if (rxcb->is_mcbc) {
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -9224,7 +9224,7 @@ void cfg80211_bss_flush(struct wiphy *wi
+  * @count: the number of TBTTs until the color change happens
+  * @color_bitmap: representations of the colors that the local BSS is aware of
+  */
+-int cfg80211_bss_color_notify(struct net_device *dev,
++int cfg80211_bss_color_notify(struct net_device *dev, gfp_t gfp,
+ 			      enum nl80211_commands cmd, u8 count,
+ 			      u64 color_bitmap);
+ 
+@@ -9234,9 +9234,9 @@ int cfg80211_bss_color_notify(struct net
+  * @color_bitmap: representations of the colors that the local BSS is aware of
+  */
+ static inline int cfg80211_obss_color_collision_notify(struct net_device *dev,
+-						       u64 color_bitmap)
++						       u64 color_bitmap, gfp_t gfp)
+ {
+-	return cfg80211_bss_color_notify(dev, NL80211_CMD_OBSS_COLOR_COLLISION,
++	return cfg80211_bss_color_notify(dev, gfp, NL80211_CMD_OBSS_COLOR_COLLISION,
+ 					 0, color_bitmap);
+ }
+ 
+@@ -9250,7 +9250,7 @@ static inline int cfg80211_obss_color_co
+ static inline int cfg80211_color_change_started_notify(struct net_device *dev,
+ 						       u8 count)
+ {
+-	return cfg80211_bss_color_notify(dev, NL80211_CMD_COLOR_CHANGE_STARTED,
++	return cfg80211_bss_color_notify(dev, GFP_KERNEL, NL80211_CMD_COLOR_CHANGE_STARTED,
+ 					 count, 0);
+ }
+ 
+@@ -9262,7 +9262,7 @@ static inline int cfg80211_color_change_
+  */
+ static inline int cfg80211_color_change_aborted_notify(struct net_device *dev)
+ {
+-	return cfg80211_bss_color_notify(dev, NL80211_CMD_COLOR_CHANGE_ABORTED,
++	return cfg80211_bss_color_notify(dev, GFP_KERNEL, NL80211_CMD_COLOR_CHANGE_ABORTED,
+ 					 0, 0);
+ }
+ 
+@@ -9274,7 +9274,7 @@ static inline int cfg80211_color_change_
+  */
+ static inline int cfg80211_color_change_notify(struct net_device *dev)
+ {
+-	return cfg80211_bss_color_notify(dev,
++	return cfg80211_bss_color_notify(dev, GFP_KERNEL,
+ 					 NL80211_CMD_COLOR_CHANGE_COMPLETED,
+ 					 0, 0);
+ }
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -5239,6 +5239,10 @@ void ieee80211_tx_status_ext(struct ieee
+  *	(NULL for multicast packets)
+  * @info: tx status information
+  */
++void ieee80211_tx_status_8023(struct ieee80211_hw *hw,
++                               struct ieee80211_vif *vif,
++                               struct sk_buff *skb);
++
+ static inline void ieee80211_tx_status_noskb(struct ieee80211_hw *hw,
+ 					     struct ieee80211_sta *sta,
+ 					     struct ieee80211_tx_info *info)
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -4775,7 +4775,7 @@ void ieee80211_color_collision_detection
+ 	struct ieee80211_sub_if_data *sdata = link->sdata;
+ 
+ 	sdata_lock(sdata);
+-	cfg80211_obss_color_collision_notify(sdata->dev, link->color_bitmap);
++	cfg80211_obss_color_collision_notify(sdata->dev, link->color_bitmap, GFP_KERNEL);
+ 	sdata_unlock(sdata);
+ }
+ 
+--- a/net/mac80211/debugfs_netdev.c
++++ b/net/mac80211/debugfs_netdev.c
+@@ -889,7 +889,7 @@ void ieee80211_debugfs_add_netdev(struct
+ {
+ 	char buf[10+IFNAMSIZ];
+ 
+-	sprintf(buf, "netdev:%s", sdata->name);
++	snprintf(buf, 10 + IFNAMSIZ, "netdev:%s", sdata->name);
+ 	sdata->vif.debugfs_dir = debugfs_create_dir(buf,
+ 		sdata->local->hw.wiphy->debugfsdir);
+ 	sdata->debugfs.subdir_stations = debugfs_create_dir("stations",
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -1406,18 +1406,6 @@ static void __sta_info_destroy_part2(str
+ 		WARN_ON_ONCE(ret);
+ 	}
+ 
+-	/* Flush queues before removing keys, as that might remove them
+-	 * from hardware, and then depending on the offload method, any
+-	 * frames sitting on hardware queues might be sent out without
+-	 * any encryption at all.
+-	 */
+-	if (local->ops->set_key) {
+-		if (local->ops->flush_sta)
+-			drv_flush_sta(local, sta->sdata, sta);
+-		else
+-			ieee80211_flush_queues(local, sta->sdata, false);
+-	}
+-
+ 	/* now keys can no longer be reached */
+ 	ieee80211_free_sta_keys(local, sta);
+ 
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -1244,6 +1244,30 @@ void ieee80211_tx_rate_update(struct iee
+ }
+ EXPORT_SYMBOL(ieee80211_tx_rate_update);
+ 
++void ieee80211_tx_status_8023(struct ieee80211_hw *hw,
++                              struct ieee80211_vif *vif,
++                              struct sk_buff *skb)
++{
++        struct ieee80211_sub_if_data *sdata;
++        struct ieee80211_tx_status status = {
++                .skb = skb,
++                .info = IEEE80211_SKB_CB(skb),
++        };
++        struct sta_info *sta;
++
++        sdata = vif_to_sdata(vif);
++
++        rcu_read_lock();
++
++        if (!ieee80211_lookup_ra_sta(sdata, skb, &sta) && !IS_ERR(sta))
++                status.sta = &sta->sta;
++
++        ieee80211_tx_status_ext(hw, &status);
++
++        rcu_read_unlock();
++}
++EXPORT_SYMBOL(ieee80211_tx_status_8023);
++
+ void ieee80211_report_low_ack(struct ieee80211_sta *pubsta, u32 num_packets)
+ {
+ 	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -19406,7 +19406,7 @@ void cfg80211_ch_switch_started_notify(s
+ }
+ EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
+ 
+-int cfg80211_bss_color_notify(struct net_device *dev,
++int cfg80211_bss_color_notify(struct net_device *dev, gfp_t gfp,
+ 			      enum nl80211_commands cmd, u8 count,
+ 			      u64 color_bitmap)
+ {
+@@ -19420,7 +19420,7 @@ int cfg80211_bss_color_notify(struct net
+ 
+ 	trace_cfg80211_bss_color_notify(dev, cmd, count, color_bitmap);
+ 
+-	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
++	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
+ 	if (!msg)
+ 		return -ENOMEM;
+ 
+@@ -19443,7 +19443,7 @@ int cfg80211_bss_color_notify(struct net
+ 	genlmsg_end(msg, hdr);
+ 
+ 	return genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
+-				       msg, 0, NL80211_MCGRP_MLME, GFP_KERNEL);
++				       msg, 0, NL80211_MCGRP_MLME, gfp);
+ 
+ nla_put_failure:
+ 	nlmsg_free(msg);
+--- a/backport-include/linux/netdevice.h
++++ b/backport-include/linux/netdevice.h
+@@ -70,6 +70,9 @@ static inline void netif_trans_update(st
+ 	(_dev)->needs_free_netdev = true;
+ #endif
+ 
++#define netdev_tstats(dev)  dev->tstats
++#define netdev_assign_tstats(dev, e)    dev->tstats = (e);
++
+ #if LINUX_VERSION_IS_LESS(4,15,0)
+ static inline int _bp_netdev_upper_dev_link(struct net_device *dev,
+ 					    struct net_device *upper_dev)
diff --git a/package/kernel/mac80211/patches/ath11k_nss/902-000-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch b/package/kernel/mac80211/patches/ath11k_nss/902-000-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
new file mode 100644
index 00000000000000..f0fc8c14ec1efd
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/902-000-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
@@ -0,0 +1,206 @@
+From 05d9bff2eb8b057d34c7c4b24329dd92cf4faddb Mon Sep 17 00:00:00 2001
+From: Sathishkumar Muruganandam <murugana@codeaurora.org>
+Date: Wed, 18 Nov 2020 23:54:38 +0530
+Subject: [PATCH 1/3] mac80211: add AP_VLAN iftype support on NSS offload case
+
+- allow AP_VLAN iftype to get added, removed
+- add new callback for 4addr rx_notify to get AP_VLAN created from hostapd
+- modify sta_use_4addr drv callback to advertise AP_VLAN vif instead of AP vif
+- modify drv_tx callback to use AP_VLAN vif on NSS offload case
+
+Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
+---
+ include/net/mac80211.h    | 11 +++++++++++
+ net/mac80211/cfg.c        |  5 ++++-
+ net/mac80211/driver-ops.c |  9 +++++----
+ net/mac80211/iface.c      | 10 ++++++----
+ net/mac80211/rx.c         |  6 ++++++
+ net/mac80211/tx.c         | 14 ++++++++++----
+ net/mac80211/util.c       |  6 ++----
+ 7 files changed, 44 insertions(+), 17 deletions(-)
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -5100,6 +5100,17 @@ void ieee80211_sta_pspoll(struct ieee802
+  */
+ void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *sta, u8 tid);
+ 
++/**
++ * ieee80211_rx_nss_notify_4addr - notify userspace about 4addr frame rx
++ * @dev: The device the frame matched to
++ * @addr: the transmitter address of 4addr sta
++ *
++ * When operating in AP mode with NSS offload enabled, this function is used
++ * to invoke cfg80211 callback to notify userspace that an associated station
++ * sent a 4addr frame.
++ */
++void ieee80211_rx_nss_notify_4addr(struct net_device *dev, u8* sta_addr);
++
+ /*
+  * The TX headroom reserved by mac80211 for its own tx_status functions.
+  * This is enough for the radiotap header.
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -2176,7 +2176,13 @@ static int ieee80211_change_station(stru
+ 
+ 			rcu_assign_pointer(vlansdata->u.vlan.sta, sta);
+ 			__ieee80211_check_fast_rx_iface(vlansdata);
+-			drv_sta_set_4addr(local, sta->sdata, &sta->sta, true);
++
++			if (ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD))
++				drv_sta_set_4addr(local, vlansdata, &sta->sta,
++						  true);
++			else
++				drv_sta_set_4addr(local, sta->sdata, &sta->sta,
++						  true);
+ 		}
+ 
+ 		if (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+--- a/net/mac80211/driver-ops.c
++++ b/net/mac80211/driver-ops.c
+@@ -59,10 +59,9 @@ int drv_add_interface(struct ieee80211_l
+ 
+ 	might_sleep();
+ 
+-	if (WARN_ON(sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
+-		    (sdata->vif.type == NL80211_IFTYPE_MONITOR &&
++	if (WARN_ON(sdata->vif.type == NL80211_IFTYPE_MONITOR &&
+ 		     !ieee80211_hw_check(&local->hw, WANT_MONITOR_VIF) &&
+-		     !(sdata->u.mntr.flags & MONITOR_FLAG_ACTIVE))))
++		     !(sdata->u.mntr.flags & MONITOR_FLAG_ACTIVE)))
+ 		return -EINVAL;
+ 
+ 	trace_drv_add_interface(local, sdata);
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -676,6 +676,9 @@ static void ieee80211_do_stop(struct iee
+ 
+ 	switch (sdata->vif.type) {
+ 	case NL80211_IFTYPE_AP_VLAN:
++		if (ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD) &&
++		    going_down)
++			drv_remove_interface(local, sdata);
+ 		break;
+ 	case NL80211_IFTYPE_MONITOR:
+ 		if (local->monitors == 0)
+@@ -960,6 +963,7 @@ static bool ieee80211_iftype_supports_hd
+ 	switch (iftype) {
+ 	/* P2P GO and client are mapped to AP/STATION types */
+ 	case NL80211_IFTYPE_AP:
++	case NL80211_IFTYPE_AP_VLAN:
+ 	case NL80211_IFTYPE_STATION:
+ 		return true;
+ 	default:
+@@ -1014,7 +1018,8 @@ static void ieee80211_set_vif_encap_ops(
+ 	struct ieee80211_sub_if_data *bss = sdata;
+ 	bool enabled;
+ 
+-	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
++	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
++	    !ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD)) {
+ 		if (!sdata->bss)
+ 			return;
+ 
+@@ -1359,10 +1364,17 @@ int ieee80211_do_open(struct wireless_de
+ 
+ 	switch (sdata->vif.type) {
+ 	case NL80211_IFTYPE_AP_VLAN:
+-		/* no need to tell driver, but set carrier and chanctx */
+ 		if (sdata->bss->active) {
+ 			ieee80211_link_vlan_copy_chanctx(&sdata->deflink);
+ 			netif_carrier_on(dev);
++
++			if (ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD)) {
++				ieee80211_set_sdata_offload_flags(sdata);
++				res = drv_add_interface(local, sdata);
++				if (res)
++					goto err_del_interface;
++			}
++
+ 			ieee80211_set_vif_encap_ops(sdata);
+ 		} else {
+ 			netif_carrier_off(dev);
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1759,6 +1759,12 @@ void ieee80211_sta_uapsd_trigger(struct
+ }
+ EXPORT_SYMBOL(ieee80211_sta_uapsd_trigger);
+ 
++void ieee80211_rx_nss_notify_4addr(struct net_device *dev, u8 *sta_addr)
++{
++	cfg80211_rx_unexpected_4addr_frame(dev, sta_addr, GFP_ATOMIC);
++}
++EXPORT_SYMBOL(ieee80211_rx_nss_notify_4addr);
++
+ static ieee80211_rx_result debug_noinline
+ ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
+ {
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -4725,7 +4725,8 @@ static void ieee80211_8023_xmit(struct i
+ 	info->flags |= info_flags;
+ 	info->hw_queue = sdata->vif.hw_queue[queue];
+ 
+-	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
++	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
++		!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD))
+ 		sdata = container_of(sdata->bss,
+ 				     struct ieee80211_sub_if_data, u.ap);
+ 
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -2410,6 +2410,9 @@ static void ieee80211_assign_chanctx(str
+ 	if (!local->use_chanctx)
+ 		return;
+ 
++	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
++		return;
++
+ 	mutex_lock(&local->chanctx_mtx);
+ 	conf = rcu_dereference_protected(link->conf->chanctx_conf,
+ 					 lockdep_is_held(&local->chanctx_mtx));
+@@ -2615,7 +2618,8 @@ int ieee80211_reconfig(struct ieee80211_
+ 	}
+ 
+ 	list_for_each_entry(sdata, &local->interfaces, list) {
+-		if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
++		if ((sdata->vif.type != NL80211_IFTYPE_AP_VLAN ||
++		    ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD)) &&
+ 		    sdata->vif.type != NL80211_IFTYPE_MONITOR &&
+ 		    ieee80211_sdata_running(sdata)) {
+ 			res = drv_add_interface(local, sdata);
+@@ -2630,7 +2634,8 @@ int ieee80211_reconfig(struct ieee80211_
+ 	if (res) {
+ 		list_for_each_entry_continue_reverse(sdata, &local->interfaces,
+ 						     list)
+-			if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
++			if ((sdata->vif.type != NL80211_IFTYPE_AP_VLAN ||
++			    ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD)) &&
+ 			    sdata->vif.type != NL80211_IFTYPE_MONITOR &&
+ 			    ieee80211_sdata_running(sdata))
+ 				drv_remove_interface(local, sdata);
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -5235,7 +5235,8 @@ static bool ieee80211_assoc_success(stru
+ 	 * If we're using 4-addr mode, let the AP know that we're
+ 	 * doing so, so that it can create the STA VLAN on its side
+ 	 */
+-	if (ifmgd->use_4addr)
++	if (ifmgd->use_4addr &&
++	    (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD)))
+ 		ieee80211_send_4addr_nullfunc(local, sdata);
+ 
+ 	/*
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -1457,7 +1457,9 @@ static inline void drv_sta_set_4addr(str
+ 				     struct ieee80211_sub_if_data *sdata,
+ 				     struct ieee80211_sta *sta, bool enabled)
+ {
+-	sdata = get_bss_sdata(sdata);
++	if (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD))
++		sdata = get_bss_sdata(sdata);
++
+ 	if (!check_sdata_in_driver(sdata))
+ 		return;
+ 
diff --git a/package/kernel/mac80211/patches/ath11k_nss/902-001-ath11k-add-WDS-offload-changes-to-NSS-driver-interface.patch b/package/kernel/mac80211/patches/ath11k_nss/902-001-ath11k-add-WDS-offload-changes-to-NSS-driver-interface.patch
new file mode 100644
index 00000000000000..7e2a9f0ee4dd4b
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/902-001-ath11k-add-WDS-offload-changes-to-NSS-driver-interface.patch
@@ -0,0 +1,701 @@
+From d4c3b17e66243a2d6d8845192453ef7da568bac2 Mon Sep 17 00:00:00 2001
+From: Sathishkumar Muruganandam <murugana@codeaurora.org>
+Date: Thu, 10 Sep 2020 15:58:53 +0530
+Subject: [PATCH 1/2] ath11k: add WDS offload changes to NSS driver interface
+
+add WDS and MEC AST handling to NSS
+
+Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/nss.c | 465 ++++++++++++++++++++++++++++++++--
+ drivers/net/wireless/ath/ath11k/nss.h |  36 ++-
+ 2 files changed, 473 insertions(+), 28 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/nss.c
++++ b/drivers/net/wireless/ath/ath11k/nss.c
+@@ -9,10 +9,12 @@
+ #include "nss.h"
+ #include "core.h"
+ #include "peer.h"
++#include "dp_tx.h"
+ #include "dp_rx.h"
+ #include "dp_tx.h"
+ #include "hif.h"
+ #include "wmi.h"
++#include "wmi.h"
+ #include "../../../../../net/mac80211/sta_info.h"
+ 
+ /*-----------------------------ATH11K-NSS Helpers--------------------------*/
+@@ -348,6 +350,22 @@ void ath11k_nss_wifili_event_receive(str
+ 		ath11k_nss_wifili_link_desc_return(ab,
+ 						   (void *)&msg->msg.linkdescinfomsg);
+ 		break;
++	case NSS_WIFILI_WDS_PEER_ADD_MSG:
++		ath11k_dbg(ab, ATH11K_DBG_NSS_WDS, "nss wifili wds peer add event received %d response %d error %d\n",
++			   msg_type, response, error);
++		break;
++	case NSS_WIFILI_WDS_PEER_UPDATE_MSG:
++		ath11k_dbg(ab, ATH11K_DBG_NSS_WDS, "nss wifili wds peer update event received %d response %d error %d\n",
++			   msg_type, response, error);
++		break;
++	case NSS_WIFILI_WDS_PEER_MAP_MSG:
++		ath11k_dbg(ab, ATH11K_DBG_NSS_WDS, "nss wifili wds peer map event received %d response %d error %d\n",
++			   msg_type, response, error);
++		break;
++	case NSS_WIFILI_WDS_PEER_DEL_MSG:
++		ath11k_dbg(ab, ATH11K_DBG_NSS_WDS, "nss wifili wds peer del event received %d response %d error %d\n",
++			   msg_type, response, error);
++		break;
+ 	default:
+ 		ath11k_dbg(ab, ATH11K_DBG_NSS, "unhandled event %d\n", msg_type);
+ 		break;
+@@ -458,13 +476,6 @@ static void ath11k_nss_vdev_event_receiv
+ 	/*TODO*/
+ }
+ 
+-static void
+-ath11k_nss_vdev_special_data_receive(struct net_device *dev, struct sk_buff *skb,
+-				     __attribute__((unused)) struct napi_struct *napi)
+-{
+-	/* TODO */
+-}
+-
+ /* TODO: move to mac80211 after cleanups/refactoring required after feature completion */
+ static int ath11k_nss_deliver_rx(struct ieee80211_vif *vif, struct sk_buff *skb,
+ 				 bool eth,  int data_offs, struct napi_struct *napi)
+@@ -588,11 +599,239 @@ static int ath11k_nss_undecap_nwifi(stru
+ 	return 0;
+ }
+ 
++static void ath11k_nss_wds_type_rx(struct ath11k *ar, u8* src_mac, u8 is_sa_valid,
++				   u8 addr4_valid, u16 peer_id)
++{
++	struct ath11k_base *ab = ar->ab;
++	struct ath11k_ast_entry *ast_entry = NULL;
++	struct ath11k_peer *ta_peer = NULL;
++
++	spin_lock_bh(&ab->base_lock);
++	ta_peer = ath11k_peer_find_by_id(ab, peer_id);
++
++	if (!ta_peer) {
++		spin_unlock_bh(&ab->base_lock);
++		return;
++	}
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS_WDS,"ath11k_nss_wds_type_rx ta_peer %pM\n",
++		   ta_peer->addr);
++
++	if (addr4_valid) {
++		ast_entry = ath11k_peer_ast_find_by_addr(ab, src_mac);
++		if (!is_sa_valid) {
++			ath11k_peer_add_ast(ar, ta_peer, src_mac,
++					    ATH11K_AST_TYPE_WDS);
++			ath11k_nss_add_wds_peer(ar, ta_peer,
++						src_mac, ATH11K_AST_TYPE_WDS);
++		} else {
++			if (!ast_entry) {
++				ath11k_peer_add_ast(ar, ta_peer, src_mac,
++						    ATH11K_AST_TYPE_WDS);
++				ath11k_nss_add_wds_peer(ar, ta_peer, src_mac,
++							ATH11K_AST_TYPE_WDS);
++			} else {
++				ath11k_peer_update_ast(ar, ta_peer, ast_entry);
++				ath11k_nss_update_wds_peer(ar, ta_peer, src_mac);
++			}
++		}
++	}
++
++	spin_unlock_bh(&ab->base_lock);
++}
++
++static void ath11k_nss_mec_handler(struct ath11k *ar, u8* mec_mac_addr)
++{
++	struct ath11k_base *ab = ar->ab;
++	struct ath11k_peer *peer = ar->bss_peer;
++	u8 mac_addr[ETH_ALEN];
++	u32 *mac_addr_l32;
++	u16 *mac_addr_h16;
++
++	if (!peer)
++		return;
++
++	/* mec_mac_addr has the swapped mac_addr after 4 bytes (sizeof(u32))
++	 * mec_mac_addr[0]
++	 * |
++	 * 03:0a:00:00:2d:15:22:f0:fd:8c
++	 *		^
++	 * 		Swapped MAC address present after 4 bytes
++	 * MAC address after swapping is 8c:fd:f0:22:15:2d */
++
++	mac_addr_l32 = (u32 *) (mec_mac_addr + sizeof(u32));
++	mac_addr_h16 = (u16 *) (mec_mac_addr + sizeof(u32) + sizeof(u32));
++
++	*mac_addr_l32 = swab32(*mac_addr_l32);
++	*mac_addr_h16 = swab16(*mac_addr_h16);
++
++	memcpy(mac_addr, mac_addr_h16, ETH_ALEN - 4);
++	memcpy(mac_addr + 2, mac_addr_l32, 4);
++
++	if (!ether_addr_equal(ar->mac_addr, mac_addr)) {
++		spin_lock_bh(&ab->base_lock);
++		ath11k_peer_add_ast(ar, peer, mac_addr,
++				    ATH11K_AST_TYPE_MEC);
++		spin_unlock_bh(&ab->base_lock);
++	}
++}
++
++static void ath11k_nss_vdev_spl_receive_ext_wdsdata(struct ath11k_vif *arvif,
++						    struct sk_buff *skb,
++						    struct nss_wifi_vdev_wds_per_packet_metadata *wds_metadata)
++{
++	struct ath11k *ar = arvif->ar;
++	struct ath11k_base *ab = ar->ab;
++	enum wifi_vdev_ext_wds_info_type wds_type;
++	u8 is_sa_valid = 0, addr4_valid = 0;
++	u16 peer_id;
++	u8 src_mac[ETH_ALEN];
++
++	is_sa_valid = wds_metadata->is_sa_valid;
++	addr4_valid = wds_metadata->addr4_valid;
++	wds_type = wds_metadata->wds_type;
++	peer_id = wds_metadata->peer_id;
++
++	memcpy(src_mac, ((struct ethhdr *)skb->data)->h_source, ETH_ALEN);
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS_WDS,"receive_ext_wdsdata wds_type %d peer id %u sa_valid %d addr4_valid %d src_mac %pM\n",
++		   wds_type, peer_id, is_sa_valid, addr4_valid, src_mac);
++
++	switch (wds_type) {
++		case NSS_WIFI_VDEV_WDS_TYPE_RX:
++			ath11k_nss_wds_type_rx(ar, src_mac, is_sa_valid,
++					       addr4_valid, peer_id);
++			break;
++		case NSS_WIFI_VDEV_WDS_TYPE_MEC:
++			ath11k_nss_mec_handler(ar, (u8 *)(skb->data));
++			break;
++		default:
++			ath11k_warn(ab, "unsupported wds_type %d\n", wds_type);
++			break;
++	}
++}
++
++static bool ath11k_nss_vdev_data_receive_mec_check(struct ath11k *ar,
++						   struct sk_buff *skb)
++{
++	struct ath11k_base *ab = ar->ab;
++	struct ath11k_ast_entry *ast_entry = NULL;
++	u8 src_mac[ETH_ALEN];
++
++	memcpy(src_mac, ((struct ethhdr *)skb->data)->h_source, ETH_ALEN);
++	ath11k_dbg(ab, ATH11K_DBG_NSS_WDS,
++		   "ath11k_nss_vdev_data_receive_mec_check src mac %pM\n",
++		   src_mac);
++
++	spin_lock_bh(&ab->base_lock);
++	ast_entry = ath11k_peer_ast_find_by_addr(ab, src_mac);
++
++	if (ast_entry && ast_entry->type == ATH11K_AST_TYPE_MEC) {
++		spin_unlock_bh(&ab->base_lock);
++		ath11k_dbg(ab, ATH11K_DBG_NSS_WDS,
++			   "dropping mec traffic from %pM\n", ast_entry->addr);
++		return true;
++	}
++
++	spin_unlock_bh(&ab->base_lock);
++	return false;
++}
++
++static int ath11k_nss_undecap(struct ath11k_vif *arvif, struct sk_buff *skb,
++			      int *data_offs, bool *eth_decap)
++{
++	enum ath11k_hw_txrx_mode decap_type;
++
++	decap_type = arvif->nss.decap;
++
++	switch (decap_type) {
++	case ATH11K_HW_TXRX_RAW:
++		return ath11k_nss_undecap_raw(arvif, skb, data_offs);
++	case ATH11K_HW_TXRX_NATIVE_WIFI:
++		return ath11k_nss_undecap_nwifi(arvif, skb, data_offs);
++	case ATH11K_HW_TXRX_ETHERNET:
++		*eth_decap = true;
++		return 0;
++	default:
++		return -EINVAL;
++	}
++}
++
++static void
++ath11k_nss_vdev_special_data_receive(struct net_device *dev, struct sk_buff *skb,
++				     __attribute__((unused)) struct napi_struct *napi)
++{
++	struct nss_wifi_vdev_per_packet_metadata *wifi_metadata = NULL;
++	struct nss_wifi_vdev_wds_per_packet_metadata *wds_metadata = NULL;
++	struct wireless_dev *wdev;
++	struct ieee80211_vif *vif;
++	struct ath11k_vif *arvif;
++	struct ath11k_base *ab;
++	bool eth_decap = false;
++	int data_offs = 0;
++	int ret = 0;
++
++	if (!dev) {
++		dev_kfree_skb_any(skb);
++		return;
++	}
++
++	wdev = dev->ieee80211_ptr;
++	if (!wdev) {
++		dev_kfree_skb_any(skb);
++		return;
++	}
++
++	vif = wdev_to_ieee80211_vif(wdev);
++	if (!vif) {
++		dev_kfree_skb_any(skb);
++		return;
++	}
++
++	arvif = (struct ath11k_vif *)vif->drv_priv;
++	if (!arvif) {
++		dev_kfree_skb_any(skb);
++		return;
++	}
++
++	ab = arvif->ar->ab;
++
++	skb->dev = dev;
++
++	dma_unmap_single(ab->dev, virt_to_phys(skb->head),
++			 NSS_WIFI_VDEV_PER_PACKET_METADATA_OFFSET +
++			 sizeof(struct nss_wifi_vdev_per_packet_metadata),
++			 DMA_FROM_DEVICE);
++
++	wifi_metadata = (struct nss_wifi_vdev_per_packet_metadata *)(skb->head +
++			 NSS_WIFI_VDEV_PER_PACKET_METADATA_OFFSET);
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS_WDS,
++		   "dp special data from nss: wifi_metadata->pkt_type %d",
++		   wifi_metadata->pkt_type);
++
++	ret = ath11k_nss_undecap(arvif, skb, &data_offs, &eth_decap);
++	if (ret) {
++		ath11k_warn(ab, "error in nss rx undecap, type %d err %d\n",
++			    arvif->nss.decap, ret);
++		dev_kfree_skb_any(skb);
++		return;
++	}
++
++	if (eth_decap && wifi_metadata->pkt_type ==
++	    NSS_WIFI_VDEV_EXT_DATA_PKT_TYPE_WDS_LEARN) {
++		wds_metadata = &wifi_metadata->metadata.wds_metadata;
++		ath11k_nss_vdev_spl_receive_ext_wdsdata(arvif, skb,
++							wds_metadata);
++	}
++
++	ath11k_nss_deliver_rx(arvif->vif, skb, eth_decap, data_offs, napi);
++}
++
+ static void
+ ath11k_nss_vdev_data_receive(struct net_device *dev, struct sk_buff *skb,
+ 			     __attribute__((unused)) struct napi_struct *napi)
+ {
+-	enum ath11k_hw_txrx_mode decap_type;
+ 	struct wireless_dev *wdev;
+ 	struct ieee80211_vif *vif;
+ 	struct ath11k_vif *arvif;
+@@ -632,28 +871,16 @@ ath11k_nss_vdev_data_receive(struct net_
+ 	ath11k_dbg_dump(ab, ATH11K_DBG_DP_RX, "", "dp rx msdu from nss: ",
+ 			skb->data, skb->len);
+ 
+-	decap_type = arvif->nss.decap;
+-
+-	switch (decap_type) {
+-	case ATH11K_HW_TXRX_RAW:
+-		ret = ath11k_nss_undecap_raw(arvif, skb, &data_offs);
+-		break;
+-	case ATH11K_HW_TXRX_NATIVE_WIFI:
+-		ret = ath11k_nss_undecap_nwifi(arvif, skb, &data_offs);
+-		break;
+-	case ATH11K_HW_TXRX_ETHERNET:
+-		/* no changes required for ethernet decap */
+-		ret = 0;
+-		eth_decap = true;
+-		break;
+-	default:
+-		ret = -EINVAL;
+-		break;
++	if ((vif->type == NL80211_IFTYPE_STATION && wdev->use_4addr) &&
++	     ath11k_nss_vdev_data_receive_mec_check(arvif->ar, skb)) {
++		dev_kfree_skb_any(skb);
++		return;
+ 	}
+ 
++	ret = ath11k_nss_undecap(arvif, skb, &data_offs, &eth_decap);
+ 	if (ret) {
+-		ath11k_warn(ab, "error in nss rx undecap, type %d err %d\n", decap_type,
+-			    ret);
++		ath11k_warn(ab, "error in nss rx undecap, type %d err %d\n",
++			    arvif->nss.decap, ret);
+ 		dev_kfree_skb_any(skb);
+ 		return;
+ 	}
+@@ -1362,7 +1589,7 @@ void ath11k_nss_update_sta_rxrate(struct
+ 	peer->nss.nss_stats->rxrate.bw = ath11k_mac_bw_to_mac80211_bw(ppdu_info->bw);
+ }
+ 
+-int ath11k_nss_peer_delete(struct ath11k_base *ab, const u8 *addr)
++int ath11k_nss_peer_delete(struct ath11k_base *ab, u32 vdev_id, const u8 *addr)
+ {
+ 	struct nss_wifili_peer_msg *peer_msg;
+ 	struct nss_wifili_msg *wlmsg = NULL;
+@@ -1376,9 +1603,10 @@ int ath11k_nss_peer_delete(struct ath11k
+ 
+ 	spin_lock_bh(&ab->base_lock);
+ 
+-	peer = ath11k_peer_find_by_addr(ab, addr);
++	peer = ath11k_peer_find(ab, vdev_id, addr);
+ 	if (!peer) {
+-		ath11k_warn(ab, "peer (%pM) not found for nss peer delete\n", addr);
++		ath11k_warn(ab, "peer (%pM) not found on vdev_id %d for nss peer delete\n",
++			    addr, vdev_id);
+ 		spin_unlock_bh(&ab->base_lock);
+ 		return -EINVAL;
+ 	}
+@@ -1451,8 +1679,9 @@ free_peer:
+ 	return ret;
+ }
+ 
+-int ath11k_nss_peer_create(struct ath11k_base *ab, struct ath11k_peer *peer)
++int ath11k_nss_peer_create(struct ath11k *ar, struct ath11k_peer *peer)
+ {
++	struct ath11k_base *ab = ar->ab;
+ 	struct nss_wifili_peer_msg *peer_msg;
+ 	struct nss_wifili_msg *wlmsg = NULL;
+ 	nss_wifili_msg_callback_t msg_cb;
+@@ -1509,17 +1738,23 @@ int ath11k_nss_peer_create(struct ath11k
+ 	status = nss_wifili_tx_msg(ab->nss.ctx, wlmsg);
+ 	if (status != NSS_TX_SUCCESS) {
+ 		ret = -EINVAL;
+-		ath11k_warn(ab, "nss send peer (%pM) create msg tx error\n",
+-			    peer->addr);
++		ath11k_warn(ab, "nss send peer (%pM) create msg tx error: %d\n",
++			    peer->addr, status);
+ 		goto peer_mem_free;
+ 	}
+ 
+-	ret = 0;
+ 	ath11k_dbg(ab, ATH11K_DBG_NSS,
+ 		   "nss peer_create msg success mac:%pM vdev:%d peer_id:%d hw_ast_idx:%d ast_hash:%d\n",
+ 		   peer_msg->peer_mac_addr, peer_msg->vdev_id, peer_msg->peer_id,
+ 		   peer_msg->hw_ast_idx, peer_msg->tx_ast_hash);
+ 
++	ret = ath11k_peer_add_ast(ar, peer, peer->addr,
++				  ATH11K_AST_TYPE_STATIC);
++	if (ret) {
++		ath11k_warn(ab, "failed to add STATIC ast: %d\n", ret);
++		goto peer_mem_free;
++	}
++
+ 	peer->nss.nss_stats = kzalloc(sizeof(*peer->nss.nss_stats), GFP_ATOMIC);
+ 	if (!peer->nss.nss_stats) {
+ 		ret = -ENOMEM;
+@@ -1538,6 +1773,199 @@ msg_free:
+ 	return ret;
+ }
+ 
++int ath11k_nss_add_wds_peer(struct ath11k *ar, struct ath11k_peer *peer,
++			    u8 *dest_mac, enum ath11k_ast_entry_type type)
++{
++	struct ath11k_base *ab = ar->ab;
++	struct nss_wifili_wds_peer_msg *wds_peer_msg;
++	struct nss_wifili_msg *wlmsg = NULL;
++	nss_wifili_msg_callback_t msg_cb;
++	nss_tx_status_t status;
++	int ret = 0;
++
++	wlmsg = kzalloc(sizeof(struct nss_wifili_msg), GFP_ATOMIC);
++	if (wlmsg == NULL)
++		return -ENOMEM;
++
++	wds_peer_msg = &wlmsg->msg.wdspeermsg;
++
++	wds_peer_msg->pdev_id = ar->pdev->pdev_id;
++	wds_peer_msg->ast_type = type;
++	wds_peer_msg->peer_id = peer->peer_id;
++
++	if (type == ATH11K_AST_TYPE_MEC)
++		ether_addr_copy(wds_peer_msg->peer_mac, ar->mac_addr);
++	else
++		ether_addr_copy(wds_peer_msg->peer_mac, peer->addr);
++
++	ether_addr_copy(wds_peer_msg->dest_mac, dest_mac);
++
++	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++
++	nss_cmn_msg_init(&wlmsg->cm, ab->nss.if_num,
++			 NSS_WIFILI_WDS_PEER_ADD_MSG,
++			 sizeof(struct nss_wifili_wds_peer_msg),
++			 msg_cb, NULL);
++
++	status = nss_wifili_tx_msg(ab->nss.ctx, wlmsg);
++	if (status != NSS_TX_SUCCESS) {
++		ret = -EINVAL;
++		ath11k_warn(ab, "nss send wds add peer msg tx error: %d\n",
++			    status);
++		goto msg_free;
++	}
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS_WDS,
++		   "nss add wds peer success peer mac:%pM dest mac:%pM peer_id:%d\n",
++		   wds_peer_msg->peer_mac, wds_peer_msg->dest_mac, wds_peer_msg->peer_id);
++
++msg_free:
++	kfree(wlmsg);
++	return ret;
++}
++
++int ath11k_nss_update_wds_peer(struct ath11k *ar, struct ath11k_peer *peer,
++			       u8 *dest_mac)
++{
++	struct ath11k_base *ab = ar->ab;
++	struct nss_wifili_wds_peer_msg *wds_peer_msg;
++	struct nss_wifili_msg *wlmsg = NULL;
++	nss_wifili_msg_callback_t msg_cb;
++	nss_tx_status_t status;
++	int ret = 0;
++
++	wlmsg = kzalloc(sizeof(struct nss_wifili_msg), GFP_ATOMIC);
++	if (wlmsg == NULL)
++		return -ENOMEM;
++
++	wds_peer_msg = &wlmsg->msg.wdspeermsg;
++
++	wds_peer_msg->pdev_id = ar->pdev->pdev_id;
++	wds_peer_msg->ast_type = ATH11K_AST_TYPE_WDS;
++	wds_peer_msg->peer_id = peer->peer_id;
++	ether_addr_copy(wds_peer_msg->peer_mac, peer->addr);
++	ether_addr_copy(wds_peer_msg->dest_mac, dest_mac);
++
++	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++
++	nss_cmn_msg_init(&wlmsg->cm, ab->nss.if_num,
++			 NSS_WIFILI_WDS_PEER_UPDATE_MSG,
++			 sizeof(struct nss_wifili_wds_peer_msg),
++			 msg_cb, NULL);
++
++	status = nss_wifili_tx_msg(ab->nss.ctx, wlmsg);
++	if (status != NSS_TX_SUCCESS) {
++		ret = -EINVAL;
++		ath11k_warn(ab, "nss send wds update peer msg tx error: %d\n",
++			    status);
++		goto msg_free;
++	}
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS_WDS,
++		   "nss update wds peer success peer mac:%pM dest mac:%pM peer_id:%d\n",
++		   wds_peer_msg->peer_mac, wds_peer_msg->dest_mac, wds_peer_msg->peer_id);
++
++msg_free:
++	kfree(wlmsg);
++	return ret;
++}
++
++int ath11k_nss_map_wds_peer(struct ath11k *ar, struct ath11k_peer *peer,
++			    u8 *dest_mac, enum ath11k_ast_entry_type type)
++{
++	struct ath11k_base *ab = ar->ab;
++	struct nss_wifili_wds_peer_map_msg *wds_peer_map_msg;
++	struct nss_wifili_msg *wlmsg = NULL;
++	nss_wifili_msg_callback_t msg_cb;
++	nss_tx_status_t status;
++	int ret = 0;
++
++	wlmsg = kzalloc(sizeof(struct nss_wifili_msg), GFP_ATOMIC);
++	if (wlmsg == NULL)
++		return -ENOMEM;
++
++	wds_peer_map_msg = &wlmsg->msg.wdspeermapmsg;
++
++	wds_peer_map_msg->vdev_id = peer->vdev_id;
++	wds_peer_map_msg->ast_idx = peer->hw_peer_id;
++
++	if (type == ATH11K_AST_TYPE_MEC)
++		wds_peer_map_msg->peer_id = NSS_WIFILI_MEC_PEER_ID;
++	else
++		wds_peer_map_msg->peer_id = peer->peer_id;
++
++	ether_addr_copy(wds_peer_map_msg->dest_mac, dest_mac);
++
++	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++
++	nss_cmn_msg_init(&wlmsg->cm, ab->nss.if_num,
++			 NSS_WIFILI_WDS_PEER_MAP_MSG,
++			 sizeof(struct nss_wifili_wds_peer_map_msg),
++			 msg_cb, NULL);
++
++	status = nss_wifili_tx_msg(ab->nss.ctx, wlmsg);
++	if (status != NSS_TX_SUCCESS) {
++		ret = -EINVAL;
++		ath11k_warn(ab, "nss send wds peer map msg tx error: %d\n",
++			    status);
++		goto msg_free;
++	}
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS_WDS,
++		   "nss wds peer map success mac:%pM hw_ast_idx:%d peer_id:%d\n",
++		   wds_peer_map_msg->dest_mac, wds_peer_map_msg->ast_idx, wds_peer_map_msg->peer_id);
++
++msg_free:
++	kfree(wlmsg);
++	return ret;
++}
++
++int ath11k_nss_del_wds_peer(struct ath11k *ar, struct ath11k_peer *peer,
++			    u8 *dest_mac)
++{
++	struct ath11k_base *ab = ar->ab;
++	struct nss_wifili_wds_peer_msg *wds_peer_msg;
++	struct nss_wifili_msg *wlmsg = NULL;
++	nss_wifili_msg_callback_t msg_cb;
++	nss_tx_status_t status;
++	int ret = 0;
++
++	wlmsg = kzalloc(sizeof(struct nss_wifili_msg), GFP_ATOMIC);
++	if (wlmsg == NULL)
++		return -ENOMEM;
++
++	wds_peer_msg = &wlmsg->msg.wdspeermsg;
++
++	wds_peer_msg->pdev_id = ar->pdev->pdev_id;
++	wds_peer_msg->ast_type = ATH11K_AST_TYPE_NONE;
++	wds_peer_msg->peer_id = peer->peer_id;
++	ether_addr_copy(wds_peer_msg->peer_mac, peer->addr);
++	ether_addr_copy(wds_peer_msg->dest_mac, dest_mac);
++
++	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++
++	nss_cmn_msg_init(&wlmsg->cm, ab->nss.if_num,
++			 NSS_WIFILI_WDS_PEER_DEL_MSG,
++			 sizeof(struct nss_wifili_wds_peer_msg),
++			 msg_cb, NULL);
++
++	status = nss_wifili_tx_msg(ab->nss.ctx, wlmsg);
++	if (status != NSS_TX_SUCCESS) {
++		ret = -EINVAL;
++		ath11k_warn(ab, "nss send wds del peer msg tx error: %d\n",
++			    status);
++		goto msg_free;
++	}
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS_WDS,
++		   "nss del wds peer success peer mac:%pM dest mac:%pM peer_id:%d\n",
++		   wds_peer_msg->peer_mac, wds_peer_msg->dest_mac, wds_peer_msg->peer_id);
++
++msg_free:
++	kfree(wlmsg);
++	return ret;
++}
++
+ /*-------------------------------INIT/DEINIT---------------------------------*/
+ 
+ static int ath11k_nss_radio_buf_cfg(struct ath11k *ar, int range, int buf_sz)
+@@ -1931,7 +2359,7 @@ static int ath11k_nss_init(struct ath11k
+ 
+ 	status = nss_wifili_tx_msg(nss_contex, wlmsg);
+ 	if (status != NSS_TX_SUCCESS) {
+-		ath11k_warn(ab, "failure to send nss init msg\n");
++		ath11k_warn(ab, "failure to send nss init msg: %d \n", status);
+ 		goto unregister;
+ 	}
+ 
+@@ -1985,7 +2413,8 @@ static int ath11k_nss_stats_cfg(struct a
+ 
+ 	status = nss_wifili_tx_msg(ar->nss.ctx, wlmsg);
+ 	if (status != NSS_TX_SUCCESS) {
+-		ath11k_warn(ab, "nss stats cfg %d msg tx failure\n", nss_msg);
++		ath11k_warn(ab, "nss stats cfg %d msg tx failure: %d\n",
++			    nss_msg, status);
+ 		ret = -EINVAL;
+ 		goto free;
+ 	}
+--- a/drivers/net/wireless/ath/ath11k/nss.h
++++ b/drivers/net/wireless/ath/ath11k/nss.h
+@@ -17,12 +17,14 @@ struct ath11k_base;
+ struct ath11k_vif;
+ struct ath11k_peer;
+ struct ath11k_sta;
++enum ath11k_ast_entry_type;
+ struct hal_rx_mon_ppdu_info;
+ struct hal_rx_user_status;
+ 
+ /* NSS DBG macro is not included as part of debug enum to avoid
+  * frequent changes during upgrade*/
+-#define ATH11K_DBG_NSS	0x80000000
++#define ATH11K_DBG_NSS	0x40000000
++#define ATH11K_DBG_NSS_WDS	0x80000000
+ 
+ /* WIFILI Supported Target Types */
+ #define ATH11K_WIFILI_TARGET_TYPE_UNKNOWN   0xFF
+@@ -208,11 +210,19 @@ int ath11k_nss_vdev_create(struct ath11k
+ void ath11k_nss_vdev_delete(struct ath11k_vif *arvif);
+ int ath11k_nss_vdev_up(struct ath11k_vif *arvif);
+ int ath11k_nss_vdev_down(struct ath11k_vif *arvif);
+-int ath11k_nss_peer_delete(struct ath11k_base *ab, const u8 *addr);
++int ath11k_nss_peer_delete(struct ath11k_base *ab, u32 vdev_id, const u8 *addr);
+ int ath11k_nss_set_peer_authorize(struct ath11k *ar, u16 peer_id);
+-int ath11k_nss_peer_create(struct ath11k_base *ab, struct ath11k_peer *peer);
++int ath11k_nss_peer_create(struct ath11k *ar, struct ath11k_peer *peer);
+ void ath11k_nss_peer_stats_enable(struct ath11k *ar);
+ void ath11k_nss_peer_stats_disable(struct ath11k *ar);
++int ath11k_nss_add_wds_peer(struct ath11k *ar, struct ath11k_peer *peer,
++			    u8 *dest_mac, enum ath11k_ast_entry_type type);
++int ath11k_nss_update_wds_peer(struct ath11k *ar, struct ath11k_peer *peer,
++			       u8 *dest_mac);
++int ath11k_nss_map_wds_peer(struct ath11k *ar, struct ath11k_peer *peer,
++			    u8 *dest_mac, enum ath11k_ast_entry_type type);
++int ath11k_nss_del_wds_peer(struct ath11k *ar, struct ath11k_peer *peer,
++			    u8 *dest_mac);
+ int ath11k_nss_set_peer_sec_type(struct ath11k *ar, struct ath11k_peer *peer,
+ 				 struct ieee80211_key_conf *key_conf);
+ void ath11k_nss_update_sta_stats(struct station_info *sinfo,
+@@ -274,12 +284,37 @@ static inline int ath11k_nss_vdev_down(s
+ 	return 0;
+ }
+ 
+-static inline int ath11k_nss_peer_delete(struct ath11k_base *ab, const u8 *addr)
++static inline int ath11k_nss_peer_delete(struct ath11k_base *ab, u32 vdev_id,
++                                         const u8 *addr)
+ {
+ 	return 0;
+ }
+ 
+-static inline int ath11k_nss_peer_create(struct ath11k_base *ab, struct ath11k_peer *peer)
++static inline int ath11k_nss_add_wds_peer(struct ath11k *ar, struct ath11k_peer *peer,
++					  u8 *dest_mac, int type)
++{
++	return 0;
++}
++
++static inline int ath11k_nss_update_wds_peer(struct ath11k *ar, struct ath11k_peer *peer,
++					     u8 *dest_mac)
++{
++	return 0;
++}
++
++static inline int ath11k_nss_map_wds_peer(struct ath11k *ar, struct ath11k_peer *peer,
++					  u8 *dest_mac, int type)
++{
++	return 0;
++}
++
++static inline int ath11k_nss_del_wds_peer(struct ath11k_vif *arvif, struct ath11k_peer *peer,
++			    u8 *dest_mac)
++{
++	return 0;
++}
++
++static inline int ath11k_nss_peer_create(struct ath11k *ar, struct ath11k_peer *peer)
+ {
+ 	return 0;
+ }
diff --git a/package/kernel/mac80211/patches/ath11k_nss/902-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch b/package/kernel/mac80211/patches/ath11k_nss/902-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
new file mode 100644
index 00000000000000..143191f6a9bca9
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/902-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
@@ -0,0 +1,102 @@
+From 36ee9d37b53c933f4dd8f934f8e0273b5e901549 Mon Sep 17 00:00:00 2001
+From: Sathishkumar Muruganandam <murugana@codeaurora.org>
+Date: Fri, 8 Jan 2021 00:02:54 +0530
+Subject: [PATCH 1/3] mac80211: add dynamic VLAN support on NSS offload
+
+NSS requires dynamic AP_VLAN vif ifnum and its corresponding VLAN ID
+and group key index to configure dynamic VLAN ext VDEV in NSS.
+
+Hence mac80211 set_key and sta_state callbacks are modified to advertise
+AP_VLAN vif when NSS offload is enabled and VLAN ID provided by hostapd
+in key params is stored to ieee80211_key_conf for the driver.
+
+Co-Developed-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
+---
+ include/net/mac80211.h    | 3 +++
+ net/mac80211/cfg.c        | 1 +
+ net/mac80211/driver-ops.c | 4 +++-
+ net/mac80211/driver-ops.h | 4 +++-
+ net/mac80211/key.c        | 5 ++++-
+ net/mac80211/tx.c         | 4 ++++
+ 6 files changed, 18 insertions(+), 3 deletions(-)
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -2089,6 +2089,8 @@ enum ieee80211_key_flags {
+  * @tx_pn: PN used for TX keys, may be used by the driver as well if it
+  *	needs to do software PN assignment by itself (e.g. due to TSO)
+  * @flags: key flags, see &enum ieee80211_key_flags.
++ * @vlan_id: VLAN ID corresponding to the group key.
++ *	For VLAN interfaces 1-4096, 0 for non-vlan interfaces
+  * @keyidx: the key index (0-3)
+  * @keylen: key material length
+  * @key: key material. For ALG_TKIP the key is encoded as a 256-bit (32 byte)
+@@ -2108,6 +2110,7 @@ struct ieee80211_key_conf {
+ 	u8 hw_key_idx;
+ 	s8 keyidx;
+ 	u16 flags;
++	u16 vlan_id;
+ 	s8 link_id;
+ 	u8 keylen;
+ 	u8 key[];
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -538,6 +538,7 @@ static int ieee80211_add_key(struct wiph
+ 		break;
+ 	case NL80211_IFTYPE_AP:
+ 	case NL80211_IFTYPE_AP_VLAN:
++		key->conf.vlan_id = params->vlan_id;
+ 		/* Keys without a station are used for TX only */
+ 		if (sta && test_sta_flag(sta, WLAN_STA_MFP))
+ 			key->conf.flags |= IEEE80211_KEY_FLAG_RX_MGMT;
+--- a/net/mac80211/driver-ops.c
++++ b/net/mac80211/driver-ops.c
+@@ -116,7 +116,11 @@ int drv_sta_state(struct ieee80211_local
+ 
+ 	might_sleep();
+ 
+-	sdata = get_bss_sdata(sdata);
++	if (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD) ||
++	    !(old_state == IEEE80211_STA_ASSOC &&
++	      new_state == IEEE80211_STA_AUTHORIZED))
++		sdata = get_bss_sdata(sdata);
++
+ 	if (!check_sdata_in_driver(sdata))
+ 		return -EIO;
+ 
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -453,7 +453,9 @@ static inline int drv_sta_add(struct iee
+ 
+ 	might_sleep();
+ 
+-	sdata = get_bss_sdata(sdata);
++	if (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD))
++		sdata = get_bss_sdata(sdata);
++
+ 	if (!check_sdata_in_driver(sdata))
+ 		return -EIO;
+ 
+--- a/net/mac80211/key.c
++++ b/net/mac80211/key.c
+@@ -166,7 +166,8 @@ static int ieee80211_key_enable_hw_accel
+ 	if (sta && !sta->uploaded)
+ 		goto out_unsupported;
+ 
+-	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
++	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
++	    !ieee80211_hw_check(&key->local->hw, SUPPORTS_NSS_OFFLOAD)) {
+ 		/*
+ 		 * The driver doesn't know anything about VLAN interfaces.
+ 		 * Hence, don't send GTKs for VLAN interfaces to the driver.
+@@ -610,6 +611,8 @@ ieee80211_key_alloc(u32 cipher, int idx,
+ 	 */
+ 	key->conf.flags = 0;
+ 	key->flags = 0;
++	/* VLAN ID initialised to zero for non-vlan interfaces */
++	key->conf.vlan_id = 0;
+ 
+ 	key->conf.link_id = -1;
+ 	key->conf.cipher = cipher;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/902-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch b/package/kernel/mac80211/patches/ath11k_nss/902-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch
new file mode 100644
index 00000000000000..12d42ddaa9ba9c
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/902-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch
@@ -0,0 +1,973 @@
+From e6ecf9e1cc115b5821a880c6dccc5d8c9cd76fbd Mon Sep 17 00:00:00 2001
+From: Sathishkumar Muruganandam <murugana@codeaurora.org>
+Date: Tue, 15 Sep 2020 21:12:37 +0530
+Subject: [PATCH] ath11k: add WDS offload support on NSS offload for STA mode
+
+When 4addr is set ON for STA interface along with NSS enabled case, WDS
+offload is enabled for ethernet mode.
+
+STA mode uses MEC (Multicast Echo Check) AST (Address Search Table) entry
+to update the bridge MAC address from NSS to drop the locally generated
+multicast/broadcast frames as multicast echo frames.
+
+AST handling and callbacks to NSS WDS APIs are added.
+
+Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/core.h  |   8 +-
+ drivers/net/wireless/ath/ath11k/dp.h    |   6 +-
+ drivers/net/wireless/ath/ath11k/dp_rx.c |  18 +-
+ drivers/net/wireless/ath/ath11k/dp_tx.c |   2 +-
+ drivers/net/wireless/ath/ath11k/peer.c  | 389 +++++++++++++++++++++++++++++++-
+ drivers/net/wireless/ath/ath11k/peer.h  | 117 ++++++++++
+ drivers/net/wireless/ath/ath11k/wmi.c   |  99 +++++++-
+ drivers/net/wireless/ath/ath11k/wmi.h   |  33 +++
+ 8 files changed, 658 insertions(+), 14 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -655,6 +655,7 @@ struct ath11k {
+ 	struct ath11k_pdev_wmi *wmi;
+ #ifdef CPTCFG_ATH11K_NSS_SUPPORT
+ 	struct ath11k_nss nss;
++	struct ath11k_peer *bss_peer;
+ #endif
+ 	struct ath11k_pdev_dp dp;
+ 	u8 mac_addr[ETH_ALEN];
+@@ -1065,6 +1066,8 @@ struct ath11k_base {
+ 	u32 rx_hash;
+ 	bool stats_disable;
+ 
++	u32 max_ast_index;
++	u32 num_ast_entries;
+ 	/* must be last */
+ 	u8 drv_priv[] __aligned(sizeof(void *));
+ };
+--- a/drivers/net/wireless/ath/ath11k/dp.h
++++ b/drivers/net/wireless/ath/ath11k/dp.h
+@@ -1181,13 +1181,16 @@ struct htt_t2h_peer_map_event {
+ #define HTT_T2H_PEER_UNMAP_INFO_PEER_ID	HTT_T2H_PEER_MAP_INFO_PEER_ID
+ #define HTT_T2H_PEER_UNMAP_INFO1_MAC_ADDR_H16 \
+ 					HTT_T2H_PEER_MAP_INFO1_MAC_ADDR_H16
+-#define HTT_T2H_PEER_MAP_INFO1_NEXT_HOP_M HTT_T2H_PEER_MAP_INFO2_NEXT_HOP_M
+-#define HTT_T2H_PEER_MAP_INFO1_NEXT_HOP_S HTT_T2H_PEER_MAP_INFO2_NEXT_HOP_S
++#define HTT_T2H_PEER_UNMAP_INFO1_NEXT_HOP_M HTT_T2H_PEER_MAP_INFO2_NEXT_HOP_M
++#define HTT_T2H_PEER_UNMAP_INFO1_NEXT_HOP_S HTT_T2H_PEER_MAP_INFO2_NEXT_HOP_S
++#define HTT_T2H_PEER_UNMAP_INFO3_WDS_FREE_COUNT	GENMASK(15, 0)
+ 
+ struct htt_t2h_peer_unmap_event {
+ 	u32 info;
+ 	u32 mac_addr_l32;
+ 	u32 info1;
++	u32 info2;
++	u32 info3;
+ } __packed;
+ 
+ struct htt_resp_msg {
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -1890,6 +1890,8 @@ void ath11k_dp_htt_htc_t2h_msg_handler(s
+ 	u16 peer_mac_h16;
+ 	u16 ast_hash;
+ 	u16 hw_peer_id;
++	u32 free_wds_count;
++	bool is_wds = false;
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_DP_HTT, "dp_htt rx msg type :0x%0x\n", type);
+ 
+@@ -1925,15 +1927,29 @@ void ath11k_dp_htt_htc_t2h_msg_handler(s
+ 				     resp->peer_map_ev.info2);
+ 		hw_peer_id = FIELD_GET(HTT_T2H_PEER_MAP_INFO1_HW_PEER_ID,
+ 				       resp->peer_map_ev.info1);
+-		ath11k_peer_map_event(ab, vdev_id, peer_id, mac_addr, ast_hash,
+-				      hw_peer_id);
++		is_wds = FIELD_GET(HTT_T2H_PEER_MAP_INFO2_NEXT_HOP_M,
++				   resp->peer_map_ev.info2);
++		ath11k_peer_map_v2_event(ab, vdev_id, peer_id, mac_addr, ast_hash,
++				         hw_peer_id, is_wds);
+ 		break;
+ 	case HTT_T2H_MSG_TYPE_PEER_UNMAP:
+-	case HTT_T2H_MSG_TYPE_PEER_UNMAP2:
+ 		peer_id = FIELD_GET(HTT_T2H_PEER_UNMAP_INFO_PEER_ID,
+ 				    resp->peer_unmap_ev.info);
+ 		ath11k_peer_unmap_event(ab, peer_id);
+ 		break;
++	case HTT_T2H_MSG_TYPE_PEER_UNMAP2:
++		peer_id = FIELD_GET(HTT_T2H_PEER_UNMAP_INFO_PEER_ID,
++				    resp->peer_unmap_ev.info);
++		peer_mac_h16 = FIELD_GET(HTT_T2H_PEER_UNMAP_INFO1_MAC_ADDR_H16,
++					 resp->peer_unmap_ev.info1);
++		ath11k_dp_get_mac_addr(resp->peer_map_ev.mac_addr_l32,
++				       peer_mac_h16, mac_addr);
++		is_wds = FIELD_GET(HTT_T2H_PEER_UNMAP_INFO1_NEXT_HOP_M,
++				   resp->peer_unmap_ev.info1);
++		free_wds_count = FIELD_GET(HTT_T2H_PEER_UNMAP_INFO3_WDS_FREE_COUNT,
++					   resp->peer_unmap_ev.info3);
++		ath11k_peer_unmap_v2_event(ab, peer_id, mac_addr, is_wds, free_wds_count);
++		break;
+ 	case HTT_T2H_MSG_TYPE_PPDU_STATS_IND:
+ 		ath11k_htt_pull_ppdu_stats(ab, skb);
+ 		break;
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -431,7 +431,7 @@ ath11k_dp_tx_process_htt_tx_complete(str
+ 		break;
+ 	case HAL_WBM_REL_HTT_TX_COMP_STATUS_MEC_NOTIFY:
+ 		/* This event is to be handled only when the driver decides to
+-		 * use WDS offload functionality.
++		 * use WDS offload functionality on NSS disabled case.
+ 		 */
+ 		break;
+ 	default:
+--- a/drivers/net/wireless/ath/ath11k/peer.c
++++ b/drivers/net/wireless/ath/ath11k/peer.c
+@@ -94,6 +94,287 @@ struct ath11k_peer *ath11k_peer_find_by_
+ 	return NULL;
+ }
+ 
++#ifdef CPTCFG_ATH11K_NSS_SUPPORT
++struct ath11k_ast_entry *ath11k_peer_ast_find_by_peer(struct ath11k_base *ab,
++						      struct ath11k_peer *peer,
++						      u8* addr)
++{
++	struct ath11k_ast_entry *ast_entry;
++
++	lockdep_assert_held(&ab->base_lock);
++
++	list_for_each_entry(ast_entry, &peer->ast_entry_list, ase_list)
++		if (ether_addr_equal(ast_entry->addr, addr))
++			return ast_entry;
++
++	return NULL;
++}
++
++struct ath11k_ast_entry *ath11k_peer_ast_find_by_addr(struct ath11k_base *ab,
++						      u8* addr)
++{
++	struct ath11k_ast_entry *ast_entry;
++	struct ath11k_peer *peer;
++
++	lockdep_assert_held(&ab->base_lock);
++
++	list_for_each_entry(peer, &ab->peers, list)
++		list_for_each_entry(ast_entry, &peer->ast_entry_list, ase_list)
++			if (ether_addr_equal(ast_entry->addr, addr))
++				return ast_entry;
++
++	return NULL;
++}
++
++void ath11k_peer_ast_wds_wmi_wk(struct work_struct *wk)
++{
++	struct ath11k_ast_entry *ast_entry = container_of(wk,
++							  struct ath11k_ast_entry,
++							  wds_wmi_wk);
++	struct ath11k *ar;
++	struct ath11k_peer *peer;
++	int ret;
++
++	if (!ast_entry)
++		return;
++
++	ar = ast_entry->ar;
++	peer = ast_entry->peer;
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "ath11k_peer_ast_wds_wmi_wk action %d ast_entry %pM next_node %pM vdev %d\n",
++		   ast_entry->action, ast_entry->addr, ast_entry->next_node_mac,
++		   ast_entry->vdev_id);
++
++	if (ast_entry->action == ATH11K_WDS_WMI_ADD) {
++		ret = ath11k_wmi_send_add_update_wds_entry_cmd(ar,
++							       ast_entry->next_node_mac,
++							       ast_entry->addr,
++							       ast_entry->vdev_id,
++							       true);
++		if (ret) {
++			ath11k_warn(ar->ab, "add wds_entry_cmd failed %d for %pM next_node %pM\n",
++				    ret, ast_entry->addr,
++				    ast_entry->next_node_mac);
++			if (peer)
++				ath11k_nss_del_wds_peer(ar, peer,
++							ast_entry->addr);
++		}
++	} else if (ast_entry->action == ATH11K_WDS_WMI_UPDATE) {
++		if (!peer)
++			return;
++
++		ret = ath11k_wmi_send_add_update_wds_entry_cmd(ar, peer->addr,
++							       ast_entry->addr,
++							       ast_entry->vdev_id,
++							       false);
++		if (ret)
++			ath11k_warn(ar->ab, "update wds_entry_cmd failed %d for %pM on peer %pM\n",
++				    ret, ast_entry->addr, peer->addr);
++	}
++}
++
++int ath11k_peer_add_ast(struct ath11k *ar, struct ath11k_peer *peer,
++			u8* mac_addr, enum ath11k_ast_entry_type type)
++{
++	struct ath11k_ast_entry *ast_entry = NULL;
++	struct ath11k_base *ab = ar->ab;
++
++	if (ab->num_ast_entries == ab->max_ast_index) {
++		ath11k_warn(ab, "failed to add ast for %pM due to insufficient ast entry resource %d in target\n",
++			    mac_addr, ab->max_ast_index);
++		return -ENOBUFS;
++	}
++
++	if (type != ATH11K_AST_TYPE_STATIC) {
++		ast_entry = ath11k_peer_ast_find_by_addr(ab, mac_addr);
++		if (ast_entry) {
++			ath11k_dbg(ab, ATH11K_DBG_MAC, "ast_entry %pM already present on peer %pM\n",
++				   mac_addr, ast_entry->peer->addr);
++			return 0;
++		}
++	}
++
++	ast_entry = kzalloc(sizeof(*ast_entry), GFP_ATOMIC);
++	if (!ast_entry) {
++		ath11k_warn(ab, "failed to alloc ast_entry for %pM\n",
++			    mac_addr);
++		return -ENOMEM;
++	}
++
++	switch (type) {
++		case ATH11K_AST_TYPE_STATIC:
++			peer->self_ast_entry = ast_entry;
++			ast_entry->type = ATH11K_AST_TYPE_STATIC;
++			break;
++		case ATH11K_AST_TYPE_SELF:
++			peer->self_ast_entry = ast_entry;
++			ast_entry->type = ATH11K_AST_TYPE_SELF;
++			break;
++		case ATH11K_AST_TYPE_WDS:
++			ast_entry->type = ATH11K_AST_TYPE_WDS;
++			ast_entry->next_hop = 1;
++			break;
++		case ATH11K_AST_TYPE_MEC:
++			ast_entry->type = ATH11K_AST_TYPE_MEC;
++			ast_entry->next_hop = 1;
++			break;
++		default:
++			ath11k_warn(ab, "unsupported ast_type %d", type);
++			kfree(ast_entry);
++			return -EINVAL;
++	}
++
++	INIT_LIST_HEAD(&ast_entry->ase_list);
++	INIT_WORK(&ast_entry->wds_wmi_wk, ath11k_peer_ast_wds_wmi_wk);
++	ast_entry->vdev_id = peer->vdev_id;
++	ast_entry->pdev_idx = peer->pdev_idx;
++	ast_entry->is_mapped = false;
++	ast_entry->is_active = true;
++	ast_entry->peer = peer;
++	ast_entry->ar = ar;
++	ether_addr_copy(ast_entry->addr, mac_addr);
++
++	list_add_tail(&ast_entry->ase_list, &peer->ast_entry_list);
++
++	ath11k_dbg(ab, ATH11K_DBG_MAC, "ath11k_peer_add_ast peer %pM ast_entry %pM, ast_type %d\n",
++		   peer->addr, mac_addr, ast_entry->type);
++
++	if (type == ATH11K_AST_TYPE_MEC)
++		ether_addr_copy(ast_entry->next_node_mac, ar->mac_addr);
++	else if (type == ATH11K_AST_TYPE_WDS)
++		ether_addr_copy(ast_entry->next_node_mac, peer->addr);
++
++	if ((ast_entry->type == ATH11K_AST_TYPE_WDS) ||
++	    (ast_entry->type == ATH11K_AST_TYPE_MEC)) {
++		ath11k_nss_add_wds_peer(ar, peer, mac_addr, ast_entry->type);
++		ast_entry->action = ATH11K_WDS_WMI_ADD;
++		ieee80211_queue_work(ar->hw, &ast_entry->wds_wmi_wk);
++	}
++
++	ab->num_ast_entries++;
++	return 0;
++}
++
++int ath11k_peer_update_ast(struct ath11k *ar, struct ath11k_peer *peer,
++			   struct ath11k_ast_entry *ast_entry)
++{
++	struct ath11k_peer *old_peer = ast_entry->peer;
++	struct ath11k_base *ab = ar->ab;
++
++	if (!ast_entry->is_mapped) {
++		ath11k_warn(ab, "ath11k_peer_update_ast: ast_entry %pM not mapped yet\n",
++			    ast_entry->addr);
++		return -EINVAL;
++	}
++
++	if (ether_addr_equal(old_peer->addr, peer->addr) &&
++	    (ast_entry->type == ATH11K_AST_TYPE_WDS) &&
++	    (ast_entry->vdev_id == peer->vdev_id) &&
++	    (ast_entry->is_active))
++		return 0;
++
++	ast_entry->vdev_id = peer->vdev_id;
++	ast_entry->pdev_idx = peer->pdev_idx;
++	ast_entry->type = ATH11K_AST_TYPE_WDS;
++	ast_entry->is_active = true;
++	ast_entry->peer = peer;
++
++	list_move_tail(&ast_entry->ase_list, &peer->ast_entry_list);
++
++	ath11k_dbg(ab, ATH11K_DBG_MAC, "ath11k_peer_update_ast old peer %pM new peer %pM ast_entry %pM\n",
++		   old_peer->addr, peer->addr, ast_entry->addr);
++
++	flush_work(&ast_entry->wds_wmi_wk);
++	ast_entry->action = ATH11K_WDS_WMI_UPDATE;
++	ieee80211_queue_work(ar->hw, &ast_entry->wds_wmi_wk);
++
++	return 0;
++}
++
++void ath11k_peer_map_ast(struct ath11k *ar, struct ath11k_peer *peer,
++			 u8* mac_addr, u16 hw_peer_id, u16 ast_hash)
++{
++	struct ath11k_ast_entry *ast_entry = NULL;
++	struct ath11k_base *ab = ar->ab;
++
++	if (!peer)
++		return;
++
++	ast_entry = ath11k_peer_ast_find_by_peer(ab, peer, mac_addr);
++
++	if (ast_entry) {
++		ast_entry->ast_idx = hw_peer_id;
++		ast_entry->is_active = true;
++		ast_entry->is_mapped = true;
++		ast_entry->ast_hash_value = ast_hash;
++
++		if ((ast_entry->type == ATH11K_AST_TYPE_WDS) ||
++		    (ast_entry->type == ATH11K_AST_TYPE_MEC))
++			ath11k_nss_map_wds_peer(ar, peer, mac_addr,
++						ast_entry->type);
++
++		ath11k_dbg(ab, ATH11K_DBG_MAC, "ath11k_peer_map_ast peer %pM ast_entry %pM\n",
++			   peer->addr, ast_entry->addr);
++	}
++
++}
++
++void ath11k_peer_del_ast(struct ath11k *ar, struct ath11k_ast_entry *ast_entry)
++{
++	struct ath11k_peer *peer;
++	struct ath11k_base *ab = ar->ab;
++
++	if (!ast_entry || !ast_entry->peer)
++		return;
++
++	peer = ast_entry->peer;
++
++	ath11k_dbg(ab, ATH11K_DBG_MAC, "ath11k_peer_del_ast peer %pM ast_entry %pM\n",
++		   peer->addr, ast_entry->addr);
++
++	if (ast_entry->is_mapped)
++		list_del(&ast_entry->ase_list);
++
++	/* WDS, MEC type AST entries need to be deleted on NSS */
++	if (ast_entry->next_hop)
++		ath11k_nss_del_wds_peer(ar, peer, ast_entry->addr);
++
++	cancel_work_sync(&ast_entry->wds_wmi_wk);
++	kfree(ast_entry);
++
++	ab->num_ast_entries--;
++}
++
++void ath11k_peer_ast_cleanup(struct ath11k *ar, struct ath11k_peer *peer,
++                             bool is_wds, u32 free_wds_count)
++{
++	struct ath11k_ast_entry *ast_entry, *tmp;
++	u32 ast_deleted_count = 0;
++
++	if (peer->self_ast_entry) {
++		ath11k_peer_del_ast(ar, peer->self_ast_entry);
++		peer->self_ast_entry = NULL;
++	}
++
++	list_for_each_entry_safe(ast_entry, tmp, &peer->ast_entry_list,
++				 ase_list) {
++		if ((ast_entry->type == ATH11K_AST_TYPE_WDS) ||
++		    (ast_entry->type == ATH11K_AST_TYPE_MEC))
++			ast_deleted_count++;
++		ath11k_peer_del_ast(ar, ast_entry);
++	}
++
++	if (!is_wds) {
++		if (ast_deleted_count != free_wds_count)
++			ath11k_warn(ar->ab, "ast_deleted_count (%d) mismatch on peer %pM free_wds_count (%d)!\n",
++				    ast_deleted_count, peer->addr, free_wds_count);
++		else
++			ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "ast_deleted_count (%d) on peer %pM free_wds_count (%d)\n",
++				   ast_deleted_count, peer->addr, free_wds_count);
++	}
++}
++#endif
++
+ void ath11k_peer_unmap_event(struct ath11k_base *ab, u16 peer_id)
+ {
+ 	struct ath11k_peer *peer;
+@@ -118,11 +399,67 @@ exit:
+ 	spin_unlock_bh(&ab->base_lock);
+ }
+ 
++void ath11k_peer_unmap_v2_event(struct ath11k_base *ab, u16 peer_id, u8 *mac_addr,
++				bool is_wds, u32 free_wds_count)
++{
++	struct ath11k_peer *peer;
++	struct ath11k *ar;
++
++	spin_lock_bh(&ab->base_lock);
++
++	peer = ath11k_peer_find_list_by_id(ab, peer_id);
++	if (!peer) {
++		ath11k_warn(ab, "peer-unmap-event: unknown peer id %d\n",
++			    peer_id);
++		goto exit;
++	}
++
++	rcu_read_lock();
++	ar = ath11k_mac_get_ar_by_vdev_id(ab, peer->vdev_id);
++	if (!ar) {
++		ath11k_warn(ab, "peer-unmap-event: unknown peer vdev id %d\n",
++			    peer->vdev_id);
++		goto free_peer;
++	}
++
++	ath11k_dbg(ab, ATH11K_DBG_DP_HTT, "htt peer unmap vdev %d peer %pM id %d is_wds %d free_wds_count %d\n",
++		   peer->vdev_id, peer->addr, peer_id, is_wds, free_wds_count);
++
++	if (ab->nss.enabled) {
++		if (is_wds) {
++			struct ath11k_ast_entry *ast_entry =
++				ath11k_peer_ast_find_by_peer(ab, peer, mac_addr);
++
++			if (ast_entry)
++				ath11k_peer_del_ast(ar, ast_entry);
++			rcu_read_unlock();
++			goto exit;
++		} else
++			ath11k_peer_ast_cleanup(ar, peer, is_wds, free_wds_count);
++	}
++
++#ifdef CPTCFG_ATH11K_NSS_SUPPORT
++	if (ar->bss_peer && ether_addr_equal(ar->bss_peer->addr, peer->addr))
++		ar->bss_peer = NULL;
++#endif
++free_peer:
++	rcu_read_unlock();
++	list_del(&peer->list);
++	kfree(peer);
++	wake_up(&ab->peer_mapping_wq);
++
++exit:
++	spin_unlock_bh(&ab->base_lock);
++}
++
+ void ath11k_peer_map_event(struct ath11k_base *ab, u8 vdev_id, u16 peer_id,
+ 			   u8 *mac_addr, u16 ast_hash, u16 hw_peer_id)
+ {
+ 	struct ath11k_peer *peer;
++	struct ath11k *ar = NULL;
+ 
++	rcu_read_lock();
++	ar = ath11k_mac_get_ar_by_vdev_id(ab, vdev_id);
+ 	spin_lock_bh(&ab->base_lock);
+ 	peer = ath11k_peer_find(ab, vdev_id, mac_addr);
+ 	if (!peer) {
+@@ -137,8 +474,8 @@ void ath11k_peer_map_event(struct ath11k
+ 		ether_addr_copy(peer->addr, mac_addr);
+ 		list_add(&peer->list, &ab->peers);
+ 		wake_up(&ab->peer_mapping_wq);
+-		if (ab->nss.enabled)
+-			ath11k_nss_peer_create(ab, peer);
++		if (ab->nss.enabled && ar)
++			ath11k_nss_peer_create(ar, peer);
+ 	}
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_DP_HTT, "peer map vdev %d peer %pM id %d\n",
+@@ -146,6 +483,69 @@ void ath11k_peer_map_event(struct ath11k
+ 
+ exit:
+ 	spin_unlock_bh(&ab->base_lock);
++	rcu_read_unlock();
++}
++
++void ath11k_peer_map_v2_event(struct ath11k_base *ab, u8 vdev_id, u16 peer_id,
++			      u8 *mac_addr, u16 ast_hash, u16 hw_peer_id,
++			      bool is_wds)
++{
++	struct ath11k_peer *peer;
++	struct ath11k *ar = NULL;
++	int ret;
++
++	rcu_read_lock();
++	ar = ath11k_mac_get_ar_by_vdev_id(ab, vdev_id);
++	spin_lock_bh(&ab->base_lock);
++	peer = ath11k_peer_find(ab, vdev_id, mac_addr);
++	if (!peer && !is_wds) {
++		peer = kzalloc(sizeof(*peer), GFP_ATOMIC);
++		if (!peer) {
++			ath11k_warn(ab, "failed to allocated peer for %pM vdev_id %d\n",
++				    mac_addr, vdev_id);
++			spin_unlock_bh(&ab->base_lock);
++			goto exit;
++		}
++
++		peer->vdev_id = vdev_id;
++		peer->peer_id = peer_id;
++		peer->ast_hash = ast_hash;
++		peer->hw_peer_id = hw_peer_id;
++		ether_addr_copy(peer->addr, mac_addr);
++		list_add(&peer->list, &ab->peers);
++#ifdef CPTCFG_ATH11K_NSS_SUPPORT
++		INIT_LIST_HEAD(&peer->ast_entry_list);
++#endif
++		if (ab->nss.enabled && ar) {
++			ret = ath11k_nss_peer_create(ar, peer);
++			if (ret) {
++				ath11k_warn(ab, "failed to do nss peer create: %d\n",
++					    ret);
++				goto peer_free;
++			}
++		}
++		wake_up(&ab->peer_mapping_wq);
++	}
++
++	if (is_wds)
++		peer = ath11k_peer_find_by_id(ab, peer_id);
++
++	if (ab->nss.enabled && ar)
++		ath11k_peer_map_ast(ar, peer, mac_addr, hw_peer_id, ast_hash);
++
++	ath11k_dbg(ab, ATH11K_DBG_DP_HTT, "htt peer map vdev %d peer %pM id %d is_wds %d\n",
++		   vdev_id, mac_addr, peer_id, is_wds);
++
++	spin_unlock_bh(&ab->base_lock);
++	goto exit;
++
++peer_free:
++	spin_unlock_bh(&ab->base_lock);
++	mutex_lock(&ar->conf_mutex);
++	ath11k_peer_delete(ar, vdev_id, mac_addr);
++	mutex_unlock(&ar->conf_mutex);
++exit:
++	rcu_read_unlock();
+ }
+ 
+ static int ath11k_wait_for_peer_common(struct ath11k_base *ab, int vdev_id,
+@@ -242,20 +642,34 @@ err_clean:
+ 
+ void ath11k_peer_cleanup(struct ath11k *ar, u32 vdev_id)
+ {
+-	struct ath11k_peer *peer, *tmp;
++	struct ath11k_peer *peer, *tmp_peer;
+ 	struct ath11k_base *ab = ar->ab;
++#ifdef CPTCFG_ATH11K_NSS_SUPPORT
++	struct ath11k_ast_entry *ast_entry, *tmp_ast;
++#endif
+ 
+ 	lockdep_assert_held(&ar->conf_mutex);
+ 
+ 	mutex_lock(&ab->tbl_mtx_lock);
+ 	spin_lock_bh(&ab->base_lock);
+-	list_for_each_entry_safe(peer, tmp, &ab->peers, list) {
++	list_for_each_entry_safe(peer, tmp_peer, &ab->peers, list) {
+ 		if (peer->vdev_id != vdev_id)
+ 			continue;
+ 
+ 		ath11k_warn(ab, "removing stale peer %pM from vdev_id %d\n",
+ 			    peer->addr, vdev_id);
+ 
++#ifdef CPTCFG_ATH11K_NSS_SUPPORT
++		if (peer->self_ast_entry) {
++			ath11k_peer_del_ast(ar, peer->self_ast_entry);
++			peer->self_ast_entry = NULL;
++		}
++
++		list_for_each_entry_safe(ast_entry, tmp_ast,
++					 &peer->ast_entry_list, ase_list)
++			ath11k_peer_del_ast(ar, ast_entry);
++#endif
++
+ 		ath11k_peer_rhash_delete(ab, peer);
+ 		list_del(&peer->list);
+ 		kfree(peer);
+@@ -302,7 +716,7 @@ static int __ath11k_peer_delete(struct a
+ 	lockdep_assert_held(&ar->conf_mutex);
+ 
+ 	reinit_completion(&ar->peer_delete_done);
+-	ath11k_nss_peer_delete(ar->ab, addr);
++	ath11k_nss_peer_delete(ar->ab, vdev_id, addr);
+ 
+ 	mutex_lock(&ab->tbl_mtx_lock);
+ 	spin_lock_bh(&ab->base_lock);
+@@ -377,6 +791,7 @@ int ath11k_peer_create(struct ath11k *ar
+ 		       struct ieee80211_sta *sta, struct peer_create_params *param)
+ {
+ 	struct ath11k_peer *peer;
++	struct ieee80211_vif *vif = arvif->vif;
+ 	struct ath11k_sta *arsta;
+ 	int ret, fbret;
+ 
+@@ -450,7 +865,14 @@ int ath11k_peer_create(struct ath11k *ar
+ 
+ 	peer->sec_type = HAL_ENCRYPT_TYPE_OPEN;
+ 	peer->sec_type_grp = HAL_ENCRYPT_TYPE_OPEN;
+-	peer->vif = arvif->vif;
++	peer->vif = vif;
++
++#ifdef CPTCFG_ATH11K_NSS_SUPPORT
++	if (vif->type == NL80211_IFTYPE_STATION && ar->ab->nss.enabled)
++		ar->bss_peer = peer;
++	else
++		ar->bss_peer = NULL;
++#endif
+ 
+ 
+ 	if (sta) {
+--- a/drivers/net/wireless/ath/ath11k/peer.h
++++ b/drivers/net/wireless/ath/ath11k/peer.h
+@@ -18,6 +18,47 @@ struct ppdu_user_delayba {
+ 	u32 resp_rate_flags;
+ };
+ 
++enum ath11k_ast_entry_type {
++	ATH11K_AST_TYPE_NONE, /* static ast entry for connected peer */
++	ATH11K_AST_TYPE_STATIC, /* static ast entry for connected peer */
++	ATH11K_AST_TYPE_SELF, /* static ast entry for self peer (STA mode) */
++	ATH11K_AST_TYPE_WDS,  /* WDS peer ast entry type*/
++	ATH11K_AST_TYPE_MEC,  /* Multicast echo ast entry type */
++	ATH11K_AST_TYPE_WDS_HM, /* HM WDS entry */
++	ATH11K_AST_TYPE_STA_BSS,       /* BSS entry(STA mode) */
++	ATH11K_AST_TYPE_DA,   /* AST entry based on Destination address */
++	ATH11K_AST_TYPE_WDS_HM_SEC, /* HM WDS entry for secondary radio */
++	ATH11K_AST_TYPE_MAX
++};
++
++enum ath11k_wds_wmi_action {
++	ATH11K_WDS_WMI_ADD = 1,
++	ATH11K_WDS_WMI_UPDATE,
++
++	ATH11K_WDS_WMI_MAX
++};
++
++struct ath11k_ast_entry {
++	u16 ast_idx;
++	u8 addr[ETH_ALEN];
++	u8 next_node_mac[ETH_ALEN];
++	enum ath11k_wds_wmi_action action;
++	struct work_struct wds_wmi_wk;
++	struct ath11k_peer *peer;
++	struct ath11k *ar;
++	bool next_hop;
++	bool is_active;
++	bool is_mapped;
++	u8 pdev_idx;
++	u8 vdev_id;
++	u16 ast_hash_value;
++	int ref_cnt;
++	enum ath11k_ast_entry_type type;
++	bool delete_in_progress;
++	void *cookie;
++	struct list_head ase_list;
++};
++
+ struct ath11k_peer {
+ 	struct list_head list;
+ 	struct ieee80211_sta *sta;
+@@ -29,6 +70,10 @@ struct ath11k_peer {
+ 	u8 pdev_idx;
+ 	u16 hw_peer_id;
+ 	struct ath11k_nss_peer nss;
++#ifdef CPTCFG_ATH11K_NSS_SUPPORT
++	struct ath11k_ast_entry *self_ast_entry;
++	struct list_head ast_entry_list;
++#endif
+ 
+ 	/* protected by ab->data_lock */
+ 	struct ieee80211_key_conf *keys[WMI_MAX_KEY_INDEX + 1];
+@@ -54,8 +99,13 @@ struct ath11k_peer {
+ };
+ 
+ void ath11k_peer_unmap_event(struct ath11k_base *ab, u16 peer_id);
++void ath11k_peer_unmap_v2_event(struct ath11k_base *ab, u16 peer_id, u8 *mac_addr,
++			        bool is_wds, u32 free_wds_count);
+ void ath11k_peer_map_event(struct ath11k_base *ab, u8 vdev_id, u16 peer_id,
+ 			   u8 *mac_addr, u16 ast_hash, u16 hw_peer_id);
++void ath11k_peer_map_v2_event(struct ath11k_base *ab, u8 vdev_id, u16 peer_id,
++			      u8 *mac_addr, u16 ast_hash, u16 hw_peer_id,
++			      bool is_wds);
+ struct ath11k_peer *ath11k_peer_find(struct ath11k_base *ab, int vdev_id,
+ 				     const u8 *addr);
+ struct ath11k_peer *ath11k_peer_find_by_addr(struct ath11k_base *ab,
+@@ -72,4 +122,71 @@ struct ath11k_peer *ath11k_peer_find_by_
+ int ath11k_peer_rhash_tbl_init(struct ath11k_base *ab);
+ void ath11k_peer_rhash_tbl_destroy(struct ath11k_base *ab);
+ int ath11k_peer_rhash_delete(struct ath11k_base *ab, struct ath11k_peer *peer);
++
++#ifdef CPTCFG_ATH11K_NSS_SUPPORT
++struct ath11k_ast_entry *ath11k_peer_ast_find_by_addr(struct ath11k_base *ab,
++						      u8* addr);
++int ath11k_peer_add_ast(struct ath11k *ar, struct ath11k_peer *peer,
++			u8* mac_addr, enum ath11k_ast_entry_type type);
++int ath11k_peer_update_ast(struct ath11k *ar, struct ath11k_peer *peer,
++			   struct ath11k_ast_entry *ast_entry);
++void ath11k_peer_map_ast(struct ath11k *ar, struct ath11k_peer *peer,
++			 u8* mac_addr, u16 hw_peer_id, u16 ast_hash);
++void ath11k_peer_del_ast(struct ath11k *ar, struct ath11k_ast_entry *ast_entry);
++void ath11k_peer_ast_cleanup(struct ath11k *ar, struct ath11k_peer *peer,
++			     bool is_wds, u32 free_wds_count);
++void ath11k_peer_ast_wds_wmi_wk(struct work_struct *wk);
++struct ath11k_ast_entry *ath11k_peer_ast_find_by_peer(struct ath11k_base *ab,
++						      struct ath11k_peer *peer,
++						      u8* addr);
++#else
++static inline struct ath11k_ast_entry *ath11k_peer_ast_find_by_addr(struct ath11k_base *ab,
++								    u8* addr)
++{
++	return NULL;
++}
++
++static inline int ath11k_peer_add_ast(struct ath11k *ar, struct ath11k_peer *peer,
++				      u8* mac_addr, enum ath11k_ast_entry_type type)
++{
++	return 0;
++}
++
++static inline int ath11k_peer_update_ast(struct ath11k *ar, struct ath11k_peer *peer,
++					 struct ath11k_ast_entry *ast_entry)
++{
++	return 0;
++}
++
++static inline void ath11k_peer_map_ast(struct ath11k *ar, struct ath11k_peer *peer,
++				       u8* mac_addr, u16 hw_peer_id, u16 ast_hash)
++{
++	return;
++}
++
++static inline void ath11k_peer_del_ast(struct ath11k *ar,
++				       struct ath11k_ast_entry *ast_entry)
++{
++	return;
++}
++
++static inline void ath11k_peer_ast_cleanup(struct ath11k *ar,
++					   struct ath11k_peer *peer,
++					   bool is_wds, u32 free_wds_count)
++{
++	return;
++}
++
++static inline void ath11k_peer_ast_wds_wmi_wk(struct work_struct *wk)
++{
++	return;
++}
++
++static inline struct ath11k_ast_entry *ath11k_peer_ast_find_by_peer(struct ath11k_base *ab,
++								    struct ath11k_peer *peer,
++								    u8* addr)
++{
++	return NULL;
++}
++#endif /* CPTCFG_ATH11K_NSS_SUPPORT */
+ #endif /* _PEER_H_ */
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -155,6 +155,7 @@ static const struct wmi_tlv_policy wmi_t
+ 		.min_len = sizeof(struct wmi_per_chain_rssi_stats), .policy = "wmi_per_chain_rssi_stats" },
+ 	[WMI_TAG_TWT_ADD_DIALOG_COMPLETE_EVENT] = {
+ 		.min_len = sizeof(struct wmi_twt_add_dialog_event), .policy = "wmi_twt_add_dialog_event" },
++	[WMI_TAG_WDS_ADDR_EVENT] = { .min_len = sizeof(struct wmi_wds_addr_event), .policy = "wmi_wds_addr_event" },
+ };
+ 
+ #define PRIMAP(_hw_mode_) \
+@@ -1174,6 +1175,51 @@ int ath11k_wmi_send_peer_delete_cmd(stru
+ 	return ret;
+ }
+ 
++int ath11k_wmi_send_add_update_wds_entry_cmd(struct ath11k *ar,
++					     const u8 *peer_addr,
++					     const u8 *wds_addr, u8 vdev_id,
++					     bool add_wds)
++{
++	struct ath11k_pdev_wmi *wmi = ar->wmi;
++	struct wmi_add_wds_entry_cmd *cmd;
++	struct sk_buff *skb;
++	int ret;
++
++	skb = ath11k_wmi_alloc_skb(wmi->wmi_ab, sizeof(*cmd));
++	if (!skb)
++		return -ENOMEM;
++
++	cmd = (struct wmi_add_wds_entry_cmd *)skb->data;
++	if (add_wds)
++		cmd->tlv_header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_PEER_ADD_WDS_ENTRY_CMD) |
++				  FIELD_PREP(WMI_TLV_LEN, sizeof(*cmd) - TLV_HDR_SIZE);
++	else
++		cmd->tlv_header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_PEER_UPDATE_WDS_ENTRY_CMD) |
++				  FIELD_PREP(WMI_TLV_LEN, sizeof(*cmd) - TLV_HDR_SIZE);
++
++	ether_addr_copy(cmd->peer_macaddr.addr, peer_addr);
++	ether_addr_copy(cmd->wds_macaddr.addr, wds_addr);
++	cmd->vdev_id = vdev_id;
++	cmd->flags = WMI_WDS_FLAG_STATIC;
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_WMI,
++		   "WMI add WDS entry vdev_id %d peer_addr %pM, wds_addr %pM flags %x\n",
++		   vdev_id, peer_addr, wds_addr, cmd->flags);
++
++	if (add_wds)
++		ret = ath11k_wmi_cmd_send(wmi, skb, WMI_PEER_ADD_WDS_ENTRY_CMDID);
++	else
++		ret = ath11k_wmi_cmd_send(wmi, skb, WMI_PEER_UPDATE_WDS_ENTRY_CMDID);
++
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to send WMI_PEER_%s_WDS_ENTRY cmd\n",
++			    add_wds ? "ADD" : "UPDATE");
++		dev_kfree_skb(skb);
++	}
++
++	return ret;
++}
++
+ int ath11k_wmi_send_pdev_set_regdomain(struct ath11k *ar,
+ 				       struct pdev_set_regdomain_params *param)
+ {
+@@ -6484,6 +6530,36 @@ static int ath11k_pull_peer_assoc_conf_e
+ 	return 0;
+ }
+ 
++static int ath11k_pull_wds_addr_ev(struct ath11k_base *ab, struct sk_buff *skb,
++				   struct wmi_wds_addr_arg *wds_addr_arg)
++{
++	const void **tb;
++	const struct wmi_wds_addr_event *ev;
++	int ret;
++
++	tb = ath11k_wmi_tlv_parse_alloc(ab, skb->data, skb->len, GFP_ATOMIC);
++	if (IS_ERR(tb)) {
++		ret = PTR_ERR(tb);
++		ath11k_warn(ab, "failed to parse tlv: %d\n", ret);
++		return ret;
++	}
++
++	ev = tb[WMI_TAG_WDS_ADDR_EVENT];
++	if (!ev) {
++		ath11k_warn(ab, "failed to fetch wds peer ev");
++		kfree(tb);
++		return -EPROTO;
++	}
++
++	memcpy(wds_addr_arg->event_type, ev->event_type, WMI_NUM_WDS_EVENTS);
++	wds_addr_arg->vdev_id = ev->vdev_id;
++	wds_addr_arg->peer_macaddr = ev->peer_macaddr.addr;
++	wds_addr_arg->dst_macaddr = ev->dst_macaddr.addr;
++
++	kfree(tb);
++	return 0;
++}
++
+ static void ath11k_wmi_pull_pdev_stats_base(const struct wmi_pdev_stats_base *src,
+ 					    struct ath11k_fw_stats_pdev *dst)
+ {
+@@ -7399,6 +7475,7 @@ static int ath11k_wmi_tlv_rdy_parse(stru
+ 
+ 		ether_addr_copy(ab->mac_addr,
+ 				fixed_param.ready_event_min.mac_addr.addr);
++		ab->max_ast_index = fixed_param.max_ast_index + 1;
+ 		ab->pktlog_defs_checksum = fixed_param.pktlog_defs_checksum;
+ 		break;
+ 	case WMI_TAG_ARRAY_FIXED_STRUCT:
+@@ -8870,6 +8947,22 @@ static void ath11k_wmi_gtk_offload_statu
+ 	kfree(tb);
+ }
+ 
++static void ath11k_wmi_wds_peer_event(struct ath11k_base *ab,
++				      struct sk_buff *skb)
++{
++	struct wmi_wds_addr_arg wds_addr_arg = {0};
++
++	if (ath11k_pull_wds_addr_ev(ab, skb, &wds_addr_arg) != 0) {
++		ath11k_warn(ab, "failed to extract wds addr event");
++		return;
++	}
++
++	ath11k_dbg(ab, ATH11K_DBG_WMI,
++		   "wds addr event vdev id %d peer macaddr %pM dst macaddr %pM\n",
++		   wds_addr_arg.vdev_id, wds_addr_arg.peer_macaddr,
++		   wds_addr_arg.dst_macaddr);
++}
++
+ static void ath11k_wmi_tlv_op_rx(struct ath11k_base *ab, struct sk_buff *skb)
+ {
+ 	struct wmi_cmd_hdr *cmd_hdr;
+@@ -9000,6 +9093,9 @@ static void ath11k_wmi_tlv_op_rx(struct
+ 	case WMI_QOS_NULL_FRAME_TX_COMPLETION_EVENTID:
+ 		ath11k_qos_null_compl_event(ab, skb);
+ 		break;
++	case WMI_WDS_PEER_EVENTID:
++		ath11k_wmi_wds_peer_event(ab, skb);
++		break;
+ 	default:
+ 		ath11k_dbg(ab, ATH11K_DBG_WMI, "unsupported event id 0x%x\n", id);
+ 		break;
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -3025,6 +3025,21 @@ struct wmi_peer_delete_cmd {
+ 	struct wmi_mac_addr peer_macaddr;
+ } __packed;
+ 
++#define WMI_WDS_FLAG_STATIC    0x1    /* Disable aging & learning */
++struct wmi_add_wds_entry_cmd {
++	u32 tlv_header;
++	struct wmi_mac_addr peer_macaddr;
++	struct wmi_mac_addr wds_macaddr;
++	u32 flags;
++	u32 vdev_id;
++} __packed;
++
++struct wmi_remove_wds_entry_cmd {
++	u32 tlv_header;
++	struct wmi_mac_addr wds_macaddr;
++	u32 vdev_id;
++} __packed;
++
+ struct wmi_peer_reorder_queue_setup_cmd {
+ 	u32 tlv_header;
+ 	u32 vdev_id;
+@@ -4629,6 +4644,21 @@ struct wmi_probe_resp_tx_status_event {
+ 	u32 tx_status;
+ } __packed;
+ 
++#define WMI_NUM_WDS_EVENTS 4
++struct wmi_wds_addr_arg {
++	u32 event_type[WMI_NUM_WDS_EVENTS];
++	const u8 *peer_macaddr;
++	const u8 *dst_macaddr;
++	u32 vdev_id;
++};
++
++struct wmi_wds_addr_event {
++	u32 event_type[WMI_NUM_WDS_EVENTS];
++	struct wmi_mac_addr peer_macaddr;
++	struct wmi_mac_addr dst_macaddr;
++	u32 vdev_id;
++} __packed;
++
+ /*
+  * PDEV statistics
+  */
+@@ -6503,6 +6533,9 @@ int ath11k_wmi_set_sta_ps_param(struct a
+ int ath11k_wmi_force_fw_hang_cmd(struct ath11k *ar, u32 type, u32 delay_time_ms);
+ int ath11k_wmi_send_peer_delete_cmd(struct ath11k *ar,
+ 				    const u8 *peer_addr, u8 vdev_id);
++int ath11k_wmi_send_add_update_wds_entry_cmd(struct ath11k *ar,
++				      const u8 *peer_addr, const u8 *wds_addr,
++				      u8 vdev_id, bool add_wds);
+ int ath11k_wmi_vdev_delete(struct ath11k *ar, u8 vdev_id);
+ void ath11k_wmi_start_scan_init(struct ath11k *ar, struct scan_req_params *arg);
+ int ath11k_wmi_send_scan_start_cmd(struct ath11k *ar,
diff --git a/package/kernel/mac80211/patches/ath11k_nss/902-ath11k-add-HE-stats-in-peer-stats.patch b/package/kernel/mac80211/patches/ath11k_nss/902-ath11k-add-HE-stats-in-peer-stats.patch
new file mode 100644
index 00000000000000..edb60ac18bef10
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/902-ath11k-add-HE-stats-in-peer-stats.patch
@@ -0,0 +1,777 @@
+From e4f16128c53b48f166301085cecc23f77bf3ff8e Mon Sep 17 00:00:00 2001
+From: Miles Hu <milehu@codeaurora.org>
+Date: Fri, 11 Oct 2019 19:24:06 -0700
+Subject: [PATCH] ath11k: add HE stats in peer stats packet counters for MIMO
+ and OFDMA
+
+Signed-off-by: Miles Hu <milehu@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/core.h        |  23 ++++-
+ drivers/net/wireless/ath/ath11k/debugfs_sta.c | 127 +++++++++++++++++++++++++-
+ drivers/net/wireless/ath/ath11k/dp.h          |  21 ++++-
+ drivers/net/wireless/ath/ath11k/dp_rx.c       |  17 +++-
+ drivers/net/wireless/ath/ath11k/rx_desc.h     |   5 +
+ 5 files changed, 185 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -29,6 +29,7 @@
+ #include "dbring.h"
+ #include "spectral.h"
+ #include "wow.h"
++#include "rx_desc.h"
+ #include "nss.h"
+ 
+ #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
+@@ -476,6 +477,8 @@ struct ath11k_htt_data_stats {
+ 	u64 bw[ATH11K_COUNTER_TYPE_MAX][ATH11K_BW_NUM];
+ 	u64 nss[ATH11K_COUNTER_TYPE_MAX][ATH11K_NSS_NUM];
+ 	u64 gi[ATH11K_COUNTER_TYPE_MAX][ATH11K_GI_NUM];
++	u64 transmit_type[ATH11K_COUNTER_TYPE_MAX][HAL_RX_RECEPTION_TYPE_MAX];
++	u64 ru_loc[ATH11K_COUNTER_TYPE_MAX][HAL_RX_RU_ALLOC_TYPE_MAX];
+ };
+ 
+ struct ath11k_htt_tx_stats {
+@@ -483,6 +486,9 @@ struct ath11k_htt_tx_stats {
+ 	u64 tx_duration;
+ 	u64 ba_fails;
+ 	u64 ack_fails;
++	u16 ru_start;
++	u16 ru_tones;
++	u32 mu_group[MAX_MU_GROUP_ID];
+ };
+ 
+ struct ath11k_per_ppdu_tx_stats {
+@@ -615,11 +621,16 @@ struct ath11k_per_peer_tx_stats {
+ 	u32 succ_bytes;
+ 	u32 retry_bytes;
+ 	u32 failed_bytes;
++	u32 duration;
+ 	u16 succ_pkts;
+ 	u16 retry_pkts;
+ 	u16 failed_pkts;
+-	u32 duration;
++	u16 ru_start;
++	u16 ru_tones;
+ 	u8 ba_fails;
++	u8 ppdu_type;
++	u32 mu_grpid;
++	u32 mu_pos;
+ 	bool is_ampdu;
+ };
+ 
+--- a/drivers/net/wireless/ath/ath11k/debugfs_sta.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs_sta.c
+@@ -12,13 +12,39 @@
+ #include "dp_tx.h"
+ #include "debugfs_htt_stats.h"
+ 
++static inline u32 ath11k_he_tones_in_ru_to_nl80211_he_ru_alloc(u16 ru_tones)
++{
++	u32 ret = 0;
++	switch (ru_tones) {
++	case 26:
++		ret = NL80211_RATE_INFO_HE_RU_ALLOC_26;
++		break;
++	case 52:
++		ret = NL80211_RATE_INFO_HE_RU_ALLOC_52;
++		break;
++	case 106:
++		ret = NL80211_RATE_INFO_HE_RU_ALLOC_106;
++		break;
++	case 242:
++		ret = NL80211_RATE_INFO_HE_RU_ALLOC_242;
++		break;
++	case 484:
++		ret = NL80211_RATE_INFO_HE_RU_ALLOC_484;
++		break;
++	case 996:
++		ret = NL80211_RATE_INFO_HE_RU_ALLOC_996;
++		break;
++	}
++	return ret;
++}
++
+ void ath11k_debugfs_sta_add_tx_stats(struct ath11k_sta *arsta,
+ 				     struct ath11k_per_peer_tx_stats *peer_stats,
+ 				     u8 legacy_rate_idx)
+ {
+ 	struct rate_info *txrate = &arsta->txrate;
+ 	struct ath11k_htt_tx_stats *tx_stats;
+-	int gi, mcs, bw, nss;
++	int gi, mcs, bw, nss, ru_type, ppdu_type;
+ 
+ 	if (!arsta->tx_stats)
+ 		return;
+@@ -63,6 +89,43 @@ void ath11k_debugfs_sta_add_tx_stats(str
+ 		STATS_OP_FMT(RETRY).legacy[1][mcs] += peer_stats->retry_pkts;
+ 	}
+ 
++	ppdu_type = peer_stats->ppdu_type;
++	if ((ppdu_type == HTT_PPDU_STATS_PPDU_TYPE_MU_OFDMA ||
++	    ppdu_type == HTT_PPDU_STATS_PPDU_TYPE_MU_MIMO_OFDMA) &&
++	    (txrate->flags & RATE_INFO_FLAGS_HE_MCS)){
++		ru_type = peer_stats->ru_tones;
++
++		if (ru_type <= NL80211_RATE_INFO_HE_RU_ALLOC_996) {
++			STATS_OP_FMT(SUCC).ru_loc[0][ru_type] += peer_stats->succ_bytes;
++			STATS_OP_FMT(SUCC).ru_loc[1][ru_type] += peer_stats->succ_pkts;
++			STATS_OP_FMT(FAIL).ru_loc[0][ru_type] += peer_stats->failed_bytes;
++			STATS_OP_FMT(FAIL).ru_loc[1][ru_type] += peer_stats->failed_pkts;
++			STATS_OP_FMT(RETRY).ru_loc[0][ru_type] += peer_stats->retry_bytes;
++			STATS_OP_FMT(RETRY).ru_loc[1][ru_type] += peer_stats->retry_pkts;
++			if (peer_stats->is_ampdu) {
++				STATS_OP_FMT(AMPDU).ru_loc[0][ru_type] +=
++					peer_stats->succ_bytes + peer_stats->retry_bytes;
++				STATS_OP_FMT(AMPDU).ru_loc[1][ru_type] +=
++					peer_stats->succ_pkts + peer_stats->retry_pkts;
++			}
++		}
++	}
++
++	if (ppdu_type < HTT_PPDU_STATS_PPDU_TYPE_MAX) {
++		STATS_OP_FMT(SUCC).transmit_type[0][ppdu_type] += peer_stats->succ_bytes;
++		STATS_OP_FMT(SUCC).transmit_type[1][ppdu_type] += peer_stats->succ_pkts;
++		STATS_OP_FMT(FAIL).transmit_type[0][ppdu_type] += peer_stats->failed_bytes;
++		STATS_OP_FMT(FAIL).transmit_type[1][ppdu_type] += peer_stats->failed_pkts;
++		STATS_OP_FMT(RETRY).transmit_type[0][ppdu_type] += peer_stats->retry_bytes;
++		STATS_OP_FMT(RETRY).transmit_type[1][ppdu_type] += peer_stats->retry_pkts;
++		if (peer_stats->is_ampdu) {
++			STATS_OP_FMT(AMPDU).transmit_type[0][ppdu_type] +=
++				peer_stats->succ_bytes + peer_stats->retry_bytes;
++			STATS_OP_FMT(AMPDU).transmit_type[1][ppdu_type] +=
++				peer_stats->succ_pkts + peer_stats->retry_pkts;
++		}
++	}
++
+ 	if (peer_stats->is_ampdu) {
+ 		tx_stats->ba_fails += peer_stats->ba_fails;
+ 
+@@ -123,6 +186,17 @@ void ath11k_debugfs_sta_add_tx_stats(str
+ 	STATS_OP_FMT(RETRY).gi[1][gi] += peer_stats->retry_pkts;
+ 
+ 	tx_stats->tx_duration += peer_stats->duration;
++
++	tx_stats->ru_start = peer_stats->ru_start;
++	tx_stats->ru_tones = peer_stats->ru_tones;
++
++	if (peer_stats->mu_grpid <= MAX_MU_GROUP_ID &&
++	    peer_stats->ppdu_type != HTT_PPDU_STATS_PPDU_TYPE_SU) {
++		if (peer_stats->mu_grpid & (MAX_MU_GROUP_ID - 1))
++			tx_stats->mu_group[peer_stats->mu_grpid] =
++						(peer_stats->mu_pos + 1);
++	}
++
+ }
+ 
+ void ath11k_debugfs_sta_update_txcompl(struct ath11k *ar,
+@@ -139,12 +213,13 @@ static ssize_t ath11k_dbg_sta_dump_tx_st
+ 	struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);
+ 	struct ath11k *ar = arsta->arvif->ar;
+ 	struct ath11k_htt_data_stats *stats;
+-	static const char *str_name[ATH11K_STATS_TYPE_MAX] = {"succ", "fail",
++	static const char *str_name[ATH11K_STATS_TYPE_MAX] = {"success", "fail",
+ 							      "retry", "ampdu"};
+ 	static const char *str[ATH11K_COUNTER_TYPE_MAX] = {"bytes", "packets"};
+ 	int len = 0, i, j, k, retval = 0;
+ 	const int size = 2 * 4096;
+-	char *buf;
++	char *buf, mu_group_id[MAX_MU_GROUP_LENGTH] = {0};
++	u32 index;
+ 
+ 	buf = kzalloc(size, GFP_KERNEL);
+ 	if (!buf)
+@@ -165,45 +240,46 @@ static ssize_t ath11k_dbg_sta_dump_tx_st
+ 			len += scnprintf(buf + len, size - len, "%s_%s\n",
+ 					 str_name[k],
+ 					 str[j]);
++			len += scnprintf(buf + len, size - len, "==========\n");
+ 			len += scnprintf(buf + len, size - len,
+-					 " HE MCS %s\n",
++					 " HE MCS %s\n\t",
+ 					 str[j]);
+ 			for (i = 0; i < ATH11K_HE_MCS_NUM; i++)
+ 				len += scnprintf(buf + len, size - len,
+-						 "  %llu ",
++						 "%llu ",
+ 						 stats->he[j][i]);
+ 			len += scnprintf(buf + len, size - len, "\n");
+ 			len += scnprintf(buf + len, size - len,
+-					 " VHT MCS %s\n",
++					 " VHT MCS %s\n\t",
+ 					 str[j]);
+ 			for (i = 0; i < ATH11K_VHT_MCS_NUM; i++)
+ 				len += scnprintf(buf + len, size - len,
+-						 "  %llu ",
++						 "%llu ",
+ 						 stats->vht[j][i]);
+ 			len += scnprintf(buf + len, size - len, "\n");
+-			len += scnprintf(buf + len, size - len, " HT MCS %s\n",
++			len += scnprintf(buf + len, size - len, " HT MCS %s\n\t",
+ 					 str[j]);
+ 			for (i = 0; i < ATH11K_HT_MCS_NUM; i++)
+ 				len += scnprintf(buf + len, size - len,
+-						 "  %llu ", stats->ht[j][i]);
++						 "%llu ", stats->ht[j][i]);
+ 			len += scnprintf(buf + len, size - len, "\n");
+ 			len += scnprintf(buf + len, size - len,
+ 					" BW %s (20,40,80,160 MHz)\n", str[j]);
+ 			len += scnprintf(buf + len, size - len,
+-					 "  %llu %llu %llu %llu\n",
++					 "\t%llu %llu %llu %llu\n",
+ 					 stats->bw[j][0], stats->bw[j][1],
+ 					 stats->bw[j][2], stats->bw[j][3]);
+ 			len += scnprintf(buf + len, size - len,
+ 					 " NSS %s (1x1,2x2,3x3,4x4)\n", str[j]);
+ 			len += scnprintf(buf + len, size - len,
+-					 "  %llu %llu %llu %llu\n",
++					 "\t%llu %llu %llu %llu\n",
+ 					 stats->nss[j][0], stats->nss[j][1],
+ 					 stats->nss[j][2], stats->nss[j][3]);
+ 			len += scnprintf(buf + len, size - len,
+ 					 " GI %s (0.4us,0.8us,1.6us,3.2us)\n",
+ 					 str[j]);
+ 			len += scnprintf(buf + len, size - len,
+-					 "  %llu %llu %llu %llu\n",
++					 "\t%llu %llu %llu %llu\n",
+ 					 stats->gi[j][0], stats->gi[j][1],
+ 					 stats->gi[j][2], stats->gi[j][3]);
+ 			len += scnprintf(buf + len, size - len,
+@@ -212,10 +288,68 @@ static ssize_t ath11k_dbg_sta_dump_tx_st
+ 			for (i = 0; i < ATH11K_LEGACY_NUM; i++)
+ 				len += scnprintf(buf + len, size - len, "%llu ",
+ 						 stats->legacy[j][i]);
+-			len += scnprintf(buf + len, size - len, "\n");
++
++			len += scnprintf(buf + len, size - len, "\n ru %s: \n", str[j]);
++			len += scnprintf(buf + len, size - len,
++					 "\tru 26: %llu\n", stats->ru_loc[j][0]);
++			len += scnprintf(buf + len, size - len,
++					 "\tru 52: %llu \n", stats->ru_loc[j][1]);
++			len += scnprintf(buf + len, size - len,
++					 "\tru 106: %llu \n", stats->ru_loc[j][2]);
++			len += scnprintf(buf + len, size - len,
++					 "\tru 242: %llu \n", stats->ru_loc[j][3]);
++			len += scnprintf(buf + len, size - len,
++					 "\tru 484: %llu \n", stats->ru_loc[j][4]);
++			len += scnprintf(buf + len, size - len,
++					 "\tru 996: %llu \n", stats->ru_loc[j][5]);
++
++			len += scnprintf(buf + len, size - len,
++					 " ppdu type %s: \n", str[j]);
++			if (k == ATH11K_STATS_TYPE_FAIL ||
++			    k == ATH11K_STATS_TYPE_RETRY) {
++				len += scnprintf(buf + len, size - len,
++						 "\tSU/MIMO: %llu\n",
++						 stats->transmit_type[j][0]);
++				len += scnprintf(buf + len, size - len,
++						 "\tOFDMA/OFDMA_MIMO: %llu\n",
++				 		 stats->transmit_type[j][2]);
++			} else {
++				len += scnprintf(buf + len, size - len,
++						 "\tSU: %llu\n",
++						 stats->transmit_type[j][0]);
++				len += scnprintf(buf + len, size - len,
++						 "\tMIMO: %llu\n",
++						 stats->transmit_type[j][1]);
++				len += scnprintf(buf + len, size - len,
++						 "\tOFDMA: %llu\n",
++				 		 stats->transmit_type[j][2]);
++				len += scnprintf(buf + len, size - len,
++						 "\tOFDMA_MIMO: %llu\n",
++						 stats->transmit_type[j][3]);
++			}
+ 		}
+ 	}
+ 
++	len += scnprintf(buf + len, size - len, "\n");
++
++	for (i = 0; i < MAX_MU_GROUP_ID;) {
++		index = 0;
++		for (j = 0; j < MAX_MU_GROUP_SHOW && i < MAX_MU_GROUP_ID;
++		     j++) {
++			index += snprintf(&mu_group_id[index],
++					     MAX_MU_GROUP_LENGTH - index,
++					     " %d",
++					     arsta->tx_stats->mu_group[i]);
++			i++;
++		}
++		len += scnprintf(buf + len, size - len,
++				  "User position list for GID %02d->%d: [%s]\n",
++				  i - MAX_MU_GROUP_SHOW, i - 1, mu_group_id);
++	}
++	len += scnprintf(buf + len, size - len,
++			  "\nLast Packet RU index [%d], Size [%d]\n",
++			  arsta->tx_stats->ru_start, arsta->tx_stats->ru_tones);
++
+ 	len += scnprintf(buf + len, size - len,
+ 			 "\nTX duration\n %llu usecs\n",
+ 			 arsta->tx_stats->tx_duration);
+@@ -223,6 +357,7 @@ static ssize_t ath11k_dbg_sta_dump_tx_st
+ 			"BA fails\n %llu\n", arsta->tx_stats->ba_fails);
+ 	len += scnprintf(buf + len, size - len,
+ 			"ack fails\n %llu\n", arsta->tx_stats->ack_fails);
++
+ 	spin_unlock_bh(&ar->data_lock);
+ 
+ 	if (len > size)
+--- a/drivers/net/wireless/ath/ath11k/dp.h
++++ b/drivers/net/wireless/ath/ath11k/dp.h
+@@ -598,6 +598,45 @@ enum htt_ppdu_stats_tag_type {
+ 				    BIT(HTT_PPDU_STATS_TAG_TX_MGMTCTRL_PAYLOAD) | \
+ 				    HTT_PPDU_STATS_TAG_DEFAULT)
+ 
++#define HTT_STATS_FRAMECTRL_TYPE_MASK 0x0C
++#define HTT_STATS_GET_FRAME_CTRL_TYPE(_val)	\
++		(((_val) & HTT_STATS_FRAMECTRL_TYPE_MASK) >> 2)
++#define HTT_STATS_FRAME_CTRL_TYPE_MGMT	0x0
++#define HTT_STATS_FRAME_CTRL_TYPE_CTRL	0x1
++#define HTT_STATS_FRAME_CTRL_TYPE_DATA	0x2
++#define HTT_STATS_FRAME_CTRL_TYPE_RESV	0x3
++
++enum htt_stats_frametype {
++	HTT_STATS_FTYPE_SGEN_NDPA = 0,
++	HTT_STATS_FTYPE_SGEN_NDP,
++	HTT_STATS_FTYPE_SGEN_BRP,
++	HTT_STATS_FTYPE_SGEN_BAR,
++	HTT_STATS_FTYPE_SGEN_RTS,
++	HTT_STATS_FTYPE_SGEN_CTS,
++	HTT_STATS_FTYPE_SGEN_CFEND,
++	HTT_STATS_FTYPE_SGEN_AX_NDPA,
++	HTT_STATS_FTYPE_SGEN_AX_NDP,
++	HTT_STATS_FTYPE_SGEN_MU_TRIG,
++	HTT_STATS_FTYPE_SGEN_MU_BAR,
++	HTT_STATS_FTYPE_SGEN_MU_BRP,
++	HTT_STATS_FTYPE_SGEN_MU_RTS,
++	HTT_STATS_FTYPE_SGEN_MU_BSR,
++	HTT_STATS_FTYPE_SGEN_UL_BSR,
++	HTT_STATS_FTYPE_SGEN_UL_BSR_TRIGGER = HTT_STATS_FTYPE_SGEN_UL_BSR,
++	HTT_STATS_FTYPE_TIDQ_DATA_SU,
++	HTT_STATS_FTYPE_TIDQ_DATA_MU,
++	HTT_STATS_FTYPE_SGEN_UL_BSR_RESP,
++	HTT_STATS_FTYPE_SGEN_QOS_NULL,
++	HTT_STATS_FTYPE_MAX,
++};
++
++enum htt_stats_internal_ppdu_frametype {
++	HTT_STATS_PPDU_FTYPE_CTRL,
++	HTT_STATS_PPDU_FTYPE_DATA,
++	HTT_STATS_PPDU_FTYPE_BAR,
++	HTT_STATS_PPDU_FTYPE_MAX
++};
++
+ /* HTT_H2T_MSG_TYPE_RX_RING_SELECTION_CFG Message
+  *
+  * details:
+@@ -1312,6 +1351,19 @@ enum htt_ppdu_stats_gi {
+ #define HTT_PPDU_STATS_USER_RATE_INFO0_USER_POS_M	GENMASK(3, 0)
+ #define HTT_PPDU_STATS_USER_RATE_INFO0_MU_GROUP_ID_M	GENMASK(11, 4)
+ 
++enum HTT_PPDU_STATS_PPDU_TYPE {
++	HTT_PPDU_STATS_PPDU_TYPE_SU,
++	HTT_PPDU_STATS_PPDU_TYPE_MU_MIMO,
++	HTT_PPDU_STATS_PPDU_TYPE_MU_OFDMA,
++	HTT_PPDU_STATS_PPDU_TYPE_MU_MIMO_OFDMA,
++	HTT_PPDU_STATS_PPDU_TYPE_UL_TRIG,
++	HTT_PPDU_STATS_PPDU_TYPE_BURST_BCN,
++	HTT_PPDU_STATS_PPDU_TYPE_UL_BSR_RESP,
++	HTT_PPDU_STATS_PPDU_TYPE_UL_BSR_TRIG,
++	HTT_PPDU_STATS_PPDU_TYPE_UL_RESP,
++	HTT_PPDU_STATS_PPDU_TYPE_MAX
++};
++
+ #define HTT_PPDU_STATS_USER_RATE_INFO1_RESP_TYPE_VALD_M	BIT(0)
+ #define HTT_PPDU_STATS_USER_RATE_INFO1_PPDU_TYPE_M	GENMASK(5, 1)
+ 
+@@ -1339,6 +1391,12 @@ enum htt_ppdu_stats_gi {
+ 		FIELD_GET(HTT_PPDU_STATS_USER_RATE_FLAGS_GI_M, _val)
+ #define HTT_USR_RATE_DCM(_val) \
+ 		FIELD_GET(HTT_PPDU_STATS_USER_RATE_FLAGS_DCM_M, _val)
++#define HTT_USR_RATE_PPDU_TYPE(_val) \
++		FIELD_GET(HTT_PPDU_STATS_USER_RATE_INFO1_PPDU_TYPE_M, _val)
++#define HTT_USR_RATE_MU_GRPID(_val) \
++		FIELD_GET(HTT_PPDU_STATS_USER_RATE_INFO0_MU_GROUP_ID_M, _val)
++#define HTT_USR_RATE_USR_POS(_val) \
++		FIELD_GET(HTT_PPDU_STATS_USER_RATE_INFO0_USER_POS_M, _val)
+ 
+ #define HTT_PPDU_STATS_USER_RATE_RESP_FLAGS_LTF_SIZE_M		GENMASK(1, 0)
+ #define HTT_PPDU_STATS_USER_RATE_RESP_FLAGS_STBC_M		BIT(2)
+@@ -1442,6 +1500,21 @@ struct htt_ppdu_stats_usr_cmpltn_ack_ba_
+ 	u32 success_bytes;
+ } __packed;
+ 
++#define HTT_PPDU_STATS_USR_CMN_FLAG_DELAYBA	BIT(14)
++#define HTT_PPDU_STATS_USR_CMN_HDR_SW_PEERID	GENMASK(31, 16)
++#define HTT_PPDU_STATS_USR_CMN_CTL_FRM_CTRL	GENMASK(15, 0)
++
++struct  htt_ppdu_stats_user_common {
++	u8 tid_num;
++	u8 vdev_id;
++	u16 sw_peer_id;
++	u32 info;
++	u32 ctrl;
++	u32 buffer_paddr_31_0;
++	u32 buffer_paddr_39_32;
++	u32 host_opaque_cookie;
++} __packed;
++
+ struct htt_ppdu_stats_usr_cmn_array {
+ 	struct htt_tlv tlv_hdr;
+ 	u32 num_ppdu_stats;
+@@ -1455,14 +1528,16 @@ struct htt_ppdu_stats_usr_cmn_array {
+ 
+ struct htt_ppdu_user_stats {
+ 	u16 peer_id;
++	u16 delay_ba;
+ 	u32 tlv_flags;
+ 	bool is_valid_peer_id;
+ 	struct htt_ppdu_stats_user_rate rate;
+ 	struct htt_ppdu_stats_usr_cmpltn_cmn cmpltn_cmn;
+ 	struct htt_ppdu_stats_usr_cmpltn_ack_ba_status ack_ba;
++	struct htt_ppdu_stats_user_common common;
+ };
+ 
+-#define HTT_PPDU_STATS_MAX_USERS	8
++#define HTT_PPDU_STATS_MAX_USERS	37
+ #define HTT_PPDU_DESC_MAX_DEPTH	16
+ 
+ struct htt_ppdu_stats {
+@@ -1471,7 +1546,7 @@ struct htt_ppdu_stats {
+ };
+ 
+ struct htt_ppdu_stats_info {
+-	u32 ppdu_id;
++	u32 tlv_bitmap, ppdu_id, frame_type, frame_ctrl, delay_ba, bar_num_users;
+ 	struct htt_ppdu_stats ppdu_stats;
+ 	struct list_head list;
+ };
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -1319,9 +1319,10 @@ static int ath11k_htt_tlv_ppdu_stats_par
+ 					   void *data)
+ {
+ 	struct htt_ppdu_stats_info *ppdu_info;
+-	struct htt_ppdu_user_stats *user_stats;
++	struct htt_ppdu_user_stats *user_stats = NULL;
+ 	int cur_user;
+ 	u16 peer_id;
++	u32 frame_type;
+ 
+ 	ppdu_info = data;
+ 
+@@ -1334,6 +1335,26 @@ static int ath11k_htt_tlv_ppdu_stats_par
+ 		}
+ 		memcpy((void *)&ppdu_info->ppdu_stats.common, ptr,
+ 		       sizeof(struct htt_ppdu_stats_common));
++		frame_type =
++			FIELD_GET(HTT_PPDU_STATS_CMN_FLAGS_FRAME_TYPE_M,
++				  ppdu_info->ppdu_stats.common.flags);
++		switch (frame_type) {
++		case HTT_STATS_FTYPE_TIDQ_DATA_SU:
++		case HTT_STATS_FTYPE_TIDQ_DATA_MU:
++			if (HTT_STATS_GET_FRAME_CTRL_TYPE(ppdu_info->frame_ctrl) <= HTT_STATS_FRAME_CTRL_TYPE_CTRL)
++				ppdu_info->frame_type = HTT_STATS_PPDU_FTYPE_CTRL;
++			else
++				ppdu_info->frame_type = HTT_STATS_PPDU_FTYPE_DATA;
++		break;
++		case HTT_STATS_FTYPE_SGEN_MU_BAR:
++		case HTT_STATS_FTYPE_SGEN_BAR:
++			ppdu_info->frame_type = HTT_STATS_PPDU_FTYPE_BAR;
++		break;
++		default:
++			ppdu_info->frame_type = HTT_STATS_PPDU_FTYPE_CTRL;
++		break;
++		}
++
+ 		break;
+ 	case HTT_PPDU_STATS_TAG_USR_RATE:
+ 		if (len < sizeof(struct htt_ppdu_stats_user_rate)) {
+@@ -1366,6 +1387,7 @@ static int ath11k_htt_tlv_ppdu_stats_par
+ 						      peer_id);
+ 		if (cur_user < 0)
+ 			return -EINVAL;
++		ppdu_info->bar_num_users += 1;
+ 		user_stats = &ppdu_info->ppdu_stats.user_stats[cur_user];
+ 		user_stats->peer_id = peer_id;
+ 		user_stats->is_valid_peer_id = true;
+@@ -1394,44 +1416,30 @@ static int ath11k_htt_tlv_ppdu_stats_par
+ 		       sizeof(struct htt_ppdu_stats_usr_cmpltn_ack_ba_status));
+ 		user_stats->tlv_flags |= BIT(tag);
+ 		break;
+-	}
+-	return 0;
+-}
+-
+-int ath11k_dp_htt_tlv_iter(struct ath11k_base *ab, const void *ptr, size_t len,
+-			   int (*iter)(struct ath11k_base *ar, u16 tag, u16 len,
+-				       const void *ptr, void *data),
+-			   void *data)
+-{
+-	const struct htt_tlv *tlv;
+-	const void *begin = ptr;
+-	u16 tlv_tag, tlv_len;
+-	int ret = -EINVAL;
+-
+-	while (len > 0) {
+-		if (len < sizeof(*tlv)) {
+-			ath11k_err(ab, "htt tlv parse failure at byte %zd (%zu bytes left, %zu expected)\n",
+-				   ptr - begin, len, sizeof(*tlv));
++	case HTT_PPDU_STATS_TAG_USR_COMMON:
++		if (len < sizeof(struct htt_ppdu_stats_user_common)) {
++			ath11k_warn(ab, "Invalid len %d for the tag 0x%x\n",
++				    len, tag);
+ 			return -EINVAL;
+ 		}
+-		tlv = (struct htt_tlv *)ptr;
+-		tlv_tag = FIELD_GET(HTT_TLV_TAG, tlv->header);
+-		tlv_len = FIELD_GET(HTT_TLV_LEN, tlv->header);
+-		ptr += sizeof(*tlv);
+-		len -= sizeof(*tlv);
+-
+-		if (tlv_len > len) {
+-			ath11k_err(ab, "htt tlv parse failure of tag %u at byte %zd (%zu bytes left, %u expected)\n",
+-				   tlv_tag, ptr - begin, len, tlv_len);
++		peer_id = ((struct htt_ppdu_stats_user_common *)ptr)->sw_peer_id;
++		cur_user = ath11k_get_ppdu_user_index(&ppdu_info->ppdu_stats,
++						      peer_id);
++		if (cur_user < 0)
+ 			return -EINVAL;
+-		}
+-		ret = iter(ab, tlv_tag, tlv_len, ptr, data);
+-		if (ret == -ENOMEM)
+-			return ret;
+-
+-		ptr += tlv_len;
+-		len -= tlv_len;
++		user_stats = &ppdu_info->ppdu_stats.user_stats[cur_user];
++		memcpy(&user_stats->common, ptr,
++		       sizeof(struct htt_ppdu_stats_user_common));
++		ppdu_info->frame_ctrl = FIELD_GET(HTT_PPDU_STATS_USR_CMN_CTL_FRM_CTRL,
++						  user_stats->common.ctrl);
++		user_stats->delay_ba = FIELD_GET(HTT_PPDU_STATS_USR_CMN_FLAG_DELAYBA,
++						  user_stats->common.info);
++		ppdu_info->delay_ba = user_stats->delay_ba;
++		break;
++	default:
++		break;
+ 	}
++	ppdu_info->tlv_bitmap |= BIT(tag);
+ 	return 0;
+ }
+ 
+@@ -1449,8 +1457,8 @@ ath11k_update_per_peer_tx_stats(struct a
+ 	struct htt_ppdu_stats_common *common = &ppdu_stats->common;
+ 	int ret;
+ 	u8 flags, mcs, nss, bw, sgi, dcm, rate_idx = 0;
+-	u32 succ_bytes = 0;
+-	u16 rate = 0, succ_pkts = 0;
++	u32 succ_bytes = 0, ppdu_type, mu_grpid, mu_pos;
++	u16 rate = 0, succ_pkts = 0, ru_tone, ru_start;
+ 	u32 tx_duration = 0;
+ 	u8 tid = HTT_PPDU_STATS_NON_QOS_TID;
+ 	bool is_ampdu = false;
+@@ -1481,6 +1489,11 @@ ath11k_update_per_peer_tx_stats(struct a
+ 	mcs = HTT_USR_RATE_MCS(user_rate->rate_flags);
+ 	sgi = HTT_USR_RATE_GI(user_rate->rate_flags);
+ 	dcm = HTT_USR_RATE_DCM(user_rate->rate_flags);
++	ppdu_type = HTT_USR_RATE_PPDU_TYPE(user_rate->info1);
++	mu_grpid = HTT_USR_RATE_MU_GRPID(user_rate->info0);
++	mu_pos = HTT_USR_RATE_USR_POS(user_rate->info0);
++	ru_start = user_rate->ru_start;
++	ru_tone = user_rate->ru_end;
+ 
+ 	/* Note: If host configured fixed rates and in some other special
+ 	 * cases, the broadcast/management frames are sent in different rates.
+@@ -1575,6 +1588,12 @@ ath11k_update_per_peer_tx_stats(struct a
+ 		peer_stats->ba_fails =
+ 			HTT_USR_CMPLTN_LONG_RETRY(usr_stats->cmpltn_cmn.flags) +
+ 			HTT_USR_CMPLTN_SHORT_RETRY(usr_stats->cmpltn_cmn.flags);
++		peer_stats->ppdu_type = ppdu_type;
++		peer_stats->ru_tones = ru_tone;
++		peer_stats->ru_start = ru_start;
++		peer_stats->mu_grpid = mu_grpid;
++		peer_stats->mu_pos   = mu_pos;
++		peer_stats->ru_tones = arsta->txrate.he_ru_alloc;
+ 
+ 		if (ath11k_debugfs_is_extd_tx_stats_enabled(ar))
+ 			ath11k_debugfs_sta_add_tx_stats(arsta, peer_stats, rate_idx);
+@@ -1627,13 +1646,87 @@ struct htt_ppdu_stats_info *ath11k_dp_ht
+ 	return ppdu_info;
+ }
+ 
++void ath11k_copy_to_delay_stats(struct ath11k_peer *peer,
++				  struct htt_ppdu_user_stats* usr_stats)
++{
++	peer->ppdu_stats_delayba.reserved0 = usr_stats->rate.reserved0;
++	peer->ppdu_stats_delayba.sw_peer_id = usr_stats->rate.sw_peer_id;
++	peer->ppdu_stats_delayba.info0 = usr_stats->rate.info0;
++	peer->ppdu_stats_delayba.ru_end = usr_stats->rate.ru_end;
++	peer->ppdu_stats_delayba.ru_start = usr_stats->rate.ru_start;
++	peer->ppdu_stats_delayba.info1 = usr_stats->rate.info1;
++	peer->ppdu_stats_delayba.rate_flags = usr_stats->rate.rate_flags;
++	peer->ppdu_stats_delayba.resp_rate_flags = usr_stats->rate.resp_rate_flags;
++
++	peer->delayba_flag = true;
++}
++
++void ath11k_copy_to_bar(struct ath11k_peer *peer,
++			struct htt_ppdu_user_stats* usr_stats)
++{
++	usr_stats->rate.reserved0 = peer->ppdu_stats_delayba.reserved0;
++	usr_stats->rate.sw_peer_id = peer->ppdu_stats_delayba.sw_peer_id;
++	usr_stats->rate.info0 = peer->ppdu_stats_delayba.info0;
++	usr_stats->rate.ru_end = peer->ppdu_stats_delayba.ru_end;
++	usr_stats->rate.ru_start = peer->ppdu_stats_delayba.ru_start;
++	usr_stats->rate.info1 = peer->ppdu_stats_delayba.info1;
++	usr_stats->rate.rate_flags = peer->ppdu_stats_delayba.rate_flags;
++	usr_stats->rate.resp_rate_flags = peer->ppdu_stats_delayba.resp_rate_flags;
++
++	peer->delayba_flag = false;
++}
++
++int ath11k_dp_htt_tlv_iter(struct ath11k_base *ab, const void *ptr, size_t len,
++			   int (*iter)(struct ath11k_base *ar, u16 tag, u16 len,
++				       const void *ptr, void *data),
++			   void *data)
++{
++	const struct htt_tlv *tlv;
++	const void *begin = ptr;
++	u16 tlv_tag, tlv_len;
++	int ret = -EINVAL;
++	struct htt_ppdu_stats_info * ppdu_info = NULL;
++
++	ppdu_info = (struct htt_ppdu_stats_info *)data;
++	ppdu_info->tlv_bitmap = 0;
++	while (len > 0) {
++		if (len < sizeof(*tlv)) {
++			ath11k_err(ab, "htt tlv parse failure at byte %zd (%zu bytes left, %zu expected)\n",
++				   ptr - begin, len, sizeof(*tlv));
++			return -EINVAL;
++		}
++		tlv = (struct htt_tlv *)ptr;
++		tlv_tag = FIELD_GET(HTT_TLV_TAG, tlv->header);
++		tlv_len = FIELD_GET(HTT_TLV_LEN, tlv->header);
++		ptr += sizeof(*tlv);
++		len -= sizeof(*tlv);
++
++		if (tlv_len > len) {
++			ath11k_err(ab, "htt tlv parse failure of tag %hhu at byte %zd (%zu bytes left, %hhu expected)\n",
++				   tlv_tag, ptr - begin, len, tlv_len);
++			return -EINVAL;
++		}
++
++		ret = iter(ab, tlv_tag, tlv_len, ptr, ppdu_info);
++		if (ret == -ENOMEM)
++			return ret;
++
++		ptr += tlv_len;
++		len -= tlv_len;
++	}
++	return 0;
++}
++
+ static int ath11k_htt_pull_ppdu_stats(struct ath11k_base *ab,
+ 				      struct sk_buff *skb)
+ {
+ 	struct ath11k_htt_ppdu_stats_msg *msg;
+ 	struct htt_ppdu_stats_info *ppdu_info;
++	struct ath11k_peer *peer = NULL;
++	struct htt_ppdu_user_stats* usr_stats = NULL;
++	u32 peer_id = 0;
+ 	struct ath11k *ar;
+-	int ret;
++	int ret, i;
+ 	u8 pdev_id;
+ 	u32 ppdu_id, len;
+ 
+@@ -1668,6 +1761,47 @@ static int ath11k_htt_pull_ppdu_stats(st
+ 		goto out_unlock_data;
+ 	}
+ 
++	/* back up data rate tlv for all peers */
++	if (ppdu_info->frame_type == HTT_STATS_PPDU_FTYPE_DATA &&
++	    (ppdu_info->tlv_bitmap & (1 << HTT_PPDU_STATS_TAG_USR_COMMON)) &&
++	    ppdu_info->delay_ba) {
++
++		for (i = 0; i < ppdu_info->ppdu_stats.common.num_users; i++) {
++			peer_id = ppdu_info->ppdu_stats.user_stats[i].peer_id;
++			spin_lock_bh(&ab->base_lock);
++			peer = ath11k_peer_find_by_id(ab, peer_id);
++			if (!peer) {
++				spin_unlock_bh(&ab->base_lock);
++				continue;
++			}
++
++			usr_stats = &ppdu_info->ppdu_stats.user_stats[i];
++			if (usr_stats->delay_ba)
++				ath11k_copy_to_delay_stats(peer, usr_stats);
++			spin_unlock_bh(&ab->base_lock);
++		}
++	}
++
++	/* restore all peers' data rate tlv to mu-bar tlv */
++	if (ppdu_info->frame_type == HTT_STATS_PPDU_FTYPE_BAR &&
++	    (ppdu_info->tlv_bitmap & (1 << HTT_PPDU_STATS_TAG_USR_COMMON))) {
++
++		for (i = 0; i < ppdu_info->bar_num_users; i++) {
++			peer_id = ppdu_info->ppdu_stats.user_stats[i].peer_id;
++			spin_lock_bh(&ab->base_lock);
++			peer = ath11k_peer_find_by_id(ab, peer_id);
++			if (!peer) {
++				spin_unlock_bh(&ab->base_lock);
++				continue;
++			}
++
++			usr_stats = &ppdu_info->ppdu_stats.user_stats[i];
++			if (peer->delayba_flag)
++				ath11k_copy_to_bar(peer, usr_stats);
++			spin_unlock_bh(&ab->base_lock);
++		}
++	}
++
+ out_unlock_data:
+ 	spin_unlock_bh(&ar->data_lock);
+ 
+--- a/drivers/net/wireless/ath/ath11k/rx_desc.h
++++ b/drivers/net/wireless/ath/ath11k/rx_desc.h
+@@ -1500,6 +1500,11 @@ struct hal_rx_desc {
+ 	} u;
+ } __packed;
+ 
++#define MAX_USER_POS 8
++#define MAX_MU_GROUP_ID 64
++#define MAX_MU_GROUP_SHOW 16
++#define MAX_MU_GROUP_LENGTH (6 * MAX_MU_GROUP_SHOW)
++
+ #define HAL_RX_RU_ALLOC_TYPE_MAX 6
+ #define RU_26  1
+ #define RU_52  2
+--- a/drivers/net/wireless/ath/ath11k/peer.h
++++ b/drivers/net/wireless/ath/ath11k/peer.h
+@@ -7,6 +7,17 @@
+ #ifndef ATH11K_PEER_H
+ #define ATH11K_PEER_H
+ 
++struct ppdu_user_delayba {
++	u8 reserved0;
++	u16 sw_peer_id;
++	u32 info0;
++	u16 ru_end;
++	u16 ru_start;
++	u32 info1;
++	u32 rate_flags;
++	u32 resp_rate_flags;
++};
++
+ struct ath11k_peer {
+ 	struct list_head list;
+ 	struct ieee80211_sta *sta;
+@@ -38,6 +49,8 @@ struct ath11k_peer {
+ 	u16 sec_type_grp;
+ 	bool is_authorized;
+ 	bool dp_setup_done;
++	struct ppdu_user_delayba ppdu_stats_delayba;
++	bool delayba_flag;
+ };
+ 
+ void ath11k_peer_unmap_event(struct ath11k_base *ab, u16 peer_id);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/902-ath11k-add-btcoex-config.patch b/package/kernel/mac80211/patches/ath11k_nss/902-ath11k-add-btcoex-config.patch
new file mode 100644
index 00000000000000..18bc4384094eca
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/902-ath11k-add-btcoex-config.patch
@@ -0,0 +1,612 @@
+--- a/drivers/net/wireless/ath/ath11k/Makefile
++++ b/drivers/net/wireless/ath/ath11k/Makefile
+@@ -17,7 +17,8 @@ ath11k-y += core.o \
+ 	    peer.o \
+ 	    dbring.o \
+ 	    hw.o \
+-	    pcic.o
++	    pcic.o \
++	    vendor.o
+ 
+ ath11k-$(CPTCFG_ATH11K_DEBUGFS) += debugfs.o debugfs_htt_stats.o debugfs_sta.o
+ ath11k-$(CPTCFG_NL80211_TESTMODE) += testmode.o
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -637,6 +637,16 @@ struct ath11k_per_peer_tx_stats {
+ #define ATH11K_FLUSH_TIMEOUT (5 * HZ)
+ #define ATH11K_VDEV_DELETE_TIMEOUT_HZ (5 * HZ)
+ 
++struct ath11k_coex_info {
++	bool coex_support;
++	u32 pta_num;
++	u32 coex_mode;
++	u32 bt_active_time_slot;
++	u32 bt_priority_time_slot;
++	u32 coex_algo_type;
++	u32 pta_priority;
++};
++
+ struct ath11k {
+ 	struct ath11k_base *ab;
+ 	struct ath11k_pdev *pdev;
+@@ -759,6 +769,8 @@ struct ath11k {
+ 	struct ath11k_per_peer_tx_stats cached_stats;
+ 	u32 last_ppdu_id;
+ 	u32 cached_ppdu_id;
++
++	struct ath11k_coex_info coex;
+ 	int monitor_vdev_id;
+ 	struct completion fw_mode_reset;
+ 	u8 ftm_msgref;
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -9,6 +9,7 @@
+ #include <linux/etherdevice.h>
+ #include <linux/bitfield.h>
+ #include <linux/inetdevice.h>
++#include <linux/of.h>
+ #include <net/if_inet6.h>
+ #include <net/ipv6.h>
+ 
+@@ -24,6 +25,7 @@
+ #include "debugfs_sta.h"
+ #include "hif.h"
+ #include "wow.h"
++#include "vendor.h"
+ #include "nss.h"
+ 
+ #define CHAN2G(_channel, _freq, _flags) { \
+@@ -9282,6 +9284,91 @@ err_fallback:
+ 	return 0;
+ }
+ 
++#define ATH11K_WLAN_PRIO_MAX	0x63
++#define ATH11K_WLAN_PRIO_WEIGHT	0xff
++
++int ath11k_mac_coex_config(struct ath11k *ar, struct ath11k_vif *arvif,
++			   int coex, u32 wlan_prio_mask, u8 wlan_weight)
++{
++	struct coex_config_arg coex_config;
++	int ret;
++
++	if (ar->state != ATH11K_STATE_ON &&
++	    ar->state != ATH11K_STATE_RESTARTED)
++		return -ENETDOWN;
++
++	if (coex == -1 || !(test_bit(ATH11K_FLAG_BTCOEX, &ar->ab->dev_flags) ^ coex))
++		goto next;
++
++	coex_config.vdev_id = arvif->vdev_id;
++	if (coex == 1) {
++		coex_config.config_type = WMI_COEX_CONFIG_PTA_INTERFACE;
++		coex_config.pta_num = ar->coex.pta_num;
++		coex_config.coex_mode = ar->coex.coex_mode;
++		coex_config.bt_txrx_time = ar->coex.bt_active_time_slot;
++		coex_config.bt_priority_time = ar->coex.bt_priority_time_slot;
++		coex_config.pta_algorithm = ar->coex.coex_algo_type;
++		coex_config.pta_priority = ar->coex.pta_priority;
++		ret = ath11k_send_coex_config_cmd(ar, &coex_config);
++		if (ret) {
++			ath11k_warn(ar->ab,
++				    "failed to set coex config vdev_id %d ret %d\n",
++				    coex_config.vdev_id, ret);
++			goto out;
++		}
++	}
++
++	memset(&coex_config, 0, sizeof(struct coex_config_arg));
++	coex_config.vdev_id = arvif->vdev_id;
++	coex_config.config_type = WMI_COEX_CONFIG_BTC_ENABLE;
++	coex_config.coex_enable = coex;
++	ret = ath11k_send_coex_config_cmd(ar, &coex_config);
++	if (ret) {
++		ath11k_warn(ar->ab,
++			    "failed to set coex config vdev_id %d ret %d\n",
++			    coex_config.vdev_id, ret);
++		goto out;
++	}
++
++	if (coex)
++		set_bit(ATH11K_FLAG_BTCOEX, &ar->ab->dev_flags);
++	else
++		clear_bit(ATH11K_FLAG_BTCOEX, &ar->ab->dev_flags);
++
++next:
++	if (!wlan_prio_mask) {
++		ret = 0;
++		goto out;
++	}
++
++	if (!(test_bit(ATH11K_FLAG_BTCOEX, &ar->ab->dev_flags))) {
++		ret = -EINVAL;
++		goto out;
++	}
++
++	if (wlan_prio_mask > ATH11K_WLAN_PRIO_MAX ||
++	    wlan_weight > ATH11K_WLAN_PRIO_WEIGHT) {
++		ret = -EINVAL;
++		goto out;
++	}
++
++	memset(&coex_config, 0, sizeof(struct coex_config_arg));
++	coex_config.vdev_id = arvif->vdev_id;
++	coex_config.config_type = WMI_COEX_CONFIG_WLAN_PKT_PRIORITY;
++	coex_config.wlan_pkt_type = wlan_prio_mask;
++	coex_config.wlan_pkt_weight = wlan_weight;
++	ret = ath11k_send_coex_config_cmd(ar, &coex_config);
++	if (ret) {
++		ath11k_warn(ar->ab,
++			    "failed to set coex config vdev_id %d ret %d\n",
++			    coex_config.vdev_id, ret);
++		goto out;
++	}
++
++out:
++	return ret;
++}
++
+ static const struct ieee80211_ops ath11k_ops = {
+ 	.tx				= ath11k_mac_op_tx,
+ 	.wake_tx_queue			= ieee80211_handle_wake_tx_queue,
+@@ -9521,6 +9608,56 @@ static int ath11k_mac_setup_iface_combin
+ 	return 0;
+ }
+ 
++static void ath11k_mac_fetch_coex_info(struct ath11k *ar)
++{
++	struct ath11k_pdev_cap *cap = &ar->pdev->cap;
++	struct ath11k_base *ab = ar->ab;
++	struct device *dev = ab->dev;
++
++	ar->coex.coex_support = false;
++
++	if (!(cap->supported_bands & WMI_HOST_WLAN_2G_CAP))
++		return;
++
++	if (of_property_read_u32(dev->of_node, "qcom,pta-num",
++				&ar->coex.pta_num)) {
++		ath11k_err(ab, "No qcom,pta_num entry in dev-tree.\n");
++	}
++
++	if (of_property_read_u32(dev->of_node, "qcom,coex-mode",
++				&ar->coex.coex_mode)) {
++		ath11k_err(ab, "No qcom,coex_mode entry in dev-tree.\n");
++	}
++
++	if (of_property_read_u32(dev->of_node, "qcom,bt-active-time",
++				&ar->coex.bt_active_time_slot)) {
++		ath11k_err(ab, "No qcom,bt-active-time entry in dev-tree.\n");
++	}
++
++	if (of_property_read_u32(dev->of_node, "qcom,bt-priority-time",
++				&ar->coex.bt_priority_time_slot)) {
++		ath11k_err(ab, "No qcom,bt-priority-time entry in dev-tree.\n");
++	}
++
++	if (of_property_read_u32(dev->of_node, "qcom,coex-algo",
++				&ar->coex.coex_algo_type)) {
++		ath11k_err(ab, "No qcom,coex-algo entry in dev-tree.\n");
++	}
++
++	if (of_property_read_u32(dev->of_node, "qcom,pta-priority",
++				&ar->coex.pta_priority)) {
++		ath11k_err(ab, "No qcom,pta-priority entry in dev-tree.\n");
++	}
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "coex pta_num %u coex_mode %u"
++		   " bt_active_time_slot %u bt_priority_time_slot %u"
++		   " coex_algorithm %u pta_priority %u\n", ar->coex.pta_num,
++		   ar->coex.coex_mode, ar->coex.bt_active_time_slot,
++		   ar->coex.bt_priority_time_slot, ar->coex.coex_algo_type,
++		   ar->coex.pta_priority);
++	ar->coex.coex_support = true;
++}
++
+ static const u8 ath11k_if_types_ext_capa[] = {
+ 	[0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING,
+ 	[2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT,
+@@ -9782,6 +9919,7 @@ static int __ath11k_mac_register(struct
+ 	ar->hw->wiphy->ema_max_profile_periodicity = TARGET_EMA_MAX_PROFILE_PERIOD;
+ 
+ 	ath11k_reg_init(ar);
++	ath11k_vendor_register(ar);
+ 
+ 	if (!test_bit(ATH11K_FLAG_RAW_MODE, &ab->dev_flags)) {
+ 		ar->hw->netdev_features = NETIF_F_HW_CSUM;
+@@ -9944,6 +10082,7 @@ int ath11k_mac_allocate(struct ath11k_ba
+ 		 */
+ 		ath11k_wmi_pdev_attach(ab, i);
+ 
++		ath11k_mac_fetch_coex_info(ar);
+ 		ar->cfg_tx_chainmask = pdev->cap.tx_chain_mask;
+ 		ar->cfg_rx_chainmask = pdev->cap.rx_chain_mask;
+ 		ar->num_tx_chains = get_num_chains(pdev->cap.tx_chain_mask);
+--- a/drivers/net/wireless/ath/ath11k/mac.h
++++ b/drivers/net/wireless/ath/ath11k/mac.h
+@@ -150,8 +150,9 @@ void __ath11k_mac_scan_finish(struct ath
+ void ath11k_mac_scan_finish(struct ath11k *ar);
+ 
+ struct ath11k_vif *ath11k_mac_get_arvif(struct ath11k *ar, u32 vdev_id);
+-struct ath11k_vif *ath11k_mac_get_arvif_by_vdev_id(struct ath11k_base *ab,
+-						   u32 vdev_id);
++struct ath11k_vif *ath11k_mac_get_arvif_by_vdev_id(struct ath11k_base *ab, u32 vdev_id);
++int ath11k_mac_coex_config(struct ath11k *ar, struct ath11k_vif *arvif,
++			   int coex, u32 wlan_prio_mask, u8 wlan_weight);
+ u8 ath11k_mac_get_target_pdev_id(struct ath11k *ar);
+ u8 ath11k_mac_get_target_pdev_id_from_vif(struct ath11k_vif *arvif);
+ struct ath11k_vif *ath11k_mac_get_vif_up(struct ath11k_base *ab);
+--- /dev/null
++++ b/drivers/net/wireless/ath/ath11k/vendor.c
+@@ -0,0 +1,121 @@
++// SPDX-License-Identifier: ISC
++/*
++ * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
++ */
++
++#include <net/netlink.h>
++#include <net/mac80211.h>
++#include "core.h"
++#include "vendor.h"
++#include "debug.h"
++
++static const struct nla_policy
++ath11k_vendor_btcoex_config_policy[QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_MAX + 1] = {
++	[QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_ENABLE] = { .type = NLA_U8 },
++	[QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_WLAN_PRIORITY] = { .type = NLA_NESTED },
++};
++
++static const struct nla_policy
++ath11k_vendor_wlan_prio_policy[QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_MAX + 1] = {
++	[QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_MASK] = { .type = NLA_U8 },
++	[QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_WEIGHT] = { .type = NLA_U8 },
++};
++
++static int ath11k_vendor_btcoex_configure(struct wiphy *wiphy,
++					  struct wireless_dev *wdev,
++					  const void *data,
++					  int data_len)
++{
++	struct ieee80211_vif *vif;
++	struct ath11k_vif *arvif;
++	struct ath11k *ar;
++	struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_MAX + 1];
++	struct nlattr *tb_wlan_prio[QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_MAX + 1];
++	struct nlattr *wlan_prio;
++	enum qca_wlan_priority_type wlan_prio_mask = 0;
++	int ret, coex = -1, rem_conf;
++	u8 wlan_weight = 0;
++
++	if (!wdev)
++		return -EINVAL;
++
++	vif = wdev_to_ieee80211_vif(wdev);
++	if (!vif)
++		return -EINVAL;
++
++	arvif = (struct ath11k_vif *)vif->drv_priv;
++	if (!arvif)
++		return -EINVAL;
++
++	ar = arvif->ar;
++
++	mutex_lock(&ar->conf_mutex);
++
++	ret = nla_parse(tb, QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_MAX, data, data_len,
++			ath11k_vendor_btcoex_config_policy, NULL);
++	if (ret) {
++		ath11k_warn(ar->ab, "invalid BTCOEX config policy attribute\n");
++		goto out;
++	}
++
++	if (!tb[QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_ENABLE] &&
++	    !tb[QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_WLAN_PRIORITY]) {
++		ath11k_warn(ar->ab, "invalid BTCOEX config attributes\n");
++		ret = -EINVAL;
++		goto out;
++	}
++
++	if (tb[QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_ENABLE]) {
++		coex = nla_get_u8(tb[QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_ENABLE]);
++		ret = ath11k_mac_coex_config(ar, arvif, coex, wlan_prio_mask, wlan_weight);
++		if (ret)
++			goto out;
++	}
++	if (tb[QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_WLAN_PRIORITY]) {
++		nla_for_each_nested(wlan_prio,
++				    tb[QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_WLAN_PRIORITY],
++				    rem_conf) {
++			ret =
++			nla_parse_nested(tb_wlan_prio, QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_MAX,
++					 wlan_prio, ath11k_vendor_wlan_prio_policy,
++					 NULL);
++			if (ret)
++				goto out;
++			wlan_prio_mask =
++				nla_get_u8(tb_wlan_prio[QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_MASK]);
++			if (tb_wlan_prio[QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_WEIGHT])
++				wlan_weight =
++				nla_get_u8(tb_wlan_prio[QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_WEIGHT]);
++			ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
++				   "BTCOEX enable %u WLAN Priority %u wlan weight %u\n",
++				   coex, wlan_prio_mask, wlan_weight);
++
++			ret = ath11k_mac_coex_config(ar, arvif, coex, wlan_prio_mask, wlan_weight);
++			if (ret)
++				goto out;
++		}
++	}
++
++out:
++	mutex_unlock(&ar->conf_mutex);
++	return ret;
++}
++
++static struct wiphy_vendor_command ath11k_vendor_commands[] = {
++	{
++		.info.vendor_id = QCA_NL80211_VENDOR_ID,
++		.info.subcmd = QCA_NL80211_VENDOR_SUBCMD_BTCOEX_CONFIG,
++		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
++			WIPHY_VENDOR_CMD_NEED_RUNNING,
++		.doit = ath11k_vendor_btcoex_configure,
++		.policy = ath11k_vendor_btcoex_config_policy
++	}
++};
++
++int ath11k_vendor_register(struct ath11k *ar)
++{
++	ar->hw->wiphy->vendor_commands = ath11k_vendor_commands;
++	ar->hw->wiphy->n_vendor_commands = ARRAY_SIZE(ath11k_vendor_commands);
++
++	return 0;
++}
+--- /dev/null
++++ b/drivers/net/wireless/ath/ath11k/vendor.h
+@@ -0,0 +1,83 @@
++/* SPDX-License-Identifier: ISC */
++/*
++ * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
++ */
++
++#ifndef ATH11K_VENDOR_H
++#define ATH11K_VENDOR_H
++
++#define QCA_NL80211_VENDOR_ID 0x001374
++
++enum qca_nl80211_vendor_subcmds {
++	/* QCA_NL80211_VENDOR_SUBCMD_BTCOEX_CONFIG: This command is used to
++	 * enable/disable BTCOEX and set priority for different type of WLAN
++	 * traffic over BT low priority traffic. This uses attributes in
++	 * enum qca-vendor_attr_btcoex_config.
++	 */
++	QCA_NL80211_VENDOR_SUBCMD_BTCOEX_CONFIG = 182,
++};
++
++/*
++ * enum qca_wlan_priority_type - priority mask
++ * This enum defines priority mask that user can configure
++ * over BT traffic type which can be passed through
++ * QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_WLAN_PRIORITY attribute.
++ *
++ * @QCA_WLAN_PRIORITY_BE: Bit mask for WLAN Best effort traffic
++ * @QCA_WLAN_PRIORITY_BK: Bit mask for WLAN Background traffic
++ * @QCA_WLAN_PRIORITY_VI: Bit mask for WLAN Video traffic
++ * @QCA_WLAN_PRIORITY_VO: Bit mask for WLAN Voice traffic
++ * @QCA_WLAN_PRIORITY_BEACON: Bit mask for WLAN BEACON frame
++ * @QCA_WLAN_PRIORITY_MGMT: Bit mask for WLAN Management frame
++*/
++enum qca_wlan_priority_type {
++	QCA_WLAN_PRIORITY_BE = BIT(0),
++	QCA_WLAN_PRIORITY_BK = BIT(1),
++	QCA_WLAN_PRIORITY_VI = BIT(2),
++	QCA_WLAN_PRIORITY_VO = BIT(3),
++	QCA_WLAN_PRIORITY_BEACON = BIT(4),
++	QCA_WLAN_PRIORITY_MGMT = BIT(5),
++};
++
++/**
++ * enum qca_wlan_vendor_attr_wlan_prio - Used to configure
++ * WLAN priority mask and its respective weight value.
++ * @QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_MASK - This is u8 attribute
++ * used to pass traffic type mask value see %qca_wlan_priority_type
++ * @QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_WEIGHT - This is u8 attribute
++ * accepts value between 0 and 255 and used to configure weight for
++ * traffic type mentioned in %QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_MASK.
++ */
++enum qca_wlan_vendor_attr_wlan_prio {
++       QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_INVALID = 0,
++       QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_MASK = 1,
++       QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_WEIGHT = 2,
++
++       QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_LAST,
++       QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_MAX =
++               QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_LAST - 1,
++};
++
++
++
++/**
++ * enum qca_wlan_vendor_attr_btcoex_config - Used by the vendor command
++ * The use can enable/disable BTCOEX and configure WLAN priority for
++ * different traffic type over BT.
++ * QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_ENABLE, enable/disable BTCOEX
++ * QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_WLAN_PRIORITY, This is a nested
++ * attribute pass the attributes in %qca_wlan_vendor_attr_wlan_prio.
++ */
++enum qca_wlan_vendor_attr_btcoex_config {
++	QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_INVALID = 0,
++	QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_ENABLE = 1,
++	QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_WLAN_PRIORITY = 2,
++
++	/* keep last */
++	QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_LAST,
++	QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_MAX =
++		QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_LAST - 1
++};
++
++int ath11k_vendor_register(struct ath11k *ar);
++#endif /* QCA_VENDOR_H */
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -1697,6 +1697,71 @@ int ath11k_wmi_vdev_set_param_cmd(struct
+ 	return ret;
+ }
+ 
++static void ath11k_wmi_copy_coex_config(struct ath11k *ar, struct wmi_coex_config_cmd *cmd,
++				       struct coex_config_arg *coex_config)
++{
++	if (coex_config->config_type == WMI_COEX_CONFIG_BTC_ENABLE) {
++		cmd->coex_enable = coex_config->coex_enable;
++		ath11k_dbg(ar->ab, ATH11K_DBG_WMI,
++			   "WMI coex config type %u vdev id %d  coex_enable %u\n",
++			   coex_config->config_type, coex_config->vdev_id,
++			   coex_config->coex_enable);
++	}
++
++	if (coex_config->config_type == WMI_COEX_CONFIG_WLAN_PKT_PRIORITY) {
++		cmd->wlan_pkt_type = coex_config->wlan_pkt_type;
++		cmd->wlan_pkt_weight = coex_config->wlan_pkt_weight;
++		ath11k_dbg(ar->ab, ATH11K_DBG_WMI,
++			   "WMI coex config type %u vdev id %d  wlan pkt type 0x%x wlan pkt weight %u\n",
++			   coex_config->config_type, coex_config->vdev_id,
++			   coex_config->wlan_pkt_type, coex_config->wlan_pkt_weight);
++	}
++
++	if (coex_config->config_type == WMI_COEX_CONFIG_PTA_INTERFACE) {
++		cmd->pta_num = coex_config->pta_num;
++		cmd->coex_mode = coex_config->coex_mode;
++		cmd->bt_txrx_time = coex_config->bt_txrx_time;
++		cmd->bt_priority_time = coex_config->bt_priority_time;
++		cmd->pta_algorithm = coex_config->pta_algorithm;
++		cmd->pta_priority = coex_config->pta_priority;
++		ath11k_dbg(ar->ab, ATH11K_DBG_WMI,
++			   "WMI coex config type %u vdev id %d  pta num %u coex mode %u bt_txrx_time %u bt_priority_time %u pta alogrithm %u pta priority %u\n",
++			   coex_config->config_type, coex_config->vdev_id,
++			   coex_config->pta_num, coex_config->coex_mode,
++			   coex_config->bt_txrx_time, coex_config->bt_priority_time,
++			   coex_config->pta_algorithm, coex_config->pta_priority);
++	}
++}
++
++int ath11k_send_coex_config_cmd(struct ath11k *ar,
++				struct coex_config_arg *coex_config)
++{
++	struct ath11k_pdev_wmi *wmi = ar->wmi;
++	struct wmi_coex_config_cmd *cmd;
++	struct sk_buff *skb;
++	int ret;
++
++	skb = ath11k_wmi_alloc_skb(wmi->wmi_ab, sizeof(*cmd));
++	if (!skb)
++		return -ENOMEM;
++
++	cmd = (struct wmi_coex_config_cmd *)skb->data;
++	cmd->tlv_header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_COEX_CONFIG_CMD) |
++			  FIELD_PREP(WMI_TLV_LEN, sizeof(*cmd) - TLV_HDR_SIZE);
++
++	cmd->vdev_id = coex_config->vdev_id;
++	cmd->config_type = coex_config->config_type;
++	ath11k_wmi_copy_coex_config(ar, cmd, coex_config);
++
++	ret = ath11k_wmi_cmd_send(wmi, skb, WMI_COEX_CONFIG_CMDID);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to send WMI_COEX_CONFIG_CMD cmd\n");
++		dev_kfree_skb(skb);
++	}
++
++	return ret;
++}
++
+ int ath11k_wmi_send_stats_request_cmd(struct ath11k *ar,
+ 				      struct stats_request_params *param)
+ {
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -5303,6 +5303,79 @@ struct wmi_wmm_params_arg {
+ 	u8 no_ack;
+ };
+ 
++enum wmi_coex_config_type {
++	WMI_COEX_CONFIG_PAGE_P2P_TDM		= 1,
++	WMI_COEX_CONFIG_PAGE_STA_TDM		= 2,
++	WMI_COEX_CONFIG_PAGE_SAP_TDM		= 3,
++	WMI_COEX_CONFIG_DURING_WLAN_CONN	= 4,
++	WMI_COEX_CONFIG_BTC_ENABLE		= 5,
++	WMI_COEX_CONFIG_COEX_DBG		= 6,
++	WMI_COEX_CONFIG_PAGE_P2P_STA_TDM	= 7,
++	WMI_COEX_CONFIG_INQUIRY_P2P_TDM		= 8,
++	WMI_COEX_CONFIG_INQUIRY_STA_TDM		= 9,
++	WMI_COEX_CONFIG_INQUIRY_SAP_TDM		= 10,
++	WMI_COEX_CONFIG_INQUIRY_P2P_STA_TDM	= 11,
++	WMI_COEX_CONFIG_TX_POWER		= 12,
++	WMI_COEX_CONFIG_PTA_CONFIG		= 13,
++	WMI_COEX_CONFIG_AP_TDM			= 14,
++	WMI_COEX_CONFIG_WLAN_SCAN_PRIORITY	= 15,
++	WMI_COEX_CONFIG_WLAN_PKT_PRIORITY	= 16,
++	WMI_COEX_CONFIG_PTA_INTERFACE		= 17,
++};
++
++struct coex_config_arg {
++	u32 vdev_id;
++        u32 config_type;
++	union {
++		struct {
++			u32 coex_enable;
++		};
++
++		struct {
++			u32 pta_num;
++			u32 coex_mode;
++			u32 bt_txrx_time;
++			u32 bt_priority_time;
++			u32 pta_algorithm;
++			u32 pta_priority;
++		};
++
++		struct {
++			u32 wlan_pkt_type;
++			u32 wlan_pkt_type_continued;
++			u32 wlan_pkt_weight;
++			u32 bt_pkt_weight;
++		};
++	};
++};
++
++struct wmi_coex_config_cmd {
++	u32 tlv_header;
++	u32 vdev_id;
++        u32 config_type;
++	union {
++		struct {
++			u32 coex_enable;
++		} __packed;
++
++		struct {
++			u32 pta_num;
++			u32 coex_mode;
++			u32 bt_txrx_time;
++			u32 bt_priority_time;
++			u32 pta_algorithm;
++			u32 pta_priority;
++		} __packed;
++
++		struct {
++			u32 wlan_pkt_type;
++			u32 wlan_pkt_type_continued;
++			u32 wlan_pkt_weight;
++			u32 bt_pkt_weight;
++		} __packed;
++	} __packed;
++} __packed;
++
+ struct wmi_vdev_set_wmm_params_cmd {
+ 	u32 tlv_header;
+ 	u32 vdev_id;
+@@ -6520,6 +6593,8 @@ int ath11k_wmi_pdev_non_srg_obss_color_e
+ 						     u32 *bitmap);
+ int ath11k_wmi_pdev_non_srg_obss_bssid_enable_bitmap(struct ath11k *ar,
+ 						     u32 *bitmap);
++int ath11k_send_coex_config_cmd(struct ath11k *ar,
++			       struct coex_config_arg *coex_config);
+ int ath11k_wmi_send_obss_color_collision_cfg_cmd(struct ath11k *ar, u32 vdev_id,
+ 						 u8 bss_color, u32 period,
+ 						 bool enable);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/903-002-ath11k-add-support-for-ext-vdev-in-NSS-for-AP_VLAN-vif-handling.patch b/package/kernel/mac80211/patches/ath11k_nss/903-002-ath11k-add-support-for-ext-vdev-in-NSS-for-AP_VLAN-vif-handling.patch
new file mode 100644
index 00000000000000..6f5fffe596172b
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/903-002-ath11k-add-support-for-ext-vdev-in-NSS-for-AP_VLAN-vif-handling.patch
@@ -0,0 +1,784 @@
+From 83c2a029a5300b2aaeaa9855011668b407d142c2 Mon Sep 17 00:00:00 2001
+From: Sathishkumar Muruganandam <murugana@codeaurora.org>
+Date: Fri, 20 Nov 2020 11:41:11 +0530
+Subject: [PATCH 2/3] ath11k: add support for ext vdev in NSS for AP_VLAN vif
+ handling
+
+- add ext vdev NSS API callbacks required for AP_VLAN vif
+- invoke ieee80211_rx_nss_notify_4addr on WDS Rx path for 4addr frames until
+  ext vdev interface is UP
+- do ext vdev down of all AP_VLAN vifs upon vdev down of associated AP vif
+
+Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/nss.c | 452 ++++++++++++++++++++++++++++++++--
+ drivers/net/wireless/ath/ath11k/nss.h |  57 +++++
+ 2 files changed, 495 insertions(+), 14 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/nss.c
++++ b/drivers/net/wireless/ath/ath11k/nss.c
+@@ -366,6 +366,10 @@ void ath11k_nss_wifili_event_receive(str
+ 		ath11k_dbg(ab, ATH11K_DBG_NSS_WDS, "nss wifili wds peer del event received %d response %d error %d\n",
+ 			   msg_type, response, error);
+ 		break;
++	case NSS_WIFILI_PEER_4ADDR_EVENT_MSG:
++		ath11k_dbg(ab, ATH11K_DBG_NSS_WDS, "nss wifili peer 4addr event received %d response %d error %d\n",
++			   msg_type, response, error);
++		break;
+ 	default:
+ 		ath11k_dbg(ab, ATH11K_DBG_NSS, "unhandled event %d\n", msg_type);
+ 		break;
+@@ -599,8 +603,9 @@ static int ath11k_nss_undecap_nwifi(stru
+ 	return 0;
+ }
+ 
+-static void ath11k_nss_wds_type_rx(struct ath11k *ar, u8* src_mac, u8 is_sa_valid,
+-				   u8 addr4_valid, u16 peer_id)
++static void ath11k_nss_wds_type_rx(struct ath11k *ar, struct net_device *dev,
++				   u8* src_mac, u8 is_sa_valid, u8 addr4_valid,
++				   u16 peer_id, bool *drop)
+ {
+ 	struct ath11k_base *ab = ar->ab;
+ 	struct ath11k_ast_entry *ast_entry = NULL;
+@@ -622,19 +627,22 @@ static void ath11k_nss_wds_type_rx(struc
+ 		if (!is_sa_valid) {
+ 			ath11k_peer_add_ast(ar, ta_peer, src_mac,
+ 					    ATH11K_AST_TYPE_WDS);
+-			ath11k_nss_add_wds_peer(ar, ta_peer,
+-						src_mac, ATH11K_AST_TYPE_WDS);
++			if (!ta_peer->nss.ext_vdev_up)
++				ieee80211_rx_nss_notify_4addr(dev, ta_peer->addr);
+ 		} else {
+ 			if (!ast_entry) {
+ 				ath11k_peer_add_ast(ar, ta_peer, src_mac,
+ 						    ATH11K_AST_TYPE_WDS);
+-				ath11k_nss_add_wds_peer(ar, ta_peer, src_mac,
+-							ATH11K_AST_TYPE_WDS);
+-			} else {
++				if (!ta_peer->nss.ext_vdev_up)
++					ieee80211_rx_nss_notify_4addr(dev, ta_peer->addr);
++			} else if (ast_entry->type == ATH11K_AST_TYPE_WDS) {
+ 				ath11k_peer_update_ast(ar, ta_peer, ast_entry);
+ 				ath11k_nss_update_wds_peer(ar, ta_peer, src_mac);
+ 			}
+ 		}
++
++		if (!ta_peer->nss.ext_vdev_up)
++			*drop = true;
+ 	}
+ 
+ 	spin_unlock_bh(&ab->base_lock);
+@@ -678,7 +686,8 @@ static void ath11k_nss_mec_handler(struc
+ 
+ static void ath11k_nss_vdev_spl_receive_ext_wdsdata(struct ath11k_vif *arvif,
+ 						    struct sk_buff *skb,
+-						    struct nss_wifi_vdev_wds_per_packet_metadata *wds_metadata)
++						    struct nss_wifi_vdev_wds_per_packet_metadata *wds_metadata,
++						    bool *drop)
+ {
+ 	struct ath11k *ar = arvif->ar;
+ 	struct ath11k_base *ab = ar->ab;
+@@ -699,8 +708,8 @@ static void ath11k_nss_vdev_spl_receive_
+ 
+ 	switch (wds_type) {
+ 		case NSS_WIFI_VDEV_WDS_TYPE_RX:
+-			ath11k_nss_wds_type_rx(ar, src_mac, is_sa_valid,
+-					       addr4_valid, peer_id);
++			ath11k_nss_wds_type_rx(ar, skb->dev, src_mac, is_sa_valid,
++					       addr4_valid, peer_id, drop);
+ 			break;
+ 		case NSS_WIFI_VDEV_WDS_TYPE_MEC:
+ 			ath11k_nss_mec_handler(ar, (u8 *)(skb->data));
+@@ -767,6 +776,7 @@ ath11k_nss_vdev_special_data_receive(str
+ 	struct ieee80211_vif *vif;
+ 	struct ath11k_vif *arvif;
+ 	struct ath11k_base *ab;
++	bool drop = false;
+ 	bool eth_decap = false;
+ 	int data_offs = 0;
+ 	int ret = 0;
+@@ -822,10 +832,11 @@ ath11k_nss_vdev_special_data_receive(str
+ 	    NSS_WIFI_VDEV_EXT_DATA_PKT_TYPE_WDS_LEARN) {
+ 		wds_metadata = &wifi_metadata->metadata.wds_metadata;
+ 		ath11k_nss_vdev_spl_receive_ext_wdsdata(arvif, skb,
+-							wds_metadata);
++							wds_metadata, &drop);
+ 	}
+ 
+-	ath11k_nss_deliver_rx(arvif->vif, skb, eth_decap, data_offs, napi);
++	if (!drop)
++		ath11k_nss_deliver_rx(arvif->vif, skb, eth_decap, data_offs, napi);
+ }
+ 
+ static void
+@@ -888,6 +899,68 @@ ath11k_nss_vdev_data_receive(struct net_
+ 	ath11k_nss_deliver_rx(arvif->vif, skb, eth_decap, data_offs, napi);
+ }
+ 
++static void
++ath11k_nss_ext_vdev_special_data_receive(struct net_device *dev,
++					 struct sk_buff *skb,
++					 __attribute__((unused)) struct napi_struct *napi)
++{
++	dev_kfree_skb_any(skb);
++}
++
++static void
++ath11k_nss_ext_vdev_data_receive(struct net_device *dev, struct sk_buff *skb,
++				 __attribute__((unused)) struct napi_struct *napi)
++{
++	struct wireless_dev *wdev;
++	struct ieee80211_vif *vif;
++	struct ath11k_vif *arvif;
++	struct ath11k_base *ab;
++	bool eth_decap = false;
++	int data_offs = 0;
++	int ret;
++
++	if (!dev) {
++		dev_kfree_skb_any(skb);
++		return;
++	}
++
++	wdev = dev->ieee80211_ptr;
++	if (!wdev) {
++		dev_kfree_skb_any(skb);
++		return;
++	}
++
++	vif = wdev_to_ieee80211_vif(wdev);
++	if (!vif) {
++		dev_kfree_skb_any(skb);
++		return;
++	}
++
++	arvif = (struct ath11k_vif *)vif->drv_priv;
++	if (!arvif) {
++		dev_kfree_skb_any(skb);
++		return;
++	}
++
++	ab = arvif->ar->ab;
++
++	skb->dev = dev;
++
++	/* log the original skb received from nss */
++	ath11k_dbg_dump(ab, ATH11K_DBG_DP_RX, "", "dp rx msdu from nss ext : ",
++			skb->data, skb->len);
++
++	ret = ath11k_nss_undecap(arvif, skb, &data_offs, &eth_decap);
++	if (ret) {
++		ath11k_warn(ab, "error in nss ext rx undecap, type %d err %d\n",
++			    arvif->nss.decap, ret);
++		dev_kfree_skb_any(skb);
++		return;
++	}
++
++	ath11k_nss_deliver_rx(arvif->vif, skb, eth_decap, data_offs, napi);
++}
++
+ int ath11k_nss_tx(struct ath11k_vif *arvif, struct sk_buff *skb)
+ {
+ 	struct ath11k *ar = arvif->ar;
+@@ -910,10 +983,16 @@ int ath11k_nss_tx(struct ath11k_vif *arv
+ 		ath11k_nss_tx_encap_nwifi(skb);
+ 
+ send:
+-	ath11k_dbg_dump(ar->ab, ATH11K_DBG_DP_TX, "", "nss tx msdu: ",
+-			skb->data, skb->len);
+-
+-	status = nss_wifi_vdev_tx_buf(arvif->ar->nss.ctx, skb, arvif->nss.if_num);
++	ath11k_dbg_dump(ar->ab, ATH11K_DBG_DP_TX,
++			arvif->vif->type == NL80211_IFTYPE_AP_VLAN ? "ext vdev" : "",
++			"nss tx msdu: ", skb->data, skb->len);
++
++	if (arvif->vif->type == NL80211_IFTYPE_AP_VLAN)
++		status = nss_wifi_ext_vdev_tx_buf(arvif->nss.ctx, skb,
++						  arvif->nss.if_num);
++	else
++		status = nss_wifi_vdev_tx_buf(arvif->ar->nss.ctx, skb,
++					      arvif->nss.if_num);
+ 
+ 	if (status != NSS_TX_SUCCESS) {
+ 		ath11k_dbg(ar->ab, (ATH11K_DBG_NSS | ATH11K_DBG_DP_TX),
+@@ -1254,6 +1333,7 @@ int ath11k_nss_vdev_up(struct ath11k_vif
+ 	struct nss_wifi_vdev_msg *vdev_msg = NULL;
+ 	struct nss_wifi_vdev_enable_msg *vdev_en;
+ 	struct ath11k *ar = arvif->ar;
++	struct ath11k_vif *ap_vlan_arvif, *tmp;
+ 	nss_tx_status_t status;
+ 	int ret = 0;
+ 
+@@ -1285,6 +1365,12 @@ int ath11k_nss_vdev_up(struct ath11k_vif
+ 	}
+ 
+ 	ath11k_dbg(ar->ab, ATH11K_DBG_NSS, "nss vdev up tx msg success\n");
++
++	if (arvif->vif->type == NL80211_IFTYPE_AP)
++		list_for_each_entry_safe(ap_vlan_arvif, tmp, &arvif->ap_vlan_arvifs,
++                                         list)
++			if (ap_vlan_arvif->nss.added)
++				ath11k_nss_ext_vdev_up(ap_vlan_arvif);
+ free:
+ 	kfree(vdev_msg);
+ 	return ret;
+@@ -1294,6 +1380,7 @@ int ath11k_nss_vdev_down(struct ath11k_v
+ {
+ 	struct nss_wifi_vdev_msg *vdev_msg = NULL;
+ 	struct ath11k *ar = arvif->ar;
++	struct ath11k_vif *ap_vlan_arvif, *tmp;
+ 	nss_tx_status_t status;
+ 	int ret = 0;
+ 
+@@ -1321,11 +1408,362 @@ int ath11k_nss_vdev_down(struct ath11k_v
+ 	}
+ 
+ 	ath11k_dbg(ar->ab, ATH11K_DBG_NSS, "nss vdev down tx msg success\n");
++
++	if (arvif->vif->type == NL80211_IFTYPE_AP)
++		list_for_each_entry_safe(ap_vlan_arvif, tmp, &arvif->ap_vlan_arvifs,
++                                         list)
++			ath11k_nss_ext_vdev_down(ap_vlan_arvif);
+ free:
+ 	kfree(vdev_msg);
+ 	return ret;
+ }
+ 
++int ath11k_nss_ext_vdev_cfg_wds_peer(struct ath11k_vif *arvif,
++				     u8 *wds_addr, u32 wds_peer_id)
++{
++	struct ath11k *ar = arvif->ar;
++	struct nss_wifi_ext_vdev_msg *ext_vdev_msg = NULL;
++	struct nss_wifi_ext_vdev_wds_msg *cfg_wds_msg = NULL;
++	nss_tx_status_t status;
++	int ret;
++
++	if (arvif->vif->type != NL80211_IFTYPE_AP_VLAN)
++		return -EINVAL;
++
++	ext_vdev_msg = kzalloc(sizeof(struct nss_wifi_ext_vdev_msg), GFP_ATOMIC);
++	if (!ext_vdev_msg)
++		return -ENOMEM;
++
++	cfg_wds_msg = &ext_vdev_msg->msg.wmsg;
++	cfg_wds_msg->wds_peer_id = wds_peer_id;
++	ether_addr_copy(cfg_wds_msg->mac_addr, wds_addr);
++
++	nss_wifi_ext_vdev_msg_init(ext_vdev_msg, arvif->nss.if_num,
++				   NSS_WIFI_EXT_VDEV_MSG_CONFIGURE_WDS,
++				   sizeof(struct nss_wifi_ext_vdev_wds_msg),
++				   NULL, arvif);
++
++	status = nss_wifi_ext_vdev_tx_msg_sync(arvif->nss.ctx, ext_vdev_msg);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ar->ab, "failed to configure wds peer nss_err:%d\n",
++			    status);
++		ret = -EINVAL;
++		goto free;
++	}
++
++	ret = 0;
++free:
++	kfree(ext_vdev_msg);
++
++	return ret;
++}
++
++int ath11k_nss_ext_vdev_wds_4addr_allow(struct ath11k_vif *arvif,
++					u32 wds_peer_id)
++{
++	struct ath11k *ar = arvif->ar;
++	struct nss_wifili_peer_wds_4addr_allow_msg *cfg_4addr_msg = NULL;
++	nss_wifili_msg_callback_t msg_cb;
++	struct nss_wifili_msg *wlmsg;
++	nss_tx_status_t status;
++
++	if (arvif->vif->type != NL80211_IFTYPE_AP_VLAN)
++		return -EINVAL;
++
++	wlmsg = kzalloc(sizeof(struct nss_wifili_msg), GFP_ATOMIC);
++	if (!wlmsg)
++		return -ENOMEM;
++
++	cfg_4addr_msg = &wlmsg->msg.wpswm;
++	cfg_4addr_msg->peer_id = wds_peer_id;
++	cfg_4addr_msg->if_num = arvif->nss.if_num;
++	cfg_4addr_msg->enable = true;
++
++	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++
++	nss_cmn_msg_init(&wlmsg->cm, ar->ab->nss.if_num,
++			 NSS_WIFILI_PEER_4ADDR_EVENT_MSG,
++			 sizeof(struct nss_wifili_peer_wds_4addr_allow_msg),
++			 msg_cb, NULL);
++
++	status = nss_wifili_tx_msg(ar->nss.ctx, wlmsg);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ar->ab, "nss wds 4addr allow if_num %d, peer_id %d cfg fail: %d\n",
++			    arvif->nss.if_num, wds_peer_id, status);
++		goto free;
++	}
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_NSS_WDS, "nss wds 4addr allow if_num %d, peer_id %d cfg complete\n",
++		   arvif->nss.if_num, wds_peer_id);
++free:
++	kfree(wlmsg);
++	return status;
++}
++
++int ath11k_nss_ext_vdev_configure(struct ath11k_vif *arvif)
++{
++	struct ath11k *ar = arvif->ar;
++	struct ath11k_vif *ap_vif = arvif->nss.ap_vif;
++	struct nss_wifi_ext_vdev_msg *ext_vdev_msg = NULL;
++	struct nss_wifi_ext_vdev_configure_if_msg *ext_vdev_cfg = NULL;
++	nss_tx_status_t status;
++	int ret;
++
++	if (arvif->vif->type != NL80211_IFTYPE_AP_VLAN)
++		return -EINVAL;
++
++	ext_vdev_msg = kzalloc(sizeof(struct nss_wifi_ext_vdev_msg), GFP_ATOMIC);
++	if (!ext_vdev_msg)
++		return -ENOMEM;
++
++	ext_vdev_cfg = &ext_vdev_msg->msg.cmsg;
++
++	ext_vdev_cfg->radio_ifnum = ar->nss.if_num;
++	ext_vdev_cfg->pvap_ifnum = ap_vif->nss.if_num;
++
++	ether_addr_copy(ext_vdev_cfg->mac_addr, arvif->vif->addr);
++
++	nss_wifi_ext_vdev_msg_init(ext_vdev_msg, arvif->nss.if_num,
++				   NSS_WIFI_EXT_VDEV_MSG_CONFIGURE_IF,
++				   sizeof(struct nss_wifi_ext_vdev_configure_if_msg),
++				   NULL, arvif);
++
++	status = nss_wifi_ext_vdev_tx_msg_sync(arvif->ar->nss.ctx, ext_vdev_msg);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ar->ab, "failed to configure nss ext vdev nss_err:%d\n",
++			    status);
++		ret = -EINVAL;
++		goto free;
++	}
++
++	ret = 0;
++free:
++	kfree(ext_vdev_msg);
++
++	return ret;
++}
++
++void ath11k_nss_ext_vdev_unregister(struct ath11k_vif *arvif)
++{
++	struct ath11k_base *ab = arvif->ar->ab;
++
++	if (arvif->vif->type != NL80211_IFTYPE_AP_VLAN)
++		return;
++
++	nss_wifi_ext_vdev_unregister_if(arvif->nss.if_num);
++	ath11k_dbg(ab, ATH11K_DBG_NSS_WDS, "unregistered nss vdev %d \n",
++		   arvif->nss.if_num);
++}
++
++static int ath11k_nss_ext_vdev_register(struct ath11k_vif *arvif,
++					struct net_device *netdev)
++{
++	struct ath11k *ar = arvif->ar;
++	struct ath11k_base *ab = ar->ab;
++	nss_tx_status_t status;
++	enum nss_dynamic_interface_type di_type;
++	u32 features = 0;
++
++	if (arvif->vif->type != NL80211_IFTYPE_AP_VLAN || arvif->nss.ctx)
++		return -EINVAL;
++
++	di_type = NSS_DYNAMIC_INTERFACE_TYPE_WIFI_EXT_VDEV_WDS;
++
++	arvif->nss.ctx = nss_wifi_ext_vdev_register_if(arvif->nss.if_num,
++						       ath11k_nss_ext_vdev_data_receive,
++						       ath11k_nss_ext_vdev_special_data_receive,
++						       NULL, netdev, features,
++						       arvif);
++
++	if (!arvif->nss.ctx) {
++		ath11k_warn(ab, "failed to register nss vdev if_num %d nss_err:%d\n",
++			    arvif->nss.if_num, status);
++		return -EINVAL;
++	}
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS_WDS, "registered nss ext vdev if_num %d\n",
++		   arvif->nss.if_num);
++	return 0;
++}
++
++static void ath11k_nss_ext_vdev_free(struct ath11k_vif *arvif)
++{
++	struct ath11k_base *ab = arvif->ar->ab;
++	nss_tx_status_t status;
++
++	if (arvif->vif->type != NL80211_IFTYPE_AP_VLAN)
++		return;
++
++	status = nss_dynamic_interface_dealloc_node(
++					arvif->nss.if_num,
++					NSS_DYNAMIC_INTERFACE_TYPE_WIFI_EXT_VDEV_WDS);
++	if (status != NSS_TX_SUCCESS)
++		ath11k_warn(ab, "failed to free nss ext vdev err:%d\n",
++			    status);
++	else
++		ath11k_dbg(ab, ATH11K_DBG_NSS_WDS,
++			   "nss ext vdev interface deallocated\n");
++}
++
++static int ath11k_nss_ext_vdev_alloc(struct ath11k_vif *arvif)
++{
++	struct ath11k_base *ab = arvif->ar->ab;
++	enum nss_dynamic_interface_type di_type;
++	int if_num;
++
++	di_type = NSS_DYNAMIC_INTERFACE_TYPE_WIFI_EXT_VDEV_WDS;
++
++	if_num = nss_dynamic_interface_alloc_node(di_type);
++	if (if_num < 0) {
++		ath11k_warn(ab, "failed to allocate nss ext vdev\n");
++		return -EINVAL;
++	}
++
++	arvif->nss.if_num = if_num;
++	ath11k_dbg(ab, ATH11K_DBG_NSS_WDS,
++		   "nss ext vdev interface %pM allocated if_num %d\n",
++		   arvif->vif->addr, if_num);
++
++	return 0;
++}
++
++int ath11k_nss_ext_vdev_create(struct ath11k_vif *arvif)
++{
++	struct ath11k *ar = arvif->ar;
++	struct ath11k_base *ab = ar->ab;
++	struct wireless_dev *wdev;
++	int ret;
++
++	if (!ab->nss.enabled)
++		return 0;
++
++	if (arvif->nss.created)
++		return 0;
++
++	wdev = ieee80211_vif_to_wdev_relaxed(arvif->vif);
++	if (!wdev) {
++		ath11k_warn(ab, "ath11k_nss: ext wdev is null\n");
++		return -EINVAL;
++	}
++
++	if (!wdev->netdev) {
++		ath11k_warn(ab, "ath11k_nss: ext netdev is null\n");
++		return -EINVAL;
++	}
++
++	ret = ath11k_nss_ext_vdev_alloc(arvif);
++	if (ret)
++		return ret;
++
++	ret = ath11k_nss_ext_vdev_register(arvif, wdev->netdev);
++	if (ret)
++		goto free_ext_vdev;
++
++	arvif->nss.created = true;
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS_WDS,
++		   "nss ext vdev interface created ctx %pK, ifnum %d\n",
++		   arvif->nss.ctx, arvif->nss.if_num);
++
++	return ret;
++
++free_ext_vdev:
++	ath11k_nss_ext_vdev_free(arvif);
++
++	return ret;
++}
++
++void ath11k_nss_ext_vdev_delete(struct ath11k_vif *arvif)
++{
++	if (!arvif->ar->ab->nss.enabled)
++		return;
++
++	if (!arvif->nss.created)
++		return;
++
++	ath11k_dbg(arvif->ar->ab, ATH11K_DBG_NSS_WDS,
++		   "nss ext vdev interface delete ctx %pK, ifnum %d\n",
++		   arvif->nss.ctx, arvif->nss.if_num);
++
++	ath11k_nss_ext_vdev_unregister(arvif);
++
++	ath11k_nss_ext_vdev_free(arvif);
++
++	arvif->nss.created = false;
++}
++
++int ath11k_nss_ext_vdev_up(struct ath11k_vif *arvif)
++{
++	struct nss_wifi_ext_vdev_msg *ext_vdev_msg = NULL;
++	struct ath11k *ar = arvif->ar;
++	nss_tx_status_t status;
++	int ret = 0;
++
++	if (!ar->ab->nss.enabled)
++		return 0;
++
++	if (arvif->vif->type != NL80211_IFTYPE_AP_VLAN)
++		return -EINVAL;
++
++	if (arvif->nss.ext_vdev_up)
++		return 0;
++
++	ext_vdev_msg = kzalloc(sizeof(struct nss_wifi_vdev_msg), GFP_ATOMIC);
++	if (!ext_vdev_msg)
++		return -ENOMEM;
++
++	nss_wifi_ext_vdev_msg_init(ext_vdev_msg, arvif->nss.if_num, NSS_IF_OPEN,
++			           sizeof(struct nss_if_open), NULL, arvif);
++
++	status = nss_wifi_ext_vdev_tx_msg_sync(arvif->nss.ctx, ext_vdev_msg);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ar->ab, "nss ext vdev up tx msg error %d\n", status);
++		ret = -EINVAL;
++		goto free;
++	}
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_NSS_WDS, "nss ext vdev up tx msg success\n");
++	arvif->nss.ext_vdev_up = true;
++free:
++	kfree(ext_vdev_msg);
++	return ret;
++}
++
++int ath11k_nss_ext_vdev_down(struct ath11k_vif *arvif)
++{
++	struct nss_wifi_ext_vdev_msg *ext_vdev_msg = NULL;
++	struct ath11k *ar = arvif->ar;
++	nss_tx_status_t status;
++	int ret = 0;
++
++	if (!ar->ab->nss.enabled)
++		return 0;
++
++	if (arvif->vif->type != NL80211_IFTYPE_AP_VLAN)
++		return -EINVAL;
++
++	ext_vdev_msg = kzalloc(sizeof(struct nss_wifi_ext_vdev_msg), GFP_ATOMIC);
++	if (!ext_vdev_msg)
++		return -ENOMEM;
++
++	nss_wifi_ext_vdev_msg_init(ext_vdev_msg, arvif->nss.if_num, NSS_IF_CLOSE,
++			           sizeof(struct nss_if_close), NULL, arvif);
++
++	status = nss_wifi_ext_vdev_tx_msg_sync(arvif->nss.ctx, ext_vdev_msg);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ar->ab, "nss ext vdev down tx msg error %d\n", status);
++		ret = -EINVAL;
++		goto free;
++	}
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_NSS_WDS, "nss ext vdev down tx msg success\n");
++
++	arvif->nss.ext_vdev_up = false;
++free:
++	kfree(ext_vdev_msg);
++	return ret;
++}
++
+ /*----------------------------Peer Setup/Config -----------------------------*/
+ 
+ int ath11k_nss_set_peer_sec_type(struct ath11k *ar,
+@@ -1419,22 +1857,22 @@ free:
+ 	return status;
+ }
+ 
+-void ath11k_nss_update_sta_stats(struct station_info *sinfo,
+-				 struct ieee80211_sta *sta,
+-				 struct ath11k_sta *arsta)
++void ath11k_nss_update_sta_stats(struct ath11k_vif *arvif,
++				 struct station_info *sinfo,
++				 struct ieee80211_sta *sta)
+ {
+ 	struct sta_info *stainfo;
+ 	struct ath11k_peer *peer;
+-	struct ath11k *ar = arsta->arvif->ar;
++	struct ath11k *ar = arvif->ar;
+ 	struct ath11k_base *ab = ar->ab;
+ 
+-	if (!ab->nss.enabled)
++	if (!ab->nss.stats_enabled)
+ 		return;
+ 
+ 	spin_lock_bh(&ab->base_lock);
+-	peer = ath11k_peer_find_by_addr(arsta->arvif->ar->ab, sta->addr);
++	peer = ath11k_peer_find_by_addr(ab, sta->addr);
+ 	if (!peer) {
+-		ath11k_dbg(ab, ATH11K_DBG_NSS, "unable to find peer %pM\n",
++		ath11k_dbg(ab, ATH11K_DBG_NSS, "sta stats: unable to find peer %pM\n",
+ 					sta->addr);
+ 		goto exit;
+ 	}
+@@ -1506,13 +1944,13 @@ void ath11k_nss_update_sta_rxrate(struct
+ 				  struct ath11k_peer *peer,
+ 				  struct hal_rx_user_status *user_stats)
+ {
+-	struct ath11k_sta *arsta = (struct ath11k_sta *)peer->sta->drv_priv;
+ 	u16 ath11k_hal_rx_legacy_rates[] =
+ 	{ 10, 20, 55, 60, 90, 110, 120, 180, 240, 360, 480, 540 };
+ 	u16 rate = 0;
+ 	u32 preamble_type;
+ 	u8 mcs, nss;
+-	struct ath11k *ar = arsta->arvif->ar;
++	struct ath11k_vif *arvif = ath11k_vif_to_arvif(peer->vif);
++	struct ath11k *ar = arvif->ar;
+ 	struct ath11k_base *ab = ar->ab;
+ 
+ 	if (!ab->nss.enabled)
+@@ -1816,8 +2254,8 @@ int ath11k_nss_add_wds_peer(struct ath11
+ 	}
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_NSS_WDS,
+-		   "nss add wds peer success peer mac:%pM dest mac:%pM peer_id:%d\n",
+-		   wds_peer_msg->peer_mac, wds_peer_msg->dest_mac, wds_peer_msg->peer_id);
++		   "nss add wds peer success pdev:%d peer mac:%pM dest mac:%pM peer_id:%d\n",
++		   wds_peer_msg->pdev_id, wds_peer_msg->peer_mac, wds_peer_msg->dest_mac, wds_peer_msg->peer_id);
+ 
+ msg_free:
+ 	kfree(wlmsg);
+@@ -1862,8 +2300,8 @@ int ath11k_nss_update_wds_peer(struct at
+ 	}
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_NSS_WDS,
+-		   "nss update wds peer success peer mac:%pM dest mac:%pM peer_id:%d\n",
+-		   wds_peer_msg->peer_mac, wds_peer_msg->dest_mac, wds_peer_msg->peer_id);
++		   "nss update wds peer success pdev:%d peer mac:%pM dest mac:%pM peer_id:%d\n",
++		   wds_peer_msg->pdev_id, wds_peer_msg->peer_mac, wds_peer_msg->dest_mac, wds_peer_msg->peer_id);
+ 
+ msg_free:
+ 	kfree(wlmsg);
+--- a/drivers/net/wireless/ath/ath11k/nss.h
++++ b/drivers/net/wireless/ath/ath11k/nss.h
+@@ -154,6 +154,7 @@ enum ath11k_nss_peer_sec_type {
+ struct ath11k_nss_peer {
+ 	uint32_t *vaddr;
+ 	dma_addr_t paddr;
++	bool ext_vdev_up;
+ 	struct peer_stats *nss_stats;
+ 	struct completion complete;
+ };
+@@ -168,6 +169,16 @@ struct arvif_nss {
+ 	int encap;
+ 	/* Keep the copy of decap type for nss */
+ 	int decap;
++	/* AP_VLAN vif context obtained on ext vdev register */
++	void* ctx;
++	/* Parent AP vif stored in case of AP_VLAN vif */
++	struct ath11k_vif *ap_vif;
++	/* Flag to notify if vlan arvif object is added to arvif list*/
++	bool added;
++	/* Flag to notify if ext vdev is up/down */
++	bool ext_vdev_up;
++	/* WDS cfg should be done only once for ext vdev */
++	bool wds_cfg_done;
+ 	bool created;
+ };
+ 
+@@ -223,11 +234,21 @@ int ath11k_nss_map_wds_peer(struct ath11
+ 			    u8 *dest_mac, enum ath11k_ast_entry_type type);
+ int ath11k_nss_del_wds_peer(struct ath11k *ar, struct ath11k_peer *peer,
+ 			    u8 *dest_mac);
++int ath11k_nss_ext_vdev_cfg_wds_peer(struct ath11k_vif *arvif,
++				     u8 *wds_addr, u32 wds_peer_id);
++int ath11k_nss_ext_vdev_wds_4addr_allow(struct ath11k_vif *arvif,
++					u32 wds_peer_id);
++int ath11k_nss_ext_vdev_create(struct ath11k_vif *arvif);
++int ath11k_nss_ext_vdev_configure(struct ath11k_vif *arvif);
++void ath11k_nss_ext_vdev_unregister(struct ath11k_vif *arvif);
++int ath11k_nss_ext_vdev_up(struct ath11k_vif *arvif);
++int ath11k_nss_ext_vdev_down(struct ath11k_vif *arvif);
++void ath11k_nss_ext_vdev_delete(struct ath11k_vif *arvif);
+ int ath11k_nss_set_peer_sec_type(struct ath11k *ar, struct ath11k_peer *peer,
+ 				 struct ieee80211_key_conf *key_conf);
+-void ath11k_nss_update_sta_stats(struct station_info *sinfo,
+-				 struct ieee80211_sta *sta,
+-				 struct ath11k_sta *arsta);
++void ath11k_nss_update_sta_stats(struct ath11k_vif *arvif,
++				 struct station_info *sinfo,
++				 struct ieee80211_sta *sta);
+ void ath11k_nss_update_sta_rxrate(struct hal_rx_mon_ppdu_info *ppdu_info,
+ 				  struct ath11k_peer *peer,
+ 				  struct hal_rx_user_status *user_stats);
+@@ -260,9 +281,9 @@ static inline void ath11k_nss_vdev_delet
+ {
+ }
+ 
+-static inline void ath11k_nss_update_sta_stats(struct station_info *sinfo,
+-					       struct ieee80211_sta *sta,
+-					       struct ath11k_sta *arsta)
++static inline void ath11k_nss_update_sta_stats(struct ath11k_vif *arvif,
++					       struct station_info *sinfo,
++					       struct ieee80211_sta *sta)
+ {
+ 	return;
+ }
+@@ -319,6 +340,43 @@ static inline int ath11k_nss_peer_create
+ 	return 0;
+ }
+ 
++static inline int ath11k_nss_ext_vdev_cfg_wds_peer(struct ath11k_vif *arvif,
++				     u8 *wds_addr, u32 wds_peer_id)
++{
++	return 0;
++}
++
++static inline int ath11k_nss_ext_vdev_wds_4addr_allow(struct ath11k_vif *arvif,
++					u32 wds_peer_id)
++{
++	return 0;
++}
++
++static inline int ath11k_nss_ext_vdev_create(struct ath11k_vif *arvif)
++{
++	return 0;
++}
++
++static inline int ath11k_nss_ext_vdev_configure(struct ath11k_vif *arvif)
++{
++	return 0;
++}
++
++static inline void ath11k_nss_ext_vdev_unregister(struct ath11k_vif *arvif)
++{
++	return;
++}
++
++static inline int ath11k_nss_ext_vdev_up(struct ath11k_vif *arvif)
++{
++	return 0;
++}
++
++static inline int ath11k_nss_ext_vdev_down(struct ath11k_vif *arvif)
++{
++	return 0;
++}
++
+ static inline void ath11k_nss_peer_stats_enable(struct ath11k *ar)
+ {
+ 	return;
+@@ -340,6 +398,11 @@ static inline int ath11k_nss_setup(struc
+ 	return 0;
+ }
+ 
++static inline void ath11k_nss_ext_vdev_delete(struct ath11k_vif *arvif)
++{
++	return;
++}
++
+ static inline int ath11k_nss_teardown(struct ath11k_base *ab)
+ {
+ 	return 0;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/903-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch b/package/kernel/mac80211/patches/ath11k_nss/903-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
new file mode 100644
index 00000000000000..86714fea844e81
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/903-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
@@ -0,0 +1,575 @@
+From 730f568af3fac2f31467ea0ff374ea442ddc379f Mon Sep 17 00:00:00 2001
+From: Sathishkumar Muruganandam <murugana@codeaurora.org>
+Date: Fri, 20 Nov 2020 11:57:36 +0530
+Subject: [PATCH 3/3] ath11k: add AP_VLAN vif support for WDS offload in NSS
+ offload
+
+- AP_VLAN vif support is required for WDS offload to interop with mac80211
+  based 4addr STA and also for multicast-to-unicast conversion of 3addr
+  multicast to 4addr frames for each associated 4addr STA.
+
+- For each associated 4addr STA, corresponding AP_VLAN vif having same MAC
+  address as AP vif is created from hostapd upon 4addr rx_notify from NSS RX.
+
+- AP_VLAN vif support is added to add/remove interface mac80211 callbacks only
+  for NSS ext vdev handling and vdev_id, FW vdev operations are not needed.
+
+- mac80211 advertises AP_VLAN vif for sta_use_4addr drv callback in case of
+  NSS offload. Extending ath11k_mac_op_sta_use_4addr to invoke ext vdev NSS
+  APIs required for AP WDS handling.
+
+- Maintain AP_VLAN vif(s) list on corresponding AP vif and vice versa required
+  for ext vdev operations (VDEV_DOWN, DELETE, CONFIGURE_IF).
+
+- NSS require ENABLE_NAWDS and WDS_BACKHAUL to be configured for AP_VLAN
+  support via ext vdev.
+
+Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/core.h |   1 +
+ drivers/net/wireless/ath/ath11k/mac.c  | 156 +++++++++++++++++++++++++++++++--
+ drivers/net/wireless/ath/ath11k/wmi.h  |   2 +
+ 3 files changed, 154 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -385,9 +385,8 @@ struct ath11k_vif {
+ #endif /* CPTCFG_ATH11K_DEBUGFS */
+ 
+ 	struct ath11k_mgmt_frame_stats mgmt_stats;
+-#ifdef CPTCFG_ATH11K_NSS_SUPPORT
+ 	struct arvif_nss nss;
+-#endif
++	struct list_head ap_vlan_arvifs;
+ };
+ 
+ struct ath11k_vif_iter {
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -4739,6 +4739,11 @@ static void ath11k_sta_rc_update_wk(stru
+ 	arvif = arsta->arvif;
+ 	ar = arvif->ar;
+ 
++	if (ar->ab->nss.enabled &&
++	    arsta->arvif->vif->type == NL80211_IFTYPE_AP_VLAN &&
++	    arsta->use_4addr_set)
++		arvif = arvif->nss.ap_vif;
++
+ 	if (WARN_ON(ath11k_mac_vif_chan(arvif->vif, &def)))
+ 		return;
+ 
+@@ -4910,17 +4915,28 @@ err_rc_bw_changed:
+ static void ath11k_sta_set_4addr_wk(struct work_struct *wk)
+ {
+ 	struct ath11k *ar;
+-	struct ath11k_vif *arvif;
++	struct ath11k_vif *arvif, *ap_vlan_arvif = NULL;
++	struct ieee80211_vif *vif;
+ 	struct ath11k_sta *arsta;
+ 	struct ieee80211_sta *sta;
++	struct ath11k_base *ab;
++	struct ath11k_peer *wds_peer;
++	u8 wds_addr[ETH_ALEN];
++	u32 wds_peer_id;
+ 	int ret = 0;
+ 
+ 	arsta = container_of(wk, struct ath11k_sta, set_4addr_wk);
+ 	sta = container_of((void *)arsta, struct ieee80211_sta, drv_priv);
+ 	arvif = arsta->arvif;
+ 	ar = arvif->ar;
++	ab = ar->ab;
+ 
+-	ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
++	if (ab->nss.enabled && arvif->vif->type == NL80211_IFTYPE_AP_VLAN) {
++		ap_vlan_arvif = arsta->arvif;
++		arvif = ap_vlan_arvif->nss.ap_vif;
++	}
++
++	ath11k_dbg(ab, ATH11K_DBG_MAC,
+ 		   "setting USE_4ADDR for peer %pM\n", sta->addr);
+ 
+ 	ret = ath11k_wmi_set_peer_param(ar, sta->addr,
+@@ -4928,8 +4944,93 @@ static void ath11k_sta_set_4addr_wk(stru
+ 					WMI_PEER_USE_4ADDR, 1);
+ 
+ 	if (ret)
+-		ath11k_warn(ar->ab, "failed to set peer %pM 4addr capability: %d\n",
++		ath11k_warn(ab, "failed to set 4addr for STA %pM: %d\n",
+ 			    sta->addr, ret);
++
++	if (!ab->nss.enabled || !ap_vlan_arvif)
++		return;
++
++	vif = ap_vlan_arvif->vif;
++
++	spin_lock_bh(&ab->base_lock);
++	wds_peer = ath11k_peer_find_by_addr(ab, sta->addr);
++	if (!wds_peer) {
++		spin_unlock_bh(&ab->base_lock);
++		ath11k_warn(ab, "mac sta use 4addr failed to find peer %pM\n",
++			    sta->addr);
++		return;
++	}
++
++	wds_peer_id = wds_peer->peer_id;
++	ether_addr_copy(wds_addr, wds_peer->addr);
++	spin_unlock_bh(&ab->base_lock);
++
++	/* skip NSS ext vdev registration if already done */
++	if (ap_vlan_arvif->nss.wds_cfg_done)
++		goto skip_nss_ext;
++
++	ret = ath11k_nss_ext_vdev_configure(ap_vlan_arvif);
++	if (ret) {
++		ath11k_warn(ab, "failed to nss cfg ext vdev %pM: %d\n",
++			    vif->addr, ret);
++		goto ext_vdev_delete;
++	}
++
++	ap_vlan_arvif->nss.wds_cfg_done = true;
++
++skip_nss_ext:
++
++	ret = ath11k_nss_ext_vdev_cfg_wds_peer(ap_vlan_arvif,
++					       wds_addr, wds_peer_id);
++	if (ret) {
++		ath11k_warn(ab, "failed to nss cfg_wds_peer %pM on %pM: %d\n",
++			    sta->addr, vif->addr, ret);
++		goto ext_vdev_delete;
++	}
++
++	ret = ath11k_nss_ext_vdev_wds_4addr_allow(ap_vlan_arvif,
++						  wds_peer_id);
++	if (ret) {
++		ath11k_warn(ab, "failed to nss 4addr allow %pM: %d\n",
++			    vif->addr, ret);
++		goto ext_vdev_delete;
++	}
++
++	ret = ath11k_nss_ext_vdev_up(ap_vlan_arvif);
++	if (ret) {
++		ath11k_warn(ab, "failed to nss ext vdev up %pM: %d\n",
++			    vif->addr, ret);
++		goto ext_vdev_delete;
++	}
++
++	spin_lock_bh(&ab->base_lock);
++	wds_peer->nss.ext_vdev_up = true;
++	wds_peer->nss.ext_vif = vif;
++	spin_unlock_bh(&ab->base_lock);
++
++	/* NAWDS and CFG_WDS_BACKHAUL configs should be done on corresponding
++	 * AP vif of the AP_VLAN vif
++	 */
++	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id,
++					    WMI_VDEV_PARAM_AP_ENABLE_NAWDS,
++					    MIN_IDLE_INACTIVE_TIME_SECS);
++	if (ret) {
++		ath11k_warn(ab, "failed to set vdev %i nawds parameters: %d\n",
++			    arvif->vdev_id, ret);
++		goto ext_vdev_down;
++	}
++
++	return;
++
++ext_vdev_down:
++	ath11k_nss_ext_vdev_down(ap_vlan_arvif);
++ext_vdev_delete:
++	ath11k_nss_ext_vdev_delete(ap_vlan_arvif);
++
++	spin_lock_bh(&ar->data_lock);
++	list_del(&ap_vlan_arvif->list);
++	spin_unlock_bh(&ar->data_lock);
++	ap_vlan_arvif->nss.added = false;
+ }
+ 
+ static int ath11k_mac_inc_num_stations(struct ath11k_vif *arvif,
+@@ -5278,9 +5379,32 @@ static void ath11k_mac_op_sta_set_4addr(
+ 					struct ieee80211_sta *sta, bool enabled)
+ {
+ 	struct ath11k *ar = hw->priv;
++	struct ath11k_vif *arvif = (void *)vif->drv_priv;
+ 	struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);
++	struct ath11k_vif *ap_arvif = NULL;
+ 
+ 	if (enabled && !arsta->use_4addr_set) {
++		if (ar->ab->nss.enabled && vif->type == NL80211_IFTYPE_AP_VLAN) {
++			/* 4addr STA is initially associated to AP vif, change
++			 * it to AP_VLAN vif and add AP_VLAN vif to AP vifs list
++			 */
++			ap_arvif = arsta->arvif;
++			arvif->nss.ap_vif = ap_arvif;
++
++			/* Check if the vlan arvif object was already present in the
++			 * list. We can receive this path multiple times for the same
++			 * vlan vif for different sta objects
++			 */
++			if (!arvif->nss.added) {
++				spin_lock_bh(&ar->data_lock);
++				list_add(&arvif->list, &ap_arvif->ap_vlan_arvifs);
++				spin_unlock_bh(&ar->data_lock);
++				arvif->nss.added = true;
++			}
++
++			arsta->arvif = arvif;
++		}
++
+ 		ieee80211_queue_work(ar->hw, &arsta->set_4addr_wk);
+ 		arsta->use_4addr_set = true;
+ 	}
+@@ -6673,6 +6797,9 @@ static int ath11k_mac_op_update_vif_offl
+ 	u32 param_id, param_value;
+ 	int ret;
+ 
++	if (ab->nss.enabled && vif->type == NL80211_IFTYPE_AP_VLAN)
++		return 0;
++
+ 	param_id = WMI_VDEV_PARAM_TX_ENCAP_TYPE;
+ 	if (ath11k_frame_mode != ATH11K_HW_TXRX_ETHERNET ||
+ 	    (vif->type != NL80211_IFTYPE_STATION &&
+@@ -6893,7 +7020,8 @@ static int ath11k_mac_op_add_interface(s
+ 		goto err;
+ 	}
+ 
+-	if (ar->num_created_vdevs > (TARGET_NUM_VDEVS(ab) - 1)) {
++	if (vif->type != NL80211_IFTYPE_AP_VLAN  &&
++	    ar->num_created_vdevs > (TARGET_NUM_VDEVS(ab) - 1)) {
+ 		ath11k_warn(ab, "failed to create vdev %u, reached max vdev limit %d\n",
+ 			    ar->num_created_vdevs, TARGET_NUM_VDEVS(ab));
+ 		ret = -EBUSY;
+@@ -6913,6 +7041,28 @@ static int ath11k_mac_op_add_interface(s
+ 	arvif->vif = vif;
+ 
+ 	INIT_LIST_HEAD(&arvif->list);
++
++	if ((vif->type == NL80211_IFTYPE_AP_VLAN ||
++	     vif->type == NL80211_IFTYPE_STATION) && ab->nss.enabled) {
++		if (ath11k_frame_mode == ATH11K_HW_TXRX_ETHERNET &&
++		    ieee80211_set_hw_80211_encap(vif, true)) {
++			vif->offload_flags |= IEEE80211_OFFLOAD_ENCAP_4ADDR;
++			arvif->nss.encap = ATH11K_HW_TXRX_ETHERNET;
++			arvif->nss.decap = ATH11K_HW_TXRX_ETHERNET;
++		}
++
++		if (vif->type == NL80211_IFTYPE_AP_VLAN) {
++			ret = ath11k_nss_ext_vdev_create(arvif);
++			if (ret) {
++				ath11k_warn(ab, "failed to create ext vdev %pM: %d\n",
++					    vif->addr, ret);
++				goto err;
++			}
++			mutex_unlock(&ar->conf_mutex);
++			return ret;
++		}
++	}
++
+ 	INIT_DELAYED_WORK(&arvif->connection_loss_work,
+ 			  ath11k_mac_vif_sta_connection_loss_work);
+ 
+@@ -6942,6 +7092,7 @@ static int ath11k_mac_op_add_interface(s
+ 		fallthrough;
+ 	case NL80211_IFTYPE_AP:
+ 		arvif->vdev_type = WMI_VDEV_TYPE_AP;
++		INIT_LIST_HEAD(&arvif->ap_vlan_arvifs);
+ 		break;
+ 	case NL80211_IFTYPE_MONITOR:
+ 		arvif->vdev_type = WMI_VDEV_TYPE_MONITOR;
+@@ -7164,13 +7315,30 @@ static void ath11k_mac_op_remove_interfa
+ 	struct ath11k *ar = hw->priv;
+ 	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
+ 	struct ath11k_base *ab = ar->ab;
++	struct ath11k_vif *ap_vlan_arvif, *tmp;
+ 	int ret;
+ 	int i;
+ 
+-	cancel_delayed_work_sync(&arvif->connection_loss_work);
+-
+ 	mutex_lock(&ar->conf_mutex);
+ 
++	if (vif->type == NL80211_IFTYPE_AP_VLAN) {
++		ath11k_nss_ext_vdev_delete(arvif);
++
++		/* In case the vlan vif never got added into the ap vlan arvifs
++		 * list, avoid removal here
++		 */
++		if (!arvif->nss.added)
++			goto unlock;
++
++		spin_lock_bh(&ar->data_lock);
++		list_del(&arvif->list);
++		spin_unlock_bh(&ar->data_lock);
++
++		goto unlock;
++	}
++
++	cancel_delayed_work_sync(&arvif->connection_loss_work);
++
+ 	ath11k_dbg(ab, ATH11K_DBG_MAC, "remove interface (vdev %d)\n",
+ 		   arvif->vdev_id);
+ 
+@@ -7187,6 +7355,14 @@ static void ath11k_mac_op_remove_interfa
+ 		if (ret)
+ 			ath11k_warn(ab, "failed to submit AP self-peer removal on vdev %d: %d\n",
+ 				    arvif->vdev_id, ret);
++
++		list_for_each_entry_safe(ap_vlan_arvif, tmp, &arvif->ap_vlan_arvifs,
++					 list) {
++			ath11k_nss_ext_vdev_delete(ap_vlan_arvif);
++			spin_lock_bh(&ar->data_lock);
++			list_del(&ap_vlan_arvif->list);
++			spin_unlock_bh(&ar->data_lock);
++		}
+ 	}
+ 
+ 	ret = ath11k_mac_vdev_delete(ar, arvif);
+@@ -7230,8 +7406,7 @@ err_vdev_del:
+ 
+ 	ath11k_debugfs_remove_interface(arvif);
+ 
+-	/* TODO: recal traffic pause state based on the available vdevs */
+-
++unlock:
+ 	mutex_unlock(&ar->conf_mutex);
+ }
+ 
+@@ -7291,16 +7466,17 @@ static int ath11k_mac_op_ampdu_action(st
+ 				      struct ieee80211_ampdu_params *params)
+ {
+ 	struct ath11k *ar = hw->priv;
++	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
+ 	int ret = -EINVAL;
+ 
+ 	mutex_lock(&ar->conf_mutex);
+ 
+ 	switch (params->action) {
+ 	case IEEE80211_AMPDU_RX_START:
+-		ret = ath11k_dp_rx_ampdu_start(ar, params);
++		ret = ath11k_dp_rx_ampdu_start(arvif, params);
+ 		break;
+ 	case IEEE80211_AMPDU_RX_STOP:
+-		ret = ath11k_dp_rx_ampdu_stop(ar, params);
++		ret = ath11k_dp_rx_ampdu_stop(arvif, params);
+ 		break;
+ 	case IEEE80211_AMPDU_TX_START:
+ 	case IEEE80211_AMPDU_TX_STOP_CONT:
+@@ -8823,6 +8999,7 @@ static void ath11k_mac_op_sta_statistics
+ {
+ 	struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);
+ 	struct ath11k *ar = arsta->arvif->ar;
++	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
+ 	s8 signal;
+ 	bool db2dbm = test_bit(WMI_TLV_SERVICE_HW_DB2DBM_CONVERSION_SUPPORT,
+ 			       ar->ab->wmi_ab.svc_map);
+@@ -8879,7 +9056,8 @@ static void ath11k_mac_op_sta_statistics
+ 		ATH11K_DEFAULT_NOISE_FLOOR;
+ 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
+ 
+-	ath11k_nss_update_sta_stats(sinfo, sta, arsta);
++	if (arvif->ar->ab->nss.enabled)
++		ath11k_nss_update_sta_stats(arvif, sinfo, sta);
+ }
+ 
+ #if IS_ENABLED(CONFIG_IPV6)
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -5069,6 +5069,8 @@ enum wmi_vdev_subtype {
+ 	WMI_VDEV_SUBTYPE_MESH_11S,
+ };
+ 
++#define MIN_IDLE_INACTIVE_TIME_SECS 256
++
+ enum wmi_sta_powersave_param {
+ 	WMI_STA_PS_PARAM_RX_WAKE_POLICY = 0,
+ 	WMI_STA_PS_PARAM_TX_WAKE_THRESHOLD = 1,
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -1162,12 +1162,13 @@ err_mem_free:
+ 	return ret;
+ }
+ 
+-int ath11k_dp_rx_ampdu_start(struct ath11k *ar,
++int ath11k_dp_rx_ampdu_start(struct ath11k_vif *arvif,
+ 			     struct ieee80211_ampdu_params *params)
+ {
++	struct ath11k *ar = arvif->ar;
+ 	struct ath11k_base *ab = ar->ab;
+ 	struct ath11k_sta *arsta = ath11k_sta_to_arsta(params->sta);
+-	int vdev_id = arsta->arvif->vdev_id;
++	int vdev_id = arvif->vdev_id;
+ 	int ret;
+ 
+ 	ret = ath11k_peer_rx_tid_setup(ar, params->sta->addr, vdev_id,
+@@ -1179,13 +1180,13 @@ int ath11k_dp_rx_ampdu_start(struct ath1
+ 	return ret;
+ }
+ 
+-int ath11k_dp_rx_ampdu_stop(struct ath11k *ar,
++int ath11k_dp_rx_ampdu_stop(struct ath11k_vif *arvif,
+ 			    struct ieee80211_ampdu_params *params)
+ {
++	struct ath11k *ar = arvif->ar;
+ 	struct ath11k_base *ab = ar->ab;
+ 	struct ath11k_peer *peer;
+-	struct ath11k_sta *arsta = ath11k_sta_to_arsta(params->sta);
+-	int vdev_id = arsta->arvif->vdev_id;
++	int vdev_id = arvif->vdev_id;
+ 	dma_addr_t paddr;
+ 	bool active;
+ 	int ret;
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.h
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.h
+@@ -69,9 +69,9 @@ struct ath11k_dp_rfc1042_hdr {
+ 	__be16 snap_type;
+ } __packed;
+ 
+-int ath11k_dp_rx_ampdu_start(struct ath11k *ar,
++int ath11k_dp_rx_ampdu_start(struct ath11k_vif *arvif,
+ 			     struct ieee80211_ampdu_params *params);
+-int ath11k_dp_rx_ampdu_stop(struct ath11k *ar,
++int ath11k_dp_rx_ampdu_stop(struct ath11k_vif *arvif,
+ 			    struct ieee80211_ampdu_params *params);
+ int ath11k_dp_peer_rx_pn_replay_config(struct ath11k_vif *arvif,
+ 				       const u8 *peer_addr,
+--- a/drivers/net/wireless/ath/ath11k/peer.c
++++ b/drivers/net/wireless/ath/ath11k/peer.c
+@@ -126,6 +126,24 @@ struct ath11k_ast_entry *ath11k_peer_ast
+ 	return NULL;
+ }
+ 
++struct ath11k_ast_entry *ath11k_peer_ast_find_by_pdev_idx(struct ath11k *ar,
++							  u8* addr)
++{
++	struct ath11k_base *ab = ar->ab;
++	struct ath11k_ast_entry *ast_entry;
++	struct ath11k_peer *peer;
++
++	lockdep_assert_held(&ab->base_lock);
++
++	list_for_each_entry(peer, &ab->peers, list)
++		list_for_each_entry(ast_entry, &peer->ast_entry_list, ase_list)
++			if (ether_addr_equal(ast_entry->addr, addr) &&
++			    ast_entry->pdev_idx == ar->pdev_idx)
++				return ast_entry;
++
++	return NULL;
++}
++
+ void ath11k_peer_ast_wds_wmi_wk(struct work_struct *wk)
+ {
+ 	struct ath11k_ast_entry *ast_entry = container_of(wk,
+@@ -186,8 +204,8 @@ int ath11k_peer_add_ast(struct ath11k *a
+ 	}
+ 
+ 	if (type != ATH11K_AST_TYPE_STATIC) {
+-		ast_entry = ath11k_peer_ast_find_by_addr(ab, mac_addr);
+-		if (ast_entry) {
++		ast_entry = ath11k_peer_ast_find_by_pdev_idx(ar, mac_addr);
++		if (ast_entry && ast_entry->type != ATH11K_AST_TYPE_STATIC) {
+ 			ath11k_dbg(ab, ATH11K_DBG_MAC, "ast_entry %pM already present on peer %pM\n",
+ 				   mac_addr, ast_entry->peer->addr);
+ 			return 0;
+@@ -284,7 +302,6 @@ int ath11k_peer_update_ast(struct ath11k
+ 	ath11k_dbg(ab, ATH11K_DBG_MAC, "ath11k_peer_update_ast old peer %pM new peer %pM ast_entry %pM\n",
+ 		   old_peer->addr, peer->addr, ast_entry->addr);
+ 
+-	flush_work(&ast_entry->wds_wmi_wk);
+ 	ast_entry->action = ATH11K_WDS_WMI_UPDATE;
+ 	ieee80211_queue_work(ar->hw, &ast_entry->wds_wmi_wk);
+ 
+@@ -329,8 +346,8 @@ void ath11k_peer_del_ast(struct ath11k *
+ 
+ 	peer = ast_entry->peer;
+ 
+-	ath11k_dbg(ab, ATH11K_DBG_MAC, "ath11k_peer_del_ast peer %pM ast_entry %pM\n",
+-		   peer->addr, ast_entry->addr);
++	ath11k_dbg(ab, ATH11K_DBG_MAC, "ath11k_peer_del_ast pdev:%d peer %pM ast_entry %pM\n",
++		   ar->pdev->pdev_id, peer->addr, ast_entry->addr);
+ 
+ 	if (ast_entry->is_mapped)
+ 		list_del(&ast_entry->ase_list);
+--- a/drivers/net/wireless/ath/ath11k/peer.h
++++ b/drivers/net/wireless/ath/ath11k/peer.h
+@@ -34,6 +34,7 @@ enum ath11k_ast_entry_type {
+ enum ath11k_wds_wmi_action {
+ 	ATH11K_WDS_WMI_ADD = 1,
+ 	ATH11K_WDS_WMI_UPDATE,
++	ATH11K_WDS_WMI_REMOVE,
+ 
+ 	ATH11K_WDS_WMI_MAX
+ };
+@@ -126,6 +127,8 @@ int ath11k_peer_rhash_delete(struct ath1
+ #ifdef CPTCFG_ATH11K_NSS_SUPPORT
+ struct ath11k_ast_entry *ath11k_peer_ast_find_by_addr(struct ath11k_base *ab,
+ 						      u8* addr);
++struct ath11k_ast_entry *ath11k_peer_ast_find_by_pdev_idx(struct ath11k *ar,
++							  u8* addr);
+ int ath11k_peer_add_ast(struct ath11k *ar, struct ath11k_peer *peer,
+ 			u8* mac_addr, enum ath11k_ast_entry_type type);
+ int ath11k_peer_update_ast(struct ath11k *ar, struct ath11k_peer *peer,
+@@ -145,6 +148,12 @@ static inline struct ath11k_ast_entry *a
+ {
+ 	return NULL;
+ }
++
++static inline struct ath11k_ast_entry *ath11k_peer_ast_find_by_pdev_idx(struct ath11k *ar,
++									u8* addr)
++{
++	return NULL;
++}
+ 
+ static inline int ath11k_peer_add_ast(struct ath11k *ar, struct ath11k_peer *peer,
+ 				      u8* mac_addr, enum ath11k_ast_entry_type type)
+--- a/drivers/net/wireless/ath/ath11k/nss.c
++++ b/drivers/net/wireless/ath/ath11k/nss.c
+@@ -164,7 +164,10 @@ static void ath11k_nss_get_peer_stats(st
+ 
+ 		peer->nss.nss_stats->tx_failed += tx_dropped;
+ 
+-		ATH11K_NSS_TXRX_NETDEV_STATS(tx, peer->vif, tx_bytes, tx_packets);
++		if (peer->nss.ext_vdev_up)
++			ATH11K_NSS_TXRX_NETDEV_STATS(tx, peer->nss.ext_vif, tx_bytes, tx_packets);
++		else
++			ATH11K_NSS_TXRX_NETDEV_STATS(tx, peer->vif, tx_bytes, tx_packets);
+ 
+ 		rx_packets = pstats->rx.rx_recvd;
+ 		peer->nss.nss_stats->rx_packets += rx_packets;
+@@ -174,7 +177,10 @@ static void ath11k_nss_get_peer_stats(st
+ 			pstats->rx.err.decrypt_err;
+ 		peer->nss.nss_stats->rx_dropped += rx_dropped;
+ 
+-		ATH11K_NSS_TXRX_NETDEV_STATS(rx, peer->vif, rx_bytes, rx_packets);
++		if (peer->nss.ext_vdev_up)
++			ATH11K_NSS_TXRX_NETDEV_STATS(tx, peer->nss.ext_vif, tx_bytes, tx_packets);
++		else
++			ATH11K_NSS_TXRX_NETDEV_STATS(rx, peer->vif, rx_bytes, rx_packets);
+ 
+ 		spin_unlock_bh(&ab->base_lock);
+ 		rcu_read_unlock();
+@@ -1040,6 +1046,9 @@ int ath11k_nss_vdev_set_cmd(struct ath11
+ 	case ATH11K_NSS_WIFI_VDEV_DECAP_TYPE_CMD:
+ 		cmd = NSS_WIFI_VDEV_DECAP_TYPE_CMD;
+ 		break;
++	case ATH11K_NSS_WIFI_VDEV_CFG_WDS_BACKHAUL_CMD:
++		cmd = NSS_WIFI_VDEV_CFG_WDS_BACKHAUL_CMD;
++		break;
+ 	default:
+ 		return -EINVAL;
+ 	}
+--- a/drivers/net/wireless/ath/ath11k/nss.h
++++ b/drivers/net/wireless/ath/ath11k/nss.h
+@@ -109,6 +109,7 @@ enum ath11k_nss_vdev_cmd {
+ 	ATH11K_NSS_WIFI_VDEV_SECURITY_TYPE_CMD,
+ 	ATH11K_NSS_WIFI_VDEV_ENCAP_TYPE_CMD,
+ 	ATH11K_NSS_WIFI_VDEV_DECAP_TYPE_CMD,
++	ATH11K_NSS_WIFI_VDEV_CFG_WDS_BACKHAUL_CMD,
+ };
+ 
+ #define WIFILI_SCHEME_ID_INVALID	-1
+@@ -155,6 +156,7 @@ struct ath11k_nss_peer {
+ 	uint32_t *vaddr;
+ 	dma_addr_t paddr;
+ 	bool ext_vdev_up;
++	struct ieee80211_vif *ext_vif;
+ 	struct peer_stats *nss_stats;
+ 	struct completion complete;
+ };
diff --git a/package/kernel/mac80211/patches/ath11k_nss/904-002-ath11k-extend-ext-vdev-in-NSS-for-dynamic-VLAN-handling.patch b/package/kernel/mac80211/patches/ath11k_nss/904-002-ath11k-extend-ext-vdev-in-NSS-for-dynamic-VLAN-handling.patch
new file mode 100644
index 00000000000000..c97edcd605d7f1
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/904-002-ath11k-extend-ext-vdev-in-NSS-for-dynamic-VLAN-handling.patch
@@ -0,0 +1,213 @@
+From 6f51430f2614ca2fb2a1e45cc81464c6d7a29f03 Mon Sep 17 00:00:00 2001
+From: Sathishkumar Muruganandam <murugana@codeaurora.org>
+Date: Fri, 8 Jan 2021 00:34:09 +0530
+Subject: [PATCH 2/3] ath11k: extend ext vdev in NSS for dynamic VLAN handling
+
+- add ext vdev NSS API callbacks required for dynamic AP_VLAN vif
+- existing ext vdev NSS API callbacks are used for both WDS and
+  dynamic VLAN di_types.
+
+Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/nss.c | 101 +++++++++++++++++++++++++++++++---
+ drivers/net/wireless/ath/ath11k/nss.h |  17 ++++++
+ 2 files changed, 109 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/nss.c
++++ b/drivers/net/wireless/ath/ath11k/nss.c
+@@ -1483,14 +1483,11 @@ static int ath11k_nss_ext_vdev_register(
+ 	struct ath11k *ar = arvif->ar;
+ 	struct ath11k_base *ab = ar->ab;
+ 	nss_tx_status_t status;
+-	enum nss_dynamic_interface_type di_type;
+ 	u32 features = 0;
+ 
+ 	if (arvif->vif->type != NL80211_IFTYPE_AP_VLAN || arvif->nss.ctx)
+ 		return -EINVAL;
+ 
+-	di_type = NSS_DYNAMIC_INTERFACE_TYPE_WIFI_EXT_VDEV_WDS;
+-
+ 	arvif->nss.ctx = nss_wifi_ext_vdev_register_if(arvif->nss.if_num,
+ 						       ath11k_nss_ext_vdev_data_receive,
+ 						       ath11k_nss_ext_vdev_special_data_receive,
+@@ -1518,7 +1515,8 @@ static void ath11k_nss_ext_vdev_free(str
+ 
+ 	status = nss_dynamic_interface_dealloc_node(
+ 					arvif->nss.if_num,
+-					NSS_DYNAMIC_INTERFACE_TYPE_WIFI_EXT_VDEV_WDS);
++					arvif->nss.di_type);
++
+ 	if (status != NSS_TX_SUCCESS)
+ 		ath11k_warn(ab, "failed to free nss ext vdev err:%d\n",
+ 			    status);
+@@ -1527,14 +1525,19 @@ static void ath11k_nss_ext_vdev_free(str
+ 			   "nss ext vdev interface deallocated\n");
+ }
+ 
+-static int ath11k_nss_ext_vdev_alloc(struct ath11k_vif *arvif)
++static int ath11k_nss_ext_vdev_alloc(struct ath11k_vif *arvif,
++				     struct wireless_dev *wdev)
+ {
+ 	struct ath11k_base *ab = arvif->ar->ab;
+ 	enum nss_dynamic_interface_type di_type;
+ 	int if_num;
+ 
+-	di_type = NSS_DYNAMIC_INTERFACE_TYPE_WIFI_EXT_VDEV_WDS;
++	if (wdev->use_4addr)
++		di_type = NSS_DYNAMIC_INTERFACE_TYPE_WIFI_EXT_VDEV_WDS;
++	else
++		di_type = NSS_DYNAMIC_INTERFACE_TYPE_WIFI_EXT_VDEV_VLAN;
+ 
++	arvif->nss.di_type = di_type;
+ 	if_num = nss_dynamic_interface_alloc_node(di_type);
+ 	if (if_num < 0) {
+ 		ath11k_warn(ab, "failed to allocate nss ext vdev\n");
+@@ -1543,8 +1546,8 @@ static int ath11k_nss_ext_vdev_alloc(str
+ 
+ 	arvif->nss.if_num = if_num;
+ 	ath11k_dbg(ab, ATH11K_DBG_NSS_WDS,
+-		   "nss ext vdev interface %pM allocated if_num %d\n",
+-		   arvif->vif->addr, if_num);
++		   "nss ext vdev interface %pM di_type %d allocated if_num %d\n",
++		   arvif->vif->addr, di_type, if_num);
+ 
+ 	return 0;
+ }
+@@ -1573,7 +1576,7 @@ int ath11k_nss_ext_vdev_create(struct at
+ 		return -EINVAL;
+ 	}
+ 
+-	ret = ath11k_nss_ext_vdev_alloc(arvif);
++	ret = ath11k_nss_ext_vdev_alloc(arvif, wdev);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -1684,6 +1687,86 @@ free:
+ 	return ret;
+ }
+ 
++int ath11k_nss_ext_vdev_cfg_dyn_vlan(struct ath11k_vif *arvif, u16 vlan_id)
++{
++	struct ath11k *ar = arvif->ar;
++	struct nss_wifi_ext_vdev_msg *ext_vdev_msg = NULL;
++	struct nss_wifi_ext_vdev_vlan_msg *cfg_dyn_vlan_msg = NULL;
++	nss_tx_status_t status;
++	int ret;
++
++	if (!ar->ab->nss.enabled)
++		return 0;
++
++	if (arvif->vif->type != NL80211_IFTYPE_AP_VLAN)
++		return -EINVAL;
++
++	ext_vdev_msg = kzalloc(sizeof(struct nss_wifi_ext_vdev_msg), GFP_ATOMIC);
++	if (!ext_vdev_msg)
++		return -ENOMEM;
++
++	cfg_dyn_vlan_msg = &ext_vdev_msg->msg.vmsg;
++	cfg_dyn_vlan_msg->vlan_id = vlan_id;
++
++	nss_wifi_ext_vdev_msg_init(ext_vdev_msg, arvif->nss.if_num,
++				   NSS_WIFI_EXT_VDEV_MSG_CONFIGURE_VLAN,
++				   sizeof(struct nss_wifi_ext_vdev_vlan_msg),
++				   NULL, arvif);
++
++	status = nss_wifi_ext_vdev_tx_msg_sync(arvif->nss.ctx, ext_vdev_msg);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ar->ab, "failed to configure dyn vlan nss_err:%d\n",
++			    status);
++		ret = -EINVAL;
++		goto free;
++	}
++
++	ret = 0;
++free:
++	kfree(ext_vdev_msg);
++
++	return ret;
++}
++
++int ath11k_nss_dyn_vlan_set_group_key(struct ath11k_vif *arvif, u16 vlan_id,
++				      u16 group_key)
++{
++	struct nss_wifi_vdev_msg *vdev_msg = NULL;
++	struct nss_wifi_vdev_set_vlan_group_key *vlan_group_key;
++	struct ath11k *ar = arvif->ar;
++	nss_tx_status_t status;
++	int ret = 0;
++
++	if (!ar->ab->nss.enabled)
++		return 0;
++
++	vdev_msg = kzalloc(sizeof(struct nss_wifi_vdev_msg), GFP_ATOMIC);
++	if (!vdev_msg)
++		return -ENOMEM;
++
++	vlan_group_key = &vdev_msg->msg.vlan_group_key;
++	vlan_group_key->vlan_id = vlan_id;
++	vlan_group_key->group_key = group_key;
++
++	nss_wifi_vdev_msg_init(vdev_msg, arvif->nss.if_num,
++			       NSS_WIFI_VDEV_SET_GROUP_KEY,
++			       sizeof(struct nss_wifi_vdev_set_vlan_group_key),
++			       NULL, NULL);
++
++	status = nss_wifi_vdev_tx_msg(ar->nss.ctx, vdev_msg);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ar->ab, "nss vdev set vlan group key error %d\n", status);
++		ret = -EINVAL;
++		goto free;
++	}
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_NSS_WDS, "nss vdev set vlan group key success\n");
++free:
++	kfree(vdev_msg);
++	return ret;
++
++}
++
+ /*----------------------------Peer Setup/Config -----------------------------*/
+ 
+ int ath11k_nss_set_peer_sec_type(struct ath11k *ar,
+--- a/drivers/net/wireless/ath/ath11k/nss.h
++++ b/drivers/net/wireless/ath/ath11k/nss.h
+@@ -150,6 +150,10 @@ struct arvif_nss {
+ 	bool added;
+ 	/* Flag to notify if ext vdev is up/down */
+ 	bool ext_vdev_up;
++#ifdef CPTCFG_ATH11K_NSS_SUPPORT
++	/* Keep the copy of di_type for nss */
++	enum nss_dynamic_interface_type di_type;
++#endif
+ 	/* WDS cfg should be done only once for ext vdev */
+ 	bool wds_cfg_done;
+ 	bool created;
+@@ -215,6 +217,9 @@ void ath11k_nss_ext_vdev_unregister(stru
+ int ath11k_nss_ext_vdev_up(struct ath11k_vif *arvif);
+ int ath11k_nss_ext_vdev_down(struct ath11k_vif *arvif);
+ void ath11k_nss_ext_vdev_delete(struct ath11k_vif *arvif);
++int ath11k_nss_ext_vdev_cfg_dyn_vlan(struct ath11k_vif *arvif, u16 vlan_id);
++int ath11k_nss_dyn_vlan_set_group_key(struct ath11k_vif *arvif, u16 vlan_id,
++				      u16 group_key);
+ int ath11k_nss_set_peer_sec_type(struct ath11k *ar, struct ath11k_peer *peer,
+ 				 struct ieee80211_key_conf *key_conf);
+ void ath11k_nss_update_sta_stats(struct ath11k_vif *arvif,
+@@ -343,6 +348,18 @@ static inline int ath11k_nss_ext_vdev_do
+ {
+ 	return 0;
+ }
++
++static inline int ath11k_nss_ext_vdev_cfg_dyn_vlan(struct ath11k_vif *arvif,
++						   u16 vlan_id)
++{
++	return 0;
++}
++
++static inline int ath11k_nss_dyn_vlan_set_group_key(struct ath11k_vif *arvif,
++						    u16 vlan_id, u16 group_key)
++{
++	return 0;
++}
+ 
+ static inline void ath11k_nss_peer_stats_enable(struct ath11k *ar)
+ {
diff --git a/package/kernel/mac80211/patches/ath11k_nss/904-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch b/package/kernel/mac80211/patches/ath11k_nss/904-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch
new file mode 100644
index 00000000000000..2361523d394ac4
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/904-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch
@@ -0,0 +1,557 @@
+From da432fe6dda831c867416d338def3e277c989287 Mon Sep 17 00:00:00 2001
+From: Sathishkumar Muruganandam <murugana@codeaurora.org>
+Date: Fri, 8 Jan 2021 00:39:47 +0530
+Subject: [PATCH 3/3] ath11k: add dynamic VLAN support in NSS offload
+
+Driver should advertise NL80211_EXT_FEATURE_VLAN_OFFLOAD to enable
+vlan offload in hostapd.
+
+Group Key for multiple vlan interfaces are configured with the help
+of group key index as NSS uses this index to get the corresponding
+group key during transmission.
+
+Each dynamic AP-VLAN interface choose unique group key index which
+will be sent to NSS along with VLAN ID for dynamic VLAN ext vdev
+configuration.
+
+ath11k_mac_op_set_key() does the NSS ext vdev config upon receiving
+VLAN ID on group key.
+
+ath11k_mac_op_sta_state() does the STA assignment from AP vif to
+AP_VLAN vif in NSS after mac80211.
+
+Currently, the firmware supports upto 128 group keys for an AP
+interface. The multiple group key support can be enabled during
+resource config.
+
+Co-Developed-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/core.h |   8 ++
+ drivers/net/wireless/ath/ath11k/mac.c  | 237 ++++++++++++++++++++++++++++++---
+ drivers/net/wireless/ath/ath11k/wmi.c  |   5 +
+ drivers/net/wireless/ath/ath11k/wmi.h  |   2 +
+ 4 files changed, 233 insertions(+), 19 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -98,6 +98,11 @@ enum ath11k_crypt_mode {
+ 	ATH11K_CRYPT_MODE_SW,
+ };
+ 
++#define ATH11K_GROUP_KEYS_NUM_MAX	128
++#define ATH11K_FREE_GROUP_IDX_MAP_BITS	(BITS_PER_BYTE * (sizeof(long)))
++#define ATH11K_FREE_GROUP_IDX_MAP_MAX	(ATH11K_GROUP_KEYS_NUM_MAX /	\
++					 ATH11K_FREE_GROUP_IDX_MAP_BITS)
++
+ static inline enum wme_ac ath11k_tid_to_ac(u32 tid)
+ {
+ 	return (((tid == 0) || (tid == 3)) ? WME_AC_BE :
+@@ -325,6 +330,20 @@ struct ath11k_mgmt_frame_stats {
+ 	u32 tx_compl_fail[ATH11K_STATS_MGMT_FRM_TYPE_MAX];
+ };
+ 
++/**
++ *struct ath11k_dyn_vlan_cfg - dynamic vlan config state info container.
++ *                             will be used during ieee80211_reconfig
++ *			       nss offload case
++ *@arvif: driver's data for the corresponding AP_VLAN ieee80211_vif
++ *@sta: ieee80211_sta which is getting associated to AP_VLAN
++ *@cfg_list: list to hold all associated sta's state
++ */
++struct ath11k_dyn_vlan_cfg {
++	struct ath11k_vif *arvif;
++	struct ieee80211_sta *sta;
++	struct list_head cfg_list;
++};
++
+ struct ath11k_vif {
+ 	u32 vdev_id;
+ 	enum wmi_vdev_type vdev_type;
+@@ -387,6 +406,11 @@ struct ath11k_vif {
+ 	struct ath11k_mgmt_frame_stats mgmt_stats;
+ 	struct arvif_nss nss;
+ 	struct list_head ap_vlan_arvifs;
++	/* list required by Dynamic VLAN during fw_recovery */
++	struct list_head dyn_vlan_cfg;
++	/* VLAN keyidx map required for Dynamic VLAN */
++	u16 *vlan_keyid_map;
++	DECLARE_BITMAP(free_groupidx_map, ATH11K_GROUP_KEYS_NUM_MAX);
+ };
+ 
+ struct ath11k_vif_iter {
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -348,6 +348,10 @@ enum nl80211_he_gi ath11k_mac_he_gi_to_n
+ 	return ret;
+ }
+ 
++static int ath11k_mac_cfg_dyn_vlan(struct ath11k_base *ab,
++				   struct ath11k_vif *ap_vlan_arvif,
++				   struct ieee80211_sta *sta);
++
+ u8 ath11k_mac_bw_to_mac80211_bw(u8 bw)
+ {
+ 	u8 ret = 0;
+@@ -720,6 +724,33 @@ u8 ath11k_mac_get_target_pdev_id(struct
+ 		return ar->ab->target_pdev_ids[0].pdev_id;
+ }
+ 
++struct ath11k_vif *ath11k_mac_get_ap_arvif_by_addr(struct ath11k_base *ab,
++						   const u8 *addr)
++{
++	int i;
++	struct ath11k_pdev *pdev;
++	struct ath11k_vif *arvif;
++	struct ath11k *ar;
++
++	for (i = 0; i < ab->num_radios; i++) {
++		pdev = rcu_dereference(ab->pdevs_active[i]);
++		if (pdev && pdev->ar) {
++			ar = pdev->ar;
++
++			spin_lock_bh(&ar->data_lock);
++			list_for_each_entry(arvif, &ar->arvifs, list) {
++				if (arvif->vif->type == NL80211_IFTYPE_AP &&
++				    ether_addr_equal(arvif->vif->addr, addr)) {
++					spin_unlock_bh(&ar->data_lock);
++					return arvif;
++				}
++			}
++			spin_unlock_bh(&ar->data_lock);
++		}
++	}
++	return NULL;
++}
++
+ static void ath11k_pdev_caps_update(struct ath11k *ar)
+ {
+ 	struct ath11k_base *ab = ar->ab;
+@@ -4173,6 +4204,9 @@ static int ath11k_install_key(struct ath
+ 	if (test_bit(ATH11K_FLAG_HW_CRYPTO_DISABLED, &ar->ab->dev_flags))
+ 		return 0;
+ 
++	if (key->vlan_id)
++		arg.group_key_idx = key->hw_key_idx;
++
+ 	if (cmd == DISABLE_KEY) {
+ 		arg.key_cipher = WMI_CIPHER_NONE;
+ 		arg.key_data = NULL;
+@@ -4262,15 +4296,40 @@ static int ath11k_clear_peer_keys(struct
+ 	return first_errno;
+ }
+ 
++static int ath11k_get_vlan_groupkey_index(struct ath11k_vif *arvif,
++					  struct ieee80211_key_conf *key)
++{
++	struct ath11k *ar = arvif->ar;
++	int map_idx = 0;
++	int free_bit;
++
++	for (map_idx = 0; map_idx < ATH11K_FREE_GROUP_IDX_MAP_MAX; map_idx++)
++		if (arvif->free_groupidx_map[map_idx] != 0)
++			break;
++
++	if (map_idx == ATH11K_FREE_GROUP_IDX_MAP_MAX)
++		return -ENOSPC;
++
++	spin_lock_bh(&ar->data_lock);
++	/* select the first free key index */
++	free_bit = __ffs64(arvif->free_groupidx_map[map_idx]);
++	key->hw_key_idx = (map_idx * ATH11K_FREE_GROUP_IDX_MAP_BITS) + free_bit;
++	/* clear the selected bit from free index map */
++	clear_bit(key->hw_key_idx, arvif->free_groupidx_map);
++	spin_unlock_bh(&ar->data_lock);
++
++	return 0;
++}
++
+ static int ath11k_mac_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ 				 struct ieee80211_vif *vif, struct ieee80211_sta *sta,
+ 				 struct ieee80211_key_conf *key)
+ {
+ 	struct ath11k *ar = hw->priv;
+ 	struct ath11k_base *ab = ar->ab;
+-	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
++	struct ath11k_vif *arvif, *ap_vlan_arvif = NULL;
+ 	struct ath11k_peer *peer;
+-	struct ath11k_sta *arsta;
++	struct ath11k_sta *arsta = NULL;
+ 	const u8 *peer_addr;
+ 	int ret = 0;
+ 	u32 flags = 0;
+@@ -4288,17 +4347,38 @@ static int ath11k_mac_op_set_key(struct
+ 	if (key->keyidx > WMI_MAX_KEY_INDEX)
+ 		return -ENOSPC;
+ 
+-	mutex_lock(&ar->conf_mutex);
++	arvif = ath11k_vif_to_arvif(vif);
+ 
+-	if (sta)
++	mutex_lock(&ar->conf_mutex);
++	if (sta) {
+ 		peer_addr = sta->addr;
+-	else if (arvif->vdev_type == WMI_VDEV_TYPE_STA)
++		arsta = (struct ath11k_sta *)sta->drv_priv;
++	} else if (arvif->vdev_type == WMI_VDEV_TYPE_STA) {
+ 		peer_addr = vif->bss_conf.bssid;
+-	else
++	} else {
+ 		peer_addr = vif->addr;
++	}
+ 
+ 	key->hw_key_idx = key->keyidx;
+ 
++	if (ab->nss.enabled && vif->type == NL80211_IFTYPE_AP_VLAN) {
++		ap_vlan_arvif = arvif;
++		if (arsta) {
++			ap_vlan_arvif->nss.ap_vif = arsta->arvif;
++			arvif = arsta->arvif;
++		} else {
++			rcu_read_lock();
++			arvif = ath11k_mac_get_ap_arvif_by_addr(ab, peer_addr);
++			if (!arvif) {
++				rcu_read_unlock();
++				ret = -EINVAL;
++				goto exit;
++			}
++			ap_vlan_arvif->nss.ap_vif = arvif;
++			rcu_read_unlock();
++		}
++	}
++
+ 	/* the peer should not disappear in mid-way (unless FW goes awry) since
+ 	 * we already hold conf_mutex. we just make sure its there now.
+ 	 */
+@@ -4343,6 +4423,74 @@ static int ath11k_mac_op_set_key(struct
+ 		goto exit;
+ 	}
+ 
++	/* VLAN ID is updated non-zero only for AP_VLAN vif */
++	if (key->vlan_id && !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE) &&
++	    ap_vlan_arvif) {
++		if (arvif->vlan_keyid_map)
++			key->hw_key_idx = arvif->vlan_keyid_map[key->vlan_id];
++		else
++			key->hw_key_idx = 0;
++		switch (cmd) {
++		case SET_KEY:
++			/* If the group key idx is already available,
++			 * no need to find the free index again.
++			 * This happens during GTK rekey. It uses
++			 * the same index after rekey also.
++			 */
++			if (!key->hw_key_idx)
++				ret = ath11k_get_vlan_groupkey_index(arvif, key);
++			break;
++		case DISABLE_KEY:
++			/* If the group key idx is already 0,
++			 * no need of freeing the index.
++			 */
++			if (key->hw_key_idx) {
++				spin_lock_bh(&ar->data_lock);
++				/* make the group index as available */
++				set_bit(key->hw_key_idx, arvif->free_groupidx_map);
++				spin_unlock_bh(&ar->data_lock);
++			}
++			break;
++		default:
++			ret = -EINVAL;
++		}
++
++		if (ret) {
++			ath11k_warn(ab, "failed to set group key index for vlan %u : %d\n",
++				    key->vlan_id, ret);
++			goto exit;
++		}
++
++		ret = ath11k_nss_ext_vdev_configure(ap_vlan_arvif);
++		if (ret) {
++			ath11k_warn(ab, "failed to nss cfg ext vdev %pM: %d\n",
++				    ap_vlan_arvif->vif->addr, ret);
++			goto exit;
++		}
++
++		ret = ath11k_nss_ext_vdev_cfg_dyn_vlan(ap_vlan_arvif,
++						       key->vlan_id);
++		if (ret) {
++			ath11k_warn(ab, "failed to cfg dynamic vlan %d\n", ret);
++			goto exit;
++		}
++
++		ret = ath11k_nss_dyn_vlan_set_group_key(ap_vlan_arvif->nss.ap_vif,
++							key->vlan_id,
++							key->hw_key_idx);
++		if (ret) {
++			ath11k_warn(ab, "failed to set dynamic vlan group key %d\n",
++				    ret);
++			goto exit;
++		}
++
++		ret = ath11k_nss_ext_vdev_up(ap_vlan_arvif);
++		if (ret) {
++			ath11k_warn(ab, "failed to set dyn vlan UP %d\n", ret);
++			goto exit;
++		}
++	}
++
+ 	spin_lock_bh(&ab->base_lock);
+ 	peer = ath11k_peer_find(ab, arvif->vdev_id, peer_addr);
+ 
+@@ -4365,6 +4513,27 @@ static int ath11k_mac_op_set_key(struct
+ 		goto unlock;
+ 	}
+ 
++	spin_unlock_bh(&ar->ab->base_lock);
++	if (ap_vlan_arvif && ar->state == ATH11K_STATE_RESTARTED) {
++		/* Keys are getting installed during ieee80211_reconfig(). Configuring
++		 * dynamic vlan is pending and the state is saved in the ap_vlan
++		 * arvif dyn_vlan_cfg list. We will configure it now since nss peer is authorised */
++		struct ath11k_dyn_vlan_cfg *dyn_vlan_cfg, *tmp;
++
++		list_for_each_entry_safe(dyn_vlan_cfg, tmp, &ap_vlan_arvif->dyn_vlan_cfg, cfg_list) {
++			struct ieee80211_sta *vlan_sta = dyn_vlan_cfg->sta;
++
++			ret = ath11k_mac_cfg_dyn_vlan(ar->ab, ap_vlan_arvif, vlan_sta);
++			if (ret)
++				ath11k_warn(ar->ab, "failed to cfg dyn vlan for peer %pM: %d\n",
++					    vlan_sta->addr, ret);
++			/* Configuration is used. Free up space */
++			list_del(&dyn_vlan_cfg->cfg_list);
++			kfree(dyn_vlan_cfg);
++		}
++	}
++
++	spin_lock_bh(&ar->ab->base_lock);
+ 	if (peer && cmd == SET_KEY) {
+ 		peer->keys[key->keyidx] = key;
+ 		if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
+@@ -4374,18 +4543,23 @@ static int ath11k_mac_op_set_key(struct
+ 			peer->mcast_keyidx = key->keyidx;
+ 			peer->sec_type_grp = ath11k_dp_tx_get_encrypt_type(key->cipher);
+ 		}
++		/* storing group key idx which will be used during rekey */
++		if (key->vlan_id)
++			arvif->vlan_keyid_map[key->vlan_id] = key->hw_key_idx;
+ 	} else if (peer && cmd == DISABLE_KEY) {
+ 		peer->keys[key->keyidx] = NULL;
+ 		if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
+ 			peer->ucast_keyidx = 0;
+ 		else
+ 			peer->mcast_keyidx = 0;
+-	} else if (!peer)
++		if (key->vlan_id)
++			arvif->vlan_keyid_map[key->vlan_id] = 0;
++	} else if (!peer) {
+ 		/* impossible unless FW goes crazy */
+ 		ath11k_warn(ab, "peer %pM disappeared!\n", peer_addr);
++  }
+ 
+-	if (sta) {
+-		arsta = ath11k_sta_to_arsta(sta);
++	if (arsta) {
+ 
+ 		switch (key->cipher) {
+ 		case WLAN_CIPHER_SUITE_TKIP:
+@@ -5186,6 +5360,33 @@ static u32 ath11k_mac_ieee80211_sta_bw_t
+ 	return bw;
+ }
+ 
++static int ath11k_mac_cfg_dyn_vlan(struct ath11k_base *ab,
++				   struct ath11k_vif *ap_vlan_arvif,
++				   struct ieee80211_sta *sta)
++{
++	struct ath11k_peer *peer;
++	int peer_id, ret;
++
++	spin_lock_bh(&ab->base_lock);
++	peer = ath11k_peer_find_by_addr(ab, sta->addr);
++	if (!peer) {
++		ath11k_warn(ab, "failed to find peer for %pM\n", sta->addr);
++		spin_unlock_bh(&ab->base_lock);
++		return -EINVAL;
++	}
++	peer_id = peer->peer_id;
++	spin_unlock_bh(&ab->base_lock);
++
++	ret = ath11k_nss_ext_vdev_wds_4addr_allow(ap_vlan_arvif, peer_id);
++	if (ret) {
++		ath11k_warn(ab, "failed to set 4addr allow for %pM:%d\n",
++			    sta->addr, ret);
++		return ret;
++	}
++
++	return ret;
++}
++
+ static int ath11k_mac_op_sta_state(struct ieee80211_hw *hw,
+ 				   struct ieee80211_vif *vif,
+ 				   struct ieee80211_sta *sta,
+@@ -5306,6 +5507,34 @@ static int ath11k_mac_op_sta_state(struc
+ 			if (ret)
+ 				ath11k_warn(ar->ab, "Unable to authorize peer %pM vdev %d: %d\n",
+ 					    sta->addr, arvif->vdev_id, ret);
++		} else if (ar->ab->nss.enabled &&
++			   vif->type == NL80211_IFTYPE_AP_VLAN &&
++			   !arsta->use_4addr_set) {
++
++			if (ar->state == ATH11K_STATE_RESTARTED) {
++				/* During ieee80211_reconfig(), at this point, nss ext vdev peer is not
++				 * authorized. Hence ath11k_mac_cfg_dyn_vlan() will return error. We save
++				 * the state vars here and use it later once nss ext vdev is authorized
++				 * in ath11k_mac_op_set_key() */
++				struct ath11k_dyn_vlan_cfg *ar_dyn_vlan_cfg;
++				ar_dyn_vlan_cfg = kzalloc(sizeof(*ar_dyn_vlan_cfg), GFP_ATOMIC);
++
++				if (!ar_dyn_vlan_cfg) {
++					ath11k_warn(ar->ab, "failed to save state for dynamic AP_VLAN configuration (%d)",
++						    -ENOSPC);
++				} else {
++					INIT_LIST_HEAD(&ar_dyn_vlan_cfg->cfg_list);
++					ar_dyn_vlan_cfg->arvif = arvif;
++					ar_dyn_vlan_cfg->sta = sta;
++					/* save it to arvif (AP_VLAN) list */
++					list_add_tail(&ar_dyn_vlan_cfg->cfg_list, &arvif->dyn_vlan_cfg);
++				}
++			} else {
++				ret = ath11k_mac_cfg_dyn_vlan(ar->ab, arvif, sta);
++				if (ret)
++					ath11k_warn(ar->ab, "failed to cfg dyn vlan for peer %pM: %d\n",
++						    sta->addr, ret);
++			}
+ 		}
+ 	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
+ 		   new_state == IEEE80211_STA_ASSOC) {
+@@ -7045,7 +7274,7 @@ static int ath11k_mac_op_add_interface(s
+ 	if ((vif->type == NL80211_IFTYPE_AP_VLAN ||
+ 	     vif->type == NL80211_IFTYPE_STATION) && ab->nss.enabled) {
+ 		if (ath11k_frame_mode == ATH11K_HW_TXRX_ETHERNET &&
+-		    ieee80211_set_hw_80211_encap(vif, true)) {
++		(vif->offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED)) {
+ 			vif->offload_flags |= IEEE80211_OFFLOAD_ENCAP_4ADDR;
+ 			arvif->nss.encap = ATH11K_HW_TXRX_ETHERNET;
+ 			arvif->nss.decap = ATH11K_HW_TXRX_ETHERNET;
+@@ -7058,6 +7287,7 @@ static int ath11k_mac_op_add_interface(s
+ 					    vif->addr, ret);
+ 				goto err;
+ 			}
++			INIT_LIST_HEAD(&arvif->dyn_vlan_cfg);
+ 			mutex_unlock(&ar->conf_mutex);
+ 			return ret;
+ 		}
+@@ -7082,6 +7312,20 @@ static int ath11k_mac_op_add_interface(s
+ 	arvif->vdev_id = bit;
+ 	arvif->vdev_subtype = WMI_VDEV_SUBTYPE_NONE;
+ 
++	spin_lock_bh(&ar->data_lock);
++	/* Configure vlan specific parameters */
++	for (i = 0; i < ATH11K_FREE_GROUP_IDX_MAP_MAX; i++)
++		arvif->free_groupidx_map[i] = 0xFFFFFFFFL;
++	/* Group idx 0 is not valid for VLAN*/
++	arvif->free_groupidx_map[0] &= ~(1L);
++	spin_unlock_bh(&ar->data_lock);
++
++	arvif->vlan_keyid_map = kzalloc(4096, GFP_KERNEL);
++	if (!arvif->vlan_keyid_map) {
++		ret = -ENOMEM;
++		goto err;
++	}
++
+ 	switch (vif->type) {
+ 	case NL80211_IFTYPE_UNSPECIFIED:
+ 	case NL80211_IFTYPE_STATION:
+@@ -7122,7 +7366,7 @@ static int ath11k_mac_op_add_interface(s
+ 	if (ret) {
+ 		ath11k_warn(ab, "failed to create WMI vdev %d: %d\n",
+ 			    arvif->vdev_id, ret);
+-		goto err;
++		goto err_keyid;
+ 	}
+ 
+ 	ar->num_created_vdevs++;
+@@ -7281,7 +7525,7 @@ err_peer_del:
+ 		if (fbret) {
+ 			ath11k_warn(ar->ab, "fallback fail to delete peer addr %pM vdev_id %d ret %d\n",
+ 				    vif->addr, arvif->vdev_id, fbret);
+-			goto err;
++			goto err_keyid;
+ 		}
+ 	}
+ 
+@@ -7292,6 +7536,8 @@ err_vdev_del:
+ 	list_del(&arvif->list);
+ 	spin_unlock_bh(&ar->data_lock);
+ 
++err_keyid:
++	kfree(arvif->vlan_keyid_map);
+ err:
+ 	mutex_unlock(&ar->conf_mutex);
+ 
+@@ -7389,6 +7635,7 @@ err_vdev_del:
+ 	list_del(&arvif->list);
+ 	spin_unlock_bh(&ar->data_lock);
+ 
++	kfree(arvif->vlan_keyid_map);
+ 	ath11k_peer_cleanup(ar, arvif->vdev_id);
+ 
+ 	idr_for_each(&ar->txmgmt_idr,
+@@ -10113,8 +10360,11 @@ static int __ath11k_mac_register(struct
+ 	    ab->hw_params.bios_sar_capa)
+ 		ar->hw->wiphy->sar_capa = ab->hw_params.bios_sar_capa;
+ 
+-	if (ab->nss.enabled)
++	if (ab->nss.enabled) {
+ 		ieee80211_hw_set(ar->hw, SUPPORTS_NSS_OFFLOAD);
++		wiphy_ext_feature_set(ar->hw->wiphy,
++				      NL80211_EXT_FEATURE_VLAN_OFFLOAD);
++	}
+ 
+ 	ret = ieee80211_register_hw(ar->hw);
+ 	if (ret) {
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -2001,6 +2001,7 @@ int ath11k_wmi_vdev_install_key(struct a
+ 	cmd->key_len = arg->key_len;
+ 	cmd->key_txmic_len = arg->key_txmic_len;
+ 	cmd->key_rxmic_len = arg->key_rxmic_len;
++	cmd->group_key_id = arg->group_key_idx;
+ 
+ 	if (arg->key_rsc_counter)
+ 		memcpy(&cmd->key_rsc_counter, &arg->key_rsc_counter,
+@@ -4275,6 +4276,7 @@ ath11k_wmi_copy_resource_config(struct w
+ 	wmi_cfg->flags2 = WMI_RSRC_CFG_FLAG2_CALC_NEXT_DTIM_COUNT_SET;
+ 	wmi_cfg->ema_max_vap_cnt = tg_cfg->ema_max_vap_cnt;
+ 	wmi_cfg->ema_max_profile_period = tg_cfg->ema_max_profile_period;
++	wmi_cfg->max_num_group_keys = tg_cfg->max_num_group_keys;
+ }
+ 
+ static int ath11k_init_cmd_send(struct ath11k_pdev_wmi *wmi,
+@@ -4497,6 +4499,9 @@ int ath11k_wmi_cmd_init(struct ath11k_ba
+ 	memset(&init_param, 0, sizeof(init_param));
+ 	memset(&config, 0, sizeof(config));
+ 
++	if (ab->nss.enabled)
++		config.max_num_group_keys = ATH11K_GROUP_KEYS_NUM_MAX;
++
+ 	ab->hw_params.hw_ops->wmi_init_config(ab, &config);
+ 
+ 	if (test_bit(WMI_TLV_SERVICE_REG_CC_EXT_EVENT_SUPPORT,
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -3701,6 +3701,7 @@ struct wmi_vdev_install_key_arg {
+ 	u32 vdev_id;
+ 	const u8 *macaddr;
+ 	u32 key_idx;
++	u32 group_key_idx;
+ 	u32 key_flags;
+ 	u32 key_cipher;
+ 	u32 key_len;
+@@ -5846,6 +5847,7 @@ struct target_resource_config {
+ 	u32 bpf_instruction_size;
+ 	u32 max_bssid_rx_filters;
+ 	u32 use_pdev_id;
++	u32 max_num_group_keys;
+ 	u32 peer_map_unmap_v2_support;
+ 	u32 sched_params;
+ 	u32 twt_ap_pdev_count;
diff --git a/target/linux/qualcommax/patches-6.6/9999-add-btcoex-dts.patch b/target/linux/qualcommax/patches-6.6/9999-add-btcoex-dts.patch
new file mode 100644
index 00000000000000..83825b782c1b7f
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/9999-add-btcoex-dts.patch
@@ -0,0 +1,30 @@
+--- linux-6.1.71/arch/arm64/boot/dts/qcom/ipq8074.dtsi	2024-01-07 01:44:56.908138962 -0500
++++ linux-6.1.71/arch/arm64/boot/dts/qcom/ipq8074.dtsi	2024-01-07 01:44:58.908138962 -0500
+@@ -1170,7 +1170,14 @@
+ 		wifi: wifi@c0000000 {
+ 			compatible = "qcom,ipq8074-wifi";
+ 			reg = <0xc000000 0x2000000>;
+-
++			qcom,hw-mode-id = <1>;
++		#ifdef __IPQ_MEM_PROFILE_256_MB__
++			qcom,tgt-mem-mode = <2>;
++		#elif __IPQ_MEM_PROFILE_512_MB__
++			qcom,tgt-mem-mode = <1>;
++		#else
++			qcom,tgt-mem-mode = <0>;
++		#endif
+ 			interrupts = <GIC_SPI 320 IRQ_TYPE_EDGE_RISING>,
+ 				     <GIC_SPI 319 IRQ_TYPE_EDGE_RISING>,
+ 				     <GIC_SPI 318 IRQ_TYPE_EDGE_RISING>,
+@@ -1276,6 +1283,12 @@
+ 					  "tcl2host-status-ring";
+ 			qcom,rproc = <&q6v5_wcss>;
+ 			status = "disabled";
++			qcom,pta-num = <0>;
++			qcom,coex-mode = <0x2>;
++			qcom,bt-active-time = <0x12>;
++			qcom,bt-priority-time = <0x0c>;
++			qcom,coex-algo = <0x2>;
++			qcom,pta-priority = <0x80800505>;
+ 		};
+ 	};

From 36e7881e790c59c6d96a61ba3215d91978a8aba3 Mon Sep 17 00:00:00 2001
From: Qosmio <datapronix@protonmail.com>
Date: Sun, 7 Jan 2024 22:41:14 -0500
Subject: [PATCH 082/225] ath11k_nss: handle qca-nss-drv symbol dependancies

---
 package/kernel/mac80211/ath.mk                |  2 ++
 .../199-001-mac80211-add-nss-support.patch    |  2 +-
 ...th11k-Add-support-for-beacon-tx-mode.patch |  4 +--
 ...ow-fast-rx-by-bypassing-stats-update.patch |  2 +-
 ...-fix-clear-peer-keys-during-disassoc.patch |  4 +--
 ...unused-RX_FLAGS-from-mac80211_rx_fla.patch |  4 +--
 .../640-006-mac80211-add-eht-radiotap.patch   |  8 ++---
 .../patches/ath11k_nss/900-fix-build.patch    | 22 ++++++-------
 ...N-iftype-support-on-NSS-offload-case.patch |  4 +--
 ...-dynamic-VLAN-support-on-NSS-offload.patch |  4 +--
 ...-support-on-NSS-offload-for-STA-mode.patch | 32 +++++++++----------
 ...02-ath11k-add-HE-stats-in-peer-stats.patch | 18 +++++------
 .../902-ath11k-add-btcoex-config.patch        | 16 +++++-----
 ...pport-for-WDS-offload-in-NSS-offload.patch |  2 +-
 ...dev-in-NSS-for-dynamic-VLAN-handling.patch | 18 +++++------
 15 files changed, 72 insertions(+), 70 deletions(-)

diff --git a/package/kernel/mac80211/ath.mk b/package/kernel/mac80211/ath.mk
index d6f38884c398e0..b109382ec7d26c 100644
--- a/package/kernel/mac80211/ath.mk
+++ b/package/kernel/mac80211/ath.mk
@@ -339,6 +339,8 @@ define KernelPackage/ath11k/config
 
        config ATH11K_NSS_SUPPORT
                bool "Enable NSS WiFi offload"
+               select NSS_DRV_WIFI_ENABLE
+               select NSS_DRV_WIFI_EXT_VDEV_ENABLE
                default y if TARGET_qualcommax
 
        config ATH11K_MEM_PROFILE_512M
diff --git a/package/kernel/mac80211/patches/ath11k_nss/199-001-mac80211-add-nss-support.patch b/package/kernel/mac80211/patches/ath11k_nss/199-001-mac80211-add-nss-support.patch
index 0b017ec97ad24d..f25def295537ca 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/199-001-mac80211-add-nss-support.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/199-001-mac80211-add-nss-support.patch
@@ -225,7 +225,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		return -EINVAL;
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -2379,6 +2379,9 @@ sta_get_last_rx_stats(struct sta_info *s
+@@ -2380,6 +2380,9 @@ sta_get_last_rx_stats(struct sta_info *s
  	struct ieee80211_sta_rx_stats *stats = &sta->deflink.rx_stats;
  	int cpu;
  
diff --git a/package/kernel/mac80211/patches/ath11k_nss/235-001-ath11k-Add-support-for-beacon-tx-mode.patch b/package/kernel/mac80211/patches/ath11k_nss/235-001-ath11k-Add-support-for-beacon-tx-mode.patch
index a95308a74ed223..5d5a83911d8519 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/235-001-ath11k-Add-support-for-beacon-tx-mode.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/235-001-ath11k-Add-support-for-beacon-tx-mode.patch
@@ -19,7 +19,7 @@ Signed-off-by: Maharaja Kennadyrajan <mkenna@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -3483,7 +3483,10 @@ static void ath11k_mac_op_bss_info_chang
+@@ -3481,7 +3481,10 @@ static void ath11k_mac_op_bss_info_chang
  
  	if (changed & BSS_CHANGED_BEACON) {
  		param_id = WMI_PDEV_PARAM_BEACON_TX_MODE;
@@ -31,7 +31,7 @@ Signed-off-by: Maharaja Kennadyrajan <mkenna@codeaurora.org>
  		ret = ath11k_wmi_pdev_set_param(ar, param_id,
  						param_value, ar->pdev->pdev_id);
  		if (ret)
-@@ -3491,8 +3494,9 @@ static void ath11k_mac_op_bss_info_chang
+@@ -3489,8 +3492,9 @@ static void ath11k_mac_op_bss_info_chang
  				    arvif->vdev_id);
  		else
  			ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
diff --git a/package/kernel/mac80211/patches/ath11k_nss/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch b/package/kernel/mac80211/patches/ath11k_nss/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
index bb46abada6b9e3..b0f6b03f750f9e 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
@@ -395,7 +395,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	bool (*rx_desc_get_mpdu_fc_valid)(struct hal_rx_desc *desc);
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -5197,6 +5197,14 @@ static int ath11k_mac_op_sta_state(struc
+@@ -5201,6 +5201,14 @@ static int ath11k_mac_op_sta_state(struc
  		}
  	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
  		   new_state == IEEE80211_STA_ASSOC) {
diff --git a/package/kernel/mac80211/patches/ath11k_nss/357-ath11k-fix-clear-peer-keys-during-disassoc.patch b/package/kernel/mac80211/patches/ath11k_nss/357-ath11k-fix-clear-peer-keys-during-disassoc.patch
index 5050192acc64ae..414cb06d87bd4b 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/357-ath11k-fix-clear-peer-keys-during-disassoc.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/357-ath11k-fix-clear-peer-keys-during-disassoc.patch
@@ -17,7 +17,7 @@ Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -4708,12 +4708,6 @@ static int ath11k_station_disassoc(struc
+@@ -4712,12 +4712,6 @@ static int ath11k_station_disassoc(struc
  			return ret;
  	}
  
@@ -30,7 +30,7 @@ Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
  	return 0;
  }
  
-@@ -5176,6 +5170,17 @@ static int ath11k_mac_op_sta_state(struc
+@@ -5180,6 +5174,17 @@ static int ath11k_mac_op_sta_state(struc
  		arsta->bw = ath11k_mac_ieee80211_sta_bw_to_wmi(ar, sta);
  		arsta->bw_prev = arsta->bw;
  		spin_unlock_bh(&ar->data_lock);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch b/package/kernel/mac80211/patches/ath11k_nss/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
index 2d1fbc097df375..14fd82cbeaa853 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
@@ -14,7 +14,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1385,8 +1385,6 @@ ieee80211_tx_info_clear_status(struct ie
+@@ -1387,8 +1387,6 @@ ieee80211_tx_info_clear_status(struct ie
   * @RX_FLAG_AMPDU_IS_LAST: this subframe is the last subframe of the A-MPDU
   * @RX_FLAG_AMPDU_DELIM_CRC_ERROR: A delimiter CRC error has been detected
   *	on this subframe
@@ -23,7 +23,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
   * @RX_FLAG_MIC_STRIPPED: The mic was stripped of this packet. Decryption was
   *	done by the hardware
   * @RX_FLAG_ONLY_MONITOR: Report frame only to monitor interfaces without
-@@ -1458,22 +1456,21 @@ enum mac80211_rx_flags {
+@@ -1460,22 +1458,21 @@ enum mac80211_rx_flags {
  	RX_FLAG_AMPDU_LAST_KNOWN	= BIT(12),
  	RX_FLAG_AMPDU_IS_LAST		= BIT(13),
  	RX_FLAG_AMPDU_DELIM_CRC_ERROR	= BIT(14),
diff --git a/package/kernel/mac80211/patches/ath11k_nss/640-006-mac80211-add-eht-radiotap.patch b/package/kernel/mac80211/patches/ath11k_nss/640-006-mac80211-add-eht-radiotap.patch
index b8d2b614dd4759..79146df5447b8b 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/640-006-mac80211-add-eht-radiotap.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/640-006-mac80211-add-eht-radiotap.patch
@@ -321,7 +321,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
   */
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1439,7 +1439,11 @@ ieee80211_tx_info_clear_status(struct ie
+@@ -1441,7 +1441,11 @@ ieee80211_tx_info_clear_status(struct ie
   *	known the frame shouldn't be reported.
   * @RX_FLAG_8023: the frame has an 802.3 header (decap offload performed by
   *	hardware or driver)
@@ -333,7 +333,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
  enum mac80211_rx_flags {
  	RX_FLAG_MMIC_ERROR		= BIT(0),
  	RX_FLAG_DECRYPTED		= BIT(1),
-@@ -1471,6 +1475,8 @@ enum mac80211_rx_flags {
+@@ -1473,6 +1477,8 @@ enum mac80211_rx_flags {
  	RX_FLAG_RADIOTAP_LSIG           = BIT(27),
  	RX_FLAG_NO_PSDU                 = BIT(28),
  	RX_FLAG_8023                    = BIT(29),
@@ -342,7 +342,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
  };
  
  /**
-@@ -1538,6 +1544,7 @@ enum mac80211_rx_encoding {
+@@ -1540,6 +1546,7 @@ enum mac80211_rx_encoding {
   *	HT or VHT is used (%RX_FLAG_HT/%RX_FLAG_VHT)
   * @nss: number of streams (VHT, HE and EHT only)
   * @flag: %RX_FLAG_\*
@@ -350,7 +350,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
   * @encoding: &enum mac80211_rx_encoding
   * @bw: &enum rate_info_bw
   * @enc_flags: uses bits from &enum mac80211_rx_encoding_flags
-@@ -1591,6 +1598,7 @@ struct ieee80211_rx_status {
+@@ -1593,6 +1600,7 @@ struct ieee80211_rx_status {
  	u8 ampdu_delimiter_crc;
  	u8 zero_length_psdu_type;
  	u8 link_valid:1, link_id:4;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/900-fix-build.patch b/package/kernel/mac80211/patches/ath11k_nss/900-fix-build.patch
index 67d6e5285bdd94..180fb7feab2e49 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/900-fix-build.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/900-fix-build.patch
@@ -56,7 +56,7 @@
  	if (rxcb->is_mcbc) {
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -9224,7 +9224,7 @@ void cfg80211_bss_flush(struct wiphy *wi
+@@ -9228,7 +9228,7 @@ void cfg80211_bss_flush(struct wiphy *wi
   * @count: the number of TBTTs until the color change happens
   * @color_bitmap: representations of the colors that the local BSS is aware of
   */
@@ -65,7 +65,7 @@
  			      enum nl80211_commands cmd, u8 count,
  			      u64 color_bitmap);
  
-@@ -9234,9 +9234,9 @@ int cfg80211_bss_color_notify(struct net
+@@ -9238,9 +9238,9 @@ int cfg80211_bss_color_notify(struct net
   * @color_bitmap: representations of the colors that the local BSS is aware of
   */
  static inline int cfg80211_obss_color_collision_notify(struct net_device *dev,
@@ -77,7 +77,7 @@
  					 0, color_bitmap);
  }
  
-@@ -9250,7 +9250,7 @@ static inline int cfg80211_obss_color_co
+@@ -9254,7 +9254,7 @@ static inline int cfg80211_obss_color_co
  static inline int cfg80211_color_change_started_notify(struct net_device *dev,
  						       u8 count)
  {
@@ -86,7 +86,7 @@
  					 count, 0);
  }
  
-@@ -9262,7 +9262,7 @@ static inline int cfg80211_color_change_
+@@ -9266,7 +9266,7 @@ static inline int cfg80211_color_change_
   */
  static inline int cfg80211_color_change_aborted_notify(struct net_device *dev)
  {
@@ -95,7 +95,7 @@
  					 0, 0);
  }
  
-@@ -9274,7 +9274,7 @@ static inline int cfg80211_color_change_
+@@ -9278,7 +9278,7 @@ static inline int cfg80211_color_change_
   */
  static inline int cfg80211_color_change_notify(struct net_device *dev)
  {
@@ -106,7 +106,7 @@
  }
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -5239,6 +5239,10 @@ void ieee80211_tx_status_ext(struct ieee
+@@ -5241,6 +5241,10 @@ void ieee80211_tx_status_ext(struct ieee
   *	(NULL for multicast packets)
   * @info: tx status information
   */
@@ -119,7 +119,7 @@
  					     struct ieee80211_tx_info *info)
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -4775,7 +4775,7 @@ void ieee80211_color_collision_detection
+@@ -4777,7 +4777,7 @@ void ieee80211_color_collision_detection
  	struct ieee80211_sub_if_data *sdata = link->sdata;
  
  	sdata_lock(sdata);
@@ -141,7 +141,7 @@
  	sdata->debugfs.subdir_stations = debugfs_create_dir("stations",
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -1406,18 +1406,6 @@ static void __sta_info_destroy_part2(str
+@@ -1407,18 +1407,6 @@ static void __sta_info_destroy_part2(str
  		WARN_ON_ONCE(ret);
  	}
  
@@ -195,7 +195,7 @@
  	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -19406,7 +19406,7 @@ void cfg80211_ch_switch_started_notify(s
+@@ -19414,7 +19414,7 @@ void cfg80211_ch_switch_started_notify(s
  }
  EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
  
@@ -204,7 +204,7 @@
  			      enum nl80211_commands cmd, u8 count,
  			      u64 color_bitmap)
  {
-@@ -19420,7 +19420,7 @@ int cfg80211_bss_color_notify(struct net
+@@ -19428,7 +19428,7 @@ int cfg80211_bss_color_notify(struct net
  
  	trace_cfg80211_bss_color_notify(dev, cmd, count, color_bitmap);
  
@@ -213,7 +213,7 @@
  	if (!msg)
  		return -ENOMEM;
  
-@@ -19443,7 +19443,7 @@ int cfg80211_bss_color_notify(struct net
+@@ -19451,7 +19451,7 @@ int cfg80211_bss_color_notify(struct net
  	genlmsg_end(msg, hdr);
  
  	return genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
diff --git a/package/kernel/mac80211/patches/ath11k_nss/902-000-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch b/package/kernel/mac80211/patches/ath11k_nss/902-000-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
index f0fc8c14ec1efd..7dc88faed71f9f 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/902-000-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/902-000-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
@@ -21,7 +21,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -5100,6 +5100,17 @@ void ieee80211_sta_pspoll(struct ieee802
+@@ -5102,6 +5102,17 @@ void ieee80211_sta_pspoll(struct ieee802
   */
  void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *sta, u8 tid);
  
@@ -41,7 +41,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
   * This is enough for the radiotap header.
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2176,7 +2176,13 @@ static int ieee80211_change_station(stru
+@@ -2177,7 +2177,13 @@ static int ieee80211_change_station(stru
  
  			rcu_assign_pointer(vlansdata->u.vlan.sta, sta);
  			__ieee80211_check_fast_rx_iface(vlansdata);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/902-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch b/package/kernel/mac80211/patches/ath11k_nss/902-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
index 143191f6a9bca9..33eb5d2001db91 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/902-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/902-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
@@ -24,7 +24,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2089,6 +2089,8 @@ enum ieee80211_key_flags {
+@@ -2091,6 +2091,8 @@ enum ieee80211_key_flags {
   * @tx_pn: PN used for TX keys, may be used by the driver as well if it
   *	needs to do software PN assignment by itself (e.g. due to TSO)
   * @flags: key flags, see &enum ieee80211_key_flags.
@@ -33,7 +33,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
   * @keyidx: the key index (0-3)
   * @keylen: key material length
   * @key: key material. For ALG_TKIP the key is encoded as a 256-bit (32 byte)
-@@ -2108,6 +2110,7 @@ struct ieee80211_key_conf {
+@@ -2110,6 +2112,7 @@ struct ieee80211_key_conf {
  	u8 hw_key_idx;
  	s8 keyidx;
  	u16 flags;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/902-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch b/package/kernel/mac80211/patches/ath11k_nss/902-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch
index 12d42ddaa9ba9c..0e6c0d92d2abde 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/902-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/902-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch
@@ -26,7 +26,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -655,6 +655,7 @@ struct ath11k {
+@@ -634,6 +634,7 @@ struct ath11k {
  	struct ath11k_pdev_wmi *wmi;
  #ifdef CPTCFG_ATH11K_NSS_SUPPORT
  	struct ath11k_nss nss;
@@ -34,7 +34,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  #endif
  	struct ath11k_pdev_dp dp;
  	u8 mac_addr[ETH_ALEN];
-@@ -1065,6 +1066,8 @@ struct ath11k_base {
+@@ -1042,6 +1043,8 @@ struct ath11k_base {
  	u32 rx_hash;
  	bool stats_disable;
  
@@ -45,7 +45,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  };
 --- a/drivers/net/wireless/ath/ath11k/dp.h
 +++ b/drivers/net/wireless/ath/ath11k/dp.h
-@@ -1181,13 +1181,16 @@ struct htt_t2h_peer_map_event {
+@@ -1142,13 +1142,16 @@ struct htt_t2h_peer_map_event {
  #define HTT_T2H_PEER_UNMAP_INFO_PEER_ID	HTT_T2H_PEER_MAP_INFO_PEER_ID
  #define HTT_T2H_PEER_UNMAP_INFO1_MAC_ADDR_H16 \
  					HTT_T2H_PEER_MAP_INFO1_MAC_ADDR_H16
@@ -66,7 +66,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  struct htt_resp_msg {
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -1890,6 +1890,8 @@ void ath11k_dp_htt_htc_t2h_msg_handler(s
+@@ -1756,6 +1756,8 @@ void ath11k_dp_htt_htc_t2h_msg_handler(s
  	u16 peer_mac_h16;
  	u16 ast_hash;
  	u16 hw_peer_id;
@@ -75,7 +75,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
  	ath11k_dbg(ab, ATH11K_DBG_DP_HTT, "dp_htt rx msg type :0x%0x\n", type);
  
-@@ -1925,15 +1927,29 @@ void ath11k_dp_htt_htc_t2h_msg_handler(s
+@@ -1791,15 +1793,29 @@ void ath11k_dp_htt_htc_t2h_msg_handler(s
  				     resp->peer_map_ev.info2);
  		hw_peer_id = FIELD_GET(HTT_T2H_PEER_MAP_INFO1_HW_PEER_ID,
  				       resp->peer_map_ev.info1);
@@ -630,9 +630,9 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	if (sta) {
 --- a/drivers/net/wireless/ath/ath11k/peer.h
 +++ b/drivers/net/wireless/ath/ath11k/peer.h
-@@ -18,6 +18,47 @@ struct ppdu_user_delayba {
- 	u32 resp_rate_flags;
- };
+@@ -7,6 +7,47 @@
+ #ifndef ATH11K_PEER_H
+ #define ATH11K_PEER_H
  
 +enum ath11k_ast_entry_type {
 +	ATH11K_AST_TYPE_NONE, /* static ast entry for connected peer */
@@ -678,7 +678,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  struct ath11k_peer {
  	struct list_head list;
  	struct ieee80211_sta *sta;
-@@ -29,6 +70,10 @@ struct ath11k_peer {
+@@ -18,6 +59,10 @@ struct ath11k_peer {
  	u8 pdev_idx;
  	u16 hw_peer_id;
  	struct ath11k_nss_peer nss;
@@ -689,7 +689,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
  	/* protected by ab->data_lock */
  	struct ieee80211_key_conf *keys[WMI_MAX_KEY_INDEX + 1];
-@@ -54,8 +99,13 @@ struct ath11k_peer {
+@@ -41,8 +86,13 @@ struct ath11k_peer {
  };
  
  void ath11k_peer_unmap_event(struct ath11k_base *ab, u16 peer_id);
@@ -703,7 +703,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  struct ath11k_peer *ath11k_peer_find(struct ath11k_base *ab, int vdev_id,
  				     const u8 *addr);
  struct ath11k_peer *ath11k_peer_find_by_addr(struct ath11k_base *ab,
-@@ -72,4 +122,71 @@ struct ath11k_peer *ath11k_peer_find_by_
+@@ -59,4 +109,71 @@ struct ath11k_peer *ath11k_peer_find_by_
  int ath11k_peer_rhash_tbl_init(struct ath11k_base *ab);
  void ath11k_peer_rhash_tbl_destroy(struct ath11k_base *ab);
  int ath11k_peer_rhash_delete(struct ath11k_base *ab, struct ath11k_peer *peer);
@@ -837,7 +837,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  int ath11k_wmi_send_pdev_set_regdomain(struct ath11k *ar,
  				       struct pdev_set_regdomain_params *param)
  {
-@@ -6484,6 +6530,36 @@ static int ath11k_pull_peer_assoc_conf_e
+@@ -6419,6 +6465,36 @@ static int ath11k_pull_peer_assoc_conf_e
  	return 0;
  }
  
@@ -874,7 +874,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  static void ath11k_wmi_pull_pdev_stats_base(const struct wmi_pdev_stats_base *src,
  					    struct ath11k_fw_stats_pdev *dst)
  {
-@@ -7399,6 +7475,7 @@ static int ath11k_wmi_tlv_rdy_parse(stru
+@@ -7334,6 +7410,7 @@ static int ath11k_wmi_tlv_rdy_parse(stru
  
  		ether_addr_copy(ab->mac_addr,
  				fixed_param.ready_event_min.mac_addr.addr);
@@ -882,7 +882,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		ab->pktlog_defs_checksum = fixed_param.pktlog_defs_checksum;
  		break;
  	case WMI_TAG_ARRAY_FIXED_STRUCT:
-@@ -8870,6 +8947,22 @@ static void ath11k_wmi_gtk_offload_statu
+@@ -8805,6 +8882,22 @@ static void ath11k_wmi_gtk_offload_statu
  	kfree(tb);
  }
  
@@ -905,7 +905,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  static void ath11k_wmi_tlv_op_rx(struct ath11k_base *ab, struct sk_buff *skb)
  {
  	struct wmi_cmd_hdr *cmd_hdr;
-@@ -9000,6 +9093,9 @@ static void ath11k_wmi_tlv_op_rx(struct
+@@ -8935,6 +9028,9 @@ static void ath11k_wmi_tlv_op_rx(struct
  	case WMI_QOS_NULL_FRAME_TX_COMPLETION_EVENTID:
  		ath11k_qos_null_compl_event(ab, skb);
  		break;
@@ -961,7 +961,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  /*
   * PDEV statistics
   */
-@@ -6503,6 +6533,9 @@ int ath11k_wmi_set_sta_ps_param(struct a
+@@ -6430,6 +6460,9 @@ int ath11k_wmi_set_sta_ps_param(struct a
  int ath11k_wmi_force_fw_hang_cmd(struct ath11k *ar, u32 type, u32 delay_time_ms);
  int ath11k_wmi_send_peer_delete_cmd(struct ath11k *ar,
  				    const u8 *peer_addr, u8 vdev_id);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/902-ath11k-add-HE-stats-in-peer-stats.patch b/package/kernel/mac80211/patches/ath11k_nss/902-ath11k-add-HE-stats-in-peer-stats.patch
index edb60ac18bef10..4831424fa40810 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/902-ath11k-add-HE-stats-in-peer-stats.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/902-ath11k-add-HE-stats-in-peer-stats.patch
@@ -363,7 +363,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  /* HTT_H2T_MSG_TYPE_RX_RING_SELECTION_CFG Message
   *
   * details:
-@@ -1312,6 +1351,19 @@ enum htt_ppdu_stats_gi {
+@@ -1315,6 +1354,19 @@ enum htt_ppdu_stats_gi {
  #define HTT_PPDU_STATS_USER_RATE_INFO0_USER_POS_M	GENMASK(3, 0)
  #define HTT_PPDU_STATS_USER_RATE_INFO0_MU_GROUP_ID_M	GENMASK(11, 4)
  
@@ -383,7 +383,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  #define HTT_PPDU_STATS_USER_RATE_INFO1_RESP_TYPE_VALD_M	BIT(0)
  #define HTT_PPDU_STATS_USER_RATE_INFO1_PPDU_TYPE_M	GENMASK(5, 1)
  
-@@ -1339,6 +1391,12 @@ enum htt_ppdu_stats_gi {
+@@ -1342,6 +1394,12 @@ enum htt_ppdu_stats_gi {
  		FIELD_GET(HTT_PPDU_STATS_USER_RATE_FLAGS_GI_M, _val)
  #define HTT_USR_RATE_DCM(_val) \
  		FIELD_GET(HTT_PPDU_STATS_USER_RATE_FLAGS_DCM_M, _val)
@@ -396,7 +396,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  
  #define HTT_PPDU_STATS_USER_RATE_RESP_FLAGS_LTF_SIZE_M		GENMASK(1, 0)
  #define HTT_PPDU_STATS_USER_RATE_RESP_FLAGS_STBC_M		BIT(2)
-@@ -1442,6 +1500,21 @@ struct htt_ppdu_stats_usr_cmpltn_ack_ba_
+@@ -1445,6 +1503,21 @@ struct htt_ppdu_stats_usr_cmpltn_ack_ba_
  	u32 success_bytes;
  } __packed;
  
@@ -418,7 +418,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  struct htt_ppdu_stats_usr_cmn_array {
  	struct htt_tlv tlv_hdr;
  	u32 num_ppdu_stats;
-@@ -1455,14 +1528,16 @@ struct htt_ppdu_stats_usr_cmn_array {
+@@ -1458,14 +1531,16 @@ struct htt_ppdu_stats_usr_cmn_array {
  
  struct htt_ppdu_user_stats {
  	u16 peer_id;
@@ -436,7 +436,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  #define HTT_PPDU_DESC_MAX_DEPTH	16
  
  struct htt_ppdu_stats {
-@@ -1471,7 +1546,7 @@ struct htt_ppdu_stats {
+@@ -1474,7 +1549,7 @@ struct htt_ppdu_stats {
  };
  
  struct htt_ppdu_stats_info {
@@ -748,9 +748,9 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  #define RU_52  2
 --- a/drivers/net/wireless/ath/ath11k/peer.h
 +++ b/drivers/net/wireless/ath/ath11k/peer.h
-@@ -7,6 +7,17 @@
- #ifndef ATH11K_PEER_H
- #define ATH11K_PEER_H
+@@ -48,6 +48,17 @@ struct ath11k_ast_entry {
+ 	struct list_head ase_list;
+ };
  
 +struct ppdu_user_delayba {
 +	u8 reserved0;
@@ -766,7 +766,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  struct ath11k_peer {
  	struct list_head list;
  	struct ieee80211_sta *sta;
-@@ -38,6 +49,8 @@ struct ath11k_peer {
+@@ -83,6 +94,8 @@ struct ath11k_peer {
  	u16 sec_type_grp;
  	bool is_authorized;
  	bool dp_setup_done;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/902-ath11k-add-btcoex-config.patch b/package/kernel/mac80211/patches/ath11k_nss/902-ath11k-add-btcoex-config.patch
index 18bc4384094eca..495245f9662462 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/902-ath11k-add-btcoex-config.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/902-ath11k-add-btcoex-config.patch
@@ -29,7 +29,7 @@
  struct ath11k {
  	struct ath11k_base *ab;
  	struct ath11k_pdev *pdev;
-@@ -759,6 +769,8 @@ struct ath11k {
+@@ -760,6 +770,8 @@ struct ath11k {
  	struct ath11k_per_peer_tx_stats cached_stats;
  	u32 last_ppdu_id;
  	u32 cached_ppdu_id;
@@ -56,7 +56,7 @@
  #include "nss.h"
  
  #define CHAN2G(_channel, _freq, _flags) { \
-@@ -9282,6 +9284,91 @@ err_fallback:
+@@ -9286,6 +9288,91 @@ err_fallback:
  	return 0;
  }
  
@@ -148,7 +148,7 @@
  static const struct ieee80211_ops ath11k_ops = {
  	.tx				= ath11k_mac_op_tx,
  	.wake_tx_queue			= ieee80211_handle_wake_tx_queue,
-@@ -9521,6 +9608,56 @@ static int ath11k_mac_setup_iface_combin
+@@ -9525,6 +9612,56 @@ static int ath11k_mac_setup_iface_combin
  	return 0;
  }
  
@@ -205,7 +205,7 @@
  static const u8 ath11k_if_types_ext_capa[] = {
  	[0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING,
  	[2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT,
-@@ -9782,6 +9919,7 @@ static int __ath11k_mac_register(struct
+@@ -9786,6 +9923,7 @@ static int __ath11k_mac_register(struct
  	ar->hw->wiphy->ema_max_profile_periodicity = TARGET_EMA_MAX_PROFILE_PERIOD;
  
  	ath11k_reg_init(ar);
@@ -213,7 +213,7 @@
  
  	if (!test_bit(ATH11K_FLAG_RAW_MODE, &ab->dev_flags)) {
  		ar->hw->netdev_features = NETIF_F_HW_CSUM;
-@@ -9944,6 +10082,7 @@ int ath11k_mac_allocate(struct ath11k_ba
+@@ -9948,6 +10086,7 @@ int ath11k_mac_allocate(struct ath11k_ba
  		 */
  		ath11k_wmi_pdev_attach(ab, i);
  
@@ -447,7 +447,7 @@
 +#endif /* QCA_VENDOR_H */
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
-@@ -1697,6 +1697,71 @@ int ath11k_wmi_vdev_set_param_cmd(struct
+@@ -1743,6 +1743,71 @@ int ath11k_wmi_vdev_set_param_cmd(struct
  	return ret;
  }
  
@@ -521,7 +521,7 @@
  {
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
-@@ -5303,6 +5303,79 @@ struct wmi_wmm_params_arg {
+@@ -5333,6 +5333,79 @@ struct wmi_wmm_params_arg {
  	u8 no_ack;
  };
  
@@ -601,7 +601,7 @@
  struct wmi_vdev_set_wmm_params_cmd {
  	u32 tlv_header;
  	u32 vdev_id;
-@@ -6520,6 +6593,8 @@ int ath11k_wmi_pdev_non_srg_obss_color_e
+@@ -6553,6 +6626,8 @@ int ath11k_wmi_pdev_non_srg_obss_color_e
  						     u32 *bitmap);
  int ath11k_wmi_pdev_non_srg_obss_bssid_enable_bitmap(struct ath11k *ar,
  						     u32 *bitmap);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/903-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch b/package/kernel/mac80211/patches/ath11k_nss/903-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
index 86714fea844e81..de7bc77ef53456 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/903-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/903-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
@@ -489,7 +489,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		list_del(&ast_entry->ase_list);
 --- a/drivers/net/wireless/ath/ath11k/peer.h
 +++ b/drivers/net/wireless/ath/ath11k/peer.h
-@@ -34,6 +34,7 @@ enum ath11k_ast_entry_type {
+@@ -23,6 +23,7 @@ enum ath11k_ast_entry_type {
  enum ath11k_wds_wmi_action {
  	ATH11K_WDS_WMI_ADD = 1,
  	ATH11K_WDS_WMI_UPDATE,
diff --git a/package/kernel/mac80211/patches/ath11k_nss/904-002-ath11k-extend-ext-vdev-in-NSS-for-dynamic-VLAN-handling.patch b/package/kernel/mac80211/patches/ath11k_nss/904-002-ath11k-extend-ext-vdev-in-NSS-for-dynamic-VLAN-handling.patch
index c97edcd605d7f1..14274b6a72680a 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/904-002-ath11k-extend-ext-vdev-in-NSS-for-dynamic-VLAN-handling.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/904-002-ath11k-extend-ext-vdev-in-NSS-for-dynamic-VLAN-handling.patch
@@ -15,7 +15,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/nss.c
 +++ b/drivers/net/wireless/ath/ath11k/nss.c
-@@ -1483,14 +1483,11 @@ static int ath11k_nss_ext_vdev_register(
+@@ -1570,14 +1570,11 @@ static int ath11k_nss_ext_vdev_register(
  	struct ath11k *ar = arvif->ar;
  	struct ath11k_base *ab = ar->ab;
  	nss_tx_status_t status;
@@ -30,7 +30,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	arvif->nss.ctx = nss_wifi_ext_vdev_register_if(arvif->nss.if_num,
  						       ath11k_nss_ext_vdev_data_receive,
  						       ath11k_nss_ext_vdev_special_data_receive,
-@@ -1518,7 +1515,8 @@ static void ath11k_nss_ext_vdev_free(str
+@@ -1605,7 +1602,8 @@ static void ath11k_nss_ext_vdev_free(str
  
  	status = nss_dynamic_interface_dealloc_node(
  					arvif->nss.if_num,
@@ -40,7 +40,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	if (status != NSS_TX_SUCCESS)
  		ath11k_warn(ab, "failed to free nss ext vdev err:%d\n",
  			    status);
-@@ -1527,14 +1525,19 @@ static void ath11k_nss_ext_vdev_free(str
+@@ -1614,14 +1612,19 @@ static void ath11k_nss_ext_vdev_free(str
  			   "nss ext vdev interface deallocated\n");
  }
  
@@ -62,7 +62,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	if_num = nss_dynamic_interface_alloc_node(di_type);
  	if (if_num < 0) {
  		ath11k_warn(ab, "failed to allocate nss ext vdev\n");
-@@ -1543,8 +1546,8 @@ static int ath11k_nss_ext_vdev_alloc(str
+@@ -1630,8 +1633,8 @@ static int ath11k_nss_ext_vdev_alloc(str
  
  	arvif->nss.if_num = if_num;
  	ath11k_dbg(ab, ATH11K_DBG_NSS_WDS,
@@ -73,7 +73,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
  	return 0;
  }
-@@ -1573,7 +1576,7 @@ int ath11k_nss_ext_vdev_create(struct at
+@@ -1660,7 +1663,7 @@ int ath11k_nss_ext_vdev_create(struct at
  		return -EINVAL;
  	}
  
@@ -82,7 +82,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	if (ret)
  		return ret;
  
-@@ -1684,6 +1687,86 @@ free:
+@@ -1773,6 +1776,86 @@ free:
  	return ret;
  }
  
@@ -171,7 +171,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  int ath11k_nss_set_peer_sec_type(struct ath11k *ar,
 --- a/drivers/net/wireless/ath/ath11k/nss.h
 +++ b/drivers/net/wireless/ath/ath11k/nss.h
-@@ -150,6 +150,10 @@ struct arvif_nss {
+@@ -179,6 +179,10 @@ struct arvif_nss {
  	bool added;
  	/* Flag to notify if ext vdev is up/down */
  	bool ext_vdev_up;
@@ -182,7 +182,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	/* WDS cfg should be done only once for ext vdev */
  	bool wds_cfg_done;
  	bool created;
-@@ -215,6 +217,9 @@ void ath11k_nss_ext_vdev_unregister(stru
+@@ -246,6 +250,9 @@ void ath11k_nss_ext_vdev_unregister(stru
  int ath11k_nss_ext_vdev_up(struct ath11k_vif *arvif);
  int ath11k_nss_ext_vdev_down(struct ath11k_vif *arvif);
  void ath11k_nss_ext_vdev_delete(struct ath11k_vif *arvif);
@@ -192,7 +192,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  int ath11k_nss_set_peer_sec_type(struct ath11k *ar, struct ath11k_peer *peer,
  				 struct ieee80211_key_conf *key_conf);
  void ath11k_nss_update_sta_stats(struct ath11k_vif *arvif,
-@@ -343,6 +348,18 @@ static inline int ath11k_nss_ext_vdev_do
+@@ -378,6 +385,18 @@ static inline int ath11k_nss_ext_vdev_do
  {
  	return 0;
  }

From 8eb9fb12fcb9d3295bb96260a9ddee1ba15ca0e2 Mon Sep 17 00:00:00 2001
From: Qosmio <datapronix@protonmail.com>
Date: Mon, 8 Jan 2024 03:08:03 -0500
Subject: [PATCH 083/225] ath11k_nss: fix ordering of sysctl values

`dev.nss.n2hcfg.n2h_wifi_pool_buf` must be set BEFORE setting
`dev.nss.n2hcfg.n2h_high_water_core0`, otherwise it resets the value.
---
 .../mac80211/files/etc/init.d/qca-nss-pbuf    | 29 +++++++++----------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/package/kernel/mac80211/files/etc/init.d/qca-nss-pbuf b/package/kernel/mac80211/files/etc/init.d/qca-nss-pbuf
index 40f05c46fb28fb..11604d15dc5c47 100755
--- a/package/kernel/mac80211/files/etc/init.d/qca-nss-pbuf
+++ b/package/kernel/mac80211/files/etc/init.d/qca-nss-pbuf
@@ -18,16 +18,23 @@ START=20
 
 apply_sysctl() {
   [ $(sysctl -n -e dev.nss.general.redirect) = "0" ] && /etc/init.d/qca-nss-ecm start
+  # Running this script multiple times is useless, as extra_pbuf_core0
+  # can't be changed if it is allocated, assume it's already been run.
+  extra_pbuf_core0=$(sysctl -n -e dev.nss.n2hcfg.extra_pbuf_core0)
 
-  logger -t ath11k_nss "$board - setting dev.nss.n2hcfg.extra_pbuf_core0=$extra_pbuf_core0"
-  sysctl -w dev.nss.n2hcfg.extra_pbuf_core0=$extra_pbuf_core0 > /dev/null 2> /dev/null
-
-  logger -t ath11k_nss "$board - setting dev.nss.n2hcfg.n2h_high_water_core0=$n2h_high_water_core0"
-  sysctl -w dev.nss.n2hcfg.n2h_high_water_core0=$n2h_high_water_core0 > /dev/null 2> /dev/null
+  if [ "$extra_pbuf_core0" = "0" ]; then
+    logger -t ath11k_nss "$board - setting dev.nss.n2hcfg.extra_pbuf_core0=$extra_pbuf_core0"
+    sysctl -w dev.nss.n2hcfg.extra_pbuf_core0=$extra_pbuf_core0 > /dev/null 2> /dev/null
+  else
+    logger -t ath11k_nss "Sysctl key 'extra_pbuf_core0' already set to '"$extra_pbuf_core0"'. Skipping applying wifi nss configs"
+  fi
 
   logger -t ath11k_nss "$board - setting dev.nss.n2hcfg.n2h_wifi_pool_buf=$n2h_wifi_pool_buf"
   sysctl -w dev.nss.n2hcfg.n2h_wifi_pool_buf=$n2h_wifi_pool_buf > /dev/null 2> /dev/null
 
+  logger -t ath11k_nss "$board - setting dev.nss.n2hcfg.n2h_high_water_core0=$n2h_high_water_core0"
+  sysctl -w dev.nss.n2hcfg.n2h_high_water_core0=$n2h_high_water_core0
+
 }
 
 apply_nss_config() {
@@ -51,7 +58,7 @@ apply_nss_config() {
     qnap,301w | \
     xiaomi,ax9000 | \
     zyxel,nbg7815)
-      extra_pbuf_core0=10000000 n2h_high_water_core0=72512 n2h_wifi_pool_buf=36864 apply_sysctl
+      extra_pbuf_core0=9000000 n2h_high_water_core0=67392 n2h_wifi_pool_buf=40960 apply_sysctl
       ;;
     # 512MB profile
     edimax,cax1800 | \
@@ -79,13 +86,5 @@ start() {
     exit 1
   fi
 
-  # Running this script multiple times is useless, as extra_pbuf_core0
-  # can't be changed if it is allocated, assume it's already been run.
-  extra_pbuf_core0=$(sysctl -n -e dev.nss.n2hcfg.extra_pbuf_core0)
-
-  if [ "$extra_pbuf_core0" = "0" ]; then
-    apply_nss_config
-  else
-    logger -t ath11k_nss "Sysctl key 'extra_pbuf_core0' already set to '"$extra_pbuf_core0"'. Skipping applying wifi nss configs"
-  fi
+  apply_nss_config
 }

From 005d831f6e54a34fa829c02ebd27b18b367ff0ae Mon Sep 17 00:00:00 2001
From: Qosmio <datapronix@protonmail.com>
Date: Tue, 9 Jan 2024 01:07:01 -0500
Subject: [PATCH 084/225] ath11k_nss: bugfix overwriting high watermark

ath11k_nss: bugfix change start order

value 'dev.nss.n2hcfg.n2h_wifi_pool_buf' was not getting set, wait till
after qca-nss-drv is loaded.

ath11k_nss: finally fix n2hcfg values not being set
---
 .../kernel/mac80211/files/etc/init.d/qca-nss-pbuf   | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/package/kernel/mac80211/files/etc/init.d/qca-nss-pbuf b/package/kernel/mac80211/files/etc/init.d/qca-nss-pbuf
index 11604d15dc5c47..50f13b33e89429 100755
--- a/package/kernel/mac80211/files/etc/init.d/qca-nss-pbuf
+++ b/package/kernel/mac80211/files/etc/init.d/qca-nss-pbuf
@@ -14,23 +14,24 @@
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 #
 
-START=20
+START=71
 
 apply_sysctl() {
-  [ $(sysctl -n -e dev.nss.general.redirect) = "0" ] && /etc/init.d/qca-nss-ecm start
+  [ $(sysctl -n -e dev.nss.general.redirect) -eq 0 ] && /etc/init.d/qca-nss-ecm start
+
   # Running this script multiple times is useless, as extra_pbuf_core0
   # can't be changed if it is allocated, assume it's already been run.
-  extra_pbuf_core0=$(sysctl -n -e dev.nss.n2hcfg.extra_pbuf_core0)
-
-  if [ "$extra_pbuf_core0" = "0" ]; then
+  if [ $(sysctl -n -e dev.nss.n2hcfg.extra_pbuf_core0) -eq 0 ]; then
     logger -t ath11k_nss "$board - setting dev.nss.n2hcfg.extra_pbuf_core0=$extra_pbuf_core0"
     sysctl -w dev.nss.n2hcfg.extra_pbuf_core0=$extra_pbuf_core0 > /dev/null 2> /dev/null
   else
     logger -t ath11k_nss "Sysctl key 'extra_pbuf_core0' already set to '"$extra_pbuf_core0"'. Skipping applying wifi nss configs"
   fi
 
+  sysctl -w dev.nss.n2hcfg.n2h_high_water_core0=$n2h_high_water_core0 > /dev/null 2>/dev/null
+
   logger -t ath11k_nss "$board - setting dev.nss.n2hcfg.n2h_wifi_pool_buf=$n2h_wifi_pool_buf"
-  sysctl -w dev.nss.n2hcfg.n2h_wifi_pool_buf=$n2h_wifi_pool_buf > /dev/null 2> /dev/null
+  sysctl -w dev.nss.n2hcfg.n2h_wifi_pool_buf=$n2h_wifi_pool_buf
 
   logger -t ath11k_nss "$board - setting dev.nss.n2hcfg.n2h_high_water_core0=$n2h_high_water_core0"
   sysctl -w dev.nss.n2hcfg.n2h_high_water_core0=$n2h_high_water_core0

From a184d246b4908ddfe1b9993da84738762f536267 Mon Sep 17 00:00:00 2001
From: Qosmio <datapronix@protonmail.com>
Date: Wed, 10 Jan 2024 21:01:36 -0500
Subject: [PATCH 085/225] ath11k_nss: Handle 256/512/1G boards automatically

---
 package/kernel/mac80211/ath.mk                | 45 ++++++---
 .../mac80211/files/etc/init.d/qca-nss-pbuf    |  9 +-
 ...07-ath11k-Enable-256_512MB-profiles.patch} | 95 +++++++++++++++----
 ...11k-Disable-rx_header-tlv-for-2K-SKB.patch | 26 +++--
 ...ow-fast-rx-by-bypassing-stats-update.patch |  2 +-
 5 files changed, 139 insertions(+), 38 deletions(-)
 rename package/kernel/mac80211/patches/ath11k_nss/{207-ath11k-Enable-512MB-profile-in-ath11k.patch => 207-ath11k-Enable-256_512MB-profiles.patch} (77%)

diff --git a/package/kernel/mac80211/ath.mk b/package/kernel/mac80211/ath.mk
index b109382ec7d26c..f8279d833b12bc 100644
--- a/package/kernel/mac80211/ath.mk
+++ b/package/kernel/mac80211/ath.mk
@@ -14,9 +14,10 @@ PKG_CONFIG_DEPENDS += \
 	CONFIG_ATH10K_THERMAL \
 	CONFIG_ATH11K_THERMAL \
 	CONFIG_ATH_USER_REGD \
+	CONFIG_ATH11K_MEM_PROFILE_1G \
 	CONFIG_ATH11K_MEM_PROFILE_512M \
-	CONFIG_ATH11K_NSS_SUPPORT \
-	CONFIG_ATH11K_SMART_ANT_ALG
+	CONFIG_ATH11K_MEM_PROFILE_256M \
+	CONFIG_ATH11K_NSS_SUPPORT
 
 ifdef CONFIG_PACKAGE_MAC80211_DEBUGFS
   config-y += \
@@ -62,9 +63,10 @@ config-$(CONFIG_ATH9K_UBNTHSR) += ATH9K_UBNTHSR
 config-$(CONFIG_ATH10K_LEDS) += ATH10K_LEDS
 config-$(CONFIG_ATH10K_THERMAL) += ATH10K_THERMAL
 config-$(CONFIG_ATH11K_THERMAL) += ATH11K_THERMAL
+config-$(CONFIG_ATH11K_MEM_PROFILE_1G) += ATH11K_MEM_PROFILE_1G
 config-$(CONFIG_ATH11K_MEM_PROFILE_512M) += ATH11K_MEM_PROFILE_512M
+config-$(CONFIG_ATH11K_MEM_PROFILE_256M) += ATH11K_MEM_PROFILE_256M
 config-$(CONFIG_ATH11K_NSS_SUPPORT) += ATH11K_NSS_SUPPORT
-config-$(CONFIG_ATH11K_SMART_ANT_ALG) += ATH11K_SMART_ANT_ALG
 
 config-$(call config_package,ath9k-htc) += ATH9K_HTC
 config-$(call config_package,ath10k,regular) += ATH10K ATH10K_PCI
@@ -339,20 +341,41 @@ define KernelPackage/ath11k/config
 
        config ATH11K_NSS_SUPPORT
                bool "Enable NSS WiFi offload"
+               select ATH11K_MEM_PROFILE_512M if (TARGET_qualcommax_ipq807x_DEVICE_edimax_cax1800 || \
+               	 TARGET_qualcommax_ipq807x_DEVICE_compex_wpq873 || \
+               	 TARGET_qualcommax_ipq807x_DEVICE_linksys_mx4200v1 || \
+               	 TARGET_qualcommax_ipq807x_DEVICE_redmi_ax6 || \
+               	 TARGET_qualcommax_ipq807x_DEVICE_xiaomi_ax3600 || \
+               	 TARGET_qualcommax_ipq807x_DEVICE_zte_mf269 )
+               select ATH11K_MEM_PROFILE_256M if (TARGET_qualcommax_ipq807x_DEVICE_netgear_wax218)
                select NSS_DRV_WIFI_ENABLE
                select NSS_DRV_WIFI_EXT_VDEV_ENABLE
                default y if TARGET_qualcommax
 
-       config ATH11K_MEM_PROFILE_512M
-               bool "Use limits for the 512MB memory size"
-               default n
+       choice
+          prompt "ATH11K Memory Profile"
+            default ATH11K_MEM_PROFILE_1G
+            help
+            	This option allows you to select the memory profile.
+            	It should correspond to the total RAM of your board.
+
+          config ATH11K_MEM_PROFILE_1G
+               bool "Use 1G memory profile"
+               help
+                  This allows configuring ath11k for boards with 1GB+ memory.
+
+          config ATH11K_MEM_PROFILE_512M
+               bool "Use 512MB memory profile"
                help
-                  This allows selecting the ath11k memory size profile to be used.
+                  This allows configuring ath11k for boards with 512M memory.
+                  The default is 1GB if not selected
 
-       config ATH11K_SMART_ANT_ALG
-               bool "Enable smart antenna"
-               depends on PACKAGE_ATH_DEBUG
-               default n
+          config ATH11K_MEM_PROFILE_256M
+               bool "Use 256MB memory profile"
+               help
+                  This allows configuring ath11k for boards with 256M memory.
+                  The default is 1GB if not selected
+       endchoice
 endef
 
 define KernelPackage/ath11k-ahb
diff --git a/package/kernel/mac80211/files/etc/init.d/qca-nss-pbuf b/package/kernel/mac80211/files/etc/init.d/qca-nss-pbuf
index 50f13b33e89429..260726fb12d871 100755
--- a/package/kernel/mac80211/files/etc/init.d/qca-nss-pbuf
+++ b/package/kernel/mac80211/files/etc/init.d/qca-nss-pbuf
@@ -47,24 +47,29 @@ apply_nss_config() {
 
   case "$board" in
     # 1GB+ profile
+    arcadyan,aw1000 | \
     buffalo,wxr-5950ax12 | \
     dynalink,dl-wrx36 | \
     edgecore,eap102 | \
-    linksys,mx5300 | \
     linksys,mx4200v2 | \
+    linksys,mx5300 | \
     netgear,rax120v2 | \
     netgear,wax620 | \
     netgear,wax630 | \
     prpl,haze | \
     qnap,301w | \
     xiaomi,ax9000 | \
+    yuncore,ax880 | \
     zyxel,nbg7815)
       extra_pbuf_core0=9000000 n2h_high_water_core0=67392 n2h_wifi_pool_buf=40960 apply_sysctl
       ;;
     # 512MB profile
     edimax,cax1800 | \
+    compex,wpq873 | \
     linksys,mx4200v1 | \
-    xiaomi,ax3600) # 512MB profile
+    redmi,ax6 | \
+    xiaomi,ax3600 | \
+    zte,mf269) # 512MB profile
       extra_pbuf_core0=3100000 n2h_high_water_core0=30624 n2h_wifi_pool_buf=8192 apply_sysctl
       ;;
     # 256MB profile
diff --git a/package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Enable-512MB-profile-in-ath11k.patch b/package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Enable-256_512MB-profiles.patch
similarity index 77%
rename from package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Enable-512MB-profile-in-ath11k.patch
rename to package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Enable-256_512MB-profiles.patch
index 0e7ddb8539a207..a4c063ce69ba49 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Enable-512MB-profile-in-ath11k.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Enable-256_512MB-profiles.patch
@@ -22,7 +22,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/Kconfig
 +++ b/drivers/net/wireless/ath/ath11k/Kconfig
-@@ -23,6 +23,13 @@ config ATH11K_NSS_SUPPORT
+@@ -23,6 +23,20 @@ config ATH11K_NSS_SUPPORT
  
  	  If unsure, say Y to enable NSS offload support.
  
@@ -32,36 +32,59 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
 +	default n
 +	---help---
 +	Enables 512MB memory profile for ath11k
++
++config ATH11K_MEM_PROFILE_256M
++	bool "ath11k enable 256MB memory profile"
++	depends on ATH11K
++	default n
++	---help---
++	Enables 256MB memory profile for ath11k
 +
  config ATH11K_AHB
  	tristate "Atheros ath11k AHB support"
  	depends on m
 --- a/drivers/net/wireless/ath/ath11k/hw.h
 +++ b/drivers/net/wireless/ath/ath11k/hw.h
-@@ -11,11 +11,30 @@
+@@ -11,11 +11,43 @@
  #include "wmi.h"
  
  /* Target configuration defines */
-+#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
- 
++#if defined(CPTCFG_ATH11K_MEM_PROFILE_256M)
++#define TARGET_NUM_VDEVS	8
++#define TARGET_NUM_PEERS_PDEV	(128 + TARGET_NUM_VDEVS)
++/* Max num of stations (per radio) */
++#define TARGET_NUM_STATIONS	128
++#define ATH11K_QMI_TARGET_MEM_MODE	ATH11K_QMI_TARGET_MEM_MODE_512M
++#define ATH11K_DP_TX_COMP_RING_SIZE	2048
++#define ATH11K_DP_RXDMA_BUF_RING_SIZE		1024
++#define ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE	512
++#define ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE	128
++#define ATH11K_DP_RXDMA_MONITOR_DST_RING_SIZE	128
++
++#elif defined(CPTCFG_ATH11K_MEM_PROFILE_512M)
 +#define TARGET_NUM_VDEVS(ab)	8
 +#define TARGET_NUM_PEERS_PDEV(ab)	(128 + TARGET_NUM_VDEVS(ab))
 +/* Max num of stations (per radio) */
 +#define TARGET_NUM_STATIONS(ab)	128
 +#define ATH11K_QMI_TARGET_MEM_MODE	ATH11K_QMI_TARGET_MEM_MODE_512M
 +#define ATH11K_DP_TX_COMP_RING_SIZE	8192
++#define ATH11K_DP_RXDMA_BUF_RING_SIZE		4096
 +#define ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE	512
 +#define ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE	128
 +#define ATH11K_DP_RXDMA_MONITOR_DST_RING_SIZE	128
+ 
 +#else
  /* Num VDEVS per radio */
- #define TARGET_NUM_VDEVS(ab)	(ab->hw_params.num_vdevs)
- 
- #define TARGET_NUM_PEERS_PDEV(ab) (ab->hw_params.num_peers + TARGET_NUM_VDEVS(ab))
+-#define TARGET_NUM_VDEVS(ab)	(ab->hw_params.num_vdevs)
+-
+-#define TARGET_NUM_PEERS_PDEV(ab) (ab->hw_params.num_peers + TARGET_NUM_VDEVS(ab))
++#define TARGET_NUM_VDEVS(ab)	(ab->hw_params.num_vdevs_peers[ab->qmi.target_mem_mode].num_vdevs)
++#define TARGET_NUM_PEERS_PDEV(ab) (ab->hw_params.num_vdevs_peers[ab->qmi.target_mem_mode].num_peers + TARGET_NUM_VDEVS(ab))
 +/* Max num of stations (per radio) */
-+#define TARGET_NUM_STATIONS(ab) (ab->hw_params.num_peers)
++#define TARGET_NUM_STATIONS(ab) (ab->hw_params.num_vdevs_peers[ab->qmi.target_mem_mode].num_peers)
 +#define ATH11K_QMI_TARGET_MEM_MODE		ATH11K_QMI_TARGET_MEM_MODE_DEFAULT
 +#define ATH11K_DP_TX_COMP_RING_SIZE		32768
++#define ATH11K_DP_RXDMA_BUF_RING_SIZE		4096
 +#define ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE	1024
 +#define ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE	4096
 +#define ATH11K_DP_RXDMA_MONITOR_DST_RING_SIZE	2048
@@ -69,7 +92,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  /* Num of peers for Single Radio mode */
  #define TARGET_NUM_PEERS_SINGLE(ab) (TARGET_NUM_PEERS_PDEV(ab))
-@@ -26,9 +45,6 @@
+@@ -26,9 +58,6 @@
  /* Num of peers for DBS_SBS */
  #define TARGET_NUM_PEERS_DBS_SBS(ab)	(3 * TARGET_NUM_PEERS_PDEV(ab))
  
@@ -79,6 +102,14 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  #define TARGET_NUM_PEERS(ab, x)	TARGET_NUM_PEERS_##x(ab)
  #define TARGET_NUM_PEER_KEYS	2
  #define TARGET_NUM_TIDS(ab, x)	(2 * TARGET_NUM_PEERS(ab, x) +	\
+@@ -226,6 +255,7 @@ struct ath11k_hw_params {
+ 	u32 tx_ring_size;
+ 	bool smp2p_wow_exit;
+ 	bool support_fw_mac_sequence;
++	const struct ath11k_num_vdevs_peers *num_vdevs_peers;
+ };
+ 
+ struct ath11k_hw_ops {
 --- a/drivers/net/wireless/ath/ath11k/qmi.h
 +++ b/drivers/net/wireless/ath/ath11k/qmi.h
 @@ -29,6 +29,12 @@
@@ -107,14 +138,21 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  #endif
 --- a/local-symbols
 +++ b/local-symbols
-@@ -171,6 +171,7 @@ ATH11K=
+@@ -171,12 +171,13 @@ ATH11K=
  ATH11K_AHB=
  ATH11K_PCI=
  ATH11K_NSS_SUPPORT=
++ATH11K_MEM_PROFILE_256M=
 +ATH11K_MEM_PROFILE_512M=
  ATH11K_DEBUG=
  ATH11K_DEBUGFS=
  ATH11K_TRACING=
+ ATH11K_SPECTRAL=
+ ATH11K_THERMAL=
+-ATH11K_MEM_PROFILE_512M=
+ ATH12K=
+ ATH12K_DEBUG=
+ ATH12K_TRACING=
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
 @@ -863,6 +863,11 @@ struct ath11k_msi_config {
@@ -226,7 +264,13 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  static struct ath11k_hw_params ath11k_hw_params[] = {
  	{
  		.hw_rev = ATH11K_HW_IPQ8074,
-@@ -100,6 +104,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -95,15 +99,15 @@ static struct ath11k_hw_params ath11k_hw
+ 		.coldboot_cal_mm = false,
+ 		.coldboot_cal_ftm = false,
+ 		.cbcal_restart_fw = true,
+-		.fw_mem_mode = 0,
++		.fw_mem_mode = ATH11K_QMI_TARGET_MEM_MODE,
+ 		.num_vdevs = 16 + 1,
  		.num_peers = 512,
  		.supports_suspend = false,
  		.hal_desc_sz = sizeof(struct hal_rx_desc_ipq8074),
@@ -234,7 +278,22 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		.supports_regdb = false,
  		.fix_l1ss = true,
  		.credit_flow = false,
-@@ -177,7 +182,7 @@ static struct ath11k_hw_params ath11k_hw
+-		.max_tx_ring = DP_TCL_NUM_RING_MAX,
+ 		.hal_params = &ath11k_hw_hal_params_ipq8074,
+ 		.supports_dynamic_smps_6ghz = false,
+ 		.alloc_cacheable_memory = true,
+@@ -127,7 +131,9 @@ static struct ath11k_hw_params ath11k_hw
+ 		.tcl_ring_retry = true,
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+-	},
++		/* In addition to TCL ring use TCL_CMD ring also for tx */
++		.max_tx_ring = DP_TCL_NUM_RING_MAX + 1,
++		.num_vdevs_peers = ath11k_vdevs_peers,
+ 	{
+ 		.hw_rev = ATH11K_HW_IPQ6018_HW10,
+ 		.name = "ipq6018 hw1.0",
+@@ -177,7 +183,7 @@ static struct ath11k_hw_params ath11k_hw
  		.coldboot_cal_mm = true,
  		.coldboot_cal_ftm = true,
  		.cbcal_restart_fw = true,
@@ -243,7 +302,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		.num_vdevs = 16 + 1,
  		.num_peers = 512,
  		.supports_suspend = false,
-@@ -259,7 +264,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -259,7 +265,7 @@ static struct ath11k_hw_params ath11k_hw
  		.coldboot_cal_mm = false,
  		.coldboot_cal_ftm = false,
  		.cbcal_restart_fw = false,
@@ -252,7 +311,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		.num_vdevs = 16 + 1,
  		.num_peers = 512,
  		.supports_suspend = true,
-@@ -426,7 +431,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -426,7 +432,7 @@ static struct ath11k_hw_params ath11k_hw
  		.coldboot_cal_mm = false,
  		.coldboot_cal_ftm = false,
  		.cbcal_restart_fw = false,
@@ -261,7 +320,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		.num_vdevs = 16 + 1,
  		.num_peers = 512,
  		.supports_suspend = true,
-@@ -509,7 +514,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -509,7 +515,7 @@ static struct ath11k_hw_params ath11k_hw
  		.coldboot_cal_mm = false,
  		.coldboot_cal_ftm = false,
  		.cbcal_restart_fw = false,
@@ -270,7 +329,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		.num_vdevs = 16 + 1,
  		.num_peers = 512,
  		.supports_suspend = true,
-@@ -593,7 +598,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -593,7 +599,7 @@ static struct ath11k_hw_params ath11k_hw
  		.coldboot_cal_mm = true,
  		.coldboot_cal_ftm = true,
  		.cbcal_restart_fw = false,
@@ -279,7 +338,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		.num_vdevs = 16 + 1,
  		.num_peers = 512,
  		.supports_suspend = false,
-@@ -672,7 +677,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -672,7 +678,7 @@ static struct ath11k_hw_params ath11k_hw
  		.supports_monitor = false,
  		.supports_sta_ps = false,
  		.supports_shadow_regs = false,
@@ -288,7 +347,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		.num_vdevs = 16 + 1,
  		.num_peers = 512,
  		.supports_regdb = false,
-@@ -710,7 +715,23 @@ static struct ath11k_hw_params ath11k_hw
+@@ -710,7 +716,23 @@ static struct ath11k_hw_params ath11k_hw
  	},
  };
  
diff --git a/package/kernel/mac80211/patches/ath11k_nss/233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch b/package/kernel/mac80211/patches/ath11k_nss/233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
index 0b9d559a4857ae..87314bc425d3d1 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
@@ -754,10 +754,24 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
 --- a/drivers/net/wireless/ath/ath11k/hw.h
 +++ b/drivers/net/wireless/ath/ath11k/hw.h
-@@ -22,6 +22,11 @@
+@@ -22,7 +22,11 @@
  #define ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE	512
  #define ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE	128
  #define ATH11K_DP_RXDMA_MONITOR_DST_RING_SIZE	128
+-
++#define ATH11K_DP_RXDMA_REFILL_RING_SIZE	2048
++/* 256b desc TLV + 4b(rounded) Pad + 30byte max nwifi header +
++ * 18byte mesh hdr + 8byte snap + 1500 eth payload
++ */
++#define ATH11K_DP_RXDMA_NSS_REFILL_RING_SIZE	1816
+ #elif defined(CPTCFG_ATH11K_MEM_PROFILE_512M)
+ #define TARGET_NUM_VDEVS(ab)	8
+ #define TARGET_NUM_PEERS_PDEV(ab)	(128 + TARGET_NUM_VDEVS(ab))
+@@ -34,7 +38,11 @@
+ #define ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE	512
+ #define ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE	128
+ #define ATH11K_DP_RXDMA_MONITOR_DST_RING_SIZE	128
+-
 +#define ATH11K_DP_RXDMA_REFILL_RING_SIZE	2048
 +/* 256b desc TLV + 4b(rounded) Pad + 30byte max nwifi header +
 + * 18byte mesh hdr + 8byte snap + 1500 eth payload
@@ -765,8 +779,8 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
 +#define ATH11K_DP_RXDMA_NSS_REFILL_RING_SIZE	1816
  #else
  /* Num VDEVS per radio */
- #define TARGET_NUM_VDEVS(ab)	(ab->hw_params.num_vdevs)
-@@ -34,6 +39,8 @@
+ #define TARGET_NUM_VDEVS(ab)	(ab->hw_params.num_vdevs_peers[ab->qmi.target_mem_mode].num_vdevs)
+@@ -47,6 +55,8 @@
  #define ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE	1024
  #define ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE	4096
  #define ATH11K_DP_RXDMA_MONITOR_DST_RING_SIZE	2048
@@ -775,7 +789,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  #endif
  
  /* Num of peers for Single Radio mode */
-@@ -129,6 +136,8 @@ enum ath11k_bus {
+@@ -142,6 +152,8 @@ enum ath11k_bus {
  
  struct hal_rx_desc;
  struct hal_tcl_data_cmd;
@@ -784,7 +798,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  struct ath11k_hw_ring_mask {
  	u8 tx[ATH11K_EXT_IRQ_GRP_NUM_MAX];
-@@ -218,6 +227,7 @@ struct ath11k_hw_params {
+@@ -231,6 +243,7 @@ struct ath11k_hw_params {
  	const struct ath11k_hw_hal_params *hal_params;
  	bool supports_dynamic_smps_6ghz;
  	bool alloc_cacheable_memory;
@@ -792,7 +806,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	bool supports_rssi_stats;
  	bool fw_wmi_diag_event;
  	bool current_cc_support;
-@@ -285,6 +295,16 @@ struct ath11k_hw_ops {
+@@ -299,6 +312,16 @@ struct ath11k_hw_ops {
  	bool (*rx_desc_mac_addr2_valid)(struct hal_rx_desc *desc);
  	u8* (*rx_desc_mpdu_start_addr2)(struct hal_rx_desc *desc);
  	u32 (*get_ring_selector)(struct sk_buff *skb);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch b/package/kernel/mac80211/patches/ath11k_nss/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
index b0f6b03f750f9e..9bc2b50f7cbd45 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
@@ -385,7 +385,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	.rx_desc_get_mpdu_fc_valid = ath11k_hw_qcn9074_rx_desc_get_mpdu_fc_valid,
 --- a/drivers/net/wireless/ath/ath11k/hw.h
 +++ b/drivers/net/wireless/ath/ath11k/hw.h
-@@ -270,6 +270,7 @@ struct ath11k_hw_ops {
+@@ -287,6 +287,7 @@ struct ath11k_hw_ops {
  	u32 (*rx_desc_get_encrypt_type)(struct hal_rx_desc *desc);
  	u8 (*rx_desc_get_decap_type)(struct hal_rx_desc *desc);
  	u8 (*rx_desc_get_mesh_ctl)(struct hal_rx_desc *desc);

From 00bb04d098084c967dfce4fcfde49ba70db0ee2b Mon Sep 17 00:00:00 2001
From: Qosmio <datapronix@protonmail.com>
Date: Wed, 10 Jan 2024 21:02:52 -0500
Subject: [PATCH 086/225] ath11k_nss: Add support to account memory stats

  Memory allocations in the driver & mac80211 are logged
  and populate those values to the user space via debugfs.
  This stats will give the snapshot of the memory being
  used by the driver at the time of dumping these
  memory stats.

  Command:
  cat /sys/kernel/debug/ath11k/ipq8074\ hw2.0/memory_stats

  Sample output of the stats
  MEMORY STATS IN BYTES:
  malloc size : 6287583
  ce_ring_alloc size: 109308
  dma_alloc size:: 10831860
  htc_skb_alloc size: 3840
  wmi alloc size: 0
  per peer object: 4644
  rx_post_buf size: 5091840
  Total size: 22329075

  User can disable/enable the memory stats accounting with
  the below command.

  echo N > /sys/kernel/debug/ath11k/ipq8074\ hw2.0/enable_memory_stats
  where N = 0 to disable logging, 1 to enable the logging.

  Note: This should be enabled/disabled only after wifi is down.
  User shouldn't enable/disable when the wifi is up to avoid
  accounting the negative values which cause incorrect values
  in the memory stats.

  Command:

  cat /sys/kernel/debug/ieee80211/phyX/memory_stats
  memory stats: malloc_size: 108
---
 .../905-ath11k-add-support-memory-stats.patch | 946 ++++++++++++++++++
 1 file changed, 946 insertions(+)
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/905-ath11k-add-support-memory-stats.patch

diff --git a/package/kernel/mac80211/patches/ath11k_nss/905-ath11k-add-support-memory-stats.patch b/package/kernel/mac80211/patches/ath11k_nss/905-ath11k-add-support-memory-stats.patch
new file mode 100644
index 00000000000000..f4f4389960bd74
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/905-ath11k-add-support-memory-stats.patch
@@ -0,0 +1,946 @@
+From 9c99e124a279391dbe2cef66226fd4e86bde8f4d Mon Sep 17 00:00:00 2001
+From: Maharaja Kennadyrajan <mkenna@codeaurora.org>
+Date: Mon, 4 Jan 2021 23:46:53 +0530
+Subject: [PATCH 1/2] ath11k/mac80211: Add support to account memory stats
+
+Memory allocations in the driver & mac80211 are logged
+and populate those values to the user space via debugfs.
+This stats will give the snapshot of the memory being
+used by the driver at the time of dumping these
+memory stats.
+
+Command:
+cat /sys/kernel/debug/ath11k/ipq8074\ hw2.0/memory_stats
+
+Sample output of the stats
+MEMORY STATS IN BYTES:
+malloc size : 6287583
+ce_ring_alloc size: 109308
+dma_alloc size:: 10831860
+htc_skb_alloc size: 3840
+wmi alloc size: 0
+per peer object: 4644
+rx_post_buf size: 5091840
+Total size: 22329075
+
+User can disable/enable the memory stats accounting with
+the below command.
+
+echo N > /sys/kernel/debug/ath11k/ipq8074\ hw2.0/enable_memory_stats
+where N = 0 to disable logging, 1 to enable the logging.
+
+Note: This should be enabled/disabled only after wifi is down.
+User shouldn't enable/disable when the wifi is up to avoid
+accounting the negative values which cause incorrect values
+in the memory stats.
+
+Command:
+
+cat /sys/kernel/debug/ieee80211/phyX/memory_stats
+memory stats: malloc_size: 108
+
+Signed-off-by: Maharaja Kennadyrajan <mkenna@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/ce.c          |  24 ++++
+ drivers/net/wireless/ath/ath11k/core.c        |   2 +-
+ drivers/net/wireless/ath/ath11k/core.h        |  19 +++
+ drivers/net/wireless/ath/ath11k/dbring.c      |   3 +
+ drivers/net/wireless/ath/ath11k/debugfs.c       | 115 ++++++++++++++++++
+ drivers/net/wireless/ath/ath11k/debugfs.h       |  29 +++++
+ drivers/net/wireless/ath/ath11k/debugfs_sta.c |   4 +
+ drivers/net/wireless/ath/ath11k/dp.c          |  13 ++
+ drivers/net/wireless/ath/ath11k/hal.c         |   6 +
+ drivers/net/wireless/ath/ath11k/htc.c         |   5 +
+ drivers/net/wireless/ath/ath11k/mac.c         |  15 ++-
+ drivers/net/wireless/ath/ath11k/nss.c         |  46 +++++++
+ drivers/net/wireless/ath/ath11k/peer.c        |   5 +
+ drivers/net/wireless/ath/ath11k/wmi.c         |   4 +
+ 15 files changed, 302 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/ce.c
++++ b/drivers/net/wireless/ath/ath11k/ce.c
+@@ -359,6 +359,9 @@ static int ath11k_ce_rx_post_pipe(struct
+ 			dev_kfree_skb_any(skb);
+ 			goto exit;
+ 		}
++
++		ATH11K_MEMORY_STATS_INC(ab, ce_rx_pipe, skb->truesize);
++
+ 	}
+ 
+ exit:
+@@ -427,6 +430,9 @@ static void ath11k_ce_recv_process_cb(st
+ 	__skb_queue_head_init(&list);
+ 	while (ath11k_ce_completed_recv_next(pipe, &skb, &nbytes) == 0) {
+ 		max_nbytes = skb->len + skb_tailroom(skb);
++
++		ATH11K_MEMORY_STATS_DEC(ab, ce_rx_pipe, skb->truesize);
++
+ 		dma_unmap_single(ab->dev, ATH11K_SKB_RXCB(skb)->paddr,
+ 				 max_nbytes, DMA_FROM_DEVICE);
+ 
+@@ -620,6 +626,9 @@ ath11k_ce_alloc_ring(struct ath11k_base
+ 	if (ce_ring == NULL)
+ 		return ERR_PTR(-ENOMEM);
+ 
++	ATH11K_MEMORY_STATS_INC(ab, ce_ring_alloc,
++				struct_size(ce_ring, skb, nentries));
++
+ 	ce_ring->nentries = nentries;
+ 	ce_ring->nentries_mask = nentries - 1;
+ 
+@@ -635,6 +644,9 @@ ath11k_ce_alloc_ring(struct ath11k_base
+ 		return ERR_PTR(-ENOMEM);
+ 	}
+ 
++	ATH11K_MEMORY_STATS_INC(ab, ce_ring_alloc,
++				nentries * desc_sz + CE_DESC_RING_ALIGN);
++
+ 	ce_ring->base_addr_ce_space_unaligned = base_addr;
+ 
+ 	ce_ring->base_addr_owner_space = PTR_ALIGN(
+@@ -814,6 +826,9 @@ static void ath11k_ce_rx_pipe_cleanup(st
+ 			continue;
+ 
+ 		ring->skb[i] = NULL;
++
++		ATH11K_MEMORY_STATS_DEC(ab, ce_rx_pipe, skb->truesize);
++
+ 		dma_unmap_single(ab->dev, ATH11K_SKB_RXCB(skb)->paddr,
+ 				 skb->len + skb_tailroom(skb), DMA_FROM_DEVICE);
+ 		dev_kfree_skb_any(skb);
+@@ -992,6 +1007,9 @@ void ath11k_ce_free_pipes(struct ath11k_
+ 					  CE_DESC_RING_ALIGN,
+ 					  ce_ring->base_addr_owner_space_unaligned,
+ 					  ce_ring->base_addr_ce_space_unaligned);
++			ATH11K_MEMORY_STATS_DEC(ab, ce_ring_alloc,
++						pipe->src_ring->nentries * desc_sz +
++						CE_DESC_RING_ALIGN);
+ 			kfree(pipe->src_ring);
+ 			pipe->src_ring = NULL;
+ 		}
+@@ -1004,6 +1022,9 @@ void ath11k_ce_free_pipes(struct ath11k_
+ 					  CE_DESC_RING_ALIGN,
+ 					  ce_ring->base_addr_owner_space_unaligned,
+ 					  ce_ring->base_addr_ce_space_unaligned);
++			ATH11K_MEMORY_STATS_DEC(ab, ce_ring_alloc,
++						pipe->dest_ring->nentries * desc_sz +
++						CE_DESC_RING_ALIGN);
+ 			kfree(pipe->dest_ring);
+ 			pipe->dest_ring = NULL;
+ 		}
+@@ -1017,6 +1038,9 @@ void ath11k_ce_free_pipes(struct ath11k_
+ 					  CE_DESC_RING_ALIGN,
+ 					  ce_ring->base_addr_owner_space_unaligned,
+ 					  ce_ring->base_addr_ce_space_unaligned);
++			ATH11K_MEMORY_STATS_DEC(ab, ce_ring_alloc,
++						pipe->status_ring->nentries * desc_sz +
++						CE_DESC_RING_ALIGN);
+ 			kfree(pipe->status_ring);
+ 			pipe->status_ring = NULL;
+ 		}
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -2144,6 +2144,8 @@ int ath11k_core_pre_init(struct ath11k_b
+ 	if (nss_offload)
+ 		ab->nss.stats_enabled = 1;
+ 
++	ab->enable_memory_stats = ATH11K_DEBUG_ENABLE_MEMORY_STATS;
++
+ 	return 0;
+ }
+ EXPORT_SYMBOL(ath11k_core_pre_init);
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -930,6 +930,23 @@ struct ath11k_num_vdevs_peers {
+   u32 num_peers;
+ };
+ 
++struct ath11k_memory_stats {
++	/* Account kzalloc and valloc */
++	atomic_t malloc_size;
++	/* Account dma_alloc in dp.c & hal.c */
++	atomic_t dma_alloc;
++	/* Account memory used in ce rings */
++	atomic_t ce_ring_alloc;
++	/* Account memory used in htc_send */
++	atomic_t htc_skb_alloc;
++	/* Account memory used in wmi tx skb alloc */
++	atomic_t wmi_tx_skb_alloc;
++	/* Account memory consumed for peer object */
++	atomic_t per_peer_object;
++	/* Account memory used in ce rx pipe */
++	atomic_t ce_rx_pipe;
++};
++
+ /* Master structure to hold the hw data which may be used in core module */
+ struct ath11k_base {
+ 	enum ath11k_hw_rev hw_rev;
+@@ -1019,6 +1036,7 @@ struct ath11k_base {
+ 	enum ath11k_dfs_region dfs_region;
+ #ifdef CPTCFG_ATH11K_DEBUGFS
+ 	struct dentry *debugfs_soc;
++	struct ath11k_memory_stats memory_stats;
+ #endif
+ 	struct ath11k_soc_dp_stats soc_stats;
+ 
+@@ -1085,6 +1103,7 @@ struct ath11k_base {
+ 
+ 	atomic_t num_max_allowed;
+ 	struct ath11k_num_vdevs_peers *num_vdevs_peers;
++	bool enable_memory_stats;
+ 
+ 	u32 rx_hash;
+ 	bool stats_disable;
+--- a/drivers/net/wireless/ath/ath11k/dbring.c
++++ b/drivers/net/wireless/ath/ath11k/dbring.c
+@@ -143,6 +143,7 @@ static int ath11k_dbring_fill_bufs(struc
+ 			break;
+ 		}
+ 		num_remain--;
++		ATH11K_MEMORY_STATS_INC(ar->ab, malloc_size, size);
+ 	}
+ 
+ 	spin_unlock_bh(&srng->lock);
+@@ -392,6 +393,8 @@ void ath11k_dbring_buf_cleanup(struct at
+ 		idr_remove(&ring->bufs_idr, buf_id);
+ 		dma_unmap_single(ar->ab->dev, buff->paddr,
+ 				 ring->buf_sz, DMA_FROM_DEVICE);
++		ATH11K_MEMORY_STATS_DEC(ar->ab, malloc_size, sizeof(*buff) +
++					ring->buf_sz + ring->buf_align - 1);
+ 		kfree(buff->payload);
+ 		kfree(buff);
+ 	}
+--- a/drivers/net/wireless/ath/ath11k/debugfs.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs.c
+@@ -801,6 +801,8 @@ static ssize_t ath11k_debugfs_dump_soc_d
+ 	if (!buf)
+ 		return -ENOMEM;
+ 
++	ATH11K_MEMORY_STATS_INC(ab, malloc_size, size);
++
+ 	len += scnprintf(buf + len, size - len, "SOC RX STATS:\n\n");
+ 	len += scnprintf(buf + len, size - len, "err ring pkts: %u\n",
+ 			 soc_stats->err_ring_pkts);
+@@ -842,6 +844,8 @@ static ssize_t ath11k_debugfs_dump_soc_d
+ 	retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+ 	kfree(buf);
+ 
++	ATH11K_MEMORY_STATS_DEC(ab, malloc_size, size);
++
+ 	return retval;
+ }
+ 
+@@ -1094,6 +1098,106 @@ static const struct file_operations fops
+ 	.write = ath11k_write_stats_disable,
+ };
+ 
++static ssize_t
++ath11k_debug_read_enable_memory_stats(struct file *file,
++				      char __user *user_buf,
++				      size_t count, loff_t *ppos)
++{
++	struct ath11k_base *ab = file->private_data;
++	char buf[10];
++	size_t len;
++
++	len = scnprintf(buf, sizeof(buf), "%d\n", ab->enable_memory_stats);
++
++	return simple_read_from_buffer(user_buf, count, ppos, buf, len);
++}
++
++static ssize_t
++ath11k_debug_write_enable_memory_stats(struct file *file,
++				       char __user *ubuf,
++				       size_t count, loff_t *ppos)
++{
++	struct ath11k_base *ab = file->private_data;
++	bool enable;
++	int ret;
++
++	if (kstrtobool_from_user(ubuf, count, &enable))
++		return -EINVAL;
++
++	if (enable == ab->enable_memory_stats) {
++		ret = count;
++		goto exit;
++	}
++
++	ab->enable_memory_stats = enable;
++	ret = count;
++exit:
++	return ret;
++}
++
++static const struct file_operations fops_enable_memory_stats = {
++	.read = ath11k_debug_read_enable_memory_stats,
++	.write = ath11k_debug_write_enable_memory_stats,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++	.open = simple_open,
++};
++
++static ssize_t ath11k_debug_dump_memory_stats(struct file *file,
++					      char __user *user_buf,
++					      size_t count, loff_t *ppos)
++{
++	struct ath11k_base *ab = file->private_data;
++	struct ath11k_memory_stats *memory_stats = &ab->memory_stats;
++	int len = 0, retval;
++	const int size = 4096;
++
++	char *buf;
++
++	buf = kzalloc(size, GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
++
++	len += scnprintf(buf + len, size - len, "MEMORY STATS IN BYTES:\n");
++	len += scnprintf(buf + len, size - len, "malloc size : %u\n",
++			 atomic_read(&memory_stats->malloc_size));
++	len += scnprintf(buf + len, size - len, "ce_ring_alloc size: %u\n",
++			 atomic_read(&memory_stats->ce_ring_alloc));
++	len += scnprintf(buf + len, size - len, "dma_alloc size:: %u\n",
++			 atomic_read(&memory_stats->dma_alloc));
++	len += scnprintf(buf + len, size - len, "htc_skb_alloc size: %u\n",
++			 atomic_read(&memory_stats->htc_skb_alloc));
++	len += scnprintf(buf + len, size - len, "wmi tx skb alloc size: %u\n",
++			 atomic_read(&memory_stats->wmi_tx_skb_alloc));
++	len += scnprintf(buf + len, size - len, "per peer object: %u\n",
++			 atomic_read(&memory_stats->per_peer_object));
++	len += scnprintf(buf + len, size - len, "rx_post_buf size: %u\n",
++			 atomic_read(&memory_stats->ce_rx_pipe));
++	len += scnprintf(buf + len, size - len, "Total size: %u\n\n",
++			 (atomic_read(&memory_stats->malloc_size) +
++			 atomic_read(&memory_stats->ce_ring_alloc) +
++			 atomic_read(&memory_stats->dma_alloc) +
++			 atomic_read(&memory_stats->htc_skb_alloc) +
++			 atomic_read(&memory_stats->wmi_tx_skb_alloc) +
++			 atomic_read(&memory_stats->per_peer_object) +
++			 atomic_read(&memory_stats->ce_rx_pipe)));
++
++	if (len > size)
++		len = size;
++
++	retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
++	kfree(buf);
++
++	return retval;
++}
++
++static const struct file_operations fops_memory_stats = {
++	.read = ath11k_debug_dump_memory_stats,
++	.open = simple_open,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++};
++
+ int ath11k_debugfs_pdev_create(struct ath11k_base *ab)
+ {
+ 	if (test_bit(ATH11K_FLAG_REGISTERED, &ab->dev_flags))
+@@ -1112,6 +1216,12 @@ int ath11k_debugfs_pdev_create(struct at
+ 	debugfs_create_file("rx_hash", 0600, ab->debugfs_soc, ab,
+ 			    &fops_soc_rx_hash);
+ 
++	debugfs_create_file("enable_memory_stats", 0600, ab->debugfs_soc,
++			    ab, &fops_enable_memory_stats);
++
++	debugfs_create_file("memory_stats", 0600, ab->debugfs_soc, ab,
++			    &fops_memory_stats);
++
+ 
+ 	return 0;
+ }
+@@ -1742,6 +1852,8 @@ static ssize_t ath11k_dump_mgmt_stats(st
+ 	if (!buf)
+ 		return -ENOMEM;
+ 
++	ATH11K_MEMORY_STATS_INC(ar->ab, malloc_size, size);
++
+ 	mutex_lock(&ar->conf_mutex);
+ 	spin_lock_bh(&ar->data_lock);
+ 
+@@ -1792,6 +1904,9 @@ static ssize_t ath11k_dump_mgmt_stats(st
+ 	ret = simple_read_from_buffer(ubuf, count, ppos, buf, len);
+ 	mutex_unlock(&ar->conf_mutex);
+ 	kfree(buf);
++
++	ATH11K_MEMORY_STATS_DEC(ar->ab, malloc_size, size);
++
+ 	return ret;
+ }
+ 
+--- a/drivers/net/wireless/ath/ath11k/debugfs.h
++++ b/drivers/net/wireless/ath/ath11k/debugfs.h
+@@ -10,6 +10,7 @@
+ 
+ #define ATH11K_TX_POWER_MAX_VAL	70
+ #define ATH11K_TX_POWER_MIN_VAL	0
++#define ATH11K_DEBUG_ENABLE_MEMORY_STATS 1
+ 
+ /* htt_dbg_ext_stats_type */
+ enum ath11k_dbg_htt_ext_stats_type {
+@@ -263,6 +264,24 @@ struct ath11k_fw_dbglog {
+ };
+ 
+ #ifdef CPTCFG_ATH11K_DEBUGFS
++#define ATH11K_MEMORY_STATS_INC(_struct, _field, _size)			\
++do {									\
++	if (ath11k_debug_is_memory_stats_enabled(_struct)) 		\
++		atomic_add(_size, &_struct->memory_stats._field);	\
++} while(0)
++
++#define ATH11K_MEMORY_STATS_DEC(_struct, _field, _size)			\
++do {									\
++	if (ath11k_debug_is_memory_stats_enabled(_struct))		\
++		atomic_sub(_size, &_struct->memory_stats._field);	\
++} while(0)
++
++#else
++#define ATH11K_MEMORY_STATS_INC(_struct, _field, _size)
++#define ATH11K_MEMORY_STATS_DEC(_struct, _field, _size)
++#endif
++
++#ifdef CPTCFG_ATH11K_DEBUGFS
+ int ath11k_debugfs_soc_create(struct ath11k_base *ab);
+ void ath11k_debugfs_soc_destroy(struct ath11k_base *ab);
+ int ath11k_debugfs_pdev_create(struct ath11k_base *ab);
+@@ -313,6 +332,11 @@ void ath11k_debugfs_add_dbring_entry(str
+ 				     enum ath11k_dbg_dbr_event event,
+ 				     struct hal_srng *srng);
+ 
++static inline int ath11k_debug_is_memory_stats_enabled(struct ath11k_base *ab)
++{
++	return ab->enable_memory_stats;
++}
++
+ #else
+ static inline int ath11k_debugfs_soc_create(struct ath11k_base *ab)
+ {
+@@ -375,6 +399,11 @@ static inline bool ath11k_debugfs_is_pkt
+ 	return false;
+ }
+ 
++static inline int ath11k_debug_is_memory_stats_enabled(struct ath11k_base *ab)
++{
++	return 0;
++}
++
+ static inline int ath11k_debugfs_rx_filter(struct ath11k *ar)
+ {
+ 	return 0;
+--- a/drivers/net/wireless/ath/ath11k/debugfs_sta.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs_sta.c
+@@ -468,6 +468,8 @@ static ssize_t ath11k_dbg_sta_dump_rx_st
+ 	retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+ 	kfree(buf);
+ 
++	ATH11K_MEMORY_STATS_DEC(ar->ab, malloc_size, size);
++
+ 	mutex_unlock(&ar->conf_mutex);
+ 	return retval;
+ }
+--- a/drivers/net/wireless/ath/ath11k/dp.c
++++ b/drivers/net/wireless/ath/ath11k/dp.c
+@@ -115,6 +115,8 @@ void ath11k_dp_srng_cleanup(struct ath11
+ 		dma_free_coherent(ab->dev, ring->size, ring->vaddr_unaligned,
+ 				  ring->paddr_unaligned);
+ 
++	ATH11K_MEMORY_STATS_DEC(ab, dma_alloc, ring->size);
++
+ 	ring->vaddr_unaligned = NULL;
+ }
+ 
+@@ -278,6 +280,8 @@ int ath11k_dp_srng_setup(struct ath11k_b
+ 	if (!ring->vaddr_unaligned)
+ 		return -ENOMEM;
+ 
++	ATH11K_MEMORY_STATS_INC(ab, dma_alloc, ring->size);
++
+ 	ring->vaddr = PTR_ALIGN(ring->vaddr_unaligned, HAL_RING_BASE_ALIGN);
+ 	ring->paddr = ring->paddr_unaligned + ((unsigned long)ring->vaddr -
+ 		      (unsigned long)ring->vaddr_unaligned);
+@@ -514,6 +518,7 @@ static void ath11k_dp_scatter_idle_link_
+ 		dma_free_coherent(ab->dev, HAL_WBM_IDLE_SCATTER_BUF_SIZE_MAX,
+ 				  slist[i].vaddr, slist[i].paddr);
+ 		slist[i].vaddr = NULL;
++		ATH11K_MEMORY_STATS_DEC(ab, dma_alloc, HAL_WBM_IDLE_SCATTER_BUF_SIZE_MAX);
+ 	}
+ }
+ 
+@@ -551,6 +556,7 @@ static int ath11k_dp_scatter_idle_link_d
+ 			ret = -ENOMEM;
+ 			goto err;
+ 		}
++		ATH11K_MEMORY_STATS_INC(ab, dma_alloc, HAL_WBM_IDLE_SCATTER_BUF_SIZE_MAX);
+ 	}
+ 
+ 	scatter_idx = 0;
+@@ -605,6 +611,7 @@ ath11k_dp_link_desc_bank_free(struct ath
+ 					  link_desc_banks[i].vaddr_unaligned,
+ 					  link_desc_banks[i].paddr_unaligned);
+ 			link_desc_banks[i].vaddr_unaligned = NULL;
++			ATH11K_MEMORY_STATS_DEC(ab, dma_alloc, link_desc_banks[i].size);
+ 		}
+ 	}
+ }
+@@ -638,6 +645,7 @@ static int ath11k_dp_link_desc_bank_allo
+ 				     ((unsigned long)desc_bank[i].vaddr -
+ 				      (unsigned long)desc_bank[i].vaddr_unaligned);
+ 		desc_bank[i].size = desc_sz;
++		ATH11K_MEMORY_STATS_INC(ab, dma_alloc, desc_bank[i].size);
+ 	}
+ 
+ 	return 0;
+@@ -1042,8 +1050,11 @@ static int ath11k_dp_tx_pending_cleanup(
+ void ath11k_dp_free(struct ath11k_base *ab)
+ {
+ 	struct ath11k_dp *dp = &ab->dp;
++	size_t size = 0;
+ 	int i;
+ 
++	size = sizeof(struct hal_wbm_release_ring) * DP_TX_COMP_RING_SIZE;
++
+ 	ath11k_dp_link_desc_cleanup(ab, dp->link_desc_banks,
+ 				    HAL_WBM_IDLE_LINK, &dp->wbm_idle_ring);
+ 
+@@ -1057,6 +1068,7 @@ void ath11k_dp_free(struct ath11k_base *
+ 			     ath11k_dp_tx_pending_cleanup, ab);
+ 		idr_destroy(&dp->tx_ring[i].txbuf_idr);
+ 		spin_unlock_bh(&dp->tx_ring[i].tx_idr_lock);
++		ATH11K_MEMORY_STATS_DEC(ab, malloc_size, size);
+ 		kfree(dp->tx_ring[i].tx_status);
+ 	}
+ 
+@@ -1114,6 +1126,7 @@ int ath11k_dp_alloc(struct ath11k_base *
+ 			ret = -ENOMEM;
+ 			goto fail_cmn_srng_cleanup;
+ 		}
++		ATH11K_MEMORY_STATS_INC(ab, malloc_size, size);
+ 	}
+ 
+ 	for (i = 0; i < HAL_DSCP_TID_MAP_TBL_NUM_ENTRIES_MAX; i++)
+--- a/drivers/net/wireless/ath/ath11k/hal.c
++++ b/drivers/net/wireless/ath/ath11k/hal.c
+@@ -201,6 +201,8 @@ static int ath11k_hal_alloc_cont_rdp(str
+ 	if (!hal->rdp.vaddr)
+ 		return -ENOMEM;
+ 
++	ATH11K_MEMORY_STATS_INC(ab, dma_alloc, size);
++
+ 	return 0;
+ }
+ 
+@@ -215,6 +217,7 @@ static void ath11k_hal_free_cont_rdp(str
+ 	size = sizeof(u32) * HAL_SRNG_RING_ID_MAX;
+ 	dma_free_coherent(ab->dev, size,
+ 			  hal->rdp.vaddr, hal->rdp.paddr);
++	ATH11K_MEMORY_STATS_DEC(ab, dma_alloc, size);
+ 	hal->rdp.vaddr = NULL;
+ }
+ 
+@@ -229,6 +232,8 @@ static int ath11k_hal_alloc_cont_wrp(str
+ 	if (!hal->wrp.vaddr)
+ 		return -ENOMEM;
+ 
++	ATH11K_MEMORY_STATS_INC(ab, dma_alloc, size);
++
+ 	return 0;
+ }
+ 
+@@ -243,6 +248,7 @@ static void ath11k_hal_free_cont_wrp(str
+ 	size = sizeof(u32) * HAL_SRNG_NUM_LMAC_RINGS;
+ 	dma_free_coherent(ab->dev, size,
+ 			  hal->wrp.vaddr, hal->wrp.paddr);
++	ATH11K_MEMORY_STATS_DEC(ab, dma_alloc, size);
+ 	hal->wrp.vaddr = NULL;
+ }
+ 
+--- a/drivers/net/wireless/ath/ath11k/htc.c
++++ b/drivers/net/wireless/ath/ath11k/htc.c
+@@ -28,6 +28,7 @@ struct sk_buff *ath11k_htc_alloc_skb(str
+ static void ath11k_htc_control_tx_complete(struct ath11k_base *ab,
+ 					   struct sk_buff *skb)
+ {
++	ATH11K_MEMORY_STATS_DEC(ab, htc_skb_alloc, skb->truesize);
+ 	kfree_skb(skb);
+ }
+ 
+@@ -609,6 +610,7 @@ int ath11k_htc_connect_service(struct at
+ 	bool disable_credit_flow_ctrl = false;
+ 	u16 message_id, service_id, flags = 0;
+ 	u8 tx_alloc = 0;
++	size_t truesize;
+ 
+ 	/* special case for HTC pseudo control service */
+ 	if (conn_req->service_id == ATH11K_HTC_SVC_ID_RSVD_CTRL) {
+@@ -632,6 +634,7 @@ int ath11k_htc_connect_service(struct at
+ 		return -ENOMEM;
+ 	}
+ 
++	truesize = skb->truesize;
+ 	length = sizeof(*req_msg);
+ 	skb_put(skb, length);
+ 	memset(skb->data, 0, length);
+@@ -667,6 +670,8 @@ int ath11k_htc_connect_service(struct at
+ 		return status;
+ 	}
+ 
++	ATH11K_MEMORY_STATS_INC(ab, htc_skb_alloc, truesize);
++
+ 	/* wait for response */
+ 	time_left = wait_for_completion_timeout(&htc->ctl_resp,
+ 						ATH11K_HTC_CONN_SVC_TIMEOUT_HZ);
+@@ -768,11 +773,13 @@ int ath11k_htc_start(struct ath11k_htc *
+ 	int status = 0;
+ 	struct ath11k_base *ab = htc->ab;
+ 	struct ath11k_htc_setup_complete_extended *msg;
++	size_t truesize;
+ 
+ 	skb = ath11k_htc_build_tx_ctrl_skb(htc->ab);
+ 	if (!skb)
+ 		return -ENOMEM;
+ 
++	truesize = skb->truesize;
+ 	skb_put(skb, sizeof(*msg));
+ 	memset(skb->data, 0, skb->len);
+ 
+@@ -791,6 +798,8 @@ int ath11k_htc_start(struct ath11k_htc *
+ 		return status;
+ 	}
+ 
++	 ATH11K_MEMORY_STATS_INC(ab, htc_skb_alloc, truesize);
++
+ 	return 0;
+ }
+ 
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -4058,6 +4058,8 @@ static int ath11k_mac_op_hw_scan(struct
+ 		goto exit;
+ 	}
+ 
++	ATH11K_MEMORY_STATS_INC(ar->ab, malloc_size, sizeof(*arg));
++
+ 	ath11k_wmi_start_scan_init(ar, arg);
+ 	arg->vdev_id = arvif->vdev_id;
+ 	arg->scan_id = ATH11K_SCAN_ID;
+@@ -4071,6 +4073,8 @@ static int ath11k_mac_op_hw_scan(struct
+ 		arg->extraie.len = req->ie_len;
+ 	}
+ 
++	ATH11K_MEMORY_STATS_INC(ar->ab, malloc_size, req->ie_len);
++
+ 	if (req->n_ssids) {
+ 		arg->num_ssids = req->n_ssids;
+ 		for (i = 0; i < arg->num_ssids; i++) {
+@@ -4157,9 +4161,16 @@ static int ath11k_mac_op_hw_scan(struct
+ exit:
+ 	if (arg) {
+ 		kfree(arg->chan_list);
+-		kfree(arg->extraie.ptr);
+-		kfree(arg);
+-	}
++
++		if (arg->extraie.ptr) {
++			ATH11K_MEMORY_STATS_DEC(ar->ab, malloc_size, req->ie_len);
++			kfree(arg->extraie.ptr);
++		}
++
++		ATH11K_MEMORY_STATS_DEC(ar->ab, malloc_size, sizeof(*arg));
++
++ 		kfree(arg);
++ 	}
+ 
+ 	mutex_unlock(&ar->conf_mutex);
+ 
+@@ -8113,6 +8124,8 @@ ath11k_mac_update_active_vif_chan(struct
+ 	if (!arg.vifs)
+ 		return;
+ 
++	ATH11K_MEMORY_STATS_INC(ar->ab, malloc_size, sizeof(arg.vifs[0]));
++
+ 	ieee80211_iterate_active_interfaces_atomic(ar->hw,
+ 						   IEEE80211_IFACE_ITER_NORMAL,
+ 						   ath11k_mac_change_chanctx_fill_iter,
+@@ -8120,6 +8133,8 @@ ath11k_mac_update_active_vif_chan(struct
+ 
+ 	ath11k_mac_update_vif_chan(ar, arg.vifs, arg.n_vifs);
+ 
++	ATH11K_MEMORY_STATS_DEC(ar->ab, malloc_size, sizeof(arg.vifs[0]));
++
+ 	kfree(arg.vifs);
+ }
+ 
+--- a/drivers/net/wireless/ath/ath11k/nss.c
++++ b/drivers/net/wireless/ath/ath11k/nss.c
+@@ -1052,6 +1052,9 @@ int ath11k_nss_vdev_set_cmd(struct ath11
+ 	default:
+ 		return -EINVAL;
+ 	}
++
++	ATH11K_MEMORY_STATS_INC(ar->ab, malloc_size, sizeof(*vdev_msg));
++
+ 	/* TODO: Convert to function for conversion in case of many
+ 	 * such commands
+ 	 */
+@@ -1082,6 +1085,7 @@ int ath11k_nss_vdev_set_cmd(struct ath11
+ 	ath11k_dbg(ar->ab, ATH11K_DBG_NSS, "nss vdev set cmd success cmd:%d val:%d\n",
+ 		   cmd, val);
+ free:
++	ATH11K_MEMORY_STATS_DEC(ar->ab, malloc_size, sizeof(*vdev_msg));
+ 	kfree(vdev_msg);
+ 	return status;
+ }
+@@ -1098,6 +1102,9 @@ static int ath11k_nss_vdev_configure(str
+ 	if (!vdev_msg)
+ 		return -ENOMEM;
+ 
++	ATH11K_MEMORY_STATS_INC(ar->ab, malloc_size,
++				sizeof(struct nss_wifi_vdev_msg));
++
+ 	vdev_cfg = &vdev_msg->msg.vdev_config;
+ 
+ 	vdev_cfg->radio_ifnum = ar->nss.if_num;
+@@ -1133,6 +1140,8 @@ static int ath11k_nss_vdev_configure(str
+ 
+ 	ret = 0;
+ free:
++	ATH11K_MEMORY_STATS_DEC(ar->ab, malloc_size,
++				sizeof(struct nss_wifi_vdev_msg));
+ 	kfree(vdev_msg);
+ 
+ 	return ret;
+@@ -1357,6 +1366,9 @@ int ath11k_nss_vdev_up(struct ath11k_vif
+ 	if (!vdev_msg)
+ 		return -ENOMEM;
+ 
++	ATH11K_MEMORY_STATS_INC(ar->ab, malloc_size,
++				sizeof(struct nss_wifi_vdev_msg));
++
+ 	vdev_en = &vdev_msg->msg.vdev_enable;
+ 
+ 	ether_addr_copy(vdev_en->mac_addr, arvif->vif->addr);
+@@ -1381,6 +1393,8 @@ int ath11k_nss_vdev_up(struct ath11k_vif
+ 			if (ap_vlan_arvif->nss.added)
+ 				ath11k_nss_ext_vdev_up(ap_vlan_arvif);
+ free:
++	ATH11K_MEMORY_STATS_DEC(ar->ab, malloc_size,
++				sizeof(struct nss_wifi_vdev_msg));
+ 	kfree(vdev_msg);
+ 	return ret;
+ }
+@@ -1404,6 +1418,8 @@ int ath11k_nss_vdev_down(struct ath11k_v
+ 	if (!vdev_msg)
+ 		return -ENOMEM;
+ 
++	ATH11K_MEMORY_STATS_INC(ar->ab, malloc_size,
++				sizeof(struct nss_wifi_vdev_msg));
+ 	nss_wifi_vdev_msg_init(vdev_msg, arvif->nss.if_num,
+ 			       NSS_WIFI_VDEV_INTERFACE_DOWN_MSG,
+ 			       sizeof(struct nss_wifi_vdev_disable_msg),
+@@ -1423,6 +1439,8 @@ int ath11k_nss_vdev_down(struct ath11k_v
+                                          list)
+ 			ath11k_nss_ext_vdev_down(ap_vlan_arvif);
+ free:
++	ATH11K_MEMORY_STATS_DEC(ar->ab, malloc_size,
++				sizeof(struct nss_wifi_vdev_msg));
+ 	kfree(vdev_msg);
+ 	return ret;
+ }
+@@ -1875,6 +1893,9 @@ int ath11k_nss_set_peer_sec_type(struct
+ 	if (!wlmsg)
+ 		return -ENOMEM;
+ 
++	ATH11K_MEMORY_STATS_INC(ar->ab, malloc_size,
++				sizeof(struct nss_wifili_msg));
++
+ 	sec_msg = &wlmsg->msg.securitymsg;
+ 	sec_msg->peer_id = peer->peer_id;
+ 
+@@ -1906,6 +1927,8 @@ int ath11k_nss_set_peer_sec_type(struct
+ 	ath11k_dbg(ar->ab, ATH11K_DBG_NSS, "nss peer id %d security cfg complete\n",
+ 		   peer->peer_id);
+ free:
++	ATH11K_MEMORY_STATS_DEC(ar->ab, malloc_size,
++				sizeof(struct nss_wifili_msg));
+ 	kfree(wlmsg);
+ 	return status;
+ }
+@@ -2593,6 +2616,7 @@ static void ath11k_nss_tx_desc_mem_free(
+ 				  ab->nss.tx_desc_vaddr[i],
+ 				  ab->nss.tx_desc_paddr[i]);
+ 		ab->nss.tx_desc_vaddr[i] = NULL;
++		ATH11K_MEMORY_STATS_DEC(ab, dma_alloc, ab->nss.tx_desc_size[i]);
+ 	}
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_NSS, "allocated tx desc mem freed\n");
+@@ -2624,6 +2648,8 @@ static int ath11k_nss_tx_desc_mem_alloc(
+ 		ab->nss.tx_desc_size[curr_page_idx] = alloc_size;
+ 		curr_page_idx++;
+ 
++		ATH11K_MEMORY_STATS_INC(ab, dma_alloc, alloc_size);
++
+ 		ath11k_dbg(ab, ATH11K_DBG_NSS,
+ 			   "curr page %d, allocated %d, total allocated %d\n",
+ 			   curr_page_idx, alloc_size, i + alloc_size);
+@@ -2795,6 +2821,8 @@ static int ath11k_nss_init(struct ath11k
+ 	if (!wlmsg)
+ 		return -ENOMEM;
+ 
++	ATH11K_MEMORY_STATS_INC(ab, malloc_size, sizeof(struct nss_wifili_msg));
++
+ 	wim = &wlmsg->msg.init;
+ 
+ 	wim->target_type = target_type;
+@@ -2914,6 +2942,7 @@ unregister:
+ 	nss_unregister_wifili_if(ab->nss.if_num);
+ free:
+ 	ath11k_nss_tx_desc_mem_free(ab);
++	ATH11K_MEMORY_STATS_DEC(ab, malloc_size, sizeof(struct nss_wifili_msg));
+ 	kfree(wlmsg);
+ 	return -EINVAL;
+ }
+@@ -3031,6 +3060,8 @@ int ath11k_nss_pdev_init(struct ath11k_b
+ 		goto unregister;
+ 	}
+ 
++	ATH11K_MEMORY_STATS_INC(ab, malloc_size, sizeof(struct nss_wifili_msg));
++
+ 	pdevmsg = &wlmsg->msg.pdevmsg;
+ 
+ 	pdevmsg->radio_id = radio_id;
+@@ -3077,6 +3108,8 @@ int ath11k_nss_pdev_init(struct ath11k_b
+ 		goto free;
+ 	}
+ 
++	ATH11K_MEMORY_STATS_DEC(ab, malloc_size, sizeof(struct nss_wifili_msg));
++
+ 	kfree(wlmsg);
+ 
+ 	/* Disable nss sojourn stats by default */
+@@ -3095,6 +3128,7 @@ int ath11k_nss_pdev_init(struct ath11k_b
+ 	return 0;
+ 
+ free:
++	ATH11K_MEMORY_STATS_DEC(ab, malloc_size, sizeof(struct nss_wifili_msg));
+ 	kfree(wlmsg);
+ unregister:
+ 	nss_unregister_wifili_radio_if(ar->nss.if_num);
+@@ -3117,6 +3151,8 @@ int ath11k_nss_start(struct ath11k_base
+ 	if (!wlmsg)
+ 		return -ENOMEM;
+ 
++	ATH11K_MEMORY_STATS_INC(ab, malloc_size, sizeof(struct nss_wifili_msg));
++
+ 	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
+ 
+ 	/* Empty message for NSS Start message */
+@@ -3157,6 +3193,7 @@ int ath11k_nss_start(struct ath11k_base
+ 	ath11k_dbg(ab, ATH11K_DBG_NSS, "nss start success\n");
+ 
+ free:
++	ATH11K_MEMORY_STATS_DEC(ab, malloc_size, sizeof(struct nss_wifili_msg));
+ 	kfree(wlmsg);
+ 	return ret;
+ }
+@@ -3175,6 +3212,8 @@ static void ath11k_nss_reset(struct ath1
+ 		return;
+ 	}
+ 
++	ATH11K_MEMORY_STATS_INC(ab, malloc_size, sizeof(struct nss_wifili_msg));
++
+ 	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
+ 
+ 	/* Empty message for NSS Reset message */
+@@ -3213,6 +3252,7 @@ static void ath11k_nss_reset(struct ath1
+ 	nss_unregister_wifili_if(ab->nss.if_num);
+ 
+ free:
++	ATH11K_MEMORY_STATS_DEC(ab, malloc_size, sizeof(struct nss_wifili_msg));
+ 	kfree(wlmsg);
+ }
+ 
+@@ -3228,6 +3268,8 @@ static int ath11k_nss_stop(struct ath11k
+ 	if (!wlmsg)
+ 		return -ENOMEM;
+ 
++	ATH11K_MEMORY_STATS_INC(ab, malloc_size, sizeof(struct nss_wifili_msg));
++
+ 	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
+ 
+ 	/* Empty message for Stop command */
+@@ -3267,6 +3309,8 @@ static int ath11k_nss_stop(struct ath11k
+ 	/* NSS Stop success */
+ 	ret = 0;
+ free:
++	ATH11K_MEMORY_STATS_DEC(ab, malloc_size, sizeof(struct nss_wifili_msg));
++
+ 	kfree(wlmsg);
+ 	return ret;
+ }
+@@ -3292,6 +3336,8 @@ int ath11k_nss_pdev_deinit(struct ath11k
+ 	if (!wlmsg)
+ 		return -ENOMEM;
+ 
++	ATH11K_MEMORY_STATS_INC(ab, malloc_size, sizeof(struct nss_wifili_msg));
++
+ 	deinit = &wlmsg->msg.pdevdeinit;
+ 	deinit->ifnum = radio_id;
+ 
+@@ -3337,6 +3383,7 @@ int ath11k_nss_pdev_deinit(struct ath11k
+ 	nss_dynamic_interface_dealloc_node(ar->nss.if_num, dyn_if_type);
+ 	nss_unregister_wifili_radio_if(ar->nss.if_num);
+ free:
++	ATH11K_MEMORY_STATS_DEC(ab, malloc_size, sizeof(struct nss_wifili_msg));
+ 	kfree(wlmsg);
+ 	return ret;
+ }
+--- a/drivers/net/wireless/ath/ath11k/peer.c
++++ b/drivers/net/wireless/ath/ath11k/peer.c
+@@ -794,6 +794,9 @@ int ath11k_peer_delete(struct ath11k *ar
+ 	if (ret)
+ 		return ret;
+ 
++	ATH11K_MEMORY_STATS_DEC(ar->ab, per_peer_object,
++				sizeof(struct ath11k_peer));
++
+ 	ar->num_peers--;
+ 
+ 	return 0;
+@@ -902,6 +905,8 @@ int ath11k_peer_create(struct ath11k *ar
+ 		arsta->tcl_metadata &= ~HTT_TCL_META_DATA_VALID_HTT;
+ 	}
+ 
++	ATH11K_MEMORY_STATS_INC(ar->ab, per_peer_object, sizeof(*peer));
++
+ 	ar->num_peers++;
+ 
+ 	spin_unlock_bh(&ar->ab->base_lock);
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -623,6 +623,8 @@ struct sk_buff *ath11k_wmi_alloc_skb(str
+ 	if (!skb)
+ 		return NULL;
+ 
++	ATH11K_MEMORY_STATS_INC(ab, wmi_tx_skb_alloc, skb->truesize);
++
+ 	skb_reserve(skb, WMI_SKB_HEADROOM);
+ 	if (!IS_ALIGNED((unsigned long)skb->data, 4))
+ 		ath11k_warn(ab, "unaligned WMI skb data\n");
+@@ -7314,6 +7316,7 @@ static void ath11k_wmi_htc_tx_complete(s
+ 	u8 eid;
+ 
+ 	eid = ATH11K_SKB_CB(skb)->eid;
++	ATH11K_MEMORY_STATS_DEC(ab, wmi_tx_skb_alloc, skb->truesize);
+ 	dev_kfree_skb(skb);
+ 
+ 	if (eid >= ATH11K_HTC_EP_COUNT)
+@@ -9107,6 +9110,7 @@ static void ath11k_wmi_tlv_op_rx(struct
+ 	}
+ 
+ out:
++	ATH11K_MEMORY_STATS_DEC(ab, wmi_tx_skb_alloc, skb->truesize);
+ 	dev_kfree_skb(skb);
+ }
+ 

From a20bf2ff46c9f6134c472dbd8759cb4c422a699c Mon Sep 17 00:00:00 2001
From: Qosmio <datapronix@protonmail.com>
Date: Wed, 10 Jan 2024 22:19:51 -0500
Subject: [PATCH 087/225] ath11k_nss: allow specifying pbuf 'memory_profile'

In case you want to specify the memory profile to use rather than
letting it autodetect. The following new uci option is introduced.
pbuf.

config general opt
  option memory_profile ''

choices are 1gb, 512mb, 256mb. Delete option to let it autodetect.

NOTE: You must reboot after changing these settings, for it to
autoapply.

ath11k_nss: fix compilation and rename some patches
---
 .../mac80211/files/etc/init.d/qca-nss-pbuf    | 29 +++++++++++++++----
 package/kernel/mac80211/files/pbuf.uci        |  5 ++++
 .../199-003-ath11k-add-nss-support.patch      |  2 +-
 ...c80211-Add-support-for-dynamic-vlan.patch} |  0
 ...ncapsulation-of-EAPOL-frames-if-OFFL.patch |  9 ++++++
 ...=> 902-020-ath11k-add-btcoex-config.patch} |  0
 ...9-ath11k-add-HE-stats-in-peer-stats.patch} |  0
 .../905-ath11k-add-support-memory-stats.patch |  2 +-
 8 files changed, 40 insertions(+), 7 deletions(-)
 create mode 100644 package/kernel/mac80211/files/pbuf.uci
 rename package/kernel/mac80211/patches/ath11k_nss/{207-ath11k-Add-support-for-dynamic-vlan.patch => 207-mac80211-Add-support-for-dynamic-vlan.patch} (100%)
 rename package/kernel/mac80211/patches/ath11k_nss/{902-ath11k-add-btcoex-config.patch => 902-020-ath11k-add-btcoex-config.patch} (100%)
 rename package/kernel/mac80211/patches/ath11k_nss/{902-ath11k-add-HE-stats-in-peer-stats.patch => 902-069-ath11k-add-HE-stats-in-peer-stats.patch} (100%)

diff --git a/package/kernel/mac80211/files/etc/init.d/qca-nss-pbuf b/package/kernel/mac80211/files/etc/init.d/qca-nss-pbuf
index 260726fb12d871..be89de061ce8b1 100755
--- a/package/kernel/mac80211/files/etc/init.d/qca-nss-pbuf
+++ b/package/kernel/mac80211/files/etc/init.d/qca-nss-pbuf
@@ -43,7 +43,23 @@ apply_nss_config() {
   sysctl -w dev.nss.n2hcfg.n2h_queue_limit_core0=256 > /dev/null 2> /dev/null
   sysctl -w dev.nss.n2hcfg.n2h_queue_limit_core1=256 > /dev/null 2> /dev/null
 
-  board=$(board_name)
+  local memory_profile
+  if memory_profile=$(uci_get pbuf.opt.memory_profile); then
+    case "$memory_profile" in
+       1g*|512m*|256m*)
+          board=$memory_profile
+          logger -t ath11k_nss "Using custom memory profile - $board"
+          ;;
+        *)
+          logger -s -t ath11k_nss -p user.error "Unknown profile $memory_profile. Choose 1gb, 512mb, or 256mb"
+          board=$(board_name)
+          logger -s -t ath11k_nss -p user.warn "Falling back to: $board"
+          ;;
+    esac
+  else
+     board=$(board_name)
+     logger -t ath11k_nss "Setting n2hcfg values for board: $board"
+  fi
 
   case "$board" in
     # 1GB+ profile
@@ -60,7 +76,8 @@ apply_nss_config() {
     qnap,301w | \
     xiaomi,ax9000 | \
     yuncore,ax880 | \
-    zyxel,nbg7815)
+    zyxel,nbg7815 | \
+    1g*)
       extra_pbuf_core0=9000000 n2h_high_water_core0=67392 n2h_wifi_pool_buf=40960 apply_sysctl
       ;;
     # 512MB profile
@@ -69,11 +86,13 @@ apply_nss_config() {
     linksys,mx4200v1 | \
     redmi,ax6 | \
     xiaomi,ax3600 | \
-    zte,mf269) # 512MB profile
+    zte,mf269 | \
+    512m*)
       extra_pbuf_core0=3100000 n2h_high_water_core0=30624 n2h_wifi_pool_buf=8192 apply_sysctl
       ;;
     # 256MB profile
-    netgear,wax218)
+    netgear,wax218 | \
+    256m*)
       extra_pbuf_core0=3100000 n2h_high_water_core0=30258 n2h_wifi_pool_buf=4096 apply_sysctl
       ;;
   esac
@@ -88,7 +107,7 @@ start() {
   enable_nss_offload=$(cat /sys/module/ath11k/parameters/nss_offload)
 
   if [ "$enable_nss_offload" = "0" ]; then
-    logger -t ath11k_nss "Module parameter 'nss_offload=0'. Skipping applying wifi nss configs"
+    logger -t ath11k_nss -s user.warn "Module parameter 'nss_offload=0'. Skipping applying wifi nss configs"
     exit 1
   fi
 
diff --git a/package/kernel/mac80211/files/pbuf.uci b/package/kernel/mac80211/files/pbuf.uci
new file mode 100644
index 00000000000000..ac4fadbc4f5e63
--- /dev/null
+++ b/package/kernel/mac80211/files/pbuf.uci
@@ -0,0 +1,5 @@
+config general opt
+  # to bypass board autodetection, uncomment ONE of the options below
+  # option memory_profile '1gb'
+  # option memory_profile '512mb'
+  # option memory_profile '256mb'
diff --git a/package/kernel/mac80211/patches/ath11k_nss/199-003-ath11k-add-nss-support.patch b/package/kernel/mac80211/patches/ath11k_nss/199-003-ath11k-add-nss-support.patch
index cfe11083939837..ffae0a9448ef8b 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/199-003-ath11k-add-nss-support.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/199-003-ath11k-add-nss-support.patch
@@ -1069,7 +1069,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	/* create list containing all the subframes */
  	ieee80211_amsdu_to_8023s(skb, &subframe_list, NULL,
 -				 vif->type, 0, NULL, NULL);
-+				 vif->type, 0, NULL, NULL, false);
++				 vif->type, 0, NULL, NULL, 0);
  
  	/* This shouldn't happen, indicating error during defragmentation */
  	if (skb_queue_empty(&subframe_list))
diff --git a/package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Add-support-for-dynamic-vlan.patch b/package/kernel/mac80211/patches/ath11k_nss/207-mac80211-Add-support-for-dynamic-vlan.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Add-support-for-dynamic-vlan.patch
rename to package/kernel/mac80211/patches/ath11k_nss/207-mac80211-Add-support-for-dynamic-vlan.patch
diff --git a/package/kernel/mac80211/patches/ath11k_nss/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch b/package/kernel/mac80211/patches/ath11k_nss/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
index b64643140a14b1..70e2603c8cc02b 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
@@ -66,6 +66,15 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
                          rcu_read_unlock();
                          return;
                  }
+@@ -4374,7 +4378,7 @@ void __ieee80211_subif_start_xmit(struct
+ 		if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) {
+ 		    	if (sta)
+ 				key = rcu_dereference(sta->ptk[sta->ptk_idx]);
+-			ieee80211_8023_xmit(sdata, dev, sta, key, skb);
++			ieee80211_8023_xmit(sdata, dev, sta, key, skb, info_flags, ctrl_flags, cookie);
+ 		} else {
+ 			ieee80211_tx_stats(dev, skb->len);
+ 			ieee80211_xmit(sdata, sta, skb);
 @@ -4657,19 +4663,29 @@ static bool ieee80211_tx_8023(struct iee
  
  static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
diff --git a/package/kernel/mac80211/patches/ath11k_nss/902-ath11k-add-btcoex-config.patch b/package/kernel/mac80211/patches/ath11k_nss/902-020-ath11k-add-btcoex-config.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath11k_nss/902-ath11k-add-btcoex-config.patch
rename to package/kernel/mac80211/patches/ath11k_nss/902-020-ath11k-add-btcoex-config.patch
diff --git a/package/kernel/mac80211/patches/ath11k_nss/902-ath11k-add-HE-stats-in-peer-stats.patch b/package/kernel/mac80211/patches/ath11k_nss/902-069-ath11k-add-HE-stats-in-peer-stats.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath11k_nss/902-ath11k-add-HE-stats-in-peer-stats.patch
rename to package/kernel/mac80211/patches/ath11k_nss/902-069-ath11k-add-HE-stats-in-peer-stats.patch
diff --git a/package/kernel/mac80211/patches/ath11k_nss/905-ath11k-add-support-memory-stats.patch b/package/kernel/mac80211/patches/ath11k_nss/905-ath11k-add-support-memory-stats.patch
index f4f4389960bd74..734b6fb8c4b160 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/905-ath11k-add-support-memory-stats.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/905-ath11k-add-support-memory-stats.patch
@@ -251,7 +251,7 @@ Signed-off-by: Maharaja Kennadyrajan <mkenna@codeaurora.org>
 +
 +static ssize_t
 +ath11k_debug_write_enable_memory_stats(struct file *file,
-+				       char __user *ubuf,
++				       const char __user *ubuf,
 +				       size_t count, loff_t *ppos)
 +{
 +	struct ath11k_base *ab = file->private_data;

From 9de9301f8c040d6e1d39b0fc0f5162fc85be9058 Mon Sep 17 00:00:00 2001
From: Qosmio <datapronix@protonmail.com>
Date: Sat, 13 Jan 2024 08:19:32 -0500
Subject: [PATCH 088/225] ath11k_nss: ath11k support dynamic vlan

also support offload for the following:

  mac80211:
    * vlan
    * mesh (partial)
  ath11k:
    * vlan
---
 ...-ath11k-Add-support-for-dynamic-vlan.patch |  381 ++++
 ...00-mac80211-nss-mesh-offload-support.patch | 1241 +++++++++++++
 ...TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch |   80 +
 ...TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch |   45 +
 .../336-mac80211-Mesh-Fast-rx-support.patch   |  208 +++
 ...rning-with-monitor-interface-restart.patch |   33 +
 ...interface-combination-advertisement-.patch | 1594 +++++++++++++++++
 .../829-mac80211-fix-mesh-ping-issue.patch    |  113 ++
 .../902-022-ath11k-add-ap-ps-support.patch    |  324 ++++
 ...x-memory-corruption-during-mesh-beac.patch |   68 +
 ...04-300-ath11k-nss_get_arvif_from_dev.patch |  113 ++
 ...07-068-ath11k-add-rx-histogram-stats.patch |  608 +++++++
 ...ul-ofdma-ru-allocation-in-peer-stats.patch |  452 +++++
 ...11k-remove-error-on-soc-debugfs-fail.patch |  146 ++
 .../908-301-ath11k-nss-mcbc-exception.patch   |  253 +++
 ...30-ath11k-sync-wds_ast_entry-updates.patch |  522 ++++++
 ...ct-ast-index-assignment-for-wds-peer.patch |   96 +
 17 files changed, 6277 insertions(+)
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Add-support-for-dynamic-vlan.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/300-mac80211-nss-mesh-offload-support.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/335-0003-mac80211-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/336-mac80211-Mesh-Fast-rx-support.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/675-01-cfg80211-Extend-interface-combination-advertisement-.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/829-mac80211-fix-mesh-ping-issue.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/902-022-ath11k-add-ap-ps-support.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/902-wifi-mac80211-Fix-memory-corruption-during-mesh-beac.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/904-300-ath11k-nss_get_arvif_from_dev.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/907-068-ath11k-add-rx-histogram-stats.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/907-108-ath11k-enable-ul-ofdma-ru-allocation-in-peer-stats.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/907-ath11k-remove-error-on-soc-debugfs-fail.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/908-301-ath11k-nss-mcbc-exception.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/908-330-ath11k-sync-wds_ast_entry-updates.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/908-362-ath11k-fix-incorrect-ast-index-assignment-for-wds-peer.patch

diff --git a/package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Add-support-for-dynamic-vlan.patch b/package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Add-support-for-dynamic-vlan.patch
new file mode 100644
index 00000000000000..b17b9fb419745d
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Add-support-for-dynamic-vlan.patch
@@ -0,0 +1,381 @@
+From 71add81f4a3f1ea505f498d789e7a1721c4d7a6e Mon Sep 17 00:00:00 2001
+From: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+Date: Mon, 4 Sep 2023 12:48:19 +0530
+Subject: [PATCH] ath11k: Add support for dynamic vlan
+
+This patch adds support for dynamic vlan. VLAN group traffics
+are encrypted in software. vlan unicast packets shall be taking
+8023 xmit path if encap offload is enabled and mcast/bcast will
+be using 80211 xmit path.
+
+Metadata info in dp_tx added to notify firmware that the
+multicast/broadcast packets are encrypted in sw.
+
+Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/core.h  |   1 +
+ drivers/net/wireless/ath/ath11k/dp_tx.c |  80 +++++++++-
+ drivers/net/wireless/ath/ath11k/dp_tx.h | 198 ++++++++++++++++++++++++
+ drivers/net/wireless/ath/ath11k/mac.c   |   3 +
+ 4 files changed, 279 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -116,6 +116,7 @@ struct ath11k_skb_cb {
+ 	u32 cipher;
+ 	struct ath11k *ar;
+ 	struct ieee80211_vif *vif;
++	u32 pkt_offset;
+ } __packed;
+ 
+ struct ath11k_skb_rxcb {
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -79,6 +79,43 @@ enum hal_encrypt_type ath11k_dp_tx_get_e
+ 	}
+ }
+ 
++#define HTT_META_DATA_ALIGNMENT	0x8
++
++static int ath11k_dp_metadata_align_skb(struct sk_buff *skb, u8 align_len)
++{
++	if (unlikely(skb_cow_head(skb, align_len)))
++		return -ENOMEM;
++
++	skb_push(skb, align_len);
++	memset(skb->data, 0, align_len);
++	return 0;
++}
++
++static int ath11k_dp_prepare_htt_metadata(struct sk_buff *skb,
++					  u8 *htt_metadata_size)
++{
++	u8 htt_desc_size;
++	/* Size rounded of multiple of 8 bytes */
++	u8 htt_desc_size_aligned;
++	int ret;
++	struct htt_tx_msdu_desc_ext *desc_ext;
++
++	htt_desc_size = sizeof(struct htt_tx_msdu_desc_ext);
++	htt_desc_size_aligned = ALIGN(htt_desc_size, HTT_META_DATA_ALIGNMENT);
++
++	ret = ath11k_dp_metadata_align_skb(skb, htt_desc_size_aligned);
++	if (unlikely(ret))
++		return ret;
++
++	desc_ext = (struct htt_tx_msdu_desc_ext *)skb->data;
++	desc_ext->valid_encrypt_type = 1;
++	desc_ext->encrypt_type = 0;
++	desc_ext->host_tx_desc_pool = 1;
++	*htt_metadata_size = htt_desc_size_aligned;
++
++	return 0;
++}
++
+ int ath11k_dp_tx(struct ath11k *ar, struct ath11k_vif *arvif,
+ 		 struct ath11k_sta *arsta, struct sk_buff *skb)
+ {
+@@ -96,7 +133,8 @@ int ath11k_dp_tx(struct ath11k *ar, stru
+ 	int ret;
+ 	u32 ring_selector = 0;
+ 	u8 ring_map = 0;
+-	bool tcl_ring_retry;
++	bool tcl_ring_retry, is_diff_encap = false;
++	u8 align_pad, htt_meta_size = 0;
+ 
+ 	if (unlikely(test_bit(ATH11K_FLAG_CRASH_FLUSH, &ar->ab->dev_flags)))
+ 		return -ESHUTDOWN;
+@@ -189,7 +227,10 @@ tcl_ring_sel:
+ 
+ 	switch (ti.encap_type) {
+ 	case HAL_TCL_ENCAP_TYPE_NATIVE_WIFI:
+-		ath11k_dp_tx_encap_nwifi(skb);
++		if (arvif->vif->offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED)
++			is_diff_encap = true;
++		else
++			ath11k_dp_tx_encap_nwifi(skb);
+ 		break;
+ 	case HAL_TCL_ENCAP_TYPE_RAW:
+ 		if (!test_bit(ATH11K_FLAG_RAW_MODE, &ab->dev_flags)) {
+@@ -208,6 +249,33 @@ tcl_ring_sel:
+ 		goto fail_remove_idr;
+ 	}
+ 
++	/* Add metadata for sw encrypted vlan group traffic */
++	if ((!test_bit(ATH11K_FLAG_HW_CRYPTO_DISABLED, &ar->ab->dev_flags) &&
++	    !(info->control.flags & IEEE80211_TX_CTL_HW_80211_ENCAP) &&
++	    !info->control.hw_key && ieee80211_has_protected(hdr->frame_control)) ||
++	    (skb->protocol == cpu_to_be16(ETH_P_PAE) && is_diff_encap)) {
++		/* HW requirement is that metadata should always point to a
++		 * 8-byte aligned address. So we add alignment pad to start of
++		 * buffer. HTT Metadata should be ensured to be multiple of 8-bytes
++		 *  to get 8-byte aligned start address along with align_pad added
++		 */
++		align_pad = ((unsigned long)skb->data) & (HTT_META_DATA_ALIGNMENT - 1);
++		ret = ath11k_dp_metadata_align_skb(skb, align_pad);
++		if (unlikely(ret))
++			goto fail_remove_idr;
++
++		ti.pkt_offset += align_pad;
++		ret = ath11k_dp_prepare_htt_metadata(skb, &htt_meta_size);
++		if (unlikely(ret))
++			goto fail_remove_idr;
++
++		ti.pkt_offset += htt_meta_size;
++		ti.meta_data_flags |= HTT_TCL_META_DATA_VALID_HTT;
++		ti.flags0 |= FIELD_PREP(HAL_TCL_DATA_CMD_INFO1_TO_FW, 1);
++		ti.encap_type = HAL_TCL_ENCAP_TYPE_RAW;
++		ti.encrypt_type = HAL_ENCRYPT_TYPE_OPEN;
++	}
++
+ 	ti.paddr = dma_map_single(ab->dev, skb->data, skb->len, DMA_TO_DEVICE);
+ 	if (unlikely(dma_mapping_error(ab->dev, ti.paddr))) {
+ 		atomic_inc(&ab->soc_stats.tx_err.misc_fail);
+@@ -216,7 +284,8 @@ tcl_ring_sel:
+ 		goto fail_remove_idr;
+ 	}
+ 
+-	ti.data_len = skb->len;
++	ti.data_len = skb->len - ti.pkt_offset;
++	skb_cb->pkt_offset = ti.pkt_offset;
+ 	skb_cb->paddr = ti.paddr;
+ 	skb_cb->vif = arvif->vif;
+ 	skb_cb->ar = ar;
+@@ -272,6 +341,8 @@ fail_unmap_dma:
+ 	dma_unmap_single(ab->dev, ti.paddr, ti.data_len, DMA_TO_DEVICE);
+ 
+ fail_remove_idr:
++	if (ti.pkt_offset)
++		skb_pull(skb, ti.pkt_offset);
+ 	spin_lock_bh(&tx_ring->tx_idr_lock);
+ 	idr_remove(&tx_ring->txbuf_idr,
+ 		   FIELD_GET(DP_TX_DESC_ID_MSDU_ID, ti.desc_id));
+@@ -358,6 +429,9 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
+ 	flags = skb_cb->flags;
+ 	vif = skb_cb->vif;
+ 
++	if (skb_cb->pkt_offset)
++		skb_pull(msdu, skb_cb->pkt_offset); /* removing the alignment and htt meta data */
++
+ 	memset(&info->status, 0, sizeof(info->status));
+ 
+ 	if (ts->acked) {
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.h
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.h
+@@ -16,6 +16,204 @@ struct ath11k_dp_htt_wbm_tx_status {
+ 	u16 peer_id;
+ };
+ 
++/* htt_tx_msdu_desc_ext
++ *
++ * valid_pwr
++ *		if set, tx pwr spec is valid
++ *
++ * valid_mcs_mask
++ *		if set, tx MCS mask is valid
++ *
++ * valid_nss_mask
++ *		if set, tx Nss mask is valid
++ *
++ * valid_preamble_type
++ *		if set, tx preamble spec is valid
++ *
++ * valid_retries
++ *		if set, tx retries spec is valid
++ *
++ * valid_bw_info
++ *		if set, tx dyn_bw and bw_mask are valid
++ *
++ * valid_guard_interval
++ *		if set, tx guard intv spec is valid
++ *
++ * valid_chainmask
++ *		if set, tx chainmask is valid
++ *
++ * valid_encrypt_type
++ *		if set, encrypt type is valid
++ *
++ * valid_key_flags
++ *		if set, key flags is valid
++ *
++ * valid_expire_tsf
++ *		if set, tx expire TSF spec is valid
++ *
++ * valid_chanfreq
++ *		if set, chanfreq is valid
++ *
++ * is_dsrc
++ *		if set, MSDU is a DSRC frame
++ *
++ * guard_interval
++ *		0.4us, 0.8us, 1.6us, 3.2us
++ *
++ * encrypt_type
++ *		0 = NO_ENCRYPT,
++ *		1 = ENCRYPT,
++ *		2 ~ 3 - Reserved
++ *
++ * retry_limit
++ *		Specify the maximum number of transmissions, including the
++ *		initial transmission, to attempt before giving up if no ack
++ *		is received.
++ *		If the tx rate is specified, then all retries shall use the
++ *		same rate as the initial transmission.
++ *		If no tx rate is specified, the target can choose whether to
++ *		retain the original rate during the retransmissions, or to
++ *		fall back to a more robust rate.
++ *
++ * use_dcm_11ax
++ *		If set, Use Dual subcarrier modulation.
++ *		Valid only for 11ax preamble types HE_SU
++ *		and HE_EXT_SU
++ *
++ * ltf_subtype_11ax
++ *		Takes enum values of htt_11ax_ltf_subtype_t
++ *		Valid only for 11ax preamble types HE_SU
++ *		and HE_EXT_SU
++ *
++ * dyn_bw
++ *		0 = static bw, 1 = dynamic bw
++ *
++ * bw_mask
++ *		Valid only if dyn_bw == 0 (static bw).
++ *
++ * host_tx_desc_pool
++ *		If set, Firmware allocates tx_descriptors
++ *		in WAL_BUFFERID_TX_HOST_DATA_EXP,instead
++ *		of WAL_BUFFERID_TX_TCL_DATA_EXP.
++ *		Use cases:
++ *		Any time firmware uses TQM-BYPASS for Data
++ *		TID, firmware expect host to set this bit.
++ *
++ * power
++ *		unit of the power field is 0.5 dbm
++ *		signed value ranging from -64dbm to 63.5 dbm
++ *
++ * mcs_mask
++ *		mcs bit mask of 0 ~ 11
++ *		Setting more than one MCS isn't currently
++ *		supported by the target (but is supported
++ *		in the interface in case in the future
++ *		the target supports specifications of
++ *		a limited set of MCS values.
++ *
++ * nss_mask
++ *		Nss bit mask 0 ~ 7
++ *		Setting more than one Nss isn't currently
++ *		supported by the target (but is supported
++ *		in the interface in case in the future
++ *		the target supports specifications of
++ *		a limited set of Nss values.
++ *
++ * pream_type
++ *		Preamble types
++ *
++ * update_peer_cache
++ *		When set these custom values will be
++ *		used for all packets, until the next
++ *		update via this ext header.
++ *		This is to make sure not all packets
++ *		need to include this header.
++ *
++ * chain_mask
++ *		specify which chains to transmit from
++ *
++ * key_flags
++ *		Key Index and related flags - used in mesh mode
++ *
++ * chanfreq
++ *		Channel frequency: This identifies the desired channel
++ *		frequency (in MHz) for tx frames. This is used by FW to help
++ *		determine when it is safe to transmit or drop frames for
++ *		off-channel operation.
++ *		The default value of zero indicates to FW that the corresponding
++ *		VDEV's home channel (if there is one) is the desired channel
++ *		frequency.
++ *
++ * expire_tsf_lo
++ *		tx expiry time (TSF) LSBs
++ *
++ * expire_tsf_hi
++ *		tx expiry time (TSF) MSBs
++ *
++ * learning_frame
++ *		When this flag is set, this frame will be dropped by FW
++ *		rather than being enqueued to the Transmit Queue Manager (TQM) HW.
++ *
++ * send_as_standalone
++ *		This will indicate if the msdu needs to be sent as a singleton PPDU,
++ *		i.e. with no A-MSDU or A-MPDU aggregation.
++ *		The scope is extended to other use-cases.
++ *
++ * is_host_opaque_valid
++ *		set this bit to 1 if the host_opaque_cookie is populated
++ *		with valid information.
++ *
++ * host_opaque_cookie
++ *		Host opaque cookie for special frames
++ */
++
++struct htt_tx_msdu_desc_ext {
++	u32
++		valid_pwr            : 1,
++		valid_mcs_mask       : 1,
++		valid_nss_mask       : 1,
++		valid_preamble_type  : 1,
++		valid_retries        : 1,
++		valid_bw_info        : 1,
++		valid_guard_interval : 1,
++		valid_chainmask      : 1,
++		valid_encrypt_type   : 1,
++		valid_key_flags      : 1,
++		valid_expire_tsf     : 1,
++		valid_chanfreq       : 1,
++		is_dsrc              : 1,
++		guard_interval       : 2,
++		encrypt_type         : 2,
++		retry_limit          : 4,
++		use_dcm_11ax         : 1,
++		ltf_subtype_11ax     : 2,
++		dyn_bw               : 1,
++		bw_mask              : 6,
++		host_tx_desc_pool    : 1;
++	u32
++		power                : 8,
++		mcs_mask             : 12,
++		nss_mask             : 8,
++		pream_type           : 3,
++		update_peer_cache    : 1;
++	u32
++		chain_mask         : 8,
++		key_flags          : 8,
++		chanfreq           : 16;
++
++	u32 expire_tsf_lo;
++	u32 expire_tsf_hi;
++
++	u32
++		learning_frame       :  1,
++		send_as_standalone   :  1,
++		is_host_opaque_valid :  1,
++		rsvd0                : 29;
++	u32
++		host_opaque_cookie  : 16,
++		rsvd1               : 16;
++} __packed;
++
+ void ath11k_dp_tx_update_txcompl(struct ath11k *ar, struct hal_tx_status *ts);
+ int ath11k_dp_tx_htt_h2t_ver_req_msg(struct ath11k_base *ab);
+ int ath11k_dp_tx(struct ath11k *ar, struct ath11k_vif *arvif,
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -9764,6 +9764,9 @@ static int __ath11k_mac_register(struct
+ 		 */
+ 		ar->hw->wiphy->interface_modes &= ~BIT(NL80211_IFTYPE_MONITOR);
+ 
++	ar->hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_AP_VLAN);
++	ar->hw->wiphy->software_iftypes |= BIT(NL80211_IFTYPE_AP_VLAN);
++
+ 	/* Apply the regd received during initialization */
+ 	ret = ath11k_regd_update(ar);
+ 	if (ret) {
diff --git a/package/kernel/mac80211/patches/ath11k_nss/300-mac80211-nss-mesh-offload-support.patch b/package/kernel/mac80211/patches/ath11k_nss/300-mac80211-nss-mesh-offload-support.patch
new file mode 100644
index 00000000000000..7233913ee6f0f7
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/300-mac80211-nss-mesh-offload-support.patch
@@ -0,0 +1,1241 @@
+From fbe5a76d8c9ff1cf3f906a3c863928fc1adcbc95 Mon Sep 17 00:00:00 2001
+From: Karthikeyan Kathirvel <kathirve@codeaurora.org>
+Date: Tue, 16 Feb 2021 13:44:39 +0530
+Subject: [PATCH] ath11k: Add mesh nss offload support
+
+- New capability advertising nss offload support for mesh type
+- Mesh obj vap and link vap registration/clean up
+- Command/event handling
+- New .ch files in ath11k for nss mesh offload related debugs
+- Tx/Rx data path on mesh link vap uses native wifi format
+- Mesh obj vap handls packets in ether format. No Tx on Mesh
+  obj vap is expected as packets transmitted in slow path is
+  supposed to be encapsulated in 802.11 format.
+- New mac80211-driver callbacks for mesh vap, mpath and mpp
+  configurations.
+
+Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
+
+Change-Id: Ib6950344286ba18fab43586262c62dcd09557614
+Co-developed-by: Karthikeyan Kathirvel <kathirve@codeaurora.org>
+Signed-off-by: Karthikeyan Kathirvel <kathirve@codeaurora.org>
+Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
+Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
+---
+ include/net/mac80211.h                      |  106 ++
+ net/mac80211/cfg.c                          |   19 +-
+ net/mac80211/debug.h                        |   10 +
+ net/mac80211/debugfs.c                      |    1 +
+ net/mac80211/driver-ops.c                   |   20 +
+ net/mac80211/driver-ops.h                   |    7 +
+ net/mac80211/mesh.h                         |    5 +
+ net/mac80211/mesh_hwmp.c                    |  273 +++++
+ net/mac80211/mesh_pathtbl.c                 |  167 ++-
+ net/mac80211/rx.c                           |    8 +-
+ 10 files changed, 2548 insertions(+), 206 deletions(-)
+ create mode 100644 drivers/net/wireless/ath/ath11k/debug_nss.c
+ create mode 100644 drivers/net/wireless/ath/ath11k/debug_nss.h
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -145,6 +145,9 @@
+  */
+ struct device;
+ 
++struct ieee80211_mesh_path_offld;
++enum ieee80211_mesh_path_offld_cmd;
++
+ /**
+  * enum ieee80211_max_queues - maximum number of queues
+  *
+@@ -387,11 +390,17 @@ enum ieee80211_bss_change {
+  * to indicate which NSS BSS parameter changed.
+  *
+  * @BSS_CHANGED_NSS_AP_ISOLATE: AP Isolate feature in NSS mode
++ * @BSS_CHANGED_NSS_MESH_TTL: TTL update in NSS mesh mode
++ * @BSS_CHANGED_NSS_MESH_REFRESH_TIME: Mesh refresh time in NSS mesh mode
++ * @BSS_CHANGED_NSS_MESH_FWD_ENABLED: NSS offload mesh forward enabled
+  *
+  */
+ 
+ enum ieee80211_nss_bss_change {
+ 	BSS_CHANGED_NSS_AP_ISOLATE  = BIT(0),
++	BSS_CHANGED_NSS_MESH_TTL  = BIT(1),
++	BSS_CHANGED_NSS_MESH_REFRESH_TIME  = BIT(2),
++	BSS_CHANGED_NSS_MESH_FWD_ENABLED  = BIT(3),
+ };
+ 
+ /*
+@@ -794,6 +803,11 @@ struct ieee80211_bss_conf {
+ 	bool eht_mu_beamformer;
+ 	bool nss_ap_isolate;
+ 	enum nl80211_beacon_tx_mode beacon_tx_mode;
++
++	/* Mesh configuration for nss offload */
++	u8 nss_offld_ttl;
++	bool nss_offld_mesh_forward_enabled;
++	u32 nss_offld_mpath_refresh_time;
+ };
+ 
+ /**
+@@ -1273,6 +1287,8 @@ struct ieee80211_rate_status {
+  * @ack_hwtstamp: Hardware timestamp of the received ack in nanoseconds
+  *	Only needed for Timing measurement and Fine timing measurement action
+  *	frames. Only reported by devices that have timestamping enabled.
++ * @mpdu_succ: Number of mpdus successfully transmitted
++ * @mpdu_fail: Number of mpdus failed
+  */
+ struct ieee80211_tx_status {
+ 	struct ieee80211_sta *sta;
+@@ -1283,6 +1299,8 @@ struct ieee80211_tx_status {
+ 	u8 n_rates;
+ 
+ 	struct list_head *free_list;
++	u32 mpdu_succ;
++	u32 mpdu_fail;
+ };
+ 
+ /**
+@@ -1775,6 +1793,7 @@ struct ieee80211_channel_switch {
+  *	this is not pure P2P vif.
+  * @IEEE80211_VIF_DISABLE_SMPS_OVERRIDE: disable user configuration of
+  *	SMPS mode via debugfs.
++ * @IEEE80211_HW_NSS_OFFLOAD_DEBUG_MODE: It enables the debug mode of nss offload.
+  */
+ enum ieee80211_vif_flags {
+ 	IEEE80211_VIF_BEACON_FILTER		= BIT(0),
+@@ -1782,6 +1801,7 @@ enum ieee80211_vif_flags {
+ 	IEEE80211_VIF_SUPPORTS_UAPSD		= BIT(2),
+ 	IEEE80211_VIF_GET_NOA_UPDATE		= BIT(3),
+ 	IEEE80211_VIF_DISABLE_SMPS_OVERRIDE	= BIT(4),
++	IEEE80211_VIF_NSS_OFFLOAD_DEBUG_MODE    = BIT(5),
+ };
+ 
+ 
+@@ -2765,6 +2785,7 @@ enum ieee80211_hw_flags {
+ 	IEEE80211_HW_DETECTS_COLOR_COLLISION,
+ 	IEEE80211_HW_MLO_MCAST_MULTI_LINK_TX,
+ 	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
++	IEEE80211_HW_SUPPORTS_MESH_NSS_OFFLOAD,
+ 
+ 	/* keep last, obviously */
+ 	NUM_IEEE80211_HW_FLAGS
+@@ -4265,6 +4286,8 @@ struct ieee80211_prep_tx_info {
+  * @set_sar_specs: Update the SAR (TX power) settings.
+  * @sta_set_decap_offload: Called to notify the driver when a station is allowed
+  *	to use rx decapsulation offload
++ * @config_mesh_offload_path: Configure mesh path table when driver supports mesh offload.
++ *	This calback must be atomic.
+  * @add_twt_setup: Update hw with TWT agreement parameters received from the peer.
+  *	This callback allows the hw to check if requested parameters
+  *	are supported and if there is enough room for a new agreement.
+@@ -4648,6 +4671,12 @@ struct ieee80211_ops {
+ 	void (*sta_set_decap_offload)(struct ieee80211_hw *hw,
+ 				      struct ieee80211_vif *vif,
+ 				      struct ieee80211_sta *sta, bool enabled);
++#ifdef CPTCFG_MAC80211_MESH
++	void (*config_mesh_offload_path)(struct ieee80211_hw *hw,
++					 struct ieee80211_vif *vif,
++					 enum ieee80211_mesh_path_offld_cmd cmd,
++					 struct ieee80211_mesh_path_offld *path);
++#endif
+ 	void (*add_twt_setup)(struct ieee80211_hw *hw,
+ 			      struct ieee80211_sta *sta,
+ 			      struct ieee80211_twt_setup *twt);
+@@ -7481,4 +7510,100 @@ int ieee80211_set_active_links(struct ie
+ void ieee80211_set_active_links_async(struct ieee80211_vif *vif,
+ 				      u16 active_links);
+ 
++/* Defines for Mesh NSS offload */
++
++enum ieee80211_mesh_path_offld_cmd {
++	IEEE80211_MESH_PATH_OFFLD_CMD_ADD_MPATH,
++	IEEE80211_MESH_PATH_OFFLD_CMD_UPDATE_MPATH,
++	IEEE80211_MESH_PATH_OFFLD_CMD_DELETE_MPATH,
++	IEEE80211_MESH_PATH_OFFLD_CMD_ADD_MPP,
++	IEEE80211_MESH_PATH_OFFLD_CMD_UPDATE_MPP,
++	IEEE80211_MESH_PATH_OFFLD_CMD_DELETE_MPP,
++};
++
++enum ieee80211_mesh_path_offld_action {
++	IEEE80211_MESH_PATH_OFFLD_ACTION_MPATH_REFRESH	= BIT(0),
++	IEEE80211_MESH_PATH_OFFLD_ACTION_MPATH_DEL	= BIT(1),
++	IEEE80211_MESH_PATH_OFFLD_ACTION_MPATH_EXP	= BIT(2),
++	IEEE80211_MESH_PATH_OFFLD_ACTION_MPP_LEARN	= BIT(3),
++	IEEE80211_MESH_PATH_OFFLD_ACTION_MPP_ADD	= BIT(4),
++	IEEE80211_MESH_PATH_OFFLD_ACTION_MPP_UPDATE	= BIT(5),
++	IEEE80211_MESH_PATH_OFFLD_ACTION_PATH_NOT_FOUND	= BIT(6),
++};
++
++/* Duplicate defines to make it available to driver */
++enum ieee80211_mesh_path_flags {
++	IEEE80211_MESH_PATH_ACTIVE =		BIT(0),
++	IEEE80211_MESH_PATH_RESOLVING =		BIT(1),
++	IEEE80211_MESH_PATH_SN_VALID =		BIT(2),
++	IEEE80211_MESH_PATH_FIXED =		BIT(3),
++	IEEE80211_MESH_PATH_RESOLVED =		BIT(4),
++	IEEE80211_MESH_PATH_REQ_QUEUED =	BIT(5),
++	IEEE80211_MESH_PATH_DELETED =		BIT(6),
++};
++
++struct ieee80211_mesh_path_offld {
++	u8 mesh_da[ETH_ALEN];
++	u8 da[ETH_ALEN];
++	u8 next_hop[ETH_ALEN];
++	u8 old_next_hop[ETH_ALEN];
++	u8 ta[ETH_ALEN];
++	u32 metric;
++	unsigned long exp_time;
++	u8 hop_count;
++	u16 flags; /* See &enum ieee80211_mesh_path_flags */
++	u8 mesh_gate;
++	u8 block_mesh_fwd;
++	u8 metadata_type;
++};
++
++#ifdef CPTCFG_MAC80211_MESH
++/** ieee80211_mesh_path_offld_change_notify - Notify mesh path change event.
++ * @vif: Mesh interface on which the event is being reported.
++ * @path: Mesh path which got changed. Please note not all the entries in the
++ *	  path will have valid information. Based on the action code, it will be
++ *	  processed.
++ * @action: Type of the event.
++ */
++int ieee80211_mesh_path_offld_change_notify(struct ieee80211_vif *vif,
++					    struct ieee80211_mesh_path_offld *path,
++					    enum ieee80211_mesh_path_offld_action action);
++
++/** ieee80211s_update_metric_ppdu - Upate tx PPDU stats for 11s metric computation
++ *
++ * @hw: the hardware the frame was transmitted by
++ * @st: tx status information
++*/
++void ieee80211s_update_metric_ppdu(struct ieee80211_hw *hw,
++				   struct ieee80211_tx_status *st);
++
++/** mesh_nss_offld_proxy_path_exp_update - update the expiry time from nss
++ * @vif Mesh interface on which the event is being reported.
++ * @mac: dest_mac_addr of the mesh proxy path
++ * @time_diff: This is the time diff since the mesh peer is active
++ */
++void mesh_nss_offld_proxy_path_exp_update(struct ieee80211_vif *vif, u8* da,
++					   u8* mesh_da, u32 time_diff);
++#else
++static inline int
++ieee80211_mesh_path_offld_change_notify(struct ieee80211_vif *vif,
++					struct ieee80211_mesh_path_offld *path,
++					enum ieee80211_mesh_path_offld_action action)
++{
++	return 0;
++}
++
++static inline void
++ieee80211s_update_metric_ppdu(struct ieee80211_hw *hw,
++			      struct ieee80211_tx_status *st)
++{
++}
++
++static inline void
++mesh_nss_offld_proxy_path_exp_update(struct ieee80211_vif *vif, u8* da,
++				      u8* mesh_da, u32 time_diff)
++{
++}
++#endif
++
+ #endif /* MAC80211_H */
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -2514,6 +2514,7 @@ static int ieee80211_update_mesh_config(
+ 	struct mesh_config *conf;
+ 	struct ieee80211_sub_if_data *sdata;
+ 	struct ieee80211_if_mesh *ifmsh;
++	u32 nss_changed = 0;
+ 
+ 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+ 	ifmsh = &sdata->u.mesh;
+@@ -2530,8 +2531,11 @@ static int ieee80211_update_mesh_config(
+ 		conf->dot11MeshMaxPeerLinks = nconf->dot11MeshMaxPeerLinks;
+ 	if (_chg_mesh_attr(NL80211_MESHCONF_MAX_RETRIES, mask))
+ 		conf->dot11MeshMaxRetries = nconf->dot11MeshMaxRetries;
+-	if (_chg_mesh_attr(NL80211_MESHCONF_TTL, mask))
++	if (_chg_mesh_attr(NL80211_MESHCONF_TTL, mask)) {
+ 		conf->dot11MeshTTL = nconf->dot11MeshTTL;
++		sdata->vif.bss_conf.nss_offld_ttl = nconf->dot11MeshTTL;
++		nss_changed |= BSS_CHANGED_NSS_MESH_TTL;
++	}
+ 	if (_chg_mesh_attr(NL80211_MESHCONF_ELEMENT_TTL, mask))
+ 		conf->element_ttl = nconf->element_ttl;
+ 	if (_chg_mesh_attr(NL80211_MESHCONF_AUTO_OPEN_PLINKS, mask)) {
+@@ -2545,8 +2549,12 @@ static int ieee80211_update_mesh_config(
+ 	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, mask))
+ 		conf->dot11MeshHWMPmaxPREQretries =
+ 			nconf->dot11MeshHWMPmaxPREQretries;
+-	if (_chg_mesh_attr(NL80211_MESHCONF_PATH_REFRESH_TIME, mask))
++	if (_chg_mesh_attr(NL80211_MESHCONF_PATH_REFRESH_TIME, mask)) {
+ 		conf->path_refresh_time = nconf->path_refresh_time;
++		sdata->vif.bss_conf.nss_offld_mpath_refresh_time =
++			nconf->path_refresh_time;
++		nss_changed |= BSS_CHANGED_NSS_MESH_REFRESH_TIME;
++	}
+ 	if (_chg_mesh_attr(NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, mask))
+ 		conf->min_discovery_timeout = nconf->min_discovery_timeout;
+ 	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, mask))
+@@ -2581,8 +2589,12 @@ static int ieee80211_update_mesh_config(
+ 	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_RANN_INTERVAL, mask))
+ 		conf->dot11MeshHWMPRannInterval =
+ 			nconf->dot11MeshHWMPRannInterval;
+-	if (_chg_mesh_attr(NL80211_MESHCONF_FORWARDING, mask))
++	if (_chg_mesh_attr(NL80211_MESHCONF_FORWARDING, mask)) {
+ 		conf->dot11MeshForwarding = nconf->dot11MeshForwarding;
++		sdata->vif.bss_conf.nss_offld_mesh_forward_enabled =
++			nconf->dot11MeshForwarding;
++		nss_changed |= BSS_CHANGED_NSS_MESH_FWD_ENABLED;
++	}
+ 	if (_chg_mesh_attr(NL80211_MESHCONF_RSSI_THRESHOLD, mask)) {
+ 		/* our RSSI threshold implementation is supported only for
+ 		 * devices that report signal in dBm.
+@@ -2624,6 +2636,7 @@ static int ieee80211_update_mesh_config(
+ 		conf->dot11MeshConnectedToAuthServer =
+ 			nconf->dot11MeshConnectedToAuthServer;
+ 	ieee80211_mbss_info_change_notify(sdata, BSS_CHANGED_BEACON);
++	ieee80211_nss_bss_info_change_notify(sdata, nss_changed);
+ 	return 0;
+ }
+ 
+--- a/net/mac80211/debug.h
++++ b/net/mac80211/debug.h
+@@ -67,6 +67,12 @@
+ #define MAC80211_MESH_PS_DEBUG 0
+ #endif
+ 
++#ifdef CPTCFG_MAC80211_MESH_OFFLOAD_DEBUG
++#define MAC80211_MESH_OFFLOAD_DEBUG 1
++#else
++#define MAC80211_MESH_OFFLOAD_DEBUG 0
++#endif
++
+ #ifdef CPTCFG_MAC80211_TDLS_DEBUG
+ #define MAC80211_TDLS_DEBUG 1
+ #else
+@@ -215,6 +221,10 @@ do {									\
+ 	_sdata_dbg(MAC80211_MESH_PS_DEBUG,				\
+ 		   sdata, fmt, ##__VA_ARGS__)
+ 
++#define moffld_dbg(sdata, fmt, ...)					\
++	_sdata_dbg(MAC80211_MESH_OFFLOAD_DEBUG,				\
++		   sdata, fmt, ##__VA_ARGS__)
++
+ #define tdls_dbg(sdata, fmt, ...)					\
+ 	_sdata_dbg(MAC80211_TDLS_DEBUG,					\
+ 		   sdata, fmt, ##__VA_ARGS__)
+--- a/net/mac80211/debugfs.c
++++ b/net/mac80211/debugfs.c
+@@ -497,6 +497,7 @@ static const char *hw_flag_names[] = {
+ 	FLAG(DETECTS_COLOR_COLLISION),
+ 	FLAG(MLO_MCAST_MULTI_LINK_TX),
+ 	FLAG(SUPPORTS_NSS_OFFLOAD),
++	FLAG(SUPPORTS_MESH_NSS_OFFLOAD),
+ #undef FLAG
+ };
+ 
+--- a/net/mac80211/driver-ops.c
++++ b/net/mac80211/driver-ops.c
+@@ -569,3 +569,23 @@ int drv_change_sta_links(struct ieee8021
+ 
+ 	return 0;
+ }
++
++#ifdef CPTCFG_MAC80211_MESH
++void drv_config_mesh_offload_path(struct ieee80211_local *local,
++				  struct ieee80211_sub_if_data *sdata,
++				  enum ieee80211_mesh_path_offld_cmd cmd,
++				  struct ieee80211_mesh_path_offld *path)
++{
++	if (!check_sdata_in_driver(sdata))
++		return;
++
++	if (!ieee80211_hw_check(&local->hw, SUPPORTS_MESH_NSS_OFFLOAD))
++		return;
++
++	if (local->ops->config_mesh_offload_path)
++		local->ops->config_mesh_offload_path(&local->hw,
++						     &sdata->vif, cmd, path);
++
++	/* TODO: trace event */
++}
++#endif
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -1567,4 +1567,10 @@ int drv_change_sta_links(struct ieee8021
+ 			 struct ieee80211_sta *sta,
+ 			 u16 old_links, u16 new_links);
+ 
++#ifdef CPTCFG_MAC80211_MESH
++void drv_config_mesh_offload_path(struct ieee80211_local *local,
++				  struct ieee80211_sub_if_data *sdata,
++				  enum ieee80211_mesh_path_offld_cmd cmd,
++				  struct ieee80211_mesh_path_offld *path);
++#endif /* CPTCFG_MAC80211_MESH */
+ #endif /* __MAC80211_DRIVER_OPS */
+--- a/net/mac80211/mesh.h
++++ b/net/mac80211/mesh.h
+@@ -316,6 +316,10 @@ void mesh_rx_path_sel_frame(struct ieee8
+ 			    struct ieee80211_mgmt *mgmt, size_t len);
+ struct mesh_path *
+ mesh_path_add(struct ieee80211_sub_if_data *sdata, const u8 *dst);
++struct mesh_path *__mesh_path_add(struct ieee80211_sub_if_data *sdata,
++				  const u8 *dst);
++int __mpp_path_add(struct ieee80211_sub_if_data *sdata,
++		   const u8 *dst, const u8 *mpp);
+ 
+ int mesh_path_add_gate(struct mesh_path *mpath);
+ int mesh_path_send_to_gates(struct mesh_path *mpath);
+@@ -357,6 +361,7 @@ void mesh_path_discard_frame(struct ieee
+ void mesh_path_tx_root_frame(struct ieee80211_sub_if_data *sdata);
+ 
+ bool mesh_action_is_path_sel(struct ieee80211_mgmt *mgmt);
++void mesh_nss_offld_path_update(struct mesh_path *mpath, bool is_mpath, u8 *old_next_hop_addr);
+ struct ieee80211_mesh_fast_tx *
+ mesh_fast_tx_get(struct ieee80211_sub_if_data *sdata,
+ 		 struct ieee80211_mesh_fast_tx_key *key);
+--- a/net/mac80211/mesh_hwmp.c
++++ b/net/mac80211/mesh_hwmp.c
+@@ -365,6 +365,13 @@ u32 airtime_link_metric_get(struct ieee8
+ 	return (u32)result;
+ }
+ 
++static inline struct sta_info *
++next_hop_deref_protected(struct mesh_path *mpath)
++{
++	return rcu_dereference_protected(mpath->next_hop,
++					 lockdep_is_held(&mpath->state_lock));
++}
++
+ /**
+  * hwmp_route_info_get - Update routing info to originator and transmitter
+  *
+@@ -388,9 +395,10 @@ static u32 hwmp_route_info_get(struct ie
+ {
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct mesh_path *mpath;
+-	struct sta_info *sta;
++	struct sta_info *sta, *next_hop;
+ 	bool fresh_info;
+ 	const u8 *orig_addr, *ta;
++	u8 old_next_hop_addr[ETH_ALEN] = {0};
+ 	u32 orig_sn, orig_metric;
+ 	unsigned long orig_lifetime, exp_time;
+ 	u32 last_hop_metric, new_metric;
+@@ -492,7 +500,10 @@ static u32 hwmp_route_info_get(struct ie
+ 		}
+ 
+ 		if (fresh_info) {
+-			if (rcu_access_pointer(mpath->next_hop) != sta) {
++			next_hop = rcu_dereference(mpath->next_hop);
++			if (next_hop)
++				ether_addr_copy(old_next_hop_addr, next_hop->sta.addr);
++			if (next_hop != sta) {
+ 				mpath->path_change_count++;
+ 				flush_mpath = true;
+ 			}
+@@ -514,6 +525,8 @@ static u32 hwmp_route_info_get(struct ie
+ 			/* draft says preq_id should be saved to, but there does
+ 			 * not seem to be any use for it, skipping by now
+ 			 */
++
++			mesh_nss_offld_path_update(mpath, true, old_next_hop_addr);
+ 		} else
+ 			spin_unlock_bh(&mpath->state_lock);
+ 	}
+@@ -544,7 +557,14 @@ static u32 hwmp_route_info_get(struct ie
+ 		}
+ 
+ 		if (fresh_info) {
+-			if (rcu_access_pointer(mpath->next_hop) != sta) {
++			/* Reset the old_next_hop_addr since this may have filled
++			 * if orig_addr and ta are different
++			 */
++			memset(old_next_hop_addr, 0, ETH_ALEN);
++			next_hop = rcu_dereference(mpath->next_hop);
++			if (next_hop)
++				ether_addr_copy(old_next_hop_addr, next_hop->sta.addr);
++			if (next_hop != sta) {
+ 				mpath->path_change_count++;
+ 				flush_mpath = true;
+ 			}
+@@ -561,6 +581,8 @@ static u32 hwmp_route_info_get(struct ie
+ 			/* init it at a low value - 0 start is tricky */
+ 			ewma_mesh_fail_avg_add(&sta->mesh->fail_avg, 1);
+ 			mesh_path_tx_pending(mpath);
++
++			mesh_nss_offld_path_update(mpath, true, old_next_hop_addr);
+ 		} else
+ 			spin_unlock_bh(&mpath->state_lock);
+ 	}
+@@ -697,15 +719,6 @@ static void hwmp_preq_frame_process(stru
+ 	}
+ }
+ 
+-
+-static inline struct sta_info *
+-next_hop_deref_protected(struct mesh_path *mpath)
+-{
+-	return rcu_dereference_protected(mpath->next_hop,
+-					 lockdep_is_held(&mpath->state_lock));
+-}
+-
+-
+ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
+ 				    struct ieee80211_mgmt *mgmt,
+ 				    const u8 *prep_elem, u32 metric)
+@@ -1349,3 +1362,274 @@ void mesh_path_tx_root_frame(struct ieee
+ 		return;
+ 	}
+ }
++
++static int mesh_path_offld_mpath_refresh(struct ieee80211_sub_if_data *sdata,
++					 u8 *mda)
++{
++	struct mesh_path *mpath;
++
++	rcu_read_lock();
++
++	mpath = mesh_path_lookup(sdata, mda);
++	if (!mpath || !(mpath->flags & MESH_PATH_ACTIVE)) {
++		moffld_dbg(sdata,
++			   "mpath lookup failed during path refresh for %pM, is_mpath %d\n",
++			   mda, mpath != NULL);
++		rcu_read_unlock();
++		return -ENOENT;
++	}
++
++	if (!(mpath->flags & MESH_PATH_RESOLVING) && !(mpath->flags & MESH_PATH_FIXED))
++		mesh_queue_preq(mpath, PREQ_Q_F_START | PREQ_Q_F_REFRESH);
++
++	rcu_read_unlock();
++
++	return 0;
++}
++
++static int mesh_path_offld_mpath_del(struct ieee80211_sub_if_data *sdata, u8 *da)
++{
++	struct mesh_path *mpath, *mppath;
++
++	rcu_read_lock();
++
++	mpath = mesh_path_lookup(sdata, da);
++	if (!mpath) {
++		moffld_dbg(sdata, "mpath lookup failed for %pM during duplicate mpath removal\n",
++			   da);
++		rcu_read_unlock();
++		return -ENOENT;
++	}
++
++	mppath = mpp_path_lookup(sdata, da);
++	if (!mppath) {
++		moffld_dbg(sdata, "proxy path lookup failed for %pM during duplicate mpath removal\n",
++			   da);
++		rcu_read_unlock();
++		return -EINVAL;
++	}
++
++	mesh_path_del(sdata, mpath->dst);
++
++	rcu_read_unlock();
++
++	return 0;
++}
++
++static int mesh_path_offld_mpath_exp(struct ieee80211_sub_if_data *sdata, u8 *mda)
++{
++	struct mesh_path *mpath;
++
++	rcu_read_lock();
++
++	mpath = mesh_path_lookup(sdata, mda);
++	if (!mpath) {
++		mpath = mesh_path_add(sdata, mda);
++		if (IS_ERR(mpath)) {
++			rcu_read_unlock();
++			moffld_dbg(sdata,
++				   "failed to add mpath for %pM during mpath exp\n", mda);
++			return PTR_ERR(mpath);
++		}
++	}
++
++	spin_lock_bh(&mpath->state_lock);
++	mpath->flags &= ~MESH_PATH_ACTIVE;
++	spin_unlock_bh(&mpath->state_lock);
++
++	if (!(mpath->flags & MESH_PATH_RESOLVING) &&
++	    mesh_path_sel_is_hwmp(sdata))
++		mesh_queue_preq(mpath, PREQ_Q_F_START);
++
++	rcu_read_unlock();
++
++	return 0;
++}
++
++static int mesh_path_offld_mpp_learn(struct ieee80211_sub_if_data *sdata,
++				     u8 *da, u8 *mda)
++{
++	struct mesh_path *mppath;
++	int ret;
++
++	rcu_read_lock();
++	mppath = mpp_path_lookup(sdata, da);
++	if (mppath) {
++		moffld_dbg(sdata, "proxy path for da %pM mesh_da %pM already exists\n",
++			   da, mda);
++		rcu_read_unlock();
++		return -EEXIST;
++	}
++
++	ret = mpp_path_add(sdata, da, mda);
++	if (ret)
++		moffld_dbg(sdata, "failed to add proxy path entry (%d): da %pM mesh_da %pM\n",
++			   ret, da, mda);
++
++	rcu_read_unlock();
++
++	return ret;
++}
++
++static int mesh_path_offld_mpp_add(struct ieee80211_sub_if_data *sdata,
++				     u8 *da, u8 *mda)
++{
++	struct mesh_path *mppath;
++	int ret;
++
++	rcu_read_lock();
++	mppath = mpp_path_lookup(sdata, da);
++	if (mppath) {
++		moffld_dbg(sdata, "proxy path for da %pM mesh_da %pM already exists\n",
++			   da, mda);
++		rcu_read_unlock();
++		return -EEXIST;
++	}
++
++	ret = __mpp_path_add(sdata, da, mda);
++	if (ret)
++		moffld_dbg(sdata, "failed to add proxy path entry (%d): da %pM mesh_da %pM\n",
++			   ret, da, mda);
++
++	rcu_read_unlock();
++
++	return ret;
++}
++
++static int mesh_path_offld_mpp_update(struct ieee80211_sub_if_data *sdata,
++				      u8 *da, u8 *mda)
++{
++	struct mesh_path *mppath;
++
++	rcu_read_lock();
++	mppath = mpp_path_lookup(sdata, da);
++	if (!mppath) {
++		moffld_dbg(sdata,
++			   "proxy path lookup for da %pM failed during MPP update with mesh_da %pM\n",
++			   da, mda);
++		rcu_read_unlock();
++		return -ENOENT;
++	} else {
++		spin_lock_bh(&mppath->state_lock);
++		if (!ether_addr_equal(mppath->mpp, mda))
++			memcpy(mppath->mpp, mda, ETH_ALEN);
++		mppath->exp_time = jiffies;
++		spin_unlock_bh(&mppath->state_lock);
++	}
++	rcu_read_unlock();
++
++	return 0;
++}
++
++static int mesh_path_offld_mpath_not_found(struct ieee80211_sub_if_data *sdata,
++					   u8 *mda, u8 *ta)
++{
++	struct mesh_path *mpath;
++	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
++
++	rcu_read_lock();
++
++	mpath = mesh_path_lookup(sdata, mda);
++	if (!mpath) {
++		mpath = mesh_path_add(sdata, mda);
++		if (IS_ERR(mpath)) {
++			moffld_dbg(sdata, "mpath add failed for mesh_da %pM (%lu)\n",
++				   mda, PTR_ERR(mpath));
++			rcu_read_unlock();
++			return PTR_ERR(mpath);
++		}
++	}
++
++	if (!(mpath->flags & MESH_PATH_RESOLVING) &&
++	    mesh_path_sel_is_hwmp(sdata))
++		mesh_queue_preq(mpath, PREQ_Q_F_START);
++
++	rcu_read_unlock();
++
++	if (!is_zero_ether_addr(ta))
++		mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,
++				   mda, 0, WLAN_REASON_MESH_PATH_NOFORWARD, ta);
++
++	return 0;
++}
++
++void ieee80211s_update_metric_ppdu(struct ieee80211_hw *hw,
++				   struct ieee80211_tx_status *st)
++{
++	struct sta_info *sta;
++	int i, num_mpdu;
++	bool failed;
++	struct rate_info rinfo;
++
++	if (!st->sta)
++		return;
++
++	if (st->mpdu_succ) {
++		num_mpdu = st->mpdu_succ;
++		failed = false;
++	} else if (st->mpdu_fail) {
++		num_mpdu = st->mpdu_fail;
++		failed = true;
++	} else
++		return;
++
++	sta = container_of(st->sta, struct sta_info, sta);
++	if (!ieee80211_vif_is_mesh(&sta->sdata->vif))
++		return;
++
++	for (i = 0; i < num_mpdu; i++) {
++		ewma_mesh_fail_avg_add(&sta->mesh->fail_avg, failed * 100);
++		if (ewma_mesh_fail_avg_read(&sta->mesh->fail_avg) >
++					    LINK_FAIL_THRESH)
++			mesh_plink_broken(sta);
++
++		if (!st->rates)
++			continue;
++
++		rinfo = st->rates->rate_idx;
++		ewma_mesh_tx_rate_avg_add(&sta->mesh->tx_rate_avg,
++					  cfg80211_calculate_bitrate(&rinfo));
++	}
++}
++EXPORT_SYMBOL(ieee80211s_update_metric_ppdu);
++
++int ieee80211_mesh_path_offld_change_notify(struct ieee80211_vif *vif,
++				struct ieee80211_mesh_path_offld *path,
++				enum ieee80211_mesh_path_offld_action action)
++{
++	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
++	int ret = -ENOTSUPP;
++
++	moffld_dbg(sdata, "received mesh offload event %d\n", action);
++
++	switch (action) {
++	case IEEE80211_MESH_PATH_OFFLD_ACTION_MPATH_REFRESH:
++		ret = mesh_path_offld_mpath_refresh(sdata, path->mesh_da);
++		break;
++	case IEEE80211_MESH_PATH_OFFLD_ACTION_MPATH_DEL:
++		ret = mesh_path_offld_mpath_del(sdata, path->mesh_da);
++		break;
++	case IEEE80211_MESH_PATH_OFFLD_ACTION_MPATH_EXP:
++		ret = mesh_path_offld_mpath_exp(sdata, path->mesh_da);
++		break;
++	case IEEE80211_MESH_PATH_OFFLD_ACTION_MPP_LEARN:
++		ret = mesh_path_offld_mpp_learn(sdata, path->da, path->mesh_da);
++		break;
++	case IEEE80211_MESH_PATH_OFFLD_ACTION_MPP_ADD:
++		ret = mesh_path_offld_mpp_add(sdata, path->da, path->mesh_da);
++		break;
++	case IEEE80211_MESH_PATH_OFFLD_ACTION_MPP_UPDATE:
++		ret = mesh_path_offld_mpp_update(sdata, path->da,
++						 path->mesh_da);
++		break;
++	case IEEE80211_MESH_PATH_OFFLD_ACTION_PATH_NOT_FOUND:
++		ret = mesh_path_offld_mpath_not_found(sdata, path->da,
++						      path->ta);
++		break;
++	default:
++		break;
++	}
++
++	return ret;
++}
++EXPORT_SYMBOL(ieee80211_mesh_path_offld_change_notify);
+--- a/net/mac80211/mesh_pathtbl.c
++++ b/net/mac80211/mesh_pathtbl.c
+@@ -15,6 +15,7 @@
+ #include "ieee80211_i.h"
+ #include "mesh.h"
+ #include <linux/rhashtable.h>
++#include "driver-ops.h"
+ 
+ static void mesh_path_free_rcu(struct mesh_table *tbl, struct mesh_path *mpath);
+ 
+@@ -103,6 +104,63 @@ static void mesh_table_free(struct mesh_
+ 				    mesh_path_rht_free, tbl);
+ }
+ 
++void mesh_nss_offld_proxy_path_exp_update(struct ieee80211_vif *vif, u8* da, u8* mesh_da, u32 inactive_time)
++{
++	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
++	struct mesh_table *tbl = &sdata->u.mesh.mpp_paths;
++	struct mesh_path *mppath;
++	struct hlist_node *n;
++	unsigned long expiry;
++
++	spin_lock_bh(&tbl->walk_lock);
++	hlist_for_each_entry_safe(mppath, n, &tbl->walk_head, walk_list) {
++		if(!ether_addr_equal(da, mppath->dst) || !ether_addr_equal(mesh_da, mppath->mpp))
++			continue;
++		if ((!(mppath->flags & MESH_PATH_RESOLVING)) &&
++		    (!(mppath->flags & MESH_PATH_FIXED))) {
++			expiry = jiffies - msecs_to_jiffies(inactive_time);
++			mppath->exp_time = time_after(mppath->exp_time, expiry) ?
++								mppath->exp_time : expiry;
++		}
++	}
++	spin_unlock_bh(&tbl->walk_lock);
++}
++EXPORT_SYMBOL(mesh_nss_offld_proxy_path_exp_update);
++
++void mesh_nss_offld_path_update(struct mesh_path *mpath, bool is_mpath, u8 *old_next_hop_addr)
++{
++	struct ieee80211_mesh_path_offld path = {0};
++	struct sta_info *next_hop;
++	struct ieee80211_sub_if_data *sdata = mpath->sdata;
++
++
++	path.metric = mpath->metric;
++	if (time_before(jiffies, mpath->exp_time))
++		path.exp_time = jiffies_to_msecs(mpath->exp_time - jiffies);
++
++	path.hop_count = mpath->hop_count;
++	path.flags = mpath->flags;
++	path.mesh_gate = mpath->is_gate;
++	if (is_mpath) {
++		ether_addr_copy(path.mesh_da, mpath->dst);
++	} else {
++		ether_addr_copy(path.mesh_da, mpath->mpp);
++		ether_addr_copy(path.da, mpath->dst);
++	}
++
++	next_hop = rcu_dereference(mpath->next_hop);
++	if (next_hop)
++		ether_addr_copy(path.next_hop, next_hop->addr);
++
++	if (old_next_hop_addr)
++		ether_addr_copy(path.old_next_hop, old_next_hop_addr);
++
++	drv_config_mesh_offload_path(sdata->local, sdata,
++				     is_mpath ? IEEE80211_MESH_PATH_OFFLD_CMD_UPDATE_MPATH :
++						IEEE80211_MESH_PATH_OFFLD_CMD_UPDATE_MPP,
++				     &path);
++}
++
+ /**
+  * mesh_path_assign_nexthop - update mesh path next hop
+  *
+@@ -240,16 +298,23 @@ static void mesh_path_move_to_queue(stru
+ 
+ 
+ static struct mesh_path *mpath_lookup(struct mesh_table *tbl, const u8 *dst,
+-				      struct ieee80211_sub_if_data *sdata)
++				      struct ieee80211_sub_if_data *sdata,
++				      bool is_mpath)
+ {
+ 	struct mesh_path *mpath;
++	bool update;
++	struct sta_info *next_hop;
+ 
+ 	mpath = rhashtable_lookup(&tbl->rhead, dst, mesh_rht_params);
+ 
+ 	if (mpath && mpath_expired(mpath)) {
+ 		spin_lock_bh(&mpath->state_lock);
++		next_hop = rcu_dereference(mpath->next_hop);
++		update = !!(mpath->flags & MESH_PATH_ACTIVE);
+ 		mpath->flags &= ~MESH_PATH_ACTIVE;
+ 		spin_unlock_bh(&mpath->state_lock);
++		if (update && is_mpath)
++			mesh_nss_offld_path_update(mpath, true, next_hop ? next_hop->addr : NULL);
+ 	}
+ 	return mpath;
+ }
+@@ -266,13 +331,13 @@ static struct mesh_path *mpath_lookup(st
+ struct mesh_path *
+ mesh_path_lookup(struct ieee80211_sub_if_data *sdata, const u8 *dst)
+ {
+-	return mpath_lookup(&sdata->u.mesh.mesh_paths, dst, sdata);
++	return mpath_lookup(&sdata->u.mesh.mesh_paths, dst, sdata, true);
+ }
+ 
+ struct mesh_path *
+ mpp_path_lookup(struct ieee80211_sub_if_data *sdata, const u8 *dst)
+ {
+-	return mpath_lookup(&sdata->u.mesh.mpp_paths, dst, sdata);
++	return mpath_lookup(&sdata->u.mesh.mpp_paths, dst, sdata, false);
+ }
+ 
+ static struct mesh_path *
+@@ -334,6 +399,7 @@ mpp_path_lookup_by_idx(struct ieee80211_
+ int mesh_path_add_gate(struct mesh_path *mpath)
+ {
+ 	struct mesh_table *tbl;
++	struct sta_info *next_hop;
+ 	int err;
+ 
+ 	rcu_read_lock();
+@@ -346,6 +412,7 @@ int mesh_path_add_gate(struct mesh_path
+ 		goto err_rcu;
+ 	}
+ 	mpath->is_gate = true;
++	next_hop = rcu_dereference(mpath->next_hop);
+ 	mpath->sdata->u.mesh.num_gates++;
+ 
+ 	spin_lock(&tbl->gates_lock);
+@@ -354,6 +421,8 @@ int mesh_path_add_gate(struct mesh_path
+ 
+ 	spin_unlock_bh(&mpath->state_lock);
+ 
++	mesh_nss_offld_path_update(mpath, true, next_hop ? next_hop->addr : NULL);
++
+ 	mpath_dbg(mpath->sdata,
+ 		  "Mesh path: Recorded new gate: %pM. %d known gates\n",
+ 		  mpath->dst, mpath->sdata->u.mesh.num_gates);
+@@ -370,16 +439,21 @@ err_rcu:
+  */
+ static void mesh_gate_del(struct mesh_table *tbl, struct mesh_path *mpath)
+ {
++	struct sta_info *next_hop;
++
+ 	lockdep_assert_held(&mpath->state_lock);
+ 	if (!mpath->is_gate)
+ 		return;
+ 
++	next_hop = rcu_dereference(mpath->next_hop);
+ 	mpath->is_gate = false;
+ 	spin_lock_bh(&tbl->gates_lock);
+ 	hlist_del_rcu(&mpath->gate_list);
+ 	mpath->sdata->u.mesh.num_gates--;
+ 	spin_unlock_bh(&tbl->gates_lock);
+ 
++	mesh_nss_offld_path_update(mpath, true, next_hop ? next_hop->addr : NULL);
++
+ 	mpath_dbg(mpath->sdata,
+ 		  "Mesh path: Deleted gate: %pM. %d known gates\n",
+ 		  mpath->dst, mpath->sdata->u.mesh.num_gates);
+@@ -667,17 +741,8 @@ void mesh_fast_tx_flush_addr(struct ieee
+ 	spin_unlock_bh(&cache->walk_lock);
+ }
+ 
+-/**
+- * mesh_path_add - allocate and add a new path to the mesh path table
+- * @dst: destination address of the path (ETH_ALEN length)
+- * @sdata: local subif
+- *
+- * Returns: 0 on success
+- *
+- * State: the initial state of the new path is set to 0
+- */
+-struct mesh_path *mesh_path_add(struct ieee80211_sub_if_data *sdata,
+-				const u8 *dst)
++struct mesh_path *__mesh_path_add(struct ieee80211_sub_if_data *sdata,
++				  const u8 *dst)
+ {
+ 	struct mesh_table *tbl;
+ 	struct mesh_path *mpath, *new_mpath;
+@@ -718,8 +783,36 @@ struct mesh_path *mesh_path_add(struct i
+ 	return new_mpath;
+ }
+ 
+-int mpp_path_add(struct ieee80211_sub_if_data *sdata,
+-		 const u8 *dst, const u8 *mpp)
++/**
++ * mesh_path_add - allocate and add a new path to the mesh path table
++ * @dst: destination address of the path (ETH_ALEN length)
++ * @sdata: local subif
++ *
++ * Returns: 0 on success
++ *
++ * State: the initial state of the new path is set to 0
++ */
++struct mesh_path *mesh_path_add(struct ieee80211_sub_if_data *sdata,
++				const u8 *dst)
++{
++	struct mesh_path *new_path;
++	struct ieee80211_mesh_path_offld path = {0};
++
++	new_path = __mesh_path_add(sdata, dst);
++	if (IS_ERR(new_path))
++		return new_path;
++
++	ether_addr_copy(path.mesh_da, dst);
++
++	drv_config_mesh_offload_path(sdata->local, sdata,
++				     IEEE80211_MESH_PATH_OFFLD_CMD_ADD_MPATH,
++				     &path);
++
++	return new_path;
++}
++
++int __mpp_path_add(struct ieee80211_sub_if_data *sdata,
++		   const u8 *dst, const u8 *mpp)
+ {
+ 	struct mesh_table *tbl;
+ 	struct mesh_path *new_mpath;
+@@ -757,6 +850,25 @@ int mpp_path_add(struct ieee80211_sub_if
+ 	return ret;
+ }
+ 
++int mpp_path_add(struct ieee80211_sub_if_data *sdata,
++		 const u8 *dst, const u8 *mpp)
++{
++	struct ieee80211_mesh_path_offld path = {0};
++	int ret;
++
++	ret = __mpp_path_add(sdata, dst, mpp);
++	if (ret)
++		return ret;
++
++	ether_addr_copy(path.mesh_da, mpp);
++	ether_addr_copy(path.da, dst);
++
++	drv_config_mesh_offload_path(sdata->local, sdata,
++				     IEEE80211_MESH_PATH_OFFLD_CMD_ADD_MPP,
++				     &path);
++
++	return 0;
++}
+ 
+ /**
+  * mesh_plink_broken - deactivates paths and sends perr when a link breaks
+@@ -807,8 +919,29 @@ static void mesh_path_free_rcu(struct me
+ 	kfree_rcu(mpath, rcu);
+ }
+ 
+-static void __mesh_path_del(struct mesh_table *tbl, struct mesh_path *mpath)
++static void __mesh_path_del(struct mesh_table *tbl, struct mesh_path *mpath,
++			   bool is_mpath_tbl)
+ {
++	struct ieee80211_mesh_path_offld path = {0};
++	struct sta_info *next_hop;
++	struct ieee80211_sub_if_data *sdata = mpath->sdata;
++
++
++	path.metric = mpath->metric;
++	path.exp_time = mpath->exp_time;
++	path.hop_count = mpath->hop_count;
++	path.flags = mpath->flags;
++	if (is_mpath_tbl) {
++		ether_addr_copy(path.mesh_da, mpath->dst);
++	} else {
++		ether_addr_copy(path.mesh_da, mpath->mpp);
++		ether_addr_copy(path.da, mpath->dst);
++	}
++
++	next_hop = rcu_dereference(mpath->next_hop);
++	if (next_hop)
++		ether_addr_copy(path.next_hop, next_hop->addr);
++
+ 	hlist_del_rcu(&mpath->walk_list);
+ 	rhashtable_remove_fast(&tbl->rhead, &mpath->rhash, mesh_rht_params);
+ 	if (tbl == &mpath->sdata->u.mesh.mpp_paths)
+@@ -816,6 +949,11 @@ static void __mesh_path_del(struct mesh_
+ 	else
+ 		mesh_fast_tx_flush_mpath(mpath);
+ 	mesh_path_free_rcu(tbl, mpath);
++
++	drv_config_mesh_offload_path(sdata->local, sdata,
++				     is_mpath_tbl ? IEEE80211_MESH_PATH_OFFLD_CMD_DELETE_MPATH :
++						    IEEE80211_MESH_PATH_OFFLD_CMD_DELETE_MPP,
++				     &path);
+ }
+ 
+ /**
+@@ -839,7 +977,7 @@ void mesh_path_flush_by_nexthop(struct s
+ 	spin_lock_bh(&tbl->walk_lock);
+ 	hlist_for_each_entry_safe(mpath, n, &tbl->walk_head, walk_list) {
+ 		if (rcu_access_pointer(mpath->next_hop) == sta)
+-			__mesh_path_del(tbl, mpath);
++			__mesh_path_del(tbl, mpath, true);
+ 	}
+ 	spin_unlock_bh(&tbl->walk_lock);
+ }
+@@ -854,19 +992,19 @@ static void mpp_flush_by_proxy(struct ie
+ 	spin_lock_bh(&tbl->walk_lock);
+ 	hlist_for_each_entry_safe(mpath, n, &tbl->walk_head, walk_list) {
+ 		if (ether_addr_equal(mpath->mpp, proxy))
+-			__mesh_path_del(tbl, mpath);
++			__mesh_path_del(tbl, mpath, false);
+ 	}
+ 	spin_unlock_bh(&tbl->walk_lock);
+ }
+ 
+-static void table_flush_by_iface(struct mesh_table *tbl)
++static void table_flush_by_iface(struct mesh_table *tbl, bool is_mpath_tbl)
+ {
+ 	struct mesh_path *mpath;
+ 	struct hlist_node *n;
+ 
+ 	spin_lock_bh(&tbl->walk_lock);
+ 	hlist_for_each_entry_safe(mpath, n, &tbl->walk_head, walk_list) {
+-		__mesh_path_del(tbl, mpath);
++		__mesh_path_del(tbl, mpath, is_mpath_tbl);
+ 	}
+ 	spin_unlock_bh(&tbl->walk_lock);
+ }
+@@ -881,8 +1019,8 @@ static void table_flush_by_iface(struct
+  */
+ void mesh_path_flush_by_iface(struct ieee80211_sub_if_data *sdata)
+ {
+-	table_flush_by_iface(&sdata->u.mesh.mesh_paths);
+-	table_flush_by_iface(&sdata->u.mesh.mpp_paths);
++	table_flush_by_iface(&sdata->u.mesh.mesh_paths, true);
++	table_flush_by_iface(&sdata->u.mesh.mpp_paths, false);
+ }
+ 
+ /**
+@@ -896,7 +1034,7 @@ void mesh_path_flush_by_iface(struct iee
+  */
+ static int table_path_del(struct mesh_table *tbl,
+ 			  struct ieee80211_sub_if_data *sdata,
+-			  const u8 *addr)
++			  const u8 *addr, bool is_mpath_tbl)
+ {
+ 	struct mesh_path *mpath;
+ 
+@@ -907,7 +1045,7 @@ static int table_path_del(struct mesh_ta
+ 		return -ENXIO;
+ 	}
+ 
+-	__mesh_path_del(tbl, mpath);
++	__mesh_path_del(tbl, mpath, is_mpath_tbl);
+ 	spin_unlock_bh(&tbl->walk_lock);
+ 	return 0;
+ }
+@@ -928,7 +1066,7 @@ int mesh_path_del(struct ieee80211_sub_i
+ 	/* flush relevant mpp entries first */
+ 	mpp_flush_by_proxy(sdata, addr);
+ 
+-	err = table_path_del(&sdata->u.mesh.mesh_paths, sdata, addr);
++	err = table_path_del(&sdata->u.mesh.mesh_paths, sdata, addr, true);
+ 	sdata->u.mesh.mesh_paths_generation++;
+ 	return err;
+ }
+@@ -1031,7 +1169,10 @@ void mesh_path_flush_pending(struct mesh
+  */
+ void mesh_path_fix_nexthop(struct mesh_path *mpath, struct sta_info *next_hop)
+ {
++	struct sta_info *old_next_hop;
++
+ 	spin_lock_bh(&mpath->state_lock);
++	old_next_hop = rcu_dereference(mpath->next_hop);
+ 	mesh_path_assign_nexthop(mpath, next_hop);
+ 	mpath->sn = 0xffff;
+ 	mpath->metric = 0;
+@@ -1045,6 +1186,8 @@ void mesh_path_fix_nexthop(struct mesh_p
+ 	/* init it at a low value - 0 start is tricky */
+ 	ewma_mesh_fail_avg_add(&next_hop->mesh->fail_avg, 1);
+ 	mesh_path_tx_pending(mpath);
++
++	mesh_nss_offld_path_update(mpath, true, old_next_hop ? old_next_hop->addr : NULL);
+ }
+ 
+ void mesh_pathtbl_init(struct ieee80211_sub_if_data *sdata)
+@@ -1056,7 +1199,7 @@ void mesh_pathtbl_init(struct ieee80211_
+ 
+ static
+ void mesh_path_tbl_expire(struct ieee80211_sub_if_data *sdata,
+-			  struct mesh_table *tbl)
++			  struct mesh_table *tbl, bool is_mpath_tbl)
+ {
+ 	struct mesh_path *mpath;
+ 	struct hlist_node *n;
+@@ -1066,15 +1209,15 @@ void mesh_path_tbl_expire(struct ieee802
+ 		if ((!(mpath->flags & MESH_PATH_RESOLVING)) &&
+ 		    (!(mpath->flags & MESH_PATH_FIXED)) &&
+ 		     time_after(jiffies, mpath->exp_time + MESH_PATH_EXPIRE))
+-			__mesh_path_del(tbl, mpath);
++			__mesh_path_del(tbl, mpath, is_mpath_tbl);
+ 	}
+ 	spin_unlock_bh(&tbl->walk_lock);
+ }
+ 
+ void mesh_path_expire(struct ieee80211_sub_if_data *sdata)
+ {
+-	mesh_path_tbl_expire(sdata, &sdata->u.mesh.mesh_paths);
+-	mesh_path_tbl_expire(sdata, &sdata->u.mesh.mpp_paths);
++	mesh_path_tbl_expire(sdata, &sdata->u.mesh.mesh_paths, true);
++	mesh_path_tbl_expire(sdata, &sdata->u.mesh.mpp_paths, false);
+ }
+ 
+ void mesh_pathtbl_unregister(struct ieee80211_sub_if_data *sdata)
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -2633,6 +2633,9 @@ static struct sk_buff *ieee80211_build_h
+ 		info_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
+ #endif
+ 
++	info = IEEE80211_SKB_CB(skb);
++	memset(info, 0, sizeof(*info));
++
+ 	/* convert Ethernet header to proper 802.11 header (based on
+ 	 * operation mode) */
+ 	ethertype = (skb->data[12] << 8) | skb->data[13];
+@@ -2703,6 +2706,13 @@ static struct sk_buff *ieee80211_build_h
+ 		break;
+ #ifdef CPTCFG_MAC80211_MESH
+ 	case NL80211_IFTYPE_MESH_POINT:
++		if (ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD) &&
++		    (sdata->vif.driver_flags & IEEE80211_VIF_NSS_OFFLOAD_DEBUG_MODE) &&
++		    !(is_multicast_ether_addr(skb->data))) {
++			info->flags = IEEE80211_TX_CTL_HW_80211_ENCAP;
++			goto nss_mesh;
++		}
++
+ 		if (!is_multicast_ether_addr(skb->data)) {
+ 			struct sta_info *next_hop;
+ 			bool mpp_lookup = true;
+@@ -2966,10 +2976,10 @@ static struct sk_buff *ieee80211_build_h
+ 
+ 	skb_reset_mac_header(skb);
+ 
+-	info = IEEE80211_SKB_CB(skb);
+-	memset(info, 0, sizeof(*info));
+-
+-	info->flags = info_flags;
++#ifdef CPTCFG_MAC80211_MESH
++nss_mesh:
++#endif
++	info->flags |= info_flags;
+ 	info->ack_frame_id = info_id;
+ 	info->band = band;
+ 
+@@ -4284,6 +4294,7 @@ void __ieee80211_subif_start_xmit(struct
+ 	struct sk_buff *next;
+ 	int len = skb->len;
+ 	struct ieee80211_key *key = NULL;
++	struct ieee80211_tx_info *info;
+ 	struct ieee80211_sub_if_data *ap_sdata;
+ 
+ 	if (unlikely(!ieee80211_sdata_running(sdata) || skb->len < ETH_HLEN)) {
+@@ -4359,9 +4370,15 @@ void __ieee80211_subif_start_xmit(struct
+ 			goto out;
+ 		}
+ 
+-		ieee80211_tx_stats(dev, skb->len);
+-
+-		ieee80211_xmit(sdata, sta, skb);
++		info = IEEE80211_SKB_CB(skb);
++		if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) {
++		    	if (sta)
++				key = rcu_dereference(sta->ptk[sta->ptk_idx]);
++			ieee80211_8023_xmit(sdata, dev, sta, key, skb);
++		} else {
++			ieee80211_tx_stats(dev, skb->len);
++			ieee80211_xmit(sdata, sta, skb);
++		}
+ 	}
+ 	goto out;
+  out_free:
diff --git a/package/kernel/mac80211/patches/ath11k_nss/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch b/package/kernel/mac80211/patches/ath11k_nss/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
new file mode 100644
index 00000000000000..1bfbd0ebdbb27e
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
@@ -0,0 +1,80 @@
+From 6a9662d48c4f277380283050370ab3f1f940b6a6 Mon Sep 17 00:00:00 2001
+From: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
+Date: Mon, 4 Sep 2023 13:44:47 +0530
+Subject: [PATCH] ath11k: skip HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE config
+
+Don't set HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE flag to TCL,
+HW only take care of tid classification if this flag is not set.
+
+Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/dp_tx.c  | 19 +------------------
+ drivers/net/wireless/ath/ath11k/hal_tx.c |  1 -
+ drivers/net/wireless/ath/ath11k/mac.c    |  2 ++
+ 3 files changed, 3 insertions(+), 19 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -44,19 +44,6 @@ static void ath11k_dp_tx_encap_nwifi(str
+ 	hdr->frame_control &= ~__cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
+ }
+ 
+-static u8 ath11k_dp_tx_get_tid(struct sk_buff *skb)
+-{
+-	struct ieee80211_hdr *hdr = (void *)skb->data;
+-	struct ath11k_skb_cb *cb = ATH11K_SKB_CB(skb);
+-
+-	if (cb->flags & ATH11K_SKB_HW_80211_ENCAP)
+-		return skb->priority & IEEE80211_QOS_CTL_TID_MASK;
+-	else if (!ieee80211_is_data_qos(hdr->frame_control))
+-		return HAL_DESC_REO_NON_QOS_TID;
+-	else
+-		return skb->priority & IEEE80211_QOS_CTL_TID_MASK;
+-}
+-
+ enum hal_encrypt_type ath11k_dp_tx_get_encrypt_type(u32 cipher)
+ {
+ 	switch (cipher) {
+@@ -143,9 +130,8 @@ int ath11k_dp_tx(struct ath11k *ar, stru
+ 		     !ieee80211_is_data(hdr->frame_control)))
+ 		return -ENOTSUPP;
+ 
+-	pool_id = skb_get_queue_mapping(skb) & (ATH11K_HW_MAX_QUEUES - 1);
+-
+ 	ring_selector = ab->hw_params.hw_ops->get_ring_selector(skb);
++	pool_id = ring_selector;
+ 
+ tcl_ring_sel:
+ 	tcl_ring_retry = false;
+@@ -221,10 +207,6 @@ tcl_ring_sel:
+ 	if (ieee80211_vif_is_mesh(arvif->vif))
+ 		ti.enable_mesh = true;
+ 
+-	ti.flags1 |= FIELD_PREP(HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE, 1);
+-
+-	ti.tid = ath11k_dp_tx_get_tid(skb);
+-
+ 	switch (ti.encap_type) {
+ 	case HAL_TCL_ENCAP_TYPE_NATIVE_WIFI:
+ 		if (arvif->vif->offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED)
+--- a/drivers/net/wireless/ath/ath11k/hal_tx.c
++++ b/drivers/net/wireless/ath/ath11k/hal_tx.c
+@@ -65,7 +65,6 @@ void ath11k_hal_tx_cmd_desc_setup(struct
+ 		FIELD_PREP(HAL_TCL_DATA_CMD_INFO1_PKT_OFFSET, ti->pkt_offset);
+ 
+ 	tcl_cmd->info2 = ti->flags1 |
+-		FIELD_PREP(HAL_TCL_DATA_CMD_INFO2_TID, ti->tid) |
+ 		FIELD_PREP(HAL_TCL_DATA_CMD_INFO2_LMAC_ID, ti->lmac_id);
+ 
+ 	tcl_cmd->info3 = FIELD_PREP(HAL_TCL_DATA_CMD_INFO3_DSCP_TID_TABLE_IDX,
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -9682,6 +9682,8 @@ static int __ath11k_mac_register(struct
+ 			ieee80211_hw_set(ar->hw, USES_RSS);
+ 	}
+ 
++	ieee80211_hw_set(ar->hw, SUPPORTS_TID_CLASS_OFFLOAD);
++
+ 	ar->hw->wiphy->features |= NL80211_FEATURE_STATIC_SMPS;
+ 	ar->hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
+ 
diff --git a/package/kernel/mac80211/patches/ath11k_nss/335-0003-mac80211-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch b/package/kernel/mac80211/patches/ath11k_nss/335-0003-mac80211-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
new file mode 100644
index 00000000000000..6a37ba0e1aa730
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/335-0003-mac80211-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
@@ -0,0 +1,45 @@
+From c7bd857a315fb299e4c984be2f3720428477ae6e Mon Sep 17 00:00:00 2001
+From: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
+Date: Thu, 11 Nov 2021 11:14:08 +0530
+Subject: [PATCH] ath11k: skip HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE config
+
+Don't set HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE flag to TCL,
+HW only take care of tid classification if this flag is not set.
+
+Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
+Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
+---
+ include/net/mac80211.h                   |  3 +++
+ net/mac80211/debugfs.c                   |  1 +
+ net/mac80211/wme.c                       |  3 +++
+ 3 files changed, 7 insertions(+)
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -2727,6 +2727,8 @@ struct ieee80211_txq {
+  *
+  *  @IEEE80211_HW_SUPPORTS_NSS_OFFLOAD: Hardware/driver supports NSS offload
+  *
++ * @IEEE80211_HW_SUPPORTS_TID_CLASS_OFFLOAD: Hardware suports tid calssification offload.
++ *
+  * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
+  */
+ enum ieee80211_hw_flags {
+@@ -2786,6 +2788,7 @@ enum ieee80211_hw_flags {
+ 	IEEE80211_HW_MLO_MCAST_MULTI_LINK_TX,
+ 	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
+ 	IEEE80211_HW_SUPPORTS_MESH_NSS_OFFLOAD,
++	IEEE80211_HW_SUPPORTS_TID_CLASS_OFFLOAD,
+ 
+ 	/* keep last, obviously */
+ 	NUM_IEEE80211_HW_FLAGS
+--- a/net/mac80211/debugfs.c
++++ b/net/mac80211/debugfs.c
+@@ -498,6 +498,7 @@ static const char *hw_flag_names[] = {
+ 	FLAG(MLO_MCAST_MULTI_LINK_TX),
+ 	FLAG(SUPPORTS_NSS_OFFLOAD),
+ 	FLAG(SUPPORTS_MESH_NSS_OFFLOAD),
++	FLAG(SUPPORTS_TID_CLASS_OFFLOAD),
+ #undef FLAG
+ };
+ 
diff --git a/package/kernel/mac80211/patches/ath11k_nss/336-mac80211-Mesh-Fast-rx-support.patch b/package/kernel/mac80211/patches/ath11k_nss/336-mac80211-Mesh-Fast-rx-support.patch
new file mode 100644
index 00000000000000..d29a05f13943bf
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/336-mac80211-Mesh-Fast-rx-support.patch
@@ -0,0 +1,208 @@
+From 0f024902a8a54c70204f5b2f824c5dc74888c536 Mon Sep 17 00:00:00 2001
+From: Sriram R <quic_srirrama@quicinc.com>
+Date: Wed, 29 Sep 2021 09:30:21 +0530
+Subject: [PATCH] mac80211: Add support for mesh fast Rx path
+
+Add support to process rx frames for the mesh destination
+when driver supports fast Rx by offloading PN, Duplicate,
+reordering to the HW.
+
+Fast Rx from a peer is enabled once the PLINK is established.
+Fast Rx is not supported for the forwarding path currently.
+
+Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
+---
+ net/mac80211/cfg.c         |   5 +
+ net/mac80211/ieee80211_i.h |   1 +
+ net/mac80211/mesh_plink.c  |   5 +
+ net/mac80211/rx.c          | 262 ++++++++++++++++++++++++++++++++++++++++++++-
+ 4 files changed, 269 insertions(+), 4 deletions(-)
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1747,6 +1747,8 @@ static void sta_apply_mesh_params(struct
+ 			/* init at low value */
+ 			ewma_mesh_tx_rate_avg_add(&sta->mesh->tx_rate_avg, 10);
+ 
++			ieee80211_check_fast_rx(sta);
++
+ 			break;
+ 		case NL80211_PLINK_LISTEN:
+ 		case NL80211_PLINK_BLOCKED:
+@@ -1761,6 +1763,7 @@ static void sta_apply_mesh_params(struct
+ 			ieee80211_mps_sta_status_update(sta);
+ 			changed |= ieee80211_mps_set_sta_local_pm(sta,
+ 					NL80211_MESH_POWER_UNKNOWN);
++			ieee80211_check_fast_rx(sta);
+ 			break;
+ 		default:
+ 			/*  nothing  */
+--- a/net/mac80211/mesh_plink.c
++++ b/net/mac80211/mesh_plink.c
+@@ -381,6 +381,8 @@ static u64 __mesh_plink_deactivate(struc
+ 	changed |= ieee80211_mps_set_sta_local_pm(sta,
+ 			NL80211_MESH_POWER_UNKNOWN);
+ 
++	ieee80211_check_fast_rx(sta);
++
+ 	return changed;
+ }
+ 
+@@ -846,6 +848,7 @@ static u64 mesh_plink_establish(struct i
+ 	mpl_dbg(sdata, "Mesh plink with %pM ESTABLISHED\n", sta->sta.addr);
+ 	ieee80211_mps_sta_status_update(sta);
+ 	changed |= ieee80211_mps_set_sta_local_pm(sta, mshcfg->power_mode);
++	ieee80211_check_fast_rx(sta);
+ 	return changed;
+ }
+ 
+@@ -864,7 +867,7 @@ static u64 mesh_plink_fsm(struct ieee802
+ 	struct mesh_config *mshcfg = &sdata->u.mesh.mshcfg;
+ 	enum ieee80211_self_protected_actioncode action = 0;
+ 	u64 changed = 0;
+-	bool flush = false;
++	bool flush = false, check_fast_rx = false;
+ 
+ 	mpl_dbg(sdata, "peer %pM in state %s got event %s\n", sta->sta.addr,
+ 		mplstates[sta->mesh->plink_state], mplevents[event]);
+@@ -924,6 +927,7 @@ static u64 mesh_plink_fsm(struct ieee802
+ 			break;
+ 		case CNF_ACPT:
+ 			changed |= mesh_plink_establish(sdata, sta);
++			check_fast_rx = true;
+ 			break;
+ 		default:
+ 			break;
+@@ -939,6 +943,7 @@ static u64 mesh_plink_fsm(struct ieee802
+ 			break;
+ 		case OPN_ACPT:
+ 			changed |= mesh_plink_establish(sdata, sta);
++			check_fast_rx = true;
+ 			action = WLAN_SP_MESH_PEERING_CONFIRM;
+ 			break;
+ 		default:
+@@ -985,6 +990,10 @@ static u64 mesh_plink_fsm(struct ieee802
+ 		break;
+ 	}
+ 	spin_unlock_bh(&sta->mesh->plink_lock);
++
++	if (check_fast_rx)
++		ieee80211_check_fast_rx(sta);
++
+ 	if (flush)
+ 		mesh_path_flush_by_nexthop(sta);
+ 	if (action) {
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -4663,10 +4663,15 @@ void ieee80211_check_fast_rx(struct sta_
+ 
+ 		break;
+ 	case NL80211_IFTYPE_MESH_POINT:
++		/* Not required for NSS mode */
++		if (ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD))
++			goto clear;
++		/* Note: da and sa offs are not static, determine in fast rx path */
++
+ 		fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_FROMDS |
+ 						      IEEE80211_FCTL_TODS);
+-		fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
+-		fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
++
++		fastrx.internal_forward = 0;
+ 		break;
+ 	default:
+ 		goto clear;
+@@ -4707,7 +4712,7 @@ void ieee80211_check_fast_rx(struct sta_
+ 	__release(check_fast_rx);
+ 
+ 	if (assign)
+-		new = kmemdup(&fastrx, sizeof(fastrx), GFP_KERNEL);
++		new = kmemdup(&fastrx, sizeof(fastrx), GFP_ATOMIC);
+ 
+ 	offload_flags = get_bss_sdata(sdata)->vif.offload_flags;
+ 	offload = offload_flags & IEEE80211_OFFLOAD_DECAP_ENABLED;
+@@ -4890,6 +4895,10 @@ static bool ieee80211_invoke_fast_rx(str
+ 		u8 sa[ETH_ALEN];
+ 	} addrs __aligned(2);
+ 	struct ieee80211_sta_rx_stats *stats;
++	struct ieee80211s_hdr *mesh_hdr;
++	struct mesh_path *mppath;
++	u8 da_offs = fast_rx->da_offs, sa_offs = fast_rx->sa_offs;
++	struct ieee80211_sub_if_data *sdata = rx->sdata;
+ 
+ 	/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
+ 	 * to a common data structure; drivers can implement that per queue
+@@ -4939,6 +4948,37 @@ static bool ieee80211_invoke_fast_rx(str
+ 		snap_offs += IEEE80211_CCMP_HDR_LEN;
+ 	}
+ 
++	/* Find corresponding offsets for mesh hdr */
++	if (ieee80211_vif_is_mesh(&sdata->vif)) {
++		if (status->rx_flags & IEEE80211_RX_AMSDU)
++			return false;
++
++		/* All mesh data frames needs to be QoS Data */
++		if (unlikely(!ieee80211_is_data_qos(hdr->frame_control)))
++			return false;
++
++		/* TODO forwarding not handled yet in fast rx */
++		if (!ether_addr_equal(fast_rx->vif_addr, hdr->addr3))
++			return false;
++
++		/* Check if Min Mesh hdr is present */
++		if (!pskb_may_pull(skb, hdrlen + 6))
++			goto drop;
++
++		/* Goto mesh hdr, located at snap offs compared to AP/STA */
++		mesh_hdr = (struct ieee80211s_hdr *) (skb->data + snap_offs);
++
++		/* Only Ext Mesh hdr supported in this path now */
++		if ((mesh_hdr->flags & MESH_FLAGS_AE) != MESH_FLAGS_AE_A5_A6)
++			return false;
++
++		/* Point to eaddr1 and eaddr2 */
++		da_offs = snap_offs + ETH_ALEN;
++		sa_offs = da_offs + ETH_ALEN;
++
++		snap_offs += sizeof(struct ieee80211s_hdr);
++	}
++
+ 	if (!ieee80211_vif_is_mesh(&rx->sdata->vif) &&
+ 	    !(status->rx_flags & IEEE80211_RX_AMSDU)) {
+ 		if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
+@@ -4976,9 +5016,33 @@ static bool ieee80211_invoke_fast_rx(str
+ 		return true;
+ 	}
+ 
++	/* Update MPP table for the received packet */
++	if (ieee80211_vif_is_mesh(&sdata->vif)) {
++		char *proxied_addr, *mpp_addr;
++
++		mpp_addr = hdr->addr4;
++		proxied_addr = mesh_hdr->eaddr2;
++
++		/* Update mpp for the SA */
++		rcu_read_lock();
++		mppath = mpp_path_lookup(sdata, proxied_addr);
++		if (!mppath) {
++			mpp_path_add(sdata, proxied_addr, mpp_addr);
++		} else {
++			spin_lock_bh(&mppath->state_lock);
++
++			if (!ether_addr_equal(mppath->mpp, mpp_addr))
++				ether_addr_copy(mppath->mpp, mpp_addr);
++
++			mppath->exp_time = jiffies;
++			spin_unlock_bh(&mppath->state_lock);
++		}
++		rcu_read_unlock();
++	}
++
+ 	/* do the header conversion - first grab the addresses */
+-	ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs);
+-	ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs);
++	ether_addr_copy(addrs.da, skb->data + da_offs);
++	ether_addr_copy(addrs.sa, skb->data + sa_offs);
+ 	if (ieee80211_vif_is_mesh(&rx->sdata->vif)) {
+ 	    skb_pull(skb, snap_offs - 2);
+ 	    put_unaligned_be16(skb->len - 2, skb->data);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch b/package/kernel/mac80211/patches/ath11k_nss/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch
new file mode 100644
index 00000000000000..d128824140ecb6
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch
@@ -0,0 +1,33 @@
+From 0628e831520aa2e57aed02aee4a1772b40ce4f9d Mon Sep 17 00:00:00 2001
+From: Nagarajan Maran <quic_nmaran@quicinc.com>
+Date: Thu, 30 Jun 2022 17:20:29 +0530
+Subject: [PATCH] mac80211: fix dynamic vlan warning with monitor interface restart
+
+When monitor interface restarts, in nss offload disabled
+case, the encap and decap offload flags are removed
+from all the interfaces in that phy#.
+
+However when dynamic VLAN and monitor interfaces are
+created in the same phy#, these flags are not updated
+correctly, due to which warning calltrace is observed.
+
+Add condition check to update the correct flags in
+dynamic VLAN case.
+
+Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
+---
+ net/mac80211/iface.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -994,7 +994,8 @@ static bool ieee80211_set_sdata_offload_
+ 		flags |= IEEE80211_OFFLOAD_DECAP_ENABLED;
+ 
+ 		if (local->monitors &&
+-		    !ieee80211_hw_check(&local->hw, SUPPORTS_CONC_MON_RX_DECAP))
++		    (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD) ||
++		     !ieee80211_hw_check(&local->hw, SUPPORTS_CONC_MON_RX_DECAP)))
+ 			flags &= ~IEEE80211_OFFLOAD_DECAP_ENABLED;
+ 	} else {
+ 		flags &= ~IEEE80211_OFFLOAD_DECAP_ENABLED;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/675-01-cfg80211-Extend-interface-combination-advertisement-.patch b/package/kernel/mac80211/patches/ath11k_nss/675-01-cfg80211-Extend-interface-combination-advertisement-.patch
new file mode 100644
index 00000000000000..4a8328f4e3ca83
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/675-01-cfg80211-Extend-interface-combination-advertisement-.patch
@@ -0,0 +1,1594 @@
+From 1c326ee47eb453b884aa0436916f73c458e1a7f3 Mon Sep 17 00:00:00 2001
+From: Vasanthakumar Thiagarajan <quic_vthiagar@quicinc.com>
+Date: Sat, 8 Oct 2022 13:59:17 +0530
+Subject: [PATCH 1/3] cfg80211/mac80211: extend iface comb
+advertisement for multi-hardware dev
+
+When driver combines multiple discrete hardware under one wiphy, it is
+required for the driver to be able to advertise iface combination
+capabilities per underlying physical hardware. Iface combination for each
+underlying hardware is described with an identifier, the same index which
+is used in wiphy->hw_chans[] to learn the channel capabilities of the
+respective hardware. It should be noted that the supporting drivers also
+need to signal the iface comb capabilities that are common for all the
+hardware through the existing interface to maintain the backward
+compatibility with the user space. Provision to advertise per physical
+hardware specific iface comb capabilities and the sanity checks on the
+advertised capabilities are implemented in this commit.
+
+Example:
+
+Say driver abstracts two discrete hardware under one wiphy,
+wiphy->hw_chans[0] supporting 2 GHz and wiphy->hw_chans[1] supporting
+5 GHz. Each hardware can operate on only one channel at any given time
+but under the wiphy there can be concurrent interfaces on both the radios.
+2 GHz hardware supports #STA <= 1, #AP <= 3 total 4 and 5 GHz hardware
+supports #STA <= 1, #AP <= 4 total 5
+
+struct ieee80211_iface_limit limits_common[] = {
+	{ .max = 1, .types = BIT(NL80211_IFTYPE_STATION), },
+	{ .max = 3, .types = BIT(NL80211_IFTYPE_AP), },
+};
+
+limits_common[] defines the minimum (common) capability out of all the
+underlying hardware specific capabilities. This is reported in the existing
+advertisement mechanism. Common max_interfaces across 2 GHz and 5 GHz is 4,
+common num_different_channels is 1.
+
+struct ieee80211_iface_limit limits_2ghz[] = {
+	{ .max = 1, .types = BIT(NL80211_IFTYPE_STATION), },
+	{ .max = 3, .types = BIT(NL80211_IFTYPE_AP), },
+};
+
+struct ieee80211_iface_limit limits_5ghz[] = {
+	{ .max = 1, .types = BIT(NL80211_IFTYPE_STATION), },
+	{ .max = 4, .types = BIT(NL80211_IFTYPE_AP), },
+};
+
+struct ieee80211_iface_combination combination = {
+	.limits = limits_common,
+	.max_interfaces = 4,
+	.num_different_channels = 1,
+	...
+	.freq_range = {
+			{
+				.hw_chan_idx = 0,
+				.limits = limits_2ghz,
+				.max_interfaces = 4,
+				.num_different_channels = 1,
+				.n_limits = ARRAY_SIZE(limits_2ghz),
+			},
+			{
+				.hw_chan_idx = 1,
+				.limits = limits_5ghz,
+				.max_interfaces = 5,
+				.num_different_channels = 1,
+				.n_limits = ARRAY_SIZE(limits_5ghz),
+			},
+		      },
+};
+
+Signed-off-by: Vasanthakumar Thiagarajan <quic_vthiagar@quicinc.com>
+---
+ include/net/cfg80211.h     | 188 +++++++++++++++++++-
+ net/mac80211/chan.c        |  29 ++-
+ net/mac80211/ieee80211_i.h |   5 +-
+ net/mac80211/main.c        |  58 ++++++
+ net/mac80211/util.c        | 315 ++++++++++++++++++++++++++------
+ net/wireless/core.c        | 265 ++++++++++++++++++++++-----
+ net/wireless/util.c        | 356 +++++++++++++++++++++++++++++++++----
+ 7 files changed, 1073 insertions(+), 143 deletions(-)
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -1537,27 +1537,60 @@ struct cfg80211_color_change_settings {
+ };
+ 
+ /**
++ * struct iface_comb_per_hw_params - HW specific interface combinations input
++ *
++ * Used to pass per-hw interface combination parameters
++ *
++ * @num_different_channels: the number of different channels we want to use
++ *	with in the per-hw supported channels.
++ * @iftype_num: array with the number of interfaces of each interface
++ *	type. The index is the interface type as specified in &enum
++ *	nl80211_iftype.
++ */
++
++struct iface_comb_per_hw_params {
++	int num_different_channels;
++	int iftype_num[NUM_NL80211_IFTYPES];
++};
++
++/**
+  * struct iface_combination_params - input parameters for interface combinations
+  *
+  * Used to pass interface combination parameters
+  *
+  * @num_different_channels: the number of different channels we want
+- *	to use for verification
++ *	to use for verification, not applicable when hw specific interface
++ *	combination parameters are passed in @per_hw_params
+  * @radar_detect: a bitmap where each bit corresponds to a channel
+  *	width where radar detection is needed, as in the definition of
+  *	&struct ieee80211_iface_combination.@radar_detect_widths
+  * @iftype_num: array with the number of interfaces of each interface
+  *	type.  The index is the interface type as specified in &enum
+- *	nl80211_iftype.
++ *	nl80211_iftype. This will hold the interfaces which are not
++ *	yet assigned a channel when hw specific interface combination
++ *	is passed in @per_hw_params.
+  * @new_beacon_int: set this to the beacon interval of a new interface
+  *	that's not operating yet, if such is to be checked as part of
+  *	the verification
++ * @per_hw: underlying hw specific interface combinations. Per-hw channel
++ *	list index as advertised in wiphy @hw_chans is used as index
++ *	in @per_hw to maintain the interface combination of the corresponding
++ *	hw.
++ * @chandef: Channel definition for which the interface combination is to be
++ *	checked, when checking during interface preparation on a new channel,
++ *	for example. This will be used when the driver advertises underlying
++ *	hw specific interface combination in a multi-mac device. This will be
++ *	NULL when the interface combination check is not due to channel or the
++ *	interface combination does not include per-hw advertisement.
++ *
+  */
+ struct iface_combination_params {
+ 	int num_different_channels;
+ 	u8 radar_detect;
+ 	int iftype_num[NUM_NL80211_IFTYPES];
+ 	u32 new_beacon_int;
++	struct iface_comb_per_hw_params *per_hw;
++	const struct cfg80211_chan_def *chandef;
+ };
+ 
+ /**
+@@ -4941,6 +4974,32 @@ struct ieee80211_iface_limit {
+ };
+ 
+ /**
++ * strucieee80211_iface_per_hw - hardware specific interface combination
++ *
++ * Drivers registering multiple radios under a single wiphy can advertise
++ * radio specific interface combinations through this structure. Please note
++ * that to maintain the compatibility with the user space which is not aware
++ * of this extension of per-hardware interface combination signaling,
++ * the driver should still advertise it's interface combination (mostly
++ * common minimum capability) using the existing interface combination signaling
++ * method.
++ *
++ * @hw_chans_idx: index of hardware specific channel list as per wiphy @hw_chans
++ * @limits: limits for the given interface type
++ * @num_different_channels: number of different channels which can be active
++ *	concurrently in this hw
++ * @max_interfaces: maximum number of total interfaces allowed in this group
++ * @n_limits: number of limitations
++ */
++struct ieee80211_iface_per_hw {
++	u8 hw_chans_idx;
++	const struct ieee80211_iface_limit *limits;
++	u32 num_different_channels;
++	u16 max_interfaces;
++	u8 n_limits;
++};
++
++/**
+  * struct ieee80211_iface_combination - possible interface combination
+  *
+  * With this structure the driver can describe which interface
+@@ -4998,6 +5057,62 @@ struct ieee80211_iface_limit {
+  *		.num_different_channels = 2,
+  *	};
+  *
++ *
++ * 4. Hardware specific interface combination with driver supporting two hw
++ *    (MAC), one underlying MAC supporting 2 GHz band and the other supporting
++ *    5 GHz band.
++ *
++ *    Allow #STA <= 1, #AP <= 1, channels = 1, total 2 in 2 GHz radio and
++ *
++ *    Allow #STA <= 1, #AP <= 2, channels = 1, total 3 in 5 GHz radio
++ *
++ *    Drivers advertising per-hardware interface combination should also
++ *    advertise a sub-set of capabilities using existing interface mainly for
++ *    maintaining compatibility with the user space which is not aware of the
++ *    new per-hardware advertisement.
++ *
++ *    Sub-set interface combination advertised in the existing infrastructure:
++ *    Allow #STA <= 1, #AP <= 1, channel = 1, total 2
++ *
++ *    .. code-block:: c
++ *
++ *	struct ieee80211_iface_limit limits4[] = {
++ *		{ .max = 1, .types = BIT(NL80211_IFTYPE_STATION), },
++ *		{ .max = 1, .types = BIT(NL80211_IFTYPE_AP), },
++ *	};
++ *	struct ieee80211_iface_limit limits5_2ghz[] = {
++ *		{ .max = 1, .types = BIT(NL80211_IFTYPE_STATION), },
++ *		{ .max = 1, .types = BIT(NL80211_IFTYPE_AP), },
++ *	};
++ *	struct ieee80211_iface_limit limits5_5ghz[] = {
++ *		{ .max = 1, .types = BIT(NL80211_IFTYPE_STATION), },
++ *		{ .max = 2, .types = BIT(NL80211_IFTYPE_AP), },
++ *	};
++ *	struct ieee80211_iface_per_hw hw_combinations[] = {
++ *		{
++ *			.hw_chans_idx = 0,
++ *			.limits = limits5_2ghz,
++ *			.num_different_channels = 1,
++ *			.max_interfaces = 2,
++ *			.n_limits = ARRAY_SIZE(limits5_2ghz),
++ *		 },
++ *		{
++ *			.hw_chans_idx = 1,
++ *			.limits = limits5_5ghz,
++ *			.num_different_channels = 1,
++ *			.max_interfaces = 3,
++ *			.n_limits = ARRAY_SIZE(limits5_5ghz),
++ *		 },
++ *	};
++ *	struct ieee80211_iface_combination combination4 = {
++ *		.limits = limits4,
++ *		.n_limits = ARRAY_SIZE(limits4),
++ *		.max_interfaces = 2,
++ *		.num_different_channels = 1,
++ *		.iface_hw_list = hw_combinations,
++ *		.n_hw_list = ARRAY_SIZE(hw_combinations),
++ *	};
++ *
+  */
+ struct ieee80211_iface_combination {
+ 	/**
+@@ -5055,6 +5170,20 @@ struct ieee80211_iface_combination {
+ 	 *   combination must be greater or equal to this value.
+ 	 */
+ 	u32 beacon_int_min_gcd;
++
++	/**
++	 * @iface_hw_list:
++	 * This wiphy has multiple underlying radios, describe interface
++	 * combination for each of them, valid only when the driver advertises
++	 * multi-radio presence in wiphy @hw_chans.
++	 */
++	const struct ieee80211_iface_per_hw *iface_hw_list;
++
++	/**
++	 * @n_hw_list:
++	 * number of hardware in @iface_hw_List
++	 */
++	u32 n_hw_list;
+ };
+ 
+ struct ieee80211_txrx_stypes {
+@@ -5305,6 +5434,18 @@ struct wiphy_iftype_akm_suites {
+ #define CFG80211_HW_TIMESTAMP_ALL_PEERS	0xffff
+ 
+ /**
++ * struct ieee80211_supported_chans_per_hw - supported channels as per the
++ * underlying constituent hw configuration
++ *
++ * @n_chans: number of channels in @chans
++ * @chans: list of channels supported by the constituent hw
++ */
++struct ieee80211_chans_per_hw {
++	int n_chans;
++	struct ieee80211_channel chans[];
++};
++
++/**
+  * struct wiphy - wireless hardware description
+  * @mtx: mutex for the data (structures) of this device
+  * @reg_notifier: the driver's regulatory notification callback,
+@@ -5520,6 +5661,13 @@ struct wiphy_iftype_akm_suites {
+  *	A value of %CFG80211_HW_TIMESTAMP_ALL_PEERS indicates the driver
+  *	supports enabling HW timestamping for all peers (i.e. no need to
+  *	specify a mac address).
++ * @hw_chans: list of the channels supported by every constituent underlying hw.
++ *	The drivers registering multiple radios under the a wiphy can advertise
++ *	the list of channels supported by each hw in this list. Underlying hw
++ *	specific channel list can be used while describing interface combination
++ *	for each of the underlying hw.
++ * @num_hw: number of underlying hw for which the channels list are advertised
++ *	in @hw_chans.
+  */
+ struct wiphy {
+ 	struct mutex mtx;
+@@ -5670,6 +5818,9 @@ struct wiphy {
+ 
+ 	u16 hw_timestamp_max_peers;
+ 
++	struct ieee80211_chans_per_hw **hw_chans;
++	int num_hw;
++
+ 	char priv[] __aligned(NETDEV_ALIGN);
+ };
+ 
+@@ -8956,9 +9107,32 @@ int cfg80211_check_combinations(struct w
+ int cfg80211_iter_combinations(struct wiphy *wiphy,
+ 			       struct iface_combination_params *params,
+ 			       void (*iter)(const struct ieee80211_iface_combination *c,
+-					    void *data),
++					    void *data, int hw_chan_idx),
+ 			       void *data);
+ 
++/**
++ * cfg80211_per_hw_iface_comb_advertised - if per-hw iface combination supported
++ *
++ * @wiphy: the wiphy
++ *
++ * This function is used to check underlying per-hw interface combination is
++ * advertised by the driver.
++ */
++bool cfg80211_per_hw_iface_comb_advertised(struct wiphy *wiphy);
++
++/**
++ * cfg80211_get_hw_idx_by_chan - get the hw index by the channel
++ *
++ * @wiphy: the wiphy
++ * @chandef: channel definition for which the supported hw index is
++ *	required
++ *
++ * returns -1 in case the channel is not supported by any of the constituent
++ *	hw
++ */
++int cfg80211_get_hw_idx_by_chan(struct wiphy *wiphy,
++				const struct cfg80211_chan_def *chandef);
++
+ /*
+  * cfg80211_stop_iface - trigger interface disconnection
+  *
+@@ -9152,6 +9326,16 @@ bool cfg80211_iftype_allowed(struct wiph
+ void cfg80211_assoc_comeback(struct net_device *netdev,
+ 			     const u8 *ap_addr, u32 timeout);
+ 
++/**
++ * cfg80211_hw_chans_includes_dfs - check if per-hardware channel includes DFS
++ * @chans: hardware channel list
++ *
++ * Check if the given per-hardware list includes channels in DFS range.
++ * Please note the channel is checked against the entire range of DFS
++ * freq in 5 GHz irrespective of regulatory configurations.
++ */
++bool cfg80211_hw_chans_includes_dfs(const struct ieee80211_chans_per_hw *chans);
++
+ /* Logging, debugging and troubleshooting/diagnostic helpers. */
+ 
+ /* wiphy_printk helpers, similar to dev_printk */
+--- a/net/mac80211/chan.c
++++ b/net/mac80211/chan.c
+@@ -47,26 +47,41 @@ int ieee80211_chanctx_refcount(struct ie
+ 	       ieee80211_chanctx_num_reserved(local, ctx);
+ }
+ 
+-static int ieee80211_num_chanctx(struct ieee80211_local *local)
++static int ieee80211_num_chanctx(struct ieee80211_local *local,
++				 const struct cfg80211_chan_def *chandef)
+ {
+ 	struct ieee80211_chanctx *ctx;
+ 	int num = 0;
++	int hw_idx, ctx_idx;
+ 
+ 	lockdep_assert_held(&local->chanctx_mtx);
+ 
+-	list_for_each_entry(ctx, &local->chanctx_list, list)
+-		num++;
++	hw_idx = cfg80211_get_hw_idx_by_chan(local->hw.wiphy, chandef);
++
++	list_for_each_entry(ctx, &local->chanctx_list, list) {
++		if (hw_idx < 0)
++			num++;
++		else {
++			ctx_idx =
++				cfg80211_get_hw_idx_by_chan(local->hw.wiphy,
++							    &ctx->conf.def);
++			if (ctx_idx == hw_idx)
++				num++;
++		}
++	}
+ 
+ 	return num;
+ }
+ 
+-static bool ieee80211_can_create_new_chanctx(struct ieee80211_local *local)
++static bool ieee80211_can_create_new_chanctx(struct ieee80211_local *local,
++					     const struct cfg80211_chan_def *chandef)
+ {
+ 	lockdep_assert_held(&local->chanctx_mtx);
+-	return ieee80211_num_chanctx(local) < ieee80211_max_num_channels(local);
++	return ieee80211_num_chanctx(local, chandef) <
++	       ieee80211_max_num_channels(local, chandef);
+ }
+ 
+-static struct ieee80211_chanctx *
++struct ieee80211_chanctx *
+ ieee80211_link_get_chanctx(struct ieee80211_link_data *link)
+ {
+ 	struct ieee80211_local *local __maybe_unused = link->sdata->local;
+@@ -1116,7 +1131,7 @@ int ieee80211_link_reserve_chanctx(struc
+ 
+ 	new_ctx = ieee80211_find_reservation_chanctx(local, chandef, mode);
+ 	if (!new_ctx) {
+-		if (ieee80211_can_create_new_chanctx(local)) {
++		if (ieee80211_can_create_new_chanctx(local, chandef)) {
+ 			new_ctx = ieee80211_new_chanctx(local, chandef, mode);
+ 			if (IS_ERR(new_ctx))
+ 				return PTR_ERR(new_ctx);
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -2573,6 +2573,8 @@ void ieee80211_link_copy_chanctx_to_vlan
+ 					  bool clear);
+ int ieee80211_chanctx_refcount(struct ieee80211_local *local,
+ 			       struct ieee80211_chanctx *ctx);
++struct ieee80211_chanctx *
++ieee80211_link_get_chanctx(struct ieee80211_link_data *link);
+ 
+ void ieee80211_recalc_smps_chanctx(struct ieee80211_local *local,
+ 				   struct ieee80211_chanctx *chanctx);
+@@ -2594,7 +2596,8 @@ int ieee80211_check_combinations(struct
+ 				 const struct cfg80211_chan_def *chandef,
+ 				 enum ieee80211_chanctx_mode chanmode,
+ 				 u8 radar_detect);
+-int ieee80211_max_num_channels(struct ieee80211_local *local);
++int ieee80211_max_num_channels(struct ieee80211_local *local,
++			       const struct cfg80211_chan_def *chandef);
+ void ieee80211_recalc_chanctx_chantype(struct ieee80211_local *local,
+ 				       struct ieee80211_chanctx *ctx);
+ 
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -937,6 +937,45 @@ static int ieee80211_init_cipher_suites(
+ 	return 0;
+ }
+ 
++static int
++ieee80211_check_per_hw_iface_comb(struct ieee80211_local *local,
++				  const struct ieee80211_iface_combination *c)
++{
++	int h, l;
++	u32 hw_idx_bm = 0;
++
++	if (!local->use_chanctx)
++		return -EINVAL;
++
++	for (h = 0; h < c->n_hw_list; h++) {
++		const struct ieee80211_iface_per_hw *hl;
++		const struct ieee80211_chans_per_hw *chans;
++
++		hl = &c->iface_hw_list[h];
++
++		if (hl->hw_chans_idx >= local->hw.wiphy->num_hw)
++			return -EINVAL;
++
++		chans = local->hw.wiphy->hw_chans[hl->hw_chans_idx];
++		if (c->radar_detect_widths &&
++		    cfg80211_hw_chans_includes_dfs(chans) &&
++		    hl->num_different_channels > 1)
++			return -EINVAL;
++
++		for (l = 0; l < hl->n_limits; l++)
++			if ((hl->limits[l].types & BIT(NL80211_IFTYPE_ADHOC)) &&
++			    hl->limits[l].max > 1)
++				return -EINVAL;
++
++		if (hw_idx_bm & BIT(h))
++			return -EINVAL;
++
++		hw_idx_bm |= BIT(h);
++	}
++
++	return 0;
++}
++
+ int ieee80211_register_hw(struct ieee80211_hw *hw)
+ {
+ 	struct ieee80211_local *local = hw_to_local(hw);
+@@ -1051,6 +1090,25 @@ int ieee80211_register_hw(struct ieee802
+ 		}
+ 	}
+ 
++	for (i = 0; i < local->hw.wiphy->n_iface_combinations; i++) {
++		const struct ieee80211_iface_combination *comb;
++
++		comb = &local->hw.wiphy->iface_combinations[i];
++
++		if (comb->n_hw_list && !local->hw.wiphy->num_hw)
++			return -EINVAL;
++
++		if (!comb->n_hw_list)
++			continue;
++
++		/*
++		 * Run through similar validations on the per-hardware
++		 * interface combinations, if advertised.
++		 */
++		if (ieee80211_check_per_hw_iface_comb(local, comb))
++			return -EINVAL;
++	}
++
+ 	/* Only HW csum features are currently compatible with mac80211 */
+ 	if (WARN_ON(hw->netdev_features & ~MAC80211_SUPPORTED_FEATURES))
+ 		return -EINVAL;
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -4818,16 +4818,174 @@ static u8 ieee80211_chanctx_radar_detect
+ 	return radar_detect;
+ }
+ 
++static void
++ieee80211_prepare_iface_combination(struct ieee80211_sub_if_data *sdata,
++				    const struct cfg80211_chan_def *chandef,
++				    enum ieee80211_chanctx_mode chanmode,
++				    struct iface_combination_params *params,
++				    int *total)
++{
++	struct ieee80211_local *local = sdata->local;
++	struct ieee80211_sub_if_data *sdata_iter;
++	enum nl80211_iftype iftype = sdata->wdev.iftype;
++	struct ieee80211_chanctx *ctx;
++
++	lockdep_assert_held(&local->chanctx_mtx);
++
++	if (chandef)
++		params->num_different_channels = 1;
++
++	if (iftype != NL80211_IFTYPE_UNSPECIFIED)
++		params->iftype_num[iftype] = 1;
++
++	list_for_each_entry(ctx, &local->chanctx_list, list) {
++		if (ctx->replace_state == IEEE80211_CHANCTX_WILL_BE_REPLACED)
++			continue;
++		params->radar_detect |=
++			ieee80211_chanctx_radar_detect(local, ctx);
++		if (ctx->mode == IEEE80211_CHANCTX_EXCLUSIVE) {
++			params->num_different_channels++;
++			continue;
++		}
++		if (chandef && chanmode == IEEE80211_CHANCTX_SHARED &&
++		    cfg80211_chandef_compatible(chandef,
++						&ctx->conf.def))
++			continue;
++		params->num_different_channels++;
++	}
++
++	list_for_each_entry_rcu(sdata_iter, &local->interfaces, list) {
++		struct wireless_dev *wdev_iter;
++
++		wdev_iter = &sdata_iter->wdev;
++
++		if (sdata_iter == sdata ||
++		    !ieee80211_sdata_running(sdata_iter) ||
++		    cfg80211_iftype_allowed(local->hw.wiphy,
++					    wdev_iter->iftype, 0, 1))
++			continue;
++
++		params->iftype_num[wdev_iter->iftype]++;
++		(*total)++;
++	}
++}
++
++static void
++ieee80211_get_per_hw_sdata_active_iface(struct ieee80211_sub_if_data *sdata,
++					struct iface_combination_params *params,
++					int *total)
++{
++	struct ieee80211_local *local = sdata->local;
++	unsigned int link_id;
++	int idx;
++
++	for (link_id = 0; link_id < ARRAY_SIZE(sdata->link); link_id++) {
++		struct ieee80211_link_data *link;
++		struct ieee80211_chanctx *ctx;
++
++		link = sdata_dereference(sdata->link[link_id], sdata);
++		if (!link)
++			continue;
++
++		ctx = ieee80211_link_get_chanctx(link);
++		if (ctx &&
++		    ctx->replace_state == IEEE80211_CHANCTX_WILL_BE_REPLACED)
++			ctx = ctx->replace_ctx;
++
++		idx = -1;
++		if (ctx)
++			idx = cfg80211_get_hw_idx_by_chan(local->hw.wiphy,
++							  &ctx->conf.def);
++
++		if (idx >= 0)
++			params->per_hw[idx].iftype_num[sdata->wdev.iftype]++;
++		else
++			params->iftype_num[sdata->wdev.iftype]++;
++
++		if (total)
++			(*total)++;
++	}
++}
++
++static int
++ieee80211_prepare_per_hw_iface_combination(struct ieee80211_sub_if_data *sdata,
++					const struct cfg80211_chan_def *chandef,
++					enum ieee80211_chanctx_mode chanmode,
++					struct iface_combination_params *params,
++					int *total)
++{
++	struct ieee80211_local *local = sdata->local;
++	struct ieee80211_sub_if_data *sdata_iter;
++	enum nl80211_iftype iftype = sdata->wdev.iftype;
++	struct ieee80211_chanctx *ctx;
++	int hchan_idx;
++	size_t size;
++	bool sdata_included = false;
++
++	lockdep_assert_held(&local->chanctx_mtx);
++
++	size = sizeof(*params->per_hw) * local->hw.wiphy->num_hw;
++	/* caller should free this memory upon success status */
++	params->per_hw = kzalloc(size, GFP_KERNEL);
++	if (!params->per_hw)
++		return -ENOMEM;
++
++	hchan_idx = cfg80211_get_hw_idx_by_chan(local->hw.wiphy, chandef);
++	if (hchan_idx >= 0) {
++		params->per_hw[hchan_idx].num_different_channels = 1;
++		if (iftype != NL80211_IFTYPE_UNSPECIFIED) {
++			params->per_hw[hchan_idx].iftype_num[iftype] = 1;
++			sdata_included = true;
++		}
++	}
++
++	list_for_each_entry(ctx, &local->chanctx_list, list) {
++		if (ctx->replace_state == IEEE80211_CHANCTX_WILL_BE_REPLACED)
++			continue;
++		hchan_idx = cfg80211_get_hw_idx_by_chan(local->hw.wiphy,
++							&ctx->conf.def);
++		if (WARN_ON(hchan_idx < 0))
++			continue;
++
++		params->radar_detect |=
++			ieee80211_chanctx_radar_detect(local, ctx);
++		if (ctx->mode == IEEE80211_CHANCTX_EXCLUSIVE) {
++			params->per_hw[hchan_idx].num_different_channels++;
++			continue;
++		}
++		if (chandef && chanmode == IEEE80211_CHANCTX_SHARED &&
++		    cfg80211_chandef_compatible(chandef,
++						&ctx->conf.def))
++			continue;
++		params->per_hw[hchan_idx].num_different_channels++;
++	}
++
++	list_for_each_entry_rcu(sdata_iter, &local->interfaces, list) {
++		struct wireless_dev *wdev_iter;
++
++		wdev_iter = &sdata_iter->wdev;
++
++		if ((sdata_included && sdata_iter == sdata) ||
++		    !ieee80211_sdata_running(sdata_iter) ||
++		    cfg80211_iftype_allowed(local->hw.wiphy,
++					    wdev_iter->iftype, 0, 1))
++			continue;
++
++		ieee80211_get_per_hw_sdata_active_iface(sdata_iter, params,
++							total);
++	}
++
++	return 0;
++}
++
+ int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
+ 				 const struct cfg80211_chan_def *chandef,
+ 				 enum ieee80211_chanctx_mode chanmode,
+ 				 u8 radar_detect)
+ {
+ 	struct ieee80211_local *local = sdata->local;
+-	struct ieee80211_sub_if_data *sdata_iter;
+ 	enum nl80211_iftype iftype = sdata->wdev.iftype;
+-	struct ieee80211_chanctx *ctx;
+-	int total = 1;
++	int total = 1, ret;
+ 	struct iface_combination_params params = {
+ 		.radar_detect = radar_detect,
+ 	};
+@@ -4861,60 +5019,118 @@ int ieee80211_check_combinations(struct
+ 		return 0;
+ 	}
+ 
+-	if (chandef)
+-		params.num_different_channels = 1;
++	if (cfg80211_per_hw_iface_comb_advertised(local->hw.wiphy)) {
++		ret = ieee80211_prepare_per_hw_iface_combination(sdata, chandef,
++									chanmode,
++									&params,
++									&total);
++		if (ret)
++			return ret;
++	} else {
++		ieee80211_prepare_iface_combination(sdata, chandef, chanmode,
++						&params, &total);
++	}
+ 
+-	if (iftype != NL80211_IFTYPE_UNSPECIFIED)
+-		params.iftype_num[iftype] = 1;
++	if (total == 1 && !params.radar_detect) {
++		kfree(params.per_hw);
++		return 0;
++	}
+ 
+-	list_for_each_entry(ctx, &local->chanctx_list, list) {
+-		if (ctx->replace_state == IEEE80211_CHANCTX_WILL_BE_REPLACED)
+-			continue;
+-		params.radar_detect |=
+-			ieee80211_chanctx_radar_detect(local, ctx);
+-		if (ctx->mode == IEEE80211_CHANCTX_EXCLUSIVE) {
+-			params.num_different_channels++;
++	ret = cfg80211_check_combinations(local->hw.wiphy, &params);
++
++	kfree(params.per_hw);
++
++	return ret;
++}
++
++static void
++ieee80211_iter_max_chans(const struct ieee80211_iface_combination *c,
++			 void *data, int hw_chan_idx)
++{
++	u32 *max_num_different_channels = data;
++
++	*max_num_different_channels =
++		max(*max_num_different_channels, c->num_different_channels);
++}
++
++static void
++ieee80211_iter_per_hw_max_chans(const struct ieee80211_iface_combination *c,
++				void *data, int hw_chan_idx)
++{
++	u32 *max_num_different_channels = data;
++	u32 max_supported_different_channels = 0;
++	int i;
++
++	for (i = 0; i < c->n_hw_list; i++) {
++		const struct ieee80211_iface_per_hw *h;
++
++		h = &c->iface_hw_list[i];
++		if (hw_chan_idx != -1) {
++			if (h->hw_chans_idx == hw_chan_idx) {
++				max_supported_different_channels =
++					h->num_different_channels;
++				break;
++			}
+ 			continue;
+ 		}
+-		if (chandef && chanmode == IEEE80211_CHANCTX_SHARED &&
+-		    cfg80211_chandef_compatible(chandef,
+-						&ctx->conf.def))
+-			continue;
+-		params.num_different_channels++;
++		max_supported_different_channels += h->num_different_channels;
+ 	}
+ 
+-	list_for_each_entry_rcu(sdata_iter, &local->interfaces, list) {
+-		struct wireless_dev *wdev_iter;
++	*max_num_different_channels = max(*max_num_different_channels,
++					  max_supported_different_channels);
++}
+ 
+-		wdev_iter = &sdata_iter->wdev;
++static int
++ieee80211_max_num_channels_hw_list(struct ieee80211_local *local,
++				   const struct cfg80211_chan_def *chandef)
++{
++	struct ieee80211_sub_if_data *sdata;
++	struct ieee80211_chanctx *ctx;
++	u32 max_num_different_channels = 1;
++	size_t size;
++	int err, hchan_idx;
++	struct iface_combination_params params = { 0 };
++
++	size = sizeof(*params.per_hw) * local->hw.wiphy->num_hw;
++	/* caller should free this memory */
++	params.per_hw = kzalloc(size, GFP_KERNEL);
++	if (!params.per_hw)
++		return -ENOMEM;
+ 
+-		if (sdata_iter == sdata ||
+-		    !ieee80211_sdata_running(sdata_iter) ||
+-		    cfg80211_iftype_allowed(local->hw.wiphy,
+-					    wdev_iter->iftype, 0, 1))
++	params.chandef = chandef;
++	list_for_each_entry(ctx, &local->chanctx_list, list) {
++		if (ctx->replace_state == IEEE80211_CHANCTX_WILL_BE_REPLACED)
++			continue;
++		hchan_idx = cfg80211_get_hw_idx_by_chan(local->hw.wiphy,
++							&ctx->conf.def);
++		if (WARN_ON(hchan_idx < 0))
+ 			continue;
+ 
+-		params.iftype_num[wdev_iter->iftype]++;
+-		total++;
++		params.radar_detect |=
++			ieee80211_chanctx_radar_detect(local, ctx);
++		params.per_hw[hchan_idx].num_different_channels++;
+ 	}
+ 
+-	if (total == 1 && !params.radar_detect)
+-		return 0;
++	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
++		struct wireless_dev *wdev = &sdata->wdev;
+ 
+-	return cfg80211_check_combinations(local->hw.wiphy, &params);
+-}
++		if (!ieee80211_sdata_running(sdata) ||
++		    cfg80211_iftype_allowed(local->hw.wiphy, wdev->iftype, 0,
++					    1))
++			continue;
++		ieee80211_get_per_hw_sdata_active_iface(sdata, &params, NULL);
++	}
+ 
+-static void
+-ieee80211_iter_max_chans(const struct ieee80211_iface_combination *c,
+-			 void *data)
+-{
+-	u32 *max_num_different_channels = data;
++	err = cfg80211_iter_combinations(local->hw.wiphy, &params,
++					 ieee80211_iter_per_hw_max_chans,
++					 &max_num_different_channels);
++	kfree(params.per_hw);
+ 
+-	*max_num_different_channels = max(*max_num_different_channels,
+-					  c->num_different_channels);
++	return err < 0 ? err : max_num_different_channels;
+ }
+ 
+-int ieee80211_max_num_channels(struct ieee80211_local *local)
++int ieee80211_max_num_channels(struct ieee80211_local *local,
++			       const struct cfg80211_chan_def *chandef)
+ {
+ 	struct ieee80211_sub_if_data *sdata;
+ 	struct ieee80211_chanctx *ctx;
+@@ -4924,6 +5140,9 @@ int ieee80211_max_num_channels(struct ie
+ 
+ 	lockdep_assert_held(&local->chanctx_mtx);
+ 
++	if (cfg80211_per_hw_iface_comb_advertised(local->hw.wiphy))
++		return ieee80211_max_num_channels_hw_list(local, chandef);
++
+ 	list_for_each_entry(ctx, &local->chanctx_list, list) {
+ 		if (ctx->replace_state == IEEE80211_CHANCTX_WILL_BE_REPLACED)
+ 			continue;
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -594,10 +594,125 @@ use_default_name:
+ }
+ EXPORT_SYMBOL(wiphy_new_nm);
+ 
++static int
++wiphy_verify_comb_limit(struct wiphy *wiphy,
++			const struct ieee80211_iface_limit *limits,
++			u8 n_limits, u32 bcn_int_min_gcd, u32 *iface_cnt,
++			u16 *all_iftypes)
++{
++	int l;
++
++	for (l = 0; l < n_limits; l++) {
++		u16 types = limits[l].types;
++
++		/*
++		 * Don't advertise an unsupported type
++		 * in a combination.
++		 */
++		if (WARN_ON((wiphy->interface_modes & types) != types))
++			return -EINVAL;
++
++		/* interface types shouldn't overlap */
++		if (WARN_ON(types & *all_iftypes))
++			return -EINVAL;
++
++		*all_iftypes |= types;
++
++		/* Shouldn't list software iftypes in combinations! */
++		if (WARN_ON(wiphy->software_iftypes & types))
++			return -EINVAL;
++
++		/* Only a single P2P_DEVICE can be allowed */
++		if (WARN_ON(types & BIT(NL80211_IFTYPE_P2P_DEVICE) &&
++			    limits[l].max > 1))
++			return -EINVAL;
++
++		/* Only a single NAN can be allowed */
++		if (WARN_ON(types & BIT(NL80211_IFTYPE_NAN) &&
++			    limits[l].max > 1))
++			return -EINVAL;
++
++		/*
++		 * This isn't well-defined right now. If you have an
++		 * IBSS interface, then its beacon interval may change
++		 * by joining other networks, and nothing prevents it
++		 * from doing that.
++		 * So technically we probably shouldn't even allow AP
++		 * and IBSS in the same interface, but it seems that
++		 * some drivers support that, possibly only with fixed
++		 * beacon intervals for IBSS.
++		 */
++		if (WARN_ON(types & BIT(NL80211_IFTYPE_ADHOC) &&
++			    bcn_int_min_gcd))
++			return -EINVAL;
++
++		*iface_cnt += limits[l].max;
++	}
++
++	return 0;
++}
++
++static int
++wiphy_verify_comb_per_hw(struct wiphy *wiphy,
++			 const struct ieee80211_iface_combination *comb)
++{
++	int h;
++	u32 hw_idx_bitmap = 0;
++	int ret;
++
++	for (h = 0; h < comb->n_hw_list; h++) {
++		const struct ieee80211_iface_per_hw *hl;
++		const struct ieee80211_chans_per_hw *chans;
++		u32 iface_cnt = 0;
++		u16 all_iftypes = 0;
++
++		hl = &comb->iface_hw_list[h];
++
++		if (hl->hw_chans_idx >= wiphy->num_hw)
++			return -EINVAL;
++
++		if (hw_idx_bitmap & BIT(hl->hw_chans_idx))
++			return -EINVAL;
++
++		hw_idx_bitmap |= BIT(hl->hw_chans_idx);
++		chans = wiphy->hw_chans[hl->hw_chans_idx];
++
++		if (WARN_ON(hl->max_interfaces < 2 && (!comb->radar_detect_widths ||
++		    !(cfg80211_hw_chans_includes_dfs(chans)))))
++			return -EINVAL;
++
++		if (WARN_ON(!hl->num_different_channels))
++			return -EINVAL;
++
++		if (WARN_ON(comb->radar_detect_widths &&
++		    cfg80211_hw_chans_includes_dfs(chans) &&
++		    hl->num_different_channels > 1))
++			return -EINVAL;
++
++		if (WARN_ON(!hl->n_limits))
++			return -EINVAL;
++
++		ret = wiphy_verify_comb_limit(wiphy, hl->limits, hl->n_limits,
++					      comb->beacon_int_min_gcd,
++					      &iface_cnt, &all_iftypes);
++		if (ret)
++			return ret;
++
++		if (WARN_ON(all_iftypes & BIT(NL80211_IFTYPE_WDS)))
++			return -EINVAL;
++
++		if (WARN_ON(iface_cnt < comb->max_interfaces))
++			return -EINVAL;
++	}
++
++	return 0;
++}
++
+ static int wiphy_verify_combinations(struct wiphy *wiphy)
+ {
+ 	const struct ieee80211_iface_combination *c;
+-	int i, j;
++	int i;
++	int ret;
+ 
+ 	for (i = 0; i < wiphy->n_iface_combinations; i++) {
+ 		u32 cnt = 0;
+@@ -624,39 +739,11 @@ static int wiphy_verify_combinations(str
+ 		if (WARN_ON(!c->n_limits))
+ 			return -EINVAL;
+ 
+-		for (j = 0; j < c->n_limits; j++) {
+-			u16 types = c->limits[j].types;
+-
+-			/* interface types shouldn't overlap */
+-			if (WARN_ON(types & all_iftypes))
+-				return -EINVAL;
+-			all_iftypes |= types;
+-
+-			if (WARN_ON(!c->limits[j].max))
+-				return -EINVAL;
+-
+-			/* Shouldn't list software iftypes in combinations! */
+-			if (WARN_ON(wiphy->software_iftypes & types))
+-				return -EINVAL;
+-
+-			/* Only a single P2P_DEVICE can be allowed */
+-			if (WARN_ON(types & BIT(NL80211_IFTYPE_P2P_DEVICE) &&
+-				    c->limits[j].max > 1))
+-				return -EINVAL;
+-
+-			/* Only a single NAN can be allowed */
+-			if (WARN_ON(types & BIT(NL80211_IFTYPE_NAN) &&
+-				    c->limits[j].max > 1))
+-				return -EINVAL;
+-
+-			cnt += c->limits[j].max;
+-			/*
+-			 * Don't advertise an unsupported type
+-			 * in a combination.
+-			 */
+-			if (WARN_ON((wiphy->interface_modes & types) != types))
+-				return -EINVAL;
+-		}
++                ret = wiphy_verify_comb_limit(wiphy, c->limits, c->n_limits,
++                                              c->beacon_int_min_gcd,
++                                              &cnt, &all_iftypes);
++                if (ret)
++                        return ret;
+ 
+ 		if (WARN_ON(all_iftypes & BIT(NL80211_IFTYPE_WDS)))
+ 			return -EINVAL;
+@@ -664,11 +751,119 @@ static int wiphy_verify_combinations(str
+ 		/* You can't even choose that many! */
+ 		if (WARN_ON(cnt < c->max_interfaces))
+ 			return -EINVAL;
++                /*
++                 * Do similar validations on the freq range specific interface
++                 * combinations when advertised.
++                 */
++                if (WARN_ON(c->n_hw_list &&
++                            wiphy_verify_comb_per_hw(wiphy, c)))
++                        return -EINVAL;
+ 	}
+ 
+ 	return 0;
+ }
+ 
++static int cfg80211_check_hw_chans(const struct ieee80211_chans_per_hw *chans1,
++                                   const struct ieee80211_chans_per_hw *chans2)
++{
++        int i, j;
++
++        if (!chans1 || !chans2)
++                return -EINVAL;
++
++        if (!chans1->n_chans || !chans2->n_chans)
++                return -EINVAL;
++
++        /* for now same channel is not allowed in more than one sub-hw */
++        for (i = 0; i < chans1->n_chans; i++)
++                for (j = 0; j < chans2->n_chans; j++)
++                        if (chans1->chans[i].center_freq ==
++                            chans2->chans[j].center_freq)
++                                return -EINVAL;
++        return 0;
++}
++
++static bool
++cfg80211_hw_chans_in_supported_list(struct wiphy *wiphy,
++                                    const struct ieee80211_chans_per_hw *chans)
++{
++        enum nl80211_band band;
++        struct ieee80211_supported_band *sband;
++        bool found;
++        int i, j;
++
++        for (i = 0; i < chans->n_chans; i++) {
++                found = false;
++                for (band = 0; band < NUM_NL80211_BANDS; band++) {
++                        sband = wiphy->bands[band];
++                        if (!sband)
++                                continue;
++                        for (j = 0; j < sband->n_channels; j++) {
++                                if (chans->chans[i].center_freq ==
++                                    sband->channels[j].center_freq) {
++                                        found = true;
++                                        break;
++                                }
++                        }
++
++                        if (found)
++                                break;
++                }
++
++                if (!found)
++                        return false;
++        }
++
++        return true;
++}
++
++static int cfg80211_validate_per_hw_chans(struct wiphy *wiphy)
++{
++        int i, j;
++        int ret;
++
++        if (!wiphy->num_hw)
++                return 0;
++
++        if (!wiphy->hw_chans)
++                return -EINVAL;
++
++        /*
++         * to advertise channel list for one hw, sband alone should
++         * be sufficient
++         */
++        if (wiphy->num_hw < 2)
++                return -EINVAL;
++
++        for (i = 0; i < wiphy->num_hw; i++) {
++                for (j = 0; j < wiphy->num_hw; j++) {
++                        const struct ieee80211_chans_per_hw *hw_chans1;
++                        const struct ieee80211_chans_per_hw *hw_chans2;
++
++                        if (i == j)
++                                continue;
++
++                        hw_chans1 = wiphy->hw_chans[i];
++                        hw_chans2 = wiphy->hw_chans[j];
++                        ret = cfg80211_check_hw_chans(hw_chans1, hw_chans2);
++                        if (ret)
++                                return ret;
++                }
++        }
++
++        for (i = 0; i < wiphy->num_hw; i++) {
++                const struct ieee80211_chans_per_hw *hw_chans;
++
++                hw_chans = wiphy->hw_chans[i];
++                if (!cfg80211_hw_chans_in_supported_list(wiphy, hw_chans)) {
++                        WARN_ON(1);
++                        return -EINVAL;
++                }
++        }
++
++        return 0;
++}
++
+ int wiphy_register(struct wiphy *wiphy)
+ {
+ 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
+@@ -905,6 +1100,11 @@ int wiphy_register(struct wiphy *wiphy)
+ 		WARN_ON(1);
+ 		return -EINVAL;
+ 	}
++
++	if (cfg80211_validate_per_hw_chans(&rdev->wiphy)) {
++		WARN_ON(1);
++		return -EINVAL;
++	}
+ 
+ 	for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
+ 		/*
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -2204,19 +2204,271 @@ int cfg80211_validate_beacon_int(struct
+ 	return 0;
+ }
+ 
++static const struct ieee80211_iface_per_hw *
++cfg80211_get_hw_iface_comb_by_idx(struct wiphy *wiphy,
++				  const struct ieee80211_iface_combination *c,
++				  int idx)
++{
++	int i;
++
++	for (i = 0; i < c->n_hw_list; i++)
++		if (c->iface_hw_list[i].hw_chans_idx == idx)
++			break;
++
++	if (i == c->n_hw_list)
++		return NULL;
++
++	return &c->iface_hw_list[i];
++}
++
++static int
++cfg80211_validate_per_hw_iface_comb_limits(struct wiphy *wiphy,
++				    struct iface_combination_params *params,
++				    const struct ieee80211_iface_combination *c,
++				    int *num_per_hw_ifaces, u32 *all_iftypes)
++{
++	struct ieee80211_iface_limit **limits;
++	const struct ieee80211_iface_per_hw *per_hw_comb;
++	int iftype_num[NUM_NL80211_IFTYPES] = { 0 };
++	int *n_limits;
++	int ret = 0;
++	int i, j, iftype;
++
++	limits = kzalloc(sizeof(*limits) * wiphy->num_hw, GFP_KERNEL);
++	if (!limits)
++		return -ENOMEM;
++
++	n_limits = kzalloc(sizeof(*n_limits) * wiphy->num_hw, GFP_KERNEL);
++	if (!n_limits) {
++		kfree(limits);
++		return -ENOMEM;
++	}
++
++	for (i = 0; i < wiphy->num_hw; i++) {
++		per_hw_comb = cfg80211_get_hw_iface_comb_by_idx(wiphy, c, i);
++		if (!per_hw_comb) {
++			ret = -EINVAL;
++			goto out_free;
++		}
++
++		limits[i] = kmemdup(per_hw_comb->limits,
++				    per_hw_comb->n_limits *
++				    sizeof(limits[i][0]), GFP_KERNEL);
++		if (!limits[i]) {
++			ret = -ENOMEM;
++			goto out_free;
++		}
++
++		n_limits[i] = per_hw_comb->n_limits;
++	}
++
++	for (i = 0; i < wiphy->num_hw; i++) {
++		per_hw_comb = cfg80211_get_hw_iface_comb_by_idx(wiphy, c, i);
++		if (!per_hw_comb) {
++			ret = -EINVAL;
++			goto out_free;
++		}
++
++		if (num_per_hw_ifaces[i] > per_hw_comb->max_interfaces) {
++			ret = -EINVAL;
++			goto out_free;
++		}
++
++		if (params->per_hw[i].num_different_channels >
++		    per_hw_comb->num_different_channels) {
++			ret = -EINVAL;
++			goto out_free;
++		}
++
++		for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
++			if (cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
++				continue;
++			for (j = 0; j < n_limits[i]; j++) {
++				*all_iftypes |= limits[i][j].types;
++				if (!(limits[i][j].types & BIT(iftype)))
++					continue;
++				if (limits[i][j].max <
++				    params->per_hw[i].iftype_num[iftype]) {
++					ret = -EINVAL;
++					goto out_free;
++				}
++
++				limits[i][j].max -=
++					params->per_hw[i].iftype_num[iftype];
++			}
++		}
++	}
++
++	memcpy(iftype_num, params->iftype_num, NUM_NL80211_IFTYPES);
++	for (i = 0; i < wiphy->num_hw; i++) {
++		u16 rem_iface;
++		per_hw_comb = cfg80211_get_hw_iface_comb_by_idx(wiphy, c, i);
++		if (!per_hw_comb) {
++			ret = -EINVAL;
++			goto out_free;
++		}
++
++		/*
++		 * we'll not be here in the first place if the numbre of per-hw
++		 * interfaces are more than the advertised ones. So it is safe
++		 * to ignore that error case here.
++		 */
++		rem_iface = per_hw_comb->max_interfaces - num_per_hw_ifaces[i];
++		if (!rem_iface)
++			continue;
++
++		/*
++		 * check if the interfaces which are not yet assigned the
++		 * operating channel can be accommodated with all the available
++		 * per-hw interface combination advertisements.
++		 */
++		for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
++			if (cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
++				continue;
++			if (!rem_iface)
++				break;
++			for (j = 0; j < n_limits[i]; j++) {
++				u16 num_avail;
++				if (!(limits[i][j].types & BIT(iftype)))
++					continue;
++				if (!rem_iface)
++					break;
++				num_avail = min(rem_iface, limits[i][j].max);
++				if (num_avail < iftype_num[iftype]) {
++					iftype_num[iftype] -= num_avail;
++					rem_iface -= num_avail;
++				} else {
++					rem_iface -= iftype_num[iftype];
++					iftype_num[iftype] = 0;
++				}
++			}
++		}
++	}
++
++	for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
++		if (iftype_num[iftype]) {
++			ret = -EINVAL;
++			goto out_free;
++		}
++	}
++
++out_free:
++	for (i = 0; i < wiphy->num_hw; i++)
++		kfree(limits[i]);
++
++	kfree(n_limits);
++	kfree(limits);
++
++	return ret;
++}
++
++static int
++cfg80211_validate_iface_comb_limits(struct wiphy *wiphy,
++				    struct iface_combination_params *params,
++				    const struct ieee80211_iface_combination *c,
++				    int num_interfaces, u32 *all_iftypes)
++{
++	struct ieee80211_iface_limit *limits;
++	int j, iftype;
++	int ret = 0;
++
++	if (num_interfaces > c->max_interfaces)
++		return -EINVAL;
++	if (params->num_different_channels > c->num_different_channels)
++		return -EINVAL;
++
++	limits = kmemdup(c->limits, sizeof(limits[0]) * c->n_limits,
++			GFP_KERNEL);
++	if (!limits)
++		return -ENOMEM;
++
++	for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
++		if (cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
++			continue;
++		for (j = 0; j < c->n_limits; j++) {
++			*all_iftypes |= limits[j].types;
++			if (!(limits[j].types & BIT(iftype)))
++				continue;
++			if (limits[j].max < params->iftype_num[iftype]) {
++				ret = -EINVAL;
++				goto out_free;
++			}
++			limits[j].max -= params->iftype_num[iftype];
++		}
++	}
++out_free:
++	kfree(limits);
++	return ret;
++}
++
++bool cfg80211_per_hw_iface_comb_advertised(struct wiphy *wiphy)
++{
++	int i;
++
++	for (i = 0; i < wiphy->n_iface_combinations; i++) {
++		const struct ieee80211_iface_combination *c;
++		c = &wiphy->iface_combinations[i];
++		if (c->n_hw_list)
++			return true;
++	}
++
++	return false;
++}
++EXPORT_SYMBOL(cfg80211_per_hw_iface_comb_advertised);
++
++static bool
++cfg80211_chan_supported_by_sub_hw(struct ieee80211_chans_per_hw *hw_chans,
++				  const struct cfg80211_chan_def *chandef)
++{
++	int i;
++
++	for (i = 0; i < hw_chans->n_chans; i++)
++		if (chandef->chan->center_freq ==
++		    hw_chans->chans[i].center_freq)
++			return true;
++
++	return false;
++}
++
++int
++cfg80211_get_hw_idx_by_chan(struct wiphy *wiphy,
++			    const struct cfg80211_chan_def *chandef)
++{
++	int i;
++
++	if (!chandef)
++		return -1;
++
++	if (!cfg80211_chandef_valid(chandef))
++		return -1;
++
++	for (i = 0; i < wiphy->num_hw; i++) {
++		if (cfg80211_chan_supported_by_sub_hw(wiphy->hw_chans[i],
++						      chandef))
++			return i;
++	}
++
++	return -1;
++}
++EXPORT_SYMBOL(cfg80211_get_hw_idx_by_chan);
++
+ int cfg80211_iter_combinations(struct wiphy *wiphy,
+ 			       struct iface_combination_params *params,
+ 			       void (*iter)(const struct ieee80211_iface_combination *c,
+-					    void *data),
++					    void *data, int hw_chan_idx),
+ 			       void *data)
+ {
+ 	const struct ieee80211_regdomain *regdom;
+ 	enum nl80211_dfs_regions region = 0;
+-	int i, j, iftype;
++	int i, iftype;
+ 	int num_interfaces = 0;
++	int *num_per_hw_ifaces = NULL;
+ 	u32 used_iftypes = 0;
+ 	u32 beacon_int_gcd;
+ 	bool beacon_int_different;
++	bool per_hw_iface_comb_used;
++	int hw_chan_idx = -1;
++	int ret = 0;
+ 
+ 	/*
+ 	 * This is a bit strange, since the iteration used to rely only on
+@@ -2239,50 +2491,66 @@ int cfg80211_iter_combinations(struct wi
+ 		rcu_read_unlock();
+ 	}
+ 
++	per_hw_iface_comb_used = cfg80211_per_hw_iface_comb_advertised(wiphy);
++	if (per_hw_iface_comb_used) {
++		num_per_hw_ifaces = kzalloc(sizeof(*num_per_hw_ifaces) *
++					    wiphy->num_hw, GFP_KERNEL);
++		if (!num_per_hw_ifaces)
++			return -ENOMEM;
++
++		hw_chan_idx = cfg80211_get_hw_idx_by_chan(wiphy,
++							  params->chandef);
++	}
++
+ 	for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
+ 		num_interfaces += params->iftype_num[iftype];
+ 		if (params->iftype_num[iftype] > 0 &&
+ 		    !cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
+ 			used_iftypes |= BIT(iftype);
++
++		if (!per_hw_iface_comb_used)
++			continue;
++
++		/* account per_hw interfaces, if advertised */
++		for (i = 0; i < wiphy->num_hw; i++) {
++			struct iface_comb_per_hw_params *per_hw;
++			per_hw  = &params->per_hw[i];
++			num_per_hw_ifaces[i] += per_hw->iftype_num[iftype];
++			if (per_hw->iftype_num[iftype] > 0 &&
++			    !cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
++				used_iftypes |= BIT(iftype);
++		}
+ 	}
+ 
+ 	for (i = 0; i < wiphy->n_iface_combinations; i++) {
+ 		const struct ieee80211_iface_combination *c;
+-		struct ieee80211_iface_limit *limits;
+ 		u32 all_iftypes = 0;
+ 
+ 		c = &wiphy->iface_combinations[i];
+ 
+-		if (num_interfaces > c->max_interfaces)
+-			continue;
+-		if (params->num_different_channels > c->num_different_channels)
+-			continue;
++		if (per_hw_iface_comb_used)
++			ret = cfg80211_validate_per_hw_iface_comb_limits(wiphy,
++								params, c,
++								num_per_hw_ifaces,
++								&all_iftypes);
++		else
++			ret = cfg80211_validate_iface_comb_limits(wiphy, params,
++								  c,
++								  num_interfaces,
++								  &all_iftypes);
++		if (ret == -ENOMEM)
++			goto out_free;
+ 
+-		limits = kmemdup(c->limits, sizeof(limits[0]) * c->n_limits,
+-				 GFP_KERNEL);
+-		if (!limits)
+-			return -ENOMEM;
+-
+-		for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
+-			if (cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
+-				continue;
+-			for (j = 0; j < c->n_limits; j++) {
+-				all_iftypes |= limits[j].types;
+-				if (!(limits[j].types & BIT(iftype)))
+-					continue;
+-				if (limits[j].max < params->iftype_num[iftype])
+-					goto cont;
+-				limits[j].max -= params->iftype_num[iftype];
+-			}
+-		}
++		if (ret)
++			continue;
+ 
+ 		if (params->radar_detect !=
+-			(c->radar_detect_widths & params->radar_detect))
+-			goto cont;
++		    (c->radar_detect_widths & params->radar_detect))
++			continue;
+ 
+ 		if (params->radar_detect && c->radar_detect_regions &&
+ 		    !(c->radar_detect_regions & BIT(region)))
+-			goto cont;
++			continue;
+ 
+ 		/* Finally check that all iftypes that we're currently
+ 		 * using are actually part of this combination. If they
+@@ -2290,32 +2558,32 @@ int cfg80211_iter_combinations(struct wi
+ 		 * to continue to the next.
+ 		 */
+ 		if ((all_iftypes & used_iftypes) != used_iftypes)
+-			goto cont;
++			continue;
+ 
+ 		if (beacon_int_gcd) {
+ 			if (c->beacon_int_min_gcd &&
+ 			    beacon_int_gcd < c->beacon_int_min_gcd)
+-				goto cont;
++				continue;
+ 			if (!c->beacon_int_min_gcd && beacon_int_different)
+-				goto cont;
++				continue;
+ 		}
+ 
+ 		/* This combination covered all interface types and
+ 		 * supported the requested numbers, so we're good.
+ 		 */
+ 
+-		(*iter)(c, data);
+- cont:
+-		kfree(limits);
++		(*iter)(c, data, hw_chan_idx);
+ 	}
+ 
+-	return 0;
++out_free:
++	kfree(num_per_hw_ifaces);
++	return ret;
+ }
+ EXPORT_SYMBOL(cfg80211_iter_combinations);
+ 
+ static void
+ cfg80211_iter_sum_ifcombs(const struct ieee80211_iface_combination *c,
+-			  void *data)
++			  void *data, int hw_chan_idx)
+ {
+ 	int *num = data;
+ 	(*num)++;
+@@ -2709,3 +2977,21 @@ cfg80211_get_iftype_ext_capa(struct wiph
+ 	return NULL;
+ }
+ EXPORT_SYMBOL(cfg80211_get_iftype_ext_capa);
++
++bool
++cfg80211_hw_chans_includes_dfs(const struct ieee80211_chans_per_hw *chans)
++{
++	int i;
++
++	for (i = 0; i < chans->n_chans; i++) {
++		if (chans->chans[i].band == NL80211_BAND_5GHZ &&
++		    ((chans->chans[i].center_freq >= 5250 &&
++		     chans->chans[i].center_freq <= 5340) ||
++		    (chans->chans[i].center_freq >= 5480 &&
++		     chans->chans[i].center_freq <= 5720)))
++			return true;
++	}
++
++	return false;
++}
++EXPORT_SYMBOL(cfg80211_hw_chans_includes_dfs);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/829-mac80211-fix-mesh-ping-issue.patch b/package/kernel/mac80211/patches/ath11k_nss/829-mac80211-fix-mesh-ping-issue.patch
new file mode 100644
index 00000000000000..7043ecb079061a
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/829-mac80211-fix-mesh-ping-issue.patch
@@ -0,0 +1,113 @@
+From a76238143218ea348cec4b5d26fe9411338ae09e Mon Sep 17 00:00:00 2001
+From: Aaradhana Sahu <quic_aarasahu@quicinc.com>
+Date: Fri, 6 Oct 2023 18:19:53 +0530
+Subject: [PATCH] mac80211: fix mesh ping issue
+
+Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
+---
+ net/mac80211/rx.c | 68 +++--------------------------------------------
+ 1 file changed, 4 insertions(+), 64 deletions(-)
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -4748,16 +4748,14 @@ void ieee80211_check_fast_rx(struct sta_
+ 
+ 		break;
+ 	case NL80211_IFTYPE_MESH_POINT:
+-		/* Not required for NSS mode */
+-		if (ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD))
+-			goto clear;
+ 		/* Note: da and sa offs are not static, determine in fast rx path */
+ 
+ 		fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_FROMDS |
+ 						      IEEE80211_FCTL_TODS);
+-
+-		fastrx.internal_forward = 0;
+-		break;
++		fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
++		fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
++		break; 
++		
+ 	default:
+ 		goto clear;
+ 	}
+@@ -4980,10 +4978,7 @@ static bool ieee80211_invoke_fast_rx(str
+ 		u8 sa[ETH_ALEN];
+ 	} addrs __aligned(2);
+ 	struct ieee80211_sta_rx_stats *stats;
+-	struct ieee80211s_hdr *mesh_hdr;
+-	struct mesh_path *mppath;
+ 	u8 da_offs = fast_rx->da_offs, sa_offs = fast_rx->sa_offs;
+-	struct ieee80211_sub_if_data *sdata = rx->sdata;
+ 
+ 	/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
+ 	 * to a common data structure; drivers can implement that per queue
+@@ -5033,37 +5028,6 @@ static bool ieee80211_invoke_fast_rx(str
+ 		snap_offs += IEEE80211_CCMP_HDR_LEN;
+ 	}
+ 
+-	/* Find corresponding offsets for mesh hdr */
+-	if (ieee80211_vif_is_mesh(&sdata->vif)) {
+-		if (status->rx_flags & IEEE80211_RX_AMSDU)
+-			return false;
+-
+-		/* All mesh data frames needs to be QoS Data */
+-		if (unlikely(!ieee80211_is_data_qos(hdr->frame_control)))
+-			return false;
+-
+-		/* TODO forwarding not handled yet in fast rx */
+-		if (!ether_addr_equal(fast_rx->vif_addr, hdr->addr3))
+-			return false;
+-
+-		/* Check if Min Mesh hdr is present */
+-		if (!pskb_may_pull(skb, hdrlen + 6))
+-			goto drop;
+-
+-		/* Goto mesh hdr, located at snap offs compared to AP/STA */
+-		mesh_hdr = (struct ieee80211s_hdr *) (skb->data + snap_offs);
+-
+-		/* Only Ext Mesh hdr supported in this path now */
+-		if ((mesh_hdr->flags & MESH_FLAGS_AE) != MESH_FLAGS_AE_A5_A6)
+-			return false;
+-
+-		/* Point to eaddr1 and eaddr2 */
+-		da_offs = snap_offs + ETH_ALEN;
+-		sa_offs = da_offs + ETH_ALEN;
+-
+-		snap_offs += sizeof(struct ieee80211s_hdr);
+-	}
+-
+ 	if (!ieee80211_vif_is_mesh(&rx->sdata->vif) &&
+ 	    !(status->rx_flags & IEEE80211_RX_AMSDU)) {
+ 		if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
+@@ -5101,30 +5065,6 @@ static bool ieee80211_invoke_fast_rx(str
+ 		return true;
+ 	}
+ 
+-	/* Update MPP table for the received packet */
+-	if (ieee80211_vif_is_mesh(&sdata->vif)) {
+-		char *proxied_addr, *mpp_addr;
+-
+-		mpp_addr = hdr->addr4;
+-		proxied_addr = mesh_hdr->eaddr2;
+-
+-		/* Update mpp for the SA */
+-		rcu_read_lock();
+-		mppath = mpp_path_lookup(sdata, proxied_addr);
+-		if (!mppath) {
+-			mpp_path_add(sdata, proxied_addr, mpp_addr);
+-		} else {
+-			spin_lock_bh(&mppath->state_lock);
+-
+-			if (!ether_addr_equal(mppath->mpp, mpp_addr))
+-				ether_addr_copy(mppath->mpp, mpp_addr);
+-
+-			mppath->exp_time = jiffies;
+-			spin_unlock_bh(&mppath->state_lock);
+-		}
+-		rcu_read_unlock();
+-	}
+-
+ 	/* do the header conversion - first grab the addresses */
+ 	ether_addr_copy(addrs.da, skb->data + da_offs);
+ 	ether_addr_copy(addrs.sa, skb->data + sa_offs);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/902-022-ath11k-add-ap-ps-support.patch b/package/kernel/mac80211/patches/ath11k_nss/902-022-ath11k-add-ap-ps-support.patch
new file mode 100644
index 00000000000000..52037816a113b1
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/902-022-ath11k-add-ap-ps-support.patch
@@ -0,0 +1,324 @@
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -30,6 +30,7 @@
+ #include "spectral.h"
+ #include "wow.h"
+ #include "nss.h"
++#include "vendor.h"
+ 
+ #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
+ 
+@@ -637,6 +638,11 @@ struct ath11k_coex_info {
+ 	u32 pta_priority;
+ };
+ 
++enum ath11k_ap_ps_state {
++	ATH11K_AP_PS_STATE_OFF,
++	ATH11K_AP_PS_STATE_ON,
++};
++
+ struct ath11k {
+ 	struct ath11k_base *ab;
+ 	struct ath11k_pdev *pdev;
+@@ -765,6 +771,8 @@ struct ath11k {
+ 	int monitor_vdev_id;
+ 	struct completion fw_mode_reset;
+ 	u8 ftm_msgref;
++	int ap_ps_enabled;
++	enum ath11k_ap_ps_state ap_ps_state;
+ #ifdef CPTCFG_ATH11K_DEBUGFS
+ 	struct ath11k_debug debug;
+ #endif
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -4963,6 +4963,33 @@ static void ath11k_mac_dec_num_stations(
+ 	ar->num_stations--;
+ }
+ 
++int ath11k_mac_ap_ps_recalc(struct ath11k *ar)
++{
++	struct ath11k_vif *arvif;
++	bool has_sta_iface = false;
++	enum ath11k_ap_ps_state state = ATH11K_AP_PS_STATE_OFF;
++	int ret = 0;
++
++	list_for_each_entry(arvif, &ar->arvifs, list) {
++		if (arvif->vdev_type == WMI_VDEV_TYPE_STA) {
++			has_sta_iface = true;
++			break;
++		}
++	}
++
++	if (!has_sta_iface && !ar->num_stations && ar->ap_ps_enabled)
++		state = ATH11K_AP_PS_STATE_ON;
++
++	if (ar->ap_ps_state == state)
++		return ret;
++
++	ret = ath11k_wmi_pdev_ap_ps_cmd_send(ar, ar->pdev->pdev_id, state);
++	if (!ret)
++		ar->ap_ps_state = state;
++
++	return ret;
++}
++
+ static int ath11k_mac_station_add(struct ath11k *ar,
+ 				  struct ieee80211_vif *vif,
+ 				  struct ieee80211_sta *sta)
+@@ -5002,6 +5029,12 @@ static int ath11k_mac_station_add(struct
+ 	ath11k_dbg(ab, ATH11K_DBG_MAC, "Added peer: %pM for VDEV: %d\n",
+ 		   sta->addr, arvif->vdev_id);
+ 
++	ret = ath11k_mac_ap_ps_recalc(ar);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to send ap ps ret %d\n", ret);
++		goto exit;
++	}
++
+ 	if (ath11k_debugfs_is_extd_tx_stats_enabled(ar)) {
+ 		arsta->tx_stats = kzalloc(sizeof(*arsta->tx_stats), GFP_KERNEL);
+ 		if (!arsta->tx_stats) {
+@@ -5158,6 +5191,9 @@ static int ath11k_mac_op_sta_state(struc
+ 
+ 		kfree(arsta->tx_stats);
+ 		arsta->tx_stats = NULL;
++		ret = ath11k_mac_ap_ps_recalc(ar);
++		if (ret)
++			ath11k_warn(ar->ab, "failed to send ap ps ret %d\n", ret);
+ 
+ 		kfree(arsta->rx_stats);
+ 		arsta->rx_stats = NULL;
+@@ -6566,6 +6602,7 @@ static void ath11k_mac_op_stop(struct ie
+ 
+ 	clear_bit(ATH11K_CAC_RUNNING, &ar->dev_flags);
+ 	ar->state = ATH11K_STATE_OFF;
++	ar->ap_ps_state = ATH11K_AP_PS_STATE_OFF;
+ 	mutex_unlock(&ar->conf_mutex);
+ 
+ 	cancel_delayed_work_sync(&ar->scan.timeout);
+@@ -6973,7 +7010,6 @@ static int ath11k_mac_op_add_interface(s
+ 			    arvif->vdev_id, ret);
+ 		goto err;
+ 	}
+-
+ 	ar->num_created_vdevs++;
+ 	ath11k_dbg(ab, ATH11K_DBG_MAC, "vdev %pM created, vdev_id %d\n",
+ 		   vif->addr, arvif->vdev_id);
+@@ -7120,6 +7156,10 @@ static int ath11k_mac_op_add_interface(s
+ 				    ret);
+ 	}
+ 
++	ret = ath11k_mac_ap_ps_recalc(ar);
++	if (ret)
++		ath11k_warn(ar->ab, "failed to set ap ps ret %d\n", ret);
++
+ 	mutex_unlock(&ar->conf_mutex);
+ 
+ 	return 0;
+@@ -7227,6 +7267,7 @@ err_vdev_del:
+ 
+ 	/* Recalc txpower for remaining vdev */
+ 	ath11k_mac_txpower_recalc(ar);
++	ath11k_mac_ap_ps_recalc(ar);
+ 
+ 	ath11k_debugfs_remove_interface(arvif);
+ 
+--- a/drivers/net/wireless/ath/ath11k/mac.h
++++ b/drivers/net/wireless/ath/ath11k/mac.h
+@@ -135,6 +135,7 @@ void ath11k_mac_11d_scan_start(struct at
+ void ath11k_mac_11d_scan_stop(struct ath11k *ar);
+ void ath11k_mac_11d_scan_stop_all(struct ath11k_base *ab);
+ 
++int ath11k_mac_ap_ps_recalc(struct ath11k *ar);
+ void ath11k_mac_destroy(struct ath11k_base *ab);
+ void ath11k_mac_unregister(struct ath11k_base *ab);
+ int ath11k_mac_register(struct ath11k_base *ab);
+--- a/drivers/net/wireless/ath/ath11k/vendor.c
++++ b/drivers/net/wireless/ath/ath11k/vendor.c
+@@ -6,7 +6,6 @@
+ #include <net/netlink.h>
+ #include <net/mac80211.h>
+ #include "core.h"
+-#include "vendor.h"
+ #include "debug.h"
+ 
+ static const struct nla_policy
+@@ -21,6 +20,11 @@ ath11k_vendor_wlan_prio_policy[QCA_WLAN_
+ 	[QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_WEIGHT] = { .type = NLA_U8 },
+ };
+ 
++static const struct nla_policy
++ath11k_vendor_set_wifi_config_policy[QCA_WLAN_VENDOR_ATTR_CONFIG_MAX + 1] = {
++	[QCA_WLAN_VENDOR_ATTR_CONFIG_GTX] = {.type = NLA_FLAG}
++};
++
+ static int ath11k_vendor_btcoex_configure(struct wiphy *wiphy,
+ 					  struct wireless_dev *wdev,
+ 					  const void *data,
+@@ -101,6 +105,51 @@ out:
+ 	return ret;
+ }
+ 
++static int ath11k_vendor_set_wifi_config(struct wiphy *wihpy,
++					 struct wireless_dev *wdev,
++					 const void *data,
++					 int data_len)
++{
++	struct ieee80211_vif *vif;
++	struct ath11k_vif *arvif;
++	struct ath11k *ar;
++	struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_CONFIG_MAX + 1];
++	int ret = 0;
++
++	if (!wdev)
++		return -EINVAL;
++
++	vif = wdev_to_ieee80211_vif(wdev);
++	if (!vif)
++		return -EINVAL;
++
++	arvif = (struct ath11k_vif*)vif->drv_priv;
++	if (!arvif)
++		return -EINVAL;
++
++	ar = arvif->ar;
++
++	mutex_lock(&ar->conf_mutex);
++
++	ret = nla_parse(tb, QCA_WLAN_VENDOR_ATTR_CONFIG_MAX, data, data_len,
++			ath11k_vendor_set_wifi_config_policy, NULL);
++	if (ret) {
++		ath11k_warn(ar->ab, "invalid set wifi config policy attribute\n");
++		goto exit;
++	}
++
++	ar->ap_ps_enabled = nla_get_flag(tb[QCA_WLAN_VENDOR_ATTR_CONFIG_GTX]);
++	ret = ath11k_mac_ap_ps_recalc(ar);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to send ap ps ret %d\n", ret);
++		goto exit;
++	}
++
++exit:
++	mutex_unlock(&ar->conf_mutex);
++	return ret;
++}
++
+ static struct wiphy_vendor_command ath11k_vendor_commands[] = {
+ 	{
+ 		.info.vendor_id = QCA_NL80211_VENDOR_ID,
+@@ -108,8 +157,18 @@ static struct wiphy_vendor_command ath11
+ 		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+ 			WIPHY_VENDOR_CMD_NEED_RUNNING,
+ 		.doit = ath11k_vendor_btcoex_configure,
+-		.policy = ath11k_vendor_btcoex_config_policy
+-	}
++		.policy = ath11k_vendor_btcoex_config_policy,
++		.maxattr = QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_MAX
++	},
++	{
++		.info.vendor_id = QCA_NL80211_VENDOR_ID,
++		.info.subcmd = QCA_NL80211_VENDOR_SUBCMD_SET_WIFI_CONFIGURATION,
++		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
++			WIPHY_VENDOR_CMD_NEED_RUNNING,
++		.doit = ath11k_vendor_set_wifi_config,
++		.policy = ath11k_vendor_set_wifi_config_policy,
++		.maxattr = QCA_WLAN_VENDOR_ATTR_CONFIG_MAX
++	},
+ };
+ 
+ int ath11k_vendor_register(struct ath11k *ar)
+--- a/drivers/net/wireless/ath/ath11k/vendor.h
++++ b/drivers/net/wireless/ath/ath11k/vendor.h
+@@ -9,6 +9,9 @@
+ #define QCA_NL80211_VENDOR_ID 0x001374
+ 
+ enum qca_nl80211_vendor_subcmds {
++	/* Wi-Fi configuration subcommand */
++	QCA_NL80211_VENDOR_SUBCMD_SET_WIFI_CONFIGURATION = 74,
++
+ 	/* QCA_NL80211_VENDOR_SUBCMD_BTCOEX_CONFIG: This command is used to
+ 	 * enable/disable BTCOEX and set priority for different type of WLAN
+ 	 * traffic over BT low priority traffic. This uses attributes in
+@@ -58,7 +61,17 @@ enum qca_wlan_vendor_attr_wlan_prio {
+                QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_LAST - 1,
+ };
+ 
++/* Attributes for data used by
++ * QCA_NL80211_VENDOR_SUBCMD_SET_WIFI_CONFIGURATION
++ */
++enum qca_wlan_vendor_attr_config {
++	QCA_WLAN_VENDOR_ATTR_CONFIG_GTX = 57,
+ 
++	/* keep last */
++	QCA_WLAN_VENDOR_ATTR_CONFIG_AFTER_LAST,
++	QCA_WLAN_VENDOR_ATTR_CONFIG_MAX =
++		QCA_WLAN_VENDOR_ATTR_CONFIG_AFTER_LAST - 1,
++};
+ 
+ /**
+  * enum qca_wlan_vendor_attr_btcoex_config - Used by the vendor command
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -1446,6 +1446,38 @@ ath11k_wmi_rx_reord_queue_remove(struct
+ 	return ret;
+ }
+ 
++int ath11k_wmi_pdev_ap_ps_cmd_send(struct ath11k *ar, u8 pdev_id,
++				   u32 param_value)
++{
++	struct ath11k_pdev_wmi *wmi = ar->wmi;
++	struct wmi_pdev_ap_ps_cmd *cmd;
++	struct sk_buff *skb;
++	int ret;
++
++	skb = ath11k_wmi_alloc_skb(wmi->wmi_ab, sizeof(*cmd));
++	if (!skb)
++		return -ENOMEM;
++
++	cmd = (struct wmi_pdev_ap_ps_cmd *)skb->data;
++	cmd->tlv_header = FIELD_PREP(WMI_TLV_TAG,
++				     WMI_TAG_PDEV_GREEN_AP_PS_ENABLE_CMD) |
++			  FIELD_PREP(WMI_TLV_LEN, sizeof(*cmd) - TLV_HDR_SIZE);
++	cmd->pdev_id = pdev_id;
++	cmd->param_value = param_value;
++
++	ret = ath11k_wmi_cmd_send(wmi, skb, WMI_PDEV_GREEN_AP_PS_ENABLE_CMDID);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to send ap ps enable/disable cmd\n");
++		dev_kfree_skb(skb);
++	}
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_WMI,
++		   "wmi pdev ap ps set pdev id %d value %d\n",
++		   pdev_id, param_value);
++
++	return ret;
++}
++
+ int ath11k_wmi_pdev_set_param(struct ath11k *ar, u32 param_id,
+ 			      u32 param_value, u8 pdev_id)
+ {
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -3110,6 +3110,12 @@ struct set_fwtest_params {
+ 	u32 value;
+ };
+ 
++struct wmi_pdev_ap_ps_cmd {
++	u32 tlv_header;
++	u32 pdev_id;
++	u32 param_value;
++} __packed;
++
+ struct wmi_fwtest_set_param_cmd_param {
+ 	u32 tlv_header;
+ 	u32 param_id;
+@@ -6628,6 +6634,7 @@ int ath11k_wmi_pdev_non_srg_obss_bssid_e
+ 						     u32 *bitmap);
+ int ath11k_send_coex_config_cmd(struct ath11k *ar,
+ 			       struct coex_config_arg *coex_config);
++int ath11k_wmi_pdev_ap_ps_cmd_send(struct ath11k *ar, u8 pdev_id, u32 value);
+ int ath11k_wmi_send_obss_color_collision_cfg_cmd(struct ath11k *ar, u32 vdev_id,
+ 						 u8 bss_color, u32 period,
+ 						 bool enable);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/902-wifi-mac80211-Fix-memory-corruption-during-mesh-beac.patch b/package/kernel/mac80211/patches/ath11k_nss/902-wifi-mac80211-Fix-memory-corruption-during-mesh-beac.patch
new file mode 100644
index 00000000000000..ea76cd96327e46
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/902-wifi-mac80211-Fix-memory-corruption-during-mesh-beac.patch
@@ -0,0 +1,68 @@
+From 0ff455d1d446e34ae6c2596d4d8491f66fc61913 Mon Sep 17 00:00:00 2001
+From: Manish Dharanenthiran <quic_mdharane@quicinc.com>
+Date: Sat, 2 Dec 2023 03:38:31 +0530
+Subject: [PATCH] wifi: mac80211: Fix memory corruption during mesh beacon
+ update
+
+During mesh beacon update, u64 flag is used to check for
+bit set/unset for validation purpose. But, in
+'ieee80211_mbss_info_change_notify' API, unsigned long flag
+is modified using sizeof(u64). This leads to following issue:
+
+ > 'mbss_changed' flag in 'ieee80211_if_mesh' is declared as
+    unsigned_long which creates an architecture dependency
+    (32bit vs 64bit) while modifying it with u64 flag which
+    leads to memory corruption.
+
+Fix above mentioned issue by replacing unsigned long with u64
+for changed flag.
+
+Signed-off-by: Manish Dharanenthiran <quic_mdharane@quicinc.com>
+---
+ net/mac80211/ieee80211_i.h | 2 +-
+ net/mac80211/mesh.c        | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -683,7 +683,7 @@ struct ieee80211_if_mesh {
+ 	struct timer_list mesh_path_root_timer;
+ 
+ 	unsigned long wrkq_flags;
+-	unsigned long mbss_changed[64 / BITS_PER_LONG];
++	unsigned long mbss_changed;
+ 
+ 	bool userspace_handles_dfs;
+ 
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -1183,7 +1183,7 @@ void ieee80211_mbss_info_change_notify(s
+ 
+ 	/* if we race with running work, worst case this work becomes a noop */
+ 	for_each_set_bit(bit, &bits, sizeof(changed) * BITS_PER_BYTE)
+-		set_bit(bit, ifmsh->mbss_changed);
++		set_bit(bit, &ifmsh->mbss_changed);
+ 	set_bit(MESH_WORK_MBSS_CHANGED, &ifmsh->wrkq_flags);
+ 	wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
+ }
+@@ -1265,7 +1265,7 @@ void ieee80211_stop_mesh(struct ieee8021
+ 
+ 	/* clear any mesh work (for next join) we may have accrued */
+ 	ifmsh->wrkq_flags = 0;
+-	memset(ifmsh->mbss_changed, 0, sizeof(ifmsh->mbss_changed));
++	ifmsh->mbss_changed = 0;
+ 
+ 	local->fif_other_bss--;
+ 	atomic_dec(&local->iff_allmultis);
+@@ -1732,9 +1732,9 @@ static void mesh_bss_info_changed(struct
+ 	u32 bit;
+ 	u64 changed = 0;
+ 
+-	for_each_set_bit(bit, ifmsh->mbss_changed,
++	for_each_set_bit(bit, &ifmsh->mbss_changed,
+ 			 sizeof(changed) * BITS_PER_BYTE) {
+-		clear_bit(bit, ifmsh->mbss_changed);
++		clear_bit(bit, &ifmsh->mbss_changed);
+ 		changed |= BIT(bit);
+ 	}
+ 
diff --git a/package/kernel/mac80211/patches/ath11k_nss/904-300-ath11k-nss_get_arvif_from_dev.patch b/package/kernel/mac80211/patches/ath11k_nss/904-300-ath11k-nss_get_arvif_from_dev.patch
new file mode 100644
index 00000000000000..5d695ccfe55f2e
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/904-300-ath11k-nss_get_arvif_from_dev.patch
@@ -0,0 +1,113 @@
+From fbe5a76d8c9ff1cf3f906a3c863928fc1adcbc95 Mon Sep 17 00:00:00 2001
+From: Karthikeyan Kathirvel <kathirve@codeaurora.org>
+Date: Tue, 16 Feb 2021 13:44:39 +0530
+Subject: [PATCH] ath11k: Add mesh nss offload support
+
+- New capability advertising nss offload support for mesh type
+- Mesh obj vap and link vap registration/clean up
+- Command/event handling
+- New .ch files in ath11k for nss mesh offload related debugs
+- Tx/Rx data path on mesh link vap uses native wifi format
+- Mesh obj vap handls packets in ether format. No Tx on Mesh
+  obj vap is expected as packets transmitted in slow path is
+  supposed to be encapsulated in 802.11 format.
+- New mac80211-driver callbacks for mesh vap, mpath and mpp
+  configurations.
+
+Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
+
+Change-Id: Ib6950344286ba18fab43586262c62dcd09557614
+Co-developed-by: Karthikeyan Kathirvel <kathirve@codeaurora.org>
+Signed-off-by: Karthikeyan Kathirvel <kathirve@codeaurora.org>
+Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/nss.c       | 1482 ++++++++++++++++++++++++---
+
+--- a/drivers/net/wireless/ath/ath11k/nss.c
++++ b/drivers/net/wireless/ath/ath11k/nss.c
+@@ -35,6 +35,30 @@ ath11k_nss_get_vdev_opmode(struct ath11k
+ 	return ATH11K_NSS_OPMODE_UNKNOWN;
+ }
+ 
++static struct ath11k_vif *ath11k_nss_get_arvif_from_dev(struct net_device *dev)
++{
++	struct wireless_dev *wdev;
++	struct ieee80211_vif *vif;
++	struct ath11k_vif *arvif;
++
++	if (!dev)
++		return NULL;
++
++	wdev = dev->ieee80211_ptr;
++	if (!wdev)
++		return NULL;
++
++	vif = wdev_to_ieee80211_vif(wdev);
++	if (!vif)
++		return NULL;
++
++	arvif = (struct ath11k_vif *)vif->drv_priv;
++	if (!arvif)
++		return NULL;
++
++	return arvif;
++}
++
+ static void ath11k_nss_wifili_stats_sync(struct ath11k_base *ab,
+ 					 struct nss_wifili_stats_sync_msg *wlsoc_stats)
+ {
+@@ -294,6 +318,9 @@ void ath11k_nss_wifili_event_receive(str
+ 
+ 	switch (msg_type) {
+ 	case NSS_WIFILI_INIT_MSG:
++		ab->nss.response = response;
++		complete(&ab->nss.complete);
++		break;
+ 	case NSS_WIFILI_PDEV_INIT_MSG:
+ 	case NSS_WIFILI_START_MSG:
+ 	case NSS_WIFILI_SOC_RESET_MSG:
+@@ -302,7 +329,6 @@ void ath11k_nss_wifili_event_receive(str
+ 		ab->nss.response = response;
+ 		complete(&ab->nss.complete);
+ 		break;
+-
+ 	case NSS_WIFILI_PEER_CREATE_MSG:
+ 		if (response != NSS_CMN_RESPONSE_EMSG)
+ 			break;
+@@ -463,7 +489,9 @@ ath11k_nss_wifili_ext_callback_fn(struct
+ 		ath11k_nss_process_mic_error(ab, skb);
+ 		break;
+ 	default:
+-		kfree(skb);
++		ath11k_dbg(ab, ATH11K_DBG_NSS, "unknown packet type received in wifili ext cb %d",
++			    wepm->pkt_type);
++		dev_kfree_skb_any(skb);
+ 		break;
+ 	}
+ }
+@@ -786,24 +814,7 @@ ath11k_nss_vdev_special_data_receive(str
+ 	int ret = 0;
+ 	struct ath11k_peer *ta_peer = NULL;
+ 
+-	if (!dev) {
+-		dev_kfree_skb_any(skb);
+-		return;
+-	}
+-
+-	wdev = dev->ieee80211_ptr;
+-	if (!wdev) {
+-		dev_kfree_skb_any(skb);
+-		return;
+-	}
+-
+-	vif = wdev_to_ieee80211_vif(wdev);
+-	if (!vif) {
+-		dev_kfree_skb_any(skb);
+-		return;
+-	}
+-
+-	arvif = (struct ath11k_vif *)vif->drv_priv;
++	arvif = ath11k_nss_get_arvif_from_dev(dev);
+ 	if (!arvif) {
+ 		dev_kfree_skb_any(skb);
+ 		return;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/907-068-ath11k-add-rx-histogram-stats.patch b/package/kernel/mac80211/patches/ath11k_nss/907-068-ath11k-add-rx-histogram-stats.patch
new file mode 100644
index 00000000000000..d3ffa5bd8da8e7
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/907-068-ath11k-add-rx-histogram-stats.patch
@@ -0,0 +1,608 @@
+From 4635ca1f29bc5838d556b09e3c186b76a5198ddb Mon Sep 17 00:00:00 2001
+From: Manikanta Pubbisetty <mpubbise@codeaurora.org>
+Date: Fri, 18 Aug 2023 11:43:33 +0530
+Subject: [PATCH] ath11k: add rx histogram stats
+
+Adding rx rate table and byte level peer rx statistics. Also,
+adding a debugfs knob to reset rx stats specific to the peer.
+
+Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/core.h        |  19 ++-
+ drivers/net/wireless/ath/ath11k/debugfs_sta.c | 152 ++++++++++++++++--
+ drivers/net/wireless/ath/ath11k/dp_rx.c       |  95 +++++++++--
+ drivers/net/wireless/ath/ath11k/dp_rx.h       |  19 +++
+ drivers/net/wireless/ath/ath11k/hal_rx.c      |  85 +++++++---
+ drivers/net/wireless/ath/ath11k/hal_rx.h      |  21 +++
+ drivers/net/wireless/ath/ath11k/hw.c          |  18 +++
+ drivers/net/wireless/ath/ath11k/hw.h          |   1 +
+ 8 files changed, 351 insertions(+), 59 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -44,6 +44,8 @@
+ 
+ #define ATH11K_INVALID_HW_MAC_ID	0xFF
+ #define ATH11K_CONNECTION_LOSS_HZ	(3 * HZ)
++#define ATH11K_RX_RATE_TABLE_NUM 320
++#define ATH11K_RX_RATE_TABLE_11AX_NUM 576
+ 
+ /* SMBIOS type containing Board Data File Name Extension */
+ #define ATH11K_SMBIOS_BDF_EXT_TYPE 0xF8
+@@ -420,6 +422,17 @@ struct ath11k_vif_iter {
+ 	struct ath11k_vif *arvif;
+ };
+ 
++struct ath11k_rx_peer_rate_stats {
++	u64 ht_mcs_count[HAL_RX_MAX_MCS_HT + 1];
++	u64 vht_mcs_count[HAL_RX_MAX_MCS_VHT + 1];
++	u64 he_mcs_count[HAL_RX_MAX_MCS_HE + 1];
++	u64 nss_count[HAL_RX_MAX_NSS];
++	u64 bw_count[HAL_RX_BW_MAX];
++	u64 gi_count[HAL_RX_GI_MAX];
++	u64 legacy_count[HAL_RX_MAX_NUM_LEGACY_RATES];
++	u64 rx_rate[ATH11K_RX_RATE_TABLE_11AX_NUM];
++};
++
+ struct ath11k_rx_peer_stats {
+ 	u64 num_msdu;
+ 	u64 num_mpdu_fcs_ok;
+@@ -431,10 +444,6 @@ struct ath11k_rx_peer_stats {
+ 	u64 non_ampdu_msdu_count;
+ 	u64 stbc_count;
+ 	u64 beamformed_count;
+-	u64 mcs_count[HAL_RX_MAX_MCS + 1];
+-	u64 nss_count[HAL_RX_MAX_NSS];
+-	u64 bw_count[HAL_RX_BW_MAX];
+-	u64 gi_count[HAL_RX_GI_MAX];
+ 	u64 coding_count[HAL_RX_SU_MU_CODING_MAX];
+ 	u64 tid_count[IEEE80211_NUM_TIDS + 1];
+ 	u64 pream_cnt[HAL_RX_PREAMBLE_MAX];
+@@ -442,6 +451,8 @@ struct ath11k_rx_peer_stats {
+ 	u64 rx_duration;
+ 	u64 dcm_count;
+ 	u64 ru_alloc_cnt[HAL_RX_RU_ALLOC_TYPE_MAX];
++	struct ath11k_rx_peer_rate_stats pkt_stats;
++	struct ath11k_rx_peer_rate_stats byte_stats;
+ };
+ 
+ #define ATH11K_HE_MCS_NUM       12
+--- a/drivers/net/wireless/ath/ath11k/debugfs_sta.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs_sta.c
+@@ -10,6 +10,7 @@
+ #include "peer.h"
+ #include "debug.h"
+ #include "dp_tx.h"
++#include "dp_rx.h"
+ #include "debugfs_htt_stats.h"
+ 
+ static inline u32 ath11k_he_tones_in_ru_to_nl80211_he_ru_alloc(u16 ru_tones)
+@@ -390,8 +391,14 @@ static ssize_t ath11k_dbg_sta_dump_rx_st
+ 	struct ath11k *ar = arsta->arvif->ar;
+ 	struct ath11k_rx_peer_stats *rx_stats = arsta->rx_stats;
+ 	int len = 0, i, retval = 0;
+-	const int size = 4096;
++	const int size = 4 * 4096;
+ 	char *buf;
++	int he_rates_avail = (rx_stats->pream_cnt[HAL_RX_PREAMBLE_11AX] > 1) ? 1 : 0;
++	int rate_table_len = he_rates_avail ? ATH11K_RX_RATE_TABLE_11AX_NUM :
++					      ATH11K_RX_RATE_TABLE_NUM;
++	char *legacy_rate_str[] = {"1Mbps", "2Mbps", "5.5Mbps", "6Mbps",
++				   "9Mbps", "11Mbps", "12Mbps", "18Mbps",
++				   "24Mbps", "36 Mbps", "48Mbps", "54Mbps"};
+ 
+ 	if (!rx_stats)
+ 		return -ENOENT;
+@@ -422,14 +429,6 @@ static ssize_t ath11k_dbg_sta_dump_rx_st
+ 			 rx_stats->num_mpdu_fcs_ok);
+ 	len += scnprintf(buf + len, size - len, "Num of MPDUs with FCS error: %llu\n",
+ 			 rx_stats->num_mpdu_fcs_err);
+-	len += scnprintf(buf + len, size - len,
+-			 "GI: 0.8us %llu 0.4us %llu 1.6us %llu 3.2us %llu\n",
+-			 rx_stats->gi_count[0], rx_stats->gi_count[1],
+-			 rx_stats->gi_count[2], rx_stats->gi_count[3]);
+-	len += scnprintf(buf + len, size - len,
+-			 "BW: 20Mhz %llu 40Mhz %llu 80Mhz %llu 160Mhz %llu\n",
+-			 rx_stats->bw_count[0], rx_stats->bw_count[1],
+-			 rx_stats->bw_count[2], rx_stats->bw_count[3]);
+ 	len += scnprintf(buf + len, size - len, "BCC %llu LDPC %llu\n",
+ 			 rx_stats->coding_count[0], rx_stats->coding_count[1]);
+ 	len += scnprintf(buf + len, size - len,
+@@ -444,14 +443,96 @@ static ssize_t ath11k_dbg_sta_dump_rx_st
+ 	len += scnprintf(buf + len, size - len, "TID(0-15) Legacy TID(16):");
+ 	for (i = 0; i <= IEEE80211_NUM_TIDS; i++)
+ 		len += scnprintf(buf + len, size - len, "%llu ", rx_stats->tid_count[i]);
+-	len += scnprintf(buf + len, size - len, "\nMCS(0-11) Legacy MCS(12):");
+-	for (i = 0; i < HAL_RX_MAX_MCS + 1; i++)
+-		len += scnprintf(buf + len, size - len, "%llu ", rx_stats->mcs_count[i]);
+-	len += scnprintf(buf + len, size - len, "\nNSS(1-8):");
+-	for (i = 0; i < HAL_RX_MAX_NSS; i++)
+-		len += scnprintf(buf + len, size - len, "%llu ", rx_stats->nss_count[i]);
+-	len += scnprintf(buf + len, size - len, "\nRX Duration:%llu ",
++	len += scnprintf(buf + len, size - len, "\nRX Duration:%llu\n",
+ 			 rx_stats->rx_duration);
++
++	len += scnprintf(buf + len, size - len, "\nRX success packet stats:\n");
++	len += scnprintf(buf + len, size - len, "\nHE packet stats:\n");
++	for (i = 0; i <= HAL_RX_MAX_MCS_HE; i++)
++		len += scnprintf(buf + len, size - len, "MCS %d: %llu%s", i,
++				 rx_stats->pkt_stats.he_mcs_count[i],
++				 (i + 1) % 6 ? "\t" : "\n");
++	len += scnprintf(buf + len, size - len, "\nVHT packet stats:\n");
++	for (i = 0; i <= HAL_RX_MAX_MCS_VHT; i++)
++		len += scnprintf(buf + len, size - len, "MCS %d: %llu%s", i,
++				 rx_stats->pkt_stats.vht_mcs_count[i],
++				 (i + 1) % 5 ? "\t" : "\n");
++	len += scnprintf(buf + len, size - len, "\nHT packet stats:\n");
++	for (i = 0; i <= HAL_RX_MAX_MCS_HT; i++)
++		len += scnprintf(buf + len, size - len, "MCS %d: %llu%s", i,
++				 rx_stats->pkt_stats.ht_mcs_count[i],
++				 (i + 1) % 8 ? "\t" : "\n");
++	len += scnprintf(buf + len, size - len, "\nLegacy rate packet stats:\n");
++	for (i = 0; i < HAL_RX_MAX_NUM_LEGACY_RATES; i++)
++		len += scnprintf(buf + len, size - len, "%s: %llu%s", legacy_rate_str[i],
++				 rx_stats->pkt_stats.legacy_count[i],
++				 (i + 1) % 4 ? "\t" : "\n");
++	len += scnprintf(buf + len, size - len, "\nNSS packet stats:\n");
++	for (i = 0; i < HAL_RX_MAX_NSS; i++)
++		len += scnprintf(buf + len, size - len, "%dx%d: %llu ", i + 1, i + 1,
++				 rx_stats->pkt_stats.nss_count[i]);
++	len += scnprintf(buf + len, size - len,
++			 "\n\nGI: 0.8us %llu 0.4us %llu 1.6us %llu 3.2us %llu\n",
++			 rx_stats->pkt_stats.gi_count[0],
++			 rx_stats->pkt_stats.gi_count[1],
++			 rx_stats->pkt_stats.gi_count[2],
++			 rx_stats->pkt_stats.gi_count[3]);
++	len += scnprintf(buf + len, size - len,
++			 "BW: 20Mhz %llu 40Mhz %llu 80Mhz %llu 160Mhz %llu\n",
++			 rx_stats->pkt_stats.bw_count[0],
++			 rx_stats->pkt_stats.bw_count[1],
++			 rx_stats->pkt_stats.bw_count[2],
++			 rx_stats->pkt_stats.bw_count[3]);
++	len += scnprintf(buf + len, size - len, "\nRate Table (packets):\n");
++	for (i = 0; i < rate_table_len; i++)
++		len += scnprintf(buf + len, size - len, "%10llu%s",
++				rx_stats->pkt_stats.rx_rate[i],
++				(i + 1) % (he_rates_avail ? 12 : 8) ? "\t" : "\n");
++
++	len += scnprintf(buf + len, size - len, "\nRX success byte stats:\n");
++	len += scnprintf(buf + len, size - len, "\nHE byte stats:\n");
++	for (i = 0; i <= HAL_RX_MAX_MCS_HE; i++)
++		len += scnprintf(buf + len, size - len, "MCS %d: %llu%s", i,
++				 rx_stats->byte_stats.he_mcs_count[i],
++				 (i + 1) % 6 ? "\t" : "\n");
++
++	len += scnprintf(buf + len, size - len, "\nVHT byte stats:\n");
++	for (i = 0; i <= HAL_RX_MAX_MCS_VHT; i++)
++		len += scnprintf(buf + len, size - len, "MCS %d: %llu%s", i,
++				 rx_stats->byte_stats.vht_mcs_count[i],
++				 (i + 1) % 5 ? "\t" : "\n");
++	len += scnprintf(buf + len, size - len, "\nHT byte stats:\n");
++	for (i = 0; i <= HAL_RX_MAX_MCS_HT; i++)
++		len += scnprintf(buf + len, size - len, "MCS %d: %llu%s", i,
++				 rx_stats->byte_stats.ht_mcs_count[i],
++				 (i + 1) % 8 ? "\t" : "\n");
++	len += scnprintf(buf + len, size - len, "\nLegacy rate byte stats:\n");
++	for (i = 0; i < HAL_RX_MAX_NUM_LEGACY_RATES; i++)
++		len += scnprintf(buf + len, size - len, "%s: %llu%s", legacy_rate_str[i],
++				 rx_stats->byte_stats.legacy_count[i],
++				 (i + 1) % 4 ? "\t" : "\n");
++	len += scnprintf(buf + len, size - len, "\nNSS byte stats:\n");
++	for (i = 0; i < HAL_RX_MAX_NSS; i++)
++		len += scnprintf(buf + len, size - len, "%dx%d: %llu ", i + 1, i + 1,
++				 rx_stats->byte_stats.nss_count[i]);
++	len += scnprintf(buf + len, size - len,
++			 "\n\nGI: 0.8us %llu 0.4us %llu 1.6us %llu 3.2us %llu\n",
++			 rx_stats->byte_stats.gi_count[0],
++			 rx_stats->byte_stats.gi_count[1],
++			 rx_stats->byte_stats.gi_count[2],
++			 rx_stats->byte_stats.gi_count[3]);
++	len += scnprintf(buf + len, size - len,
++			 "BW: 20Mhz %llu 40Mhz %llu 80Mhz %llu 160Mhz %llu\n",
++			 rx_stats->byte_stats.bw_count[0],
++			 rx_stats->byte_stats.bw_count[1],
++			 rx_stats->byte_stats.bw_count[2],
++			 rx_stats->byte_stats.bw_count[3]);
++	len += scnprintf(buf + len, size - len, "\nRate Table (bytes):\n");
++	for (i = 0; i < rate_table_len; i++)
++		len += scnprintf(buf + len, size - len, "%10llu%s",
++				rx_stats->byte_stats.rx_rate[i],
++				(i + 1) % (he_rates_avail ? 12 : 8) ? "\t" : "\n");
++
+ 	len += scnprintf(buf + len, size - len,
+ 			 "\nDCM: %llu\nRU: 26 %llu 52: %llu 106: %llu 242: %llu 484: %llu 996: %llu\n",
+ 			 rx_stats->dcm_count, rx_stats->ru_alloc_cnt[0],
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -3400,10 +3400,43 @@ exit:
+ 	return total_msdu_reaped;
+ }
+ 
++static void
++ath11k_dp_rx_update_peer_rate_table_stats(struct ath11k_rx_peer_stats *rx_stats,
++					  struct hal_rx_mon_ppdu_info *ppdu_info,
++					  u32 num_msdu)
++{
++	u32 rate_idx = 0;
++	u32 mcs_idx = ppdu_info->mcs;
++	u32 nss_idx = ppdu_info->nss - 1;
++	u32 bw_idx = ppdu_info->bw;
++	u32 gi_idx = ppdu_info->gi;
++
++	if ((mcs_idx > HAL_RX_MAX_MCS_HE) || (nss_idx >= HAL_RX_MAX_NSS) ||
++	    (bw_idx >= HAL_RX_BW_MAX) || (gi_idx >= HAL_RX_GI_MAX)) {
++		return;
++	}
++
++	if (ppdu_info->preamble_type == HAL_RX_PREAMBLE_11N ||
++	    ppdu_info->preamble_type == HAL_RX_PREAMBLE_11AC) {
++		rate_idx = mcs_idx * 8 + 8 * 10 * nss_idx;
++		rate_idx += bw_idx * 2 + gi_idx;
++	} else if (ppdu_info->preamble_type == HAL_RX_PREAMBLE_11AX) {
++		gi_idx = ath11k_he_gi_to_nl80211_he_gi(ppdu_info->gi);
++		rate_idx = mcs_idx * 12 + 12 * 12 * nss_idx;
++		rate_idx += bw_idx * 3 + gi_idx;
++	}  else {
++		return;
++	}
++
++	rx_stats->pkt_stats.rx_rate[rate_idx] += num_msdu;
++	rx_stats->byte_stats.rx_rate[rate_idx] += ppdu_info->mpdu_len;
++}
++
+ static void ath11k_dp_rx_update_peer_stats(struct ath11k_sta *arsta,
+ 					   struct hal_rx_mon_ppdu_info *ppdu_info)
+ {
+ 	struct ath11k_rx_peer_stats *rx_stats = arsta->rx_stats;
++	struct ath11k *ar = arsta->arvif->ar;
+ 	u32 num_msdu;
+ 	int i;
+ 
+@@ -3413,6 +3446,8 @@ static void ath11k_dp_rx_update_peer_sta
+ 	arsta->rssi_comb = ppdu_info->rssi_comb;
+ 	ewma_avg_rssi_add(&arsta->avg_rssi, ppdu_info->rssi_comb);
+ 
++	if (!ath11k_debugfs_is_extd_rx_stats_enabled(ar))
++		return;
+ 	num_msdu = ppdu_info->tcp_msdu_count + ppdu_info->tcp_ack_msdu_count +
+ 		   ppdu_info->udp_msdu_count + ppdu_info->other_msdu_count;
+ 
+@@ -3429,18 +3464,6 @@ static void ath11k_dp_rx_update_peer_sta
+ 		ppdu_info->tid = IEEE80211_NUM_TIDS;
+ 	}
+ 
+-	if (ppdu_info->nss > 0 && ppdu_info->nss <= HAL_RX_MAX_NSS)
+-		rx_stats->nss_count[ppdu_info->nss - 1] += num_msdu;
+-
+-	if (ppdu_info->mcs <= HAL_RX_MAX_MCS)
+-		rx_stats->mcs_count[ppdu_info->mcs] += num_msdu;
+-
+-	if (ppdu_info->gi < HAL_RX_GI_MAX)
+-		rx_stats->gi_count[ppdu_info->gi] += num_msdu;
+-
+-	if (ppdu_info->bw < HAL_RX_BW_MAX)
+-		rx_stats->bw_count[ppdu_info->bw] += num_msdu;
+-
+ 	if (ppdu_info->ldpc < HAL_RX_SU_MU_CODING_MAX)
+ 		rx_stats->coding_count[ppdu_info->ldpc] += num_msdu;
+ 
+@@ -3469,8 +3492,6 @@ static void ath11k_dp_rx_update_peer_sta
+ 	rx_stats->dcm_count += ppdu_info->dcm;
+ 	rx_stats->ru_alloc_cnt[ppdu_info->ru_alloc] += num_msdu;
+ 
+-	arsta->rssi_comb = ppdu_info->rssi_comb;
+-
+ 	BUILD_BUG_ON(ARRAY_SIZE(arsta->chain_signal) >
+ 			     ARRAY_SIZE(ppdu_info->rssi_chain_pri20));
+ 
+@@ -3479,6 +3500,52 @@ static void ath11k_dp_rx_update_peer_sta
+ 
+ 	rx_stats->rx_duration += ppdu_info->rx_duration;
+ 	arsta->rx_duration = rx_stats->rx_duration;
++
++	if (ppdu_info->nss > 0 && ppdu_info->nss <= HAL_RX_MAX_NSS) {
++		rx_stats->pkt_stats.nss_count[ppdu_info->nss - 1] += num_msdu;
++		rx_stats->byte_stats.nss_count[ppdu_info->nss - 1] += ppdu_info->mpdu_len;
++	}
++
++	if (ppdu_info->preamble_type == HAL_RX_PREAMBLE_11N &&
++	    ppdu_info->mcs <= HAL_RX_MAX_MCS_HT) {
++			rx_stats->pkt_stats.ht_mcs_count[ppdu_info->mcs] += num_msdu;
++			rx_stats->byte_stats.ht_mcs_count[ppdu_info->mcs] += ppdu_info->mpdu_len;
++			/* To fit into rate table for HT packets */
++			ppdu_info->mcs = ppdu_info->mcs % 8;
++	}
++
++	if (ppdu_info->preamble_type == HAL_RX_PREAMBLE_11AC &&
++	    ppdu_info->mcs <= HAL_RX_MAX_MCS_VHT) {
++		rx_stats->pkt_stats.vht_mcs_count[ppdu_info->mcs] += num_msdu;
++		rx_stats->byte_stats.vht_mcs_count[ppdu_info->mcs] += ppdu_info->mpdu_len;
++	}
++
++	if (ppdu_info->preamble_type == HAL_RX_PREAMBLE_11AX &&
++	    ppdu_info->mcs <= HAL_RX_MAX_MCS_HE) {
++		rx_stats->pkt_stats.he_mcs_count[ppdu_info->mcs] += num_msdu;
++		rx_stats->byte_stats.he_mcs_count[ppdu_info->mcs] += ppdu_info->mpdu_len;
++	}
++
++
++	if ((ppdu_info->preamble_type == HAL_RX_PREAMBLE_11A ||
++	     ppdu_info->preamble_type == HAL_RX_PREAMBLE_11B) &&
++	     ppdu_info->rate < HAL_RX_LEGACY_RATE_INVALID) {
++		rx_stats->pkt_stats.legacy_count[ppdu_info->rate] += num_msdu;
++		rx_stats->byte_stats.legacy_count[ppdu_info->rate] += ppdu_info->mpdu_len;
++	}
++
++	if (ppdu_info->gi < HAL_RX_GI_MAX) {
++		rx_stats->pkt_stats.gi_count[ppdu_info->gi] += num_msdu;
++		rx_stats->byte_stats.gi_count[ppdu_info->gi] += ppdu_info->mpdu_len;
++	}
++
++	if (ppdu_info->bw < HAL_RX_BW_MAX) {
++		rx_stats->pkt_stats.bw_count[ppdu_info->bw] += num_msdu;
++		rx_stats->byte_stats.bw_count[ppdu_info->bw] += ppdu_info->mpdu_len;
++	}
++
++	ath11k_dp_rx_update_peer_rate_table_stats(rx_stats, ppdu_info, num_msdu);
++
+ }
+ 
+ static struct sk_buff *ath11k_dp_rx_alloc_mon_status_buf(struct ath11k_base *ab,
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.h
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.h
+@@ -69,6 +69,25 @@ struct ath11k_dp_rfc1042_hdr {
+ 	__be16 snap_type;
+ } __packed;
+ 
++static inline u32 ath11k_he_gi_to_nl80211_he_gi(u8 sgi)
++{
++        u32 ret = 0;
++
++        switch (sgi) {
++        case RX_MSDU_START_SGI_0_8_US:
++                ret = NL80211_RATE_INFO_HE_GI_0_8;
++                break;
++        case RX_MSDU_START_SGI_1_6_US:
++                ret = NL80211_RATE_INFO_HE_GI_1_6;
++                break;
++        case RX_MSDU_START_SGI_3_2_US:
++                ret = NL80211_RATE_INFO_HE_GI_3_2;
++                break;
++        }
++
++        return ret;
++}
++
+ int ath11k_dp_rx_ampdu_start(struct ath11k_vif *arvif,
+ 			     struct ieee80211_ampdu_params *params);
+ int ath11k_dp_rx_ampdu_stop(struct ath11k_vif *arvif,
+--- a/drivers/net/wireless/ath/ath11k/hal_rx.c
++++ b/drivers/net/wireless/ath/ath11k/hal_rx.c
+@@ -978,44 +978,78 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+ 		ppdu_info->is_stbc = FIELD_GET(HAL_RX_HT_SIG_INFO_INFO1_STBC,
+ 					       info1);
+ 		ppdu_info->ldpc = FIELD_GET(HAL_RX_HT_SIG_INFO_INFO1_FEC_CODING, info1);
+-		ppdu_info->gi = info1 & HAL_RX_HT_SIG_INFO_INFO1_GI;
+-
+-		switch (ppdu_info->mcs) {
+-		case 0 ... 7:
+-			ppdu_info->nss = 1;
+-			break;
+-		case 8 ... 15:
+-			ppdu_info->nss = 2;
+-			break;
+-		case 16 ... 23:
+-			ppdu_info->nss = 3;
+-			break;
+-		case 24 ... 31:
+-			ppdu_info->nss = 4;
+-			break;
+-		}
+-
+-		if (ppdu_info->nss > 1)
+-			ppdu_info->mcs = ppdu_info->mcs % 8;
+-
++		ppdu_info->gi = FIELD_GET(HAL_RX_HT_SIG_INFO_INFO1_GI, info1);
++		ppdu_info->nss = (ppdu_info->mcs >> 3) + 1;
+ 		ppdu_info->reception_type = HAL_RX_RECEPTION_TYPE_SU;
+ 		break;
+ 	}
+ 	case HAL_PHYRX_L_SIG_B: {
+ 		struct hal_rx_lsig_b_info *lsigb =
+ 			(struct hal_rx_lsig_b_info *)tlv_data;
++		u8 rate;
++
++		rate = FIELD_GET(HAL_RX_LSIG_B_INFO_INFO0_RATE,
++				 __le32_to_cpu(lsigb->info0));
+ 
+-		ppdu_info->rate = FIELD_GET(HAL_RX_LSIG_B_INFO_INFO0_RATE,
+-					    __le32_to_cpu(lsigb->info0));
++		switch (rate) {
++		case 1:
++			rate = HAL_RX_LEGACY_RATE_1_MBPS;
++			break;
++		case 2:
++		case 5:
++			rate = HAL_RX_LEGACY_RATE_2_MBPS;
++			break;
++		case 3:
++		case 6:
++			rate = HAL_RX_LEGACY_RATE_5_5_MBPS;
++			break;
++		case 4:
++		case 7:
++			rate = HAL_RX_LEGACY_RATE_11_MBPS;
++			break;
++		default:
++			rate = HAL_RX_LEGACY_RATE_INVALID;
++		}
++		ppdu_info->rate = rate;
+ 		ppdu_info->reception_type = HAL_RX_RECEPTION_TYPE_SU;
+ 		break;
+ 	}
+ 	case HAL_PHYRX_L_SIG_A: {
+ 		struct hal_rx_lsig_a_info *lsiga =
+ 			(struct hal_rx_lsig_a_info *)tlv_data;
++		u8 rate;
+ 
+-		ppdu_info->rate = FIELD_GET(HAL_RX_LSIG_A_INFO_INFO0_RATE,
+-					    __le32_to_cpu(lsiga->info0));
++		rate = FIELD_GET(HAL_RX_LSIG_A_INFO_INFO0_RATE,
++				 __le32_to_cpu(lsiga->info0));
++		switch (rate) {
++		case 8:
++			rate = HAL_RX_LEGACY_RATE_48_MBPS;
++			break;
++		case 9:
++			rate = HAL_RX_LEGACY_RATE_24_MBPS;
++			break;
++		case 10:
++			rate = HAL_RX_LEGACY_RATE_12_MBPS;
++			break;
++		case 11:
++			rate = HAL_RX_LEGACY_RATE_6_MBPS;
++			break;
++		case 12:
++			rate = HAL_RX_LEGACY_RATE_54_MBPS;
++			break;
++		case 13:
++			rate = HAL_RX_LEGACY_RATE_36_MBPS;
++			break;
++		case 14:
++			rate = HAL_RX_LEGACY_RATE_18_MBPS;
++			break;
++		case 15:
++			rate = HAL_RX_LEGACY_RATE_9_MBPS;
++			break;
++		default:
++			rate = HAL_RX_LEGACY_RATE_INVALID;
++		}
++		ppdu_info->rate = rate;
+ 		ppdu_info->reception_type = HAL_RX_RECEPTION_TYPE_SU;
+ 		break;
+ 	}
+@@ -1473,6 +1507,9 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+ 		peer_id = ath11k_hal_rx_mpduinfo_get_peerid(ab, mpdu_info);
+ 		if (peer_id)
+ 			ppdu_info->peer_id = peer_id;
++
++		ppdu_info->mpdu_len += ab->hw_params.hw_ops->rx_desc_get_hal_mpdu_len(mpdu_info);
++
+ 		break;
+ 	}
+ 	case HAL_RXPCU_PPDU_END_INFO: {
+--- a/drivers/net/wireless/ath/ath11k/hal_rx.h
++++ b/drivers/net/wireless/ath/ath11k/hal_rx.h
+@@ -19,7 +19,11 @@ struct hal_rx_wbm_rel_info {
+ #define VHT_SIG_SU_NSS_MASK 0x7
+ 
+ #define HAL_RX_MAX_MCS 12
++#define HAL_RX_MAX_MCS_HT 31
++#define HAL_RX_MAX_MCS_VHT 9
++#define HAL_RX_MAX_MCS_HE 11
+ #define HAL_RX_MAX_NSS 8
++#define HAL_RX_MAX_NUM_LEGACY_RATES 12
+ 
+ struct hal_rx_mon_status_tlv_hdr {
+ 	u32 hdr;
+@@ -104,6 +108,22 @@ struct hal_rx_user_status {
+ 	u32 mpdu_err_byte_count;
+ };
+ 
++enum hal_rx_legacy_rate {
++	HAL_RX_LEGACY_RATE_1_MBPS,
++	HAL_RX_LEGACY_RATE_2_MBPS,
++	HAL_RX_LEGACY_RATE_5_5_MBPS,
++	HAL_RX_LEGACY_RATE_6_MBPS,
++	HAL_RX_LEGACY_RATE_9_MBPS,
++	HAL_RX_LEGACY_RATE_11_MBPS,
++	HAL_RX_LEGACY_RATE_12_MBPS,
++	HAL_RX_LEGACY_RATE_18_MBPS,
++	HAL_RX_LEGACY_RATE_24_MBPS,
++	HAL_RX_LEGACY_RATE_36_MBPS,
++	HAL_RX_LEGACY_RATE_48_MBPS,
++	HAL_RX_LEGACY_RATE_54_MBPS,
++	HAL_RX_LEGACY_RATE_INVALID,
++};
++
+ #define HAL_TLV_STATUS_PPDU_NOT_DONE    HAL_RX_MON_STATUS_PPDU_NOT_DONE
+ #define HAL_TLV_STATUS_PPDU_DONE        HAL_RX_MON_STATUS_PPDU_DONE
+ #define HAL_TLV_STATUS_BUF_DONE         HAL_RX_MON_STATUS_BUF_DONE
+@@ -128,6 +148,7 @@ struct hal_rx_mon_ppdu_info {
+ 	u32 num_mpdu_fcs_ok;
+ 	u32 num_mpdu_fcs_err;
+ 	u32 preamble_type;
++	u32 mpdu_len;
+ 	u16 chan_num;
+ 	u16 tcp_msdu_count;
+ 	u16 tcp_ack_msdu_count;
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -1051,6 +1051,17 @@ static u32 ath11k_hw_wcn6750_get_tcl_rin
+ 	return skb_get_hash(skb);
+ }
+ 
++static u32 ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_len(struct hal_rx_mpdu_info *mpdu_info)
++{
++	return FIELD_GET(HAL_RX_MPDU_INFO_INFO1_MPDU_LEN,
++			 __le32_to_cpu(mpdu_info->u.ipq8074.info1));
++}
++
++static u32 ath11k_hw_qcn9074_rx_desc_get_hal_mpdu_len(struct hal_rx_mpdu_info *mpdu_info)
++{
++	return FIELD_GET(HAL_RX_MPDU_INFO_INFO1_MPDU_LEN,
++			 __le32_to_cpu(mpdu_info->u.qcn9074.info1));
++}
+ const struct ath11k_hw_ops ipq8074_ops = {
+ 	.get_hw_mac_from_pdev_id = ath11k_hw_ipq8074_mac_from_pdev_id,
+ 	.wmi_init_config = ath11k_init_wmi_config_ipq8074,
+@@ -1089,6 +1100,7 @@ const struct ath11k_hw_ops ipq8074_ops =
+ 	.rx_desc_mac_addr2_valid = ath11k_hw_ipq8074_rx_desc_mac_addr2_valid,
+ 	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2,
+ 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
++	.rx_desc_get_hal_mpdu_len = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_len,
+ #ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
+ 	.rx_desc_get_offset = ath11k_hw_ipq8074_rx_desc_get_offset,
+ #endif
+@@ -1136,6 +1148,7 @@ const struct ath11k_hw_ops ipq6018_ops =
+ 	.rx_desc_mac_addr2_valid = ath11k_hw_ipq8074_rx_desc_mac_addr2_valid,
+ 	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2,
+ 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
++	.rx_desc_get_hal_mpdu_len = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_len,
+ };
+ 
+ const struct ath11k_hw_ops qca6390_ops = {
+@@ -1177,6 +1190,7 @@ const struct ath11k_hw_ops qca6390_ops =
+ 	.rx_desc_mac_addr2_valid = ath11k_hw_ipq8074_rx_desc_mac_addr2_valid,
+ 	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2,
+ 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
++	.rx_desc_get_hal_mpdu_len = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_len,
+ };
+ 
+ const struct ath11k_hw_ops qcn9074_ops = {
+@@ -1217,6 +1231,7 @@ const struct ath11k_hw_ops qcn9074_ops =
+ 	.reo_setup = ath11k_hw_ipq8074_reo_setup,
+ 	.mpdu_info_get_peerid = ath11k_hw_qcn9074_mpdu_info_get_peerid,
+ 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
++	.rx_desc_get_hal_mpdu_len = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_len,
+ };
+ 
+ const struct ath11k_hw_ops wcn6855_ops = {
+@@ -1339,6 +1354,7 @@ const struct ath11k_hw_ops ipq5018_ops =
+ 	.rx_desc_mac_addr2_valid = ath11k_hw_ipq9074_rx_desc_mac_addr2_valid,
+ 	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq9074_rx_desc_mpdu_start_addr2,
+ 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
++	.rx_desc_get_hal_mpdu_len = ath11k_hw_qcn9074_rx_desc_get_hal_mpdu_len,
+ };
+ 
+ #define ATH11K_TX_RING_MASK_0 BIT(0)
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -315,6 +315,7 @@ struct ath11k_hw_ops {
+ 	bool (*rx_desc_mac_addr2_valid)(struct hal_rx_desc *desc);
+ 	u8* (*rx_desc_mpdu_start_addr2)(struct hal_rx_desc *desc);
+ 	u32 (*get_ring_selector)(struct sk_buff *skb);
++	u32 (*rx_desc_get_hal_mpdu_len)(struct hal_rx_mpdu_info *mpdu_info);
+ #ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
+ 	void (*rx_desc_get_offset)(struct htt_rx_ring_tlv_filter *tlv_filter);
+ #endif
diff --git a/package/kernel/mac80211/patches/ath11k_nss/907-108-ath11k-enable-ul-ofdma-ru-allocation-in-peer-stats.patch b/package/kernel/mac80211/patches/ath11k_nss/907-108-ath11k-enable-ul-ofdma-ru-allocation-in-peer-stats.patch
new file mode 100644
index 00000000000000..e7908c6daad2a7
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/907-108-ath11k-enable-ul-ofdma-ru-allocation-in-peer-stats.patch
@@ -0,0 +1,452 @@
+--- a/drivers/net/wireless/ath/ath11k/debugfs_sta.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs_sta.c
+@@ -532,6 +532,12 @@ static ssize_t ath11k_dbg_sta_dump_rx_st
+ 		len += scnprintf(buf + len, size - len, "%10llu%s",
+ 				rx_stats->byte_stats.rx_rate[i],
+ 				(i + 1) % (he_rates_avail ? 12 : 8) ? "\t" : "\n");
++	len += scnprintf(buf + len, size - len,
++			 "\nDCM: %llu\nRU26:  %llu \nRU52:  %llu \nRU106: %llu \nRU242: %llu \nRU484: %llu \nRU996: %llu\n",
++			 rx_stats->dcm_count, rx_stats->ru_alloc_cnt[0],
++			 rx_stats->ru_alloc_cnt[1], rx_stats->ru_alloc_cnt[2],
++			 rx_stats->ru_alloc_cnt[3], rx_stats->ru_alloc_cnt[4],
++			 rx_stats->ru_alloc_cnt[5]);
+ 
+ 	len += scnprintf(buf + len, size - len,
+ 			 "\nDCM: %llu\nRU: 26 %llu 52: %llu 106: %llu 242: %llu 484: %llu 996: %llu\n",
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -3236,11 +3236,12 @@ exit:
+ static void
+ ath11k_dp_rx_update_peer_rate_table_stats(struct ath11k_rx_peer_stats *rx_stats,
+ 					  struct hal_rx_mon_ppdu_info *ppdu_info,
++					  struct hal_rx_user_status* user_stats,
+ 					  u32 num_msdu)
+ {
+ 	u32 rate_idx = 0;
+-	u32 mcs_idx = ppdu_info->mcs;
+-	u32 nss_idx = ppdu_info->nss - 1;
++	u32 mcs_idx = (user_stats) ? user_stats->mcs : ppdu_info->mcs;
++	u32 nss_idx = (user_stats) ? user_stats->nss - 1 : ppdu_info->nss - 1;
+ 	u32 bw_idx = ppdu_info->bw;
+ 	u32 gi_idx = ppdu_info->gi;
+ 
+@@ -3262,10 +3263,13 @@ ath11k_dp_rx_update_peer_rate_table_stat
+ 	}
+ 
+ 	rx_stats->pkt_stats.rx_rate[rate_idx] += num_msdu;
+-	rx_stats->byte_stats.rx_rate[rate_idx] += ppdu_info->mpdu_len;
++	if (user_stats)
++		rx_stats->byte_stats.rx_rate[rate_idx] += user_stats->mpdu_ok_byte_count;
++	else
++		rx_stats->byte_stats.rx_rate[rate_idx] += ppdu_info->mpdu_len;
+ }
+ 
+-static void ath11k_dp_rx_update_peer_stats(struct ath11k_sta *arsta,
++static void ath11k_dp_rx_update_peer_su_stats(struct ath11k_sta *arsta,
+ 					   struct hal_rx_mon_ppdu_info *ppdu_info)
+ {
+ 	struct ath11k_rx_peer_stats *rx_stats = arsta->rx_stats;
+@@ -3323,7 +3327,6 @@ static void ath11k_dp_rx_update_peer_sta
+ 	rx_stats->num_mpdu_fcs_ok += ppdu_info->num_mpdu_fcs_ok;
+ 	rx_stats->num_mpdu_fcs_err += ppdu_info->num_mpdu_fcs_err;
+ 	rx_stats->dcm_count += ppdu_info->dcm;
+-	rx_stats->ru_alloc_cnt[ppdu_info->ru_alloc] += num_msdu;
+ 
+ 	BUILD_BUG_ON(ARRAY_SIZE(arsta->chain_signal) >
+ 			     ARRAY_SIZE(ppdu_info->rssi_chain_pri20));
+@@ -3341,10 +3344,10 @@ static void ath11k_dp_rx_update_peer_sta
+ 
+ 	if (ppdu_info->preamble_type == HAL_RX_PREAMBLE_11N &&
+ 	    ppdu_info->mcs <= HAL_RX_MAX_MCS_HT) {
+-			rx_stats->pkt_stats.ht_mcs_count[ppdu_info->mcs] += num_msdu;
+-			rx_stats->byte_stats.ht_mcs_count[ppdu_info->mcs] += ppdu_info->mpdu_len;
+-			/* To fit into rate table for HT packets */
+-			ppdu_info->mcs = ppdu_info->mcs % 8;
++		rx_stats->pkt_stats.ht_mcs_count[ppdu_info->mcs] += num_msdu;
++		rx_stats->byte_stats.ht_mcs_count[ppdu_info->mcs] += ppdu_info->mpdu_len;
++		/* To fit into rate table for HT packets */
++		ppdu_info->mcs = ppdu_info->mcs % 8;
+ 	}
+ 
+ 	if (ppdu_info->preamble_type == HAL_RX_PREAMBLE_11AC &&
+@@ -3377,7 +3380,120 @@ static void ath11k_dp_rx_update_peer_sta
+ 		rx_stats->byte_stats.bw_count[ppdu_info->bw] += ppdu_info->mpdu_len;
+ 	}
+ 
+-	ath11k_dp_rx_update_peer_rate_table_stats(rx_stats, ppdu_info, num_msdu);
++	ath11k_dp_rx_update_peer_rate_table_stats(rx_stats, ppdu_info, NULL, num_msdu);
++
++}
++
++static void ath11k_dp_rx_update_user_stats(struct ath11k *ar,
++					   struct hal_rx_mon_ppdu_info *ppdu_info,
++					   u32 uid)
++{
++	struct ath11k_sta *arsta = NULL;
++	struct ath11k_rx_peer_stats *rx_stats = NULL;
++	struct hal_rx_user_status* user_stats = &ppdu_info->userstats[uid];
++	struct ath11k_peer *peer;
++	u32 num_msdu;
++
++	if (user_stats->ast_index == 0 || user_stats->ast_index == 0xFFFF)
++		return;
++
++	peer = ath11k_peer_find_by_ast(ar->ab, user_stats->ast_index);
++
++	if (peer == NULL) {
++		ath11k_warn(ar->ab, "peer ast idx %d can't be found\n",
++			    user_stats->ast_index);
++		return;
++	}
++
++	arsta = (struct ath11k_sta *)peer->sta->drv_priv;
++	rx_stats = arsta->rx_stats;
++
++	if (!rx_stats)
++		return;
++
++	arsta->rssi_comb = ppdu_info->rssi_comb;
++
++	num_msdu = user_stats->tcp_msdu_count + user_stats->tcp_ack_msdu_count +
++		   user_stats->udp_msdu_count + user_stats->other_msdu_count;
++
++	rx_stats->num_msdu += num_msdu;
++	rx_stats->tcp_msdu_count += user_stats->tcp_msdu_count +
++				    user_stats->tcp_ack_msdu_count;
++	rx_stats->udp_msdu_count += user_stats->udp_msdu_count;
++	rx_stats->other_msdu_count += user_stats->other_msdu_count;
++
++	if (ppdu_info->ldpc < HAL_RX_SU_MU_CODING_MAX)
++		rx_stats->coding_count[ppdu_info->ldpc] += num_msdu;
++
++	if (user_stats->tid <= IEEE80211_NUM_TIDS)
++		rx_stats->tid_count[user_stats->tid] += num_msdu;
++
++	if (user_stats->preamble_type < HAL_RX_PREAMBLE_MAX)
++		rx_stats->pream_cnt[user_stats->preamble_type] += num_msdu;
++
++	if (ppdu_info->reception_type < HAL_RX_RECEPTION_TYPE_MAX)
++		rx_stats->reception_type[ppdu_info->reception_type] += num_msdu;
++
++	if (ppdu_info->is_stbc)
++		rx_stats->stbc_count += num_msdu;
++
++	if (ppdu_info->beamformed)
++		rx_stats->beamformed_count += num_msdu;
++
++	if (user_stats->mpdu_cnt_fcs_ok > 1)
++		rx_stats->ampdu_msdu_count += num_msdu;
++	else
++		rx_stats->non_ampdu_msdu_count += num_msdu;
++
++	rx_stats->num_mpdu_fcs_ok += user_stats->mpdu_cnt_fcs_ok;
++	rx_stats->num_mpdu_fcs_err += user_stats->mpdu_cnt_fcs_err;
++	rx_stats->dcm_count += ppdu_info->dcm;
++	if (ppdu_info->reception_type == HAL_RX_RECEPTION_TYPE_MU_OFDMA ||
++	    ppdu_info->reception_type == HAL_RX_RECEPTION_TYPE_MU_OFDMA_MIMO)
++		rx_stats->ru_alloc_cnt[user_stats->ul_ofdma_ru_size] += num_msdu;
++
++	rx_stats->rx_duration += ppdu_info->rx_duration;
++	arsta->rx_duration = rx_stats->rx_duration;
++
++	if (user_stats->nss > 0 && user_stats->nss <= HAL_RX_MAX_NSS) {
++		rx_stats->pkt_stats.nss_count[user_stats->nss - 1] += num_msdu;
++		rx_stats->byte_stats.nss_count[user_stats->nss - 1] += user_stats->mpdu_ok_byte_count;
++	}
++
++	if (user_stats->preamble_type == HAL_RX_PREAMBLE_11AX &&
++	    user_stats->mcs <= HAL_RX_MAX_MCS_HE) {
++		rx_stats->pkt_stats.he_mcs_count[user_stats->mcs] += num_msdu;
++		rx_stats->byte_stats.he_mcs_count[user_stats->mcs] += user_stats->mpdu_ok_byte_count;
++	}
++
++	if (ppdu_info->gi < HAL_RX_GI_MAX) {
++		rx_stats->pkt_stats.gi_count[ppdu_info->gi] += num_msdu;
++		rx_stats->byte_stats.gi_count[ppdu_info->gi] += user_stats->mpdu_ok_byte_count;
++	}
++
++	if (ppdu_info->bw < HAL_RX_BW_MAX) {
++		rx_stats->pkt_stats.bw_count[ppdu_info->bw] += num_msdu;
++		rx_stats->byte_stats.bw_count[ppdu_info->bw] += user_stats->mpdu_ok_byte_count;
++	}
++
++	ath11k_dp_rx_update_peer_rate_table_stats(rx_stats, ppdu_info, user_stats, num_msdu);
++}
++
++static void ath11k_dp_rx_update_peer_mu_stats(struct ath11k *ar,
++					      struct hal_rx_mon_ppdu_info *ppdu_info)
++{
++	u32 num_users, i;
++
++	if (!ath11k_debugfs_is_extd_rx_stats_enabled(ar))
++		return;
++
++	num_users = ppdu_info->num_users;
++	if (num_users > HAL_MAX_UL_MU_USERS)
++		num_users = HAL_MAX_UL_MU_USERS;
++
++	for (i = 0; i < num_users; i++) {
++		ath11k_dp_rx_update_user_stats(ar, ppdu_info, i);
++	}
+ 
+ }
+ 
+@@ -5846,6 +5962,55 @@ static void ath11k_dp_rx_mon_dest_proces
+ 	}
+ }
+ 
++void ath11k_dp_rx_mon_process_ulofdma(struct hal_rx_mon_ppdu_info *ppdu_info)
++{
++	struct hal_rx_user_status *rx_user_status;
++	u32 num_users;
++	uint32_t i;
++	uint32_t mu_ul_user_v0_word0;
++	uint32_t mu_ul_user_v0_word1;
++	uint32_t ru_size;
++
++	if (!(ppdu_info->reception_type == HAL_RX_RECEPTION_TYPE_MU_OFDMA ||
++	      ppdu_info->reception_type == HAL_RX_RECEPTION_TYPE_MU_OFDMA_MIMO))
++		return;
++
++	num_users = ppdu_info->num_users;
++	if (num_users > HAL_MAX_UL_MU_USERS)
++		num_users = HAL_MAX_UL_MU_USERS;
++
++	for (i = 0; i < num_users; i++) {
++		rx_user_status = &ppdu_info->userstats[i];
++		mu_ul_user_v0_word0 =
++			rx_user_status->ul_ofdma_user_v0_word0;
++		mu_ul_user_v0_word1 =
++			rx_user_status->ul_ofdma_user_v0_word1;
++
++		if (FIELD_GET(HAL_RX_UL_OFDMA_USER_INFO_V0_W0_VALID,
++			mu_ul_user_v0_word0) &&
++		    !FIELD_GET(HAL_RX_UL_OFDMA_USER_INFO_V0_W0_VER,
++			mu_ul_user_v0_word0)) {
++			rx_user_status->mcs =
++				FIELD_GET(HAL_RX_UL_OFDMA_USER_INFO_V0_W1_MCS,
++					  mu_ul_user_v0_word1);
++			rx_user_status->nss =
++				FIELD_GET(HAL_RX_UL_OFDMA_USER_INFO_V0_W1_NSS,
++					  mu_ul_user_v0_word1) + 1;
++
++			rx_user_status->ofdma_info_valid = 1;
++			rx_user_status->ul_ofdma_ru_start_index =
++				FIELD_GET(HAL_RX_UL_OFDMA_USER_INFO_V0_W1_RU_START,
++				mu_ul_user_v0_word1);
++
++			ru_size = FIELD_GET(HAL_RX_UL_OFDMA_USER_INFO_V0_W1_RU_SIZE,
++				mu_ul_user_v0_word1);
++			rx_user_status->ul_ofdma_ru_width = ru_size;
++			rx_user_status->ul_ofdma_ru_size = ru_size;
++		}
++	}
++
++}
++
+ int ath11k_dp_rx_process_mon_status(struct ath11k_base *ab, int mac_id,
+ 				    struct napi_struct *napi, int budget)
+ {
+@@ -5919,8 +6084,13 @@ int ath11k_dp_rx_process_mon_status(stru
+ 
+ 		if ((ppdu_info->fc_valid) &&
+ 		    (ppdu_info->ast_index != HAL_AST_IDX_INVALID)) {
+-			arsta = (struct ath11k_sta *)peer->sta->drv_priv;
+-			ath11k_dp_rx_update_peer_stats(arsta, ppdu_info);
++			if (ppdu_info.reception_type == HAL_RX_RECEPTION_TYPE_SU) {
++				arsta = (struct ath11k_sta *)peer->sta->drv_priv;
++				ath11k_dp_rx_update_peer_su_stats(arsta, &ppdu_info);
++			} else {
++				ath11k_dp_rx_mon_process_ulofdma(&ppdu_info);
++				ath11k_dp_rx_update_peer_mu_stats(ar, &ppdu_info);
++			}
+ 		}
+ 
+ 		if (ath11k_debugfs_is_pktlog_peer_valid(ar, peer->addr))
+--- a/drivers/net/wireless/ath/ath11k/hal_rx.c
++++ b/drivers/net/wireless/ath/ath11k/hal_rx.c
+@@ -804,7 +804,6 @@ void ath11k_hal_reo_init_cmd_ring(struct
+ 	}
+ }
+ 
+-#define HAL_MAX_UL_MU_USERS	37
+ static inline void
+ ath11k_hal_rx_handle_ofdma_info(void *rx_tlv,
+ 				struct hal_rx_user_status *rx_user_status)
+@@ -836,6 +835,8 @@ ath11k_hal_rx_populate_mu_user_info(void
+ {
+ 	rx_user_status->ast_index = ppdu_info->ast_index;
+ 	rx_user_status->tid = ppdu_info->tid;
++	rx_user_status->tcp_ack_msdu_count =
++		ppdu_info->tcp_ack_msdu_count;
+ 	rx_user_status->tcp_msdu_count =
+ 		ppdu_info->tcp_msdu_count;
+ 	rx_user_status->udp_msdu_count =
+@@ -859,6 +860,9 @@ ath11k_hal_rx_populate_mu_user_info(void
+ 		ppdu_info->num_mpdu_fcs_ok;
+ 	rx_user_status->mpdu_cnt_fcs_err =
+ 		ppdu_info->num_mpdu_fcs_err;
++	memcpy(&rx_user_status->mpdu_fcs_ok_bitmap[0], &ppdu_info->mpdu_fcs_ok_bitmap[0],
++	       HAL_RX_NUM_WORDS_PER_PPDU_BITMAP *
++	       sizeof(ppdu_info->mpdu_fcs_ok_bitmap[0]));
+ 
+ 	ath11k_hal_rx_populate_byte_count(rx_tlv, ppdu_info, rx_user_status);
+ }
+@@ -888,6 +892,14 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+ 				  __le32_to_cpu(ppdu_start->info0));
+ 		ppdu_info->chan_num = __le32_to_cpu(ppdu_start->chan_num);
+ 		ppdu_info->ppdu_ts = __le32_to_cpu(ppdu_start->ppdu_start_ts);
++
++		if (ppdu_info->ppdu_id != ppdu_info->last_ppdu_id) {
++			ppdu_info->last_ppdu_id = ppdu_info->ppdu_id;
++			ppdu_info->num_users = 0;
++			memset(&ppdu_info->mpdu_fcs_ok_bitmap, 0,
++			       HAL_RX_NUM_WORDS_PER_PPDU_BITMAP *
++			       sizeof(ppdu_info->mpdu_fcs_ok_bitmap[0]));
++		}
+ 		break;
+ 	}
+ 	case HAL_RX_PPDU_END_USER_STATS: {
+@@ -942,15 +954,16 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+ 
+ 		if (userid < HAL_MAX_UL_MU_USERS) {
+ 			struct hal_rx_user_status *rxuser_stats =
+-				&ppdu_info->userstats;
++				&ppdu_info->userstats[userid];
++			ppdu_info->num_users += 1;
+ 
+ 			ath11k_hal_rx_handle_ofdma_info(tlv_data, rxuser_stats);
+ 			ath11k_hal_rx_populate_mu_user_info(tlv_data, ppdu_info,
+ 							    rxuser_stats);
+ 		}
+-		ppdu_info->userstats.mpdu_fcs_ok_bitmap[0] =
++		ppdu_info->mpdu_fcs_ok_bitmap[0] =
+ 					__le32_to_cpu(eu_stats->rsvd1[0]);
+-		ppdu_info->userstats.mpdu_fcs_ok_bitmap[1] =
++		ppdu_info->mpdu_fcs_ok_bitmap[1] =
+ 					__le32_to_cpu(eu_stats->rsvd1[1]);
+ 
+ 		break;
+@@ -958,12 +971,12 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+ 	case HAL_RX_PPDU_END_USER_STATS_EXT: {
+ 		struct hal_rx_ppdu_end_user_stats_ext *eu_stats =
+ 			(struct hal_rx_ppdu_end_user_stats_ext *)tlv_data;
+-		ppdu_info->userstats.mpdu_fcs_ok_bitmap[2] = eu_stats->info1;
+-		ppdu_info->userstats.mpdu_fcs_ok_bitmap[3] = eu_stats->info2;
+-		ppdu_info->userstats.mpdu_fcs_ok_bitmap[4] = eu_stats->info3;
+-		ppdu_info->userstats.mpdu_fcs_ok_bitmap[5] = eu_stats->info4;
+-		ppdu_info->userstats.mpdu_fcs_ok_bitmap[6] = eu_stats->info5;
+-		ppdu_info->userstats.mpdu_fcs_ok_bitmap[7] = eu_stats->info6;
++		ppdu_info->mpdu_fcs_ok_bitmap[2] = eu_stats->info1;
++		ppdu_info->mpdu_fcs_ok_bitmap[3] = eu_stats->info2;
++		ppdu_info->mpdu_fcs_ok_bitmap[4] = eu_stats->info3;
++		ppdu_info->mpdu_fcs_ok_bitmap[5] = eu_stats->info4;
++		ppdu_info->mpdu_fcs_ok_bitmap[6] = eu_stats->info5;
++		ppdu_info->mpdu_fcs_ok_bitmap[7] = eu_stats->info6;
+ 		break;
+ 	}
+ 	case HAL_PHYRX_HT_SIG: {
+--- a/drivers/net/wireless/ath/ath11k/hal_rx.h
++++ b/drivers/net/wireless/ath/ath11k/hal_rx.h
+@@ -72,6 +72,10 @@ enum hal_rx_reception_type {
+ #define HAL_RX_FCS_LEN                          4
+ #define HAL_AST_IDX_INVALID                     0xFFFF
+ 
++#define HAL_MAX_UL_MU_USERS                     37
++#define HAL_RX_MAX_MPDU                         256
++#define HAL_RX_NUM_WORDS_PER_PPDU_BITMAP        (HAL_RX_MAX_MPDU >> 5)
++
+ enum hal_rx_mon_status {
+ 	HAL_RX_MON_STATUS_PPDU_NOT_DONE,
+ 	HAL_RX_MON_STATUS_PPDU_DONE,
+@@ -82,14 +86,15 @@ struct hal_rx_user_status {
+ 	u32 mcs:4,
+ 	nss:3,
+ 	ofdma_info_valid:1,
+-	dl_ofdma_ru_start_index:7,
+-	dl_ofdma_ru_width:7,
+-	dl_ofdma_ru_size:8;
++	ul_ofdma_ru_start_index:7,
++	ul_ofdma_ru_width:7,
++	ul_ofdma_ru_size:8;
+ 	u32 ul_ofdma_user_v0_word0;
+ 	u32 ul_ofdma_user_v0_word1;
+ 	u32 ast_index;
+ 	u32 tid;
+ 	u16 tcp_msdu_count;
++	u16 tcp_ack_msdu_count;
+ 	u16 udp_msdu_count;
+ 	u16 other_msdu_count;
+ 	u16 frame_control;
+@@ -103,7 +108,7 @@ struct hal_rx_user_status {
+ 	u8 rs_flags;
+ 	u32 mpdu_cnt_fcs_ok;
+ 	u32 mpdu_cnt_fcs_err;
+-	u32 mpdu_fcs_ok_bitmap[8];
++	u32 mpdu_fcs_ok_bitmap[HAL_RX_NUM_WORDS_PER_PPDU_BITMAP];
+ 	u32 mpdu_ok_byte_count;
+ 	u32 mpdu_err_byte_count;
+ };
+@@ -144,6 +149,7 @@ struct hal_sw_mon_ring_entries {
+ 
+ struct hal_rx_mon_ppdu_info {
+ 	u32 ppdu_id;
++	u32 last_ppdu_id;
+ 	u32 ppdu_ts;
+ 	u32 num_mpdu_fcs_ok;
+ 	u32 num_mpdu_fcs_err;
+@@ -212,9 +218,20 @@ struct hal_rx_mon_ppdu_info {
+ 	u8 ltf_size;
+ 	u8 rxpcu_filter_pass;
+ 	char rssi_chain[8][8];
+-	struct hal_rx_user_status userstats;
++	u32 num_users;
++	u32 mpdu_fcs_ok_bitmap[HAL_RX_NUM_WORDS_PER_PPDU_BITMAP];
++	struct hal_rx_user_status userstats[HAL_MAX_UL_MU_USERS];
+ };
+ 
++#define HAL_RX_UL_OFDMA_USER_INFO_V0_W0_VALID			BIT(30)
++#define HAL_RX_UL_OFDMA_USER_INFO_V0_W0_VER			BIT(31)
++#define HAL_RX_UL_OFDMA_USER_INFO_V0_W1_NSS			GENMASK(2, 0)
++#define HAL_RX_UL_OFDMA_USER_INFO_V0_W1_MCS			GENMASK(6, 3)
++#define HAL_RX_UL_OFDMA_USER_INFO_V0_W1_LDPC			BIT(7)
++#define HAL_RX_UL_OFDMA_USER_INFO_V0_W1_DCM			BIT(8)
++#define HAL_RX_UL_OFDMA_USER_INFO_V0_W1_RU_START		GENMASK(15, 9)
++#define HAL_RX_UL_OFDMA_USER_INFO_V0_W1_RU_SIZE			GENMASK(18, 16)
++
+ #define HAL_RX_PPDU_START_INFO0_PPDU_ID		GENMASK(15, 0)
+ 
+ struct hal_rx_ppdu_start {
+--- a/drivers/net/wireless/ath/ath11k/peer.c
++++ b/drivers/net/wireless/ath/ath11k/peer.c
+@@ -94,6 +94,20 @@ struct ath11k_peer *ath11k_peer_find_by_
+ 	return NULL;
+ }
+ 
++struct ath11k_peer *ath11k_peer_find_by_ast(struct ath11k_base *ab,
++					   int ast_hash)
++{
++	struct ath11k_peer *peer;
++
++	lockdep_assert_held(&ab->base_lock);
++
++	list_for_each_entry(peer, &ab->peers, list)
++		if (ast_hash == peer->ast_hash)
++			return peer;
++
++	return NULL;
++}
++
+ #ifdef CPTCFG_ATH11K_NSS_SUPPORT
+ struct ath11k_ast_entry *ath11k_peer_ast_find_by_peer(struct ath11k_base *ab,
+ 						      struct ath11k_peer *peer,
+--- a/drivers/net/wireless/ath/ath11k/peer.h
++++ b/drivers/net/wireless/ath/ath11k/peer.h
+@@ -112,6 +112,7 @@ struct ath11k_peer *ath11k_peer_find(str
+ struct ath11k_peer *ath11k_peer_find_by_addr(struct ath11k_base *ab,
+ 					     const u8 *addr);
+ struct ath11k_peer *ath11k_peer_find_by_id(struct ath11k_base *ab, int peer_id);
++struct ath11k_peer *ath11k_peer_find_by_ast(struct ath11k_base *ab, int ast_hash);
+ void ath11k_peer_cleanup(struct ath11k *ar, u32 vdev_id);
+ int ath11k_peer_delete(struct ath11k *ar, u32 vdev_id, u8 *addr);
+ int ath11k_peer_create(struct ath11k *ar, struct ath11k_vif *arvif,
diff --git a/package/kernel/mac80211/patches/ath11k_nss/907-ath11k-remove-error-on-soc-debugfs-fail.patch b/package/kernel/mac80211/patches/ath11k_nss/907-ath11k-remove-error-on-soc-debugfs-fail.patch
new file mode 100644
index 00000000000000..b47785828a2bd9
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/907-ath11k-remove-error-on-soc-debugfs-fail.patch
@@ -0,0 +1,146 @@
+From 41363c3109235a96d90d5946bbc01d1cc8dad47e Mon Sep 17 00:00:00 2001
+From: Anilkumar Kolli <akolli@codeaurora.org>
+Date: Sun, 6 Sep 2020 11:01:38 +0530
+Subject: [PATCH] ath11k: update debugfs support for mupltiple radios in PCI
+bus
+
+debugfs_ath11k struct is moved to ath11k_core, since its common
+for both pci and ahb.
+
+Current ath11k_pci insmod fails if there are multiple PCI rdaios,
+debugfs directory is created with soc_name and bus_id to allow
+creating debugfs directory for second PCI radio.
+
+with this Debugfs entries looks like,
+ # ls -l /sys/kernel/debug/ath11k/
+ ipq8074 hw2.0 qcn9000 hw1.0_0000:01:00.0 qcn9000 hw1.0_0001:01:00.0
+
+ # ls -l /sys/kernel/debug/ath11k/ipq8074 hw2.0/
+   mac0  mac1 simulate_fw_crash soc_dp_stats
+
+ # ls -l /sys/kernel/debug/ath11k/qcn9000 hw1.0_0000:01:00.0
+   mac0 simulate_fw_crash soc_dp_stats
+
+ # /sys/kernel/debug/ath11k/qcn9000 hw1.0_0001:01:00.0:
+   mac0  simulate_fw_crash soc_dp_stats
+
+Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/core.c     | 12 +++++++
+ drivers/net/wireless/ath/ath11k/core.h     |  1 -
+ drivers/net/wireless/ath/ath11k/debugfs.c  | 57 ++++++++++++++++++++++++------
+ drivers/net/wireless/ath/ath11k/debugfs.h  | 11 ++++++
+ 5 files changed, 72 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -2260,5 +2260,17 @@ err_sc_free:
+ }
+ EXPORT_SYMBOL(ath11k_core_alloc);
+ 
++int ath11k_init(void)
++{
++	return ath11k_debugfs_create();
++}
++module_init(ath11k_init);
++
++void ath11k_exit(void)
++{
++	ath11k_debugfs_destroy();
++}
++module_exit(ath11k_exit);
++
+ MODULE_DESCRIPTION("Core module for Qualcomm Atheros 802.11ax wireless LAN cards.");
+ MODULE_LICENSE("Dual BSD/GPL");
+--- a/drivers/net/wireless/ath/ath11k/debugfs.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs.c
+@@ -15,6 +15,8 @@
+ #include "hif.h"
+ #include "qmi.h"
+ 
++struct dentry *debugfs_ath11k;
++
+ static const char *htt_bp_umac_ring[HTT_SW_UMAC_RING_IDX_MAX] = {
+ 	"REO2SW1_RING",
+ 	"REO2SW2_RING",
+@@ -1228,8 +1230,6 @@ int ath11k_debugfs_pdev_create(struct at
+ 
+ void ath11k_debugfs_pdev_destroy(struct ath11k_base *ab)
+ {
+-	debugfs_remove_recursive(ab->debugfs_soc);
+-	ab->debugfs_soc = NULL;
+ }
+ 
+ int ath11k_debugfs_soc_create(struct ath11k_base *ab)
+@@ -1282,6 +1282,24 @@ void ath11k_debugfs_soc_destroy(struct a
+ }
+ EXPORT_SYMBOL(ath11k_debugfs_soc_destroy);
+ 
++int ath11k_debugfs_create(void)
++{
++	debugfs_ath11k = debugfs_create_dir("ath11k", NULL);
++	if (IS_ERR_OR_NULL(debugfs_ath11k)) {
++		if (IS_ERR(debugfs_ath11k))
++			return PTR_ERR(debugfs_ath11k);
++		return -ENOMEM;
++	}
++
++	return 0;
++}
++
++void ath11k_debugfs_destroy(void)
++{
++	debugfs_remove_recursive(debugfs_ath11k);
++	debugfs_ath11k = NULL;
++}
++
+ void ath11k_debugfs_fw_stats_init(struct ath11k *ar)
+ {
+ 	struct dentry *fwstats_dir = debugfs_create_dir("fw_stats",
+@@ -1932,6 +1950,9 @@ void ath11k_debugfs_unregister(struct at
+ 		kfree(dbr_debug);
+ 		ar->debug.dbr_debug[i] = NULL;
+ 	}
++
++	debugfs_remove_recursive(ar->debug.debugfs_pdev);
++	ar->debug.debugfs_pdev = NULL;
+ }
+ 
+ static ssize_t ath11k_write_twt_add_dialog(struct file *file,
+@@ -2294,6 +2315,9 @@ int ath11k_debugfs_register(struct ath11
+ 	char pdev_name[10];
+ 	char buf[100] = {0};
+ 
++	if (!(IS_ERR_OR_NULL(ar->debug.debugfs_pdev)))
++		return 0;
++
+ 	snprintf(pdev_name, sizeof(pdev_name), "%s%u", "mac", ar->pdev_idx);
+ 
+ 	ar->debug.debugfs_pdev = debugfs_create_dir(pdev_name, ab->debugfs_soc);
+--- a/drivers/net/wireless/ath/ath11k/debugfs.h
++++ b/drivers/net/wireless/ath/ath11k/debugfs.h
+@@ -282,6 +282,8 @@ do {									\
+ #endif
+ 
+ #ifdef CPTCFG_ATH11K_DEBUGFS
++int ath11k_debugfs_create(void);
++void ath11k_debugfs_destroy(void);
+ int ath11k_debugfs_soc_create(struct ath11k_base *ab);
+ void ath11k_debugfs_soc_destroy(struct ath11k_base *ab);
+ int ath11k_debugfs_pdev_create(struct ath11k_base *ab);
+@@ -338,6 +340,15 @@ static inline int ath11k_debug_is_memory
+ }
+ 
+ #else
++static inline int ath11k_debugfs_create(void)
++{
++	return 0;
++}
++
++static inline void ath11k_debugfs_destroy(void)
++{
++}
++
+ static inline int ath11k_debugfs_soc_create(struct ath11k_base *ab)
+ {
+ 	return 0;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/908-301-ath11k-nss-mcbc-exception.patch b/package/kernel/mac80211/patches/ath11k_nss/908-301-ath11k-nss-mcbc-exception.patch
new file mode 100644
index 00000000000000..bba58322a254e7
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/908-301-ath11k-nss-mcbc-exception.patch
@@ -0,0 +1,253 @@
+From 91df8aa674d2d4064ab22f47515c3fb126527208 Mon Sep 17 00:00:00 2001
+From: Karthikeyan Kathirvel <kathirve@codeaurora.org>
+Date: Thu, 12 Nov 2020 15:02:56 +0530
+Subject: [PATCH] ath11k: NSS MCBC Exception added for STA
+
+Since NSS FW is not supporting PN check for MCBC pkts, those pkts are
+excepted from NSS offload to pass through mac80211 PN check.
+
+Signed-off-by: Karthikeyan Kathirvel <kathirve@codeaurora.org>
+Change-Id: I4a6ac67a1c2cf3ab7a219d0953907191606a5e70
+---
+ drivers/net/wireless/ath/ath11k/nss.c    | 128 +++++++++++++++++++++
+ drivers/net/wireless/ath/ath11k/nss.h |  51 ++++----
+ 2 files changed, 153 insertions(+), 26 deletions(-)
+ create mode 100644 mac80211/patches/301-ath11k-nss-mcbc-exception.patch
+
+--- a/drivers/net/wireless/ath/ath11k/nss.c
++++ b/drivers/net/wireless/ath/ath11k/nss.c
+@@ -611,7 +611,7 @@ static int ath11k_nss_undecap_nwifi(stru
+ 
+ static void ath11k_nss_wds_type_rx(struct ath11k *ar, struct net_device *dev,
+ 				   u8* src_mac, u8 is_sa_valid, u8 addr4_valid,
+-				   u16 peer_id, bool *drop)
++				   u16 peer_id)
+ {
+ 	struct ath11k_base *ab = ar->ab;
+ 	struct ath11k_ast_entry *ast_entry = NULL;
+@@ -647,8 +647,6 @@ static void ath11k_nss_wds_type_rx(struc
+ 			}
+ 		}
+ 
+-		if (!ta_peer->nss.ext_vdev_up)
+-			*drop = true;
+ 	}
+ 
+ 	spin_unlock_bh(&ab->base_lock);
+@@ -692,8 +690,7 @@ static void ath11k_nss_mec_handler(struc
+ 
+ static void ath11k_nss_vdev_spl_receive_ext_wdsdata(struct ath11k_vif *arvif,
+ 						    struct sk_buff *skb,
+-						    struct nss_wifi_vdev_wds_per_packet_metadata *wds_metadata,
+-						    bool *drop)
++						    struct nss_wifi_vdev_wds_per_packet_metadata *wds_metadata)
+ {
+ 	struct ath11k *ar = arvif->ar;
+ 	struct ath11k_base *ab = ar->ab;
+@@ -715,7 +712,7 @@ static void ath11k_nss_vdev_spl_receive_
+ 	switch (wds_type) {
+ 		case NSS_WIFI_VDEV_WDS_TYPE_RX:
+ 			ath11k_nss_wds_type_rx(ar, skb->dev, src_mac, is_sa_valid,
+-					       addr4_valid, peer_id, drop);
++					       addr4_valid, peer_id);
+ 			break;
+ 		case NSS_WIFI_VDEV_WDS_TYPE_MEC:
+ 			ath11k_nss_mec_handler(ar, (u8 *)(skb->data));
+@@ -778,14 +775,16 @@ ath11k_nss_vdev_special_data_receive(str
+ {
+ 	struct nss_wifi_vdev_per_packet_metadata *wifi_metadata = NULL;
+ 	struct nss_wifi_vdev_wds_per_packet_metadata *wds_metadata = NULL;
++	struct nss_wifi_vdev_addr4_data_metadata *addr4_metadata = NULL;
+ 	struct wireless_dev *wdev;
+ 	struct ieee80211_vif *vif;
+ 	struct ath11k_vif *arvif;
+ 	struct ath11k_base *ab;
+-	bool drop = false;
++	struct ath11k_skb_rxcb *rxcb;
+ 	bool eth_decap = false;
+ 	int data_offs = 0;
+ 	int ret = 0;
++	struct ath11k_peer *ta_peer = NULL;
+ 
+ 	if (!dev) {
+ 		dev_kfree_skb_any(skb);
+@@ -834,15 +833,50 @@ ath11k_nss_vdev_special_data_receive(str
+ 		return;
+ 	}
+ 
+-	if (eth_decap && wifi_metadata->pkt_type ==
+-	    NSS_WIFI_VDEV_EXT_DATA_PKT_TYPE_WDS_LEARN) {
+-		wds_metadata = &wifi_metadata->metadata.wds_metadata;
+-		ath11k_nss_vdev_spl_receive_ext_wdsdata(arvif, skb,
+-							wds_metadata, &drop);
+-	}
++	switch(wifi_metadata->pkt_type) {
++	case NSS_WIFI_VDEV_EXT_DATA_PKT_TYPE_WDS_LEARN:
++		if (eth_decap) {
++			wds_metadata = &wifi_metadata->metadata.wds_metadata;
++			ath11k_nss_vdev_spl_receive_ext_wdsdata(arvif, skb,
++								wds_metadata);
++		}
++		dev_kfree_skb_any(skb);
++	break;
++	case NSS_WIFI_VDEV_EXT_DATA_PKT_TYPE_MCBC_RX:
++		ath11k_dbg_dump(ab, ATH11K_DBG_DP_RX, "",
++			        "mcbc packet exception from nss: ",
++			        skb->data, skb->len);
++		rxcb = ATH11K_SKB_RXCB(skb);
++		rxcb->rx_desc = (struct hal_rx_desc *)skb->head;
++		rxcb->is_first_msdu = rxcb->is_last_msdu = true;
++		rxcb->is_continuation = false;
++		rxcb->is_mcbc = true;
++		ath11k_dp_rx_from_nss(arvif->ar, skb, napi);
++	break;
++	case NSS_WIFI_VDEV_EXT_DATA_PKT_TYPE_4ADDR:
++		if (eth_decap) {
++			addr4_metadata = &wifi_metadata->metadata.addr4_metadata;
++
++			spin_lock_bh(&ab->base_lock);
++			ta_peer = ath11k_peer_find_by_id(ab, addr4_metadata->peer_id);
++			if (!ta_peer) {
++				spin_unlock_bh(&ab->base_lock);
++				dev_kfree_skb_any(skb);
++				return;
++			}
+ 
+-	if (!drop)
+-		ath11k_nss_deliver_rx(arvif->vif, skb, eth_decap, data_offs, napi);
++			ath11k_dbg(ab, ATH11K_DBG_NSS_WDS, "4addr exception ta_peer %pM\n",
++				   ta_peer->addr);
++			if (!ta_peer->nss.ext_vdev_up && addr4_metadata->addr4_valid)
++			    ieee80211_rx_nss_notify_4addr(dev, ta_peer->addr);
++			spin_unlock_bh(&ab->base_lock);
++		}
++		dev_kfree_skb_any(skb);
++	break;
++	default:
++		ath11k_warn(ab, "unsupported pkt_type %d from nss\n", wifi_metadata->pkt_type);
++		dev_kfree_skb_any(skb);
++	}
+ }
+ 
+ static void
+@@ -1049,6 +1083,9 @@ int ath11k_nss_vdev_set_cmd(struct ath11
+ 	case ATH11K_NSS_WIFI_VDEV_CFG_WDS_BACKHAUL_CMD:
+ 		cmd = NSS_WIFI_VDEV_CFG_WDS_BACKHAUL_CMD;
+ 		break;
++	case ATH11K_NSS_WIFI_VDEV_CFG_MCBC_EXC_TO_HOST_CMD:
++		cmd = NSS_WIFI_VDEV_CFG_MCBC_EXC_TO_HOST_CMD;
++		break;
+ 	default:
+ 		return -EINVAL;
+ 	}
+@@ -1299,12 +1336,31 @@ int ath11k_nss_vdev_create(struct ath11k
+ 		goto free_vdev;
+ 
+ 	switch (arvif->vif->type) {
+-	case NL80211_IFTYPE_AP:
+ 	case NL80211_IFTYPE_STATION:
+ 		ret = ath11k_nss_vdev_configure(arvif);
+ 		if (ret)
+ 			goto unregister_vdev;
+ 
++		ret = ath11k_nss_vdev_set_cmd(arvif,
++					      ATH11K_NSS_WIFI_VDEV_CFG_MCBC_EXC_TO_HOST_CMD,
++					      ATH11K_NSS_ENABLE_MCBC_EXC);
++		if (ret) {
++			ath11k_err(ab, "failed to set MCBC in nss %d\n", ret);
++			goto unregister_vdev;
++		}
++		break;
++	case NL80211_IFTYPE_AP:
++		ret = ath11k_nss_vdev_configure(arvif);
++		if (ret)
++			goto unregister_vdev;
++
++		ret = ath11k_nss_vdev_set_cmd(arvif,
++					      ATH11K_NSS_WIFI_VDEV_CFG_WDS_BACKHAUL_CMD,
++					      true);
++		if (ret) {
++			ath11k_warn(ab, "failed to cfg wds backhaul in nss %d\n", ret);
++			goto unregister_vdev;
++		}
+ 		break;
+ 	default:
+ 		ret = -ENOTSUPP;
+@@ -1463,7 +1519,7 @@ int ath11k_nss_ext_vdev_cfg_wds_peer(str
+ 
+ 	cfg_wds_msg = &ext_vdev_msg->msg.wmsg;
+ 	cfg_wds_msg->wds_peer_id = wds_peer_id;
+-	ether_addr_copy(cfg_wds_msg->mac_addr, wds_addr);
++	ether_addr_copy((u8 *) cfg_wds_msg->mac_addr, wds_addr);
+ 
+ 	nss_wifi_ext_vdev_msg_init(ext_vdev_msg, arvif->nss.if_num,
+ 				   NSS_WIFI_EXT_VDEV_MSG_CONFIGURE_WDS,
+@@ -1587,7 +1643,6 @@ static int ath11k_nss_ext_vdev_register(
+ {
+ 	struct ath11k *ar = arvif->ar;
+ 	struct ath11k_base *ab = ar->ab;
+-	nss_tx_status_t status;
+ 	u32 features = 0;
+ 
+ 	if (arvif->vif->type != NL80211_IFTYPE_AP_VLAN || arvif->nss.ctx)
+@@ -1601,7 +1656,7 @@ static int ath11k_nss_ext_vdev_register(
+ 
+ 	if (!arvif->nss.ctx) {
+ 		ath11k_warn(ab, "failed to register nss vdev if_num %d nss_err:%d\n",
+-			    arvif->nss.if_num, status);
++			    arvif->nss.if_num, NSS_TX_FAILURE);
+ 		return -EINVAL;
+ 	}
+ 
+--- a/drivers/net/wireless/ath/ath11k/nss.h
++++ b/drivers/net/wireless/ath/ath11k/nss.h
+@@ -110,10 +110,14 @@ enum ath11k_nss_vdev_cmd {
+ 	ATH11K_NSS_WIFI_VDEV_ENCAP_TYPE_CMD,
+ 	ATH11K_NSS_WIFI_VDEV_DECAP_TYPE_CMD,
+ 	ATH11K_NSS_WIFI_VDEV_CFG_WDS_BACKHAUL_CMD,
++	ATH11K_NSS_WIFI_VDEV_CFG_MCBC_EXC_TO_HOST_CMD,
+ };
+ 
+ #define WIFILI_SCHEME_ID_INVALID	-1
+ 
++/* Enables the MCBC exception in NSS fw, 1 = enable */
++#define ATH11K_NSS_ENABLE_MCBC_EXC	1
++
+ enum ath11k_nss_opmode {
+ 	ATH11K_NSS_OPMODE_UNKNOWN,
+ 	ATH11K_NSS_OPMODE_AP,
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -3086,6 +3086,23 @@ static void ath11k_dp_rx_process_receive
+ 	}
+ }
+ 
++void ath11k_dp_rx_from_nss(struct ath11k *ar, struct sk_buff *msdu,
++                           struct napi_struct *napi)
++{
++	struct ieee80211_rx_status rx_status = {0};
++	struct ath11k_skb_rxcb *rxcb;
++	bool fast_rx = false;
++
++	rxcb = ATH11K_SKB_RXCB(msdu);
++
++	ath11k_dp_rx_h_ppdu(ar, rxcb->rx_desc, &rx_status);
++	ath11k_dp_rx_h_mpdu(ar, msdu, rxcb->rx_desc, &rx_status, &fast_rx);
++
++	rx_status.flag |= RX_FLAG_SKIP_MONITOR | RX_FLAG_DUP_VALIDATED;
++
++	ath11k_dp_rx_deliver_msdu(ar, napi, msdu, &rx_status);
++}
++
+ int ath11k_dp_process_rx(struct ath11k_base *ab, int ring_id,
+ 			 struct napi_struct *napi, int budget)
+ {
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.h
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.h
+@@ -157,4 +157,6 @@ bool ath11k_dp_rx_h_attn_is_mcbc(struct
+ 				 struct hal_rx_desc *desc);
+ u16 ath11k_dp_rx_h_mpdu_start_peer_id(struct ath11k_base *ab,
+ 				      struct hal_rx_desc *desc);
++void ath11k_dp_rx_from_nss(struct ath11k *ar, struct sk_buff *msdu,
++                           struct napi_struct *napi);
+ #endif /* ATH11K_DP_RX_H */
diff --git a/package/kernel/mac80211/patches/ath11k_nss/908-330-ath11k-sync-wds_ast_entry-updates.patch b/package/kernel/mac80211/patches/ath11k_nss/908-330-ath11k-sync-wds_ast_entry-updates.patch
new file mode 100644
index 00000000000000..6ebd709e7d3298
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/908-330-ath11k-sync-wds_ast_entry-updates.patch
@@ -0,0 +1,522 @@
+From 9e1f28f343347774b01f330d76d2c5323fcd07ae Mon Sep 17 00:00:00 2001
+From: Rameshkumar Sundaram <ramess@codeaurora.org>
+Date: Fri, 24 Sep 2021 18:25:08 +0530
+Subject: [PATCH] ath11k: sync wds ast entry on peer/entry deletions
+
+Peer specific ast entries list is shared between
+peer_unmap_event(softirq) and peer_ast_wds_wmi_wk
+(worker). The worker sends a WMI command and hence tends to
+sleep.
+complete_work_sync() is used in peer_unmap_event bh handler
+which tries to yield the CPU(calls schedule)
+until the worker completes. This results kernel reporting
+schedule in atomic context and system crash.
+Add new global wmi_ast_list and add all ast add/update
+work to this list.
+Add a new global wmi_ast_work and queue this
+work on each entry to global wmi_ast_list list.
+Process the wmi_ast_list in worker and send updates
+to FW.
+Each ast entry node is shared between global wmi_ast list
+and peer specific ast_list and deletes will be done
+in sync between two lists.
+On peer deletion all the peer specific entries will
+be deleted from wmi_ast_list and peer delete in progress
+will be set to avoid new ast entries adding up and therefore
+peer unmap evnt won't find any ast worker in progress
+entries to free in irq context.
+This peer ast cleanup and worker processing same entry
+will be synchronized with new base_ast_lock mutex.
+FW indpendently Deleting a single wds ast entry in irq context &
+worker already processing the same cannot be synchronized.
+As we can't hold bh scheduling while worker tries to sleep,
+and entry in scheduled update work will be sent to FW.
+
+Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/ahb.c  |   1 +
+ drivers/net/wireless/ath/ath11k/core.c |   3 +
+ drivers/net/wireless/ath/ath11k/core.h |   4 +
+ drivers/net/wireless/ath/ath11k/nss.c  |   6 +-
+ drivers/net/wireless/ath/ath11k/nss.h  |   8 +-
+ drivers/net/wireless/ath/ath11k/pci.c  |   1 +
+ drivers/net/wireless/ath/ath11k/peer.c | 172 ++++++++++++++++++++++++---------
+ drivers/net/wireless/ath/ath11k/peer.h |   3 +-
+ 8 files changed, 144 insertions(+), 54 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/ahb.c
++++ b/drivers/net/wireless/ath/ath11k/ahb.c
+@@ -1245,6 +1245,7 @@ static void ath11k_ahb_remove_prepare(st
+ 	set_bit(ATH11K_FLAG_UNREGISTERING, &ab->dev_flags);
+ 	cancel_work_sync(&ab->restart_work);
+ 	cancel_work_sync(&ab->qmi.event_work);
++	cancel_work_sync(&ab->wmi_ast_work);
+ }
+ 
+ static void ath11k_ahb_free_resources(struct ath11k_base *ab)
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -2230,6 +2230,7 @@ struct ath11k_base *ath11k_core_alloc(st
+ 
+ 	mutex_init(&ab->core_lock);
+ 	mutex_init(&ab->tbl_mtx_lock);
++	mutex_init(&ab->base_ast_lock);
+ 	spin_lock_init(&ab->base_lock);
+ 	mutex_init(&ab->vdev_id_11d_lock);
+ 	init_completion(&ab->reset_complete);
+@@ -2243,6 +2244,8 @@ struct ath11k_base *ath11k_core_alloc(st
+ 	INIT_WORK(&ab->restart_work, ath11k_core_restart);
+ 	INIT_WORK(&ab->update_11d_work, ath11k_update_11d);
+ 	INIT_WORK(&ab->reset_work, ath11k_core_reset);
++	INIT_WORK(&ab->wmi_ast_work, ath11k_peer_ast_wds_wmi_wk);
++	INIT_LIST_HEAD(&ab->wmi_ast_list);
+ 	timer_setup(&ab->rx_replenish_retry, ath11k_ce_rx_replenish_retry, 0);
+ 	init_completion(&ab->htc_suspend);
+ 	init_completion(&ab->wow.wakeup_completed);
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -32,6 +32,7 @@
+ #include "rx_desc.h"
+ #include "nss.h"
+ #include "vendor.h"
++#include "peer.h"
+ 
+ #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
+ 
+@@ -1131,6 +1132,11 @@ struct ath11k_base {
+ 
+ 	u32 max_ast_index;
+ 	u32 num_ast_entries;
++
++	struct mutex base_ast_lock;
++	struct work_struct wmi_ast_work;
++	struct list_head wmi_ast_list;
++
+ 	/* must be last */
+ 	u8 drv_priv[] __aligned(sizeof(void *));
+ };
+--- a/drivers/net/wireless/ath/ath11k/nss.c
++++ b/drivers/net/wireless/ath/ath11k/nss.c
+@@ -691,8 +691,9 @@ static void ath11k_nss_wds_type_rx(struc
+ 	spin_unlock_bh(&ab->base_lock);
+ }
+ 
+-static void ath11k_nss_mec_handler(struct ath11k *ar, u8* mec_mac_addr)
++static void ath11k_nss_mec_handler(struct ath11k_vif *arvif, u8* mec_mac_addr)
+ {
++	struct ath11k *ar = arvif->ar;
+ 	struct ath11k_base *ab = ar->ab;
+ 	struct ath11k_peer *peer = ar->bss_peer;
+ 	u8 mac_addr[ETH_ALEN];
+@@ -719,7 +720,7 @@ static void ath11k_nss_mec_handler(struc
+ 	memcpy(mac_addr, mac_addr_h16, ETH_ALEN - 4);
+ 	memcpy(mac_addr + 2, mac_addr_l32, 4);
+ 
+-	if (!ether_addr_equal(ar->mac_addr, mac_addr)) {
++	if (!ether_addr_equal(arvif->vif->addr, mac_addr)) {
+ 		spin_lock_bh(&ab->base_lock);
+ 		ath11k_peer_add_ast(ar, peer, mac_addr,
+ 				    ATH11K_AST_TYPE_MEC);
+@@ -754,7 +755,7 @@ static void ath11k_nss_vdev_spl_receive_
+ 					       addr4_valid, peer_id);
+ 			break;
+ 		case NSS_WIFI_VDEV_WDS_TYPE_MEC:
+-			ath11k_nss_mec_handler(ar, (u8 *)(skb->data));
++			ath11k_nss_mec_handler(arvif, (u8 *)(skb->data));
+ 			break;
+ 		default:
+ 			ath11k_warn(ab, "unsupported wds_type %d\n", wds_type);
+@@ -3848,11 +3849,7 @@ int ath11k_nss_add_wds_peer(struct ath11
+ 	wds_peer_msg->ast_type = type;
+ 	wds_peer_msg->peer_id = peer->peer_id;
+ 
+-	if (type == ATH11K_AST_TYPE_MEC)
+-		ether_addr_copy(wds_peer_msg->peer_mac, ar->mac_addr);
+-	else
+-		ether_addr_copy(wds_peer_msg->peer_mac, peer->addr);
+-
++	ether_addr_copy(wds_peer_msg->peer_mac, peer->addr);
+ 	ether_addr_copy(wds_peer_msg->dest_mac, dest_mac);
+ 
+ 	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
+@@ -3975,7 +3972,7 @@ msg_free:
+ 	return ret;
+ }
+ 
+-int ath11k_nss_del_wds_peer(struct ath11k *ar, struct ath11k_peer *peer,
++int ath11k_nss_del_wds_peer(struct ath11k *ar, u8 *peer_addr, int peer_id,
+ 			    u8 *dest_mac)
+ {
+ 	struct ath11k_base *ab = ar->ab;
+@@ -3993,8 +3990,8 @@ int ath11k_nss_del_wds_peer(struct ath11
+ 
+ 	wds_peer_msg->pdev_id = ar->pdev->pdev_id;
+ 	wds_peer_msg->ast_type = ATH11K_AST_TYPE_NONE;
+-	wds_peer_msg->peer_id = peer->peer_id;
+-	ether_addr_copy(wds_peer_msg->peer_mac, peer->addr);
++	wds_peer_msg->peer_id = peer_id;
++	ether_addr_copy(wds_peer_msg->peer_mac, peer_addr);
+ 	ether_addr_copy(wds_peer_msg->dest_mac, dest_mac);
+ 
+ 	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
+--- a/drivers/net/wireless/ath/ath11k/nss.h
++++ b/drivers/net/wireless/ath/ath11k/nss.h
+@@ -291,8 +291,8 @@ int ath11k_nss_update_wds_peer(struct at
+ 			       u8 *dest_mac);
+ int ath11k_nss_map_wds_peer(struct ath11k *ar, struct ath11k_peer *peer,
+ 			    u8 *dest_mac, enum ath11k_ast_entry_type type);
+-int ath11k_nss_del_wds_peer(struct ath11k *ar, struct ath11k_peer *peer,
+-			    u8 *dest_mac);
++int ath11k_nss_del_wds_peer(struct ath11k *ar, u8 *peer_addr,
++			    int peer_id, u8 *dest_mac);
+ int ath11k_nss_ext_vdev_cfg_wds_peer(struct ath11k_vif *arvif,
+ 				     u8 *wds_addr, u32 wds_peer_id);
+ int ath11k_nss_ext_vdev_wds_4addr_allow(struct ath11k_vif *arvif,
+@@ -404,8 +404,8 @@ static inline int ath11k_nss_map_wds_pee
+ 	return 0;
+ }
+ 
+-static inline int ath11k_nss_del_wds_peer(struct ath11k_vif *arvif, struct ath11k_peer *peer,
+-			    u8 *dest_mac)
++static inline int ath11k_nss_del_wds_peer(struct ath11k *ar, u8 *peer_addr,
++					  int peer_id, u8 *dest_mac)
+ {
+ 	return 0;
+ }
+--- a/drivers/net/wireless/ath/ath11k/pci.c
++++ b/drivers/net/wireless/ath/ath11k/pci.c
+@@ -970,6 +970,7 @@ static void ath11k_pci_remove(struct pci
+ 	}
+ 
+ 	set_bit(ATH11K_FLAG_UNREGISTERING, &ab->dev_flags);
++	cancel_work_sync(&ab->wmi_ast_work);
+ 
+ 	ath11k_core_deinit(ab);
+ 
+--- a/drivers/net/wireless/ath/ath11k/peer.c
++++ b/drivers/net/wireless/ath/ath11k/peer.c
+@@ -160,49 +160,68 @@ struct ath11k_ast_entry *ath11k_peer_ast
+ 
+ void ath11k_peer_ast_wds_wmi_wk(struct work_struct *wk)
+ {
+-	struct ath11k_ast_entry *ast_entry = container_of(wk,
+-							  struct ath11k_ast_entry,
+-							  wds_wmi_wk);
+-	struct ath11k *ar;
++	struct ath11k_ast_entry *ast_entry, *entry;
++	struct ath11k_base *ab = container_of(wk, struct ath11k_base, wmi_ast_work);
+ 	struct ath11k_peer *peer;
++	struct ath11k *ar;
+ 	int ret;
++	u8 peer_addr[ETH_ALEN];
++	int peer_id;
+ 
+-	if (!ast_entry)
+-		return;
++	ast_entry = kzalloc(sizeof(*ast_entry), GFP_ATOMIC);
+ 
+-	ar = ast_entry->ar;
+-	peer = ast_entry->peer;
++	mutex_lock(&ab->base_ast_lock);
++	spin_lock_bh(&ab->base_lock);
++
++	while ((entry = list_first_entry_or_null(&ab->wmi_ast_list,
++	       struct ath11k_ast_entry, wmi_list))) {
++		list_del_init(&entry->wmi_list);
+ 
+-	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "ath11k_peer_ast_wds_wmi_wk action %d ast_entry %pM next_node %pM vdev %d\n",
+-		   ast_entry->action, ast_entry->addr, ast_entry->next_node_mac,
+-		   ast_entry->vdev_id);
+-
+-	if (ast_entry->action == ATH11K_WDS_WMI_ADD) {
+-		ret = ath11k_wmi_send_add_update_wds_entry_cmd(ar,
+-							       ast_entry->next_node_mac,
+-							       ast_entry->addr,
+-							       ast_entry->vdev_id,
+-							       true);
+-		if (ret) {
+-			ath11k_warn(ar->ab, "add wds_entry_cmd failed %d for %pM next_node %pM\n",
+-				    ret, ast_entry->addr,
+-				    ast_entry->next_node_mac);
+-			if (peer)
+-				ath11k_nss_del_wds_peer(ar, peer,
+-							ast_entry->addr);
++		if (!entry->ar || (entry->peer && entry->peer->delete_in_progress)) {
++			continue;
+ 		}
+-	} else if (ast_entry->action == ATH11K_WDS_WMI_UPDATE) {
+-		if (!peer)
+-			return;
++		memcpy(ast_entry, entry, sizeof(*ast_entry));
++		ar = ast_entry->ar;
++		peer = ast_entry->peer;
++		memcpy(peer_addr, peer->addr, sizeof(peer_addr));
++		peer_id = peer->peer_id;
++
++		ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
++			   "ath11k_peer_ast_wds_wmi_wk action %d ast_entry %pM peer %pM vdev %d\n",
++			   ast_entry->action, ast_entry->addr, peer_addr,
++			   ast_entry->vdev_id);
+ 
+-		ret = ath11k_wmi_send_add_update_wds_entry_cmd(ar, peer->addr,
+-							       ast_entry->addr,
+-							       ast_entry->vdev_id,
+-							       false);
+-		if (ret)
+-			ath11k_warn(ar->ab, "update wds_entry_cmd failed %d for %pM on peer %pM\n",
+-				    ret, ast_entry->addr, peer->addr);
++		if (ast_entry->action == ATH11K_WDS_WMI_ADD) {
++			spin_unlock_bh(&ab->base_lock);
++			ret = ath11k_wmi_send_add_update_wds_entry_cmd(ar, peer_addr,
++								       ast_entry->addr,
++								       ast_entry->vdev_id,
++								       true);
++			if (ret) {
++				ath11k_warn(ar->ab, "add wds_entry_cmd failed %d for %pM, peer %pM\n",
++					    ret, ast_entry->addr, peer_addr);
++				if (peer)
++					ath11k_nss_del_wds_peer(ar, peer_addr, peer_id,
++								ast_entry->addr);
++			}
++		} else if (ast_entry->action == ATH11K_WDS_WMI_UPDATE) {
++				if (!peer) {
++					continue;
++				}
++				spin_unlock_bh(&ab->base_lock);
++				ret = ath11k_wmi_send_add_update_wds_entry_cmd(ar, peer_addr,
++									       ast_entry->addr,
++									       ast_entry->vdev_id,
++									       false);
++				if (ret)
++					ath11k_warn(ar->ab, "update wds_entry_cmd failed %d for %pM on peer %pM\n",
++						    ret, ast_entry->addr, peer_addr);
++		}
++		spin_lock_bh(&ab->base_lock);
+ 	}
++	spin_unlock_bh(&ab->base_lock);
++	mutex_unlock(&ab->base_ast_lock);
++	kfree(ast_entry);
+ }
+ 
+ int ath11k_peer_add_ast(struct ath11k *ar, struct ath11k_peer *peer,
+@@ -211,6 +230,8 @@ int ath11k_peer_add_ast(struct ath11k *a
+ 	struct ath11k_ast_entry *ast_entry = NULL;
+ 	struct ath11k_base *ab = ar->ab;
+ 
++	lockdep_assert_held(&ab->base_lock);
++
+ 	if (ab->num_ast_entries == ab->max_ast_index) {
+ 		ath11k_warn(ab, "failed to add ast for %pM due to insufficient ast entry resource %d in target\n",
+ 			    mac_addr, ab->max_ast_index);
+@@ -226,6 +247,9 @@ int ath11k_peer_add_ast(struct ath11k *a
+ 		}
+ 	}
+ 
++	if (peer && peer->delete_in_progress)
++		return -EINVAL;
++
+ 	ast_entry = kzalloc(sizeof(*ast_entry), GFP_ATOMIC);
+ 	if (!ast_entry) {
+ 		ath11k_warn(ab, "failed to alloc ast_entry for %pM\n",
+@@ -257,7 +281,7 @@ int ath11k_peer_add_ast(struct ath11k *a
+ 	}
+ 
+ 	INIT_LIST_HEAD(&ast_entry->ase_list);
+-	INIT_WORK(&ast_entry->wds_wmi_wk, ath11k_peer_ast_wds_wmi_wk);
++	INIT_LIST_HEAD(&ast_entry->wmi_list);
+ 	ast_entry->vdev_id = peer->vdev_id;
+ 	ast_entry->pdev_idx = peer->pdev_idx;
+ 	ast_entry->is_mapped = false;
+@@ -271,16 +295,12 @@ int ath11k_peer_add_ast(struct ath11k *a
+ 	ath11k_dbg(ab, ATH11K_DBG_MAC, "ath11k_peer_add_ast peer %pM ast_entry %pM, ast_type %d\n",
+ 		   peer->addr, mac_addr, ast_entry->type);
+ 
+-	if (type == ATH11K_AST_TYPE_MEC)
+-		ether_addr_copy(ast_entry->next_node_mac, ar->mac_addr);
+-	else if (type == ATH11K_AST_TYPE_WDS)
+-		ether_addr_copy(ast_entry->next_node_mac, peer->addr);
+-
+ 	if ((ast_entry->type == ATH11K_AST_TYPE_WDS) ||
+ 	    (ast_entry->type == ATH11K_AST_TYPE_MEC)) {
+ 		ath11k_nss_add_wds_peer(ar, peer, mac_addr, ast_entry->type);
+ 		ast_entry->action = ATH11K_WDS_WMI_ADD;
+-		ieee80211_queue_work(ar->hw, &ast_entry->wds_wmi_wk);
++		list_add_tail(&ast_entry->wmi_list, &ab->wmi_ast_list);
++		ieee80211_queue_work(ar->hw, &ab->wmi_ast_work);
+ 	}
+ 
+ 	ab->num_ast_entries++;
+@@ -293,6 +313,8 @@ int ath11k_peer_update_ast(struct ath11k
+ 	struct ath11k_peer *old_peer = ast_entry->peer;
+ 	struct ath11k_base *ab = ar->ab;
+ 
++	lockdep_assert_held(&ab->base_lock);
++
+ 	if (!ast_entry->is_mapped) {
+ 		ath11k_warn(ab, "ath11k_peer_update_ast: ast_entry %pM not mapped yet\n",
+ 			    ast_entry->addr);
+@@ -305,6 +327,9 @@ int ath11k_peer_update_ast(struct ath11k
+ 	    (ast_entry->is_active))
+ 		return 0;
+ 
++	if (peer && peer->delete_in_progress)
++                return -EINVAL;
++
+ 	ast_entry->vdev_id = peer->vdev_id;
+ 	ast_entry->pdev_idx = peer->pdev_idx;
+ 	ast_entry->type = ATH11K_AST_TYPE_WDS;
+@@ -317,7 +342,14 @@ int ath11k_peer_update_ast(struct ath11k
+ 		   old_peer->addr, peer->addr, ast_entry->addr);
+ 
+ 	ast_entry->action = ATH11K_WDS_WMI_UPDATE;
+-	ieee80211_queue_work(ar->hw, &ast_entry->wds_wmi_wk);
++
++	/* wmi_list entry might've been processed & removed.*/
++	if (list_empty(&ast_entry->wmi_list))
++		list_add_tail(&ast_entry->wmi_list, &ab->wmi_ast_list);
++	else
++		list_move_tail(&ast_entry->wmi_list, &ab->wmi_ast_list);
++
++	ieee80211_queue_work(ar->hw, &ab->wmi_ast_work);
+ 
+ 	return 0;
+ }
+@@ -363,16 +395,23 @@ void ath11k_peer_del_ast(struct ath11k *
+ 	ath11k_dbg(ab, ATH11K_DBG_MAC, "ath11k_peer_del_ast pdev:%d peer %pM ast_entry %pM\n",
+ 		   ar->pdev->pdev_id, peer->addr, ast_entry->addr);
+ 
+-	if (ast_entry->is_mapped)
+-		list_del(&ast_entry->ase_list);
++	if ((ast_entry->type == ATH11K_AST_TYPE_WDS) ||
++		(ast_entry->type == ATH11K_AST_TYPE_MEC)) {
++		if (!list_empty(&ast_entry->wmi_list)) {
++			ath11k_dbg(ab, ATH11K_DBG_MAC,
++				   "ath11k_peer_del_ast deleting unprocessed ast entry %pM "
++				   "of peer %pM from wmi list\n", ast_entry->addr, peer->addr);
++			list_del_init(&ast_entry->wmi_list);
++		}
++	}
++	list_del(&ast_entry->ase_list);
+ 
+ 	/* WDS, MEC type AST entries need to be deleted on NSS */
+ 	if (ast_entry->next_hop)
+-		ath11k_nss_del_wds_peer(ar, peer, ast_entry->addr);
++		ath11k_nss_del_wds_peer(ar, peer->addr, peer->peer_id,
++					ast_entry->addr);
+ 
+-	cancel_work_sync(&ast_entry->wds_wmi_wk);
+ 	kfree(ast_entry);
+-
+ 	ab->num_ast_entries--;
+ }
+ 
+@@ -681,6 +720,10 @@ void ath11k_peer_cleanup(struct ath11k *
+ 
+ 	lockdep_assert_held(&ar->conf_mutex);
+ 
++#ifdef CPTCFG_ATH11K_NSS_SUPPORT
++	mutex_lock(&ab->base_ast_lock);
++#endif
++
+ 	mutex_lock(&ab->tbl_mtx_lock);
+ 	spin_lock_bh(&ab->base_lock);
+ 	list_for_each_entry_safe(peer, tmp_peer, &ab->peers, list) {
+@@ -709,6 +752,9 @@ void ath11k_peer_cleanup(struct ath11k *
+ 
+ 	spin_unlock_bh(&ab->base_lock);
+ 	mutex_unlock(&ab->tbl_mtx_lock);
++#ifdef CPTCFG_ATH11K_NSS_SUPPORT
++	mutex_unlock(&ab->base_ast_lock);
++#endif
+ }
+ 
+ static int ath11k_wait_for_peer_deleted(struct ath11k *ar, int vdev_id, const u8 *addr)
+@@ -743,12 +789,18 @@ static int __ath11k_peer_delete(struct a
+ 	int ret;
+ 	struct ath11k_peer *peer;
+ 	struct ath11k_base *ab = ar->ab;
++#ifdef CPTCFG_ATH11K_NSS_SUPPORT
++	struct ath11k_ast_entry *ast_entry, *tmp_ast;
++#endif
+ 
+ 	lockdep_assert_held(&ar->conf_mutex);
+ 
+ 	reinit_completion(&ar->peer_delete_done);
+ 	ath11k_nss_peer_delete(ar->ab, vdev_id, addr);
+ 
++#ifdef CPTCFG_ATH11K_NSS_SUPPORT
++	mutex_lock(&ab->base_ast_lock);
++#endif
+ 	mutex_lock(&ab->tbl_mtx_lock);
+ 	spin_lock_bh(&ab->base_lock);
+ 
+@@ -771,17 +823,35 @@ static int __ath11k_peer_delete(struct a
+ 		return -EINVAL;
+ 	}
+ 
+-	/* Check if the found peer is what we want to remove.
+-	 * While the sta is transitioning to another band we may
+-	 * have 2 peer with the same addr assigned to different
+-	 * vdev_id. Make sure we are deleting the correct peer.
+-	 */
+-	if (peer && peer->vdev_id == vdev_id)
++	if (peer) {
++#ifdef CPTCFG_ATH11K_NSS_SUPPORT
++		peer->delete_in_progress = true;
++		if (peer->self_ast_entry) {
++			ath11k_peer_del_ast(ar, peer->self_ast_entry);
++			peer->self_ast_entry = NULL;
++		}
++
++		list_for_each_entry_safe(ast_entry, tmp_ast,
++					 &peer->ast_entry_list, ase_list)
++			if ((ast_entry->type == ATH11K_AST_TYPE_WDS) ||
++			    (ast_entry->type == ATH11K_AST_TYPE_MEC)) {
++				if (!list_empty(&ast_entry->wmi_list)) {
++					ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
++						   "%s deleting unprocessed ast entry %pM of peer %pM from wmi list\n",
++						   __func__, ast_entry->addr, addr);
++					list_del_init(&ast_entry->wmi_list);
++				}
++			}
++#endif
+ 		ath11k_peer_rhash_delete(ab, peer);
++	}
+ 
+ 	spin_unlock_bh(&ab->base_lock);
+ 	mutex_unlock(&ab->tbl_mtx_lock);
+ 
++#ifdef CPTCFG_ATH11K_NSS_SUPPORT
++	mutex_unlock(&ab->base_ast_lock);
++#endif
+ 
+ 	ret = ath11k_wmi_send_peer_delete_cmd(ar, addr, vdev_id);
+ 	if (ret) {
+--- a/drivers/net/wireless/ath/ath11k/peer.h
++++ b/drivers/net/wireless/ath/ath11k/peer.h
+@@ -31,9 +31,7 @@ enum ath11k_wds_wmi_action {
+ struct ath11k_ast_entry {
+ 	u16 ast_idx;
+ 	u8 addr[ETH_ALEN];
+-	u8 next_node_mac[ETH_ALEN];
+ 	enum ath11k_wds_wmi_action action;
+-	struct work_struct wds_wmi_wk;
+ 	struct ath11k_peer *peer;
+ 	struct ath11k *ar;
+ 	bool next_hop;
+@@ -47,6 +45,7 @@ struct ath11k_ast_entry {
+ 	bool delete_in_progress;
+ 	void *cookie;
+ 	struct list_head ase_list;
++	struct list_head wmi_list;
+ };
+ 
+ struct ppdu_user_delayba {
+@@ -97,6 +96,7 @@ struct ath11k_peer {
+ 	bool dp_setup_done;
+ 	struct ppdu_user_delayba ppdu_stats_delayba;
+ 	bool delayba_flag;
++	bool delete_in_progress;
+ };
+ 
+ void ath11k_peer_unmap_event(struct ath11k_base *ab, u16 peer_id);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/908-362-ath11k-fix-incorrect-ast-index-assignment-for-wds-peer.patch b/package/kernel/mac80211/patches/ath11k_nss/908-362-ath11k-fix-incorrect-ast-index-assignment-for-wds-peer.patch
new file mode 100644
index 00000000000000..f734c5aea8d876
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/908-362-ath11k-fix-incorrect-ast-index-assignment-for-wds-peer.patch
@@ -0,0 +1,96 @@
+From 396176575be9767a79d451fba4fe2931305f0435 Mon Sep 17 00:00:00 2001
+From: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
+Date: Mon, 7 Nov 2022 21:49:20 +0530
+Subject: [PATCH] ath11k: fix incorrect ast index assignment for wds peer
+
+Currently, same ast index is assigned for different nss wds peer mac
+addresses which is incorrect. However, firmware provides the correct
+and different ast index for different mac addresses.
+
+Hence, fix this issue by assigning the correct ast index provided by
+the firmware.
+
+Signed-off-by: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/nss.c  | 5 +++--
+ drivers/net/wireless/ath/ath11k/nss.h  | 6 ++++--
+ drivers/net/wireless/ath/ath11k/peer.c | 3 +--
+ 3 files changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/nss.c
++++ b/drivers/net/wireless/ath/ath11k/nss.c
+@@ -805,8 +805,6 @@ ath11k_nss_vdev_special_data_receive(str
+ 	struct nss_wifi_vdev_per_packet_metadata *wifi_metadata = NULL;
+ 	struct nss_wifi_vdev_wds_per_packet_metadata *wds_metadata = NULL;
+ 	struct nss_wifi_vdev_addr4_data_metadata *addr4_metadata = NULL;
+-	struct wireless_dev *wdev;
+-	struct ieee80211_vif *vif;
+ 	struct ath11k_vif *arvif;
+ 	struct ath11k_base *ab;
+ 	struct ath11k_skb_rxcb *rxcb;
+@@ -2487,13 +2485,14 @@ msg_free:
+ }
+ 
+ int ath11k_nss_map_wds_peer(struct ath11k *ar, struct ath11k_peer *peer,
+-			    u8 *dest_mac, enum ath11k_ast_entry_type type)
++			    u8 *dest_mac, struct ath11k_ast_entry *ast_entry)
+ {
+ 	struct ath11k_base *ab = ar->ab;
+ 	struct nss_wifili_wds_peer_map_msg *wds_peer_map_msg;
+ 	struct nss_wifili_msg *wlmsg = NULL;
+ 	nss_wifili_msg_callback_t msg_cb;
+ 	nss_tx_status_t status;
++	enum ath11k_ast_entry_type type = ast_entry->type;
+ 	int ret = 0;
+ 
+ 	wlmsg = kzalloc(sizeof(struct nss_wifili_msg), GFP_ATOMIC);
+@@ -2503,7 +2502,7 @@ int ath11k_nss_map_wds_peer(struct ath11
+ 	wds_peer_map_msg = &wlmsg->msg.wdspeermapmsg;
+ 
+ 	wds_peer_map_msg->vdev_id = peer->vdev_id;
+-	wds_peer_map_msg->ast_idx = peer->hw_peer_id;
++	wds_peer_map_msg->ast_idx = ast_entry->ast_idx;
+ 
+ 	if (type == ATH11K_AST_TYPE_MEC)
+ 		wds_peer_map_msg->peer_id = NSS_WIFILI_MEC_PEER_ID;
+--- a/drivers/net/wireless/ath/ath11k/nss.h
++++ b/drivers/net/wireless/ath/ath11k/nss.h
+@@ -16,6 +16,7 @@ struct ath11k;
+ struct ath11k_base;
+ struct ath11k_vif;
+ struct ath11k_peer;
++struct ath11k_ast_entry;
+ struct ath11k_sta;
+ enum ath11k_ast_entry_type;
+ struct hal_rx_mon_ppdu_info;
+@@ -241,7 +242,7 @@ int ath11k_nss_add_wds_peer(struct ath11
+ int ath11k_nss_update_wds_peer(struct ath11k *ar, struct ath11k_peer *peer,
+ 			       u8 *dest_mac);
+ int ath11k_nss_map_wds_peer(struct ath11k *ar, struct ath11k_peer *peer,
+-			    u8 *dest_mac, enum ath11k_ast_entry_type type);
++			    u8 *dest_mac, struct ath11k_ast_entry *ast_entry);
+ int ath11k_nss_del_wds_peer(struct ath11k *ar, u8 *peer_addr,
+ 			    int peer_id, u8 *dest_mac);
+ int ath11k_nss_ext_vdev_cfg_wds_peer(struct ath11k_vif *arvif,
+@@ -337,7 +338,8 @@ static inline int ath11k_nss_update_wds_
+ }
+ 
+ static inline int ath11k_nss_map_wds_peer(struct ath11k *ar, struct ath11k_peer *peer,
+-					  u8 *dest_mac, int type)
++					  u8 *dest_mac,
++					  struct ath11k_ast_entry *ast_entry)
+ {
+ 	return 0;
+ }
+--- a/drivers/net/wireless/ath/ath11k/peer.c
++++ b/drivers/net/wireless/ath/ath11k/peer.c
+@@ -373,8 +373,7 @@ void ath11k_peer_map_ast(struct ath11k *
+ 
+ 		if ((ast_entry->type == ATH11K_AST_TYPE_WDS) ||
+ 		    (ast_entry->type == ATH11K_AST_TYPE_MEC))
+-			ath11k_nss_map_wds_peer(ar, peer, mac_addr,
+-						ast_entry->type);
++			ath11k_nss_map_wds_peer(ar, peer, mac_addr, ast_entry);
+ 
+ 		ath11k_dbg(ab, ATH11K_DBG_MAC, "ath11k_peer_map_ast peer %pM ast_entry %pM\n",
+ 			   peer->addr, ast_entry->addr);

From daa31d5bbbd56dd4c80bfef1c908090d928cf7fd Mon Sep 17 00:00:00 2001
From: Qosmio <datapronix@protonmail.com>
Date: Sat, 13 Jan 2024 17:13:16 -0500
Subject: [PATCH 089/225] ath11k_nss: fix `'ppdu_info' is a pointer...` error

---
 ...ul-ofdma-ru-allocation-in-peer-stats.patch | 23 ++++++++++---------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/package/kernel/mac80211/patches/ath11k_nss/907-108-ath11k-enable-ul-ofdma-ru-allocation-in-peer-stats.patch b/package/kernel/mac80211/patches/ath11k_nss/907-108-ath11k-enable-ul-ofdma-ru-allocation-in-peer-stats.patch
index e7908c6daad2a7..9be70411b10996 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/907-108-ath11k-enable-ul-ofdma-ru-allocation-in-peer-stats.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/907-108-ath11k-enable-ul-ofdma-ru-allocation-in-peer-stats.patch
@@ -247,19 +247,20 @@
  int ath11k_dp_rx_process_mon_status(struct ath11k_base *ab, int mac_id,
  				    struct napi_struct *napi, int budget)
  {
-@@ -5919,8 +6084,13 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -5917,10 +6082,13 @@ int ath11k_dp_rx_process_mon_status(stru
+ 			goto next_skb;
+ 		}
  
- 		if ((ppdu_info->fc_valid) &&
- 		    (ppdu_info->ast_index != HAL_AST_IDX_INVALID)) {
--			arsta = (struct ath11k_sta *)peer->sta->drv_priv;
+-		if ((ppdu_info->fc_valid) &&
+-		    (ppdu_info->ast_index != HAL_AST_IDX_INVALID)) {
++		if (ppdu_info->reception_type == HAL_RX_RECEPTION_TYPE_SU) {
+ 			arsta = (struct ath11k_sta *)peer->sta->drv_priv;
 -			ath11k_dp_rx_update_peer_stats(arsta, ppdu_info);
-+			if (ppdu_info.reception_type == HAL_RX_RECEPTION_TYPE_SU) {
-+				arsta = (struct ath11k_sta *)peer->sta->drv_priv;
-+				ath11k_dp_rx_update_peer_su_stats(arsta, &ppdu_info);
-+			} else {
-+				ath11k_dp_rx_mon_process_ulofdma(&ppdu_info);
-+				ath11k_dp_rx_update_peer_mu_stats(ar, &ppdu_info);
-+			}
++			ath11k_dp_rx_update_peer_su_stats(arsta, ppdu_info);
++		} else if ((ppdu_info->fc_valid) &&
++			   (ppdu_info->ast_index != HAL_AST_IDX_INVALID)) {
++			ath11k_dp_rx_mon_process_ulofdma(ppdu_info);
++			ath11k_dp_rx_update_peer_mu_stats(ar, ppdu_info);
  		}
  
  		if (ath11k_debugfs_is_pktlog_peer_valid(ar, peer->addr))

From 75800628ecf6772c46e8108a01c5dd5661f865d2 Mon Sep 17 00:00:00 2001
From: Qosmio <datapronix@protonmail.com>
Date: Tue, 16 Jan 2024 18:45:18 -0500
Subject: [PATCH 090/225] ath11k_nss: bugfix NSS memleak + enhancements

bugfixes:
  * Rreverted patch `105-ath11k-fix-monitor-crash-if-tx-offload-is-enabled.patch`.
    Initial test show lower memory use. `ieee80211_tx_status_8023` was
    also removed upstream for a reason as it wasn't being used, and the
    logic behind it was flawed.
    See https://patchwork.kernel.org/project/linux-wireless/patch/20230308174703.12270-2-quic_pradeepc@quicinc.com

  * Mmemory profile for '256M' was missing logic that was in 512/1G.
    Should build correctly now

  * added more qsdk related patches to nss/offload

ath11k_nss: fix up patches

ath11k_nss: revert m3, fix coredump when rebooting

M3 SSR dump logic makes the router coredump. Just putting dummy case to
skip warning.

[12394.072384] Hardware name: Dynalink DL-WRX36 (DT)
[12394.079758] Call trace:
[12394.084354]  dump_backtrace.part.0+0xbc/0xd0
[12394.086614]  show_stack+0x18/0x30
[12394.091127]  dump_stack_lvl+0x6c/0x88
[12394.094339]  dump_stack+0x18/0x34
[12394.097985]  bad_page+0xe0/0x110
[12394.101282]  __free_pages_ok+0x33c/0x360
[12394.104582]  __free_pages+0xbc/0xe0
[12394.108487]  dma_direct_free+0xd0/0x140
[12394.111701]  dma_free_attrs+0x90/0xb0
[12394.115519]  ath11k_qmi_fwreset_from_cold_boot+0x9e0/0xa10 [ath11k]
[12394.119343]  ath11k_qmi_deinit_service+0x64/0x21d0 [ath11k]
[12394.125419]  ath11k_core_deinit+0xa4/0xc0 [ath11k]
[12394.130974]  0xffffffc000fb3600
[12394.135831]  platform_shutdown+0x24/0x40
[12394.138871]  device_shutdown+0x14c/0x240
[12394.143037]  kernel_restart+0x40/0xb0
[12394.146944]  __do_sys_reboot+0xcc/0x200
[12394.150502]  __arm64_sys_reboot+0x24/0x30
[12394.154148]  invoke_syscall.constprop.0+0x5c/0x110
[12394.158317]  do_el0_svc+0x58/0x170
[12394.163001]  el0_svc+0x18/0x60
[12394.166386]  el0t_64_sync_handler+0x114/0x120
[12394.169426]  el0t_64_sync+0x174/0x178
---
 ...nitor-crash-if-tx-offload-is-enabled.patch |  60 --
 .../199-001-mac80211-add-nss-support.patch    |   8 -
 ...-ath11k_nss-add-nss-driver-interface.patch |   4 +-
 .../199-003-ath11k-add-nss-support.patch      |   6 +-
 ...-ath11k-Add-support-for-dynamic-vlan.patch |   6 +-
 ...207-ath11k-Enable-256_512MB-profiles.patch |  29 +-
 ...00-mac80211-nss-mesh-offload-support.patch |   2 +-
 .../patches/ath11k_nss/900-fix-build.patch    |  46 --
 ...load-changes-to-NSS-driver-interface.patch |  19 +-
 ...04-300-ath11k-nss_get_arvif_from_dev.patch |   4 +-
 ...support-to-send-the-QoS-Null-Data-fr.patch |  31 +
 .../906-ath11k-m3-ssr-dump-collection.patch   |  12 +
 .../908-301-ath11k-nss-mcbc-exception.patch   |   6 +-
 .../911-244-ath11k-dp-tx-perf.patch           | 623 ++++++++++++++++++
 ...-0001-ath11k-optimize-tx-completions.patch | 269 ++++++++
 ...se-DECLARE_BITMAP-for-idr-operations.patch | 288 ++++++++
 ...1k-add-simple-tx-handler-for-AP-mode.patch | 185 ++++++
 .../911-335-ath11k-fix-ar-ops-crash.patch     |  71 ++
 ...Add-retry-mechanism-for-update_rx_qu.patch | 384 +++++++++++
 ...rt-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch |  52 ++
 ...-frags-from-uninitialized-peer-in-dp.patch |  74 +++
 ...356-ath11k-invalid-desc-sanity-check.patch |  74 +++
 ...k-skb_headroom-before-using-skb_push.patch | 209 ++++++
 ...fix-RCU-stall-in-mesh-fast-xmit-path.patch | 120 ++++
 ...ix-crash-when-accessing-null-pointer.patch |  87 +++
 ...ing-memset-of-ppdu-info-for-next-skb.patch |  87 +++
 26 files changed, 2590 insertions(+), 166 deletions(-)
 delete mode 100644 package/kernel/mac80211/patches/ath11k_nss/105-ath11k-fix-monitor-crash-if-tx-offload-is-enabled.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/906-456-wifi-ath11k-Add-support-to-send-the-QoS-Null-Data-fr.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/906-ath11k-m3-ssr-dump-collection.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/911-244-ath11k-dp-tx-perf.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/911-335-0001-ath11k-optimize-tx-completions.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/911-335-0002-ath11k-use-DECLARE_BITMAP-for-idr-operations.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/911-335-0006-ath11k-add-simple-tx-handler-for-AP-mode.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/911-335-ath11k-fix-ar-ops-crash.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/911-373-ath11k-Add-retry-mechanism-for-update_rx_qu.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/913-341-ath11k-fix-support-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/913-353-ath11k-ignore-frags-from-uninitialized-peer-in-dp.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/913-356-ath11k-invalid-desc-sanity-check.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/913-374-ath11k-Check-skb_headroom-before-using-skb_push.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/913-686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/913-726-mac80211-fix-crash-when-accessing-null-pointer.patch
 create mode 100644 package/kernel/mac80211/patches/ath11k_nss/913-830-ath11k-Avoiding-memset-of-ppdu-info-for-next-skb.patch

diff --git a/package/kernel/mac80211/patches/ath11k_nss/105-ath11k-fix-monitor-crash-if-tx-offload-is-enabled.patch b/package/kernel/mac80211/patches/ath11k_nss/105-ath11k-fix-monitor-crash-if-tx-offload-is-enabled.patch
deleted file mode 100644
index 9304833c87d1c3..00000000000000
--- a/package/kernel/mac80211/patches/ath11k_nss/105-ath11k-fix-monitor-crash-if-tx-offload-is-enabled.patch
+++ /dev/null
@@ -1,60 +0,0 @@
- drivers/net/wireless/ath/ath11k/dp_tx.c | 20 +++++++++++++++++---
- 1 file changed, 17 insertions(+), 3 deletions(-)
-
---- a/drivers/net/wireless/ath/ath11k/dp_tx.c
-+++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
-@@ -322,6 +322,8 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
- 	struct ath11k_skb_cb *skb_cb;
- 	struct ath11k *ar;
- 	struct ath11k_peer *peer;
-+	struct ieee80211_vif *vif;
-+	u8 flags = 0;
- 
- 	spin_lock(&tx_ring->tx_idr_lock);
- 	msdu = idr_remove(&tx_ring->txbuf_idr, ts->msdu_id);
-@@ -348,6 +350,14 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
- 		return;
- 	}
- 
-+	if (!skb_cb->vif) {
-+		dev_kfree_skb_any(msdu);
-+		return;
-+	}
-+
-+	flags = skb_cb->flags;
-+	vif = skb_cb->vif;
-+
- 	memset(&info->status, 0, sizeof(info->status));
- 
- 	if (ts->acked) {
-@@ -555,6 +565,8 @@ static void ath11k_dp_tx_complete_msdu(s
- 	struct ath11k_peer *peer;
- 	struct ath11k_sta *arsta;
- 	struct rate_info rate;
-+	struct ieee80211_vif *vif;
-+	u8 flags = 0;
- 
- 	if (WARN_ON_ONCE(ts->buf_rel_source != HAL_WBM_REL_SRC_MODULE_TQM)) {
- 		/* Must not happen */
-@@ -575,6 +587,9 @@ static void ath11k_dp_tx_complete_msdu(s
- 		return;
- 	}
- 
-+	flags = skb_cb->flags;
-+	vif = skb_cb->vif;
-+
- 	info = IEEE80211_SKB_CB(msdu);
- 	memset(&info->status, 0, sizeof(info->status));
- 
-@@ -641,7 +656,10 @@ static void ath11k_dp_tx_complete_msdu(s
- 
- 	spin_unlock_bh(&ab->base_lock);
- 
--	ieee80211_tx_status_ext(ar->hw, &status);
-+	if (flags & ATH11K_SKB_HW_80211_ENCAP)
-+		ieee80211_tx_status_8023(ar->hw, vif, msdu);
-+	else
-+		ieee80211_tx_status_ext(ar->hw, &status);
- }
- 
- static inline void ath11k_dp_tx_status_parse(struct ath11k_base *ab,
diff --git a/package/kernel/mac80211/patches/ath11k_nss/199-001-mac80211-add-nss-support.patch b/package/kernel/mac80211/patches/ath11k_nss/199-001-mac80211-add-nss-support.patch
index f25def295537ca..a06ef7652df538 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/199-001-mac80211-add-nss-support.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/199-001-mac80211-add-nss-support.patch
@@ -451,11 +451,3 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  QCOM_AOSS_QMP=
  QCOM_COMMAND_DB=
  QCOM_CPR=
-@@ -174,6 +175,7 @@ ATH11K_DEBUGFS=
- ATH11K_TRACING=
- ATH11K_SPECTRAL=
- ATH11K_THERMAL=
-+ATH11K_MEM_PROFILE_512M=
- ATH12K=
- ATH12K_DEBUG=
- ATH12K_TRACING=
diff --git a/package/kernel/mac80211/patches/ath11k_nss/199-002-ath11k_nss-add-nss-driver-interface.patch b/package/kernel/mac80211/patches/ath11k_nss/199-002-ath11k_nss-add-nss-driver-interface.patch
index beee16098f14c3..79f8190d5b990f 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/199-002-ath11k_nss-add-nss-driver-interface.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/199-002-ath11k_nss-add-nss-driver-interface.patch
@@ -600,8 +600,8 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
 +			     __attribute__((unused)) struct napi_struct *napi)
 +{
 +	enum ath11k_hw_txrx_mode decap_type;
-+	struct wireless_dev *wdev;
-+	struct ieee80211_vif *vif;
++	struct wireless_dev *wdev = NULL;
++	struct ieee80211_vif *vif = NULL;
 +	struct ath11k_vif *arvif;
 +	struct ath11k_base *ab;
 +	bool eth_decap = false;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/199-003-ath11k-add-nss-support.patch b/package/kernel/mac80211/patches/ath11k_nss/199-003-ath11k-add-nss-support.patch
index ffae0a9448ef8b..34b30984ca76d2 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/199-003-ath11k-add-nss-support.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/199-003-ath11k-add-nss-support.patch
@@ -557,15 +557,13 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  exit:
  	mutex_unlock(&ar->conf_mutex);
  	return ret;
-@@ -6216,10 +6279,16 @@ static void ath11k_mac_op_tx(struct ieee
+@@ -6216,10 +6279,14 @@ static void ath11k_mac_op_tx(struct ieee
  	if (control->sta)
  		arsta = ath11k_sta_to_arsta(control->sta);
  
 -	ret = ath11k_dp_tx(ar, arvif, arsta, skb);
-+	if (ar->ab->nss.enabled) {
-+		arvif->ar->ab->nss.debug_mode = true;
++	if (ar->ab->nss.enabled)
 +		ret = ath11k_nss_tx(arvif, skb);
-+  }
 +	else
 +		ret = ath11k_dp_tx(ar, arvif, arsta, skb);
  	if (unlikely(ret)) {
diff --git a/package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Add-support-for-dynamic-vlan.patch b/package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Add-support-for-dynamic-vlan.patch
index b17b9fb419745d..a937ffba79961c 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Add-support-for-dynamic-vlan.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Add-support-for-dynamic-vlan.patch
@@ -150,9 +150,9 @@ Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
  	spin_lock_bh(&tx_ring->tx_idr_lock);
  	idr_remove(&tx_ring->txbuf_idr,
  		   FIELD_GET(DP_TX_DESC_ID_MSDU_ID, ti.desc_id));
-@@ -358,6 +429,9 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
- 	flags = skb_cb->flags;
- 	vif = skb_cb->vif;
+@@ -348,6 +419,9 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
+ 		return;
+ 	}
  
 +	if (skb_cb->pkt_offset)
 +		skb_pull(msdu, skb_cb->pkt_offset); /* removing the alignment and htt meta data */
diff --git a/package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Enable-256_512MB-profiles.patch b/package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Enable-256_512MB-profiles.patch
index a4c063ce69ba49..4d7af8641311dc 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Enable-256_512MB-profiles.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Enable-256_512MB-profiles.patch
@@ -50,11 +50,11 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  /* Target configuration defines */
 +#if defined(CPTCFG_ATH11K_MEM_PROFILE_256M)
-+#define TARGET_NUM_VDEVS	8
-+#define TARGET_NUM_PEERS_PDEV	(128 + TARGET_NUM_VDEVS)
++#define TARGET_NUM_VDEVS(ab)	8
++#define TARGET_NUM_PEERS_PDEV(ab)	(128 + TARGET_NUM_VDEVS(ab))
 +/* Max num of stations (per radio) */
-+#define TARGET_NUM_STATIONS	128
-+#define ATH11K_QMI_TARGET_MEM_MODE	ATH11K_QMI_TARGET_MEM_MODE_512M
++#define TARGET_NUM_STATIONS(ab)	128
++#define ATH11K_QMI_TARGET_MEM_MODE	ATH11K_QMI_TARGET_MEM_MODE_256M
 +#define ATH11K_DP_TX_COMP_RING_SIZE	2048
 +#define ATH11K_DP_RXDMA_BUF_RING_SIZE		1024
 +#define ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE	512
@@ -138,7 +138,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  #endif
 --- a/local-symbols
 +++ b/local-symbols
-@@ -171,12 +171,13 @@ ATH11K=
+@@ -171,6 +171,8 @@ ATH11K=
  ATH11K_AHB=
  ATH11K_PCI=
  ATH11K_NSS_SUPPORT=
@@ -147,12 +147,6 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  ATH11K_DEBUG=
  ATH11K_DEBUGFS=
  ATH11K_TRACING=
- ATH11K_SPECTRAL=
- ATH11K_THERMAL=
--ATH11K_MEM_PROFILE_512M=
- ATH12K=
- ATH12K_DEBUG=
- ATH12K_TRACING=
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
 @@ -863,6 +863,11 @@ struct ath11k_msi_config {
@@ -282,17 +276,16 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		.hal_params = &ath11k_hw_hal_params_ipq8074,
  		.supports_dynamic_smps_6ghz = false,
  		.alloc_cacheable_memory = true,
-@@ -127,7 +131,9 @@ static struct ath11k_hw_params ath11k_hw
+@@ -127,6 +131,9 @@ static struct ath11k_hw_params ath11k_hw
  		.tcl_ring_retry = true,
  		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
  		.smp2p_wow_exit = false,
--	},
 +		/* In addition to TCL ring use TCL_CMD ring also for tx */
 +		.max_tx_ring = DP_TCL_NUM_RING_MAX + 1,
 +		.num_vdevs_peers = ath11k_vdevs_peers,
+ 	},
  	{
  		.hw_rev = ATH11K_HW_IPQ6018_HW10,
- 		.name = "ipq6018 hw1.0",
 @@ -177,7 +183,7 @@ static struct ath11k_hw_params ath11k_hw
  		.coldboot_cal_mm = true,
  		.coldboot_cal_ftm = true,
@@ -374,13 +367,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
 --- a/drivers/net/wireless/ath/ath11k/debugfs.c
 +++ b/drivers/net/wireless/ath/ath11k/debugfs.c
-@@ -1592,10 +1592,13 @@ static ssize_t ath11k_dump_mgmt_stats(st
- 				      size_t count, loff_t *ppos)
- {
- 	struct ath11k *ar = file->private_data;
-+#ifndef CPTCFG_ATH11K_MEM_PROFILE_512M
-+	struct ath11k_base *ab = ar->ab;
-+#endif
+@@ -1595,7 +1595,7 @@ static ssize_t ath11k_dump_mgmt_stats(st
  	struct ath11k_vif *arvif = NULL;
  	struct ath11k_mgmt_frame_stats *mgmt_stats;
  	int len = 0, ret, i;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/300-mac80211-nss-mesh-offload-support.patch b/package/kernel/mac80211/patches/ath11k_nss/300-mac80211-nss-mesh-offload-support.patch
index 7233913ee6f0f7..d3e6b9850b620f 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/300-mac80211-nss-mesh-offload-support.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/300-mac80211-nss-mesh-offload-support.patch
@@ -187,7 +187,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
 +	u32 metric;
 +	unsigned long exp_time;
 +	u8 hop_count;
-+	u16 flags; /* See &enum ieee80211_mesh_path_flags */
++	u8 flags; /* See &enum ieee80211_mesh_path_flags */
 +	u8 mesh_gate;
 +	u8 block_mesh_fwd;
 +	u8 metadata_type;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/900-fix-build.patch b/package/kernel/mac80211/patches/ath11k_nss/900-fix-build.patch
index 180fb7feab2e49..12feacda8555f7 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/900-fix-build.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/900-fix-build.patch
@@ -104,19 +104,6 @@
  					 NL80211_CMD_COLOR_CHANGE_COMPLETED,
  					 0, 0);
  }
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -5241,6 +5241,10 @@ void ieee80211_tx_status_ext(struct ieee
-  *	(NULL for multicast packets)
-  * @info: tx status information
-  */
-+void ieee80211_tx_status_8023(struct ieee80211_hw *hw,
-+                               struct ieee80211_vif *vif,
-+                               struct sk_buff *skb);
-+
- static inline void ieee80211_tx_status_noskb(struct ieee80211_hw *hw,
- 					     struct ieee80211_sta *sta,
- 					     struct ieee80211_tx_info *info)
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
 @@ -4777,7 +4777,7 @@ void ieee80211_color_collision_detection
@@ -160,39 +147,6 @@
  	/* now keys can no longer be reached */
  	ieee80211_free_sta_keys(local, sta);
  
---- a/net/mac80211/status.c
-+++ b/net/mac80211/status.c
-@@ -1244,6 +1244,30 @@ void ieee80211_tx_rate_update(struct iee
- }
- EXPORT_SYMBOL(ieee80211_tx_rate_update);
- 
-+void ieee80211_tx_status_8023(struct ieee80211_hw *hw,
-+                              struct ieee80211_vif *vif,
-+                              struct sk_buff *skb)
-+{
-+        struct ieee80211_sub_if_data *sdata;
-+        struct ieee80211_tx_status status = {
-+                .skb = skb,
-+                .info = IEEE80211_SKB_CB(skb),
-+        };
-+        struct sta_info *sta;
-+
-+        sdata = vif_to_sdata(vif);
-+
-+        rcu_read_lock();
-+
-+        if (!ieee80211_lookup_ra_sta(sdata, skb, &sta) && !IS_ERR(sta))
-+                status.sta = &sta->sta;
-+
-+        ieee80211_tx_status_ext(hw, &status);
-+
-+        rcu_read_unlock();
-+}
-+EXPORT_SYMBOL(ieee80211_tx_status_8023);
-+
- void ieee80211_report_low_ack(struct ieee80211_sta *pubsta, u32 num_packets)
- {
- 	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
 @@ -19414,7 +19414,7 @@ void cfg80211_ch_switch_started_notify(s
diff --git a/package/kernel/mac80211/patches/ath11k_nss/902-001-ath11k-add-WDS-offload-changes-to-NSS-driver-interface.patch b/package/kernel/mac80211/patches/ath11k_nss/902-001-ath11k-add-WDS-offload-changes-to-NSS-driver-interface.patch
index 7e2a9f0ee4dd4b..47146c459e796e 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/902-001-ath11k-add-WDS-offload-changes-to-NSS-driver-interface.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/902-001-ath11k-add-WDS-offload-changes-to-NSS-driver-interface.patch
@@ -13,20 +13,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/nss.c
 +++ b/drivers/net/wireless/ath/ath11k/nss.c
-@@ -9,10 +9,12 @@
- #include "nss.h"
- #include "core.h"
- #include "peer.h"
-+#include "dp_tx.h"
- #include "dp_rx.h"
- #include "dp_tx.h"
- #include "hif.h"
- #include "wmi.h"
-+#include "wmi.h"
- #include "../../../../../net/mac80211/sta_info.h"
- 
- /*-----------------------------ATH11K-NSS Helpers--------------------------*/
-@@ -348,6 +350,22 @@ void ath11k_nss_wifili_event_receive(str
+@@ -348,6 +348,22 @@ void ath11k_nss_wifili_event_receive(str
  		ath11k_nss_wifili_link_desc_return(ab,
  						   (void *)&msg->msg.linkdescinfomsg);
  		break;
@@ -301,8 +288,8 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  			     __attribute__((unused)) struct napi_struct *napi)
  {
 -	enum ath11k_hw_txrx_mode decap_type;
- 	struct wireless_dev *wdev;
- 	struct ieee80211_vif *vif;
+ 	struct wireless_dev *wdev = NULL;
+ 	struct ieee80211_vif *vif = NULL;
  	struct ath11k_vif *arvif;
 @@ -632,28 +871,16 @@ ath11k_nss_vdev_data_receive(struct net_
  	ath11k_dbg_dump(ab, ATH11K_DBG_DP_RX, "", "dp rx msdu from nss: ",
diff --git a/package/kernel/mac80211/patches/ath11k_nss/904-300-ath11k-nss_get_arvif_from_dev.patch b/package/kernel/mac80211/patches/ath11k_nss/904-300-ath11k-nss_get_arvif_from_dev.patch
index 5d695ccfe55f2e..86812a1830d817 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/904-300-ath11k-nss_get_arvif_from_dev.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/904-300-ath11k-nss_get_arvif_from_dev.patch
@@ -85,9 +85,9 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  		break;
  	}
  }
-@@ -786,24 +814,7 @@ ath11k_nss_vdev_special_data_receive(str
+@@ -785,24 +813,7 @@ ath11k_nss_vdev_special_data_receive(str
+ 	int data_offs = 0;
  	int ret = 0;
- 	struct ath11k_peer *ta_peer = NULL;
  
 -	if (!dev) {
 -		dev_kfree_skb_any(skb);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/906-456-wifi-ath11k-Add-support-to-send-the-QoS-Null-Data-fr.patch b/package/kernel/mac80211/patches/ath11k_nss/906-456-wifi-ath11k-Add-support-to-send-the-QoS-Null-Data-fr.patch
new file mode 100644
index 00000000000000..10c39288094b5f
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/906-456-wifi-ath11k-Add-support-to-send-the-QoS-Null-Data-fr.patch
@@ -0,0 +1,31 @@
+From 047c8f3ea16fe1d071f83b51b8c132f797903c91 Mon Sep 17 00:00:00 2001
+From: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
+Date: Tue, 10 Oct 2023 09:13:38 +0530
+Subject: [PATCH] wifi: ath11k: Add support to send the QoS Null Data frame
+ through exception path
+
+When we try to send QoS NULL Data frame in Ethernet encap type, it modified
+as QoS Data frame with TID 0 (encryption enabled one if security enabled).
+But expectation is, it should be send as open type frame with TID 7 since
+its a QoS NULL data frame.
+
+Added this frame under exception route to bypass TCL with the help of FW.
+
+Signed-off-by: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/dp_tx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -209,7 +209,9 @@ tcl_ring_sel:
+ 
+ 	switch (ti.encap_type) {
+ 	case HAL_TCL_ENCAP_TYPE_NATIVE_WIFI:
+-		if (arvif->vif->offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED)
++		if ((arvif->vif->offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED) &&
++		    (skb->protocol == cpu_to_be16(ETH_P_PAE) ||
++		     ieee80211_is_qos_nullfunc(hdr->frame_control)))
+ 			is_diff_encap = true;
+ 		else
+ 			ath11k_dp_tx_encap_nwifi(skb);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/906-ath11k-m3-ssr-dump-collection.patch b/package/kernel/mac80211/patches/ath11k_nss/906-ath11k-m3-ssr-dump-collection.patch
new file mode 100644
index 00000000000000..47b29fd19e19bb
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/906-ath11k-m3-ssr-dump-collection.patch
@@ -0,0 +1,12 @@
+--- a/drivers/net/wireless/ath/ath11k/qmi.c
++++ b/drivers/net/wireless/ath/ath11k/qmi.c
+@@ -2101,6 +2101,9 @@ static int ath11k_qmi_assign_target_mem_
+ 			ab->qmi.target_mem[idx].type = ab->qmi.target_mem[i].type;
+ 			idx++;
+ 			break;
++		case M3_DUMP_REGION_TYPE:
++			idx++;
++			break;
+ 		default:
+ 			ath11k_warn(ab, "qmi ignore invalid mem req type %d\n",
+ 				    ab->qmi.target_mem[i].type);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/908-301-ath11k-nss-mcbc-exception.patch b/package/kernel/mac80211/patches/ath11k_nss/908-301-ath11k-nss-mcbc-exception.patch
index bba58322a254e7..47c6b7ec3e5ae2 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/908-301-ath11k-nss-mcbc-exception.patch
+++ b/package/kernel/mac80211/patches/ath11k_nss/908-301-ath11k-nss-mcbc-exception.patch
@@ -69,9 +69,9 @@ Change-Id: I4a6ac67a1c2cf3ab7a219d0953907191606a5e70
  	int ret = 0;
 +	struct ath11k_peer *ta_peer = NULL;
  
- 	if (!dev) {
- 		dev_kfree_skb_any(skb);
-@@ -834,15 +833,50 @@ ath11k_nss_vdev_special_data_receive(str
+ 	arvif = ath11k_nss_get_arvif_from_dev(dev);
+ 	if (!arvif) {
+@@ -843,15 +842,50 @@ ath11k_nss_vdev_special_data_receive(str
  		return;
  	}
  
diff --git a/package/kernel/mac80211/patches/ath11k_nss/911-244-ath11k-dp-tx-perf.patch b/package/kernel/mac80211/patches/ath11k_nss/911-244-ath11k-dp-tx-perf.patch
new file mode 100644
index 00000000000000..79906c8d3a4ab3
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/911-244-ath11k-dp-tx-perf.patch
@@ -0,0 +1,623 @@
+From a19b1279d75dd1306c6eac291e985657f988780c Mon Sep 17 00:00:00 2001
+From: P Praneesh <ppranees@codeaurora.org>
+Date: Thu, 7 Jan 2021 16:32:30 +0530
+Subject: [PATCH] ath11k: dp_tx perf improvements
+
+ Contains below changes,
+	1. Add branch prediction in tx path
+	2. Allow fast tx completion by freeing skb when stats is disabled.
+	3. Remove mod operator overhead for dst ring access to avoid(to be profiled)
+	4. Lockless tcl ring usage since rings are selected per cpu
+
+Sample stats disable command:
+echo 1 > /sys/kernel/debug/ath11k/qcn9000\ hw1.0_0000\:01\:00.0/stats_disable
+echo 1 > /sys/kernel/debug/ath11k/ipq8074\ hw2.0/stats_disable
+
+Signed-off-by: Sriram R <srirrama@codeaurora.org>
+Signed-off-by: P Praneesh <ppranees@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/core.h  |   1 +
+ drivers/net/wireless/ath/ath11k/dp.c    |   7 +-
+ drivers/net/wireless/ath/ath11k/dp_tx.c | 118 ++++++++++++++++++--------------
+ drivers/net/wireless/ath/ath11k/dp_tx.h |   2 +
+ drivers/net/wireless/ath/ath11k/hal.c   |   9 ++-
+ drivers/net/wireless/ath/ath11k/mac.c   |   9 ++-
+ 6 files changed, 88 insertions(+), 58 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -118,6 +118,7 @@ static inline enum wme_ac ath11k_tid_to_
+ enum ath11k_skb_flags {
+ 	ATH11K_SKB_HW_80211_ENCAP = BIT(0),
+ 	ATH11K_SKB_CIPHER_SET = BIT(1),
++	ATH11K_SKB_TX_STATUS = BIT(2),
+ };
+ 
+ struct ath11k_skb_cb {
+@@ -919,7 +920,12 @@ struct ath11k_soc_dp_tx_err_stats {
+ 	/* Other failures during dp_tx due to mem allocation failure
+ 	 * idr unavailable etc.
+ 	 */
++	/* TCL Ring IDR unavailable */
++	u32 idr_na[DP_TCL_NUM_RING_MAX];
++
+ 	atomic_t misc_fail;
++	atomic_t max_fail;
++	/* Tx failures due to NSS Tx error status */
+ 	atomic_t nss_tx_fail;
+ };
+ 
+--- a/drivers/net/wireless/ath/ath11k/dp.c
++++ b/drivers/net/wireless/ath/ath11k/dp.c
+@@ -362,7 +362,7 @@ void ath11k_dp_stop_shadow_timers(struct
+ 	if (!ab->hw_params.supports_shadow_regs)
+ 		return;
+ 
+-	for (i = 0; i < ab->hw_params.max_tx_ring; i++)
++	for (i = 0; i < DP_TCL_NUM_RING_MAX; i++)
+ 		ath11k_dp_shadow_stop_timer(ab, &ab->dp.tx_ring_timer[i]);
+ 
+ 	ath11k_dp_shadow_stop_timer(ab, &ab->dp.reo_cmd_timer);
+@@ -377,7 +377,7 @@ static void ath11k_dp_srng_common_cleanu
+ 	ath11k_dp_srng_cleanup(ab, &dp->wbm_desc_rel_ring);
+ 	ath11k_dp_srng_cleanup(ab, &dp->tcl_cmd_ring);
+ 	ath11k_dp_srng_cleanup(ab, &dp->tcl_status_ring);
+-	for (i = 0; i < ab->hw_params.max_tx_ring; i++) {
++	for (i = 0; i < DP_TCL_NUM_RING_MAX; i++) {
+ 		ath11k_dp_srng_cleanup(ab, &dp->tx_ring[i].tcl_data_ring);
+ 		ath11k_dp_srng_cleanup(ab, &dp->tx_ring[i].tcl_comp_ring);
+ 	}
+@@ -411,6 +411,11 @@ static int ath11k_dp_srng_common_setup(s
+ 		goto err;
+ 	}
+ 
++	if (ab->hw_params.max_tx_ring > DP_TCL_NUM_RING_MAX) {
++		srng = &ab->hal.srng_list[dp->tcl_cmd_ring.ring_id];
++		ath11k_hal_tx_init_data_ring(ab, srng, HAL_TCL_CMD);
++	}
++
+ 	ret = ath11k_dp_srng_setup(ab, &dp->tcl_status_ring, HAL_TCL_STATUS,
+ 				   0, 0, DP_TCL_STATUS_RING_SIZE);
+ 	if (ret) {
+@@ -418,7 +423,7 @@ static int ath11k_dp_srng_common_setup(s
+ 		goto err;
+ 	}
+ 
+-	for (i = 0; i < ab->hw_params.max_tx_ring; i++) {
++	for (i = 0; i < DP_TCL_NUM_RING_MAX; i++) {
+ 		tcl_num = ab->hw_params.hal_params->tcl2wbm_rbm_map[i].tcl_ring_num;
+ 		wbm_num = ab->hw_params.hal_params->tcl2wbm_rbm_map[i].wbm_ring_num;
+ 
+@@ -441,7 +446,7 @@ static int ath11k_dp_srng_common_setup(s
+ 		}
+ 
+ 		srng = &ab->hal.srng_list[dp->tx_ring[i].tcl_data_ring.ring_id];
+-		ath11k_hal_tx_init_data_ring(ab, srng);
++		ath11k_hal_tx_init_data_ring(ab, srng, HAL_TCL_DATA);
+ 
+ 		ath11k_dp_shadow_init_timer(ab, &dp->tx_ring_timer[i],
+ 					    ATH11K_SHADOW_DP_TIMER_INTERVAL,
+@@ -1062,7 +1067,7 @@ void ath11k_dp_free(struct ath11k_base *
+ 
+ 	ath11k_dp_reo_cmd_list_cleanup(ab);
+ 
+-	for (i = 0; i < ab->hw_params.max_tx_ring; i++) {
++	for (i = 0; i < DP_TCL_NUM_RING_MAX; i++) {
+ 		spin_lock_bh(&dp->tx_ring[i].tx_idr_lock);
+ 		idr_for_each(&dp->tx_ring[i].txbuf_idr,
+ 			     ath11k_dp_tx_pending_cleanup, ab);
+@@ -1114,7 +1119,7 @@ int ath11k_dp_alloc(struct ath11k_base *
+ 
+ 	size = sizeof(struct hal_wbm_release_ring) * DP_TX_COMP_RING_SIZE;
+ 
+-	for (i = 0; i < ab->hw_params.max_tx_ring; i++) {
++	for (i = 0; i < DP_TCL_NUM_RING_MAX; i++) {
+ 		idr_init(&dp->tx_ring[i].txbuf_idr);
+ 		spin_lock_init(&dp->tx_ring[i].tx_idr_lock);
+ 		dp->tx_ring[i].tcl_data_ring_id = i;
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -121,27 +121,35 @@ int ath11k_dp_tx(struct ath11k *ar, stru
+ 	u32 ring_selector = 0;
+ 	u8 ring_map = 0;
+ 	bool tcl_ring_retry, is_diff_encap = false;
+-	u8 align_pad, htt_meta_size = 0;
+-
+-	if (unlikely(test_bit(ATH11K_FLAG_CRASH_FLUSH, &ar->ab->dev_flags)))
+-		return -ESHUTDOWN;
++	u8 align_pad, htt_meta_size = 0, max_tx_ring, tcl_ring_id, ring_id;
+ 
+ 	if (unlikely(!(info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) &&
+ 		     !ieee80211_is_data(hdr->frame_control)))
+ 		return -ENOTSUPP;
+ 
+-	ring_selector = ab->hw_params.hw_ops->get_ring_selector(skb);
++	max_tx_ring = ab->hw_params.max_tx_ring;
++
++#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
++	if (unlikely(atomic_read(&ab->num_max_allowed) > DP_TX_COMP_MAX_ALLOWED)) {
++		atomic_inc(&ab->soc_stats.tx_err.max_fail);
++		return -ENOSPC;
++	}
++#endif
++	ring_selector = smp_processor_id();;
+ 	pool_id = ring_selector;
+ 
+ tcl_ring_sel:
+ 	tcl_ring_retry = false;
+ 
+-	ti.ring_id = ring_selector % ab->hw_params.max_tx_ring;
+-	ti.rbm_id = ab->hw_params.hal_params->tcl2wbm_rbm_map[ti.ring_id].rbm_id;
++	ring_id = ring_selector % max_tx_ring;
++	tcl_ring_id = (ring_id == DP_TCL_NUM_RING_MAX) ?
++				  DP_TCL_NUM_RING_MAX - 1 : ring_id;
+ 
+-	ring_map |= BIT(ti.ring_id);
+ 
+-	tx_ring = &dp->tx_ring[ti.ring_id];
++	ring_map |= BIT(ring_id);
++
++	ti.buf_id = tcl_ring_id + HAL_RX_BUF_RBM_SW0_BM;
++	tx_ring = &dp->tx_ring[tcl_ring_id];
+ 
+ 	spin_lock_bh(&tx_ring->tx_idr_lock);
+ 	ret = idr_alloc(&tx_ring->txbuf_idr, skb, 0,
+@@ -149,9 +157,9 @@ tcl_ring_sel:
+ 	spin_unlock_bh(&tx_ring->tx_idr_lock);
+ 
+ 	if (unlikely(ret < 0)) {
+-		if (ring_map == (BIT(ab->hw_params.max_tx_ring) - 1) ||
++		if (ring_map == (BIT(max_tx_ring) - 1) ||
+ 		    !ab->hw_params.tcl_ring_retry) {
+-			atomic_inc(&ab->soc_stats.tx_err.misc_fail);
++			ab->soc_stats.tx_err.idr_na[tcl_ring_id]++;
+ 			return -ENOSPC;
+ 		}
+ 
+@@ -260,6 +268,11 @@ tcl_ring_sel:
+ 		ti.encrypt_type = HAL_ENCRYPT_TYPE_OPEN;
+ 	}
+ 
++	ti.data_len = skb->len - ti.pkt_offset;
++	skb_cb->pkt_offset = ti.pkt_offset;
++	skb_cb->vif = arvif->vif;
++	skb_cb->ar = ar;
++
+ 	ti.paddr = dma_map_single(ab->dev, skb->data, skb->len, DMA_TO_DEVICE);
+ 	if (unlikely(dma_mapping_error(ab->dev, ti.paddr))) {
+ 		atomic_inc(&ab->soc_stats.tx_err.misc_fail);
+@@ -268,13 +281,13 @@ tcl_ring_sel:
+ 		goto fail_remove_idr;
+ 	}
+ 
+-	ti.data_len = skb->len - ti.pkt_offset;
+-	skb_cb->pkt_offset = ti.pkt_offset;
+ 	skb_cb->paddr = ti.paddr;
+-	skb_cb->vif = arvif->vif;
+-	skb_cb->ar = ar;
+ 
+-	hal_ring_id = tx_ring->tcl_data_ring.ring_id;
++	if (ring_id == DP_TCL_NUM_RING_MAX)
++		hal_ring_id = dp->tcl_cmd_ring.ring_id;
++	else
++		hal_ring_id = tx_ring->tcl_data_ring.ring_id;
++
+ 	tcl_ring = &ab->hal.srng_list[hal_ring_id];
+ 
+ 	spin_lock_bh(&tcl_ring->lock);
+@@ -287,7 +300,7 @@ tcl_ring_sel:
+ 		 * desc because the desc is directly enqueued onto hw queue.
+ 		 */
+ 		ath11k_hal_srng_access_end(ab, tcl_ring);
+-		ab->soc_stats.tx_err.desc_na[ti.ring_id]++;
++		ab->soc_stats.tx_err.desc_na[tcl_ring_id]++;
+ 		spin_unlock_bh(&tcl_ring->lock);
+ 		ret = -ENOMEM;
+ 
+@@ -296,8 +309,8 @@ tcl_ring_sel:
+ 		 * checking this ring earlier for each pkt tx.
+ 		 * Restart ring selection if some rings are not checked yet.
+ 		 */
+-		if (unlikely(ring_map != (BIT(ab->hw_params.max_tx_ring)) - 1) &&
+-		    ab->hw_params.tcl_ring_retry && ab->hw_params.max_tx_ring > 1) {
++		if (unlikely(ring_map != (BIT(max_tx_ring)) - 1) &&
++		    ab->hw_params.tcl_ring_retry && max_tx_ring > 1) {
+ 			tcl_ring_retry = true;
+ 			ring_selector++;
+ 		}
+@@ -308,17 +321,17 @@ tcl_ring_sel:
+ 	ath11k_hal_tx_cmd_desc_setup(ab, hal_tcl_desc +
+ 					 sizeof(struct hal_tlv_hdr), &ti);
+ 
++	atomic_inc(&ar->dp.num_tx_pending);
++	atomic_inc(&ab->num_max_allowed);
+ 	ath11k_hal_srng_access_end(ab, tcl_ring);
+ 
+-	ath11k_dp_shadow_start_timer(ab, tcl_ring, &dp->tx_ring_timer[ti.ring_id]);
++	ath11k_dp_shadow_start_timer(ab, tcl_ring, &dp->tx_ring_timer[ti.buf_id]);
+ 
+ 	spin_unlock_bh(&tcl_ring->lock);
+ 
+ 	ath11k_dbg_dump(ab, ATH11K_DBG_DP_TX, NULL, "dp tx msdu: ",
+ 			skb->data, skb->len);
+ 
+-	atomic_inc(&ar->dp.num_tx_pending);
+-	atomic_inc(&ab->num_max_allowed);
+ 
+ 	return 0;
+ 
+@@ -365,7 +378,6 @@ static void ath11k_dp_tx_free_txbuf(stru
+ 	ar = ab->pdevs[mac_id].ar;
+ 	if (atomic_dec_and_test(&ar->dp.num_tx_pending))
+ 		wake_up(&ar->dp.tx_empty_waitq);
+-	atomic_dec(&ab->num_max_allowed);
+ }
+ 
+ static void
+@@ -379,6 +391,7 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
+ 	struct ath11k_skb_cb *skb_cb;
+ 	struct ath11k *ar;
+ 	struct ath11k_peer *peer;
++	u8 flags = 0;
+ 
+ 	spin_lock(&tx_ring->tx_idr_lock);
+ 	msdu = idr_remove(&tx_ring->txbuf_idr, ts->msdu_id);
+@@ -397,10 +410,30 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
+ 
+ 	if (atomic_dec_and_test(&ar->dp.num_tx_pending))
+ 		wake_up(&ar->dp.tx_empty_waitq);
+-	atomic_dec(&ab->num_max_allowed);
+ 
+ 	dma_unmap_single(ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
+ 
++	flags = skb_cb->flags;
++
++	/* Free skb here if stats is disabled */
++	if (ab->stats_disable && !(flags & ATH11K_SKB_TX_STATUS)) {
++		if (msdu->destructor) {
++			msdu->wifi_acked_valid = 1;
++			msdu->wifi_acked = ts->acked;
++		}
++		if (skb_has_frag_list(msdu)) {
++			kfree_skb_list(skb_shinfo(msdu)->frag_list);
++			skb_shinfo(msdu)->frag_list = NULL;
++		}
++		dev_kfree_skb(msdu);
++ 		return;
++	}
++
++	if (unlikely(!skb_cb->vif)) {
++		dev_kfree_skb_any(msdu);
++		return;
++	}
++
+ 	if (!skb_cb->vif) {
+ 		ieee80211_free_txskb(ar->hw, msdu);
+ 		return;
+@@ -616,6 +649,7 @@ static void ath11k_dp_tx_complete_msdu(s
+ 	struct ath11k_peer *peer;
+ 	struct ath11k_sta *arsta;
+ 	struct rate_info rate;
++	u8 flags = 0;
+ 
+ 	if (WARN_ON_ONCE(ts->buf_rel_source != HAL_WBM_REL_SRC_MODULE_TQM)) {
+ 		/* Must not happen */
+@@ -626,6 +660,20 @@ static void ath11k_dp_tx_complete_msdu(s
+ 
+ 	dma_unmap_single(ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
+ 
++	/* Free skb here if stats is disabled */
++	if (ab->stats_disable && !(flags & ATH11K_SKB_TX_STATUS)) {
++		if (msdu->destructor) {
++			msdu->wifi_acked_valid = 1;
++			msdu->wifi_acked = ts->status == HAL_WBM_TQM_REL_REASON_FRAME_ACKED;
++		}
++		if (skb_has_frag_list(msdu)) {
++			kfree_skb_list(skb_shinfo(msdu)->frag_list);
++			skb_shinfo(msdu)->frag_list = NULL;
++		}
++		dev_kfree_skb(msdu);
++		return;
++	}
++
+ 	if (unlikely(!rcu_access_pointer(ab->pdevs_active[ar->pdev_idx]))) {
+ 		ieee80211_free_txskb(ar->hw, msdu);
+ 		return;
+@@ -680,7 +728,7 @@ static void ath11k_dp_tx_complete_msdu(s
+ 
+ 	spin_lock_bh(&ab->base_lock);
+ 	peer = ath11k_peer_find_by_id(ab, ts->peer_id);
+-	if (!peer || !peer->sta) {
++	if (unlikely(!peer || !peer->sta)) {
+ 		ath11k_dbg(ab, ATH11K_DBG_DATA,
+ 			   "dp_tx: failed to find the peer with peer_id %d\n",
+ 			    ts->peer_id);
+@@ -736,19 +784,36 @@ static inline void ath11k_dp_tx_status_p
+ 		ts->rate_stats = 0;
+ }
+ 
++static inline bool ath11k_dp_tx_completion_valid(struct hal_wbm_release_ring *desc)
++{
++	struct htt_tx_wbm_completion *status_desc;
++
++	if (FIELD_GET(HAL_WBM_RELEASE_INFO0_REL_SRC_MODULE, desc->info0) ==
++	    HAL_WBM_REL_SRC_MODULE_FW) {
++		status_desc = ((u8 *)desc) + HTT_TX_WBM_COMP_STATUS_OFFSET;
++
++		/* Dont consider HTT_TX_COMP_STATUS_MEC_NOTIFY */
++		if (FIELD_GET(HTT_TX_WBM_COMP_INFO0_STATUS, status_desc->info0) ==
++		    HAL_WBM_REL_HTT_TX_COMP_STATUS_MEC_NOTIFY)
++			return false;
++	}
++	return true;
++}
++
+ void ath11k_dp_tx_completion_handler(struct ath11k_base *ab, int ring_id)
+ {
+ 	struct ath11k *ar;
+ 	struct ath11k_dp *dp = &ab->dp;
+-	int hal_ring_id = dp->tx_ring[ring_id].tcl_comp_ring.ring_id;
++	int hal_ring_id = dp->tx_ring[ring_id].tcl_comp_ring.ring_id, count = 0, i = 0;
+ 	struct hal_srng *status_ring = &ab->hal.srng_list[hal_ring_id];
+ 	struct sk_buff *msdu;
+ 	struct hal_tx_status ts = { 0 };
+ 	struct dp_tx_ring *tx_ring = &dp->tx_ring[ring_id];
+ 	int valid_entries;
+ 	u32 *desc;
+-	u32 msdu_id;
++	u32 msdu_id, desc_id;
+ 	u8 mac_id;
++	struct hal_wbm_release_ring *tx_status;
+ 
+ 	spin_lock_bh(&status_ring->lock);
+ 
+@@ -763,33 +828,27 @@ void ath11k_dp_tx_completion_handler(str
+ 
+ 	ath11k_hal_srng_dst_invalidate_entry(ab, status_ring, valid_entries);
+ 
+-	while ((ATH11K_TX_COMPL_NEXT(tx_ring->tx_status_head) !=
+-		tx_ring->tx_status_tail) &&
+-	       (desc = ath11k_hal_srng_dst_get_next_cache_entry(ab, status_ring))) {
+-		memcpy(&tx_ring->tx_status[tx_ring->tx_status_head],
+-		       desc, sizeof(struct hal_wbm_release_ring));
+-		tx_ring->tx_status_head =
+-			ATH11K_TX_COMPL_NEXT(tx_ring->tx_status_head);
+-	}
++	while ((desc = ath11k_hal_srng_dst_get_next_cache_entry(ab, status_ring))) {
++		if (!ath11k_dp_tx_completion_valid(desc))
++			continue;
+ 
+-	if (unlikely((ath11k_hal_srng_dst_peek(ab, status_ring) != NULL) &&
+-		     (ATH11K_TX_COMPL_NEXT(tx_ring->tx_status_head) ==
+-		      tx_ring->tx_status_tail))) {
+-		/* TODO: Process pending tx_status messages when kfifo_is_full() */
+-		ath11k_warn(ab, "Unable to process some of the tx_status ring desc because status_fifo is full\n");
++		memcpy(&tx_ring->tx_status[count],
++		       desc, sizeof(struct hal_wbm_release_ring));
++		count++;
+ 	}
+ 
+ 	ath11k_hal_srng_access_end(ab, status_ring);
+ 
+ 	spin_unlock_bh(&status_ring->lock);
+ 
+-	while (ATH11K_TX_COMPL_NEXT(tx_ring->tx_status_tail) != tx_ring->tx_status_head) {
+-		struct hal_wbm_release_ring *tx_status;
+-		u32 desc_id;
+-
+-		tx_ring->tx_status_tail =
+-			ATH11K_TX_COMPL_NEXT(tx_ring->tx_status_tail);
+-		tx_status = &tx_ring->tx_status[tx_ring->tx_status_tail];
++	if (atomic_sub_return(count, &ab->num_max_allowed) < 0) {
++		ath11k_warn(ab, "tx completion mismatch count %d ring id %d max_num %d\n",
++			    count, tx_ring->tcl_data_ring_id,
++			    atomic_read(&ab->num_max_allowed));
++	}
++
++	while (count--) {
++		tx_status = &tx_ring->tx_status[i++];
+ 		ath11k_dp_tx_status_parse(ab, tx_status, &ts);
+ 
+ 		desc_id = FIELD_GET(BUFFER_ADDR_INFO1_SW_COOKIE,
+@@ -822,7 +881,6 @@ void ath11k_dp_tx_completion_handler(str
+ 			wake_up(&ar->dp.tx_empty_waitq);
+ 
+ 		ath11k_dp_tx_complete_msdu(ar, msdu, &ts);
+-		atomic_dec(&ab->num_max_allowed);
+ 	}
+ }
+ 
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -6723,12 +6723,22 @@ static void ath11k_mac_op_tx(struct ieee
+ 	if (control->sta)
+ 		arsta = ath11k_sta_to_arsta(control->sta);
+ 
++	/* Must call mac80211 tx status handler, else when stats is disabled we free
++	 * the skb from driver. Own tx packets on monitor will also be disabled.
++	 */
++	if ((info->flags & (IEEE80211_TX_CTL_REQ_TX_STATUS | IEEE80211_TX_INTFL_NL80211_FRAME_TX)) ||
++	    info->ack_frame_id || vif->type == NL80211_IFTYPE_MESH_POINT ||
++	    test_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags))
++		skb_cb->flags |= ATH11K_SKB_TX_STATUS;
++
+ 	if (ar->ab->nss.enabled)
+ 		ret = ath11k_nss_tx(arvif, skb);
+ 	else
+ 		ret = ath11k_dp_tx(ar, arvif, arsta, skb);
++
+ 	if (unlikely(ret)) {
+-		ath11k_warn(ar->ab, "failed to transmit frame %d\n", ret);
++		if (!ar->ab->nss.enabled && ret != -ENOSPC && ret != -ENOMEM)
++			ath11k_warn(ar->ab, "failed to transmit frame %d\n", ret);
+ 		ieee80211_free_txskb(ar->hw, skb);
+ 		return;
+ 	}
+@@ -7690,7 +7700,7 @@ err_vdev_del:
+ 	idr_for_each(&ar->txmgmt_idr,
+ 		     ath11k_mac_vif_txmgmt_idr_remove, vif);
+ 
+-	for (i = 0; i < ab->hw_params.max_tx_ring; i++) {
++	for (i = 0; i < DP_TCL_NUM_RING_MAX; i++) {
+ 		spin_lock_bh(&ab->dp.tx_ring[i].tx_idr_lock);
+ 		idr_for_each(&ab->dp.tx_ring[i].txbuf_idr,
+ 			     ath11k_mac_vif_unref, vif);
+--- a/drivers/net/wireless/ath/ath11k/debugfs.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs.c
+@@ -833,10 +833,22 @@ static ssize_t ath11k_debugfs_dump_soc_d
+ 		len += scnprintf(buf + len, size - len, "ring%d: %u\n",
+ 				 i, soc_stats->tx_err.desc_na[i]);
+ 
++	len += scnprintf(buf + len, size - len, "\nTCL Ring idr Failures:\n");
++	for (i = 0; i < DP_TCL_NUM_RING_MAX; i++)
++		len += scnprintf(buf + len, size - len, "ring%d: %u\n",
++				 i, soc_stats->tx_err.idr_na[i]);
++
++	len += scnprintf(buf + len, size - len, "\nMax Transmit Failures: %d\n",
++			 atomic_read(&soc_stats->tx_err.max_fail));
++
+ 	len += scnprintf(buf + len, size - len,
+ 			 "\nMisc Transmit Failures: %d\n",
+ 			 atomic_read(&soc_stats->tx_err.misc_fail));
+ 
++	len += scnprintf(buf + len, size - len,
++			 "\nNSS Transmit Failures: %d\n",
++			 atomic_read(&soc_stats->tx_err.nss_tx_fail));
++
+ 	len += ath11k_debugfs_dump_soc_ring_bp_stats(ab, buf + len, size - len);
+ 
+ 	if (len > size)
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -192,7 +192,6 @@ static struct ath11k_hw_params ath11k_hw
+ 		.supports_regdb = false,
+ 		.fix_l1ss = true,
+ 		.credit_flow = false,
+-		.max_tx_ring = DP_TCL_NUM_RING_MAX,
+ 		.hal_params = &ath11k_hw_hal_params_ipq8074,
+ 		.supports_dynamic_smps_6ghz = false,
+ 		.alloc_cacheable_memory = true,
+@@ -217,6 +216,8 @@ static struct ath11k_hw_params ath11k_hw
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = false,
++		/* In addition to TCL ring use TCL_CMD ring also for tx */
++		.max_tx_ring = DP_TCL_NUM_RING_MAX + 1,
+ 	},
+ 	{
+ 		.name = "qca6390 hw2.0",
+@@ -384,6 +384,8 @@ static struct ath11k_hw_params ath11k_hw
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = false,
++		/* In addition to TCL ring use TCL_CMD ring also for tx */
++		.max_tx_ring = DP_TCL_NUM_RING_MAX + 1,
+ 	},
+ 	{
+ 		.name = "wcn6855 hw2.0",
+@@ -2147,6 +2149,9 @@ int ath11k_core_pre_init(struct ath11k_b
+ 
+ 	ab->enable_memory_stats = ATH11K_DEBUG_ENABLE_MEMORY_STATS;
+ 
++	if (ab->nss.enabled && ab->hw_params.max_tx_ring > DP_TCL_NUM_RING_MAX)
++		ab->hw_params.max_tx_ring = DP_TCL_NUM_RING_MAX;
++
+ 	return 0;
+ }
+ EXPORT_SYMBOL(ath11k_core_pre_init);
+--- a/drivers/net/wireless/ath/ath11k/hal_tx.h
++++ b/drivers/net/wireless/ath/ath11k/hal_tx.h
+@@ -18,7 +18,7 @@
+ 
+ struct hal_tx_info {
+ 	u16 meta_data_flags; /* %HAL_TCL_DATA_CMD_INFO0_META_ */
+-	u8 ring_id;
++	u8 buf_id;
+ 	u32 desc_id;
+ 	enum hal_tcl_desc_type type;
+ 	enum hal_tcl_encap_type encap_type;
+@@ -70,5 +70,5 @@ int ath11k_hal_reo_cmd_send(struct ath11
+ 			    enum hal_reo_cmd_type type,
+ 			    struct ath11k_hal_reo_cmd *cmd);
+ void ath11k_hal_tx_init_data_ring(struct ath11k_base *ab,
+-				  struct hal_srng *srng);
++				  struct hal_srng *srng, enum hal_ring_type type);
+ #endif
+--- a/drivers/net/wireless/ath/ath11k/hal_tx.c
++++ b/drivers/net/wireless/ath/ath11k/hal_tx.c
+@@ -37,18 +37,18 @@ static const u8 dscp_tid_map[DSCP_TID_MA
+ void ath11k_hal_tx_cmd_desc_setup(struct ath11k_base *ab, void *cmd,
+ 				  struct hal_tx_info *ti)
+ {
+-	struct hal_tcl_data_cmd *tcl_cmd = cmd;
++	struct hal_tcl_data_cmd tcl_cmd, *tcl_desc = cmd;
+ 
+-	tcl_cmd->buf_addr_info.info0 =
++	tcl_cmd.buf_addr_info.info0 =
+ 		FIELD_PREP(BUFFER_ADDR_INFO0_ADDR, ti->paddr);
+-	tcl_cmd->buf_addr_info.info1 =
++	tcl_cmd.buf_addr_info.info1 =
+ 		FIELD_PREP(BUFFER_ADDR_INFO1_ADDR,
+ 			   ((uint64_t)ti->paddr >> HAL_ADDR_MSB_REG_SHIFT));
+-	tcl_cmd->buf_addr_info.info1 |=
+-		FIELD_PREP(BUFFER_ADDR_INFO1_RET_BUF_MGR, ti->rbm_id) |
++	tcl_cmd.buf_addr_info.info1 |=
++		FIELD_PREP(BUFFER_ADDR_INFO1_RET_BUF_MGR, ti->buf_id) |
+ 		FIELD_PREP(BUFFER_ADDR_INFO1_SW_COOKIE, ti->desc_id);
+ 
+-	tcl_cmd->info0 =
++	tcl_cmd.info0 =
+ 		FIELD_PREP(HAL_TCL_DATA_CMD_INFO0_DESC_TYPE, ti->type) |
+ 		FIELD_PREP(HAL_TCL_DATA_CMD_INFO0_ENCAP_TYPE, ti->encap_type) |
+ 		FIELD_PREP(HAL_TCL_DATA_CMD_INFO0_ENCRYPT_TYPE,
+@@ -60,23 +60,25 @@ void ath11k_hal_tx_cmd_desc_setup(struct
+ 		FIELD_PREP(HAL_TCL_DATA_CMD_INFO0_CMD_NUM,
+ 			   ti->meta_data_flags);
+ 
+-	tcl_cmd->info1 = ti->flags0 |
++	tcl_cmd.info1 = ti->flags0 |
+ 		FIELD_PREP(HAL_TCL_DATA_CMD_INFO1_DATA_LEN, ti->data_len) |
+ 		FIELD_PREP(HAL_TCL_DATA_CMD_INFO1_PKT_OFFSET, ti->pkt_offset);
+ 
+-	tcl_cmd->info2 = ti->flags1 |
++	tcl_cmd.info2 = ti->flags1 |
+ 		FIELD_PREP(HAL_TCL_DATA_CMD_INFO2_LMAC_ID, ti->lmac_id);
+ 
+-	tcl_cmd->info3 = FIELD_PREP(HAL_TCL_DATA_CMD_INFO3_DSCP_TID_TABLE_IDX,
++	tcl_cmd.info3 = FIELD_PREP(HAL_TCL_DATA_CMD_INFO3_DSCP_TID_TABLE_IDX,
+ 				    ti->dscp_tid_tbl_idx) |
+ 			 FIELD_PREP(HAL_TCL_DATA_CMD_INFO3_SEARCH_INDEX,
+ 				    ti->bss_ast_idx) |
+ 			 FIELD_PREP(HAL_TCL_DATA_CMD_INFO3_CACHE_SET_NUM,
+ 				    ti->bss_ast_hash);
+-	tcl_cmd->info4 = 0;
++	tcl_cmd.info4 = 0;
+ 
+ 	if (ti->enable_mesh)
+-		ab->hw_params.hw_ops->tx_mesh_enable(ab, tcl_cmd);
++		ab->hw_params.hw_ops->tx_mesh_enable(ab, &tcl_cmd);
++
++	*tcl_desc = tcl_cmd;
+ }
+ 
+ void ath11k_hal_tx_set_dscp_tid_map(struct ath11k_base *ab, int id)
+@@ -136,7 +138,9 @@ void ath11k_hal_tx_set_dscp_tid_map(stru
+ 			   ctrl_reg_val);
+ }
+ 
+-void ath11k_hal_tx_init_data_ring(struct ath11k_base *ab, struct hal_srng *srng)
++void ath11k_hal_tx_init_data_ring(struct ath11k_base *ab, struct hal_srng *srng,
++				enum hal_ring_type type)
++
+ {
+ 	struct hal_srng_params params;
+ 	struct hal_tlv_hdr *tlv;
+@@ -145,7 +149,7 @@ void ath11k_hal_tx_init_data_ring(struct
+ 
+ 	memset(&params, 0, sizeof(params));
+ 
+-	entry_size = ath11k_hal_srng_get_entrysize(ab, HAL_TCL_DATA);
++	entry_size = ath11k_hal_srng_get_entrysize(ab, type);
+ 	ath11k_hal_srng_get_params(ab, srng, &params);
+ 	desc = (u8 *)params.ring_base_vaddr;
+ 
diff --git a/package/kernel/mac80211/patches/ath11k_nss/911-335-0001-ath11k-optimize-tx-completions.patch b/package/kernel/mac80211/patches/ath11k_nss/911-335-0001-ath11k-optimize-tx-completions.patch
new file mode 100644
index 00000000000000..3cc13d1ba98543
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/911-335-0001-ath11k-optimize-tx-completions.patch
@@ -0,0 +1,269 @@
+From 34b4e65248e7e1605448b06a006347354990bfba Mon Sep 17 00:00:00 2001
+From: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
+Date: Thu, 11 Nov 2021 10:30:35 +0530
+Subject: [PATCH] ath11k: optimize tx completions
+
+Process the required fields from tx completion status
+in case of stats disabled.
+
+Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/dp_tx.c | 114 ++++++++++++++++----------------
+ 1 file changed, 58 insertions(+), 56 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -439,6 +439,7 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
+ 		return;
+ 	}
+ 
++
+ 	if (skb_cb->pkt_offset)
+ 		skb_pull(msdu, skb_cb->pkt_offset); /* removing the alignment and htt meta data */
+ 
+@@ -637,9 +638,41 @@ err_out:
+ 	spin_unlock_bh(&ab->base_lock);
+ }
+ 
++static inline void ath11k_dp_tx_status_parse(struct ath11k_base *ab,
++					     struct hal_wbm_release_ring *desc,
++					     struct hal_tx_status *ts)
++{
++	ts->buf_rel_source =
++		FIELD_GET(HAL_WBM_RELEASE_INFO0_REL_SRC_MODULE, desc->info0);
++	if (unlikely(ts->buf_rel_source != HAL_WBM_REL_SRC_MODULE_FW &&
++		     ts->buf_rel_source != HAL_WBM_REL_SRC_MODULE_TQM))
++		return;
++
++	if (unlikely(ts->buf_rel_source == HAL_WBM_REL_SRC_MODULE_FW))
++		return;
++
++	ts->status = FIELD_GET(HAL_WBM_RELEASE_INFO0_TQM_RELEASE_REASON,
++			       desc->info0);
++	ts->ppdu_id = FIELD_GET(HAL_WBM_RELEASE_INFO1_TQM_STATUS_NUMBER,
++				desc->info1);
++	ts->try_cnt = FIELD_GET(HAL_WBM_RELEASE_INFO1_TRANSMIT_COUNT,
++				desc->info1);
++	ts->ack_rssi = FIELD_GET(HAL_WBM_RELEASE_INFO2_ACK_FRAME_RSSI,
++				 desc->info2);
++	if (desc->info2 & HAL_WBM_RELEASE_INFO2_FIRST_MSDU)
++		ts->flags |= HAL_TX_STATUS_FLAGS_FIRST_MSDU;
++	ts->peer_id = FIELD_GET(HAL_WBM_RELEASE_INFO3_PEER_ID, desc->info3);
++	ts->tid = FIELD_GET(HAL_WBM_RELEASE_INFO3_TID, desc->info3);
++	if (desc->rate_stats.info0 & HAL_TX_RATE_STATS_INFO0_VALID)
++		ts->rate_stats = desc->rate_stats.info0;
++	else
++		ts->rate_stats = 0;
++}
++
+ static void ath11k_dp_tx_complete_msdu(struct ath11k *ar,
+ 				       struct sk_buff *msdu,
+-				       struct hal_tx_status *ts)
++				       struct hal_wbm_release_ring *tx_status,
++				       enum hal_wbm_rel_src_module buf_rel_source)
+ {
+ 	struct ieee80211_tx_status status = { 0 };
+ 	struct ieee80211_rate_status status_rate = { 0 };
+@@ -649,9 +682,12 @@ static void ath11k_dp_tx_complete_msdu(s
+ 	struct ath11k_peer *peer;
+ 	struct ath11k_sta *arsta;
+ 	struct rate_info rate;
++	struct hal_tx_status ts = { 0 };
++	enum hal_wbm_htt_tx_comp_status wbm_status;
++	enum hal_wbm_tqm_rel_reason rel_status;
+ 	u8 flags = 0;
+ 
+-	if (WARN_ON_ONCE(ts->buf_rel_source != HAL_WBM_REL_SRC_MODULE_TQM)) {
++	if (unlikely(WARN_ON_ONCE(buf_rel_source != HAL_WBM_REL_SRC_MODULE_TQM))) {
+ 		/* Must not happen */
+ 		return;
+ 	}
+@@ -660,11 +696,14 @@ static void ath11k_dp_tx_complete_msdu(s
+ 
+ 	dma_unmap_single(ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
+ 
+-	/* Free skb here if stats is disabled */
++	rel_status = FIELD_GET(HAL_WBM_RELEASE_INFO0_TQM_RELEASE_REASON,
++			       tx_status->info0);
++
++ 	/* Free skb here if stats is disabled */
+ 	if (ab->stats_disable && !(flags & ATH11K_SKB_TX_STATUS)) {
+ 		if (msdu->destructor) {
+ 			msdu->wifi_acked_valid = 1;
+-			msdu->wifi_acked = ts->status == HAL_WBM_TQM_REL_REASON_FRAME_ACKED;
++			msdu->wifi_acked = rel_status == HAL_WBM_TQM_REL_REASON_FRAME_ACKED;
+ 		}
+ 		if (skb_has_frag_list(msdu)) {
+ 			kfree_skb_list(skb_shinfo(msdu)->frag_list);
+@@ -674,6 +713,8 @@ static void ath11k_dp_tx_complete_msdu(s
+ 		return;
+ 	}
+ 
++	ath11k_dp_tx_status_parse(ab, tx_status, &ts);
++
+ 	if (unlikely(!rcu_access_pointer(ab->pdevs_active[ar->pdev_idx]))) {
+ 		ieee80211_free_txskb(ar->hw, msdu);
+ 		return;
+@@ -684,54 +725,56 @@ static void ath11k_dp_tx_complete_msdu(s
+ 		return;
+ 	}
+ 
++	wbm_status = FIELD_GET(HTT_TX_WBM_COMP_INFO0_STATUS,
++			       tx_status->info0);
+ 	info = IEEE80211_SKB_CB(msdu);
+ 	memset(&info->status, 0, sizeof(info->status));
+ 
+ 	/* skip tx rate update from ieee80211_status*/
+ 	info->status.rates[0].idx = -1;
+ 
+-	if (ts->status == HAL_WBM_TQM_REL_REASON_FRAME_ACKED &&
++	if (ts.status == HAL_WBM_TQM_REL_REASON_FRAME_ACKED &&
+ 	    !(info->flags & IEEE80211_TX_CTL_NO_ACK)) {
+ 		info->flags |= IEEE80211_TX_STAT_ACK;
+ 		info->status.ack_signal = ATH11K_DEFAULT_NOISE_FLOOR +
+-					  ts->ack_rssi;
++					  ts.ack_rssi;
+ 		info->status.flags |= IEEE80211_TX_STATUS_ACK_SIGNAL_VALID;
+ 	}
+ 
+-	if (ts->status == HAL_WBM_TQM_REL_REASON_CMD_REMOVE_TX &&
++	if (ts.status == HAL_WBM_TQM_REL_REASON_CMD_REMOVE_TX &&
+ 	    (info->flags & IEEE80211_TX_CTL_NO_ACK))
+ 		info->flags |= IEEE80211_TX_STAT_NOACK_TRANSMITTED;
+ 
+ 	if (unlikely(ath11k_debugfs_is_extd_tx_stats_enabled(ar)) ||
+ 	    ab->hw_params.single_pdev_only) {
+-		if (ts->flags & HAL_TX_STATUS_FLAGS_FIRST_MSDU) {
++		if (ts.flags & HAL_TX_STATUS_FLAGS_FIRST_MSDU) {
+ 			if (ar->last_ppdu_id == 0) {
+-				ar->last_ppdu_id = ts->ppdu_id;
+-			} else if (ar->last_ppdu_id == ts->ppdu_id ||
++				ar->last_ppdu_id = ts.ppdu_id;
++			} else if (ar->last_ppdu_id == ts.ppdu_id ||
+ 				   ar->cached_ppdu_id == ar->last_ppdu_id) {
+ 				ar->cached_ppdu_id = ar->last_ppdu_id;
+ 				ar->cached_stats.is_ampdu = true;
+-				ath11k_dp_tx_update_txcompl(ar, ts);
++				ath11k_dp_tx_update_txcompl(ar, &ts);
+ 				memset(&ar->cached_stats, 0,
+ 				       sizeof(struct ath11k_per_peer_tx_stats));
+ 			} else {
+ 				ar->cached_stats.is_ampdu = false;
+-				ath11k_dp_tx_update_txcompl(ar, ts);
++				ath11k_dp_tx_update_txcompl(ar, &ts);
+ 				memset(&ar->cached_stats, 0,
+ 				       sizeof(struct ath11k_per_peer_tx_stats));
+ 			}
+-			ar->last_ppdu_id = ts->ppdu_id;
++			ar->last_ppdu_id = ts.ppdu_id;
+ 		}
+ 
+-		ath11k_dp_tx_cache_peer_stats(ar, msdu, ts);
++		ath11k_dp_tx_cache_peer_stats(ar, msdu, &ts);
+ 	}
+ 
+ 	spin_lock_bh(&ab->base_lock);
+-	peer = ath11k_peer_find_by_id(ab, ts->peer_id);
++	peer = ath11k_peer_find_by_id(ab, ts.peer_id);
+ 	if (unlikely(!peer || !peer->sta)) {
+ 		ath11k_dbg(ab, ATH11K_DBG_DATA,
+ 			   "dp_tx: failed to find the peer with peer_id %d\n",
+-			    ts->peer_id);
++			    ts.peer_id);
+ 		spin_unlock_bh(&ab->base_lock);
+ 		ieee80211_free_txskb(ar->hw, msdu);
+ 		return;
+@@ -753,44 +796,13 @@ static void ath11k_dp_tx_complete_msdu(s
+ 	ieee80211_tx_status_ext(ar->hw, &status);
+ }
+ 
+-static inline void ath11k_dp_tx_status_parse(struct ath11k_base *ab,
+-					     struct hal_wbm_release_ring *desc,
+-					     struct hal_tx_status *ts)
+-{
+-	ts->buf_rel_source =
+-		FIELD_GET(HAL_WBM_RELEASE_INFO0_REL_SRC_MODULE, desc->info0);
+-	if (unlikely(ts->buf_rel_source != HAL_WBM_REL_SRC_MODULE_FW &&
+-		     ts->buf_rel_source != HAL_WBM_REL_SRC_MODULE_TQM))
+-		return;
+-
+-	if (unlikely(ts->buf_rel_source == HAL_WBM_REL_SRC_MODULE_FW))
+-		return;
+-
+-	ts->status = FIELD_GET(HAL_WBM_RELEASE_INFO0_TQM_RELEASE_REASON,
+-			       desc->info0);
+-	ts->ppdu_id = FIELD_GET(HAL_WBM_RELEASE_INFO1_TQM_STATUS_NUMBER,
+-				desc->info1);
+-	ts->try_cnt = FIELD_GET(HAL_WBM_RELEASE_INFO1_TRANSMIT_COUNT,
+-				desc->info1);
+-	ts->ack_rssi = FIELD_GET(HAL_WBM_RELEASE_INFO2_ACK_FRAME_RSSI,
+-				 desc->info2);
+-	if (desc->info2 & HAL_WBM_RELEASE_INFO2_FIRST_MSDU)
+-		ts->flags |= HAL_TX_STATUS_FLAGS_FIRST_MSDU;
+-	ts->peer_id = FIELD_GET(HAL_WBM_RELEASE_INFO3_PEER_ID, desc->info3);
+-	ts->tid = FIELD_GET(HAL_WBM_RELEASE_INFO3_TID, desc->info3);
+-	if (desc->rate_stats.info0 & HAL_TX_RATE_STATS_INFO0_VALID)
+-		ts->rate_stats = desc->rate_stats.info0;
+-	else
+-		ts->rate_stats = 0;
+-}
+-
+ static inline bool ath11k_dp_tx_completion_valid(struct hal_wbm_release_ring *desc)
+ {
+ 	struct htt_tx_wbm_completion *status_desc;
+ 
+ 	if (FIELD_GET(HAL_WBM_RELEASE_INFO0_REL_SRC_MODULE, desc->info0) ==
+ 	    HAL_WBM_REL_SRC_MODULE_FW) {
+-		status_desc = ((u8 *)desc) + HTT_TX_WBM_COMP_STATUS_OFFSET;
++		status_desc = ((struct htt_tx_wbm_completion *)desc) + HTT_TX_WBM_COMP_STATUS_OFFSET;
+ 
+ 		/* Dont consider HTT_TX_COMP_STATUS_MEC_NOTIFY */
+ 		if (FIELD_GET(HTT_TX_WBM_COMP_INFO0_STATUS, status_desc->info0) ==
+@@ -807,9 +819,9 @@ void ath11k_dp_tx_completion_handler(str
+ 	int hal_ring_id = dp->tx_ring[ring_id].tcl_comp_ring.ring_id, count = 0, i = 0;
+ 	struct hal_srng *status_ring = &ab->hal.srng_list[hal_ring_id];
+ 	struct sk_buff *msdu;
+-	struct hal_tx_status ts = { 0 };
+ 	struct dp_tx_ring *tx_ring = &dp->tx_ring[ring_id];
+ 	int valid_entries;
++	enum hal_wbm_rel_src_module buf_rel_source;
+ 	u32 *desc;
+ 	u32 msdu_id, desc_id;
+ 	u8 mac_id;
+@@ -829,7 +841,7 @@ void ath11k_dp_tx_completion_handler(str
+ 	ath11k_hal_srng_dst_invalidate_entry(ab, status_ring, valid_entries);
+ 
+ 	while ((desc = ath11k_hal_srng_dst_get_next_cache_entry(ab, status_ring))) {
+-		if (!ath11k_dp_tx_completion_valid(desc))
++		if (!ath11k_dp_tx_completion_valid((struct hal_wbm_release_ring *)desc))
+ 			continue;
+ 
+ 		memcpy(&tx_ring->tx_status[count],
+@@ -849,14 +861,16 @@ void ath11k_dp_tx_completion_handler(str
+ 
+ 	while (count--) {
+ 		tx_status = &tx_ring->tx_status[i++];
+-		ath11k_dp_tx_status_parse(ab, tx_status, &ts);
+ 
+ 		desc_id = FIELD_GET(BUFFER_ADDR_INFO1_SW_COOKIE,
+ 				    tx_status->buf_addr_info.info1);
+ 		mac_id = FIELD_GET(DP_TX_DESC_ID_MAC_ID, desc_id);
+ 		msdu_id = FIELD_GET(DP_TX_DESC_ID_MSDU_ID, desc_id);
+ 
+-		if (unlikely(ts.buf_rel_source == HAL_WBM_REL_SRC_MODULE_FW)) {
++		buf_rel_source = FIELD_GET(HAL_WBM_RELEASE_INFO0_REL_SRC_MODULE,
++					   tx_status->info0);
++
++		if (unlikely(buf_rel_source == HAL_WBM_REL_SRC_MODULE_FW)) {
+ 			ath11k_dp_tx_process_htt_tx_complete(ab,
+ 							     (void *)tx_status,
+ 							     mac_id, msdu_id,
+@@ -880,7 +894,7 @@ void ath11k_dp_tx_completion_handler(str
+ 		if (atomic_dec_and_test(&ar->dp.num_tx_pending))
+ 			wake_up(&ar->dp.tx_empty_waitq);
+ 
+-		ath11k_dp_tx_complete_msdu(ar, msdu, &ts);
++		ath11k_dp_tx_complete_msdu(ar, msdu, tx_status, buf_rel_source);
+ 	}
+ }
+ 
diff --git a/package/kernel/mac80211/patches/ath11k_nss/911-335-0002-ath11k-use-DECLARE_BITMAP-for-idr-operations.patch b/package/kernel/mac80211/patches/ath11k_nss/911-335-0002-ath11k-use-DECLARE_BITMAP-for-idr-operations.patch
new file mode 100644
index 00000000000000..7b87edb0ae6baa
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/911-335-0002-ath11k-use-DECLARE_BITMAP-for-idr-operations.patch
@@ -0,0 +1,288 @@
+From 6cd8cb301e431860e71b8d3453846a9ed0efea81 Mon Sep 17 00:00:00 2001
+From: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
+Date: Thu, 11 Nov 2021 10:38:26 +0530
+Subject: [PATCH] ath11k: use DECLARE_BITMAP for idr operations
+
+Use DECLARE_BITMAP for declaring bit map for idrs. And use APIs
+find_first_zero_bit, set_bit and clear bit instead of idr_alloc
+and idr_destroy.
+
+This helps in improving idle CPU and throughput.
+
+Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/dp.c    | 34 +++++++++++++-----
+ drivers/net/wireless/ath/ath11k/dp.h    | 10 +++++-
+ drivers/net/wireless/ath/ath11k/dp_tx.c | 61 ++++++++++++++++++---------------
+ 3 files changed, 69 insertions(+), 36 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp.c
++++ b/drivers/net/wireless/ath/ath11k/dp.c
+@@ -380,6 +380,8 @@ static void ath11k_dp_srng_common_cleanu
+ 	for (i = 0; i < DP_TCL_NUM_RING_MAX; i++) {
+ 		ath11k_dp_srng_cleanup(ab, &dp->tx_ring[i].tcl_data_ring);
+ 		ath11k_dp_srng_cleanup(ab, &dp->tx_ring[i].tcl_comp_ring);
++		kfree(dp->tx_ring[i].idr_pool);
++		dp->tx_ring[i].idr_pool = NULL;
+ 	}
+ 	ath11k_dp_srng_cleanup(ab, &dp->reo_reinject_ring);
+ 	ath11k_dp_srng_cleanup(ab, &dp->rx_rel_ring);
+@@ -392,7 +394,7 @@ static int ath11k_dp_srng_common_setup(s
+ {
+ 	struct ath11k_dp *dp = &ab->dp;
+ 	struct hal_srng *srng;
+-	int i, ret;
++	int i, ret, j;
+ 	u8 tcl_num, wbm_num;
+ 
+ 	ret = ath11k_dp_srng_setup(ab, &dp->wbm_desc_rel_ring,
+@@ -451,6 +453,18 @@ static int ath11k_dp_srng_common_setup(s
+ 		ath11k_dp_shadow_init_timer(ab, &dp->tx_ring_timer[i],
+ 					    ATH11K_SHADOW_DP_TIMER_INTERVAL,
+ 					    dp->tx_ring[i].tcl_data_ring.ring_id);
++
++		dp->tx_ring[i].idr_pool = kcalloc(DP_TX_IDR_SIZE,
++						  sizeof(struct idr_entry), GFP_KERNEL);
++		if (!dp->tx_ring[i].idr_pool) {
++			ath11k_warn(ab, "failed to allocate memory for idr pool ring(%d)\n", i);
++			ret = -ENOMEM;
++			goto err;
++		}
++
++		/* Reset id to default */
++		for (j = 0; j < DP_TX_IDR_SIZE; j++)
++			dp->tx_ring[i].idr_pool[j].id = -1;
+ 	}
+ 
+ 	ret = ath11k_dp_srng_setup(ab, &dp->reo_reinject_ring, HAL_REO_REINJECT,
+@@ -1039,9 +1053,8 @@ void ath11k_dp_vdev_tx_attach(struct ath
+ 	ath11k_dp_update_vdev_search(arvif);
+ }
+ 
+-static int ath11k_dp_tx_pending_cleanup(int buf_id, void *skb, void *ctx)
++static int ath11k_dp_tx_pending_cleanup(struct ath11k_base *ab, void *skb)
+ {
+-	struct ath11k_base *ab = ctx;
+ 	struct sk_buff *msdu = skb;
+ 
+ 	dma_unmap_single(ab->dev, ATH11K_SKB_CB(msdu)->paddr, msdu->len,
+@@ -1056,23 +1069,30 @@ void ath11k_dp_free(struct ath11k_base *
+ {
+ 	struct ath11k_dp *dp = &ab->dp;
+ 	size_t size = 0;
+-	int i;
++	int i, j;
+ 
+ 	size = sizeof(struct hal_wbm_release_ring) * DP_TX_COMP_RING_SIZE;
+ 
+ 	ath11k_dp_link_desc_cleanup(ab, dp->link_desc_banks,
+ 				    HAL_WBM_IDLE_LINK, &dp->wbm_idle_ring);
+ 
++	for (i = 0; i < DP_TCL_NUM_RING_MAX; i++) {
++		struct dp_tx_ring *tx_ring = &dp->tx_ring[i];
++		spin_lock_bh(&tx_ring->tx_idr_lock);
++		for(j = 0; j < DP_TX_IDR_SIZE; j++) {
++
++			if (test_and_clear_bit(j, tx_ring->idrs))
++				ath11k_dp_tx_pending_cleanup(ab, tx_ring->idr_pool[j].buf);
++		}
++
++		spin_unlock_bh(&tx_ring->tx_idr_lock);
++	}
++
+ 	ath11k_dp_srng_common_cleanup(ab);
+ 
+ 	ath11k_dp_reo_cmd_list_cleanup(ab);
+ 
+ 	for (i = 0; i < DP_TCL_NUM_RING_MAX; i++) {
+-		spin_lock_bh(&dp->tx_ring[i].tx_idr_lock);
+-		idr_for_each(&dp->tx_ring[i].txbuf_idr,
+-			     ath11k_dp_tx_pending_cleanup, ab);
+-		idr_destroy(&dp->tx_ring[i].txbuf_idr);
+-		spin_unlock_bh(&dp->tx_ring[i].tx_idr_lock);
+ 		ATH11K_MEMORY_STATS_DEC(ab, malloc_size, size);
+ 		kfree(dp->tx_ring[i].tx_status);
+ 	}
+--- a/drivers/net/wireless/ath/ath11k/dp.h
++++ b/drivers/net/wireless/ath/ath11k/dp.h
+@@ -8,6 +8,7 @@
+ #define ATH11K_DP_H
+ 
+ #include "hal_rx.h"
++#include "hw.h"
+ 
+ #define MAX_RXDMA_PER_PDEV     2
+ 
+@@ -78,6 +79,13 @@ struct dp_rxdma_ring {
+ 
+ #define ATH11K_TX_COMPL_NEXT(x)	(((x) + 1) % DP_TX_COMP_RING_SIZE)
+ 
++struct idr_entry {
++	int id;
++	void *buf;
++};
++
++#define DP_TX_IDR_SIZE	ATH11K_DP_TX_COMP_RING_SIZE
++
+ struct dp_tx_ring {
+ 	u8 tcl_data_ring_id;
+ 	struct dp_srng tcl_data_ring;
+@@ -88,6 +96,8 @@ struct dp_tx_ring {
+ 	struct hal_wbm_release_ring *tx_status;
+ 	int tx_status_head;
+ 	int tx_status_tail;
++	DECLARE_BITMAP(idrs, DP_TX_IDR_SIZE);
++	struct idr_entry *idr_pool;
+ };
+ 
+ enum dp_mon_status_buf_state {
+@@ -207,7 +217,6 @@ struct ath11k_pdev_dp {
+ #define DP_TCL_DATA_RING_SIZE		512
+ #define DP_TCL_DATA_RING_SIZE_WCN6750	2048
+ #define DP_TX_COMP_RING_SIZE		ATH11K_DP_TX_COMP_RING_SIZE
+-#define DP_TX_IDR_SIZE			DP_TX_COMP_RING_SIZE
+ #define DP_TX_COMP_MAX_ALLOWED			DP_TX_COMP_RING_SIZE
+ #define DP_TCL_CMD_RING_SIZE		32
+ #define DP_TCL_STATUS_RING_SIZE		32
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -122,6 +122,7 @@ int ath11k_dp_tx(struct ath11k *ar, stru
+ 	u8 ring_map = 0;
+ 	bool tcl_ring_retry, is_diff_encap = false;
+ 	u8 align_pad, htt_meta_size = 0, max_tx_ring, tcl_ring_id, ring_id;
++	u32 idr;
+ 
+ 	if (unlikely(!(info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) &&
+ 		     !ieee80211_is_data(hdr->frame_control)))
+@@ -152,24 +153,28 @@ tcl_ring_sel:
+ 	tx_ring = &dp->tx_ring[tcl_ring_id];
+ 
+ 	spin_lock_bh(&tx_ring->tx_idr_lock);
+-	ret = idr_alloc(&tx_ring->txbuf_idr, skb, 0,
+-			DP_TX_IDR_SIZE - 1, GFP_ATOMIC);
+-	spin_unlock_bh(&tx_ring->tx_idr_lock);
+-
+-	if (unlikely(ret < 0)) {
++	idr = find_first_zero_bit(tx_ring->idrs, DP_TX_IDR_SIZE);
++	if (unlikely(idr >= DP_TX_IDR_SIZE)) {
+ 		if (ring_map == (BIT(max_tx_ring) - 1) ||
+ 		    !ab->hw_params.tcl_ring_retry) {
++			spin_unlock_bh(&tx_ring->tx_idr_lock);
+ 			ab->soc_stats.tx_err.idr_na[tcl_ring_id]++;
+ 			return -ENOSPC;
+ 		}
+ 
+ 		/* Check if the next ring is available */
++		spin_unlock_bh(&tx_ring->tx_idr_lock);
+ 		ring_selector++;
+ 		goto tcl_ring_sel;
+ 	}
+ 
++	set_bit(idr, tx_ring->idrs);
++	tx_ring->idr_pool[idr].id = idr;
++	tx_ring->idr_pool[idr].buf = skb;
++	spin_unlock_bh(&tx_ring->tx_idr_lock);
++
+ 	ti.desc_id = FIELD_PREP(DP_TX_DESC_ID_MAC_ID, ar->pdev_idx) |
+-		     FIELD_PREP(DP_TX_DESC_ID_MSDU_ID, ret) |
++		     FIELD_PREP(DP_TX_DESC_ID_MSDU_ID, idr) |
+ 		     FIELD_PREP(DP_TX_DESC_ID_POOL_ID, pool_id);
+ 	ti.encap_type = ath11k_dp_tx_get_encap_type(arvif, skb);
+ 
+@@ -341,10 +346,9 @@ fail_unmap_dma:
+ fail_remove_idr:
+ 	if (ti.pkt_offset)
+ 		skb_pull(skb, ti.pkt_offset);
+-	spin_lock_bh(&tx_ring->tx_idr_lock);
+-	idr_remove(&tx_ring->txbuf_idr,
+-		   FIELD_GET(DP_TX_DESC_ID_MSDU_ID, ti.desc_id));
+-	spin_unlock_bh(&tx_ring->tx_idr_lock);
++
++	tx_ring->idr_pool[idr].id = -1;
++	clear_bit(idr, tx_ring->idrs);
+ 
+ 	if (tcl_ring_retry)
+ 		goto tcl_ring_sel;
+@@ -353,16 +357,19 @@ fail_remove_idr:
+ }
+ 
+ static void ath11k_dp_tx_free_txbuf(struct ath11k_base *ab, u8 mac_id,
+-				    int msdu_id,
++				    u32 msdu_id,
+ 				    struct dp_tx_ring *tx_ring)
+ {
+ 	struct ath11k *ar;
+-	struct sk_buff *msdu;
++	struct sk_buff *msdu = NULL;
+ 	struct ath11k_skb_cb *skb_cb;
+ 
+-	spin_lock(&tx_ring->tx_idr_lock);
+-	msdu = idr_remove(&tx_ring->txbuf_idr, msdu_id);
+-	spin_unlock(&tx_ring->tx_idr_lock);
++	if (msdu_id < DP_TX_IDR_SIZE &&
++	    tx_ring->idr_pool[msdu_id].id == msdu_id) {
++		msdu = tx_ring->idr_pool[msdu_id].buf;
++		tx_ring->idr_pool[msdu_id].id = -1;
++		clear_bit(msdu_id, tx_ring->idrs);
++	}
+ 
+ 	if (unlikely(!msdu)) {
+ 		ath11k_warn(ab, "tx completion for unknown msdu_id %d\n",
+@@ -386,16 +393,20 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
+ 				 struct ath11k_dp_htt_wbm_tx_status *ts)
+ {
+ 	struct ieee80211_tx_status status = { 0 };
+-	struct sk_buff *msdu;
++	struct sk_buff *msdu = NULL;
+ 	struct ieee80211_tx_info *info;
+ 	struct ath11k_skb_cb *skb_cb;
+ 	struct ath11k *ar;
+ 	struct ath11k_peer *peer;
++	u32 msdu_id = ts->msdu_id;
+ 	u8 flags = 0;
+ 
+-	spin_lock(&tx_ring->tx_idr_lock);
+-	msdu = idr_remove(&tx_ring->txbuf_idr, ts->msdu_id);
+-	spin_unlock(&tx_ring->tx_idr_lock);
++	if (msdu_id < DP_TX_IDR_SIZE &&
++	    tx_ring->idr_pool[msdu_id].id == msdu_id) {
++		msdu = tx_ring->idr_pool[msdu_id].buf;
++		tx_ring->idr_pool[msdu_id].id = -1;
++		clear_bit(msdu_id, tx_ring->idrs);
++	}
+ 
+ 	if (unlikely(!msdu)) {
+ 		ath11k_warn(ab, "htt tx completion for unknown msdu_id %d\n",
+@@ -860,6 +871,7 @@ void ath11k_dp_tx_completion_handler(str
+ 	}
+ 
+ 	while (count--) {
++		msdu=NULL;
+ 		tx_status = &tx_ring->tx_status[i++];
+ 
+ 		desc_id = FIELD_GET(BUFFER_ADDR_INFO1_SW_COOKIE,
+@@ -878,17 +890,19 @@ void ath11k_dp_tx_completion_handler(str
+ 			continue;
+ 		}
+ 
+-		spin_lock(&tx_ring->tx_idr_lock);
+-		msdu = idr_remove(&tx_ring->txbuf_idr, msdu_id);
++		if (msdu_id < DP_TX_IDR_SIZE &&
++		    tx_ring->idr_pool[msdu_id].id == msdu_id) {
++			msdu = tx_ring->idr_pool[msdu_id].buf;
++			tx_ring->idr_pool[msdu_id].id = -1;
++			clear_bit(msdu_id, tx_ring->idrs);
++		}
++
+ 		if (unlikely(!msdu)) {
+ 			ath11k_warn(ab, "tx completion for unknown msdu_id %d\n",
+ 				    msdu_id);
+-			spin_unlock(&tx_ring->tx_idr_lock);
+ 			continue;
+ 		}
+ 
+-		spin_unlock(&tx_ring->tx_idr_lock);
+-
+ 		ar = ab->pdevs[mac_id].ar;
+ 
+ 		if (atomic_dec_and_test(&ar->dp.num_tx_pending))
diff --git a/package/kernel/mac80211/patches/ath11k_nss/911-335-0006-ath11k-add-simple-tx-handler-for-AP-mode.patch b/package/kernel/mac80211/patches/ath11k_nss/911-335-0006-ath11k-add-simple-tx-handler-for-AP-mode.patch
new file mode 100644
index 00000000000000..c61c206c417de7
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/911-335-0006-ath11k-add-simple-tx-handler-for-AP-mode.patch
@@ -0,0 +1,185 @@
+From 9600bc899bd28386375f5b5902a33f1984ce9da8 Mon Sep 17 00:00:00 2001
+From: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
+Date: Thu, 18 Nov 2021 13:11:02 +0530
+Subject: [PATCH] ath11k: add simple tx handler for AP mode
+
+Add simple tx handler for AP mode to skip cheks which are not
+applicable for AP mode.
+
+Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/dp_tx.c    | 123 +++++++++++++++++++++++++++++
+ drivers/net/wireless/ath/ath11k/dp_tx.h    |   2 +
+ drivers/net/wireless/ath/ath11k/hal_desc.h |   6 ++
+ drivers/net/wireless/ath/ath11k/mac.c      |   3 +
+ 4 files changed, 134 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -103,6 +103,128 @@ static int ath11k_dp_prepare_htt_metadat
+ 	return 0;
+ }
+ 
++int ath11k_dp_tx_simple(struct ath11k *ar, struct ath11k_vif *arvif,
++			struct sk_buff *skb, struct ath11k_sta *arsta)
++{
++	struct ath11k_base *ab = ar->ab;
++	struct ath11k_dp *dp = &ab->dp;
++	struct ath11k_skb_cb *skb_cb = ATH11K_SKB_CB(skb);
++	struct hal_srng *tcl_ring;
++	struct dp_tx_ring *tx_ring;
++	struct hal_tcl_data_cmd *tcl_desc;
++	void *hal_tcl_desc;
++	dma_addr_t paddr;
++	u8 pool_id;
++	u8 hal_ring_id;
++	int ret;
++	u32 idr;
++	u8 tcl_ring_id, ring_id, max_tx_ring;
++	u8 buf_id;
++	u32 desc_id;
++	u8 ring_selector;
++
++	max_tx_ring = ab->hw_params.max_tx_ring;
++
++	if (unlikely(atomic_read(&ab->num_max_allowed) > DP_TX_COMP_MAX_ALLOWED)) {
++		atomic_inc(&ab->soc_stats.tx_err.max_fail);
++		ret = -EINVAL;
++	}
++
++	ring_selector = smp_processor_id();
++	pool_id = ring_selector;
++
++	if (max_tx_ring == 1) {
++		ring_id = 0;
++		tcl_ring_id = 0;
++	} else {
++		ring_id = ring_selector % max_tx_ring;
++		tcl_ring_id = (ring_id == DP_TCL_NUM_RING_MAX) ?
++			      DP_TCL_NUM_RING_MAX - 1 : ring_id;
++	}
++
++	buf_id = tcl_ring_id + HAL_RX_BUF_RBM_SW0_BM;
++	tx_ring = &dp->tx_ring[tcl_ring_id];
++
++	spin_lock_bh(&tx_ring->tx_idr_lock);
++	idr = find_first_zero_bit(tx_ring->idrs, DP_TX_IDR_SIZE);
++	if (unlikely(idr >= DP_TX_IDR_SIZE)) {
++		spin_unlock_bh(&tx_ring->tx_idr_lock);
++		return -ENOSPC;
++	}
++
++	set_bit(idr, tx_ring->idrs);
++	tx_ring->idr_pool[idr].id = idr;
++	tx_ring->idr_pool[idr].buf = skb;
++	spin_unlock_bh(&tx_ring->tx_idr_lock);
++
++	desc_id = FIELD_PREP(DP_TX_DESC_ID_MAC_ID, ar->pdev_idx) |
++		  FIELD_PREP(DP_TX_DESC_ID_MSDU_ID, idr) |
++		  FIELD_PREP(DP_TX_DESC_ID_POOL_ID, pool_id);
++
++	skb_cb->vif = arvif->vif;
++	skb_cb->ar = ar;
++
++	paddr = dma_map_single(ab->dev, skb->data, skb->len, DMA_TO_DEVICE);
++	if (unlikely(dma_mapping_error(ab->dev, paddr))) {
++		atomic_inc(&ab->soc_stats.tx_err.misc_fail);
++		ath11k_warn(ab, "failed to DMA map data Tx buffer\n");
++		ret = -ENOMEM;
++		goto fail_remove_idr;
++	}
++
++	skb_cb->paddr = paddr;
++
++	hal_ring_id = tx_ring->tcl_data_ring.ring_id;
++	tcl_ring = &ab->hal.srng_list[hal_ring_id];
++
++	spin_lock_bh(&tcl_ring->lock);
++	ath11k_hal_srng_access_begin(ab, tcl_ring);
++
++	hal_tcl_desc = (void *)ath11k_hal_srng_src_get_next_entry(ab, tcl_ring);
++	if (unlikely(!hal_tcl_desc)) {
++		ath11k_hal_srng_access_end(ab, tcl_ring);
++		spin_unlock_bh(&tcl_ring->lock);
++		ab->soc_stats.tx_err.desc_na[tcl_ring_id]++;
++		ret = -ENOMEM;
++		goto fail_remove_idr;
++	}
++
++	tcl_desc = (struct hal_tcl_data_cmd *)(hal_tcl_desc + sizeof(struct hal_tlv_hdr));
++	tcl_desc->info3 = 0;
++	tcl_desc->info4 = 0;
++
++	tcl_desc->buf_addr_info.info0 = FIELD_PREP(BUFFER_ADDR_INFO0_ADDR, paddr);
++	tcl_desc->buf_addr_info.info1 = FIELD_PREP(BUFFER_ADDR_INFO1_ADDR,
++			((uint64_t)paddr >> HAL_ADDR_MSB_REG_SHIFT));
++	tcl_desc->buf_addr_info.info1 |= FIELD_PREP(BUFFER_ADDR_INFO1_RET_BUF_MGR, buf_id) |
++		FIELD_PREP(BUFFER_ADDR_INFO1_SW_COOKIE, desc_id);
++	tcl_desc->info0 = FIELD_PREP(HAL_TCL_DATA_CMD_INFO0_SEARCH_TYPE,
++			arvif->search_type) |
++		FIELD_PREP(HAL_TCL_DATA_CMD_INFO0_ENCAP_TYPE, HAL_TCL_ENCAP_TYPE_ETHERNET) |
++		FIELD_PREP(HAL_TCL_DATA_CMD_INFO0_ADDR_EN, arvif->hal_addr_search_flags) |
++		FIELD_PREP(HAL_TCL_DATA_CMD_INFO0_CMD_NUM, arvif->tcl_metadata);
++
++	tcl_desc->info1 = FIELD_PREP(HAL_TCL_DATA_CMD_INFO1_DATA_LEN, skb->len);
++
++	if (likely(skb->ip_summed == CHECKSUM_PARTIAL))
++		tcl_desc->info1 |= TX_IP_CHECKSUM;
++
++	tcl_desc->info2 = FIELD_PREP(HAL_TCL_DATA_CMD_INFO2_LMAC_ID, ar->lmac_id);
++
++	ath11k_hal_srng_access_end(ab, tcl_ring);
++	spin_unlock_bh(&tcl_ring->lock);
++
++	atomic_inc(&ar->dp.num_tx_pending);
++	atomic_inc(&ab->num_max_allowed);
++
++	return 0;
++
++fail_remove_idr:
++	tx_ring->idr_pool[idr].id = -1;
++	clear_bit(idr, tx_ring->idrs);
++	return ret;
++}
++
+ int ath11k_dp_tx(struct ath11k *ar, struct ath11k_vif *arvif,
+ 		 struct ath11k_sta *arsta, struct sk_buff *skb)
+ {
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.h
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.h
+@@ -218,6 +218,8 @@ void ath11k_dp_tx_update_txcompl(struct
+ int ath11k_dp_tx_htt_h2t_ver_req_msg(struct ath11k_base *ab);
+ int ath11k_dp_tx(struct ath11k *ar, struct ath11k_vif *arvif,
+ 		 struct ath11k_sta *arsta, struct sk_buff *skb);
++int ath11k_dp_tx_simple(struct ath11k *ar, struct ath11k_vif *arvif,
++			struct sk_buff *skb, struct ath11k_sta *arsta);
+ void ath11k_dp_tx_completion_handler(struct ath11k_base *ab, int ring_id);
+ int ath11k_dp_tx_send_reo_cmd(struct ath11k_base *ab, struct dp_rx_tid *rx_tid,
+ 			      enum hal_reo_cmd_type type,
+--- a/drivers/net/wireless/ath/ath11k/hal_desc.h
++++ b/drivers/net/wireless/ath/ath11k/hal_desc.h
+@@ -952,6 +952,12 @@ struct hal_reo_flush_cache {
+ 	u32 rsvd0[6];
+ } __packed;
+ 
++#define TX_IP_CHECKSUM HAL_TCL_DATA_CMD_INFO1_IP4_CKSUM_EN | \
++		       HAL_TCL_DATA_CMD_INFO1_UDP4_CKSUM_EN | \
++		       HAL_TCL_DATA_CMD_INFO1_UDP6_CKSUM_EN | \
++		       HAL_TCL_DATA_CMD_INFO1_TCP4_CKSUM_EN | \
++		       HAL_TCL_DATA_CMD_INFO1_TCP6_CKSUM_EN
++
+ #define HAL_TCL_DATA_CMD_INFO0_DESC_TYPE	BIT(0)
+ #define HAL_TCL_DATA_CMD_INFO0_EPD		BIT(1)
+ #define HAL_TCL_DATA_CMD_INFO0_ENCAP_TYPE	GENMASK(3, 2)
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -6733,6 +6733,9 @@ static void ath11k_mac_op_tx(struct ieee
+ 
+ 	if (ar->ab->nss.enabled)
+ 		ret = ath11k_nss_tx(arvif, skb);
++	else if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP && 0)
++		ret = ath11k_dp_tx_simple(ar, arvif, skb,
++					  (control->sta) ? (struct ath11k_sta *)control->sta->drv_priv : NULL);
+ 	else
+ 		ret = ath11k_dp_tx(ar, arvif, arsta, skb);
+ 
diff --git a/package/kernel/mac80211/patches/ath11k_nss/911-335-ath11k-fix-ar-ops-crash.patch b/package/kernel/mac80211/patches/ath11k_nss/911-335-ath11k-fix-ar-ops-crash.patch
new file mode 100644
index 00000000000000..ffae27277d7316
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/911-335-ath11k-fix-ar-ops-crash.patch
@@ -0,0 +1,71 @@
+From: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
+Subject: [patch] ath11k: fix NULL pointer crash due to the radio ops
+
+Mac80211 callback ops variable not intialised in the radio structure.
+when the firmware not advertise the WMI_TLV_SERVICE_PEER_TID_CONFIGS_SUPPORT
+in the service bitmmap, driver try to set set_tid_config ops as NULL.
+Since ar->ops already NULL, it leads to NULL pointer access crash.
+So fix this crash by properly intialise the mac80211 callback ops
+in the radio structure.
+
+Tested-on: QCN6122 hw1.0 WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
+---
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -10558,6 +10558,7 @@ int ath11k_mac_allocate(struct ath11k_ba
+ 	struct ieee80211_hw *hw;
+ 	struct ath11k *ar;
+ 	struct ath11k_pdev *pdev;
++	struct ieee80211_ops *ops;
+ 	int ret;
+ 	int i;
+ 
+@@ -10565,17 +10566,25 @@ int ath11k_mac_allocate(struct ath11k_ba
+ 		return 0;
+ 
+ 	for (i = 0; i < ab->num_radios; i++) {
++		ops = kmemdup(&ath11k_ops, sizeof(ath11k_ops), GFP_KERNEL);
++		if (!ops) {
++			ret = -ENOMEM;
++			goto err_free_mac;
++		}
++
+ 		pdev = &ab->pdevs[i];
+-		hw = ieee80211_alloc_hw(sizeof(struct ath11k), &ath11k_ops);
++		hw = ieee80211_alloc_hw(sizeof(struct ath11k), ops);
+ 		if (!hw) {
+ 			ath11k_warn(ab, "failed to allocate mac80211 hw device\n");
+ 			ret = -ENOMEM;
++			kfree(ops);
+ 			goto err_free_mac;
+ 		}
+ 
+ 		ar = hw->priv;
+ 		ar->hw = hw;
+ 		ar->ab = ab;
++		ar->ops = ops;
+ 		ar->pdev = pdev;
+ 		ar->pdev_idx = i;
+ 		ar->lmac_id = ath11k_hw_get_mac_from_pdev_id(&ab->hw_params, i);
+@@ -10636,6 +10645,7 @@ void ath11k_mac_destroy(struct ath11k_ba
+ {
+ 	struct ath11k *ar;
+ 	struct ath11k_pdev *pdev;
++	struct ieee80211_ops *ops;
+ 	int i;
+ 
+ 	for (i = 0; i < ab->num_radios; i++) {
+@@ -10644,8 +10654,9 @@ void ath11k_mac_destroy(struct ath11k_ba
+ 		if (!ar)
+ 			continue;
+ 
+-		ath11k_fw_stats_free(&ar->fw_stats);
++		ops = ar->ops;
+ 		ieee80211_free_hw(ar->hw);
++		kfree(ops);
+ 		pdev->ar = NULL;
+ 	}
+ }
diff --git a/package/kernel/mac80211/patches/ath11k_nss/911-373-ath11k-Add-retry-mechanism-for-update_rx_qu.patch b/package/kernel/mac80211/patches/ath11k_nss/911-373-ath11k-Add-retry-mechanism-for-update_rx_qu.patch
new file mode 100644
index 00000000000000..90f335efbca6fb
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/911-373-ath11k-Add-retry-mechanism-for-update_rx_qu.patch
@@ -0,0 +1,384 @@
+From 17d1895bad45ec2ef4c8c430ac0fbaff2ff1cf39 Mon Sep 17 00:00:00 2001
+From: Manish Dharanenthiran <quic_mdharane@quicinc.com>
+Date: Tue, 18 Apr 2023 15:01:42 +0530
+Subject: [PATCH 2/3] CHROMIUM: ath11k: Add retry mechanism for update_rx_queue
+ reo cmd
+
+While reo_cmd ring is full, peer delete update rx queue
+will be failed as there is no space to send the command
+in ring. During the failure scenario, host will do
+dma_unmap and free the allocated address but the HW
+still have that particular vaddr. So, on next alloc
+cycle kernel will allocated the freed addr but HW will
+still have the address. This will result in memory
+corruption as the host will try to access/write that
+memory which is already in-use.
+
+To avoid this corruption, added new retry mechanism
+for HAL_REO_CMD_UPDATE_RX_QUEUE by adding new list to
+dp struct and protecting with new lock for access.
+This avoids the host free in failure case and will
+be freed only when HW freed that particular vaddr.
+
+Also, updated below changes
+1) reo_flush command for sending 1K desc in one
+command instead of sending 11 command for single
+TID.
+
+2) Set FWD_MPDU and valid bit flag so that reo
+flush will happen soon instead of waiting to
+flush the queue.
+
+Signed-off-by: Manish Dharanenthiran <quic_mdharane@quicinc.com>
+Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/core.h    |   3 +
+ drivers/net/wireless/ath/ath11k/debugfs.c |  12 ++
+ drivers/net/wireless/ath/ath11k/dp.c      |   2 +
+ drivers/net/wireless/ath/ath11k/dp.h      |  15 ++
+ drivers/net/wireless/ath/ath11k/dp_rx.c   | 167 +++++++++++++++++-----
+ 5 files changed, 161 insertions(+), 38 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -936,6 +936,9 @@ struct ath11k_soc_dp_stats {
+ 	u32 rxdma_error[HAL_REO_ENTR_RING_RXDMA_ECODE_MAX];
+ 	u32 reo_error[HAL_REO_DEST_RING_ERROR_CODE_MAX];
+ 	u32 hal_reo_error[DP_REO_DST_RING_MAX];
++	u32 hal_reo_cmd_drain;
++	u32 reo_cmd_cache_error;
++	u32 reo_cmd_update_rx_queue_error;
+ 	struct ath11k_soc_dp_tx_err_stats tx_err;
+ 	struct ath11k_dp_ring_bp_stats bp_stats;
+ };
+--- a/drivers/net/wireless/ath/ath11k/debugfs.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs.c
+@@ -851,6 +851,18 @@ static ssize_t ath11k_debugfs_dump_soc_d
+ 			 "\nNSS Transmit Failures: %d\n",
+ 			 atomic_read(&soc_stats->tx_err.nss_tx_fail));
+ 
++	len += scnprintf(buf + len, size - len,
++			 "\nHAL_REO_CMD_DRAIN Counter: %u\n",
++			 soc_stats->hal_reo_cmd_drain);
++
++	len += scnprintf(buf + len, size - len,
++			 "\nREO_CMD_CACHE_FLUSH Failure: %u\n",
++			 soc_stats->reo_cmd_cache_error);
++
++	len += scnprintf(buf + len, size - len,
++			 "\nREO_CMD_UPDATE_RX_QUEUE Failure: %u\n",
++			 soc_stats->reo_cmd_update_rx_queue_error);
++
+ 	len += ath11k_debugfs_dump_soc_ring_bp_stats(ab, buf + len, size - len);
+ 
+ 	if (len > size)
+--- a/drivers/net/wireless/ath/ath11k/dp.c
++++ b/drivers/net/wireless/ath/ath11k/dp.c
+@@ -1113,8 +1113,10 @@ int ath11k_dp_alloc(struct ath11k_base *
+ 
+ 	INIT_LIST_HEAD(&dp->reo_cmd_list);
+ 	INIT_LIST_HEAD(&dp->reo_cmd_cache_flush_list);
++	INIT_LIST_HEAD(&dp->reo_cmd_update_rx_queue_list);
+ 	INIT_LIST_HEAD(&dp->dp_full_mon_mpdu_list);
+ 	spin_lock_init(&dp->reo_cmd_lock);
++	spin_lock_init(&dp->reo_cmd_update_queue_lock);
+ 
+ 	dp->reo_cmd_cache_flush_count = 0;
+ 
+--- a/drivers/net/wireless/ath/ath11k/dp.h
++++ b/drivers/net/wireless/ath/ath11k/dp.h
+@@ -24,6 +24,7 @@ struct dp_rx_tid {
+ 	u32 *vaddr;
+ 	dma_addr_t paddr;
+ 	u32 size;
++	u32 pending_desc_size;
+ 	u32 ba_win_sz;
+ 	bool active;
+ 
+@@ -51,6 +52,14 @@ struct dp_reo_cache_flush_elem {
+ 	unsigned long ts;
+ };
+ 
++struct dp_reo_update_rx_queue_elem {
++	struct list_head list;
++	struct dp_rx_tid data;
++	int peer_id;
++	u8 tid;
++	bool reo_cmd_update_rx_queue_resend_flag;
++};
++
+ struct dp_reo_cmd {
+ 	struct list_head list;
+ 	struct dp_rx_tid data;
+@@ -296,6 +305,12 @@ struct ath11k_dp {
+ 	 * - reo_cmd_cache_flush_count
+ 	 */
+ 	spinlock_t reo_cmd_lock;
++	struct list_head reo_cmd_update_rx_queue_list;
++	/**
++	 * protects access to below field,
++	 * - reo_cmd_update_rx_queue_list
++	 */
++	spinlock_t reo_cmd_update_queue_lock;
+ 	struct ath11k_hp_update_timer reo_cmd_timer;
+ 	struct ath11k_hp_update_timer tx_ring_timer[DP_TCL_NUM_RING_MAX];
+ };
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -21,6 +21,9 @@
+ 
+ #define ATH11K_DP_RX_FRAGMENT_TIMEOUT_MS (2 * HZ)
+ 
++static void ath11k_dp_rx_tid_del_func(struct ath11k_dp *dp, void *ctx,
++				      enum hal_reo_cmd_status status);
++
+ static inline
+ u8 *ath11k_dp_rx_h_80211_hdr(struct ath11k_base *ab, struct hal_rx_desc *desc)
+ {
+@@ -707,13 +710,50 @@ static int ath11k_dp_rx_pdev_srng_alloc(
+ 	return 0;
+ }
+ 
++static int ath11k_peer_rx_tid_delete_handler(struct ath11k_base *ab,
++					     struct dp_rx_tid *rx_tid, u8 tid)
++{
++	struct ath11k_hal_reo_cmd cmd = {0};
++	struct ath11k_dp *dp = &ab->dp;
++
++	lockdep_assert_held(&dp->reo_cmd_update_queue_lock);
++
++	rx_tid->active = false;
++	cmd.flag = HAL_REO_CMD_FLG_NEED_STATUS;
++	cmd.addr_lo = lower_32_bits(rx_tid->paddr);
++	cmd.addr_hi = upper_32_bits(rx_tid->paddr);
++	cmd.upd0 |= HAL_REO_CMD_UPD0_VLD;
++
++	return ath11k_dp_tx_send_reo_cmd(ab, rx_tid,
++					 HAL_REO_CMD_UPDATE_RX_QUEUE,
++					 &cmd,
++					 ath11k_dp_rx_tid_del_func);
++}
++
+ void ath11k_dp_reo_cmd_list_cleanup(struct ath11k_base *ab)
+ {
+ 	struct ath11k_dp *dp = &ab->dp;
+ 	struct dp_reo_cmd *cmd, *tmp;
+ 	struct dp_reo_cache_flush_elem *cmd_cache, *tmp_cache;
++	struct dp_reo_update_rx_queue_elem *cmd_queue, *tmp_queue;
+ 	struct dp_rx_tid *rx_tid;
+ 
++	spin_lock_bh(&dp->reo_cmd_update_queue_lock);
++	list_for_each_entry_safe(cmd_queue, tmp_queue,
++				 &dp->reo_cmd_update_rx_queue_list,
++				 list) {
++		list_del(&cmd_queue->list);
++		rx_tid = &cmd_queue->data;
++		if (rx_tid->vaddr) {
++			dma_unmap_single(ab->dev, rx_tid->paddr,
++					 rx_tid->size, DMA_BIDIRECTIONAL);
++			kfree(rx_tid->vaddr);
++			rx_tid->vaddr = NULL;
++		}
++		kfree(cmd_queue);
++	}
++	spin_unlock_bh(&dp->reo_cmd_update_queue_lock);
++
+ 	spin_lock_bh(&dp->reo_cmd_lock);
+ 	list_for_each_entry_safe(cmd, tmp, &dp->reo_cmd_list, list) {
+ 		list_del(&cmd->list);
+@@ -759,14 +799,18 @@ static void ath11k_dp_reo_cmd_free(struc
+ 	}
+ }
+ 
+-static void ath11k_dp_reo_cache_flush(struct ath11k_base *ab,
++static int ath11k_dp_reo_cache_flush(struct ath11k_base *ab,
+ 				      struct dp_rx_tid *rx_tid)
+ {
+ 	struct ath11k_hal_reo_cmd cmd = {0};
+ 	unsigned long tot_desc_sz, desc_sz;
+ 	int ret;
+ 
+-	tot_desc_sz = rx_tid->size;
++	if (rx_tid->pending_desc_size)
++		tot_desc_sz = rx_tid->pending_desc_size;
++	else
++		tot_desc_sz = rx_tid->size;
++
+ 	desc_sz = ath11k_hal_reo_qdesc_size(0, HAL_DESC_REO_NON_QOS_TID);
+ 
+ 	while (tot_desc_sz > desc_sz) {
+@@ -777,11 +821,17 @@ static void ath11k_dp_reo_cache_flush(st
+ 						HAL_REO_CMD_FLUSH_CACHE, &cmd,
+ 						NULL);
+ 		if (ret)
+-			ath11k_warn(ab,
+-				    "failed to send HAL_REO_CMD_FLUSH_CACHE, tid %d (%d)\n",
+-				    rx_tid->tid, ret);
++			rx_tid->pending_desc_size = tot_desc_sz + desc_sz;
++
++		/* If this fails with ring full condition, then
++		 * no need to retry below as it is expected to
++		 * fail within short time
++		 */
++		if (ret == -ENOBUFS)
++			goto exit;
+ 	}
+ 
++	rx_tid->pending_desc_size = desc_sz;
+ 	memset(&cmd, 0, sizeof(cmd));
+ 	cmd.addr_lo = lower_32_bits(rx_tid->paddr);
+ 	cmd.addr_hi = upper_32_bits(rx_tid->paddr);
+@@ -789,24 +839,21 @@ static void ath11k_dp_reo_cache_flush(st
+ 	ret = ath11k_dp_tx_send_reo_cmd(ab, rx_tid,
+ 					HAL_REO_CMD_FLUSH_CACHE,
+ 					&cmd, ath11k_dp_reo_cmd_free);
+-	if (ret) {
+-		ath11k_err(ab, "failed to send HAL_REO_CMD_FLUSH_CACHE cmd, tid %d (%d)\n",
+-			   rx_tid->tid, ret);
+-		dma_unmap_single(ab->dev, rx_tid->paddr, rx_tid->size,
+-				 DMA_BIDIRECTIONAL);
+-		kfree(rx_tid->vaddr);
+-		rx_tid->vaddr = NULL;
+-	}
++
++exit:
++	return ret;
+ }
+ 
+ static void ath11k_dp_rx_tid_del_func(struct ath11k_dp *dp, void *ctx,
+ 				      enum hal_reo_cmd_status status)
+ {
+ 	struct ath11k_base *ab = dp->ab;
+-	struct dp_rx_tid *rx_tid = ctx;
++	struct dp_rx_tid *rx_tid = ctx, *update_rx_tid;
+ 	struct dp_reo_cache_flush_elem *elem, *tmp;
++	struct dp_reo_update_rx_queue_elem *qelem, *qtmp;
+ 
+ 	if (status == HAL_REO_CMD_DRAIN) {
++		ab->soc_stats.hal_reo_cmd_drain++;
+ 		goto free_desc;
+ 	} else if (status != HAL_REO_CMD_SUCCESS) {
+ 		/* Shouldn't happen! Cleanup in case of other failure? */
+@@ -815,6 +862,29 @@ static void ath11k_dp_rx_tid_del_func(st
+ 		return;
+ 	}
+ 
++	/* Check if there is any pending rx_queue, if yes then update it */
++	spin_lock_bh(&dp->reo_cmd_update_queue_lock);
++	list_for_each_entry_safe(qelem, qtmp, &dp->reo_cmd_update_rx_queue_list,
++				 list) {
++		if (qelem->reo_cmd_update_rx_queue_resend_flag &&
++		    qelem->data.active) {
++			update_rx_tid = &qelem->data;
++
++			if (ath11k_peer_rx_tid_delete_handler(ab, update_rx_tid, qelem->tid)) {
++				update_rx_tid->active = true;
++				break;
++			}
++			update_rx_tid->vaddr = NULL;
++			update_rx_tid->paddr = 0;
++			update_rx_tid->size = 0;
++			update_rx_tid->pending_desc_size = 0;
++
++			list_del(&qelem->list);
++			kfree(qelem);
++		}
++	}
++	spin_unlock_bh(&dp->reo_cmd_update_queue_lock);
++
+ 	elem = kzalloc(sizeof(*elem), GFP_ATOMIC);
+ 	if (!elem)
+ 		goto free_desc;
+@@ -832,13 +902,20 @@ static void ath11k_dp_rx_tid_del_func(st
+ 		if (dp->reo_cmd_cache_flush_count > DP_REO_DESC_FREE_THRESHOLD ||
+ 		    time_after(jiffies, elem->ts +
+ 			       msecs_to_jiffies(DP_REO_DESC_FREE_TIMEOUT_MS))) {
++			spin_unlock_bh(&dp->reo_cmd_lock);
++			if (ath11k_dp_reo_cache_flush(ab, &elem->data)) {
++				ab->soc_stats.reo_cmd_cache_error++;
++				/* In failure case, just update the timestamp
++				 * for flush cache elem and continue
++				 */
++				spin_lock_bh(&dp->reo_cmd_lock);
++				elem->ts = jiffies;
++				break;
++			}
++			spin_lock_bh(&dp->reo_cmd_lock);
+ 			list_del(&elem->list);
+ 			dp->reo_cmd_cache_flush_count--;
+-			spin_unlock_bh(&dp->reo_cmd_lock);
+-
+-			ath11k_dp_reo_cache_flush(ab, &elem->data);
+ 			kfree(elem);
+-			spin_lock_bh(&dp->reo_cmd_lock);
+ 		}
+ 	}
+ 	spin_unlock_bh(&dp->reo_cmd_lock);
+@@ -854,34 +931,48 @@ free_desc:
+ void ath11k_peer_rx_tid_delete(struct ath11k *ar,
+ 			       struct ath11k_peer *peer, u8 tid)
+ {
+-	struct ath11k_hal_reo_cmd cmd = {0};
+ 	struct dp_rx_tid *rx_tid = &peer->rx_tid[tid];
+-	int ret;
++	struct dp_reo_update_rx_queue_elem *elem, *tmp;
++	struct ath11k_base *ab = ar->ab;
++	struct ath11k_dp *dp = &ab->dp;
+ 
+ 	if (!rx_tid->active)
+ 		return;
+ 
+-	rx_tid->active = false;
++	elem = kzalloc(sizeof(*elem), GFP_ATOMIC);
++	if (!elem) {
++		ath11k_warn(ar->ab, "failed to alloc reo_update_rx_queue_elem, rx tid %d\n",
++			    rx_tid->tid);
++		return;
++	}
++	elem->reo_cmd_update_rx_queue_resend_flag = false;
++	elem->peer_id = peer->peer_id;
++	elem->tid = tid;
++	memcpy(&elem->data, rx_tid, sizeof(*rx_tid));
++	spin_lock_bh(&dp->reo_cmd_update_queue_lock);
++	list_add_tail(&elem->list, &dp->reo_cmd_update_rx_queue_list);
+ 
+-	cmd.flag = HAL_REO_CMD_FLG_NEED_STATUS;
+-	cmd.addr_lo = lower_32_bits(rx_tid->paddr);
+-	cmd.addr_hi = upper_32_bits(rx_tid->paddr);
+-	cmd.upd0 |= HAL_REO_CMD_UPD0_VLD;
+-	ret = ath11k_dp_tx_send_reo_cmd(ar->ab, rx_tid,
+-					HAL_REO_CMD_UPDATE_RX_QUEUE, &cmd,
+-					ath11k_dp_rx_tid_del_func);
+-	if (ret) {
+-		if (ret != -ESHUTDOWN)
+-			ath11k_err(ar->ab, "failed to send HAL_REO_CMD_UPDATE_RX_QUEUE cmd, tid %d (%d)\n",
+-				   tid, ret);
+-		dma_unmap_single(ar->ab->dev, rx_tid->paddr, rx_tid->size,
+-				 DMA_BIDIRECTIONAL);
+-		kfree(rx_tid->vaddr);
++	list_for_each_entry_safe(elem, tmp, &dp->reo_cmd_update_rx_queue_list,
++				 list) {
++		rx_tid = &elem->data;
++
++		if (ath11k_peer_rx_tid_delete_handler(ab, rx_tid, elem->tid)) {
++			rx_tid->active = true;
++			ab->soc_stats.reo_cmd_update_rx_queue_error++;
++			elem->reo_cmd_update_rx_queue_resend_flag = true;
++			break;
++		}
+ 		rx_tid->vaddr = NULL;
++		rx_tid->paddr = 0;
++		rx_tid->size = 0;
++		rx_tid->pending_desc_size = 0;
++
++		list_del(&elem->list);
++		kfree(elem);
+ 	}
++	spin_unlock_bh(&dp->reo_cmd_update_queue_lock);
+ 
+-	rx_tid->paddr = 0;
+-	rx_tid->size = 0;
++	return;
+ }
+ 
+ static int ath11k_dp_rx_link_desc_return(struct ath11k_base *ab,
diff --git a/package/kernel/mac80211/patches/ath11k_nss/913-341-ath11k-fix-support-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch b/package/kernel/mac80211/patches/ath11k_nss/913-341-ath11k-fix-support-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch
new file mode 100644
index 00000000000000..a1b885c8b50e5a
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/913-341-ath11k-fix-support-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch
@@ -0,0 +1,52 @@
+From 516c1d2faf4480c355ec5000d6d4ad4fc287d0e8 Mon Sep 17 00:00:00 2001
+From: Aditya Kumar Singh <quic_adisi@quicinc.com>
+Date: Thu, 30 Dec 2021 17:44:40 +0530
+Subject: [PATCH] ath11k: fix support for ext vdev in NSS for AP_VLAN vif
+ during recovery
+
+When driver is recovering, it tears down nss connection and sets
+ab->nss.enabled as false. However, this is not set back to its original
+state post recovery and hence when ext vdev is added again, warning
+trace appears since ath11k_mac_op_add_interface() does not handle
+NL80211_IFTYPE_AP_VLAN vif with nss disabled and throws a WARN_ON(1).
+
+[ 2777.201255] ------------[ cut here ]------------
+[ 2777.209669] WARNING: CPU: 0 PID: 77 at drivers/net/wireless/ath/ath11k/mac.c:7298 ath11k_mac_op_add_interface+0x314/0xa98 [ath11k]
+[----- Trimmed -----]
+[ 2777.499054] CPU: 0 PID: 77 Comm: kworker/0:2 Tainted: G        W         5.4.89 #0
+[ 2777.515132] Hardware name: Generic DT based system
+[ 2777.522658] Workqueue: events_freezable ieee80211_restart_work [mac80211]
+[ 2777.527305] [<8030f3a4>] (unwind_backtrace) from [<8030b700>] (show_stack+0x10/0x14)
+[ 2777.534153] [<8030b700>] (show_stack) from [<808da410>] (dump_stack+0x88/0xa8)
+[ 2777.541964] [<808da410>] (dump_stack) from [<8031bf20>] (__warn+0xa4/0xd0)
+[ 2777.548994] [<8031bf20>] (__warn) from [<8031bfbc>] (warn_slowpath_fmt+0x70/0x9c)
+[ 2777.555972] [<8031bfbc>] (warn_slowpath_fmt) from [<c02cb440>] (ath11k_mac_op_add_interface+0x314/0xa98 [ath11k])
+[ 2777.563664] [<c02cb440>] (ath11k_mac_op_add_interface [ath11k]) from [<7fd34720>] (drv_add_interface+0x68/0x78 [mac80211])
+[ 2777.573928] [<7fd34720>] (drv_add_interface [mac80211]) from [<7fd679bc>] (ieee80211_reconfig+0x240/0xce8 [mac80211])
+[ 2777.584843] [<7fd679bc>] (ieee80211_reconfig [mac80211]) from [<7fd311ec>] (ieee80211_restart_work+0xd4/0xf4 [mac80211])
+[ 2777.595401] [<7fd311ec>] (ieee80211_restart_work [mac80211]) from [<80331968>] (process_one_work+0x1dc/0x310)
+[ 2777.606205] [<80331968>] (process_one_work) from [<80332cf8>] (worker_thread+0x2bc/0x40c)
+[ 2777.616009] [<80332cf8>] (worker_thread) from [<803373ac>] (kthread+0x164/0x180)
+[ 2777.624167] [<803373ac>] (kthread) from [<803010e0>] (ret_from_fork+0x14/0x34)
+
+Added logic to enable nss as per MODULE_PARM_DESC parameter.
+
+Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/core.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -2010,6 +2010,11 @@ static int ath11k_core_reconfigure_on_cr
+ 
+ 	clear_bit(ATH11K_FLAG_CRASH_FLUSH, &ab->dev_flags);
+ 
++	/* We have disabled NSS Offload support in the starting.
++	 * Re-enabling it if it was originally enabled in the MODULE_PARM_DESC.
++	 */
++	ab->nss.enabled = nss_offload;
++
+ 	ret = ath11k_core_qmi_firmware_ready(ab);
+ 	if (ret)
+ 		goto err_hal_srng_deinit;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/913-353-ath11k-ignore-frags-from-uninitialized-peer-in-dp.patch b/package/kernel/mac80211/patches/ath11k_nss/913-353-ath11k-ignore-frags-from-uninitialized-peer-in-dp.patch
new file mode 100644
index 00000000000000..e8ac589acfc8ec
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/913-353-ath11k-ignore-frags-from-uninitialized-peer-in-dp.patch
@@ -0,0 +1,74 @@
+From 0ab84604de1db0f589f7303507f38148ba8f3f04 Mon Sep 17 00:00:00 2001
+From: Nagarajan Maran <quic_nmaran@quicinc.com>
+Date: Tue, 28 Jun 2022 11:31:50 +0530
+Subject: [PATCH] ath11k: Ignore frags from uninitialized peer in dp
+
+In certain scenario, fragmented packet is received for self peer,
+for which rx_tid and rx_frags are not initialized in datapath. 
+While handling this fragment, crash is observed as the 
+rx_frag list is uninitialised and when we walk in 
+ath11k_dp_rx_h_sort_frags, skb null leads to exception.
+
+To address this, before processing received fragments we
+check dp_setup_done flag is set to ensure that peer
+has completed its dp peer setup for fragment queue,
+else ignore processing the fragments.
+
+Also, __fls would have an undefined behavior if the argument
+is passed as "0". Hence, added changes to handle the same.
+
+Below is the call trace of the crash:
+
+  CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.164 #0
+  Hardware name: Qualcomm Technologies, Inc. IPQ6018/AP-CP01-C1 (DT)
+  pstate: a0400005 (NzCv daif +PAN -UAO)
+  pc : ath11k_dp_process_rx_err+0x550/0x1084 [ath11k]
+  lr : ath11k_dp_process_rx_err+0x4e0/0x1084 [ath11k]
+  
+  Call trace:
+  ath11k_dp_process_rx_err+0x550/0x1084 [ath11k]
+  ath11k_dp_service_srng+0x70/0x370 [ath11k]
+  0xffffffc009693a04
+  __napi_poll+0x30/0xa4
+  net_rx_action+0x118/0x270
+  __do_softirq+0x10c/0x244
+  irq_exit+0x64/0xb4
+  __handle_domain_irq+0x88/0xac
+  gic_handle_irq+0x74/0xbc
+  el1_irq+0xf0/0x1c0
+  arch_cpu_idle+0x10/0x18
+  do_idle+0x104/0x248
+  cpu_startup_entry+0x20/0x64
+  rest_init+0xd0/0xdc
+  arch_call_rest_init+0xc/0x14
+  start_kernel+0x480/0x4b8
+  Code: f9400281 f94066a2 91405021 b94a0023 (f9406401)
+
+Signed-off-by: Harshitha Prem <quic_hprem@quicinc.com>
+Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/dp.c    |  3 ++-
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 11 ++++++++++-
+ drivers/net/wireless/ath/ath11k/peer.h  |  2 ++
+ 3 files changed, 14 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp.c
++++ b/drivers/net/wireless/ath/ath11k/dp.c
+@@ -38,6 +38,7 @@ void ath11k_dp_peer_cleanup(struct ath11
+ 	ath11k_peer_rx_tid_cleanup(ar, peer);
+ 	peer->dp_setup_done = false;
+ 	crypto_free_shash(peer->tfm_mmic);
++	peer->dp_setup_done = false;
+ 	spin_unlock_bh(&ab->base_lock);
+ }
+ 
+--- a/drivers/net/wireless/ath/ath11k/peer.h
++++ b/drivers/net/wireless/ath/ath11k/peer.h
+@@ -93,6 +93,7 @@ struct ath11k_peer {
+ 	u16 sec_type;
+ 	u16 sec_type_grp;
+ 	bool is_authorized;
++	/* Peer's datapath set flag */
+ 	bool dp_setup_done;
+ 	struct ppdu_user_delayba ppdu_stats_delayba;
+ 	bool delayba_flag;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/913-356-ath11k-invalid-desc-sanity-check.patch b/package/kernel/mac80211/patches/ath11k_nss/913-356-ath11k-invalid-desc-sanity-check.patch
new file mode 100644
index 00000000000000..4e7e37957b1f31
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/913-356-ath11k-invalid-desc-sanity-check.patch
@@ -0,0 +1,74 @@
+From c7e37aebbe19056eb7b61299e75c863263acf2b9 Mon Sep 17 00:00:00 2001
+From: Nagarajan Maran <quic_nmaran@quicinc.com>
+Date: Tue, 9 Aug 2022 13:22:43 +0530
+Subject: [PATCH] Fix SKB corruption in REO destination ring
+
+In the traffic cases, randomly, invalid RX descriptor
+from REO destination ring is received. This
+invalid descriptor causes wrong SKB to be fetched
+which in turn causes SKB memory corruption issue.
+
+Introduced Sanity check to validate the descriptor,
+before processing the SKB.
+
+During the failure scenario, invalid RX descriptor
+filled with values "0" is received which in-turn
+corrupts the SKB stored in the ldr lookup
+with buffer id "0". Changed the start id for
+idr allocation to "1" and the buffer id "0" is
+reserved for error validation.
+
+
+Crash Signature : 
+
+Unable to handle kernel paging request at virtual address 3f004900
+During the crash,
+PC points to "b15_dma_inv_range+0x30/0x50"
+LR points to "dma_cache_maint_page+0x8c/0x128".
+The Backtrace obtained is as follows:
+[<8031716c>] (b15_dma_inv_range) from [<80313a4c>] (dma_cache_maint_page+0x8c/0x128)
+[<80313a4c>] (dma_cache_maint_page) from [<80313b90>] (__dma_page_dev_to_cpu+0x28/0xcc)
+[<80313b90>] (__dma_page_dev_to_cpu) from [<7fb5dd68>] (ath11k_dp_process_rx+0x1e8/0x4a4 [ath11k])
+[<7fb5dd68>] (ath11k_dp_process_rx [ath11k]) from [<7fb53c20>] (ath11k_dp_service_srng+0xb0/0x2ac [ath11k])
+[<7fb53c20>] (ath11k_dp_service_srng [ath11k]) from [<7f67bba4>] (ath11k_pci_ext_grp_napi_poll+0x1c/0x78 [ath11k_pci])
+[<7f67bba4>] (ath11k_pci_ext_grp_napi_poll [ath11k_pci]) from [<807d5cf4>] (__napi_poll+0x28/0xb8)
+[<807d5cf4>] (__napi_poll) from [<807d5f28>] (net_rx_action+0xf0/0x280)
+[<807d5f28>] (net_rx_action) from [<80302148>] (__do_softirq+0xd0/0x280)
+[<80302148>] (__do_softirq) from [<80320408>] (irq_exit+0x74/0xd4)
+[<80320408>] (irq_exit) from [<803638a4>] (__handle_domain_irq+0x90/0xb4)
+[<803638a4>] (__handle_domain_irq) from [<805bedec>] (gic_handle_irq+0x58/0x90)
+[<805bedec>] (gic_handle_irq) from [<80301a78>] (__irq_svc+0x58/0x8c)
+
+Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -3228,6 +3228,16 @@ try_again:
+ 	while (likely(desc =
+ 	      (struct hal_reo_dest_ring *)ath11k_hal_srng_dst_get_next_entry(ab,
+ 									     srng))) {
++
++		push_reason = FIELD_GET(HAL_REO_DEST_RING_INFO0_PUSH_REASON,
++					desc->info0);
++		if (unlikely(push_reason ==
++		    HAL_REO_DEST_RING_PUSH_REASON_ERR_DETECTED)) {
++			ath11k_warn(ab,"Received invalid desc\n");
++			ab->soc_stats.hal_reo_error[dp->reo_dst_ring[ring_id].ring_id]++;
++			continue;
++		}
++
+ 		cookie = FIELD_GET(BUFFER_ADDR_INFO1_SW_COOKIE,
+ 				   desc->buf_addr_info.info1);
+ 		buf_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_BUF_ID,
+@@ -3258,8 +3268,6 @@ try_again:
+ 
+ 		num_buffs_reaped[mac_id]++;
+ 
+-		push_reason = FIELD_GET(HAL_REO_DEST_RING_INFO0_PUSH_REASON,
+-					desc->info0);
+ 		if (unlikely(push_reason !=
+ 			     HAL_REO_DEST_RING_PUSH_REASON_ROUTING_INSTRUCTION)) {
+ 			dev_kfree_skb_any(msdu);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/913-374-ath11k-Check-skb_headroom-before-using-skb_push.patch b/package/kernel/mac80211/patches/ath11k_nss/913-374-ath11k-Check-skb_headroom-before-using-skb_push.patch
new file mode 100644
index 00000000000000..1bbbdd6c7446da
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/913-374-ath11k-Check-skb_headroom-before-using-skb_push.patch
@@ -0,0 +1,209 @@
+From efecc6e8355d02aeac7bf1a43397551440a8d0d8 Mon Sep 17 00:00:00 2001
+From: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
+Date: Thu, 30 Mar 2023 22:12:56 +0530
+Subject: [PATCH] ath11k: Check skb_headroom before using skb_push
+
+Below kernel panic may occur if there is no
+skb_headroom available for performing skb_push.
+
+<4>[67506.565072] CPU: 1 PID: 1741 Comm: ap-wireless-opt Not tainted 5.4.89+ #0
+<4>[67506.578860] Hardware name: Generic DT based system
+<4>[67506.585728] PC is at fortify_panic+0x10/0x18
+<4>[67506.590406] LR is at fortify_panic+0x10/0x18
+
+(fortify_panic) from [<7f2cd3cc>] (ath11k_dp_rx_crypto_icv_len+0x1e0/0x161c [ath11k])
+(ath11k_dp_rx_crypto_icv_len [ath11k]) from [<7f2cdbac>] (ath11k_dp_rx_crypto_icv_len+0x9c0/0x161c [ath11k])
+(ath11k_dp_rx_crypto_icv_len [ath11k]) from [<7f2ce0e8>] (ath11k_dp_rx_crypto_icv_len+0xefc/0x161c [ath11k])
+(ath11k_dp_rx_crypto_icv_len [ath11k]) from [<7f2cedb0>] (ath11k_dp_process_rx+0x4ec/0x544 [ath11k])
+(ath11k_dp_process_rx [ath11k]) from [<7f2c417c>] (ath11k_dp_service_srng+0xdc/0x2a0 [ath11k])
+(ath11k_dp_service_srng [ath11k]) from [<7f0d78c8>] (ath11k_pci_ext_grp_napi_poll+0x20/0x50 [ath11k_pci])
+(ath11k_pci_ext_grp_napi_poll [ath11k_pci]) from [<806a6a74>] (__napi_poll+0x28/0xb8)
+(__napi_poll) from [<806a6c9c>] (net_rx_action+0xec/0x280)
+(net_rx_action) from [<8010226c>] (__do_softirq+0xc4/0x248)
+(__do_softirq) from [<8011f230>] (irq_exit+0x6c/0xcc)
+(irq_exit) from [<80162a08>] (__handle_domain_irq+0x8c/0xb0)
+(__handle_domain_irq) from [<803f0188>] (gic_handle_irq+0x54/0x8c)
+(gic_handle_irq) from [<80101a8c>] (__irq_svc+0x6c/0xa8)
+
+Fix this by checking skb_headroom and expand the
+headroom if required size is not available.
+
+Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 70 +++++++++++++++++++++++++
+ 1 file changed, 70 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -2270,16 +2270,27 @@ static void ath11k_get_dot11_hdr_from_rx
+ 	size_t hdr_len, crypto_len;
+ 	struct ieee80211_hdr *hdr;
+ 	u16 fc, qos_ctl = 0;
++	int expand_by;
+ 	u8 *crypto_hdr;
+ 
+ 	if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
+ 		crypto_len = ath11k_dp_rx_crypto_param_len(ar, enctype);
++		if (skb_headroom(msdu) < crypto_len) {
++			expand_by = crypto_len - skb_headroom(msdu);
++			if (WARN_ON_ONCE(pskb_expand_head(msdu, expand_by, 0, GFP_ATOMIC)))
++				return;
++		}
+ 		crypto_hdr = skb_push(msdu, crypto_len);
+ 		ath11k_dp_rx_desc_get_crypto_header(ab, rx_desc, crypto_hdr, enctype);
+ 	}
+ 
+ 	fc = ath11k_dp_rxdesc_get_mpdu_frame_ctrl(ab, rx_desc);
+ 	hdr_len = ieee80211_hdrlen(fc);
++	if (skb_headroom(msdu) < hdr_len) {
++		expand_by = hdr_len - skb_headroom(msdu);
++		if (WARN_ON_ONCE(pskb_expand_head(msdu, expand_by, 0, GFP_ATOMIC)))
++			return;
++	}
+ 	skb_push(msdu, hdr_len);
+ 	hdr = (struct ieee80211_hdr *)msdu->data;
+ 	hdr->frame_control = fc;
+@@ -2315,6 +2326,7 @@ static void ath11k_dp_rx_h_undecap_nwifi
+ 	u8 da[ETH_ALEN];
+ 	u8 sa[ETH_ALEN];
+ 	u16 qos_ctl = 0;
++	int expand_by = 0;
+ 	u8 *qos, *crypto_hdr;
+ 	bool add_qos_ctrl = false;
+ 
+@@ -2359,26 +2371,46 @@ static void ath11k_dp_rx_h_undecap_nwifi
+ 	}
+ 
+ 	if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
++		int crypto_param_len = ath11k_dp_rx_crypto_param_len(ar, enctype);
++
++		if (skb_headroom(msdu) < crypto_param_len) {
++			expand_by = crypto_param_len - skb_headroom(msdu);
++			if (WARN_ON_ONCE(pskb_expand_head(msdu, expand_by, 0, GFP_ATOMIC)))
++				return;
++		}
+ 		if (first_hdr) {
+-			memcpy(skb_push(msdu,
+-					ath11k_dp_rx_crypto_param_len(ar, enctype)),
+-					(void *)hdr + hdr_len,
+-					ath11k_dp_rx_crypto_param_len(ar, enctype));
++			memcpy(skb_push(msdu, crypto_param_len),
++			       (void *)hdr + hdr_len, crypto_param_len);
+ 		} else {
+-			crypto_hdr = skb_push(msdu, ath11k_dp_rx_crypto_param_len(ar, enctype));
++			crypto_hdr = skb_push(msdu, crypto_param_len);
+ 			ath11k_dp_rx_desc_get_crypto_header(ar->ab,
+ 							    rxcb->rx_desc, crypto_hdr, enctype);
+ 		}
+ 	}
+ 
+ 	if (!rxcb->is_first_msdu || add_qos_ctrl) {
++		if (skb_headroom(msdu) < IEEE80211_QOS_CTL_LEN) {
++			expand_by = IEEE80211_QOS_CTL_LEN - skb_headroom(msdu);
++			if (WARN_ON_ONCE(pskb_expand_head(msdu, expand_by, 0, GFP_ATOMIC)))
++				return;
++		}
+ 		memcpy(skb_push(msdu,
+ 				IEEE80211_QOS_CTL_LEN), &qos_ctl,
+ 				IEEE80211_QOS_CTL_LEN);
++		if (skb_headroom(msdu) < hdr_len) {
++			expand_by = hdr_len - skb_headroom(msdu);
++			if (WARN_ON_ONCE(pskb_expand_head(msdu, expand_by, 0, GFP_ATOMIC)))
++				return;
++		}
+ 		memcpy(skb_push(msdu, hdr_len), decap_hdr, hdr_len);
+ 		return;
+ 	}
+ 
++	if (skb_headroom(msdu) < hdr_len) {
++		expand_by = hdr_len - skb_headroom(msdu);
++		if (WARN_ON_ONCE(pskb_expand_head(msdu, expand_by, 0, GFP_ATOMIC)))
++			return;
++	}
+ 	memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
+ 
+ 	/* original 802.11 header has a different DA and in
+@@ -2487,6 +2519,7 @@ static void ath11k_dp_rx_h_undecap_eth(s
+ 	u8 da[ETH_ALEN];
+ 	u8 sa[ETH_ALEN];
+ 	void *rfc1042;
++	int expand_by;
+ 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
+ 	struct ath11k_dp_rfc1042_hdr rfc = {0xaa, 0xaa, 0x03, {0x00, 0x00, 0x00}};
+ 
+@@ -2496,6 +2529,11 @@ static void ath11k_dp_rx_h_undecap_eth(s
+ 		ether_addr_copy(sa, eth->h_source);
+ 		rfc.snap_type = eth->h_proto;
+ 		skb_pull(msdu, sizeof(struct ethhdr));
++		if (skb_headroom(msdu) < sizeof(struct ath11k_dp_rfc1042_hdr)) {
++			expand_by = sizeof(struct ath11k_dp_rfc1042_hdr) - skb_headroom(msdu);
++			if (WARN_ON_ONCE(pskb_expand_head(msdu, expand_by, 0, GFP_ATOMIC)))
++				return;
++		}
+ 		memcpy(skb_push(msdu, sizeof(struct ath11k_dp_rfc1042_hdr)), &rfc,
+ 		       sizeof(struct ath11k_dp_rfc1042_hdr));
+ 		ath11k_get_dot11_hdr_from_rx_desc(ar, msdu, rxcb, status, enctype);
+@@ -2513,6 +2551,11 @@ static void ath11k_dp_rx_h_undecap_eth(s
+ 	skb_pull(msdu, sizeof(struct ethhdr));
+ 
+ 	/* push rfc1042/llc/snap */
++	if (skb_headroom(msdu) < sizeof(struct ath11k_dp_rfc1042_hdr)) {
++		expand_by = sizeof(struct ath11k_dp_rfc1042_hdr) - skb_headroom(msdu);
++		if (WARN_ON_ONCE(pskb_expand_head(msdu, expand_by, 0, GFP_ATOMIC)))
++			return;
++	}
+ 	memcpy(skb_push(msdu, sizeof(struct ath11k_dp_rfc1042_hdr)), rfc1042,
+ 	       sizeof(struct ath11k_dp_rfc1042_hdr));
+ 
+@@ -2521,12 +2564,22 @@ static void ath11k_dp_rx_h_undecap_eth(s
+ 	hdr_len = ieee80211_hdrlen(hdr->frame_control);
+ 
+ 	if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
+-		memcpy(skb_push(msdu,
+-				ath11k_dp_rx_crypto_param_len(ar, enctype)),
+-		       (void *)hdr + hdr_len,
+-		       ath11k_dp_rx_crypto_param_len(ar, enctype));
++		int crypto_param_len = ath11k_dp_rx_crypto_param_len(ar, enctype);
++
++		if (skb_headroom(msdu) < crypto_param_len) {
++			expand_by = crypto_param_len - skb_headroom(msdu);
++			if (WARN_ON_ONCE(pskb_expand_head(msdu, expand_by, 0, GFP_ATOMIC)))
++				return;
++		}
++		memcpy(skb_push(msdu, crypto_param_len),
++		       (void *)hdr + hdr_len, crypto_param_len);
+ 	}
+ 
++	if (skb_headroom(msdu) < hdr_len) {
++		expand_by = hdr_len - skb_headroom(msdu);
++		if (WARN_ON_ONCE(pskb_expand_head(msdu, expand_by, 0, GFP_ATOMIC)))
++			return;
++	}
+ 	memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
+ 
+ exit:
+@@ -2954,10 +3007,16 @@ static void ath11k_dp_rx_deliver_msdu(st
+ 	u8 decap = DP_RX_DECAP_TYPE_RAW;
+ 	bool is_mcbc = rxcb->is_mcbc;
+ 	bool is_eapol = rxcb->is_eapol;
++	int expand_by;
+ 
+ 	if (status->encoding == RX_ENC_HE &&
+ 	    !(status->flag & RX_FLAG_RADIOTAP_HE) &&
+ 	    !(status->flag & RX_FLAG_SKIP_MONITOR)) {
++		if (skb_headroom(msdu) < sizeof(known)) {
++			expand_by = sizeof(known) - skb_headroom(msdu);
++			if (WARN_ON_ONCE(pskb_expand_head(msdu, expand_by, 0, GFP_ATOMIC)))
++				goto exit;
++		}
+ 		he = skb_push(msdu, sizeof(known));
+ 		memcpy(he, &known, sizeof(known));
+ 		status->flag |= RX_FLAG_RADIOTAP_HE;
+@@ -3013,6 +3072,7 @@ static void ath11k_dp_rx_deliver_msdu(st
+ 	    !(is_mcbc && rx_status->flag & RX_FLAG_DECRYPTED))
+ 		rx_status->flag |= RX_FLAG_8023;
+ 
++exit:
+ 	ieee80211_rx_napi(ar->hw, pubsta, msdu, napi);
+ 
+ 	if (ath11k_debugfs_is_extd_rx_stats_enabled(ar)) {
diff --git a/package/kernel/mac80211/patches/ath11k_nss/913-686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch b/package/kernel/mac80211/patches/ath11k_nss/913-686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch
new file mode 100644
index 00000000000000..6614d8d496b354
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/913-686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch
@@ -0,0 +1,120 @@
+From 331198f889cef552e4644abf1f2ebfcaa2cc41e9 Mon Sep 17 00:00:00 2001
+From: P Praneesh <quic_ppranees@quicinc.com>
+Date: Wed, 23 Nov 2022 18:50:47 +0530
+Subject: [PATCH] mac80211: fix RCU stall in mesh fast xmit path
+
+In mesh fast xmit, mesh_fill_cached_hdr tries to acquire spinlock
+which is already acquired by the same core for updating mesh path
+table. Fix it by using atomic variable instead of using spinlock.
+
+[100466.097939] rcu: INFO: rcu_preempt self-detected stall on CPU
+[100466.097962] rcu:    0-....: (8381 ticks this GP) idle=e86/0/0x3 softirq=2648463/2648463 fqs=4184
+[100466.102651]         (t=8403 jiffies g=5521597 q=620)
+[100466.111586] Task dump for CPU 0:
+[100466.115839] swapper/0       R  running task        0     0      0 0x0000000a
+[100466.119228] Call trace:
+[100466.126348]  dump_backtrace+0x0/0x15c
+[100466.128949]  show_stack+0x14/0x1c
+[100466.132508]  sched_show_task+0x104/0x134
+[100466.135893]  dump_cpu_task+0x40/0x274
+[100466.139974]  rcu_dump_cpu_stacks+0x7c/0xd4
+[100466.143620]  rcu_sched_clock_irq+0x350/0x824
+[100466.147699]  update_process_times+0x2c/0x50
+[100466.152213]  tick_sched_handle.isra.4+0x3c/0x44
+[100466.156553]  tick_sched_timer+0x48/0x88
+[100466.161153]  __hrtimer_run_queues+0xa0/0x140
+[100466.165059]  hrtimer_interrupt+0xe4/0x214
+[100466.169315]  arch_timer_handler_virt+0x28/0x3c
+[100466.173308]  handle_percpu_devid_irq+0x84/0x12c
+[100466.177733]  generic_handle_irq+0x18/0x2c
+[100466.182593]  __handle_domain_irq+0x84/0xac
+[100466.186500]  gic_handle_irq+0x74/0xbc
+[100466.190579]  el1_irq+0xf0/0x1c0
+[100466.194398]  queued_spin_lock_slowpath+0x98/0x2c0
+[100466.197800]  mesh_fill_cached_hdr+0x15c/0x2d0 [mac80211]
+[100466.202397]  __ieee80211_subif_start_xmit+0xf4/0xf3c [mac80211]
+[100466.207865]  ieee80211_subif_start_xmit+0x274/0x2ac [mac80211]
+[100466.213933]  dev_hard_start_xmit+0x1b0/0x230
+[100466.219574]  sch_direct_xmit+0xbc/0x300
+[100466.224086]  __dev_queue_xmit+0x5b0/0x8cc
+[100466.228079]  dev_queue_xmit+0x10/0x18
+[100466.231990]  sfe_ipv4_recv_udp+0x1014/0x1050 [qca_nss_sfe]
+[100466.235722]  sfe_ipv4_recv+0x394/0x5a4 [qca_nss_sfe]
+[100466.241190]  sfe_recv+0xf0/0x47c [qca_nss_sfe]
+[100466.246397]  __netif_receive_skb_core+0x1ac/0xa3c
+[100466.250736]  __netif_receive_skb_list_core+0x84/0x1ec
+[100466.255598]  netif_receive_skb_list_internal+0x250/0x29c
+[100466.260720]  gro_normal_list+0x24/0x40
+[100466.266186]  gro_normal_one+0x3c/0x48
+[100466.269832]  napi_gro_receive+0xc0/0x104
+[100466.273655]  edma_rx_napi_poll+0x820/0xdb4 [qca_nss_dp]
+[100466.277734]  __napi_poll+0x30/0xa4
+[100466.283113]  net_rx_action+0x118/0x270
+[100466.286325]  __do_softirq+0x10c/0x244
+[100466.290145]  irq_exit+0x64/0xb4
+[100466.293965]  __handle_domain_irq+0x88/0xac
+[100466.297350]  gic_handle_irq+0x74/0xbc
+[100466.301256]  el1_irq+0xf0/0x1c0
+[100466.305076]  arch_cpu_idle+0x10/0x18
+[100466.308461]  do_idle+0x104/0x248
+[100466.312019]  cpu_startup_entry+0x20/0x64
+[100466.315320]  rest_init+0xd0/0xdc
+[100466.319311]  arch_call_rest_init+0xc/0x14
+[100466.322610]  start_kernel+0x480/0x4b8
+
+Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
+---
+ net/mac80211/cfg.c          | 2 +-
+ net/mac80211/mesh.h         | 4 ++--
+ net/mac80211/mesh_hwmp.c    | 4 ++--
+ net/mac80211/mesh_pathtbl.c | 9 ++++-----
+ 4 files changed, 9 insertions(+), 10 deletions(-)
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -2347,7 +2347,7 @@ static void mpath_set_pinfo(struct mesh_
+ 	if (mpath->flags & MESH_PATH_RESOLVED)
+ 		pinfo->flags |= NL80211_MPATH_FLAG_RESOLVED;
+ 	pinfo->hop_count = mpath->hop_count;
+-	pinfo->path_change_count = mpath->path_change_count;
++	pinfo->path_change_count = atomic_read(&mpath->path_change_count);
+ }
+ 
+ static int ieee80211_get_mpath(struct wiphy *wiphy, struct net_device *dev,
+--- a/net/mac80211/mesh.h
++++ b/net/mac80211/mesh.h
+@@ -126,7 +126,7 @@ struct mesh_path {
+ 	unsigned long fast_tx_check;
+ 	bool is_root;
+ 	bool is_gate;
+-	u32 path_change_count;
++	atomic_t path_change_count;
+ };
+ 
+ #define MESH_FAST_TX_CACHE_MAX_SIZE		512
+--- a/net/mac80211/mesh_hwmp.c
++++ b/net/mac80211/mesh_hwmp.c
+@@ -504,7 +504,10 @@ static u32 hwmp_route_info_get(struct ie
+ 			if (next_hop)
+ 				ether_addr_copy(old_next_hop_addr, next_hop->sta.addr);
+ 			if (next_hop != sta) {
+-				mpath->path_change_count++;
++				atomic_inc(&mpath->path_change_count);
++                                mpath_dbg(sdata, "MESH MPU dst %pM next hop %pM"
++                                          " metric %d ft 0x%x\n",
++                                          mpath->dst, sta->deflink.addr, last_hop_metric, action);
+ 				flush_mpath = true;
+ 			}
+ 			mesh_path_assign_nexthop(mpath, sta);
+@@ -565,7 +568,10 @@ static u32 hwmp_route_info_get(struct ie
+ 			if (next_hop)
+ 				ether_addr_copy(old_next_hop_addr, next_hop->sta.addr);
+ 			if (next_hop != sta) {
+-				mpath->path_change_count++;
++				atomic_inc(&mpath->path_change_count);
++				mpath_dbg(sdata, "MESH MPU dst %pM next hop %pM"
++					  " metric %d ft 0x%x\n",
++					  mpath->dst, sta->deflink.addr, last_hop_metric, action);
+ 				flush_mpath = true;
+ 			}
+ 			mesh_path_assign_nexthop(mpath, sta);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/913-726-mac80211-fix-crash-when-accessing-null-pointer.patch b/package/kernel/mac80211/patches/ath11k_nss/913-726-mac80211-fix-crash-when-accessing-null-pointer.patch
new file mode 100644
index 00000000000000..8e60a5f6b255f7
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/913-726-mac80211-fix-crash-when-accessing-null-pointer.patch
@@ -0,0 +1,87 @@
+From 376306e1018974ded893d8fefb91fe69676392d9 Mon Sep 17 00:00:00 2001
+From: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Date: Mon, 1 May 2023 15:15:56 +0530
+Subject: [PATCH] mac80211: fix crash when accessing null pointer
+
+During MLD transmission, band will be zero, fetching 0th sband will be an
+invalid accessing of sband information and also facing crash when 2ghz
+radio is in different phy and other bands are in a single phy, this is
+due to 2.4 Ghz sband will be NULL for the phy which is having sbands other
+than 2.4 Ghz.
+
+Fix this by adding sband NULL check.
+
+[ 2125.764601] Unable to handle kernel read from unreadable memory at virtual address 0000000000000050
+[ 2125.764631] Mem abort info:
+[ 2125.772445]   ESR = 0x96000005
+[ 2125.775221]   EC = 0x25: DABT (current EL), IL = 32 bits
+[ 2125.778339]   SET = 0, FnV = 0
+[ 2125.783804]   EA = 0, S1PTW = 0
+[ 2125.786669] Data abort info:
+[ 2125.789707]   ISV = 0, ISS = 0x00000005
+[ 2125.792833]   CM = 0, WnR = 0
+[ 2125.796394] user pgtable: 4k pages, 39-bit VAs, pgdp=000000006432b000
+[ 2125.799520] [0000000000000050] pgd=0000000000000000, pud=0000000000000000
+[ 2125.805946] Internal error: Oops: 96000005 [#1] PREEMPT SMP
+[ 2126.082240] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.213 #0
+[ 2126.110546] pstate: 40400005 (nZcv daif +PAN -UAO)
+[ 2126.117591] pc : ieee80211_tx_monitor+0x1ac/0x5d0 [mac80211]
+[ 2126.122360] lr : ieee80211_tx_monitor+0x14c/0x5d0 [mac80211]
+[ 2126.128163] sp : ffffff803e14ecc0
+[ 2126.133803] x29: ffffff803e14ecc0 x28: 000000000000000d
+[ 2126.137016] x27: 0000000000000000 x26: ffffff803892aa40
+[ 2126.142398] x25: 0000000000000009 x24: 0000000000000000
+[ 2126.147694] x23: 0000000000000001 x22: ffffff80250210e0
+[ 2126.152988] x21: ffffff803a0a5800 x20: ffffff803a0a5828
+[ 2126.158284] x19: ffffff803892aa33 x18: 0000000000000000
+[ 2126.163579] x17: 0000000000000000 x16: 0000000000000000
+[ 2126.168873] x15: 0000000000000000 x14: 020101f0fd8c13dd
+[ 2126.174169] x13: 00c0bf3d2d200706 x12: 3809ff36b83b03ff
+[ 2126.179464] x11: 0a5802c3fe1802c3 x10: 002f3262005e4342
+[ 2126.184759] x9 : 0000a4270000a403 x8 : ffffff803892aa3f
+[ 2126.190055] x7 : 0000000000000000 x6 : 0000000000000001
+[ 2126.195349] x5 : ffffff803e14edd8 x4 : 0000000000000001
+[ 2126.200644] x3 : 000000000000000c x2 : 0000000000000000
+[ 2126.205939] x1 : ffffff803892aa3b x0 : 0000000000000040
+[ 2126.211235] Call trace:
+[ 2126.216542]  ieee80211_tx_monitor+0x1ac/0x5d0 [mac80211]
+[ 2126.218714]  ieee80211_tx_status_ext+0x78c/0x7d0 [mac80211]
+[ 2126.224269]  ieee80211_tx_status+0x78/0xa0 [mac80211]
+[ 2126.229564]  ieee80211_restart_hw+0xe0/0x26c [mac80211]
+[ 2126.234763]  tasklet_action_common.isra.2+0xa4/0x11c
+[ 2126.239795]  tasklet_action+0x24/0x2c
+[ 2126.245002]  __do_softirq+0x10c/0x244
+[ 2126.248561]  irq_exit+0x64/0xb4
+[ 2126.252207]  __handle_domain_irq+0x88/0xac
+[ 2126.255158]  gic_handle_irq+0x74/0xbc
+[ 2126.259325]  el1_irq+0xf0/0x1c0
+[ 2126.263058]  arch_cpu_idle+0x10/0x18
+[ 2126.266009]  do_idle+0x104/0x248
+[ 2126.269827]  cpu_startup_entry+0x20/0x64
+[ 2126.273041]  rest_init+0xd0/0xdc
+[ 2126.276947]  arch_call_rest_init+0xc/0x14
+[ 2126.280159]  start_kernel+0x46c/0x4a4
+[ 2126.284070] Code: d37d0863 8b030042 52800183 f9449c42 (f9402842)
+[ 2126.287713] ---[ end trace 04f5d203895d53da ]---
+
+Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+---
+ net/mac80211/status.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -336,8 +336,11 @@ ieee80211_add_tx_radiotap_header(struct
+ 		struct ieee80211_supported_band *sband;
+ 
+ 		sband = local->hw.wiphy->bands[info->band];
+-		legacy_rate =
+-			sband->bitrates[info->status.rates[0].idx].bitrate;
++		//TODO: Incase of MLD, band will be 0 for tx pkts
++		//this has to be taken care during TX monitor support.
++		if (sband)
++			legacy_rate =
++				sband->bitrates[info->status.rates[0].idx].bitrate;
+ 	}
+ 
+ 	if (legacy_rate) {
diff --git a/package/kernel/mac80211/patches/ath11k_nss/913-830-ath11k-Avoiding-memset-of-ppdu-info-for-next-skb.patch b/package/kernel/mac80211/patches/ath11k_nss/913-830-ath11k-Avoiding-memset-of-ppdu-info-for-next-skb.patch
new file mode 100644
index 00000000000000..28b4fdf6468337
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k_nss/913-830-ath11k-Avoiding-memset-of-ppdu-info-for-next-skb.patch
@@ -0,0 +1,87 @@
+From 5b4a0de1356558f58df9c6a1f46c7c0ce2fadb03 Mon Sep 17 00:00:00 2001
+From: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
+Date: Mon, 28 Aug 2023 14:48:41 +0530
+Subject: [PATCH] ath11k: Avoiding memset of ppdu-info for next skb
+
+While parsing mon status from skb, ppdu_info got memset with zero during
+next skb fetch from queue or mon ring in case a single PPDU is more than
+RX_BUFFER_SIZE. Because of this nss value got override for respective
+ppdu and leads to warn_on in mac80211.Removed memset from next skb fetch
+and added flag to track discontinued skb in case of fetch from skb.
+
+WARN_ON Reason:
+
+Rate marked as an HE rate but data is invalid: MCS: 0, NSS: 0
+
+Below the call trace observed:
+
+    Call trace:
+    ieee80211_rx_list+0x1d4/0xcc4 [mac80211]
+    ieee80211_rx_napi+0x58/0xcc [mac80211]
+    ath11k_dp_rx_deliver_msdu+0x358/0x3e4 [ath11k]
+    ath11k_dp_rx_mon_deliver.isra.27+0x470/0x4cc [ath11k]
+    ath11k_dp_rx_mon_dest_process+0x1cc/0x2bc [ath11k]
+    ath11k_dp_rx_process_mon_status+0x5ec/0xf90 [ath11k]
+    ath11k_dp_rx_process_mon_rings+0x40c/0x44c [ath11k]
+    ath11k_dp_service_srng+0x114/0x2c0 [ath11k]
+    ath11k_ahb_ext_grp_napi_poll+0x30/0xa0 [ath11k_ahb]
+    __napi_poll+0x30/0xa4
+    net_rx_action+0x118/0x270
+    __do_softirq+0x10c/0x244
+    irq_exit+0x64/0xb4
+    __handle_domain_irq+0x88/0xac
+    gic_handle_irq+0x74/0xbc
+    el1_irq+0xf0/0x1c0
+    arch_cpu_idle+0x10/0x18
+    do_idle+0x104/0x248
+    cpu_startup_entry+0x20/0x64
+    rest_init+0xd0/0xdc
+    arch_call_rest_init+0xc/0x14
+    start_kernel+0x46c/0x4a4
+    --[ end trace e754e9088a240857 ]---
+
+Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c  | 6 ++++--
+ drivers/net/wireless/ath/ath11k/hal_rx.h | 1 +
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -6210,7 +6210,9 @@ int ath11k_dp_rx_process_mon_status(stru
+ 	if (!num_buffs_reaped)
+ 		goto exit;
+ 
+-	memset(ppdu_info, 0, sizeof(*ppdu_info));
++	if (!ppdu_info->ppdu_continuation)
++		memset(ppdu_info, 0, sizeof(*ppdu_info));
++
+ 	ppdu_info->peer_id = HAL_INVALID_PEERID;
+ 
+ 	while ((skb = __skb_dequeue(&skb_list))) {
+@@ -6228,7 +6230,6 @@ int ath11k_dp_rx_process_mon_status(stru
+ 		if (log_type != ATH11K_PKTLOG_TYPE_INVALID)
+ 			trace_ath11k_htt_rxdesc(ar, skb->data, log_type, rx_buf_sz);
+ 
+-		memset(ppdu_info, 0, sizeof(*ppdu_info));
+ 		ppdu_info->peer_id = HAL_INVALID_PEERID;
+ 		hal_status = ath11k_hal_rx_parse_mon_status(ab, ppdu_info, skb);
+ 
+@@ -6244,6 +6245,7 @@ int ath11k_dp_rx_process_mon_status(stru
+ 		if (ppdu_info->peer_id == HAL_INVALID_PEERID ||
+ 		    hal_status != HAL_RX_MON_STATUS_PPDU_DONE) {
+ 			dev_kfree_skb_any(skb);
++			ppdu_info->ppdu_continuation = true;
+ 			continue;
+ 		}
+ 
+--- a/drivers/net/wireless/ath/ath11k/hal_rx.h
++++ b/drivers/net/wireless/ath/ath11k/hal_rx.h
+@@ -220,6 +220,7 @@ struct hal_rx_mon_ppdu_info {
+ 	char rssi_chain[8][8];
+ 	u32 num_users;
+ 	u32 mpdu_fcs_ok_bitmap[HAL_RX_NUM_WORDS_PER_PPDU_BITMAP];
++	bool ppdu_continuation;
+ 	struct hal_rx_user_status userstats[HAL_MAX_UL_MU_USERS];
+ };
+ 

From 6ca790daa9dd356a9c1ad6c0412f2f81bf75a51b Mon Sep 17 00:00:00 2001
From: Qosmio <datapronix@protonmail.com>
Date: Wed, 17 Jan 2024 05:04:28 -0500
Subject: [PATCH 091/225] ath11k_nss: set pbuf script off by default

uci option pbuf.opt.memory_profile must be explicity set to auto, 1gb,
512m, 256m to run.
---
 .../mac80211/files/etc/init.d/qca-nss-pbuf       | 16 +++++++++++-----
 package/kernel/mac80211/files/pbuf.uci           |  3 ++-
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/package/kernel/mac80211/files/etc/init.d/qca-nss-pbuf b/package/kernel/mac80211/files/etc/init.d/qca-nss-pbuf
index be89de061ce8b1..02afd5f6c3d380 100755
--- a/package/kernel/mac80211/files/etc/init.d/qca-nss-pbuf
+++ b/package/kernel/mac80211/files/etc/init.d/qca-nss-pbuf
@@ -50,15 +50,21 @@ apply_nss_config() {
           board=$memory_profile
           logger -t ath11k_nss "Using custom memory profile - $board"
           ;;
-        *)
-          logger -s -t ath11k_nss -p user.error "Unknown profile $memory_profile. Choose 1gb, 512mb, or 256mb"
+        off*|false*|disable*|0)
+          logger -s -t ath11k_nss -p user.warn "NSS pbuf option 'memory_profile=off'. Not running. Enable if you have issues connecting more than 65 clients"
+          exit 0
+          ;;
+        auto)
           board=$(board_name)
-          logger -s -t ath11k_nss -p user.warn "Falling back to: $board"
+          logger -t ath11k_nss "Setting n2hcfg values for board: $board"
+          ;;
+          *)
+            logger -s -t ath11k_nss -p user.error "Unknown profile $memory_profile. Choose auto, 1gb, 512mb, or 256mb"
+          exit 1
           ;;
     esac
   else
-     board=$(board_name)
-     logger -t ath11k_nss "Setting n2hcfg values for board: $board"
+    exi 0
   fi
 
   case "$board" in
diff --git a/package/kernel/mac80211/files/pbuf.uci b/package/kernel/mac80211/files/pbuf.uci
index ac4fadbc4f5e63..2b277e11f02f4d 100644
--- a/package/kernel/mac80211/files/pbuf.uci
+++ b/package/kernel/mac80211/files/pbuf.uci
@@ -1,5 +1,6 @@
 config general opt
-  # to bypass board autodetection, uncomment ONE of the options below
+  option memory_profile 'off'
+  # option memory_profile 'auto'
   # option memory_profile '1gb'
   # option memory_profile '512mb'
   # option memory_profile '256mb'

From f9469f13a68efed6e778e88779bc6696b7934dd5 Mon Sep 17 00:00:00 2001
From: Qosmio <datapronix@protonmail.com>
Date: Wed, 17 Jan 2024 15:45:10 -0500
Subject: [PATCH 092/225] ath11k_nss: squash and refactor patches

ath11k_nss: fix build for 256/1G mem, and ath10k

ath11k_nss: bump release version '8'

mac80211: refactor NSS patches

Since NSS requires patches to subsys, and ath*k directories. Move
patches into a subset of nss for better tracking against QSDK,
and modularization.

ath11k_nss: rename patches

ath11k_nss: clean up optional patches

To reduce bug tracking headaches, I've remove the following patches, as
they are not required for NSS offload and have been around the last 2-3
years without ever being upstreamed.

nss/ath11k/235-001-ath11k-Add-support-for-beacon-tx-mode.patch
nss/ath11k/237-002-ath11k-Add-provision-to-configure-rx-hashmap.patch
nss/ath11k/902-020-ath11k-add-btcoex-config.patch
nss/ath11k/902-022-ath11k-add-ap-ps-support.patch
nss/ath11k/907-068-ath11k-add-rx-histogram-stats.patch
nss/ath11k/907-108-ath11k-enable-ul-ofdma-ru-allocation-in-peer-stats.patch
nss/ath11k/911-373-ath11k-Add-retry-mechanism-for-update_rx_qu.patch
nss/ath11k/913-353-ath11k-ignore-frags-from-uninitialized-peer-in-dp.patch
nss/ath11k/913-356-ath11k-invalid-desc-sanity-check.patch
nss/ath11k/913-374-ath11k-Check-skb_headroom-before-using-skb_push.patch
nss/ath11k/913-830-ath11k-Avoiding-memset-of-ppdu-info-for-next-skb.patch
nss/subsys/235-002-mac80211-Add-support-for-beacon-tx-mode.patch
nss/subsys/913-726-mac80211-fix-crash-when-accessing-null-pointer.patch

ath11k_nss: Remove superfluous patches

Remove patches unrelated to NSS offloading to minimize bloat and better
track NSS related issues.

ath11k_nss: Refactor patches to use upstream names

Reworked patches to use upstream QSDK names. Allows for better tracking

ath11k_nss: align wifi offload with qca-nss-drv

The option in qca-nss-drv is actually 'NSS_DRV_WIFIOFFLOAD_ENABLE' use
the same syntax.

ath10k-ct: fix compile with NSS wifi

ath11k_nss: Merge every NSS related feature + more

* Added macro to disable NSS mesh offload
* Added menuconfig option "ATH11K_NSS_MESH_SUPPORT" to selectivley build mesh support,
	as well it's depenacndy on nss-drv-wifimeshmgr.
* Added option to disable HTT Stats, and STA stats (stations).
* Reducing footprint by ~210KB. Debugfs minimal is still enabled.
* Reworked a TON of patches, some my own, hopefully there should be a far less amount of WOA2/WPA3 connection issues.
* Updated the /etc/init.d/pbuf script to be more robust. (handles tweaking ath11k and NSS settings better)

NOTES: Although mesh package builds (nss-drv-wifimeshmgr), ath11k doesn't seem to support it yet.
Not sure if NSS requires 3 radios to work, I'm at a dead end currently with that route.

ATTENTION:
the ptch `37-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch`
works well on nss with frame_mode=2.
And on `ath11k frame_mode=1 nss_offload=0`

And on `ath11k frame_mode=2 nss_offload=1`

if you set nss_offload=off and frame_mode=2, it will CRASH
if you set nss_offload=on and frame_mode=2, it will  RUN
if you set nss_offload=off and frame_mode=1, it will RUN

ath11k_nss: fix n2h high_water_core0/wifi_pool_buf

These were commented out, but looks like they are needed to prevent lock
ups with heavy usage apps (users report in torrenting)

ath11k_nss: Renumber ath11k patches in the range

commit 3c7cc4b725ea406f19b736427034e3bdb436aedc
Author:     Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
AuthorDate: Thu Jan 4 11:25:56 2024 +0530
Commit:     Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
CommitDate: Wed Jan 3 22:53:51 2024 -0800

    wifi: ath11k: Renumber ath11k patches in the range

    In ath11k, patches are not maintained in the range and not sequential.
    Renumber the patches sequential and in the range.

    Change-Id: I77c51c0f5bf9f94863db4ef364b156e14465a60c
    Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>

ath11k_nss: Add mac hw flag to avoid tx queue in mac80211

commit 4e9b5f7f0d1ed40dbf3208f7ed4448e49b4a4ac1
Author:     Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
AuthorDate: Wed Dec 6 12:20:59 2023 +0530
Commit:     Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
CommitDate: Mon Dec 18 12:52:33 2023 +0530

    wifi: mac80211: Add mac hw flag to avoid tx queue in mac80211

    Queue SKB in mac80211 become mandatory from latest 6.1 kernel. Because of
    this queuing, there will be performance degradation. Add hw flag option
    to enable tx queue in Driver/Hardware.

    Driver/hardware can register for HAS_TX_QUEUE HW flag and avoid tx queuing
    in mac80211.

    Add same HW flag checks to avoid accessing skb queues which will be
    NULL or invalid and also NULL checks for sta txqs for NULL or invalid
    access.

ath11k_nss: add the HTC+ / iPhone fix

commit ccdca73cd65723c3cb63c17edc95c4c43318cb38
Author:     John Crispin <john@phrozen.org>
AuthorDate: Sun Jul 9 17:12:34 2023 +0200
Commit:     John Crispin <john@phrozen.org>
CommitDate: Thu Aug 31 16:08:34 2023 +0200

    mac80211: add the HTC+ / iPhone fix

    Signed-off-by: John Crispin <john@phrozen.org>

ath11k_nss: ath-next fix connection failure due to unexpected peer delete

Currently ath11k_mac_op_unassign_vif_chanctx() deletes peer but
ath11k_mac_op_assign_vif_chanctx() doesn't create it. This results in
connection failure if MAC80211 calls drv_unassign_vif_chanctx() and
drv_assign_vif_chanctx() during AUTH and ASSOC, see below log:

[  102.372431] wlan0: authenticated
[  102.372585] ath11k_pci 0000:01:00.0: wlan0: disabling HT/VHT/HE as WMM/QoS is not supported by the AP
[  102.372593] ath11k_pci 0000:01:00.0: mac chanctx unassign ptr ffff895084638598 vdev_id 0
[  102.372808] ath11k_pci 0000:01:00.0: WMI vdev stop id 0x0
[  102.383114] ath11k_pci 0000:01:00.0: vdev stopped for vdev id 0
[  102.384689] ath11k_pci 0000:01:00.0: WMI peer delete vdev_id 0 peer_addr 20:e5:2a:21:c4:51
[  102.396676] ath11k_pci 0000:01:00.0: htt peer unmap vdev 0 peer 20:e5:2a:21:c4:51 id 3
[  102.396711] ath11k_pci 0000:01:00.0: peer delete resp for vdev id 0 addr 20:e5:2a:21:c4:51
[  102.396722] ath11k_pci 0000:01:00.0: mac removed peer 20:e5:2a:21:c4:51  vdev 0 after vdev stop
[  102.396780] ath11k_pci 0000:01:00.0: mac chanctx assign ptr ffff895084639c18 vdev_id 0
[  102.400628] wlan0: associate with 20:e5:2a:21:c4:51 (try 1/3)
[  102.508864] wlan0: associate with 20:e5:2a:21:c4:51 (try 2/3)
[  102.612815] wlan0: associate with 20:e5:2a:21:c4:51 (try 3/3)
[  102.720846] wlan0: association with 20:e5:2a:21:c4:51 timed out

The peer delete logic in ath11k_mac_op_unassign_vif_chanctx() is
introduced by commit b4a0f54156ac ("ath11k: move peer delete after
vdev stop of station for QCA6390 and WCN6855") to fix firmware
crash issue caused by unexpected vdev stop/peer delete sequence.

Actually for a STA interface peer should be deleted in
ath11k_mac_op_sta_state() when STA's state changes from
IEEE80211_STA_NONE to IEEE80211_STA_NOTEXIST, which also coincides
with current peer creation design that peer is created during
IEEE80211_STA_NOTEXIST -> IEEE80211_STA_NONE transition. So move
peer delete back to ath11k_mac_op_sta_state(), also stop vdev before
deleting peer to fix the firmware crash issue mentioned there. In
this way the connection failure mentioned here is also fixed.

Also do some cleanups in patch "wifi: ath11k: remove invalid peer
create logic", and refactor in patches "wifi: ath11k: rename
ath11k_start_vdev_delay()" and "wifi: ath11k: avoid forward declaration
of ath11k_mac_start_vdev_delay()".

Tested this patch set using QCA6390 and WCN6855 on both STA and SAP
interfaces. Basic connection and ping work well.

Baochen Qiang (4):
  wifi: ath11k: remove invalid peer create logic
  wifi: ath11k: rename ath11k_start_vdev_delay()
  wifi: ath11k: avoid forward declaration of
    ath11k_mac_start_vdev_delay()
  wifi: ath11k: fix connection failure due to unexpected peer delete

 drivers/net/wireless/ath/ath11k/mac.c | 564 +++++++++++++-------------
 1 file changed, 288 insertions(+), 276 deletions(-)

ath11k_nss: Revert support for beacon_tx_mode

ath11k_nss: Update release fix dependancies

ath11k_nss: mgmt and data ack rssi update

Data ACK RSSI :

      Advertise NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT feature support
for accounting and notifying "last ack signal" and "avg ack signal" to
user space through NL interface.

      Enabled data ack rssi support for ethernet mode.

Mgmt ACK RSSI:

      Enabled support for Tx-ACK RSSI in HTT over Management packets.

ath11k_nss: add missing support to enable/disable bss color collision detection

ath11k_nss: FW Initiated Dynamic MU-EDCA

Implementing the updating of firmware initiated dynamic MU-EDCA
parameters in Beacon IE. Firmware routinely checks its clients and
updates its MU-EDCA values every 3 seconds. Firmware is tuning
MU-EDCA parameters to improve performance. As part of this process,
the firmware informs host about new MU-EDCA values utilizing
WMI_MUEDCA_PARAMS_CONFIG_EVENTID. FW expectation is that host will
update MU-EDCA parameters in the Beacon IE.

ath11k_nss: refresh patches + cleanup Makefile

ath11k_nss: Set correct pbufs for 1GB profile

ath11k_nss: Revert setting fw_mem_mode for IPQ807x

Leave it set to '0', as it will kernel panic with 2K skb patch. This
flag was incorrectly assumed to save memory on 1G platforms.

ath11k_nss: remove leftover max_tx_ring

it was not removed when applying patch to replace it with 'max_tx_ring =
DP_TCL_NUM_RING_MAX +1'

ath11k_nss: Import bugfix patches

ath11k_nss: Experimental build for IPQ6018

This will require setting the correct `ATH11K_MEM_PROFILE_XXX` for your
platform. Setting it to value lower/higher than physically available
will cause NULL virtual address kernel panics.

I believe this setting was not originally meant to reduce memory
footprint of 1G+ platforms, but to account for platforms that were
512M or less.

Will require tweaking to allow for the old behvaior on 1G+ IPQ807x,
while still saving memory for platforms <= 512M.

commit d2d5a0d1f9ce668f92a22eb45279c6c4c3bf7a4f
Author:     Qosmio <datapronix@protonmail.com>
AuthorDate: Sat Mar 9 11:59:20 2024 -0500
Commit:     Sean Khan <datapronix@protonmail.com>
CommitDate: Fri Oct 11 11:13:03 2024 -0400

ath11k_nss: fix typo in 512M memory profile

ath11k_nss: remove SFE patch 718-e-mac80211-Deliver-the-frame-to-driver-tx-ops-directly

It is not relevant to NSS builds and only meant for SFE.

ath11k_nss: remove unecessary patches

Color collision should be left on by default, as it's a primary feature
of 802.11AX.

ath11k_nss: fix spacing

ath11k_nss: Remove unnecessary TKIP bloat

Remove TKIP patches that are not being used as 99% of folks are running
modern encryption (AES-CCMP,SAE,etc).

ath11k_nss: parameterize DP_RXDMA_REFILL_RING_SIZE memory profile

ath11k_nss: Remove SFE related code

Cleanup SFE (shortcut fe) related code as we're not using it on NSS

ath11k_nss: idr, ampdu, and skb headroom check optimizations

ath11k_nss: get valid last_rate for rx_bitrate from cpu stats

ath11k_nss: Fix BCCA counter for EMA

Currently BCCA counter is updated to FW via csa counter offs and
beacon with new countdown is updated for every beacon tx completion event.
For EMA, all EMA beacons are updated in one shot, and counter update for
every tx event will mess up the actual sequence of countdown sent over the air.

Allow FW to update the countdown till 1 and finalize the color
change.

ath11k_nss: Fix compile for TRACE feature
---
 ...99-001-fix-ath10k_update_vif_offload.patch |   32 +
 package/kernel/mac80211/Makefile              |   23 +-
 package/kernel/mac80211/ath.mk                |   47 +-
 .../init.d/qca-nss-pbuf => qca-nss-pbuf.init} |   74 +-
 .../107-ath11k-tid-counter-fix.patch          |   21 -
 .../211-ath11k-add-obss-pd-support.patch      |   56 -
 ...01-ath11k-account-tx-rx-packets-flow.patch |  494 ---
 ...-mac80211-account-tx-rx-packets-flow.patch |  369 --
 ...th11k-Add-support-for-beacon-tx-mode.patch |   45 -
 ...80211-Add-support-for-beacon-tx-mode.patch |  159 -
 ...dd-provision-to-configure-rx-hashmap.patch |  208 -
 .../245-revert-dev-sw-netstats-txrx-add.patch |  145 -
 ...-fix-tkip-encryption-traffic-failure.patch |   25 -
 .../640-006-mac80211-add-eht-radiotap.patch   |  506 ---
 ...interface-combination-advertisement-.patch | 1594 --------
 .../702-ath11k-fix-memory-leak-in-dp-rx.patch |   48 -
 ...-the-frame-to-driver-tx-ops-directly.patch |   74 -
 .../902-020-ath11k-add-btcoex-config.patch    |  612 ---
 .../902-022-ath11k-add-ap-ps-support.patch    |  324 --
 ...04-300-ath11k-nss_get_arvif_from_dev.patch |  113 -
 .../905-ath11k-add-support-memory-stats.patch |  946 -----
 ...1k-add-simple-tx-handler-for-AP-mode.patch |  185 -
 .../911-335-ath11k-fix-ar-ops-crash.patch     |   71 -
 ...ix-crash-when-accessing-null-pointer.patch |   87 -
 .../199-004-ath10k-fixup-nss-compile.patch    |   19 +
 ...th11k-fix-for-peer-memory-corruption.patch |    0
 .../068-ath11k-add-rx-histogram-stats.patch}  |  135 +-
 ...9-ath11k-add-HE-stats-in-peer-stats.patch} |   74 +-
 ...080-ath11k-ethernet-rx-decap-offload.patch |   15 +
 ...dma-counter-always-zero-in-peer-stat.patch |   82 +
 ...dma-counter-increamenting-improperly.patch |    6 +-
 ...l-ofdma-ru-allocation-in-peer-stats.patch} |   51 +-
 .../113-ath11k-add-8023-undecap-support.patch |    4 +-
 ...-adding-support-for-mgmt-frame-stats.patch |   12 +-
 ...1k-remove-error-on-soc-debugfs-fail.patch} |   40 +-
 .../188-ath11k-m3-ssr-dump-collection.patch}  |    2 +-
 ...91-ath11k-add-mgmt-and-data-ack-rssi.patch |   29 +-
 ...-ath11k_nss-add-nss-driver-interface.patch |   29 +-
 .../199-003-ath11k-add-nss-support.patch      |  321 +-
 ...03-mac80211-ath11k-fw-dynamic-muedca.patch |  162 +
 ...-ath11k-Add-support-for-dynamic-vlan.patch |    4 +-
 ...207-ath11k-Enable-256_512MB-profiles.patch |  175 +-
 ...oad-changes-to-NSS-driver-interface.patch} |   30 +-
 ...support-on-NSS-offload-for-STA-mode.patch} |   86 +-
 ...14-ath11k-qos-null-frame-tx-over-wmi.patch |  181 +-
 ...dev-in-NSS-for-AP_VLAN-vif-handling.patch} |   48 +-
 ...port-for-WDS-offload-in-NSS-offload.patch} |   77 +-
 ...ev-in-NSS-for-dynamic-VLAN-handling.patch} |   18 +-
 ...dynamic-VLAN-support-in-NSS-offload.patch} |   54 +-
 ...ow-fast-rx-by-bypassing-stats-update.patch |  101 +
 ...dst-ring-descriptors-from-cacheable-.patch |    6 +-
 ...ow-fast-rx-by-bypassing-stats-update.patch |  191 +-
 .../ath11k/244-ath11k-dp-tx-perf.patch}       |  108 +-
 .../patches/nss/ath11k/270-iphone-issue.patch |   11 +
 .../300-ath11k-nss-mesh-offload-support.patch | 3365 +++++++++++++++++
 .../301-ath11k-nss-mcbc-exception.patch}      |   80 +-
 ...lookup-failure-in-mgmt-tx-completion.patch |  125 +
 ...avoid-stack-corrupt-in-nwifi-undecap.patch |    0
 ...e-free-of-peer-rx_tid-during-reo-cmd.patch |    2 +-
 ...0-ath11k-sync-wds_ast_entry-updates.patch} |   47 +-
 ...0001-ath11k-optimize-tx-completions.patch} |   52 +-
 ...e-DECLARE_BITMAP-for-idr-operations.patch} |   32 +-
 ...TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch |   19 +-
 ...ing-rx-stats-with-monitor-vif-enable.patch |   88 +
 ...1k-skip-status-ring-entry-processing.patch |   10 +-
 ...t-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch} |    2 +-
 ...ccess-of-the-dma-buffer-back-to-dma-.patch |    0
 ...frags-from-uninitialized-peer-in-dp.patch} |    2 +-
 ...56-ath11k-invalid-desc-sanity-check.patch} |   15 +-
 ...-fix-clear-peer-keys-during-disassoc.patch |    4 +-
 ...t-ast-index-assignment-for-wds-peer.patch} |   19 +-
 ...Fix-ppdu_id-from-firmware-PPDU-stats.patch |   52 +
 ...dd-retry-mechanism-for-update_rx_qu.patch} |   22 +-
 ...-event-handler-support-for-link-desc.patch |    8 +-
 ...ix-mutex-dead-lock-and-q6-dump-crash.patch |   59 +
 ...agement-frames-to-firmware-before-wa.patch |   43 +
 ...th11k-Advertise-TX_QUEUE-mac-hw-flag.patch |   23 +
 ...id-memset-of-ppdu-info-for-next-skb.patch} |   18 +-
 ...upport-to-send-the-QoS-Null-Data-fr.patch} |    5 +-
 ...a_map_single-to-virt_to_phys-in-rx-r.patch |   66 +
 ...11k-remove-invalid-peer-create-logic.patch |   58 +
 ...th11k-rename-ath11k_start_vdev_delay.patch |   52 +
 ...ation-of-ath11k_mac_start_vdev_delay.patch |  601 +++
 ...ailure-due-to-unexpected-peer-delete.patch |  257 ++
 ...k-make-debugfs-sta-htt-stats-modular.patch |  198 +
 ...1k-Disable-rx_header-tlv-for-2K-SKB.patch} |  284 +-
 ...nss-thread-priority-during-pdev_ini.patch} |   20 +-
 ...d-ampdu-id-in-802.11-radiotap-header.patch |  279 ++
 ...999-336-0001-ath11k-idr-optimization.patch |  132 +
 .../999-336-0002-ath11k-Use-idr_replace.patch |  280 ++
 ...-skb_headroom-before-using-skb_push.patch} |   64 +-
 ...wifi-ath11k-Fix-BCCA-counter-for-EMA.patch |  115 +
 .../subsys/007-fix_compilation_issue.patch}   |   76 +-
 ...-when-using-encapsulation-offloading.patch |    2 +-
 .../199-001-mac80211-add-nss-support.patch    |   42 +-
 ...t-callback-when-hwencap-enable-in-st.patch |    2 +-
 ...03-mac80211-ath11k-fw-dynamic-muedca.patch |  203 +
 ...ath11k-Add-support-for-dynamic-vlan.patch} |    4 +-
 ...07-mac80211-add-nss-redirect-support.patch |   10 +-
 ...-iftype-support-on-NSS-offload-case.patch} |   28 +-
 ...dynamic-VLAN-support-on-NSS-offload.patch} |   32 +-
 .../subsys}/245-compilation_fix.patch         |   13 +-
 ...300-ath11k-nss-mesh-offload-support.patch} |   63 +-
 ...CL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch} |    6 +-
 ...-0005-mac80211-simple-tx-for-AP-mode.patch |    7 +-
 .../336-mac80211-Mesh-Fast-rx-support.patch   |   14 +-
 ...mac80211-fix-unconditional-sta-usage.patch |   17 +-
 .../345-mac80211-fix-mixed-declaration.patch  |   52 +
 ...change-to-40Mhz-during-channel-switc.patch |   34 +
 ...rning-with-monitor-interface-restart.patch |    2 +-
 ...unused-RX_FLAGS-from-mac80211_rx_fla.patch |    6 +-
 ...ncapsulation-of-EAPOL-frames-if-OFFL.patch |   93 +-
 ...ix-RCU-stall-in-mesh-fast-xmit-path.patch} |   12 +-
 ...id-last_rate-for-rx_bitrate-from-cpu.patch |   68 +
 ...se-HW-checksum-offload-only-for-ethm.patch |   41 +-
 ...1-Add-mac-hw-flag-to-avoid-queue-skb.patch |  342 ++
 .../829-mac80211-fix-mesh-ping-issue.patch    |    8 +-
 ...x-memory-corruption-during-mesh-beac.patch |    6 +-
 118 files changed, 8315 insertions(+), 7695 deletions(-)
 create mode 100644 package/kernel/ath10k-ct/patches/999-001-fix-ath10k_update_vif_offload.patch
 rename package/kernel/mac80211/files/{etc/init.d/qca-nss-pbuf => qca-nss-pbuf.init} (64%)
 delete mode 100644 package/kernel/mac80211/patches/ath11k_nss/107-ath11k-tid-counter-fix.patch
 delete mode 100644 package/kernel/mac80211/patches/ath11k_nss/211-ath11k-add-obss-pd-support.patch
 delete mode 100644 package/kernel/mac80211/patches/ath11k_nss/234-001-ath11k-account-tx-rx-packets-flow.patch
 delete mode 100644 package/kernel/mac80211/patches/ath11k_nss/234-002-mac80211-account-tx-rx-packets-flow.patch
 delete mode 100644 package/kernel/mac80211/patches/ath11k_nss/235-001-ath11k-Add-support-for-beacon-tx-mode.patch
 delete mode 100644 package/kernel/mac80211/patches/ath11k_nss/235-002-mac80211-Add-support-for-beacon-tx-mode.patch
 delete mode 100644 package/kernel/mac80211/patches/ath11k_nss/237-002-ath11k-Add-provision-to-configure-rx-hashmap.patch
 delete mode 100644 package/kernel/mac80211/patches/ath11k_nss/245-revert-dev-sw-netstats-txrx-add.patch
 delete mode 100644 package/kernel/mac80211/patches/ath11k_nss/359-ath11k-fix-tkip-encryption-traffic-failure.patch
 delete mode 100644 package/kernel/mac80211/patches/ath11k_nss/640-006-mac80211-add-eht-radiotap.patch
 delete mode 100644 package/kernel/mac80211/patches/ath11k_nss/675-01-cfg80211-Extend-interface-combination-advertisement-.patch
 delete mode 100644 package/kernel/mac80211/patches/ath11k_nss/702-ath11k-fix-memory-leak-in-dp-rx.patch
 delete mode 100644 package/kernel/mac80211/patches/ath11k_nss/718-e-mac80211-Deliver-the-frame-to-driver-tx-ops-directly.patch
 delete mode 100644 package/kernel/mac80211/patches/ath11k_nss/902-020-ath11k-add-btcoex-config.patch
 delete mode 100644 package/kernel/mac80211/patches/ath11k_nss/902-022-ath11k-add-ap-ps-support.patch
 delete mode 100644 package/kernel/mac80211/patches/ath11k_nss/904-300-ath11k-nss_get_arvif_from_dev.patch
 delete mode 100644 package/kernel/mac80211/patches/ath11k_nss/905-ath11k-add-support-memory-stats.patch
 delete mode 100644 package/kernel/mac80211/patches/ath11k_nss/911-335-0006-ath11k-add-simple-tx-handler-for-AP-mode.patch
 delete mode 100644 package/kernel/mac80211/patches/ath11k_nss/911-335-ath11k-fix-ar-ops-crash.patch
 delete mode 100644 package/kernel/mac80211/patches/ath11k_nss/913-726-mac80211-fix-crash-when-accessing-null-pointer.patch
 create mode 100644 package/kernel/mac80211/patches/nss/ath10k/199-004-ath10k-fixup-nss-compile.patch
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/ath11k}/033-ath11k-fix-for-peer-memory-corruption.patch (100%)
 rename package/kernel/mac80211/patches/{ath11k_nss/907-068-ath11k-add-rx-histogram-stats.patch => nss/ath11k/068-ath11k-add-rx-histogram-stats.patch} (84%)
 rename package/kernel/mac80211/patches/{ath11k_nss/902-069-ath11k-add-HE-stats-in-peer-stats.patch => nss/ath11k/069-ath11k-add-HE-stats-in-peer-stats.patch} (93%)
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/080-ath11k-ethernet-rx-decap-offload.patch
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/084-ath11k-fix-ul-ofdma-counter-always-zero-in-peer-stat.patch
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/ath11k}/087-ath11k-fix-ul-ofdma-counter-increamenting-improperly.patch (91%)
 rename package/kernel/mac80211/patches/{ath11k_nss/907-108-ath11k-enable-ul-ofdma-ru-allocation-in-peer-stats.patch => nss/ath11k/108-ath11k-enable-ul-ofdma-ru-allocation-in-peer-stats.patch} (91%)
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/ath11k}/113-ath11k-add-8023-undecap-support.patch (92%)
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/ath11k}/142-ath11k-adding-support-for-mgmt-frame-stats.patch (97%)
 rename package/kernel/mac80211/patches/{ath11k_nss/907-ath11k-remove-error-on-soc-debugfs-fail.patch => nss/ath11k/181-ath11k-remove-error-on-soc-debugfs-fail.patch} (88%)
 rename package/kernel/mac80211/patches/{ath11k_nss/906-ath11k-m3-ssr-dump-collection.patch => nss/ath11k/188-ath11k-m3-ssr-dump-collection.patch} (84%)
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/ath11k}/191-ath11k-add-mgmt-and-data-ack-rssi.patch (54%)
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/ath11k}/199-002-ath11k_nss-add-nss-driver-interface.patch (99%)
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/ath11k}/199-003-ath11k-add-nss-support.patch (82%)
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/203-mac80211-ath11k-fw-dynamic-muedca.patch
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/ath11k}/207-ath11k-Add-support-for-dynamic-vlan.patch (99%)
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/ath11k}/207-ath11k-Enable-256_512MB-profiles.patch (68%)
 rename package/kernel/mac80211/patches/{ath11k_nss/902-001-ath11k-add-WDS-offload-changes-to-NSS-driver-interface.patch => nss/ath11k/211-001-ath11k-add-WDS-offload-changes-to-NSS-driver-interface.patch} (96%)
 rename package/kernel/mac80211/patches/{ath11k_nss/902-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch => nss/ath11k/211-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch} (93%)
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/ath11k}/214-ath11k-qos-null-frame-tx-over-wmi.patch (59%)
 rename package/kernel/mac80211/patches/{ath11k_nss/903-002-ath11k-add-support-for-ext-vdev-in-NSS-for-AP_VLAN-vif-handling.patch => nss/ath11k/235-002-ath11k-add-support-for-ext-vdev-in-NSS-for-AP_VLAN-vif-handling.patch} (93%)
 rename package/kernel/mac80211/patches/{ath11k_nss/903-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch => nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch} (88%)
 rename package/kernel/mac80211/patches/{ath11k_nss/904-002-ath11k-extend-ext-vdev-in-NSS-for-dynamic-VLAN-handling.patch => nss/ath11k/236-002-ath11k-extend-ext-vdev-in-NSS-for-dynamic-VLAN-handling.patch} (92%)
 rename package/kernel/mac80211/patches/{ath11k_nss/904-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch => nss/ath11k/236-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch} (91%)
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/237-001-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/ath11k}/237-003-ath11k-allocate-dst-ring-descriptors-from-cacheable-.patch (96%)
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/ath11k}/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch (70%)
 rename package/kernel/mac80211/patches/{ath11k_nss/911-244-ath11k-dp-tx-perf.patch => nss/ath11k/244-ath11k-dp-tx-perf.patch} (87%)
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/270-iphone-issue.patch
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch
 rename package/kernel/mac80211/patches/{ath11k_nss/908-301-ath11k-nss-mcbc-exception.patch => nss/ath11k/301-ath11k-nss-mcbc-exception.patch} (70%)
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/314-ath11k-Fix-peer-lookup-failure-in-mgmt-tx-completion.patch
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/ath11k}/318-ath11k-avoid-stack-corrupt-in-nwifi-undecap.patch (100%)
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/ath11k}/319-ath11k-fix-double-free-of-peer-rx_tid-during-reo-cmd.patch (96%)
 rename package/kernel/mac80211/patches/{ath11k_nss/908-330-ath11k-sync-wds_ast_entry-updates.patch => nss/ath11k/330-ath11k-sync-wds_ast_entry-updates.patch} (94%)
 rename package/kernel/mac80211/patches/{ath11k_nss/911-335-0001-ath11k-optimize-tx-completions.patch => nss/ath11k/335-0001-ath11k-optimize-tx-completions.patch} (82%)
 rename package/kernel/mac80211/patches/{ath11k_nss/911-335-0002-ath11k-use-DECLARE_BITMAP-for-idr-operations.patch => nss/ath11k/335-0002-ath11k-use-DECLARE_BITMAP-for-idr-operations.patch} (90%)
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/ath11k}/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch (81%)
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/336-ath11k-Fix-updating-rx-stats-with-monitor-vif-enable.patch
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/ath11k}/336-ath11k-skip-status-ring-entry-processing.patch (95%)
 rename package/kernel/mac80211/patches/{ath11k_nss/913-341-ath11k-fix-support-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch => nss/ath11k/341-ath11k-fix-support-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch} (97%)
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/ath11k}/342-ath11k-provide-access-of-the-dma-buffer-back-to-dma-.patch (100%)
 rename package/kernel/mac80211/patches/{ath11k_nss/913-353-ath11k-ignore-frags-from-uninitialized-peer-in-dp.patch => nss/ath11k/353-ath11k-ignore-frags-from-uninitialized-peer-in-dp.patch} (98%)
 rename package/kernel/mac80211/patches/{ath11k_nss/913-356-ath11k-invalid-desc-sanity-check.patch => nss/ath11k/356-ath11k-invalid-desc-sanity-check.patch} (86%)
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/ath11k}/357-ath11k-fix-clear-peer-keys-during-disassoc.patch (92%)
 rename package/kernel/mac80211/patches/{ath11k_nss/908-362-ath11k-fix-incorrect-ast-index-assignment-for-wds-peer.patch => nss/ath11k/362-ath11k-fix-incorrect-ast-index-assignment-for-wds-peer.patch} (82%)
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/371-ath11k-Fix-ppdu_id-from-firmware-PPDU-stats.patch
 rename package/kernel/mac80211/patches/{ath11k_nss/911-373-ath11k-Add-retry-mechanism-for-update_rx_qu.patch => nss/ath11k/373-ath11k-Add-retry-mechanism-for-update_rx_qu.patch} (94%)
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/ath11k}/376-ath11k-Add-nss-event-handler-support-for-link-desc.patch (90%)
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/401-ath11k-Fix-mutex-dead-lock-and-q6-dump-crash.patch
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/453-ath11k-flush-management-frames-to-firmware-before-wa.patch
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/456-wifi-ath11k-Advertise-TX_QUEUE-mac-hw-flag.patch
 rename package/kernel/mac80211/patches/{ath11k_nss/913-830-ath11k-Avoiding-memset-of-ppdu-info-for-next-skb.patch => nss/ath11k/457-wifi-ath11k-Avoid-memset-of-ppdu-info-for-next-skb.patch} (86%)
 rename package/kernel/mac80211/patches/{ath11k_nss/906-456-wifi-ath11k-Add-support-to-send-the-QoS-Null-Data-fr.patch => nss/ath11k/458-wifi-ath11k-Add-support-to-send-the-QoS-Null-Data-fr.patch} (88%)
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/669-ath11k-change-dma_map_single-to-virt_to_phys-in-rx-r.patch
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/907-01-wifi-ath11k-remove-invalid-peer-create-logic.patch
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/907-02-wifi-ath11k-rename-ath11k_start_vdev_delay.patch
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/907-03-wifi-ath11k-avoid-forward-declaration-of-ath11k_mac_start_vdev_delay.patch
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/907-04-wifi-ath11k-fix-connection-failure-due-to-unexpected-peer-delete.patch
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/908-ath11k-make-debugfs-sta-htt-stats-modular.patch
 rename package/kernel/mac80211/patches/{ath11k_nss/233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch => nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch} (77%)
 rename package/kernel/mac80211/patches/{ath11k_nss/311-ath11k-configure-nss-thread-priority-during-pdev_ini.patch => nss/ath11k/999-311-ath11k-configure-nss-thread-priority-during-pdev_ini.patch} (85%)
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/999-312-ath11k-add-ampdu-id-in-802.11-radiotap-header.patch
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/999-336-0001-ath11k-idr-optimization.patch
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch
 rename package/kernel/mac80211/patches/{ath11k_nss/913-374-ath11k-Check-skb_headroom-before-using-skb_push.patch => nss/ath11k/999-374-ath11k-Check-skb_headroom-before-using-skb_push.patch} (78%)
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/999-783-001-wifi-ath11k-Fix-BCCA-counter-for-EMA.patch
 rename package/kernel/mac80211/patches/{ath11k_nss/900-fix-build.patch => nss/subsys/007-fix_compilation_issue.patch} (61%)
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/subsys}/146-mac80211-enable-TKIP-when-using-encapsulation-offloading.patch (86%)
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/subsys}/199-001-mac80211-add-nss-support.patch (91%)
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/subsys}/199-mac80211-fix-xmit-callback-when-hwencap-enable-in-st.patch (97%)
 create mode 100644 package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
 rename package/kernel/mac80211/patches/{ath11k_nss/207-mac80211-Add-support-for-dynamic-vlan.patch => nss/subsys/207-ath11k-Add-support-for-dynamic-vlan.patch} (94%)
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/subsys}/207-mac80211-add-nss-redirect-support.patch (95%)
 rename package/kernel/mac80211/patches/{ath11k_nss/902-000-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch => nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch} (86%)
 rename package/kernel/mac80211/patches/{ath11k_nss/902-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch => nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch} (78%)
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/subsys}/245-compilation_fix.patch (93%)
 rename package/kernel/mac80211/patches/{ath11k_nss/300-mac80211-nss-mesh-offload-support.patch => nss/subsys/300-ath11k-nss-mesh-offload-support.patch} (95%)
 rename package/kernel/mac80211/patches/{ath11k_nss/335-0003-mac80211-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch => nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch} (90%)
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/subsys}/335-0005-mac80211-simple-tx-for-AP-mode.patch (93%)
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/subsys}/336-mac80211-Mesh-Fast-rx-support.patch (93%)
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/subsys}/342-mac80211-fix-unconditional-sta-usage.patch (79%)
 create mode 100644 package/kernel/mac80211/patches/nss/subsys/345-mac80211-fix-mixed-declaration.patch
 create mode 100644 package/kernel/mac80211/patches/nss/subsys/346-mac80211-fix-bw-change-to-40Mhz-during-channel-switc.patch
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/subsys}/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch (95%)
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/subsys}/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch (94%)
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/subsys}/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch (70%)
 rename package/kernel/mac80211/patches/{ath11k_nss/913-686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch => nss/subsys/686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch} (88%)
 create mode 100644 package/kernel/mac80211/patches/nss/subsys/751-mac80211-Get-valid-last_rate-for-rx_bitrate-from-cpu.patch
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/subsys}/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch (74%)
 create mode 100644 package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/subsys}/829-mac80211-fix-mesh-ping-issue.patch (92%)
 rename package/kernel/mac80211/patches/{ath11k_nss => nss/subsys}/902-wifi-mac80211-Fix-memory-corruption-during-mesh-beac.patch (91%)

diff --git a/package/kernel/ath10k-ct/patches/999-001-fix-ath10k_update_vif_offload.patch b/package/kernel/ath10k-ct/patches/999-001-fix-ath10k_update_vif_offload.patch
new file mode 100644
index 00000000000000..2ef718625f011e
--- /dev/null
+++ b/package/kernel/ath10k-ct/patches/999-001-fix-ath10k_update_vif_offload.patch
@@ -0,0 +1,32 @@
+--- a/ath10k-6.4/mac.c
++++ b/ath10k-6.4/mac.c
+@@ -6362,13 +6362,13 @@
+ 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac set txbf conf, value: 0x%x\n",
+ 		   value);
+ 	return ath10k_wmi_vdev_set_param(ar, arvif->vdev_id,
+ 					 ar->wmi.vdev_param->txbf, value);
+ }
+
+-static void ath10k_update_vif_offload(struct ieee80211_hw *hw,
++static int ath10k_update_vif_offload(struct ieee80211_hw *hw,
+ 				      struct ieee80211_vif *vif)
+ {
+ 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
+ 	struct ath10k *ar = hw->priv;
+ 	u32 vdev_param;
+ 	int ret;
+@@ -6384,14 +6384,16 @@
+ 					ATH10K_HW_TXRX_NATIVE_WIFI);
+ 	/* 10.X firmware does not support this VDEV parameter. Do not warn */
+ 	if (ret && ret != -EOPNOTSUPP) {
+ 		ath10k_warn(ar, "failed to set vdev %i TX encapsulation: %d\n",
+ 			    arvif->vdev_id, ret);
+ 	}
++
++	return ret;
+ }
+
+ /*
+  * TODO:
+  * Figure out how to handle WMI_VDEV_SUBTYPE_P2P_DEVICE,
+  * because we will send mgmt frames without CCK. This requirement
diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile
index ad38b331c40e1b..c6092553c5299b 100644
--- a/package/kernel/mac80211/Makefile
+++ b/package/kernel/mac80211/Makefile
@@ -40,12 +40,14 @@ PKG_CONFIG_DEPENDS:= \
 	CONFIG_PACKAGE_MAC80211_NSS_REDIRECT \
 	CONFIG_PACKAGE_IWLWIFI_DEBUG \
 	CONFIG_PACKAGE_IWLWIFI_DEBUGFS \
-	CONFIG_PACKAGE_RTLWIFI_DEBUG \
+	CONFIG_PACKAGE_RTLWIFI_DEBUG
 
 include $(INCLUDE_DIR)/package.mk
 
 WMENU:=Wireless Drivers
 
+NSS_PATCH:= subsys ath10k ath11k
+
 define KernelPackage/mac80211/Default
   SUBMENU:=$(WMENU)
   URL:=https://wireless.wiki.kernel.org/
@@ -377,7 +379,11 @@ define Build/Patch
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath10k,ath10k/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath11k,ath11k/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath12k,ath12k/)
-	$(if $(CONFIG_ATH11K_NSS_SUPPORT),$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath11k_nss,ath11k_nss/))
+ifdef CONFIG_ATH11K_NSS_SUPPORT
+	$(foreach driver,$(NSS_PATCH),
+		$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/nss/$(driver),nss/$(driver)/)
+	)
+endif
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rt2x00,rt2x00/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mt7601u,mt7601u/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mwl,mwl/)
@@ -395,7 +401,11 @@ define Quilt/Refresh/Package
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath10k,ath10k/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath11k,ath11k/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath12k,ath12k/)
-	$(if $(CONFIG_ATH11K_NSS_SUPPORT),$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath11k_nss,ath11k_nss/))
+ifdef CONFIG_ATH11K_NSS_SUPPORT
+	$(foreach driver,$(NSS_PATCH),
+		$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/nss/$(driver),nss/$(driver)/)
+	)
+endif
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rt2x00,rt2x00/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mt7601u,mt7601u/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mwl,mwl/)
@@ -422,6 +432,13 @@ define Build/InstallDev
 	rm -f $(1)/usr/include/mac80211-backport/linux/module.h
 endef
 
+ifdef CONFIG_ATH11K_NSS_SUPPORT
+define KernelPackage/ath11k/install
+       $(INSTALL_DIR) $(1)/etc/init.d $(1)/etc/config
+       $(INSTALL_BIN) ./files/qca-nss-pbuf.init $(1)/etc/init.d/qca-nss-pbuf
+       $(INSTALL_BIN) ./files/pbuf.uci $(1)/etc/config/pbuf
+endef
+endif
 
 $(eval $(foreach drv,$(PKG_DRIVERS),$(call KernelPackage,$(drv))))
 $(eval $(call KernelPackage,cfg80211))
diff --git a/package/kernel/mac80211/ath.mk b/package/kernel/mac80211/ath.mk
index f8279d833b12bc..a757d685f1bd36 100644
--- a/package/kernel/mac80211/ath.mk
+++ b/package/kernel/mac80211/ath.mk
@@ -13,11 +13,14 @@ PKG_CONFIG_DEPENDS += \
 	CONFIG_ATH10K_LEDS \
 	CONFIG_ATH10K_THERMAL \
 	CONFIG_ATH11K_THERMAL \
+	CONFIG_ATH11K_DEBUGFS_STA \
+	CONFIG_ATH11K_DEBUGFS_HTT_STATS \
 	CONFIG_ATH_USER_REGD \
 	CONFIG_ATH11K_MEM_PROFILE_1G \
 	CONFIG_ATH11K_MEM_PROFILE_512M \
 	CONFIG_ATH11K_MEM_PROFILE_256M \
-	CONFIG_ATH11K_NSS_SUPPORT
+	CONFIG_ATH11K_NSS_SUPPORT \
+	CONFIG_ATH11K_NSS_MESH_SUPPORT
 
 ifdef CONFIG_PACKAGE_MAC80211_DEBUGFS
   config-y += \
@@ -67,6 +70,9 @@ config-$(CONFIG_ATH11K_MEM_PROFILE_1G) += ATH11K_MEM_PROFILE_1G
 config-$(CONFIG_ATH11K_MEM_PROFILE_512M) += ATH11K_MEM_PROFILE_512M
 config-$(CONFIG_ATH11K_MEM_PROFILE_256M) += ATH11K_MEM_PROFILE_256M
 config-$(CONFIG_ATH11K_NSS_SUPPORT) += ATH11K_NSS_SUPPORT
+config-$(CONFIG_ATH11K_NSS_MESH_SUPPORT) += ATH11K_NSS_MESH_SUPPORT
+config-$(CONFIG_ATH11K_DEBUGFS_STA) += ATH11K_DEBUGFS_STA
+config-$(CONFIG_ATH11K_DEBUGFS_HTT_STATS) += ATH11K_DEBUGFS_HTT_STATS
 
 config-$(call config_package,ath9k-htc) += ATH9K_HTC
 config-$(call config_package,ath10k,regular) += ATH10K ATH10K_PCI
@@ -318,7 +324,10 @@ define KernelPackage/ath11k
   URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath11k
   DEPENDS+= +kmod-ath +@DRIVER_11AC_SUPPORT +@DRIVER_11AX_SUPPORT \
   +kmod-crypto-michael-mic +ATH11K_THERMAL:kmod-hwmon-core +ATH11K_THERMAL:kmod-thermal \
-  +ATH11K_NSS_SUPPORT:kmod-qca-nss-drv
+  +ATH11K_NSS_SUPPORT:kmod-qca-nss-drv \
+  +ATH11K_NSS_MESH_SUPPORT:kmod-qca-nss-drv-wifi-meshmgr \
+  +@(ATH11K_NSS_SUPPORT):NSS_DRV_WIFIOFFLOAD_ENABLE \
+  +@(ATH11K_NSS_SUPPORT):NSS_DRV_WIFI_EXT_VDEV_ENABLE
   FILES:=$(PKG_BUILD_DIR)/drivers/soc/qcom/qmi_helpers.ko \
   $(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath11k/ath11k.ko
 ifdef CONFIG_ATH11K_NSS_SUPPORT
@@ -332,6 +341,10 @@ This module adds support for Qualcomm Technologies 802.11ax family of
 chipsets.
 endef
 
+define KernelPackage/ath11k/conffiles
+/etc/config/pbuf
+endef
+
 define KernelPackage/ath11k/config
 
        config ATH11K_THERMAL
@@ -339,6 +352,22 @@ define KernelPackage/ath11k/config
                depends on PACKAGE_kmod-ath11k
                default y if TARGET_qualcommax
 
+      config ATH11K_DEBUGFS_STA
+               bool "Enable ath11k station statistics"
+               depends on PACKAGE_kmod-ath11k
+               depends on PACKAGE_MAC80211_DEBUGFS
+               default y
+               help
+                  Say Y to enable access to the station statistics via debugfs.
+
+      config ATH11K_DEBUGFS_HTT_STATS
+               bool "Enable ath11k HTT statistics"
+               depends on PACKAGE_kmod-ath11k
+               depends on PACKAGE_MAC80211_DEBUGFS
+               default y
+               help
+                  Say Y to enable access to the HTT statistics via debugfs.
+
        config ATH11K_NSS_SUPPORT
                bool "Enable NSS WiFi offload"
                select ATH11K_MEM_PROFILE_512M if (TARGET_qualcommax_ipq807x_DEVICE_edimax_cax1800 || \
@@ -347,13 +376,17 @@ define KernelPackage/ath11k/config
                	 TARGET_qualcommax_ipq807x_DEVICE_redmi_ax6 || \
                	 TARGET_qualcommax_ipq807x_DEVICE_xiaomi_ax3600 || \
                	 TARGET_qualcommax_ipq807x_DEVICE_zte_mf269 )
-               select ATH11K_MEM_PROFILE_256M if (TARGET_qualcommax_ipq807x_DEVICE_netgear_wax218)
-               select NSS_DRV_WIFI_ENABLE
-               select NSS_DRV_WIFI_EXT_VDEV_ENABLE
-               default y if TARGET_qualcommax
+               select ATH11K_MEM_PROFILE_256M if TARGET_qualcommax_ipq807x_DEVICE_netgear_wax218
+
+       config ATH11K_NSS_MESH_SUPPORT
+               bool "Enable NSS WiFi Mesh offload"
+               depends on ATH11K_NSS_SUPPORT
+               select PACKAGE_MAC80211_MESH
+               default n
 
        choice
-          prompt "ATH11K Memory Profile"
+            prompt "Memory Profile"
+            depends on PACKAGE_kmod-ath11k
             default ATH11K_MEM_PROFILE_1G
             help
             	This option allows you to select the memory profile.
diff --git a/package/kernel/mac80211/files/etc/init.d/qca-nss-pbuf b/package/kernel/mac80211/files/qca-nss-pbuf.init
similarity index 64%
rename from package/kernel/mac80211/files/etc/init.d/qca-nss-pbuf
rename to package/kernel/mac80211/files/qca-nss-pbuf.init
index 02afd5f6c3d380..c6d6b8b2238074 100755
--- a/package/kernel/mac80211/files/etc/init.d/qca-nss-pbuf
+++ b/package/kernel/mac80211/files/qca-nss-pbuf.init
@@ -17,31 +17,52 @@
 START=71
 
 apply_sysctl() {
-  [ $(sysctl -n -e dev.nss.general.redirect) -eq 0 ] && /etc/init.d/qca-nss-ecm start
+  [ "$(sysctl -n -e dev.nss.general.redirect)" -eq 0 ] && /etc/init.d/qca-nss-ecm start
 
   # Running this script multiple times is useless, as extra_pbuf_core0
   # can't be changed if it is allocated, assume it's already been run.
-  if [ $(sysctl -n -e dev.nss.n2hcfg.extra_pbuf_core0) -eq 0 ]; then
+  if [ "$(sysctl -n -e dev.nss.n2hcfg.extra_pbuf_core0)" -eq 0 ]; then
     logger -t ath11k_nss "$board - setting dev.nss.n2hcfg.extra_pbuf_core0=$extra_pbuf_core0"
-    sysctl -w dev.nss.n2hcfg.extra_pbuf_core0=$extra_pbuf_core0 > /dev/null 2> /dev/null
+    sysctl -w dev.nss.n2hcfg.extra_pbuf_core0="$extra_pbuf_core0" > /dev/null 2> /dev/null
   else
-    logger -t ath11k_nss "Sysctl key 'extra_pbuf_core0' already set to '"$extra_pbuf_core0"'. Skipping applying wifi nss configs"
+    logger -t ath11k_nss "Sysctl key 'extra_pbuf_core0' already set to '""$extra_pbuf_core0""'. Skipping applying wifi nss configs"
   fi
 
-  sysctl -w dev.nss.n2hcfg.n2h_high_water_core0=$n2h_high_water_core0 > /dev/null 2>/dev/null
+  sysctl -w dev.nss.n2hcfg.n2h_high_water_core0="$n2h_high_water_core0" > /dev/null 2>/dev/null
 
   logger -t ath11k_nss "$board - setting dev.nss.n2hcfg.n2h_wifi_pool_buf=$n2h_wifi_pool_buf"
-  sysctl -w dev.nss.n2hcfg.n2h_wifi_pool_buf=$n2h_wifi_pool_buf
+  sysctl -w dev.nss.n2hcfg.n2h_wifi_pool_buf="$n2h_wifi_pool_buf"
 
   logger -t ath11k_nss "$board - setting dev.nss.n2hcfg.n2h_high_water_core0=$n2h_high_water_core0"
-  sysctl -w dev.nss.n2hcfg.n2h_high_water_core0=$n2h_high_water_core0
+  sysctl -w dev.nss.n2hcfg.n2h_high_water_core0="$n2h_high_water_core0"
 
 }
 
 apply_nss_config() {
+  if [ ! -r /sys/module/ath11k/parameters/nss_offload ]; then
+    logger -t ath11k_nss "Module parameter '/sys/module/ath11k/parameters/nss_offload' does NOT exist. Skipping applying wifi nss configs"
+    exit 1
+  fi
 
-  sysctl -w dev.nss.n2hcfg.n2h_queue_limit_core0=256 > /dev/null 2> /dev/null
-  sysctl -w dev.nss.n2hcfg.n2h_queue_limit_core1=256 > /dev/null 2> /dev/null
+  enable_nss_offload=$(cat /sys/module/ath11k/parameters/nss_offload)
+
+  if [ "$enable_nss_offload" -ne "1" ]; then
+    logger -t ath11k_nss -s user.warn "Module parameter 'nss_offload=0'. Skipping applying wifi nss configs"
+    exit 1
+  fi
+
+  [ ! -d "/proc/sys/dev/nss/rps" ] && {
+    logger -s -t ath11k_nss -p user.error "NSS driver not loaded or disabled! Exiting... "
+    exit 1
+  }
+
+  # Lock NSS clock to highest setting
+  sysctl -w dev.nss.clock.auto_scale=0 > /dev/null 2> /dev/null
+
+  sysctl -w dev.nss.n2hcfg.n2h_queue_limit_core0=2048 > /dev/null 2> /dev/null
+  sysctl -w dev.nss.n2hcfg.n2h_queue_limit_core1=2048 > /dev/null 2> /dev/null
+
+  sysctl -w dev.nss.rps.hash_bitmap=15 > /dev/null 2> /dev/null
 
   local memory_profile
   if memory_profile=$(uci_get pbuf.opt.memory_profile); then
@@ -64,7 +85,7 @@ apply_nss_config() {
           ;;
     esac
   else
-    exi 0
+    exit 0
   fi
 
   case "$board" in
@@ -84,7 +105,7 @@ apply_nss_config() {
     yuncore,ax880 | \
     zyxel,nbg7815 | \
     1g*)
-      extra_pbuf_core0=9000000 n2h_high_water_core0=67392 n2h_wifi_pool_buf=40960 apply_sysctl
+      extra_pbuf_core0=10000000 n2h_high_water_core0=72512 n2h_wifi_pool_buf=36864 apply_sysctl
       ;;
     # 512MB profile
     edimax,cax1800 | \
@@ -94,28 +115,35 @@ apply_nss_config() {
     xiaomi,ax3600 | \
     zte,mf269 | \
     512m*)
-      extra_pbuf_core0=3100000 n2h_high_water_core0=30624 n2h_wifi_pool_buf=8192 apply_sysctl
+      extra_pbuf_core0=3100000  n2h_high_water_core0=30624 n2h_wifi_pool_buf=8192 apply_sysctl
       ;;
     # 256MB profile
     netgear,wax218 | \
     256m*)
-      extra_pbuf_core0=3100000 n2h_high_water_core0=30258 n2h_wifi_pool_buf=4096 apply_sysctl
+      extra_pbuf_core0=3100000  n2h_high_water_core0=30258 n2h_wifi_pool_buf=4096 apply_sysctl
       ;;
   esac
 }
 
-start() {
-  if [ ! -r /sys/module/ath11k/parameters/nss_offload ]; then
-    logger -t ath11k_nss "Module parameter '/sys/module/ath11k/parameters/nss_offload' does NOT exist. Skipping applying wifi nss configs"
-    exit 1
-  fi
+boost_performance() {
 
-  enable_nss_offload=$(cat /sys/module/ath11k/parameters/nss_offload)
+  find /sys/kernel/debug/ath11k -name stats_disable| while read -r stats_disable; do
+    echo 1 > "$stats_disable"
+  done
 
-  if [ "$enable_nss_offload" = "0" ]; then
-    logger -t ath11k_nss -s user.warn "Module parameter 'nss_offload=0'. Skipping applying wifi nss configs"
-    exit 1
-  fi
+  ubus call iwinfo devices | jsonfilter -e "@.devices[*]"| while read -r device; do
+    tc qdisc replace dev "${device}" root noqueue
+  done
+
+  for num in 0 1 2 3; do
+    echo "performance" > /sys/devices/system/cpu/cpu${num}/cpufreq/scaling_governor
+  done
+
+}
 
+start() {
+
+  boost_performance
   apply_nss_config
+
 }
diff --git a/package/kernel/mac80211/patches/ath11k_nss/107-ath11k-tid-counter-fix.patch b/package/kernel/mac80211/patches/ath11k_nss/107-ath11k-tid-counter-fix.patch
deleted file mode 100644
index 1826e64bbcba05..00000000000000
--- a/package/kernel/mac80211/patches/ath11k_nss/107-ath11k-tid-counter-fix.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-From e227e5896dc8fe69d63334819c5fbada9caddc50 Mon Sep 17 00:00:00 2001
-From: Miles Hu <milehu@codeaurora.org>
-Date: Tue, 14 Jan 2020 14:29:53 -0800
-Subject: [PATCH] tid fix
-
----
- drivers/net/wireless/ath/ath11k/hal_rx.c | 2 +-
- drivers/net/wireless/ath/ath11k/hal_rx.h | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/ath/ath11k/hal_rx.c
-+++ b/drivers/net/wireless/ath/ath11k/hal_rx.c
-@@ -905,7 +905,7 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
- 				  __le32_to_cpu(eu_stats->info1));
- 		ppdu_info->tid =
- 			ffs(FIELD_GET(HAL_RX_PPDU_END_USER_STATS_INFO7_TID_BITMAP,
--				      __le32_to_cpu(eu_stats->info7))) - 1;
-+				      __le32_to_cpu(eu_stats->rsvd2[0]))) - 1;
- 		ppdu_info->tcp_msdu_count =
- 			FIELD_GET(HAL_RX_PPDU_END_USER_STATS_INFO4_TCP_MSDU_CNT,
- 				  __le32_to_cpu(eu_stats->info4));
diff --git a/package/kernel/mac80211/patches/ath11k_nss/211-ath11k-add-obss-pd-support.patch b/package/kernel/mac80211/patches/ath11k_nss/211-ath11k-add-obss-pd-support.patch
deleted file mode 100644
index ddae9fcbc50e7d..00000000000000
--- a/package/kernel/mac80211/patches/ath11k_nss/211-ath11k-add-obss-pd-support.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From 81694575884dc69535252a6f44128323fd6a2504 Mon Sep 17 00:00:00 2001
-From: Rajkumar Manoharan <rmanohar@codeaurora.org>
-Date: Sat, 26 Sep 2020 23:17:03 -0700
-Subject: [PATCH 1/3] nl80211: fix OBSS PD min and max offset validation
-
-The SRG minimum and maximum offset doesn't present when the SR control field
-of Spatial Reuse Parameter Set element set SRG Information Present to 0.
-Both attributes are 1-byte values so use appropriate nla_get function.
-
-Signed-off-by: Rajkumar Manoharan <rmanohar@codeaurora.org>
----
- net/wireless/nl80211.c | 21 ++++++++++-----------
- 1 file changed, 10 insertions(+), 11 deletions(-)
-
---- a/drivers/net/wireless/ath/ath11k/mac.c
-+++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -3272,7 +3272,8 @@ static int ath11k_mac_config_obss_pd(str
- {
- 	u32 bitmap[2], param_id, param_val, pdev_id;
- 	int ret;
--	s8 non_srg_th = 0, srg_th = 0;
-+	s8 non_srg_th = ATH11K_OBSS_PD_THRESHOLD_DISABLED;
-+	s8 srg_th = 0;
- 
- 	pdev_id = ar->pdev->pdev_id;
- 
-@@ -3301,8 +3302,6 @@ static int ath11k_mac_config_obss_pd(str
- 		if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_NON_SRG_OFFSET_PRESENT)
- 			non_srg_th = (ATH11K_OBSS_PD_MAX_THRESHOLD +
- 				      he_obss_pd->non_srg_max_offset);
--		else
--			non_srg_th = ATH11K_OBSS_PD_NON_SRG_MAX_THRESHOLD;
- 
- 		param_val |= ATH11K_OBSS_PD_NON_SRG_EN;
- 	}
-@@ -3317,7 +3316,8 @@ static int ath11k_mac_config_obss_pd(str
- 		param_val |= ATH11K_OBSS_PD_THRESHOLD_IN_DBM;
- 		param_val |= FIELD_PREP(GENMASK(15, 8), srg_th);
- 	} else {
--		non_srg_th -= ATH11K_DEFAULT_NOISE_FLOOR;
-+		if ((non_srg_th & 0xff) != ATH11K_OBSS_PD_THRESHOLD_DISABLED)
-+			non_srg_th -= ATH11K_DEFAULT_NOISE_FLOOR;
- 		/* SRG not supported and threshold in dB */
- 		param_val &= ~(ATH11K_OBSS_PD_SRG_EN |
- 			       ATH11K_OBSS_PD_THRESHOLD_IN_DBM);
---- a/drivers/net/wireless/ath/ath11k/mac.h
-+++ b/drivers/net/wireless/ath/ath11k/mac.h
-@@ -121,7 +121,7 @@ struct ath11k_generic_iter {
- #define ATH11K_PEER_RX_NSS_80_80MHZ		GENMASK(5, 3)
- 
- #define ATH11K_OBSS_PD_MAX_THRESHOLD			-82
--#define ATH11K_OBSS_PD_NON_SRG_MAX_THRESHOLD		-62
-+#define ATH11K_OBSS_PD_THRESHOLD_DISABLED		128
- #define ATH11K_OBSS_PD_THRESHOLD_IN_DBM			BIT(29)
- #define ATH11K_OBSS_PD_SRG_EN				BIT(30)
- #define ATH11K_OBSS_PD_NON_SRG_EN			BIT(31)
diff --git a/package/kernel/mac80211/patches/ath11k_nss/234-001-ath11k-account-tx-rx-packets-flow.patch b/package/kernel/mac80211/patches/ath11k_nss/234-001-ath11k-account-tx-rx-packets-flow.patch
deleted file mode 100644
index 08e158a407ca8f..00000000000000
--- a/package/kernel/mac80211/patches/ath11k_nss/234-001-ath11k-account-tx-rx-packets-flow.patch
+++ /dev/null
@@ -1,494 +0,0 @@
-From d6d86c0c48c8d114e94c5b5f749c97d629d727ef Mon Sep 17 00:00:00 2001
-From: Maharaja Kennadyrajan <mkenna@codeaurora.org>
-Date: Mon, 4 Jan 2021 23:49:21 +0530
-Subject: [PATCH 1/2] ath11k/mac80211: Add support to account Tx and Rx flow
- packets
-
-Added support to log the inflow and outflow of the Tx and Rx
-packets in netif and host driver.
-
-Command to dump the Tx pkts flow in driver:
-cat
-/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
-XX\:XX\:XX\:XX\:XX\:XX/driver_tx_pkts_flow
-
-Command to dump the Rx pkts flow in driver:
-cat
-/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
-XX\:XX\:XX\:XX\:XX\:XX/driver_rx_pkts_flow
-
-Commands to reset the Tx/Rx pkts flow in driver:
-echo 1 >
-/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
-XX\:XX\:XX\:XX\:XX\:XX/reset_tx_stats
-
-echo 1 >
-/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
-XX\:XX\:XX\:XX\:XX\:XX/reset_rx_stats
-
-Command to dump the Tx pkts flow in mac80211:
-cat
-/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
-XX\:XX\:XX\:XX\:XX\:XX/mac80211_tx_pkts_flow
-
-Command to dump the Rx pkts flow in mac80211:
-cat
-/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
-XX\:XX\:XX\:XX\:XX\:XX/mac80211_rx_pkts_flow
-
-Commands to reset the Tx/Rx pkts flow in mac80211:
-echo 1 >
-/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
-XX\:XX\:XX\:XX\:XX\:XX/reset_mac80211_tx_pkts_flow
-
-echo 1 >
-/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
-XX\:XX\:XX\:XX\:XX\:XX/reset_mac80211_rx_pkts_flow
-
-Sample output after running the Tx and Rx traffic.
-
-root@OpenWrt:/# cat sys/kernel/debug/ieee80211/phy0/netdev\:
-wlan0/stations/8c\:fd\:f0\:06\:23\:41/driver_tx_pkts_flow
-Tx packets inflow from mac80211: 20
-Tx packets outflow to HW: 20
-
-root@OpenWrt:/# cat sys/kernel/debug/ieee80211/phy0/netdev\:
-wlan0/stations/8c\:fd\:f0\:06\:23\:41/mac80211_tx_pkts_flow
-Tx packets outflow from netif: 20
-Tx packets inflow in mac80211: 20
-
-root@OpenWrt:/# cat sys/kernel/debug/ieee80211/phy0/netdev\:
-wlan0/stations/8c\:fd\:f0\:06\:23\:41/driver_rx_pkts_flow
-Rx packets inflow from HW: 28
-Rx packets outflow from driver: 28
-
-root@OpenWrt:/# cat sys/kernel/debug/ieee80211/phy0/netdev\:
-wlan0/stations/8c\:fd\:f0\:06\:23\:41/mac80211_rx_pkts_flow
-Rx packets inflow in mac80211: 28
-Rx packets inflow in netif: 26
-Rx forwarded packets in bridge: 2
-
-Signed-off-by: Maharaja Kennadyrajan <mkenna@codeaurora.org>
----
- drivers/net/wireless/ath/ath11k/core.h        |  12 ++
- drivers/net/wireless/ath/ath11k/debugfs.h       |   2 +
- drivers/net/wireless/ath/ath11k/debugfs_sta.c | 145 +++++++++++++++++-
- drivers/net/wireless/ath/ath11k/dp_rx.c       |  38 +++++
- drivers/net/wireless/ath/ath11k/mac.c         |  11 ++
- 5 files changed, 207 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/ath/ath11k/core.h
-+++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -494,6 +494,17 @@ struct ath11k_per_ppdu_tx_stats {
- 
- DECLARE_EWMA(avg_rssi, 10, 8)
- 
-+struct ath11k_driver_tx_pkts_flow {
-+	atomic_t pkts_in;
-+	atomic_t pkts_out;
-+};
-+
-+struct ath11k_driver_rx_pkts_flow {
-+	atomic_t pkts_frm_hw;
-+	atomic_t pkts_out;
-+	atomic_t pkts_out_to_netif;
-+};
-+
- struct ath11k_sta {
- 	struct ath11k_vif *arvif;
- 
-@@ -527,6 +538,8 @@ struct ath11k_sta {
- #ifdef CPTCFG_ATH11K_NSS_SUPPORT
- 	struct ath11k_nss_sta_stats *nss_stats;
- #endif
-+	struct ath11k_driver_tx_pkts_flow drv_tx_pkts;
-+	struct ath11k_driver_rx_pkts_flow drv_rx_pkts;
- 	u16 tcl_metadata;
- 
- 	/* Protected with ar->data_lock */
---- a/drivers/net/wireless/ath/ath11k/debugfs.h
-+++ b/drivers/net/wireless/ath/ath11k/debugfs.h
-@@ -98,7 +98,7 @@ struct ath_pktlog_hdr {
- };
- 
- #define ATH11K_HTT_PEER_STATS_RESET BIT(16)
--
-+#define ATH11K_DRV_TX_STATS_SIZE      1024
- #define ATH11K_HTT_STATS_BUF_SIZE (1024 * 512)
- #define ATH11K_FW_STATS_BUF_SIZE (1024 * 1024)
- 
---- a/drivers/net/wireless/ath/ath11k/debugfs_sta.c
-+++ b/drivers/net/wireless/ath/ath11k/debugfs_sta.c
-@@ -146,9 +146,6 @@ static ssize_t ath11k_dbg_sta_dump_tx_st
- 	const int size = 2 * 4096;
- 	char *buf;
- 
--	if (!arsta->tx_stats)
--		return -ENOENT;
--
- 	buf = kzalloc(size, GFP_KERNEL);
- 	if (!buf)
- 		return -ENOMEM;
-@@ -156,6 +153,12 @@ static ssize_t ath11k_dbg_sta_dump_tx_st
- 	mutex_lock(&ar->conf_mutex);
- 
- 	spin_lock_bh(&ar->data_lock);
-+
-+	if (!arsta->tx_stats) {
-+		retval = -ENOENT;
-+		goto end;
-+	}
-+
- 	for (k = 0; k < ATH11K_STATS_TYPE_MAX; k++) {
- 		for (j = 0; j < ATH11K_COUNTER_TYPE_MAX; j++) {
- 			stats = &arsta->tx_stats->stats[k];
-@@ -229,6 +232,11 @@ static ssize_t ath11k_dbg_sta_dump_tx_st
- 
- 	mutex_unlock(&ar->conf_mutex);
- 	return retval;
-+end:
-+	spin_unlock_bh(&ar->data_lock);
-+	mutex_unlock(&ar->conf_mutex);
-+	kfree(buf);
-+	return retval;
- }
- 
- static const struct file_operations fops_tx_stats = {
-@@ -847,17 +855,211 @@ static const struct file_operations fops
- 	.llseek = default_llseek,
- };
- 
-+static ssize_t ath11k_dbg_sta_reset_rx_stats(struct file *file,
-+					     const char __user *buf,
-+					     size_t count, loff_t *ppos)
-+{
-+	struct ieee80211_sta *sta = file->private_data;
-+	struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv;
-+	struct ath11k *ar = arsta->arvif->ar;
-+	int ret, reset;
-+
-+	if (!arsta->rx_stats)
-+		return -ENOENT;
-+
-+	ret = kstrtoint_from_user(buf, count, 0, &reset);
-+	if (ret)
-+		return ret;
-+
-+	if (!reset || reset > 1)
-+		return -EINVAL;
-+
-+	spin_lock_bh(&ar->ab->base_lock);
-+	memset(arsta->rx_stats, 0, sizeof(*arsta->rx_stats));
-+	atomic_set(&arsta->drv_rx_pkts.pkts_frm_hw, 0);
-+	atomic_set(&arsta->drv_rx_pkts.pkts_out, 0);
-+	atomic_set(&arsta->drv_rx_pkts.pkts_out_to_netif, 0);
-+	spin_unlock_bh(&ar->ab->base_lock);
-+
-+	ret = count;
-+	return ret;
-+}
-+
-+static const struct file_operations fops_reset_rx_stats = {
-+	.write = ath11k_dbg_sta_reset_rx_stats,
-+	.open = simple_open,
-+	.owner = THIS_MODULE,
-+	.llseek = default_llseek,
-+};
-+
-+static ssize_t
-+ath11k_dbg_sta_dump_driver_tx_pkts_flow(struct file *file,
-+					char __user *user_buf,
-+					size_t count, loff_t *ppos)
-+{
-+	struct ieee80211_sta *sta = file->private_data;
-+	struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv;
-+	struct ath11k *ar = arsta->arvif->ar;
-+	int len = 0, ret_val;
-+	const int size = ATH11K_DRV_TX_STATS_SIZE;
-+	char *buf;
-+
-+	buf = kzalloc(ATH11K_DRV_TX_STATS_SIZE, GFP_KERNEL);
-+	if (!buf)
-+		return -ENOMEM;
-+
-+	mutex_lock(&ar->conf_mutex);
-+	spin_lock_bh(&ar->ab->base_lock);
-+
-+	if (!arsta->tx_stats) {
-+		ret_val = -ENOENT;
-+		goto end;
-+	}
-+
-+	len += scnprintf(buf + len, size - len,
-+			 "Tx packets inflow from mac80211: %u\n",
-+			 atomic_read(&arsta->drv_tx_pkts.pkts_in));
-+	len += scnprintf(buf + len, size - len,
-+			 "Tx packets outflow to HW: %u\n",
-+			 atomic_read(&arsta->drv_tx_pkts.pkts_out));
-+	spin_unlock_bh(&ar->ab->base_lock);
-+
-+	if (len > size)
-+		len = size;
-+
-+	ret_val = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-+	kfree(buf);
-+
-+	mutex_unlock(&ar->conf_mutex);
-+	return ret_val;
-+end:
-+	spin_unlock_bh(&ar->ab->base_lock);
-+	mutex_unlock(&ar->conf_mutex);
-+	kfree(buf);
-+	return ret_val;
-+}
-+
-+static const struct file_operations fops_driver_tx_pkts_flow = {
-+	.read = ath11k_dbg_sta_dump_driver_tx_pkts_flow,
-+	.open = simple_open,
-+	.owner = THIS_MODULE,
-+	.llseek = default_llseek,
-+};
-+
-+static ssize_t ath11k_dbg_sta_reset_tx_stats(struct file *file,
-+					     const char __user *buf,
-+					     size_t count, loff_t *ppos)
-+{
-+	struct ieee80211_sta *sta = file->private_data;
-+	struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv;
-+	struct ath11k *ar = arsta->arvif->ar;
-+	int ret, reset;
-+
-+	ret = kstrtoint_from_user(buf, count, 0, &reset);
-+	if (ret)
-+		return ret;
-+
-+	if (!reset || reset > 1)
-+		return -EINVAL;
-+
-+	spin_lock_bh(&ar->ab->base_lock);
-+
-+	if (!arsta->tx_stats) {
-+		spin_unlock_bh(&ar->ab->base_lock);
-+		return -ENOENT;
-+	}
-+
-+	memset(arsta->tx_stats, 0, sizeof(*arsta->tx_stats));
-+	atomic_set(&arsta->drv_tx_pkts.pkts_in, 0);
-+	atomic_set(&arsta->drv_tx_pkts.pkts_out, 0);
-+	spin_unlock_bh(&ar->ab->base_lock);
-+
-+	ret = count;
-+	return ret;
-+}
-+
-+static const struct file_operations fops_reset_tx_stats = {
-+	.write = ath11k_dbg_sta_reset_tx_stats,
-+	.open = simple_open,
-+	.owner = THIS_MODULE,
-+	.llseek = default_llseek,
-+};
-+
-+static ssize_t
-+ath11k_dbg_sta_dump_driver_rx_pkts_flow(struct file *file,
-+					char __user *user_buf,
-+					size_t count, loff_t *ppos)
-+{
-+	struct ieee80211_sta *sta = file->private_data;
-+	struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv;
-+	struct ath11k *ar = arsta->arvif->ar;
-+	struct ath11k_rx_peer_stats *rx_stats = arsta->rx_stats;
-+	int len = 0, ret_val = 0;
-+	const int size = 1024;
-+	char *buf;
-+
-+	if (!rx_stats)
-+		return -ENOENT;
-+
-+	buf = kzalloc(size, GFP_KERNEL);
-+	if (!buf)
-+		return -ENOMEM;
-+
-+	mutex_lock(&ar->conf_mutex);
-+	spin_lock_bh(&ar->ab->base_lock);
-+
-+	len += scnprintf(buf + len, size - len,
-+			 "Rx packets inflow from HW: %u\n",
-+			 atomic_read(&arsta->drv_rx_pkts.pkts_frm_hw));
-+	len += scnprintf(buf + len, size - len,
-+			 "Rx packets outflow from driver: %u\n",
-+			 atomic_read(&arsta->drv_rx_pkts.pkts_out));
-+	len += scnprintf(buf + len, size - len,
-+			 "Rx packets outflow from driver to netif in Fast rx: %u\n",
-+			 atomic_read(&arsta->drv_rx_pkts.pkts_out_to_netif));
-+
-+	len += scnprintf(buf + len, size - len, "\n");
-+
-+	spin_unlock_bh(&ar->ab->base_lock);
-+
-+	if (len > size)
-+		len = size;
-+
-+	ret_val = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-+	kfree(buf);
-+
-+	mutex_unlock(&ar->conf_mutex);
-+	return ret_val;
-+}
-+
-+static const struct file_operations fops_driver_rx_pkts_flow = {
-+	.read = ath11k_dbg_sta_dump_driver_rx_pkts_flow,
-+	.open = simple_open,
-+	.owner = THIS_MODULE,
-+	.llseek = default_llseek,
-+};
-+
- void ath11k_debugfs_sta_op_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 			       struct ieee80211_sta *sta, struct dentry *dir)
- {
- 	struct ath11k *ar = hw->priv;
- 
--	if (ath11k_debugfs_is_extd_tx_stats_enabled(ar))
--		debugfs_create_file("tx_stats", 0400, dir, sta,
--				    &fops_tx_stats);
--	if (ath11k_debugfs_is_extd_rx_stats_enabled(ar))
-+	if (ath11k_debugfs_is_extd_tx_stats_enabled(ar)) {
-+ 		debugfs_create_file("tx_stats", 0400, dir, sta,
-+ 				    &fops_tx_stats);
-+		debugfs_create_file("reset_tx_stats", 0600, dir, sta,
-+				    &fops_reset_tx_stats);
-+		debugfs_create_file("driver_tx_pkts_flow", 0400, dir, sta,
-+				    &fops_driver_tx_pkts_flow);
-+	}
-+	if (ath11k_debugfs_is_extd_rx_stats_enabled(ar)) {
- 		debugfs_create_file("rx_stats", 0400, dir, sta,
- 				    &fops_rx_stats);
-+		debugfs_create_file("reset_rx_stats", 0600, dir, sta,
-+				    &fops_reset_rx_stats);
-+		debugfs_create_file("driver_rx_pkts_flow", 0400, dir, sta,
-+				    &fops_driver_rx_pkts_flow);
-+ 	}
- 
- 	debugfs_create_file("htt_peer_stats", 0400, dir, sta,
- 			    &fops_htt_peer_stats);
---- a/drivers/net/wireless/ath/ath11k/dp_rx.c
-+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -2416,6 +2416,7 @@ static void ath11k_dp_rx_h_mpdu(struct a
- 	struct rx_attention *rx_attention;
- 	u32 err_bitmap;
- 
-+
- 	/* PN for multicast packets will be checked in mac80211 */
- 	rxcb = ATH11K_SKB_RXCB(msdu);
- 	fill_crypto_hdr = ath11k_dp_rx_h_attn_is_mcbc(ar->ab, rx_desc);
-@@ -2609,6 +2610,7 @@ static void ath11k_dp_rx_deliver_msdu(st
- 	struct ieee80211_rx_status *rx_status;
- 	struct ieee80211_radiotap_he *he = NULL;
- 	struct ieee80211_sta *pubsta = NULL;
-+	struct ath11k_sta *arsta = NULL;
- 	struct ath11k_peer *peer;
- 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
- 	u8 decap = DP_RX_DECAP_TYPE_RAW;
-@@ -2674,6 +2676,18 @@ static void ath11k_dp_rx_deliver_msdu(st
- 		rx_status->flag |= RX_FLAG_8023;
- 
- 	ieee80211_rx_napi(ar->hw, pubsta, msdu, napi);
-+
-+	if (ath11k_debugfs_is_extd_rx_stats_enabled(ar)) {
-+		if (!(status->flag & RX_FLAG_ONLY_MONITOR)) {
-+			spin_lock_bh(&ar->ab->base_lock);
-+			if (peer && peer->sta)
-+				arsta =
-+				(struct ath11k_sta *)peer->sta->drv_priv;
-+			spin_unlock_bh(&ar->ab->base_lock);
-+			if (arsta)
-+				atomic_inc(&arsta->drv_rx_pkts.pkts_out);
-+		}
-+	}
- }
- 
- static int ath11k_dp_rx_process_msdu(struct ath11k *ar,
-@@ -2820,6 +2834,8 @@ int ath11k_dp_process_rx(struct ath11k_b
- 	int total_msdu_reaped = 0;
- 	struct hal_srng *srng;
- 	struct sk_buff *msdu;
-+	struct ath11k_peer *peer = NULL;
-+	struct ath11k_sta *arsta = NULL;
- 	bool done = false;
- 	int buf_id, mac_id;
- 	struct ath11k *ar;
-@@ -2893,6 +2909,19 @@ try_again:
- 		rxcb->tid = FIELD_GET(HAL_REO_DEST_RING_INFO0_RX_QUEUE_NUM,
- 				      desc->info0);
- 
-+		if (ath11k_debugfs_is_extd_rx_stats_enabled(ar) && rxcb->peer_id) {
-+			rcu_read_lock();
-+			spin_lock_bh(&ab->base_lock);
-+			peer = ath11k_peer_find_by_id(ab, rxcb->peer_id);
-+			if (peer && peer->sta)
-+				arsta =
-+				(struct ath11k_sta *)peer->sta->drv_priv;
-+			spin_unlock_bh(&ab->base_lock);
-+			if (arsta)
-+				atomic_inc(&arsta->drv_rx_pkts.pkts_frm_hw);
-+			rcu_read_unlock();
-+		}
-+
- 		rxcb->mac_id = mac_id;
- 		__skb_queue_tail(&msdu_list[mac_id], msdu);
- 
-@@ -4084,7 +4113,10 @@ static int ath11k_dp_rx_h_null_q_desc(st
- 	struct rx_attention *rx_attention;
- 	u8 l3pad_bytes;
- 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
-+	struct ath11k_peer *peer = NULL;
-+	struct ath11k_sta *arsta = NULL;
- 	u32 hal_rx_desc_sz = ar->ab->hw_params.hal_desc_sz;
-+	u32 peer_id;
- 
- 	msdu_len = ath11k_dp_rx_h_msdu_start_msdu_len(ar->ab, desc);
- 
-@@ -4136,6 +4168,18 @@ static int ath11k_dp_rx_h_null_q_desc(st
- 	 * rx with mac80211. Need not worry about cleaning up amsdu_list.
- 	 */
- 
-+	if (ath11k_debugfs_is_extd_rx_stats_enabled(ar)) {
-+		peer_id = ath11k_dp_rx_h_mpdu_start_peer_id(ar->ab, desc);
-+		spin_lock_bh(&ar->ab->base_lock);
-+		if (peer_id)
-+			peer = ath11k_peer_find_by_id(ar->ab, rxcb->peer_id);
-+		if (peer && peer->sta)
-+			arsta = (struct ath11k_sta *)peer->sta->drv_priv;
-+		spin_unlock_bh(&ar->ab->base_lock);
-+		if (arsta)
-+			atomic_inc(&arsta->drv_rx_pkts.pkts_frm_hw);
-+	}
-+
- 	return 0;
- }
- 
---- a/drivers/net/wireless/ath/ath11k/mac.c
-+++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -6252,6 +6252,7 @@ static void ath11k_mac_op_tx(struct ieee
- 	struct ath11k_mgmt_frame_stats *mgmt_stats = &arvif->mgmt_stats;
- 	struct ath11k_sta *arsta = NULL;
- 	u32 info_flags = info->flags;
-+	struct ieee80211_sta *sta = control->sta;
- 	bool is_prb_rsp;
- 	u16 frm_type = 0;
- 	int ret;
-@@ -6314,6 +6315,15 @@ static void ath11k_mac_op_tx(struct ieee
- 		ieee80211_free_txskb(ar->hw, skb);
- 		return;
- 	}
-+
-+	if (ath11k_debugfs_is_extd_tx_stats_enabled(ar) && sta) {
-+		arsta = (struct ath11k_sta *)sta->drv_priv;
-+		if (arsta) {
-+			atomic_inc(&arsta->drv_tx_pkts.pkts_in);
-+			if (!ret)
-+				atomic_inc(&arsta->drv_tx_pkts.pkts_out);
-+		}
-+	}
- }
- 
- void ath11k_mac_drain_tx(struct ath11k *ar)
diff --git a/package/kernel/mac80211/patches/ath11k_nss/234-002-mac80211-account-tx-rx-packets-flow.patch b/package/kernel/mac80211/patches/ath11k_nss/234-002-mac80211-account-tx-rx-packets-flow.patch
deleted file mode 100644
index 7488f0c2bfce6b..00000000000000
--- a/package/kernel/mac80211/patches/ath11k_nss/234-002-mac80211-account-tx-rx-packets-flow.patch
+++ /dev/null
@@ -1,369 +0,0 @@
-From 26bf6027fe93346f47358e8933e613ac1ece3455 Mon Sep 17 00:00:00 2001
-From: Maharaja Kennadyrajan <mkenna@codeaurora.org>
-Date: Mon, 4 Jan 2021 23:50:37 +0530
-Subject: [PATCH 2/2] ath11k/mac80211: Add support to account Tx and Rx flow
- packets
-
-Added support to log the inflow and outflow of the Tx and Rx
-packets in netif and host driver.
-
-Command to dump the Tx pkts flow in driver:
-cat
-/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
-XX\:XX\:XX\:XX\:XX\:XX/driver_tx_pkts_flow
-
-Command to dump the Rx pkts flow in driver:
-cat
-/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
-XX\:XX\:XX\:XX\:XX\:XX/driver_rx_pkts_flow
-
-Commands to reset the Tx/Rx pkts flow in driver:
-echo 1 >
-/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
-XX\:XX\:XX\:XX\:XX\:XX/reset_tx_stats
-
-echo 1 >
-/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
-XX\:XX\:XX\:XX\:XX\:XX/reset_rx_stats
-
-Command to dump the Tx pkts flow in mac80211:
-cat
-/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
-XX\:XX\:XX\:XX\:XX\:XX/mac80211_tx_pkts_flow
-
-Command to dump the Rx pkts flow in mac80211:
-cat
-/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
-XX\:XX\:XX\:XX\:XX\:XX/mac80211_rx_pkts_flow
-
-Commands to reset the Tx/Rx pkts flow in mac80211:
-echo 1 >
-/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
-XX\:XX\:XX\:XX\:XX\:XX/reset_mac80211_tx_pkts_flow
-
-echo 1 >
-/sys/kernel/debug/ieee80211/phyX/netdev\:wlanX/stations/
-XX\:XX\:XX\:XX\:XX\:XX/reset_mac80211_rx_pkts_flow
-
-Sample output after running the Tx and Rx traffic.
-
-root@OpenWrt:/# cat sys/kernel/debug/ieee80211/phy0/netdev\:
-wlan0/stations/8c\:fd\:f0\:06\:23\:41/driver_tx_pkts_flow
-Tx packets inflow from mac80211: 20
-Tx packets outflow to HW: 20
-
-root@OpenWrt:/# cat sys/kernel/debug/ieee80211/phy0/netdev\:
-wlan0/stations/8c\:fd\:f0\:06\:23\:41/mac80211_tx_pkts_flow
-Tx packets outflow from netif: 20
-Tx packets inflow in mac80211: 20
-
-root@OpenWrt:/# cat sys/kernel/debug/ieee80211/phy0/netdev\:
-wlan0/stations/8c\:fd\:f0\:06\:23\:41/driver_rx_pkts_flow
-Rx packets inflow from HW: 28
-Rx packets outflow from driver: 28
-
-root@OpenWrt:/# cat sys/kernel/debug/ieee80211/phy0/netdev\:
-wlan0/stations/8c\:fd\:f0\:06\:23\:41/mac80211_rx_pkts_flow
-Rx packets inflow in mac80211: 28
-Rx packets inflow in netif: 26
-Rx forwarded packets in bridge: 2
-
-Signed-off-by: Maharaja Kennadyrajan <mkenna@codeaurora.org>
----
- net/mac80211/debugfs_sta.c | 174 +++++++++++++++++++++++++++++++++++++
- net/mac80211/rx.c          |  13 +++
- net/mac80211/sta_info.h    |   7 ++
- net/mac80211/tx.c          |   8 ++
- 4 files changed, 202 insertions(+)
-
---- a/net/mac80211/debugfs_sta.c
-+++ b/net/mac80211/debugfs_sta.c
-@@ -1219,6 +1219,176 @@ out:
- }
- LINK_STA_OPS(eht_capa);
- 
-+static ssize_t
-+sta_reset_mac80211_tx_pkts_flow_read(struct file *file,
-+				     char __user *userbuf,
-+				     size_t count, loff_t *ppos)
-+{
-+	size_t bufsz = 30;
-+	char *buf = kzalloc(bufsz, GFP_KERNEL), *p = buf;
-+	ssize_t rv;
-+
-+	if (!buf)
-+		return -ENOMEM;
-+
-+	p += scnprintf(p, bufsz + buf - p, "write 1 to reset the stats\n");
-+
-+	rv = simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
-+	kfree(buf);
-+	return rv;
-+}
-+
-+static ssize_t
-+sta_reset_mac80211_tx_pkts_flow_write(struct file *file,
-+				      const char __user *userbuf,
-+				      size_t count, loff_t *ppos)
-+{
-+	struct sta_info *sta = file->private_data;
-+	unsigned long tx_stats_reset;
-+	int ret;
-+	char _buf[2] = {}, *buf = _buf;
-+
-+	if (count > sizeof(_buf))
-+		return -EINVAL;
-+
-+	if (copy_from_user(buf, userbuf, count))
-+		return -EFAULT;
-+
-+	buf[sizeof(_buf) - 1] = '\0';
-+	if (sscanf(buf, "%lu", &tx_stats_reset) != 1)
-+		return -EINVAL;
-+
-+	ret = kstrtoul(buf, 0, &tx_stats_reset);
-+	if (ret || tx_stats_reset != 1)
-+		return -EINVAL;
-+
-+	atomic_set(&sta->tx_drv_pkts, 0);
-+	atomic_set(&sta->tx_netif_pkts, 0);
-+
-+	return count;
-+}
-+STA_OPS_RW(reset_mac80211_tx_pkts_flow);
-+
-+static ssize_t
-+sta_reset_mac80211_rx_pkts_flow_read(struct file *file,
-+				     char __user *userbuf,
-+				     size_t count, loff_t *ppos)
-+{
-+	size_t bufsz = 30;
-+	char *buf = kzalloc(bufsz, GFP_KERNEL), *p = buf;
-+	ssize_t rv;
-+
-+	if (!buf)
-+		return -ENOMEM;
-+
-+	p += scnprintf(p, bufsz + buf - p, "write 1 to reset the stats\n");
-+
-+	rv = simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
-+	kfree(buf);
-+	return rv;
-+}
-+
-+static ssize_t
-+sta_reset_mac80211_rx_pkts_flow_write(struct file *file,
-+				      const char __user *userbuf,
-+				      size_t count, loff_t *ppos)
-+{
-+	struct sta_info *sta = file->private_data;
-+	unsigned long rx_stats_reset;
-+	int ret;
-+	char _buf[2] = {}, *buf = _buf;
-+
-+	if (count > sizeof(_buf))
-+		return -EINVAL;
-+
-+	if (copy_from_user(buf, userbuf, count))
-+		return -EFAULT;
-+
-+	buf[sizeof(_buf) - 1] = '\0';
-+	if (sscanf(buf, "%lu", &rx_stats_reset) != 1)
-+		return -EINVAL;
-+
-+	ret = kstrtoul(buf, 0, &rx_stats_reset);
-+	if (ret || rx_stats_reset != 1)
-+		return -EINVAL;
-+
-+	atomic_set(&sta->rx_drv_pkts, 0);
-+	atomic_set(&sta->rx_netif_pkts, 0);
-+	atomic_set(&sta->rx_forwarded_pkts, 0);
-+
-+	return count;
-+}
-+STA_OPS_RW(reset_mac80211_rx_pkts_flow);
-+
-+static ssize_t sta_mac80211_tx_pkts_flow_read(struct file *file,
-+					      char __user *userbuf,
-+					      size_t count, loff_t *ppos)
-+{
-+	struct sta_info *sta = file->private_data;
-+	int retval = 0, len = 0;
-+	const int size = 256;
-+	char *buf;
-+
-+	buf = kzalloc(size, GFP_KERNEL);
-+	if (!buf)
-+		return -ENOMEM;
-+
-+	rcu_read_lock();
-+
-+	len += scnprintf(buf + len, size - len,
-+			 "Tx packets outflow from netif: %u\n",
-+			 atomic_read(&sta->tx_netif_pkts));
-+	len += scnprintf(buf + len, size - len,
-+			 "Tx packets outflow from mac80211: %u\n",
-+			 atomic_read(&sta->tx_drv_pkts));
-+	rcu_read_unlock();
-+
-+	if (len > size)
-+		len = size;
-+
-+	retval = simple_read_from_buffer(userbuf, count, ppos, buf, len);
-+	kfree(buf);
-+
-+	return retval;
-+}
-+STA_OPS(mac80211_tx_pkts_flow);
-+
-+static ssize_t sta_mac80211_rx_pkts_flow_read(struct file *file,
-+					      char __user *userbuf,
-+					      size_t count, loff_t *ppos)
-+{
-+	struct sta_info *sta = file->private_data;
-+	int retval = 0, len = 0;
-+	const int size = 512;
-+	char *buf;
-+
-+	buf = kzalloc(size, GFP_KERNEL);
-+	if (!buf)
-+		return -ENOMEM;
-+
-+	rcu_read_lock();
-+
-+	len += scnprintf(buf + len, size - len,
-+			 "Rx packets inflow in mac80211: %u\n",
-+			 atomic_read(&sta->rx_drv_pkts));
-+	len += scnprintf(buf + len, size - len,
-+			 "Rx packets inflow in netif: %u\n",
-+			 atomic_read(&sta->rx_netif_pkts));
-+	len += scnprintf(buf + len, size - len,
-+			 "Rx forwarded packets in bridge: %u\n",
-+			 atomic_read(&sta->rx_forwarded_pkts));
-+
-+	rcu_read_unlock();
-+
-+	if (len > size)
-+		len = size;
-+	retval = simple_read_from_buffer(userbuf, count, ppos, buf, len);
-+	kfree(buf);
-+
-+	return retval;
-+}
-+STA_OPS(mac80211_rx_pkts_flow);
-+
- #define DEBUGFS_ADD(name) \
- 	debugfs_create_file(#name, 0400, \
- 		sta->debugfs_dir, sta, &sta_ ##name## _ops)
-@@ -1254,6 +1424,10 @@ void ieee80211_sta_debugfs_add(struct st
- 	DEBUGFS_ADD(num_ps_buf_frames);
- 	DEBUGFS_ADD(last_seq_ctrl);
- 	DEBUGFS_ADD(agg_status);
-+	DEBUGFS_ADD(reset_mac80211_tx_pkts_flow);
-+	DEBUGFS_ADD(reset_mac80211_rx_pkts_flow);
-+	DEBUGFS_ADD(mac80211_tx_pkts_flow);
-+	DEBUGFS_ADD(mac80211_rx_pkts_flow);
- 	/* FIXME: Kept here as the statistics are only done on the deflink */
- 	DEBUGFS_ADD_COUNTER(tx_filtered, deflink.status_stats.filtered);
- 
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -2623,6 +2623,7 @@ static void ieee80211_deliver_skb_to_loc
- {
- 	struct ieee80211_sub_if_data *sdata = rx->sdata;
- 	struct net_device *dev = sdata->dev;
-+	struct sta_info *sta = rx->sta;
- 
- 	if (unlikely((skb->protocol == sdata->control_port_protocol ||
- 		     (skb->protocol == cpu_to_be16(ETH_P_PREAUTH) &&
-@@ -2666,6 +2667,7 @@ static void ieee80211_deliver_skb_to_loc
- 		else
- 			netif_receive_skb(skb);
- #endif
-+		atomic_inc(&sta->rx_netif_pkts);
- 	}
- }
- 
-@@ -2724,6 +2726,7 @@ ieee80211_deliver_skb(struct ieee80211_r
- 				 */
- 				xmit_skb = skb;
- 				skb = NULL;
-+				atomic_inc(&rx->sta->rx_forwarded_pkts);
- 			}
- 		}
- 	}
-@@ -4836,6 +4839,7 @@ static void ieee80211_rx_8023(struct iee
- 			skb_reset_network_header(xmit_skb);
- 			skb_reset_mac_header(xmit_skb);
- 			dev_queue_xmit(xmit_skb);
-+			atomic_inc(&rx->sta->rx_forwarded_pkts);
- 		}
- 
- 		if (!skb)
-@@ -5332,9 +5336,18 @@ void ieee80211_rx_list(struct ieee80211_
- 	struct ieee80211_supported_band *sband;
- 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
- 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-+	struct sta_info *sta = NULL;
- 
- 	WARN_ON_ONCE(softirq_count() == 0);
- 
-+	if (pubsta) {
-+		sta = container_of(pubsta, struct sta_info, sta);
-+		if (sta && napi) {
-+			if (!(status->flag & RX_FLAG_ONLY_MONITOR))
-+				atomic_inc(&sta->rx_drv_pkts);
-+		}
-+	}
-+
- 	if (WARN_ON(status->band >= NUM_NL80211_BANDS))
- 		goto drop;
- 
---- a/net/mac80211/sta_info.h
-+++ b/net/mac80211/sta_info.h
-@@ -724,6 +724,13 @@ struct sta_info {
- 	struct link_sta_info deflink;
- 	struct link_sta_info __rcu *link[IEEE80211_MLD_MAX_NUM_LINKS];
- 
-+	atomic_t tx_drv_pkts;
-+	atomic_t tx_netif_pkts;
-+	atomic_t rx_drv_pkts;
-+	atomic_t rx_netif_pkts;
-+	/* Rx packets forwarded to bridge */
-+	atomic_t rx_forwarded_pkts;
-+
- 	/* keep last! */
- 	struct ieee80211_sta sta;
- };
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -4294,6 +4294,9 @@ void __ieee80211_subif_start_xmit(struct
- 	if (IS_ERR(sta))
- 		sta = NULL;
- 
-+	if (sta)
-+		atomic_inc(&sta->tx_netif_pkts);
-+
-         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
-                 ap_sdata = container_of(sdata->bss,
-                                         struct ieee80211_sub_if_data, u.ap);
-@@ -4614,6 +4617,9 @@ static bool __ieee80211_tx_8023(struct i
- 
- 	drv_tx(local, &control, skb);
- 
-+	if (sta)
-+		atomic_inc(&sta->tx_drv_pkts);
-+
- 	return true;
- }
- 
-@@ -4719,6 +4725,9 @@ static void ieee80211_8023_xmit(struct i
- 
- 	ieee80211_tx_8023(sdata, skb, sta, false);
- 
-+	if (sta)
-+		atomic_inc(&sta->tx_netif_pkts);
-+
- 	return;
- 
- out_free:
diff --git a/package/kernel/mac80211/patches/ath11k_nss/235-001-ath11k-Add-support-for-beacon-tx-mode.patch b/package/kernel/mac80211/patches/ath11k_nss/235-001-ath11k-Add-support-for-beacon-tx-mode.patch
deleted file mode 100644
index 5d5a83911d8519..00000000000000
--- a/package/kernel/mac80211/patches/ath11k_nss/235-001-ath11k-Add-support-for-beacon-tx-mode.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From a297f43a9ad6d8c95cf8b984337ffb410f3eb92c Mon Sep 17 00:00:00 2001
-From: Maharaja Kennadyrajan <mkenna@codeaurora.org>
-Date: Tue, 12 Jan 2021 18:07:51 +0530
-Subject: [PATCH] ath11k: Add support for beacon tx mode
-
-User can configure the beacon tx mode while bring-up the
-AP via hostapd configuration.
-
-Use the below configuration in the hostapd to configure
-the beacon tx mode.
-
-"beacon_tx_mode=N", where N = 0 for STAGGERED beacon mode
-and N = 1 for BURST beacon mode.
-
-Signed-off-by: Maharaja Kennadyrajan <mkenna@codeaurora.org>
----
- drivers/net/wireless/ath/ath11k/mac.c | 7 ++++---
- 1 file changed, 4 insertions(+), 3 deletions(-)
-
---- a/drivers/net/wireless/ath/ath11k/mac.c
-+++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -3481,7 +3481,10 @@ static void ath11k_mac_op_bss_info_chang
- 
- 	if (changed & BSS_CHANGED_BEACON) {
- 		param_id = WMI_PDEV_PARAM_BEACON_TX_MODE;
--		param_value = WMI_BEACON_STAGGERED_MODE;
-+		if (info->beacon_tx_mode == NL80211_BEACON_BURST_MODE)
-+			param_value = WMI_BEACON_BURST_MODE;
-+		else
-+			param_value = WMI_BEACON_STAGGERED_MODE;
- 		ret = ath11k_wmi_pdev_set_param(ar, param_id,
- 						param_value, ar->pdev->pdev_id);
- 		if (ret)
-@@ -3489,8 +3492,9 @@ static void ath11k_mac_op_bss_info_chang
- 				    arvif->vdev_id);
- 		else
- 			ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
--				   "Set staggered beacon mode for VDEV: %d\n",
--				   arvif->vdev_id);
-+				   "Set %s beacon mode for VDEV: %d mode: %d\n",
-+				   param_value ? "burst" : "staggered",
-+				   arvif->vdev_id, param_value);
- 
- 		if (!arvif->do_not_send_tmpl || !arvif->bcca_zero_sent) {
- 			ret = ath11k_mac_setup_bcn_tmpl(arvif);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/235-002-mac80211-Add-support-for-beacon-tx-mode.patch b/package/kernel/mac80211/patches/ath11k_nss/235-002-mac80211-Add-support-for-beacon-tx-mode.patch
deleted file mode 100644
index 6fb460f6b4f740..00000000000000
--- a/package/kernel/mac80211/patches/ath11k_nss/235-002-mac80211-Add-support-for-beacon-tx-mode.patch
+++ /dev/null
@@ -1,159 +0,0 @@
-From f8e7ec408c357d6438abd980f700353a7efcac7e Mon Sep 17 00:00:00 2001
-From: Maharaja Kennadyrajan <mkenna@codeaurora.org>
-Date: Tue, 12 Jan 2021 18:11:33 +0530
-Subject: [PATCH] mac80211: Add support for beacon tx mode
-
-User can configure the beacon tx mode while bring-up the
-AP via hostapd configuration.
-
-Use the below configuration in the hostapd to configure
-the beacon tx mode.
-
-"beacon_tx_mode=N", where N = 0 for STAGGERED beacon mode
-and N = 1 for BURST beacon mode.
-
-Signed-off-by: Maharaja Kennadyrajan <mkenna@codeaurora.org>
----
- include/net/cfg80211.h       | 2 +-
- include/net/mac80211.h       | 1 +
- include/uapi/linux/nl80211.h | 2 ++
- net/mac80211/cfg.c           | 1 +
- net/wireless/nl80211.c       | 7 ++++++-
- 5 files changed, 11 insertions(+), 2 deletions(-)
-
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -1443,6 +1443,7 @@ struct cfg80211_unsol_bcast_probe_resp {
-  * @punct_bitmap: Preamble puncturing bitmap. Each bit represents
-  *	a 20 MHz channel, lowest bit corresponding to the lowest channel.
-  *	Bit set to 1 indicates that the channel is punctured.
-+ * @beacon_tx_mode: Beacon Tx Mode setting
-  */
- struct cfg80211_ap_settings {
- 	struct cfg80211_chan_def chandef;
-@@ -1478,6 +1479,7 @@ struct cfg80211_ap_settings {
- 	struct cfg80211_unsol_bcast_probe_resp unsol_bcast_probe_resp;
- 	struct cfg80211_mbssid_config mbssid_config;
- 	u16 punct_bitmap;
-+	enum nl80211_beacon_tx_mode beacon_tx_mode;
- };
- 
- /**
-@@ -2436,6 +2438,7 @@ struct mesh_config {
-  *	to operate on DFS channels.
-  * @control_port_over_nl80211: TRUE if userspace expects to exchange control
-  *	port frames over NL80211 instead of the network interface.
-+ * @beacon_tx_mode: Beacon Tx Mode setting.
-  *
-  * These parameters are fixed when the mesh is created.
-  */
-@@ -2459,6 +2462,7 @@ struct mesh_setup {
- 	struct cfg80211_bitrate_mask beacon_rate;
- 	bool userspace_handles_dfs;
- 	bool control_port_over_nl80211;
-+	enum nl80211_beacon_tx_mode beacon_tx_mode;
- };
- 
- /**
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -698,6 +698,7 @@ struct ieee80211_fils_discovery {
-  * @eht_mu_beamformer: in AP-mode, does this BSS enable operation as an EHT MU
-  *	beamformer
-  * @nss_ap_isolate: Used for notifying the NSS host about AP isolate feature
-+ * @beacon_tx_mode: Beacon Tx Mode setting.
-  */
- struct ieee80211_bss_conf {
- 	struct ieee80211_vif *vif;
-@@ -792,6 +793,7 @@ struct ieee80211_bss_conf {
- 	bool eht_su_beamformee;
- 	bool eht_mu_beamformer;
- 	bool nss_ap_isolate;
-+	enum nl80211_beacon_tx_mode beacon_tx_mode;
- };
- 
- /**
---- a/include/uapi/linux/nl80211.h
-+++ b/include/uapi/linux/nl80211.h
-@@ -2814,7 +2814,9 @@ enum nl80211_commands {
-  *
-  * @NL80211_ATTR_MLO_LINK_DISABLED: Flag attribute indicating that the link is
-  *	disabled.
-- *
-+ * @NL80211_ATTR_BEACON_TX_MODE: used to configure the beacon tx mode as
-+ *	staggered mode = 1 or burst mode = 2 in %NL80211_CMD_START_AP or
-+ *	%NL80211_CMD_JOIN_MESH from user-space.
-  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
-  * @NL80211_ATTR_MAX: highest attribute number currently defined
-  * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -3353,6 +3355,8 @@ enum nl80211_attrs {
- 
- 	NL80211_ATTR_MLO_LINK_DISABLED,
- 
-+	NL80211_ATTR_BEACON_TX_MODE,
-+
- 	/* add attributes here, update the policy in nl80211.c */
- 
- 	__NL80211_ATTR_AFTER_LAST,
-@@ -7840,4 +7844,12 @@ enum nl80211_ap_settings_flags {
- 	NL80211_AP_SETTINGS_SA_QUERY_OFFLOAD_SUPPORT	= 1 << 1,
- };
- 
-+/**
-+ * enum nl80211_beacon_tx_mode - Beacon Tx Mode enum.
-+ * 	Used to configure beacon staggered mode or beacon burst mode.
-+ */
-+enum nl80211_beacon_tx_mode {
-+	NL80211_BEACON_STAGGERED_MODE = 1,
-+	NL80211_BEACON_BURST_MODE = 2,
-+};
- #endif /* __LINUX_NL80211_H */
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -1294,6 +1294,7 @@ static int ieee80211_start_ap(struct wip
- 
- 	prev_beacon_int = link_conf->beacon_int;
- 	link_conf->beacon_int = params->beacon_interval;
-+	link_conf->beacon_tx_mode = params->beacon_tx_mode;
- 
- 	if (params->ht_cap)
- 		link_conf->ht_ldpc =
-@@ -2490,6 +2491,7 @@ static int copy_mesh_setup(struct ieee80
- 
- 	sdata->vif.bss_conf.beacon_int = setup->beacon_interval;
- 	sdata->vif.bss_conf.dtim_period = setup->dtim_period;
-+	sdata->vif.bss_conf.beacon_tx_mode = setup->beacon_tx_mode;
- 
- 	sdata->beacon_rate_set = false;
- 	if (wiphy_ext_feature_isset(sdata->local->hw.wiphy,
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -811,6 +811,7 @@ static const struct nla_policy nl80211_p
- 	[NL80211_ATTR_HW_TIMESTAMP_ENABLED] = { .type = NLA_FLAG },
- 	[NL80211_ATTR_EMA_RNR_ELEMS] = { .type = NLA_NESTED },
- 	[NL80211_ATTR_MLO_LINK_DISABLED] = { .type = NLA_FLAG },
-+	[NL80211_ATTR_BEACON_TX_MODE] = NLA_POLICY_RANGE(NLA_U32, 1, 2),
- };
- 
- /* policy for the key attributes */
-@@ -5941,6 +5942,9 @@ static int nl80211_start_ap(struct sk_bu
- 		nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
- 	params->dtim_period =
- 		nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
-+	if (info->attrs[NL80211_ATTR_BEACON_TX_MODE])
-+		params->beacon_tx_mode =
-+			nla_get_u32(info->attrs[NL80211_ATTR_BEACON_TX_MODE]);
- 
- 	err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
- 					   params->beacon_interval);
-@@ -13037,6 +13041,10 @@ static int nl80211_join_mesh(struct sk_b
- 			return -EINVAL;
- 	}
- 
-+	if (info->attrs[NL80211_ATTR_BEACON_TX_MODE])
-+		setup.beacon_tx_mode =
-+			nla_get_u32(info->attrs[NL80211_ATTR_BEACON_TX_MODE]);
-+
- 	if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
- 		/* parse additional setup parameters if given */
- 		err = nl80211_parse_mesh_setup(info, &setup);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/237-002-ath11k-Add-provision-to-configure-rx-hashmap.patch b/package/kernel/mac80211/patches/ath11k_nss/237-002-ath11k-Add-provision-to-configure-rx-hashmap.patch
deleted file mode 100644
index 83c019b871e81b..00000000000000
--- a/package/kernel/mac80211/patches/ath11k_nss/237-002-ath11k-Add-provision-to-configure-rx-hashmap.patch
+++ /dev/null
@@ -1,208 +0,0 @@
-From 60d0a63d537c280ff9501296cefd322b981b88f5 Mon Sep 17 00:00:00 2001
-From: P Praneesh <ppranees@codeaurora.org>
-Date: Mon, 14 Dec 2020 19:13:49 +0530
-Subject: [PATCH] ath11k: Add provision to configure rx hashmap
-
-Currently the hashmap is set to default during REO
-setup and all REO rings are equally distributed across
-32 hash values.
-
-Add provision to configure the hashmap so that destination
-rings can be controlled. Setting 0 will disable hash based
-steering.
-
-echo "hashmap" > /sys/kernel/debug/ath11k/ipq8074\ hw2.0/rx_hash
-
-Signed-off-by: Sriram R <srirrama@codeaurora.org>
-Signed-off-by: P Praneesh <ppranees@codeaurora.org>
----
- drivers/net/wireless/ath/ath11k/core.h   |  2 ++
- drivers/net/wireless/ath/ath11k/debugfs.c  | 51 ++++++++++++++++++++++++++++++++
- drivers/net/wireless/ath/ath11k/dp.c     |  4 ++-
- drivers/net/wireless/ath/ath11k/hal.h    |  1 +
- drivers/net/wireless/ath/ath11k/hal_rx.c | 30 +++++++++++--------
- 5 files changed, 74 insertions(+), 14 deletions(-)
-
---- a/drivers/net/wireless/ath/ath11k/core.h
-+++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -65,6 +65,7 @@ extern bool ath11k_ftm_mode;
- #define ATH11K_RECONFIGURE_TIMEOUT_HZ (10 * HZ)
- #define ATH11K_RECOVER_START_TIMEOUT_HZ (20 * HZ)
- 
-+#define HAL_REO_DEST_RING_CTRL_HASH_RING_SHIFT                  8
- enum ath11k_supported_bw {
- 	ATH11K_BW_20	= 0,
- 	ATH11K_BW_40	= 1,
-@@ -1037,6 +1038,8 @@ struct ath11k_base {
- 	atomic_t num_max_allowed;
- 	struct ath11k_num_vdevs_peers *num_vdevs_peers;
- 
-+	u32 rx_hash;
-+
- 	/* must be last */
- 	u8 drv_priv[] __aligned(sizeof(void *));
- };
---- a/drivers/net/wireless/ath/ath11k/debugfs.c
-+++ b/drivers/net/wireless/ath/ath11k/debugfs.c
-@@ -972,6 +972,54 @@ static const struct file_operations fops
- 	.llseek = default_llseek,
- };
- 
-+static ssize_t ath11k_write_rx_hash(struct file *file,
-+				    const char __user *ubuf,
-+				    size_t count, loff_t *ppos)
-+{
-+	struct ath11k_base *ab = file->private_data;
-+	struct ath11k_pdev *pdev;
-+	u32 rx_hash;
-+	u8 buf[128] = {0};
-+	int ret, i, radioup = 0;
-+
-+	for (i = 0; i < ab->num_radios; i++) {
-+		pdev = &ab->pdevs[i];
-+		if (pdev && pdev->ar) {
-+			radioup = 1;
-+			break;
-+		}
-+	}
-+
-+	if (radioup == 0) {
-+		ath11k_err(ab, "radio is not up\n");
-+		ret = -ENETDOWN;
-+		goto exit;
-+	}
-+
-+	ret = simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, ubuf, count);
-+	if (ret < 0)
-+		goto exit;
-+
-+	buf[ret] = '\0';
-+	ret = sscanf(buf, "%x", &rx_hash);
-+	if (!ret) {
-+		ret = -EINVAL;
-+		goto exit;
-+	}
-+
-+	if (rx_hash != ab->rx_hash) {
-+		ab->rx_hash = rx_hash;
-+		if (rx_hash)
-+			ath11k_hal_reo_hash_setup(ab, rx_hash);
-+	}
-+	ret = count;
-+exit:
-+	return ret;
-+}
-+static const struct file_operations fops_soc_rx_hash = {
-+	.open = simple_open,
-+	.write = ath11k_write_rx_hash,
-+};
- int ath11k_debugfs_pdev_create(struct ath11k_base *ab)
- {
- 	if (test_bit(ATH11K_FLAG_REGISTERED, &ab->dev_flags))
-@@ -987,6 +1035,10 @@ int ath11k_debugfs_pdev_create(struct at
- 		debugfs_create_file("sram", 0400, ab->debugfs_soc, ab,
- 				    &fops_sram_dump);
- 
-+		debugfs_create_file("rx_hash", 0600, ab->debugfs_soc, ab,
-+			    &fops_soc_rx_hash);
-+
-+
- 	return 0;
- }
- 
---- a/drivers/net/wireless/ath/ath11k/dp.c
-+++ b/drivers/net/wireless/ath/ath11k/dp.c
-@@ -50,7 +50,7 @@ int ath11k_dp_peer_setup(struct ath11k *
- 	bool rx_hash_enable = DP_RX_HASH_ENABLE;
- 
- 	/* RX Hash based steering is disabled for NSS Offload */
--	if (ar->ab->nss.enabled)
-+	if (ar->ab->nss.enabled || !ab->rx_hash)
- 		rx_hash_enable = DP_RX_HASH_DISABLE;
- 
- 	/* NOTE: reo_dest ring id starts from 1 unlike mac_id which starts from 0 */
---- a/drivers/net/wireless/ath/ath11k/hal.h
-+++ b/drivers/net/wireless/ath/ath11k/hal.h
-@@ -922,6 +922,7 @@ void ath11k_hal_reo_qdesc_setup(void *va
- 				u32 start_seq, enum hal_pn_type type);
- void ath11k_hal_reo_init_cmd_ring(struct ath11k_base *ab,
- 				  struct hal_srng *srng);
-+void ath11k_hal_reo_hash_setup(struct ath11k_base *ab, u32 ring_hash_map);
- void ath11k_hal_setup_link_idle_list(struct ath11k_base *ab,
- 				     struct hal_wbm_idle_scatter_list *sbuf,
- 				     u32 nsbufs, u32 tot_link_desc,
---- a/drivers/net/wireless/ath/ath11k/hw.c
-+++ b/drivers/net/wireless/ath/ath11k/hw.c
-@@ -102,6 +102,23 @@ static void ath11k_init_wmi_config_qca63
- 	config->flag1 |= WMI_RSRC_CFG_FLAG1_BSS_CHANNEL_INFO_64;
- }
- 
-+void ath11k_hal_reo_hash_setup(struct ath11k_base *ab, u32 ring_hash_map)
-+{
-+	u32 reo_base = HAL_SEQ_WCSS_UMAC_REO_REG;
-+	u8 reo_dest_hash_shift = ab->hw_params.reo_dest_ring_map_shift;
-+
-+	ab->rx_hash = ring_hash_map;
-+
-+	/* These registers use only 24bits(3 bits x 8 hash values) for
-+	 * mapping the dest rings and remaining bits are reserved/not used
-+	 * so its safe to write them completely.
-+	 */
-+	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_2,
-+			   ring_hash_map << reo_dest_hash_shift);
-+	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_3,
-+			   ring_hash_map << reo_dest_hash_shift);
-+}
-+
- static void ath11k_hw_ipq8074_reo_setup(struct ath11k_base *ab)
- {
- 	u8 frag_dest_ring = HAL_SRNG_RING_ID_REO2SW1;
-@@ -143,18 +160,7 @@ static void ath11k_hw_ipq8074_reo_setup(
- 	if (ab->nss.enabled)
- 		return;
- 
--	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_0,
--			   FIELD_PREP(HAL_REO_DEST_RING_CTRL_HASH_RING_MAP,
--				      ring_hash_map));
--	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_1,
--			   FIELD_PREP(HAL_REO_DEST_RING_CTRL_HASH_RING_MAP,
--				      ring_hash_map));
--	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_2,
--			   FIELD_PREP(HAL_REO_DEST_RING_CTRL_HASH_RING_MAP,
--				      ring_hash_map));
--	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_3,
--			   FIELD_PREP(HAL_REO_DEST_RING_CTRL_HASH_RING_MAP,
--				      ring_hash_map));
-+	ath11k_hal_reo_hash_setup(ab, ring_hash_map);
- }
- 
- static void ath11k_init_wmi_config_ipq8074(struct ath11k_base *ab,
-@@ -925,10 +931,7 @@ static void ath11k_hw_wcn6855_reo_setup(
- 	if (ab->nss.enabled)
- 		return;
- 
--	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_2,
--			   ring_hash_map);
--	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_3,
--			   ring_hash_map);
-+	ath11k_hal_reo_hash_setup(ab, ring_hash_map);
- }
- 
- static void ath11k_hw_ipq5018_reo_setup(struct ath11k_base *ab)
-@@ -963,15 +966,7 @@ static void ath11k_hw_ipq5018_reo_setup(
- 			   HAL_DEFAULT_REO_TIMEOUT_USEC);
- 	ath11k_hif_write32(ab, reo_base + HAL_REO1_AGING_THRESH_IX_3(ab),
- 			   HAL_DEFAULT_REO_TIMEOUT_USEC);
--
--	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_0,
--			   ring_hash_map);
--	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_1,
--			   ring_hash_map);
--	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_2,
--			   ring_hash_map);
--	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_3,
--			   ring_hash_map);
-+	ath11k_hal_reo_hash_setup(ab, ring_hash_map);
- }
- 
- static u16
diff --git a/package/kernel/mac80211/patches/ath11k_nss/245-revert-dev-sw-netstats-txrx-add.patch b/package/kernel/mac80211/patches/ath11k_nss/245-revert-dev-sw-netstats-txrx-add.patch
deleted file mode 100644
index 6f7c1aadd95b64..00000000000000
--- a/package/kernel/mac80211/patches/ath11k_nss/245-revert-dev-sw-netstats-txrx-add.patch
+++ /dev/null
@@ -1,145 +0,0 @@
-From 3be7ae2d65b6638c4165d66c1c4b5d82d95517d9 Mon Sep 17 00:00:00 2001
-From: Tamizh Chelvam <tamizhr@codeaurora.org>
-Date: Wed, 10 Mar 2021 12:21:49 +0530
-Subject: [PATCH] Revert "net: mac80211: use core API for updating TX/RX stats"
-
-This reverts 36ec144f041bedc2f14b32faa2da11d4d9660003 commit
-in QSDK since 4.4 backports does not support netstats APIs
-for tx/rx stats and retaining the original logic for calculating
-tx/rx stats.
-
-Signed-off-by: Tamizh Chelvam <tamizhr@codeaurora.org>
----
- net/mac80211/rx.c | 18 ++++++++++++++----
- net/mac80211/tx.c | 16 +++++++++++++---
- 2 files changed, 27 insertions(+), 7 deletions(-)
-
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -33,6 +33,18 @@
- #include "wme.h"
- #include "rate.h"
- 
-+static inline void ieee80211_rx_stats(struct net_device *dev, u32 len)
-+{
-+	struct pcpu_sw_netstats *tstats = this_cpu_ptr(netdev_tstats(dev));
-+
-+	u64_stats_update_begin(&tstats->syncp);
-+#if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 1, 0))
-+	tstats->rx_packets++;
-+	tstats->rx_bytes += len;
-+#endif
-+	u64_stats_update_end(&tstats->syncp);
-+}
-+
- /*
-  * monitor mode reception
-  *
-@@ -50,7 +62,11 @@ static struct sk_buff *ieee80211_clean_s
- 
- 	if (present_fcs_len)
- 		__pskb_trim(skb, skb->len - present_fcs_len);
-+#if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 1, 0))
-+	__pskb_pull(skb, rtap_space);
-+#else
- 	pskb_pull(skb, rtap_space);
-+#endif
- 
- 	/* After pulling radiotap header, clear all flags that indicate
- 	 * info in skb->data.
-@@ -83,7 +99,11 @@ static struct sk_buff *ieee80211_clean_s
- 
- 	memmove(skb->data + IEEE80211_HT_CTL_LEN, skb->data,
- 		hdrlen - IEEE80211_HT_CTL_LEN);
-+#if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 1, 0))
-+	__pskb_pull(skb, IEEE80211_HT_CTL_LEN);
-+#else
- 	pskb_pull(skb, IEEE80211_HT_CTL_LEN);
-+#endif
- 
- 	return skb;
- }
-@@ -853,7 +873,7 @@ ieee80211_rx_monitor(struct ieee80211_lo
- 
- 			if (skb) {
- 				skb->dev = sdata->dev;
--				dev_sw_netstats_rx_add(skb->dev, skb->len);
-+				ieee80211_rx_stats(skb->dev, skb->len);
- 				netif_receive_skb(skb);
- 			}
- 		}
-@@ -2686,7 +2706,7 @@ ieee80211_deliver_skb(struct ieee80211_r
- 	skb = rx->skb;
- 	xmit_skb = NULL;
- 
--	dev_sw_netstats_rx_add(dev, skb->len);
-+	ieee80211_rx_stats(dev, skb->len);
- 
- 	if (rx->sta) {
- 		/* The seqno index has the same property as needed
-@@ -4098,7 +4118,7 @@ static void ieee80211_rx_cooked_monitor(
- 		}
- 
- 		prev_dev = sdata->dev;
--		dev_sw_netstats_rx_add(sdata->dev, skb->len);
-+		ieee80211_rx_stats(sdata->dev, skb->len);
- 	}
- 
- 	if (prev_dev) {
-@@ -4806,7 +4826,7 @@ static void ieee80211_rx_8023(struct iee
- 
- 	skb->dev = fast_rx->dev;
- 
--	dev_sw_netstats_rx_add(fast_rx->dev, skb->len);
-+	ieee80211_rx_stats(fast_rx->dev, skb->len);
- 
- 	/* The seqno index has the same property as needed
- 	 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -40,6 +40,18 @@
- static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
- 				struct net_device *dev, struct sta_info *sta,
- 				struct ieee80211_key *key, struct sk_buff *skb);
-+
-+static inline void ieee80211_tx_stats(struct net_device *dev, u32 len)
-+{
-+	struct pcpu_sw_netstats *tstats = this_cpu_ptr(netdev_tstats(dev));
-+
-+	u64_stats_update_begin(&tstats->syncp);
-+#if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 1, 0))
-+	tstats->tx_packets++;
-+	tstats->tx_bytes += len;
-+#endif
-+	u64_stats_update_end(&tstats->syncp);
-+}
- /* misc utils */
- 
- static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
-@@ -3557,7 +3569,7 @@ ieee80211_xmit_fast_finish(struct ieee80
- 	if (key)
- 		info->control.hw_key = &key->conf;
- 
--	dev_sw_netstats_tx_add(skb->dev, 1, skb->len);
-+	ieee80211_tx_stats(skb->dev, skb->len);
- 
- 	if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
- 		tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
-@@ -4346,7 +4358,7 @@ void __ieee80211_subif_start_xmit(struct
- 			goto out;
- 		}
- 
--		dev_sw_netstats_tx_add(dev, 1, skb->len);
-+		ieee80211_tx_stats(dev, skb->len);
- 
- 		ieee80211_xmit(sdata, sta, skb);
- 	}
-@@ -4717,7 +4729,7 @@ static void ieee80211_8023_xmit(struct i
- 		info->ack_frame_id = ieee80211_store_ack_skb(local, skb,
- 							     &info->flags, NULL);
- 
--	dev_sw_netstats_tx_add(dev, skbs, len);
-+	ieee80211_tx_stats(dev, len);
- 	if (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD)) {
- 		sta->deflink.tx_stats.packets[queue] += skbs;
- 		sta->deflink.tx_stats.bytes[queue] += len;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/359-ath11k-fix-tkip-encryption-traffic-failure.patch b/package/kernel/mac80211/patches/ath11k_nss/359-ath11k-fix-tkip-encryption-traffic-failure.patch
deleted file mode 100644
index d8c907556645cf..00000000000000
--- a/package/kernel/mac80211/patches/ath11k_nss/359-ath11k-fix-tkip-encryption-traffic-failure.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From e4f2f898dcbe2bf82b9e8fb4f3d306c98d82e5bd Mon Sep 17 00:00:00 2001
-From: Ramya Gnanasekar <quic_rgnanase@quicinc.com>
-Date: Wed, 7 Dec 2022 17:29:50 +0530
-Subject: [PATCH] ath11k: fix tkip encryption traffic failure
-
-Fast rx is not assigned in case of TKIP cipher and hence
-packets are dropped in fast path.
-
-Handle the rx decap for TKIP so frames will be handled in
-normal rx path.
-
-Signed-off-by: Ramya Gnanasekar <quic_rgnanase@quicinc.com>
-
---- a/drivers/net/wireless/ath/ath11k/dp_rx.c
-+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -2364,7 +2364,8 @@ static void ath11k_dp_rx_h_undecap(struc
- 		ehdr = (struct ethhdr *)msdu->data;
- 
- 		/* mac80211 allows fast path only for authorized STA */
--		if (ehdr->h_proto == cpu_to_be16(ETH_P_PAE)) {
-+		if (ehdr->h_proto == cpu_to_be16(ETH_P_PAE) ||
-+		    enctype == HAL_ENCRYPT_TYPE_TKIP_MIC) {
- 			ATH11K_SKB_RXCB(msdu)->is_eapol = true;
- 			ath11k_dp_rx_h_undecap_eth(ar, msdu, first_hdr,
- 						   enctype, status);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/640-006-mac80211-add-eht-radiotap.patch b/package/kernel/mac80211/patches/ath11k_nss/640-006-mac80211-add-eht-radiotap.patch
deleted file mode 100644
index 79146df5447b8b..00000000000000
--- a/package/kernel/mac80211/patches/ath11k_nss/640-006-mac80211-add-eht-radiotap.patch
+++ /dev/null
@@ -1,506 +0,0 @@
-From f76abd98383dbd350f4e41b400beaaff2130254a Mon Sep 17 00:00:00 2001
-From: P Praneesh <quic_ppranees@quicinc.com>
-Date: Sun, 3 Jul 2022 19:31:44 +0530
-Subject: [PATCH] mac80211: add EHT radiotap header construction logic
-
-Driver advertises U_SIG and EHT info in the flag under rx_status
-structure. Based on this flag, corresponding EHT and U_SIG
-information are added in the radiotap header.
-
-Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
----
- include/net/ieee80211_radiotap.h | 160 +++++++++++++++++++++++++++++++++++++++
- include/net/mac80211.h           |   9 +++
- net/mac80211/rx.c                |  88 +++++++++++++++++++++
- 3 files changed, 257 insertions(+)
-
---- a/include/net/ieee80211_radiotap.h
-+++ b/include/net/ieee80211_radiotap.h
-@@ -92,6 +92,11 @@ enum ieee80211_radiotap_presence {
- 	IEEE80211_RADIOTAP_EHT = 34,
- };
- 
-+enum ieee80211_radiotap_presence_ext {
-+	IEEE80211_RADIOTAP_USIG_INFO	= 1,
-+	IEEE80211_RADIOTAP_EHT_INFO	= 2,
-+};
-+
- /* for IEEE80211_RADIOTAP_FLAGS */
- enum ieee80211_radiotap_flags {
- 	IEEE80211_RADIOTAP_F_CFP = 0x01,
-@@ -406,128 +411,6 @@ struct ieee80211_radiotap_eht_usig {
- 	__le32 mask;
- } __packed;
- 
--/* ieee80211_radiotap_eht - content of EHT tlv (type 34)
-- * see www.radiotap.org/fields/EHT.html for details
-- */
--struct ieee80211_radiotap_eht {
--	__le32 known;
--	__le32 data[9];
--	__le32 user_info[];
--} __packed;
--
--/* Known field for EHT TLV
-- * The ending defines for what the field applies as following
-- * O - OFDMA (including TB), M - MU-MIMO, S - EHT sounding.
-- */
--enum ieee80211_radiotap_eht_known {
--	IEEE80211_RADIOTAP_EHT_KNOWN_SPATIAL_REUSE		= 0x00000002,
--	IEEE80211_RADIOTAP_EHT_KNOWN_GI				= 0x00000004,
--	IEEE80211_RADIOTAP_EHT_KNOWN_EHT_LTF			= 0x00000010,
--	IEEE80211_RADIOTAP_EHT_KNOWN_LDPC_EXTRA_SYM_OM		= 0x00000020,
--	IEEE80211_RADIOTAP_EHT_KNOWN_PRE_PADD_FACOR_OM		= 0x00000040,
--	IEEE80211_RADIOTAP_EHT_KNOWN_PE_DISAMBIGUITY_OM		= 0x00000080,
--	IEEE80211_RADIOTAP_EHT_KNOWN_DISREGARD_O		= 0x00000100,
--	IEEE80211_RADIOTAP_EHT_KNOWN_DISREGARD_S		= 0x00000200,
--	IEEE80211_RADIOTAP_EHT_KNOWN_CRC1			= 0x00002000,
--	IEEE80211_RADIOTAP_EHT_KNOWN_TAIL1			= 0x00004000,
--	IEEE80211_RADIOTAP_EHT_KNOWN_CRC2_O			= 0x00008000,
--	IEEE80211_RADIOTAP_EHT_KNOWN_TAIL2_O			= 0x00010000,
--	IEEE80211_RADIOTAP_EHT_KNOWN_NSS_S			= 0x00020000,
--	IEEE80211_RADIOTAP_EHT_KNOWN_BEAMFORMED_S		= 0x00040000,
--	IEEE80211_RADIOTAP_EHT_KNOWN_NR_NON_OFDMA_USERS_M	= 0x00080000,
--	IEEE80211_RADIOTAP_EHT_KNOWN_ENCODING_BLOCK_CRC_M	= 0x00100000,
--	IEEE80211_RADIOTAP_EHT_KNOWN_ENCODING_BLOCK_TAIL_M	= 0x00200000,
--	IEEE80211_RADIOTAP_EHT_KNOWN_RU_MRU_SIZE_OM		= 0x00400000,
--	IEEE80211_RADIOTAP_EHT_KNOWN_RU_MRU_INDEX_OM		= 0x00800000,
--	IEEE80211_RADIOTAP_EHT_KNOWN_RU_ALLOC_TB_FMT		= 0x01000000,
--	IEEE80211_RADIOTAP_EHT_KNOWN_PRIMARY_80			= 0x02000000,
--};
--
--enum ieee80211_radiotap_eht_data {
--	/* Data 0 */
--	IEEE80211_RADIOTAP_EHT_DATA0_SPATIAL_REUSE		= 0x00000078,
--	IEEE80211_RADIOTAP_EHT_DATA0_GI				= 0x00000180,
--	IEEE80211_RADIOTAP_EHT_DATA0_LTF			= 0x00000600,
--	IEEE80211_RADIOTAP_EHT_DATA0_EHT_LTF			= 0x00003800,
--	IEEE80211_RADIOTAP_EHT_DATA0_LDPC_EXTRA_SYM_OM		= 0x00004000,
--	IEEE80211_RADIOTAP_EHT_DATA0_PRE_PADD_FACOR_OM		= 0x00018000,
--	IEEE80211_RADIOTAP_EHT_DATA0_PE_DISAMBIGUITY_OM		= 0x00020000,
--	IEEE80211_RADIOTAP_EHT_DATA0_DISREGARD_S		= 0x000c0000,
--	IEEE80211_RADIOTAP_EHT_DATA0_DISREGARD_O		= 0x003c0000,
--	IEEE80211_RADIOTAP_EHT_DATA0_CRC1_O			= 0x03c00000,
--	IEEE80211_RADIOTAP_EHT_DATA0_TAIL1_O			= 0xfc000000,
--	/* Data 1 */
--	IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE			= 0x0000001f,
--	IEEE80211_RADIOTAP_EHT_DATA1_RU_INDEX			= 0x00001fe0,
--	IEEE80211_RADIOTAP_EHT_DATA1_RU_ALLOC_CC_1_1_1		= 0x003fe000,
--	IEEE80211_RADIOTAP_EHT_DATA1_RU_ALLOC_CC_1_1_1_KNOWN	= 0x00400000,
--	IEEE80211_RADIOTAP_EHT_DATA1_PRIMARY_80			= 0xc0000000,
--	/* Data 2 */
--	IEEE80211_RADIOTAP_EHT_DATA2_RU_ALLOC_CC_2_1_1		= 0x000001ff,
--	IEEE80211_RADIOTAP_EHT_DATA2_RU_ALLOC_CC_2_1_1_KNOWN	= 0x00000200,
--	IEEE80211_RADIOTAP_EHT_DATA2_RU_ALLOC_CC_1_1_2		= 0x0007fc00,
--	IEEE80211_RADIOTAP_EHT_DATA2_RU_ALLOC_CC_1_1_2_KNOWN	= 0x00080000,
--	IEEE80211_RADIOTAP_EHT_DATA2_RU_ALLOC_CC_2_1_2		= 0x1ff00000,
--	IEEE80211_RADIOTAP_EHT_DATA2_RU_ALLOC_CC_2_1_2_KNOWN	= 0x20000000,
--	/* Data 3 */
--	IEEE80211_RADIOTAP_EHT_DATA3_RU_ALLOC_CC_1_2_1		= 0x000001ff,
--	IEEE80211_RADIOTAP_EHT_DATA3_RU_ALLOC_CC_1_2_1_KNOWN	= 0x00000200,
--	IEEE80211_RADIOTAP_EHT_DATA3_RU_ALLOC_CC_2_2_1		= 0x0007fc00,
--	IEEE80211_RADIOTAP_EHT_DATA3_RU_ALLOC_CC_2_2_1_KNOWN	= 0x00080000,
--	IEEE80211_RADIOTAP_EHT_DATA3_RU_ALLOC_CC_1_2_2		= 0x1ff00000,
--	IEEE80211_RADIOTAP_EHT_DATA3_RU_ALLOC_CC_1_2_2_KNOWN	= 0x20000000,
--	/* Data 4 */
--	IEEE80211_RADIOTAP_EHT_DATA4_RU_ALLOC_CC_2_2_2		= 0x000001ff,
--	IEEE80211_RADIOTAP_EHT_DATA4_RU_ALLOC_CC_2_2_2_KNOWN	= 0x00000200,
--	IEEE80211_RADIOTAP_EHT_DATA4_RU_ALLOC_CC_1_2_3		= 0x0007fc00,
--	IEEE80211_RADIOTAP_EHT_DATA4_RU_ALLOC_CC_1_2_3_KNOWN	= 0x00080000,
--	IEEE80211_RADIOTAP_EHT_DATA4_RU_ALLOC_CC_2_2_3		= 0x1ff00000,
--	IEEE80211_RADIOTAP_EHT_DATA4_RU_ALLOC_CC_2_2_3_KNOWN	= 0x20000000,
--	/* Data 5 */
--	IEEE80211_RADIOTAP_EHT_DATA5_RU_ALLOC_CC_1_2_4		= 0x000001ff,
--	IEEE80211_RADIOTAP_EHT_DATA5_RU_ALLOC_CC_1_2_4_KNOWN	= 0x00000200,
--	IEEE80211_RADIOTAP_EHT_DATA5_RU_ALLOC_CC_2_2_4		= 0x0007fc00,
--	IEEE80211_RADIOTAP_EHT_DATA5_RU_ALLOC_CC_2_2_4_KNOWN	= 0x00080000,
--	IEEE80211_RADIOTAP_EHT_DATA5_RU_ALLOC_CC_1_2_5		= 0x1ff00000,
--	IEEE80211_RADIOTAP_EHT_DATA5_RU_ALLOC_CC_1_2_5_KNOWN	= 0x20000000,
--	/* Data 6 */
--	IEEE80211_RADIOTAP_EHT_DATA6_RU_ALLOC_CC_2_2_5		= 0x000001ff,
--	IEEE80211_RADIOTAP_EHT_DATA6_RU_ALLOC_CC_2_2_5_KNOWN	= 0x00000200,
--	IEEE80211_RADIOTAP_EHT_DATA6_RU_ALLOC_CC_1_2_6		= 0x0007fc00,
--	IEEE80211_RADIOTAP_EHT_DATA6_RU_ALLOC_CC_1_2_6_KNOWN	= 0x00080000,
--	IEEE80211_RADIOTAP_EHT_DATA6_RU_ALLOC_CC_2_2_6		= 0x1ff00000,
--	IEEE80211_RADIOTAP_EHT_DATA6_RU_ALLOC_CC_2_2_6_KNOWN	= 0x20000000,
--	/* Data 7 */
--	IEEE80211_RADIOTAP_EHT_DATA7_CRC2_O			= 0x0000000f,
--	IEEE80211_RADIOTAP_EHT_DATA7_TAIL_2_O			= 0x000003f0,
--	IEEE80211_RADIOTAP_EHT_DATA7_NSS_S			= 0x0000f000,
--	IEEE80211_RADIOTAP_EHT_DATA7_BEAMFORMED_S		= 0x00010000,
--	IEEE80211_RADIOTAP_EHT_DATA7_NUM_OF_NON_OFDMA_USERS	= 0x000e0000,
--	IEEE80211_RADIOTAP_EHT_DATA7_USER_ENCODING_BLOCK_CRC	= 0x00f00000,
--	IEEE80211_RADIOTAP_EHT_DATA7_USER_ENCODING_BLOCK_TAIL	= 0x3f000000,
--	/* Data 8 */
--	IEEE80211_RADIOTAP_EHT_DATA8_RU_ALLOC_TB_FMT_PS_160	= 0x00000001,
--	IEEE80211_RADIOTAP_EHT_DATA8_RU_ALLOC_TB_FMT_B0		= 0x00000002,
--	IEEE80211_RADIOTAP_EHT_DATA8_RU_ALLOC_TB_FMT_B7_B1	= 0x000001fc,
--};
--
--enum ieee80211_radiotap_eht_user_info {
--	IEEE80211_RADIOTAP_EHT_USER_INFO_STA_ID_KNOWN		= 0x00000001,
--	IEEE80211_RADIOTAP_EHT_USER_INFO_MCS_KNOWN		= 0x00000002,
--	IEEE80211_RADIOTAP_EHT_USER_INFO_CODING_KNOWN		= 0x00000004,
--	IEEE80211_RADIOTAP_EHT_USER_INFO_NSS_KNOWN_O		= 0x00000010,
--	IEEE80211_RADIOTAP_EHT_USER_INFO_BEAMFORMING_KNOWN_O	= 0x00000020,
--	IEEE80211_RADIOTAP_EHT_USER_INFO_SPATIAL_CONFIG_KNOWN_M	= 0x00000040,
--	IEEE80211_RADIOTAP_EHT_USER_INFO_DATA_FOR_USER		= 0x00000080,
--	IEEE80211_RADIOTAP_EHT_USER_INFO_STA_ID			= 0x0007ff00,
--	IEEE80211_RADIOTAP_EHT_USER_INFO_CODING			= 0x00080000,
--	IEEE80211_RADIOTAP_EHT_USER_INFO_MCS			= 0x00f00000,
--	IEEE80211_RADIOTAP_EHT_USER_INFO_NSS_O			= 0x0f000000,
--	IEEE80211_RADIOTAP_EHT_USER_INFO_BEAMFORMING_O		= 0x20000000,
--	IEEE80211_RADIOTAP_EHT_USER_INFO_SPATIAL_CONFIG_M	= 0x3f000000,
--	IEEE80211_RADIOTAP_EHT_USER_INFO_RESEVED_c0000000	= 0xc0000000,
--};
--
- enum ieee80211_radiotap_eht_usig_common {
- 	IEEE80211_RADIOTAP_EHT_USIG_COMMON_PHY_VER_KNOWN	= 0x00000001,
- 	IEEE80211_RADIOTAP_EHT_USIG_COMMON_BW_KNOWN		= 0x00000002,
-@@ -573,6 +456,161 @@ enum ieee80211_radiotap_eht_usig_tb {
- 	IEEE80211_RADIOTAP_EHT_USIG2_TB_B20_B25_TAIL		= 0xfc000000,
- };
- 
-+enum ieee80211_radiotap_usig_common {
-+	IEEE80211_RADIOTAP_USIG_CMN_PHY_VERSION			= 0x00000001,
-+	IEEE80211_RADIOTAP_USIG_CMN_BW_KNOWN			= 0x00000002,
-+	IEEE80211_RADIOTAP_USIG_CMN_UL_DL_KNOWN			= 0x00000004,
-+	IEEE80211_RADIOTAP_USIG_CMN_BSS_COLOR_KNOWN		= 0x00000008,
-+	IEEE80211_RADIOTAP_USIG_CMN_TXOP_KNOWN			= 0x00000010,
-+	IEEE80211_RADIOTAP_USIG_CMN_BAD_CRC			= 0x00000020,
-+	IEEE80211_RADIOTAP_USIG_CMN_PHY_VERSION_ID		= 0x00007000,
-+	IEEE80211_RADIOTAP_USIG_CMN_BW				= 0x00038000,
-+	IEEE80211_RADIOTAP_USIG_CMN_UL_DL			= 0x00040000,
-+	IEEE80211_RADIOTAP_USIG_CMN_BSS_COLOR			= 0x01f80000,
-+	IEEE80211_RADIOTAP_USIG_CMN_TXOP			= 0xfe000000,
-+};
-+
-+enum ieee80211_radiotap_usig_eht_mu_ppdu {
-+	IEEE80211_RADIOTAP_USIG_EHT_MU_DISREGARD		= 0x0000001f,
-+	IEEE80211_RADIOTAP_USIG_EHT_MU_DISREGARD_VALIDATE	= 0x00000020,
-+	IEEE80211_RADIOTAP_USIG_EHT_MU_PPDU_TYPE_COMP_MODE	= 0x000000c0,
-+	IEEE80211_RADIOTAP_USIG_EHT_MU_PPDU_COMP_VALIDATE	= 0x00000100,
-+	IEEE80211_RADIOTAP_USIG_EHT_MU_PUNCTURED_CHAN_INFO	= 0x00003e00,
-+	IEEE80211_RADIOTAP_USIG_EHT_MU_PUNCTURED_CHAN_VALIDATE	= 0x00004000,
-+	IEEE80211_RADIOTAP_USIG_EHT_MU_MCS			= 0x00018000,
-+	IEEE80211_RADIOTAP_USIG_EHT_MU_NUM_SYMBOLS		= 0x003e0000,
-+	IEEE80211_RADIOTAP_USIG_EHT_MU_CRC			= 0x03c00000,
-+	IEEE80211_RADIOTAP_USIG_EHT_MU_TAIL			= 0xfc000000,
-+};
-+
-+enum ieee80211_radiotap_usig_eht_tb_ppdu {
-+	IEEE80211_RADIOTAP_USIG_EHT_TB_DISREGARD		= 0x0000003f,
-+	IEEE80211_RADIOTAP_USIG_EHT_TB_PPDU_TYPE_COMP_MODE	= 0x000000c0,
-+	IEEE80211_RADIOTAP_USIG_EHT_TB_VALIDATE			= 0x00000100,
-+	IEEE80211_RADIOTAP_USIG_EHT_TB_SPATIAL_REUSE1		= 0x00001e00,
-+	IEEE80211_RADIOTAP_USIG_EHT_TB_SPATIAL_REUSE2		= 0x0001e000,
-+	IEEE80211_RADIOTAP_USIG_EHT_TB_DISREGARD1		= 0x003e0000,
-+	IEEE80211_RADIOTAP_USIG_EHT_TB_CRC			= 0x03c00000,
-+	IEEE80211_RADIOTAP_USIG_EHT_TB_TAIL			= 0xfc000000,
-+};
-+
-+struct ieee80211_radiotap_usig {
-+	__le32 usig_cmn;
-+	__le32 eht_mu_ppdu;
-+	__le32 eht_tb_ppdu;
-+};
-+
-+enum ieee80211_radiotap_eht_known {
-+	IEEE80211_RADIOTAP_EHT_SPATIAL_REUSE_KNOWN	= 0x00000002,
-+	IEEE80211_RADIOTAP_EHT_GUARD_INTERVAL_KNOWN	= 0x00000004,
-+	IEEE80211_RADIOTAP_EHT_LTF_KNOWN		= 0x00000008,
-+	IEEE80211_RADIOTAP_EHT_EHT_LTF_KNOWN		= 0x00000010,
-+	IEEE80211_RADIOTAP_EHT_LDPC_EXTRA_SYM_SEG_KNOWN	= 0x00000020,
-+	IEEE80211_RADIOTAP_EHT_PRE_FEC_PAD_FACTOR_KNOWN	= 0x00000040,
-+	IEEE80211_RADIOTAP_EHT_PE_DISAMBIGUITY_KNOWN	= 0x00000080,
-+	IEEE80211_RADIOTAP_EHT_DISREGARD_KNOWN		= 0x00000100,
-+	IEEE80211_RADIOTAP_EHT_SOUNDING_DISREGARD_KNOWN	= 0x00000200,
-+	IEEE80211_RADIOTAP_EHT_CRC1_KNOWN		= 0x00002000,
-+	IEEE80211_RADIOTAP_EHT_TAIL1_KNOWN		= 0x00004000,
-+	IEEE80211_RADIOTAP_EHT_CRC2_KNOWN		= 0x00008000,
-+	IEEE80211_RADIOTAP_EHT_TAIL2_KNOWN		= 0x00010000,
-+	IEEE80211_RADIOTAP_EHT_NSS_KNOWN		= 0x00020000,
-+	IEEE80211_RADIOTAP_EHT_BEAMFORMED_KNOWN		= 0x00040000,
-+	IEEE80211_RADIOTAP_EHT_NUM_NON_OFDMA_USR_KNOWN	= 0x00080000,
-+	IEEE80211_RADIOTAP_EHT_USR_ENC_BLK_CRC_KNOWN	= 0x00100000,
-+	IEEE80211_RADIOTAP_EHT_USR_ENC_BLK_TAIL_KNOWN	= 0x00200000,
-+	IEEE80211_RADIOTAP_EHT_RU_SIZE_KNOWN		= 0x00400000,
-+	IEEE80211_RADIOTAP_EHT_RU_INDEX_KNOWN		= 0x00800000,
-+	IEEE80211_RADIOTAP_EHT_RU_ALLOCATION		= 0x01000000,
-+	IEEE80211_RADIOTAP_EHT_PRI80_CHAN_POS_KNOWN	= 0x02000000,
-+};
-+
-+enum ieee80211_radiotap_eht_data0 {
-+	IEEE80211_RADIOTAP_EHT_DATA0_SPATIAL_REUSE		= 0x00000078,
-+	IEEE80211_RADIOTAP_EHT_DATA0_GI				= 0x00000180,
-+	IEEE80211_RADIOTAP_EHT_DATA0_LTF			= 0x00000600,
-+	IEEE80211_RADIOTAP_EHT_DATA0_EHT_LTF			= 0x00003800,
-+	IEEE80211_RADIOTAP_EHT_DATA0_LDPC_EXTRA_SYM_SEG		= 0x00004000,
-+	IEEE80211_RADIOTAP_EHT_DATA0_PRE_FEC_PAD_FACTOR		= 0x00018000,
-+	IEEE80211_RADIOTAP_EHT_DATA0_PE_DISAMBIGUITY		= 0x00020000,
-+	IEEE80211_RADIOTAP_EHT_DATA0_DISREGARD_EHT_SOUND	= 0x000c0000,
-+	IEEE80211_RADIOTAP_EHT_DATA0_DISREGARD_NON_EHT_SOUND	= 0x003c0000,
-+	IEEE80211_RADIOTAP_EHT_DATA0_CRC1			= 0x03c00000,
-+	IEEE80211_RADIOTAP_EHT_DATA0_TAIL1			= 0xfc000000,
-+};
-+
-+enum ieee80211_radiotap_eht_data1 {
-+	IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE			= 0x0000001f,
-+		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_26			= 0,
-+		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_52			= 1,
-+		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_106		= 2,
-+		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_242		= 3,
-+		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_484		= 4,
-+		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_996		= 5,
-+		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_2x996		= 6,
-+		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_4x996		= 7,
-+		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_52P26		= 8,
-+		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_106P26		= 9,
-+		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_484P242		= 10,
-+		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_996P484		= 11,
-+		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_996P484P242	= 12,
-+		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_2x996P484		= 13,
-+		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_3x996		= 14,
-+		IEEE80211_RADIOTAP_EHT_DATA1_RU_SIZE_3x996P484		= 15,
-+
-+	IEEE80211_RADIOTAP_EHT_DATA1_RU_INDEX			= 0x00001fe0,
-+	IEEE80211_RADIOTAP_EHT_DATA1_RU_ALLOCATION1		= 0x003fe000,
-+	IEEE80211_RADIOTAP_EHT_DATA1_RU_PRIMARY_80MHZ_CHAN_POS	= 0xc0000000,
-+};
-+
-+enum ieee80211_radiotap_eht_data2_to_data6 {
-+	IEEE80211_RADIOTAP_EHT_DATA2_6_RU_ALLOCATION_X		= 0x000001ff,
-+	IEEE80211_RADIOTAP_EHT_DATA2_6_RU_ALLOCATION_X_KNOWN	= 0x00000200,
-+	IEEE80211_RADIOTAP_EHT_DATA2_6_RU_ALLOCATION_XP1	= 0x0007fc00,
-+	IEEE80211_RADIOTAP_EHT_DATA2_6_RU_ALLOCATION_XP1_KNOWN	= 0x00080000,
-+	IEEE80211_RADIOTAP_EHT_DATA2_6_RU_ALLOCATION_XP2	= 0x1ff00000,
-+	IEEE80211_RADIOTAP_EHT_DATA2_6_RU_ALLOCATION_XP2_KNOWN	= 0x20000000,
-+};
-+
-+enum ieee80211_radiotap_eht_data7 {
-+	IEEE80211_RADIOTAP_EHT_DATA7_CRC2			= 0x0000000f,
-+	IEEE80211_RADIOTAP_EHT_DATA7_TAIL2			= 0x000003f0,
-+	IEEE80211_RADIOTAP_EHT_DATA7_NSS			= 0x0000f000,
-+	IEEE80211_RADIOTAP_EHT_DATA7_BEAMFORMED			= 0x00010000,
-+	IEEE80211_RADIOTAP_EHT_DATA7_NUM_NON_OFDMA_USERS	= 0x000e0000,
-+	IEEE80211_RADIOTAP_EHT_DATA7_USR_ENC_BLK_CRC		= 0x00f00000,
-+	IEEE80211_RADIOTAP_EHT_DATA7_USR_ENC_BLK_TAIL		= 0x3f000000,
-+};
-+
-+enum ieee80211_radiotap_eht_data8 {
-+	IEEE80211_RADIOTAP_EHT_DATA8_RU_ALLOCATION_PS160	= 0x00000001,
-+	IEEE80211_RADIOTAP_EHT_DATA8_RU_ALLOCATION_TB_FORMAT1	= 0x00000002,
-+	IEEE80211_RADIOTAP_EHT_DATA8_RU_ALLOCATION_TB_FORMAT2	= 0x000001fc,
-+};
-+
-+enum ieee80211_radiotap_eht_user_info {
-+	IEEE80211_RADIOTAP_EHT_USER_INFO_STA_ID_KNOWN		= 0x00000001,
-+	IEEE80211_RADIOTAP_EHT_USER_INFO_MCS_KNOWN		= 0x00000002,
-+	IEEE80211_RADIOTAP_EHT_USER_INFO_CODING_KNOWN		= 0x00000004,
-+	IEEE80211_RADIOTAP_EHT_USER_INFO_RSVD_KNOWN		= 0x00000008,
-+	IEEE80211_RADIOTAP_EHT_USER_INFO_NSS_KNOWN		= 0x00000010,
-+	IEEE80211_RADIOTAP_EHT_USER_INFO_BEAMFORMING_KNOWN	= 0x00000020,
-+	IEEE80211_RADIOTAP_EHT_USER_INFO_SPATIAL_CONFIG_KNOWN	= 0x00000040,
-+	IEEE80211_RADIOTAP_EHT_USER_INFO_DATA_CAPTURE		= 0x00000080,
-+	IEEE80211_RADIOTAP_EHT_USER_INFO_STA_ID			= 0x0007ff00,
-+	IEEE80211_RADIOTAP_EHT_USER_INFO_CODING			= 0x00080000,
-+	IEEE80211_RADIOTAP_EHT_USER_INFO_MCS			= 0x00f00000,
-+	IEEE80211_RADIOTAP_EHT_USER_INFO_NSS			= 0x0f000000,
-+	IEEE80211_RADIOTAP_EHT_USER_INFO_BEAMFORMING		= 0x20000000,
-+	IEEE80211_RADIOTAP_EHT_USER_INFO_SPATIAL_CONFIG		= 0x3f000000,
-+};
-+
-+struct ieee80211_radiotap_eht {
-+	__le32 known;
-+	__le32 data[9];
-+	__le32 user_info[];
-+};
-+
- /**
-  * ieee80211_get_radiotap_len - get radiotap header length
-  */
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -1441,7 +1441,11 @@ ieee80211_tx_info_clear_status(struct ie
-  *	known the frame shouldn't be reported.
-  * @RX_FLAG_8023: the frame has an 802.3 header (decap offload performed by
-  *	hardware or driver)
-+ * @RX_FLAG_USIG_HEADER: Universal field carries information necessary to
-+ *	interpret EHT PPDUs.
-+ * @RX_FLAG_EHT_HEADER: EHT radiotap data is present.
-  */
-+
- enum mac80211_rx_flags {
- 	RX_FLAG_MMIC_ERROR		= BIT(0),
- 	RX_FLAG_DECRYPTED		= BIT(1),
-@@ -1473,6 +1477,8 @@ enum mac80211_rx_flags {
- 	RX_FLAG_RADIOTAP_LSIG           = BIT(27),
- 	RX_FLAG_NO_PSDU                 = BIT(28),
- 	RX_FLAG_8023                    = BIT(29),
-+	RX_FLAG_USIG_HEADER             = BIT(30),
-+	RX_FLAG_EHT_HEADER              = BIT(31),
- };
- 
- /**
-@@ -1540,6 +1546,7 @@ enum mac80211_rx_encoding {
-  *	HT or VHT is used (%RX_FLAG_HT/%RX_FLAG_VHT)
-  * @nss: number of streams (VHT, HE and EHT only)
-  * @flag: %RX_FLAG_\*
-+ * @ext_flag: %RX_FLAG_\*
-  * @encoding: &enum mac80211_rx_encoding
-  * @bw: &enum rate_info_bw
-  * @enc_flags: uses bits from &enum mac80211_rx_encoding_flags
-@@ -1593,6 +1600,7 @@ struct ieee80211_rx_status {
- 	u8 ampdu_delimiter_crc;
- 	u8 zero_length_psdu_type;
- 	u8 link_valid:1, link_id:4;
-+	u8 eht_num_user;
- };
- 
- static inline u32
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -143,6 +143,12 @@ ieee80211_rx_radiotap_hdrlen(struct ieee
- 	/* always present fields */
- 	len = sizeof(struct ieee80211_radiotap_header) + 8;
- 
-+	/* EHT present fields */
-+	if ((status->flag & RX_FLAG_EHT_HEADER) ||
-+	    (status->flag & RX_FLAG_USIG_HEADER)) {
-+		len += 4;
-+	}
-+
- 	/* allocate extra bitmaps */
- 	if (status->chains)
- 		len += 4 * hweight8(status->chains);
-@@ -202,6 +208,20 @@ ieee80211_rx_radiotap_hdrlen(struct ieee
- 		BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_lsig) != 4);
- 	}
- 
-+	if (status->flag & RX_FLAG_USIG_HEADER &&
-+	    status->encoding == RX_ENC_EHT) {
-+		len = ALIGN(len, 4);
-+		len += 12;
-+		BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_usig) != 12);
-+	}
-+
-+	if (status->flag & RX_FLAG_EHT_HEADER &&
-+	    status->encoding == RX_ENC_EHT) {
-+		len = ALIGN(len, 4);
-+		len += 40;
-+		len += status->eht_num_user * 4;
-+	}
-+
- 	if (status->chains) {
- 		/* antenna and antenna signal fields */
- 		len += 2 * hweight8(status->chains);
-@@ -223,6 +243,15 @@ ieee80211_rx_radiotap_hdrlen(struct ieee
- 		if (status->flag & RX_FLAG_RADIOTAP_LSIG)
- 			tlv_offset +=
- 				sizeof(struct ieee80211_radiotap_lsig);
-+		if (status->flag & RX_FLAG_USIG_HEADER)
-+			tlv_offset +=
-+				sizeof(struct ieee80211_radiotap_usig);
-+		if (status->flag & RX_FLAG_EHT_HEADER) {
-+			tlv_offset +=
-+				sizeof(struct ieee80211_radiotap_eht);
-+			tlv_offset +=
-+				status->eht_num_user * sizeof(u32);
-+		}
- 
- 		/* ensure 4 byte alignment for TLV */
- 		len = ALIGN(len, 4);
-@@ -330,6 +359,14 @@ ieee80211_add_rx_radiotap_header(struct
- 	struct ieee80211_radiotap_he he = {};
- 	struct ieee80211_radiotap_he_mu he_mu = {};
- 	struct ieee80211_radiotap_lsig lsig = {};
-+	struct ieee80211_radiotap_usig usig = {};
-+	struct ieee80211_radiotap_eht eht = {};
-+	u32 *user_info;
-+	bool rhdr_ext = false;
-+
-+	if ((status->flag & RX_FLAG_USIG_HEADER) ||
-+	    (status->flag & RX_FLAG_EHT_HEADER))
-+		rhdr_ext = true;
- 
- 	if (status->flag & RX_FLAG_RADIOTAP_HE) {
- 		he = *(struct ieee80211_radiotap_he *)skb->data;
-@@ -352,6 +389,20 @@ ieee80211_add_rx_radiotap_header(struct
- 		tlvs_len = skb_mac_header(skb) - skb->data;
- 	}
- 
-+	if (status->flag & RX_FLAG_USIG_HEADER) {
-+		usig = *(struct ieee80211_radiotap_usig *)skb->data;
-+		skb_pull(skb, sizeof(usig));
-+		WARN_ON_ONCE(status->encoding != RX_ENC_EHT);
-+	}
-+
-+	if (status->flag & RX_FLAG_EHT_HEADER) {
-+		eht = *(struct ieee80211_radiotap_eht *)skb->data;
-+		skb_pull(skb, sizeof(eht));
-+		user_info = (u32 *)skb->data;
-+		skb_pull(skb, status->eht_num_user * sizeof(u32));
-+		WARN_ON_ONCE(status->encoding != RX_ENC_EHT);
-+	}
-+
- 	mpdulen = skb->len;
- 	if (!(has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)))
- 		mpdulen += FCS_LEN;
-@@ -382,6 +433,19 @@ ieee80211_add_rx_radiotap_header(struct
- 	if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END)
- 		it_present_val |= BIT(IEEE80211_RADIOTAP_TLV);
- 
-+	if (rhdr_ext) {
-+		it_present_val |= BIT(IEEE80211_RADIOTAP_EXT);
-+		put_unaligned_le32(it_present_val, it_present);
-+		it_present_val = 0;
-+		it_present++;
-+		/* IEEE80211_RADIOTAP_USIG */
-+		if (status->flag & RX_FLAG_USIG_HEADER)
-+			it_present_val |= BIT(IEEE80211_RADIOTAP_USIG_INFO);
-+		/* IEEE80211_RADIOTAP_EHT */
-+		if (status->flag & RX_FLAG_EHT_HEADER)
-+			it_present_val |= BIT(IEEE80211_RADIOTAP_EHT_INFO);
-+	}
-+
- 	put_unaligned_le32(it_present_val, it_present);
- 
- 	/* This references through an offset into it_optional[] rather
-@@ -706,6 +770,22 @@ ieee80211_add_rx_radiotap_header(struct
- 		*pos++ = status->chain_signal[chain];
- 		*pos++ = chain;
- 	}
-+
-+	if (status->flag & RX_FLAG_USIG_HEADER) {
-+		while ((pos - (u8 *)rthdr) & 1)
-+			pos++;
-+		memcpy(pos, &usig, sizeof(usig));
-+		pos += sizeof(usig);
-+	}
-+
-+	if (status->flag & RX_FLAG_EHT_HEADER) {
-+		while ((pos - (u8 *)rthdr) & 1)
-+			pos++;
-+		memcpy(pos, &eht, sizeof(eht));
-+		pos += sizeof(eht);
-+		memcpy(pos, user_info, (status->eht_num_user * sizeof(u32)));
-+		pos += status->eht_num_user * sizeof(u32);
-+	}
- }
- 
- static struct sk_buff *
-@@ -800,6 +880,14 @@ ieee80211_rx_monitor(struct ieee80211_lo
- 	if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END)
- 		rtap_space += skb_mac_header(origskb) - &origskb->data[rtap_space];
- 
-+	if (status->flag & RX_FLAG_USIG_HEADER)
-+		rtap_space += sizeof(struct ieee80211_radiotap_usig);
-+
-+	if (status->flag & RX_FLAG_EHT_HEADER) {
-+		rtap_space += sizeof(struct ieee80211_radiotap_eht);
-+		rtap_space += (status->eht_num_user * sizeof(u32));
-+	}
-+
- 	min_head_len = rtap_space;
- 
- 	/*
diff --git a/package/kernel/mac80211/patches/ath11k_nss/675-01-cfg80211-Extend-interface-combination-advertisement-.patch b/package/kernel/mac80211/patches/ath11k_nss/675-01-cfg80211-Extend-interface-combination-advertisement-.patch
deleted file mode 100644
index 4a8328f4e3ca83..00000000000000
--- a/package/kernel/mac80211/patches/ath11k_nss/675-01-cfg80211-Extend-interface-combination-advertisement-.patch
+++ /dev/null
@@ -1,1594 +0,0 @@
-From 1c326ee47eb453b884aa0436916f73c458e1a7f3 Mon Sep 17 00:00:00 2001
-From: Vasanthakumar Thiagarajan <quic_vthiagar@quicinc.com>
-Date: Sat, 8 Oct 2022 13:59:17 +0530
-Subject: [PATCH 1/3] cfg80211/mac80211: extend iface comb
-advertisement for multi-hardware dev
-
-When driver combines multiple discrete hardware under one wiphy, it is
-required for the driver to be able to advertise iface combination
-capabilities per underlying physical hardware. Iface combination for each
-underlying hardware is described with an identifier, the same index which
-is used in wiphy->hw_chans[] to learn the channel capabilities of the
-respective hardware. It should be noted that the supporting drivers also
-need to signal the iface comb capabilities that are common for all the
-hardware through the existing interface to maintain the backward
-compatibility with the user space. Provision to advertise per physical
-hardware specific iface comb capabilities and the sanity checks on the
-advertised capabilities are implemented in this commit.
-
-Example:
-
-Say driver abstracts two discrete hardware under one wiphy,
-wiphy->hw_chans[0] supporting 2 GHz and wiphy->hw_chans[1] supporting
-5 GHz. Each hardware can operate on only one channel at any given time
-but under the wiphy there can be concurrent interfaces on both the radios.
-2 GHz hardware supports #STA <= 1, #AP <= 3 total 4 and 5 GHz hardware
-supports #STA <= 1, #AP <= 4 total 5
-
-struct ieee80211_iface_limit limits_common[] = {
-	{ .max = 1, .types = BIT(NL80211_IFTYPE_STATION), },
-	{ .max = 3, .types = BIT(NL80211_IFTYPE_AP), },
-};
-
-limits_common[] defines the minimum (common) capability out of all the
-underlying hardware specific capabilities. This is reported in the existing
-advertisement mechanism. Common max_interfaces across 2 GHz and 5 GHz is 4,
-common num_different_channels is 1.
-
-struct ieee80211_iface_limit limits_2ghz[] = {
-	{ .max = 1, .types = BIT(NL80211_IFTYPE_STATION), },
-	{ .max = 3, .types = BIT(NL80211_IFTYPE_AP), },
-};
-
-struct ieee80211_iface_limit limits_5ghz[] = {
-	{ .max = 1, .types = BIT(NL80211_IFTYPE_STATION), },
-	{ .max = 4, .types = BIT(NL80211_IFTYPE_AP), },
-};
-
-struct ieee80211_iface_combination combination = {
-	.limits = limits_common,
-	.max_interfaces = 4,
-	.num_different_channels = 1,
-	...
-	.freq_range = {
-			{
-				.hw_chan_idx = 0,
-				.limits = limits_2ghz,
-				.max_interfaces = 4,
-				.num_different_channels = 1,
-				.n_limits = ARRAY_SIZE(limits_2ghz),
-			},
-			{
-				.hw_chan_idx = 1,
-				.limits = limits_5ghz,
-				.max_interfaces = 5,
-				.num_different_channels = 1,
-				.n_limits = ARRAY_SIZE(limits_5ghz),
-			},
-		      },
-};
-
-Signed-off-by: Vasanthakumar Thiagarajan <quic_vthiagar@quicinc.com>
----
- include/net/cfg80211.h     | 188 +++++++++++++++++++-
- net/mac80211/chan.c        |  29 ++-
- net/mac80211/ieee80211_i.h |   5 +-
- net/mac80211/main.c        |  58 ++++++
- net/mac80211/util.c        | 315 ++++++++++++++++++++++++++------
- net/wireless/core.c        | 265 ++++++++++++++++++++++-----
- net/wireless/util.c        | 356 +++++++++++++++++++++++++++++++++----
- 7 files changed, 1073 insertions(+), 143 deletions(-)
-
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -1537,27 +1537,60 @@ struct cfg80211_color_change_settings {
- };
- 
- /**
-+ * struct iface_comb_per_hw_params - HW specific interface combinations input
-+ *
-+ * Used to pass per-hw interface combination parameters
-+ *
-+ * @num_different_channels: the number of different channels we want to use
-+ *	with in the per-hw supported channels.
-+ * @iftype_num: array with the number of interfaces of each interface
-+ *	type. The index is the interface type as specified in &enum
-+ *	nl80211_iftype.
-+ */
-+
-+struct iface_comb_per_hw_params {
-+	int num_different_channels;
-+	int iftype_num[NUM_NL80211_IFTYPES];
-+};
-+
-+/**
-  * struct iface_combination_params - input parameters for interface combinations
-  *
-  * Used to pass interface combination parameters
-  *
-  * @num_different_channels: the number of different channels we want
-- *	to use for verification
-+ *	to use for verification, not applicable when hw specific interface
-+ *	combination parameters are passed in @per_hw_params
-  * @radar_detect: a bitmap where each bit corresponds to a channel
-  *	width where radar detection is needed, as in the definition of
-  *	&struct ieee80211_iface_combination.@radar_detect_widths
-  * @iftype_num: array with the number of interfaces of each interface
-  *	type.  The index is the interface type as specified in &enum
-- *	nl80211_iftype.
-+ *	nl80211_iftype. This will hold the interfaces which are not
-+ *	yet assigned a channel when hw specific interface combination
-+ *	is passed in @per_hw_params.
-  * @new_beacon_int: set this to the beacon interval of a new interface
-  *	that's not operating yet, if such is to be checked as part of
-  *	the verification
-+ * @per_hw: underlying hw specific interface combinations. Per-hw channel
-+ *	list index as advertised in wiphy @hw_chans is used as index
-+ *	in @per_hw to maintain the interface combination of the corresponding
-+ *	hw.
-+ * @chandef: Channel definition for which the interface combination is to be
-+ *	checked, when checking during interface preparation on a new channel,
-+ *	for example. This will be used when the driver advertises underlying
-+ *	hw specific interface combination in a multi-mac device. This will be
-+ *	NULL when the interface combination check is not due to channel or the
-+ *	interface combination does not include per-hw advertisement.
-+ *
-  */
- struct iface_combination_params {
- 	int num_different_channels;
- 	u8 radar_detect;
- 	int iftype_num[NUM_NL80211_IFTYPES];
- 	u32 new_beacon_int;
-+	struct iface_comb_per_hw_params *per_hw;
-+	const struct cfg80211_chan_def *chandef;
- };
- 
- /**
-@@ -4941,6 +4974,32 @@ struct ieee80211_iface_limit {
- };
- 
- /**
-+ * strucieee80211_iface_per_hw - hardware specific interface combination
-+ *
-+ * Drivers registering multiple radios under a single wiphy can advertise
-+ * radio specific interface combinations through this structure. Please note
-+ * that to maintain the compatibility with the user space which is not aware
-+ * of this extension of per-hardware interface combination signaling,
-+ * the driver should still advertise it's interface combination (mostly
-+ * common minimum capability) using the existing interface combination signaling
-+ * method.
-+ *
-+ * @hw_chans_idx: index of hardware specific channel list as per wiphy @hw_chans
-+ * @limits: limits for the given interface type
-+ * @num_different_channels: number of different channels which can be active
-+ *	concurrently in this hw
-+ * @max_interfaces: maximum number of total interfaces allowed in this group
-+ * @n_limits: number of limitations
-+ */
-+struct ieee80211_iface_per_hw {
-+	u8 hw_chans_idx;
-+	const struct ieee80211_iface_limit *limits;
-+	u32 num_different_channels;
-+	u16 max_interfaces;
-+	u8 n_limits;
-+};
-+
-+/**
-  * struct ieee80211_iface_combination - possible interface combination
-  *
-  * With this structure the driver can describe which interface
-@@ -4998,6 +5057,62 @@ struct ieee80211_iface_limit {
-  *		.num_different_channels = 2,
-  *	};
-  *
-+ *
-+ * 4. Hardware specific interface combination with driver supporting two hw
-+ *    (MAC), one underlying MAC supporting 2 GHz band and the other supporting
-+ *    5 GHz band.
-+ *
-+ *    Allow #STA <= 1, #AP <= 1, channels = 1, total 2 in 2 GHz radio and
-+ *
-+ *    Allow #STA <= 1, #AP <= 2, channels = 1, total 3 in 5 GHz radio
-+ *
-+ *    Drivers advertising per-hardware interface combination should also
-+ *    advertise a sub-set of capabilities using existing interface mainly for
-+ *    maintaining compatibility with the user space which is not aware of the
-+ *    new per-hardware advertisement.
-+ *
-+ *    Sub-set interface combination advertised in the existing infrastructure:
-+ *    Allow #STA <= 1, #AP <= 1, channel = 1, total 2
-+ *
-+ *    .. code-block:: c
-+ *
-+ *	struct ieee80211_iface_limit limits4[] = {
-+ *		{ .max = 1, .types = BIT(NL80211_IFTYPE_STATION), },
-+ *		{ .max = 1, .types = BIT(NL80211_IFTYPE_AP), },
-+ *	};
-+ *	struct ieee80211_iface_limit limits5_2ghz[] = {
-+ *		{ .max = 1, .types = BIT(NL80211_IFTYPE_STATION), },
-+ *		{ .max = 1, .types = BIT(NL80211_IFTYPE_AP), },
-+ *	};
-+ *	struct ieee80211_iface_limit limits5_5ghz[] = {
-+ *		{ .max = 1, .types = BIT(NL80211_IFTYPE_STATION), },
-+ *		{ .max = 2, .types = BIT(NL80211_IFTYPE_AP), },
-+ *	};
-+ *	struct ieee80211_iface_per_hw hw_combinations[] = {
-+ *		{
-+ *			.hw_chans_idx = 0,
-+ *			.limits = limits5_2ghz,
-+ *			.num_different_channels = 1,
-+ *			.max_interfaces = 2,
-+ *			.n_limits = ARRAY_SIZE(limits5_2ghz),
-+ *		 },
-+ *		{
-+ *			.hw_chans_idx = 1,
-+ *			.limits = limits5_5ghz,
-+ *			.num_different_channels = 1,
-+ *			.max_interfaces = 3,
-+ *			.n_limits = ARRAY_SIZE(limits5_5ghz),
-+ *		 },
-+ *	};
-+ *	struct ieee80211_iface_combination combination4 = {
-+ *		.limits = limits4,
-+ *		.n_limits = ARRAY_SIZE(limits4),
-+ *		.max_interfaces = 2,
-+ *		.num_different_channels = 1,
-+ *		.iface_hw_list = hw_combinations,
-+ *		.n_hw_list = ARRAY_SIZE(hw_combinations),
-+ *	};
-+ *
-  */
- struct ieee80211_iface_combination {
- 	/**
-@@ -5055,6 +5170,20 @@ struct ieee80211_iface_combination {
- 	 *   combination must be greater or equal to this value.
- 	 */
- 	u32 beacon_int_min_gcd;
-+
-+	/**
-+	 * @iface_hw_list:
-+	 * This wiphy has multiple underlying radios, describe interface
-+	 * combination for each of them, valid only when the driver advertises
-+	 * multi-radio presence in wiphy @hw_chans.
-+	 */
-+	const struct ieee80211_iface_per_hw *iface_hw_list;
-+
-+	/**
-+	 * @n_hw_list:
-+	 * number of hardware in @iface_hw_List
-+	 */
-+	u32 n_hw_list;
- };
- 
- struct ieee80211_txrx_stypes {
-@@ -5305,6 +5434,18 @@ struct wiphy_iftype_akm_suites {
- #define CFG80211_HW_TIMESTAMP_ALL_PEERS	0xffff
- 
- /**
-+ * struct ieee80211_supported_chans_per_hw - supported channels as per the
-+ * underlying constituent hw configuration
-+ *
-+ * @n_chans: number of channels in @chans
-+ * @chans: list of channels supported by the constituent hw
-+ */
-+struct ieee80211_chans_per_hw {
-+	int n_chans;
-+	struct ieee80211_channel chans[];
-+};
-+
-+/**
-  * struct wiphy - wireless hardware description
-  * @mtx: mutex for the data (structures) of this device
-  * @reg_notifier: the driver's regulatory notification callback,
-@@ -5520,6 +5661,13 @@ struct wiphy_iftype_akm_suites {
-  *	A value of %CFG80211_HW_TIMESTAMP_ALL_PEERS indicates the driver
-  *	supports enabling HW timestamping for all peers (i.e. no need to
-  *	specify a mac address).
-+ * @hw_chans: list of the channels supported by every constituent underlying hw.
-+ *	The drivers registering multiple radios under the a wiphy can advertise
-+ *	the list of channels supported by each hw in this list. Underlying hw
-+ *	specific channel list can be used while describing interface combination
-+ *	for each of the underlying hw.
-+ * @num_hw: number of underlying hw for which the channels list are advertised
-+ *	in @hw_chans.
-  */
- struct wiphy {
- 	struct mutex mtx;
-@@ -5670,6 +5818,9 @@ struct wiphy {
- 
- 	u16 hw_timestamp_max_peers;
- 
-+	struct ieee80211_chans_per_hw **hw_chans;
-+	int num_hw;
-+
- 	char priv[] __aligned(NETDEV_ALIGN);
- };
- 
-@@ -8956,9 +9107,32 @@ int cfg80211_check_combinations(struct w
- int cfg80211_iter_combinations(struct wiphy *wiphy,
- 			       struct iface_combination_params *params,
- 			       void (*iter)(const struct ieee80211_iface_combination *c,
--					    void *data),
-+					    void *data, int hw_chan_idx),
- 			       void *data);
- 
-+/**
-+ * cfg80211_per_hw_iface_comb_advertised - if per-hw iface combination supported
-+ *
-+ * @wiphy: the wiphy
-+ *
-+ * This function is used to check underlying per-hw interface combination is
-+ * advertised by the driver.
-+ */
-+bool cfg80211_per_hw_iface_comb_advertised(struct wiphy *wiphy);
-+
-+/**
-+ * cfg80211_get_hw_idx_by_chan - get the hw index by the channel
-+ *
-+ * @wiphy: the wiphy
-+ * @chandef: channel definition for which the supported hw index is
-+ *	required
-+ *
-+ * returns -1 in case the channel is not supported by any of the constituent
-+ *	hw
-+ */
-+int cfg80211_get_hw_idx_by_chan(struct wiphy *wiphy,
-+				const struct cfg80211_chan_def *chandef);
-+
- /*
-  * cfg80211_stop_iface - trigger interface disconnection
-  *
-@@ -9152,6 +9326,16 @@ bool cfg80211_iftype_allowed(struct wiph
- void cfg80211_assoc_comeback(struct net_device *netdev,
- 			     const u8 *ap_addr, u32 timeout);
- 
-+/**
-+ * cfg80211_hw_chans_includes_dfs - check if per-hardware channel includes DFS
-+ * @chans: hardware channel list
-+ *
-+ * Check if the given per-hardware list includes channels in DFS range.
-+ * Please note the channel is checked against the entire range of DFS
-+ * freq in 5 GHz irrespective of regulatory configurations.
-+ */
-+bool cfg80211_hw_chans_includes_dfs(const struct ieee80211_chans_per_hw *chans);
-+
- /* Logging, debugging and troubleshooting/diagnostic helpers. */
- 
- /* wiphy_printk helpers, similar to dev_printk */
---- a/net/mac80211/chan.c
-+++ b/net/mac80211/chan.c
-@@ -47,26 +47,41 @@ int ieee80211_chanctx_refcount(struct ie
- 	       ieee80211_chanctx_num_reserved(local, ctx);
- }
- 
--static int ieee80211_num_chanctx(struct ieee80211_local *local)
-+static int ieee80211_num_chanctx(struct ieee80211_local *local,
-+				 const struct cfg80211_chan_def *chandef)
- {
- 	struct ieee80211_chanctx *ctx;
- 	int num = 0;
-+	int hw_idx, ctx_idx;
- 
- 	lockdep_assert_held(&local->chanctx_mtx);
- 
--	list_for_each_entry(ctx, &local->chanctx_list, list)
--		num++;
-+	hw_idx = cfg80211_get_hw_idx_by_chan(local->hw.wiphy, chandef);
-+
-+	list_for_each_entry(ctx, &local->chanctx_list, list) {
-+		if (hw_idx < 0)
-+			num++;
-+		else {
-+			ctx_idx =
-+				cfg80211_get_hw_idx_by_chan(local->hw.wiphy,
-+							    &ctx->conf.def);
-+			if (ctx_idx == hw_idx)
-+				num++;
-+		}
-+	}
- 
- 	return num;
- }
- 
--static bool ieee80211_can_create_new_chanctx(struct ieee80211_local *local)
-+static bool ieee80211_can_create_new_chanctx(struct ieee80211_local *local,
-+					     const struct cfg80211_chan_def *chandef)
- {
- 	lockdep_assert_held(&local->chanctx_mtx);
--	return ieee80211_num_chanctx(local) < ieee80211_max_num_channels(local);
-+	return ieee80211_num_chanctx(local, chandef) <
-+	       ieee80211_max_num_channels(local, chandef);
- }
- 
--static struct ieee80211_chanctx *
-+struct ieee80211_chanctx *
- ieee80211_link_get_chanctx(struct ieee80211_link_data *link)
- {
- 	struct ieee80211_local *local __maybe_unused = link->sdata->local;
-@@ -1116,7 +1131,7 @@ int ieee80211_link_reserve_chanctx(struc
- 
- 	new_ctx = ieee80211_find_reservation_chanctx(local, chandef, mode);
- 	if (!new_ctx) {
--		if (ieee80211_can_create_new_chanctx(local)) {
-+		if (ieee80211_can_create_new_chanctx(local, chandef)) {
- 			new_ctx = ieee80211_new_chanctx(local, chandef, mode);
- 			if (IS_ERR(new_ctx))
- 				return PTR_ERR(new_ctx);
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -2573,6 +2573,8 @@ void ieee80211_link_copy_chanctx_to_vlan
- 					  bool clear);
- int ieee80211_chanctx_refcount(struct ieee80211_local *local,
- 			       struct ieee80211_chanctx *ctx);
-+struct ieee80211_chanctx *
-+ieee80211_link_get_chanctx(struct ieee80211_link_data *link);
- 
- void ieee80211_recalc_smps_chanctx(struct ieee80211_local *local,
- 				   struct ieee80211_chanctx *chanctx);
-@@ -2594,7 +2596,8 @@ int ieee80211_check_combinations(struct
- 				 const struct cfg80211_chan_def *chandef,
- 				 enum ieee80211_chanctx_mode chanmode,
- 				 u8 radar_detect);
--int ieee80211_max_num_channels(struct ieee80211_local *local);
-+int ieee80211_max_num_channels(struct ieee80211_local *local,
-+			       const struct cfg80211_chan_def *chandef);
- void ieee80211_recalc_chanctx_chantype(struct ieee80211_local *local,
- 				       struct ieee80211_chanctx *ctx);
- 
---- a/net/mac80211/main.c
-+++ b/net/mac80211/main.c
-@@ -937,6 +937,45 @@ static int ieee80211_init_cipher_suites(
- 	return 0;
- }
- 
-+static int
-+ieee80211_check_per_hw_iface_comb(struct ieee80211_local *local,
-+				  const struct ieee80211_iface_combination *c)
-+{
-+	int h, l;
-+	u32 hw_idx_bm = 0;
-+
-+	if (!local->use_chanctx)
-+		return -EINVAL;
-+
-+	for (h = 0; h < c->n_hw_list; h++) {
-+		const struct ieee80211_iface_per_hw *hl;
-+		const struct ieee80211_chans_per_hw *chans;
-+
-+		hl = &c->iface_hw_list[h];
-+
-+		if (hl->hw_chans_idx >= local->hw.wiphy->num_hw)
-+			return -EINVAL;
-+
-+		chans = local->hw.wiphy->hw_chans[hl->hw_chans_idx];
-+		if (c->radar_detect_widths &&
-+		    cfg80211_hw_chans_includes_dfs(chans) &&
-+		    hl->num_different_channels > 1)
-+			return -EINVAL;
-+
-+		for (l = 0; l < hl->n_limits; l++)
-+			if ((hl->limits[l].types & BIT(NL80211_IFTYPE_ADHOC)) &&
-+			    hl->limits[l].max > 1)
-+				return -EINVAL;
-+
-+		if (hw_idx_bm & BIT(h))
-+			return -EINVAL;
-+
-+		hw_idx_bm |= BIT(h);
-+	}
-+
-+	return 0;
-+}
-+
- int ieee80211_register_hw(struct ieee80211_hw *hw)
- {
- 	struct ieee80211_local *local = hw_to_local(hw);
-@@ -1051,6 +1090,25 @@ int ieee80211_register_hw(struct ieee802
- 		}
- 	}
- 
-+	for (i = 0; i < local->hw.wiphy->n_iface_combinations; i++) {
-+		const struct ieee80211_iface_combination *comb;
-+
-+		comb = &local->hw.wiphy->iface_combinations[i];
-+
-+		if (comb->n_hw_list && !local->hw.wiphy->num_hw)
-+			return -EINVAL;
-+
-+		if (!comb->n_hw_list)
-+			continue;
-+
-+		/*
-+		 * Run through similar validations on the per-hardware
-+		 * interface combinations, if advertised.
-+		 */
-+		if (ieee80211_check_per_hw_iface_comb(local, comb))
-+			return -EINVAL;
-+	}
-+
- 	/* Only HW csum features are currently compatible with mac80211 */
- 	if (WARN_ON(hw->netdev_features & ~MAC80211_SUPPORTED_FEATURES))
- 		return -EINVAL;
---- a/net/mac80211/util.c
-+++ b/net/mac80211/util.c
-@@ -4818,16 +4818,174 @@ static u8 ieee80211_chanctx_radar_detect
- 	return radar_detect;
- }
- 
-+static void
-+ieee80211_prepare_iface_combination(struct ieee80211_sub_if_data *sdata,
-+				    const struct cfg80211_chan_def *chandef,
-+				    enum ieee80211_chanctx_mode chanmode,
-+				    struct iface_combination_params *params,
-+				    int *total)
-+{
-+	struct ieee80211_local *local = sdata->local;
-+	struct ieee80211_sub_if_data *sdata_iter;
-+	enum nl80211_iftype iftype = sdata->wdev.iftype;
-+	struct ieee80211_chanctx *ctx;
-+
-+	lockdep_assert_held(&local->chanctx_mtx);
-+
-+	if (chandef)
-+		params->num_different_channels = 1;
-+
-+	if (iftype != NL80211_IFTYPE_UNSPECIFIED)
-+		params->iftype_num[iftype] = 1;
-+
-+	list_for_each_entry(ctx, &local->chanctx_list, list) {
-+		if (ctx->replace_state == IEEE80211_CHANCTX_WILL_BE_REPLACED)
-+			continue;
-+		params->radar_detect |=
-+			ieee80211_chanctx_radar_detect(local, ctx);
-+		if (ctx->mode == IEEE80211_CHANCTX_EXCLUSIVE) {
-+			params->num_different_channels++;
-+			continue;
-+		}
-+		if (chandef && chanmode == IEEE80211_CHANCTX_SHARED &&
-+		    cfg80211_chandef_compatible(chandef,
-+						&ctx->conf.def))
-+			continue;
-+		params->num_different_channels++;
-+	}
-+
-+	list_for_each_entry_rcu(sdata_iter, &local->interfaces, list) {
-+		struct wireless_dev *wdev_iter;
-+
-+		wdev_iter = &sdata_iter->wdev;
-+
-+		if (sdata_iter == sdata ||
-+		    !ieee80211_sdata_running(sdata_iter) ||
-+		    cfg80211_iftype_allowed(local->hw.wiphy,
-+					    wdev_iter->iftype, 0, 1))
-+			continue;
-+
-+		params->iftype_num[wdev_iter->iftype]++;
-+		(*total)++;
-+	}
-+}
-+
-+static void
-+ieee80211_get_per_hw_sdata_active_iface(struct ieee80211_sub_if_data *sdata,
-+					struct iface_combination_params *params,
-+					int *total)
-+{
-+	struct ieee80211_local *local = sdata->local;
-+	unsigned int link_id;
-+	int idx;
-+
-+	for (link_id = 0; link_id < ARRAY_SIZE(sdata->link); link_id++) {
-+		struct ieee80211_link_data *link;
-+		struct ieee80211_chanctx *ctx;
-+
-+		link = sdata_dereference(sdata->link[link_id], sdata);
-+		if (!link)
-+			continue;
-+
-+		ctx = ieee80211_link_get_chanctx(link);
-+		if (ctx &&
-+		    ctx->replace_state == IEEE80211_CHANCTX_WILL_BE_REPLACED)
-+			ctx = ctx->replace_ctx;
-+
-+		idx = -1;
-+		if (ctx)
-+			idx = cfg80211_get_hw_idx_by_chan(local->hw.wiphy,
-+							  &ctx->conf.def);
-+
-+		if (idx >= 0)
-+			params->per_hw[idx].iftype_num[sdata->wdev.iftype]++;
-+		else
-+			params->iftype_num[sdata->wdev.iftype]++;
-+
-+		if (total)
-+			(*total)++;
-+	}
-+}
-+
-+static int
-+ieee80211_prepare_per_hw_iface_combination(struct ieee80211_sub_if_data *sdata,
-+					const struct cfg80211_chan_def *chandef,
-+					enum ieee80211_chanctx_mode chanmode,
-+					struct iface_combination_params *params,
-+					int *total)
-+{
-+	struct ieee80211_local *local = sdata->local;
-+	struct ieee80211_sub_if_data *sdata_iter;
-+	enum nl80211_iftype iftype = sdata->wdev.iftype;
-+	struct ieee80211_chanctx *ctx;
-+	int hchan_idx;
-+	size_t size;
-+	bool sdata_included = false;
-+
-+	lockdep_assert_held(&local->chanctx_mtx);
-+
-+	size = sizeof(*params->per_hw) * local->hw.wiphy->num_hw;
-+	/* caller should free this memory upon success status */
-+	params->per_hw = kzalloc(size, GFP_KERNEL);
-+	if (!params->per_hw)
-+		return -ENOMEM;
-+
-+	hchan_idx = cfg80211_get_hw_idx_by_chan(local->hw.wiphy, chandef);
-+	if (hchan_idx >= 0) {
-+		params->per_hw[hchan_idx].num_different_channels = 1;
-+		if (iftype != NL80211_IFTYPE_UNSPECIFIED) {
-+			params->per_hw[hchan_idx].iftype_num[iftype] = 1;
-+			sdata_included = true;
-+		}
-+	}
-+
-+	list_for_each_entry(ctx, &local->chanctx_list, list) {
-+		if (ctx->replace_state == IEEE80211_CHANCTX_WILL_BE_REPLACED)
-+			continue;
-+		hchan_idx = cfg80211_get_hw_idx_by_chan(local->hw.wiphy,
-+							&ctx->conf.def);
-+		if (WARN_ON(hchan_idx < 0))
-+			continue;
-+
-+		params->radar_detect |=
-+			ieee80211_chanctx_radar_detect(local, ctx);
-+		if (ctx->mode == IEEE80211_CHANCTX_EXCLUSIVE) {
-+			params->per_hw[hchan_idx].num_different_channels++;
-+			continue;
-+		}
-+		if (chandef && chanmode == IEEE80211_CHANCTX_SHARED &&
-+		    cfg80211_chandef_compatible(chandef,
-+						&ctx->conf.def))
-+			continue;
-+		params->per_hw[hchan_idx].num_different_channels++;
-+	}
-+
-+	list_for_each_entry_rcu(sdata_iter, &local->interfaces, list) {
-+		struct wireless_dev *wdev_iter;
-+
-+		wdev_iter = &sdata_iter->wdev;
-+
-+		if ((sdata_included && sdata_iter == sdata) ||
-+		    !ieee80211_sdata_running(sdata_iter) ||
-+		    cfg80211_iftype_allowed(local->hw.wiphy,
-+					    wdev_iter->iftype, 0, 1))
-+			continue;
-+
-+		ieee80211_get_per_hw_sdata_active_iface(sdata_iter, params,
-+							total);
-+	}
-+
-+	return 0;
-+}
-+
- int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
- 				 const struct cfg80211_chan_def *chandef,
- 				 enum ieee80211_chanctx_mode chanmode,
- 				 u8 radar_detect)
- {
- 	struct ieee80211_local *local = sdata->local;
--	struct ieee80211_sub_if_data *sdata_iter;
- 	enum nl80211_iftype iftype = sdata->wdev.iftype;
--	struct ieee80211_chanctx *ctx;
--	int total = 1;
-+	int total = 1, ret;
- 	struct iface_combination_params params = {
- 		.radar_detect = radar_detect,
- 	};
-@@ -4861,60 +5019,118 @@ int ieee80211_check_combinations(struct
- 		return 0;
- 	}
- 
--	if (chandef)
--		params.num_different_channels = 1;
-+	if (cfg80211_per_hw_iface_comb_advertised(local->hw.wiphy)) {
-+		ret = ieee80211_prepare_per_hw_iface_combination(sdata, chandef,
-+									chanmode,
-+									&params,
-+									&total);
-+		if (ret)
-+			return ret;
-+	} else {
-+		ieee80211_prepare_iface_combination(sdata, chandef, chanmode,
-+						&params, &total);
-+	}
- 
--	if (iftype != NL80211_IFTYPE_UNSPECIFIED)
--		params.iftype_num[iftype] = 1;
-+	if (total == 1 && !params.radar_detect) {
-+		kfree(params.per_hw);
-+		return 0;
-+	}
- 
--	list_for_each_entry(ctx, &local->chanctx_list, list) {
--		if (ctx->replace_state == IEEE80211_CHANCTX_WILL_BE_REPLACED)
--			continue;
--		params.radar_detect |=
--			ieee80211_chanctx_radar_detect(local, ctx);
--		if (ctx->mode == IEEE80211_CHANCTX_EXCLUSIVE) {
--			params.num_different_channels++;
-+	ret = cfg80211_check_combinations(local->hw.wiphy, &params);
-+
-+	kfree(params.per_hw);
-+
-+	return ret;
-+}
-+
-+static void
-+ieee80211_iter_max_chans(const struct ieee80211_iface_combination *c,
-+			 void *data, int hw_chan_idx)
-+{
-+	u32 *max_num_different_channels = data;
-+
-+	*max_num_different_channels =
-+		max(*max_num_different_channels, c->num_different_channels);
-+}
-+
-+static void
-+ieee80211_iter_per_hw_max_chans(const struct ieee80211_iface_combination *c,
-+				void *data, int hw_chan_idx)
-+{
-+	u32 *max_num_different_channels = data;
-+	u32 max_supported_different_channels = 0;
-+	int i;
-+
-+	for (i = 0; i < c->n_hw_list; i++) {
-+		const struct ieee80211_iface_per_hw *h;
-+
-+		h = &c->iface_hw_list[i];
-+		if (hw_chan_idx != -1) {
-+			if (h->hw_chans_idx == hw_chan_idx) {
-+				max_supported_different_channels =
-+					h->num_different_channels;
-+				break;
-+			}
- 			continue;
- 		}
--		if (chandef && chanmode == IEEE80211_CHANCTX_SHARED &&
--		    cfg80211_chandef_compatible(chandef,
--						&ctx->conf.def))
--			continue;
--		params.num_different_channels++;
-+		max_supported_different_channels += h->num_different_channels;
- 	}
- 
--	list_for_each_entry_rcu(sdata_iter, &local->interfaces, list) {
--		struct wireless_dev *wdev_iter;
-+	*max_num_different_channels = max(*max_num_different_channels,
-+					  max_supported_different_channels);
-+}
- 
--		wdev_iter = &sdata_iter->wdev;
-+static int
-+ieee80211_max_num_channels_hw_list(struct ieee80211_local *local,
-+				   const struct cfg80211_chan_def *chandef)
-+{
-+	struct ieee80211_sub_if_data *sdata;
-+	struct ieee80211_chanctx *ctx;
-+	u32 max_num_different_channels = 1;
-+	size_t size;
-+	int err, hchan_idx;
-+	struct iface_combination_params params = { 0 };
-+
-+	size = sizeof(*params.per_hw) * local->hw.wiphy->num_hw;
-+	/* caller should free this memory */
-+	params.per_hw = kzalloc(size, GFP_KERNEL);
-+	if (!params.per_hw)
-+		return -ENOMEM;
- 
--		if (sdata_iter == sdata ||
--		    !ieee80211_sdata_running(sdata_iter) ||
--		    cfg80211_iftype_allowed(local->hw.wiphy,
--					    wdev_iter->iftype, 0, 1))
-+	params.chandef = chandef;
-+	list_for_each_entry(ctx, &local->chanctx_list, list) {
-+		if (ctx->replace_state == IEEE80211_CHANCTX_WILL_BE_REPLACED)
-+			continue;
-+		hchan_idx = cfg80211_get_hw_idx_by_chan(local->hw.wiphy,
-+							&ctx->conf.def);
-+		if (WARN_ON(hchan_idx < 0))
- 			continue;
- 
--		params.iftype_num[wdev_iter->iftype]++;
--		total++;
-+		params.radar_detect |=
-+			ieee80211_chanctx_radar_detect(local, ctx);
-+		params.per_hw[hchan_idx].num_different_channels++;
- 	}
- 
--	if (total == 1 && !params.radar_detect)
--		return 0;
-+	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
-+		struct wireless_dev *wdev = &sdata->wdev;
- 
--	return cfg80211_check_combinations(local->hw.wiphy, &params);
--}
-+		if (!ieee80211_sdata_running(sdata) ||
-+		    cfg80211_iftype_allowed(local->hw.wiphy, wdev->iftype, 0,
-+					    1))
-+			continue;
-+		ieee80211_get_per_hw_sdata_active_iface(sdata, &params, NULL);
-+	}
- 
--static void
--ieee80211_iter_max_chans(const struct ieee80211_iface_combination *c,
--			 void *data)
--{
--	u32 *max_num_different_channels = data;
-+	err = cfg80211_iter_combinations(local->hw.wiphy, &params,
-+					 ieee80211_iter_per_hw_max_chans,
-+					 &max_num_different_channels);
-+	kfree(params.per_hw);
- 
--	*max_num_different_channels = max(*max_num_different_channels,
--					  c->num_different_channels);
-+	return err < 0 ? err : max_num_different_channels;
- }
- 
--int ieee80211_max_num_channels(struct ieee80211_local *local)
-+int ieee80211_max_num_channels(struct ieee80211_local *local,
-+			       const struct cfg80211_chan_def *chandef)
- {
- 	struct ieee80211_sub_if_data *sdata;
- 	struct ieee80211_chanctx *ctx;
-@@ -4924,6 +5140,9 @@ int ieee80211_max_num_channels(struct ie
- 
- 	lockdep_assert_held(&local->chanctx_mtx);
- 
-+	if (cfg80211_per_hw_iface_comb_advertised(local->hw.wiphy))
-+		return ieee80211_max_num_channels_hw_list(local, chandef);
-+
- 	list_for_each_entry(ctx, &local->chanctx_list, list) {
- 		if (ctx->replace_state == IEEE80211_CHANCTX_WILL_BE_REPLACED)
- 			continue;
---- a/net/wireless/core.c
-+++ b/net/wireless/core.c
-@@ -594,10 +594,125 @@ use_default_name:
- }
- EXPORT_SYMBOL(wiphy_new_nm);
- 
-+static int
-+wiphy_verify_comb_limit(struct wiphy *wiphy,
-+			const struct ieee80211_iface_limit *limits,
-+			u8 n_limits, u32 bcn_int_min_gcd, u32 *iface_cnt,
-+			u16 *all_iftypes)
-+{
-+	int l;
-+
-+	for (l = 0; l < n_limits; l++) {
-+		u16 types = limits[l].types;
-+
-+		/*
-+		 * Don't advertise an unsupported type
-+		 * in a combination.
-+		 */
-+		if (WARN_ON((wiphy->interface_modes & types) != types))
-+			return -EINVAL;
-+
-+		/* interface types shouldn't overlap */
-+		if (WARN_ON(types & *all_iftypes))
-+			return -EINVAL;
-+
-+		*all_iftypes |= types;
-+
-+		/* Shouldn't list software iftypes in combinations! */
-+		if (WARN_ON(wiphy->software_iftypes & types))
-+			return -EINVAL;
-+
-+		/* Only a single P2P_DEVICE can be allowed */
-+		if (WARN_ON(types & BIT(NL80211_IFTYPE_P2P_DEVICE) &&
-+			    limits[l].max > 1))
-+			return -EINVAL;
-+
-+		/* Only a single NAN can be allowed */
-+		if (WARN_ON(types & BIT(NL80211_IFTYPE_NAN) &&
-+			    limits[l].max > 1))
-+			return -EINVAL;
-+
-+		/*
-+		 * This isn't well-defined right now. If you have an
-+		 * IBSS interface, then its beacon interval may change
-+		 * by joining other networks, and nothing prevents it
-+		 * from doing that.
-+		 * So technically we probably shouldn't even allow AP
-+		 * and IBSS in the same interface, but it seems that
-+		 * some drivers support that, possibly only with fixed
-+		 * beacon intervals for IBSS.
-+		 */
-+		if (WARN_ON(types & BIT(NL80211_IFTYPE_ADHOC) &&
-+			    bcn_int_min_gcd))
-+			return -EINVAL;
-+
-+		*iface_cnt += limits[l].max;
-+	}
-+
-+	return 0;
-+}
-+
-+static int
-+wiphy_verify_comb_per_hw(struct wiphy *wiphy,
-+			 const struct ieee80211_iface_combination *comb)
-+{
-+	int h;
-+	u32 hw_idx_bitmap = 0;
-+	int ret;
-+
-+	for (h = 0; h < comb->n_hw_list; h++) {
-+		const struct ieee80211_iface_per_hw *hl;
-+		const struct ieee80211_chans_per_hw *chans;
-+		u32 iface_cnt = 0;
-+		u16 all_iftypes = 0;
-+
-+		hl = &comb->iface_hw_list[h];
-+
-+		if (hl->hw_chans_idx >= wiphy->num_hw)
-+			return -EINVAL;
-+
-+		if (hw_idx_bitmap & BIT(hl->hw_chans_idx))
-+			return -EINVAL;
-+
-+		hw_idx_bitmap |= BIT(hl->hw_chans_idx);
-+		chans = wiphy->hw_chans[hl->hw_chans_idx];
-+
-+		if (WARN_ON(hl->max_interfaces < 2 && (!comb->radar_detect_widths ||
-+		    !(cfg80211_hw_chans_includes_dfs(chans)))))
-+			return -EINVAL;
-+
-+		if (WARN_ON(!hl->num_different_channels))
-+			return -EINVAL;
-+
-+		if (WARN_ON(comb->radar_detect_widths &&
-+		    cfg80211_hw_chans_includes_dfs(chans) &&
-+		    hl->num_different_channels > 1))
-+			return -EINVAL;
-+
-+		if (WARN_ON(!hl->n_limits))
-+			return -EINVAL;
-+
-+		ret = wiphy_verify_comb_limit(wiphy, hl->limits, hl->n_limits,
-+					      comb->beacon_int_min_gcd,
-+					      &iface_cnt, &all_iftypes);
-+		if (ret)
-+			return ret;
-+
-+		if (WARN_ON(all_iftypes & BIT(NL80211_IFTYPE_WDS)))
-+			return -EINVAL;
-+
-+		if (WARN_ON(iface_cnt < comb->max_interfaces))
-+			return -EINVAL;
-+	}
-+
-+	return 0;
-+}
-+
- static int wiphy_verify_combinations(struct wiphy *wiphy)
- {
- 	const struct ieee80211_iface_combination *c;
--	int i, j;
-+	int i;
-+	int ret;
- 
- 	for (i = 0; i < wiphy->n_iface_combinations; i++) {
- 		u32 cnt = 0;
-@@ -624,39 +739,11 @@ static int wiphy_verify_combinations(str
- 		if (WARN_ON(!c->n_limits))
- 			return -EINVAL;
- 
--		for (j = 0; j < c->n_limits; j++) {
--			u16 types = c->limits[j].types;
--
--			/* interface types shouldn't overlap */
--			if (WARN_ON(types & all_iftypes))
--				return -EINVAL;
--			all_iftypes |= types;
--
--			if (WARN_ON(!c->limits[j].max))
--				return -EINVAL;
--
--			/* Shouldn't list software iftypes in combinations! */
--			if (WARN_ON(wiphy->software_iftypes & types))
--				return -EINVAL;
--
--			/* Only a single P2P_DEVICE can be allowed */
--			if (WARN_ON(types & BIT(NL80211_IFTYPE_P2P_DEVICE) &&
--				    c->limits[j].max > 1))
--				return -EINVAL;
--
--			/* Only a single NAN can be allowed */
--			if (WARN_ON(types & BIT(NL80211_IFTYPE_NAN) &&
--				    c->limits[j].max > 1))
--				return -EINVAL;
--
--			cnt += c->limits[j].max;
--			/*
--			 * Don't advertise an unsupported type
--			 * in a combination.
--			 */
--			if (WARN_ON((wiphy->interface_modes & types) != types))
--				return -EINVAL;
--		}
-+                ret = wiphy_verify_comb_limit(wiphy, c->limits, c->n_limits,
-+                                              c->beacon_int_min_gcd,
-+                                              &cnt, &all_iftypes);
-+                if (ret)
-+                        return ret;
- 
- 		if (WARN_ON(all_iftypes & BIT(NL80211_IFTYPE_WDS)))
- 			return -EINVAL;
-@@ -664,11 +751,119 @@ static int wiphy_verify_combinations(str
- 		/* You can't even choose that many! */
- 		if (WARN_ON(cnt < c->max_interfaces))
- 			return -EINVAL;
-+                /*
-+                 * Do similar validations on the freq range specific interface
-+                 * combinations when advertised.
-+                 */
-+                if (WARN_ON(c->n_hw_list &&
-+                            wiphy_verify_comb_per_hw(wiphy, c)))
-+                        return -EINVAL;
- 	}
- 
- 	return 0;
- }
- 
-+static int cfg80211_check_hw_chans(const struct ieee80211_chans_per_hw *chans1,
-+                                   const struct ieee80211_chans_per_hw *chans2)
-+{
-+        int i, j;
-+
-+        if (!chans1 || !chans2)
-+                return -EINVAL;
-+
-+        if (!chans1->n_chans || !chans2->n_chans)
-+                return -EINVAL;
-+
-+        /* for now same channel is not allowed in more than one sub-hw */
-+        for (i = 0; i < chans1->n_chans; i++)
-+                for (j = 0; j < chans2->n_chans; j++)
-+                        if (chans1->chans[i].center_freq ==
-+                            chans2->chans[j].center_freq)
-+                                return -EINVAL;
-+        return 0;
-+}
-+
-+static bool
-+cfg80211_hw_chans_in_supported_list(struct wiphy *wiphy,
-+                                    const struct ieee80211_chans_per_hw *chans)
-+{
-+        enum nl80211_band band;
-+        struct ieee80211_supported_band *sband;
-+        bool found;
-+        int i, j;
-+
-+        for (i = 0; i < chans->n_chans; i++) {
-+                found = false;
-+                for (band = 0; band < NUM_NL80211_BANDS; band++) {
-+                        sband = wiphy->bands[band];
-+                        if (!sband)
-+                                continue;
-+                        for (j = 0; j < sband->n_channels; j++) {
-+                                if (chans->chans[i].center_freq ==
-+                                    sband->channels[j].center_freq) {
-+                                        found = true;
-+                                        break;
-+                                }
-+                        }
-+
-+                        if (found)
-+                                break;
-+                }
-+
-+                if (!found)
-+                        return false;
-+        }
-+
-+        return true;
-+}
-+
-+static int cfg80211_validate_per_hw_chans(struct wiphy *wiphy)
-+{
-+        int i, j;
-+        int ret;
-+
-+        if (!wiphy->num_hw)
-+                return 0;
-+
-+        if (!wiphy->hw_chans)
-+                return -EINVAL;
-+
-+        /*
-+         * to advertise channel list for one hw, sband alone should
-+         * be sufficient
-+         */
-+        if (wiphy->num_hw < 2)
-+                return -EINVAL;
-+
-+        for (i = 0; i < wiphy->num_hw; i++) {
-+                for (j = 0; j < wiphy->num_hw; j++) {
-+                        const struct ieee80211_chans_per_hw *hw_chans1;
-+                        const struct ieee80211_chans_per_hw *hw_chans2;
-+
-+                        if (i == j)
-+                                continue;
-+
-+                        hw_chans1 = wiphy->hw_chans[i];
-+                        hw_chans2 = wiphy->hw_chans[j];
-+                        ret = cfg80211_check_hw_chans(hw_chans1, hw_chans2);
-+                        if (ret)
-+                                return ret;
-+                }
-+        }
-+
-+        for (i = 0; i < wiphy->num_hw; i++) {
-+                const struct ieee80211_chans_per_hw *hw_chans;
-+
-+                hw_chans = wiphy->hw_chans[i];
-+                if (!cfg80211_hw_chans_in_supported_list(wiphy, hw_chans)) {
-+                        WARN_ON(1);
-+                        return -EINVAL;
-+                }
-+        }
-+
-+        return 0;
-+}
-+
- int wiphy_register(struct wiphy *wiphy)
- {
- 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
-@@ -905,6 +1100,11 @@ int wiphy_register(struct wiphy *wiphy)
- 		WARN_ON(1);
- 		return -EINVAL;
- 	}
-+
-+	if (cfg80211_validate_per_hw_chans(&rdev->wiphy)) {
-+		WARN_ON(1);
-+		return -EINVAL;
-+	}
- 
- 	for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
- 		/*
---- a/net/wireless/util.c
-+++ b/net/wireless/util.c
-@@ -2204,19 +2204,271 @@ int cfg80211_validate_beacon_int(struct
- 	return 0;
- }
- 
-+static const struct ieee80211_iface_per_hw *
-+cfg80211_get_hw_iface_comb_by_idx(struct wiphy *wiphy,
-+				  const struct ieee80211_iface_combination *c,
-+				  int idx)
-+{
-+	int i;
-+
-+	for (i = 0; i < c->n_hw_list; i++)
-+		if (c->iface_hw_list[i].hw_chans_idx == idx)
-+			break;
-+
-+	if (i == c->n_hw_list)
-+		return NULL;
-+
-+	return &c->iface_hw_list[i];
-+}
-+
-+static int
-+cfg80211_validate_per_hw_iface_comb_limits(struct wiphy *wiphy,
-+				    struct iface_combination_params *params,
-+				    const struct ieee80211_iface_combination *c,
-+				    int *num_per_hw_ifaces, u32 *all_iftypes)
-+{
-+	struct ieee80211_iface_limit **limits;
-+	const struct ieee80211_iface_per_hw *per_hw_comb;
-+	int iftype_num[NUM_NL80211_IFTYPES] = { 0 };
-+	int *n_limits;
-+	int ret = 0;
-+	int i, j, iftype;
-+
-+	limits = kzalloc(sizeof(*limits) * wiphy->num_hw, GFP_KERNEL);
-+	if (!limits)
-+		return -ENOMEM;
-+
-+	n_limits = kzalloc(sizeof(*n_limits) * wiphy->num_hw, GFP_KERNEL);
-+	if (!n_limits) {
-+		kfree(limits);
-+		return -ENOMEM;
-+	}
-+
-+	for (i = 0; i < wiphy->num_hw; i++) {
-+		per_hw_comb = cfg80211_get_hw_iface_comb_by_idx(wiphy, c, i);
-+		if (!per_hw_comb) {
-+			ret = -EINVAL;
-+			goto out_free;
-+		}
-+
-+		limits[i] = kmemdup(per_hw_comb->limits,
-+				    per_hw_comb->n_limits *
-+				    sizeof(limits[i][0]), GFP_KERNEL);
-+		if (!limits[i]) {
-+			ret = -ENOMEM;
-+			goto out_free;
-+		}
-+
-+		n_limits[i] = per_hw_comb->n_limits;
-+	}
-+
-+	for (i = 0; i < wiphy->num_hw; i++) {
-+		per_hw_comb = cfg80211_get_hw_iface_comb_by_idx(wiphy, c, i);
-+		if (!per_hw_comb) {
-+			ret = -EINVAL;
-+			goto out_free;
-+		}
-+
-+		if (num_per_hw_ifaces[i] > per_hw_comb->max_interfaces) {
-+			ret = -EINVAL;
-+			goto out_free;
-+		}
-+
-+		if (params->per_hw[i].num_different_channels >
-+		    per_hw_comb->num_different_channels) {
-+			ret = -EINVAL;
-+			goto out_free;
-+		}
-+
-+		for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
-+			if (cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
-+				continue;
-+			for (j = 0; j < n_limits[i]; j++) {
-+				*all_iftypes |= limits[i][j].types;
-+				if (!(limits[i][j].types & BIT(iftype)))
-+					continue;
-+				if (limits[i][j].max <
-+				    params->per_hw[i].iftype_num[iftype]) {
-+					ret = -EINVAL;
-+					goto out_free;
-+				}
-+
-+				limits[i][j].max -=
-+					params->per_hw[i].iftype_num[iftype];
-+			}
-+		}
-+	}
-+
-+	memcpy(iftype_num, params->iftype_num, NUM_NL80211_IFTYPES);
-+	for (i = 0; i < wiphy->num_hw; i++) {
-+		u16 rem_iface;
-+		per_hw_comb = cfg80211_get_hw_iface_comb_by_idx(wiphy, c, i);
-+		if (!per_hw_comb) {
-+			ret = -EINVAL;
-+			goto out_free;
-+		}
-+
-+		/*
-+		 * we'll not be here in the first place if the numbre of per-hw
-+		 * interfaces are more than the advertised ones. So it is safe
-+		 * to ignore that error case here.
-+		 */
-+		rem_iface = per_hw_comb->max_interfaces - num_per_hw_ifaces[i];
-+		if (!rem_iface)
-+			continue;
-+
-+		/*
-+		 * check if the interfaces which are not yet assigned the
-+		 * operating channel can be accommodated with all the available
-+		 * per-hw interface combination advertisements.
-+		 */
-+		for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
-+			if (cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
-+				continue;
-+			if (!rem_iface)
-+				break;
-+			for (j = 0; j < n_limits[i]; j++) {
-+				u16 num_avail;
-+				if (!(limits[i][j].types & BIT(iftype)))
-+					continue;
-+				if (!rem_iface)
-+					break;
-+				num_avail = min(rem_iface, limits[i][j].max);
-+				if (num_avail < iftype_num[iftype]) {
-+					iftype_num[iftype] -= num_avail;
-+					rem_iface -= num_avail;
-+				} else {
-+					rem_iface -= iftype_num[iftype];
-+					iftype_num[iftype] = 0;
-+				}
-+			}
-+		}
-+	}
-+
-+	for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
-+		if (iftype_num[iftype]) {
-+			ret = -EINVAL;
-+			goto out_free;
-+		}
-+	}
-+
-+out_free:
-+	for (i = 0; i < wiphy->num_hw; i++)
-+		kfree(limits[i]);
-+
-+	kfree(n_limits);
-+	kfree(limits);
-+
-+	return ret;
-+}
-+
-+static int
-+cfg80211_validate_iface_comb_limits(struct wiphy *wiphy,
-+				    struct iface_combination_params *params,
-+				    const struct ieee80211_iface_combination *c,
-+				    int num_interfaces, u32 *all_iftypes)
-+{
-+	struct ieee80211_iface_limit *limits;
-+	int j, iftype;
-+	int ret = 0;
-+
-+	if (num_interfaces > c->max_interfaces)
-+		return -EINVAL;
-+	if (params->num_different_channels > c->num_different_channels)
-+		return -EINVAL;
-+
-+	limits = kmemdup(c->limits, sizeof(limits[0]) * c->n_limits,
-+			GFP_KERNEL);
-+	if (!limits)
-+		return -ENOMEM;
-+
-+	for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
-+		if (cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
-+			continue;
-+		for (j = 0; j < c->n_limits; j++) {
-+			*all_iftypes |= limits[j].types;
-+			if (!(limits[j].types & BIT(iftype)))
-+				continue;
-+			if (limits[j].max < params->iftype_num[iftype]) {
-+				ret = -EINVAL;
-+				goto out_free;
-+			}
-+			limits[j].max -= params->iftype_num[iftype];
-+		}
-+	}
-+out_free:
-+	kfree(limits);
-+	return ret;
-+}
-+
-+bool cfg80211_per_hw_iface_comb_advertised(struct wiphy *wiphy)
-+{
-+	int i;
-+
-+	for (i = 0; i < wiphy->n_iface_combinations; i++) {
-+		const struct ieee80211_iface_combination *c;
-+		c = &wiphy->iface_combinations[i];
-+		if (c->n_hw_list)
-+			return true;
-+	}
-+
-+	return false;
-+}
-+EXPORT_SYMBOL(cfg80211_per_hw_iface_comb_advertised);
-+
-+static bool
-+cfg80211_chan_supported_by_sub_hw(struct ieee80211_chans_per_hw *hw_chans,
-+				  const struct cfg80211_chan_def *chandef)
-+{
-+	int i;
-+
-+	for (i = 0; i < hw_chans->n_chans; i++)
-+		if (chandef->chan->center_freq ==
-+		    hw_chans->chans[i].center_freq)
-+			return true;
-+
-+	return false;
-+}
-+
-+int
-+cfg80211_get_hw_idx_by_chan(struct wiphy *wiphy,
-+			    const struct cfg80211_chan_def *chandef)
-+{
-+	int i;
-+
-+	if (!chandef)
-+		return -1;
-+
-+	if (!cfg80211_chandef_valid(chandef))
-+		return -1;
-+
-+	for (i = 0; i < wiphy->num_hw; i++) {
-+		if (cfg80211_chan_supported_by_sub_hw(wiphy->hw_chans[i],
-+						      chandef))
-+			return i;
-+	}
-+
-+	return -1;
-+}
-+EXPORT_SYMBOL(cfg80211_get_hw_idx_by_chan);
-+
- int cfg80211_iter_combinations(struct wiphy *wiphy,
- 			       struct iface_combination_params *params,
- 			       void (*iter)(const struct ieee80211_iface_combination *c,
--					    void *data),
-+					    void *data, int hw_chan_idx),
- 			       void *data)
- {
- 	const struct ieee80211_regdomain *regdom;
- 	enum nl80211_dfs_regions region = 0;
--	int i, j, iftype;
-+	int i, iftype;
- 	int num_interfaces = 0;
-+	int *num_per_hw_ifaces = NULL;
- 	u32 used_iftypes = 0;
- 	u32 beacon_int_gcd;
- 	bool beacon_int_different;
-+	bool per_hw_iface_comb_used;
-+	int hw_chan_idx = -1;
-+	int ret = 0;
- 
- 	/*
- 	 * This is a bit strange, since the iteration used to rely only on
-@@ -2239,50 +2491,66 @@ int cfg80211_iter_combinations(struct wi
- 		rcu_read_unlock();
- 	}
- 
-+	per_hw_iface_comb_used = cfg80211_per_hw_iface_comb_advertised(wiphy);
-+	if (per_hw_iface_comb_used) {
-+		num_per_hw_ifaces = kzalloc(sizeof(*num_per_hw_ifaces) *
-+					    wiphy->num_hw, GFP_KERNEL);
-+		if (!num_per_hw_ifaces)
-+			return -ENOMEM;
-+
-+		hw_chan_idx = cfg80211_get_hw_idx_by_chan(wiphy,
-+							  params->chandef);
-+	}
-+
- 	for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
- 		num_interfaces += params->iftype_num[iftype];
- 		if (params->iftype_num[iftype] > 0 &&
- 		    !cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
- 			used_iftypes |= BIT(iftype);
-+
-+		if (!per_hw_iface_comb_used)
-+			continue;
-+
-+		/* account per_hw interfaces, if advertised */
-+		for (i = 0; i < wiphy->num_hw; i++) {
-+			struct iface_comb_per_hw_params *per_hw;
-+			per_hw  = &params->per_hw[i];
-+			num_per_hw_ifaces[i] += per_hw->iftype_num[iftype];
-+			if (per_hw->iftype_num[iftype] > 0 &&
-+			    !cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
-+				used_iftypes |= BIT(iftype);
-+		}
- 	}
- 
- 	for (i = 0; i < wiphy->n_iface_combinations; i++) {
- 		const struct ieee80211_iface_combination *c;
--		struct ieee80211_iface_limit *limits;
- 		u32 all_iftypes = 0;
- 
- 		c = &wiphy->iface_combinations[i];
- 
--		if (num_interfaces > c->max_interfaces)
--			continue;
--		if (params->num_different_channels > c->num_different_channels)
--			continue;
-+		if (per_hw_iface_comb_used)
-+			ret = cfg80211_validate_per_hw_iface_comb_limits(wiphy,
-+								params, c,
-+								num_per_hw_ifaces,
-+								&all_iftypes);
-+		else
-+			ret = cfg80211_validate_iface_comb_limits(wiphy, params,
-+								  c,
-+								  num_interfaces,
-+								  &all_iftypes);
-+		if (ret == -ENOMEM)
-+			goto out_free;
- 
--		limits = kmemdup(c->limits, sizeof(limits[0]) * c->n_limits,
--				 GFP_KERNEL);
--		if (!limits)
--			return -ENOMEM;
--
--		for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
--			if (cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
--				continue;
--			for (j = 0; j < c->n_limits; j++) {
--				all_iftypes |= limits[j].types;
--				if (!(limits[j].types & BIT(iftype)))
--					continue;
--				if (limits[j].max < params->iftype_num[iftype])
--					goto cont;
--				limits[j].max -= params->iftype_num[iftype];
--			}
--		}
-+		if (ret)
-+			continue;
- 
- 		if (params->radar_detect !=
--			(c->radar_detect_widths & params->radar_detect))
--			goto cont;
-+		    (c->radar_detect_widths & params->radar_detect))
-+			continue;
- 
- 		if (params->radar_detect && c->radar_detect_regions &&
- 		    !(c->radar_detect_regions & BIT(region)))
--			goto cont;
-+			continue;
- 
- 		/* Finally check that all iftypes that we're currently
- 		 * using are actually part of this combination. If they
-@@ -2290,32 +2558,32 @@ int cfg80211_iter_combinations(struct wi
- 		 * to continue to the next.
- 		 */
- 		if ((all_iftypes & used_iftypes) != used_iftypes)
--			goto cont;
-+			continue;
- 
- 		if (beacon_int_gcd) {
- 			if (c->beacon_int_min_gcd &&
- 			    beacon_int_gcd < c->beacon_int_min_gcd)
--				goto cont;
-+				continue;
- 			if (!c->beacon_int_min_gcd && beacon_int_different)
--				goto cont;
-+				continue;
- 		}
- 
- 		/* This combination covered all interface types and
- 		 * supported the requested numbers, so we're good.
- 		 */
- 
--		(*iter)(c, data);
-- cont:
--		kfree(limits);
-+		(*iter)(c, data, hw_chan_idx);
- 	}
- 
--	return 0;
-+out_free:
-+	kfree(num_per_hw_ifaces);
-+	return ret;
- }
- EXPORT_SYMBOL(cfg80211_iter_combinations);
- 
- static void
- cfg80211_iter_sum_ifcombs(const struct ieee80211_iface_combination *c,
--			  void *data)
-+			  void *data, int hw_chan_idx)
- {
- 	int *num = data;
- 	(*num)++;
-@@ -2709,3 +2977,21 @@ cfg80211_get_iftype_ext_capa(struct wiph
- 	return NULL;
- }
- EXPORT_SYMBOL(cfg80211_get_iftype_ext_capa);
-+
-+bool
-+cfg80211_hw_chans_includes_dfs(const struct ieee80211_chans_per_hw *chans)
-+{
-+	int i;
-+
-+	for (i = 0; i < chans->n_chans; i++) {
-+		if (chans->chans[i].band == NL80211_BAND_5GHZ &&
-+		    ((chans->chans[i].center_freq >= 5250 &&
-+		     chans->chans[i].center_freq <= 5340) ||
-+		    (chans->chans[i].center_freq >= 5480 &&
-+		     chans->chans[i].center_freq <= 5720)))
-+			return true;
-+	}
-+
-+	return false;
-+}
-+EXPORT_SYMBOL(cfg80211_hw_chans_includes_dfs);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/702-ath11k-fix-memory-leak-in-dp-rx.patch b/package/kernel/mac80211/patches/ath11k_nss/702-ath11k-fix-memory-leak-in-dp-rx.patch
deleted file mode 100644
index 1bfa9b89b45c5f..00000000000000
--- a/package/kernel/mac80211/patches/ath11k_nss/702-ath11k-fix-memory-leak-in-dp-rx.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 9e4857cfe7f646c239fde030eb16b3d6520c34d8 Mon Sep 17 00:00:00 2001
-From: Hari Chandrakanthan <quic_haric@quicinc.com>
-Date: Fri, 6 Jan 2023 12:49:44 +0530
-Subject: [PATCH] ath11k: fix memory leak in dp rx
-
-In dp rx path, by default, fast_rx is set as true.
-And if peer supports fast rx, the frame is sent to upper layer
-through napi_gro_receive.
-
-If peer doesn't support fast rx, the frames need to be processed in
-ath11k_dp_rx_deliver_msdu and sent to mac80211 using ieee80211_rx_napi.
-In dp rx path, the api ath11k_dp_rx_h_mpdu checks whether peer supports
-fast rx.
-
-If peer find fails in ath11k_dp_rx_h_mpdu, the skb is not sent to network stack
-as well as mac80211. Because the argument fast_rx is not set to false in ath11k_dp_rx_h_mpdu
-when peer find fails.
-
-This can lead to memory leak.
-
-Fix it by setting argument fast_rx as false in ath11k_dp_rx_h_mpdu
-so that the skb is sent to mac80211 through ath11k_dp_rx_deliver_msdu.
-
-Signed-off-by: Hari Chandrakanthan <quic_haric@quicinc.com>
----
- drivers/net/wireless/ath/ath11k/dp_rx.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/ath/ath11k/dp_rx.c
-+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -2512,8 +2512,6 @@ static void ath11k_dp_rx_h_mpdu(struct a
- 			}
- 		}
- 
--		*fast_rx = false;
--
- 		if (rxcb->is_mcbc)
- 			enctype = peer->sec_type_grp;
- 		else
-@@ -2523,6 +2521,8 @@ static void ath11k_dp_rx_h_mpdu(struct a
- 	}
- 	spin_unlock_bh(&ar->ab->base_lock);
- 
-+	*fast_rx = false;
-+
- 	rx_attention = ath11k_dp_rx_get_attention(ar->ab, rx_desc);
- 	err_bitmap = ath11k_dp_rx_h_attn_mpdu_err(rx_attention);
- 	if (enctype != HAL_ENCRYPT_TYPE_OPEN && !err_bitmap)
diff --git a/package/kernel/mac80211/patches/ath11k_nss/718-e-mac80211-Deliver-the-frame-to-driver-tx-ops-directly.patch b/package/kernel/mac80211/patches/ath11k_nss/718-e-mac80211-Deliver-the-frame-to-driver-tx-ops-directly.patch
deleted file mode 100644
index 31db236d5fd4ef..00000000000000
--- a/package/kernel/mac80211/patches/ath11k_nss/718-e-mac80211-Deliver-the-frame-to-driver-tx-ops-directly.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From f37e9b4a68d32d03346cbfc3cb4178b186c8f2a4 Mon Sep 17 00:00:00 2001
-From: Ramanathan Choodamani <quic_rchoodam@quicinc.com>
-Date: Fri, 17 Feb 2023 03:08:29 -0800
-Subject: [PATCH 5/7] mac80211: Deliver the frame to driver tx ops
- directly
-
-Deliver the frame to driver directly in the forwarding path
-to improve the throughput performance.
-
-Reset the fast xmit flag in ieee80211 datapath to ensure
-other features handled as normal through the ath12k_dp_tx
-function
-
-Signed-off-by: Balamurugan Mahalingam <quic_bmahalin@quicinc.com>
-Signed-off-by: Ramanathan Choodamani <quic_rchoodam@quicinc.com>
----
- net/mac80211/tx.c | 13 ++++++++++++-
- 1 file changed, 12 insertions(+), 1 deletion(-)
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -4567,6 +4567,7 @@ netdev_tx_t ieee80211_subif_start_xmit(s
- #ifdef CPTCFG_MAC80211_NSS_SUPPORT
- 	ieee80211_xmit_nss_fixup(skb, dev);
- #endif
-+	skb->fast_xmit = 0;
- 
- 	if (likely(!is_multicast_ether_addr(eth->h_dest)))
- 		goto normal;
-@@ -4838,7 +4839,43 @@ void ieee80211_8023_xmit_ap(struct ieee8
- netdev_tx_t ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
- 					    struct net_device *dev)
- {
--	return __ieee80211_subif_start_xmit_8023(skb, dev, 0, 0, NULL);
-+	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-+	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-+	struct ieee80211_tx_control control = {};
-+	struct sta_info *sta;
-+	struct ieee80211_sta *pubsta = NULL;
-+
-+	info->control.vif = &sdata->vif;
-+
-+	if (skb->fast_xmit) {
-+		info->control.flags = u32_encode_bits(IEEE80211_LINK_UNSPECIFIED,
-+						      IEEE80211_TX_CTRL_MLO_LINK);
-+		info->flags = IEEE80211_TX_CTL_HW_80211_ENCAP;
-+
-+		if (hweight16(sdata->vif.valid_links) > 1) {
-+			rcu_read_lock();
-+
-+			if (ieee80211_lookup_ra_sta(sdata, skb, &sta)) {
-+				kfree_skb(skb);
-+				goto out;
-+			}
-+
-+			if (!IS_ERR_OR_NULL(sta) && sta->uploaded)
-+				pubsta = &sta->sta;
-+
-+			control.sta = pubsta;
-+			drv_tx(sdata->local, &control,  skb);
-+out:
-+			rcu_read_unlock();
-+		} else {
-+			control.sta = NULL;
-+			drv_tx(sdata->local, &control,  skb);
-+		}
-+
-+		return NETDEV_TX_OK;
-+	} else {
-+		return __ieee80211_subif_start_xmit_8023(skb, dev, 0, 0, NULL);
-+	}
- }
- 
- netdev_tx_t __ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
diff --git a/package/kernel/mac80211/patches/ath11k_nss/902-020-ath11k-add-btcoex-config.patch b/package/kernel/mac80211/patches/ath11k_nss/902-020-ath11k-add-btcoex-config.patch
deleted file mode 100644
index 495245f9662462..00000000000000
--- a/package/kernel/mac80211/patches/ath11k_nss/902-020-ath11k-add-btcoex-config.patch
+++ /dev/null
@@ -1,612 +0,0 @@
---- a/drivers/net/wireless/ath/ath11k/Makefile
-+++ b/drivers/net/wireless/ath/ath11k/Makefile
-@@ -17,7 +17,8 @@ ath11k-y += core.o \
- 	    peer.o \
- 	    dbring.o \
- 	    hw.o \
--	    pcic.o
-+	    pcic.o \
-+	    vendor.o
- 
- ath11k-$(CPTCFG_ATH11K_DEBUGFS) += debugfs.o debugfs_htt_stats.o debugfs_sta.o
- ath11k-$(CPTCFG_NL80211_TESTMODE) += testmode.o
---- a/drivers/net/wireless/ath/ath11k/core.h
-+++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -637,6 +637,16 @@ struct ath11k_per_peer_tx_stats {
- #define ATH11K_FLUSH_TIMEOUT (5 * HZ)
- #define ATH11K_VDEV_DELETE_TIMEOUT_HZ (5 * HZ)
- 
-+struct ath11k_coex_info {
-+	bool coex_support;
-+	u32 pta_num;
-+	u32 coex_mode;
-+	u32 bt_active_time_slot;
-+	u32 bt_priority_time_slot;
-+	u32 coex_algo_type;
-+	u32 pta_priority;
-+};
-+
- struct ath11k {
- 	struct ath11k_base *ab;
- 	struct ath11k_pdev *pdev;
-@@ -760,6 +770,8 @@ struct ath11k {
- 	struct ath11k_per_peer_tx_stats cached_stats;
- 	u32 last_ppdu_id;
- 	u32 cached_ppdu_id;
-+
-+	struct ath11k_coex_info coex;
- 	int monitor_vdev_id;
- 	struct completion fw_mode_reset;
- 	u8 ftm_msgref;
---- a/drivers/net/wireless/ath/ath11k/mac.c
-+++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -9,6 +9,7 @@
- #include <linux/etherdevice.h>
- #include <linux/bitfield.h>
- #include <linux/inetdevice.h>
-+#include <linux/of.h>
- #include <net/if_inet6.h>
- #include <net/ipv6.h>
- 
-@@ -24,6 +25,7 @@
- #include "debugfs_sta.h"
- #include "hif.h"
- #include "wow.h"
-+#include "vendor.h"
- #include "nss.h"
- 
- #define CHAN2G(_channel, _freq, _flags) { \
-@@ -9286,6 +9288,91 @@ err_fallback:
- 	return 0;
- }
- 
-+#define ATH11K_WLAN_PRIO_MAX	0x63
-+#define ATH11K_WLAN_PRIO_WEIGHT	0xff
-+
-+int ath11k_mac_coex_config(struct ath11k *ar, struct ath11k_vif *arvif,
-+			   int coex, u32 wlan_prio_mask, u8 wlan_weight)
-+{
-+	struct coex_config_arg coex_config;
-+	int ret;
-+
-+	if (ar->state != ATH11K_STATE_ON &&
-+	    ar->state != ATH11K_STATE_RESTARTED)
-+		return -ENETDOWN;
-+
-+	if (coex == -1 || !(test_bit(ATH11K_FLAG_BTCOEX, &ar->ab->dev_flags) ^ coex))
-+		goto next;
-+
-+	coex_config.vdev_id = arvif->vdev_id;
-+	if (coex == 1) {
-+		coex_config.config_type = WMI_COEX_CONFIG_PTA_INTERFACE;
-+		coex_config.pta_num = ar->coex.pta_num;
-+		coex_config.coex_mode = ar->coex.coex_mode;
-+		coex_config.bt_txrx_time = ar->coex.bt_active_time_slot;
-+		coex_config.bt_priority_time = ar->coex.bt_priority_time_slot;
-+		coex_config.pta_algorithm = ar->coex.coex_algo_type;
-+		coex_config.pta_priority = ar->coex.pta_priority;
-+		ret = ath11k_send_coex_config_cmd(ar, &coex_config);
-+		if (ret) {
-+			ath11k_warn(ar->ab,
-+				    "failed to set coex config vdev_id %d ret %d\n",
-+				    coex_config.vdev_id, ret);
-+			goto out;
-+		}
-+	}
-+
-+	memset(&coex_config, 0, sizeof(struct coex_config_arg));
-+	coex_config.vdev_id = arvif->vdev_id;
-+	coex_config.config_type = WMI_COEX_CONFIG_BTC_ENABLE;
-+	coex_config.coex_enable = coex;
-+	ret = ath11k_send_coex_config_cmd(ar, &coex_config);
-+	if (ret) {
-+		ath11k_warn(ar->ab,
-+			    "failed to set coex config vdev_id %d ret %d\n",
-+			    coex_config.vdev_id, ret);
-+		goto out;
-+	}
-+
-+	if (coex)
-+		set_bit(ATH11K_FLAG_BTCOEX, &ar->ab->dev_flags);
-+	else
-+		clear_bit(ATH11K_FLAG_BTCOEX, &ar->ab->dev_flags);
-+
-+next:
-+	if (!wlan_prio_mask) {
-+		ret = 0;
-+		goto out;
-+	}
-+
-+	if (!(test_bit(ATH11K_FLAG_BTCOEX, &ar->ab->dev_flags))) {
-+		ret = -EINVAL;
-+		goto out;
-+	}
-+
-+	if (wlan_prio_mask > ATH11K_WLAN_PRIO_MAX ||
-+	    wlan_weight > ATH11K_WLAN_PRIO_WEIGHT) {
-+		ret = -EINVAL;
-+		goto out;
-+	}
-+
-+	memset(&coex_config, 0, sizeof(struct coex_config_arg));
-+	coex_config.vdev_id = arvif->vdev_id;
-+	coex_config.config_type = WMI_COEX_CONFIG_WLAN_PKT_PRIORITY;
-+	coex_config.wlan_pkt_type = wlan_prio_mask;
-+	coex_config.wlan_pkt_weight = wlan_weight;
-+	ret = ath11k_send_coex_config_cmd(ar, &coex_config);
-+	if (ret) {
-+		ath11k_warn(ar->ab,
-+			    "failed to set coex config vdev_id %d ret %d\n",
-+			    coex_config.vdev_id, ret);
-+		goto out;
-+	}
-+
-+out:
-+	return ret;
-+}
-+
- static const struct ieee80211_ops ath11k_ops = {
- 	.tx				= ath11k_mac_op_tx,
- 	.wake_tx_queue			= ieee80211_handle_wake_tx_queue,
-@@ -9525,6 +9612,56 @@ static int ath11k_mac_setup_iface_combin
- 	return 0;
- }
- 
-+static void ath11k_mac_fetch_coex_info(struct ath11k *ar)
-+{
-+	struct ath11k_pdev_cap *cap = &ar->pdev->cap;
-+	struct ath11k_base *ab = ar->ab;
-+	struct device *dev = ab->dev;
-+
-+	ar->coex.coex_support = false;
-+
-+	if (!(cap->supported_bands & WMI_HOST_WLAN_2G_CAP))
-+		return;
-+
-+	if (of_property_read_u32(dev->of_node, "qcom,pta-num",
-+				&ar->coex.pta_num)) {
-+		ath11k_err(ab, "No qcom,pta_num entry in dev-tree.\n");
-+	}
-+
-+	if (of_property_read_u32(dev->of_node, "qcom,coex-mode",
-+				&ar->coex.coex_mode)) {
-+		ath11k_err(ab, "No qcom,coex_mode entry in dev-tree.\n");
-+	}
-+
-+	if (of_property_read_u32(dev->of_node, "qcom,bt-active-time",
-+				&ar->coex.bt_active_time_slot)) {
-+		ath11k_err(ab, "No qcom,bt-active-time entry in dev-tree.\n");
-+	}
-+
-+	if (of_property_read_u32(dev->of_node, "qcom,bt-priority-time",
-+				&ar->coex.bt_priority_time_slot)) {
-+		ath11k_err(ab, "No qcom,bt-priority-time entry in dev-tree.\n");
-+	}
-+
-+	if (of_property_read_u32(dev->of_node, "qcom,coex-algo",
-+				&ar->coex.coex_algo_type)) {
-+		ath11k_err(ab, "No qcom,coex-algo entry in dev-tree.\n");
-+	}
-+
-+	if (of_property_read_u32(dev->of_node, "qcom,pta-priority",
-+				&ar->coex.pta_priority)) {
-+		ath11k_err(ab, "No qcom,pta-priority entry in dev-tree.\n");
-+	}
-+
-+	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "coex pta_num %u coex_mode %u"
-+		   " bt_active_time_slot %u bt_priority_time_slot %u"
-+		   " coex_algorithm %u pta_priority %u\n", ar->coex.pta_num,
-+		   ar->coex.coex_mode, ar->coex.bt_active_time_slot,
-+		   ar->coex.bt_priority_time_slot, ar->coex.coex_algo_type,
-+		   ar->coex.pta_priority);
-+	ar->coex.coex_support = true;
-+}
-+
- static const u8 ath11k_if_types_ext_capa[] = {
- 	[0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING,
- 	[2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT,
-@@ -9786,6 +9923,7 @@ static int __ath11k_mac_register(struct
- 	ar->hw->wiphy->ema_max_profile_periodicity = TARGET_EMA_MAX_PROFILE_PERIOD;
- 
- 	ath11k_reg_init(ar);
-+	ath11k_vendor_register(ar);
- 
- 	if (!test_bit(ATH11K_FLAG_RAW_MODE, &ab->dev_flags)) {
- 		ar->hw->netdev_features = NETIF_F_HW_CSUM;
-@@ -9948,6 +10086,7 @@ int ath11k_mac_allocate(struct ath11k_ba
- 		 */
- 		ath11k_wmi_pdev_attach(ab, i);
- 
-+		ath11k_mac_fetch_coex_info(ar);
- 		ar->cfg_tx_chainmask = pdev->cap.tx_chain_mask;
- 		ar->cfg_rx_chainmask = pdev->cap.rx_chain_mask;
- 		ar->num_tx_chains = get_num_chains(pdev->cap.tx_chain_mask);
---- a/drivers/net/wireless/ath/ath11k/mac.h
-+++ b/drivers/net/wireless/ath/ath11k/mac.h
-@@ -150,8 +150,9 @@ void __ath11k_mac_scan_finish(struct ath
- void ath11k_mac_scan_finish(struct ath11k *ar);
- 
- struct ath11k_vif *ath11k_mac_get_arvif(struct ath11k *ar, u32 vdev_id);
--struct ath11k_vif *ath11k_mac_get_arvif_by_vdev_id(struct ath11k_base *ab,
--						   u32 vdev_id);
-+struct ath11k_vif *ath11k_mac_get_arvif_by_vdev_id(struct ath11k_base *ab, u32 vdev_id);
-+int ath11k_mac_coex_config(struct ath11k *ar, struct ath11k_vif *arvif,
-+			   int coex, u32 wlan_prio_mask, u8 wlan_weight);
- u8 ath11k_mac_get_target_pdev_id(struct ath11k *ar);
- u8 ath11k_mac_get_target_pdev_id_from_vif(struct ath11k_vif *arvif);
- struct ath11k_vif *ath11k_mac_get_vif_up(struct ath11k_base *ab);
---- /dev/null
-+++ b/drivers/net/wireless/ath/ath11k/vendor.c
-@@ -0,0 +1,121 @@
-+// SPDX-License-Identifier: ISC
-+/*
-+ * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
-+ */
-+
-+#include <net/netlink.h>
-+#include <net/mac80211.h>
-+#include "core.h"
-+#include "vendor.h"
-+#include "debug.h"
-+
-+static const struct nla_policy
-+ath11k_vendor_btcoex_config_policy[QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_MAX + 1] = {
-+	[QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_ENABLE] = { .type = NLA_U8 },
-+	[QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_WLAN_PRIORITY] = { .type = NLA_NESTED },
-+};
-+
-+static const struct nla_policy
-+ath11k_vendor_wlan_prio_policy[QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_MAX + 1] = {
-+	[QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_MASK] = { .type = NLA_U8 },
-+	[QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_WEIGHT] = { .type = NLA_U8 },
-+};
-+
-+static int ath11k_vendor_btcoex_configure(struct wiphy *wiphy,
-+					  struct wireless_dev *wdev,
-+					  const void *data,
-+					  int data_len)
-+{
-+	struct ieee80211_vif *vif;
-+	struct ath11k_vif *arvif;
-+	struct ath11k *ar;
-+	struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_MAX + 1];
-+	struct nlattr *tb_wlan_prio[QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_MAX + 1];
-+	struct nlattr *wlan_prio;
-+	enum qca_wlan_priority_type wlan_prio_mask = 0;
-+	int ret, coex = -1, rem_conf;
-+	u8 wlan_weight = 0;
-+
-+	if (!wdev)
-+		return -EINVAL;
-+
-+	vif = wdev_to_ieee80211_vif(wdev);
-+	if (!vif)
-+		return -EINVAL;
-+
-+	arvif = (struct ath11k_vif *)vif->drv_priv;
-+	if (!arvif)
-+		return -EINVAL;
-+
-+	ar = arvif->ar;
-+
-+	mutex_lock(&ar->conf_mutex);
-+
-+	ret = nla_parse(tb, QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_MAX, data, data_len,
-+			ath11k_vendor_btcoex_config_policy, NULL);
-+	if (ret) {
-+		ath11k_warn(ar->ab, "invalid BTCOEX config policy attribute\n");
-+		goto out;
-+	}
-+
-+	if (!tb[QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_ENABLE] &&
-+	    !tb[QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_WLAN_PRIORITY]) {
-+		ath11k_warn(ar->ab, "invalid BTCOEX config attributes\n");
-+		ret = -EINVAL;
-+		goto out;
-+	}
-+
-+	if (tb[QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_ENABLE]) {
-+		coex = nla_get_u8(tb[QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_ENABLE]);
-+		ret = ath11k_mac_coex_config(ar, arvif, coex, wlan_prio_mask, wlan_weight);
-+		if (ret)
-+			goto out;
-+	}
-+	if (tb[QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_WLAN_PRIORITY]) {
-+		nla_for_each_nested(wlan_prio,
-+				    tb[QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_WLAN_PRIORITY],
-+				    rem_conf) {
-+			ret =
-+			nla_parse_nested(tb_wlan_prio, QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_MAX,
-+					 wlan_prio, ath11k_vendor_wlan_prio_policy,
-+					 NULL);
-+			if (ret)
-+				goto out;
-+			wlan_prio_mask =
-+				nla_get_u8(tb_wlan_prio[QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_MASK]);
-+			if (tb_wlan_prio[QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_WEIGHT])
-+				wlan_weight =
-+				nla_get_u8(tb_wlan_prio[QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_WEIGHT]);
-+			ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
-+				   "BTCOEX enable %u WLAN Priority %u wlan weight %u\n",
-+				   coex, wlan_prio_mask, wlan_weight);
-+
-+			ret = ath11k_mac_coex_config(ar, arvif, coex, wlan_prio_mask, wlan_weight);
-+			if (ret)
-+				goto out;
-+		}
-+	}
-+
-+out:
-+	mutex_unlock(&ar->conf_mutex);
-+	return ret;
-+}
-+
-+static struct wiphy_vendor_command ath11k_vendor_commands[] = {
-+	{
-+		.info.vendor_id = QCA_NL80211_VENDOR_ID,
-+		.info.subcmd = QCA_NL80211_VENDOR_SUBCMD_BTCOEX_CONFIG,
-+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
-+			WIPHY_VENDOR_CMD_NEED_RUNNING,
-+		.doit = ath11k_vendor_btcoex_configure,
-+		.policy = ath11k_vendor_btcoex_config_policy
-+	}
-+};
-+
-+int ath11k_vendor_register(struct ath11k *ar)
-+{
-+	ar->hw->wiphy->vendor_commands = ath11k_vendor_commands;
-+	ar->hw->wiphy->n_vendor_commands = ARRAY_SIZE(ath11k_vendor_commands);
-+
-+	return 0;
-+}
---- /dev/null
-+++ b/drivers/net/wireless/ath/ath11k/vendor.h
-@@ -0,0 +1,83 @@
-+/* SPDX-License-Identifier: ISC */
-+/*
-+ * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
-+ */
-+
-+#ifndef ATH11K_VENDOR_H
-+#define ATH11K_VENDOR_H
-+
-+#define QCA_NL80211_VENDOR_ID 0x001374
-+
-+enum qca_nl80211_vendor_subcmds {
-+	/* QCA_NL80211_VENDOR_SUBCMD_BTCOEX_CONFIG: This command is used to
-+	 * enable/disable BTCOEX and set priority for different type of WLAN
-+	 * traffic over BT low priority traffic. This uses attributes in
-+	 * enum qca-vendor_attr_btcoex_config.
-+	 */
-+	QCA_NL80211_VENDOR_SUBCMD_BTCOEX_CONFIG = 182,
-+};
-+
-+/*
-+ * enum qca_wlan_priority_type - priority mask
-+ * This enum defines priority mask that user can configure
-+ * over BT traffic type which can be passed through
-+ * QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_WLAN_PRIORITY attribute.
-+ *
-+ * @QCA_WLAN_PRIORITY_BE: Bit mask for WLAN Best effort traffic
-+ * @QCA_WLAN_PRIORITY_BK: Bit mask for WLAN Background traffic
-+ * @QCA_WLAN_PRIORITY_VI: Bit mask for WLAN Video traffic
-+ * @QCA_WLAN_PRIORITY_VO: Bit mask for WLAN Voice traffic
-+ * @QCA_WLAN_PRIORITY_BEACON: Bit mask for WLAN BEACON frame
-+ * @QCA_WLAN_PRIORITY_MGMT: Bit mask for WLAN Management frame
-+*/
-+enum qca_wlan_priority_type {
-+	QCA_WLAN_PRIORITY_BE = BIT(0),
-+	QCA_WLAN_PRIORITY_BK = BIT(1),
-+	QCA_WLAN_PRIORITY_VI = BIT(2),
-+	QCA_WLAN_PRIORITY_VO = BIT(3),
-+	QCA_WLAN_PRIORITY_BEACON = BIT(4),
-+	QCA_WLAN_PRIORITY_MGMT = BIT(5),
-+};
-+
-+/**
-+ * enum qca_wlan_vendor_attr_wlan_prio - Used to configure
-+ * WLAN priority mask and its respective weight value.
-+ * @QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_MASK - This is u8 attribute
-+ * used to pass traffic type mask value see %qca_wlan_priority_type
-+ * @QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_WEIGHT - This is u8 attribute
-+ * accepts value between 0 and 255 and used to configure weight for
-+ * traffic type mentioned in %QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_MASK.
-+ */
-+enum qca_wlan_vendor_attr_wlan_prio {
-+       QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_INVALID = 0,
-+       QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_MASK = 1,
-+       QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_WEIGHT = 2,
-+
-+       QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_LAST,
-+       QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_MAX =
-+               QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_LAST - 1,
-+};
-+
-+
-+
-+/**
-+ * enum qca_wlan_vendor_attr_btcoex_config - Used by the vendor command
-+ * The use can enable/disable BTCOEX and configure WLAN priority for
-+ * different traffic type over BT.
-+ * QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_ENABLE, enable/disable BTCOEX
-+ * QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_WLAN_PRIORITY, This is a nested
-+ * attribute pass the attributes in %qca_wlan_vendor_attr_wlan_prio.
-+ */
-+enum qca_wlan_vendor_attr_btcoex_config {
-+	QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_INVALID = 0,
-+	QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_ENABLE = 1,
-+	QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_WLAN_PRIORITY = 2,
-+
-+	/* keep last */
-+	QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_LAST,
-+	QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_MAX =
-+		QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_LAST - 1
-+};
-+
-+int ath11k_vendor_register(struct ath11k *ar);
-+#endif /* QCA_VENDOR_H */
---- a/drivers/net/wireless/ath/ath11k/wmi.c
-+++ b/drivers/net/wireless/ath/ath11k/wmi.c
-@@ -1743,6 +1743,71 @@ int ath11k_wmi_vdev_set_param_cmd(struct
- 	return ret;
- }
- 
-+static void ath11k_wmi_copy_coex_config(struct ath11k *ar, struct wmi_coex_config_cmd *cmd,
-+				       struct coex_config_arg *coex_config)
-+{
-+	if (coex_config->config_type == WMI_COEX_CONFIG_BTC_ENABLE) {
-+		cmd->coex_enable = coex_config->coex_enable;
-+		ath11k_dbg(ar->ab, ATH11K_DBG_WMI,
-+			   "WMI coex config type %u vdev id %d  coex_enable %u\n",
-+			   coex_config->config_type, coex_config->vdev_id,
-+			   coex_config->coex_enable);
-+	}
-+
-+	if (coex_config->config_type == WMI_COEX_CONFIG_WLAN_PKT_PRIORITY) {
-+		cmd->wlan_pkt_type = coex_config->wlan_pkt_type;
-+		cmd->wlan_pkt_weight = coex_config->wlan_pkt_weight;
-+		ath11k_dbg(ar->ab, ATH11K_DBG_WMI,
-+			   "WMI coex config type %u vdev id %d  wlan pkt type 0x%x wlan pkt weight %u\n",
-+			   coex_config->config_type, coex_config->vdev_id,
-+			   coex_config->wlan_pkt_type, coex_config->wlan_pkt_weight);
-+	}
-+
-+	if (coex_config->config_type == WMI_COEX_CONFIG_PTA_INTERFACE) {
-+		cmd->pta_num = coex_config->pta_num;
-+		cmd->coex_mode = coex_config->coex_mode;
-+		cmd->bt_txrx_time = coex_config->bt_txrx_time;
-+		cmd->bt_priority_time = coex_config->bt_priority_time;
-+		cmd->pta_algorithm = coex_config->pta_algorithm;
-+		cmd->pta_priority = coex_config->pta_priority;
-+		ath11k_dbg(ar->ab, ATH11K_DBG_WMI,
-+			   "WMI coex config type %u vdev id %d  pta num %u coex mode %u bt_txrx_time %u bt_priority_time %u pta alogrithm %u pta priority %u\n",
-+			   coex_config->config_type, coex_config->vdev_id,
-+			   coex_config->pta_num, coex_config->coex_mode,
-+			   coex_config->bt_txrx_time, coex_config->bt_priority_time,
-+			   coex_config->pta_algorithm, coex_config->pta_priority);
-+	}
-+}
-+
-+int ath11k_send_coex_config_cmd(struct ath11k *ar,
-+				struct coex_config_arg *coex_config)
-+{
-+	struct ath11k_pdev_wmi *wmi = ar->wmi;
-+	struct wmi_coex_config_cmd *cmd;
-+	struct sk_buff *skb;
-+	int ret;
-+
-+	skb = ath11k_wmi_alloc_skb(wmi->wmi_ab, sizeof(*cmd));
-+	if (!skb)
-+		return -ENOMEM;
-+
-+	cmd = (struct wmi_coex_config_cmd *)skb->data;
-+	cmd->tlv_header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_COEX_CONFIG_CMD) |
-+			  FIELD_PREP(WMI_TLV_LEN, sizeof(*cmd) - TLV_HDR_SIZE);
-+
-+	cmd->vdev_id = coex_config->vdev_id;
-+	cmd->config_type = coex_config->config_type;
-+	ath11k_wmi_copy_coex_config(ar, cmd, coex_config);
-+
-+	ret = ath11k_wmi_cmd_send(wmi, skb, WMI_COEX_CONFIG_CMDID);
-+	if (ret) {
-+		ath11k_warn(ar->ab, "failed to send WMI_COEX_CONFIG_CMD cmd\n");
-+		dev_kfree_skb(skb);
-+	}
-+
-+	return ret;
-+}
-+
- int ath11k_wmi_send_stats_request_cmd(struct ath11k *ar,
- 				      struct stats_request_params *param)
- {
---- a/drivers/net/wireless/ath/ath11k/wmi.h
-+++ b/drivers/net/wireless/ath/ath11k/wmi.h
-@@ -5333,6 +5333,79 @@ struct wmi_wmm_params_arg {
- 	u8 no_ack;
- };
- 
-+enum wmi_coex_config_type {
-+	WMI_COEX_CONFIG_PAGE_P2P_TDM		= 1,
-+	WMI_COEX_CONFIG_PAGE_STA_TDM		= 2,
-+	WMI_COEX_CONFIG_PAGE_SAP_TDM		= 3,
-+	WMI_COEX_CONFIG_DURING_WLAN_CONN	= 4,
-+	WMI_COEX_CONFIG_BTC_ENABLE		= 5,
-+	WMI_COEX_CONFIG_COEX_DBG		= 6,
-+	WMI_COEX_CONFIG_PAGE_P2P_STA_TDM	= 7,
-+	WMI_COEX_CONFIG_INQUIRY_P2P_TDM		= 8,
-+	WMI_COEX_CONFIG_INQUIRY_STA_TDM		= 9,
-+	WMI_COEX_CONFIG_INQUIRY_SAP_TDM		= 10,
-+	WMI_COEX_CONFIG_INQUIRY_P2P_STA_TDM	= 11,
-+	WMI_COEX_CONFIG_TX_POWER		= 12,
-+	WMI_COEX_CONFIG_PTA_CONFIG		= 13,
-+	WMI_COEX_CONFIG_AP_TDM			= 14,
-+	WMI_COEX_CONFIG_WLAN_SCAN_PRIORITY	= 15,
-+	WMI_COEX_CONFIG_WLAN_PKT_PRIORITY	= 16,
-+	WMI_COEX_CONFIG_PTA_INTERFACE		= 17,
-+};
-+
-+struct coex_config_arg {
-+	u32 vdev_id;
-+        u32 config_type;
-+	union {
-+		struct {
-+			u32 coex_enable;
-+		};
-+
-+		struct {
-+			u32 pta_num;
-+			u32 coex_mode;
-+			u32 bt_txrx_time;
-+			u32 bt_priority_time;
-+			u32 pta_algorithm;
-+			u32 pta_priority;
-+		};
-+
-+		struct {
-+			u32 wlan_pkt_type;
-+			u32 wlan_pkt_type_continued;
-+			u32 wlan_pkt_weight;
-+			u32 bt_pkt_weight;
-+		};
-+	};
-+};
-+
-+struct wmi_coex_config_cmd {
-+	u32 tlv_header;
-+	u32 vdev_id;
-+        u32 config_type;
-+	union {
-+		struct {
-+			u32 coex_enable;
-+		} __packed;
-+
-+		struct {
-+			u32 pta_num;
-+			u32 coex_mode;
-+			u32 bt_txrx_time;
-+			u32 bt_priority_time;
-+			u32 pta_algorithm;
-+			u32 pta_priority;
-+		} __packed;
-+
-+		struct {
-+			u32 wlan_pkt_type;
-+			u32 wlan_pkt_type_continued;
-+			u32 wlan_pkt_weight;
-+			u32 bt_pkt_weight;
-+		} __packed;
-+	} __packed;
-+} __packed;
-+
- struct wmi_vdev_set_wmm_params_cmd {
- 	u32 tlv_header;
- 	u32 vdev_id;
-@@ -6553,6 +6626,8 @@ int ath11k_wmi_pdev_non_srg_obss_color_e
- 						     u32 *bitmap);
- int ath11k_wmi_pdev_non_srg_obss_bssid_enable_bitmap(struct ath11k *ar,
- 						     u32 *bitmap);
-+int ath11k_send_coex_config_cmd(struct ath11k *ar,
-+			       struct coex_config_arg *coex_config);
- int ath11k_wmi_send_obss_color_collision_cfg_cmd(struct ath11k *ar, u32 vdev_id,
- 						 u8 bss_color, u32 period,
- 						 bool enable);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/902-022-ath11k-add-ap-ps-support.patch b/package/kernel/mac80211/patches/ath11k_nss/902-022-ath11k-add-ap-ps-support.patch
deleted file mode 100644
index 52037816a113b1..00000000000000
--- a/package/kernel/mac80211/patches/ath11k_nss/902-022-ath11k-add-ap-ps-support.patch
+++ /dev/null
@@ -1,324 +0,0 @@
---- a/drivers/net/wireless/ath/ath11k/core.h
-+++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -30,6 +30,7 @@
- #include "spectral.h"
- #include "wow.h"
- #include "nss.h"
-+#include "vendor.h"
- 
- #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
- 
-@@ -637,6 +638,11 @@ struct ath11k_coex_info {
- 	u32 pta_priority;
- };
- 
-+enum ath11k_ap_ps_state {
-+	ATH11K_AP_PS_STATE_OFF,
-+	ATH11K_AP_PS_STATE_ON,
-+};
-+
- struct ath11k {
- 	struct ath11k_base *ab;
- 	struct ath11k_pdev *pdev;
-@@ -765,6 +771,8 @@ struct ath11k {
- 	int monitor_vdev_id;
- 	struct completion fw_mode_reset;
- 	u8 ftm_msgref;
-+	int ap_ps_enabled;
-+	enum ath11k_ap_ps_state ap_ps_state;
- #ifdef CPTCFG_ATH11K_DEBUGFS
- 	struct ath11k_debug debug;
- #endif
---- a/drivers/net/wireless/ath/ath11k/mac.c
-+++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -4963,6 +4963,33 @@ static void ath11k_mac_dec_num_stations(
- 	ar->num_stations--;
- }
- 
-+int ath11k_mac_ap_ps_recalc(struct ath11k *ar)
-+{
-+	struct ath11k_vif *arvif;
-+	bool has_sta_iface = false;
-+	enum ath11k_ap_ps_state state = ATH11K_AP_PS_STATE_OFF;
-+	int ret = 0;
-+
-+	list_for_each_entry(arvif, &ar->arvifs, list) {
-+		if (arvif->vdev_type == WMI_VDEV_TYPE_STA) {
-+			has_sta_iface = true;
-+			break;
-+		}
-+	}
-+
-+	if (!has_sta_iface && !ar->num_stations && ar->ap_ps_enabled)
-+		state = ATH11K_AP_PS_STATE_ON;
-+
-+	if (ar->ap_ps_state == state)
-+		return ret;
-+
-+	ret = ath11k_wmi_pdev_ap_ps_cmd_send(ar, ar->pdev->pdev_id, state);
-+	if (!ret)
-+		ar->ap_ps_state = state;
-+
-+	return ret;
-+}
-+
- static int ath11k_mac_station_add(struct ath11k *ar,
- 				  struct ieee80211_vif *vif,
- 				  struct ieee80211_sta *sta)
-@@ -5002,6 +5029,12 @@ static int ath11k_mac_station_add(struct
- 	ath11k_dbg(ab, ATH11K_DBG_MAC, "Added peer: %pM for VDEV: %d\n",
- 		   sta->addr, arvif->vdev_id);
- 
-+	ret = ath11k_mac_ap_ps_recalc(ar);
-+	if (ret) {
-+		ath11k_warn(ar->ab, "failed to send ap ps ret %d\n", ret);
-+		goto exit;
-+	}
-+
- 	if (ath11k_debugfs_is_extd_tx_stats_enabled(ar)) {
- 		arsta->tx_stats = kzalloc(sizeof(*arsta->tx_stats), GFP_KERNEL);
- 		if (!arsta->tx_stats) {
-@@ -5158,6 +5191,9 @@ static int ath11k_mac_op_sta_state(struc
- 
- 		kfree(arsta->tx_stats);
- 		arsta->tx_stats = NULL;
-+		ret = ath11k_mac_ap_ps_recalc(ar);
-+		if (ret)
-+			ath11k_warn(ar->ab, "failed to send ap ps ret %d\n", ret);
- 
- 		kfree(arsta->rx_stats);
- 		arsta->rx_stats = NULL;
-@@ -6566,6 +6602,7 @@ static void ath11k_mac_op_stop(struct ie
- 
- 	clear_bit(ATH11K_CAC_RUNNING, &ar->dev_flags);
- 	ar->state = ATH11K_STATE_OFF;
-+	ar->ap_ps_state = ATH11K_AP_PS_STATE_OFF;
- 	mutex_unlock(&ar->conf_mutex);
- 
- 	cancel_delayed_work_sync(&ar->scan.timeout);
-@@ -6973,7 +7010,6 @@ static int ath11k_mac_op_add_interface(s
- 			    arvif->vdev_id, ret);
- 		goto err;
- 	}
--
- 	ar->num_created_vdevs++;
- 	ath11k_dbg(ab, ATH11K_DBG_MAC, "vdev %pM created, vdev_id %d\n",
- 		   vif->addr, arvif->vdev_id);
-@@ -7120,6 +7156,10 @@ static int ath11k_mac_op_add_interface(s
- 				    ret);
- 	}
- 
-+	ret = ath11k_mac_ap_ps_recalc(ar);
-+	if (ret)
-+		ath11k_warn(ar->ab, "failed to set ap ps ret %d\n", ret);
-+
- 	mutex_unlock(&ar->conf_mutex);
- 
- 	return 0;
-@@ -7227,6 +7267,7 @@ err_vdev_del:
- 
- 	/* Recalc txpower for remaining vdev */
- 	ath11k_mac_txpower_recalc(ar);
-+	ath11k_mac_ap_ps_recalc(ar);
- 
- 	ath11k_debugfs_remove_interface(arvif);
- 
---- a/drivers/net/wireless/ath/ath11k/mac.h
-+++ b/drivers/net/wireless/ath/ath11k/mac.h
-@@ -135,6 +135,7 @@ void ath11k_mac_11d_scan_start(struct at
- void ath11k_mac_11d_scan_stop(struct ath11k *ar);
- void ath11k_mac_11d_scan_stop_all(struct ath11k_base *ab);
- 
-+int ath11k_mac_ap_ps_recalc(struct ath11k *ar);
- void ath11k_mac_destroy(struct ath11k_base *ab);
- void ath11k_mac_unregister(struct ath11k_base *ab);
- int ath11k_mac_register(struct ath11k_base *ab);
---- a/drivers/net/wireless/ath/ath11k/vendor.c
-+++ b/drivers/net/wireless/ath/ath11k/vendor.c
-@@ -6,7 +6,6 @@
- #include <net/netlink.h>
- #include <net/mac80211.h>
- #include "core.h"
--#include "vendor.h"
- #include "debug.h"
- 
- static const struct nla_policy
-@@ -21,6 +20,11 @@ ath11k_vendor_wlan_prio_policy[QCA_WLAN_
- 	[QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_WEIGHT] = { .type = NLA_U8 },
- };
- 
-+static const struct nla_policy
-+ath11k_vendor_set_wifi_config_policy[QCA_WLAN_VENDOR_ATTR_CONFIG_MAX + 1] = {
-+	[QCA_WLAN_VENDOR_ATTR_CONFIG_GTX] = {.type = NLA_FLAG}
-+};
-+
- static int ath11k_vendor_btcoex_configure(struct wiphy *wiphy,
- 					  struct wireless_dev *wdev,
- 					  const void *data,
-@@ -101,6 +105,51 @@ out:
- 	return ret;
- }
- 
-+static int ath11k_vendor_set_wifi_config(struct wiphy *wihpy,
-+					 struct wireless_dev *wdev,
-+					 const void *data,
-+					 int data_len)
-+{
-+	struct ieee80211_vif *vif;
-+	struct ath11k_vif *arvif;
-+	struct ath11k *ar;
-+	struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_CONFIG_MAX + 1];
-+	int ret = 0;
-+
-+	if (!wdev)
-+		return -EINVAL;
-+
-+	vif = wdev_to_ieee80211_vif(wdev);
-+	if (!vif)
-+		return -EINVAL;
-+
-+	arvif = (struct ath11k_vif*)vif->drv_priv;
-+	if (!arvif)
-+		return -EINVAL;
-+
-+	ar = arvif->ar;
-+
-+	mutex_lock(&ar->conf_mutex);
-+
-+	ret = nla_parse(tb, QCA_WLAN_VENDOR_ATTR_CONFIG_MAX, data, data_len,
-+			ath11k_vendor_set_wifi_config_policy, NULL);
-+	if (ret) {
-+		ath11k_warn(ar->ab, "invalid set wifi config policy attribute\n");
-+		goto exit;
-+	}
-+
-+	ar->ap_ps_enabled = nla_get_flag(tb[QCA_WLAN_VENDOR_ATTR_CONFIG_GTX]);
-+	ret = ath11k_mac_ap_ps_recalc(ar);
-+	if (ret) {
-+		ath11k_warn(ar->ab, "failed to send ap ps ret %d\n", ret);
-+		goto exit;
-+	}
-+
-+exit:
-+	mutex_unlock(&ar->conf_mutex);
-+	return ret;
-+}
-+
- static struct wiphy_vendor_command ath11k_vendor_commands[] = {
- 	{
- 		.info.vendor_id = QCA_NL80211_VENDOR_ID,
-@@ -108,8 +157,18 @@ static struct wiphy_vendor_command ath11
- 		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
- 			WIPHY_VENDOR_CMD_NEED_RUNNING,
- 		.doit = ath11k_vendor_btcoex_configure,
--		.policy = ath11k_vendor_btcoex_config_policy
--	}
-+		.policy = ath11k_vendor_btcoex_config_policy,
-+		.maxattr = QCA_WLAN_VENDOR_ATTR_BTCOEX_CONFIG_MAX
-+	},
-+	{
-+		.info.vendor_id = QCA_NL80211_VENDOR_ID,
-+		.info.subcmd = QCA_NL80211_VENDOR_SUBCMD_SET_WIFI_CONFIGURATION,
-+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
-+			WIPHY_VENDOR_CMD_NEED_RUNNING,
-+		.doit = ath11k_vendor_set_wifi_config,
-+		.policy = ath11k_vendor_set_wifi_config_policy,
-+		.maxattr = QCA_WLAN_VENDOR_ATTR_CONFIG_MAX
-+	},
- };
- 
- int ath11k_vendor_register(struct ath11k *ar)
---- a/drivers/net/wireless/ath/ath11k/vendor.h
-+++ b/drivers/net/wireless/ath/ath11k/vendor.h
-@@ -9,6 +9,9 @@
- #define QCA_NL80211_VENDOR_ID 0x001374
- 
- enum qca_nl80211_vendor_subcmds {
-+	/* Wi-Fi configuration subcommand */
-+	QCA_NL80211_VENDOR_SUBCMD_SET_WIFI_CONFIGURATION = 74,
-+
- 	/* QCA_NL80211_VENDOR_SUBCMD_BTCOEX_CONFIG: This command is used to
- 	 * enable/disable BTCOEX and set priority for different type of WLAN
- 	 * traffic over BT low priority traffic. This uses attributes in
-@@ -58,7 +61,17 @@ enum qca_wlan_vendor_attr_wlan_prio {
-                QCA_WLAN_VENDOR_ATTR_WLAN_PRIO_LAST - 1,
- };
- 
-+/* Attributes for data used by
-+ * QCA_NL80211_VENDOR_SUBCMD_SET_WIFI_CONFIGURATION
-+ */
-+enum qca_wlan_vendor_attr_config {
-+	QCA_WLAN_VENDOR_ATTR_CONFIG_GTX = 57,
- 
-+	/* keep last */
-+	QCA_WLAN_VENDOR_ATTR_CONFIG_AFTER_LAST,
-+	QCA_WLAN_VENDOR_ATTR_CONFIG_MAX =
-+		QCA_WLAN_VENDOR_ATTR_CONFIG_AFTER_LAST - 1,
-+};
- 
- /**
-  * enum qca_wlan_vendor_attr_btcoex_config - Used by the vendor command
---- a/drivers/net/wireless/ath/ath11k/wmi.c
-+++ b/drivers/net/wireless/ath/ath11k/wmi.c
-@@ -1446,6 +1446,38 @@ ath11k_wmi_rx_reord_queue_remove(struct
- 	return ret;
- }
- 
-+int ath11k_wmi_pdev_ap_ps_cmd_send(struct ath11k *ar, u8 pdev_id,
-+				   u32 param_value)
-+{
-+	struct ath11k_pdev_wmi *wmi = ar->wmi;
-+	struct wmi_pdev_ap_ps_cmd *cmd;
-+	struct sk_buff *skb;
-+	int ret;
-+
-+	skb = ath11k_wmi_alloc_skb(wmi->wmi_ab, sizeof(*cmd));
-+	if (!skb)
-+		return -ENOMEM;
-+
-+	cmd = (struct wmi_pdev_ap_ps_cmd *)skb->data;
-+	cmd->tlv_header = FIELD_PREP(WMI_TLV_TAG,
-+				     WMI_TAG_PDEV_GREEN_AP_PS_ENABLE_CMD) |
-+			  FIELD_PREP(WMI_TLV_LEN, sizeof(*cmd) - TLV_HDR_SIZE);
-+	cmd->pdev_id = pdev_id;
-+	cmd->param_value = param_value;
-+
-+	ret = ath11k_wmi_cmd_send(wmi, skb, WMI_PDEV_GREEN_AP_PS_ENABLE_CMDID);
-+	if (ret) {
-+		ath11k_warn(ar->ab, "failed to send ap ps enable/disable cmd\n");
-+		dev_kfree_skb(skb);
-+	}
-+
-+	ath11k_dbg(ar->ab, ATH11K_DBG_WMI,
-+		   "wmi pdev ap ps set pdev id %d value %d\n",
-+		   pdev_id, param_value);
-+
-+	return ret;
-+}
-+
- int ath11k_wmi_pdev_set_param(struct ath11k *ar, u32 param_id,
- 			      u32 param_value, u8 pdev_id)
- {
---- a/drivers/net/wireless/ath/ath11k/wmi.h
-+++ b/drivers/net/wireless/ath/ath11k/wmi.h
-@@ -3110,6 +3110,12 @@ struct set_fwtest_params {
- 	u32 value;
- };
- 
-+struct wmi_pdev_ap_ps_cmd {
-+	u32 tlv_header;
-+	u32 pdev_id;
-+	u32 param_value;
-+} __packed;
-+
- struct wmi_fwtest_set_param_cmd_param {
- 	u32 tlv_header;
- 	u32 param_id;
-@@ -6628,6 +6634,7 @@ int ath11k_wmi_pdev_non_srg_obss_bssid_e
- 						     u32 *bitmap);
- int ath11k_send_coex_config_cmd(struct ath11k *ar,
- 			       struct coex_config_arg *coex_config);
-+int ath11k_wmi_pdev_ap_ps_cmd_send(struct ath11k *ar, u8 pdev_id, u32 value);
- int ath11k_wmi_send_obss_color_collision_cfg_cmd(struct ath11k *ar, u32 vdev_id,
- 						 u8 bss_color, u32 period,
- 						 bool enable);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/904-300-ath11k-nss_get_arvif_from_dev.patch b/package/kernel/mac80211/patches/ath11k_nss/904-300-ath11k-nss_get_arvif_from_dev.patch
deleted file mode 100644
index 86812a1830d817..00000000000000
--- a/package/kernel/mac80211/patches/ath11k_nss/904-300-ath11k-nss_get_arvif_from_dev.patch
+++ /dev/null
@@ -1,113 +0,0 @@
-From fbe5a76d8c9ff1cf3f906a3c863928fc1adcbc95 Mon Sep 17 00:00:00 2001
-From: Karthikeyan Kathirvel <kathirve@codeaurora.org>
-Date: Tue, 16 Feb 2021 13:44:39 +0530
-Subject: [PATCH] ath11k: Add mesh nss offload support
-
-- New capability advertising nss offload support for mesh type
-- Mesh obj vap and link vap registration/clean up
-- Command/event handling
-- New .ch files in ath11k for nss mesh offload related debugs
-- Tx/Rx data path on mesh link vap uses native wifi format
-- Mesh obj vap handls packets in ether format. No Tx on Mesh
-  obj vap is expected as packets transmitted in slow path is
-  supposed to be encapsulated in 802.11 format.
-- New mac80211-driver callbacks for mesh vap, mpath and mpp
-  configurations.
-
-Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
-
-Change-Id: Ib6950344286ba18fab43586262c62dcd09557614
-Co-developed-by: Karthikeyan Kathirvel <kathirve@codeaurora.org>
-Signed-off-by: Karthikeyan Kathirvel <kathirve@codeaurora.org>
-Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
----
- drivers/net/wireless/ath/ath11k/nss.c       | 1482 ++++++++++++++++++++++++---
-
---- a/drivers/net/wireless/ath/ath11k/nss.c
-+++ b/drivers/net/wireless/ath/ath11k/nss.c
-@@ -35,6 +35,30 @@ ath11k_nss_get_vdev_opmode(struct ath11k
- 	return ATH11K_NSS_OPMODE_UNKNOWN;
- }
- 
-+static struct ath11k_vif *ath11k_nss_get_arvif_from_dev(struct net_device *dev)
-+{
-+	struct wireless_dev *wdev;
-+	struct ieee80211_vif *vif;
-+	struct ath11k_vif *arvif;
-+
-+	if (!dev)
-+		return NULL;
-+
-+	wdev = dev->ieee80211_ptr;
-+	if (!wdev)
-+		return NULL;
-+
-+	vif = wdev_to_ieee80211_vif(wdev);
-+	if (!vif)
-+		return NULL;
-+
-+	arvif = (struct ath11k_vif *)vif->drv_priv;
-+	if (!arvif)
-+		return NULL;
-+
-+	return arvif;
-+}
-+
- static void ath11k_nss_wifili_stats_sync(struct ath11k_base *ab,
- 					 struct nss_wifili_stats_sync_msg *wlsoc_stats)
- {
-@@ -294,6 +318,9 @@ void ath11k_nss_wifili_event_receive(str
- 
- 	switch (msg_type) {
- 	case NSS_WIFILI_INIT_MSG:
-+		ab->nss.response = response;
-+		complete(&ab->nss.complete);
-+		break;
- 	case NSS_WIFILI_PDEV_INIT_MSG:
- 	case NSS_WIFILI_START_MSG:
- 	case NSS_WIFILI_SOC_RESET_MSG:
-@@ -302,7 +329,6 @@ void ath11k_nss_wifili_event_receive(str
- 		ab->nss.response = response;
- 		complete(&ab->nss.complete);
- 		break;
--
- 	case NSS_WIFILI_PEER_CREATE_MSG:
- 		if (response != NSS_CMN_RESPONSE_EMSG)
- 			break;
-@@ -463,7 +489,9 @@ ath11k_nss_wifili_ext_callback_fn(struct
- 		ath11k_nss_process_mic_error(ab, skb);
- 		break;
- 	default:
--		kfree(skb);
-+		ath11k_dbg(ab, ATH11K_DBG_NSS, "unknown packet type received in wifili ext cb %d",
-+			    wepm->pkt_type);
-+		dev_kfree_skb_any(skb);
- 		break;
- 	}
- }
-@@ -785,24 +813,7 @@ ath11k_nss_vdev_special_data_receive(str
- 	int data_offs = 0;
- 	int ret = 0;
- 
--	if (!dev) {
--		dev_kfree_skb_any(skb);
--		return;
--	}
--
--	wdev = dev->ieee80211_ptr;
--	if (!wdev) {
--		dev_kfree_skb_any(skb);
--		return;
--	}
--
--	vif = wdev_to_ieee80211_vif(wdev);
--	if (!vif) {
--		dev_kfree_skb_any(skb);
--		return;
--	}
--
--	arvif = (struct ath11k_vif *)vif->drv_priv;
-+	arvif = ath11k_nss_get_arvif_from_dev(dev);
- 	if (!arvif) {
- 		dev_kfree_skb_any(skb);
- 		return;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/905-ath11k-add-support-memory-stats.patch b/package/kernel/mac80211/patches/ath11k_nss/905-ath11k-add-support-memory-stats.patch
deleted file mode 100644
index 734b6fb8c4b160..00000000000000
--- a/package/kernel/mac80211/patches/ath11k_nss/905-ath11k-add-support-memory-stats.patch
+++ /dev/null
@@ -1,946 +0,0 @@
-From 9c99e124a279391dbe2cef66226fd4e86bde8f4d Mon Sep 17 00:00:00 2001
-From: Maharaja Kennadyrajan <mkenna@codeaurora.org>
-Date: Mon, 4 Jan 2021 23:46:53 +0530
-Subject: [PATCH 1/2] ath11k/mac80211: Add support to account memory stats
-
-Memory allocations in the driver & mac80211 are logged
-and populate those values to the user space via debugfs.
-This stats will give the snapshot of the memory being
-used by the driver at the time of dumping these
-memory stats.
-
-Command:
-cat /sys/kernel/debug/ath11k/ipq8074\ hw2.0/memory_stats
-
-Sample output of the stats
-MEMORY STATS IN BYTES:
-malloc size : 6287583
-ce_ring_alloc size: 109308
-dma_alloc size:: 10831860
-htc_skb_alloc size: 3840
-wmi alloc size: 0
-per peer object: 4644
-rx_post_buf size: 5091840
-Total size: 22329075
-
-User can disable/enable the memory stats accounting with
-the below command.
-
-echo N > /sys/kernel/debug/ath11k/ipq8074\ hw2.0/enable_memory_stats
-where N = 0 to disable logging, 1 to enable the logging.
-
-Note: This should be enabled/disabled only after wifi is down.
-User shouldn't enable/disable when the wifi is up to avoid
-accounting the negative values which cause incorrect values
-in the memory stats.
-
-Command:
-
-cat /sys/kernel/debug/ieee80211/phyX/memory_stats
-memory stats: malloc_size: 108
-
-Signed-off-by: Maharaja Kennadyrajan <mkenna@codeaurora.org>
----
- drivers/net/wireless/ath/ath11k/ce.c          |  24 ++++
- drivers/net/wireless/ath/ath11k/core.c        |   2 +-
- drivers/net/wireless/ath/ath11k/core.h        |  19 +++
- drivers/net/wireless/ath/ath11k/dbring.c      |   3 +
- drivers/net/wireless/ath/ath11k/debugfs.c       | 115 ++++++++++++++++++
- drivers/net/wireless/ath/ath11k/debugfs.h       |  29 +++++
- drivers/net/wireless/ath/ath11k/debugfs_sta.c |   4 +
- drivers/net/wireless/ath/ath11k/dp.c          |  13 ++
- drivers/net/wireless/ath/ath11k/hal.c         |   6 +
- drivers/net/wireless/ath/ath11k/htc.c         |   5 +
- drivers/net/wireless/ath/ath11k/mac.c         |  15 ++-
- drivers/net/wireless/ath/ath11k/nss.c         |  46 +++++++
- drivers/net/wireless/ath/ath11k/peer.c        |   5 +
- drivers/net/wireless/ath/ath11k/wmi.c         |   4 +
- 15 files changed, 302 insertions(+), 3 deletions(-)
-
---- a/drivers/net/wireless/ath/ath11k/ce.c
-+++ b/drivers/net/wireless/ath/ath11k/ce.c
-@@ -359,6 +359,9 @@ static int ath11k_ce_rx_post_pipe(struct
- 			dev_kfree_skb_any(skb);
- 			goto exit;
- 		}
-+
-+		ATH11K_MEMORY_STATS_INC(ab, ce_rx_pipe, skb->truesize);
-+
- 	}
- 
- exit:
-@@ -427,6 +430,9 @@ static void ath11k_ce_recv_process_cb(st
- 	__skb_queue_head_init(&list);
- 	while (ath11k_ce_completed_recv_next(pipe, &skb, &nbytes) == 0) {
- 		max_nbytes = skb->len + skb_tailroom(skb);
-+
-+		ATH11K_MEMORY_STATS_DEC(ab, ce_rx_pipe, skb->truesize);
-+
- 		dma_unmap_single(ab->dev, ATH11K_SKB_RXCB(skb)->paddr,
- 				 max_nbytes, DMA_FROM_DEVICE);
- 
-@@ -620,6 +626,9 @@ ath11k_ce_alloc_ring(struct ath11k_base
- 	if (ce_ring == NULL)
- 		return ERR_PTR(-ENOMEM);
- 
-+	ATH11K_MEMORY_STATS_INC(ab, ce_ring_alloc,
-+				struct_size(ce_ring, skb, nentries));
-+
- 	ce_ring->nentries = nentries;
- 	ce_ring->nentries_mask = nentries - 1;
- 
-@@ -635,6 +644,9 @@ ath11k_ce_alloc_ring(struct ath11k_base
- 		return ERR_PTR(-ENOMEM);
- 	}
- 
-+	ATH11K_MEMORY_STATS_INC(ab, ce_ring_alloc,
-+				nentries * desc_sz + CE_DESC_RING_ALIGN);
-+
- 	ce_ring->base_addr_ce_space_unaligned = base_addr;
- 
- 	ce_ring->base_addr_owner_space = PTR_ALIGN(
-@@ -814,6 +826,9 @@ static void ath11k_ce_rx_pipe_cleanup(st
- 			continue;
- 
- 		ring->skb[i] = NULL;
-+
-+		ATH11K_MEMORY_STATS_DEC(ab, ce_rx_pipe, skb->truesize);
-+
- 		dma_unmap_single(ab->dev, ATH11K_SKB_RXCB(skb)->paddr,
- 				 skb->len + skb_tailroom(skb), DMA_FROM_DEVICE);
- 		dev_kfree_skb_any(skb);
-@@ -992,6 +1007,9 @@ void ath11k_ce_free_pipes(struct ath11k_
- 					  CE_DESC_RING_ALIGN,
- 					  ce_ring->base_addr_owner_space_unaligned,
- 					  ce_ring->base_addr_ce_space_unaligned);
-+			ATH11K_MEMORY_STATS_DEC(ab, ce_ring_alloc,
-+						pipe->src_ring->nentries * desc_sz +
-+						CE_DESC_RING_ALIGN);
- 			kfree(pipe->src_ring);
- 			pipe->src_ring = NULL;
- 		}
-@@ -1004,6 +1022,9 @@ void ath11k_ce_free_pipes(struct ath11k_
- 					  CE_DESC_RING_ALIGN,
- 					  ce_ring->base_addr_owner_space_unaligned,
- 					  ce_ring->base_addr_ce_space_unaligned);
-+			ATH11K_MEMORY_STATS_DEC(ab, ce_ring_alloc,
-+						pipe->dest_ring->nentries * desc_sz +
-+						CE_DESC_RING_ALIGN);
- 			kfree(pipe->dest_ring);
- 			pipe->dest_ring = NULL;
- 		}
-@@ -1017,6 +1038,9 @@ void ath11k_ce_free_pipes(struct ath11k_
- 					  CE_DESC_RING_ALIGN,
- 					  ce_ring->base_addr_owner_space_unaligned,
- 					  ce_ring->base_addr_ce_space_unaligned);
-+			ATH11K_MEMORY_STATS_DEC(ab, ce_ring_alloc,
-+						pipe->status_ring->nentries * desc_sz +
-+						CE_DESC_RING_ALIGN);
- 			kfree(pipe->status_ring);
- 			pipe->status_ring = NULL;
- 		}
---- a/drivers/net/wireless/ath/ath11k/core.c
-+++ b/drivers/net/wireless/ath/ath11k/core.c
-@@ -2144,6 +2144,8 @@ int ath11k_core_pre_init(struct ath11k_b
- 	if (nss_offload)
- 		ab->nss.stats_enabled = 1;
- 
-+	ab->enable_memory_stats = ATH11K_DEBUG_ENABLE_MEMORY_STATS;
-+
- 	return 0;
- }
- EXPORT_SYMBOL(ath11k_core_pre_init);
---- a/drivers/net/wireless/ath/ath11k/core.h
-+++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -930,6 +930,23 @@ struct ath11k_num_vdevs_peers {
-   u32 num_peers;
- };
- 
-+struct ath11k_memory_stats {
-+	/* Account kzalloc and valloc */
-+	atomic_t malloc_size;
-+	/* Account dma_alloc in dp.c & hal.c */
-+	atomic_t dma_alloc;
-+	/* Account memory used in ce rings */
-+	atomic_t ce_ring_alloc;
-+	/* Account memory used in htc_send */
-+	atomic_t htc_skb_alloc;
-+	/* Account memory used in wmi tx skb alloc */
-+	atomic_t wmi_tx_skb_alloc;
-+	/* Account memory consumed for peer object */
-+	atomic_t per_peer_object;
-+	/* Account memory used in ce rx pipe */
-+	atomic_t ce_rx_pipe;
-+};
-+
- /* Master structure to hold the hw data which may be used in core module */
- struct ath11k_base {
- 	enum ath11k_hw_rev hw_rev;
-@@ -1019,6 +1036,7 @@ struct ath11k_base {
- 	enum ath11k_dfs_region dfs_region;
- #ifdef CPTCFG_ATH11K_DEBUGFS
- 	struct dentry *debugfs_soc;
-+	struct ath11k_memory_stats memory_stats;
- #endif
- 	struct ath11k_soc_dp_stats soc_stats;
- 
-@@ -1085,6 +1103,7 @@ struct ath11k_base {
- 
- 	atomic_t num_max_allowed;
- 	struct ath11k_num_vdevs_peers *num_vdevs_peers;
-+	bool enable_memory_stats;
- 
- 	u32 rx_hash;
- 	bool stats_disable;
---- a/drivers/net/wireless/ath/ath11k/dbring.c
-+++ b/drivers/net/wireless/ath/ath11k/dbring.c
-@@ -143,6 +143,7 @@ static int ath11k_dbring_fill_bufs(struc
- 			break;
- 		}
- 		num_remain--;
-+		ATH11K_MEMORY_STATS_INC(ar->ab, malloc_size, size);
- 	}
- 
- 	spin_unlock_bh(&srng->lock);
-@@ -392,6 +393,8 @@ void ath11k_dbring_buf_cleanup(struct at
- 		idr_remove(&ring->bufs_idr, buf_id);
- 		dma_unmap_single(ar->ab->dev, buff->paddr,
- 				 ring->buf_sz, DMA_FROM_DEVICE);
-+		ATH11K_MEMORY_STATS_DEC(ar->ab, malloc_size, sizeof(*buff) +
-+					ring->buf_sz + ring->buf_align - 1);
- 		kfree(buff->payload);
- 		kfree(buff);
- 	}
---- a/drivers/net/wireless/ath/ath11k/debugfs.c
-+++ b/drivers/net/wireless/ath/ath11k/debugfs.c
-@@ -801,6 +801,8 @@ static ssize_t ath11k_debugfs_dump_soc_d
- 	if (!buf)
- 		return -ENOMEM;
- 
-+	ATH11K_MEMORY_STATS_INC(ab, malloc_size, size);
-+
- 	len += scnprintf(buf + len, size - len, "SOC RX STATS:\n\n");
- 	len += scnprintf(buf + len, size - len, "err ring pkts: %u\n",
- 			 soc_stats->err_ring_pkts);
-@@ -842,6 +844,8 @@ static ssize_t ath11k_debugfs_dump_soc_d
- 	retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
- 	kfree(buf);
- 
-+	ATH11K_MEMORY_STATS_DEC(ab, malloc_size, size);
-+
- 	return retval;
- }
- 
-@@ -1094,6 +1098,106 @@ static const struct file_operations fops
- 	.write = ath11k_write_stats_disable,
- };
- 
-+static ssize_t
-+ath11k_debug_read_enable_memory_stats(struct file *file,
-+				      char __user *user_buf,
-+				      size_t count, loff_t *ppos)
-+{
-+	struct ath11k_base *ab = file->private_data;
-+	char buf[10];
-+	size_t len;
-+
-+	len = scnprintf(buf, sizeof(buf), "%d\n", ab->enable_memory_stats);
-+
-+	return simple_read_from_buffer(user_buf, count, ppos, buf, len);
-+}
-+
-+static ssize_t
-+ath11k_debug_write_enable_memory_stats(struct file *file,
-+				       const char __user *ubuf,
-+				       size_t count, loff_t *ppos)
-+{
-+	struct ath11k_base *ab = file->private_data;
-+	bool enable;
-+	int ret;
-+
-+	if (kstrtobool_from_user(ubuf, count, &enable))
-+		return -EINVAL;
-+
-+	if (enable == ab->enable_memory_stats) {
-+		ret = count;
-+		goto exit;
-+	}
-+
-+	ab->enable_memory_stats = enable;
-+	ret = count;
-+exit:
-+	return ret;
-+}
-+
-+static const struct file_operations fops_enable_memory_stats = {
-+	.read = ath11k_debug_read_enable_memory_stats,
-+	.write = ath11k_debug_write_enable_memory_stats,
-+	.owner = THIS_MODULE,
-+	.llseek = default_llseek,
-+	.open = simple_open,
-+};
-+
-+static ssize_t ath11k_debug_dump_memory_stats(struct file *file,
-+					      char __user *user_buf,
-+					      size_t count, loff_t *ppos)
-+{
-+	struct ath11k_base *ab = file->private_data;
-+	struct ath11k_memory_stats *memory_stats = &ab->memory_stats;
-+	int len = 0, retval;
-+	const int size = 4096;
-+
-+	char *buf;
-+
-+	buf = kzalloc(size, GFP_KERNEL);
-+	if (!buf)
-+		return -ENOMEM;
-+
-+	len += scnprintf(buf + len, size - len, "MEMORY STATS IN BYTES:\n");
-+	len += scnprintf(buf + len, size - len, "malloc size : %u\n",
-+			 atomic_read(&memory_stats->malloc_size));
-+	len += scnprintf(buf + len, size - len, "ce_ring_alloc size: %u\n",
-+			 atomic_read(&memory_stats->ce_ring_alloc));
-+	len += scnprintf(buf + len, size - len, "dma_alloc size:: %u\n",
-+			 atomic_read(&memory_stats->dma_alloc));
-+	len += scnprintf(buf + len, size - len, "htc_skb_alloc size: %u\n",
-+			 atomic_read(&memory_stats->htc_skb_alloc));
-+	len += scnprintf(buf + len, size - len, "wmi tx skb alloc size: %u\n",
-+			 atomic_read(&memory_stats->wmi_tx_skb_alloc));
-+	len += scnprintf(buf + len, size - len, "per peer object: %u\n",
-+			 atomic_read(&memory_stats->per_peer_object));
-+	len += scnprintf(buf + len, size - len, "rx_post_buf size: %u\n",
-+			 atomic_read(&memory_stats->ce_rx_pipe));
-+	len += scnprintf(buf + len, size - len, "Total size: %u\n\n",
-+			 (atomic_read(&memory_stats->malloc_size) +
-+			 atomic_read(&memory_stats->ce_ring_alloc) +
-+			 atomic_read(&memory_stats->dma_alloc) +
-+			 atomic_read(&memory_stats->htc_skb_alloc) +
-+			 atomic_read(&memory_stats->wmi_tx_skb_alloc) +
-+			 atomic_read(&memory_stats->per_peer_object) +
-+			 atomic_read(&memory_stats->ce_rx_pipe)));
-+
-+	if (len > size)
-+		len = size;
-+
-+	retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-+	kfree(buf);
-+
-+	return retval;
-+}
-+
-+static const struct file_operations fops_memory_stats = {
-+	.read = ath11k_debug_dump_memory_stats,
-+	.open = simple_open,
-+	.owner = THIS_MODULE,
-+	.llseek = default_llseek,
-+};
-+
- int ath11k_debugfs_pdev_create(struct ath11k_base *ab)
- {
- 	if (test_bit(ATH11K_FLAG_REGISTERED, &ab->dev_flags))
-@@ -1112,6 +1216,12 @@ int ath11k_debugfs_pdev_create(struct at
- 	debugfs_create_file("rx_hash", 0600, ab->debugfs_soc, ab,
- 			    &fops_soc_rx_hash);
- 
-+	debugfs_create_file("enable_memory_stats", 0600, ab->debugfs_soc,
-+			    ab, &fops_enable_memory_stats);
-+
-+	debugfs_create_file("memory_stats", 0600, ab->debugfs_soc, ab,
-+			    &fops_memory_stats);
-+
- 
- 	return 0;
- }
-@@ -1742,6 +1852,8 @@ static ssize_t ath11k_dump_mgmt_stats(st
- 	if (!buf)
- 		return -ENOMEM;
- 
-+	ATH11K_MEMORY_STATS_INC(ar->ab, malloc_size, size);
-+
- 	mutex_lock(&ar->conf_mutex);
- 	spin_lock_bh(&ar->data_lock);
- 
-@@ -1792,6 +1904,9 @@ static ssize_t ath11k_dump_mgmt_stats(st
- 	ret = simple_read_from_buffer(ubuf, count, ppos, buf, len);
- 	mutex_unlock(&ar->conf_mutex);
- 	kfree(buf);
-+
-+	ATH11K_MEMORY_STATS_DEC(ar->ab, malloc_size, size);
-+
- 	return ret;
- }
- 
---- a/drivers/net/wireless/ath/ath11k/debugfs.h
-+++ b/drivers/net/wireless/ath/ath11k/debugfs.h
-@@ -10,6 +10,7 @@
- 
- #define ATH11K_TX_POWER_MAX_VAL	70
- #define ATH11K_TX_POWER_MIN_VAL	0
-+#define ATH11K_DEBUG_ENABLE_MEMORY_STATS 1
- 
- /* htt_dbg_ext_stats_type */
- enum ath11k_dbg_htt_ext_stats_type {
-@@ -263,6 +264,24 @@ struct ath11k_fw_dbglog {
- };
- 
- #ifdef CPTCFG_ATH11K_DEBUGFS
-+#define ATH11K_MEMORY_STATS_INC(_struct, _field, _size)			\
-+do {									\
-+	if (ath11k_debug_is_memory_stats_enabled(_struct)) 		\
-+		atomic_add(_size, &_struct->memory_stats._field);	\
-+} while(0)
-+
-+#define ATH11K_MEMORY_STATS_DEC(_struct, _field, _size)			\
-+do {									\
-+	if (ath11k_debug_is_memory_stats_enabled(_struct))		\
-+		atomic_sub(_size, &_struct->memory_stats._field);	\
-+} while(0)
-+
-+#else
-+#define ATH11K_MEMORY_STATS_INC(_struct, _field, _size)
-+#define ATH11K_MEMORY_STATS_DEC(_struct, _field, _size)
-+#endif
-+
-+#ifdef CPTCFG_ATH11K_DEBUGFS
- int ath11k_debugfs_soc_create(struct ath11k_base *ab);
- void ath11k_debugfs_soc_destroy(struct ath11k_base *ab);
- int ath11k_debugfs_pdev_create(struct ath11k_base *ab);
-@@ -313,6 +332,11 @@ void ath11k_debugfs_add_dbring_entry(str
- 				     enum ath11k_dbg_dbr_event event,
- 				     struct hal_srng *srng);
- 
-+static inline int ath11k_debug_is_memory_stats_enabled(struct ath11k_base *ab)
-+{
-+	return ab->enable_memory_stats;
-+}
-+
- #else
- static inline int ath11k_debugfs_soc_create(struct ath11k_base *ab)
- {
-@@ -375,6 +399,11 @@ static inline bool ath11k_debugfs_is_pkt
- 	return false;
- }
- 
-+static inline int ath11k_debug_is_memory_stats_enabled(struct ath11k_base *ab)
-+{
-+	return 0;
-+}
-+
- static inline int ath11k_debugfs_rx_filter(struct ath11k *ar)
- {
- 	return 0;
---- a/drivers/net/wireless/ath/ath11k/debugfs_sta.c
-+++ b/drivers/net/wireless/ath/ath11k/debugfs_sta.c
-@@ -468,6 +468,8 @@ static ssize_t ath11k_dbg_sta_dump_rx_st
- 	retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
- 	kfree(buf);
- 
-+	ATH11K_MEMORY_STATS_DEC(ar->ab, malloc_size, size);
-+
- 	mutex_unlock(&ar->conf_mutex);
- 	return retval;
- }
---- a/drivers/net/wireless/ath/ath11k/dp.c
-+++ b/drivers/net/wireless/ath/ath11k/dp.c
-@@ -115,6 +115,8 @@ void ath11k_dp_srng_cleanup(struct ath11
- 		dma_free_coherent(ab->dev, ring->size, ring->vaddr_unaligned,
- 				  ring->paddr_unaligned);
- 
-+	ATH11K_MEMORY_STATS_DEC(ab, dma_alloc, ring->size);
-+
- 	ring->vaddr_unaligned = NULL;
- }
- 
-@@ -278,6 +280,8 @@ int ath11k_dp_srng_setup(struct ath11k_b
- 	if (!ring->vaddr_unaligned)
- 		return -ENOMEM;
- 
-+	ATH11K_MEMORY_STATS_INC(ab, dma_alloc, ring->size);
-+
- 	ring->vaddr = PTR_ALIGN(ring->vaddr_unaligned, HAL_RING_BASE_ALIGN);
- 	ring->paddr = ring->paddr_unaligned + ((unsigned long)ring->vaddr -
- 		      (unsigned long)ring->vaddr_unaligned);
-@@ -514,6 +518,7 @@ static void ath11k_dp_scatter_idle_link_
- 		dma_free_coherent(ab->dev, HAL_WBM_IDLE_SCATTER_BUF_SIZE_MAX,
- 				  slist[i].vaddr, slist[i].paddr);
- 		slist[i].vaddr = NULL;
-+		ATH11K_MEMORY_STATS_DEC(ab, dma_alloc, HAL_WBM_IDLE_SCATTER_BUF_SIZE_MAX);
- 	}
- }
- 
-@@ -551,6 +556,7 @@ static int ath11k_dp_scatter_idle_link_d
- 			ret = -ENOMEM;
- 			goto err;
- 		}
-+		ATH11K_MEMORY_STATS_INC(ab, dma_alloc, HAL_WBM_IDLE_SCATTER_BUF_SIZE_MAX);
- 	}
- 
- 	scatter_idx = 0;
-@@ -605,6 +611,7 @@ ath11k_dp_link_desc_bank_free(struct ath
- 					  link_desc_banks[i].vaddr_unaligned,
- 					  link_desc_banks[i].paddr_unaligned);
- 			link_desc_banks[i].vaddr_unaligned = NULL;
-+			ATH11K_MEMORY_STATS_DEC(ab, dma_alloc, link_desc_banks[i].size);
- 		}
- 	}
- }
-@@ -638,6 +645,7 @@ static int ath11k_dp_link_desc_bank_allo
- 				     ((unsigned long)desc_bank[i].vaddr -
- 				      (unsigned long)desc_bank[i].vaddr_unaligned);
- 		desc_bank[i].size = desc_sz;
-+		ATH11K_MEMORY_STATS_INC(ab, dma_alloc, desc_bank[i].size);
- 	}
- 
- 	return 0;
-@@ -1042,8 +1050,11 @@ static int ath11k_dp_tx_pending_cleanup(
- void ath11k_dp_free(struct ath11k_base *ab)
- {
- 	struct ath11k_dp *dp = &ab->dp;
-+	size_t size = 0;
- 	int i;
- 
-+	size = sizeof(struct hal_wbm_release_ring) * DP_TX_COMP_RING_SIZE;
-+
- 	ath11k_dp_link_desc_cleanup(ab, dp->link_desc_banks,
- 				    HAL_WBM_IDLE_LINK, &dp->wbm_idle_ring);
- 
-@@ -1057,6 +1068,7 @@ void ath11k_dp_free(struct ath11k_base *
- 			     ath11k_dp_tx_pending_cleanup, ab);
- 		idr_destroy(&dp->tx_ring[i].txbuf_idr);
- 		spin_unlock_bh(&dp->tx_ring[i].tx_idr_lock);
-+		ATH11K_MEMORY_STATS_DEC(ab, malloc_size, size);
- 		kfree(dp->tx_ring[i].tx_status);
- 	}
- 
-@@ -1114,6 +1126,7 @@ int ath11k_dp_alloc(struct ath11k_base *
- 			ret = -ENOMEM;
- 			goto fail_cmn_srng_cleanup;
- 		}
-+		ATH11K_MEMORY_STATS_INC(ab, malloc_size, size);
- 	}
- 
- 	for (i = 0; i < HAL_DSCP_TID_MAP_TBL_NUM_ENTRIES_MAX; i++)
---- a/drivers/net/wireless/ath/ath11k/hal.c
-+++ b/drivers/net/wireless/ath/ath11k/hal.c
-@@ -201,6 +201,8 @@ static int ath11k_hal_alloc_cont_rdp(str
- 	if (!hal->rdp.vaddr)
- 		return -ENOMEM;
- 
-+	ATH11K_MEMORY_STATS_INC(ab, dma_alloc, size);
-+
- 	return 0;
- }
- 
-@@ -215,6 +217,7 @@ static void ath11k_hal_free_cont_rdp(str
- 	size = sizeof(u32) * HAL_SRNG_RING_ID_MAX;
- 	dma_free_coherent(ab->dev, size,
- 			  hal->rdp.vaddr, hal->rdp.paddr);
-+	ATH11K_MEMORY_STATS_DEC(ab, dma_alloc, size);
- 	hal->rdp.vaddr = NULL;
- }
- 
-@@ -229,6 +232,8 @@ static int ath11k_hal_alloc_cont_wrp(str
- 	if (!hal->wrp.vaddr)
- 		return -ENOMEM;
- 
-+	ATH11K_MEMORY_STATS_INC(ab, dma_alloc, size);
-+
- 	return 0;
- }
- 
-@@ -243,6 +248,7 @@ static void ath11k_hal_free_cont_wrp(str
- 	size = sizeof(u32) * HAL_SRNG_NUM_LMAC_RINGS;
- 	dma_free_coherent(ab->dev, size,
- 			  hal->wrp.vaddr, hal->wrp.paddr);
-+	ATH11K_MEMORY_STATS_DEC(ab, dma_alloc, size);
- 	hal->wrp.vaddr = NULL;
- }
- 
---- a/drivers/net/wireless/ath/ath11k/htc.c
-+++ b/drivers/net/wireless/ath/ath11k/htc.c
-@@ -28,6 +28,7 @@ struct sk_buff *ath11k_htc_alloc_skb(str
- static void ath11k_htc_control_tx_complete(struct ath11k_base *ab,
- 					   struct sk_buff *skb)
- {
-+	ATH11K_MEMORY_STATS_DEC(ab, htc_skb_alloc, skb->truesize);
- 	kfree_skb(skb);
- }
- 
-@@ -609,6 +610,7 @@ int ath11k_htc_connect_service(struct at
- 	bool disable_credit_flow_ctrl = false;
- 	u16 message_id, service_id, flags = 0;
- 	u8 tx_alloc = 0;
-+	size_t truesize;
- 
- 	/* special case for HTC pseudo control service */
- 	if (conn_req->service_id == ATH11K_HTC_SVC_ID_RSVD_CTRL) {
-@@ -632,6 +634,7 @@ int ath11k_htc_connect_service(struct at
- 		return -ENOMEM;
- 	}
- 
-+	truesize = skb->truesize;
- 	length = sizeof(*req_msg);
- 	skb_put(skb, length);
- 	memset(skb->data, 0, length);
-@@ -667,6 +670,8 @@ int ath11k_htc_connect_service(struct at
- 		return status;
- 	}
- 
-+	ATH11K_MEMORY_STATS_INC(ab, htc_skb_alloc, truesize);
-+
- 	/* wait for response */
- 	time_left = wait_for_completion_timeout(&htc->ctl_resp,
- 						ATH11K_HTC_CONN_SVC_TIMEOUT_HZ);
-@@ -768,11 +773,13 @@ int ath11k_htc_start(struct ath11k_htc *
- 	int status = 0;
- 	struct ath11k_base *ab = htc->ab;
- 	struct ath11k_htc_setup_complete_extended *msg;
-+	size_t truesize;
- 
- 	skb = ath11k_htc_build_tx_ctrl_skb(htc->ab);
- 	if (!skb)
- 		return -ENOMEM;
- 
-+	truesize = skb->truesize;
- 	skb_put(skb, sizeof(*msg));
- 	memset(skb->data, 0, skb->len);
- 
-@@ -791,6 +798,8 @@ int ath11k_htc_start(struct ath11k_htc *
- 		return status;
- 	}
- 
-+	 ATH11K_MEMORY_STATS_INC(ab, htc_skb_alloc, truesize);
-+
- 	return 0;
- }
- 
---- a/drivers/net/wireless/ath/ath11k/mac.c
-+++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -4058,6 +4058,8 @@ static int ath11k_mac_op_hw_scan(struct
- 		goto exit;
- 	}
- 
-+	ATH11K_MEMORY_STATS_INC(ar->ab, malloc_size, sizeof(*arg));
-+
- 	ath11k_wmi_start_scan_init(ar, arg);
- 	arg->vdev_id = arvif->vdev_id;
- 	arg->scan_id = ATH11K_SCAN_ID;
-@@ -4071,6 +4073,8 @@ static int ath11k_mac_op_hw_scan(struct
- 		arg->extraie.len = req->ie_len;
- 	}
- 
-+	ATH11K_MEMORY_STATS_INC(ar->ab, malloc_size, req->ie_len);
-+
- 	if (req->n_ssids) {
- 		arg->num_ssids = req->n_ssids;
- 		for (i = 0; i < arg->num_ssids; i++) {
-@@ -4157,9 +4161,16 @@ static int ath11k_mac_op_hw_scan(struct
- exit:
- 	if (arg) {
- 		kfree(arg->chan_list);
--		kfree(arg->extraie.ptr);
--		kfree(arg);
--	}
-+
-+		if (arg->extraie.ptr) {
-+			ATH11K_MEMORY_STATS_DEC(ar->ab, malloc_size, req->ie_len);
-+			kfree(arg->extraie.ptr);
-+		}
-+
-+		ATH11K_MEMORY_STATS_DEC(ar->ab, malloc_size, sizeof(*arg));
-+
-+ 		kfree(arg);
-+ 	}
- 
- 	mutex_unlock(&ar->conf_mutex);
- 
-@@ -8113,6 +8124,8 @@ ath11k_mac_update_active_vif_chan(struct
- 	if (!arg.vifs)
- 		return;
- 
-+	ATH11K_MEMORY_STATS_INC(ar->ab, malloc_size, sizeof(arg.vifs[0]));
-+
- 	ieee80211_iterate_active_interfaces_atomic(ar->hw,
- 						   IEEE80211_IFACE_ITER_NORMAL,
- 						   ath11k_mac_change_chanctx_fill_iter,
-@@ -8120,6 +8133,8 @@ ath11k_mac_update_active_vif_chan(struct
- 
- 	ath11k_mac_update_vif_chan(ar, arg.vifs, arg.n_vifs);
- 
-+	ATH11K_MEMORY_STATS_DEC(ar->ab, malloc_size, sizeof(arg.vifs[0]));
-+
- 	kfree(arg.vifs);
- }
- 
---- a/drivers/net/wireless/ath/ath11k/nss.c
-+++ b/drivers/net/wireless/ath/ath11k/nss.c
-@@ -1052,6 +1052,9 @@ int ath11k_nss_vdev_set_cmd(struct ath11
- 	default:
- 		return -EINVAL;
- 	}
-+
-+	ATH11K_MEMORY_STATS_INC(ar->ab, malloc_size, sizeof(*vdev_msg));
-+
- 	/* TODO: Convert to function for conversion in case of many
- 	 * such commands
- 	 */
-@@ -1082,6 +1085,7 @@ int ath11k_nss_vdev_set_cmd(struct ath11
- 	ath11k_dbg(ar->ab, ATH11K_DBG_NSS, "nss vdev set cmd success cmd:%d val:%d\n",
- 		   cmd, val);
- free:
-+	ATH11K_MEMORY_STATS_DEC(ar->ab, malloc_size, sizeof(*vdev_msg));
- 	kfree(vdev_msg);
- 	return status;
- }
-@@ -1098,6 +1102,9 @@ static int ath11k_nss_vdev_configure(str
- 	if (!vdev_msg)
- 		return -ENOMEM;
- 
-+	ATH11K_MEMORY_STATS_INC(ar->ab, malloc_size,
-+				sizeof(struct nss_wifi_vdev_msg));
-+
- 	vdev_cfg = &vdev_msg->msg.vdev_config;
- 
- 	vdev_cfg->radio_ifnum = ar->nss.if_num;
-@@ -1133,6 +1140,8 @@ static int ath11k_nss_vdev_configure(str
- 
- 	ret = 0;
- free:
-+	ATH11K_MEMORY_STATS_DEC(ar->ab, malloc_size,
-+				sizeof(struct nss_wifi_vdev_msg));
- 	kfree(vdev_msg);
- 
- 	return ret;
-@@ -1357,6 +1366,9 @@ int ath11k_nss_vdev_up(struct ath11k_vif
- 	if (!vdev_msg)
- 		return -ENOMEM;
- 
-+	ATH11K_MEMORY_STATS_INC(ar->ab, malloc_size,
-+				sizeof(struct nss_wifi_vdev_msg));
-+
- 	vdev_en = &vdev_msg->msg.vdev_enable;
- 
- 	ether_addr_copy(vdev_en->mac_addr, arvif->vif->addr);
-@@ -1381,6 +1393,8 @@ int ath11k_nss_vdev_up(struct ath11k_vif
- 			if (ap_vlan_arvif->nss.added)
- 				ath11k_nss_ext_vdev_up(ap_vlan_arvif);
- free:
-+	ATH11K_MEMORY_STATS_DEC(ar->ab, malloc_size,
-+				sizeof(struct nss_wifi_vdev_msg));
- 	kfree(vdev_msg);
- 	return ret;
- }
-@@ -1404,6 +1418,8 @@ int ath11k_nss_vdev_down(struct ath11k_v
- 	if (!vdev_msg)
- 		return -ENOMEM;
- 
-+	ATH11K_MEMORY_STATS_INC(ar->ab, malloc_size,
-+				sizeof(struct nss_wifi_vdev_msg));
- 	nss_wifi_vdev_msg_init(vdev_msg, arvif->nss.if_num,
- 			       NSS_WIFI_VDEV_INTERFACE_DOWN_MSG,
- 			       sizeof(struct nss_wifi_vdev_disable_msg),
-@@ -1423,6 +1439,8 @@ int ath11k_nss_vdev_down(struct ath11k_v
-                                          list)
- 			ath11k_nss_ext_vdev_down(ap_vlan_arvif);
- free:
-+	ATH11K_MEMORY_STATS_DEC(ar->ab, malloc_size,
-+				sizeof(struct nss_wifi_vdev_msg));
- 	kfree(vdev_msg);
- 	return ret;
- }
-@@ -1875,6 +1893,9 @@ int ath11k_nss_set_peer_sec_type(struct
- 	if (!wlmsg)
- 		return -ENOMEM;
- 
-+	ATH11K_MEMORY_STATS_INC(ar->ab, malloc_size,
-+				sizeof(struct nss_wifili_msg));
-+
- 	sec_msg = &wlmsg->msg.securitymsg;
- 	sec_msg->peer_id = peer->peer_id;
- 
-@@ -1906,6 +1927,8 @@ int ath11k_nss_set_peer_sec_type(struct
- 	ath11k_dbg(ar->ab, ATH11K_DBG_NSS, "nss peer id %d security cfg complete\n",
- 		   peer->peer_id);
- free:
-+	ATH11K_MEMORY_STATS_DEC(ar->ab, malloc_size,
-+				sizeof(struct nss_wifili_msg));
- 	kfree(wlmsg);
- 	return status;
- }
-@@ -2593,6 +2616,7 @@ static void ath11k_nss_tx_desc_mem_free(
- 				  ab->nss.tx_desc_vaddr[i],
- 				  ab->nss.tx_desc_paddr[i]);
- 		ab->nss.tx_desc_vaddr[i] = NULL;
-+		ATH11K_MEMORY_STATS_DEC(ab, dma_alloc, ab->nss.tx_desc_size[i]);
- 	}
- 
- 	ath11k_dbg(ab, ATH11K_DBG_NSS, "allocated tx desc mem freed\n");
-@@ -2624,6 +2648,8 @@ static int ath11k_nss_tx_desc_mem_alloc(
- 		ab->nss.tx_desc_size[curr_page_idx] = alloc_size;
- 		curr_page_idx++;
- 
-+		ATH11K_MEMORY_STATS_INC(ab, dma_alloc, alloc_size);
-+
- 		ath11k_dbg(ab, ATH11K_DBG_NSS,
- 			   "curr page %d, allocated %d, total allocated %d\n",
- 			   curr_page_idx, alloc_size, i + alloc_size);
-@@ -2795,6 +2821,8 @@ static int ath11k_nss_init(struct ath11k
- 	if (!wlmsg)
- 		return -ENOMEM;
- 
-+	ATH11K_MEMORY_STATS_INC(ab, malloc_size, sizeof(struct nss_wifili_msg));
-+
- 	wim = &wlmsg->msg.init;
- 
- 	wim->target_type = target_type;
-@@ -2914,6 +2942,7 @@ unregister:
- 	nss_unregister_wifili_if(ab->nss.if_num);
- free:
- 	ath11k_nss_tx_desc_mem_free(ab);
-+	ATH11K_MEMORY_STATS_DEC(ab, malloc_size, sizeof(struct nss_wifili_msg));
- 	kfree(wlmsg);
- 	return -EINVAL;
- }
-@@ -3031,6 +3060,8 @@ int ath11k_nss_pdev_init(struct ath11k_b
- 		goto unregister;
- 	}
- 
-+	ATH11K_MEMORY_STATS_INC(ab, malloc_size, sizeof(struct nss_wifili_msg));
-+
- 	pdevmsg = &wlmsg->msg.pdevmsg;
- 
- 	pdevmsg->radio_id = radio_id;
-@@ -3077,6 +3108,8 @@ int ath11k_nss_pdev_init(struct ath11k_b
- 		goto free;
- 	}
- 
-+	ATH11K_MEMORY_STATS_DEC(ab, malloc_size, sizeof(struct nss_wifili_msg));
-+
- 	kfree(wlmsg);
- 
- 	/* Disable nss sojourn stats by default */
-@@ -3095,6 +3128,7 @@ int ath11k_nss_pdev_init(struct ath11k_b
- 	return 0;
- 
- free:
-+	ATH11K_MEMORY_STATS_DEC(ab, malloc_size, sizeof(struct nss_wifili_msg));
- 	kfree(wlmsg);
- unregister:
- 	nss_unregister_wifili_radio_if(ar->nss.if_num);
-@@ -3117,6 +3151,8 @@ int ath11k_nss_start(struct ath11k_base
- 	if (!wlmsg)
- 		return -ENOMEM;
- 
-+	ATH11K_MEMORY_STATS_INC(ab, malloc_size, sizeof(struct nss_wifili_msg));
-+
- 	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
- 
- 	/* Empty message for NSS Start message */
-@@ -3157,6 +3193,7 @@ int ath11k_nss_start(struct ath11k_base
- 	ath11k_dbg(ab, ATH11K_DBG_NSS, "nss start success\n");
- 
- free:
-+	ATH11K_MEMORY_STATS_DEC(ab, malloc_size, sizeof(struct nss_wifili_msg));
- 	kfree(wlmsg);
- 	return ret;
- }
-@@ -3175,6 +3212,8 @@ static void ath11k_nss_reset(struct ath1
- 		return;
- 	}
- 
-+	ATH11K_MEMORY_STATS_INC(ab, malloc_size, sizeof(struct nss_wifili_msg));
-+
- 	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
- 
- 	/* Empty message for NSS Reset message */
-@@ -3213,6 +3252,7 @@ static void ath11k_nss_reset(struct ath1
- 	nss_unregister_wifili_if(ab->nss.if_num);
- 
- free:
-+	ATH11K_MEMORY_STATS_DEC(ab, malloc_size, sizeof(struct nss_wifili_msg));
- 	kfree(wlmsg);
- }
- 
-@@ -3228,6 +3268,8 @@ static int ath11k_nss_stop(struct ath11k
- 	if (!wlmsg)
- 		return -ENOMEM;
- 
-+	ATH11K_MEMORY_STATS_INC(ab, malloc_size, sizeof(struct nss_wifili_msg));
-+
- 	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
- 
- 	/* Empty message for Stop command */
-@@ -3267,6 +3309,8 @@ static int ath11k_nss_stop(struct ath11k
- 	/* NSS Stop success */
- 	ret = 0;
- free:
-+	ATH11K_MEMORY_STATS_DEC(ab, malloc_size, sizeof(struct nss_wifili_msg));
-+
- 	kfree(wlmsg);
- 	return ret;
- }
-@@ -3292,6 +3336,8 @@ int ath11k_nss_pdev_deinit(struct ath11k
- 	if (!wlmsg)
- 		return -ENOMEM;
- 
-+	ATH11K_MEMORY_STATS_INC(ab, malloc_size, sizeof(struct nss_wifili_msg));
-+
- 	deinit = &wlmsg->msg.pdevdeinit;
- 	deinit->ifnum = radio_id;
- 
-@@ -3337,6 +3383,7 @@ int ath11k_nss_pdev_deinit(struct ath11k
- 	nss_dynamic_interface_dealloc_node(ar->nss.if_num, dyn_if_type);
- 	nss_unregister_wifili_radio_if(ar->nss.if_num);
- free:
-+	ATH11K_MEMORY_STATS_DEC(ab, malloc_size, sizeof(struct nss_wifili_msg));
- 	kfree(wlmsg);
- 	return ret;
- }
---- a/drivers/net/wireless/ath/ath11k/peer.c
-+++ b/drivers/net/wireless/ath/ath11k/peer.c
-@@ -794,6 +794,9 @@ int ath11k_peer_delete(struct ath11k *ar
- 	if (ret)
- 		return ret;
- 
-+	ATH11K_MEMORY_STATS_DEC(ar->ab, per_peer_object,
-+				sizeof(struct ath11k_peer));
-+
- 	ar->num_peers--;
- 
- 	return 0;
-@@ -902,6 +905,8 @@ int ath11k_peer_create(struct ath11k *ar
- 		arsta->tcl_metadata &= ~HTT_TCL_META_DATA_VALID_HTT;
- 	}
- 
-+	ATH11K_MEMORY_STATS_INC(ar->ab, per_peer_object, sizeof(*peer));
-+
- 	ar->num_peers++;
- 
- 	spin_unlock_bh(&ar->ab->base_lock);
---- a/drivers/net/wireless/ath/ath11k/wmi.c
-+++ b/drivers/net/wireless/ath/ath11k/wmi.c
-@@ -623,6 +623,8 @@ struct sk_buff *ath11k_wmi_alloc_skb(str
- 	if (!skb)
- 		return NULL;
- 
-+	ATH11K_MEMORY_STATS_INC(ab, wmi_tx_skb_alloc, skb->truesize);
-+
- 	skb_reserve(skb, WMI_SKB_HEADROOM);
- 	if (!IS_ALIGNED((unsigned long)skb->data, 4))
- 		ath11k_warn(ab, "unaligned WMI skb data\n");
-@@ -7314,6 +7316,7 @@ static void ath11k_wmi_htc_tx_complete(s
- 	u8 eid;
- 
- 	eid = ATH11K_SKB_CB(skb)->eid;
-+	ATH11K_MEMORY_STATS_DEC(ab, wmi_tx_skb_alloc, skb->truesize);
- 	dev_kfree_skb(skb);
- 
- 	if (eid >= ATH11K_HTC_EP_COUNT)
-@@ -9107,6 +9110,7 @@ static void ath11k_wmi_tlv_op_rx(struct
- 	}
- 
- out:
-+	ATH11K_MEMORY_STATS_DEC(ab, wmi_tx_skb_alloc, skb->truesize);
- 	dev_kfree_skb(skb);
- }
- 
diff --git a/package/kernel/mac80211/patches/ath11k_nss/911-335-0006-ath11k-add-simple-tx-handler-for-AP-mode.patch b/package/kernel/mac80211/patches/ath11k_nss/911-335-0006-ath11k-add-simple-tx-handler-for-AP-mode.patch
deleted file mode 100644
index c61c206c417de7..00000000000000
--- a/package/kernel/mac80211/patches/ath11k_nss/911-335-0006-ath11k-add-simple-tx-handler-for-AP-mode.patch
+++ /dev/null
@@ -1,185 +0,0 @@
-From 9600bc899bd28386375f5b5902a33f1984ce9da8 Mon Sep 17 00:00:00 2001
-From: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
-Date: Thu, 18 Nov 2021 13:11:02 +0530
-Subject: [PATCH] ath11k: add simple tx handler for AP mode
-
-Add simple tx handler for AP mode to skip cheks which are not
-applicable for AP mode.
-
-Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
----
- drivers/net/wireless/ath/ath11k/dp_tx.c    | 123 +++++++++++++++++++++++++++++
- drivers/net/wireless/ath/ath11k/dp_tx.h    |   2 +
- drivers/net/wireless/ath/ath11k/hal_desc.h |   6 ++
- drivers/net/wireless/ath/ath11k/mac.c      |   3 +
- 4 files changed, 134 insertions(+)
-
---- a/drivers/net/wireless/ath/ath11k/dp_tx.c
-+++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
-@@ -103,6 +103,128 @@ static int ath11k_dp_prepare_htt_metadat
- 	return 0;
- }
- 
-+int ath11k_dp_tx_simple(struct ath11k *ar, struct ath11k_vif *arvif,
-+			struct sk_buff *skb, struct ath11k_sta *arsta)
-+{
-+	struct ath11k_base *ab = ar->ab;
-+	struct ath11k_dp *dp = &ab->dp;
-+	struct ath11k_skb_cb *skb_cb = ATH11K_SKB_CB(skb);
-+	struct hal_srng *tcl_ring;
-+	struct dp_tx_ring *tx_ring;
-+	struct hal_tcl_data_cmd *tcl_desc;
-+	void *hal_tcl_desc;
-+	dma_addr_t paddr;
-+	u8 pool_id;
-+	u8 hal_ring_id;
-+	int ret;
-+	u32 idr;
-+	u8 tcl_ring_id, ring_id, max_tx_ring;
-+	u8 buf_id;
-+	u32 desc_id;
-+	u8 ring_selector;
-+
-+	max_tx_ring = ab->hw_params.max_tx_ring;
-+
-+	if (unlikely(atomic_read(&ab->num_max_allowed) > DP_TX_COMP_MAX_ALLOWED)) {
-+		atomic_inc(&ab->soc_stats.tx_err.max_fail);
-+		ret = -EINVAL;
-+	}
-+
-+	ring_selector = smp_processor_id();
-+	pool_id = ring_selector;
-+
-+	if (max_tx_ring == 1) {
-+		ring_id = 0;
-+		tcl_ring_id = 0;
-+	} else {
-+		ring_id = ring_selector % max_tx_ring;
-+		tcl_ring_id = (ring_id == DP_TCL_NUM_RING_MAX) ?
-+			      DP_TCL_NUM_RING_MAX - 1 : ring_id;
-+	}
-+
-+	buf_id = tcl_ring_id + HAL_RX_BUF_RBM_SW0_BM;
-+	tx_ring = &dp->tx_ring[tcl_ring_id];
-+
-+	spin_lock_bh(&tx_ring->tx_idr_lock);
-+	idr = find_first_zero_bit(tx_ring->idrs, DP_TX_IDR_SIZE);
-+	if (unlikely(idr >= DP_TX_IDR_SIZE)) {
-+		spin_unlock_bh(&tx_ring->tx_idr_lock);
-+		return -ENOSPC;
-+	}
-+
-+	set_bit(idr, tx_ring->idrs);
-+	tx_ring->idr_pool[idr].id = idr;
-+	tx_ring->idr_pool[idr].buf = skb;
-+	spin_unlock_bh(&tx_ring->tx_idr_lock);
-+
-+	desc_id = FIELD_PREP(DP_TX_DESC_ID_MAC_ID, ar->pdev_idx) |
-+		  FIELD_PREP(DP_TX_DESC_ID_MSDU_ID, idr) |
-+		  FIELD_PREP(DP_TX_DESC_ID_POOL_ID, pool_id);
-+
-+	skb_cb->vif = arvif->vif;
-+	skb_cb->ar = ar;
-+
-+	paddr = dma_map_single(ab->dev, skb->data, skb->len, DMA_TO_DEVICE);
-+	if (unlikely(dma_mapping_error(ab->dev, paddr))) {
-+		atomic_inc(&ab->soc_stats.tx_err.misc_fail);
-+		ath11k_warn(ab, "failed to DMA map data Tx buffer\n");
-+		ret = -ENOMEM;
-+		goto fail_remove_idr;
-+	}
-+
-+	skb_cb->paddr = paddr;
-+
-+	hal_ring_id = tx_ring->tcl_data_ring.ring_id;
-+	tcl_ring = &ab->hal.srng_list[hal_ring_id];
-+
-+	spin_lock_bh(&tcl_ring->lock);
-+	ath11k_hal_srng_access_begin(ab, tcl_ring);
-+
-+	hal_tcl_desc = (void *)ath11k_hal_srng_src_get_next_entry(ab, tcl_ring);
-+	if (unlikely(!hal_tcl_desc)) {
-+		ath11k_hal_srng_access_end(ab, tcl_ring);
-+		spin_unlock_bh(&tcl_ring->lock);
-+		ab->soc_stats.tx_err.desc_na[tcl_ring_id]++;
-+		ret = -ENOMEM;
-+		goto fail_remove_idr;
-+	}
-+
-+	tcl_desc = (struct hal_tcl_data_cmd *)(hal_tcl_desc + sizeof(struct hal_tlv_hdr));
-+	tcl_desc->info3 = 0;
-+	tcl_desc->info4 = 0;
-+
-+	tcl_desc->buf_addr_info.info0 = FIELD_PREP(BUFFER_ADDR_INFO0_ADDR, paddr);
-+	tcl_desc->buf_addr_info.info1 = FIELD_PREP(BUFFER_ADDR_INFO1_ADDR,
-+			((uint64_t)paddr >> HAL_ADDR_MSB_REG_SHIFT));
-+	tcl_desc->buf_addr_info.info1 |= FIELD_PREP(BUFFER_ADDR_INFO1_RET_BUF_MGR, buf_id) |
-+		FIELD_PREP(BUFFER_ADDR_INFO1_SW_COOKIE, desc_id);
-+	tcl_desc->info0 = FIELD_PREP(HAL_TCL_DATA_CMD_INFO0_SEARCH_TYPE,
-+			arvif->search_type) |
-+		FIELD_PREP(HAL_TCL_DATA_CMD_INFO0_ENCAP_TYPE, HAL_TCL_ENCAP_TYPE_ETHERNET) |
-+		FIELD_PREP(HAL_TCL_DATA_CMD_INFO0_ADDR_EN, arvif->hal_addr_search_flags) |
-+		FIELD_PREP(HAL_TCL_DATA_CMD_INFO0_CMD_NUM, arvif->tcl_metadata);
-+
-+	tcl_desc->info1 = FIELD_PREP(HAL_TCL_DATA_CMD_INFO1_DATA_LEN, skb->len);
-+
-+	if (likely(skb->ip_summed == CHECKSUM_PARTIAL))
-+		tcl_desc->info1 |= TX_IP_CHECKSUM;
-+
-+	tcl_desc->info2 = FIELD_PREP(HAL_TCL_DATA_CMD_INFO2_LMAC_ID, ar->lmac_id);
-+
-+	ath11k_hal_srng_access_end(ab, tcl_ring);
-+	spin_unlock_bh(&tcl_ring->lock);
-+
-+	atomic_inc(&ar->dp.num_tx_pending);
-+	atomic_inc(&ab->num_max_allowed);
-+
-+	return 0;
-+
-+fail_remove_idr:
-+	tx_ring->idr_pool[idr].id = -1;
-+	clear_bit(idr, tx_ring->idrs);
-+	return ret;
-+}
-+
- int ath11k_dp_tx(struct ath11k *ar, struct ath11k_vif *arvif,
- 		 struct ath11k_sta *arsta, struct sk_buff *skb)
- {
---- a/drivers/net/wireless/ath/ath11k/dp_tx.h
-+++ b/drivers/net/wireless/ath/ath11k/dp_tx.h
-@@ -218,6 +218,8 @@ void ath11k_dp_tx_update_txcompl(struct
- int ath11k_dp_tx_htt_h2t_ver_req_msg(struct ath11k_base *ab);
- int ath11k_dp_tx(struct ath11k *ar, struct ath11k_vif *arvif,
- 		 struct ath11k_sta *arsta, struct sk_buff *skb);
-+int ath11k_dp_tx_simple(struct ath11k *ar, struct ath11k_vif *arvif,
-+			struct sk_buff *skb, struct ath11k_sta *arsta);
- void ath11k_dp_tx_completion_handler(struct ath11k_base *ab, int ring_id);
- int ath11k_dp_tx_send_reo_cmd(struct ath11k_base *ab, struct dp_rx_tid *rx_tid,
- 			      enum hal_reo_cmd_type type,
---- a/drivers/net/wireless/ath/ath11k/hal_desc.h
-+++ b/drivers/net/wireless/ath/ath11k/hal_desc.h
-@@ -952,6 +952,12 @@ struct hal_reo_flush_cache {
- 	u32 rsvd0[6];
- } __packed;
- 
-+#define TX_IP_CHECKSUM HAL_TCL_DATA_CMD_INFO1_IP4_CKSUM_EN | \
-+		       HAL_TCL_DATA_CMD_INFO1_UDP4_CKSUM_EN | \
-+		       HAL_TCL_DATA_CMD_INFO1_UDP6_CKSUM_EN | \
-+		       HAL_TCL_DATA_CMD_INFO1_TCP4_CKSUM_EN | \
-+		       HAL_TCL_DATA_CMD_INFO1_TCP6_CKSUM_EN
-+
- #define HAL_TCL_DATA_CMD_INFO0_DESC_TYPE	BIT(0)
- #define HAL_TCL_DATA_CMD_INFO0_EPD		BIT(1)
- #define HAL_TCL_DATA_CMD_INFO0_ENCAP_TYPE	GENMASK(3, 2)
---- a/drivers/net/wireless/ath/ath11k/mac.c
-+++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -6733,6 +6733,9 @@ static void ath11k_mac_op_tx(struct ieee
- 
- 	if (ar->ab->nss.enabled)
- 		ret = ath11k_nss_tx(arvif, skb);
-+	else if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP && 0)
-+		ret = ath11k_dp_tx_simple(ar, arvif, skb,
-+					  (control->sta) ? (struct ath11k_sta *)control->sta->drv_priv : NULL);
- 	else
- 		ret = ath11k_dp_tx(ar, arvif, arsta, skb);
- 
diff --git a/package/kernel/mac80211/patches/ath11k_nss/911-335-ath11k-fix-ar-ops-crash.patch b/package/kernel/mac80211/patches/ath11k_nss/911-335-ath11k-fix-ar-ops-crash.patch
deleted file mode 100644
index ffae27277d7316..00000000000000
--- a/package/kernel/mac80211/patches/ath11k_nss/911-335-ath11k-fix-ar-ops-crash.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
-Subject: [patch] ath11k: fix NULL pointer crash due to the radio ops
-
-Mac80211 callback ops variable not intialised in the radio structure.
-when the firmware not advertise the WMI_TLV_SERVICE_PEER_TID_CONFIGS_SUPPORT
-in the service bitmmap, driver try to set set_tid_config ops as NULL.
-Since ar->ops already NULL, it leads to NULL pointer access crash.
-So fix this crash by properly intialise the mac80211 callback ops
-in the radio structure.
-
-Tested-on: QCN6122 hw1.0 WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
-
-Signed-off-by: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
----
-
---- a/drivers/net/wireless/ath/ath11k/mac.c
-+++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -10558,6 +10558,7 @@ int ath11k_mac_allocate(struct ath11k_ba
- 	struct ieee80211_hw *hw;
- 	struct ath11k *ar;
- 	struct ath11k_pdev *pdev;
-+	struct ieee80211_ops *ops;
- 	int ret;
- 	int i;
- 
-@@ -10565,17 +10566,25 @@ int ath11k_mac_allocate(struct ath11k_ba
- 		return 0;
- 
- 	for (i = 0; i < ab->num_radios; i++) {
-+		ops = kmemdup(&ath11k_ops, sizeof(ath11k_ops), GFP_KERNEL);
-+		if (!ops) {
-+			ret = -ENOMEM;
-+			goto err_free_mac;
-+		}
-+
- 		pdev = &ab->pdevs[i];
--		hw = ieee80211_alloc_hw(sizeof(struct ath11k), &ath11k_ops);
-+		hw = ieee80211_alloc_hw(sizeof(struct ath11k), ops);
- 		if (!hw) {
- 			ath11k_warn(ab, "failed to allocate mac80211 hw device\n");
- 			ret = -ENOMEM;
-+			kfree(ops);
- 			goto err_free_mac;
- 		}
- 
- 		ar = hw->priv;
- 		ar->hw = hw;
- 		ar->ab = ab;
-+		ar->ops = ops;
- 		ar->pdev = pdev;
- 		ar->pdev_idx = i;
- 		ar->lmac_id = ath11k_hw_get_mac_from_pdev_id(&ab->hw_params, i);
-@@ -10636,6 +10645,7 @@ void ath11k_mac_destroy(struct ath11k_ba
- {
- 	struct ath11k *ar;
- 	struct ath11k_pdev *pdev;
-+	struct ieee80211_ops *ops;
- 	int i;
- 
- 	for (i = 0; i < ab->num_radios; i++) {
-@@ -10644,8 +10654,9 @@ void ath11k_mac_destroy(struct ath11k_ba
- 		if (!ar)
- 			continue;
- 
--		ath11k_fw_stats_free(&ar->fw_stats);
-+		ops = ar->ops;
- 		ieee80211_free_hw(ar->hw);
-+		kfree(ops);
- 		pdev->ar = NULL;
- 	}
- }
diff --git a/package/kernel/mac80211/patches/ath11k_nss/913-726-mac80211-fix-crash-when-accessing-null-pointer.patch b/package/kernel/mac80211/patches/ath11k_nss/913-726-mac80211-fix-crash-when-accessing-null-pointer.patch
deleted file mode 100644
index 8e60a5f6b255f7..00000000000000
--- a/package/kernel/mac80211/patches/ath11k_nss/913-726-mac80211-fix-crash-when-accessing-null-pointer.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From 376306e1018974ded893d8fefb91fe69676392d9 Mon Sep 17 00:00:00 2001
-From: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
-Date: Mon, 1 May 2023 15:15:56 +0530
-Subject: [PATCH] mac80211: fix crash when accessing null pointer
-
-During MLD transmission, band will be zero, fetching 0th sband will be an
-invalid accessing of sband information and also facing crash when 2ghz
-radio is in different phy and other bands are in a single phy, this is
-due to 2.4 Ghz sband will be NULL for the phy which is having sbands other
-than 2.4 Ghz.
-
-Fix this by adding sband NULL check.
-
-[ 2125.764601] Unable to handle kernel read from unreadable memory at virtual address 0000000000000050
-[ 2125.764631] Mem abort info:
-[ 2125.772445]   ESR = 0x96000005
-[ 2125.775221]   EC = 0x25: DABT (current EL), IL = 32 bits
-[ 2125.778339]   SET = 0, FnV = 0
-[ 2125.783804]   EA = 0, S1PTW = 0
-[ 2125.786669] Data abort info:
-[ 2125.789707]   ISV = 0, ISS = 0x00000005
-[ 2125.792833]   CM = 0, WnR = 0
-[ 2125.796394] user pgtable: 4k pages, 39-bit VAs, pgdp=000000006432b000
-[ 2125.799520] [0000000000000050] pgd=0000000000000000, pud=0000000000000000
-[ 2125.805946] Internal error: Oops: 96000005 [#1] PREEMPT SMP
-[ 2126.082240] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.213 #0
-[ 2126.110546] pstate: 40400005 (nZcv daif +PAN -UAO)
-[ 2126.117591] pc : ieee80211_tx_monitor+0x1ac/0x5d0 [mac80211]
-[ 2126.122360] lr : ieee80211_tx_monitor+0x14c/0x5d0 [mac80211]
-[ 2126.128163] sp : ffffff803e14ecc0
-[ 2126.133803] x29: ffffff803e14ecc0 x28: 000000000000000d
-[ 2126.137016] x27: 0000000000000000 x26: ffffff803892aa40
-[ 2126.142398] x25: 0000000000000009 x24: 0000000000000000
-[ 2126.147694] x23: 0000000000000001 x22: ffffff80250210e0
-[ 2126.152988] x21: ffffff803a0a5800 x20: ffffff803a0a5828
-[ 2126.158284] x19: ffffff803892aa33 x18: 0000000000000000
-[ 2126.163579] x17: 0000000000000000 x16: 0000000000000000
-[ 2126.168873] x15: 0000000000000000 x14: 020101f0fd8c13dd
-[ 2126.174169] x13: 00c0bf3d2d200706 x12: 3809ff36b83b03ff
-[ 2126.179464] x11: 0a5802c3fe1802c3 x10: 002f3262005e4342
-[ 2126.184759] x9 : 0000a4270000a403 x8 : ffffff803892aa3f
-[ 2126.190055] x7 : 0000000000000000 x6 : 0000000000000001
-[ 2126.195349] x5 : ffffff803e14edd8 x4 : 0000000000000001
-[ 2126.200644] x3 : 000000000000000c x2 : 0000000000000000
-[ 2126.205939] x1 : ffffff803892aa3b x0 : 0000000000000040
-[ 2126.211235] Call trace:
-[ 2126.216542]  ieee80211_tx_monitor+0x1ac/0x5d0 [mac80211]
-[ 2126.218714]  ieee80211_tx_status_ext+0x78c/0x7d0 [mac80211]
-[ 2126.224269]  ieee80211_tx_status+0x78/0xa0 [mac80211]
-[ 2126.229564]  ieee80211_restart_hw+0xe0/0x26c [mac80211]
-[ 2126.234763]  tasklet_action_common.isra.2+0xa4/0x11c
-[ 2126.239795]  tasklet_action+0x24/0x2c
-[ 2126.245002]  __do_softirq+0x10c/0x244
-[ 2126.248561]  irq_exit+0x64/0xb4
-[ 2126.252207]  __handle_domain_irq+0x88/0xac
-[ 2126.255158]  gic_handle_irq+0x74/0xbc
-[ 2126.259325]  el1_irq+0xf0/0x1c0
-[ 2126.263058]  arch_cpu_idle+0x10/0x18
-[ 2126.266009]  do_idle+0x104/0x248
-[ 2126.269827]  cpu_startup_entry+0x20/0x64
-[ 2126.273041]  rest_init+0xd0/0xdc
-[ 2126.276947]  arch_call_rest_init+0xc/0x14
-[ 2126.280159]  start_kernel+0x46c/0x4a4
-[ 2126.284070] Code: d37d0863 8b030042 52800183 f9449c42 (f9402842)
-[ 2126.287713] ---[ end trace 04f5d203895d53da ]---
-
-Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
----
- net/mac80211/status.c | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
---- a/net/mac80211/status.c
-+++ b/net/mac80211/status.c
-@@ -336,8 +336,11 @@ ieee80211_add_tx_radiotap_header(struct
- 		struct ieee80211_supported_band *sband;
- 
- 		sband = local->hw.wiphy->bands[info->band];
--		legacy_rate =
--			sband->bitrates[info->status.rates[0].idx].bitrate;
-+		//TODO: Incase of MLD, band will be 0 for tx pkts
-+		//this has to be taken care during TX monitor support.
-+		if (sband)
-+			legacy_rate =
-+				sband->bitrates[info->status.rates[0].idx].bitrate;
- 	}
- 
- 	if (legacy_rate) {
diff --git a/package/kernel/mac80211/patches/nss/ath10k/199-004-ath10k-fixup-nss-compile.patch b/package/kernel/mac80211/patches/nss/ath10k/199-004-ath10k-fixup-nss-compile.patch
new file mode 100644
index 00000000000000..d413514144f161
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath10k/199-004-ath10k-fixup-nss-compile.patch
@@ -0,0 +1,19 @@
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -5530,7 +5530,7 @@ static int ath10k_mac_set_txbf_conf(stru
+ 					 ar->wmi.vdev_param->txbf, value);
+ }
+ 
+-static void ath10k_update_vif_offload(struct ieee80211_hw *hw,
++static int ath10k_update_vif_offload(struct ieee80211_hw *hw,
+ 				      struct ieee80211_vif *vif)
+ {
+ 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
+@@ -5552,6 +5552,7 @@ static void ath10k_update_vif_offload(st
+ 		ath10k_warn(ar, "failed to set vdev %i TX encapsulation: %d\n",
+ 			    arvif->vdev_id, ret);
+ 	}
++	return ret;
+ }
+ 
+ /*
diff --git a/package/kernel/mac80211/patches/ath11k_nss/033-ath11k-fix-for-peer-memory-corruption.patch b/package/kernel/mac80211/patches/nss/ath11k/033-ath11k-fix-for-peer-memory-corruption.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath11k_nss/033-ath11k-fix-for-peer-memory-corruption.patch
rename to package/kernel/mac80211/patches/nss/ath11k/033-ath11k-fix-for-peer-memory-corruption.patch
diff --git a/package/kernel/mac80211/patches/ath11k_nss/907-068-ath11k-add-rx-histogram-stats.patch b/package/kernel/mac80211/patches/nss/ath11k/068-ath11k-add-rx-histogram-stats.patch
similarity index 84%
rename from package/kernel/mac80211/patches/ath11k_nss/907-068-ath11k-add-rx-histogram-stats.patch
rename to package/kernel/mac80211/patches/nss/ath11k/068-ath11k-add-rx-histogram-stats.patch
index d3ffa5bd8da8e7..e4ac1ee17b0b2e 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/907-068-ath11k-add-rx-histogram-stats.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/068-ath11k-add-rx-histogram-stats.patch
@@ -20,7 +20,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -44,6 +44,8 @@
+@@ -41,6 +41,8 @@
  
  #define ATH11K_INVALID_HW_MAC_ID	0xFF
  #define ATH11K_CONNECTION_LOSS_HZ	(3 * HZ)
@@ -29,7 +29,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  
  /* SMBIOS type containing Board Data File Name Extension */
  #define ATH11K_SMBIOS_BDF_EXT_TYPE 0xF8
-@@ -420,6 +422,17 @@ struct ath11k_vif_iter {
+@@ -376,6 +378,17 @@ struct ath11k_vif_iter {
  	struct ath11k_vif *arvif;
  };
  
@@ -47,7 +47,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  struct ath11k_rx_peer_stats {
  	u64 num_msdu;
  	u64 num_mpdu_fcs_ok;
-@@ -431,10 +444,6 @@ struct ath11k_rx_peer_stats {
+@@ -387,10 +400,6 @@ struct ath11k_rx_peer_stats {
  	u64 non_ampdu_msdu_count;
  	u64 stbc_count;
  	u64 beamformed_count;
@@ -58,7 +58,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  	u64 coding_count[HAL_RX_SU_MU_CODING_MAX];
  	u64 tid_count[IEEE80211_NUM_TIDS + 1];
  	u64 pream_cnt[HAL_RX_PREAMBLE_MAX];
-@@ -442,6 +451,8 @@ struct ath11k_rx_peer_stats {
+@@ -398,6 +407,8 @@ struct ath11k_rx_peer_stats {
  	u64 rx_duration;
  	u64 dcm_count;
  	u64 ru_alloc_cnt[HAL_RX_RU_ALLOC_TYPE_MAX];
@@ -76,8 +76,8 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
 +#include "dp_rx.h"
  #include "debugfs_htt_stats.h"
  
- static inline u32 ath11k_he_tones_in_ru_to_nl80211_he_ru_alloc(u16 ru_tones)
-@@ -390,8 +391,14 @@ static ssize_t ath11k_dbg_sta_dump_rx_st
+ void ath11k_debugfs_sta_add_tx_stats(struct ath11k_sta *arsta,
+@@ -247,8 +248,14 @@ static ssize_t ath11k_dbg_sta_dump_rx_st
  	struct ath11k *ar = arsta->arvif->ar;
  	struct ath11k_rx_peer_stats *rx_stats = arsta->rx_stats;
  	int len = 0, i, retval = 0;
@@ -93,7 +93,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  
  	if (!rx_stats)
  		return -ENOENT;
-@@ -422,14 +429,6 @@ static ssize_t ath11k_dbg_sta_dump_rx_st
+@@ -279,14 +286,6 @@ static ssize_t ath11k_dbg_sta_dump_rx_st
  			 rx_stats->num_mpdu_fcs_ok);
  	len += scnprintf(buf + len, size - len, "Num of MPDUs with FCS error: %llu\n",
  			 rx_stats->num_mpdu_fcs_err);
@@ -108,7 +108,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  	len += scnprintf(buf + len, size - len, "BCC %llu LDPC %llu\n",
  			 rx_stats->coding_count[0], rx_stats->coding_count[1]);
  	len += scnprintf(buf + len, size - len,
-@@ -444,14 +443,96 @@ static ssize_t ath11k_dbg_sta_dump_rx_st
+@@ -301,14 +300,96 @@ static ssize_t ath11k_dbg_sta_dump_rx_st
  	len += scnprintf(buf + len, size - len, "TID(0-15) Legacy TID(16):");
  	for (i = 0; i <= IEEE80211_NUM_TIDS; i++)
  		len += scnprintf(buf + len, size - len, "%llu ", rx_stats->tid_count[i]);
@@ -212,9 +212,64 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  	len += scnprintf(buf + len, size - len,
  			 "\nDCM: %llu\nRU: 26 %llu 52: %llu 106: %llu 242: %llu 484: %llu 996: %llu\n",
  			 rx_stats->dcm_count, rx_stats->ru_alloc_cnt[0],
+@@ -847,6 +928,40 @@ static const struct file_operations fops
+ 	.llseek = default_llseek,
+ };
+ 
++static ssize_t ath11k_dbg_sta_reset_rx_stats(struct file *file,
++					     const char __user *buf,
++					     size_t count, loff_t *ppos)
++{
++	struct ieee80211_sta *sta = file->private_data;
++	struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv;
++	struct ath11k *ar = arsta->arvif->ar;
++	int ret, reset;
++
++	if (!arsta->rx_stats)
++		return -ENOENT;
++
++	ret = kstrtoint_from_user(buf, count, 0, &reset);
++	if (ret)
++		return ret;
++
++	if (!reset || reset > 1)
++		return -EINVAL;
++
++	spin_lock_bh(&ar->ab->base_lock);
++	memset(arsta->rx_stats, 0, sizeof(*arsta->rx_stats));
++	spin_unlock_bh(&ar->ab->base_lock);
++
++	ret = count;
++	return ret;
++}
++
++static const struct file_operations fops_reset_rx_stats = {
++	.write = ath11k_dbg_sta_reset_rx_stats,
++	.open = simple_open,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++};
++
+ void ath11k_debugfs_sta_op_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 			       struct ieee80211_sta *sta, struct dentry *dir)
+ {
+@@ -855,9 +970,12 @@ void ath11k_debugfs_sta_op_add(struct ie
+ 	if (ath11k_debugfs_is_extd_tx_stats_enabled(ar))
+ 		debugfs_create_file("tx_stats", 0400, dir, sta,
+ 				    &fops_tx_stats);
+-	if (ath11k_debugfs_is_extd_rx_stats_enabled(ar))
++	if (ath11k_debugfs_is_extd_rx_stats_enabled(ar)) {
+ 		debugfs_create_file("rx_stats", 0400, dir, sta,
+ 				    &fops_rx_stats);
++		debugfs_create_file("reset_rx_stats", 0600, dir, sta,
++				    &fops_reset_rx_stats);
++	}
+ 
+ 	debugfs_create_file("htt_peer_stats", 0400, dir, sta,
+ 			    &fops_htt_peer_stats);
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -3400,10 +3400,43 @@ exit:
+@@ -2762,10 +2762,43 @@ exit:
  	return total_msdu_reaped;
  }
  
@@ -258,7 +313,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  	u32 num_msdu;
  	int i;
  
-@@ -3413,6 +3446,8 @@ static void ath11k_dp_rx_update_peer_sta
+@@ -2775,6 +2808,8 @@ static void ath11k_dp_rx_update_peer_sta
  	arsta->rssi_comb = ppdu_info->rssi_comb;
  	ewma_avg_rssi_add(&arsta->avg_rssi, ppdu_info->rssi_comb);
  
@@ -267,7 +322,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  	num_msdu = ppdu_info->tcp_msdu_count + ppdu_info->tcp_ack_msdu_count +
  		   ppdu_info->udp_msdu_count + ppdu_info->other_msdu_count;
  
-@@ -3429,18 +3464,6 @@ static void ath11k_dp_rx_update_peer_sta
+@@ -2791,18 +2826,6 @@ static void ath11k_dp_rx_update_peer_sta
  		ppdu_info->tid = IEEE80211_NUM_TIDS;
  	}
  
@@ -286,7 +341,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  	if (ppdu_info->ldpc < HAL_RX_SU_MU_CODING_MAX)
  		rx_stats->coding_count[ppdu_info->ldpc] += num_msdu;
  
-@@ -3469,8 +3492,6 @@ static void ath11k_dp_rx_update_peer_sta
+@@ -2831,8 +2854,6 @@ static void ath11k_dp_rx_update_peer_sta
  	rx_stats->dcm_count += ppdu_info->dcm;
  	rx_stats->ru_alloc_cnt[ppdu_info->ru_alloc] += num_msdu;
  
@@ -295,7 +350,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  	BUILD_BUG_ON(ARRAY_SIZE(arsta->chain_signal) >
  			     ARRAY_SIZE(ppdu_info->rssi_chain_pri20));
  
-@@ -3479,6 +3500,52 @@ static void ath11k_dp_rx_update_peer_sta
+@@ -2841,6 +2862,52 @@ static void ath11k_dp_rx_update_peer_sta
  
  	rx_stats->rx_duration += ppdu_info->rx_duration;
  	arsta->rx_duration = rx_stats->rx_duration;
@@ -350,7 +405,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  static struct sk_buff *ath11k_dp_rx_alloc_mon_status_buf(struct ath11k_base *ab,
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.h
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.h
-@@ -69,6 +69,25 @@ struct ath11k_dp_rfc1042_hdr {
+@@ -41,6 +41,25 @@ struct ath11k_dp_rfc1042_hdr {
  	__be16 snap_type;
  } __packed;
  
@@ -373,12 +428,12 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
 +        return ret;
 +}
 +
- int ath11k_dp_rx_ampdu_start(struct ath11k_vif *arvif,
+ int ath11k_dp_rx_ampdu_start(struct ath11k *ar,
  			     struct ieee80211_ampdu_params *params);
- int ath11k_dp_rx_ampdu_stop(struct ath11k_vif *arvif,
+ int ath11k_dp_rx_ampdu_stop(struct ath11k *ar,
 --- a/drivers/net/wireless/ath/ath11k/hal_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/hal_rx.c
-@@ -978,44 +978,78 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+@@ -975,44 +975,78 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
  		ppdu_info->is_stbc = FIELD_GET(HAL_RX_HT_SIG_INFO_INFO1_STBC,
  					       info1);
  		ppdu_info->ldpc = FIELD_GET(HAL_RX_HT_SIG_INFO_INFO1_FEC_CODING, info1);
@@ -481,7 +536,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  		ppdu_info->reception_type = HAL_RX_RECEPTION_TYPE_SU;
  		break;
  	}
-@@ -1473,6 +1507,9 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+@@ -1470,6 +1504,9 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
  		peer_id = ath11k_hal_rx_mpduinfo_get_peerid(ab, mpdu_info);
  		if (peer_id)
  			ppdu_info->peer_id = peer_id;
@@ -505,7 +560,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  
  struct hal_rx_mon_status_tlv_hdr {
  	u32 hdr;
-@@ -104,6 +108,22 @@ struct hal_rx_user_status {
+@@ -103,6 +107,22 @@ struct hal_rx_user_status {
  	u32 mpdu_err_byte_count;
  };
  
@@ -528,7 +583,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  #define HAL_TLV_STATUS_PPDU_NOT_DONE    HAL_RX_MON_STATUS_PPDU_NOT_DONE
  #define HAL_TLV_STATUS_PPDU_DONE        HAL_RX_MON_STATUS_PPDU_DONE
  #define HAL_TLV_STATUS_BUF_DONE         HAL_RX_MON_STATUS_BUF_DONE
-@@ -128,6 +148,7 @@ struct hal_rx_mon_ppdu_info {
+@@ -127,6 +147,7 @@ struct hal_rx_mon_ppdu_info {
  	u32 num_mpdu_fcs_ok;
  	u32 num_mpdu_fcs_err;
  	u32 preamble_type;
@@ -538,7 +593,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  	u16 tcp_ack_msdu_count;
 --- a/drivers/net/wireless/ath/ath11k/hw.c
 +++ b/drivers/net/wireless/ath/ath11k/hw.c
-@@ -1051,6 +1051,17 @@ static u32 ath11k_hw_wcn6750_get_tcl_rin
+@@ -900,6 +900,17 @@ static u32 ath11k_hw_wcn6750_get_tcl_rin
  	return skb_get_hash(skb);
  }
  
@@ -556,15 +611,15 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  const struct ath11k_hw_ops ipq8074_ops = {
  	.get_hw_mac_from_pdev_id = ath11k_hw_ipq8074_mac_from_pdev_id,
  	.wmi_init_config = ath11k_init_wmi_config_ipq8074,
-@@ -1089,6 +1100,7 @@ const struct ath11k_hw_ops ipq8074_ops =
+@@ -938,6 +949,7 @@ const struct ath11k_hw_ops ipq8074_ops =
  	.rx_desc_mac_addr2_valid = ath11k_hw_ipq8074_rx_desc_mac_addr2_valid,
  	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2,
  	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
 +	.rx_desc_get_hal_mpdu_len = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_len,
- #ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
- 	.rx_desc_get_offset = ath11k_hw_ipq8074_rx_desc_get_offset,
- #endif
-@@ -1136,6 +1148,7 @@ const struct ath11k_hw_ops ipq6018_ops =
+ };
+ 
+ const struct ath11k_hw_ops ipq6018_ops = {
+@@ -978,6 +990,7 @@ const struct ath11k_hw_ops ipq6018_ops =
  	.rx_desc_mac_addr2_valid = ath11k_hw_ipq8074_rx_desc_mac_addr2_valid,
  	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2,
  	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
@@ -572,7 +627,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  };
  
  const struct ath11k_hw_ops qca6390_ops = {
-@@ -1177,6 +1190,7 @@ const struct ath11k_hw_ops qca6390_ops =
+@@ -1018,6 +1031,7 @@ const struct ath11k_hw_ops qca6390_ops =
  	.rx_desc_mac_addr2_valid = ath11k_hw_ipq8074_rx_desc_mac_addr2_valid,
  	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2,
  	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
@@ -580,15 +635,23 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  };
  
  const struct ath11k_hw_ops qcn9074_ops = {
-@@ -1217,6 +1231,7 @@ const struct ath11k_hw_ops qcn9074_ops =
- 	.reo_setup = ath11k_hw_ipq8074_reo_setup,
- 	.mpdu_info_get_peerid = ath11k_hw_qcn9074_mpdu_info_get_peerid,
+@@ -1058,6 +1072,7 @@ const struct ath11k_hw_ops qcn9074_ops =
+ 	.rx_desc_mac_addr2_valid = ath11k_hw_ipq9074_rx_desc_mac_addr2_valid,
+ 	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq9074_rx_desc_mpdu_start_addr2,
  	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
-+	.rx_desc_get_hal_mpdu_len = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_len,
++	.rx_desc_get_hal_mpdu_len = ath11k_hw_qcn9074_rx_desc_get_hal_mpdu_len,
  };
  
  const struct ath11k_hw_ops wcn6855_ops = {
-@@ -1339,6 +1354,7 @@ const struct ath11k_hw_ops ipq5018_ops =
+@@ -1098,6 +1113,7 @@ const struct ath11k_hw_ops wcn6855_ops =
+ 	.rx_desc_mac_addr2_valid = ath11k_hw_wcn6855_rx_desc_mac_addr2_valid,
+ 	.rx_desc_mpdu_start_addr2 = ath11k_hw_wcn6855_rx_desc_mpdu_start_addr2,
+ 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
++	.rx_desc_get_hal_mpdu_len = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_len,
+ };
+ 
+ const struct ath11k_hw_ops wcn6750_ops = {
+@@ -1179,6 +1195,7 @@ const struct ath11k_hw_ops ipq5018_ops =
  	.rx_desc_mac_addr2_valid = ath11k_hw_ipq9074_rx_desc_mac_addr2_valid,
  	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq9074_rx_desc_mpdu_start_addr2,
  	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
@@ -598,11 +661,11 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  #define ATH11K_TX_RING_MASK_0 BIT(0)
 --- a/drivers/net/wireless/ath/ath11k/hw.h
 +++ b/drivers/net/wireless/ath/ath11k/hw.h
-@@ -315,6 +315,7 @@ struct ath11k_hw_ops {
+@@ -269,6 +269,7 @@ struct ath11k_hw_ops {
  	bool (*rx_desc_mac_addr2_valid)(struct hal_rx_desc *desc);
  	u8* (*rx_desc_mpdu_start_addr2)(struct hal_rx_desc *desc);
  	u32 (*get_ring_selector)(struct sk_buff *skb);
 +	u32 (*rx_desc_get_hal_mpdu_len)(struct hal_rx_mpdu_info *mpdu_info);
- #ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
- 	void (*rx_desc_get_offset)(struct htt_rx_ring_tlv_filter *tlv_filter);
- #endif
+ };
+ 
+ extern const struct ath11k_hw_ops ipq8074_ops;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/902-069-ath11k-add-HE-stats-in-peer-stats.patch b/package/kernel/mac80211/patches/nss/ath11k/069-ath11k-add-HE-stats-in-peer-stats.patch
similarity index 93%
rename from package/kernel/mac80211/patches/ath11k_nss/902-069-ath11k-add-HE-stats-in-peer-stats.patch
rename to package/kernel/mac80211/patches/nss/ath11k/069-ath11k-add-HE-stats-in-peer-stats.patch
index 4831424fa40810..5c29297c3363f8 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/902-069-ath11k-add-HE-stats-in-peer-stats.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/069-ath11k-add-HE-stats-in-peer-stats.patch
@@ -20,10 +20,10 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  #include "spectral.h"
  #include "wow.h"
 +#include "rx_desc.h"
- #include "nss.h"
  
  #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
-@@ -476,6 +477,8 @@ struct ath11k_htt_data_stats {
+ 
+@@ -469,6 +470,8 @@ struct ath11k_htt_data_stats {
  	u64 bw[ATH11K_COUNTER_TYPE_MAX][ATH11K_BW_NUM];
  	u64 nss[ATH11K_COUNTER_TYPE_MAX][ATH11K_NSS_NUM];
  	u64 gi[ATH11K_COUNTER_TYPE_MAX][ATH11K_GI_NUM];
@@ -32,7 +32,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  };
  
  struct ath11k_htt_tx_stats {
-@@ -483,6 +486,9 @@ struct ath11k_htt_tx_stats {
+@@ -476,6 +479,9 @@ struct ath11k_htt_tx_stats {
  	u64 tx_duration;
  	u64 ba_fails;
  	u64 ack_fails;
@@ -42,7 +42,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  };
  
  struct ath11k_per_ppdu_tx_stats {
-@@ -615,11 +621,16 @@ struct ath11k_per_peer_tx_stats {
+@@ -592,11 +598,16 @@ struct ath11k_per_peer_tx_stats {
  	u32 succ_bytes;
  	u32 retry_bytes;
  	u32 failed_bytes;
@@ -62,8 +62,8 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  
 --- a/drivers/net/wireless/ath/ath11k/debugfs_sta.c
 +++ b/drivers/net/wireless/ath/ath11k/debugfs_sta.c
-@@ -12,13 +12,39 @@
- #include "dp_tx.h"
+@@ -13,13 +13,39 @@
+ #include "dp_rx.h"
  #include "debugfs_htt_stats.h"
  
 +static inline u32 ath11k_he_tones_in_ru_to_nl80211_he_ru_alloc(u16 ru_tones)
@@ -103,7 +103,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  
  	if (!arsta->tx_stats)
  		return;
-@@ -63,6 +89,43 @@ void ath11k_debugfs_sta_add_tx_stats(str
+@@ -64,6 +90,43 @@ void ath11k_debugfs_sta_add_tx_stats(str
  		STATS_OP_FMT(RETRY).legacy[1][mcs] += peer_stats->retry_pkts;
  	}
  
@@ -147,7 +147,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  	if (peer_stats->is_ampdu) {
  		tx_stats->ba_fails += peer_stats->ba_fails;
  
-@@ -123,6 +186,17 @@ void ath11k_debugfs_sta_add_tx_stats(str
+@@ -124,6 +187,17 @@ void ath11k_debugfs_sta_add_tx_stats(str
  	STATS_OP_FMT(RETRY).gi[1][gi] += peer_stats->retry_pkts;
  
  	tx_stats->tx_duration += peer_stats->duration;
@@ -165,7 +165,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  }
  
  void ath11k_debugfs_sta_update_txcompl(struct ath11k *ar,
-@@ -139,12 +213,13 @@ static ssize_t ath11k_dbg_sta_dump_tx_st
+@@ -140,12 +214,13 @@ static ssize_t ath11k_dbg_sta_dump_tx_st
  	struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);
  	struct ath11k *ar = arsta->arvif->ar;
  	struct ath11k_htt_data_stats *stats;
@@ -179,9 +179,9 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
 +	char *buf, mu_group_id[MAX_MU_GROUP_LENGTH] = {0};
 +	u32 index;
  
- 	buf = kzalloc(size, GFP_KERNEL);
- 	if (!buf)
-@@ -165,45 +240,46 @@ static ssize_t ath11k_dbg_sta_dump_tx_st
+ 	if (!arsta->tx_stats)
+ 		return -ENOENT;
+@@ -163,45 +238,46 @@ static ssize_t ath11k_dbg_sta_dump_tx_st
  			len += scnprintf(buf + len, size - len, "%s_%s\n",
  					 str_name[k],
  					 str[j]);
@@ -237,7 +237,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  					 stats->gi[j][0], stats->gi[j][1],
  					 stats->gi[j][2], stats->gi[j][3]);
  			len += scnprintf(buf + len, size - len,
-@@ -212,10 +288,68 @@ static ssize_t ath11k_dbg_sta_dump_tx_st
+@@ -210,10 +286,68 @@ static ssize_t ath11k_dbg_sta_dump_tx_st
  			for (i = 0; i < ATH11K_LEGACY_NUM; i++)
  				len += scnprintf(buf + len, size - len, "%llu ",
  						 stats->legacy[j][i]);
@@ -307,7 +307,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  	len += scnprintf(buf + len, size - len,
  			 "\nTX duration\n %llu usecs\n",
  			 arsta->tx_stats->tx_duration);
-@@ -223,6 +357,7 @@ static ssize_t ath11k_dbg_sta_dump_tx_st
+@@ -221,6 +355,7 @@ static ssize_t ath11k_dbg_sta_dump_tx_st
  			"BA fails\n %llu\n", arsta->tx_stats->ba_fails);
  	len += scnprintf(buf + len, size - len,
  			"ack fails\n %llu\n", arsta->tx_stats->ack_fails);
@@ -317,7 +317,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  	if (len > size)
 --- a/drivers/net/wireless/ath/ath11k/dp.h
 +++ b/drivers/net/wireless/ath/ath11k/dp.h
-@@ -598,6 +598,45 @@ enum htt_ppdu_stats_tag_type {
+@@ -595,6 +595,45 @@ enum htt_ppdu_stats_tag_type {
  				    BIT(HTT_PPDU_STATS_TAG_TX_MGMTCTRL_PAYLOAD) | \
  				    HTT_PPDU_STATS_TAG_DEFAULT)
  
@@ -363,7 +363,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  /* HTT_H2T_MSG_TYPE_RX_RING_SELECTION_CFG Message
   *
   * details:
-@@ -1315,6 +1354,19 @@ enum htt_ppdu_stats_gi {
+@@ -1234,6 +1273,19 @@ enum htt_ppdu_stats_gi {
  #define HTT_PPDU_STATS_USER_RATE_INFO0_USER_POS_M	GENMASK(3, 0)
  #define HTT_PPDU_STATS_USER_RATE_INFO0_MU_GROUP_ID_M	GENMASK(11, 4)
  
@@ -383,7 +383,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  #define HTT_PPDU_STATS_USER_RATE_INFO1_RESP_TYPE_VALD_M	BIT(0)
  #define HTT_PPDU_STATS_USER_RATE_INFO1_PPDU_TYPE_M	GENMASK(5, 1)
  
-@@ -1342,6 +1394,12 @@ enum htt_ppdu_stats_gi {
+@@ -1261,6 +1313,12 @@ enum htt_ppdu_stats_gi {
  		FIELD_GET(HTT_PPDU_STATS_USER_RATE_FLAGS_GI_M, _val)
  #define HTT_USR_RATE_DCM(_val) \
  		FIELD_GET(HTT_PPDU_STATS_USER_RATE_FLAGS_DCM_M, _val)
@@ -396,7 +396,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  
  #define HTT_PPDU_STATS_USER_RATE_RESP_FLAGS_LTF_SIZE_M		GENMASK(1, 0)
  #define HTT_PPDU_STATS_USER_RATE_RESP_FLAGS_STBC_M		BIT(2)
-@@ -1445,6 +1503,21 @@ struct htt_ppdu_stats_usr_cmpltn_ack_ba_
+@@ -1364,6 +1422,21 @@ struct htt_ppdu_stats_usr_cmpltn_ack_ba_
  	u32 success_bytes;
  } __packed;
  
@@ -418,7 +418,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  struct htt_ppdu_stats_usr_cmn_array {
  	struct htt_tlv tlv_hdr;
  	u32 num_ppdu_stats;
-@@ -1458,14 +1531,16 @@ struct htt_ppdu_stats_usr_cmn_array {
+@@ -1377,14 +1450,16 @@ struct htt_ppdu_stats_usr_cmn_array {
  
  struct htt_ppdu_user_stats {
  	u16 peer_id;
@@ -436,7 +436,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  #define HTT_PPDU_DESC_MAX_DEPTH	16
  
  struct htt_ppdu_stats {
-@@ -1474,7 +1549,7 @@ struct htt_ppdu_stats {
+@@ -1393,7 +1468,7 @@ struct htt_ppdu_stats {
  };
  
  struct htt_ppdu_stats_info {
@@ -447,7 +447,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  };
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -1319,9 +1319,10 @@ static int ath11k_htt_tlv_ppdu_stats_par
+@@ -1252,9 +1252,10 @@ static int ath11k_htt_tlv_ppdu_stats_par
  					   void *data)
  {
  	struct htt_ppdu_stats_info *ppdu_info;
@@ -459,7 +459,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  
  	ppdu_info = data;
  
-@@ -1334,6 +1335,26 @@ static int ath11k_htt_tlv_ppdu_stats_par
+@@ -1267,6 +1268,26 @@ static int ath11k_htt_tlv_ppdu_stats_par
  		}
  		memcpy((void *)&ppdu_info->ppdu_stats.common, ptr,
  		       sizeof(struct htt_ppdu_stats_common));
@@ -486,7 +486,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  		break;
  	case HTT_PPDU_STATS_TAG_USR_RATE:
  		if (len < sizeof(struct htt_ppdu_stats_user_rate)) {
-@@ -1366,6 +1387,7 @@ static int ath11k_htt_tlv_ppdu_stats_par
+@@ -1299,6 +1320,7 @@ static int ath11k_htt_tlv_ppdu_stats_par
  						      peer_id);
  		if (cur_user < 0)
  			return -EINVAL;
@@ -494,7 +494,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  		user_stats = &ppdu_info->ppdu_stats.user_stats[cur_user];
  		user_stats->peer_id = peer_id;
  		user_stats->is_valid_peer_id = true;
-@@ -1394,44 +1416,30 @@ static int ath11k_htt_tlv_ppdu_stats_par
+@@ -1327,44 +1349,30 @@ static int ath11k_htt_tlv_ppdu_stats_par
  		       sizeof(struct htt_ppdu_stats_usr_cmpltn_ack_ba_status));
  		user_stats->tlv_flags |= BIT(tag);
  		break;
@@ -559,7 +559,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  	return 0;
  }
  
-@@ -1449,8 +1457,8 @@ ath11k_update_per_peer_tx_stats(struct a
+@@ -1382,8 +1390,8 @@ ath11k_update_per_peer_tx_stats(struct a
  	struct htt_ppdu_stats_common *common = &ppdu_stats->common;
  	int ret;
  	u8 flags, mcs, nss, bw, sgi, dcm, rate_idx = 0;
@@ -570,7 +570,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  	u32 tx_duration = 0;
  	u8 tid = HTT_PPDU_STATS_NON_QOS_TID;
  	bool is_ampdu = false;
-@@ -1481,6 +1489,11 @@ ath11k_update_per_peer_tx_stats(struct a
+@@ -1414,6 +1422,11 @@ ath11k_update_per_peer_tx_stats(struct a
  	mcs = HTT_USR_RATE_MCS(user_rate->rate_flags);
  	sgi = HTT_USR_RATE_GI(user_rate->rate_flags);
  	dcm = HTT_USR_RATE_DCM(user_rate->rate_flags);
@@ -582,7 +582,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  
  	/* Note: If host configured fixed rates and in some other special
  	 * cases, the broadcast/management frames are sent in different rates.
-@@ -1575,6 +1588,12 @@ ath11k_update_per_peer_tx_stats(struct a
+@@ -1508,6 +1521,12 @@ ath11k_update_per_peer_tx_stats(struct a
  		peer_stats->ba_fails =
  			HTT_USR_CMPLTN_LONG_RETRY(usr_stats->cmpltn_cmn.flags) +
  			HTT_USR_CMPLTN_SHORT_RETRY(usr_stats->cmpltn_cmn.flags);
@@ -595,7 +595,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  
  		if (ath11k_debugfs_is_extd_tx_stats_enabled(ar))
  			ath11k_debugfs_sta_add_tx_stats(arsta, peer_stats, rate_idx);
-@@ -1627,13 +1646,87 @@ struct htt_ppdu_stats_info *ath11k_dp_ht
+@@ -1560,13 +1579,89 @@ struct htt_ppdu_stats_info *ath11k_dp_ht
  	return ppdu_info;
  }
  
@@ -640,8 +640,10 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
 +	int ret = -EINVAL;
 +	struct htt_ppdu_stats_info * ppdu_info = NULL;
 +
-+	ppdu_info = (struct htt_ppdu_stats_info *)data;
-+	ppdu_info->tlv_bitmap = 0;
++	if (data) {
++		ppdu_info = (struct htt_ppdu_stats_info *)data;
++		ppdu_info->tlv_bitmap = 0;
++	}
 +	while (len > 0) {
 +		if (len < sizeof(*tlv)) {
 +			ath11k_err(ab, "htt tlv parse failure at byte %zd (%zu bytes left, %zu expected)\n",
@@ -684,7 +686,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  	u8 pdev_id;
  	u32 ppdu_id, len;
  
-@@ -1668,6 +1761,47 @@ static int ath11k_htt_pull_ppdu_stats(st
+@@ -1601,6 +1696,47 @@ static int ath11k_htt_pull_ppdu_stats(st
  		goto out_unlock_data;
  	}
  
@@ -734,7 +736,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  
 --- a/drivers/net/wireless/ath/ath11k/rx_desc.h
 +++ b/drivers/net/wireless/ath/ath11k/rx_desc.h
-@@ -1500,6 +1500,11 @@ struct hal_rx_desc {
+@@ -1494,6 +1494,11 @@ struct hal_rx_desc {
  	} u;
  } __packed;
  
@@ -748,9 +750,9 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  #define RU_52  2
 --- a/drivers/net/wireless/ath/ath11k/peer.h
 +++ b/drivers/net/wireless/ath/ath11k/peer.h
-@@ -48,6 +48,17 @@ struct ath11k_ast_entry {
- 	struct list_head ase_list;
- };
+@@ -7,6 +7,17 @@
+ #ifndef ATH11K_PEER_H
+ #define ATH11K_PEER_H
  
 +struct ppdu_user_delayba {
 +	u8 reserved0;
@@ -766,7 +768,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  struct ath11k_peer {
  	struct list_head list;
  	struct ieee80211_sta *sta;
-@@ -83,6 +94,8 @@ struct ath11k_peer {
+@@ -36,6 +47,8 @@ struct ath11k_peer {
  	u16 sec_type_grp;
  	bool is_authorized;
  	bool dp_setup_done;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/080-ath11k-ethernet-rx-decap-offload.patch b/package/kernel/mac80211/patches/nss/ath11k/080-ath11k-ethernet-rx-decap-offload.patch
new file mode 100644
index 00000000000000..3334ef52f8ec78
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/080-ath11k-ethernet-rx-decap-offload.patch
@@ -0,0 +1,15 @@
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -27,10 +27,10 @@ module_param_named(crypto_mode, ath11k_c
+ MODULE_PARM_DESC(crypto_mode, "crypto mode: 0-hardware, 1-software");
+ 
+ /* frame mode values are mapped as per enum ath11k_hw_txrx_mode */
+-unsigned int ath11k_frame_mode = ATH11K_HW_TXRX_NATIVE_WIFI;
++unsigned int ath11k_frame_mode = ATH11K_HW_TXRX_ETHERNET;
+ module_param_named(frame_mode, ath11k_frame_mode, uint, 0644);
+ MODULE_PARM_DESC(frame_mode,
+-		 "Datapath frame mode (0: raw, 1: native wifi (default), 2: ethernet)");
++		 "Datapath frame mode (0: raw, 1: native wifi, 2: ethernet(default))");
+ 
+ bool ath11k_ftm_mode;
+ module_param_named(ftm_mode, ath11k_ftm_mode, bool, 0444);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/084-ath11k-fix-ul-ofdma-counter-always-zero-in-peer-stat.patch b/package/kernel/mac80211/patches/nss/ath11k/084-ath11k-fix-ul-ofdma-counter-always-zero-in-peer-stat.patch
new file mode 100644
index 00000000000000..b46a32c09210ea
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/084-ath11k-fix-ul-ofdma-counter-always-zero-in-peer-stat.patch
@@ -0,0 +1,82 @@
+From 3827a38706dcf081992fccf30957b29e81a25e5c Mon Sep 17 00:00:00 2001
+From: Miles Hu <milehu@codeaurora.org>
+Date: Mon, 25 Nov 2019 10:24:41 -0800
+Subject: [PATCH] ath11k: fix ul-ofdma counter always zero in peer stats
+
+The problem is caused by RSSI_LEGACY tlv is not handled properly.
+All ul mu receiption information need to be extracted from the tlv.
+
+Signed-off-by: Miles Hu <milehu@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/debugfs_sta.c |  7 -------
+ drivers/net/wireless/ath/ath11k/hal_rx.c      | 17 +++++++++++++++++
+ drivers/net/wireless/ath/ath11k/hal_rx.h      |  8 ++++++++
+ 3 files changed, 25 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/debugfs_sta.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs_sta.c
+@@ -525,13 +525,6 @@ static ssize_t ath11k_dbg_sta_dump_rx_st
+ 				rx_stats->byte_stats.rx_rate[i],
+ 				(i + 1) % (he_rates_avail ? 12 : 8) ? "\t" : "\n");
+ 
+-	len += scnprintf(buf + len, size - len,
+-			 "\nDCM: %llu\nRU: 26 %llu 52: %llu 106: %llu 242: %llu 484: %llu 996: %llu\n",
+-			 rx_stats->dcm_count, rx_stats->ru_alloc_cnt[0],
+-			 rx_stats->ru_alloc_cnt[1], rx_stats->ru_alloc_cnt[2],
+-			 rx_stats->ru_alloc_cnt[3], rx_stats->ru_alloc_cnt[4],
+-			 rx_stats->ru_alloc_cnt[5]);
+-
+ 	len += scnprintf(buf + len, size - len, "\n");
+ 
+ 	spin_unlock_bh(&ar->ab->base_lock);
+--- a/drivers/net/wireless/ath/ath11k/hal_rx.c
++++ b/drivers/net/wireless/ath/ath11k/hal_rx.c
+@@ -1478,6 +1478,7 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+ 				       ab->wmi_ab.svc_map);
+ 		struct hal_rx_phyrx_rssi_legacy_info *rssi =
+ 			(struct hal_rx_phyrx_rssi_legacy_info *)tlv_data;
++		u32 reception_type = 0;
+ 
+ 		/* TODO: Please note that the combined rssi will not be accurate
+ 		 * in MU case. Rssi in MU needs to be retrieved from
+@@ -1487,6 +1488,22 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+ 			FIELD_GET(HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RSSI_COMB,
+ 				  __le32_to_cpu(rssi->info0));
+ 
++		reception_type =
++			FIELD_GET(HAL_RX_PHYRX_RSSI_LEGACY_INFO_RSVD1_RECEPTION,
++				  __le32_to_cpu(rssi->rsvd[0]));
++
++		switch (reception_type) {
++		case HAL_RECEPTION_TYPE_ULOFMDA:
++			ppdu_info->reception_type = HAL_RX_RECEPTION_TYPE_MU_OFDMA;
++			break;
++		case HAL_RECEPTION_TYPE_ULMIMO:
++			ppdu_info->reception_type = HAL_RX_RECEPTION_TYPE_MU_MIMO;
++			break;
++		default:
++			ppdu_info->reception_type = HAL_RX_RECEPTION_TYPE_SU;
++			break;
++		}
++
+ 		if (db2dbm) {
+ 			for (i = 0; i < ARRAY_SIZE(rssi->preamble); i++) {
+ 				ppdu_info->rssi_chain_pri20[i] =
+--- a/drivers/net/wireless/ath/ath11k/hal_rx.h
++++ b/drivers/net/wireless/ath/ath11k/hal_rx.h
+@@ -414,6 +414,15 @@ struct hal_rx_he_sig_b2_ofdma_info {
+ 
+ #define HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RSSI_COMB	GENMASK(15, 8)
+ 
++#define HAL_RX_PHYRX_RSSI_LEGACY_INFO_RSVD1_RECEPTION  GENMASK(3, 0)
++
++enum hal_rx_ul_reception_type {
++	HAL_RECEPTION_TYPE_ULOFMDA,
++	HAL_RECEPTION_TYPE_ULMIMO,
++	HAL_RECEPTION_TYPE_OTHER,
++	HAL_RECEPTION_TYPE_FRAMELESS
++};
++
+ #define HAL_RX_PHYRX_RSSI_PREAMBLE_PRI20	GENMASK(7, 0)
+ 
+ struct hal_rx_phyrx_chain_rssi {
diff --git a/package/kernel/mac80211/patches/ath11k_nss/087-ath11k-fix-ul-ofdma-counter-increamenting-improperly.patch b/package/kernel/mac80211/patches/nss/ath11k/087-ath11k-fix-ul-ofdma-counter-increamenting-improperly.patch
similarity index 91%
rename from package/kernel/mac80211/patches/ath11k_nss/087-ath11k-fix-ul-ofdma-counter-increamenting-improperly.patch
rename to package/kernel/mac80211/patches/nss/ath11k/087-ath11k-fix-ul-ofdma-counter-increamenting-improperly.patch
index 326db09145b342..52e2509b796c3d 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/087-ath11k-fix-ul-ofdma-counter-increamenting-improperly.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/087-ath11k-fix-ul-ofdma-counter-increamenting-improperly.patch
@@ -5,7 +5,7 @@
 
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -5242,8 +5242,11 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -5451,8 +5451,11 @@ int ath11k_dp_rx_process_mon_status(stru
  			goto next_skb;
  		}
  
@@ -33,7 +33,7 @@
  				      __le32_to_cpu(eu_stats->info7))) - 1;
 --- a/drivers/net/wireless/ath/ath11k/hal_rx.h
 +++ b/drivers/net/wireless/ath/ath11k/hal_rx.h
-@@ -66,6 +66,7 @@ enum hal_rx_reception_type {
+@@ -70,6 +70,7 @@ enum hal_rx_reception_type {
  };
  
  #define HAL_RX_FCS_LEN                          4
@@ -41,7 +41,7 @@
  
  enum hal_rx_mon_status {
  	HAL_RX_MON_STATUS_PPDU_NOT_DONE,
-@@ -150,6 +151,7 @@ struct hal_rx_mon_ppdu_info {
+@@ -171,6 +172,7 @@ struct hal_rx_mon_ppdu_info {
  	u8 rssi_comb;
  	u8 rssi_chain_pri20[HAL_RX_MAX_NSS];
  	u16 tid;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/907-108-ath11k-enable-ul-ofdma-ru-allocation-in-peer-stats.patch b/package/kernel/mac80211/patches/nss/ath11k/108-ath11k-enable-ul-ofdma-ru-allocation-in-peer-stats.patch
similarity index 91%
rename from package/kernel/mac80211/patches/ath11k_nss/907-108-ath11k-enable-ul-ofdma-ru-allocation-in-peer-stats.patch
rename to package/kernel/mac80211/patches/nss/ath11k/108-ath11k-enable-ul-ofdma-ru-allocation-in-peer-stats.patch
index 9be70411b10996..18477cd5234f1b 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/907-108-ath11k-enable-ul-ofdma-ru-allocation-in-peer-stats.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/108-ath11k-enable-ul-ofdma-ru-allocation-in-peer-stats.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath11k/debugfs_sta.c
 +++ b/drivers/net/wireless/ath/ath11k/debugfs_sta.c
-@@ -532,6 +532,12 @@ static ssize_t ath11k_dbg_sta_dump_rx_st
+@@ -524,6 +524,12 @@ static ssize_t ath11k_dbg_sta_dump_rx_st
  		len += scnprintf(buf + len, size - len, "%10llu%s",
  				rx_stats->byte_stats.rx_rate[i],
  				(i + 1) % (he_rates_avail ? 12 : 8) ? "\t" : "\n");
@@ -11,11 +11,11 @@
 +			 rx_stats->ru_alloc_cnt[3], rx_stats->ru_alloc_cnt[4],
 +			 rx_stats->ru_alloc_cnt[5]);
  
- 	len += scnprintf(buf + len, size - len,
- 			 "\nDCM: %llu\nRU: 26 %llu 52: %llu 106: %llu 242: %llu 484: %llu 996: %llu\n",
+ 	len += scnprintf(buf + len, size - len, "\n");
+ 
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -3236,11 +3236,12 @@ exit:
+@@ -2901,11 +2901,12 @@ exit:
  static void
  ath11k_dp_rx_update_peer_rate_table_stats(struct ath11k_rx_peer_stats *rx_stats,
  					  struct hal_rx_mon_ppdu_info *ppdu_info,
@@ -30,7 +30,7 @@
  	u32 bw_idx = ppdu_info->bw;
  	u32 gi_idx = ppdu_info->gi;
  
-@@ -3262,10 +3263,13 @@ ath11k_dp_rx_update_peer_rate_table_stat
+@@ -2927,10 +2928,13 @@ ath11k_dp_rx_update_peer_rate_table_stat
  	}
  
  	rx_stats->pkt_stats.rx_rate[rate_idx] += num_msdu;
@@ -46,7 +46,7 @@
  					   struct hal_rx_mon_ppdu_info *ppdu_info)
  {
  	struct ath11k_rx_peer_stats *rx_stats = arsta->rx_stats;
-@@ -3323,7 +3327,6 @@ static void ath11k_dp_rx_update_peer_sta
+@@ -2988,7 +2992,6 @@ static void ath11k_dp_rx_update_peer_sta
  	rx_stats->num_mpdu_fcs_ok += ppdu_info->num_mpdu_fcs_ok;
  	rx_stats->num_mpdu_fcs_err += ppdu_info->num_mpdu_fcs_err;
  	rx_stats->dcm_count += ppdu_info->dcm;
@@ -54,7 +54,7 @@
  
  	BUILD_BUG_ON(ARRAY_SIZE(arsta->chain_signal) >
  			     ARRAY_SIZE(ppdu_info->rssi_chain_pri20));
-@@ -3341,10 +3344,10 @@ static void ath11k_dp_rx_update_peer_sta
+@@ -3006,10 +3009,10 @@ static void ath11k_dp_rx_update_peer_sta
  
  	if (ppdu_info->preamble_type == HAL_RX_PREAMBLE_11N &&
  	    ppdu_info->mcs <= HAL_RX_MAX_MCS_HT) {
@@ -69,7 +69,7 @@
  	}
  
  	if (ppdu_info->preamble_type == HAL_RX_PREAMBLE_11AC &&
-@@ -3377,7 +3380,120 @@ static void ath11k_dp_rx_update_peer_sta
+@@ -3042,7 +3045,120 @@ static void ath11k_dp_rx_update_peer_sta
  		rx_stats->byte_stats.bw_count[ppdu_info->bw] += ppdu_info->mpdu_len;
  	}
  
@@ -191,7 +191,7 @@
  
  }
  
-@@ -5846,6 +5962,55 @@ static void ath11k_dp_rx_mon_dest_proces
+@@ -5380,6 +5496,55 @@ static void ath11k_dp_rx_mon_dest_proces
  	}
  }
  
@@ -247,20 +247,19 @@
  int ath11k_dp_rx_process_mon_status(struct ath11k_base *ab, int mac_id,
  				    struct napi_struct *napi, int budget)
  {
-@@ -5917,10 +6082,13 @@ int ath11k_dp_rx_process_mon_status(stru
- 			goto next_skb;
- 		}
+@@ -5453,8 +5618,13 @@ int ath11k_dp_rx_process_mon_status(stru
  
--		if ((ppdu_info->fc_valid) &&
--		    (ppdu_info->ast_index != HAL_AST_IDX_INVALID)) {
-+		if (ppdu_info->reception_type == HAL_RX_RECEPTION_TYPE_SU) {
- 			arsta = (struct ath11k_sta *)peer->sta->drv_priv;
+ 		if ((ppdu_info->fc_valid) &&
+ 		    (ppdu_info->ast_index != HAL_AST_IDX_INVALID)) {
+-			arsta = (struct ath11k_sta *)peer->sta->drv_priv;
 -			ath11k_dp_rx_update_peer_stats(arsta, ppdu_info);
-+			ath11k_dp_rx_update_peer_su_stats(arsta, ppdu_info);
-+		} else if ((ppdu_info->fc_valid) &&
-+			   (ppdu_info->ast_index != HAL_AST_IDX_INVALID)) {
-+			ath11k_dp_rx_mon_process_ulofdma(ppdu_info);
-+			ath11k_dp_rx_update_peer_mu_stats(ar, ppdu_info);
++			if (ppdu_info->reception_type == HAL_RX_RECEPTION_TYPE_SU) {
++				arsta = (struct ath11k_sta *)peer->sta->drv_priv;
++				ath11k_dp_rx_update_peer_su_stats(arsta, ppdu_info);
++			} else {
++				ath11k_dp_rx_mon_process_ulofdma(ppdu_info);
++				ath11k_dp_rx_update_peer_mu_stats(ar, ppdu_info);
++			}
  		}
  
  		if (ath11k_debugfs_is_pktlog_peer_valid(ar, peer->addr))
@@ -420,7 +419,7 @@
  struct hal_rx_ppdu_start {
 --- a/drivers/net/wireless/ath/ath11k/peer.c
 +++ b/drivers/net/wireless/ath/ath11k/peer.c
-@@ -94,6 +94,20 @@ struct ath11k_peer *ath11k_peer_find_by_
+@@ -93,6 +93,20 @@ struct ath11k_peer *ath11k_peer_find_by_
  	return NULL;
  }
  
@@ -438,12 +437,12 @@
 +	return NULL;
 +}
 +
- #ifdef CPTCFG_ATH11K_NSS_SUPPORT
- struct ath11k_ast_entry *ath11k_peer_ast_find_by_peer(struct ath11k_base *ab,
- 						      struct ath11k_peer *peer,
+ void ath11k_peer_unmap_event(struct ath11k_base *ab, u16 peer_id)
+ {
+ 	struct ath11k_peer *peer;
 --- a/drivers/net/wireless/ath/ath11k/peer.h
 +++ b/drivers/net/wireless/ath/ath11k/peer.h
-@@ -112,6 +112,7 @@ struct ath11k_peer *ath11k_peer_find(str
+@@ -59,6 +59,7 @@ struct ath11k_peer *ath11k_peer_find(str
  struct ath11k_peer *ath11k_peer_find_by_addr(struct ath11k_base *ab,
  					     const u8 *addr);
  struct ath11k_peer *ath11k_peer_find_by_id(struct ath11k_base *ab, int peer_id);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/113-ath11k-add-8023-undecap-support.patch b/package/kernel/mac80211/patches/nss/ath11k/113-ath11k-add-8023-undecap-support.patch
similarity index 92%
rename from package/kernel/mac80211/patches/ath11k_nss/113-ath11k-add-8023-undecap-support.patch
rename to package/kernel/mac80211/patches/nss/ath11k/113-ath11k-add-8023-undecap-support.patch
index 8ef3d9ba7c4d91..2ba2411c3ef54b 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/113-ath11k-add-8023-undecap-support.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/113-ath11k-add-8023-undecap-support.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -2163,6 +2163,42 @@ static void ath11k_dp_rx_h_undecap_eth(s
+@@ -2305,6 +2305,42 @@ static void ath11k_dp_rx_h_undecap_eth(s
  	ether_addr_copy(ieee80211_get_SA(hdr), sa);
  }
  
@@ -43,7 +43,7 @@
  static void ath11k_dp_rx_h_undecap(struct ath11k *ar, struct sk_buff *msdu,
  				   struct hal_rx_desc *rx_desc,
  				   enum hal_encrypt_type enctype,
-@@ -2204,7 +2240,8 @@ static void ath11k_dp_rx_h_undecap(struc
+@@ -2346,7 +2382,8 @@ static void ath11k_dp_rx_h_undecap(struc
  						   enctype, status);
  		break;
  	case DP_RX_DECAP_TYPE_8023:
diff --git a/package/kernel/mac80211/patches/ath11k_nss/142-ath11k-adding-support-for-mgmt-frame-stats.patch b/package/kernel/mac80211/patches/nss/ath11k/142-ath11k-adding-support-for-mgmt-frame-stats.patch
similarity index 97%
rename from package/kernel/mac80211/patches/ath11k_nss/142-ath11k-adding-support-for-mgmt-frame-stats.patch
rename to package/kernel/mac80211/patches/nss/ath11k/142-ath11k-adding-support-for-mgmt-frame-stats.patch
index f1dfc0f7b9a887..c069cc8ff9f58a 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/142-ath11k-adding-support-for-mgmt-frame-stats.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/142-ath11k-adding-support-for-mgmt-frame-stats.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -311,6 +311,16 @@ struct ath11k_rekey_data {
+@@ -314,6 +314,16 @@ struct ath11k_rekey_data {
  	bool enable_offload;
  };
  
@@ -17,7 +17,7 @@
  struct ath11k_vif {
  	u32 vdev_id;
  	enum wmi_vdev_type vdev_type;
-@@ -369,6 +379,8 @@ struct ath11k_vif {
+@@ -372,6 +382,8 @@ struct ath11k_vif {
  #ifdef CPTCFG_ATH11K_DEBUGFS
  	struct dentry *debugfs_twt;
  #endif /* CPTCFG_ATH11K_DEBUGFS */
@@ -39,7 +39,7 @@
 +	struct ath11k_vif *arvif = NULL;
 +	struct ath11k_mgmt_frame_stats *mgmt_stats;
 +	int len = 0, ret, i;
-+	int size = (TARGET_NUM_VDEVS - 1) * 1500;
++	int size = (TARGET_NUM_VDEVS(ar->ab) - 1) * 1500;
 +	char *buf;
 +	const char *mgmt_frm_type[ATH11K_STATS_MGMT_FRM_TYPE_MAX-1] = {"assoc_req", "assoc_resp",
 +								       "reassoc_req", "reassoc_resp",
@@ -178,7 +178,7 @@
  	}
 --- a/drivers/net/wireless/ath/ath11k/peer.c
 +++ b/drivers/net/wireless/ath/ath11k/peer.c
-@@ -444,6 +444,7 @@ int ath11k_peer_create(struct ath11k *ar
+@@ -458,6 +458,7 @@ int ath11k_peer_create(struct ath11k *ar
  
  	peer->sec_type = HAL_ENCRYPT_TYPE_OPEN;
  	peer->sec_type_grp = HAL_ENCRYPT_TYPE_OPEN;
@@ -188,7 +188,7 @@
  		arsta = ath11k_sta_to_arsta(sta);
 --- a/drivers/net/wireless/ath/ath11k/peer.h
 +++ b/drivers/net/wireless/ath/ath11k/peer.h
-@@ -10,6 +10,7 @@
+@@ -21,6 +21,7 @@ struct ppdu_user_delayba {
  struct ath11k_peer {
  	struct list_head list;
  	struct ieee80211_sta *sta;
@@ -233,7 +233,7 @@
 +	arvif = ath11k_vif_to_arvif(vif);
 +	mgmt_stats = &arvif->mgmt_stats;
 +
-+	if (!status)
++	if (!tx_compl_param->status)
 +		mgmt_stats->tx_compl_succ[frm_type]++;
 +	else
 +		mgmt_stats->tx_compl_fail[frm_type]++;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/907-ath11k-remove-error-on-soc-debugfs-fail.patch b/package/kernel/mac80211/patches/nss/ath11k/181-ath11k-remove-error-on-soc-debugfs-fail.patch
similarity index 88%
rename from package/kernel/mac80211/patches/ath11k_nss/907-ath11k-remove-error-on-soc-debugfs-fail.patch
rename to package/kernel/mac80211/patches/nss/ath11k/181-ath11k-remove-error-on-soc-debugfs-fail.patch
index b47785828a2bd9..ca21c0b14297b2 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/907-ath11k-remove-error-on-soc-debugfs-fail.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/181-ath11k-remove-error-on-soc-debugfs-fail.patch
@@ -34,7 +34,7 @@ Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
-@@ -2260,5 +2260,17 @@ err_sc_free:
+@@ -2189,5 +2189,17 @@ err_sc_free:
  }
  EXPORT_SYMBOL(ath11k_core_alloc);
  
@@ -54,16 +54,16 @@ Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
  MODULE_LICENSE("Dual BSD/GPL");
 --- a/drivers/net/wireless/ath/ath11k/debugfs.c
 +++ b/drivers/net/wireless/ath/ath11k/debugfs.c
-@@ -15,6 +15,8 @@
+@@ -16,6 +16,8 @@
+ #include "peer.h"
  #include "hif.h"
- #include "qmi.h"
  
 +struct dentry *debugfs_ath11k;
 +
  static const char *htt_bp_umac_ring[HTT_SW_UMAC_RING_IDX_MAX] = {
  	"REO2SW1_RING",
  	"REO2SW2_RING",
-@@ -1228,8 +1230,6 @@ int ath11k_debugfs_pdev_create(struct at
+@@ -991,8 +993,6 @@ int ath11k_debugfs_pdev_create(struct at
  
  void ath11k_debugfs_pdev_destroy(struct ath11k_base *ab)
  {
@@ -72,7 +72,7 @@ Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
  }
  
  int ath11k_debugfs_soc_create(struct ath11k_base *ab)
-@@ -1282,6 +1282,24 @@ void ath11k_debugfs_soc_destroy(struct a
+@@ -1045,6 +1045,24 @@ void ath11k_debugfs_soc_destroy(struct a
  }
  EXPORT_SYMBOL(ath11k_debugfs_soc_destroy);
  
@@ -97,17 +97,7 @@ Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
  void ath11k_debugfs_fw_stats_init(struct ath11k *ar)
  {
  	struct dentry *fwstats_dir = debugfs_create_dir("fw_stats",
-@@ -1932,6 +1950,9 @@ void ath11k_debugfs_unregister(struct at
- 		kfree(dbr_debug);
- 		ar->debug.dbr_debug[i] = NULL;
- 	}
-+
-+	debugfs_remove_recursive(ar->debug.debugfs_pdev);
-+	ar->debug.debugfs_pdev = NULL;
- }
- 
- static ssize_t ath11k_write_twt_add_dialog(struct file *file,
-@@ -2294,6 +2315,9 @@ int ath11k_debugfs_register(struct ath11
+@@ -1675,6 +1693,9 @@ int ath11k_debugfs_register(struct ath11
  	char pdev_name[10];
  	char buf[100] = {0};
  
@@ -117,10 +107,20 @@ Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
  	snprintf(pdev_name, sizeof(pdev_name), "%s%u", "mac", ar->pdev_idx);
  
  	ar->debug.debugfs_pdev = debugfs_create_dir(pdev_name, ab->debugfs_soc);
+@@ -1752,6 +1773,9 @@ void ath11k_debugfs_unregister(struct at
+ 		kfree(dbr_debug);
+ 		ar->debug.dbr_debug[i] = NULL;
+ 	}
++
++	debugfs_remove_recursive(ar->debug.debugfs_pdev);
++	ar->debug.debugfs_pdev = NULL;
+ }
+ 
+ static ssize_t ath11k_write_twt_add_dialog(struct file *file,
 --- a/drivers/net/wireless/ath/ath11k/debugfs.h
 +++ b/drivers/net/wireless/ath/ath11k/debugfs.h
-@@ -282,6 +282,8 @@ do {									\
- #endif
+@@ -263,6 +263,8 @@ struct ath11k_fw_dbglog {
+ };
  
  #ifdef CPTCFG_ATH11K_DEBUGFS
 +int ath11k_debugfs_create(void);
@@ -128,8 +128,8 @@ Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
  int ath11k_debugfs_soc_create(struct ath11k_base *ab);
  void ath11k_debugfs_soc_destroy(struct ath11k_base *ab);
  int ath11k_debugfs_pdev_create(struct ath11k_base *ab);
-@@ -338,6 +340,15 @@ static inline int ath11k_debug_is_memory
- }
+@@ -314,6 +316,15 @@ void ath11k_debugfs_add_dbring_entry(str
+ 				     struct hal_srng *srng);
  
  #else
 +static inline int ath11k_debugfs_create(void)
diff --git a/package/kernel/mac80211/patches/ath11k_nss/906-ath11k-m3-ssr-dump-collection.patch b/package/kernel/mac80211/patches/nss/ath11k/188-ath11k-m3-ssr-dump-collection.patch
similarity index 84%
rename from package/kernel/mac80211/patches/ath11k_nss/906-ath11k-m3-ssr-dump-collection.patch
rename to package/kernel/mac80211/patches/nss/ath11k/188-ath11k-m3-ssr-dump-collection.patch
index 47b29fd19e19bb..1fe5317105c137 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/906-ath11k-m3-ssr-dump-collection.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/188-ath11k-m3-ssr-dump-collection.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath11k/qmi.c
 +++ b/drivers/net/wireless/ath/ath11k/qmi.c
-@@ -2101,6 +2101,9 @@ static int ath11k_qmi_assign_target_mem_
+@@ -2100,6 +2100,9 @@ static int ath11k_qmi_assign_target_mem_
  			ab->qmi.target_mem[idx].type = ab->qmi.target_mem[i].type;
  			idx++;
  			break;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/191-ath11k-add-mgmt-and-data-ack-rssi.patch b/package/kernel/mac80211/patches/nss/ath11k/191-ath11k-add-mgmt-and-data-ack-rssi.patch
similarity index 54%
rename from package/kernel/mac80211/patches/ath11k_nss/191-ath11k-add-mgmt-and-data-ack-rssi.patch
rename to package/kernel/mac80211/patches/nss/ath11k/191-ath11k-add-mgmt-and-data-ack-rssi.patch
index dea5600324f536..22cdb4dccb4d5d 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/191-ath11k-add-mgmt-and-data-ack-rssi.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/191-ath11k-add-mgmt-and-data-ack-rssi.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -9571,6 +9571,8 @@ static int __ath11k_mac_register(struct
+@@ -9579,6 +9579,8 @@ static int __ath11k_mac_register(struct
  		wiphy_ext_feature_set(ar->hw->wiphy,
  				      NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
  
@@ -19,30 +19,3 @@
  	wmi_cfg->peer_map_unmap_v2_support = tg_cfg->peer_map_unmap_v2_support;
  	wmi_cfg->sched_params = tg_cfg->sched_params;
  	wmi_cfg->twt_ap_pdev_count = tg_cfg->twt_ap_pdev_count;
-@@ -5874,7 +5875,7 @@ static int wmi_process_mgmt_tx_comp(stru
- 	arvif = ath11k_vif_to_arvif(vif);
- 	mgmt_stats = &arvif->mgmt_stats;
- 
--	if (!status)
-+	if (!tx_compl_param->status)
- 		mgmt_stats->tx_compl_succ[frm_type]++;
- 	else
- 		mgmt_stats->tx_compl_fail[frm_type]++;
---- a/drivers/net/wireless/ath/ath11k/wmi.h
-+++ b/drivers/net/wireless/ath/ath11k/wmi.h
-@@ -4539,6 +4539,7 @@ struct wmi_pdev_bss_chan_info_event {
- 	u32 rx_bss_cycle_count_low;
- 	u32 rx_bss_cycle_count_high;
- 	u32 pdev_id;
-+	u32 ack_rssi;
- } __packed;
- 
- #define WMI_VDEV_INSTALL_KEY_COMPL_STATUS_SUCCESS 0
-@@ -4890,7 +4891,6 @@ struct wmi_mgmt_tx_compl_event {
- 	u32 desc_id;
- 	u32 status;
- 	u32 pdev_id;
--	u32 ppdu_id;
- 	u32 ack_rssi;
- } __packed;
- 
diff --git a/package/kernel/mac80211/patches/ath11k_nss/199-002-ath11k_nss-add-nss-driver-interface.patch b/package/kernel/mac80211/patches/nss/ath11k/199-002-ath11k_nss-add-nss-driver-interface.patch
similarity index 99%
rename from package/kernel/mac80211/patches/ath11k_nss/199-002-ath11k_nss-add-nss-driver-interface.patch
rename to package/kernel/mac80211/patches/nss/ath11k/199-002-ath11k_nss-add-nss-driver-interface.patch
index 79f8190d5b990f..851e4ed0225a95 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/199-002-ath11k_nss-add-nss-driver-interface.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/199-002-ath11k_nss-add-nss-driver-interface.patch
@@ -48,7 +48,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  ath11k_ahb-y += ahb.o
 --- /dev/null
 +++ b/drivers/net/wireless/ath/ath11k/nss.c
-@@ -0,0 +1,2392 @@
+@@ -0,0 +1,2396 @@
 +// SPDX-License-Identifier: BSD-3-Clause-Clear
 +/*
 + * Copyright (c) 2020 The Linux Foundation. All rights reserved.
@@ -259,8 +259,9 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
 +	peer = ath11k_peer_find_by_id(ab, peer_id);
 +	if (!peer) {
 +		spin_unlock_bh(&ab->base_lock);
-+		ath11k_warn(ab, "ath11k_nss: unable to free peer mem, peer_id:%d\n",
-+			    peer_id);
++		if(ab->nss.debug_mode)
++      ath11k_warn(ab, "ath11k_nss: unable to free peer mem, peer_id:%d\n",
++            peer_id);
 +		return;
 +	}
 +
@@ -675,7 +676,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
 +	int encap_type = ath11k_dp_tx_get_encap_type(arvif, skb);
 +	struct ath11k_soc_dp_stats *soc_stats = &ar->ab->soc_stats;
 +
-+	if (!arvif->ar->ab->nss.debug_mode && encap_type != arvif->nss.encap) {
++	if (encap_type != arvif->nss.encap) {
 +		ath11k_warn(ar->ab, "encap mismatch in nss tx skb encap type %d" \
 +			    " vif encap type %d\n", encap_type, arvif->nss.encap);
 +		goto drop;
@@ -1421,7 +1422,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
 +	 */
 +	ret = wait_for_completion_timeout(&peer->nss.complete,
 +					  msecs_to_jiffies(ATH11K_NSS_MSG_TIMEOUT_MS));
-+	if (!ret)
++	if (ab->nss.debug_mode && !ret)
 +		ath11k_warn(ab, "timeout while waiting for nss peer delete msg response\n");
 +
 +	return 0;
@@ -1764,6 +1765,8 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
 +		return ATH11K_WIFILI_TARGET_TYPE_QCA6018;
 +	case ATH11K_HW_QCN9074_HW10:
 +		return ATH11K_WIFILI_TARGET_TYPE_QCN9074;
++	case ATH11K_HW_IPQ5018_HW10:
++		return ATH11K_WIFILI_TARGET_TYPE_QCA5018;
 +	default:
 +		ath11k_warn(ab, "NSS Offload not supported for this HW\n");
 +		return ATH11K_WIFILI_TARGET_TYPE_UNKNOWN;
@@ -1775,6 +1778,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
 +	switch (ab->hw_rev) {
 +	case ATH11K_HW_IPQ8074:
 +	case ATH11K_HW_IPQ6018_HW10:
++	case ATH11K_HW_IPQ5018_HW10:
 +		return NSS_WIFILI_INTERNAL_INTERFACE;
 +	case ATH11K_HW_QCN9074_HW10:
 +		return nss_get_available_wifili_external_if();
@@ -2799,7 +2803,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  static inline void ath11k_pci_select_window(struct ath11k_pci *ab_pci, u32 offset)
  {
  	struct ath11k_base *ab = ab_pci->ab;
-@@ -708,6 +722,7 @@ static const struct ath11k_hif_ops ath11
+@@ -710,6 +724,7 @@ static const struct ath11k_hif_ops ath11
  	.map_service_to_pipe = ath11k_pcic_map_service_to_pipe,
  	.ce_irq_enable = ath11k_pci_hif_ce_irq_enable,
  	.ce_irq_disable = ath11k_pci_hif_ce_irq_disable,
@@ -2979,7 +2983,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  enum dp_rx_decap_type {
  	DP_RX_DECAP_TYPE_RAW,
  	DP_RX_DECAP_TYPE_NATIVE_WIFI,
-@@ -56,6 +84,9 @@ void ath11k_peer_rx_tid_delete(struct at
+@@ -75,6 +103,9 @@ void ath11k_peer_rx_tid_delete(struct at
  int ath11k_peer_rx_tid_setup(struct ath11k *ar, const u8 *peer_mac, int vdev_id,
  			     u8 tid, u32 ba_win_sz, u16 ssn,
  			     enum hal_pn_type pn_type);
@@ -3010,7 +3014,16 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	/* TODO: Do we need to enable ANI? */
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -913,6 +913,7 @@ struct ath11k_base {
+@@ -849,6 +849,8 @@ struct ath11k_soc_dp_tx_err_stats {
+ 	 * idr unavailable etc.
+ 	 */
+ 	atomic_t misc_fail;
++	/* Tx failures due to NSS Tx error status */
++	atomic_t nss_tx_fail;
+ };
+ 
+ struct ath11k_soc_dp_stats {
+@@ -935,6 +937,7 @@ struct ath11k_base {
  	struct list_head peers;
  	wait_queue_head_t peer_mapping_wq;
  	u8 mac_addr[ETH_ALEN];
diff --git a/package/kernel/mac80211/patches/ath11k_nss/199-003-ath11k-add-nss-support.patch b/package/kernel/mac80211/patches/nss/ath11k/199-003-ath11k-add-nss-support.patch
similarity index 82%
rename from package/kernel/mac80211/patches/ath11k_nss/199-003-ath11k-add-nss-support.patch
rename to package/kernel/mac80211/patches/nss/ath11k/199-003-ath11k-add-nss-support.patch
index 34b30984ca76d2..2234cb6bc4cc1d 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/199-003-ath11k-add-nss-support.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/199-003-ath11k-add-nss-support.patch
@@ -156,15 +156,15 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  }
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -29,6 +29,7 @@
- #include "dbring.h"
+@@ -30,6 +30,7 @@
  #include "spectral.h"
  #include "wow.h"
+ #include "rx_desc.h"
 +#include "nss.h"
  
  #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
  
-@@ -381,6 +382,9 @@ struct ath11k_vif {
+@@ -384,6 +385,9 @@ struct ath11k_vif {
  #endif /* CPTCFG_ATH11K_DEBUGFS */
  
  	struct ath11k_mgmt_frame_stats mgmt_stats;
@@ -174,7 +174,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  };
  
  struct ath11k_vif_iter {
-@@ -520,6 +524,9 @@ struct ath11k_sta {
+@@ -537,6 +541,9 @@ struct ath11k_sta {
  #endif
  
  	bool use_4addr_set;
@@ -184,7 +184,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	u16 tcl_metadata;
  
  	/* Protected with ar->data_lock */
-@@ -610,6 +617,9 @@ struct ath11k {
+@@ -632,6 +639,9 @@ struct ath11k {
  	struct ieee80211_hw *hw;
  	struct ieee80211_ops *ops;
  	struct ath11k_pdev_wmi *wmi;
@@ -194,15 +194,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	struct ath11k_pdev_dp dp;
  	u8 mac_addr[ETH_ALEN];
  	struct ath11k_he ar_he;
-@@ -827,6 +837,7 @@ struct ath11k_soc_dp_tx_err_stats {
- 	 * idr unavailable etc.
- 	 */
- 	atomic_t misc_fail;
-+	atomic_t nss_tx_fail;
- };
- 
- struct ath11k_soc_dp_stats {
-@@ -868,9 +879,11 @@ struct ath11k_base {
+@@ -892,9 +902,11 @@ struct ath11k_base {
  	struct ath11k_htc htc;
  
  	struct ath11k_dp dp;
@@ -365,7 +357,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	if (ar->ab->hw_params.rxdma1_enable) {
  		rx_ring = &dp->rxdma_mon_buf_ring;
-@@ -1893,7 +1896,7 @@ static void ath11k_dp_rx_h_csum_offload(
+@@ -2035,7 +2038,7 @@ static void ath11k_dp_rx_h_csum_offload(
  			  CHECKSUM_NONE : CHECKSUM_UNNECESSARY;
  }
  
@@ -374,7 +366,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  				       enum hal_encrypt_type enctype)
  {
  	switch (enctype) {
-@@ -1920,7 +1923,7 @@ static int ath11k_dp_rx_crypto_mic_len(s
+@@ -2062,7 +2065,7 @@ static int ath11k_dp_rx_crypto_mic_len(s
  	return 0;
  }
  
@@ -383,7 +375,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  					 enum hal_encrypt_type enctype)
  {
  	switch (enctype) {
-@@ -1948,7 +1951,7 @@ static int ath11k_dp_rx_crypto_param_len
+@@ -2090,7 +2093,7 @@ static int ath11k_dp_rx_crypto_param_len
  	return 0;
  }
  
@@ -392,7 +384,56 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  				       enum hal_encrypt_type enctype)
  {
  	switch (enctype) {
-@@ -5239,7 +5242,7 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -2826,6 +2829,22 @@ static void ath11k_dp_rx_process_receive
+ 	}
+ }
+ 
++void ath11k_dp_rx_from_nss(struct ath11k *ar, struct sk_buff *msdu,
++                           struct napi_struct *napi)
++{
++	struct ieee80211_rx_status rx_status = {0};
++	struct ath11k_skb_rxcb *rxcb;
++
++	rxcb = ATH11K_SKB_RXCB(msdu);
++
++	ath11k_dp_rx_h_ppdu(ar, rxcb->rx_desc, &rx_status);
++	ath11k_dp_rx_h_mpdu(ar, msdu, rxcb->rx_desc, &rx_status);
++
++	rx_status.flag |= RX_FLAG_SKIP_MONITOR | RX_FLAG_DUP_VALIDATED;
++
++	ath11k_dp_rx_deliver_msdu(ar, napi, msdu, &rx_status);
++}
++
+ int ath11k_dp_process_rx(struct ath11k_base *ab, int ring_id,
+ 			 struct napi_struct *napi, int budget)
+ {
+@@ -3133,6 +3152,13 @@ static void ath11k_dp_rx_update_user_sta
+ 	arsta = (struct ath11k_sta *)peer->sta->drv_priv;
+ 	rx_stats = arsta->rx_stats;
+ 
++	if (ar->ab->nss.enabled)
++		ath11k_nss_update_sta_rxrate(ppdu_info, peer, user_stats);
++
++	/* we've updated rate stats dont update dp rx stats if not enabled */
++	if (!ath11k_debugfs_is_extd_rx_stats_enabled(ar))
++		return;
++
+ 	if (!rx_stats)
+ 		return;
+ 
+@@ -3209,8 +3235,10 @@ static void ath11k_dp_rx_update_peer_mu_
+ {
+ 	u32 num_users, i;
+ 
+-	if (!ath11k_debugfs_is_extd_rx_stats_enabled(ar))
++	if (!ar->ab->nss.enabled &&
++	    !ath11k_debugfs_is_extd_rx_stats_enabled(ar)) {
+ 		return;
++	}
+ 
+ 	num_users = ppdu_info->num_users;
+ 	if (num_users > HAL_MAX_UL_MU_USERS)
+@@ -5613,7 +5641,7 @@ int ath11k_dp_rx_process_mon_status(stru
  	struct sk_buff *skb;
  	struct sk_buff_head skb_list;
  	struct ath11k_peer *peer;
@@ -401,9 +442,17 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	int num_buffs_reaped = 0;
  	u32 rx_buf_sz;
  	u16 log_type;
+@@ -5681,6 +5709,7 @@ int ath11k_dp_rx_process_mon_status(stru
+ 			if (ppdu_info->reception_type == HAL_RX_RECEPTION_TYPE_SU) {
+ 				arsta = (struct ath11k_sta *)peer->sta->drv_priv;
+ 				ath11k_dp_rx_update_peer_su_stats(arsta, ppdu_info);
++				ath11k_nss_update_sta_rxrate(ppdu_info, peer, NULL);
+ 			} else {
+ 				ath11k_dp_rx_mon_process_ulofdma(ppdu_info);
+ 				ath11k_dp_rx_update_peer_mu_stats(ar, ppdu_info);
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.h
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.h
-@@ -126,4 +126,16 @@ int ath11k_peer_rx_frag_setup(struct ath
+@@ -145,4 +145,18 @@ int ath11k_peer_rx_frag_setup(struct ath
  int ath11k_dp_rx_pktlog_start(struct ath11k_base *ab);
  int ath11k_dp_rx_pktlog_stop(struct ath11k_base *ab, bool stop_timer);
  
@@ -419,6 +468,8 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
 +				 struct hal_rx_desc *desc);
 +u16 ath11k_dp_rx_h_mpdu_start_peer_id(struct ath11k_base *ab,
 +				      struct hal_rx_desc *desc);
++void ath11k_dp_rx_from_nss(struct ath11k *ar, struct sk_buff *msdu,
++				      struct napi_struct *napi);
  #endif /* ATH11K_DP_RX_H */
 --- a/drivers/net/wireless/ath/ath11k/hal.h
 +++ b/drivers/net/wireless/ath/ath11k/hal.h
@@ -431,6 +482,21 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  enum hal_ring_type {
  	HAL_REO_DST,
  	HAL_REO_EXCEPTION,
+--- a/drivers/net/wireless/ath/ath11k/hal_rx.c
++++ b/drivers/net/wireless/ath/ath11k/hal_rx.c
+@@ -938,6 +938,12 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+ 		ppdu_info->num_mpdu_fcs_err =
+ 			FIELD_GET(HAL_RX_PPDU_END_USER_STATS_INFO0_MPDU_CNT_FCS_ERR,
+ 				  info0);
++
++		if (ppdu_info->fc_valid)
++			ppdu_info->frame_control =
++				FIELD_GET(HAL_RX_PPDU_END_USER_STATS_INFO2_FRAME_CTRL,
++						__le32_to_cpu(eu_stats->info2));
++
+ 		switch (ppdu_info->preamble_type) {
+ 		case HAL_RX_PREAMBLE_11N:
+ 			ppdu_info->ht_flags = 1;
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
 @@ -24,6 +24,7 @@
@@ -573,7 +639,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	}
  }
  
-@@ -6241,6 +6310,8 @@ static int ath11k_mac_config_mon_status_
+@@ -6241,6 +6308,8 @@ static int ath11k_mac_config_mon_status_
  
  	if (enable) {
  		tlv_filter = ath11k_mac_mon_status_filter_default;
@@ -582,7 +648,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		if (ath11k_debugfs_rx_filter(ar))
  			tlv_filter.rx_filter = ath11k_debugfs_rx_filter(ar);
  	}
-@@ -6539,7 +6610,7 @@ static int ath11k_mac_setup_vdev_create_
+@@ -6539,7 +6608,7 @@ static int ath11k_mac_setup_vdev_create_
  	return 0;
  }
  
@@ -591,7 +657,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  					     struct ieee80211_vif *vif)
  {
  	struct ath11k *ar = hw->priv;
-@@ -6585,6 +6656,8 @@ static void ath11k_mac_op_update_vif_off
+@@ -6585,6 +6654,8 @@ static void ath11k_mac_op_update_vif_off
  			    arvif->vdev_id, ret);
  		vif->offload_flags &= ~IEEE80211_OFFLOAD_DECAP_ENABLED;
  	}
@@ -600,7 +666,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  }
  
  static bool ath11k_mac_vif_ap_active_any(struct ath11k_base *ab)
-@@ -6715,6 +6788,8 @@ static int ath11k_mac_vdev_delete(struct
+@@ -6715,6 +6786,8 @@ static int ath11k_mac_vdev_delete(struct
  
  	reinit_completion(&ar->vdev_delete_done);
  
@@ -609,7 +675,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	ret = ath11k_wmi_vdev_delete(ar, arvif->vdev_id);
  	if (ret) {
  		ath11k_warn(ar->ab, "failed to delete WMI vdev %d: %d\n",
-@@ -6855,7 +6930,34 @@ static int ath11k_mac_op_add_interface(s
+@@ -6855,7 +6928,34 @@ static int ath11k_mac_op_add_interface(s
  	list_add(&arvif->list, &ar->arvifs);
  	spin_unlock_bh(&ar->data_lock);
  
@@ -645,7 +711,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	nss = get_num_chains(ar->cfg_tx_chainmask) ? : 1;
  	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id,
-@@ -6979,6 +7081,7 @@ err_peer_del:
+@@ -6979,6 +7079,7 @@ err_peer_del:
  	}
  
  err_vdev_del:
@@ -653,7 +719,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	ath11k_mac_vdev_delete(ar, arvif);
  	spin_lock_bh(&ar->data_lock);
  	list_del(&arvif->list);
-@@ -7489,6 +7592,10 @@ ath11k_mac_update_vif_chan(struct ath11k
+@@ -7489,6 +7590,10 @@ ath11k_mac_update_vif_chan(struct ath11k
  				    arvif->vdev_id, ret);
  			continue;
  		}
@@ -664,7 +730,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	}
  
  	/* Restart the internal monitor vdev on new channel */
-@@ -8717,6 +8824,8 @@ static void ath11k_mac_op_sta_statistics
+@@ -8717,6 +8822,8 @@ static void ath11k_mac_op_sta_statistics
  	sinfo->signal_avg = ewma_avg_rssi_read(&arsta->avg_rssi) +
  		ATH11K_DEFAULT_NOISE_FLOOR;
  	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
@@ -673,7 +739,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  }
  
  #if IS_ENABLED(CONFIG_IPV6)
-@@ -9136,6 +9245,7 @@ static const struct ieee80211_ops ath11k
+@@ -9144,6 +9251,7 @@ static const struct ieee80211_ops ath11k
  	.update_vif_offload		= ath11k_mac_op_update_vif_offload,
  	.config                         = ath11k_mac_op_config,
  	.bss_info_changed               = ath11k_mac_op_bss_info_changed,
@@ -681,7 +747,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	.configure_filter		= ath11k_mac_op_configure_filter,
  	.hw_scan                        = ath11k_mac_op_hw_scan,
  	.cancel_hw_scan                 = ath11k_mac_op_cancel_hw_scan,
-@@ -9521,7 +9631,8 @@ static int __ath11k_mac_register(struct
+@@ -9529,7 +9637,8 @@ static int __ath11k_mac_register(struct
  		ieee80211_hw_set(ar->hw, TX_AMPDU_SETUP_IN_HW);
  		ieee80211_hw_set(ar->hw, SUPPORTS_REORDERING_BUFFER);
  		ieee80211_hw_set(ar->hw, SUPPORTS_AMSDU_IN_AMPDU);
@@ -691,7 +757,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	}
  
  	ar->hw->wiphy->features |= NL80211_FEATURE_STATIC_SMPS;
-@@ -9636,6 +9747,9 @@ static int __ath11k_mac_register(struct
+@@ -9644,6 +9753,9 @@ static int __ath11k_mac_register(struct
  	    ab->hw_params.bios_sar_capa)
  		ar->hw->wiphy->sar_capa = ab->hw_params.bios_sar_capa;
  
@@ -711,7 +777,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  static struct ath11k_peer *ath11k_peer_find_list_by_id(struct ath11k_base *ab,
  						       int peer_id)
-@@ -136,6 +137,8 @@ void ath11k_peer_map_event(struct ath11k
+@@ -150,6 +151,8 @@ void ath11k_peer_map_event(struct ath11k
  		ether_addr_copy(peer->addr, mac_addr);
  		list_add(&peer->list, &ab->peers);
  		wake_up(&ab->peer_mapping_wq);
@@ -720,7 +786,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	}
  
  	ath11k_dbg(ab, ATH11K_DBG_DP_HTT, "peer map vdev %d peer %pM id %d\n",
-@@ -298,17 +301,13 @@ static int __ath11k_peer_delete(struct a
+@@ -312,17 +315,13 @@ static int __ath11k_peer_delete(struct a
  
  	lockdep_assert_held(&ar->conf_mutex);
  
@@ -741,7 +807,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	/* Fallback to peer list search if the correct peer can't be found.
  	 * Skip the deletion of the peer from the rhash since it has already
-@@ -327,10 +326,17 @@ static int __ath11k_peer_delete(struct a
+@@ -341,10 +340,17 @@ static int __ath11k_peer_delete(struct a
  		return -EINVAL;
  	}
  
@@ -760,17 +826,9 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	ret = ath11k_wmi_send_peer_delete_cmd(ar, addr, vdev_id);
  	if (ret) {
-@@ -446,6 +452,7 @@ int ath11k_peer_create(struct ath11k *ar
- 	peer->sec_type_grp = HAL_ENCRYPT_TYPE_OPEN;
- 	peer->vif = arvif->vif;
- 
-+
- 	if (sta) {
- 		arsta = ath11k_sta_to_arsta(sta);
- 		arsta->tcl_metadata |= FIELD_PREP(HTT_TCL_META_DATA_TYPE, 0) |
 --- a/drivers/net/wireless/ath/ath11k/peer.h
 +++ b/drivers/net/wireless/ath/ath11k/peer.h
-@@ -17,6 +17,7 @@ struct ath11k_peer {
+@@ -28,6 +28,7 @@ struct ath11k_peer {
  	u16 ast_hash;
  	u8 pdev_idx;
  	u16 hw_peer_id;
@@ -801,9 +859,9 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  #include "hif.h"
 +#include "qmi.h"
  
- static const char *htt_bp_umac_ring[HTT_SW_UMAC_RING_IDX_MAX] = {
- 	"REO2SW1_RING",
-@@ -663,6 +662,7 @@ static ssize_t ath11k_write_extd_rx_stat
+ struct dentry *debugfs_ath11k;
+ 
+@@ -665,6 +664,7 @@ static ssize_t ath11k_write_extd_rx_stat
  			HTT_RX_FP_DATA_FILTER_FLASG3;
  	} else {
  		tlv_filter = ath11k_mac_mon_status_filter_default;
@@ -811,90 +869,18 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	}
  
  	ar->debug.rx_filter = tlv_filter.rx_filter;
-@@ -1669,72 +1669,6 @@ static const struct file_operations fops
- 	.open = simple_open
- };
- 
--int ath11k_debugfs_register(struct ath11k *ar)
--{
--	struct ath11k_base *ab = ar->ab;
--	char pdev_name[10];
--	char buf[100] = {0};
--
--	snprintf(pdev_name, sizeof(pdev_name), "%s%u", "mac", ar->pdev_idx);
--
--	ar->debug.debugfs_pdev = debugfs_create_dir(pdev_name, ab->debugfs_soc);
--	if (IS_ERR(ar->debug.debugfs_pdev))
--		return PTR_ERR(ar->debug.debugfs_pdev);
--
--	/* Create a symlink under ieee80211/phy* */
--	snprintf(buf, 100, "../../ath11k/%pd2", ar->debug.debugfs_pdev);
--	debugfs_create_symlink("ath11k", ar->hw->wiphy->debugfsdir, buf);
--
--	ath11k_debugfs_htt_stats_init(ar);
--
--	ath11k_debugfs_fw_stats_init(ar);
--
--	debugfs_create_file("ext_tx_stats", 0644,
--			    ar->debug.debugfs_pdev, ar,
--			    &fops_extd_tx_stats);
--	debugfs_create_file("ext_rx_stats", 0644,
--			    ar->debug.debugfs_pdev, ar,
--			    &fops_extd_rx_stats);
--	debugfs_create_file("pktlog_filter", 0644,
--			    ar->debug.debugfs_pdev, ar,
--			    &fops_pktlog_filter);
--	debugfs_create_file("fw_dbglog_config", 0600,
--			    ar->debug.debugfs_pdev, ar,
--			    &fops_fw_dbglog);
--	debugfs_create_file("dump_mgmt_stats", 0644,
--			    ar->debug.debugfs_pdev, ar,
--			    &fops_dump_mgmt_stats);
--
--	if (ar->hw->wiphy->bands[NL80211_BAND_5GHZ]) {
--		debugfs_create_file("dfs_simulate_radar", 0200,
--				    ar->debug.debugfs_pdev, ar,
--				    &fops_simulate_radar);
--		debugfs_create_bool("dfs_block_radar_events", 0200,
--				    ar->debug.debugfs_pdev,
--				    &ar->dfs_block_radar_events);
--	}
--
--	if (ab->hw_params.dbr_debug_support)
--		debugfs_create_file("enable_dbr_debug", 0200, ar->debug.debugfs_pdev,
--				    ar, &fops_dbr_debug);
--
--	debugfs_create_file("ps_state_enable", 0600, ar->debug.debugfs_pdev, ar,
--			    &fops_ps_state_enable);
--
--	if (test_bit(WMI_TLV_SERVICE_PEER_POWER_SAVE_DURATION_SUPPORT,
--		     ar->ab->wmi_ab.svc_map)) {
--		debugfs_create_file("ps_timekeeper_enable", 0600,
--				    ar->debug.debugfs_pdev, ar,
--				    &fops_ps_timekeeper_enable);
--
--		debugfs_create_file("reset_ps_duration", 0200,
--				    ar->debug.debugfs_pdev, ar,
--				    &fops_reset_ps_duration);
--	}
--
--	return 0;
--}
--
- void ath11k_debugfs_unregister(struct ath11k *ar)
- {
- 	struct ath11k_debug_dbr *dbr_debug;
-@@ -1977,6 +1911,144 @@ static const struct file_operations ath1
+@@ -1687,6 +1687,76 @@ static const struct file_operations fops
  	.open = simple_open
  };
  
++
 +static ssize_t ath11k_write_nss_stats(struct file *file,
 +				      const char __user *ubuf,
 +				      size_t count, loff_t *ppos)
 +{
 +	struct ath11k *ar = file->private_data;
 +	struct ath11k_base *ab = ar->ab;
-+	u32 nss_stats;
++	u8 nss_stats;
 +	int ret;
 +
 +	if (!ab->nss.enabled) {
@@ -902,7 +888,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
 +		return -EINVAL;
 +	}
 +
-+	if (kstrtouint_from_user(ubuf, count, 0, &nss_stats))
++	if (kstrtou8_from_user(ubuf, count, 0, &nss_stats))
 +		return -EINVAL;
 +
 +	mutex_lock(&ar->conf_mutex);
@@ -957,78 +943,21 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
 +	.llseek = default_llseek,
 +};
 +
-+int ath11k_debugfs_register(struct ath11k *ar)
-+{
-+	struct ath11k_base *ab = ar->ab;
-+	char pdev_name[10];
-+	char buf[100] = {0};
-+
-+	snprintf(pdev_name, sizeof(pdev_name), "%s%u", "mac", ar->pdev_idx);
-+
-+	ar->debug.debugfs_pdev = debugfs_create_dir(pdev_name, ab->debugfs_soc);
-+	if (IS_ERR(ar->debug.debugfs_pdev))
-+		return PTR_ERR(ar->debug.debugfs_pdev);
-+
-+	/* Create a symlink under ieee80211/phy* */
-+	snprintf(buf, 100, "../../ath11k/%pd2", ar->debug.debugfs_pdev);
-+	debugfs_create_symlink("ath11k", ar->hw->wiphy->debugfsdir, buf);
-+
-+	ath11k_debugfs_htt_stats_init(ar);
-+
-+	ath11k_debugfs_fw_stats_init(ar);
-+
-+	debugfs_create_file("ext_tx_stats", 0644,
-+			    ar->debug.debugfs_pdev, ar,
-+			    &fops_extd_tx_stats);
-+	debugfs_create_file("ext_rx_stats", 0644,
-+			    ar->debug.debugfs_pdev, ar,
-+			    &fops_extd_rx_stats);
-+	debugfs_create_file("pktlog_filter", 0644,
-+			    ar->debug.debugfs_pdev, ar,
-+			    &fops_pktlog_filter);
-+	debugfs_create_file("fw_dbglog_config", 0600,
-+			    ar->debug.debugfs_pdev, ar,
-+			    &fops_fw_dbglog);
-+	debugfs_create_file("dump_mgmt_stats", 0644,
-+			    ar->debug.debugfs_pdev, ar,
-+			    &fops_dump_mgmt_stats);
-+
-+	if (ar->hw->wiphy->bands[NL80211_BAND_5GHZ]) {
-+		debugfs_create_file("dfs_simulate_radar", 0200,
-+				    ar->debug.debugfs_pdev, ar,
-+				    &fops_simulate_radar);
-+		debugfs_create_bool("dfs_block_radar_events", 0200,
-+				    ar->debug.debugfs_pdev,
-+				    &ar->dfs_block_radar_events);
-+	}
-+
-+	if (ab->hw_params.dbr_debug_support)
-+		debugfs_create_file("enable_dbr_debug", 0200, ar->debug.debugfs_pdev,
-+				    ar, &fops_dbr_debug);
-+
-+	debugfs_create_file("ps_state_enable", 0600, ar->debug.debugfs_pdev, ar,
-+			    &fops_ps_state_enable);
-+
-+	if (test_bit(WMI_TLV_SERVICE_PEER_POWER_SAVE_DURATION_SUPPORT,
-+		     ar->ab->wmi_ab.svc_map)) {
-+		debugfs_create_file("ps_timekeeper_enable", 0600,
-+				    ar->debug.debugfs_pdev, ar,
-+				    &fops_ps_timekeeper_enable);
-+
-+		debugfs_create_file("reset_ps_duration", 0200,
-+				    ar->debug.debugfs_pdev, ar,
-+				    &fops_reset_ps_duration);
-+	}
-+
+ int ath11k_debugfs_register(struct ath11k *ar)
+ {
+ 	struct ath11k_base *ab = ar->ab;
+@@ -1753,6 +1823,11 @@ int ath11k_debugfs_register(struct ath11
+ 				    &fops_reset_ps_duration);
+ 	}
+ 
 +	if (ab->nss.enabled)
 +		debugfs_create_file("nss_peer_stats_config", 0644,
-+				    ar->debug.debugfs_pdev, ar, &fops_nss_stats);
++				    ar->debug.debugfs_pdev, ar,
++				    &fops_nss_stats);
 +
-+	return 0;
-+}
- void ath11k_debugfs_add_interface(struct ath11k_vif *arvif)
- {
- 	struct ath11k_base *ab = arvif->ar->ab;
+ 	return 0;
+ }
+ 
 --- a/drivers/net/wireless/ath/ath11k/dp_tx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
 @@ -12,7 +12,7 @@
@@ -1062,7 +991,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  #include "hif.h"
  #include "wmi.h"
  #include "../../../../../net/mac80211/sta_info.h"
-@@ -465,7 +467,7 @@ deliver_amsdu:
+@@ -466,7 +468,7 @@ deliver_amsdu:
  
  	/* create list containing all the subframes */
  	ieee80211_amsdu_to_8023s(skb, &subframe_list, NULL,
@@ -1071,7 +1000,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	/* This shouldn't happen, indicating error during defragmentation */
  	if (skb_queue_empty(&subframe_list))
-@@ -657,12 +659,14 @@ drop:
+@@ -658,12 +660,14 @@ drop:
  	return -EINVAL;
  }
  
@@ -1087,7 +1016,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	if (!ar->ab->nss.enabled)
  		return 0;
-@@ -675,6 +679,22 @@ int ath11k_nss_vdev_set_cmd(struct ath11
+@@ -676,6 +680,22 @@ int ath11k_nss_vdev_set_cmd(struct ath11
  	if (!vdev_msg)
  		return -ENOMEM;
  
@@ -1110,7 +1039,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	/* TODO: Convert to function for conversion in case of many
  	 * such commands
  	 */
-@@ -1136,7 +1156,6 @@ void ath11k_nss_update_sta_stats(struct
+@@ -1137,7 +1157,6 @@ void ath11k_nss_update_sta_stats(struct
  {
  	struct sta_info *stainfo;
  	struct ath11k_peer *peer;
@@ -1118,7 +1047,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	struct ath11k *ar = arsta->arvif->ar;
  	struct ath11k_base *ab = ar->ab;
  
-@@ -1230,6 +1249,9 @@ void ath11k_nss_update_sta_rxrate(struct
+@@ -1231,6 +1250,9 @@ void ath11k_nss_update_sta_rxrate(struct
  	if (!ab->nss.enabled)
  		return;
  
@@ -1128,7 +1057,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	if (!peer->nss.nss_stats)
  		return;
  
-@@ -1289,7 +1311,7 @@ void ath11k_nss_update_sta_rxrate(struct
+@@ -1290,7 +1312,7 @@ void ath11k_nss_update_sta_rxrate(struct
  		peer->nss.nss_stats->rxrate.mcs = mcs;
  		peer->nss.nss_stats->rxrate.flags = RATE_INFO_FLAGS_HE_MCS;
  		peer->nss.nss_stats->rxrate.he_dcm = ppdu_info->dcm;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/203-mac80211-ath11k-fw-dynamic-muedca.patch b/package/kernel/mac80211/patches/nss/ath11k/203-mac80211-ath11k-fw-dynamic-muedca.patch
new file mode 100644
index 00000000000000..a91d4aa97cbbca
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/203-mac80211-ath11k-fw-dynamic-muedca.patch
@@ -0,0 +1,162 @@
+From ed838800bb8f4c59b320395066ac356f74528a50 Mon Sep 17 00:00:00 2001
+From: Muna Sinada <msinada@codeaurora.org>
+Date: Wed, 29 Jul 2020 00:11:30 -0700
+Subject: [PATCH] 203-mac80211-ath11k-fw-dynamic-muedca.patch
+
+mac80211/ath11k:FW Initiated Dynamic MU-EDCA
+
+Implementing the updating of firmware initiated dynamic MU-EDCA
+parameters in Beacon IE. Firmware routinely checks its clients and
+updates its MU-EDCA values every 3 seconds. Firmware is tuning
+MU-EDCA parameters to improve performance. As part of this process,
+the firmware informs host about new MU-EDCA values utilizing
+WMI_MUEDCA_PARAMS_CONFIG_EVENTID. FW expectation is that host will
+update MU-EDCA parameters in the Beacon IE.
+Implementation consists of:
+	(1) Receiving updated parameters through event in ATH11k
+	(2) Passing updated parameters ATH11k -> mac80211 -> cfg80211
+	(3) Passing updated parameters to user space.
+
+Signed-off-by: Muna Sinada <msinada@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/wmi.c | 97 +++++++++++++++++++++++++++++++----
+ drivers/net/wireless/ath/ath11k/wmi.h | 12 +++++
+ include/net/cfg80211.h                | 11 ++++
+ include/net/mac80211.h                | 13 +++++
+ include/uapi/linux/nl80211.h          | 10 ++++
+ net/mac80211/mlme.c                   | 12 +++++
+ net/mac80211/trace.h                  | 20 ++++++++
+ net/wireless/nl80211.c                | 36 +++++++++++++
+ 8 files changed, 200 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -148,6 +148,8 @@ static const struct wmi_tlv_policy wmi_t
+ 		.min_len = sizeof(struct wmi_vdev_delete_resp_event) },
+ 	[WMI_TAG_OBSS_COLOR_COLLISION_EVT] = {
+ 		.min_len = sizeof(struct wmi_obss_color_collision_event) },
++	[WMI_TAG_MUEDCA_PARAMS_CONFIG_EVENT] = {
++		.min_len = sizeof(struct wmi_pdev_update_muedca_event) },
+ 	[WMI_TAG_11D_NEW_COUNTRY_EVENT] = {
+ 		.min_len = sizeof(struct wmi_11d_new_cc_ev) },
+ 	[WMI_TAG_PER_CHAIN_RSSI_STATS] = {
+@@ -8727,6 +8729,74 @@ exit:
+ 	kfree(tb);
+ }
+ 
++static void
++ath11k_wmi_pdev_update_muedca_params_status_event(struct ath11k_base *ab,
++						  struct sk_buff *skb)
++{
++	const void **tb;
++	const struct wmi_pdev_update_muedca_event *ev;
++	struct ieee80211_mu_edca_param_set *params;
++	struct ath11k *ar;
++	int ret;
++
++	tb = ath11k_wmi_tlv_parse_alloc(ab, skb->data, skb->len, GFP_ATOMIC);
++	if (IS_ERR(tb)) {
++		ret = PTR_ERR(tb);
++		ath11k_warn(ab, "failed to parse tlv: %d\n", ret);
++		return;
++	}
++
++	ev = tb[WMI_TAG_MUEDCA_PARAMS_CONFIG_EVENT];
++	if (!ev) {
++		ath11k_warn(ab, "failed to fetch pdev update muedca params ev");
++		goto exit;
++	}
++
++	ath11k_dbg(ab, ATH11K_DBG_WMI,
++		   "Update MU-EDCA parameters for pdev:%d\n", ev->pdev_id);
++
++	ar = ath11k_mac_get_ar_by_pdev_id(ab, ev->pdev_id);
++	if (!ar) {
++		ath11k_warn(ab,
++			    "MU-EDCA parameter change in invalid pdev %d\n",
++			    ev->pdev_id);
++		goto exit;
++	}
++
++	params = kzalloc(sizeof(*params), GFP_ATOMIC);
++	if (!params) {
++		ath11k_warn(ab,
++			"Failed to allocate memory for updated MU-EDCA Parameters");
++		goto exit;
++	}
++
++	params->ac_be.aifsn = ev->aifsn[0];
++	params->ac_be.ecw_min_max = ((0xF & ev->ecwmax[0]) << 4) |
++				    (0xF & ev->ecwmin[0]);
++	params->ac_be.mu_edca_timer = ev->muedca_expiration_time[0];
++
++	params->ac_bk.aifsn = ev->aifsn[1];
++	params->ac_bk.ecw_min_max = ((0xF & ev->ecwmax[1]) << 4) |
++				    (0xF & ev->ecwmin[1]);
++	params->ac_bk.mu_edca_timer = ev->muedca_expiration_time[1];
++
++	params->ac_vi.aifsn = ev->aifsn[2];
++	params->ac_vi.ecw_min_max = ((0xF & ev->ecwmax[2]) << 4) |
++				    (0xF & ev->ecwmin[2]);
++	params->ac_vi.mu_edca_timer = ev->muedca_expiration_time[2];
++
++	params->ac_vo.aifsn = ev->aifsn[3];
++	params->ac_vo.ecw_min_max = ((0xF & ev->ecwmax[3]) << 4) |
++				    (0xF & ev->ecwmin[3]);
++	params->ac_vo.mu_edca_timer = ev->muedca_expiration_time[3];
++
++	ieee80211_update_muedca_params(ar->hw, params, GFP_ATOMIC);
++
++	kfree(params);
++exit:
++	kfree(tb);
++}
++
+ static void ath11k_wmi_tlv_op_rx(struct ath11k_base *ab, struct sk_buff *skb)
+ {
+ 	struct wmi_cmd_hdr *cmd_hdr;
+@@ -8845,6 +8915,9 @@ static void ath11k_wmi_tlv_op_rx(struct
+ 	case WMI_11D_NEW_COUNTRY_EVENTID:
+ 		ath11k_reg_11d_new_cc_event(ab, skb);
+ 		break;
++	case WMI_MUEDCA_PARAMS_CONFIG_EVENTID:
++		ath11k_wmi_pdev_update_muedca_params_status_event(ab, skb);
++		break;
+ 	case WMI_DIAG_EVENTID:
+ 		ath11k_wmi_diag_event(ab, skb);
+ 		break;
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -759,6 +759,7 @@ enum wmi_tlv_event_id {
+ 	WMI_READ_DATA_FROM_FLASH_EVENTID,
+ 	WMI_REPORT_RX_AGGR_FAILURE_EVENTID,
+ 	WMI_PKGID_EVENTID,
++	WMI_MUEDCA_PARAMS_CONFIG_EVENTID = 0x1d01e,
+ 	WMI_GPIO_INPUT_EVENTID = WMI_TLV_CMD(WMI_GRP_GPIO),
+ 	WMI_UPLOADH_EVENTID,
+ 	WMI_CAPTUREH_EVENTID,
+@@ -1869,6 +1870,7 @@ enum wmi_tlv_tag {
+ 	WMI_TAG_NDP_EVENT,
+ 	WMI_TAG_PDEV_PEER_PKTLOG_FILTER_CMD = 0x301,
+ 	WMI_TAG_PDEV_PEER_PKTLOG_FILTER_INFO,
++	WMI_TAG_MUEDCA_PARAMS_CONFIG_EVENT = 0x32a,
+ 	WMI_TAG_FILS_DISCOVERY_TMPL_CMD = 0x344,
+ 	WMI_TAG_PDEV_SRG_BSS_COLOR_BITMAP_CMD = 0x37b,
+ 	WMI_TAG_PDEV_SRG_PARTIAL_BSSID_BITMAP_CMD,
+@@ -4868,6 +4870,16 @@ struct wmi_pdev_temperature_event {
+ 	u32 pdev_id;
+ } __packed;
+ 
++#define WMI_AC_MAX				4
++
++struct wmi_pdev_update_muedca_event {
++	u32 pdev_id;
++	u32 aifsn[WMI_AC_MAX];
++	u32 ecwmin[WMI_AC_MAX];
++	u32 ecwmax[WMI_AC_MAX];
++	u32 muedca_expiration_time[WMI_AC_MAX];
++} __packed;
++
+ #define WMI_RX_STATUS_OK			0x00
+ #define WMI_RX_STATUS_ERR_CRC			0x01
+ #define WMI_RX_STATUS_ERR_DECRYPT		0x08
diff --git a/package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Add-support-for-dynamic-vlan.patch b/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Add-support-for-dynamic-vlan.patch
similarity index 99%
rename from package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Add-support-for-dynamic-vlan.patch
rename to package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Add-support-for-dynamic-vlan.patch
index a937ffba79961c..54a6d1528422db 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Add-support-for-dynamic-vlan.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Add-support-for-dynamic-vlan.patch
@@ -21,7 +21,7 @@ Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -116,6 +116,7 @@ struct ath11k_skb_cb {
+@@ -119,6 +119,7 @@ struct ath11k_skb_cb {
  	u32 cipher;
  	struct ath11k *ar;
  	struct ieee80211_vif *vif;
@@ -369,7 +369,7 @@ Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
  int ath11k_dp_tx(struct ath11k *ar, struct ath11k_vif *arvif,
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -9764,6 +9764,9 @@ static int __ath11k_mac_register(struct
+@@ -9770,6 +9770,9 @@ static int __ath11k_mac_register(struct
  		 */
  		ar->hw->wiphy->interface_modes &= ~BIT(NL80211_IFTYPE_MONITOR);
  
diff --git a/package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Enable-256_512MB-profiles.patch b/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Enable-256_512MB-profiles.patch
similarity index 68%
rename from package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Enable-256_512MB-profiles.patch
rename to package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Enable-256_512MB-profiles.patch
index 4d7af8641311dc..4d9c1537a8bb4b 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/207-ath11k-Enable-256_512MB-profiles.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Enable-256_512MB-profiles.patch
@@ -45,34 +45,21 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	depends on m
 --- a/drivers/net/wireless/ath/ath11k/hw.h
 +++ b/drivers/net/wireless/ath/ath11k/hw.h
-@@ -11,11 +11,43 @@
+@@ -11,11 +11,29 @@
  #include "wmi.h"
  
  /* Target configuration defines */
-+#if defined(CPTCFG_ATH11K_MEM_PROFILE_256M)
-+#define TARGET_NUM_VDEVS(ab)	8
-+#define TARGET_NUM_PEERS_PDEV(ab)	(128 + TARGET_NUM_VDEVS(ab))
-+/* Max num of stations (per radio) */
-+#define TARGET_NUM_STATIONS(ab)	128
-+#define ATH11K_QMI_TARGET_MEM_MODE	ATH11K_QMI_TARGET_MEM_MODE_256M
-+#define ATH11K_DP_TX_COMP_RING_SIZE	2048
-+#define ATH11K_DP_RXDMA_BUF_RING_SIZE		1024
-+#define ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE	512
-+#define ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE	128
-+#define ATH11K_DP_RXDMA_MONITOR_DST_RING_SIZE	128
-+
-+#elif defined(CPTCFG_ATH11K_MEM_PROFILE_512M)
++#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
+ 
 +#define TARGET_NUM_VDEVS(ab)	8
 +#define TARGET_NUM_PEERS_PDEV(ab)	(128 + TARGET_NUM_VDEVS(ab))
 +/* Max num of stations (per radio) */
 +#define TARGET_NUM_STATIONS(ab)	128
 +#define ATH11K_QMI_TARGET_MEM_MODE	ATH11K_QMI_TARGET_MEM_MODE_512M
 +#define ATH11K_DP_TX_COMP_RING_SIZE	8192
-+#define ATH11K_DP_RXDMA_BUF_RING_SIZE		4096
 +#define ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE	512
 +#define ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE	128
 +#define ATH11K_DP_RXDMA_MONITOR_DST_RING_SIZE	128
- 
 +#else
  /* Num VDEVS per radio */
 -#define TARGET_NUM_VDEVS(ab)	(ab->hw_params.num_vdevs)
@@ -84,7 +71,6 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
 +#define TARGET_NUM_STATIONS(ab) (ab->hw_params.num_vdevs_peers[ab->qmi.target_mem_mode].num_peers)
 +#define ATH11K_QMI_TARGET_MEM_MODE		ATH11K_QMI_TARGET_MEM_MODE_DEFAULT
 +#define ATH11K_DP_TX_COMP_RING_SIZE		32768
-+#define ATH11K_DP_RXDMA_BUF_RING_SIZE		4096
 +#define ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE	1024
 +#define ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE	4096
 +#define ATH11K_DP_RXDMA_MONITOR_DST_RING_SIZE	2048
@@ -92,7 +78,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  /* Num of peers for Single Radio mode */
  #define TARGET_NUM_PEERS_SINGLE(ab) (TARGET_NUM_PEERS_PDEV(ab))
-@@ -26,9 +58,6 @@
+@@ -26,9 +44,6 @@
  /* Num of peers for DBS_SBS */
  #define TARGET_NUM_PEERS_DBS_SBS(ab)	(3 * TARGET_NUM_PEERS_PDEV(ab))
  
@@ -102,7 +88,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  #define TARGET_NUM_PEERS(ab, x)	TARGET_NUM_PEERS_##x(ab)
  #define TARGET_NUM_PEER_KEYS	2
  #define TARGET_NUM_TIDS(ab, x)	(2 * TARGET_NUM_PEERS(ab, x) +	\
-@@ -226,6 +255,7 @@ struct ath11k_hw_params {
+@@ -226,6 +241,7 @@ struct ath11k_hw_params {
  	u32 tx_ring_size;
  	bool smp2p_wow_exit;
  	bool support_fw_mac_sequence;
@@ -125,17 +111,18 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  #define QMI_WLFW_REQUEST_MEM_IND_V01		0x0035
  #define QMI_WLFW_FW_MEM_READY_IND_V01		0x0037
  #define QMI_WLFW_COLD_BOOT_CAL_DONE_IND_V01	0x003E
-@@ -519,4 +525,10 @@ int ath11k_qmi_init_service(struct ath11
- void ath11k_qmi_free_resource(struct ath11k_base *ab);
- int ath11k_qmi_fwreset_from_cold_boot(struct ath11k_base *ab);
+@@ -42,6 +48,11 @@
+ #define ATH11K_QMI_DEVICE_BAR_SIZE		0x200000
  
+ struct ath11k_base;
 +enum ath11k_target_mem_mode {
-+  ATH11K_QMI_TARGET_MEM_MODE_DEFAULT = 0,
-+  ATH11K_QMI_TARGET_MEM_MODE_512M,
-+  ATH11K_QMI_TARGET_MEM_MODE_256M,
++ 	ATH11K_QMI_TARGET_MEM_MODE_DEFAULT = 0,
++ 	ATH11K_QMI_TARGET_MEM_MODE_512M,
++	ATH11K_QMI_TARGET_MEM_MODE_256M,
 +};
-+
- #endif
+ 
+ enum ath11k_qmi_file_type {
+ 	ATH11K_QMI_FILE_TYPE_BDF_GOLDEN,
 --- a/local-symbols
 +++ b/local-symbols
 @@ -171,6 +171,8 @@ ATH11K=
@@ -149,28 +136,27 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  ATH11K_TRACING=
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -863,6 +863,11 @@ struct ath11k_msi_config {
+@@ -887,6 +887,11 @@ struct ath11k_msi_config {
  	u16 hw_rev;
  };
  
 +struct ath11k_num_vdevs_peers {
-+  u32 num_vdevs;
-+  u32 num_peers;
++	u32 num_vdevs;
++	u32 num_peers;
 +};
 +
  /* Master structure to hold the hw data which may be used in core module */
  struct ath11k_base {
  	enum ath11k_hw_rev hw_rev;
-@@ -1016,6 +1021,9 @@ struct ath11k_base {
- 	} testmode;
- #endif
+@@ -1032,6 +1037,8 @@ struct ath11k_base {
+ 		const struct ath11k_pci_ops *ops;
+ 	} pci;
  
 +	atomic_t num_max_allowed;
-+	struct ath11k_num_vdevs_peers *num_vdevs_peers;
 +
- 	/* must be last */
- 	u8 drv_priv[] __aligned(sizeof(void *));
- };
+ #ifdef CPTCFG_NL80211_TESTMODE
+ 	struct {
+ 		u32 data_pos;
 --- a/drivers/net/wireless/ath/ath11k/dp.h
 +++ b/drivers/net/wireless/ath/ath11k/dp.h
 @@ -206,8 +206,9 @@ struct ath11k_pdev_dp {
@@ -180,7 +166,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
 -#define DP_TX_COMP_RING_SIZE		32768
 +#define DP_TX_COMP_RING_SIZE		ATH11K_DP_TX_COMP_RING_SIZE
  #define DP_TX_IDR_SIZE			DP_TX_COMP_RING_SIZE
-+#define DP_TX_COMP_MAX_ALLOWED			DP_TX_COMP_RING_SIZE
++#define DP_TX_COMP_MAX_ALLOWED         DP_TX_COMP_RING_SIZE
  #define DP_TCL_CMD_RING_SIZE		32
  #define DP_TCL_STATUS_RING_SIZE		32
  #define DP_REO_DST_RING_MAX		4
@@ -199,7 +185,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  #define DP_RX_RELEASE_RING_NUM	3
 --- a/drivers/net/wireless/ath/ath11k/dp_tx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
-@@ -265,6 +265,7 @@ tcl_ring_sel:
+@@ -334,6 +334,7 @@ tcl_ring_sel:
  			skb->data, skb->len);
  
  	atomic_inc(&ar->dp.num_tx_pending);
@@ -207,7 +193,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  	return 0;
  
-@@ -309,6 +310,7 @@ static void ath11k_dp_tx_free_txbuf(stru
+@@ -380,6 +381,7 @@ static void ath11k_dp_tx_free_txbuf(stru
  	ar = ab->pdevs[mac_id].ar;
  	if (atomic_dec_and_test(&ar->dp.num_tx_pending))
  		wake_up(&ar->dp.tx_empty_waitq);
@@ -215,7 +201,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  }
  
  static void
-@@ -342,6 +344,7 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
+@@ -411,6 +413,7 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
  
  	if (atomic_dec_and_test(&ar->dp.num_tx_pending))
  		wake_up(&ar->dp.tx_empty_waitq);
@@ -223,7 +209,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  	dma_unmap_single(ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
  
-@@ -769,6 +772,7 @@ void ath11k_dp_tx_completion_handler(str
+@@ -825,6 +828,7 @@ void ath11k_dp_tx_completion_handler(str
  			wake_up(&ar->dp.tx_empty_waitq);
  
  		ath11k_dp_tx_complete_msdu(ar, msdu, &ts);
@@ -233,23 +219,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
-@@ -9,6 +9,7 @@
- #include <linux/remoteproc.h>
- #include <linux/firmware.h>
- #include <linux/of.h>
-+#include <linux/of_platform.h>
- 
- #include "core.h"
- #include "dp_tx.h"
-@@ -16,6 +17,7 @@
- #include "debug.h"
- #include "hif.h"
- #include "wow.h"
-+#include "ahb.h"
- 
- unsigned int nss_offload;
- #ifdef CPTCFG_ATH11K_NSS_SUPPORT
-@@ -42,6 +44,8 @@ bool ath11k_ftm_mode;
+@@ -42,6 +42,8 @@ bool ath11k_ftm_mode;
  module_param_named(ftm_mode, ath11k_ftm_mode, bool, 0444);
  MODULE_PARM_DESC(ftm_mode, "Boots up in factory test mode");
  
@@ -258,44 +228,24 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  static struct ath11k_hw_params ath11k_hw_params[] = {
  	{
  		.hw_rev = ATH11K_HW_IPQ8074,
-@@ -95,15 +99,15 @@ static struct ath11k_hw_params ath11k_hw
- 		.coldboot_cal_mm = false,
- 		.coldboot_cal_ftm = false,
- 		.cbcal_restart_fw = true,
--		.fw_mem_mode = 0,
-+		.fw_mem_mode = ATH11K_QMI_TARGET_MEM_MODE,
- 		.num_vdevs = 16 + 1,
- 		.num_peers = 512,
- 		.supports_suspend = false,
- 		.hal_desc_sz = sizeof(struct hal_rx_desc_ipq8074),
-+		.reo_dest_ring_map_shift = HAL_REO_DEST_RING_CTRL_HASH_RING_SHIFT,
- 		.supports_regdb = false,
- 		.fix_l1ss = true,
- 		.credit_flow = false,
--		.max_tx_ring = DP_TCL_NUM_RING_MAX,
- 		.hal_params = &ath11k_hw_hal_params_ipq8074,
- 		.supports_dynamic_smps_6ghz = false,
- 		.alloc_cacheable_memory = true,
-@@ -127,6 +131,9 @@ static struct ath11k_hw_params ath11k_hw
+@@ -127,6 +129,7 @@ static struct ath11k_hw_params ath11k_hw
  		.tcl_ring_retry = true,
  		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
  		.smp2p_wow_exit = false,
-+		/* In addition to TCL ring use TCL_CMD ring also for tx */
-+		.max_tx_ring = DP_TCL_NUM_RING_MAX + 1,
 +		.num_vdevs_peers = ath11k_vdevs_peers,
  	},
  	{
  		.hw_rev = ATH11K_HW_IPQ6018_HW10,
-@@ -177,7 +183,7 @@ static struct ath11k_hw_params ath11k_hw
- 		.coldboot_cal_mm = true,
- 		.coldboot_cal_ftm = true,
+@@ -177,7 +180,7 @@ static struct ath11k_hw_params ath11k_hw
+ 		.coldboot_cal_mm = false,
+ 		.coldboot_cal_ftm = false,
  		.cbcal_restart_fw = true,
 -		.fw_mem_mode = 0,
 +		.fw_mem_mode = ATH11K_QMI_TARGET_MEM_MODE,
  		.num_vdevs = 16 + 1,
  		.num_peers = 512,
  		.supports_suspend = false,
-@@ -259,7 +265,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -259,7 +262,7 @@ static struct ath11k_hw_params ath11k_hw
  		.coldboot_cal_mm = false,
  		.coldboot_cal_ftm = false,
  		.cbcal_restart_fw = false,
@@ -304,7 +254,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		.num_vdevs = 16 + 1,
  		.num_peers = 512,
  		.supports_suspend = true,
-@@ -426,7 +432,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -426,7 +429,7 @@ static struct ath11k_hw_params ath11k_hw
  		.coldboot_cal_mm = false,
  		.coldboot_cal_ftm = false,
  		.cbcal_restart_fw = false,
@@ -313,7 +263,15 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		.num_vdevs = 16 + 1,
  		.num_peers = 512,
  		.supports_suspend = true,
-@@ -509,7 +515,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -462,6 +465,7 @@ static struct ath11k_hw_params ath11k_hw
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = true,
++		.num_vdevs_peers = ath11k_vdevs_peers,
+ 	},
+ 	{
+ 		.name = "wcn6855 hw2.1",
+@@ -509,7 +513,7 @@ static struct ath11k_hw_params ath11k_hw
  		.coldboot_cal_mm = false,
  		.coldboot_cal_ftm = false,
  		.cbcal_restart_fw = false,
@@ -322,7 +280,15 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		.num_vdevs = 16 + 1,
  		.num_peers = 512,
  		.supports_suspend = true,
-@@ -593,7 +599,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -545,6 +549,7 @@ static struct ath11k_hw_params ath11k_hw
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = true,
++		.num_vdevs_peers = ath11k_vdevs_peers,
+ 	},
+ 	{
+ 		.name = "wcn6750 hw1.0",
+@@ -593,7 +598,7 @@ static struct ath11k_hw_params ath11k_hw
  		.coldboot_cal_mm = true,
  		.coldboot_cal_ftm = true,
  		.cbcal_restart_fw = false,
@@ -331,7 +297,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		.num_vdevs = 16 + 1,
  		.num_peers = 512,
  		.supports_suspend = false,
-@@ -672,7 +678,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -672,7 +677,7 @@ static struct ath11k_hw_params ath11k_hw
  		.supports_monitor = false,
  		.supports_sta_ps = false,
  		.supports_shadow_regs = false,
@@ -340,11 +306,14 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		.num_vdevs = 16 + 1,
  		.num_peers = 512,
  		.supports_regdb = false,
-@@ -710,7 +716,23 @@ static struct ath11k_hw_params ath11k_hw
- 	},
- };
- 
--static inline struct ath11k_pdev *ath11k_core_get_single_pdev(struct ath11k_base *ab)
+@@ -707,6 +712,22 @@ static struct ath11k_hw_params ath11k_hw
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = false,
++		.num_vdevs_peers = ath11k_vdevs_peers,
++	},
++};
++
 +static const struct ath11k_num_vdevs_peers ath11k_vdevs_peers[] = {
 +	{
 +		.num_vdevs = (16 + 1),
@@ -357,22 +326,6 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
 +	{
 +		.num_vdevs = 8,
 +		.num_peers = 128,
-+	},
-+};
-+
-+static inline struct ath11k_pdev *
-+ath11k_core_get_single_pdev(struct ath11k_base *ab)
- {
- 	WARN_ON(!ab->hw_params.single_pdev_only);
+ 	},
+ };
  
---- a/drivers/net/wireless/ath/ath11k/debugfs.c
-+++ b/drivers/net/wireless/ath/ath11k/debugfs.c
-@@ -1595,7 +1595,7 @@ static ssize_t ath11k_dump_mgmt_stats(st
- 	struct ath11k_vif *arvif = NULL;
- 	struct ath11k_mgmt_frame_stats *mgmt_stats;
- 	int len = 0, ret, i;
--	int size = (TARGET_NUM_VDEVS - 1) * 1500;
-+	int size = (TARGET_NUM_VDEVS(ab) - 1) * 1500;
- 	char *buf;
- 	const char *mgmt_frm_type[ATH11K_STATS_MGMT_FRM_TYPE_MAX-1] = {"assoc_req", "assoc_resp",
- 								       "reassoc_req", "reassoc_resp",
diff --git a/package/kernel/mac80211/patches/ath11k_nss/902-001-ath11k-add-WDS-offload-changes-to-NSS-driver-interface.patch b/package/kernel/mac80211/patches/nss/ath11k/211-001-ath11k-add-WDS-offload-changes-to-NSS-driver-interface.patch
similarity index 96%
rename from package/kernel/mac80211/patches/ath11k_nss/902-001-ath11k-add-WDS-offload-changes-to-NSS-driver-interface.patch
rename to package/kernel/mac80211/patches/nss/ath11k/211-001-ath11k-add-WDS-offload-changes-to-NSS-driver-interface.patch
index 47146c459e796e..a470ba934507f1 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/902-001-ath11k-add-WDS-offload-changes-to-NSS-driver-interface.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/211-001-ath11k-add-WDS-offload-changes-to-NSS-driver-interface.patch
@@ -13,9 +13,9 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/nss.c
 +++ b/drivers/net/wireless/ath/ath11k/nss.c
-@@ -348,6 +348,22 @@ void ath11k_nss_wifili_event_receive(str
- 		ath11k_nss_wifili_link_desc_return(ab,
- 						   (void *)&msg->msg.linkdescinfomsg);
+@@ -307,6 +307,22 @@ void ath11k_nss_wifili_event_receive(str
+ 	case NSS_WIFILI_TID_REOQ_SETUP_MSG:
+ 		/* TODO setup tidq */
  		break;
 +	case NSS_WIFILI_WDS_PEER_ADD_MSG:
 +		ath11k_dbg(ab, ATH11K_DBG_NSS_WDS, "nss wifili wds peer add event received %d response %d error %d\n",
@@ -36,7 +36,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	default:
  		ath11k_dbg(ab, ATH11K_DBG_NSS, "unhandled event %d\n", msg_type);
  		break;
-@@ -458,13 +476,6 @@ static void ath11k_nss_vdev_event_receiv
+@@ -417,13 +433,6 @@ static void ath11k_nss_vdev_event_receiv
  	/*TODO*/
  }
  
@@ -50,7 +50,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  /* TODO: move to mac80211 after cleanups/refactoring required after feature completion */
  static int ath11k_nss_deliver_rx(struct ieee80211_vif *vif, struct sk_buff *skb,
  				 bool eth,  int data_offs, struct napi_struct *napi)
-@@ -588,11 +599,239 @@ static int ath11k_nss_undecap_nwifi(stru
+@@ -547,11 +556,239 @@ static int ath11k_nss_undecap_nwifi(stru
  	return 0;
  }
  
@@ -291,7 +291,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	struct wireless_dev *wdev = NULL;
  	struct ieee80211_vif *vif = NULL;
  	struct ath11k_vif *arvif;
-@@ -632,28 +871,16 @@ ath11k_nss_vdev_data_receive(struct net_
+@@ -591,28 +828,16 @@ ath11k_nss_vdev_data_receive(struct net_
  	ath11k_dbg_dump(ab, ATH11K_DBG_DP_RX, "", "dp rx msdu from nss: ",
  			skb->data, skb->len);
  
@@ -327,7 +327,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		dev_kfree_skb_any(skb);
  		return;
  	}
-@@ -1362,7 +1589,7 @@ void ath11k_nss_update_sta_rxrate(struct
+@@ -1321,7 +1546,7 @@ void ath11k_nss_update_sta_rxrate(struct
  	peer->nss.nss_stats->rxrate.bw = ath11k_mac_bw_to_mac80211_bw(ppdu_info->bw);
  }
  
@@ -336,7 +336,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  {
  	struct nss_wifili_peer_msg *peer_msg;
  	struct nss_wifili_msg *wlmsg = NULL;
-@@ -1376,9 +1603,10 @@ int ath11k_nss_peer_delete(struct ath11k
+@@ -1335,9 +1560,10 @@ int ath11k_nss_peer_delete(struct ath11k
  
  	spin_lock_bh(&ab->base_lock);
  
@@ -349,7 +349,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		spin_unlock_bh(&ab->base_lock);
  		return -EINVAL;
  	}
-@@ -1451,8 +1679,9 @@ free_peer:
+@@ -1410,8 +1636,9 @@ free_peer:
  	return ret;
  }
  
@@ -360,7 +360,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	struct nss_wifili_peer_msg *peer_msg;
  	struct nss_wifili_msg *wlmsg = NULL;
  	nss_wifili_msg_callback_t msg_cb;
-@@ -1509,17 +1738,23 @@ int ath11k_nss_peer_create(struct ath11k
+@@ -1468,17 +1695,23 @@ int ath11k_nss_peer_create(struct ath11k
  	status = nss_wifili_tx_msg(ab->nss.ctx, wlmsg);
  	if (status != NSS_TX_SUCCESS) {
  		ret = -EINVAL;
@@ -387,7 +387,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	peer->nss.nss_stats = kzalloc(sizeof(*peer->nss.nss_stats), GFP_ATOMIC);
  	if (!peer->nss.nss_stats) {
  		ret = -ENOMEM;
-@@ -1538,6 +1773,199 @@ msg_free:
+@@ -1497,6 +1730,199 @@ msg_free:
  	return ret;
  }
  
@@ -587,7 +587,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  /*-------------------------------INIT/DEINIT---------------------------------*/
  
  static int ath11k_nss_radio_buf_cfg(struct ath11k *ar, int range, int buf_sz)
-@@ -1931,7 +2359,7 @@ static int ath11k_nss_init(struct ath11k
+@@ -1890,7 +2316,7 @@ static int ath11k_nss_init(struct ath11k
  
  	status = nss_wifili_tx_msg(nss_contex, wlmsg);
  	if (status != NSS_TX_SUCCESS) {
@@ -596,7 +596,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		goto unregister;
  	}
  
-@@ -1985,7 +2413,8 @@ static int ath11k_nss_stats_cfg(struct a
+@@ -1944,7 +2370,8 @@ static int ath11k_nss_stats_cfg(struct a
  
  	status = nss_wifili_tx_msg(ar->nss.ctx, wlmsg);
  	if (status != NSS_TX_SUCCESS) {
@@ -624,7 +624,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
  /* WIFILI Supported Target Types */
  #define ATH11K_WIFILI_TARGET_TYPE_UNKNOWN   0xFF
-@@ -208,11 +210,19 @@ int ath11k_nss_vdev_create(struct ath11k
+@@ -205,11 +207,19 @@ int ath11k_nss_vdev_create(struct ath11k
  void ath11k_nss_vdev_delete(struct ath11k_vif *arvif);
  int ath11k_nss_vdev_up(struct ath11k_vif *arvif);
  int ath11k_nss_vdev_down(struct ath11k_vif *arvif);
@@ -646,7 +646,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  int ath11k_nss_set_peer_sec_type(struct ath11k *ar, struct ath11k_peer *peer,
  				 struct ieee80211_key_conf *key_conf);
  void ath11k_nss_update_sta_stats(struct station_info *sinfo,
-@@ -274,12 +284,37 @@ static inline int ath11k_nss_vdev_down(s
+@@ -271,12 +281,37 @@ static inline int ath11k_nss_vdev_down(s
  	return 0;
  }
  
diff --git a/package/kernel/mac80211/patches/ath11k_nss/902-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch b/package/kernel/mac80211/patches/nss/ath11k/211-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch
similarity index 93%
rename from package/kernel/mac80211/patches/ath11k_nss/902-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch
rename to package/kernel/mac80211/patches/nss/ath11k/211-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch
index 0e6c0d92d2abde..8ad2cc71f8981d 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/902-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/211-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch
@@ -26,7 +26,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -634,6 +634,7 @@ struct ath11k {
+@@ -642,6 +642,7 @@ struct ath11k {
  	struct ath11k_pdev_wmi *wmi;
  #ifdef CPTCFG_ATH11K_NSS_SUPPORT
  	struct ath11k_nss nss;
@@ -34,18 +34,19 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  #endif
  	struct ath11k_pdev_dp dp;
  	u8 mac_addr[ETH_ALEN];
-@@ -1042,6 +1043,8 @@ struct ath11k_base {
- 	u32 rx_hash;
- 	bool stats_disable;
+@@ -1047,6 +1048,9 @@ struct ath11k_base {
+ 	} testmode;
+ #endif
  
 +	u32 max_ast_index;
 +	u32 num_ast_entries;
++
  	/* must be last */
  	u8 drv_priv[] __aligned(sizeof(void *));
  };
 --- a/drivers/net/wireless/ath/ath11k/dp.h
 +++ b/drivers/net/wireless/ath/ath11k/dp.h
-@@ -1142,13 +1142,16 @@ struct htt_t2h_peer_map_event {
+@@ -1105,13 +1105,16 @@ struct htt_t2h_peer_map_event {
  #define HTT_T2H_PEER_UNMAP_INFO_PEER_ID	HTT_T2H_PEER_MAP_INFO_PEER_ID
  #define HTT_T2H_PEER_UNMAP_INFO1_MAC_ADDR_H16 \
  					HTT_T2H_PEER_MAP_INFO1_MAC_ADDR_H16
@@ -66,7 +67,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  struct htt_resp_msg {
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -1756,6 +1756,8 @@ void ath11k_dp_htt_htc_t2h_msg_handler(s
+@@ -1857,6 +1857,8 @@ void ath11k_dp_htt_htc_t2h_msg_handler(s
  	u16 peer_mac_h16;
  	u16 ast_hash;
  	u16 hw_peer_id;
@@ -75,7 +76,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
  	ath11k_dbg(ab, ATH11K_DBG_DP_HTT, "dp_htt rx msg type :0x%0x\n", type);
  
-@@ -1791,15 +1793,29 @@ void ath11k_dp_htt_htc_t2h_msg_handler(s
+@@ -1892,15 +1894,29 @@ void ath11k_dp_htt_htc_t2h_msg_handler(s
  				     resp->peer_map_ev.info2);
  		hw_peer_id = FIELD_GET(HTT_T2H_PEER_MAP_INFO1_HW_PEER_ID,
  				       resp->peer_map_ev.info1);
@@ -110,7 +111,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		break;
 --- a/drivers/net/wireless/ath/ath11k/dp_tx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
-@@ -431,7 +431,7 @@ ath11k_dp_tx_process_htt_tx_complete(str
+@@ -495,7 +495,7 @@ ath11k_dp_tx_process_htt_tx_complete(str
  		break;
  	case HAL_WBM_REL_HTT_TX_COMP_STATUS_MEC_NOTIFY:
  		/* This event is to be handled only when the driver decides to
@@ -121,7 +122,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	default:
 --- a/drivers/net/wireless/ath/ath11k/peer.c
 +++ b/drivers/net/wireless/ath/ath11k/peer.c
-@@ -94,6 +94,287 @@ struct ath11k_peer *ath11k_peer_find_by_
+@@ -108,6 +108,287 @@ struct ath11k_peer *ath11k_peer_find_by_
  	return NULL;
  }
  
@@ -409,7 +410,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  void ath11k_peer_unmap_event(struct ath11k_base *ab, u16 peer_id)
  {
  	struct ath11k_peer *peer;
-@@ -118,11 +399,67 @@ exit:
+@@ -132,11 +413,67 @@ exit:
  	spin_unlock_bh(&ab->base_lock);
  }
  
@@ -477,7 +478,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	spin_lock_bh(&ab->base_lock);
  	peer = ath11k_peer_find(ab, vdev_id, mac_addr);
  	if (!peer) {
-@@ -137,8 +474,8 @@ void ath11k_peer_map_event(struct ath11k
+@@ -151,8 +488,8 @@ void ath11k_peer_map_event(struct ath11k
  		ether_addr_copy(peer->addr, mac_addr);
  		list_add(&peer->list, &ab->peers);
  		wake_up(&ab->peer_mapping_wq);
@@ -488,7 +489,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	}
  
  	ath11k_dbg(ab, ATH11K_DBG_DP_HTT, "peer map vdev %d peer %pM id %d\n",
-@@ -146,6 +483,69 @@ void ath11k_peer_map_event(struct ath11k
+@@ -160,6 +497,69 @@ void ath11k_peer_map_event(struct ath11k
  
  exit:
  	spin_unlock_bh(&ab->base_lock);
@@ -558,7 +559,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  }
  
  static int ath11k_wait_for_peer_common(struct ath11k_base *ab, int vdev_id,
-@@ -242,20 +642,34 @@ err_clean:
+@@ -256,20 +656,34 @@ err_clean:
  
  void ath11k_peer_cleanup(struct ath11k *ar, u32 vdev_id)
  {
@@ -595,7 +596,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		ath11k_peer_rhash_delete(ab, peer);
  		list_del(&peer->list);
  		kfree(peer);
-@@ -302,7 +716,7 @@ static int __ath11k_peer_delete(struct a
+@@ -316,7 +730,7 @@ static int __ath11k_peer_delete(struct a
  	lockdep_assert_held(&ar->conf_mutex);
  
  	reinit_completion(&ar->peer_delete_done);
@@ -604,7 +605,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
  	mutex_lock(&ab->tbl_mtx_lock);
  	spin_lock_bh(&ab->base_lock);
-@@ -377,6 +791,7 @@ int ath11k_peer_create(struct ath11k *ar
+@@ -391,6 +805,7 @@ int ath11k_peer_create(struct ath11k *ar
  		       struct ieee80211_sta *sta, struct peer_create_params *param)
  {
  	struct ath11k_peer *peer;
@@ -612,27 +613,25 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	struct ath11k_sta *arsta;
  	int ret, fbret;
  
-@@ -450,7 +865,14 @@ int ath11k_peer_create(struct ath11k *ar
- 
- 	peer->sec_type = HAL_ENCRYPT_TYPE_OPEN;
+@@ -466,6 +881,13 @@ int ath11k_peer_create(struct ath11k *ar
  	peer->sec_type_grp = HAL_ENCRYPT_TYPE_OPEN;
--	peer->vif = arvif->vif;
-+	peer->vif = vif;
-+
+ 	peer->vif = arvif->vif;
+ 
 +#ifdef CPTCFG_ATH11K_NSS_SUPPORT
 +	if (vif->type == NL80211_IFTYPE_STATION && ar->ab->nss.enabled)
 +		ar->bss_peer = peer;
 +	else
 +		ar->bss_peer = NULL;
 +#endif
- 
- 
++
  	if (sta) {
+ 		arsta = ath11k_sta_to_arsta(sta);
+ 		arsta->tcl_metadata |= FIELD_PREP(HTT_TCL_META_DATA_TYPE, 0) |
 --- a/drivers/net/wireless/ath/ath11k/peer.h
 +++ b/drivers/net/wireless/ath/ath11k/peer.h
-@@ -7,6 +7,47 @@
- #ifndef ATH11K_PEER_H
- #define ATH11K_PEER_H
+@@ -18,6 +18,47 @@ struct ppdu_user_delayba {
+ 	u32 resp_rate_flags;
+ };
  
 +enum ath11k_ast_entry_type {
 +	ATH11K_AST_TYPE_NONE, /* static ast entry for connected peer */
@@ -678,7 +677,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  struct ath11k_peer {
  	struct list_head list;
  	struct ieee80211_sta *sta;
-@@ -18,6 +59,10 @@ struct ath11k_peer {
+@@ -29,6 +70,10 @@ struct ath11k_peer {
  	u8 pdev_idx;
  	u16 hw_peer_id;
  	struct ath11k_nss_peer nss;
@@ -689,7 +688,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
  	/* protected by ab->data_lock */
  	struct ieee80211_key_conf *keys[WMI_MAX_KEY_INDEX + 1];
-@@ -41,8 +86,13 @@ struct ath11k_peer {
+@@ -54,8 +99,13 @@ struct ath11k_peer {
  };
  
  void ath11k_peer_unmap_event(struct ath11k_base *ab, u16 peer_id);
@@ -703,7 +702,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  struct ath11k_peer *ath11k_peer_find(struct ath11k_base *ab, int vdev_id,
  				     const u8 *addr);
  struct ath11k_peer *ath11k_peer_find_by_addr(struct ath11k_base *ab,
-@@ -59,4 +109,71 @@ struct ath11k_peer *ath11k_peer_find_by_
+@@ -73,4 +123,71 @@ struct ath11k_peer *ath11k_peer_find_by_
  int ath11k_peer_rhash_tbl_init(struct ath11k_base *ab);
  void ath11k_peer_rhash_tbl_destroy(struct ath11k_base *ab);
  int ath11k_peer_rhash_delete(struct ath11k_base *ab, struct ath11k_peer *peer);
@@ -777,15 +776,16 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  #endif /* _PEER_H_ */
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
-@@ -155,6 +155,7 @@ static const struct wmi_tlv_policy wmi_t
- 		.min_len = sizeof(struct wmi_per_chain_rssi_stats), .policy = "wmi_per_chain_rssi_stats" },
+@@ -156,6 +156,8 @@ static const struct wmi_tlv_policy wmi_t
+ 		.min_len = sizeof(struct wmi_per_chain_rssi_stats) },
  	[WMI_TAG_TWT_ADD_DIALOG_COMPLETE_EVENT] = {
- 		.min_len = sizeof(struct wmi_twt_add_dialog_event), .policy = "wmi_twt_add_dialog_event" },
-+	[WMI_TAG_WDS_ADDR_EVENT] = { .min_len = sizeof(struct wmi_wds_addr_event), .policy = "wmi_wds_addr_event" },
+ 		.min_len = sizeof(struct wmi_twt_add_dialog_event) },
++	[WMI_TAG_WDS_ADDR_EVENT] = {
++		.min_len = sizeof(struct wmi_wds_addr_event) },
  };
  
  #define PRIMAP(_hw_mode_) \
-@@ -1174,6 +1175,51 @@ int ath11k_wmi_send_peer_delete_cmd(stru
+@@ -1126,6 +1128,51 @@ int ath11k_wmi_send_peer_delete_cmd(stru
  	return ret;
  }
  
@@ -837,7 +837,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  int ath11k_wmi_send_pdev_set_regdomain(struct ath11k *ar,
  				       struct pdev_set_regdomain_params *param)
  {
-@@ -6419,6 +6465,36 @@ static int ath11k_pull_peer_assoc_conf_e
+@@ -6363,6 +6410,36 @@ static int ath11k_pull_peer_assoc_conf_e
  	return 0;
  }
  
@@ -874,7 +874,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  static void ath11k_wmi_pull_pdev_stats_base(const struct wmi_pdev_stats_base *src,
  					    struct ath11k_fw_stats_pdev *dst)
  {
-@@ -7334,6 +7410,7 @@ static int ath11k_wmi_tlv_rdy_parse(stru
+@@ -7278,6 +7355,7 @@ static int ath11k_wmi_tlv_rdy_parse(stru
  
  		ether_addr_copy(ab->mac_addr,
  				fixed_param.ready_event_min.mac_addr.addr);
@@ -882,7 +882,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		ab->pktlog_defs_checksum = fixed_param.pktlog_defs_checksum;
  		break;
  	case WMI_TAG_ARRAY_FIXED_STRUCT:
-@@ -8805,6 +8882,22 @@ static void ath11k_wmi_gtk_offload_statu
+@@ -8797,6 +8875,22 @@ exit:
  	kfree(tb);
  }
  
@@ -905,9 +905,9 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  static void ath11k_wmi_tlv_op_rx(struct ath11k_base *ab, struct sk_buff *skb)
  {
  	struct wmi_cmd_hdr *cmd_hdr;
-@@ -8935,6 +9028,9 @@ static void ath11k_wmi_tlv_op_rx(struct
- 	case WMI_QOS_NULL_FRAME_TX_COMPLETION_EVENTID:
- 		ath11k_qos_null_compl_event(ab, skb);
+@@ -8927,6 +9021,9 @@ static void ath11k_wmi_tlv_op_rx(struct
+ 	case WMI_GTK_OFFLOAD_STATUS_EVENTID:
+ 		ath11k_wmi_gtk_offload_status_event(ab, skb);
  		break;
 +	case WMI_WDS_PEER_EVENTID:
 +		ath11k_wmi_wds_peer_event(ab, skb);
@@ -917,7 +917,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		break;
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
-@@ -3025,6 +3025,21 @@ struct wmi_peer_delete_cmd {
+@@ -3011,6 +3011,21 @@ struct wmi_peer_delete_cmd {
  	struct wmi_mac_addr peer_macaddr;
  } __packed;
  
@@ -939,7 +939,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  struct wmi_peer_reorder_queue_setup_cmd {
  	u32 tlv_header;
  	u32 vdev_id;
-@@ -4629,6 +4644,21 @@ struct wmi_probe_resp_tx_status_event {
+@@ -4613,6 +4628,21 @@ struct wmi_probe_resp_tx_status_event {
  	u32 tx_status;
  } __packed;
  
@@ -961,7 +961,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  /*
   * PDEV statistics
   */
-@@ -6430,6 +6460,9 @@ int ath11k_wmi_set_sta_ps_param(struct a
+@@ -6412,6 +6442,9 @@ int ath11k_wmi_set_sta_ps_param(struct a
  int ath11k_wmi_force_fw_hang_cmd(struct ath11k *ar, u32 type, u32 delay_time_ms);
  int ath11k_wmi_send_peer_delete_cmd(struct ath11k *ar,
  				    const u8 *peer_addr, u8 vdev_id);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/214-ath11k-qos-null-frame-tx-over-wmi.patch b/package/kernel/mac80211/patches/nss/ath11k/214-ath11k-qos-null-frame-tx-over-wmi.patch
similarity index 59%
rename from package/kernel/mac80211/patches/ath11k_nss/214-ath11k-qos-null-frame-tx-over-wmi.patch
rename to package/kernel/mac80211/patches/nss/ath11k/214-ath11k-qos-null-frame-tx-over-wmi.patch
index a69c5b2af244f8..5f31f4ded2358c 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/214-ath11k-qos-null-frame-tx-over-wmi.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/214-ath11k-qos-null-frame-tx-over-wmi.patch
@@ -82,128 +82,16 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	if (control->sta)
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
-@@ -23,6 +23,7 @@
- 
- struct wmi_tlv_policy {
- 	size_t min_len;
-+	char policy[40];
- };
- 
- struct wmi_tlv_svc_ready_parse {
-@@ -91,69 +92,69 @@ struct wmi_tlv_mgmt_rx_parse {
- 
- static const struct wmi_tlv_policy wmi_tlv_policies[] = {
- 	[WMI_TAG_ARRAY_BYTE]
--		= { .min_len = 0 },
-+		= { .min_len = 0, .policy = "WMI_TAG_ARRAY_BYTE" },
- 	[WMI_TAG_ARRAY_UINT32]
--		= { .min_len = 0 },
-+		= { .min_len = 0, .policy = "WMI_TAG_ARRAY_UINT32" },
- 	[WMI_TAG_SERVICE_READY_EVENT]
--		= { .min_len = sizeof(struct wmi_service_ready_event) },
-+		= { .min_len = sizeof(struct wmi_service_ready_event), .policy = "wmi_service_ready_event" },
- 	[WMI_TAG_SERVICE_READY_EXT_EVENT]
--		= { .min_len =  sizeof(struct wmi_service_ready_ext_event) },
-+		= { .min_len =  sizeof(struct wmi_service_ready_ext_event), .policy = "wmi_service_ready_ext_event" },
- 	[WMI_TAG_SOC_MAC_PHY_HW_MODE_CAPS]
--		= { .min_len = sizeof(struct wmi_soc_mac_phy_hw_mode_caps) },
-+		= { .min_len = sizeof(struct wmi_soc_mac_phy_hw_mode_caps), .policy = "wmi_soc_mac_phy_hw_mode_caps" },
- 	[WMI_TAG_SOC_HAL_REG_CAPABILITIES]
--		= { .min_len = sizeof(struct wmi_soc_hal_reg_capabilities) },
-+		= { .min_len = sizeof(struct wmi_soc_hal_reg_capabilities), .policy = "wmi_soc_hal_reg_capabilities" },
- 	[WMI_TAG_VDEV_START_RESPONSE_EVENT]
--		= { .min_len = sizeof(struct wmi_vdev_start_resp_event) },
-+		= { .min_len = sizeof(struct wmi_vdev_start_resp_event), .policy = "wmi_vdev_start_resp_event" },
- 	[WMI_TAG_PEER_DELETE_RESP_EVENT]
--		= { .min_len = sizeof(struct wmi_peer_delete_resp_event) },
-+		= { .min_len = sizeof(struct wmi_peer_delete_resp_event), .policy = "wmi_peer_delete_resp_event" },
- 	[WMI_TAG_OFFLOAD_BCN_TX_STATUS_EVENT]
--		= { .min_len = sizeof(struct wmi_bcn_tx_status_event) },
-+		= { .min_len = sizeof(struct wmi_bcn_tx_status_event), .policy = "wmi_bcn_tx_status_event" },
- 	[WMI_TAG_VDEV_STOPPED_EVENT]
--		= { .min_len = sizeof(struct wmi_vdev_stopped_event) },
-+		= { .min_len = sizeof(struct wmi_vdev_stopped_event), .policy = "wmi_vdev_stopped_event" },
- 	[WMI_TAG_REG_CHAN_LIST_CC_EVENT]
--		= { .min_len = sizeof(struct wmi_reg_chan_list_cc_event) },
-+		= { .min_len = sizeof(struct wmi_reg_chan_list_cc_event), .policy = "wmi_reg_chan_list_cc_event" },
- 	[WMI_TAG_REG_CHAN_LIST_CC_EXT_EVENT]
--		= { .min_len = sizeof(struct wmi_reg_chan_list_cc_ext_event) },
-+		= { .min_len = sizeof(struct wmi_reg_chan_list_cc_ext_event), .policy = "wmi_reg_chan_list_cc_ext_event" },
+@@ -117,7 +117,7 @@ static const struct wmi_tlv_policy wmi_t
  	[WMI_TAG_MGMT_RX_HDR]
--		= { .min_len = sizeof(struct wmi_mgmt_rx_hdr) },
-+		= { .min_len = sizeof(struct wmi_mgmt_rx_hdr), .policy = "wmi_mgmt_rx_hdr" },
+ 		= { .min_len = sizeof(struct wmi_mgmt_rx_hdr) },
  	[WMI_TAG_MGMT_TX_COMPL_EVENT]
 -		= { .min_len = sizeof(struct wmi_mgmt_tx_compl_event) },
-+		= { .min_len = sizeof(struct wmi_tx_compl_event), .policy = "wmi_tx_compl_event" },
++		= { .min_len = sizeof(struct wmi_tx_compl_event) },
  	[WMI_TAG_SCAN_EVENT]
--		= { .min_len = sizeof(struct wmi_scan_event) },
-+		= { .min_len = sizeof(struct wmi_scan_event), .policy = "wmi_scan_event" },
+ 		= { .min_len = sizeof(struct wmi_scan_event) },
  	[WMI_TAG_PEER_STA_KICKOUT_EVENT]
--		= { .min_len = sizeof(struct wmi_peer_sta_kickout_event) },
-+		= { .min_len = sizeof(struct wmi_peer_sta_kickout_event), .policy = "wmi_peer_sta_kickout_event" },
- 	[WMI_TAG_ROAM_EVENT]
--		= { .min_len = sizeof(struct wmi_roam_event) },
-+		= { .min_len = sizeof(struct wmi_roam_event), .policy = "wmi_roam_event" },
- 	[WMI_TAG_CHAN_INFO_EVENT]
--		= { .min_len = sizeof(struct wmi_chan_info_event) },
-+		= { .min_len = sizeof(struct wmi_chan_info_event), .policy = "wmi_chan_info_event" },
- 	[WMI_TAG_PDEV_BSS_CHAN_INFO_EVENT]
--		= { .min_len = sizeof(struct wmi_pdev_bss_chan_info_event) },
-+		= { .min_len = sizeof(struct wmi_pdev_bss_chan_info_event), .policy = "wmi_pdev_bss_chan_info_event" },
- 	[WMI_TAG_VDEV_INSTALL_KEY_COMPLETE_EVENT]
--		= { .min_len = sizeof(struct wmi_vdev_install_key_compl_event) },
-+		= { .min_len = sizeof(struct wmi_vdev_install_key_compl_event), .policy = "wmi_vdev_install_key_compl_event" },
- 	[WMI_TAG_READY_EVENT] = {
--		.min_len = sizeof(struct wmi_ready_event_min) },
-+		.min_len = sizeof(struct wmi_ready_event_min), .policy = "wmi_ready_event_min" },
- 	[WMI_TAG_SERVICE_AVAILABLE_EVENT]
--		= {.min_len = sizeof(struct wmi_service_available_event) },
-+		= {.min_len = sizeof(struct wmi_service_available_event), .policy = "wmi_service_available_event" },
- 	[WMI_TAG_PEER_ASSOC_CONF_EVENT]
--		= { .min_len = sizeof(struct wmi_peer_assoc_conf_event) },
-+		= { .min_len = sizeof(struct wmi_peer_assoc_conf_event), .policy = "wmi_peer_assoc_conf_event" },
- 	[WMI_TAG_STATS_EVENT]
--		= { .min_len = sizeof(struct wmi_stats_event) },
-+		= { .min_len = sizeof(struct wmi_stats_event), .policy = "wmi_stats_event" },
- 	[WMI_TAG_PDEV_CTL_FAILSAFE_CHECK_EVENT]
--		= { .min_len = sizeof(struct wmi_pdev_ctl_failsafe_chk_event) },
-+		= { .min_len = sizeof(struct wmi_pdev_ctl_failsafe_chk_event), .policy = "wmi_pdev_ctl_failsafe_chk_event" },
- 	[WMI_TAG_HOST_SWFDA_EVENT] = {
--		.min_len = sizeof(struct wmi_fils_discovery_event) },
-+		.min_len = sizeof(struct wmi_fils_discovery_event), .policy = "wmi_fils_discovery_event" },
- 	[WMI_TAG_OFFLOAD_PRB_RSP_TX_STATUS_EVENT] = {
--		.min_len = sizeof(struct wmi_probe_resp_tx_status_event) },
-+		.min_len = sizeof(struct wmi_probe_resp_tx_status_event), .policy = "wmi_probe_resp_tx_status_event" },
- 	[WMI_TAG_VDEV_DELETE_RESP_EVENT] = {
--		.min_len = sizeof(struct wmi_vdev_delete_resp_event) },
-+		.min_len = sizeof(struct wmi_vdev_delete_resp_event), .policy = "wmi_vdev_delete_resp_event" },
- 	[WMI_TAG_OBSS_COLOR_COLLISION_EVT] = {
--		.min_len = sizeof(struct wmi_obss_color_collision_event) },
-+		.min_len = sizeof(struct wmi_obss_color_collision_event), .policy = "wmi_obss_color_collision_event" },
- 	[WMI_TAG_11D_NEW_COUNTRY_EVENT] = {
--		.min_len = sizeof(struct wmi_11d_new_cc_ev) },
-+		.min_len = sizeof(struct wmi_11d_new_cc_ev), .policy = "wmi_11d_new_cc_ev" },
- 	[WMI_TAG_PER_CHAIN_RSSI_STATS] = {
--		.min_len = sizeof(struct wmi_per_chain_rssi_stats) },
-+		.min_len = sizeof(struct wmi_per_chain_rssi_stats), .policy = "wmi_per_chain_rssi_stats" },
- 	[WMI_TAG_TWT_ADD_DIALOG_COMPLETE_EVENT] = {
--		.min_len = sizeof(struct wmi_twt_add_dialog_event) },
-+		.min_len = sizeof(struct wmi_twt_add_dialog_event), .policy = "wmi_twt_add_dialog_event" },
- };
- 
- #define PRIMAP(_hw_mode_) \
-@@ -203,8 +204,8 @@ ath11k_wmi_tlv_iter(struct ath11k_base *
- 		if (tlv_tag < ARRAY_SIZE(wmi_tlv_policies) &&
- 		    wmi_tlv_policies[tlv_tag].min_len &&
- 		    wmi_tlv_policies[tlv_tag].min_len > tlv_len) {
--			ath11k_err(ab, "wmi tlv parse failure of tag %u at byte %zd (%u bytes is less than min length %zu)\n",
--				   tlv_tag, ptr - begin, tlv_len,
-+			ath11k_err(ab, "wmi tlv parse failure of tag %u (%s) at byte %zd (%u bytes is less than min length %zu)\n",
-+				   tlv_tag, wmi_tlv_policies[tlv_tag].policy, ptr - begin, tlv_len,
- 				   wmi_tlv_policies[tlv_tag].min_len);
- 			return -EINVAL;
- 		}
-@@ -697,6 +698,55 @@ int ath11k_wmi_mgmt_send(struct ath11k *
+@@ -701,6 +701,55 @@ int ath11k_wmi_mgmt_send(struct ath11k *
  	return ret;
  }
  
@@ -259,15 +147,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  int ath11k_wmi_vdev_create(struct ath11k *ar, u8 *macaddr,
  			   struct vdev_create_params *param)
  {
-@@ -4103,7 +4153,6 @@ ath11k_wmi_copy_resource_config(struct w
- 	wmi_cfg->max_bssid_rx_filters = tg_cfg->max_bssid_rx_filters;
- 	wmi_cfg->use_pdev_id = tg_cfg->use_pdev_id;
- 	wmi_cfg->flag1 = tg_cfg->flag1;
--	wmi_cfg->flag1 |= WMI_RSRC_CFG_FLAG1_ACK_RSSI;
- 	wmi_cfg->peer_map_unmap_v2_support = tg_cfg->peer_map_unmap_v2_support;
- 	wmi_cfg->sched_params = tg_cfg->sched_params;
- 	wmi_cfg->twt_ap_pdev_count = tg_cfg->twt_ap_pdev_count;
-@@ -5856,8 +5905,8 @@ static int ath11k_pull_mgmt_rx_params_tl
+@@ -5905,8 +5954,8 @@ static int ath11k_pull_mgmt_rx_params_tl
  	return 0;
  }
  
@@ -278,7 +158,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  {
  	struct sk_buff *msdu;
  	struct ieee80211_tx_info *info;
-@@ -5895,6 +5944,11 @@ static int wmi_process_mgmt_tx_comp(stru
+@@ -5944,6 +5993,11 @@ static int wmi_process_mgmt_tx_comp(stru
  			info->status.ack_signal = tx_compl_param->ack_rssi;
  	}
  
@@ -290,7 +170,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	hdr = (struct ieee80211_hdr *)msdu->data;
  	frm_type = FIELD_GET(IEEE80211_FCTL_STYPE, hdr->frame_control);
  
-@@ -5913,10 +5967,13 @@ static int wmi_process_mgmt_tx_comp(stru
+@@ -5962,10 +6016,13 @@ static int wmi_process_mgmt_tx_comp(stru
  	arvif = ath11k_vif_to_arvif(vif);
  	mgmt_stats = &arvif->mgmt_stats;
  
@@ -308,7 +188,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	spin_unlock_bh(&ar->data_lock);
  
  skip_mgmt_stats:
-@@ -5938,12 +5995,13 @@ skip_mgmt_stats:
+@@ -5987,12 +6044,13 @@ skip_mgmt_stats:
  	return 0;
  }
  
@@ -326,7 +206,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	int ret;
  
  	tb = ath11k_wmi_tlv_parse_alloc(ab, skb->data, skb->len, GFP_ATOMIC);
-@@ -5953,7 +6011,7 @@ static int ath11k_pull_mgmt_tx_compl_par
+@@ -6002,7 +6060,7 @@ static int ath11k_pull_mgmt_tx_compl_par
  		return ret;
  	}
  
@@ -335,7 +215,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	if (!ev) {
  		ath11k_warn(ab, "failed to fetch mgmt tx compl ev");
  		kfree(tb);
-@@ -7730,10 +7788,11 @@ exit:
+@@ -7810,10 +7868,11 @@ exit:
  
  static void ath11k_mgmt_tx_compl_event(struct ath11k_base *ab, struct sk_buff *skb)
  {
@@ -349,7 +229,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  		ath11k_warn(ab, "failed to extract mgmt tx compl event");
  		return;
  	}
-@@ -7746,7 +7805,7 @@ static void ath11k_mgmt_tx_compl_event(s
+@@ -7826,7 +7885,7 @@ static void ath11k_mgmt_tx_compl_event(s
  		goto exit;
  	}
  
@@ -358,7 +238,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  
  	ath11k_dbg(ab, ATH11K_DBG_MGMT,
  		   "event mgmt tx compl ev pdev_id %d, desc_id %d, status %d ack_rssi %d",
-@@ -7757,6 +7816,36 @@ exit:
+@@ -7837,6 +7896,36 @@ exit:
  	rcu_read_unlock();
  }
  
@@ -395,13 +275,14 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  static struct ath11k *ath11k_get_ar_on_scan_state(struct ath11k_base *ab,
  						  u32 vdev_id,
  						  enum ath11k_scan_state state)
-@@ -8843,6 +8932,9 @@ static void ath11k_wmi_tlv_op_rx(struct
- 	case WMI_GTK_OFFLOAD_STATUS_EVENTID:
- 		ath11k_wmi_gtk_offload_status_event(ab, skb);
+@@ -9024,6 +9113,10 @@ static void ath11k_wmi_tlv_op_rx(struct
+ 	case WMI_WDS_PEER_EVENTID:
+ 		ath11k_wmi_wds_peer_event(ab, skb);
  		break;
 +	case WMI_QOS_NULL_FRAME_TX_COMPLETION_EVENTID:
 +		ath11k_qos_null_compl_event(ab, skb);
 +		break;
++
  	default:
  		ath11k_dbg(ab, ATH11K_DBG_WMI, "unsupported event id 0x%x\n", id);
  		break;
@@ -425,16 +306,16 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	WMI_TX_ADDBA_COMPLETE_EVENTID,
  	WMI_BA_RSP_SSN_EVENTID,
 @@ -1880,6 +1883,9 @@ enum wmi_tlv_tag {
+ 	WMI_TAG_PDEV_NON_SRG_OBSS_BSSID_ENABLE_BITMAP_CMD,
+ 	WMI_TAG_REGULATORY_RULE_EXT_STRUCT = 0x3A9,
  	WMI_TAG_REG_CHAN_LIST_CC_EXT_EVENT,
- 	WMI_TAG_PDEV_SET_BIOS_SAR_TABLE_CMD = 0x3D8,
- 	WMI_TAG_PDEV_SET_BIOS_GEO_TABLE_CMD,
 +	/* TODO add all the missing cmds */
 +	WMI_TAG_QOS_NULL_FRAME_TX_SEND = 0x3A6,
 +	WMI_TAG_QOS_NULL_FRAME_TX_STATUS,
+ 	WMI_TAG_PDEV_SET_BIOS_SAR_TABLE_CMD = 0x3D8,
+ 	WMI_TAG_PDEV_SET_BIOS_GEO_TABLE_CMD,
  	WMI_TAG_MAX
- };
- 
-@@ -2107,7 +2113,17 @@ enum wmi_tlv_service {
+@@ -2109,7 +2115,17 @@ enum wmi_tlv_service {
  	WMI_TLV_SERVICE_PEER_POWER_SAVE_DURATION_SUPPORT = 246,
  	WMI_TLV_SERVICE_SRG_SRP_SPATIAL_REUSE_SUPPORT = 249,
  	WMI_TLV_SERVICE_MBSS_PARAM_IN_VDEV_START_SUPPORT = 253,
@@ -452,7 +333,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  
  	/* The second 128 bits */
  	WMI_MAX_EXT_SERVICE = 256,
-@@ -3814,6 +3830,7 @@ struct wmi_scan_prob_req_oui_cmd {
+@@ -3831,6 +3847,7 @@ struct wmi_scan_prob_req_oui_cmd {
  }  __packed;
  
  #define WMI_MGMT_SEND_DOWNLD_LEN	64
@@ -460,7 +341,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  
  #define WMI_TX_PARAMS_DWORD0_POWER		GENMASK(7, 0)
  #define WMI_TX_PARAMS_DWORD0_MCS_MASK		GENMASK(19, 8)
-@@ -3824,9 +3841,10 @@ struct wmi_scan_prob_req_oui_cmd {
+@@ -3841,9 +3858,10 @@ struct wmi_scan_prob_req_oui_cmd {
  #define WMI_TX_PARAMS_DWORD1_BW_MASK		GENMASK(14, 8)
  #define WMI_TX_PARAMS_DWORD1_PREAMBLE_TYPE	GENMASK(19, 15)
  #define WMI_TX_PARAMS_DWORD1_FRAME_TYPE		BIT(20)
@@ -473,15 +354,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	u32 tlv_header;
  	u32 tx_params_dword0;
  	u32 tx_params_dword1;
-@@ -4570,7 +4588,6 @@ struct wmi_pdev_bss_chan_info_event {
- 	u32 rx_bss_cycle_count_low;
- 	u32 rx_bss_cycle_count_high;
- 	u32 pdev_id;
--	u32 ack_rssi;
- } __packed;
- 
- #define WMI_VDEV_INSTALL_KEY_COMPL_STATUS_SUCCESS 0
-@@ -4918,7 +4935,7 @@ struct wmi_rssi_ctl_ext {
+@@ -4959,7 +4977,7 @@ struct wmi_rssi_ctl_ext {
  	u32 rssi_ctl_ext[MAX_ANTENNA_EIGHT - ATH_MAX_ANTENNA];
  };
  
@@ -490,7 +363,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	u32 desc_id;
  	u32 status;
  	u32 pdev_id;
-@@ -5748,6 +5765,17 @@ struct wmi_debug_log_config_cmd_fixed_pa
+@@ -5790,6 +5808,17 @@ struct wmi_debug_log_config_cmd_fixed_pa
  	u32 value;
  } __packed;
  
@@ -508,7 +381,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  #define WMI_MAX_MEM_REQS 32
  
  #define MAX_RADIOS 3
-@@ -6358,6 +6386,8 @@ int ath11k_wmi_cmd_send(struct ath11k_pd
+@@ -6400,6 +6429,8 @@ int ath11k_wmi_cmd_send(struct ath11k_pd
  struct sk_buff *ath11k_wmi_alloc_skb(struct ath11k_wmi_base *wmi_sc, u32 len);
  int ath11k_wmi_mgmt_send(struct ath11k *ar, u32 vdev_id, u32 buf_id,
  			 struct sk_buff *frame);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/903-002-ath11k-add-support-for-ext-vdev-in-NSS-for-AP_VLAN-vif-handling.patch b/package/kernel/mac80211/patches/nss/ath11k/235-002-ath11k-add-support-for-ext-vdev-in-NSS-for-AP_VLAN-vif-handling.patch
similarity index 93%
rename from package/kernel/mac80211/patches/ath11k_nss/903-002-ath11k-add-support-for-ext-vdev-in-NSS-for-AP_VLAN-vif-handling.patch
rename to package/kernel/mac80211/patches/nss/ath11k/235-002-ath11k-add-support-for-ext-vdev-in-NSS-for-AP_VLAN-vif-handling.patch
index 6f5fffe596172b..7a935968261d33 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/903-002-ath11k-add-support-for-ext-vdev-in-NSS-for-AP_VLAN-vif-handling.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/235-002-ath11k-add-support-for-ext-vdev-in-NSS-for-AP_VLAN-vif-handling.patch
@@ -17,7 +17,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/nss.c
 +++ b/drivers/net/wireless/ath/ath11k/nss.c
-@@ -366,6 +366,10 @@ void ath11k_nss_wifili_event_receive(str
+@@ -323,6 +323,10 @@ void ath11k_nss_wifili_event_receive(str
  		ath11k_dbg(ab, ATH11K_DBG_NSS_WDS, "nss wifili wds peer del event received %d response %d error %d\n",
  			   msg_type, response, error);
  		break;
@@ -28,7 +28,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	default:
  		ath11k_dbg(ab, ATH11K_DBG_NSS, "unhandled event %d\n", msg_type);
  		break;
-@@ -599,8 +603,9 @@ static int ath11k_nss_undecap_nwifi(stru
+@@ -556,8 +560,9 @@ static int ath11k_nss_undecap_nwifi(stru
  	return 0;
  }
  
@@ -40,7 +40,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  {
  	struct ath11k_base *ab = ar->ab;
  	struct ath11k_ast_entry *ast_entry = NULL;
-@@ -622,19 +627,22 @@ static void ath11k_nss_wds_type_rx(struc
+@@ -579,19 +584,22 @@ static void ath11k_nss_wds_type_rx(struc
  		if (!is_sa_valid) {
  			ath11k_peer_add_ast(ar, ta_peer, src_mac,
  					    ATH11K_AST_TYPE_WDS);
@@ -68,7 +68,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	}
  
  	spin_unlock_bh(&ab->base_lock);
-@@ -678,7 +686,8 @@ static void ath11k_nss_mec_handler(struc
+@@ -635,7 +643,8 @@ static void ath11k_nss_mec_handler(struc
  
  static void ath11k_nss_vdev_spl_receive_ext_wdsdata(struct ath11k_vif *arvif,
  						    struct sk_buff *skb,
@@ -78,7 +78,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  {
  	struct ath11k *ar = arvif->ar;
  	struct ath11k_base *ab = ar->ab;
-@@ -699,8 +708,8 @@ static void ath11k_nss_vdev_spl_receive_
+@@ -656,8 +665,8 @@ static void ath11k_nss_vdev_spl_receive_
  
  	switch (wds_type) {
  		case NSS_WIFI_VDEV_WDS_TYPE_RX:
@@ -89,7 +89,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  			break;
  		case NSS_WIFI_VDEV_WDS_TYPE_MEC:
  			ath11k_nss_mec_handler(ar, (u8 *)(skb->data));
-@@ -767,6 +776,7 @@ ath11k_nss_vdev_special_data_receive(str
+@@ -724,6 +733,7 @@ ath11k_nss_vdev_special_data_receive(str
  	struct ieee80211_vif *vif;
  	struct ath11k_vif *arvif;
  	struct ath11k_base *ab;
@@ -97,7 +97,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	bool eth_decap = false;
  	int data_offs = 0;
  	int ret = 0;
-@@ -822,10 +832,11 @@ ath11k_nss_vdev_special_data_receive(str
+@@ -779,10 +789,11 @@ ath11k_nss_vdev_special_data_receive(str
  	    NSS_WIFI_VDEV_EXT_DATA_PKT_TYPE_WDS_LEARN) {
  		wds_metadata = &wifi_metadata->metadata.wds_metadata;
  		ath11k_nss_vdev_spl_receive_ext_wdsdata(arvif, skb,
@@ -111,7 +111,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  }
  
  static void
-@@ -888,6 +899,68 @@ ath11k_nss_vdev_data_receive(struct net_
+@@ -845,6 +856,68 @@ ath11k_nss_vdev_data_receive(struct net_
  	ath11k_nss_deliver_rx(arvif->vif, skb, eth_decap, data_offs, napi);
  }
  
@@ -180,7 +180,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  int ath11k_nss_tx(struct ath11k_vif *arvif, struct sk_buff *skb)
  {
  	struct ath11k *ar = arvif->ar;
-@@ -910,10 +983,16 @@ int ath11k_nss_tx(struct ath11k_vif *arv
+@@ -867,10 +940,16 @@ int ath11k_nss_tx(struct ath11k_vif *arv
  		ath11k_nss_tx_encap_nwifi(skb);
  
  send:
@@ -201,7 +201,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
  	if (status != NSS_TX_SUCCESS) {
  		ath11k_dbg(ar->ab, (ATH11K_DBG_NSS | ATH11K_DBG_DP_TX),
-@@ -1254,6 +1333,7 @@ int ath11k_nss_vdev_up(struct ath11k_vif
+@@ -1211,6 +1290,7 @@ int ath11k_nss_vdev_up(struct ath11k_vif
  	struct nss_wifi_vdev_msg *vdev_msg = NULL;
  	struct nss_wifi_vdev_enable_msg *vdev_en;
  	struct ath11k *ar = arvif->ar;
@@ -209,7 +209,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	nss_tx_status_t status;
  	int ret = 0;
  
-@@ -1285,6 +1365,12 @@ int ath11k_nss_vdev_up(struct ath11k_vif
+@@ -1242,6 +1322,12 @@ int ath11k_nss_vdev_up(struct ath11k_vif
  	}
  
  	ath11k_dbg(ar->ab, ATH11K_DBG_NSS, "nss vdev up tx msg success\n");
@@ -222,7 +222,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  free:
  	kfree(vdev_msg);
  	return ret;
-@@ -1294,6 +1380,7 @@ int ath11k_nss_vdev_down(struct ath11k_v
+@@ -1251,6 +1337,7 @@ int ath11k_nss_vdev_down(struct ath11k_v
  {
  	struct nss_wifi_vdev_msg *vdev_msg = NULL;
  	struct ath11k *ar = arvif->ar;
@@ -230,7 +230,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	nss_tx_status_t status;
  	int ret = 0;
  
-@@ -1321,11 +1408,362 @@ int ath11k_nss_vdev_down(struct ath11k_v
+@@ -1278,11 +1365,362 @@ int ath11k_nss_vdev_down(struct ath11k_v
  	}
  
  	ath11k_dbg(ar->ab, ATH11K_DBG_NSS, "nss vdev down tx msg success\n");
@@ -262,7 +262,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 +
 +	cfg_wds_msg = &ext_vdev_msg->msg.wmsg;
 +	cfg_wds_msg->wds_peer_id = wds_peer_id;
-+	ether_addr_copy(cfg_wds_msg->mac_addr, wds_addr);
++	ether_addr_copy((u8 *)cfg_wds_msg->mac_addr, wds_addr);
 +
 +	nss_wifi_ext_vdev_msg_init(ext_vdev_msg, arvif->nss.if_num,
 +				   NSS_WIFI_EXT_VDEV_MSG_CONFIGURE_WDS,
@@ -593,7 +593,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  /*----------------------------Peer Setup/Config -----------------------------*/
  
  int ath11k_nss_set_peer_sec_type(struct ath11k *ar,
-@@ -1419,22 +1857,22 @@ free:
+@@ -1376,22 +1814,22 @@ free:
  	return status;
  }
  
@@ -623,7 +623,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  					sta->addr);
  		goto exit;
  	}
-@@ -1506,13 +1944,13 @@ void ath11k_nss_update_sta_rxrate(struct
+@@ -1463,13 +1901,13 @@ void ath11k_nss_update_sta_rxrate(struct
  				  struct ath11k_peer *peer,
  				  struct hal_rx_user_status *user_stats)
  {
@@ -639,7 +639,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	struct ath11k_base *ab = ar->ab;
  
  	if (!ab->nss.enabled)
-@@ -1816,8 +2254,8 @@ int ath11k_nss_add_wds_peer(struct ath11
+@@ -1773,8 +2211,8 @@ int ath11k_nss_add_wds_peer(struct ath11
  	}
  
  	ath11k_dbg(ab, ATH11K_DBG_NSS_WDS,
@@ -650,7 +650,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
  msg_free:
  	kfree(wlmsg);
-@@ -1862,8 +2300,8 @@ int ath11k_nss_update_wds_peer(struct at
+@@ -1819,8 +2257,8 @@ int ath11k_nss_update_wds_peer(struct at
  	}
  
  	ath11k_dbg(ab, ATH11K_DBG_NSS_WDS,
@@ -663,7 +663,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	kfree(wlmsg);
 --- a/drivers/net/wireless/ath/ath11k/nss.h
 +++ b/drivers/net/wireless/ath/ath11k/nss.h
-@@ -154,6 +154,7 @@ enum ath11k_nss_peer_sec_type {
+@@ -151,6 +151,7 @@ enum ath11k_nss_peer_sec_type {
  struct ath11k_nss_peer {
  	uint32_t *vaddr;
  	dma_addr_t paddr;
@@ -671,7 +671,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	struct peer_stats *nss_stats;
  	struct completion complete;
  };
-@@ -168,6 +169,16 @@ struct arvif_nss {
+@@ -165,6 +166,16 @@ struct arvif_nss {
  	int encap;
  	/* Keep the copy of decap type for nss */
  	int decap;
@@ -688,7 +688,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	bool created;
  };
  
-@@ -223,11 +234,21 @@ int ath11k_nss_map_wds_peer(struct ath11
+@@ -220,11 +231,21 @@ int ath11k_nss_map_wds_peer(struct ath11
  			    u8 *dest_mac, enum ath11k_ast_entry_type type);
  int ath11k_nss_del_wds_peer(struct ath11k *ar, struct ath11k_peer *peer,
  			    u8 *dest_mac);
@@ -713,7 +713,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  void ath11k_nss_update_sta_rxrate(struct hal_rx_mon_ppdu_info *ppdu_info,
  				  struct ath11k_peer *peer,
  				  struct hal_rx_user_status *user_stats);
-@@ -260,9 +281,9 @@ static inline void ath11k_nss_vdev_delet
+@@ -257,9 +278,9 @@ static inline void ath11k_nss_vdev_delet
  {
  }
  
@@ -726,7 +726,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  {
  	return;
  }
-@@ -319,6 +340,43 @@ static inline int ath11k_nss_peer_create
+@@ -316,6 +337,43 @@ static inline int ath11k_nss_peer_create
  	return 0;
  }
  
@@ -770,7 +770,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  static inline void ath11k_nss_peer_stats_enable(struct ath11k *ar)
  {
  	return;
-@@ -340,6 +398,11 @@ static inline int ath11k_nss_setup(struc
+@@ -337,6 +395,11 @@ static inline int ath11k_nss_setup(struc
  	return 0;
  }
  
diff --git a/package/kernel/mac80211/patches/ath11k_nss/903-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch b/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
similarity index 88%
rename from package/kernel/mac80211/patches/ath11k_nss/903-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
rename to package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
index de7bc77ef53456..729ee80199b9a2 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/903-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
@@ -33,20 +33,17 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -385,9 +385,8 @@ struct ath11k_vif {
- #endif /* CPTCFG_ATH11K_DEBUGFS */
- 
- 	struct ath11k_mgmt_frame_stats mgmt_stats;
--#ifdef CPTCFG_ATH11K_NSS_SUPPORT
+@@ -389,6 +389,7 @@ struct ath11k_vif {
+ #ifdef CPTCFG_ATH11K_NSS_SUPPORT
  	struct arvif_nss nss;
--#endif
+ #endif
 +	struct list_head ap_vlan_arvifs;
  };
  
  struct ath11k_vif_iter {
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -4739,6 +4739,11 @@ static void ath11k_sta_rc_update_wk(stru
+@@ -4744,6 +4744,11 @@ static void ath11k_sta_rc_update_wk(stru
  	arvif = arsta->arvif;
  	ar = arvif->ar;
  
@@ -58,7 +55,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	if (WARN_ON(ath11k_mac_vif_chan(arvif->vif, &def)))
  		return;
  
-@@ -4910,17 +4915,28 @@ err_rc_bw_changed:
+@@ -4915,17 +4920,28 @@ err_rc_bw_changed:
  static void ath11k_sta_set_4addr_wk(struct work_struct *wk)
  {
  	struct ath11k *ar;
@@ -89,7 +86,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		   "setting USE_4ADDR for peer %pM\n", sta->addr);
  
  	ret = ath11k_wmi_set_peer_param(ar, sta->addr,
-@@ -4928,8 +4944,93 @@ static void ath11k_sta_set_4addr_wk(stru
+@@ -4933,8 +4949,93 @@ static void ath11k_sta_set_4addr_wk(stru
  					WMI_PEER_USE_4ADDR, 1);
  
  	if (ret)
@@ -184,7 +181,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  }
  
  static int ath11k_mac_inc_num_stations(struct ath11k_vif *arvif,
-@@ -5278,9 +5379,32 @@ static void ath11k_mac_op_sta_set_4addr(
+@@ -5264,9 +5365,32 @@ static void ath11k_mac_op_sta_set_4addr(
  					struct ieee80211_sta *sta, bool enabled)
  {
  	struct ath11k *ar = hw->priv;
@@ -217,7 +214,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		ieee80211_queue_work(ar->hw, &arsta->set_4addr_wk);
  		arsta->use_4addr_set = true;
  	}
-@@ -6673,6 +6797,9 @@ static int ath11k_mac_op_update_vif_offl
+@@ -6646,6 +6770,9 @@ static int ath11k_mac_op_update_vif_offl
  	u32 param_id, param_value;
  	int ret;
  
@@ -227,7 +224,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	param_id = WMI_VDEV_PARAM_TX_ENCAP_TYPE;
  	if (ath11k_frame_mode != ATH11K_HW_TXRX_ETHERNET ||
  	    (vif->type != NL80211_IFTYPE_STATION &&
-@@ -6893,7 +7020,8 @@ static int ath11k_mac_op_add_interface(s
+@@ -6866,7 +6993,8 @@ static int ath11k_mac_op_add_interface(s
  		goto err;
  	}
  
@@ -237,7 +234,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		ath11k_warn(ab, "failed to create vdev %u, reached max vdev limit %d\n",
  			    ar->num_created_vdevs, TARGET_NUM_VDEVS(ab));
  		ret = -EBUSY;
-@@ -6913,6 +7041,28 @@ static int ath11k_mac_op_add_interface(s
+@@ -6886,6 +7014,28 @@ static int ath11k_mac_op_add_interface(s
  	arvif->vif = vif;
  
  	INIT_LIST_HEAD(&arvif->list);
@@ -266,7 +263,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	INIT_DELAYED_WORK(&arvif->connection_loss_work,
  			  ath11k_mac_vif_sta_connection_loss_work);
  
-@@ -6942,6 +7092,7 @@ static int ath11k_mac_op_add_interface(s
+@@ -6915,6 +7065,7 @@ static int ath11k_mac_op_add_interface(s
  		fallthrough;
  	case NL80211_IFTYPE_AP:
  		arvif->vdev_type = WMI_VDEV_TYPE_AP;
@@ -274,7 +271,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		break;
  	case NL80211_IFTYPE_MONITOR:
  		arvif->vdev_type = WMI_VDEV_TYPE_MONITOR;
-@@ -7164,13 +7315,30 @@ static void ath11k_mac_op_remove_interfa
+@@ -7137,13 +7288,30 @@ static void ath11k_mac_op_remove_interfa
  	struct ath11k *ar = hw->priv;
  	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
  	struct ath11k_base *ab = ar->ab;
@@ -307,7 +304,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	ath11k_dbg(ab, ATH11K_DBG_MAC, "remove interface (vdev %d)\n",
  		   arvif->vdev_id);
  
-@@ -7187,6 +7355,14 @@ static void ath11k_mac_op_remove_interfa
+@@ -7160,6 +7328,14 @@ static void ath11k_mac_op_remove_interfa
  		if (ret)
  			ath11k_warn(ab, "failed to submit AP self-peer removal on vdev %d: %d\n",
  				    arvif->vdev_id, ret);
@@ -322,7 +319,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	}
  
  	ret = ath11k_mac_vdev_delete(ar, arvif);
-@@ -7230,8 +7406,7 @@ err_vdev_del:
+@@ -7203,8 +7379,7 @@ err_vdev_del:
  
  	ath11k_debugfs_remove_interface(arvif);
  
@@ -332,7 +329,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	mutex_unlock(&ar->conf_mutex);
  }
  
-@@ -7291,16 +7466,17 @@ static int ath11k_mac_op_ampdu_action(st
+@@ -7264,16 +7439,17 @@ static int ath11k_mac_op_ampdu_action(st
  				      struct ieee80211_ampdu_params *params)
  {
  	struct ath11k *ar = hw->priv;
@@ -352,7 +349,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		break;
  	case IEEE80211_AMPDU_TX_START:
  	case IEEE80211_AMPDU_TX_STOP_CONT:
-@@ -8823,6 +8999,7 @@ static void ath11k_mac_op_sta_statistics
+@@ -8796,6 +8972,7 @@ static void ath11k_mac_op_sta_statistics
  {
  	struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);
  	struct ath11k *ar = arsta->arvif->ar;
@@ -360,7 +357,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	s8 signal;
  	bool db2dbm = test_bit(WMI_TLV_SERVICE_HW_DB2DBM_CONVERSION_SUPPORT,
  			       ar->ab->wmi_ab.svc_map);
-@@ -8879,7 +9056,8 @@ static void ath11k_mac_op_sta_statistics
+@@ -8852,7 +9029,8 @@ static void ath11k_mac_op_sta_statistics
  		ATH11K_DEFAULT_NOISE_FLOOR;
  	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
  
@@ -372,7 +369,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  #if IS_ENABLED(CONFIG_IPV6)
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
-@@ -5069,6 +5069,8 @@ enum wmi_vdev_subtype {
+@@ -5082,6 +5082,8 @@ enum wmi_vdev_subtype {
  	WMI_VDEV_SUBTYPE_MESH_11S,
  };
  
@@ -383,7 +380,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	WMI_STA_PS_PARAM_TX_WAKE_THRESHOLD = 1,
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -1162,12 +1162,13 @@ err_mem_free:
+@@ -1121,12 +1121,13 @@ err_mem_free:
  	return ret;
  }
  
@@ -399,7 +396,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	int ret;
  
  	ret = ath11k_peer_rx_tid_setup(ar, params->sta->addr, vdev_id,
-@@ -1179,13 +1180,13 @@ int ath11k_dp_rx_ampdu_start(struct ath1
+@@ -1138,13 +1139,13 @@ int ath11k_dp_rx_ampdu_start(struct ath1
  	return ret;
  }
  
@@ -418,9 +415,9 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	int ret;
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.h
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.h
-@@ -69,9 +69,9 @@ struct ath11k_dp_rfc1042_hdr {
- 	__be16 snap_type;
- } __packed;
+@@ -88,9 +88,9 @@ static inline u32 ath11k_he_gi_to_nl8021
+         return ret;
+ }
  
 -int ath11k_dp_rx_ampdu_start(struct ath11k *ar,
 +int ath11k_dp_rx_ampdu_start(struct ath11k_vif *arvif,
@@ -432,7 +429,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  				       const u8 *peer_addr,
 --- a/drivers/net/wireless/ath/ath11k/peer.c
 +++ b/drivers/net/wireless/ath/ath11k/peer.c
-@@ -126,6 +126,24 @@ struct ath11k_ast_entry *ath11k_peer_ast
+@@ -140,6 +140,24 @@ struct ath11k_ast_entry *ath11k_peer_ast
  	return NULL;
  }
  
@@ -457,7 +454,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  void ath11k_peer_ast_wds_wmi_wk(struct work_struct *wk)
  {
  	struct ath11k_ast_entry *ast_entry = container_of(wk,
-@@ -186,8 +204,8 @@ int ath11k_peer_add_ast(struct ath11k *a
+@@ -200,8 +218,8 @@ int ath11k_peer_add_ast(struct ath11k *a
  	}
  
  	if (type != ATH11K_AST_TYPE_STATIC) {
@@ -468,7 +465,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  			ath11k_dbg(ab, ATH11K_DBG_MAC, "ast_entry %pM already present on peer %pM\n",
  				   mac_addr, ast_entry->peer->addr);
  			return 0;
-@@ -284,7 +302,6 @@ int ath11k_peer_update_ast(struct ath11k
+@@ -298,7 +316,6 @@ int ath11k_peer_update_ast(struct ath11k
  	ath11k_dbg(ab, ATH11K_DBG_MAC, "ath11k_peer_update_ast old peer %pM new peer %pM ast_entry %pM\n",
  		   old_peer->addr, peer->addr, ast_entry->addr);
  
@@ -476,7 +473,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	ast_entry->action = ATH11K_WDS_WMI_UPDATE;
  	ieee80211_queue_work(ar->hw, &ast_entry->wds_wmi_wk);
  
-@@ -329,8 +346,8 @@ void ath11k_peer_del_ast(struct ath11k *
+@@ -343,8 +360,8 @@ void ath11k_peer_del_ast(struct ath11k *
  
  	peer = ast_entry->peer;
  
@@ -489,7 +486,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		list_del(&ast_entry->ase_list);
 --- a/drivers/net/wireless/ath/ath11k/peer.h
 +++ b/drivers/net/wireless/ath/ath11k/peer.h
-@@ -23,6 +23,7 @@ enum ath11k_ast_entry_type {
+@@ -34,6 +34,7 @@ enum ath11k_ast_entry_type {
  enum ath11k_wds_wmi_action {
  	ATH11K_WDS_WMI_ADD = 1,
  	ATH11K_WDS_WMI_UPDATE,
@@ -497,7 +494,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
  	ATH11K_WDS_WMI_MAX
  };
-@@ -126,6 +127,8 @@ int ath11k_peer_rhash_delete(struct ath1
+@@ -127,6 +128,8 @@ int ath11k_peer_rhash_delete(struct ath1
  #ifdef CPTCFG_ATH11K_NSS_SUPPORT
  struct ath11k_ast_entry *ath11k_peer_ast_find_by_addr(struct ath11k_base *ab,
  						      u8* addr);
@@ -506,7 +503,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  int ath11k_peer_add_ast(struct ath11k *ar, struct ath11k_peer *peer,
  			u8* mac_addr, enum ath11k_ast_entry_type type);
  int ath11k_peer_update_ast(struct ath11k *ar, struct ath11k_peer *peer,
-@@ -145,6 +148,12 @@ static inline struct ath11k_ast_entry *a
+@@ -146,6 +149,12 @@ static inline struct ath11k_ast_entry *a
  {
  	return NULL;
  }
@@ -521,7 +518,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  				      u8* mac_addr, enum ath11k_ast_entry_type type)
 --- a/drivers/net/wireless/ath/ath11k/nss.c
 +++ b/drivers/net/wireless/ath/ath11k/nss.c
-@@ -164,7 +164,10 @@ static void ath11k_nss_get_peer_stats(st
+@@ -124,7 +124,10 @@ static void ath11k_nss_get_peer_stats(st
  
  		peer->nss.nss_stats->tx_failed += tx_dropped;
  
@@ -533,19 +530,19 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
  		rx_packets = pstats->rx.rx_recvd;
  		peer->nss.nss_stats->rx_packets += rx_packets;
-@@ -174,7 +177,10 @@ static void ath11k_nss_get_peer_stats(st
+@@ -134,7 +137,10 @@ static void ath11k_nss_get_peer_stats(st
  			pstats->rx.err.decrypt_err;
  		peer->nss.nss_stats->rx_dropped += rx_dropped;
  
 -		ATH11K_NSS_TXRX_NETDEV_STATS(rx, peer->vif, rx_bytes, rx_packets);
 +		if (peer->nss.ext_vdev_up)
-+			ATH11K_NSS_TXRX_NETDEV_STATS(tx, peer->nss.ext_vif, tx_bytes, tx_packets);
++			ATH11K_NSS_TXRX_NETDEV_STATS(tx, peer->nss.ext_vif, rx_bytes, rx_packets);
 +		else
 +			ATH11K_NSS_TXRX_NETDEV_STATS(rx, peer->vif, rx_bytes, rx_packets);
  
  		spin_unlock_bh(&ab->base_lock);
  		rcu_read_unlock();
-@@ -1040,6 +1046,9 @@ int ath11k_nss_vdev_set_cmd(struct ath11
+@@ -997,6 +1003,9 @@ int ath11k_nss_vdev_set_cmd(struct ath11
  	case ATH11K_NSS_WIFI_VDEV_DECAP_TYPE_CMD:
  		cmd = NSS_WIFI_VDEV_DECAP_TYPE_CMD;
  		break;
@@ -557,15 +554,15 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	}
 --- a/drivers/net/wireless/ath/ath11k/nss.h
 +++ b/drivers/net/wireless/ath/ath11k/nss.h
-@@ -109,6 +109,7 @@ enum ath11k_nss_vdev_cmd {
+@@ -108,6 +108,7 @@ enum ath11k_nss_vdev_cmd {
  	ATH11K_NSS_WIFI_VDEV_SECURITY_TYPE_CMD,
  	ATH11K_NSS_WIFI_VDEV_ENCAP_TYPE_CMD,
  	ATH11K_NSS_WIFI_VDEV_DECAP_TYPE_CMD,
 +	ATH11K_NSS_WIFI_VDEV_CFG_WDS_BACKHAUL_CMD,
  };
  
- #define WIFILI_SCHEME_ID_INVALID	-1
-@@ -155,6 +156,7 @@ struct ath11k_nss_peer {
+ enum ath11k_nss_opmode {
+@@ -152,6 +153,7 @@ struct ath11k_nss_peer {
  	uint32_t *vaddr;
  	dma_addr_t paddr;
  	bool ext_vdev_up;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/904-002-ath11k-extend-ext-vdev-in-NSS-for-dynamic-VLAN-handling.patch b/package/kernel/mac80211/patches/nss/ath11k/236-002-ath11k-extend-ext-vdev-in-NSS-for-dynamic-VLAN-handling.patch
similarity index 92%
rename from package/kernel/mac80211/patches/ath11k_nss/904-002-ath11k-extend-ext-vdev-in-NSS-for-dynamic-VLAN-handling.patch
rename to package/kernel/mac80211/patches/nss/ath11k/236-002-ath11k-extend-ext-vdev-in-NSS-for-dynamic-VLAN-handling.patch
index 14274b6a72680a..cb1e39f149e409 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/904-002-ath11k-extend-ext-vdev-in-NSS-for-dynamic-VLAN-handling.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/236-002-ath11k-extend-ext-vdev-in-NSS-for-dynamic-VLAN-handling.patch
@@ -15,7 +15,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/nss.c
 +++ b/drivers/net/wireless/ath/ath11k/nss.c
-@@ -1570,14 +1570,11 @@ static int ath11k_nss_ext_vdev_register(
+@@ -1527,14 +1527,11 @@ static int ath11k_nss_ext_vdev_register(
  	struct ath11k *ar = arvif->ar;
  	struct ath11k_base *ab = ar->ab;
  	nss_tx_status_t status;
@@ -30,7 +30,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	arvif->nss.ctx = nss_wifi_ext_vdev_register_if(arvif->nss.if_num,
  						       ath11k_nss_ext_vdev_data_receive,
  						       ath11k_nss_ext_vdev_special_data_receive,
-@@ -1605,7 +1602,8 @@ static void ath11k_nss_ext_vdev_free(str
+@@ -1562,7 +1559,8 @@ static void ath11k_nss_ext_vdev_free(str
  
  	status = nss_dynamic_interface_dealloc_node(
  					arvif->nss.if_num,
@@ -40,7 +40,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	if (status != NSS_TX_SUCCESS)
  		ath11k_warn(ab, "failed to free nss ext vdev err:%d\n",
  			    status);
-@@ -1614,14 +1612,19 @@ static void ath11k_nss_ext_vdev_free(str
+@@ -1571,14 +1569,19 @@ static void ath11k_nss_ext_vdev_free(str
  			   "nss ext vdev interface deallocated\n");
  }
  
@@ -62,7 +62,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	if_num = nss_dynamic_interface_alloc_node(di_type);
  	if (if_num < 0) {
  		ath11k_warn(ab, "failed to allocate nss ext vdev\n");
-@@ -1630,8 +1633,8 @@ static int ath11k_nss_ext_vdev_alloc(str
+@@ -1587,8 +1590,8 @@ static int ath11k_nss_ext_vdev_alloc(str
  
  	arvif->nss.if_num = if_num;
  	ath11k_dbg(ab, ATH11K_DBG_NSS_WDS,
@@ -73,7 +73,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
  	return 0;
  }
-@@ -1660,7 +1663,7 @@ int ath11k_nss_ext_vdev_create(struct at
+@@ -1617,7 +1620,7 @@ int ath11k_nss_ext_vdev_create(struct at
  		return -EINVAL;
  	}
  
@@ -82,7 +82,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	if (ret)
  		return ret;
  
-@@ -1773,6 +1776,86 @@ free:
+@@ -1730,6 +1733,86 @@ free:
  	return ret;
  }
  
@@ -171,7 +171,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  int ath11k_nss_set_peer_sec_type(struct ath11k *ar,
 --- a/drivers/net/wireless/ath/ath11k/nss.h
 +++ b/drivers/net/wireless/ath/ath11k/nss.h
-@@ -179,6 +179,10 @@ struct arvif_nss {
+@@ -176,6 +176,10 @@ struct arvif_nss {
  	bool added;
  	/* Flag to notify if ext vdev is up/down */
  	bool ext_vdev_up;
@@ -182,7 +182,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	/* WDS cfg should be done only once for ext vdev */
  	bool wds_cfg_done;
  	bool created;
-@@ -246,6 +250,9 @@ void ath11k_nss_ext_vdev_unregister(stru
+@@ -243,6 +247,9 @@ void ath11k_nss_ext_vdev_unregister(stru
  int ath11k_nss_ext_vdev_up(struct ath11k_vif *arvif);
  int ath11k_nss_ext_vdev_down(struct ath11k_vif *arvif);
  void ath11k_nss_ext_vdev_delete(struct ath11k_vif *arvif);
@@ -192,7 +192,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  int ath11k_nss_set_peer_sec_type(struct ath11k *ar, struct ath11k_peer *peer,
  				 struct ieee80211_key_conf *key_conf);
  void ath11k_nss_update_sta_stats(struct ath11k_vif *arvif,
-@@ -378,6 +385,18 @@ static inline int ath11k_nss_ext_vdev_do
+@@ -375,6 +382,18 @@ static inline int ath11k_nss_ext_vdev_do
  {
  	return 0;
  }
diff --git a/package/kernel/mac80211/patches/ath11k_nss/904-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch b/package/kernel/mac80211/patches/nss/ath11k/236-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch
similarity index 91%
rename from package/kernel/mac80211/patches/ath11k_nss/904-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch
rename to package/kernel/mac80211/patches/nss/ath11k/236-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch
index 2361523d394ac4..80b8a5fc67d7ea 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/904-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/236-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch
@@ -36,7 +36,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -98,6 +98,11 @@ enum ath11k_crypt_mode {
+@@ -99,6 +99,11 @@ enum ath11k_crypt_mode {
  	ATH11K_CRYPT_MODE_SW,
  };
  
@@ -48,7 +48,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  static inline enum wme_ac ath11k_tid_to_ac(u32 tid)
  {
  	return (((tid == 0) || (tid == 3)) ? WME_AC_BE :
-@@ -325,6 +330,20 @@ struct ath11k_mgmt_frame_stats {
+@@ -326,6 +331,20 @@ struct ath11k_mgmt_frame_stats {
  	u32 tx_compl_fail[ATH11K_STATS_MGMT_FRM_TYPE_MAX];
  };
  
@@ -69,9 +69,9 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  struct ath11k_vif {
  	u32 vdev_id;
  	enum wmi_vdev_type vdev_type;
-@@ -387,6 +406,11 @@ struct ath11k_vif {
- 	struct ath11k_mgmt_frame_stats mgmt_stats;
+@@ -390,6 +409,11 @@ struct ath11k_vif {
  	struct arvif_nss nss;
+ #endif
  	struct list_head ap_vlan_arvifs;
 +	/* list required by Dynamic VLAN during fw_recovery */
 +	struct list_head dyn_vlan_cfg;
@@ -83,7 +83,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  struct ath11k_vif_iter {
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -348,6 +348,10 @@ enum nl80211_he_gi ath11k_mac_he_gi_to_n
+@@ -351,6 +351,10 @@ enum nl80211_he_gi ath11k_mac_he_gi_to_n
  	return ret;
  }
  
@@ -94,7 +94,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  u8 ath11k_mac_bw_to_mac80211_bw(u8 bw)
  {
  	u8 ret = 0;
-@@ -720,6 +724,33 @@ u8 ath11k_mac_get_target_pdev_id(struct
+@@ -723,6 +727,33 @@ u8 ath11k_mac_get_target_pdev_id(struct
  		return ar->ab->target_pdev_ids[0].pdev_id;
  }
  
@@ -128,7 +128,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  static void ath11k_pdev_caps_update(struct ath11k *ar)
  {
  	struct ath11k_base *ab = ar->ab;
-@@ -4173,6 +4204,9 @@ static int ath11k_install_key(struct ath
+@@ -4172,6 +4203,9 @@ static int ath11k_install_key(struct ath
  	if (test_bit(ATH11K_FLAG_HW_CRYPTO_DISABLED, &ar->ab->dev_flags))
  		return 0;
  
@@ -138,7 +138,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	if (cmd == DISABLE_KEY) {
  		arg.key_cipher = WMI_CIPHER_NONE;
  		arg.key_data = NULL;
-@@ -4262,15 +4296,40 @@ static int ath11k_clear_peer_keys(struct
+@@ -4261,15 +4295,40 @@ static int ath11k_clear_peer_keys(struct
  	return first_errno;
  }
  
@@ -181,7 +181,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	const u8 *peer_addr;
  	int ret = 0;
  	u32 flags = 0;
-@@ -4288,17 +4347,38 @@ static int ath11k_mac_op_set_key(struct
+@@ -4287,17 +4346,38 @@ static int ath11k_mac_op_set_key(struct
  	if (key->keyidx > WMI_MAX_KEY_INDEX)
  		return -ENOSPC;
  
@@ -224,7 +224,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	/* the peer should not disappear in mid-way (unless FW goes awry) since
  	 * we already hold conf_mutex. we just make sure its there now.
  	 */
-@@ -4343,6 +4423,74 @@ static int ath11k_mac_op_set_key(struct
+@@ -4342,6 +4422,74 @@ static int ath11k_mac_op_set_key(struct
  		goto exit;
  	}
  
@@ -299,7 +299,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	spin_lock_bh(&ab->base_lock);
  	peer = ath11k_peer_find(ab, arvif->vdev_id, peer_addr);
  
-@@ -4365,6 +4513,27 @@ static int ath11k_mac_op_set_key(struct
+@@ -4364,6 +4512,27 @@ static int ath11k_mac_op_set_key(struct
  		goto unlock;
  	}
  
@@ -327,7 +327,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	if (peer && cmd == SET_KEY) {
  		peer->keys[key->keyidx] = key;
  		if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
-@@ -4374,18 +4543,23 @@ static int ath11k_mac_op_set_key(struct
+@@ -4373,18 +4542,23 @@ static int ath11k_mac_op_set_key(struct
  			peer->mcast_keyidx = key->keyidx;
  			peer->sec_type_grp = ath11k_dp_tx_get_encrypt_type(key->cipher);
  		}
@@ -354,7 +354,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
  		switch (key->cipher) {
  		case WLAN_CIPHER_SUITE_TKIP:
-@@ -5186,6 +5360,33 @@ static u32 ath11k_mac_ieee80211_sta_bw_t
+@@ -5191,6 +5365,33 @@ static u32 ath11k_mac_ieee80211_sta_bw_t
  	return bw;
  }
  
@@ -388,7 +388,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  static int ath11k_mac_op_sta_state(struct ieee80211_hw *hw,
  				   struct ieee80211_vif *vif,
  				   struct ieee80211_sta *sta,
-@@ -5306,6 +5507,34 @@ static int ath11k_mac_op_sta_state(struc
+@@ -5300,6 +5501,34 @@ static int ath11k_mac_op_sta_state(struc
  			if (ret)
  				ath11k_warn(ar->ab, "Unable to authorize peer %pM vdev %d: %d\n",
  					    sta->addr, arvif->vdev_id, ret);
@@ -423,7 +423,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		}
  	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
  		   new_state == IEEE80211_STA_ASSOC) {
-@@ -7045,7 +7274,7 @@ static int ath11k_mac_op_add_interface(s
+@@ -7018,7 +7247,7 @@ static int ath11k_mac_op_add_interface(s
  	if ((vif->type == NL80211_IFTYPE_AP_VLAN ||
  	     vif->type == NL80211_IFTYPE_STATION) && ab->nss.enabled) {
  		if (ath11k_frame_mode == ATH11K_HW_TXRX_ETHERNET &&
@@ -432,7 +432,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  			vif->offload_flags |= IEEE80211_OFFLOAD_ENCAP_4ADDR;
  			arvif->nss.encap = ATH11K_HW_TXRX_ETHERNET;
  			arvif->nss.decap = ATH11K_HW_TXRX_ETHERNET;
-@@ -7058,6 +7287,7 @@ static int ath11k_mac_op_add_interface(s
+@@ -7031,6 +7260,7 @@ static int ath11k_mac_op_add_interface(s
  					    vif->addr, ret);
  				goto err;
  			}
@@ -440,7 +440,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  			mutex_unlock(&ar->conf_mutex);
  			return ret;
  		}
-@@ -7082,6 +7312,20 @@ static int ath11k_mac_op_add_interface(s
+@@ -7055,6 +7285,20 @@ static int ath11k_mac_op_add_interface(s
  	arvif->vdev_id = bit;
  	arvif->vdev_subtype = WMI_VDEV_SUBTYPE_NONE;
  
@@ -461,7 +461,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	switch (vif->type) {
  	case NL80211_IFTYPE_UNSPECIFIED:
  	case NL80211_IFTYPE_STATION:
-@@ -7122,7 +7366,7 @@ static int ath11k_mac_op_add_interface(s
+@@ -7095,7 +7339,7 @@ static int ath11k_mac_op_add_interface(s
  	if (ret) {
  		ath11k_warn(ab, "failed to create WMI vdev %d: %d\n",
  			    arvif->vdev_id, ret);
@@ -470,7 +470,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	}
  
  	ar->num_created_vdevs++;
-@@ -7281,7 +7525,7 @@ err_peer_del:
+@@ -7254,7 +7498,7 @@ err_peer_del:
  		if (fbret) {
  			ath11k_warn(ar->ab, "fallback fail to delete peer addr %pM vdev_id %d ret %d\n",
  				    vif->addr, arvif->vdev_id, fbret);
@@ -479,7 +479,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		}
  	}
  
-@@ -7292,6 +7536,8 @@ err_vdev_del:
+@@ -7265,6 +7509,8 @@ err_vdev_del:
  	list_del(&arvif->list);
  	spin_unlock_bh(&ar->data_lock);
  
@@ -488,7 +488,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  err:
  	mutex_unlock(&ar->conf_mutex);
  
-@@ -7389,6 +7635,7 @@ err_vdev_del:
+@@ -7362,6 +7608,7 @@ err_vdev_del:
  	list_del(&arvif->list);
  	spin_unlock_bh(&ar->data_lock);
  
@@ -496,7 +496,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	ath11k_peer_cleanup(ar, arvif->vdev_id);
  
  	idr_for_each(&ar->txmgmt_idr,
-@@ -10113,8 +10360,11 @@ static int __ath11k_mac_register(struct
+@@ -9960,8 +10207,11 @@ static int __ath11k_mac_register(struct
  	    ab->hw_params.bios_sar_capa)
  		ar->hw->wiphy->sar_capa = ab->hw_params.bios_sar_capa;
  
@@ -511,7 +511,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	if (ret) {
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
-@@ -2001,6 +2001,7 @@ int ath11k_wmi_vdev_install_key(struct a
+@@ -1938,6 +1938,7 @@ int ath11k_wmi_vdev_install_key(struct a
  	cmd->key_len = arg->key_len;
  	cmd->key_txmic_len = arg->key_txmic_len;
  	cmd->key_rxmic_len = arg->key_rxmic_len;
@@ -519,7 +519,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
  	if (arg->key_rsc_counter)
  		memcpy(&cmd->key_rsc_counter, &arg->key_rsc_counter,
-@@ -4275,6 +4276,7 @@ ath11k_wmi_copy_resource_config(struct w
+@@ -4213,6 +4214,7 @@ ath11k_wmi_copy_resource_config(struct w
  	wmi_cfg->flags2 = WMI_RSRC_CFG_FLAG2_CALC_NEXT_DTIM_COUNT_SET;
  	wmi_cfg->ema_max_vap_cnt = tg_cfg->ema_max_vap_cnt;
  	wmi_cfg->ema_max_profile_period = tg_cfg->ema_max_profile_period;
@@ -527,7 +527,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  }
  
  static int ath11k_init_cmd_send(struct ath11k_pdev_wmi *wmi,
-@@ -4497,6 +4499,9 @@ int ath11k_wmi_cmd_init(struct ath11k_ba
+@@ -4435,6 +4437,9 @@ int ath11k_wmi_cmd_init(struct ath11k_ba
  	memset(&init_param, 0, sizeof(init_param));
  	memset(&config, 0, sizeof(config));
  
@@ -539,7 +539,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	if (test_bit(WMI_TLV_SERVICE_REG_CC_EXT_EVENT_SUPPORT,
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
-@@ -3701,6 +3701,7 @@ struct wmi_vdev_install_key_arg {
+@@ -3703,6 +3703,7 @@ struct wmi_vdev_install_key_arg {
  	u32 vdev_id;
  	const u8 *macaddr;
  	u32 key_idx;
@@ -547,7 +547,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	u32 key_flags;
  	u32 key_cipher;
  	u32 key_len;
-@@ -5846,6 +5847,7 @@ struct target_resource_config {
+@@ -5786,6 +5787,7 @@ struct target_resource_config {
  	u32 bpf_instruction_size;
  	u32 max_bssid_rx_filters;
  	u32 use_pdev_id;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/237-001-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch b/package/kernel/mac80211/patches/nss/ath11k/237-001-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
new file mode 100644
index 00000000000000..0362ff8caa5d0e
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/237-001-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
@@ -0,0 +1,101 @@
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -1076,6 +1076,7 @@ struct ath11k_base {
+ 	u32 max_ast_index;
+ 	u32 num_ast_entries;
+ 
++	bool stats_disable;
+ 	/* must be last */
+ 	u8 drv_priv[] __aligned(sizeof(void *));
+ };
+--- a/drivers/net/wireless/ath/ath11k/debugfs.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs.c
+@@ -973,6 +973,79 @@ static const struct file_operations fops
+ 	.llseek = default_llseek,
+ };
+ 
++static void ath11k_debug_config_mon_status(struct ath11k *ar, bool enable)
++{
++	struct htt_rx_ring_tlv_filter tlv_filter = {0};
++	struct ath11k_base *ab = ar->ab;
++	int i;
++	u32 ring_id;
++
++	if (enable)
++		tlv_filter = ath11k_mac_mon_status_filter_default;
++
++	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
++		ring_id = ar->dp.rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
++		ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id,
++						 ar->dp.mac_id + i,
++						 HAL_RXDMA_MONITOR_STATUS,
++						 DP_RX_BUFFER_SIZE,
++						 &tlv_filter);
++	}
++}
++
++static ssize_t ath11k_write_stats_disable(struct file *file,
++					  const char __user *user_buf,
++					  size_t count, loff_t *ppos)
++{
++	struct ath11k_base *ab = file->private_data;
++	struct ath11k_pdev *pdev;
++	bool disable;
++	int ret, i, radioup = 0;
++	u32 mask = 0;
++
++	for (i = 0; i < ab->num_radios; i++) {
++		pdev = &ab->pdevs[i];
++		if (pdev && pdev->ar) {
++			radioup = 1;
++			break;
++		}
++	}
++
++	if (radioup == 0) {
++		ath11k_err(ab, "radio is not up\n");
++		ret = -ENETDOWN;
++		goto exit;
++	}
++
++	if (kstrtobool_from_user(user_buf, count, &disable))
++		 return -EINVAL;
++
++	 if (disable != ab->stats_disable) {
++		ab->stats_disable = disable;
++		for (i = 0; i < ab->num_radios; i++) {
++			pdev = &ab->pdevs[i];
++			if (pdev && pdev->ar) {
++				ath11k_debug_config_mon_status(pdev->ar, !disable);
++
++				if (!disable)
++					mask = HTT_PPDU_STATS_TAG_DEFAULT;
++
++				ath11k_dp_tx_htt_h2t_ppdu_stats_req(pdev->ar, mask);
++			}
++		}
++	 }
++
++	ret = count;
++
++exit:
++	return ret;
++}
++
++static const struct file_operations fops_soc_stats_disable = {
++	.open = simple_open,
++	.write = ath11k_write_stats_disable,
++};
++
+ int ath11k_debugfs_pdev_create(struct ath11k_base *ab)
+ {
+ 	if (test_bit(ATH11K_FLAG_REGISTERED, &ab->dev_flags))
+@@ -1022,6 +1095,8 @@ int ath11k_debugfs_soc_create(struct ath
+ 		ret = PTR_ERR(ab->debugfs_soc);
+ 		goto out;
+ 	}
++	debugfs_create_file("stats_disable", 0600, ab->debugfs_soc, ab,
++                            &fops_soc_stats_disable);
+ 
+ 	ret = 0;
+ 
diff --git a/package/kernel/mac80211/patches/ath11k_nss/237-003-ath11k-allocate-dst-ring-descriptors-from-cacheable-.patch b/package/kernel/mac80211/patches/nss/ath11k/237-003-ath11k-allocate-dst-ring-descriptors-from-cacheable-.patch
similarity index 96%
rename from package/kernel/mac80211/patches/ath11k_nss/237-003-ath11k-allocate-dst-ring-descriptors-from-cacheable-.patch
rename to package/kernel/mac80211/patches/nss/ath11k/237-003-ath11k-allocate-dst-ring-descriptors-from-cacheable-.patch
index c054ee146f748a..db2bbfa0d2845d 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/237-003-ath11k-allocate-dst-ring-descriptors-from-cacheable-.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/237-003-ath11k-allocate-dst-ring-descriptors-from-cacheable-.patch
@@ -24,7 +24,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/dp_tx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
-@@ -705,6 +705,7 @@ void ath11k_dp_tx_completion_handler(str
+@@ -761,6 +761,7 @@ void ath11k_dp_tx_completion_handler(str
  	struct sk_buff *msdu;
  	struct hal_tx_status ts = { 0 };
  	struct dp_tx_ring *tx_ring = &dp->tx_ring[ring_id];
@@ -32,7 +32,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	u32 *desc;
  	u32 msdu_id;
  	u8 mac_id;
-@@ -713,9 +714,18 @@ void ath11k_dp_tx_completion_handler(str
+@@ -769,9 +770,18 @@ void ath11k_dp_tx_completion_handler(str
  
  	ath11k_hal_srng_access_begin(ab, status_ring);
  
@@ -131,7 +131,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  
 --- a/drivers/net/wireless/ath/ath11k/hal.h
 +++ b/drivers/net/wireless/ath/ath11k/hal.h
-@@ -946,8 +946,12 @@ void ath11k_hal_srng_get_params(struct a
+@@ -945,8 +945,12 @@ void ath11k_hal_srng_get_params(struct a
  u32 *ath11k_hal_srng_dst_get_next_entry(struct ath11k_base *ab,
  					struct hal_srng *srng);
  u32 *ath11k_hal_srng_dst_peek(struct ath11k_base *ab, struct hal_srng *srng);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch b/package/kernel/mac80211/patches/nss/ath11k/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
similarity index 70%
rename from package/kernel/mac80211/patches/ath11k_nss/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
rename to package/kernel/mac80211/patches/nss/ath11k/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
index 9bc2b50f7cbd45..61077309338ffb 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
@@ -23,7 +23,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -135,6 +135,7 @@ struct ath11k_skb_rxcb {
+@@ -143,6 +143,7 @@ struct ath11k_skb_rxcb {
  	u8 tid;
  	u16 peer_id;
  	u16 seq_no;
@@ -31,109 +31,9 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  };
  
  enum ath11k_hw_rev {
-@@ -1039,6 +1040,7 @@ struct ath11k_base {
- 	struct ath11k_num_vdevs_peers *num_vdevs_peers;
- 
- 	u32 rx_hash;
-+	bool stats_disable;
- 
- 	/* must be last */
- 	u8 drv_priv[] __aligned(sizeof(void *));
---- a/drivers/net/wireless/ath/ath11k/debugfs.c
-+++ b/drivers/net/wireless/ath/ath11k/debugfs.c
-@@ -1020,6 +1020,80 @@ static const struct file_operations fops
- 	.open = simple_open,
- 	.write = ath11k_write_rx_hash,
- };
-+
-+static void ath11k_debug_config_mon_status(struct ath11k *ar, bool enable)
-+{
-+	struct htt_rx_ring_tlv_filter tlv_filter = {0};
-+	struct ath11k_base *ab = ar->ab;
-+	int i;
-+	u32 ring_id;
-+
-+	if (enable)
-+		tlv_filter = ath11k_mac_mon_status_filter_default;
-+
-+	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
-+		ring_id = ar->dp.rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
-+		ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id,
-+						 ar->dp.mac_id + i,
-+						 HAL_RXDMA_MONITOR_STATUS,
-+						 DP_RX_BUFFER_SIZE,
-+						 &tlv_filter);
-+	}
-+}
-+
-+static ssize_t ath11k_write_stats_disable(struct file *file,
-+					  const char __user *user_buf,
-+					  size_t count, loff_t *ppos)
-+{
-+	struct ath11k_base *ab = file->private_data;
-+	struct ath11k_pdev *pdev;
-+	bool disable;
-+	int ret, i, radioup = 0;
-+	u32 mask = 0;
-+
-+	for (i = 0; i < ab->num_radios; i++) {
-+		pdev = &ab->pdevs[i];
-+		if (pdev && pdev->ar) {
-+			radioup = 1;
-+			break;
-+		}
-+	}
-+
-+	if (radioup == 0) {
-+		ath11k_err(ab, "radio is not up\n");
-+		ret = -ENETDOWN;
-+		goto exit;
-+	}
-+
-+	if (kstrtobool_from_user(user_buf, count, &disable))
-+		 return -EINVAL;
-+
-+	 if (disable != ab->stats_disable) {
-+		ab->stats_disable = disable;
-+		for (i = 0; i < ab->num_radios; i++) {
-+			pdev = &ab->pdevs[i];
-+			if (pdev && pdev->ar) {
-+				ath11k_debug_config_mon_status(pdev->ar, !disable);
-+
-+				if (!disable)
-+					mask = HTT_PPDU_STATS_TAG_DEFAULT;
-+
-+				ath11k_dp_tx_htt_h2t_ppdu_stats_req(pdev->ar, mask);
-+			}
-+		}
-+	 }
-+
-+	ret = count;
-+
-+exit:
-+	return ret;
-+}
-+
-+static const struct file_operations fops_soc_stats_disable = {
-+	.open = simple_open,
-+	.write = ath11k_write_stats_disable,
-+};
-+
- int ath11k_debugfs_pdev_create(struct ath11k_base *ab)
- {
- 	if (test_bit(ATH11K_FLAG_REGISTERED, &ab->dev_flags))
-@@ -1035,7 +1109,7 @@ int ath11k_debugfs_pdev_create(struct at
- 		debugfs_create_file("sram", 0400, ab->debugfs_soc, ab,
- 				    &fops_sram_dump);
- 
--		debugfs_create_file("rx_hash", 0600, ab->debugfs_soc, ab,
-+	debugfs_create_file("rx_hash", 0600, ab->debugfs_soc, ab,
- 			    &fops_soc_rx_hash);
- 
- 
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -375,6 +375,12 @@ static int ath11k_dp_purge_mon_ring(stru
+@@ -340,6 +340,12 @@ static int ath11k_dp_purge_mon_ring(stru
  	return -ETIMEDOUT;
  }
  
@@ -146,7 +46,16 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  /* Returns number of Rx buffers replenished */
  int ath11k_dp_rxbufs_replenish(struct ath11k_base *ab, int mac_id,
  			       struct dp_rxdma_ring *rx_ring,
-@@ -2402,10 +2408,60 @@ ath11k_dp_rx_h_find_peer(struct ath11k_b
+@@ -1664,7 +1670,7 @@ int ath11k_dp_htt_tlv_iter(struct ath11k
+ 		len -= sizeof(*tlv);
+ 
+ 		if (tlv_len > len) {
+-			ath11k_err(ab, "htt tlv parse failure of tag %hhu at byte %zd (%zu bytes left, %hhu expected)\n",
++			ath11k_err(ab, "htt tlv parse failure of tag %hu at byte %zd (%zu bytes left, %hu expected)\n",
+ 				   tlv_tag, ptr - begin, len, tlv_len);
+ 			return -EINVAL;
+ 		}
+@@ -2454,10 +2460,60 @@ ath11k_dp_rx_h_find_peer(struct ath11k_b
  	return peer;
  }
  
@@ -208,17 +117,22 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  {
  	bool  fill_crypto_hdr;
  	enum hal_encrypt_type enctype;
-@@ -2417,6 +2473,9 @@ static void ath11k_dp_rx_h_mpdu(struct a
+@@ -2468,9 +2524,13 @@ static void ath11k_dp_rx_h_mpdu(struct a
+ 	struct rx_attention *rx_attention;
  	u32 err_bitmap;
  
- 
 +	struct wireless_dev *wdev = NULL;
 +	struct ath11k_sta *arsta = NULL;
 +
  	/* PN for multicast packets will be checked in mac80211 */
  	rxcb = ATH11K_SKB_RXCB(msdu);
- 	fill_crypto_hdr = ath11k_dp_rx_h_attn_is_mcbc(ar->ab, rx_desc);
-@@ -2430,6 +2489,30 @@ static void ath11k_dp_rx_h_mpdu(struct a
+-	fill_crypto_hdr = ath11k_dp_rx_h_attn_is_mcbc(ar->ab, rx_desc);
++	if (!ar->ab->nss.enabled)
++		fill_crypto_hdr = ath11k_dp_rx_h_attn_is_mcbc(ar->ab, rx_desc);
+ 	rxcb->is_mcbc = fill_crypto_hdr;
+ 
+ 	if (rxcb->is_mcbc) {
+@@ -2481,6 +2541,26 @@ static void ath11k_dp_rx_h_mpdu(struct a
  	spin_lock_bh(&ar->ab->base_lock);
  	peer = ath11k_dp_rx_h_find_peer(ar->ab, msdu);
  	if (peer) {
@@ -238,18 +152,23 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
 +				if (peer->sta)
 +					arsta =
 +					(struct ath11k_sta *)peer->sta->drv_priv;
-+				if (arsta)
-+					atomic_inc(&arsta->drv_rx_pkts.pkts_out_to_netif);
 +				return;
 +			}
 +		}
-+
-+		*fast_rx = false;
 +
  		if (rxcb->is_mcbc)
  			enctype = peer->sec_type_grp;
  		else
-@@ -2693,7 +2776,8 @@ static void ath11k_dp_rx_deliver_msdu(st
+@@ -2490,6 +2570,8 @@ static void ath11k_dp_rx_h_mpdu(struct a
+ 	}
+ 	spin_unlock_bh(&ar->ab->base_lock);
+ 
++	*fast_rx = false;
++
+ 	rx_attention = ath11k_dp_rx_get_attention(ar->ab, rx_desc);
+ 	err_bitmap = ath11k_dp_rx_h_attn_mpdu_err(rx_attention);
+ 	if (enctype != HAL_ENCRYPT_TYPE_OPEN && !err_bitmap)
+@@ -2731,7 +2813,8 @@ static void ath11k_dp_rx_deliver_msdu(st
  static int ath11k_dp_rx_process_msdu(struct ath11k *ar,
  				     struct sk_buff *msdu,
  				     struct sk_buff_head *msdu_list,
@@ -259,7 +178,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  {
  	struct ath11k_base *ab = ar->ab;
  	struct hal_rx_desc *rx_desc, *lrx_desc;
-@@ -2775,8 +2859,13 @@ static int ath11k_dp_rx_process_msdu(str
+@@ -2798,8 +2881,13 @@ static int ath11k_dp_rx_process_msdu(str
  		}
  	}
  
@@ -274,7 +193,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  
  	rx_status->flag |= RX_FLAG_SKIP_MONITOR | RX_FLAG_DUP_VALIDATED;
  
-@@ -2791,10 +2880,12 @@ static void ath11k_dp_rx_process_receive
+@@ -2814,10 +2902,12 @@ static void ath11k_dp_rx_process_receive
  						  struct sk_buff_head *msdu_list,
  						  int mac_id)
  {
@@ -287,7 +206,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  
  	if (skb_queue_empty(msdu_list))
  		return;
-@@ -2811,7 +2902,12 @@ static void ath11k_dp_rx_process_receive
+@@ -2834,7 +2924,12 @@ static void ath11k_dp_rx_process_receive
  	}
  
  	while ((msdu = __skb_dequeue(msdu_list))) {
@@ -301,7 +220,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		if (unlikely(ret)) {
  			ath11k_dbg(ab, ATH11K_DBG_DATA,
  				   "Unable to process msdu %d", ret);
-@@ -2819,7 +2915,10 @@ static void ath11k_dp_rx_process_receive
+@@ -2842,7 +2937,10 @@ static void ath11k_dp_rx_process_receive
  			continue;
  		}
  
@@ -313,15 +232,29 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	}
  }
  
-@@ -4117,6 +4216,7 @@ static int ath11k_dp_rx_h_null_q_desc(st
- 	struct ath11k_sta *arsta = NULL;
- 	u32 hal_rx_desc_sz = ar->ab->hw_params.hal_desc_sz;
- 	u32 peer_id;
-+	bool fast_rx;
+@@ -2851,11 +2949,12 @@ void ath11k_dp_rx_from_nss(struct ath11k
+ {
+ 	struct ieee80211_rx_status rx_status = {0};
+ 	struct ath11k_skb_rxcb *rxcb;
++	bool fast_rx = false;
  
- 	msdu_len = ath11k_dp_rx_h_msdu_start_msdu_len(ar->ab, desc);
+ 	rxcb = ATH11K_SKB_RXCB(msdu);
+ 
+ 	ath11k_dp_rx_h_ppdu(ar, rxcb->rx_desc, &rx_status);
+-	ath11k_dp_rx_h_mpdu(ar, msdu, rxcb->rx_desc, &rx_status);
++	ath11k_dp_rx_h_mpdu(ar, msdu, rxcb->rx_desc, &rx_status, &fast_rx);
+ 
+ 	rx_status.flag |= RX_FLAG_SKIP_MONITOR | RX_FLAG_DUP_VALIDATED;
  
-@@ -4160,7 +4260,8 @@ static int ath11k_dp_rx_h_null_q_desc(st
+@@ -4322,6 +4421,7 @@ static int ath11k_dp_rx_h_null_q_desc(st
+ 				      struct ieee80211_rx_status *status,
+ 				      struct sk_buff_head *msdu_list)
+ {
++	bool fast_rx;
+ 	u16 msdu_len;
+ 	struct hal_rx_desc *desc = (struct hal_rx_desc *)msdu->data;
+ 	struct rx_attention *rx_attention;
+@@ -4371,7 +4471,8 @@ static int ath11k_dp_rx_h_null_q_desc(st
  	}
  	ath11k_dp_rx_h_ppdu(ar, desc, status);
  
@@ -333,7 +266,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  
 --- a/drivers/net/wireless/ath/ath11k/hw.c
 +++ b/drivers/net/wireless/ath/ath11k/hw.c
-@@ -303,6 +303,16 @@ static bool ath11k_hw_ipq8074_rx_desc_ge
+@@ -293,6 +293,16 @@ static bool ath11k_hw_ipq8074_rx_desc_ge
  			 __le32_to_cpu(desc->u.ipq8074.msdu_start.info2));
  }
  
@@ -350,7 +283,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  static bool ath11k_hw_ipq8074_rx_desc_get_mpdu_seq_ctl_vld(struct hal_rx_desc *desc)
  {
  	return !!FIELD_GET(RX_MPDU_START_INFO1_MPDU_SEQ_CTRL_VALID,
-@@ -590,6 +600,16 @@ static bool ath11k_hw_qcn9074_rx_desc_ge
+@@ -470,6 +480,16 @@ static bool ath11k_hw_qcn9074_rx_desc_ge
  			 __le32_to_cpu(desc->u.qcn9074.msdu_start.info2));
  }
  
@@ -367,7 +300,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  static bool ath11k_hw_qcn9074_rx_desc_get_mpdu_seq_ctl_vld(struct hal_rx_desc *desc)
  {
  	return !!FIELD_GET(RX_MPDU_START_INFO11_MPDU_SEQ_CTRL_VALID,
-@@ -1132,6 +1152,7 @@ const struct ath11k_hw_ops qca6390_ops =
+@@ -1025,6 +1045,7 @@ const struct ath11k_hw_ops qca6390_ops =
  	.rx_desc_get_encrypt_type = ath11k_hw_ipq8074_rx_desc_get_encrypt_type,
  	.rx_desc_get_decap_type = ath11k_hw_ipq8074_rx_desc_get_decap_type,
  	.rx_desc_get_mesh_ctl = ath11k_hw_ipq8074_rx_desc_get_mesh_ctl,
@@ -375,7 +308,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	.rx_desc_get_ldpc_support = ath11k_hw_ipq8074_rx_desc_get_ldpc_support,
  	.rx_desc_get_mpdu_seq_ctl_vld = ath11k_hw_ipq8074_rx_desc_get_mpdu_seq_ctl_vld,
  	.rx_desc_get_mpdu_fc_valid = ath11k_hw_ipq8074_rx_desc_get_mpdu_fc_valid,
-@@ -1293,6 +1314,7 @@ const struct ath11k_hw_ops ipq5018_ops =
+@@ -1189,6 +1210,7 @@ const struct ath11k_hw_ops ipq5018_ops =
  	.rx_desc_get_encrypt_type = ath11k_hw_qcn9074_rx_desc_get_encrypt_type,
  	.rx_desc_get_decap_type = ath11k_hw_qcn9074_rx_desc_get_decap_type,
  	.rx_desc_get_mesh_ctl = ath11k_hw_qcn9074_rx_desc_get_mesh_ctl,
@@ -385,7 +318,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	.rx_desc_get_mpdu_fc_valid = ath11k_hw_qcn9074_rx_desc_get_mpdu_fc_valid,
 --- a/drivers/net/wireless/ath/ath11k/hw.h
 +++ b/drivers/net/wireless/ath/ath11k/hw.h
-@@ -287,6 +287,7 @@ struct ath11k_hw_ops {
+@@ -260,6 +260,7 @@ struct ath11k_hw_ops {
  	u32 (*rx_desc_get_encrypt_type)(struct hal_rx_desc *desc);
  	u8 (*rx_desc_get_decap_type)(struct hal_rx_desc *desc);
  	u8 (*rx_desc_get_mesh_ctl)(struct hal_rx_desc *desc);
@@ -395,7 +328,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	bool (*rx_desc_get_mpdu_fc_valid)(struct hal_rx_desc *desc);
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -5201,6 +5201,14 @@ static int ath11k_mac_op_sta_state(struc
+@@ -5532,6 +5532,14 @@ static int ath11k_mac_op_sta_state(struc
  		}
  	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
  		   new_state == IEEE80211_STA_ASSOC) {
diff --git a/package/kernel/mac80211/patches/ath11k_nss/911-244-ath11k-dp-tx-perf.patch b/package/kernel/mac80211/patches/nss/ath11k/244-ath11k-dp-tx-perf.patch
similarity index 87%
rename from package/kernel/mac80211/patches/ath11k_nss/911-244-ath11k-dp-tx-perf.patch
rename to package/kernel/mac80211/patches/nss/ath11k/244-ath11k-dp-tx-perf.patch
index 79906c8d3a4ab3..1c9a6ebd1d41ac 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/911-244-ath11k-dp-tx-perf.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/244-ath11k-dp-tx-perf.patch
@@ -26,7 +26,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -118,6 +118,7 @@ static inline enum wme_ac ath11k_tid_to_
+@@ -115,6 +115,7 @@ static inline enum wme_ac ath11k_tid_to_
  enum ath11k_skb_flags {
  	ATH11K_SKB_HW_80211_ENCAP = BIT(0),
  	ATH11K_SKB_CIPHER_SET = BIT(1),
@@ -34,22 +34,23 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  };
  
  struct ath11k_skb_cb {
-@@ -919,7 +920,12 @@ struct ath11k_soc_dp_tx_err_stats {
+@@ -883,10 +884,13 @@ struct ath11k_dp_ring_bp_stats {
+ struct ath11k_soc_dp_tx_err_stats {
+ 	/* TCL Ring Descriptor unavailable */
+ 	u32 desc_na[DP_TCL_NUM_RING_MAX];
++	/* TCL Ring IDR unavailable */
++	u32 idr_na[DP_TCL_NUM_RING_MAX];
  	/* Other failures during dp_tx due to mem allocation failure
  	 * idr unavailable etc.
  	 */
-+	/* TCL Ring IDR unavailable */
-+	u32 idr_na[DP_TCL_NUM_RING_MAX];
-+
  	atomic_t misc_fail;
 +	atomic_t max_fail;
-+	/* Tx failures due to NSS Tx error status */
+ 	/* Tx failures due to NSS Tx error status */
  	atomic_t nss_tx_fail;
  };
- 
 --- a/drivers/net/wireless/ath/ath11k/dp.c
 +++ b/drivers/net/wireless/ath/ath11k/dp.c
-@@ -362,7 +362,7 @@ void ath11k_dp_stop_shadow_timers(struct
+@@ -358,7 +358,7 @@ void ath11k_dp_stop_shadow_timers(struct
  	if (!ab->hw_params.supports_shadow_regs)
  		return;
  
@@ -58,7 +59,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		ath11k_dp_shadow_stop_timer(ab, &ab->dp.tx_ring_timer[i]);
  
  	ath11k_dp_shadow_stop_timer(ab, &ab->dp.reo_cmd_timer);
-@@ -377,7 +377,7 @@ static void ath11k_dp_srng_common_cleanu
+@@ -373,7 +373,7 @@ static void ath11k_dp_srng_common_cleanu
  	ath11k_dp_srng_cleanup(ab, &dp->wbm_desc_rel_ring);
  	ath11k_dp_srng_cleanup(ab, &dp->tcl_cmd_ring);
  	ath11k_dp_srng_cleanup(ab, &dp->tcl_status_ring);
@@ -67,7 +68,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		ath11k_dp_srng_cleanup(ab, &dp->tx_ring[i].tcl_data_ring);
  		ath11k_dp_srng_cleanup(ab, &dp->tx_ring[i].tcl_comp_ring);
  	}
-@@ -411,6 +411,11 @@ static int ath11k_dp_srng_common_setup(s
+@@ -407,6 +407,11 @@ static int ath11k_dp_srng_common_setup(s
  		goto err;
  	}
  
@@ -79,7 +80,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	ret = ath11k_dp_srng_setup(ab, &dp->tcl_status_ring, HAL_TCL_STATUS,
  				   0, 0, DP_TCL_STATUS_RING_SIZE);
  	if (ret) {
-@@ -418,7 +423,7 @@ static int ath11k_dp_srng_common_setup(s
+@@ -414,7 +419,7 @@ static int ath11k_dp_srng_common_setup(s
  		goto err;
  	}
  
@@ -88,7 +89,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		tcl_num = ab->hw_params.hal_params->tcl2wbm_rbm_map[i].tcl_ring_num;
  		wbm_num = ab->hw_params.hal_params->tcl2wbm_rbm_map[i].wbm_ring_num;
  
-@@ -441,7 +446,7 @@ static int ath11k_dp_srng_common_setup(s
+@@ -437,7 +442,7 @@ static int ath11k_dp_srng_common_setup(s
  		}
  
  		srng = &ab->hal.srng_list[dp->tx_ring[i].tcl_data_ring.ring_id];
@@ -97,7 +98,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  
  		ath11k_dp_shadow_init_timer(ab, &dp->tx_ring_timer[i],
  					    ATH11K_SHADOW_DP_TIMER_INTERVAL,
-@@ -1062,7 +1067,7 @@ void ath11k_dp_free(struct ath11k_base *
+@@ -1051,7 +1056,7 @@ void ath11k_dp_free(struct ath11k_base *
  
  	ath11k_dp_reo_cmd_list_cleanup(ab);
  
@@ -106,7 +107,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		spin_lock_bh(&dp->tx_ring[i].tx_idr_lock);
  		idr_for_each(&dp->tx_ring[i].txbuf_idr,
  			     ath11k_dp_tx_pending_cleanup, ab);
-@@ -1114,7 +1119,7 @@ int ath11k_dp_alloc(struct ath11k_base *
+@@ -1102,7 +1107,7 @@ int ath11k_dp_alloc(struct ath11k_base *
  
  	size = sizeof(struct hal_wbm_release_ring) * DP_TX_COMP_RING_SIZE;
  
@@ -117,7 +118,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		dp->tx_ring[i].tcl_data_ring_id = i;
 --- a/drivers/net/wireless/ath/ath11k/dp_tx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
-@@ -121,27 +121,35 @@ int ath11k_dp_tx(struct ath11k *ar, stru
+@@ -134,28 +134,34 @@ int ath11k_dp_tx(struct ath11k *ar, stru
  	u32 ring_selector = 0;
  	u8 ring_map = 0;
  	bool tcl_ring_retry, is_diff_encap = false;
@@ -131,9 +132,10 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		     !ieee80211_is_data(hdr->frame_control)))
  		return -ENOTSUPP;
  
--	ring_selector = ab->hw_params.hw_ops->get_ring_selector(skb);
+-	pool_id = skb_get_queue_mapping(skb) & (ATH11K_HW_MAX_QUEUES - 1);
 +	max_tx_ring = ab->hw_params.max_tx_ring;
-+
+ 
+-	ring_selector = ab->hw_params.hw_ops->get_ring_selector(skb);
 +#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
 +	if (unlikely(atomic_read(&ab->num_max_allowed) > DP_TX_COMP_MAX_ALLOWED)) {
 +		atomic_inc(&ab->soc_stats.tx_err.max_fail);
@@ -141,7 +143,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
 +	}
 +#endif
 +	ring_selector = smp_processor_id();;
- 	pool_id = ring_selector;
++	pool_id = ring_selector;
  
  tcl_ring_sel:
  	tcl_ring_retry = false;
@@ -153,16 +155,15 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
 +				  DP_TCL_NUM_RING_MAX - 1 : ring_id;
  
 -	ring_map |= BIT(ti.ring_id);
++	ring_map |= BIT(ring_id);
  
 -	tx_ring = &dp->tx_ring[ti.ring_id];
-+	ring_map |= BIT(ring_id);
-+
 +	ti.buf_id = tcl_ring_id + HAL_RX_BUF_RBM_SW0_BM;
 +	tx_ring = &dp->tx_ring[tcl_ring_id];
  
  	spin_lock_bh(&tx_ring->tx_idr_lock);
  	ret = idr_alloc(&tx_ring->txbuf_idr, skb, 0,
-@@ -149,9 +157,9 @@ tcl_ring_sel:
+@@ -163,9 +169,9 @@ tcl_ring_sel:
  	spin_unlock_bh(&tx_ring->tx_idr_lock);
  
  	if (unlikely(ret < 0)) {
@@ -174,7 +175,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  			return -ENOSPC;
  		}
  
-@@ -260,6 +268,11 @@ tcl_ring_sel:
+@@ -276,6 +282,11 @@ tcl_ring_sel:
  		ti.encrypt_type = HAL_ENCRYPT_TYPE_OPEN;
  	}
  
@@ -186,7 +187,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	ti.paddr = dma_map_single(ab->dev, skb->data, skb->len, DMA_TO_DEVICE);
  	if (unlikely(dma_mapping_error(ab->dev, ti.paddr))) {
  		atomic_inc(&ab->soc_stats.tx_err.misc_fail);
-@@ -268,13 +281,13 @@ tcl_ring_sel:
+@@ -284,13 +295,13 @@ tcl_ring_sel:
  		goto fail_remove_idr;
  	}
  
@@ -205,7 +206,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	tcl_ring = &ab->hal.srng_list[hal_ring_id];
  
  	spin_lock_bh(&tcl_ring->lock);
-@@ -287,7 +300,7 @@ tcl_ring_sel:
+@@ -303,7 +314,7 @@ tcl_ring_sel:
  		 * desc because the desc is directly enqueued onto hw queue.
  		 */
  		ath11k_hal_srng_access_end(ab, tcl_ring);
@@ -214,7 +215,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		spin_unlock_bh(&tcl_ring->lock);
  		ret = -ENOMEM;
  
-@@ -296,8 +309,8 @@ tcl_ring_sel:
+@@ -312,8 +323,8 @@ tcl_ring_sel:
  		 * checking this ring earlier for each pkt tx.
  		 * Restart ring selection if some rings are not checked yet.
  		 */
@@ -225,7 +226,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  			tcl_ring_retry = true;
  			ring_selector++;
  		}
-@@ -308,17 +321,17 @@ tcl_ring_sel:
+@@ -324,17 +335,17 @@ tcl_ring_sel:
  	ath11k_hal_tx_cmd_desc_setup(ab, hal_tcl_desc +
  					 sizeof(struct hal_tlv_hdr), &ti);
  
@@ -246,7 +247,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  
  	return 0;
  
-@@ -365,7 +378,6 @@ static void ath11k_dp_tx_free_txbuf(stru
+@@ -381,7 +392,6 @@ static void ath11k_dp_tx_free_txbuf(stru
  	ar = ab->pdevs[mac_id].ar;
  	if (atomic_dec_and_test(&ar->dp.num_tx_pending))
  		wake_up(&ar->dp.tx_empty_waitq);
@@ -254,7 +255,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  }
  
  static void
-@@ -379,6 +391,7 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
+@@ -395,6 +405,7 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
  	struct ath11k_skb_cb *skb_cb;
  	struct ath11k *ar;
  	struct ath11k_peer *peer;
@@ -262,7 +263,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  
  	spin_lock(&tx_ring->tx_idr_lock);
  	msdu = idr_remove(&tx_ring->txbuf_idr, ts->msdu_id);
-@@ -397,10 +410,30 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
+@@ -413,10 +424,30 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
  
  	if (atomic_dec_and_test(&ar->dp.num_tx_pending))
  		wake_up(&ar->dp.tx_empty_waitq);
@@ -294,7 +295,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	if (!skb_cb->vif) {
  		ieee80211_free_txskb(ar->hw, msdu);
  		return;
-@@ -616,6 +649,7 @@ static void ath11k_dp_tx_complete_msdu(s
+@@ -632,6 +663,7 @@ static void ath11k_dp_tx_complete_msdu(s
  	struct ath11k_peer *peer;
  	struct ath11k_sta *arsta;
  	struct rate_info rate;
@@ -302,7 +303,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  
  	if (WARN_ON_ONCE(ts->buf_rel_source != HAL_WBM_REL_SRC_MODULE_TQM)) {
  		/* Must not happen */
-@@ -626,6 +660,20 @@ static void ath11k_dp_tx_complete_msdu(s
+@@ -642,6 +674,20 @@ static void ath11k_dp_tx_complete_msdu(s
  
  	dma_unmap_single(ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
  
@@ -323,7 +324,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	if (unlikely(!rcu_access_pointer(ab->pdevs_active[ar->pdev_idx]))) {
  		ieee80211_free_txskb(ar->hw, msdu);
  		return;
-@@ -680,7 +728,7 @@ static void ath11k_dp_tx_complete_msdu(s
+@@ -696,7 +742,7 @@ static void ath11k_dp_tx_complete_msdu(s
  
  	spin_lock_bh(&ab->base_lock);
  	peer = ath11k_peer_find_by_id(ab, ts->peer_id);
@@ -332,7 +333,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		ath11k_dbg(ab, ATH11K_DBG_DATA,
  			   "dp_tx: failed to find the peer with peer_id %d\n",
  			    ts->peer_id);
-@@ -736,19 +784,36 @@ static inline void ath11k_dp_tx_status_p
+@@ -752,19 +798,36 @@ static inline void ath11k_dp_tx_status_p
  		ts->rate_stats = 0;
  }
  
@@ -342,7 +343,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
 +
 +	if (FIELD_GET(HAL_WBM_RELEASE_INFO0_REL_SRC_MODULE, desc->info0) ==
 +	    HAL_WBM_REL_SRC_MODULE_FW) {
-+		status_desc = ((u8 *)desc) + HTT_TX_WBM_COMP_STATUS_OFFSET;
++		status_desc = ((struct htt_tx_wbm_completion *)desc) + HTT_TX_WBM_COMP_STATUS_OFFSET;
 +
 +		/* Dont consider HTT_TX_COMP_STATUS_MEC_NOTIFY */
 +		if (FIELD_GET(HTT_TX_WBM_COMP_INFO0_STATUS, status_desc->info0) ==
@@ -371,7 +372,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  
  	spin_lock_bh(&status_ring->lock);
  
-@@ -763,33 +828,27 @@ void ath11k_dp_tx_completion_handler(str
+@@ -779,33 +842,27 @@ void ath11k_dp_tx_completion_handler(str
  
  	ath11k_hal_srng_dst_invalidate_entry(ab, status_ring, valid_entries);
  
@@ -384,7 +385,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
 -			ATH11K_TX_COMPL_NEXT(tx_ring->tx_status_head);
 -	}
 +	while ((desc = ath11k_hal_srng_dst_get_next_cache_entry(ab, status_ring))) {
-+		if (!ath11k_dp_tx_completion_valid(desc))
++		if (!ath11k_dp_tx_completion_valid((struct hal_wbm_release_ring *)desc))
 +			continue;
  
 -	if (unlikely((ath11k_hal_srng_dst_peek(ab, status_ring) != NULL) &&
@@ -419,7 +420,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		ath11k_dp_tx_status_parse(ab, tx_status, &ts);
  
  		desc_id = FIELD_GET(BUFFER_ADDR_INFO1_SW_COOKIE,
-@@ -822,7 +881,6 @@ void ath11k_dp_tx_completion_handler(str
+@@ -838,7 +895,6 @@ void ath11k_dp_tx_completion_handler(str
  			wake_up(&ar->dp.tx_empty_waitq);
  
  		ath11k_dp_tx_complete_msdu(ar, msdu, &ts);
@@ -429,7 +430,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -6723,12 +6723,22 @@ static void ath11k_mac_op_tx(struct ieee
+@@ -6669,12 +6669,22 @@ static void ath11k_mac_op_tx(struct ieee
  	if (control->sta)
  		arsta = ath11k_sta_to_arsta(control->sta);
  
@@ -453,7 +454,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		ieee80211_free_txskb(ar->hw, skb);
  		return;
  	}
-@@ -7690,7 +7700,7 @@ err_vdev_del:
+@@ -7622,7 +7632,7 @@ err_vdev_del:
  	idr_for_each(&ar->txmgmt_idr,
  		     ath11k_mac_vif_txmgmt_idr_remove, vif);
  
@@ -464,7 +465,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  			     ath11k_mac_vif_unref, vif);
 --- a/drivers/net/wireless/ath/ath11k/debugfs.c
 +++ b/drivers/net/wireless/ath/ath11k/debugfs.c
-@@ -833,10 +833,22 @@ static ssize_t ath11k_debugfs_dump_soc_d
+@@ -832,10 +832,22 @@ static ssize_t ath11k_debugfs_dump_soc_d
  		len += scnprintf(buf + len, size - len, "ring%d: %u\n",
  				 i, soc_stats->tx_err.desc_na[i]);
  
@@ -489,7 +490,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	if (len > size)
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
-@@ -192,7 +192,6 @@ static struct ath11k_hw_params ath11k_hw
+@@ -188,7 +188,6 @@ static struct ath11k_hw_params ath11k_hw
  		.supports_regdb = false,
  		.fix_l1ss = true,
  		.credit_flow = false,
@@ -497,7 +498,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		.hal_params = &ath11k_hw_hal_params_ipq8074,
  		.supports_dynamic_smps_6ghz = false,
  		.alloc_cacheable_memory = true,
-@@ -217,6 +216,8 @@ static struct ath11k_hw_params ath11k_hw
+@@ -213,6 +212,8 @@ static struct ath11k_hw_params ath11k_hw
  		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
  		.smp2p_wow_exit = false,
  		.support_fw_mac_sequence = false,
@@ -506,7 +507,15 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	},
  	{
  		.name = "qca6390 hw2.0",
-@@ -384,6 +384,8 @@ static struct ath11k_hw_params ath11k_hw
+@@ -355,7 +356,6 @@ static struct ath11k_hw_params ath11k_hw
+ 		.supports_regdb = false,
+ 		.fix_l1ss = true,
+ 		.credit_flow = false,
+-		.max_tx_ring = DP_TCL_NUM_RING_MAX,
+ 		.hal_params = &ath11k_hw_hal_params_ipq8074,
+ 		.supports_dynamic_smps_6ghz = true,
+ 		.alloc_cacheable_memory = true,
+@@ -380,6 +380,8 @@ static struct ath11k_hw_params ath11k_hw
  		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
  		.smp2p_wow_exit = false,
  		.support_fw_mac_sequence = false,
@@ -515,9 +524,9 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	},
  	{
  		.name = "wcn6855 hw2.0",
-@@ -2147,6 +2149,9 @@ int ath11k_core_pre_init(struct ath11k_b
- 
- 	ab->enable_memory_stats = ATH11K_DEBUG_ENABLE_MEMORY_STATS;
+@@ -2143,6 +2145,9 @@ int ath11k_core_pre_init(struct ath11k_b
+ 	if (nss_offload)
+ 		ab->nss.stats_enabled = 1;
  
 +	if (ab->nss.enabled && ab->hw_params.max_tx_ring > DP_TCL_NUM_RING_MAX)
 +		ab->hw_params.max_tx_ring = DP_TCL_NUM_RING_MAX;
@@ -570,7 +579,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		FIELD_PREP(HAL_TCL_DATA_CMD_INFO0_DESC_TYPE, ti->type) |
  		FIELD_PREP(HAL_TCL_DATA_CMD_INFO0_ENCAP_TYPE, ti->encap_type) |
  		FIELD_PREP(HAL_TCL_DATA_CMD_INFO0_ENCRYPT_TYPE,
-@@ -60,23 +60,25 @@ void ath11k_hal_tx_cmd_desc_setup(struct
+@@ -60,24 +60,26 @@ void ath11k_hal_tx_cmd_desc_setup(struct
  		FIELD_PREP(HAL_TCL_DATA_CMD_INFO0_CMD_NUM,
  			   ti->meta_data_flags);
  
@@ -581,6 +590,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  
 -	tcl_cmd->info2 = ti->flags1 |
 +	tcl_cmd.info2 = ti->flags1 |
+ 		FIELD_PREP(HAL_TCL_DATA_CMD_INFO2_TID, ti->tid) |
  		FIELD_PREP(HAL_TCL_DATA_CMD_INFO2_LMAC_ID, ti->lmac_id);
  
 -	tcl_cmd->info3 = FIELD_PREP(HAL_TCL_DATA_CMD_INFO3_DSCP_TID_TABLE_IDX,
@@ -601,7 +611,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  }
  
  void ath11k_hal_tx_set_dscp_tid_map(struct ath11k_base *ab, int id)
-@@ -136,7 +138,9 @@ void ath11k_hal_tx_set_dscp_tid_map(stru
+@@ -137,7 +139,9 @@ void ath11k_hal_tx_set_dscp_tid_map(stru
  			   ctrl_reg_val);
  }
  
@@ -612,7 +622,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  {
  	struct hal_srng_params params;
  	struct hal_tlv_hdr *tlv;
-@@ -145,7 +149,7 @@ void ath11k_hal_tx_init_data_ring(struct
+@@ -146,7 +150,7 @@ void ath11k_hal_tx_init_data_ring(struct
  
  	memset(&params, 0, sizeof(params));
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/270-iphone-issue.patch b/package/kernel/mac80211/patches/nss/ath11k/270-iphone-issue.patch
new file mode 100644
index 00000000000000..4260d0e5337451
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/270-iphone-issue.patch
@@ -0,0 +1,11 @@
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -6267,6 +6267,8 @@ static int ath11k_mac_copy_he_cap(struct
+ 		memcpy(he_cap_elem->phy_cap_info, band_cap->he_cap_phy_info,
+ 		       sizeof(he_cap_elem->phy_cap_info));
+ 
++		he_cap_elem->mac_cap_info[0] &= ~IEEE80211_HE_MAC_CAP0_HTC_HE;
++
+ 		he_cap_elem->mac_cap_info[1] &=
+ 			IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_MASK;
+ 
diff --git a/package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch b/package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch
new file mode 100644
index 00000000000000..b31809f689548b
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch
@@ -0,0 +1,3365 @@
+From fbe5a76d8c9ff1cf3f906a3c863928fc1adcbc95 Mon Sep 17 00:00:00 2001
+From: Karthikeyan Kathirvel <kathirve@codeaurora.org>
+Date: Tue, 16 Feb 2021 13:44:39 +0530
+Subject: [PATCH] ath11k: Add mesh nss offload support
+
+- New capability advertising nss offload support for mesh type
+- Mesh obj vap and link vap registration/clean up
+- Command/event handling
+- New .ch files in ath11k for nss mesh offload related debugs
+- Tx/Rx data path on mesh link vap uses native wifi format
+- Mesh obj vap handls packets in ether format. No Tx on Mesh
+  obj vap is expected as packets transmitted in slow path is
+  supposed to be encapsulated in 802.11 format.
+- New mac80211-driver callbacks for mesh vap, mpath and mpp
+  configurations.
+
+Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
+
+Change-Id: Ib6950344286ba18fab43586262c62dcd09557614
+Co-developed-by: Karthikeyan Kathirvel <kathirve@codeaurora.org>
+Signed-off-by: Karthikeyan Kathirvel <kathirve@codeaurora.org>
+Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/Makefile    |    2 +-
+ drivers/net/wireless/ath/ath11k/debug_nss.c |  343 +++++++
+ drivers/net/wireless/ath/ath11k/debug_nss.h |   24 +
+ drivers/net/wireless/ath/ath11k/dp.h        |   16 +-
+ drivers/net/wireless/ath/ath11k/dp_rx.c     |  170 ++-
+ drivers/net/wireless/ath/ath11k/dp_rx.h     |    2 +
+ drivers/net/wireless/ath/ath11k/mac.c       |   36 +-
+ drivers/net/wireless/ath/ath11k/nss.c       | 1482 ++++++++++++++++++++++++---
+ drivers/net/wireless/ath/ath11k/nss.h       |   63 +-
+ 19 files changed, 2548 insertions(+), 206 deletions(-)
+ create mode 100644 drivers/net/wireless/ath/ath11k/debug_nss.c
+ create mode 100644 drivers/net/wireless/ath/ath11k/debug_nss.h
+
+--- a/drivers/net/wireless/ath/ath11k/Makefile
++++ b/drivers/net/wireless/ath/ath11k/Makefile
+@@ -27,6 +27,10 @@ ath11k-$(CPTCFG_ATH11K_SPECTRAL) += spec
+ ath11k-$(CONFIG_PM) += wow.o
+ ath11k-$(CPTCFG_ATH11K_NSS_SUPPORT) += nss.o
+ 
++ifeq ($(and $(CPTCFG_ATH11K_DEBUGFS),$(CPTCFG_ATH11K_NSS_MESH_SUPPORT)),y)
++ath11k-y += debug_nss.o
++endif
++
+ obj-$(CPTCFG_ATH11K_AHB) += ath11k_ahb.o
+ ath11k_ahb-y += ahb.o
+ 
+--- /dev/null
++++ b/drivers/net/wireless/ath/ath11k/debug_nss.c
+@@ -0,0 +1,924 @@
++// SPDX-License-Identifier: BSD-3-Clause-Clear
++/*
++ * Copyright (c) 2020 The Linux Foundation. All rights reserved.
++ */
++
++#ifdef CPTCFG_ATH11K_NSS_SUPPORT
++
++#include <net/mac80211.h>
++#include "dp_rx.h"
++#include "nss.h"
++#include "debug.h"
++#include "debug_nss.h"
++
++static unsigned int
++debug_nss_fill_mpp_dump(struct ath11k_vif *arvif, char *buf, ssize_t size)
++{
++	struct arvif_nss *nss = &arvif->nss;
++	struct ath11k *ar = arvif->ar;
++	struct ath11k_nss_mpp_entry *entry, *tmp;
++	LIST_HEAD(local_entry);
++	unsigned int len = 0;
++	int i;
++
++	len += scnprintf(buf + len, size - len, "\nProxy path table\n");
++	len += scnprintf(buf + len, size - len, "dest_mac_addr\t\tmesh_dest_mac\t\tflags\n");
++	spin_lock_bh(&ar->nss.dump_lock);
++	list_splice_tail_init(&nss->mpp_dump, &local_entry);
++	spin_unlock_bh(&ar->nss.dump_lock);
++
++	list_for_each_entry_safe(entry, tmp, &local_entry, list) {
++		for (i = 0; i < entry->num_entries; i++)
++			len += scnprintf(buf + len, size - len, "%pM\t%pM\t0x%x\n",
++					 entry->mpp[i].dest_mac_addr,
++					 entry->mpp[i].mesh_dest_mac, entry->mpp[i].flags);
++		list_del(&entry->list);
++		kfree(entry);
++	}
++
++	return len;
++}
++
++static int ath11k_nss_dump_mpp_open(struct inode *inode, struct file *file)
++{
++	struct ath11k_vif *arvif = inode->i_private;
++	struct ath11k *ar = arvif->ar;
++	unsigned long time_left;
++	struct ath11k_nss_dbg_priv_data *priv_data;
++	int ret;
++	ssize_t size = 100;
++	char *buf;
++
++	mutex_lock(&ar->conf_mutex);
++
++	reinit_completion(&arvif->nss.dump_mpp_complete);
++
++	priv_data = kzalloc(sizeof(*priv_data), GFP_KERNEL);
++	if (!priv_data) {
++		mutex_unlock(&ar->conf_mutex);
++		return -ENOMEM;
++	}
++
++	priv_data->arvif = arvif;
++	ret = ath11k_nss_dump_mpp_request(arvif);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to send dump mpp command %d\n", ret);
++		goto err_unlock;
++	}
++
++	time_left = wait_for_completion_timeout(&arvif->nss.dump_mpp_complete,
++						ATH11K_NSS_MPATH_DUMP_TIMEOUT);
++	if (time_left == 0) {
++		ret = -ETIMEDOUT;
++		goto err_unlock;
++	}
++
++	mutex_unlock(&ar->conf_mutex);
++
++	size += (arvif->nss.mpp_dump_num_entries * 200 + 10 * 100);
++	buf = kmalloc(size, GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
++
++	priv_data->buf = buf;
++
++	priv_data->len= debug_nss_fill_mpp_dump(arvif, buf, size);
++
++	file->private_data = priv_data;
++
++	return 0;
++
++err_unlock:
++	kfree(priv_data);
++	mutex_unlock(&ar->conf_mutex);
++	return ret;
++}
++
++static int ath11k_nss_dump_mpp_release(struct inode *inode, struct file *file)
++{
++	struct ath11k_nss_dbg_priv_data *priv_data = file->private_data;
++
++	kfree(priv_data->buf);
++	kfree(priv_data);
++	return 0;
++}
++
++static ssize_t ath11k_nss_dump_mpp_read(struct file *file,
++					char __user *user_buf,
++					size_t count, loff_t *ppos)
++{
++	struct ath11k_nss_dbg_priv_data *priv_data = file->private_data;
++	struct ath11k_vif *arvif = priv_data->arvif;
++	char *buf = priv_data->buf;
++	struct ath11k *ar = arvif->ar;
++	int ret;
++
++	mutex_lock(&ar->conf_mutex);
++
++	ret = simple_read_from_buffer(user_buf, count, ppos, buf, priv_data->len);
++
++	mutex_unlock(&ar->conf_mutex);
++
++	return ret;
++}
++
++static const struct file_operations fops_nss_dump_mpp_table = {
++	.open = ath11k_nss_dump_mpp_open,
++	.read = ath11k_nss_dump_mpp_read,
++	.release = ath11k_nss_dump_mpp_release,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++};
++
++static unsigned int
++debug_nss_fill_mpath_dump(struct ath11k_vif *arvif, char *buf, ssize_t size)
++{
++	struct arvif_nss *nss = &arvif->nss;
++	struct ath11k *ar = arvif->ar;
++	struct ath11k_nss_mpath_entry *entry, *tmp;
++	LIST_HEAD(local_entry);
++	unsigned int len = 0;
++	u64 expiry_time;
++	int i;
++
++	len += scnprintf(buf + len, size - len, "\nmpath table\n");
++	len += scnprintf(buf + len, size - len, "dest_mac_addr\t\tnext_hop_mac\t\tmetric\t"
++			"expiry_time\thop_count\tflags\tlink_vap_id\n");
++
++	spin_lock_bh(&ar->nss.dump_lock);
++	list_splice_tail_init(&nss->mpath_dump, &local_entry);
++	spin_unlock_bh(&ar->nss.dump_lock);
++
++	list_for_each_entry_safe(entry, tmp, &local_entry, list) {
++		for (i = 0; i < entry->num_entries; i++) {
++			memcpy(&expiry_time, entry->mpath[i].expiry_time, sizeof(u64));
++			len += scnprintf(buf + len, size - len, "%pM\t%pM\t%u\t%llu\t\t\t%d\t0x%x\t%d\n",
++					 entry->mpath[i].dest_mac_addr,
++					 entry->mpath[i].next_hop_mac_addr, entry->mpath[i].metric,
++					 expiry_time, entry->mpath[i].hop_count,
++					 entry->mpath[i].flags, entry->mpath[i].link_vap_id);
++		}
++		kfree(entry);
++	}
++
++	return len;
++}
++
++static int ath11k_nss_dump_mpath_open(struct inode *inode, struct file *file)
++{
++	struct ath11k_vif *arvif = inode->i_private;
++	struct ath11k *ar = arvif->ar;
++	unsigned long time_left;
++	struct ath11k_nss_dbg_priv_data *priv_data;
++	ssize_t size = 200;
++	char *buf;
++	int ret;
++
++	reinit_completion(&arvif->nss.dump_mpath_complete);
++
++	priv_data = kzalloc(sizeof(*priv_data), GFP_KERNEL);
++	if (!priv_data)
++		return -ENOMEM;
++
++	mutex_lock(&ar->conf_mutex);
++
++	priv_data->arvif = arvif;
++	ret = ath11k_nss_dump_mpath_request(arvif);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to send dump mpath command %d\n", ret);
++		goto err_unlock;
++	}
++
++	time_left = wait_for_completion_timeout(&arvif->nss.dump_mpath_complete,
++						ATH11K_NSS_MPATH_DUMP_TIMEOUT);
++	if (time_left == 0) {
++		ret = -ETIMEDOUT;
++		goto err_unlock;
++	}
++
++	mutex_unlock(&ar->conf_mutex);
++
++	size += (arvif->nss.mpath_dump_num_entries * 200 + 10 * 100);
++	buf = kmalloc(size, GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
++
++	priv_data->buf = buf;
++
++	priv_data->len = debug_nss_fill_mpath_dump(arvif, buf, size);
++
++	file->private_data = priv_data;
++
++	return 0;
++
++err_unlock:
++	mutex_unlock(&ar->conf_mutex);
++	return ret;
++}
++
++static int ath11k_nss_dump_mpath_release(struct inode *inode, struct file *file)
++{
++	struct ath11k_nss_dbg_priv_data *priv_data = file->private_data;
++
++	kfree(priv_data->buf);
++	kfree(priv_data);
++	return 0;
++
++}
++
++static ssize_t ath11k_nss_dump_mpath_read(struct file *file,
++					  char __user *user_buf,
++					  size_t count, loff_t *ppos)
++{
++	struct ath11k_nss_dbg_priv_data *priv_data = file->private_data;
++	struct ath11k_vif *arvif = priv_data->arvif;
++	char *buf = priv_data->buf;
++	struct ath11k *ar = arvif->ar;
++	int ret;
++
++	mutex_lock(&ar->conf_mutex);
++
++	ret = simple_read_from_buffer(user_buf, count, ppos, buf, priv_data->len);
++
++	mutex_unlock(&ar->conf_mutex);
++
++	return ret;
++}
++
++static const struct file_operations fops_nss_dump_mpath_table = {
++	.open = ath11k_nss_dump_mpath_open,
++	.read = ath11k_nss_dump_mpath_read,
++	.release = ath11k_nss_dump_mpath_release,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++};
++
++static ssize_t ath11k_nss_mpath_add(struct file *file,
++				     const char __user *user_buf,
++				     size_t count, loff_t *ppos)
++{
++	struct ath11k_vif *arvif = file->private_data;
++	struct ieee80211_mesh_path_offld path = {0};
++	u8 buf[128] = {0};
++	int ret;
++
++	ret = simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count);
++	if (ret < 0)
++		return ret;
++
++	buf[ret] = '\0';
++	ret = sscanf(buf, "%u %hhu %02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx %02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx %hhu %hhu",
++			&path.metric,
++			&path.hop_count,
++			&path.mesh_da[0],
++			&path.mesh_da[1],
++			&path.mesh_da[2],
++			&path.mesh_da[3],
++			&path.mesh_da[4],
++			&path.mesh_da[5],
++			&path.next_hop[0],
++			&path.next_hop[1],
++			&path.next_hop[2],
++			&path.next_hop[3],
++			&path.next_hop[4],
++			&path.next_hop[5],
++			&path.block_mesh_fwd,
++			&path.metadata_type);
++
++
++	path.flags |= IEEE80211_MESH_PATH_ACTIVE | IEEE80211_MESH_PATH_RESOLVED;
++
++	if (ret != 16)
++		return -EINVAL;
++
++	/* Configure the mpath */
++	ret = ath11k_nss_mesh_config_path(arvif->ar, arvif,
++			IEEE80211_MESH_PATH_OFFLD_CMD_ADD_MPATH,
++			&path);
++	if(ret) {
++		ath11k_warn(arvif->ar->ab, "failed to configure mpath ret %d\n", ret);
++		return -EINVAL;
++	}
++
++	return ret ? ret : count;
++
++}
++
++static const struct file_operations fops_nss_mpath_add = {
++	.open = simple_open,
++	.write = ath11k_nss_mpath_add,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++};
++
++static ssize_t ath11k_nss_mpp_add(struct file *file,
++				   const char __user *user_buf,
++				   size_t count, loff_t *ppos)
++{
++	struct ath11k_vif *arvif = file->private_data;
++	struct ieee80211_mesh_path_offld path = {0};
++	u8 buf[128] = {0};
++	int ret;
++
++	if (!arvif->ar->ab->nss.debug_mode) {
++		ret = -EPERM;
++		return ret;
++	}
++
++	ret = simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count);
++	if (ret < 0)
++		return ret;
++
++	buf[ret] = '\0';
++	ret = sscanf(buf, "%02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx %02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx",
++			&path.da[0],
++			&path.da[1],
++			&path.da[2],
++			&path.da[3],
++			&path.da[4],
++			&path.da[5],
++			&path.mesh_da[0],
++			&path.mesh_da[1],
++			&path.mesh_da[2],
++			&path.mesh_da[3],
++			&path.mesh_da[4],
++			&path.mesh_da[5]);
++
++	path.flags |= IEEE80211_MESH_PATH_ACTIVE | IEEE80211_MESH_PATH_RESOLVED;
++
++	if (ret != 12)
++		return -EINVAL;
++
++	/* Configure the mpp */
++	ret = ath11k_nss_mesh_config_path(arvif->ar, arvif,
++			IEEE80211_MESH_PATH_OFFLD_CMD_ADD_MPP,
++			&path);
++	if(ret) {
++		ath11k_warn(arvif->ar->ab, "failed to configure mpp ret %d\n", ret);
++		return -EINVAL;
++	}
++
++	return ret ? ret : count;
++
++}
++
++static const struct file_operations fops_nss_mpp_add = {
++	.open = simple_open,
++	.write = ath11k_nss_mpp_add,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++};
++
++static ssize_t ath11k_nss_mpath_update(struct file *file,
++					const char __user *user_buf,
++					size_t count, loff_t *ppos)
++{
++	struct ath11k_vif *arvif = file->private_data;
++	struct ieee80211_mesh_path_offld path = {0};
++	u8 buf[128] = {0};
++	int ret;
++
++	ret = simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count);
++	if (ret < 0)
++		return ret;
++
++	buf[ret] = '\0';
++	ret = sscanf(buf, "%u %hhu %02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx %02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx %02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx %hhu %lu %hhu %hhu",
++			&path.metric,
++			&path.hop_count,
++			&path.mesh_da[0],
++			&path.mesh_da[1],
++			&path.mesh_da[2],
++			&path.mesh_da[3],
++			&path.mesh_da[4],
++			&path.mesh_da[5],
++			&path.next_hop[0],
++			&path.next_hop[1],
++			&path.next_hop[2],
++			&path.next_hop[3],
++			&path.next_hop[4],
++			&path.next_hop[5],
++			&path.old_next_hop[0],
++			&path.old_next_hop[1],
++			&path.old_next_hop[2],
++			&path.old_next_hop[3],
++			&path.old_next_hop[4],
++			&path.old_next_hop[5],
++			&path.mesh_gate,
++			&path.exp_time,
++			&path.block_mesh_fwd,
++			&path.metadata_type);
++
++
++	path.flags |= IEEE80211_MESH_PATH_ACTIVE | IEEE80211_MESH_PATH_RESOLVED;
++
++	if (ret != 24)
++		return -EINVAL;
++
++	/* Configure the mpath */
++	ret = ath11k_nss_mesh_config_path(arvif->ar, arvif,
++			IEEE80211_MESH_PATH_OFFLD_CMD_UPDATE_MPATH,
++			&path);
++	if(ret) {
++		ath11k_warn(arvif->ar->ab, "failed to configure mpath ret %d\n", ret);
++		return -EINVAL;
++	}
++
++	return ret ? ret : count;
++
++}
++
++static const struct file_operations fops_nss_mpath_update = {
++	.open = simple_open,
++	.write = ath11k_nss_mpath_update,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++};
++
++static ssize_t ath11k_nss_mpp_update(struct file *file,
++					const char __user *user_buf,
++					size_t count, loff_t *ppos)
++{
++	struct ath11k_vif *arvif = file->private_data;
++	struct ieee80211_mesh_path_offld path = {0};
++	u8 buf[128] = {0};
++	int ret;
++
++	if (!arvif->ar->ab->nss.debug_mode) {
++		ret = -EPERM;
++		return ret;
++	}
++
++	ret = simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count);
++	if (ret < 0)
++		return ret;
++
++	buf[ret] = '\0';
++	ret = sscanf(buf, "%02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx %02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx",
++			&path.da[0],
++			&path.da[1],
++			&path.da[2],
++			&path.da[3],
++			&path.da[4],
++			&path.da[5],
++			&path.mesh_da[0],
++			&path.mesh_da[1],
++			&path.mesh_da[2],
++			&path.mesh_da[3],
++			&path.mesh_da[4],
++			&path.mesh_da[5]);
++
++	path.flags |= IEEE80211_MESH_PATH_ACTIVE | IEEE80211_MESH_PATH_RESOLVED;
++
++	if (ret != 12)
++		return -EINVAL;
++
++	/* Configure the mpp */
++	ret = ath11k_nss_mesh_config_path(arvif->ar, arvif,
++			IEEE80211_MESH_PATH_OFFLD_CMD_UPDATE_MPP,
++			&path);
++	if(ret) {
++		ath11k_warn(arvif->ar->ab, "failed to configure mpp ret %d\n", ret);
++		return -EINVAL;
++	}
++
++	return ret ? ret : count;
++
++}
++
++static const struct file_operations fops_nss_mpp_update = {
++	.open = simple_open,
++	.write = ath11k_nss_mpp_update,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++};
++
++
++static ssize_t ath11k_nss_mpath_delete(struct file *file,
++					const char __user *user_buf,
++					size_t count, loff_t *ppos)
++{
++	struct ath11k_vif *arvif = file->private_data;
++	struct ieee80211_mesh_path_offld path = {0};
++	u8 buf[128] = {0};
++	int ret;
++
++	if (!arvif->ar->ab->nss.debug_mode) {
++		ret = -EPERM;
++		return ret;
++	}
++
++	ret = simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count);
++	if (ret < 0)
++		return ret;
++
++	buf[ret] = '\0';
++	ret = sscanf(buf, "%02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx %02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx",
++			&path.mesh_da[0],
++			&path.mesh_da[1],
++			&path.mesh_da[2],
++			&path.mesh_da[3],
++			&path.mesh_da[4],
++			&path.mesh_da[5],
++			&path.next_hop[0],
++			&path.next_hop[1],
++			&path.next_hop[2],
++			&path.next_hop[3],
++			&path.next_hop[4],
++			&path.next_hop[5]);
++
++	path.flags |= IEEE80211_MESH_PATH_DELETED;
++
++	if (ret != 12)
++		return -EINVAL;
++
++	/* Configure the mpath */
++	ret = ath11k_nss_mesh_config_path(arvif->ar, arvif,
++			IEEE80211_MESH_PATH_OFFLD_CMD_DELETE_MPATH,
++			&path);
++	if(ret) {
++		ath11k_warn(arvif->ar->ab, "failed to configure mpath ret %d\n", ret);
++		return -EINVAL;
++	}
++
++	return ret ? ret : count;
++
++}
++
++static const struct file_operations fops_nss_mpath_del = {
++	.open = simple_open,
++	.write = ath11k_nss_mpath_delete,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++};
++
++static ssize_t ath11k_nss_mpp_delete(struct file *file,
++					const char __user *user_buf,
++					size_t count, loff_t *ppos)
++{
++	struct ath11k_vif *arvif = file->private_data;
++	struct ieee80211_mesh_path_offld path = {0};
++	u8 buf[128] = {0};
++	int ret;
++
++	if (!arvif->ar->ab->nss.debug_mode) {
++		ret = -EPERM;
++		return ret;
++	}
++
++	ret = simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count);
++	if (ret < 0)
++		return ret;
++
++	buf[ret] = '\0';
++	ret = sscanf(buf, "%02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx %02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx",
++			&path.da[0],
++			&path.da[1],
++			&path.da[2],
++			&path.da[3],
++			&path.da[4],
++			&path.da[5],
++			&path.mesh_da[0],
++			&path.mesh_da[1],
++			&path.mesh_da[2],
++			&path.mesh_da[3],
++			&path.mesh_da[4],
++			&path.mesh_da[5]);
++
++	path.flags |= IEEE80211_MESH_PATH_DELETED;
++
++	if (ret != 12)
++		return -EINVAL;
++
++	/* Configure the mpp */
++	ret = ath11k_nss_mesh_config_path(arvif->ar, arvif,
++			IEEE80211_MESH_PATH_OFFLD_CMD_DELETE_MPP,
++			&path);
++	if(ret) {
++		ath11k_warn(arvif->ar->ab, "failed to configure mpp ret %d\n", ret);
++		return -EINVAL;
++	}
++
++	return ret ? ret : count;
++
++}
++
++static const struct file_operations fops_nss_mpp_del = {
++	.open = simple_open,
++	.write = ath11k_nss_mpp_delete,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++};
++
++
++static ssize_t ath11k_nss_assoc_link(struct file *file,
++				     const char __user *user_buf,
++				     size_t count, loff_t *ppos)
++{
++	struct ath11k_vif *arvif = file->private_data;
++	u8 buf[128] = {0};
++	int ret;
++	u32 assoc_link = 0;
++
++	ret = simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count);
++	if (ret < 0)
++		return ret;
++
++	buf[ret] = '\0';
++	ret = sscanf(buf, "%u", &assoc_link);
++
++	if (ret != 1)
++		return -EINVAL;
++
++	arvif->ar->ab->nss.debug_mode = true;
++	arvif->vif->driver_flags |= IEEE80211_VIF_NSS_OFFLOAD_DEBUG_MODE;
++
++	ret = ath11k_nss_assoc_link_arvif_to_ifnum(arvif, assoc_link);
++
++	return ret ? ret : count;
++
++}
++
++static const struct file_operations fops_nss_assoc_link = {
++	.open = simple_open,
++	.write = ath11k_nss_assoc_link,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++};
++
++static ssize_t ath11k_nss_links(struct file *file,
++				  char __user *user_buf,
++				  size_t count, loff_t *ppos)
++{
++	char buf[512] = {0};
++	struct arvif_nss *nss;
++	int len = 0;
++
++	list_for_each_entry(nss, &mesh_vaps, list)
++		len += scnprintf(buf + len, sizeof(buf) - len, "link id %d\n",
++				nss->if_num);
++
++	return simple_read_from_buffer(user_buf, count, ppos, buf, len);
++}
++
++static const struct file_operations fops_nss_links = {
++	.open = simple_open,
++	.read = ath11k_nss_links,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++};
++
++static ssize_t ath11k_nss_vap_link_id(struct file *file,
++				  char __user *user_buf,
++				  size_t count, loff_t *ppos)
++{
++	struct ath11k_vif *arvif = file->private_data;
++	struct arvif_nss *nss = &arvif->nss;
++	char buf[512] = {0};
++	int len = 0;
++
++	len = scnprintf(buf, sizeof(buf) - len, "link id %d\n",
++			nss->if_num);
++
++	return simple_read_from_buffer(user_buf, count, ppos, buf, len);
++}
++
++static const struct file_operations fops_nss_vap_link_id = {
++	.open = simple_open,
++	.read = ath11k_nss_vap_link_id,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++};
++
++static ssize_t ath11k_nss_read_mpp_mode(struct file *file,
++				  char __user *user_buf,
++				  size_t count, loff_t *ppos)
++{
++	char buf[512] = {0};
++	int len = 0;
++
++	len = scnprintf(buf, sizeof(buf) - len, "%s\n",mpp_mode ?
++			"Host Assisted Learning" : "NSS Independent Learning");
++
++	return simple_read_from_buffer(user_buf, count, ppos, buf, len);
++}
++
++static ssize_t ath11k_nss_write_mpp_mode(struct file *file,
++				  const char __user *user_buf,
++				  size_t count, loff_t *ppos)
++{
++	u8 buf[128] = {0};
++	int ret;
++	u32 mppath_mode = 0;
++
++	ret = simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count);
++	if (ret < 0)
++		return ret;
++
++	buf[ret] = '\0';
++	ret = sscanf(buf, "%u", &mppath_mode);
++
++	if (ret != 1)
++		return -EINVAL;
++
++	mpp_mode = mppath_mode;
++
++	ret = 0;
++
++	return ret ? ret : count;
++}
++
++static const struct file_operations fops_nss_mpp_mode = {
++	.open = simple_open,
++	.write = ath11k_nss_write_mpp_mode,
++	.read = ath11k_nss_read_mpp_mode,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++};
++
++static ssize_t ath11k_nss_write_excep_flags(struct file *file,
++				  const char __user *user_buf,
++				  size_t count, loff_t *ppos)
++{
++	struct ath11k_vif *arvif = file->private_data;
++	u8 buf[128] = {0};
++	int ret;
++	struct nss_wifi_mesh_exception_flag_msg msg;
++
++	ret = simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count);
++	if (ret < 0)
++		return ret;
++
++	buf[ret] = '\0';
++
++	ret = sscanf(buf, "%02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx %hhu",
++			&msg.dest_mac_addr[0],
++			&msg.dest_mac_addr[1],
++			&msg.dest_mac_addr[2],
++			&msg.dest_mac_addr[3],
++			&msg.dest_mac_addr[4],
++			&msg.dest_mac_addr[5],
++			&msg.exception);
++
++	if (ret != 7)
++		return -EINVAL;
++
++	ret = ath11k_nss_mesh_exception_flags(arvif, &msg);
++
++	return ret ? ret : count;
++}
++
++static const struct file_operations fops_nss_excep_flags = {
++	.open = simple_open,
++	.write = ath11k_nss_write_excep_flags,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++};
++
++static ssize_t ath11k_nss_write_metadata_type(struct file *file,
++				  const char __user *user_buf,
++				  size_t count, loff_t *ppos)
++{
++	struct ath11k_vif *arvif = file->private_data;
++	struct ath11k *ar = arvif->ar;
++	u8 buf[128] = {0};
++	int ret;
++	u8 pkt_type;
++
++	ret = simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count);
++	if (ret < 0)
++		return ret;
++
++	buf[ret] = '\0';
++
++	ret = sscanf(buf, "%hhu", &pkt_type);
++	mutex_lock(&ar->conf_mutex);
++	arvif->nss.metadata_type = pkt_type ? NSS_WIFI_MESH_PRE_HEADER_80211 : NSS_WIFI_MESH_PRE_HEADER_NONE;
++	mutex_unlock(&ar->conf_mutex);
++
++	if (ret != 1)
++		return -EINVAL;
++
++	ret = 0;
++
++	return ret ? ret : count;
++}
++
++static const struct file_operations fops_nss_metadata_type = {
++	.open = simple_open,
++	.write = ath11k_nss_write_metadata_type,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++};
++
++static ssize_t ath11k_nss_write_exc_rate_limit(struct file *file,
++				  const char __user *user_buf,
++				  size_t count, loff_t *ppos)
++{
++	struct ath11k_vif *arvif = file->private_data;
++	u8 buf[128] = {0};
++	int ret;
++	struct nss_wifi_mesh_rate_limit_config nss_exc_cfg;
++
++	ret = simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count);
++	if (ret < 0)
++		return ret;
++
++	buf[ret] = '\0';
++
++	ret = sscanf(buf, "%u %u %u",
++			&nss_exc_cfg.exception_num,
++			&nss_exc_cfg.enable,
++			&nss_exc_cfg.rate_limit);
++
++	if (ret != 3)
++		return -EINVAL;
++
++	ret = ath11k_nss_exc_rate_config(arvif, &nss_exc_cfg);
++
++	return ret ? ret : count;
++}
++
++static const struct file_operations fops_nss_exc_rate_limit = {
++	.open = simple_open,
++	.write = ath11k_nss_write_exc_rate_limit,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++};
++
++void ath11k_debugfs_nss_mesh_vap_create(struct ath11k_vif *arvif)
++{
++	struct dentry *debugfs_nss_mesh_dir, *debugfs_dbg_infra;
++
++	debugfs_nss_mesh_dir = debugfs_create_dir("nss_mesh", arvif->vif->debugfs_dir);
++	debugfs_dbg_infra = debugfs_create_dir("dbg_infra", debugfs_nss_mesh_dir);
++
++	debugfs_create_file("dump_nss_mpath_table", 0600,
++			debugfs_nss_mesh_dir, arvif,
++			&fops_nss_dump_mpath_table);
++
++	debugfs_create_file("dump_nss_mpp_table", 0600,
++			debugfs_nss_mesh_dir, arvif,
++			&fops_nss_dump_mpp_table);
++
++	debugfs_create_file("mpath_add", 0200,
++			debugfs_dbg_infra, arvif,
++			&fops_nss_mpath_add);
++
++	debugfs_create_file("mpath_update", 0200,
++			debugfs_dbg_infra, arvif,
++			&fops_nss_mpath_update);
++
++	debugfs_create_file("mpath_del", 0200,
++			debugfs_dbg_infra, arvif,
++			&fops_nss_mpath_del);
++
++	debugfs_create_file("mpp_add", 0200,
++			debugfs_dbg_infra, arvif,
++			&fops_nss_mpp_add);
++
++	debugfs_create_file("mpp_update", 0200,
++			debugfs_dbg_infra, arvif,
++			&fops_nss_mpp_update);
++
++	debugfs_create_file("mpp_del", 0200,
++			debugfs_dbg_infra, arvif,
++			&fops_nss_mpp_del);
++
++	debugfs_create_file("assoc_link", 0200,
++			debugfs_dbg_infra, arvif,
++			&fops_nss_assoc_link);
++
++	debugfs_create_file("vap_linkid", 0200,
++			debugfs_dbg_infra, arvif,
++			&fops_nss_vap_link_id);
++
++	debugfs_create_file("excep_flags", 0200,
++			debugfs_dbg_infra, arvif,
++			&fops_nss_excep_flags);
++
++	debugfs_create_file("metadata_type", 0200,
++			debugfs_dbg_infra, arvif,
++			&fops_nss_metadata_type);
++
++	debugfs_create_file("exc_rate_limit", 0200,
++			debugfs_dbg_infra, arvif,
++			&fops_nss_exc_rate_limit);
++}
++
++void ath11k_debugfs_nss_soc_create(struct ath11k_base *ab)
++{
++	struct dentry *debugfs_dbg_infra;
++
++	debugfs_dbg_infra = debugfs_create_dir("dbg_infra", debugfs_ath11k);
++
++	debugfs_create_file("links", 0200,
++			debugfs_dbg_infra, ab,
++			&fops_nss_links);
++
++	debugfs_create_file("mpp_mode", 0600,
++			debugfs_dbg_infra, ab,
++			&fops_nss_mpp_mode);
++}
++
++#endif
+--- /dev/null
++++ b/drivers/net/wireless/ath/ath11k/debug_nss.h
+@@ -0,0 +1,35 @@
++/* SPDX-License-Identifier: BSD-3-Clause-Clear */
++/*
++ * Copyright (c) 2020 The Linux Foundation. All rights reserved.
++ */
++
++#ifndef ATH11K_DEBUG_NSS_H
++#define ATH11K_DEBUG_NSS_H
++
++#include <nss_api_if.h>
++#include <nss_cmn.h>
++
++#define ATH11K_NSS_MPATH_DUMP_TIMEOUT (2 * HZ)
++
++struct ath11k_vif;
++extern enum nss_wifi_mesh_mpp_learning_mode mpp_mode;
++extern struct list_head mesh_vaps;
++struct ath11k_nss_dbg_priv_data {
++	struct ath11k_vif *arvif;
++	char *buf;
++	unsigned int len;
++};
++
++#ifdef CPTCFG_MAC80211_DEBUGFS
++void ath11k_debugfs_nss_mesh_vap_create(struct ath11k_vif *arvif);
++void ath11k_debugfs_nss_soc_create(struct ath11k_base *ab);
++#else
++static inline void ath11k_debugfs_nss_mesh_vap_create(struct ath11k_vif *arvif)
++{
++}
++static inline void ath11k_debugfs_nss_soc_create(struct ath11k_base *ab)
++{
++}
++#endif
++
++#endif
+--- a/drivers/net/wireless/ath/ath11k/dp.h
++++ b/drivers/net/wireless/ath/ath11k/dp.h
+@@ -1453,15 +1453,29 @@ struct htt_ppdu_stats_usr_cmn_array {
+ 	struct htt_tx_ppdu_stats_info tx_ppdu_info[];
+ } __packed;
+ 
++#define HTT_PPDU_STATS_CMPLTN_FLUSH_INFO_FLOW_TYPE GENMASK(7, 0)
++#define HTT_PPDU_STATS_CMPLTN_FLUSH_INFO_NUM_MPDU GENMASK(16, 8)
++#define HTT_PPDU_STATS_CMPLTN_FLUSH_INFO_NUM_MSDU GENMASK(30, 17)
++
++struct htt_ppdu_stats_cmpltn_flush {
++	u32 drop_reason;
++	u32 info;
++	u8 tid_num;
++	u8 queue_type;
++	u16 sw_peer_id;
++} __packed;
++
+ struct htt_ppdu_user_stats {
+ 	u16 peer_id;
+ 	u16 delay_ba;
+ 	u32 tlv_flags;
+ 	bool is_valid_peer_id;
++	bool rate_stats_updated;
+ 	struct htt_ppdu_stats_user_rate rate;
+ 	struct htt_ppdu_stats_usr_cmpltn_cmn cmpltn_cmn;
+ 	struct htt_ppdu_stats_usr_cmpltn_ack_ba_status ack_ba;
+ 	struct htt_ppdu_stats_user_common common;
++	struct htt_ppdu_stats_cmpltn_flush cmpltn_flush;
+ };
+ 
+ #define HTT_PPDU_STATS_MAX_USERS	37
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -1409,6 +1409,71 @@ static int ath11k_htt_tlv_ppdu_stats_par
+ 	return 0;
+ }
+ 
++static void ath11k_dp_ppdu_stats_flush_tlv_parse(struct ath11k_base *ab,
++					  struct htt_ppdu_stats_cmpltn_flush *msg)
++{
++	struct ath11k *ar;
++	struct ieee80211_sta *sta;
++	struct ath11k_sta *arsta;
++	struct ath11k_peer *peer = NULL;
++	struct ieee80211_tx_status status;
++	struct ieee80211_rate_status status_rate = { 0 };
++
++	if (!ab->nss.mesh_nss_offload_enabled)
++		return;
++
++	rcu_read_lock();
++
++	spin_lock_bh(&ab->base_lock);
++	peer = ath11k_peer_find_by_id(ab, msg->sw_peer_id);
++	if (!peer)
++		goto exit;
++
++	if (peer->vif->type != NL80211_IFTYPE_MESH_POINT)
++		goto exit;
++
++	if (ether_addr_equal(peer->addr, peer->vif->addr))
++		goto exit;
++
++	sta = peer->sta;
++	arsta = (struct ath11k_sta *)sta->drv_priv;
++
++	memset(&status, 0, sizeof(status));
++
++	status.sta = sta;
++	status_rate.rate_idx = arsta->last_txrate;
++
++	status.rates = &status_rate;
++	status.mpdu_fail = FIELD_GET(HTT_PPDU_STATS_CMPLTN_FLUSH_INFO_NUM_MPDU,
++				     msg->info);
++	ar = arsta->arvif->ar;
++	ieee80211s_update_metric_ppdu(ar->hw, &status);
++
++exit:
++	spin_unlock_bh(&ab->base_lock);
++	rcu_read_unlock();
++}
++
++static int ath11k_htt_tlv_ppdu_soc_stats_parse(struct ath11k_base *ab,
++					       u16 tag, u16 len, const void *ptr,
++					       void *data)
++{
++	switch (tag) {
++	case HTT_PPDU_STATS_TAG_USR_COMPLTN_FLUSH:
++		if (len < sizeof(struct htt_ppdu_stats_cmpltn_flush)) {
++			ath11k_warn(ab, "Invalid len %d for the tag 0x%x\n",
++				    len, tag);
++			return -EINVAL;
++		}
++		ath11k_dp_ppdu_stats_flush_tlv_parse(ab, (struct htt_ppdu_stats_cmpltn_flush *)ptr);
++		break;
++	default:
++		break;
++	}
++
++	return 0;
++}
++
+ static void
+ ath11k_update_per_peer_tx_stats(struct ath11k *ar,
+ 				struct htt_ppdu_stats *ppdu_stats, u8 user)
+@@ -1432,6 +1497,9 @@ ath11k_update_per_peer_tx_stats(struct a
+ 	if (!(usr_stats->tlv_flags & BIT(HTT_PPDU_STATS_TAG_USR_RATE)))
+ 		return;
+ 
++	if (usr_stats->rate_stats_updated)
++		return;
++
+ 	if (usr_stats->tlv_flags & BIT(HTT_PPDU_STATS_TAG_USR_COMPLTN_COMMON))
+ 		is_ampdu =
+ 			HTT_USR_CMPLTN_IS_AMPDU(usr_stats->cmpltn_cmn.flags);
+@@ -1565,6 +1633,8 @@ ath11k_update_per_peer_tx_stats(struct a
+ 			ath11k_debugfs_sta_add_tx_stats(arsta, peer_stats, rate_idx);
+ 	}
+ 
++	usr_stats->rate_stats_updated = true;
++
+ 	spin_unlock_bh(&ab->base_lock);
+ 	rcu_read_unlock();
+ }
+@@ -1685,6 +1755,69 @@ int ath11k_dp_htt_tlv_iter(struct ath11k
+ 	return 0;
+ }
+ 
++static void
++ath11k_dp_rx_ppdu_stats_update_tx_comp_status(struct ath11k *ar,
++				       struct htt_ppdu_stats_info *ppdu_info)
++{
++	struct ath11k_base *ab = ar->ab;
++	struct ieee80211_sta *sta;
++	struct ath11k_sta *arsta;
++	struct ath11k_peer *peer = NULL;
++	struct htt_ppdu_user_stats* usr_stats = NULL;
++	struct ieee80211_tx_status status;
++	struct ieee80211_rate_status status_rate = { 0 };
++
++	u32 peer_id = 0;
++	int i;
++
++	lockdep_assert_held(&ar->data_lock);
++
++	if (!ar->ab->nss.mesh_nss_offload_enabled)
++		return;
++
++	ath11k_htt_update_ppdu_stats(ar, &ppdu_info->ppdu_stats);
++
++	rcu_read_lock();
++
++	for (i = 0; i < ppdu_info->ppdu_stats.common.num_users; i++) {
++		usr_stats = &ppdu_info->ppdu_stats.user_stats[i];
++		peer_id = usr_stats->peer_id;
++		spin_lock_bh(&ab->base_lock);
++		peer = ath11k_peer_find_by_id(ab, peer_id);
++		if (!peer) {
++			spin_unlock_bh(&ab->base_lock);
++			continue;
++		}
++
++		if (peer->vif->type != NL80211_IFTYPE_MESH_POINT) {
++			spin_unlock_bh(&ab->base_lock);
++			goto exit;
++		}
++
++		if (ether_addr_equal(peer->addr, peer->vif->addr)) {
++			spin_unlock_bh(&ab->base_lock);
++			continue;
++		}
++
++		sta = peer->sta;
++		arsta = (struct ath11k_sta *)sta->drv_priv;
++
++		memset(&status, 0, sizeof(status));
++
++		status.sta = sta;
++		status_rate.rate_idx = arsta->last_txrate;
++		status.rates = &status_rate;
++		status.mpdu_succ = usr_stats->cmpltn_cmn.mpdu_success;
++
++		ieee80211s_update_metric_ppdu(ar->hw, &status);
++
++		spin_unlock_bh(&ab->base_lock);
++	}
++
++exit:
++	rcu_read_unlock();
++}
++
+ static int ath11k_htt_pull_ppdu_stats(struct ath11k_base *ab,
+ 				      struct sk_buff *skb)
+ {
+@@ -1703,6 +1836,15 @@ static int ath11k_htt_pull_ppdu_stats(st
+ 	pdev_id = FIELD_GET(HTT_T2H_PPDU_STATS_INFO_PDEV_ID, msg->info);
+ 	ppdu_id = msg->ppdu_id;
+ 
++	if (pdev_id == 0) {
++		ret = ath11k_dp_htt_tlv_iter(ab, msg->data, len,
++					     ath11k_htt_tlv_ppdu_soc_stats_parse,
++					     NULL);
++		if (ret)
++			ath11k_warn(ab, "failed to parse tlv %d\n", ret);
++		return ret;
++	}
++
+ 	rcu_read_lock();
+ 	ar = ath11k_mac_get_ar_by_pdev_id(ab, pdev_id);
+ 	if (!ar) {
+@@ -1770,6 +1912,12 @@ static int ath11k_htt_pull_ppdu_stats(st
+ 		}
+ 	}
+ 
++	/* Stats update for mesh interface used when nss-offload in mesh is enabled */
++	if ((ppdu_info->frame_type == HTT_STATS_PPDU_FTYPE_DATA &&
++	    (ppdu_info->tlv_bitmap & (1 << HTT_PPDU_STATS_TAG_USR_RATE)) &&
++	    ppdu_info->tlv_bitmap & (1 << HTT_PPDU_STATS_TAG_USR_COMPLTN_COMMON)))
++		ath11k_dp_rx_ppdu_stats_update_tx_comp_status(ar, ppdu_info);
++
+ out_unlock_data:
+ 	spin_unlock_bh(&ar->data_lock);
+ 
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -3474,6 +3474,18 @@ static void ath11k_mac_op_nss_bss_info_c
+ 			ath11k_warn(ar->ab, "failed to set ap_isolate in nss %d\n", ret);
+ 	}
+ 
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++	if (changed & (BSS_CHANGED_NSS_MESH_TTL |
++				BSS_CHANGED_NSS_MESH_REFRESH_TIME |
++				BSS_CHANGED_NSS_MESH_FWD_ENABLED)) {
++		ret = ath11k_nss_mesh_config_update(vif, changed);
++		if (ret)
++			ath11k_warn(ar->ab,
++					"failed to update mesh nss offload configuration %d\n",
++					ret);
++	}
++#endif
++
+ 	mutex_unlock(&ar->conf_mutex);
+ }
+ 
+@@ -9714,6 +9726,28 @@ err_fallback:
+ 	return 0;
+ }
+ 
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++static void
++ath11k_mac_op_config_mesh_offload_path(struct ieee80211_hw *hw,
++				       struct ieee80211_vif *vif,
++				       enum ieee80211_mesh_path_offld_cmd cmd,
++				       struct ieee80211_mesh_path_offld *path)
++{
++	struct ath11k *ar = hw->priv;
++	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
++	int ret;
++
++	if (arvif->ar->ab->nss.debug_mode) {
++		ret = 0;
++		return;
++	}
++
++	ret = ath11k_nss_mesh_config_path(ar, arvif, cmd, path);
++	if (ret)
++		ath11k_warn(ar->ab, "failed to configure path entry to mesh table %d\n", ret);
++}
++#endif
++
+ static const struct ieee80211_ops ath11k_ops = {
+ 	.tx				= ath11k_mac_op_tx,
+ 	.wake_tx_queue			= ieee80211_handle_wake_tx_queue,
+@@ -9771,6 +9805,9 @@ static const struct ieee80211_ops ath11k
+ 	.set_sar_specs			= ath11k_mac_op_set_bios_sar_specs,
+ 	.remain_on_channel		= ath11k_mac_op_remain_on_channel,
+ 	.cancel_remain_on_channel	= ath11k_mac_op_cancel_remain_on_channel,
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++	.config_mesh_offload_path       = ath11k_mac_op_config_mesh_offload_path,
++#endif
+ };
+ 
+ static void ath11k_mac_update_ch_list(struct ath11k *ar,
+@@ -10231,6 +10268,8 @@ static int __ath11k_mac_register(struct
+ 		ieee80211_hw_set(ar->hw, SUPPORTS_NSS_OFFLOAD);
+ 		wiphy_ext_feature_set(ar->hw->wiphy,
+ 				      NL80211_EXT_FEATURE_VLAN_OFFLOAD);
++		if (ab->nss.mesh_nss_offload_enabled)
++			ieee80211_hw_set(ar->hw, SUPPORTS_MESH_NSS_OFFLOAD);
+ 	}
+ 
+ 	ret = ieee80211_register_hw(ar->hw);
+--- a/drivers/net/wireless/ath/ath11k/nss.c
++++ b/drivers/net/wireless/ath/ath11k/nss.c
+@@ -6,6 +6,7 @@
+ #include "debug.h"
+ #include "mac.h"
+ #include "nss.h"
++#include "debug_nss.h"
+ #include "core.h"
+ #include "peer.h"
+ #include "dp_rx.h"
+@@ -14,6 +15,11 @@
+ #include "wmi.h"
+ #include "../../../../../net/mac80211/sta_info.h"
+ 
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++enum nss_wifi_mesh_mpp_learning_mode mpp_mode = NSS_WIFI_MESH_MPP_LEARNING_MODE_INDEPENDENT_NSS;
++LIST_HEAD(mesh_vaps);
++#endif
++
+ /*-----------------------------ATH11K-NSS Helpers--------------------------*/
+ 
+ static enum ath11k_nss_opmode
+@@ -32,6 +38,30 @@ ath11k_nss_get_vdev_opmode(struct ath11k
+ 	return ATH11K_NSS_OPMODE_UNKNOWN;
+ }
+ 
++static struct ath11k_vif *ath11k_nss_get_arvif_from_dev(struct net_device *dev)
++{
++	struct wireless_dev *wdev;
++	struct ieee80211_vif *vif;
++	struct ath11k_vif *arvif;
++
++	if (!dev)
++		return NULL;
++
++	wdev = dev->ieee80211_ptr;
++	if (!wdev)
++		return NULL;
++
++	vif = wdev_to_ieee80211_vif(wdev);
++	if (!vif)
++		return NULL;
++
++	arvif = (struct ath11k_vif *)vif->drv_priv;
++	if (!arvif)
++		return NULL;
++
++	return arvif;
++}
++
+ static void ath11k_nss_wifili_stats_sync(struct ath11k_base *ab,
+ 					 struct nss_wifili_stats_sync_msg *wlsoc_stats)
+ {
+@@ -263,7 +293,6 @@ void ath11k_nss_wifili_event_receive(str
+ 		ab->nss.response = response;
+ 		complete(&ab->nss.complete);
+ 		break;
+-
+ 	case NSS_WIFILI_PEER_CREATE_MSG:
+ 		if (response != NSS_CMN_RESPONSE_EMSG)
+ 			break;
+@@ -333,6 +362,13 @@ void ath11k_nss_wifili_event_receive(str
+ 		ath11k_dbg(ab, ATH11K_DBG_NSS_WDS, "nss wifili peer 4addr event received %d response %d error %d\n",
+ 			   msg_type, response, error);
+ 		break;
++	case NSS_WIFILI_SEND_MESH_CAPABILITY_INFO:
++		complete(&ab->nss.complete);
++		if (response != NSS_CMN_RESPONSE_EMSG)
++			ab->nss.mesh_nss_offload_enabled = true;
++		ath11k_dbg(ab, ATH11K_DBG_NSS_MESH, "nss wifili mesh capability response %d\n",
++			   ab->nss.mesh_nss_offload_enabled);
++		break;
+ 	default:
+ 		ath11k_dbg(ab, ATH11K_DBG_NSS, "unhandled event %d\n", msg_type);
+ 		break;
+@@ -420,7 +456,9 @@ ath11k_nss_wifili_ext_callback_fn(struct
+ 		ath11k_nss_process_mic_error(ab, skb);
+ 		break;
+ 	default:
+-		kfree(skb);
++		ath11k_dbg(ab, ATH11K_DBG_NSS, "unknown packet type received in wifili ext cb %d",
++			    wepm->pkt_type);
++		dev_kfree_skb_any(skb);
+ 		break;
+ 	}
+ }
+@@ -735,8 +773,6 @@ ath11k_nss_vdev_special_data_receive(str
+ {
+ 	struct nss_wifi_vdev_per_packet_metadata *wifi_metadata = NULL;
+ 	struct nss_wifi_vdev_wds_per_packet_metadata *wds_metadata = NULL;
+-	struct wireless_dev *wdev;
+-	struct ieee80211_vif *vif;
+ 	struct ath11k_vif *arvif;
+ 	struct ath11k_base *ab;
+ 	bool drop = false;
+@@ -744,24 +780,7 @@ ath11k_nss_vdev_special_data_receive(str
+ 	int data_offs = 0;
+ 	int ret = 0;
+ 
+-	if (!dev) {
+-		dev_kfree_skb_any(skb);
+-		return;
+-	}
+-
+-	wdev = dev->ieee80211_ptr;
+-	if (!wdev) {
+-		dev_kfree_skb_any(skb);
+-		return;
+-	}
+-
+-	vif = wdev_to_ieee80211_vif(wdev);
+-	if (!vif) {
+-		dev_kfree_skb_any(skb);
+-		return;
+-	}
+-
+-	arvif = (struct ath11k_vif *)vif->drv_priv;
++	arvif = ath11k_nss_get_arvif_from_dev(dev);
+ 	if (!arvif) {
+ 		dev_kfree_skb_any(skb);
+ 		return;
+@@ -874,25 +893,1041 @@ static void
+ ath11k_nss_ext_vdev_data_receive(struct net_device *dev, struct sk_buff *skb,
+ 				 __attribute__((unused)) struct napi_struct *napi)
+ {
+-	struct wireless_dev *wdev;
+-	struct ieee80211_vif *vif;
+ 	struct ath11k_vif *arvif;
+ 	struct ath11k_base *ab;
+ 	bool eth_decap = false;
+ 	int data_offs = 0;
+ 	int ret;
+ 
+-	if (!dev) {
++	arvif = ath11k_nss_get_arvif_from_dev(dev);
++	if (!arvif) {
+ 		dev_kfree_skb_any(skb);
+ 		return;
+ 	}
+ 
+-	wdev = dev->ieee80211_ptr;
+-	if (!wdev) {
++	ab = arvif->ar->ab;
++
++	skb->dev = dev;
++
++	/* log the original skb received from nss */
++	ath11k_dbg_dump(ab, ATH11K_DBG_DP_RX, "", "dp rx msdu from nss ext : ",
++			skb->data, skb->len);
++
++	ret = ath11k_nss_undecap(arvif, skb, &data_offs, &eth_decap);
++	if (ret) {
++		ath11k_warn(ab, "error in nss ext rx undecap, type %d err %d\n",
++			    arvif->nss.decap, ret);
++		dev_kfree_skb_any(skb);
++		return;
++	}
++
++	ath11k_nss_deliver_rx(arvif->vif, skb, eth_decap, data_offs, napi);
++}
++
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++/*------Mesh offload------*/
++
++void ath11k_nss_mesh_wifili_event_receive(void *app_data,
++					  struct nss_cmn_msg *cmn_msg)
++{
++	struct nss_wifi_mesh_msg *msg = (struct nss_wifi_mesh_msg *)cmn_msg;
++	struct ath11k_base *ab = app_data;
++	u32 msg_type = msg->cm.type;
++	enum nss_cmn_response response = msg->cm.response;
++	u32 error =  msg->cm.error;
++
++	if (!ab)
++		return;
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS_MESH, "nss mesh event received %d response %d error %d\n",
++		   msg_type, response, error);
++
++	switch (msg_type) {
++	case NSS_WIFI_MESH_MSG_MPATH_ADD:
++		if (response == NSS_CMN_RESPONSE_EMSG)
++			ath11k_warn(ab,"failed to add an entry to mpath table mesh_da %pM vdev_id %d\n",
++				    (&msg->msg.mpath_add)->dest_mac_addr,
++				    (&msg->msg.mpath_add)->link_vap_id);
++		break;
++	case NSS_WIFI_MESH_MSG_MPATH_UPDATE:
++		if (response == NSS_CMN_RESPONSE_EMSG)
++			ath11k_warn(ab, "failed to update mpath entry mesh_da %pM vdev_id %d"
++				    "next_hop %pM old_next_hop %pM metric %d flags 0x%u hop_count %d"
++				    "exp_time %u mesh_gate %u\n",
++				    (&msg->msg.mpath_update)->dest_mac_addr,
++				    (&msg->msg.mpath_update)->link_vap_id,
++				    (&msg->msg.mpath_update)->next_hop_mac_addr,
++				    (&msg->msg.mpath_update)->old_next_hop_mac_addr,
++				    (&msg->msg.mpath_update)->metric,
++				    (&msg->msg.mpath_update)->path_flags,
++				    (&msg->msg.mpath_update)->hop_count,
++				    (&msg->msg.mpath_update)->expiry_time,
++				    (&msg->msg.mpath_update)->is_mesh_gate);
++		break;
++	case NSS_WIFI_MESH_MSG_MPATH_DELETE:
++		if (response == NSS_CMN_RESPONSE_EMSG)
++			ath11k_warn(ab,"failed to remove mpath entry mesh_da %pM"
++				    "vdev_id %d\n",
++				    (&msg->msg.mpath_del)->mesh_dest_mac_addr,
++				    (&msg->msg.mpath_del)->link_vap_id);
++		break;
++	case NSS_WIFI_MESH_MSG_PROXY_PATH_ADD:
++		if (response == NSS_CMN_RESPONSE_EMSG)
++			ath11k_warn(ab,"failed to add proxy entry da %pM mesh_da %pM \n",
++				    (&msg->msg.proxy_add_msg)->dest_mac_addr,
++				    (&msg->msg.proxy_add_msg)->mesh_dest_mac);
++		break;
++	case NSS_WIFI_MESH_MSG_PROXY_PATH_UPDATE:
++		if (response == NSS_CMN_RESPONSE_EMSG)
++			ath11k_warn(ab,"failed to update proxy path da %pM mesh_da %pM\n",
++				    (&msg->msg.proxy_update_msg)->dest_mac_addr,
++				    (&msg->msg.proxy_update_msg)->mesh_dest_mac);
++		break;
++	case NSS_WIFI_MESH_MSG_PROXY_PATH_DELETE:
++		if (response == NSS_CMN_RESPONSE_EMSG)
++			ath11k_warn(ab,"failed to remove proxy path entry da %pM mesh_da %pM\n",
++				    (&msg->msg.proxy_del_msg)->dest_mac_addr,
++				    (&msg->msg.proxy_del_msg)->mesh_dest_mac_addr);
++		break;
++	case NSS_WIFI_MESH_MSG_EXCEPTION_FLAG:
++		if (response == NSS_CMN_RESPONSE_EMSG)
++			ath11k_warn(ab,"failed to add the exception  da %pM\n",
++				    (&msg->msg.exception_msg)->dest_mac_addr);
++		break;
++	default:
++		ath11k_dbg(ab, ATH11K_DBG_NSS_MESH, "unhandled event %d\n", msg_type);
++		break;
++	}
++}
++
++static void nss_mesh_convert_path_flags(u8 *dest, u8 *src, bool to_nss)
++{
++	if (to_nss) {
++		if (*src & IEEE80211_MESH_PATH_ACTIVE)
++			*dest |= NSS_WIFI_MESH_PATH_FLAG_ACTIVE;
++		if (*src & IEEE80211_MESH_PATH_RESOLVING)
++			*dest |= NSS_WIFI_MESH_PATH_FLAG_RESOLVING;
++		if (*src & IEEE80211_MESH_PATH_RESOLVED)
++			*dest |= NSS_WIFI_MESH_PATH_FLAG_RESOLVED;
++		if (*src & IEEE80211_MESH_PATH_FIXED)
++			*dest |= NSS_WIFI_MESH_PATH_FLAG_FIXED;
++	} else {
++		if (*src & NSS_WIFI_MESH_PATH_FLAG_ACTIVE)
++			*dest |= IEEE80211_MESH_PATH_ACTIVE;
++		if (*src & NSS_WIFI_MESH_PATH_FLAG_RESOLVING)
++			*dest |= IEEE80211_MESH_PATH_RESOLVING;
++		if (*src & NSS_WIFI_MESH_PATH_FLAG_RESOLVED)
++			*dest |= IEEE80211_MESH_PATH_RESOLVED;
++		if (*src & NSS_WIFI_MESH_PATH_FLAG_FIXED)
++			*dest |= IEEE80211_MESH_PATH_FIXED;
++	}
++}
++
++static void ath11k_nss_mesh_mpath_refresh(struct ath11k_vif *arvif,
++					  struct nss_wifi_mesh_msg *msg)
++{
++	struct ath11k_base *ab = arvif->ar->ab;
++	struct nss_wifi_mesh_path_refresh_msg *refresh_msg;
++	struct ieee80211_mesh_path_offld path = {0};
++	int ret;
++
++	refresh_msg = &msg->msg.path_refresh_msg;
++	ether_addr_copy(path.mesh_da, refresh_msg->dest_mac_addr);
++	ether_addr_copy(path.next_hop, refresh_msg->next_hop_mac_addr);
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS,
++		   "Mesh path refresh event from nss, mDA %pM next_hop %pM link_vdev %d\n",
++		   refresh_msg->dest_mac_addr, refresh_msg->next_hop_mac_addr,
++		   refresh_msg->link_vap_id);
++
++
++	if (ab->nss.debug_mode)
++		return;
++
++	ret = ieee80211_mesh_path_offld_change_notify(arvif->vif, &path,
++			IEEE80211_MESH_PATH_OFFLD_ACTION_MPATH_REFRESH);
++	if (ret)
++		ath11k_warn(ab, "failed to notify mpath refresh nss event %d\n", ret);
++}
++
++static void ath11k_nss_mesh_path_not_found(struct ath11k_vif *arvif,
++					   struct nss_wifi_mesh_msg *msg)
++{
++	struct ath11k_base *ab = arvif->ar->ab;
++	struct nss_wifi_mesh_mpath_not_found_msg *err_msg;
++	struct ieee80211_mesh_path_offld path = {0};
++	int ret;
++
++	err_msg = &msg->msg.mpath_not_found_msg;
++	ether_addr_copy(path.da, err_msg->dest_mac_addr);
++	if (err_msg->is_mesh_forward_path)
++		ether_addr_copy(path.ta, err_msg->transmitter_mac_addr);
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS,
++		   "Mesh path not found event from nss, (m)DA %pM ta %pM link vap %d\n",
++		   err_msg->dest_mac_addr, err_msg->transmitter_mac_addr, err_msg->link_vap_id);
++
++
++	if (ab->nss.debug_mode)
++		return;
++
++	ret = ieee80211_mesh_path_offld_change_notify(arvif->vif, &path,
++			IEEE80211_MESH_PATH_OFFLD_ACTION_PATH_NOT_FOUND);
++	if (ret)
++		ath11k_warn(ab, "failed to notify mpath not found nss event %d\n", ret);
++}
++
++static void ath11k_nss_mesh_path_delete(struct ath11k_vif *arvif,
++					struct nss_wifi_mesh_msg *msg)
++{
++	struct ath11k_base *ab = arvif->ar->ab;
++	struct nss_wifi_mesh_mpath_del_msg *del_msg = &msg->msg.mpath_del;
++	struct ieee80211_mesh_path_offld path = {0};
++	int ret;
++
++	ether_addr_copy(path.mesh_da, del_msg->mesh_dest_mac_addr);
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS,
++		   "Mesh path delete event from nss, mDA %pM vap_id %d\n",
++		   del_msg->mesh_dest_mac_addr, del_msg->link_vap_id);
++
++	ret = ieee80211_mesh_path_offld_change_notify(arvif->vif, &path,
++			IEEE80211_MESH_PATH_OFFLD_ACTION_MPATH_DEL);
++	if (ret)
++		ath11k_warn(ab, "failed to notify mpath delete nss event %d\n", ret);
++}
++
++static void ath11k_nss_mesh_path_expiry(struct ath11k_vif *arvif,
++					struct nss_wifi_mesh_msg *msg)
++{
++	struct ath11k_base *ab = arvif->ar->ab;
++	struct nss_wifi_mesh_path_expiry_msg *exp_msg = &msg->msg.path_expiry_msg;
++	struct ieee80211_mesh_path_offld path = {0};
++	int ret;
++
++	ether_addr_copy(path.mesh_da, exp_msg->mesh_dest_mac_addr);
++	ether_addr_copy(path.next_hop, exp_msg->next_hop_mac_addr);
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS,
++		   "Mesh path delete event from nss, mDA %pM next_hop %pM if_num %d\n",
++		   exp_msg->mesh_dest_mac_addr, exp_msg->next_hop_mac_addr,
++		   arvif->nss.if_num);
++
++	ret = ieee80211_mesh_path_offld_change_notify(arvif->vif, &path,
++			IEEE80211_MESH_PATH_OFFLD_ACTION_MPATH_EXP);
++	if (ret)
++		ath11k_warn(ab, "failed to notify mpath expiry nss event %d\n", ret);
++}
++
++static void ath11k_nss_mesh_mpp_learn(struct ath11k_vif *arvif,
++				      struct nss_wifi_mesh_msg *msg)
++ {
++	 struct ath11k_base *ab = arvif->ar->ab;
++	 struct nss_wifi_mesh_proxy_path_learn_msg *learn_msg;
++	 struct ieee80211_mesh_path_offld path = {0};
++	 int ret;
++
++	 learn_msg = &msg->msg.proxy_learn_msg;
++
++	 ether_addr_copy(path.mesh_da, learn_msg->mesh_dest_mac);
++	 ether_addr_copy(path.da, learn_msg->dest_mac_addr);
++	 nss_mesh_convert_path_flags(&path.flags, &learn_msg->path_flags, false);
++
++	 ath11k_dbg(ab, ATH11K_DBG_NSS,
++		    "Mesh proxy learn event from nss, mDA %pM da %pM flags 0x%x if_num %d\n",
++		    learn_msg->mesh_dest_mac, learn_msg->dest_mac_addr,
++		    learn_msg->path_flags, arvif->nss.if_num);
++
++	 ret = ieee80211_mesh_path_offld_change_notify(arvif->vif, &path,
++			 IEEE80211_MESH_PATH_OFFLD_ACTION_MPP_LEARN);
++	 if (ret)
++		 ath11k_warn(ab, "failed to notify proxy learn event %d\n", ret);
++}
++
++static void ath11k_nss_mesh_mpp_add(struct ath11k_vif *arvif,
++				    struct nss_wifi_mesh_msg *msg)
++{
++	struct ath11k_base *ab = arvif->ar->ab;
++	struct nss_wifi_mesh_proxy_path_add_msg *add_msg = &msg->msg.proxy_add_msg;
++	struct ieee80211_mesh_path_offld path = {0};
++	int ret;
++
++	ether_addr_copy(path.mesh_da, add_msg->mesh_dest_mac);
++	ether_addr_copy(path.da, add_msg->dest_mac_addr);
++	nss_mesh_convert_path_flags(&path.flags, &add_msg->path_flags, false);
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS,
++		   "Mesh proxy add event from nss, mDA %pM da %pM flags 0x%x if_num %d\n",
++		   add_msg->mesh_dest_mac, add_msg->dest_mac_addr, add_msg->path_flags,
++		   arvif->nss.if_num);
++
++	ret = ieee80211_mesh_path_offld_change_notify(arvif->vif, &path,
++				IEEE80211_MESH_PATH_OFFLD_ACTION_MPP_ADD);
++	if (ret)
++		ath11k_warn(ab, "failed to notify proxy add event %d\n", ret);
++}
++
++static void ath11k_nss_mesh_mpp_update(struct ath11k_vif *arvif,
++				       struct nss_wifi_mesh_msg *msg)
++{
++	struct ath11k_base *ab = arvif->ar->ab;
++	struct nss_wifi_mesh_proxy_path_update_msg *umsg;
++	struct ieee80211_mesh_path_offld path = {0};
++	int ret;
++
++	umsg = &msg->msg.proxy_update_msg;
++	ether_addr_copy(path.mesh_da, umsg->mesh_dest_mac);
++	ether_addr_copy(path.da, umsg->dest_mac_addr);
++	nss_mesh_convert_path_flags(&path.flags, &umsg->path_flags, false);
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS,
++		   "Mesh proxy update event from nss, mDA %pM da %pM flags 0x%x if_num %d\n",
++		   umsg->mesh_dest_mac, umsg->dest_mac_addr, umsg->path_flags, arvif->nss.if_num);
++
++	ret = ieee80211_mesh_path_offld_change_notify(arvif->vif, &path,
++				IEEE80211_MESH_PATH_OFFLD_ACTION_MPP_UPDATE);
++	if (ret)
++		ath11k_warn(ab, "failed to notify proxy update event %d\n", ret);
++}
++
++static int
++ath11k_nss_mesh_process_path_table_dump_msg(struct ath11k_vif *arvif,
++				     struct nss_wifi_mesh_msg *msg)
++{
++	struct nss_wifi_mesh_path_table_dump *mpath_dump = &msg->msg.mpath_table_dump;
++	struct ath11k_nss_mpath_entry *entry;
++	struct ath11k *ar = arvif->ar;
++	ssize_t len;
++
++	len = sizeof(struct nss_wifi_mesh_path_dump_entry) * mpath_dump->num_entries;
++	entry = kzalloc(sizeof(*entry) + len, GFP_ATOMIC);
++	if (!entry)
++		return -ENOMEM;
++
++	memcpy(entry->mpath, mpath_dump->path_entry, len);
++	entry->num_entries = mpath_dump->num_entries;
++	spin_lock_bh(&ar->nss.dump_lock);
++	list_add_tail(&entry->list, &arvif->nss.mpath_dump);
++	arvif->nss.mpath_dump_num_entries += mpath_dump->num_entries;
++	spin_unlock_bh(&ar->nss.dump_lock);
++
++	if (!mpath_dump->more_events)
++		complete(&arvif->nss.dump_mpath_complete);
++
++	return 0;
++}
++
++static int
++ath11k_nss_mesh_process_mpp_table_dump_msg(struct ath11k_vif *arvif,
++				    struct nss_wifi_mesh_msg *msg)
++{
++	struct nss_wifi_mesh_proxy_path_table_dump *mpp_dump;
++	struct ath11k_nss_mpp_entry *entry, *tmp;
++	struct ath11k *ar = arvif->ar;
++	struct arvif_nss *nss = &arvif->nss;
++	ssize_t len;
++	LIST_HEAD(local_entry_exp_update);
++
++	mpp_dump = &msg->msg.proxy_path_table_dump;
++
++	if (!mpp_dump->num_entries)
++		return 0;
++
++	len = sizeof(struct nss_wifi_mesh_proxy_path_dump_entry) * mpp_dump->num_entries;
++	entry = kzalloc(sizeof(*entry) + len, GFP_ATOMIC);
++	if (!entry)
++		return -ENOMEM;
++
++	memcpy(entry->mpp, mpp_dump->path_entry, len);
++	entry->num_entries = mpp_dump->num_entries;
++	spin_lock_bh(&ar->nss.dump_lock);
++	list_add_tail(&entry->list, &arvif->nss.mpp_dump);
++	arvif->nss.mpp_dump_num_entries += mpp_dump->num_entries;
++	spin_unlock_bh(&ar->nss.dump_lock);
++
++	if (!mpp_dump->more_events) {
++		if (arvif->nss.mpp_aging) {
++			arvif->nss.mpp_aging = false;
++			spin_lock_bh(&ar->nss.dump_lock);
++			list_splice_tail_init(&nss->mpp_dump, &local_entry_exp_update);
++			spin_unlock_bh(&ar->nss.dump_lock);
++
++			list_for_each_entry_safe(entry, tmp, &local_entry_exp_update, list) {
++				if (entry->mpp->time_diff > ATH11K_MPP_EXPIRY_TIMER_INTERVAL_MS)
++					continue;
++				mesh_nss_offld_proxy_path_exp_update(arvif->vif,
++								     entry->mpp->dest_mac_addr,
++								     entry->mpp->mesh_dest_mac,
++								     entry->mpp->time_diff);
++			}
++			/* If mpp_dump_req is true dont free the entry
++			 * since it will get freed in debug_nss_fill_mpp_dump
++			 * both mpp_aging and mpp_dump_req will be true during
++			 * simultaneous accessing of mpp dump entry. So this will
++			 * gain the reuse of same dump result for both mpp_aging
++			 * and mpp_dump_req */
++			if (!arvif->nss.mpp_dump_req) {
++				list_for_each_entry_safe(entry, tmp, &local_entry_exp_update, list)
++					kfree(entry);
++			} else {
++				/* Adding back to global nss dump tbl to reuse the same
++				 * tbl for mpp dump request
++				 */
++				spin_lock_bh(&ar->nss.dump_lock);
++				list_splice_tail_init(&local_entry_exp_update, &nss->mpp_dump);
++				spin_unlock_bh(&ar->nss.dump_lock);
++			}
++		}
++
++		if (arvif->nss.mpp_dump_req) {
++			complete(&arvif->nss.dump_mpp_complete);
++			arvif->nss.mpp_dump_req = false;
++		}
++	}
++
++	return 0;
++}
++
++int ath11k_nss_mesh_exception_flags(struct ath11k_vif *arvif,
++			       struct nss_wifi_mesh_exception_flag_msg *nss_msg)
++{
++	nss_wifi_mesh_msg_callback_t msg_cb;
++	nss_tx_status_t status;
++	int ret = 0;
++
++	msg_cb = (nss_wifi_mesh_msg_callback_t)ath11k_nss_mesh_wifili_event_receive;
++
++	status = (nss_tx_status_t)nss_wifi_meshmgr_mesh_path_exception(arvif->nss.mesh_handle, nss_msg,
++			msg_cb, arvif->ar->ab);
++
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(arvif->ar->ab, "failed to set the exception flags\n");
++		ret = -EINVAL;
++	}
++
++	return ret;
++}
++
++int ath11k_nss_exc_rate_config(struct ath11k_vif *arvif,
++					struct nss_wifi_mesh_rate_limit_config *nss_exc_cfg)
++{
++	nss_tx_status_t status;
++	int ret = 0;
++
++	status = (nss_tx_status_t)nss_wifi_meshmgr_config_mesh_exception_sync(arvif->nss.mesh_handle, nss_exc_cfg);
++
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(arvif->ar->ab, "failed to set the exception rate ctrl\n");
++		ret = -EINVAL;
++	}
++
++	return ret;
++}
++
++static void ath11k_nss_mesh_obj_vdev_event_receive(void *dev,
++						   struct nss_cmn_msg *cmn_msg)
++{
++	struct nss_wifi_mesh_msg *msg = (struct nss_wifi_mesh_msg *) cmn_msg;
++	struct ath11k_base *ab;
++	struct ath11k_vif *arvif;
++	int ret;
++
++	arvif = ath11k_nss_get_arvif_from_dev(dev);
++	if (!arvif)
++		return;
++
++	ab = arvif->ar->ab;
++
++	switch (msg->cm.type) {
++	case NSS_WIFI_MESH_MSG_PATH_REFRESH:
++		ath11k_nss_mesh_mpath_refresh(arvif, msg);
++		break;
++	case NSS_WIFI_MESH_MSG_PATH_NOT_FOUND:
++		ath11k_nss_mesh_path_not_found(arvif, msg);
++		break;
++	case NSS_WIFI_MESH_MSG_MPATH_DELETE:
++		ath11k_nss_mesh_path_delete(arvif, msg);
++		break;
++	case NSS_WIFI_MESH_MSG_PATH_EXPIRY:
++		ath11k_nss_mesh_path_expiry(arvif, msg);
++		break;
++	case NSS_WIFI_MESH_MSG_PROXY_PATH_LEARN:
++		ath11k_nss_mesh_mpp_learn(arvif, msg);
++		break;
++	case NSS_WIFI_MESH_MSG_PROXY_PATH_ADD:
++		ath11k_nss_mesh_mpp_add(arvif, msg);
++		break;
++	case NSS_WIFI_MESH_MSG_PROXY_PATH_UPDATE:
++		ath11k_nss_mesh_mpp_update(arvif, msg);
++		break;
++	case NSS_WIFI_MESH_MSG_PATH_TABLE_DUMP:
++		ret = ath11k_nss_mesh_process_path_table_dump_msg(arvif, msg);
++		if (ret)
++			ath11k_warn(arvif->ar->ab, "failed mpath table dump message %d\n",
++				    ret);
++		break;
++	case NSS_WIFI_MESH_MSG_PROXY_PATH_TABLE_DUMP:
++		ret = ath11k_nss_mesh_process_mpp_table_dump_msg(arvif, msg);
++		if (ret)
++			ath11k_warn(arvif->ar->ab, "failed mpp table dump message %d\n",
++				    ret);
++		break;
++	default:
++		ath11k_dbg(ab, ATH11K_DBG_NSS, "unknown message type on mesh obj vap %d\n",
++			   msg->cm.type);
++		break;
++	}
++}
++
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++static int ath11k_nss_mesh_mpath_add(struct ath11k_vif *arvif,
++			      struct ieee80211_mesh_path_offld *path)
++{
++	nss_wifi_mesh_msg_callback_t msg_cb;
++	struct nss_wifi_mesh_mpath_add_msg *msg;
++	struct ath11k *ar = arvif->ar;
++	nss_tx_status_t status;
++	int ret = 0;
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_NSS_MESH, "add mpath for mesh_da %pM on radio %d\n",
++		   path->mesh_da, ar->pdev->pdev_id);
++
++	msg = kzalloc(sizeof(struct nss_wifi_mesh_mpath_add_msg), GFP_ATOMIC);
++	if (!msg)
++		return -ENOMEM;
++
++	msg_cb = (nss_wifi_mesh_msg_callback_t)ath11k_nss_mesh_wifili_event_receive;
++
++	ether_addr_copy(msg->dest_mac_addr, path->mesh_da);
++	ether_addr_copy(msg->next_hop_mac_addr, path->next_hop);
++	msg->hop_count = path->hop_count;
++	msg->metric = path->metric;
++	nss_mesh_convert_path_flags(&msg->path_flags, &path->flags, true);
++	msg->link_vap_id = arvif->nss.if_num;
++	msg->block_mesh_fwd = path->block_mesh_fwd;
++	msg->metadata_type = path->metadata_type ? NSS_WIFI_MESH_PRE_HEADER_80211: NSS_WIFI_MESH_PRE_HEADER_NONE;
++
++	status = (nss_tx_status_t)nss_wifi_meshmgr_mesh_path_add(arvif->nss.mesh_handle, msg,
++					        msg_cb, ar->ab);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ar->ab,
++			    "failed to add mpath entry mesh_da %pM radio_id %d status %d\n",
++			    path->mesh_da, arvif->nss.if_num, status);
++		ret = -EINVAL;
++	}
++
++	kfree(msg);
++
++	return ret;
++}
++
++static int ath11k_nss_mesh_mpath_update(struct ath11k_vif *arvif,
++			      struct ieee80211_mesh_path_offld *path)
++{
++	nss_wifi_mesh_msg_callback_t msg_cb;
++	struct nss_wifi_mesh_mpath_update_msg *msg;
++	struct ath11k *ar = arvif->ar;
++	nss_tx_status_t status;
++	int ret = 0;
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_NSS_MESH,
++		   "update mpath  mesh_da %pM radio %d next_hop %pM old_next_hop %pM "
++		   "metric %d flags 0x%x hop_count %d "
++		   "exp_time %lu mesh_gate %d\n",
++		   path->mesh_da, ar->pdev->pdev_id, path->next_hop, path->old_next_hop,
++		   path->metric, path->flags, path->hop_count, path->exp_time,
++		   path->mesh_gate);
++
++	msg = kzalloc(sizeof(struct nss_wifi_mesh_mpath_update_msg), GFP_ATOMIC);
++	if (!msg)
++		return -ENOMEM;
++
++	msg_cb = (nss_wifi_mesh_msg_callback_t)ath11k_nss_mesh_wifili_event_receive;
++
++	ether_addr_copy(msg->dest_mac_addr, path->mesh_da);
++	ether_addr_copy(msg->next_hop_mac_addr, path->next_hop);
++	ether_addr_copy(msg->old_next_hop_mac_addr, path->old_next_hop);
++	msg->hop_count = path->hop_count;
++	msg->metric = path->metric;
++	nss_mesh_convert_path_flags(&msg->path_flags, &path->flags, true);
++	msg->link_vap_id = arvif->nss.if_num;
++	msg->is_mesh_gate = path->mesh_gate;
++	msg->expiry_time = path->exp_time;
++	msg->block_mesh_fwd = path->block_mesh_fwd;
++	msg->metadata_type =
++		(uint8_t)(path->metadata_type ==
++					  (uint8_t)
++						  NSS_WIFI_MESH_PRE_HEADER_80211 ?
++				  NSS_WIFI_MESH_PRE_HEADER_80211 :
++				  NSS_WIFI_MESH_PRE_HEADER_NONE);
++
++	msg->update_flags = NSS_WIFI_MESH_PATH_UPDATE_FLAG_NEXTHOP |
++		     NSS_WIFI_MESH_PATH_UPDATE_FLAG_HOPCOUNT |
++		     NSS_WIFI_MESH_PATH_UPDATE_FLAG_METRIC |
++		     NSS_WIFI_MESH_PATH_UPDATE_FLAG_MESH_FLAGS |
++		     NSS_WIFI_MESH_PATH_UPDATE_FLAG_BLOCK_MESH_FWD |
++		     NSS_WIFI_MESH_PATH_UPDATE_FLAG_METADATA_ENABLE_VALID;
++
++	status = (nss_tx_status_t)nss_wifi_meshmgr_mesh_path_update(arvif->nss.mesh_handle, msg,
++						    msg_cb, ar->ab);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ar->ab,
++			    "failed to update mpath entry mesh_da %pM radio_id %d status %d\n",
++			    path->mesh_da, arvif->nss.if_num, status);
++		ret = -EINVAL;
++	}
++
++	kfree(msg);
++
++	return ret;
++}
++
++static int ath11k_nss_mesh_mpath_del(struct ath11k_vif *arvif,
++			      struct ieee80211_mesh_path_offld *path)
++{
++	nss_wifi_mesh_msg_callback_t msg_cb;
++	struct nss_wifi_mesh_mpath_del_msg *msg;
++	struct ath11k *ar = arvif->ar;
++	nss_tx_status_t status;
++	int ret = 0;
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_NSS_MESH, "del mpath for mesh_da %pM on radio %d\n",
++		   path->mesh_da, ar->pdev->pdev_id);
++
++	msg = kzalloc(sizeof(struct nss_wifi_mesh_mpath_del_msg), GFP_ATOMIC);
++	if (!msg)
++		return -ENOMEM;
++
++	msg_cb = (nss_wifi_mesh_msg_callback_t)ath11k_nss_mesh_wifili_event_receive;
++
++	ether_addr_copy(msg->mesh_dest_mac_addr, path->mesh_da);
++	ether_addr_copy(msg->next_hop_mac_addr, path->next_hop);
++	msg->link_vap_id = arvif->nss.if_num;
++
++	status = (nss_tx_status_t)nss_wifi_meshmgr_mesh_path_delete(arvif->nss.mesh_handle,
++						   msg, msg_cb, ar->ab);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ar->ab,
++			    "failed to del mpath entry mesh_da %pM radio_id %d status %d\n",
++			    path->mesh_da, arvif->nss.if_num, status);
++		ret = -EINVAL;
++	}
++
++	kfree(msg);
++
++	return ret;
++}
++
++static int ath11k_nss_mesh_mpp_add_cmd(struct ath11k_vif *arvif,
++			      struct ieee80211_mesh_path_offld *path)
++{
++	nss_wifi_mesh_msg_callback_t msg_cb;
++	struct nss_wifi_mesh_proxy_path_add_msg *msg;
++	struct ath11k *ar = arvif->ar;
++	nss_tx_status_t status;
++	int ret = 0;
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_NSS_MESH, "add mpp mesh_da %pM da %pM\n",
++		   path->mesh_da, path->da);
++
++	msg = kzalloc(sizeof(struct nss_wifi_mesh_proxy_path_add_msg), GFP_ATOMIC);
++	if (!msg)
++		return -ENOMEM;
++
++	msg_cb = (nss_wifi_mesh_msg_callback_t)ath11k_nss_mesh_wifili_event_receive;
++
++	ether_addr_copy(msg->dest_mac_addr, path->da);
++	ether_addr_copy(msg->mesh_dest_mac, path->mesh_da);
++	nss_mesh_convert_path_flags(&msg->path_flags, &path->flags, true);
++
++	status = (nss_tx_status_t)nss_wifi_meshmgr_mesh_proxy_path_add(arvif->nss.mesh_handle,
++						      msg, msg_cb, ar->ab);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ar->ab,
++			    "failed to add mpp entry da %pM mesh_da %pM status %d\n",
++			    path->da, path->mesh_da, status);
++		ret = -EINVAL;
++	}
++
++	kfree(msg);
++
++	return ret;
++}
++
++static int ath11k_nss_mesh_mpp_update_cmd(struct ath11k_vif *arvif,
++			      struct ieee80211_mesh_path_offld *path)
++{
++	nss_wifi_mesh_msg_callback_t msg_cb;
++	struct nss_wifi_mesh_proxy_path_update_msg *msg;
++	struct ath11k *ar = arvif->ar;
++	nss_tx_status_t status;
++	int ret = 0;
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_NSS_MESH, "update mpp da %pM mesh_da %pM on vap_id %d\n",
++		   path->da, path->mesh_da, arvif->nss.if_num);
++
++	msg = kzalloc(sizeof(struct nss_wifi_mesh_proxy_path_update_msg), GFP_ATOMIC);
++	if (!msg)
++		return -ENOMEM;
++
++	msg_cb = (nss_wifi_mesh_msg_callback_t)ath11k_nss_mesh_wifili_event_receive;
++
++	ether_addr_copy(msg->dest_mac_addr, path->da);
++	ether_addr_copy(msg->mesh_dest_mac, path->mesh_da);
++	nss_mesh_convert_path_flags(&msg->path_flags, &path->flags, true);
++	msg->bitmap = NSS_WIFI_MESH_PATH_UPDATE_FLAG_NEXTHOP |
++			NSS_WIFI_MESH_PATH_UPDATE_FLAG_HOPCOUNT;
++
++	status = (nss_tx_status_t)nss_wifi_meshmgr_mesh_proxy_path_update(arvif->nss.mesh_handle,
++							 msg, msg_cb, ar->ab);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ar->ab,
++			    "failed to update mpp da %pM mesh_da %pM status %d\n",
++			    path->da, path->mesh_da, status);
++		ret = -EINVAL;
++	}
++
++	kfree(msg);
++
++	return ret;
++}
++
++static int ath11k_nss_mesh_mpp_del_cmd(struct ath11k_vif *arvif,
++			      struct ieee80211_mesh_path_offld *path)
++{
++	nss_wifi_mesh_msg_callback_t msg_cb;
++	struct nss_wifi_mesh_proxy_path_del_msg *msg;
++	struct ath11k *ar = arvif->ar;
++	nss_tx_status_t status;
++	int ret = 0;
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_NSS_MESH, "del mpath for mesh_da %pM\n",
++		   path->mesh_da);
++
++	msg = kzalloc(sizeof(struct nss_wifi_mesh_proxy_path_del_msg), GFP_ATOMIC);
++	if (!msg)
++		return -ENOMEM;
++
++	msg_cb = (nss_wifi_mesh_msg_callback_t)ath11k_nss_mesh_wifili_event_receive;
++
++	ether_addr_copy(msg->dest_mac_addr, path->da);
++	ether_addr_copy(msg->mesh_dest_mac_addr, path->mesh_da);
++
++	status = (nss_tx_status_t)nss_wifi_meshmgr_mesh_proxy_path_delete(arvif->nss.mesh_handle, msg,
++							 msg_cb, ar->ab);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ar->ab,
++			    "failed to add mpath entry mesh_da %pM status %d\n",
++			    path->mesh_da, status);
++		ret = -EINVAL;
++	}
++
++	kfree(msg);
++
++	return ret;
++}
++
++int ath11k_nss_mesh_config_path(struct ath11k *ar, struct ath11k_vif *arvif,
++				enum ieee80211_mesh_path_offld_cmd cmd,
++				struct ieee80211_mesh_path_offld *path)
++{
++	int ret;
++
++
++	if (!ar->ab->nss.enabled)
++		return 0;
++
++	switch (cmd) {
++	case IEEE80211_MESH_PATH_OFFLD_CMD_ADD_MPATH:
++		ret = ath11k_nss_mesh_mpath_add(arvif, path);
++		break;
++	case IEEE80211_MESH_PATH_OFFLD_CMD_UPDATE_MPATH:
++		ret = ath11k_nss_mesh_mpath_update(arvif, path);
++		break;
++	case IEEE80211_MESH_PATH_OFFLD_CMD_DELETE_MPATH:
++		ret = ath11k_nss_mesh_mpath_del(arvif, path);
++		break;
++	case IEEE80211_MESH_PATH_OFFLD_CMD_ADD_MPP:
++		ret = ath11k_nss_mesh_mpp_add_cmd(arvif, path);
++		break;
++	case IEEE80211_MESH_PATH_OFFLD_CMD_UPDATE_MPP:
++		ret = ath11k_nss_mesh_mpp_update_cmd(arvif, path);
++		break;
++	case IEEE80211_MESH_PATH_OFFLD_CMD_DELETE_MPP:
++		ret = ath11k_nss_mesh_mpp_del_cmd(arvif, path);
++		break;
++	default:
++		ath11k_warn(ar->ab, "unknown mesh path table command type %d\n", cmd);
++		return -EINVAL;
++	}
++
++	return ret;
++}
++
++int ath11k_nss_mesh_config_update(struct ieee80211_vif *vif, int changed)
++{
++	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
++	struct ath11k_base *ab = arvif->ar->ab;
++	struct nss_wifi_mesh_config_msg *nss_msg;
++	struct arvif_nss *nss = &arvif->nss;
++	nss_tx_status_t status;
++	int ret = 0;
++
++	if (!ab->nss.enabled)
++		return 0;
++
++	if (!ab->nss.mesh_nss_offload_enabled)
++		return -ENOTSUPP;
++
++	if (!changed)
++		return 0;
++
++	nss_msg = kzalloc(sizeof(*nss_msg), GFP_KERNEL);
++	if (!nss_msg)
++		return -ENOMEM;
++
++	if (changed & BSS_CHANGED_NSS_MESH_TTL) {
++		nss_msg->ttl = vif->bss_conf.nss_offld_ttl;
++		nss->mesh_ttl = vif->bss_conf.nss_offld_ttl;
++		nss_msg->config_flags |= NSS_WIFI_MESH_CONFIG_FLAG_TTL_VALID;
++	}
++
++	if (changed & BSS_CHANGED_NSS_MESH_REFRESH_TIME) {
++		nss_msg->mesh_path_refresh_time =
++			vif->bss_conf.nss_offld_mpath_refresh_time;
++		nss->mpath_refresh_time =
++			vif->bss_conf.nss_offld_mpath_refresh_time;
++		nss_msg->config_flags |= NSS_WIFI_MESH_CONFIG_FLAG_MPATH_REFRESH_VALID;
++	}
++
++	if (changed & BSS_CHANGED_NSS_MESH_FWD_ENABLED) {
++		nss_msg->block_mesh_forwarding =
++			vif->bss_conf.nss_offld_mesh_forward_enabled;
++		nss->mesh_forward_enabled =
++			vif->bss_conf.nss_offld_mesh_forward_enabled;
++		nss_msg->config_flags |= NSS_WIFI_MESH_CONFIG_FLAG_BLOCK_MESH_FWD_VALID;
++		nss_msg->metadata_type = arvif->nss.metadata_type;
++		nss_msg->config_flags |= NSS_WIFI_MESH_CONFIG_FLAG_METADATA_ENABLE_VALID;
++	}
++
++	status = (nss_tx_status_t)nss_wifi_meshmgr_mesh_config_update_sync(arvif->nss.mesh_handle,
++							  nss_msg);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ab, "failed to configure nss mesh obj vdev nss_err:%d\n",
++				status);
++		ret = -EINVAL;
++	}
++
++	kfree(nss_msg);
++
++	return ret;
++}
++#endif
++
++int ath11k_nss_dump_mpath_request(struct ath11k_vif *arvif)
++{
++	struct ath11k_base *ab = arvif->ar->ab;
++	struct ath11k *ar = arvif->ar;
++	struct arvif_nss *nss = &arvif->nss;
++	struct ath11k_nss_mpath_entry *entry, *tmp;
++	LIST_HEAD(local_entry);
++	nss_tx_status_t status;
++
++	/* Clean up any stale entries from old events */
++	spin_lock_bh(&ar->nss.dump_lock);
++	list_splice_tail(&nss->mpath_dump, &local_entry);
++	arvif->nss.mpath_dump_num_entries = 0;
++	spin_unlock_bh(&ar->nss.dump_lock);
++
++	list_for_each_entry_safe(entry, tmp, &local_entry, list)
++		kfree(entry);
++
++	status = (nss_tx_status_t)nss_wifi_meshmgr_dump_mesh_path_sync(arvif->nss.mesh_handle);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ab, "failed to send mpath dump command on mesh obj vdev nss_err:%d\n",
++				status);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++int ath11k_nss_dump_mpp_request(struct ath11k_vif *arvif)
++{
++	struct ath11k_base *ab = arvif->ar->ab;
++	struct ath11k *ar = arvif->ar;
++	struct arvif_nss *nss = &arvif->nss;
++	struct ath11k_nss_mpp_entry *entry, *tmp;
++	LIST_HEAD(local_entry);
++	nss_wifi_meshmgr_status_t status;
++
++	if (!arvif->nss.mpp_aging) {
++		/* Clean up any stale entries from old events */
++		spin_lock_bh(&ar->nss.dump_lock);
++		list_splice_tail_init(&nss->mpp_dump, &local_entry);
++		arvif->nss.mpp_dump_num_entries = 0;
++		spin_unlock_bh(&ar->nss.dump_lock);
++
++		list_for_each_entry_safe(entry, tmp, &local_entry, list) {
++			list_del(&entry->list);
++			kfree(entry);
++		}
++	}
++
++	arvif->nss.mpp_dump_req = true;
++
++	status = nss_wifi_meshmgr_dump_mesh_proxy_path_sync(arvif->nss.mesh_handle);
++	if (status != NSS_WIFI_MESHMGR_SUCCESS) {
++		if (status == NSS_WIFI_MESHMGR_FAILURE_ONESHOT_ALREADY_ATTACHED)
++			return 0;
++		ath11k_warn(ab, "failed to send mpp dump command on mesh obj vdev nss_err:%d\n",
++			    status);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++void ath11k_nss_mpp_timer_cb(struct timer_list *timer)
++{
++	nss_wifi_mesh_msg_callback_t msg_cb;
++	struct arvif_nss *nss = from_timer(nss, timer,mpp_expiry_timer);
++	struct ath11k_vif *arvif = container_of(nss, struct ath11k_vif, nss);
++	struct ath11k_base *ab = arvif->ar->ab;
++	LIST_HEAD(local_entry);
++	nss_tx_status_t status;
++
++	msg_cb = (nss_wifi_mesh_msg_callback_t)ath11k_nss_mesh_wifili_event_receive;
++
++	if (!arvif->nss.mpp_dump_req)
++		arvif->nss.mpp_dump_num_entries = 0;
++	arvif->nss.mpp_aging = true;
++
++	status = (nss_tx_status_t)nss_wifi_meshmgr_dump_mesh_proxy_path(arvif->nss.mesh_handle, msg_cb, ab);
++	if (status != NSS_TX_SUCCESS)
++		ath11k_warn(ab, "failed to send mpp dump command from timer nss_err:%d\n",
++				status);
++
++	mod_timer(&nss->mpp_expiry_timer,
++		 jiffies + msecs_to_jiffies(ATH11K_MPP_EXPIRY_TIMER_INTERVAL_MS));
++
++}
++
++static void
++ath11k_nss_mesh_obj_vdev_data_receive(struct net_device *dev, struct sk_buff *skb,
++				      struct napi_struct *napi)
++{
++	struct ath11k_vif *arvif;
++	struct ath11k_base *ab;
++	char dump_msg[100] = {0};
++	struct nss_wifi_mesh_per_packet_metadata *wifi_metadata = NULL;
++
++	arvif = ath11k_nss_get_arvif_from_dev(dev);
++	if (!arvif) {
+ 		dev_kfree_skb_any(skb);
+ 		return;
+ 	}
+ 
++	ab = arvif->ar->ab;
++
++	skb->dev = dev;
++
++	snprintf(dump_msg, sizeof(dump_msg), "nss mesh obj vdev: link id %d ",
++		 arvif->nss.if_num);
++
++	ath11k_dbg_dump(ab, ATH11K_DBG_DP_RX, "dp rx msdu from nss", dump_msg,
++			skb->data, skb->len);
++
++	if (arvif->nss.metadata_type == NSS_WIFI_MESH_PRE_HEADER_80211) {
++		wifi_metadata = (struct nss_wifi_mesh_per_packet_metadata *)(skb->data -
++				(sizeof(struct nss_wifi_mesh_per_packet_metadata)));
++
++		ath11k_dbg(ab, ATH11K_DBG_NSS_MESH,
++				"exception from nss on mesh obj vap: pkt_type %d\n",
++				wifi_metadata->pkt_type);
++		switch (wifi_metadata->pkt_type) {
++		case NSS_WIFI_MESH_PRE_HEADER_80211:
++			ath11k_dbg_dump(ab, ATH11K_DBG_DP_RX, "",
++					"wifi header from nss on mesh obj vdev: ",
++					skb->data - sizeof(*wifi_metadata), sizeof(*wifi_metadata) + skb->len);
++			dev_kfree_skb_any(skb);
++		break;
++		default:
++			dev_kfree_skb_any(skb);
++		}
++
++		return;
++	}
++
++	ath11k_nss_deliver_rx(arvif->vif, skb, true, 0, napi);
++}
++
++static void
++ath11k_nss_mesh_obj_ext_data_callback(struct net_device *dev, struct sk_buff *skb,
++				      __attribute__((unused)) struct napi_struct *napi)
++{
++	struct ath11k_vif *arvif;
++	struct ath11k_base *ab;
++	struct nss_wifi_mesh_encap_ext_pkt_metadata *wifi_metadata = NULL;
++	int metadata_len;
++
++	arvif = ath11k_nss_get_arvif_from_dev(dev);
++	if (!arvif) {
++		dev_kfree_skb_any(skb);
++		return;
++	}
++
++	ab = arvif->ar->ab;
++
++	skb->dev = dev;
++
++	metadata_len = NSS_WIFI_MESH_ENCAP_METADATA_OFFSET_TYPE +
++		sizeof(struct nss_wifi_mesh_encap_ext_pkt_metadata);
++
++	/* msdu from nss should contain metadata in headroom
++	 * any msdu which has invalid or not contains metadata
++	 * will be treated as invalid msdu and dropping it.
++	 */
++	if (!(metadata_len < skb_headroom(skb))) {
++		ath11k_warn(ab, "msdu from nss is having invalid headroom %d\n", skb_headroom(skb));
++		dev_kfree_skb_any(skb);
++		return;
++	}
++
++	dma_unmap_single(ab->dev, virt_to_phys(skb->head),
++			metadata_len,
++			DMA_FROM_DEVICE);
++
++	wifi_metadata = (struct nss_wifi_mesh_encap_ext_pkt_metadata *)(skb->head +
++			NSS_WIFI_MESH_ENCAP_METADATA_OFFSET_TYPE);
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS_MESH, "msdu from nss ext_data _cb on mesh obj vdev");
++
++	switch (wifi_metadata->pkt_type) {
++		case NSS_WIFI_MESH_ENCAP_EXT_DATA_PKT_TYPE_MPATH_NOT_FOUND_EXC:
++			ath11k_dbg_dump(ab, ATH11K_DBG_DP_RX, "", "msdu from nss ext_data for mpath not found : ",
++					skb->data, skb->len);
++			skb->protocol = eth_type_trans(skb, dev);
++			skb_reset_network_header(skb);
++			dev_queue_xmit(skb);
++		break;
++		default:
++			ath11k_warn(ab, "unknown packet type received in mesh obj ext data %d",
++					wifi_metadata->pkt_type);
++			dev_kfree_skb_any(skb);
++	}
++}
++
++static void
++ath11k_nss_mesh_link_vdev_data_receive(struct net_device *dev,
++				       struct sk_buff *skb,
++				       struct napi_struct *napi)
++{
++	struct ieee80211_vif *vif;
++	struct ath11k_vif *arvif;
++	struct ath11k_base *ab;
++	struct wireless_dev *wdev = (struct wireless_dev *)dev;
++
+ 	vif = wdev_to_ieee80211_vif(wdev);
+ 	if (!vif) {
+ 		dev_kfree_skb_any(skb);
+@@ -906,23 +1941,81 @@ ath11k_nss_ext_vdev_data_receive(struct
+ 	}
+ 
+ 	ab = arvif->ar->ab;
++	ath11k_dbg_dump(ab, ATH11K_DBG_DP_RX, "", "msdu from nss data_receive_cb on mesh link vdev: ",
++			skb->data, skb->len);
++	/* data callback for mesh link vap is not expected */
++	dev_kfree_skb_any(skb);
++}
+ 
+-	skb->dev = dev;
++static void
++ath11k_nss_mesh_link_vdev_special_data_receive(struct net_device *dev,
++				struct sk_buff *skb,
++				__attribute__((unused)) struct napi_struct *napi)
++{
++	struct ieee80211_vif *vif;
++	struct ath11k_base *ab;
++	struct nss_wifi_vdev_per_packet_metadata *wifi_metadata = NULL;
++	struct ath11k_skb_rxcb *rxcb;
++	struct ath11k_vif *arvif;
++	struct wireless_dev *wdev = (struct wireless_dev *)dev;
+ 
+-	/* log the original skb received from nss */
+-	ath11k_dbg_dump(ab, ATH11K_DBG_DP_RX, "", "dp rx msdu from nss ext : ",
+-			skb->data, skb->len);
++	vif = wdev_to_ieee80211_vif(wdev);
++	if (!vif) {
++		dev_kfree_skb_any(skb);
++		return;
++	}
+ 
+-	ret = ath11k_nss_undecap(arvif, skb, &data_offs, &eth_decap);
+-	if (ret) {
+-		ath11k_warn(ab, "error in nss ext rx undecap, type %d err %d\n",
+-			    arvif->nss.decap, ret);
++	arvif = (struct ath11k_vif *)vif->drv_priv;
++	if (!arvif) {
+ 		dev_kfree_skb_any(skb);
+ 		return;
+ 	}
+ 
+-	ath11k_nss_deliver_rx(arvif->vif, skb, eth_decap, data_offs, napi);
++	ab = arvif->ar->ab;
++
++	wifi_metadata = (struct nss_wifi_vdev_per_packet_metadata *)(skb->head +
++			NSS_WIFI_VDEV_PER_PACKET_METADATA_OFFSET);
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS_MESH,
++		   "dp special data from nss on mesh link vap: pkt_type %d\n",
++		   wifi_metadata->pkt_type);
++
++	switch (wifi_metadata->pkt_type) {
++	case NSS_WIFI_VDEV_MESH_EXT_DATA_PKT_TYPE_RX_SPL_PACKET:
++		ath11k_dbg_dump(ab, ATH11K_DBG_DP_RX, "",
++				"special packet meta data from nss on mesh link vdev: ",
++				wifi_metadata,
++				sizeof(struct nss_wifi_vdev_per_packet_metadata));
++		ath11k_dbg_dump(ab, ATH11K_DBG_DP_RX, "",
++				"special packet payload from nss on mesh link vdev: ",
++				skb->data, skb->len);
++		dev_kfree_skb_any(skb);
++		break;
++	case NSS_WIFI_VDEV_EXT_DATA_PKT_TYPE_MCBC_RX:
++		ath11k_dbg_dump(ab, ATH11K_DBG_DP_RX, "",
++				"mcast packet exception from nss on mesh link vdev: ",
++				skb->data, skb->len);
++		rxcb = ATH11K_SKB_RXCB(skb);
++		rxcb->rx_desc = (struct hal_rx_desc *)skb->head;
++		rxcb->is_first_msdu = rxcb->is_last_msdu = true;
++		rxcb->is_continuation = false;
++		rxcb->is_mcbc = true;
++		ath11k_dp_rx_from_nss(arvif->ar, skb, napi);
++		break;
++	case NSS_WIFI_VDEV_EXT_DATA_PKT_TYPE_MESH:
++		ath11k_dbg_dump(ab, ATH11K_DBG_DP_RX, "",
++				"static exception path from nss on mesh link vdev: ",
++				skb->data, skb->len);
++		dev_kfree_skb_any(skb);
++		break;
++	default:
++		ath11k_warn(ab, "unknown packet type received in mesh link vdev %d",
++			    wifi_metadata->pkt_type);
++		dev_kfree_skb_any(skb);
++		break;
++	}
+ }
++#endif
+ 
+ int ath11k_nss_tx(struct ath11k_vif *arvif, struct sk_buff *skb)
+ {
+@@ -930,8 +2023,9 @@ int ath11k_nss_tx(struct ath11k_vif *arv
+ 	nss_tx_status_t status;
+ 	int encap_type = ath11k_dp_tx_get_encap_type(arvif, skb);
+ 	struct ath11k_soc_dp_stats *soc_stats = &ar->ab->soc_stats;
++	char dump_msg[100] = {0};
+ 
+-	if (encap_type != arvif->nss.encap) {
++	if (!arvif->ar->ab->nss.debug_mode && encap_type != arvif->nss.encap) {
+ 		ath11k_warn(ar->ab, "encap mismatch in nss tx skb encap type %d" \
+ 			    " vif encap type %d\n", encap_type, arvif->nss.encap);
+ 		goto drop;
+@@ -946,16 +2040,45 @@ int ath11k_nss_tx(struct ath11k_vif *arv
+ 		ath11k_nss_tx_encap_nwifi(skb);
+ 
+ send:
+-	ath11k_dbg_dump(ar->ab, ATH11K_DBG_DP_TX,
+-			arvif->vif->type == NL80211_IFTYPE_AP_VLAN ? "ext vdev" : "",
+-			"nss tx msdu: ", skb->data, skb->len);
+-
+-	if (arvif->vif->type == NL80211_IFTYPE_AP_VLAN)
++	if (arvif->vif->type == NL80211_IFTYPE_AP_VLAN) {
++		ath11k_dbg_dump(ar->ab, ATH11K_DBG_DP_TX, "ext vdev",
++				"nss tx msdu: ", skb->data, skb->len);
+ 		status = nss_wifi_ext_vdev_tx_buf(arvif->nss.ctx, skb,
+ 						  arvif->nss.if_num);
+-	else
+-		status = nss_wifi_vdev_tx_buf(arvif->ar->nss.ctx, skb,
+-					      arvif->nss.if_num);
++	} else {
++		if (arvif->ar->ab->nss.debug_mode) {
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++			if (encap_type == HAL_TCL_ENCAP_TYPE_ETHERNET &&
++			    !is_multicast_ether_addr(skb->data)) {
++				snprintf(dump_msg, sizeof(dump_msg),
++					 "nss tx ucast msdu: %d ",
++					 arvif->nss.mesh_handle);
++				ath11k_dbg_dump(ar->ab, ATH11K_DBG_DP_TX, "mesh",
++						dump_msg, skb->data, skb->len);
++				status = (nss_tx_status_t)nss_wifi_meshmgr_tx_buf(arvif->nss.mesh_handle,
++								 skb);
++			} else {
++#endif
++				snprintf(dump_msg, sizeof(dump_msg),
++					 "nss tx mcast msdu: %d ",
++					 arvif->nss.if_num);
++				ath11k_dbg_dump(ar->ab, ATH11K_DBG_DP_TX, "mesh",
++						dump_msg, skb->data, skb->len);
++				status = nss_wifi_vdev_tx_buf(arvif->ar->nss.ctx, skb,
++							      arvif->nss.if_num);
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++			}
++#endif
++		} else {
++			snprintf(dump_msg, sizeof(dump_msg),
++				 "nss tx msdu: %d ",
++				 arvif->nss.if_num);
++			ath11k_dbg_dump(ar->ab, ATH11K_DBG_DP_TX, "",
++					dump_msg, skb->data, skb->len);
++			status = nss_wifi_vdev_tx_buf(arvif->ar->nss.ctx, skb,
++						      arvif->nss.if_num);
++		}
++	}
+ 
+ 	if (status != NSS_TX_SUCCESS) {
+ 		ath11k_dbg(ar->ab, (ATH11K_DBG_NSS | ATH11K_DBG_DP_TX),
+@@ -1057,6 +2180,9 @@ static int ath11k_nss_vdev_configure(str
+ 
+ 	vdev_cfg = &vdev_msg->msg.vdev_config;
+ 
++	if (arvif->vif->type == NL80211_IFTYPE_MESH_POINT)
++		vdev_cfg->vap_ext_mode = WIFI_VDEV_EXT_MODE_MESH_LINK;
++
+ 	vdev_cfg->radio_ifnum = ar->nss.if_num;
+ 	vdev_cfg->vdev_id = arvif->vdev_id;
+ 
+@@ -1095,6 +2221,39 @@ free:
+ 	return ret;
+ }
+ 
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++static int ath11k_nss_mesh_obj_assoc_link_vap(struct ath11k_vif *arvif)
++{
++	struct nss_wifi_mesh_assoc_link_vap *msg;
++	struct ath11k_base *ab = arvif->ar->ab;
++	nss_tx_status_t status;
++	int ret;
++
++	msg = kzalloc(sizeof(struct nss_wifi_mesh_assoc_link_vap), GFP_ATOMIC);
++	if (!msg)
++		return -ENOMEM;
++
++	msg->link_vap_id = arvif->nss.if_num;
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS_MESH, "nss mesh assoc link vap %d, mesh handle %d\n",
++		   arvif->nss.if_num, arvif->nss.mesh_handle);
++
++	status = (nss_tx_status_t)nss_wifi_meshmgr_assoc_link_vap_sync(arvif->nss.mesh_handle, msg);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ab, "failed mesh obj vdev tx msg for assoc link vap nss_err:%d\n",
++			    status);
++		ret = -EINVAL;
++		goto free;
++	}
++
++	ret = 0;
++free:
++	kfree(msg);
++
++	return ret;
++}
++#endif
++
+ static void ath11k_nss_vdev_unregister(struct ath11k_vif *arvif)
+ {
+ 	struct ath11k_base *ab = arvif->ar->ab;
+@@ -1106,6 +2265,14 @@ static void ath11k_nss_vdev_unregister(s
+ 		ath11k_dbg(ab, ATH11K_DBG_NSS, "unregistered nss vdev %d \n",
+ 			   arvif->nss.if_num);
+ 		break;
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++	case NL80211_IFTYPE_MESH_POINT:
++		nss_unregister_wifi_vdev_if(arvif->nss.if_num);
++		ath11k_dbg(ab, ATH11K_DBG_NSS,
++			   "unregistered nss mesh vdevs mesh link %d\n",
++			   arvif->nss.if_num);
++		break;
++#endif
+ 	default:
+ 		ath11k_warn(ab, "unsupported interface type %d for nss vdev unregister\n",
+ 			    arvif->vif->type);
+@@ -1113,6 +2280,78 @@ static void ath11k_nss_vdev_unregister(s
+ 	}
+ }
+ 
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++static int ath11k_nss_mesh_alloc_register(struct ath11k_vif *arvif,
++					 struct net_device *netdev)
++{
++	struct ath11k_base *ab = arvif->ar->ab;
++	struct nss_wifi_mesh_config_msg *nss_msg;
++	struct arvif_nss *nss = &arvif->nss;
++	int ret = 0;
++
++	nss->mesh_ttl = ATH11K_MESH_DEFAULT_ELEMENT_TTL;
++	nss->mpath_refresh_time = 1000; /* msecs */
++	nss->mesh_forward_enabled = true;
++
++	nss_msg = kzalloc(sizeof(*nss_msg), GFP_KERNEL);
++	if (!nss_msg)
++		return -ENOMEM;
++
++	nss_msg->ttl = nss->mesh_ttl;
++	nss_msg->mesh_path_refresh_time = nss->mpath_refresh_time;
++	nss_msg->mpp_learning_mode = mpp_mode;
++	nss_msg->block_mesh_forwarding = 0;
++	ether_addr_copy(nss_msg->local_mac_addr, arvif->vif->addr);
++	nss_msg->config_flags =
++			 NSS_WIFI_MESH_CONFIG_FLAG_TTL_VALID		|
++			 NSS_WIFI_MESH_CONFIG_FLAG_MPATH_REFRESH_VALID	|
++			 NSS_WIFI_MESH_CONFIG_FLAG_MPP_LEARNING_MODE_VALID |
++			 NSS_WIFI_MESH_CONFIG_FLAG_BLOCK_MESH_FWD_VALID |
++			 NSS_WIFI_MESH_CONFIG_FLAG_LOCAL_MAC_VALID;
++
++	arvif->nss.mesh_handle = nss_wifi_meshmgr_if_create_sync(netdev, nss_msg,
++								 ath11k_nss_mesh_obj_vdev_data_receive,
++								 ath11k_nss_mesh_obj_ext_data_callback,
++								 ath11k_nss_mesh_obj_vdev_event_receive);
++	if (arvif->nss.mesh_handle == NSS_WIFI_MESH_HANDLE_INVALID) {
++		ath11k_warn(ab, "failed to create meshmgr\n");
++		ret = -EINVAL;
++	}
++
++	kfree(nss_msg);
++
++	return ret;
++}
++
++static int ath11k_nss_mesh_vdev_register(struct ath11k_vif *arvif,
++					 struct net_device *netdev)
++{
++	struct ath11k *ar = arvif->ar;
++	struct ath11k_base *ab = ar->ab;
++	nss_tx_status_t status;
++	u32 features = 0;
++
++	status = nss_register_wifi_vdev_if(ar->nss.ctx,
++				arvif->nss.if_num,
++				ath11k_nss_mesh_link_vdev_data_receive,
++				ath11k_nss_mesh_link_vdev_special_data_receive,
++				ath11k_nss_vdev_event_receive,
++				(struct net_device *)netdev->ieee80211_ptr,
++				features);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ab, "failed to register nss mesh link vdev if_num %d nss_err:%d\n",
++			    arvif->nss.if_num, status);
++		nss_unregister_wifi_vdev_if(arvif->nss.if_num);
++		return -EINVAL;
++	}
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS, "registered nss mesh link vdev if_num %d\n",
++		   arvif->nss.if_num);
++
++	return 0;
++}
++#endif
++
+ static int ath11k_nss_vdev_register(struct ath11k_vif *arvif,
+ 				    struct net_device *netdev)
+ {
+@@ -1140,6 +2379,15 @@ static int ath11k_nss_vdev_register(stru
+ 			   arvif->nss.if_num);
+ 
+ 		break;
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++	case NL80211_IFTYPE_MESH_POINT:
++		if (!ab->nss.mesh_nss_offload_enabled)
++			return -ENOTSUPP;
++
++		if (ath11k_nss_mesh_vdev_register(arvif, netdev))
++			return -EINVAL;
++		break;
++#endif
+ 	default:
+ 		ath11k_warn(ab, "unsupported interface type %d for nss vdev register\n",
+ 			    arvif->vif->type);
+@@ -1149,6 +2397,62 @@ static int ath11k_nss_vdev_register(stru
+ 	return 0;
+ }
+ 
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++static void ath11k_nss_mesh_vdev_free(struct ath11k_vif *arvif)
++{
++	struct ath11k_base *ab = arvif->ar->ab;
++	struct ath11k *ar = arvif->ar;
++	struct ath11k_nss_mpath_entry *mpath_entry, *mpath_tmp;
++	struct ath11k_nss_mpp_entry *mpp_entry, *mpp_tmp;
++	struct arvif_nss *nss = &arvif->nss, *nss_entry, *nss_tmp;
++	LIST_HEAD(mpath_local_entry);
++	LIST_HEAD(mpp_local_entry);
++	nss_tx_status_t status;
++
++	del_timer_sync(&nss->mpp_expiry_timer);
++
++	spin_lock_bh(&ar->nss.dump_lock);
++	list_splice_tail_init(&nss->mpath_dump, &mpath_local_entry);
++	spin_unlock_bh(&ar->nss.dump_lock);
++
++	list_for_each_entry_safe(mpath_entry, mpath_tmp, &mpath_local_entry, list) {
++		list_del(&mpath_entry->list);
++		kfree(mpath_entry);
++	}
++
++	spin_lock_bh(&ar->nss.dump_lock);
++	list_splice_tail_init(&nss->mpp_dump, &mpp_local_entry);
++	spin_unlock_bh(&ar->nss.dump_lock);
++
++	list_for_each_entry_safe(mpp_entry, mpp_tmp, &mpp_local_entry, list) {
++		list_del(&mpp_entry->list);
++		kfree(mpp_entry);
++	}
++
++	list_for_each_entry_safe(nss_entry, nss_tmp, &mesh_vaps, list)
++		list_del(&nss_entry->list);
++
++	status = nss_dynamic_interface_dealloc_node(
++						arvif->nss.if_num,
++						NSS_DYNAMIC_INTERFACE_TYPE_VAP);
++	if (status != NSS_TX_SUCCESS)
++		ath11k_warn(ab, "failed to free nss mesh link vdev nss_err:%d\n",
++			    status);
++	else
++		ath11k_dbg(ab, ATH11K_DBG_NSS,
++			   "nss mesh link vdev interface deallocated\n");
++
++	status = (nss_tx_status_t)nss_wifi_meshmgr_if_destroy_sync(arvif->nss.mesh_handle);
++
++	if (status != NSS_TX_SUCCESS)
++		ath11k_warn(ab, "failed to free nss mesh object vdev nss_err:%d\n",
++			    status);
++	else
++		ath11k_dbg(ab, ATH11K_DBG_NSS,
++			   "nss mesh object vdev interface deallocated\n");
++}
++#endif
++
+ void ath11k_nss_vdev_free(struct ath11k_vif *arvif)
+ {
+ 	struct ath11k_base *ab = arvif->ar->ab;
+@@ -1168,6 +2472,11 @@ void ath11k_nss_vdev_free(struct ath11k_
+ 				   "nss vdev interface deallocated\n");
+ 
+ 		return;
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++	case NL80211_IFTYPE_MESH_POINT:
++		ath11k_nss_mesh_vdev_free(arvif);
++		return;
++#endif
+ 	default:
+ 		ath11k_warn(ab, "unsupported interface type %d for nss vdev dealloc\n",
+ 			    arvif->vif->type);
+@@ -1175,11 +2484,96 @@ void ath11k_nss_vdev_free(struct ath11k_
+ 	}
+ }
+ 
+-static int ath11k_nss_vdev_alloc(struct ath11k_vif *arvif)
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++struct arvif_nss *ath11k_nss_find_arvif_by_if_num(int if_num)
++{
++	struct arvif_nss *nss;
++
++	list_for_each_entry(nss, &mesh_vaps, list) {
++		if (if_num == nss->if_num)
++			return nss;
++	}
++	return NULL;
++}
++
++int ath11k_nss_assoc_link_arvif_to_ifnum(struct ath11k_vif *arvif, int if_num)
++{
++	struct ath11k_base *ab = arvif->ar->ab;
++	struct ath11k_vif *arvif_link;
++	struct wireless_dev *wdev;
++	struct arvif_nss *nss;
++	int ret;
++
++	wdev = ieee80211_vif_to_wdev_relaxed(arvif->vif);
++	if (!wdev) {
++		ath11k_warn(ab, "ath11k_nss: wdev is null\n");
++		return -EINVAL;
++	}
++
++	if (!wdev->netdev) {
++		ath11k_warn(ab, "ath11k_nss: netdev is null\n");
++		return -EINVAL;
++	}
++
++	nss = ath11k_nss_find_arvif_by_if_num(if_num);
++	if (!nss) {
++		ath11k_warn(ab, "ath11k_nss: unable to find if_num %d\n",if_num);
++		return -EINVAL;
++	}
++
++	arvif_link = container_of(nss, struct ath11k_vif, nss);
++
++	ath11k_dbg(ab, ATH11K_DBG_NSS_MESH,
++		   "assoc link vap ifnum %d to mesh handle of link id %d\n",
++		   arvif_link->nss.if_num, arvif->nss.if_num);
++
++	arvif_link->nss.mesh_handle = arvif->nss.mesh_handle;
++
++	ret = ath11k_nss_mesh_obj_assoc_link_vap(arvif_link);
++	if (ret)
++		ath11k_warn(ab, "failed to associate link vap to mesh vap %d\n", ret);
++
++	return 0;
++}
++
++static int ath11k_nss_mesh_vdev_alloc(struct ath11k_vif *arvif,
++		struct net_device *netdev)
++{
++	struct ath11k_base *ab = arvif->ar->ab;
++	int if_num;
++
++	if (!ab->nss.mesh_nss_offload_enabled)
++		return -ENOTSUPP;
++
++	if_num = nss_dynamic_interface_alloc_node(NSS_DYNAMIC_INTERFACE_TYPE_VAP);
++	if (if_num < 0) {
++		ath11k_warn(ab, "failed to allocate nss mesh link vdev\n");
++		return -EINVAL;
++	}
++
++	arvif->nss.if_num = if_num;
++
++	INIT_LIST_HEAD(&arvif->nss.list);
++	list_add_tail(&arvif->nss.list, &mesh_vaps);
++
++	INIT_LIST_HEAD(&arvif->nss.mpath_dump);
++	init_completion(&arvif->nss.dump_mpath_complete);
++	INIT_LIST_HEAD(&arvif->nss.mpp_dump);
++	init_completion(&arvif->nss.dump_mpp_complete);
++
++	return 0;
++}
++#endif
++
++static int ath11k_nss_vdev_alloc(struct ath11k_vif *arvif,
++		struct net_device *netdev)
+ {
+ 	struct ath11k_base *ab = arvif->ar->ab;
+ 	enum nss_dynamic_interface_type if_type;
+ 	int if_num;
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++	int ret;
++#endif
+ 
+ 	/* Initialize completion for verifying NSS message response */
+ 	init_completion(&arvif->nss.complete);
+@@ -1201,6 +2595,16 @@ static int ath11k_nss_vdev_alloc(struct
+ 			   arvif->nss.if_num);
+ 
+ 		break;
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++	case NL80211_IFTYPE_MESH_POINT:
++		ret = ath11k_nss_mesh_vdev_alloc(arvif, netdev);
++		if (ret) {
++			ath11k_warn(ab, "failed to allocate nss vdev of mesh type %d\n",
++				    ret);
++			return ret;
++		}
++		break;
++#endif
+ 	default:
+ 		ath11k_warn(ab, "unsupported interface type %d for nss vdev alloc\n",
+ 			    arvif->vif->type);
+@@ -1238,7 +2642,7 @@ int ath11k_nss_vdev_create(struct ath11k
+ 		return -EINVAL;
+ 	}
+ 
+-	ret = ath11k_nss_vdev_alloc(arvif);
++	ret = ath11k_nss_vdev_alloc(arvif, wdev->netdev);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -1254,6 +2658,45 @@ int ath11k_nss_vdev_create(struct ath11k
+ 			goto unregister_vdev;
+ 
+ 		break;
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++	case NL80211_IFTYPE_MESH_POINT:
++		ret = ath11k_nss_mesh_alloc_register(arvif, wdev->netdev);
++		if (ret) {
++			ath11k_warn(ab, "failed to alloc and register mesh vap %d\n", ret);
++			goto unregister_vdev;
++		}
++
++		ret = ath11k_nss_vdev_configure(arvif);
++		if (ret) {
++			ath11k_warn(ab, "failed to configure nss mesh link vdev\n");
++			goto unregister_vdev;
++		}
++
++		ret = ath11k_nss_mesh_obj_assoc_link_vap(arvif);
++		if (ret) {
++			ath11k_warn(ab, "failed to associate link vap to mesh vap %d\n", ret);
++			goto unregister_vdev;
++		}
++
++		ret = ath11k_nss_vdev_set_cmd(arvif,
++					      ATH11K_NSS_WIFI_VDEV_CFG_MCBC_EXC_TO_HOST_CMD, 1);
++		if (ret) {
++			ath11k_warn(ab, "failed to enable mcast/bcast exception %d\n", ret);
++			goto unregister_vdev;
++		}
++
++		ath11k_debugfs_nss_mesh_vap_create(arvif);
++
++		/* This timer cb is called at specified
++		 * interval to update mpp exp timeout */
++		timer_setup(&arvif->nss.mpp_expiry_timer,
++				ath11k_nss_mpp_timer_cb, 0);
++
++		/* Start the initial timer in 2 secs */
++		mod_timer(&arvif->nss.mpp_expiry_timer,
++				jiffies + msecs_to_jiffies(2 * HZ));
++		break;
++#endif
+ 	default:
+ 		ret = -ENOTSUPP;
+ 		goto unregister_vdev;
+@@ -1310,6 +2753,15 @@ int ath11k_nss_vdev_up(struct ath11k_vif
+ 	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR)
+ 		return 0;
+ 
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++	if (arvif->vif->type == NL80211_IFTYPE_MESH_POINT) {
++		status = (nss_tx_status_t)nss_wifi_meshmgr_if_up(arvif->nss.mesh_handle);
++		if (status != NSS_TX_SUCCESS) {
++			ath11k_warn(ar->ab, "nss mesh vdev up error %d\n", status);
++			return -EINVAL;
++		}
++	}
++#endif
+ 	vdev_msg = kzalloc(sizeof(struct nss_wifi_vdev_msg), GFP_ATOMIC);
+ 	if (!vdev_msg)
+ 		return -ENOMEM;
+@@ -1357,6 +2809,15 @@ int ath11k_nss_vdev_down(struct ath11k_v
+ 	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR)
+ 		return 0;
+ 
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++	if (arvif->vif->type == NL80211_IFTYPE_MESH_POINT) {
++		status = (nss_tx_status_t)nss_wifi_meshmgr_if_down(arvif->nss.mesh_handle);
++		if (status != NSS_TX_SUCCESS) {
++			ath11k_warn(ar->ab, "nss mesh vdev up error %d\n", status);
++			return -EINVAL;
++		}
++	}
++#endif
+ 	vdev_msg = kzalloc(sizeof(struct nss_wifi_vdev_msg), GFP_ATOMIC);
+ 	if (!vdev_msg)
+ 		return -ENOMEM;
+@@ -2731,6 +4192,51 @@ static int ath11k_nss_get_dynamic_interf
+ 	}
+ }
+ 
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++static int ath11k_nss_mesh_capability(struct ath11k_base *ab)
++{
++	struct nss_wifili_msg *wlmsg = NULL;
++	nss_wifili_msg_callback_t msg_cb;
++	nss_tx_status_t status;
++	int ret = 0;
++
++	wlmsg = kzalloc(sizeof(struct nss_wifili_msg), GFP_ATOMIC);
++	if (!wlmsg)
++		return -ENOMEM;
++
++	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++
++	reinit_completion(&ab->nss.complete);
++
++	nss_cmn_msg_init(&wlmsg->cm, ab->nss.if_num,
++			 NSS_WIFILI_SEND_MESH_CAPABILITY_INFO,
++			 sizeof(struct nss_wifili_mesh_capability_info),
++			 msg_cb, NULL);
++
++	status = nss_wifili_tx_msg(ab->nss.ctx, wlmsg);
++	if (status != NSS_TX_SUCCESS) {
++		ath11k_warn(ab, "nss failed to get mesh capability msg %d\n", status);
++		ret = -EINVAL;
++		goto free;
++	}
++
++	ret = wait_for_completion_timeout(&ab->nss.complete,
++					  msecs_to_jiffies(ATH11K_NSS_MSG_TIMEOUT_MS));
++	if (!ret) {
++		ath11k_warn(ab, "timeout while waiting for mesh capability check\n");
++		ret = -ETIMEDOUT;
++		goto free;
++	}
++
++	kfree(wlmsg);
++	return 0;
++
++free:
++	kfree(wlmsg);
++	return ret;
++}
++#endif
++
+ static int ath11k_nss_init(struct ath11k_base *ab)
+ {
+ 	struct nss_wifili_init_msg *wim = NULL;
+@@ -2863,6 +4369,17 @@ static int ath11k_nss_init(struct ath11k
+ 
+ 	kfree(wlmsg);
+ 
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++	/* Create a mesh links read debugfs entry */
++	ath11k_debugfs_nss_soc_create(ab);
++
++	/* Check for mesh capability */
++	ret = ath11k_nss_mesh_capability(ab);
++
++	if (ret)
++		ath11k_err(ab, "Mesh offload is not enabled %d\n", ret);
++#endif
++
+ 	ath11k_dbg(ab, ATH11K_DBG_NSS, "NSS Init Message TX Success %p %d\n",
+ 		   ab->nss.ctx, ab->nss.if_num);
+ 	return 0;
+--- a/drivers/net/wireless/ath/ath11k/nss.h
++++ b/drivers/net/wireless/ath/ath11k/nss.h
+@@ -10,8 +10,12 @@
+ #ifdef CPTCFG_ATH11K_NSS_SUPPORT
+ #include <nss_api_if.h>
+ #include <nss_cmn.h>
+-
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++#include <nss_wifi_meshmgr.h>
++#endif
+ #endif
++#include "../../../../../net/mac80211/mesh.h"
++
+ struct ath11k;
+ struct ath11k_base;
+ struct ath11k_vif;
+@@ -23,8 +27,9 @@ struct hal_rx_user_status;
+ 
+ /* NSS DBG macro is not included as part of debug enum to avoid
+  * frequent changes during upgrade*/
+-#define ATH11K_DBG_NSS	0x40000000
+-#define ATH11K_DBG_NSS_WDS	0x80000000
++#define ATH11K_DBG_NSS		0x20000000
++#define ATH11K_DBG_NSS_WDS	0x40000000
++#define ATH11K_DBG_NSS_MESH	0x80000000
+ 
+ /* WIFILI Supported Target Types */
+ #define ATH11K_WIFILI_TARGET_TYPE_UNKNOWN   0xFF
+@@ -60,6 +65,7 @@ struct hal_rx_user_status;
+ /* Timeout for waiting for response from NSS on TX msg */
+ #define ATH11K_NSS_MSG_TIMEOUT_MS 5000
+ 
++#define ATH11K_MESH_DEFAULT_ELEMENT_TTL	31
+ /* Init Flags */
+ #define WIFILI_NSS_CCE_DISABLED 0x1
+ #define WIFILI_ADDTL_MEM_SEG_SET 0x000000002
+@@ -119,6 +125,8 @@ enum ath11k_nss_opmode {
+ 	ATH11K_NSS_OPMODE_MONITOR,
+ };
+ 
++#define ATH11K_MPP_EXPIRY_TIMER_INTERVAL_MS	60 * HZ
++
+ struct peer_stats {
+ 	u64 last_rx;
+ 	u64 last_ack;
+@@ -158,10 +166,30 @@ struct ath11k_nss_peer {
+ 	struct completion complete;
+ };
+ 
++struct ath11k_nss_mpath_entry {
++	struct list_head list;
++	u32 num_entries;
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++	struct nss_wifi_mesh_path_dump_entry mpath[0];
++#endif
++};
++
++struct ath11k_nss_mpp_entry {
++	struct list_head list;
++	u32 num_entries;
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++	struct nss_wifi_mesh_proxy_path_dump_entry mpp[0];
++#endif
++};
++
+ /* Structure to hold the vif related info for nss offload support */
+ struct arvif_nss {
+ 	/* dynamic ifnum allocated by nss driver for vif */
+ 	int if_num;
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++	/* mesh handle for mesh obj vap */
++	nss_wifi_mesh_handle_t mesh_handle;
++#endif
+ 	/* Used for completion status for vdev config nss messages */
+ 	struct completion complete;
+ 	/* Keep the copy of encap type for nss */
+@@ -183,6 +211,25 @@ struct arvif_nss {
+ 	/* WDS cfg should be done only once for ext vdev */
+ 	bool wds_cfg_done;
+ 	bool created;
++
++	bool mpp_aging;
++	bool mpp_dump_req;
++	struct timer_list mpp_expiry_timer;
++	u8 mesh_ttl;
++	bool mesh_forward_enabled;
++	u32 metadata_type;
++	u32 mpath_refresh_time;
++
++	struct list_head list;
++	struct list_head mpath_dump;
++	/* total number of mpath entries in all of the mpath_dump list */
++	u32 mpath_dump_num_entries;
++	struct completion dump_mpath_complete;
++
++	struct list_head mpp_dump;
++	/* total number of mpp entries in all of the mpp_dump list */
++	u32 mpp_dump_num_entries;
++	struct completion dump_mpp_complete;
+ };
+ 
+ /* Structure to hold the pdev/radio related info for nss offload support */
+@@ -191,6 +238,8 @@ struct ath11k_nss {
+ 	int if_num;
+ 	/* Radio/pdev Context obtained on pdev register */
+ 	void* ctx;
++	/* protects stats from nss */
++	spinlock_t dump_lock;
+ };
+ 
+ /* Structure to hold the soc related info for nss offload support */
+@@ -199,6 +248,8 @@ struct ath11k_soc_nss {
+ 	bool enabled;
+ 	/* turn on/off nss stats support in ath11k */
+ 	bool stats_enabled;
++	/* Mesh offload support as advertised by nss */
++	bool mesh_nss_offload_enabled;
+ 	/* soc nss ctx */
+ 	void* ctx;
+ 	/* if_num to be used for soc related nss messages */
+@@ -261,6 +312,29 @@ void ath11k_nss_update_sta_rxrate(struct
+ int ath11k_nss_setup(struct ath11k_base *ab);
+ int ath11k_nss_teardown(struct ath11k_base *ab);
+ void ath11k_nss_ext_rx_stats(struct ath11k_base *ab, struct htt_rx_ring_tlv_filter *tlv_filter);
++int ath11k_nss_dump_mpath_request(struct ath11k_vif *arvif);
++int ath11k_nss_dump_mpp_request(struct ath11k_vif *arvif);
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++int ath11k_nss_mesh_config_path(struct ath11k *ar, struct ath11k_vif *arvif,
++				enum ieee80211_mesh_path_offld_cmd cmd,
++				struct ieee80211_mesh_path_offld *path);
++#else
++static inline int
++ath11k_nss_mesh_config_path(struct ath11k *ar, struct ath11k_vif *arvif,
++				enum ieee80211_mesh_path_offld_cmd cmd,
++				struct ieee80211_mesh_path_offld *path)
++{
++  return 0;
++}
++#endif
++int ath11k_nss_mesh_config_update(struct ieee80211_vif *vif, int changed);
++int ath11k_nss_assoc_link_arvif_to_ifnum(struct ath11k_vif *arvif, int if_num);
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++int ath11k_nss_mesh_exception_flags(struct ath11k_vif *arvif,
++			       struct nss_wifi_mesh_exception_flag_msg *nss_msg);
++int ath11k_nss_exc_rate_config(struct ath11k_vif *arvif,
++					struct nss_wifi_mesh_rate_limit_config *nss_exc_cfg);
++#endif
+ #else
+ static inline int ath11k_nss_tx(struct ath11k_vif *arvif, struct sk_buff *skb)
+ {
+@@ -431,5 +505,38 @@ static inline void ath11k_nss_ext_rx_sta
+ {
+ 	return;
+ }
++
++#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
++static inline int
++ath11k_nss_mesh_config_path(struct ath11k *ar, struct ath11k_vif *arvif,
++			    enum ieee80211_mesh_path_offld_cmd cmd,
++			    struct ieee80211_mesh_path_offld *path)
++{
++	return 0;
++}
++#endif
++static inline int
++ath11k_nss_mesh_config_update(struct ieee80211_vif *vif, int changed)
++{
++	return 0;
++}
++
++static inline int ath11k_nss_assoc_link_arvif_to_ifnum(struct ath11k_vif *arvif,
++						       int if_num)
++{
++	return 0;
++}
++
++static inline int ath11k_nss_mesh_exception_flags(struct ath11k_vif *arvif,
++						  void *nss_msg)
++{
++	return 0;
++}
++
++static inline int
++ath11k_nss_exc_rate_config(struct ath11k_vif *arvif, void *nss_exc_cfg)
++{
++	return 0;
++}
+ #endif /* CPTCFG_ATH11K_NSS_SUPPORT */
+ #endif
+--- a/drivers/net/wireless/ath/ath11k/debug.h
++++ b/drivers/net/wireless/ath/ath11k/debug.h
+@@ -10,6 +10,7 @@
+ #include "trace.h"
+ #include "debugfs.h"
+ 
++extern struct dentry *debugfs_ath11k;
+ enum ath11k_debug_mask {
+ 	ATH11K_DBG_AHB		= 0x00000001,
+ 	ATH11K_DBG_WMI		= 0x00000002,
+--- a/local-symbols
++++ b/local-symbols
+@@ -171,6 +171,7 @@ ATH11K=
+ ATH11K_AHB=
+ ATH11K_PCI=
+ ATH11K_NSS_SUPPORT=
++ATH11K_NSS_MESH_SUPPORT=
+ ATH11K_MEM_PROFILE_256M=
+ ATH11K_MEM_PROFILE_512M=
+ ATH11K_DEBUG=
+--- a/drivers/net/wireless/ath/ath11k/Kconfig
++++ b/drivers/net/wireless/ath/ath11k/Kconfig
+@@ -23,6 +23,15 @@ config ATH11K_NSS_SUPPORT
+ 
+ 	  If unsure, say Y to enable NSS offload support.
+ 
++config ATH11K_NSS_MESH_SUPPORT
++	bool "QCA ath11k nss mesh support"
++	depends on ATH11K_NSS_SUPPORT
++	default n
++	---help---
++	  Enables NSS offload support for ATH11K Mesh
++
++	  If unsure, say Y to enable NSS offload support.
++
+ config ATH11K_MEM_PROFILE_512M
+ 	bool "ath11k enable 512MB memory profile"
+ 	depends on ATH11K
diff --git a/package/kernel/mac80211/patches/ath11k_nss/908-301-ath11k-nss-mcbc-exception.patch b/package/kernel/mac80211/patches/nss/ath11k/301-ath11k-nss-mcbc-exception.patch
similarity index 70%
rename from package/kernel/mac80211/patches/ath11k_nss/908-301-ath11k-nss-mcbc-exception.patch
rename to package/kernel/mac80211/patches/nss/ath11k/301-ath11k-nss-mcbc-exception.patch
index 47c6b7ec3e5ae2..2fa70d0f395ab3 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/908-301-ath11k-nss-mcbc-exception.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/301-ath11k-nss-mcbc-exception.patch
@@ -16,7 +16,7 @@ Change-Id: I4a6ac67a1c2cf3ab7a219d0953907191606a5e70
 
 --- a/drivers/net/wireless/ath/ath11k/nss.c
 +++ b/drivers/net/wireless/ath/ath11k/nss.c
-@@ -611,7 +611,7 @@ static int ath11k_nss_undecap_nwifi(stru
+@@ -606,7 +606,7 @@ static int ath11k_nss_undecap_nwifi(stru
  
  static void ath11k_nss_wds_type_rx(struct ath11k *ar, struct net_device *dev,
  				   u8* src_mac, u8 is_sa_valid, u8 addr4_valid,
@@ -25,7 +25,7 @@ Change-Id: I4a6ac67a1c2cf3ab7a219d0953907191606a5e70
  {
  	struct ath11k_base *ab = ar->ab;
  	struct ath11k_ast_entry *ast_entry = NULL;
-@@ -647,8 +647,6 @@ static void ath11k_nss_wds_type_rx(struc
+@@ -642,8 +642,6 @@ static void ath11k_nss_wds_type_rx(struc
  			}
  		}
  
@@ -34,7 +34,7 @@ Change-Id: I4a6ac67a1c2cf3ab7a219d0953907191606a5e70
  	}
  
  	spin_unlock_bh(&ab->base_lock);
-@@ -692,8 +690,7 @@ static void ath11k_nss_mec_handler(struc
+@@ -687,8 +685,7 @@ static void ath11k_nss_mec_handler(struc
  
  static void ath11k_nss_vdev_spl_receive_ext_wdsdata(struct ath11k_vif *arvif,
  						    struct sk_buff *skb,
@@ -44,7 +44,7 @@ Change-Id: I4a6ac67a1c2cf3ab7a219d0953907191606a5e70
  {
  	struct ath11k *ar = arvif->ar;
  	struct ath11k_base *ab = ar->ab;
-@@ -715,7 +712,7 @@ static void ath11k_nss_vdev_spl_receive_
+@@ -710,7 +707,7 @@ static void ath11k_nss_vdev_spl_receive_
  	switch (wds_type) {
  		case NSS_WIFI_VDEV_WDS_TYPE_RX:
  			ath11k_nss_wds_type_rx(ar, skb->dev, src_mac, is_sa_valid,
@@ -53,25 +53,21 @@ Change-Id: I4a6ac67a1c2cf3ab7a219d0953907191606a5e70
  			break;
  		case NSS_WIFI_VDEV_WDS_TYPE_MEC:
  			ath11k_nss_mec_handler(ar, (u8 *)(skb->data));
-@@ -778,14 +775,16 @@ ath11k_nss_vdev_special_data_receive(str
- {
- 	struct nss_wifi_vdev_per_packet_metadata *wifi_metadata = NULL;
+@@ -775,10 +772,12 @@ ath11k_nss_vdev_special_data_receive(str
  	struct nss_wifi_vdev_wds_per_packet_metadata *wds_metadata = NULL;
-+	struct nss_wifi_vdev_addr4_data_metadata *addr4_metadata = NULL;
- 	struct wireless_dev *wdev;
- 	struct ieee80211_vif *vif;
  	struct ath11k_vif *arvif;
  	struct ath11k_base *ab;
 -	bool drop = false;
-+	struct ath11k_skb_rxcb *rxcb;
  	bool eth_decap = false;
  	int data_offs = 0;
  	int ret = 0;
++	struct nss_wifi_vdev_addr4_data_metadata *addr4_metadata = NULL;
++	struct ath11k_skb_rxcb *rxcb;
 +	struct ath11k_peer *ta_peer = NULL;
  
  	arvif = ath11k_nss_get_arvif_from_dev(dev);
  	if (!arvif) {
-@@ -843,15 +842,50 @@ ath11k_nss_vdev_special_data_receive(str
+@@ -810,15 +809,50 @@ ath11k_nss_vdev_special_data_receive(str
  		return;
  	}
  
@@ -130,7 +126,7 @@ Change-Id: I4a6ac67a1c2cf3ab7a219d0953907191606a5e70
  }
  
  static void
-@@ -1049,6 +1083,9 @@ int ath11k_nss_vdev_set_cmd(struct ath11
+@@ -2129,6 +2163,9 @@ int ath11k_nss_vdev_set_cmd(struct ath11
  	case ATH11K_NSS_WIFI_VDEV_CFG_WDS_BACKHAUL_CMD:
  		cmd = NSS_WIFI_VDEV_CFG_WDS_BACKHAUL_CMD;
  		break;
@@ -140,7 +136,7 @@ Change-Id: I4a6ac67a1c2cf3ab7a219d0953907191606a5e70
  	default:
  		return -EINVAL;
  	}
-@@ -1299,12 +1336,31 @@ int ath11k_nss_vdev_create(struct ath11k
+@@ -2651,12 +2688,31 @@ int ath11k_nss_vdev_create(struct ath11k
  		goto free_vdev;
  
  	switch (arvif->vif->type) {
@@ -171,18 +167,9 @@ Change-Id: I4a6ac67a1c2cf3ab7a219d0953907191606a5e70
 +			goto unregister_vdev;
 +		}
  		break;
- 	default:
- 		ret = -ENOTSUPP;
-@@ -1463,7 +1519,7 @@ int ath11k_nss_ext_vdev_cfg_wds_peer(str
- 
- 	cfg_wds_msg = &ext_vdev_msg->msg.wmsg;
- 	cfg_wds_msg->wds_peer_id = wds_peer_id;
--	ether_addr_copy(cfg_wds_msg->mac_addr, wds_addr);
-+	ether_addr_copy((u8 *) cfg_wds_msg->mac_addr, wds_addr);
- 
- 	nss_wifi_ext_vdev_msg_init(ext_vdev_msg, arvif->nss.if_num,
- 				   NSS_WIFI_EXT_VDEV_MSG_CONFIGURE_WDS,
-@@ -1587,7 +1643,6 @@ static int ath11k_nss_ext_vdev_register(
+ #ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
+ 	case NL80211_IFTYPE_MESH_POINT:
+@@ -2987,7 +3043,6 @@ static int ath11k_nss_ext_vdev_register(
  {
  	struct ath11k *ar = arvif->ar;
  	struct ath11k_base *ab = ar->ab;
@@ -190,7 +177,7 @@ Change-Id: I4a6ac67a1c2cf3ab7a219d0953907191606a5e70
  	u32 features = 0;
  
  	if (arvif->vif->type != NL80211_IFTYPE_AP_VLAN || arvif->nss.ctx)
-@@ -1601,7 +1656,7 @@ static int ath11k_nss_ext_vdev_register(
+@@ -3001,7 +3056,7 @@ static int ath11k_nss_ext_vdev_register(
  
  	if (!arvif->nss.ctx) {
  		ath11k_warn(ab, "failed to register nss vdev if_num %d nss_err:%d\n",
@@ -201,53 +188,16 @@ Change-Id: I4a6ac67a1c2cf3ab7a219d0953907191606a5e70
  
 --- a/drivers/net/wireless/ath/ath11k/nss.h
 +++ b/drivers/net/wireless/ath/ath11k/nss.h
-@@ -110,10 +110,14 @@ enum ath11k_nss_vdev_cmd {
+@@ -115,8 +115,12 @@ enum ath11k_nss_vdev_cmd {
  	ATH11K_NSS_WIFI_VDEV_ENCAP_TYPE_CMD,
  	ATH11K_NSS_WIFI_VDEV_DECAP_TYPE_CMD,
  	ATH11K_NSS_WIFI_VDEV_CFG_WDS_BACKHAUL_CMD,
 +	ATH11K_NSS_WIFI_VDEV_CFG_MCBC_EXC_TO_HOST_CMD,
  };
  
- #define WIFILI_SCHEME_ID_INVALID	-1
- 
 +/* Enables the MCBC exception in NSS fw, 1 = enable */
 +#define ATH11K_NSS_ENABLE_MCBC_EXC	1
 +
  enum ath11k_nss_opmode {
  	ATH11K_NSS_OPMODE_UNKNOWN,
  	ATH11K_NSS_OPMODE_AP,
---- a/drivers/net/wireless/ath/ath11k/dp_rx.c
-+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -3086,6 +3086,23 @@ static void ath11k_dp_rx_process_receive
- 	}
- }
- 
-+void ath11k_dp_rx_from_nss(struct ath11k *ar, struct sk_buff *msdu,
-+                           struct napi_struct *napi)
-+{
-+	struct ieee80211_rx_status rx_status = {0};
-+	struct ath11k_skb_rxcb *rxcb;
-+	bool fast_rx = false;
-+
-+	rxcb = ATH11K_SKB_RXCB(msdu);
-+
-+	ath11k_dp_rx_h_ppdu(ar, rxcb->rx_desc, &rx_status);
-+	ath11k_dp_rx_h_mpdu(ar, msdu, rxcb->rx_desc, &rx_status, &fast_rx);
-+
-+	rx_status.flag |= RX_FLAG_SKIP_MONITOR | RX_FLAG_DUP_VALIDATED;
-+
-+	ath11k_dp_rx_deliver_msdu(ar, napi, msdu, &rx_status);
-+}
-+
- int ath11k_dp_process_rx(struct ath11k_base *ab, int ring_id,
- 			 struct napi_struct *napi, int budget)
- {
---- a/drivers/net/wireless/ath/ath11k/dp_rx.h
-+++ b/drivers/net/wireless/ath/ath11k/dp_rx.h
-@@ -157,4 +157,6 @@ bool ath11k_dp_rx_h_attn_is_mcbc(struct
- 				 struct hal_rx_desc *desc);
- u16 ath11k_dp_rx_h_mpdu_start_peer_id(struct ath11k_base *ab,
- 				      struct hal_rx_desc *desc);
-+void ath11k_dp_rx_from_nss(struct ath11k *ar, struct sk_buff *msdu,
-+                           struct napi_struct *napi);
- #endif /* ATH11K_DP_RX_H */
diff --git a/package/kernel/mac80211/patches/nss/ath11k/314-ath11k-Fix-peer-lookup-failure-in-mgmt-tx-completion.patch b/package/kernel/mac80211/patches/nss/ath11k/314-ath11k-Fix-peer-lookup-failure-in-mgmt-tx-completion.patch
new file mode 100644
index 00000000000000..cb4fba0a2ffdcd
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/314-ath11k-Fix-peer-lookup-failure-in-mgmt-tx-completion.patch
@@ -0,0 +1,125 @@
+From e58249f0a5826926c0e96acea4dfbc8683cfaaab Mon Sep 17 00:00:00 2001
+From: Rameshkumar Sundaram <ramess@codeaurora.org>
+Date: Wed, 9 Jun 2021 17:32:30 +0530
+Subject: [PATCH] ath11k: Fix peer lookup failure in mgmt tx completion
+
+In mgmt tx completion handler, peer lookup is done using address 2
+of transmitted frame to find arvif and update mgmt tx completion stats.
+For STA interface, self peer will not be created and hence
+peer lookup with address 2 keeps failing.
+Fix this by obtaining vif directly from SKB_CB for updating stats.
+
+Possible vif removal races:
+1. If vif removed before tx completion all idrs associated to the vif
+would've been flushed and finding msdu with idr will fail,
+hence tx completion wont be processed therafter.
+2. Added data lock to protect vif removal during tx completion processing.
+
+Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/mac.c |  2 ++
+ drivers/net/wireless/ath/ath11k/wmi.c | 53 ++++++++++++++++-------------------
+ 2 files changed, 26 insertions(+), 29 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -7643,8 +7643,10 @@ err_vdev_del:
+ 	kfree(arvif->vlan_keyid_map);
+ 	ath11k_peer_cleanup(ar, arvif->vdev_id);
+ 
++	spin_lock_bh(&ar->data_lock);
+ 	idr_for_each(&ar->txmgmt_idr,
+ 		     ath11k_mac_vif_txmgmt_idr_remove, vif);
++	spin_unlock_bh(&ar->data_lock);
+ 
+ 	for (i = 0; i < DP_TCL_NUM_RING_MAX; i++) {
+ 		spin_lock_bh(&ab->dp.tx_ring[i].tx_idr_lock);
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -5966,13 +5966,13 @@ static int wmi_process_tx_comp(struct at
+ 	struct ieee80211_tx_info *info;
+ 	struct ath11k_skb_cb *skb_cb;
+ 	struct ieee80211_hdr *hdr;
+-	struct ath11k_peer *peer;
+ 	struct ieee80211_vif *vif;
+ 	struct ath11k_vif *arvif;
+ 	struct ath11k_mgmt_frame_stats *mgmt_stats;
+ 	u16 frm_type;
+ 	int num_mgmt;
+ 
++	spin_lock_bh(&ar->data_lock);
+ 	spin_lock_bh(&ar->txmgmt_idr_lock);
+ 	msdu = idr_find(&ar->txmgmt_idr, tx_compl_param->desc_id);
+ 
+@@ -5980,6 +5980,7 @@ static int wmi_process_tx_comp(struct at
+ 		ath11k_warn(ar->ab, "received mgmt tx compl for invalid msdu_id: %d\n",
+ 			    tx_compl_param->desc_id);
+ 		spin_unlock_bh(&ar->txmgmt_idr_lock);
++		spin_unlock_bh(&ar->data_lock);
+ 		return -ENOENT;
+ 	}
+ 
+@@ -5988,6 +5989,28 @@ static int wmi_process_tx_comp(struct at
+ 
+ 	skb_cb = ATH11K_SKB_CB(msdu);
+ 	dma_unmap_single(ar->ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
++	hdr = (struct ieee80211_hdr *)msdu->data;
++
++	if (ieee80211_is_mgmt(hdr->frame_control)) {
++		frm_type = FIELD_GET(IEEE80211_FCTL_STYPE, hdr->frame_control);
++		vif = skb_cb->vif;
++
++		if (!vif) {
++			ath11k_warn(ar->ab, "failed to find vif to update txcompl mgmt stats\n");
++			goto skip_mgmt_stats;
++		}
++
++		arvif = ath11k_vif_to_arvif(vif);
++		mgmt_stats = &arvif->mgmt_stats;
++
++		if (!tx_compl_param->status)
++			mgmt_stats->tx_compl_succ[frm_type]++;
++		else
++			mgmt_stats->tx_compl_fail[frm_type]++;
++	}
++
++skip_mgmt_stats:
++	spin_unlock_bh(&ar->data_lock);
+ 
+ 	info = IEEE80211_SKB_CB(msdu);
+ 	if ((!(info->flags & IEEE80211_TX_CTL_NO_ACK)) &&
+@@ -6003,34 +6026,6 @@ static int wmi_process_tx_comp(struct at
+ 	 */
+ 	info->status.rates[0].idx = -1;
+ 
+-	hdr = (struct ieee80211_hdr *)msdu->data;
+-	frm_type = FIELD_GET(IEEE80211_FCTL_STYPE, hdr->frame_control);
+-
+-	spin_lock_bh(&ar->ab->base_lock);
+-	peer = ath11k_peer_find_by_addr(ar->ab, hdr->addr2);
+-	if (!peer) {
+-		spin_unlock_bh(&ar->ab->base_lock);
+-		ath11k_warn(ar->ab, "failed to find peer to update txcompl mgmt stats\n");
+-		goto skip_mgmt_stats;
+-	}
+-
+-	vif = peer->vif;
+-	spin_unlock_bh(&ar->ab->base_lock);
+-
+-	spin_lock_bh(&ar->data_lock);
+-	arvif = ath11k_vif_to_arvif(vif);
+-	mgmt_stats = &arvif->mgmt_stats;
+-
+-	if (ieee80211_is_mgmt(hdr->frame_control)) {
+-		if (!tx_compl_param->status)
+-			mgmt_stats->tx_compl_succ[frm_type]++;
+-		else
+-			mgmt_stats->tx_compl_fail[frm_type]++;
+-	}
+-
+-	spin_unlock_bh(&ar->data_lock);
+-
+-skip_mgmt_stats:
+ 	ieee80211_tx_status_irqsafe(ar->hw, msdu);
+ 
+ 	num_mgmt = atomic_dec_if_positive(&ar->num_pending_mgmt_tx);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/318-ath11k-avoid-stack-corrupt-in-nwifi-undecap.patch b/package/kernel/mac80211/patches/nss/ath11k/318-ath11k-avoid-stack-corrupt-in-nwifi-undecap.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath11k_nss/318-ath11k-avoid-stack-corrupt-in-nwifi-undecap.patch
rename to package/kernel/mac80211/patches/nss/ath11k/318-ath11k-avoid-stack-corrupt-in-nwifi-undecap.patch
diff --git a/package/kernel/mac80211/patches/ath11k_nss/319-ath11k-fix-double-free-of-peer-rx_tid-during-reo-cmd.patch b/package/kernel/mac80211/patches/nss/ath11k/319-ath11k-fix-double-free-of-peer-rx_tid-during-reo-cmd.patch
similarity index 96%
rename from package/kernel/mac80211/patches/ath11k_nss/319-ath11k-fix-double-free-of-peer-rx_tid-during-reo-cmd.patch
rename to package/kernel/mac80211/patches/nss/ath11k/319-ath11k-fix-double-free-of-peer-rx_tid-during-reo-cmd.patch
index 7ea6b471e340aa..d733219b38aa7f 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/319-ath11k-fix-double-free-of-peer-rx_tid-during-reo-cmd.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/319-ath11k-fix-double-free-of-peer-rx_tid-during-reo-cmd.patch
@@ -30,7 +30,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/hw.c
 +++ b/drivers/net/wireless/ath/ath11k/hw.c
-@@ -1435,6 +1435,7 @@ const struct ath11k_hw_ring_mask ath11k_
+@@ -1332,6 +1332,7 @@ const struct ath11k_hw_ring_mask ath11k_
  		ATH11K_RX_WBM_REL_RING_MASK_0,
  	},
  	.reo_status = {
diff --git a/package/kernel/mac80211/patches/ath11k_nss/908-330-ath11k-sync-wds_ast_entry-updates.patch b/package/kernel/mac80211/patches/nss/ath11k/330-ath11k-sync-wds_ast_entry-updates.patch
similarity index 94%
rename from package/kernel/mac80211/patches/ath11k_nss/908-330-ath11k-sync-wds_ast_entry-updates.patch
rename to package/kernel/mac80211/patches/nss/ath11k/330-ath11k-sync-wds_ast_entry-updates.patch
index 6ebd709e7d3298..361c9064148acd 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/908-330-ath11k-sync-wds_ast_entry-updates.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/330-ath11k-sync-wds_ast_entry-updates.patch
@@ -56,7 +56,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  static void ath11k_ahb_free_resources(struct ath11k_base *ab)
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
-@@ -2230,6 +2230,7 @@ struct ath11k_base *ath11k_core_alloc(st
+@@ -2212,6 +2212,7 @@ struct ath11k_base *ath11k_core_alloc(st
  
  	mutex_init(&ab->core_lock);
  	mutex_init(&ab->tbl_mtx_lock);
@@ -64,7 +64,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  	spin_lock_init(&ab->base_lock);
  	mutex_init(&ab->vdev_id_11d_lock);
  	init_completion(&ab->reset_complete);
-@@ -2243,6 +2244,8 @@ struct ath11k_base *ath11k_core_alloc(st
+@@ -2225,6 +2226,8 @@ struct ath11k_base *ath11k_core_alloc(st
  	INIT_WORK(&ab->restart_work, ath11k_core_restart);
  	INIT_WORK(&ab->update_11d_work, ath11k_update_11d);
  	INIT_WORK(&ab->reset_work, ath11k_core_reset);
@@ -75,29 +75,27 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  	init_completion(&ab->wow.wakeup_completed);
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -32,6 +32,7 @@
+@@ -31,6 +31,7 @@
+ #include "wow.h"
  #include "rx_desc.h"
  #include "nss.h"
- #include "vendor.h"
 +#include "peer.h"
  
  #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
  
-@@ -1131,6 +1132,11 @@ struct ath11k_base {
+@@ -1080,6 +1081,9 @@ struct ath11k_base {
  
  	u32 max_ast_index;
  	u32 num_ast_entries;
-+
 +	struct mutex base_ast_lock;
 +	struct work_struct wmi_ast_work;
 +	struct list_head wmi_ast_list;
-+
+ 
+ 	bool stats_disable;
  	/* must be last */
- 	u8 drv_priv[] __aligned(sizeof(void *));
- };
 --- a/drivers/net/wireless/ath/ath11k/nss.c
 +++ b/drivers/net/wireless/ath/ath11k/nss.c
-@@ -691,8 +691,9 @@ static void ath11k_nss_wds_type_rx(struc
+@@ -647,8 +647,9 @@ static void ath11k_nss_wds_type_rx(struc
  	spin_unlock_bh(&ab->base_lock);
  }
  
@@ -108,7 +106,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  	struct ath11k_base *ab = ar->ab;
  	struct ath11k_peer *peer = ar->bss_peer;
  	u8 mac_addr[ETH_ALEN];
-@@ -719,7 +720,7 @@ static void ath11k_nss_mec_handler(struc
+@@ -675,7 +676,7 @@ static void ath11k_nss_mec_handler(struc
  	memcpy(mac_addr, mac_addr_h16, ETH_ALEN - 4);
  	memcpy(mac_addr + 2, mac_addr_l32, 4);
  
@@ -117,7 +115,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  		spin_lock_bh(&ab->base_lock);
  		ath11k_peer_add_ast(ar, peer, mac_addr,
  				    ATH11K_AST_TYPE_MEC);
-@@ -754,7 +755,7 @@ static void ath11k_nss_vdev_spl_receive_
+@@ -710,7 +711,7 @@ static void ath11k_nss_vdev_spl_receive_
  					       addr4_valid, peer_id);
  			break;
  		case NSS_WIFI_VDEV_WDS_TYPE_MEC:
@@ -126,7 +124,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  			break;
  		default:
  			ath11k_warn(ab, "unsupported wds_type %d\n", wds_type);
-@@ -3848,11 +3849,7 @@ int ath11k_nss_add_wds_peer(struct ath11
+@@ -3796,11 +3797,7 @@ int ath11k_nss_add_wds_peer(struct ath11
  	wds_peer_msg->ast_type = type;
  	wds_peer_msg->peer_id = peer->peer_id;
  
@@ -139,7 +137,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  	ether_addr_copy(wds_peer_msg->dest_mac, dest_mac);
  
  	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
-@@ -3975,7 +3972,7 @@ msg_free:
+@@ -3923,7 +3920,7 @@ msg_free:
  	return ret;
  }
  
@@ -148,7 +146,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  			    u8 *dest_mac)
  {
  	struct ath11k_base *ab = ar->ab;
-@@ -3993,8 +3990,8 @@ int ath11k_nss_del_wds_peer(struct ath11
+@@ -3941,8 +3938,8 @@ int ath11k_nss_del_wds_peer(struct ath11
  
  	wds_peer_msg->pdev_id = ar->pdev->pdev_id;
  	wds_peer_msg->ast_type = ATH11K_AST_TYPE_NONE;
@@ -161,7 +159,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
 --- a/drivers/net/wireless/ath/ath11k/nss.h
 +++ b/drivers/net/wireless/ath/ath11k/nss.h
-@@ -291,8 +291,8 @@ int ath11k_nss_update_wds_peer(struct at
+@@ -290,8 +290,8 @@ int ath11k_nss_update_wds_peer(struct at
  			       u8 *dest_mac);
  int ath11k_nss_map_wds_peer(struct ath11k *ar, struct ath11k_peer *peer,
  			    u8 *dest_mac, enum ath11k_ast_entry_type type);
@@ -172,7 +170,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  int ath11k_nss_ext_vdev_cfg_wds_peer(struct ath11k_vif *arvif,
  				     u8 *wds_addr, u32 wds_peer_id);
  int ath11k_nss_ext_vdev_wds_4addr_allow(struct ath11k_vif *arvif,
-@@ -404,8 +404,8 @@ static inline int ath11k_nss_map_wds_pee
+@@ -413,8 +413,8 @@ static inline int ath11k_nss_map_wds_pee
  	return 0;
  }
  
@@ -185,7 +183,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  }
 --- a/drivers/net/wireless/ath/ath11k/pci.c
 +++ b/drivers/net/wireless/ath/ath11k/pci.c
-@@ -970,6 +970,7 @@ static void ath11k_pci_remove(struct pci
+@@ -972,6 +972,7 @@ static void ath11k_pci_remove(struct pci
  	}
  
  	set_bit(ATH11K_FLAG_UNREGISTERING, &ab->dev_flags);
@@ -494,7 +492,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  	if (ret) {
 --- a/drivers/net/wireless/ath/ath11k/peer.h
 +++ b/drivers/net/wireless/ath/ath11k/peer.h
-@@ -31,9 +31,7 @@ enum ath11k_wds_wmi_action {
+@@ -42,9 +42,7 @@ enum ath11k_wds_wmi_action {
  struct ath11k_ast_entry {
  	u16 ast_idx;
  	u8 addr[ETH_ALEN];
@@ -504,15 +502,18 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  	struct ath11k_peer *peer;
  	struct ath11k *ar;
  	bool next_hop;
-@@ -47,6 +45,7 @@ struct ath11k_ast_entry {
- 	bool delete_in_progress;
+@@ -55,9 +53,9 @@ struct ath11k_ast_entry {
+ 	u16 ast_hash_value;
+ 	int ref_cnt;
+ 	enum ath11k_ast_entry_type type;
+-	bool delete_in_progress;
  	void *cookie;
  	struct list_head ase_list;
 +	struct list_head wmi_list;
  };
  
- struct ppdu_user_delayba {
-@@ -97,6 +96,7 @@ struct ath11k_peer {
+ struct ath11k_peer {
+@@ -97,6 +95,7 @@ struct ath11k_peer {
  	bool dp_setup_done;
  	struct ppdu_user_delayba ppdu_stats_delayba;
  	bool delayba_flag;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/911-335-0001-ath11k-optimize-tx-completions.patch b/package/kernel/mac80211/patches/nss/ath11k/335-0001-ath11k-optimize-tx-completions.patch
similarity index 82%
rename from package/kernel/mac80211/patches/ath11k_nss/911-335-0001-ath11k-optimize-tx-completions.patch
rename to package/kernel/mac80211/patches/nss/ath11k/335-0001-ath11k-optimize-tx-completions.patch
index 3cc13d1ba98543..60f3b246550641 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/911-335-0001-ath11k-optimize-tx-completions.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/335-0001-ath11k-optimize-tx-completions.patch
@@ -13,15 +13,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/dp_tx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
-@@ -439,6 +439,7 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
- 		return;
- 	}
- 
-+
- 	if (skb_cb->pkt_offset)
- 		skb_pull(msdu, skb_cb->pkt_offset); /* removing the alignment and htt meta data */
- 
-@@ -637,9 +638,41 @@ err_out:
+@@ -651,9 +651,41 @@ err_out:
  	spin_unlock_bh(&ab->base_lock);
  }
  
@@ -64,12 +56,11 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  {
  	struct ieee80211_tx_status status = { 0 };
  	struct ieee80211_rate_status status_rate = { 0 };
-@@ -649,9 +682,12 @@ static void ath11k_dp_tx_complete_msdu(s
+@@ -663,9 +695,11 @@ static void ath11k_dp_tx_complete_msdu(s
  	struct ath11k_peer *peer;
  	struct ath11k_sta *arsta;
  	struct rate_info rate;
 +	struct hal_tx_status ts = { 0 };
-+	enum hal_wbm_htt_tx_comp_status wbm_status;
 +	enum hal_wbm_tqm_rel_reason rel_status;
  	u8 flags = 0;
  
@@ -78,7 +69,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  		/* Must not happen */
  		return;
  	}
-@@ -660,11 +696,14 @@ static void ath11k_dp_tx_complete_msdu(s
+@@ -674,11 +708,14 @@ static void ath11k_dp_tx_complete_msdu(s
  
  	dma_unmap_single(ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
  
@@ -95,7 +86,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  		}
  		if (skb_has_frag_list(msdu)) {
  			kfree_skb_list(skb_shinfo(msdu)->frag_list);
-@@ -674,6 +713,8 @@ static void ath11k_dp_tx_complete_msdu(s
+@@ -688,6 +725,8 @@ static void ath11k_dp_tx_complete_msdu(s
  		return;
  	}
  
@@ -104,15 +95,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  	if (unlikely(!rcu_access_pointer(ab->pdevs_active[ar->pdev_idx]))) {
  		ieee80211_free_txskb(ar->hw, msdu);
  		return;
-@@ -684,54 +725,56 @@ static void ath11k_dp_tx_complete_msdu(s
- 		return;
- 	}
- 
-+	wbm_status = FIELD_GET(HTT_TX_WBM_COMP_INFO0_STATUS,
-+			       tx_status->info0);
- 	info = IEEE80211_SKB_CB(msdu);
- 	memset(&info->status, 0, sizeof(info->status));
- 
+@@ -704,48 +743,48 @@ static void ath11k_dp_tx_complete_msdu(s
  	/* skip tx rate update from ieee80211_status*/
  	info->status.rates[0].idx = -1;
  
@@ -173,7 +156,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  		spin_unlock_bh(&ab->base_lock);
  		ieee80211_free_txskb(ar->hw, msdu);
  		return;
-@@ -753,44 +796,13 @@ static void ath11k_dp_tx_complete_msdu(s
+@@ -767,37 +806,6 @@ static void ath11k_dp_tx_complete_msdu(s
  	ieee80211_tx_status_ext(ar->hw, &status);
  }
  
@@ -211,15 +194,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  static inline bool ath11k_dp_tx_completion_valid(struct hal_wbm_release_ring *desc)
  {
  	struct htt_tx_wbm_completion *status_desc;
- 
- 	if (FIELD_GET(HAL_WBM_RELEASE_INFO0_REL_SRC_MODULE, desc->info0) ==
- 	    HAL_WBM_REL_SRC_MODULE_FW) {
--		status_desc = ((u8 *)desc) + HTT_TX_WBM_COMP_STATUS_OFFSET;
-+		status_desc = ((struct htt_tx_wbm_completion *)desc) + HTT_TX_WBM_COMP_STATUS_OFFSET;
- 
- 		/* Dont consider HTT_TX_COMP_STATUS_MEC_NOTIFY */
- 		if (FIELD_GET(HTT_TX_WBM_COMP_INFO0_STATUS, status_desc->info0) ==
-@@ -807,9 +819,9 @@ void ath11k_dp_tx_completion_handler(str
+@@ -821,9 +829,9 @@ void ath11k_dp_tx_completion_handler(str
  	int hal_ring_id = dp->tx_ring[ring_id].tcl_comp_ring.ring_id, count = 0, i = 0;
  	struct hal_srng *status_ring = &ab->hal.srng_list[hal_ring_id];
  	struct sk_buff *msdu;
@@ -230,16 +205,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  	u32 *desc;
  	u32 msdu_id, desc_id;
  	u8 mac_id;
-@@ -829,7 +841,7 @@ void ath11k_dp_tx_completion_handler(str
- 	ath11k_hal_srng_dst_invalidate_entry(ab, status_ring, valid_entries);
- 
- 	while ((desc = ath11k_hal_srng_dst_get_next_cache_entry(ab, status_ring))) {
--		if (!ath11k_dp_tx_completion_valid(desc))
-+		if (!ath11k_dp_tx_completion_valid((struct hal_wbm_release_ring *)desc))
- 			continue;
- 
- 		memcpy(&tx_ring->tx_status[count],
-@@ -849,14 +861,16 @@ void ath11k_dp_tx_completion_handler(str
+@@ -863,14 +871,16 @@ void ath11k_dp_tx_completion_handler(str
  
  	while (count--) {
  		tx_status = &tx_ring->tx_status[i++];
@@ -258,7 +224,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  			ath11k_dp_tx_process_htt_tx_complete(ab,
  							     (void *)tx_status,
  							     mac_id, msdu_id,
-@@ -880,7 +894,7 @@ void ath11k_dp_tx_completion_handler(str
+@@ -894,7 +904,7 @@ void ath11k_dp_tx_completion_handler(str
  		if (atomic_dec_and_test(&ar->dp.num_tx_pending))
  			wake_up(&ar->dp.tx_empty_waitq);
  
diff --git a/package/kernel/mac80211/patches/ath11k_nss/911-335-0002-ath11k-use-DECLARE_BITMAP-for-idr-operations.patch b/package/kernel/mac80211/patches/nss/ath11k/335-0002-ath11k-use-DECLARE_BITMAP-for-idr-operations.patch
similarity index 90%
rename from package/kernel/mac80211/patches/ath11k_nss/911-335-0002-ath11k-use-DECLARE_BITMAP-for-idr-operations.patch
rename to package/kernel/mac80211/patches/nss/ath11k/335-0002-ath11k-use-DECLARE_BITMAP-for-idr-operations.patch
index 7b87edb0ae6baa..f567ec640942c9 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/911-335-0002-ath11k-use-DECLARE_BITMAP-for-idr-operations.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/335-0002-ath11k-use-DECLARE_BITMAP-for-idr-operations.patch
@@ -18,7 +18,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/dp.c
 +++ b/drivers/net/wireless/ath/ath11k/dp.c
-@@ -380,6 +380,8 @@ static void ath11k_dp_srng_common_cleanu
+@@ -376,6 +376,8 @@ static void ath11k_dp_srng_common_cleanu
  	for (i = 0; i < DP_TCL_NUM_RING_MAX; i++) {
  		ath11k_dp_srng_cleanup(ab, &dp->tx_ring[i].tcl_data_ring);
  		ath11k_dp_srng_cleanup(ab, &dp->tx_ring[i].tcl_comp_ring);
@@ -27,7 +27,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  	}
  	ath11k_dp_srng_cleanup(ab, &dp->reo_reinject_ring);
  	ath11k_dp_srng_cleanup(ab, &dp->rx_rel_ring);
-@@ -392,7 +394,7 @@ static int ath11k_dp_srng_common_setup(s
+@@ -388,7 +390,7 @@ static int ath11k_dp_srng_common_setup(s
  {
  	struct ath11k_dp *dp = &ab->dp;
  	struct hal_srng *srng;
@@ -36,7 +36,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  	u8 tcl_num, wbm_num;
  
  	ret = ath11k_dp_srng_setup(ab, &dp->wbm_desc_rel_ring,
-@@ -451,6 +453,18 @@ static int ath11k_dp_srng_common_setup(s
+@@ -447,6 +449,18 @@ static int ath11k_dp_srng_common_setup(s
  		ath11k_dp_shadow_init_timer(ab, &dp->tx_ring_timer[i],
  					    ATH11K_SHADOW_DP_TIMER_INTERVAL,
  					    dp->tx_ring[i].tcl_data_ring.ring_id);
@@ -55,7 +55,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  	}
  
  	ret = ath11k_dp_srng_setup(ab, &dp->reo_reinject_ring, HAL_REO_REINJECT,
-@@ -1039,9 +1053,8 @@ void ath11k_dp_vdev_tx_attach(struct ath
+@@ -1031,9 +1045,8 @@ void ath11k_dp_vdev_tx_attach(struct ath
  	ath11k_dp_update_vdev_search(arvif);
  }
  
@@ -66,15 +66,13 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  	struct sk_buff *msdu = skb;
  
  	dma_unmap_single(ab->dev, ATH11K_SKB_CB(msdu)->paddr, msdu->len,
-@@ -1056,23 +1069,30 @@ void ath11k_dp_free(struct ath11k_base *
+@@ -1047,21 +1060,28 @@ static int ath11k_dp_tx_pending_cleanup(
+ void ath11k_dp_free(struct ath11k_base *ab)
  {
  	struct ath11k_dp *dp = &ab->dp;
- 	size_t size = 0;
 -	int i;
 +	int i, j;
  
- 	size = sizeof(struct hal_wbm_release_ring) * DP_TX_COMP_RING_SIZE;
- 
  	ath11k_dp_link_desc_cleanup(ab, dp->link_desc_banks,
  				    HAL_WBM_IDLE_LINK, &dp->wbm_idle_ring);
  
@@ -100,9 +98,9 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
 -			     ath11k_dp_tx_pending_cleanup, ab);
 -		idr_destroy(&dp->tx_ring[i].txbuf_idr);
 -		spin_unlock_bh(&dp->tx_ring[i].tx_idr_lock);
- 		ATH11K_MEMORY_STATS_DEC(ab, malloc_size, size);
  		kfree(dp->tx_ring[i].tx_status);
  	}
+ 
 --- a/drivers/net/wireless/ath/ath11k/dp.h
 +++ b/drivers/net/wireless/ath/ath11k/dp.h
 @@ -8,6 +8,7 @@
@@ -141,12 +139,12 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  #define DP_TCL_DATA_RING_SIZE_WCN6750	2048
  #define DP_TX_COMP_RING_SIZE		ATH11K_DP_TX_COMP_RING_SIZE
 -#define DP_TX_IDR_SIZE			DP_TX_COMP_RING_SIZE
- #define DP_TX_COMP_MAX_ALLOWED			DP_TX_COMP_RING_SIZE
+ #define DP_TX_COMP_MAX_ALLOWED         DP_TX_COMP_RING_SIZE
  #define DP_TCL_CMD_RING_SIZE		32
  #define DP_TCL_STATUS_RING_SIZE		32
 --- a/drivers/net/wireless/ath/ath11k/dp_tx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
-@@ -122,6 +122,7 @@ int ath11k_dp_tx(struct ath11k *ar, stru
+@@ -135,6 +135,7 @@ int ath11k_dp_tx(struct ath11k *ar, stru
  	u8 ring_map = 0;
  	bool tcl_ring_retry, is_diff_encap = false;
  	u8 align_pad, htt_meta_size = 0, max_tx_ring, tcl_ring_id, ring_id;
@@ -154,7 +152,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  
  	if (unlikely(!(info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) &&
  		     !ieee80211_is_data(hdr->frame_control)))
-@@ -152,24 +153,28 @@ tcl_ring_sel:
+@@ -164,24 +165,28 @@ tcl_ring_sel:
  	tx_ring = &dp->tx_ring[tcl_ring_id];
  
  	spin_lock_bh(&tx_ring->tx_idr_lock);
@@ -189,7 +187,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  		     FIELD_PREP(DP_TX_DESC_ID_POOL_ID, pool_id);
  	ti.encap_type = ath11k_dp_tx_get_encap_type(arvif, skb);
  
-@@ -341,10 +346,9 @@ fail_unmap_dma:
+@@ -355,10 +360,9 @@ fail_unmap_dma:
  fail_remove_idr:
  	if (ti.pkt_offset)
  		skb_pull(skb, ti.pkt_offset);
@@ -203,7 +201,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  
  	if (tcl_ring_retry)
  		goto tcl_ring_sel;
-@@ -353,16 +357,19 @@ fail_remove_idr:
+@@ -367,16 +371,19 @@ fail_remove_idr:
  }
  
  static void ath11k_dp_tx_free_txbuf(struct ath11k_base *ab, u8 mac_id,
@@ -228,7 +226,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  
  	if (unlikely(!msdu)) {
  		ath11k_warn(ab, "tx completion for unknown msdu_id %d\n",
-@@ -386,16 +393,20 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
+@@ -400,16 +407,20 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
  				 struct ath11k_dp_htt_wbm_tx_status *ts)
  {
  	struct ieee80211_tx_status status = { 0 };
@@ -253,7 +251,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  
  	if (unlikely(!msdu)) {
  		ath11k_warn(ab, "htt tx completion for unknown msdu_id %d\n",
-@@ -860,6 +871,7 @@ void ath11k_dp_tx_completion_handler(str
+@@ -870,6 +881,7 @@ void ath11k_dp_tx_completion_handler(str
  	}
  
  	while (count--) {
@@ -261,7 +259,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  		tx_status = &tx_ring->tx_status[i++];
  
  		desc_id = FIELD_GET(BUFFER_ADDR_INFO1_SW_COOKIE,
-@@ -878,17 +890,19 @@ void ath11k_dp_tx_completion_handler(str
+@@ -888,17 +900,19 @@ void ath11k_dp_tx_completion_handler(str
  			continue;
  		}
  
diff --git a/package/kernel/mac80211/patches/ath11k_nss/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch b/package/kernel/mac80211/patches/nss/ath11k/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
similarity index 81%
rename from package/kernel/mac80211/patches/ath11k_nss/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
rename to package/kernel/mac80211/patches/nss/ath11k/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
index 1bfbd0ebdbb27e..3c3e436c75ce41 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
@@ -35,18 +35,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  enum hal_encrypt_type ath11k_dp_tx_get_encrypt_type(u32 cipher)
  {
  	switch (cipher) {
-@@ -143,9 +130,8 @@ int ath11k_dp_tx(struct ath11k *ar, stru
- 		     !ieee80211_is_data(hdr->frame_control)))
- 		return -ENOTSUPP;
- 
--	pool_id = skb_get_queue_mapping(skb) & (ATH11K_HW_MAX_QUEUES - 1);
--
- 	ring_selector = ab->hw_params.hw_ops->get_ring_selector(skb);
-+	pool_id = ring_selector;
- 
- tcl_ring_sel:
- 	tcl_ring_retry = false;
-@@ -221,10 +207,6 @@ tcl_ring_sel:
+@@ -232,10 +219,6 @@ tcl_ring_sel:
  	if (ieee80211_vif_is_mesh(arvif->vif))
  		ti.enable_mesh = true;
  
@@ -62,14 +51,14 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
 @@ -65,7 +65,6 @@ void ath11k_hal_tx_cmd_desc_setup(struct
  		FIELD_PREP(HAL_TCL_DATA_CMD_INFO1_PKT_OFFSET, ti->pkt_offset);
  
- 	tcl_cmd->info2 = ti->flags1 |
+ 	tcl_cmd.info2 = ti->flags1 |
 -		FIELD_PREP(HAL_TCL_DATA_CMD_INFO2_TID, ti->tid) |
  		FIELD_PREP(HAL_TCL_DATA_CMD_INFO2_LMAC_ID, ti->lmac_id);
  
- 	tcl_cmd->info3 = FIELD_PREP(HAL_TCL_DATA_CMD_INFO3_DSCP_TID_TABLE_IDX,
+ 	tcl_cmd.info3 = FIELD_PREP(HAL_TCL_DATA_CMD_INFO3_DSCP_TID_TABLE_IDX,
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -9682,6 +9682,8 @@ static int __ath11k_mac_register(struct
+@@ -10154,6 +10154,8 @@ static int __ath11k_mac_register(struct
  			ieee80211_hw_set(ar->hw, USES_RSS);
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/336-ath11k-Fix-updating-rx-stats-with-monitor-vif-enable.patch b/package/kernel/mac80211/patches/nss/ath11k/336-ath11k-Fix-updating-rx-stats-with-monitor-vif-enable.patch
new file mode 100644
index 00000000000000..752218e9b8ec26
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/336-ath11k-Fix-updating-rx-stats-with-monitor-vif-enable.patch
@@ -0,0 +1,88 @@
+From 00d07d474f2ee3aa8aa2945fc26e473183e9201a Mon Sep 17 00:00:00 2001
+From: Anilkumar Kolli <quic_akolli@quicinc.com>
+Date: Fri, 17 Dec 2021 17:16:11 +0530
+Subject: [PATCH] ath11k: Fix updating rx stats with monitor vif enabled
+
+Rx stats update fails when monitor vif is enabled.
+Current code does not update rx stats from monitor
+status ring if monitor vif is enabled.
+Add logic to update rx stats even if monitor vif enabled.
+
+Fixes: 1f49c59c7222 ("mac80211: Package upgrade")
+
+Signed-off-by: Anilkumar Kolli <quic_akolli@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c            | 96 ++++++----------------
+
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -5953,12 +5953,23 @@ int ath11k_dp_rx_process_mon_status(stru
+ 			pmon->mon_ppdu_status = DP_PPDU_STATUS_START;
+ 		}
+ 
+-		if (ppdu_info->peer_id == HAL_INVALID_PEERID ||
+-		    hal_status != HAL_RX_MON_STATUS_PPDU_DONE) {
++		if (test_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags) &&
++		    hal_status == HAL_RX_MON_STATUS_PPDU_DONE &&
++		    pmon->mon_ppdu_status == DP_PPDU_STATUS_START) {
++			rx_mon_stats->status_ppdu_done++;
++			pmon->mon_ppdu_status = DP_PPDU_STATUS_DONE;
++
++			if (!ab->hw_params.full_monitor_mode) {
++				ath11k_dp_rx_mon_dest_process(ar, mac_id, budget, napi);
++				pmon->mon_ppdu_status = DP_PPDU_STATUS_START;
++			}
++		}
++
++		if ((ppdu_info->peer_id == HAL_INVALID_PEERID ||
++		    hal_status != HAL_RX_MON_STATUS_PPDU_DONE)) {
+ 			dev_kfree_skb_any(skb);
+ 			continue;
+ 		}
+-
+ 		rcu_read_lock();
+ 		spin_lock_bh(&ab->base_lock);
+ 		peer = ath11k_peer_find_by_id(ab, ppdu_info->peer_id);
+@@ -6282,6 +6293,13 @@ static int ath11k_dp_full_mon_process_rx
+ 
+ 	spin_lock_bh(&pmon->mon_lock);
+ 
++	pmon->mon_ppdu_status = DP_PPDU_STATUS_START;
++	if (!test_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags)) {
++		quota = ath11k_dp_rx_process_mon_status(ab, mac_id, napi, budget);
++		spin_unlock_bh(&pmon->mon_lock);
++		return quota;
++	}
++
+ 	sw_mon_entries = &pmon->sw_mon_entries;
+ 	rx_mon_stats = &pmon->rx_mon_stats;
+ 
+@@ -6321,7 +6339,6 @@ static int ath11k_dp_full_mon_process_rx
+ 		}
+ 
+ 		rx_mon_stats->dest_ppdu_done++;
+-		pmon->mon_ppdu_status = DP_PPDU_STATUS_START;
+ 		pmon->buf_state = DP_MON_STATUS_LAG;
+ 		pmon->mon_status_paddr = sw_mon_entries->mon_status_paddr;
+ 		pmon->hold_mon_dst_ring = true;
+@@ -6352,16 +6369,10 @@ reap_status_ring:
+ int ath11k_dp_rx_process_mon_rings(struct ath11k_base *ab, int mac_id,
+ 				   struct napi_struct *napi, int budget)
+ {
+-	struct ath11k *ar = ath11k_ab_to_ar(ab, mac_id);
+-	int ret = 0;
+-
+-	if (test_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags) &&
+-	    ab->hw_params.full_monitor_mode)
+-		ret = ath11k_dp_full_mon_process_rx(ab, mac_id, napi, budget);
+-	else
+-		ret = ath11k_dp_rx_process_mon_status(ab, mac_id, napi, budget);
+-
+-	return ret;
++ 	if (ab->hw_params.full_monitor_mode)
++ 		return ath11k_dp_full_mon_process_rx(ab, mac_id, napi, budget);
++ 	else
++ 		return ath11k_dp_rx_process_mon_status(ab, mac_id, napi, budget);
+ }
+ 
+ static int ath11k_dp_rx_pdev_mon_status_attach(struct ath11k *ar)
diff --git a/package/kernel/mac80211/patches/ath11k_nss/336-ath11k-skip-status-ring-entry-processing.patch b/package/kernel/mac80211/patches/nss/ath11k/336-ath11k-skip-status-ring-entry-processing.patch
similarity index 95%
rename from package/kernel/mac80211/patches/ath11k_nss/336-ath11k-skip-status-ring-entry-processing.patch
rename to package/kernel/mac80211/patches/nss/ath11k/336-ath11k-skip-status-ring-entry-processing.patch
index 2e874d321d0ad1..0adf26c808aec6 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/336-ath11k-skip-status-ring-entry-processing.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/336-ath11k-skip-status-ring-entry-processing.patch
@@ -35,7 +35,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -3296,6 +3296,46 @@ ath11k_dp_rx_mon_update_status_buf_state
+@@ -3660,6 +3660,46 @@ ath11k_dp_rx_mon_update_status_buf_state
  	}
  }
  
@@ -82,7 +82,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  static int ath11k_dp_rx_reap_mon_status_ring(struct ath11k_base *ab, int mac_id,
  					     int *budget, struct sk_buff_head *skb_list)
  {
-@@ -3309,6 +3349,7 @@ static int ath11k_dp_rx_reap_mon_status_
+@@ -3673,6 +3713,7 @@ static int ath11k_dp_rx_reap_mon_status_
  	struct sk_buff *skb;
  	struct ath11k_skb_rxcb *rxcb;
  	struct hal_tlv_hdr *tlv;
@@ -90,7 +90,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  	u32 cookie;
  	int buf_id, srng_id;
  	dma_addr_t paddr;
-@@ -3328,8 +3369,7 @@ static int ath11k_dp_rx_reap_mon_status_
+@@ -3692,8 +3733,7 @@ static int ath11k_dp_rx_reap_mon_status_
  	ath11k_hal_srng_access_begin(ab, srng);
  	while (*budget) {
  		*budget -= 1;
@@ -100,7 +100,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  		if (!rx_mon_status_desc) {
  			pmon->buf_state = DP_MON_STATUS_REPLINISH;
  			break;
-@@ -3360,18 +3400,43 @@ static int ath11k_dp_rx_reap_mon_status_
+@@ -3724,18 +3764,43 @@ static int ath11k_dp_rx_reap_mon_status_
  			tlv = (struct hal_tlv_hdr *)skb->data;
  			if (FIELD_GET(HAL_TLV_HDR_TAG, tlv->tl) !=
  					HAL_RX_STATUS_BUFFER_DONE) {
@@ -180,7 +180,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  	lockdep_assert_held(&srng->lock);
 --- a/drivers/net/wireless/ath/ath11k/hal.h
 +++ b/drivers/net/wireless/ath/ath11k/hal.h
-@@ -953,6 +953,8 @@ int ath11k_hal_srng_dst_num_free(struct
+@@ -952,6 +952,8 @@ int ath11k_hal_srng_dst_num_free(struct
  void ath11k_hal_srng_dst_invalidate_entry(struct ath11k_base *ab,
  					  struct hal_srng *srng, int entries);
  u32 *ath11k_hal_srng_src_peek(struct ath11k_base *ab, struct hal_srng *srng);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/913-341-ath11k-fix-support-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch b/package/kernel/mac80211/patches/nss/ath11k/341-ath11k-fix-support-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch
similarity index 97%
rename from package/kernel/mac80211/patches/ath11k_nss/913-341-ath11k-fix-support-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch
rename to package/kernel/mac80211/patches/nss/ath11k/341-ath11k-fix-support-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch
index a1b885c8b50e5a..dbd8dd904c022d 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/913-341-ath11k-fix-support-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/341-ath11k-fix-support-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch
@@ -38,7 +38,7 @@ Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
-@@ -2010,6 +2010,11 @@ static int ath11k_core_reconfigure_on_cr
+@@ -1838,6 +1838,11 @@ static int ath11k_core_reconfigure_on_cr
  
  	clear_bit(ATH11K_FLAG_CRASH_FLUSH, &ab->dev_flags);
  
diff --git a/package/kernel/mac80211/patches/ath11k_nss/342-ath11k-provide-access-of-the-dma-buffer-back-to-dma-.patch b/package/kernel/mac80211/patches/nss/ath11k/342-ath11k-provide-access-of-the-dma-buffer-back-to-dma-.patch
similarity index 100%
rename from package/kernel/mac80211/patches/ath11k_nss/342-ath11k-provide-access-of-the-dma-buffer-back-to-dma-.patch
rename to package/kernel/mac80211/patches/nss/ath11k/342-ath11k-provide-access-of-the-dma-buffer-back-to-dma-.patch
diff --git a/package/kernel/mac80211/patches/ath11k_nss/913-353-ath11k-ignore-frags-from-uninitialized-peer-in-dp.patch b/package/kernel/mac80211/patches/nss/ath11k/353-ath11k-ignore-frags-from-uninitialized-peer-in-dp.patch
similarity index 98%
rename from package/kernel/mac80211/patches/ath11k_nss/913-353-ath11k-ignore-frags-from-uninitialized-peer-in-dp.patch
rename to package/kernel/mac80211/patches/nss/ath11k/353-ath11k-ignore-frags-from-uninitialized-peer-in-dp.patch
index e8ac589acfc8ec..0e99521c4d5ff0 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/913-353-ath11k-ignore-frags-from-uninitialized-peer-in-dp.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/353-ath11k-ignore-frags-from-uninitialized-peer-in-dp.patch
@@ -64,7 +64,7 @@ Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
  
 --- a/drivers/net/wireless/ath/ath11k/peer.h
 +++ b/drivers/net/wireless/ath/ath11k/peer.h
-@@ -93,6 +93,7 @@ struct ath11k_peer {
+@@ -92,6 +92,7 @@ struct ath11k_peer {
  	u16 sec_type;
  	u16 sec_type_grp;
  	bool is_authorized;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/913-356-ath11k-invalid-desc-sanity-check.patch b/package/kernel/mac80211/patches/nss/ath11k/356-ath11k-invalid-desc-sanity-check.patch
similarity index 86%
rename from package/kernel/mac80211/patches/ath11k_nss/913-356-ath11k-invalid-desc-sanity-check.patch
rename to package/kernel/mac80211/patches/nss/ath11k/356-ath11k-invalid-desc-sanity-check.patch
index 4e7e37957b1f31..f574597dceb969 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/913-356-ath11k-invalid-desc-sanity-check.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/356-ath11k-invalid-desc-sanity-check.patch
@@ -46,7 +46,18 @@ Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -3228,6 +3228,16 @@ try_again:
+@@ -396,8 +396,8 @@ int ath11k_dp_rxbufs_replenish(struct at
+ 			goto fail_free_skb;
+ 
+ 		spin_lock_bh(&rx_ring->idr_lock);
+-		buf_id = idr_alloc(&rx_ring->bufs_idr, skb, 1,
+-				   (rx_ring->bufs_max * 3) + 1, GFP_ATOMIC);
++			buf_id = idr_alloc(&rx_ring->bufs_idr, skb, 1,
++					(rx_ring->bufs_max * 3) + 1, GFP_ATOMIC);
+ 		spin_unlock_bh(&rx_ring->idr_lock);
+ 		if (buf_id <= 0)
+ 			goto fail_dma_unmap;
+@@ -3141,6 +3141,16 @@ try_again:
  	while (likely(desc =
  	      (struct hal_reo_dest_ring *)ath11k_hal_srng_dst_get_next_entry(ab,
  									     srng))) {
@@ -63,7 +74,7 @@ Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
  		cookie = FIELD_GET(BUFFER_ADDR_INFO1_SW_COOKIE,
  				   desc->buf_addr_info.info1);
  		buf_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_BUF_ID,
-@@ -3258,8 +3268,6 @@ try_again:
+@@ -3171,8 +3181,6 @@ try_again:
  
  		num_buffs_reaped[mac_id]++;
  
diff --git a/package/kernel/mac80211/patches/ath11k_nss/357-ath11k-fix-clear-peer-keys-during-disassoc.patch b/package/kernel/mac80211/patches/nss/ath11k/357-ath11k-fix-clear-peer-keys-during-disassoc.patch
similarity index 92%
rename from package/kernel/mac80211/patches/ath11k_nss/357-ath11k-fix-clear-peer-keys-during-disassoc.patch
rename to package/kernel/mac80211/patches/nss/ath11k/357-ath11k-fix-clear-peer-keys-during-disassoc.patch
index 414cb06d87bd4b..15a8afde61ef4f 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/357-ath11k-fix-clear-peer-keys-during-disassoc.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/357-ath11k-fix-clear-peer-keys-during-disassoc.patch
@@ -17,7 +17,7 @@ Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -4712,12 +4712,6 @@ static int ath11k_station_disassoc(struc
+@@ -4899,12 +4899,6 @@ static int ath11k_station_disassoc(struc
  			return ret;
  	}
  
@@ -30,7 +30,7 @@ Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
  	return 0;
  }
  
-@@ -5180,6 +5174,17 @@ static int ath11k_mac_op_sta_state(struc
+@@ -5495,6 +5489,17 @@ static int ath11k_mac_op_sta_state(struc
  		arsta->bw = ath11k_mac_ieee80211_sta_bw_to_wmi(ar, sta);
  		arsta->bw_prev = arsta->bw;
  		spin_unlock_bh(&ar->data_lock);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/908-362-ath11k-fix-incorrect-ast-index-assignment-for-wds-peer.patch b/package/kernel/mac80211/patches/nss/ath11k/362-ath11k-fix-incorrect-ast-index-assignment-for-wds-peer.patch
similarity index 82%
rename from package/kernel/mac80211/patches/ath11k_nss/908-362-ath11k-fix-incorrect-ast-index-assignment-for-wds-peer.patch
rename to package/kernel/mac80211/patches/nss/ath11k/362-ath11k-fix-incorrect-ast-index-assignment-for-wds-peer.patch
index f734c5aea8d876..3786bd3de9647d 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/908-362-ath11k-fix-incorrect-ast-index-assignment-for-wds-peer.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/362-ath11k-fix-incorrect-ast-index-assignment-for-wds-peer.patch
@@ -19,16 +19,7 @@ Signed-off-by: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/nss.c
 +++ b/drivers/net/wireless/ath/ath11k/nss.c
-@@ -805,8 +805,6 @@ ath11k_nss_vdev_special_data_receive(str
- 	struct nss_wifi_vdev_per_packet_metadata *wifi_metadata = NULL;
- 	struct nss_wifi_vdev_wds_per_packet_metadata *wds_metadata = NULL;
- 	struct nss_wifi_vdev_addr4_data_metadata *addr4_metadata = NULL;
--	struct wireless_dev *wdev;
--	struct ieee80211_vif *vif;
- 	struct ath11k_vif *arvif;
- 	struct ath11k_base *ab;
- 	struct ath11k_skb_rxcb *rxcb;
-@@ -2487,13 +2485,14 @@ msg_free:
+@@ -3871,13 +3871,14 @@ msg_free:
  }
  
  int ath11k_nss_map_wds_peer(struct ath11k *ar, struct ath11k_peer *peer,
@@ -44,7 +35,7 @@ Signed-off-by: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
  	int ret = 0;
  
  	wlmsg = kzalloc(sizeof(struct nss_wifili_msg), GFP_ATOMIC);
-@@ -2503,7 +2502,7 @@ int ath11k_nss_map_wds_peer(struct ath11
+@@ -3887,7 +3888,7 @@ int ath11k_nss_map_wds_peer(struct ath11
  	wds_peer_map_msg = &wlmsg->msg.wdspeermapmsg;
  
  	wds_peer_map_msg->vdev_id = peer->vdev_id;
@@ -55,7 +46,7 @@ Signed-off-by: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
  		wds_peer_map_msg->peer_id = NSS_WIFILI_MEC_PEER_ID;
 --- a/drivers/net/wireless/ath/ath11k/nss.h
 +++ b/drivers/net/wireless/ath/ath11k/nss.h
-@@ -16,6 +16,7 @@ struct ath11k;
+@@ -20,6 +20,7 @@ struct ath11k;
  struct ath11k_base;
  struct ath11k_vif;
  struct ath11k_peer;
@@ -63,7 +54,7 @@ Signed-off-by: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
  struct ath11k_sta;
  enum ath11k_ast_entry_type;
  struct hal_rx_mon_ppdu_info;
-@@ -241,7 +242,7 @@ int ath11k_nss_add_wds_peer(struct ath11
+@@ -289,7 +290,7 @@ int ath11k_nss_add_wds_peer(struct ath11
  int ath11k_nss_update_wds_peer(struct ath11k *ar, struct ath11k_peer *peer,
  			       u8 *dest_mac);
  int ath11k_nss_map_wds_peer(struct ath11k *ar, struct ath11k_peer *peer,
@@ -72,7 +63,7 @@ Signed-off-by: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
  int ath11k_nss_del_wds_peer(struct ath11k *ar, u8 *peer_addr,
  			    int peer_id, u8 *dest_mac);
  int ath11k_nss_ext_vdev_cfg_wds_peer(struct ath11k_vif *arvif,
-@@ -337,7 +338,8 @@ static inline int ath11k_nss_update_wds_
+@@ -408,7 +409,8 @@ static inline int ath11k_nss_update_wds_
  }
  
  static inline int ath11k_nss_map_wds_peer(struct ath11k *ar, struct ath11k_peer *peer,
diff --git a/package/kernel/mac80211/patches/nss/ath11k/371-ath11k-Fix-ppdu_id-from-firmware-PPDU-stats.patch b/package/kernel/mac80211/patches/nss/ath11k/371-ath11k-Fix-ppdu_id-from-firmware-PPDU-stats.patch
new file mode 100644
index 00000000000000..f909ba4a673f69
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/371-ath11k-Fix-ppdu_id-from-firmware-PPDU-stats.patch
@@ -0,0 +1,52 @@
+From 537a8f2292ba9052957e8284161bcee0635e4223 Mon Sep 17 00:00:00 2001
+From: Ramya Gnanasekar <quic_rgnanase@quicinc.com>
+Date: Tue, 11 Apr 2023 14:15:36 +0530
+Subject: [PATCH] ath11k: Fix ppdu_id from firmware PPDU stats
+
+ppdu_id in USR_COMPLTN_ACK_BA_STATUS TLV will have firmware meta data
+last 7 bits.
+When ppdu_id is taken as such, during parsing this is treated as different
+ppdu_id which causes incorrect stats update. Since firmware will use
+this MSB 7 bits for internal accounting and optimization,
+it is recommended to use first 25 bits when fetching ppdu for USR_COMPLTN_ACK_BA_STATUS.
+
+Signed-off-by: Ramya Gnanasekar <quic_rgnanase@quicinc.com>
+
+--- a/drivers/net/wireless/ath/ath11k/dp.h
++++ b/drivers/net/wireless/ath/ath11k/dp.h
+@@ -1425,6 +1425,7 @@ struct htt_ppdu_stats_usr_cmpltn_cmn {
+ #define HTT_PPDU_STATS_ACK_BA_INFO_TID_NUM	GENMASK(31, 25)
+ 
+ #define HTT_PPDU_STATS_NON_QOS_TID	16
++#define HTT_PPDU_STATS_PPDU_ID		GENMASK(24, 0)
+ 
+ struct htt_ppdu_stats_usr_cmpltn_ack_ba_status {
+ 	u32 ppdu_id;
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -1288,7 +1288,7 @@ static int ath11k_htt_tlv_ppdu_stats_par
+ 	struct htt_ppdu_user_stats *user_stats = NULL;
+ 	int cur_user;
+ 	u16 peer_id;
+-	u32 frame_type;
++	u32 frame_type, ppdu_id;
+ 
+ 	ppdu_info = data;
+ 
+@@ -1369,6 +1369,8 @@ static int ath11k_htt_tlv_ppdu_stats_par
+ 			return -EINVAL;
+ 		}
+ 
++		ppdu_id =
++		((struct htt_ppdu_stats_usr_cmpltn_ack_ba_status *)ptr)->ppdu_id;
+ 		peer_id =
+ 		((struct htt_ppdu_stats_usr_cmpltn_ack_ba_status *)ptr)->sw_peer_id;
+ 		cur_user = ath11k_get_ppdu_user_index(&ppdu_info->ppdu_stats,
+@@ -1380,6 +1382,7 @@ static int ath11k_htt_tlv_ppdu_stats_par
+ 		user_stats->is_valid_peer_id = true;
+ 		memcpy((void *)&user_stats->ack_ba, ptr,
+ 		       sizeof(struct htt_ppdu_stats_usr_cmpltn_ack_ba_status));
++		ppdu_info->ppdu_id = FIELD_GET(HTT_PPDU_STATS_PPDU_ID, ppdu_id);
+ 		user_stats->tlv_flags |= BIT(tag);
+ 		break;
+ 	case HTT_PPDU_STATS_TAG_USR_COMMON:
diff --git a/package/kernel/mac80211/patches/ath11k_nss/911-373-ath11k-Add-retry-mechanism-for-update_rx_qu.patch b/package/kernel/mac80211/patches/nss/ath11k/373-ath11k-Add-retry-mechanism-for-update_rx_qu.patch
similarity index 94%
rename from package/kernel/mac80211/patches/ath11k_nss/911-373-ath11k-Add-retry-mechanism-for-update_rx_qu.patch
rename to package/kernel/mac80211/patches/nss/ath11k/373-ath11k-Add-retry-mechanism-for-update_rx_qu.patch
index 90f335efbca6fb..8adb5448a1564c 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/911-373-ath11k-Add-retry-mechanism-for-update_rx_qu.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/373-ath11k-Add-retry-mechanism-for-update_rx_qu.patch
@@ -41,7 +41,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -936,6 +936,9 @@ struct ath11k_soc_dp_stats {
+@@ -902,6 +902,9 @@ struct ath11k_soc_dp_stats {
  	u32 rxdma_error[HAL_REO_ENTR_RING_RXDMA_ECODE_MAX];
  	u32 reo_error[HAL_REO_DEST_RING_ERROR_CODE_MAX];
  	u32 hal_reo_error[DP_REO_DST_RING_MAX];
@@ -53,7 +53,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  };
 --- a/drivers/net/wireless/ath/ath11k/debugfs.c
 +++ b/drivers/net/wireless/ath/ath11k/debugfs.c
-@@ -851,6 +851,18 @@ static ssize_t ath11k_debugfs_dump_soc_d
+@@ -848,6 +848,18 @@ static ssize_t ath11k_debugfs_dump_soc_d
  			 "\nNSS Transmit Failures: %d\n",
  			 atomic_read(&soc_stats->tx_err.nss_tx_fail));
  
@@ -74,7 +74,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	if (len > size)
 --- a/drivers/net/wireless/ath/ath11k/dp.c
 +++ b/drivers/net/wireless/ath/ath11k/dp.c
-@@ -1113,8 +1113,10 @@ int ath11k_dp_alloc(struct ath11k_base *
+@@ -1102,8 +1102,10 @@ int ath11k_dp_alloc(struct ath11k_base *
  
  	INIT_LIST_HEAD(&dp->reo_cmd_list);
  	INIT_LIST_HEAD(&dp->reo_cmd_cache_flush_list);
@@ -110,7 +110,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  struct dp_reo_cmd {
  	struct list_head list;
  	struct dp_rx_tid data;
-@@ -296,6 +305,12 @@ struct ath11k_dp {
+@@ -295,6 +304,12 @@ struct ath11k_dp {
  	 * - reo_cmd_cache_flush_count
  	 */
  	spinlock_t reo_cmd_lock;
@@ -135,7 +135,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  static inline
  u8 *ath11k_dp_rx_h_80211_hdr(struct ath11k_base *ab, struct hal_rx_desc *desc)
  {
-@@ -707,13 +710,50 @@ static int ath11k_dp_rx_pdev_srng_alloc(
+@@ -672,13 +675,50 @@ static int ath11k_dp_rx_pdev_srng_alloc(
  	return 0;
  }
  
@@ -186,7 +186,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	spin_lock_bh(&dp->reo_cmd_lock);
  	list_for_each_entry_safe(cmd, tmp, &dp->reo_cmd_list, list) {
  		list_del(&cmd->list);
-@@ -759,14 +799,18 @@ static void ath11k_dp_reo_cmd_free(struc
+@@ -724,14 +764,18 @@ static void ath11k_dp_reo_cmd_free(struc
  	}
  }
  
@@ -207,7 +207,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	desc_sz = ath11k_hal_reo_qdesc_size(0, HAL_DESC_REO_NON_QOS_TID);
  
  	while (tot_desc_sz > desc_sz) {
-@@ -777,11 +821,17 @@ static void ath11k_dp_reo_cache_flush(st
+@@ -742,11 +786,17 @@ static void ath11k_dp_reo_cache_flush(st
  						HAL_REO_CMD_FLUSH_CACHE, &cmd,
  						NULL);
  		if (ret)
@@ -228,7 +228,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	memset(&cmd, 0, sizeof(cmd));
  	cmd.addr_lo = lower_32_bits(rx_tid->paddr);
  	cmd.addr_hi = upper_32_bits(rx_tid->paddr);
-@@ -789,24 +839,21 @@ static void ath11k_dp_reo_cache_flush(st
+@@ -754,24 +804,21 @@ static void ath11k_dp_reo_cache_flush(st
  	ret = ath11k_dp_tx_send_reo_cmd(ab, rx_tid,
  					HAL_REO_CMD_FLUSH_CACHE,
  					&cmd, ath11k_dp_reo_cmd_free);
@@ -259,7 +259,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  		goto free_desc;
  	} else if (status != HAL_REO_CMD_SUCCESS) {
  		/* Shouldn't happen! Cleanup in case of other failure? */
-@@ -815,6 +862,29 @@ static void ath11k_dp_rx_tid_del_func(st
+@@ -780,6 +827,29 @@ static void ath11k_dp_rx_tid_del_func(st
  		return;
  	}
  
@@ -289,7 +289,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	elem = kzalloc(sizeof(*elem), GFP_ATOMIC);
  	if (!elem)
  		goto free_desc;
-@@ -832,13 +902,20 @@ static void ath11k_dp_rx_tid_del_func(st
+@@ -797,13 +867,20 @@ static void ath11k_dp_rx_tid_del_func(st
  		if (dp->reo_cmd_cache_flush_count > DP_REO_DESC_FREE_THRESHOLD ||
  		    time_after(jiffies, elem->ts +
  			       msecs_to_jiffies(DP_REO_DESC_FREE_TIMEOUT_MS))) {
@@ -314,7 +314,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  		}
  	}
  	spin_unlock_bh(&dp->reo_cmd_lock);
-@@ -854,34 +931,48 @@ free_desc:
+@@ -819,34 +896,48 @@ free_desc:
  void ath11k_peer_rx_tid_delete(struct ath11k *ar,
  			       struct ath11k_peer *peer, u8 tid)
  {
diff --git a/package/kernel/mac80211/patches/ath11k_nss/376-ath11k-Add-nss-event-handler-support-for-link-desc.patch b/package/kernel/mac80211/patches/nss/ath11k/376-ath11k-Add-nss-event-handler-support-for-link-desc.patch
similarity index 90%
rename from package/kernel/mac80211/patches/ath11k_nss/376-ath11k-Add-nss-event-handler-support-for-link-desc.patch
rename to package/kernel/mac80211/patches/nss/ath11k/376-ath11k-Add-nss-event-handler-support-for-link-desc.patch
index 7b3df32c05b69e..df9fb62bcd17b4 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/376-ath11k-Add-nss-event-handler-support-for-link-desc.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/376-ath11k-Add-nss-event-handler-support-for-link-desc.patch
@@ -16,7 +16,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/nss.c
 +++ b/drivers/net/wireless/ath/ath11k/nss.c
-@@ -72,6 +72,43 @@ static void ath11k_nss_wifili_stats_sync
+@@ -101,6 +101,43 @@ static void ath11k_nss_wifili_stats_sync
  	spin_unlock_bh(&ab->base_lock);
  }
  
@@ -60,9 +60,9 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  static void ath11k_nss_get_peer_stats(struct ath11k_base *ab, struct nss_wifili_peer_stats *stats)
  {
  	struct ath11k_peer *peer;
-@@ -307,6 +344,10 @@ void ath11k_nss_wifili_event_receive(str
- 	case NSS_WIFILI_TID_REOQ_SETUP_MSG:
- 		/* TODO setup tidq */
+@@ -369,6 +406,10 @@ void ath11k_nss_wifili_event_receive(str
+ 		ath11k_dbg(ab, ATH11K_DBG_NSS_MESH, "nss wifili mesh capability response %d\n",
+ 			   ab->nss.mesh_nss_offload_enabled);
  		break;
 +	case NSS_WIFILI_LINK_DESC_INFO_MSG:
 +		ath11k_nss_wifili_link_desc_return(ab,
diff --git a/package/kernel/mac80211/patches/nss/ath11k/401-ath11k-Fix-mutex-dead-lock-and-q6-dump-crash.patch b/package/kernel/mac80211/patches/nss/ath11k/401-ath11k-Fix-mutex-dead-lock-and-q6-dump-crash.patch
new file mode 100644
index 00000000000000..1f66f72a4a4851
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/401-ath11k-Fix-mutex-dead-lock-and-q6-dump-crash.patch
@@ -0,0 +1,59 @@
+From 0a30d8c3d51d798b50bd792aa49e6a5b5ad14183 Mon Sep 17 00:00:00 2001
+From: Rajat Soni <quic_rajson@quicinc.com>
+Date: Wed, 12 Apr 2023 18:06:54 +0530
+Subject: [PATCH] ath11k: Fix mutex dead lock and q6 dump crash
+
+Issue 1:
+Currently for HOST_DDR_REGION_TYPE memory, we are facing crash
+because target memory virtual address (vaddr) is NULL. We are
+not assigning any value to vaddr.
+
+Issue 2:
+In ath11k_mac_op_start we are using mutex lock and waiting for
+waiting for completion of ab->reconfigure_complete.
+Before completing ab->reconfigure_complete in function
+ath11k_core_reconfigure_on_crash, we are again trying
+to get mutex lock in ath11k_spectral_deinit. This results
+in dead lock.
+
+Due to these two issue during SSR case fw recovery pdev
+is not recovered properly.
+
+To resolve these two issues:
+Issue1:
+During ath11k_qmi_assign_target_mem_chunk we should assign
+ab->qmi.target_mem[idx].vaddr.
+
+Issue 2:
+Unlock mutex lock before waiting for completion of
+ab->reconfigure_complete and acquiring lock again.
+
+Signed-off-by: Rajat Soni <quic_rajson@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 2 ++
+ drivers/net/wireless/ath/ath11k/qmi.c | 1 +
+ 2 files changed, 3 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -8001,7 +8001,9 @@ static int ath11k_mac_op_start(struct ie
+ 		break;
+ 	case ATH11K_STATE_RESTARTING:
+ 		ar->state = ATH11K_STATE_RESTARTED;
++		mutex_unlock(&ar->conf_mutex);
+ 		ath11k_mac_wait_reconfigure(ab);
++		mutex_lock(&ar->conf_mutex);
+ 		break;
+ 	case ATH11K_STATE_RESTARTED:
+ 	case ATH11K_STATE_WEDGED:
+--- a/drivers/net/wireless/ath/ath11k/qmi.c
++++ b/drivers/net/wireless/ath/ath11k/qmi.c
+@@ -2960,6 +2960,8 @@ static int ath11k_qmi_assign_target_mem_
+ 			if (!ab->qmi.target_mem[idx].iaddr)
+ 				return -EIO;
+ 
++			ab->qmi.target_mem[idx].vaddr = ab->qmi.target_mem[idx].iaddr;
++
+ 			ab->qmi.target_mem[idx].size = ab->qmi.target_mem[i].size;
+ 			host_ddr_sz = ab->qmi.target_mem[i].size;
+ 			ab->qmi.target_mem[idx].type = ab->qmi.target_mem[i].type;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/453-ath11k-flush-management-frames-to-firmware-before-wa.patch b/package/kernel/mac80211/patches/nss/ath11k/453-ath11k-flush-management-frames-to-firmware-before-wa.patch
new file mode 100644
index 00000000000000..7d413afec97b3d
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/453-ath11k-flush-management-frames-to-firmware-before-wa.patch
@@ -0,0 +1,43 @@
+From 76482cd32e1053ef6437015d9418636616931213 Mon Sep 17 00:00:00 2001
+From: Hari Chandrakanthan <quic_haric@quicinc.com>
+Date: Thu, 22 Jun 2023 00:45:47 +0530
+Subject: [PATCH] ath11k : flush management frames to firmware before waiting 
+ for tx completion
+
+warning print "ath11k c000000.wifi: failed to flush mgmt transmit queue 0"
+is observed during interface down.
+
+The management packets are queued in a skb_queue and the skb_queue
+is dequeued in the work ar->wmi_mgmt_tx_work.
+
+In ath11k_mac_flush_tx_complete, before waiting for the tx completion of
+all the management frames, we are not ensuring that queued
+management frames are flushed to the firmware.
+
+This causes ar->num_pending_mgmt_tx to be positive and it leads to the
+warning print.
+
+Fix this by flushing all the management frames to firmware before waiting
+for the tx completion.
+
+Signed-off-by: Hari Chandrakanthan <quic_haric@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
+index 28c9908ef816..dbdb7aa5c498 100644
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -10266,6 +10266,8 @@ static int ath11k_mac_flush_tx_complete(struct ath11k *ar)
+ 		ret = -ETIMEDOUT;
+ 	}
+ 
++	flush_work(&ar->wmi_mgmt_tx_work);
++
+ 	time_left = wait_event_timeout(ar->txmgmt_empty_waitq,
+ 				       (atomic_read(&ar->num_pending_mgmt_tx) == 0),
+ 				       ATH11K_FLUSH_TIMEOUT);
+-- 
+2.7.4
+
diff --git a/package/kernel/mac80211/patches/nss/ath11k/456-wifi-ath11k-Advertise-TX_QUEUE-mac-hw-flag.patch b/package/kernel/mac80211/patches/nss/ath11k/456-wifi-ath11k-Advertise-TX_QUEUE-mac-hw-flag.patch
new file mode 100644
index 00000000000000..510fbc2448cee7
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/456-wifi-ath11k-Advertise-TX_QUEUE-mac-hw-flag.patch
@@ -0,0 +1,23 @@
+From dbba58c4f45aecaf2c55a1b2d3500878b86cd8ef Mon Sep 17 00:00:00 2001
+From: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
+Date: Mon, 11 Dec 2023 16:02:25 +0530
+Subject: [PATCH] wifi: ath11k: Advertise TX_QUEUE mac hw flag
+
+To avoid tx queuing in mac80211, advertise TX_QUEUE mac hw flag
+which enable tx queuing in driver and avoid performance degradation.
+
+Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -10141,6 +10141,7 @@ static int __ath11k_mac_register(struct
+ 	ieee80211_hw_set(ar->hw, QUEUE_CONTROL);
+ 	ieee80211_hw_set(ar->hw, SUPPORTS_TX_FRAG);
+ 	ieee80211_hw_set(ar->hw, REPORTS_LOW_ACK);
++	ieee80211_hw_set(ar->hw, HAS_TX_QUEUE);
+ 
+ 	if (ath11k_frame_mode == ATH11K_HW_TXRX_ETHERNET) {
+ 		ieee80211_hw_set(ar->hw, SUPPORTS_TX_ENCAP_OFFLOAD);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/913-830-ath11k-Avoiding-memset-of-ppdu-info-for-next-skb.patch b/package/kernel/mac80211/patches/nss/ath11k/457-wifi-ath11k-Avoid-memset-of-ppdu-info-for-next-skb.patch
similarity index 86%
rename from package/kernel/mac80211/patches/ath11k_nss/913-830-ath11k-Avoiding-memset-of-ppdu-info-for-next-skb.patch
rename to package/kernel/mac80211/patches/nss/ath11k/457-wifi-ath11k-Avoid-memset-of-ppdu-info-for-next-skb.patch
index 28b4fdf6468337..c23b6cb3c858b4 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/913-830-ath11k-Avoiding-memset-of-ppdu-info-for-next-skb.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/457-wifi-ath11k-Avoid-memset-of-ppdu-info-for-next-skb.patch
@@ -48,7 +48,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -6210,7 +6210,9 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -6090,7 +6090,9 @@ int ath11k_dp_rx_process_mon_status(stru
  	if (!num_buffs_reaped)
  		goto exit;
  
@@ -59,7 +59,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	ppdu_info->peer_id = HAL_INVALID_PEERID;
  
  	while ((skb = __skb_dequeue(&skb_list))) {
-@@ -6228,7 +6230,6 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -6108,7 +6110,6 @@ int ath11k_dp_rx_process_mon_status(stru
  		if (log_type != ATH11K_PKTLOG_TYPE_INVALID)
  			trace_ath11k_htt_rxdesc(ar, skb->data, log_type, rx_buf_sz);
  
@@ -67,21 +67,21 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  		ppdu_info->peer_id = HAL_INVALID_PEERID;
  		hal_status = ath11k_hal_rx_parse_mon_status(ab, ppdu_info, skb);
  
-@@ -6244,6 +6245,7 @@ int ath11k_dp_rx_process_mon_status(stru
- 		if (ppdu_info->peer_id == HAL_INVALID_PEERID ||
- 		    hal_status != HAL_RX_MON_STATUS_PPDU_DONE) {
+@@ -6136,6 +6137,7 @@ int ath11k_dp_rx_process_mon_status(stru
+ 		if ((ppdu_info->peer_id == HAL_INVALID_PEERID ||
+ 		    hal_status != HAL_RX_MON_STATUS_PPDU_DONE)) {
  			dev_kfree_skb_any(skb);
 +			ppdu_info->ppdu_continuation = true;
  			continue;
  		}
- 
+ 		rcu_read_lock();
 --- a/drivers/net/wireless/ath/ath11k/hal_rx.h
 +++ b/drivers/net/wireless/ath/ath11k/hal_rx.h
-@@ -220,6 +220,7 @@ struct hal_rx_mon_ppdu_info {
- 	char rssi_chain[8][8];
+@@ -221,6 +221,7 @@ struct hal_rx_mon_ppdu_info {
  	u32 num_users;
  	u32 mpdu_fcs_ok_bitmap[HAL_RX_NUM_WORDS_PER_PPDU_BITMAP];
-+	bool ppdu_continuation;
  	struct hal_rx_user_status userstats[HAL_MAX_UL_MU_USERS];
++	bool ppdu_continuation;
  };
  
+ #define HAL_RX_UL_OFDMA_USER_INFO_V0_W0_VALID			BIT(30)
diff --git a/package/kernel/mac80211/patches/ath11k_nss/906-456-wifi-ath11k-Add-support-to-send-the-QoS-Null-Data-fr.patch b/package/kernel/mac80211/patches/nss/ath11k/458-wifi-ath11k-Add-support-to-send-the-QoS-Null-Data-fr.patch
similarity index 88%
rename from package/kernel/mac80211/patches/ath11k_nss/906-456-wifi-ath11k-Add-support-to-send-the-QoS-Null-Data-fr.patch
rename to package/kernel/mac80211/patches/nss/ath11k/458-wifi-ath11k-Add-support-to-send-the-QoS-Null-Data-fr.patch
index 10c39288094b5f..88903faddfdbf6 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/906-456-wifi-ath11k-Add-support-to-send-the-QoS-Null-Data-fr.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/458-wifi-ath11k-Add-support-to-send-the-QoS-Null-Data-fr.patch
@@ -18,14 +18,13 @@ Signed-off-by: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/dp_tx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
-@@ -209,7 +209,9 @@ tcl_ring_sel:
+@@ -221,7 +221,8 @@ tcl_ring_sel:
  
  	switch (ti.encap_type) {
  	case HAL_TCL_ENCAP_TYPE_NATIVE_WIFI:
 -		if (arvif->vif->offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED)
 +		if ((arvif->vif->offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED) &&
-+		    (skb->protocol == cpu_to_be16(ETH_P_PAE) ||
-+		     ieee80211_is_qos_nullfunc(hdr->frame_control)))
++		    ieee80211_is_qos_nullfunc(hdr->frame_control))
  			is_diff_encap = true;
  		else
  			ath11k_dp_tx_encap_nwifi(skb);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/669-ath11k-change-dma_map_single-to-virt_to_phys-in-rx-r.patch b/package/kernel/mac80211/patches/nss/ath11k/669-ath11k-change-dma_map_single-to-virt_to_phys-in-rx-r.patch
new file mode 100644
index 00000000000000..fe767b6a33de2a
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/669-ath11k-change-dma_map_single-to-virt_to_phys-in-rx-r.patch
@@ -0,0 +1,66 @@
+From cd0401a0fe82b5f9c31016d11dcc99d9fa4be96d Mon Sep 17 00:00:00 2001
+From: Balamurugan Selvarajan <quic_bselvara@quicinc.com>
+Date: Wed, 14 Sep 2022 17:12:20 +0530
+Subject: [PATCH] ath11k: Skip cache invalidation in rx replenish
+
+In ath11k_dp_rxbufs_replenish() the descriptors are updated with
+new skb physical address. currently physical address is obtained
+using dma_map_single() this api additionally invalidates the cache
+lines which is not required in replenish(). This consumes CPU cycles.
+In the Rx data path, the desc->skb memory is invalidated before
+reading from the memory. So, replace dmap_map_single() with
+dma_map_single_attrs(DMA_ATTR_SKIP_CPU_SYNC). This reduces CPU usage by 7%.
+
+perf top with dma_map_single()
+=============================
+    24.99%  [kernel]       [k] __pi___inval_dcache_area
+    14.56%  [ath11k]       [k] ath11k_dp_process_rx
+     8.24%  [qca_nss_dp]   [k] edma_tx_ring_xmit
+     5.22%  [kernel]       [k] dmac_clean_range_no_dsb
+     4.26%  [kernel]       [k] __dma_clean_area_no_dsb
+     4.22%  [qca_nss_sfe]  [k] sfe_recv
+     3.90%  [kernel]       [k] skb_recycler_alloc
+     3.87%  [kernel]       [k] __local_bh_enable_ip
+
+perf top with dma_map_single_attrs with DMA_ATTR_SKIP_CPU_SYNC
+=============================================================
+    17.07%  [kernel]       [k] __pi___inval_dcache_area
+    15.53%  [ath11k]       [k] ath11k_dp_process_rx
+     9.03%  [qca_nss_dp]   [k] edma_tx_ring_xmit
+     5.62%  [kernel]       [k] dmac_clean_range_no_dsb
+     5.41%  [kernel]       [k] skb_recycler_alloc
+     4.68%  [qca_nss_sfe]  [k] sfe_recv
+     4.64%  [kernel]       [k] __dma_clean_area_no_dsb
+     3.88%  [kernel]       [k] __local_bh_enable_ip
+
+Signed-off-by: Balamurugan Selvarajan <quic_bselvara@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -427,9 +427,9 @@ int ath11k_dp_rxbufs_replenish(struct at
+ 				 skb->data);
+ 		}
+ 
+-		paddr = dma_map_single(ab->dev, skb->data,
+-				       skb->len + skb_tailroom(skb),
+-				       DMA_FROM_DEVICE);
++		paddr = dma_map_single_attrs(ab->dev, skb->data,
++					     skb->len + skb_tailroom(skb),
++					     DMA_FROM_DEVICE, DMA_ATTR_SKIP_CPU_SYNC);
+ 		if (dma_mapping_error(ab->dev, paddr))
+ 			goto fail_free_skb;
+ 
+@@ -465,8 +465,8 @@ fail_idr_remove:
+ 	idr_remove(&rx_ring->bufs_idr, buf_id);
+ 	spin_unlock_bh(&rx_ring->idr_lock);
+ fail_dma_unmap:
+-	dma_unmap_single(ab->dev, paddr, skb->len + skb_tailroom(skb),
+-			 DMA_FROM_DEVICE);
++	dma_unmap_single_attrs(ab->dev, paddr, skb->len + skb_tailroom(skb),
++			       DMA_FROM_DEVICE, DMA_ATTR_SKIP_CPU_SYNC);
+ fail_free_skb:
+ 	dev_kfree_skb_any(skb);
+ 
diff --git a/package/kernel/mac80211/patches/nss/ath11k/907-01-wifi-ath11k-remove-invalid-peer-create-logic.patch b/package/kernel/mac80211/patches/nss/ath11k/907-01-wifi-ath11k-remove-invalid-peer-create-logic.patch
new file mode 100644
index 00000000000000..b471fb326a5b48
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/907-01-wifi-ath11k-remove-invalid-peer-create-logic.patch
@@ -0,0 +1,58 @@
+Received: from bqiang-Celadon-RN.qca.qualcomm.com (10.80.80.8) by
+From: Baochen Qiang <quic_bqiang@quicinc.com>
+To: <ath11k@lists.infradead.org>
+Subject: [PATCH 1/4] wifi: ath11k: remove invalid peer create logic
+Date: Tue, 23 Jan 2024 10:56:57 +0800
+
+In ath11k_mac_op_assign_vif_chanctx(), there is a logic to
+create peer using ar->mac_addr for a STA vdev. This is invalid
+because a STA vdev should have a peer created using AP's
+MAC address. Besides, if we run into that logic, it means a peer
+has already been created earlier, we should not create it again.
+So remove it.
+
+This is found during code review.
+
+Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1
+Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
+Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 16 ----------------
+ 1 file changed, 16 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -8221,7 +8221,6 @@ ath11k_mac_op_assign_vif_chanctx(struct
+ 	struct ath11k_base *ab = ar->ab;
+ 	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
+ 	int ret;
+-	struct peer_create_params param;
+ 
+ 	mutex_lock(&ar->conf_mutex);
+ 
+@@ -8244,21 +8243,6 @@ ath11k_mac_op_assign_vif_chanctx(struct
+ 		goto out;
+ 	}
+ 
+-	if (ab->hw_params.vdev_start_delay &&
+-	    arvif->vdev_type != WMI_VDEV_TYPE_AP &&
+-	    arvif->vdev_type != WMI_VDEV_TYPE_MONITOR) {
+-		param.vdev_id = arvif->vdev_id;
+-		param.peer_type = WMI_PEER_TYPE_DEFAULT;
+-		param.peer_addr = ar->mac_addr;
+-
+-		ret = ath11k_peer_create(ar, arvif, NULL, &param);
+-		if (ret) {
+-			ath11k_warn(ab, "failed to create peer after vdev start delay: %d",
+-				    ret);
+-			goto out;
+-		}
+-	}
+-
+ 	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
+ 		ret = ath11k_mac_monitor_start(ar);
+ 		if (ret) {
diff --git a/package/kernel/mac80211/patches/nss/ath11k/907-02-wifi-ath11k-rename-ath11k_start_vdev_delay.patch b/package/kernel/mac80211/patches/nss/ath11k/907-02-wifi-ath11k-rename-ath11k_start_vdev_delay.patch
new file mode 100644
index 00000000000000..2fb2cdfd429b11
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/907-02-wifi-ath11k-rename-ath11k_start_vdev_delay.patch
@@ -0,0 +1,52 @@
+From: Baochen Qiang <quic_bqiang@quicinc.com>
+To: <ath11k@lists.infradead.org>
+Subject: [PATCH 2/4] wifi: ath11k: rename ath11k_start_vdev_delay()
+Date: Tue, 23 Jan 2024 10:56:58 +0800
+
+Rename ath11k_start_vdev_delay() as ath11k_mac_start_vdev_delay()
+to follow naming convention.
+
+Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1
+Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
+Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -261,8 +261,8 @@ static const u32 ath11k_smps_map[] = {
+ 	[WLAN_HT_CAP_SM_PS_DISABLED] = WMI_PEER_SMPS_PS_NONE,
+ };
+ 
+-static int ath11k_start_vdev_delay(struct ieee80211_hw *hw,
+-				   struct ieee80211_vif *vif);
++static int ath11k_mac_start_vdev_delay(struct ieee80211_hw *hw,
++				       struct ieee80211_vif *vif);
+ 
+ enum nl80211_he_ru_alloc ath11k_mac_phy_he_ru_to_nl80211_he_ru_alloc(u16 ru_phy)
+ {
+@@ -5319,7 +5319,7 @@ static int ath11k_mac_station_add(struct
+ 	if (ab->hw_params.vdev_start_delay &&
+ 	    !arvif->is_started &&
+ 	    arvif->vdev_type != WMI_VDEV_TYPE_AP) {
+-		ret = ath11k_start_vdev_delay(ar->hw, vif);
++		ret = ath11k_mac_start_vdev_delay(ar->hw, vif);
+ 		if (ret) {
+ 			ath11k_warn(ab, "failed to delay vdev start: %d\n", ret);
+ 			goto free_tx_stats;
+@@ -8164,8 +8164,8 @@ unlock:
+ 	mutex_unlock(&ar->conf_mutex);
+ }
+ 
+-static int ath11k_start_vdev_delay(struct ieee80211_hw *hw,
+-				   struct ieee80211_vif *vif)
++static int ath11k_mac_start_vdev_delay(struct ieee80211_hw *hw,
++				       struct ieee80211_vif *vif)
+ {
+ 	struct ath11k *ar = hw->priv;
+ 	struct ath11k_base *ab = ar->ab;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/907-03-wifi-ath11k-avoid-forward-declaration-of-ath11k_mac_start_vdev_delay.patch b/package/kernel/mac80211/patches/nss/ath11k/907-03-wifi-ath11k-avoid-forward-declaration-of-ath11k_mac_start_vdev_delay.patch
new file mode 100644
index 00000000000000..4d83d0f0ed9029
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/907-03-wifi-ath11k-avoid-forward-declaration-of-ath11k_mac_start_vdev_delay.patch
@@ -0,0 +1,601 @@
+From: Baochen Qiang <quic_bqiang@quicinc.com>
+To: <ath11k@lists.infradead.org>
+Subject: [PATCH 3/4] wifi: ath11k: avoid forward declaration of
+ ath11k_mac_start_vdev_delay()
+Date: Tue, 23 Jan 2024 10:56:59 +0800
+
+Currently ath11k_mac_start_vdev_delay() needs a forward declaration because
+it is defined after where it is called. Avoid this by re-arranging
+ath11k_mac_station_add() and ath11k_mac_op_sta_state().
+
+No functional changes. Compile tested only.
+
+Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
+Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 459 +++++++++++++-------------
+ 1 file changed, 228 insertions(+), 231 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -261,9 +261,6 @@ static const u32 ath11k_smps_map[] = {
+ 	[WLAN_HT_CAP_SM_PS_DISABLED] = WMI_PEER_SMPS_PS_NONE,
+ };
+ 
+-static int ath11k_mac_start_vdev_delay(struct ieee80211_hw *hw,
+-				       struct ieee80211_vif *vif);
+-
+ enum nl80211_he_ru_alloc ath11k_mac_phy_he_ru_to_nl80211_he_ru_alloc(u16 ru_phy)
+ {
+ 	enum nl80211_he_ru_alloc ret;
+@@ -5249,100 +5246,6 @@ static void ath11k_mac_dec_num_stations(
+ 	ar->num_stations--;
+ }
+ 
+-static int ath11k_mac_station_add(struct ath11k *ar,
+-				  struct ieee80211_vif *vif,
+-				  struct ieee80211_sta *sta)
+-{
+-	struct ath11k_base *ab = ar->ab;
+-	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
+-	struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);
+-	struct peer_create_params peer_param;
+-	int ret;
+-
+-	lockdep_assert_held(&ar->conf_mutex);
+-
+-	ret = ath11k_mac_inc_num_stations(arvif, sta);
+-	if (ret) {
+-		ath11k_warn(ab, "refusing to associate station: too many connected already (%d)\n",
+-			    ar->max_num_stations);
+-		goto exit;
+-	}
+-
+-	arsta->rx_stats = kzalloc(sizeof(*arsta->rx_stats), GFP_KERNEL);
+-	if (!arsta->rx_stats) {
+-		ret = -ENOMEM;
+-		goto dec_num_station;
+-	}
+-
+-	peer_param.vdev_id = arvif->vdev_id;
+-	peer_param.peer_addr = sta->addr;
+-	peer_param.peer_type = WMI_PEER_TYPE_DEFAULT;
+-
+-	ret = ath11k_peer_create(ar, arvif, sta, &peer_param);
+-	if (ret) {
+-		ath11k_warn(ab, "Failed to add peer: %pM for VDEV: %d\n",
+-			    sta->addr, arvif->vdev_id);
+-		goto free_rx_stats;
+-	}
+-
+-	ath11k_dbg(ab, ATH11K_DBG_MAC, "Added peer: %pM for VDEV: %d\n",
+-		   sta->addr, arvif->vdev_id);
+-
+-	if (ath11k_debugfs_is_extd_tx_stats_enabled(ar)) {
+-		arsta->tx_stats = kzalloc(sizeof(*arsta->tx_stats), GFP_KERNEL);
+-		if (!arsta->tx_stats) {
+-			ret = -ENOMEM;
+-			goto free_peer;
+-		}
+-	}
+-
+-	if (ieee80211_vif_is_mesh(vif)) {
+-		ath11k_dbg(ab, ATH11K_DBG_MAC,
+-			   "setting USE_4ADDR for mesh STA %pM\n", sta->addr);
+-		ret = ath11k_wmi_set_peer_param(ar, sta->addr,
+-						arvif->vdev_id,
+-						WMI_PEER_USE_4ADDR, 1);
+-		if (ret) {
+-			ath11k_warn(ab, "failed to set mesh STA %pM 4addr capability: %d\n",
+-				    sta->addr, ret);
+-			goto free_tx_stats;
+-		}
+-	}
+-
+-	ret = ath11k_dp_peer_setup(ar, arvif->vdev_id, sta->addr);
+-	if (ret) {
+-		ath11k_warn(ab, "failed to setup dp for peer %pM on vdev %i (%d)\n",
+-			    sta->addr, arvif->vdev_id, ret);
+-		goto free_tx_stats;
+-	}
+-
+-	if (ab->hw_params.vdev_start_delay &&
+-	    !arvif->is_started &&
+-	    arvif->vdev_type != WMI_VDEV_TYPE_AP) {
+-		ret = ath11k_mac_start_vdev_delay(ar->hw, vif);
+-		if (ret) {
+-			ath11k_warn(ab, "failed to delay vdev start: %d\n", ret);
+-			goto free_tx_stats;
+-		}
+-	}
+-
+-	ewma_avg_rssi_init(&arsta->avg_rssi);
+-	return 0;
+-
+-free_tx_stats:
+-	kfree(arsta->tx_stats);
+-	arsta->tx_stats = NULL;
+-free_peer:
+-	ath11k_peer_delete(ar, arvif->vdev_id, sta->addr);
+-free_rx_stats:
+-	kfree(arsta->rx_stats);
+-	arsta->rx_stats = NULL;
+-dec_num_station:
+-	ath11k_mac_dec_num_stations(arvif, sta);
+-exit:
+-	return ret;
+-}
+-
+ static u32 ath11k_mac_ieee80211_sta_bw_to_wmi(struct ath11k *ar,
+ 					      struct ieee80211_sta *sta)
+ {
+@@ -5398,187 +5301,6 @@ static int ath11k_mac_cfg_dyn_vlan(struc
+ 	return ret;
+ }
+ 
+-static int ath11k_mac_op_sta_state(struct ieee80211_hw *hw,
+-				   struct ieee80211_vif *vif,
+-				   struct ieee80211_sta *sta,
+-				   enum ieee80211_sta_state old_state,
+-				   enum ieee80211_sta_state new_state)
+-{
+-	struct ath11k *ar = hw->priv;
+-	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
+-	struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);
+-	struct ath11k_peer *peer;
+-	int ret = 0;
+-
+-	/* cancel must be done outside the mutex to avoid deadlock */
+-	if ((old_state == IEEE80211_STA_NONE &&
+-	     new_state == IEEE80211_STA_NOTEXIST)) {
+-		cancel_work_sync(&arsta->update_wk);
+-		cancel_work_sync(&arsta->set_4addr_wk);
+-	}
+-
+-	mutex_lock(&ar->conf_mutex);
+-
+-	if (old_state == IEEE80211_STA_NOTEXIST &&
+-	    new_state == IEEE80211_STA_NONE) {
+-		memset(arsta, 0, sizeof(*arsta));
+-		arsta->arvif = arvif;
+-		arsta->peer_ps_state = WMI_PEER_PS_STATE_DISABLED;
+-		INIT_WORK(&arsta->update_wk, ath11k_sta_rc_update_wk);
+-		INIT_WORK(&arsta->set_4addr_wk, ath11k_sta_set_4addr_wk);
+-
+-		ret = ath11k_mac_station_add(ar, vif, sta);
+-		if (ret)
+-			ath11k_warn(ar->ab, "Failed to add station: %pM for VDEV: %d\n",
+-				    sta->addr, arvif->vdev_id);
+-	} else if ((old_state == IEEE80211_STA_NONE &&
+-		    new_state == IEEE80211_STA_NOTEXIST)) {
+-		bool skip_peer_delete = ar->ab->hw_params.vdev_start_delay &&
+-			vif->type == NL80211_IFTYPE_STATION;
+-
+-		ath11k_dp_peer_cleanup(ar, arvif->vdev_id, sta->addr);
+-
+-		if (!skip_peer_delete) {
+-			ret = ath11k_peer_delete(ar, arvif->vdev_id, sta->addr);
+-			if (ret)
+-				ath11k_warn(ar->ab,
+-					    "Failed to delete peer: %pM for VDEV: %d\n",
+-					    sta->addr, arvif->vdev_id);
+-			else
+-				ath11k_dbg(ar->ab,
+-					   ATH11K_DBG_MAC,
+-					   "Removed peer: %pM for VDEV: %d\n",
+-					   sta->addr, arvif->vdev_id);
+-		}
+-
+-		ath11k_mac_dec_num_stations(arvif, sta);
+-		mutex_lock(&ar->ab->tbl_mtx_lock);
+-		spin_lock_bh(&ar->ab->base_lock);
+-		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
+-		if (skip_peer_delete && peer) {
+-			peer->sta = NULL;
+-		} else if (peer && peer->sta == sta) {
+-			ath11k_warn(ar->ab, "Found peer entry %pM n vdev %i after it was supposedly removed\n",
+-				    vif->addr, arvif->vdev_id);
+-			ath11k_peer_rhash_delete(ar->ab, peer);
+-			peer->sta = NULL;
+-			list_del(&peer->list);
+-			kfree(peer);
+-			ar->num_peers--;
+-		}
+-		spin_unlock_bh(&ar->ab->base_lock);
+-		mutex_unlock(&ar->ab->tbl_mtx_lock);
+-
+-		kfree(arsta->tx_stats);
+-		arsta->tx_stats = NULL;
+-
+-		kfree(arsta->rx_stats);
+-		arsta->rx_stats = NULL;
+-	} else if (old_state == IEEE80211_STA_AUTH &&
+-		   new_state == IEEE80211_STA_ASSOC &&
+-		   (vif->type == NL80211_IFTYPE_AP ||
+-		    vif->type == NL80211_IFTYPE_MESH_POINT ||
+-		    vif->type == NL80211_IFTYPE_ADHOC)) {
+-		ret = ath11k_station_assoc(ar, vif, sta, false);
+-		if (ret)
+-			ath11k_warn(ar->ab, "Failed to associate station: %pM\n",
+-				    sta->addr);
+-
+-		spin_lock_bh(&ar->data_lock);
+-		/* Set arsta bw and prev bw */
+-		arsta->bw = ath11k_mac_ieee80211_sta_bw_to_wmi(ar, sta);
+-		arsta->bw_prev = arsta->bw;
+-		spin_unlock_bh(&ar->data_lock);
+-
+-		/* Driver should clear the peer keys during mac80211's ref ptr
+-		 * gets cleared in __sta_info_destroy_part2 (trans from
+-		 * IEEE80211_STA_AUTHORIZED to IEEE80211_STA_ASSOC)
+-		 */
+-		ret = ath11k_clear_peer_keys(arvif, sta->addr);
+-		if (ret) {
+-			ath11k_warn(ar->ab, "failed to clear all peer keys for vdev %i: %d\n",
+-					arvif->vdev_id, ret);
+-			return ret;
+-		}
+-	} else if (old_state == IEEE80211_STA_ASSOC &&
+-		   new_state == IEEE80211_STA_AUTHORIZED) {
+-		spin_lock_bh(&ar->ab->base_lock);
+-
+-		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
+-		if (peer)
+-			peer->is_authorized = true;
+-
+-		spin_unlock_bh(&ar->ab->base_lock);
+-
+-		if (vif->type == NL80211_IFTYPE_STATION && arvif->is_up) {
+-			ret = ath11k_wmi_set_peer_param(ar, sta->addr,
+-							arvif->vdev_id,
+-							WMI_PEER_AUTHORIZE,
+-							1);
+-			if (ret)
+-				ath11k_warn(ar->ab, "Unable to authorize peer %pM vdev %d: %d\n",
+-					    sta->addr, arvif->vdev_id, ret);
+-		} else if (ar->ab->nss.enabled &&
+-			   vif->type == NL80211_IFTYPE_AP_VLAN &&
+-			   !arsta->use_4addr_set) {
+-
+-			if (ar->state == ATH11K_STATE_RESTARTED) {
+-				/* During ieee80211_reconfig(), at this point, nss ext vdev peer is not
+-				 * authorized. Hence ath11k_mac_cfg_dyn_vlan() will return error. We save
+-				 * the state vars here and use it later once nss ext vdev is authorized
+-				 * in ath11k_mac_op_set_key() */
+-				struct ath11k_dyn_vlan_cfg *ar_dyn_vlan_cfg;
+-				ar_dyn_vlan_cfg = kzalloc(sizeof(*ar_dyn_vlan_cfg), GFP_ATOMIC);
+-
+-				if (!ar_dyn_vlan_cfg) {
+-					ath11k_warn(ar->ab, "failed to save state for dynamic AP_VLAN configuration (%d)",
+-						    -ENOSPC);
+-				} else {
+-					INIT_LIST_HEAD(&ar_dyn_vlan_cfg->cfg_list);
+-					ar_dyn_vlan_cfg->arvif = arvif;
+-					ar_dyn_vlan_cfg->sta = sta;
+-					/* save it to arvif (AP_VLAN) list */
+-					list_add_tail(&ar_dyn_vlan_cfg->cfg_list, &arvif->dyn_vlan_cfg);
+-				}
+-			} else {
+-				ret = ath11k_mac_cfg_dyn_vlan(ar->ab, arvif, sta);
+-				if (ret)
+-					ath11k_warn(ar->ab, "failed to cfg dyn vlan for peer %pM: %d\n",
+-						    sta->addr, ret);
+-			}
+-		}
+-	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
+-		   new_state == IEEE80211_STA_ASSOC) {
+-
+-		spin_lock_bh(&ar->ab->base_lock);
+-		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
+-		if (peer)
+-			peer->is_authorized = false;
+-		spin_unlock_bh(&ar->ab->base_lock);
+-	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
+-		   new_state == IEEE80211_STA_ASSOC) {
+-		spin_lock_bh(&ar->ab->base_lock);
+-
+-		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
+-		if (peer)
+-			peer->is_authorized = false;
+-
+-		spin_unlock_bh(&ar->ab->base_lock);
+-	} else if (old_state == IEEE80211_STA_ASSOC &&
+-		   new_state == IEEE80211_STA_AUTH &&
+-		   (vif->type == NL80211_IFTYPE_AP ||
+-		    vif->type == NL80211_IFTYPE_MESH_POINT ||
+-		    vif->type == NL80211_IFTYPE_ADHOC)) {
+-		ret = ath11k_station_disassoc(ar, vif, sta);
+-		if (ret)
+-			ath11k_warn(ar->ab, "Failed to disassociate station: %pM\n",
+-				    sta->addr);
+-	}
+-
+-	mutex_unlock(&ar->conf_mutex);
+-	return ret;
+-}
+-
+ static int ath11k_mac_op_sta_set_txpwr(struct ieee80211_hw *hw,
+ 				       struct ieee80211_vif *vif,
+ 				       struct ieee80211_sta *sta)
+@@ -9739,6 +9461,281 @@ ath11k_mac_op_config_mesh_offload_path(s
+ }
+ #endif
+ 
++static int ath11k_mac_station_add(struct ath11k *ar,
++				  struct ieee80211_vif *vif,
++				  struct ieee80211_sta *sta)
++{
++	struct ath11k_base *ab = ar->ab;
++	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
++	struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);
++	struct peer_create_params peer_param;
++	int ret;
++
++	lockdep_assert_held(&ar->conf_mutex);
++
++	ret = ath11k_mac_inc_num_stations(arvif, sta);
++	if (ret) {
++		ath11k_warn(ab, "refusing to associate station: too many connected already (%d)\n",
++			    ar->max_num_stations);
++		goto exit;
++	}
++
++	arsta->rx_stats = kzalloc(sizeof(*arsta->rx_stats), GFP_KERNEL);
++	if (!arsta->rx_stats) {
++		ret = -ENOMEM;
++		goto dec_num_station;
++	}
++
++	peer_param.vdev_id = arvif->vdev_id;
++	peer_param.peer_addr = sta->addr;
++	peer_param.peer_type = WMI_PEER_TYPE_DEFAULT;
++
++	ret = ath11k_peer_create(ar, arvif, sta, &peer_param);
++	if (ret) {
++		ath11k_warn(ab, "Failed to add peer: %pM for VDEV: %d\n",
++			    sta->addr, arvif->vdev_id);
++		goto free_rx_stats;
++	}
++
++	ath11k_dbg(ab, ATH11K_DBG_MAC, "Added peer: %pM for VDEV: %d\n",
++		   sta->addr, arvif->vdev_id);
++
++	if (ath11k_debugfs_is_extd_tx_stats_enabled(ar)) {
++		arsta->tx_stats = kzalloc(sizeof(*arsta->tx_stats), GFP_KERNEL);
++		if (!arsta->tx_stats) {
++			ret = -ENOMEM;
++			goto free_peer;
++		}
++	}
++
++	if (ieee80211_vif_is_mesh(vif)) {
++		ath11k_dbg(ab, ATH11K_DBG_MAC,
++			   "setting USE_4ADDR for mesh STA %pM\n", sta->addr);
++		ret = ath11k_wmi_set_peer_param(ar, sta->addr,
++						arvif->vdev_id,
++						WMI_PEER_USE_4ADDR, 1);
++		if (ret) {
++			ath11k_warn(ab, "failed to set mesh STA %pM 4addr capability: %d\n",
++				    sta->addr, ret);
++			goto free_tx_stats;
++		}
++	}
++
++	ret = ath11k_dp_peer_setup(ar, arvif->vdev_id, sta->addr);
++	if (ret) {
++		ath11k_warn(ab, "failed to setup dp for peer %pM on vdev %i (%d)\n",
++			    sta->addr, arvif->vdev_id, ret);
++		goto free_tx_stats;
++	}
++
++	if (ab->hw_params.vdev_start_delay &&
++	    !arvif->is_started &&
++	    arvif->vdev_type != WMI_VDEV_TYPE_AP) {
++		ret = ath11k_mac_start_vdev_delay(ar->hw, vif);
++		if (ret) {
++			ath11k_warn(ab, "failed to delay vdev start: %d\n", ret);
++			goto free_tx_stats;
++		}
++	}
++
++	ewma_avg_rssi_init(&arsta->avg_rssi);
++	return 0;
++
++free_tx_stats:
++	kfree(arsta->tx_stats);
++	arsta->tx_stats = NULL;
++free_peer:
++	ath11k_peer_delete(ar, arvif->vdev_id, sta->addr);
++free_rx_stats:
++	kfree(arsta->rx_stats);
++	arsta->rx_stats = NULL;
++dec_num_station:
++	ath11k_mac_dec_num_stations(arvif, sta);
++exit:
++	return ret;
++}
++
++static int ath11k_mac_op_sta_state(struct ieee80211_hw *hw,
++				   struct ieee80211_vif *vif,
++				   struct ieee80211_sta *sta,
++				   enum ieee80211_sta_state old_state,
++				   enum ieee80211_sta_state new_state)
++{
++	struct ath11k *ar = hw->priv;
++	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
++	struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);
++	struct ath11k_peer *peer;
++	int ret = 0;
++
++	/* cancel must be done outside the mutex to avoid deadlock */
++	if ((old_state == IEEE80211_STA_NONE &&
++	     new_state == IEEE80211_STA_NOTEXIST)) {
++		cancel_work_sync(&arsta->update_wk);
++		cancel_work_sync(&arsta->set_4addr_wk);
++	}
++
++	mutex_lock(&ar->conf_mutex);
++
++	if (old_state == IEEE80211_STA_NOTEXIST &&
++	    new_state == IEEE80211_STA_NONE) {
++		memset(arsta, 0, sizeof(*arsta));
++		arsta->arvif = arvif;
++		arsta->peer_ps_state = WMI_PEER_PS_STATE_DISABLED;
++		INIT_WORK(&arsta->update_wk, ath11k_sta_rc_update_wk);
++		INIT_WORK(&arsta->set_4addr_wk, ath11k_sta_set_4addr_wk);
++
++		ret = ath11k_mac_station_add(ar, vif, sta);
++		if (ret)
++			ath11k_warn(ar->ab, "Failed to add station: %pM for VDEV: %d\n",
++				    sta->addr, arvif->vdev_id);
++	} else if ((old_state == IEEE80211_STA_NONE &&
++		    new_state == IEEE80211_STA_NOTEXIST)) {
++		bool skip_peer_delete = ar->ab->hw_params.vdev_start_delay &&
++			vif->type == NL80211_IFTYPE_STATION;
++
++		ath11k_dp_peer_cleanup(ar, arvif->vdev_id, sta->addr);
++
++		if (!skip_peer_delete) {
++			ret = ath11k_peer_delete(ar, arvif->vdev_id, sta->addr);
++			if (ret)
++				ath11k_warn(ar->ab,
++					    "Failed to delete peer: %pM for VDEV: %d\n",
++					    sta->addr, arvif->vdev_id);
++			else
++				ath11k_dbg(ar->ab,
++					   ATH11K_DBG_MAC,
++					   "Removed peer: %pM for VDEV: %d\n",
++					   sta->addr, arvif->vdev_id);
++		}
++
++		ath11k_mac_dec_num_stations(arvif, sta);
++		mutex_lock(&ar->ab->tbl_mtx_lock);
++		spin_lock_bh(&ar->ab->base_lock);
++		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
++		if (skip_peer_delete && peer) {
++			peer->sta = NULL;
++		} else if (peer && peer->sta == sta) {
++			ath11k_warn(ar->ab, "Found peer entry %pM n vdev %i after it was supposedly removed\n",
++				    vif->addr, arvif->vdev_id);
++			ath11k_peer_rhash_delete(ar->ab, peer);
++			peer->sta = NULL;
++			list_del(&peer->list);
++			kfree(peer);
++			ar->num_peers--;
++		}
++		spin_unlock_bh(&ar->ab->base_lock);
++		mutex_unlock(&ar->ab->tbl_mtx_lock);
++
++		kfree(arsta->tx_stats);
++		arsta->tx_stats = NULL;
++
++		kfree(arsta->rx_stats);
++		arsta->rx_stats = NULL;
++	} else if (old_state == IEEE80211_STA_AUTH &&
++		   new_state == IEEE80211_STA_ASSOC &&
++		   (vif->type == NL80211_IFTYPE_AP ||
++		    vif->type == NL80211_IFTYPE_MESH_POINT ||
++		    vif->type == NL80211_IFTYPE_ADHOC)) {
++		ret = ath11k_station_assoc(ar, vif, sta, false);
++		if (ret)
++			ath11k_warn(ar->ab, "Failed to associate station: %pM\n",
++				    sta->addr);
++
++		spin_lock_bh(&ar->data_lock);
++		/* Set arsta bw and prev bw */
++		arsta->bw = ath11k_mac_ieee80211_sta_bw_to_wmi(ar, sta);
++		arsta->bw_prev = arsta->bw;
++		spin_unlock_bh(&ar->data_lock);
++
++		/* Driver should clear the peer keys during mac80211's ref ptr
++		 * gets cleared in __sta_info_destroy_part2 (trans from
++		 * IEEE80211_STA_AUTHORIZED to IEEE80211_STA_ASSOC)
++		 */
++		ret = ath11k_clear_peer_keys(arvif, sta->addr);
++		if (ret) {
++			ath11k_warn(ar->ab, "failed to clear all peer keys for vdev %i: %d\n",
++					arvif->vdev_id, ret);
++			return ret;
++		}
++	} else if (old_state == IEEE80211_STA_ASSOC &&
++		   new_state == IEEE80211_STA_AUTHORIZED) {
++		spin_lock_bh(&ar->ab->base_lock);
++
++		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
++		if (peer)
++			peer->is_authorized = true;
++
++		spin_unlock_bh(&ar->ab->base_lock);
++
++		if (vif->type == NL80211_IFTYPE_STATION && arvif->is_up) {
++			ret = ath11k_wmi_set_peer_param(ar, sta->addr,
++							arvif->vdev_id,
++							WMI_PEER_AUTHORIZE,
++							1);
++			if (ret)
++				ath11k_warn(ar->ab, "Unable to authorize peer %pM vdev %d: %d\n",
++					    sta->addr, arvif->vdev_id, ret);
++		} else if (ar->ab->nss.enabled &&
++			   vif->type == NL80211_IFTYPE_AP_VLAN &&
++			   !arsta->use_4addr_set) {
++
++			if (ar->state == ATH11K_STATE_RESTARTED) {
++				/* During ieee80211_reconfig(), at this point, nss ext vdev peer is not
++				 * authorized. Hence ath11k_mac_cfg_dyn_vlan() will return error. We save
++				 * the state vars here and use it later once nss ext vdev is authorized
++				 * in ath11k_mac_op_set_key() */
++				struct ath11k_dyn_vlan_cfg *ar_dyn_vlan_cfg;
++				ar_dyn_vlan_cfg = kzalloc(sizeof(*ar_dyn_vlan_cfg), GFP_ATOMIC);
++
++				if (!ar_dyn_vlan_cfg) {
++					ath11k_warn(ar->ab, "failed to save state for dynamic AP_VLAN configuration (%d)",
++						    -ENOSPC);
++				} else {
++					INIT_LIST_HEAD(&ar_dyn_vlan_cfg->cfg_list);
++					ar_dyn_vlan_cfg->arvif = arvif;
++					ar_dyn_vlan_cfg->sta = sta;
++					/* save it to arvif (AP_VLAN) list */
++					list_add_tail(&ar_dyn_vlan_cfg->cfg_list, &arvif->dyn_vlan_cfg);
++				}
++			} else {
++				ret = ath11k_mac_cfg_dyn_vlan(ar->ab, arvif, sta);
++				if (ret)
++					ath11k_warn(ar->ab, "failed to cfg dyn vlan for peer %pM: %d\n",
++						    sta->addr, ret);
++			}
++		}
++	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
++		   new_state == IEEE80211_STA_ASSOC) {
++
++		spin_lock_bh(&ar->ab->base_lock);
++		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
++		if (peer)
++			peer->is_authorized = false;
++		spin_unlock_bh(&ar->ab->base_lock);
++	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
++		   new_state == IEEE80211_STA_ASSOC) {
++		spin_lock_bh(&ar->ab->base_lock);
++
++		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
++		if (peer)
++			peer->is_authorized = false;
++
++		spin_unlock_bh(&ar->ab->base_lock);
++	} else if (old_state == IEEE80211_STA_ASSOC &&
++		   new_state == IEEE80211_STA_AUTH &&
++		   (vif->type == NL80211_IFTYPE_AP ||
++		    vif->type == NL80211_IFTYPE_MESH_POINT ||
++		    vif->type == NL80211_IFTYPE_ADHOC)) {
++		ret = ath11k_station_disassoc(ar, vif, sta);
++		if (ret)
++			ath11k_warn(ar->ab, "Failed to disassociate station: %pM\n",
++				    sta->addr);
++	}
++
++	mutex_unlock(&ar->conf_mutex);
++	return ret;
++}
++
+ static const struct ieee80211_ops ath11k_ops = {
+ 	.tx				= ath11k_mac_op_tx,
+ 	.wake_tx_queue			= ieee80211_handle_wake_tx_queue,
diff --git a/package/kernel/mac80211/patches/nss/ath11k/907-04-wifi-ath11k-fix-connection-failure-due-to-unexpected-peer-delete.patch b/package/kernel/mac80211/patches/nss/ath11k/907-04-wifi-ath11k-fix-connection-failure-due-to-unexpected-peer-delete.patch
new file mode 100644
index 00000000000000..d1b462519c91e8
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/907-04-wifi-ath11k-fix-connection-failure-due-to-unexpected-peer-delete.patch
@@ -0,0 +1,257 @@
+From: Baochen Qiang <quic_bqiang@quicinc.com>
+To: <ath11k@lists.infradead.org>
+Subject: [PATCH 4/4] wifi: ath11k: fix connection failure due to unexpected
+ peer delete
+Date: Tue, 23 Jan 2024 10:57:00 +0800
+
+Currently ath11k_mac_op_unassign_vif_chanctx() deletes peer but
+ath11k_mac_op_assign_vif_chanctx() doesn't create it. This results in
+connection failure if MAC80211 calls drv_unassign_vif_chanctx() and
+drv_assign_vif_chanctx() during AUTH and ASSOC, see below log:
+
+[  102.372431] wlan0: authenticated
+[  102.372585] ath11k_pci 0000:01:00.0: wlan0: disabling HT/VHT/HE as WMM/QoS is not supported by the AP
+[  102.372593] ath11k_pci 0000:01:00.0: mac chanctx unassign ptr ffff895084638598 vdev_id 0
+[  102.372808] ath11k_pci 0000:01:00.0: WMI vdev stop id 0x0
+[  102.383114] ath11k_pci 0000:01:00.0: vdev stopped for vdev id 0
+[  102.384689] ath11k_pci 0000:01:00.0: WMI peer delete vdev_id 0 peer_addr 20:e5:2a:21:c4:51
+[  102.396676] ath11k_pci 0000:01:00.0: htt peer unmap vdev 0 peer 20:e5:2a:21:c4:51 id 3
+[  102.396711] ath11k_pci 0000:01:00.0: peer delete resp for vdev id 0 addr 20:e5:2a:21:c4:51
+[  102.396722] ath11k_pci 0000:01:00.0: mac removed peer 20:e5:2a:21:c4:51  vdev 0 after vdev stop
+[  102.396780] ath11k_pci 0000:01:00.0: mac chanctx assign ptr ffff895084639c18 vdev_id 0
+[  102.400628] wlan0: associate with 20:e5:2a:21:c4:51 (try 1/3)
+[  102.508864] wlan0: associate with 20:e5:2a:21:c4:51 (try 2/3)
+[  102.612815] wlan0: associate with 20:e5:2a:21:c4:51 (try 3/3)
+[  102.720846] wlan0: association with 20:e5:2a:21:c4:51 timed out
+
+The peer delete logic in ath11k_mac_op_unassign_vif_chanctx() is
+introduced by commit b4a0f54156ac ("ath11k: move peer delete after
+vdev stop of station for QCA6390 and WCN6855") to fix firmware
+crash issue caused by unexpected vdev stop/peer delete sequence.
+
+Actually for a STA interface peer should be deleted in
+ath11k_mac_op_sta_state() when STA's state changes from
+IEEE80211_STA_NONE to IEEE80211_STA_NOTEXIST, which also coincides
+with current peer creation design that peer is created during
+IEEE80211_STA_NOTEXIST -> IEEE80211_STA_NONE transition. So move
+peer delete back to ath11k_mac_op_sta_state(), also stop vdev before
+deleting peer to fix the firmware crash issue mentioned there. In
+this way the connection failure mentioned here is also fixed.
+
+Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1
+Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
+
+Fixes: b4a0f54156ac ("ath11k: move peer delete after vdev stop of station for QCA6390 and WCN6855")
+Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
+Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 139 ++++++++++++++++----------
+ 1 file changed, 85 insertions(+), 54 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -7933,6 +7933,30 @@ static int ath11k_mac_start_vdev_delay(s
+ 	return 0;
+ }
+ 
++static int ath11k_mac_stop_vdev_early(struct ieee80211_hw *hw,
++				      struct ieee80211_vif *vif)
++{
++	struct ath11k *ar = hw->priv;
++	struct ath11k_base *ab = ar->ab;
++	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
++	int ret;
++
++	if (WARN_ON(!arvif->is_started))
++		return -EBUSY;
++
++	ret = ath11k_mac_vdev_stop(arvif);
++	if (ret) {
++		ath11k_warn(ab, "failed to stop vdev %i: %d\n",
++			    arvif->vdev_id, ret);
++		return ret;
++	}
++
++	arvif->is_started = false;
++
++	/* TODO: Setup ps and cts/rts protection */
++	return 0;
++}
++
+ static int
+ ath11k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw,
+ 				 struct ieee80211_vif *vif,
+@@ -7977,15 +8001,17 @@ ath11k_mac_op_assign_vif_chanctx(struct
+ 		goto out;
+ 	}
+ 
+-	ret = ath11k_mac_vdev_start(arvif, ctx);
+-	if (ret) {
+-		ath11k_warn(ab, "failed to start vdev %i addr %pM on freq %d: %d\n",
+-			    arvif->vdev_id, vif->addr,
+-			    ctx->def.chan->center_freq, ret);
+-		goto out;
+-	}
++	if (!arvif->is_started) {
++		ret = ath11k_mac_vdev_start(arvif, ctx);
++		if (ret) {
++			ath11k_warn(ab, "failed to start vdev %i addr %pM on freq %d: %d\n",
++				    arvif->vdev_id, vif->addr,
++				    ctx->def.chan->center_freq, ret);
++			goto out;
++		}
+ 
+-	arvif->is_started = true;
++		arvif->is_started = true;
++	}
+ 
+ 	if (arvif->vdev_type != WMI_VDEV_TYPE_MONITOR &&
+ 	    test_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags)) {
+@@ -8025,8 +8051,6 @@ ath11k_mac_op_unassign_vif_chanctx(struc
+ 		   "chanctx unassign ptr %p vdev_id %i\n",
+ 		   ctx, arvif->vdev_id);
+ 
+-	WARN_ON(!arvif->is_started);
+-
+ 	if (ab->hw_params.vdev_start_delay &&
+ 	    arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
+ 		spin_lock_bh(&ab->base_lock);
+@@ -8050,24 +8074,13 @@ ath11k_mac_op_unassign_vif_chanctx(struc
+ 		return;
+ 	}
+ 
+-	ret = ath11k_mac_vdev_stop(arvif);
+-	if (ret)
+-		ath11k_warn(ab, "failed to stop vdev %i: %d\n",
+-			    arvif->vdev_id, ret);
+-
+-	arvif->is_started = false;
+-
+-	if (ab->hw_params.vdev_start_delay &&
+-	    arvif->vdev_type == WMI_VDEV_TYPE_STA) {
+-		ret = ath11k_peer_delete(ar, arvif->vdev_id, arvif->bssid);
++	if (arvif->is_started) {
++		ret = ath11k_mac_vdev_stop(arvif);
+ 		if (ret)
+-			ath11k_warn(ar->ab,
+-				    "failed to delete peer %pM for vdev %d: %d\n",
+-				    arvif->bssid, arvif->vdev_id, ret);
+-		else
+-			ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
+-				   "removed peer %pM  vdev %d after vdev stop\n",
+-				   arvif->bssid, arvif->vdev_id);
++			ath11k_warn(ab, "failed to stop vdev %i: %d\n",
++				    arvif->vdev_id, ret);
++
++		arvif->is_started = false;
+ 	}
+ 
+ 	if (ab->hw_params.vdev_start_delay &&
+@@ -9555,6 +9568,46 @@ exit:
+ 	return ret;
+ }
+ 
++static int ath11k_mac_station_remove(struct ath11k *ar,
++				     struct ieee80211_vif *vif,
++				     struct ieee80211_sta *sta)
++{
++	struct ath11k_base *ab = ar->ab;
++	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
++	struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);
++	int ret;
++
++	if (ab->hw_params.vdev_start_delay &&
++	    arvif->is_started &&
++	    arvif->vdev_type != WMI_VDEV_TYPE_AP) {
++		ret = ath11k_mac_stop_vdev_early(ar->hw, vif);
++		if (ret) {
++			ath11k_warn(ab, "failed to do early vdev stop: %d\n", ret);
++			return ret;
++		}
++	}
++
++	ath11k_dp_peer_cleanup(ar, arvif->vdev_id, sta->addr);
++
++	ret = ath11k_peer_delete(ar, arvif->vdev_id, sta->addr);
++	if (ret)
++		ath11k_warn(ab, "Failed to delete peer: %pM for VDEV: %d\n",
++			    sta->addr, arvif->vdev_id);
++	else
++		ath11k_dbg(ab, ATH11K_DBG_MAC, "Removed peer: %pM for VDEV: %d\n",
++			   sta->addr, arvif->vdev_id);
++
++	ath11k_mac_dec_num_stations(arvif, sta);
++
++	kfree(arsta->tx_stats);
++	arsta->tx_stats = NULL;
++
++	kfree(arsta->rx_stats);
++	arsta->rx_stats = NULL;
++
++	return ret;
++}
++
+ static int ath11k_mac_op_sta_state(struct ieee80211_hw *hw,
+ 				   struct ieee80211_vif *vif,
+ 				   struct ieee80211_sta *sta,
+@@ -9590,31 +9643,15 @@ static int ath11k_mac_op_sta_state(struc
+ 				    sta->addr, arvif->vdev_id);
+ 	} else if ((old_state == IEEE80211_STA_NONE &&
+ 		    new_state == IEEE80211_STA_NOTEXIST)) {
+-		bool skip_peer_delete = ar->ab->hw_params.vdev_start_delay &&
+-			vif->type == NL80211_IFTYPE_STATION;
+-
+-		ath11k_dp_peer_cleanup(ar, arvif->vdev_id, sta->addr);
+-
+-		if (!skip_peer_delete) {
+-			ret = ath11k_peer_delete(ar, arvif->vdev_id, sta->addr);
+-			if (ret)
+-				ath11k_warn(ar->ab,
+-					    "Failed to delete peer: %pM for VDEV: %d\n",
+-					    sta->addr, arvif->vdev_id);
+-			else
+-				ath11k_dbg(ar->ab,
+-					   ATH11K_DBG_MAC,
+-					   "Removed peer: %pM for VDEV: %d\n",
+-					   sta->addr, arvif->vdev_id);
+-		}
++		ret = ath11k_mac_station_remove(ar, vif, sta);
++		if (ret)
++			ath11k_warn(ar->ab, "Failed to remove station: %pM for VDEV: %d\n",
++				    sta->addr, arvif->vdev_id);
+ 
+-		ath11k_mac_dec_num_stations(arvif, sta);
+ 		mutex_lock(&ar->ab->tbl_mtx_lock);
+ 		spin_lock_bh(&ar->ab->base_lock);
+ 		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
+-		if (skip_peer_delete && peer) {
+-			peer->sta = NULL;
+-		} else if (peer && peer->sta == sta) {
++		if (peer && peer->sta == sta) {
+ 			ath11k_warn(ar->ab, "Found peer entry %pM n vdev %i after it was supposedly removed\n",
+ 				    vif->addr, arvif->vdev_id);
+ 			ath11k_peer_rhash_delete(ar->ab, peer);
+@@ -9625,12 +9662,6 @@ static int ath11k_mac_op_sta_state(struc
+ 		}
+ 		spin_unlock_bh(&ar->ab->base_lock);
+ 		mutex_unlock(&ar->ab->tbl_mtx_lock);
+-
+-		kfree(arsta->tx_stats);
+-		arsta->tx_stats = NULL;
+-
+-		kfree(arsta->rx_stats);
+-		arsta->rx_stats = NULL;
+ 	} else if (old_state == IEEE80211_STA_AUTH &&
+ 		   new_state == IEEE80211_STA_ASSOC &&
+ 		   (vif->type == NL80211_IFTYPE_AP ||
+@@ -10202,6 +10233,8 @@ static int __ath11k_mac_register(struct
+ 
+ 	wiphy_ext_feature_set(ar->hw->wiphy, NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
+ 
++	wiphy_ext_feature_set(ar->hw->wiphy, NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
++
+ 	ar->hw->queues = ATH11K_HW_MAX_QUEUES;
+ 	ar->hw->wiphy->tx_queue_len = ATH11K_QUEUE_LEN;
+ 	ar->hw->offchannel_tx_hw_queue = ATH11K_HW_MAX_QUEUES - 1;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/908-ath11k-make-debugfs-sta-htt-stats-modular.patch b/package/kernel/mac80211/patches/nss/ath11k/908-ath11k-make-debugfs-sta-htt-stats-modular.patch
new file mode 100644
index 00000000000000..2362820dc9e838
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/908-ath11k-make-debugfs-sta-htt-stats-modular.patch
@@ -0,0 +1,198 @@
+--- a/drivers/net/wireless/ath/ath11k/Kconfig
++++ b/drivers/net/wireless/ath/ath11k/Kconfig
+@@ -80,6 +80,24 @@ config ATH11K_DEBUGFS
+ 
+ 	  If unsure, say Y to make it easier to debug problems.
+ 
++config ATH11K_DEBUGFS_STA
++	bool "QCA ath11k debugfs STA support"
++	depends on ATH11K_DEBUGFS
++	default n
++	help
++	  Enable ath11k debugfs STA support
++
++	  If unsure, say Y to make it easier to debug problems.
++
++config ATH11K_DEBUGFS_HTT_STATS
++	bool "QCA ath11k debugfs HTT stats support"
++	depends on ATH11K_DEBUGFS
++	default n
++	help
++	  Enable ath11k debugfs HTT stats support
++
++	  If unsure, say Y to make it easier to debug problems.
++
+ config ATH11K_TRACING
+ 	bool "ath11k tracing support"
+ 	depends on ATH11K && EVENT_TRACING
+--- a/drivers/net/wireless/ath/ath11k/Makefile
++++ b/drivers/net/wireless/ath/ath11k/Makefile
+@@ -19,7 +19,9 @@ ath11k-y += core.o \
+ 	    hw.o \
+ 	    pcic.o
+ 
+-ath11k-$(CPTCFG_ATH11K_DEBUGFS) += debugfs.o debugfs_htt_stats.o debugfs_sta.o
++ath11k-$(CPTCFG_ATH11K_DEBUGFS) += debugfs.o
++ath11k-$(CPTCFG_ATH11K_DEBUGFS_STA) += debugfs_sta.o
++ath11k-$(CPTCFG_ATH11K_DEBUGFS_HTT_STATS) += debugfs_htt_stats.o
+ ath11k-$(CPTCFG_NL80211_TESTMODE) += testmode.o
+ ath11k-$(CPTCFG_ATH11K_TRACING) += trace.o
+ ath11k-$(CPTCFG_ATH11K_THERMAL) += thermal.o
+--- a/drivers/net/wireless/ath/ath11k/debugfs.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs.c
+@@ -1875,7 +1875,9 @@ int ath11k_debugfs_register(struct ath11
+ 	snprintf(buf, 100, "../../ath11k/%pd2", ar->debug.debugfs_pdev);
+ 	debugfs_create_symlink("ath11k", ar->hw->wiphy->debugfsdir, buf);
+ 
++#ifdef CPTCFG_ATH11K_DEBUGFS_HTT_STATS
+ 	ath11k_debugfs_htt_stats_init(ar);
++#endif /* CPTCFG_ATH11K_DEBUGFS_HTT_STATS */
+ 
+ 	ath11k_debugfs_fw_stats_init(ar);
+ 
+--- a/drivers/net/wireless/ath/ath11k/debugfs_sta.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs_sta.c
+@@ -11,7 +11,9 @@
+ #include "debug.h"
+ #include "dp_tx.h"
+ #include "dp_rx.h"
++#ifdef CPTCFG_ATH11K_DEBUGFS_HTT_STATS
+ #include "debugfs_htt_stats.h"
++#endif /* CPTCFG_ATH11K_DEBUGFS_HTT_STATS */
+ 
+ static inline u32 ath11k_he_tones_in_ru_to_nl80211_he_ru_alloc(u16 ru_tones)
+ {
+@@ -551,6 +553,7 @@ static const struct file_operations fops
+ 	.llseek = default_llseek,
+ };
+ 
++#ifdef CPTCFG_ATH11K_DEBUGFS_HTT_STATS
+ static int
+ ath11k_dbg_sta_open_htt_peer_stats(struct inode *inode, struct file *file)
+ {
+@@ -622,6 +625,7 @@ static const struct file_operations fops
+ 	.owner = THIS_MODULE,
+ 	.llseek = default_llseek,
+ };
++#endif /* CPTCFG_ATH11K_DEBUGFS_HTT_STATS */
+ 
+ static ssize_t ath11k_dbg_sta_write_peer_pktlog(struct file *file,
+ 						const char __user *buf,
+@@ -906,6 +910,7 @@ static const struct file_operations fops
+ 	.llseek = default_llseek,
+ };
+ 
++#ifdef CPTCFG_ATH11K_DEBUGFS_HTT_STATS
+ static ssize_t
+ ath11k_write_htt_peer_stats_reset(struct file *file,
+ 				  const char __user *user_buf,
+@@ -965,6 +970,7 @@ static const struct file_operations fops
+ 	.owner = THIS_MODULE,
+ 	.llseek = default_llseek,
+ };
++#endif /* CPTCFG_ATH11K_DEBUGFS_HTT_STATS */
+ 
+ static ssize_t ath11k_dbg_sta_read_peer_ps_state(struct file *file,
+ 						 char __user *user_buf,
+@@ -1111,8 +1117,10 @@ void ath11k_debugfs_sta_op_add(struct ie
+ 				    &fops_reset_rx_stats);
+ 	}
+ 
++#ifdef CPTCFG_ATH11K_DEBUGFS_HTT_STATS
+ 	debugfs_create_file("htt_peer_stats", 0400, dir, sta,
+ 			    &fops_htt_peer_stats);
++#endif /* CPTCFG_ATH11K_DEBUGFS_HTT_STATS */
+ 
+ 	debugfs_create_file("peer_pktlog", 0644, dir, sta,
+ 			    &fops_peer_pktlog);
+@@ -1122,10 +1130,12 @@ void ath11k_debugfs_sta_op_add(struct ie
+ 	debugfs_create_file("addba_resp", 0200, dir, sta, &fops_addba_resp);
+ 	debugfs_create_file("delba", 0200, dir, sta, &fops_delba);
+ 
++#ifdef CPTCFG_ATH11K_DEBUGFS_HTT_STATS
+ 	if (test_bit(WMI_TLV_SERVICE_PER_PEER_HTT_STATS_RESET,
+ 		     ar->ab->wmi_ab.svc_map))
+ 		debugfs_create_file("htt_peer_stats_reset", 0600, dir, sta,
+ 				    &fops_htt_peer_stats_reset);
++#endif /* CPTCFG_ATH11K_DEBUGFS_HTT_STATS */
+ 
+ 	debugfs_create_file("peer_ps_state", 0400, dir, sta,
+ 			    &fops_peer_ps_state);
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -1723,8 +1723,10 @@ ath11k_update_per_peer_tx_stats(struct a
+ 		peer_stats->mu_pos   = mu_pos;
+ 		peer_stats->ru_tones = arsta->txrate.he_ru_alloc;
+ 
++#ifdef CPTCFG_ATH11K_DEBUGFS_STA
+ 		if (ath11k_debugfs_is_extd_tx_stats_enabled(ar))
+ 			ath11k_debugfs_sta_add_tx_stats(arsta, peer_stats, rate_idx);
++#endif
+ 	}
+ 
+ 	usr_stats->rate_stats_updated = true;
+@@ -2170,7 +2172,9 @@ void ath11k_dp_htt_htc_t2h_msg_handler(s
+ 		ath11k_htt_pull_ppdu_stats(ab, skb);
+ 		break;
+ 	case HTT_T2H_MSG_TYPE_EXT_STATS_CONF:
++#ifdef CPTCFG_ATH11K_DEBUGFS_HTT_STATS
+ 		ath11k_debugfs_htt_ext_stats_handler(ab, skb);
++#endif /* CPTCFG_ATH11K_DEBUGFS_HTT_STATS */
+ 		break;
+ 	case HTT_T2H_MSG_TYPE_PKTLOG:
+ 		ath11k_htt_pktlog(ab, skb);
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -7,7 +7,9 @@
+ #include "core.h"
+ #include "dp_tx.h"
+ #include "debug.h"
++#ifdef CPTCFG_ATH11K_DEBUGFS_STA
+ #include "debugfs_sta.h"
++#endif
+ #include "hw.h"
+ #include "peer.h"
+ #include "mac.h"
+@@ -551,7 +553,9 @@ static void ath11k_dp_tx_cache_peer_stat
+ void ath11k_dp_tx_update_txcompl(struct ath11k *ar, struct hal_tx_status *ts)
+ {
+ 	struct ath11k_base *ab = ar->ab;
++#ifdef CPTCFG_ATH11K_DEBUGFS_STA
+ 	struct ath11k_per_peer_tx_stats *peer_stats = &ar->cached_stats;
++#endif
+ 	enum hal_tx_rate_stats_pkt_type pkt_type;
+ 	enum hal_tx_rate_stats_sgi sgi;
+ 	enum hal_tx_rate_stats_bw bw;
+@@ -640,8 +644,10 @@ void ath11k_dp_tx_update_txcompl(struct
+ 			ath11k_mac_he_ru_tones_to_nl80211_he_ru_alloc(ru_tones);
+ 	}
+ 
++#ifdef CPTCFG_ATH11K_DEBUGFS_STA
+ 	if (ath11k_debugfs_is_extd_tx_stats_enabled(ar))
+ 		ath11k_debugfs_sta_add_tx_stats(arsta, peer_stats, rate_idx);
++#endif
+ 
+ err_out:
+ 	spin_unlock_bh(&ab->base_lock);
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -9812,7 +9812,7 @@ static const struct ieee80211_ops ath11k
+ 	.set_wakeup			= ath11k_wow_op_set_wakeup,
+ #endif
+ 
+-#ifdef CPTCFG_ATH11K_DEBUGFS
++#ifdef CPTCFG_ATH11K_DEBUGFS_STA
+ 	.sta_add_debugfs		= ath11k_debugfs_sta_op_add,
+ #endif
+ 
+--- a/local-symbols
++++ b/local-symbols
+@@ -176,6 +176,8 @@ ATH11K_MEM_PROFILE_256M=
+ ATH11K_MEM_PROFILE_512M=
+ ATH11K_DEBUG=
+ ATH11K_DEBUGFS=
++ATH11K_DEBUGFS_STA=
++ATH11K_DEBUGFS_HTT_STATS=
+ ATH11K_TRACING=
+ ATH11K_SPECTRAL=
+ ATH11K_THERMAL=
diff --git a/package/kernel/mac80211/patches/ath11k_nss/233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch b/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
similarity index 77%
rename from package/kernel/mac80211/patches/ath11k_nss/233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
rename to package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
index 87314bc425d3d1..85562dc463a211 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
@@ -12,7 +12,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/debugfs.c
 +++ b/drivers/net/wireless/ath/ath11k/debugfs.c
-@@ -666,6 +666,7 @@ static ssize_t ath11k_write_extd_rx_stat
+@@ -668,6 +668,7 @@ static ssize_t ath11k_write_extd_rx_stat
  	}
  
  	ar->debug.rx_filter = tlv_filter.rx_filter;
@@ -20,7 +20,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
  		ring_id = ar->dp.rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
-@@ -1111,6 +1112,7 @@ static ssize_t ath11k_write_pktlog_filte
+@@ -1228,6 +1229,7 @@ static ssize_t ath11k_write_pktlog_filte
  	}
  
  	/* Clear rx filter set for monitor mode and rx status */
@@ -30,7 +30,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		ret = ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id, ar->dp.mac_id,
 --- a/drivers/net/wireless/ath/ath11k/dp.h
 +++ b/drivers/net/wireless/ath/ath11k/dp.h
-@@ -219,7 +219,8 @@ struct ath11k_pdev_dp {
+@@ -237,7 +237,8 @@ struct ath11k_pdev_dp {
  #define DP_REO_CMD_RING_SIZE		256
  #define DP_REO_STATUS_RING_SIZE		2048
  #define DP_RXDMA_BUF_RING_SIZE		4096
@@ -40,7 +40,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  #define DP_RXDMA_ERR_DST_RING_SIZE	1024
  #define DP_RXDMA_MON_STATUS_RING_SIZE	ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE
  #define DP_RXDMA_MONITOR_BUF_RING_SIZE	ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE
-@@ -609,7 +610,7 @@ enum htt_ppdu_stats_tag_type {
+@@ -672,7 +673,7 @@ enum htt_stats_internal_ppdu_frametype {
   *
   *    |31       26|25|24|23            16|15             8|7             0|
   *    |-----------------+----------------+----------------+---------------|
@@ -49,7 +49,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
   *    |-------------------------------------------------------------------|
   *    |              rsvd2               |           ring_buffer_size     |
   *    |-------------------------------------------------------------------|
-@@ -623,6 +624,14 @@ enum htt_ppdu_stats_tag_type {
+@@ -686,6 +691,14 @@ enum htt_stats_internal_ppdu_frametype {
   *    |-------------------------------------------------------------------|
   *    |                         tlv_filter_in_flags                       |
   *    |-------------------------------------------------------------------|
@@ -64,17 +64,19 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
   * Where:
   *     PS = pkt_swap
   *     SS = status_swap
-@@ -636,6 +645,9 @@ enum htt_ppdu_stats_tag_type {
+@@ -699,7 +712,10 @@ enum htt_stats_internal_ppdu_frametype {
   *                    More details can be got from enum htt_srng_ring_id
   *          b'24    - status_swap: 1 is to swap status TLV
   *          b'25    - pkt_swap:  1 is to swap packet TLV
+- *          b'26:31 - rsvd1:  reserved for future use
 + *          b'26    - rx_offset_valid (OV): flag to indicate rx offsets
 + *                    configuration fields are valid
 + *
-  *          b'26:31 - rsvd1:  reserved for future use
++ *          b'27:31 - rsvd1:  reserved for future use
   * dword1 - b'0:16  - ring_buffer_size: size of buffers referenced by rx ring,
   *                    in byte units.
-@@ -665,6 +677,42 @@ enum htt_ppdu_stats_tag_type {
+  *                    Valid only for HW_TO_SW_RING and SW_TO_HW_RING
+@@ -728,6 +744,42 @@ enum htt_stats_internal_ppdu_frametype {
   * dword6 - b'0:31 -  tlv_filter_in_flags:
   *                    Filter in Attention/MPDU/PPDU/Header/User tlvs
   *                    Refer to CFG_TLV_FILTER_IN_FLAG defs
@@ -117,7 +119,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
   */
  
  #define HTT_RX_RING_SELECTION_CFG_CMD_INFO0_MSG_TYPE	GENMASK(7, 0)
-@@ -672,8 +720,16 @@ enum htt_ppdu_stats_tag_type {
+@@ -735,8 +787,16 @@ enum htt_stats_internal_ppdu_frametype {
  #define HTT_RX_RING_SELECTION_CFG_CMD_INFO0_RING_ID	GENMASK(23, 16)
  #define HTT_RX_RING_SELECTION_CFG_CMD_INFO0_SS		BIT(24)
  #define HTT_RX_RING_SELECTION_CFG_CMD_INFO0_PS		BIT(25)
@@ -134,7 +136,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  enum htt_rx_filter_tlv_flags {
  	HTT_RX_FILTER_TLV_FLAGS_MPDU_START		= BIT(0),
-@@ -977,6 +1033,14 @@ enum htt_rx_data_pkt_filter_tlv_flasg3 {
+@@ -1040,6 +1100,14 @@ enum htt_rx_data_pkt_filter_tlv_flasg3 {
  		HTT_RX_FILTER_TLV_FLAGS_PER_MSDU_HEADER | \
  		HTT_RX_FILTER_TLV_FLAGS_ATTENTION)
  
@@ -149,7 +151,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  struct htt_rx_ring_selection_cfg_cmd {
  	u32 info0;
  	u32 info1;
-@@ -985,6 +1049,10 @@ struct htt_rx_ring_selection_cfg_cmd {
+@@ -1048,6 +1116,10 @@ struct htt_rx_ring_selection_cfg_cmd {
  	u32 pkt_type_en_flags2;
  	u32 pkt_type_en_flags3;
  	u32 rx_filter_tlv;
@@ -160,7 +162,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  } __packed;
  
  struct htt_rx_ring_tlv_filter {
-@@ -993,6 +1061,14 @@ struct htt_rx_ring_tlv_filter {
+@@ -1056,6 +1128,14 @@ struct htt_rx_ring_tlv_filter {
  	u32 pkt_filter_flags1; /* MGMT */
  	u32 pkt_filter_flags2; /* CTRL */
  	u32 pkt_filter_flags3; /* DATA */
@@ -177,7 +179,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  #define HTT_RX_FULL_MON_MODE_CFG_CMD_INFO0_MSG_TYPE	GENMASK(7, 0)
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -70,6 +70,12 @@ static inline bool ath11k_dp_rx_h_mpdu_s
+@@ -73,6 +73,12 @@ static inline bool ath11k_dp_rx_h_mpdu_s
  	return ab->hw_params.hw_ops->rx_desc_get_mpdu_fc_valid(desc);
  }
  
@@ -190,7 +192,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  static inline bool ath11k_dp_rx_h_mpdu_start_more_frags(struct ath11k_base *ab,
  							struct sk_buff *skb)
  {
-@@ -306,6 +312,35 @@ static u8 *ath11k_dp_rxdesc_mpdu_start_a
+@@ -309,6 +315,35 @@ static u8 *ath11k_dp_rxdesc_mpdu_start_a
  	return ab->hw_params.hw_ops->rx_desc_mpdu_start_addr2(desc);
  }
  
@@ -226,7 +228,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  static void ath11k_dp_service_mon_ring(struct timer_list *t)
  {
  	struct ath11k_base *ab = from_timer(ab, t, mon_reap_timer);
-@@ -1976,6 +2011,49 @@ int ath11k_dp_rx_crypto_icv_len(struct a
+@@ -2387,6 +2422,49 @@ int ath11k_dp_rx_crypto_icv_len(struct a
  	return 0;
  }
  
@@ -276,7 +278,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  static void ath11k_dp_rx_h_undecap_nwifi(struct ath11k *ar,
  					 struct sk_buff *msdu,
  					 u8 *first_hdr,
-@@ -1989,7 +2067,8 @@ static void ath11k_dp_rx_h_undecap_nwifi
+@@ -2400,7 +2478,8 @@ static void ath11k_dp_rx_h_undecap_nwifi
  	u8 da[ETH_ALEN];
  	u8 sa[ETH_ALEN];
  	u16 qos_ctl = 0;
@@ -286,7 +288,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  	/* copy SA & DA and pull decapped header */
  	hdr = (struct ieee80211_hdr *)msdu->data;
-@@ -1998,7 +2077,7 @@ static void ath11k_dp_rx_h_undecap_nwifi
+@@ -2409,7 +2488,7 @@ static void ath11k_dp_rx_h_undecap_nwifi
  	ether_addr_copy(sa, ieee80211_get_SA(hdr));
  	skb_pull(msdu, ieee80211_hdrlen(hdr->frame_control));
  
@@ -295,7 +297,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		/* original 802.11 header is valid for the first msdu
  		 * hence we can reuse the same header
  		 */
-@@ -2028,16 +2107,23 @@ static void ath11k_dp_rx_h_undecap_nwifi
+@@ -2439,16 +2518,23 @@ static void ath11k_dp_rx_h_undecap_nwifi
  
  		/* copy decap header before overwriting for reuse below */
  		memcpy(decap_hdr, (uint8_t *)hdr, hdr_len);
@@ -324,7 +326,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		memcpy(skb_push(msdu,
  				IEEE80211_QOS_CTL_LEN), &qos_ctl,
  				IEEE80211_QOS_CTL_LEN);
-@@ -2153,6 +2239,20 @@ static void ath11k_dp_rx_h_undecap_eth(s
+@@ -2564,6 +2650,20 @@ static void ath11k_dp_rx_h_undecap_eth(s
  	u8 da[ETH_ALEN];
  	u8 sa[ETH_ALEN];
  	void *rfc1042;
@@ -345,7 +347,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  	rfc1042 = ath11k_dp_rx_h_find_rfc1042(ar, msdu, enctype);
  	if (WARN_ON_ONCE(!rfc1042))
-@@ -2181,6 +2281,7 @@ static void ath11k_dp_rx_h_undecap_eth(s
+@@ -2592,6 +2692,7 @@ static void ath11k_dp_rx_h_undecap_eth(s
  
  	memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
  
@@ -353,7 +355,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	/* original 802.11 header has a different DA and in
  	 * case of 4addr it may also have different SA
  	 */
-@@ -2199,6 +2300,7 @@ static void ath11k_dp_rx_h_undecap_snap(
+@@ -2610,6 +2711,7 @@ static void ath11k_dp_rx_h_undecap_snap(
  	size_t hdr_len;
  	u8 l3_pad_bytes;
  	struct hal_rx_desc *rx_desc;
@@ -361,7 +363,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  	/* Delivered decapped frame:
  	 * [amsdu header] <-- replaced with 802.11 hdr
-@@ -2212,6 +2314,11 @@ static void ath11k_dp_rx_h_undecap_snap(
+@@ -2623,6 +2725,11 @@ static void ath11k_dp_rx_h_undecap_snap(
  	skb_put(msdu, l3_pad_bytes);
  	skb_pull(msdu, sizeof(struct ath11k_dp_amsdu_subframe_hdr) + l3_pad_bytes);
  
@@ -373,7 +375,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	hdr = (struct ieee80211_hdr *)first_hdr;
  	hdr_len = ieee80211_hdrlen(hdr->frame_control);
  
-@@ -2608,6 +2715,20 @@ static int ath11k_dp_rx_process_msdu(str
+@@ -3097,6 +3204,20 @@ static int ath11k_dp_rx_process_msdu(str
  		goto free_out;
  	}
  
@@ -394,7 +396,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	rxcb = ATH11K_SKB_RXCB(msdu);
  	rxcb->rx_desc = rx_desc;
  	msdu_len = ath11k_dp_rx_h_msdu_start_msdu_len(ab, rx_desc);
-@@ -2620,8 +2741,9 @@ static int ath11k_dp_rx_process_msdu(str
+@@ -3109,8 +3230,9 @@ static int ath11k_dp_rx_process_msdu(str
  			hdr_status = ath11k_dp_rx_h_80211_hdr(ab, rx_desc);
  			ret = -EINVAL;
  			ath11k_warn(ab, "invalid msdu len %u\n", msdu_len);
@@ -406,7 +408,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  			ath11k_dbg_dump(ab, ATH11K_DBG_DATA, NULL, "", rx_desc,
  					sizeof(struct hal_rx_desc));
  			goto free_out;
-@@ -3283,6 +3405,7 @@ static int ath11k_dp_rx_h_verify_tkip_mi
+@@ -4069,6 +4191,7 @@ static int ath11k_dp_rx_h_verify_tkip_mi
  
  	hdr = (struct ieee80211_hdr *)(msdu->data + hal_rx_desc_sz);
  	hdr_len = ieee80211_hdrlen(hdr->frame_control);
@@ -414,7 +416,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	head_len = hdr_len + hal_rx_desc_sz + IEEE80211_TKIP_IV_LEN;
  	tail_len = IEEE80211_CCMP_MIC_LEN + IEEE80211_TKIP_ICV_LEN + FCS_LEN;
  
-@@ -3563,8 +3686,8 @@ static void ath11k_dp_rx_h_sort_frags(st
+@@ -4349,8 +4472,8 @@ static void ath11k_dp_rx_h_sort_frags(st
  
  static u64 ath11k_dp_rx_h_get_pn(struct ath11k *ar, struct sk_buff *skb)
  {
@@ -424,7 +426,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	u8 *ehdr;
  	u32 hal_rx_desc_sz = ar->ab->hw_params.hal_desc_sz;
  
-@@ -3794,8 +3917,9 @@ ath11k_dp_process_rx_err_buf(struct ath1
+@@ -4580,8 +4703,9 @@ ath11k_dp_process_rx_err_buf(struct ath1
  	if ((msdu_len + hal_rx_desc_sz) > DP_RX_BUFFER_SIZE) {
  		hdr_status = ath11k_dp_rx_h_80211_hdr(ar->ab, rx_desc);
  		ath11k_warn(ar->ab, "invalid msdu leng %u", msdu_len);
@@ -436,7 +438,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "", rx_desc,
  				sizeof(struct hal_rx_desc));
  		dev_kfree_skb_any(msdu);
-@@ -4418,6 +4542,47 @@ void ath11k_dp_rx_pdev_free(struct ath11
+@@ -5206,6 +5330,47 @@ void ath11k_dp_rx_pdev_free(struct ath11
  	ath11k_dp_rxdma_pdev_buf_free(ar);
  }
  
@@ -484,7 +486,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  int ath11k_dp_rx_pdev_alloc(struct ath11k_base *ab, int mac_id)
  {
  	struct ath11k *ar = ab->pdevs[mac_id].ar;
-@@ -4511,6 +4676,12 @@ config_refill_ring:
+@@ -5299,6 +5464,12 @@ config_refill_ring:
  		}
  	}
  
@@ -499,7 +501,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
 --- a/drivers/net/wireless/ath/ath11k/dp_tx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
-@@ -1127,6 +1127,8 @@ int ath11k_dp_tx_htt_rx_filter_setup(str
+@@ -1264,6 +1264,8 @@ int ath11k_dp_tx_htt_rx_filter_setup(str
  				 !!(params.flags & HAL_SRNG_FLAGS_MSI_SWAP));
  	cmd->info0 |= FIELD_PREP(HTT_RX_RING_SELECTION_CFG_CMD_INFO0_PS,
  				 !!(params.flags & HAL_SRNG_FLAGS_DATA_TLV_SWAP));
@@ -508,7 +510,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  	cmd->info1 = FIELD_PREP(HTT_RX_RING_SELECTION_CFG_CMD_INFO1_BUF_SIZE,
  				rx_buf_size);
-@@ -1136,6 +1138,26 @@ int ath11k_dp_tx_htt_rx_filter_setup(str
+@@ -1273,6 +1275,26 @@ int ath11k_dp_tx_htt_rx_filter_setup(str
  	cmd->pkt_type_en_flags3 = tlv_filter->pkt_filter_flags3;
  	cmd->rx_filter_tlv = tlv_filter->rx_filter;
  
@@ -535,7 +537,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	ret = ath11k_htc_send(&ab->htc, ab->dp.eid, skb);
  	if (ret)
  		goto err_free;
-@@ -1214,6 +1236,7 @@ int ath11k_dp_tx_htt_monitor_mode_ring_c
+@@ -1351,6 +1373,7 @@ int ath11k_dp_tx_htt_monitor_mode_ring_c
  	}
  
  	ring_id = dp->rxdma_mon_buf_ring.refill_buf_ring.ring_id;
@@ -557,7 +559,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  }
  
  static bool ath11k_hw_ipq8074_rx_desc_encrypt_valid(struct hal_rx_desc *desc)
-@@ -395,26 +399,132 @@ static void ath11k_hw_ipq8074_rx_desc_se
+@@ -405,26 +409,132 @@ static void ath11k_hw_ipq8074_rx_desc_se
  	desc->u.ipq8074.msdu_start.info1 = __cpu_to_le32(info);
  }
  
@@ -696,7 +698,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  }
  
  static bool ath11k_hw_qcn9074_rx_desc_get_first_msdu(struct hal_rx_desc *desc)
-@@ -437,7 +547,11 @@ static u8 ath11k_hw_qcn9074_rx_desc_get_
+@@ -447,7 +557,11 @@ static u8 ath11k_hw_qcn9074_rx_desc_get_
  
  static u8 *ath11k_hw_qcn9074_rx_desc_get_hdr_status(struct hal_rx_desc *desc)
  {
@@ -708,7 +710,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  }
  
  static bool ath11k_hw_qcn9074_rx_desc_encrypt_valid(struct hal_rx_desc *desc)
-@@ -614,7 +728,11 @@ static u8 ath11k_hw_wcn6855_rx_desc_get_
+@@ -634,7 +748,11 @@ static u8 ath11k_hw_wcn6855_rx_desc_get_
  
  static u8 *ath11k_hw_wcn6855_rx_desc_get_hdr_status(struct hal_rx_desc *desc)
  {
@@ -720,10 +722,107 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  }
  
  static bool ath11k_hw_wcn6855_rx_desc_encrypt_valid(struct hal_rx_desc *desc)
-@@ -956,6 +1074,13 @@ const struct ath11k_hw_ops ipq8074_ops =
- 	.rx_desc_mac_addr2_valid = ath11k_hw_ipq8074_rx_desc_mac_addr2_valid,
+@@ -784,6 +902,96 @@ static u8 *ath11k_hw_wcn6855_rx_desc_mpd
+ {
+ 	return desc->u.wcn6855.mpdu_start.addr2;
+ }
++#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
++static void ath11k_hw_qcn9074_rx_desc_get_offset(struct htt_rx_ring_tlv_filter *tlv_filter)
++{
++	tlv_filter->rx_mpdu_end_offset = __le16_to_cpu(offsetof
++			(struct hal_rx_desc_qcn9074, mpdu_end_tag));
++	tlv_filter->rx_mpdu_start_offset = __le16_to_cpu(offsetof
++			(struct hal_rx_desc_qcn9074, mpdu_start_tag));
++	tlv_filter->rx_msdu_end_offset = __le16_to_cpu(offsetof
++			(struct hal_rx_desc_qcn9074, msdu_end_tag));
++	tlv_filter->rx_msdu_start_offset = __le16_to_cpu(offsetof
++			(struct hal_rx_desc_qcn9074, msdu_start_tag));
++	tlv_filter->rx_attn_offset = __le16_to_cpu(offsetof
++			(struct hal_rx_desc_qcn9074, rx_attn_tag));
++}
++#endif
++
++static u16 ath11k_hw_qcn9074_rx_desc_get_mpdu_frame_ctl(struct hal_rx_desc *desc)
++{
++	return __le16_to_cpu(desc->u.qcn9074.mpdu_start.frame_ctrl);
++}
++
++static bool ath11k_hw_qcn9074_rx_desc_dot11_hdr_fields_valid(struct hal_rx_desc *desc)
++{
++	if ((ath11k_hw_qcn9074_rx_desc_get_mpdu_seq_ctl_vld(desc) &&
++	     ath11k_hw_qcn9074_rx_desc_get_mpdu_fc_valid(desc) &&
++	     (__le32_to_cpu(desc->u.qcn9074.mpdu_start.info11) &
++			     RX_MPDU_START_INFO11_MAC_ADDR1_VALID) &&
++	     ath11k_hw_qcn9074_rx_desc_mac_addr2_valid(desc) &&
++	     (__le32_to_cpu(desc->u.qcn9074.mpdu_start.info11) &
++			    RX_MPDU_START_INFO11_MAC_ADDR3_VALID) &&
++	     FIELD_GET((RX_MPDU_START_INFO11_MPDU_DUR_VALID),
++			__le32_to_cpu(desc->u.qcn9074.mpdu_start.info11)))) {
++		return true;
++	}
++	return false;
++}
++
++static void ath11k_hw_qcn9074_rx_desc_get_dot11_hdr(struct hal_rx_desc *desc,
++						    struct ieee80211_hdr *hdr)
++{
++	hdr->frame_control = __le16_to_cpu(desc->u.qcn9074.mpdu_start.frame_ctrl);
++	hdr->duration_id = __le16_to_cpu(desc->u.qcn9074.mpdu_start.duration);
++	ether_addr_copy(hdr->addr1, desc->u.qcn9074.mpdu_start.addr1);
++	ether_addr_copy(hdr->addr2, desc->u.qcn9074.mpdu_start.addr2);
++	ether_addr_copy(hdr->addr3, desc->u.qcn9074.mpdu_start.addr3);
++	if (__le32_to_cpu(desc->u.qcn9074.mpdu_start.info11) &
++			  RX_MPDU_START_INFO11_MAC_ADDR4_VALID) {
++		ether_addr_copy(hdr->addr4, desc->u.qcn9074.mpdu_start.addr4);
++	}
++	hdr->seq_ctrl = __le16_to_cpu(desc->u.qcn9074.mpdu_start.seq_ctrl);
++}
++
++static void ath11k_hw_qcn9074_rx_desc_get_crypto_hdr(struct hal_rx_desc *desc,
++						     u8 *crypto_hdr,
++						     enum hal_encrypt_type enctype)
++{
++	unsigned int key_id;
++
++	switch (enctype) {
++	case HAL_ENCRYPT_TYPE_OPEN:
++		return;
++	case HAL_ENCRYPT_TYPE_TKIP_NO_MIC:
++	case HAL_ENCRYPT_TYPE_TKIP_MIC:
++		crypto_hdr[0] = HAL_RX_MPDU_INFO_PN_GET_BYTE2(desc->u.qcn9074.mpdu_start.pn[0]);
++		crypto_hdr[1] = 0;
++		crypto_hdr[2] = HAL_RX_MPDU_INFO_PN_GET_BYTE1(desc->u.qcn9074.mpdu_start.pn[0]);
++		break;
++	case HAL_ENCRYPT_TYPE_CCMP_128:
++	case HAL_ENCRYPT_TYPE_CCMP_256:
++	case HAL_ENCRYPT_TYPE_GCMP_128:
++	case HAL_ENCRYPT_TYPE_AES_GCMP_256:
++		crypto_hdr[0] = HAL_RX_MPDU_INFO_PN_GET_BYTE1(desc->u.qcn9074.mpdu_start.pn[0]);
++		crypto_hdr[1] = HAL_RX_MPDU_INFO_PN_GET_BYTE2(desc->u.qcn9074.mpdu_start.pn[0]);
++		crypto_hdr[2] = 0;
++		break;
++	case HAL_ENCRYPT_TYPE_WEP_40:
++	case HAL_ENCRYPT_TYPE_WEP_104:
++	case HAL_ENCRYPT_TYPE_WEP_128:
++	case HAL_ENCRYPT_TYPE_WAPI_GCM_SM4:
++	case HAL_ENCRYPT_TYPE_WAPI:
++		return;
++	}
++	key_id        = FIELD_GET(RX_MPDU_START_INFO12_KEY_ID,
++				  __le32_to_cpu(desc->u.qcn9074.mpdu_start.info12));
++	crypto_hdr[3] = 0x20 | (key_id << 6);
++	crypto_hdr[4] = HAL_RX_MPDU_INFO_PN_GET_BYTE3(desc->u.qcn9074.mpdu_start.pn[0]);
++	crypto_hdr[5] = HAL_RX_MPDU_INFO_PN_GET_BYTE4(desc->u.qcn9074.mpdu_start.pn[0]);
++	crypto_hdr[6] = HAL_RX_MPDU_INFO_PN_GET_BYTE1(desc->u.qcn9074.mpdu_start.pn[1]);
++	crypto_hdr[7] = HAL_RX_MPDU_INFO_PN_GET_BYTE2(desc->u.qcn9074.mpdu_start.pn[1]);
++}
+ 
+ static void ath11k_hw_wcn6855_reo_setup(struct ath11k_base *ab)
+ {
+@@ -988,6 +1196,13 @@ const struct ath11k_hw_ops ipq8074_ops =
  	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2,
  	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
+ 	.rx_desc_get_hal_mpdu_len = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_len,
 +#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
 +	.rx_desc_get_offset = ath11k_hw_ipq8074_rx_desc_get_offset,
 +#endif
@@ -734,44 +833,60 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  };
  
  const struct ath11k_hw_ops ipq6018_ops = {
-@@ -1043,6 +1168,8 @@ const struct ath11k_hw_ops qcn9074_ops =
- 	.wmi_init_config = ath11k_init_wmi_config_ipq8074,
- 	.mac_id_to_pdev_id = ath11k_hw_mac_id_to_pdev_id_ipq8074,
- 	.mac_id_to_srng_id = ath11k_hw_mac_id_to_srng_id_ipq8074,
-+	.rx_desc_mac_addr2_valid = ath11k_hw_qcn9074_rx_desc_mac_addr2_valid,
-+	.rx_desc_mpdu_start_addr2 = ath11k_hw_qcn9074_rx_desc_mpdu_start_addr2,
- 	.tx_mesh_enable = ath11k_hw_qcn9074_tx_mesh_enable,
- 	.rx_desc_get_first_msdu = ath11k_hw_qcn9074_rx_desc_get_first_msdu,
- 	.rx_desc_get_last_msdu = ath11k_hw_qcn9074_rx_desc_get_last_msdu,
-@@ -1073,8 +1200,6 @@ const struct ath11k_hw_ops qcn9074_ops =
+@@ -1029,6 +1244,13 @@ const struct ath11k_hw_ops ipq6018_ops =
+ 	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2,
+ 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
+ 	.rx_desc_get_hal_mpdu_len = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_len,
++#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
++	.rx_desc_get_offset = ath11k_hw_ipq8074_rx_desc_get_offset,
++#endif
++	.rx_desc_get_mpdu_frame_ctl = ath11k_hw_ipq8074_rx_desc_get_mpdu_frame_ctl,
++	.rx_desc_dot11_hdr_fields_valid = ath11k_hw_ipq8074_rx_desc_dot11_hdr_fields_valid,
++	.rx_desc_get_dot11_hdr = ath11k_hw_ipq8074_rx_desc_get_dot11_hdr,
++	.rx_desc_get_crypto_header = ath11k_hw_ipq8074_rx_desc_get_crypto_hdr,
+ };
+ 
+ const struct ath11k_hw_ops qca6390_ops = {
+@@ -1071,6 +1293,13 @@ const struct ath11k_hw_ops qca6390_ops =
+ 	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2,
+ 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
+ 	.rx_desc_get_hal_mpdu_len = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_len,
++#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
++	.rx_desc_get_offset = ath11k_hw_ipq8074_rx_desc_get_offset,
++#endif
++	.rx_desc_get_mpdu_frame_ctl = ath11k_hw_ipq8074_rx_desc_get_mpdu_frame_ctl,
++	.rx_desc_dot11_hdr_fields_valid = ath11k_hw_ipq8074_rx_desc_dot11_hdr_fields_valid,
++	.rx_desc_get_dot11_hdr = ath11k_hw_ipq8074_rx_desc_get_dot11_hdr,
++	.rx_desc_get_crypto_header = ath11k_hw_ipq8074_rx_desc_get_crypto_hdr,
+ };
+ 
+ const struct ath11k_hw_ops qcn9074_ops = {
+@@ -1108,10 +1337,17 @@ const struct ath11k_hw_ops qcn9074_ops =
  	.rx_desc_get_msdu_payload = ath11k_hw_qcn9074_rx_desc_get_msdu_payload,
  	.reo_setup = ath11k_hw_ipq8074_reo_setup,
  	.mpdu_info_get_peerid = ath11k_hw_qcn9074_mpdu_info_get_peerid,
 -	.rx_desc_mac_addr2_valid = ath11k_hw_ipq9074_rx_desc_mac_addr2_valid,
 -	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq9074_rx_desc_mpdu_start_addr2,
++	.rx_desc_mac_addr2_valid = ath11k_hw_qcn9074_rx_desc_mac_addr2_valid,
++	.rx_desc_mpdu_start_addr2 = ath11k_hw_qcn9074_rx_desc_mpdu_start_addr2,
  	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
+ 	.rx_desc_get_hal_mpdu_len = ath11k_hw_qcn9074_rx_desc_get_hal_mpdu_len,
++#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
++	.rx_desc_get_offset = ath11k_hw_qcn9074_rx_desc_get_offset,
++#endif
++	.rx_desc_get_mpdu_frame_ctl = ath11k_hw_qcn9074_rx_desc_get_mpdu_frame_ctl,
++	.rx_desc_dot11_hdr_fields_valid = ath11k_hw_qcn9074_rx_desc_dot11_hdr_fields_valid,
++	.rx_desc_get_dot11_hdr = ath11k_hw_qcn9074_rx_desc_get_dot11_hdr,
++	.rx_desc_get_crypto_header = ath11k_hw_qcn9074_rx_desc_get_crypto_hdr,
  };
  
+ const struct ath11k_hw_ops wcn6855_ops = {
 --- a/drivers/net/wireless/ath/ath11k/hw.h
 +++ b/drivers/net/wireless/ath/ath11k/hw.h
-@@ -22,7 +22,11 @@
- #define ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE	512
- #define ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE	128
- #define ATH11K_DP_RXDMA_MONITOR_DST_RING_SIZE	128
--
-+#define ATH11K_DP_RXDMA_REFILL_RING_SIZE	2048
-+/* 256b desc TLV + 4b(rounded) Pad + 30byte max nwifi header +
-+ * 18byte mesh hdr + 8byte snap + 1500 eth payload
-+ */
-+#define ATH11K_DP_RXDMA_NSS_REFILL_RING_SIZE	1816
- #elif defined(CPTCFG_ATH11K_MEM_PROFILE_512M)
- #define TARGET_NUM_VDEVS(ab)	8
- #define TARGET_NUM_PEERS_PDEV(ab)	(128 + TARGET_NUM_VDEVS(ab))
-@@ -34,7 +38,11 @@
+@@ -22,6 +22,11 @@
  #define ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE	512
  #define ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE	128
  #define ATH11K_DP_RXDMA_MONITOR_DST_RING_SIZE	128
--
 +#define ATH11K_DP_RXDMA_REFILL_RING_SIZE	2048
 +/* 256b desc TLV + 4b(rounded) Pad + 30byte max nwifi header +
 + * 18byte mesh hdr + 8byte snap + 1500 eth payload
@@ -780,7 +895,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  #else
  /* Num VDEVS per radio */
  #define TARGET_NUM_VDEVS(ab)	(ab->hw_params.num_vdevs_peers[ab->qmi.target_mem_mode].num_vdevs)
-@@ -47,6 +55,8 @@
+@@ -33,6 +38,8 @@
  #define ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE	1024
  #define ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE	4096
  #define ATH11K_DP_RXDMA_MONITOR_DST_RING_SIZE	2048
@@ -789,27 +904,20 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  #endif
  
  /* Num of peers for Single Radio mode */
-@@ -142,6 +152,8 @@ enum ath11k_bus {
- 
+@@ -129,6 +136,9 @@ enum ath11k_bus {
  struct hal_rx_desc;
  struct hal_tcl_data_cmd;
+ 
 +struct htt_rx_ring_tlv_filter;
 +enum hal_encrypt_type;
- 
++
  struct ath11k_hw_ring_mask {
  	u8 tx[ATH11K_EXT_IRQ_GRP_NUM_MAX];
-@@ -231,6 +243,7 @@ struct ath11k_hw_params {
- 	const struct ath11k_hw_hal_params *hal_params;
- 	bool supports_dynamic_smps_6ghz;
- 	bool alloc_cacheable_memory;
-+	u8 reo_dest_ring_map_shift;
- 	bool supports_rssi_stats;
- 	bool fw_wmi_diag_event;
- 	bool current_cc_support;
-@@ -299,6 +312,16 @@ struct ath11k_hw_ops {
- 	bool (*rx_desc_mac_addr2_valid)(struct hal_rx_desc *desc);
+ 	u8 rx_mon_status[ATH11K_EXT_IRQ_GRP_NUM_MAX];
+@@ -287,6 +297,16 @@ struct ath11k_hw_ops {
  	u8* (*rx_desc_mpdu_start_addr2)(struct hal_rx_desc *desc);
  	u32 (*get_ring_selector)(struct sk_buff *skb);
+ 	u32 (*rx_desc_get_hal_mpdu_len)(struct hal_rx_mpdu_info *mpdu_info);
 +#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
 +	void (*rx_desc_get_offset)(struct htt_rx_ring_tlv_filter *tlv_filter);
 +#endif
@@ -825,16 +933,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  extern const struct ath11k_hw_ops ipq8074_ops;
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -3421,7 +3421,7 @@ static int ath11k_mac_config_obss_pd(str
- 
- static void ath11k_mac_op_nss_bss_info_changed(struct ieee80211_hw *hw,
- 					   struct ieee80211_vif *vif,
--					   u32 changed)
-+					   u64 changed)
- {
- 	struct ath11k *ar = hw->priv;
- 	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
-@@ -6340,6 +6340,7 @@ static int ath11k_mac_config_mon_status_
+@@ -6455,6 +6455,7 @@ static int ath11k_mac_config_mon_status_
  			tlv_filter.rx_filter = ath11k_debugfs_rx_filter(ar);
  	}
  
@@ -842,15 +941,6 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
  		ring_id = ar->dp.rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
  		ret = ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id,
-@@ -9716,8 +9717,6 @@ static int __ath11k_mac_register(struct
- 		wiphy_ext_feature_set(ar->hw->wiphy,
- 				      NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
- 
--	wiphy_ext_feature_set(ar->hw->wiphy, NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
--
- 	ar->hw->queues = ATH11K_HW_MAX_QUEUES;
- 	ar->hw->wiphy->tx_queue_len = ATH11K_QUEUE_LEN;
- 	ar->hw->offchannel_tx_hw_queue = ATH11K_HW_MAX_QUEUES - 1;
 --- a/drivers/net/wireless/ath/ath11k/rx_desc.h
 +++ b/drivers/net/wireless/ath/ath11k/rx_desc.h
 @@ -1442,9 +1442,11 @@ struct hal_rx_desc_ipq8074 {
@@ -889,7 +979,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	u8 msdu_payload[];
  } __packed;
  
-@@ -1502,4 +1508,17 @@ struct hal_rx_desc {
+@@ -1507,4 +1513,17 @@ struct hal_rx_desc {
  #define RU_484 18
  #define RU_996 37
  
@@ -909,7 +999,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  #endif /* ATH11K_RX_DESC_H */
 --- a/drivers/net/wireless/ath/ath11k/nss.c
 +++ b/drivers/net/wireless/ath/ath11k/nss.c
-@@ -1800,7 +1800,7 @@ static int ath11k_nss_init(struct ath11k
+@@ -4360,7 +4360,7 @@ static int ath11k_nss_init(struct ath11k
  
  	/* fill rx parameters to initialize rx context */
  	wim->wrip.tlv_size = ab->hw_params.hal_desc_sz;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/311-ath11k-configure-nss-thread-priority-during-pdev_ini.patch b/package/kernel/mac80211/patches/nss/ath11k/999-311-ath11k-configure-nss-thread-priority-during-pdev_ini.patch
similarity index 85%
rename from package/kernel/mac80211/patches/ath11k_nss/311-ath11k-configure-nss-thread-priority-during-pdev_ini.patch
rename to package/kernel/mac80211/patches/nss/ath11k/999-311-ath11k-configure-nss-thread-priority-during-pdev_ini.patch
index 0a7dcf5e845780..c95960f2de04bf 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/311-ath11k-configure-nss-thread-priority-during-pdev_ini.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-311-ath11k-configure-nss-thread-priority-during-pdev_ini.patch
@@ -22,7 +22,7 @@ Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
  
  #include "debug.h"
  #include "mac.h"
-@@ -1782,6 +1783,7 @@ static int ath11k_nss_init(struct ath11k
+@@ -4342,6 +4343,7 @@ static int ath11k_nss_init(struct ath11k
  	nss_tx_status_t status;
  	struct ath11k_dp *dp;
  	int i, ret;
@@ -30,7 +30,7 @@ Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
  
  	dp = &ab->dp;
  
-@@ -1801,6 +1803,8 @@ static int ath11k_nss_init(struct ath11k
+@@ -4361,6 +4363,8 @@ static int ath11k_nss_init(struct ath11k
  	/* fill rx parameters to initialize rx context */
  	wim->wrip.tlv_size = ab->hw_params.hal_desc_sz;
  	wim->wrip.rx_buf_len = DP_RXDMA_NSS_REFILL_RING_SIZE;
@@ -39,7 +39,7 @@ Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
  
  	/* fill hal srng message */
  	wim->hssm.dev_base_addr = (u32)ab->mem_pa;
-@@ -1977,11 +1981,13 @@ int ath11k_nss_pdev_init(struct ath11k_b
+@@ -4549,11 +4553,13 @@ int ath11k_nss_pdev_init(struct ath11k_b
  	struct nss_wifili_msg *wlmsg = NULL;
  	nss_wifili_msg_callback_t msg_cb;
  	nss_tx_status_t status;
@@ -54,7 +54,7 @@ Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
  
  	dyn_if_type = ath11k_nss_get_dynamic_interface_type(ab);
  
-@@ -2010,6 +2016,15 @@ int ath11k_nss_pdev_init(struct ath11k_b
+@@ -4582,6 +4588,15 @@ int ath11k_nss_pdev_init(struct ath11k_b
  	ath11k_dbg(ab, ATH11K_DBG_NSS, "nss pdev init - id:%d init ctxt:%p ifnum:%d\n",
  		   ar->pdev->pdev_id, ar->nss.ctx, ar->nss.if_num);
  
@@ -70,7 +70,7 @@ Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
  	wlmsg = kzalloc(sizeof(struct nss_wifili_msg), GFP_ATOMIC);
  	if (!wlmsg) {
  		ret = -ENOMEM;
-@@ -2022,6 +2037,7 @@ int ath11k_nss_pdev_init(struct ath11k_b
+@@ -4594,6 +4609,7 @@ int ath11k_nss_pdev_init(struct ath11k_b
  	pdevmsg->lmac_id = ar->lmac_id;
  	pdevmsg->target_pdev_id = ar->pdev->pdev_id;
  	pdevmsg->num_rx_swdesc = WIFILI_RX_DESC_POOL_WEIGHT * DP_RXDMA_BUF_RING_SIZE;
@@ -78,7 +78,7 @@ Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
  
  	/* Store rxdma ring info to the message */
  	refill_ring_id = ar->dp.rx_refill_buf_ring.refill_buf_ring.ring_id;
-@@ -2315,6 +2331,9 @@ int ath11k_nss_pdev_deinit(struct ath11k
+@@ -4887,6 +4903,9 @@ int ath11k_nss_pdev_deinit(struct ath11k
  	/* pdev deinit msg success, dealloc, deregister and return */
  	ret = 0;
  
@@ -90,7 +90,7 @@ Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
  free:
 --- a/drivers/net/wireless/ath/ath11k/nss.h
 +++ b/drivers/net/wireless/ath/ath11k/nss.h
-@@ -61,6 +61,7 @@ struct hal_rx_user_status;
+@@ -70,6 +70,7 @@ struct hal_rx_user_status;
  /* Init Flags */
  #define WIFILI_NSS_CCE_DISABLED 0x1
  #define WIFILI_ADDTL_MEM_SEG_SET 0x000000002
@@ -98,9 +98,9 @@ Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
  
  /* ATH11K NSS PEER Info */
  /* Host memory allocated for peer info storage in nss */
-@@ -108,6 +109,8 @@ enum ath11k_nss_vdev_cmd {
- 	ATH11K_NSS_WIFI_VDEV_DECAP_TYPE_CMD,
- };
+@@ -122,6 +123,8 @@ enum ath11k_nss_vdev_cmd {
+ /* Enables the MCBC exception in NSS fw, 1 = enable */
+ #define ATH11K_NSS_ENABLE_MCBC_EXC	1
  
 +#define WIFILI_SCHEME_ID_INVALID	-1
 +
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-312-ath11k-add-ampdu-id-in-802.11-radiotap-header.patch b/package/kernel/mac80211/patches/nss/ath11k/999-312-ath11k-add-ampdu-id-in-802.11-radiotap-header.patch
new file mode 100644
index 00000000000000..1f554ae95ccc69
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-312-ath11k-add-ampdu-id-in-802.11-radiotap-header.patch
@@ -0,0 +1,279 @@
+From 3f962ed9a4079964c48e321fd928a2719038d881 Mon Sep 17 00:00:00 2001
+From: P Praneesh <ppranees@codeaurora.org>
+Date: Fri, 28 May 2021 23:53:57 +0530
+Subject: [PATCH] ath11k: add ampdu id in 802.11 radiotap header
+
+AMPDU aggregate reference number is generated by
+driver internally which is same across each
+subframe of an ampdu.
+
+For fetching AMPDU-ID, we need to concatenate
+ppdu_id from mpdu_info and tlv_usr from tlv heder.
+while parsing monitor TLV data with HAL_RX_MPDU_START
+TLV tag, ampdu id is fetched from mpdu_info and
+updated to corresponding mac80211 structure during
+ath11k_update_radiotap.
+
+Signed-off-by: P Praneesh <ppranees@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c  |  6 ++++++
+ drivers/net/wireless/ath/ath11k/hal_rx.c | 13 ++++++++++++
+ drivers/net/wireless/ath/ath11k/hal_rx.h | 16 ++++++++------
+ drivers/net/wireless/ath/ath11k/hw.c     | 36 +++++++++++++++++++++++++-------
+ drivers/net/wireless/ath/ath11k/hw.h     |  1 +
+ 5 files changed, 58 insertions(+), 14 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -5994,6 +5994,7 @@ static void ath11k_update_radiotap(struc
+ {
+ 	struct ieee80211_supported_band *sband;
+ 	u8 *ptr = NULL;
++	u16 ampdu_id = ppduinfo->ampdu_id[ppduinfo->userid];
+ 
+ 	rxs->flag |= RX_FLAG_MACTIME_START;
+ 	rxs->signal = ppduinfo->rssi_comb + ATH11K_DEFAULT_NOISE_FLOOR;
+@@ -6001,6 +6002,11 @@ static void ath11k_update_radiotap(struc
+ 	if (ppduinfo->nss)
+ 		rxs->nss = ppduinfo->nss;
+ 
++	if (ampdu_id) {
++		rxs->flag |= RX_FLAG_AMPDU_DETAILS;
++		rxs->ampdu_reference = ampdu_id;
++	}
++
+ 	if (ppduinfo->he_mu_flags) {
+ 		rxs->flag |= RX_FLAG_RADIOTAP_HE_MU;
+ 		rxs->encoding = RX_ENC_HE;
+--- a/drivers/net/wireless/ath/ath11k/hal_rx.c
++++ b/drivers/net/wireless/ath/ath11k/hal_rx.c
+@@ -873,6 +873,13 @@ static u16 ath11k_hal_rx_mpduinfo_get_pe
+ 	return ab->hw_params.hw_ops->mpdu_info_get_peerid(mpdu_info);
+ }
+ 
++static
++u16 ath11k_hal_rxdesc_get_hal_mpdu_ppdu_id(struct ath11k_base *ab,
++					   struct hal_rx_mpdu_info *mpdu_info)
++{
++	return ab->hw_params.hw_ops->rx_desc_get_hal_ppdu_id(mpdu_info);
++}
++
+ static enum hal_rx_mon_status
+ ath11k_hal_rx_parse_mon_status_tlv(struct ath11k_base *ab,
+ 				   struct hal_rx_mon_ppdu_info *ppdu_info,
+@@ -1546,6 +1553,12 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+ 
+ 		ppdu_info->mpdu_len += ab->hw_params.hw_ops->rx_desc_get_hal_mpdu_len(mpdu_info);
+ 
++		if (userid < HAL_MAX_UL_MU_USERS) {
++			ppdu_info->userid = userid;
++			ppdu_info->ampdu_id[userid] =
++				ath11k_hal_rxdesc_get_hal_mpdu_ppdu_id(ab, mpdu_info);
++		}
++
+ 		break;
+ 	}
+ 	case HAL_RXPCU_PPDU_END_INFO: {
+--- a/drivers/net/wireless/ath/ath11k/hal_rx.h
++++ b/drivers/net/wireless/ath/ath11k/hal_rx.h
+@@ -221,6 +221,8 @@ struct hal_rx_mon_ppdu_info {
+ 	u32 num_users;
+ 	u32 mpdu_fcs_ok_bitmap[HAL_RX_NUM_WORDS_PER_PPDU_BITMAP];
+ 	struct hal_rx_user_status userstats[HAL_MAX_UL_MU_USERS];
++	u8 userid;
++	u16 ampdu_id[HAL_MAX_UL_MU_USERS];
+ 	bool ppdu_continuation;
+ };
+ 
+@@ -460,20 +462,22 @@ struct hal_rx_phyrx_rssi_legacy_info {
+ #define HAL_RX_MPDU_INFO_INFO0_PEERID	GENMASK(31, 16)
+ #define HAL_RX_MPDU_INFO_INFO0_PEERID_WCN6855	GENMASK(15, 0)
+ #define HAL_RX_MPDU_INFO_INFO1_MPDU_LEN		GENMASK(13, 0)
++#define HAL_RX_MPDU_INFO_INFO0_PPDU_ID		GENMASK(31, 16)
+ 
+ struct hal_rx_mpdu_info_ipq8074 {
+-	__le32 rsvd0;
+ 	__le32 info0;
+-	__le32 rsvd1[11];
+ 	__le32 info1;
++	__le32 rsvd1[11];
++	__le32 info2;
+ 	__le32 rsvd2[9];
+ } __packed;
+ 
+ struct hal_rx_mpdu_info_qcn9074 {
+-	__le32 rsvd0[10];
++	__le32 rsvd0[9];
+ 	__le32 info0;
+-	__le32 rsvd1[2];
+ 	__le32 info1;
++	__le32 rsvd1[2];
++	__le32 info2;
+ 	__le32 rsvd2[9];
+ } __packed;
+ 
+@@ -493,9 +497,11 @@ struct hal_rx_mpdu_info {
+ 
+ #define HAL_RX_PPDU_END_DURATION	GENMASK(23, 0)
+ struct hal_rx_ppdu_end_duration {
+-	__le32 rsvd0[9];
++	__le32 rsvd0[2];
+ 	__le32 info0;
+-	__le32 rsvd1[4];
++	__le32 rsvd1[6];
++	__le32 info1;
++	__le32 rsvd2[4];
+ } __packed;
+ 
+ struct hal_rx_rxpcu_classification_overview {
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -306,6 +306,7 @@ struct ath11k_hw_ops {
+ 	void (*rx_desc_get_crypto_header)(struct hal_rx_desc *desc,
+ 					  u8 *crypto_hdr,
+ 					  enum hal_encrypt_type enctype);
++	u16 (*rx_desc_get_hal_ppdu_id) (struct hal_rx_mpdu_info *mpdu_info);
+ };
+ 
+ extern const struct ath11k_hw_ops ipq8074_ops;
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -13,6 +13,7 @@
+ #include "hif.h"
+ #include "hal.h"
+ #include "hw.h"
++#include "hal_rx.h"
+ 
+ /* Map from pdev index to hw mac index */
+ static u8 ath11k_hw_ipq8074_mac_from_pdev_id(int pdev_idx)
+@@ -717,17 +718,6 @@ static u8 *ath11k_hw_qcn9074_rx_desc_get
+ 	return &desc->u.qcn9074.msdu_payload[0];
+ }
+ 
+-static bool ath11k_hw_ipq9074_rx_desc_mac_addr2_valid(struct hal_rx_desc *desc)
+-{
+-	return __le32_to_cpu(desc->u.qcn9074.mpdu_start.info11) &
+-	       RX_MPDU_START_INFO11_MAC_ADDR2_VALID;
+-}
+-
+-static u8 *ath11k_hw_ipq9074_rx_desc_mpdu_start_addr2(struct hal_rx_desc *desc)
+-{
+-	return desc->u.qcn9074.mpdu_start.addr2;
+-}
+-
+ static bool ath11k_hw_wcn6855_rx_desc_get_first_msdu(struct hal_rx_desc *desc)
+ {
+ 	return !!FIELD_GET(RX_MSDU_END_INFO2_FIRST_MSDU_WCN6855,
+@@ -1085,12 +1075,27 @@ static void ath11k_hw_ipq5018_reo_setup(
+ }
+ 
+ static u16
++ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_ppdu_id(struct hal_rx_mpdu_info *mpdu_info)
++{
++
++	return FIELD_GET(HAL_RX_MPDU_INFO_INFO0_PPDU_ID,
++			 __le32_to_cpu(mpdu_info->u.ipq8074.info0));
++}
++
++static
++u16 ath11k_hw_qcn9074_rx_desc_get_hal_mpdu_ppdu_id(struct hal_rx_mpdu_info *mpdu_info)
++{
++
++	return FIELD_GET(HAL_RX_MPDU_INFO_INFO0_PPDU_ID,
++			 __le32_to_cpu(mpdu_info->u.qcn9074.info0));
++}
++
++static u16
+ ath11k_hw_ipq8074_mpdu_info_get_peerid(struct hal_rx_mpdu_info *mpdu_info)
+ {
+ 	u16 peer_id = 0;
+-
+ 	peer_id = FIELD_GET(HAL_RX_MPDU_INFO_INFO0_PEERID,
+-			    __le32_to_cpu(mpdu_info->u.ipq8074.info0));
++			    __le32_to_cpu(mpdu_info->u.ipq8074.info1));
+ 
+ 	return peer_id;
+ }
+@@ -1196,6 +1201,7 @@ const struct ath11k_hw_ops ipq8074_ops =
+ 	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2,
+ 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
+ 	.rx_desc_get_hal_mpdu_len = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_len,
++	.rx_desc_get_hal_ppdu_id = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_ppdu_id,
+ #ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
+ 	.rx_desc_get_offset = ath11k_hw_ipq8074_rx_desc_get_offset,
+ #endif
+@@ -1219,6 +1225,7 @@ const struct ath11k_hw_ops ipq6018_ops =
+ 	.rx_desc_get_encrypt_type = ath11k_hw_ipq8074_rx_desc_get_encrypt_type,
+ 	.rx_desc_get_decap_type = ath11k_hw_ipq8074_rx_desc_get_decap_type,
+ 	.rx_desc_get_mesh_ctl = ath11k_hw_ipq8074_rx_desc_get_mesh_ctl,
++	.rx_desc_get_ip_valid = ath11k_hw_ipq8074_rx_desc_get_ip_valid,
+ 	.rx_desc_get_ldpc_support = ath11k_hw_ipq8074_rx_desc_get_ldpc_support,
+ 	.rx_desc_get_mpdu_seq_ctl_vld = ath11k_hw_ipq8074_rx_desc_get_mpdu_seq_ctl_vld,
+ 	.rx_desc_get_mpdu_fc_valid = ath11k_hw_ipq8074_rx_desc_get_mpdu_fc_valid,
+@@ -1251,6 +1258,7 @@ const struct ath11k_hw_ops ipq6018_ops =
+ 	.rx_desc_dot11_hdr_fields_valid = ath11k_hw_ipq8074_rx_desc_dot11_hdr_fields_valid,
+ 	.rx_desc_get_dot11_hdr = ath11k_hw_ipq8074_rx_desc_get_dot11_hdr,
+ 	.rx_desc_get_crypto_header = ath11k_hw_ipq8074_rx_desc_get_crypto_hdr,
++	.rx_desc_get_hal_ppdu_id = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_ppdu_id,
+ };
+ 
+ const struct ath11k_hw_ops qca6390_ops = {
+@@ -1300,6 +1308,7 @@ const struct ath11k_hw_ops qca6390_ops =
+ 	.rx_desc_dot11_hdr_fields_valid = ath11k_hw_ipq8074_rx_desc_dot11_hdr_fields_valid,
+ 	.rx_desc_get_dot11_hdr = ath11k_hw_ipq8074_rx_desc_get_dot11_hdr,
+ 	.rx_desc_get_crypto_header = ath11k_hw_ipq8074_rx_desc_get_crypto_hdr,
++	.rx_desc_get_hal_ppdu_id = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_ppdu_id,
+ };
+ 
+ const struct ath11k_hw_ops qcn9074_ops = {
+@@ -1341,6 +1350,7 @@ const struct ath11k_hw_ops qcn9074_ops =
+ 	.rx_desc_mpdu_start_addr2 = ath11k_hw_qcn9074_rx_desc_mpdu_start_addr2,
+ 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
+ 	.rx_desc_get_hal_mpdu_len = ath11k_hw_qcn9074_rx_desc_get_hal_mpdu_len,
++	.rx_desc_get_hal_ppdu_id = ath11k_hw_qcn9074_rx_desc_get_hal_mpdu_ppdu_id,
+ #ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
+ 	.rx_desc_get_offset = ath11k_hw_qcn9074_rx_desc_get_offset,
+ #endif
+@@ -1389,6 +1399,7 @@ const struct ath11k_hw_ops wcn6855_ops =
+ 	.rx_desc_mpdu_start_addr2 = ath11k_hw_wcn6855_rx_desc_mpdu_start_addr2,
+ 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
+ 	.rx_desc_get_hal_mpdu_len = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_len,
++	.rx_desc_get_hal_ppdu_id = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_ppdu_id,
+ };
+ 
+ const struct ath11k_hw_ops wcn6750_ops = {
+@@ -1405,6 +1416,7 @@ const struct ath11k_hw_ops wcn6750_ops =
+ 	.rx_desc_get_encrypt_type = ath11k_hw_qcn9074_rx_desc_get_encrypt_type,
+ 	.rx_desc_get_decap_type = ath11k_hw_qcn9074_rx_desc_get_decap_type,
+ 	.rx_desc_get_mesh_ctl = ath11k_hw_qcn9074_rx_desc_get_mesh_ctl,
++	.rx_desc_get_ip_valid = ath11k_hw_qcn9074_rx_desc_get_ip_valid,
+ 	.rx_desc_get_ldpc_support = ath11k_hw_qcn9074_rx_desc_get_ldpc_support,
+ 	.rx_desc_get_mpdu_seq_ctl_vld = ath11k_hw_qcn9074_rx_desc_get_mpdu_seq_ctl_vld,
+ 	.rx_desc_get_mpdu_fc_valid = ath11k_hw_qcn9074_rx_desc_get_mpdu_fc_valid,
+@@ -1426,9 +1438,10 @@ const struct ath11k_hw_ops wcn6750_ops =
+ 	.rx_desc_get_msdu_payload = ath11k_hw_qcn9074_rx_desc_get_msdu_payload,
+ 	.reo_setup = ath11k_hw_wcn6855_reo_setup,
+ 	.mpdu_info_get_peerid = ath11k_hw_ipq8074_mpdu_info_get_peerid,
+-	.rx_desc_mac_addr2_valid = ath11k_hw_ipq9074_rx_desc_mac_addr2_valid,
+-	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq9074_rx_desc_mpdu_start_addr2,
++	.rx_desc_mac_addr2_valid = ath11k_hw_qcn9074_rx_desc_mac_addr2_valid,
++	.rx_desc_mpdu_start_addr2 = ath11k_hw_qcn9074_rx_desc_mpdu_start_addr2,
+ 	.get_ring_selector = ath11k_hw_wcn6750_get_tcl_ring_selector,
++	.rx_desc_get_hal_ppdu_id = ath11k_hw_qcn9074_rx_desc_get_hal_mpdu_ppdu_id,
+ };
+ 
+ /* IPQ5018 hw ops is similar to QCN9074 except for the dest ring remap */
+@@ -1468,10 +1481,11 @@ const struct ath11k_hw_ops ipq5018_ops =
+ 	.reo_setup = ath11k_hw_ipq5018_reo_setup,
+ 	.rx_desc_get_msdu_payload = ath11k_hw_qcn9074_rx_desc_get_msdu_payload,
+ 	.mpdu_info_get_peerid = ath11k_hw_ipq8074_mpdu_info_get_peerid,
+-	.rx_desc_mac_addr2_valid = ath11k_hw_ipq9074_rx_desc_mac_addr2_valid,
+-	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq9074_rx_desc_mpdu_start_addr2,
++	.rx_desc_mac_addr2_valid = ath11k_hw_qcn9074_rx_desc_mac_addr2_valid,
++	.rx_desc_mpdu_start_addr2 = ath11k_hw_qcn9074_rx_desc_mpdu_start_addr2,
+ 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
+ 	.rx_desc_get_hal_mpdu_len = ath11k_hw_qcn9074_rx_desc_get_hal_mpdu_len,
++	.rx_desc_get_hal_ppdu_id = ath11k_hw_qcn9074_rx_desc_get_hal_mpdu_ppdu_id,
+ };
+ 
+ #define ATH11K_TX_RING_MASK_0 BIT(0)
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-336-0001-ath11k-idr-optimization.patch b/package/kernel/mac80211/patches/nss/ath11k/999-336-0001-ath11k-idr-optimization.patch
new file mode 100644
index 00000000000000..499f720caba8cb
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-336-0001-ath11k-idr-optimization.patch
@@ -0,0 +1,132 @@
+From 58c0d08408e58f0f496127a59465726457dc72c8 Mon Sep 17 00:00:00 2001
+From: Tamizh Chelvam <quic_tamizhr@quicinc.com>
+Date: Mon, 15 Nov 2021 17:51:43 +0530
+Subject: [PATCH] ath11k: idr optimization
+
+Replace idr_find and idr_remove with idr_remove. As idr_remove
+itself will do idr_find. And use dma low level api.
+
+Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
+---
+ backport-include/linux/idr.h            |  4 +++
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 52 +++++++++++----------------------
+ drivers/net/wireless/ath/ath11k/dp_tx.c |  2 +-
+ 3 files changed, 22 insertions(+), 36 deletions(-)
+
+--- a/backport-include/linux/idr.h
++++ b/backport-include/linux/idr.h
+@@ -8,6 +8,10 @@
+ static inline void *backport_idr_remove(struct idr *idr, int id)
+ {
+ 	void *item = idr_find(idr, id);
++
++	if (!item)
++		return NULL;
++
+ 	idr_remove(idr, id);
+ 	return item;
+ }
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -3336,18 +3336,16 @@ try_again:
+ 		ar = ab->pdevs[mac_id].ar;
+ 		rx_ring = &ar->dp.rx_refill_buf_ring;
+ 		spin_lock_bh(&rx_ring->idr_lock);
+-		msdu = idr_find(&rx_ring->bufs_idr, buf_id);
++		msdu = idr_remove(&rx_ring->bufs_idr, buf_id);
++		spin_unlock_bh(&rx_ring->idr_lock);
+ 		if (unlikely(!msdu)) {
+ 			ath11k_warn(ab, "frame rx with invalid buf_id %d\n",
+ 				    buf_id);
+-			spin_unlock_bh(&rx_ring->idr_lock);
+ 			continue;
+ 		}
+ 
+-		idr_remove(&rx_ring->bufs_idr, buf_id);
+-		spin_unlock_bh(&rx_ring->idr_lock);
+-
+ 		rxcb = ATH11K_SKB_RXCB(msdu);
++
+ 		dma_unmap_single(ab->dev, rxcb->paddr,
+ 				 msdu->len + skb_tailroom(msdu),
+ 				 DMA_FROM_DEVICE);
+@@ -4574,17 +4572,14 @@ ath11k_dp_process_rx_err_buf(struct ath1
+ 	u32 hal_rx_desc_sz = ar->ab->hw_params.hal_desc_sz;
+ 
+ 	spin_lock_bh(&rx_ring->idr_lock);
+-	msdu = idr_find(&rx_ring->bufs_idr, buf_id);
++	msdu = idr_remove(&rx_ring->bufs_idr, buf_id);
++	spin_unlock_bh(&rx_ring->idr_lock);
+ 	if (!msdu) {
+ 		ath11k_warn(ar->ab, "rx err buf with invalid buf_id %d\n",
+ 			    buf_id);
+-		spin_unlock_bh(&rx_ring->idr_lock);
+ 		return -EINVAL;
+ 	}
+ 
+-	idr_remove(&rx_ring->bufs_idr, buf_id);
+-	spin_unlock_bh(&rx_ring->idr_lock);
+-
+ 	rxcb = ATH11K_SKB_RXCB(msdu);
+ 	dma_unmap_single(ar->ab->dev, rxcb->paddr,
+ 			 msdu->len + skb_tailroom(msdu),
+@@ -5005,18 +5000,16 @@ int ath11k_dp_rx_process_wbm_err(struct
+ 		rx_ring = &ar->dp.rx_refill_buf_ring;
+ 
+ 		spin_lock_bh(&rx_ring->idr_lock);
+-		msdu = idr_find(&rx_ring->bufs_idr, buf_id);
++ 		msdu = idr_remove(&rx_ring->bufs_idr, buf_id);
++		spin_unlock_bh(&rx_ring->idr_lock);
+ 		if (!msdu) {
+ 			ath11k_warn(ab, "frame rx with invalid buf_id %d pdev %d\n",
+ 				    buf_id, mac_id);
+-			spin_unlock_bh(&rx_ring->idr_lock);
+ 			continue;
+ 		}
+ 
+-		idr_remove(&rx_ring->bufs_idr, buf_id);
+-		spin_unlock_bh(&rx_ring->idr_lock);
+-
+ 		rxcb = ATH11K_SKB_RXCB(msdu);
++
+ 		dma_unmap_single(ab->dev, rxcb->paddr,
+ 				 msdu->len + skb_tailroom(msdu),
+ 				 DMA_FROM_DEVICE);
+@@ -5131,16 +5124,14 @@ int ath11k_dp_process_rxdma_err(struct a
+ 					   msdu_cookies[i]);
+ 
+ 			spin_lock_bh(&rx_ring->idr_lock);
+-			skb = idr_find(&rx_ring->bufs_idr, buf_id);
++			skb = idr_remove(&rx_ring->bufs_idr, buf_id);
++			spin_unlock_bh(&rx_ring->idr_lock);
+ 			if (!skb) {
+ 				ath11k_warn(ab, "rxdma error with invalid buf_id %d\n",
+ 					    buf_id);
+-				spin_unlock_bh(&rx_ring->idr_lock);
+ 				continue;
+ 			}
+ 
+-			idr_remove(&rx_ring->bufs_idr, buf_id);
+-			spin_unlock_bh(&rx_ring->idr_lock);
+ 
+ 			rxcb = ATH11K_SKB_RXCB(skb);
+ 			dma_unmap_single(ab->dev, rxcb->paddr,
+@@ -6399,16 +6390,14 @@ ath11k_dp_rx_full_mon_mpdu_pop(struct at
+ 					   msdu_list.sw_cookie[i]);
+ 
+ 			spin_lock_bh(&rx_ring->idr_lock);
+-			msdu = idr_find(&rx_ring->bufs_idr, buf_id);
++			msdu = idr_remove(&rx_ring->bufs_idr, buf_id);
++			spin_unlock_bh(&rx_ring->idr_lock);
+ 			if (!msdu) {
+ 				ath11k_dbg(ar->ab, ATH11K_DBG_DATA,
+ 					   "full mon msdu_pop: invalid buf_id %d\n",
+ 					    buf_id);
+-				spin_unlock_bh(&rx_ring->idr_lock);
+ 				break;
+ 			}
+-			idr_remove(&rx_ring->bufs_idr, buf_id);
+-			spin_unlock_bh(&rx_ring->idr_lock);
+ 
+ 			rxcb = ATH11K_SKB_RXCB(msdu);
+ 			if (!rxcb->unmapped) {
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch b/package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch
new file mode 100644
index 00000000000000..c5134fca93a867
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch
@@ -0,0 +1,280 @@
+From 93abe1755de2727bf8fb5969bce25ae49c704484 Mon Sep 17 00:00:00 2001
+From: Tamizh Chelvam <quic_tamizhr@quicinc.com>
+Date: Mon, 15 Nov 2021 18:15:38 +0530
+Subject: [PATCH] ath11k: Use idr_replace
+
+idr_alloc has been done multiple times upon reaping the msdu
+using idr_remove. This idr_alloc would take more cpu, to redue
+the cpu usage call idr_replace by storing used buf_ids instead
+of calling idr_alloc during replenish.
+
+Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/core.h  |  6 +++
+ drivers/net/wireless/ath/ath11k/dp.c    |  2 +-
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 66 +++++++++++++++++++++++++--------
+ drivers/net/wireless/ath/ath11k/dp_rx.h |  2 +-
+ 4 files changed, 59 insertions(+), 17 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -662,6 +662,11 @@ struct ath11k_per_peer_tx_stats {
+ #define ATH11K_FLUSH_TIMEOUT (5 * HZ)
+ #define ATH11K_VDEV_DELETE_TIMEOUT_HZ (5 * HZ)
+ 
++struct ath11k_rx_buf_id {
++	struct list_head list;
++	int used_buf_id;
++};
++
+ struct ath11k {
+ 	struct ath11k_base *ab;
+ 	struct ath11k_pdev *pdev;
+@@ -811,6 +816,7 @@ struct ath11k {
+ 	/* protected by conf_mutex */
+ 	bool ps_state_enable;
+ 	bool ps_timekeeper_enable;
++	struct ath11k_rx_buf_id rx_buf_id;
+ };
+ 
+ struct ath11k_band_cap {
+--- a/drivers/net/wireless/ath/ath11k/dp.c
++++ b/drivers/net/wireless/ath/ath11k/dp.c
+@@ -897,7 +897,7 @@ int ath11k_dp_service_srng(struct ath11k
+ 
+ 				hal_params = ab->hw_params.hal_params;
+ 				ath11k_dp_rxbufs_replenish(ab, id, rx_ring, 0,
+-							   hal_params->rx_buf_rbm);
++							   hal_params->rx_buf_rbm, NULL);
+ 			}
+ 		}
+ 	}
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -388,7 +388,8 @@ static inline u8 ath11k_dp_rx_h_msdu_sta
+ int ath11k_dp_rxbufs_replenish(struct ath11k_base *ab, int mac_id,
+ 			       struct dp_rxdma_ring *rx_ring,
+ 			       int req_entries,
+-			       enum hal_rx_buf_return_buf_manager mgr)
++			       enum hal_rx_buf_return_buf_manager mgr,
++				   u32 *buf_ids)
+ {
+ 	struct hal_srng *srng;
+ 	u32 *desc;
+@@ -396,9 +397,15 @@ int ath11k_dp_rxbufs_replenish(struct at
+ 	int num_free;
+ 	int num_remain;
+ 	int buf_id;
++	int buf_id_index;
+ 	u32 cookie;
+ 	dma_addr_t paddr;
+ 
++	if (!buf_ids)
++		buf_id_index = 0;
++	else
++		buf_id_index = min(req_entries, DP_RX_MAX_IDR_BUF);
++
+ 	req_entries = min(req_entries, rx_ring->bufs_max);
+ 
+ 	srng = &ab->hal.srng_list[rx_ring->refill_buf_ring.ring_id];
+@@ -434,8 +441,14 @@ int ath11k_dp_rxbufs_replenish(struct at
+ 			goto fail_free_skb;
+ 
+ 		spin_lock_bh(&rx_ring->idr_lock);
++		if (buf_ids && buf_id_index) {
++			buf_id_index--;
++			buf_id = buf_ids[buf_id_index];
++			idr_replace(&rx_ring->bufs_idr, skb, buf_id);
++		} else {
+ 			buf_id = idr_alloc(&rx_ring->bufs_idr, skb, 1,
+ 					(rx_ring->bufs_max * 3) + 1, GFP_ATOMIC);
++		}
+ 		spin_unlock_bh(&rx_ring->idr_lock);
+ 		if (buf_id <= 0)
+ 			goto fail_dma_unmap;
+@@ -458,6 +471,12 @@ int ath11k_dp_rxbufs_replenish(struct at
+ 
+ 	spin_unlock_bh(&srng->lock);
+ 
++	while (buf_id_index--) {
++		spin_lock_bh(&rx_ring->idr_lock);
++		idr_remove(&rx_ring->bufs_idr, buf_ids[buf_id_index]);
++		spin_unlock_bh(&rx_ring->idr_lock);
++	}
++
+ 	return req_entries - num_remain;
+ 
+ fail_idr_remove:
+@@ -532,7 +551,7 @@ static int ath11k_dp_rxdma_ring_buf_setu
+ 
+ 	rx_ring->bufs_max = num_entries;
+ 	ath11k_dp_rxbufs_replenish(ar->ab, dp->mac_id, rx_ring, num_entries,
+-				   ar->ab->hw_params.hal_params->rx_buf_rbm);
++				   ar->ab->hw_params.hal_params->rx_buf_rbm, NULL);
+ 	return 0;
+ }
+ 
+@@ -3346,11 +3365,14 @@ int ath11k_dp_process_rx(struct ath11k_b
+ 	struct ath11k *ar;
+ 	struct hal_reo_dest_ring *desc;
+ 	enum hal_reo_dest_ring_push_reason push_reason;
++	u32 *rx_buf_id[MAX_RADIOS];
+ 	u32 cookie;
+ 	int i;
+ 
+-	for (i = 0; i < MAX_RADIOS; i++)
++	for (i = 0; i < MAX_RADIOS; i++) {
+ 		__skb_queue_head_init(&msdu_list[i]);
++		rx_buf_id[i] = kzalloc(sizeof(u32) * DP_RX_MAX_IDR_BUF, GFP_ATOMIC);
++	}
+ 
+ 	srng = &ab->hal.srng_list[dp->reo_dst_ring[ring_id].ring_id];
+ 
+@@ -3385,8 +3407,15 @@ try_again:
+ 
+ 		ar = ab->pdevs[mac_id].ar;
+ 		rx_ring = &ar->dp.rx_refill_buf_ring;
++		i = num_buffs_reaped[mac_id];
++
+ 		spin_lock_bh(&rx_ring->idr_lock);
+-		msdu = idr_remove(&rx_ring->bufs_idr, buf_id);
++		if (rx_buf_id[mac_id] && i < DP_RX_MAX_IDR_BUF) {
++			msdu = idr_find(&rx_ring->bufs_idr, buf_id);
++			rx_buf_id[mac_id][i] = buf_id;
++		} else {
++			msdu = idr_remove(&rx_ring->bufs_idr, buf_id);
++		}
+ 		spin_unlock_bh(&rx_ring->idr_lock);
+ 		if (unlikely(!msdu)) {
+ 			ath11k_warn(ab, "frame rx with invalid buf_id %d\n",
+@@ -3464,9 +3493,12 @@ try_again:
+ 		rx_ring = &ar->dp.rx_refill_buf_ring;
+ 
+ 		ath11k_dp_rxbufs_replenish(ab, i, rx_ring, num_buffs_reaped[i],
+-					   ab->hw_params.hal_params->rx_buf_rbm);
++					   ab->hw_params.hal_params->rx_buf_rbm, rx_buf_id[i]);
+ 	}
+ exit:
++	for (i = 0; i < MAX_RADIOS; i++)
++		kfree(rx_buf_id[i]);
++
+ 	return total_msdu_reaped;
+ }
+ 
+@@ -4831,7 +4864,7 @@ exit:
+ 		rx_ring = &ar->dp.rx_refill_buf_ring;
+ 
+ 		ath11k_dp_rxbufs_replenish(ab, i, rx_ring, n_bufs_reaped[i],
+-					   ab->hw_params.hal_params->rx_buf_rbm);
++					   ab->hw_params.hal_params->rx_buf_rbm, NULL);
+ 	}
+ 
+ 	return tot_n_bufs_reaped;
+@@ -5047,14 +5080,17 @@ int ath11k_dp_rx_process_wbm_err(struct
+ 	struct sk_buff *msdu;
+ 	struct sk_buff_head msdu_list[MAX_RADIOS];
+ 	struct ath11k_skb_rxcb *rxcb;
++	u32 *wbm_err_buf_id[MAX_RADIOS];
+ 	u32 *rx_desc;
+ 	int buf_id, mac_id;
+ 	int num_buffs_reaped[MAX_RADIOS] = {0};
+ 	int total_num_buffs_reaped = 0;
+ 	int ret, i;
+ 
+-	for (i = 0; i < ab->num_radios; i++)
++	for (i = 0; i < ab->num_radios; i++) {
+ 		__skb_queue_head_init(&msdu_list[i]);
++		wbm_err_buf_id[i] = kzalloc(sizeof(u32) * DP_RX_MAX_IDR_BUF, GFP_ATOMIC);
++	}
+ 
+ 	srng = &ab->hal.srng_list[dp->rx_rel_ring.ring_id];
+ 
+@@ -5077,9 +5112,15 @@ int ath11k_dp_rx_process_wbm_err(struct
+ 
+ 		ar = ab->pdevs[mac_id].ar;
+ 		rx_ring = &ar->dp.rx_refill_buf_ring;
++		i = num_buffs_reaped[mac_id];
+ 
+ 		spin_lock_bh(&rx_ring->idr_lock);
+- 		msdu = idr_remove(&rx_ring->bufs_idr, buf_id);
++		if (wbm_err_buf_id[mac_id] && i < DP_RX_MAX_IDR_BUF) {
++			msdu = idr_find(&rx_ring->bufs_idr, buf_id);
++			wbm_err_buf_id[mac_id][i] = buf_id;
++		} else {
++			msdu = idr_remove(&rx_ring->bufs_idr, buf_id);
++		}
+ 		spin_unlock_bh(&rx_ring->idr_lock);
+ 		if (!msdu) {
+ 			ath11k_warn(ab, "frame rx with invalid buf_id %d pdev %d\n",
+@@ -5124,7 +5165,7 @@ int ath11k_dp_rx_process_wbm_err(struct
+ 		rx_ring = &ar->dp.rx_refill_buf_ring;
+ 
+ 		ath11k_dp_rxbufs_replenish(ab, i, rx_ring, num_buffs_reaped[i],
+-					   ab->hw_params.hal_params->rx_buf_rbm);
++					   ab->hw_params.hal_params->rx_buf_rbm, wbm_err_buf_id[i]);
+ 	}
+ 
+ 	rcu_read_lock();
+@@ -5151,6 +5187,8 @@ int ath11k_dp_rx_process_wbm_err(struct
+ 	}
+ 	rcu_read_unlock();
+ done:
++	for (i = 0; i < ab->num_radios; i++)
++		kfree(wbm_err_buf_id[i]);
+ 	return total_num_buffs_reaped;
+ }
+ 
+@@ -5238,7 +5276,7 @@ int ath11k_dp_process_rxdma_err(struct a
+ 
+ 	if (num_buf_freed)
+ 		ath11k_dp_rxbufs_replenish(ab, mac_id, rx_ring, num_buf_freed,
+-					   ab->hw_params.hal_params->rx_buf_rbm);
++					   ab->hw_params.hal_params->rx_buf_rbm, NULL);
+ 
+ 	return budget - quota;
+ }
+@@ -6184,12 +6222,12 @@ static void ath11k_dp_rx_mon_dest_proces
+ 			ath11k_dp_rxbufs_replenish(ar->ab, dp->mac_id,
+ 						   &dp->rxdma_mon_buf_ring,
+ 						   rx_bufs_used,
+-						   hal_params->rx_buf_rbm);
++						   hal_params->rx_buf_rbm, NULL);
+ 		else
+ 			ath11k_dp_rxbufs_replenish(ar->ab, dp->mac_id,
+ 						   &dp->rx_refill_buf_ring,
+ 						   rx_bufs_used,
+-						   hal_params->rx_buf_rbm);
++						   hal_params->rx_buf_rbm, NULL);
+ 	}
+ }
+ 
+@@ -6701,7 +6739,7 @@ next_entry:
+ 		ath11k_dp_rxbufs_replenish(ar->ab, dp->mac_id,
+ 					   &dp->rxdma_mon_buf_ring,
+ 					   rx_bufs_used,
+-					   HAL_RX_BUF_RBM_SW3_BM);
++					   HAL_RX_BUF_RBM_SW3_BM, NULL);
+ 	}
+ 
+ reap_status_ring:
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.h
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.h
+@@ -11,6 +11,8 @@
+ 
+ #define DP_MAX_NWIFI_HDR_LEN	36
+ 
++#define DP_RX_MAX_IDR_BUF    256
++
+ #define DP_RX_MPDU_ERR_FCS			BIT(0)
+ #define DP_RX_MPDU_ERR_DECRYPT			BIT(1)
+ #define DP_RX_MPDU_ERR_TKIP_MIC			BIT(2)
+@@ -125,7 +127,8 @@ int ath11k_dp_process_rx(struct ath11k_b
+ int ath11k_dp_rxbufs_replenish(struct ath11k_base *ab, int mac_id,
+ 			       struct dp_rxdma_ring *rx_ring,
+ 			       int req_entries,
+-			       enum hal_rx_buf_return_buf_manager mgr);
++ 			       enum hal_rx_buf_return_buf_manager mgr,
++			       u32 *buf_id);
+ int ath11k_dp_htt_tlv_iter(struct ath11k_base *ab, const void *ptr, size_t len,
+ 			   int (*iter)(struct ath11k_base *ar, u16 tag, u16 len,
+ 				       const void *ptr, void *data),
diff --git a/package/kernel/mac80211/patches/ath11k_nss/913-374-ath11k-Check-skb_headroom-before-using-skb_push.patch b/package/kernel/mac80211/patches/nss/ath11k/999-374-ath11k-Check-skb_headroom-before-using-skb_push.patch
similarity index 78%
rename from package/kernel/mac80211/patches/ath11k_nss/913-374-ath11k-Check-skb_headroom-before-using-skb_push.patch
rename to package/kernel/mac80211/patches/nss/ath11k/999-374-ath11k-Check-skb_headroom-before-using-skb_push.patch
index 1bbbdd6c7446da..b58b13eebe1d40 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/913-374-ath11k-Check-skb_headroom-before-using-skb_push.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-374-ath11k-Check-skb_headroom-before-using-skb_push.patch
@@ -35,7 +35,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -2270,16 +2270,27 @@ static void ath11k_get_dot11_hdr_from_rx
+@@ -2454,16 +2454,27 @@ static void ath11k_get_dot11_hdr_from_rx
  	size_t hdr_len, crypto_len;
  	struct ieee80211_hdr *hdr;
  	u16 fc, qos_ctl = 0;
@@ -63,7 +63,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	skb_push(msdu, hdr_len);
  	hdr = (struct ieee80211_hdr *)msdu->data;
  	hdr->frame_control = fc;
-@@ -2315,6 +2326,7 @@ static void ath11k_dp_rx_h_undecap_nwifi
+@@ -2499,6 +2510,7 @@ static void ath11k_dp_rx_h_undecap_nwifi
  	u8 da[ETH_ALEN];
  	u8 sa[ETH_ALEN];
  	u16 qos_ctl = 0;
@@ -71,7 +71,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	u8 *qos, *crypto_hdr;
  	bool add_qos_ctrl = false;
  
-@@ -2359,26 +2371,46 @@ static void ath11k_dp_rx_h_undecap_nwifi
+@@ -2543,26 +2555,46 @@ static void ath11k_dp_rx_h_undecap_nwifi
  	}
  
  	if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
@@ -123,7 +123,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
  
  	/* original 802.11 header has a different DA and in
-@@ -2487,6 +2519,7 @@ static void ath11k_dp_rx_h_undecap_eth(s
+@@ -2671,6 +2703,7 @@ static void ath11k_dp_rx_h_undecap_eth(s
  	u8 da[ETH_ALEN];
  	u8 sa[ETH_ALEN];
  	void *rfc1042;
@@ -131,7 +131,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
  	struct ath11k_dp_rfc1042_hdr rfc = {0xaa, 0xaa, 0x03, {0x00, 0x00, 0x00}};
  
-@@ -2496,6 +2529,11 @@ static void ath11k_dp_rx_h_undecap_eth(s
+@@ -2680,6 +2713,11 @@ static void ath11k_dp_rx_h_undecap_eth(s
  		ether_addr_copy(sa, eth->h_source);
  		rfc.snap_type = eth->h_proto;
  		skb_pull(msdu, sizeof(struct ethhdr));
@@ -143,7 +143,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  		memcpy(skb_push(msdu, sizeof(struct ath11k_dp_rfc1042_hdr)), &rfc,
  		       sizeof(struct ath11k_dp_rfc1042_hdr));
  		ath11k_get_dot11_hdr_from_rx_desc(ar, msdu, rxcb, status, enctype);
-@@ -2513,6 +2551,11 @@ static void ath11k_dp_rx_h_undecap_eth(s
+@@ -2697,6 +2735,11 @@ static void ath11k_dp_rx_h_undecap_eth(s
  	skb_pull(msdu, sizeof(struct ethhdr));
  
  	/* push rfc1042/llc/snap */
@@ -155,7 +155,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	memcpy(skb_push(msdu, sizeof(struct ath11k_dp_rfc1042_hdr)), rfc1042,
  	       sizeof(struct ath11k_dp_rfc1042_hdr));
  
-@@ -2521,12 +2564,22 @@ static void ath11k_dp_rx_h_undecap_eth(s
+@@ -2705,12 +2748,22 @@ static void ath11k_dp_rx_h_undecap_eth(s
  	hdr_len = ieee80211_hdrlen(hdr->frame_control);
  
  	if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
@@ -182,7 +182,51 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
  
  exit:
-@@ -2954,10 +3007,16 @@ static void ath11k_dp_rx_deliver_msdu(st
+@@ -2731,6 +2784,7 @@ static void ath11k_dp_rx_h_undecap_snap(
+ 	struct ieee80211_hdr *hdr;
+ 	size_t hdr_len;
+ 	u8 l3_pad_bytes;
++	int expand_by;
+ 	struct hal_rx_desc *rx_desc;
+ 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
+ 
+@@ -2755,12 +2809,22 @@ static void ath11k_dp_rx_h_undecap_snap(
+ 	hdr_len = ieee80211_hdrlen(hdr->frame_control);
+ 
+ 	if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
+-		memcpy(skb_push(msdu,
+-				ath11k_dp_rx_crypto_param_len(ar, enctype)),
+-		       (void *)hdr + hdr_len,
+-			ath11k_dp_rx_crypto_param_len(ar, enctype));
++		int crypto_param_len = ath11k_dp_rx_crypto_param_len(ar, enctype);
++
++		if (skb_headroom(msdu) < crypto_param_len) {
++			expand_by = crypto_param_len - skb_headroom(msdu);
++			if (WARN_ON_ONCE(pskb_expand_head(msdu, expand_by, 0, GFP_ATOMIC)))
++				return;
++		}
++		memcpy(skb_push(msdu, crypto_param_len),
++		       (void *)hdr + hdr_len, crypto_param_len);
+ 	}
+ 
++	if (skb_headroom(msdu) < hdr_len) {
++		expand_by = hdr_len - skb_headroom(msdu);
++		if (WARN_ON_ONCE(pskb_expand_head(msdu, expand_by, 0, GFP_ATOMIC)))
++			return;
++	}
+ 	memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
+ }
+ 
+@@ -2890,7 +2954,7 @@ static void ath11k_dp_rx_h_mpdu(struct a
+ 				struct ieee80211_rx_status *rx_status,
+ 				bool *fast_rx)
+ {
+-	bool  fill_crypto_hdr;
++	bool fill_crypto_hdr = 0;
+ 	enum hal_encrypt_type enctype;
+ 	bool is_decrypted = false;
+ 	struct ath11k_skb_rxcb *rxcb;
+@@ -3123,10 +3187,16 @@ static void ath11k_dp_rx_deliver_msdu(st
  	u8 decap = DP_RX_DECAP_TYPE_RAW;
  	bool is_mcbc = rxcb->is_mcbc;
  	bool is_eapol = rxcb->is_eapol;
@@ -199,11 +243,11 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  		he = skb_push(msdu, sizeof(known));
  		memcpy(he, &known, sizeof(known));
  		status->flag |= RX_FLAG_RADIOTAP_HE;
-@@ -3013,6 +3072,7 @@ static void ath11k_dp_rx_deliver_msdu(st
+@@ -3182,6 +3252,7 @@ static void ath11k_dp_rx_deliver_msdu(st
  	    !(is_mcbc && rx_status->flag & RX_FLAG_DECRYPTED))
  		rx_status->flag |= RX_FLAG_8023;
  
 +exit:
  	ieee80211_rx_napi(ar->hw, pubsta, msdu, napi);
+ }
  
- 	if (ath11k_debugfs_is_extd_rx_stats_enabled(ar)) {
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-783-001-wifi-ath11k-Fix-BCCA-counter-for-EMA.patch b/package/kernel/mac80211/patches/nss/ath11k/999-783-001-wifi-ath11k-Fix-BCCA-counter-for-EMA.patch
new file mode 100644
index 00000000000000..cf712593cc15b8
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-783-001-wifi-ath11k-Fix-BCCA-counter-for-EMA.patch
@@ -0,0 +1,115 @@
+From ea4988df80e62204c411a60bafadfbff23eaa773 Mon Sep 17 00:00:00 2001
+From: Rameshkumar Sundaram <quic_ramess@quicinc.com>
+Date: Thu, 15 Jun 2023 14:33:55 +0530
+Subject: [PATCH] wifi: ath11k: Fix BCCA counter for EMA
+
+Currently BCCA counter is updated to FW via csa counter offs and
+beacon with new countdown is updated for every beacon tx completion event.
+For EMA, all EMA beacons are updated in one shot, and counter update for
+every tx event will mess up the actual sequence of countdown sent over the air.
+
+Allow FW to update the countdown till 1 and finalize the color
+change.
+
+Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 21 ---------------------
+ drivers/net/wireless/ath/ath11k/mac.h |  1 -
+ drivers/net/wireless/ath/ath11k/wmi.c | 23 +++++++++++++++--------
+ 3 files changed, 15 insertions(+), 30 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -1601,27 +1601,6 @@ static int ath11k_mac_setup_bcn_tmpl(str
+ 	return ath11k_mac_setup_bcn_tmpl_mbssid(arvif);
+ }
+ 
+-void ath11k_mac_bcn_tx_event(struct ath11k_vif *arvif)
+-{
+-	struct ieee80211_vif *vif = arvif->vif;
+-
+-	if (!vif->bss_conf.color_change_active && !arvif->bcca_zero_sent)
+-		return;
+-
+-	if (vif->bss_conf.color_change_active &&
+-	    ieee80211_beacon_cntdwn_is_complete(vif)) {
+-		arvif->bcca_zero_sent = true;
+-		ieee80211_color_change_finish(vif);
+-		return;
+-	}
+-
+-	arvif->bcca_zero_sent = false;
+-
+-	if (vif->bss_conf.color_change_active)
+-		ieee80211_beacon_update_cntdwn(vif);
+-	ath11k_mac_setup_bcn_tmpl(arvif);
+-}
+-
+ static void ath11k_control_beaconing(struct ath11k_vif *arvif,
+ 				     struct ieee80211_bss_conf *info)
+ {
+--- a/drivers/net/wireless/ath/ath11k/mac.h
++++ b/drivers/net/wireless/ath/ath11k/mac.h
+@@ -170,7 +170,6 @@ enum ath11k_supported_bw ath11k_mac_mac8
+ enum hal_encrypt_type ath11k_dp_tx_get_encrypt_type(u32 cipher);
+ void ath11k_mac_handle_beacon(struct ath11k *ar, struct sk_buff *skb);
+ void ath11k_mac_handle_beacon_miss(struct ath11k *ar, u32 vdev_id);
+-void ath11k_mac_bcn_tx_event(struct ath11k_vif *arvif);
+ int ath11k_mac_wait_tx_complete(struct ath11k *ar);
+ int ath11k_mac_vif_set_keepalive(struct ath11k_vif *arvif,
+ 				 enum wmi_sta_keepalive_method method,
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -1874,9 +1874,10 @@ int ath11k_wmi_bcn_tmpl(struct ath11k *a
+ 	cmd->vdev_id = vdev_id;
+ 	cmd->tim_ie_offset = offs->tim_offset;
+ 
+-	if (vif->bss_conf.csa_active) {
++	if (vif->bss_conf.csa_active || vif->bss_conf.color_change_active) {
+ 		cmd->csa_switch_count_offset = offs->cntdwn_counter_offs[0];
+ 		cmd->ext_csa_switch_count_offset = offs->cntdwn_counter_offs[1];
++		cmd->csa_event_bitmap = cpu_to_le32(0xFFFFFFFF);
+ 	}
+ 
+ 	cmd->buf_len = bcn->len;
+@@ -7586,7 +7587,6 @@ static void ath11k_bcn_tx_status_event(s
+ 		rcu_read_unlock();
+ 		return;
+ 	}
+-	ath11k_mac_bcn_tx_event(arvif);
+ 	rcu_read_unlock();
+ }
+ 
+@@ -8500,10 +8500,7 @@ ath11k_wmi_process_csa_switch_count_even
+ {
+ 	int i;
+ 	struct ath11k_vif *arvif;
+-
+-	/* Finish CSA once the switch count becomes NULL */
+-	if (ev->current_switch_count)
+-		return;
++	struct ieee80211_bss_conf *bss_conf;
+ 
+ 	rcu_read_lock();
+ 	for (i = 0; i < ev->num_vdevs; i++) {
+@@ -8515,8 +8512,18 @@ ath11k_wmi_process_csa_switch_count_even
+ 			continue;
+ 		}
+ 
+-		if (arvif->is_up && arvif->vif->bss_conf.csa_active)
+-			ieee80211_csa_finish(arvif->vif);
++		bss_conf = &arvif->vif->bss_conf;
++		if (arvif->is_up && (bss_conf->csa_active || bss_conf->color_change_active)) {
++			if (!ev->current_switch_count) {
++				if (bss_conf->csa_active)
++					ieee80211_csa_finish(arvif->vif);
++			} else if (ev->current_switch_count > 1) {
++				ieee80211_beacon_update_cntdwn(arvif->vif);
++			} else {
++				if (bss_conf->color_change_active)
++					ieee80211_color_change_finish(arvif->vif);
++			}
++		}
+ 	}
+ 	rcu_read_unlock();
+ }
diff --git a/package/kernel/mac80211/patches/ath11k_nss/900-fix-build.patch b/package/kernel/mac80211/patches/nss/subsys/007-fix_compilation_issue.patch
similarity index 61%
rename from package/kernel/mac80211/patches/ath11k_nss/900-fix-build.patch
rename to package/kernel/mac80211/patches/nss/subsys/007-fix_compilation_issue.patch
index 12feacda8555f7..d89cfbe51cb8ab 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/900-fix-build.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/007-fix_compilation_issue.patch
@@ -1,62 +1,6 @@
---- a/drivers/net/wireless/ath/ath11k/dp_rx.c
-+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -2305,6 +2305,7 @@ static void ath11k_dp_rx_h_undecap_snap(
- 	struct ieee80211_hdr *hdr;
- 	size_t hdr_len;
- 	u8 l3_pad_bytes;
-+	int expand_by;
- 	struct hal_rx_desc *rx_desc;
- 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
- 
-@@ -2329,12 +2330,22 @@ static void ath11k_dp_rx_h_undecap_snap(
- 	hdr_len = ieee80211_hdrlen(hdr->frame_control);
- 
- 	if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
--		memcpy(skb_push(msdu,
--				ath11k_dp_rx_crypto_param_len(ar, enctype)),
--		       (void *)hdr + hdr_len,
--			ath11k_dp_rx_crypto_param_len(ar, enctype));
-+		int crypto_param_len = ath11k_dp_rx_crypto_param_len(ar, enctype);
-+
-+		if (skb_headroom(msdu) < crypto_param_len) {
-+			expand_by = crypto_param_len - skb_headroom(msdu);
-+			if (WARN_ON_ONCE(pskb_expand_head(msdu, expand_by, 0, GFP_ATOMIC)))
-+				return;
-+		}
-+		memcpy(skb_push(msdu, crypto_param_len),
-+		       (void *)hdr + hdr_len, crypto_param_len);
- 	}
- 
-+	if (skb_headroom(msdu) < hdr_len) {
-+		expand_by = hdr_len - skb_headroom(msdu);
-+		if (WARN_ON_ONCE(pskb_expand_head(msdu, expand_by, 0, GFP_ATOMIC)))
-+			return;
-+	}
- 	memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
- }
- 
-@@ -2464,7 +2475,7 @@ static void ath11k_dp_rx_h_mpdu(struct a
- 				struct ieee80211_rx_status *rx_status,
- 				bool *fast_rx)
- {
--	bool  fill_crypto_hdr;
-+	bool fill_crypto_hdr = 0;
- 	enum hal_encrypt_type enctype;
- 	bool is_decrypted = false;
- 	struct ath11k_skb_rxcb *rxcb;
-@@ -2479,7 +2490,8 @@ static void ath11k_dp_rx_h_mpdu(struct a
- 
- 	/* PN for multicast packets will be checked in mac80211 */
- 	rxcb = ATH11K_SKB_RXCB(msdu);
--	fill_crypto_hdr = ath11k_dp_rx_h_attn_is_mcbc(ar->ab, rx_desc);
-+	if (!ar->ab->nss.enabled)
-+		fill_crypto_hdr = ath11k_dp_rx_h_attn_is_mcbc(ar->ab, rx_desc);
- 	rxcb->is_mcbc = fill_crypto_hdr;
- 
- 	if (rxcb->is_mcbc) {
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -9228,7 +9228,7 @@ void cfg80211_bss_flush(struct wiphy *wi
+@@ -9247,7 +9247,7 @@ void cfg80211_bss_flush(struct wiphy *wi
   * @count: the number of TBTTs until the color change happens
   * @color_bitmap: representations of the colors that the local BSS is aware of
   */
@@ -65,7 +9,7 @@
  			      enum nl80211_commands cmd, u8 count,
  			      u64 color_bitmap);
  
-@@ -9238,9 +9238,9 @@ int cfg80211_bss_color_notify(struct net
+@@ -9257,9 +9257,9 @@ int cfg80211_bss_color_notify(struct net
   * @color_bitmap: representations of the colors that the local BSS is aware of
   */
  static inline int cfg80211_obss_color_collision_notify(struct net_device *dev,
@@ -77,7 +21,7 @@
  					 0, color_bitmap);
  }
  
-@@ -9254,7 +9254,7 @@ static inline int cfg80211_obss_color_co
+@@ -9273,7 +9273,7 @@ static inline int cfg80211_obss_color_co
  static inline int cfg80211_color_change_started_notify(struct net_device *dev,
  						       u8 count)
  {
@@ -86,7 +30,7 @@
  					 count, 0);
  }
  
-@@ -9266,7 +9266,7 @@ static inline int cfg80211_color_change_
+@@ -9285,7 +9285,7 @@ static inline int cfg80211_color_change_
   */
  static inline int cfg80211_color_change_aborted_notify(struct net_device *dev)
  {
@@ -95,7 +39,7 @@
  					 0, 0);
  }
  
-@@ -9278,7 +9278,7 @@ static inline int cfg80211_color_change_
+@@ -9297,7 +9297,7 @@ static inline int cfg80211_color_change_
   */
  static inline int cfg80211_color_change_notify(struct net_device *dev)
  {
@@ -106,7 +50,7 @@
  }
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -4777,7 +4777,7 @@ void ieee80211_color_collision_detection
+@@ -4780,7 +4780,7 @@ void ieee80211_color_collision_detection
  	struct ieee80211_sub_if_data *sdata = link->sdata;
  
  	sdata_lock(sdata);
@@ -128,7 +72,7 @@
  	sdata->debugfs.subdir_stations = debugfs_create_dir("stations",
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -1407,18 +1407,6 @@ static void __sta_info_destroy_part2(str
+@@ -1410,18 +1410,6 @@ static void __sta_info_destroy_part2(str
  		WARN_ON_ONCE(ret);
  	}
  
@@ -149,7 +93,7 @@
  
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -19414,7 +19414,7 @@ void cfg80211_ch_switch_started_notify(s
+@@ -19472,7 +19472,7 @@ void cfg80211_ch_switch_started_notify(s
  }
  EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
  
@@ -158,7 +102,7 @@
  			      enum nl80211_commands cmd, u8 count,
  			      u64 color_bitmap)
  {
-@@ -19428,7 +19428,7 @@ int cfg80211_bss_color_notify(struct net
+@@ -19486,7 +19486,7 @@ int cfg80211_bss_color_notify(struct net
  
  	trace_cfg80211_bss_color_notify(dev, cmd, count, color_bitmap);
  
@@ -167,7 +111,7 @@
  	if (!msg)
  		return -ENOMEM;
  
-@@ -19451,7 +19451,7 @@ int cfg80211_bss_color_notify(struct net
+@@ -19509,7 +19509,7 @@ int cfg80211_bss_color_notify(struct net
  	genlmsg_end(msg, hdr);
  
  	return genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
diff --git a/package/kernel/mac80211/patches/ath11k_nss/146-mac80211-enable-TKIP-when-using-encapsulation-offloading.patch b/package/kernel/mac80211/patches/nss/subsys/146-mac80211-enable-TKIP-when-using-encapsulation-offloading.patch
similarity index 86%
rename from package/kernel/mac80211/patches/ath11k_nss/146-mac80211-enable-TKIP-when-using-encapsulation-offloading.patch
rename to package/kernel/mac80211/patches/nss/subsys/146-mac80211-enable-TKIP-when-using-encapsulation-offloading.patch
index 82d8c4e05bb11f..a5da9e91eae835 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/146-mac80211-enable-TKIP-when-using-encapsulation-offloading.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/146-mac80211-enable-TKIP-when-using-encapsulation-offloading.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4686,8 +4686,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4688,8 +4688,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  	if (!key)
  		key = rcu_dereference(sdata->default_unicast_key);
  
diff --git a/package/kernel/mac80211/patches/ath11k_nss/199-001-mac80211-add-nss-support.patch b/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch
similarity index 91%
rename from package/kernel/mac80211/patches/ath11k_nss/199-001-mac80211-add-nss-support.patch
rename to package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch
index a06ef7652df538..fc8fec0660f352 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/199-001-mac80211-add-nss-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch
@@ -53,7 +53,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  };
  
  /**
-@@ -1406,7 +1422,7 @@ ieee80211_tx_info_clear_status(struct ie
+@@ -1408,7 +1424,7 @@ ieee80211_tx_info_clear_status(struct ie
   * @RX_FLAG_AMPDU_EOF_BIT_KNOWN: The EOF value is known
   * @RX_FLAG_RADIOTAP_HE: HE radiotap data is present
   *	(&struct ieee80211_radiotap_he, mac80211 will fill in
@@ -62,7 +62,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   *	 - DATA3_DATA_MCS
   *	 - DATA3_DATA_DCM
   *	 - DATA3_CODING
-@@ -1414,7 +1430,7 @@ ieee80211_tx_info_clear_status(struct ie
+@@ -1416,7 +1432,7 @@ ieee80211_tx_info_clear_status(struct ie
   *	 - DATA5_DATA_BW_RU_ALLOC
   *	 - DATA6_NSTS
   *	 - DATA3_STBC
@@ -71,7 +71,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   *	from the RX info data, so leave those zeroed when building this data)
   * @RX_FLAG_RADIOTAP_HE_MU: HE MU radiotap data is present
   *	(&struct ieee80211_radiotap_he_mu)
-@@ -1987,6 +2003,16 @@ static inline bool lockdep_vif_mutex_hel
+@@ -1989,6 +2005,16 @@ static inline bool lockdep_vif_mutex_hel
  			      lockdep_vif_mutex_held(vif))
  
  /**
@@ -88,7 +88,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   * enum ieee80211_key_flags - key flags
   *
   * These flags are used for communication about keys between the driver
-@@ -2677,6 +2703,8 @@ struct ieee80211_txq {
+@@ -2680,6 +2706,8 @@ struct ieee80211_txq {
   * @IEEE80211_HW_MLO_MCAST_MULTI_LINK_TX: Hardware/driver handles transmitting
   *	multicast frames on all links, mac80211 should not do that.
   *
@@ -97,7 +97,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
   */
  enum ieee80211_hw_flags {
-@@ -2734,6 +2762,7 @@ enum ieee80211_hw_flags {
+@@ -2737,6 +2765,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_SUPPORTS_CONC_MON_RX_DECAP,
  	IEEE80211_HW_DETECTS_COLOR_COLLISION,
  	IEEE80211_HW_MLO_MCAST_MULTI_LINK_TX,
@@ -105,7 +105,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	/* keep last, obviously */
  	NUM_IEEE80211_HW_FLAGS
-@@ -3746,6 +3775,10 @@ struct ieee80211_prep_tx_info {
+@@ -3749,6 +3778,10 @@ struct ieee80211_prep_tx_info {
   *	non-MLO connections.
   *	The callback can sleep.
   *
@@ -116,18 +116,18 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   * @prepare_multicast: Prepare for multicast filter configuration.
   *	This callback is optional, and its return value is passed
   *	to configure_filter(). This callback must be atomic.
-@@ -4297,7 +4330,9 @@ struct ieee80211_ops {
+@@ -4300,7 +4333,9 @@ struct ieee80211_ops {
  				  struct ieee80211_vif *vif,
  				  struct ieee80211_bss_conf *info,
  				  u64 changed);
 -
 +	void (*nss_bss_info_changed)(struct ieee80211_hw *hw,
 +				     struct ieee80211_vif *vif,
-+				     u64 changed);
++				     u32 changed);
  	int (*start_ap)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			struct ieee80211_bss_conf *link_conf);
  	void (*stop_ap)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-@@ -4602,7 +4637,7 @@ struct ieee80211_ops {
+@@ -4605,7 +4640,7 @@ struct ieee80211_ops {
  	int (*reset_tid_config)(struct ieee80211_hw *hw,
  				struct ieee80211_vif *vif,
  				struct ieee80211_sta *sta, u8 tids);
@@ -138,7 +138,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  			      struct ieee80211_sta *sta, bool enabled);
 --- a/net/mac80211/debugfs.c
 +++ b/net/mac80211/debugfs.c
-@@ -496,6 +496,7 @@ static const char *hw_flag_names[] = {
+@@ -505,6 +505,7 @@ static const char *hw_flag_names[] = {
  	FLAG(SUPPORTS_CONC_MON_RX_DECAP),
  	FLAG(DETECTS_COLOR_COLLISION),
  	FLAG(MLO_MCAST_MULTI_LINK_TX),
@@ -191,7 +191,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  u64 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata)
  {
  	sdata->vif.bss_conf.use_cts_prot = false;
-@@ -694,12 +705,6 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+@@ -691,12 +702,6 @@ struct ieee80211_hw *ieee80211_alloc_hw_
  			   NL80211_FEATURE_FULL_AP_CLIENT_STATE;
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_FILS_STA);
  	wiphy_ext_feature_set(wiphy,
@@ -204,7 +204,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  			      NL80211_EXT_FEATURE_SCAN_FREQ_KHZ);
  	wiphy_ext_feature_set(wiphy,
  			      NL80211_EXT_FEATURE_POWERED_ADDR_CHANGE);
-@@ -1007,6 +1012,18 @@ int ieee80211_register_hw(struct ieee802
+@@ -1005,6 +1010,18 @@ int ieee80211_register_hw(struct ieee802
  			return -EINVAL;
  	}
  
@@ -225,7 +225,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		return -EINVAL;
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -2380,6 +2380,9 @@ sta_get_last_rx_stats(struct sta_info *s
+@@ -2370,6 +2370,9 @@ sta_get_last_rx_stats(struct sta_info *s
  	struct ieee80211_sta_rx_stats *stats = &sta->deflink.rx_stats;
  	int cpu;
  
@@ -237,7 +237,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -1028,11 +1028,23 @@ ieee80211_tx_h_stats(struct ieee80211_tx
+@@ -1029,11 +1029,23 @@ ieee80211_tx_h_stats(struct ieee80211_tx
  {
  	struct sk_buff *skb;
  	int ac = -1;
@@ -261,7 +261,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		ac = skb_get_queue_mapping(skb);
  		tx->sta->deflink.tx_stats.bytes[ac] += skb->len;
  	}
-@@ -2857,7 +2869,9 @@ static struct sk_buff *ieee80211_build_h
+@@ -2858,7 +2870,9 @@ static struct sk_buff *ieee80211_build_h
  
  	if (unlikely(!multicast && ((skb->sk &&
  		     skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS) ||
@@ -272,7 +272,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		info_id = ieee80211_store_ack_skb(local, skb, &info_flags,
  						  cookie);
  
-@@ -4639,13 +4653,16 @@ static void ieee80211_8023_xmit(struct i
+@@ -4641,13 +4655,16 @@ static void ieee80211_8023_xmit(struct i
  	}
  
  	if (unlikely(skb->sk &&
@@ -306,7 +306,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  				gfp);
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2675,7 +2675,7 @@ static int ieee80211_change_bss(struct w
+@@ -2679,7 +2679,7 @@ static int ieee80211_change_bss(struct w
  	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	struct ieee80211_link_data *link;
  	struct ieee80211_supported_band *sband;
@@ -315,7 +315,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	link = ieee80211_link_or_deflink(sdata, params->link_id, true);
  	if (IS_ERR(link))
-@@ -2725,6 +2725,8 @@ static int ieee80211_change_bss(struct w
+@@ -2729,6 +2729,8 @@ static int ieee80211_change_bss(struct w
  			sdata->flags |= IEEE80211_SDATA_DONT_BRIDGE_PACKETS;
  		else
  			sdata->flags &= ~IEEE80211_SDATA_DONT_BRIDGE_PACKETS;
@@ -324,7 +324,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		ieee80211_check_fast_rx_iface(sdata);
  	}
  
-@@ -2753,6 +2755,8 @@ static int ieee80211_change_bss(struct w
+@@ -2757,6 +2759,8 @@ static int ieee80211_change_bss(struct w
  
  	ieee80211_link_info_change_notify(sdata, link, changed);
  
@@ -361,7 +361,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  {
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1845,6 +1845,8 @@ void ieee80211_vif_cfg_change_notify(str
+@@ -1847,6 +1847,8 @@ void ieee80211_vif_cfg_change_notify(str
  void ieee80211_link_info_change_notify(struct ieee80211_sub_if_data *sdata,
  				       struct ieee80211_link_data *link,
  				       u64 changed);
@@ -388,7 +388,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
 +		LOCAL_ENTRY
 +		VIF_ENTRY
 +		__field(u32, changed)
-+		__field(bool, nss_ap_isolate);
++		__field(bool, nss_ap_isolate)
 +	),
 +
 +	TP_fast_assign(
diff --git a/package/kernel/mac80211/patches/ath11k_nss/199-mac80211-fix-xmit-callback-when-hwencap-enable-in-st.patch b/package/kernel/mac80211/patches/nss/subsys/199-mac80211-fix-xmit-callback-when-hwencap-enable-in-st.patch
similarity index 97%
rename from package/kernel/mac80211/patches/ath11k_nss/199-mac80211-fix-xmit-callback-when-hwencap-enable-in-st.patch
rename to package/kernel/mac80211/patches/nss/subsys/199-mac80211-fix-xmit-callback-when-hwencap-enable-in-st.patch
index 87c2a52b676f21..fffe171334c9a4 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/199-mac80211-fix-xmit-callback-when-hwencap-enable-in-st.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/199-mac80211-fix-xmit-callback-when-hwencap-enable-in-st.patch
@@ -18,7 +18,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -6213,7 +6213,13 @@ start_xmit:
+@@ -6215,7 +6215,13 @@ start_xmit:
  	mutex_lock(&local->mtx);
  
  	local_bh_disable();
diff --git a/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch b/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
new file mode 100644
index 00000000000000..bd9c1c024b1e5d
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
@@ -0,0 +1,203 @@
+From ed838800bb8f4c59b320395066ac356f74528a50 Mon Sep 17 00:00:00 2001
+From: Muna Sinada <msinada@codeaurora.org>
+Date: Wed, 29 Jul 2020 00:11:30 -0700
+Subject: [PATCH] 203-mac80211-ath11k-fw-dynamic-muedca.patch
+
+mac80211/ath11k:FW Initiated Dynamic MU-EDCA
+
+Implementing the updating of firmware initiated dynamic MU-EDCA
+parameters in Beacon IE. Firmware routinely checks its clients and
+updates its MU-EDCA values every 3 seconds. Firmware is tuning
+MU-EDCA parameters to improve performance. As part of this process,
+the firmware informs host about new MU-EDCA values utilizing
+WMI_MUEDCA_PARAMS_CONFIG_EVENTID. FW expectation is that host will
+update MU-EDCA parameters in the Beacon IE.
+Implementation consists of:
+	(1) Receiving updated parameters through event in ATH11k
+	(2) Passing updated parameters ATH11k -> mac80211 -> cfg80211
+	(3) Passing updated parameters to user space.
+
+Signed-off-by: Muna Sinada <msinada@codeaurora.org>
+---
+ drivers/net/wireless/ath/ath11k/wmi.c | 97 +++++++++++++++++++++++++++++++----
+ drivers/net/wireless/ath/ath11k/wmi.h | 12 +++++
+ include/net/cfg80211.h                | 11 ++++
+ include/net/mac80211.h                | 13 +++++
+ include/uapi/linux/nl80211.h          | 10 ++++
+ net/mac80211/mlme.c                   | 12 +++++
+ net/mac80211/trace.h                  | 20 ++++++++
+ net/wireless/nl80211.c                | 36 +++++++++++++
+ 8 files changed, 200 insertions(+), 11 deletions(-)
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -9327,4 +9327,15 @@ bool cfg80211_valid_disable_subchannel_b
+  */
+ void cfg80211_links_removed(struct net_device *dev, u16 link_mask);
+ 
++/**
++ * cfg80211_update_muedca_params_event - Notify the updated MU-EDCA parameters
++ *	to user space.
++ * @wiphy: the wiphy
++ * @params: Updated MU-EDCA parameters
++ * @gfp: allocation flags
++ */
++void cfg80211_update_muedca_params_event(struct wiphy *wiphy,
++					 struct ieee80211_mu_edca_param_set
++					 *params, gfp_t gfp);
++
+ #endif /* __NET_CFG80211_H */
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -7361,6 +7361,20 @@ u32 ieee80211_calc_rx_airtime(struct iee
+ 			      int len);
+ 
+ /**
++ * ieee80211_update_muedca_params - update MU-EDCA parameters.
++ *
++ * This function is used to pass dynamically updated MU-EDCA parameters from
++ * driver to user space in order for parameters to be updated in beacon.
++ *
++ * @hw: pointer as obtained from ieee80211_alloc_hw()
++ * @params: updated MU-EDCA paramters
++ * @gfp: allocation flags
++ */
++void ieee80211_update_muedca_params(struct ieee80211_hw *hw,
++				    struct ieee80211_mu_edca_param_set
++				    *params, gfp_t gfp);
++
++/**
+  * ieee80211_calc_tx_airtime - calculate estimated transmission airtime for TX.
+  *
+  * This function calculates the estimated airtime usage of a frame based on the
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -1314,6 +1314,10 @@
+  *	Multi-Link reconfiguration. %NL80211_ATTR_MLO_LINKS is used to provide
+  *	information about the removed STA MLD setup links.
+  *
++ * @NL80211_CMD_UPDATE_HE_MUEDCA_PARAMS: Updated MU-EDCA parameters from driver.
++ *	This event is used to update dynamic MU-EDCA parameters in Beacon frame,
++ *	coming from driver and now need to be reflected in Beacon frame.
++ *
+  * @NL80211_CMD_MAX: highest used command number
+  * @__NL80211_CMD_AFTER_LAST: internal use
+  */
+@@ -1569,6 +1573,7 @@ enum nl80211_commands {
+ 
+ 	NL80211_CMD_LINKS_REMOVED,
+ 
++	NL80211_CMD_UPDATE_HE_MUEDCA_PARAMS,
+ 	/* add new commands above here */
+ 
+ 	/* used to define NL80211_CMD_MAX below */
+@@ -2815,6 +2820,8 @@ enum nl80211_commands {
+  * @NL80211_ATTR_MLO_LINK_DISABLED: Flag attribute indicating that the link is
+  *	disabled.
+  *
++ * @NL80211_ATTR_HE_MUEDCA_PARAMS: MU-EDCA AC parameters for the
++ *	%NL80211_CMD_UPDATE_HE_MUEDCA_PARAMS command.
+  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
+  * @NL80211_ATTR_MAX: highest attribute number currently defined
+  * @__NL80211_ATTR_AFTER_LAST: internal use
+@@ -3353,6 +3360,8 @@ enum nl80211_attrs {
+ 
+ 	NL80211_ATTR_MLO_LINK_DISABLED,
+ 
++	NL80211_ATTR_HE_MUEDCA_PARAMS,
++
+ 	/* add attributes here, update the policy in nl80211.c */
+ 
+ 	__NL80211_ATTR_AFTER_LAST,
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -7954,3 +7954,15 @@ void ieee80211_disable_rssi_reports(stru
+ 	_ieee80211_enable_rssi_reports(sdata, 0, 0);
+ }
+ EXPORT_SYMBOL(ieee80211_disable_rssi_reports);
++
++void ieee80211_update_muedca_params(struct ieee80211_hw *hw,
++				    struct ieee80211_mu_edca_param_set
++				    *params, gfp_t gfp)
++{
++	struct ieee80211_local *local = hw_to_local(hw);
++
++	trace_api_update_muedca_params(local, params);
++
++	cfg80211_update_muedca_params_event(local->hw.wiphy, params, gfp);
++}
++EXPORT_SYMBOL(ieee80211_update_muedca_params);
+--- a/net/mac80211/trace.h
++++ b/net/mac80211/trace.h
+@@ -3092,6 +3092,26 @@ TRACE_EVENT(stop_queue,
+ 	)
+ );
+ 
++TRACE_EVENT(api_update_muedca_params,
++	TP_PROTO(struct ieee80211_local *local,
++		 struct ieee80211_mu_edca_param_set *params),
++
++	TP_ARGS(local, params),
++
++	TP_STRUCT__entry(
++		LOCAL_ENTRY
++	),
++
++	TP_fast_assign(
++		LOCAL_ASSIGN;
++	),
++
++	TP_printk(
++		LOCAL_PR_FMT " updated MU-EDCA parameters",
++		LOCAL_PR_ARG
++	)
++);
++
+ #endif /* !__MAC80211_DRIVER_TRACE || TRACE_HEADER_MULTI_READ */
+ 
+ #undef TRACE_INCLUDE_PATH
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -20199,6 +20199,42 @@ nla_put_failure:
+ }
+ EXPORT_SYMBOL(cfg80211_update_owe_info_event);
+ 
++void cfg80211_update_muedca_params_event(struct wiphy *wiphy,
++					 struct ieee80211_mu_edca_param_set
++					 *params, gfp_t gfp)
++{
++	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
++	struct sk_buff *msg;
++	void *hdr;
++
++	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
++	if (!msg)
++		return;
++
++	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_HE_MUEDCA_PARAMS);
++	if (!hdr)
++		goto nla_put_failure;
++
++	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
++		goto nla_put_failure;
++
++	if (nla_put(msg, NL80211_ATTR_HE_MUEDCA_PARAMS,
++		    sizeof(struct ieee80211_mu_edca_param_set),
++		    (const void *)params))
++		goto nla_put_failure;
++
++	genlmsg_end(msg, hdr);
++
++	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
++				NL80211_MCGRP_MLME, gfp);
++	return;
++
++nla_put_failure:
++	genlmsg_cancel(msg, hdr);
++	nlmsg_free(msg);
++}
++EXPORT_SYMBOL(cfg80211_update_muedca_params_event);
++
+ /* initialisation/exit functions */
+ 
+ int __init nl80211_init(void)
diff --git a/package/kernel/mac80211/patches/ath11k_nss/207-mac80211-Add-support-for-dynamic-vlan.patch b/package/kernel/mac80211/patches/nss/subsys/207-ath11k-Add-support-for-dynamic-vlan.patch
similarity index 94%
rename from package/kernel/mac80211/patches/ath11k_nss/207-mac80211-Add-support-for-dynamic-vlan.patch
rename to package/kernel/mac80211/patches/nss/subsys/207-ath11k-Add-support-for-dynamic-vlan.patch
index af46c8f0bfa05e..15d796071fa077 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/207-mac80211-Add-support-for-dynamic-vlan.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/207-ath11k-Add-support-for-dynamic-vlan.patch
@@ -29,7 +29,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  /* misc utils */
  
  static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
-@@ -4268,6 +4271,8 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4270,6 +4273,8 @@ void __ieee80211_subif_start_xmit(struct
  	struct sta_info *sta;
  	struct sk_buff *next;
  	int len = skb->len;
@@ -38,7 +38,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  
  	if (unlikely(!ieee80211_sdata_running(sdata) || skb->len < ETH_HLEN)) {
  		kfree_skb(skb);
-@@ -4289,6 +4294,19 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4291,6 +4296,19 @@ void __ieee80211_subif_start_xmit(struct
  	if (IS_ERR(sta))
  		sta = NULL;
  
diff --git a/package/kernel/mac80211/patches/ath11k_nss/207-mac80211-add-nss-redirect-support.patch b/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
similarity index 95%
rename from package/kernel/mac80211/patches/ath11k_nss/207-mac80211-add-nss-redirect-support.patch
rename to package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
index c9a12d5f127cbe..a4895803b38ba0 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/207-mac80211-add-nss-redirect-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
@@ -136,7 +136,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	return 0;
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -2570,6 +2570,54 @@ static bool ieee80211_frame_allowed(stru
+@@ -2569,6 +2569,54 @@ static bool ieee80211_frame_allowed(stru
  	return true;
  }
  
@@ -191,7 +191,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  static void ieee80211_deliver_skb_to_local_stack(struct sk_buff *skb,
  						 struct ieee80211_rx_data *rx)
  {
-@@ -2609,11 +2657,15 @@ static void ieee80211_deliver_skb_to_loc
+@@ -2608,11 +2656,15 @@ static void ieee80211_deliver_skb_to_loc
  			     !ether_addr_equal(ehdr->h_dest, sdata->vif.addr)))
  			ether_addr_copy(ehdr->h_dest, sdata->vif.addr);
  
@@ -209,7 +209,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4501,6 +4501,35 @@ static void ieee80211_mlo_multicast_tx(s
+@@ -4503,6 +4503,35 @@ static void ieee80211_mlo_multicast_tx(s
  	kfree_skb(skb);
  }
  
@@ -245,7 +245,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  /**
   * ieee80211_subif_start_xmit - netif start_xmit function for 802.3 vifs
   * @skb: packet to be sent
-@@ -4514,6 +4543,10 @@ netdev_tx_t ieee80211_subif_start_xmit(s
+@@ -4516,6 +4545,10 @@ netdev_tx_t ieee80211_subif_start_xmit(s
  	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	const struct ethhdr *eth = (void *)skb->data;
  
@@ -256,7 +256,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	if (likely(!is_multicast_ether_addr(eth->h_dest)))
  		goto normal;
  
-@@ -4700,6 +4733,9 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4702,6 +4735,9 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  	struct ieee80211_key *key;
  	struct sta_info *sta;
  
diff --git a/package/kernel/mac80211/patches/ath11k_nss/902-000-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch b/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
similarity index 86%
rename from package/kernel/mac80211/patches/ath11k_nss/902-000-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
rename to package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
index 7dc88faed71f9f..55e2fff1560fb8 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/902-000-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
@@ -21,7 +21,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -5102,6 +5102,17 @@ void ieee80211_sta_pspoll(struct ieee802
+@@ -5098,6 +5098,17 @@ void ieee80211_sta_pspoll(struct ieee802
   */
  void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *sta, u8 tid);
  
@@ -41,7 +41,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
   * This is enough for the radiotap header.
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2177,7 +2177,13 @@ static int ieee80211_change_station(stru
+@@ -2180,7 +2180,13 @@ static int ieee80211_change_station(stru
  
  			rcu_assign_pointer(vlansdata->u.vlan.sta, sta);
  			__ieee80211_check_fast_rx_iface(vlansdata);
@@ -122,7 +122,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  			netif_carrier_off(dev);
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -1759,6 +1759,12 @@ void ieee80211_sta_uapsd_trigger(struct
+@@ -1656,6 +1656,12 @@ void ieee80211_sta_uapsd_trigger(struct
  }
  EXPORT_SYMBOL(ieee80211_sta_uapsd_trigger);
  
@@ -137,8 +137,24 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  {
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4725,7 +4725,8 @@ static void ieee80211_8023_xmit(struct i
- 	info->flags |= info_flags;
+@@ -4297,8 +4297,13 @@ void __ieee80211_subif_start_xmit(struct
+ 		sta = NULL;
+ 
+         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
+-                ap_sdata = container_of(sdata->bss,
+-                                        struct ieee80211_sub_if_data, u.ap);
++                if (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD))
++                        ap_sdata = container_of(sdata->bss,
++                                                struct ieee80211_sub_if_data,
++                                                u.ap);
++                else
++                        ap_sdata = sdata;
++
+                 if (ap_sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED &&
+                     !is_multicast_ether_addr(skb->data)) {
+                         if (sta)
+@@ -4688,7 +4693,8 @@ static void ieee80211_8023_xmit(struct i
+ 
  	info->hw_queue = sdata->vif.hw_queue[queue];
  
 -	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
@@ -181,7 +197,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  				drv_remove_interface(local, sdata);
 --- a/net/mac80211/mlme.c
 +++ b/net/mac80211/mlme.c
-@@ -5235,7 +5235,8 @@ static bool ieee80211_assoc_success(stru
+@@ -5259,7 +5259,8 @@ static bool ieee80211_assoc_success(stru
  	 * If we're using 4-addr mode, let the AP know that we're
  	 * doing so, so that it can create the STA VLAN on its side
  	 */
diff --git a/package/kernel/mac80211/patches/ath11k_nss/902-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch b/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
similarity index 78%
rename from package/kernel/mac80211/patches/ath11k_nss/902-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
rename to package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
index 33eb5d2001db91..803ee900bfdcc1 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/902-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
@@ -24,7 +24,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2091,6 +2091,8 @@ enum ieee80211_key_flags {
+@@ -2086,6 +2086,8 @@ enum ieee80211_key_flags {
   * @tx_pn: PN used for TX keys, may be used by the driver as well if it
   *	needs to do software PN assignment by itself (e.g. due to TSO)
   * @flags: key flags, see &enum ieee80211_key_flags.
@@ -33,7 +33,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
   * @keyidx: the key index (0-3)
   * @keylen: key material length
   * @key: key material. For ALG_TKIP the key is encoded as a 256-bit (32 byte)
-@@ -2110,6 +2112,7 @@ struct ieee80211_key_conf {
+@@ -2105,6 +2107,7 @@ struct ieee80211_key_conf {
  	u8 hw_key_idx;
  	s8 keyidx;
  	u16 flags;
@@ -100,3 +100,31 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
  	key->conf.link_id = -1;
  	key->conf.cipher = cipher;
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -4649,16 +4649,25 @@ static void ieee80211_8023_xmit(struct i
+ 				struct ieee80211_key *key, struct sk_buff *skb)
+ {
+ 	struct ieee80211_tx_info *info;
++	struct ethhdr *ehdr = (struct ethhdr *)skb->data;
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct tid_ampdu_tx *tid_tx;
+ 	struct sk_buff *seg, *next;
+ 	unsigned int skbs = 0, len = 0;
+ 	u16 queue;
++	unsigned char *ra = ehdr->h_dest;
++	bool multicast;
+ 	u8 tid;
+ 
+ 	queue = ieee80211_select_queue(sdata, sta, skb);
+ 	skb_set_queue_mapping(skb, queue);
+ 
++	multicast = is_multicast_ether_addr(ra);
++
++	if (multicast && sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
++	    !atomic_read(&sdata->u.vlan.num_mcast_sta))
++		goto out_free;
++
+ 	if (unlikely(test_bit(SCAN_SW_SCANNING, &local->scanning)) &&
+ 	    test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))
+ 		goto out_free;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/245-compilation_fix.patch b/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch
similarity index 93%
rename from package/kernel/mac80211/patches/ath11k_nss/245-compilation_fix.patch
rename to package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch
index b4a735f10fc0e6..46b716419a7cd8 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/245-compilation_fix.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch
@@ -77,7 +77,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	/* then other type-dependent work */
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4668,19 +4668,21 @@ static void ieee80211_8023_xmit(struct i
+@@ -4678,19 +4678,21 @@ static void ieee80211_8023_xmit(struct i
  
  	ieee80211_aggr_check(sdata, sta, skb);
  
@@ -111,7 +111,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	}
  
  	skb = ieee80211_tx_skb_fixup(skb, ieee80211_sdata_netdev_features(sdata));
-@@ -4739,7 +4741,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4747,7 +4749,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  {
  	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	struct ethhdr *ehdr = (struct ethhdr *)skb->data;
@@ -120,7 +120,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	struct sta_info *sta;
  
  #ifdef CPTCFG_MAC80211_NSS_SUPPORT
-@@ -4757,9 +4759,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4765,9 +4767,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		goto out;
  	}
  
@@ -137,7 +137,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  		goto skip_offload;
  
  	key = rcu_dereference(sta->ptk[sta->ptk_idx]);
-@@ -4770,6 +4776,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4778,6 +4784,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		goto skip_offload;
  
  	sk_pacing_shift_update(skb->sk, sdata->local->hw.tx_sk_pacing_shift);
@@ -145,9 +145,8 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	ieee80211_8023_xmit(sdata, dev, sta, key, skb);
  	goto out;
  
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -5342,7 +5342,7 @@ void ieee80211_rx_list(struct ieee80211_
+@@ -6284,13 +6291,7 @@ start_xmit:
+ 	mutex_lock(&local->mtx);
  
  	if (pubsta) {
  		sta = container_of(pubsta, struct sta_info, sta);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/300-mac80211-nss-mesh-offload-support.patch b/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
similarity index 95%
rename from package/kernel/mac80211/patches/ath11k_nss/300-mac80211-nss-mesh-offload-support.patch
rename to package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
index d3e6b9850b620f..55ad36baf69aa4 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/300-mac80211-nss-mesh-offload-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
@@ -66,18 +66,18 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  };
  
  /*
-@@ -794,6 +803,11 @@ struct ieee80211_bss_conf {
- 	bool eht_mu_beamformer;
- 	bool nss_ap_isolate;
- 	enum nl80211_beacon_tx_mode beacon_tx_mode;
+@@ -790,6 +799,11 @@ struct ieee80211_bss_conf {
+ 	bool he_full_ul_mumimo;
+ 	bool eht_su_beamformer;
+ 	bool eht_su_beamformee;
 +
 +	/* Mesh configuration for nss offload */
 +	u8 nss_offld_ttl;
 +	bool nss_offld_mesh_forward_enabled;
 +	u32 nss_offld_mpath_refresh_time;
+ 	bool eht_mu_beamformer;
+ 	bool nss_ap_isolate;
  };
- 
- /**
 @@ -1273,6 +1287,8 @@ struct ieee80211_rate_status {
   * @ack_hwtstamp: Hardware timestamp of the received ack in nanoseconds
   *	Only needed for Timing measurement and Fine timing measurement action
@@ -112,7 +112,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  };
  
  
-@@ -2765,6 +2785,7 @@ enum ieee80211_hw_flags {
+@@ -2769,6 +2789,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_DETECTS_COLOR_COLLISION,
  	IEEE80211_HW_MLO_MCAST_MULTI_LINK_TX,
  	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
@@ -120,7 +120,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  
  	/* keep last, obviously */
  	NUM_IEEE80211_HW_FLAGS
-@@ -4265,6 +4286,8 @@ struct ieee80211_prep_tx_info {
+@@ -4269,6 +4290,8 @@ struct ieee80211_prep_tx_info {
   * @set_sar_specs: Update the SAR (TX power) settings.
   * @sta_set_decap_offload: Called to notify the driver when a station is allowed
   *	to use rx decapsulation offload
@@ -129,7 +129,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
   * @add_twt_setup: Update hw with TWT agreement parameters received from the peer.
   *	This callback allows the hw to check if requested parameters
   *	are supported and if there is enough room for a new agreement.
-@@ -4648,6 +4671,12 @@ struct ieee80211_ops {
+@@ -4652,6 +4675,12 @@ struct ieee80211_ops {
  	void (*sta_set_decap_offload)(struct ieee80211_hw *hw,
  				      struct ieee80211_vif *vif,
  				      struct ieee80211_sta *sta, bool enabled);
@@ -142,7 +142,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	void (*add_twt_setup)(struct ieee80211_hw *hw,
  			      struct ieee80211_sta *sta,
  			      struct ieee80211_twt_setup *twt);
-@@ -7481,4 +7510,100 @@ int ieee80211_set_active_links(struct ie
+@@ -7510,4 +7539,100 @@ int ieee80211_set_active_links(struct ie
  void ieee80211_set_active_links_async(struct ieee80211_vif *vif,
  				      u16 active_links);
  
@@ -245,7 +245,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  #endif /* MAC80211_H */
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2514,6 +2514,7 @@ static int ieee80211_update_mesh_config(
+@@ -2523,6 +2523,7 @@ static int ieee80211_update_mesh_config(
  	struct mesh_config *conf;
  	struct ieee80211_sub_if_data *sdata;
  	struct ieee80211_if_mesh *ifmsh;
@@ -253,7 +253,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  
  	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	ifmsh = &sdata->u.mesh;
-@@ -2530,8 +2531,11 @@ static int ieee80211_update_mesh_config(
+@@ -2539,8 +2540,11 @@ static int ieee80211_update_mesh_config(
  		conf->dot11MeshMaxPeerLinks = nconf->dot11MeshMaxPeerLinks;
  	if (_chg_mesh_attr(NL80211_MESHCONF_MAX_RETRIES, mask))
  		conf->dot11MeshMaxRetries = nconf->dot11MeshMaxRetries;
@@ -266,7 +266,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	if (_chg_mesh_attr(NL80211_MESHCONF_ELEMENT_TTL, mask))
  		conf->element_ttl = nconf->element_ttl;
  	if (_chg_mesh_attr(NL80211_MESHCONF_AUTO_OPEN_PLINKS, mask)) {
-@@ -2545,8 +2549,12 @@ static int ieee80211_update_mesh_config(
+@@ -2554,8 +2558,12 @@ static int ieee80211_update_mesh_config(
  	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, mask))
  		conf->dot11MeshHWMPmaxPREQretries =
  			nconf->dot11MeshHWMPmaxPREQretries;
@@ -280,7 +280,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	if (_chg_mesh_attr(NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, mask))
  		conf->min_discovery_timeout = nconf->min_discovery_timeout;
  	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, mask))
-@@ -2581,8 +2589,12 @@ static int ieee80211_update_mesh_config(
+@@ -2590,8 +2598,12 @@ static int ieee80211_update_mesh_config(
  	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_RANN_INTERVAL, mask))
  		conf->dot11MeshHWMPRannInterval =
  			nconf->dot11MeshHWMPRannInterval;
@@ -294,7 +294,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	if (_chg_mesh_attr(NL80211_MESHCONF_RSSI_THRESHOLD, mask)) {
  		/* our RSSI threshold implementation is supported only for
  		 * devices that report signal in dBm.
-@@ -2624,6 +2636,7 @@ static int ieee80211_update_mesh_config(
+@@ -2633,6 +2645,7 @@ static int ieee80211_update_mesh_config(
  		conf->dot11MeshConnectedToAuthServer =
  			nconf->dot11MeshConnectedToAuthServer;
  	ieee80211_mbss_info_change_notify(sdata, BSS_CHANGED_BEACON);
@@ -330,7 +330,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  		   sdata, fmt, ##__VA_ARGS__)
 --- a/net/mac80211/debugfs.c
 +++ b/net/mac80211/debugfs.c
-@@ -497,6 +497,7 @@ static const char *hw_flag_names[] = {
+@@ -506,6 +506,7 @@ static const char *hw_flag_names[] = {
  	FLAG(DETECTS_COLOR_COLLISION),
  	FLAG(MLO_MCAST_MULTI_LINK_TX),
  	FLAG(SUPPORTS_NSS_OFFLOAD),
@@ -340,7 +340,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  
 --- a/net/mac80211/driver-ops.c
 +++ b/net/mac80211/driver-ops.c
-@@ -569,3 +569,23 @@ int drv_change_sta_links(struct ieee8021
+@@ -579,3 +579,23 @@ int drv_change_sta_links(struct ieee8021
  
  	return 0;
  }
@@ -366,7 +366,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
 +#endif
 --- a/net/mac80211/driver-ops.h
 +++ b/net/mac80211/driver-ops.h
-@@ -1567,4 +1567,10 @@ int drv_change_sta_links(struct ieee8021
+@@ -1571,4 +1571,10 @@ int drv_change_sta_links(struct ieee8021
  			 struct ieee80211_sta *sta,
  			 u16 old_links, u16 new_links);
  
@@ -379,7 +379,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  #endif /* __MAC80211_DRIVER_OPS */
 --- a/net/mac80211/mesh.h
 +++ b/net/mac80211/mesh.h
-@@ -316,6 +316,10 @@ void mesh_rx_path_sel_frame(struct ieee8
+@@ -315,6 +315,10 @@ void mesh_rx_path_sel_frame(struct ieee8
  			    struct ieee80211_mgmt *mgmt, size_t len);
  struct mesh_path *
  mesh_path_add(struct ieee80211_sub_if_data *sdata, const u8 *dst);
@@ -390,7 +390,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  
  int mesh_path_add_gate(struct mesh_path *mpath);
  int mesh_path_send_to_gates(struct mesh_path *mpath);
-@@ -357,6 +361,7 @@ void mesh_path_discard_frame(struct ieee
+@@ -356,6 +360,7 @@ void mesh_path_discard_frame(struct ieee
  void mesh_path_tx_root_frame(struct ieee80211_sub_if_data *sdata);
  
  bool mesh_action_is_path_sel(struct ieee80211_mgmt *mgmt);
@@ -1173,7 +1173,16 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  void mesh_pathtbl_unregister(struct ieee80211_sub_if_data *sdata)
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -2633,6 +2633,9 @@ static struct sk_buff *ieee80211_build_h
+@@ -2610,7 +2610,7 @@ static struct sk_buff *ieee80211_build_h
+ 	bool multicast;
+ 	u16 info_id = 0;
+ 	struct ieee80211_chanctx_conf *chanctx_conf = NULL;
+-	enum nl80211_band band;
++	enum nl80211_band band = 0;
+ 	int ret;
+ 	u8 link_id = u32_get_bits(ctrl_flags, IEEE80211_TX_CTRL_MLO_LINK);
+ 
+@@ -2622,6 +2622,9 @@ static struct sk_buff *ieee80211_build_h
  		info_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
  #endif
  
@@ -1183,7 +1192,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	/* convert Ethernet header to proper 802.11 header (based on
  	 * operation mode) */
  	ethertype = (skb->data[12] << 8) | skb->data[13];
-@@ -2703,6 +2706,13 @@ static struct sk_buff *ieee80211_build_h
+@@ -2692,6 +2695,13 @@ static struct sk_buff *ieee80211_build_h
  		break;
  #ifdef CPTCFG_MAC80211_MESH
  	case NL80211_IFTYPE_MESH_POINT:
@@ -1197,7 +1206,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  		if (!is_multicast_ether_addr(skb->data)) {
  			struct sta_info *next_hop;
  			bool mpp_lookup = true;
-@@ -2966,10 +2976,10 @@ static struct sk_buff *ieee80211_build_h
+@@ -2955,10 +2965,10 @@ static struct sk_buff *ieee80211_build_h
  
  	skb_reset_mac_header(skb);
  
@@ -1212,7 +1221,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	info->ack_frame_id = info_id;
  	info->band = band;
  
-@@ -4284,6 +4294,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4274,6 +4284,7 @@ void __ieee80211_subif_start_xmit(struct
  	struct sk_buff *next;
  	int len = skb->len;
  	struct ieee80211_key *key = NULL;
@@ -1220,11 +1229,11 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	struct ieee80211_sub_if_data *ap_sdata;
  
  	if (unlikely(!ieee80211_sdata_running(sdata) || skb->len < ETH_HLEN)) {
-@@ -4359,9 +4370,15 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4350,9 +4361,15 @@ void __ieee80211_subif_start_xmit(struct
  			goto out;
  		}
  
--		ieee80211_tx_stats(dev, skb->len);
+-		dev_sw_netstats_tx_add(dev, 1, skb->len);
 -
 -		ieee80211_xmit(sdata, sta, skb);
 +		info = IEEE80211_SKB_CB(skb);
@@ -1233,7 +1242,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
 +				key = rcu_dereference(sta->ptk[sta->ptk_idx]);
 +			ieee80211_8023_xmit(sdata, dev, sta, key, skb);
 +		} else {
-+			ieee80211_tx_stats(dev, skb->len);
++			dev_sw_netstats_tx_add(dev, 1, skb->len);
 +			ieee80211_xmit(sdata, sta, skb);
 +		}
  	}
diff --git a/package/kernel/mac80211/patches/ath11k_nss/335-0003-mac80211-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch b/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
similarity index 90%
rename from package/kernel/mac80211/patches/ath11k_nss/335-0003-mac80211-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
rename to package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
index 6a37ba0e1aa730..f78d7ce6e09304 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/335-0003-mac80211-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
@@ -16,7 +16,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2727,6 +2727,8 @@ struct ieee80211_txq {
+@@ -2731,6 +2731,8 @@ struct ieee80211_txq {
   *
   *  @IEEE80211_HW_SUPPORTS_NSS_OFFLOAD: Hardware/driver supports NSS offload
   *
@@ -25,7 +25,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
   * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
   */
  enum ieee80211_hw_flags {
-@@ -2786,6 +2788,7 @@ enum ieee80211_hw_flags {
+@@ -2790,6 +2792,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_MLO_MCAST_MULTI_LINK_TX,
  	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
  	IEEE80211_HW_SUPPORTS_MESH_NSS_OFFLOAD,
@@ -35,7 +35,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	NUM_IEEE80211_HW_FLAGS
 --- a/net/mac80211/debugfs.c
 +++ b/net/mac80211/debugfs.c
-@@ -498,6 +498,7 @@ static const char *hw_flag_names[] = {
+@@ -507,6 +507,7 @@ static const char *hw_flag_names[] = {
  	FLAG(MLO_MCAST_MULTI_LINK_TX),
  	FLAG(SUPPORTS_NSS_OFFLOAD),
  	FLAG(SUPPORTS_MESH_NSS_OFFLOAD),
diff --git a/package/kernel/mac80211/patches/ath11k_nss/335-0005-mac80211-simple-tx-for-AP-mode.patch b/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch
similarity index 93%
rename from package/kernel/mac80211/patches/ath11k_nss/335-0005-mac80211-simple-tx-for-AP-mode.patch
rename to package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch
index d859d038003196..63373b7751f9eb 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/335-0005-mac80211-simple-tx-for-AP-mode.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch
@@ -14,7 +14,7 @@ Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4748,6 +4748,70 @@ out_free:
+@@ -4761,6 +4761,67 @@ out_free:
  	kfree_skb(skb);
  }
  
@@ -58,7 +58,6 @@ Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
 +	if (sta) {
 +		sta->deflink.tx_stats.bytes[q_map] += skb->len;
 +		sta->deflink.tx_stats.packets[q_map]++;
-+		atomic_inc(&sta->tx_netif_pkts);
 +	}
 +
 +	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
@@ -78,14 +77,12 @@ Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
 +
 +	drv_tx(local, &control, skb);
 +
-+	if (sta)
-+		atomic_inc(&sta->tx_drv_pkts);
 +}
 +
  netdev_tx_t ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
  					    struct net_device *dev)
  {
-@@ -4787,6 +4851,11 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4800,6 +4861,11 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  	if (key && (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)))
  		goto skip_offload;
  
diff --git a/package/kernel/mac80211/patches/ath11k_nss/336-mac80211-Mesh-Fast-rx-support.patch b/package/kernel/mac80211/patches/nss/subsys/336-mac80211-Mesh-Fast-rx-support.patch
similarity index 93%
rename from package/kernel/mac80211/patches/ath11k_nss/336-mac80211-Mesh-Fast-rx-support.patch
rename to package/kernel/mac80211/patches/nss/subsys/336-mac80211-Mesh-Fast-rx-support.patch
index d29a05f13943bf..0b89a11957bec4 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/336-mac80211-Mesh-Fast-rx-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/336-mac80211-Mesh-Fast-rx-support.patch
@@ -20,7 +20,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -1747,6 +1747,8 @@ static void sta_apply_mesh_params(struct
+@@ -1750,6 +1750,8 @@ static void sta_apply_mesh_params(struct
  			/* init at low value */
  			ewma_mesh_tx_rate_avg_add(&sta->mesh->tx_rate_avg, 10);
  
@@ -29,7 +29,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  			break;
  		case NL80211_PLINK_LISTEN:
  		case NL80211_PLINK_BLOCKED:
-@@ -1761,6 +1763,7 @@ static void sta_apply_mesh_params(struct
+@@ -1764,6 +1766,7 @@ static void sta_apply_mesh_params(struct
  			ieee80211_mps_sta_status_update(sta);
  			changed |= ieee80211_mps_set_sta_local_pm(sta,
  					NL80211_MESH_POWER_UNKNOWN);
@@ -94,7 +94,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  	if (action) {
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -4663,10 +4663,15 @@ void ieee80211_check_fast_rx(struct sta_
+@@ -4649,10 +4649,15 @@ void ieee80211_check_fast_rx(struct sta_
  
  		break;
  	case NL80211_IFTYPE_MESH_POINT:
@@ -112,7 +112,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  		break;
  	default:
  		goto clear;
-@@ -4707,7 +4712,7 @@ void ieee80211_check_fast_rx(struct sta_
+@@ -4693,7 +4698,7 @@ void ieee80211_check_fast_rx(struct sta_
  	__release(check_fast_rx);
  
  	if (assign)
@@ -121,7 +121,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  
  	offload_flags = get_bss_sdata(sdata)->vif.offload_flags;
  	offload = offload_flags & IEEE80211_OFFLOAD_DECAP_ENABLED;
-@@ -4890,6 +4895,10 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4875,6 +4880,10 @@ static bool ieee80211_invoke_fast_rx(str
  		u8 sa[ETH_ALEN];
  	} addrs __aligned(2);
  	struct ieee80211_sta_rx_stats *stats;
@@ -132,7 +132,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  
  	/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
  	 * to a common data structure; drivers can implement that per queue
-@@ -4939,6 +4948,37 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4924,6 +4933,37 @@ static bool ieee80211_invoke_fast_rx(str
  		snap_offs += IEEE80211_CCMP_HDR_LEN;
  	}
  
@@ -170,7 +170,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  	if (!ieee80211_vif_is_mesh(&rx->sdata->vif) &&
  	    !(status->rx_flags & IEEE80211_RX_AMSDU)) {
  		if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
-@@ -4976,9 +5016,33 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4961,9 +5001,33 @@ static bool ieee80211_invoke_fast_rx(str
  		return true;
  	}
  
diff --git a/package/kernel/mac80211/patches/ath11k_nss/342-mac80211-fix-unconditional-sta-usage.patch b/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch
similarity index 79%
rename from package/kernel/mac80211/patches/ath11k_nss/342-mac80211-fix-unconditional-sta-usage.patch
rename to package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch
index e4890a3654c3b3..0cb2a1e95244e3 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/342-mac80211-fix-unconditional-sta-usage.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch
@@ -33,16 +33,19 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4725,12 +4725,12 @@ static void ieee80211_8023_xmit(struct i
+@@ -4695,7 +4695,7 @@ static void ieee80211_8023_xmit(struct i
  
- 	if (unlikely(skb->sk &&
- 		     skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS &&
--		     !ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD)))
-+		     !ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD) && sta))
- 		info->ack_frame_id = ieee80211_store_ack_skb(local, skb,
+ 	ieee80211_aggr_check(sdata, sta, skb);
+ 
+-	if (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD)) {
++	if (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD) && sta) {
+ 		tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
+ 		tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
+ 		if (tid_tx) {
+@@ -4746,7 +4746,7 @@ static void ieee80211_8023_xmit(struct i
  							     &info->flags, NULL);
  
- 	ieee80211_tx_stats(dev, len);
+ 	dev_sw_netstats_tx_add(dev, skbs, len);
 -	if (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD)) {
 +	if (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD) && sta) {
  		sta->deflink.tx_stats.packets[queue] += skbs;
diff --git a/package/kernel/mac80211/patches/nss/subsys/345-mac80211-fix-mixed-declaration.patch b/package/kernel/mac80211/patches/nss/subsys/345-mac80211-fix-mixed-declaration.patch
new file mode 100644
index 00000000000000..808f69e644ed61
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/subsys/345-mac80211-fix-mixed-declaration.patch
@@ -0,0 +1,52 @@
+From b3215eee07d071137e6977d60eee3cf685241fbb Mon Sep 17 00:00:00 2001
+From: Hari Chandrakanthan <quic_haric@quicinc.com>
+Date: Thu, 3 Feb 2022 13:55:53 +0530
+Subject: [PATCH] mac80211 : fix mixed declaration
+
+Fix mixed declaration in the api ieee80211_parse_ch_switch_ie
+
+Signed-off-by: Hari Chandrakanthan <quic_haric@quicinc.com>
+---
+ net/mac80211/spectmgmt.c | 22 +++++++++-------------
+ 1 file changed, 9 insertions(+), 13 deletions(-)
+
+--- a/net/mac80211/spectmgmt.c
++++ b/net/mac80211/spectmgmt.c
+@@ -33,7 +33,10 @@ int ieee80211_parse_ch_switch_ie(struct
+ 	struct cfg80211_chan_def new_vht_chandef = {};
+ 	const struct ieee80211_sec_chan_offs_ie *sec_chan_offs;
+ 	const struct ieee80211_wide_bw_chansw_ie *wide_bw_chansw_ie;
++	struct ieee80211_vht_operation vht_oper;
++	struct ieee80211_ht_operation ht_oper;
+ 	int secondary_channel_offset = -1;
++	u8 new_seg1;
+ 
+ 	memset(csa_ie, 0, sizeof(*csa_ie));
+ 
+@@ -133,20 +136,13 @@ int ieee80211_parse_ch_switch_ie(struct
+ 	}
+ 
+ 	if (wide_bw_chansw_ie) {
+-		u8 new_seg1 = wide_bw_chansw_ie->new_center_freq_seg1;
+-		struct ieee80211_vht_operation vht_oper = {
+-			.chan_width =
+-				wide_bw_chansw_ie->new_channel_width,
+-			.center_freq_seg0_idx =
+-				wide_bw_chansw_ie->new_center_freq_seg0,
+-			.center_freq_seg1_idx = new_seg1,
++		new_seg1 = wide_bw_chansw_ie->new_center_freq_seg1;
++		vht_oper.chan_width = wide_bw_chansw_ie->new_channel_width;
++		vht_oper.center_freq_seg0_idx = wide_bw_chansw_ie->new_center_freq_seg0;
++		vht_oper.center_freq_seg1_idx = new_seg1;
+ 			/* .basic_mcs_set doesn't matter */
+-		};
+-		struct ieee80211_ht_operation ht_oper = {
+-			.operation_mode =
+-				cpu_to_le16(new_seg1 <<
+-					    IEEE80211_HT_OP_MODE_CCFS2_SHIFT),
+-		};
++		ht_oper.operation_mode = cpu_to_le16(new_seg1 <<
++						     IEEE80211_HT_OP_MODE_CCFS2_SHIFT);
+ 
+ 		/* default, for the case of IEEE80211_VHT_CHANWIDTH_USE_HT,
+ 		 * to the previously parsed chandef
diff --git a/package/kernel/mac80211/patches/nss/subsys/346-mac80211-fix-bw-change-to-40Mhz-during-channel-switc.patch b/package/kernel/mac80211/patches/nss/subsys/346-mac80211-fix-bw-change-to-40Mhz-during-channel-switc.patch
new file mode 100644
index 00000000000000..df2b3a9257b115
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/subsys/346-mac80211-fix-bw-change-to-40Mhz-during-channel-switc.patch
@@ -0,0 +1,34 @@
+From 9c7571646a01eedb85350dfce12b499a0267ab2b Mon Sep 17 00:00:00 2001
+From: Hari Chandrakanthan <quic_haric@quicinc.com>
+Date: Thu, 3 Feb 2022 14:01:57 +0530
+Subject: [PATCH] mac80211 : fix bw change to 40Mhz during channel switch
+
+When AP reduces its channel bandwidth to 40Mhz, the associated
+sta reduces the channel bandwidth to 20Mhz.
+
+From spec 802.11 ac, section 8.4.2.165 :
+The Wide Bandwidth Channel Switch subelement is present under the following conditions:
+1.Channel switching to a BSS operating channel width of 40 MHz or wider
+2.Extended channel switching to a BSS operating channel width of 80 MHz or wider
+
+So when wide bandwidth channel switch subelement is present,
+the default bandwidth is chosen as 40Mhz.
+
+Signed-off-by: Hari Chandrakanthan <quic_haric@quicinc.com>
+---
+ net/mac80211/spectmgmt.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/mac80211/spectmgmt.c
++++ b/net/mac80211/spectmgmt.c
+@@ -136,6 +136,10 @@ int ieee80211_parse_ch_switch_ie(struct
+ 	}
+ 
+ 	if (wide_bw_chansw_ie) {
++		csa_ie->chandef.width = NL80211_CHAN_WIDTH_40;
++		csa_ie->chandef.center_freq1 =
++			ieee80211_channel_to_frequency(wide_bw_chansw_ie->new_center_freq_seg0,
++						       new_chan->band);
+ 		new_seg1 = wide_bw_chansw_ie->new_center_freq_seg1;
+ 		vht_oper.chan_width = wide_bw_chansw_ie->new_channel_width;
+ 		vht_oper.center_freq_seg0_idx = wide_bw_chansw_ie->new_center_freq_seg0;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch b/package/kernel/mac80211/patches/nss/subsys/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch
similarity index 95%
rename from package/kernel/mac80211/patches/ath11k_nss/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch
rename to package/kernel/mac80211/patches/nss/subsys/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch
index d128824140ecb6..ba80b62d0ac732 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch
@@ -21,7 +21,7 @@ Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
 
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -994,7 +994,8 @@ static bool ieee80211_set_sdata_offload_
+@@ -998,7 +998,8 @@ static bool ieee80211_set_sdata_offload_
  		flags |= IEEE80211_OFFLOAD_DECAP_ENABLED;
  
  		if (local->monitors &&
diff --git a/package/kernel/mac80211/patches/ath11k_nss/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch b/package/kernel/mac80211/patches/nss/subsys/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
similarity index 94%
rename from package/kernel/mac80211/patches/ath11k_nss/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
rename to package/kernel/mac80211/patches/nss/subsys/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
index 14fd82cbeaa853..2cb2ebe6f58f76 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
@@ -14,7 +14,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1387,8 +1387,6 @@ ieee80211_tx_info_clear_status(struct ie
+@@ -1405,8 +1405,6 @@ ieee80211_tx_info_clear_status(struct ie
   * @RX_FLAG_AMPDU_IS_LAST: this subframe is the last subframe of the A-MPDU
   * @RX_FLAG_AMPDU_DELIM_CRC_ERROR: A delimiter CRC error has been detected
   *	on this subframe
@@ -23,7 +23,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
   * @RX_FLAG_MIC_STRIPPED: The mic was stripped of this packet. Decryption was
   *	done by the hardware
   * @RX_FLAG_ONLY_MONITOR: Report frame only to monitor interfaces without
-@@ -1460,22 +1458,21 @@ enum mac80211_rx_flags {
+@@ -1478,22 +1476,21 @@ enum mac80211_rx_flags {
  	RX_FLAG_AMPDU_LAST_KNOWN	= BIT(12),
  	RX_FLAG_AMPDU_IS_LAST		= BIT(13),
  	RX_FLAG_AMPDU_DELIM_CRC_ERROR	= BIT(14),
@@ -63,7 +63,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
  /**
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -527,18 +527,13 @@ ieee80211_add_rx_radiotap_header(struct
+@@ -507,18 +507,13 @@ ieee80211_add_rx_radiotap_header(struct
  			flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
  		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
  			flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
diff --git a/package/kernel/mac80211/patches/ath11k_nss/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch b/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
similarity index 70%
rename from package/kernel/mac80211/patches/ath11k_nss/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
rename to package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
index 70e2603c8cc02b..a947728fc661f1 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
@@ -20,7 +20,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
 
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -2062,6 +2062,11 @@ netdev_tx_t ieee80211_subif_start_xmit(s
+@@ -2063,6 +2063,11 @@ netdev_tx_t ieee80211_subif_start_xmit(s
  				       struct net_device *dev);
  netdev_tx_t ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
  					    struct net_device *dev);
@@ -41,23 +41,10 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
 -				struct ieee80211_key *key, struct sk_buff *skb);
 +				struct ieee80211_key *key, struct sk_buff *skb,
 +				u32 info_flags, u32 ctrl_flags, u64 *cookie);
+ /* misc utils */
  
- static inline void ieee80211_tx_stats(struct net_device *dev, u32 len)
- {
-@@ -4310,13 +4311,18 @@ void __ieee80211_subif_start_xmit(struct
- 		atomic_inc(&sta->tx_netif_pkts);
- 
-         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
--                ap_sdata = container_of(sdata->bss,
--                                        struct ieee80211_sub_if_data, u.ap);
-+                if (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD))
-+                        ap_sdata = container_of(sdata->bss,
-+                                                struct ieee80211_sub_if_data,
-+                                                u.ap);
-+                else
-+                        ap_sdata = sdata;
-+
-                 if (ap_sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED &&
+ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
+@@ -4319,7 +4320,7 @@ void __ieee80211_subif_start_xmit(struct
                      !is_multicast_ether_addr(skb->data)) {
                          if (sta)
                                  key = rcu_dereference(sta->ptk[sta->ptk_idx]);
@@ -66,16 +53,16 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
                          rcu_read_unlock();
                          return;
                  }
-@@ -4374,7 +4378,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4365,7 +4366,7 @@ void __ieee80211_subif_start_xmit(struct
  		if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) {
  		    	if (sta)
  				key = rcu_dereference(sta->ptk[sta->ptk_idx]);
 -			ieee80211_8023_xmit(sdata, dev, sta, key, skb);
 +			ieee80211_8023_xmit(sdata, dev, sta, key, skb, info_flags, ctrl_flags, cookie);
  		} else {
- 			ieee80211_tx_stats(dev, skb->len);
+ 			dev_sw_netstats_tx_add(dev, 1, skb->len);
  			ieee80211_xmit(sdata, sta, skb);
-@@ -4657,19 +4663,29 @@ static bool ieee80211_tx_8023(struct iee
+@@ -4663,7 +4664,8 @@ static bool ieee80211_tx_8023(struct iee
  
  static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
  				struct net_device *dev, struct sta_info *sta,
@@ -84,51 +71,32 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
 +				u32 info_flags, u32 ctrl_flags, u64 *cookie)
  {
  	struct ieee80211_tx_info *info;
-+	struct ethhdr *ehdr = (struct ethhdr *)skb->data;
- 	struct ieee80211_local *local = sdata->local;
- 	struct tid_ampdu_tx *tid_tx;
- 	struct sk_buff *seg, *next;
- 	unsigned int skbs = 0, len = 0;
- 	u16 queue;
-+	unsigned char *ra = ehdr->h_dest;
-+	bool multicast;
- 	u8 tid;
- 
- 	queue = ieee80211_select_queue(sdata, sta, skb);
- 	skb_set_queue_mapping(skb, queue);
- 
-+	multicast = is_multicast_ether_addr(ra);
-+
-+	if (multicast && sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
-+	    !atomic_read(&sdata->u.vlan.num_mcast_sta))
-+		goto out_free;
-+
- 	if (unlikely(test_bit(SCAN_SW_SCANNING, &local->scanning)) &&
- 	    test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))
- 		goto out_free;
-@@ -4704,6 +4720,7 @@ static void ieee80211_8023_xmit(struct i
+ 	struct ethhdr *ehdr = (struct ethhdr *)skb->data;
+@@ -4719,6 +4721,7 @@ static void ieee80211_8023_xmit(struct i
  	info = IEEE80211_SKB_CB(skb);
  	memset(info, 0, sizeof(*info));
  
 +	info->flags |= info_flags;
  	info->hw_queue = sdata->vif.hw_queue[queue];
  
- 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-@@ -4723,9 +4740,10 @@ static void ieee80211_8023_xmit(struct i
+ 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+@@ -4739,11 +4742,12 @@ static void ieee80211_8023_xmit(struct i
  			memcpy(IEEE80211_SKB_CB(seg), info, sizeof(*info));
  	}
  
 -	if (unlikely(skb->sk &&
 -		     skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS &&
--		     !ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD) && sta))
 +	if (unlikely(((skb->sk &&
 +		       skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS) ||
 +		      ((ctrl_flags & IEEE80211_TX_CTL_REQ_TX_STATUS) && !multicast)) &&
-+		     !ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD)))
+ 		     !ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD)))
  		info->ack_frame_id = ieee80211_store_ack_skb(local, skb,
- 							     &info->flags, NULL);
+-							     &info->flags, NULL);
++							     &info->flags, cookie);
  
-@@ -4750,7 +4768,8 @@ out_free:
+ 	dev_sw_netstats_tx_add(dev, skbs, len);
+ 	if (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD) && sta) {
+@@ -4763,7 +4767,8 @@ out_free:
  
  void ieee80211_8023_xmit_ap(struct ieee80211_sub_if_data *sdata,
  			    struct net_device *dev, struct sta_info *sta,
@@ -138,7 +106,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  {
  	struct ieee80211_tx_info *info;
  	struct ieee80211_local *local = sdata->local;
-@@ -4759,6 +4778,9 @@ void ieee80211_8023_xmit_ap(struct ieee8
+@@ -4772,6 +4777,9 @@ void ieee80211_8023_xmit_ap(struct ieee8
  	unsigned long flags;
  	int q;
  	u16 q_map;
@@ -148,7 +116,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  	/*
  	 * If the skb is shared we need to obtain our own copy.
-@@ -4770,11 +4792,13 @@ void ieee80211_8023_xmit_ap(struct ieee8
+@@ -4783,11 +4791,13 @@ void ieee80211_8023_xmit_ap(struct ieee8
  
  	info = IEEE80211_SKB_CB(skb);
  	memset(info, 0, sizeof(*info));
@@ -165,9 +133,9 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  	info->flags |= IEEE80211_TX_CTL_HW_80211_ENCAP;
  	info->control.vif = &sdata->vif;
-@@ -4811,14 +4835,23 @@ void ieee80211_8023_xmit_ap(struct ieee8
- 	if (sta)
- 		atomic_inc(&sta->tx_drv_pkts);
+@@ -4821,14 +4831,23 @@ void ieee80211_8023_xmit_ap(struct ieee8
+ 	drv_tx(local, &control, skb);
+ 
  }
 -
  netdev_tx_t ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
@@ -190,7 +158,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  #ifdef CPTCFG_MAC80211_NSS_SUPPORT
         ieee80211_xmit_nss_fixup(skb, dev);
-@@ -4834,14 +4867,15 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4844,14 +4863,15 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		kfree_skb(skb);
  		goto out;
  	}
@@ -208,7 +176,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  		goto skip_offload;
  
  	key = rcu_dereference(sta->ptk[sta->ptk_idx]);
-@@ -4852,13 +4886,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4862,13 +4882,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		goto skip_offload;
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP) {
@@ -224,18 +192,15 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  	goto out;
  
  skip_offload:
-@@ -6364,13 +6398,10 @@ start_xmit:
+@@ -6374,7 +6394,10 @@ start_xmit:
  	mutex_lock(&local->mtx);
  
  	local_bh_disable();
--
--	/* added hardware encap check for ethernet mode */
- 	if (sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED)
--		ieee80211_subif_start_xmit_8023(skb, skb->dev);
+-	__ieee80211_subif_start_xmit(skb, skb->dev, flags, ctrl_flags, cookie);
++	if (sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED)
 +		__ieee80211_subif_start_xmit_8023(skb, skb->dev, flags, ctrl_flags, cookie);
- 	else
- 		__ieee80211_subif_start_xmit(skb, skb->dev, flags, ctrl_flags, cookie);
--
++	else
++		__ieee80211_subif_start_xmit(skb, skb->dev, flags, ctrl_flags, cookie);
  	local_bh_enable();
  
  	mutex_unlock(&local->mtx);
diff --git a/package/kernel/mac80211/patches/ath11k_nss/913-686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch b/package/kernel/mac80211/patches/nss/subsys/686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch
similarity index 88%
rename from package/kernel/mac80211/patches/ath11k_nss/913-686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch
rename to package/kernel/mac80211/patches/nss/subsys/686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch
index 6614d8d496b354..7ffaf99158b90e 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/913-686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch
@@ -72,7 +72,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2347,7 +2347,7 @@ static void mpath_set_pinfo(struct mesh_
+@@ -2350,7 +2350,7 @@ static void mpath_set_pinfo(struct mesh_
  	if (mpath->flags & MESH_PATH_RESOLVED)
  		pinfo->flags |= NL80211_MPATH_FLAG_RESOLVED;
  	pinfo->hop_count = mpath->hop_count;
@@ -94,27 +94,21 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
  #define MESH_FAST_TX_CACHE_MAX_SIZE		512
 --- a/net/mac80211/mesh_hwmp.c
 +++ b/net/mac80211/mesh_hwmp.c
-@@ -504,7 +504,10 @@ static u32 hwmp_route_info_get(struct ie
+@@ -504,7 +504,7 @@ static u32 hwmp_route_info_get(struct ie
  			if (next_hop)
  				ether_addr_copy(old_next_hop_addr, next_hop->sta.addr);
  			if (next_hop != sta) {
 -				mpath->path_change_count++;
 +				atomic_inc(&mpath->path_change_count);
-+                                mpath_dbg(sdata, "MESH MPU dst %pM next hop %pM"
-+                                          " metric %d ft 0x%x\n",
-+                                          mpath->dst, sta->deflink.addr, last_hop_metric, action);
  				flush_mpath = true;
  			}
  			mesh_path_assign_nexthop(mpath, sta);
-@@ -565,7 +568,10 @@ static u32 hwmp_route_info_get(struct ie
+@@ -565,7 +565,7 @@ static u32 hwmp_route_info_get(struct ie
  			if (next_hop)
  				ether_addr_copy(old_next_hop_addr, next_hop->sta.addr);
  			if (next_hop != sta) {
 -				mpath->path_change_count++;
 +				atomic_inc(&mpath->path_change_count);
-+				mpath_dbg(sdata, "MESH MPU dst %pM next hop %pM"
-+					  " metric %d ft 0x%x\n",
-+					  mpath->dst, sta->deflink.addr, last_hop_metric, action);
  				flush_mpath = true;
  			}
  			mesh_path_assign_nexthop(mpath, sta);
diff --git a/package/kernel/mac80211/patches/nss/subsys/751-mac80211-Get-valid-last_rate-for-rx_bitrate-from-cpu.patch b/package/kernel/mac80211/patches/nss/subsys/751-mac80211-Get-valid-last_rate-for-rx_bitrate-from-cpu.patch
new file mode 100644
index 00000000000000..098767aa3f36db
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/subsys/751-mac80211-Get-valid-last_rate-for-rx_bitrate-from-cpu.patch
@@ -0,0 +1,68 @@
+From eac6bea547505fc6545014755e8e529fd804df42 Mon Sep 17 00:00:00 2001
+From: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
+Date: Tue, 18 Apr 2023 14:41:05 +0530
+Subject: [PATCH 1/3] mac80211: Get valid last_rate for rx_bitrate from cpu
+ stats
+
+Get the valid last_rate from the cpu rx_stats while filling the
+rx_bitrate in the station dump. This helps to avoid the missing
+rx bitrate field in the iw station dump.
+
+Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
+Signed-off-by: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
+---
+ net/mac80211/sta_info.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -2396,7 +2396,7 @@ void ieee80211_sta_update_pending_airtim
+ }
+ 
+ static struct ieee80211_sta_rx_stats *
+-sta_get_last_rx_stats(struct sta_info *sta)
++sta_get_last_rx_stats(struct sta_info *sta, bool is_rx_bitrate)
+ {
+ 	struct ieee80211_sta_rx_stats *stats = &sta->deflink.rx_stats;
+ 	int cpu;
+@@ -2409,8 +2409,13 @@ sta_get_last_rx_stats(struct sta_info *s
+ 
+ 	for_each_possible_cpu(cpu) {
+ 		struct ieee80211_sta_rx_stats *cpustats;
++		u16 rate;
+ 
+ 		cpustats = per_cpu_ptr(sta->deflink.pcpu_rx_stats, cpu);
++		rate = READ_ONCE(cpustats->last_rate);
++
++		if(!cpustats->last_rx || (is_rx_bitrate && (rate == STA_STATS_RATE_INVALID)))
++			continue;
+ 
+ 		if (time_after(cpustats->last_rx, stats->last_rx))
+ 			stats = cpustats;
+@@ -2480,7 +2485,7 @@ static void sta_stats_decode_rate(struct
+ 
+ static int sta_set_rate_info_rx(struct sta_info *sta, struct rate_info *rinfo)
+ {
+-	u32 rate = READ_ONCE(sta_get_last_rx_stats(sta)->last_rate);
++	u32 rate = READ_ONCE(sta_get_last_rx_stats(sta, true)->last_rate);
+ 
+ 	if (rate == STA_STATS_RATE_INVALID)
+ 		return -EINVAL;
+@@ -2680,7 +2685,7 @@ void sta_set_sinfo(struct sta_info *sta,
+ 	struct ieee80211_sta_rx_stats *last_rxstats;
+ 	struct link_sta_info *link_sta = NULL;
+ 
+-	last_rxstats = sta_get_last_rx_stats(sta);
++	last_rxstats = sta_get_last_rx_stats(sta, false);
+ 
+ 	sinfo->generation = sdata->local->sta_generation;
+ 
+@@ -2924,7 +2929,7 @@ u32 sta_get_expected_throughput(struct s
+ 
+ unsigned long ieee80211_sta_last_active(struct sta_info *sta)
+ {
+-	struct ieee80211_sta_rx_stats *stats = sta_get_last_rx_stats(sta);
++	struct ieee80211_sta_rx_stats *stats = sta_get_last_rx_stats(sta, false);
+ 
+ 	if (!sta->deflink.status_stats.last_ack ||
+ 	    time_after(stats->last_rx, sta->deflink.status_stats.last_ack))
diff --git a/package/kernel/mac80211/patches/ath11k_nss/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch b/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
similarity index 74%
rename from package/kernel/mac80211/patches/ath11k_nss/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
rename to package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
index e5b4d7d9e7ef4e..50466d46c37880 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
@@ -31,7 +31,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
  				struct net_device *dev, struct sta_info *sta,
  				struct ieee80211_key *key, struct sk_buff *skb,
-@@ -3633,7 +3635,7 @@ ieee80211_sdata_netdev_features(struct i
+@@ -3632,7 +3634,7 @@ ieee80211_sdata_netdev_features(struct i
  }
  
  static struct sk_buff *
@@ -40,7 +40,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  {
  	if (skb_is_gso(skb)) {
  		struct sk_buff *segs;
-@@ -3651,7 +3653,7 @@ ieee80211_tx_skb_fixup(struct sk_buff *s
+@@ -3650,7 +3652,7 @@ ieee80211_tx_skb_fixup(struct sk_buff *s
  	if (skb_needs_linearize(skb, features) && __skb_linearize(skb))
  		goto free;
  
@@ -49,7 +49,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  		int ofs = skb_checksum_start_offset(skb);
  
  		if (skb->encapsulation)
-@@ -3797,7 +3799,7 @@ static bool ieee80211_xmit_fast(struct i
+@@ -3796,7 +3798,7 @@ static bool ieee80211_xmit_fast(struct i
  	memcpy(&eth, skb->data, ETH_HLEN - 2);
  
  	/* after this point (skb is modified) we cannot return false */
@@ -58,7 +58,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	if (!skb)
  		return true;
  
-@@ -4345,7 +4347,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4343,7 +4345,7 @@ void __ieee80211_subif_start_xmit(struct
  	 * things so we cannot really handle checksum or GSO offload.
  	 * fix it up in software before we handle anything else.
  	 */
@@ -67,15 +67,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	if (!skb) {
  		len = 0;
  		goto out;
-@@ -4567,7 +4569,6 @@ netdev_tx_t ieee80211_subif_start_xmit(s
- #ifdef CPTCFG_MAC80211_NSS_SUPPORT
- 	ieee80211_xmit_nss_fixup(skb, dev);
- #endif
--	skb->fast_xmit = 0;
- 
- 	if (likely(!is_multicast_ether_addr(eth->h_dest)))
- 		goto normal;
-@@ -4714,7 +4715,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4714,7 +4716,7 @@ static void ieee80211_8023_xmit(struct i
  		}
  	}
  
@@ -84,30 +76,9 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	if (!skb)
  		return;
  
-@@ -4839,6 +4840,7 @@ void ieee80211_8023_xmit_ap(struct ieee8
- netdev_tx_t ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
- 					    struct net_device *dev)
- {
-+#ifdef CPTCFG_MAC80211_SFE_SUPPORT
- 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
- 	struct ieee80211_tx_control control = {};
-@@ -4873,9 +4875,10 @@ out:
- 		}
- 
- 		return NETDEV_TX_OK;
--	} else {
--		return __ieee80211_subif_start_xmit_8023(skb, dev, 0, 0, NULL);
- 	}
-+#endif
-+	return __ieee80211_subif_start_xmit_8023(skb, dev, 0, 0, NULL);
-+
- }
- 
- netdev_tx_t __ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -2250,6 +2250,10 @@ int ieee80211_if_add(struct ieee80211_lo
+@@ -2267,6 +2267,10 @@ int ieee80211_if_add(struct ieee80211_lo
  
  		ndev->features |= local->hw.netdev_features;
  		ndev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
diff --git a/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch b/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
new file mode 100644
index 00000000000000..b76692a6f9500c
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
@@ -0,0 +1,342 @@
+From ca28b8b125c27063b9b4bc60bb85206ca8e0d403 Mon Sep 17 00:00:00 2001
+From: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
+Date: Thu, 31 Aug 2023 10:59:33 +0530
+Subject: [PATCH] wifi: mac80211: Add mac hw flag to avoid queue skb
+
+Queue SKB in mac80211 become mandatory from latest 6.1 kernel. Because of
+this queuing, there will be performance degradation. Add hw flag option
+to enable tx queue in Driver/Hardware.
+
+Driver/hardware can register for HAS_TX_QUEUE HW flag and avoid tx queuing
+in mac80211.
+
+Add same HW flag checks to avoid accessing skb queues which will be
+NULL or invalid and also NULL checks for sta txqs for NULL or invalid
+access.
+
+Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
+---
+ include/net/mac80211.h                |  1 +
+ net/mac80211/debugfs.c                |  1 +
+ net/mac80211/tx.c                     | 18 ++++++++++++++----
+ 4 files changed, 17 insertions(+), 4 deletions(-)
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -2730,6 +2730,9 @@ struct ieee80211_txq {
+  *
+  * @IEEE80211_HW_SUPPORTS_TID_CLASS_OFFLOAD: Hardware suports tid calssification offload.
+  *
++ * @IEE80211_HW_HAS_TX_QUEUE: Hardware/drivers has tx queue, does skb queuing itself,
++ *	the stack will not do tx queuing.
++ *
+  * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
+  */
+ enum ieee80211_hw_flags {
+@@ -2790,6 +2793,7 @@ enum ieee80211_hw_flags {
+ 	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
+ 	IEEE80211_HW_SUPPORTS_MESH_NSS_OFFLOAD,
+ 	IEEE80211_HW_SUPPORTS_TID_CLASS_OFFLOAD,
++	IEEE80211_HW_HAS_TX_QUEUE,
+ 
+ 	/* keep last, obviously */
+ 	NUM_IEEE80211_HW_FLAGS
+--- a/net/mac80211/debugfs.c
++++ b/net/mac80211/debugfs.c
+@@ -508,6 +508,7 @@ static const char *hw_flag_names[] = {
+ 	FLAG(SUPPORTS_NSS_OFFLOAD),
+ 	FLAG(SUPPORTS_MESH_NSS_OFFLOAD),
+ 	FLAG(SUPPORTS_TID_CLASS_OFFLOAD),
++	FLAG(HAS_TX_QUEUE),
+ #undef FLAG
+ };
+ 
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1603,6 +1603,9 @@ int ieee80211_txq_setup_flows(struct iee
+ 	bool supp_vht = false;
+ 	enum nl80211_band band;
+ 
++	if (ieee80211_hw_check(&local->hw, HAS_TX_QUEUE))
++		return 0;
++
+ 	ret = fq_init(fq, 4096);
+ 	if (ret)
+ 		return ret;
+@@ -1650,6 +1653,9 @@ void ieee80211_txq_teardown_flows(struct
+ {
+ 	struct fq *fq = &local->fq;
+ 
++	if (ieee80211_hw_check(&local->hw, HAS_TX_QUEUE))
++		return;
++
+ 	kfree(local->cvars);
+ 	local->cvars = NULL;
+ 
+@@ -1666,7 +1672,8 @@ static bool ieee80211_queue_skb(struct i
+ 	struct ieee80211_vif *vif;
+ 	struct txq_info *txqi;
+ 
+-	if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
++	if (ieee80211_hw_check(&local->hw, HAS_TX_QUEUE) ||
++	    sdata->vif.type == NL80211_IFTYPE_MONITOR)
+ 		return false;
+ 
+ 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+@@ -4328,7 +4335,8 @@ void __ieee80211_subif_start_xmit(struct
+                 }
+         }
+ 
+-	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, sta, skb));
++	if (unlikely(!ieee80211_hw_check(&local->hw, HAS_TX_QUEUE)))
++		skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, sta, skb));
+ 	ieee80211_aggr_check(sdata, sta, skb);
+ 
+ 	if (sta) {
+@@ -4680,8 +4688,10 @@ static void ieee80211_8023_xmit(struct i
+ 	bool multicast;
+ 	u8 tid;
+ 
+-	queue = ieee80211_select_queue(sdata, sta, skb);
+-	skb_set_queue_mapping(skb, queue);
++	if (unlikely(!ieee80211_hw_check(&local->hw, HAS_TX_QUEUE))) {
++		queue = ieee80211_select_queue(sdata, sta, skb);
++		skb_set_queue_mapping(skb, queue);
++	}
+ 
+ 	multicast = is_multicast_ether_addr(ra);
+ 
+@@ -6416,9 +6426,12 @@ int ieee80211_tx_control_port(struct wip
+ 	}
+ 
+ 	if (!IS_ERR(sta)) {
+-		u16 queue = ieee80211_select_queue(sdata, sta, skb);
+ 
+-		skb_set_queue_mapping(skb, queue);
++		if (!ieee80211_hw_check(&local->hw, HAS_TX_QUEUE)) {
++			u16 queue = ieee80211_select_queue(sdata, sta, skb);
++
++			skb_set_queue_mapping(skb, queue);
++		}
+ 
+ 		/*
+ 		 * for MLO STA, the SA should be the AP MLD address, but
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -4525,6 +4525,9 @@ static int ieee80211_get_txq_stats(struc
+ 	struct ieee80211_sub_if_data *sdata;
+ 	int ret = 0;
+ 
++	if (ieee80211_hw_check(&local->hw, HAS_TX_QUEUE))
++		return 1;
++
+ 	spin_lock_bh(&local->fq.lock);
+ 	rcu_read_lock();
+ 
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -839,7 +839,10 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+ 		atomic_set(&local->agg_queue_stop[i], 0);
+ 	}
+ 	tasklet_setup(&local->tx_pending_tasklet, ieee80211_tx_pending);
+-	tasklet_setup(&local->wake_txqs_tasklet, ieee80211_wake_txqs);
++
++	if (!ieee80211_hw_check(&local->hw, HAS_TX_QUEUE))
++		tasklet_setup(&local->wake_txqs_tasklet, ieee80211_wake_txqs);
++
+ 	tasklet_setup(&local->tasklet, ieee80211_tasklet_handler);
+ 
+ 	skb_queue_head_init(&local->skb_queue);
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1549,6 +1549,9 @@ static void sta_ps_start(struct sta_info
+ 
+ 	ieee80211_clear_fast_xmit(sta);
+ 
++	if (!sta->sta.txq[0])
++		return;
++
+ 	for (tid = 0; tid < IEEE80211_NUM_TIDS; tid++) {
+ 		struct ieee80211_txq *txq = sta->sta.txq[tid];
+ 		struct txq_info *txqi = to_txq_info(txq);
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -140,15 +140,17 @@ static void __cleanup_single_sta(struct
+ 		atomic_dec(&ps->num_sta_ps);
+ 	}
+ 
+-	for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
+-		struct txq_info *txqi;
++	if (sta->sta.txq[0]) {
++		for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
++			struct txq_info *txqi;
+ 
+-		if (!sta->sta.txq[i])
+-			continue;
++			if (!sta->sta.txq[i])
++				continue;
+ 
+-		txqi = to_txq_info(sta->sta.txq[i]);
++			txqi = to_txq_info(sta->sta.txq[i]);
+ 
+-		ieee80211_txq_purge(local, txqi);
++			ieee80211_txq_purge(local, txqi);
++		}
+ 	}
+ 
+ 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+@@ -430,7 +432,9 @@ void sta_info_free(struct ieee80211_loca
+ 
+ 	sta_dbg(sta->sdata, "Destroyed STA %pM\n", sta->sta.addr);
+ 
+-	kfree(to_txq_info(sta->sta.txq[0]));
++	if (sta->sta.txq[0])
++		kfree(to_txq_info(sta->sta.txq[0]));
++
+ 	kfree(rcu_dereference_raw(sta->sta.rates));
+ #ifdef CPTCFG_MAC80211_MESH
+ 	kfree(sta->mesh);
+@@ -532,8 +536,6 @@ __sta_info_alloc(struct ieee80211_sub_if
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct ieee80211_hw *hw = &local->hw;
+ 	struct sta_info *sta;
+-	void *txq_data;
+-	int size;
+ 	int i;
+ 
+ 	sta = kzalloc(sizeof(*sta) + hw->sta_data_size, gfp);
+@@ -607,18 +609,22 @@ __sta_info_alloc(struct ieee80211_sub_if
+ 
+ 	sta->last_connected = ktime_get_seconds();
+ 
+-	size = sizeof(struct txq_info) +
+-	       ALIGN(hw->txq_data_size, sizeof(void *));
+ 
+-	txq_data = kcalloc(ARRAY_SIZE(sta->sta.txq), size, gfp);
+-	if (!txq_data)
+-		goto free;
++	if (!ieee80211_hw_check(&local->hw, HAS_TX_QUEUE)) {
++		void *txq_data;
++		int size = sizeof(struct txq_info) +
++			ALIGN(hw->txq_data_size, sizeof(void *));
++
++		txq_data = kcalloc(ARRAY_SIZE(sta->sta.txq), size, gfp);
++		if (!txq_data)
++			goto free;
+ 
+-	for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
+-		struct txq_info *txq = txq_data + i * size;
++		for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
++			struct txq_info *txq = txq_data + i * size;
+ 
+-		/* might not do anything for the (bufferable) MMPDU TXQ */
+-		ieee80211_txq_init(sdata, sta, txq, i);
++			/* might not do anything for the (bufferable) MMPDU TXQ */
++			ieee80211_txq_init(sdata, sta, txq, i);
++		}
+ 	}
+ 
+ 	if (sta_prepare_rate_control(local, sta, gfp))
+@@ -692,7 +698,8 @@ __sta_info_alloc(struct ieee80211_sub_if
+ 	return sta;
+ 
+ free_txq:
+-	kfree(to_txq_info(sta->sta.txq[0]));
++	if (sta->sta.txq[0])
++		kfree(to_txq_info(sta->sta.txq[0]));
+ free:
+ 	sta_info_free_link(&sta->deflink);
+ #ifdef CPTCFG_MAC80211_MESH
+@@ -1687,11 +1694,13 @@ void ieee80211_sta_ps_deliver_wakeup(str
+ 	if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
+ 		drv_sta_notify(local, sdata, STA_NOTIFY_AWAKE, &sta->sta);
+ 
+-	for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
+-		if (!sta->sta.txq[i] || !txq_has_queue(sta->sta.txq[i]))
+-			continue;
++	if (!ieee80211_hw_check(&local->hw, HAS_TX_QUEUE)) {
++		for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
++			if (!sta->sta.txq[i] || !txq_has_queue(sta->sta.txq[i]))
++				continue;
+ 
+-		schedule_and_wake_txq(local, to_txq_info(sta->sta.txq[i]));
++			schedule_and_wake_txq(local, to_txq_info(sta->sta.txq[i]));
++		}
+ 	}
+ 
+ 	skb_queue_head_init(&pending);
+@@ -2106,6 +2115,9 @@ ieee80211_sta_ps_deliver_response(struct
+ 		 * TIM recalculation.
+ 		 */
+ 
++		if (!sta->sta.txq[0])
++			return;
++
+ 		for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
+ 			if (!sta->sta.txq[tid] ||
+ 			    !(driver_release_tids & BIT(tid)) ||
+@@ -2521,7 +2533,7 @@ static void sta_set_tidstats(struct sta_
+ 		tidstats->tx_msdu_failed = sta->deflink.status_stats.msdu_failed[tid];
+ 	}
+ 
+-	if (tid < IEEE80211_NUM_TIDS) {
++	if (!ieee80211_hw_check(&local->hw, HAS_TX_QUEUE) && tid < IEEE80211_NUM_TIDS) {
+ 		spin_lock_bh(&local->fq.lock);
+ 		rcu_read_lock();
+ 
+@@ -2849,6 +2861,9 @@ unsigned long ieee80211_sta_last_active(
+ 
+ static void sta_update_codel_params(struct sta_info *sta, u32 thr)
+ {
++	if (ieee80211_hw_check(&sta->sdata->local->hw, HAS_TX_QUEUE))
++		return;
++
+ 	if (thr && thr < STA_SLOW_THRESHOLD * sta->local->num_sta) {
+ 		sta->cparams.target = MS2TIME(50);
+ 		sta->cparams.interval = MS2TIME(300);
+--- a/net/mac80211/debugfs_sta.c
++++ b/net/mac80211/debugfs_sta.c
+@@ -162,6 +162,9 @@ static ssize_t sta_aqm_read(struct file
+ 		       bufsz + buf - p,
+ 		       "tid ac backlog-bytes backlog-packets new-flows drops marks overlimit collisions tx-bytes tx-packets flags\n");
+ 
++	if (!ieee80211_hw_check(&local->hw, HAS_TX_QUEUE))
++		goto skip_txq_info;
++
+ 	for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
+ 		if (!sta->sta.txq[i])
+ 			continue;
+@@ -186,6 +189,7 @@ static ssize_t sta_aqm_read(struct file
+ 			       test_bit(IEEE80211_TXQ_DIRTY, &txqi->flags) ? " DIRTY" : "");
+ 	}
+ 
++skip_txq_info:
+ 	rcu_read_unlock();
+ 	spin_unlock_bh(&local->fq.lock);
+ 
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -832,7 +832,8 @@ bool ieee80211_mesh_xmit_fast(struct iee
+ 	if (!skb)
+ 		return true;
+ 
+-	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, sta, skb));
++	if (unlikely(!ieee80211_hw_check(&sdata->local->hw, HAS_TX_QUEUE)))
++		skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, sta, skb));
+ 
+ 	meshhdr = (struct ieee80211s_hdr *)entry->hdr;
+ 	if ((meshhdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6) {
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -477,10 +477,8 @@ static void __ieee80211_wake_queue(struc
+ 	 * release someone's lock, but it is fine because all the callers of
+ 	 * __ieee80211_wake_queue call it right before releasing the lock.
+ 	 */
+-	if (reason == IEEE80211_QUEUE_STOP_REASON_DRIVER)
++	if (!ieee80211_hw_check(&local->hw, HAS_TX_QUEUE))
+ 		tasklet_schedule(&local->wake_txqs_tasklet);
+-	else
+-		_ieee80211_wake_txqs(local, flags);
+ }
+ 
+ void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,
diff --git a/package/kernel/mac80211/patches/ath11k_nss/829-mac80211-fix-mesh-ping-issue.patch b/package/kernel/mac80211/patches/nss/subsys/829-mac80211-fix-mesh-ping-issue.patch
similarity index 92%
rename from package/kernel/mac80211/patches/ath11k_nss/829-mac80211-fix-mesh-ping-issue.patch
rename to package/kernel/mac80211/patches/nss/subsys/829-mac80211-fix-mesh-ping-issue.patch
index 7043ecb079061a..642901bed17459 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/829-mac80211-fix-mesh-ping-issue.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/829-mac80211-fix-mesh-ping-issue.patch
@@ -10,7 +10,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
 
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -4748,16 +4748,14 @@ void ieee80211_check_fast_rx(struct sta_
+@@ -4647,16 +4647,14 @@ void ieee80211_check_fast_rx(struct sta_
  
  		break;
  	case NL80211_IFTYPE_MESH_POINT:
@@ -31,7 +31,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  	default:
  		goto clear;
  	}
-@@ -4980,10 +4978,7 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4878,10 +4876,7 @@ static bool ieee80211_invoke_fast_rx(str
  		u8 sa[ETH_ALEN];
  	} addrs __aligned(2);
  	struct ieee80211_sta_rx_stats *stats;
@@ -42,7 +42,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  	/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
  	 * to a common data structure; drivers can implement that per queue
-@@ -5033,37 +5028,6 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4931,37 +4926,6 @@ static bool ieee80211_invoke_fast_rx(str
  		snap_offs += IEEE80211_CCMP_HDR_LEN;
  	}
  
@@ -80,7 +80,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  	if (!ieee80211_vif_is_mesh(&rx->sdata->vif) &&
  	    !(status->rx_flags & IEEE80211_RX_AMSDU)) {
  		if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
-@@ -5101,30 +5065,6 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4999,30 +4963,6 @@ static bool ieee80211_invoke_fast_rx(str
  		return true;
  	}
  
diff --git a/package/kernel/mac80211/patches/ath11k_nss/902-wifi-mac80211-Fix-memory-corruption-during-mesh-beac.patch b/package/kernel/mac80211/patches/nss/subsys/902-wifi-mac80211-Fix-memory-corruption-during-mesh-beac.patch
similarity index 91%
rename from package/kernel/mac80211/patches/ath11k_nss/902-wifi-mac80211-Fix-memory-corruption-during-mesh-beac.patch
rename to package/kernel/mac80211/patches/nss/subsys/902-wifi-mac80211-Fix-memory-corruption-during-mesh-beac.patch
index ea76cd96327e46..e3d8db5815fe88 100644
--- a/package/kernel/mac80211/patches/ath11k_nss/902-wifi-mac80211-Fix-memory-corruption-during-mesh-beac.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/902-wifi-mac80211-Fix-memory-corruption-during-mesh-beac.patch
@@ -36,7 +36,7 @@ Signed-off-by: Manish Dharanenthiran <quic_mdharane@quicinc.com>
  
 --- a/net/mac80211/mesh.c
 +++ b/net/mac80211/mesh.c
-@@ -1183,7 +1183,7 @@ void ieee80211_mbss_info_change_notify(s
+@@ -1184,7 +1184,7 @@ void ieee80211_mbss_info_change_notify(s
  
  	/* if we race with running work, worst case this work becomes a noop */
  	for_each_set_bit(bit, &bits, sizeof(changed) * BITS_PER_BYTE)
@@ -45,7 +45,7 @@ Signed-off-by: Manish Dharanenthiran <quic_mdharane@quicinc.com>
  	set_bit(MESH_WORK_MBSS_CHANGED, &ifmsh->wrkq_flags);
  	wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
  }
-@@ -1265,7 +1265,7 @@ void ieee80211_stop_mesh(struct ieee8021
+@@ -1266,7 +1266,7 @@ void ieee80211_stop_mesh(struct ieee8021
  
  	/* clear any mesh work (for next join) we may have accrued */
  	ifmsh->wrkq_flags = 0;
@@ -54,7 +54,7 @@ Signed-off-by: Manish Dharanenthiran <quic_mdharane@quicinc.com>
  
  	local->fif_other_bss--;
  	atomic_dec(&local->iff_allmultis);
-@@ -1732,9 +1732,9 @@ static void mesh_bss_info_changed(struct
+@@ -1733,9 +1733,9 @@ static void mesh_bss_info_changed(struct
  	u32 bit;
  	u64 changed = 0;
  

From a1e4131a77bfa6db5f5d66fe895a345b0b9ca4ab Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 9 Mar 2024 11:59:20 -0500
Subject: [PATCH 093/225] qualcommax: Introduce skbuff_recycle for performance

QSDK NSS builds utilize skbuff recycling for better handling of memory.

On a Dynalink DL-WRX36 (pbuf script should be set to 'auto') a significant drop in
memory usage was observed as well consistent sustained RX/TX speeds.

BEFORE:
echo 3 >! /proc/sys/vm/drop_caches

free -m
					total        used        free      shared  buff/cache   available
Mem:             867         338         547          90         101         528
Swap:              0           0           0

AFTER:
					total        used        free      shared  buff/cache   available
Mem:             867         242         594           1          81         624
Swap:              0           0           0

NOTE:

For 512MB platforms, users need to test with the following scenarios,
as the patch `999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch` is
really only testable on platforms with 512M or less RAM.

1.) Explicitly setting 'ATH11K_MEM_PROFILE_512M' on and see if system
crashes on boot.

2.) Explicitly setting 'ATH11K_MEM_PROFILE_1G'

3.) Remove patches
999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
999-311-ath11k-configure-nss-thread-priority-during-pdev_ini.patch

And re-test with #1 and #2

It was incorrectly assumed that setting a 512M for 1G platforms would save
memory, instead it needs to be explicitly set to know proper memory
regions, otherwise it would cause fw crash.

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 target/linux/qualcommax/config-6.6            |   5 +
 .../qualcommax/files/net/core/skbuff_debug.c  | 332 ++++++++
 .../qualcommax/files/net/core/skbuff_debug.h  |  53 ++
 .../files/net/core/skbuff_notifier.c          |  42 +
 .../files/net/core/skbuff_notifier.h          |  52 ++
 .../files/net/core/skbuff_recycle.c           | 729 ++++++++++++++++++
 .../files/net/core/skbuff_recycle.h           | 178 +++++
 7 files changed, 1391 insertions(+)
 create mode 100644 target/linux/qualcommax/files/net/core/skbuff_debug.c
 create mode 100644 target/linux/qualcommax/files/net/core/skbuff_debug.h
 create mode 100644 target/linux/qualcommax/files/net/core/skbuff_notifier.c
 create mode 100644 target/linux/qualcommax/files/net/core/skbuff_notifier.h
 create mode 100644 target/linux/qualcommax/files/net/core/skbuff_recycle.c
 create mode 100644 target/linux/qualcommax/files/net/core/skbuff_recycle.h

diff --git a/target/linux/qualcommax/config-6.6 b/target/linux/qualcommax/config-6.6
index ac5059682a5cdf..70fb9a00e4834b 100644
--- a/target/linux/qualcommax/config-6.6
+++ b/target/linux/qualcommax/config-6.6
@@ -503,6 +503,11 @@ CONFIG_SERIAL_MSM=y
 CONFIG_SERIAL_MSM_CONSOLE=y
 CONFIG_SGL_ALLOC=y
 CONFIG_SG_POOL=y
+# CONFIG_ALLOC_SKB_PAGE_FRAG_DISABLE is not set
+# CONFIG_DEBUG_OBJECTS_SKBUFF is not set
+CONFIG_SKB_RECYCLER=y
+CONFIG_SKB_RECYCLER_MULTI_CPU=y
+# CONFIG_SKB_FAST_RECYCLABLE_DEBUG_ENABLE is not set
 CONFIG_SMP=y
 # CONFIG_SM_CAMCC_6350 is not set
 # CONFIG_SM_CAMCC_8450 is not set
diff --git a/target/linux/qualcommax/files/net/core/skbuff_debug.c b/target/linux/qualcommax/files/net/core/skbuff_debug.c
new file mode 100644
index 00000000000000..50d06759210995
--- /dev/null
+++ b/target/linux/qualcommax/files/net/core/skbuff_debug.c
@@ -0,0 +1,332 @@
+/*
+ * Copyright (c) 2013-2014, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <asm/stacktrace.h>
+#include <asm/current.h>
+#include <linux/sched.h>
+#include <linux/module.h>
+#include <linux/smp.h>
+
+#include "skbuff_debug.h"
+#include "skbuff_notifier.h"
+#include "skbuff_recycle.h"
+
+static int skbuff_debugobj_enabled __read_mostly = 1;
+
+static int skbuff_debug_event_handler(struct notifier_block *nb,
+				      unsigned long action, void *data);
+static struct notifier_block skbuff_debug_notify = {
+	.notifier_call = skbuff_debug_event_handler,
+	.priority = 0
+};
+
+inline u32 skbuff_debugobj_sum(struct sk_buff *skb)
+{
+	int pos = offsetof(struct sk_buff, free_addr);
+	u32 sum = 0;
+
+	while (pos--)
+		sum += ((u8 *)skb)[pos];
+
+	return sum;
+}
+
+struct skbuff_debugobj_walking {
+	int pos;
+	void **d;
+};
+
+#ifdef CONFIG_ARM
+static int skbuff_debugobj_walkstack(struct stackframe *frame, void *p) {
+	struct skbuff_debugobj_walking *w = (struct skbuff_debugobj_walking *)p;
+	unsigned long pc = frame->pc;
+
+	if (w->pos < DEBUG_OBJECTS_SKBUFF_STACKSIZE - 1) {
+		w->d[w->pos++] = (void *)pc;
+		return 0;
+	}
+
+	return -ENOENT;
+}
+#else
+static bool skbuff_debugobj_walkstack(void *p, unsigned long pc)
+{
+	struct skbuff_debugobj_walking *w = (struct skbuff_debugobj_walking *)p;
+
+	if (w->pos < DEBUG_OBJECTS_SKBUFF_STACKSIZE - 1) {
+		w->d[w->pos++] = (void *)pc;
+		return true;
+	}
+
+	return false;
+}
+#endif
+
+#if defined(CONFIG_ARM) || defined(CONFIG_ARM64)
+static void skbuff_debugobj_get_stack(void **ret)
+{
+	struct skbuff_debugobj_walking w = {0, ret};
+	void *p = &w;
+
+#ifdef CONFIG_ARM
+	struct stackframe frame;
+	register unsigned long current_sp asm ("sp");
+
+	frame.lr = (unsigned long)__builtin_return_address(0);
+	frame.fp = (unsigned long)__builtin_frame_address(0);
+	frame.sp = current_sp;
+	frame.pc = (unsigned long)skbuff_debugobj_get_stack;
+
+	walk_stackframe(&frame, skbuff_debugobj_walkstack, p);
+#else
+	arch_stack_walk(skbuff_debugobj_walkstack, p, current, NULL);
+#endif
+
+	ret[w.pos] = NULL;
+}
+#else
+#error
+static void skbuff_debugobj_get_stack(void **ret)
+{
+	/* not supported */
+	ret[0] = 0xdeadbeef;
+}
+#endif
+
+void skbuff_debugobj_print_stack(void *const *stack)
+{
+	int i;
+
+	for (i = 0; stack[i]; i++)
+		pr_emerg("\t %pS (0x%p)\n", stack[i], stack[i]);
+}
+
+static const char *skbuff_debugobj_state_name(const struct sk_buff *skb)
+{
+	int obj_state;
+
+	obj_state = debug_object_get_state((struct sk_buff *)skb);
+	switch (obj_state) {
+	case ODEBUG_STATE_NONE:
+		return "none";
+	case ODEBUG_STATE_INIT:
+		return "init";
+	case ODEBUG_STATE_INACTIVE:
+		return "inactive";
+	case ODEBUG_STATE_ACTIVE:
+		return "active";
+	case ODEBUG_STATE_DESTROYED:
+		return "destroyed";
+	case ODEBUG_STATE_NOTAVAILABLE:
+		return "not available";
+	default:
+		return "invalid";
+	}
+}
+
+void skbuff_debugobj_print_skb(const struct sk_buff *skb)
+{
+	pr_emerg("skb_debug: current process = %s (pid %i)\n",
+		 current->comm, current->pid);
+	pr_emerg("skb_debug: skb 0x%p, next 0x%p, prev 0x%p, state = %s\n", skb,
+		 skb->next, skb->prev, skbuff_debugobj_state_name(skb));
+	pr_emerg("skb_debug: free stack:\n");
+	skbuff_debugobj_print_stack(skb->free_addr);
+	pr_emerg("skb_debug: alloc stack:\n");
+	skbuff_debugobj_print_stack(skb->alloc_addr);
+}
+EXPORT_SYMBOL(skbuff_debugobj_print_skb);
+
+/* skbuff_debugobj_fixup():
+ *	Called when an error is detected in the state machine for
+ *	the objects
+ */
+static bool skbuff_debugobj_fixup(void *addr, enum debug_obj_state state)
+{
+	struct sk_buff *skb = (struct sk_buff *)addr;
+	ftrace_dump(DUMP_ALL);
+	WARN(1, "skb_debug: state = %d, skb = 0x%p sum = %d (now %d)\n",
+	     state, skb, skb->sum, skbuff_debugobj_sum(skb));
+	skb_recycler_notifier_send_event(SKB_RECYCLER_NOTIFIER_FSM, skb);
+
+	return true;
+}
+
+static struct debug_obj_descr skbuff_debug_descr = {
+	.name		= "sk_buff_struct",
+	.fixup_init	= skbuff_debugobj_fixup,
+	.fixup_activate	= skbuff_debugobj_fixup,
+	.fixup_destroy	= skbuff_debugobj_fixup,
+	.fixup_free	= skbuff_debugobj_fixup,
+};
+
+inline void skbuff_debugobj_activate(struct sk_buff *skb)
+{
+	int ret = 0;
+
+	if (!skbuff_debugobj_enabled)
+		return;
+
+	skbuff_debugobj_get_stack(skb->alloc_addr);
+	ret = debug_object_activate(skb, &skbuff_debug_descr);
+	if (ret)
+		goto err_act;
+
+	skbuff_debugobj_sum_validate(skb);
+
+	return;
+
+err_act:
+	ftrace_dump(DUMP_ALL);
+	WARN(1, "skb_debug: failed to activate err = %d skb = 0x%p sum = %d (now %d)\n",
+	     ret, skb, skb->sum, skbuff_debugobj_sum(skb));
+	skb_recycler_notifier_send_event(SKB_RECYCLER_NOTIFIER_DBLALLOC, skb);
+}
+
+inline void skbuff_debugobj_init_and_activate(struct sk_buff *skb)
+{
+	if (!skbuff_debugobj_enabled)
+		return;
+
+	/* if we're coming from the slab, the skb->sum might
+	 * be invalid anyways
+	 */
+	skb->sum = skbuff_debugobj_sum(skb);
+
+	debug_object_init(skb, &skbuff_debug_descr);
+	skbuff_debugobj_activate(skb);
+}
+
+inline void skbuff_debugobj_deactivate(struct sk_buff *skb)
+{
+	int obj_state;
+
+	if (!skbuff_debugobj_enabled)
+		return;
+
+	skb->sum = skbuff_debugobj_sum(skb);
+
+	obj_state = debug_object_get_state(skb);
+
+	if (obj_state == ODEBUG_STATE_ACTIVE) {
+		debug_object_deactivate(skb, &skbuff_debug_descr);
+		skbuff_debugobj_get_stack(skb->free_addr);
+		return;
+	}
+
+	ftrace_dump(DUMP_ALL);
+	WARN(1, "skb_debug: deactivating inactive object skb=0x%p state=%d sum = %d (now %d)\n",
+	     skb, obj_state, skb->sum, skbuff_debugobj_sum(skb));
+	skb_recycler_notifier_send_event(SKB_RECYCLER_NOTIFIER_DBLFREE, skb);
+}
+
+inline void _skbuff_debugobj_sum_validate(struct sk_buff *skb,
+					  const char *var, const char *src,
+					  int line, const char *fxn)
+{
+	if (!skbuff_debugobj_enabled || !skb)
+		return;
+
+	if (skb->sum == skbuff_debugobj_sum(skb))
+		return;
+
+	ftrace_dump(DUMP_ALL);
+	WARN(1, "skb_debug: skb sum changed skb = 0x%p sum = %d (now %d)\n",
+	     skb, skb->sum, skbuff_debugobj_sum(skb));
+	pr_emerg("skb_debug: %s() checking %s in %s:%d\n", fxn, var, src, line);
+	skb_recycler_notifier_send_event(SKB_RECYCLER_NOTIFIER_SUMERR, skb);
+}
+
+inline void skbuff_debugobj_sum_update(struct sk_buff *skb)
+{
+	if (!skbuff_debugobj_enabled || !skb)
+		return;
+
+	skb->sum = skbuff_debugobj_sum(skb);
+}
+
+inline void skbuff_debugobj_destroy(struct sk_buff *skb)
+{
+	if (!skbuff_debugobj_enabled)
+		return;
+
+	debug_object_destroy(skb, &skbuff_debug_descr);
+}
+
+static int __init disable_object_debug(char *str)
+{
+	skbuff_debugobj_enabled = 0;
+
+	pr_info("skb_debug: debug objects is disabled\n");
+	return 0;
+}
+
+early_param("no_skbuff_debug_objects", disable_object_debug);
+
+void skbuff_debugobj_print_skb_list(const struct sk_buff *skb_list,
+				    const char *list_title, int cpu)
+{
+	int count;
+	struct sk_buff *skb_i = (struct sk_buff *)skb_list;
+	u32 sum_i, sum_now;
+	int obj_state;
+
+	if (cpu < 0) {
+		cpu = get_cpu();
+		put_cpu();
+	}
+	pr_emerg("skb_debug: start skb list '%s' [CPU#%d]\n", list_title, cpu);
+	count = 0;
+	if (skb_list) {
+		do {
+			obj_state =
+				debug_object_get_state(skb_i);
+			if (obj_state < ODEBUG_STATE_NOTAVAILABLE) {
+				sum_i = skb_i->sum;
+				sum_now = skbuff_debugobj_sum(skb_i);
+			} else {
+				sum_i = 0;
+				sum_now = 0;
+			}
+			if (sum_i != sum_now) {
+				pr_emerg("skb_debug: [%02d] skb 0x%p, next 0x%p, prev 0x%p, state %d (%s), sum %d (now %d)\n",
+					 count, skb_i, skb_i->next, skb_i->prev,
+					 obj_state, skbuff_debugobj_state_name(skb_i),
+					 sum_i, sum_now);
+			}
+			skb_i = skb_i->next;
+			count++;
+		} while (skb_list != skb_i);
+	}
+	pr_emerg("skb_debug: end skb list '%s'. In total %d skbs iterated.\n", list_title, count);
+}
+
+void skbuff_debugobj_register_callback(void)
+{
+	skb_recycler_notifier_register(&skbuff_debug_notify);
+}
+
+int skbuff_debug_event_handler(struct notifier_block *nb, unsigned long action,
+			       void *data)
+{
+	struct sk_buff *skb = (struct sk_buff *)data;
+
+	pr_emerg("skb_debug: notifier event %lu\n", action);
+	skbuff_debugobj_print_skb(skb);
+	skb_recycler_print_all_lists();
+
+	return NOTIFY_DONE;
+}
diff --git a/target/linux/qualcommax/files/net/core/skbuff_debug.h b/target/linux/qualcommax/files/net/core/skbuff_debug.h
new file mode 100644
index 00000000000000..43e37ba43b645e
--- /dev/null
+++ b/target/linux/qualcommax/files/net/core/skbuff_debug.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (c) 2013-2014, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/skbuff.h>
+#include <linux/debugobjects.h>
+
+#ifndef _LINUX_SKBBUFF_DEBUG_OBJECTS
+#define _LINUX_SKBBUFF_DEBUG_OBJECTS
+
+#ifdef CONFIG_DEBUG_OBJECTS_SKBUFF
+void skbuff_debugobj_init_and_activate(struct sk_buff *skb);
+void skbuff_debugobj_activate(struct sk_buff *skb);
+void skbuff_debugobj_deactivate(struct sk_buff *skb);
+void skbuff_debugobj_destroy(struct sk_buff *skb);
+#define skbuff_debugobj_sum_validate(skb) _skbuff_debugobj_sum_validate(skb, \
+		#skb, __FILE__, __LINE__, __func__)
+void _skbuff_debugobj_sum_validate(struct sk_buff *skb, const char *var,
+				   const char *src, int line, const char *fxn);
+void skbuff_debugobj_sum_update(struct sk_buff *skb);
+void skbuff_debugobj_print_skb(const struct sk_buff *skb);
+
+void skbuff_debugobj_print_skb_list(const struct sk_buff *skb_list,
+				    const char *list_title, int cpu);
+void skbuff_debugobj_register_callback(void);
+
+#else
+static inline void skbuff_debugobj_init_and_activate(struct sk_buff *skb) { }
+static inline void skbuff_debugobj_activate(struct sk_buff *skb) { }
+static inline void skbuff_debugobj_deactivate(struct sk_buff *skb) { }
+static inline void skbuff_debugobj_destroy(struct sk_buff *skb) { }
+static inline void skbuff_debugobj_sum_validate(struct sk_buff *skb) { }
+static inline void skbuff_debugobj_sum_update(struct sk_buff *skb) { }
+static inline void skbuff_debugobj_print_skb(const struct sk_buff *skb) { }
+
+static inline void skbuff_debugobj_print_skb_list
+	(const struct sk_buff *skb_list, const char *list_title, int cpu) { }
+static inline void skbuff_debugobj_register_callback(void) { }
+#endif
+
+#endif /* _LINUX_SKBBUFF_DEBUG_OBJECTS */
diff --git a/target/linux/qualcommax/files/net/core/skbuff_notifier.c b/target/linux/qualcommax/files/net/core/skbuff_notifier.c
new file mode 100644
index 00000000000000..8c59476db7fe38
--- /dev/null
+++ b/target/linux/qualcommax/files/net/core/skbuff_notifier.c
@@ -0,0 +1,42 @@
+/*
+ * Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* Notifier interface for the SKB Recycler */
+
+#include "skbuff_notifier.h"
+
+static BLOCKING_NOTIFIER_HEAD(skb_recycler_notifier);
+
+int skb_recycler_notifier_register(struct notifier_block *nb)
+{
+	return blocking_notifier_chain_register(&skb_recycler_notifier, nb);
+}
+EXPORT_SYMBOL(skb_recycler_notifier_register);
+
+int skb_recycler_notifier_unregister(struct notifier_block *nb)
+{
+	return blocking_notifier_chain_unregister(&skb_recycler_notifier, nb);
+}
+EXPORT_SYMBOL(skb_recycler_notifier_unregister);
+
+int skb_recycler_notifier_send_event(unsigned long action, struct sk_buff *skb)
+{
+	int ret;
+
+	ret = blocking_notifier_call_chain(&skb_recycler_notifier, action, skb);
+
+	return 0;
+}
diff --git a/target/linux/qualcommax/files/net/core/skbuff_notifier.h b/target/linux/qualcommax/files/net/core/skbuff_notifier.h
new file mode 100644
index 00000000000000..3d8bfa586fc94b
--- /dev/null
+++ b/target/linux/qualcommax/files/net/core/skbuff_notifier.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef SKBUFF_NOTIFIER_H
+#define SKBUFF_NOTIFIER_H
+
+#include <linux/notifier.h>
+#include <linux/skbuff.h>
+
+/* notifier events */
+#define SKB_RECYCLER_NOTIFIER_SUMERR   0x0001
+#define SKB_RECYCLER_NOTIFIER_DBLFREE  0x0002
+#define SKB_RECYCLER_NOTIFIER_DBLALLOC 0x0004
+#define SKB_RECYCLER_NOTIFIER_FSM      0x0008
+
+#if defined(CONFIG_DEBUG_OBJECTS_SKBUFF)
+int skb_recycler_notifier_register(struct notifier_block *nb);
+int skb_recycler_notifier_unregister(struct notifier_block *nb);
+int skb_recycler_notifier_send_event(unsigned long action,
+				     struct sk_buff *skb);
+#else
+static inline int skb_recycler_notifier_register(struct notifier_block *nb)
+{
+	return 0;
+}
+
+static inline int skb_recycler_notifier_unregister(struct notifier_block *nb)
+{
+	return 0;
+}
+
+static inline int skb_recycler_notifier_send_event(unsigned long action,
+						   struct sk_buff *skb)
+{
+	return 1;
+}
+#endif /* CONFIG_DEBUG_OBJECTS_SKBUFF */
+
+#endif /* SKBUFF_NOTIFIER_H */
diff --git a/target/linux/qualcommax/files/net/core/skbuff_recycle.c b/target/linux/qualcommax/files/net/core/skbuff_recycle.c
new file mode 100644
index 00000000000000..41add8d3098fca
--- /dev/null
+++ b/target/linux/qualcommax/files/net/core/skbuff_recycle.c
@@ -0,0 +1,729 @@
+/*
+ * Copyright (c) 2013-2016, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+/* Generic skb recycler */
+
+#include "skbuff_recycle.h"
+#include <linux/proc_fs.h>
+#include <linux/string.h>
+
+#include "skbuff_debug.h"
+
+static struct proc_dir_entry *proc_net_skbrecycler;
+
+static DEFINE_PER_CPU(struct sk_buff_head, recycle_list);
+static int skb_recycle_max_skbs = SKB_RECYCLE_MAX_SKBS;
+
+#ifdef CONFIG_SKB_RECYCLER_MULTI_CPU
+static DEFINE_PER_CPU(struct sk_buff_head, recycle_spare_list);
+static struct global_recycler glob_recycler;
+static int skb_recycle_spare_max_skbs = SKB_RECYCLE_SPARE_MAX_SKBS;
+#endif
+
+inline struct sk_buff *skb_recycler_alloc(struct net_device *dev,
+					  unsigned int length)
+{
+	unsigned long flags;
+	struct sk_buff_head *h;
+	struct sk_buff *skb = NULL;
+	struct sk_buff *ln = NULL;
+
+	if (unlikely(length > SKB_RECYCLE_SIZE))
+		return NULL;
+
+	h = &get_cpu_var(recycle_list);
+	local_irq_save(flags);
+	skb = skb_peek(h);
+	if (skb) {
+		ln = skb_peek_next(skb, h);
+		skbuff_debugobj_activate(skb);
+		/* Recalculate the sum for skb->next as next and prev pointers
+		 * of skb->next will be updated in __skb_unlink
+		 */
+		skbuff_debugobj_sum_validate(ln);
+		__skb_unlink(skb, h);
+		skbuff_debugobj_sum_update(ln);
+	}
+#ifdef CONFIG_SKB_RECYCLER_MULTI_CPU
+	if (unlikely(!skb)) {
+		u8 head;
+
+		spin_lock(&glob_recycler.lock);
+		/* If global recycle list is not empty, use global buffers */
+		head = glob_recycler.head;
+		if (unlikely(head == glob_recycler.tail)) {
+			spin_unlock(&glob_recycler.lock);
+		} else {
+			struct sk_buff *gn = glob_recycler.pool[head].next;
+			struct sk_buff *gp = glob_recycler.pool[head].prev;
+
+			/* Move SKBs from global list to CPU pool */
+			skbuff_debugobj_sum_validate(gn);
+			skbuff_debugobj_sum_validate(gp);
+			skb_queue_splice_init(&glob_recycler.pool[head], h);
+			skbuff_debugobj_sum_update(gn);
+			skbuff_debugobj_sum_update(gp);
+
+			head = (head + 1) & SKB_RECYCLE_MAX_SHARED_POOLS_MASK;
+			glob_recycler.head = head;
+			spin_unlock(&glob_recycler.lock);
+			/* We have refilled the CPU pool - dequeue */
+			skb = skb_peek(h);
+			if (skb) {
+				/* Recalculate the sum for skb->next as next and
+				 * prev pointers of skb->next will be updated
+				 * in __skb_unlink
+				 */
+				ln = skb_peek_next(skb, h);
+				skbuff_debugobj_activate(skb);
+				skbuff_debugobj_sum_validate(ln);
+				__skb_unlink(skb, h);
+				skbuff_debugobj_sum_update(ln);
+			}
+		}
+	}
+#endif
+	local_irq_restore(flags);
+	put_cpu_var(recycle_list);
+
+	if (likely(skb)) {
+		struct skb_shared_info *shinfo;
+
+		/* We're about to write a large amount to the skb to
+		 * zero most of the structure so prefetch the start
+		 * of the shinfo region now so it's in the D-cache
+		 * before we start to write that.
+		 */
+		shinfo = skb_shinfo(skb);
+		prefetchw(shinfo);
+
+		zero_struct(skb, offsetof(struct sk_buff, tail));
+		refcount_set(&skb->users, 1);
+		skb->mac_header = (typeof(skb->mac_header))~0U;
+		skb->transport_header = (typeof(skb->transport_header))~0U;
+		zero_struct(shinfo, offsetof(struct skb_shared_info, dataref));
+		atomic_set(&shinfo->dataref, 1);
+
+		skb->data = skb->head + NET_SKB_PAD;
+		skb_reset_tail_pointer(skb);
+
+		skb->dev = dev;
+	}
+
+	return skb;
+}
+
+inline bool skb_recycler_consume(struct sk_buff *skb)
+{
+	unsigned long flags;
+	struct sk_buff_head *h;
+	struct sk_buff *ln = NULL;
+	/* Can we recycle this skb?  If not, simply return that we cannot */
+	if (unlikely(!consume_skb_can_recycle(skb, SKB_RECYCLE_MIN_SIZE,
+					      SKB_RECYCLE_MAX_SIZE)))
+		return false;
+
+	/* If we can, then it will be much faster for us to recycle this one
+	 * later than to allocate a new one from scratch.
+	 */
+	h = &get_cpu_var(recycle_list);
+	local_irq_save(flags);
+	/* Attempt to enqueue the CPU hot recycle list first */
+	if (likely(skb_queue_len(h) < skb_recycle_max_skbs)) {
+		ln = skb_peek(h);
+		/* Recalculate the sum for peek of list as next and prev
+		 * pointers of skb->next will be updated in __skb_queue_head
+		 */
+		skbuff_debugobj_sum_validate(ln);
+		__skb_queue_head(h, skb);
+		skbuff_debugobj_deactivate(skb);
+		skbuff_debugobj_sum_update(ln);
+		local_irq_restore(flags);
+		preempt_enable();
+		return true;
+	}
+#ifdef CONFIG_SKB_RECYCLER_MULTI_CPU
+	h = this_cpu_ptr(&recycle_spare_list);
+
+	/* The CPU hot recycle list was full; if the spare list is also full,
+	 * attempt to move the spare list to the global list for other CPUs to
+	 * use.
+	 */
+	if (unlikely(skb_queue_len(h) >= skb_recycle_spare_max_skbs)) {
+		u8 cur_tail, next_tail;
+
+		spin_lock(&glob_recycler.lock);
+		cur_tail = glob_recycler.tail;
+		next_tail = (cur_tail + 1) & SKB_RECYCLE_MAX_SHARED_POOLS_MASK;
+		if (next_tail != glob_recycler.head) {
+			struct sk_buff_head *p = &glob_recycler.pool[cur_tail];
+			struct sk_buff *hn = h->next, *hp = h->prev;
+
+			/* Move SKBs from CPU pool to Global pool*/
+			skbuff_debugobj_sum_validate(hp);
+			skbuff_debugobj_sum_validate(hn);
+			skb_queue_splice_init(h, p);
+			skbuff_debugobj_sum_update(hp);
+			skbuff_debugobj_sum_update(hn);
+
+			/* Done with global list init */
+			glob_recycler.tail = next_tail;
+			spin_unlock(&glob_recycler.lock);
+
+			/* Recalculate the sum for peek of list as next and prev
+			 * pointers of skb->next will be updated in
+			 * __skb_queue_head
+			 */
+			ln = skb_peek(h);
+			skbuff_debugobj_sum_validate(ln);
+			/* We have now cleared room in the spare;
+			 * Initialize and enqueue skb into spare
+			 */
+			__skb_queue_head(h, skb);
+			skbuff_debugobj_sum_update(ln);
+			skbuff_debugobj_deactivate(skb);
+
+			local_irq_restore(flags);
+			preempt_enable();
+			return true;
+		}
+		/* We still have a full spare because the global is also full */
+		spin_unlock(&glob_recycler.lock);
+	} else {
+		/* We have room in the spare list; enqueue to spare list */
+		ln = skb_peek(h);
+		/* Recalculate the sum for peek of list as next and prev
+		 * pointers of skb->next will be updated in __skb_queue_head
+		 */
+		skbuff_debugobj_sum_validate(ln);
+		__skb_queue_head(h, skb);
+		skbuff_debugobj_deactivate(skb);
+		skbuff_debugobj_sum_update(ln);
+		local_irq_restore(flags);
+		preempt_enable();
+		return true;
+	}
+#endif
+
+	local_irq_restore(flags);
+	preempt_enable();
+
+	return false;
+}
+
+/**
+ *	skb_recycler_consume_list_fast - free a list of skbs
+ *	@skb_list: head of the buffer list
+ *
+ *	Add the list of given SKBs to CPU list. Assumption is that these buffers
+ *	have been allocated originally from recycler and have been transmitted through
+ *	a controlled fast xmit path, thus removing the need for additional checks
+ *	before recycling the buffers back to pool
+ */
+#ifdef CONFIG_DEBUG_OBJECTS_SKBUFF
+inline bool skb_recycler_consume_list_fast(struct sk_buff_head *skb_list)
+{
+	struct sk_buff *skb = NULL, *next = NULL;
+
+	skb_queue_walk_safe(skb_list, skb, next) {
+		if (skb) {
+			__skb_unlink(skb, skb_list);
+			skb_recycler_consume(skb);
+		}
+	}
+
+	return true;
+}
+#else
+inline bool skb_recycler_consume_list_fast(struct sk_buff_head *skb_list)
+{
+	unsigned long flags;
+	struct sk_buff_head *h;
+
+	h = &get_cpu_var(recycle_list);
+	local_irq_save(flags);
+	/* Attempt to enqueue the CPU hot recycle list first */
+	if (likely(skb_queue_len(h) < skb_recycle_max_skbs)) {
+		skb_queue_splice(skb_list,h);
+		local_irq_restore(flags);
+		preempt_enable();
+		return true;
+	}
+
+	local_irq_restore(flags);
+	preempt_enable();
+
+	return false;
+}
+#endif
+
+static void skb_recycler_free_skb(struct sk_buff_head *list)
+{
+	struct sk_buff *skb = NULL, *next = NULL;
+	unsigned long flags;
+
+	spin_lock_irqsave(&list->lock, flags);
+	while ((skb = skb_peek(list)) != NULL) {
+		skbuff_debugobj_activate(skb);
+		next = skb->next;
+		__skb_unlink(skb, list);
+		skb_release_data(skb);
+		kfree_skbmem(skb);
+		/*
+		 * Update the skb->sum for next due to skb_link operation
+		 */
+		if (next) {
+			skbuff_debugobj_sum_update(next);
+		}
+	}
+	spin_unlock_irqrestore(&list->lock, flags);
+}
+
+static int skb_cpu_callback(unsigned int ocpu)
+{
+	unsigned long oldcpu = (unsigned long)ocpu;
+
+	skb_recycler_free_skb(&per_cpu(recycle_list, oldcpu));
+#ifdef CONFIG_SKB_RECYCLER_MULTI_CPU
+	spin_lock(&glob_recycler.lock);
+	skb_recycler_free_skb(&per_cpu(recycle_spare_list, oldcpu));
+	spin_unlock(&glob_recycler.lock);
+#endif
+
+	return NOTIFY_DONE;
+}
+
+#ifdef CONFIG_SKB_RECYCLER_PREALLOC
+static int __init skb_prealloc_init_list(void)
+{
+	int i;
+	struct sk_buff *skb;
+
+	for (i = 0; i < SKB_RECYCLE_MAX_PREALLOC_SKBS; i++) {
+		skb = __alloc_skb(SKB_RECYCLE_MAX_SIZE + NET_SKB_PAD,
+				  GFP_KERNEL, 0, NUMA_NO_NODE);
+		if (unlikely(!skb))
+			return -ENOMEM;
+
+		skb_reserve(skb, NET_SKB_PAD);
+
+		skb_recycler_consume(skb);
+	}
+	return 0;
+}
+#endif
+
+/* procfs: count
+ * Show skb counts
+ */
+static int proc_skb_count_show(struct seq_file *seq, void *v)
+{
+	int cpu;
+	int len;
+	int total;
+#ifdef CONFIG_SKB_RECYCLER_MULTI_CPU
+	unsigned int i;
+	unsigned long flags;
+#endif
+
+	total = 0;
+
+	for_each_online_cpu(cpu) {
+		len = skb_queue_len(&per_cpu(recycle_list, cpu));
+		seq_printf(seq, "recycle_list[%d]: %d\n", cpu, len);
+		total += len;
+	}
+
+#ifdef CONFIG_SKB_RECYCLER_MULTI_CPU
+	for_each_online_cpu(cpu) {
+		len = skb_queue_len(&per_cpu(recycle_spare_list, cpu));
+		seq_printf(seq, "recycle_spare_list[%d]: %d\n", cpu, len);
+		total += len;
+	}
+
+	for (i = 0; i < SKB_RECYCLE_MAX_SHARED_POOLS; i++) {
+		spin_lock_irqsave(&glob_recycler.lock, flags);
+		len = skb_queue_len(&glob_recycler.pool[i]);
+		spin_unlock_irqrestore(&glob_recycler.lock, flags);
+		seq_printf(seq, "global_list[%d]: %d\n", i, len);
+		total += len;
+	}
+#endif
+
+	seq_printf(seq, "total: %d\n", total);
+	return 0;
+}
+
+static int proc_skb_count_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, proc_skb_count_show, pde_data(inode));
+}
+
+static const struct proc_ops proc_skb_count_fops = {
+	.proc_open    = proc_skb_count_open,
+	.proc_read    = seq_read,
+	.proc_lseek  = seq_lseek,
+	.proc_release = single_release,
+};
+
+/* procfs: flush
+ * Flush skbs
+ */
+static void skb_recycler_flush_task(struct work_struct *work)
+{
+	unsigned long flags;
+	struct sk_buff_head *h;
+	struct sk_buff_head tmp;
+	struct sk_buff *skb = NULL;
+
+	skb_queue_head_init(&tmp);
+
+	h = &get_cpu_var(recycle_list);
+	local_irq_save(flags);
+	skb_queue_splice_init(h, &tmp);
+	/*
+	 * Update the sum for first skb present in tmp list.
+	 * Since the skb is changed in splice init
+	 */
+	skb = skb_peek(&tmp);
+	skbuff_debugobj_sum_update(skb);
+	local_irq_restore(flags);
+	put_cpu_var(recycle_list);
+	skb_recycler_free_skb(&tmp);
+
+#ifdef CONFIG_SKB_RECYCLER_MULTI_CPU
+	h = &get_cpu_var(recycle_spare_list);
+	local_irq_save(flags);
+	skb_queue_splice_init(h, &tmp);
+	skb = skb_peek(&tmp);
+	skbuff_debugobj_sum_update(skb);
+	local_irq_restore(flags);
+	put_cpu_var(recycle_spare_list);
+	skb_recycler_free_skb(&tmp);
+#endif
+}
+
+static ssize_t proc_skb_flush_write(struct file *file,
+				    const char __user *buf,
+				    size_t count,
+				    loff_t *ppos)
+{
+#ifdef CONFIG_SKB_RECYCLER_MULTI_CPU
+	unsigned int i;
+	unsigned long flags;
+#endif
+	schedule_on_each_cpu(&skb_recycler_flush_task);
+
+#ifdef CONFIG_SKB_RECYCLER_MULTI_CPU
+	spin_lock_irqsave(&glob_recycler.lock, flags);
+	for (i = 0; i < SKB_RECYCLE_MAX_SHARED_POOLS; i++)
+		skb_recycler_free_skb(&glob_recycler.pool[i]);
+	glob_recycler.head = 0;
+	glob_recycler.tail = 0;
+	spin_unlock_irqrestore(&glob_recycler.lock, flags);
+#endif
+	return count;
+}
+
+static const struct proc_ops proc_skb_flush_fops = {
+	.proc_write   = proc_skb_flush_write,
+	.proc_open    = simple_open,
+	.proc_lseek  = noop_llseek,
+};
+
+/* procfs: max_skbs
+ * Show max skbs
+ */
+static int proc_skb_max_skbs_show(struct seq_file *seq, void *v)
+{
+	seq_printf(seq, "%d\n", skb_recycle_max_skbs);
+	return 0;
+}
+
+static int proc_skb_max_skbs_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, proc_skb_max_skbs_show, pde_data(inode));
+}
+
+static ssize_t proc_skb_max_skbs_write(struct file *file,
+				       const char __user *buf,
+				       size_t count,
+				       loff_t *ppos)
+{
+	int ret;
+	int max;
+	char buffer[13];
+
+	memset(buffer, 0, sizeof(buffer));
+	if (count > sizeof(buffer) - 1)
+		count = sizeof(buffer) - 1;
+	if (copy_from_user(buffer, buf, count) != 0)
+		return -EFAULT;
+	ret = kstrtoint(strstrip(buffer), 10, &max);
+	if (ret == 0 && max >= 0)
+		skb_recycle_max_skbs = max;
+
+	return count;
+}
+
+static const struct proc_ops proc_skb_max_skbs_fops = {
+	.proc_open    = proc_skb_max_skbs_open,
+	.proc_read    = seq_read,
+	.proc_write   = proc_skb_max_skbs_write,
+	.proc_release = single_release,
+};
+
+#ifdef CONFIG_SKB_RECYCLER_MULTI_CPU
+/* procfs: max_spare_skbs
+ * Show max spare skbs
+ */
+static int proc_skb_max_spare_skbs_show(struct seq_file *seq, void *v)
+{
+	seq_printf(seq, "%d\n", skb_recycle_spare_max_skbs);
+	return 0;
+}
+
+static int proc_skb_max_spare_skbs_open(struct inode *inode, struct file *file)
+{
+	return single_open(file,
+			   proc_skb_max_spare_skbs_show,
+			   pde_data(inode));
+}
+
+static ssize_t
+proc_skb_max_spare_skbs_write(struct file *file,
+			      const char __user *buf,
+			      size_t count,
+			      loff_t *ppos)
+{
+	int ret;
+	int max;
+	char buffer[13];
+
+	memset(buffer, 0, sizeof(buffer));
+	if (count > sizeof(buffer) - 1)
+		count = sizeof(buffer) - 1;
+	if (copy_from_user(buffer, buf, count) != 0)
+		return -EFAULT;
+	ret = kstrtoint(strstrip(buffer), 10, &max);
+	if (ret == 0 && max >= 0)
+		skb_recycle_spare_max_skbs = max;
+
+	return count;
+}
+
+static const struct proc_ops proc_skb_max_spare_skbs_fops = {
+	.proc_open    = proc_skb_max_spare_skbs_open,
+	.proc_read    = seq_read,
+	.proc_write   = proc_skb_max_spare_skbs_write,
+	.proc_release = single_release,
+};
+#endif /* CONFIG_SKB_RECYCLER_MULTI_CPU */
+
+static void skb_recycler_init_procfs(void)
+{
+	proc_net_skbrecycler = proc_mkdir("skb_recycler", init_net.proc_net);
+	if (!proc_net_skbrecycler) {
+		pr_err("cannot create skb_recycle proc dir");
+		return;
+	}
+
+	if (!proc_create("count",
+			 S_IRUGO,
+			 proc_net_skbrecycler,
+			 &proc_skb_count_fops))
+		pr_err("cannot create proc net skb_recycle held\n");
+
+	if (!proc_create("flush",
+			 S_IWUGO,
+			 proc_net_skbrecycler,
+			 &proc_skb_flush_fops))
+		pr_err("cannot create proc net skb_recycle flush\n");
+
+	if (!proc_create("max_skbs",
+			 S_IRUGO | S_IWUGO,
+			 proc_net_skbrecycler,
+			 &proc_skb_max_skbs_fops))
+		pr_err("cannot create proc net skb_recycle max_skbs\n");
+
+#ifdef CONFIG_SKB_RECYCLER_MULTI_CPU
+	if (!proc_create("max_spare_skbs",
+			 S_IRUGO | S_IWUGO,
+			 proc_net_skbrecycler,
+			 &proc_skb_max_spare_skbs_fops))
+		pr_err("cannot create proc net skb_recycle max_spare_skbs\n");
+#endif
+}
+
+void __init skb_recycler_init(void)
+{
+	int cpu;
+#ifdef CONFIG_SKB_RECYCLER_MULTI_CPU
+	unsigned int i;
+#endif
+
+	for_each_possible_cpu(cpu) {
+		skb_queue_head_init(&per_cpu(recycle_list, cpu));
+	}
+
+#ifdef CONFIG_SKB_RECYCLER_MULTI_CPU
+	for_each_possible_cpu(cpu) {
+		skb_queue_head_init(&per_cpu(recycle_spare_list, cpu));
+	}
+
+	spin_lock_init(&glob_recycler.lock);
+
+	for (i = 0; i < SKB_RECYCLE_MAX_SHARED_POOLS; i++)
+		skb_queue_head_init(&glob_recycler.pool[i]);
+	glob_recycler.head = 0;
+	glob_recycler.tail = 0;
+#endif
+
+#ifdef CONFIG_SKB_RECYCLER_PREALLOC
+	if (skb_prealloc_init_list())
+		pr_err("Failed to preallocate SKBs for recycle list\n");
+#endif
+	cpuhp_setup_state_nocalls(CPUHP_SKB_RECYCLER_DEAD, "net/skbuff_recycler:dead:",NULL, skb_cpu_callback);
+	skbuff_debugobj_register_callback();
+	skb_recycler_init_procfs();
+}
+
+void skb_recycler_print_all_lists(void)
+{
+	unsigned long flags;
+	int cpu;
+#ifdef CONFIG_SKB_RECYCLER_MULTI_CPU
+	int i;
+	struct sk_buff_head *h;
+
+	cpu = get_cpu();
+	spin_lock_irqsave(&glob_recycler.lock, flags);
+	for (i = 0; i < SKB_RECYCLE_MAX_SHARED_POOLS; i++)
+		skbuff_debugobj_print_skb_list((&glob_recycler.pool[i])->next,
+					       "Global Pool", -1);
+	spin_unlock_irqrestore(&glob_recycler.lock, flags);
+
+	preempt_disable();
+	local_irq_save(flags);
+
+	h = &per_cpu(recycle_spare_list, cpu);
+	skbuff_debugobj_print_skb_list(h->next, "Recycle Spare", cpu);
+
+	local_irq_restore(flags);
+	preempt_enable();
+#endif
+
+	preempt_disable();
+	local_irq_save(flags);
+	h = &per_cpu(recycle_list, cpu);
+	skbuff_debugobj_print_skb_list(h->next, "Recycle List", cpu);
+
+	local_irq_restore(flags);
+	preempt_enable();
+}
+
+#ifdef SKB_FAST_RECYCLABLE_DEBUG_ENABLE
+/**
+ *	consume_skb_can_fast_recycle_debug - Debug API to flag any sanity check
+ *      				     failures on a fast recycled skb
+ *	@skb: buffer to be checked
+ *	@min_skb_size: minimum skb size allowed
+ *	@max_skb_size: maximum skb size allowed
+ *
+ *	Returns false with warning message if any of the checks fail
+ */
+static inline bool consume_skb_can_fast_recycle_debug(const struct sk_buff *skb,
+		int min_skb_size, int max_skb_size)
+{
+	if (unlikely(irqs_disabled())) {
+		WARN(1, "skb_debug: irqs_disabled for skb = 0x%p \n", skb);
+		return false;
+	}
+	if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_DEV_ZEROCOPY)) {
+		WARN(1, "skb_debug: ZEROCOPY flag set for skb = 0x%p \n", skb);
+		return false;
+	}
+	if (unlikely(skb_is_nonlinear(skb))) {
+		WARN(1, "skb_debug: non-linear skb = 0x%p \n", skb);
+		return false;
+	}
+	if (unlikely(skb_shinfo(skb)->frag_list)) {
+		WARN(1, "skb_debug: set frag_list for skb = 0x%p \n", skb);
+		return false;
+	}
+	if (unlikely(skb_shinfo(skb)->nr_frags)) {
+		WARN(1, "skb_debug: set nr_frags for skb = 0x%p \n", skb);
+		return false;
+	}
+	if (unlikely(skb->fclone != SKB_FCLONE_UNAVAILABLE)) {
+		WARN(1, "skb_debug: FCLONE available for skb = 0x%p \n", skb);
+		return false;
+	}
+	min_skb_size = SKB_DATA_ALIGN(min_skb_size + NET_SKB_PAD);
+	if (unlikely(skb_end_pointer(skb) - skb->head < min_skb_size)) {
+		WARN(1, "skb_debug: invalid min size for skb = 0x%p \n", skb);
+		return false;
+	}
+	max_skb_size = SKB_DATA_ALIGN(max_skb_size + NET_SKB_PAD);
+	if (unlikely(skb_end_pointer(skb) - skb->head > max_skb_size)) {
+		WARN(1, "skb_debug: invalid max size for skb = 0x%p \n", skb);
+		return false;
+	}
+	if (unlikely(skb_cloned(skb))) {
+		WARN(1, "skb_debug: cloned skb = 0x%p \n", skb);
+		return false;
+	}
+	if (unlikely(skb_pfmemalloc(skb))) {
+		WARN(1, "skb_debug: enabled pfmemalloc for skb = 0x%p \n", skb);
+		return false;
+	}
+	if (skb->_skb_refdst) {
+		WARN(1, "skb_debug: _skb_refdst flag enabled = 0x%p \n", skb);
+		return false;
+	}
+	if (skb->destructor) {
+		WARN(1, "skb_debug: destructor flag enabled = 0x%p \n", skb);
+		return false;
+	}
+	if (skb->active_extensions) {
+		WARN(1, "skb_debug: active_extensions flag enabled = 0x%p \n",
+		     skb);
+		return false;
+	}
+#if IS_ENABLED(CONFIG_NF_CONNTRACK)
+	if (skb->_nfct & NFCT_PTRMASK) {
+		WARN(1, "skb_debug: nfctinfo bits set for skb = 0x%p \n", skb);
+		return false;
+	}
+#endif
+	return true;
+}
+
+/**
+ *      check_skb_fast_recyclable - Debug API to flag any sanity check failures
+ *      			    on a fast recycled skb
+ *      @skb: buffer to be checked
+ *
+ *      Checks skb recyclability
+ */
+void check_skb_fast_recyclable(struct sk_buff *skb)
+{
+	bool check = true;
+	check = consume_skb_can_fast_recycle_debug(skb, SKB_RECYCLE_MIN_SIZE, SKB_RECYCLE_MAX_SIZE);
+	if (!check)
+		BUG_ON(1);
+}
+EXPORT_SYMBOL(check_skb_fast_recyclable);
+#endif
diff --git a/target/linux/qualcommax/files/net/core/skbuff_recycle.h b/target/linux/qualcommax/files/net/core/skbuff_recycle.h
new file mode 100644
index 00000000000000..cbbc3ee1f0d6ee
--- /dev/null
+++ b/target/linux/qualcommax/files/net/core/skbuff_recycle.h
@@ -0,0 +1,178 @@
+/*
+ * Copyright (c) 2013-2017, The Linux Foundation. All rights reserved.
+ *
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ */
+/* Definitions for the skb recycler functions */
+
+#ifndef _LINUX_SKBUFF_RECYCLE_H
+#define _LINUX_SKBUFF_RECYCLE_H
+
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/cpu.h>
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/interrupt.h>
+#include <linux/in.h>
+#include <linux/inet.h>
+#include <linux/slab.h>
+#include <linux/netdevice.h>
+#ifdef CONFIG_NET_CLS_ACT
+#include <net/pkt_sched.h>
+#endif
+#include <linux/string.h>
+#include <linux/skbuff.h>
+#include <linux/splice.h>
+#include <linux/init.h>
+#include <linux/prefetch.h>
+#include <linux/if.h>
+
+#define SKB_RECYCLE_SIZE	2304
+#define SKB_RECYCLE_MIN_SIZE	SKB_RECYCLE_SIZE
+#define SKB_RECYCLE_MAX_SIZE	SKB_RECYCLE_SIZE
+#define SKB_RECYCLE_MAX_SKBS	1024
+
+#define SKB_RECYCLE_SPARE_MAX_SKBS		256
+
+#ifdef CONFIG_SKB_RECYCLER_PREALLOC
+#define SKB_RECYCLE_MAX_PREALLOC_SKBS CONFIG_SKB_RECYCLE_MAX_PREALLOC_SKBS
+#define SKB_RECYCLE_MAX_SHARED_POOLS \
+	DIV_ROUND_UP(SKB_RECYCLE_MAX_PREALLOC_SKBS, \
+			SKB_RECYCLE_SPARE_MAX_SKBS)
+#else
+#define SKB_RECYCLE_MAX_SHARED_POOLS            8
+#endif
+
+#define SKB_RECYCLE_MAX_SHARED_POOLS_MASK \
+	(SKB_RECYCLE_MAX_SHARED_POOLS - 1)
+
+#ifdef CONFIG_SKB_RECYCLER_MULTI_CPU
+struct global_recycler {
+	/* Global circular list which holds the shared skb pools */
+	struct sk_buff_head pool[SKB_RECYCLE_MAX_SHARED_POOLS];
+	u8 head;		/* head of the circular list */
+	u8 tail;		/* tail of the circular list */
+	spinlock_t lock;
+};
+#endif
+
+static __always_inline void zero_struct(void *v, int size)
+{
+	u32 *s = (u32 *)v;
+
+	/* We assume that size is word aligned; in fact, it's constant */
+	WARN_ON((size & 3) != 0);
+
+	/* This looks odd but we "know" size is a constant, and so the
+	 * compiler can fold away all of the conditionals.  The compiler is
+	 * pretty smart here, and can fold away the loop, too!
+	 */
+	while (size > 0) {
+		if (size >= 4)
+			s[0] = 0;
+		if (size >= 8)
+			s[1] = 0;
+		if (size >= 12)
+			s[2] = 0;
+		if (size >= 16)
+			s[3] = 0;
+		if (size >= 20)
+			s[4] = 0;
+		if (size >= 24)
+			s[5] = 0;
+		if (size >= 28)
+			s[6] = 0;
+		if (size >= 32)
+			s[7] = 0;
+		if (size >= 36)
+			s[8] = 0;
+		if (size >= 40)
+			s[9] = 0;
+		if (size >= 44)
+			s[10] = 0;
+		if (size >= 48)
+			s[11] = 0;
+		if (size >= 52)
+			s[12] = 0;
+		if (size >= 56)
+			s[13] = 0;
+		if (size >= 60)
+			s[14] = 0;
+		if (size >= 64)
+			s[15] = 0;
+		size -= 64;
+		s += 16;
+	}
+}
+
+static inline bool consume_skb_can_recycle(const struct sk_buff *skb,
+					   int min_skb_size, int max_skb_size)
+{
+	if (unlikely(irqs_disabled()))
+		return false;
+
+	if (unlikely(skb_shinfo(skb)->tx_flags & SKBFL_ZEROCOPY_ENABLE))
+		return false;
+
+	if (unlikely(skb->head_frag))
+		return false;
+
+	if (unlikely(skb_is_nonlinear(skb)))
+		return false;
+
+	if (unlikely(skb_shinfo(skb)->frag_list))
+		return false;
+
+	if (unlikely(skb_shinfo(skb)->nr_frags))
+		return false;
+
+	if (unlikely(skb->fclone != SKB_FCLONE_UNAVAILABLE))
+		return false;
+
+	min_skb_size = SKB_DATA_ALIGN(min_skb_size + NET_SKB_PAD);
+	if (unlikely(skb_end_pointer(skb) - skb->head < min_skb_size))
+		return false;
+
+	max_skb_size = SKB_DATA_ALIGN(max_skb_size + NET_SKB_PAD);
+	if (unlikely(skb_end_pointer(skb) - skb->head > max_skb_size))
+		return false;
+
+	if (unlikely(skb_cloned(skb)))
+		return false;
+
+	if (unlikely(skb_pfmemalloc(skb)))
+		return false;
+
+	return true;
+}
+
+#ifdef CONFIG_SKB_RECYCLER
+void __init skb_recycler_init(void);
+struct sk_buff *skb_recycler_alloc(struct net_device *dev, unsigned int length);
+bool skb_recycler_consume(struct sk_buff *skb);
+bool skb_recycler_consume_list_fast(struct sk_buff_head *skb_list);
+void skb_recycler_print_all_lists(void);
+#else
+#define skb_recycler_init()  {}
+#define skb_recycler_alloc(dev, len) NULL
+#define skb_recycler_consume(skb) false
+#define skb_recycler_consume_list_fast(skb_list) false
+#define skb_recycler_print_all_lists() false
+#endif
+#endif

From a71c19c8eb02ec8e48d89b37aa2cc403f5e27237 Mon Sep 17 00:00:00 2001
From: Qosmio <datapronix@protonmail.com>
Date: Sun, 24 Mar 2024 23:20:41 -0400
Subject: [PATCH 094/225] ath11k_nss: set pbuf to 'auto'

Since SKB recycler was merged into main nss-wifi branch, it is not
necessary to manually tinker with pbuf script. Memory is now properly
managed between NSS driver allocating/deallocating SKBs. For optimal
wifi performance, especially upload, it is advised to leave the script
to 'auto'.

Users who use sysupgrade should manually set the uci config
'/etc/config/pbuf' as it will not overwrite existing configuration.
---
 package/kernel/mac80211/files/pbuf.uci | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/kernel/mac80211/files/pbuf.uci b/package/kernel/mac80211/files/pbuf.uci
index 2b277e11f02f4d..4e01048e9bee0e 100644
--- a/package/kernel/mac80211/files/pbuf.uci
+++ b/package/kernel/mac80211/files/pbuf.uci
@@ -1,6 +1,6 @@
 config general opt
-  option memory_profile 'off'
-  # option memory_profile 'auto'
+  # option memory_profile 'off'
+  option memory_profile 'auto'
   # option memory_profile '1gb'
   # option memory_profile '512mb'
   # option memory_profile '256mb'

From acb446f35516814d585fbc4d99695a86944a1834 Mon Sep 17 00:00:00 2001
From: Qosmio <datapronix@protonmail.com>
Date: Mon, 25 Mar 2024 13:31:04 -0400
Subject: [PATCH 095/225] ath11k_nss: refresh and fixup patches

---
 package/kernel/mac80211/Makefile              |   6 +-
 ...91-ath11k-add-mgmt-and-data-ack-rssi.patch |   2 +-
 .../199-003-ath11k-add-nss-support.patch      |   4 +-
 ...-ath11k-Add-support-for-dynamic-vlan.patch |   2 +-
 ...pport-for-WDS-offload-in-NSS-offload.patch |  28 ++---
 ...-dynamic-VLAN-support-in-NSS-offload.patch |  36 +++---
 ...ow-fast-rx-by-bypassing-stats-update.patch |   2 +-
 .../nss/ath11k/244-ath11k-dp-tx-perf.patch    |   4 +-
 .../patches/nss/ath11k/270-iphone-issue.patch |   2 +-
 .../300-ath11k-nss-mesh-offload-support.patch |   8 +-
 ...lookup-failure-in-mgmt-tx-completion.patch |   2 +-
 ...30-ath11k-sync-wds_ast_entry-updates.patch |   4 +-
 ...TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch |   2 +-
 ...rt-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch |   2 +-
 ...-fix-clear-peer-keys-during-disassoc.patch |   4 +-
 ...ix-mutex-dead-lock-and-q6-dump-crash.patch |   4 +-
 ...agement-frames-to-firmware-before-wa.patch |   7 +-
 ...oid-memset-of-ppdu-info-for-next-skb.patch |   6 +-
 ...a_map_single-to-virt_to_phys-in-rx-r.patch |   4 +-
 ...11k-remove-invalid-peer-create-logic.patch |   4 +-
 ...th11k-rename-ath11k_start_vdev_delay.patch |   6 +-
 ...ation-of-ath11k_mac_start_vdev_delay.patch |   8 +-
 ...ailure-due-to-unexpected-peer-delete.patch |  14 +--
 ...k-make-debugfs-sta-htt-stats-modular.patch |   6 +-
 ...11k-Disable-rx_header-tlv-for-2K-SKB.patch |  52 ++++-----
 ...d-ampdu-id-in-802.11-radiotap-header.patch |   6 +-
 ...999-336-0001-ath11k-idr-optimization.patch |  10 +-
 .../999-336-0002-ath11k-Use-idr_replace.patch |  22 ++--
 ...k-skb_headroom-before-using-skb_push.patch |   6 +-
 .../subsys/007-fix_compilation_issue.patch    |  10 +-
 ...-when-using-encapsulation-offloading.patch |   2 +-
 .../199-001-mac80211-add-nss-support.patch    |  26 ++---
 ...t-callback-when-hwencap-enable-in-st.patch |   2 +-
 ...03-mac80211-ath11k-fw-dynamic-muedca.patch |   4 +-
 ...-ath11k-Add-support-for-dynamic-vlan.patch |   4 +-
 ...07-mac80211-add-nss-redirect-support.patch |   6 +-
 ...N-iftype-support-on-NSS-offload-case.patch |   6 +-
 ...-dynamic-VLAN-support-on-NSS-offload.patch |   6 +-
 .../nss/subsys/245-compilation_fix.patch      | 106 +++---------------
 .../300-ath11k-nss-mesh-offload-support.patch |  34 +++---
 ...TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch |   4 +-
 ...-0005-mac80211-simple-tx-for-AP-mode.patch |   4 +-
 ...mac80211-fix-unconditional-sta-usage.patch |   4 +-
 ...unused-RX_FLAGS-from-mac80211_rx_fla.patch |   4 +-
 ...ncapsulation-of-EAPOL-frames-if-OFFL.patch |  24 ++--
 ...fix-RCU-stall-in-mesh-fast-xmit-path.patch |   2 +-
 ...id-last_rate-for-rx_bitrate-from-cpu.patch |  12 +-
 ...se-HW-checksum-offload-only-for-ethm.patch |   4 +-
 ...1-Add-mac-hw-flag-to-avoid-queue-skb.patch |  24 ++--
 ...x-memory-corruption-during-mesh-beac.patch |   2 +-
 50 files changed, 236 insertions(+), 317 deletions(-)

diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile
index c6092553c5299b..82e8013fdd1478 100644
--- a/package/kernel/mac80211/Makefile
+++ b/package/kernel/mac80211/Makefile
@@ -434,9 +434,9 @@ endef
 
 ifdef CONFIG_ATH11K_NSS_SUPPORT
 define KernelPackage/ath11k/install
-       $(INSTALL_DIR) $(1)/etc/init.d $(1)/etc/config
-       $(INSTALL_BIN) ./files/qca-nss-pbuf.init $(1)/etc/init.d/qca-nss-pbuf
-       $(INSTALL_BIN) ./files/pbuf.uci $(1)/etc/config/pbuf
+	$(INSTALL_DIR) $(1)/etc/init.d $(1)/etc/config
+	$(INSTALL_BIN) ./files/qca-nss-pbuf.init $(1)/etc/init.d/qca-nss-pbuf
+	$(INSTALL_BIN) ./files/pbuf.uci $(1)/etc/config/pbuf
 endef
 endif
 
diff --git a/package/kernel/mac80211/patches/nss/ath11k/191-ath11k-add-mgmt-and-data-ack-rssi.patch b/package/kernel/mac80211/patches/nss/ath11k/191-ath11k-add-mgmt-and-data-ack-rssi.patch
index 22cdb4dccb4d5d..466dacd1006768 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/191-ath11k-add-mgmt-and-data-ack-rssi.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/191-ath11k-add-mgmt-and-data-ack-rssi.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -9579,6 +9579,8 @@ static int __ath11k_mac_register(struct
+@@ -9580,6 +9580,8 @@ static int __ath11k_mac_register(struct
  		wiphy_ext_feature_set(ar->hw->wiphy,
  				      NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/199-003-ath11k-add-nss-support.patch b/package/kernel/mac80211/patches/nss/ath11k/199-003-ath11k-add-nss-support.patch
index 2234cb6bc4cc1d..e30b5d761d3378 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/199-003-ath11k-add-nss-support.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/199-003-ath11k-add-nss-support.patch
@@ -747,7 +747,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	.configure_filter		= ath11k_mac_op_configure_filter,
  	.hw_scan                        = ath11k_mac_op_hw_scan,
  	.cancel_hw_scan                 = ath11k_mac_op_cancel_hw_scan,
-@@ -9529,7 +9637,8 @@ static int __ath11k_mac_register(struct
+@@ -9530,7 +9638,8 @@ static int __ath11k_mac_register(struct
  		ieee80211_hw_set(ar->hw, TX_AMPDU_SETUP_IN_HW);
  		ieee80211_hw_set(ar->hw, SUPPORTS_REORDERING_BUFFER);
  		ieee80211_hw_set(ar->hw, SUPPORTS_AMSDU_IN_AMPDU);
@@ -757,7 +757,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	}
  
  	ar->hw->wiphy->features |= NL80211_FEATURE_STATIC_SMPS;
-@@ -9644,6 +9753,9 @@ static int __ath11k_mac_register(struct
+@@ -9645,6 +9754,9 @@ static int __ath11k_mac_register(struct
  	    ab->hw_params.bios_sar_capa)
  		ar->hw->wiphy->sar_capa = ab->hw_params.bios_sar_capa;
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Add-support-for-dynamic-vlan.patch b/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Add-support-for-dynamic-vlan.patch
index 54a6d1528422db..a765d1a292c60c 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Add-support-for-dynamic-vlan.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Add-support-for-dynamic-vlan.patch
@@ -369,7 +369,7 @@ Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
  int ath11k_dp_tx(struct ath11k *ar, struct ath11k_vif *arvif,
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -9770,6 +9770,9 @@ static int __ath11k_mac_register(struct
+@@ -9771,6 +9771,9 @@ static int __ath11k_mac_register(struct
  		 */
  		ar->hw->wiphy->interface_modes &= ~BIT(NL80211_IFTYPE_MONITOR);
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch b/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
index 729ee80199b9a2..1730beea85dfc0 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
@@ -43,7 +43,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  struct ath11k_vif_iter {
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -4744,6 +4744,11 @@ static void ath11k_sta_rc_update_wk(stru
+@@ -4739,6 +4739,11 @@ static void ath11k_sta_rc_update_wk(stru
  	arvif = arsta->arvif;
  	ar = arvif->ar;
  
@@ -55,7 +55,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	if (WARN_ON(ath11k_mac_vif_chan(arvif->vif, &def)))
  		return;
  
-@@ -4915,17 +4920,28 @@ err_rc_bw_changed:
+@@ -4910,17 +4915,28 @@ err_rc_bw_changed:
  static void ath11k_sta_set_4addr_wk(struct work_struct *wk)
  {
  	struct ath11k *ar;
@@ -86,7 +86,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		   "setting USE_4ADDR for peer %pM\n", sta->addr);
  
  	ret = ath11k_wmi_set_peer_param(ar, sta->addr,
-@@ -4933,8 +4949,93 @@ static void ath11k_sta_set_4addr_wk(stru
+@@ -4928,8 +4944,93 @@ static void ath11k_sta_set_4addr_wk(stru
  					WMI_PEER_USE_4ADDR, 1);
  
  	if (ret)
@@ -181,7 +181,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  }
  
  static int ath11k_mac_inc_num_stations(struct ath11k_vif *arvif,
-@@ -5264,9 +5365,32 @@ static void ath11k_mac_op_sta_set_4addr(
+@@ -5259,9 +5360,32 @@ static void ath11k_mac_op_sta_set_4addr(
  					struct ieee80211_sta *sta, bool enabled)
  {
  	struct ath11k *ar = hw->priv;
@@ -214,7 +214,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		ieee80211_queue_work(ar->hw, &arsta->set_4addr_wk);
  		arsta->use_4addr_set = true;
  	}
-@@ -6646,6 +6770,9 @@ static int ath11k_mac_op_update_vif_offl
+@@ -6641,6 +6765,9 @@ static int ath11k_mac_op_update_vif_offl
  	u32 param_id, param_value;
  	int ret;
  
@@ -224,7 +224,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	param_id = WMI_VDEV_PARAM_TX_ENCAP_TYPE;
  	if (ath11k_frame_mode != ATH11K_HW_TXRX_ETHERNET ||
  	    (vif->type != NL80211_IFTYPE_STATION &&
-@@ -6866,7 +6993,8 @@ static int ath11k_mac_op_add_interface(s
+@@ -6861,7 +6988,8 @@ static int ath11k_mac_op_add_interface(s
  		goto err;
  	}
  
@@ -234,7 +234,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		ath11k_warn(ab, "failed to create vdev %u, reached max vdev limit %d\n",
  			    ar->num_created_vdevs, TARGET_NUM_VDEVS(ab));
  		ret = -EBUSY;
-@@ -6886,6 +7014,28 @@ static int ath11k_mac_op_add_interface(s
+@@ -6881,6 +7009,28 @@ static int ath11k_mac_op_add_interface(s
  	arvif->vif = vif;
  
  	INIT_LIST_HEAD(&arvif->list);
@@ -263,7 +263,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	INIT_DELAYED_WORK(&arvif->connection_loss_work,
  			  ath11k_mac_vif_sta_connection_loss_work);
  
-@@ -6915,6 +7065,7 @@ static int ath11k_mac_op_add_interface(s
+@@ -6910,6 +7060,7 @@ static int ath11k_mac_op_add_interface(s
  		fallthrough;
  	case NL80211_IFTYPE_AP:
  		arvif->vdev_type = WMI_VDEV_TYPE_AP;
@@ -271,7 +271,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		break;
  	case NL80211_IFTYPE_MONITOR:
  		arvif->vdev_type = WMI_VDEV_TYPE_MONITOR;
-@@ -7137,13 +7288,30 @@ static void ath11k_mac_op_remove_interfa
+@@ -7132,13 +7283,30 @@ static void ath11k_mac_op_remove_interfa
  	struct ath11k *ar = hw->priv;
  	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
  	struct ath11k_base *ab = ar->ab;
@@ -304,7 +304,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	ath11k_dbg(ab, ATH11K_DBG_MAC, "remove interface (vdev %d)\n",
  		   arvif->vdev_id);
  
-@@ -7160,6 +7328,14 @@ static void ath11k_mac_op_remove_interfa
+@@ -7155,6 +7323,14 @@ static void ath11k_mac_op_remove_interfa
  		if (ret)
  			ath11k_warn(ab, "failed to submit AP self-peer removal on vdev %d: %d\n",
  				    arvif->vdev_id, ret);
@@ -319,7 +319,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	}
  
  	ret = ath11k_mac_vdev_delete(ar, arvif);
-@@ -7203,8 +7379,7 @@ err_vdev_del:
+@@ -7198,8 +7374,7 @@ err_vdev_del:
  
  	ath11k_debugfs_remove_interface(arvif);
  
@@ -329,7 +329,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	mutex_unlock(&ar->conf_mutex);
  }
  
-@@ -7264,16 +7439,17 @@ static int ath11k_mac_op_ampdu_action(st
+@@ -7259,16 +7434,17 @@ static int ath11k_mac_op_ampdu_action(st
  				      struct ieee80211_ampdu_params *params)
  {
  	struct ath11k *ar = hw->priv;
@@ -349,7 +349,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		break;
  	case IEEE80211_AMPDU_TX_START:
  	case IEEE80211_AMPDU_TX_STOP_CONT:
-@@ -8796,6 +8972,7 @@ static void ath11k_mac_op_sta_statistics
+@@ -8791,6 +8967,7 @@ static void ath11k_mac_op_sta_statistics
  {
  	struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);
  	struct ath11k *ar = arsta->arvif->ar;
@@ -357,7 +357,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	s8 signal;
  	bool db2dbm = test_bit(WMI_TLV_SERVICE_HW_DB2DBM_CONVERSION_SUPPORT,
  			       ar->ab->wmi_ab.svc_map);
-@@ -8852,7 +9029,8 @@ static void ath11k_mac_op_sta_statistics
+@@ -8847,7 +9024,8 @@ static void ath11k_mac_op_sta_statistics
  		ATH11K_DEFAULT_NOISE_FLOOR;
  	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/236-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch b/package/kernel/mac80211/patches/nss/ath11k/236-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch
index 80b8a5fc67d7ea..750fd2b239d548 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/236-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/236-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch
@@ -83,7 +83,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  struct ath11k_vif_iter {
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -351,6 +351,10 @@ enum nl80211_he_gi ath11k_mac_he_gi_to_n
+@@ -346,6 +346,10 @@ enum nl80211_he_gi ath11k_mac_he_gi_to_n
  	return ret;
  }
  
@@ -94,7 +94,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  u8 ath11k_mac_bw_to_mac80211_bw(u8 bw)
  {
  	u8 ret = 0;
-@@ -723,6 +727,33 @@ u8 ath11k_mac_get_target_pdev_id(struct
+@@ -718,6 +722,33 @@ u8 ath11k_mac_get_target_pdev_id(struct
  		return ar->ab->target_pdev_ids[0].pdev_id;
  }
  
@@ -128,7 +128,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  static void ath11k_pdev_caps_update(struct ath11k *ar)
  {
  	struct ath11k_base *ab = ar->ab;
-@@ -4172,6 +4203,9 @@ static int ath11k_install_key(struct ath
+@@ -4167,6 +4198,9 @@ static int ath11k_install_key(struct ath
  	if (test_bit(ATH11K_FLAG_HW_CRYPTO_DISABLED, &ar->ab->dev_flags))
  		return 0;
  
@@ -138,7 +138,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	if (cmd == DISABLE_KEY) {
  		arg.key_cipher = WMI_CIPHER_NONE;
  		arg.key_data = NULL;
-@@ -4261,15 +4295,40 @@ static int ath11k_clear_peer_keys(struct
+@@ -4256,15 +4290,40 @@ static int ath11k_clear_peer_keys(struct
  	return first_errno;
  }
  
@@ -181,7 +181,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	const u8 *peer_addr;
  	int ret = 0;
  	u32 flags = 0;
-@@ -4287,17 +4346,38 @@ static int ath11k_mac_op_set_key(struct
+@@ -4282,17 +4341,38 @@ static int ath11k_mac_op_set_key(struct
  	if (key->keyidx > WMI_MAX_KEY_INDEX)
  		return -ENOSPC;
  
@@ -224,7 +224,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	/* the peer should not disappear in mid-way (unless FW goes awry) since
  	 * we already hold conf_mutex. we just make sure its there now.
  	 */
-@@ -4342,6 +4422,74 @@ static int ath11k_mac_op_set_key(struct
+@@ -4337,6 +4417,74 @@ static int ath11k_mac_op_set_key(struct
  		goto exit;
  	}
  
@@ -299,7 +299,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	spin_lock_bh(&ab->base_lock);
  	peer = ath11k_peer_find(ab, arvif->vdev_id, peer_addr);
  
-@@ -4364,6 +4512,27 @@ static int ath11k_mac_op_set_key(struct
+@@ -4359,6 +4507,27 @@ static int ath11k_mac_op_set_key(struct
  		goto unlock;
  	}
  
@@ -327,7 +327,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	if (peer && cmd == SET_KEY) {
  		peer->keys[key->keyidx] = key;
  		if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
-@@ -4373,18 +4542,23 @@ static int ath11k_mac_op_set_key(struct
+@@ -4368,18 +4537,23 @@ static int ath11k_mac_op_set_key(struct
  			peer->mcast_keyidx = key->keyidx;
  			peer->sec_type_grp = ath11k_dp_tx_get_encrypt_type(key->cipher);
  		}
@@ -354,7 +354,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
  		switch (key->cipher) {
  		case WLAN_CIPHER_SUITE_TKIP:
-@@ -5191,6 +5365,33 @@ static u32 ath11k_mac_ieee80211_sta_bw_t
+@@ -5186,6 +5360,33 @@ static u32 ath11k_mac_ieee80211_sta_bw_t
  	return bw;
  }
  
@@ -388,7 +388,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  static int ath11k_mac_op_sta_state(struct ieee80211_hw *hw,
  				   struct ieee80211_vif *vif,
  				   struct ieee80211_sta *sta,
-@@ -5300,6 +5501,34 @@ static int ath11k_mac_op_sta_state(struc
+@@ -5295,6 +5496,34 @@ static int ath11k_mac_op_sta_state(struc
  			if (ret)
  				ath11k_warn(ar->ab, "Unable to authorize peer %pM vdev %d: %d\n",
  					    sta->addr, arvif->vdev_id, ret);
@@ -423,7 +423,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		}
  	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
  		   new_state == IEEE80211_STA_ASSOC) {
-@@ -7018,7 +7247,7 @@ static int ath11k_mac_op_add_interface(s
+@@ -7013,7 +7242,7 @@ static int ath11k_mac_op_add_interface(s
  	if ((vif->type == NL80211_IFTYPE_AP_VLAN ||
  	     vif->type == NL80211_IFTYPE_STATION) && ab->nss.enabled) {
  		if (ath11k_frame_mode == ATH11K_HW_TXRX_ETHERNET &&
@@ -432,7 +432,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  			vif->offload_flags |= IEEE80211_OFFLOAD_ENCAP_4ADDR;
  			arvif->nss.encap = ATH11K_HW_TXRX_ETHERNET;
  			arvif->nss.decap = ATH11K_HW_TXRX_ETHERNET;
-@@ -7031,6 +7260,7 @@ static int ath11k_mac_op_add_interface(s
+@@ -7026,6 +7255,7 @@ static int ath11k_mac_op_add_interface(s
  					    vif->addr, ret);
  				goto err;
  			}
@@ -440,7 +440,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  			mutex_unlock(&ar->conf_mutex);
  			return ret;
  		}
-@@ -7055,6 +7285,20 @@ static int ath11k_mac_op_add_interface(s
+@@ -7050,6 +7280,20 @@ static int ath11k_mac_op_add_interface(s
  	arvif->vdev_id = bit;
  	arvif->vdev_subtype = WMI_VDEV_SUBTYPE_NONE;
  
@@ -461,7 +461,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	switch (vif->type) {
  	case NL80211_IFTYPE_UNSPECIFIED:
  	case NL80211_IFTYPE_STATION:
-@@ -7095,7 +7339,7 @@ static int ath11k_mac_op_add_interface(s
+@@ -7090,7 +7334,7 @@ static int ath11k_mac_op_add_interface(s
  	if (ret) {
  		ath11k_warn(ab, "failed to create WMI vdev %d: %d\n",
  			    arvif->vdev_id, ret);
@@ -470,7 +470,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	}
  
  	ar->num_created_vdevs++;
-@@ -7254,7 +7498,7 @@ err_peer_del:
+@@ -7249,7 +7493,7 @@ err_peer_del:
  		if (fbret) {
  			ath11k_warn(ar->ab, "fallback fail to delete peer addr %pM vdev_id %d ret %d\n",
  				    vif->addr, arvif->vdev_id, fbret);
@@ -479,7 +479,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		}
  	}
  
-@@ -7265,6 +7509,8 @@ err_vdev_del:
+@@ -7260,6 +7504,8 @@ err_vdev_del:
  	list_del(&arvif->list);
  	spin_unlock_bh(&ar->data_lock);
  
@@ -488,7 +488,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  err:
  	mutex_unlock(&ar->conf_mutex);
  
-@@ -7362,6 +7608,7 @@ err_vdev_del:
+@@ -7357,6 +7603,7 @@ err_vdev_del:
  	list_del(&arvif->list);
  	spin_unlock_bh(&ar->data_lock);
  
@@ -496,7 +496,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	ath11k_peer_cleanup(ar, arvif->vdev_id);
  
  	idr_for_each(&ar->txmgmt_idr,
-@@ -9960,8 +10207,11 @@ static int __ath11k_mac_register(struct
+@@ -9956,8 +10203,11 @@ static int __ath11k_mac_register(struct
  	    ab->hw_params.bios_sar_capa)
  		ar->hw->wiphy->sar_capa = ab->hw_params.bios_sar_capa;
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch b/package/kernel/mac80211/patches/nss/ath11k/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
index 61077309338ffb..d25e43ec0b3998 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
@@ -328,7 +328,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	bool (*rx_desc_get_mpdu_fc_valid)(struct hal_rx_desc *desc);
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -5532,6 +5532,14 @@ static int ath11k_mac_op_sta_state(struc
+@@ -5527,6 +5527,14 @@ static int ath11k_mac_op_sta_state(struc
  		}
  	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
  		   new_state == IEEE80211_STA_ASSOC) {
diff --git a/package/kernel/mac80211/patches/nss/ath11k/244-ath11k-dp-tx-perf.patch b/package/kernel/mac80211/patches/nss/ath11k/244-ath11k-dp-tx-perf.patch
index 1c9a6ebd1d41ac..c4042611d3d9ea 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/244-ath11k-dp-tx-perf.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/244-ath11k-dp-tx-perf.patch
@@ -430,7 +430,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -6669,12 +6669,22 @@ static void ath11k_mac_op_tx(struct ieee
+@@ -6664,12 +6664,22 @@ static void ath11k_mac_op_tx(struct ieee
  	if (control->sta)
  		arsta = ath11k_sta_to_arsta(control->sta);
  
@@ -454,7 +454,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		ieee80211_free_txskb(ar->hw, skb);
  		return;
  	}
-@@ -7622,7 +7632,7 @@ err_vdev_del:
+@@ -7617,7 +7627,7 @@ err_vdev_del:
  	idr_for_each(&ar->txmgmt_idr,
  		     ath11k_mac_vif_txmgmt_idr_remove, vif);
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/270-iphone-issue.patch b/package/kernel/mac80211/patches/nss/ath11k/270-iphone-issue.patch
index 4260d0e5337451..717c11bdfe39e1 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/270-iphone-issue.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/270-iphone-issue.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -6267,6 +6267,8 @@ static int ath11k_mac_copy_he_cap(struct
+@@ -6262,6 +6262,8 @@ static int ath11k_mac_copy_he_cap(struct
  		memcpy(he_cap_elem->phy_cap_info, band_cap->he_cap_phy_info,
  		       sizeof(he_cap_elem->phy_cap_info));
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch b/package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch
index b31809f689548b..30848b8f6164ac 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch
@@ -1238,7 +1238,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -3474,6 +3474,18 @@ static void ath11k_mac_op_nss_bss_info_c
+@@ -3469,6 +3469,18 @@ static void ath11k_mac_op_nss_bss_info_c
  			ath11k_warn(ar->ab, "failed to set ap_isolate in nss %d\n", ret);
  	}
  
@@ -1257,7 +1257,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  	mutex_unlock(&ar->conf_mutex);
  }
  
-@@ -9714,6 +9726,28 @@ err_fallback:
+@@ -9709,6 +9721,28 @@ err_fallback:
  	return 0;
  }
  
@@ -1286,7 +1286,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  static const struct ieee80211_ops ath11k_ops = {
  	.tx				= ath11k_mac_op_tx,
  	.wake_tx_queue			= ieee80211_handle_wake_tx_queue,
-@@ -9771,6 +9805,9 @@ static const struct ieee80211_ops ath11k
+@@ -9766,6 +9800,9 @@ static const struct ieee80211_ops ath11k
  	.set_sar_specs			= ath11k_mac_op_set_bios_sar_specs,
  	.remain_on_channel		= ath11k_mac_op_remain_on_channel,
  	.cancel_remain_on_channel	= ath11k_mac_op_cancel_remain_on_channel,
@@ -1296,7 +1296,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  };
  
  static void ath11k_mac_update_ch_list(struct ath11k *ar,
-@@ -10231,6 +10268,8 @@ static int __ath11k_mac_register(struct
+@@ -10227,6 +10264,8 @@ static int __ath11k_mac_register(struct
  		ieee80211_hw_set(ar->hw, SUPPORTS_NSS_OFFLOAD);
  		wiphy_ext_feature_set(ar->hw->wiphy,
  				      NL80211_EXT_FEATURE_VLAN_OFFLOAD);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/314-ath11k-Fix-peer-lookup-failure-in-mgmt-tx-completion.patch b/package/kernel/mac80211/patches/nss/ath11k/314-ath11k-Fix-peer-lookup-failure-in-mgmt-tx-completion.patch
index cb4fba0a2ffdcd..6edfd5f9208e97 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/314-ath11k-Fix-peer-lookup-failure-in-mgmt-tx-completion.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/314-ath11k-Fix-peer-lookup-failure-in-mgmt-tx-completion.patch
@@ -23,7 +23,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -7643,8 +7643,10 @@ err_vdev_del:
+@@ -7638,8 +7638,10 @@ err_vdev_del:
  	kfree(arvif->vlan_keyid_map);
  	ath11k_peer_cleanup(ar, arvif->vdev_id);
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/330-ath11k-sync-wds_ast_entry-updates.patch b/package/kernel/mac80211/patches/nss/ath11k/330-ath11k-sync-wds_ast_entry-updates.patch
index 361c9064148acd..01ccc6003fc0cf 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/330-ath11k-sync-wds_ast_entry-updates.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/330-ath11k-sync-wds_ast_entry-updates.patch
@@ -56,7 +56,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  static void ath11k_ahb_free_resources(struct ath11k_base *ab)
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
-@@ -2212,6 +2212,7 @@ struct ath11k_base *ath11k_core_alloc(st
+@@ -2211,6 +2211,7 @@ struct ath11k_base *ath11k_core_alloc(st
  
  	mutex_init(&ab->core_lock);
  	mutex_init(&ab->tbl_mtx_lock);
@@ -64,7 +64,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  	spin_lock_init(&ab->base_lock);
  	mutex_init(&ab->vdev_id_11d_lock);
  	init_completion(&ab->reset_complete);
-@@ -2225,6 +2226,8 @@ struct ath11k_base *ath11k_core_alloc(st
+@@ -2224,6 +2225,8 @@ struct ath11k_base *ath11k_core_alloc(st
  	INIT_WORK(&ab->restart_work, ath11k_core_restart);
  	INIT_WORK(&ab->update_11d_work, ath11k_update_11d);
  	INIT_WORK(&ab->reset_work, ath11k_core_reset);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch b/package/kernel/mac80211/patches/nss/ath11k/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
index 3c3e436c75ce41..8e018e619f12f8 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
@@ -58,7 +58,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  	tcl_cmd.info3 = FIELD_PREP(HAL_TCL_DATA_CMD_INFO3_DSCP_TID_TABLE_IDX,
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -10154,6 +10154,8 @@ static int __ath11k_mac_register(struct
+@@ -10150,6 +10150,8 @@ static int __ath11k_mac_register(struct
  			ieee80211_hw_set(ar->hw, USES_RSS);
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/341-ath11k-fix-support-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch b/package/kernel/mac80211/patches/nss/ath11k/341-ath11k-fix-support-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch
index dbd8dd904c022d..9a3c95a9df3c40 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/341-ath11k-fix-support-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/341-ath11k-fix-support-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch
@@ -38,7 +38,7 @@ Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
-@@ -1838,6 +1838,11 @@ static int ath11k_core_reconfigure_on_cr
+@@ -1837,6 +1837,11 @@ static int ath11k_core_reconfigure_on_cr
  
  	clear_bit(ATH11K_FLAG_CRASH_FLUSH, &ab->dev_flags);
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/357-ath11k-fix-clear-peer-keys-during-disassoc.patch b/package/kernel/mac80211/patches/nss/ath11k/357-ath11k-fix-clear-peer-keys-during-disassoc.patch
index 15a8afde61ef4f..4c7fefbba155d7 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/357-ath11k-fix-clear-peer-keys-during-disassoc.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/357-ath11k-fix-clear-peer-keys-during-disassoc.patch
@@ -17,7 +17,7 @@ Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -4899,12 +4899,6 @@ static int ath11k_station_disassoc(struc
+@@ -4894,12 +4894,6 @@ static int ath11k_station_disassoc(struc
  			return ret;
  	}
  
@@ -30,7 +30,7 @@ Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
  	return 0;
  }
  
-@@ -5495,6 +5489,17 @@ static int ath11k_mac_op_sta_state(struc
+@@ -5490,6 +5484,17 @@ static int ath11k_mac_op_sta_state(struc
  		arsta->bw = ath11k_mac_ieee80211_sta_bw_to_wmi(ar, sta);
  		arsta->bw_prev = arsta->bw;
  		spin_unlock_bh(&ar->data_lock);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/401-ath11k-Fix-mutex-dead-lock-and-q6-dump-crash.patch b/package/kernel/mac80211/patches/nss/ath11k/401-ath11k-Fix-mutex-dead-lock-and-q6-dump-crash.patch
index 1f66f72a4a4851..ceeb15c8cbea65 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/401-ath11k-Fix-mutex-dead-lock-and-q6-dump-crash.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/401-ath11k-Fix-mutex-dead-lock-and-q6-dump-crash.patch
@@ -36,7 +36,7 @@ Signed-off-by: Rajat Soni <quic_rajson@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -8001,7 +8001,9 @@ static int ath11k_mac_op_start(struct ie
+@@ -6786,7 +6786,9 @@ static int ath11k_mac_op_start(struct ie
  		break;
  	case ATH11K_STATE_RESTARTING:
  		ar->state = ATH11K_STATE_RESTARTED;
@@ -48,7 +48,7 @@ Signed-off-by: Rajat Soni <quic_rajson@quicinc.com>
  	case ATH11K_STATE_WEDGED:
 --- a/drivers/net/wireless/ath/ath11k/qmi.c
 +++ b/drivers/net/wireless/ath/ath11k/qmi.c
-@@ -2960,6 +2960,8 @@ static int ath11k_qmi_assign_target_mem_
+@@ -2061,6 +2061,8 @@ static int ath11k_qmi_assign_target_mem_
  			if (!ab->qmi.target_mem[idx].iaddr)
  				return -EIO;
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/453-ath11k-flush-management-frames-to-firmware-before-wa.patch b/package/kernel/mac80211/patches/nss/ath11k/453-ath11k-flush-management-frames-to-firmware-before-wa.patch
index 7d413afec97b3d..90982924fe29f7 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/453-ath11k-flush-management-frames-to-firmware-before-wa.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/453-ath11k-flush-management-frames-to-firmware-before-wa.patch
@@ -25,11 +25,9 @@ Signed-off-by: Hari Chandrakanthan <quic_haric@quicinc.com>
  drivers/net/wireless/ath/ath11k/mac.c | 2 ++
  1 file changed, 2 insertions(+)
 
-diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
-index 28c9908ef816..dbdb7aa5c498 100644
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -10266,6 +10266,8 @@ static int ath11k_mac_flush_tx_complete(struct ath11k *ar)
+@@ -8464,6 +8464,8 @@ static int ath11k_mac_flush_tx_complete(
  		ret = -ETIMEDOUT;
  	}
  
@@ -38,6 +36,3 @@ index 28c9908ef816..dbdb7aa5c498 100644
  	time_left = wait_event_timeout(ar->txmgmt_empty_waitq,
  				       (atomic_read(&ar->num_pending_mgmt_tx) == 0),
  				       ATH11K_FLUSH_TIMEOUT);
--- 
-2.7.4
-
diff --git a/package/kernel/mac80211/patches/nss/ath11k/457-wifi-ath11k-Avoid-memset-of-ppdu-info-for-next-skb.patch b/package/kernel/mac80211/patches/nss/ath11k/457-wifi-ath11k-Avoid-memset-of-ppdu-info-for-next-skb.patch
index c23b6cb3c858b4..21a92296da38a1 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/457-wifi-ath11k-Avoid-memset-of-ppdu-info-for-next-skb.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/457-wifi-ath11k-Avoid-memset-of-ppdu-info-for-next-skb.patch
@@ -48,7 +48,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -6090,7 +6090,9 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -6089,7 +6089,9 @@ int ath11k_dp_rx_process_mon_status(stru
  	if (!num_buffs_reaped)
  		goto exit;
  
@@ -59,7 +59,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	ppdu_info->peer_id = HAL_INVALID_PEERID;
  
  	while ((skb = __skb_dequeue(&skb_list))) {
-@@ -6108,7 +6110,6 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -6107,7 +6109,6 @@ int ath11k_dp_rx_process_mon_status(stru
  		if (log_type != ATH11K_PKTLOG_TYPE_INVALID)
  			trace_ath11k_htt_rxdesc(ar, skb->data, log_type, rx_buf_sz);
  
@@ -67,7 +67,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  		ppdu_info->peer_id = HAL_INVALID_PEERID;
  		hal_status = ath11k_hal_rx_parse_mon_status(ab, ppdu_info, skb);
  
-@@ -6136,6 +6137,7 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -6135,6 +6136,7 @@ int ath11k_dp_rx_process_mon_status(stru
  		if ((ppdu_info->peer_id == HAL_INVALID_PEERID ||
  		    hal_status != HAL_RX_MON_STATUS_PPDU_DONE)) {
  			dev_kfree_skb_any(skb);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/669-ath11k-change-dma_map_single-to-virt_to_phys-in-rx-r.patch b/package/kernel/mac80211/patches/nss/ath11k/669-ath11k-change-dma_map_single-to-virt_to_phys-in-rx-r.patch
index fe767b6a33de2a..06cee635f3e79b 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/669-ath11k-change-dma_map_single-to-virt_to_phys-in-rx-r.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/669-ath11k-change-dma_map_single-to-virt_to_phys-in-rx-r.patch
@@ -40,7 +40,7 @@ Signed-off-by: Balamurugan Selvarajan <quic_bselvara@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -427,9 +427,9 @@ int ath11k_dp_rxbufs_replenish(struct at
+@@ -392,9 +392,9 @@ int ath11k_dp_rxbufs_replenish(struct at
  				 skb->data);
  		}
  
@@ -53,7 +53,7 @@ Signed-off-by: Balamurugan Selvarajan <quic_bselvara@quicinc.com>
  		if (dma_mapping_error(ab->dev, paddr))
  			goto fail_free_skb;
  
-@@ -465,8 +465,8 @@ fail_idr_remove:
+@@ -430,8 +430,8 @@ fail_idr_remove:
  	idr_remove(&rx_ring->bufs_idr, buf_id);
  	spin_unlock_bh(&rx_ring->idr_lock);
  fail_dma_unmap:
diff --git a/package/kernel/mac80211/patches/nss/ath11k/907-01-wifi-ath11k-remove-invalid-peer-create-logic.patch b/package/kernel/mac80211/patches/nss/ath11k/907-01-wifi-ath11k-remove-invalid-peer-create-logic.patch
index b471fb326a5b48..4d8f9f28e3a1e3 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/907-01-wifi-ath11k-remove-invalid-peer-create-logic.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/907-01-wifi-ath11k-remove-invalid-peer-create-logic.patch
@@ -26,7 +26,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -8221,7 +8221,6 @@ ath11k_mac_op_assign_vif_chanctx(struct
+@@ -8218,7 +8218,6 @@ ath11k_mac_op_assign_vif_chanctx(struct
  	struct ath11k_base *ab = ar->ab;
  	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
  	int ret;
@@ -34,7 +34,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  
  	mutex_lock(&ar->conf_mutex);
  
-@@ -8244,21 +8243,6 @@ ath11k_mac_op_assign_vif_chanctx(struct
+@@ -8241,21 +8240,6 @@ ath11k_mac_op_assign_vif_chanctx(struct
  		goto out;
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/907-02-wifi-ath11k-rename-ath11k_start_vdev_delay.patch b/package/kernel/mac80211/patches/nss/ath11k/907-02-wifi-ath11k-rename-ath11k_start_vdev_delay.patch
index 2fb2cdfd429b11..7d04e371edd5fa 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/907-02-wifi-ath11k-rename-ath11k_start_vdev_delay.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/907-02-wifi-ath11k-rename-ath11k_start_vdev_delay.patch
@@ -19,7 +19,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -261,8 +261,8 @@ static const u32 ath11k_smps_map[] = {
+@@ -256,8 +256,8 @@ static const u32 ath11k_smps_map[] = {
  	[WLAN_HT_CAP_SM_PS_DISABLED] = WMI_PEER_SMPS_PS_NONE,
  };
  
@@ -30,7 +30,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  
  enum nl80211_he_ru_alloc ath11k_mac_phy_he_ru_to_nl80211_he_ru_alloc(u16 ru_phy)
  {
-@@ -5319,7 +5319,7 @@ static int ath11k_mac_station_add(struct
+@@ -5314,7 +5314,7 @@ static int ath11k_mac_station_add(struct
  	if (ab->hw_params.vdev_start_delay &&
  	    !arvif->is_started &&
  	    arvif->vdev_type != WMI_VDEV_TYPE_AP) {
@@ -39,7 +39,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  		if (ret) {
  			ath11k_warn(ab, "failed to delay vdev start: %d\n", ret);
  			goto free_tx_stats;
-@@ -8164,8 +8164,8 @@ unlock:
+@@ -8161,8 +8161,8 @@ unlock:
  	mutex_unlock(&ar->conf_mutex);
  }
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/907-03-wifi-ath11k-avoid-forward-declaration-of-ath11k_mac_start_vdev_delay.patch b/package/kernel/mac80211/patches/nss/ath11k/907-03-wifi-ath11k-avoid-forward-declaration-of-ath11k_mac_start_vdev_delay.patch
index 4d83d0f0ed9029..f928d851a678d7 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/907-03-wifi-ath11k-avoid-forward-declaration-of-ath11k_mac_start_vdev_delay.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/907-03-wifi-ath11k-avoid-forward-declaration-of-ath11k_mac_start_vdev_delay.patch
@@ -18,7 +18,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -261,9 +261,6 @@ static const u32 ath11k_smps_map[] = {
+@@ -256,9 +256,6 @@ static const u32 ath11k_smps_map[] = {
  	[WLAN_HT_CAP_SM_PS_DISABLED] = WMI_PEER_SMPS_PS_NONE,
  };
  
@@ -28,7 +28,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  enum nl80211_he_ru_alloc ath11k_mac_phy_he_ru_to_nl80211_he_ru_alloc(u16 ru_phy)
  {
  	enum nl80211_he_ru_alloc ret;
-@@ -5249,100 +5246,6 @@ static void ath11k_mac_dec_num_stations(
+@@ -5244,100 +5241,6 @@ static void ath11k_mac_dec_num_stations(
  	ar->num_stations--;
  }
  
@@ -129,7 +129,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  static u32 ath11k_mac_ieee80211_sta_bw_to_wmi(struct ath11k *ar,
  					      struct ieee80211_sta *sta)
  {
-@@ -5398,187 +5301,6 @@ static int ath11k_mac_cfg_dyn_vlan(struc
+@@ -5393,187 +5296,6 @@ static int ath11k_mac_cfg_dyn_vlan(struc
  	return ret;
  }
  
@@ -317,7 +317,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  static int ath11k_mac_op_sta_set_txpwr(struct ieee80211_hw *hw,
  				       struct ieee80211_vif *vif,
  				       struct ieee80211_sta *sta)
-@@ -9739,6 +9461,281 @@ ath11k_mac_op_config_mesh_offload_path(s
+@@ -9738,6 +9460,281 @@ ath11k_mac_op_config_mesh_offload_path(s
  }
  #endif
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/907-04-wifi-ath11k-fix-connection-failure-due-to-unexpected-peer-delete.patch b/package/kernel/mac80211/patches/nss/ath11k/907-04-wifi-ath11k-fix-connection-failure-due-to-unexpected-peer-delete.patch
index d1b462519c91e8..010825fd16656e 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/907-04-wifi-ath11k-fix-connection-failure-due-to-unexpected-peer-delete.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/907-04-wifi-ath11k-fix-connection-failure-due-to-unexpected-peer-delete.patch
@@ -52,7 +52,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -7933,6 +7933,30 @@ static int ath11k_mac_start_vdev_delay(s
+@@ -7930,6 +7930,30 @@ static int ath11k_mac_start_vdev_delay(s
  	return 0;
  }
  
@@ -83,7 +83,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  static int
  ath11k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw,
  				 struct ieee80211_vif *vif,
-@@ -7977,15 +8001,17 @@ ath11k_mac_op_assign_vif_chanctx(struct
+@@ -7974,15 +7998,17 @@ ath11k_mac_op_assign_vif_chanctx(struct
  		goto out;
  	}
  
@@ -109,7 +109,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  
  	if (arvif->vdev_type != WMI_VDEV_TYPE_MONITOR &&
  	    test_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags)) {
-@@ -8025,8 +8051,6 @@ ath11k_mac_op_unassign_vif_chanctx(struc
+@@ -8022,8 +8048,6 @@ ath11k_mac_op_unassign_vif_chanctx(struc
  		   "chanctx unassign ptr %p vdev_id %i\n",
  		   ctx, arvif->vdev_id);
  
@@ -118,7 +118,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  	if (ab->hw_params.vdev_start_delay &&
  	    arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
  		spin_lock_bh(&ab->base_lock);
-@@ -8050,24 +8074,13 @@ ath11k_mac_op_unassign_vif_chanctx(struc
+@@ -8047,24 +8071,13 @@ ath11k_mac_op_unassign_vif_chanctx(struc
  		return;
  	}
  
@@ -149,7 +149,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  	}
  
  	if (ab->hw_params.vdev_start_delay &&
-@@ -9555,6 +9568,46 @@ exit:
+@@ -9554,6 +9567,46 @@ exit:
  	return ret;
  }
  
@@ -196,7 +196,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  static int ath11k_mac_op_sta_state(struct ieee80211_hw *hw,
  				   struct ieee80211_vif *vif,
  				   struct ieee80211_sta *sta,
-@@ -9590,31 +9643,15 @@ static int ath11k_mac_op_sta_state(struc
+@@ -9589,31 +9642,15 @@ static int ath11k_mac_op_sta_state(struc
  				    sta->addr, arvif->vdev_id);
  	} else if ((old_state == IEEE80211_STA_NONE &&
  		    new_state == IEEE80211_STA_NOTEXIST)) {
@@ -233,7 +233,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  			ath11k_warn(ar->ab, "Found peer entry %pM n vdev %i after it was supposedly removed\n",
  				    vif->addr, arvif->vdev_id);
  			ath11k_peer_rhash_delete(ar->ab, peer);
-@@ -9625,12 +9662,6 @@ static int ath11k_mac_op_sta_state(struc
+@@ -9624,12 +9661,6 @@ static int ath11k_mac_op_sta_state(struc
  		}
  		spin_unlock_bh(&ar->ab->base_lock);
  		mutex_unlock(&ar->ab->tbl_mtx_lock);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/908-ath11k-make-debugfs-sta-htt-stats-modular.patch b/package/kernel/mac80211/patches/nss/ath11k/908-ath11k-make-debugfs-sta-htt-stats-modular.patch
index 2362820dc9e838..4276e64cc30364 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/908-ath11k-make-debugfs-sta-htt-stats-modular.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/908-ath11k-make-debugfs-sta-htt-stats-modular.patch
@@ -153,7 +153,7 @@
  #include "hw.h"
  #include "peer.h"
  #include "mac.h"
-@@ -551,7 +553,9 @@ static void ath11k_dp_tx_cache_peer_stat
+@@ -550,7 +552,9 @@ static void ath11k_dp_tx_cache_peer_stat
  void ath11k_dp_tx_update_txcompl(struct ath11k *ar, struct hal_tx_status *ts)
  {
  	struct ath11k_base *ab = ar->ab;
@@ -163,7 +163,7 @@
  	enum hal_tx_rate_stats_pkt_type pkt_type;
  	enum hal_tx_rate_stats_sgi sgi;
  	enum hal_tx_rate_stats_bw bw;
-@@ -640,8 +644,10 @@ void ath11k_dp_tx_update_txcompl(struct
+@@ -639,8 +643,10 @@ void ath11k_dp_tx_update_txcompl(struct
  			ath11k_mac_he_ru_tones_to_nl80211_he_ru_alloc(ru_tones);
  	}
  
@@ -176,7 +176,7 @@
  	spin_unlock_bh(&ab->base_lock);
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -9812,7 +9812,7 @@ static const struct ieee80211_ops ath11k
+@@ -9811,7 +9811,7 @@ static const struct ieee80211_ops ath11k
  	.set_wakeup			= ath11k_wow_op_set_wakeup,
  #endif
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch b/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
index 85562dc463a211..322698f0ea8d84 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
@@ -49,7 +49,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
   *    |-------------------------------------------------------------------|
   *    |              rsvd2               |           ring_buffer_size     |
   *    |-------------------------------------------------------------------|
-@@ -686,6 +691,14 @@ enum htt_stats_internal_ppdu_frametype {
+@@ -686,6 +687,14 @@ enum htt_stats_internal_ppdu_frametype {
   *    |-------------------------------------------------------------------|
   *    |                         tlv_filter_in_flags                       |
   *    |-------------------------------------------------------------------|
@@ -64,7 +64,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
   * Where:
   *     PS = pkt_swap
   *     SS = status_swap
-@@ -699,7 +712,10 @@ enum htt_stats_internal_ppdu_frametype {
+@@ -699,7 +708,10 @@ enum htt_stats_internal_ppdu_frametype {
   *                    More details can be got from enum htt_srng_ring_id
   *          b'24    - status_swap: 1 is to swap status TLV
   *          b'25    - pkt_swap:  1 is to swap packet TLV
@@ -76,7 +76,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
   * dword1 - b'0:16  - ring_buffer_size: size of buffers referenced by rx ring,
   *                    in byte units.
   *                    Valid only for HW_TO_SW_RING and SW_TO_HW_RING
-@@ -728,6 +744,42 @@ enum htt_stats_internal_ppdu_frametype {
+@@ -728,6 +740,42 @@ enum htt_stats_internal_ppdu_frametype {
   * dword6 - b'0:31 -  tlv_filter_in_flags:
   *                    Filter in Attention/MPDU/PPDU/Header/User tlvs
   *                    Refer to CFG_TLV_FILTER_IN_FLAG defs
@@ -119,7 +119,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
   */
  
  #define HTT_RX_RING_SELECTION_CFG_CMD_INFO0_MSG_TYPE	GENMASK(7, 0)
-@@ -735,8 +787,16 @@ enum htt_stats_internal_ppdu_frametype {
+@@ -735,8 +783,16 @@ enum htt_stats_internal_ppdu_frametype {
  #define HTT_RX_RING_SELECTION_CFG_CMD_INFO0_RING_ID	GENMASK(23, 16)
  #define HTT_RX_RING_SELECTION_CFG_CMD_INFO0_SS		BIT(24)
  #define HTT_RX_RING_SELECTION_CFG_CMD_INFO0_PS		BIT(25)
@@ -136,7 +136,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  enum htt_rx_filter_tlv_flags {
  	HTT_RX_FILTER_TLV_FLAGS_MPDU_START		= BIT(0),
-@@ -1040,6 +1100,14 @@ enum htt_rx_data_pkt_filter_tlv_flasg3 {
+@@ -1040,6 +1096,14 @@ enum htt_rx_data_pkt_filter_tlv_flasg3 {
  		HTT_RX_FILTER_TLV_FLAGS_PER_MSDU_HEADER | \
  		HTT_RX_FILTER_TLV_FLAGS_ATTENTION)
  
@@ -151,7 +151,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  struct htt_rx_ring_selection_cfg_cmd {
  	u32 info0;
  	u32 info1;
-@@ -1048,6 +1116,10 @@ struct htt_rx_ring_selection_cfg_cmd {
+@@ -1048,6 +1112,10 @@ struct htt_rx_ring_selection_cfg_cmd {
  	u32 pkt_type_en_flags2;
  	u32 pkt_type_en_flags3;
  	u32 rx_filter_tlv;
@@ -162,7 +162,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  } __packed;
  
  struct htt_rx_ring_tlv_filter {
-@@ -1056,6 +1128,14 @@ struct htt_rx_ring_tlv_filter {
+@@ -1056,6 +1124,14 @@ struct htt_rx_ring_tlv_filter {
  	u32 pkt_filter_flags1; /* MGMT */
  	u32 pkt_filter_flags2; /* CTRL */
  	u32 pkt_filter_flags3; /* DATA */
@@ -228,7 +228,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  static void ath11k_dp_service_mon_ring(struct timer_list *t)
  {
  	struct ath11k_base *ab = from_timer(ab, t, mon_reap_timer);
-@@ -2387,6 +2422,49 @@ int ath11k_dp_rx_crypto_icv_len(struct a
+@@ -2389,6 +2424,49 @@ int ath11k_dp_rx_crypto_icv_len(struct a
  	return 0;
  }
  
@@ -278,7 +278,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  static void ath11k_dp_rx_h_undecap_nwifi(struct ath11k *ar,
  					 struct sk_buff *msdu,
  					 u8 *first_hdr,
-@@ -2400,7 +2478,8 @@ static void ath11k_dp_rx_h_undecap_nwifi
+@@ -2402,7 +2480,8 @@ static void ath11k_dp_rx_h_undecap_nwifi
  	u8 da[ETH_ALEN];
  	u8 sa[ETH_ALEN];
  	u16 qos_ctl = 0;
@@ -288,7 +288,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  	/* copy SA & DA and pull decapped header */
  	hdr = (struct ieee80211_hdr *)msdu->data;
-@@ -2409,7 +2488,7 @@ static void ath11k_dp_rx_h_undecap_nwifi
+@@ -2411,7 +2490,7 @@ static void ath11k_dp_rx_h_undecap_nwifi
  	ether_addr_copy(sa, ieee80211_get_SA(hdr));
  	skb_pull(msdu, ieee80211_hdrlen(hdr->frame_control));
  
@@ -297,7 +297,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		/* original 802.11 header is valid for the first msdu
  		 * hence we can reuse the same header
  		 */
-@@ -2439,16 +2518,23 @@ static void ath11k_dp_rx_h_undecap_nwifi
+@@ -2441,16 +2520,23 @@ static void ath11k_dp_rx_h_undecap_nwifi
  
  		/* copy decap header before overwriting for reuse below */
  		memcpy(decap_hdr, (uint8_t *)hdr, hdr_len);
@@ -326,7 +326,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		memcpy(skb_push(msdu,
  				IEEE80211_QOS_CTL_LEN), &qos_ctl,
  				IEEE80211_QOS_CTL_LEN);
-@@ -2564,6 +2650,20 @@ static void ath11k_dp_rx_h_undecap_eth(s
+@@ -2566,6 +2652,20 @@ static void ath11k_dp_rx_h_undecap_eth(s
  	u8 da[ETH_ALEN];
  	u8 sa[ETH_ALEN];
  	void *rfc1042;
@@ -347,7 +347,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  	rfc1042 = ath11k_dp_rx_h_find_rfc1042(ar, msdu, enctype);
  	if (WARN_ON_ONCE(!rfc1042))
-@@ -2592,6 +2692,7 @@ static void ath11k_dp_rx_h_undecap_eth(s
+@@ -2594,6 +2694,7 @@ static void ath11k_dp_rx_h_undecap_eth(s
  
  	memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
  
@@ -355,7 +355,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	/* original 802.11 header has a different DA and in
  	 * case of 4addr it may also have different SA
  	 */
-@@ -2610,6 +2711,7 @@ static void ath11k_dp_rx_h_undecap_snap(
+@@ -2612,6 +2713,7 @@ static void ath11k_dp_rx_h_undecap_snap(
  	size_t hdr_len;
  	u8 l3_pad_bytes;
  	struct hal_rx_desc *rx_desc;
@@ -363,7 +363,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  	/* Delivered decapped frame:
  	 * [amsdu header] <-- replaced with 802.11 hdr
-@@ -2623,6 +2725,11 @@ static void ath11k_dp_rx_h_undecap_snap(
+@@ -2625,6 +2727,11 @@ static void ath11k_dp_rx_h_undecap_snap(
  	skb_put(msdu, l3_pad_bytes);
  	skb_pull(msdu, sizeof(struct ath11k_dp_amsdu_subframe_hdr) + l3_pad_bytes);
  
@@ -375,7 +375,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	hdr = (struct ieee80211_hdr *)first_hdr;
  	hdr_len = ieee80211_hdrlen(hdr->frame_control);
  
-@@ -3097,6 +3204,20 @@ static int ath11k_dp_rx_process_msdu(str
+@@ -3098,6 +3205,20 @@ static int ath11k_dp_rx_process_msdu(str
  		goto free_out;
  	}
  
@@ -396,7 +396,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	rxcb = ATH11K_SKB_RXCB(msdu);
  	rxcb->rx_desc = rx_desc;
  	msdu_len = ath11k_dp_rx_h_msdu_start_msdu_len(ab, rx_desc);
-@@ -3109,8 +3230,9 @@ static int ath11k_dp_rx_process_msdu(str
+@@ -3110,8 +3231,9 @@ static int ath11k_dp_rx_process_msdu(str
  			hdr_status = ath11k_dp_rx_h_80211_hdr(ab, rx_desc);
  			ret = -EINVAL;
  			ath11k_warn(ab, "invalid msdu len %u\n", msdu_len);
@@ -408,7 +408,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  			ath11k_dbg_dump(ab, ATH11K_DBG_DATA, NULL, "", rx_desc,
  					sizeof(struct hal_rx_desc));
  			goto free_out;
-@@ -4069,6 +4191,7 @@ static int ath11k_dp_rx_h_verify_tkip_mi
+@@ -4070,6 +4192,7 @@ static int ath11k_dp_rx_h_verify_tkip_mi
  
  	hdr = (struct ieee80211_hdr *)(msdu->data + hal_rx_desc_sz);
  	hdr_len = ieee80211_hdrlen(hdr->frame_control);
@@ -416,7 +416,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	head_len = hdr_len + hal_rx_desc_sz + IEEE80211_TKIP_IV_LEN;
  	tail_len = IEEE80211_CCMP_MIC_LEN + IEEE80211_TKIP_ICV_LEN + FCS_LEN;
  
-@@ -4349,8 +4472,8 @@ static void ath11k_dp_rx_h_sort_frags(st
+@@ -4350,8 +4473,8 @@ static void ath11k_dp_rx_h_sort_frags(st
  
  static u64 ath11k_dp_rx_h_get_pn(struct ath11k *ar, struct sk_buff *skb)
  {
@@ -426,7 +426,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	u8 *ehdr;
  	u32 hal_rx_desc_sz = ar->ab->hw_params.hal_desc_sz;
  
-@@ -4580,8 +4703,9 @@ ath11k_dp_process_rx_err_buf(struct ath1
+@@ -4581,8 +4704,9 @@ ath11k_dp_process_rx_err_buf(struct ath1
  	if ((msdu_len + hal_rx_desc_sz) > DP_RX_BUFFER_SIZE) {
  		hdr_status = ath11k_dp_rx_h_80211_hdr(ar->ab, rx_desc);
  		ath11k_warn(ar->ab, "invalid msdu leng %u", msdu_len);
@@ -438,7 +438,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "", rx_desc,
  				sizeof(struct hal_rx_desc));
  		dev_kfree_skb_any(msdu);
-@@ -5206,6 +5330,47 @@ void ath11k_dp_rx_pdev_free(struct ath11
+@@ -5207,6 +5331,47 @@ void ath11k_dp_rx_pdev_free(struct ath11
  	ath11k_dp_rxdma_pdev_buf_free(ar);
  }
  
@@ -486,7 +486,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  int ath11k_dp_rx_pdev_alloc(struct ath11k_base *ab, int mac_id)
  {
  	struct ath11k *ar = ab->pdevs[mac_id].ar;
-@@ -5299,6 +5464,12 @@ config_refill_ring:
+@@ -5300,6 +5465,12 @@ config_refill_ring:
  		}
  	}
  
@@ -501,7 +501,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
 --- a/drivers/net/wireless/ath/ath11k/dp_tx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
-@@ -1264,6 +1264,8 @@ int ath11k_dp_tx_htt_rx_filter_setup(str
+@@ -1263,6 +1263,8 @@ int ath11k_dp_tx_htt_rx_filter_setup(str
  				 !!(params.flags & HAL_SRNG_FLAGS_MSI_SWAP));
  	cmd->info0 |= FIELD_PREP(HTT_RX_RING_SELECTION_CFG_CMD_INFO0_PS,
  				 !!(params.flags & HAL_SRNG_FLAGS_DATA_TLV_SWAP));
@@ -510,7 +510,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  	cmd->info1 = FIELD_PREP(HTT_RX_RING_SELECTION_CFG_CMD_INFO1_BUF_SIZE,
  				rx_buf_size);
-@@ -1273,6 +1275,26 @@ int ath11k_dp_tx_htt_rx_filter_setup(str
+@@ -1272,6 +1274,26 @@ int ath11k_dp_tx_htt_rx_filter_setup(str
  	cmd->pkt_type_en_flags3 = tlv_filter->pkt_filter_flags3;
  	cmd->rx_filter_tlv = tlv_filter->rx_filter;
  
@@ -537,7 +537,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	ret = ath11k_htc_send(&ab->htc, ab->dp.eid, skb);
  	if (ret)
  		goto err_free;
-@@ -1351,6 +1373,7 @@ int ath11k_dp_tx_htt_monitor_mode_ring_c
+@@ -1350,6 +1372,7 @@ int ath11k_dp_tx_htt_monitor_mode_ring_c
  	}
  
  	ring_id = dp->rxdma_mon_buf_ring.refill_buf_ring.ring_id;
@@ -933,7 +933,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  extern const struct ath11k_hw_ops ipq8074_ops;
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -6455,6 +6455,7 @@ static int ath11k_mac_config_mon_status_
+@@ -6450,6 +6450,7 @@ static int ath11k_mac_config_mon_status_
  			tlv_filter.rx_filter = ath11k_debugfs_rx_filter(ar);
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-312-ath11k-add-ampdu-id-in-802.11-radiotap-header.patch b/package/kernel/mac80211/patches/nss/ath11k/999-312-ath11k-add-ampdu-id-in-802.11-radiotap-header.patch
index 1f554ae95ccc69..12a035bf4e5790 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-312-ath11k-add-ampdu-id-in-802.11-radiotap-header.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-312-ath11k-add-ampdu-id-in-802.11-radiotap-header.patch
@@ -25,7 +25,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -5994,6 +5994,7 @@ static void ath11k_update_radiotap(struc
+@@ -5995,6 +5995,7 @@ static void ath11k_update_radiotap(struc
  {
  	struct ieee80211_supported_band *sband;
  	u8 *ptr = NULL;
@@ -33,7 +33,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  
  	rxs->flag |= RX_FLAG_MACTIME_START;
  	rxs->signal = ppduinfo->rssi_comb + ATH11K_DEFAULT_NOISE_FLOOR;
-@@ -6001,6 +6002,11 @@ static void ath11k_update_radiotap(struc
+@@ -6002,6 +6003,11 @@ static void ath11k_update_radiotap(struc
  	if (ppduinfo->nss)
  		rxs->nss = ppduinfo->nss;
  
@@ -128,7 +128,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  struct hal_rx_rxpcu_classification_overview {
 --- a/drivers/net/wireless/ath/ath11k/hw.h
 +++ b/drivers/net/wireless/ath/ath11k/hw.h
-@@ -306,6 +306,7 @@ struct ath11k_hw_ops {
+@@ -307,6 +307,7 @@ struct ath11k_hw_ops {
  	void (*rx_desc_get_crypto_header)(struct hal_rx_desc *desc,
  					  u8 *crypto_hdr,
  					  enum hal_encrypt_type enctype);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-336-0001-ath11k-idr-optimization.patch b/package/kernel/mac80211/patches/nss/ath11k/999-336-0001-ath11k-idr-optimization.patch
index 499f720caba8cb..ef01c639a266b4 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-336-0001-ath11k-idr-optimization.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-336-0001-ath11k-idr-optimization.patch
@@ -28,7 +28,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  }
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -3336,18 +3336,16 @@ try_again:
+@@ -3385,18 +3385,16 @@ try_again:
  		ar = ab->pdevs[mac_id].ar;
  		rx_ring = &ar->dp.rx_refill_buf_ring;
  		spin_lock_bh(&rx_ring->idr_lock);
@@ -50,7 +50,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  		dma_unmap_single(ab->dev, rxcb->paddr,
  				 msdu->len + skb_tailroom(msdu),
  				 DMA_FROM_DEVICE);
-@@ -4574,17 +4572,14 @@ ath11k_dp_process_rx_err_buf(struct ath1
+@@ -4667,17 +4665,14 @@ ath11k_dp_process_rx_err_buf(struct ath1
  	u32 hal_rx_desc_sz = ar->ab->hw_params.hal_desc_sz;
  
  	spin_lock_bh(&rx_ring->idr_lock);
@@ -70,7 +70,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	rxcb = ATH11K_SKB_RXCB(msdu);
  	dma_unmap_single(ar->ab->dev, rxcb->paddr,
  			 msdu->len + skb_tailroom(msdu),
-@@ -5005,18 +5000,16 @@ int ath11k_dp_rx_process_wbm_err(struct
+@@ -5083,18 +5078,16 @@ int ath11k_dp_rx_process_wbm_err(struct
  		rx_ring = &ar->dp.rx_refill_buf_ring;
  
  		spin_lock_bh(&rx_ring->idr_lock);
@@ -92,7 +92,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  		dma_unmap_single(ab->dev, rxcb->paddr,
  				 msdu->len + skb_tailroom(msdu),
  				 DMA_FROM_DEVICE);
-@@ -5131,16 +5124,14 @@ int ath11k_dp_process_rxdma_err(struct a
+@@ -5209,16 +5202,14 @@ int ath11k_dp_process_rxdma_err(struct a
  					   msdu_cookies[i]);
  
  			spin_lock_bh(&rx_ring->idr_lock);
@@ -111,7 +111,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  
  			rxcb = ATH11K_SKB_RXCB(skb);
  			dma_unmap_single(ab->dev, rxcb->paddr,
-@@ -6399,16 +6390,14 @@ ath11k_dp_rx_full_mon_mpdu_pop(struct at
+@@ -6429,16 +6420,14 @@ ath11k_dp_rx_full_mon_mpdu_pop(struct at
  					   msdu_list.sw_cookie[i]);
  
  			spin_lock_bh(&rx_ring->idr_lock);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch b/package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch
index c5134fca93a867..974de141070d63 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch
@@ -114,7 +114,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	return 0;
  }
  
-@@ -3346,11 +3365,14 @@ int ath11k_dp_process_rx(struct ath11k_b
+@@ -3347,11 +3366,14 @@ int ath11k_dp_process_rx(struct ath11k_b
  	struct ath11k *ar;
  	struct hal_reo_dest_ring *desc;
  	enum hal_reo_dest_ring_push_reason push_reason;
@@ -130,7 +130,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  
  	srng = &ab->hal.srng_list[dp->reo_dst_ring[ring_id].ring_id];
  
-@@ -3385,8 +3407,15 @@ try_again:
+@@ -3384,8 +3406,15 @@ try_again:
  
  		ar = ab->pdevs[mac_id].ar;
  		rx_ring = &ar->dp.rx_refill_buf_ring;
@@ -147,7 +147,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  		spin_unlock_bh(&rx_ring->idr_lock);
  		if (unlikely(!msdu)) {
  			ath11k_warn(ab, "frame rx with invalid buf_id %d\n",
-@@ -3464,9 +3493,12 @@ try_again:
+@@ -3463,9 +3492,12 @@ try_again:
  		rx_ring = &ar->dp.rx_refill_buf_ring;
  
  		ath11k_dp_rxbufs_replenish(ab, i, rx_ring, num_buffs_reaped[i],
@@ -161,7 +161,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	return total_msdu_reaped;
  }
  
-@@ -4831,7 +4864,7 @@ exit:
+@@ -4827,7 +4859,7 @@ exit:
  		rx_ring = &ar->dp.rx_refill_buf_ring;
  
  		ath11k_dp_rxbufs_replenish(ab, i, rx_ring, n_bufs_reaped[i],
@@ -170,7 +170,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	}
  
  	return tot_n_bufs_reaped;
-@@ -5047,14 +5080,17 @@ int ath11k_dp_rx_process_wbm_err(struct
+@@ -5043,14 +5075,17 @@ int ath11k_dp_rx_process_wbm_err(struct
  	struct sk_buff *msdu;
  	struct sk_buff_head msdu_list[MAX_RADIOS];
  	struct ath11k_skb_rxcb *rxcb;
@@ -189,7 +189,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  
  	srng = &ab->hal.srng_list[dp->rx_rel_ring.ring_id];
  
-@@ -5077,9 +5112,15 @@ int ath11k_dp_rx_process_wbm_err(struct
+@@ -5076,9 +5111,15 @@ int ath11k_dp_rx_process_wbm_err(struct
  
  		ar = ab->pdevs[mac_id].ar;
  		rx_ring = &ar->dp.rx_refill_buf_ring;
@@ -206,7 +206,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  		spin_unlock_bh(&rx_ring->idr_lock);
  		if (!msdu) {
  			ath11k_warn(ab, "frame rx with invalid buf_id %d pdev %d\n",
-@@ -5124,7 +5165,7 @@ int ath11k_dp_rx_process_wbm_err(struct
+@@ -5123,7 +5164,7 @@ int ath11k_dp_rx_process_wbm_err(struct
  		rx_ring = &ar->dp.rx_refill_buf_ring;
  
  		ath11k_dp_rxbufs_replenish(ab, i, rx_ring, num_buffs_reaped[i],
@@ -215,7 +215,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	}
  
  	rcu_read_lock();
-@@ -5151,6 +5187,8 @@ int ath11k_dp_rx_process_wbm_err(struct
+@@ -5145,6 +5186,8 @@ int ath11k_dp_rx_process_wbm_err(struct
  	}
  	rcu_read_unlock();
  done:
@@ -224,7 +224,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	return total_num_buffs_reaped;
  }
  
-@@ -5238,7 +5276,7 @@ int ath11k_dp_process_rxdma_err(struct a
+@@ -5230,7 +5273,7 @@ int ath11k_dp_process_rxdma_err(struct a
  
  	if (num_buf_freed)
  		ath11k_dp_rxbufs_replenish(ab, mac_id, rx_ring, num_buf_freed,
@@ -233,7 +233,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  
  	return budget - quota;
  }
-@@ -6184,12 +6222,12 @@ static void ath11k_dp_rx_mon_dest_proces
+@@ -6182,12 +6225,12 @@ static void ath11k_dp_rx_mon_dest_proces
  			ath11k_dp_rxbufs_replenish(ar->ab, dp->mac_id,
  						   &dp->rxdma_mon_buf_ring,
  						   rx_bufs_used,
@@ -248,7 +248,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	}
  }
  
-@@ -6701,7 +6739,7 @@ next_entry:
+@@ -6697,7 +6740,7 @@ next_entry:
  		ath11k_dp_rxbufs_replenish(ar->ab, dp->mac_id,
  					   &dp->rxdma_mon_buf_ring,
  					   rx_bufs_used,
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-374-ath11k-Check-skb_headroom-before-using-skb_push.patch b/package/kernel/mac80211/patches/nss/ath11k/999-374-ath11k-Check-skb_headroom-before-using-skb_push.patch
index b58b13eebe1d40..988717c1dbc257 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-374-ath11k-Check-skb_headroom-before-using-skb_push.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-374-ath11k-Check-skb_headroom-before-using-skb_push.patch
@@ -217,7 +217,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
  }
  
-@@ -2890,7 +2954,7 @@ static void ath11k_dp_rx_h_mpdu(struct a
+@@ -2889,7 +2953,7 @@ static void ath11k_dp_rx_h_mpdu(struct a
  				struct ieee80211_rx_status *rx_status,
  				bool *fast_rx)
  {
@@ -226,7 +226,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	enum hal_encrypt_type enctype;
  	bool is_decrypted = false;
  	struct ath11k_skb_rxcb *rxcb;
-@@ -3123,10 +3187,16 @@ static void ath11k_dp_rx_deliver_msdu(st
+@@ -3122,10 +3186,16 @@ static void ath11k_dp_rx_deliver_msdu(st
  	u8 decap = DP_RX_DECAP_TYPE_RAW;
  	bool is_mcbc = rxcb->is_mcbc;
  	bool is_eapol = rxcb->is_eapol;
@@ -243,7 +243,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  		he = skb_push(msdu, sizeof(known));
  		memcpy(he, &known, sizeof(known));
  		status->flag |= RX_FLAG_RADIOTAP_HE;
-@@ -3182,6 +3252,7 @@ static void ath11k_dp_rx_deliver_msdu(st
+@@ -3181,6 +3251,7 @@ static void ath11k_dp_rx_deliver_msdu(st
  	    !(is_mcbc && rx_status->flag & RX_FLAG_DECRYPTED))
  		rx_status->flag |= RX_FLAG_8023;
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/007-fix_compilation_issue.patch b/package/kernel/mac80211/patches/nss/subsys/007-fix_compilation_issue.patch
index d89cfbe51cb8ab..7a9b58411d0e1c 100644
--- a/package/kernel/mac80211/patches/nss/subsys/007-fix_compilation_issue.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/007-fix_compilation_issue.patch
@@ -50,7 +50,7 @@
  }
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -4780,7 +4780,7 @@ void ieee80211_color_collision_detection
+@@ -4779,7 +4779,7 @@ void ieee80211_color_collision_detection
  	struct ieee80211_sub_if_data *sdata = link->sdata;
  
  	sdata_lock(sdata);
@@ -72,7 +72,7 @@
  	sdata->debugfs.subdir_stations = debugfs_create_dir("stations",
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -1410,18 +1410,6 @@ static void __sta_info_destroy_part2(str
+@@ -1414,18 +1414,6 @@ static void __sta_info_destroy_part2(str
  		WARN_ON_ONCE(ret);
  	}
  
@@ -93,7 +93,7 @@
  
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -19472,7 +19472,7 @@ void cfg80211_ch_switch_started_notify(s
+@@ -19484,7 +19484,7 @@ void cfg80211_ch_switch_started_notify(s
  }
  EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
  
@@ -102,7 +102,7 @@
  			      enum nl80211_commands cmd, u8 count,
  			      u64 color_bitmap)
  {
-@@ -19486,7 +19486,7 @@ int cfg80211_bss_color_notify(struct net
+@@ -19498,7 +19498,7 @@ int cfg80211_bss_color_notify(struct net
  
  	trace_cfg80211_bss_color_notify(dev, cmd, count, color_bitmap);
  
@@ -111,7 +111,7 @@
  	if (!msg)
  		return -ENOMEM;
  
-@@ -19509,7 +19509,7 @@ int cfg80211_bss_color_notify(struct net
+@@ -19521,7 +19521,7 @@ int cfg80211_bss_color_notify(struct net
  	genlmsg_end(msg, hdr);
  
  	return genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
diff --git a/package/kernel/mac80211/patches/nss/subsys/146-mac80211-enable-TKIP-when-using-encapsulation-offloading.patch b/package/kernel/mac80211/patches/nss/subsys/146-mac80211-enable-TKIP-when-using-encapsulation-offloading.patch
index a5da9e91eae835..86b2f2169bb79f 100644
--- a/package/kernel/mac80211/patches/nss/subsys/146-mac80211-enable-TKIP-when-using-encapsulation-offloading.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/146-mac80211-enable-TKIP-when-using-encapsulation-offloading.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4688,8 +4688,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4689,8 +4689,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  	if (!key)
  		key = rcu_dereference(sdata->default_unicast_key);
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch b/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch
index fc8fec0660f352..ecdf4d15c0c896 100644
--- a/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch
@@ -53,7 +53,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  };
  
  /**
-@@ -1408,7 +1424,7 @@ ieee80211_tx_info_clear_status(struct ie
+@@ -1410,7 +1426,7 @@ ieee80211_tx_info_clear_status(struct ie
   * @RX_FLAG_AMPDU_EOF_BIT_KNOWN: The EOF value is known
   * @RX_FLAG_RADIOTAP_HE: HE radiotap data is present
   *	(&struct ieee80211_radiotap_he, mac80211 will fill in
@@ -62,7 +62,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   *	 - DATA3_DATA_MCS
   *	 - DATA3_DATA_DCM
   *	 - DATA3_CODING
-@@ -1416,7 +1432,7 @@ ieee80211_tx_info_clear_status(struct ie
+@@ -1418,7 +1434,7 @@ ieee80211_tx_info_clear_status(struct ie
   *	 - DATA5_DATA_BW_RU_ALLOC
   *	 - DATA6_NSTS
   *	 - DATA3_STBC
@@ -71,7 +71,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   *	from the RX info data, so leave those zeroed when building this data)
   * @RX_FLAG_RADIOTAP_HE_MU: HE MU radiotap data is present
   *	(&struct ieee80211_radiotap_he_mu)
-@@ -1989,6 +2005,16 @@ static inline bool lockdep_vif_mutex_hel
+@@ -1991,6 +2007,16 @@ static inline bool lockdep_vif_mutex_hel
  			      lockdep_vif_mutex_held(vif))
  
  /**
@@ -88,7 +88,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   * enum ieee80211_key_flags - key flags
   *
   * These flags are used for communication about keys between the driver
-@@ -2680,6 +2706,8 @@ struct ieee80211_txq {
+@@ -2682,6 +2708,8 @@ struct ieee80211_txq {
   * @IEEE80211_HW_MLO_MCAST_MULTI_LINK_TX: Hardware/driver handles transmitting
   *	multicast frames on all links, mac80211 should not do that.
   *
@@ -97,7 +97,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
   */
  enum ieee80211_hw_flags {
-@@ -2737,6 +2765,7 @@ enum ieee80211_hw_flags {
+@@ -2739,6 +2767,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_SUPPORTS_CONC_MON_RX_DECAP,
  	IEEE80211_HW_DETECTS_COLOR_COLLISION,
  	IEEE80211_HW_MLO_MCAST_MULTI_LINK_TX,
@@ -105,7 +105,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	/* keep last, obviously */
  	NUM_IEEE80211_HW_FLAGS
-@@ -3749,6 +3778,10 @@ struct ieee80211_prep_tx_info {
+@@ -3751,6 +3780,10 @@ struct ieee80211_prep_tx_info {
   *	non-MLO connections.
   *	The callback can sleep.
   *
@@ -116,7 +116,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   * @prepare_multicast: Prepare for multicast filter configuration.
   *	This callback is optional, and its return value is passed
   *	to configure_filter(). This callback must be atomic.
-@@ -4300,7 +4333,9 @@ struct ieee80211_ops {
+@@ -4302,7 +4335,9 @@ struct ieee80211_ops {
  				  struct ieee80211_vif *vif,
  				  struct ieee80211_bss_conf *info,
  				  u64 changed);
@@ -127,7 +127,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	int (*start_ap)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			struct ieee80211_bss_conf *link_conf);
  	void (*stop_ap)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-@@ -4605,7 +4640,7 @@ struct ieee80211_ops {
+@@ -4607,7 +4642,7 @@ struct ieee80211_ops {
  	int (*reset_tid_config)(struct ieee80211_hw *hw,
  				struct ieee80211_vif *vif,
  				struct ieee80211_sta *sta, u8 tids);
@@ -225,7 +225,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		return -EINVAL;
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -2370,6 +2370,9 @@ sta_get_last_rx_stats(struct sta_info *s
+@@ -2390,6 +2390,9 @@ sta_get_last_rx_stats(struct sta_info *s
  	struct ieee80211_sta_rx_stats *stats = &sta->deflink.rx_stats;
  	int cpu;
  
@@ -272,7 +272,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		info_id = ieee80211_store_ack_skb(local, skb, &info_flags,
  						  cookie);
  
-@@ -4641,13 +4655,16 @@ static void ieee80211_8023_xmit(struct i
+@@ -4642,13 +4656,16 @@ static void ieee80211_8023_xmit(struct i
  	}
  
  	if (unlikely(skb->sk &&
@@ -306,7 +306,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  				gfp);
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2679,7 +2679,7 @@ static int ieee80211_change_bss(struct w
+@@ -2678,7 +2678,7 @@ static int ieee80211_change_bss(struct w
  	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	struct ieee80211_link_data *link;
  	struct ieee80211_supported_band *sband;
@@ -315,7 +315,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	link = ieee80211_link_or_deflink(sdata, params->link_id, true);
  	if (IS_ERR(link))
-@@ -2729,6 +2729,8 @@ static int ieee80211_change_bss(struct w
+@@ -2728,6 +2728,8 @@ static int ieee80211_change_bss(struct w
  			sdata->flags |= IEEE80211_SDATA_DONT_BRIDGE_PACKETS;
  		else
  			sdata->flags &= ~IEEE80211_SDATA_DONT_BRIDGE_PACKETS;
@@ -324,7 +324,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		ieee80211_check_fast_rx_iface(sdata);
  	}
  
-@@ -2757,6 +2759,8 @@ static int ieee80211_change_bss(struct w
+@@ -2756,6 +2758,8 @@ static int ieee80211_change_bss(struct w
  
  	ieee80211_link_info_change_notify(sdata, link, changed);
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/199-mac80211-fix-xmit-callback-when-hwencap-enable-in-st.patch b/package/kernel/mac80211/patches/nss/subsys/199-mac80211-fix-xmit-callback-when-hwencap-enable-in-st.patch
index fffe171334c9a4..01740e29803580 100644
--- a/package/kernel/mac80211/patches/nss/subsys/199-mac80211-fix-xmit-callback-when-hwencap-enable-in-st.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/199-mac80211-fix-xmit-callback-when-hwencap-enable-in-st.patch
@@ -18,7 +18,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -6215,7 +6215,13 @@ start_xmit:
+@@ -6216,7 +6216,13 @@ start_xmit:
  	mutex_lock(&local->mtx);
  
  	local_bh_disable();
diff --git a/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch b/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
index bd9c1c024b1e5d..d4410bd712f669 100644
--- a/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
@@ -49,7 +49,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  #endif /* __NET_CFG80211_H */
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -7361,6 +7361,20 @@ u32 ieee80211_calc_rx_airtime(struct iee
+@@ -7363,6 +7363,20 @@ u32 ieee80211_calc_rx_airtime(struct iee
  			      int len);
  
  /**
@@ -158,7 +158,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  #undef TRACE_INCLUDE_PATH
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -20199,6 +20199,42 @@ nla_put_failure:
+@@ -20211,6 +20211,42 @@ nla_put_failure:
  }
  EXPORT_SYMBOL(cfg80211_update_owe_info_event);
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/207-ath11k-Add-support-for-dynamic-vlan.patch b/package/kernel/mac80211/patches/nss/subsys/207-ath11k-Add-support-for-dynamic-vlan.patch
index 15d796071fa077..5ae1ba64bba9d5 100644
--- a/package/kernel/mac80211/patches/nss/subsys/207-ath11k-Add-support-for-dynamic-vlan.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/207-ath11k-Add-support-for-dynamic-vlan.patch
@@ -29,7 +29,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  /* misc utils */
  
  static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
-@@ -4270,6 +4273,8 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4271,6 +4274,8 @@ void __ieee80211_subif_start_xmit(struct
  	struct sta_info *sta;
  	struct sk_buff *next;
  	int len = skb->len;
@@ -38,7 +38,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  
  	if (unlikely(!ieee80211_sdata_running(sdata) || skb->len < ETH_HLEN)) {
  		kfree_skb(skb);
-@@ -4291,6 +4296,19 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4292,6 +4297,19 @@ void __ieee80211_subif_start_xmit(struct
  	if (IS_ERR(sta))
  		sta = NULL;
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch b/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
index a4895803b38ba0..38d737dc37d96a 100644
--- a/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
@@ -209,7 +209,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4503,6 +4503,35 @@ static void ieee80211_mlo_multicast_tx(s
+@@ -4504,6 +4504,35 @@ static void ieee80211_mlo_multicast_tx(s
  	kfree_skb(skb);
  }
  
@@ -245,7 +245,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  /**
   * ieee80211_subif_start_xmit - netif start_xmit function for 802.3 vifs
   * @skb: packet to be sent
-@@ -4516,6 +4545,10 @@ netdev_tx_t ieee80211_subif_start_xmit(s
+@@ -4517,6 +4546,10 @@ netdev_tx_t ieee80211_subif_start_xmit(s
  	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	const struct ethhdr *eth = (void *)skb->data;
  
@@ -256,7 +256,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	if (likely(!is_multicast_ether_addr(eth->h_dest)))
  		goto normal;
  
-@@ -4702,6 +4735,9 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4703,6 +4736,9 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  	struct ieee80211_key *key;
  	struct sta_info *sta;
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch b/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
index 55e2fff1560fb8..3d543d714122dd 100644
--- a/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
@@ -21,7 +21,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -5098,6 +5098,17 @@ void ieee80211_sta_pspoll(struct ieee802
+@@ -5100,6 +5100,17 @@ void ieee80211_sta_pspoll(struct ieee802
   */
  void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *sta, u8 tid);
  
@@ -137,7 +137,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  {
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4297,8 +4297,13 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4298,8 +4298,13 @@ void __ieee80211_subif_start_xmit(struct
  		sta = NULL;
  
          if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
@@ -153,7 +153,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
                  if (ap_sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED &&
                      !is_multicast_ether_addr(skb->data)) {
                          if (sta)
-@@ -4688,7 +4693,8 @@ static void ieee80211_8023_xmit(struct i
+@@ -4689,7 +4694,8 @@ static void ieee80211_8023_xmit(struct i
  
  	info->hw_queue = sdata->vif.hw_queue[queue];
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch b/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
index 803ee900bfdcc1..542ab4e6a93831 100644
--- a/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
@@ -24,7 +24,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2086,6 +2086,8 @@ enum ieee80211_key_flags {
+@@ -2088,6 +2088,8 @@ enum ieee80211_key_flags {
   * @tx_pn: PN used for TX keys, may be used by the driver as well if it
   *	needs to do software PN assignment by itself (e.g. due to TSO)
   * @flags: key flags, see &enum ieee80211_key_flags.
@@ -33,7 +33,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
   * @keyidx: the key index (0-3)
   * @keylen: key material length
   * @key: key material. For ALG_TKIP the key is encoded as a 256-bit (32 byte)
-@@ -2105,6 +2107,7 @@ struct ieee80211_key_conf {
+@@ -2107,6 +2109,7 @@ struct ieee80211_key_conf {
  	u8 hw_key_idx;
  	s8 keyidx;
  	u16 flags;
@@ -102,7 +102,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	key->conf.cipher = cipher;
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4649,16 +4649,25 @@ static void ieee80211_8023_xmit(struct i
+@@ -4650,16 +4650,25 @@ static void ieee80211_8023_xmit(struct i
  				struct ieee80211_key *key, struct sk_buff *skb)
  {
  	struct ieee80211_tx_info *info;
diff --git a/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch b/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch
index 46b716419a7cd8..0e92c0f1332b7d 100644
--- a/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch
@@ -18,17 +18,6 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  net/mac80211/tx.c                        | 54 ++++++++++++++++++++++----------
  7 files changed, 40 insertions(+), 23 deletions(-)
 
---- a/include/linux/backport-refcount.h
-+++ b/include/linux/backport-refcount.h
-@@ -247,7 +247,7 @@ static inline __must_check bool refcount
- 
- static inline void __refcount_inc(refcount_t *r, int *oldp)
- {
--	__refcount_add(1, r, oldp);
-+	refcount_add(1, r);
- }
- 
- /**
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
 @@ -207,6 +207,7 @@ enum ieee80211_rx_flags {
@@ -39,45 +28,9 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	struct list_head *list;
  	struct sk_buff *skb;
  	struct ieee80211_local *local;
-@@ -292,6 +293,7 @@ struct unsol_bcast_probe_resp_data {
- 	u8 data[];
- };
- 
-+
- struct ps_data {
- 	/* yes, this looks ugly, but guarantees that we can later use
- 	 * bitmap_empty :)
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -1705,7 +1705,6 @@ static void ieee80211_iface_work(struct
- 
- 	/* first process frames */
- 	while ((skb = skb_dequeue(&sdata->skb_queue))) {
--		kcov_remote_start_common(skb_get_kcov_handle(skb));
- 
- 		if (skb->protocol == cpu_to_be16(ETH_P_TDLS))
- 			ieee80211_process_tdls_channel_switch(sdata, skb);
-@@ -1713,17 +1712,14 @@ static void ieee80211_iface_work(struct
- 			ieee80211_iface_process_skb(local, sdata, skb);
- 
- 		kfree_skb(skb);
--		kcov_remote_stop();
- 	}
- 
- 	/* process status queue */
- 	while ((skb = skb_dequeue(&sdata->status_queue))) {
--		kcov_remote_start_common(skb_get_kcov_handle(skb));
- 
- 		ieee80211_iface_process_status(sdata, skb);
- 		kfree_skb(skb);
- 
--		kcov_remote_stop();
- 	}
- 
- 	/* then other type-dependent work */
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4678,19 +4678,21 @@ static void ieee80211_8023_xmit(struct i
+@@ -4679,19 +4679,21 @@ static void ieee80211_8023_xmit(struct i
  
  	ieee80211_aggr_check(sdata, sta, skb);
  
@@ -111,7 +64,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	}
  
  	skb = ieee80211_tx_skb_fixup(skb, ieee80211_sdata_netdev_features(sdata));
-@@ -4747,7 +4749,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4748,7 +4750,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  {
  	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	struct ethhdr *ehdr = (struct ethhdr *)skb->data;
@@ -120,7 +73,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	struct sta_info *sta;
  
  #ifdef CPTCFG_MAC80211_NSS_SUPPORT
-@@ -4765,9 +4767,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4766,9 +4768,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		goto out;
  	}
  
@@ -137,7 +90,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  		goto skip_offload;
  
  	key = rcu_dereference(sta->ptk[sta->ptk_idx]);
-@@ -4778,6 +4784,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4779,6 +4785,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		goto skip_offload;
  
  	sk_pacing_shift_update(skb->sk, sdata->local->hw.tx_sk_pacing_shift);
@@ -145,47 +98,18 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	ieee80211_8023_xmit(sdata, dev, sta, key, skb);
  	goto out;
  
-@@ -6284,13 +6291,7 @@ start_xmit:
+@@ -6285,13 +6292,7 @@ start_xmit:
  	mutex_lock(&local->mtx);
  
- 	if (pubsta) {
- 		sta = container_of(pubsta, struct sta_info, sta);
--		if (sta && napi) {
-+		if (sta) {
- 			if (!(status->flag & RX_FLAG_ONLY_MONITOR))
- 				atomic_inc(&sta->rx_drv_pkts);
- 		}
-@@ -5442,8 +5442,6 @@ void ieee80211_rx_list(struct ieee80211_
- 
- 	status->rx_flags = 0;
- 
--	kcov_remote_start_common(skb_get_kcov_handle(skb));
+ 	local_bh_disable();
 -
- 	/*
- 	 * Frames with failed FCS/PLCP checksum are not returned,
- 	 * all other frames are returned without radiotap header
-@@ -5463,7 +5461,6 @@ void ieee80211_rx_list(struct ieee80211_
- 			__ieee80211_rx_handle_packet(hw, pubsta, skb, list);
- 	}
- 
--	kcov_remote_stop();
- 	return;
-  drop:
- 	kfree_skb(skb);
---- a/backport-include/linux/skbuff.h
-+++ b/backport-include/linux/skbuff.h
-@@ -24,14 +24,6 @@ static inline void *backport___skb_push(
- }
- #define __skb_push LINUX_BACKPORT(__skb_push)
- 
--static inline void *__skb_put_zero(struct sk_buff *skb, unsigned int len)
--{
--	void *tmp = __skb_put(skb, len);
--
--	memset(tmp, 0, len);
--	return tmp;
--}
+-	/* added hardware encap check for ethernet mode */
+-	if (sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED)
+-		ieee80211_subif_start_xmit_8023(skb, skb->dev);
+-	else
+-		__ieee80211_subif_start_xmit(skb, skb->dev, flags, ctrl_flags, cookie);
 -
- static inline void *skb_put_zero(struct sk_buff *skb, unsigned int len)
- {
- 	void *tmp = skb_put(skb, len);
++	__ieee80211_subif_start_xmit(skb, skb->dev, flags, ctrl_flags, cookie);
+ 	local_bh_enable();
+ 
+ 	mutex_unlock(&local->mtx);
diff --git a/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch b/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
index 55ad36baf69aa4..e1b46836c6b4c5 100644
--- a/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
@@ -78,7 +78,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	bool eht_mu_beamformer;
  	bool nss_ap_isolate;
  };
-@@ -1273,6 +1287,8 @@ struct ieee80211_rate_status {
+@@ -1275,6 +1289,8 @@ struct ieee80211_rate_status {
   * @ack_hwtstamp: Hardware timestamp of the received ack in nanoseconds
   *	Only needed for Timing measurement and Fine timing measurement action
   *	frames. Only reported by devices that have timestamping enabled.
@@ -87,7 +87,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
   */
  struct ieee80211_tx_status {
  	struct ieee80211_sta *sta;
-@@ -1283,6 +1299,8 @@ struct ieee80211_tx_status {
+@@ -1285,6 +1301,8 @@ struct ieee80211_tx_status {
  	u8 n_rates;
  
  	struct list_head *free_list;
@@ -96,7 +96,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  };
  
  /**
-@@ -1775,6 +1793,7 @@ struct ieee80211_channel_switch {
+@@ -1777,6 +1795,7 @@ struct ieee80211_channel_switch {
   *	this is not pure P2P vif.
   * @IEEE80211_VIF_DISABLE_SMPS_OVERRIDE: disable user configuration of
   *	SMPS mode via debugfs.
@@ -104,7 +104,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
   */
  enum ieee80211_vif_flags {
  	IEEE80211_VIF_BEACON_FILTER		= BIT(0),
-@@ -1782,6 +1801,7 @@ enum ieee80211_vif_flags {
+@@ -1784,6 +1803,7 @@ enum ieee80211_vif_flags {
  	IEEE80211_VIF_SUPPORTS_UAPSD		= BIT(2),
  	IEEE80211_VIF_GET_NOA_UPDATE		= BIT(3),
  	IEEE80211_VIF_DISABLE_SMPS_OVERRIDE	= BIT(4),
@@ -112,7 +112,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  };
  
  
-@@ -2769,6 +2789,7 @@ enum ieee80211_hw_flags {
+@@ -2771,6 +2791,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_DETECTS_COLOR_COLLISION,
  	IEEE80211_HW_MLO_MCAST_MULTI_LINK_TX,
  	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
@@ -120,7 +120,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  
  	/* keep last, obviously */
  	NUM_IEEE80211_HW_FLAGS
-@@ -4269,6 +4290,8 @@ struct ieee80211_prep_tx_info {
+@@ -4271,6 +4292,8 @@ struct ieee80211_prep_tx_info {
   * @set_sar_specs: Update the SAR (TX power) settings.
   * @sta_set_decap_offload: Called to notify the driver when a station is allowed
   *	to use rx decapsulation offload
@@ -129,7 +129,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
   * @add_twt_setup: Update hw with TWT agreement parameters received from the peer.
   *	This callback allows the hw to check if requested parameters
   *	are supported and if there is enough room for a new agreement.
-@@ -4652,6 +4675,12 @@ struct ieee80211_ops {
+@@ -4654,6 +4677,12 @@ struct ieee80211_ops {
  	void (*sta_set_decap_offload)(struct ieee80211_hw *hw,
  				      struct ieee80211_vif *vif,
  				      struct ieee80211_sta *sta, bool enabled);
@@ -142,7 +142,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	void (*add_twt_setup)(struct ieee80211_hw *hw,
  			      struct ieee80211_sta *sta,
  			      struct ieee80211_twt_setup *twt);
-@@ -7510,4 +7539,100 @@ int ieee80211_set_active_links(struct ie
+@@ -7512,4 +7541,100 @@ int ieee80211_set_active_links(struct ie
  void ieee80211_set_active_links_async(struct ieee80211_vif *vif,
  				      u16 active_links);
  
@@ -245,7 +245,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  #endif /* MAC80211_H */
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2523,6 +2523,7 @@ static int ieee80211_update_mesh_config(
+@@ -2522,6 +2522,7 @@ static int ieee80211_update_mesh_config(
  	struct mesh_config *conf;
  	struct ieee80211_sub_if_data *sdata;
  	struct ieee80211_if_mesh *ifmsh;
@@ -253,7 +253,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  
  	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	ifmsh = &sdata->u.mesh;
-@@ -2539,8 +2540,11 @@ static int ieee80211_update_mesh_config(
+@@ -2538,8 +2539,11 @@ static int ieee80211_update_mesh_config(
  		conf->dot11MeshMaxPeerLinks = nconf->dot11MeshMaxPeerLinks;
  	if (_chg_mesh_attr(NL80211_MESHCONF_MAX_RETRIES, mask))
  		conf->dot11MeshMaxRetries = nconf->dot11MeshMaxRetries;
@@ -266,7 +266,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	if (_chg_mesh_attr(NL80211_MESHCONF_ELEMENT_TTL, mask))
  		conf->element_ttl = nconf->element_ttl;
  	if (_chg_mesh_attr(NL80211_MESHCONF_AUTO_OPEN_PLINKS, mask)) {
-@@ -2554,8 +2558,12 @@ static int ieee80211_update_mesh_config(
+@@ -2553,8 +2557,12 @@ static int ieee80211_update_mesh_config(
  	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, mask))
  		conf->dot11MeshHWMPmaxPREQretries =
  			nconf->dot11MeshHWMPmaxPREQretries;
@@ -280,7 +280,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	if (_chg_mesh_attr(NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, mask))
  		conf->min_discovery_timeout = nconf->min_discovery_timeout;
  	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, mask))
-@@ -2590,8 +2598,12 @@ static int ieee80211_update_mesh_config(
+@@ -2589,8 +2597,12 @@ static int ieee80211_update_mesh_config(
  	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_RANN_INTERVAL, mask))
  		conf->dot11MeshHWMPRannInterval =
  			nconf->dot11MeshHWMPRannInterval;
@@ -294,7 +294,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	if (_chg_mesh_attr(NL80211_MESHCONF_RSSI_THRESHOLD, mask)) {
  		/* our RSSI threshold implementation is supported only for
  		 * devices that report signal in dBm.
-@@ -2633,6 +2645,7 @@ static int ieee80211_update_mesh_config(
+@@ -2632,6 +2644,7 @@ static int ieee80211_update_mesh_config(
  		conf->dot11MeshConnectedToAuthServer =
  			nconf->dot11MeshConnectedToAuthServer;
  	ieee80211_mbss_info_change_notify(sdata, BSS_CHANGED_BEACON);
@@ -379,7 +379,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  #endif /* __MAC80211_DRIVER_OPS */
 --- a/net/mac80211/mesh.h
 +++ b/net/mac80211/mesh.h
-@@ -315,6 +315,10 @@ void mesh_rx_path_sel_frame(struct ieee8
+@@ -320,6 +320,10 @@ void mesh_rx_path_sel_frame(struct ieee8
  			    struct ieee80211_mgmt *mgmt, size_t len);
  struct mesh_path *
  mesh_path_add(struct ieee80211_sub_if_data *sdata, const u8 *dst);
@@ -390,7 +390,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  
  int mesh_path_add_gate(struct mesh_path *mpath);
  int mesh_path_send_to_gates(struct mesh_path *mpath);
-@@ -356,6 +360,7 @@ void mesh_path_discard_frame(struct ieee
+@@ -361,6 +365,7 @@ void mesh_path_discard_frame(struct ieee
  void mesh_path_tx_root_frame(struct ieee80211_sub_if_data *sdata);
  
  bool mesh_action_is_path_sel(struct ieee80211_mgmt *mgmt);
@@ -1221,7 +1221,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	info->ack_frame_id = info_id;
  	info->band = band;
  
-@@ -4274,6 +4284,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4275,6 +4285,7 @@ void __ieee80211_subif_start_xmit(struct
  	struct sk_buff *next;
  	int len = skb->len;
  	struct ieee80211_key *key = NULL;
@@ -1229,7 +1229,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	struct ieee80211_sub_if_data *ap_sdata;
  
  	if (unlikely(!ieee80211_sdata_running(sdata) || skb->len < ETH_HLEN)) {
-@@ -4350,9 +4361,15 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4351,9 +4362,15 @@ void __ieee80211_subif_start_xmit(struct
  			goto out;
  		}
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch b/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
index f78d7ce6e09304..0704e8fcf7da86 100644
--- a/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
@@ -16,7 +16,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2731,6 +2731,8 @@ struct ieee80211_txq {
+@@ -2733,6 +2733,8 @@ struct ieee80211_txq {
   *
   *  @IEEE80211_HW_SUPPORTS_NSS_OFFLOAD: Hardware/driver supports NSS offload
   *
@@ -25,7 +25,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
   * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
   */
  enum ieee80211_hw_flags {
-@@ -2790,6 +2792,7 @@ enum ieee80211_hw_flags {
+@@ -2792,6 +2794,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_MLO_MCAST_MULTI_LINK_TX,
  	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
  	IEEE80211_HW_SUPPORTS_MESH_NSS_OFFLOAD,
diff --git a/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch b/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch
index 63373b7751f9eb..314bcbe549af97 100644
--- a/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch
@@ -14,7 +14,7 @@ Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4761,6 +4761,67 @@ out_free:
+@@ -4762,6 +4762,67 @@ out_free:
  	kfree_skb(skb);
  }
  
@@ -82,7 +82,7 @@ Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
  netdev_tx_t ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
  					    struct net_device *dev)
  {
-@@ -4800,6 +4861,11 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4801,6 +4862,11 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  	if (key && (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)))
  		goto skip_offload;
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch b/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch
index 0cb2a1e95244e3..c8d719006d170f 100644
--- a/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch
@@ -33,7 +33,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4695,7 +4695,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4696,7 +4696,7 @@ static void ieee80211_8023_xmit(struct i
  
  	ieee80211_aggr_check(sdata, sta, skb);
  
@@ -42,7 +42,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  		tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
  		tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
  		if (tid_tx) {
-@@ -4746,7 +4746,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4747,7 +4747,7 @@ static void ieee80211_8023_xmit(struct i
  							     &info->flags, NULL);
  
  	dev_sw_netstats_tx_add(dev, skbs, len);
diff --git a/package/kernel/mac80211/patches/nss/subsys/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch b/package/kernel/mac80211/patches/nss/subsys/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
index 2cb2ebe6f58f76..55380f59d3826c 100644
--- a/package/kernel/mac80211/patches/nss/subsys/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
@@ -14,7 +14,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1405,8 +1405,6 @@ ieee80211_tx_info_clear_status(struct ie
+@@ -1407,8 +1407,6 @@ ieee80211_tx_info_clear_status(struct ie
   * @RX_FLAG_AMPDU_IS_LAST: this subframe is the last subframe of the A-MPDU
   * @RX_FLAG_AMPDU_DELIM_CRC_ERROR: A delimiter CRC error has been detected
   *	on this subframe
@@ -23,7 +23,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
   * @RX_FLAG_MIC_STRIPPED: The mic was stripped of this packet. Decryption was
   *	done by the hardware
   * @RX_FLAG_ONLY_MONITOR: Report frame only to monitor interfaces without
-@@ -1478,22 +1476,21 @@ enum mac80211_rx_flags {
+@@ -1480,22 +1478,21 @@ enum mac80211_rx_flags {
  	RX_FLAG_AMPDU_LAST_KNOWN	= BIT(12),
  	RX_FLAG_AMPDU_IS_LAST		= BIT(13),
  	RX_FLAG_AMPDU_DELIM_CRC_ERROR	= BIT(14),
diff --git a/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch b/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
index a947728fc661f1..13977ab665862e 100644
--- a/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
@@ -44,7 +44,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  /* misc utils */
  
  static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
-@@ -4319,7 +4320,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4320,7 +4321,7 @@ void __ieee80211_subif_start_xmit(struct
                      !is_multicast_ether_addr(skb->data)) {
                          if (sta)
                                  key = rcu_dereference(sta->ptk[sta->ptk_idx]);
@@ -53,7 +53,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
                          rcu_read_unlock();
                          return;
                  }
-@@ -4365,7 +4366,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4366,7 +4367,7 @@ void __ieee80211_subif_start_xmit(struct
  		if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) {
  		    	if (sta)
  				key = rcu_dereference(sta->ptk[sta->ptk_idx]);
@@ -62,7 +62,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  		} else {
  			dev_sw_netstats_tx_add(dev, 1, skb->len);
  			ieee80211_xmit(sdata, sta, skb);
-@@ -4663,7 +4664,8 @@ static bool ieee80211_tx_8023(struct iee
+@@ -4664,7 +4665,8 @@ static bool ieee80211_tx_8023(struct iee
  
  static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
  				struct net_device *dev, struct sta_info *sta,
@@ -72,7 +72,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  {
  	struct ieee80211_tx_info *info;
  	struct ethhdr *ehdr = (struct ethhdr *)skb->data;
-@@ -4719,6 +4721,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4720,6 +4722,7 @@ static void ieee80211_8023_xmit(struct i
  	info = IEEE80211_SKB_CB(skb);
  	memset(info, 0, sizeof(*info));
  
@@ -80,7 +80,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  	info->hw_queue = sdata->vif.hw_queue[queue];
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
-@@ -4739,11 +4742,12 @@ static void ieee80211_8023_xmit(struct i
+@@ -4740,11 +4743,12 @@ static void ieee80211_8023_xmit(struct i
  			memcpy(IEEE80211_SKB_CB(seg), info, sizeof(*info));
  	}
  
@@ -96,7 +96,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  	dev_sw_netstats_tx_add(dev, skbs, len);
  	if (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD) && sta) {
-@@ -4763,7 +4767,8 @@ out_free:
+@@ -4764,7 +4768,8 @@ out_free:
  
  void ieee80211_8023_xmit_ap(struct ieee80211_sub_if_data *sdata,
  			    struct net_device *dev, struct sta_info *sta,
@@ -106,7 +106,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  {
  	struct ieee80211_tx_info *info;
  	struct ieee80211_local *local = sdata->local;
-@@ -4772,6 +4777,9 @@ void ieee80211_8023_xmit_ap(struct ieee8
+@@ -4773,6 +4778,9 @@ void ieee80211_8023_xmit_ap(struct ieee8
  	unsigned long flags;
  	int q;
  	u16 q_map;
@@ -116,7 +116,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  	/*
  	 * If the skb is shared we need to obtain our own copy.
-@@ -4783,11 +4791,13 @@ void ieee80211_8023_xmit_ap(struct ieee8
+@@ -4784,11 +4792,13 @@ void ieee80211_8023_xmit_ap(struct ieee8
  
  	info = IEEE80211_SKB_CB(skb);
  	memset(info, 0, sizeof(*info));
@@ -133,7 +133,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  	info->flags |= IEEE80211_TX_CTL_HW_80211_ENCAP;
  	info->control.vif = &sdata->vif;
-@@ -4821,14 +4831,23 @@ void ieee80211_8023_xmit_ap(struct ieee8
+@@ -4822,14 +4832,23 @@ void ieee80211_8023_xmit_ap(struct ieee8
  	drv_tx(local, &control, skb);
  
  }
@@ -158,7 +158,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  #ifdef CPTCFG_MAC80211_NSS_SUPPORT
         ieee80211_xmit_nss_fixup(skb, dev);
-@@ -4844,14 +4863,15 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4845,14 +4864,15 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		kfree_skb(skb);
  		goto out;
  	}
@@ -176,7 +176,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  		goto skip_offload;
  
  	key = rcu_dereference(sta->ptk[sta->ptk_idx]);
-@@ -4862,13 +4882,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4863,13 +4883,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		goto skip_offload;
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP) {
@@ -192,7 +192,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  	goto out;
  
  skip_offload:
-@@ -6374,7 +6394,10 @@ start_xmit:
+@@ -6375,7 +6395,10 @@ start_xmit:
  	mutex_lock(&local->mtx);
  
  	local_bh_disable();
diff --git a/package/kernel/mac80211/patches/nss/subsys/686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch b/package/kernel/mac80211/patches/nss/subsys/686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch
index 7ffaf99158b90e..62916f15eddb56 100644
--- a/package/kernel/mac80211/patches/nss/subsys/686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch
@@ -72,7 +72,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2350,7 +2350,7 @@ static void mpath_set_pinfo(struct mesh_
+@@ -2349,7 +2349,7 @@ static void mpath_set_pinfo(struct mesh_
  	if (mpath->flags & MESH_PATH_RESOLVED)
  		pinfo->flags |= NL80211_MPATH_FLAG_RESOLVED;
  	pinfo->hop_count = mpath->hop_count;
diff --git a/package/kernel/mac80211/patches/nss/subsys/751-mac80211-Get-valid-last_rate-for-rx_bitrate-from-cpu.patch b/package/kernel/mac80211/patches/nss/subsys/751-mac80211-Get-valid-last_rate-for-rx_bitrate-from-cpu.patch
index 098767aa3f36db..ea83021014ad26 100644
--- a/package/kernel/mac80211/patches/nss/subsys/751-mac80211-Get-valid-last_rate-for-rx_bitrate-from-cpu.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/751-mac80211-Get-valid-last_rate-for-rx_bitrate-from-cpu.patch
@@ -16,7 +16,7 @@ Signed-off-by: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
 
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -2396,7 +2396,7 @@ void ieee80211_sta_update_pending_airtim
+@@ -2385,7 +2385,7 @@ void ieee80211_sta_update_pending_airtim
  }
  
  static struct ieee80211_sta_rx_stats *
@@ -25,7 +25,7 @@ Signed-off-by: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
  {
  	struct ieee80211_sta_rx_stats *stats = &sta->deflink.rx_stats;
  	int cpu;
-@@ -2409,8 +2409,13 @@ sta_get_last_rx_stats(struct sta_info *s
+@@ -2398,8 +2398,13 @@ sta_get_last_rx_stats(struct sta_info *s
  
  	for_each_possible_cpu(cpu) {
  		struct ieee80211_sta_rx_stats *cpustats;
@@ -39,7 +39,7 @@ Signed-off-by: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
  
  		if (time_after(cpustats->last_rx, stats->last_rx))
  			stats = cpustats;
-@@ -2480,7 +2485,7 @@ static void sta_stats_decode_rate(struct
+@@ -2476,7 +2481,7 @@ static void sta_stats_decode_rate(struct
  
  static int sta_set_rate_info_rx(struct sta_info *sta, struct rate_info *rinfo)
  {
@@ -48,16 +48,16 @@ Signed-off-by: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
  
  	if (rate == STA_STATS_RATE_INVALID)
  		return -EINVAL;
-@@ -2680,7 +2685,7 @@ void sta_set_sinfo(struct sta_info *sta,
+@@ -2576,7 +2581,7 @@ void sta_set_sinfo(struct sta_info *sta,
+ 	int i, ac, cpu;
  	struct ieee80211_sta_rx_stats *last_rxstats;
- 	struct link_sta_info *link_sta = NULL;
  
 -	last_rxstats = sta_get_last_rx_stats(sta);
 +	last_rxstats = sta_get_last_rx_stats(sta, false);
  
  	sinfo->generation = sdata->local->sta_generation;
  
-@@ -2924,7 +2929,7 @@ u32 sta_get_expected_throughput(struct s
+@@ -2859,7 +2864,7 @@ u32 sta_get_expected_throughput(struct s
  
  unsigned long ieee80211_sta_last_active(struct sta_info *sta)
  {
diff --git a/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch b/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
index 50466d46c37880..6be28b6ac56663 100644
--- a/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
@@ -58,7 +58,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	if (!skb)
  		return true;
  
-@@ -4343,7 +4345,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4344,7 +4346,7 @@ void __ieee80211_subif_start_xmit(struct
  	 * things so we cannot really handle checksum or GSO offload.
  	 * fix it up in software before we handle anything else.
  	 */
@@ -67,7 +67,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	if (!skb) {
  		len = 0;
  		goto out;
-@@ -4714,7 +4716,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4715,7 +4717,7 @@ static void ieee80211_8023_xmit(struct i
  		}
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch b/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
index b76692a6f9500c..c2846abf7e5961 100644
--- a/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
@@ -23,7 +23,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2730,6 +2730,9 @@ struct ieee80211_txq {
+@@ -2732,6 +2732,9 @@ struct ieee80211_txq {
   *
   * @IEEE80211_HW_SUPPORTS_TID_CLASS_OFFLOAD: Hardware suports tid calssification offload.
   *
@@ -33,7 +33,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
   * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
   */
  enum ieee80211_hw_flags {
-@@ -2790,6 +2793,7 @@ enum ieee80211_hw_flags {
+@@ -2792,6 +2795,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
  	IEEE80211_HW_SUPPORTS_MESH_NSS_OFFLOAD,
  	IEEE80211_HW_SUPPORTS_TID_CLASS_OFFLOAD,
@@ -83,7 +83,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  		return false;
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-@@ -4328,7 +4335,8 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4329,7 +4336,8 @@ void __ieee80211_subif_start_xmit(struct
                  }
          }
  
@@ -93,7 +93,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	ieee80211_aggr_check(sdata, sta, skb);
  
  	if (sta) {
-@@ -4680,8 +4688,10 @@ static void ieee80211_8023_xmit(struct i
+@@ -4681,8 +4689,10 @@ static void ieee80211_8023_xmit(struct i
  	bool multicast;
  	u8 tid;
  
@@ -106,7 +106,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  
  	multicast = is_multicast_ether_addr(ra);
  
-@@ -6416,9 +6426,12 @@ int ieee80211_tx_control_port(struct wip
+@@ -6379,9 +6389,12 @@ int ieee80211_tx_control_port(struct wip
  	}
  
  	if (!IS_ERR(sta)) {
@@ -123,7 +123,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  		 * for MLO STA, the SA should be the AP MLD address, but
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -4525,6 +4525,9 @@ static int ieee80211_get_txq_stats(struc
+@@ -4524,6 +4524,9 @@ static int ieee80211_get_txq_stats(struc
  	struct ieee80211_sub_if_data *sdata;
  	int ret = 0;
  
@@ -205,7 +205,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	int i;
  
  	sta = kzalloc(sizeof(*sta) + hw->sta_data_size, gfp);
-@@ -607,18 +609,22 @@ __sta_info_alloc(struct ieee80211_sub_if
+@@ -611,18 +613,22 @@ __sta_info_alloc(struct ieee80211_sub_if
  
  	sta->last_connected = ktime_get_seconds();
  
@@ -237,7 +237,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	}
  
  	if (sta_prepare_rate_control(local, sta, gfp))
-@@ -692,7 +698,8 @@ __sta_info_alloc(struct ieee80211_sub_if
+@@ -696,7 +702,8 @@ __sta_info_alloc(struct ieee80211_sub_if
  	return sta;
  
  free_txq:
@@ -247,7 +247,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  free:
  	sta_info_free_link(&sta->deflink);
  #ifdef CPTCFG_MAC80211_MESH
-@@ -1687,11 +1694,13 @@ void ieee80211_sta_ps_deliver_wakeup(str
+@@ -1691,11 +1698,13 @@ void ieee80211_sta_ps_deliver_wakeup(str
  	if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
  		drv_sta_notify(local, sdata, STA_NOTIFY_AWAKE, &sta->sta);
  
@@ -265,7 +265,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	}
  
  	skb_queue_head_init(&pending);
-@@ -2106,6 +2115,9 @@ ieee80211_sta_ps_deliver_response(struct
+@@ -2110,6 +2119,9 @@ ieee80211_sta_ps_deliver_response(struct
  		 * TIM recalculation.
  		 */
  
@@ -275,7 +275,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  		for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
  			if (!sta->sta.txq[tid] ||
  			    !(driver_release_tids & BIT(tid)) ||
-@@ -2521,7 +2533,7 @@ static void sta_set_tidstats(struct sta_
+@@ -2546,7 +2558,7 @@ static void sta_set_tidstats(struct sta_
  		tidstats->tx_msdu_failed = sta->deflink.status_stats.msdu_failed[tid];
  	}
  
@@ -284,7 +284,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  		spin_lock_bh(&local->fq.lock);
  		rcu_read_lock();
  
-@@ -2849,6 +2861,9 @@ unsigned long ieee80211_sta_last_active(
+@@ -2874,6 +2886,9 @@ unsigned long ieee80211_sta_last_active(
  
  static void sta_update_codel_params(struct sta_info *sta, u32 thr)
  {
diff --git a/package/kernel/mac80211/patches/nss/subsys/902-wifi-mac80211-Fix-memory-corruption-during-mesh-beac.patch b/package/kernel/mac80211/patches/nss/subsys/902-wifi-mac80211-Fix-memory-corruption-during-mesh-beac.patch
index e3d8db5815fe88..0f8289a892d4a4 100644
--- a/package/kernel/mac80211/patches/nss/subsys/902-wifi-mac80211-Fix-memory-corruption-during-mesh-beac.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/902-wifi-mac80211-Fix-memory-corruption-during-mesh-beac.patch
@@ -25,7 +25,7 @@ Signed-off-by: Manish Dharanenthiran <quic_mdharane@quicinc.com>
 
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -683,7 +683,7 @@ struct ieee80211_if_mesh {
+@@ -682,7 +682,7 @@ struct ieee80211_if_mesh {
  	struct timer_list mesh_path_root_timer;
  
  	unsigned long wrkq_flags;

From c11d7dde475d7fa14e3a1d4625cbd8707526c6d2 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sun, 24 Mar 2024 22:44:54 -0400
Subject: [PATCH 096/225] qualcommax: NSS: kernel 6.6 support (squash)

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../0600-1-qca-nss-ecm-support-CORE.patch     | 875 ++++++++++++++++++
 ...x-IPv6-user-route-change-event-calls.patch |  87 ++
 .../0605-1-qca-nss-cfi-support.patch          | 127 +++
 .../0981-1-qca-skb_recycler-support.patch     | 384 ++++++++
 4 files changed, 1473 insertions(+)
 create mode 100644 target/linux/qualcommax/patches-6.6/0600-1-qca-nss-ecm-support-CORE.patch
 create mode 100644 target/linux/qualcommax/patches-6.6/0600-7-qca-nss-ecm-fix-IPv6-user-route-change-event-calls.patch
 create mode 100644 target/linux/qualcommax/patches-6.6/0605-1-qca-nss-cfi-support.patch
 create mode 100644 target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch

diff --git a/target/linux/qualcommax/patches-6.6/0600-1-qca-nss-ecm-support-CORE.patch b/target/linux/qualcommax/patches-6.6/0600-1-qca-nss-ecm-support-CORE.patch
new file mode 100644
index 00000000000000..c49b9564044716
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0600-1-qca-nss-ecm-support-CORE.patch
@@ -0,0 +1,875 @@
+--- a/include/linux/if_bridge.h
++++ b/include/linux/if_bridge.h
+@@ -71,6 +71,9 @@ void brioctl_set(int (*hook)(struct net
+ 			     void __user *uarg));
+ int br_ioctl_call(struct net *net, struct net_bridge *br, unsigned int cmd,
+ 		  struct ifreq *ifr, void __user *uarg);
++extern void br_dev_update_stats(struct net_device *dev,
++				struct rtnl_link_stats64 *nlstats);
++extern bool br_is_hairpin_enabled(struct net_device *dev);
+ 
+ #if IS_ENABLED(CONFIG_BRIDGE) && IS_ENABLED(CONFIG_BRIDGE_IGMP_SNOOPING)
+ int br_multicast_list_adjacent(struct net_device *dev,
+@@ -213,4 +216,42 @@ static inline clock_t br_get_ageing_time
+ }
+ #endif
+ 
++/* QCA NSS ECM support - Start */
++extern struct net_device *br_port_dev_get(struct net_device *dev,
++					  unsigned char *addr,
++					  struct sk_buff *skb,
++					  unsigned int cookie);
++extern void br_refresh_fdb_entry(struct net_device *dev, const char *addr);
++extern void br_fdb_entry_refresh(struct net_device *dev, const char *addr, __u16 vid);
++extern struct net_bridge_fdb_entry *br_fdb_has_entry(struct net_device *dev,
++						     const char *addr,
++						     __u16 vid);
++extern void br_fdb_update_register_notify(struct notifier_block *nb);
++extern void br_fdb_update_unregister_notify(struct notifier_block *nb);
++
++typedef struct net_bridge_port *br_port_dev_get_hook_t(struct net_device *dev,
++						       struct sk_buff *skb,
++						       unsigned char *addr,
++						       unsigned int cookie);
++extern br_port_dev_get_hook_t __rcu *br_port_dev_get_hook;
++
++#define BR_FDB_EVENT_ADD     0x01
++#define BR_FDB_EVENT_DEL     0x02
++
++struct br_fdb_event {
++	struct net_device *dev;
++	unsigned char      addr[6];
++	unsigned char      is_local;
++	struct net_bridge *br;
++	struct net_device *orig_dev;
++};
++extern void br_fdb_register_notify(struct notifier_block *nb);
++extern void br_fdb_unregister_notify(struct notifier_block *nb);
++
++typedef struct net_bridge_port *br_get_dst_hook_t(
++		const struct net_bridge_port *src,
++		struct sk_buff **skb);
++extern br_get_dst_hook_t __rcu *br_get_dst_hook;
++/* QCA NSS ECM support - End */
++
+ #endif
+--- a/include/linux/if_vlan.h
++++ b/include/linux/if_vlan.h
+@@ -143,7 +143,10 @@ extern struct net_device *__vlan_find_de
+ extern int vlan_for_each(struct net_device *dev,
+ 			 int (*action)(struct net_device *dev, int vid,
+ 				       void *arg), void *arg);
++extern void __vlan_dev_update_accel_stats(struct net_device *dev,
++				    struct rtnl_link_stats64 *stats); /* QCA NSS ECM support */
+ extern struct net_device *vlan_dev_real_dev(const struct net_device *dev);
++extern struct net_device *vlan_dev_next_dev(const struct net_device *dev); /* QCA NSS ECM support */
+ extern u16 vlan_dev_vlan_id(const struct net_device *dev);
+ extern __be16 vlan_dev_vlan_proto(const struct net_device *dev);
+ 
+@@ -236,6 +239,12 @@ extern void vlan_vids_del_by_dev(struct
+ extern bool vlan_uses_dev(const struct net_device *dev);
+ 
+ #else
++static inline void __vlan_dev_update_accel_stats(struct net_device *dev,
++					   struct rtnl_link_stats64 *stats)
++{
++
++} /* QCA NSS ECM support */
++
+ static inline struct net_device *
+ __vlan_find_dev_deep_rcu(struct net_device *real_dev,
+ 		     __be16 vlan_proto, u16 vlan_id)
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -2936,6 +2936,10 @@ enum netdev_cmd {
+ 	NETDEV_OFFLOAD_XSTATS_REPORT_USED,
+ 	NETDEV_OFFLOAD_XSTATS_REPORT_DELTA,
+ 	NETDEV_XDP_FEAT_CHANGE,
++	/* QCA NSS ECM Support - Start */
++	NETDEV_BR_JOIN,
++	NETDEV_BR_LEAVE,
++	/* QCA NSS ECM Support - End */
+ };
+ const char *netdev_cmd_to_name(enum netdev_cmd cmd);
+ 
+--- a/include/net/ip6_route.h
++++ b/include/net/ip6_route.h
+@@ -207,6 +207,11 @@ void rt6_multipath_rebalance(struct fib6
+ void rt6_uncached_list_add(struct rt6_info *rt);
+ void rt6_uncached_list_del(struct rt6_info *rt);
+ 
++/* QCA NSS ECM support - Start */
++int rt6_register_notifier(struct notifier_block *nb);
++int rt6_unregister_notifier(struct notifier_block *nb);
++/* QCA NSS ECM support - End */
++
+ static inline const struct rt6_info *skb_rt6_info(const struct sk_buff *skb)
+ {
+ 	const struct dst_entry *dst = skb_dst(skb);
+--- a/include/net/neighbour.h
++++ b/include/net/neighbour.h
+@@ -249,6 +249,13 @@ static inline int neigh_parms_family(str
+ 	return p->tbl->family;
+ }
+ 
++/* QCA NSS ECM support - Start */
++struct neigh_mac_update {
++	unsigned char old_mac[ALIGN(MAX_ADDR_LEN, sizeof(unsigned long))];
++	unsigned char update_mac[ALIGN(MAX_ADDR_LEN, sizeof(unsigned long))];
++};
++/* QCA NSS ECM support - End */
++
+ #define NEIGH_PRIV_ALIGN	sizeof(long long)
+ #define NEIGH_ENTRY_SIZE(size)	ALIGN((size), NEIGH_PRIV_ALIGN)
+ 
+@@ -395,6 +402,11 @@ void __neigh_for_each_release(struct nei
+ 			      int (*cb)(struct neighbour *));
+ int neigh_xmit(int fam, struct net_device *, const void *, struct sk_buff *);
+ 
++/* QCA NSS ECM support - Start */
++extern void neigh_mac_update_register_notify(struct notifier_block *nb);
++extern void neigh_mac_update_unregister_notify(struct notifier_block *nb);
++/* QCA NSS ECM support - End */
++
+ struct neigh_seq_state {
+ 	struct seq_net_private p;
+ 	struct neigh_table *tbl;
+@@ -600,4 +612,5 @@ static inline void neigh_update_is_route
+ 		*notify = 1;
+ 	}
+ }
++
+ #endif
+--- a/include/net/route.h
++++ b/include/net/route.h
+@@ -237,6 +237,11 @@ struct rtable *rt_dst_alloc(struct net_d
+ 			    unsigned int flags, u16 type, bool noxfrm);
+ struct rtable *rt_dst_clone(struct net_device *dev, struct rtable *rt);
+ 
++/* QCA NSS ECM support - Start */
++int ip_rt_register_notifier(struct notifier_block *nb);
++int ip_rt_unregister_notifier(struct notifier_block *nb);
++/* QCA NSS ECM support - End */
++
+ struct in_ifaddr;
+ void fib_add_ifaddr(struct in_ifaddr *);
+ void fib_del_ifaddr(struct in_ifaddr *, struct in_ifaddr *);
+--- a/net/bridge/br_private.h
++++ b/net/bridge/br_private.h
+@@ -2266,4 +2266,6 @@ void br_do_suppress_nd(struct sk_buff *s
+ 		       u16 vid, struct net_bridge_port *p, struct nd_msg *msg);
+ struct nd_msg *br_is_nd_neigh_msg(struct sk_buff *skb, struct nd_msg *m);
+ bool br_is_neigh_suppress_enabled(const struct net_bridge_port *p, u16 vid);
++#define __br_get(__hook, __default, __args ...) \
++		(__hook ? (__hook(__args)) : (__default)) /* QCA NSS ECM support */
+ #endif
+--- a/net/8021q/vlan_core.c
++++ b/net/8021q/vlan_core.c
+@@ -72,6 +72,28 @@ bool vlan_do_receive(struct sk_buff **sk
+ 	return true;
+ }
+ 
++/* QCA NSS ECM support - Start */
++/* Update the VLAN device with statistics from network offload engines */
++void __vlan_dev_update_accel_stats(struct net_device *dev,
++				   struct rtnl_link_stats64 *nlstats)
++{
++	struct vlan_pcpu_stats *stats;
++
++	if (!is_vlan_dev(dev))
++		return;
++
++	stats = per_cpu_ptr(vlan_dev_priv(dev)->vlan_pcpu_stats, 0);
++
++	u64_stats_update_begin(&stats->syncp);
++	u64_stats_add(&stats->rx_packets, nlstats->rx_packets);
++	u64_stats_add(&stats->rx_bytes, nlstats->rx_bytes);
++	u64_stats_add(&stats->tx_packets, nlstats->tx_packets);
++	u64_stats_add(&stats->tx_bytes, nlstats->tx_bytes);
++	u64_stats_update_end(&stats->syncp);
++}
++EXPORT_SYMBOL(__vlan_dev_update_accel_stats);
++/* QCA NSS ECM support - End */
++
+ /* Must be invoked with rcu_read_lock. */
+ struct net_device *__vlan_find_dev_deep_rcu(struct net_device *dev,
+ 					__be16 vlan_proto, u16 vlan_id)
+@@ -110,6 +132,15 @@ struct net_device *vlan_dev_real_dev(con
+ }
+ EXPORT_SYMBOL(vlan_dev_real_dev);
+ 
++/* QCA NSS ECM support - Start */
++/* Caller is responsible to hold the reference of the returned device */
++struct net_device *vlan_dev_next_dev(const struct net_device *dev)
++{
++	return vlan_dev_priv(dev)->real_dev;
++}
++EXPORT_SYMBOL(vlan_dev_next_dev);
++/* QCA NSS ECM support - End */
++
+ u16 vlan_dev_vlan_id(const struct net_device *dev)
+ {
+ 	return vlan_dev_priv(dev)->vlan_id;
+--- a/net/bridge/br_fdb.c
++++ b/net/bridge/br_fdb.c
+@@ -33,6 +33,20 @@ static const struct rhashtable_params br
+ 
+ static struct kmem_cache *br_fdb_cache __read_mostly;
+ 
++ATOMIC_NOTIFIER_HEAD(br_fdb_notifier_list);
++
++void br_fdb_register_notify(struct notifier_block *nb)
++{
++	atomic_notifier_chain_register(&br_fdb_notifier_list, nb);
++}
++EXPORT_SYMBOL_GPL(br_fdb_register_notify);
++
++void br_fdb_unregister_notify(struct notifier_block *nb)
++{
++	atomic_notifier_chain_unregister(&br_fdb_notifier_list, nb);
++}
++EXPORT_SYMBOL_GPL(br_fdb_unregister_notify);
++
+ int __init br_fdb_init(void)
+ {
+ 	br_fdb_cache = kmem_cache_create("bridge_fdb_cache",
+@@ -195,6 +209,25 @@ static void fdb_notify(struct net_bridge
+ 	if (swdev_notify)
+ 		br_switchdev_fdb_notify(br, fdb, type);
+ 
++	/* QCA NSS ECM support - Start */
++	if (fdb->dst) {
++		int event;
++		struct br_fdb_event fdb_event;
++
++		if (type == RTM_NEWNEIGH)
++			event = BR_FDB_EVENT_ADD;
++		else
++			event = BR_FDB_EVENT_DEL;
++
++		fdb_event.dev = fdb->dst->dev;
++		ether_addr_copy(fdb_event.addr, fdb->key.addr.addr);
++		fdb_event.is_local = test_bit(BR_FDB_LOCAL, &fdb->flags);
++		atomic_notifier_call_chain(&br_fdb_notifier_list,
++					   event,
++					   (void *)&fdb_event);
++	}
++	/* QCA NSS ECM support - End */
++
+ 	skb = nlmsg_new(fdb_nlmsg_size(), GFP_ATOMIC);
+ 	if (skb == NULL)
+ 		goto errout;
+@@ -519,6 +552,22 @@ out:
+ 	spin_unlock_bh(&br->hash_lock);
+ }
+ 
++/* QCA NSS ECM support - Start */
++ATOMIC_NOTIFIER_HEAD(br_fdb_update_notifier_list);
++
++void br_fdb_update_register_notify(struct notifier_block *nb)
++{
++	atomic_notifier_chain_register(&br_fdb_update_notifier_list, nb);
++}
++EXPORT_SYMBOL_GPL(br_fdb_update_register_notify);
++
++void br_fdb_update_unregister_notify(struct notifier_block *nb)
++{
++	atomic_notifier_chain_unregister(&br_fdb_update_notifier_list, nb);
++}
++EXPORT_SYMBOL_GPL(br_fdb_update_unregister_notify);
++/* QCA NSS ECM support - End */
++
+ void br_fdb_cleanup(struct work_struct *work)
+ {
+ 	struct net_bridge *br = container_of(work, struct net_bridge,
+@@ -527,6 +576,7 @@ void br_fdb_cleanup(struct work_struct *
+ 	unsigned long delay = hold_time(br);
+ 	unsigned long work_delay = delay;
+ 	unsigned long now = jiffies;
++	u8 mac_addr[6]; /* QCA NSS ECM support */
+ 
+ 	/* this part is tricky, in order to avoid blocking learning and
+ 	 * consequently forwarding, we rely on rcu to delete objects with
+@@ -553,8 +603,15 @@ void br_fdb_cleanup(struct work_struct *
+ 			work_delay = min(work_delay, this_timer - now);
+ 		} else {
+ 			spin_lock_bh(&br->hash_lock);
+-			if (!hlist_unhashed(&f->fdb_node))
++			if (!hlist_unhashed(&f->fdb_node)) {
++				ether_addr_copy(mac_addr, f->key.addr.addr);
+ 				fdb_delete(br, f, true);
++				/* QCA NSS ECM support - Start */
++				atomic_notifier_call_chain(
++					&br_fdb_update_notifier_list, 0,
++					(void *)mac_addr);
++				/* QCA NSS ECM support - End */
++			}
+ 			spin_unlock_bh(&br->hash_lock);
+ 		}
+ 	}
+@@ -891,6 +948,12 @@ void br_fdb_update(struct net_bridge *br
+ 				 */
+ 				if (unlikely(test_bit(BR_FDB_LOCKED, &fdb->flags)))
+ 					clear_bit(BR_FDB_LOCKED, &fdb->flags);
++
++				/* QCA NSS ECM support - Start */
++				atomic_notifier_call_chain(
++					&br_fdb_update_notifier_list,
++					0, (void *)addr);
++				/* QCA NSS ECM support - End */
+ 			}
+ 
+ 			if (unlikely(test_bit(BR_FDB_ADDED_BY_USER, &flags)))
+@@ -914,6 +977,64 @@ void br_fdb_update(struct net_bridge *br
+ 	}
+ }
+ 
++/* QCA NSS ECM support - Start */
++/* Refresh FDB entries for bridge packets being forwarded by offload engines */
++void br_refresh_fdb_entry(struct net_device *dev, const char *addr)
++{
++	struct net_bridge_port *p = br_port_get_rcu(dev);
++
++	if (!p || p->state == BR_STATE_DISABLED)
++		return;
++
++	if (!is_valid_ether_addr(addr)) {
++		pr_info("bridge: Attempt to refresh with invalid ether address %pM\n",
++			addr);
++		return;
++	}
++
++	rcu_read_lock();
++	br_fdb_update(p->br, p, addr, 0, true);
++	rcu_read_unlock();
++}
++EXPORT_SYMBOL_GPL(br_refresh_fdb_entry);
++
++/* Update timestamp of FDB entries for bridge packets being forwarded by offload engines */
++void br_fdb_entry_refresh(struct net_device *dev, const char *addr, __u16 vid)
++{
++	struct net_bridge_fdb_entry *fdb;
++	struct net_bridge_port *p = br_port_get_rcu(dev);
++
++	if (!p || p->state == BR_STATE_DISABLED)
++		return;
++
++	rcu_read_lock();
++	fdb = fdb_find_rcu(&p->br->fdb_hash_tbl, addr, vid);
++	if (likely(fdb)) {
++		fdb->updated = jiffies;
++	}
++	rcu_read_unlock();
++}
++EXPORT_SYMBOL_GPL(br_fdb_entry_refresh);
++
++/* Look up the MAC address in the device's bridge fdb table */
++struct net_bridge_fdb_entry *br_fdb_has_entry(struct net_device *dev,
++					      const char *addr, __u16 vid)
++{
++	struct net_bridge_port *p = br_port_get_rcu(dev);
++	struct net_bridge_fdb_entry *fdb;
++
++	if (!p || p->state == BR_STATE_DISABLED)
++		return NULL;
++
++	rcu_read_lock();
++	fdb = fdb_find_rcu(&p->br->fdb_hash_tbl, addr, vid);
++	rcu_read_unlock();
++
++	return fdb;
++}
++EXPORT_SYMBOL_GPL(br_fdb_has_entry);
++
++/* QCA NSS ECM support - End */
+ /* Dump information about entries, in response to GETNEIGH */
+ int br_fdb_dump(struct sk_buff *skb,
+ 		struct netlink_callback *cb,
+--- a/net/bridge/br_if.c
++++ b/net/bridge/br_if.c
+@@ -26,6 +26,12 @@
+ 
+ #include "br_private.h"
+ 
++/* QCA NSS ECM support - Start */
++/* Hook for external forwarding logic */
++br_port_dev_get_hook_t __rcu *br_port_dev_get_hook __read_mostly;
++EXPORT_SYMBOL_GPL(br_port_dev_get_hook);
++/* QCA NSS ECM support - End */
++
+ /*
+  * Determine initial path cost based on speed.
+  * using recommendations from 802.1d standard
+@@ -697,6 +703,8 @@ int br_add_if(struct net_bridge *br, str
+ 
+ 	kobject_uevent(&p->kobj, KOBJ_ADD);
+ 
++	call_netdevice_notifiers(NETDEV_BR_JOIN, dev); /* QCA NSS ECM support */
++
+ 	return 0;
+ 
+ err6:
+@@ -732,6 +740,8 @@ int br_del_if(struct net_bridge *br, str
+ 	if (!p || p->br != br)
+ 		return -EINVAL;
+ 
++	call_netdevice_notifiers(NETDEV_BR_LEAVE, dev); /* QCA NSS ECM support */
++
+ 	/* Since more than one interface can be attached to a bridge,
+ 	 * there still maybe an alternate path for netconsole to use;
+ 	 * therefore there is no reason for a NETDEV_RELEASE event.
+@@ -775,3 +785,97 @@ bool br_port_flag_is_set(const struct ne
+ 	return p->flags & flag;
+ }
+ EXPORT_SYMBOL_GPL(br_port_flag_is_set);
++
++/* br_port_dev_get()
++ *      If a skb is provided, and the br_port_dev_get_hook_t hook exists,
++ *      use that to try and determine the egress port for that skb.
++ *      If not, or no egress port could be determined, use the given addr
++ *      to identify the port to which it is reachable,
++ *	returing a reference to the net device associated with that port.
++ *
++ * NOTE: Return NULL if given dev is not a bridge or the mac has no
++ * associated port.
++ */
++struct net_device *br_port_dev_get(struct net_device *dev, unsigned char *addr,
++				   struct sk_buff *skb,
++				   unsigned int cookie)
++{
++	struct net_bridge_fdb_entry *fdbe;
++	struct net_bridge *br;
++	struct net_device *netdev = NULL;
++
++	/* Is this a bridge? */
++	if (!(dev->priv_flags & IFF_EBRIDGE))
++		return NULL;
++
++	rcu_read_lock();
++
++	/* If the hook exists and the skb isn't NULL, try and get the port */
++	if (skb) {
++		br_port_dev_get_hook_t *port_dev_get_hook;
++
++		port_dev_get_hook = rcu_dereference(br_port_dev_get_hook);
++		if (port_dev_get_hook) {
++			struct net_bridge_port *pdst =
++				__br_get(port_dev_get_hook, NULL, dev, skb,
++					 addr, cookie);
++			if (pdst) {
++				dev_hold(pdst->dev);
++				netdev = pdst->dev;
++				goto out;
++			}
++		}
++	}
++
++	/* Either there is no hook, or can't
++	 * determine the port to use - fall back to using FDB
++	 */
++
++	br = netdev_priv(dev);
++
++	/* Lookup the fdb entry and get reference to the port dev */
++	fdbe = br_fdb_find_rcu(br, addr, 0);
++	if (fdbe && fdbe->dst) {
++		netdev = fdbe->dst->dev; /* port device */
++		dev_hold(netdev);
++	}
++out:
++	rcu_read_unlock();
++	return netdev;
++}
++EXPORT_SYMBOL_GPL(br_port_dev_get);
++
++/* Update bridge statistics for bridge packets processed by offload engines */
++void br_dev_update_stats(struct net_device *dev,
++			 struct rtnl_link_stats64 *nlstats)
++{
++	struct pcpu_sw_netstats *tstats;
++
++	/* Is this a bridge? */
++	if (!(dev->priv_flags & IFF_EBRIDGE))
++		return;
++
++	tstats = this_cpu_ptr(dev->tstats);
++
++	u64_stats_update_begin(&tstats->syncp);
++	u64_stats_add(&tstats->rx_packets, nlstats->rx_packets);
++	u64_stats_add(&tstats->rx_bytes, nlstats->rx_bytes);
++	u64_stats_add(&tstats->tx_packets, nlstats->tx_packets);
++	u64_stats_add(&tstats->tx_bytes, nlstats->tx_bytes);
++	u64_stats_update_end(&tstats->syncp);
++}
++EXPORT_SYMBOL_GPL(br_dev_update_stats);
++
++/* QCA NSS ECM support - Start */
++/* API to know if hairpin feature is enabled/disabled on this bridge port */
++bool br_is_hairpin_enabled(struct net_device *dev)
++{
++	struct net_bridge_port *port = br_port_get_check_rcu(dev);
++
++	if (likely(port))
++		return port->flags & BR_HAIRPIN_MODE;
++	return false;
++}
++EXPORT_SYMBOL_GPL(br_is_hairpin_enabled);
++
++/* QCA NSS ECM support - End */
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -1275,6 +1275,22 @@ static void neigh_update_hhs(struct neig
+ 	}
+ }
+ 
++/* QCA NSS ECM support - Start */
++ATOMIC_NOTIFIER_HEAD(neigh_mac_update_notifier_list);
++
++void neigh_mac_update_register_notify(struct notifier_block *nb)
++{
++	atomic_notifier_chain_register(&neigh_mac_update_notifier_list, nb);
++}
++EXPORT_SYMBOL_GPL(neigh_mac_update_register_notify);
++
++void neigh_mac_update_unregister_notify(struct notifier_block *nb)
++{
++	atomic_notifier_chain_unregister(&neigh_mac_update_notifier_list, nb);
++}
++EXPORT_SYMBOL_GPL(neigh_mac_update_unregister_notify);
++/* QCA NSS ECM support - End */
++
+ /* Generic update routine.
+    -- lladdr is new lladdr or NULL, if it is not supplied.
+    -- new    is new state.
+@@ -1303,6 +1319,7 @@ static int __neigh_update(struct neighbo
+ 	struct net_device *dev;
+ 	int err, notify = 0;
+ 	u8 old;
++   struct neigh_mac_update nmu; /* QCA NSS ECM support */
+ 
+ 	trace_neigh_update(neigh, lladdr, new, flags, nlmsg_pid);
+ 
+@@ -1317,7 +1334,10 @@ static int __neigh_update(struct neighbo
+ 		new = old;
+ 		goto out;
+ 	}
+-	if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
++
++	memset(&nmu, 0, sizeof(struct neigh_mac_update)); /* QCA NSS ECM support */
++
++   if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
+ 	    (old & (NUD_NOARP | NUD_PERMANENT)))
+ 		goto out;
+ 
+@@ -1354,7 +1374,12 @@ static int __neigh_update(struct neighbo
+ 		   - compare new & old
+ 		   - if they are different, check override flag
+ 		 */
+-		if ((old & NUD_VALID) &&
++       /* QCA NSS ECM update - Start */
++		memcpy(nmu.old_mac, neigh->ha, dev->addr_len);
++		memcpy(nmu.update_mac, lladdr, dev->addr_len);
++		/* QCA NSS ECM update - End */
++
++       if ((old & NUD_VALID) &&
+ 		    !memcmp(lladdr, neigh->ha, dev->addr_len))
+ 			lladdr = neigh->ha;
+ 	} else {
+@@ -1476,8 +1501,11 @@ out:
+ 		neigh_update_gc_list(neigh);
+ 	if (managed_update)
+ 		neigh_update_managed_list(neigh);
+-	if (notify)
++	if (notify) {
+ 		neigh_update_notify(neigh, nlmsg_pid);
++		atomic_notifier_call_chain(&neigh_mac_update_notifier_list, 0,
++					   (struct neigh_mac_update *)&nmu); /* QCA NSS ECM support */
++    }
+ 	trace_neigh_update_done(neigh, err);
+ 	return err;
+ }
+--- a/net/ipv4/fib_trie.c
++++ b/net/ipv4/fib_trie.c
+@@ -1211,6 +1211,9 @@ static bool fib_valid_key_len(u32 key, u
+ static void fib_remove_alias(struct trie *t, struct key_vector *tp,
+ 			     struct key_vector *l, struct fib_alias *old);
+ 
++/* Define route change notification chain. */
++static BLOCKING_NOTIFIER_HEAD(iproute_chain);	/* QCA NSS ECM support */
++
+ /* Caller must hold RTNL. */
+ int fib_table_insert(struct net *net, struct fib_table *tb,
+ 		     struct fib_config *cfg, struct netlink_ext_ack *extack)
+@@ -1404,6 +1407,9 @@ int fib_table_insert(struct net *net, st
+ 	rtmsg_fib(RTM_NEWROUTE, htonl(key), new_fa, plen, new_fa->tb_id,
+ 		  &cfg->fc_nlinfo, nlflags);
+ succeeded:
++	blocking_notifier_call_chain(&iproute_chain,
++				     RTM_NEWROUTE, fi);
++
+ 	return 0;
+ 
+ out_remove_new_fa:
+@@ -1775,6 +1781,9 @@ int fib_table_delete(struct net *net, st
+ 	if (fa_to_delete->fa_state & FA_S_ACCESSED)
+ 		rt_cache_flush(cfg->fc_nlinfo.nl_net);
+ 
++	blocking_notifier_call_chain(&iproute_chain,
++				     RTM_DELROUTE, fa_to_delete->fa_info);
++
+ 	fib_release_info(fa_to_delete->fa_info);
+ 	alias_free_mem_rcu(fa_to_delete);
+ 	return 0;
+@@ -2407,6 +2416,20 @@ void __init fib_trie_init(void)
+ 					   0, SLAB_PANIC | SLAB_ACCOUNT, NULL);
+ }
+ 
++/* QCA NSS ECM support - Start */
++int ip_rt_register_notifier(struct notifier_block *nb)
++{
++	return blocking_notifier_chain_register(&iproute_chain, nb);
++}
++EXPORT_SYMBOL(ip_rt_register_notifier);
++
++int ip_rt_unregister_notifier(struct notifier_block *nb)
++{
++	return blocking_notifier_chain_unregister(&iproute_chain, nb);
++}
++EXPORT_SYMBOL(ip_rt_unregister_notifier);
++/* QCA NSS ECM support - End */
++
+ struct fib_table *fib_trie_table(u32 id, struct fib_table *alias)
+ {
+ 	struct fib_table *tb;
+--- a/net/ipv6/ndisc.c
++++ b/net/ipv6/ndisc.c
+@@ -666,6 +666,7 @@ void ndisc_send_ns(struct net_device *de
+ 	if (skb)
+ 		ndisc_send_skb(skb, daddr, saddr);
+ }
++EXPORT_SYMBOL(ndisc_send_ns);
+ 
+ void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
+ 		   const struct in6_addr *daddr)
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -197,6 +197,9 @@ static void rt6_uncached_list_flush_dev(
+ 	}
+ }
+ 
++/* Define route change notification chain. */
++ATOMIC_NOTIFIER_HEAD(ip6route_chain);	/* QCA NSS ECM support */
++
+ static inline const void *choose_neigh_daddr(const struct in6_addr *p,
+ 					     struct sk_buff *skb,
+ 					     const void *daddr)
+@@ -3864,6 +3867,10 @@ int ip6_route_add(struct fib6_config *cf
+ 		return PTR_ERR(rt);
+ 
+ 	err = __ip6_ins_rt(rt, &cfg->fc_nlinfo, extack);
++	if (!err)
++		atomic_notifier_call_chain(&ip6route_chain,
++					   RTM_NEWROUTE, rt);
++
+ 	fib6_info_release(rt);
+ 
+ 	return err;
+@@ -3885,6 +3892,9 @@ static int __ip6_del_rt(struct fib6_info
+ 	err = fib6_del(rt, info);
+ 	spin_unlock_bh(&table->tb6_lock);
+ 
++	if (!err)
++		atomic_notifier_call_chain(&ip6route_chain,
++					   RTM_DELROUTE, rt);
+ out:
+ 	fib6_info_release(rt);
+ 	return err;
+@@ -6329,6 +6339,20 @@ static int ip6_route_dev_notify(struct n
+ 	return NOTIFY_OK;
+ }
+ 
++/* QCA NSS ECM support - Start */
++int rt6_register_notifier(struct notifier_block *nb)
++{
++	return atomic_notifier_chain_register(&ip6route_chain, nb);
++}
++EXPORT_SYMBOL(rt6_register_notifier);
++
++int rt6_unregister_notifier(struct notifier_block *nb)
++{
++	return atomic_notifier_chain_unregister(&ip6route_chain, nb);
++}
++EXPORT_SYMBOL(rt6_unregister_notifier);
++/* QCA NSS ECM support - End */
++
+ /*
+  *	/proc
+  */
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -1673,6 +1673,7 @@ const char *netdev_cmd_to_name(enum netd
+ 	N(PRE_CHANGEADDR) N(OFFLOAD_XSTATS_ENABLE) N(OFFLOAD_XSTATS_DISABLE)
+ 	N(OFFLOAD_XSTATS_REPORT_USED) N(OFFLOAD_XSTATS_REPORT_DELTA)
+ 	N(XDP_FEAT_CHANGE)
++	N(BR_JOIN) N(BR_LEAVE)
+ 	}
+ #undef N
+ 	return "UNKNOWN_NETDEV_EVENT";
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -1002,6 +1002,7 @@ void inet6_ifa_finish_destroy(struct ine
+ 
+ 	kfree_rcu(ifp, rcu);
+ }
++EXPORT_SYMBOL(inet6_ifa_finish_destroy);
+ 
+ static void
+ ipv6_link_dev_addr(struct inet6_dev *idev, struct inet6_ifaddr *ifp)
+--- a/include/net/vxlan.h
++++ b/include/net/vxlan.h
+@@ -440,6 +440,15 @@ static inline __be32 vxlan_compute_rco(u
+ 	return vni_field;
+ }
+ 
++/*
++ * vxlan_get_vni()
++ *      Returns the vni corresponding to tunnel
++ */
++static inline u32 vxlan_get_vni(struct vxlan_dev *vxlan_tun)
++{
++    return be32_to_cpu(vxlan_tun->cfg.vni);
++}
++
+ static inline unsigned short vxlan_get_sk_family(struct vxlan_sock *vs)
+ {
+ 	return vs->sock->sk->sk_family;
+--- a/include/uapi/linux/in.h
++++ b/include/uapi/linux/in.h
+@@ -63,6 +63,8 @@ enum {
+ #define IPPROTO_MTP		IPPROTO_MTP
+   IPPROTO_BEETPH = 94,		/* IP option pseudo header for BEET	*/
+ #define IPPROTO_BEETPH		IPPROTO_BEETPH
++  IPPROTO_ETHERIP = 97,		/* ETHERIP protocol number		*/
++#define IPPROTO_ETHERIP		IPPROTO_ETHERIP
+   IPPROTO_ENCAP = 98,		/* Encapsulation Header			*/
+ #define IPPROTO_ENCAP		IPPROTO_ENCAP
+   IPPROTO_PIM = 103,		/* Protocol Independent Multicast	*/
+@@ -327,7 +329,7 @@ struct sockaddr_in {
+ #endif
+ 
+ /* <asm/byteorder.h> contains the htonl type stuff.. */
+-#include <asm/byteorder.h> 
++#include <asm/byteorder.h>
+ 
+ 
+ #endif /* _UAPI_LINUX_IN_H */
+--- a/tools/include/uapi/linux/in.h
++++ b/tools/include/uapi/linux/in.h
+@@ -63,6 +63,8 @@ enum {
+ #define IPPROTO_MTP		IPPROTO_MTP
+   IPPROTO_BEETPH = 94,		/* IP option pseudo header for BEET	*/
+ #define IPPROTO_BEETPH		IPPROTO_BEETPH
++  IPPROTO_ETHERIP = 97,		/* ETHERIP protocol number		*/
++#define IPPROTO_ETHERIP		IPPROTO_ETHERIP
+   IPPROTO_ENCAP = 98,		/* Encapsulation Header			*/
+ #define IPPROTO_ENCAP		IPPROTO_ENCAP
+   IPPROTO_PIM = 103,		/* Protocol Independent Multicast	*/
+@@ -327,7 +329,7 @@ struct sockaddr_in {
+ #endif
+ 
+ /* <asm/byteorder.h> contains the htonl type stuff.. */
+-#include <asm/byteorder.h> 
++#include <asm/byteorder.h>
+ 
+ 
+ #endif /* _UAPI_LINUX_IN_H */
+--- a/net/netfilter/nf_conntrack_ecache.c
++++ b/net/netfilter/nf_conntrack_ecache.c
+@@ -266,7 +266,6 @@ void nf_conntrack_register_notifier(stru
+ 	mutex_lock(&nf_ct_ecache_mutex);
+ 	notify = rcu_dereference_protected(net->ct.nf_conntrack_event_cb,
+ 					   lockdep_is_held(&nf_ct_ecache_mutex));
+-	WARN_ON_ONCE(notify);
+ 	rcu_assign_pointer(net->ct.nf_conntrack_event_cb, new);
+ 	mutex_unlock(&nf_ct_ecache_mutex);
+ }
+--- a/include/net/netns/conntrack.h
++++ b/include/net/netns/conntrack.h
+@@ -26,6 +26,7 @@ struct nf_tcp_net {
+ 	unsigned int timeouts[TCP_CONNTRACK_TIMEOUT_MAX];
+ 	u8 tcp_loose;
+ 	u8 tcp_be_liberal;
++	u8 tcp_no_window_check;
+ 	u8 tcp_max_retrans;
+ 	u8 tcp_ignore_invalid_rst;
+ #if IS_ENABLED(CONFIG_NF_FLOW_TABLE)
+--- a/net/netfilter/nf_conntrack_proto_tcp.c
++++ b/net/netfilter/nf_conntrack_proto_tcp.c
+@@ -515,11 +515,15 @@ tcp_in_window(struct nf_conn *ct, enum i
+ 	struct ip_ct_tcp *state = &ct->proto.tcp;
+ 	struct ip_ct_tcp_state *sender = &state->seen[dir];
+ 	struct ip_ct_tcp_state *receiver = &state->seen[!dir];
++	const struct nf_tcp_net *tn = nf_tcp_pernet(nf_ct_net(ct));
+ 	__u32 seq, ack, sack, end, win, swin;
+ 	bool in_recv_win, seq_ok;
+ 	s32 receiver_offset;
+ 	u16 win_raw;
+ 
++	if (tn->tcp_no_window_check)
++		return NFCT_TCP_ACCEPT;
++
+ 	/*
+ 	 * Get the required data from the packet.
+ 	 */
+@@ -1285,7 +1289,7 @@ int nf_conntrack_tcp_packet(struct nf_co
+ 		 IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&
+ 		 timeouts[new_state] > timeouts[TCP_CONNTRACK_UNACK])
+ 		timeout = timeouts[TCP_CONNTRACK_UNACK];
+-	else if (ct->proto.tcp.last_win == 0 &&
++	else if (!tn->tcp_no_window_check && ct->proto.tcp.last_win == 0 &&
+ 		 timeouts[new_state] > timeouts[TCP_CONNTRACK_RETRANS])
+ 		timeout = timeouts[TCP_CONNTRACK_RETRANS];
+ 	else
+@@ -1601,6 +1605,9 @@ void nf_conntrack_tcp_init_net(struct ne
+ 	 */
+ 	tn->tcp_be_liberal = 0;
+ 
++	/* Skip Windows Check */
++	tn->tcp_no_window_check = 0;
++
+ 	/* If it's non-zero, we turn off RST sequence number check */
+ 	tn->tcp_ignore_invalid_rst = 0;
+ 
+--- a/net/netfilter/nf_conntrack_standalone.c
++++ b/net/netfilter/nf_conntrack_standalone.c
+@@ -633,6 +633,7 @@ enum nf_ct_sysctl_index {
+ #endif
+ 	NF_SYSCTL_CT_PROTO_TCP_LOOSE,
+ 	NF_SYSCTL_CT_PROTO_TCP_LIBERAL,
++	NF_SYSCTL_CT_PROTO_TCP_NO_WINDOW_CHECK,
+ 	NF_SYSCTL_CT_PROTO_TCP_IGNORE_INVALID_RST,
+ 	NF_SYSCTL_CT_PROTO_TCP_MAX_RETRANS,
+ 	NF_SYSCTL_CT_PROTO_TIMEOUT_UDP,
+@@ -840,6 +841,14 @@ static struct ctl_table nf_ct_sysctl_tab
+ 		.extra1 	= SYSCTL_ZERO,
+ 		.extra2 	= SYSCTL_ONE,
+ 	},
++	[NF_SYSCTL_CT_PROTO_TCP_NO_WINDOW_CHECK] = {
++		.procname       = "nf_conntrack_tcp_no_window_check",
++		.maxlen         = sizeof(u8),
++		.mode           = 0644,
++		.proc_handler	= proc_dou8vec_minmax,
++		.extra1 	= SYSCTL_ZERO,
++		.extra2 	= SYSCTL_ONE,
++	},
+ 	[NF_SYSCTL_CT_PROTO_TCP_IGNORE_INVALID_RST] = {
+ 		.procname	= "nf_conntrack_tcp_ignore_invalid_rst",
+ 		.maxlen		= sizeof(u8),
+@@ -1050,6 +1059,7 @@ static void nf_conntrack_standalone_init
+ 
+ 	XASSIGN(LOOSE, &tn->tcp_loose);
+ 	XASSIGN(LIBERAL, &tn->tcp_be_liberal);
++	XASSIGN(NO_WINDOW_CHECK, &tn->tcp_no_window_check);
+ 	XASSIGN(MAX_RETRANS, &tn->tcp_max_retrans);
+ 	XASSIGN(IGNORE_INVALID_RST, &tn->tcp_ignore_invalid_rst);
+ #undef XASSIGN
diff --git a/target/linux/qualcommax/patches-6.6/0600-7-qca-nss-ecm-fix-IPv6-user-route-change-event-calls.patch b/target/linux/qualcommax/patches-6.6/0600-7-qca-nss-ecm-fix-IPv6-user-route-change-event-calls.patch
new file mode 100644
index 00000000000000..e3081a79aafdbe
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0600-7-qca-nss-ecm-fix-IPv6-user-route-change-event-calls.patch
@@ -0,0 +1,87 @@
+From ce18a6fdff6a39a01111d74f513d2ef66142047c Mon Sep 17 00:00:00 2001
+From: Murat Sezgin <msezgin@codeaurora.org>
+Date: Wed, 5 Aug 2020 13:21:27 -0700
+Subject: [PATCH 246/281] net:ipv6: Fix IPv6 user route change event calls
+
+These events should be called only when the route table is
+changed by the userspace. So, we should call them in the
+ioctl and the netlink message handler function.
+
+Change-Id: If7ec615014cfc79d5fa72878e49eaf99c2560c32
+Signed-off-by: Murat Sezgin <msezgin@codeaurora.org>
+---
+	net/ipv6/route.c | 31 +++++++++++++++++++++----------
+	1 file changed, 21 insertions(+), 10 deletions(-)
+
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -3867,10 +3867,6 @@ int ip6_route_add(struct fib6_config *cf
+ 		return PTR_ERR(rt);
+ 
+ 	err = __ip6_ins_rt(rt, &cfg->fc_nlinfo, extack);
+-	if (!err)
+-		atomic_notifier_call_chain(&ip6route_chain,
+-					   RTM_NEWROUTE, rt);
+-
+ 	fib6_info_release(rt);
+ 
+ 	return err;
+@@ -3892,9 +3888,6 @@ static int __ip6_del_rt(struct fib6_info
+ 	err = fib6_del(rt, info);
+ 	spin_unlock_bh(&table->tb6_lock);
+ 
+-	if (!err)
+-		atomic_notifier_call_chain(&ip6route_chain,
+-					   RTM_DELROUTE, rt);
+ out:
+ 	fib6_info_release(rt);
+ 	return err;
+@@ -4500,6 +4493,10 @@ int ipv6_route_ioctl(struct net *net, un
+ 		break;
+ 	}
+ 	rtnl_unlock();
++	if (!err)
++		atomic_notifier_call_chain(&ip6route_chain,
++					   (cmd == SIOCADDRT) ? RTM_NEWROUTE : RTM_DELROUTE, &cfg);
++
+ 	return err;
+ }
+ 
+@@ -5518,11 +5515,17 @@ static int inet6_rtm_delroute(struct sk_
+ 	}
+ 
+ 	if (cfg.fc_mp)
+-		return ip6_route_multipath_del(&cfg, extack);
++		err = ip6_route_multipath_del(&cfg, extack);
+ 	else {
+ 		cfg.fc_delete_all_nh = 1;
+-		return ip6_route_del(&cfg, extack);
++		err = ip6_route_del(&cfg, extack);
+ 	}
++
++	if (!err)
++		atomic_notifier_call_chain(&ip6route_chain,
++					   RTM_DELROUTE, &cfg);
++
++	return err;
+ }
+ 
+ static int inet6_rtm_newroute(struct sk_buff *skb, struct nlmsghdr *nlh,
+@@ -5539,9 +5542,15 @@ static int inet6_rtm_newroute(struct sk_
+ 		cfg.fc_metric = IP6_RT_PRIO_USER;
+ 
+ 	if (cfg.fc_mp)
+-		return ip6_route_multipath_add(&cfg, extack);
++		err = ip6_route_multipath_add(&cfg, extack);
+ 	else
+-		return ip6_route_add(&cfg, GFP_KERNEL, extack);
++		err = ip6_route_add(&cfg, GFP_KERNEL, extack);
++
++	if (!err)
++		atomic_notifier_call_chain(&ip6route_chain,
++					   RTM_NEWROUTE, &cfg);
++
++	return err;
+ }
+ 
+ /* add the overhead of this fib6_nh to nexthop_len */
diff --git a/target/linux/qualcommax/patches-6.6/0605-1-qca-nss-cfi-support.patch b/target/linux/qualcommax/patches-6.6/0605-1-qca-nss-cfi-support.patch
new file mode 100644
index 00000000000000..a0ed16e38f242e
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0605-1-qca-nss-cfi-support.patch
@@ -0,0 +1,127 @@
+--- a/crypto/authenc.c
++++ b/crypto/authenc.c
+@@ -417,6 +417,8 @@ static int crypto_authenc_create(struct
+ 		     enc->base.cra_driver_name) >= CRYPTO_MAX_ALG_NAME)
+ 		goto err_free_inst;
+ 
++	inst->alg.base.cra_flags |= (auth_base->cra_flags |
++				    enc->base.cra_flags) & CRYPTO_ALG_NOSUPP_SG;
+ 	inst->alg.base.cra_priority = enc->base.cra_priority * 10 +
+ 				      auth_base->cra_priority;
+ 	inst->alg.base.cra_blocksize = enc->base.cra_blocksize;
+--- a/include/linux/crypto.h
++++ b/include/linux/crypto.h
+@@ -101,6 +101,11 @@
+ #define CRYPTO_NOLOAD			0x00008000
+ 
+ /*
++ * Set this flag if algorithm does not support SG list transforms
++ */
++#define CRYPTO_ALG_NOSUPP_SG		0x0000c000
++
++/*
+  * The algorithm may allocate memory during request processing, i.e. during
+  * encryption, decryption, or hashing.  Users can request an algorithm with this
+  * flag unset if they can't handle memory allocation failures.
+--- a/net/ipv4/esp4.c
++++ b/net/ipv4/esp4.c
+@@ -3,6 +3,7 @@
+
+ #include <crypto/aead.h>
+ #include <crypto/authenc.h>
++#include <crypto/algapi.h>
+ #include <linux/err.h>
+ #include <linux/module.h>
+ #include <net/ip.h>
+@@ -658,6 +658,7 @@ static int esp_output(struct xfrm_state
+ 	struct ip_esp_hdr *esph;
+ 	struct crypto_aead *aead;
+ 	struct esp_info esp;
++	bool nosupp_sg;
+ 
+ 	esp.inplace = true;
+ 
+@@ -669,6 +670,11 @@ static int esp_output(struct xfrm_state
+ 	aead = x->data;
+ 	alen = crypto_aead_authsize(aead);
+ 
++	nosupp_sg = crypto_tfm_alg_type(&aead->base) & CRYPTO_ALG_NOSUPP_SG;
++	if (nosupp_sg && skb_linearize(skb)) {
++		return -ENOMEM;
++	}
++
+ 	esp.tfclen = 0;
+ 	if (x->tfcpad) {
+ 		struct xfrm_dst *dst = (struct xfrm_dst *)skb_dst(skb);
+@@ -890,6 +896,7 @@ static int esp_input(struct xfrm_state *
+ 	u8 *iv;
+ 	struct scatterlist *sg;
+ 	int err = -EINVAL;
++	bool nosupp_sg;
+ 
+ 	if (!pskb_may_pull(skb, sizeof(struct ip_esp_hdr) + ivlen))
+ 		goto out;
+@@ -897,6 +904,12 @@ static int esp_input(struct xfrm_state *
+ 	if (elen <= 0)
+ 		goto out;
+ 
++	nosupp_sg = crypto_tfm_alg_type(&aead->base) & CRYPTO_ALG_NOSUPP_SG;
++	if (nosupp_sg && skb_linearize(skb)) {
++		err = -ENOMEM;
++		goto out;
++	}
++
+ 	assoclen = sizeof(struct ip_esp_hdr);
+ 	seqhilen = 0;
+ 
+--- a/net/ipv6/esp6.c
++++ b/net/ipv6/esp6.c
+@@ -15,6 +15,7 @@
+
+ #include <crypto/aead.h>
+ #include <crypto/authenc.h>
++#include <crypto/algapi.h>
+ #include <linux/err.h>
+ #include <linux/module.h>
+ #include <net/ip.h>
+@@ -696,6 +696,7 @@ static int esp6_output(struct xfrm_state
+ 	struct ip_esp_hdr *esph;
+ 	struct crypto_aead *aead;
+ 	struct esp_info esp;
++	bool nosupp_sg;
+ 
+ 	esp.inplace = true;
+ 
+@@ -707,6 +708,11 @@ static int esp6_output(struct xfrm_state
+ 	aead = x->data;
+ 	alen = crypto_aead_authsize(aead);
+ 
++	nosupp_sg = crypto_tfm_alg_type(&aead->base) & CRYPTO_ALG_NOSUPP_SG;
++	if (nosupp_sg && skb_linearize(skb)) {
++		return -ENOMEM;
++	}
++
+ 	esp.tfclen = 0;
+ 	if (x->tfcpad) {
+ 		struct xfrm_dst *dst = (struct xfrm_dst *)skb_dst(skb);
+@@ -934,6 +940,7 @@ static int esp6_input(struct xfrm_state
+ 	__be32 *seqhi;
+ 	u8 *iv;
+ 	struct scatterlist *sg;
++	bool nosupp_sg;
+ 
+ 	if (!pskb_may_pull(skb, sizeof(struct ip_esp_hdr) + ivlen)) {
+ 		ret = -EINVAL;
+@@ -945,6 +952,12 @@ static int esp6_input(struct xfrm_state
+ 		goto out;
+ 	}
+ 
++	nosupp_sg = crypto_tfm_alg_type(&aead->base) & CRYPTO_ALG_NOSUPP_SG;
++	if (nosupp_sg && skb_linearize(skb)) {
++		ret = -ENOMEM;
++		goto out;
++	}
++
+ 	assoclen = sizeof(struct ip_esp_hdr);
+ 	seqhilen = 0;
+ 
diff --git a/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch b/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch
new file mode 100644
index 00000000000000..e59b5e5398aea4
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch
@@ -0,0 +1,384 @@
+--- a/include/linux/cpuhotplug.h
++++ b/include/linux/cpuhotplug.h
+@@ -94,6 +94,7 @@ enum cpuhp_state {
+ 	CPUHP_RADIX_DEAD,
+ 	CPUHP_PAGE_ALLOC,
+ 	CPUHP_NET_DEV_DEAD,
++	CPUHP_SKB_RECYCLER_DEAD,
+ 	CPUHP_PCI_XGENE_DEAD,
+ 	CPUHP_IOMMU_IOVA_DEAD,
+ 	CPUHP_LUSTRE_CFS_DEAD,
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -1065,6 +1065,10 @@ struct sk_buff {
+ 	/* only useable after checking ->active_extensions != 0 */
+ 	struct skb_ext		*extensions;
+ #endif
++
++#ifdef CONFIG_DEBUG_OBJECTS_SKBUFF
++	void			*free_addr;
++#endif
+ };
+ 
+ /* if you move pkt_type around you also must adapt those constants */
+@@ -1250,7 +1254,7 @@ static inline void kfree_skb_list(struct sk_buff *segs)
+ 	kfree_skb_list_reason(segs, SKB_DROP_REASON_NOT_SPECIFIED);
+ }
+ 
+-#ifdef CONFIG_TRACEPOINTS
++#ifdef CONFIG_SKB_RECYCLER
+ void consume_skb(struct sk_buff *skb);
+ #else
+ static inline void consume_skb(struct sk_buff *skb)
+@@ -1262,6 +1266,9 @@ static inline void consume_skb(struct sk_buff *skb)
+ void __consume_stateless_skb(struct sk_buff *skb);
+ void  __kfree_skb(struct sk_buff *skb);
+ extern struct kmem_cache *skbuff_cache;
++extern void kfree_skbmem(struct sk_buff *skb);
++extern void skb_release_data(struct sk_buff *skb, enum skb_drop_reason reason,
++			     bool napi_safe);
+ 
+ void kfree_skb_partial(struct sk_buff *skb, bool head_stolen);
+ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,
+--- a/net/Kconfig
++++ b/net/Kconfig
+@@ -369,6 +369,27 @@ config NET_FLOW_LIMIT
+ 	  with many clients some protection against DoS by a single (spoofed)
+ 	  flow that greatly exceeds average workload.
+ 
++config SKB_RECYCLER
++	bool "Generic skb recycling"
++	default y
++	help
++	  SKB_RECYCLER is used to implement RX-to-RX skb recycling.
++	  This config enables the recycling scheme for bridging and
++	  routing workloads. It can reduce skbuff freeing or
++	  reallocation overhead.
++
++config SKB_RECYCLER_MULTI_CPU
++	bool "Cross-CPU recycling for CPU-locked workloads"
++	depends on SMP && SKB_RECYCLER
++	default n
++
++config ALLOC_SKB_PAGE_FRAG_DISABLE
++	bool "Disable page fragment based skbuff payload allocations"
++	depends on !SKB_RECYCLER
++	default n
++	help
++	 Disable page fragment based allocations for skbuff payloads.
++
+ menu "Network testing"
+ 
+ config NET_PKTGEN
+--- a/net/core/Makefile
++++ b/net/core/Makefile
+@@ -41,3 +41,4 @@ obj-$(CONFIG_NET_SOCK_MSG) += skmsg.o
+ obj-$(CONFIG_BPF_SYSCALL) += sock_map.o
+ obj-$(CONFIG_BPF_SYSCALL) += bpf_sk_storage.o
+ obj-$(CONFIG_OF)	+= of_net.o
++obj-$(CONFIG_SKB_RECYCLER) += skbuff_recycle.o
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -6016,10 +6016,16 @@ static int process_backlog(struct napi_struct *napi, int quota)
+ 
+ 	napi->weight = READ_ONCE(dev_rx_weight);
+ 	while (again) {
+-		struct sk_buff *skb;
++		struct sk_buff *skb, *next_skb;
+ 
+ 		while ((skb = __skb_dequeue(&sd->process_queue))) {
+ 			rcu_read_lock();
++
++			next_skb = skb_peek(&sd->process_queue);
++			if (likely(next_skb)) {
++				prefetch(next_skb->data);
++			}
++
+ 			__netif_receive_skb(skb);
+ 			rcu_read_unlock();
+ 			input_queue_head_incr(sd);
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -87,6 +87,31 @@
+ 
+ #include "dev.h"
+ #include "sock_destructor.h"
++#include "skbuff_recycle.h"
++
++struct kmem_cache *skb_data_cache;
++/*
++ * For low memory profile, NSS_SKB_FIXED_SIZE_2K is enabled and
++ * CONFIG_SKB_RECYCLER is disabled. For premium and enterprise profile
++ * CONFIG_SKB_RECYCLER is enabled and NSS_SKB_FIXED_SIZE_2K is disabled.
++ * Irrespective of NSS_SKB_FIXED_SIZE_2K enabled/disabled, the
++ * CONFIG_SKB_RECYCLER and __LP64__ determines the value of SKB_DATA_CACHE_SIZE
++ */
++#if defined(CONFIG_SKB_RECYCLER)
++/*
++ * 2688 for 64bit arch, 2624 for 32bit arch
++ */
++#define SKB_DATA_CACHE_SIZE (SKB_DATA_ALIGN(SKB_RECYCLE_SIZE + NET_SKB_PAD) + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
++#else
++/*
++ * 2368 for 64bit arch, 2176 for 32bit arch
++ */
++#if defined(__LP64__)
++#define SKB_DATA_CACHE_SIZE ((SKB_DATA_ALIGN(1984 + NET_SKB_PAD)) + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
++#else
++#define SKB_DATA_CACHE_SIZE ((SKB_DATA_ALIGN(1856 + NET_SKB_PAD)) + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
++#endif
++#endif
+ 
+ struct kmem_cache *skbuff_cache __ro_after_init;
+ static struct kmem_cache *skbuff_fclone_cache __ro_after_init;
+@@ -551,21 +576,20 @@ static void *kmalloc_reserve(unsigned int *size, gfp_t flags, int node,
+ 			     bool *pfmemalloc)
+ {
+ 	bool ret_pfmemalloc = false;
+-	size_t obj_size;
++	unsigned int obj_size = *size;
+ 	void *obj;
+ 
+ 	obj_size = SKB_HEAD_ALIGN(*size);
+-	if (obj_size <= SKB_SMALL_HEAD_CACHE_SIZE &&
+-	    !(flags & KMALLOC_NOT_NORMAL_BITS)) {
+-		obj = kmem_cache_alloc_node(skb_small_head_cache,
+-				flags | __GFP_NOMEMALLOC | __GFP_NOWARN,
+-				node);
+-		*size = SKB_SMALL_HEAD_CACHE_SIZE;
++	if (obj_size > SZ_2K && obj_size <= SKB_DATA_CACHE_SIZE) {
++		obj = kmem_cache_alloc_node(skb_data_cache,
++						flags | __GFP_NOMEMALLOC | __GFP_NOWARN,
++						node);
++		*size = SKB_DATA_CACHE_SIZE;
+ 		if (obj || !(gfp_pfmemalloc_allowed(flags)))
+ 			goto out;
+ 		/* Try again but now we are using pfmemalloc reserves */
+ 		ret_pfmemalloc = true;
+-		obj = kmem_cache_alloc_node(skb_small_head_cache, flags, node);
++		obj = kmem_cache_alloc_node(skb_data_cache, flags, node);
+ 		goto out;
+ 	}
+ 
+@@ -648,10 +671,12 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
+ 	 * aligned memory blocks, unless SLUB/SLAB debug is enabled.
+ 	 * Both skb->head and skb_shared_info are cache line aligned.
+ 	 */
++	size = SKB_DATA_ALIGN(size);
++	size += SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
+ 	data = kmalloc_reserve(&size, gfp_mask, node, &pfmemalloc);
+ 	if (unlikely(!data))
+ 		goto nodata;
+-	/* kmalloc_size_roundup() might give us more room than requested.
++	/* kmalloc_reserve(size) might give us more room than requested.
+ 	 * Put skb_shared_info exactly at the end of allocated zone,
+ 	 * to allow max possible filling before reallocation.
+ 	 */
+@@ -686,7 +711,7 @@ EXPORT_SYMBOL(__alloc_skb);
+ /**
+  *	__netdev_alloc_skb - allocate an skbuff for rx on a specific device
+  *	@dev: network device to receive on
+- *	@len: length to allocate
++ *	@length: length to allocate
+  *	@gfp_mask: get_free_pages mask, passed to alloc_skb
+  *
+  *	Allocate a new &sk_buff and assign it a usage count of one. The
+@@ -696,29 +721,53 @@ EXPORT_SYMBOL(__alloc_skb);
+  *
+  *	%NULL is returned if there is no free memory.
+  */
+-struct sk_buff *__netdev_alloc_skb(struct net_device *dev, unsigned int len,
+-				   gfp_t gfp_mask)
++struct sk_buff *__netdev_alloc_skb(struct net_device *dev,
++				   unsigned int length, gfp_t gfp_mask)
+ {
+-	struct page_frag_cache *nc;
+ 	struct sk_buff *skb;
++	unsigned int len = length;
++
++#ifdef CONFIG_SKB_RECYCLER
++	skb = skb_recycler_alloc(dev, length);
++	if (likely(skb))
++		return skb;
++
++	len = SKB_RECYCLE_SIZE;
++	if (unlikely(length > SKB_RECYCLE_SIZE))
++		len = length;
++
++	skb = __alloc_skb(len + NET_SKB_PAD, gfp_mask,
++			  SKB_ALLOC_RX, NUMA_NO_NODE);
++	if (!skb)
++		goto skb_fail;
++	goto skb_success;
++#else
++	struct page_frag_cache *nc;
+ 	bool pfmemalloc;
++	bool page_frag_alloc_enable = true;
+ 	void *data;
+ 
+ 	len += NET_SKB_PAD;
+ 
++
++#ifdef CONFIG_ALLOC_SKB_PAGE_FRAG_DISABLE
++	page_frag_alloc_enable = false;
++#endif
+ 	/* If requested length is either too small or too big,
+ 	 * we use kmalloc() for skb->head allocation.
+ 	 */
+ 	if (len <= SKB_WITH_OVERHEAD(1024) ||
+ 	    len > SKB_WITH_OVERHEAD(PAGE_SIZE) ||
+-	    (gfp_mask & (__GFP_DIRECT_RECLAIM | GFP_DMA))) {
++	    (gfp_mask & (__GFP_DIRECT_RECLAIM | GFP_DMA)) ||
++	    !page_frag_alloc_enable) {
+ 		skb = __alloc_skb(len, gfp_mask, SKB_ALLOC_RX, NUMA_NO_NODE);
+ 		if (!skb)
+ 			goto skb_fail;
+ 		goto skb_success;
+ 	}
+ 
+-	len = SKB_HEAD_ALIGN(len);
++	len += SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
++	len = SKB_DATA_ALIGN(len);
+ 
+ 	if (sk_memalloc_socks())
+ 		gfp_mask |= __GFP_MEMALLOC;
+@@ -747,6 +796,7 @@ struct sk_buff *__netdev_alloc_skb(struct net_device *dev, unsigned int len,
+ 	if (pfmemalloc)
+ 		skb->pfmemalloc = 1;
+ 	skb->head_frag = 1;
++#endif
+ 
+ skb_success:
+ 	skb_reserve(skb, NET_SKB_PAD);
+@@ -817,7 +867,8 @@ struct sk_buff *__napi_alloc_skb(struct napi_struct *napi, unsigned int len,
+ 		data = page_frag_alloc_1k(&nc->page_small, gfp_mask);
+ 		pfmemalloc = NAPI_SMALL_PAGE_PFMEMALLOC(nc->page_small);
+ 	} else {
+-		len = SKB_HEAD_ALIGN(len);
++		len += SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
++		len = SKB_DATA_ALIGN(len);
+ 
+ 		data = page_frag_alloc(&nc->page, len, gfp_mask);
+ 		pfmemalloc = nc->page.pfmemalloc;
+@@ -975,7 +1026,7 @@ static void skb_free_head(struct sk_buff *skb, bool napi_safe)
+ 	}
+ }
+ 
+-static void skb_release_data(struct sk_buff *skb, enum skb_drop_reason reason,
++void skb_release_data(struct sk_buff *skb, enum skb_drop_reason reason,
+ 			     bool napi_safe)
+ {
+ 	struct skb_shared_info *shinfo = skb_shinfo(skb);
+@@ -1018,7 +1069,7 @@ static void skb_release_data(struct sk_buff *skb, enum skb_drop_reason reason,
+ /*
+  *	Free an skbuff by memory without cleaning the state.
+  */
+-static void kfree_skbmem(struct sk_buff *skb)
++void kfree_skbmem(struct sk_buff *skb)
+ {
+ 	struct sk_buff_fclones *fclones;
+ 
+@@ -1282,7 +1333,6 @@ void skb_tx_error(struct sk_buff *skb)
+ }
+ EXPORT_SYMBOL(skb_tx_error);
+ 
+-#ifdef CONFIG_TRACEPOINTS
+ /**
+  *	consume_skb - free an skbuff
+  *	@skb: buffer to free
+@@ -1291,13 +1341,48 @@ EXPORT_SYMBOL(skb_tx_error);
+  *	Functions identically to kfree_skb, but kfree_skb assumes that the frame
+  *	is being dropped after a failure and notes that
+  */
++#ifdef CONFIG_SKB_RECYCLER
+ void consume_skb(struct sk_buff *skb)
+ {
+ 	if (!skb_unref(skb))
+ 		return;
++	prefetch(&skb->destructor);
++
++	/*Tian: Not sure if we need to continue using this since
++	 * since unref does the work in 5.4
++	 */
++
++	/*
++	if (likely(atomic_read(&skb->users) == 1))
++		smp_rmb();
++	else if (likely(!atomic_dec_and_test(&skb->users)))
++		return;
++	*/
+ 
++	/* If possible we'd like to recycle any skb rather than just free it,
++	 * but in order to do that we need to release any head state too.
++	 * We don't want to do this later because we'll be in a pre-emption
++	 * disabled state.
++	 */
++	skb_release_head_state(skb);
++
++	/* Can we recycle this skb?  If we can then it will be much faster
++	 * for us to recycle this one later than to allocate a new one
++	 * from scratch.
++	 */
++	if (likely(skb->head) && likely(skb_recycler_consume(skb)))
++		return;
++
++#ifdef CONFIG_TRACEPOINTS
+ 	trace_consume_skb(skb, __builtin_return_address(0));
+-	__kfree_skb(skb);
++#endif
++	/* We're not recycling so now we need to do the rest of what we would
++	 * have done in __kfree_skb (above and beyond the skb_release_head_state
++	 * that we already did).
++	 */
++	if (likely(skb->head))
++	  skb_release_data(skb, SKB_CONSUMED, false);
++	kfree_skbmem(skb);
+ }
+ EXPORT_SYMBOL(consume_skb);
+ #endif
+@@ -2107,6 +2192,8 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
+ 	if (skb_pfmemalloc(skb))
+ 		gfp_mask |= __GFP_MEMALLOC;
+ 
++	size = SKB_DATA_ALIGN(size);
++	size += SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
+ 	data = kmalloc_reserve(&size, gfp_mask, NUMA_NO_NODE, NULL);
+ 	if (!data)
+ 		goto nodata;
+@@ -4854,6 +4941,10 @@ static void skb_extensions_init(void) {}
+ 
+ void __init skb_init(void)
+ {
++	skb_data_cache = kmem_cache_create_usercopy("skb_data_cache",
++						SKB_DATA_CACHE_SIZE,
++						0, SLAB_PANIC, 0, SKB_DATA_CACHE_SIZE,
++						NULL);
+ 	skbuff_cache = kmem_cache_create_usercopy("skbuff_head_cache",
+ 					      sizeof(struct sk_buff),
+ 					      0,
+@@ -4879,6 +4970,7 @@ void __init skb_init(void)
+ 						SKB_SMALL_HEAD_HEADROOM,
+ 						NULL);
+ 	skb_extensions_init();
++	skb_recycler_init();
+ }
+ 
+ static int
+@@ -6382,6 +6474,8 @@ static int pskb_carve_inside_header(struct sk_buff *skb, const u32 off,
+ 	if (skb_pfmemalloc(skb))
+ 		gfp_mask |= __GFP_MEMALLOC;
+ 
++	size = SKB_DATA_ALIGN(size);
++	size += SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
+ 	data = kmalloc_reserve(&size, gfp_mask, NUMA_NO_NODE, NULL);
+ 	if (!data)
+ 		return -ENOMEM;
+@@ -6498,6 +6592,8 @@ static int pskb_carve_inside_nonlinear(struct sk_buff *skb, const u32 off,
+ 	if (skb_pfmemalloc(skb))
+ 		gfp_mask |= __GFP_MEMALLOC;
+ 
++	size = SKB_DATA_ALIGN(size);
++	size += SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
+ 	data = kmalloc_reserve(&size, gfp_mask, NUMA_NO_NODE, NULL);
+ 	if (!data)
+ 		return -ENOMEM;

From d37d689906df4f999d5eb51f4fe484c08c982128 Mon Sep 17 00:00:00 2001
From: Qosmio <datapronix@protonmail.com>
Date: Sat, 9 Mar 2024 11:17:51 -0500
Subject: [PATCH 097/225] qualcommax: remove uneeded btcoex dts

not needed for NSS offload and helps save some memory
---
 .../patches-6.6/9999-add-btcoex-dts.patch     | 30 -------------------
 1 file changed, 30 deletions(-)
 delete mode 100644 target/linux/qualcommax/patches-6.6/9999-add-btcoex-dts.patch

diff --git a/target/linux/qualcommax/patches-6.6/9999-add-btcoex-dts.patch b/target/linux/qualcommax/patches-6.6/9999-add-btcoex-dts.patch
deleted file mode 100644
index 83825b782c1b7f..00000000000000
--- a/target/linux/qualcommax/patches-6.6/9999-add-btcoex-dts.patch
+++ /dev/null
@@ -1,30 +0,0 @@
---- linux-6.1.71/arch/arm64/boot/dts/qcom/ipq8074.dtsi	2024-01-07 01:44:56.908138962 -0500
-+++ linux-6.1.71/arch/arm64/boot/dts/qcom/ipq8074.dtsi	2024-01-07 01:44:58.908138962 -0500
-@@ -1170,7 +1170,14 @@
- 		wifi: wifi@c0000000 {
- 			compatible = "qcom,ipq8074-wifi";
- 			reg = <0xc000000 0x2000000>;
--
-+			qcom,hw-mode-id = <1>;
-+		#ifdef __IPQ_MEM_PROFILE_256_MB__
-+			qcom,tgt-mem-mode = <2>;
-+		#elif __IPQ_MEM_PROFILE_512_MB__
-+			qcom,tgt-mem-mode = <1>;
-+		#else
-+			qcom,tgt-mem-mode = <0>;
-+		#endif
- 			interrupts = <GIC_SPI 320 IRQ_TYPE_EDGE_RISING>,
- 				     <GIC_SPI 319 IRQ_TYPE_EDGE_RISING>,
- 				     <GIC_SPI 318 IRQ_TYPE_EDGE_RISING>,
-@@ -1276,6 +1283,12 @@
- 					  "tcl2host-status-ring";
- 			qcom,rproc = <&q6v5_wcss>;
- 			status = "disabled";
-+			qcom,pta-num = <0>;
-+			qcom,coex-mode = <0x2>;
-+			qcom,bt-active-time = <0x12>;
-+			qcom,bt-priority-time = <0x0c>;
-+			qcom,coex-algo = <0x2>;
-+			qcom,pta-priority = <0x80800505>;
- 		};
- 	};

From 633a5aacb8840f61bfac6a9baf7e5f836577248f Mon Sep 17 00:00:00 2001
From: Qosmio <datapronix@protonmail.com>
Date: Sun, 24 Mar 2024 21:33:21 -0400
Subject: [PATCH 098/225] qualcommax: Move QCE to user selectable module

The performance of Qualcomm Crypto Engine is 10x slower than kernel
based encryption via ARMv8 crypto extensions. Rather than building it
into the kernel allow users to select it as module which can be tested with
other HW based crypto APIs via cryptodev-linux.
---
 package/kernel/linux/modules/crypto.mk | 18 +++++++++++++++++-
 target/linux/qualcommax/config-6.6     | 12 ++++++------
 2 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/package/kernel/linux/modules/crypto.mk b/package/kernel/linux/modules/crypto.mk
index 2257a36c802cda..0e67c6cf9ebab6 100644
--- a/package/kernel/linux/modules/crypto.mk
+++ b/package/kernel/linux/modules/crypto.mk
@@ -1173,7 +1173,6 @@ endef
 
 $(eval $(call KernelPackage,crypto-xts))
 
-
 define KernelPackage/crypto-xxhash
   TITLE:=xxHash non-cryptographic hash algorithm
   DEPENDS:=+kmod-crypto-hash +kmod-lib-xxhash
@@ -1185,3 +1184,20 @@ endef
 
 $(eval $(call KernelPackage,crypto-xxhash))
 
+define KernelPackage/crypto-qce
+  TITLE:=QTI Crypto Engine (QCE)
+  KCONFIG:= \
+	CONFIG_CRYPTO_DEV_QCE \
+	CONFIG_CRYPTO_DEV_QCE_AEAD=y \
+	CONFIG_CRYPTO_DEV_QCE_ENABLE_ALL=y \
+	CONFIG_CRYPTO_DEV_QCE_SHA=y \
+	CONFIG_CRYPTO_DEV_QCE_SKCIPHER=y \
+	CONFIG_CRYPTO_DEV_QCE_SW_MAX_LEN=512
+  FILES:= \
+	$(LINUX_DIR)/drivers/crypto/qce/qcrypto.ko
+  AUTOLOAD:=$(call AutoLoad,09,qcrypto)
+  DEPENDS:=@TARGET_qualcommax +kmod-crypto-manager +kmod-crypto-hash +kmod-crypto-des
+  $(call AddDepends/crypto)
+endef
+
+$(eval $(call KernelPackage,crypto-qce))
diff --git a/target/linux/qualcommax/config-6.6 b/target/linux/qualcommax/config-6.6
index 70fb9a00e4834b..0c96379c8757d4 100644
--- a/target/linux/qualcommax/config-6.6
+++ b/target/linux/qualcommax/config-6.6
@@ -99,15 +99,15 @@ CONFIG_CRC8=y
 CONFIG_CRYPTO_AUTHENC=y
 CONFIG_CRYPTO_CBC=y
 CONFIG_CRYPTO_DEFLATE=y
-CONFIG_CRYPTO_DEV_QCE=y
-CONFIG_CRYPTO_DEV_QCE_AEAD=y
+# CONFIG_CRYPTO_DEV_QCE=y
+# CONFIG_CRYPTO_DEV_QCE_AEAD=y
 # CONFIG_CRYPTO_DEV_QCE_ENABLE_AEAD is not set
-CONFIG_CRYPTO_DEV_QCE_ENABLE_ALL=y
+# CONFIG_CRYPTO_DEV_QCE_ENABLE_ALL=y
 # CONFIG_CRYPTO_DEV_QCE_ENABLE_SHA is not set
 # CONFIG_CRYPTO_DEV_QCE_ENABLE_SKCIPHER is not set
-CONFIG_CRYPTO_DEV_QCE_SHA=y
-CONFIG_CRYPTO_DEV_QCE_SKCIPHER=y
-CONFIG_CRYPTO_DEV_QCE_SW_MAX_LEN=512
+# CONFIG_CRYPTO_DEV_QCE_SHA=y
+# CONFIG_CRYPTO_DEV_QCE_SKCIPHER=y
+# CONFIG_CRYPTO_DEV_QCE_SW_MAX_LEN=512
 CONFIG_CRYPTO_DEV_QCOM_RNG=y
 CONFIG_CRYPTO_ECB=y
 CONFIG_CRYPTO_HASH_INFO=y

From 579846f23502c4fa959fbd740d184d70ea13cecf Mon Sep 17 00:00:00 2001
From: Qosmio <datapronix@protonmail.com>
Date: Sun, 24 Mar 2024 22:44:54 -0400
Subject: [PATCH 099/225] qualcommax: NSS: kernel 6.6 support

---
 package/kernel/linux/modules/netfilter.mk     |   1 +
 target/linux/qualcommax/config-6.6            |  22 +-
 .../files/net/core/skbuff_recycle.c           |   5 +
 ...added-for-necessary-clocks-and-reset.patch | 311 +++++++
 ...-gcc_snoc_bus_timeout_ahb_clk-offset.patch |  44 +
 ...074-Fix-gcc_blsp1_ahb_clk-properties.patch |  41 +
 ...-2-qca-nss-ecm-support-PPPOE-offload.patch | 600 ++++++++++++
 ...00-3-qca-nss-ecm-support-net-bonding.patch |  46 +
 ...pport-net-bonding-over-LAG-interface.patch | 685 ++++++++++++++
 .../0600-5-qca-nss-ecm-support-macvlan.patch  |  96 ++
 ...nss-ecm-support-netfilter-DSCPREMARK.patch | 154 +++
 ...601-1-qca-add-nss-bridge-mgr-support.patch |  92 ++
 ...0602-1-qca-nss-drv-add-qdisc-support.patch |  25 +
 ...-1-qca-nss-clients-add-qdisc-support.patch | 463 +++++++++
 ...3-2-qca-nss-clients-add-l2tp-support.patch |  46 +
 ...3-3-qca-nss-clients-add-PPTP-support.patch | 478 ++++++++++
 ...qca-nss-clients-add-iptunnel-support.patch |  77 ++
 ...-5-qca-nss-clients-add-vxlan-support.patch | 103 ++
 ...-clients-add-l2tp-offloading-support.patch | 368 ++++++++
 ...a-nss-clients-iptunnel-lock-this-cpu.patch |  22 +
 ...-qca-nss-clients-add-tls-mgr-support.patch |  24 +
 .../0604-1-qca-add-mcs-support.patch          | 876 ++++++++++++++++++
 ...-api-disallow-identical-driver-names.patch |  10 +
 ...0980-3-mtd-silence-UBI-NAND-warnings.patch |  13 +
 24 files changed, 4598 insertions(+), 4 deletions(-)
 create mode 100644 target/linux/qualcommax/patches-6.6/0170-clk-qcom-ipq8074-Support-added-for-necessary-clocks-and-reset.patch
 create mode 100644 target/linux/qualcommax/patches-6.6/0171-1-clk-qcom-ipq8074-Fix-gcc_snoc_bus_timeout_ahb_clk-offset.patch
 create mode 100644 target/linux/qualcommax/patches-6.6/0171-2-clk-qcom-ipq8074-Fix-gcc_blsp1_ahb_clk-properties.patch
 create mode 100644 target/linux/qualcommax/patches-6.6/0600-2-qca-nss-ecm-support-PPPOE-offload.patch
 create mode 100644 target/linux/qualcommax/patches-6.6/0600-3-qca-nss-ecm-support-net-bonding.patch
 create mode 100644 target/linux/qualcommax/patches-6.6/0600-4-qca-nss-ecm-support-net-bonding-over-LAG-interface.patch
 create mode 100644 target/linux/qualcommax/patches-6.6/0600-5-qca-nss-ecm-support-macvlan.patch
 create mode 100644 target/linux/qualcommax/patches-6.6/0600-6-qca-nss-ecm-support-netfilter-DSCPREMARK.patch
 create mode 100644 target/linux/qualcommax/patches-6.6/0601-1-qca-add-nss-bridge-mgr-support.patch
 create mode 100644 target/linux/qualcommax/patches-6.6/0602-1-qca-nss-drv-add-qdisc-support.patch
 create mode 100644 target/linux/qualcommax/patches-6.6/0603-1-qca-nss-clients-add-qdisc-support.patch
 create mode 100644 target/linux/qualcommax/patches-6.6/0603-2-qca-nss-clients-add-l2tp-support.patch
 create mode 100644 target/linux/qualcommax/patches-6.6/0603-3-qca-nss-clients-add-PPTP-support.patch
 create mode 100644 target/linux/qualcommax/patches-6.6/0603-4-qca-nss-clients-add-iptunnel-support.patch
 create mode 100644 target/linux/qualcommax/patches-6.6/0603-5-qca-nss-clients-add-vxlan-support.patch
 create mode 100644 target/linux/qualcommax/patches-6.6/0603-6-qca-nss-clients-add-l2tp-offloading-support.patch
 create mode 100644 target/linux/qualcommax/patches-6.6/0603-7-qca-nss-clients-iptunnel-lock-this-cpu.patch
 create mode 100644 target/linux/qualcommax/patches-6.6/0603-8-qca-nss-clients-add-tls-mgr-support.patch
 create mode 100644 target/linux/qualcommax/patches-6.6/0604-1-qca-add-mcs-support.patch
 create mode 100644 target/linux/qualcommax/patches-6.6/0980-2-Revert-crypto-api-disallow-identical-driver-names.patch
 create mode 100644 target/linux/qualcommax/patches-6.6/0980-3-mtd-silence-UBI-NAND-warnings.patch

diff --git a/package/kernel/linux/modules/netfilter.mk b/package/kernel/linux/modules/netfilter.mk
index cf66bd8cd8c7ee..c7d89227d4b765 100644
--- a/package/kernel/linux/modules/netfilter.mk
+++ b/package/kernel/linux/modules/netfilter.mk
@@ -328,6 +328,7 @@ $(eval $(call KernelPackage,ipt-offload))
 define KernelPackage/ipt-ipopt
   TITLE:=Modules for matching/changing IP packet options
   KCONFIG:=$(KCONFIG_IPT_IPOPT)
+  DEPENDS:=+PACKAGE_kmod-nf-conntrack:kmod-nf-conntrack
   FILES:=$(foreach mod,$(IPT_IPOPT-m),$(LINUX_DIR)/net/$(mod).ko)
   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_IPOPT-m)))
   $(call AddDepends/ipt)
diff --git a/target/linux/qualcommax/config-6.6 b/target/linux/qualcommax/config-6.6
index 0c96379c8757d4..1eac5124ae7931 100644
--- a/target/linux/qualcommax/config-6.6
+++ b/target/linux/qualcommax/config-6.6
@@ -44,6 +44,8 @@ CONFIG_ARM64_WORKAROUND_TSB_FLUSH_FAILURE=y
 CONFIG_ARM_AMBA=y
 CONFIG_ARM_ARCH_TIMER=y
 CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
+# CONFIG_ARM_SMMU_V3_PMU is not set
+# CONFIG_ARM_CORESIGHT_PMU_ARCH_SYSTEM_PMU is not set
 CONFIG_ARM_GIC=y
 CONFIG_ARM_GIC_V2M=y
 CONFIG_ARM_GIC_V3=y
@@ -76,11 +78,11 @@ CONFIG_COREDUMP=y
 CONFIG_CPUFREQ_DT=y
 CONFIG_CPUFREQ_DT_PLATDEV=y
 CONFIG_CPU_FREQ=y
-# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
-CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL is not set
 CONFIG_CPU_FREQ_GOV_ATTR_SET=y
 # CONFIG_CPU_FREQ_GOV_CONSERVATIVE is not set
-# CONFIG_CPU_FREQ_GOV_ONDEMAND is not set
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
 CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
 # CONFIG_CPU_FREQ_GOV_POWERSAVE is not set
 CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
@@ -123,6 +125,8 @@ CONFIG_CRYPTO_RNG=y
 CONFIG_CRYPTO_RNG2=y
 CONFIG_CRYPTO_SHA1=y
 CONFIG_CRYPTO_SHA256=y
+# CONFIG_CRYPTO_SM4_ARM64_CE_CCM is not set
+# CONFIG_CRYPTO_SM4_ARM64_CE_GCM is not set
 CONFIG_CRYPTO_XTS=y
 CONFIG_CRYPTO_ZSTD=y
 CONFIG_DCACHE_WORD_ACCESS=y
@@ -189,6 +193,11 @@ CONFIG_HAS_IOPORT=y
 CONFIG_HAS_IOPORT_MAP=y
 CONFIG_HWSPINLOCK=y
 CONFIG_HWSPINLOCK_QCOM=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_MSM=y
+CONFIG_HZ=1000
+# CONFIG_HZ_100 is not set
+CONFIG_HZ_1000=y
 CONFIG_I2C=y
 CONFIG_I2C_BOARDINFO=y
 CONFIG_I2C_CHARDEV=y
@@ -373,7 +382,12 @@ CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y
 CONFIG_POWER_RESET=y
 # CONFIG_POWER_RESET_MSM is not set
 CONFIG_POWER_SUPPLY=y
-CONFIG_PREEMPT_NONE_BUILD=y
+CONFIG_PREEMPT=y
+CONFIG_PREEMPT_COUNT=y
+# CONFIG_PREEMPT_DYNAMIC is not set
+# CONFIG_PREEMPT_NONE_BUILD is not set
+# CONFIG_PREEMPT_NONE is not set
+CONFIG_PREEMPT_RCU=y
 CONFIG_PRINTK_TIME=y
 CONFIG_PTP_1588_CLOCK_OPTIONAL=y
 CONFIG_QCA807X_PHY=y
diff --git a/target/linux/qualcommax/files/net/core/skbuff_recycle.c b/target/linux/qualcommax/files/net/core/skbuff_recycle.c
index 41add8d3098fca..cbcbc46c70d0a5 100644
--- a/target/linux/qualcommax/files/net/core/skbuff_recycle.c
+++ b/target/linux/qualcommax/files/net/core/skbuff_recycle.c
@@ -18,6 +18,7 @@
 #include "skbuff_recycle.h"
 #include <linux/proc_fs.h>
 #include <linux/string.h>
+#include <linux/version.h>
 
 #include "skbuff_debug.h"
 
@@ -279,7 +280,11 @@ static void skb_recycler_free_skb(struct sk_buff_head *list)
 		skbuff_debugobj_activate(skb);
 		next = skb->next;
 		__skb_unlink(skb, list);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6,2,0)
+		skb_release_data(skb, SKB_CONSUMED, false);
+#else
 		skb_release_data(skb);
+#endif
 		kfree_skbmem(skb);
 		/*
 		 * Update the skb->sum for next due to skb_link operation
diff --git a/target/linux/qualcommax/patches-6.6/0170-clk-qcom-ipq8074-Support-added-for-necessary-clocks-and-reset.patch b/target/linux/qualcommax/patches-6.6/0170-clk-qcom-ipq8074-Support-added-for-necessary-clocks-and-reset.patch
new file mode 100644
index 00000000000000..76cc8caac9a412
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0170-clk-qcom-ipq8074-Support-added-for-necessary-clocks-and-reset.patch
@@ -0,0 +1,311 @@
+From 6504bc9edeb1a2a54d813f4bb5d0267e7bf827f9 Mon Sep 17 00:00:00 2001
+From: Praveenkumar I <ipkumar@codeaurora.org>
+Date: Thu, 6 Feb 2020 17:35:42 +0530
+Subject: [PATCH 4/8] clk: ipq8074: Support added for necessary clocks and
+ reset
+
+Change-Id: I21a76a44185f766e9b6dcba274392ea8e599718b
+Signed-off-by: Praveenkumar I <ipkumar@codeaurora.org>
+Signed-off-by: Rajkumar Ayyasamy <arajkuma@codeaurora.org>
+---
+ drivers/clk/qcom/gcc-ipq8074.c               | 238 ++++++++++++++++++-
+ include/dt-bindings/clock/qcom,gcc-ipq8074.h |  35 ++-
+ 2 files changed, 258 insertions(+), 15 deletions(-)
+
+--- a/drivers/clk/qcom/gcc-ipq8074.c
++++ b/drivers/clk/qcom/gcc-ipq8074.c
+@@ -48,6 +48,22 @@ enum {
+ 	P_UNIPHY2_TX,
+ };
+ 
++static const char * const gcc_xo_gpll4_gpll0_gpll6_gpll0_div2[] = {
++	"xo",
++	"gpll4",
++	"gpll0",
++	"gpll6",
++	"gpll0_out_main_div2",
++};
++
++static const struct parent_map gcc_xo_gpll4_gpll0_gpll6_gpll0_div2_map[] = {
++	{ P_XO, 0 },
++	{ P_GPLL4, 1 },
++	{ P_GPLL0, 2 },
++	{ P_GPLL6, 3 },
++	{ P_GPLL0_DIV2, 4 },
++};
++
+ static struct clk_alpha_pll gpll0_main = {
+ 	.offset = 0x21000,
+ 	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
+@@ -629,6 +645,12 @@ static const struct freq_tbl ftbl_pcie_a
+ 	{ }
+ };
+ 
++struct freq_tbl ftbl_pcie_rchng_clk_src[] = {
++	F(19200000, P_XO, 1, 0, 0),
++	F(100000000, P_GPLL0, 8, 0, 0),
++	{ }
++};
++
+ static struct clk_rcg2 pcie0_axi_clk_src = {
+ 	.cmd_rcgr = 0x75054,
+ 	.freq_tbl = ftbl_pcie_axi_clk_src,
+@@ -2029,6 +2051,78 @@ static struct clk_rcg2 gp3_clk_src = {
+ 	},
+ };
+ 
++struct freq_tbl ftbl_qdss_tsctr_clk_src[] = {
++	F(160000000, P_GPLL0_DIV2, 2.5, 0, 0),
++	F(320000000, P_GPLL0, 2.5, 0, 0),
++	F(600000000, P_GPLL6, 2, 0, 0),
++	{ }
++};
++
++struct clk_rcg2 qdss_tsctr_clk_src = {
++	.cmd_rcgr = 0x29064,
++	.freq_tbl = ftbl_qdss_tsctr_clk_src,
++	.hid_width = 5,
++	.parent_map = gcc_xo_gpll4_gpll0_gpll6_gpll0_div2_map,
++	.clkr.hw.init = &(struct clk_init_data){
++		.name = "qdss_tsctr_clk_src",
++		.parent_names = gcc_xo_gpll4_gpll0_gpll6_gpll0_div2,
++		.num_parents = 5,
++		.ops = &clk_rcg2_ops,
++	},
++};
++
++static struct clk_fixed_factor qdss_dap_sync_clk_src = {
++	.mult = 1,
++	.div = 4,
++	.hw.init = &(struct clk_init_data){
++		.name = "qdss_dap_sync_clk_src",
++		.parent_names = (const char *[]){
++			"qdss_tsctr_clk_src"
++		},
++		.num_parents = 1,
++		.ops = &clk_fixed_factor_ops,
++	},
++};
++
++struct freq_tbl ftbl_qdss_at_clk_src[] = {
++	F(66670000, P_GPLL0_DIV2, 6, 0, 0),
++	F(240000000, P_GPLL6, 6, 0, 0),
++	{ }
++};
++
++struct clk_rcg2 qdss_at_clk_src = {
++	.cmd_rcgr = 0x2900c,
++	.freq_tbl = ftbl_qdss_at_clk_src,
++	.hid_width = 5,
++	.parent_map = gcc_xo_gpll4_gpll0_gpll6_gpll0_div2_map,
++	.clkr.hw.init = &(struct clk_init_data){
++		.name = "qdss_at_clk_src",
++		.parent_names = gcc_xo_gpll4_gpll0_gpll6_gpll0_div2,
++		.num_parents = 5,
++		.ops = &clk_rcg2_ops,
++	},
++};
++
++
++struct freq_tbl ftbl_adss_pwm_clk_src[] = {
++	F(19200000, P_XO, 1, 0, 0),
++	F(200000000, P_GPLL0, 4, 0, 0),
++	{ }
++};
++
++struct clk_rcg2 adss_pwm_clk_src = {
++	.cmd_rcgr = 0x1c008,
++	.freq_tbl = ftbl_adss_pwm_clk_src,
++	.hid_width = 5,
++	.parent_map = gcc_xo_gpll0_map,
++	.clkr.hw.init = &(struct clk_init_data){
++		.name = "adss_pwm_clk_src",
++		.parent_data = gcc_xo_gpll0,
++		.num_parents = 2,
++		.ops = &clk_rcg2_ops,
++	},
++};
++
+ static struct clk_branch gcc_blsp1_ahb_clk = {
+ 	.halt_reg = 0x01008,
+ 	.clkr = {
+@@ -4224,13 +4318,7 @@ static struct clk_branch gcc_gp3_clk = {
+ 	},
+ };
+ 
+-static const struct freq_tbl ftbl_pcie_rchng_clk_src[] = {
+-	F(19200000, P_XO, 1, 0, 0),
+-	F(100000000, P_GPLL0, 8, 0, 0),
+-	{ }
+-};
+-
+-static struct clk_rcg2 pcie0_rchng_clk_src = {
++struct clk_rcg2 pcie0_rchng_clk_src = {
+ 	.cmd_rcgr = 0x75070,
+ 	.freq_tbl = ftbl_pcie_rchng_clk_src,
+ 	.hid_width = 5,
+@@ -4322,6 +4410,114 @@ static const struct alpha_pll_config nss
+ 	.alpha_en_mask = BIT(24),
+ };
+ 
++static struct clk_branch gcc_snoc_bus_timeout2_ahb_clk = {
++	.halt_reg = 0x4700c,
++	.halt_bit = 31,
++	.clkr = {
++		.enable_reg = 0x4700c,
++		.enable_mask = BIT(0),
++		.hw.init = &(struct clk_init_data){
++			.name = "gcc_snoc_bus_timeout2_ahb_clk",
++			.parent_names = (const char *[]){
++				"usb0_master_clk_src"
++			},
++			.num_parents = 1,
++			.flags = CLK_SET_RATE_PARENT,
++			.ops = &clk_branch2_ops,
++		},
++	},
++};
++
++static struct clk_branch gcc_snoc_bus_timeout3_ahb_clk = {
++	.halt_reg = 0x47014,
++	.halt_bit = 31,
++	.clkr = {
++		.enable_reg = 0x47014,
++		.enable_mask = BIT(0),
++		.hw.init = &(struct clk_init_data){
++			.name = "gcc_snoc_bus_timeout3_ahb_clk",
++			.parent_names = (const char *[]){
++				"usb1_master_clk_src"
++			},
++			.num_parents = 1,
++			.flags = CLK_SET_RATE_PARENT,
++			.ops = &clk_branch2_ops,
++		},
++	},
++};
++
++static struct clk_branch gcc_dcc_clk = {
++	.halt_reg = 0x77004,
++	.halt_bit = 31,
++	.clkr = {
++		.enable_reg = 0x77004,
++		.enable_mask = BIT(0),
++		.hw.init = &(struct clk_init_data){
++			.name = "gcc_dcc_clk",
++			.parent_names = (const char *[]){
++				"pcnoc_clk_src"
++			},
++			.num_parents = 1,
++			.flags = CLK_SET_RATE_PARENT,
++			.ops = &clk_branch2_ops,
++		},
++	},
++};
++
++static struct clk_branch gcc_qdss_at_clk = {
++	.halt_reg = 0x29024,
++	.halt_bit = 31,
++	.clkr = {
++		.enable_reg = 0x29024,
++		.enable_mask = BIT(0),
++		.hw.init = &(struct clk_init_data){
++			.name = "gcc_qdss_at_clk",
++			.parent_names = (const char *[]){
++				"qdss_at_clk_src"
++			},
++			.num_parents = 1,
++			.flags = CLK_SET_RATE_PARENT | CLK_IS_CRITICAL,
++			.ops = &clk_branch2_ops,
++		},
++	},
++};
++
++static struct clk_branch gcc_qdss_dap_clk = {
++	.halt_reg = 0x29084,
++	.halt_bit = 31,
++	.clkr = {
++		.enable_reg = 0x29084,
++		.enable_mask = BIT(0),
++		.hw.init = &(struct clk_init_data){
++			.name = "gcc_qdss_dap_clk",
++			.parent_names = (const char *[]){
++				"qdss_dap_sync_clk_src"
++			},
++			.num_parents = 1,
++			.flags = CLK_SET_RATE_PARENT | CLK_IS_CRITICAL,
++			.ops = &clk_branch2_ops,
++		},
++	},
++};
++
++static struct clk_branch gcc_adss_pwm_clk = {
++	.halt_reg = 0x1c020,
++	.halt_bit = 31,
++	.clkr = {
++		.enable_reg = 0x1c020,
++		.enable_mask = BIT(0),
++		.hw.init = &(struct clk_init_data){
++			.name = "gcc_adss_pwm_clk",
++			.parent_names = (const char *[]){
++				"adss_pwm_clk_src"
++			},
++			.num_parents = 1,
++			.flags = CLK_SET_RATE_PARENT,
++			.ops = &clk_branch2_ops,
++		},
++	},
++};
++
+ static struct clk_hw *gcc_ipq8074_hws[] = {
+ 	&gpll0_out_main_div2.hw,
+ 	&gpll6_out_main_div2.hw,
+@@ -4330,6 +4526,7 @@ static struct clk_hw *gcc_ipq8074_hws[]
+ 	&gcc_xo_div4_clk_src.hw,
+ 	&nss_noc_clk_src.hw,
+ 	&nss_ppe_cdiv_clk_src.hw,
++	&qdss_dap_sync_clk_src.hw,
+ };
+ 
+ static struct clk_regmap *gcc_ipq8074_clks[] = {
+@@ -4561,6 +4758,15 @@ static struct clk_regmap *gcc_ipq8074_cl
+ 	[GCC_PCIE0_RCHNG_CLK] = &gcc_pcie0_rchng_clk.clkr,
+ 	[GCC_PCIE0_AXI_S_BRIDGE_CLK] = &gcc_pcie0_axi_s_bridge_clk.clkr,
+ 	[GCC_CRYPTO_PPE_CLK] = &gcc_crypto_ppe_clk.clkr,
++    [GCC_SNOC_BUS_TIMEOUT2_AHB_CLK] = &gcc_snoc_bus_timeout2_ahb_clk.clkr,
++    [GCC_SNOC_BUS_TIMEOUT3_AHB_CLK] = &gcc_snoc_bus_timeout3_ahb_clk.clkr,
++    [GCC_DCC_CLK] = &gcc_dcc_clk.clkr,
++    [QDSS_TSCTR_CLK_SRC] = &qdss_tsctr_clk_src.clkr,
++    [QDSS_AT_CLK_SRC] = &qdss_at_clk_src.clkr,
++    [GCC_QDSS_AT_CLK] = &gcc_qdss_at_clk.clkr,
++    [GCC_QDSS_DAP_CLK] = &gcc_qdss_dap_clk.clkr,
++    [ADSS_PWM_CLK_SRC] = &adss_pwm_clk_src.clkr,
++    [GCC_ADSS_PWM_CLK] = &gcc_adss_pwm_clk.clkr,
+ };
+ 
+ static const struct qcom_reset_map gcc_ipq8074_resets[] = {
+--- a/include/dt-bindings/clock/qcom,gcc-ipq8074.h
++++ b/include/dt-bindings/clock/qcom,gcc-ipq8074.h
+@@ -230,10 +230,19 @@
+ #define GCC_GP1_CLK				221
+ #define GCC_GP2_CLK				222
+ #define GCC_GP3_CLK				223
+-#define GCC_PCIE0_AXI_S_BRIDGE_CLK		224
+-#define GCC_PCIE0_RCHNG_CLK_SRC			225
+-#define GCC_PCIE0_RCHNG_CLK			226
+-#define GCC_CRYPTO_PPE_CLK			227
++#define GCC_CRYPTO_PPE_CLK             224
++#define GCC_PCIE0_RCHNG_CLK_SRC        225
++#define GCC_PCIE0_RCHNG_CLK            226
++#define GCC_PCIE0_AXI_S_BRIDGE_CLK         227
++#define GCC_SNOC_BUS_TIMEOUT2_AHB_CLK      228
++#define GCC_SNOC_BUS_TIMEOUT3_AHB_CLK      229
++#define GCC_DCC_CLK                230
++#define ADSS_PWM_CLK_SRC           231
++#define GCC_ADSS_PWM_CLK           232
++#define QDSS_TSCTR_CLK_SRC         233
++#define QDSS_AT_CLK_SRC            234
++#define GCC_QDSS_AT_CLK            235
++#define GCC_QDSS_DAP_CLK           236
+ 
+ #define GCC_BLSP1_BCR				0
+ #define GCC_BLSP1_QUP1_BCR			1
diff --git a/target/linux/qualcommax/patches-6.6/0171-1-clk-qcom-ipq8074-Fix-gcc_snoc_bus_timeout_ahb_clk-offset.patch b/target/linux/qualcommax/patches-6.6/0171-1-clk-qcom-ipq8074-Fix-gcc_snoc_bus_timeout_ahb_clk-offset.patch
new file mode 100644
index 00000000000000..b1393fc9ad43c2
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0171-1-clk-qcom-ipq8074-Fix-gcc_snoc_bus_timeout_ahb_clk-offset.patch
@@ -0,0 +1,44 @@
+From 462aa0c53397ec5bf78e3e7f68aa8a3ca300f4ba Mon Sep 17 00:00:00 2001
+From: Selvam Sathappan Periakaruppan <speriaka@codeaurora.org>
+Date: Tue, 24 Mar 2020 19:09:38 +0530
+Subject: [PATCH 5/8] clk: qcom: ipq8074: Fix gcc_snoc_bus_timeout_ahb_clk
+ offset
+
+By default, the ipq8074 V2 clks are provided in the gcc driver.
+Updating the gcc_snoc_bus_timeout_ahb_clk offsets also as needed
+in ipq8074 V2.
+
+Change-Id: I5a6e98d002f5c3354a804e55dd9ebb1f83f7f974
+Signed-off-by: Selvam Sathappan Periakaruppan <speriaka@codeaurora.org>
+---
+ drivers/clk/qcom/gcc-ipq8074.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/clk/qcom/gcc-ipq8074.c
++++ b/drivers/clk/qcom/gcc-ipq8074.c
+@@ -4411,10 +4411,10 @@ static const struct alpha_pll_config nss
+ };
+ 
+ static struct clk_branch gcc_snoc_bus_timeout2_ahb_clk = {
+-	.halt_reg = 0x4700c,
++	.halt_reg = 0x47014,
+ 	.halt_bit = 31,
+ 	.clkr = {
+-		.enable_reg = 0x4700c,
++		.enable_reg = 0x47014,
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_snoc_bus_timeout2_ahb_clk",
+@@ -4429,10 +4429,10 @@ static struct clk_branch gcc_snoc_bus_ti
+ };
+ 
+ static struct clk_branch gcc_snoc_bus_timeout3_ahb_clk = {
+-	.halt_reg = 0x47014,
++	.halt_reg = 0x4701C,
+ 	.halt_bit = 31,
+ 	.clkr = {
+-		.enable_reg = 0x47014,
++		.enable_reg = 0x4701C,
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_snoc_bus_timeout3_ahb_clk",
diff --git a/target/linux/qualcommax/patches-6.6/0171-2-clk-qcom-ipq8074-Fix-gcc_blsp1_ahb_clk-properties.patch b/target/linux/qualcommax/patches-6.6/0171-2-clk-qcom-ipq8074-Fix-gcc_blsp1_ahb_clk-properties.patch
new file mode 100644
index 00000000000000..a7abddd5fddf18
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0171-2-clk-qcom-ipq8074-Fix-gcc_blsp1_ahb_clk-properties.patch
@@ -0,0 +1,41 @@
+From 52315bec6ed633b6a71f28b746029602f8bd70b9 Mon Sep 17 00:00:00 2001
+From: Balaji Prakash J <bjagadee@codeaurora.org>
+Date: Wed, 22 Apr 2020 20:35:30 +0530
+Subject: [PATCH] clk: ipq8074: fix gcc_blsp1_ahb_clk properties
+
+All the voting enabled clocks does not support the enable
+from CBCR register. So, updated gcc_blsp1_ahb_clk enable
+register and mask to enable bit in APCS_CLOCK_BRANCH_ENA_VOTE.
+
+Also, the voting controlled clocks are shared among multiple
+components like APSS, RPM, NSS, TZ, etc. So, turning the
+voting off from APSS does not make the clock off if it has
+been voted from another component. Added the flag
+BRANCH_HALT_VOTED in order to skip checking the clock
+disable status.
+
+This change is referred from the below commits,
+1. 246b4fb3af9bd65d8af794aac2f0e7b1ed9cc2dd
+2. c8374157d5ae91d3b3e0d513d62808a798b32d3a
+
+Signed-off-by: Balaji Prakash J <bjagadee@codeaurora.org>
+Change-Id: I505cb560b31ad27a02c165fbe13bb33a2fc7d230
+---
+ drivers/clk/qcom/gcc-ipq8074.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/qcom/gcc-ipq8074.c
++++ b/drivers/clk/qcom/gcc-ipq8074.c
+@@ -2125,9 +2125,10 @@ struct clk_rcg2 adss_pwm_clk_src = {
+ 
+ static struct clk_branch gcc_blsp1_ahb_clk = {
+ 	.halt_reg = 0x01008,
++	.halt_check = BRANCH_HALT_VOTED,
+ 	.clkr = {
+-		.enable_reg = 0x01008,
+-		.enable_mask = BIT(0),
++		.enable_reg = 0x0b004,
++		.enable_mask = BIT(10),
+ 		.hw.init = &(struct clk_init_data){
+ 			.name = "gcc_blsp1_ahb_clk",
+ 			.parent_hws = (const struct clk_hw *[]){
diff --git a/target/linux/qualcommax/patches-6.6/0600-2-qca-nss-ecm-support-PPPOE-offload.patch b/target/linux/qualcommax/patches-6.6/0600-2-qca-nss-ecm-support-PPPOE-offload.patch
new file mode 100644
index 00000000000000..e59290878db29e
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0600-2-qca-nss-ecm-support-PPPOE-offload.patch
@@ -0,0 +1,600 @@
+--- a/drivers/net/ppp/ppp_generic.c
++++ b/drivers/net/ppp/ppp_generic.c
+@@ -48,6 +48,7 @@
+ #include <net/slhc_vj.h>
+ #include <linux/atomic.h>
+ #include <linux/refcount.h>
++#include <linux/if_pppox.h>
+ 
+ #include <linux/nsproxy.h>
+ #include <net/net_namespace.h>
+@@ -254,6 +255,25 @@ struct ppp_net {
+ #define seq_before(a, b)	((s32)((a) - (b)) < 0)
+ #define seq_after(a, b)		((s32)((a) - (b)) > 0)
+ 
++
++/*
++ * Registration/Unregistration methods
++ * for PPP channel connect and disconnect event notifications.
++ */
++RAW_NOTIFIER_HEAD(ppp_channel_connection_notifier_list);
++
++void ppp_channel_connection_register_notify(struct notifier_block *nb)
++{
++	raw_notifier_chain_register(&ppp_channel_connection_notifier_list, nb);
++}
++EXPORT_SYMBOL_GPL(ppp_channel_connection_register_notify);
++
++void ppp_channel_connection_unregister_notify(struct notifier_block *nb)
++{
++	raw_notifier_chain_unregister(&ppp_channel_connection_notifier_list, nb);
++}
++EXPORT_SYMBOL_GPL(ppp_channel_connection_unregister_notify);
++
+ /* Prototypes. */
+ static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf,
+ 			struct file *file, unsigned int cmd, unsigned long arg);
+@@ -3453,7 +3473,10 @@ ppp_connect_channel(struct channel *pch,
+ 	struct ppp_net *pn;
+ 	int ret = -ENXIO;
+ 	int hdrlen;
++	int ppp_proto;
++	int version;
+ 
++	int notify = 0;
+ 	pn = ppp_pernet(pch->chan_net);
+ 
+ 	mutex_lock(&pn->all_ppp_mutex);
+@@ -3485,13 +3508,40 @@ ppp_connect_channel(struct channel *pch,
+ 	++ppp->n_channels;
+ 	pch->ppp = ppp;
+ 	refcount_inc(&ppp->file.refcnt);
++
++	/* Set the netdev priv flag if the prototype
++	 * is L2TP or PPTP. Return success in all cases
++	 */
++	if (!pch->chan)
++		goto out2;
++
++	ppp_proto = ppp_channel_get_protocol(pch->chan);
++	if (ppp_proto == PX_PROTO_PPTP) {
++		ppp->dev->priv_flags_ext |= IFF_EXT_PPP_PPTP;
++	} else if (ppp_proto == PX_PROTO_OL2TP) {
++		version = ppp_channel_get_proto_version(pch->chan);
++		if (version == 2)
++			ppp->dev->priv_flags_ext |= IFF_EXT_PPP_L2TPV2;
++		else if (version == 3)
++			ppp->dev->priv_flags_ext |= IFF_EXT_PPP_L2TPV3;
++	}
++	notify = 1;
++
++ out2:
+ 	ppp_unlock(ppp);
+ 	ret = 0;
+-
+  outl:
+ 	write_unlock_bh(&pch->upl);
+  out:
+ 	mutex_unlock(&pn->all_ppp_mutex);
++
++	if (notify && ppp && ppp->dev) {
++		dev_hold(ppp->dev);
++		raw_notifier_call_chain(&ppp_channel_connection_notifier_list,
++					   PPP_CHANNEL_CONNECT, ppp->dev);
++		dev_put(ppp->dev);
++	}
++
+ 	return ret;
+ }
+ 
+@@ -3509,6 +3559,13 @@ ppp_disconnect_channel(struct channel *p
+ 	pch->ppp = NULL;
+ 	write_unlock_bh(&pch->upl);
+ 	if (ppp) {
++		if (ppp->dev) {
++			dev_hold(ppp->dev);
++			raw_notifier_call_chain(&ppp_channel_connection_notifier_list,
++					   PPP_CHANNEL_DISCONNECT, ppp->dev);
++			dev_put(ppp->dev);
++		}
++
+ 		/* remove it from the ppp unit's list */
+ 		ppp_lock(ppp);
+ 		list_del(&pch->clist);
+@@ -3588,6 +3645,222 @@ static void *unit_find(struct idr *p, in
+ 	return idr_find(p, n);
+ }
+ 
++/* Updates the PPP interface statistics. */
++void ppp_update_stats(struct net_device *dev, unsigned long rx_packets,
++		      unsigned long rx_bytes, unsigned long tx_packets,
++		      unsigned long tx_bytes, unsigned long rx_errors,
++		      unsigned long tx_errors, unsigned long rx_dropped,
++		      unsigned long tx_dropped)
++{
++	struct ppp *ppp;
++
++	if (!dev)
++		return;
++
++	if (dev->type != ARPHRD_PPP)
++		return;
++
++	ppp = netdev_priv(dev);
++
++	ppp_xmit_lock(ppp);
++	ppp->stats64.tx_packets += tx_packets;
++	ppp->stats64.tx_bytes += tx_bytes;
++	ppp->dev->stats.tx_errors += tx_errors;
++	ppp->dev->stats.tx_dropped += tx_dropped;
++	if (tx_packets)
++		ppp->last_xmit = jiffies;
++	ppp_xmit_unlock(ppp);
++
++	ppp_recv_lock(ppp);
++	ppp->stats64.rx_packets += rx_packets;
++	ppp->stats64.rx_bytes += rx_bytes;
++	ppp->dev->stats.rx_errors += rx_errors;
++	ppp->dev->stats.rx_dropped += rx_dropped;
++	if (rx_packets)
++		ppp->last_recv = jiffies;
++	ppp_recv_unlock(ppp);
++}
++
++/* Returns >0 if the device is a multilink PPP netdevice, 0 if not or < 0 if
++ * the device is not PPP.
++ */
++int ppp_is_multilink(struct net_device *dev)
++{
++	struct ppp *ppp;
++	unsigned int flags;
++
++	if (!dev)
++		return -1;
++
++	if (dev->type != ARPHRD_PPP)
++		return -1;
++
++	ppp = netdev_priv(dev);
++	ppp_lock(ppp);
++	flags = ppp->flags;
++	ppp_unlock(ppp);
++
++	if (flags & SC_MULTILINK)
++		return 1;
++
++	return 0;
++}
++EXPORT_SYMBOL(ppp_is_multilink);
++
++/* ppp_channel_get_protocol()
++ *	Call this to obtain the underlying protocol of the PPP channel,
++ *	e.g. PX_PROTO_OE
++ *
++ * NOTE: Some channels do not use PX sockets so the protocol value may be very
++ * different for them.
++ * NOTE: -1 indicates failure.
++ * NOTE: Once you know the channel protocol you may then either cast 'chan' to
++ * its sub-class or use the channel protocol specific API's as provided by that
++ * channel sub type.
++ */
++int ppp_channel_get_protocol(struct ppp_channel *chan)
++{
++	if (!chan->ops->get_channel_protocol)
++		return -1;
++
++	return chan->ops->get_channel_protocol(chan);
++}
++EXPORT_SYMBOL(ppp_channel_get_protocol);
++
++/* ppp_channel_get_proto_version()
++ *	Call this to get channel protocol version
++ */
++int ppp_channel_get_proto_version(struct ppp_channel *chan)
++{
++	if (!chan->ops->get_channel_protocol_ver)
++		return -1;
++
++	return chan->ops->get_channel_protocol_ver(chan);
++}
++EXPORT_SYMBOL(ppp_channel_get_proto_version);
++
++/* ppp_channel_hold()
++ *	Call this to hold a channel.
++ *
++ * Returns true on success or false if the hold could not happen.
++ *
++ * NOTE: chan must be protected against destruction during this call -
++ * either by correct locking etc. or because you already have an implicit
++ * or explicit hold to the channel already and this is an additional hold.
++ */
++bool ppp_channel_hold(struct ppp_channel *chan)
++{
++	if (!chan->ops->hold)
++		return false;
++
++	chan->ops->hold(chan);
++	return true;
++}
++EXPORT_SYMBOL(ppp_channel_hold);
++
++/* ppp_channel_release()
++ *	Call this to release a hold you have upon a channel
++ */
++void ppp_channel_release(struct ppp_channel *chan)
++{
++	chan->ops->release(chan);
++}
++EXPORT_SYMBOL(ppp_channel_release);
++
++/* Check if ppp xmit lock is on hold */
++bool ppp_is_xmit_locked(struct net_device *dev)
++{
++	struct ppp *ppp;
++
++	if (!dev)
++		return false;
++
++	if (dev->type != ARPHRD_PPP)
++		return false;
++
++	ppp = netdev_priv(dev);
++	if (!ppp)
++		return false;
++
++	if (spin_is_locked(&(ppp)->wlock))
++		return true;
++
++	return false;
++}
++EXPORT_SYMBOL(ppp_is_xmit_locked);
++
++/* ppp_hold_channels()
++ *	Returns the PPP channels of the PPP device, storing each one into
++ *	channels[].
++ *
++ * channels[] has chan_sz elements.
++ * This function returns the number of channels stored, up to chan_sz.
++ * It will return < 0 if the device is not PPP.
++ *
++ * You MUST release the channels using ppp_release_channels().
++ */
++int ppp_hold_channels(struct net_device *dev, struct ppp_channel *channels[],
++		      unsigned int chan_sz)
++{
++	struct ppp *ppp;
++	int c;
++	struct channel *pch;
++
++	if (!dev)
++		return -1;
++
++	if (dev->type != ARPHRD_PPP)
++		return -1;
++
++	ppp = netdev_priv(dev);
++
++	c = 0;
++	ppp_lock(ppp);
++	list_for_each_entry(pch, &ppp->channels, clist) {
++		struct ppp_channel *chan;
++
++		if (!pch->chan) {
++			/* Channel is going / gone away */
++			continue;
++		}
++
++		if (c == chan_sz) {
++			/* No space to record channel */
++			ppp_unlock(ppp);
++			return c;
++		}
++
++		/* Hold the channel, if supported */
++		chan = pch->chan;
++		if (!chan->ops->hold)
++			continue;
++
++		chan->ops->hold(chan);
++
++		 /* Record the channel */
++		channels[c++] = chan;
++	}
++	ppp_unlock(ppp);
++	return c;
++}
++EXPORT_SYMBOL(ppp_hold_channels);
++
++/* ppp_release_channels()
++ *	Releases channels
++ */
++void ppp_release_channels(struct ppp_channel *channels[], unsigned int chan_sz)
++{
++	unsigned int c;
++
++	for (c = 0; c < chan_sz; ++c) {
++		struct ppp_channel *chan;
++
++		chan = channels[c];
++		chan->ops->release(chan);
++	}
++}
++EXPORT_SYMBOL(ppp_release_channels);
++
+ /* Module/initialization stuff */
+ 
+ module_init(ppp_init);
+@@ -3604,6 +3877,7 @@ EXPORT_SYMBOL(ppp_input_error);
+ EXPORT_SYMBOL(ppp_output_wakeup);
+ EXPORT_SYMBOL(ppp_register_compressor);
+ EXPORT_SYMBOL(ppp_unregister_compressor);
++EXPORT_SYMBOL(ppp_update_stats);
+ MODULE_LICENSE("GPL");
+ MODULE_ALIAS_CHARDEV(PPP_MAJOR, 0);
+ MODULE_ALIAS_RTNL_LINK("ppp");
+--- a/drivers/net/ppp/pppoe.c
++++ b/drivers/net/ppp/pppoe.c
+@@ -62,6 +62,7 @@
+ #include <linux/inetdevice.h>
+ #include <linux/etherdevice.h>
+ #include <linux/skbuff.h>
++#include <linux/if_arp.h>
+ #include <linux/init.h>
+ #include <linux/if_ether.h>
+ #include <linux/if_pppox.h>
+@@ -87,7 +88,7 @@
+ static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb);
+ 
+ static const struct proto_ops pppoe_ops;
+-static const struct ppp_channel_ops pppoe_chan_ops;
++static const struct pppoe_channel_ops pppoe_chan_ops;
+ 
+ /* per-net private data for this module */
+ static unsigned int pppoe_net_id __read_mostly;
+@@ -692,7 +693,7 @@ static int pppoe_connect(struct socket *
+ 
+ 		po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr) - 2;
+ 		po->chan.private = sk;
+-		po->chan.ops = &pppoe_chan_ops;
++		po->chan.ops = (struct ppp_channel_ops *)&pppoe_chan_ops;
+ 
+ 		error = ppp_register_net_channel(dev_net(dev), &po->chan);
+ 		if (error) {
+@@ -995,9 +996,80 @@ static int pppoe_fill_forward_path(struc
+ 	return 0;
+ }
+ 
+-static const struct ppp_channel_ops pppoe_chan_ops = {
+-	.start_xmit = pppoe_xmit,
+-	.fill_forward_path = pppoe_fill_forward_path,
++/************************************************************************
++ *
++ * function called by generic PPP driver to hold channel
++ *
++ ***********************************************************************/
++static void pppoe_hold_chan(struct ppp_channel *chan)
++{
++	struct sock *sk = (struct sock *)chan->private;
++
++	sock_hold(sk);
++}
++
++/************************************************************************
++ *
++ * function called by generic PPP driver to release channel
++ *
++ ***********************************************************************/
++static void pppoe_release_chan(struct ppp_channel *chan)
++{
++	struct sock *sk = (struct sock *)chan->private;
++
++	sock_put(sk);
++}
++
++/************************************************************************
++ *
++ * function called to get the channel protocol type
++ *
++ ***********************************************************************/
++static int pppoe_get_channel_protocol(struct ppp_channel *chan)
++{
++	return PX_PROTO_OE;
++}
++
++/************************************************************************
++ *
++ * function called to get the PPPoE channel addressing
++ * NOTE: This function returns a HOLD to the netdevice
++ *
++ ***********************************************************************/
++static int pppoe_get_addressing(struct ppp_channel *chan,
++				 struct pppoe_opt *addressing)
++{
++	struct sock *sk = (struct sock *)chan->private;
++	struct pppox_sock *po = pppox_sk(sk);
++	int err = 0;
++
++	*addressing = po->proto.pppoe;
++	if (!addressing->dev)
++		return -ENODEV;
++
++	dev_hold(addressing->dev);
++	return err;
++}
++
++/* pppoe_channel_addressing_get()
++ *	Return PPPoE channel specific addressing information.
++ */
++int pppoe_channel_addressing_get(struct ppp_channel *chan,
++				  struct pppoe_opt *addressing)
++{
++	return pppoe_get_addressing(chan, addressing);
++}
++EXPORT_SYMBOL(pppoe_channel_addressing_get);
++
++static const struct pppoe_channel_ops pppoe_chan_ops = {
++	/* PPPoE specific channel ops */
++	.get_addressing = pppoe_get_addressing,
++	/* General ppp channel ops */
++	.ops.start_xmit = pppoe_xmit,
++	.ops.get_channel_protocol = pppoe_get_channel_protocol,
++	.ops.hold = pppoe_hold_chan,
++	.ops.release = pppoe_release_chan,
++	.ops.fill_forward_path = pppoe_fill_forward_path,
+ };
+ 
+ static int pppoe_recvmsg(struct socket *sock, struct msghdr *m,
+--- a/include/linux/if_pppox.h
++++ b/include/linux/if_pppox.h
+@@ -91,4 +91,17 @@ enum {
+     PPPOX_DEAD		= 16  /* dead, useless, please clean me up!*/
+ };
+ 
++/*
++ * PPPoE Channel specific operations
++ */
++struct pppoe_channel_ops {
++	/* Must be first - general to all PPP channels */
++	struct ppp_channel_ops ops;
++	int (*get_addressing)(struct ppp_channel *, struct pppoe_opt *);
++};
++
++/* Return PPPoE channel specific addressing information */
++extern int pppoe_channel_addressing_get(struct ppp_channel *chan,
++					 struct pppoe_opt *addressing);
++
+ #endif /* !(__LINUX_IF_PPPOX_H) */
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -1762,6 +1762,36 @@ enum netdev_priv_flags {
+ 	IFF_NO_IP_ALIGN			= BIT_ULL(34),
+ };
+ 
++/**
++ * enum netdev_priv_flags_ext - &struct net_device priv_flags_ext
++ *
++ * These flags are used to check for device type and can be
++ * set and used by the drivers
++ *
++ * @IFF_EXT_TUN_TAP: device is a TUN/TAP device
++ * @IFF_EXT_PPP_L2TPV2: device is a L2TPV2 device
++ * @IFF_EXT_PPP_L2TPV3: device is a L2TPV3 device
++ * @IFF_EXT_PPP_PPTP: device is a PPTP device
++ * @IFF_EXT_GRE_V4_TAP: device is a GRE IPv4 TAP device
++ * @IFF_EXT_GRE_V6_TAP: device is a GRE IPv6 TAP device
++ * @IFF_EXT_IFB: device is an IFB device
++ * @IFF_EXT_MAPT: device is an MAPT device
++ * @IFF_EXT_HW_NO_OFFLOAD: device is an NON Offload device
++ * @IFF_EXT_L2TPV3: device is a L2TPV3 Ethernet device
++ */
++enum netdev_priv_flags_ext {
++	IFF_EXT_TUN_TAP			= 1<<0,
++	IFF_EXT_PPP_L2TPV2		= 1<<1,
++	IFF_EXT_PPP_L2TPV3		= 1<<2,
++	IFF_EXT_PPP_PPTP		= 1<<3,
++	IFF_EXT_GRE_V4_TAP		= 1<<4,
++	IFF_EXT_GRE_V6_TAP		= 1<<5,
++	IFF_EXT_IFB			= 1<<6,
++	IFF_EXT_MAPT			= 1<<7,
++	IFF_EXT_HW_NO_OFFLOAD		= 1<<8,
++	IFF_EXT_ETH_L2TPV3		= 1<<9,
++};
++
+ #define IFF_802_1Q_VLAN			IFF_802_1Q_VLAN
+ #define IFF_EBRIDGE			IFF_EBRIDGE
+ #define IFF_BONDING			IFF_BONDING
+@@ -2127,6 +2157,7 @@ struct net_device {
+ 	unsigned int		flags;
+ 	xdp_features_t		xdp_features;
+ 	unsigned long long	priv_flags;
++	unsigned int		priv_flags_ext;
+ 	const struct net_device_ops *netdev_ops;
+ 	const struct xdp_metadata_ops *xdp_metadata_ops;
+ 	int			ifindex;
+--- a/include/linux/ppp_channel.h
++++ b/include/linux/ppp_channel.h
+@@ -19,6 +19,10 @@
+ #include <linux/skbuff.h>
+ #include <linux/poll.h>
+ #include <net/net_namespace.h>
++#include <linux/notifier.h>
++
++#define PPP_CHANNEL_DISCONNECT	0
++#define PPP_CHANNEL_CONNECT	1
+ 
+ struct net_device_path;
+ struct net_device_path_ctx;
+@@ -30,9 +34,19 @@ struct ppp_channel_ops {
+ 	int	(*start_xmit)(struct ppp_channel *, struct sk_buff *);
+ 	/* Handle an ioctl call that has come in via /dev/ppp. */
+ 	int	(*ioctl)(struct ppp_channel *, unsigned int, unsigned long);
++	/* Get channel protocol type, one of PX_PROTO_XYZ or specific to
++	 * the channel subtype
++	 */
++	int (*get_channel_protocol)(struct ppp_channel *);
++	/* Get channel protocol version */
++	int (*get_channel_protocol_ver)(struct ppp_channel *);
++	/* Hold the channel from being destroyed */
++	void (*hold)(struct ppp_channel *);
++	/* Release hold on the channel */
++	void (*release)(struct ppp_channel *);
+ 	int	(*fill_forward_path)(struct net_device_path_ctx *,
+-				     struct net_device_path *,
+-				     const struct ppp_channel *);
++				struct net_device_path *,
++				const struct ppp_channel *);
+ };
+ 
+ struct ppp_channel {
+@@ -76,6 +90,51 @@ extern int ppp_unit_number(struct ppp_ch
+ /* Get the device name associated with a channel, or NULL if none */
+ extern char *ppp_dev_name(struct ppp_channel *);
+ 
++/* Call this to obtain the underlying protocol of the PPP channel,
++ * e.g. PX_PROTO_OE
++ */
++extern int ppp_channel_get_protocol(struct ppp_channel *);
++
++/* Call this get protocol version */
++extern int ppp_channel_get_proto_version(struct ppp_channel *);
++
++/* Call this to hold a channel */
++extern bool ppp_channel_hold(struct ppp_channel *);
++
++/* Call this to release a hold you have upon a channel */
++extern void ppp_channel_release(struct ppp_channel *);
++
++/* Release hold on PPP channels */
++extern void ppp_release_channels(struct ppp_channel *channels[],
++				 unsigned int chan_sz);
++
++/* Hold PPP channels for the PPP device */
++extern int ppp_hold_channels(struct net_device *dev,
++				struct ppp_channel *channels[],
++				unsigned int chan_sz);
++
++/* Test if ppp xmit lock is locked */
++extern bool ppp_is_xmit_locked(struct net_device *dev);
++
++/* Test if the ppp device is a multi-link ppp device */
++extern int ppp_is_multilink(struct net_device *dev);
++
++/* Register the PPP channel connect notifier */
++extern void ppp_channel_connection_register_notify(struct notifier_block *nb);
++
++/* Unregister the PPP channel connect notifier */
++extern void ppp_channel_connection_unregister_notify(struct notifier_block *nb);
++
++/* Update statistics of the PPP net_device by incrementing related
++ * statistics field value with corresponding parameter
++ */
++extern void ppp_update_stats(struct net_device *dev, unsigned long rx_packets,
++			     unsigned long rx_bytes, unsigned long tx_packets,
++			     unsigned long tx_bytes, unsigned long rx_errors,
++			     unsigned long tx_errors, unsigned long rx_dropped,
++			     unsigned long tx_dropped);
++
++
+ /*
+  * SMP locking notes:
+  * The channel code must ensure that when it calls ppp_unregister_channel,
diff --git a/target/linux/qualcommax/patches-6.6/0600-3-qca-nss-ecm-support-net-bonding.patch b/target/linux/qualcommax/patches-6.6/0600-3-qca-nss-ecm-support-net-bonding.patch
new file mode 100644
index 00000000000000..4e683e3a3e7e8e
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0600-3-qca-nss-ecm-support-net-bonding.patch
@@ -0,0 +1,46 @@
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -210,6 +210,7 @@ atomic_t netpoll_block_tx = ATOMIC_INIT(
+ #endif
+ 
+ unsigned int bond_net_id __read_mostly;
++static unsigned long bond_id_mask = 0xFFFFFFF0; /* QCA NSS ECM bonding support */
+ 
+ static const struct flow_dissector_key flow_keys_bonding_keys[] = {
+ 	{
+@@ -5872,6 +5873,11 @@ static void bond_destructor(struct net_d
+ 	if (bond->wq)
+ 		destroy_workqueue(bond->wq);
+ 
++	/* QCA NSS ECM bonding support - Start */
++	if (bond->id != (~0U))
++		clear_bit(bond->id, &bond_id_mask);
++	/* QCA NSS ECM bonding support - End */
++
+ 	free_percpu(bond->rr_tx_counter);
+ }
+ 
+@@ -6421,6 +6427,13 @@ int bond_create(struct net *net, const c
+ 
+ 	bond_work_init_all(bond);
+ 
++	/* QCA NSS ECM bonding support - Start */
++	bond->id = ~0U;
++	if (bond_id_mask != (~0UL)) {
++		bond->id = (u32)ffz(bond_id_mask);
++		set_bit(bond->id, &bond_id_mask);
++	}
++	/* QCA NSS ECM bonding support - End */
+ out:
+ 	rtnl_unlock();
+ 	return res;
+--- a/include/net/bonding.h
++++ b/include/net/bonding.h
+@@ -261,6 +261,7 @@ struct bonding {
+ 	spinlock_t ipsec_lock;
+ #endif /* CONFIG_XFRM_OFFLOAD */
+ 	struct bpf_prog *xdp_prog;
++	u32 id;/* QCA NSS ECM bonding support */
+ };
+ 
+ #define bond_slave_get_rcu(dev) \
diff --git a/target/linux/qualcommax/patches-6.6/0600-4-qca-nss-ecm-support-net-bonding-over-LAG-interface.patch b/target/linux/qualcommax/patches-6.6/0600-4-qca-nss-ecm-support-net-bonding-over-LAG-interface.patch
new file mode 100644
index 00000000000000..e02e9090db8c4e
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0600-4-qca-nss-ecm-support-net-bonding-over-LAG-interface.patch
@@ -0,0 +1,685 @@
+--- a/drivers/net/bonding/bond_3ad.c
++++ b/drivers/net/bonding/bond_3ad.c
+@@ -116,6 +116,40 @@ static void ad_marker_response_received(
+ 					struct port *port);
+ static void ad_update_actor_keys(struct port *port, bool reset);
+ 
++/* QCA NSS ECM bonding support - Start */
++struct bond_cb __rcu *bond_cb;
++
++int bond_register_cb(struct bond_cb *cb)
++{
++	struct bond_cb *lag_cb;
++
++	lag_cb = kzalloc(sizeof(*lag_cb), GFP_ATOMIC | __GFP_NOWARN);
++	if (!lag_cb) {
++		return -1;
++	}
++
++	memcpy((void *)lag_cb, (void *)cb, sizeof(*cb));
++
++	rcu_read_lock();
++	rcu_assign_pointer(bond_cb, lag_cb);
++	rcu_read_unlock();
++	return 0;
++}
++EXPORT_SYMBOL(bond_register_cb);
++
++void bond_unregister_cb(void)
++{
++	struct bond_cb *lag_cb_main;
++
++	rcu_read_lock();
++	lag_cb_main = rcu_dereference(bond_cb);
++	rcu_assign_pointer(bond_cb, NULL);
++	rcu_read_unlock();
++
++	kfree(lag_cb_main);
++}
++EXPORT_SYMBOL(bond_unregister_cb);
++/* QCA NSS ECM bonding support - End */
+ 
+ /* ================= api to bonding and kernel code ================== */
+ 
+@@ -1073,7 +1107,31 @@ static void ad_mux_machine(struct port *
+ 			ad_disable_collecting_distributing(port,
+ 							   update_slave_arr);
+ 			port->ntt = true;
++
++		/* QCA NSS ECM bonding support - Start */
++			/* Send a notificaton about change in state of this
++			* port. We only want to handle case where port moves
++			* from AD_MUX_COLLECTING_DISTRIBUTING ->
++			* AD_MUX_ATTACHED.
++			*/
++			if (bond_slave_is_up(port->slave) &&
++			    (last_state == AD_MUX_COLLECTING_DISTRIBUTING)) {
++				struct bond_cb *lag_cb_main;
++
++				rcu_read_lock();
++				lag_cb_main = rcu_dereference(bond_cb);
++				if (lag_cb_main &&
++				    lag_cb_main->bond_cb_link_down) {
++					struct net_device *dev;
++
++					dev = port->slave->dev;
++					lag_cb_main->bond_cb_link_down(dev);
++				}
++				rcu_read_unlock();
++			}
++
+ 			break;
++		/* QCA NSS ECM bonding support - End */
+ 		case AD_MUX_COLLECTING_DISTRIBUTING:
+ 			port->actor_oper_port_state |= LACP_STATE_COLLECTING;
+ 			port->actor_oper_port_state |= LACP_STATE_DISTRIBUTING;
+@@ -1917,6 +1975,7 @@ static void ad_enable_collecting_distrib
+ 					      bool *update_slave_arr)
+ {
+ 	if (port->aggregator->is_active) {
++		struct bond_cb *lag_cb_main; /* QCA NSS ECM bonding support */
+ 		slave_dbg(port->slave->bond->dev, port->slave->dev,
+ 			  "Enabling port %d (LAG %d)\n",
+ 			  port->actor_port_number,
+@@ -1924,6 +1983,16 @@ static void ad_enable_collecting_distrib
+ 		__enable_port(port);
+ 		/* Slave array needs update */
+ 		*update_slave_arr = true;
++
++		/* QCA NSS ECM bonding support - Start */
++		rcu_read_lock();
++		lag_cb_main = rcu_dereference(bond_cb);
++
++		if (lag_cb_main && lag_cb_main->bond_cb_link_up)
++			lag_cb_main->bond_cb_link_up(port->slave->dev);
++
++		rcu_read_unlock();
++		/* QCA NSS ECM bonding support - End */
+ 	}
+ }
+ 
+@@ -2683,6 +2752,104 @@ int bond_3ad_get_active_agg_info(struct
+ 	return ret;
+ }
+ 
++/* QCA NSS ECM bonding support - Start */
++/* bond_3ad_get_tx_dev - Calculate egress interface for a given packet,
++ * for a LAG that is configured in 802.3AD mode
++ * @skb: pointer to skb to be egressed
++ * @src_mac: pointer to source L2 address
++ * @dst_mac: pointer to destination L2 address
++ * @src: pointer to source L3 address
++ * @dst: pointer to destination L3 address
++ * @protocol: L3 protocol id from L2 header
++ * @bond_dev: pointer to bond master device
++ *
++ * If @skb is NULL, bond_xmit_hash is used to calculate hash using L2/L3
++ * addresses.
++ *
++ * Returns: Either valid slave device, or NULL otherwise
++ */
++struct net_device *bond_3ad_get_tx_dev(struct sk_buff *skb, u8 *src_mac,
++				       u8 *dst_mac, void *src,
++				       void *dst, u16 protocol,
++				       struct net_device *bond_dev,
++				       __be16 *layer4hdr)
++{
++	struct bonding *bond = netdev_priv(bond_dev);
++	struct aggregator *agg;
++	struct ad_info ad_info;
++	struct list_head *iter;
++	struct slave *slave;
++	struct slave *first_ok_slave = NULL;
++	u32 hash = 0;
++	int slaves_in_agg;
++	int slave_agg_no = 0;
++	int agg_id;
++
++	if (__bond_3ad_get_active_agg_info(bond, &ad_info)) {
++		pr_debug("%s: Error: __bond_3ad_get_active_agg_info failed\n",
++			 bond_dev->name);
++		return NULL;
++	}
++
++	slaves_in_agg = ad_info.ports;
++	agg_id = ad_info.aggregator_id;
++
++	if (slaves_in_agg == 0) {
++		pr_debug("%s: Error: active aggregator is empty\n",
++			 bond_dev->name);
++		return NULL;
++	}
++
++	if (skb) {
++		hash = bond_xmit_hash(bond, skb);
++		slave_agg_no = hash % slaves_in_agg;
++	} else {
++		if (bond->params.xmit_policy != BOND_XMIT_POLICY_LAYER23 &&
++		    bond->params.xmit_policy != BOND_XMIT_POLICY_LAYER2 &&
++		    bond->params.xmit_policy != BOND_XMIT_POLICY_LAYER34) {
++			pr_debug("%s: Error: Unsupported hash policy for 802.3AD fast path\n",
++				 bond_dev->name);
++			return NULL;
++		}
++
++		hash = bond_xmit_hash_without_skb(src_mac, dst_mac,
++						  src, dst, protocol,
++						  bond_dev, layer4hdr);
++		slave_agg_no = hash % slaves_in_agg;
++	}
++
++	bond_for_each_slave_rcu(bond, slave, iter) {
++		agg = SLAVE_AD_INFO(slave)->port.aggregator;
++		if (!agg || agg->aggregator_identifier != agg_id)
++			continue;
++
++		if (slave_agg_no >= 0) {
++			if (!first_ok_slave && bond_slave_can_tx(slave))
++				first_ok_slave = slave;
++			slave_agg_no--;
++			continue;
++		}
++
++		if (bond_slave_can_tx(slave))
++			return slave->dev;
++	}
++
++	if (slave_agg_no >= 0) {
++		pr_err("%s: Error: Couldn't find a slave to tx on for aggregator ID %d\n",
++		       bond_dev->name, agg_id);
++		return NULL;
++	}
++
++	/* we couldn't find any suitable slave after the agg_no, so use the
++	 * first suitable found, if found.
++	 */
++	if (first_ok_slave)
++		return first_ok_slave->dev;
++
++	return NULL;
++}
++/* QCA NSS ECM bonding support - End */
++
+ int bond_3ad_lacpdu_recv(const struct sk_buff *skb, struct bonding *bond,
+ 			 struct slave *slave)
+ {
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -288,6 +288,21 @@ const char *bond_mode_name(int mode)
+ 	return names[mode];
+ }
+ 
++/* QCA NSS ECM bonding support */
++int bond_get_id(struct net_device *bond_dev)
++{
++	struct bonding *bond;
++
++	if (!((bond_dev->priv_flags & IFF_BONDING) &&
++	      (bond_dev->flags & IFF_MASTER)))
++		return -EINVAL;
++
++	bond = netdev_priv(bond_dev);
++	return bond->id;
++}
++EXPORT_SYMBOL(bond_get_id);
++/* QCA NSS ECM bonding support */
++
+ /**
+  * bond_dev_queue_xmit - Prepare skb for xmit.
+  *
+@@ -1189,6 +1204,23 @@ void bond_change_active_slave(struct bon
+ 			if (BOND_MODE(bond) == BOND_MODE_8023AD)
+ 				bond_3ad_handle_link_change(new_active, BOND_LINK_UP);
+ 
++           /* QCA NSS ECM bonding support - Start */
++			if (bond->params.mode == BOND_MODE_XOR) {
++				struct bond_cb *lag_cb_main;
++
++				rcu_read_lock();
++				lag_cb_main = rcu_dereference(bond_cb);
++				if (lag_cb_main &&
++				    lag_cb_main->bond_cb_link_up) {
++					struct net_device *dev;
++
++					dev = new_active->dev;
++					lag_cb_main->bond_cb_link_up(dev);
++				}
++				rcu_read_unlock();
++			}
++           /* QCA NSS ECM bonding support - End */
++
+ 			if (bond_is_lb(bond))
+ 				bond_alb_handle_link_change(bond, new_active, BOND_LINK_UP);
+ 		} else {
+@@ -1833,6 +1865,7 @@ int bond_enslave(struct net_device *bond
+ 	const struct net_device_ops *slave_ops = slave_dev->netdev_ops;
+ 	struct slave *new_slave = NULL, *prev_slave;
+ 	struct sockaddr_storage ss;
++	struct bond_cb *lag_cb_main; /* QCA NSS ECM bonding support */
+ 	int link_reporting;
+ 	int res = 0, i;
+ 
+@@ -2278,6 +2311,15 @@ int bond_enslave(struct net_device *bond
+ 		   bond_is_active_slave(new_slave) ? "an active" : "a backup",
+ 		   new_slave->link != BOND_LINK_DOWN ? "an up" : "a down");
+ 
++	/* QCA NSS ECM bonding support - Start */
++	rcu_read_lock();
++	lag_cb_main = rcu_dereference(bond_cb);
++	if (lag_cb_main && lag_cb_main->bond_cb_enslave)
++		lag_cb_main->bond_cb_enslave(slave_dev);
++
++	rcu_read_unlock();
++	/* QCA NSS ECM bonding support - End */
++
+ 	/* enslave is successful */
+ 	bond_queue_slave_event(new_slave);
+ 	return 0;
+@@ -2343,6 +2385,15 @@ err_undo_flags:
+ 		}
+ 	}
+ 
++	/* QCA NSS ECM bonding support - Start */
++	rcu_read_lock();
++	lag_cb_main = rcu_dereference(bond_cb);
++	if (lag_cb_main && lag_cb_main->bond_cb_enslave)
++		lag_cb_main->bond_cb_enslave(slave_dev);
++
++	rcu_read_unlock();
++	/* QCA NSS ECM bonding support - End */
++
+ 	return res;
+ }
+ 
+@@ -2364,6 +2415,7 @@ static int __bond_release_one(struct net
+ 	struct bonding *bond = netdev_priv(bond_dev);
+ 	struct slave *slave, *oldcurrent;
+ 	struct sockaddr_storage ss;
++	struct bond_cb *lag_cb_main; /* QCA NSS ECM bonding support */
+ 	int old_flags = bond_dev->flags;
+ 	netdev_features_t old_features = bond_dev->features;
+ 
+@@ -2386,6 +2438,15 @@ static int __bond_release_one(struct net
+ 
+ 	bond_set_slave_inactive_flags(slave, BOND_SLAVE_NOTIFY_NOW);
+ 
++	/* QCA NSS ECM bonding support - Start */
++	rcu_read_lock();
++	lag_cb_main = rcu_dereference(bond_cb);
++	if (lag_cb_main && lag_cb_main->bond_cb_release)
++		lag_cb_main->bond_cb_release(slave_dev);
++
++	rcu_read_unlock();
++	/* QCA NSS ECM bonding support - End */
++
+ 	bond_sysfs_slave_del(slave);
+ 
+ 	/* recompute stats just before removing the slave */
+@@ -2708,6 +2769,8 @@ static void bond_miimon_commit(struct bo
+ 	struct slave *slave, *primary, *active;
+ 	bool do_failover = false;
+ 	struct list_head *iter;
++	struct net_device *slave_dev = NULL; /* QCA NSS ECM bonding support */
++	struct bond_cb *lag_cb_main; /* QCA NSS ECM bonding support */
+ 
+ 	ASSERT_RTNL();
+ 
+@@ -2747,6 +2810,12 @@ static void bond_miimon_commit(struct bo
+ 				bond_set_active_slave(slave);
+ 			}
+ 
++			/* QCA NSS ECM bonding support - Start */
++			if ((bond->params.mode == BOND_MODE_XOR) &&
++			    (!slave_dev))
++				slave_dev = slave->dev;
++			/* QCA NSS ECM bonding support - End */
++
+ 			slave_info(bond->dev, slave->dev, "link status definitely up, %u Mbps %s duplex\n",
+ 				   slave->speed == SPEED_UNKNOWN ? 0 : slave->speed,
+ 				   slave->duplex ? "full" : "half");
+@@ -2795,6 +2864,16 @@ static void bond_miimon_commit(struct bo
+ 		unblock_netpoll_tx();
+ 	}
+ 
++	/* QCA NSS ECM bonding support - Start */
++	rcu_read_lock();
++	lag_cb_main = rcu_dereference(bond_cb);
++
++	if (slave_dev && lag_cb_main && lag_cb_main->bond_cb_link_up)
++		lag_cb_main->bond_cb_link_up(slave_dev);
++
++	rcu_read_unlock();
++	/* QCA NSS ECM bonding support - End */
++
+ 	bond_set_carrier(bond);
+ }
+ 
+@@ -4047,8 +4126,219 @@ static inline u32 bond_eth_hash(struct s
+ 		return 0;
+ 
+ 	ep = (struct ethhdr *)(data + mhoff);
+-	return ep->h_dest[5] ^ ep->h_source[5] ^ be16_to_cpu(ep->h_proto);
++	return ep->h_dest[5] ^ ep->h_source[5]; /* QCA NSS ECM bonding support */
++}
++
++/* QCA NSS ECM bonding support - Start */
++/* Extract the appropriate headers based on bond's xmit policy */
++static bool bond_flow_dissect_without_skb(struct bonding *bond,
++					  u8 *src_mac, u8 *dst_mac,
++					  void *psrc, void *pdst,
++					  u16 protocol, __be16 *layer4hdr,
++					  struct flow_keys *fk)
++{
++	u32 *src = NULL;
++	u32 *dst = NULL;
++
++	fk->ports.ports = 0;
++	src = (uint32_t *)psrc;
++	dst = (uint32_t *)pdst;
++
++	if (protocol == htons(ETH_P_IP)) {
++       /* V4 addresses and address type*/
++		fk->addrs.v4addrs.src = src[0];
++		fk->addrs.v4addrs.dst = dst[0];
++       fk->control.addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS;
++	} else if (protocol == htons(ETH_P_IPV6)) {
++       /* V6 addresses and address type*/
++		memcpy(&fk->addrs.v6addrs.src, src, sizeof(struct in6_addr));
++		memcpy(&fk->addrs.v6addrs.dst, dst, sizeof(struct in6_addr));
++       fk->control.addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
++	} else {
++		return false;
++	}
++	if ((bond->params.xmit_policy == BOND_XMIT_POLICY_LAYER34) &&
++	    (layer4hdr))
++		fk->ports.ports = *layer4hdr;
++
++	return true;
++}
++
++/* bond_xmit_hash_without_skb - Applies load balancing algorithm for a packet,
++ * to calculate hash for a given set of L2/L3 addresses. Does not
++ * calculate egress interface.
++ */
++uint32_t bond_xmit_hash_without_skb(u8 *src_mac, u8 *dst_mac,
++				    void *psrc, void *pdst, u16 protocol,
++				    struct net_device *bond_dev,
++				    __be16 *layer4hdr)
++{
++	struct bonding *bond = netdev_priv(bond_dev);
++	struct flow_keys flow;
++	u32 hash = 0;
++
++	if (bond->params.xmit_policy == BOND_XMIT_POLICY_LAYER2 ||
++	    !bond_flow_dissect_without_skb(bond, src_mac, dst_mac, psrc,
++					   pdst, protocol, layer4hdr, &flow))
++		return (dst_mac[5] ^ src_mac[5]);
++
++	if (bond->params.xmit_policy == BOND_XMIT_POLICY_LAYER23)
++		hash = dst_mac[5] ^ src_mac[5];
++	else if (layer4hdr)
++		hash = (__force u32)flow.ports.ports;
++
++	hash ^= (__force u32)flow_get_u32_dst(&flow) ^
++		(__force u32)flow_get_u32_src(&flow);
++	hash ^= (hash >> 16);
++	hash ^= (hash >> 8);
++
++	return hash;
++}
++
++/* bond_xor_get_tx_dev - Calculate egress interface for a given packet for a LAG
++ * that is configured in balance-xor mode
++ * @skb: pointer to skb to be egressed
++ * @src_mac: pointer to source L2 address
++ * @dst_mac: pointer to destination L2 address
++ * @src: pointer to source L3 address in network order
++ * @dst: pointer to destination L3 address in network order
++ * @protocol: L3 protocol
++ * @bond_dev: pointer to bond master device
++ *
++ * If @skb is NULL, bond_xmit_hash_without_skb is used to calculate hash using
++ * L2/L3 addresses.
++ *
++ * Returns: Either valid slave device, or NULL otherwise
++ */
++static struct net_device *bond_xor_get_tx_dev(struct sk_buff *skb,
++					      u8 *src_mac, u8 *dst_mac,
++					      void *src, void *dst,
++					      u16 protocol,
++					      struct net_device *bond_dev,
++					      __be16 *layer4hdr)
++{
++	struct bonding *bond = netdev_priv(bond_dev);
++	int slave_cnt = READ_ONCE(bond->slave_cnt);
++	int slave_id = 0, i = 0;
++	u32 hash;
++	struct list_head *iter;
++	struct slave *slave;
++
++	if (slave_cnt == 0) {
++		pr_debug("%s: Error: No slave is attached to the interface\n",
++			 bond_dev->name);
++		return NULL;
++	}
++
++	if (skb) {
++		hash = bond_xmit_hash(bond, skb);
++		slave_id = hash % slave_cnt;
++	} else {
++		if (bond->params.xmit_policy != BOND_XMIT_POLICY_LAYER23 &&
++		    bond->params.xmit_policy != BOND_XMIT_POLICY_LAYER2	&&
++		    bond->params.xmit_policy != BOND_XMIT_POLICY_LAYER34) {
++			pr_debug("%s: Error: Unsupported hash policy for balance-XOR fast path\n",
++				 bond_dev->name);
++			return NULL;
++		}
++
++		hash = bond_xmit_hash_without_skb(src_mac, dst_mac, src,
++						  dst, protocol, bond_dev,
++						  layer4hdr);
++		slave_id = hash % slave_cnt;
++	}
++
++	i = slave_id;
++
++	/* Here we start from the slave with slave_id */
++	bond_for_each_slave_rcu(bond, slave, iter) {
++		if (--i < 0) {
++			if (bond_slave_can_tx(slave))
++				return slave->dev;
++		}
++	}
++
++	/* Here we start from the first slave up to slave_id */
++	i = slave_id;
++	bond_for_each_slave_rcu(bond, slave, iter) {
++		if (--i < 0)
++			break;
++		if (bond_slave_can_tx(slave))
++			return slave->dev;
++	}
++
++	return NULL;
++}
++
++/* bond_get_tx_dev - Calculate egress interface for a given packet.
++ *
++ * Supports 802.3AD and balance-xor modes
++ *
++ * @skb: pointer to skb to be egressed, if valid
++ * @src_mac: pointer to source L2 address
++ * @dst_mac: pointer to destination L2 address
++ * @src: pointer to source L3 address in network order
++ * @dst: pointer to destination L3 address in network order
++ * @protocol: L3 protocol id from L2 header
++ * @bond_dev: pointer to bond master device
++ *
++ * Returns: Either valid slave device, or NULL for un-supported LAG modes
++ */
++struct net_device *bond_get_tx_dev(struct sk_buff *skb, uint8_t *src_mac,
++				   u8 *dst_mac, void *src,
++				   void *dst, u16 protocol,
++				   struct net_device *bond_dev,
++				   __be16 *layer4hdr)
++{
++	struct bonding *bond;
++
++	if (!bond_dev)
++		return NULL;
++
++	if (!((bond_dev->priv_flags & IFF_BONDING) &&
++	      (bond_dev->flags & IFF_MASTER)))
++		return NULL;
++
++	bond = netdev_priv(bond_dev);
++
++	switch (bond->params.mode) {
++	case BOND_MODE_XOR:
++		return bond_xor_get_tx_dev(skb, src_mac, dst_mac,
++					   src, dst, protocol,
++					   bond_dev, layer4hdr);
++	case BOND_MODE_8023AD:
++		return bond_3ad_get_tx_dev(skb, src_mac, dst_mac,
++					   src, dst, protocol,
++					   bond_dev, layer4hdr);
++	default:
++		return NULL;
++	}
+ }
++EXPORT_SYMBOL(bond_get_tx_dev);
++
++/* In bond_xmit_xor() , we determine the output device by using a pre-
++ * determined xmit_hash_policy(), If the selected device is not enabled,
++ * find the next active slave.
++ */
++static int bond_xmit_xor(struct sk_buff *skb, struct net_device *dev)
++{
++	struct bonding *bond = netdev_priv(dev);
++	struct net_device *outdev;
++
++	outdev = bond_xor_get_tx_dev(skb, NULL, NULL, NULL,
++				     NULL, 0, dev, NULL);
++	if (!outdev)
++		goto out;
++
++	bond_dev_queue_xmit(bond, skb, outdev);
++	goto final;
++out:
++	/* no suitable interface, frame not sent */
++	dev_kfree_skb(skb);
++final:
++	return NETDEV_TX_OK;
++}
++/* QCA NSS ECM bonding support - End */
+ 
+ static bool bond_flow_ip(struct sk_buff *skb, struct flow_keys *fk, const void *data,
+ 			 int hlen, __be16 l2_proto, int *nhoff, int *ip_proto, bool l34)
+@@ -5177,15 +5467,18 @@ static netdev_tx_t bond_3ad_xor_xmit(str
+ 				     struct net_device *dev)
+ {
+ 	struct bonding *bond = netdev_priv(dev);
+-	struct bond_up_slave *slaves;
+-	struct slave *slave;
++	/* QCA NSS ECM bonding support - Start */
++	struct net_device *outdev = NULL;
+ 
+-	slaves = rcu_dereference(bond->usable_slaves);
+-	slave = bond_xmit_3ad_xor_slave_get(bond, skb, slaves);
+-	if (likely(slave))
+-		return bond_dev_queue_xmit(bond, skb, slave->dev);
++	outdev = bond_3ad_get_tx_dev(skb, NULL, NULL, NULL,
++				     NULL, 0, dev, NULL);
++	if (!outdev) {
++		dev_kfree_skb(skb);
++		return NETDEV_TX_OK;
++	}
+ 
+-	return bond_tx_drop(dev, skb);
++	return bond_dev_queue_xmit(bond, skb, outdev);
++	/* QCA NSS ECM bonding support - End */
+ }
+ 
+ /* in broadcast mode, we send everything to all usable interfaces. */
+@@ -5435,8 +5728,9 @@ static netdev_tx_t __bond_start_xmit(str
+ 		return bond_xmit_roundrobin(skb, dev);
+ 	case BOND_MODE_ACTIVEBACKUP:
+ 		return bond_xmit_activebackup(skb, dev);
+-	case BOND_MODE_8023AD:
+ 	case BOND_MODE_XOR:
++		return bond_xmit_xor(skb, dev); /* QCA NSS ECM bonding support */
++	case BOND_MODE_8023AD:
+ 		return bond_3ad_xor_xmit(skb, dev);
+ 	case BOND_MODE_BROADCAST:
+ 		return bond_xmit_broadcast(skb, dev);
+--- a/include/net/bond_3ad.h
++++ b/include/net/bond_3ad.h
+@@ -302,8 +302,15 @@ int bond_3ad_lacpdu_recv(const struct sk
+ 			 struct slave *slave);
+ int bond_3ad_set_carrier(struct bonding *bond);
+ void bond_3ad_update_lacp_rate(struct bonding *bond);
++/* QCA NSS ECM bonding support */
++struct net_device *bond_3ad_get_tx_dev(struct sk_buff *skb, uint8_t *src_mac,
++				       uint8_t *dst_mac, void *src,
++				       void *dst, uint16_t protocol,
++				       struct net_device *bond_dev,
++				       __be16 *layer4hdr);
++/* QCA NSS ECM bonding support */
++
+ void bond_3ad_update_ad_actor_settings(struct bonding *bond);
+ int bond_3ad_stats_fill(struct sk_buff *skb, struct bond_3ad_stats *stats);
+ size_t bond_3ad_stats_size(void);
+ #endif /* _NET_BOND_3AD_H */
+-
+--- a/include/net/bonding.h
++++ b/include/net/bonding.h
+@@ -90,6 +90,8 @@
+ #define BOND_XFRM_FEATURES (NETIF_F_HW_ESP | NETIF_F_HW_ESP_TX_CSUM | \
+ 			    NETIF_F_GSO_ESP)
+ 
++extern struct bond_cb __rcu *bond_cb; /* QCA NSS ECM bonding support */
++
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+ extern atomic_t netpoll_block_tx;
+ 
+@@ -653,6 +655,7 @@ struct bond_net {
+ 
+ int bond_rcv_validate(const struct sk_buff *skb, struct bonding *bond, struct slave *slave);
+ netdev_tx_t bond_dev_queue_xmit(struct bonding *bond, struct sk_buff *skb, struct net_device *slave_dev);
++int bond_get_id(struct net_device *bond_dev); /* QCA NSS ECM bonding support */
+ int bond_create(struct net *net, const char *name);
+ int bond_create_sysfs(struct bond_net *net);
+ void bond_destroy_sysfs(struct bond_net *net);
+@@ -684,6 +687,13 @@ struct bond_vlan_tag *bond_verify_device
+ 					      int level);
+ int bond_update_slave_arr(struct bonding *bond, struct slave *skipslave);
+ void bond_slave_arr_work_rearm(struct bonding *bond, unsigned long delay);
++/* QCA NSS ECM bonding support - Start */
++uint32_t bond_xmit_hash_without_skb(uint8_t *src_mac, uint8_t *dst_mac,
++				    void *psrc, void *pdst, uint16_t protocol,
++				    struct net_device *bond_dev,
++				    __be16 *layer4hdr);
++/* QCA NSS ECM bonding support - End */
++
+ void bond_work_init_all(struct bonding *bond);
+ 
+ #ifdef CONFIG_PROC_FS
+@@ -788,4 +798,18 @@ static inline netdev_tx_t bond_tx_drop(s
+ 	return NET_XMIT_DROP;
+ }
+ 
++/* QCA NSS ECM bonding support - Start */
++struct bond_cb {
++	void (*bond_cb_link_up)(struct net_device *slave);
++	void (*bond_cb_link_down)(struct net_device *slave);
++	void (*bond_cb_enslave)(struct net_device *slave);
++	void (*bond_cb_release)(struct net_device *slave);
++	void (*bond_cb_delete_by_slave)(struct net_device *slave);
++	void (*bond_cb_delete_by_mac)(uint8_t *mac_addr);
++};
++
++extern int bond_register_cb(struct bond_cb *cb);
++extern void bond_unregister_cb(void);
++/* QCA NSS ECM bonding support - End */
++
+ #endif /* _NET_BONDING_H */
diff --git a/target/linux/qualcommax/patches-6.6/0600-5-qca-nss-ecm-support-macvlan.patch b/target/linux/qualcommax/patches-6.6/0600-5-qca-nss-ecm-support-macvlan.patch
new file mode 100644
index 00000000000000..29f7e96d791328
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0600-5-qca-nss-ecm-support-macvlan.patch
@@ -0,0 +1,96 @@
+--- a/include/linux/if_macvlan.h
++++ b/include/linux/if_macvlan.h
+@@ -15,6 +15,13 @@ struct macvlan_port;
+ #define MACVLAN_MC_FILTER_BITS	8
+ #define MACVLAN_MC_FILTER_SZ	(1 << MACVLAN_MC_FILTER_BITS)
+ 
++/* QCA NSS ECM Support - Start */
++/*
++ * Callback for updating interface statistics for macvlan flows offloaded from host CPU.
++ */
++typedef void (*macvlan_offload_stats_update_cb_t)(struct net_device *dev, struct rtnl_link_stats64 *stats, bool update_mcast_rx_stats);
++/* QCA NSS ECM Support - End */
++
+ struct macvlan_dev {
+ 	struct net_device	*dev;
+ 	struct list_head	list;
+@@ -35,6 +42,7 @@ struct macvlan_dev {
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+ 	struct netpoll		*netpoll;
+ #endif
++	macvlan_offload_stats_update_cb_t	offload_stats_update; /* QCA NSS ECM support */
+ };
+ 
+ static inline void macvlan_count_rx(const struct macvlan_dev *vlan,
+@@ -107,4 +115,26 @@ static inline int macvlan_release_l2fw_o
+ 	macvlan->accel_priv = NULL;
+ 	return dev_uc_add(macvlan->lowerdev, dev->dev_addr);
+ }
++
++/* QCA NSS ECM Support - Start */
++#if IS_ENABLED(CONFIG_MACVLAN)
++static inline void
++macvlan_offload_stats_update(struct net_device *dev,
++			     struct rtnl_link_stats64 *stats,
++			     bool update_mcast_rx_stats)
++{
++	struct macvlan_dev *macvlan = netdev_priv(dev);
++
++	macvlan->offload_stats_update(dev, stats, update_mcast_rx_stats);
++}
++
++static inline enum
++macvlan_mode macvlan_get_mode(struct net_device *dev)
++{
++	struct macvlan_dev *macvlan = netdev_priv(dev);
++
++	return macvlan->mode;
++}
++#endif
++/* QCA NSS ECM Support - End */
+ #endif /* _LINUX_IF_MACVLAN_H */
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -960,6 +960,34 @@ static void macvlan_uninit(struct net_de
+ 		macvlan_port_destroy(port->dev);
+ }
+ 
++/* QCA NSS ECM Support - Start */
++/* Update macvlan statistics processed by offload engines */
++static void macvlan_dev_update_stats(struct net_device *dev,
++				     struct rtnl_link_stats64 *offl_stats,
++				     bool update_mcast_rx_stats)
++{
++	struct vlan_pcpu_stats *stats;
++	struct macvlan_dev *macvlan;
++
++	/* Is this a macvlan? */
++	if (!netif_is_macvlan(dev))
++		return;
++
++	macvlan = netdev_priv(dev);
++	stats = this_cpu_ptr(macvlan->pcpu_stats);
++	u64_stats_update_begin(&stats->syncp);
++	u64_stats_add(&stats->rx_packets, offl_stats->rx_packets);
++	u64_stats_add(&stats->rx_bytes, offl_stats->rx_bytes);
++	u64_stats_add(&stats->tx_packets, offl_stats->tx_packets);
++	u64_stats_add(&stats->tx_bytes, offl_stats->tx_bytes);
++	/* Update multicast statistics */
++	if (unlikely(update_mcast_rx_stats)) {
++		u64_stats_add(&stats->rx_multicast, offl_stats->rx_packets);
++	}
++	u64_stats_update_end(&stats->syncp);
++}
++/* QCA NSS ECM Support - End */
++
+ static void macvlan_dev_get_stats64(struct net_device *dev,
+ 				    struct rtnl_link_stats64 *stats)
+ {
+@@ -1506,6 +1534,7 @@ int macvlan_common_newlink(struct net *s
+ 	vlan->dev      = dev;
+ 	vlan->port     = port;
+ 	vlan->set_features = MACVLAN_FEATURES;
++	vlan->offload_stats_update = macvlan_dev_update_stats; /* QCA NSS ECM Support */
+ 
+ 	vlan->mode     = MACVLAN_MODE_VEPA;
+ 	if (data && data[IFLA_MACVLAN_MODE])
diff --git a/target/linux/qualcommax/patches-6.6/0600-6-qca-nss-ecm-support-netfilter-DSCPREMARK.patch b/target/linux/qualcommax/patches-6.6/0600-6-qca-nss-ecm-support-netfilter-DSCPREMARK.patch
new file mode 100644
index 00000000000000..27650731a69612
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0600-6-qca-nss-ecm-support-netfilter-DSCPREMARK.patch
@@ -0,0 +1,154 @@
+--- a/net/netfilter/Kconfig
++++ b/net/netfilter/Kconfig
+@@ -174,6 +174,13 @@ config NF_CONNTRACK_TIMEOUT
+ 
+ 	  If unsure, say `N'.
+ 
++config NF_CONNTRACK_DSCPREMARK_EXT
++	bool  'Connection tracking extension for dscp remark target'
++	depends on NETFILTER_ADVANCED
++	help
++	  This option enables support for connection tracking extension
++	  for dscp remark.
++
+ config NF_CONNTRACK_TIMESTAMP
+ 	bool  'Connection tracking timestamping'
+ 	depends on NETFILTER_ADVANCED
+--- a/include/net/netfilter/nf_conntrack_extend.h
++++ b/include/net/netfilter/nf_conntrack_extend.h
+@@ -31,6 +31,10 @@ enum nf_ct_ext_id {
+ #if IS_ENABLED(CONFIG_NET_ACT_CT)
+ 	NF_CT_EXT_ACT_CT,
+ #endif
++#ifdef CONFIG_NF_CONNTRACK_DSCPREMARK_EXT
++	NF_CT_EXT_DSCPREMARK,   /* QCA NSS ECM support */
++#endif
++
+ 	NF_CT_EXT_NUM,
+ };
+ 
+--- a/net/netfilter/nf_conntrack_extend.c
++++ b/net/netfilter/nf_conntrack_extend.c
+@@ -23,6 +23,7 @@
+ #include <net/netfilter/nf_conntrack_labels.h>
+ #include <net/netfilter/nf_conntrack_synproxy.h>
+ #include <net/netfilter/nf_conntrack_act_ct.h>
++#include <net/netfilter/nf_conntrack_dscpremark_ext.h>
+ #include <net/netfilter/nf_nat.h>
+ 
+ #define NF_CT_EXT_PREALLOC	128u /* conntrack events are on by default */
+@@ -54,6 +55,9 @@ static const u8 nf_ct_ext_type_len[NF_CT
+ #if IS_ENABLED(CONFIG_NET_ACT_CT)
+ 	[NF_CT_EXT_ACT_CT] = sizeof(struct nf_conn_act_ct_ext),
+ #endif
++#ifdef CONFIG_NF_CONNTRACK_DSCPREMARK_EXT
++	[NF_CT_EXT_DSCPREMARK] = sizeof(struct nf_ct_dscpremark_ext),
++#endif
+ };
+ 
+ static __always_inline unsigned int total_extension_size(void)
+@@ -86,6 +90,9 @@ static __always_inline unsigned int tota
+ #if IS_ENABLED(CONFIG_NET_ACT_CT)
+ 		+ sizeof(struct nf_conn_act_ct_ext)
+ #endif
++#ifdef CONFIG_NF_CONNTRACK_DSCPREMARK_EXT
++	    + sizeof(struct nf_ct_dscpremark_ext)
++#endif
+ 	;
+ }
+ 
+--- a/net/netfilter/Makefile
++++ b/net/netfilter/Makefile
+@@ -15,6 +15,7 @@ nf_conntrack-$(CONFIG_NF_CONNTRACK_OVS)
+ nf_conntrack-$(CONFIG_NF_CT_PROTO_DCCP) += nf_conntrack_proto_dccp.o
+ nf_conntrack-$(CONFIG_NF_CT_PROTO_SCTP) += nf_conntrack_proto_sctp.o
+ nf_conntrack-$(CONFIG_NF_CT_PROTO_GRE) += nf_conntrack_proto_gre.o
++nf_conntrack-$(CONFIG_NF_CONNTRACK_DSCPREMARK_EXT) += nf_conntrack_dscpremark_ext.o
+ ifeq ($(CONFIG_NF_CONNTRACK),m)
+ nf_conntrack-$(CONFIG_DEBUG_INFO_BTF_MODULES) += nf_conntrack_bpf.o
+ else ifeq ($(CONFIG_NF_CONNTRACK),y)
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -45,6 +45,9 @@
+ #include <net/netfilter/nf_conntrack_zones.h>
+ #include <net/netfilter/nf_conntrack_timestamp.h>
+ #include <net/netfilter/nf_conntrack_timeout.h>
++#ifdef CONFIG_NF_CONNTRACK_DSCPREMARK_EXT
++#include <net/netfilter/nf_conntrack_dscpremark_ext.h>
++#endif
+ #include <net/netfilter/nf_conntrack_labels.h>
+ #include <net/netfilter/nf_conntrack_synproxy.h>
+ #include <net/netfilter/nf_nat.h>
+@@ -1740,6 +1743,9 @@ init_conntrack(struct net *net, struct n
+ 	nf_ct_acct_ext_add(ct, GFP_ATOMIC);
+ 	nf_ct_tstamp_ext_add(ct, GFP_ATOMIC);
+ 	nf_ct_labels_ext_add(ct);
++#ifdef CONFIG_NF_CONNTRACK_DSCPREMARK_EXT
++	nf_ct_dscpremark_ext_add(ct, GFP_ATOMIC);
++#endif
+ 
+ #ifdef CONFIG_NF_CONNTRACK_EVENTS
+ 	ecache = tmpl ? nf_ct_ecache_find(tmpl) : NULL;
+--- a/net/netfilter/xt_DSCP.c
++++ b/net/netfilter/xt_DSCP.c
+@@ -15,6 +15,9 @@
+ 
+ #include <linux/netfilter/x_tables.h>
+ #include <linux/netfilter/xt_DSCP.h>
++#ifdef CONFIG_NF_CONNTRACK_DSCPREMARK_EXT
++#include <net/netfilter/nf_conntrack_dscpremark_ext.h>
++#endif
+ 
+ MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
+ MODULE_DESCRIPTION("Xtables: DSCP/TOS field modification");
+@@ -31,6 +34,10 @@ dscp_tg(struct sk_buff *skb, const struc
+ {
+ 	const struct xt_DSCP_info *dinfo = par->targinfo;
+ 	u_int8_t dscp = ipv4_get_dsfield(ip_hdr(skb)) >> XT_DSCP_SHIFT;
++#ifdef CONFIG_NF_CONNTRACK_DSCPREMARK_EXT
++	struct nf_conn *ct;
++	enum ip_conntrack_info ctinfo;
++#endif
+ 
+ 	if (dscp != dinfo->dscp) {
+ 		if (skb_ensure_writable(skb, sizeof(struct iphdr)))
+@@ -39,6 +46,13 @@ dscp_tg(struct sk_buff *skb, const struc
+ 		ipv4_change_dsfield(ip_hdr(skb), XT_DSCP_ECN_MASK,
+ 				    dinfo->dscp << XT_DSCP_SHIFT);
+ 
++#ifdef CONFIG_NF_CONNTRACK_DSCPREMARK_EXT
++		ct = nf_ct_get(skb, &ctinfo);
++		if (!ct)
++			return XT_CONTINUE;
++
++		nf_conntrack_dscpremark_ext_set_dscp_rule_valid(ct);
++#endif
+ 	}
+ 	return XT_CONTINUE;
+ }
+@@ -48,13 +62,24 @@ dscp_tg6(struct sk_buff *skb, const stru
+ {
+ 	const struct xt_DSCP_info *dinfo = par->targinfo;
+ 	u_int8_t dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> XT_DSCP_SHIFT;
+-
++#ifdef CONFIG_NF_CONNTRACK_DSCPREMARK_EXT
++	struct nf_conn *ct;
++	enum ip_conntrack_info ctinfo;
++#endif
+ 	if (dscp != dinfo->dscp) {
+ 		if (skb_ensure_writable(skb, sizeof(struct ipv6hdr)))
+ 			return NF_DROP;
+ 
+ 		ipv6_change_dsfield(ipv6_hdr(skb), XT_DSCP_ECN_MASK,
+ 				    dinfo->dscp << XT_DSCP_SHIFT);
++
++#ifdef CONFIG_NF_CONNTRACK_DSCPREMARK_EXT
++		ct = nf_ct_get(skb, &ctinfo);
++		if (!ct)
++			return XT_CONTINUE;
++
++		nf_conntrack_dscpremark_ext_set_dscp_rule_valid(ct);
++#endif
+ 	}
+ 	return XT_CONTINUE;
+ }
diff --git a/target/linux/qualcommax/patches-6.6/0601-1-qca-add-nss-bridge-mgr-support.patch b/target/linux/qualcommax/patches-6.6/0601-1-qca-add-nss-bridge-mgr-support.patch
new file mode 100644
index 00000000000000..dcfd78d5932a6a
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0601-1-qca-add-nss-bridge-mgr-support.patch
@@ -0,0 +1,92 @@
+From 3c17a0e1112be70071e98d5208da5b55dcec20a6 Mon Sep 17 00:00:00 2001
+From: Simon Casey <simon501098c@gmail.com>
+Date: Wed, 2 Feb 2022 19:37:29 +0100
+Subject: [PATCH] Update 607-qca-add-add-nss-bridge-mgr-support.patch for kernel 5.15
+
+---
+ include/linux/if_bridge.h |  4 ++++
+ net/bridge/br_fdb.c       | 25 +++++++++++++++++++++----
+ 2 files changed, 25 insertions(+), 4 deletions(-)
+
+--- a/include/linux/if_bridge.h
++++ b/include/linux/if_bridge.h
+@@ -254,4 +254,8 @@ typedef struct net_bridge_port *br_get_d
+ extern br_get_dst_hook_t __rcu *br_get_dst_hook;
+ /* QCA NSS ECM support - End */
+ 
++/* QCA NSS bridge-mgr support - Start */
++extern struct net_device *br_fdb_bridge_dev_get_and_hold(struct net_bridge *br);
++/* QCA NSS bridge-mgr support - End */
++
+ #endif
+--- a/net/bridge/br_fdb.c
++++ b/net/bridge/br_fdb.c
+@@ -576,7 +576,7 @@ void br_fdb_cleanup(struct work_struct *
+ 	unsigned long delay = hold_time(br);
+ 	unsigned long work_delay = delay;
+ 	unsigned long now = jiffies;
+-	u8 mac_addr[6]; /* QCA NSS ECM support */
++	struct br_fdb_event fdb_event; /* QCA NSS bridge-mgr support */
+ 
+ 	/* this part is tricky, in order to avoid blocking learning and
+ 	 * consequently forwarding, we rely on rcu to delete objects with
+@@ -604,12 +604,13 @@ void br_fdb_cleanup(struct work_struct *
+ 		} else {
+ 			spin_lock_bh(&br->hash_lock);
+ 			if (!hlist_unhashed(&f->fdb_node)) {
+-				ether_addr_copy(mac_addr, f->key.addr.addr);
++				memset(&fdb_event, 0, sizeof(fdb_event));
++				ether_addr_copy(fdb_event.addr, f->key.addr.addr);
+ 				fdb_delete(br, f, true);
+ 				/* QCA NSS ECM support - Start */
+ 				atomic_notifier_call_chain(
+ 					&br_fdb_update_notifier_list, 0,
+-					(void *)mac_addr);
++					(void *)&fdb_event);
+ 				/* QCA NSS ECM support - End */
+ 			}
+ 			spin_unlock_bh(&br->hash_lock);
+@@ -907,10 +908,21 @@ static bool __fdb_mark_active(struct net
+ 		  test_and_clear_bit(BR_FDB_NOTIFY_INACTIVE, &fdb->flags));
+ }
+ 
++/* QCA NSS bridge-mgr support - Start */
++/* Get the bridge device */
++struct net_device *br_fdb_bridge_dev_get_and_hold(struct net_bridge *br)
++{
++	dev_hold(br->dev);
++	return br->dev;
++}
++EXPORT_SYMBOL_GPL(br_fdb_bridge_dev_get_and_hold);
++/* QCA NSS bridge-mgr support - End */
++
+ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
+ 		   const unsigned char *addr, u16 vid, unsigned long flags)
+ {
+ 	struct net_bridge_fdb_entry *fdb;
++	struct br_fdb_event fdb_event; /* QCA NSS bridge-mgr support */
+ 
+ 	/* some users want to always flood. */
+ 	if (hold_time(br) == 0)
+@@ -936,6 +948,12 @@ void br_fdb_update(struct net_bridge *br
+ 			if (unlikely(source != READ_ONCE(fdb->dst) &&
+ 				     !test_bit(BR_FDB_STICKY, &fdb->flags))) {
+ 				br_switchdev_fdb_notify(br, fdb, RTM_DELNEIGH);
++				/* QCA NSS bridge-mgr support - Start */
++				ether_addr_copy(fdb_event.addr, addr);
++				fdb_event.br = br;
++				fdb_event.orig_dev = fdb->dst->dev;
++				fdb_event.dev = source->dev;
++				/* QCA NSS bridge-mgr support - End */
+ 				WRITE_ONCE(fdb->dst, source);
+ 				fdb_modified = true;
+ 				/* Take over HW learned entry */
+@@ -952,7 +970,7 @@ void br_fdb_update(struct net_bridge *br
+ 				/* QCA NSS ECM support - Start */
+ 				atomic_notifier_call_chain(
+ 					&br_fdb_update_notifier_list,
+-					0, (void *)addr);
++					0, (void *)&fdb_event);
+ 				/* QCA NSS ECM support - End */
+ 			}
+ 
diff --git a/target/linux/qualcommax/patches-6.6/0602-1-qca-nss-drv-add-qdisc-support.patch b/target/linux/qualcommax/patches-6.6/0602-1-qca-nss-drv-add-qdisc-support.patch
new file mode 100644
index 00000000000000..2926faacefebd7
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0602-1-qca-nss-drv-add-qdisc-support.patch
@@ -0,0 +1,25 @@
+--- a/include/uapi/linux/pkt_cls.h
++++ b/include/uapi/linux/pkt_cls.h
+@@ -139,6 +139,7 @@ enum tca_id {
+ 	TCA_ID_MPLS,
+ 	TCA_ID_CT,
+ 	TCA_ID_GATE,
++	TCA_ID_MIRRED_NSS, /* QCA NSS Qdisc IGS Support */
+ 	/* other actions go here */
+ 	__TCA_ID_MAX = 255
+ };
+@@ -817,4 +818,14 @@ enum {
+ 	TCF_EM_OPND_LT
+ };
+ 
++/* QCA NSS Qdisc Support - Start */
++#define _TC_MAKE32(x)		((x))
++#define _TC_MAKEMASK1(n)	(_TC_MAKE32(1) << _TC_MAKE32(n))
++
++#define TC_NCLS                 _TC_MAKEMASK1(8)
++#define TC_NCLS_NSS		_TC_MAKEMASK1(12)
++#define SET_TC_NCLS_NSS(v)	( TC_NCLS_NSS | ((v) & ~TC_NCLS_NSS))
++#define CLR_TC_NCLS_NSS(v)	( (v) & ~TC_NCLS_NSS)
++/* QCA NSS Qdisc Support - End */
++
+ #endif
diff --git a/target/linux/qualcommax/patches-6.6/0603-1-qca-nss-clients-add-qdisc-support.patch b/target/linux/qualcommax/patches-6.6/0603-1-qca-nss-clients-add-qdisc-support.patch
new file mode 100644
index 00000000000000..9220aca1c78be7
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0603-1-qca-nss-clients-add-qdisc-support.patch
@@ -0,0 +1,463 @@
+--- a/include/linux/timer.h
++++ b/include/linux/timer.h
+@@ -17,6 +17,7 @@ struct timer_list {
+ 	unsigned long		expires;
+ 	void			(*function)(struct timer_list *);
+ 	u32			flags;
++	unsigned long		cust_data;
+ 
+ #ifdef CONFIG_LOCKDEP
+ 	struct lockdep_map	lockdep_map;
+--- a/drivers/net/ifb.c
++++ b/drivers/net/ifb.c
+@@ -151,6 +151,31 @@ resched:
+ 
+ }
+ 
++void ifb_update_offload_stats(struct net_device *dev, struct pcpu_sw_netstats *offload_stats)
++{
++	struct ifb_dev_private *dp;
++   struct ifb_q_private *txp;
++
++   if (!dev || !offload_stats) {
++   	return;
++   }
++
++   if (!(dev->priv_flags_ext & IFF_EXT_IFB)) {
++       return;
++   }
++
++   dp = netdev_priv(dev);
++   txp = dp->tx_private;
++
++   u64_stats_update_begin(&txp->rx_stats.sync);
++   txp->rx_stats.packets += u64_stats_read(&offload_stats->rx_packets);
++   txp->rx_stats.bytes += u64_stats_read(&offload_stats->rx_bytes);
++   txp->tx_stats.packets += u64_stats_read(&offload_stats->tx_packets);
++   txp->tx_stats.bytes += u64_stats_read(&offload_stats->tx_bytes);
++   u64_stats_update_end(&txp->rx_stats.sync);
++}
++EXPORT_SYMBOL(ifb_update_offload_stats);
++
+ static void ifb_stats64(struct net_device *dev,
+ 			struct rtnl_link_stats64 *stats)
+ {
+@@ -326,6 +351,7 @@ static void ifb_setup(struct net_device
+ 	dev->flags |= IFF_NOARP;
+ 	dev->flags &= ~IFF_MULTICAST;
+ 	dev->priv_flags &= ~IFF_TX_SKB_SHARING;
++	dev->priv_flags_ext |= IFF_EXT_IFB;     /* Mark the device as an IFB device. */
+ 	netif_keep_dst(dev);
+ 	eth_hw_addr_random(dev);
+ 	dev->needs_free_netdev = true;
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -4696,6 +4696,15 @@ void dev_uc_flush(struct net_device *dev
+ void dev_uc_init(struct net_device *dev);
+ 
+ /**
++ *  ifb_update_offload_stats - Update the IFB interface stats
++ *  @dev: IFB device to update the stats
++ *  @offload_stats: per CPU stats structure
++ *
++ *  Allows update of IFB stats when flows are offloaded to an accelerator.
++ **/
++void ifb_update_offload_stats(struct net_device *dev, struct pcpu_sw_netstats *offload_stats);
++
++/**
+  *  __dev_uc_sync - Synchonize device's unicast list
+  *  @dev:  device to sync
+  *  @sync: function to call if address should be added
+@@ -5222,6 +5231,11 @@ static inline bool netif_is_failover_sla
+ 	return dev->priv_flags & IFF_FAILOVER_SLAVE;
+ }
+ 
++static inline bool netif_is_ifb_dev(const struct net_device *dev)
++{
++	return dev->priv_flags_ext & IFF_EXT_IFB;
++}
++
+ /* This device needs to keep skb dst for qdisc enqueue or ndo_start_xmit() */
+ static inline void netif_keep_dst(struct net_device *dev)
+ {
+--- a/include/uapi/linux/pkt_sched.h
++++ b/include/uapi/linux/pkt_sched.h
+@@ -1306,4 +1306,248 @@ enum {
+ 
+ #define TCA_ETS_MAX (__TCA_ETS_MAX - 1)
+ 
++/* QCA NSS Clients Support - Start */
++enum {
++	TCA_NSS_ACCEL_MODE_NSS_FW,
++	TCA_NSS_ACCEL_MODE_PPE,
++	TCA_NSS_ACCEL_MODE_MAX
++};
++
++/* NSSFIFO section */
++
++enum {
++	TCA_NSSFIFO_UNSPEC,
++	TCA_NSSFIFO_PARMS,
++	__TCA_NSSFIFO_MAX
++};
++
++#define TCA_NSSFIFO_MAX	(__TCA_NSSFIFO_MAX - 1)
++
++struct tc_nssfifo_qopt {
++	__u32	limit;		/* Queue length: bytes for bfifo, packets for pfifo */
++	__u8	set_default;	/* Sets qdisc to be the default qdisc for enqueue */
++	__u8	accel_mode;	/* Dictates which data plane offloads the qdisc */
++};
++
++/* NSSWRED section */
++
++enum {
++	TCA_NSSWRED_UNSPEC,
++	TCA_NSSWRED_PARMS,
++	__TCA_NSSWRED_MAX
++};
++
++#define TCA_NSSWRED_MAX (__TCA_NSSWRED_MAX - 1)
++#define NSSWRED_CLASS_MAX 6
++struct tc_red_alg_parameter {
++	__u32	min;	/* qlen_avg < min: pkts are all enqueued */
++	__u32	max;	/* qlen_avg > max: pkts are all dropped */
++	__u32	probability;/* Drop probability at qlen_avg = max */
++	__u32	exp_weight_factor;/* exp_weight_factor for calculate qlen_avg */
++};
++
++struct tc_nsswred_traffic_class {
++	__u32 limit;			/* Queue length */
++	__u32 weight_mode_value;	/* Weight mode value */
++	struct tc_red_alg_parameter rap;/* Parameters for RED alg */
++};
++
++/*
++ * Weight modes for WRED
++ */
++enum tc_nsswred_weight_modes {
++	TC_NSSWRED_WEIGHT_MODE_DSCP = 0,/* Weight mode is DSCP */
++	TC_NSSWRED_WEIGHT_MODES,	/* Must be last */
++};
++
++struct tc_nsswred_qopt {
++	__u32	limit;			/* Queue length */
++	enum tc_nsswred_weight_modes weight_mode;
++					/* Weight mode */
++	__u32	traffic_classes;	/* How many traffic classes: DPs */
++	__u32	def_traffic_class;	/* Default traffic if no match: def_DP */
++	__u32	traffic_id;		/* The traffic id to be configured: DP */
++	__u32	weight_mode_value;	/* Weight mode value */
++	struct tc_red_alg_parameter rap;/* RED algorithm parameters */
++	struct tc_nsswred_traffic_class tntc[NSSWRED_CLASS_MAX];
++					/* Traffic settings for dumpping */
++	__u8	ecn;			/* Setting ECN bit or dropping */
++	__u8	set_default;		/* Sets qdisc to be the default for enqueue */
++	__u8	accel_mode;		/* Dictates which data plane offloads the qdisc */
++};
++
++/* NSSCODEL section */
++
++enum {
++	TCA_NSSCODEL_UNSPEC,
++	TCA_NSSCODEL_PARMS,
++	__TCA_NSSCODEL_MAX
++};
++
++#define TCA_NSSCODEL_MAX	(__TCA_NSSCODEL_MAX - 1)
++
++struct tc_nsscodel_qopt {
++	__u32	target;		/* Acceptable queueing delay */
++	__u32	limit;		/* Max number of packets that can be held in the queue */
++	__u32	interval;	/* Monitoring interval */
++	__u32	flows;		/* Number of flow buckets */
++	__u32	quantum;	/* Weight (in bytes) used for DRR of flow buckets */
++	__u8	ecn;		/* 0 - disable ECN, 1 - enable ECN */
++	__u8	set_default;	/* Sets qdisc to be the default qdisc for enqueue */
++	__u8	accel_mode;	/* Dictates which data plane offloads the qdisc */
++};
++
++struct tc_nsscodel_xstats {
++	__u32 peak_queue_delay;	/* Peak delay experienced by a dequeued packet */
++	__u32 peak_drop_delay;	/* Peak delay experienced by a dropped packet */
++};
++
++/* NSSFQ_CODEL section */
++
++struct tc_nssfq_codel_xstats {
++	__u32 new_flow_count;	/* Total number of new flows seen */
++	__u32 new_flows_len;	/* Current number of new flows */
++	__u32 old_flows_len;	/* Current number of old flows */
++	__u32 ecn_mark;		/* Number of packets marked with ECN */
++	__u32 drop_overlimit;	/* Number of packets dropped due to overlimit */
++	__u32 maxpacket;	/* The largest packet seen so far in the queue */
++};
++
++/* NSSTBL section */
++
++enum {
++	TCA_NSSTBL_UNSPEC,
++	TCA_NSSTBL_PARMS,
++	__TCA_NSSTBL_MAX
++};
++
++#define TCA_NSSTBL_MAX	(__TCA_NSSTBL_MAX - 1)
++
++struct tc_nsstbl_qopt {
++	__u32	burst;		/* Maximum burst size */
++	__u32	rate;		/* Limiting rate of TBF */
++	__u32	peakrate;	/* Maximum rate at which TBF is allowed to send */
++	__u32	mtu;		/* Max size of packet, or minumim burst size */
++	__u8	accel_mode;	/* Dictates which data plane offloads the qdisc */
++};
++
++/* NSSPRIO section */
++
++#define TCA_NSSPRIO_MAX_BANDS 256
++
++enum {
++	TCA_NSSPRIO_UNSPEC,
++	TCA_NSSPRIO_PARMS,
++	__TCA_NSSPRIO_MAX
++};
++
++#define TCA_NSSPRIO_MAX	(__TCA_NSSPRIO_MAX - 1)
++
++struct tc_nssprio_qopt {
++	__u32	bands;		/* Number of bands */
++	__u8	accel_mode;	/* Dictates which data plane offloads the qdisc */
++};
++
++/* NSSBF section */
++
++enum {
++	TCA_NSSBF_UNSPEC,
++	TCA_NSSBF_CLASS_PARMS,
++	TCA_NSSBF_QDISC_PARMS,
++	__TCA_NSSBF_MAX
++};
++
++#define TCA_NSSBF_MAX	(__TCA_NSSBF_MAX - 1)
++
++struct tc_nssbf_class_qopt {
++	__u32	burst;		/* Maximum burst size */
++	__u32	rate;		/* Allowed bandwidth for this class */
++	__u32	mtu;		/* MTU of the associated interface */
++	__u32	quantum;	/* Quantum allocation for DRR */
++};
++
++struct tc_nssbf_qopt {
++	__u16	defcls;		/* Default class value */
++	__u8	accel_mode;	/* Dictates which data plane offloads the qdisc */
++};
++
++/* NSSWRR section */
++
++enum {
++	TCA_NSSWRR_UNSPEC,
++	TCA_NSSWRR_CLASS_PARMS,
++	TCA_NSSWRR_QDISC_PARMS,
++	__TCA_NSSWRR_MAX
++};
++
++#define TCA_NSSWRR_MAX	(__TCA_NSSWRR_MAX - 1)
++
++struct tc_nsswrr_class_qopt {
++	__u32	quantum;	/* Weight associated to this class */
++};
++
++struct tc_nsswrr_qopt {
++	__u8	accel_mode;	/* Dictates which data plane offloads the qdisc */
++};
++
++/* NSSWFQ section */
++
++enum {
++	TCA_NSSWFQ_UNSPEC,
++	TCA_NSSWFQ_CLASS_PARMS,
++	TCA_NSSWFQ_QDISC_PARMS,
++	__TCA_NSSWFQ_MAX
++};
++
++#define TCA_NSSWFQ_MAX	(__TCA_NSSWFQ_MAX - 1)
++
++struct tc_nsswfq_class_qopt {
++	__u32	quantum;	/* Weight associated to this class */
++};
++
++struct tc_nsswfq_qopt {
++	__u8	accel_mode;	/* Dictates which data plane offloads the qdisc */
++};
++
++/* NSSHTB section */
++
++enum {
++	TCA_NSSHTB_UNSPEC,
++	TCA_NSSHTB_CLASS_PARMS,
++	TCA_NSSHTB_QDISC_PARMS,
++	__TCA_NSSHTB_MAX
++};
++
++#define TCA_NSSHTB_MAX	(__TCA_NSSHTB_MAX - 1)
++
++struct tc_nsshtb_class_qopt {
++	__u32	burst;		/* Allowed burst size */
++	__u32	rate;		/* Allowed bandwidth for this class */
++	__u32	cburst;		/* Maximum burst size */
++	__u32	crate;		/* Maximum bandwidth for this class */
++	__u32	quantum;	/* Quantum allocation for DRR */
++	__u32	priority;	/* Priority value associated with this class */
++	__u32	overhead;	/* Overhead in bytes per packet */
++};
++
++struct tc_nsshtb_qopt {
++	__u32	r2q;		/* Rate to quantum ratio */
++	__u8	accel_mode;	/* Dictates which data plane offloads the qdisc */
++};
++
++/* NSSBLACKHOLE section */
++
++enum {
++	TCA_NSSBLACKHOLE_UNSPEC,
++	TCA_NSSBLACKHOLE_PARMS,
++	__TCA_NSSBLACKHOLE_MAX
++};
++
++#define TCA_NSSBLACKHOLE_MAX	(__TCA_NSSBLACKHOLE_MAX - 1)
++
++struct tc_nssblackhole_qopt {
++	__u8	set_default;	/* Sets qdisc to be the default qdisc for enqueue */
++	__u8	accel_mode;	/* Dictates which data plane offloads the qdisc */
++};
++/* QCA NSS Clients Support - End */
+ #endif
+--- a/net/sched/sch_api.c
++++ b/net/sched/sch_api.c
+@@ -314,6 +314,7 @@ struct Qdisc *qdisc_lookup(struct net_de
+ out:
+ 	return q;
+ }
++EXPORT_SYMBOL(qdisc_lookup);
+ 
+ struct Qdisc *qdisc_lookup_rcu(struct net_device *dev, u32 handle)
+ {
+@@ -2389,4 +2390,26 @@ static int __init pktsched_init(void)
+ 	return 0;
+ }
+ 
++/* QCA NSS Qdisc Support - Start */
++bool tcf_destroy(struct tcf_proto *tp, bool force)
++{
++	tp->ops->destroy(tp, force, NULL);
++	module_put(tp->ops->owner);
++	kfree_rcu(tp, rcu);
++
++	return true;
++}
++
++void tcf_destroy_chain(struct tcf_proto __rcu **fl)
++{
++	struct tcf_proto *tp;
++
++	while ((tp = rtnl_dereference(*fl)) != NULL) {
++		RCU_INIT_POINTER(*fl, tp->next);
++		tcf_destroy(tp, true);
++	}
++}
++EXPORT_SYMBOL(tcf_destroy_chain);
++/* QCA NSS Qdisc Support - End */
++
+ subsys_initcall(pktsched_init);
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -1069,6 +1069,7 @@ static void __qdisc_destroy(struct Qdisc
+ 
+ 	call_rcu(&qdisc->rcu, qdisc_free_cb);
+ }
++EXPORT_SYMBOL(qdisc_destroy);
+ 
+ void qdisc_destroy(struct Qdisc *qdisc)
+ {
+--- a/include/net/sch_generic.h
++++ b/include/net/sch_generic.h
+@@ -94,6 +94,7 @@ struct Qdisc {
+ #define TCQ_F_INVISIBLE		0x80 /* invisible by default in dump */
+ #define TCQ_F_NOLOCK		0x100 /* qdisc does not require locking */
+ #define TCQ_F_OFFLOADED		0x200 /* qdisc is offloaded to HW */
++#define TCQ_F_NSS		0x1000 /* NSS qdisc flag. */
+ 	u32			limit;
+ 	const struct Qdisc_ops	*ops;
+ 	struct qdisc_size_table	__rcu *stab;
+@@ -751,6 +752,42 @@ static inline bool skb_skip_tc_classify(
+ 	return false;
+ }
+ 
++/* QCA NSS Qdisc Support - Start */
++/*
++ * Set skb classify bit field.
++ */
++static inline void skb_set_tc_classify_offload(struct sk_buff *skb)
++{
++#ifdef CONFIG_NET_CLS_ACT
++	skb->tc_skip_classify_offload = 1;
++#endif
++}
++
++/*
++ * Clear skb classify bit field.
++ */
++static inline void skb_clear_tc_classify_offload(struct sk_buff *skb)
++{
++#ifdef CONFIG_NET_CLS_ACT
++	skb->tc_skip_classify_offload = 0;
++#endif
++}
++
++/*
++ * Skip skb processing if sent from ifb dev.
++ */
++static inline bool skb_skip_tc_classify_offload(struct sk_buff *skb)
++{
++#ifdef CONFIG_NET_CLS_ACT
++	if (skb->tc_skip_classify_offload) {
++		skb_clear_tc_classify_offload(skb);
++		return true;
++	}
++#endif
++	return false;
++}
++/* QCA NSS Qdisc Support - End */
++
+ /* Reset all TX qdiscs greater than index of a device.  */
+ static inline void qdisc_reset_all_tx_gt(struct net_device *dev, unsigned int i)
+ {
+@@ -1323,4 +1360,9 @@ static inline void qdisc_synchronize(con
+ 		msleep(1);
+ }
+ 
++/* QCA NSS Qdisc Support - Start */
++void qdisc_destroy(struct Qdisc *qdisc);
++void tcf_destroy_chain(struct tcf_proto __rcu **fl);
++/* QCA NSS Qdisc Support - End */
++
+ #endif
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -764,6 +764,7 @@ typedef unsigned char *sk_buff_data_t;
+  *	@offload_fwd_mark: Packet was L2-forwarded in hardware
+  *	@offload_l3_fwd_mark: Packet was L3-forwarded in hardware
+  *	@tc_skip_classify: do not classify packet. set by IFB device
++ *	@tc_skip_classify_offload: do not classify packet set by offload IFB device
+  *	@tc_at_ingress: used within tc_classify to distinguish in/egress
+  *	@redirected: packet was redirected by packet classifier
+  *	@from_ingress: packet was redirected from the ingress path
+@@ -945,6 +946,9 @@ struct sk_buff {
+ 	__u8			tc_at_ingress:1;	/* See TC_AT_INGRESS_MASK */
+ 	__u8			tc_skip_classify:1;
+ #endif
++#ifdef CONFIG_NET_CLS_ACT
++	__u8			tc_skip_classify_offload:1; /* QCA NSS Qdisc Support */
++#endif
+ 	__u8			remcsum_offload:1;
+ 	__u8			csum_complete_sw:1;
+ 	__u8			csum_level:2;
diff --git a/target/linux/qualcommax/patches-6.6/0603-2-qca-nss-clients-add-l2tp-support.patch b/target/linux/qualcommax/patches-6.6/0603-2-qca-nss-clients-add-l2tp-support.patch
new file mode 100644
index 00000000000000..7fa9184df25155
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0603-2-qca-nss-clients-add-l2tp-support.patch
@@ -0,0 +1,46 @@
+--- a/net/l2tp/l2tp_core.c
++++ b/net/l2tp/l2tp_core.c
+@@ -398,6 +398,31 @@ err_tlock:
+ }
+ EXPORT_SYMBOL_GPL(l2tp_session_register);
+ 
++void l2tp_stats_update(struct l2tp_tunnel *tunnel,
++                       struct l2tp_session *session,
++                       struct l2tp_stats *stats)
++{
++        atomic_long_add(atomic_long_read(&stats->rx_packets),
++                        &tunnel->stats.rx_packets);
++        atomic_long_add(atomic_long_read(&stats->rx_bytes),
++                        &tunnel->stats.rx_bytes);
++        atomic_long_add(atomic_long_read(&stats->tx_packets),
++                        &tunnel->stats.tx_packets);
++        atomic_long_add(atomic_long_read(&stats->tx_bytes),
++                        &tunnel->stats.tx_bytes);
++
++        atomic_long_add(atomic_long_read(&stats->rx_packets),
++                        &session->stats.rx_packets);
++        atomic_long_add(atomic_long_read(&stats->rx_bytes),
++                        &session->stats.rx_bytes);
++        atomic_long_add(atomic_long_read(&stats->tx_packets),
++                        &session->stats.tx_packets);
++        atomic_long_add(atomic_long_read(&stats->tx_bytes),
++                        &session->stats.tx_bytes);
++}
++EXPORT_SYMBOL_GPL(l2tp_stats_update);
++
++
+ /*****************************************************************************
+  * Receive data handling
+  *****************************************************************************/
+--- a/net/l2tp/l2tp_core.h
++++ b/net/l2tp/l2tp_core.h
+@@ -232,6 +232,9 @@ struct l2tp_session *l2tp_session_get_nt
+ struct l2tp_session *l2tp_session_get_by_ifname(const struct net *net,
+ 						const char *ifname);
+ 
++void l2tp_stats_update(struct l2tp_tunnel *tunnel, struct l2tp_session *session,
++                       struct l2tp_stats *stats);
++
+ /* Tunnel and session lifetime management.
+  * Creation of a new instance is a two-step process: create, then register.
+  * Destruction is triggered using the *_delete functions, and completes asynchronously.
diff --git a/target/linux/qualcommax/patches-6.6/0603-3-qca-nss-clients-add-PPTP-support.patch b/target/linux/qualcommax/patches-6.6/0603-3-qca-nss-clients-add-PPTP-support.patch
new file mode 100644
index 00000000000000..5fb9917bc9067e
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0603-3-qca-nss-clients-add-PPTP-support.patch
@@ -0,0 +1,478 @@
+--- a/include/linux/if_pppox.h
++++ b/include/linux/if_pppox.h
+@@ -36,6 +36,7 @@ struct pptp_opt {
+ 	u32 ack_sent, ack_recv;
+ 	u32 seq_sent, seq_recv;
+ 	int ppp_flags;
++	bool pptp_offload_mode;
+ };
+ #include <net/sock.h>
+ 
+@@ -100,8 +101,40 @@ struct pppoe_channel_ops {
+ 	int (*get_addressing)(struct ppp_channel *, struct pppoe_opt *);
+ };
+ 
++/* PPTP client callback */
++typedef int (*pptp_gre_seq_offload_callback_t)(struct sk_buff *skb,
++					       struct net_device *pptp_dev);
++
+ /* Return PPPoE channel specific addressing information */
+ extern int pppoe_channel_addressing_get(struct ppp_channel *chan,
+ 					 struct pppoe_opt *addressing);
+ 
++/* Lookup PPTP session info and return PPTP session using sip, dip and local call id */
++extern int pptp_session_find_by_src_callid(struct pptp_opt *opt, __be16 src_call_id,
++			 __be32 daddr, __be32 saddr);
++
++/* Lookup PPTP session info and return PPTP session using dip and peer call id */
++extern int pptp_session_find(struct pptp_opt *opt, __be16 peer_call_id,
++			     __be32 peer_ip_addr);
++
++/* Return PPTP session information given the channel */
++extern void pptp_channel_addressing_get(struct pptp_opt *opt,
++					struct ppp_channel *chan);
++
++/* Enable the PPTP session offload flag */
++extern int pptp_session_enable_offload_mode(__be16 peer_call_id,
++					    __be32 peer_ip_addr);
++
++/* Disable the PPTP session offload flag */
++extern int pptp_session_disable_offload_mode(__be16 peer_call_id,
++					     __be32 peer_ip_addr);
++
++/* Register the PPTP GRE packets sequence number offload callback */
++extern int
++pptp_register_gre_seq_offload_callback(pptp_gre_seq_offload_callback_t
++				       pptp_client_cb);
++
++/* Unregister the PPTP GRE packets sequence number offload callback */
++extern void pptp_unregister_gre_seq_offload_callback(void);
++
+ #endif /* !(__LINUX_IF_PPPOX_H) */
+--- a/drivers/net/ppp/ppp_generic.c
++++ b/drivers/net/ppp/ppp_generic.c
+@@ -2973,6 +2973,20 @@ char *ppp_dev_name(struct ppp_channel *c
+ 	return name;
+ }
+ 
++/* Return the PPP net device index */
++int ppp_dev_index(struct ppp_channel *chan)
++{
++	struct channel *pch = chan->ppp;
++	int ifindex = 0;
++
++	if (pch) {
++		read_lock_bh(&pch->upl);
++		if (pch->ppp && pch->ppp->dev)
++			ifindex = pch->ppp->dev->ifindex;
++		read_unlock_bh(&pch->upl);
++	}
++	return ifindex;
++}
+ 
+ /*
+  * Disconnect a channel from the generic layer.
+@@ -3681,6 +3695,28 @@ void ppp_update_stats(struct net_device
+ 	ppp_recv_unlock(ppp);
+ }
+ 
++/* Returns true if Compression is enabled on PPP device
++ */
++bool ppp_is_cp_enabled(struct net_device *dev)
++{
++	struct ppp *ppp;
++	bool flag = false;
++
++	if (!dev)
++		return false;
++
++	if (dev->type != ARPHRD_PPP)
++		return false;
++
++	ppp = netdev_priv(dev);
++	ppp_lock(ppp);
++	flag = !!(ppp->xstate & SC_COMP_RUN) || !!(ppp->rstate & SC_DECOMP_RUN);
++	ppp_unlock(ppp);
++
++	return flag;
++}
++EXPORT_SYMBOL(ppp_is_cp_enabled);
++
+ /* Returns >0 if the device is a multilink PPP netdevice, 0 if not or < 0 if
+  * the device is not PPP.
+  */
+@@ -3872,6 +3908,7 @@ EXPORT_SYMBOL(ppp_unregister_channel);
+ EXPORT_SYMBOL(ppp_channel_index);
+ EXPORT_SYMBOL(ppp_unit_number);
+ EXPORT_SYMBOL(ppp_dev_name);
++EXPORT_SYMBOL(ppp_dev_index);
+ EXPORT_SYMBOL(ppp_input);
+ EXPORT_SYMBOL(ppp_input_error);
+ EXPORT_SYMBOL(ppp_output_wakeup);
+--- a/include/linux/ppp_channel.h
++++ b/include/linux/ppp_channel.h
+@@ -84,6 +84,9 @@ extern void ppp_unregister_channel(struc
+ /* Get the channel number for a channel */
+ extern int ppp_channel_index(struct ppp_channel *);
+ 
++/* Get the device index  associated with a channel, or 0, if none */
++extern int ppp_dev_index(struct ppp_channel *);
++
+ /* Get the unit number associated with a channel, or -1 if none */
+ extern int ppp_unit_number(struct ppp_channel *);
+ 
+@@ -116,6 +119,7 @@ extern int ppp_hold_channels(struct net_
+ /* Test if ppp xmit lock is locked */
+ extern bool ppp_is_xmit_locked(struct net_device *dev);
+ 
++bool ppp_is_cp_enabled(struct net_device *dev);
+ /* Test if the ppp device is a multi-link ppp device */
+ extern int ppp_is_multilink(struct net_device *dev);
+ 
+--- a/drivers/net/ppp/pptp.c
++++ b/drivers/net/ppp/pptp.c
+@@ -50,6 +50,8 @@ static struct proto pptp_sk_proto __read
+ static const struct ppp_channel_ops pptp_chan_ops;
+ static const struct proto_ops pptp_ops;
+ 
++static pptp_gre_seq_offload_callback_t __rcu pptp_gre_offload_xmit_cb;
++
+ static struct pppox_sock *lookup_chan(u16 call_id, __be32 s_addr)
+ {
+ 	struct pppox_sock *sock;
+@@ -91,6 +93,79 @@ static int lookup_chan_dst(u16 call_id,
+ 	return i < MAX_CALLID;
+ }
+ 
++/* Search a pptp session based on local call id, local and remote ip address */
++static int lookup_session_src(struct pptp_opt *opt, u16 call_id, __be32 daddr, __be32 saddr)
++{
++	struct pppox_sock *sock;
++	int i = 1;
++
++	rcu_read_lock();
++	for_each_set_bit_from(i, callid_bitmap, MAX_CALLID) {
++		sock = rcu_dereference(callid_sock[i]);
++		if (!sock)
++			continue;
++
++		if (sock->proto.pptp.src_addr.call_id == call_id &&
++		    sock->proto.pptp.dst_addr.sin_addr.s_addr == daddr &&
++		    sock->proto.pptp.src_addr.sin_addr.s_addr == saddr) {
++			sock_hold(sk_pppox(sock));
++			memcpy(opt, &sock->proto.pptp, sizeof(struct pptp_opt));
++			sock_put(sk_pppox(sock));
++			rcu_read_unlock();
++			return 0;
++		}
++	}
++	rcu_read_unlock();
++	return -EINVAL;
++}
++
++/* Search a pptp session based on peer call id and peer ip address */
++static int lookup_session_dst(struct pptp_opt *opt, u16 call_id, __be32 d_addr)
++{
++	struct pppox_sock *sock;
++	int i = 1;
++
++	rcu_read_lock();
++	for_each_set_bit_from(i, callid_bitmap, MAX_CALLID) {
++		sock = rcu_dereference(callid_sock[i]);
++		if (!sock)
++			continue;
++
++		if (sock->proto.pptp.dst_addr.call_id == call_id &&
++		    sock->proto.pptp.dst_addr.sin_addr.s_addr == d_addr) {
++			sock_hold(sk_pppox(sock));
++			memcpy(opt, &sock->proto.pptp, sizeof(struct pptp_opt));
++			sock_put(sk_pppox(sock));
++			rcu_read_unlock();
++			return 0;
++		}
++	}
++	rcu_read_unlock();
++	return -EINVAL;
++}
++
++/* If offload mode set then this function sends all packets to
++ * offload module instead of network stack
++ */
++static int pptp_client_skb_xmit(struct sk_buff *skb,
++				struct net_device *pptp_dev)
++{
++	pptp_gre_seq_offload_callback_t pptp_gre_offload_cb_f;
++	int ret;
++
++	rcu_read_lock();
++	pptp_gre_offload_cb_f = rcu_dereference(pptp_gre_offload_xmit_cb);
++
++	if (!pptp_gre_offload_cb_f) {
++		rcu_read_unlock();
++		return -1;
++	}
++
++	ret = pptp_gre_offload_cb_f(skb, pptp_dev);
++	rcu_read_unlock();
++	return ret;
++}
++
+ static int add_chan(struct pppox_sock *sock,
+ 		    struct pptp_addr *sa)
+ {
+@@ -136,7 +211,7 @@ static struct rtable *pptp_route_output(
+ 	struct net *net;
+ 
+ 	net = sock_net(sk);
+-	flowi4_init_output(fl4, sk->sk_bound_dev_if, sk->sk_mark, 0,
++	flowi4_init_output(fl4, 0, sk->sk_mark, 0,
+ 			   RT_SCOPE_UNIVERSE, IPPROTO_GRE, 0,
+ 			   po->proto.pptp.dst_addr.sin_addr.s_addr,
+ 			   po->proto.pptp.src_addr.sin_addr.s_addr,
+@@ -163,8 +238,11 @@ static int pptp_xmit(struct ppp_channel
+ 
+ 	struct rtable *rt;
+ 	struct net_device *tdev;
++	struct net_device *pptp_dev;
+ 	struct iphdr  *iph;
+ 	int    max_headroom;
++	int    pptp_ifindex;
++	int    ret;
+ 
+ 	if (sk_pppox(po)->sk_state & PPPOX_DEAD)
+ 		goto tx_error;
+@@ -258,7 +336,32 @@ static int pptp_xmit(struct ppp_channel
+ 	ip_select_ident(net, skb, NULL);
+ 	ip_send_check(iph);
+ 
+-	ip_local_out(net, skb->sk, skb);
++	pptp_ifindex = ppp_dev_index(chan);
++
++	/* set incoming interface as the ppp interface */
++	if (skb->skb_iif)
++		skb->skb_iif = pptp_ifindex;
++
++	/* If the PPTP GRE seq number offload module is not enabled yet
++	 * then sends all PPTP GRE packets through linux network stack
++	 */
++	if (!opt->pptp_offload_mode) {
++		ip_local_out(net, skb->sk, skb);
++		return 1;
++	}
++
++	pptp_dev = dev_get_by_index(&init_net, pptp_ifindex);
++	if (!pptp_dev)
++		goto tx_error;
++
++	 /* If PPTP offload module is enabled then forward all PPTP GRE
++	  * packets to PPTP GRE offload module
++	  */
++	ret = pptp_client_skb_xmit(skb, pptp_dev);
++	dev_put(pptp_dev);
++	if (ret < 0)
++		goto tx_error;
++
+ 	return 1;
+ 
+ tx_error:
+@@ -314,6 +417,13 @@ static int pptp_rcv_core(struct sock *sk
+ 		goto drop;
+ 
+ 	payload = skb->data + headersize;
++
++	 /* If offload is enabled, we expect the offload module
++	  * to handle PPTP GRE sequence number checks
++	  */
++	if (opt->pptp_offload_mode)
++		goto allow_packet;
++
+ 	/* check for expected sequence number */
+ 	if (seq < opt->seq_recv + 1 || WRAPPED(opt->seq_recv, seq)) {
+ 		if ((payload[0] == PPP_ALLSTATIONS) && (payload[1] == PPP_UI) &&
+@@ -371,6 +481,7 @@ static int pptp_rcv(struct sk_buff *skb)
+ 	if (po) {
+ 		skb_dst_drop(skb);
+ 		nf_reset_ct(skb);
++		skb->skb_iif = ppp_dev_index(&po->chan);
+ 		return sk_receive_skb(sk_pppox(po), skb, 0);
+ 	}
+ drop:
+@@ -473,7 +584,7 @@ static int pptp_connect(struct socket *s
+ 
+ 	opt->dst_addr = sp->sa_addr.pptp;
+ 	sk->sk_state |= PPPOX_CONNECTED;
+-
++	opt->pptp_offload_mode = false;
+  end:
+ 	release_sock(sk);
+ 	return error;
+@@ -603,9 +714,169 @@ static int pptp_ppp_ioctl(struct ppp_cha
+ 	return err;
+ }
+ 
++/* pptp_channel_addressing_get()
++ *	Return PPTP channel specific addressing information.
++ */
++void pptp_channel_addressing_get(struct pptp_opt *opt, struct ppp_channel *chan)
++{
++	struct sock *sk;
++	struct pppox_sock *po;
++
++	if (!opt)
++		return;
++
++	sk = (struct sock *)chan->private;
++	if (!sk)
++		return;
++
++	sock_hold(sk);
++
++	/* This is very unlikely, but check the socket is connected state */
++	if (unlikely(sock_flag(sk, SOCK_DEAD) ||
++		     !(sk->sk_state & PPPOX_CONNECTED))) {
++		sock_put(sk);
++		return;
++	}
++
++	po = pppox_sk(sk);
++	memcpy(opt, &po->proto.pptp, sizeof(struct pptp_opt));
++	sock_put(sk);
++}
++EXPORT_SYMBOL(pptp_channel_addressing_get);
++
++/* pptp_session_find()
++ *	Search and return a PPTP session info based on peer callid and IP
++ *	address. The function accepts the parameters in network byte order.
++ */
++int pptp_session_find(struct pptp_opt *opt, __be16 peer_call_id,
++		      __be32 peer_ip_addr)
++{
++	if (!opt)
++		return -EINVAL;
++
++	return lookup_session_dst(opt, ntohs(peer_call_id), peer_ip_addr);
++}
++EXPORT_SYMBOL(pptp_session_find);
++
++/* pptp_session_find_by_src_callid()
++ *	Search and return a PPTP session info based on src callid and IP
++ *	address. The function accepts the parameters in network byte order.
++ */
++int pptp_session_find_by_src_callid(struct pptp_opt *opt, __be16 src_call_id,
++		      __be32 daddr, __be32 saddr)
++{
++	if (!opt)
++		return -EINVAL;
++
++	return lookup_session_src(opt, ntohs(src_call_id), daddr, saddr);
++}
++EXPORT_SYMBOL(pptp_session_find_by_src_callid);
++
++ /* Function to change the offload mode true/false for a PPTP session */
++static int pptp_set_offload_mode(bool accel_mode,
++				 __be16 peer_call_id, __be32 peer_ip_addr)
++{
++	struct pppox_sock *sock;
++	int i = 1;
++
++	rcu_read_lock();
++	for_each_set_bit_from(i, callid_bitmap, MAX_CALLID) {
++		sock = rcu_dereference(callid_sock[i]);
++		if (!sock)
++			continue;
++
++		if (sock->proto.pptp.dst_addr.call_id == peer_call_id &&
++		    sock->proto.pptp.dst_addr.sin_addr.s_addr == peer_ip_addr) {
++			sock_hold(sk_pppox(sock));
++			sock->proto.pptp.pptp_offload_mode = accel_mode;
++			sock_put(sk_pppox(sock));
++			rcu_read_unlock();
++			return 0;
++		}
++	}
++	rcu_read_unlock();
++	return -EINVAL;
++}
++
++/* Enable the PPTP session offload flag */
++int pptp_session_enable_offload_mode(__be16 peer_call_id, __be32 peer_ip_addr)
++{
++	return pptp_set_offload_mode(true, peer_call_id, peer_ip_addr);
++}
++EXPORT_SYMBOL(pptp_session_enable_offload_mode);
++
++/* Disable the PPTP session offload flag */
++int pptp_session_disable_offload_mode(__be16 peer_call_id, __be32 peer_ip_addr)
++{
++	return pptp_set_offload_mode(false, peer_call_id, peer_ip_addr);
++}
++EXPORT_SYMBOL(pptp_session_disable_offload_mode);
++
++/* Register the offload callback function on behalf of the module which
++ * will own the sequence and acknowledgment number updates for all
++ * PPTP GRE packets. All PPTP GRE packets are then transmitted to this
++ * module after encapsulation in order to ensure the correct seq/ack
++ * fields are set in the packets before transmission. This is required
++ * when PPTP flows are offloaded to acceleration engines, in-order to
++ * ensure consistency in sequence and ack numbers between PPTP control
++ * (PPP LCP) and data packets
++ */
++int pptp_register_gre_seq_offload_callback(pptp_gre_seq_offload_callback_t
++					   pptp_gre_offload_cb)
++{
++	pptp_gre_seq_offload_callback_t pptp_gre_offload_cb_f;
++
++	rcu_read_lock();
++	pptp_gre_offload_cb_f = rcu_dereference(pptp_gre_offload_xmit_cb);
++
++	if (pptp_gre_offload_cb_f) {
++		rcu_read_unlock();
++		return -1;
++	}
++
++	rcu_assign_pointer(pptp_gre_offload_xmit_cb, pptp_gre_offload_cb);
++	rcu_read_unlock();
++	return 0;
++}
++EXPORT_SYMBOL(pptp_register_gre_seq_offload_callback);
++
++/* Unregister the PPTP GRE packets sequence number offload callback */
++void pptp_unregister_gre_seq_offload_callback(void)
++{
++	rcu_assign_pointer(pptp_gre_offload_xmit_cb, NULL);
++}
++EXPORT_SYMBOL(pptp_unregister_gre_seq_offload_callback);
++
++/* pptp_hold_chan() */
++static void pptp_hold_chan(struct ppp_channel *chan)
++{
++	struct sock *sk = (struct sock *)chan->private;
++
++	sock_hold(sk);
++}
++
++/* pptp_release_chan() */
++static void pptp_release_chan(struct ppp_channel *chan)
++{
++	struct sock *sk = (struct sock *)chan->private;
++
++	sock_put(sk);
++}
++
++/* pptp_get_channel_protocol()
++ *     Return the protocol type of the PPTP over PPP protocol
++ */
++static int pptp_get_channel_protocol(struct ppp_channel *chan)
++{
++	return PX_PROTO_PPTP;
++}
++
+ static const struct ppp_channel_ops pptp_chan_ops = {
+ 	.start_xmit = pptp_xmit,
+ 	.ioctl      = pptp_ppp_ioctl,
++	.get_channel_protocol = pptp_get_channel_protocol,
++	.hold = pptp_hold_chan,
++	.release = pptp_release_chan,
+ };
+ 
+ static struct proto pptp_sk_proto __read_mostly = {
diff --git a/target/linux/qualcommax/patches-6.6/0603-4-qca-nss-clients-add-iptunnel-support.patch b/target/linux/qualcommax/patches-6.6/0603-4-qca-nss-clients-add-iptunnel-support.patch
new file mode 100644
index 00000000000000..c9fc33686480ec
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0603-4-qca-nss-clients-add-iptunnel-support.patch
@@ -0,0 +1,77 @@
+--- a/include/net/ip6_tunnel.h
++++ b/include/net/ip6_tunnel.h
+@@ -36,6 +36,7 @@ struct __ip6_tnl_parm {
+ 	__u8 proto;		/* tunnel protocol */
+ 	__u8 encap_limit;	/* encapsulation limit for tunnel */
+ 	__u8 hop_limit;		/* hop limit for tunnel */
++	__u8 draft03;		/* FMR using draft03 of map-e - QCA NSS Clients Support */
+ 	bool collect_md;
+ 	__be32 flowinfo;	/* traffic class and flowlabel for tunnel */
+ 	__u32 flags;		/* tunnel flags */
+--- a/include/net/ip_tunnels.h
++++ b/include/net/ip_tunnels.h
+@@ -558,4 +558,9 @@ static inline void ip_tunnel_info_opts_s
+ 
+ #endif /* CONFIG_INET */
+ 
++/* QCA NSS Clients Support - Start */
++void ipip6_update_offload_stats(struct net_device *dev, void *ptr);
++void ip6_update_offload_stats(struct net_device *dev, void *ptr);
++/* QCA NSS Clients Support - End */
++
+ #endif /* __NET_IP_TUNNELS_H */
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -2411,6 +2411,26 @@ nla_put_failure:
+ 	return -EMSGSIZE;
+ }
+ 
++/* QCA NSS Client Support - Start */
++/*
++ * Update offload stats
++ */
++void ip6_update_offload_stats(struct net_device *dev, void *ptr)
++{
++	struct pcpu_sw_netstats *tstats = per_cpu_ptr(dev->tstats, 0);
++	const struct pcpu_sw_netstats *offload_stats =
++					(struct pcpu_sw_netstats *)ptr;
++
++	u64_stats_update_begin(&tstats->syncp);
++	u64_stats_add(&tstats->tx_packets, u64_stats_read(&offload_stats->tx_packets));
++	u64_stats_add(&tstats->tx_bytes, u64_stats_read(&offload_stats->tx_bytes));
++	u64_stats_add(&tstats->rx_packets, u64_stats_read(&offload_stats->rx_packets));
++	u64_stats_add(&tstats->rx_bytes, u64_stats_read(&offload_stats->rx_bytes));
++	u64_stats_update_end(&tstats->syncp);
++}
++EXPORT_SYMBOL(ip6_update_offload_stats);
++/* QCA NSS Client Support - End */
++
+ struct net *ip6_tnl_get_link_net(const struct net_device *dev)
+ {
+ 	struct ip6_tnl *tunnel = netdev_priv(dev);
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -1733,6 +1733,23 @@ nla_put_failure:
+ 	return -EMSGSIZE;
+ }
+ 
++/* QCA NSS Clients Support - Start */
++void ipip6_update_offload_stats(struct net_device *dev, void *ptr)
++{
++	struct pcpu_sw_netstats *tstats = per_cpu_ptr(dev->tstats, 0);
++	const struct pcpu_sw_netstats *offload_stats =
++					(struct pcpu_sw_netstats *)ptr;
++
++	u64_stats_update_begin(&tstats->syncp);
++	u64_stats_add(&tstats->tx_packets, u64_stats_read(&offload_stats->tx_packets));
++	u64_stats_add(&tstats->tx_bytes, u64_stats_read(&offload_stats->tx_bytes));
++	u64_stats_add(&tstats->rx_packets, u64_stats_read(&offload_stats->rx_packets));
++	u64_stats_add(&tstats->rx_bytes, u64_stats_read(&offload_stats->rx_bytes));
++	u64_stats_update_end(&tstats->syncp);
++}
++EXPORT_SYMBOL(ipip6_update_offload_stats);
++/* QCA NSS Clients Support - End */
++
+ static const struct nla_policy ipip6_policy[IFLA_IPTUN_MAX + 1] = {
+ 	[IFLA_IPTUN_LINK]		= { .type = NLA_U32 },
+ 	[IFLA_IPTUN_LOCAL]		= { .type = NLA_U32 },
diff --git a/target/linux/qualcommax/patches-6.6/0603-5-qca-nss-clients-add-vxlan-support.patch b/target/linux/qualcommax/patches-6.6/0603-5-qca-nss-clients-add-vxlan-support.patch
new file mode 100644
index 00000000000000..7d05fd1aff619c
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0603-5-qca-nss-clients-add-vxlan-support.patch
@@ -0,0 +1,103 @@
+--- a/drivers/net/vxlan/vxlan_core.c
++++ b/drivers/net/vxlan/vxlan_core.c
+@@ -29,6 +29,20 @@
+ #include <net/vxlan.h>
+ #include <net/nexthop.h>
+ 
++ATOMIC_NOTIFIER_HEAD(vxlan_fdb_notifier_list);
++
++void vxlan_fdb_register_notify(struct notifier_block *nb)
++{
++	atomic_notifier_chain_register(&vxlan_fdb_notifier_list, nb);
++}
++EXPORT_SYMBOL(vxlan_fdb_register_notify);
++
++void vxlan_fdb_unregister_notify(struct notifier_block *nb)
++{
++	atomic_notifier_chain_unregister(&vxlan_fdb_notifier_list, nb);
++}
++EXPORT_SYMBOL(vxlan_fdb_unregister_notify);
++
+ #if IS_ENABLED(CONFIG_IPV6)
+ #include <net/ip6_tunnel.h>
+ #include <net/ip6_checksum.h>
+@@ -260,6 +274,7 @@ static void __vxlan_fdb_notify(struct vx
+ {
+ 	struct net *net = dev_net(vxlan->dev);
+ 	struct sk_buff *skb;
++   struct vxlan_fdb_event vfe;
+ 	int err = -ENOBUFS;
+ 
+ 	skb = nlmsg_new(vxlan_nlmsg_size(), GFP_ATOMIC);
+@@ -275,6 +290,10 @@ static void __vxlan_fdb_notify(struct vx
+ 	}
+ 
+ 	rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
++	vfe.dev = vxlan->dev;
++	vfe.rdst = rd;
++	ether_addr_copy(vfe.eth_addr, fdb->eth_addr);
++	atomic_notifier_call_chain(&vxlan_fdb_notifier_list, type, (void *)&vfe);
+ 	return;
+ errout:
+ 	if (err < 0)
+@@ -441,6 +460,18 @@ static struct vxlan_fdb *vxlan_find_mac(
+ 	return f;
+ }
+ 
++/* Find and update age of fdb entry corresponding to MAC. */
++void vxlan_fdb_update_mac(struct vxlan_dev *vxlan, const u8 *mac, uint32_t vni)
++{
++	u32 hash_index;
++
++	hash_index = fdb_head_index(vxlan, mac, vni);
++	spin_lock_bh(&vxlan->hash_lock[hash_index]);
++	vxlan_find_mac(vxlan, mac, vni);
++	spin_unlock_bh(&vxlan->hash_lock[hash_index]);
++}
++EXPORT_SYMBOL(vxlan_fdb_update_mac);
++
+ /* caller should hold vxlan->hash_lock */
+ static struct vxlan_rdst *vxlan_fdb_find_rdst(struct vxlan_fdb *f,
+ 					      union vxlan_addr *ip, __be16 port,
+@@ -2581,6 +2612,9 @@ void vxlan_xmit_one(struct sk_buff *skb,
+ 			goto out_unlock;
+ 		}
+ 
++		/* Reset the skb_iif to Tunnels interface index */
++		skb->skb_iif = dev->ifindex;
++
+ 		tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
+ 		ttl = ttl ? : ip4_dst_hoplimit(&rt->dst);
+ 		err = vxlan_build_skb(skb, ndst, sizeof(struct iphdr),
+@@ -2652,6 +2686,9 @@ void vxlan_xmit_one(struct sk_buff *skb,
+ 		if (err < 0)
+ 			goto tx_error;
+ 
++		/* Reset the skb_iif to Tunnels interface index */
++		skb->skb_iif = dev->ifindex;
++
+ 		udp_tunnel6_xmit_skb(ndst, sock6->sock->sk, skb, dev,
+ 				     &local_ip.sin6.sin6_addr,
+ 				     &dst->sin6.sin6_addr, tos, ttl,
+--- a/include/net/vxlan.h
++++ b/include/net/vxlan.h
+@@ -352,6 +352,19 @@ struct vxlan_dev {
+ 					 VXLAN_F_VNIFILTER         |    \
+ 					 VXLAN_F_LOCALBYPASS)
+ 
++/*
++ * Application data for fdb notifier event
++ */
++struct vxlan_fdb_event {
++	struct net_device *dev;
++	struct vxlan_rdst *rdst;
++	u8 eth_addr[ETH_ALEN];
++};
++
++extern void vxlan_fdb_register_notify(struct notifier_block *nb);
++extern void vxlan_fdb_unregister_notify(struct notifier_block *nb);
++extern void vxlan_fdb_update_mac(struct vxlan_dev *vxlan, const u8 *mac, uint32_t vni);
++
+ struct net_device *vxlan_dev_create(struct net *net, const char *name,
+ 				    u8 name_assign_type, struct vxlan_config *conf);
+ 
diff --git a/target/linux/qualcommax/patches-6.6/0603-6-qca-nss-clients-add-l2tp-offloading-support.patch b/target/linux/qualcommax/patches-6.6/0603-6-qca-nss-clients-add-l2tp-offloading-support.patch
new file mode 100644
index 00000000000000..4032eb3c227134
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0603-6-qca-nss-clients-add-l2tp-offloading-support.patch
@@ -0,0 +1,368 @@
+--- a/include/linux/ppp_channel.h
++++ b/include/linux/ppp_channel.h
+@@ -61,6 +61,51 @@ struct ppp_channel {
+ };
+ 
+ #ifdef __KERNEL__
++/* Call this to obtain the underlying protocol of the PPP channel,
++ * e.g. PX_PROTO_OE
++ */
++extern int ppp_channel_get_protocol(struct ppp_channel *);
++
++/* Call this to hold a channel */
++extern bool ppp_channel_hold(struct ppp_channel *);
++
++/* Call this to release a hold you have upon a channel */
++extern void ppp_channel_release(struct ppp_channel *);
++
++/* Release hold on PPP channels */
++extern void ppp_release_channels(struct ppp_channel *channels[],
++                                 unsigned int chan_sz);
++
++/* Test if ppp xmit lock is locked */
++extern bool ppp_is_xmit_locked(struct net_device *dev);
++
++/* Call this get protocol version */
++extern int ppp_channel_get_proto_version(struct ppp_channel *);
++
++/* Get the device index  associated with a channel, or 0, if none */
++extern int ppp_dev_index(struct ppp_channel *);
++
++/* Hold PPP channels for the PPP device */
++extern int ppp_hold_channels(struct net_device *dev,
++                             struct ppp_channel *channels[],
++                             unsigned int chan_sz);
++extern int __ppp_hold_channels(struct net_device *dev,
++ 				struct ppp_channel *channels[],
++ 				unsigned int chan_sz);
++
++/* Test if the ppp device is a multi-link ppp device */
++extern int ppp_is_multilink(struct net_device *dev);
++extern int __ppp_is_multilink(struct net_device *dev);
++
++/* Update statistics of the PPP net_device by incrementing related
++ * statistics field value with corresponding parameter
++ */
++extern void ppp_update_stats(struct net_device *dev, unsigned long rx_packets,
++                             unsigned long rx_bytes, unsigned long tx_packets,
++                             unsigned long tx_bytes, unsigned long rx_errors,
++                             unsigned long tx_errors, unsigned long rx_dropped,
++                             unsigned long tx_dropped);
++
+ /* Called by the channel when it can send some more data. */
+ extern void ppp_output_wakeup(struct ppp_channel *);
+ 
+@@ -148,5 +193,17 @@ extern void ppp_update_stats(struct net_
+  * that ppp_unregister_channel returns.
+  */
+ 
++/* QCA NSS Clients Support - Start */
++/* PPP channel connection event types */
++#define PPP_CHANNEL_DISCONNECT  0
++#define PPP_CHANNEL_CONNECT     1
++
++/* Register the PPP channel connect notifier */
++extern void ppp_channel_connection_register_notify(struct notifier_block *nb);
++
++/* Unregister the PPP channel connect notifier */
++extern void ppp_channel_connection_unregister_notify(struct notifier_block *nb);
++/* QCA NSS Clients Support - End */
++
+ #endif /* __KERNEL__ */
+ #endif
+--- a/include/linux/if_pppol2tp.h
++++ b/include/linux/if_pppol2tp.h
+@@ -12,4 +12,30 @@
+ #include <linux/in6.h>
+ #include <uapi/linux/if_pppol2tp.h>
+ 
++/* QCA NSS ECM support - Start */
++/*
++ * Holds L2TP channel info
++ */
++struct  pppol2tp_common_addr {
++	int tunnel_version;				/* v2 or v3 */
++	__u32 local_tunnel_id, remote_tunnel_id;	/* tunnel id */
++	__u32 local_session_id, remote_session_id;	/* session id */
++	struct sockaddr_in local_addr, remote_addr; /* ip address and port */
++};
++
++/*
++ * L2TP channel operations
++ */
++struct pppol2tp_channel_ops {
++	struct ppp_channel_ops ops; /* ppp channel ops */
++};
++
++/*
++ * exported function which calls pppol2tp channel's get addressing
++ * function
++ */
++extern int pppol2tp_channel_addressing_get(struct ppp_channel *,
++					   struct pppol2tp_common_addr *);
++/* QCA NSS ECM support - End */
++
+ #endif
+--- a/net/l2tp/l2tp_ppp.c
++++ b/net/l2tp/l2tp_ppp.c
+@@ -123,9 +123,17 @@ struct pppol2tp_session {
+ };
+ 
+ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb);
+-
+-static const struct ppp_channel_ops pppol2tp_chan_ops = {
+-	.start_xmit =  pppol2tp_xmit,
++static int pppol2tp_get_channel_protocol(struct ppp_channel *);
++static int pppol2tp_get_channel_protocol_ver(struct ppp_channel *);
++static void pppol2tp_hold_chan(struct ppp_channel *);
++static void pppol2tp_release_chan(struct ppp_channel *);
++
++static const struct pppol2tp_channel_ops pppol2tp_chan_ops = {
++	.ops.start_xmit =  pppol2tp_xmit,
++	.ops.get_channel_protocol = pppol2tp_get_channel_protocol,
++	.ops.get_channel_protocol_ver = pppol2tp_get_channel_protocol_ver,
++	.ops.hold = pppol2tp_hold_chan,
++	.ops.release = pppol2tp_release_chan,
+ };
+ 
+ static const struct proto_ops pppol2tp_ops;
+@@ -373,6 +381,13 @@ static int pppol2tp_xmit(struct ppp_chan
+ 	skb->data[0] = PPP_ALLSTATIONS;
+ 	skb->data[1] = PPP_UI;
+ 
++	/* QCA NSS ECM support - start */
++	/* set incoming interface as the ppp interface */
++	if ((skb->protocol == htons(ETH_P_IP)) ||
++	    (skb->protocol == htons(ETH_P_IPV6)))
++		skb->skb_iif = ppp_dev_index(chan);
++	/* QCA NSS ECM support - End */
++
+ 	local_bh_disable();
+ 	l2tp_xmit_skb(session, skb);
+ 	local_bh_enable();
+@@ -818,7 +833,7 @@ static int pppol2tp_connect(struct socke
+ 	po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
+ 
+ 	po->chan.private = sk;
+-	po->chan.ops	 = &pppol2tp_chan_ops;
++	po->chan.ops	 = (struct ppp_channel_ops *)&pppol2tp_chan_ops.ops;
+ 	po->chan.mtu	 = pppol2tp_tunnel_mtu(tunnel);
+ 
+ 	error = ppp_register_net_channel(sock_net(sk), &po->chan);
+@@ -1732,6 +1747,109 @@ static void __exit pppol2tp_exit(void)
+ 	unregister_pernet_device(&pppol2tp_net_ops);
+ }
+ 
++/* QCA NSS ECM support - Start */
++/* pppol2tp_hold_chan() */
++static void pppol2tp_hold_chan(struct ppp_channel *chan)
++{
++	struct sock *sk = (struct sock *)chan->private;
++
++	sock_hold(sk);
++}
++
++/* pppol2tp_release_chan() */
++static void pppol2tp_release_chan(struct ppp_channel *chan)
++{
++	struct sock *sk = (struct sock *)chan->private;
++
++	sock_put(sk);
++}
++
++/* pppol2tp_get_channel_protocol()
++ * Return the protocol type of the L2TP over PPP protocol
++ */
++static int pppol2tp_get_channel_protocol(struct ppp_channel *chan)
++{
++	return PX_PROTO_OL2TP;
++}
++
++/* pppol2tp_get_channel_protocol_ver()
++ * Return the protocol version of the L2TP over PPP protocol
++ */
++static int pppol2tp_get_channel_protocol_ver(struct ppp_channel *chan)
++{
++	struct sock *sk;
++	struct l2tp_session *session;
++	struct l2tp_tunnel *tunnel;
++	int version = 0;
++
++	if (chan && chan->private)
++		sk = (struct sock *)chan->private;
++	else
++		return -1;
++
++	/* Get session and tunnel contexts from the socket */
++	session = pppol2tp_sock_to_session(sk);
++	if (!session)
++		return -1;
++
++	tunnel = session->tunnel;
++	if (!tunnel) {
++		sock_put(sk);
++		return -1;
++	}
++
++	version = tunnel->version;
++
++	sock_put(sk);
++
++	return version;
++}
++
++/* pppol2tp_get_addressing() */
++static int pppol2tp_get_addressing(struct ppp_channel *chan,
++				   struct pppol2tp_common_addr *addr)
++{
++	struct sock *sk = (struct sock *)chan->private;
++	struct l2tp_session *session;
++	struct l2tp_tunnel *tunnel;
++	struct inet_sock *isk = NULL;
++	int err = -ENXIO;
++
++	/* Get session and tunnel contexts from the socket */
++	session = pppol2tp_sock_to_session(sk);
++	if (!session)
++		return err;
++
++	tunnel = session->tunnel;
++	if (!tunnel) {
++		sock_put(sk);
++		return err;
++	}
++	isk = inet_sk(tunnel->sock);
++
++	addr->local_tunnel_id = tunnel->tunnel_id;
++	addr->remote_tunnel_id = tunnel->peer_tunnel_id;
++	addr->local_session_id = session->session_id;
++	addr->remote_session_id = session->peer_session_id;
++
++	addr->local_addr.sin_port = isk->inet_sport;
++	addr->remote_addr.sin_port = isk->inet_dport;
++	addr->local_addr.sin_addr.s_addr = isk->inet_saddr;
++	addr->remote_addr.sin_addr.s_addr = isk->inet_daddr;
++
++	sock_put(sk);
++	return 0;
++}
++
++/* pppol2tp_channel_addressing_get() */
++int pppol2tp_channel_addressing_get(struct ppp_channel *chan,
++				    struct pppol2tp_common_addr *addr)
++{
++	return pppol2tp_get_addressing(chan, addr);
++}
++EXPORT_SYMBOL(pppol2tp_channel_addressing_get);
++/* QCA NSS ECM support - End */
++
+ module_init(pppol2tp_init);
+ module_exit(pppol2tp_exit);
+ 
+--- a/drivers/net/ppp/ppp_generic.c
++++ b/drivers/net/ppp/ppp_generic.c
+@@ -3743,6 +3743,32 @@ int ppp_is_multilink(struct net_device *
+ }
+ EXPORT_SYMBOL(ppp_is_multilink);
+ 
++/* __ppp_is_multilink()
++ *      Returns >0 if the device is a multilink PPP netdevice, 0 if not or < 0
++ *      if the device is not PPP. Caller should acquire ppp_lock before calling
++ *      this function
++ */
++int __ppp_is_multilink(struct net_device *dev)
++{
++	struct ppp *ppp;
++	unsigned int flags;
++
++	if (!dev)
++		return -1;
++
++	if (dev->type != ARPHRD_PPP)
++		return -1;
++
++	ppp = netdev_priv(dev);
++	flags = ppp->flags;
++
++	if (flags & SC_MULTILINK)
++		return 1;
++
++	return 0;
++}
++EXPORT_SYMBOL(__ppp_is_multilink);
++
+ /* ppp_channel_get_protocol()
+  *	Call this to obtain the underlying protocol of the PPP channel,
+  *	e.g. PX_PROTO_OE
+@@ -3881,6 +3907,59 @@ int ppp_hold_channels(struct net_device
+ }
+ EXPORT_SYMBOL(ppp_hold_channels);
+ 
++/* __ppp_hold_channels()
++ *	Returns the PPP channels of the PPP device, storing each one into
++ *	channels[].
++ *
++ * channels[] has chan_sz elements.
++ * This function returns the number of channels stored, up to chan_sz.
++ * It will return < 0 if the device is not PPP.
++ *
++ * You MUST release the channels using ppp_release_channels().
++ */
++int __ppp_hold_channels(struct net_device *dev, struct ppp_channel *channels[],
++		      unsigned int chan_sz)
++{
++	struct ppp *ppp;
++	int c;
++	struct channel *pch;
++
++	if (!dev)
++		return -1;
++
++	if (dev->type != ARPHRD_PPP)
++		return -1;
++
++	ppp = netdev_priv(dev);
++
++	c = 0;
++	list_for_each_entry(pch, &ppp->channels, clist) {
++		struct ppp_channel *chan;
++
++		if (!pch->chan) {
++			/* Channel is going / gone away */
++			continue;
++		}
++
++		if (c == chan_sz) {
++			/* No space to record channel */
++			return c;
++		}
++
++		/* Hold the channel, if supported */
++		chan = pch->chan;
++		if (!chan->ops->hold)
++			continue;
++
++		chan->ops->hold(chan);
++
++		 /* Record the channel */
++		channels[c++] = chan;
++	}
++	return c;
++}
++EXPORT_SYMBOL(__ppp_hold_channels);
++
+ /* ppp_release_channels()
+  *	Releases channels
+  */
+--- a/net/l2tp/l2tp_core.h
++++ b/net/l2tp/l2tp_core.h
+@@ -235,6 +235,9 @@ struct l2tp_session *l2tp_session_get_by
+ void l2tp_stats_update(struct l2tp_tunnel *tunnel, struct l2tp_session *session,
+                        struct l2tp_stats *stats);
+ 
++void l2tp_stats_update(struct l2tp_tunnel *tunnel, struct l2tp_session *session,
++                       struct l2tp_stats *stats);
++
+ /* Tunnel and session lifetime management.
+  * Creation of a new instance is a two-step process: create, then register.
+  * Destruction is triggered using the *_delete functions, and completes asynchronously.
diff --git a/target/linux/qualcommax/patches-6.6/0603-7-qca-nss-clients-iptunnel-lock-this-cpu.patch b/target/linux/qualcommax/patches-6.6/0603-7-qca-nss-clients-iptunnel-lock-this-cpu.patch
new file mode 100644
index 00000000000000..e4ed49ea4c21fb
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0603-7-qca-nss-clients-iptunnel-lock-this-cpu.patch
@@ -0,0 +1,22 @@
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -2417,7 +2417,7 @@ nla_put_failure:
+  */
+ void ip6_update_offload_stats(struct net_device *dev, void *ptr)
+ {
+-	struct pcpu_sw_netstats *tstats = per_cpu_ptr(dev->tstats, 0);
++	struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
+ 	const struct pcpu_sw_netstats *offload_stats =
+ 					(struct pcpu_sw_netstats *)ptr;
+ 
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -1736,7 +1736,7 @@ nla_put_failure:
+ /* QCA NSS Clients Support - Start */
+ void ipip6_update_offload_stats(struct net_device *dev, void *ptr)
+ {
+-	struct pcpu_sw_netstats *tstats = per_cpu_ptr(dev->tstats, 0);
++	struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
+ 	const struct pcpu_sw_netstats *offload_stats =
+ 					(struct pcpu_sw_netstats *)ptr;
+ 
diff --git a/target/linux/qualcommax/patches-6.6/0603-8-qca-nss-clients-add-tls-mgr-support.patch b/target/linux/qualcommax/patches-6.6/0603-8-qca-nss-clients-add-tls-mgr-support.patch
new file mode 100644
index 00000000000000..0499e237f6be88
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0603-8-qca-nss-clients-add-tls-mgr-support.patch
@@ -0,0 +1,24 @@
+--- /dev/null
++++ b/include/uapi/linux/tlshdr.h
+@@ -0,0 +1,21 @@
++#ifndef _UAPI_LINUX_TLSHDR_H
++#define _UAPI_LINUX_TLSHDR_H
++
++#include <linux/types.h>
++
++struct tlshdr {
++	__u8 type;
++	__be16 version;
++	__be16 len;
++} __attribute__((packed));
++
++#define TLSHDR_REC_TYPE_CCS 20		/* TLS packet is change cipher specification */
++#define TLSHDR_REC_TYPE_ALERT 21	/* TLS packet is Alert */
++#define TLSHDR_REC_TYPE_HANDSHAKE 22	/* TLS packet is Handshake */
++#define TLSHDR_REC_TYPE_DATA 23		/* TLS packet is Application data */
++
++#define TLSHDR_VERSION_1_1 0x0302 /* TLS Header Version(tls 1.1) */
++#define TLSHDR_VERSION_1_2 0x0303 /* TLS Header Version(tls 1.2) */
++#define TLSHDR_VERSION_1_3 0x0304 /* TLS Header Version(tls 1.3) */
++
++#endif /* _UAPI_LINUX_TLSHDR_H */
diff --git a/target/linux/qualcommax/patches-6.6/0604-1-qca-add-mcs-support.patch b/target/linux/qualcommax/patches-6.6/0604-1-qca-add-mcs-support.patch
new file mode 100644
index 00000000000000..edf21700c3e94c
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0604-1-qca-add-mcs-support.patch
@@ -0,0 +1,876 @@
+--- a/include/linux/if_bridge.h
++++ b/include/linux/if_bridge.h
+@@ -258,4 +258,17 @@ extern br_get_dst_hook_t __rcu *br_get_d
+ extern struct net_device *br_fdb_bridge_dev_get_and_hold(struct net_bridge *br);
+ /* QCA NSS bridge-mgr support - End */
+ 
++/* QCA qca-mcs support - Start */
++typedef struct net_bridge_port *br_get_dst_hook_t(const struct net_bridge_port *src,
++		struct sk_buff **skb);
++extern br_get_dst_hook_t __rcu *br_get_dst_hook;
++
++typedef int (br_multicast_handle_hook_t)(const struct net_bridge_port *src,
++		struct sk_buff *skb);
++extern br_multicast_handle_hook_t __rcu *br_multicast_handle_hook;
++
++typedef void (br_notify_hook_t)(int group, int event, const void *ptr);
++extern br_notify_hook_t __rcu *br_notify_hook;
++/* QCA qca-mcs support - End */
++
+ #endif
+--- a/net/bridge/br_fdb.c
++++ b/net/bridge/br_fdb.c
+@@ -239,6 +239,8 @@ static void fdb_notify(struct net_bridge
+ 		kfree_skb(skb);
+ 		goto errout;
+ 	}
++
++	__br_notify(RTNLGRP_NEIGH, type, fdb); /* QCA qca-mcs support */
+ 	rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
+ 	return;
+ errout:
+@@ -305,6 +307,7 @@ struct net_bridge_fdb_entry *br_fdb_find
+ {
+ 	return fdb_find_rcu(&br->fdb_hash_tbl, addr, vid);
+ }
++EXPORT_SYMBOL_GPL(br_fdb_find_rcu); /* QCA qca-mcs support */
+ 
+ /* When a static FDB entry is added, the mac address from the entry is
+  * added to the bridge private HW address list and all required ports
+--- a/net/bridge/br_private.h
++++ b/net/bridge/br_private.h
+@@ -906,6 +906,7 @@ void br_manage_promisc(struct net_bridge
+ int nbp_backup_change(struct net_bridge_port *p, struct net_device *backup_dev);
+ 
+ /* br_input.c */
++int br_pass_frame_up(struct sk_buff *skb); /* QCA qca-mcs support */
+ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb);
+ rx_handler_func_t *br_get_rx_handler(const struct net_device *dev);
+ 
+@@ -2268,4 +2269,14 @@ struct nd_msg *br_is_nd_neigh_msg(struct
+ bool br_is_neigh_suppress_enabled(const struct net_bridge_port *p, u16 vid);
+ #define __br_get(__hook, __default, __args ...) \
+ 		(__hook ? (__hook(__args)) : (__default)) /* QCA NSS ECM support */
++
++/* QCA qca-mcs support - Start */
++static inline void __br_notify(int group, int type, const void *data)
++{
++	br_notify_hook_t *notify_hook = rcu_dereference(br_notify_hook);
++
++	if (notify_hook)
++		notify_hook(group, type, data);
++}
++/* QCA qca-mcs support - End */
+ #endif
+--- a/net/bridge/br_netlink.c
++++ b/net/bridge/br_netlink.c
+@@ -656,6 +656,7 @@ void br_info_notify(int event, const str
+ 		kfree_skb(skb);
+ 		goto errout;
+ 	}
++	__br_notify(RTNLGRP_LINK, event, port); /* QCA qca-mcs support */
+ 	rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL, GFP_ATOMIC);
+ 	return;
+ errout:
+--- a/net/bridge/br.c
++++ b/net/bridge/br.c
+@@ -472,6 +472,12 @@ static void __exit br_deinit(void)
+ 	br_fdb_fini();
+ }
+ 
++/* QCA qca-mcs support - Start */
++/* Hook for bridge event notifications */
++br_notify_hook_t __rcu *br_notify_hook __read_mostly;
++EXPORT_SYMBOL_GPL(br_notify_hook);
++/* QCA qca-mcs support - End */
++
+ module_init(br_init)
+ module_exit(br_deinit)
+ MODULE_LICENSE("GPL");
+--- a/net/bridge/br_device.c
++++ b/net/bridge/br_device.c
+@@ -83,6 +83,13 @@ netdev_tx_t br_dev_xmit(struct sk_buff *
+ 	if (is_broadcast_ether_addr(dest)) {
+ 		br_flood(br, skb, BR_PKT_BROADCAST, false, true, vid);
+ 	} else if (is_multicast_ether_addr(dest)) {
++		/* QCA qca-mcs support - Start */
++		br_multicast_handle_hook_t *multicast_handle_hook =
++		  rcu_dereference(br_multicast_handle_hook);
++		if (!__br_get(multicast_handle_hook, true, NULL, skb))
++			goto out;
++		/* QCA qca-mcs support - End */
++
+ 		if (unlikely(netpoll_tx_running(dev))) {
+ 			br_flood(br, skb, BR_PKT_MULTICAST, false, true, vid);
+ 			goto out;
+--- a/net/bridge/br_input.c
++++ b/net/bridge/br_input.c
+@@ -30,7 +30,17 @@ br_netif_receive_skb(struct net *net, st
+ 	return netif_receive_skb(skb);
+ }
+ 
+-static int br_pass_frame_up(struct sk_buff *skb)
++/* QCA qca-mcs support - Start */
++/* Hook for external Multicast handler */
++br_multicast_handle_hook_t __rcu *br_multicast_handle_hook __read_mostly;
++EXPORT_SYMBOL_GPL(br_multicast_handle_hook);
++
++/* Hook for external forwarding logic */
++br_get_dst_hook_t __rcu *br_get_dst_hook __read_mostly;
++EXPORT_SYMBOL_GPL(br_get_dst_hook);
++/* QCA qca-mcs support - End */
++
++int br_pass_frame_up(struct sk_buff *skb)
+ {
+ 	struct net_device *indev, *brdev = BR_INPUT_SKB_CB(skb)->brdev;
+ 	struct net_bridge *br = netdev_priv(brdev);
+@@ -69,6 +79,7 @@ static int br_pass_frame_up(struct sk_bu
+ 		       dev_net(indev), NULL, skb, indev, NULL,
+ 		       br_netif_receive_skb);
+ }
++EXPORT_SYMBOL_GPL(br_pass_frame_up); /* QCA qca-mcs support */
+ 
+ /* note: already called with rcu_read_lock */
+ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
+@@ -82,6 +93,11 @@ int br_handle_frame_finish(struct net *n
+ 	struct net_bridge_mcast *brmctx;
+ 	struct net_bridge_vlan *vlan;
+ 	struct net_bridge *br;
++	/* QCA qca-mcs support - Start */
++	br_multicast_handle_hook_t *multicast_handle_hook;
++	struct net_bridge_port *pdst = NULL;
++	br_get_dst_hook_t *get_dst_hook = rcu_dereference(br_get_dst_hook);
++	/* QCA qca-mcs support - End */
+ 	u16 vid = 0;
+ 	u8 state;
+ 
+@@ -175,6 +191,12 @@ int br_handle_frame_finish(struct net *n
+ 
+ 	switch (pkt_type) {
+ 	case BR_PKT_MULTICAST:
++		/* QCA qca-mcs support - Start */
++		multicast_handle_hook = rcu_dereference(br_multicast_handle_hook);
++		if (!__br_get(multicast_handle_hook, true, p, skb))
++			goto out;
++		/* QCA qca-mcs support - End */
++
+ 		mdst = br_mdb_get(brmctx, skb, vid);
+ 		if ((mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) &&
+ 		    br_multicast_querier_exists(brmctx, eth_hdr(skb), mdst)) {
+@@ -190,8 +212,15 @@ int br_handle_frame_finish(struct net *n
+ 		}
+ 		break;
+ 	case BR_PKT_UNICAST:
+-		dst = br_fdb_find_rcu(br, eth_hdr(skb)->h_dest, vid);
+-		break;
++		/* QCA qca-mcs support - Start */
++		pdst = __br_get(get_dst_hook, NULL, p, &skb);
++		if (pdst) {
++			if (!skb)
++				goto out;
++		} else {
++		/* QCA qca-mcs support - End */
++			dst = br_fdb_find_rcu(br, eth_hdr(skb)->h_dest, vid);
++		}
+ 	default:
+ 		break;
+ 	}
+@@ -206,6 +235,13 @@ int br_handle_frame_finish(struct net *n
+ 			dst->used = now;
+ 		br_forward(dst->dst, skb, local_rcv, false);
+ 	} else {
++	  /* QCA qca-mcs support - Start */
++		if (pdst) {
++			br_forward(pdst, skb, local_rcv, false);
++			goto out;
++		}
++		/* QCA qca-mcs support - End */
++
+ 		if (!mcast_hit)
+ 			br_flood(br, skb, pkt_type, local_rcv, false, vid);
+ 		else
+--- a/include/linux/mroute.h
++++ b/include/linux/mroute.h
+@@ -92,4 +92,44 @@ struct rtmsg;
+ int ipmr_get_route(struct net *net, struct sk_buff *skb,
+ 		   __be32 saddr, __be32 daddr,
+ 		   struct rtmsg *rtm, u32 portid);
++
++/* QCA ECM qca-mcs support - Start */
++#define IPMR_MFC_EVENT_UPDATE   1
++#define IPMR_MFC_EVENT_DELETE   2
++
++/*
++ * Callback to registered modules in the event of updates to a multicast group
++ */
++typedef void (*ipmr_mfc_event_offload_callback_t)(__be32 origin, __be32 group,
++						  u32 max_dest_dev,
++						  u32 dest_dev_idx[],
++						  u8 op);
++
++/*
++ * Register the callback used to inform offload modules when updates occur to
++ * MFC. The callback is registered by offload modules
++ */
++extern bool ipmr_register_mfc_event_offload_callback(
++			ipmr_mfc_event_offload_callback_t mfc_offload_cb);
++
++/*
++ * De-Register the callback used to inform offload modules when updates occur
++ * to MFC
++ */
++extern void ipmr_unregister_mfc_event_offload_callback(void);
++
++/*
++ * Find the destination interface list, given a multicast group and source
++ */
++extern int ipmr_find_mfc_entry(struct net *net, __be32 origin, __be32 group,
++				 u32 max_dst_cnt, u32 dest_dev[]);
++
++/*
++ * Out-of-band multicast statistics update for flows that are offloaded from
++ * Linux
++ */
++extern int ipmr_mfc_stats_update(struct net *net, __be32 origin, __be32 group,
++				 u64 pkts_in, u64 bytes_in,
++				 u64 pkts_out, u64 bytes_out);
++/* QCA ECM qca-mcs support - End */
+ #endif
+--- a/include/linux/mroute6.h
++++ b/include/linux/mroute6.h
+@@ -137,4 +137,47 @@ static inline int ip6mr_sk_ioctl(struct
+ 	return 1;
+ }
+ #endif
++
++/* QCA qca-mcs support - Start */
++#define IP6MR_MFC_EVENT_UPDATE   1
++#define IP6MR_MFC_EVENT_DELETE   2
++
++/*
++ * Callback to registered modules in the event of updates to a multicast group
++ */
++typedef void (*ip6mr_mfc_event_offload_callback_t)(struct in6_addr *origin,
++						   struct in6_addr *group,
++						   u32 max_dest_dev,
++						   u32 dest_dev_idx[],
++						   uint8_t op);
++
++/*
++ * Register the callback used to inform offload modules when updates occur
++ * to MFC. The callback is registered by offload modules
++ */
++extern bool ip6mr_register_mfc_event_offload_callback(
++			ip6mr_mfc_event_offload_callback_t mfc_offload_cb);
++
++/*
++ * De-Register the callback used to inform offload modules when updates occur
++ * to MFC
++ */
++extern void ip6mr_unregister_mfc_event_offload_callback(void);
++
++/*
++ * Find the destination interface list given a multicast group and source
++ */
++extern int ip6mr_find_mfc_entry(struct net *net, struct in6_addr *origin,
++				struct in6_addr *group, u32 max_dst_cnt,
++				u32 dest_dev[]);
++
++/*
++ * Out-of-band multicast statistics update for flows that are offloaded from
++ * Linux
++ */
++extern int ip6mr_mfc_stats_update(struct net *net, struct in6_addr *origin,
++				  struct in6_addr *group, uint64_t pkts_in,
++				  uint64_t bytes_in, uint64_t pkts_out,
++				  uint64_t bytes_out);
++/* QCA qca-mcs support - End */
+ #endif
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -89,6 +89,9 @@ static struct net_device *vif_dev_read(c
+ /* Special spinlock for queue of unresolved entries */
+ static DEFINE_SPINLOCK(mfc_unres_lock);
+ 
++/* spinlock for offload */
++static DEFINE_SPINLOCK(lock); /* QCA ECM qca-mcs support */
++
+ /* We return to original Alan's scheme. Hash table of resolved
+  * entries is changed only in process context and protected
+  * with weak lock mrt_lock. Queue of unresolved entries is protected
+@@ -112,6 +115,9 @@ static void mroute_netlink_event(struct
+ static void igmpmsg_netlink_event(const struct mr_table *mrt, struct sk_buff *pkt);
+ static void mroute_clean_tables(struct mr_table *mrt, int flags);
+ static void ipmr_expire_process(struct timer_list *t);
++static struct mfc_cache *ipmr_cache_find(struct mr_table *mrt, __be32 origin,
++					 __be32 mcastgrp);
++static ipmr_mfc_event_offload_callback_t __rcu ipmr_mfc_event_offload_callback; /* QCA ECM qca-mcs support */
+ 
+ #ifdef CONFIG_IP_MROUTE_MULTIPLE_TABLES
+ #define ipmr_for_each_table(mrt, net)					\
+@@ -223,6 +229,80 @@ static int ipmr_rule_fill(struct fib_rul
+ 	return 0;
+ }
+ 
++/* QCA ECM qca-mcs support - Start */
++/* ipmr_sync_entry_update()
++ * Call the registered offload callback to report an update to a multicast
++ * route entry. The callback receives the list of destination interfaces and
++ * the interface count
++ */
++static void ipmr_sync_entry_update(struct mr_table *mrt,
++				   struct mfc_cache *cache)
++{
++	int vifi, dest_if_count = 0;
++	u32 dest_dev[MAXVIFS];
++	__be32  origin;
++	__be32  group;
++	ipmr_mfc_event_offload_callback_t offload_update_cb_f;
++
++	memset(dest_dev, 0, sizeof(dest_dev));
++
++	origin = cache->mfc_origin;
++	group = cache->mfc_mcastgrp;
++
++	spin_lock(&mrt_lock);
++	for (vifi = 0; vifi < cache->_c.mfc_un.res.maxvif; vifi++) {
++		if (!((cache->_c.mfc_un.res.ttls[vifi] > 0) &&
++		      (cache->_c.mfc_un.res.ttls[vifi] < 255))) {
++			continue;
++		}
++		if (dest_if_count == MAXVIFS) {
++			spin_unlock(&mrt_lock);
++			return;
++		}
++
++		if (!VIF_EXISTS(mrt, vifi)) {
++			spin_unlock(&mrt_lock);
++			return;
++		}
++		dest_dev[dest_if_count] = mrt->vif_table[vifi].dev->ifindex;
++		dest_if_count++;
++	}
++	spin_unlock(&mrt_lock);
++
++	rcu_read_lock();
++	offload_update_cb_f = rcu_dereference(ipmr_mfc_event_offload_callback);
++
++	if (!offload_update_cb_f) {
++		rcu_read_unlock();
++		return;
++	}
++
++	offload_update_cb_f(group, origin, dest_if_count, dest_dev,
++			    IPMR_MFC_EVENT_UPDATE);
++	rcu_read_unlock();
++}
++
++/* ipmr_sync_entry_delete()
++ * Call the registered offload callback to inform of a multicast route entry
++ * delete event
++ */
++static void ipmr_sync_entry_delete(u32 origin, u32 group)
++{
++	ipmr_mfc_event_offload_callback_t offload_update_cb_f;
++
++	rcu_read_lock();
++	offload_update_cb_f = rcu_dereference(ipmr_mfc_event_offload_callback);
++
++	if (!offload_update_cb_f) {
++		rcu_read_unlock();
++		return;
++	}
++
++	offload_update_cb_f(group, origin, 0, NULL, IPMR_MFC_EVENT_DELETE);
++	rcu_read_unlock();
++}
++/* QCA ECM qca-mcs support - End */
++
+ static const struct fib_rules_ops __net_initconst ipmr_rules_ops_template = {
+ 	.family		= RTNL_FAMILY_IPMR,
+ 	.rule_size	= sizeof(struct ipmr_rule),
+@@ -236,6 +316,156 @@ static const struct fib_rules_ops __net_
+ 	.owner		= THIS_MODULE,
+ };
+ 
++/* QCA ECM qca-mcs support - Start */
++/* ipmr_register_mfc_event_offload_callback()
++ * Register the IPv4 Multicast update offload callback with IPMR
++ */
++bool ipmr_register_mfc_event_offload_callback(
++		ipmr_mfc_event_offload_callback_t mfc_offload_cb)
++{
++	ipmr_mfc_event_offload_callback_t offload_update_cb_f;
++
++	rcu_read_lock();
++	offload_update_cb_f = rcu_dereference(ipmr_mfc_event_offload_callback);
++
++	if (offload_update_cb_f) {
++		rcu_read_unlock();
++		return false;
++	}
++	rcu_read_unlock();
++
++	spin_lock(&lock);
++	rcu_assign_pointer(ipmr_mfc_event_offload_callback, mfc_offload_cb);
++	spin_unlock(&lock);
++	synchronize_rcu();
++	return true;
++}
++EXPORT_SYMBOL(ipmr_register_mfc_event_offload_callback);
++
++/* ipmr_unregister_mfc_event_offload_callback()
++ * De-register the IPv4 Multicast update offload callback with IPMR
++ */
++void ipmr_unregister_mfc_event_offload_callback(void)
++{
++	spin_lock(&lock);
++	rcu_assign_pointer(ipmr_mfc_event_offload_callback, NULL);
++	spin_unlock(&lock);
++	synchronize_rcu();
++}
++EXPORT_SYMBOL(ipmr_unregister_mfc_event_offload_callback);
++
++/* ipmr_find_mfc_entry()
++ * Returns destination interface list for a particular multicast flow, and
++ * the number of interfaces in the list
++ */
++int ipmr_find_mfc_entry(struct net *net, __be32 origin, __be32 group,
++			u32 max_dest_cnt, u32 dest_dev[])
++{
++	int vifi, dest_if_count = 0;
++	struct mr_table *mrt;
++	struct mfc_cache *cache;
++
++	mrt = ipmr_get_table(net, RT_TABLE_DEFAULT);
++	if (!mrt)
++		return -ENOENT;
++
++	rcu_read_lock();
++	cache = ipmr_cache_find(mrt, origin, group);
++	if (!cache) {
++		rcu_read_unlock();
++		return -ENOENT;
++	}
++
++	spin_lock(&mrt_lock);
++	for (vifi = 0; vifi < cache->_c.mfc_un.res.maxvif; vifi++) {
++		if (!((cache->_c.mfc_un.res.ttls[vifi] > 0) &&
++		      (cache->_c.mfc_un.res.ttls[vifi] < 255))) {
++			continue;
++		}
++
++		/* We have another valid destination interface entry. Check if
++		 * the number of the destination interfaces for the route is
++		 * exceeding the size of the array given to us
++		 */
++		if (dest_if_count == max_dest_cnt) {
++			spin_unlock(&mrt_lock);
++			rcu_read_unlock();
++			return -EINVAL;
++		}
++
++		if (!VIF_EXISTS(mrt, vifi)) {
++			spin_unlock(&mrt_lock);
++			rcu_read_unlock();
++			return -EINVAL;
++		}
++
++		dest_dev[dest_if_count] = mrt->vif_table[vifi].dev->ifindex;
++		dest_if_count++;
++	}
++	spin_unlock(&mrt_lock);
++	rcu_read_unlock();
++
++	return dest_if_count;
++}
++EXPORT_SYMBOL(ipmr_find_mfc_entry);
++
++/* ipmr_mfc_stats_update()
++ * Update the MFC/VIF statistics for offloaded flows
++ */
++int ipmr_mfc_stats_update(struct net *net, __be32 origin, __be32 group,
++			  u64 pkts_in, u64 bytes_in,
++			  u64 pkts_out, u64 bytes_out)
++{
++	int vif, vifi;
++	struct mr_table *mrt;
++	struct mfc_cache *cache;
++
++	mrt = ipmr_get_table(net, RT_TABLE_DEFAULT);
++	if (!mrt)
++		return -ENOENT;
++
++	rcu_read_lock();
++	cache = ipmr_cache_find(mrt, origin, group);
++	if (!cache) {
++		rcu_read_unlock();
++		return -ENOENT;
++	}
++
++	vif = cache->_c.mfc_parent;
++
++	spin_lock(&mrt_lock);
++	if (!VIF_EXISTS(mrt, vif)) {
++		spin_unlock(&mrt_lock);
++		rcu_read_unlock();
++		return -EINVAL;
++	}
++
++	mrt->vif_table[vif].pkt_in += pkts_in;
++	mrt->vif_table[vif].bytes_in += bytes_in;
++	cache->_c.mfc_un.res.pkt  += pkts_out;
++	cache->_c.mfc_un.res.bytes += bytes_out;
++
++	for (vifi = cache->_c.mfc_un.res.minvif;
++			vifi < cache->_c.mfc_un.res.maxvif; vifi++) {
++		if ((cache->_c.mfc_un.res.ttls[vifi] > 0) &&
++		    (cache->_c.mfc_un.res.ttls[vifi] < 255)) {
++			if (!VIF_EXISTS(mrt, vifi)) {
++				spin_unlock(&mrt_lock);
++				rcu_read_unlock();
++				return -EINVAL;
++			}
++			mrt->vif_table[vifi].pkt_out += pkts_out;
++			mrt->vif_table[vifi].bytes_out += bytes_out;
++		}
++	}
++	spin_unlock(&mrt_lock);
++	rcu_read_unlock();
++
++	return 0;
++}
++EXPORT_SYMBOL(ipmr_mfc_stats_update);
++/* QCA ECM qca-mcs support - End */
++
+ static int __net_init ipmr_rules_init(struct net *net)
+ {
+ 	struct fib_rules_ops *ops;
+@@ -1191,6 +1421,10 @@ static int ipmr_mfc_delete(struct mr_tab
+ 	call_ipmr_mfc_entry_notifiers(net, FIB_EVENT_ENTRY_DEL, c, mrt->id);
+ 	mroute_netlink_event(mrt, c, RTM_DELROUTE);
+ 	mr_cache_put(&c->_c);
++	/* QCA ECM qca-mcs support - Start */
++	/* Inform offload modules of the delete event */
++	ipmr_sync_entry_delete(c->mfc_origin, c->mfc_mcastgrp);
++	/* QCA ECM qca-mcs support - End */
+ 
+ 	return 0;
+ }
+@@ -1221,6 +1455,10 @@ static int ipmr_mfc_add(struct net *net,
+ 		call_ipmr_mfc_entry_notifiers(net, FIB_EVENT_ENTRY_REPLACE, c,
+ 					      mrt->id);
+ 		mroute_netlink_event(mrt, c, RTM_NEWROUTE);
++		/* QCA ECM qca-mcs support - Start */
++		/* Inform offload modules of the update event */
++		ipmr_sync_entry_update(mrt, c);
++		/* QCA ECM qca-mcs support - End */
+ 		return 0;
+ 	}
+ 
+--- a/net/ipv6/ip6mr.c
++++ b/net/ipv6/ip6mr.c
+@@ -74,6 +74,9 @@ static struct net_device *vif_dev_read(c
+ /* Special spinlock for queue of unresolved entries */
+ static DEFINE_SPINLOCK(mfc_unres_lock);
+ 
++/* Spinlock for offload */
++static DEFINE_SPINLOCK(lock); /* QCA qca-mcs support */
++
+ /* We return to original Alan's scheme. Hash table of resolved
+    entries is changed only in process context and protected
+    with weak lock mrt_lock. Queue of unresolved entries is protected
+@@ -101,6 +104,13 @@ static int ip6mr_rtm_dumproute(struct sk
+ 			       struct netlink_callback *cb);
+ static void mroute_clean_tables(struct mr_table *mrt, int flags);
+ static void ipmr_expire_process(struct timer_list *t);
++/* QCA qca-mcs support - Start */
++static struct mfc6_cache *ip6mr_cache_find(struct mr_table *mrt,
++					   const struct in6_addr *origin,
++					   const struct in6_addr *mcastgrp);
++static ip6mr_mfc_event_offload_callback_t __rcu
++				ip6mr_mfc_event_offload_callback;
++/* QCA qca-mcs support - End */
+ 
+ #ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES
+ #define ip6mr_for_each_table(mrt, net) \
+@@ -375,6 +385,84 @@ static struct mfc6_cache_cmp_arg ip6mr_m
+ 	.mf6c_mcastgrp = IN6ADDR_ANY_INIT,
+ };
+ 
++/* QCA qca-mcs support - Start */
++/* ip6mr_sync_entry_update()
++ * Call the registered offload callback to report an update to a multicast
++ * route entry. The callback receives the list of destination interfaces and
++ * the interface count
++ */
++static void ip6mr_sync_entry_update(struct mr_table *mrt,
++				    struct mfc6_cache *cache)
++{
++	int vifi, dest_if_count = 0;
++	u32 dest_dev[MAXMIFS];
++	struct in6_addr mc_origin, mc_group;
++	ip6mr_mfc_event_offload_callback_t offload_update_cb_f;
++
++	memset(dest_dev, 0, sizeof(dest_dev));
++
++	spin_lock(&mrt_lock);
++
++	for (vifi = 0; vifi < cache->_c.mfc_un.res.maxvif; vifi++) {
++		if (!((cache->_c.mfc_un.res.ttls[vifi] > 0) &&
++		      (cache->_c.mfc_un.res.ttls[vifi] < 255))) {
++			continue;
++		}
++
++		if (dest_if_count == MAXMIFS) {
++			spin_unlock(&mrt_lock);
++			return;
++		}
++
++		if (!VIF_EXISTS(mrt, vifi)) {
++			spin_unlock(&mrt_lock);
++			return;
++		}
++
++		dest_dev[dest_if_count] = mrt->vif_table[vifi].dev->ifindex;
++		dest_if_count++;
++	}
++
++	memcpy(&mc_origin, &cache->mf6c_origin, sizeof(struct in6_addr));
++	memcpy(&mc_group, &cache->mf6c_mcastgrp, sizeof(struct in6_addr));
++	spin_unlock(&mrt_lock);
++
++	rcu_read_lock();
++	offload_update_cb_f = rcu_dereference(ip6mr_mfc_event_offload_callback);
++
++	if (!offload_update_cb_f) {
++		rcu_read_unlock();
++		return;
++	}
++
++	offload_update_cb_f(&mc_group, &mc_origin, dest_if_count, dest_dev,
++			    IP6MR_MFC_EVENT_UPDATE);
++	rcu_read_unlock();
++}
++
++/* ip6mr_sync_entry_delete()
++ * Call the registered offload callback to inform of a multicast route entry
++ * delete event
++ */
++static void ip6mr_sync_entry_delete(struct in6_addr *mc_origin,
++				    struct in6_addr *mc_group)
++{
++	ip6mr_mfc_event_offload_callback_t offload_update_cb_f;
++
++	rcu_read_lock();
++	offload_update_cb_f = rcu_dereference(ip6mr_mfc_event_offload_callback);
++
++	if (!offload_update_cb_f) {
++		rcu_read_unlock();
++		return;
++	}
++
++	offload_update_cb_f(mc_group, mc_origin, 0, NULL,
++			    IP6MR_MFC_EVENT_DELETE);
++	rcu_read_unlock();
++}
++/* QCA qca-mcs support - End */
++
+ static struct mr_table_ops ip6mr_mr_table_ops = {
+ 	.rht_params = &ip6mr_rht_params,
+ 	.cmparg_any = &ip6mr_mr_table_ops_cmparg_any,
+@@ -697,6 +785,151 @@ static int call_ip6mr_mfc_entry_notifier
+ 				     &mfc->_c, tb_id, &net->ipv6.ipmr_seq);
+ }
+ 
++/* QCA qca-mcs support - Start */
++/* ip6mr_register_mfc_event_offload_callback()
++ * Register the IPv6 multicast update callback for offload modules
++ */
++bool ip6mr_register_mfc_event_offload_callback(
++		ip6mr_mfc_event_offload_callback_t mfc_offload_cb)
++{
++	ip6mr_mfc_event_offload_callback_t offload_update_cb_f;
++
++	rcu_read_lock();
++	offload_update_cb_f = rcu_dereference(ip6mr_mfc_event_offload_callback);
++
++	if (offload_update_cb_f) {
++		rcu_read_unlock();
++		return false;
++	}
++	rcu_read_unlock();
++
++	spin_lock(&lock);
++	rcu_assign_pointer(ip6mr_mfc_event_offload_callback, mfc_offload_cb);
++	spin_unlock(&lock);
++	synchronize_rcu();
++	return true;
++}
++EXPORT_SYMBOL(ip6mr_register_mfc_event_offload_callback);
++
++/* ip6mr_unregister_mfc_event_offload_callback()
++ * De-register the IPv6 multicast update callback for offload modules
++ */
++void ip6mr_unregister_mfc_event_offload_callback(void)
++{
++	spin_lock(&lock);
++	rcu_assign_pointer(ip6mr_mfc_event_offload_callback, NULL);
++	spin_unlock(&lock);
++	synchronize_rcu();
++}
++EXPORT_SYMBOL(ip6mr_unregister_mfc_event_offload_callback);
++
++/* ip6mr_find_mfc_entry()
++ * Return the destination interface list for a particular multicast flow, and
++ * the number of interfaces in the list
++ */
++int ip6mr_find_mfc_entry(struct net *net, struct in6_addr *origin,
++			 struct in6_addr *group, u32 max_dest_cnt,
++			 u32 dest_dev[])
++{
++	int vifi, dest_if_count = 0;
++	struct mr_table *mrt;
++	struct mfc6_cache *cache;
++
++	mrt = ip6mr_get_table(net, RT6_TABLE_DFLT);
++	if (!mrt)
++		return -ENOENT;
++
++	spin_lock(&mrt_lock);
++	cache = ip6mr_cache_find(mrt, origin, group);
++	if (!cache) {
++		spin_unlock(&mrt_lock);
++		return -ENOENT;
++	}
++
++	for (vifi = 0; vifi < cache->_c.mfc_un.res.maxvif; vifi++) {
++		if (!((cache->_c.mfc_un.res.ttls[vifi] > 0) &&
++		      (cache->_c.mfc_un.res.ttls[vifi] < 255))) {
++			continue;
++		}
++
++		/* We have another valid destination interface entry. Check if
++		 * the number of the destination interfaces for the route is
++		 * exceeding the size of the array given to us
++		 */
++		if (dest_if_count == max_dest_cnt) {
++			spin_unlock(&mrt_lock);
++			return -EINVAL;
++		}
++
++		if (!VIF_EXISTS(mrt, vifi)) {
++			spin_unlock(&mrt_lock);
++			return -EINVAL;
++		}
++
++		dest_dev[dest_if_count] = mrt->vif_table[vifi].dev->ifindex;
++		dest_if_count++;
++	}
++	spin_unlock(&mrt_lock);
++
++	return dest_if_count;
++}
++EXPORT_SYMBOL(ip6mr_find_mfc_entry);
++
++/* ip6mr_mfc_stats_update()
++ * Update the MFC/VIF statistics for offloaded flows
++ */
++int ip6mr_mfc_stats_update(struct net *net, struct in6_addr *origin,
++			   struct in6_addr *group, u64 pkts_in,
++			   u64 bytes_in, uint64_t pkts_out,
++			   u64 bytes_out)
++{
++	int vif, vifi;
++	struct mr_table *mrt;
++	struct mfc6_cache *cache;
++
++	mrt = ip6mr_get_table(net, RT6_TABLE_DFLT);
++
++	if (!mrt)
++		return -ENOENT;
++
++	spin_lock(&mrt_lock);
++	cache = ip6mr_cache_find(mrt, origin, group);
++	if (!cache) {
++		spin_unlock(&mrt_lock);
++		return -ENOENT;
++	}
++
++	vif = cache->_c.mfc_parent;
++
++	if (!VIF_EXISTS(mrt, vif)) {
++		spin_unlock(&mrt_lock);
++		return -EINVAL;
++	}
++
++	mrt->vif_table[vif].pkt_in += pkts_in;
++	mrt->vif_table[vif].bytes_in += bytes_in;
++	cache->_c.mfc_un.res.pkt += pkts_out;
++	cache->_c.mfc_un.res.bytes += bytes_out;
++
++	for (vifi = cache->_c.mfc_un.res.minvif;
++			vifi < cache->_c.mfc_un.res.maxvif; vifi++) {
++		if ((cache->_c.mfc_un.res.ttls[vifi] > 0) &&
++		    (cache->_c.mfc_un.res.ttls[vifi] < 255)) {
++			if (!VIF_EXISTS(mrt, vifi)) {
++				spin_unlock(&mrt_lock);
++				return -EINVAL;
++			}
++			mrt->vif_table[vifi].pkt_out += pkts_out;
++			mrt->vif_table[vifi].bytes_out += bytes_out;
++		}
++	}
++
++	spin_unlock(&mrt_lock);
++	return 0;
++}
++EXPORT_SYMBOL(ip6mr_mfc_stats_update);
++/* QCA qca-mcs support - End */
++
+ /* Delete a VIF entry */
+ static int mif6_delete(struct mr_table *mrt, int vifi, int notify,
+ 		       struct list_head *head)
+@@ -1221,6 +1454,7 @@ static int ip6mr_mfc_delete(struct mr_ta
+ 			    int parent)
+ {
+ 	struct mfc6_cache *c;
++	struct in6_addr mc_origin, mc_group; /* QCA qca-mcs support */
+ 
+ 	/* The entries are added/deleted only under RTNL */
+ 	rcu_read_lock();
+@@ -1229,6 +1463,11 @@ static int ip6mr_mfc_delete(struct mr_ta
+ 	rcu_read_unlock();
+ 	if (!c)
+ 		return -ENOENT;
++
++	/* QCA qca-mcs support - Start */
++	memcpy(&mc_origin, &c->mf6c_origin, sizeof(struct in6_addr));
++	memcpy(&mc_group, &c->mf6c_mcastgrp, sizeof(struct in6_addr));
++	/* QCA qca-mcs support - End */
+ 	rhltable_remove(&mrt->mfc_hash, &c->_c.mnode, ip6mr_rht_params);
+ 	list_del_rcu(&c->_c.list);
+ 
+@@ -1236,6 +1475,11 @@ static int ip6mr_mfc_delete(struct mr_ta
+ 				       FIB_EVENT_ENTRY_DEL, c, mrt->id);
+ 	mr6_netlink_event(mrt, c, RTM_DELROUTE);
+ 	mr_cache_put(&c->_c);
++	/* QCA qca-mcs support - Start */
++	/* Inform offload modules of the delete event */
++	ip6mr_sync_entry_delete(&mc_origin, &mc_group);
++	/* QCA qca-mcs support - End */
++
+ 	return 0;
+ }
+ 
+@@ -1457,6 +1701,10 @@ static int ip6mr_mfc_add(struct net *net
+ 		call_ip6mr_mfc_entry_notifiers(net, FIB_EVENT_ENTRY_REPLACE,
+ 					       c, mrt->id);
+ 		mr6_netlink_event(mrt, c, RTM_NEWROUTE);
++		/* QCA qca-mcs support - Start */
++		/* Inform offload modules of the update event */
++		ip6mr_sync_entry_update(mrt, c);
++		/* QCA qca-mcs support - End */
+ 		return 0;
+ 	}
+ 
diff --git a/target/linux/qualcommax/patches-6.6/0980-2-Revert-crypto-api-disallow-identical-driver-names.patch b/target/linux/qualcommax/patches-6.6/0980-2-Revert-crypto-api-disallow-identical-driver-names.patch
new file mode 100644
index 00000000000000..3f7f58dfee5af2
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0980-2-Revert-crypto-api-disallow-identical-driver-names.patch
@@ -0,0 +1,10 @@
+--- a/crypto/algapi.c
++++ b/crypto/algapi.c
+@@ -341,7 +341,6 @@ __crypto_register_alg(struct crypto_alg
+ 		}
+ 
+ 		if (!strcmp(q->cra_driver_name, alg->cra_name) ||
+-		    !strcmp(q->cra_driver_name, alg->cra_driver_name) ||
+ 		    !strcmp(q->cra_name, alg->cra_driver_name))
+ 			goto err;
+ 	}
diff --git a/target/linux/qualcommax/patches-6.6/0980-3-mtd-silence-UBI-NAND-warnings.patch b/target/linux/qualcommax/patches-6.6/0980-3-mtd-silence-UBI-NAND-warnings.patch
new file mode 100644
index 00000000000000..646e683dc8df70
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0980-3-mtd-silence-UBI-NAND-warnings.patch
@@ -0,0 +1,13 @@
+--- a/drivers/mtd/mtdblock.c
++++ b/drivers/mtd/mtdblock.c
+@@ -261,10 +261,6 @@ static int mtdblock_open(struct mtd_blkt
+ 		return 0;
+ 	}
+ 
+-	if (mtd_type_is_nand(mbd->mtd))
+-		pr_warn_ratelimited("%s: MTD device '%s' is NAND, please consider using UBI block devices instead.\n",
+-			mbd->tr->name, mbd->mtd->name);
+-
+ 	/* OK, it's not open. Create cache info for it */
+ 	mtdblk->count = 1;
+ 	mutex_init(&mtdblk->cache_mutex);

From fc2041a125cfcb244a61693e93eaab34c43983ee Mon Sep 17 00:00:00 2001
From: Qosmio <datapronix@protonmail.com>
Date: Sun, 24 Mar 2024 23:37:32 -0400
Subject: [PATCH 100/225] cryptodev-linux: Add hooks for QCA NSS

---
 package/kernel/cryptodev-linux/Makefile       | 11 ++-
 .../patches/0005-add-qca-nss.patch            | 99 +++++++++++++++++++
 2 files changed, 109 insertions(+), 1 deletion(-)
 create mode 100644 package/kernel/cryptodev-linux/patches/0005-add-qca-nss.patch

diff --git a/package/kernel/cryptodev-linux/Makefile b/package/kernel/cryptodev-linux/Makefile
index 165cc60487b5b0..751cf9b81deae0 100644
--- a/package/kernel/cryptodev-linux/Makefile
+++ b/package/kernel/cryptodev-linux/Makefile
@@ -41,13 +41,22 @@ define KernelPackage/cryptodev/description
   via a "/dev/crypto" device.
 endef
 
+ifneq ($(CONFIG_PACKAGE_kmod-crypto-qce),)
+EXTRA_CFLAGS+=-DQCA
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-qca-nss-crypto),)
+EXTRA_CFLAGS+=-DQCANSS
+endif
+
 define Build/Configure
 endef
 
 define Build/Compile
 	$(MAKE) -C $(PKG_BUILD_DIR) \
 		$(KERNEL_MAKE_FLAGS) \
-		KERNEL_DIR="$(LINUX_DIR)"
+		KERNEL_DIR="$(LINUX_DIR)" \
+		EXTRA_CFLAGS="$(EXTRA_CFLAGS)"
 endef
 
 define Build/InstallDev
diff --git a/package/kernel/cryptodev-linux/patches/0005-add-qca-nss.patch b/package/kernel/cryptodev-linux/patches/0005-add-qca-nss.patch
new file mode 100644
index 00000000000000..4f467a18773467
--- /dev/null
+++ b/package/kernel/cryptodev-linux/patches/0005-add-qca-nss.patch
@@ -0,0 +1,99 @@
+--- a/ioctl.c
++++ b/ioctl.c
+@@ -829,29 +829,37 @@ static inline void tfm_info_to_alg_info(
+ 			"%s", crypto_tfm_alg_driver_name(tfm));
+ }
+ 
+-#ifndef CRYPTO_ALG_KERN_DRIVER_ONLY
++#if defined(QCANSS) || defined(QCA) || defined(MT7621) || defined(MT7622) || defined(LANTIQ) || defined(BCM675X) || defined(BCM49XX) || defined(MT798X)
+ static unsigned int is_known_accelerated(struct crypto_tfm *tfm)
+ {
+ 	const char *name = crypto_tfm_alg_driver_name(tfm);
+ 
+ 	if (name == NULL)
+-		return 1; /* assume accelerated */
++		return 0;
+ 
+ 	/* look for known crypto engine names */
+-	if (strstr(name, "-talitos")	||
+-	    !strncmp(name, "mv-", 3)	||
+-	    !strncmp(name, "atmel-", 6)	||
+-	    strstr(name, "geode")	||
+-	    strstr(name, "hifn")	||
+-	    strstr(name, "-ixp4xx")	||
+-	    strstr(name, "-omap")	||
+-	    strstr(name, "-picoxcell")	||
+-	    strstr(name, "-s5p")	||
+-	    strstr(name, "-ppc4xx")	||
+-	    strstr(name, "-caam")	||
+-	    strstr(name, "-n2"))
++#if defined(QCANSS)
++	if (!strncmp(name, "nss-", 4))
+ 		return 1;
+-
++#elif defined(QCA)
++	if (!strncmp(name, "qcrypto", 7))
++		return 1;
++#elif defined(MT7621)
++	if (strstr(name, "eip93"))
++		return 1;
++#elif defined(MT7622)
++	if (strstr(name, "mtk"))
++		return 1;
++#elif defined(MT798X)
++	if (strstr(name, "safexcel-"))
++		return 1;
++#elif defined(LANTIQ)
++	if (strstr(name, "ltq-crypto"))
++		return 1;
++#elif defined(BCM675X) || defined(BCM49XX)
++	if (strstr(name, "-iproc"))
++		return 1;
++#endif
+ 	return 0;
+ }
+ #endif
+@@ -876,22 +884,22 @@ static int get_session_info(struct fcryp
+ 		else
+ 			tfm = crypto_aead_tfm(ses_ptr->cdata.async.as);
+ 		tfm_info_to_alg_info(&siop->cipher_info, tfm);
+-#ifdef CRYPTO_ALG_KERN_DRIVER_ONLY
+-		if (tfm->__crt_alg->cra_flags & CRYPTO_ALG_KERN_DRIVER_ONLY)
++#if defined(QCANSS) || defined(QCA) || defined(MT7621) || defined(MT7622) || defined(LANTIQ) || defined(BCM675X) || defined(BCM49XX) || defined(MT798X)
++		if (is_known_accelerated(tfm))
+ 			siop->flags |= SIOP_FLAG_KERNEL_DRIVER_ONLY;
+ #else
+-		if (is_known_accelerated(tfm))
++		if (tfm->__crt_alg->cra_flags & CRYPTO_ALG_KERN_DRIVER_ONLY)
+ 			siop->flags |= SIOP_FLAG_KERNEL_DRIVER_ONLY;
+ #endif
+ 	}
+ 	if (ses_ptr->hdata.init) {
+ 		tfm = crypto_ahash_tfm(ses_ptr->hdata.async.s);
+ 		tfm_info_to_alg_info(&siop->hash_info, tfm);
+-#ifdef CRYPTO_ALG_KERN_DRIVER_ONLY
+-		if (tfm->__crt_alg->cra_flags & CRYPTO_ALG_KERN_DRIVER_ONLY)
++#if defined(QCANSS) || defined(QCA) || defined(MT7621) || defined(MT7622) || defined(LANTIQ) || defined(BCM675X) || defined(BCM49XX) || defined(MT798X)
++		if (is_known_accelerated(tfm))
+ 			siop->flags |= SIOP_FLAG_KERNEL_DRIVER_ONLY;
+ #else
+-		if (is_known_accelerated(tfm))
++		if (tfm->__crt_alg->cra_flags & CRYPTO_ALG_KERN_DRIVER_ONLY)
+ 			siop->flags |= SIOP_FLAG_KERNEL_DRIVER_ONLY;
+ #endif
+ 	}
+--- a/main.c
++++ b/main.c
+@@ -168,6 +168,12 @@ __crypto_run_zc(struct csession *ses_ptr
+ 	struct crypt_op *cop = &kcop->cop;
+ 	int ret = 0;
+ 
++#if defined(QCANSS)
++//openssl bug!!!
++	if (unlikely(cop->src != cop->dst)) {
++		return __crypto_run_std(ses_ptr, cop);
++	}
++#endif
+ 	ret = get_userbuf(ses_ptr, cop->src, cop->len, cop->dst, cop->len,
+ 	                  kcop->task, kcop->mm, &src_sg, &dst_sg);
+ 	if (unlikely(ret)) {

From d97b9332009b2bee1bf9d34916aa4f612d931cba Mon Sep 17 00:00:00 2001
From: Qosmio <datapronix@protonmail.com>
Date: Mon, 25 Mar 2024 00:07:45 -0400
Subject: [PATCH 101/225] feeds: NSS: point to 6.x branch

This will now be the default NSS branch, and will cover
both kernel 6.1 and 6.6 related changes going forward.

qualcommax: NSS: fix up 'nss_region'
---
 feeds.conf.default | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/feeds.conf.default b/feeds.conf.default
index 4527c3215a827e..68c55d271c0819 100644
--- a/feeds.conf.default
+++ b/feeds.conf.default
@@ -2,7 +2,7 @@ src-git packages https://git.openwrt.org/feed/packages.git
 src-git luci https://git.openwrt.org/project/luci.git
 src-git routing https://git.openwrt.org/feed/routing.git
 src-git telephony https://git.openwrt.org/feed/telephony.git
-src-git nss_packages https://github.com/qosmio/nss-packages.git;NSS-12.4-K6.1
+src-git nss_packages https://github.com/qosmio/nss-packages.git;NSS-12.4-K6.x
 src-git sqm_scripts_nss https://github.com/qosmio/sqm-scripts-nss.git
 #src-git video https://github.com/openwrt/video.git
 #src-git targets https://github.com/openwrt/targets.git

From afa5c9bf515a20b3a21d018d96a59defe9b6c6fd Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sun, 31 Mar 2024 19:16:29 -0400
Subject: [PATCH 102/225] qualcommax: disable swiotlb for 64mb in saving.

Disable software input output translation lookaside buffer (swiotlb) as
it wastes memory on low memory platforms (512m or less)

qualcommax: only disable swiotlb for platforms <= 512M

Disabling swiotlb is only required for platforms with 512M or less to save
64mb.
---
 ...com-disable-swiotlb-for-64mb-savings.patch | 99 +++++++++++++++++++
 1 file changed, 99 insertions(+)
 create mode 100644 target/linux/qualcommax/patches-6.6/0982-1-arm64-dts-qcom-disable-swiotlb-for-64mb-savings.patch

diff --git a/target/linux/qualcommax/patches-6.6/0982-1-arm64-dts-qcom-disable-swiotlb-for-64mb-savings.patch b/target/linux/qualcommax/patches-6.6/0982-1-arm64-dts-qcom-disable-swiotlb-for-64mb-savings.patch
new file mode 100644
index 00000000000000..bb610079aad154
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0982-1-arm64-dts-qcom-disable-swiotlb-for-64mb-savings.patch
@@ -0,0 +1,99 @@
+--- a/arch/arm64/boot/dts/qcom/ipq6010-wax214.dts
++++ b/arch/arm64/boot/dts/qcom/ipq6010-wax214.dts
+@@ -25,7 +25,7 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial0:115200n8";
+-		bootargs-append = " root=/dev/ubiblock0_1";
++		bootargs-append = " coherent_pool=2M swiotlb=noforce root=/dev/ubiblock0_1";
+ 	};
+ 
+ 	keys {
+--- a/arch/arm64/boot/dts/qcom/ipq8070-cax1800.dts
++++ b/arch/arm64/boot/dts/qcom/ipq8070-cax1800.dts
+@@ -27,7 +27,7 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial0:115200n8";
+-		bootargs-append = " root=/dev/ubiblock0_1";
++		bootargs-append = " coherent_pool=2M swiotlb=noforce root=/dev/ubiblock0_1";
+ 	};
+ 
+ 	keys {
+--- a/arch/arm64/boot/dts/qcom/ipq8070-rm2-6.dts
++++ b/arch/arm64/boot/dts/qcom/ipq8070-rm2-6.dts
+@@ -32,7 +32,7 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial0:115200n8";
+-		bootargs-append = " root=/dev/ubiblock0_1";
++		bootargs-append = " coherent_pool=2M swiotlb=noforce root=/dev/ubiblock0_1";
+ 	};
+ 
+ 	keys {
+--- a/arch/arm64/boot/dts/qcom/ipq8071-ax3600.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8071-ax3600.dtsi
+@@ -20,7 +20,7 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial0:115200n8";
+-		bootargs-append = " root=/dev/ubiblock0_0";
++		bootargs-append = " coherent_pool=2M swiotlb=noforce root=/dev/ubiblock0_0";
+ 	};
+ 
+ 	keys {
+--- a/arch/arm64/boot/dts/qcom/ipq8071-mf269.dts
++++ b/arch/arm64/boot/dts/qcom/ipq8071-mf269.dts
+@@ -24,7 +24,7 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial0:115200n8";
+-		bootargs-append = " root=/dev/ubiblock0_0";
++		bootargs-append = " coherent_pool=2M swiotlb=noforce root=/dev/ubiblock0_0";
+ 	};
+ 
+ 	keys {
+--- a/arch/arm64/boot/dts/qcom/ipq8072-ax880.dts
++++ b/arch/arm64/boot/dts/qcom/ipq8072-ax880.dts
+@@ -29,7 +29,7 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial0:115200n8";
+-		bootargs-append = " root=/dev/ubiblock0_1";
++		bootargs-append = " coherent_pool=2M swiotlb=noforce root=/dev/ubiblock0_1";
+ 	};
+ 
+ 	keys {
+--- a/arch/arm64/boot/dts/qcom/ipq8072-wax218.dts
++++ b/arch/arm64/boot/dts/qcom/ipq8072-wax218.dts
+@@ -27,7 +27,7 @@
+ 		 * Netgear's U-Boot adds "ubi.mtd=rootfs root=mtd:ubi_rootfs"
+ 		 * That fails to create a UBI block device, so add it here.
+ 		*/
+-		bootargs-append = " ubi.block=0,rootfs root=/dev/ubiblock0_1";
++		bootargs-append = " coherent_pool=2M swiotlb=noforce ubi.block=0,rootfs root=/dev/ubiblock0_1";
+ 	};
+ 
+ 	keys {
+--- a/arch/arm64/boot/dts/qcom/ipq8072-wpq873.dts
++++ b/arch/arm64/boot/dts/qcom/ipq8072-wpq873.dts
+@@ -31,7 +31,7 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial0:115200n8";
+-		bootargs-append = " root=/dev/ubiblock0_1";
++		bootargs-append = " coherent_pool=2M swiotlb=noforce root=/dev/ubiblock0_1";
+ 	};
+ 
+ 	keys {
+--- a/arch/arm64/boot/dts/qcom/ipq8174-mx4200.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8174-mx4200.dtsi
+@@ -29,7 +29,7 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial0:115200n8";
+-		bootargs-append = " root=/dev/ubiblock0_0";
++		bootargs-append = " coherent_pool=2M swiotlb=noforce root=/dev/ubiblock0_0";
+ 	};
+ 
+ 	keys {

From cb3afe321a23507f2f7b3fb86dbbce54a969222c Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Mon, 29 Apr 2024 21:50:56 -0400
Subject: [PATCH 103/225] qualcommax: qca-mcs support for kernel >= 6.6.29

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../0604-1-qca-add-mcs-support.patch          | 22 +++++++++----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/target/linux/qualcommax/patches-6.6/0604-1-qca-add-mcs-support.patch b/target/linux/qualcommax/patches-6.6/0604-1-qca-add-mcs-support.patch
index edf21700c3e94c..4b87366d84966a 100644
--- a/target/linux/qualcommax/patches-6.6/0604-1-qca-add-mcs-support.patch
+++ b/target/linux/qualcommax/patches-6.6/0604-1-qca-add-mcs-support.patch
@@ -39,15 +39,15 @@
   * added to the bridge private HW address list and all required ports
 --- a/net/bridge/br_private.h
 +++ b/net/bridge/br_private.h
-@@ -906,6 +906,7 @@ void br_manage_promisc(struct net_bridge
+@@ -907,6 +907,7 @@ void br_manage_promisc(struct net_bridge
  int nbp_backup_change(struct net_bridge_port *p, struct net_device *backup_dev);
  
  /* br_input.c */
-+int br_pass_frame_up(struct sk_buff *skb); /* QCA qca-mcs support */
++int br_pass_frame_up(struct sk_buff *skb, bool promisc); /* QCA qca-mcs support */
  int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb);
  rx_handler_func_t *br_get_rx_handler(const struct net_device *dev);
  
-@@ -2268,4 +2269,14 @@ struct nd_msg *br_is_nd_neigh_msg(struct
+@@ -2269,4 +2270,14 @@ struct nd_msg *br_is_nd_neigh_msg(struct
  bool br_is_neigh_suppress_enabled(const struct net_bridge_port *p, u16 vid);
  #define __br_get(__hook, __default, __args ...) \
  		(__hook ? (__hook(__args)) : (__default)) /* QCA NSS ECM support */
@@ -109,7 +109,7 @@
  	return netif_receive_skb(skb);
  }
  
--static int br_pass_frame_up(struct sk_buff *skb)
+-static int br_pass_frame_up(struct sk_buff *skb, bool promisc)
 +/* QCA qca-mcs support - Start */
 +/* Hook for external Multicast handler */
 +br_multicast_handle_hook_t __rcu *br_multicast_handle_hook __read_mostly;
@@ -120,11 +120,11 @@
 +EXPORT_SYMBOL_GPL(br_get_dst_hook);
 +/* QCA qca-mcs support - End */
 +
-+int br_pass_frame_up(struct sk_buff *skb)
++int br_pass_frame_up(struct sk_buff *skb, bool promisc)
  {
  	struct net_device *indev, *brdev = BR_INPUT_SKB_CB(skb)->brdev;
  	struct net_bridge *br = netdev_priv(brdev);
-@@ -69,6 +79,7 @@ static int br_pass_frame_up(struct sk_bu
+@@ -71,6 +81,7 @@ static int br_pass_frame_up(struct sk_bu
  		       dev_net(indev), NULL, skb, indev, NULL,
  		       br_netif_receive_skb);
  }
@@ -132,7 +132,7 @@
  
  /* note: already called with rcu_read_lock */
  int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
-@@ -82,6 +93,11 @@ int br_handle_frame_finish(struct net *n
+@@ -84,6 +95,11 @@ int br_handle_frame_finish(struct net *n
  	struct net_bridge_mcast *brmctx;
  	struct net_bridge_vlan *vlan;
  	struct net_bridge *br;
@@ -141,10 +141,10 @@
 +	struct net_bridge_port *pdst = NULL;
 +	br_get_dst_hook_t *get_dst_hook = rcu_dereference(br_get_dst_hook);
 +	/* QCA qca-mcs support - End */
+ 	bool promisc;
  	u16 vid = 0;
  	u8 state;
- 
-@@ -175,6 +191,12 @@ int br_handle_frame_finish(struct net *n
+@@ -180,6 +196,12 @@ int br_handle_frame_finish(struct net *n
  
  	switch (pkt_type) {
  	case BR_PKT_MULTICAST:
@@ -157,7 +157,7 @@
  		mdst = br_mdb_get(brmctx, skb, vid);
  		if ((mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) &&
  		    br_multicast_querier_exists(brmctx, eth_hdr(skb), mdst)) {
-@@ -190,8 +212,15 @@ int br_handle_frame_finish(struct net *n
+@@ -195,8 +217,15 @@ int br_handle_frame_finish(struct net *n
  		}
  		break;
  	case BR_PKT_UNICAST:
@@ -175,7 +175,7 @@
  	default:
  		break;
  	}
-@@ -206,6 +235,13 @@ int br_handle_frame_finish(struct net *n
+@@ -211,6 +240,13 @@ int br_handle_frame_finish(struct net *n
  			dst->used = now;
  		br_forward(dst->dst, skb, local_rcv, false);
  	} else {

From eb7fa7cd62e40cc9aed77963ed0c23f68665c1f6 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sun, 5 May 2024 00:59:15 -0400
Subject: [PATCH 104/225] feeds: nss-packages: switch to branch 12.5-6.x

---
 feeds.conf.default | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/feeds.conf.default b/feeds.conf.default
index 68c55d271c0819..5e40f047d6b5f4 100644
--- a/feeds.conf.default
+++ b/feeds.conf.default
@@ -2,7 +2,7 @@ src-git packages https://git.openwrt.org/feed/packages.git
 src-git luci https://git.openwrt.org/project/luci.git
 src-git routing https://git.openwrt.org/feed/routing.git
 src-git telephony https://git.openwrt.org/feed/telephony.git
-src-git nss_packages https://github.com/qosmio/nss-packages.git;NSS-12.4-K6.x
+src-git nss_packages https://github.com/qosmio/nss-packages.git;NSS-12.5-K6.x
 src-git sqm_scripts_nss https://github.com/qosmio/sqm-scripts-nss.git
 #src-git video https://github.com/openwrt/video.git
 #src-git targets https://github.com/openwrt/targets.git

From e2a43013e26f4a661e9eca033f309118b96d8e6e Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sun, 5 May 2024 01:02:03 -0400
Subject: [PATCH 105/225] ath11k_nss: fix invalid access to memory

In ath11k_dp_rx_msdu_coalesce(), rxcb is fetched from skb and bool
is_continuation is part of rxcb.

Currently, after freeing the skb, the rxcb->is_continuation accessed
again which is wrong since the memory is already freed.

Hence fix the issue by locally defining bool is_continuation from rxcb,
so that after freeing skb also we can use is_continuation.

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...-ath11k-fix-invalid-access-to-memory.patch | 47 +++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/909-wifi-ath11k-fix-invalid-access-to-memory.patch

diff --git a/package/kernel/mac80211/patches/nss/ath11k/909-wifi-ath11k-fix-invalid-access-to-memory.patch b/package/kernel/mac80211/patches/nss/ath11k/909-wifi-ath11k-fix-invalid-access-to-memory.patch
new file mode 100644
index 00000000000000..da069c0de63163
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/909-wifi-ath11k-fix-invalid-access-to-memory.patch
@@ -0,0 +1,47 @@
+From cea94c73e068ce4e015327bf251f782545d8e365 Mon Sep 17 00:00:00 2001
+From: Sarika Sharma <quic_sarishar@quicinc.com>
+Date: Mon, 29 Jan 2024 16:01:23 +0530
+Subject: [PATCH] wifi: ath11k: fix invalid access to memory
+
+In ath11k_dp_rx_msdu_coalesce(), rxcb is fetched from skb and bool
+is_continuation is part of rxcb.
+Currently, after freeing the skb, the rxcb->is_continuation accessed
+again which is wrong since the memory is already freed.
+
+Hence fix the issue by locally defining bool is_continuation from rxcb,
+so that after freeing skb also we can use is_continuation.
+
+Signed-off-by: Sarika Sharma <quic_sarishar@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -2202,6 +2202,7 @@ static int ath11k_dp_rx_msdu_coalesce(st
+ 	struct hal_rx_desc *ldesc;
+ 	int space_extra, rem_len, buf_len;
+ 	u32 hal_rx_desc_sz = ar->ab->hw_params.hal_desc_sz;
++	bool is_continuation;
+ 
+ 	/* As the msdu is spread across multiple rx buffers,
+ 	 * find the offset to the start of msdu for computing
+@@ -2250,7 +2251,8 @@ static int ath11k_dp_rx_msdu_coalesce(st
+ 	rem_len = msdu_len - buf_first_len;
+ 	while ((skb = __skb_dequeue(msdu_list)) != NULL && rem_len > 0) {
+ 		rxcb = ATH11K_SKB_RXCB(skb);
+-		if (rxcb->is_continuation)
++		is_continuation = rxcb->is_continuation;
++		if (is_continuation)
+ 			buf_len = DP_RX_BUFFER_SIZE - hal_rx_desc_sz;
+ 		else
+ 			buf_len = rem_len;
+@@ -2268,7 +2270,7 @@ static int ath11k_dp_rx_msdu_coalesce(st
+ 		dev_kfree_skb_any(skb);
+ 
+ 		rem_len -= buf_len;
+-		if (!rxcb->is_continuation)
++		if (!is_continuation)
+ 			break;
+ 	}
+ 

From f8c62a242a737851ae1dd04be9cbf1de1983622d Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Tue, 7 May 2024 02:31:32 -0400
Subject: [PATCH 106/225] qualcommax: NSS: Add support for all ipq807x targets

NSS offload feature should be available for all IPQ807x/IPQ817x targets.

* Arcadyan AW1000
* CMCC RM2-6
* Linksys MX4200 V1/V2
* Linksys MX5300
* Sagemcom Fast 5285 Spectrum SAXV1V1S
* Yuncore AX880
* ZBT Z800AX
* ZTE MF269

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../qualcommax/files/arch/arm64/boot/dts/qcom/ipq8070-rm2-6.dts  | 1 +
 .../qualcommax/files/arch/arm64/boot/dts/qcom/ipq8071-mf269.dts  | 1 +
 .../qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-aw1000.dts | 1 +
 .../qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-ax880.dts  | 1 +
 .../qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-mx5300.dts | 1 +
 .../files/arch/arm64/boot/dts/qcom/ipq8072-sax1v1k.dts           | 1 +
 .../files/arch/arm64/boot/dts/qcom/ipq8072-zbt-z800ax.dts        | 1 +
 .../files/arch/arm64/boot/dts/qcom/ipq8174-mx4200.dtsi           | 1 +
 8 files changed, 8 insertions(+)

diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8070-rm2-6.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8070-rm2-6.dts
index 5d3123f75ea3ff..52a9468f99be54 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8070-rm2-6.dts
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8070-rm2-6.dts
@@ -5,6 +5,7 @@
 #include "ipq8074-512m.dtsi"
 #include "ipq8074-ac-cpu.dtsi"
 #include "ipq8074-ess.dtsi"
+#include "ipq8074-nss.dtsi"
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/leds/common.h>
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8071-mf269.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8071-mf269.dts
index 866ed5e9c35011..c5b21bd29abc6c 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8071-mf269.dts
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8071-mf269.dts
@@ -5,6 +5,7 @@
 #include "ipq8074-512m.dtsi"
 #include "ipq8074-ac-cpu.dtsi"
 #include "ipq8074-ess.dtsi"
+#include "ipq8074-nss.dtsi"
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/leds/common.h>
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-aw1000.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-aw1000.dts
index c85e9f1993aa33..fbad0e79e5010c 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-aw1000.dts
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-aw1000.dts
@@ -6,6 +6,7 @@
 #include "ipq8074.dtsi"
 #include "ipq8074-hk-cpu.dtsi"
 #include "ipq8074-ess.dtsi"
+#include "ipq8074-nss.dtsi"
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/leds/common.h>
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-ax880.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-ax880.dts
index 23e89a9ae42d31..af5a497b39acac 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-ax880.dts
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-ax880.dts
@@ -6,6 +6,7 @@
 #include "ipq8074.dtsi"
 #include "ipq8074-hk-cpu.dtsi"
 #include "ipq8074-ess.dtsi"
+#include "ipq8074-nss.dtsi"
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/leds/common.h>
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-mx5300.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-mx5300.dts
index 9d28f2ad0d4aec..6e2e95c00a3de8 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-mx5300.dts
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-mx5300.dts
@@ -5,6 +5,7 @@
 #include "ipq8074.dtsi"
 #include "ipq8074-hk-cpu.dtsi"
 #include "ipq8074-ess.dtsi"
+#include "ipq8074-nss.dtsi"
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/leds/common.h>
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-sax1v1k.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-sax1v1k.dts
index fbb652a097b05f..4ce99b1836675e 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-sax1v1k.dts
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-sax1v1k.dts
@@ -5,6 +5,7 @@
 #include "ipq8074.dtsi"
 #include "ipq8074-hk-cpu.dtsi"
 #include "ipq8074-ess.dtsi"
+#include "ipq8074-nss.dtsi"
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/leds/common.h>
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-zbt-z800ax.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-zbt-z800ax.dts
index 814a7cb2bd9df1..2398bf92959c99 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-zbt-z800ax.dts
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-zbt-z800ax.dts
@@ -5,6 +5,7 @@
 #include "ipq8074.dtsi"
 #include "ipq8074-hk-cpu.dtsi"
 #include "ipq8074-ess.dtsi"
+#include "ipq8074-nss.dtsi"
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/leds/common.h>
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8174-mx4200.dtsi b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8174-mx4200.dtsi
index 13ce8d16016860..741c00bdcb9f56 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8174-mx4200.dtsi
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8174-mx4200.dtsi
@@ -4,6 +4,7 @@
 #include "ipq8074.dtsi"
 #include "ipq8074-ac-cpu.dtsi"
 #include "ipq8074-ess.dtsi"
+#include "ipq8074-nss.dtsi"
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/leds/common.h>

From 1af0cdfde30e3e4a52c7b69ed38cb7f22d8362b9 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Wed, 15 May 2024 02:02:31 -0400
Subject: [PATCH 107/225] ath11k_nss: revert AMPDU in radiotap header

Causes issues with rate stats on IPQ9074

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...d-ampdu-id-in-802.11-radiotap-header.patch | 279 ------------------
 1 file changed, 279 deletions(-)
 delete mode 100644 package/kernel/mac80211/patches/nss/ath11k/999-312-ath11k-add-ampdu-id-in-802.11-radiotap-header.patch

diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-312-ath11k-add-ampdu-id-in-802.11-radiotap-header.patch b/package/kernel/mac80211/patches/nss/ath11k/999-312-ath11k-add-ampdu-id-in-802.11-radiotap-header.patch
deleted file mode 100644
index 12a035bf4e5790..00000000000000
--- a/package/kernel/mac80211/patches/nss/ath11k/999-312-ath11k-add-ampdu-id-in-802.11-radiotap-header.patch
+++ /dev/null
@@ -1,279 +0,0 @@
-From 3f962ed9a4079964c48e321fd928a2719038d881 Mon Sep 17 00:00:00 2001
-From: P Praneesh <ppranees@codeaurora.org>
-Date: Fri, 28 May 2021 23:53:57 +0530
-Subject: [PATCH] ath11k: add ampdu id in 802.11 radiotap header
-
-AMPDU aggregate reference number is generated by
-driver internally which is same across each
-subframe of an ampdu.
-
-For fetching AMPDU-ID, we need to concatenate
-ppdu_id from mpdu_info and tlv_usr from tlv heder.
-while parsing monitor TLV data with HAL_RX_MPDU_START
-TLV tag, ampdu id is fetched from mpdu_info and
-updated to corresponding mac80211 structure during
-ath11k_update_radiotap.
-
-Signed-off-by: P Praneesh <ppranees@codeaurora.org>
----
- drivers/net/wireless/ath/ath11k/dp_rx.c  |  6 ++++++
- drivers/net/wireless/ath/ath11k/hal_rx.c | 13 ++++++++++++
- drivers/net/wireless/ath/ath11k/hal_rx.h | 16 ++++++++------
- drivers/net/wireless/ath/ath11k/hw.c     | 36 +++++++++++++++++++++++++-------
- drivers/net/wireless/ath/ath11k/hw.h     |  1 +
- 5 files changed, 58 insertions(+), 14 deletions(-)
-
---- a/drivers/net/wireless/ath/ath11k/dp_rx.c
-+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -5995,6 +5995,7 @@ static void ath11k_update_radiotap(struc
- {
- 	struct ieee80211_supported_band *sband;
- 	u8 *ptr = NULL;
-+	u16 ampdu_id = ppduinfo->ampdu_id[ppduinfo->userid];
- 
- 	rxs->flag |= RX_FLAG_MACTIME_START;
- 	rxs->signal = ppduinfo->rssi_comb + ATH11K_DEFAULT_NOISE_FLOOR;
-@@ -6002,6 +6003,11 @@ static void ath11k_update_radiotap(struc
- 	if (ppduinfo->nss)
- 		rxs->nss = ppduinfo->nss;
- 
-+	if (ampdu_id) {
-+		rxs->flag |= RX_FLAG_AMPDU_DETAILS;
-+		rxs->ampdu_reference = ampdu_id;
-+	}
-+
- 	if (ppduinfo->he_mu_flags) {
- 		rxs->flag |= RX_FLAG_RADIOTAP_HE_MU;
- 		rxs->encoding = RX_ENC_HE;
---- a/drivers/net/wireless/ath/ath11k/hal_rx.c
-+++ b/drivers/net/wireless/ath/ath11k/hal_rx.c
-@@ -873,6 +873,13 @@ static u16 ath11k_hal_rx_mpduinfo_get_pe
- 	return ab->hw_params.hw_ops->mpdu_info_get_peerid(mpdu_info);
- }
- 
-+static
-+u16 ath11k_hal_rxdesc_get_hal_mpdu_ppdu_id(struct ath11k_base *ab,
-+					   struct hal_rx_mpdu_info *mpdu_info)
-+{
-+	return ab->hw_params.hw_ops->rx_desc_get_hal_ppdu_id(mpdu_info);
-+}
-+
- static enum hal_rx_mon_status
- ath11k_hal_rx_parse_mon_status_tlv(struct ath11k_base *ab,
- 				   struct hal_rx_mon_ppdu_info *ppdu_info,
-@@ -1546,6 +1553,12 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
- 
- 		ppdu_info->mpdu_len += ab->hw_params.hw_ops->rx_desc_get_hal_mpdu_len(mpdu_info);
- 
-+		if (userid < HAL_MAX_UL_MU_USERS) {
-+			ppdu_info->userid = userid;
-+			ppdu_info->ampdu_id[userid] =
-+				ath11k_hal_rxdesc_get_hal_mpdu_ppdu_id(ab, mpdu_info);
-+		}
-+
- 		break;
- 	}
- 	case HAL_RXPCU_PPDU_END_INFO: {
---- a/drivers/net/wireless/ath/ath11k/hal_rx.h
-+++ b/drivers/net/wireless/ath/ath11k/hal_rx.h
-@@ -221,6 +221,8 @@ struct hal_rx_mon_ppdu_info {
- 	u32 num_users;
- 	u32 mpdu_fcs_ok_bitmap[HAL_RX_NUM_WORDS_PER_PPDU_BITMAP];
- 	struct hal_rx_user_status userstats[HAL_MAX_UL_MU_USERS];
-+	u8 userid;
-+	u16 ampdu_id[HAL_MAX_UL_MU_USERS];
- 	bool ppdu_continuation;
- };
- 
-@@ -460,20 +462,22 @@ struct hal_rx_phyrx_rssi_legacy_info {
- #define HAL_RX_MPDU_INFO_INFO0_PEERID	GENMASK(31, 16)
- #define HAL_RX_MPDU_INFO_INFO0_PEERID_WCN6855	GENMASK(15, 0)
- #define HAL_RX_MPDU_INFO_INFO1_MPDU_LEN		GENMASK(13, 0)
-+#define HAL_RX_MPDU_INFO_INFO0_PPDU_ID		GENMASK(31, 16)
- 
- struct hal_rx_mpdu_info_ipq8074 {
--	__le32 rsvd0;
- 	__le32 info0;
--	__le32 rsvd1[11];
- 	__le32 info1;
-+	__le32 rsvd1[11];
-+	__le32 info2;
- 	__le32 rsvd2[9];
- } __packed;
- 
- struct hal_rx_mpdu_info_qcn9074 {
--	__le32 rsvd0[10];
-+	__le32 rsvd0[9];
- 	__le32 info0;
--	__le32 rsvd1[2];
- 	__le32 info1;
-+	__le32 rsvd1[2];
-+	__le32 info2;
- 	__le32 rsvd2[9];
- } __packed;
- 
-@@ -493,9 +497,11 @@ struct hal_rx_mpdu_info {
- 
- #define HAL_RX_PPDU_END_DURATION	GENMASK(23, 0)
- struct hal_rx_ppdu_end_duration {
--	__le32 rsvd0[9];
-+	__le32 rsvd0[2];
- 	__le32 info0;
--	__le32 rsvd1[4];
-+	__le32 rsvd1[6];
-+	__le32 info1;
-+	__le32 rsvd2[4];
- } __packed;
- 
- struct hal_rx_rxpcu_classification_overview {
---- a/drivers/net/wireless/ath/ath11k/hw.h
-+++ b/drivers/net/wireless/ath/ath11k/hw.h
-@@ -307,6 +307,7 @@ struct ath11k_hw_ops {
- 	void (*rx_desc_get_crypto_header)(struct hal_rx_desc *desc,
- 					  u8 *crypto_hdr,
- 					  enum hal_encrypt_type enctype);
-+	u16 (*rx_desc_get_hal_ppdu_id) (struct hal_rx_mpdu_info *mpdu_info);
- };
- 
- extern const struct ath11k_hw_ops ipq8074_ops;
---- a/drivers/net/wireless/ath/ath11k/hw.c
-+++ b/drivers/net/wireless/ath/ath11k/hw.c
-@@ -13,6 +13,7 @@
- #include "hif.h"
- #include "hal.h"
- #include "hw.h"
-+#include "hal_rx.h"
- 
- /* Map from pdev index to hw mac index */
- static u8 ath11k_hw_ipq8074_mac_from_pdev_id(int pdev_idx)
-@@ -717,17 +718,6 @@ static u8 *ath11k_hw_qcn9074_rx_desc_get
- 	return &desc->u.qcn9074.msdu_payload[0];
- }
- 
--static bool ath11k_hw_ipq9074_rx_desc_mac_addr2_valid(struct hal_rx_desc *desc)
--{
--	return __le32_to_cpu(desc->u.qcn9074.mpdu_start.info11) &
--	       RX_MPDU_START_INFO11_MAC_ADDR2_VALID;
--}
--
--static u8 *ath11k_hw_ipq9074_rx_desc_mpdu_start_addr2(struct hal_rx_desc *desc)
--{
--	return desc->u.qcn9074.mpdu_start.addr2;
--}
--
- static bool ath11k_hw_wcn6855_rx_desc_get_first_msdu(struct hal_rx_desc *desc)
- {
- 	return !!FIELD_GET(RX_MSDU_END_INFO2_FIRST_MSDU_WCN6855,
-@@ -1085,12 +1075,27 @@ static void ath11k_hw_ipq5018_reo_setup(
- }
- 
- static u16
-+ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_ppdu_id(struct hal_rx_mpdu_info *mpdu_info)
-+{
-+
-+	return FIELD_GET(HAL_RX_MPDU_INFO_INFO0_PPDU_ID,
-+			 __le32_to_cpu(mpdu_info->u.ipq8074.info0));
-+}
-+
-+static
-+u16 ath11k_hw_qcn9074_rx_desc_get_hal_mpdu_ppdu_id(struct hal_rx_mpdu_info *mpdu_info)
-+{
-+
-+	return FIELD_GET(HAL_RX_MPDU_INFO_INFO0_PPDU_ID,
-+			 __le32_to_cpu(mpdu_info->u.qcn9074.info0));
-+}
-+
-+static u16
- ath11k_hw_ipq8074_mpdu_info_get_peerid(struct hal_rx_mpdu_info *mpdu_info)
- {
- 	u16 peer_id = 0;
--
- 	peer_id = FIELD_GET(HAL_RX_MPDU_INFO_INFO0_PEERID,
--			    __le32_to_cpu(mpdu_info->u.ipq8074.info0));
-+			    __le32_to_cpu(mpdu_info->u.ipq8074.info1));
- 
- 	return peer_id;
- }
-@@ -1196,6 +1201,7 @@ const struct ath11k_hw_ops ipq8074_ops =
- 	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2,
- 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
- 	.rx_desc_get_hal_mpdu_len = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_len,
-+	.rx_desc_get_hal_ppdu_id = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_ppdu_id,
- #ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
- 	.rx_desc_get_offset = ath11k_hw_ipq8074_rx_desc_get_offset,
- #endif
-@@ -1219,6 +1225,7 @@ const struct ath11k_hw_ops ipq6018_ops =
- 	.rx_desc_get_encrypt_type = ath11k_hw_ipq8074_rx_desc_get_encrypt_type,
- 	.rx_desc_get_decap_type = ath11k_hw_ipq8074_rx_desc_get_decap_type,
- 	.rx_desc_get_mesh_ctl = ath11k_hw_ipq8074_rx_desc_get_mesh_ctl,
-+	.rx_desc_get_ip_valid = ath11k_hw_ipq8074_rx_desc_get_ip_valid,
- 	.rx_desc_get_ldpc_support = ath11k_hw_ipq8074_rx_desc_get_ldpc_support,
- 	.rx_desc_get_mpdu_seq_ctl_vld = ath11k_hw_ipq8074_rx_desc_get_mpdu_seq_ctl_vld,
- 	.rx_desc_get_mpdu_fc_valid = ath11k_hw_ipq8074_rx_desc_get_mpdu_fc_valid,
-@@ -1251,6 +1258,7 @@ const struct ath11k_hw_ops ipq6018_ops =
- 	.rx_desc_dot11_hdr_fields_valid = ath11k_hw_ipq8074_rx_desc_dot11_hdr_fields_valid,
- 	.rx_desc_get_dot11_hdr = ath11k_hw_ipq8074_rx_desc_get_dot11_hdr,
- 	.rx_desc_get_crypto_header = ath11k_hw_ipq8074_rx_desc_get_crypto_hdr,
-+	.rx_desc_get_hal_ppdu_id = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_ppdu_id,
- };
- 
- const struct ath11k_hw_ops qca6390_ops = {
-@@ -1300,6 +1308,7 @@ const struct ath11k_hw_ops qca6390_ops =
- 	.rx_desc_dot11_hdr_fields_valid = ath11k_hw_ipq8074_rx_desc_dot11_hdr_fields_valid,
- 	.rx_desc_get_dot11_hdr = ath11k_hw_ipq8074_rx_desc_get_dot11_hdr,
- 	.rx_desc_get_crypto_header = ath11k_hw_ipq8074_rx_desc_get_crypto_hdr,
-+	.rx_desc_get_hal_ppdu_id = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_ppdu_id,
- };
- 
- const struct ath11k_hw_ops qcn9074_ops = {
-@@ -1341,6 +1350,7 @@ const struct ath11k_hw_ops qcn9074_ops =
- 	.rx_desc_mpdu_start_addr2 = ath11k_hw_qcn9074_rx_desc_mpdu_start_addr2,
- 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
- 	.rx_desc_get_hal_mpdu_len = ath11k_hw_qcn9074_rx_desc_get_hal_mpdu_len,
-+	.rx_desc_get_hal_ppdu_id = ath11k_hw_qcn9074_rx_desc_get_hal_mpdu_ppdu_id,
- #ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
- 	.rx_desc_get_offset = ath11k_hw_qcn9074_rx_desc_get_offset,
- #endif
-@@ -1389,6 +1399,7 @@ const struct ath11k_hw_ops wcn6855_ops =
- 	.rx_desc_mpdu_start_addr2 = ath11k_hw_wcn6855_rx_desc_mpdu_start_addr2,
- 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
- 	.rx_desc_get_hal_mpdu_len = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_len,
-+	.rx_desc_get_hal_ppdu_id = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_ppdu_id,
- };
- 
- const struct ath11k_hw_ops wcn6750_ops = {
-@@ -1405,6 +1416,7 @@ const struct ath11k_hw_ops wcn6750_ops =
- 	.rx_desc_get_encrypt_type = ath11k_hw_qcn9074_rx_desc_get_encrypt_type,
- 	.rx_desc_get_decap_type = ath11k_hw_qcn9074_rx_desc_get_decap_type,
- 	.rx_desc_get_mesh_ctl = ath11k_hw_qcn9074_rx_desc_get_mesh_ctl,
-+	.rx_desc_get_ip_valid = ath11k_hw_qcn9074_rx_desc_get_ip_valid,
- 	.rx_desc_get_ldpc_support = ath11k_hw_qcn9074_rx_desc_get_ldpc_support,
- 	.rx_desc_get_mpdu_seq_ctl_vld = ath11k_hw_qcn9074_rx_desc_get_mpdu_seq_ctl_vld,
- 	.rx_desc_get_mpdu_fc_valid = ath11k_hw_qcn9074_rx_desc_get_mpdu_fc_valid,
-@@ -1426,9 +1438,10 @@ const struct ath11k_hw_ops wcn6750_ops =
- 	.rx_desc_get_msdu_payload = ath11k_hw_qcn9074_rx_desc_get_msdu_payload,
- 	.reo_setup = ath11k_hw_wcn6855_reo_setup,
- 	.mpdu_info_get_peerid = ath11k_hw_ipq8074_mpdu_info_get_peerid,
--	.rx_desc_mac_addr2_valid = ath11k_hw_ipq9074_rx_desc_mac_addr2_valid,
--	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq9074_rx_desc_mpdu_start_addr2,
-+	.rx_desc_mac_addr2_valid = ath11k_hw_qcn9074_rx_desc_mac_addr2_valid,
-+	.rx_desc_mpdu_start_addr2 = ath11k_hw_qcn9074_rx_desc_mpdu_start_addr2,
- 	.get_ring_selector = ath11k_hw_wcn6750_get_tcl_ring_selector,
-+	.rx_desc_get_hal_ppdu_id = ath11k_hw_qcn9074_rx_desc_get_hal_mpdu_ppdu_id,
- };
- 
- /* IPQ5018 hw ops is similar to QCN9074 except for the dest ring remap */
-@@ -1468,10 +1481,11 @@ const struct ath11k_hw_ops ipq5018_ops =
- 	.reo_setup = ath11k_hw_ipq5018_reo_setup,
- 	.rx_desc_get_msdu_payload = ath11k_hw_qcn9074_rx_desc_get_msdu_payload,
- 	.mpdu_info_get_peerid = ath11k_hw_ipq8074_mpdu_info_get_peerid,
--	.rx_desc_mac_addr2_valid = ath11k_hw_ipq9074_rx_desc_mac_addr2_valid,
--	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq9074_rx_desc_mpdu_start_addr2,
-+	.rx_desc_mac_addr2_valid = ath11k_hw_qcn9074_rx_desc_mac_addr2_valid,
-+	.rx_desc_mpdu_start_addr2 = ath11k_hw_qcn9074_rx_desc_mpdu_start_addr2,
- 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
- 	.rx_desc_get_hal_mpdu_len = ath11k_hw_qcn9074_rx_desc_get_hal_mpdu_len,
-+	.rx_desc_get_hal_ppdu_id = ath11k_hw_qcn9074_rx_desc_get_hal_mpdu_ppdu_id,
- };
- 
- #define ATH11K_TX_RING_MASK_0 BIT(0)

From 8b7090a9637b6b19fb9a209a07ee7ef253caadcf Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 25 May 2024 15:20:58 -0400
Subject: [PATCH 108/225] qualcommax: NSS: Set required NSS packages and
 options

---
 package/kernel/mac80211/ath.mk            | 5 +++++
 target/linux/qualcommax/ipq807x/target.mk | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/package/kernel/mac80211/ath.mk b/package/kernel/mac80211/ath.mk
index a757d685f1bd36..5c382d43f78389 100644
--- a/package/kernel/mac80211/ath.mk
+++ b/package/kernel/mac80211/ath.mk
@@ -377,11 +377,16 @@ define KernelPackage/ath11k/config
                	 TARGET_qualcommax_ipq807x_DEVICE_xiaomi_ax3600 || \
                	 TARGET_qualcommax_ipq807x_DEVICE_zte_mf269 )
                select ATH11K_MEM_PROFILE_256M if TARGET_qualcommax_ipq807x_DEVICE_netgear_wax218
+               default y
+               help
+                  Say Y to enable NSS WiFi offload support. Ensure you enable feeds for NSS drivers.
+                  https://github.com/qosmio/nss-packages
 
        config ATH11K_NSS_MESH_SUPPORT
                bool "Enable NSS WiFi Mesh offload"
                depends on ATH11K_NSS_SUPPORT
                select PACKAGE_MAC80211_MESH
+               select NSS_FIRMWARE_VERSION_11_4
                default n
 
        choice
diff --git a/target/linux/qualcommax/ipq807x/target.mk b/target/linux/qualcommax/ipq807x/target.mk
index 22a9b78d592df4..b4af8fa4233489 100644
--- a/target/linux/qualcommax/ipq807x/target.mk
+++ b/target/linux/qualcommax/ipq807x/target.mk
@@ -1,6 +1,6 @@
 SUBTARGET:=ipq807x
 BOARDNAME:=Qualcomm Atheros IPQ807x
-DEFAULT_PACKAGES += kmod-phy-aquantia ath11k-firmware-ipq8074
+DEFAULT_PACKAGES += kmod-phy-aquantia ath11k-firmware-ipq8074 kmod-qca-nss-ecm kmod-qca-nss-drv
 
 define Target/Description
 	Build firmware images for Qualcomm Atheros IPQ807x based boards.

From dd9e6a04e8dd922b621aeece2696295fa92ee22d Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 1 Jun 2024 17:16:21 -0400
Subject: [PATCH 109/225] iproute2: Fixup NSS patches for GCC 14.x

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../iproute2/patches/400-add-nss-qdisc.patch  | 69 +++++++++----------
 .../iproute2/patches/500-add-nssmirred.patch  |  4 +-
 2 files changed, 36 insertions(+), 37 deletions(-)

diff --git a/package/network/utils/iproute2/patches/400-add-nss-qdisc.patch b/package/network/utils/iproute2/patches/400-add-nss-qdisc.patch
index 299710f79169d0..a50b8b81a3e3d6 100644
--- a/package/network/utils/iproute2/patches/400-add-nss-qdisc.patch
+++ b/package/network/utils/iproute2/patches/400-add-nss-qdisc.patch
@@ -264,7 +264,7 @@
  
 --- /dev/null
 +++ b/tc/q_nss.c
-@@ -0,0 +1,1826 @@
+@@ -0,0 +1,1825 @@
 +/*
 + **************************************************************************
 + * Copyright (c) 2015, 2018 The Linux Foundation. All rights reserved.
@@ -310,7 +310,7 @@
 +	fprintf(stderr, "            nsswred limit BYTES DP NUMBER min BYTES max BYTES avpkt BYTES dscp NUMBER [ probability VALUE ] [ burst PACKETS ]\n");
 +}
 +
-+static int nsswred_setup(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++static int nsswred_setup(const struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
 +{
 +	struct rtattr *tail;
 +	struct tc_nsswred_qopt opt;
@@ -385,7 +385,7 @@
 +	return 0;
 +}
 +
-+static int nsswred_parse_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++static int nsswred_parse_opt(const struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n, const char *dev)
 +{
 +	struct rtattr *tail;
 +	struct tc_nsswred_qopt opt;
@@ -534,7 +534,7 @@
 +	return 0;
 +}
 +
-+static int nsswred_print_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++static int nsswred_print_opt(const struct qdisc_util *qu, FILE *f, struct rtattr *opt)
 +{
 +	struct rtattr *tb[TCA_NSSWRED_MAX + 1];
 +	struct tc_nsswred_qopt *qopt;
@@ -602,7 +602,7 @@
 +	fprintf(stderr, "Usage: ...  nsspfifo [ limit PACKETS ] [ set_default ] [ accel_mode ]\n");
 +}
 +
-+static int nssfifo_parse_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++static int nssfifo_parse_opt(const struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n, const char *dev)
 +{
 +	struct rtattr *tail;
 +	struct tc_nssfifo_qopt opt;
@@ -652,7 +652,7 @@
 +	return 0;
 +}
 +
-+static int nssfifo_print_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++static int nssfifo_print_opt(const struct qdisc_util *qu, FILE *f, struct rtattr *opt)
 +{
 +	struct rtattr *tb[TCA_NSSFIFO_MAX + 1];
 +	struct tc_nssfifo_qopt *qopt;
@@ -709,7 +709,7 @@
 +	fprintf(stderr, "Value of target and interval should be greater than 1ms\n");
 +}
 +
-+static int nssfq_codel_parse_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++static int nssfq_codel_parse_opt(const struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n, const char *dev)
 +{
 +	struct rtattr *tail;
 +	struct tc_nsscodel_qopt opt;
@@ -797,7 +797,7 @@
 +	return 0;
 +}
 +
-+static int nssfq_codel_print_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++static int nssfq_codel_print_opt(const struct qdisc_util *qu, FILE *f, struct rtattr *opt)
 +{
 +	struct rtattr *tb[TCA_NSSCODEL_MAX + 1];
 +	struct tc_nsscodel_qopt *qopt;
@@ -835,7 +835,7 @@
 +	return 0;
 +}
 +
-+static int nssfq_codel_print_xstats(struct qdisc_util *qu, FILE *f, struct rtattr *xstats)
++static int nssfq_codel_print_xstats(const struct qdisc_util *qu, FILE *f, struct rtattr *xstats)
 +{
 +	struct tc_nssfq_codel_xstats *st;
 +
@@ -872,7 +872,7 @@
 +	fprintf(stderr, "Value of target and interval should be greater than 1ms\n");
 +}
 +
-+static int nsscodel_parse_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++static int nsscodel_parse_opt(const struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n, const char *dev)
 +{
 +	struct rtattr *tail;
 +	struct tc_nsscodel_qopt opt;
@@ -944,7 +944,7 @@
 +	return 0;
 +}
 +
-+static int nsscodel_print_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++static int nsscodel_print_opt(const struct qdisc_util *qu, FILE *f, struct rtattr *opt)
 +{
 +	struct rtattr *tb[TCA_NSSCODEL_MAX + 1];
 +	struct tc_nsscodel_qopt *qopt;
@@ -977,7 +977,7 @@
 +	return 0;
 +}
 +
-+static int nsscodel_print_xstats(struct qdisc_util *qu, FILE *f, struct rtattr *xstats)
++static int nsscodel_print_xstats(const struct qdisc_util *qu, FILE *f, struct rtattr *xstats)
 +{
 +	struct tc_nsscodel_xstats *st;
 +
@@ -1008,7 +1008,7 @@
 +	fprintf(stderr, "Usage: ... nsstbl burst BYTES rate BPS [ mtu BYTES ] [ accel_mode ]\n");
 +}
 +
-+static int nsstbl_parse_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++static int nsstbl_parse_opt(const struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n, const char *dev)
 +{
 +	int ok = 0;
 +	struct rtattr *tail;
@@ -1108,7 +1108,7 @@
 +	return 0;
 +}
 +
-+static int nsstbl_print_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++static int nsstbl_print_opt(const struct qdisc_util *qu, FILE *f, struct rtattr *opt)
 +{
 +	struct rtattr *tb[TCA_NSSTBL_MAX + 1];
 +	struct tc_nsstbl_qopt *qopt;
@@ -1147,7 +1147,7 @@
 +	fprintf(stderr, "Usage: ... nssprio [ bands NUMBER (default 256) ] [ accel_mode ]\n");
 +}
 +
-+static int nssprio_parse_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++static int nssprio_parse_opt(const struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n, const char *dev)
 +{
 +	int ok = 0;
 +	struct rtattr *tail;
@@ -1204,7 +1204,7 @@
 +	return 0;
 +}
 +
-+static int nssprio_print_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++static int nssprio_print_opt(const struct qdisc_util *qu, FILE *f, struct rtattr *opt)
 +{
 +	struct rtattr *tb[TCA_NSSPRIO_MAX + 1];
 +	struct tc_nssprio_qopt *qopt;
@@ -1254,7 +1254,7 @@
 +	fprintf(stderr, "NSSBF: Illegal \"%s\"\n", arg);
 +}
 +
-+static int nssbf_parse_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++static int nssbf_parse_opt(const struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n, const char *dev)
 +{
 +	struct tc_nssbf_qopt opt;
 +	struct rtattr *tail;
@@ -1306,7 +1306,7 @@
 +	return 0;
 +}
 +
-+static int nssbf_print_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++static int nssbf_print_opt(const struct qdisc_util *qu, FILE *f, struct rtattr *opt)
 +{
 +	struct rtattr *tb[TCA_NSSBF_MAX + 1];
 +	struct tc_nssbf_qopt *qopt;
@@ -1329,7 +1329,7 @@
 +	return 0;
 +}
 +
-+static int nssbf_parse_class_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++static int nssbf_parse_class_opt(const struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n, const char *dev)
 +{
 +	int ok = 0;
 +	struct rtattr *tail;
@@ -1413,7 +1413,7 @@
 +	return 0;
 +}
 +
-+static int nssbf_print_class_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++static int nssbf_print_class_opt(const struct qdisc_util *qu, FILE *f, struct rtattr *opt)
 +{
 +	struct rtattr *tb[TCA_NSSBF_MAX + 1];
 +	struct tc_nssbf_class_qopt *qopt;
@@ -1459,7 +1459,7 @@
 +	fprintf(stderr, "Usage (class): ... nsswrr quantum PACKETS ]\n");
 +}
 +
-+static int nsswrr_parse_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++static int nsswrr_parse_opt(const struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n, const char *dev)
 +{
 +	struct tc_nsswrr_qopt opt;
 +	bool accel_mode = false;
@@ -1501,7 +1501,7 @@
 +	return 0;
 +}
 +
-+static int nsswrr_print_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++static int nsswrr_print_opt(const struct qdisc_util *qu, FILE *f, struct rtattr *opt)
 +{
 +	struct rtattr *tb[TCA_NSSWRR_MAX + 1];
 +	struct tc_nsswrr_qopt *qopt;
@@ -1523,7 +1523,7 @@
 +	return 0;
 +}
 +
-+static int nsswrr_parse_class_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++static int nsswrr_parse_class_opt(const struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n, const char *dev)
 +{
 +	int ok = 0;
 +	struct rtattr *tail;
@@ -1563,7 +1563,7 @@
 +	return 0;
 +}
 +
-+static int nsswrr_print_class_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++static int nsswrr_print_class_opt(const struct qdisc_util *qu, FILE *f, struct rtattr *opt)
 +{
 +	struct rtattr *tb[TCA_NSSWRR_MAX + 1];
 +	struct tc_nsswrr_class_qopt *qopt;
@@ -1605,7 +1605,7 @@
 +	fprintf(stderr, "Usage (class): ... nsswfq quantum BYTES ]\n");
 +}
 +
-+static int nsswfq_parse_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++static int nsswfq_parse_opt(const struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n, const char *dev)
 +{
 +	struct tc_nsswfq_qopt opt;
 +	bool accel_mode = false;
@@ -1647,7 +1647,7 @@
 +	return 0;
 +}
 +
-+static int nsswfq_print_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++static int nsswfq_print_opt(const struct qdisc_util *qu, FILE *f, struct rtattr *opt)
 +{
 +	struct rtattr *tb[TCA_NSSWFQ_MAX + 1];
 +	struct tc_nsswfq_qopt *qopt;
@@ -1669,7 +1669,7 @@
 +	return 0;
 +}
 +
-+static int nsswfq_parse_class_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++static int nsswfq_parse_class_opt(const struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n, const char *dev)
 +{
 +	int ok = 0;
 +	struct rtattr *tail;
@@ -1709,7 +1709,7 @@
 +	return 0;
 +}
 +
-+static int nsswfq_print_class_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++static int nsswfq_print_class_opt(const struct qdisc_util *qu, FILE *f, struct rtattr *opt)
 +{
 +	struct rtattr *tb[TCA_NSSWFQ_MAX + 1];
 +	struct tc_nsswfq_class_qopt *qopt;
@@ -1761,7 +1761,7 @@
 +	fprintf(stderr, "NSSHTB: Illegal \"%s\"\n", arg);
 +}
 +
-+static int nsshtb_parse_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++static int nsshtb_parse_opt(const struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n, const char *dev)
 +{
 +	struct tc_nsshtb_qopt opt;
 +	struct rtattr *tail;
@@ -1813,7 +1813,7 @@
 +	return 0;
 +}
 +
-+static int nsshtb_print_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++static int nsshtb_print_opt(const struct qdisc_util *qu, FILE *f, struct rtattr *opt)
 +{
 +	struct rtattr *tb[TCA_NSSHTB_MAX + 1];
 +	struct tc_nsshtb_qopt *qopt;
@@ -1839,7 +1839,7 @@
 +	return 0;
 +}
 +
-+static int nsshtb_parse_class_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++static int nsshtb_parse_class_opt(const struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n, const char *dev)
 +{
 +	int ok = 0;
 +	struct rtattr *tail;
@@ -1971,11 +1971,10 @@
 +	return 0;
 +}
 +
-+static int nsshtb_print_class_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++static int nsshtb_print_class_opt(const struct qdisc_util *qu, FILE *f, struct rtattr *opt)
 +{
 +	struct rtattr *tb[TCA_NSSHTB_MAX + 1];
 +	struct tc_nsshtb_class_qopt *qopt;
-+	SPRINT_BUF(b1);
 +
 +	if (opt == NULL)
 +		return 0;
@@ -2016,7 +2015,7 @@
 +	fprintf(stderr, "Usage: ...  nssblackhole [ set_default ] [ accel_mode ]\n");
 +}
 +
-+static int nssblackhole_parse_opt(struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n)
++static int nssblackhole_parse_opt(const struct qdisc_util *qu, int argc, char **argv, struct nlmsghdr *n, const char *dev)
 +{
 +	struct rtattr *tail;
 +	struct tc_nssblackhole_qopt opt;
@@ -2060,7 +2059,7 @@
 +	return 0;
 +}
 +
-+static int nssblackhole_print_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
++static int nssblackhole_print_opt(const struct qdisc_util *qu, FILE *f, struct rtattr *opt)
 +{
 +	struct rtattr *tb[TCA_NSSBLACKHOLE_MAX + 1];
 +	struct tc_nssblackhole_qopt *qopt;
diff --git a/package/network/utils/iproute2/patches/500-add-nssmirred.patch b/package/network/utils/iproute2/patches/500-add-nssmirred.patch
index f4c3bc587d124c..08bc935b2cc0ce 100644
--- a/package/network/utils/iproute2/patches/500-add-nssmirred.patch
+++ b/package/network/utils/iproute2/patches/500-add-nssmirred.patch
@@ -68,7 +68,7 @@
 + * parse_nss_mirred()
 + *	Parse and validate the nssmirred action statement.
 + */
-+static int parse_nss_mirred(struct action_util *a, int *argc_p, char ***argv_p,
++static int parse_nss_mirred(const struct action_util *a, int *argc_p, char ***argv_p,
 +	     int tca_id, struct nlmsghdr *n)
 +{
 +	int idx, argc = *argc_p;
@@ -142,7 +142,7 @@
 + * print_nss_mirred()
 + *	Print information related to nssmirred action.
 + */
-+static int print_nss_mirred(struct action_util *au, FILE * f, struct rtattr *arg)
++static int print_nss_mirred(const struct action_util *au, FILE * f, struct rtattr *arg)
 +{
 +	struct tc_nss_mirred *p;
 +	struct rtattr *tb[TCA_NSS_MIRRED_MAX + 1];

From f1a85a361397ec19df8cd22ba6238b603d71c335 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sun, 2 Jun 2024 18:50:37 -0400
Subject: [PATCH 110/225] ath11k_nss: mac80211 fix pending airtime

On platforms using ath10k with mac80211 'nss_redirect' enabled,
a warning `ieee80211_sta_update_pending_airtime` is observered
whenever traffic load is high (iperf3).

Don't offload if pending queue > 1000

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...07-mac80211-add-nss-redirect-support.patch | 32 ++++++++++++++++---
 1 file changed, 27 insertions(+), 5 deletions(-)

diff --git a/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch b/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
index 38d737dc37d96a..55d6b0194f7c04 100644
--- a/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
@@ -136,7 +136,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	return 0;
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -2569,6 +2569,54 @@ static bool ieee80211_frame_allowed(stru
+@@ -2569,6 +2569,58 @@ static bool ieee80211_frame_allowed(stru
  	return true;
  }
  
@@ -154,6 +154,10 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
 +		case_rtn_string(NSS_TX_FAILURE_TOO_SHORT);
 +		case_rtn_string(NSS_TX_FAILURE_NOT_SUPPORTED);
 +		case_rtn_string(NSS_TX_FAILURE_BAD_PARAM);
++		case_rtn_string(NSS_TX_FAILURE_NOT_ENABLED);
++		case_rtn_string(NSS_TX_FAILURE_SYNC_BAD_PARAM);
++		case_rtn_string(NSS_TX_FAILURE_SYNC_TIMEOUT);
++		case_rtn_string(NSS_TX_FAILURE_SYNC_FW_ERR);
 +	default:
 +		return "Unknown NSS TX status";
 +	}
@@ -191,7 +195,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  static void ieee80211_deliver_skb_to_local_stack(struct sk_buff *skb,
  						 struct ieee80211_rx_data *rx)
  {
-@@ -2608,11 +2656,15 @@ static void ieee80211_deliver_skb_to_loc
+@@ -2608,11 +2660,15 @@ static void ieee80211_deliver_skb_to_loc
  			     !ether_addr_equal(ehdr->h_dest, sdata->vif.addr)))
  			ether_addr_copy(ehdr->h_dest, sdata->vif.addr);
  
@@ -209,7 +213,25 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4504,6 +4504,35 @@ static void ieee80211_mlo_multicast_tx(s
+@@ -1726,7 +1726,16 @@ static bool ieee80211_tx_frags(struct ie
+ 					return true;
+ 				}
+ 			} else {
+-
++#ifdef CPTCFG_MAC80211_NSS_SUPPORT
++				if (skb_queue_len(&local->pending[q]) >= 1000) {
++					spin_unlock_irqrestore(
++						&local->queue_stop_reason_lock,
++						flags);
++					ieee80211_purge_tx_queue(&local->hw,
++								 skbs);
++					return false;
++				}
++#endif
+ 				/*
+ 				 * Since queue is stopped, queue up frames for
+ 				 * later transmission from the tx-pending
+@@ -4504,6 +4513,35 @@ static void ieee80211_mlo_multicast_tx(s
  	kfree_skb(skb);
  }
  
@@ -245,7 +267,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  /**
   * ieee80211_subif_start_xmit - netif start_xmit function for 802.3 vifs
   * @skb: packet to be sent
-@@ -4517,6 +4546,10 @@ netdev_tx_t ieee80211_subif_start_xmit(s
+@@ -4517,6 +4555,10 @@ netdev_tx_t ieee80211_subif_start_xmit(s
  	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	const struct ethhdr *eth = (void *)skb->data;
  
@@ -256,7 +278,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	if (likely(!is_multicast_ether_addr(eth->h_dest)))
  		goto normal;
  
-@@ -4703,6 +4736,9 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4703,6 +4745,9 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  	struct ieee80211_key *key;
  	struct sta_info *sta;
  

From 9ae547274a20baa79ea1791e5cf65fbd2de6575a Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sun, 2 Jun 2024 18:58:56 -0400
Subject: [PATCH 111/225] ath11k_nss: mac80211: remove STA txq pending airtime
 underflow warning

This warning can trigger if there is a mismatch between frames that were
sent with the sta pointer set vs tx status frames reported for the sta address.

This can happen due to race conditions on re-creating stations, or even
in the case of .sta_add/remove being used instead of .sta_state, which can cause
frames to be sent to a station that has not been uploaded yet.

If there is an actual underflow issue, it should show up in the device airtime
warning below, so it is better to remove this one.

Signed-off-by: Felix Fietkau <nbd@xxxxxxxx>

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...970-mac80211-ath10k-fix-airtime-underflow.patch | 14 ++++++++++++++
 1 file changed, 14 insertions(+)
 create mode 100644 package/kernel/mac80211/patches/nss/subsys/970-mac80211-ath10k-fix-airtime-underflow.patch

diff --git a/package/kernel/mac80211/patches/nss/subsys/970-mac80211-ath10k-fix-airtime-underflow.patch b/package/kernel/mac80211/patches/nss/subsys/970-mac80211-ath10k-fix-airtime-underflow.patch
new file mode 100644
index 00000000000000..d91b691291f6af
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/subsys/970-mac80211-ath10k-fix-airtime-underflow.patch
@@ -0,0 +1,14 @@
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -2386,10 +2386,7 @@ void ieee80211_sta_update_pending_airtim
+ 	atomic_sub(tx_airtime, &local->aql_total_pending_airtime);
+ 	tx_pending = atomic_sub_return(tx_airtime,
+ 				       &local->aql_ac_pending_airtime[ac]);
+-	if (WARN_ONCE(tx_pending < 0,
+-		      "Device %s AC %d pending airtime underflow: %u, %u",
+-		      wiphy_name(local->hw.wiphy), ac, tx_pending,
+-		      tx_airtime)) {
++	if (tx_pending < 0) {
+ 		atomic_cmpxchg(&local->aql_ac_pending_airtime[ac],
+ 			       tx_pending, 0);
+ 		atomic_sub(tx_pending, &local->aql_total_pending_airtime);

From 95271d0b6eefca6d7eb891529b538616bf7cb367 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sun, 2 Jun 2024 19:00:44 -0400
Subject: [PATCH 112/225] ath11k_nss: change warning levels

This is mostly a cosmetic change for users running NSS firmware 11.4
with mesh setups. Rather than fill up kernel logs with warnings, move log
warnings to debug.

The stats are still captured in '/sys/kernel/debug/qca-nss-drv/stats/*'

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...-ath11k_nss-add-nss-driver-interface.patch | 11 +++++---
 .../300-ath11k-nss-mesh-offload-support.patch | 28 +++++++++----------
 2 files changed, 21 insertions(+), 18 deletions(-)

diff --git a/package/kernel/mac80211/patches/nss/ath11k/199-002-ath11k_nss-add-nss-driver-interface.patch b/package/kernel/mac80211/patches/nss/ath11k/199-002-ath11k_nss-add-nss-driver-interface.patch
index 851e4ed0225a95..41b75404f033e6 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/199-002-ath11k_nss-add-nss-driver-interface.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/199-002-ath11k_nss-add-nss-driver-interface.patch
@@ -48,7 +48,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  ath11k_ahb-y += ahb.o
 --- /dev/null
 +++ b/drivers/net/wireless/ath/ath11k/nss.c
-@@ -0,0 +1,2396 @@
+@@ -0,0 +1,2399 @@
 +// SPDX-License-Identifier: BSD-3-Clause-Clear
 +/*
 + * Copyright (c) 2020 The Linux Foundation. All rights reserved.
@@ -320,7 +320,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
 +		peer_id = (&msg->msg.peermsg)->peer_id;
 +
 +		if (response == NSS_CMN_RESPONSE_EMSG)
-+			ath11k_warn(ab, "ath11k_nss: peer delete failed%d\n",
++			ath11k_warn(ab, "ath11k_nss: peer delete failed (peer_id: %d)\n",
 +				    peer_id);
 +
 +		/* free peer memory allocated during peer create irrespective of
@@ -677,8 +677,10 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
 +	struct ath11k_soc_dp_stats *soc_stats = &ar->ab->soc_stats;
 +
 +	if (encap_type != arvif->nss.encap) {
-+		ath11k_warn(ar->ab, "encap mismatch in nss tx skb encap type %d" \
++		ath11k_dbg(ar->ab, ATH11K_DBG_DP_TX, "encap mismatch in nss tx skb encap type %d" \
 +			    " vif encap type %d\n", encap_type, arvif->nss.encap);
++		ath11k_dbg_dump(ar->ab, (ATH11K_DBG_NSS | ATH11K_DBG_DP_TX), "", "nss tx msdu: ",
++			skb->data, skb->len);
 +		goto drop;
 +	}
 +
@@ -705,7 +707,8 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
 +	return status;
 +drop:
 +	atomic_inc(&soc_stats->tx_err.misc_fail);
-+	WARN_ON_ONCE(1);
++	if(ar->ab->nss.debug_mode)
++	  WARN_ON_ONCE(1);
 +	return -EINVAL;
 +}
 +
diff --git a/package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch b/package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch
index 30848b8f6164ac..dbd792aeca9b3e 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch
@@ -1494,8 +1494,8 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
 +	case NSS_WIFI_MESH_MSG_MPATH_UPDATE:
 +		if (response == NSS_CMN_RESPONSE_EMSG)
 +			ath11k_warn(ab, "failed to update mpath entry mesh_da %pM vdev_id %d"
-+				    "next_hop %pM old_next_hop %pM metric %d flags 0x%u hop_count %d"
-+				    "exp_time %u mesh_gate %u\n",
++				    " next_hop %pM old_next_hop %pM metric %d flags 0x%u hop_count %d"
++				    " exp_time %u mesh_gate %u\n",
 +				    (&msg->msg.mpath_update)->dest_mac_addr,
 +				    (&msg->msg.mpath_update)->link_vap_id,
 +				    (&msg->msg.mpath_update)->next_hop_mac_addr,
@@ -1508,14 +1508,14 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
 +		break;
 +	case NSS_WIFI_MESH_MSG_MPATH_DELETE:
 +		if (response == NSS_CMN_RESPONSE_EMSG)
-+			ath11k_warn(ab,"failed to remove mpath entry mesh_da %pM"
-+				    "vdev_id %d\n",
++			ath11k_dbg(ab, ATH11K_DBG_NSS_MESH, "failed to remove mpath entry mesh_da %pM"
++				    " vdev_id %d\n",
 +				    (&msg->msg.mpath_del)->mesh_dest_mac_addr,
 +				    (&msg->msg.mpath_del)->link_vap_id);
 +		break;
 +	case NSS_WIFI_MESH_MSG_PROXY_PATH_ADD:
 +		if (response == NSS_CMN_RESPONSE_EMSG)
-+			ath11k_warn(ab,"failed to add proxy entry da %pM mesh_da %pM \n",
++			ath11k_dbg(ab, ATH11K_DBG_NSS_MESH, "failed to add proxy entry da %pM mesh_da %pM\n",
 +				    (&msg->msg.proxy_add_msg)->dest_mac_addr,
 +				    (&msg->msg.proxy_add_msg)->mesh_dest_mac);
 +		break;
@@ -1527,13 +1527,13 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
 +		break;
 +	case NSS_WIFI_MESH_MSG_PROXY_PATH_DELETE:
 +		if (response == NSS_CMN_RESPONSE_EMSG)
-+			ath11k_warn(ab,"failed to remove proxy path entry da %pM mesh_da %pM\n",
++			ath11k_dbg(ab, ATH11K_DBG_NSS_MESH, "failed to remove proxy path entry da %pM mesh_da %pM\n",
 +				    (&msg->msg.proxy_del_msg)->dest_mac_addr,
 +				    (&msg->msg.proxy_del_msg)->mesh_dest_mac_addr);
 +		break;
 +	case NSS_WIFI_MESH_MSG_EXCEPTION_FLAG:
 +		if (response == NSS_CMN_RESPONSE_EMSG)
-+			ath11k_warn(ab,"failed to add the exception  da %pM\n",
++			ath11k_warn(ab,"failed to add the exception da %pM\n",
 +				    (&msg->msg.exception_msg)->dest_mac_addr);
 +		break;
 +	default:
@@ -1589,7 +1589,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
 +	ret = ieee80211_mesh_path_offld_change_notify(arvif->vif, &path,
 +			IEEE80211_MESH_PATH_OFFLD_ACTION_MPATH_REFRESH);
 +	if (ret)
-+		ath11k_warn(ab, "failed to notify mpath refresh nss event %d\n", ret);
++		ath11k_dbg(ab, ATH11K_DBG_NSS, "failed to notify mpath refresh nss event %d\n", ret);
 +}
 +
 +static void ath11k_nss_mesh_path_not_found(struct ath11k_vif *arvif,
@@ -1683,7 +1683,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
 +	 ret = ieee80211_mesh_path_offld_change_notify(arvif->vif, &path,
 +			 IEEE80211_MESH_PATH_OFFLD_ACTION_MPP_LEARN);
 +	 if (ret)
-+		 ath11k_warn(ab, "failed to notify proxy learn event %d\n", ret);
++		 ath11k_dbg(ab, ATH11K_DBG_NSS_MESH, "failed to notify proxy learn event %d\n", ret);
 +}
 +
 +static void ath11k_nss_mesh_mpp_add(struct ath11k_vif *arvif,
@@ -1706,7 +1706,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
 +	ret = ieee80211_mesh_path_offld_change_notify(arvif->vif, &path,
 +				IEEE80211_MESH_PATH_OFFLD_ACTION_MPP_ADD);
 +	if (ret)
-+		ath11k_warn(ab, "failed to notify proxy add event %d\n", ret);
++		ath11k_dbg(ab, ATH11K_DBG_NSS_MESH, "failed to notify proxy add event %d\n", ret);
 +}
 +
 +static void ath11k_nss_mesh_mpp_update(struct ath11k_vif *arvif,
@@ -1729,7 +1729,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
 +	ret = ieee80211_mesh_path_offld_change_notify(arvif->vif, &path,
 +				IEEE80211_MESH_PATH_OFFLD_ACTION_MPP_UPDATE);
 +	if (ret)
-+		ath11k_warn(ab, "failed to notify proxy update event %d\n", ret);
++		ath11k_dbg(ab, ATH11K_DBG_NSS_MESH, "failed to notify proxy update event %d\n", ret);
 +}
 +
 +static int
@@ -2572,10 +2572,10 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  
 -	if (encap_type != arvif->nss.encap) {
 +	if (!arvif->ar->ab->nss.debug_mode && encap_type != arvif->nss.encap) {
- 		ath11k_warn(ar->ab, "encap mismatch in nss tx skb encap type %d" \
+ 		ath11k_dbg(ar->ab, ATH11K_DBG_DP_TX, "encap mismatch in nss tx skb encap type %d" \
  			    " vif encap type %d\n", encap_type, arvif->nss.encap);
- 		goto drop;
-@@ -946,16 +2040,45 @@ int ath11k_nss_tx(struct ath11k_vif *arv
+ 		ath11k_dbg_dump(ar->ab, (ATH11K_DBG_NSS | ATH11K_DBG_DP_TX), "", "nss tx msdu: ",
+@@ -948,16 +2042,45 @@ int ath11k_nss_tx(struct ath11k_vif *arv
  		ath11k_nss_tx_encap_nwifi(skb);
  
  send:

From 21fee386faa85b3d57e641409897d35e7cee6d37 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sun, 2 Jun 2024 19:06:48 -0400
Subject: [PATCH 113/225] ath11k_nss: fix incorrect tx/rx stats WDS

Should be 'rx'

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch b/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
index 1730beea85dfc0..b8eb343f4f8295 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
@@ -536,7 +536,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
 -		ATH11K_NSS_TXRX_NETDEV_STATS(rx, peer->vif, rx_bytes, rx_packets);
 +		if (peer->nss.ext_vdev_up)
-+			ATH11K_NSS_TXRX_NETDEV_STATS(tx, peer->nss.ext_vif, rx_bytes, rx_packets);
++			ATH11K_NSS_TXRX_NETDEV_STATS(rx, peer->nss.ext_vif, rx_bytes, rx_packets);
 +		else
 +			ATH11K_NSS_TXRX_NETDEV_STATS(rx, peer->vif, rx_bytes, rx_packets);
  

From 9401db81b38df4723a4bf15287204eea23bc71c0 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sun, 2 Jun 2024 19:11:52 -0400
Subject: [PATCH 114/225] ath11k_nss: correctly free skb using
 ieee80211_free_txskb()

While freeing skb in tx completion path for status reinject, inspect
or vdevid mismatch, dev_kfree_skb_any() is used but when a function
is using functions from mac80211 to free an skb then it should do
it consistently and not switch to the generic dev_kfree_skb_any.
Otherwise, mac80211 will not be aware of the freed skb and thus
not clean up related information in its internal data structures.

Hence fix the issue by properly using ieee80211_free_txskb().

Signed-off-by: Sarika Sharma <quic_sarishar@quicinc.com>
Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...-free-skb-using-ieee80211_free_txskb.patch | 36 +++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/910-wifi-ath11k-correctly-free-skb-using-ieee80211_free_txskb.patch

diff --git a/package/kernel/mac80211/patches/nss/ath11k/910-wifi-ath11k-correctly-free-skb-using-ieee80211_free_txskb.patch b/package/kernel/mac80211/patches/nss/ath11k/910-wifi-ath11k-correctly-free-skb-using-ieee80211_free_txskb.patch
new file mode 100644
index 00000000000000..27ea07015b82b3
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/910-wifi-ath11k-correctly-free-skb-using-ieee80211_free_txskb.patch
@@ -0,0 +1,36 @@
+From 2ff5eea9f7a5ad18e1ac8f48c29786083d4abaa3 Mon Sep 17 00:00:00 2001
+From: Sarika Sharma <quic_sarishar@quicinc.com>
+Date: Thu, 14 Mar 2024 08:44:09 +0530
+Subject: [PATCH] wifi: ath11k: correctly free skb using ieee80211_free_txskb()
+
+While freeing skb in tx completion path for status reinject, inspect
+or vdevid mismatch, dev_kfree_skb_any() is used but when a function
+is using functions from mac80211 to free an skb then it should do
+it consistently and not switch to the generic dev_kfree_skb_any.
+Otherwise, mac80211 will not be aware of the freed skb and thus
+not clean up related information in its internal data structures.
+
+Hence fix the issue by properly using ieee80211_free_txskb().
+
+Signed-off-by: Sarika Sharma <quic_sarishar@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/dp_tx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -384,9 +384,13 @@ static void ath11k_dp_tx_free_txbuf(stru
+ 	skb_cb = ATH11K_SKB_CB(msdu);
+ 
+ 	dma_unmap_single(ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
+-	dev_kfree_skb_any(msdu);
+ 
+ 	ar = ab->pdevs[mac_id].ar;
++	if (ab->stats_disable)
++		dev_kfree_skb_any(msdu);
++	else
++		ieee80211_free_txskb(ar->hw, msdu);
++
+ 	if (atomic_dec_and_test(&ar->dp.num_tx_pending))
+ 		wake_up(&ar->dp.tx_empty_waitq);
+ }

From 91aa570a908b36aaf57ff191f00e3e275af670df Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sun, 2 Jun 2024 19:12:50 -0400
Subject: [PATCH 115/225] ath11k_nss: Add lock when accessing idr_pool of
 tx_ring

Lock is missed while accessing idr_pool of tx_ring which
causes Use after free crash in dp_free path when unloading
the module.

Fix this by adding tx_idr_lock when accessing idr_pool
of tx_ring.

Signed-off-by: Aishwarya R <quic_aisr@quicinc.com>
Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...lock-when-accessing-idr_pool-of-tx_r.patch | 75 +++++++++++++++++++
 1 file changed, 75 insertions(+)
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/910-wifi-ath11k-Add-lock-when-accessing-idr_pool-of-tx_r.patch

diff --git a/package/kernel/mac80211/patches/nss/ath11k/910-wifi-ath11k-Add-lock-when-accessing-idr_pool-of-tx_r.patch b/package/kernel/mac80211/patches/nss/ath11k/910-wifi-ath11k-Add-lock-when-accessing-idr_pool-of-tx_r.patch
new file mode 100644
index 00000000000000..38188636a58cd4
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/910-wifi-ath11k-Add-lock-when-accessing-idr_pool-of-tx_r.patch
@@ -0,0 +1,75 @@
+From 1d840740e28058a5be16d96202c076f552839d7a Mon Sep 17 00:00:00 2001
+From: Aishwarya R <quic_aisr@quicinc.com>
+Date: Tue, 19 Mar 2024 15:14:30 +0530
+Subject: [PATCH] wifi: ath11k: Add lock when accessing idr_pool of tx_ring
+
+Lock is missed while accessing idr_pool of tx_ring which
+causes Use after free crash in dp_free path when unloading
+the module.
+
+Fix this by adding tx_idr_lock when accessing idr_pool
+of tx_ring.
+
+Signed-off-by: Aishwarya R <quic_aisr@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/dp_tx.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -347,8 +347,10 @@ fail_remove_idr:
+ 	if (ti.pkt_offset)
+ 		skb_pull(skb, ti.pkt_offset);
+ 
++	spin_lock_bh(&tx_ring->tx_idr_lock);
+ 	tx_ring->idr_pool[idr].id = -1;
+ 	clear_bit(idr, tx_ring->idrs);
++	spin_unlock_bh(&tx_ring->tx_idr_lock);
+ 
+ 	if (tcl_ring_retry)
+ 		goto tcl_ring_sel;
+@@ -364,12 +366,14 @@ static void ath11k_dp_tx_free_txbuf(stru
+ 	struct sk_buff *msdu = NULL;
+ 	struct ath11k_skb_cb *skb_cb;
+ 
++	spin_lock_bh(&tx_ring->tx_idr_lock);
+ 	if (msdu_id < DP_TX_IDR_SIZE &&
+ 	    tx_ring->idr_pool[msdu_id].id == msdu_id) {
+ 		msdu = tx_ring->idr_pool[msdu_id].buf;
+ 		tx_ring->idr_pool[msdu_id].id = -1;
+ 		clear_bit(msdu_id, tx_ring->idrs);
+ 	}
++	spin_unlock_bh(&tx_ring->tx_idr_lock);
+ 
+ 	if (unlikely(!msdu)) {
+ 		ath11k_warn(ab, "tx completion for unknown msdu_id %d\n",
+@@ -401,12 +405,14 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
+ 	u32 msdu_id = ts->msdu_id;
+ 	u8 flags = 0;
+ 
++	spin_lock_bh(&tx_ring->tx_idr_lock);
+ 	if (msdu_id < DP_TX_IDR_SIZE &&
+ 	    tx_ring->idr_pool[msdu_id].id == msdu_id) {
+ 		msdu = tx_ring->idr_pool[msdu_id].buf;
+ 		tx_ring->idr_pool[msdu_id].id = -1;
+ 		clear_bit(msdu_id, tx_ring->idrs);
+ 	}
++	spin_unlock_bh(&tx_ring->tx_idr_lock);
+ 
+ 	if (unlikely(!msdu)) {
+ 		ath11k_warn(ab, "htt tx completion for unknown msdu_id %d\n",
+@@ -890,12 +896,14 @@ void ath11k_dp_tx_completion_handler(str
+ 			continue;
+ 		}
+ 
++		spin_lock_bh(&tx_ring->tx_idr_lock);
+ 		if (msdu_id < DP_TX_IDR_SIZE &&
+ 		    tx_ring->idr_pool[msdu_id].id == msdu_id) {
+ 			msdu = tx_ring->idr_pool[msdu_id].buf;
+ 			tx_ring->idr_pool[msdu_id].id = -1;
+ 			clear_bit(msdu_id, tx_ring->idrs);
+ 		}
++		spin_unlock_bh(&tx_ring->tx_idr_lock);
+ 
+ 		if (unlikely(!msdu)) {
+ 			ath11k_warn(ab, "tx completion for unknown msdu_id %d\n",

From 518fd68b14483f7f4aff61456fc98a6190c14ded Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sun, 2 Jun 2024 19:14:08 -0400
Subject: [PATCH 116/225] ath11k_nss: mac80211 Use C99 flexible arrays instead
 of zero-length arrays

Fixes compile issues on GCC 13.3+

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../subsys/971-mac80211-fix-field-span-warning.patch  | 11 +++++++++++
 1 file changed, 11 insertions(+)
 create mode 100644 package/kernel/mac80211/patches/nss/subsys/971-mac80211-fix-field-span-warning.patch

diff --git a/package/kernel/mac80211/patches/nss/subsys/971-mac80211-fix-field-span-warning.patch b/package/kernel/mac80211/patches/nss/subsys/971-mac80211-fix-field-span-warning.patch
new file mode 100644
index 00000000000000..7d7ff4025bf127
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/subsys/971-mac80211-fix-field-span-warning.patch
@@ -0,0 +1,11 @@
+--- a/include/linux/ieee80211.h
++++ b/include/linux/ieee80211.h
+@@ -961,7 +961,7 @@ struct ieee80211_tim_ie {
+ 	u8 dtim_period;
+ 	u8 bitmap_ctrl;
+ 	/* variable size: 1 - 251 bytes */
+-	u8 virtual_map[1];
++	u8 virtual_map[];
+ } __packed;
+ 
+ /**

From 09a60a622f9a025124b0edacb67ded1184089e46 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sun, 2 Jun 2024 19:22:26 -0400
Subject: [PATCH 117/225] qualcommax: NSS: Add support for sxk80, mx8500

Adding NSS support for:

Linksys MX8500
Netgear SXR80/SXS80 (SXK80 - router and satellite)

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-mx8500.dts | 1 +
 .../qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-sxk80.dtsi | 1 +
 2 files changed, 2 insertions(+)

diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-mx8500.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-mx8500.dts
index 70f4438ab0c530..a4fcb3e18d0343 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-mx8500.dts
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-mx8500.dts
@@ -5,6 +5,7 @@
 #include "ipq8074.dtsi"
 #include "ipq8074-hk-cpu.dtsi"
 #include "ipq8074-ess.dtsi"
+#include "ipq8074-nss.dtsi"
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/leds/common.h>
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-sxk80.dtsi b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-sxk80.dtsi
index 7f8b813749116f..7a29f945d55537 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-sxk80.dtsi
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-sxk80.dtsi
@@ -8,6 +8,7 @@
 
 #include "ipq8074.dtsi"
 #include "ipq8074-ess.dtsi"
+#include "ipq8074-nss.dtsi"
 #include "ipq8074-hk-cpu.dtsi"
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>

From b5dbfab54a07375450f31ecc24ac7881b92f380c Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sun, 2 Jun 2024 19:25:04 -0400
Subject: [PATCH 118/225] qualcommax: NSS: Add DTS entries for nss-macsec

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../arch/arm64/boot/dts/qcom/ipq8074-nss.dtsi     | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-nss.dtsi b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-nss.dtsi
index d85a37230a0e04..ff07e3871335ad 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-nss.dtsi
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-nss.dtsi
@@ -268,4 +268,19 @@
 			};
 		};
 	};
+
+	nss-macsec0 {
+		compatible = "qcom,nss-macsec";
+		mdiobus = <&mdio>;
+		phy_addr = <0x18>;
+		phy_access_mode = <0x00>;
+	};
+
+	nss-macsec1 {
+		compatible = "qcom,nss-macsec";
+		mdiobus = <&mdio>;
+		phy_addr = <0x1c>;
+		phy_access_mode = <0x00>;
+	};
+
 };

From 5e14dc793d577449e9bc3da42ffa48db523babd9 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sun, 2 Jun 2024 19:29:37 -0400
Subject: [PATCH 119/225] qualcommax: NSS: ECM: Fixes for Bridge VLAN Filtering

1. Fix function to check for bridge master status while checking
for Bridge VLAN filter feature is enabled on bridge slave ports.
2. Disable default PVID for bridges during device registration in
the system.

Change-Id: Ibea6559c1b0700a2300b60e20d57b7818e23a8a8
Signed-off-by: Vishnu Vardhan Bantanahal <quic_vishvard@quicinc.com>

bridge: Fix Bridge VLAN stats update
This patch fixes Bridge VLAN stats update for both bridge master
and bridge slave.
Change-Id: Ia26f4c71e83e27dd83336815cda5c05c8c3f24ff
Signed-off-by: Vishnu Vardhan Bantanahal <quic_vishvard@quicinc.com>

bridge: Add bridge VLAN filter APIs for offload for 6.1 Kernel

Change-Id: I54e44c26664f86ae024f54605a032713a9a3eee5
Signed-off-by: Vishnu Vardhan Bantanahal <quic_vishvard@quicinc.com>

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...idge-Fixes-for-Bridge-VLAN-Filtering.patch | 341 ++++++++++++++++++
 1 file changed, 341 insertions(+)
 create mode 100644 target/linux/qualcommax/patches-6.6/0606-1-qca-nss-ecm-bridge-Fixes-for-Bridge-VLAN-Filtering.patch

diff --git a/target/linux/qualcommax/patches-6.6/0606-1-qca-nss-ecm-bridge-Fixes-for-Bridge-VLAN-Filtering.patch b/target/linux/qualcommax/patches-6.6/0606-1-qca-nss-ecm-bridge-Fixes-for-Bridge-VLAN-Filtering.patch
new file mode 100644
index 00000000000000..b4d5f89dd559a6
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0606-1-qca-nss-ecm-bridge-Fixes-for-Bridge-VLAN-Filtering.patch
@@ -0,0 +1,341 @@
+From 7732ede3f72eebb8742e17e61e07e9286c442aec Mon Sep 17 00:00:00 2001
+From: Vishnu Vardhan Bantanahal <quic_vishvard@quicinc.com>
+Date: Mon, 15 May 2023 17:56:04 +0530
+Subject: [PATCH 277/281] bridge: Fixes for Bridge VLAN Filtering
+
+1. Fix function to check for bridge master status while checking
+for Bridge VLAN filter feature is enabled on bridge slave ports.
+2. Disable default PVID for bridges during device registration in
+the system.
+Change-Id: Ibea6559c1b0700a2300b60e20d57b7818e23a8a8
+Signed-off-by: Vishnu Vardhan Bantanahal <quic_vishvard@quicinc.com>
+
+bridge: Fix Bridge VLAN stats update
+This patch fixes Bridge VLAN stats update for both bridge master
+and bridge slave.
+Change-Id: Ia26f4c71e83e27dd83336815cda5c05c8c3f24ff
+Signed-off-by: Vishnu Vardhan Bantanahal <quic_vishvard@quicinc.com>
+
+bridge: Add bridge VLAN filter APIs for offload for 6.1 Kernel
+
+Change-Id: I54e44c26664f86ae024f54605a032713a9a3eee5
+Signed-off-by: Vishnu Vardhan Bantanahal <quic_vishvard@quicinc.com>
+---
+ include/linux/if_bridge.h |  29 +++++-
+ include/linux/netdevice.h |   2 +-
+ net/bridge/br.c           |   4 +
+ net/bridge/br_if.c        |  11 ++-
+ net/bridge/br_private.h   |   1 +
+ net/bridge/br_vlan.c      | 186 +++++++++++++++++++++++++++++++++++++-
+ net/core/dev.c            |   2 +-
+ 7 files changed, 227 insertions(+), 8 deletions(-)
+
+--- a/include/linux/if_bridge.h
++++ b/include/linux/if_bridge.h
+@@ -128,6 +128,12 @@ int br_vlan_get_info_rcu(const struct ne
+ bool br_mst_enabled(const struct net_device *dev);
+ int br_mst_get_info(const struct net_device *dev, u16 msti, unsigned long *vids);
+ int br_mst_get_state(const struct net_device *dev, u16 msti, u8 *state);
++
++extern struct net_device *br_fdb_find_vid_by_mac(struct net_device *dev, u8 *mac, u16 *vid);
++extern int br_vlan_get_tag_skb(const struct sk_buff *skb, u16 *vid);
++extern int br_dev_is_vlan_filter_enabled(struct net_device *dev);
++extern int br_vlan_update_stats(struct net_device* dev, u32 vid, u64 rx_bytes, u64 rx_packets, u64 tx_bytes, u64 tx_packets);
++extern int br_vlan_get_info_rcu(const struct net_device *dev, u16 vid, struct bridge_vlan_info *p_vinfo);
+ #else
+ static inline bool br_vlan_enabled(const struct net_device *dev)
+ {
+@@ -149,8 +155,27 @@ static inline int br_vlan_get_pvid_rcu(c
+ 	return -EINVAL;
+ }
+ 
+-static inline int br_vlan_get_info(const struct net_device *dev, u16 vid,
+-				   struct bridge_vlan_info *p_vinfo)
++static inline int br_vlan_get_info(const struct net_device *dev, u16 vid, struct bridge_vlan_info *p_vinfo)
++{
++	return -EINVAL;
++}
++
++static inline struct net_device *br_fdb_find_vid_by_mac(struct net_device *dev, u8 *mac, u16 *vid)
++{
++	return NULL;
++}
++
++static inline int br_vlan_get_tag_skb(const struct sk_buff *skb, u16 *vid)
++{
++	return -EINVAL;
++}
++
++static inline int br_dev_is_vlan_filter_enabled(const struct net_device *dev)
++{
++	return -EINVAL;
++}
++
++static inline int br_vlan_update_stats(struct net_device* dev, u32 vid, u64 rx_bytes, u64 rx_packets, u64 tx_bytes, u64 tx_packets)
+ {
+ 	return -EINVAL;
+ }
+--- a/net/bridge/br.c
++++ b/net/bridge/br.c
+@@ -42,6 +42,10 @@ static int br_device_event(struct notifi
+ 			return notifier_from_errno(err);
+ 
+ 		if (event == NETDEV_REGISTER) {
++#if IS_ENABLED(CONFIG_BRIDGE_VLAN_FILTERING)
++			br_vlan_disable_default_pvid(netdev_priv(dev));
++#endif
++
+ 			/* register of bridge completed, add sysfs entries */
+ 			err = br_sysfs_addbr(dev);
+ 			if (err)
+--- a/net/bridge/br_if.c
++++ b/net/bridge/br_if.c
+@@ -800,9 +800,12 @@ struct net_device *br_port_dev_get(struc
+ 				   struct sk_buff *skb,
+ 				   unsigned int cookie)
+ {
++#if !IS_ENABLED(CONFIG_BRIDGE_VLAN_FILTERING)
+ 	struct net_bridge_fdb_entry *fdbe;
+ 	struct net_bridge *br;
++#endif
+ 	struct net_device *netdev = NULL;
++	u16 __maybe_unused vid;
+ 
+ 	/* Is this a bridge? */
+ 	if (!(dev->priv_flags & IFF_EBRIDGE))
+@@ -831,14 +834,20 @@ struct net_device *br_port_dev_get(struc
+ 	 * determine the port to use - fall back to using FDB
+ 	 */
+ 
++#if IS_ENABLED(CONFIG_BRIDGE_VLAN_FILTERING)
++	/* Lookup the fdb entry and get reference to the port dev.
++	 * dev_hold() is done as part of br_fdb_find_vid_by_mac()
++	 */
++	netdev = br_fdb_find_vid_by_mac(dev, addr, &vid);
++#else
+ 	br = netdev_priv(dev);
+-
+-	/* Lookup the fdb entry and get reference to the port dev */
+ 	fdbe = br_fdb_find_rcu(br, addr, 0);
+ 	if (fdbe && fdbe->dst) {
+ 		netdev = fdbe->dst->dev; /* port device */
+ 		dev_hold(netdev);
+ 	}
++#endif
++
+ out:
+ 	rcu_read_unlock();
+ 	return netdev;
+--- a/net/bridge/br_private.h
++++ b/net/bridge/br_private.h
+@@ -1563,6 +1563,7 @@ void br_vlan_fill_forward_path_pvid(stru
+ int br_vlan_fill_forward_path_mode(struct net_bridge *br,
+ 				   struct net_bridge_port *dst,
+ 				   struct net_device_path *path);
++void br_vlan_disable_default_pvid(struct net_bridge *br);
+ 
+ static inline struct net_bridge_vlan_group *br_vlan_group(
+ 					const struct net_bridge *br)
+--- a/net/bridge/br_vlan.c
++++ b/net/bridge/br_vlan.c
+@@ -933,8 +933,190 @@ int br_vlan_get_proto(const struct net_d
+ }
+ EXPORT_SYMBOL_GPL(br_vlan_get_proto);
+ 
++/*
++ * br_vlan_get_tag_skb()
++ * 	Returns VLAN tag is its found valid in skb.
++ */
++int br_vlan_get_tag_skb(const struct sk_buff *skb, u16 *vid)
++{
++	return br_vlan_get_tag(skb, vid);
++
++}
++EXPORT_SYMBOL_GPL(br_vlan_get_tag_skb);
++
++/*
++ * br_dev_is_vlan_filter_enabled()
++ * 	Caller should ensure to hold rcu_lock()
++ * 	Returns 0, when device(port or bridge device) has a valid bridge
++ * 	vlan filter configuration and returns error otherwise.
++ */
++int br_dev_is_vlan_filter_enabled(struct net_device *dev)
++{
++	struct net_bridge_port *p;
++	struct net_bridge_vlan_group *vg = NULL;
++	struct net_device *master = NULL;
++
++	if (!dev) {
++		return -ENODEV;
++	}
++
++	if (netif_is_bridge_master(dev)) {
++		/*
++		 * Its a bridge device
++		 */
++		if (!br_vlan_enabled(dev)) {
++			return -ENOENT;
++		}
++
++		vg = br_vlan_group(netdev_priv(dev));
++	} else if (dev->priv_flags & IFF_BRIDGE_PORT) {
++		/*
++		 * It's a bridge port
++		 */
++		master = netdev_master_upper_dev_get_rcu(dev);
++		if (!master) {
++			return -EINVAL;
++		}
++
++		if (!br_vlan_enabled(master)) {
++			return -ENOENT;
++		}
++
++		p = br_port_get_rcu(dev);
++		if (p)
++			vg = nbp_vlan_group(p);
++	} else {
++		/*
++		 * Neither a bridge device or port
++		 */
++		return -EINVAL;
++	}
++
++	if (vg != NULL && vg->num_vlans) {
++		return 0;
++	}
++
++	return -ENXIO;
++}
++EXPORT_SYMBOL_GPL(br_dev_is_vlan_filter_enabled);
++
++/*
++ * br_fdb_find_vid_by_mac()
++ * 	Caller ensures to ensure rcu_lock() is taken.
++ * 	Returns 0 in case of lookup was performed.
++ * 	Look up the bridge fdb table for the mac-address & find associated
++ * 	VLAN id associated with it.
++ * 	vid is non-zero for succesfull lookup, otherwise 0.
++ * 	We dev_hold() on the returned device, caller will release this hold.
++ */
++struct net_device *br_fdb_find_vid_by_mac(struct net_device *dev, u8 *mac, u16 *vid)
++{
++	struct net_bridge *br;
++	struct net_bridge_fdb_entry *f;
++	struct net_device *netdev = NULL;
++
++	if (!mac) {
++		return NULL;
++	}
++
++	if (!dev || !netif_is_bridge_master(dev)) {
++		return NULL;
++	}
++
++	br = netdev_priv(dev);
++	if (!br) {
++		return NULL;
++	}
++
++	hlist_for_each_entry_rcu(f, &br->fdb_list, fdb_node) {
++		if (ether_addr_equal(f->key.addr.addr, mac)) {
++			*vid = f->key.vlan_id;
++			if (f->dst) {
++				netdev = f->dst->dev;
++				dev_hold(netdev);
++				break;
++			}
++		}
++	}
++	return netdev;
++}
++EXPORT_SYMBOL_GPL(br_fdb_find_vid_by_mac);
++
++/*
++ * br_vlan_update_stats()
++ * 	Update bridge VLAN filter statistics.
++ */
++int br_vlan_update_stats(struct net_device *dev, u32 vid, u64 rx_bytes, u64 rx_packets, u64 tx_bytes, u64 tx_packets)
++{
++	struct net_bridge_port *p;
++	struct net_bridge_vlan *v;
++	struct pcpu_sw_netstats *stats;
++	const struct net_bridge *br;
++	struct net_bridge_vlan_group *vg;
++	struct net_device *brdev;
++
++	if (!dev) {
++		return -ENODEV;
++	}
++
++	if (!netif_is_bridge_port(dev) && !netif_is_bridge_master(dev)) {
++		return -EINVAL;
++	}
++
++	rcu_read_lock();
++
++	brdev = dev;
++	if (!netif_is_bridge_master(dev)) {
++		brdev = netdev_master_upper_dev_get_rcu(dev);
++		if (!brdev) {
++			rcu_read_unlock();
++			return -EPERM;
++		}
++	}
++
++	br = netdev_priv(brdev);
++	if (!br || !br_opt_get(br, BROPT_VLAN_STATS_ENABLED)) {
++		rcu_read_unlock();
++		return -EINVAL;
++	}
++
++	p = br_port_get_rcu(dev);
++	if (p) {
++		vg = nbp_vlan_group_rcu(p);
++	} else if (netif_is_bridge_master(dev)) {
++		vg = br_vlan_group(netdev_priv(dev));
++	} else {
++		rcu_read_unlock();
++		return -EINVAL;
++	}
++
++
++	if (!vg) {
++		rcu_read_unlock();
++		return -ENXIO;
++	}
++
++	v = br_vlan_find(vg, vid);
++	if (!v || !br_vlan_should_use(v)) {
++		rcu_read_unlock();
++		return -ENOENT;
++	}
++
++	stats = this_cpu_ptr(v->stats);
++	u64_stats_update_begin(&stats->syncp);
++	u64_stats_add(&stats->rx_bytes, rx_bytes);
++	u64_stats_add(&stats->rx_packets, rx_packets);
++	u64_stats_add(&stats->tx_bytes, tx_bytes);
++	u64_stats_add(&stats->tx_packets, tx_packets);
++	u64_stats_update_end(&stats->syncp);
++
++	rcu_read_unlock();
++	return 0;
++}
++EXPORT_SYMBOL_GPL(br_vlan_update_stats);
++
+ int __br_vlan_set_proto(struct net_bridge *br, __be16 proto,
+-			struct netlink_ext_ack *extack)
++	                        struct netlink_ext_ack *extack)
+ {
+ 	struct switchdev_attr attr = {
+ 		.orig_dev = br->dev,
+@@ -1068,7 +1250,7 @@ static bool vlan_default_pvid(struct net
+ 	return false;
+ }
+ 
+-static void br_vlan_disable_default_pvid(struct net_bridge *br)
++void br_vlan_disable_default_pvid(struct net_bridge *br)
+ {
+ 	struct net_bridge_port *p;
+ 	u16 pvid = br->default_pvid;

From 82264e35580beddd58b76d30a7e041ea295270b3 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Fri, 7 Jun 2024 14:58:00 -0400
Subject: [PATCH 120/225] ath11k_nss: Fix IPQ6018 wifi offloading

This patch was mostly cosmetic for ipq8074 to supress warnings about
invalid memory region. In this case the M3 dump region. This isn't
necessary for operation or offloading, and is used for firmware
debugging.

However due to the memory layout of ipq6018 it was causing issues of NSS
offloading properly loading. 'idx' shouldn't be incremented, and instead
should just break.

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../patches/nss/ath11k/188-ath11k-m3-ssr-dump-collection.patch | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/package/kernel/mac80211/patches/nss/ath11k/188-ath11k-m3-ssr-dump-collection.patch b/package/kernel/mac80211/patches/nss/ath11k/188-ath11k-m3-ssr-dump-collection.patch
index 1fe5317105c137..8bff0bf7766c92 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/188-ath11k-m3-ssr-dump-collection.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/188-ath11k-m3-ssr-dump-collection.patch
@@ -1,11 +1,10 @@
 --- a/drivers/net/wireless/ath/ath11k/qmi.c
 +++ b/drivers/net/wireless/ath/ath11k/qmi.c
-@@ -2100,6 +2100,9 @@ static int ath11k_qmi_assign_target_mem_
+@@ -2100,6 +2100,8 @@ static int ath11k_qmi_assign_target_mem_
  			ab->qmi.target_mem[idx].type = ab->qmi.target_mem[i].type;
  			idx++;
  			break;
 +		case M3_DUMP_REGION_TYPE:
-+			idx++;
 +			break;
  		default:
  			ath11k_warn(ab, "qmi ignore invalid mem req type %d\n",

From 0332bc3006561c781dc10e98d1f35f5624e4201d Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sun, 9 Jun 2024 23:54:37 -0400
Subject: [PATCH 121/225] qualcommax: add ramoops memory region
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch adds support for allocating 1MB of reserved memory
for ramoops on IPQ807x and IPQ6018 platforms.

This is required to get PSTORE option working.

Tested with the following options:

```
CONFIG_PACKAGE_kmod-pstore=y
CONFIG_PACKAGE_kmod-ramoops=y
CONFIG_PACKAGE_kmod-reed-solomon=y
```

dmesg output
```
➤ dmesg | grep -Ei "psto|ramo"

[Sun Jun  9 23:22:01 2024] OF: reserved mem: 0x0000000051200000..0x00000000512fffff (1024 KiB) map non-reusable ramoops@51200000
[Sun Jun  9 23:22:05 2024] pstore: Using crash dump compression: deflate
[Sun Jun  9 23:22:05 2024] pstore: Registered ramoops as persistent store backend
[Sun Jun  9 23:22:05 2024] ramoops: using 0x100000@0x51200000, ecc: 0
```

Triggering kernel panic

```
sh -c 'echo 10 > /proc/sys/kernel/panic; echo c > /proc/sysrq-trigger'
```

After rebooting

```
mkdir -p /tmp/ramoops
mount -t pstore pstore /tmp/ramoops
```

```
➤ l /tmp/ramoops
drwxr-x---    2 root     root           0 Jun  9 23:02 .
drwxr-xr-x    8 root     root        4.0K Jun  9 23:23 ..
-r--r--r--    1 root     root        6.6K Jun  9 23:21 dmesg-ramoops-0
```

Truncated output
```
Panic#1 Part1
<6>[   21.656119] remoteproc remoteproc0: remote processor cd00000.q6v5_wcss is now up
<14>[   21.657910] kmodloader: done loading kernel modules from /etc/modules.d/*
<6>[   21.710545] ath11k c000000.wifi: chip_id 0x0 chip_family 0x0 board_id 0xff soc_id 0xffffffff
<6>[   21.710594] ath11k c000000.wifi: fw_version 0x270204a5 fw_build_timestamp 2022-08-04 13:05 fw_build_id WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
<6>[   91.416867] br-lan: topology change detected, sending tcn bpdu
<6>[ 1256.023874] sysrq: Trigger a crash
<0>[ 1256.023911] Kernel panic - not syncing: sysrq triggered crash
<4>[ 1256.026176] CPU: 2 PID: 2842 Comm: sh Tainted: G           O       6.6.32 #0
<4>[ 1256.031993] Hardware name: Linksys MX5300 (DT)
<4>[ 1256.039106] Call trace:
<4>[ 1256.043354]  dump_backtrace+0xb0/0x10c
<4>[ 1256.045701]  show_stack+0x18/0x24
<4>[ 1256.049519]  dump_stack_lvl+0x48/0x60
<4>[ 1256.052906]  dump_stack+0x18/0x24
<4>[ 1256.056550]  panic+0x2d0/0x31c
<4>[ 1256.059848]  sysrq_handle_moom+0x0/0x30
<4>[ 1256.062800]  __handle_sysrq+0xe4/0x1e0
<4>[ 1256.066534]  write_sysrq_trigger+0xbc/0xfc
<4>[ 1256.070354]  proc_reg_write+0xb0/0xf8
<4>[ 1256.074434]  vfs_write+0xa4/0x298
<4>[ 1256.078165]  ksys_write+0x5c/0xe0
<4>[ 1256.081464]  __arm64_sys_write+0x1c/0x28
<4>[ 1256.084763]  invoke_syscall.constprop.0+0x5c/0x100
<4>[ 1256.088758]  do_el0_svc+0x40/0xc8
<4>[ 1256.093355]  el0_svc+0x30/0xb8
<4>[ 1256.096740]  el0t_64_sync_handler+0x120/0x12c
<4>[ 1256.099694]  el0t_64_sync+0x178/0x17c
<2>[ 1256.104122] SMP: stopping secondary CPUs
<0>[ 1256.107773] Kernel Offset: disabled
<0>[ 1256.111759] CPU features: 0x0,00000000,00000000,0000400b
<0>[ 1256.114975] Memory Limit: none
```

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../arch/arm64/boot/dts/qcom/ipq6018-512m.dtsi   |  4 ++++
 .../arch/arm64/boot/dts/qcom/ipq8074-512m.dtsi   |  4 ++++
 ...0911-arm64-dts-qcom-ipq8074-add-ramoops.patch | 16 ++++++++++++++++
 ...0912-arm64-dts-qcom-ipq6018-add-ramoops.patch | 16 ++++++++++++++++
 4 files changed, 40 insertions(+)
 create mode 100644 target/linux/qualcommax/patches-6.6/0911-arm64-dts-qcom-ipq8074-add-ramoops.patch
 create mode 100644 target/linux/qualcommax/patches-6.6/0912-arm64-dts-qcom-ipq6018-add-ramoops.patch

diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq6018-512m.dtsi b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq6018-512m.dtsi
index d46a852404d946..51e0e7d8120db5 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq6018-512m.dtsi
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq6018-512m.dtsi
@@ -21,3 +21,7 @@
 	reg = <0x0 0x4ab00000 0x0 0x03700000>;
 	no-map;
 };
+
+&ramoops_region {
+	reg = <0x0 0x4e200000 0x0 0x100000>;
+};
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-512m.dtsi b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-512m.dtsi
index dace4008b38bdf..48f6345c948981 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-512m.dtsi
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-512m.dtsi
@@ -17,3 +17,7 @@
 &m3_dump_region {
 	reg = <0x0 0x4e800000 0x0 0x100000>;
 };
+
+&ramoops_region {
+	reg = <0x0 0x4e900000 0x0 0x100000>;
+};
diff --git a/target/linux/qualcommax/patches-6.6/0911-arm64-dts-qcom-ipq8074-add-ramoops.patch b/target/linux/qualcommax/patches-6.6/0911-arm64-dts-qcom-ipq8074-add-ramoops.patch
new file mode 100644
index 00000000000000..4da27793e55bae
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0911-arm64-dts-qcom-ipq8074-add-ramoops.patch
@@ -0,0 +1,16 @@
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -198,6 +198,13 @@
+ 			no-map;
+ 			reg = <0x0 0x51000000 0x0 0x100000>;
+ 		};
++
++		ramoops_region: ramoops@51200000 {
++			compatible = "ramoops";
++			reg = <0x0 0x51200000 0x0 0x100000>;
++			no-map;
++			record-size = <0x1000>;
++		};
+ 	};
+ 
+ 	firmware {
diff --git a/target/linux/qualcommax/patches-6.6/0912-arm64-dts-qcom-ipq6018-add-ramoops.patch b/target/linux/qualcommax/patches-6.6/0912-arm64-dts-qcom-ipq6018-add-ramoops.patch
new file mode 100644
index 00000000000000..4873f3cac754f4
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0912-arm64-dts-qcom-ipq6018-add-ramoops.patch
@@ -0,0 +1,16 @@
+--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+@@ -223,6 +223,13 @@
+ 			reg = <0x0 0x4ab00000 0x0 0x5500000>;
+ 			no-map;
+ 		};
++
++		ramoops_region: ramoops@50000000 {
++			compatible = "ramoops";
++			reg = <0x0 0x50000000 0x0 0x100000>;
++			no-map;
++			record-size = <0x1000>;
++		};
+ 	};
+ 
+ 	smem {

From 1d0a526a587fd13f2a1bca0cb6af1391c2c1c59d Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 22 Jun 2024 18:06:12 -0400
Subject: [PATCH 122/225] ath11k_nss: modularize nss-pbuf options

The following options can now be specified in `pbuf` uci config.

1.) auto_scale (bool) - enable or disable NSS CPU auto-scaling.
                        default: 'off'.

                        NOTE: Recommended to leave off, as it locks
                        NSS core to it's full 1.7Ghz speed. In the past
                        auto_scaling has been unstable, often causing
                        kernel panics or connection drops. Qualcomm
                        themselves disables scaling in QSDK for
                        ath11k/ath12k/qca-wifi.

                        It is provided to allow users wanting more
                        control over power usage. Setting to 'on' also
                        fixes NSS CPU stats updating properly.

2.) n2h_queue_limit_core0 (int) - set queue limits for CORE 0 and 1.
                                  default: '2048'

                                  For users on low memory systems (<=512M),
                                  that are experiencing issues can try lowering
                                  to the driver default of '256'.
---
 package/kernel/mac80211/files/pbuf.uci        |  1 +
 .../kernel/mac80211/files/qca-nss-pbuf.init   | 26 ++++++++++++-------
 2 files changed, 17 insertions(+), 10 deletions(-)

diff --git a/package/kernel/mac80211/files/pbuf.uci b/package/kernel/mac80211/files/pbuf.uci
index 4e01048e9bee0e..7057843ecdb3ac 100644
--- a/package/kernel/mac80211/files/pbuf.uci
+++ b/package/kernel/mac80211/files/pbuf.uci
@@ -1,4 +1,5 @@
 config general opt
+  option auto_scale 'off'
   # option memory_profile 'off'
   option memory_profile 'auto'
   # option memory_profile '1gb'
diff --git a/package/kernel/mac80211/files/qca-nss-pbuf.init b/package/kernel/mac80211/files/qca-nss-pbuf.init
index c6d6b8b2238074..5d88d1a67fe0b2 100755
--- a/package/kernel/mac80211/files/qca-nss-pbuf.init
+++ b/package/kernel/mac80211/files/qca-nss-pbuf.init
@@ -1,5 +1,5 @@
 #!/bin/sh /etc/rc.common
-#
+# shellcheck disable=3043
 # Copyright (c) 2021 The Linux Foundation. All rights reserved.
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -23,22 +23,24 @@ apply_sysctl() {
   # can't be changed if it is allocated, assume it's already been run.
   if [ "$(sysctl -n -e dev.nss.n2hcfg.extra_pbuf_core0)" -eq 0 ]; then
     logger -t ath11k_nss "$board - setting dev.nss.n2hcfg.extra_pbuf_core0=$extra_pbuf_core0"
-    sysctl -w dev.nss.n2hcfg.extra_pbuf_core0="$extra_pbuf_core0" > /dev/null 2> /dev/null
+    sysctl -w dev.nss.n2hcfg.extra_pbuf_core0="$extra_pbuf_core0" > /dev/null 2>&1
   else
     logger -t ath11k_nss "Sysctl key 'extra_pbuf_core0' already set to '""$extra_pbuf_core0""'. Skipping applying wifi nss configs"
   fi
 
-  sysctl -w dev.nss.n2hcfg.n2h_high_water_core0="$n2h_high_water_core0" > /dev/null 2>/dev/null
+  sysctl -w dev.nss.n2hcfg.n2h_high_water_core0="$n2h_high_water_core0" > /dev/null 2>&1
 
   logger -t ath11k_nss "$board - setting dev.nss.n2hcfg.n2h_wifi_pool_buf=$n2h_wifi_pool_buf"
-  sysctl -w dev.nss.n2hcfg.n2h_wifi_pool_buf="$n2h_wifi_pool_buf"
+  sysctl -w dev.nss.n2hcfg.n2h_wifi_pool_buf="$n2h_wifi_pool_buf" > /dev/null 2>&1
 
   logger -t ath11k_nss "$board - setting dev.nss.n2hcfg.n2h_high_water_core0=$n2h_high_water_core0"
-  sysctl -w dev.nss.n2hcfg.n2h_high_water_core0="$n2h_high_water_core0"
+  sysctl -w dev.nss.n2hcfg.n2h_high_water_core0="$n2h_high_water_core0" > /dev/null 2>&1
 
 }
 
 apply_nss_config() {
+  local auto_scale n2h_queue_limit_core0 n2h_queue_limit_core1
+
   if [ ! -r /sys/module/ath11k/parameters/nss_offload ]; then
     logger -t ath11k_nss "Module parameter '/sys/module/ath11k/parameters/nss_offload' does NOT exist. Skipping applying wifi nss configs"
     exit 1
@@ -56,13 +58,17 @@ apply_nss_config() {
     exit 1
   }
 
-  # Lock NSS clock to highest setting
-  sysctl -w dev.nss.clock.auto_scale=0 > /dev/null 2> /dev/null
+  config_load     pbuf
+  config_get_bool auto_scale            opt auto_scale            0
+  config_get      n2h_queue_limit_core0 opt n2h_queue_limit_core0 2048
+  config_get      n2h_queue_limit_core1 opt n2h_queue_limit_core1 2048
+
+  sysctl -w dev.nss.clock.auto_scale="$auto_scale" > /dev/null 2>&1
 
-  sysctl -w dev.nss.n2hcfg.n2h_queue_limit_core0=2048 > /dev/null 2> /dev/null
-  sysctl -w dev.nss.n2hcfg.n2h_queue_limit_core1=2048 > /dev/null 2> /dev/null
+  sysctl -w dev.nss.n2hcfg.n2h_queue_limit_core0="$n2h_queue_limit_core0" > /dev/null 2>&1
+  sysctl -w dev.nss.n2hcfg.n2h_queue_limit_core1="$n2h_queue_limit_core1" > /dev/null 2>&1
 
-  sysctl -w dev.nss.rps.hash_bitmap=15 > /dev/null 2> /dev/null
+  sysctl -w dev.nss.rps.hash_bitmap=15 > /dev/null 2>&1
 
   local memory_profile
   if memory_profile=$(uci_get pbuf.opt.memory_profile); then

From 622290bbee89ceb44b2142fce2fc03fa21642a72 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 22 Jun 2024 17:18:07 -0400
Subject: [PATCH 123/225] ath11k_nss: Organize patch order and formatting

NSS patches should always get applied last as to avoid fuzzing issues
with upstream patches.

Also cleanup patches that introduced spaces as indents vs. tabs

Signed-off-by: Sean Khan <datapronix@protonmail.com>

ath11k_nss: drop upstreamed patch

A variation of this patch 'wifi: mac80211: Use flexible array in struct ieee80211_tim_ie'
was upstreamed in commit 'e6e4d90b69027d74ba7e9a0a586b95a5714e10c0'.
Remove it to avoid compilation issues.

Signed-off-by: Sean Khan <datapronix@protonmail.com>

ath11k_nss: Fix patch conflict

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 package/kernel/mac80211/Makefile              | 20 ++++----
 .../199-003-ath11k-add-nss-support.patch      | 10 ++--
 ...load-changes-to-NSS-driver-interface.patch | 14 ++---
 ...vdev-in-NSS-for-AP_VLAN-vif-handling.patch | 18 +++----
 ...pport-for-WDS-offload-in-NSS-offload.patch |  2 +-
 ...dev-in-NSS-for-dynamic-VLAN-handling.patch | 12 ++---
 .../300-ath11k-nss-mesh-offload-support.patch | 36 ++++++-------
 .../301-ath11k-nss-mcbc-exception.patch       |  8 +--
 ...lookup-failure-in-mgmt-tx-completion.patch |  2 +-
 ...30-ath11k-sync-wds_ast_entry-updates.patch |  6 +--
 ...TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch |  2 +-
 ...ct-ast-index-assignment-for-wds-peer.patch |  4 +-
 ...ix-mutex-dead-lock-and-q6-dump-crash.patch |  2 +-
 ...agement-frames-to-firmware-before-wa.patch |  2 +-
 ...th11k-Advertise-TX_QUEUE-mac-hw-flag.patch |  2 +-
 ...11k-remove-invalid-peer-create-logic.patch |  4 +-
 ...th11k-rename-ath11k_start_vdev_delay.patch |  2 +-
 ...ation-of-ath11k_mac_start_vdev_delay.patch |  2 +-
 ...ailure-due-to-unexpected-peer-delete.patch | 16 +++---
 ...k-make-debugfs-sta-htt-stats-modular.patch |  2 +-
 ...11k-Disable-rx_header-tlv-for-2K-SKB.patch | 10 ++--
 ...-nss-thread-priority-during-pdev_ini.patch | 12 ++---
 ...999-336-0001-ath11k-idr-optimization.patch |  2 +-
 .../999-336-0002-ath11k-Use-idr_replace.patch |  4 +-
 .../199-001-mac80211-add-nss-support.patch    | 18 +++----
 ...03-mac80211-ath11k-fw-dynamic-muedca.patch |  2 +-
 ...-ath11k-Add-support-for-dynamic-vlan.patch | 24 ++++-----
 ...N-iftype-support-on-NSS-offload-case.patch | 30 +++++------
 ...-dynamic-VLAN-support-on-NSS-offload.patch |  6 +--
 .../nss/subsys/245-compilation_fix.patch      | 10 ++--
 .../300-ath11k-nss-mesh-offload-support.patch | 24 ++++-----
 ...TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch |  4 +-
 ...-0005-mac80211-simple-tx-for-AP-mode.patch |  4 +-
 .../336-mac80211-Mesh-Fast-rx-support.patch   | 10 ++--
 ...mac80211-fix-unconditional-sta-usage.patch |  4 +-
 ...unused-RX_FLAGS-from-mac80211_rx_fla.patch | 51 +++++++++++++++----
 ...ncapsulation-of-EAPOL-frames-if-OFFL.patch | 42 +++++++--------
 ...se-HW-checksum-offload-only-for-ethm.patch | 10 ++--
 ...1-Add-mac-hw-flag-to-avoid-queue-skb.patch | 14 ++---
 .../829-mac80211-fix-mesh-ping-issue.patch    | 13 +++--
 .../971-mac80211-fix-field-span-warning.patch | 11 ----
 ...ts-ipq8074-add-reserved-memory-nodes.patch |  4 +-
 ...added-for-necessary-clocks-and-reset.patch | 10 ++--
 ...-gcc_snoc_bus_timeout_ahb_clk-offset.patch |  4 +-
 ...074-Fix-gcc_blsp1_ahb_clk-properties.patch |  2 +-
 .../0600-1-qca-nss-ecm-support-CORE.patch     | 14 ++---
 ...-2-qca-nss-ecm-support-PPPOE-offload.patch |  4 +-
 ...x-IPv6-user-route-change-event-calls.patch | 10 ++--
 ...-1-qca-nss-clients-add-qdisc-support.patch |  8 +--
 ...qca-nss-clients-add-iptunnel-support.patch |  6 +--
 ...-5-qca-nss-clients-add-vxlan-support.patch |  4 +-
 ...a-nss-clients-iptunnel-lock-this-cpu.patch |  4 +-
 .../0604-1-qca-add-mcs-support.patch          |  4 +-
 .../0605-1-qca-nss-cfi-support.patch          | 24 ++++-----
 .../0981-1-qca-skb_recycler-support.patch     | 42 +++++++--------
 ...com-disable-swiotlb-for-64mb-savings.patch |  8 +--
 56 files changed, 319 insertions(+), 300 deletions(-)
 delete mode 100644 package/kernel/mac80211/patches/nss/subsys/971-mac80211-fix-field-span-warning.patch

diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile
index 82e8013fdd1478..9c0833d677948a 100644
--- a/package/kernel/mac80211/Makefile
+++ b/package/kernel/mac80211/Makefile
@@ -379,16 +379,16 @@ define Build/Patch
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath10k,ath10k/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath11k,ath11k/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath12k,ath12k/)
-ifdef CONFIG_ATH11K_NSS_SUPPORT
-	$(foreach driver,$(NSS_PATCH),
-		$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/nss/$(driver),nss/$(driver)/)
-	)
-endif
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rt2x00,rt2x00/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mt7601u,mt7601u/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mwl,mwl/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/brcm,brcm/)
 	$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rtl,rtl/)
+ifdef CONFIG_ATH11K_NSS_SUPPORT
+	$(foreach driver,$(NSS_PATCH),
+		$(call PatchDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/nss/$(driver),nss/$(driver)/)
+	)
+endif
 	$(if $(QUILT),touch $(PKG_BUILD_DIR)/.quilt_used)
 endef
 
@@ -401,16 +401,16 @@ define Quilt/Refresh/Package
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath10k,ath10k/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath11k,ath11k/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/ath12k,ath12k/)
-ifdef CONFIG_ATH11K_NSS_SUPPORT
-	$(foreach driver,$(NSS_PATCH),
-		$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/nss/$(driver),nss/$(driver)/)
-	)
-endif
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rt2x00,rt2x00/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mt7601u,mt7601u/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/mwl,mwl/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/brcm,brcm/)
 	$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/rtl,rtl/)
+ifdef CONFIG_ATH11K_NSS_SUPPORT
+	$(foreach driver,$(NSS_PATCH),
+		$(call Quilt/RefreshDir,$(PKG_BUILD_DIR),$(PATCH_DIR)/nss/$(driver),nss/$(driver)/)
+	)
+endif
 endef
 
 define Build/Compile
diff --git a/package/kernel/mac80211/patches/nss/ath11k/199-003-ath11k-add-nss-support.patch b/package/kernel/mac80211/patches/nss/ath11k/199-003-ath11k-add-nss-support.patch
index e30b5d761d3378..b123e3d2a74109 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/199-003-ath11k-add-nss-support.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/199-003-ath11k-add-nss-support.patch
@@ -1000,7 +1000,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	/* This shouldn't happen, indicating error during defragmentation */
  	if (skb_queue_empty(&subframe_list))
-@@ -658,12 +660,14 @@ drop:
+@@ -661,12 +663,14 @@ drop:
  	return -EINVAL;
  }
  
@@ -1016,7 +1016,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	if (!ar->ab->nss.enabled)
  		return 0;
-@@ -676,6 +680,22 @@ int ath11k_nss_vdev_set_cmd(struct ath11
+@@ -679,6 +683,22 @@ int ath11k_nss_vdev_set_cmd(struct ath11
  	if (!vdev_msg)
  		return -ENOMEM;
  
@@ -1039,7 +1039,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	/* TODO: Convert to function for conversion in case of many
  	 * such commands
  	 */
-@@ -1137,7 +1157,6 @@ void ath11k_nss_update_sta_stats(struct
+@@ -1140,7 +1160,6 @@ void ath11k_nss_update_sta_stats(struct
  {
  	struct sta_info *stainfo;
  	struct ath11k_peer *peer;
@@ -1047,7 +1047,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	struct ath11k *ar = arsta->arvif->ar;
  	struct ath11k_base *ab = ar->ab;
  
-@@ -1231,6 +1250,9 @@ void ath11k_nss_update_sta_rxrate(struct
+@@ -1234,6 +1253,9 @@ void ath11k_nss_update_sta_rxrate(struct
  	if (!ab->nss.enabled)
  		return;
  
@@ -1057,7 +1057,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	if (!peer->nss.nss_stats)
  		return;
  
-@@ -1290,7 +1312,7 @@ void ath11k_nss_update_sta_rxrate(struct
+@@ -1293,7 +1315,7 @@ void ath11k_nss_update_sta_rxrate(struct
  		peer->nss.nss_stats->rxrate.mcs = mcs;
  		peer->nss.nss_stats->rxrate.flags = RATE_INFO_FLAGS_HE_MCS;
  		peer->nss.nss_stats->rxrate.he_dcm = ppdu_info->dcm;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/211-001-ath11k-add-WDS-offload-changes-to-NSS-driver-interface.patch b/package/kernel/mac80211/patches/nss/ath11k/211-001-ath11k-add-WDS-offload-changes-to-NSS-driver-interface.patch
index a470ba934507f1..687bbd1f6aff46 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/211-001-ath11k-add-WDS-offload-changes-to-NSS-driver-interface.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/211-001-ath11k-add-WDS-offload-changes-to-NSS-driver-interface.patch
@@ -327,7 +327,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		dev_kfree_skb_any(skb);
  		return;
  	}
-@@ -1321,7 +1546,7 @@ void ath11k_nss_update_sta_rxrate(struct
+@@ -1324,7 +1549,7 @@ void ath11k_nss_update_sta_rxrate(struct
  	peer->nss.nss_stats->rxrate.bw = ath11k_mac_bw_to_mac80211_bw(ppdu_info->bw);
  }
  
@@ -336,7 +336,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  {
  	struct nss_wifili_peer_msg *peer_msg;
  	struct nss_wifili_msg *wlmsg = NULL;
-@@ -1335,9 +1560,10 @@ int ath11k_nss_peer_delete(struct ath11k
+@@ -1338,9 +1563,10 @@ int ath11k_nss_peer_delete(struct ath11k
  
  	spin_lock_bh(&ab->base_lock);
  
@@ -349,7 +349,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		spin_unlock_bh(&ab->base_lock);
  		return -EINVAL;
  	}
-@@ -1410,8 +1636,9 @@ free_peer:
+@@ -1413,8 +1639,9 @@ free_peer:
  	return ret;
  }
  
@@ -360,7 +360,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	struct nss_wifili_peer_msg *peer_msg;
  	struct nss_wifili_msg *wlmsg = NULL;
  	nss_wifili_msg_callback_t msg_cb;
-@@ -1468,17 +1695,23 @@ int ath11k_nss_peer_create(struct ath11k
+@@ -1471,17 +1698,23 @@ int ath11k_nss_peer_create(struct ath11k
  	status = nss_wifili_tx_msg(ab->nss.ctx, wlmsg);
  	if (status != NSS_TX_SUCCESS) {
  		ret = -EINVAL;
@@ -387,7 +387,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	peer->nss.nss_stats = kzalloc(sizeof(*peer->nss.nss_stats), GFP_ATOMIC);
  	if (!peer->nss.nss_stats) {
  		ret = -ENOMEM;
-@@ -1497,6 +1730,199 @@ msg_free:
+@@ -1500,6 +1733,199 @@ msg_free:
  	return ret;
  }
  
@@ -587,7 +587,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  /*-------------------------------INIT/DEINIT---------------------------------*/
  
  static int ath11k_nss_radio_buf_cfg(struct ath11k *ar, int range, int buf_sz)
-@@ -1890,7 +2316,7 @@ static int ath11k_nss_init(struct ath11k
+@@ -1893,7 +2319,7 @@ static int ath11k_nss_init(struct ath11k
  
  	status = nss_wifili_tx_msg(nss_contex, wlmsg);
  	if (status != NSS_TX_SUCCESS) {
@@ -596,7 +596,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		goto unregister;
  	}
  
-@@ -1944,7 +2370,8 @@ static int ath11k_nss_stats_cfg(struct a
+@@ -1947,7 +2373,8 @@ static int ath11k_nss_stats_cfg(struct a
  
  	status = nss_wifili_tx_msg(ar->nss.ctx, wlmsg);
  	if (status != NSS_TX_SUCCESS) {
diff --git a/package/kernel/mac80211/patches/nss/ath11k/235-002-ath11k-add-support-for-ext-vdev-in-NSS-for-AP_VLAN-vif-handling.patch b/package/kernel/mac80211/patches/nss/ath11k/235-002-ath11k-add-support-for-ext-vdev-in-NSS-for-AP_VLAN-vif-handling.patch
index 7a935968261d33..07f341cd047d59 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/235-002-ath11k-add-support-for-ext-vdev-in-NSS-for-AP_VLAN-vif-handling.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/235-002-ath11k-add-support-for-ext-vdev-in-NSS-for-AP_VLAN-vif-handling.patch
@@ -180,7 +180,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  int ath11k_nss_tx(struct ath11k_vif *arvif, struct sk_buff *skb)
  {
  	struct ath11k *ar = arvif->ar;
-@@ -867,10 +940,16 @@ int ath11k_nss_tx(struct ath11k_vif *arv
+@@ -869,10 +942,16 @@ int ath11k_nss_tx(struct ath11k_vif *arv
  		ath11k_nss_tx_encap_nwifi(skb);
  
  send:
@@ -201,7 +201,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
  	if (status != NSS_TX_SUCCESS) {
  		ath11k_dbg(ar->ab, (ATH11K_DBG_NSS | ATH11K_DBG_DP_TX),
-@@ -1211,6 +1290,7 @@ int ath11k_nss_vdev_up(struct ath11k_vif
+@@ -1214,6 +1293,7 @@ int ath11k_nss_vdev_up(struct ath11k_vif
  	struct nss_wifi_vdev_msg *vdev_msg = NULL;
  	struct nss_wifi_vdev_enable_msg *vdev_en;
  	struct ath11k *ar = arvif->ar;
@@ -209,7 +209,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	nss_tx_status_t status;
  	int ret = 0;
  
-@@ -1242,6 +1322,12 @@ int ath11k_nss_vdev_up(struct ath11k_vif
+@@ -1245,6 +1325,12 @@ int ath11k_nss_vdev_up(struct ath11k_vif
  	}
  
  	ath11k_dbg(ar->ab, ATH11K_DBG_NSS, "nss vdev up tx msg success\n");
@@ -222,7 +222,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  free:
  	kfree(vdev_msg);
  	return ret;
-@@ -1251,6 +1337,7 @@ int ath11k_nss_vdev_down(struct ath11k_v
+@@ -1254,6 +1340,7 @@ int ath11k_nss_vdev_down(struct ath11k_v
  {
  	struct nss_wifi_vdev_msg *vdev_msg = NULL;
  	struct ath11k *ar = arvif->ar;
@@ -230,7 +230,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	nss_tx_status_t status;
  	int ret = 0;
  
-@@ -1278,11 +1365,362 @@ int ath11k_nss_vdev_down(struct ath11k_v
+@@ -1281,11 +1368,362 @@ int ath11k_nss_vdev_down(struct ath11k_v
  	}
  
  	ath11k_dbg(ar->ab, ATH11K_DBG_NSS, "nss vdev down tx msg success\n");
@@ -593,7 +593,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  /*----------------------------Peer Setup/Config -----------------------------*/
  
  int ath11k_nss_set_peer_sec_type(struct ath11k *ar,
-@@ -1376,22 +1814,22 @@ free:
+@@ -1379,22 +1817,22 @@ free:
  	return status;
  }
  
@@ -623,7 +623,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  					sta->addr);
  		goto exit;
  	}
-@@ -1463,13 +1901,13 @@ void ath11k_nss_update_sta_rxrate(struct
+@@ -1466,13 +1904,13 @@ void ath11k_nss_update_sta_rxrate(struct
  				  struct ath11k_peer *peer,
  				  struct hal_rx_user_status *user_stats)
  {
@@ -639,7 +639,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	struct ath11k_base *ab = ar->ab;
  
  	if (!ab->nss.enabled)
-@@ -1773,8 +2211,8 @@ int ath11k_nss_add_wds_peer(struct ath11
+@@ -1776,8 +2214,8 @@ int ath11k_nss_add_wds_peer(struct ath11
  	}
  
  	ath11k_dbg(ab, ATH11K_DBG_NSS_WDS,
@@ -650,7 +650,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
  msg_free:
  	kfree(wlmsg);
-@@ -1819,8 +2257,8 @@ int ath11k_nss_update_wds_peer(struct at
+@@ -1822,8 +2260,8 @@ int ath11k_nss_update_wds_peer(struct at
  	}
  
  	ath11k_dbg(ab, ATH11K_DBG_NSS_WDS,
diff --git a/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch b/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
index b8eb343f4f8295..7e922f6aef9e50 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
@@ -542,7 +542,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
  		spin_unlock_bh(&ab->base_lock);
  		rcu_read_unlock();
-@@ -997,6 +1003,9 @@ int ath11k_nss_vdev_set_cmd(struct ath11
+@@ -1000,6 +1006,9 @@ int ath11k_nss_vdev_set_cmd(struct ath11
  	case ATH11K_NSS_WIFI_VDEV_DECAP_TYPE_CMD:
  		cmd = NSS_WIFI_VDEV_DECAP_TYPE_CMD;
  		break;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/236-002-ath11k-extend-ext-vdev-in-NSS-for-dynamic-VLAN-handling.patch b/package/kernel/mac80211/patches/nss/ath11k/236-002-ath11k-extend-ext-vdev-in-NSS-for-dynamic-VLAN-handling.patch
index cb1e39f149e409..bc0618693f4f25 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/236-002-ath11k-extend-ext-vdev-in-NSS-for-dynamic-VLAN-handling.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/236-002-ath11k-extend-ext-vdev-in-NSS-for-dynamic-VLAN-handling.patch
@@ -15,7 +15,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/nss.c
 +++ b/drivers/net/wireless/ath/ath11k/nss.c
-@@ -1527,14 +1527,11 @@ static int ath11k_nss_ext_vdev_register(
+@@ -1530,14 +1530,11 @@ static int ath11k_nss_ext_vdev_register(
  	struct ath11k *ar = arvif->ar;
  	struct ath11k_base *ab = ar->ab;
  	nss_tx_status_t status;
@@ -30,7 +30,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	arvif->nss.ctx = nss_wifi_ext_vdev_register_if(arvif->nss.if_num,
  						       ath11k_nss_ext_vdev_data_receive,
  						       ath11k_nss_ext_vdev_special_data_receive,
-@@ -1562,7 +1559,8 @@ static void ath11k_nss_ext_vdev_free(str
+@@ -1565,7 +1562,8 @@ static void ath11k_nss_ext_vdev_free(str
  
  	status = nss_dynamic_interface_dealloc_node(
  					arvif->nss.if_num,
@@ -40,7 +40,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	if (status != NSS_TX_SUCCESS)
  		ath11k_warn(ab, "failed to free nss ext vdev err:%d\n",
  			    status);
-@@ -1571,14 +1569,19 @@ static void ath11k_nss_ext_vdev_free(str
+@@ -1574,14 +1572,19 @@ static void ath11k_nss_ext_vdev_free(str
  			   "nss ext vdev interface deallocated\n");
  }
  
@@ -62,7 +62,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	if_num = nss_dynamic_interface_alloc_node(di_type);
  	if (if_num < 0) {
  		ath11k_warn(ab, "failed to allocate nss ext vdev\n");
-@@ -1587,8 +1590,8 @@ static int ath11k_nss_ext_vdev_alloc(str
+@@ -1590,8 +1593,8 @@ static int ath11k_nss_ext_vdev_alloc(str
  
  	arvif->nss.if_num = if_num;
  	ath11k_dbg(ab, ATH11K_DBG_NSS_WDS,
@@ -73,7 +73,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
  	return 0;
  }
-@@ -1617,7 +1620,7 @@ int ath11k_nss_ext_vdev_create(struct at
+@@ -1620,7 +1623,7 @@ int ath11k_nss_ext_vdev_create(struct at
  		return -EINVAL;
  	}
  
@@ -82,7 +82,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	if (ret)
  		return ret;
  
-@@ -1730,6 +1733,86 @@ free:
+@@ -1733,6 +1736,86 @@ free:
  	return ret;
  }
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch b/package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch
index dbd792aeca9b3e..af08f3530858c2 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch
@@ -1257,7 +1257,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  	mutex_unlock(&ar->conf_mutex);
  }
  
-@@ -9709,6 +9721,28 @@ err_fallback:
+@@ -9707,6 +9719,28 @@ err_fallback:
  	return 0;
  }
  
@@ -1286,7 +1286,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  static const struct ieee80211_ops ath11k_ops = {
  	.tx				= ath11k_mac_op_tx,
  	.wake_tx_queue			= ieee80211_handle_wake_tx_queue,
-@@ -9766,6 +9800,9 @@ static const struct ieee80211_ops ath11k
+@@ -9764,6 +9798,9 @@ static const struct ieee80211_ops ath11k
  	.set_sar_specs			= ath11k_mac_op_set_bios_sar_specs,
  	.remain_on_channel		= ath11k_mac_op_remain_on_channel,
  	.cancel_remain_on_channel	= ath11k_mac_op_cancel_remain_on_channel,
@@ -1296,7 +1296,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  };
  
  static void ath11k_mac_update_ch_list(struct ath11k *ar,
-@@ -10227,6 +10264,8 @@ static int __ath11k_mac_register(struct
+@@ -10225,6 +10262,8 @@ static int __ath11k_mac_register(struct
  		ieee80211_hw_set(ar->hw, SUPPORTS_NSS_OFFLOAD);
  		wiphy_ext_feature_set(ar->hw->wiphy,
  				      NL80211_EXT_FEATURE_VLAN_OFFLOAD);
@@ -2629,7 +2629,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  
  	if (status != NSS_TX_SUCCESS) {
  		ath11k_dbg(ar->ab, (ATH11K_DBG_NSS | ATH11K_DBG_DP_TX),
-@@ -1057,6 +2180,9 @@ static int ath11k_nss_vdev_configure(str
+@@ -1060,6 +2183,9 @@ static int ath11k_nss_vdev_configure(str
  
  	vdev_cfg = &vdev_msg->msg.vdev_config;
  
@@ -2639,7 +2639,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  	vdev_cfg->radio_ifnum = ar->nss.if_num;
  	vdev_cfg->vdev_id = arvif->vdev_id;
  
-@@ -1095,6 +2221,39 @@ free:
+@@ -1098,6 +2224,39 @@ free:
  	return ret;
  }
  
@@ -2679,7 +2679,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  static void ath11k_nss_vdev_unregister(struct ath11k_vif *arvif)
  {
  	struct ath11k_base *ab = arvif->ar->ab;
-@@ -1106,6 +2265,14 @@ static void ath11k_nss_vdev_unregister(s
+@@ -1109,6 +2268,14 @@ static void ath11k_nss_vdev_unregister(s
  		ath11k_dbg(ab, ATH11K_DBG_NSS, "unregistered nss vdev %d \n",
  			   arvif->nss.if_num);
  		break;
@@ -2694,7 +2694,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  	default:
  		ath11k_warn(ab, "unsupported interface type %d for nss vdev unregister\n",
  			    arvif->vif->type);
-@@ -1113,6 +2280,78 @@ static void ath11k_nss_vdev_unregister(s
+@@ -1116,6 +2283,78 @@ static void ath11k_nss_vdev_unregister(s
  	}
  }
  
@@ -2773,7 +2773,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  static int ath11k_nss_vdev_register(struct ath11k_vif *arvif,
  				    struct net_device *netdev)
  {
-@@ -1140,6 +2379,15 @@ static int ath11k_nss_vdev_register(stru
+@@ -1143,6 +2382,15 @@ static int ath11k_nss_vdev_register(stru
  			   arvif->nss.if_num);
  
  		break;
@@ -2789,7 +2789,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  	default:
  		ath11k_warn(ab, "unsupported interface type %d for nss vdev register\n",
  			    arvif->vif->type);
-@@ -1149,6 +2397,62 @@ static int ath11k_nss_vdev_register(stru
+@@ -1152,6 +2400,62 @@ static int ath11k_nss_vdev_register(stru
  	return 0;
  }
  
@@ -2852,7 +2852,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  void ath11k_nss_vdev_free(struct ath11k_vif *arvif)
  {
  	struct ath11k_base *ab = arvif->ar->ab;
-@@ -1168,6 +2472,11 @@ void ath11k_nss_vdev_free(struct ath11k_
+@@ -1171,6 +2475,11 @@ void ath11k_nss_vdev_free(struct ath11k_
  				   "nss vdev interface deallocated\n");
  
  		return;
@@ -2864,7 +2864,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  	default:
  		ath11k_warn(ab, "unsupported interface type %d for nss vdev dealloc\n",
  			    arvif->vif->type);
-@@ -1175,11 +2484,96 @@ void ath11k_nss_vdev_free(struct ath11k_
+@@ -1178,11 +2487,96 @@ void ath11k_nss_vdev_free(struct ath11k_
  	}
  }
  
@@ -2962,7 +2962,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  
  	/* Initialize completion for verifying NSS message response */
  	init_completion(&arvif->nss.complete);
-@@ -1201,6 +2595,16 @@ static int ath11k_nss_vdev_alloc(struct
+@@ -1204,6 +2598,16 @@ static int ath11k_nss_vdev_alloc(struct
  			   arvif->nss.if_num);
  
  		break;
@@ -2979,7 +2979,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  	default:
  		ath11k_warn(ab, "unsupported interface type %d for nss vdev alloc\n",
  			    arvif->vif->type);
-@@ -1238,7 +2642,7 @@ int ath11k_nss_vdev_create(struct ath11k
+@@ -1241,7 +2645,7 @@ int ath11k_nss_vdev_create(struct ath11k
  		return -EINVAL;
  	}
  
@@ -2988,7 +2988,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  	if (ret)
  		return ret;
  
-@@ -1254,6 +2658,45 @@ int ath11k_nss_vdev_create(struct ath11k
+@@ -1257,6 +2661,45 @@ int ath11k_nss_vdev_create(struct ath11k
  			goto unregister_vdev;
  
  		break;
@@ -3034,7 +3034,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  	default:
  		ret = -ENOTSUPP;
  		goto unregister_vdev;
-@@ -1310,6 +2753,15 @@ int ath11k_nss_vdev_up(struct ath11k_vif
+@@ -1313,6 +2756,15 @@ int ath11k_nss_vdev_up(struct ath11k_vif
  	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR)
  		return 0;
  
@@ -3050,7 +3050,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  	vdev_msg = kzalloc(sizeof(struct nss_wifi_vdev_msg), GFP_ATOMIC);
  	if (!vdev_msg)
  		return -ENOMEM;
-@@ -1357,6 +2809,15 @@ int ath11k_nss_vdev_down(struct ath11k_v
+@@ -1360,6 +2812,15 @@ int ath11k_nss_vdev_down(struct ath11k_v
  	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR)
  		return 0;
  
@@ -3066,7 +3066,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  	vdev_msg = kzalloc(sizeof(struct nss_wifi_vdev_msg), GFP_ATOMIC);
  	if (!vdev_msg)
  		return -ENOMEM;
-@@ -2731,6 +4192,51 @@ static int ath11k_nss_get_dynamic_interf
+@@ -2734,6 +4195,51 @@ static int ath11k_nss_get_dynamic_interf
  	}
  }
  
@@ -3118,7 +3118,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  static int ath11k_nss_init(struct ath11k_base *ab)
  {
  	struct nss_wifili_init_msg *wim = NULL;
-@@ -2863,6 +4369,17 @@ static int ath11k_nss_init(struct ath11k
+@@ -2866,6 +4372,17 @@ static int ath11k_nss_init(struct ath11k
  
  	kfree(wlmsg);
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/301-ath11k-nss-mcbc-exception.patch b/package/kernel/mac80211/patches/nss/ath11k/301-ath11k-nss-mcbc-exception.patch
index 2fa70d0f395ab3..ea279879b80d4d 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/301-ath11k-nss-mcbc-exception.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/301-ath11k-nss-mcbc-exception.patch
@@ -126,7 +126,7 @@ Change-Id: I4a6ac67a1c2cf3ab7a219d0953907191606a5e70
  }
  
  static void
-@@ -2129,6 +2163,9 @@ int ath11k_nss_vdev_set_cmd(struct ath11
+@@ -2132,6 +2166,9 @@ int ath11k_nss_vdev_set_cmd(struct ath11
  	case ATH11K_NSS_WIFI_VDEV_CFG_WDS_BACKHAUL_CMD:
  		cmd = NSS_WIFI_VDEV_CFG_WDS_BACKHAUL_CMD;
  		break;
@@ -136,7 +136,7 @@ Change-Id: I4a6ac67a1c2cf3ab7a219d0953907191606a5e70
  	default:
  		return -EINVAL;
  	}
-@@ -2651,12 +2688,31 @@ int ath11k_nss_vdev_create(struct ath11k
+@@ -2654,12 +2691,31 @@ int ath11k_nss_vdev_create(struct ath11k
  		goto free_vdev;
  
  	switch (arvif->vif->type) {
@@ -169,7 +169,7 @@ Change-Id: I4a6ac67a1c2cf3ab7a219d0953907191606a5e70
  		break;
  #ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
  	case NL80211_IFTYPE_MESH_POINT:
-@@ -2987,7 +3043,6 @@ static int ath11k_nss_ext_vdev_register(
+@@ -2990,7 +3046,6 @@ static int ath11k_nss_ext_vdev_register(
  {
  	struct ath11k *ar = arvif->ar;
  	struct ath11k_base *ab = ar->ab;
@@ -177,7 +177,7 @@ Change-Id: I4a6ac67a1c2cf3ab7a219d0953907191606a5e70
  	u32 features = 0;
  
  	if (arvif->vif->type != NL80211_IFTYPE_AP_VLAN || arvif->nss.ctx)
-@@ -3001,7 +3056,7 @@ static int ath11k_nss_ext_vdev_register(
+@@ -3004,7 +3059,7 @@ static int ath11k_nss_ext_vdev_register(
  
  	if (!arvif->nss.ctx) {
  		ath11k_warn(ab, "failed to register nss vdev if_num %d nss_err:%d\n",
diff --git a/package/kernel/mac80211/patches/nss/ath11k/314-ath11k-Fix-peer-lookup-failure-in-mgmt-tx-completion.patch b/package/kernel/mac80211/patches/nss/ath11k/314-ath11k-Fix-peer-lookup-failure-in-mgmt-tx-completion.patch
index 6edfd5f9208e97..448bd3c70daab4 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/314-ath11k-Fix-peer-lookup-failure-in-mgmt-tx-completion.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/314-ath11k-Fix-peer-lookup-failure-in-mgmt-tx-completion.patch
@@ -23,7 +23,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -7638,8 +7638,10 @@ err_vdev_del:
+@@ -7636,8 +7636,10 @@ err_vdev_del:
  	kfree(arvif->vlan_keyid_map);
  	ath11k_peer_cleanup(ar, arvif->vdev_id);
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/330-ath11k-sync-wds_ast_entry-updates.patch b/package/kernel/mac80211/patches/nss/ath11k/330-ath11k-sync-wds_ast_entry-updates.patch
index 01ccc6003fc0cf..9993e4d4773321 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/330-ath11k-sync-wds_ast_entry-updates.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/330-ath11k-sync-wds_ast_entry-updates.patch
@@ -124,7 +124,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  			break;
  		default:
  			ath11k_warn(ab, "unsupported wds_type %d\n", wds_type);
-@@ -3796,11 +3797,7 @@ int ath11k_nss_add_wds_peer(struct ath11
+@@ -3799,11 +3800,7 @@ int ath11k_nss_add_wds_peer(struct ath11
  	wds_peer_msg->ast_type = type;
  	wds_peer_msg->peer_id = peer->peer_id;
  
@@ -137,7 +137,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  	ether_addr_copy(wds_peer_msg->dest_mac, dest_mac);
  
  	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
-@@ -3923,7 +3920,7 @@ msg_free:
+@@ -3926,7 +3923,7 @@ msg_free:
  	return ret;
  }
  
@@ -146,7 +146,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  			    u8 *dest_mac)
  {
  	struct ath11k_base *ab = ar->ab;
-@@ -3941,8 +3938,8 @@ int ath11k_nss_del_wds_peer(struct ath11
+@@ -3944,8 +3941,8 @@ int ath11k_nss_del_wds_peer(struct ath11
  
  	wds_peer_msg->pdev_id = ar->pdev->pdev_id;
  	wds_peer_msg->ast_type = ATH11K_AST_TYPE_NONE;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch b/package/kernel/mac80211/patches/nss/ath11k/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
index 8e018e619f12f8..cb33d8d347f7c4 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
@@ -58,7 +58,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  	tcl_cmd.info3 = FIELD_PREP(HAL_TCL_DATA_CMD_INFO3_DSCP_TID_TABLE_IDX,
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -10150,6 +10150,8 @@ static int __ath11k_mac_register(struct
+@@ -10148,6 +10148,8 @@ static int __ath11k_mac_register(struct
  			ieee80211_hw_set(ar->hw, USES_RSS);
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/362-ath11k-fix-incorrect-ast-index-assignment-for-wds-peer.patch b/package/kernel/mac80211/patches/nss/ath11k/362-ath11k-fix-incorrect-ast-index-assignment-for-wds-peer.patch
index 3786bd3de9647d..cc2981a2c0fac4 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/362-ath11k-fix-incorrect-ast-index-assignment-for-wds-peer.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/362-ath11k-fix-incorrect-ast-index-assignment-for-wds-peer.patch
@@ -19,7 +19,7 @@ Signed-off-by: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/nss.c
 +++ b/drivers/net/wireless/ath/ath11k/nss.c
-@@ -3871,13 +3871,14 @@ msg_free:
+@@ -3874,13 +3874,14 @@ msg_free:
  }
  
  int ath11k_nss_map_wds_peer(struct ath11k *ar, struct ath11k_peer *peer,
@@ -35,7 +35,7 @@ Signed-off-by: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
  	int ret = 0;
  
  	wlmsg = kzalloc(sizeof(struct nss_wifili_msg), GFP_ATOMIC);
-@@ -3887,7 +3888,7 @@ int ath11k_nss_map_wds_peer(struct ath11
+@@ -3890,7 +3891,7 @@ int ath11k_nss_map_wds_peer(struct ath11
  	wds_peer_map_msg = &wlmsg->msg.wdspeermapmsg;
  
  	wds_peer_map_msg->vdev_id = peer->vdev_id;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/401-ath11k-Fix-mutex-dead-lock-and-q6-dump-crash.patch b/package/kernel/mac80211/patches/nss/ath11k/401-ath11k-Fix-mutex-dead-lock-and-q6-dump-crash.patch
index ceeb15c8cbea65..125250fdb381cc 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/401-ath11k-Fix-mutex-dead-lock-and-q6-dump-crash.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/401-ath11k-Fix-mutex-dead-lock-and-q6-dump-crash.patch
@@ -36,7 +36,7 @@ Signed-off-by: Rajat Soni <quic_rajson@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -6786,7 +6786,9 @@ static int ath11k_mac_op_start(struct ie
+@@ -6784,7 +6784,9 @@ static int ath11k_mac_op_start(struct ie
  		break;
  	case ATH11K_STATE_RESTARTING:
  		ar->state = ATH11K_STATE_RESTARTED;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/453-ath11k-flush-management-frames-to-firmware-before-wa.patch b/package/kernel/mac80211/patches/nss/ath11k/453-ath11k-flush-management-frames-to-firmware-before-wa.patch
index 90982924fe29f7..cc1f393c2b3074 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/453-ath11k-flush-management-frames-to-firmware-before-wa.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/453-ath11k-flush-management-frames-to-firmware-before-wa.patch
@@ -27,7 +27,7 @@ Signed-off-by: Hari Chandrakanthan <quic_haric@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -8464,6 +8464,8 @@ static int ath11k_mac_flush_tx_complete(
+@@ -8462,6 +8462,8 @@ static int ath11k_mac_flush_tx_complete(
  		ret = -ETIMEDOUT;
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/456-wifi-ath11k-Advertise-TX_QUEUE-mac-hw-flag.patch b/package/kernel/mac80211/patches/nss/ath11k/456-wifi-ath11k-Advertise-TX_QUEUE-mac-hw-flag.patch
index 510fbc2448cee7..c9b8f4dbb391d5 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/456-wifi-ath11k-Advertise-TX_QUEUE-mac-hw-flag.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/456-wifi-ath11k-Advertise-TX_QUEUE-mac-hw-flag.patch
@@ -13,7 +13,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -10141,6 +10141,7 @@ static int __ath11k_mac_register(struct
+@@ -10139,6 +10139,7 @@ static int __ath11k_mac_register(struct
  	ieee80211_hw_set(ar->hw, QUEUE_CONTROL);
  	ieee80211_hw_set(ar->hw, SUPPORTS_TX_FRAG);
  	ieee80211_hw_set(ar->hw, REPORTS_LOW_ACK);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/907-01-wifi-ath11k-remove-invalid-peer-create-logic.patch b/package/kernel/mac80211/patches/nss/ath11k/907-01-wifi-ath11k-remove-invalid-peer-create-logic.patch
index 4d8f9f28e3a1e3..401fa2d012b9b4 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/907-01-wifi-ath11k-remove-invalid-peer-create-logic.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/907-01-wifi-ath11k-remove-invalid-peer-create-logic.patch
@@ -26,7 +26,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -8218,7 +8218,6 @@ ath11k_mac_op_assign_vif_chanctx(struct
+@@ -8216,7 +8216,6 @@ ath11k_mac_op_assign_vif_chanctx(struct
  	struct ath11k_base *ab = ar->ab;
  	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
  	int ret;
@@ -34,7 +34,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  
  	mutex_lock(&ar->conf_mutex);
  
-@@ -8241,21 +8240,6 @@ ath11k_mac_op_assign_vif_chanctx(struct
+@@ -8239,21 +8238,6 @@ ath11k_mac_op_assign_vif_chanctx(struct
  		goto out;
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/907-02-wifi-ath11k-rename-ath11k_start_vdev_delay.patch b/package/kernel/mac80211/patches/nss/ath11k/907-02-wifi-ath11k-rename-ath11k_start_vdev_delay.patch
index 7d04e371edd5fa..12744f51c64e96 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/907-02-wifi-ath11k-rename-ath11k_start_vdev_delay.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/907-02-wifi-ath11k-rename-ath11k_start_vdev_delay.patch
@@ -39,7 +39,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  		if (ret) {
  			ath11k_warn(ab, "failed to delay vdev start: %d\n", ret);
  			goto free_tx_stats;
-@@ -8161,8 +8161,8 @@ unlock:
+@@ -8159,8 +8159,8 @@ unlock:
  	mutex_unlock(&ar->conf_mutex);
  }
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/907-03-wifi-ath11k-avoid-forward-declaration-of-ath11k_mac_start_vdev_delay.patch b/package/kernel/mac80211/patches/nss/ath11k/907-03-wifi-ath11k-avoid-forward-declaration-of-ath11k_mac_start_vdev_delay.patch
index f928d851a678d7..710ad5aa5becca 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/907-03-wifi-ath11k-avoid-forward-declaration-of-ath11k_mac_start_vdev_delay.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/907-03-wifi-ath11k-avoid-forward-declaration-of-ath11k_mac_start_vdev_delay.patch
@@ -317,7 +317,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  static int ath11k_mac_op_sta_set_txpwr(struct ieee80211_hw *hw,
  				       struct ieee80211_vif *vif,
  				       struct ieee80211_sta *sta)
-@@ -9738,6 +9460,281 @@ ath11k_mac_op_config_mesh_offload_path(s
+@@ -9736,6 +9458,281 @@ ath11k_mac_op_config_mesh_offload_path(s
  }
  #endif
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/907-04-wifi-ath11k-fix-connection-failure-due-to-unexpected-peer-delete.patch b/package/kernel/mac80211/patches/nss/ath11k/907-04-wifi-ath11k-fix-connection-failure-due-to-unexpected-peer-delete.patch
index 010825fd16656e..462e8cad727b5a 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/907-04-wifi-ath11k-fix-connection-failure-due-to-unexpected-peer-delete.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/907-04-wifi-ath11k-fix-connection-failure-due-to-unexpected-peer-delete.patch
@@ -52,7 +52,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -7930,6 +7930,30 @@ static int ath11k_mac_start_vdev_delay(s
+@@ -7928,6 +7928,30 @@ static int ath11k_mac_start_vdev_delay(s
  	return 0;
  }
  
@@ -83,7 +83,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  static int
  ath11k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw,
  				 struct ieee80211_vif *vif,
-@@ -7974,15 +7998,17 @@ ath11k_mac_op_assign_vif_chanctx(struct
+@@ -7972,15 +7996,17 @@ ath11k_mac_op_assign_vif_chanctx(struct
  		goto out;
  	}
  
@@ -109,7 +109,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  
  	if (arvif->vdev_type != WMI_VDEV_TYPE_MONITOR &&
  	    test_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags)) {
-@@ -8022,8 +8048,6 @@ ath11k_mac_op_unassign_vif_chanctx(struc
+@@ -8020,8 +8046,6 @@ ath11k_mac_op_unassign_vif_chanctx(struc
  		   "chanctx unassign ptr %p vdev_id %i\n",
  		   ctx, arvif->vdev_id);
  
@@ -118,7 +118,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  	if (ab->hw_params.vdev_start_delay &&
  	    arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
  		spin_lock_bh(&ab->base_lock);
-@@ -8047,24 +8071,13 @@ ath11k_mac_op_unassign_vif_chanctx(struc
+@@ -8045,24 +8069,13 @@ ath11k_mac_op_unassign_vif_chanctx(struc
  		return;
  	}
  
@@ -149,7 +149,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  	}
  
  	if (ab->hw_params.vdev_start_delay &&
-@@ -9554,6 +9567,46 @@ exit:
+@@ -9552,6 +9565,46 @@ exit:
  	return ret;
  }
  
@@ -196,7 +196,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  static int ath11k_mac_op_sta_state(struct ieee80211_hw *hw,
  				   struct ieee80211_vif *vif,
  				   struct ieee80211_sta *sta,
-@@ -9589,31 +9642,15 @@ static int ath11k_mac_op_sta_state(struc
+@@ -9587,31 +9640,15 @@ static int ath11k_mac_op_sta_state(struc
  				    sta->addr, arvif->vdev_id);
  	} else if ((old_state == IEEE80211_STA_NONE &&
  		    new_state == IEEE80211_STA_NOTEXIST)) {
@@ -233,7 +233,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  			ath11k_warn(ar->ab, "Found peer entry %pM n vdev %i after it was supposedly removed\n",
  				    vif->addr, arvif->vdev_id);
  			ath11k_peer_rhash_delete(ar->ab, peer);
-@@ -9624,12 +9661,6 @@ static int ath11k_mac_op_sta_state(struc
+@@ -9622,12 +9659,6 @@ static int ath11k_mac_op_sta_state(struc
  		}
  		spin_unlock_bh(&ar->ab->base_lock);
  		mutex_unlock(&ar->ab->tbl_mtx_lock);
@@ -246,7 +246,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  	} else if (old_state == IEEE80211_STA_AUTH &&
  		   new_state == IEEE80211_STA_ASSOC &&
  		   (vif->type == NL80211_IFTYPE_AP ||
-@@ -10202,6 +10233,8 @@ static int __ath11k_mac_register(struct
+@@ -10200,6 +10231,8 @@ static int __ath11k_mac_register(struct
  
  	wiphy_ext_feature_set(ar->hw->wiphy, NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/908-ath11k-make-debugfs-sta-htt-stats-modular.patch b/package/kernel/mac80211/patches/nss/ath11k/908-ath11k-make-debugfs-sta-htt-stats-modular.patch
index 4276e64cc30364..829f59bfdc43b5 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/908-ath11k-make-debugfs-sta-htt-stats-modular.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/908-ath11k-make-debugfs-sta-htt-stats-modular.patch
@@ -176,7 +176,7 @@
  	spin_unlock_bh(&ab->base_lock);
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -9811,7 +9811,7 @@ static const struct ieee80211_ops ath11k
+@@ -9809,7 +9809,7 @@ static const struct ieee80211_ops ath11k
  	.set_wakeup			= ath11k_wow_op_set_wakeup,
  #endif
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch b/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
index 322698f0ea8d84..57a6b7fb4a7ddb 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
@@ -501,7 +501,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
 --- a/drivers/net/wireless/ath/ath11k/dp_tx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
-@@ -1263,6 +1263,8 @@ int ath11k_dp_tx_htt_rx_filter_setup(str
+@@ -1275,6 +1275,8 @@ int ath11k_dp_tx_htt_rx_filter_setup(str
  				 !!(params.flags & HAL_SRNG_FLAGS_MSI_SWAP));
  	cmd->info0 |= FIELD_PREP(HTT_RX_RING_SELECTION_CFG_CMD_INFO0_PS,
  				 !!(params.flags & HAL_SRNG_FLAGS_DATA_TLV_SWAP));
@@ -510,7 +510,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  	cmd->info1 = FIELD_PREP(HTT_RX_RING_SELECTION_CFG_CMD_INFO1_BUF_SIZE,
  				rx_buf_size);
-@@ -1272,6 +1274,26 @@ int ath11k_dp_tx_htt_rx_filter_setup(str
+@@ -1284,6 +1286,26 @@ int ath11k_dp_tx_htt_rx_filter_setup(str
  	cmd->pkt_type_en_flags3 = tlv_filter->pkt_filter_flags3;
  	cmd->rx_filter_tlv = tlv_filter->rx_filter;
  
@@ -537,7 +537,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	ret = ath11k_htc_send(&ab->htc, ab->dp.eid, skb);
  	if (ret)
  		goto err_free;
-@@ -1350,6 +1372,7 @@ int ath11k_dp_tx_htt_monitor_mode_ring_c
+@@ -1362,6 +1384,7 @@ int ath11k_dp_tx_htt_monitor_mode_ring_c
  	}
  
  	ring_id = dp->rxdma_mon_buf_ring.refill_buf_ring.ring_id;
@@ -933,7 +933,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  extern const struct ath11k_hw_ops ipq8074_ops;
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -6450,6 +6450,7 @@ static int ath11k_mac_config_mon_status_
+@@ -6448,6 +6448,7 @@ static int ath11k_mac_config_mon_status_
  			tlv_filter.rx_filter = ath11k_debugfs_rx_filter(ar);
  	}
  
@@ -999,7 +999,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  #endif /* ATH11K_RX_DESC_H */
 --- a/drivers/net/wireless/ath/ath11k/nss.c
 +++ b/drivers/net/wireless/ath/ath11k/nss.c
-@@ -4360,7 +4360,7 @@ static int ath11k_nss_init(struct ath11k
+@@ -4363,7 +4363,7 @@ static int ath11k_nss_init(struct ath11k
  
  	/* fill rx parameters to initialize rx context */
  	wim->wrip.tlv_size = ab->hw_params.hal_desc_sz;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-311-ath11k-configure-nss-thread-priority-during-pdev_ini.patch b/package/kernel/mac80211/patches/nss/ath11k/999-311-ath11k-configure-nss-thread-priority-during-pdev_ini.patch
index c95960f2de04bf..7f92958691077e 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-311-ath11k-configure-nss-thread-priority-during-pdev_ini.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-311-ath11k-configure-nss-thread-priority-during-pdev_ini.patch
@@ -22,7 +22,7 @@ Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
  
  #include "debug.h"
  #include "mac.h"
-@@ -4342,6 +4343,7 @@ static int ath11k_nss_init(struct ath11k
+@@ -4345,6 +4346,7 @@ static int ath11k_nss_init(struct ath11k
  	nss_tx_status_t status;
  	struct ath11k_dp *dp;
  	int i, ret;
@@ -30,7 +30,7 @@ Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
  
  	dp = &ab->dp;
  
-@@ -4361,6 +4363,8 @@ static int ath11k_nss_init(struct ath11k
+@@ -4364,6 +4366,8 @@ static int ath11k_nss_init(struct ath11k
  	/* fill rx parameters to initialize rx context */
  	wim->wrip.tlv_size = ab->hw_params.hal_desc_sz;
  	wim->wrip.rx_buf_len = DP_RXDMA_NSS_REFILL_RING_SIZE;
@@ -39,7 +39,7 @@ Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
  
  	/* fill hal srng message */
  	wim->hssm.dev_base_addr = (u32)ab->mem_pa;
-@@ -4549,11 +4553,13 @@ int ath11k_nss_pdev_init(struct ath11k_b
+@@ -4552,11 +4556,13 @@ int ath11k_nss_pdev_init(struct ath11k_b
  	struct nss_wifili_msg *wlmsg = NULL;
  	nss_wifili_msg_callback_t msg_cb;
  	nss_tx_status_t status;
@@ -54,7 +54,7 @@ Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
  
  	dyn_if_type = ath11k_nss_get_dynamic_interface_type(ab);
  
-@@ -4582,6 +4588,15 @@ int ath11k_nss_pdev_init(struct ath11k_b
+@@ -4585,6 +4591,15 @@ int ath11k_nss_pdev_init(struct ath11k_b
  	ath11k_dbg(ab, ATH11K_DBG_NSS, "nss pdev init - id:%d init ctxt:%p ifnum:%d\n",
  		   ar->pdev->pdev_id, ar->nss.ctx, ar->nss.if_num);
  
@@ -70,7 +70,7 @@ Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
  	wlmsg = kzalloc(sizeof(struct nss_wifili_msg), GFP_ATOMIC);
  	if (!wlmsg) {
  		ret = -ENOMEM;
-@@ -4594,6 +4609,7 @@ int ath11k_nss_pdev_init(struct ath11k_b
+@@ -4597,6 +4612,7 @@ int ath11k_nss_pdev_init(struct ath11k_b
  	pdevmsg->lmac_id = ar->lmac_id;
  	pdevmsg->target_pdev_id = ar->pdev->pdev_id;
  	pdevmsg->num_rx_swdesc = WIFILI_RX_DESC_POOL_WEIGHT * DP_RXDMA_BUF_RING_SIZE;
@@ -78,7 +78,7 @@ Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
  
  	/* Store rxdma ring info to the message */
  	refill_ring_id = ar->dp.rx_refill_buf_ring.refill_buf_ring.ring_id;
-@@ -4887,6 +4903,9 @@ int ath11k_nss_pdev_deinit(struct ath11k
+@@ -4890,6 +4906,9 @@ int ath11k_nss_pdev_deinit(struct ath11k
  	/* pdev deinit msg success, dealloc, deregister and return */
  	ret = 0;
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-336-0001-ath11k-idr-optimization.patch b/package/kernel/mac80211/patches/nss/ath11k/999-336-0001-ath11k-idr-optimization.patch
index ef01c639a266b4..abcc7a197e4300 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-336-0001-ath11k-idr-optimization.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-336-0001-ath11k-idr-optimization.patch
@@ -111,7 +111,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  
  			rxcb = ATH11K_SKB_RXCB(skb);
  			dma_unmap_single(ab->dev, rxcb->paddr,
-@@ -6429,16 +6420,14 @@ ath11k_dp_rx_full_mon_mpdu_pop(struct at
+@@ -6423,16 +6414,14 @@ ath11k_dp_rx_full_mon_mpdu_pop(struct at
  					   msdu_list.sw_cookie[i]);
  
  			spin_lock_bh(&rx_ring->idr_lock);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch b/package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch
index 974de141070d63..9a212c39440f29 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch
@@ -233,7 +233,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  
  	return budget - quota;
  }
-@@ -6182,12 +6225,12 @@ static void ath11k_dp_rx_mon_dest_proces
+@@ -6176,12 +6219,12 @@ static void ath11k_dp_rx_mon_dest_proces
  			ath11k_dp_rxbufs_replenish(ar->ab, dp->mac_id,
  						   &dp->rxdma_mon_buf_ring,
  						   rx_bufs_used,
@@ -248,7 +248,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	}
  }
  
-@@ -6697,7 +6740,7 @@ next_entry:
+@@ -6691,7 +6734,7 @@ next_entry:
  		ath11k_dp_rxbufs_replenish(ar->ab, dp->mac_id,
  					   &dp->rxdma_mon_buf_ring,
  					   rx_bufs_used,
diff --git a/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch b/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch
index ecdf4d15c0c896..94560505fe052b 100644
--- a/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch
@@ -53,7 +53,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  };
  
  /**
-@@ -1410,7 +1426,7 @@ ieee80211_tx_info_clear_status(struct ie
+@@ -1413,7 +1429,7 @@ ieee80211_tx_info_clear_status(struct ie
   * @RX_FLAG_AMPDU_EOF_BIT_KNOWN: The EOF value is known
   * @RX_FLAG_RADIOTAP_HE: HE radiotap data is present
   *	(&struct ieee80211_radiotap_he, mac80211 will fill in
@@ -62,7 +62,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   *	 - DATA3_DATA_MCS
   *	 - DATA3_DATA_DCM
   *	 - DATA3_CODING
-@@ -1418,7 +1434,7 @@ ieee80211_tx_info_clear_status(struct ie
+@@ -1421,7 +1437,7 @@ ieee80211_tx_info_clear_status(struct ie
   *	 - DATA5_DATA_BW_RU_ALLOC
   *	 - DATA6_NSTS
   *	 - DATA3_STBC
@@ -71,7 +71,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   *	from the RX info data, so leave those zeroed when building this data)
   * @RX_FLAG_RADIOTAP_HE_MU: HE MU radiotap data is present
   *	(&struct ieee80211_radiotap_he_mu)
-@@ -1991,6 +2007,16 @@ static inline bool lockdep_vif_mutex_hel
+@@ -1996,6 +2012,16 @@ static inline bool lockdep_vif_mutex_hel
  			      lockdep_vif_mutex_held(vif))
  
  /**
@@ -88,7 +88,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   * enum ieee80211_key_flags - key flags
   *
   * These flags are used for communication about keys between the driver
-@@ -2682,6 +2708,8 @@ struct ieee80211_txq {
+@@ -2687,6 +2713,8 @@ struct ieee80211_txq {
   * @IEEE80211_HW_MLO_MCAST_MULTI_LINK_TX: Hardware/driver handles transmitting
   *	multicast frames on all links, mac80211 should not do that.
   *
@@ -97,7 +97,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
   */
  enum ieee80211_hw_flags {
-@@ -2739,6 +2767,7 @@ enum ieee80211_hw_flags {
+@@ -2744,6 +2772,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_SUPPORTS_CONC_MON_RX_DECAP,
  	IEEE80211_HW_DETECTS_COLOR_COLLISION,
  	IEEE80211_HW_MLO_MCAST_MULTI_LINK_TX,
@@ -105,7 +105,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	/* keep last, obviously */
  	NUM_IEEE80211_HW_FLAGS
-@@ -3751,6 +3780,10 @@ struct ieee80211_prep_tx_info {
+@@ -3756,6 +3785,10 @@ struct ieee80211_prep_tx_info {
   *	non-MLO connections.
   *	The callback can sleep.
   *
@@ -116,7 +116,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   * @prepare_multicast: Prepare for multicast filter configuration.
   *	This callback is optional, and its return value is passed
   *	to configure_filter(). This callback must be atomic.
-@@ -4302,7 +4335,9 @@ struct ieee80211_ops {
+@@ -4307,7 +4340,9 @@ struct ieee80211_ops {
  				  struct ieee80211_vif *vif,
  				  struct ieee80211_bss_conf *info,
  				  u64 changed);
@@ -127,7 +127,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	int (*start_ap)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			struct ieee80211_bss_conf *link_conf);
  	void (*stop_ap)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-@@ -4607,7 +4642,7 @@ struct ieee80211_ops {
+@@ -4612,7 +4647,7 @@ struct ieee80211_ops {
  	int (*reset_tid_config)(struct ieee80211_hw *hw,
  				struct ieee80211_vif *vif,
  				struct ieee80211_sta *sta, u8 tids);
@@ -361,7 +361,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  {
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1847,6 +1847,8 @@ void ieee80211_vif_cfg_change_notify(str
+@@ -1844,6 +1844,8 @@ void ieee80211_vif_cfg_change_notify(str
  void ieee80211_link_info_change_notify(struct ieee80211_sub_if_data *sdata,
  				       struct ieee80211_link_data *link,
  				       u64 changed);
diff --git a/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch b/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
index d4410bd712f669..2c4b6d1e2bff9c 100644
--- a/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
@@ -49,7 +49,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  #endif /* __NET_CFG80211_H */
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -7363,6 +7363,20 @@ u32 ieee80211_calc_rx_airtime(struct iee
+@@ -7368,6 +7368,20 @@ u32 ieee80211_calc_rx_airtime(struct iee
  			      int len);
  
  /**
diff --git a/package/kernel/mac80211/patches/nss/subsys/207-ath11k-Add-support-for-dynamic-vlan.patch b/package/kernel/mac80211/patches/nss/subsys/207-ath11k-Add-support-for-dynamic-vlan.patch
index 5ae1ba64bba9d5..f82584a9fdf3d0 100644
--- a/package/kernel/mac80211/patches/nss/subsys/207-ath11k-Add-support-for-dynamic-vlan.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/207-ath11k-Add-support-for-dynamic-vlan.patch
@@ -42,18 +42,18 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	if (IS_ERR(sta))
  		sta = NULL;
  
-+        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
-+                ap_sdata = container_of(sdata->bss,
-+                                        struct ieee80211_sub_if_data, u.ap);
-+                if (ap_sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED &&
-+                    !is_multicast_ether_addr(skb->data)) {
-+                        if (sta)
-+                                key = rcu_dereference(sta->ptk[sta->ptk_idx]);
-+                        ieee80211_8023_xmit(sdata, dev, sta, key, skb);
-+                        rcu_read_unlock();
-+                        return;
-+                }
-+        }
++	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
++		ap_sdata = container_of(sdata->bss,
++					struct ieee80211_sub_if_data, u.ap);
++		if (ap_sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED &&
++		    !is_multicast_ether_addr(skb->data)) {
++			if (sta)
++				key = rcu_dereference(sta->ptk[sta->ptk_idx]);
++			ieee80211_8023_xmit(sdata, dev, sta, key, skb);
++			rcu_read_unlock();
++			return;
++		}
++	}
 +
  	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, sta, skb));
  	ieee80211_aggr_check(sdata, sta, skb);
diff --git a/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch b/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
index 3d543d714122dd..225cdc45da0f47 100644
--- a/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
@@ -21,7 +21,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -5100,6 +5100,17 @@ void ieee80211_sta_pspoll(struct ieee802
+@@ -5105,6 +5105,17 @@ void ieee80211_sta_pspoll(struct ieee802
   */
  void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *sta, u8 tid);
  
@@ -137,23 +137,21 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  {
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4298,8 +4298,13 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4307,8 +4307,11 @@ void __ieee80211_subif_start_xmit(struct
  		sta = NULL;
  
-         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
--                ap_sdata = container_of(sdata->bss,
--                                        struct ieee80211_sub_if_data, u.ap);
-+                if (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD))
-+                        ap_sdata = container_of(sdata->bss,
-+                                                struct ieee80211_sub_if_data,
-+                                                u.ap);
-+                else
-+                        ap_sdata = sdata;
-+
-                 if (ap_sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED &&
-                     !is_multicast_ether_addr(skb->data)) {
-                         if (sta)
-@@ -4689,7 +4694,8 @@ static void ieee80211_8023_xmit(struct i
+ 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
+-		ap_sdata = container_of(sdata->bss,
+-					struct ieee80211_sub_if_data, u.ap);
++		if (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD))
++			ap_sdata = container_of(
++				sdata->bss, struct ieee80211_sub_if_data, u.ap);
++		else
++			ap_sdata = sdata;
+ 		if (ap_sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED &&
+ 		    !is_multicast_ether_addr(skb->data)) {
+ 			if (sta)
+@@ -4698,7 +4701,8 @@ static void ieee80211_8023_xmit(struct i
  
  	info->hw_queue = sdata->vif.hw_queue[queue];
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch b/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
index 542ab4e6a93831..ca0efe70f42fdd 100644
--- a/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
@@ -24,7 +24,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2088,6 +2088,8 @@ enum ieee80211_key_flags {
+@@ -2093,6 +2093,8 @@ enum ieee80211_key_flags {
   * @tx_pn: PN used for TX keys, may be used by the driver as well if it
   *	needs to do software PN assignment by itself (e.g. due to TSO)
   * @flags: key flags, see &enum ieee80211_key_flags.
@@ -33,7 +33,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
   * @keyidx: the key index (0-3)
   * @keylen: key material length
   * @key: key material. For ALG_TKIP the key is encoded as a 256-bit (32 byte)
-@@ -2107,6 +2109,7 @@ struct ieee80211_key_conf {
+@@ -2112,6 +2114,7 @@ struct ieee80211_key_conf {
  	u8 hw_key_idx;
  	s8 keyidx;
  	u16 flags;
@@ -102,7 +102,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	key->conf.cipher = cipher;
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4650,16 +4650,25 @@ static void ieee80211_8023_xmit(struct i
+@@ -4657,16 +4657,25 @@ static void ieee80211_8023_xmit(struct i
  				struct ieee80211_key *key, struct sk_buff *skb)
  {
  	struct ieee80211_tx_info *info;
diff --git a/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch b/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch
index 0e92c0f1332b7d..aac819d945b1f7 100644
--- a/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch
@@ -30,7 +30,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	struct ieee80211_local *local;
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4679,19 +4679,21 @@ static void ieee80211_8023_xmit(struct i
+@@ -4686,19 +4686,21 @@ static void ieee80211_8023_xmit(struct i
  
  	ieee80211_aggr_check(sdata, sta, skb);
  
@@ -64,7 +64,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	}
  
  	skb = ieee80211_tx_skb_fixup(skb, ieee80211_sdata_netdev_features(sdata));
-@@ -4748,7 +4750,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4755,7 +4757,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  {
  	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	struct ethhdr *ehdr = (struct ethhdr *)skb->data;
@@ -73,7 +73,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	struct sta_info *sta;
  
  #ifdef CPTCFG_MAC80211_NSS_SUPPORT
-@@ -4766,9 +4768,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4773,9 +4775,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		goto out;
  	}
  
@@ -90,7 +90,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  		goto skip_offload;
  
  	key = rcu_dereference(sta->ptk[sta->ptk_idx]);
-@@ -4779,6 +4785,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4786,6 +4792,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		goto skip_offload;
  
  	sk_pacing_shift_update(skb->sk, sdata->local->hw.tx_sk_pacing_shift);
@@ -98,7 +98,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	ieee80211_8023_xmit(sdata, dev, sta, key, skb);
  	goto out;
  
-@@ -6285,13 +6292,7 @@ start_xmit:
+@@ -6292,13 +6299,7 @@ start_xmit:
  	mutex_lock(&local->mtx);
  
  	local_bh_disable();
diff --git a/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch b/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
index e1b46836c6b4c5..b088fae5341676 100644
--- a/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
@@ -96,7 +96,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  };
  
  /**
-@@ -1777,6 +1795,7 @@ struct ieee80211_channel_switch {
+@@ -1782,6 +1800,7 @@ struct ieee80211_channel_switch {
   *	this is not pure P2P vif.
   * @IEEE80211_VIF_DISABLE_SMPS_OVERRIDE: disable user configuration of
   *	SMPS mode via debugfs.
@@ -104,7 +104,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
   */
  enum ieee80211_vif_flags {
  	IEEE80211_VIF_BEACON_FILTER		= BIT(0),
-@@ -1784,6 +1803,7 @@ enum ieee80211_vif_flags {
+@@ -1789,6 +1808,7 @@ enum ieee80211_vif_flags {
  	IEEE80211_VIF_SUPPORTS_UAPSD		= BIT(2),
  	IEEE80211_VIF_GET_NOA_UPDATE		= BIT(3),
  	IEEE80211_VIF_DISABLE_SMPS_OVERRIDE	= BIT(4),
@@ -112,7 +112,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  };
  
  
-@@ -2771,6 +2791,7 @@ enum ieee80211_hw_flags {
+@@ -2776,6 +2796,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_DETECTS_COLOR_COLLISION,
  	IEEE80211_HW_MLO_MCAST_MULTI_LINK_TX,
  	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
@@ -120,7 +120,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  
  	/* keep last, obviously */
  	NUM_IEEE80211_HW_FLAGS
-@@ -4271,6 +4292,8 @@ struct ieee80211_prep_tx_info {
+@@ -4276,6 +4297,8 @@ struct ieee80211_prep_tx_info {
   * @set_sar_specs: Update the SAR (TX power) settings.
   * @sta_set_decap_offload: Called to notify the driver when a station is allowed
   *	to use rx decapsulation offload
@@ -129,7 +129,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
   * @add_twt_setup: Update hw with TWT agreement parameters received from the peer.
   *	This callback allows the hw to check if requested parameters
   *	are supported and if there is enough room for a new agreement.
-@@ -4654,6 +4677,12 @@ struct ieee80211_ops {
+@@ -4659,6 +4682,12 @@ struct ieee80211_ops {
  	void (*sta_set_decap_offload)(struct ieee80211_hw *hw,
  				      struct ieee80211_vif *vif,
  				      struct ieee80211_sta *sta, bool enabled);
@@ -142,7 +142,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	void (*add_twt_setup)(struct ieee80211_hw *hw,
  			      struct ieee80211_sta *sta,
  			      struct ieee80211_twt_setup *twt);
-@@ -7512,4 +7541,100 @@ int ieee80211_set_active_links(struct ie
+@@ -7517,4 +7546,100 @@ int ieee80211_set_active_links(struct ie
  void ieee80211_set_active_links_async(struct ieee80211_vif *vif,
  				      u16 active_links);
  
@@ -1173,7 +1173,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  void mesh_pathtbl_unregister(struct ieee80211_sub_if_data *sdata)
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -2610,7 +2610,7 @@ static struct sk_buff *ieee80211_build_h
+@@ -2619,7 +2619,7 @@ static struct sk_buff *ieee80211_build_h
  	bool multicast;
  	u16 info_id = 0;
  	struct ieee80211_chanctx_conf *chanctx_conf = NULL;
@@ -1182,7 +1182,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	int ret;
  	u8 link_id = u32_get_bits(ctrl_flags, IEEE80211_TX_CTRL_MLO_LINK);
  
-@@ -2622,6 +2622,9 @@ static struct sk_buff *ieee80211_build_h
+@@ -2631,6 +2631,9 @@ static struct sk_buff *ieee80211_build_h
  		info_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
  #endif
  
@@ -1192,7 +1192,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	/* convert Ethernet header to proper 802.11 header (based on
  	 * operation mode) */
  	ethertype = (skb->data[12] << 8) | skb->data[13];
-@@ -2692,6 +2695,13 @@ static struct sk_buff *ieee80211_build_h
+@@ -2701,6 +2704,13 @@ static struct sk_buff *ieee80211_build_h
  		break;
  #ifdef CPTCFG_MAC80211_MESH
  	case NL80211_IFTYPE_MESH_POINT:
@@ -1206,7 +1206,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  		if (!is_multicast_ether_addr(skb->data)) {
  			struct sta_info *next_hop;
  			bool mpp_lookup = true;
-@@ -2955,10 +2965,10 @@ static struct sk_buff *ieee80211_build_h
+@@ -2964,10 +2974,10 @@ static struct sk_buff *ieee80211_build_h
  
  	skb_reset_mac_header(skb);
  
@@ -1221,7 +1221,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	info->ack_frame_id = info_id;
  	info->band = band;
  
-@@ -4275,6 +4285,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4284,6 +4294,7 @@ void __ieee80211_subif_start_xmit(struct
  	struct sk_buff *next;
  	int len = skb->len;
  	struct ieee80211_key *key = NULL;
@@ -1229,7 +1229,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	struct ieee80211_sub_if_data *ap_sdata;
  
  	if (unlikely(!ieee80211_sdata_running(sdata) || skb->len < ETH_HLEN)) {
-@@ -4351,9 +4362,15 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4358,9 +4369,15 @@ void __ieee80211_subif_start_xmit(struct
  			goto out;
  		}
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch b/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
index 0704e8fcf7da86..1dd927098b88e9 100644
--- a/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
@@ -16,7 +16,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2733,6 +2733,8 @@ struct ieee80211_txq {
+@@ -2738,6 +2738,8 @@ struct ieee80211_txq {
   *
   *  @IEEE80211_HW_SUPPORTS_NSS_OFFLOAD: Hardware/driver supports NSS offload
   *
@@ -25,7 +25,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
   * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
   */
  enum ieee80211_hw_flags {
-@@ -2792,6 +2794,7 @@ enum ieee80211_hw_flags {
+@@ -2797,6 +2799,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_MLO_MCAST_MULTI_LINK_TX,
  	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
  	IEEE80211_HW_SUPPORTS_MESH_NSS_OFFLOAD,
diff --git a/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch b/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch
index 314bcbe549af97..56f964d0405882 100644
--- a/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch
@@ -14,7 +14,7 @@ Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4762,6 +4762,67 @@ out_free:
+@@ -4769,6 +4769,67 @@ out_free:
  	kfree_skb(skb);
  }
  
@@ -82,7 +82,7 @@ Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
  netdev_tx_t ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
  					    struct net_device *dev)
  {
-@@ -4801,6 +4862,11 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4808,6 +4869,11 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  	if (key && (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)))
  		goto skip_offload;
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/336-mac80211-Mesh-Fast-rx-support.patch b/package/kernel/mac80211/patches/nss/subsys/336-mac80211-Mesh-Fast-rx-support.patch
index 0b89a11957bec4..abdf3c9bd2195e 100644
--- a/package/kernel/mac80211/patches/nss/subsys/336-mac80211-Mesh-Fast-rx-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/336-mac80211-Mesh-Fast-rx-support.patch
@@ -94,7 +94,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  	if (action) {
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -4649,10 +4649,15 @@ void ieee80211_check_fast_rx(struct sta_
+@@ -4653,10 +4653,15 @@ void ieee80211_check_fast_rx(struct sta_
  
  		break;
  	case NL80211_IFTYPE_MESH_POINT:
@@ -112,7 +112,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  		break;
  	default:
  		goto clear;
-@@ -4693,7 +4698,7 @@ void ieee80211_check_fast_rx(struct sta_
+@@ -4697,7 +4702,7 @@ void ieee80211_check_fast_rx(struct sta_
  	__release(check_fast_rx);
  
  	if (assign)
@@ -121,7 +121,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  
  	offload_flags = get_bss_sdata(sdata)->vif.offload_flags;
  	offload = offload_flags & IEEE80211_OFFLOAD_DECAP_ENABLED;
-@@ -4875,6 +4880,10 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4879,6 +4884,10 @@ static bool ieee80211_invoke_fast_rx(str
  		u8 sa[ETH_ALEN];
  	} addrs __aligned(2);
  	struct ieee80211_sta_rx_stats *stats;
@@ -132,7 +132,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  
  	/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
  	 * to a common data structure; drivers can implement that per queue
-@@ -4924,6 +4933,37 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4928,6 +4937,37 @@ static bool ieee80211_invoke_fast_rx(str
  		snap_offs += IEEE80211_CCMP_HDR_LEN;
  	}
  
@@ -170,7 +170,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  	if (!ieee80211_vif_is_mesh(&rx->sdata->vif) &&
  	    !(status->rx_flags & IEEE80211_RX_AMSDU)) {
  		if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
-@@ -4961,9 +5001,33 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4965,9 +5005,33 @@ static bool ieee80211_invoke_fast_rx(str
  		return true;
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch b/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch
index c8d719006d170f..969aa5da5f010c 100644
--- a/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch
@@ -33,7 +33,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4696,7 +4696,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4703,7 +4703,7 @@ static void ieee80211_8023_xmit(struct i
  
  	ieee80211_aggr_check(sdata, sta, skb);
  
@@ -42,7 +42,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  		tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
  		tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
  		if (tid_tx) {
-@@ -4747,7 +4747,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4754,7 +4754,7 @@ static void ieee80211_8023_xmit(struct i
  							     &info->flags, NULL);
  
  	dev_sw_netstats_tx_add(dev, skbs, len);
diff --git a/package/kernel/mac80211/patches/nss/subsys/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch b/package/kernel/mac80211/patches/nss/subsys/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
index 55380f59d3826c..5683bdec18da5c 100644
--- a/package/kernel/mac80211/patches/nss/subsys/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
@@ -14,7 +14,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1407,8 +1407,6 @@ ieee80211_tx_info_clear_status(struct ie
+@@ -1410,8 +1410,6 @@ ieee80211_tx_info_clear_status(struct ie
   * @RX_FLAG_AMPDU_IS_LAST: this subframe is the last subframe of the A-MPDU
   * @RX_FLAG_AMPDU_DELIM_CRC_ERROR: A delimiter CRC error has been detected
   *	on this subframe
@@ -23,13 +23,37 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
   * @RX_FLAG_MIC_STRIPPED: The mic was stripped of this packet. Decryption was
   *	done by the hardware
   * @RX_FLAG_ONLY_MONITOR: Report frame only to monitor interfaces without
-@@ -1480,22 +1478,21 @@ enum mac80211_rx_flags {
- 	RX_FLAG_AMPDU_LAST_KNOWN	= BIT(12),
- 	RX_FLAG_AMPDU_IS_LAST		= BIT(13),
- 	RX_FLAG_AMPDU_DELIM_CRC_ERROR	= BIT(14),
+@@ -1468,39 +1466,38 @@ ieee80211_tx_info_clear_status(struct ie
+  *	hardware or driver)
+  */
+ enum mac80211_rx_flags {
+-	RX_FLAG_MMIC_ERROR		= BIT(0),
+-	RX_FLAG_DECRYPTED		= BIT(1),
+-	RX_FLAG_ONLY_MONITOR		= BIT(2),
+-	RX_FLAG_MMIC_STRIPPED		= BIT(3),
+-	RX_FLAG_IV_STRIPPED		= BIT(4),
+-	RX_FLAG_FAILED_FCS_CRC		= BIT(5),
+-	RX_FLAG_FAILED_PLCP_CRC 	= BIT(6),
++	RX_FLAG_MMIC_ERROR              = BIT(0),
++	RX_FLAG_DECRYPTED               = BIT(1),
++	RX_FLAG_ONLY_MONITOR            = BIT(2),
++	RX_FLAG_MMIC_STRIPPED           = BIT(3),
++	RX_FLAG_IV_STRIPPED             = BIT(4),
++	RX_FLAG_FAILED_FCS_CRC          = BIT(5),
++	RX_FLAG_FAILED_PLCP_CRC         = BIT(6),
+ 	/* one free bit at 7 */
+-	RX_FLAG_NO_SIGNAL_VAL		= BIT(8),
+-	RX_FLAG_AMPDU_DETAILS		= BIT(9),
+-	RX_FLAG_PN_VALIDATED		= BIT(10),
+-	RX_FLAG_DUP_VALIDATED		= BIT(11),
+-	RX_FLAG_AMPDU_LAST_KNOWN	= BIT(12),
+-	RX_FLAG_AMPDU_IS_LAST		= BIT(13),
+-	RX_FLAG_AMPDU_DELIM_CRC_ERROR	= BIT(14),
 -	RX_FLAG_AMPDU_DELIM_CRC_KNOWN	= BIT(15),
--	RX_FLAG_MACTIME_END		= BIT(16),
--	RX_FLAG_ONLY_MONITOR		= BIT(17),
+-	RX_FLAG_MACTIME			= BIT(16) | BIT(17),
+-	RX_FLAG_MACTIME_PLCP_START	= 1 << 16,
+-	RX_FLAG_MACTIME_START		= 2 << 16,
+-	RX_FLAG_MACTIME_END		= 3 << 16,
 -	RX_FLAG_SKIP_MONITOR		= BIT(18),
 -	RX_FLAG_AMSDU_MORE		= BIT(19),
 -	RX_FLAG_RADIOTAP_TLV_AT_END	= BIT(20),
@@ -43,8 +67,17 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
 -	RX_FLAG_RADIOTAP_LSIG		= BIT(28),
 -	RX_FLAG_NO_PSDU			= BIT(29),
 -	RX_FLAG_8023			= BIT(30),
-+	RX_FLAG_MACTIME_END             = BIT(15),
-+	RX_FLAG_ONLY_MONITOR            = BIT(16),
++	RX_FLAG_NO_SIGNAL_VAL           = BIT(8),
++	RX_FLAG_AMPDU_DETAILS           = BIT(9),
++	RX_FLAG_PN_VALIDATED            = BIT(10),
++	RX_FLAG_DUP_VALIDATED           = BIT(11),
++	RX_FLAG_AMPDU_LAST_KNOWN        = BIT(12),
++	RX_FLAG_AMPDU_IS_LAST           = BIT(13),
++	RX_FLAG_AMPDU_DELIM_CRC_ERROR   = BIT(14),
++	RX_FLAG_MACTIME                 = BIT(15) | BIT(16),
++	RX_FLAG_MACTIME_PLCP_START      = 1 << 15,
++	RX_FLAG_MACTIME_START           = 2 << 15,
++	RX_FLAG_MACTIME_END             = 3 << 15,
 +	RX_FLAG_SKIP_MONITOR            = BIT(17),
 +	RX_FLAG_AMSDU_MORE              = BIT(18),
 +	RX_FLAG_RADIOTAP_TLV_AT_END     = BIT(19),
diff --git a/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch b/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
index 13977ab665862e..bdbe79a6be93e8 100644
--- a/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
@@ -20,7 +20,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
 
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -2063,6 +2063,11 @@ netdev_tx_t ieee80211_subif_start_xmit(s
+@@ -2060,6 +2060,11 @@ netdev_tx_t ieee80211_subif_start_xmit(s
  				       struct net_device *dev);
  netdev_tx_t ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
  					    struct net_device *dev);
@@ -44,16 +44,16 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  /* misc utils */
  
  static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
-@@ -4320,7 +4321,7 @@ void __ieee80211_subif_start_xmit(struct
-                     !is_multicast_ether_addr(skb->data)) {
-                         if (sta)
-                                 key = rcu_dereference(sta->ptk[sta->ptk_idx]);
--                        ieee80211_8023_xmit(sdata, dev, sta, key, skb);
-+                        ieee80211_8023_xmit(sdata, dev, sta, key, skb, info_flags, ctrl_flags, cookie);
-                         rcu_read_unlock();
-                         return;
-                 }
-@@ -4366,7 +4367,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4327,7 +4328,7 @@ void __ieee80211_subif_start_xmit(struct
+ 		    !is_multicast_ether_addr(skb->data)) {
+ 			if (sta)
+ 				key = rcu_dereference(sta->ptk[sta->ptk_idx]);
+-			ieee80211_8023_xmit(sdata, dev, sta, key, skb);
++			ieee80211_8023_xmit(sdata, dev, sta, key, skb, info_flags, ctrl_flags, cookie);
+ 			rcu_read_unlock();
+ 			return;
+ 		}
+@@ -4373,7 +4374,7 @@ void __ieee80211_subif_start_xmit(struct
  		if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) {
  		    	if (sta)
  				key = rcu_dereference(sta->ptk[sta->ptk_idx]);
@@ -62,7 +62,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  		} else {
  			dev_sw_netstats_tx_add(dev, 1, skb->len);
  			ieee80211_xmit(sdata, sta, skb);
-@@ -4664,7 +4665,8 @@ static bool ieee80211_tx_8023(struct iee
+@@ -4671,7 +4672,8 @@ static bool ieee80211_tx_8023(struct iee
  
  static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
  				struct net_device *dev, struct sta_info *sta,
@@ -72,7 +72,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  {
  	struct ieee80211_tx_info *info;
  	struct ethhdr *ehdr = (struct ethhdr *)skb->data;
-@@ -4720,6 +4722,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4727,6 +4729,7 @@ static void ieee80211_8023_xmit(struct i
  	info = IEEE80211_SKB_CB(skb);
  	memset(info, 0, sizeof(*info));
  
@@ -80,7 +80,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  	info->hw_queue = sdata->vif.hw_queue[queue];
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
-@@ -4740,11 +4743,12 @@ static void ieee80211_8023_xmit(struct i
+@@ -4747,11 +4750,12 @@ static void ieee80211_8023_xmit(struct i
  			memcpy(IEEE80211_SKB_CB(seg), info, sizeof(*info));
  	}
  
@@ -96,7 +96,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  	dev_sw_netstats_tx_add(dev, skbs, len);
  	if (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD) && sta) {
-@@ -4764,7 +4768,8 @@ out_free:
+@@ -4771,7 +4775,8 @@ out_free:
  
  void ieee80211_8023_xmit_ap(struct ieee80211_sub_if_data *sdata,
  			    struct net_device *dev, struct sta_info *sta,
@@ -106,7 +106,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  {
  	struct ieee80211_tx_info *info;
  	struct ieee80211_local *local = sdata->local;
-@@ -4773,6 +4778,9 @@ void ieee80211_8023_xmit_ap(struct ieee8
+@@ -4780,6 +4785,9 @@ void ieee80211_8023_xmit_ap(struct ieee8
  	unsigned long flags;
  	int q;
  	u16 q_map;
@@ -116,7 +116,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  	/*
  	 * If the skb is shared we need to obtain our own copy.
-@@ -4784,11 +4792,13 @@ void ieee80211_8023_xmit_ap(struct ieee8
+@@ -4791,11 +4799,13 @@ void ieee80211_8023_xmit_ap(struct ieee8
  
  	info = IEEE80211_SKB_CB(skb);
  	memset(info, 0, sizeof(*info));
@@ -133,7 +133,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  	info->flags |= IEEE80211_TX_CTL_HW_80211_ENCAP;
  	info->control.vif = &sdata->vif;
-@@ -4822,14 +4832,23 @@ void ieee80211_8023_xmit_ap(struct ieee8
+@@ -4829,14 +4839,23 @@ void ieee80211_8023_xmit_ap(struct ieee8
  	drv_tx(local, &control, skb);
  
  }
@@ -158,7 +158,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  #ifdef CPTCFG_MAC80211_NSS_SUPPORT
         ieee80211_xmit_nss_fixup(skb, dev);
-@@ -4845,14 +4864,15 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4852,14 +4871,15 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		kfree_skb(skb);
  		goto out;
  	}
@@ -176,7 +176,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  		goto skip_offload;
  
  	key = rcu_dereference(sta->ptk[sta->ptk_idx]);
-@@ -4863,13 +4883,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4870,13 +4890,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		goto skip_offload;
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP) {
@@ -192,7 +192,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  	goto out;
  
  skip_offload:
-@@ -6375,7 +6395,10 @@ start_xmit:
+@@ -6382,7 +6402,10 @@ start_xmit:
  	mutex_lock(&local->mtx);
  
  	local_bh_disable();
diff --git a/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch b/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
index 6be28b6ac56663..5b5b45695e965b 100644
--- a/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
@@ -31,7 +31,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
  				struct net_device *dev, struct sta_info *sta,
  				struct ieee80211_key *key, struct sk_buff *skb,
-@@ -3632,7 +3634,7 @@ ieee80211_sdata_netdev_features(struct i
+@@ -3641,7 +3643,7 @@ ieee80211_sdata_netdev_features(struct i
  }
  
  static struct sk_buff *
@@ -40,7 +40,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  {
  	if (skb_is_gso(skb)) {
  		struct sk_buff *segs;
-@@ -3650,7 +3652,7 @@ ieee80211_tx_skb_fixup(struct sk_buff *s
+@@ -3659,7 +3661,7 @@ ieee80211_tx_skb_fixup(struct sk_buff *s
  	if (skb_needs_linearize(skb, features) && __skb_linearize(skb))
  		goto free;
  
@@ -49,7 +49,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  		int ofs = skb_checksum_start_offset(skb);
  
  		if (skb->encapsulation)
-@@ -3796,7 +3798,7 @@ static bool ieee80211_xmit_fast(struct i
+@@ -3805,7 +3807,7 @@ static bool ieee80211_xmit_fast(struct i
  	memcpy(&eth, skb->data, ETH_HLEN - 2);
  
  	/* after this point (skb is modified) we cannot return false */
@@ -58,7 +58,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	if (!skb)
  		return true;
  
-@@ -4344,7 +4346,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4351,7 +4353,7 @@ void __ieee80211_subif_start_xmit(struct
  	 * things so we cannot really handle checksum or GSO offload.
  	 * fix it up in software before we handle anything else.
  	 */
@@ -67,7 +67,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	if (!skb) {
  		len = 0;
  		goto out;
-@@ -4715,7 +4717,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4722,7 +4724,7 @@ static void ieee80211_8023_xmit(struct i
  		}
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch b/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
index c2846abf7e5961..6867ee57c399d2 100644
--- a/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
@@ -23,7 +23,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2732,6 +2732,9 @@ struct ieee80211_txq {
+@@ -2737,6 +2737,9 @@ struct ieee80211_txq {
   *
   * @IEEE80211_HW_SUPPORTS_TID_CLASS_OFFLOAD: Hardware suports tid calssification offload.
   *
@@ -33,7 +33,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
   * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
   */
  enum ieee80211_hw_flags {
-@@ -2792,6 +2795,7 @@ enum ieee80211_hw_flags {
+@@ -2797,6 +2800,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
  	IEEE80211_HW_SUPPORTS_MESH_NSS_OFFLOAD,
  	IEEE80211_HW_SUPPORTS_TID_CLASS_OFFLOAD,
@@ -83,9 +83,9 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  		return false;
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-@@ -4329,7 +4336,8 @@ void __ieee80211_subif_start_xmit(struct
-                 }
-         }
+@@ -4336,7 +4343,8 @@ void __ieee80211_subif_start_xmit(struct
+ 		}
+ 	}
  
 -	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, sta, skb));
 +	if (unlikely(!ieee80211_hw_check(&local->hw, HAS_TX_QUEUE)))
@@ -93,7 +93,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	ieee80211_aggr_check(sdata, sta, skb);
  
  	if (sta) {
-@@ -4681,8 +4689,10 @@ static void ieee80211_8023_xmit(struct i
+@@ -4688,8 +4696,10 @@ static void ieee80211_8023_xmit(struct i
  	bool multicast;
  	u8 tid;
  
@@ -106,7 +106,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  
  	multicast = is_multicast_ether_addr(ra);
  
-@@ -6379,9 +6389,12 @@ int ieee80211_tx_control_port(struct wip
+@@ -6386,9 +6396,12 @@ int ieee80211_tx_control_port(struct wip
  	}
  
  	if (!IS_ERR(sta)) {
diff --git a/package/kernel/mac80211/patches/nss/subsys/829-mac80211-fix-mesh-ping-issue.patch b/package/kernel/mac80211/patches/nss/subsys/829-mac80211-fix-mesh-ping-issue.patch
index 642901bed17459..7532ef1e713125 100644
--- a/package/kernel/mac80211/patches/nss/subsys/829-mac80211-fix-mesh-ping-issue.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/829-mac80211-fix-mesh-ping-issue.patch
@@ -10,7 +10,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
 
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -4647,16 +4647,14 @@ void ieee80211_check_fast_rx(struct sta_
+@@ -4651,16 +4651,14 @@ void ieee80211_check_fast_rx(struct sta_
  
  		break;
  	case NL80211_IFTYPE_MESH_POINT:
@@ -23,15 +23,14 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  						      IEEE80211_FCTL_TODS);
 -
 -		fastrx.internal_forward = 0;
--		break;
 +		fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
 +		fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
-+		break; 
-+		
+ 		break;
++
  	default:
  		goto clear;
  	}
-@@ -4878,10 +4876,7 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4882,10 +4880,7 @@ static bool ieee80211_invoke_fast_rx(str
  		u8 sa[ETH_ALEN];
  	} addrs __aligned(2);
  	struct ieee80211_sta_rx_stats *stats;
@@ -42,7 +41,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  	/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
  	 * to a common data structure; drivers can implement that per queue
-@@ -4931,37 +4926,6 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4935,37 +4930,6 @@ static bool ieee80211_invoke_fast_rx(str
  		snap_offs += IEEE80211_CCMP_HDR_LEN;
  	}
  
@@ -80,7 +79,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  	if (!ieee80211_vif_is_mesh(&rx->sdata->vif) &&
  	    !(status->rx_flags & IEEE80211_RX_AMSDU)) {
  		if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
-@@ -4999,30 +4963,6 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -5003,30 +4967,6 @@ static bool ieee80211_invoke_fast_rx(str
  		return true;
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/971-mac80211-fix-field-span-warning.patch b/package/kernel/mac80211/patches/nss/subsys/971-mac80211-fix-field-span-warning.patch
deleted file mode 100644
index 7d7ff4025bf127..00000000000000
--- a/package/kernel/mac80211/patches/nss/subsys/971-mac80211-fix-field-span-warning.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/include/linux/ieee80211.h
-+++ b/include/linux/ieee80211.h
-@@ -961,7 +961,7 @@ struct ieee80211_tim_ie {
- 	u8 dtim_period;
- 	u8 bitmap_ctrl;
- 	/* variable size: 1 - 251 bytes */
--	u8 virtual_map[1];
-+	u8 virtual_map[];
- } __packed;
- 
- /**
diff --git a/target/linux/qualcommax/patches-6.6/0102-arm64-dts-ipq8074-add-reserved-memory-nodes.patch b/target/linux/qualcommax/patches-6.6/0102-arm64-dts-ipq8074-add-reserved-memory-nodes.patch
index 64f8da87aadedb..7f95b0110c9ec5 100644
--- a/target/linux/qualcommax/patches-6.6/0102-arm64-dts-ipq8074-add-reserved-memory-nodes.patch
+++ b/target/linux/qualcommax/patches-6.6/0102-arm64-dts-ipq8074-add-reserved-memory-nodes.patch
@@ -22,7 +22,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
 @@ -86,6 +86,16 @@
  		#size-cells = <2>;
  		ranges;
-
+ 
 +		nss_region: nss@40000000 {
 +			no-map;
 +			reg = <0x0 0x40000000 0x0 0x01000000>;
@@ -56,5 +56,5 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
 +			reg = <0x0 0x51000000 0x0 0x100000>;
 +		};
  	};
-
+ 
  	firmware {
diff --git a/target/linux/qualcommax/patches-6.6/0170-clk-qcom-ipq8074-Support-added-for-necessary-clocks-and-reset.patch b/target/linux/qualcommax/patches-6.6/0170-clk-qcom-ipq8074-Support-added-for-necessary-clocks-and-reset.patch
index 76cc8caac9a412..056fba00aa5aa3 100644
--- a/target/linux/qualcommax/patches-6.6/0170-clk-qcom-ipq8074-Support-added-for-necessary-clocks-and-reset.patch
+++ b/target/linux/qualcommax/patches-6.6/0170-clk-qcom-ipq8074-Support-added-for-necessary-clocks-and-reset.patch
@@ -50,7 +50,7 @@ Signed-off-by: Rajkumar Ayyasamy <arajkuma@codeaurora.org>
  static struct clk_rcg2 pcie0_axi_clk_src = {
  	.cmd_rcgr = 0x75054,
  	.freq_tbl = ftbl_pcie_axi_clk_src,
-@@ -2029,6 +2051,78 @@ static struct clk_rcg2 gp3_clk_src = {
+@@ -2031,6 +2053,78 @@ static struct clk_rcg2 gp3_clk_src = {
  	},
  };
  
@@ -129,7 +129,7 @@ Signed-off-by: Rajkumar Ayyasamy <arajkuma@codeaurora.org>
  static struct clk_branch gcc_blsp1_ahb_clk = {
  	.halt_reg = 0x01008,
  	.clkr = {
-@@ -4224,13 +4318,7 @@ static struct clk_branch gcc_gp3_clk = {
+@@ -4226,13 +4320,7 @@ static struct clk_branch gcc_gp3_clk = {
  	},
  };
  
@@ -144,7 +144,7 @@ Signed-off-by: Rajkumar Ayyasamy <arajkuma@codeaurora.org>
  	.cmd_rcgr = 0x75070,
  	.freq_tbl = ftbl_pcie_rchng_clk_src,
  	.hid_width = 5,
-@@ -4322,6 +4410,114 @@ static const struct alpha_pll_config nss
+@@ -4324,6 +4412,114 @@ static const struct alpha_pll_config nss
  	.alpha_en_mask = BIT(24),
  };
  
@@ -259,7 +259,7 @@ Signed-off-by: Rajkumar Ayyasamy <arajkuma@codeaurora.org>
  static struct clk_hw *gcc_ipq8074_hws[] = {
  	&gpll0_out_main_div2.hw,
  	&gpll6_out_main_div2.hw,
-@@ -4330,6 +4526,7 @@ static struct clk_hw *gcc_ipq8074_hws[]
+@@ -4332,6 +4528,7 @@ static struct clk_hw *gcc_ipq8074_hws[]
  	&gcc_xo_div4_clk_src.hw,
  	&nss_noc_clk_src.hw,
  	&nss_ppe_cdiv_clk_src.hw,
@@ -267,7 +267,7 @@ Signed-off-by: Rajkumar Ayyasamy <arajkuma@codeaurora.org>
  };
  
  static struct clk_regmap *gcc_ipq8074_clks[] = {
-@@ -4561,6 +4758,15 @@ static struct clk_regmap *gcc_ipq8074_cl
+@@ -4563,6 +4760,15 @@ static struct clk_regmap *gcc_ipq8074_cl
  	[GCC_PCIE0_RCHNG_CLK] = &gcc_pcie0_rchng_clk.clkr,
  	[GCC_PCIE0_AXI_S_BRIDGE_CLK] = &gcc_pcie0_axi_s_bridge_clk.clkr,
  	[GCC_CRYPTO_PPE_CLK] = &gcc_crypto_ppe_clk.clkr,
diff --git a/target/linux/qualcommax/patches-6.6/0171-1-clk-qcom-ipq8074-Fix-gcc_snoc_bus_timeout_ahb_clk-offset.patch b/target/linux/qualcommax/patches-6.6/0171-1-clk-qcom-ipq8074-Fix-gcc_snoc_bus_timeout_ahb_clk-offset.patch
index b1393fc9ad43c2..96577d0eda09a9 100644
--- a/target/linux/qualcommax/patches-6.6/0171-1-clk-qcom-ipq8074-Fix-gcc_snoc_bus_timeout_ahb_clk-offset.patch
+++ b/target/linux/qualcommax/patches-6.6/0171-1-clk-qcom-ipq8074-Fix-gcc_snoc_bus_timeout_ahb_clk-offset.patch
@@ -16,7 +16,7 @@ Signed-off-by: Selvam Sathappan Periakaruppan <speriaka@codeaurora.org>
 
 --- a/drivers/clk/qcom/gcc-ipq8074.c
 +++ b/drivers/clk/qcom/gcc-ipq8074.c
-@@ -4411,10 +4411,10 @@ static const struct alpha_pll_config nss
+@@ -4413,10 +4413,10 @@ static const struct alpha_pll_config nss
  };
  
  static struct clk_branch gcc_snoc_bus_timeout2_ahb_clk = {
@@ -29,7 +29,7 @@ Signed-off-by: Selvam Sathappan Periakaruppan <speriaka@codeaurora.org>
  		.enable_mask = BIT(0),
  		.hw.init = &(struct clk_init_data){
  			.name = "gcc_snoc_bus_timeout2_ahb_clk",
-@@ -4429,10 +4429,10 @@ static struct clk_branch gcc_snoc_bus_ti
+@@ -4431,10 +4431,10 @@ static struct clk_branch gcc_snoc_bus_ti
  };
  
  static struct clk_branch gcc_snoc_bus_timeout3_ahb_clk = {
diff --git a/target/linux/qualcommax/patches-6.6/0171-2-clk-qcom-ipq8074-Fix-gcc_blsp1_ahb_clk-properties.patch b/target/linux/qualcommax/patches-6.6/0171-2-clk-qcom-ipq8074-Fix-gcc_blsp1_ahb_clk-properties.patch
index a7abddd5fddf18..6e4adf685b2425 100644
--- a/target/linux/qualcommax/patches-6.6/0171-2-clk-qcom-ipq8074-Fix-gcc_blsp1_ahb_clk-properties.patch
+++ b/target/linux/qualcommax/patches-6.6/0171-2-clk-qcom-ipq8074-Fix-gcc_blsp1_ahb_clk-properties.patch
@@ -26,7 +26,7 @@ Change-Id: I505cb560b31ad27a02c165fbe13bb33a2fc7d230
 
 --- a/drivers/clk/qcom/gcc-ipq8074.c
 +++ b/drivers/clk/qcom/gcc-ipq8074.c
-@@ -2125,9 +2125,10 @@ struct clk_rcg2 adss_pwm_clk_src = {
+@@ -2127,9 +2127,10 @@ struct clk_rcg2 adss_pwm_clk_src = {
  
  static struct clk_branch gcc_blsp1_ahb_clk = {
  	.halt_reg = 0x01008,
diff --git a/target/linux/qualcommax/patches-6.6/0600-1-qca-nss-ecm-support-CORE.patch b/target/linux/qualcommax/patches-6.6/0600-1-qca-nss-ecm-support-CORE.patch
index c49b9564044716..218e156137b4ff 100644
--- a/target/linux/qualcommax/patches-6.6/0600-1-qca-nss-ecm-support-CORE.patch
+++ b/target/linux/qualcommax/patches-6.6/0600-1-qca-nss-ecm-support-CORE.patch
@@ -81,7 +81,7 @@
  		     __be16 vlan_proto, u16 vlan_id)
 --- a/include/linux/netdevice.h
 +++ b/include/linux/netdevice.h
-@@ -2936,6 +2936,10 @@ enum netdev_cmd {
+@@ -2933,6 +2933,10 @@ enum netdev_cmd {
  	NETDEV_OFFLOAD_XSTATS_REPORT_USED,
  	NETDEV_OFFLOAD_XSTATS_REPORT_DELTA,
  	NETDEV_XDP_FEAT_CHANGE,
@@ -156,7 +156,7 @@
  void fib_del_ifaddr(struct in_ifaddr *, struct in_ifaddr *);
 --- a/net/bridge/br_private.h
 +++ b/net/bridge/br_private.h
-@@ -2266,4 +2266,6 @@ void br_do_suppress_nd(struct sk_buff *s
+@@ -2267,4 +2267,6 @@ void br_do_suppress_nd(struct sk_buff *s
  		       u16 vid, struct net_bridge_port *p, struct nd_msg *msg);
  struct nd_msg *br_is_nd_neigh_msg(struct sk_buff *skb, struct nd_msg *m);
  bool br_is_neigh_suppress_enabled(const struct net_bridge_port *p, u16 vid);
@@ -653,7 +653,7 @@
  		   const struct in6_addr *daddr)
 --- a/net/ipv6/route.c
 +++ b/net/ipv6/route.c
-@@ -197,6 +197,9 @@ static void rt6_uncached_list_flush_dev(
+@@ -198,6 +198,9 @@ static void rt6_uncached_list_flush_dev(
  	}
  }
  
@@ -663,7 +663,7 @@
  static inline const void *choose_neigh_daddr(const struct in6_addr *p,
  					     struct sk_buff *skb,
  					     const void *daddr)
-@@ -3864,6 +3867,10 @@ int ip6_route_add(struct fib6_config *cf
+@@ -3866,6 +3869,10 @@ int ip6_route_add(struct fib6_config *cf
  		return PTR_ERR(rt);
  
  	err = __ip6_ins_rt(rt, &cfg->fc_nlinfo, extack);
@@ -674,7 +674,7 @@
  	fib6_info_release(rt);
  
  	return err;
-@@ -3885,6 +3892,9 @@ static int __ip6_del_rt(struct fib6_info
+@@ -3887,6 +3894,9 @@ static int __ip6_del_rt(struct fib6_info
  	err = fib6_del(rt, info);
  	spin_unlock_bh(&table->tb6_lock);
  
@@ -684,7 +684,7 @@
  out:
  	fib6_info_release(rt);
  	return err;
-@@ -6329,6 +6339,20 @@ static int ip6_route_dev_notify(struct n
+@@ -6334,6 +6344,20 @@ static int ip6_route_dev_notify(struct n
  	return NOTIFY_OK;
  }
  
@@ -707,7 +707,7 @@
   */
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -1673,6 +1673,7 @@ const char *netdev_cmd_to_name(enum netd
+@@ -1699,6 +1699,7 @@ const char *netdev_cmd_to_name(enum netd
  	N(PRE_CHANGEADDR) N(OFFLOAD_XSTATS_ENABLE) N(OFFLOAD_XSTATS_DISABLE)
  	N(OFFLOAD_XSTATS_REPORT_USED) N(OFFLOAD_XSTATS_REPORT_DELTA)
  	N(XDP_FEAT_CHANGE)
diff --git a/target/linux/qualcommax/patches-6.6/0600-2-qca-nss-ecm-support-PPPOE-offload.patch b/target/linux/qualcommax/patches-6.6/0600-2-qca-nss-ecm-support-PPPOE-offload.patch
index e59290878db29e..2e28409fa0dbf7 100644
--- a/target/linux/qualcommax/patches-6.6/0600-2-qca-nss-ecm-support-PPPOE-offload.patch
+++ b/target/linux/qualcommax/patches-6.6/0600-2-qca-nss-ecm-support-PPPOE-offload.patch
@@ -466,7 +466,7 @@
  #endif /* !(__LINUX_IF_PPPOX_H) */
 --- a/include/linux/netdevice.h
 +++ b/include/linux/netdevice.h
-@@ -1762,6 +1762,36 @@ enum netdev_priv_flags {
+@@ -1761,6 +1761,36 @@ enum netdev_priv_flags {
  	IFF_NO_IP_ALIGN			= BIT_ULL(34),
  };
  
@@ -503,7 +503,7 @@
  #define IFF_802_1Q_VLAN			IFF_802_1Q_VLAN
  #define IFF_EBRIDGE			IFF_EBRIDGE
  #define IFF_BONDING			IFF_BONDING
-@@ -2127,6 +2157,7 @@ struct net_device {
+@@ -2126,6 +2156,7 @@ struct net_device {
  	unsigned int		flags;
  	xdp_features_t		xdp_features;
  	unsigned long long	priv_flags;
diff --git a/target/linux/qualcommax/patches-6.6/0600-7-qca-nss-ecm-fix-IPv6-user-route-change-event-calls.patch b/target/linux/qualcommax/patches-6.6/0600-7-qca-nss-ecm-fix-IPv6-user-route-change-event-calls.patch
index e3081a79aafdbe..f37ff6e4f8eb2d 100644
--- a/target/linux/qualcommax/patches-6.6/0600-7-qca-nss-ecm-fix-IPv6-user-route-change-event-calls.patch
+++ b/target/linux/qualcommax/patches-6.6/0600-7-qca-nss-ecm-fix-IPv6-user-route-change-event-calls.patch
@@ -15,7 +15,7 @@ Signed-off-by: Murat Sezgin <msezgin@codeaurora.org>
 
 --- a/net/ipv6/route.c
 +++ b/net/ipv6/route.c
-@@ -3867,10 +3867,6 @@ int ip6_route_add(struct fib6_config *cf
+@@ -3869,10 +3869,6 @@ int ip6_route_add(struct fib6_config *cf
  		return PTR_ERR(rt);
  
  	err = __ip6_ins_rt(rt, &cfg->fc_nlinfo, extack);
@@ -26,7 +26,7 @@ Signed-off-by: Murat Sezgin <msezgin@codeaurora.org>
  	fib6_info_release(rt);
  
  	return err;
-@@ -3892,9 +3888,6 @@ static int __ip6_del_rt(struct fib6_info
+@@ -3894,9 +3890,6 @@ static int __ip6_del_rt(struct fib6_info
  	err = fib6_del(rt, info);
  	spin_unlock_bh(&table->tb6_lock);
  
@@ -36,7 +36,7 @@ Signed-off-by: Murat Sezgin <msezgin@codeaurora.org>
  out:
  	fib6_info_release(rt);
  	return err;
-@@ -4500,6 +4493,10 @@ int ipv6_route_ioctl(struct net *net, un
+@@ -4505,6 +4498,10 @@ int ipv6_route_ioctl(struct net *net, un
  		break;
  	}
  	rtnl_unlock();
@@ -47,7 +47,7 @@ Signed-off-by: Murat Sezgin <msezgin@codeaurora.org>
  	return err;
  }
  
-@@ -5518,11 +5515,17 @@ static int inet6_rtm_delroute(struct sk_
+@@ -5523,11 +5520,17 @@ static int inet6_rtm_delroute(struct sk_
  	}
  
  	if (cfg.fc_mp)
@@ -67,7 +67,7 @@ Signed-off-by: Murat Sezgin <msezgin@codeaurora.org>
  }
  
  static int inet6_rtm_newroute(struct sk_buff *skb, struct nlmsghdr *nlh,
-@@ -5539,9 +5542,15 @@ static int inet6_rtm_newroute(struct sk_
+@@ -5544,9 +5547,15 @@ static int inet6_rtm_newroute(struct sk_
  		cfg.fc_metric = IP6_RT_PRIO_USER;
  
  	if (cfg.fc_mp)
diff --git a/target/linux/qualcommax/patches-6.6/0603-1-qca-nss-clients-add-qdisc-support.patch b/target/linux/qualcommax/patches-6.6/0603-1-qca-nss-clients-add-qdisc-support.patch
index 9220aca1c78be7..e57786380bf429 100644
--- a/target/linux/qualcommax/patches-6.6/0603-1-qca-nss-clients-add-qdisc-support.patch
+++ b/target/linux/qualcommax/patches-6.6/0603-1-qca-nss-clients-add-qdisc-support.patch
@@ -52,7 +52,7 @@
  	dev->needs_free_netdev = true;
 --- a/include/linux/netdevice.h
 +++ b/include/linux/netdevice.h
-@@ -4696,6 +4696,15 @@ void dev_uc_flush(struct net_device *dev
+@@ -4693,6 +4693,15 @@ void dev_uc_flush(struct net_device *dev
  void dev_uc_init(struct net_device *dev);
  
  /**
@@ -68,7 +68,7 @@
   *  __dev_uc_sync - Synchonize device's unicast list
   *  @dev:  device to sync
   *  @sync: function to call if address should be added
-@@ -5222,6 +5231,11 @@ static inline bool netif_is_failover_sla
+@@ -5219,6 +5228,11 @@ static inline bool netif_is_failover_sla
  	return dev->priv_flags & IFF_FAILOVER_SLAVE;
  }
  
@@ -443,7 +443,7 @@
  #endif
 --- a/include/linux/skbuff.h
 +++ b/include/linux/skbuff.h
-@@ -764,6 +764,7 @@ typedef unsigned char *sk_buff_data_t;
+@@ -762,6 +762,7 @@ typedef unsigned char *sk_buff_data_t;
   *	@offload_fwd_mark: Packet was L2-forwarded in hardware
   *	@offload_l3_fwd_mark: Packet was L3-forwarded in hardware
   *	@tc_skip_classify: do not classify packet. set by IFB device
@@ -451,7 +451,7 @@
   *	@tc_at_ingress: used within tc_classify to distinguish in/egress
   *	@redirected: packet was redirected by packet classifier
   *	@from_ingress: packet was redirected from the ingress path
-@@ -945,6 +946,9 @@ struct sk_buff {
+@@ -940,6 +941,9 @@ struct sk_buff {
  	__u8			tc_at_ingress:1;	/* See TC_AT_INGRESS_MASK */
  	__u8			tc_skip_classify:1;
  #endif
diff --git a/target/linux/qualcommax/patches-6.6/0603-4-qca-nss-clients-add-iptunnel-support.patch b/target/linux/qualcommax/patches-6.6/0603-4-qca-nss-clients-add-iptunnel-support.patch
index c9fc33686480ec..fb51c88e18d651 100644
--- a/target/linux/qualcommax/patches-6.6/0603-4-qca-nss-clients-add-iptunnel-support.patch
+++ b/target/linux/qualcommax/patches-6.6/0603-4-qca-nss-clients-add-iptunnel-support.patch
@@ -10,7 +10,7 @@
  	__u32 flags;		/* tunnel flags */
 --- a/include/net/ip_tunnels.h
 +++ b/include/net/ip_tunnels.h
-@@ -558,4 +558,9 @@ static inline void ip_tunnel_info_opts_s
+@@ -592,4 +592,9 @@ static inline void ip_tunnel_info_opts_s
  
  #endif /* CONFIG_INET */
  
@@ -22,7 +22,7 @@
  #endif /* __NET_IP_TUNNELS_H */
 --- a/net/ipv6/ip6_tunnel.c
 +++ b/net/ipv6/ip6_tunnel.c
-@@ -2411,6 +2411,26 @@ nla_put_failure:
+@@ -2412,6 +2412,26 @@ nla_put_failure:
  	return -EMSGSIZE;
  }
  
@@ -51,7 +51,7 @@
  	struct ip6_tnl *tunnel = netdev_priv(dev);
 --- a/net/ipv6/sit.c
 +++ b/net/ipv6/sit.c
-@@ -1733,6 +1733,23 @@ nla_put_failure:
+@@ -1734,6 +1734,23 @@ nla_put_failure:
  	return -EMSGSIZE;
  }
  
diff --git a/target/linux/qualcommax/patches-6.6/0603-5-qca-nss-clients-add-vxlan-support.patch b/target/linux/qualcommax/patches-6.6/0603-5-qca-nss-clients-add-vxlan-support.patch
index 7d05fd1aff619c..b80d57bdff4519 100644
--- a/target/linux/qualcommax/patches-6.6/0603-5-qca-nss-clients-add-vxlan-support.patch
+++ b/target/linux/qualcommax/patches-6.6/0603-5-qca-nss-clients-add-vxlan-support.patch
@@ -59,7 +59,7 @@
  /* caller should hold vxlan->hash_lock */
  static struct vxlan_rdst *vxlan_fdb_find_rdst(struct vxlan_fdb *f,
  					      union vxlan_addr *ip, __be16 port,
-@@ -2581,6 +2612,9 @@ void vxlan_xmit_one(struct sk_buff *skb,
+@@ -2600,6 +2631,9 @@ void vxlan_xmit_one(struct sk_buff *skb,
  			goto out_unlock;
  		}
  
@@ -69,7 +69,7 @@
  		tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
  		ttl = ttl ? : ip4_dst_hoplimit(&rt->dst);
  		err = vxlan_build_skb(skb, ndst, sizeof(struct iphdr),
-@@ -2652,6 +2686,9 @@ void vxlan_xmit_one(struct sk_buff *skb,
+@@ -2671,6 +2705,9 @@ void vxlan_xmit_one(struct sk_buff *skb,
  		if (err < 0)
  			goto tx_error;
  
diff --git a/target/linux/qualcommax/patches-6.6/0603-7-qca-nss-clients-iptunnel-lock-this-cpu.patch b/target/linux/qualcommax/patches-6.6/0603-7-qca-nss-clients-iptunnel-lock-this-cpu.patch
index e4ed49ea4c21fb..671d8d1e37bc80 100644
--- a/target/linux/qualcommax/patches-6.6/0603-7-qca-nss-clients-iptunnel-lock-this-cpu.patch
+++ b/target/linux/qualcommax/patches-6.6/0603-7-qca-nss-clients-iptunnel-lock-this-cpu.patch
@@ -1,6 +1,6 @@
 --- a/net/ipv6/ip6_tunnel.c
 +++ b/net/ipv6/ip6_tunnel.c
-@@ -2417,7 +2417,7 @@ nla_put_failure:
+@@ -2418,7 +2418,7 @@ nla_put_failure:
   */
  void ip6_update_offload_stats(struct net_device *dev, void *ptr)
  {
@@ -11,7 +11,7 @@
  
 --- a/net/ipv6/sit.c
 +++ b/net/ipv6/sit.c
-@@ -1736,7 +1736,7 @@ nla_put_failure:
+@@ -1737,7 +1737,7 @@ nla_put_failure:
  /* QCA NSS Clients Support - Start */
  void ipip6_update_offload_stats(struct net_device *dev, void *ptr)
  {
diff --git a/target/linux/qualcommax/patches-6.6/0604-1-qca-add-mcs-support.patch b/target/linux/qualcommax/patches-6.6/0604-1-qca-add-mcs-support.patch
index 4b87366d84966a..bbac5a709c4156 100644
--- a/target/linux/qualcommax/patches-6.6/0604-1-qca-add-mcs-support.patch
+++ b/target/linux/qualcommax/patches-6.6/0604-1-qca-add-mcs-support.patch
@@ -64,7 +64,7 @@
  #endif
 --- a/net/bridge/br_netlink.c
 +++ b/net/bridge/br_netlink.c
-@@ -656,6 +656,7 @@ void br_info_notify(int event, const str
+@@ -657,6 +657,7 @@ void br_info_notify(int event, const str
  		kfree_skb(skb);
  		goto errout;
  	}
@@ -89,7 +89,7 @@
  MODULE_LICENSE("GPL");
 --- a/net/bridge/br_device.c
 +++ b/net/bridge/br_device.c
-@@ -83,6 +83,13 @@ netdev_tx_t br_dev_xmit(struct sk_buff *
+@@ -89,6 +89,13 @@ netdev_tx_t br_dev_xmit(struct sk_buff *
  	if (is_broadcast_ether_addr(dest)) {
  		br_flood(br, skb, BR_PKT_BROADCAST, false, true, vid);
  	} else if (is_multicast_ether_addr(dest)) {
diff --git a/target/linux/qualcommax/patches-6.6/0605-1-qca-nss-cfi-support.patch b/target/linux/qualcommax/patches-6.6/0605-1-qca-nss-cfi-support.patch
index a0ed16e38f242e..329dee7db654d4 100644
--- a/target/linux/qualcommax/patches-6.6/0605-1-qca-nss-cfi-support.patch
+++ b/target/linux/qualcommax/patches-6.6/0605-1-qca-nss-cfi-support.patch
@@ -1,6 +1,6 @@
 --- a/crypto/authenc.c
 +++ b/crypto/authenc.c
-@@ -417,6 +417,8 @@ static int crypto_authenc_create(struct
+@@ -415,6 +415,8 @@ static int crypto_authenc_create(struct
  		     enc->base.cra_driver_name) >= CRYPTO_MAX_ALG_NAME)
  		goto err_free_inst;
  
@@ -11,7 +11,7 @@
  	inst->alg.base.cra_blocksize = enc->base.cra_blocksize;
 --- a/include/linux/crypto.h
 +++ b/include/linux/crypto.h
-@@ -101,6 +101,11 @@
+@@ -86,6 +86,11 @@
  #define CRYPTO_NOLOAD			0x00008000
  
  /*
@@ -26,14 +26,14 @@
 --- a/net/ipv4/esp4.c
 +++ b/net/ipv4/esp4.c
 @@ -3,6 +3,7 @@
-
+ 
  #include <crypto/aead.h>
  #include <crypto/authenc.h>
 +#include <crypto/algapi.h>
  #include <linux/err.h>
  #include <linux/module.h>
  #include <net/ip.h>
-@@ -658,6 +658,7 @@ static int esp_output(struct xfrm_state
+@@ -658,6 +659,7 @@ static int esp_output(struct xfrm_state
  	struct ip_esp_hdr *esph;
  	struct crypto_aead *aead;
  	struct esp_info esp;
@@ -41,7 +41,7 @@
  
  	esp.inplace = true;
  
-@@ -669,6 +670,11 @@ static int esp_output(struct xfrm_state
+@@ -669,6 +671,11 @@ static int esp_output(struct xfrm_state
  	aead = x->data;
  	alen = crypto_aead_authsize(aead);
  
@@ -53,7 +53,7 @@
  	esp.tfclen = 0;
  	if (x->tfcpad) {
  		struct xfrm_dst *dst = (struct xfrm_dst *)skb_dst(skb);
-@@ -890,6 +896,7 @@ static int esp_input(struct xfrm_state *
+@@ -890,6 +897,7 @@ static int esp_input(struct xfrm_state *
  	u8 *iv;
  	struct scatterlist *sg;
  	int err = -EINVAL;
@@ -61,7 +61,7 @@
  
  	if (!pskb_may_pull(skb, sizeof(struct ip_esp_hdr) + ivlen))
  		goto out;
-@@ -897,6 +904,12 @@ static int esp_input(struct xfrm_state *
+@@ -897,6 +905,12 @@ static int esp_input(struct xfrm_state *
  	if (elen <= 0)
  		goto out;
  
@@ -77,14 +77,14 @@
 --- a/net/ipv6/esp6.c
 +++ b/net/ipv6/esp6.c
 @@ -15,6 +15,7 @@
-
+ 
  #include <crypto/aead.h>
  #include <crypto/authenc.h>
 +#include <crypto/algapi.h>
  #include <linux/err.h>
  #include <linux/module.h>
  #include <net/ip.h>
-@@ -696,6 +696,7 @@ static int esp6_output(struct xfrm_state
+@@ -696,6 +697,7 @@ static int esp6_output(struct xfrm_state
  	struct ip_esp_hdr *esph;
  	struct crypto_aead *aead;
  	struct esp_info esp;
@@ -92,7 +92,7 @@
  
  	esp.inplace = true;
  
-@@ -707,6 +708,11 @@ static int esp6_output(struct xfrm_state
+@@ -707,6 +709,11 @@ static int esp6_output(struct xfrm_state
  	aead = x->data;
  	alen = crypto_aead_authsize(aead);
  
@@ -104,7 +104,7 @@
  	esp.tfclen = 0;
  	if (x->tfcpad) {
  		struct xfrm_dst *dst = (struct xfrm_dst *)skb_dst(skb);
-@@ -934,6 +940,7 @@ static int esp6_input(struct xfrm_state
+@@ -934,6 +941,7 @@ static int esp6_input(struct xfrm_state
  	__be32 *seqhi;
  	u8 *iv;
  	struct scatterlist *sg;
@@ -112,7 +112,7 @@
  
  	if (!pskb_may_pull(skb, sizeof(struct ip_esp_hdr) + ivlen)) {
  		ret = -EINVAL;
-@@ -945,6 +952,12 @@ static int esp6_input(struct xfrm_state
+@@ -945,6 +953,12 @@ static int esp6_input(struct xfrm_state
  		goto out;
  	}
  
diff --git a/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch b/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch
index e59b5e5398aea4..a09ace9b54fb50 100644
--- a/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch
+++ b/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch
@@ -10,7 +10,7 @@
  	CPUHP_LUSTRE_CFS_DEAD,
 --- a/include/linux/skbuff.h
 +++ b/include/linux/skbuff.h
-@@ -1065,6 +1065,10 @@ struct sk_buff {
+@@ -1059,6 +1059,10 @@ struct sk_buff {
  	/* only useable after checking ->active_extensions != 0 */
  	struct skb_ext		*extensions;
  #endif
@@ -21,7 +21,7 @@
  };
  
  /* if you move pkt_type around you also must adapt those constants */
-@@ -1250,7 +1254,7 @@ static inline void kfree_skb_list(struct sk_buff *segs)
+@@ -1244,7 +1248,7 @@ static inline void kfree_skb_list(struct
  	kfree_skb_list_reason(segs, SKB_DROP_REASON_NOT_SPECIFIED);
  }
  
@@ -30,7 +30,7 @@
  void consume_skb(struct sk_buff *skb);
  #else
  static inline void consume_skb(struct sk_buff *skb)
-@@ -1262,6 +1266,9 @@ static inline void consume_skb(struct sk_buff *skb)
+@@ -1256,6 +1260,9 @@ static inline void consume_skb(struct sk
  void __consume_stateless_skb(struct sk_buff *skb);
  void  __kfree_skb(struct sk_buff *skb);
  extern struct kmem_cache *skbuff_cache;
@@ -79,7 +79,7 @@
 +obj-$(CONFIG_SKB_RECYCLER) += skbuff_recycle.o
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -6016,10 +6016,16 @@ static int process_backlog(struct napi_struct *napi, int quota)
+@@ -6043,10 +6043,16 @@ static int process_backlog(struct napi_s
  
  	napi->weight = READ_ONCE(dev_rx_weight);
  	while (again) {
@@ -131,7 +131,7 @@
  
  struct kmem_cache *skbuff_cache __ro_after_init;
  static struct kmem_cache *skbuff_fclone_cache __ro_after_init;
-@@ -551,21 +576,20 @@ static void *kmalloc_reserve(unsigned int *size, gfp_t flags, int node,
+@@ -551,21 +576,20 @@ static void *kmalloc_reserve(unsigned in
  			     bool *pfmemalloc)
  {
  	bool ret_pfmemalloc = false;
@@ -160,7 +160,7 @@
  		goto out;
  	}
  
-@@ -648,10 +671,12 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
+@@ -648,10 +672,12 @@ struct sk_buff *__alloc_skb(unsigned int
  	 * aligned memory blocks, unless SLUB/SLAB debug is enabled.
  	 * Both skb->head and skb_shared_info are cache line aligned.
  	 */
@@ -174,7 +174,7 @@
  	 * Put skb_shared_info exactly at the end of allocated zone,
  	 * to allow max possible filling before reallocation.
  	 */
-@@ -686,7 +711,7 @@ EXPORT_SYMBOL(__alloc_skb);
+@@ -686,7 +712,7 @@ EXPORT_SYMBOL(__alloc_skb);
  /**
   *	__netdev_alloc_skb - allocate an skbuff for rx on a specific device
   *	@dev: network device to receive on
@@ -183,7 +183,7 @@
   *	@gfp_mask: get_free_pages mask, passed to alloc_skb
   *
   *	Allocate a new &sk_buff and assign it a usage count of one. The
-@@ -696,29 +721,53 @@ EXPORT_SYMBOL(__alloc_skb);
+@@ -696,29 +722,53 @@ EXPORT_SYMBOL(__alloc_skb);
   *
   *	%NULL is returned if there is no free memory.
   */
@@ -242,7 +242,7 @@
  
  	if (sk_memalloc_socks())
  		gfp_mask |= __GFP_MEMALLOC;
-@@ -747,6 +796,7 @@ struct sk_buff *__netdev_alloc_skb(struct net_device *dev, unsigned int len,
+@@ -747,6 +797,7 @@ struct sk_buff *__netdev_alloc_skb(struc
  	if (pfmemalloc)
  		skb->pfmemalloc = 1;
  	skb->head_frag = 1;
@@ -250,7 +250,7 @@
  
  skb_success:
  	skb_reserve(skb, NET_SKB_PAD);
-@@ -817,7 +867,8 @@ struct sk_buff *__napi_alloc_skb(struct napi_struct *napi, unsigned int len,
+@@ -817,7 +868,8 @@ struct sk_buff *__napi_alloc_skb(struct
  		data = page_frag_alloc_1k(&nc->page_small, gfp_mask);
  		pfmemalloc = NAPI_SMALL_PAGE_PFMEMALLOC(nc->page_small);
  	} else {
@@ -260,7 +260,7 @@
  
  		data = page_frag_alloc(&nc->page, len, gfp_mask);
  		pfmemalloc = nc->page.pfmemalloc;
-@@ -975,7 +1026,7 @@ static void skb_free_head(struct sk_buff *skb, bool napi_safe)
+@@ -975,7 +1027,7 @@ static void skb_free_head(struct sk_buff
  	}
  }
  
@@ -269,7 +269,7 @@
  			     bool napi_safe)
  {
  	struct skb_shared_info *shinfo = skb_shinfo(skb);
-@@ -1018,7 +1069,7 @@ static void skb_release_data(struct sk_buff *skb, enum skb_drop_reason reason,
+@@ -1018,7 +1070,7 @@ exit:
  /*
   *	Free an skbuff by memory without cleaning the state.
   */
@@ -278,7 +278,7 @@
  {
  	struct sk_buff_fclones *fclones;
  
-@@ -1282,7 +1333,6 @@ void skb_tx_error(struct sk_buff *skb)
+@@ -1282,7 +1334,6 @@ void skb_tx_error(struct sk_buff *skb)
  }
  EXPORT_SYMBOL(skb_tx_error);
  
@@ -286,7 +286,7 @@
  /**
   *	consume_skb - free an skbuff
   *	@skb: buffer to free
-@@ -1291,13 +1341,48 @@ EXPORT_SYMBOL(skb_tx_error);
+@@ -1291,13 +1342,48 @@ EXPORT_SYMBOL(skb_tx_error);
   *	Functions identically to kfree_skb, but kfree_skb assumes that the frame
   *	is being dropped after a failure and notes that
   */
@@ -300,14 +300,14 @@
 +	/*Tian: Not sure if we need to continue using this since
 +	 * since unref does the work in 5.4
 +	 */
-+
+ 
 +	/*
 +	if (likely(atomic_read(&skb->users) == 1))
 +		smp_rmb();
 +	else if (likely(!atomic_dec_and_test(&skb->users)))
 +		return;
 +	*/
- 
++
 +	/* If possible we'd like to recycle any skb rather than just free it,
 +	 * but in order to do that we need to release any head state too.
 +	 * We don't want to do this later because we'll be in a pre-emption
@@ -336,7 +336,7 @@
  }
  EXPORT_SYMBOL(consume_skb);
  #endif
-@@ -2107,6 +2192,8 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
+@@ -2113,6 +2199,8 @@ int pskb_expand_head(struct sk_buff *skb
  	if (skb_pfmemalloc(skb))
  		gfp_mask |= __GFP_MEMALLOC;
  
@@ -345,7 +345,7 @@
  	data = kmalloc_reserve(&size, gfp_mask, NUMA_NO_NODE, NULL);
  	if (!data)
  		goto nodata;
-@@ -4854,6 +4941,10 @@ static void skb_extensions_init(void) {}
+@@ -4869,6 +4957,10 @@ static void skb_extensions_init(void) {}
  
  void __init skb_init(void)
  {
@@ -356,7 +356,7 @@
  	skbuff_cache = kmem_cache_create_usercopy("skbuff_head_cache",
  					      sizeof(struct sk_buff),
  					      0,
-@@ -4879,6 +4970,7 @@ void __init skb_init(void)
+@@ -4894,6 +4986,7 @@ void __init skb_init(void)
  						SKB_SMALL_HEAD_HEADROOM,
  						NULL);
  	skb_extensions_init();
@@ -364,7 +364,7 @@
  }
  
  static int
-@@ -6382,6 +6474,8 @@ static int pskb_carve_inside_header(struct sk_buff *skb, const u32 off,
+@@ -6397,6 +6490,8 @@ static int pskb_carve_inside_header(stru
  	if (skb_pfmemalloc(skb))
  		gfp_mask |= __GFP_MEMALLOC;
  
@@ -373,7 +373,7 @@
  	data = kmalloc_reserve(&size, gfp_mask, NUMA_NO_NODE, NULL);
  	if (!data)
  		return -ENOMEM;
-@@ -6498,6 +6592,8 @@ static int pskb_carve_inside_nonlinear(struct sk_buff *skb, const u32 off,
+@@ -6513,6 +6608,8 @@ static int pskb_carve_inside_nonlinear(s
  	if (skb_pfmemalloc(skb))
  		gfp_mask |= __GFP_MEMALLOC;
  
diff --git a/target/linux/qualcommax/patches-6.6/0982-1-arm64-dts-qcom-disable-swiotlb-for-64mb-savings.patch b/target/linux/qualcommax/patches-6.6/0982-1-arm64-dts-qcom-disable-swiotlb-for-64mb-savings.patch
index bb610079aad154..c993f6098995ac 100644
--- a/target/linux/qualcommax/patches-6.6/0982-1-arm64-dts-qcom-disable-swiotlb-for-64mb-savings.patch
+++ b/target/linux/qualcommax/patches-6.6/0982-1-arm64-dts-qcom-disable-swiotlb-for-64mb-savings.patch
@@ -22,7 +22,7 @@
  	keys {
 --- a/arch/arm64/boot/dts/qcom/ipq8070-rm2-6.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq8070-rm2-6.dts
-@@ -32,7 +32,7 @@
+@@ -33,7 +33,7 @@
  
  	chosen {
  		stdout-path = "serial0:115200n8";
@@ -44,7 +44,7 @@
  	keys {
 --- a/arch/arm64/boot/dts/qcom/ipq8071-mf269.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq8071-mf269.dts
-@@ -24,7 +24,7 @@
+@@ -25,7 +25,7 @@
  
  	chosen {
  		stdout-path = "serial0:115200n8";
@@ -55,7 +55,7 @@
  	keys {
 --- a/arch/arm64/boot/dts/qcom/ipq8072-ax880.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq8072-ax880.dts
-@@ -29,7 +29,7 @@
+@@ -30,7 +30,7 @@
  
  	chosen {
  		stdout-path = "serial0:115200n8";
@@ -88,7 +88,7 @@
  	keys {
 --- a/arch/arm64/boot/dts/qcom/ipq8174-mx4200.dtsi
 +++ b/arch/arm64/boot/dts/qcom/ipq8174-mx4200.dtsi
-@@ -29,7 +29,7 @@
+@@ -30,7 +30,7 @@
  
  	chosen {
  		stdout-path = "serial0:115200n8";

From ce56601f304693ed648cbbd276f889777a632f49 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Thu, 27 Jun 2024 19:16:52 -0400
Subject: [PATCH 124/225] ath11k_nss: Drop unnecessary iphone fix patch

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../patches/nss/ath11k/270-iphone-issue.patch         | 11 -----------
 1 file changed, 11 deletions(-)
 delete mode 100644 package/kernel/mac80211/patches/nss/ath11k/270-iphone-issue.patch

diff --git a/package/kernel/mac80211/patches/nss/ath11k/270-iphone-issue.patch b/package/kernel/mac80211/patches/nss/ath11k/270-iphone-issue.patch
deleted file mode 100644
index 717c11bdfe39e1..00000000000000
--- a/package/kernel/mac80211/patches/nss/ath11k/270-iphone-issue.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/drivers/net/wireless/ath/ath11k/mac.c
-+++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -6262,6 +6262,8 @@ static int ath11k_mac_copy_he_cap(struct
- 		memcpy(he_cap_elem->phy_cap_info, band_cap->he_cap_phy_info,
- 		       sizeof(he_cap_elem->phy_cap_info));
- 
-+		he_cap_elem->mac_cap_info[0] &= ~IEEE80211_HE_MAC_CAP0_HTC_HE;
-+
- 		he_cap_elem->mac_cap_info[1] &=
- 			IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_MASK;
- 

From fd7a898b1516d21692d31b910d18e25a833176cc Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Thu, 27 Jun 2024 19:35:24 -0400
Subject: [PATCH 125/225] wifi_nss: Add threaded NAPI for ath10k and ath11k

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../ath10k/800-ath10k-Add-threaded-napi.patch | 32 +++++++++
 .../999-800-ath11k-Add-threaded-napi.patch    | 70 +++++++++++++++++++
 2 files changed, 102 insertions(+)
 create mode 100644 package/kernel/mac80211/patches/nss/ath10k/800-ath10k-Add-threaded-napi.patch
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/999-800-ath11k-Add-threaded-napi.patch

diff --git a/package/kernel/mac80211/patches/nss/ath10k/800-ath10k-Add-threaded-napi.patch b/package/kernel/mac80211/patches/nss/ath10k/800-ath10k-Add-threaded-napi.patch
new file mode 100644
index 00000000000000..9c79d4569944b2
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath10k/800-ath10k-Add-threaded-napi.patch
@@ -0,0 +1,32 @@
+--- a/drivers/net/wireless/ath/ath10k/pci.c
++++ b/drivers/net/wireless/ath/ath10k/pci.c
+@@ -1974,6 +1974,7 @@ static int ath10k_pci_hif_start(struct a
+ 
+ 	ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot hif start\n");
+ 
++	dev_set_threaded(&ar->napi_dev, true);
+ 	ath10k_core_napi_enable(ar);
+ 
+ 	ath10k_pci_irq_enable(ar);
+--- a/drivers/net/wireless/ath/ath10k/sdio.c
++++ b/drivers/net/wireless/ath/ath10k/sdio.c
+@@ -1862,6 +1862,7 @@ static int ath10k_sdio_hif_start(struct
+ 	struct ath10k_sdio *ar_sdio = ath10k_sdio_priv(ar);
+ 	int ret;
+ 
++	dev_set_threaded(&ar->napi_dev, true);
+ 	ath10k_core_napi_enable(ar);
+ 
+ 	/* Sleep 20 ms before HIF interrupts are disabled.
+--- a/drivers/net/wireless/ath/ath10k/core.c
++++ b/drivers/net/wireless/ath/ath10k/core.c
+@@ -3702,6 +3702,9 @@ struct ath10k *ath10k_core_create(size_t
+ 		  ath10k_core_set_coverage_class_work);
+ 
+ 	init_dummy_netdev(&ar->napi_dev);
++	snprintf(ar->napi_dev.name, sizeof(ar->napi_dev.name), "ath10k_%s",
++		 wiphy_name(ar->hw->wiphy));
++	ar->napi_dev.threaded = 1;
+ 
+ 	ret = ath10k_coredump_create(ar);
+ 	if (ret)
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-800-ath11k-Add-threaded-napi.patch b/package/kernel/mac80211/patches/nss/ath11k/999-800-ath11k-Add-threaded-napi.patch
new file mode 100644
index 00000000000000..46d17c2e280945
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-800-ath11k-Add-threaded-napi.patch
@@ -0,0 +1,70 @@
+--- a/drivers/net/wireless/ath/ath11k/ahb.c
++++ b/drivers/net/wireless/ath/ath11k/ahb.c
+@@ -526,6 +526,7 @@ static int ath11k_ahb_config_ext_irq(str
+ 	int irq;
+ 	int ret;
+ 	bool nss_offload;
++	static int devidx = 0;
+ 
+ 	/* TCL Completion, REO Dest, ERR, Exception and h2rxdma rings are offloaded
+ 	 * to nss when its enabled, hence don't enable these interrupts
+@@ -539,6 +540,9 @@ static int ath11k_ahb_config_ext_irq(str
+ 		irq_grp->ab = ab;
+ 		irq_grp->grp_id = i;
+ 		init_dummy_netdev(&irq_grp->napi_ndev);
++		snprintf(irq_grp->napi_ndev.name, sizeof(irq_grp->napi_ndev.name), "%s%d:%d",
++			 "ath11k_ahb", devidx, i);
++		irq_grp->napi_ndev.threaded = 1;
+ 		netif_napi_add(&irq_grp->napi_ndev, &irq_grp->napi,
+ 			       ath11k_ahb_ext_grp_napi_poll);
+ 
+@@ -604,6 +608,8 @@ static int ath11k_ahb_config_ext_irq(str
+ 		}
+ 	}
+ 
++	devidx++;
++
+ 	return 0;
+ }
+ 
+--- a/drivers/net/wireless/ath/ath11k/pci.c
++++ b/drivers/net/wireless/ath/ath11k/pci.c
+@@ -308,6 +308,8 @@ static int ath11k_pci_fix_l1ss(struct at
+ 		return ret;
+ 	}
+ 
++	devidx++;
++
+ 	return 0;
+ }
+ 
+--- a/drivers/net/wireless/ath/ath11k/pcic.c
++++ b/drivers/net/wireless/ath/ath11k/pcic.c
+@@ -505,8 +505,7 @@ static int ath11k_pcic_ext_grp_napi_poll
+ 	int i;
+ 
+ 	work_done = ath11k_dp_service_srng(ab, irq_grp, budget);
+-	if (work_done < budget) {
+-		napi_complete_done(napi, work_done);
++	if (work_done < budget && napi_complete_done(napi, work_done)) {
+ 		for (i = 0; i < irq_grp->num_irq; i++)
+ 			enable_irq(irq_grp->ab->irq_num[irq_grp->irqs[i]]);
+ 	}
+@@ -550,6 +549,7 @@ static int ath11k_pcic_ext_irq_config(st
+ 	int i, j, ret, num_vectors = 0;
+ 	u32 user_base_data = 0, base_vector = 0;
+ 	unsigned long irq_flags;
++	static int devidx = 0;
+ 
+ 	ret = ath11k_pcic_get_user_msi_assignment(ab, "DP", &num_vectors,
+ 						  &user_base_data,
+@@ -568,6 +568,9 @@ static int ath11k_pcic_ext_irq_config(st
+ 		irq_grp->ab = ab;
+ 		irq_grp->grp_id = i;
+ 		init_dummy_netdev(&irq_grp->napi_ndev);
++		snprintf(irq_grp->napi_ndev.name, sizeof(irq_grp->napi_ndev.name), "%s%d:%d",
++			 "ath11k_pci", devidx, i);
++		irq_grp->napi_ndev.threaded = 1;
+ 		netif_napi_add(&irq_grp->napi_ndev, &irq_grp->napi,
+ 			       ath11k_pcic_ext_grp_napi_poll);
+ 

From 5bffb7dc998dfc7393f51f1da87b5d27bb192ff0 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Thu, 27 Jun 2024 19:38:40 -0400
Subject: [PATCH 126/225] ath11k_nss: Add mac80211 based AQL support

Add wake_tx_queue mac op to support AQL and support
txq dequeueing from mac80211. Also implement a
simple scheduler for pulling all skbs from txqs
of all AC's at the end of tx completion NAPI.

Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1

Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...mac80211-based-AQL-support-in-ath11k.patch | 164 ++++++++++++++++++
 1 file changed, 164 insertions(+)
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/999-810-ath11k-Add-mac80211-based-AQL-support-in-ath11k.patch

diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-810-ath11k-Add-mac80211-based-AQL-support-in-ath11k.patch b/package/kernel/mac80211/patches/nss/ath11k/999-810-ath11k-Add-mac80211-based-AQL-support-in-ath11k.patch
new file mode 100644
index 00000000000000..f4e232c94f8416
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-810-ath11k-Add-mac80211-based-AQL-support-in-ath11k.patch
@@ -0,0 +1,164 @@
+From: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
+To: <ath11k-review.external@qti.qualcomm.com>
+CC: <linux-wireless@vger.kernel.org>
+Date: Mon, 1 May 2023 18:37:25 +0530
+Subject: [PATCH] ath11k: Add mac80211 based AQL support in ath11k
+
+Add wake_tx_queue mac op to support AQL and support
+txq dequeueing from mac80211. Also implement a
+simple scheduler for pulling all skbs from txqs
+of all AC's at the end of tx completion NAPI.
+
+Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/dp_tx.c | 11 ++++
+ drivers/net/wireless/ath/ath11k/mac.c   | 70 ++++++++++++++++++++++---
+ drivers/net/wireless/ath/ath11k/mac.h   |  1 +
+ 3 files changed, 76 insertions(+), 6 deletions(-)
+
+
+base-commit: 12f167f02a1abe2c8817496a902de00758285b92
+
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -847,6 +847,7 @@ void ath11k_dp_tx_completion_handler(str
+ 	u32 msdu_id, desc_id;
+ 	u8 mac_id;
+ 	struct hal_wbm_release_ring *tx_status;
++	bool mac_id_scheduled[MAX_RADIOS];
+ 
+ 	spin_lock_bh(&status_ring->lock);
+ 
+@@ -921,6 +922,15 @@ void ath11k_dp_tx_completion_handler(str
+ 			wake_up(&ar->dp.tx_empty_waitq);
+ 
+ 		ath11k_dp_tx_complete_msdu(ar, msdu, tx_status, buf_rel_source);
++		mac_id_scheduled[mac_id] = true;
++	}
++
++	/* Schedule remaining Tx packets for the radio */
++	for (i = 0; i <  MAX_RADIOS; i++) {
++		if (!mac_id_scheduled[i])
++			continue;
++		ar = ab->pdevs[i].ar;
++		ath11k_mac_tx_push_pending(ar);
+ 	}
+ }
+ 
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -6317,9 +6317,9 @@ static int ath11k_mac_tx_over_wmi(struct
+ 	return 0;
+ }
+ 
+-static void ath11k_mac_op_tx(struct ieee80211_hw *hw,
+-			     struct ieee80211_tx_control *control,
+-			     struct sk_buff *skb)
++static void ath11k_mac_tx(struct ieee80211_hw *hw,
++			  struct ieee80211_sta *sta,
++			  struct sk_buff *skb)
+ {
+ 	struct ath11k_skb_cb *skb_cb = ATH11K_SKB_CB(skb);
+ 	struct ath11k *ar = hw->priv;
+@@ -6379,8 +6379,8 @@ static void ath11k_mac_op_tx(struct ieee
+ 		return;
+ 	}
+ 
+-	if (control->sta)
+-		arsta = ath11k_sta_to_arsta(control->sta);
++	if (sta)
++		arsta = ath11k_sta_to_arsta(sta);
+ 
+ 	/* Must call mac80211 tx status handler, else when stats is disabled we free
+ 	 * the skb from driver. Own tx packets on monitor will also be disabled.
+@@ -6403,6 +6403,62 @@ static void ath11k_mac_op_tx(struct ieee
+ 	}
+ }
+ 
++static void ath11k_mac_schedule_txq(struct ieee80211_hw *hw, u32 ac)
++{
++	struct ieee80211_txq *txq;
++	struct sk_buff *skb;
++
++	ieee80211_txq_schedule_start(hw, ac);
++	while ((txq = ieee80211_next_txq(hw, ac))) {
++		while ((skb = ieee80211_tx_dequeue_ni(hw, txq)))
++			ath11k_mac_tx(hw, txq->sta, skb);
++
++		ieee80211_return_txq(hw, txq, false);
++	}
++	ieee80211_txq_schedule_end(hw, ac);
++}
++
++void ath11k_mac_tx_push_pending(struct ath11k *ar)
++{
++	struct ieee80211_hw *hw = ar->hw;
++	u32 ac;
++
++	rcu_read_lock();
++	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
++		ath11k_mac_schedule_txq(hw, ac);
++
++	rcu_read_unlock();
++}
++
++static void ath11k_mac_op_wake_tx_queue(struct ieee80211_hw *hw,
++					struct ieee80211_txq *txq)
++{
++	u8 ac;
++	struct sk_buff *skb;
++
++	ac = txq->ac;
++	ieee80211_txq_schedule_start(hw, ac);
++	txq = ieee80211_next_txq(hw, ac);
++
++	if (!txq)
++		goto out;
++
++	while ((skb = ieee80211_tx_dequeue_ni(hw, txq)))
++		ath11k_mac_tx(hw, txq->sta, skb);
++
++	ieee80211_return_txq(hw, txq, false);
++
++out:
++	ieee80211_txq_schedule_end(hw, ac);
++}
++
++static void ath11k_mac_op_tx(struct ieee80211_hw *hw,
++			     struct ieee80211_tx_control *control,
++			     struct sk_buff *skb)
++{
++	ath11k_mac_tx(hw, control->sta, skb);
++}
++
+ void ath11k_mac_drain_tx(struct ath11k *ar)
+ {
+ 	/* make sure rcu-protected mac80211 tx path itself is drained */
+@@ -9746,7 +9802,7 @@ static int ath11k_mac_op_sta_state(struc
+ 
+ static const struct ieee80211_ops ath11k_ops = {
+ 	.tx				= ath11k_mac_op_tx,
+-	.wake_tx_queue			= ieee80211_handle_wake_tx_queue,
++	.wake_tx_queue			= ath11k_mac_op_wake_tx_queue,
+ 	.start                          = ath11k_mac_op_start,
+ 	.stop                           = ath11k_mac_op_stop,
+ 	.reconfig_complete              = ath11k_mac_op_reconfig_complete,
+@@ -10274,6 +10330,8 @@ static int __ath11k_mac_register(struct
+ 			ieee80211_hw_set(ar->hw, SUPPORTS_MESH_NSS_OFFLOAD);
+ 	}
+ 
++	wiphy_ext_feature_set(ar->hw->wiphy, NL80211_EXT_FEATURE_AQL);
++
+ 	ret = ieee80211_register_hw(ar->hw);
+ 	if (ret) {
+ 		ath11k_err(ar->ab, "ieee80211 registration failed: %d\n", ret);
+--- a/drivers/net/wireless/ath/ath11k/mac.h
++++ b/drivers/net/wireless/ath/ath11k/mac.h
+@@ -174,4 +174,5 @@ int ath11k_mac_wait_tx_complete(struct a
+ int ath11k_mac_vif_set_keepalive(struct ath11k_vif *arvif,
+ 				 enum wmi_sta_keepalive_method method,
+ 				 u32 interval);
++void ath11k_mac_tx_push_pending(struct ath11k *ar);
+ #endif

From b1f88fd044552d5cbe72e73920c5b3cf7fac724f Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Thu, 27 Jun 2024 20:09:51 -0400
Subject: [PATCH 127/225] qualcommax: Fix threaded NAPI scheduling

Revert to using the default kernel timer (CONFIG_HZ_100).

Setting the timer to 1000hz is unecessary and just adds CPU overhead. It
also causes atomic scheduling issues in various threaded tasks,
especially when using threaded NAPI.

When the kernel timer frequency is set to 1000 Hz, it generates interrupts
1000 times per second. This increased frequency can lead to more
frequent context switches and interrupt handling, which can
interfere with other kernel activities.

Since network packet processing is offloaded to the NSS cores, the main CPU
does not need high-resolution timer interrupts to manage network
traffic efficiently. The NSS cores handle this independently.

This is the setting used and recommended by Qualcomm for all their IPQ
platforms.

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 target/linux/qualcommax/config-6.6 | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/target/linux/qualcommax/config-6.6 b/target/linux/qualcommax/config-6.6
index 1eac5124ae7931..48beaebd8acb42 100644
--- a/target/linux/qualcommax/config-6.6
+++ b/target/linux/qualcommax/config-6.6
@@ -195,9 +195,6 @@ CONFIG_HWSPINLOCK=y
 CONFIG_HWSPINLOCK_QCOM=y
 CONFIG_HW_RANDOM=y
 CONFIG_HW_RANDOM_MSM=y
-CONFIG_HZ=1000
-# CONFIG_HZ_100 is not set
-CONFIG_HZ_1000=y
 CONFIG_I2C=y
 CONFIG_I2C_BOARDINFO=y
 CONFIG_I2C_CHARDEV=y

From 619e06479f376743fda3b3400d6aed83209aa8a1 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Tue, 2 Jul 2024 21:54:29 -0400
Subject: [PATCH 128/225] qualcommax: clean up kernel config, align with QSDK

Cleaned up erronous settings for disabled features. The syntax should be
"# CONFIG_SOME_OPTION is not set", rather than simply commenting it out.

Removed left over config options from 5.15, and enabled features
recommended by QSDK:

```
CONFIG_IRQ_TIME_ACCOUNTING=y
CONFIG_MULTI_IRQ_HANDLER=y
CONFIG_HANDLE_DOMAIN_IRQ=y
CONFIG_HZ_FIXED=0
CONFIG_NO_HZ=y
```

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 target/linux/qualcommax/config-6.6 | 25 +++++++++++--------------
 1 file changed, 11 insertions(+), 14 deletions(-)

diff --git a/target/linux/qualcommax/config-6.6 b/target/linux/qualcommax/config-6.6
index 48beaebd8acb42..291e8cf1b974df 100644
--- a/target/linux/qualcommax/config-6.6
+++ b/target/linux/qualcommax/config-6.6
@@ -44,8 +44,6 @@ CONFIG_ARM64_WORKAROUND_TSB_FLUSH_FAILURE=y
 CONFIG_ARM_AMBA=y
 CONFIG_ARM_ARCH_TIMER=y
 CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
-# CONFIG_ARM_SMMU_V3_PMU is not set
-# CONFIG_ARM_CORESIGHT_PMU_ARCH_SYSTEM_PMU is not set
 CONFIG_ARM_GIC=y
 CONFIG_ARM_GIC_V2M=y
 CONFIG_ARM_GIC_V3=y
@@ -101,15 +99,15 @@ CONFIG_CRC8=y
 CONFIG_CRYPTO_AUTHENC=y
 CONFIG_CRYPTO_CBC=y
 CONFIG_CRYPTO_DEFLATE=y
-# CONFIG_CRYPTO_DEV_QCE=y
-# CONFIG_CRYPTO_DEV_QCE_AEAD=y
+# CONFIG_CRYPTO_DEV_QCE is not set
+# CONFIG_CRYPTO_DEV_QCE_AEAD is not set
 # CONFIG_CRYPTO_DEV_QCE_ENABLE_AEAD is not set
-# CONFIG_CRYPTO_DEV_QCE_ENABLE_ALL=y
+# CONFIG_CRYPTO_DEV_QCE_ENABLE_ALL is not set
 # CONFIG_CRYPTO_DEV_QCE_ENABLE_SHA is not set
 # CONFIG_CRYPTO_DEV_QCE_ENABLE_SKCIPHER is not set
-# CONFIG_CRYPTO_DEV_QCE_SHA=y
-# CONFIG_CRYPTO_DEV_QCE_SKCIPHER=y
-# CONFIG_CRYPTO_DEV_QCE_SW_MAX_LEN=512
+# CONFIG_CRYPTO_DEV_QCE_SHA is not set
+# CONFIG_CRYPTO_DEV_QCE_SKCIPHER is not set
+# CONFIG_CRYPTO_DEV_QCE_SW_MAX_LEN is not set
 CONFIG_CRYPTO_DEV_QCOM_RNG=y
 CONFIG_CRYPTO_ECB=y
 CONFIG_CRYPTO_HASH_INFO=y
@@ -125,8 +123,6 @@ CONFIG_CRYPTO_RNG=y
 CONFIG_CRYPTO_RNG2=y
 CONFIG_CRYPTO_SHA1=y
 CONFIG_CRYPTO_SHA256=y
-# CONFIG_CRYPTO_SM4_ARM64_CE_CCM is not set
-# CONFIG_CRYPTO_SM4_ARM64_CE_GCM is not set
 CONFIG_CRYPTO_XTS=y
 CONFIG_CRYPTO_ZSTD=y
 CONFIG_DCACHE_WORD_ACCESS=y
@@ -193,8 +189,6 @@ CONFIG_HAS_IOPORT=y
 CONFIG_HAS_IOPORT_MAP=y
 CONFIG_HWSPINLOCK=y
 CONFIG_HWSPINLOCK_QCOM=y
-CONFIG_HW_RANDOM=y
-CONFIG_HW_RANDOM_MSM=y
 CONFIG_I2C=y
 CONFIG_I2C_BOARDINFO=y
 CONFIG_I2C_CHARDEV=y
@@ -218,6 +212,9 @@ CONFIG_IRQ_DOMAIN_HIERARCHY=y
 CONFIG_IRQ_FASTEOI_HIERARCHY_HANDLERS=y
 CONFIG_IRQ_FORCED_THREADING=y
 CONFIG_IRQ_WORK=y
+CONFIG_IRQ_TIME_ACCOUNTING=y
+CONFIG_MULTI_IRQ_HANDLER=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
 # CONFIG_KPSS_XCC is not set
 CONFIG_LEDS_TLC591XX=y
 CONFIG_LIBFDT=y
@@ -277,8 +274,10 @@ CONFIG_NET_SELFTESTS=y
 CONFIG_NET_SWITCHDEV=y
 CONFIG_NET_XGRESS=y
 CONFIG_NLS=y
+CONFIG_HZ_FIXED=0
 CONFIG_NO_HZ_COMMON=y
 CONFIG_NO_HZ_IDLE=y
+CONFIG_NO_HZ=y
 CONFIG_NR_CPUS=4
 CONFIG_NVIDIA_CARMEL_CNP_ERRATUM=y
 CONFIG_NVMEM=y
@@ -381,8 +380,6 @@ CONFIG_POWER_RESET=y
 CONFIG_POWER_SUPPLY=y
 CONFIG_PREEMPT=y
 CONFIG_PREEMPT_COUNT=y
-# CONFIG_PREEMPT_DYNAMIC is not set
-# CONFIG_PREEMPT_NONE_BUILD is not set
 # CONFIG_PREEMPT_NONE is not set
 CONFIG_PREEMPT_RCU=y
 CONFIG_PRINTK_TIME=y

From 361a737a931ed6e78f0baba3492f84d37b3ff8a9 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Tue, 2 Jul 2024 22:00:41 -0400
Subject: [PATCH 129/225] qualcommax: NSS: introduce helper functions for NAPI
 threading

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...983-1-netdevice-threaded-napi-helper.patch | 59 +++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 target/linux/qualcommax/patches-6.6/0983-1-netdevice-threaded-napi-helper.patch

diff --git a/target/linux/qualcommax/patches-6.6/0983-1-netdevice-threaded-napi-helper.patch b/target/linux/qualcommax/patches-6.6/0983-1-netdevice-threaded-napi-helper.patch
new file mode 100644
index 00000000000000..f905097e8a5be6
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0983-1-netdevice-threaded-napi-helper.patch
@@ -0,0 +1,59 @@
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -2711,6 +2711,25 @@ netif_napi_add(struct net_device *dev, s
+ 	netif_napi_add_weight(dev, napi, poll, NAPI_POLL_WEIGHT);
+ }
+ 
++
++static inline void netif_threaded_napi_add_weight(struct net_device *dev,
++					   struct napi_struct *napi,
++					   int (*poll)(struct napi_struct *, int),
++					   int weight)
++{
++	netif_napi_add_weight(dev, napi, poll, weight);
++	if (num_online_cpus() > 1) {
++		dev_set_threaded(dev, true);
++	}
++}
++
++static inline void netif_threaded_napi_add(struct net_device *dev,
++					   struct napi_struct *napi,
++					   int (*poll)(struct napi_struct *, int))
++{
++	netif_threaded_napi_add_weight(dev, napi, poll, NAPI_POLL_WEIGHT);
++}
++
+ static inline void
+ netif_napi_add_tx_weight(struct net_device *dev,
+ 			 struct napi_struct *napi,
+@@ -2721,6 +2740,16 @@ netif_napi_add_tx_weight(struct net_devi
+ 	netif_napi_add_weight(dev, napi, poll, weight);
+ }
+ 
++static inline void
++netif_threaded_napi_add_tx_weight(struct net_device *dev,
++			 struct napi_struct *napi,
++			 int (*poll)(struct napi_struct *, int),
++			 int weight)
++{
++	set_bit(NAPI_STATE_NO_BUSY_POLL, &napi->state);
++	netif_threaded_napi_add_weight(dev, napi, poll, weight);
++}
++
+ /**
+  * netif_napi_add_tx() - initialize a NAPI context to be used for Tx only
+  * @dev:  network device
+@@ -2738,6 +2767,13 @@ static inline void netif_napi_add_tx(str
+ 	netif_napi_add_tx_weight(dev, napi, poll, NAPI_POLL_WEIGHT);
+ }
+ 
++static inline void netif_threaded_napi_add_tx(struct net_device *dev,
++				     struct napi_struct *napi,
++				     int (*poll)(struct napi_struct *, int))
++{
++	netif_threaded_napi_add_tx_weight(dev, napi, poll, NAPI_POLL_WEIGHT);
++}
++
+ /**
+  *  __netif_napi_del - remove a NAPI context
+  *  @napi: NAPI context

From 932a4360316ab161db2f1564d6c2a3f054272a7b Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Tue, 2 Jul 2024 22:05:38 -0400
Subject: [PATCH 130/225] wifi_nss: Use NAPI threaded helper functions

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ... => 999-800-ath10k-Add-threaded-napi.patch} | 18 ++++++++++++++++++
 .../999-800-ath11k-Add-threaded-napi.patch     | 16 ++++++++++------
 2 files changed, 28 insertions(+), 6 deletions(-)
 rename package/kernel/mac80211/patches/nss/ath10k/{800-ath10k-Add-threaded-napi.patch => 999-800-ath10k-Add-threaded-napi.patch} (62%)

diff --git a/package/kernel/mac80211/patches/nss/ath10k/800-ath10k-Add-threaded-napi.patch b/package/kernel/mac80211/patches/nss/ath10k/999-800-ath10k-Add-threaded-napi.patch
similarity index 62%
rename from package/kernel/mac80211/patches/nss/ath10k/800-ath10k-Add-threaded-napi.patch
rename to package/kernel/mac80211/patches/nss/ath10k/999-800-ath10k-Add-threaded-napi.patch
index 9c79d4569944b2..b81fb7ce3677d7 100644
--- a/package/kernel/mac80211/patches/nss/ath10k/800-ath10k-Add-threaded-napi.patch
+++ b/package/kernel/mac80211/patches/nss/ath10k/999-800-ath10k-Add-threaded-napi.patch
@@ -8,6 +8,15 @@
  	ath10k_core_napi_enable(ar);
  
  	ath10k_pci_irq_enable(ar);
+@@ -3232,7 +3233,7 @@ static void ath10k_pci_free_irq(struct a
+ 
+ void ath10k_pci_init_napi(struct ath10k *ar)
+ {
+-	netif_napi_add(&ar->napi_dev, &ar->napi, ath10k_pci_napi_poll);
++	netif_threaded_napi_add(&ar->napi_dev, &ar->napi, ath10k_pci_napi_poll);
+ }
+ 
+ static int ath10k_pci_init_irq(struct ath10k *ar)
 --- a/drivers/net/wireless/ath/ath10k/sdio.c
 +++ b/drivers/net/wireless/ath/ath10k/sdio.c
 @@ -1862,6 +1862,7 @@ static int ath10k_sdio_hif_start(struct
@@ -18,6 +27,15 @@
  	ath10k_core_napi_enable(ar);
  
  	/* Sleep 20 ms before HIF interrupts are disabled.
+@@ -2531,7 +2532,7 @@ static int ath10k_sdio_probe(struct sdio
+ 		return -ENOMEM;
+ 	}
+ 
+-	netif_napi_add(&ar->napi_dev, &ar->napi, ath10k_sdio_napi_poll);
++	netif_threaded_napi_add(&ar->napi_dev, &ar->napi, ath10k_sdio_napi_poll);
+ 
+ 	ath10k_dbg(ar, ATH10K_DBG_BOOT,
+ 		   "sdio new func %d vendor 0x%x device 0x%x block 0x%x/0x%x\n",
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
 @@ -3702,6 +3702,9 @@ struct ath10k *ath10k_core_create(size_t
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-800-ath11k-Add-threaded-napi.patch b/package/kernel/mac80211/patches/nss/ath11k/999-800-ath11k-Add-threaded-napi.patch
index 46d17c2e280945..99469642c7a7c1 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-800-ath11k-Add-threaded-napi.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-800-ath11k-Add-threaded-napi.patch
@@ -8,16 +8,18 @@
  
  	/* TCL Completion, REO Dest, ERR, Exception and h2rxdma rings are offloaded
  	 * to nss when its enabled, hence don't enable these interrupts
-@@ -539,6 +540,9 @@ static int ath11k_ahb_config_ext_irq(str
+@@ -539,7 +540,10 @@ static int ath11k_ahb_config_ext_irq(str
  		irq_grp->ab = ab;
  		irq_grp->grp_id = i;
  		init_dummy_netdev(&irq_grp->napi_ndev);
+-		netif_napi_add(&irq_grp->napi_ndev, &irq_grp->napi,
 +		snprintf(irq_grp->napi_ndev.name, sizeof(irq_grp->napi_ndev.name), "%s%d:%d",
 +			 "ath11k_ahb", devidx, i);
-+		irq_grp->napi_ndev.threaded = 1;
- 		netif_napi_add(&irq_grp->napi_ndev, &irq_grp->napi,
++
++		netif_threaded_napi_add(&irq_grp->napi_ndev, &irq_grp->napi,
  			       ath11k_ahb_ext_grp_napi_poll);
  
+ 		for (j = 0; j < ATH11K_EXT_IRQ_NUM_MAX; j++) {
 @@ -604,6 +608,8 @@ static int ath11k_ahb_config_ext_irq(str
  		}
  	}
@@ -58,13 +60,15 @@
  
  	ret = ath11k_pcic_get_user_msi_assignment(ab, "DP", &num_vectors,
  						  &user_base_data,
-@@ -568,6 +568,9 @@ static int ath11k_pcic_ext_irq_config(st
+@@ -568,7 +568,10 @@ static int ath11k_pcic_ext_irq_config(st
  		irq_grp->ab = ab;
  		irq_grp->grp_id = i;
  		init_dummy_netdev(&irq_grp->napi_ndev);
+-		netif_napi_add(&irq_grp->napi_ndev, &irq_grp->napi,
 +		snprintf(irq_grp->napi_ndev.name, sizeof(irq_grp->napi_ndev.name), "%s%d:%d",
 +			 "ath11k_pci", devidx, i);
-+		irq_grp->napi_ndev.threaded = 1;
- 		netif_napi_add(&irq_grp->napi_ndev, &irq_grp->napi,
++
++		netif_threaded_napi_add(&irq_grp->napi_ndev, &irq_grp->napi,
  			       ath11k_pcic_ext_grp_napi_poll);
  
+ 		/* tcl, reo, rx_err, wbm release, rxdma rings are offloaded to nss. */

From 660ace1ed4df4831a222baab883f0cd75928c624 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Wed, 3 Jul 2024 02:08:57 -0400
Subject: [PATCH 131/225] ath11k_nss: fix incorrectly applied ath11k_pci
 threaded napi patch

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../999-800-ath11k-Add-threaded-napi.patch    | 20 +++++++++----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-800-ath11k-Add-threaded-napi.patch b/package/kernel/mac80211/patches/nss/ath11k/999-800-ath11k-Add-threaded-napi.patch
index 99469642c7a7c1..570e8d8bbfb03d 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-800-ath11k-Add-threaded-napi.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-800-ath11k-Add-threaded-napi.patch
@@ -29,17 +29,6 @@
  	return 0;
  }
  
---- a/drivers/net/wireless/ath/ath11k/pci.c
-+++ b/drivers/net/wireless/ath/ath11k/pci.c
-@@ -308,6 +308,8 @@ static int ath11k_pci_fix_l1ss(struct at
- 		return ret;
- 	}
- 
-+	devidx++;
-+
- 	return 0;
- }
- 
 --- a/drivers/net/wireless/ath/ath11k/pcic.c
 +++ b/drivers/net/wireless/ath/ath11k/pcic.c
 @@ -505,8 +505,7 @@ static int ath11k_pcic_ext_grp_napi_poll
@@ -72,3 +61,12 @@
  			       ath11k_pcic_ext_grp_napi_poll);
  
  		/* tcl, reo, rx_err, wbm release, rxdma rings are offloaded to nss. */
+@@ -616,6 +619,8 @@ static int ath11k_pcic_ext_irq_config(st
+ 		ath11k_pcic_ext_grp_disable(irq_grp);
+ 	}
+ 
++	devidx++;
++
+ 	return 0;
+ }
+ 

From 4e294d73ef26e8e8e8f307e6634e3188134af821 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Wed, 3 Jul 2024 15:05:51 -0400
Subject: [PATCH 132/225] qualcommax: NSS: Add default packages drv, ecm,
 bridge-mgr

These packages are required for basic NSS offloading. So ensure they're
selected for all qualcommax targets.

  * kmod-qca-nss-ecm (Enhanced Connection Manager)
  * kmod-qca-nss-drv (NSS Driver)
  * kmod-qca-nss-drv-bridge-mgr (NSS Manager for Bridges)

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 target/linux/qualcommax/Makefile | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/linux/qualcommax/Makefile b/target/linux/qualcommax/Makefile
index 3c9bb840e31ca6..850191b2d0d878 100644
--- a/target/linux/qualcommax/Makefile
+++ b/target/linux/qualcommax/Makefile
@@ -16,6 +16,8 @@ DEFAULT_PACKAGES += \
 	kmod-leds-gpio kmod-gpio-button-hotplug \
 	kmod-qca-nss-dp kmod-ath11k-ahb \
 	wpad-basic-mbedtls uboot-envtools \
-	e2fsprogs kmod-fs-ext4 losetup
+	e2fsprogs kmod-fs-ext4 losetup \
+	kmod-qca-nss-drv kmod-qca-nss-ecm \
+	kmod-qca-nss-drv-bridge-mgr
 
 $(eval $(call BuildTarget))

From 4505f8348a1d3ce71a4896549045f3eb4e4d4199 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Wed, 3 Jul 2024 16:03:09 -0400
Subject: [PATCH 133/225] ath10k-ct: Bump patch for 6.4 to 6.7

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...99-001-fix-ath10k_update_vif_offload.patch | 24 +++++--------------
 1 file changed, 6 insertions(+), 18 deletions(-)

diff --git a/package/kernel/ath10k-ct/patches/999-001-fix-ath10k_update_vif_offload.patch b/package/kernel/ath10k-ct/patches/999-001-fix-ath10k_update_vif_offload.patch
index 2ef718625f011e..6d0f8b4f8fd4cc 100644
--- a/package/kernel/ath10k-ct/patches/999-001-fix-ath10k_update_vif_offload.patch
+++ b/package/kernel/ath10k-ct/patches/999-001-fix-ath10k_update_vif_offload.patch
@@ -1,32 +1,20 @@
---- a/ath10k-6.4/mac.c
-+++ b/ath10k-6.4/mac.c
-@@ -6362,13 +6362,13 @@
- 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac set txbf conf, value: 0x%x\n",
- 		   value);
- 	return ath10k_wmi_vdev_set_param(ar, arvif->vdev_id,
+--- a/ath10k-6.7/mac.c
++++ b/ath10k-6.7/mac.c
+@@ -6364,7 +6364,7 @@ static int ath10k_mac_set_txbf_conf(stru
  					 ar->wmi.vdev_param->txbf, value);
  }
-
+ 
 -static void ath10k_update_vif_offload(struct ieee80211_hw *hw,
 +static int ath10k_update_vif_offload(struct ieee80211_hw *hw,
  				      struct ieee80211_vif *vif)
  {
  	struct ath10k_vif *arvif = (void *)vif->drv_priv;
- 	struct ath10k *ar = hw->priv;
- 	u32 vdev_param;
- 	int ret;
-@@ -6384,14 +6384,16 @@
- 					ATH10K_HW_TXRX_NATIVE_WIFI);
- 	/* 10.X firmware does not support this VDEV parameter. Do not warn */
- 	if (ret && ret != -EOPNOTSUPP) {
+@@ -6386,6 +6386,8 @@ static void ath10k_update_vif_offload(st
  		ath10k_warn(ar, "failed to set vdev %i TX encapsulation: %d\n",
  			    arvif->vdev_id, ret);
  	}
 +
 +	return ret;
  }
-
+ 
  /*
-  * TODO:
-  * Figure out how to handle WMI_VDEV_SUBTYPE_P2P_DEVICE,
-  * because we will send mgmt frames without CCK. This requirement

From 700511f3e8f1e3d0bfe5da8d719c72e5792dc00f Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Wed, 3 Jul 2024 16:03:51 -0400
Subject: [PATCH 134/225] ath10k-ct: Use NAPI threaded helper functions

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../999-800-ath10k-Add-threaded-napi.patch    | 50 +++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 package/kernel/ath10k-ct/patches/999-800-ath10k-Add-threaded-napi.patch

diff --git a/package/kernel/ath10k-ct/patches/999-800-ath10k-Add-threaded-napi.patch b/package/kernel/ath10k-ct/patches/999-800-ath10k-Add-threaded-napi.patch
new file mode 100644
index 00000000000000..57326293fe3fa7
--- /dev/null
+++ b/package/kernel/ath10k-ct/patches/999-800-ath10k-Add-threaded-napi.patch
@@ -0,0 +1,50 @@
+--- a/ath10k-6.7/pci.c
++++ b/ath10k-6.7/pci.c
+@@ -2284,6 +2284,7 @@ static int ath10k_pci_hif_start(struct a
+ 
+ 	ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot hif start\n");
+ 
++	dev_set_threaded(&ar->napi_dev, true);
+ 	ath10k_core_napi_enable(ar);
+ 
+ 	ath10k_pci_irq_enable(ar);
+@@ -3564,7 +3565,7 @@ static void ath10k_pci_free_irq(struct a
+ 
+ void ath10k_pci_init_napi(struct ath10k *ar)
+ {
+-	netif_napi_add(&ar->napi_dev, &ar->napi, ath10k_pci_napi_poll);
++	netif_threaded_napi_add(&ar->napi_dev, &ar->napi, ath10k_pci_napi_poll);
+ }
+ 
+ static int ath10k_pci_init_irq(struct ath10k *ar)
+--- a/ath10k-6.7/sdio.c
++++ b/ath10k-6.7/sdio.c
+@@ -1862,6 +1862,7 @@ static int ath10k_sdio_hif_start(struct
+ 	struct ath10k_sdio *ar_sdio = ath10k_sdio_priv(ar);
+ 	int ret;
+ 
++	dev_set_threaded(&ar->napi_dev, true);
+ 	ath10k_core_napi_enable(ar);
+ 
+ 	/* Sleep 20 ms before HIF interrupts are disabled.
+@@ -2531,7 +2532,7 @@ static int ath10k_sdio_probe(struct sdio
+ 		return -ENOMEM;
+ 	}
+ 
+-	netif_napi_add(&ar->napi_dev, &ar->napi, ath10k_sdio_napi_poll);
++	netif_threaded_napi_add(&ar->napi_dev, &ar->napi, ath10k_sdio_napi_poll);
+ 
+ 	ath10k_dbg(ar, ATH10K_DBG_BOOT,
+ 		   "sdio new func %d vendor 0x%x device 0x%x block 0x%x/0x%x\n",
+--- a/ath10k-6.7/core.c
++++ b/ath10k-6.7/core.c
+@@ -4571,6 +4571,9 @@ struct ath10k *ath10k_core_create(size_t
+ 	INIT_WORK(&ar->stop_scan_work, ath10k_wmi_stop_scan_work);
+ 
+ 	init_dummy_netdev(&ar->napi_dev);
++	snprintf(ar->napi_dev.name, sizeof(ar->napi_dev.name), "ath10k_%s",
++		 wiphy_name(ar->hw->wiphy));
++	ar->napi_dev.threaded = 1;
+ 
+ 	ret = ath10k_coredump_create(ar);
+ 	if (ret)

From f9d8350ea32982ae6402a0dfe9f94c74cc9dc0e5 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Thu, 4 Jul 2024 19:24:39 -0400
Subject: [PATCH 135/225] ath11k_nss: add tracing for
 update_muedca_params_event

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...03-mac80211-ath11k-fw-dynamic-muedca.patch | 49 +++++++++++++++++++
 1 file changed, 49 insertions(+)

diff --git a/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch b/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
index 2c4b6d1e2bff9c..d293a23df69a00 100644
--- a/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
@@ -201,3 +201,52 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  /* initialisation/exit functions */
  
  int __init nl80211_init(void)
+--- a/net/wireless/trace.h
++++ b/net/wireless/trace.h
+@@ -3805,6 +3805,46 @@ TRACE_EVENT(cfg80211_update_owe_info_eve
+ 		  __entry->assoc_link_id, __entry->peer_mld_addr)
+ );
+ 
++TRACE_EVENT(cfg80211_update_muedca_params_event,
++	TP_PROTO(struct wiphy *wiphy,
++		 const struct ieee80211_mu_edca_param_set *params),
++	TP_ARGS(wiphy, params),
++	TP_STRUCT__entry(
++		WIPHY_ENTRY
++		__field(u8, mu_qos_info)
++		__field(u8, be_aifsn)
++		__field(u8, be_ecw_min_max)
++		__field(u8, be_mu_edca_timer)
++		__field(u8, bk_aifsn)
++		__field(u8, bk_ecw_min_max)
++		__field(u8, bk_mu_edca_timer)
++		__field(u8, vi_aifsn)
++		__field(u8, vi_ecw_min_max)
++		__field(u8, vi_mu_edca_timer)
++		__field(u8, vo_aifsn)
++		__field(u8, vo_ecw_min_max)
++		__field(u8, vo_mu_edca_timer)
++	),
++	TP_fast_assign(
++		WIPHY_ASSIGN;
++		__entry->mu_qos_info = params->mu_qos_info
++		__entry->be_aifsn = params->ac_be.aifsn
++		__entry->be_ecw_min_max = params->ac_be.ecw_min_max
++		__entry->be_mu_edca_timer = params->ac_be.mu_edca_timer
++		__entry->bk_aifsn = params->ac_bk.aifsn
++		__entry->bk_ecw_min_max = params->ac_bk.ecw_min_max
++		__entry->bk_mu_edca_timer = params->ac_bk.mu_edca_timer
++		__entry->vi_aifsn = params->ac_vi.aifsn
++		__entry->vi_ecw_min_max = params->ac_vi.ecw_min_max
++		__entry->vi_mu_edca_timer = params->ac_vi.mu_edca_timer
++		__entry->vo_aifsn = params->ac_vo.aifsn
++		__entry->vo_ecw_min_max = params->ac_vo.ecw_min_max
++		__entry->vo_mu_edca_timer = params->ac_vo.mu_edca_timer
++	),
++	TP_printk(WIPHY_PR_FMT ", MU QOS info: %u", WIPHY_PR_ARG,
++		  __entry->mu_qos_info)
++);
++
+ TRACE_EVENT(cfg80211_bss_color_notify,
+ 	TP_PROTO(struct net_device *netdev,
+ 		 enum nl80211_commands cmd,

From 98d63a96891b4b5113bd7eec728deb601279e7a1 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Fri, 5 Jul 2024 15:59:59 -0400
Subject: [PATCH 136/225] Revert "qualcommax: NSS: introduce helper functions
 for NAPI threading"

This reverts commit 5cf32cfe3edca047b7347236496c275bc23ae7fb.
---
 ...983-1-netdevice-threaded-napi-helper.patch | 59 -------------------
 1 file changed, 59 deletions(-)
 delete mode 100644 target/linux/qualcommax/patches-6.6/0983-1-netdevice-threaded-napi-helper.patch

diff --git a/target/linux/qualcommax/patches-6.6/0983-1-netdevice-threaded-napi-helper.patch b/target/linux/qualcommax/patches-6.6/0983-1-netdevice-threaded-napi-helper.patch
deleted file mode 100644
index f905097e8a5be6..00000000000000
--- a/target/linux/qualcommax/patches-6.6/0983-1-netdevice-threaded-napi-helper.patch
+++ /dev/null
@@ -1,59 +0,0 @@
---- a/include/linux/netdevice.h
-+++ b/include/linux/netdevice.h
-@@ -2711,6 +2711,25 @@ netif_napi_add(struct net_device *dev, s
- 	netif_napi_add_weight(dev, napi, poll, NAPI_POLL_WEIGHT);
- }
- 
-+
-+static inline void netif_threaded_napi_add_weight(struct net_device *dev,
-+					   struct napi_struct *napi,
-+					   int (*poll)(struct napi_struct *, int),
-+					   int weight)
-+{
-+	netif_napi_add_weight(dev, napi, poll, weight);
-+	if (num_online_cpus() > 1) {
-+		dev_set_threaded(dev, true);
-+	}
-+}
-+
-+static inline void netif_threaded_napi_add(struct net_device *dev,
-+					   struct napi_struct *napi,
-+					   int (*poll)(struct napi_struct *, int))
-+{
-+	netif_threaded_napi_add_weight(dev, napi, poll, NAPI_POLL_WEIGHT);
-+}
-+
- static inline void
- netif_napi_add_tx_weight(struct net_device *dev,
- 			 struct napi_struct *napi,
-@@ -2721,6 +2740,16 @@ netif_napi_add_tx_weight(struct net_devi
- 	netif_napi_add_weight(dev, napi, poll, weight);
- }
- 
-+static inline void
-+netif_threaded_napi_add_tx_weight(struct net_device *dev,
-+			 struct napi_struct *napi,
-+			 int (*poll)(struct napi_struct *, int),
-+			 int weight)
-+{
-+	set_bit(NAPI_STATE_NO_BUSY_POLL, &napi->state);
-+	netif_threaded_napi_add_weight(dev, napi, poll, weight);
-+}
-+
- /**
-  * netif_napi_add_tx() - initialize a NAPI context to be used for Tx only
-  * @dev:  network device
-@@ -2738,6 +2767,13 @@ static inline void netif_napi_add_tx(str
- 	netif_napi_add_tx_weight(dev, napi, poll, NAPI_POLL_WEIGHT);
- }
- 
-+static inline void netif_threaded_napi_add_tx(struct net_device *dev,
-+				     struct napi_struct *napi,
-+				     int (*poll)(struct napi_struct *, int))
-+{
-+	netif_threaded_napi_add_tx_weight(dev, napi, poll, NAPI_POLL_WEIGHT);
-+}
-+
- /**
-  *  __netif_napi_del - remove a NAPI context
-  *  @napi: NAPI context

From 4d142e1c864119310120f24f20703b47e0002c3d Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Fri, 5 Jul 2024 16:05:04 -0400
Subject: [PATCH 137/225] wifi_nss: Revert using napi threaded helper function

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../999-800-ath10k-Add-threaded-napi.patch    | 20 +------------
 .../999-800-ath10k-Add-threaded-napi.patch    | 30 +++++++------------
 .../999-800-ath11k-Add-threaded-napi.patch    | 28 ++++++++++++-----
 3 files changed, 32 insertions(+), 46 deletions(-)

diff --git a/package/kernel/ath10k-ct/patches/999-800-ath10k-Add-threaded-napi.patch b/package/kernel/ath10k-ct/patches/999-800-ath10k-Add-threaded-napi.patch
index 57326293fe3fa7..8290bc19751fa1 100644
--- a/package/kernel/ath10k-ct/patches/999-800-ath10k-Add-threaded-napi.patch
+++ b/package/kernel/ath10k-ct/patches/999-800-ath10k-Add-threaded-napi.patch
@@ -8,15 +8,6 @@
  	ath10k_core_napi_enable(ar);
  
  	ath10k_pci_irq_enable(ar);
-@@ -3564,7 +3565,7 @@ static void ath10k_pci_free_irq(struct a
- 
- void ath10k_pci_init_napi(struct ath10k *ar)
- {
--	netif_napi_add(&ar->napi_dev, &ar->napi, ath10k_pci_napi_poll);
-+	netif_threaded_napi_add(&ar->napi_dev, &ar->napi, ath10k_pci_napi_poll);
- }
- 
- static int ath10k_pci_init_irq(struct ath10k *ar)
 --- a/ath10k-6.7/sdio.c
 +++ b/ath10k-6.7/sdio.c
 @@ -1862,6 +1862,7 @@ static int ath10k_sdio_hif_start(struct
@@ -27,15 +18,6 @@
  	ath10k_core_napi_enable(ar);
  
  	/* Sleep 20 ms before HIF interrupts are disabled.
-@@ -2531,7 +2532,7 @@ static int ath10k_sdio_probe(struct sdio
- 		return -ENOMEM;
- 	}
- 
--	netif_napi_add(&ar->napi_dev, &ar->napi, ath10k_sdio_napi_poll);
-+	netif_threaded_napi_add(&ar->napi_dev, &ar->napi, ath10k_sdio_napi_poll);
- 
- 	ath10k_dbg(ar, ATH10K_DBG_BOOT,
- 		   "sdio new func %d vendor 0x%x device 0x%x block 0x%x/0x%x\n",
 --- a/ath10k-6.7/core.c
 +++ b/ath10k-6.7/core.c
 @@ -4571,6 +4571,9 @@ struct ath10k *ath10k_core_create(size_t
@@ -44,7 +26,7 @@
  	init_dummy_netdev(&ar->napi_dev);
 +	snprintf(ar->napi_dev.name, sizeof(ar->napi_dev.name), "ath10k_%s",
 +		 wiphy_name(ar->hw->wiphy));
-+	ar->napi_dev.threaded = 1;
++	dev_set_threaded(&ar->napi_dev, true);
  
  	ret = ath10k_coredump_create(ar);
  	if (ret)
diff --git a/package/kernel/mac80211/patches/nss/ath10k/999-800-ath10k-Add-threaded-napi.patch b/package/kernel/mac80211/patches/nss/ath10k/999-800-ath10k-Add-threaded-napi.patch
index b81fb7ce3677d7..98fe4b1ee90aa5 100644
--- a/package/kernel/mac80211/patches/nss/ath10k/999-800-ath10k-Add-threaded-napi.patch
+++ b/package/kernel/mac80211/patches/nss/ath10k/999-800-ath10k-Add-threaded-napi.patch
@@ -8,15 +8,6 @@
  	ath10k_core_napi_enable(ar);
  
  	ath10k_pci_irq_enable(ar);
-@@ -3232,7 +3233,7 @@ static void ath10k_pci_free_irq(struct a
- 
- void ath10k_pci_init_napi(struct ath10k *ar)
- {
--	netif_napi_add(&ar->napi_dev, &ar->napi, ath10k_pci_napi_poll);
-+	netif_threaded_napi_add(&ar->napi_dev, &ar->napi, ath10k_pci_napi_poll);
- }
- 
- static int ath10k_pci_init_irq(struct ath10k *ar)
 --- a/drivers/net/wireless/ath/ath10k/sdio.c
 +++ b/drivers/net/wireless/ath/ath10k/sdio.c
 @@ -1862,6 +1862,7 @@ static int ath10k_sdio_hif_start(struct
@@ -27,15 +18,6 @@
  	ath10k_core_napi_enable(ar);
  
  	/* Sleep 20 ms before HIF interrupts are disabled.
-@@ -2531,7 +2532,7 @@ static int ath10k_sdio_probe(struct sdio
- 		return -ENOMEM;
- 	}
- 
--	netif_napi_add(&ar->napi_dev, &ar->napi, ath10k_sdio_napi_poll);
-+	netif_threaded_napi_add(&ar->napi_dev, &ar->napi, ath10k_sdio_napi_poll);
- 
- 	ath10k_dbg(ar, ATH10K_DBG_BOOT,
- 		   "sdio new func %d vendor 0x%x device 0x%x block 0x%x/0x%x\n",
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
 @@ -3702,6 +3702,9 @@ struct ath10k *ath10k_core_create(size_t
@@ -44,7 +26,17 @@
  	init_dummy_netdev(&ar->napi_dev);
 +	snprintf(ar->napi_dev.name, sizeof(ar->napi_dev.name), "ath10k_%s",
 +		 wiphy_name(ar->hw->wiphy));
-+	ar->napi_dev.threaded = 1;
++	dev_set_threaded(&ar->napi_dev, true);
  
  	ret = ath10k_coredump_create(ar);
  	if (ret)
+--- a/drivers/net/wireless/ath/ath10k/ahb.c
++++ b/drivers/net/wireless/ath/ath10k/ahb.c
+@@ -622,6 +622,7 @@ static int ath10k_ahb_hif_start(struct a
+ 	ath10k_core_napi_enable(ar);
+ 	ath10k_ce_enable_interrupts(ar);
+ 	ath10k_pci_enable_legacy_irq(ar);
++	dev_set_threaded(&ar->napi_dev, true);
+ 
+ 	ath10k_pci_rx_post(ar);
+ 
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-800-ath11k-Add-threaded-napi.patch b/package/kernel/mac80211/patches/nss/ath11k/999-800-ath11k-Add-threaded-napi.patch
index 570e8d8bbfb03d..4f24a267cf172c 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-800-ath11k-Add-threaded-napi.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-800-ath11k-Add-threaded-napi.patch
@@ -1,6 +1,16 @@
 --- a/drivers/net/wireless/ath/ath11k/ahb.c
 +++ b/drivers/net/wireless/ath/ath11k/ahb.c
-@@ -526,6 +526,7 @@ static int ath11k_ahb_config_ext_irq(str
+@@ -494,8 +494,7 @@ static int ath11k_ahb_ext_grp_napi_poll(
+ 	int work_done;
+ 
+ 	work_done = ath11k_dp_service_srng(ab, irq_grp, budget);
+-	if (work_done < budget) {
+-		napi_complete_done(napi, work_done);
++	if (work_done < budget && napi_complete_done(napi, work_done)) {
+ 		ath11k_ahb_ext_grp_enable(irq_grp);
+ 	}
+ 
+@@ -526,6 +525,7 @@ static int ath11k_ahb_config_ext_irq(str
  	int irq;
  	int ret;
  	bool nss_offload;
@@ -8,18 +18,19 @@
  
  	/* TCL Completion, REO Dest, ERR, Exception and h2rxdma rings are offloaded
  	 * to nss when its enabled, hence don't enable these interrupts
-@@ -539,7 +540,10 @@ static int ath11k_ahb_config_ext_irq(str
+@@ -539,8 +539,12 @@ static int ath11k_ahb_config_ext_irq(str
  		irq_grp->ab = ab;
  		irq_grp->grp_id = i;
  		init_dummy_netdev(&irq_grp->napi_ndev);
--		netif_napi_add(&irq_grp->napi_ndev, &irq_grp->napi,
 +		snprintf(irq_grp->napi_ndev.name, sizeof(irq_grp->napi_ndev.name), "%s%d:%d",
 +			 "ath11k_ahb", devidx, i);
 +
-+		netif_threaded_napi_add(&irq_grp->napi_ndev, &irq_grp->napi,
+ 		netif_napi_add(&irq_grp->napi_ndev, &irq_grp->napi,
  			       ath11k_ahb_ext_grp_napi_poll);
++		dev_set_threaded(&irq_grp->napi_ndev, true);
  
  		for (j = 0; j < ATH11K_EXT_IRQ_NUM_MAX; j++) {
+ 			if (!nss_offload && ab->hw_params.ring_mask->tx[i] & BIT(j)) {
 @@ -604,6 +608,8 @@ static int ath11k_ahb_config_ext_irq(str
  		}
  	}
@@ -49,19 +60,20 @@
  
  	ret = ath11k_pcic_get_user_msi_assignment(ab, "DP", &num_vectors,
  						  &user_base_data,
-@@ -568,7 +568,10 @@ static int ath11k_pcic_ext_irq_config(st
+@@ -568,8 +568,12 @@ static int ath11k_pcic_ext_irq_config(st
  		irq_grp->ab = ab;
  		irq_grp->grp_id = i;
  		init_dummy_netdev(&irq_grp->napi_ndev);
--		netif_napi_add(&irq_grp->napi_ndev, &irq_grp->napi,
 +		snprintf(irq_grp->napi_ndev.name, sizeof(irq_grp->napi_ndev.name), "%s%d:%d",
 +			 "ath11k_pci", devidx, i);
 +
-+		netif_threaded_napi_add(&irq_grp->napi_ndev, &irq_grp->napi,
+ 		netif_napi_add(&irq_grp->napi_ndev, &irq_grp->napi,
  			       ath11k_pcic_ext_grp_napi_poll);
++		dev_set_threaded(&irq_grp->napi_ndev, true);
  
  		/* tcl, reo, rx_err, wbm release, rxdma rings are offloaded to nss. */
-@@ -616,6 +619,8 @@ static int ath11k_pcic_ext_irq_config(st
+ 		if (ab->nss.enabled &&
+@@ -616,6 +620,8 @@ static int ath11k_pcic_ext_irq_config(st
  		ath11k_pcic_ext_grp_disable(irq_grp);
  	}
  

From ecb6eee56cf0cba11ca3ae3ee2020a43ee48add5 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Fri, 5 Jul 2024 20:09:21 -0400
Subject: [PATCH 138/225] ath11k_nss: fix monitor mode

commit 072327212c033baf96365a5045673c5981eb0bdf (HEAD -> next, origin/next)
Author:     John Crispin <john@phrozen.org>
AuthorDate: Fri Jul 5 15:42:24 2024 +0200
Commit:     John Crispin <john@phrozen.org>
CommitDate: Fri Jul 5 15:42:40 2024 +0200

    ath11k: fix monitor mode

    Enabling CPTCFG_ATH11K_MEM_PROFILE_512M will change the layout of
    struct hal_rx_desc_ipq8074. This broke monitor mode. Fix it by not modifying
    the struct even if the 512MB profile is enabled.

    Fixes: WIFI-12102
    Signed-off-by: John Crispin <john@phrozen.org>

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...11k-Disable-rx_header-tlv-for-2K-SKB.patch | 38 +------------------
 1 file changed, 1 insertion(+), 37 deletions(-)

diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch b/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
index 57a6b7fb4a7ddb..ae7f1f8434af16 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
@@ -943,43 +943,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		ret = ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id,
 --- a/drivers/net/wireless/ath/ath11k/rx_desc.h
 +++ b/drivers/net/wireless/ath/ath11k/rx_desc.h
-@@ -1442,9 +1442,11 @@ struct hal_rx_desc_ipq8074 {
- 	__le32 mpdu_end_tag;
- 	struct rx_mpdu_end mpdu_end;
- 	u8 rx_padding1[HAL_RX_DESC_PADDING1_BYTES];
-+#ifndef CPTCFG_ATH11K_MEM_PROFILE_512M
- 	__le32 hdr_status_tag;
- 	__le32 phy_ppdu_id;
- 	u8 hdr_status[HAL_RX_DESC_HDR_STATUS_LEN];
-+#endif
- 	u8 msdu_payload[];
- } __packed;
- 
-@@ -1461,9 +1463,11 @@ struct hal_rx_desc_qcn9074 {
- 	__le32 mpdu_end_tag;
- 	struct rx_mpdu_end mpdu_end;
- 	u8 rx_padding1[HAL_RX_DESC_PADDING1_BYTES];
-+#ifndef CPTCFG_ATH11K_MEM_PROFILE_512M
- 	__le32 hdr_status_tag;
- 	__le32 phy_ppdu_id;
- 	u8 hdr_status[HAL_RX_DESC_HDR_STATUS_LEN];
-+#endif
- 	u8 msdu_payload[];
- } __packed;
- 
-@@ -1480,9 +1484,11 @@ struct hal_rx_desc_wcn6855 {
- 	__le32 mpdu_end_tag;
- 	struct rx_mpdu_end mpdu_end;
- 	u8 rx_padding1[HAL_RX_DESC_PADDING1_BYTES];
-+#ifndef CPTCFG_ATH11K_MEM_PROFILE_512M
- 	__le32 hdr_status_tag;
- 	__le32 phy_ppdu_id;
- 	u8 hdr_status[HAL_RX_DESC_HDR_STATUS_LEN];
-+#endif
- 	u8 msdu_payload[];
- } __packed;
- 
-@@ -1507,4 +1513,17 @@ struct hal_rx_desc {
+@@ -1507,4 +1507,17 @@ struct hal_rx_desc {
  #define RU_484 18
  #define RU_996 37
  

From 69354d867f043e30fb052df3cd2a200168bd9302 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 6 Jul 2024 15:25:25 -0400
Subject: [PATCH 139/225] hostapd: handle updated MU-EDCA params from driver

This patch handles the updating of MU-EDCA parameters indicated by
driver. Driver requests to update the parameters and Parameter Set
Update Count in beacon frames. This patch addresses only AP mode.

Three actions are taken to successfully update MU-EDCA parameters
in beacon:
	(1) Update MU-EDCA parameters stored in hostapd
	    The following Access Categories (AC) are updated:
	      VO: Voice
	      VI: Video
	      BE: Best Effort
	      BK: Background

	(2) Increment Parameter Set Update Count
	(3) Update beacon with new parameters

There aren't any options to configure, hostapd simply updates MU-EDCA
published by ath11k driver.

To verify params are getting updated, set log_level to '1' and check
logger

i.e. `uci set wireless.radio0.log_level=1`

```
Sat Jul  6 15:36:10 2024 daemon.debug hostapd: phy0-ap0: IEEE 802.11 MU-EDCA: Updated MU-EDCA parameters for AC 0: BE: 3, BK: 7, VI: 2, VO: 2
Sat Jul  6 15:36:10 2024 daemon.debug hostapd: phy0-ap0: IEEE 802.11 MU-EDCA: Updated MU-EDCA parameters for AC 1: BE: 164, BK: 164, VI: 67, VO: 50
Sat Jul  6 15:36:10 2024 daemon.debug hostapd: phy0-ap0: IEEE 802.11 MU-EDCA: Updated MU-EDCA parameters for AC 2: BE: 255, BK: 2, VI: 255, VO: 255
```

Requires the following patches applied to 'ath11k/subsys'

commit ce7f1ad354869d85abdf8e8ed8d36599e057ba5d
Author:     Sean Khan <datapronix@protonmail.com>
AuthorDate: Tue Feb 27 00:45:32 2024 -0500
Commit:     Sean Khan <datapronix@protonmail.com>
CommitDate: Sat Jul 6 15:19:26 2024 -0400

    ath11k_nss: FW Initiated Dynamic MU-EDCA

    package/kernel/mac80211/patches/nss/ath11k/203-mac80211-ath11k-fw-dynamic-muedca.patch
    package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../780-hostapd-update-muedca-params.patch    | 299 ++++++++++++++++++
 1 file changed, 299 insertions(+)
 create mode 100644 package/network/services/hostapd/patches/780-hostapd-update-muedca-params.patch

diff --git a/package/network/services/hostapd/patches/780-hostapd-update-muedca-params.patch b/package/network/services/hostapd/patches/780-hostapd-update-muedca-params.patch
new file mode 100644
index 00000000000000..fabae7dba881e5
--- /dev/null
+++ b/package/network/services/hostapd/patches/780-hostapd-update-muedca-params.patch
@@ -0,0 +1,299 @@
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -1314,6 +1314,11 @@ static int hostapd_ctrl_iface_set(struct
+ 		} else if (os_strncmp(cmd, "wme_ac_", 7) == 0 ||
+ 			   os_strncmp(cmd, "wmm_ac_", 7) == 0) {
+ 			hapd->parameter_set_count++;
++			 /* Incrementing MU-EDCA Parameter Set Update Count*/
++			 hapd->iface->conf->he_mu_edca.he_qos_info =
++			  (hapd->iface->conf->he_mu_edca.he_qos_info & 0xf0) |
++			  ((hapd->iface->conf->he_mu_edca.he_qos_info + 1) &
++			   0xf);
+ 			if (ieee802_11_update_beacons(hapd->iface))
+ 				wpa_printf(MSG_DEBUG,
+ 					   "Failed to update beacons with WMM parameters");
+--- a/src/ap/drv_callbacks.c
++++ b/src/ap/drv_callbacks.c
+@@ -20,6 +20,7 @@
+ #include "common/hw_features_common.h"
+ #include "crypto/random.h"
+ #include "p2p/p2p.h"
++#include "wpa_debug.h"
+ #include "wps/wps.h"
+ #include "fst/fst.h"
+ #include "wnm_ap.h"
+@@ -2267,6 +2268,47 @@ static void hostapd_event_wds_sta_interf
+ 		ifname, MAC2STR(addr));
+ }
+ 
++static void hostapd_event_update_muedca_params(struct hostapd_data *hapd,
++					       struct update_muedca *params)
++{
++	int i;
++	u8 updated_count;
++
++	/* Update current MU-EDCA parameters */
++	for (i = 0; i < 3; i++) {
++		hapd->iface->conf->he_mu_edca.he_mu_ac_be_param[i] =
++						params->he_mu_ac_be_param[i];
++		hapd->iface->conf->he_mu_edca.he_mu_ac_bk_param[i] =
++						params->he_mu_ac_bk_param[i];
++		hapd->iface->conf->he_mu_edca.he_mu_ac_vo_param[i] =
++						params->he_mu_ac_vo_param[i];
++		hapd->iface->conf->he_mu_edca.he_mu_ac_vi_param[i] =
++						params->he_mu_ac_vi_param[i];
++		hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211,
++		             HOSTAPD_LEVEL_DEBUG,
++			   "MU-EDCA: Updated MU-EDCA parameters for AC %d: "
++			   "BE: %d, BK: %d, VI: %d, VO: %d",
++			   i, params->he_mu_ac_be_param[i],
++			   params->he_mu_ac_bk_param[i],
++			   params->he_mu_ac_vi_param[i],
++			   params->he_mu_ac_vo_param[i]);
++	}
++
++	/* Increment Parameter Set Update Count for MU-EDCA and WME EDCA only
++	 * if any STA is connected
++	 */
++	if (hapd->num_sta) {
++		updated_count = (hapd->iface->conf->he_mu_edca.he_qos_info + 1) & 0xf;
++		hapd->iface->conf->he_mu_edca.he_qos_info &= 0xf0;
++		hapd->iface->conf->he_mu_edca.he_qos_info |= updated_count;
++		hapd->parameter_set_count++;
++	}
++
++	/* Update beacon with updated MU-EDCA parameters */
++	if (ieee802_11_update_beacons(hapd->iface))
++		wpa_printf(MSG_WARNING,
++			   "Failed to update beacons with MU-EDCA parameters");
++}
+ 
+ #ifdef CONFIG_OWE
+ static int hostapd_notif_update_dh_ie(struct hostapd_data *hapd,
+@@ -2677,6 +2719,9 @@ void hostapd_wpa_event(void *ctx, enum w
+ 		hostapd_cleanup_cca_params(hapd);
+ 		break;
+ #endif /* CONFIG_IEEE80211AX */
++	case EVENT_UPDATE_MUEDCA_PARAMS:
++		 hostapd_event_update_muedca_params(hapd, &data->update_muedca);
++		 break;
+ 	default:
+ 		wpa_printf(MSG_DEBUG, "Unknown event %d", event);
+ 		break;
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -4100,6 +4100,10 @@ static int hostapd_fill_csa_settings(str
+ 	hapd->cs_count = settings->cs_count;
+ 	hapd->cs_block_tx = settings->block_tx;
+ 
++	 /* reset MU-EDCA and WME EDCA parameter set count */
++	 hapd->iface->conf->he_mu_edca.he_qos_info &= 0xfff0;
++	 hapd->parameter_set_count = 0;
++
+ 	ret = hostapd_build_beacon_data(hapd, &settings->beacon_csa);
+ 	if (ret) {
+ 		free_beacon_data(&settings->beacon_after);
+--- a/src/ap/ieee802_11_he.c
++++ b/src/ap/ieee802_11_he.c
+@@ -19,6 +19,7 @@
+ #include "sta_info.h"
+ #include "ieee802_11.h"
+ #include "dfs.h"
++#include "wmm.h"
+ 
+ static u8 ieee80211_he_ppet_size(u8 ppe_thres_hdr, const u8 *phy_cap_info)
+ {
+@@ -291,9 +292,16 @@ u8 * hostapd_eid_he_operation(struct hos
+ u8 * hostapd_eid_he_mu_edca_parameter_set(struct hostapd_data *hapd, u8 *eid)
+ {
+ 	struct ieee80211_he_mu_edca_parameter_set *edca;
++	struct hostapd_wmm_ac_params wmmp[WMM_AC_NUM];
+ 	u8 *pos;
+ 	size_t i;
+ 
++	 /* Updating WME Parameter Set Count to avoid mismatch */
++	 os_memset(wmmp, 0, sizeof(wmmp));
++
++	 if (hapd->conf->wmm_enabled)
++		 wmm_calc_regulatory_limit(hapd, wmmp);
++
+ 	pos = (u8 *) &hapd->iface->conf->he_mu_edca;
+ 	for (i = 0; i < sizeof(*edca); i++) {
+ 		if (pos[i])
+--- a/src/ap/wmm.c
++++ b/src/ap/wmm.c
+@@ -61,8 +61,8 @@ wmm_set_regulatory_limit(const struct ho
+ /*
+  * Calculate WMM regulatory limit if any.
+  */
+-static void wmm_calc_regulatory_limit(struct hostapd_data *hapd,
+-				      struct hostapd_wmm_ac_params *acp)
++void wmm_calc_regulatory_limit(struct hostapd_data *hapd,
++			       struct hostapd_wmm_ac_params *acp)
+ {
+ 	struct hostapd_hw_modes *mode = hapd->iface->current_mode;
+ 	int c;
+@@ -91,6 +91,10 @@ static void wmm_calc_regulatory_limit(st
+ 		os_memcpy(hapd->iface->prev_wmm, acp,
+ 			  sizeof(hapd->iconf->wmm_ac_params));
+ 		hapd->parameter_set_count++;
++		 /* Incrementing MU-EDCA Parameter Set Update Count*/
++		  hapd->iface->conf->he_mu_edca.he_qos_info =
++		  (hapd->iface->conf->he_mu_edca.he_qos_info & 0xf0) |
++		  ((hapd->iface->conf->he_mu_edca.he_qos_info + 1) & 0xf);
+ 	}
+ }
+ 
+--- a/src/ap/wmm.h
++++ b/src/ap/wmm.h
+@@ -13,6 +13,8 @@
+ struct ieee80211_mgmt;
+ struct wmm_tspec_element;
+ 
++void wmm_calc_regulatory_limit(struct hostapd_data *hapd,
++				struct hostapd_wmm_ac_params *acp);
+ u8 * hostapd_eid_wmm(struct hostapd_data *hapd, u8 *eid);
+ int hostapd_eid_wmm_valid(struct hostapd_data *hapd, const u8 *eid,
+ 			  size_t len);
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -5786,6 +5786,16 @@ enum wpa_event_type {
+ 	EVENT_LINK_CH_SWITCH_STARTED,
+ 
+ 	/**
++	 * EVENT_UPDATE_MUEDCA_PARAMS - Updated MU-EDCA parameters received
++	 *
++	 * this event is emitted when updated MU-EDCA parameters from driver
++	 * are received. updated MU-EDCA parameters need to be updated in
++	 * beacon.
++	 */
++	EVENT_UPDATE_MUEDCA_PARAMS,
++
++
++	/**
+ 	 * EVENT_TID_LINK_MAP - MLD event to set TID-to-link mapping
+ 	 *
+ 	 * This event is used by the driver to indicate the received TID-to-link
+@@ -6752,6 +6762,16 @@ union wpa_event_data {
+ 	struct pasn_auth pasn_auth;
+ 
+ 	/**
++	 * struct update_muedca - Data for EVENT_UPDATE_MU_EDCA_PARAMS
++	 */
++	struct update_muedca {
++		u8 he_mu_ac_be_param[3];
++		u8 he_mu_ac_bk_param[3];
++		u8 he_mu_ac_vi_param[3];
++		u8 he_mu_ac_vo_param[3];
++	} update_muedca;
++
++	/**
+ 	 * struct port_authorized - Data for EVENT_PORT_AUTHORIZED
+ 	 * @td_bitmap: For STA mode, transition disable bitmap, if received in
+ 	 *	EAPOL-Key msg 3/4
+--- a/src/drivers/driver_common.c
++++ b/src/drivers/driver_common.c
+@@ -98,6 +98,7 @@ const char * event_to_string(enum wpa_ev
+ 	E2S(PASN_AUTH);
+ 	E2S(LINK_CH_SWITCH);
+ 	E2S(LINK_CH_SWITCH_STARTED);
++	E2S(UPDATE_MUEDCA_PARAMS);
+ 	E2S(TID_LINK_MAP);
+ 	E2S(LINK_RECONFIG);
+ 	}
+--- a/src/drivers/driver_nl80211_event.c
++++ b/src/drivers/driver_nl80211_event.c
+@@ -184,6 +184,7 @@ static const char * nl80211_command_to_s
+ 	C2S(NL80211_CMD_ADD_LINK_STA)
+ 	C2S(NL80211_CMD_MODIFY_LINK_STA)
+ 	C2S(NL80211_CMD_REMOVE_LINK_STA)
++	C2S(NL80211_CMD_UPDATE_HE_MUEDCA_PARAMS)
+ 	C2S(NL80211_CMD_SET_HW_TIMESTAMP)
+ 	C2S(NL80211_CMD_LINKS_REMOVED)
+ 	C2S(__NL80211_CMD_AFTER_LAST)
+@@ -3644,6 +3645,35 @@ static void nl80211_sta_opmode_change_ev
+ 	wpa_supplicant_event(drv->ctx, EVENT_STATION_OPMODE_CHANGED, &ed);
+ }
+ 
++static void nl80211_update_muedca_params_event(struct wpa_driver_nl80211_data *drv,
++					    struct nlattr **tb)
++{
++	struct host_update_muedca {
++		u8 mu_qos_info;
++		u8 ac_be[3];
++		u8 ac_bk[3];
++		u8 ac_vi[3];
++		u8 ac_vo[3];
++	};
++
++	struct host_update_muedca *rx_muedca_params;
++	union wpa_event_data ed;
++	int i;
++
++	if (!tb[NL80211_ATTR_HE_MUEDCA_PARAMS])
++		return;
++
++	rx_muedca_params = nla_data(tb[NL80211_ATTR_HE_MUEDCA_PARAMS]);
++
++	for (i = 0; i< 3; i++) {
++		ed.update_muedca.he_mu_ac_be_param[i] = rx_muedca_params->ac_be[i];
++		ed.update_muedca.he_mu_ac_bk_param[i] = rx_muedca_params->ac_bk[i];
++		ed.update_muedca.he_mu_ac_vi_param[i] = rx_muedca_params->ac_vi[i];
++		ed.update_muedca.he_mu_ac_vo_param[i] = rx_muedca_params->ac_vo[i];
++	}
++
++	wpa_supplicant_event(drv->ctx, EVENT_UPDATE_MUEDCA_PARAMS, &ed);
++}
+ 
+ static void nl80211_control_port_frame(struct wpa_driver_nl80211_data *drv,
+ 				       struct nlattr **tb)
+@@ -4090,6 +4120,9 @@ static void do_process_drv_event(struct
+ 	case NL80211_CMD_LINKS_REMOVED:
+ 		wpa_supplicant_event(drv->ctx, EVENT_LINK_RECONFIG, NULL);
+ 		break;
++	case NL80211_CMD_UPDATE_HE_MUEDCA_PARAMS:
++		nl80211_update_muedca_params_event(drv, tb);
++		break;
+ 	default:
+ 		wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: Ignored unknown event "
+ 			"(cmd=%d)", cmd);
+--- a/src/drivers/nl80211_copy.h
++++ b/src/drivers/nl80211_copy.h
+@@ -1323,6 +1323,11 @@
+  *	Multi-Link reconfiguration. %NL80211_ATTR_MLO_LINKS is used to provide
+  *	information about the removed STA MLD setup links.
+  *
++ * @NL80211_CMD_UPDATE_HE_MUEDCA_PARAMS: Updated MU-EDCA parameters from driver.
++ *	This event is used to update MU-EDCA parameters in Beacon frame, which
++ *	were indicated by driver and now need to be reflected in
++ *	Beacon frame.
++ *
+  * @NL80211_CMD_MAX: highest used command number
+  * @__NL80211_CMD_AFTER_LAST: internal use
+  */
+@@ -1578,6 +1583,7 @@ enum nl80211_commands {
+ 
+ 	NL80211_CMD_LINKS_REMOVED,
+ 
++	NL80211_CMD_UPDATE_HE_MUEDCA_PARAMS,
+ 	/* add new commands above here */
+ 
+ 	/* used to define NL80211_CMD_MAX below */
+@@ -2799,6 +2805,9 @@ enum nl80211_commands {
+  *	the incoming frame RX timestamp.
+  * @NL80211_ATTR_TD_BITMAP: Transition Disable bitmap, for subsequent
+  *	(re)associations.
++ * @NL80211_ATTR_HE_MUEDCA_PARAMS: MU-EDCA AC parameters for the
++ *	NL80211_CMD_UPDATE_HE_MUEDCA_PARAMS command.
++ *
+  *
+  * @NL80211_ATTR_PUNCT_BITMAP: (u32) Preamble puncturing bitmap, lowest
+  *	bit corresponds to the lowest 20 MHz channel. Each bit set to 1
+@@ -3364,6 +3373,7 @@ enum nl80211_attrs {
+ 
+ 	NL80211_ATTR_MLO_LINK_DISABLED,
+ 
++	NL80211_ATTR_HE_MUEDCA_PARAMS,
+ 	/* add attributes here, update the policy in nl80211.c */
+ 
+ 	__NL80211_ATTR_AFTER_LAST,

From f2f9d7a71222a47682406d2494f49ce3ce8b0269 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Mon, 8 Jul 2024 11:44:08 -0400
Subject: [PATCH 140/225] Revert "ath11k_nss: Add mac80211 based AQL support"

This reverts commit b1b446335beee744c7a74770d7383618d9cc3202.
---
 ...mac80211-based-AQL-support-in-ath11k.patch | 164 ------------------
 1 file changed, 164 deletions(-)
 delete mode 100644 package/kernel/mac80211/patches/nss/ath11k/999-810-ath11k-Add-mac80211-based-AQL-support-in-ath11k.patch

diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-810-ath11k-Add-mac80211-based-AQL-support-in-ath11k.patch b/package/kernel/mac80211/patches/nss/ath11k/999-810-ath11k-Add-mac80211-based-AQL-support-in-ath11k.patch
deleted file mode 100644
index f4e232c94f8416..00000000000000
--- a/package/kernel/mac80211/patches/nss/ath11k/999-810-ath11k-Add-mac80211-based-AQL-support-in-ath11k.patch
+++ /dev/null
@@ -1,164 +0,0 @@
-From: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
-To: <ath11k-review.external@qti.qualcomm.com>
-CC: <linux-wireless@vger.kernel.org>
-Date: Mon, 1 May 2023 18:37:25 +0530
-Subject: [PATCH] ath11k: Add mac80211 based AQL support in ath11k
-
-Add wake_tx_queue mac op to support AQL and support
-txq dequeueing from mac80211. Also implement a
-simple scheduler for pulling all skbs from txqs
-of all AC's at the end of tx completion NAPI.
-
-Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1
-
-Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
----
- drivers/net/wireless/ath/ath11k/dp_tx.c | 11 ++++
- drivers/net/wireless/ath/ath11k/mac.c   | 70 ++++++++++++++++++++++---
- drivers/net/wireless/ath/ath11k/mac.h   |  1 +
- 3 files changed, 76 insertions(+), 6 deletions(-)
-
-
-base-commit: 12f167f02a1abe2c8817496a902de00758285b92
-
---- a/drivers/net/wireless/ath/ath11k/dp_tx.c
-+++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
-@@ -847,6 +847,7 @@ void ath11k_dp_tx_completion_handler(str
- 	u32 msdu_id, desc_id;
- 	u8 mac_id;
- 	struct hal_wbm_release_ring *tx_status;
-+	bool mac_id_scheduled[MAX_RADIOS];
- 
- 	spin_lock_bh(&status_ring->lock);
- 
-@@ -921,6 +922,15 @@ void ath11k_dp_tx_completion_handler(str
- 			wake_up(&ar->dp.tx_empty_waitq);
- 
- 		ath11k_dp_tx_complete_msdu(ar, msdu, tx_status, buf_rel_source);
-+		mac_id_scheduled[mac_id] = true;
-+	}
-+
-+	/* Schedule remaining Tx packets for the radio */
-+	for (i = 0; i <  MAX_RADIOS; i++) {
-+		if (!mac_id_scheduled[i])
-+			continue;
-+		ar = ab->pdevs[i].ar;
-+		ath11k_mac_tx_push_pending(ar);
- 	}
- }
- 
---- a/drivers/net/wireless/ath/ath11k/mac.c
-+++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -6317,9 +6317,9 @@ static int ath11k_mac_tx_over_wmi(struct
- 	return 0;
- }
- 
--static void ath11k_mac_op_tx(struct ieee80211_hw *hw,
--			     struct ieee80211_tx_control *control,
--			     struct sk_buff *skb)
-+static void ath11k_mac_tx(struct ieee80211_hw *hw,
-+			  struct ieee80211_sta *sta,
-+			  struct sk_buff *skb)
- {
- 	struct ath11k_skb_cb *skb_cb = ATH11K_SKB_CB(skb);
- 	struct ath11k *ar = hw->priv;
-@@ -6379,8 +6379,8 @@ static void ath11k_mac_op_tx(struct ieee
- 		return;
- 	}
- 
--	if (control->sta)
--		arsta = ath11k_sta_to_arsta(control->sta);
-+	if (sta)
-+		arsta = ath11k_sta_to_arsta(sta);
- 
- 	/* Must call mac80211 tx status handler, else when stats is disabled we free
- 	 * the skb from driver. Own tx packets on monitor will also be disabled.
-@@ -6403,6 +6403,62 @@ static void ath11k_mac_op_tx(struct ieee
- 	}
- }
- 
-+static void ath11k_mac_schedule_txq(struct ieee80211_hw *hw, u32 ac)
-+{
-+	struct ieee80211_txq *txq;
-+	struct sk_buff *skb;
-+
-+	ieee80211_txq_schedule_start(hw, ac);
-+	while ((txq = ieee80211_next_txq(hw, ac))) {
-+		while ((skb = ieee80211_tx_dequeue_ni(hw, txq)))
-+			ath11k_mac_tx(hw, txq->sta, skb);
-+
-+		ieee80211_return_txq(hw, txq, false);
-+	}
-+	ieee80211_txq_schedule_end(hw, ac);
-+}
-+
-+void ath11k_mac_tx_push_pending(struct ath11k *ar)
-+{
-+	struct ieee80211_hw *hw = ar->hw;
-+	u32 ac;
-+
-+	rcu_read_lock();
-+	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
-+		ath11k_mac_schedule_txq(hw, ac);
-+
-+	rcu_read_unlock();
-+}
-+
-+static void ath11k_mac_op_wake_tx_queue(struct ieee80211_hw *hw,
-+					struct ieee80211_txq *txq)
-+{
-+	u8 ac;
-+	struct sk_buff *skb;
-+
-+	ac = txq->ac;
-+	ieee80211_txq_schedule_start(hw, ac);
-+	txq = ieee80211_next_txq(hw, ac);
-+
-+	if (!txq)
-+		goto out;
-+
-+	while ((skb = ieee80211_tx_dequeue_ni(hw, txq)))
-+		ath11k_mac_tx(hw, txq->sta, skb);
-+
-+	ieee80211_return_txq(hw, txq, false);
-+
-+out:
-+	ieee80211_txq_schedule_end(hw, ac);
-+}
-+
-+static void ath11k_mac_op_tx(struct ieee80211_hw *hw,
-+			     struct ieee80211_tx_control *control,
-+			     struct sk_buff *skb)
-+{
-+	ath11k_mac_tx(hw, control->sta, skb);
-+}
-+
- void ath11k_mac_drain_tx(struct ath11k *ar)
- {
- 	/* make sure rcu-protected mac80211 tx path itself is drained */
-@@ -9746,7 +9802,7 @@ static int ath11k_mac_op_sta_state(struc
- 
- static const struct ieee80211_ops ath11k_ops = {
- 	.tx				= ath11k_mac_op_tx,
--	.wake_tx_queue			= ieee80211_handle_wake_tx_queue,
-+	.wake_tx_queue			= ath11k_mac_op_wake_tx_queue,
- 	.start                          = ath11k_mac_op_start,
- 	.stop                           = ath11k_mac_op_stop,
- 	.reconfig_complete              = ath11k_mac_op_reconfig_complete,
-@@ -10274,6 +10330,8 @@ static int __ath11k_mac_register(struct
- 			ieee80211_hw_set(ar->hw, SUPPORTS_MESH_NSS_OFFLOAD);
- 	}
- 
-+	wiphy_ext_feature_set(ar->hw->wiphy, NL80211_EXT_FEATURE_AQL);
-+
- 	ret = ieee80211_register_hw(ar->hw);
- 	if (ret) {
- 		ath11k_err(ar->ab, "ieee80211 registration failed: %d\n", ret);
---- a/drivers/net/wireless/ath/ath11k/mac.h
-+++ b/drivers/net/wireless/ath/ath11k/mac.h
-@@ -174,4 +174,5 @@ int ath11k_mac_wait_tx_complete(struct a
- int ath11k_mac_vif_set_keepalive(struct ath11k_vif *arvif,
- 				 enum wmi_sta_keepalive_method method,
- 				 u32 interval);
-+void ath11k_mac_tx_push_pending(struct ath11k *ar);
- #endif

From c8d42316b79eda0a417a4d7da901c88df8605be7 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Mon, 8 Jul 2024 11:55:50 -0400
Subject: [PATCH 141/225] ath11k_nss: add missing NL80211_ATTR_HE_MUEDCA_PARAMS

Signed-off-by: Sean Khan <datapronix@protonmail.com>

ath11k_nss: fix missing semicolon ';'

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...03-mac80211-ath11k-fw-dynamic-muedca.patch | 36 +++++++++++--------
 .../0600-1-qca-nss-ecm-support-CORE.patch     | 12 +++----
 ...x-IPv6-user-route-change-event-calls.patch | 10 +++---
 ...-1-qca-nss-clients-add-qdisc-support.patch |  8 ++---
 .../0981-1-qca-skb_recycler-support.patch     |  8 ++---
 5 files changed, 41 insertions(+), 33 deletions(-)

diff --git a/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch b/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
index d293a23df69a00..bb7d15fb426238 100644
--- a/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
@@ -158,7 +158,15 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  #undef TRACE_INCLUDE_PATH
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -20211,6 +20211,42 @@ nla_put_failure:
+@@ -812,6 +812,7 @@ static const struct nla_policy nl80211_p
+ 	[NL80211_ATTR_HW_TIMESTAMP_ENABLED] = { .type = NLA_FLAG },
+ 	[NL80211_ATTR_EMA_RNR_ELEMS] = { .type = NLA_NESTED },
+ 	[NL80211_ATTR_MLO_LINK_DISABLED] = { .type = NLA_FLAG },
++	[NL80211_ATTR_HE_MUEDCA_PARAMS] = NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_mu_edca_param_set)),
+ };
+ 
+ /* policy for the key attributes */
+@@ -20211,6 +20212,42 @@ nla_put_failure:
  }
  EXPORT_SYMBOL(cfg80211_update_owe_info_event);
  
@@ -229,19 +237,19 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
 +	),
 +	TP_fast_assign(
 +		WIPHY_ASSIGN;
-+		__entry->mu_qos_info = params->mu_qos_info
-+		__entry->be_aifsn = params->ac_be.aifsn
-+		__entry->be_ecw_min_max = params->ac_be.ecw_min_max
-+		__entry->be_mu_edca_timer = params->ac_be.mu_edca_timer
-+		__entry->bk_aifsn = params->ac_bk.aifsn
-+		__entry->bk_ecw_min_max = params->ac_bk.ecw_min_max
-+		__entry->bk_mu_edca_timer = params->ac_bk.mu_edca_timer
-+		__entry->vi_aifsn = params->ac_vi.aifsn
-+		__entry->vi_ecw_min_max = params->ac_vi.ecw_min_max
-+		__entry->vi_mu_edca_timer = params->ac_vi.mu_edca_timer
-+		__entry->vo_aifsn = params->ac_vo.aifsn
-+		__entry->vo_ecw_min_max = params->ac_vo.ecw_min_max
-+		__entry->vo_mu_edca_timer = params->ac_vo.mu_edca_timer
++		__entry->mu_qos_info = params->mu_qos_info;
++		__entry->be_aifsn = params->ac_be.aifsn;
++		__entry->be_ecw_min_max = params->ac_be.ecw_min_max;
++		__entry->be_mu_edca_timer = params->ac_be.mu_edca_timer;
++		__entry->bk_aifsn = params->ac_bk.aifsn;
++		__entry->bk_ecw_min_max = params->ac_bk.ecw_min_max;
++		__entry->bk_mu_edca_timer = params->ac_bk.mu_edca_timer;
++		__entry->vi_aifsn = params->ac_vi.aifsn;
++		__entry->vi_ecw_min_max = params->ac_vi.ecw_min_max;
++		__entry->vi_mu_edca_timer = params->ac_vi.mu_edca_timer;
++		__entry->vo_aifsn = params->ac_vo.aifsn;
++		__entry->vo_ecw_min_max = params->ac_vo.ecw_min_max;
++		__entry->vo_mu_edca_timer = params->ac_vo.mu_edca_timer;
 +	),
 +	TP_printk(WIPHY_PR_FMT ", MU QOS info: %u", WIPHY_PR_ARG,
 +		  __entry->mu_qos_info)
diff --git a/target/linux/qualcommax/patches-6.6/0600-1-qca-nss-ecm-support-CORE.patch b/target/linux/qualcommax/patches-6.6/0600-1-qca-nss-ecm-support-CORE.patch
index 218e156137b4ff..de641dad8988ec 100644
--- a/target/linux/qualcommax/patches-6.6/0600-1-qca-nss-ecm-support-CORE.patch
+++ b/target/linux/qualcommax/patches-6.6/0600-1-qca-nss-ecm-support-CORE.patch
@@ -663,7 +663,7 @@
  static inline const void *choose_neigh_daddr(const struct in6_addr *p,
  					     struct sk_buff *skb,
  					     const void *daddr)
-@@ -3866,6 +3869,10 @@ int ip6_route_add(struct fib6_config *cf
+@@ -3868,6 +3871,10 @@ int ip6_route_add(struct fib6_config *cf
  		return PTR_ERR(rt);
  
  	err = __ip6_ins_rt(rt, &cfg->fc_nlinfo, extack);
@@ -674,7 +674,7 @@
  	fib6_info_release(rt);
  
  	return err;
-@@ -3887,6 +3894,9 @@ static int __ip6_del_rt(struct fib6_info
+@@ -3889,6 +3896,9 @@ static int __ip6_del_rt(struct fib6_info
  	err = fib6_del(rt, info);
  	spin_unlock_bh(&table->tb6_lock);
  
@@ -684,7 +684,7 @@
  out:
  	fib6_info_release(rt);
  	return err;
-@@ -6334,6 +6344,20 @@ static int ip6_route_dev_notify(struct n
+@@ -6336,6 +6346,20 @@ static int ip6_route_dev_notify(struct n
  	return NOTIFY_OK;
  }
  
@@ -842,7 +842,7 @@
  
 --- a/net/netfilter/nf_conntrack_standalone.c
 +++ b/net/netfilter/nf_conntrack_standalone.c
-@@ -633,6 +633,7 @@ enum nf_ct_sysctl_index {
+@@ -630,6 +630,7 @@ enum nf_ct_sysctl_index {
  #endif
  	NF_SYSCTL_CT_PROTO_TCP_LOOSE,
  	NF_SYSCTL_CT_PROTO_TCP_LIBERAL,
@@ -850,7 +850,7 @@
  	NF_SYSCTL_CT_PROTO_TCP_IGNORE_INVALID_RST,
  	NF_SYSCTL_CT_PROTO_TCP_MAX_RETRANS,
  	NF_SYSCTL_CT_PROTO_TIMEOUT_UDP,
-@@ -840,6 +841,14 @@ static struct ctl_table nf_ct_sysctl_tab
+@@ -834,6 +835,14 @@ static struct ctl_table nf_ct_sysctl_tab
  		.extra1 	= SYSCTL_ZERO,
  		.extra2 	= SYSCTL_ONE,
  	},
@@ -865,7 +865,7 @@
  	[NF_SYSCTL_CT_PROTO_TCP_IGNORE_INVALID_RST] = {
  		.procname	= "nf_conntrack_tcp_ignore_invalid_rst",
  		.maxlen		= sizeof(u8),
-@@ -1050,6 +1059,7 @@ static void nf_conntrack_standalone_init
+@@ -1035,6 +1044,7 @@ static void nf_conntrack_standalone_init
  
  	XASSIGN(LOOSE, &tn->tcp_loose);
  	XASSIGN(LIBERAL, &tn->tcp_be_liberal);
diff --git a/target/linux/qualcommax/patches-6.6/0600-7-qca-nss-ecm-fix-IPv6-user-route-change-event-calls.patch b/target/linux/qualcommax/patches-6.6/0600-7-qca-nss-ecm-fix-IPv6-user-route-change-event-calls.patch
index f37ff6e4f8eb2d..baef78525a3e13 100644
--- a/target/linux/qualcommax/patches-6.6/0600-7-qca-nss-ecm-fix-IPv6-user-route-change-event-calls.patch
+++ b/target/linux/qualcommax/patches-6.6/0600-7-qca-nss-ecm-fix-IPv6-user-route-change-event-calls.patch
@@ -15,7 +15,7 @@ Signed-off-by: Murat Sezgin <msezgin@codeaurora.org>
 
 --- a/net/ipv6/route.c
 +++ b/net/ipv6/route.c
-@@ -3869,10 +3869,6 @@ int ip6_route_add(struct fib6_config *cf
+@@ -3871,10 +3871,6 @@ int ip6_route_add(struct fib6_config *cf
  		return PTR_ERR(rt);
  
  	err = __ip6_ins_rt(rt, &cfg->fc_nlinfo, extack);
@@ -26,7 +26,7 @@ Signed-off-by: Murat Sezgin <msezgin@codeaurora.org>
  	fib6_info_release(rt);
  
  	return err;
-@@ -3894,9 +3890,6 @@ static int __ip6_del_rt(struct fib6_info
+@@ -3896,9 +3892,6 @@ static int __ip6_del_rt(struct fib6_info
  	err = fib6_del(rt, info);
  	spin_unlock_bh(&table->tb6_lock);
  
@@ -36,7 +36,7 @@ Signed-off-by: Murat Sezgin <msezgin@codeaurora.org>
  out:
  	fib6_info_release(rt);
  	return err;
-@@ -4505,6 +4498,10 @@ int ipv6_route_ioctl(struct net *net, un
+@@ -4507,6 +4500,10 @@ int ipv6_route_ioctl(struct net *net, un
  		break;
  	}
  	rtnl_unlock();
@@ -47,7 +47,7 @@ Signed-off-by: Murat Sezgin <msezgin@codeaurora.org>
  	return err;
  }
  
-@@ -5523,11 +5520,17 @@ static int inet6_rtm_delroute(struct sk_
+@@ -5525,11 +5522,17 @@ static int inet6_rtm_delroute(struct sk_
  	}
  
  	if (cfg.fc_mp)
@@ -67,7 +67,7 @@ Signed-off-by: Murat Sezgin <msezgin@codeaurora.org>
  }
  
  static int inet6_rtm_newroute(struct sk_buff *skb, struct nlmsghdr *nlh,
-@@ -5544,9 +5547,15 @@ static int inet6_rtm_newroute(struct sk_
+@@ -5546,9 +5549,15 @@ static int inet6_rtm_newroute(struct sk_
  		cfg.fc_metric = IP6_RT_PRIO_USER;
  
  	if (cfg.fc_mp)
diff --git a/target/linux/qualcommax/patches-6.6/0603-1-qca-nss-clients-add-qdisc-support.patch b/target/linux/qualcommax/patches-6.6/0603-1-qca-nss-clients-add-qdisc-support.patch
index e57786380bf429..156eaf4b240fc7 100644
--- a/target/linux/qualcommax/patches-6.6/0603-1-qca-nss-clients-add-qdisc-support.patch
+++ b/target/linux/qualcommax/patches-6.6/0603-1-qca-nss-clients-add-qdisc-support.patch
@@ -341,7 +341,7 @@
  
  struct Qdisc *qdisc_lookup_rcu(struct net_device *dev, u32 handle)
  {
-@@ -2389,4 +2390,26 @@ static int __init pktsched_init(void)
+@@ -2390,4 +2391,26 @@ static int __init pktsched_init(void)
  	return 0;
  }
  
@@ -370,7 +370,7 @@
  subsys_initcall(pktsched_init);
 --- a/net/sched/sch_generic.c
 +++ b/net/sched/sch_generic.c
-@@ -1069,6 +1069,7 @@ static void __qdisc_destroy(struct Qdisc
+@@ -1073,6 +1073,7 @@ static void __qdisc_destroy(struct Qdisc
  
  	call_rcu(&qdisc->rcu, qdisc_free_cb);
  }
@@ -388,7 +388,7 @@
  	u32			limit;
  	const struct Qdisc_ops	*ops;
  	struct qdisc_size_table	__rcu *stab;
-@@ -751,6 +752,42 @@ static inline bool skb_skip_tc_classify(
+@@ -752,6 +753,42 @@ static inline bool skb_skip_tc_classify(
  	return false;
  }
  
@@ -431,7 +431,7 @@
  /* Reset all TX qdiscs greater than index of a device.  */
  static inline void qdisc_reset_all_tx_gt(struct net_device *dev, unsigned int i)
  {
-@@ -1323,4 +1360,9 @@ static inline void qdisc_synchronize(con
+@@ -1324,4 +1361,9 @@ static inline void qdisc_synchronize(con
  		msleep(1);
  }
  
diff --git a/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch b/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch
index a09ace9b54fb50..33ff213b0dc259 100644
--- a/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch
+++ b/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch
@@ -345,7 +345,7 @@
  	data = kmalloc_reserve(&size, gfp_mask, NUMA_NO_NODE, NULL);
  	if (!data)
  		goto nodata;
-@@ -4869,6 +4957,10 @@ static void skb_extensions_init(void) {}
+@@ -4865,6 +4953,10 @@ static void skb_extensions_init(void) {}
  
  void __init skb_init(void)
  {
@@ -356,7 +356,7 @@
  	skbuff_cache = kmem_cache_create_usercopy("skbuff_head_cache",
  					      sizeof(struct sk_buff),
  					      0,
-@@ -4894,6 +4986,7 @@ void __init skb_init(void)
+@@ -4890,6 +4982,7 @@ void __init skb_init(void)
  						SKB_SMALL_HEAD_HEADROOM,
  						NULL);
  	skb_extensions_init();
@@ -364,7 +364,7 @@
  }
  
  static int
-@@ -6397,6 +6490,8 @@ static int pskb_carve_inside_header(stru
+@@ -6393,6 +6486,8 @@ static int pskb_carve_inside_header(stru
  	if (skb_pfmemalloc(skb))
  		gfp_mask |= __GFP_MEMALLOC;
  
@@ -373,7 +373,7 @@
  	data = kmalloc_reserve(&size, gfp_mask, NUMA_NO_NODE, NULL);
  	if (!data)
  		return -ENOMEM;
-@@ -6513,6 +6608,8 @@ static int pskb_carve_inside_nonlinear(s
+@@ -6509,6 +6604,8 @@ static int pskb_carve_inside_nonlinear(s
  	if (skb_pfmemalloc(skb))
  		gfp_mask |= __GFP_MEMALLOC;
  

From 605cc359ae2151d4223fce5b32c97613bbbabd45 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Mon, 8 Jul 2024 12:06:46 -0400
Subject: [PATCH 142/225] qualcommax: add coherent_pool=2M swiotlb=noforce

Add them for all current qualcommax platforms

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...com-disable-swiotlb-for-64mb-savings.patch | 205 +++++++++++++++++-
 1 file changed, 196 insertions(+), 9 deletions(-)

diff --git a/target/linux/qualcommax/patches-6.6/0982-1-arm64-dts-qcom-disable-swiotlb-for-64mb-savings.patch b/target/linux/qualcommax/patches-6.6/0982-1-arm64-dts-qcom-disable-swiotlb-for-64mb-savings.patch
index c993f6098995ac..ffe31ee712e03c 100644
--- a/target/linux/qualcommax/patches-6.6/0982-1-arm64-dts-qcom-disable-swiotlb-for-64mb-savings.patch
+++ b/target/linux/qualcommax/patches-6.6/0982-1-arm64-dts-qcom-disable-swiotlb-for-64mb-savings.patch
@@ -1,3 +1,5 @@
+diff --git a/arch/arm64/boot/dts/qcom/ipq6010-wax214.dts b/arch/arm64/boot/dts/qcom/ipq6010-wax214.dts
+index 90a4828c17..bb13f6fb4a 100644
 --- a/arch/arm64/boot/dts/qcom/ipq6010-wax214.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq6010-wax214.dts
 @@ -25,7 +25,7 @@
@@ -5,10 +7,25 @@
  	chosen {
  		stdout-path = "serial0:115200n8";
 -		bootargs-append = " root=/dev/ubiblock0_1";
-+		bootargs-append = " coherent_pool=2M swiotlb=noforce root=/dev/ubiblock0_1";
++		bootargs-append = " root=/dev/ubiblock0_1 coherent_pool=2M swiotlb=noforce";
  	};
  
  	keys {
+diff --git a/arch/arm64/boot/dts/qcom/ipq6018-fap650.dts b/arch/arm64/boot/dts/qcom/ipq6018-fap650.dts
+index e9ebcc9063..7420dc75dc 100644
+--- a/arch/arm64/boot/dts/qcom/ipq6018-fap650.dts
++++ b/arch/arm64/boot/dts/qcom/ipq6018-fap650.dts
+@@ -30,7 +30,7 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial0:115200n8";
+-		bootargs-append = " root=/dev/ubiblock0_1";
++		bootargs-append = " root=/dev/ubiblock0_1 coherent_pool=2M swiotlb=noforce";
+ 	};
+ 
+ 	keys {
+diff --git a/arch/arm64/boot/dts/qcom/ipq8070-cax1800.dts b/arch/arm64/boot/dts/qcom/ipq8070-cax1800.dts
+index 4359c3d5b1..8ca6eb6dac 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8070-cax1800.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq8070-cax1800.dts
 @@ -27,7 +27,7 @@
@@ -16,10 +33,12 @@
  	chosen {
  		stdout-path = "serial0:115200n8";
 -		bootargs-append = " root=/dev/ubiblock0_1";
-+		bootargs-append = " coherent_pool=2M swiotlb=noforce root=/dev/ubiblock0_1";
++		bootargs-append = " root=/dev/ubiblock0_1 coherent_pool=2M swiotlb=noforce";
  	};
  
  	keys {
+diff --git a/arch/arm64/boot/dts/qcom/ipq8070-rm2-6.dts b/arch/arm64/boot/dts/qcom/ipq8070-rm2-6.dts
+index 52a9468f99..7ba0bda97c 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8070-rm2-6.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq8070-rm2-6.dts
 @@ -33,7 +33,7 @@
@@ -27,10 +46,12 @@
  	chosen {
  		stdout-path = "serial0:115200n8";
 -		bootargs-append = " root=/dev/ubiblock0_1";
-+		bootargs-append = " coherent_pool=2M swiotlb=noforce root=/dev/ubiblock0_1";
++		bootargs-append = " root=/dev/ubiblock0_1 coherent_pool=2M swiotlb=noforce";
  	};
  
  	keys {
+diff --git a/arch/arm64/boot/dts/qcom/ipq8071-ax3600.dtsi b/arch/arm64/boot/dts/qcom/ipq8071-ax3600.dtsi
+index c2c5f4ce83..f198df9183 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8071-ax3600.dtsi
 +++ b/arch/arm64/boot/dts/qcom/ipq8071-ax3600.dtsi
 @@ -20,7 +20,7 @@
@@ -38,10 +59,25 @@
  	chosen {
  		stdout-path = "serial0:115200n8";
 -		bootargs-append = " root=/dev/ubiblock0_0";
-+		bootargs-append = " coherent_pool=2M swiotlb=noforce root=/dev/ubiblock0_0";
++		bootargs-append = " root=/dev/ubiblock0_0 coherent_pool=2M swiotlb=noforce";
  	};
  
  	keys {
+diff --git a/arch/arm64/boot/dts/qcom/ipq8071-eap102.dts b/arch/arm64/boot/dts/qcom/ipq8071-eap102.dts
+index bcf0285220..760a00fc7f 100644
+--- a/arch/arm64/boot/dts/qcom/ipq8071-eap102.dts
++++ b/arch/arm64/boot/dts/qcom/ipq8071-eap102.dts
+@@ -30,7 +30,7 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial0:115200n8";
+-		bootargs-append = " root=/dev/ubiblock0_1";
++		bootargs-append = " root=/dev/ubiblock0_1 coherent_pool=2M swiotlb=noforce";
+ 	};
+ 
+ 	keys {
+diff --git a/arch/arm64/boot/dts/qcom/ipq8071-mf269.dts b/arch/arm64/boot/dts/qcom/ipq8071-mf269.dts
+index c5b21bd29a..3ff700fe63 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8071-mf269.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq8071-mf269.dts
 @@ -25,7 +25,7 @@
@@ -49,10 +85,25 @@
  	chosen {
  		stdout-path = "serial0:115200n8";
 -		bootargs-append = " root=/dev/ubiblock0_0";
-+		bootargs-append = " coherent_pool=2M swiotlb=noforce root=/dev/ubiblock0_0";
++		bootargs-append = " root=/dev/ubiblock0_0 coherent_pool=2M swiotlb=noforce";
  	};
  
  	keys {
+diff --git a/arch/arm64/boot/dts/qcom/ipq8072-aw1000.dts b/arch/arm64/boot/dts/qcom/ipq8072-aw1000.dts
+index fbad0e79e5..28b5bc3506 100644
+--- a/arch/arm64/boot/dts/qcom/ipq8072-aw1000.dts
++++ b/arch/arm64/boot/dts/qcom/ipq8072-aw1000.dts
+@@ -35,7 +35,7 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial0:115200n8";
+-		bootargs-append = " root=/dev/ubiblock0_1";
++		bootargs-append = " root=/dev/ubiblock0_1 coherent_pool=2M swiotlb=noforce";
+ 	};
+ 
+ 	gpio-export {
+diff --git a/arch/arm64/boot/dts/qcom/ipq8072-ax880.dts b/arch/arm64/boot/dts/qcom/ipq8072-ax880.dts
+index af5a497b39..3510705344 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8072-ax880.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq8072-ax880.dts
 @@ -30,7 +30,7 @@
@@ -60,10 +111,64 @@
  	chosen {
  		stdout-path = "serial0:115200n8";
 -		bootargs-append = " root=/dev/ubiblock0_1";
-+		bootargs-append = " coherent_pool=2M swiotlb=noforce root=/dev/ubiblock0_1";
++		bootargs-append = " root=/dev/ubiblock0_1 coherent_pool=2M swiotlb=noforce";
  	};
  
  	keys {
+diff --git a/arch/arm64/boot/dts/qcom/ipq8072-ax9000.dts b/arch/arm64/boot/dts/qcom/ipq8072-ax9000.dts
+index fe5a136722..b555b9e6d5 100644
+--- a/arch/arm64/boot/dts/qcom/ipq8072-ax9000.dts
++++ b/arch/arm64/boot/dts/qcom/ipq8072-ax9000.dts
+@@ -26,7 +26,7 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial0:115200n8";
+-		bootargs-append = " root=/dev/ubiblock0_0";
++		bootargs-append = " root=/dev/ubiblock0_0 coherent_pool=2M swiotlb=noforce";
+ 	};
+ 
+ 	keys {
+diff --git a/arch/arm64/boot/dts/qcom/ipq8072-dl-wrx36.dts b/arch/arm64/boot/dts/qcom/ipq8072-dl-wrx36.dts
+index 24dd51b47f..8096807d3a 100644
+--- a/arch/arm64/boot/dts/qcom/ipq8072-dl-wrx36.dts
++++ b/arch/arm64/boot/dts/qcom/ipq8072-dl-wrx36.dts
+@@ -32,7 +32,7 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial0:115200n8";
+-		bootargs-append = " root=/dev/ubiblock0_1";
++		bootargs-append = " root=/dev/ubiblock0_1 coherent_pool=2M swiotlb=noforce";
+ 	};
+ 
+ 	keys {
+diff --git a/arch/arm64/boot/dts/qcom/ipq8072-mx5300.dts b/arch/arm64/boot/dts/qcom/ipq8072-mx5300.dts
+index 6e2e95c00a..02106cf753 100644
+--- a/arch/arm64/boot/dts/qcom/ipq8072-mx5300.dts
++++ b/arch/arm64/boot/dts/qcom/ipq8072-mx5300.dts
+@@ -33,7 +33,7 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial0:115200n8";
+-		bootargs-append = " root=/dev/ubiblock0_0 rootfstype=squashfs ro";
++		bootargs-append = " root=/dev/ubiblock0_0 rootfstype=squashfs ro coherent_pool=2M swiotlb=noforce";
+ 	};
+ 
+ 	keys {
+diff --git a/arch/arm64/boot/dts/qcom/ipq8072-mx8500.dts b/arch/arm64/boot/dts/qcom/ipq8072-mx8500.dts
+index a4fcb3e18d..075faf8f12 100644
+--- a/arch/arm64/boot/dts/qcom/ipq8072-mx8500.dts
++++ b/arch/arm64/boot/dts/qcom/ipq8072-mx8500.dts
+@@ -25,7 +25,7 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial0:115200n8";
+-		bootargs-append = " root=/dev/ubiblock0_0 rootfstype=squashfs ro";
++		bootargs-append = " root=/dev/ubiblock0_0 rootfstype=squashfs ro coherent_pool=2M swiotlb=noforce";
+ 	};
+ 
+ 	gpio_export {
+diff --git a/arch/arm64/boot/dts/qcom/ipq8072-wax218.dts b/arch/arm64/boot/dts/qcom/ipq8072-wax218.dts
+index 2c1e0f5e47..2354aff1bb 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8072-wax218.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq8072-wax218.dts
 @@ -27,7 +27,7 @@
@@ -71,10 +176,25 @@
  		 * That fails to create a UBI block device, so add it here.
  		*/
 -		bootargs-append = " ubi.block=0,rootfs root=/dev/ubiblock0_1";
-+		bootargs-append = " coherent_pool=2M swiotlb=noforce ubi.block=0,rootfs root=/dev/ubiblock0_1";
++		bootargs-append = " ubi.block=0,rootfs root=/dev/ubiblock0_1 coherent_pool=2M swiotlb=noforce";
+ 	};
+ 
+ 	keys {
+diff --git a/arch/arm64/boot/dts/qcom/ipq8072-wax620.dts b/arch/arm64/boot/dts/qcom/ipq8072-wax620.dts
+index 5762899889..32b84c7560 100644
+--- a/arch/arm64/boot/dts/qcom/ipq8072-wax620.dts
++++ b/arch/arm64/boot/dts/qcom/ipq8072-wax620.dts
+@@ -30,7 +30,7 @@
+ 		 * Netgear's U-Boot adds "ubi.mtd=rootfs root=mtd:ubi_rootfs"
+ 		 * That fails to create a UBI block device, so add it here.
+ 		*/
+-		bootargs-append = " root=/dev/ubiblock0_1";
++		bootargs-append = " root=/dev/ubiblock0_1 coherent_pool=2M swiotlb=noforce";
  	};
  
  	keys {
+diff --git a/arch/arm64/boot/dts/qcom/ipq8072-wpq873.dts b/arch/arm64/boot/dts/qcom/ipq8072-wpq873.dts
+index ebc68e15a8..d6690d1b66 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8072-wpq873.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq8072-wpq873.dts
 @@ -31,7 +31,7 @@
@@ -82,10 +202,77 @@
  	chosen {
  		stdout-path = "serial0:115200n8";
 -		bootargs-append = " root=/dev/ubiblock0_1";
-+		bootargs-append = " coherent_pool=2M swiotlb=noforce root=/dev/ubiblock0_1";
++		bootargs-append = " root=/dev/ubiblock0_1 coherent_pool=2M swiotlb=noforce";
  	};
  
  	keys {
+diff --git a/arch/arm64/boot/dts/qcom/ipq8072-zbt-z800ax.dts b/arch/arm64/boot/dts/qcom/ipq8072-zbt-z800ax.dts
+index 2398bf9295..99b746245e 100644
+--- a/arch/arm64/boot/dts/qcom/ipq8072-zbt-z800ax.dts
++++ b/arch/arm64/boot/dts/qcom/ipq8072-zbt-z800ax.dts
+@@ -33,7 +33,7 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial0:115200n8";
+-		bootargs-append = " root=/dev/ubiblock0_1";
++		bootargs-append = " root=/dev/ubiblock0_1 coherent_pool=2M swiotlb=noforce";
+ 	};
+ 
+ 	gpio-export {
+diff --git a/arch/arm64/boot/dts/qcom/ipq8074-rax120v2.dts b/arch/arm64/boot/dts/qcom/ipq8074-rax120v2.dts
+index 5331f98587..57e0bde3cb 100644
+--- a/arch/arm64/boot/dts/qcom/ipq8074-rax120v2.dts
++++ b/arch/arm64/boot/dts/qcom/ipq8074-rax120v2.dts
+@@ -25,7 +25,7 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial0:115200n8";
+-		bootargs-append = " ubi.mtd=rootfs root=/dev/ubiblock0_0";
++		bootargs-append = " ubi.mtd=rootfs root=/dev/ubiblock0_0 coherent_pool=2M swiotlb=noforce";
+ 	};
+ 
+ 	keys {
+diff --git a/arch/arm64/boot/dts/qcom/ipq8074-sxk80.dtsi b/arch/arm64/boot/dts/qcom/ipq8074-sxk80.dtsi
+index 7a29f945d5..315472635b 100644
+--- a/arch/arm64/boot/dts/qcom/ipq8074-sxk80.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074-sxk80.dtsi
+@@ -26,7 +26,7 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial0:115200n8";
+-		bootargs-append = " ubi.mtd=rootfs root=/dev/ubiblock0_0";
++		bootargs-append = " ubi.mtd=rootfs root=/dev/ubiblock0_0 coherent_pool=2M swiotlb=noforce";
+ 	};
+ 
+ 	keys {
+diff --git a/arch/arm64/boot/dts/qcom/ipq8074-wax630.dts b/arch/arm64/boot/dts/qcom/ipq8074-wax630.dts
+index d241ae642a..bb400beb0f 100644
+--- a/arch/arm64/boot/dts/qcom/ipq8074-wax630.dts
++++ b/arch/arm64/boot/dts/qcom/ipq8074-wax630.dts
+@@ -29,7 +29,7 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial0:115200n8";
+-		bootargs-append = " root=/dev/ubiblock0_1";
++		bootargs-append = " root=/dev/ubiblock0_1 coherent_pool=2M swiotlb=noforce";
+ 	};
+ 
+ 	keys {
+diff --git a/arch/arm64/boot/dts/qcom/ipq8074-wxr-5950ax12.dts b/arch/arm64/boot/dts/qcom/ipq8074-wxr-5950ax12.dts
+index 5f463b6c62..52d9f9c4e9 100644
+--- a/arch/arm64/boot/dts/qcom/ipq8074-wxr-5950ax12.dts
++++ b/arch/arm64/boot/dts/qcom/ipq8074-wxr-5950ax12.dts
+@@ -25,7 +25,7 @@
+ 
+ 	chosen {
+ 		stdout-path = "serial0:115200n8";
+-		bootargs-append = " ubi.mtd=user_property root=/dev/ubiblock1_0";
++		bootargs-append = " ubi.mtd=user_property root=/dev/ubiblock1_0 coherent_pool=2M swiotlb=noforce";
+ 	};
+ 
+ 	leds {
+diff --git a/arch/arm64/boot/dts/qcom/ipq8174-mx4200.dtsi b/arch/arm64/boot/dts/qcom/ipq8174-mx4200.dtsi
+index 741c00bdcb..a4a379bb4a 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8174-mx4200.dtsi
 +++ b/arch/arm64/boot/dts/qcom/ipq8174-mx4200.dtsi
 @@ -30,7 +30,7 @@
@@ -93,7 +280,7 @@
  	chosen {
  		stdout-path = "serial0:115200n8";
 -		bootargs-append = " root=/dev/ubiblock0_0";
-+		bootargs-append = " coherent_pool=2M swiotlb=noforce root=/dev/ubiblock0_0";
++		bootargs-append = " root=/dev/ubiblock0_0 coherent_pool=2M swiotlb=noforce";
  	};
  
  	keys {

From 44c4f6c030a34224ff01215ecaea9672d20993aa Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Tue, 9 Jul 2024 02:01:55 -0400
Subject: [PATCH 143/225] qualcommax: skbuff_recycle: allow specifiying max
 size

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 target/linux/qualcommax/files/net/core/skbuff_recycle.c | 2 +-
 target/linux/qualcommax/files/net/core/skbuff_recycle.h | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/linux/qualcommax/files/net/core/skbuff_recycle.c b/target/linux/qualcommax/files/net/core/skbuff_recycle.c
index cbcbc46c70d0a5..3f1afcb1981d90 100644
--- a/target/linux/qualcommax/files/net/core/skbuff_recycle.c
+++ b/target/linux/qualcommax/files/net/core/skbuff_recycle.c
@@ -639,7 +639,7 @@ void skb_recycler_print_all_lists(void)
 	preempt_enable();
 }
 
-#ifdef SKB_FAST_RECYCLABLE_DEBUG_ENABLE
+#ifdef CONFIG_SKB_FAST_RECYCLABLE_DEBUG_ENABLE
 /**
  *	consume_skb_can_fast_recycle_debug - Debug API to flag any sanity check
  *      				     failures on a fast recycled skb
diff --git a/target/linux/qualcommax/files/net/core/skbuff_recycle.h b/target/linux/qualcommax/files/net/core/skbuff_recycle.h
index cbbc3ee1f0d6ee..dd4b5b39d2411a 100644
--- a/target/linux/qualcommax/files/net/core/skbuff_recycle.h
+++ b/target/linux/qualcommax/files/net/core/skbuff_recycle.h
@@ -43,7 +43,10 @@
 #include <linux/prefetch.h>
 #include <linux/if.h>
 
-#define SKB_RECYCLE_SIZE	2304
+#ifndef CONFIG_SKB_RECYCLE_SIZE
+#define CONFIG_SKB_RECYCLE_SIZE 2304
+#endif
+#define SKB_RECYCLE_SIZE	CONFIG_SKB_RECYCLE_SIZE
 #define SKB_RECYCLE_MIN_SIZE	SKB_RECYCLE_SIZE
 #define SKB_RECYCLE_MAX_SIZE	SKB_RECYCLE_SIZE
 #define SKB_RECYCLE_MAX_SKBS	1024

From cadec3e20353d803fc746dfa919927febe2b2299 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Tue, 9 Jul 2024 22:43:07 -0400
Subject: [PATCH 144/225] qualcommax: NSS: Enable NSS for Asus RT-AX89X

NSS offload feature enablement for Asus RT-AX89X

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../files/arch/arm64/boot/dts/qcom/ipq8074-rt-ax89x.dts          | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-rt-ax89x.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-rt-ax89x.dts
index 4af942c2892877..694b5aabe1b7b0 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-rt-ax89x.dts
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-rt-ax89x.dts
@@ -6,6 +6,7 @@
 #include "ipq8074.dtsi"
 #include "ipq8074-hk-cpu.dtsi"
 #include "ipq8074-ess.dtsi"
+#include "ipq8074-nss.dtsi"
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/leds/common.h>

From e215a5cb3acdba60a2f1c90d99b1ba8e12761be0 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Wed, 10 Jul 2024 14:25:37 -0400
Subject: [PATCH 145/225] ath11k_nss: Refresh patches

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...07-mac80211-add-nss-redirect-support.patch | 37 ++++++++++---------
 ...N-iftype-support-on-NSS-offload-case.patch |  4 +-
 ...-dynamic-VLAN-support-on-NSS-offload.patch |  2 +-
 .../nss/subsys/245-compilation_fix.patch      | 10 ++---
 .../300-ath11k-nss-mesh-offload-support.patch | 12 +++---
 ...-0005-mac80211-simple-tx-for-AP-mode.patch |  4 +-
 ...mac80211-fix-unconditional-sta-usage.patch |  4 +-
 ...ncapsulation-of-EAPOL-frames-if-OFFL.patch | 26 ++++++-------
 ...se-HW-checksum-offload-only-for-ethm.patch | 12 +++---
 ...1-Add-mac-hw-flag-to-avoid-queue-skb.patch |  6 +--
 10 files changed, 59 insertions(+), 58 deletions(-)

diff --git a/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch b/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
index 55d6b0194f7c04..cfd026aea172cb 100644
--- a/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
@@ -114,21 +114,23 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  /*
   * NOTE: Be very careful when changing this function, it must NOT return
   * an error on interface type changes that have been pre-checked, so most
-@@ -1450,6 +1491,19 @@ int ieee80211_do_open(struct wireless_de
+@@ -1450,6 +1491,21 @@ int ieee80211_do_open(struct wireless_de
  
  	ieee80211_recalc_ps(local);
  
 +#ifdef CPTCFG_MAC80211_NSS_SUPPORT
-+       sdata->nssctx = NULL;
-+       if (nss_redirect) {
-+               sdata->nssctx = nss_virt_if_create_sync(dev);
-+               if (sdata->nssctx) {
-+                       sdata_info(sdata, "Created a NSS virtual interface\n");
-+                       nss_virt_if_register(sdata->nssctx, receive_from_nss, sdata->dev);
-+               } else {
-+                       sdata_info(sdata, "Failed to create a NSS virtual interface\n");
-+               }
-+       }
++	sdata->nssctx = NULL;
++	if (nss_redirect) {
++		sdata->nssctx = nss_virt_if_create_sync(dev);
++		if (sdata->nssctx) {
++			sdata_info(sdata, "Created a NSS virtual interface\n");
++			nss_virt_if_register(sdata->nssctx, receive_from_nss, sdata->dev);
++		} else {
++			sdata_info(
++				sdata,
++				"Failed to create a NSS virtual interface\n");
++		}
++	}
 +#endif
 +
  	set_bit(SDATA_STATE_RUNNING, &sdata->state);
@@ -213,11 +215,10 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -1726,7 +1726,16 @@ static bool ieee80211_tx_frags(struct ie
- 					return true;
+@@ -1727,6 +1727,16 @@ static bool ieee80211_tx_frags(struct ie
  				}
  			} else {
--
+ 
 +#ifdef CPTCFG_MAC80211_NSS_SUPPORT
 +				if (skb_queue_len(&local->pending[q]) >= 1000) {
 +					spin_unlock_irqrestore(
@@ -231,7 +232,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  				/*
  				 * Since queue is stopped, queue up frames for
  				 * later transmission from the tx-pending
-@@ -4504,6 +4513,35 @@ static void ieee80211_mlo_multicast_tx(s
+@@ -4504,6 +4514,35 @@ static void ieee80211_mlo_multicast_tx(s
  	kfree_skb(skb);
  }
  
@@ -267,7 +268,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  /**
   * ieee80211_subif_start_xmit - netif start_xmit function for 802.3 vifs
   * @skb: packet to be sent
-@@ -4517,6 +4555,10 @@ netdev_tx_t ieee80211_subif_start_xmit(s
+@@ -4517,6 +4556,10 @@ netdev_tx_t ieee80211_subif_start_xmit(s
  	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	const struct ethhdr *eth = (void *)skb->data;
  
@@ -278,12 +279,12 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	if (likely(!is_multicast_ether_addr(eth->h_dest)))
  		goto normal;
  
-@@ -4703,6 +4745,9 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4703,6 +4746,9 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  	struct ieee80211_key *key;
  	struct sta_info *sta;
  
 +#ifdef CPTCFG_MAC80211_NSS_SUPPORT
-+       ieee80211_xmit_nss_fixup(skb, dev);
++	ieee80211_xmit_nss_fixup(skb, dev);
 +#endif
  	if (unlikely(!ieee80211_sdata_running(sdata) || skb->len < ETH_HLEN)) {
  		kfree_skb(skb);
diff --git a/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch b/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
index 225cdc45da0f47..d0379441a09848 100644
--- a/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
@@ -137,7 +137,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  {
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4307,8 +4307,11 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4308,8 +4308,11 @@ void __ieee80211_subif_start_xmit(struct
  		sta = NULL;
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
@@ -151,7 +151,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		if (ap_sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED &&
  		    !is_multicast_ether_addr(skb->data)) {
  			if (sta)
-@@ -4698,7 +4701,8 @@ static void ieee80211_8023_xmit(struct i
+@@ -4699,7 +4702,8 @@ static void ieee80211_8023_xmit(struct i
  
  	info->hw_queue = sdata->vif.hw_queue[queue];
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch b/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
index ca0efe70f42fdd..94b731218a7445 100644
--- a/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
@@ -102,7 +102,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	key->conf.cipher = cipher;
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4657,16 +4657,25 @@ static void ieee80211_8023_xmit(struct i
+@@ -4658,16 +4658,25 @@ static void ieee80211_8023_xmit(struct i
  				struct ieee80211_key *key, struct sk_buff *skb)
  {
  	struct ieee80211_tx_info *info;
diff --git a/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch b/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch
index aac819d945b1f7..021fa9826d534a 100644
--- a/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch
@@ -30,7 +30,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	struct ieee80211_local *local;
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4686,19 +4686,21 @@ static void ieee80211_8023_xmit(struct i
+@@ -4687,19 +4687,21 @@ static void ieee80211_8023_xmit(struct i
  
  	ieee80211_aggr_check(sdata, sta, skb);
  
@@ -64,7 +64,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	}
  
  	skb = ieee80211_tx_skb_fixup(skb, ieee80211_sdata_netdev_features(sdata));
-@@ -4755,7 +4757,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4756,7 +4758,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  {
  	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	struct ethhdr *ehdr = (struct ethhdr *)skb->data;
@@ -73,7 +73,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	struct sta_info *sta;
  
  #ifdef CPTCFG_MAC80211_NSS_SUPPORT
-@@ -4773,9 +4775,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4774,9 +4776,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		goto out;
  	}
  
@@ -90,7 +90,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  		goto skip_offload;
  
  	key = rcu_dereference(sta->ptk[sta->ptk_idx]);
-@@ -4786,6 +4792,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4787,6 +4793,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		goto skip_offload;
  
  	sk_pacing_shift_update(skb->sk, sdata->local->hw.tx_sk_pacing_shift);
@@ -98,7 +98,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	ieee80211_8023_xmit(sdata, dev, sta, key, skb);
  	goto out;
  
-@@ -6292,13 +6299,7 @@ start_xmit:
+@@ -6293,13 +6300,7 @@ start_xmit:
  	mutex_lock(&local->mtx);
  
  	local_bh_disable();
diff --git a/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch b/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
index b088fae5341676..27a7cf3bdf48ca 100644
--- a/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
@@ -1173,7 +1173,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  void mesh_pathtbl_unregister(struct ieee80211_sub_if_data *sdata)
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -2619,7 +2619,7 @@ static struct sk_buff *ieee80211_build_h
+@@ -2620,7 +2620,7 @@ static struct sk_buff *ieee80211_build_h
  	bool multicast;
  	u16 info_id = 0;
  	struct ieee80211_chanctx_conf *chanctx_conf = NULL;
@@ -1182,7 +1182,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	int ret;
  	u8 link_id = u32_get_bits(ctrl_flags, IEEE80211_TX_CTRL_MLO_LINK);
  
-@@ -2631,6 +2631,9 @@ static struct sk_buff *ieee80211_build_h
+@@ -2632,6 +2632,9 @@ static struct sk_buff *ieee80211_build_h
  		info_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
  #endif
  
@@ -1192,7 +1192,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	/* convert Ethernet header to proper 802.11 header (based on
  	 * operation mode) */
  	ethertype = (skb->data[12] << 8) | skb->data[13];
-@@ -2701,6 +2704,13 @@ static struct sk_buff *ieee80211_build_h
+@@ -2702,6 +2705,13 @@ static struct sk_buff *ieee80211_build_h
  		break;
  #ifdef CPTCFG_MAC80211_MESH
  	case NL80211_IFTYPE_MESH_POINT:
@@ -1206,7 +1206,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  		if (!is_multicast_ether_addr(skb->data)) {
  			struct sta_info *next_hop;
  			bool mpp_lookup = true;
-@@ -2964,10 +2974,10 @@ static struct sk_buff *ieee80211_build_h
+@@ -2965,10 +2975,10 @@ static struct sk_buff *ieee80211_build_h
  
  	skb_reset_mac_header(skb);
  
@@ -1221,7 +1221,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	info->ack_frame_id = info_id;
  	info->band = band;
  
-@@ -4284,6 +4294,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4285,6 +4295,7 @@ void __ieee80211_subif_start_xmit(struct
  	struct sk_buff *next;
  	int len = skb->len;
  	struct ieee80211_key *key = NULL;
@@ -1229,7 +1229,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	struct ieee80211_sub_if_data *ap_sdata;
  
  	if (unlikely(!ieee80211_sdata_running(sdata) || skb->len < ETH_HLEN)) {
-@@ -4358,9 +4369,15 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4359,9 +4370,15 @@ void __ieee80211_subif_start_xmit(struct
  			goto out;
  		}
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch b/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch
index 56f964d0405882..49145299b20628 100644
--- a/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch
@@ -14,7 +14,7 @@ Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4769,6 +4769,67 @@ out_free:
+@@ -4770,6 +4770,67 @@ out_free:
  	kfree_skb(skb);
  }
  
@@ -82,7 +82,7 @@ Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
  netdev_tx_t ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
  					    struct net_device *dev)
  {
-@@ -4808,6 +4869,11 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4809,6 +4870,11 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  	if (key && (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)))
  		goto skip_offload;
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch b/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch
index 969aa5da5f010c..bbc9a32cf0a720 100644
--- a/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch
@@ -33,7 +33,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4703,7 +4703,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4704,7 +4704,7 @@ static void ieee80211_8023_xmit(struct i
  
  	ieee80211_aggr_check(sdata, sta, skb);
  
@@ -42,7 +42,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  		tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
  		tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
  		if (tid_tx) {
-@@ -4754,7 +4754,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4755,7 +4755,7 @@ static void ieee80211_8023_xmit(struct i
  							     &info->flags, NULL);
  
  	dev_sw_netstats_tx_add(dev, skbs, len);
diff --git a/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch b/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
index bdbe79a6be93e8..e36b1b89c9bfa4 100644
--- a/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
@@ -44,7 +44,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  /* misc utils */
  
  static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
-@@ -4327,7 +4328,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4328,7 +4329,7 @@ void __ieee80211_subif_start_xmit(struct
  		    !is_multicast_ether_addr(skb->data)) {
  			if (sta)
  				key = rcu_dereference(sta->ptk[sta->ptk_idx]);
@@ -53,7 +53,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  			rcu_read_unlock();
  			return;
  		}
-@@ -4373,7 +4374,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4374,7 +4375,7 @@ void __ieee80211_subif_start_xmit(struct
  		if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) {
  		    	if (sta)
  				key = rcu_dereference(sta->ptk[sta->ptk_idx]);
@@ -62,7 +62,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  		} else {
  			dev_sw_netstats_tx_add(dev, 1, skb->len);
  			ieee80211_xmit(sdata, sta, skb);
-@@ -4671,7 +4672,8 @@ static bool ieee80211_tx_8023(struct iee
+@@ -4672,7 +4673,8 @@ static bool ieee80211_tx_8023(struct iee
  
  static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
  				struct net_device *dev, struct sta_info *sta,
@@ -72,7 +72,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  {
  	struct ieee80211_tx_info *info;
  	struct ethhdr *ehdr = (struct ethhdr *)skb->data;
-@@ -4727,6 +4729,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4728,6 +4730,7 @@ static void ieee80211_8023_xmit(struct i
  	info = IEEE80211_SKB_CB(skb);
  	memset(info, 0, sizeof(*info));
  
@@ -80,7 +80,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  	info->hw_queue = sdata->vif.hw_queue[queue];
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
-@@ -4747,11 +4750,12 @@ static void ieee80211_8023_xmit(struct i
+@@ -4748,11 +4751,12 @@ static void ieee80211_8023_xmit(struct i
  			memcpy(IEEE80211_SKB_CB(seg), info, sizeof(*info));
  	}
  
@@ -96,7 +96,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  	dev_sw_netstats_tx_add(dev, skbs, len);
  	if (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD) && sta) {
-@@ -4771,7 +4775,8 @@ out_free:
+@@ -4772,7 +4776,8 @@ out_free:
  
  void ieee80211_8023_xmit_ap(struct ieee80211_sub_if_data *sdata,
  			    struct net_device *dev, struct sta_info *sta,
@@ -106,7 +106,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  {
  	struct ieee80211_tx_info *info;
  	struct ieee80211_local *local = sdata->local;
-@@ -4780,6 +4785,9 @@ void ieee80211_8023_xmit_ap(struct ieee8
+@@ -4781,6 +4786,9 @@ void ieee80211_8023_xmit_ap(struct ieee8
  	unsigned long flags;
  	int q;
  	u16 q_map;
@@ -116,7 +116,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  	/*
  	 * If the skb is shared we need to obtain our own copy.
-@@ -4791,11 +4799,13 @@ void ieee80211_8023_xmit_ap(struct ieee8
+@@ -4792,11 +4800,13 @@ void ieee80211_8023_xmit_ap(struct ieee8
  
  	info = IEEE80211_SKB_CB(skb);
  	memset(info, 0, sizeof(*info));
@@ -133,7 +133,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  	info->flags |= IEEE80211_TX_CTL_HW_80211_ENCAP;
  	info->control.vif = &sdata->vif;
-@@ -4829,14 +4839,23 @@ void ieee80211_8023_xmit_ap(struct ieee8
+@@ -4830,14 +4840,23 @@ void ieee80211_8023_xmit_ap(struct ieee8
  	drv_tx(local, &control, skb);
  
  }
@@ -157,8 +157,8 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
 +	bool is_eapol;
  
  #ifdef CPTCFG_MAC80211_NSS_SUPPORT
-        ieee80211_xmit_nss_fixup(skb, dev);
-@@ -4852,14 +4871,15 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+ 	ieee80211_xmit_nss_fixup(skb, dev);
+@@ -4853,14 +4872,15 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		kfree_skb(skb);
  		goto out;
  	}
@@ -176,7 +176,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  		goto skip_offload;
  
  	key = rcu_dereference(sta->ptk[sta->ptk_idx]);
-@@ -4870,13 +4890,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4871,13 +4891,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		goto skip_offload;
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP) {
@@ -192,7 +192,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  	goto out;
  
  skip_offload:
-@@ -6382,7 +6402,10 @@ start_xmit:
+@@ -6383,7 +6403,10 @@ start_xmit:
  	mutex_lock(&local->mtx);
  
  	local_bh_disable();
diff --git a/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch b/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
index 5b5b45695e965b..4dff812589e263 100644
--- a/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
@@ -31,7 +31,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
  				struct net_device *dev, struct sta_info *sta,
  				struct ieee80211_key *key, struct sk_buff *skb,
-@@ -3641,7 +3643,7 @@ ieee80211_sdata_netdev_features(struct i
+@@ -3642,7 +3644,7 @@ ieee80211_sdata_netdev_features(struct i
  }
  
  static struct sk_buff *
@@ -40,7 +40,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  {
  	if (skb_is_gso(skb)) {
  		struct sk_buff *segs;
-@@ -3659,7 +3661,7 @@ ieee80211_tx_skb_fixup(struct sk_buff *s
+@@ -3660,7 +3662,7 @@ ieee80211_tx_skb_fixup(struct sk_buff *s
  	if (skb_needs_linearize(skb, features) && __skb_linearize(skb))
  		goto free;
  
@@ -49,7 +49,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  		int ofs = skb_checksum_start_offset(skb);
  
  		if (skb->encapsulation)
-@@ -3805,7 +3807,7 @@ static bool ieee80211_xmit_fast(struct i
+@@ -3806,7 +3808,7 @@ static bool ieee80211_xmit_fast(struct i
  	memcpy(&eth, skb->data, ETH_HLEN - 2);
  
  	/* after this point (skb is modified) we cannot return false */
@@ -58,7 +58,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	if (!skb)
  		return true;
  
-@@ -4351,7 +4353,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4352,7 +4354,7 @@ void __ieee80211_subif_start_xmit(struct
  	 * things so we cannot really handle checksum or GSO offload.
  	 * fix it up in software before we handle anything else.
  	 */
@@ -67,7 +67,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	if (!skb) {
  		len = 0;
  		goto out;
-@@ -4722,7 +4724,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4723,7 +4725,7 @@ static void ieee80211_8023_xmit(struct i
  		}
  	}
  
@@ -78,7 +78,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -2267,6 +2267,10 @@ int ieee80211_if_add(struct ieee80211_lo
+@@ -2269,6 +2269,10 @@ int ieee80211_if_add(struct ieee80211_lo
  
  		ndev->features |= local->hw.netdev_features;
  		ndev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
diff --git a/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch b/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
index 6867ee57c399d2..fb422592a0de31 100644
--- a/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
@@ -83,7 +83,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  		return false;
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-@@ -4336,7 +4343,8 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4337,7 +4344,8 @@ void __ieee80211_subif_start_xmit(struct
  		}
  	}
  
@@ -93,7 +93,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	ieee80211_aggr_check(sdata, sta, skb);
  
  	if (sta) {
-@@ -4688,8 +4696,10 @@ static void ieee80211_8023_xmit(struct i
+@@ -4689,8 +4697,10 @@ static void ieee80211_8023_xmit(struct i
  	bool multicast;
  	u8 tid;
  
@@ -106,7 +106,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  
  	multicast = is_multicast_ether_addr(ra);
  
-@@ -6386,9 +6396,12 @@ int ieee80211_tx_control_port(struct wip
+@@ -6387,9 +6397,12 @@ int ieee80211_tx_control_port(struct wip
  	}
  
  	if (!IS_ERR(sta)) {

From f02860f88d636bb1f38fc7e1e39cca46aadaf83f Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Wed, 10 Jul 2024 15:48:47 -0400
Subject: [PATCH 146/225] ath11k_nss: Check for NSS FW 11.4 and build
 accordingly

Some features are not available in NSS firmware 11.4.0.5
* `NSS_WIFI_VDEV_EXT_DATA_PKT_TYPE_4ADDR`

This was introduced in `NHSS.QSDK.11.5`. To avoid unexpected issues,
disable the case check for `NSS_WIFI_VDEV_EXT_DATA_PKT_TYPE_4ADDR` if
`CONFIG_NSS_FIRMWARE_VERSION_11_4` is selected.

Signed-off-by: Sean Khan <datapronix@protonmail.com>

ath11k_nss: rename '*.patch.patch' to '.patch'

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 package/kernel/mac80211/Makefile              |  4 +++
 .../999-312-ath11k-add-fw-11-4-check.patch    | 31 +++++++++++++++++++
 2 files changed, 35 insertions(+)
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/999-312-ath11k-add-fw-11-4-check.patch

diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile
index 9c0833d677948a..b4b364b6930e5c 100644
--- a/package/kernel/mac80211/Makefile
+++ b/package/kernel/mac80211/Makefile
@@ -309,6 +309,10 @@ ifdef CONFIG_ATH11K_NSS_SUPPORT
 	IREMAP_CFLAGS+=-I$(STAGING_DIR)/usr/include/qca-nss-drv -I$(STAGING_DIR)/usr/include/qca-nss-clients
 endif
 
+ifeq ($(CONFIG_NSS_FIRMWARE_VERSION_11_4),y)
+	C_DEFINES+=-DCONFIG_NSS_FIRMWARE_VERSION_11_4
+endif
+
 config-$(CONFIG_PACKAGE_MAC80211_NSS_SUPPORT) += MAC80211_NSS_SUPPORT
 
 MAKE_OPTS:= \
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-312-ath11k-add-fw-11-4-check.patch b/package/kernel/mac80211/patches/nss/ath11k/999-312-ath11k-add-fw-11-4-check.patch
new file mode 100644
index 00000000000000..dd2af5bbf224b8
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-312-ath11k-add-fw-11-4-check.patch
@@ -0,0 +1,31 @@
+--- a/drivers/net/wireless/ath/ath11k/nss.c
++++ b/drivers/net/wireless/ath/ath11k/nss.c
+@@ -818,9 +818,11 @@ ath11k_nss_vdev_special_data_receive(str
+ 	bool eth_decap = false;
+ 	int data_offs = 0;
+ 	int ret = 0;
+-	struct nss_wifi_vdev_addr4_data_metadata *addr4_metadata = NULL;
+ 	struct ath11k_skb_rxcb *rxcb;
++#ifndef CONFIG_NSS_FIRMWARE_VERSION_11_4
++	struct nss_wifi_vdev_addr4_data_metadata *addr4_metadata = NULL;
+ 	struct ath11k_peer *ta_peer = NULL;
++#endif
+ 
+ 	arvif = ath11k_nss_get_arvif_from_dev(dev);
+ 	if (!arvif) {
+@@ -872,6 +874,7 @@ ath11k_nss_vdev_special_data_receive(str
+ 		rxcb->is_mcbc = true;
+ 		ath11k_dp_rx_from_nss(arvif->ar, skb, napi);
+ 	break;
++#ifndef CONFIG_NSS_FIRMWARE_VERSION_11_4
+ 	case NSS_WIFI_VDEV_EXT_DATA_PKT_TYPE_4ADDR:
+ 		if (eth_decap) {
+ 			addr4_metadata = &wifi_metadata->metadata.addr4_metadata;
+@@ -891,6 +894,7 @@ ath11k_nss_vdev_special_data_receive(str
+ 			spin_unlock_bh(&ab->base_lock);
+ 		}
+ 		dev_kfree_skb_any(skb);
++#endif
+ 	break;
+ 	default:
+ 		ath11k_warn(ab, "unsupported pkt_type %d from nss\n", wifi_metadata->pkt_type);

From 2707e8f33c8b1ec38a295a7526ed7aee634d4d29 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 13 Jul 2024 03:03:05 -0400
Subject: [PATCH 147/225] ath11k_nss: Bump version 6.6.15 to 6.9.9

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../199-004-ath10k-fixup-nss-compile.patch    |   4 +-
 .../999-800-ath10k-Add-threaded-napi.patch    |   6 +-
 ...th11k-fix-for-peer-memory-corruption.patch |   4 +-
 .../068-ath11k-add-rx-histogram-stats.patch   |  42 +-
 ...69-ath11k-add-HE-stats-in-peer-stats.patch |  44 +-
 ...080-ath11k-ethernet-rx-decap-offload.patch |   2 +-
 ...dma-counter-always-zero-in-peer-stat.patch |   8 +-
 ...dma-counter-increamenting-improperly.patch |   8 +-
 ...ul-ofdma-ru-allocation-in-peer-stats.patch |  38 +-
 .../113-ath11k-add-8023-undecap-support.patch |   4 +-
 ...-adding-support-for-mgmt-frame-stats.patch |  47 +-
 ...11k-remove-error-on-soc-debugfs-fail.patch |  16 +-
 ...91-ath11k-add-mgmt-and-data-ack-rssi.patch |   4 +-
 ...-ath11k_nss-add-nss-driver-interface.patch |  24 +-
 .../199-003-ath11k-add-nss-support.patch      | 144 +++--
 ...03-mac80211-ath11k-fw-dynamic-muedca.patch |  12 +-
 ...-ath11k-Add-support-for-dynamic-vlan.patch |   6 +-
 ...207-ath11k-Enable-256_512MB-profiles.patch |  83 ++-
 ...-support-on-NSS-offload-for-STA-mode.patch |  24 +-
 ...14-ath11k-qos-null-frame-tx-over-wmi.patch |  50 +-
 ...pport-for-WDS-offload-in-NSS-offload.patch |  40 +-
 ...-dynamic-VLAN-support-in-NSS-offload.patch | 186 +++---
 ...ow-fast-rx-by-bypassing-stats-update.patch |   6 +-
 ...dst-ring-descriptors-from-cacheable-.patch |   6 +-
 ...ow-fast-rx-by-bypassing-stats-update.patch |  34 +-
 .../nss/ath11k/244-ath11k-dp-tx-perf.patch    |  42 +-
 .../300-ath11k-nss-mesh-offload-support.patch |  26 +-
 ...lookup-failure-in-mgmt-tx-completion.patch |  10 +-
 ...30-ath11k-sync-wds_ast_entry-updates.patch |  14 +-
 ...se-DECLARE_BITMAP-for-idr-operations.patch |  10 +-
 ...TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch |   2 +-
 ...ing-rx-stats-with-monitor-vif-enable.patch |   8 +-
 ...1k-skip-status-ring-entry-processing.patch |  12 +-
 ...rt-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch |   2 +-
 ...ccess-of-the-dma-buffer-back-to-dma-.patch |   2 +-
 ...356-ath11k-invalid-desc-sanity-check.patch |   6 +-
 ...-fix-clear-peer-keys-during-disassoc.patch |   4 +-
 ...Fix-ppdu_id-from-firmware-PPDU-stats.patch |   6 +-
 ...Add-retry-mechanism-for-update_rx_qu.patch |  22 +-
 ...ix-mutex-dead-lock-and-q6-dump-crash.patch |   2 +-
 ...agement-frames-to-firmware-before-wa.patch |   2 +-
 ...th11k-Advertise-TX_QUEUE-mac-hw-flag.patch |   2 +-
 ...oid-memset-of-ppdu-info-for-next-skb.patch |   8 +-
 ...a_map_single-to-virt_to_phys-in-rx-r.patch |   4 +-
 ...11k-remove-invalid-peer-create-logic.patch |  58 --
 ...th11k-rename-ath11k_start_vdev_delay.patch |  52 --
 ...ation-of-ath11k_mac_start_vdev_delay.patch | 601 ------------------
 ...ailure-due-to-unexpected-peer-delete.patch | 257 --------
 ...k-make-debugfs-sta-htt-stats-modular.patch |  32 +-
 ...-ath11k-fix-invalid-access-to-memory.patch |   6 +-
 ...11k-Disable-rx_header-tlv-for-2K-SKB.patch |  44 +-
 ...999-336-0001-ath11k-idr-optimization.patch |  10 +-
 .../999-336-0002-ath11k-Use-idr_replace.patch |  40 +-
 ...k-skb_headroom-before-using-skb_push.patch |  24 +-
 ...wifi-ath11k-Fix-BCCA-counter-for-EMA.patch |  20 +-
 .../999-800-ath11k-Add-threaded-napi.patch    |  16 +-
 .../subsys/007-fix_compilation_issue.patch    | 134 ----
 ...-when-using-encapsulation-offloading.patch |   2 +-
 .../199-001-mac80211-add-nss-support.patch    | 106 +--
 ...t-callback-when-hwencap-enable-in-st.patch |   6 +-
 ...03-mac80211-ath11k-fw-dynamic-muedca.patch |  54 +-
 ...-ath11k-Add-support-for-dynamic-vlan.patch |   4 +-
 ...07-mac80211-add-nss-redirect-support.patch |  28 +-
 ...N-iftype-support-on-NSS-offload-case.patch |  44 +-
 ...-dynamic-VLAN-support-on-NSS-offload.patch |  20 +-
 .../nss/subsys/245-compilation_fix.patch      |  16 +-
 .../300-ath11k-nss-mesh-offload-support.patch | 165 +++--
 ...TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch |  10 +-
 ...-0005-mac80211-simple-tx-for-AP-mode.patch |   6 +-
 .../336-mac80211-Mesh-Fast-rx-support.patch   |  26 +-
 ...mac80211-fix-unconditional-sta-usage.patch |   6 +-
 .../345-mac80211-fix-mixed-declaration.patch  |  52 --
 ...change-to-40Mhz-during-channel-switc.patch |  34 -
 ...rning-with-monitor-interface-restart.patch |   2 +-
 ...unused-RX_FLAGS-from-mac80211_rx_fla.patch |  71 ++-
 ...ncapsulation-of-EAPOL-frames-if-OFFL.patch |  46 +-
 ...fix-RCU-stall-in-mesh-fast-xmit-path.patch |   8 +-
 ...id-last_rate-for-rx_bitrate-from-cpu.patch |  10 +-
 ...se-HW-checksum-offload-only-for-ethm.patch |  14 +-
 ...1-Add-mac-hw-flag-to-avoid-queue-skb.patch |  52 +-
 .../829-mac80211-fix-mesh-ping-issue.patch    |   8 +-
 ...x-memory-corruption-during-mesh-beac.patch |   8 +-
 ...ac80211-ath10k-fix-airtime-underflow.patch |   2 +-
 83 files changed, 995 insertions(+), 2125 deletions(-)
 delete mode 100644 package/kernel/mac80211/patches/nss/ath11k/907-01-wifi-ath11k-remove-invalid-peer-create-logic.patch
 delete mode 100644 package/kernel/mac80211/patches/nss/ath11k/907-02-wifi-ath11k-rename-ath11k_start_vdev_delay.patch
 delete mode 100644 package/kernel/mac80211/patches/nss/ath11k/907-03-wifi-ath11k-avoid-forward-declaration-of-ath11k_mac_start_vdev_delay.patch
 delete mode 100644 package/kernel/mac80211/patches/nss/ath11k/907-04-wifi-ath11k-fix-connection-failure-due-to-unexpected-peer-delete.patch
 delete mode 100644 package/kernel/mac80211/patches/nss/subsys/007-fix_compilation_issue.patch
 delete mode 100644 package/kernel/mac80211/patches/nss/subsys/345-mac80211-fix-mixed-declaration.patch
 delete mode 100644 package/kernel/mac80211/patches/nss/subsys/346-mac80211-fix-bw-change-to-40Mhz-during-channel-switc.patch

diff --git a/package/kernel/mac80211/patches/nss/ath10k/199-004-ath10k-fixup-nss-compile.patch b/package/kernel/mac80211/patches/nss/ath10k/199-004-ath10k-fixup-nss-compile.patch
index d413514144f161..5e8c5f08ad99ee 100644
--- a/package/kernel/mac80211/patches/nss/ath10k/199-004-ath10k-fixup-nss-compile.patch
+++ b/package/kernel/mac80211/patches/nss/ath10k/199-004-ath10k-fixup-nss-compile.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -5530,7 +5530,7 @@ static int ath10k_mac_set_txbf_conf(stru
+@@ -5527,7 +5527,7 @@ static int ath10k_mac_set_txbf_conf(stru
  					 ar->wmi.vdev_param->txbf, value);
  }
  
@@ -9,7 +9,7 @@
  				      struct ieee80211_vif *vif)
  {
  	struct ath10k_vif *arvif = (void *)vif->drv_priv;
-@@ -5552,6 +5552,7 @@ static void ath10k_update_vif_offload(st
+@@ -5549,6 +5549,7 @@ static void ath10k_update_vif_offload(st
  		ath10k_warn(ar, "failed to set vdev %i TX encapsulation: %d\n",
  			    arvif->vdev_id, ret);
  	}
diff --git a/package/kernel/mac80211/patches/nss/ath10k/999-800-ath10k-Add-threaded-napi.patch b/package/kernel/mac80211/patches/nss/ath10k/999-800-ath10k-Add-threaded-napi.patch
index 98fe4b1ee90aa5..4293e2ccfdfc13 100644
--- a/package/kernel/mac80211/patches/nss/ath10k/999-800-ath10k-Add-threaded-napi.patch
+++ b/package/kernel/mac80211/patches/nss/ath10k/999-800-ath10k-Add-threaded-napi.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath10k/pci.c
 +++ b/drivers/net/wireless/ath/ath10k/pci.c
-@@ -1974,6 +1974,7 @@ static int ath10k_pci_hif_start(struct a
+@@ -1975,6 +1975,7 @@ static int ath10k_pci_hif_start(struct a
  
  	ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot hif start\n");
  
@@ -10,7 +10,7 @@
  	ath10k_pci_irq_enable(ar);
 --- a/drivers/net/wireless/ath/ath10k/sdio.c
 +++ b/drivers/net/wireless/ath/ath10k/sdio.c
-@@ -1862,6 +1862,7 @@ static int ath10k_sdio_hif_start(struct
+@@ -1863,6 +1863,7 @@ static int ath10k_sdio_hif_start(struct
  	struct ath10k_sdio *ar_sdio = ath10k_sdio_priv(ar);
  	int ret;
  
@@ -20,7 +20,7 @@
  	/* Sleep 20 ms before HIF interrupts are disabled.
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -3702,6 +3702,9 @@ struct ath10k *ath10k_core_create(size_t
+@@ -3722,6 +3722,9 @@ struct ath10k *ath10k_core_create(size_t
  		  ath10k_core_set_coverage_class_work);
  
  	init_dummy_netdev(&ar->napi_dev);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/033-ath11k-fix-for-peer-memory-corruption.patch b/package/kernel/mac80211/patches/nss/ath11k/033-ath11k-fix-for-peer-memory-corruption.patch
index 5c9c723913b09a..a537d85cd1e0ef 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/033-ath11k-fix-for-peer-memory-corruption.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/033-ath11k-fix-for-peer-memory-corruption.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -4178,22 +4178,28 @@ static int ath11k_clear_peer_keys(struct
+@@ -4186,22 +4186,28 @@ static int ath11k_clear_peer_keys(struct
  	int ret;
  	int i;
  	u32 flags = 0;
@@ -35,7 +35,7 @@
  					 DISABLE_KEY, addr, flags);
  		if (ret < 0 && first_errno == 0)
  			first_errno = ret;
-@@ -4201,10 +4207,6 @@ static int ath11k_clear_peer_keys(struct
+@@ -4209,10 +4215,6 @@ static int ath11k_clear_peer_keys(struct
  		if (ret < 0)
  			ath11k_warn(ab, "failed to remove peer key %d: %d\n",
  				    i, ret);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/068-ath11k-add-rx-histogram-stats.patch b/package/kernel/mac80211/patches/nss/ath11k/068-ath11k-add-rx-histogram-stats.patch
index e4ac1ee17b0b2e..646cd697750ee5 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/068-ath11k-add-rx-histogram-stats.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/068-ath11k-add-rx-histogram-stats.patch
@@ -20,7 +20,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -41,6 +41,8 @@
+@@ -44,6 +44,8 @@
  
  #define ATH11K_INVALID_HW_MAC_ID	0xFF
  #define ATH11K_CONNECTION_LOSS_HZ	(3 * HZ)
@@ -29,7 +29,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  
  /* SMBIOS type containing Board Data File Name Extension */
  #define ATH11K_SMBIOS_BDF_EXT_TYPE 0xF8
-@@ -376,6 +378,17 @@ struct ath11k_vif_iter {
+@@ -415,6 +417,17 @@ struct ath11k_vif_iter {
  	struct ath11k_vif *arvif;
  };
  
@@ -47,7 +47,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  struct ath11k_rx_peer_stats {
  	u64 num_msdu;
  	u64 num_mpdu_fcs_ok;
-@@ -387,10 +400,6 @@ struct ath11k_rx_peer_stats {
+@@ -426,10 +439,6 @@ struct ath11k_rx_peer_stats {
  	u64 non_ampdu_msdu_count;
  	u64 stbc_count;
  	u64 beamformed_count;
@@ -58,7 +58,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  	u64 coding_count[HAL_RX_SU_MU_CODING_MAX];
  	u64 tid_count[IEEE80211_NUM_TIDS + 1];
  	u64 pream_cnt[HAL_RX_PREAMBLE_MAX];
-@@ -398,6 +407,8 @@ struct ath11k_rx_peer_stats {
+@@ -437,6 +446,8 @@ struct ath11k_rx_peer_stats {
  	u64 rx_duration;
  	u64 dcm_count;
  	u64 ru_alloc_cnt[HAL_RX_RU_ALLOC_TYPE_MAX];
@@ -69,7 +69,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  #define ATH11K_HE_MCS_NUM       12
 --- a/drivers/net/wireless/ath/ath11k/debugfs_sta.c
 +++ b/drivers/net/wireless/ath/ath11k/debugfs_sta.c
-@@ -10,6 +10,7 @@
+@@ -11,6 +11,7 @@
  #include "peer.h"
  #include "debug.h"
  #include "dp_tx.h"
@@ -77,7 +77,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  #include "debugfs_htt_stats.h"
  
  void ath11k_debugfs_sta_add_tx_stats(struct ath11k_sta *arsta,
-@@ -247,8 +248,14 @@ static ssize_t ath11k_dbg_sta_dump_rx_st
+@@ -248,8 +249,14 @@ static ssize_t ath11k_dbg_sta_dump_rx_st
  	struct ath11k *ar = arsta->arvif->ar;
  	struct ath11k_rx_peer_stats *rx_stats = arsta->rx_stats;
  	int len = 0, i, retval = 0;
@@ -93,7 +93,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  
  	if (!rx_stats)
  		return -ENOENT;
-@@ -279,14 +286,6 @@ static ssize_t ath11k_dbg_sta_dump_rx_st
+@@ -280,14 +287,6 @@ static ssize_t ath11k_dbg_sta_dump_rx_st
  			 rx_stats->num_mpdu_fcs_ok);
  	len += scnprintf(buf + len, size - len, "Num of MPDUs with FCS error: %llu\n",
  			 rx_stats->num_mpdu_fcs_err);
@@ -108,7 +108,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  	len += scnprintf(buf + len, size - len, "BCC %llu LDPC %llu\n",
  			 rx_stats->coding_count[0], rx_stats->coding_count[1]);
  	len += scnprintf(buf + len, size - len,
-@@ -301,14 +300,96 @@ static ssize_t ath11k_dbg_sta_dump_rx_st
+@@ -302,14 +301,96 @@ static ssize_t ath11k_dbg_sta_dump_rx_st
  	len += scnprintf(buf + len, size - len, "TID(0-15) Legacy TID(16):");
  	for (i = 0; i <= IEEE80211_NUM_TIDS; i++)
  		len += scnprintf(buf + len, size - len, "%llu ", rx_stats->tid_count[i]);
@@ -212,7 +212,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  	len += scnprintf(buf + len, size - len,
  			 "\nDCM: %llu\nRU: 26 %llu 52: %llu 106: %llu 242: %llu 484: %llu 996: %llu\n",
  			 rx_stats->dcm_count, rx_stats->ru_alloc_cnt[0],
-@@ -847,6 +928,40 @@ static const struct file_operations fops
+@@ -848,6 +929,40 @@ static const struct file_operations fops
  	.llseek = default_llseek,
  };
  
@@ -253,7 +253,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  void ath11k_debugfs_sta_op_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			       struct ieee80211_sta *sta, struct dentry *dir)
  {
-@@ -855,9 +970,12 @@ void ath11k_debugfs_sta_op_add(struct ie
+@@ -856,9 +971,12 @@ void ath11k_debugfs_sta_op_add(struct ie
  	if (ath11k_debugfs_is_extd_tx_stats_enabled(ar))
  		debugfs_create_file("tx_stats", 0400, dir, sta,
  				    &fops_tx_stats);
@@ -269,7 +269,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  			    &fops_htt_peer_stats);
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -2762,10 +2762,43 @@ exit:
+@@ -2763,10 +2763,43 @@ exit:
  	return total_msdu_reaped;
  }
  
@@ -313,7 +313,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  	u32 num_msdu;
  	int i;
  
-@@ -2775,6 +2808,8 @@ static void ath11k_dp_rx_update_peer_sta
+@@ -2776,6 +2809,8 @@ static void ath11k_dp_rx_update_peer_sta
  	arsta->rssi_comb = ppdu_info->rssi_comb;
  	ewma_avg_rssi_add(&arsta->avg_rssi, ppdu_info->rssi_comb);
  
@@ -322,7 +322,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  	num_msdu = ppdu_info->tcp_msdu_count + ppdu_info->tcp_ack_msdu_count +
  		   ppdu_info->udp_msdu_count + ppdu_info->other_msdu_count;
  
-@@ -2791,18 +2826,6 @@ static void ath11k_dp_rx_update_peer_sta
+@@ -2792,18 +2827,6 @@ static void ath11k_dp_rx_update_peer_sta
  		ppdu_info->tid = IEEE80211_NUM_TIDS;
  	}
  
@@ -341,7 +341,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  	if (ppdu_info->ldpc < HAL_RX_SU_MU_CODING_MAX)
  		rx_stats->coding_count[ppdu_info->ldpc] += num_msdu;
  
-@@ -2831,8 +2854,6 @@ static void ath11k_dp_rx_update_peer_sta
+@@ -2832,8 +2855,6 @@ static void ath11k_dp_rx_update_peer_sta
  	rx_stats->dcm_count += ppdu_info->dcm;
  	rx_stats->ru_alloc_cnt[ppdu_info->ru_alloc] += num_msdu;
  
@@ -350,7 +350,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  	BUILD_BUG_ON(ARRAY_SIZE(arsta->chain_signal) >
  			     ARRAY_SIZE(ppdu_info->rssi_chain_pri20));
  
-@@ -2841,6 +2862,52 @@ static void ath11k_dp_rx_update_peer_sta
+@@ -2842,6 +2863,52 @@ static void ath11k_dp_rx_update_peer_sta
  
  	rx_stats->rx_duration += ppdu_info->rx_duration;
  	arsta->rx_duration = rx_stats->rx_duration;
@@ -433,7 +433,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  int ath11k_dp_rx_ampdu_stop(struct ath11k *ar,
 --- a/drivers/net/wireless/ath/ath11k/hal_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/hal_rx.c
-@@ -975,44 +975,78 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+@@ -976,44 +976,78 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
  		ppdu_info->is_stbc = FIELD_GET(HAL_RX_HT_SIG_INFO_INFO1_STBC,
  					       info1);
  		ppdu_info->ldpc = FIELD_GET(HAL_RX_HT_SIG_INFO_INFO1_FEC_CODING, info1);
@@ -536,7 +536,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  		ppdu_info->reception_type = HAL_RX_RECEPTION_TYPE_SU;
  		break;
  	}
-@@ -1470,6 +1504,9 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+@@ -1471,6 +1505,9 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
  		peer_id = ath11k_hal_rx_mpduinfo_get_peerid(ab, mpdu_info);
  		if (peer_id)
  			ppdu_info->peer_id = peer_id;
@@ -548,7 +548,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  	case HAL_RXPCU_PPDU_END_INFO: {
 --- a/drivers/net/wireless/ath/ath11k/hal_rx.h
 +++ b/drivers/net/wireless/ath/ath11k/hal_rx.h
-@@ -19,7 +19,11 @@ struct hal_rx_wbm_rel_info {
+@@ -20,7 +20,11 @@ struct hal_rx_wbm_rel_info {
  #define VHT_SIG_SU_NSS_MASK 0x7
  
  #define HAL_RX_MAX_MCS 12
@@ -560,7 +560,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  
  struct hal_rx_mon_status_tlv_hdr {
  	u32 hdr;
-@@ -103,6 +107,22 @@ struct hal_rx_user_status {
+@@ -104,6 +108,22 @@ struct hal_rx_user_status {
  	u32 mpdu_err_byte_count;
  };
  
@@ -583,7 +583,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  #define HAL_TLV_STATUS_PPDU_NOT_DONE    HAL_RX_MON_STATUS_PPDU_NOT_DONE
  #define HAL_TLV_STATUS_PPDU_DONE        HAL_RX_MON_STATUS_PPDU_DONE
  #define HAL_TLV_STATUS_BUF_DONE         HAL_RX_MON_STATUS_BUF_DONE
-@@ -127,6 +147,7 @@ struct hal_rx_mon_ppdu_info {
+@@ -128,6 +148,7 @@ struct hal_rx_mon_ppdu_info {
  	u32 num_mpdu_fcs_ok;
  	u32 num_mpdu_fcs_err;
  	u32 preamble_type;
@@ -661,7 +661,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  #define ATH11K_TX_RING_MASK_0 BIT(0)
 --- a/drivers/net/wireless/ath/ath11k/hw.h
 +++ b/drivers/net/wireless/ath/ath11k/hw.h
-@@ -269,6 +269,7 @@ struct ath11k_hw_ops {
+@@ -270,6 +270,7 @@ struct ath11k_hw_ops {
  	bool (*rx_desc_mac_addr2_valid)(struct hal_rx_desc *desc);
  	u8* (*rx_desc_mpdu_start_addr2)(struct hal_rx_desc *desc);
  	u32 (*get_ring_selector)(struct sk_buff *skb);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/069-ath11k-add-HE-stats-in-peer-stats.patch b/package/kernel/mac80211/patches/nss/ath11k/069-ath11k-add-HE-stats-in-peer-stats.patch
index 5c29297c3363f8..13c87a0470c9a6 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/069-ath11k-add-HE-stats-in-peer-stats.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/069-ath11k-add-HE-stats-in-peer-stats.patch
@@ -15,15 +15,15 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -29,6 +29,7 @@
+@@ -31,6 +31,7 @@
  #include "dbring.h"
  #include "spectral.h"
  #include "wow.h"
 +#include "rx_desc.h"
+ #include "fw.h"
  
  #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
- 
-@@ -469,6 +470,8 @@ struct ath11k_htt_data_stats {
+@@ -508,6 +509,8 @@ struct ath11k_htt_data_stats {
  	u64 bw[ATH11K_COUNTER_TYPE_MAX][ATH11K_BW_NUM];
  	u64 nss[ATH11K_COUNTER_TYPE_MAX][ATH11K_NSS_NUM];
  	u64 gi[ATH11K_COUNTER_TYPE_MAX][ATH11K_GI_NUM];
@@ -32,7 +32,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  };
  
  struct ath11k_htt_tx_stats {
-@@ -476,6 +479,9 @@ struct ath11k_htt_tx_stats {
+@@ -515,6 +518,9 @@ struct ath11k_htt_tx_stats {
  	u64 tx_duration;
  	u64 ba_fails;
  	u64 ack_fails;
@@ -42,7 +42,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  };
  
  struct ath11k_per_ppdu_tx_stats {
-@@ -592,11 +598,16 @@ struct ath11k_per_peer_tx_stats {
+@@ -631,11 +637,16 @@ struct ath11k_per_peer_tx_stats {
  	u32 succ_bytes;
  	u32 retry_bytes;
  	u32 failed_bytes;
@@ -62,7 +62,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  
 --- a/drivers/net/wireless/ath/ath11k/debugfs_sta.c
 +++ b/drivers/net/wireless/ath/ath11k/debugfs_sta.c
-@@ -13,13 +13,39 @@
+@@ -14,13 +14,39 @@
  #include "dp_rx.h"
  #include "debugfs_htt_stats.h"
  
@@ -103,7 +103,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  
  	if (!arsta->tx_stats)
  		return;
-@@ -64,6 +90,43 @@ void ath11k_debugfs_sta_add_tx_stats(str
+@@ -65,6 +91,43 @@ void ath11k_debugfs_sta_add_tx_stats(str
  		STATS_OP_FMT(RETRY).legacy[1][mcs] += peer_stats->retry_pkts;
  	}
  
@@ -147,7 +147,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  	if (peer_stats->is_ampdu) {
  		tx_stats->ba_fails += peer_stats->ba_fails;
  
-@@ -124,6 +187,17 @@ void ath11k_debugfs_sta_add_tx_stats(str
+@@ -125,6 +188,17 @@ void ath11k_debugfs_sta_add_tx_stats(str
  	STATS_OP_FMT(RETRY).gi[1][gi] += peer_stats->retry_pkts;
  
  	tx_stats->tx_duration += peer_stats->duration;
@@ -165,7 +165,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  }
  
  void ath11k_debugfs_sta_update_txcompl(struct ath11k *ar,
-@@ -140,12 +214,13 @@ static ssize_t ath11k_dbg_sta_dump_tx_st
+@@ -141,12 +215,13 @@ static ssize_t ath11k_dbg_sta_dump_tx_st
  	struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);
  	struct ath11k *ar = arsta->arvif->ar;
  	struct ath11k_htt_data_stats *stats;
@@ -181,7 +181,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  
  	if (!arsta->tx_stats)
  		return -ENOENT;
-@@ -163,45 +238,46 @@ static ssize_t ath11k_dbg_sta_dump_tx_st
+@@ -164,45 +239,46 @@ static ssize_t ath11k_dbg_sta_dump_tx_st
  			len += scnprintf(buf + len, size - len, "%s_%s\n",
  					 str_name[k],
  					 str[j]);
@@ -237,7 +237,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  					 stats->gi[j][0], stats->gi[j][1],
  					 stats->gi[j][2], stats->gi[j][3]);
  			len += scnprintf(buf + len, size - len,
-@@ -210,10 +286,68 @@ static ssize_t ath11k_dbg_sta_dump_tx_st
+@@ -211,10 +287,68 @@ static ssize_t ath11k_dbg_sta_dump_tx_st
  			for (i = 0; i < ATH11K_LEGACY_NUM; i++)
  				len += scnprintf(buf + len, size - len, "%llu ",
  						 stats->legacy[j][i]);
@@ -307,7 +307,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  	len += scnprintf(buf + len, size - len,
  			 "\nTX duration\n %llu usecs\n",
  			 arsta->tx_stats->tx_duration);
-@@ -221,6 +355,7 @@ static ssize_t ath11k_dbg_sta_dump_tx_st
+@@ -222,6 +356,7 @@ static ssize_t ath11k_dbg_sta_dump_tx_st
  			"BA fails\n %llu\n", arsta->tx_stats->ba_fails);
  	len += scnprintf(buf + len, size - len,
  			"ack fails\n %llu\n", arsta->tx_stats->ack_fails);
@@ -447,7 +447,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  };
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -1252,9 +1252,10 @@ static int ath11k_htt_tlv_ppdu_stats_par
+@@ -1253,9 +1253,10 @@ static int ath11k_htt_tlv_ppdu_stats_par
  					   void *data)
  {
  	struct htt_ppdu_stats_info *ppdu_info;
@@ -459,7 +459,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  
  	ppdu_info = data;
  
-@@ -1267,6 +1268,26 @@ static int ath11k_htt_tlv_ppdu_stats_par
+@@ -1268,6 +1269,26 @@ static int ath11k_htt_tlv_ppdu_stats_par
  		}
  		memcpy((void *)&ppdu_info->ppdu_stats.common, ptr,
  		       sizeof(struct htt_ppdu_stats_common));
@@ -486,7 +486,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  		break;
  	case HTT_PPDU_STATS_TAG_USR_RATE:
  		if (len < sizeof(struct htt_ppdu_stats_user_rate)) {
-@@ -1299,6 +1320,7 @@ static int ath11k_htt_tlv_ppdu_stats_par
+@@ -1300,6 +1321,7 @@ static int ath11k_htt_tlv_ppdu_stats_par
  						      peer_id);
  		if (cur_user < 0)
  			return -EINVAL;
@@ -494,7 +494,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  		user_stats = &ppdu_info->ppdu_stats.user_stats[cur_user];
  		user_stats->peer_id = peer_id;
  		user_stats->is_valid_peer_id = true;
-@@ -1327,44 +1349,30 @@ static int ath11k_htt_tlv_ppdu_stats_par
+@@ -1328,44 +1350,30 @@ static int ath11k_htt_tlv_ppdu_stats_par
  		       sizeof(struct htt_ppdu_stats_usr_cmpltn_ack_ba_status));
  		user_stats->tlv_flags |= BIT(tag);
  		break;
@@ -559,7 +559,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  	return 0;
  }
  
-@@ -1382,8 +1390,8 @@ ath11k_update_per_peer_tx_stats(struct a
+@@ -1383,8 +1391,8 @@ ath11k_update_per_peer_tx_stats(struct a
  	struct htt_ppdu_stats_common *common = &ppdu_stats->common;
  	int ret;
  	u8 flags, mcs, nss, bw, sgi, dcm, rate_idx = 0;
@@ -570,7 +570,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  	u32 tx_duration = 0;
  	u8 tid = HTT_PPDU_STATS_NON_QOS_TID;
  	bool is_ampdu = false;
-@@ -1414,6 +1422,11 @@ ath11k_update_per_peer_tx_stats(struct a
+@@ -1415,6 +1423,11 @@ ath11k_update_per_peer_tx_stats(struct a
  	mcs = HTT_USR_RATE_MCS(user_rate->rate_flags);
  	sgi = HTT_USR_RATE_GI(user_rate->rate_flags);
  	dcm = HTT_USR_RATE_DCM(user_rate->rate_flags);
@@ -582,7 +582,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  
  	/* Note: If host configured fixed rates and in some other special
  	 * cases, the broadcast/management frames are sent in different rates.
-@@ -1508,6 +1521,12 @@ ath11k_update_per_peer_tx_stats(struct a
+@@ -1509,6 +1522,12 @@ ath11k_update_per_peer_tx_stats(struct a
  		peer_stats->ba_fails =
  			HTT_USR_CMPLTN_LONG_RETRY(usr_stats->cmpltn_cmn.flags) +
  			HTT_USR_CMPLTN_SHORT_RETRY(usr_stats->cmpltn_cmn.flags);
@@ -595,7 +595,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  
  		if (ath11k_debugfs_is_extd_tx_stats_enabled(ar))
  			ath11k_debugfs_sta_add_tx_stats(arsta, peer_stats, rate_idx);
-@@ -1560,13 +1579,89 @@ struct htt_ppdu_stats_info *ath11k_dp_ht
+@@ -1561,13 +1580,89 @@ struct htt_ppdu_stats_info *ath11k_dp_ht
  	return ppdu_info;
  }
  
@@ -686,7 +686,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  	u8 pdev_id;
  	u32 ppdu_id, len;
  
-@@ -1601,6 +1696,47 @@ static int ath11k_htt_pull_ppdu_stats(st
+@@ -1602,6 +1697,47 @@ static int ath11k_htt_pull_ppdu_stats(st
  		goto out_unlock_data;
  	}
  
@@ -736,7 +736,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  
 --- a/drivers/net/wireless/ath/ath11k/rx_desc.h
 +++ b/drivers/net/wireless/ath/ath11k/rx_desc.h
-@@ -1494,6 +1494,11 @@ struct hal_rx_desc {
+@@ -1495,6 +1495,11 @@ struct hal_rx_desc {
  	} u;
  } __packed;
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/080-ath11k-ethernet-rx-decap-offload.patch b/package/kernel/mac80211/patches/nss/ath11k/080-ath11k-ethernet-rx-decap-offload.patch
index 3334ef52f8ec78..6e50b3d99b9696 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/080-ath11k-ethernet-rx-decap-offload.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/080-ath11k-ethernet-rx-decap-offload.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
-@@ -27,10 +27,10 @@ module_param_named(crypto_mode, ath11k_c
+@@ -28,10 +28,10 @@ module_param_named(crypto_mode, ath11k_c
  MODULE_PARM_DESC(crypto_mode, "crypto mode: 0-hardware, 1-software");
  
  /* frame mode values are mapped as per enum ath11k_hw_txrx_mode */
diff --git a/package/kernel/mac80211/patches/nss/ath11k/084-ath11k-fix-ul-ofdma-counter-always-zero-in-peer-stat.patch b/package/kernel/mac80211/patches/nss/ath11k/084-ath11k-fix-ul-ofdma-counter-always-zero-in-peer-stat.patch
index b46a32c09210ea..0de45a755239a3 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/084-ath11k-fix-ul-ofdma-counter-always-zero-in-peer-stat.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/084-ath11k-fix-ul-ofdma-counter-always-zero-in-peer-stat.patch
@@ -15,7 +15,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/debugfs_sta.c
 +++ b/drivers/net/wireless/ath/ath11k/debugfs_sta.c
-@@ -525,13 +525,6 @@ static ssize_t ath11k_dbg_sta_dump_rx_st
+@@ -526,13 +526,6 @@ static ssize_t ath11k_dbg_sta_dump_rx_st
  				rx_stats->byte_stats.rx_rate[i],
  				(i + 1) % (he_rates_avail ? 12 : 8) ? "\t" : "\n");
  
@@ -31,7 +31,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  	spin_unlock_bh(&ar->ab->base_lock);
 --- a/drivers/net/wireless/ath/ath11k/hal_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/hal_rx.c
-@@ -1478,6 +1478,7 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+@@ -1479,6 +1479,7 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
  				       ab->wmi_ab.svc_map);
  		struct hal_rx_phyrx_rssi_legacy_info *rssi =
  			(struct hal_rx_phyrx_rssi_legacy_info *)tlv_data;
@@ -39,7 +39,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  
  		/* TODO: Please note that the combined rssi will not be accurate
  		 * in MU case. Rssi in MU needs to be retrieved from
-@@ -1487,6 +1488,22 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+@@ -1488,6 +1489,22 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
  			FIELD_GET(HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RSSI_COMB,
  				  __le32_to_cpu(rssi->info0));
  
@@ -64,7 +64,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  				ppdu_info->rssi_chain_pri20[i] =
 --- a/drivers/net/wireless/ath/ath11k/hal_rx.h
 +++ b/drivers/net/wireless/ath/ath11k/hal_rx.h
-@@ -414,6 +414,15 @@ struct hal_rx_he_sig_b2_ofdma_info {
+@@ -415,6 +415,15 @@ struct hal_rx_he_sig_b2_ofdma_info {
  
  #define HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RSSI_COMB	GENMASK(15, 8)
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/087-ath11k-fix-ul-ofdma-counter-increamenting-improperly.patch b/package/kernel/mac80211/patches/nss/ath11k/087-ath11k-fix-ul-ofdma-counter-increamenting-improperly.patch
index 52e2509b796c3d..706082dc5119e4 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/087-ath11k-fix-ul-ofdma-counter-increamenting-improperly.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/087-ath11k-fix-ul-ofdma-counter-increamenting-improperly.patch
@@ -5,7 +5,7 @@
 
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -5451,8 +5451,11 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -5452,8 +5452,11 @@ int ath11k_dp_rx_process_mon_status(stru
  			goto next_skb;
  		}
  
@@ -21,7 +21,7 @@
  			trace_ath11k_htt_rxdesc(ar, skb->data, log_type, rx_buf_sz);
 --- a/drivers/net/wireless/ath/ath11k/hal_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/hal_rx.c
-@@ -900,6 +900,9 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+@@ -901,6 +901,9 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
  		ppdu_info->ast_index =
  			FIELD_GET(HAL_RX_PPDU_END_USER_STATS_INFO2_AST_INDEX,
  				  __le32_to_cpu(eu_stats->info2));
@@ -33,7 +33,7 @@
  				      __le32_to_cpu(eu_stats->info7))) - 1;
 --- a/drivers/net/wireless/ath/ath11k/hal_rx.h
 +++ b/drivers/net/wireless/ath/ath11k/hal_rx.h
-@@ -70,6 +70,7 @@ enum hal_rx_reception_type {
+@@ -71,6 +71,7 @@ enum hal_rx_reception_type {
  };
  
  #define HAL_RX_FCS_LEN                          4
@@ -41,7 +41,7 @@
  
  enum hal_rx_mon_status {
  	HAL_RX_MON_STATUS_PPDU_NOT_DONE,
-@@ -171,6 +172,7 @@ struct hal_rx_mon_ppdu_info {
+@@ -172,6 +173,7 @@ struct hal_rx_mon_ppdu_info {
  	u8 rssi_comb;
  	u8 rssi_chain_pri20[HAL_RX_MAX_NSS];
  	u16 tid;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/108-ath11k-enable-ul-ofdma-ru-allocation-in-peer-stats.patch b/package/kernel/mac80211/patches/nss/ath11k/108-ath11k-enable-ul-ofdma-ru-allocation-in-peer-stats.patch
index 18477cd5234f1b..3406836981d920 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/108-ath11k-enable-ul-ofdma-ru-allocation-in-peer-stats.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/108-ath11k-enable-ul-ofdma-ru-allocation-in-peer-stats.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath11k/debugfs_sta.c
 +++ b/drivers/net/wireless/ath/ath11k/debugfs_sta.c
-@@ -524,6 +524,12 @@ static ssize_t ath11k_dbg_sta_dump_rx_st
+@@ -525,6 +525,12 @@ static ssize_t ath11k_dbg_sta_dump_rx_st
  		len += scnprintf(buf + len, size - len, "%10llu%s",
  				rx_stats->byte_stats.rx_rate[i],
  				(i + 1) % (he_rates_avail ? 12 : 8) ? "\t" : "\n");
@@ -15,7 +15,7 @@
  
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -2901,11 +2901,12 @@ exit:
+@@ -2902,11 +2902,12 @@ exit:
  static void
  ath11k_dp_rx_update_peer_rate_table_stats(struct ath11k_rx_peer_stats *rx_stats,
  					  struct hal_rx_mon_ppdu_info *ppdu_info,
@@ -30,7 +30,7 @@
  	u32 bw_idx = ppdu_info->bw;
  	u32 gi_idx = ppdu_info->gi;
  
-@@ -2927,10 +2928,13 @@ ath11k_dp_rx_update_peer_rate_table_stat
+@@ -2928,10 +2929,13 @@ ath11k_dp_rx_update_peer_rate_table_stat
  	}
  
  	rx_stats->pkt_stats.rx_rate[rate_idx] += num_msdu;
@@ -46,7 +46,7 @@
  					   struct hal_rx_mon_ppdu_info *ppdu_info)
  {
  	struct ath11k_rx_peer_stats *rx_stats = arsta->rx_stats;
-@@ -2988,7 +2992,6 @@ static void ath11k_dp_rx_update_peer_sta
+@@ -2989,7 +2993,6 @@ static void ath11k_dp_rx_update_peer_sta
  	rx_stats->num_mpdu_fcs_ok += ppdu_info->num_mpdu_fcs_ok;
  	rx_stats->num_mpdu_fcs_err += ppdu_info->num_mpdu_fcs_err;
  	rx_stats->dcm_count += ppdu_info->dcm;
@@ -54,7 +54,7 @@
  
  	BUILD_BUG_ON(ARRAY_SIZE(arsta->chain_signal) >
  			     ARRAY_SIZE(ppdu_info->rssi_chain_pri20));
-@@ -3006,10 +3009,10 @@ static void ath11k_dp_rx_update_peer_sta
+@@ -3007,10 +3010,10 @@ static void ath11k_dp_rx_update_peer_sta
  
  	if (ppdu_info->preamble_type == HAL_RX_PREAMBLE_11N &&
  	    ppdu_info->mcs <= HAL_RX_MAX_MCS_HT) {
@@ -69,7 +69,7 @@
  	}
  
  	if (ppdu_info->preamble_type == HAL_RX_PREAMBLE_11AC &&
-@@ -3042,7 +3045,120 @@ static void ath11k_dp_rx_update_peer_sta
+@@ -3043,7 +3046,120 @@ static void ath11k_dp_rx_update_peer_sta
  		rx_stats->byte_stats.bw_count[ppdu_info->bw] += ppdu_info->mpdu_len;
  	}
  
@@ -191,7 +191,7 @@
  
  }
  
-@@ -5380,6 +5496,55 @@ static void ath11k_dp_rx_mon_dest_proces
+@@ -5381,6 +5497,55 @@ static void ath11k_dp_rx_mon_dest_proces
  	}
  }
  
@@ -247,7 +247,7 @@
  int ath11k_dp_rx_process_mon_status(struct ath11k_base *ab, int mac_id,
  				    struct napi_struct *napi, int budget)
  {
-@@ -5453,8 +5618,13 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -5454,8 +5619,13 @@ int ath11k_dp_rx_process_mon_status(stru
  
  		if ((ppdu_info->fc_valid) &&
  		    (ppdu_info->ast_index != HAL_AST_IDX_INVALID)) {
@@ -265,7 +265,7 @@
  		if (ath11k_debugfs_is_pktlog_peer_valid(ar, peer->addr))
 --- a/drivers/net/wireless/ath/ath11k/hal_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/hal_rx.c
-@@ -804,7 +804,6 @@ void ath11k_hal_reo_init_cmd_ring(struct
+@@ -805,7 +805,6 @@ void ath11k_hal_reo_init_cmd_ring(struct
  	}
  }
  
@@ -273,7 +273,7 @@
  static inline void
  ath11k_hal_rx_handle_ofdma_info(void *rx_tlv,
  				struct hal_rx_user_status *rx_user_status)
-@@ -836,6 +835,8 @@ ath11k_hal_rx_populate_mu_user_info(void
+@@ -837,6 +836,8 @@ ath11k_hal_rx_populate_mu_user_info(void
  {
  	rx_user_status->ast_index = ppdu_info->ast_index;
  	rx_user_status->tid = ppdu_info->tid;
@@ -282,7 +282,7 @@
  	rx_user_status->tcp_msdu_count =
  		ppdu_info->tcp_msdu_count;
  	rx_user_status->udp_msdu_count =
-@@ -859,6 +860,9 @@ ath11k_hal_rx_populate_mu_user_info(void
+@@ -860,6 +861,9 @@ ath11k_hal_rx_populate_mu_user_info(void
  		ppdu_info->num_mpdu_fcs_ok;
  	rx_user_status->mpdu_cnt_fcs_err =
  		ppdu_info->num_mpdu_fcs_err;
@@ -292,7 +292,7 @@
  
  	ath11k_hal_rx_populate_byte_count(rx_tlv, ppdu_info, rx_user_status);
  }
-@@ -888,6 +892,14 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+@@ -889,6 +893,14 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
  				  __le32_to_cpu(ppdu_start->info0));
  		ppdu_info->chan_num = __le32_to_cpu(ppdu_start->chan_num);
  		ppdu_info->ppdu_ts = __le32_to_cpu(ppdu_start->ppdu_start_ts);
@@ -307,7 +307,7 @@
  		break;
  	}
  	case HAL_RX_PPDU_END_USER_STATS: {
-@@ -942,15 +954,16 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+@@ -943,15 +955,16 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
  
  		if (userid < HAL_MAX_UL_MU_USERS) {
  			struct hal_rx_user_status *rxuser_stats =
@@ -327,7 +327,7 @@
  					__le32_to_cpu(eu_stats->rsvd1[1]);
  
  		break;
-@@ -958,12 +971,12 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+@@ -959,12 +972,12 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
  	case HAL_RX_PPDU_END_USER_STATS_EXT: {
  		struct hal_rx_ppdu_end_user_stats_ext *eu_stats =
  			(struct hal_rx_ppdu_end_user_stats_ext *)tlv_data;
@@ -348,7 +348,7 @@
  	case HAL_PHYRX_HT_SIG: {
 --- a/drivers/net/wireless/ath/ath11k/hal_rx.h
 +++ b/drivers/net/wireless/ath/ath11k/hal_rx.h
-@@ -72,6 +72,10 @@ enum hal_rx_reception_type {
+@@ -73,6 +73,10 @@ enum hal_rx_reception_type {
  #define HAL_RX_FCS_LEN                          4
  #define HAL_AST_IDX_INVALID                     0xFFFF
  
@@ -359,7 +359,7 @@
  enum hal_rx_mon_status {
  	HAL_RX_MON_STATUS_PPDU_NOT_DONE,
  	HAL_RX_MON_STATUS_PPDU_DONE,
-@@ -82,14 +86,15 @@ struct hal_rx_user_status {
+@@ -83,14 +87,15 @@ struct hal_rx_user_status {
  	u32 mcs:4,
  	nss:3,
  	ofdma_info_valid:1,
@@ -378,7 +378,7 @@
  	u16 udp_msdu_count;
  	u16 other_msdu_count;
  	u16 frame_control;
-@@ -103,7 +108,7 @@ struct hal_rx_user_status {
+@@ -104,7 +109,7 @@ struct hal_rx_user_status {
  	u8 rs_flags;
  	u32 mpdu_cnt_fcs_ok;
  	u32 mpdu_cnt_fcs_err;
@@ -387,7 +387,7 @@
  	u32 mpdu_ok_byte_count;
  	u32 mpdu_err_byte_count;
  };
-@@ -144,6 +149,7 @@ struct hal_sw_mon_ring_entries {
+@@ -145,6 +150,7 @@ struct hal_sw_mon_ring_entries {
  
  struct hal_rx_mon_ppdu_info {
  	u32 ppdu_id;
@@ -395,7 +395,7 @@
  	u32 ppdu_ts;
  	u32 num_mpdu_fcs_ok;
  	u32 num_mpdu_fcs_err;
-@@ -212,9 +218,20 @@ struct hal_rx_mon_ppdu_info {
+@@ -213,9 +219,20 @@ struct hal_rx_mon_ppdu_info {
  	u8 ltf_size;
  	u8 rxpcu_filter_pass;
  	char rssi_chain[8][8];
diff --git a/package/kernel/mac80211/patches/nss/ath11k/113-ath11k-add-8023-undecap-support.patch b/package/kernel/mac80211/patches/nss/ath11k/113-ath11k-add-8023-undecap-support.patch
index 2ba2411c3ef54b..c08aa58c8c64e9 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/113-ath11k-add-8023-undecap-support.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/113-ath11k-add-8023-undecap-support.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -2305,6 +2305,42 @@ static void ath11k_dp_rx_h_undecap_eth(s
+@@ -2306,6 +2306,42 @@ static void ath11k_dp_rx_h_undecap_eth(s
  	ether_addr_copy(ieee80211_get_SA(hdr), sa);
  }
  
@@ -43,7 +43,7 @@
  static void ath11k_dp_rx_h_undecap(struct ath11k *ar, struct sk_buff *msdu,
  				   struct hal_rx_desc *rx_desc,
  				   enum hal_encrypt_type enctype,
-@@ -2346,7 +2382,8 @@ static void ath11k_dp_rx_h_undecap(struc
+@@ -2347,7 +2383,8 @@ static void ath11k_dp_rx_h_undecap(struc
  						   enctype, status);
  		break;
  	case DP_RX_DECAP_TYPE_8023:
diff --git a/package/kernel/mac80211/patches/nss/ath11k/142-ath11k-adding-support-for-mgmt-frame-stats.patch b/package/kernel/mac80211/patches/nss/ath11k/142-ath11k-adding-support-for-mgmt-frame-stats.patch
index c069cc8ff9f58a..d6b94cdde10b0c 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/142-ath11k-adding-support-for-mgmt-frame-stats.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/142-ath11k-adding-support-for-mgmt-frame-stats.patch
@@ -1,7 +1,23 @@
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -314,6 +314,16 @@ struct ath11k_rekey_data {
- 	bool enable_offload;
+@@ -17,6 +17,7 @@
+ #include <linux/average.h>
+ #include <linux/firmware.h>
+ 
++#include "fw.h"
+ #include "qmi.h"
+ #include "htc.h"
+ #include "wmi.h"
+@@ -32,7 +33,6 @@
+ #include "spectral.h"
+ #include "wow.h"
+ #include "rx_desc.h"
+-#include "fw.h"
+ 
+ #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
+ 
+@@ -355,6 +355,16 @@ struct ath11k_reg_tpc_power_info {
+ 	struct ath11k_chan_power_info chan_power_info[IEEE80211_MAX_NUM_PWR_LEVEL];
  };
  
 +#define ATH11K_STATS_MGMT_FRM_TYPE_MAX 16
@@ -17,18 +33,17 @@
  struct ath11k_vif {
  	u32 vdev_id;
  	enum wmi_vdev_type vdev_type;
-@@ -372,6 +382,8 @@ struct ath11k_vif {
- #ifdef CPTCFG_ATH11K_DEBUGFS
- 	struct dentry *debugfs_twt;
- #endif /* CPTCFG_ATH11K_DEBUGFS */
-+
+@@ -411,6 +421,7 @@ struct ath11k_vif {
+ 	struct ath11k_rekey_data rekey_data;
+ 
+ 	struct ath11k_reg_tpc_power_info reg_tpc_info;
 +	struct ath11k_mgmt_frame_stats mgmt_stats;
  };
  
  struct ath11k_vif_iter {
 --- a/drivers/net/wireless/ath/ath11k/debugfs.c
 +++ b/drivers/net/wireless/ath/ath11k/debugfs.c
-@@ -1588,6 +1588,87 @@ static const struct file_operations fops
+@@ -1589,6 +1589,87 @@ static const struct file_operations fops
  	.llseek = default_llseek,
  };
  
@@ -116,7 +131,7 @@
  int ath11k_debugfs_register(struct ath11k *ar)
  {
  	struct ath11k_base *ab = ar->ab;
-@@ -1620,6 +1701,9 @@ int ath11k_debugfs_register(struct ath11
+@@ -1621,6 +1702,9 @@ int ath11k_debugfs_register(struct ath11
  	debugfs_create_file("fw_dbglog_config", 0600,
  			    ar->debug.debugfs_pdev, ar,
  			    &fops_fw_dbglog);
@@ -128,7 +143,7 @@
  		debugfs_create_file("dfs_simulate_radar", 0200,
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -6148,9 +6148,9 @@ static int ath11k_mac_mgmt_tx(struct ath
+@@ -5934,9 +5934,9 @@ static int ath11k_mac_mgmt_tx(struct ath
  	 */
  	if (is_prb_rsp &&
  	    atomic_read(&ar->num_pending_mgmt_tx) > ATH11K_PRB_RSP_DROP_THRESHOLD) {
@@ -140,7 +155,7 @@
  	}
  
  	if (skb_queue_len_lockless(q) >= ATH11K_TX_MGMT_NUM_PENDING_MAX) {
-@@ -6176,9 +6176,11 @@ static void ath11k_mac_op_tx(struct ieee
+@@ -5962,9 +5962,11 @@ static void ath11k_mac_op_tx(struct ieee
  	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
  	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
  	struct ieee80211_key_conf *key = info->control.hw_key;
@@ -152,7 +167,7 @@
  	int ret;
  
  	memset(skb_cb, 0, sizeof(*skb_cb));
-@@ -6192,12 +6194,21 @@ static void ath11k_mac_op_tx(struct ieee
+@@ -5978,12 +5980,21 @@ static void ath11k_mac_op_tx(struct ieee
  	if (info_flags & IEEE80211_TX_CTL_HW_80211_ENCAP) {
  		skb_cb->flags |= ATH11K_SKB_HW_80211_ENCAP;
  	} else if (ieee80211_is_mgmt(hdr->frame_control)) {
@@ -198,7 +213,7 @@
  	int peer_id;
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
-@@ -5823,6 +5823,12 @@ static int wmi_process_mgmt_tx_comp(stru
+@@ -5896,6 +5896,12 @@ static int wmi_process_mgmt_tx_comp(stru
  	struct sk_buff *msdu;
  	struct ieee80211_tx_info *info;
  	struct ath11k_skb_cb *skb_cb;
@@ -211,7 +226,7 @@
  	int num_mgmt;
  
  	spin_lock_bh(&ar->txmgmt_idr_lock);
-@@ -5850,6 +5856,31 @@ static int wmi_process_mgmt_tx_comp(stru
+@@ -5923,6 +5929,31 @@ static int wmi_process_mgmt_tx_comp(stru
  			info->status.ack_signal = tx_compl_param->ack_rssi;
  	}
  
@@ -243,7 +258,7 @@
  	ieee80211_tx_status_irqsafe(ar->hw, msdu);
  
  	num_mgmt = atomic_dec_if_positive(&ar->num_pending_mgmt_tx);
-@@ -7519,6 +7550,11 @@ static void ath11k_mgmt_rx_event(struct
+@@ -7500,6 +7531,11 @@ static void ath11k_mgmt_rx_event(struct
  	struct ieee80211_hdr *hdr;
  	u16 fc;
  	struct ieee80211_supported_band *sband;
@@ -255,7 +270,7 @@
  
  	if (ath11k_pull_mgmt_rx_params_tlv(ab, skb, &rx_ev) != 0) {
  		ath11k_warn(ab, "failed to extract mgmt rx event");
-@@ -7584,7 +7620,34 @@ static void ath11k_mgmt_rx_event(struct
+@@ -7565,7 +7601,34 @@ static void ath11k_mgmt_rx_event(struct
  
  	hdr = (struct ieee80211_hdr *)skb->data;
  	fc = le16_to_cpu(hdr->frame_control);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/181-ath11k-remove-error-on-soc-debugfs-fail.patch b/package/kernel/mac80211/patches/nss/ath11k/181-ath11k-remove-error-on-soc-debugfs-fail.patch
index ca21c0b14297b2..0e46d98da442b5 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/181-ath11k-remove-error-on-soc-debugfs-fail.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/181-ath11k-remove-error-on-soc-debugfs-fail.patch
@@ -34,7 +34,7 @@ Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
-@@ -2189,5 +2189,17 @@ err_sc_free:
+@@ -2294,5 +2294,17 @@ err_sc_free:
  }
  EXPORT_SYMBOL(ath11k_core_alloc);
  
@@ -54,7 +54,7 @@ Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
  MODULE_LICENSE("Dual BSD/GPL");
 --- a/drivers/net/wireless/ath/ath11k/debugfs.c
 +++ b/drivers/net/wireless/ath/ath11k/debugfs.c
-@@ -16,6 +16,8 @@
+@@ -17,6 +17,8 @@
  #include "peer.h"
  #include "hif.h"
  
@@ -63,7 +63,7 @@ Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
  static const char *htt_bp_umac_ring[HTT_SW_UMAC_RING_IDX_MAX] = {
  	"REO2SW1_RING",
  	"REO2SW2_RING",
-@@ -991,8 +993,6 @@ int ath11k_debugfs_pdev_create(struct at
+@@ -992,8 +994,6 @@ int ath11k_debugfs_pdev_create(struct at
  
  void ath11k_debugfs_pdev_destroy(struct ath11k_base *ab)
  {
@@ -72,7 +72,7 @@ Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
  }
  
  int ath11k_debugfs_soc_create(struct ath11k_base *ab)
-@@ -1045,6 +1045,24 @@ void ath11k_debugfs_soc_destroy(struct a
+@@ -1046,6 +1046,24 @@ void ath11k_debugfs_soc_destroy(struct a
  }
  EXPORT_SYMBOL(ath11k_debugfs_soc_destroy);
  
@@ -97,7 +97,7 @@ Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
  void ath11k_debugfs_fw_stats_init(struct ath11k *ar)
  {
  	struct dentry *fwstats_dir = debugfs_create_dir("fw_stats",
-@@ -1675,6 +1693,9 @@ int ath11k_debugfs_register(struct ath11
+@@ -1676,6 +1694,9 @@ int ath11k_debugfs_register(struct ath11
  	char pdev_name[10];
  	char buf[100] = {0};
  
@@ -107,7 +107,7 @@ Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
  	snprintf(pdev_name, sizeof(pdev_name), "%s%u", "mac", ar->pdev_idx);
  
  	ar->debug.debugfs_pdev = debugfs_create_dir(pdev_name, ab->debugfs_soc);
-@@ -1752,6 +1773,9 @@ void ath11k_debugfs_unregister(struct at
+@@ -1753,6 +1774,9 @@ void ath11k_debugfs_unregister(struct at
  		kfree(dbr_debug);
  		ar->debug.dbr_debug[i] = NULL;
  	}
@@ -119,7 +119,7 @@ Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
  static ssize_t ath11k_write_twt_add_dialog(struct file *file,
 --- a/drivers/net/wireless/ath/ath11k/debugfs.h
 +++ b/drivers/net/wireless/ath/ath11k/debugfs.h
-@@ -263,6 +263,8 @@ struct ath11k_fw_dbglog {
+@@ -264,6 +264,8 @@ struct ath11k_fw_dbglog {
  };
  
  #ifdef CPTCFG_ATH11K_DEBUGFS
@@ -128,7 +128,7 @@ Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
  int ath11k_debugfs_soc_create(struct ath11k_base *ab);
  void ath11k_debugfs_soc_destroy(struct ath11k_base *ab);
  int ath11k_debugfs_pdev_create(struct ath11k_base *ab);
-@@ -314,6 +316,15 @@ void ath11k_debugfs_add_dbring_entry(str
+@@ -315,6 +317,15 @@ void ath11k_debugfs_add_dbring_entry(str
  				     struct hal_srng *srng);
  
  #else
diff --git a/package/kernel/mac80211/patches/nss/ath11k/191-ath11k-add-mgmt-and-data-ack-rssi.patch b/package/kernel/mac80211/patches/nss/ath11k/191-ath11k-add-mgmt-and-data-ack-rssi.patch
index 466dacd1006768..35d05f1b687ccc 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/191-ath11k-add-mgmt-and-data-ack-rssi.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/191-ath11k-add-mgmt-and-data-ack-rssi.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -9580,6 +9580,8 @@ static int __ath11k_mac_register(struct
+@@ -10159,6 +10159,8 @@ static int __ath11k_mac_register(struct
  		wiphy_ext_feature_set(ar->hw->wiphy,
  				      NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
  
@@ -11,7 +11,7 @@
  	ar->hw->offchannel_tx_hw_queue = ATH11K_HW_MAX_QUEUES - 1;
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
-@@ -4065,6 +4065,7 @@ ath11k_wmi_copy_resource_config(struct w
+@@ -4128,6 +4128,7 @@ ath11k_wmi_copy_resource_config(struct w
  	wmi_cfg->max_bssid_rx_filters = tg_cfg->max_bssid_rx_filters;
  	wmi_cfg->use_pdev_id = tg_cfg->use_pdev_id;
  	wmi_cfg->flag1 = tg_cfg->flag1;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/199-002-ath11k_nss-add-nss-driver-interface.patch b/package/kernel/mac80211/patches/nss/ath11k/199-002-ath11k_nss-add-nss-driver-interface.patch
index 41b75404f033e6..11badcab663f24 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/199-002-ath11k_nss-add-nss-driver-interface.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/199-002-ath11k_nss-add-nss-driver-interface.patch
@@ -38,7 +38,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	depends on m
 --- a/drivers/net/wireless/ath/ath11k/Makefile
 +++ b/drivers/net/wireless/ath/ath11k/Makefile
-@@ -25,6 +25,7 @@ ath11k-$(CPTCFG_ATH11K_TRACING) += trace
+@@ -26,6 +26,7 @@ ath11k-$(CPTCFG_ATH11K_TRACING) += trace
  ath11k-$(CPTCFG_ATH11K_THERMAL) += thermal.o
  ath11k-$(CPTCFG_ATH11K_SPECTRAL) += spectral.o
  ath11k-$(CONFIG_PM) += wow.o
@@ -2760,7 +2760,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
 +#endif
 --- a/drivers/net/wireless/ath/ath11k/hif.h
 +++ b/drivers/net/wireless/ath/ath11k/hif.h
-@@ -30,6 +30,7 @@ struct ath11k_hif_ops {
+@@ -31,6 +31,7 @@ struct ath11k_hif_ops {
  	void (*ce_irq_enable)(struct ath11k_base *ab);
  	void (*ce_irq_disable)(struct ath11k_base *ab);
  	void (*get_ce_msi_idx)(struct ath11k_base *ab, u32 ce_id, u32 *msi_idx);
@@ -2768,7 +2768,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  };
  
  static inline void ath11k_hif_ce_irq_enable(struct ath11k_base *ab)
-@@ -136,6 +137,14 @@ static inline void ath11k_get_msi_addres
+@@ -137,6 +138,14 @@ static inline void ath11k_get_msi_addres
  	ab->hif.ops->get_msi_address(ab, msi_addr_lo, msi_addr_hi);
  }
  
@@ -2785,7 +2785,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  {
 --- a/drivers/net/wireless/ath/ath11k/pci.c
 +++ b/drivers/net/wireless/ath/ath11k/pci.c
-@@ -67,6 +67,20 @@ static u32 ath11k_pci_get_window_start(s
+@@ -70,6 +70,20 @@ static u32 ath11k_pci_get_window_start(s
  		return ATH11K_PCI_WINDOW_START;
  }
  
@@ -2806,7 +2806,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  static inline void ath11k_pci_select_window(struct ath11k_pci *ab_pci, u32 offset)
  {
  	struct ath11k_base *ab = ab_pci->ab;
-@@ -710,6 +724,7 @@ static const struct ath11k_hif_ops ath11
+@@ -723,6 +737,7 @@ static const struct ath11k_hif_ops ath11
  	.map_service_to_pipe = ath11k_pcic_map_service_to_pipe,
  	.ce_irq_enable = ath11k_pci_hif_ce_irq_enable,
  	.ce_irq_disable = ath11k_pci_hif_ce_irq_disable,
@@ -2816,7 +2816,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -992,6 +992,29 @@ unlock_exit:
+@@ -993,6 +993,29 @@ unlock_exit:
  	spin_unlock_bh(&ab->base_lock);
  }
  
@@ -2895,7 +2895,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  {
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
-@@ -2873,6 +2873,27 @@ struct pdev_set_regdomain_params {
+@@ -2894,6 +2894,27 @@ struct pdev_set_regdomain_params {
  	u32 pdev_id;
  };
  
@@ -2923,7 +2923,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  struct rx_reorder_queue_remove_params {
  	u8 *peer_macaddr;
  	u16 vdev_id;
-@@ -3121,6 +3142,16 @@ struct wmi_pdev_set_regdomain_cmd {
+@@ -3142,6 +3163,16 @@ struct wmi_pdev_set_regdomain_cmd {
  	u32 dfs_domain;
  } __packed;
  
@@ -2940,7 +2940,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  struct wmi_peer_set_param_cmd {
  	u32 tlv_header;
  	u32 vdev_id;
-@@ -6362,6 +6393,8 @@ int ath11k_wmi_send_peer_create_cmd(stru
+@@ -6384,6 +6415,8 @@ int ath11k_wmi_send_peer_create_cmd(stru
  int ath11k_wmi_vdev_set_param_cmd(struct ath11k *ar, u32 vdev_id,
  				  u32 param_id, u32 param_value);
  
@@ -2998,7 +2998,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  int ath11k_dp_pdev_reo_setup(struct ath11k_base *ab);
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -6367,6 +6367,16 @@ static int ath11k_mac_op_start(struct ie
+@@ -6153,6 +6153,16 @@ static int ath11k_mac_op_start(struct ie
  		goto err;
  	}
  
@@ -3017,7 +3017,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	/* TODO: Do we need to enable ANI? */
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -849,6 +849,8 @@ struct ath11k_soc_dp_tx_err_stats {
+@@ -887,6 +887,8 @@ struct ath11k_soc_dp_tx_err_stats {
  	 * idr unavailable etc.
  	 */
  	atomic_t misc_fail;
@@ -3026,7 +3026,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  };
  
  struct ath11k_soc_dp_stats {
-@@ -935,6 +937,7 @@ struct ath11k_base {
+@@ -973,6 +975,7 @@ struct ath11k_base {
  	struct list_head peers;
  	wait_queue_head_t peer_mapping_wq;
  	u8 mac_addr[ETH_ALEN];
diff --git a/package/kernel/mac80211/patches/nss/ath11k/199-003-ath11k-add-nss-support.patch b/package/kernel/mac80211/patches/nss/ath11k/199-003-ath11k-add-nss-support.patch
index b123e3d2a74109..94ab2544935c41 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/199-003-ath11k-add-nss-support.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/199-003-ath11k-add-nss-support.patch
@@ -24,7 +24,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/ahb.c
 +++ b/drivers/net/wireless/ath/ath11k/ahb.c
-@@ -525,6 +525,12 @@ static int ath11k_ahb_config_ext_irq(str
+@@ -526,6 +526,12 @@ static int ath11k_ahb_config_ext_irq(str
  	int i, j;
  	int irq;
  	int ret;
@@ -37,7 +37,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	for (i = 0; i < ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {
  		struct ath11k_ext_irq_grp *irq_grp = &ab->ext_irq_grp[i];
-@@ -537,20 +543,20 @@ static int ath11k_ahb_config_ext_irq(str
+@@ -538,20 +544,20 @@ static int ath11k_ahb_config_ext_irq(str
  			       ath11k_ahb_ext_grp_napi_poll);
  
  		for (j = 0; j < ATH11K_EXT_IRQ_NUM_MAX; j++) {
@@ -62,7 +62,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  				irq_grp->irqs[num_irq++] = wbm2host_rx_release;
  
  			if (ab->hw_params.ring_mask->reo_status[i] & BIT(j))
-@@ -563,7 +569,7 @@ static int ath11k_ahb_config_ext_irq(str
+@@ -564,7 +570,7 @@ static int ath11k_ahb_config_ext_irq(str
  						ath11k_hw_get_mac_from_pdev_id(hw, j);
  				}
  
@@ -71,7 +71,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  					irq_grp->irqs[num_irq++] =
  						host2rxdma_host_buf_ring_mac1 -
  						ath11k_hw_get_mac_from_pdev_id(hw, j);
-@@ -904,6 +910,7 @@ static int ath11k_ahb_setup_resources(st
+@@ -905,6 +911,7 @@ static int ath11k_ahb_setup_resources(st
  	}
  
  	ab->mem = mem;
@@ -81,9 +81,9 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	return 0;
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
-@@ -17,6 +17,12 @@
- #include "hif.h"
+@@ -18,6 +18,12 @@
  #include "wow.h"
+ #include "fw.h"
  
 +unsigned int nss_offload;
 +#ifdef CPTCFG_ATH11K_NSS_SUPPORT
@@ -94,7 +94,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  unsigned int ath11k_debug_mask;
  EXPORT_SYMBOL(ath11k_debug_mask);
  module_param_named(debug_mask, ath11k_debug_mask, uint, 0644);
-@@ -1528,10 +1534,16 @@ static int ath11k_core_pdev_create(struc
+@@ -1624,10 +1630,16 @@ static int ath11k_core_pdev_create(struc
  		goto err_pdev_debug;
  	}
  
@@ -112,7 +112,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	}
  
  	ret = ath11k_thermal_register(ab);
-@@ -1553,6 +1565,8 @@ err_thermal_unregister:
+@@ -1649,6 +1661,8 @@ err_thermal_unregister:
  	ath11k_thermal_unregister(ab);
  err_mac_unregister:
  	ath11k_mac_unregister(ab);
@@ -121,7 +121,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  err_dp_pdev_free:
  	ath11k_dp_pdev_free(ab);
  err_pdev_debug:
-@@ -1566,6 +1580,10 @@ static void ath11k_core_pdev_destroy(str
+@@ -1662,6 +1676,10 @@ static void ath11k_core_pdev_destroy(str
  	ath11k_spectral_deinit(ab);
  	ath11k_thermal_unregister(ab);
  	ath11k_mac_unregister(ab);
@@ -132,7 +132,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	ath11k_hif_irq_disable(ab);
  	ath11k_dp_pdev_free(ab);
  	ath11k_debugfs_pdev_destroy(ab);
-@@ -1772,6 +1790,10 @@ static int ath11k_core_reconfigure_on_cr
+@@ -1868,6 +1886,10 @@ static int ath11k_core_reconfigure_on_cr
  	int ret;
  
  	mutex_lock(&ab->core_lock);
@@ -141,10 +141,10 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
 +	ab->nss.enabled = false;
 +
  	ath11k_thermal_unregister(ab);
- 	ath11k_hif_irq_disable(ab);
  	ath11k_dp_pdev_free(ab);
-@@ -2095,6 +2117,10 @@ int ath11k_core_pre_init(struct ath11k_b
- 		ath11k_err(ab, "failed to get hw params: %d\n", ret);
+ 	ath11k_spectral_deinit(ab);
+@@ -2199,6 +2221,10 @@ int ath11k_core_pre_init(struct ath11k_b
+ 		ath11k_err(ab, "failed to pre init firmware: %d", ret);
  		return ret;
  	}
 +	ab->nss.enabled = nss_offload;
@@ -156,7 +156,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  }
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -30,6 +30,7 @@
+@@ -33,6 +33,7 @@
  #include "spectral.h"
  #include "wow.h"
  #include "rx_desc.h"
@@ -164,9 +164,9 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
  
-@@ -384,6 +385,9 @@ struct ath11k_vif {
- #endif /* CPTCFG_ATH11K_DEBUGFS */
+@@ -422,6 +423,9 @@ struct ath11k_vif {
  
+ 	struct ath11k_reg_tpc_power_info reg_tpc_info;
  	struct ath11k_mgmt_frame_stats mgmt_stats;
 +#ifdef CPTCFG_ATH11K_NSS_SUPPORT
 +	struct arvif_nss nss;
@@ -174,7 +174,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  };
  
  struct ath11k_vif_iter {
-@@ -537,6 +541,9 @@ struct ath11k_sta {
+@@ -575,6 +579,9 @@ struct ath11k_sta {
  #endif
  
  	bool use_4addr_set;
@@ -184,9 +184,9 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	u16 tcl_metadata;
  
  	/* Protected with ar->data_lock */
-@@ -632,6 +639,9 @@ struct ath11k {
+@@ -669,6 +676,9 @@ struct ath11k {
+ 	struct ath11k_pdev *pdev;
  	struct ieee80211_hw *hw;
- 	struct ieee80211_ops *ops;
  	struct ath11k_pdev_wmi *wmi;
 +#ifdef CPTCFG_ATH11K_NSS_SUPPORT
 +	struct ath11k_nss nss;
@@ -194,7 +194,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	struct ath11k_pdev_dp dp;
  	u8 mac_addr[ETH_ALEN];
  	struct ath11k_he ar_he;
-@@ -892,9 +902,11 @@ struct ath11k_base {
+@@ -930,9 +940,11 @@ struct ath11k_base {
  	struct ath11k_htc htc;
  
  	struct ath11k_dp dp;
@@ -227,7 +227,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	if (ret) {
  		ath11k_warn(ab, "failed to set default routing %d peer :%pM vdev_id :%d\n",
-@@ -132,6 +137,18 @@ static int ath11k_dp_srng_calculate_msi_
+@@ -135,6 +140,18 @@ static int ath11k_dp_srng_calculate_msi_
  {
  	const u8 *grp_mask;
  
@@ -246,7 +246,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	switch (type) {
  	case HAL_WBM2SW_RELEASE:
  		if (ring_num == DP_RX_RELEASE_RING_NUM) {
-@@ -778,14 +795,16 @@ int ath11k_dp_service_srng(struct ath11k
+@@ -792,14 +809,16 @@ int ath11k_dp_service_srng(struct ath11k
  	int work_done = 0;
  	int i, j;
  	int tot_work_done = 0;
@@ -268,7 +268,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		work_done = ath11k_dp_process_rx_err(ab, napi, budget);
  		budget -= work_done;
  		tot_work_done += work_done;
-@@ -793,7 +812,7 @@ int ath11k_dp_service_srng(struct ath11k
+@@ -807,7 +826,7 @@ int ath11k_dp_service_srng(struct ath11k
  			goto done;
  	}
  
@@ -277,7 +277,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		work_done = ath11k_dp_rx_process_wbm_err(ab,
  							 napi,
  							 budget);
-@@ -804,7 +823,7 @@ int ath11k_dp_service_srng(struct ath11k
+@@ -818,7 +837,7 @@ int ath11k_dp_service_srng(struct ath11k
  			goto done;
  	}
  
@@ -286,7 +286,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		i =  fls(ab->hw_params.ring_mask->rx[grp_id]) - 1;
  		work_done = ath11k_dp_process_rx(ab, i, napi,
  						 budget);
-@@ -838,7 +857,7 @@ int ath11k_dp_service_srng(struct ath11k
+@@ -852,7 +871,7 @@ int ath11k_dp_service_srng(struct ath11k
  	if (ab->hw_params.ring_mask->reo_status[grp_id])
  		ath11k_dp_process_reo_status(ab);
  
@@ -307,7 +307,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -17,6 +17,7 @@
+@@ -18,6 +18,7 @@
  #include "hal_rx.h"
  #include "dp_tx.h"
  #include "peer.h"
@@ -315,7 +315,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  #define ATH11K_DP_RX_FRAGMENT_TIMEOUT_MS (2 * HZ)
  
-@@ -213,8 +214,8 @@ static inline u8 ath11k_dp_rx_h_mpdu_sta
+@@ -214,8 +215,8 @@ static inline u8 ath11k_dp_rx_h_mpdu_sta
  	return ab->hw_params.hw_ops->rx_desc_get_mpdu_tid(desc);
  }
  
@@ -326,7 +326,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  {
  	return ab->hw_params.hw_ops->rx_desc_get_mpdu_peer_id(desc);
  }
-@@ -225,8 +226,8 @@ static inline u8 ath11k_dp_rx_h_msdu_end
+@@ -226,8 +227,8 @@ static inline u8 ath11k_dp_rx_h_msdu_end
  	return ab->hw_params.hw_ops->rx_desc_get_l3_pad_bytes(desc);
  }
  
@@ -337,7 +337,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  {
  	return ab->hw_params.hw_ops->rx_desc_get_first_msdu(desc);
  }
-@@ -283,7 +284,7 @@ static inline void ath11k_dp_rxdesc_set_
+@@ -284,7 +285,7 @@ static inline void ath11k_dp_rxdesc_set_
  	ab->hw_params.hw_ops->rx_desc_set_msdu_len(desc, len);
  }
  
@@ -346,7 +346,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  					struct hal_rx_desc *desc)
  {
  	struct rx_attention *attn = ath11k_dp_rx_get_attention(ab, desc);
-@@ -498,7 +499,9 @@ static int ath11k_dp_rxdma_pdev_buf_setu
+@@ -499,7 +500,9 @@ static int ath11k_dp_rxdma_pdev_buf_setu
  	struct dp_rxdma_ring *rx_ring = &dp->rx_refill_buf_ring;
  	int i;
  
@@ -357,7 +357,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	if (ar->ab->hw_params.rxdma1_enable) {
  		rx_ring = &dp->rxdma_mon_buf_ring;
-@@ -2035,7 +2038,7 @@ static void ath11k_dp_rx_h_csum_offload(
+@@ -2036,7 +2039,7 @@ static void ath11k_dp_rx_h_csum_offload(
  			  CHECKSUM_NONE : CHECKSUM_UNNECESSARY;
  }
  
@@ -366,7 +366,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  				       enum hal_encrypt_type enctype)
  {
  	switch (enctype) {
-@@ -2062,7 +2065,7 @@ static int ath11k_dp_rx_crypto_mic_len(s
+@@ -2063,7 +2066,7 @@ static int ath11k_dp_rx_crypto_mic_len(s
  	return 0;
  }
  
@@ -375,7 +375,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  					 enum hal_encrypt_type enctype)
  {
  	switch (enctype) {
-@@ -2090,7 +2093,7 @@ static int ath11k_dp_rx_crypto_param_len
+@@ -2091,7 +2094,7 @@ static int ath11k_dp_rx_crypto_param_len
  	return 0;
  }
  
@@ -384,7 +384,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  				       enum hal_encrypt_type enctype)
  {
  	switch (enctype) {
-@@ -2826,6 +2829,22 @@ static void ath11k_dp_rx_process_receive
+@@ -2827,6 +2830,22 @@ static void ath11k_dp_rx_process_receive
  	}
  }
  
@@ -407,7 +407,17 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  int ath11k_dp_process_rx(struct ath11k_base *ab, int ring_id,
  			 struct napi_struct *napi, int budget)
  {
-@@ -3133,6 +3152,13 @@ static void ath11k_dp_rx_update_user_sta
+@@ -3126,7 +3145,8 @@ static void ath11k_dp_rx_update_user_sta
+ 	peer = ath11k_peer_find_by_ast(ar->ab, user_stats->ast_index);
+ 
+ 	if (peer == NULL) {
+-		ath11k_warn(ar->ab, "peer ast idx %d can't be found\n",
++		if (!ar->ab->nss.enabled)
++		  ath11k_warn(ar->ab, "peer ast idx %d can't be found\n",
+ 			    user_stats->ast_index);
+ 		return;
+ 	}
+@@ -3134,6 +3154,13 @@ static void ath11k_dp_rx_update_user_sta
  	arsta = (struct ath11k_sta *)peer->sta->drv_priv;
  	rx_stats = arsta->rx_stats;
  
@@ -421,7 +431,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	if (!rx_stats)
  		return;
  
-@@ -3209,8 +3235,10 @@ static void ath11k_dp_rx_update_peer_mu_
+@@ -3210,8 +3237,10 @@ static void ath11k_dp_rx_update_peer_mu_
  {
  	u32 num_users, i;
  
@@ -433,7 +443,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	num_users = ppdu_info->num_users;
  	if (num_users > HAL_MAX_UL_MU_USERS)
-@@ -5613,7 +5641,7 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -5614,7 +5643,7 @@ int ath11k_dp_rx_process_mon_status(stru
  	struct sk_buff *skb;
  	struct sk_buff_head skb_list;
  	struct ath11k_peer *peer;
@@ -442,7 +452,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	int num_buffs_reaped = 0;
  	u32 rx_buf_sz;
  	u16 log_type;
-@@ -5681,6 +5709,7 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -5682,6 +5711,7 @@ int ath11k_dp_rx_process_mon_status(stru
  			if (ppdu_info->reception_type == HAL_RX_RECEPTION_TYPE_SU) {
  				arsta = (struct ath11k_sta *)peer->sta->drv_priv;
  				ath11k_dp_rx_update_peer_su_stats(arsta, ppdu_info);
@@ -484,7 +494,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	HAL_REO_EXCEPTION,
 --- a/drivers/net/wireless/ath/ath11k/hal_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/hal_rx.c
-@@ -938,6 +938,12 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+@@ -939,6 +939,12 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
  		ppdu_info->num_mpdu_fcs_err =
  			FIELD_GET(HAL_RX_PPDU_END_USER_STATS_INFO0_MPDU_CNT_FCS_ERR,
  				  info0);
@@ -507,7 +517,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  #define CHAN2G(_channel, _freq, _flags) { \
  	.band                   = NL80211_BAND_2GHZ, \
-@@ -1603,6 +1604,11 @@ static void ath11k_control_beaconing(str
+@@ -1593,6 +1594,11 @@ static void ath11k_control_beaconing(str
  	lockdep_assert_held(&arvif->ar->conf_mutex);
  
  	if (!info->enable_beacon) {
@@ -519,7 +529,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		ret = ath11k_wmi_vdev_down(ar, arvif->vdev_id);
  		if (ret)
  			ath11k_warn(ar->ab, "failed to down vdev_id %i: %d\n",
-@@ -1642,6 +1648,12 @@ static void ath11k_control_beaconing(str
+@@ -1632,6 +1638,12 @@ static void ath11k_control_beaconing(str
  
  	arvif->is_up = true;
  
@@ -532,7 +542,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "vdev %d up\n", arvif->vdev_id);
  }
  
-@@ -3075,6 +3087,12 @@ static void ath11k_bss_assoc(struct ieee
+@@ -3070,6 +3082,12 @@ static void ath11k_bss_assoc(struct ieee
  		   "vdev %d up (associated) bssid %pM aid %d\n",
  		   arvif->vdev_id, bss_conf->bssid, vif->cfg.aid);
  
@@ -545,7 +555,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	spin_lock_bh(&ar->ab->base_lock);
  
  	peer = ath11k_peer_find(ar->ab, arvif->vdev_id, arvif->bssid);
-@@ -3117,6 +3135,10 @@ static void ath11k_bss_disassoc(struct i
+@@ -3112,6 +3130,10 @@ static void ath11k_bss_disassoc(struct i
  
  	lockdep_assert_held(&ar->conf_mutex);
  
@@ -556,8 +566,8 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "vdev %i disassoc bssid %pM\n",
  		   arvif->vdev_id, arvif->bssid);
  
-@@ -3397,6 +3419,28 @@ static int ath11k_mac_config_obss_pd(str
- 	return 0;
+@@ -3404,6 +3426,28 @@ static bool ath11k_mac_supports_station_
+ 		chandef->chan->band == NL80211_BAND_6GHZ;
  }
  
 +static void ath11k_mac_op_nss_bss_info_changed(struct ieee80211_hw *hw,
@@ -585,7 +595,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  static void ath11k_mac_op_bss_info_changed(struct ieee80211_hw *hw,
  					   struct ieee80211_vif *vif,
  					   struct ieee80211_bss_conf *info,
-@@ -4295,6 +4339,26 @@ static int ath11k_mac_op_set_key(struct
+@@ -4303,6 +4347,26 @@ static int ath11k_mac_op_set_key(struct
  
  	spin_lock_bh(&ab->base_lock);
  	peer = ath11k_peer_find(ab, arvif->vdev_id, peer_addr);
@@ -612,7 +622,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	if (peer && cmd == SET_KEY) {
  		peer->keys[key->keyidx] = key;
  		if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
-@@ -4333,9 +4397,8 @@ static int ath11k_mac_op_set_key(struct
+@@ -4341,9 +4405,8 @@ static int ath11k_mac_op_set_key(struct
  			break;
  		}
  	}
@@ -623,7 +633,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  exit:
  	mutex_unlock(&ar->conf_mutex);
  	return ret;
-@@ -6216,10 +6279,14 @@ static void ath11k_mac_op_tx(struct ieee
+@@ -6002,10 +6065,14 @@ static void ath11k_mac_op_tx(struct ieee
  	if (control->sta)
  		arsta = ath11k_sta_to_arsta(control->sta);
  
@@ -639,7 +649,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	}
  }
  
-@@ -6241,6 +6308,8 @@ static int ath11k_mac_config_mon_status_
+@@ -6027,6 +6094,8 @@ static int ath11k_mac_config_mon_status_
  
  	if (enable) {
  		tlv_filter = ath11k_mac_mon_status_filter_default;
@@ -648,7 +658,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		if (ath11k_debugfs_rx_filter(ar))
  			tlv_filter.rx_filter = ath11k_debugfs_rx_filter(ar);
  	}
-@@ -6539,7 +6608,7 @@ static int ath11k_mac_setup_vdev_create_
+@@ -6325,7 +6394,7 @@ static int ath11k_mac_setup_vdev_create_
  	return 0;
  }
  
@@ -657,7 +667,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  					     struct ieee80211_vif *vif)
  {
  	struct ath11k *ar = hw->priv;
-@@ -6585,6 +6654,8 @@ static void ath11k_mac_op_update_vif_off
+@@ -6371,6 +6440,8 @@ static void ath11k_mac_op_update_vif_off
  			    arvif->vdev_id, ret);
  		vif->offload_flags &= ~IEEE80211_OFFLOAD_DECAP_ENABLED;
  	}
@@ -666,7 +676,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  }
  
  static bool ath11k_mac_vif_ap_active_any(struct ath11k_base *ab)
-@@ -6715,6 +6786,8 @@ static int ath11k_mac_vdev_delete(struct
+@@ -6501,6 +6572,8 @@ static int ath11k_mac_vdev_delete(struct
  
  	reinit_completion(&ar->vdev_delete_done);
  
@@ -675,7 +685,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	ret = ath11k_wmi_vdev_delete(ar, arvif->vdev_id);
  	if (ret) {
  		ath11k_warn(ar->ab, "failed to delete WMI vdev %d: %d\n",
-@@ -6855,7 +6928,34 @@ static int ath11k_mac_op_add_interface(s
+@@ -6634,7 +6707,34 @@ static int ath11k_mac_op_add_interface(s
  	list_add(&arvif->list, &ar->arvifs);
  	spin_unlock_bh(&ar->data_lock);
  
@@ -711,7 +721,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	nss = get_num_chains(ar->cfg_tx_chainmask) ? : 1;
  	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id,
-@@ -6979,6 +7079,7 @@ err_peer_del:
+@@ -6764,6 +6864,7 @@ err_peer_del:
  	}
  
  err_vdev_del:
@@ -719,7 +729,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	ath11k_mac_vdev_delete(ar, arvif);
  	spin_lock_bh(&ar->data_lock);
  	list_del(&arvif->list);
-@@ -7489,6 +7590,10 @@ ath11k_mac_update_vif_chan(struct ath11k
+@@ -7281,6 +7382,10 @@ ath11k_mac_update_vif_chan(struct ath11k
  				    arvif->vdev_id, ret);
  			continue;
  		}
@@ -730,7 +740,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	}
  
  	/* Restart the internal monitor vdev on new channel */
-@@ -8717,6 +8822,8 @@ static void ath11k_mac_op_sta_statistics
+@@ -8982,6 +9087,8 @@ static void ath11k_mac_op_sta_statistics
  	sinfo->signal_avg = ewma_avg_rssi_read(&arsta->avg_rssi) +
  		ATH11K_DEFAULT_NOISE_FLOOR;
  	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
@@ -739,7 +749,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  }
  
  #if IS_ENABLED(CONFIG_IPV6)
-@@ -9144,6 +9251,7 @@ static const struct ieee80211_ops ath11k
+@@ -9674,6 +9781,7 @@ static const struct ieee80211_ops ath11k
  	.update_vif_offload		= ath11k_mac_op_update_vif_offload,
  	.config                         = ath11k_mac_op_config,
  	.bss_info_changed               = ath11k_mac_op_bss_info_changed,
@@ -747,7 +757,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	.configure_filter		= ath11k_mac_op_configure_filter,
  	.hw_scan                        = ath11k_mac_op_hw_scan,
  	.cancel_hw_scan                 = ath11k_mac_op_cancel_hw_scan,
-@@ -9530,7 +9638,8 @@ static int __ath11k_mac_register(struct
+@@ -10109,7 +10217,8 @@ static int __ath11k_mac_register(struct
  		ieee80211_hw_set(ar->hw, TX_AMPDU_SETUP_IN_HW);
  		ieee80211_hw_set(ar->hw, SUPPORTS_REORDERING_BUFFER);
  		ieee80211_hw_set(ar->hw, SUPPORTS_AMSDU_IN_AMPDU);
@@ -757,7 +767,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	}
  
  	ar->hw->wiphy->features |= NL80211_FEATURE_STATIC_SMPS;
-@@ -9645,6 +9754,9 @@ static int __ath11k_mac_register(struct
+@@ -10224,6 +10333,9 @@ static int __ath11k_mac_register(struct
  	    ab->hw_params.bios_sar_capa)
  		ar->hw->wiphy->sar_capa = ab->hw_params.bios_sar_capa;
  
@@ -838,7 +848,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	struct ieee80211_key_conf *keys[WMI_MAX_KEY_INDEX + 1];
 --- a/drivers/net/wireless/ath/ath11k/pci.c
 +++ b/drivers/net/wireless/ath/ath11k/pci.c
-@@ -570,6 +570,7 @@ static int ath11k_pci_claim(struct ath11
+@@ -583,6 +583,7 @@ static int ath11k_pci_claim(struct ath11
  	}
  
  	ab->mem_ce = ab->mem;
@@ -848,7 +858,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	return 0;
 --- a/drivers/net/wireless/ath/ath11k/debugfs.c
 +++ b/drivers/net/wireless/ath/ath11k/debugfs.c
-@@ -10,11 +10,10 @@
+@@ -11,11 +11,10 @@
  #include "core.h"
  #include "debug.h"
  #include "wmi.h"
@@ -861,7 +871,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  struct dentry *debugfs_ath11k;
  
-@@ -665,6 +664,7 @@ static ssize_t ath11k_write_extd_rx_stat
+@@ -666,6 +665,7 @@ static ssize_t ath11k_write_extd_rx_stat
  			HTT_RX_FP_DATA_FILTER_FLASG3;
  	} else {
  		tlv_filter = ath11k_mac_mon_status_filter_default;
@@ -869,7 +879,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	}
  
  	ar->debug.rx_filter = tlv_filter.rx_filter;
-@@ -1687,6 +1687,76 @@ static const struct file_operations fops
+@@ -1688,6 +1688,76 @@ static const struct file_operations fops
  	.open = simple_open
  };
  
@@ -946,7 +956,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  int ath11k_debugfs_register(struct ath11k *ar)
  {
  	struct ath11k_base *ab = ar->ab;
-@@ -1753,6 +1823,11 @@ int ath11k_debugfs_register(struct ath11
+@@ -1754,6 +1824,11 @@ int ath11k_debugfs_register(struct ath11
  				    &fops_reset_ps_duration);
  	}
  
@@ -971,7 +981,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
 --- a/drivers/net/wireless/ath/ath11k/dp_tx.h
 +++ b/drivers/net/wireless/ath/ath11k/dp_tx.h
-@@ -38,6 +38,8 @@ int ath11k_dp_tx_htt_rx_filter_setup(str
+@@ -39,6 +39,8 @@ int ath11k_dp_tx_htt_rx_filter_setup(str
  				     int mac_id, enum hal_ring_type ring_type,
  				     int rx_buf_size,
  				     struct htt_rx_ring_tlv_filter *tlv_filter);
@@ -1185,7 +1195,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_3,
 --- a/drivers/net/wireless/ath/ath11k/pcic.c
 +++ b/drivers/net/wireless/ath/ath11k/pcic.c
-@@ -571,6 +571,12 @@ static int ath11k_pcic_ext_irq_config(st
+@@ -582,6 +582,12 @@ static int ath11k_pcic_ext_irq_config(st
  		netif_napi_add(&irq_grp->napi_ndev, &irq_grp->napi,
  			       ath11k_pcic_ext_grp_napi_poll);
  
@@ -1200,7 +1210,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		    ab->hw_params.ring_mask->rx_err[i] ||
 --- a/local-symbols
 +++ b/local-symbols
-@@ -170,6 +170,7 @@ WCN36XX_DEBUGFS=
+@@ -163,6 +163,7 @@ WCN36XX_DEBUGFS=
  ATH11K=
  ATH11K_AHB=
  ATH11K_PCI=
diff --git a/package/kernel/mac80211/patches/nss/ath11k/203-mac80211-ath11k-fw-dynamic-muedca.patch b/package/kernel/mac80211/patches/nss/ath11k/203-mac80211-ath11k-fw-dynamic-muedca.patch
index a91d4aa97cbbca..a5200d21833001 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/203-mac80211-ath11k-fw-dynamic-muedca.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/203-mac80211-ath11k-fw-dynamic-muedca.patch
@@ -40,7 +40,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  	[WMI_TAG_11D_NEW_COUNTRY_EVENT] = {
  		.min_len = sizeof(struct wmi_11d_new_cc_ev) },
  	[WMI_TAG_PER_CHAIN_RSSI_STATS] = {
-@@ -8727,6 +8729,74 @@ exit:
+@@ -8708,6 +8710,74 @@ exit:
  	kfree(tb);
  }
  
@@ -54,7 +54,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
 +	struct ath11k *ar;
 +	int ret;
 +
-+	tb = ath11k_wmi_tlv_parse_alloc(ab, skb->data, skb->len, GFP_ATOMIC);
++	tb = ath11k_wmi_tlv_parse_alloc(ab, skb, GFP_ATOMIC);
 +	if (IS_ERR(tb)) {
 +		ret = PTR_ERR(tb);
 +		ath11k_warn(ab, "failed to parse tlv: %d\n", ret);
@@ -115,7 +115,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  static void ath11k_wmi_tlv_op_rx(struct ath11k_base *ab, struct sk_buff *skb)
  {
  	struct wmi_cmd_hdr *cmd_hdr;
-@@ -8845,6 +8915,9 @@ static void ath11k_wmi_tlv_op_rx(struct
+@@ -8826,6 +8896,9 @@ static void ath11k_wmi_tlv_op_rx(struct
  	case WMI_11D_NEW_COUNTRY_EVENTID:
  		ath11k_reg_11d_new_cc_event(ab, skb);
  		break;
@@ -127,7 +127,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  		break;
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
-@@ -759,6 +759,7 @@ enum wmi_tlv_event_id {
+@@ -776,6 +776,7 @@ enum wmi_tlv_event_id {
  	WMI_READ_DATA_FROM_FLASH_EVENTID,
  	WMI_REPORT_RX_AGGR_FAILURE_EVENTID,
  	WMI_PKGID_EVENTID,
@@ -135,7 +135,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  	WMI_GPIO_INPUT_EVENTID = WMI_TLV_CMD(WMI_GRP_GPIO),
  	WMI_UPLOADH_EVENTID,
  	WMI_CAPTUREH_EVENTID,
-@@ -1869,6 +1870,7 @@ enum wmi_tlv_tag {
+@@ -1888,6 +1889,7 @@ enum wmi_tlv_tag {
  	WMI_TAG_NDP_EVENT,
  	WMI_TAG_PDEV_PEER_PKTLOG_FILTER_CMD = 0x301,
  	WMI_TAG_PDEV_PEER_PKTLOG_FILTER_INFO,
@@ -143,7 +143,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  	WMI_TAG_FILS_DISCOVERY_TMPL_CMD = 0x344,
  	WMI_TAG_PDEV_SRG_BSS_COLOR_BITMAP_CMD = 0x37b,
  	WMI_TAG_PDEV_SRG_PARTIAL_BSSID_BITMAP_CMD,
-@@ -4868,6 +4870,16 @@ struct wmi_pdev_temperature_event {
+@@ -4890,6 +4892,16 @@ struct wmi_pdev_temperature_event {
  	u32 pdev_id;
  } __packed;
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Add-support-for-dynamic-vlan.patch b/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Add-support-for-dynamic-vlan.patch
index a765d1a292c60c..809c61df4ab720 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Add-support-for-dynamic-vlan.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Add-support-for-dynamic-vlan.patch
@@ -21,7 +21,7 @@ Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -119,6 +119,7 @@ struct ath11k_skb_cb {
+@@ -122,6 +122,7 @@ struct ath11k_skb_cb {
  	u32 cipher;
  	struct ath11k *ar;
  	struct ieee80211_vif *vif;
@@ -162,7 +162,7 @@ Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
  	if (ts->acked) {
 --- a/drivers/net/wireless/ath/ath11k/dp_tx.h
 +++ b/drivers/net/wireless/ath/ath11k/dp_tx.h
-@@ -16,6 +16,204 @@ struct ath11k_dp_htt_wbm_tx_status {
+@@ -17,6 +17,204 @@ struct ath11k_dp_htt_wbm_tx_status {
  	u16 peer_id;
  };
  
@@ -369,7 +369,7 @@ Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
  int ath11k_dp_tx(struct ath11k *ar, struct ath11k_vif *arvif,
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -9771,6 +9771,9 @@ static int __ath11k_mac_register(struct
+@@ -10350,6 +10350,9 @@ static int __ath11k_mac_register(struct
  		 */
  		ar->hw->wiphy->interface_modes &= ~BIT(NL80211_IFTYPE_MONITOR);
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Enable-256_512MB-profiles.patch b/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Enable-256_512MB-profiles.patch
index 4d9c1537a8bb4b..2adfb3ba99b4be 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Enable-256_512MB-profiles.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Enable-256_512MB-profiles.patch
@@ -93,9 +93,9 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	bool smp2p_wow_exit;
  	bool support_fw_mac_sequence;
 +	const struct ath11k_num_vdevs_peers *num_vdevs_peers;
+ 	bool support_dual_stations;
  };
  
- struct ath11k_hw_ops {
 --- a/drivers/net/wireless/ath/ath11k/qmi.h
 +++ b/drivers/net/wireless/ath/ath11k/qmi.h
 @@ -29,6 +29,12 @@
@@ -125,7 +125,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	ATH11K_QMI_FILE_TYPE_BDF_GOLDEN,
 --- a/local-symbols
 +++ b/local-symbols
-@@ -171,6 +171,8 @@ ATH11K=
+@@ -164,6 +164,8 @@ ATH11K=
  ATH11K_AHB=
  ATH11K_PCI=
  ATH11K_NSS_SUPPORT=
@@ -136,7 +136,23 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  ATH11K_TRACING=
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -887,6 +887,11 @@ struct ath11k_msi_config {
+@@ -17,7 +17,6 @@
+ #include <linux/average.h>
+ #include <linux/firmware.h>
+ 
+-#include "fw.h"
+ #include "qmi.h"
+ #include "htc.h"
+ #include "wmi.h"
+@@ -34,6 +33,7 @@
+ #include "wow.h"
+ #include "rx_desc.h"
+ #include "nss.h"
++#include "fw.h"
+ 
+ #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
+ 
+@@ -925,6 +925,11 @@ struct ath11k_msi_config {
  	u16 hw_rev;
  };
  
@@ -148,9 +164,9 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  /* Master structure to hold the hw data which may be used in core module */
  struct ath11k_base {
  	enum ath11k_hw_rev hw_rev;
-@@ -1032,6 +1037,8 @@ struct ath11k_base {
- 		const struct ath11k_pci_ops *ops;
- 	} pci;
+@@ -1082,6 +1087,8 @@ struct ath11k_base {
+ 		DECLARE_BITMAP(fw_features, ATH11K_FW_FEATURE_COUNT);
+ 	} fw;
  
 +	atomic_t num_max_allowed;
 +
@@ -219,7 +235,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
-@@ -42,6 +42,8 @@ bool ath11k_ftm_mode;
+@@ -43,6 +43,8 @@ bool ath11k_ftm_mode;
  module_param_named(ftm_mode, ath11k_ftm_mode, bool, 0444);
  MODULE_PARM_DESC(ftm_mode, "Boots up in factory test mode");
  
@@ -228,15 +244,15 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  static struct ath11k_hw_params ath11k_hw_params[] = {
  	{
  		.hw_rev = ATH11K_HW_IPQ8074,
-@@ -127,6 +129,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -128,6 +130,7 @@ static struct ath11k_hw_params ath11k_hw
  		.tcl_ring_retry = true,
  		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
  		.smp2p_wow_exit = false,
 +		.num_vdevs_peers = ath11k_vdevs_peers,
+ 		.support_dual_stations = false,
  	},
  	{
- 		.hw_rev = ATH11K_HW_IPQ6018_HW10,
-@@ -177,7 +180,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -179,7 +182,7 @@ static struct ath11k_hw_params ath11k_hw
  		.coldboot_cal_mm = false,
  		.coldboot_cal_ftm = false,
  		.cbcal_restart_fw = true,
@@ -245,59 +261,59 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		.num_vdevs = 16 + 1,
  		.num_peers = 512,
  		.supports_suspend = false,
-@@ -259,7 +262,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -262,7 +265,7 @@ static struct ath11k_hw_params ath11k_hw
  		.coldboot_cal_mm = false,
  		.coldboot_cal_ftm = false,
  		.cbcal_restart_fw = false,
 -		.fw_mem_mode = 0,
 +		.fw_mem_mode = ATH11K_QMI_TARGET_MEM_MODE,
- 		.num_vdevs = 16 + 1,
+ 		.num_vdevs = 2 + 1,
  		.num_peers = 512,
  		.supports_suspend = true,
-@@ -426,7 +429,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -431,7 +434,7 @@ static struct ath11k_hw_params ath11k_hw
  		.coldboot_cal_mm = false,
  		.coldboot_cal_ftm = false,
  		.cbcal_restart_fw = false,
 -		.fw_mem_mode = 0,
 +		.fw_mem_mode = ATH11K_QMI_TARGET_MEM_MODE,
- 		.num_vdevs = 16 + 1,
+ 		.num_vdevs = 2 + 1,
  		.num_peers = 512,
  		.supports_suspend = true,
-@@ -462,6 +465,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -467,6 +470,7 @@ static struct ath11k_hw_params ath11k_hw
  		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
  		.smp2p_wow_exit = false,
  		.support_fw_mac_sequence = true,
 +		.num_vdevs_peers = ath11k_vdevs_peers,
+ 		.support_dual_stations = true,
  	},
  	{
- 		.name = "wcn6855 hw2.1",
-@@ -509,7 +513,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -515,7 +519,7 @@ static struct ath11k_hw_params ath11k_hw
  		.coldboot_cal_mm = false,
  		.coldboot_cal_ftm = false,
  		.cbcal_restart_fw = false,
 -		.fw_mem_mode = 0,
 +		.fw_mem_mode = ATH11K_QMI_TARGET_MEM_MODE,
- 		.num_vdevs = 16 + 1,
+ 		.num_vdevs = 2 + 1,
  		.num_peers = 512,
  		.supports_suspend = true,
-@@ -545,6 +549,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -551,6 +555,7 @@ static struct ath11k_hw_params ath11k_hw
  		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
  		.smp2p_wow_exit = false,
  		.support_fw_mac_sequence = true,
 +		.num_vdevs_peers = ath11k_vdevs_peers,
+ 		.support_dual_stations = true,
  	},
  	{
- 		.name = "wcn6750 hw1.0",
-@@ -593,7 +598,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -600,7 +605,7 @@ static struct ath11k_hw_params ath11k_hw
  		.coldboot_cal_mm = true,
  		.coldboot_cal_ftm = true,
  		.cbcal_restart_fw = false,
 -		.fw_mem_mode = 0,
 +		.fw_mem_mode = ATH11K_QMI_TARGET_MEM_MODE,
- 		.num_vdevs = 16 + 1,
+ 		.num_vdevs = 3,
  		.num_peers = 512,
  		.supports_suspend = false,
-@@ -672,7 +677,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -680,7 +685,7 @@ static struct ath11k_hw_params ath11k_hw
  		.supports_monitor = false,
  		.supports_sta_ps = false,
  		.supports_shadow_regs = false,
@@ -306,14 +322,18 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		.num_vdevs = 16 + 1,
  		.num_peers = 512,
  		.supports_regdb = false,
-@@ -707,6 +712,22 @@ static struct ath11k_hw_params ath11k_hw
+@@ -715,6 +720,7 @@ static struct ath11k_hw_params ath11k_hw
  		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
  		.smp2p_wow_exit = false,
  		.support_fw_mac_sequence = false,
 +		.num_vdevs_peers = ath11k_vdevs_peers,
-+	},
-+};
-+
+ 		.support_dual_stations = false,
+ 	},
+ 	{
+@@ -805,6 +811,21 @@ static struct ath11k_hw_params ath11k_hw
+ 	},
+ };
+ 
 +static const struct ath11k_num_vdevs_peers ath11k_vdevs_peers[] = {
 +	{
 +		.num_vdevs = (16 + 1),
@@ -326,6 +346,9 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
 +	{
 +		.num_vdevs = 8,
 +		.num_peers = 128,
- 	},
- };
- 
++	},
++};
++
+ static inline struct ath11k_pdev *ath11k_core_get_single_pdev(struct ath11k_base *ab)
+ {
+ 	WARN_ON(!ab->hw_params.single_pdev_only);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/211-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch b/package/kernel/mac80211/patches/nss/ath11k/211-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch
index 8ad2cc71f8981d..8ab1971384c8dc 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/211-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/211-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch
@@ -26,7 +26,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -642,6 +642,7 @@ struct ath11k {
+@@ -679,6 +679,7 @@ struct ath11k {
  	struct ath11k_pdev_wmi *wmi;
  #ifdef CPTCFG_ATH11K_NSS_SUPPORT
  	struct ath11k_nss nss;
@@ -34,7 +34,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  #endif
  	struct ath11k_pdev_dp dp;
  	u8 mac_addr[ETH_ALEN];
-@@ -1047,6 +1048,9 @@ struct ath11k_base {
+@@ -1097,6 +1098,9 @@ struct ath11k_base {
  	} testmode;
  #endif
  
@@ -67,7 +67,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  struct htt_resp_msg {
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -1857,6 +1857,8 @@ void ath11k_dp_htt_htc_t2h_msg_handler(s
+@@ -1858,6 +1858,8 @@ void ath11k_dp_htt_htc_t2h_msg_handler(s
  	u16 peer_mac_h16;
  	u16 ast_hash;
  	u16 hw_peer_id;
@@ -76,7 +76,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
  	ath11k_dbg(ab, ATH11K_DBG_DP_HTT, "dp_htt rx msg type :0x%0x\n", type);
  
-@@ -1892,15 +1894,29 @@ void ath11k_dp_htt_htc_t2h_msg_handler(s
+@@ -1893,15 +1895,29 @@ void ath11k_dp_htt_htc_t2h_msg_handler(s
  				     resp->peer_map_ev.info2);
  		hw_peer_id = FIELD_GET(HTT_T2H_PEER_MAP_INFO1_HW_PEER_ID,
  				       resp->peer_map_ev.info1);
@@ -837,7 +837,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  int ath11k_wmi_send_pdev_set_regdomain(struct ath11k *ar,
  				       struct pdev_set_regdomain_params *param)
  {
-@@ -6363,6 +6410,36 @@ static int ath11k_pull_peer_assoc_conf_e
+@@ -6436,6 +6483,36 @@ static int ath11k_pull_peer_assoc_conf_e
  	return 0;
  }
  
@@ -848,7 +848,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 +	const struct wmi_wds_addr_event *ev;
 +	int ret;
 +
-+	tb = ath11k_wmi_tlv_parse_alloc(ab, skb->data, skb->len, GFP_ATOMIC);
++	tb = ath11k_wmi_tlv_parse_alloc(ab, skb, GFP_ATOMIC);
 +	if (IS_ERR(tb)) {
 +		ret = PTR_ERR(tb);
 +		ath11k_warn(ab, "failed to parse tlv: %d\n", ret);
@@ -874,7 +874,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  static void ath11k_wmi_pull_pdev_stats_base(const struct wmi_pdev_stats_base *src,
  					    struct ath11k_fw_stats_pdev *dst)
  {
-@@ -7278,6 +7355,7 @@ static int ath11k_wmi_tlv_rdy_parse(stru
+@@ -7260,6 +7337,7 @@ static int ath11k_wmi_tlv_rdy_parse(stru
  
  		ether_addr_copy(ab->mac_addr,
  				fixed_param.ready_event_min.mac_addr.addr);
@@ -882,7 +882,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		ab->pktlog_defs_checksum = fixed_param.pktlog_defs_checksum;
  		break;
  	case WMI_TAG_ARRAY_FIXED_STRUCT:
-@@ -8797,6 +8875,22 @@ exit:
+@@ -8778,6 +8856,22 @@ exit:
  	kfree(tb);
  }
  
@@ -905,7 +905,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  static void ath11k_wmi_tlv_op_rx(struct ath11k_base *ab, struct sk_buff *skb)
  {
  	struct wmi_cmd_hdr *cmd_hdr;
-@@ -8927,6 +9021,9 @@ static void ath11k_wmi_tlv_op_rx(struct
+@@ -8908,6 +9002,9 @@ static void ath11k_wmi_tlv_op_rx(struct
  	case WMI_GTK_OFFLOAD_STATUS_EVENTID:
  		ath11k_wmi_gtk_offload_status_event(ab, skb);
  		break;
@@ -917,7 +917,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		break;
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
-@@ -3011,6 +3011,21 @@ struct wmi_peer_delete_cmd {
+@@ -3032,6 +3032,21 @@ struct wmi_peer_delete_cmd {
  	struct wmi_mac_addr peer_macaddr;
  } __packed;
  
@@ -939,7 +939,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  struct wmi_peer_reorder_queue_setup_cmd {
  	u32 tlv_header;
  	u32 vdev_id;
-@@ -4613,6 +4628,21 @@ struct wmi_probe_resp_tx_status_event {
+@@ -4635,6 +4650,21 @@ struct wmi_probe_resp_tx_status_event {
  	u32 tx_status;
  } __packed;
  
@@ -961,7 +961,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  /*
   * PDEV statistics
   */
-@@ -6412,6 +6442,9 @@ int ath11k_wmi_set_sta_ps_param(struct a
+@@ -6434,6 +6464,9 @@ int ath11k_wmi_set_sta_ps_param(struct a
  int ath11k_wmi_force_fw_hang_cmd(struct ath11k *ar, u32 type, u32 delay_time_ms);
  int ath11k_wmi_send_peer_delete_cmd(struct ath11k *ar,
  				    const u8 *peer_addr, u8 vdev_id);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/214-ath11k-qos-null-frame-tx-over-wmi.patch b/package/kernel/mac80211/patches/nss/ath11k/214-ath11k-qos-null-frame-tx-over-wmi.patch
index 5f31f4ded2358c..aca1676d6fcfa7 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/214-ath11k-qos-null-frame-tx-over-wmi.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/214-ath11k-qos-null-frame-tx-over-wmi.patch
@@ -22,7 +22,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -6129,6 +6129,16 @@ static int ath11k_mac_mgmt_tx_wmi(struct
+@@ -5915,6 +5915,16 @@ static int ath11k_mac_mgmt_tx_wmi(struct
  
  	ATH11K_SKB_CB(skb)->paddr = paddr;
  
@@ -39,7 +39,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	ret = ath11k_wmi_mgmt_send(ar, arvif->vdev_id, buf_id, skb);
  	if (ret) {
  		ath11k_warn(ar->ab, "failed to send mgmt frame: %d\n", ret);
-@@ -6196,8 +6206,8 @@ static void ath11k_mgmt_over_wmi_tx_work
+@@ -5982,8 +5992,8 @@ static void ath11k_mgmt_over_wmi_tx_work
  	}
  }
  
@@ -50,7 +50,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  {
  	struct sk_buff_head *q = &ar->wmi_mgmt_tx_queue;
  
-@@ -6259,7 +6269,7 @@ static void ath11k_mac_op_tx(struct ieee
+@@ -6045,7 +6055,7 @@ static void ath11k_mac_op_tx(struct ieee
  	} else if (ieee80211_is_mgmt(hdr->frame_control)) {
  		frm_type = FIELD_GET(IEEE80211_FCTL_STYPE, hdr->frame_control);
  		is_prb_rsp = ieee80211_is_probe_resp(hdr->frame_control);
@@ -59,7 +59,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  		if (ret) {
  			if (ret != -EBUSY)
  				ath11k_warn(ar->ab, "failed to queue management frame %d\n",
-@@ -6274,6 +6284,20 @@ static void ath11k_mac_op_tx(struct ieee
+@@ -6060,6 +6070,20 @@ static void ath11k_mac_op_tx(struct ieee
  			spin_unlock_bh(&ar->data_lock);
  		}
  		return;
@@ -147,7 +147,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  int ath11k_wmi_vdev_create(struct ath11k *ar, u8 *macaddr,
  			   struct vdev_create_params *param)
  {
-@@ -5905,8 +5954,8 @@ static int ath11k_pull_mgmt_rx_params_tl
+@@ -5978,8 +6027,8 @@ static int ath11k_pull_mgmt_rx_params_tl
  	return 0;
  }
  
@@ -158,7 +158,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  {
  	struct sk_buff *msdu;
  	struct ieee80211_tx_info *info;
-@@ -5944,6 +5993,11 @@ static int wmi_process_mgmt_tx_comp(stru
+@@ -6017,6 +6066,11 @@ static int wmi_process_mgmt_tx_comp(stru
  			info->status.ack_signal = tx_compl_param->ack_rssi;
  	}
  
@@ -170,7 +170,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	hdr = (struct ieee80211_hdr *)msdu->data;
  	frm_type = FIELD_GET(IEEE80211_FCTL_STYPE, hdr->frame_control);
  
-@@ -5962,10 +6016,13 @@ static int wmi_process_mgmt_tx_comp(stru
+@@ -6035,10 +6089,13 @@ static int wmi_process_mgmt_tx_comp(stru
  	arvif = ath11k_vif_to_arvif(vif);
  	mgmt_stats = &arvif->mgmt_stats;
  
@@ -188,7 +188,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	spin_unlock_bh(&ar->data_lock);
  
  skip_mgmt_stats:
-@@ -5987,12 +6044,13 @@ skip_mgmt_stats:
+@@ -6060,12 +6117,13 @@ skip_mgmt_stats:
  	return 0;
  }
  
@@ -205,8 +205,8 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
 +	const struct wmi_tx_compl_event *ev;
  	int ret;
  
- 	tb = ath11k_wmi_tlv_parse_alloc(ab, skb->data, skb->len, GFP_ATOMIC);
-@@ -6002,7 +6060,7 @@ static int ath11k_pull_mgmt_tx_compl_par
+ 	tb = ath11k_wmi_tlv_parse_alloc(ab, skb, GFP_ATOMIC);
+@@ -6075,7 +6133,7 @@ static int ath11k_pull_mgmt_tx_compl_par
  		return ret;
  	}
  
@@ -215,7 +215,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	if (!ev) {
  		ath11k_warn(ab, "failed to fetch mgmt tx compl ev");
  		kfree(tb);
-@@ -7810,10 +7868,11 @@ exit:
+@@ -7791,10 +7849,11 @@ exit:
  
  static void ath11k_mgmt_tx_compl_event(struct ath11k_base *ab, struct sk_buff *skb)
  {
@@ -229,7 +229,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  		ath11k_warn(ab, "failed to extract mgmt tx compl event");
  		return;
  	}
-@@ -7826,7 +7885,7 @@ static void ath11k_mgmt_tx_compl_event(s
+@@ -7807,7 +7866,7 @@ static void ath11k_mgmt_tx_compl_event(s
  		goto exit;
  	}
  
@@ -238,7 +238,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  
  	ath11k_dbg(ab, ATH11K_DBG_MGMT,
  		   "event mgmt tx compl ev pdev_id %d, desc_id %d, status %d ack_rssi %d",
-@@ -7837,6 +7896,36 @@ exit:
+@@ -7818,6 +7877,36 @@ exit:
  	rcu_read_unlock();
  }
  
@@ -275,7 +275,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  static struct ath11k *ath11k_get_ar_on_scan_state(struct ath11k_base *ab,
  						  u32 vdev_id,
  						  enum ath11k_scan_state state)
-@@ -9024,6 +9113,10 @@ static void ath11k_wmi_tlv_op_rx(struct
+@@ -9005,6 +9094,10 @@ static void ath11k_wmi_tlv_op_rx(struct
  	case WMI_WDS_PEER_EVENTID:
  		ath11k_wmi_wds_peer_event(ab, skb);
  		break;
@@ -288,7 +288,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  		break;
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
-@@ -363,6 +363,7 @@ enum wmi_tlv_cmd_id {
+@@ -380,6 +380,7 @@ enum wmi_tlv_cmd_id {
  	WMI_BSS_COLOR_CHANGE_ENABLE_CMDID,
  	WMI_VDEV_BCN_OFFLOAD_QUIET_CONFIG_CMDID,
  	WMI_FILS_DISCOVERY_TMPL_CMDID,
@@ -296,7 +296,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	WMI_ADDBA_CLEAR_RESP_CMDID = WMI_TLV_CMD(WMI_GRP_BA_NEG),
  	WMI_ADDBA_SEND_CMDID,
  	WMI_ADDBA_STATUS_CMDID,
-@@ -693,6 +694,8 @@ enum wmi_tlv_event_id {
+@@ -710,6 +711,8 @@ enum wmi_tlv_event_id {
  	WMI_TBTTOFFSET_EXT_UPDATE_EVENTID,
  	WMI_OFFCHAN_DATA_TX_COMPLETION_EVENTID,
  	WMI_HOST_FILS_DISCOVERY_EVENTID,
@@ -305,17 +305,17 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	WMI_TX_DELBA_COMPLETE_EVENTID = WMI_TLV_CMD(WMI_GRP_BA_NEG),
  	WMI_TX_ADDBA_COMPLETE_EVENTID,
  	WMI_BA_RSP_SSN_EVENTID,
-@@ -1880,6 +1883,9 @@ enum wmi_tlv_tag {
+@@ -1899,6 +1902,9 @@ enum wmi_tlv_tag {
  	WMI_TAG_PDEV_NON_SRG_OBSS_BSSID_ENABLE_BITMAP_CMD,
  	WMI_TAG_REGULATORY_RULE_EXT_STRUCT = 0x3A9,
  	WMI_TAG_REG_CHAN_LIST_CC_EXT_EVENT,
 +	/* TODO add all the missing cmds */
 +	WMI_TAG_QOS_NULL_FRAME_TX_SEND = 0x3A6,
 +	WMI_TAG_QOS_NULL_FRAME_TX_STATUS,
+ 	WMI_TAG_VDEV_SET_TPC_POWER_CMD = 0x3B5,
+ 	WMI_TAG_VDEV_CH_POWER_INFO,
  	WMI_TAG_PDEV_SET_BIOS_SAR_TABLE_CMD = 0x3D8,
- 	WMI_TAG_PDEV_SET_BIOS_GEO_TABLE_CMD,
- 	WMI_TAG_MAX
-@@ -2109,7 +2115,17 @@ enum wmi_tlv_service {
+@@ -2130,7 +2136,17 @@ enum wmi_tlv_service {
  	WMI_TLV_SERVICE_PEER_POWER_SAVE_DURATION_SUPPORT = 246,
  	WMI_TLV_SERVICE_SRG_SRP_SPATIAL_REUSE_SUPPORT = 249,
  	WMI_TLV_SERVICE_MBSS_PARAM_IN_VDEV_START_SUPPORT = 253,
@@ -333,7 +333,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  
  	/* The second 128 bits */
  	WMI_MAX_EXT_SERVICE = 256,
-@@ -3831,6 +3847,7 @@ struct wmi_scan_prob_req_oui_cmd {
+@@ -3877,6 +3893,7 @@ struct wmi_scan_prob_req_oui_cmd {
  }  __packed;
  
  #define WMI_MGMT_SEND_DOWNLD_LEN	64
@@ -341,7 +341,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  
  #define WMI_TX_PARAMS_DWORD0_POWER		GENMASK(7, 0)
  #define WMI_TX_PARAMS_DWORD0_MCS_MASK		GENMASK(19, 8)
-@@ -3841,9 +3858,10 @@ struct wmi_scan_prob_req_oui_cmd {
+@@ -3887,9 +3904,10 @@ struct wmi_scan_prob_req_oui_cmd {
  #define WMI_TX_PARAMS_DWORD1_BW_MASK		GENMASK(14, 8)
  #define WMI_TX_PARAMS_DWORD1_PREAMBLE_TYPE	GENMASK(19, 15)
  #define WMI_TX_PARAMS_DWORD1_FRAME_TYPE		BIT(20)
@@ -354,7 +354,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	u32 tlv_header;
  	u32 tx_params_dword0;
  	u32 tx_params_dword1;
-@@ -4959,7 +4977,7 @@ struct wmi_rssi_ctl_ext {
+@@ -4981,7 +4999,7 @@ struct wmi_rssi_ctl_ext {
  	u32 rssi_ctl_ext[MAX_ANTENNA_EIGHT - ATH_MAX_ANTENNA];
  };
  
@@ -363,7 +363,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	u32 desc_id;
  	u32 status;
  	u32 pdev_id;
-@@ -5790,6 +5808,17 @@ struct wmi_debug_log_config_cmd_fixed_pa
+@@ -5813,6 +5831,17 @@ struct wmi_debug_log_config_cmd_fixed_pa
  	u32 value;
  } __packed;
  
@@ -381,7 +381,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  #define WMI_MAX_MEM_REQS 32
  
  #define MAX_RADIOS 3
-@@ -6400,6 +6429,8 @@ int ath11k_wmi_cmd_send(struct ath11k_pd
+@@ -6422,6 +6451,8 @@ int ath11k_wmi_cmd_send(struct ath11k_pd
  struct sk_buff *ath11k_wmi_alloc_skb(struct ath11k_wmi_base *wmi_sc, u32 len);
  int ath11k_wmi_mgmt_send(struct ath11k *ar, u32 vdev_id, u32 buf_id,
  			 struct sk_buff *frame);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch b/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
index 7e922f6aef9e50..6581ca9653a081 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
@@ -33,7 +33,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -389,6 +389,7 @@ struct ath11k_vif {
+@@ -427,6 +427,7 @@ struct ath11k_vif {
  #ifdef CPTCFG_ATH11K_NSS_SUPPORT
  	struct arvif_nss nss;
  #endif
@@ -43,7 +43,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  struct ath11k_vif_iter {
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -4739,6 +4739,11 @@ static void ath11k_sta_rc_update_wk(stru
+@@ -4755,6 +4755,11 @@ static void ath11k_sta_rc_update_wk(stru
  	arvif = arsta->arvif;
  	ar = arvif->ar;
  
@@ -55,7 +55,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	if (WARN_ON(ath11k_mac_vif_chan(arvif->vif, &def)))
  		return;
  
-@@ -4910,17 +4915,28 @@ err_rc_bw_changed:
+@@ -4924,17 +4929,28 @@ err_rc_bw_changed:
  static void ath11k_sta_set_4addr_wk(struct work_struct *wk)
  {
  	struct ath11k *ar;
@@ -86,7 +86,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		   "setting USE_4ADDR for peer %pM\n", sta->addr);
  
  	ret = ath11k_wmi_set_peer_param(ar, sta->addr,
-@@ -4928,8 +4944,93 @@ static void ath11k_sta_set_4addr_wk(stru
+@@ -4942,8 +4958,93 @@ static void ath11k_sta_set_4addr_wk(stru
  					WMI_PEER_USE_4ADDR, 1);
  
  	if (ret)
@@ -181,7 +181,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  }
  
  static int ath11k_mac_inc_num_stations(struct ath11k_vif *arvif,
-@@ -5259,9 +5360,32 @@ static void ath11k_mac_op_sta_set_4addr(
+@@ -5045,9 +5146,32 @@ static void ath11k_mac_op_sta_set_4addr(
  					struct ieee80211_sta *sta, bool enabled)
  {
  	struct ath11k *ar = hw->priv;
@@ -214,7 +214,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		ieee80211_queue_work(ar->hw, &arsta->set_4addr_wk);
  		arsta->use_4addr_set = true;
  	}
-@@ -6641,6 +6765,9 @@ static int ath11k_mac_op_update_vif_offl
+@@ -6427,6 +6551,9 @@ static int ath11k_mac_op_update_vif_offl
  	u32 param_id, param_value;
  	int ret;
  
@@ -224,7 +224,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	param_id = WMI_VDEV_PARAM_TX_ENCAP_TYPE;
  	if (ath11k_frame_mode != ATH11K_HW_TXRX_ETHERNET ||
  	    (vif->type != NL80211_IFTYPE_STATION &&
-@@ -6861,7 +6988,8 @@ static int ath11k_mac_op_add_interface(s
+@@ -6647,7 +6774,8 @@ static int ath11k_mac_op_add_interface(s
  		goto err;
  	}
  
@@ -234,7 +234,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		ath11k_warn(ab, "failed to create vdev %u, reached max vdev limit %d\n",
  			    ar->num_created_vdevs, TARGET_NUM_VDEVS(ab));
  		ret = -EBUSY;
-@@ -6881,6 +7009,28 @@ static int ath11k_mac_op_add_interface(s
+@@ -6660,6 +6788,28 @@ static int ath11k_mac_op_add_interface(s
  	arvif->vif = vif;
  
  	INIT_LIST_HEAD(&arvif->list);
@@ -263,7 +263,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	INIT_DELAYED_WORK(&arvif->connection_loss_work,
  			  ath11k_mac_vif_sta_connection_loss_work);
  
-@@ -6910,6 +7060,7 @@ static int ath11k_mac_op_add_interface(s
+@@ -6689,6 +6839,7 @@ static int ath11k_mac_op_add_interface(s
  		fallthrough;
  	case NL80211_IFTYPE_AP:
  		arvif->vdev_type = WMI_VDEV_TYPE_AP;
@@ -271,7 +271,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		break;
  	case NL80211_IFTYPE_MONITOR:
  		arvif->vdev_type = WMI_VDEV_TYPE_MONITOR;
-@@ -7132,13 +7283,30 @@ static void ath11k_mac_op_remove_interfa
+@@ -6917,13 +7068,30 @@ static void ath11k_mac_op_remove_interfa
  	struct ath11k *ar = hw->priv;
  	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
  	struct ath11k_base *ab = ar->ab;
@@ -304,7 +304,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	ath11k_dbg(ab, ATH11K_DBG_MAC, "remove interface (vdev %d)\n",
  		   arvif->vdev_id);
  
-@@ -7155,6 +7323,14 @@ static void ath11k_mac_op_remove_interfa
+@@ -6940,6 +7108,14 @@ static void ath11k_mac_op_remove_interfa
  		if (ret)
  			ath11k_warn(ab, "failed to submit AP self-peer removal on vdev %d: %d\n",
  				    arvif->vdev_id, ret);
@@ -319,9 +319,9 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	}
  
  	ret = ath11k_mac_vdev_delete(ar, arvif);
-@@ -7198,8 +7374,7 @@ err_vdev_del:
- 
- 	ath11k_debugfs_remove_interface(arvif);
+@@ -6981,8 +7157,7 @@ err_vdev_del:
+ 	/* Recalc txpower for remaining vdev */
+ 	ath11k_mac_txpower_recalc(ar);
  
 -	/* TODO: recal traffic pause state based on the available vdevs */
 -
@@ -329,7 +329,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	mutex_unlock(&ar->conf_mutex);
  }
  
-@@ -7259,16 +7434,17 @@ static int ath11k_mac_op_ampdu_action(st
+@@ -7042,16 +7217,17 @@ static int ath11k_mac_op_ampdu_action(st
  				      struct ieee80211_ampdu_params *params)
  {
  	struct ath11k *ar = hw->priv;
@@ -349,7 +349,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		break;
  	case IEEE80211_AMPDU_TX_START:
  	case IEEE80211_AMPDU_TX_STOP_CONT:
-@@ -8791,6 +8967,7 @@ static void ath11k_mac_op_sta_statistics
+@@ -9056,6 +9232,7 @@ static void ath11k_mac_op_sta_statistics
  {
  	struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);
  	struct ath11k *ar = arsta->arvif->ar;
@@ -357,7 +357,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	s8 signal;
  	bool db2dbm = test_bit(WMI_TLV_SERVICE_HW_DB2DBM_CONVERSION_SUPPORT,
  			       ar->ab->wmi_ab.svc_map);
-@@ -8847,7 +9024,8 @@ static void ath11k_mac_op_sta_statistics
+@@ -9112,7 +9289,8 @@ static void ath11k_mac_op_sta_statistics
  		ATH11K_DEFAULT_NOISE_FLOOR;
  	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
  
@@ -369,7 +369,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  #if IS_ENABLED(CONFIG_IPV6)
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
-@@ -5082,6 +5082,8 @@ enum wmi_vdev_subtype {
+@@ -5105,6 +5105,8 @@ enum wmi_vdev_subtype {
  	WMI_VDEV_SUBTYPE_MESH_11S,
  };
  
@@ -380,7 +380,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	WMI_STA_PS_PARAM_TX_WAKE_THRESHOLD = 1,
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -1121,12 +1121,13 @@ err_mem_free:
+@@ -1122,12 +1122,13 @@ err_mem_free:
  	return ret;
  }
  
@@ -396,7 +396,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	int ret;
  
  	ret = ath11k_peer_rx_tid_setup(ar, params->sta->addr, vdev_id,
-@@ -1138,13 +1139,13 @@ int ath11k_dp_rx_ampdu_start(struct ath1
+@@ -1139,13 +1140,13 @@ int ath11k_dp_rx_ampdu_start(struct ath1
  	return ret;
  }
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/236-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch b/package/kernel/mac80211/patches/nss/ath11k/236-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch
index 750fd2b239d548..b9e89bae07f942 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/236-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/236-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch
@@ -36,7 +36,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -99,6 +99,11 @@ enum ath11k_crypt_mode {
+@@ -102,6 +102,11 @@ enum ath11k_crypt_mode {
  	ATH11K_CRYPT_MODE_SW,
  };
  
@@ -48,7 +48,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  static inline enum wme_ac ath11k_tid_to_ac(u32 tid)
  {
  	return (((tid == 0) || (tid == 3)) ? WME_AC_BE :
-@@ -326,6 +331,20 @@ struct ath11k_mgmt_frame_stats {
+@@ -367,6 +372,20 @@ struct ath11k_mgmt_frame_stats {
  	u32 tx_compl_fail[ATH11K_STATS_MGMT_FRM_TYPE_MAX];
  };
  
@@ -69,7 +69,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  struct ath11k_vif {
  	u32 vdev_id;
  	enum wmi_vdev_type vdev_type;
-@@ -390,6 +409,11 @@ struct ath11k_vif {
+@@ -428,6 +447,11 @@ struct ath11k_vif {
  	struct arvif_nss nss;
  #endif
  	struct list_head ap_vlan_arvifs;
@@ -83,7 +83,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  struct ath11k_vif_iter {
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -346,6 +346,10 @@ enum nl80211_he_gi ath11k_mac_he_gi_to_n
+@@ -343,6 +343,10 @@ enum nl80211_he_gi ath11k_mac_he_gi_to_n
  	return ret;
  }
  
@@ -94,7 +94,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  u8 ath11k_mac_bw_to_mac80211_bw(u8 bw)
  {
  	u8 ret = 0;
-@@ -718,6 +722,33 @@ u8 ath11k_mac_get_target_pdev_id(struct
+@@ -715,6 +719,33 @@ u8 ath11k_mac_get_target_pdev_id(struct
  		return ar->ab->target_pdev_ids[0].pdev_id;
  }
  
@@ -128,7 +128,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  static void ath11k_pdev_caps_update(struct ath11k *ar)
  {
  	struct ath11k_base *ab = ar->ab;
-@@ -4167,6 +4198,9 @@ static int ath11k_install_key(struct ath
+@@ -4175,6 +4206,9 @@ static int ath11k_install_key(struct ath
  	if (test_bit(ATH11K_FLAG_HW_CRYPTO_DISABLED, &ar->ab->dev_flags))
  		return 0;
  
@@ -138,7 +138,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	if (cmd == DISABLE_KEY) {
  		arg.key_cipher = WMI_CIPHER_NONE;
  		arg.key_data = NULL;
-@@ -4256,15 +4290,40 @@ static int ath11k_clear_peer_keys(struct
+@@ -4264,15 +4298,40 @@ static int ath11k_clear_peer_keys(struct
  	return first_errno;
  }
  
@@ -181,7 +181,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	const u8 *peer_addr;
  	int ret = 0;
  	u32 flags = 0;
-@@ -4282,17 +4341,38 @@ static int ath11k_mac_op_set_key(struct
+@@ -4290,17 +4349,38 @@ static int ath11k_mac_op_set_key(struct
  	if (key->keyidx > WMI_MAX_KEY_INDEX)
  		return -ENOSPC;
  
@@ -224,7 +224,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	/* the peer should not disappear in mid-way (unless FW goes awry) since
  	 * we already hold conf_mutex. we just make sure its there now.
  	 */
-@@ -4337,6 +4417,74 @@ static int ath11k_mac_op_set_key(struct
+@@ -4345,6 +4425,74 @@ static int ath11k_mac_op_set_key(struct
  		goto exit;
  	}
  
@@ -299,7 +299,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	spin_lock_bh(&ab->base_lock);
  	peer = ath11k_peer_find(ab, arvif->vdev_id, peer_addr);
  
-@@ -4359,6 +4507,27 @@ static int ath11k_mac_op_set_key(struct
+@@ -4367,6 +4515,27 @@ static int ath11k_mac_op_set_key(struct
  		goto unlock;
  	}
  
@@ -327,7 +327,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	if (peer && cmd == SET_KEY) {
  		peer->keys[key->keyidx] = key;
  		if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
-@@ -4368,18 +4537,23 @@ static int ath11k_mac_op_set_key(struct
+@@ -4376,18 +4545,23 @@ static int ath11k_mac_op_set_key(struct
  			peer->mcast_keyidx = key->keyidx;
  			peer->sec_type_grp = ath11k_dp_tx_get_encrypt_type(key->cipher);
  		}
@@ -354,85 +354,16 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
  		switch (key->cipher) {
  		case WLAN_CIPHER_SUITE_TKIP:
-@@ -5186,6 +5360,33 @@ static u32 ath11k_mac_ieee80211_sta_bw_t
- 	return bw;
- }
- 
-+static int ath11k_mac_cfg_dyn_vlan(struct ath11k_base *ab,
-+				   struct ath11k_vif *ap_vlan_arvif,
-+				   struct ieee80211_sta *sta)
-+{
-+	struct ath11k_peer *peer;
-+	int peer_id, ret;
-+
-+	spin_lock_bh(&ab->base_lock);
-+	peer = ath11k_peer_find_by_addr(ab, sta->addr);
-+	if (!peer) {
-+		ath11k_warn(ab, "failed to find peer for %pM\n", sta->addr);
-+		spin_unlock_bh(&ab->base_lock);
-+		return -EINVAL;
-+	}
-+	peer_id = peer->peer_id;
-+	spin_unlock_bh(&ab->base_lock);
-+
-+	ret = ath11k_nss_ext_vdev_wds_4addr_allow(ap_vlan_arvif, peer_id);
-+	if (ret) {
-+		ath11k_warn(ab, "failed to set 4addr allow for %pM:%d\n",
-+			    sta->addr, ret);
-+		return ret;
-+	}
-+
-+	return ret;
-+}
-+
- static int ath11k_mac_op_sta_state(struct ieee80211_hw *hw,
- 				   struct ieee80211_vif *vif,
- 				   struct ieee80211_sta *sta,
-@@ -5295,6 +5496,34 @@ static int ath11k_mac_op_sta_state(struc
- 			if (ret)
- 				ath11k_warn(ar->ab, "Unable to authorize peer %pM vdev %d: %d\n",
- 					    sta->addr, arvif->vdev_id, ret);
-+		} else if (ar->ab->nss.enabled &&
-+			   vif->type == NL80211_IFTYPE_AP_VLAN &&
-+			   !arsta->use_4addr_set) {
-+
-+			if (ar->state == ATH11K_STATE_RESTARTED) {
-+				/* During ieee80211_reconfig(), at this point, nss ext vdev peer is not
-+				 * authorized. Hence ath11k_mac_cfg_dyn_vlan() will return error. We save
-+				 * the state vars here and use it later once nss ext vdev is authorized
-+				 * in ath11k_mac_op_set_key() */
-+				struct ath11k_dyn_vlan_cfg *ar_dyn_vlan_cfg;
-+				ar_dyn_vlan_cfg = kzalloc(sizeof(*ar_dyn_vlan_cfg), GFP_ATOMIC);
-+
-+				if (!ar_dyn_vlan_cfg) {
-+					ath11k_warn(ar->ab, "failed to save state for dynamic AP_VLAN configuration (%d)",
-+						    -ENOSPC);
-+				} else {
-+					INIT_LIST_HEAD(&ar_dyn_vlan_cfg->cfg_list);
-+					ar_dyn_vlan_cfg->arvif = arvif;
-+					ar_dyn_vlan_cfg->sta = sta;
-+					/* save it to arvif (AP_VLAN) list */
-+					list_add_tail(&ar_dyn_vlan_cfg->cfg_list, &arvif->dyn_vlan_cfg);
-+				}
-+			} else {
-+				ret = ath11k_mac_cfg_dyn_vlan(ar->ab, arvif, sta);
-+				if (ret)
-+					ath11k_warn(ar->ab, "failed to cfg dyn vlan for peer %pM: %d\n",
-+						    sta->addr, ret);
-+			}
- 		}
- 	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
- 		   new_state == IEEE80211_STA_ASSOC) {
-@@ -7013,7 +7242,7 @@ static int ath11k_mac_op_add_interface(s
+@@ -6792,7 +6966,7 @@ static int ath11k_mac_op_add_interface(s
  	if ((vif->type == NL80211_IFTYPE_AP_VLAN ||
  	     vif->type == NL80211_IFTYPE_STATION) && ab->nss.enabled) {
  		if (ath11k_frame_mode == ATH11K_HW_TXRX_ETHERNET &&
 -		    ieee80211_set_hw_80211_encap(vif, true)) {
-+		(vif->offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED)) {
++		   (vif->offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED)) {
  			vif->offload_flags |= IEEE80211_OFFLOAD_ENCAP_4ADDR;
  			arvif->nss.encap = ATH11K_HW_TXRX_ETHERNET;
  			arvif->nss.decap = ATH11K_HW_TXRX_ETHERNET;
-@@ -7026,6 +7255,7 @@ static int ath11k_mac_op_add_interface(s
+@@ -6805,6 +6979,7 @@ static int ath11k_mac_op_add_interface(s
  					    vif->addr, ret);
  				goto err;
  			}
@@ -440,7 +371,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  			mutex_unlock(&ar->conf_mutex);
  			return ret;
  		}
-@@ -7050,6 +7280,20 @@ static int ath11k_mac_op_add_interface(s
+@@ -6829,6 +7004,20 @@ static int ath11k_mac_op_add_interface(s
  	arvif->vdev_id = bit;
  	arvif->vdev_subtype = WMI_VDEV_SUBTYPE_NONE;
  
@@ -461,7 +392,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	switch (vif->type) {
  	case NL80211_IFTYPE_UNSPECIFIED:
  	case NL80211_IFTYPE_STATION:
-@@ -7090,7 +7334,7 @@ static int ath11k_mac_op_add_interface(s
+@@ -6869,7 +7058,7 @@ static int ath11k_mac_op_add_interface(s
  	if (ret) {
  		ath11k_warn(ab, "failed to create WMI vdev %d: %d\n",
  			    arvif->vdev_id, ret);
@@ -470,7 +401,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	}
  
  	ar->num_created_vdevs++;
-@@ -7249,7 +7493,7 @@ err_peer_del:
+@@ -7034,7 +7223,7 @@ err_peer_del:
  		if (fbret) {
  			ath11k_warn(ar->ab, "fallback fail to delete peer addr %pM vdev_id %d ret %d\n",
  				    vif->addr, arvif->vdev_id, fbret);
@@ -479,7 +410,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		}
  	}
  
-@@ -7260,6 +7504,8 @@ err_vdev_del:
+@@ -7045,6 +7234,8 @@ err_vdev_del:
  	list_del(&arvif->list);
  	spin_unlock_bh(&ar->data_lock);
  
@@ -488,7 +419,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  err:
  	mutex_unlock(&ar->conf_mutex);
  
-@@ -7357,6 +7603,7 @@ err_vdev_del:
+@@ -7142,6 +7333,7 @@ err_vdev_del:
  	list_del(&arvif->list);
  	spin_unlock_bh(&ar->data_lock);
  
@@ -496,7 +427,76 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	ath11k_peer_cleanup(ar, arvif->vdev_id);
  
  	idr_for_each(&ar->txmgmt_idr,
-@@ -9956,8 +10203,11 @@ static int __ath11k_mac_register(struct
+@@ -9835,6 +10027,33 @@ static int ath11k_mac_station_remove(str
+ 	return ret;
+ }
+ 
++static int ath11k_mac_cfg_dyn_vlan(struct ath11k_base *ab,
++				   struct ath11k_vif *ap_vlan_arvif,
++				   struct ieee80211_sta *sta)
++{
++	struct ath11k_peer *peer;
++	int peer_id, ret;
++
++	spin_lock_bh(&ab->base_lock);
++	peer = ath11k_peer_find_by_addr(ab, sta->addr);
++	if (!peer) {
++		ath11k_warn(ab, "failed to find peer for %pM\n", sta->addr);
++		spin_unlock_bh(&ab->base_lock);
++		return -EINVAL;
++	}
++	peer_id = peer->peer_id;
++	spin_unlock_bh(&ab->base_lock);
++
++	ret = ath11k_nss_ext_vdev_wds_4addr_allow(ap_vlan_arvif, peer_id);
++	if (ret) {
++		ath11k_warn(ab, "failed to set 4addr allow for %pM:%d\n",
++			    sta->addr, ret);
++		return ret;
++	}
++
++	return ret;
++}
++
+ static int ath11k_mac_op_sta_state(struct ieee80211_hw *hw,
+ 				   struct ieee80211_vif *vif,
+ 				   struct ieee80211_sta *sta,
+@@ -9924,6 +10143,34 @@ static int ath11k_mac_op_sta_state(struc
+ 			if (ret)
+ 				ath11k_warn(ar->ab, "Unable to authorize peer %pM vdev %d: %d\n",
+ 					    sta->addr, arvif->vdev_id, ret);
++		} else if (ar->ab->nss.enabled &&
++			   vif->type == NL80211_IFTYPE_AP_VLAN &&
++			   !arsta->use_4addr_set) {
++
++			if (ar->state == ATH11K_STATE_RESTARTED) {
++				/* During ieee80211_reconfig(), at this point, nss ext vdev peer is not
++				 * authorized. Hence ath11k_mac_cfg_dyn_vlan() will return error. We save
++				 * the state vars here and use it later once nss ext vdev is authorized
++				 * in ath11k_mac_op_set_key() */
++				struct ath11k_dyn_vlan_cfg *ar_dyn_vlan_cfg;
++				ar_dyn_vlan_cfg = kzalloc(sizeof(*ar_dyn_vlan_cfg), GFP_ATOMIC);
++
++				if (!ar_dyn_vlan_cfg) {
++					ath11k_warn(ar->ab, "failed to save state for dynamic AP_VLAN configuration (%d)",
++						    -ENOSPC);
++				} else {
++					INIT_LIST_HEAD(&ar_dyn_vlan_cfg->cfg_list);
++					ar_dyn_vlan_cfg->arvif = arvif;
++					ar_dyn_vlan_cfg->sta = sta;
++					/* save it to arvif (AP_VLAN) list */
++					list_add_tail(&ar_dyn_vlan_cfg->cfg_list, &arvif->dyn_vlan_cfg);
++				}
++			} else {
++				ret = ath11k_mac_cfg_dyn_vlan(ar->ab, arvif, sta);
++				if (ret)
++					ath11k_warn(ar->ab, "failed to cfg dyn vlan for peer %pM: %d\n",
++						    sta->addr, ret);
++			}
+ 		}
+ 
+ 		if (!ret &&
+@@ -10535,8 +10782,11 @@ static int __ath11k_mac_register(struct
  	    ab->hw_params.bios_sar_capa)
  		ar->hw->wiphy->sar_capa = ab->hw_params.bios_sar_capa;
  
@@ -519,7 +519,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
  	if (arg->key_rsc_counter)
  		memcpy(&cmd->key_rsc_counter, &arg->key_rsc_counter,
-@@ -4213,6 +4214,7 @@ ath11k_wmi_copy_resource_config(struct w
+@@ -4276,6 +4277,7 @@ ath11k_wmi_copy_resource_config(struct w
  	wmi_cfg->flags2 = WMI_RSRC_CFG_FLAG2_CALC_NEXT_DTIM_COUNT_SET;
  	wmi_cfg->ema_max_vap_cnt = tg_cfg->ema_max_vap_cnt;
  	wmi_cfg->ema_max_profile_period = tg_cfg->ema_max_profile_period;
@@ -527,7 +527,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  }
  
  static int ath11k_init_cmd_send(struct ath11k_pdev_wmi *wmi,
-@@ -4435,6 +4437,9 @@ int ath11k_wmi_cmd_init(struct ath11k_ba
+@@ -4498,6 +4500,9 @@ int ath11k_wmi_cmd_init(struct ath11k_ba
  	memset(&init_param, 0, sizeof(init_param));
  	memset(&config, 0, sizeof(config));
  
@@ -539,7 +539,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	if (test_bit(WMI_TLV_SERVICE_REG_CC_EXT_EVENT_SUPPORT,
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
-@@ -3703,6 +3703,7 @@ struct wmi_vdev_install_key_arg {
+@@ -3749,6 +3749,7 @@ struct wmi_vdev_install_key_arg {
  	u32 vdev_id;
  	const u8 *macaddr;
  	u32 key_idx;
@@ -547,7 +547,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	u32 key_flags;
  	u32 key_cipher;
  	u32 key_len;
-@@ -5786,6 +5787,7 @@ struct target_resource_config {
+@@ -5809,6 +5810,7 @@ struct target_resource_config {
  	u32 bpf_instruction_size;
  	u32 max_bssid_rx_filters;
  	u32 use_pdev_id;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/237-001-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch b/package/kernel/mac80211/patches/nss/ath11k/237-001-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
index 0362ff8caa5d0e..0ce88c62ec55c6 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/237-001-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/237-001-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -1076,6 +1076,7 @@ struct ath11k_base {
+@@ -1126,6 +1126,7 @@ struct ath11k_base {
  	u32 max_ast_index;
  	u32 num_ast_entries;
  
@@ -10,7 +10,7 @@
  };
 --- a/drivers/net/wireless/ath/ath11k/debugfs.c
 +++ b/drivers/net/wireless/ath/ath11k/debugfs.c
-@@ -973,6 +973,79 @@ static const struct file_operations fops
+@@ -974,6 +974,79 @@ static const struct file_operations fops
  	.llseek = default_llseek,
  };
  
@@ -90,7 +90,7 @@
  int ath11k_debugfs_pdev_create(struct ath11k_base *ab)
  {
  	if (test_bit(ATH11K_FLAG_REGISTERED, &ab->dev_flags))
-@@ -1022,6 +1095,8 @@ int ath11k_debugfs_soc_create(struct ath
+@@ -1023,6 +1096,8 @@ int ath11k_debugfs_soc_create(struct ath
  		ret = PTR_ERR(ab->debugfs_soc);
  		goto out;
  	}
diff --git a/package/kernel/mac80211/patches/nss/ath11k/237-003-ath11k-allocate-dst-ring-descriptors-from-cacheable-.patch b/package/kernel/mac80211/patches/nss/ath11k/237-003-ath11k-allocate-dst-ring-descriptors-from-cacheable-.patch
index db2bbfa0d2845d..2342ebcba910db 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/237-003-ath11k-allocate-dst-ring-descriptors-from-cacheable-.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/237-003-ath11k-allocate-dst-ring-descriptors-from-cacheable-.patch
@@ -54,7 +54,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		tx_ring->tx_status_head =
 --- a/drivers/net/wireless/ath/ath11k/hal.c
 +++ b/drivers/net/wireless/ath/ath11k/hal.c
-@@ -653,7 +653,8 @@ u32 *ath11k_hal_srng_dst_get_next_entry(
+@@ -668,7 +668,8 @@ u32 *ath11k_hal_srng_dst_get_next_entry(
  
  	desc = srng->ring_base_vaddr + srng->u.dst_ring.tp;
  
@@ -64,7 +64,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  
  	/* wrap around to start of ring*/
  	if (srng->u.dst_ring.tp == srng->ring_size)
-@@ -666,8 +667,63 @@ u32 *ath11k_hal_srng_dst_get_next_entry(
+@@ -681,8 +682,63 @@ u32 *ath11k_hal_srng_dst_get_next_entry(
  	return desc;
  }
  
@@ -131,7 +131,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  
 --- a/drivers/net/wireless/ath/ath11k/hal.h
 +++ b/drivers/net/wireless/ath/ath11k/hal.h
-@@ -945,8 +945,12 @@ void ath11k_hal_srng_get_params(struct a
+@@ -946,8 +946,12 @@ void ath11k_hal_srng_get_params(struct a
  u32 *ath11k_hal_srng_dst_get_next_entry(struct ath11k_base *ab,
  					struct hal_srng *srng);
  u32 *ath11k_hal_srng_dst_peek(struct ath11k_base *ab, struct hal_srng *srng);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch b/package/kernel/mac80211/patches/nss/ath11k/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
index d25e43ec0b3998..7692d633bc3798 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
@@ -23,7 +23,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -143,6 +143,7 @@ struct ath11k_skb_rxcb {
+@@ -146,6 +146,7 @@ struct ath11k_skb_rxcb {
  	u8 tid;
  	u16 peer_id;
  	u16 seq_no;
@@ -33,7 +33,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  enum ath11k_hw_rev {
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -340,6 +340,12 @@ static int ath11k_dp_purge_mon_ring(stru
+@@ -341,6 +341,12 @@ static int ath11k_dp_purge_mon_ring(stru
  	return -ETIMEDOUT;
  }
  
@@ -46,7 +46,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  /* Returns number of Rx buffers replenished */
  int ath11k_dp_rxbufs_replenish(struct ath11k_base *ab, int mac_id,
  			       struct dp_rxdma_ring *rx_ring,
-@@ -1664,7 +1670,7 @@ int ath11k_dp_htt_tlv_iter(struct ath11k
+@@ -1665,7 +1671,7 @@ int ath11k_dp_htt_tlv_iter(struct ath11k
  		len -= sizeof(*tlv);
  
  		if (tlv_len > len) {
@@ -55,7 +55,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  				   tlv_tag, ptr - begin, len, tlv_len);
  			return -EINVAL;
  		}
-@@ -2454,10 +2460,60 @@ ath11k_dp_rx_h_find_peer(struct ath11k_b
+@@ -2455,10 +2461,60 @@ ath11k_dp_rx_h_find_peer(struct ath11k_b
  	return peer;
  }
  
@@ -117,7 +117,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  {
  	bool  fill_crypto_hdr;
  	enum hal_encrypt_type enctype;
-@@ -2468,9 +2524,13 @@ static void ath11k_dp_rx_h_mpdu(struct a
+@@ -2469,9 +2525,13 @@ static void ath11k_dp_rx_h_mpdu(struct a
  	struct rx_attention *rx_attention;
  	u32 err_bitmap;
  
@@ -132,7 +132,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	rxcb->is_mcbc = fill_crypto_hdr;
  
  	if (rxcb->is_mcbc) {
-@@ -2481,6 +2541,26 @@ static void ath11k_dp_rx_h_mpdu(struct a
+@@ -2482,6 +2542,26 @@ static void ath11k_dp_rx_h_mpdu(struct a
  	spin_lock_bh(&ar->ab->base_lock);
  	peer = ath11k_dp_rx_h_find_peer(ar->ab, msdu);
  	if (peer) {
@@ -159,7 +159,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		if (rxcb->is_mcbc)
  			enctype = peer->sec_type_grp;
  		else
-@@ -2490,6 +2570,8 @@ static void ath11k_dp_rx_h_mpdu(struct a
+@@ -2491,6 +2571,8 @@ static void ath11k_dp_rx_h_mpdu(struct a
  	}
  	spin_unlock_bh(&ar->ab->base_lock);
  
@@ -168,7 +168,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	rx_attention = ath11k_dp_rx_get_attention(ar->ab, rx_desc);
  	err_bitmap = ath11k_dp_rx_h_attn_mpdu_err(rx_attention);
  	if (enctype != HAL_ENCRYPT_TYPE_OPEN && !err_bitmap)
-@@ -2731,7 +2813,8 @@ static void ath11k_dp_rx_deliver_msdu(st
+@@ -2732,7 +2814,8 @@ static void ath11k_dp_rx_deliver_msdu(st
  static int ath11k_dp_rx_process_msdu(struct ath11k *ar,
  				     struct sk_buff *msdu,
  				     struct sk_buff_head *msdu_list,
@@ -178,7 +178,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  {
  	struct ath11k_base *ab = ar->ab;
  	struct hal_rx_desc *rx_desc, *lrx_desc;
-@@ -2798,8 +2881,13 @@ static int ath11k_dp_rx_process_msdu(str
+@@ -2799,8 +2882,13 @@ static int ath11k_dp_rx_process_msdu(str
  		}
  	}
  
@@ -193,7 +193,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  
  	rx_status->flag |= RX_FLAG_SKIP_MONITOR | RX_FLAG_DUP_VALIDATED;
  
-@@ -2814,10 +2902,12 @@ static void ath11k_dp_rx_process_receive
+@@ -2815,10 +2903,12 @@ static void ath11k_dp_rx_process_receive
  						  struct sk_buff_head *msdu_list,
  						  int mac_id)
  {
@@ -206,7 +206,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  
  	if (skb_queue_empty(msdu_list))
  		return;
-@@ -2834,7 +2924,12 @@ static void ath11k_dp_rx_process_receive
+@@ -2835,7 +2925,12 @@ static void ath11k_dp_rx_process_receive
  	}
  
  	while ((msdu = __skb_dequeue(msdu_list))) {
@@ -220,7 +220,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		if (unlikely(ret)) {
  			ath11k_dbg(ab, ATH11K_DBG_DATA,
  				   "Unable to process msdu %d", ret);
-@@ -2842,7 +2937,10 @@ static void ath11k_dp_rx_process_receive
+@@ -2843,7 +2938,10 @@ static void ath11k_dp_rx_process_receive
  			continue;
  		}
  
@@ -232,7 +232,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	}
  }
  
-@@ -2851,11 +2949,12 @@ void ath11k_dp_rx_from_nss(struct ath11k
+@@ -2852,11 +2950,12 @@ void ath11k_dp_rx_from_nss(struct ath11k
  {
  	struct ieee80211_rx_status rx_status = {0};
  	struct ath11k_skb_rxcb *rxcb;
@@ -246,7 +246,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  
  	rx_status.flag |= RX_FLAG_SKIP_MONITOR | RX_FLAG_DUP_VALIDATED;
  
-@@ -4322,6 +4421,7 @@ static int ath11k_dp_rx_h_null_q_desc(st
+@@ -4324,6 +4423,7 @@ static int ath11k_dp_rx_h_null_q_desc(st
  				      struct ieee80211_rx_status *status,
  				      struct sk_buff_head *msdu_list)
  {
@@ -254,7 +254,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	u16 msdu_len;
  	struct hal_rx_desc *desc = (struct hal_rx_desc *)msdu->data;
  	struct rx_attention *rx_attention;
-@@ -4371,7 +4471,8 @@ static int ath11k_dp_rx_h_null_q_desc(st
+@@ -4373,7 +4473,8 @@ static int ath11k_dp_rx_h_null_q_desc(st
  	}
  	ath11k_dp_rx_h_ppdu(ar, desc, status);
  
@@ -318,7 +318,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	.rx_desc_get_mpdu_fc_valid = ath11k_hw_qcn9074_rx_desc_get_mpdu_fc_valid,
 --- a/drivers/net/wireless/ath/ath11k/hw.h
 +++ b/drivers/net/wireless/ath/ath11k/hw.h
-@@ -260,6 +260,7 @@ struct ath11k_hw_ops {
+@@ -261,6 +261,7 @@ struct ath11k_hw_ops {
  	u32 (*rx_desc_get_encrypt_type)(struct hal_rx_desc *desc);
  	u8 (*rx_desc_get_decap_type)(struct hal_rx_desc *desc);
  	u8 (*rx_desc_get_mesh_ctl)(struct hal_rx_desc *desc);
@@ -328,7 +328,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	bool (*rx_desc_get_mpdu_fc_valid)(struct hal_rx_desc *desc);
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -5527,6 +5527,14 @@ static int ath11k_mac_op_sta_state(struc
+@@ -10197,6 +10197,14 @@ static int ath11k_mac_op_sta_state(struc
  		}
  	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
  		   new_state == IEEE80211_STA_ASSOC) {
diff --git a/package/kernel/mac80211/patches/nss/ath11k/244-ath11k-dp-tx-perf.patch b/package/kernel/mac80211/patches/nss/ath11k/244-ath11k-dp-tx-perf.patch
index c4042611d3d9ea..c7acb122a584c6 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/244-ath11k-dp-tx-perf.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/244-ath11k-dp-tx-perf.patch
@@ -26,7 +26,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -115,6 +115,7 @@ static inline enum wme_ac ath11k_tid_to_
+@@ -118,6 +118,7 @@ static inline enum wme_ac ath11k_tid_to_
  enum ath11k_skb_flags {
  	ATH11K_SKB_HW_80211_ENCAP = BIT(0),
  	ATH11K_SKB_CIPHER_SET = BIT(1),
@@ -34,7 +34,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  };
  
  struct ath11k_skb_cb {
-@@ -883,10 +884,13 @@ struct ath11k_dp_ring_bp_stats {
+@@ -921,10 +922,13 @@ struct ath11k_dp_ring_bp_stats {
  struct ath11k_soc_dp_tx_err_stats {
  	/* TCL Ring Descriptor unavailable */
  	u32 desc_na[DP_TCL_NUM_RING_MAX];
@@ -50,7 +50,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  };
 --- a/drivers/net/wireless/ath/ath11k/dp.c
 +++ b/drivers/net/wireless/ath/ath11k/dp.c
-@@ -358,7 +358,7 @@ void ath11k_dp_stop_shadow_timers(struct
+@@ -372,7 +372,7 @@ void ath11k_dp_stop_shadow_timers(struct
  	if (!ab->hw_params.supports_shadow_regs)
  		return;
  
@@ -59,7 +59,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		ath11k_dp_shadow_stop_timer(ab, &ab->dp.tx_ring_timer[i]);
  
  	ath11k_dp_shadow_stop_timer(ab, &ab->dp.reo_cmd_timer);
-@@ -373,7 +373,7 @@ static void ath11k_dp_srng_common_cleanu
+@@ -387,7 +387,7 @@ static void ath11k_dp_srng_common_cleanu
  	ath11k_dp_srng_cleanup(ab, &dp->wbm_desc_rel_ring);
  	ath11k_dp_srng_cleanup(ab, &dp->tcl_cmd_ring);
  	ath11k_dp_srng_cleanup(ab, &dp->tcl_status_ring);
@@ -68,7 +68,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		ath11k_dp_srng_cleanup(ab, &dp->tx_ring[i].tcl_data_ring);
  		ath11k_dp_srng_cleanup(ab, &dp->tx_ring[i].tcl_comp_ring);
  	}
-@@ -407,6 +407,11 @@ static int ath11k_dp_srng_common_setup(s
+@@ -421,6 +421,11 @@ static int ath11k_dp_srng_common_setup(s
  		goto err;
  	}
  
@@ -80,7 +80,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	ret = ath11k_dp_srng_setup(ab, &dp->tcl_status_ring, HAL_TCL_STATUS,
  				   0, 0, DP_TCL_STATUS_RING_SIZE);
  	if (ret) {
-@@ -414,7 +419,7 @@ static int ath11k_dp_srng_common_setup(s
+@@ -428,7 +433,7 @@ static int ath11k_dp_srng_common_setup(s
  		goto err;
  	}
  
@@ -89,7 +89,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		tcl_num = ab->hw_params.hal_params->tcl2wbm_rbm_map[i].tcl_ring_num;
  		wbm_num = ab->hw_params.hal_params->tcl2wbm_rbm_map[i].wbm_ring_num;
  
-@@ -437,7 +442,7 @@ static int ath11k_dp_srng_common_setup(s
+@@ -451,7 +456,7 @@ static int ath11k_dp_srng_common_setup(s
  		}
  
  		srng = &ab->hal.srng_list[dp->tx_ring[i].tcl_data_ring.ring_id];
@@ -98,7 +98,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  
  		ath11k_dp_shadow_init_timer(ab, &dp->tx_ring_timer[i],
  					    ATH11K_SHADOW_DP_TIMER_INTERVAL,
-@@ -1051,7 +1056,7 @@ void ath11k_dp_free(struct ath11k_base *
+@@ -1065,7 +1070,7 @@ void ath11k_dp_free(struct ath11k_base *
  
  	ath11k_dp_reo_cmd_list_cleanup(ab);
  
@@ -107,7 +107,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		spin_lock_bh(&dp->tx_ring[i].tx_idr_lock);
  		idr_for_each(&dp->tx_ring[i].txbuf_idr,
  			     ath11k_dp_tx_pending_cleanup, ab);
-@@ -1102,7 +1107,7 @@ int ath11k_dp_alloc(struct ath11k_base *
+@@ -1116,7 +1121,7 @@ int ath11k_dp_alloc(struct ath11k_base *
  
  	size = sizeof(struct hal_wbm_release_ring) * DP_TX_COMP_RING_SIZE;
  
@@ -130,7 +130,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  
  	if (unlikely(!(info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) &&
  		     !ieee80211_is_data(hdr->frame_control)))
- 		return -ENOTSUPP;
+ 		return -EOPNOTSUPP;
  
 -	pool_id = skb_get_queue_mapping(skb) & (ATH11K_HW_MAX_QUEUES - 1);
 +	max_tx_ring = ab->hw_params.max_tx_ring;
@@ -430,7 +430,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -6664,12 +6664,22 @@ static void ath11k_mac_op_tx(struct ieee
+@@ -6387,12 +6387,22 @@ static void ath11k_mac_op_tx(struct ieee
  	if (control->sta)
  		arsta = ath11k_sta_to_arsta(control->sta);
  
@@ -438,7 +438,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
 +	 * the skb from driver. Own tx packets on monitor will also be disabled.
 +	 */
 +	if ((info->flags & (IEEE80211_TX_CTL_REQ_TX_STATUS | IEEE80211_TX_INTFL_NL80211_FRAME_TX)) ||
-+	    info->ack_frame_id || vif->type == NL80211_IFTYPE_MESH_POINT ||
++	    info->status_data || vif->type == NL80211_IFTYPE_MESH_POINT ||
 +	    test_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags))
 +		skb_cb->flags |= ATH11K_SKB_TX_STATUS;
 +
@@ -454,7 +454,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		ieee80211_free_txskb(ar->hw, skb);
  		return;
  	}
-@@ -7617,7 +7627,7 @@ err_vdev_del:
+@@ -7339,7 +7349,7 @@ err_vdev_del:
  	idr_for_each(&ar->txmgmt_idr,
  		     ath11k_mac_vif_txmgmt_idr_remove, vif);
  
@@ -465,7 +465,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  			     ath11k_mac_vif_unref, vif);
 --- a/drivers/net/wireless/ath/ath11k/debugfs.c
 +++ b/drivers/net/wireless/ath/ath11k/debugfs.c
-@@ -832,10 +832,22 @@ static ssize_t ath11k_debugfs_dump_soc_d
+@@ -833,10 +833,22 @@ static ssize_t ath11k_debugfs_dump_soc_d
  		len += scnprintf(buf + len, size - len, "ring%d: %u\n",
  				 i, soc_stats->tx_err.desc_na[i]);
  
@@ -490,7 +490,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	if (len > size)
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
-@@ -188,7 +188,6 @@ static struct ath11k_hw_params ath11k_hw
+@@ -190,7 +190,6 @@ static struct ath11k_hw_params ath11k_hw
  		.supports_regdb = false,
  		.fix_l1ss = true,
  		.credit_flow = false,
@@ -498,16 +498,16 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		.hal_params = &ath11k_hw_hal_params_ipq8074,
  		.supports_dynamic_smps_6ghz = false,
  		.alloc_cacheable_memory = true,
-@@ -213,6 +212,8 @@ static struct ath11k_hw_params ath11k_hw
- 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+@@ -216,6 +215,8 @@ static struct ath11k_hw_params ath11k_hw
  		.smp2p_wow_exit = false,
  		.support_fw_mac_sequence = false,
+ 		.support_dual_stations = false,
 +		/* In addition to TCL ring use TCL_CMD ring also for tx */
 +		.max_tx_ring = DP_TCL_NUM_RING_MAX + 1,
  	},
  	{
  		.name = "qca6390 hw2.0",
-@@ -355,7 +356,6 @@ static struct ath11k_hw_params ath11k_hw
+@@ -359,7 +360,6 @@ static struct ath11k_hw_params ath11k_hw
  		.supports_regdb = false,
  		.fix_l1ss = true,
  		.credit_flow = false,
@@ -515,16 +515,16 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		.hal_params = &ath11k_hw_hal_params_ipq8074,
  		.supports_dynamic_smps_6ghz = true,
  		.alloc_cacheable_memory = true,
-@@ -380,6 +380,8 @@ static struct ath11k_hw_params ath11k_hw
- 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+@@ -385,6 +385,8 @@ static struct ath11k_hw_params ath11k_hw
  		.smp2p_wow_exit = false,
  		.support_fw_mac_sequence = false,
+ 		.support_dual_stations = false,
 +		/* In addition to TCL ring use TCL_CMD ring also for tx */
 +		.max_tx_ring = DP_TCL_NUM_RING_MAX + 1,
  	},
  	{
  		.name = "wcn6855 hw2.0",
-@@ -2143,6 +2145,9 @@ int ath11k_core_pre_init(struct ath11k_b
+@@ -2247,6 +2249,9 @@ int ath11k_core_pre_init(struct ath11k_b
  	if (nss_offload)
  		ab->nss.stats_enabled = 1;
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch b/package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch
index af08f3530858c2..7ba7eacdc364e3 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch
@@ -36,7 +36,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/Makefile
 +++ b/drivers/net/wireless/ath/ath11k/Makefile
-@@ -27,6 +27,10 @@ ath11k-$(CPTCFG_ATH11K_SPECTRAL) += spec
+@@ -28,6 +28,10 @@ ath11k-$(CPTCFG_ATH11K_SPECTRAL) += spec
  ath11k-$(CONFIG_PM) += wow.o
  ath11k-$(CPTCFG_ATH11K_NSS_SUPPORT) += nss.o
  
@@ -1046,7 +1046,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  #define HTT_PPDU_STATS_MAX_USERS	37
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -1409,6 +1409,71 @@ static int ath11k_htt_tlv_ppdu_stats_par
+@@ -1410,6 +1410,71 @@ static int ath11k_htt_tlv_ppdu_stats_par
  	return 0;
  }
  
@@ -1118,7 +1118,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  static void
  ath11k_update_per_peer_tx_stats(struct ath11k *ar,
  				struct htt_ppdu_stats *ppdu_stats, u8 user)
-@@ -1432,6 +1497,9 @@ ath11k_update_per_peer_tx_stats(struct a
+@@ -1433,6 +1498,9 @@ ath11k_update_per_peer_tx_stats(struct a
  	if (!(usr_stats->tlv_flags & BIT(HTT_PPDU_STATS_TAG_USR_RATE)))
  		return;
  
@@ -1128,7 +1128,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  	if (usr_stats->tlv_flags & BIT(HTT_PPDU_STATS_TAG_USR_COMPLTN_COMMON))
  		is_ampdu =
  			HTT_USR_CMPLTN_IS_AMPDU(usr_stats->cmpltn_cmn.flags);
-@@ -1565,6 +1633,8 @@ ath11k_update_per_peer_tx_stats(struct a
+@@ -1566,6 +1634,8 @@ ath11k_update_per_peer_tx_stats(struct a
  			ath11k_debugfs_sta_add_tx_stats(arsta, peer_stats, rate_idx);
  	}
  
@@ -1137,7 +1137,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  	spin_unlock_bh(&ab->base_lock);
  	rcu_read_unlock();
  }
-@@ -1685,6 +1755,69 @@ int ath11k_dp_htt_tlv_iter(struct ath11k
+@@ -1686,6 +1756,69 @@ int ath11k_dp_htt_tlv_iter(struct ath11k
  	return 0;
  }
  
@@ -1207,7 +1207,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  static int ath11k_htt_pull_ppdu_stats(struct ath11k_base *ab,
  				      struct sk_buff *skb)
  {
-@@ -1703,6 +1836,15 @@ static int ath11k_htt_pull_ppdu_stats(st
+@@ -1704,6 +1837,15 @@ static int ath11k_htt_pull_ppdu_stats(st
  	pdev_id = FIELD_GET(HTT_T2H_PPDU_STATS_INFO_PDEV_ID, msg->info);
  	ppdu_id = msg->ppdu_id;
  
@@ -1223,7 +1223,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  	rcu_read_lock();
  	ar = ath11k_mac_get_ar_by_pdev_id(ab, pdev_id);
  	if (!ar) {
-@@ -1770,6 +1912,12 @@ static int ath11k_htt_pull_ppdu_stats(st
+@@ -1771,6 +1913,12 @@ static int ath11k_htt_pull_ppdu_stats(st
  		}
  	}
  
@@ -1238,7 +1238,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -3469,6 +3469,18 @@ static void ath11k_mac_op_nss_bss_info_c
+@@ -3476,6 +3476,18 @@ static void ath11k_mac_op_nss_bss_info_c
  			ath11k_warn(ar->ab, "failed to set ap_isolate in nss %d\n", ret);
  	}
  
@@ -1257,8 +1257,8 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  	mutex_unlock(&ar->conf_mutex);
  }
  
-@@ -9707,6 +9719,28 @@ err_fallback:
- 	return 0;
+@@ -10237,6 +10249,28 @@ static int ath11k_mac_op_sta_state(struc
+ 	return ret;
  }
  
 +#ifdef CPTCFG_ATH11K_NSS_MESH_SUPPORT
@@ -1286,7 +1286,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  static const struct ieee80211_ops ath11k_ops = {
  	.tx				= ath11k_mac_op_tx,
  	.wake_tx_queue			= ieee80211_handle_wake_tx_queue,
-@@ -9764,6 +9798,9 @@ static const struct ieee80211_ops ath11k
+@@ -10295,6 +10329,9 @@ static const struct ieee80211_ops ath11k
  	.set_sar_specs			= ath11k_mac_op_set_bios_sar_specs,
  	.remain_on_channel		= ath11k_mac_op_remain_on_channel,
  	.cancel_remain_on_channel	= ath11k_mac_op_cancel_remain_on_channel,
@@ -1296,7 +1296,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  };
  
  static void ath11k_mac_update_ch_list(struct ath11k *ar,
-@@ -10225,6 +10262,8 @@ static int __ath11k_mac_register(struct
+@@ -10804,6 +10841,8 @@ static int __ath11k_mac_register(struct
  		ieee80211_hw_set(ar->hw, SUPPORTS_NSS_OFFLOAD);
  		wiphy_ext_feature_set(ar->hw->wiphy,
  				      NL80211_EXT_FEATURE_VLAN_OFFLOAD);
@@ -3337,7 +3337,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  	ATH11K_DBG_WMI		= 0x00000002,
 --- a/local-symbols
 +++ b/local-symbols
-@@ -171,6 +171,7 @@ ATH11K=
+@@ -164,6 +164,7 @@ ATH11K=
  ATH11K_AHB=
  ATH11K_PCI=
  ATH11K_NSS_SUPPORT=
diff --git a/package/kernel/mac80211/patches/nss/ath11k/314-ath11k-Fix-peer-lookup-failure-in-mgmt-tx-completion.patch b/package/kernel/mac80211/patches/nss/ath11k/314-ath11k-Fix-peer-lookup-failure-in-mgmt-tx-completion.patch
index 448bd3c70daab4..d0b57fe27e5275 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/314-ath11k-Fix-peer-lookup-failure-in-mgmt-tx-completion.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/314-ath11k-Fix-peer-lookup-failure-in-mgmt-tx-completion.patch
@@ -23,7 +23,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -7636,8 +7636,10 @@ err_vdev_del:
+@@ -7358,8 +7358,10 @@ err_vdev_del:
  	kfree(arvif->vlan_keyid_map);
  	ath11k_peer_cleanup(ar, arvif->vdev_id);
  
@@ -36,7 +36,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  		spin_lock_bh(&ab->dp.tx_ring[i].tx_idr_lock);
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
-@@ -5966,13 +5966,13 @@ static int wmi_process_tx_comp(struct at
+@@ -6039,13 +6039,13 @@ static int wmi_process_tx_comp(struct at
  	struct ieee80211_tx_info *info;
  	struct ath11k_skb_cb *skb_cb;
  	struct ieee80211_hdr *hdr;
@@ -51,7 +51,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  	spin_lock_bh(&ar->txmgmt_idr_lock);
  	msdu = idr_find(&ar->txmgmt_idr, tx_compl_param->desc_id);
  
-@@ -5980,6 +5980,7 @@ static int wmi_process_tx_comp(struct at
+@@ -6053,6 +6053,7 @@ static int wmi_process_tx_comp(struct at
  		ath11k_warn(ar->ab, "received mgmt tx compl for invalid msdu_id: %d\n",
  			    tx_compl_param->desc_id);
  		spin_unlock_bh(&ar->txmgmt_idr_lock);
@@ -59,7 +59,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  		return -ENOENT;
  	}
  
-@@ -5988,6 +5989,28 @@ static int wmi_process_tx_comp(struct at
+@@ -6061,6 +6062,28 @@ static int wmi_process_tx_comp(struct at
  
  	skb_cb = ATH11K_SKB_CB(msdu);
  	dma_unmap_single(ar->ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
@@ -88,7 +88,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  
  	info = IEEE80211_SKB_CB(msdu);
  	if ((!(info->flags & IEEE80211_TX_CTL_NO_ACK)) &&
-@@ -6003,34 +6026,6 @@ static int wmi_process_tx_comp(struct at
+@@ -6076,34 +6099,6 @@ static int wmi_process_tx_comp(struct at
  	 */
  	info->status.rates[0].idx = -1;
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/330-ath11k-sync-wds_ast_entry-updates.patch b/package/kernel/mac80211/patches/nss/ath11k/330-ath11k-sync-wds_ast_entry-updates.patch
index 9993e4d4773321..61c4cec5189737 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/330-ath11k-sync-wds_ast_entry-updates.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/330-ath11k-sync-wds_ast_entry-updates.patch
@@ -46,7 +46,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/ahb.c
 +++ b/drivers/net/wireless/ath/ath11k/ahb.c
-@@ -1245,6 +1245,7 @@ static void ath11k_ahb_remove_prepare(st
+@@ -1239,6 +1239,7 @@ static void ath11k_ahb_remove_prepare(st
  	set_bit(ATH11K_FLAG_UNREGISTERING, &ab->dev_flags);
  	cancel_work_sync(&ab->restart_work);
  	cancel_work_sync(&ab->qmi.event_work);
@@ -56,7 +56,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  static void ath11k_ahb_free_resources(struct ath11k_base *ab)
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
-@@ -2211,6 +2211,7 @@ struct ath11k_base *ath11k_core_alloc(st
+@@ -2316,6 +2316,7 @@ struct ath11k_base *ath11k_core_alloc(st
  
  	mutex_init(&ab->core_lock);
  	mutex_init(&ab->tbl_mtx_lock);
@@ -64,7 +64,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  	spin_lock_init(&ab->base_lock);
  	mutex_init(&ab->vdev_id_11d_lock);
  	init_completion(&ab->reset_complete);
-@@ -2224,6 +2225,8 @@ struct ath11k_base *ath11k_core_alloc(st
+@@ -2329,6 +2330,8 @@ struct ath11k_base *ath11k_core_alloc(st
  	INIT_WORK(&ab->restart_work, ath11k_core_restart);
  	INIT_WORK(&ab->update_11d_work, ath11k_update_11d);
  	INIT_WORK(&ab->reset_work, ath11k_core_reset);
@@ -75,15 +75,15 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  	init_completion(&ab->wow.wakeup_completed);
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -31,6 +31,7 @@
+@@ -33,6 +33,7 @@
  #include "wow.h"
  #include "rx_desc.h"
  #include "nss.h"
 +#include "peer.h"
+ #include "fw.h"
  
  #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
- 
-@@ -1080,6 +1081,9 @@ struct ath11k_base {
+@@ -1130,6 +1131,9 @@ struct ath11k_base {
  
  	u32 max_ast_index;
  	u32 num_ast_entries;
@@ -183,7 +183,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  }
 --- a/drivers/net/wireless/ath/ath11k/pci.c
 +++ b/drivers/net/wireless/ath/ath11k/pci.c
-@@ -972,6 +972,7 @@ static void ath11k_pci_remove(struct pci
+@@ -1004,6 +1004,7 @@ static void ath11k_pci_remove(struct pci
  	}
  
  	set_bit(ATH11K_FLAG_UNREGISTERING, &ab->dev_flags);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/335-0002-ath11k-use-DECLARE_BITMAP-for-idr-operations.patch b/package/kernel/mac80211/patches/nss/ath11k/335-0002-ath11k-use-DECLARE_BITMAP-for-idr-operations.patch
index f567ec640942c9..4efdbe00c2aa6e 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/335-0002-ath11k-use-DECLARE_BITMAP-for-idr-operations.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/335-0002-ath11k-use-DECLARE_BITMAP-for-idr-operations.patch
@@ -18,7 +18,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/dp.c
 +++ b/drivers/net/wireless/ath/ath11k/dp.c
-@@ -376,6 +376,8 @@ static void ath11k_dp_srng_common_cleanu
+@@ -390,6 +390,8 @@ static void ath11k_dp_srng_common_cleanu
  	for (i = 0; i < DP_TCL_NUM_RING_MAX; i++) {
  		ath11k_dp_srng_cleanup(ab, &dp->tx_ring[i].tcl_data_ring);
  		ath11k_dp_srng_cleanup(ab, &dp->tx_ring[i].tcl_comp_ring);
@@ -27,7 +27,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  	}
  	ath11k_dp_srng_cleanup(ab, &dp->reo_reinject_ring);
  	ath11k_dp_srng_cleanup(ab, &dp->rx_rel_ring);
-@@ -388,7 +390,7 @@ static int ath11k_dp_srng_common_setup(s
+@@ -402,7 +404,7 @@ static int ath11k_dp_srng_common_setup(s
  {
  	struct ath11k_dp *dp = &ab->dp;
  	struct hal_srng *srng;
@@ -36,7 +36,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  	u8 tcl_num, wbm_num;
  
  	ret = ath11k_dp_srng_setup(ab, &dp->wbm_desc_rel_ring,
-@@ -447,6 +449,18 @@ static int ath11k_dp_srng_common_setup(s
+@@ -461,6 +463,18 @@ static int ath11k_dp_srng_common_setup(s
  		ath11k_dp_shadow_init_timer(ab, &dp->tx_ring_timer[i],
  					    ATH11K_SHADOW_DP_TIMER_INTERVAL,
  					    dp->tx_ring[i].tcl_data_ring.ring_id);
@@ -55,7 +55,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  	}
  
  	ret = ath11k_dp_srng_setup(ab, &dp->reo_reinject_ring, HAL_REO_REINJECT,
-@@ -1031,9 +1045,8 @@ void ath11k_dp_vdev_tx_attach(struct ath
+@@ -1045,9 +1059,8 @@ void ath11k_dp_vdev_tx_attach(struct ath
  	ath11k_dp_update_vdev_search(arvif);
  }
  
@@ -66,7 +66,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  	struct sk_buff *msdu = skb;
  
  	dma_unmap_single(ab->dev, ATH11K_SKB_CB(msdu)->paddr, msdu->len,
-@@ -1047,21 +1060,28 @@ static int ath11k_dp_tx_pending_cleanup(
+@@ -1061,21 +1074,28 @@ static int ath11k_dp_tx_pending_cleanup(
  void ath11k_dp_free(struct ath11k_base *ab)
  {
  	struct ath11k_dp *dp = &ab->dp;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch b/package/kernel/mac80211/patches/nss/ath11k/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
index cb33d8d347f7c4..851a32bc35cf20 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
@@ -58,7 +58,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  	tcl_cmd.info3 = FIELD_PREP(HAL_TCL_DATA_CMD_INFO3_DSCP_TID_TABLE_IDX,
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -10148,6 +10148,8 @@ static int __ath11k_mac_register(struct
+@@ -10727,6 +10727,8 @@ static int __ath11k_mac_register(struct
  			ieee80211_hw_set(ar->hw, USES_RSS);
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/336-ath11k-Fix-updating-rx-stats-with-monitor-vif-enable.patch b/package/kernel/mac80211/patches/nss/ath11k/336-ath11k-Fix-updating-rx-stats-with-monitor-vif-enable.patch
index 752218e9b8ec26..cf0f88068a37b9 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/336-ath11k-Fix-updating-rx-stats-with-monitor-vif-enable.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/336-ath11k-Fix-updating-rx-stats-with-monitor-vif-enable.patch
@@ -16,7 +16,7 @@ Signed-off-by: Anilkumar Kolli <quic_akolli@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -5953,12 +5953,23 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -5955,12 +5955,23 @@ int ath11k_dp_rx_process_mon_status(stru
  			pmon->mon_ppdu_status = DP_PPDU_STATUS_START;
  		}
  
@@ -43,7 +43,7 @@ Signed-off-by: Anilkumar Kolli <quic_akolli@quicinc.com>
  		rcu_read_lock();
  		spin_lock_bh(&ab->base_lock);
  		peer = ath11k_peer_find_by_id(ab, ppdu_info->peer_id);
-@@ -6282,6 +6293,13 @@ static int ath11k_dp_full_mon_process_rx
+@@ -6284,6 +6295,13 @@ static int ath11k_dp_full_mon_process_rx
  
  	spin_lock_bh(&pmon->mon_lock);
  
@@ -57,7 +57,7 @@ Signed-off-by: Anilkumar Kolli <quic_akolli@quicinc.com>
  	sw_mon_entries = &pmon->sw_mon_entries;
  	rx_mon_stats = &pmon->rx_mon_stats;
  
-@@ -6321,7 +6339,6 @@ static int ath11k_dp_full_mon_process_rx
+@@ -6323,7 +6341,6 @@ static int ath11k_dp_full_mon_process_rx
  		}
  
  		rx_mon_stats->dest_ppdu_done++;
@@ -65,7 +65,7 @@ Signed-off-by: Anilkumar Kolli <quic_akolli@quicinc.com>
  		pmon->buf_state = DP_MON_STATUS_LAG;
  		pmon->mon_status_paddr = sw_mon_entries->mon_status_paddr;
  		pmon->hold_mon_dst_ring = true;
-@@ -6352,16 +6369,10 @@ reap_status_ring:
+@@ -6354,16 +6371,10 @@ reap_status_ring:
  int ath11k_dp_rx_process_mon_rings(struct ath11k_base *ab, int mac_id,
  				   struct napi_struct *napi, int budget)
  {
diff --git a/package/kernel/mac80211/patches/nss/ath11k/336-ath11k-skip-status-ring-entry-processing.patch b/package/kernel/mac80211/patches/nss/ath11k/336-ath11k-skip-status-ring-entry-processing.patch
index 0adf26c808aec6..3fa320ec26c2f9 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/336-ath11k-skip-status-ring-entry-processing.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/336-ath11k-skip-status-ring-entry-processing.patch
@@ -35,7 +35,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -3660,6 +3660,46 @@ ath11k_dp_rx_mon_update_status_buf_state
+@@ -3662,6 +3662,46 @@ ath11k_dp_rx_mon_update_status_buf_state
  	}
  }
  
@@ -82,7 +82,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  static int ath11k_dp_rx_reap_mon_status_ring(struct ath11k_base *ab, int mac_id,
  					     int *budget, struct sk_buff_head *skb_list)
  {
-@@ -3673,6 +3713,7 @@ static int ath11k_dp_rx_reap_mon_status_
+@@ -3675,6 +3715,7 @@ static int ath11k_dp_rx_reap_mon_status_
  	struct sk_buff *skb;
  	struct ath11k_skb_rxcb *rxcb;
  	struct hal_tlv_hdr *tlv;
@@ -90,7 +90,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  	u32 cookie;
  	int buf_id, srng_id;
  	dma_addr_t paddr;
-@@ -3692,8 +3733,7 @@ static int ath11k_dp_rx_reap_mon_status_
+@@ -3694,8 +3735,7 @@ static int ath11k_dp_rx_reap_mon_status_
  	ath11k_hal_srng_access_begin(ab, srng);
  	while (*budget) {
  		*budget -= 1;
@@ -100,7 +100,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  		if (!rx_mon_status_desc) {
  			pmon->buf_state = DP_MON_STATUS_REPLINISH;
  			break;
-@@ -3724,18 +3764,43 @@ static int ath11k_dp_rx_reap_mon_status_
+@@ -3726,18 +3766,43 @@ static int ath11k_dp_rx_reap_mon_status_
  			tlv = (struct hal_tlv_hdr *)skb->data;
  			if (FIELD_GET(HAL_TLV_HDR_TAG, tlv->tl) !=
  					HAL_RX_STATUS_BUFFER_DONE) {
@@ -157,7 +157,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  			spin_lock_bh(&rx_ring->idr_lock);
 --- a/drivers/net/wireless/ath/ath11k/hal.c
 +++ b/drivers/net/wireless/ath/ath11k/hal.c
-@@ -837,6 +837,20 @@ u32 *ath11k_hal_srng_src_get_next_reaped
+@@ -852,6 +852,20 @@ u32 *ath11k_hal_srng_src_get_next_reaped
  	return desc;
  }
  
@@ -180,7 +180,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  	lockdep_assert_held(&srng->lock);
 --- a/drivers/net/wireless/ath/ath11k/hal.h
 +++ b/drivers/net/wireless/ath/ath11k/hal.h
-@@ -952,6 +952,8 @@ int ath11k_hal_srng_dst_num_free(struct
+@@ -953,6 +953,8 @@ int ath11k_hal_srng_dst_num_free(struct
  void ath11k_hal_srng_dst_invalidate_entry(struct ath11k_base *ab,
  					  struct hal_srng *srng, int entries);
  u32 *ath11k_hal_srng_src_peek(struct ath11k_base *ab, struct hal_srng *srng);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/341-ath11k-fix-support-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch b/package/kernel/mac80211/patches/nss/ath11k/341-ath11k-fix-support-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch
index 9a3c95a9df3c40..1a02b0db6ce8bb 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/341-ath11k-fix-support-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/341-ath11k-fix-support-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch
@@ -38,7 +38,7 @@ Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
-@@ -1837,6 +1837,11 @@ static int ath11k_core_reconfigure_on_cr
+@@ -1932,6 +1932,11 @@ static int ath11k_core_reconfigure_on_cr
  
  	clear_bit(ATH11K_FLAG_CRASH_FLUSH, &ab->dev_flags);
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/342-ath11k-provide-access-of-the-dma-buffer-back-to-dma-.patch b/package/kernel/mac80211/patches/nss/ath11k/342-ath11k-provide-access-of-the-dma-buffer-back-to-dma-.patch
index db779080b71f96..31043cf23f8722 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/342-ath11k-provide-access-of-the-dma-buffer-back-to-dma-.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/342-ath11k-provide-access-of-the-dma-buffer-back-to-dma-.patch
@@ -17,7 +17,7 @@ Signed-off-by: Hari Chandrakanthan <quic_haric@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/dbring.c
 +++ b/drivers/net/wireless/ath/ath11k/dbring.c
-@@ -80,6 +80,8 @@ static int ath11k_dbring_bufs_replenish(
+@@ -81,6 +81,8 @@ static int ath11k_dbring_bufs_replenish(
  
  	buff->paddr = paddr;
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/356-ath11k-invalid-desc-sanity-check.patch b/package/kernel/mac80211/patches/nss/ath11k/356-ath11k-invalid-desc-sanity-check.patch
index f574597dceb969..c2980acbe58472 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/356-ath11k-invalid-desc-sanity-check.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/356-ath11k-invalid-desc-sanity-check.patch
@@ -46,7 +46,7 @@ Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -396,8 +396,8 @@ int ath11k_dp_rxbufs_replenish(struct at
+@@ -397,8 +397,8 @@ int ath11k_dp_rxbufs_replenish(struct at
  			goto fail_free_skb;
  
  		spin_lock_bh(&rx_ring->idr_lock);
@@ -57,7 +57,7 @@ Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
  		spin_unlock_bh(&rx_ring->idr_lock);
  		if (buf_id <= 0)
  			goto fail_dma_unmap;
-@@ -3141,6 +3141,16 @@ try_again:
+@@ -3142,6 +3142,16 @@ try_again:
  	while (likely(desc =
  	      (struct hal_reo_dest_ring *)ath11k_hal_srng_dst_get_next_entry(ab,
  									     srng))) {
@@ -74,7 +74,7 @@ Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
  		cookie = FIELD_GET(BUFFER_ADDR_INFO1_SW_COOKIE,
  				   desc->buf_addr_info.info1);
  		buf_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_BUF_ID,
-@@ -3171,8 +3181,6 @@ try_again:
+@@ -3172,8 +3182,6 @@ try_again:
  
  		num_buffs_reaped[mac_id]++;
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/357-ath11k-fix-clear-peer-keys-during-disassoc.patch b/package/kernel/mac80211/patches/nss/ath11k/357-ath11k-fix-clear-peer-keys-during-disassoc.patch
index 4c7fefbba155d7..4bb88126851913 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/357-ath11k-fix-clear-peer-keys-during-disassoc.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/357-ath11k-fix-clear-peer-keys-during-disassoc.patch
@@ -17,7 +17,7 @@ Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -4894,12 +4894,6 @@ static int ath11k_station_disassoc(struc
+@@ -4902,12 +4902,6 @@ static int ath11k_station_disassoc(struc
  			return ret;
  	}
  
@@ -30,7 +30,7 @@ Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
  	return 0;
  }
  
-@@ -5490,6 +5484,17 @@ static int ath11k_mac_op_sta_state(struc
+@@ -10149,6 +10143,17 @@ static int ath11k_mac_op_sta_state(struc
  		arsta->bw = ath11k_mac_ieee80211_sta_bw_to_wmi(ar, sta);
  		arsta->bw_prev = arsta->bw;
  		spin_unlock_bh(&ar->data_lock);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/371-ath11k-Fix-ppdu_id-from-firmware-PPDU-stats.patch b/package/kernel/mac80211/patches/nss/ath11k/371-ath11k-Fix-ppdu_id-from-firmware-PPDU-stats.patch
index f909ba4a673f69..f7abe8b21bae83 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/371-ath11k-Fix-ppdu_id-from-firmware-PPDU-stats.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/371-ath11k-Fix-ppdu_id-from-firmware-PPDU-stats.patch
@@ -24,7 +24,7 @@ Signed-off-by: Ramya Gnanasekar <quic_rgnanase@quicinc.com>
  	u32 ppdu_id;
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -1288,7 +1288,7 @@ static int ath11k_htt_tlv_ppdu_stats_par
+@@ -1289,7 +1289,7 @@ static int ath11k_htt_tlv_ppdu_stats_par
  	struct htt_ppdu_user_stats *user_stats = NULL;
  	int cur_user;
  	u16 peer_id;
@@ -33,7 +33,7 @@ Signed-off-by: Ramya Gnanasekar <quic_rgnanase@quicinc.com>
  
  	ppdu_info = data;
  
-@@ -1369,6 +1369,8 @@ static int ath11k_htt_tlv_ppdu_stats_par
+@@ -1370,6 +1370,8 @@ static int ath11k_htt_tlv_ppdu_stats_par
  			return -EINVAL;
  		}
  
@@ -42,7 +42,7 @@ Signed-off-by: Ramya Gnanasekar <quic_rgnanase@quicinc.com>
  		peer_id =
  		((struct htt_ppdu_stats_usr_cmpltn_ack_ba_status *)ptr)->sw_peer_id;
  		cur_user = ath11k_get_ppdu_user_index(&ppdu_info->ppdu_stats,
-@@ -1380,6 +1382,7 @@ static int ath11k_htt_tlv_ppdu_stats_par
+@@ -1381,6 +1383,7 @@ static int ath11k_htt_tlv_ppdu_stats_par
  		user_stats->is_valid_peer_id = true;
  		memcpy((void *)&user_stats->ack_ba, ptr,
  		       sizeof(struct htt_ppdu_stats_usr_cmpltn_ack_ba_status));
diff --git a/package/kernel/mac80211/patches/nss/ath11k/373-ath11k-Add-retry-mechanism-for-update_rx_qu.patch b/package/kernel/mac80211/patches/nss/ath11k/373-ath11k-Add-retry-mechanism-for-update_rx_qu.patch
index 8adb5448a1564c..6510e290c51cf1 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/373-ath11k-Add-retry-mechanism-for-update_rx_qu.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/373-ath11k-Add-retry-mechanism-for-update_rx_qu.patch
@@ -41,7 +41,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -902,6 +902,9 @@ struct ath11k_soc_dp_stats {
+@@ -940,6 +940,9 @@ struct ath11k_soc_dp_stats {
  	u32 rxdma_error[HAL_REO_ENTR_RING_RXDMA_ECODE_MAX];
  	u32 reo_error[HAL_REO_DEST_RING_ERROR_CODE_MAX];
  	u32 hal_reo_error[DP_REO_DST_RING_MAX];
@@ -53,7 +53,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  };
 --- a/drivers/net/wireless/ath/ath11k/debugfs.c
 +++ b/drivers/net/wireless/ath/ath11k/debugfs.c
-@@ -848,6 +848,18 @@ static ssize_t ath11k_debugfs_dump_soc_d
+@@ -849,6 +849,18 @@ static ssize_t ath11k_debugfs_dump_soc_d
  			 "\nNSS Transmit Failures: %d\n",
  			 atomic_read(&soc_stats->tx_err.nss_tx_fail));
  
@@ -74,7 +74,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	if (len > size)
 --- a/drivers/net/wireless/ath/ath11k/dp.c
 +++ b/drivers/net/wireless/ath/ath11k/dp.c
-@@ -1102,8 +1102,10 @@ int ath11k_dp_alloc(struct ath11k_base *
+@@ -1116,8 +1116,10 @@ int ath11k_dp_alloc(struct ath11k_base *
  
  	INIT_LIST_HEAD(&dp->reo_cmd_list);
  	INIT_LIST_HEAD(&dp->reo_cmd_cache_flush_list);
@@ -125,7 +125,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  };
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -21,6 +21,9 @@
+@@ -22,6 +22,9 @@
  
  #define ATH11K_DP_RX_FRAGMENT_TIMEOUT_MS (2 * HZ)
  
@@ -135,7 +135,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  static inline
  u8 *ath11k_dp_rx_h_80211_hdr(struct ath11k_base *ab, struct hal_rx_desc *desc)
  {
-@@ -672,13 +675,50 @@ static int ath11k_dp_rx_pdev_srng_alloc(
+@@ -673,13 +676,50 @@ static int ath11k_dp_rx_pdev_srng_alloc(
  	return 0;
  }
  
@@ -186,7 +186,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	spin_lock_bh(&dp->reo_cmd_lock);
  	list_for_each_entry_safe(cmd, tmp, &dp->reo_cmd_list, list) {
  		list_del(&cmd->list);
-@@ -724,14 +764,18 @@ static void ath11k_dp_reo_cmd_free(struc
+@@ -725,14 +765,18 @@ static void ath11k_dp_reo_cmd_free(struc
  	}
  }
  
@@ -207,7 +207,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	desc_sz = ath11k_hal_reo_qdesc_size(0, HAL_DESC_REO_NON_QOS_TID);
  
  	while (tot_desc_sz > desc_sz) {
-@@ -742,11 +786,17 @@ static void ath11k_dp_reo_cache_flush(st
+@@ -743,11 +787,17 @@ static void ath11k_dp_reo_cache_flush(st
  						HAL_REO_CMD_FLUSH_CACHE, &cmd,
  						NULL);
  		if (ret)
@@ -228,7 +228,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	memset(&cmd, 0, sizeof(cmd));
  	cmd.addr_lo = lower_32_bits(rx_tid->paddr);
  	cmd.addr_hi = upper_32_bits(rx_tid->paddr);
-@@ -754,24 +804,21 @@ static void ath11k_dp_reo_cache_flush(st
+@@ -755,24 +805,21 @@ static void ath11k_dp_reo_cache_flush(st
  	ret = ath11k_dp_tx_send_reo_cmd(ab, rx_tid,
  					HAL_REO_CMD_FLUSH_CACHE,
  					&cmd, ath11k_dp_reo_cmd_free);
@@ -259,7 +259,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  		goto free_desc;
  	} else if (status != HAL_REO_CMD_SUCCESS) {
  		/* Shouldn't happen! Cleanup in case of other failure? */
-@@ -780,6 +827,29 @@ static void ath11k_dp_rx_tid_del_func(st
+@@ -781,6 +828,29 @@ static void ath11k_dp_rx_tid_del_func(st
  		return;
  	}
  
@@ -289,7 +289,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	elem = kzalloc(sizeof(*elem), GFP_ATOMIC);
  	if (!elem)
  		goto free_desc;
-@@ -797,13 +867,20 @@ static void ath11k_dp_rx_tid_del_func(st
+@@ -798,13 +868,20 @@ static void ath11k_dp_rx_tid_del_func(st
  		if (dp->reo_cmd_cache_flush_count > DP_REO_DESC_FREE_THRESHOLD ||
  		    time_after(jiffies, elem->ts +
  			       msecs_to_jiffies(DP_REO_DESC_FREE_TIMEOUT_MS))) {
@@ -314,7 +314,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  		}
  	}
  	spin_unlock_bh(&dp->reo_cmd_lock);
-@@ -819,34 +896,48 @@ free_desc:
+@@ -820,34 +897,48 @@ free_desc:
  void ath11k_peer_rx_tid_delete(struct ath11k *ar,
  			       struct ath11k_peer *peer, u8 tid)
  {
diff --git a/package/kernel/mac80211/patches/nss/ath11k/401-ath11k-Fix-mutex-dead-lock-and-q6-dump-crash.patch b/package/kernel/mac80211/patches/nss/ath11k/401-ath11k-Fix-mutex-dead-lock-and-q6-dump-crash.patch
index 125250fdb381cc..0514302a0d22c9 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/401-ath11k-Fix-mutex-dead-lock-and-q6-dump-crash.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/401-ath11k-Fix-mutex-dead-lock-and-q6-dump-crash.patch
@@ -36,7 +36,7 @@ Signed-off-by: Rajat Soni <quic_rajson@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -6784,7 +6784,9 @@ static int ath11k_mac_op_start(struct ie
+@@ -6496,7 +6496,9 @@ static int ath11k_mac_op_start(struct ie
  		break;
  	case ATH11K_STATE_RESTARTING:
  		ar->state = ATH11K_STATE_RESTARTED;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/453-ath11k-flush-management-frames-to-firmware-before-wa.patch b/package/kernel/mac80211/patches/nss/ath11k/453-ath11k-flush-management-frames-to-firmware-before-wa.patch
index cc1f393c2b3074..ad090f56ba007a 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/453-ath11k-flush-management-frames-to-firmware-before-wa.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/453-ath11k-flush-management-frames-to-firmware-before-wa.patch
@@ -27,7 +27,7 @@ Signed-off-by: Hari Chandrakanthan <quic_haric@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -8462,6 +8462,8 @@ static int ath11k_mac_flush_tx_complete(
+@@ -8655,6 +8655,8 @@ static int ath11k_mac_flush_tx_complete(
  		ret = -ETIMEDOUT;
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/456-wifi-ath11k-Advertise-TX_QUEUE-mac-hw-flag.patch b/package/kernel/mac80211/patches/nss/ath11k/456-wifi-ath11k-Advertise-TX_QUEUE-mac-hw-flag.patch
index c9b8f4dbb391d5..48696c975db76b 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/456-wifi-ath11k-Advertise-TX_QUEUE-mac-hw-flag.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/456-wifi-ath11k-Advertise-TX_QUEUE-mac-hw-flag.patch
@@ -13,7 +13,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -10139,6 +10139,7 @@ static int __ath11k_mac_register(struct
+@@ -10718,6 +10718,7 @@ static int __ath11k_mac_register(struct
  	ieee80211_hw_set(ar->hw, QUEUE_CONTROL);
  	ieee80211_hw_set(ar->hw, SUPPORTS_TX_FRAG);
  	ieee80211_hw_set(ar->hw, REPORTS_LOW_ACK);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/457-wifi-ath11k-Avoid-memset-of-ppdu-info-for-next-skb.patch b/package/kernel/mac80211/patches/nss/ath11k/457-wifi-ath11k-Avoid-memset-of-ppdu-info-for-next-skb.patch
index 21a92296da38a1..a6ae251ad33602 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/457-wifi-ath11k-Avoid-memset-of-ppdu-info-for-next-skb.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/457-wifi-ath11k-Avoid-memset-of-ppdu-info-for-next-skb.patch
@@ -48,7 +48,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -6089,7 +6089,9 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -6091,7 +6091,9 @@ int ath11k_dp_rx_process_mon_status(stru
  	if (!num_buffs_reaped)
  		goto exit;
  
@@ -59,7 +59,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	ppdu_info->peer_id = HAL_INVALID_PEERID;
  
  	while ((skb = __skb_dequeue(&skb_list))) {
-@@ -6107,7 +6109,6 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -6109,7 +6111,6 @@ int ath11k_dp_rx_process_mon_status(stru
  		if (log_type != ATH11K_PKTLOG_TYPE_INVALID)
  			trace_ath11k_htt_rxdesc(ar, skb->data, log_type, rx_buf_sz);
  
@@ -67,7 +67,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  		ppdu_info->peer_id = HAL_INVALID_PEERID;
  		hal_status = ath11k_hal_rx_parse_mon_status(ab, ppdu_info, skb);
  
-@@ -6135,6 +6136,7 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -6137,6 +6138,7 @@ int ath11k_dp_rx_process_mon_status(stru
  		if ((ppdu_info->peer_id == HAL_INVALID_PEERID ||
  		    hal_status != HAL_RX_MON_STATUS_PPDU_DONE)) {
  			dev_kfree_skb_any(skb);
@@ -77,7 +77,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  		rcu_read_lock();
 --- a/drivers/net/wireless/ath/ath11k/hal_rx.h
 +++ b/drivers/net/wireless/ath/ath11k/hal_rx.h
-@@ -221,6 +221,7 @@ struct hal_rx_mon_ppdu_info {
+@@ -222,6 +222,7 @@ struct hal_rx_mon_ppdu_info {
  	u32 num_users;
  	u32 mpdu_fcs_ok_bitmap[HAL_RX_NUM_WORDS_PER_PPDU_BITMAP];
  	struct hal_rx_user_status userstats[HAL_MAX_UL_MU_USERS];
diff --git a/package/kernel/mac80211/patches/nss/ath11k/669-ath11k-change-dma_map_single-to-virt_to_phys-in-rx-r.patch b/package/kernel/mac80211/patches/nss/ath11k/669-ath11k-change-dma_map_single-to-virt_to_phys-in-rx-r.patch
index 06cee635f3e79b..2b654f7a2a3714 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/669-ath11k-change-dma_map_single-to-virt_to_phys-in-rx-r.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/669-ath11k-change-dma_map_single-to-virt_to_phys-in-rx-r.patch
@@ -40,7 +40,7 @@ Signed-off-by: Balamurugan Selvarajan <quic_bselvara@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -392,9 +392,9 @@ int ath11k_dp_rxbufs_replenish(struct at
+@@ -393,9 +393,9 @@ int ath11k_dp_rxbufs_replenish(struct at
  				 skb->data);
  		}
  
@@ -53,7 +53,7 @@ Signed-off-by: Balamurugan Selvarajan <quic_bselvara@quicinc.com>
  		if (dma_mapping_error(ab->dev, paddr))
  			goto fail_free_skb;
  
-@@ -430,8 +430,8 @@ fail_idr_remove:
+@@ -431,8 +431,8 @@ fail_idr_remove:
  	idr_remove(&rx_ring->bufs_idr, buf_id);
  	spin_unlock_bh(&rx_ring->idr_lock);
  fail_dma_unmap:
diff --git a/package/kernel/mac80211/patches/nss/ath11k/907-01-wifi-ath11k-remove-invalid-peer-create-logic.patch b/package/kernel/mac80211/patches/nss/ath11k/907-01-wifi-ath11k-remove-invalid-peer-create-logic.patch
deleted file mode 100644
index 401fa2d012b9b4..00000000000000
--- a/package/kernel/mac80211/patches/nss/ath11k/907-01-wifi-ath11k-remove-invalid-peer-create-logic.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-Received: from bqiang-Celadon-RN.qca.qualcomm.com (10.80.80.8) by
-From: Baochen Qiang <quic_bqiang@quicinc.com>
-To: <ath11k@lists.infradead.org>
-Subject: [PATCH 1/4] wifi: ath11k: remove invalid peer create logic
-Date: Tue, 23 Jan 2024 10:56:57 +0800
-
-In ath11k_mac_op_assign_vif_chanctx(), there is a logic to
-create peer using ar->mac_addr for a STA vdev. This is invalid
-because a STA vdev should have a peer created using AP's
-MAC address. Besides, if we run into that logic, it means a peer
-has already been created earlier, we should not create it again.
-So remove it.
-
-This is found during code review.
-
-Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1
-Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23
-Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
-Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
-
-Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
-Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
----
- drivers/net/wireless/ath/ath11k/mac.c | 16 ----------------
- 1 file changed, 16 deletions(-)
-
---- a/drivers/net/wireless/ath/ath11k/mac.c
-+++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -8216,7 +8216,6 @@ ath11k_mac_op_assign_vif_chanctx(struct
- 	struct ath11k_base *ab = ar->ab;
- 	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
- 	int ret;
--	struct peer_create_params param;
- 
- 	mutex_lock(&ar->conf_mutex);
- 
-@@ -8239,21 +8238,6 @@ ath11k_mac_op_assign_vif_chanctx(struct
- 		goto out;
- 	}
- 
--	if (ab->hw_params.vdev_start_delay &&
--	    arvif->vdev_type != WMI_VDEV_TYPE_AP &&
--	    arvif->vdev_type != WMI_VDEV_TYPE_MONITOR) {
--		param.vdev_id = arvif->vdev_id;
--		param.peer_type = WMI_PEER_TYPE_DEFAULT;
--		param.peer_addr = ar->mac_addr;
--
--		ret = ath11k_peer_create(ar, arvif, NULL, &param);
--		if (ret) {
--			ath11k_warn(ab, "failed to create peer after vdev start delay: %d",
--				    ret);
--			goto out;
--		}
--	}
--
- 	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
- 		ret = ath11k_mac_monitor_start(ar);
- 		if (ret) {
diff --git a/package/kernel/mac80211/patches/nss/ath11k/907-02-wifi-ath11k-rename-ath11k_start_vdev_delay.patch b/package/kernel/mac80211/patches/nss/ath11k/907-02-wifi-ath11k-rename-ath11k_start_vdev_delay.patch
deleted file mode 100644
index 12744f51c64e96..00000000000000
--- a/package/kernel/mac80211/patches/nss/ath11k/907-02-wifi-ath11k-rename-ath11k_start_vdev_delay.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From: Baochen Qiang <quic_bqiang@quicinc.com>
-To: <ath11k@lists.infradead.org>
-Subject: [PATCH 2/4] wifi: ath11k: rename ath11k_start_vdev_delay()
-Date: Tue, 23 Jan 2024 10:56:58 +0800
-
-Rename ath11k_start_vdev_delay() as ath11k_mac_start_vdev_delay()
-to follow naming convention.
-
-Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1
-Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23
-Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
-Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
-
-Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
-Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
----
- drivers/net/wireless/ath/ath11k/mac.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
---- a/drivers/net/wireless/ath/ath11k/mac.c
-+++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -256,8 +256,8 @@ static const u32 ath11k_smps_map[] = {
- 	[WLAN_HT_CAP_SM_PS_DISABLED] = WMI_PEER_SMPS_PS_NONE,
- };
- 
--static int ath11k_start_vdev_delay(struct ieee80211_hw *hw,
--				   struct ieee80211_vif *vif);
-+static int ath11k_mac_start_vdev_delay(struct ieee80211_hw *hw,
-+				       struct ieee80211_vif *vif);
- 
- enum nl80211_he_ru_alloc ath11k_mac_phy_he_ru_to_nl80211_he_ru_alloc(u16 ru_phy)
- {
-@@ -5314,7 +5314,7 @@ static int ath11k_mac_station_add(struct
- 	if (ab->hw_params.vdev_start_delay &&
- 	    !arvif->is_started &&
- 	    arvif->vdev_type != WMI_VDEV_TYPE_AP) {
--		ret = ath11k_start_vdev_delay(ar->hw, vif);
-+		ret = ath11k_mac_start_vdev_delay(ar->hw, vif);
- 		if (ret) {
- 			ath11k_warn(ab, "failed to delay vdev start: %d\n", ret);
- 			goto free_tx_stats;
-@@ -8159,8 +8159,8 @@ unlock:
- 	mutex_unlock(&ar->conf_mutex);
- }
- 
--static int ath11k_start_vdev_delay(struct ieee80211_hw *hw,
--				   struct ieee80211_vif *vif)
-+static int ath11k_mac_start_vdev_delay(struct ieee80211_hw *hw,
-+				       struct ieee80211_vif *vif)
- {
- 	struct ath11k *ar = hw->priv;
- 	struct ath11k_base *ab = ar->ab;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/907-03-wifi-ath11k-avoid-forward-declaration-of-ath11k_mac_start_vdev_delay.patch b/package/kernel/mac80211/patches/nss/ath11k/907-03-wifi-ath11k-avoid-forward-declaration-of-ath11k_mac_start_vdev_delay.patch
deleted file mode 100644
index 710ad5aa5becca..00000000000000
--- a/package/kernel/mac80211/patches/nss/ath11k/907-03-wifi-ath11k-avoid-forward-declaration-of-ath11k_mac_start_vdev_delay.patch
+++ /dev/null
@@ -1,601 +0,0 @@
-From: Baochen Qiang <quic_bqiang@quicinc.com>
-To: <ath11k@lists.infradead.org>
-Subject: [PATCH 3/4] wifi: ath11k: avoid forward declaration of
- ath11k_mac_start_vdev_delay()
-Date: Tue, 23 Jan 2024 10:56:59 +0800
-
-Currently ath11k_mac_start_vdev_delay() needs a forward declaration because
-it is defined after where it is called. Avoid this by re-arranging
-ath11k_mac_station_add() and ath11k_mac_op_sta_state().
-
-No functional changes. Compile tested only.
-
-Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
-Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
----
- drivers/net/wireless/ath/ath11k/mac.c | 459 +++++++++++++-------------
- 1 file changed, 228 insertions(+), 231 deletions(-)
-
---- a/drivers/net/wireless/ath/ath11k/mac.c
-+++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -256,9 +256,6 @@ static const u32 ath11k_smps_map[] = {
- 	[WLAN_HT_CAP_SM_PS_DISABLED] = WMI_PEER_SMPS_PS_NONE,
- };
- 
--static int ath11k_mac_start_vdev_delay(struct ieee80211_hw *hw,
--				       struct ieee80211_vif *vif);
--
- enum nl80211_he_ru_alloc ath11k_mac_phy_he_ru_to_nl80211_he_ru_alloc(u16 ru_phy)
- {
- 	enum nl80211_he_ru_alloc ret;
-@@ -5244,100 +5241,6 @@ static void ath11k_mac_dec_num_stations(
- 	ar->num_stations--;
- }
- 
--static int ath11k_mac_station_add(struct ath11k *ar,
--				  struct ieee80211_vif *vif,
--				  struct ieee80211_sta *sta)
--{
--	struct ath11k_base *ab = ar->ab;
--	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
--	struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);
--	struct peer_create_params peer_param;
--	int ret;
--
--	lockdep_assert_held(&ar->conf_mutex);
--
--	ret = ath11k_mac_inc_num_stations(arvif, sta);
--	if (ret) {
--		ath11k_warn(ab, "refusing to associate station: too many connected already (%d)\n",
--			    ar->max_num_stations);
--		goto exit;
--	}
--
--	arsta->rx_stats = kzalloc(sizeof(*arsta->rx_stats), GFP_KERNEL);
--	if (!arsta->rx_stats) {
--		ret = -ENOMEM;
--		goto dec_num_station;
--	}
--
--	peer_param.vdev_id = arvif->vdev_id;
--	peer_param.peer_addr = sta->addr;
--	peer_param.peer_type = WMI_PEER_TYPE_DEFAULT;
--
--	ret = ath11k_peer_create(ar, arvif, sta, &peer_param);
--	if (ret) {
--		ath11k_warn(ab, "Failed to add peer: %pM for VDEV: %d\n",
--			    sta->addr, arvif->vdev_id);
--		goto free_rx_stats;
--	}
--
--	ath11k_dbg(ab, ATH11K_DBG_MAC, "Added peer: %pM for VDEV: %d\n",
--		   sta->addr, arvif->vdev_id);
--
--	if (ath11k_debugfs_is_extd_tx_stats_enabled(ar)) {
--		arsta->tx_stats = kzalloc(sizeof(*arsta->tx_stats), GFP_KERNEL);
--		if (!arsta->tx_stats) {
--			ret = -ENOMEM;
--			goto free_peer;
--		}
--	}
--
--	if (ieee80211_vif_is_mesh(vif)) {
--		ath11k_dbg(ab, ATH11K_DBG_MAC,
--			   "setting USE_4ADDR for mesh STA %pM\n", sta->addr);
--		ret = ath11k_wmi_set_peer_param(ar, sta->addr,
--						arvif->vdev_id,
--						WMI_PEER_USE_4ADDR, 1);
--		if (ret) {
--			ath11k_warn(ab, "failed to set mesh STA %pM 4addr capability: %d\n",
--				    sta->addr, ret);
--			goto free_tx_stats;
--		}
--	}
--
--	ret = ath11k_dp_peer_setup(ar, arvif->vdev_id, sta->addr);
--	if (ret) {
--		ath11k_warn(ab, "failed to setup dp for peer %pM on vdev %i (%d)\n",
--			    sta->addr, arvif->vdev_id, ret);
--		goto free_tx_stats;
--	}
--
--	if (ab->hw_params.vdev_start_delay &&
--	    !arvif->is_started &&
--	    arvif->vdev_type != WMI_VDEV_TYPE_AP) {
--		ret = ath11k_mac_start_vdev_delay(ar->hw, vif);
--		if (ret) {
--			ath11k_warn(ab, "failed to delay vdev start: %d\n", ret);
--			goto free_tx_stats;
--		}
--	}
--
--	ewma_avg_rssi_init(&arsta->avg_rssi);
--	return 0;
--
--free_tx_stats:
--	kfree(arsta->tx_stats);
--	arsta->tx_stats = NULL;
--free_peer:
--	ath11k_peer_delete(ar, arvif->vdev_id, sta->addr);
--free_rx_stats:
--	kfree(arsta->rx_stats);
--	arsta->rx_stats = NULL;
--dec_num_station:
--	ath11k_mac_dec_num_stations(arvif, sta);
--exit:
--	return ret;
--}
--
- static u32 ath11k_mac_ieee80211_sta_bw_to_wmi(struct ath11k *ar,
- 					      struct ieee80211_sta *sta)
- {
-@@ -5393,187 +5296,6 @@ static int ath11k_mac_cfg_dyn_vlan(struc
- 	return ret;
- }
- 
--static int ath11k_mac_op_sta_state(struct ieee80211_hw *hw,
--				   struct ieee80211_vif *vif,
--				   struct ieee80211_sta *sta,
--				   enum ieee80211_sta_state old_state,
--				   enum ieee80211_sta_state new_state)
--{
--	struct ath11k *ar = hw->priv;
--	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
--	struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);
--	struct ath11k_peer *peer;
--	int ret = 0;
--
--	/* cancel must be done outside the mutex to avoid deadlock */
--	if ((old_state == IEEE80211_STA_NONE &&
--	     new_state == IEEE80211_STA_NOTEXIST)) {
--		cancel_work_sync(&arsta->update_wk);
--		cancel_work_sync(&arsta->set_4addr_wk);
--	}
--
--	mutex_lock(&ar->conf_mutex);
--
--	if (old_state == IEEE80211_STA_NOTEXIST &&
--	    new_state == IEEE80211_STA_NONE) {
--		memset(arsta, 0, sizeof(*arsta));
--		arsta->arvif = arvif;
--		arsta->peer_ps_state = WMI_PEER_PS_STATE_DISABLED;
--		INIT_WORK(&arsta->update_wk, ath11k_sta_rc_update_wk);
--		INIT_WORK(&arsta->set_4addr_wk, ath11k_sta_set_4addr_wk);
--
--		ret = ath11k_mac_station_add(ar, vif, sta);
--		if (ret)
--			ath11k_warn(ar->ab, "Failed to add station: %pM for VDEV: %d\n",
--				    sta->addr, arvif->vdev_id);
--	} else if ((old_state == IEEE80211_STA_NONE &&
--		    new_state == IEEE80211_STA_NOTEXIST)) {
--		bool skip_peer_delete = ar->ab->hw_params.vdev_start_delay &&
--			vif->type == NL80211_IFTYPE_STATION;
--
--		ath11k_dp_peer_cleanup(ar, arvif->vdev_id, sta->addr);
--
--		if (!skip_peer_delete) {
--			ret = ath11k_peer_delete(ar, arvif->vdev_id, sta->addr);
--			if (ret)
--				ath11k_warn(ar->ab,
--					    "Failed to delete peer: %pM for VDEV: %d\n",
--					    sta->addr, arvif->vdev_id);
--			else
--				ath11k_dbg(ar->ab,
--					   ATH11K_DBG_MAC,
--					   "Removed peer: %pM for VDEV: %d\n",
--					   sta->addr, arvif->vdev_id);
--		}
--
--		ath11k_mac_dec_num_stations(arvif, sta);
--		mutex_lock(&ar->ab->tbl_mtx_lock);
--		spin_lock_bh(&ar->ab->base_lock);
--		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
--		if (skip_peer_delete && peer) {
--			peer->sta = NULL;
--		} else if (peer && peer->sta == sta) {
--			ath11k_warn(ar->ab, "Found peer entry %pM n vdev %i after it was supposedly removed\n",
--				    vif->addr, arvif->vdev_id);
--			ath11k_peer_rhash_delete(ar->ab, peer);
--			peer->sta = NULL;
--			list_del(&peer->list);
--			kfree(peer);
--			ar->num_peers--;
--		}
--		spin_unlock_bh(&ar->ab->base_lock);
--		mutex_unlock(&ar->ab->tbl_mtx_lock);
--
--		kfree(arsta->tx_stats);
--		arsta->tx_stats = NULL;
--
--		kfree(arsta->rx_stats);
--		arsta->rx_stats = NULL;
--	} else if (old_state == IEEE80211_STA_AUTH &&
--		   new_state == IEEE80211_STA_ASSOC &&
--		   (vif->type == NL80211_IFTYPE_AP ||
--		    vif->type == NL80211_IFTYPE_MESH_POINT ||
--		    vif->type == NL80211_IFTYPE_ADHOC)) {
--		ret = ath11k_station_assoc(ar, vif, sta, false);
--		if (ret)
--			ath11k_warn(ar->ab, "Failed to associate station: %pM\n",
--				    sta->addr);
--
--		spin_lock_bh(&ar->data_lock);
--		/* Set arsta bw and prev bw */
--		arsta->bw = ath11k_mac_ieee80211_sta_bw_to_wmi(ar, sta);
--		arsta->bw_prev = arsta->bw;
--		spin_unlock_bh(&ar->data_lock);
--
--		/* Driver should clear the peer keys during mac80211's ref ptr
--		 * gets cleared in __sta_info_destroy_part2 (trans from
--		 * IEEE80211_STA_AUTHORIZED to IEEE80211_STA_ASSOC)
--		 */
--		ret = ath11k_clear_peer_keys(arvif, sta->addr);
--		if (ret) {
--			ath11k_warn(ar->ab, "failed to clear all peer keys for vdev %i: %d\n",
--					arvif->vdev_id, ret);
--			return ret;
--		}
--	} else if (old_state == IEEE80211_STA_ASSOC &&
--		   new_state == IEEE80211_STA_AUTHORIZED) {
--		spin_lock_bh(&ar->ab->base_lock);
--
--		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
--		if (peer)
--			peer->is_authorized = true;
--
--		spin_unlock_bh(&ar->ab->base_lock);
--
--		if (vif->type == NL80211_IFTYPE_STATION && arvif->is_up) {
--			ret = ath11k_wmi_set_peer_param(ar, sta->addr,
--							arvif->vdev_id,
--							WMI_PEER_AUTHORIZE,
--							1);
--			if (ret)
--				ath11k_warn(ar->ab, "Unable to authorize peer %pM vdev %d: %d\n",
--					    sta->addr, arvif->vdev_id, ret);
--		} else if (ar->ab->nss.enabled &&
--			   vif->type == NL80211_IFTYPE_AP_VLAN &&
--			   !arsta->use_4addr_set) {
--
--			if (ar->state == ATH11K_STATE_RESTARTED) {
--				/* During ieee80211_reconfig(), at this point, nss ext vdev peer is not
--				 * authorized. Hence ath11k_mac_cfg_dyn_vlan() will return error. We save
--				 * the state vars here and use it later once nss ext vdev is authorized
--				 * in ath11k_mac_op_set_key() */
--				struct ath11k_dyn_vlan_cfg *ar_dyn_vlan_cfg;
--				ar_dyn_vlan_cfg = kzalloc(sizeof(*ar_dyn_vlan_cfg), GFP_ATOMIC);
--
--				if (!ar_dyn_vlan_cfg) {
--					ath11k_warn(ar->ab, "failed to save state for dynamic AP_VLAN configuration (%d)",
--						    -ENOSPC);
--				} else {
--					INIT_LIST_HEAD(&ar_dyn_vlan_cfg->cfg_list);
--					ar_dyn_vlan_cfg->arvif = arvif;
--					ar_dyn_vlan_cfg->sta = sta;
--					/* save it to arvif (AP_VLAN) list */
--					list_add_tail(&ar_dyn_vlan_cfg->cfg_list, &arvif->dyn_vlan_cfg);
--				}
--			} else {
--				ret = ath11k_mac_cfg_dyn_vlan(ar->ab, arvif, sta);
--				if (ret)
--					ath11k_warn(ar->ab, "failed to cfg dyn vlan for peer %pM: %d\n",
--						    sta->addr, ret);
--			}
--		}
--	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
--		   new_state == IEEE80211_STA_ASSOC) {
--
--		spin_lock_bh(&ar->ab->base_lock);
--		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
--		if (peer)
--			peer->is_authorized = false;
--		spin_unlock_bh(&ar->ab->base_lock);
--	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
--		   new_state == IEEE80211_STA_ASSOC) {
--		spin_lock_bh(&ar->ab->base_lock);
--
--		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
--		if (peer)
--			peer->is_authorized = false;
--
--		spin_unlock_bh(&ar->ab->base_lock);
--	} else if (old_state == IEEE80211_STA_ASSOC &&
--		   new_state == IEEE80211_STA_AUTH &&
--		   (vif->type == NL80211_IFTYPE_AP ||
--		    vif->type == NL80211_IFTYPE_MESH_POINT ||
--		    vif->type == NL80211_IFTYPE_ADHOC)) {
--		ret = ath11k_station_disassoc(ar, vif, sta);
--		if (ret)
--			ath11k_warn(ar->ab, "Failed to disassociate station: %pM\n",
--				    sta->addr);
--	}
--
--	mutex_unlock(&ar->conf_mutex);
--	return ret;
--}
--
- static int ath11k_mac_op_sta_set_txpwr(struct ieee80211_hw *hw,
- 				       struct ieee80211_vif *vif,
- 				       struct ieee80211_sta *sta)
-@@ -9736,6 +9458,281 @@ ath11k_mac_op_config_mesh_offload_path(s
- }
- #endif
- 
-+static int ath11k_mac_station_add(struct ath11k *ar,
-+				  struct ieee80211_vif *vif,
-+				  struct ieee80211_sta *sta)
-+{
-+	struct ath11k_base *ab = ar->ab;
-+	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
-+	struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);
-+	struct peer_create_params peer_param;
-+	int ret;
-+
-+	lockdep_assert_held(&ar->conf_mutex);
-+
-+	ret = ath11k_mac_inc_num_stations(arvif, sta);
-+	if (ret) {
-+		ath11k_warn(ab, "refusing to associate station: too many connected already (%d)\n",
-+			    ar->max_num_stations);
-+		goto exit;
-+	}
-+
-+	arsta->rx_stats = kzalloc(sizeof(*arsta->rx_stats), GFP_KERNEL);
-+	if (!arsta->rx_stats) {
-+		ret = -ENOMEM;
-+		goto dec_num_station;
-+	}
-+
-+	peer_param.vdev_id = arvif->vdev_id;
-+	peer_param.peer_addr = sta->addr;
-+	peer_param.peer_type = WMI_PEER_TYPE_DEFAULT;
-+
-+	ret = ath11k_peer_create(ar, arvif, sta, &peer_param);
-+	if (ret) {
-+		ath11k_warn(ab, "Failed to add peer: %pM for VDEV: %d\n",
-+			    sta->addr, arvif->vdev_id);
-+		goto free_rx_stats;
-+	}
-+
-+	ath11k_dbg(ab, ATH11K_DBG_MAC, "Added peer: %pM for VDEV: %d\n",
-+		   sta->addr, arvif->vdev_id);
-+
-+	if (ath11k_debugfs_is_extd_tx_stats_enabled(ar)) {
-+		arsta->tx_stats = kzalloc(sizeof(*arsta->tx_stats), GFP_KERNEL);
-+		if (!arsta->tx_stats) {
-+			ret = -ENOMEM;
-+			goto free_peer;
-+		}
-+	}
-+
-+	if (ieee80211_vif_is_mesh(vif)) {
-+		ath11k_dbg(ab, ATH11K_DBG_MAC,
-+			   "setting USE_4ADDR for mesh STA %pM\n", sta->addr);
-+		ret = ath11k_wmi_set_peer_param(ar, sta->addr,
-+						arvif->vdev_id,
-+						WMI_PEER_USE_4ADDR, 1);
-+		if (ret) {
-+			ath11k_warn(ab, "failed to set mesh STA %pM 4addr capability: %d\n",
-+				    sta->addr, ret);
-+			goto free_tx_stats;
-+		}
-+	}
-+
-+	ret = ath11k_dp_peer_setup(ar, arvif->vdev_id, sta->addr);
-+	if (ret) {
-+		ath11k_warn(ab, "failed to setup dp for peer %pM on vdev %i (%d)\n",
-+			    sta->addr, arvif->vdev_id, ret);
-+		goto free_tx_stats;
-+	}
-+
-+	if (ab->hw_params.vdev_start_delay &&
-+	    !arvif->is_started &&
-+	    arvif->vdev_type != WMI_VDEV_TYPE_AP) {
-+		ret = ath11k_mac_start_vdev_delay(ar->hw, vif);
-+		if (ret) {
-+			ath11k_warn(ab, "failed to delay vdev start: %d\n", ret);
-+			goto free_tx_stats;
-+		}
-+	}
-+
-+	ewma_avg_rssi_init(&arsta->avg_rssi);
-+	return 0;
-+
-+free_tx_stats:
-+	kfree(arsta->tx_stats);
-+	arsta->tx_stats = NULL;
-+free_peer:
-+	ath11k_peer_delete(ar, arvif->vdev_id, sta->addr);
-+free_rx_stats:
-+	kfree(arsta->rx_stats);
-+	arsta->rx_stats = NULL;
-+dec_num_station:
-+	ath11k_mac_dec_num_stations(arvif, sta);
-+exit:
-+	return ret;
-+}
-+
-+static int ath11k_mac_op_sta_state(struct ieee80211_hw *hw,
-+				   struct ieee80211_vif *vif,
-+				   struct ieee80211_sta *sta,
-+				   enum ieee80211_sta_state old_state,
-+				   enum ieee80211_sta_state new_state)
-+{
-+	struct ath11k *ar = hw->priv;
-+	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
-+	struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);
-+	struct ath11k_peer *peer;
-+	int ret = 0;
-+
-+	/* cancel must be done outside the mutex to avoid deadlock */
-+	if ((old_state == IEEE80211_STA_NONE &&
-+	     new_state == IEEE80211_STA_NOTEXIST)) {
-+		cancel_work_sync(&arsta->update_wk);
-+		cancel_work_sync(&arsta->set_4addr_wk);
-+	}
-+
-+	mutex_lock(&ar->conf_mutex);
-+
-+	if (old_state == IEEE80211_STA_NOTEXIST &&
-+	    new_state == IEEE80211_STA_NONE) {
-+		memset(arsta, 0, sizeof(*arsta));
-+		arsta->arvif = arvif;
-+		arsta->peer_ps_state = WMI_PEER_PS_STATE_DISABLED;
-+		INIT_WORK(&arsta->update_wk, ath11k_sta_rc_update_wk);
-+		INIT_WORK(&arsta->set_4addr_wk, ath11k_sta_set_4addr_wk);
-+
-+		ret = ath11k_mac_station_add(ar, vif, sta);
-+		if (ret)
-+			ath11k_warn(ar->ab, "Failed to add station: %pM for VDEV: %d\n",
-+				    sta->addr, arvif->vdev_id);
-+	} else if ((old_state == IEEE80211_STA_NONE &&
-+		    new_state == IEEE80211_STA_NOTEXIST)) {
-+		bool skip_peer_delete = ar->ab->hw_params.vdev_start_delay &&
-+			vif->type == NL80211_IFTYPE_STATION;
-+
-+		ath11k_dp_peer_cleanup(ar, arvif->vdev_id, sta->addr);
-+
-+		if (!skip_peer_delete) {
-+			ret = ath11k_peer_delete(ar, arvif->vdev_id, sta->addr);
-+			if (ret)
-+				ath11k_warn(ar->ab,
-+					    "Failed to delete peer: %pM for VDEV: %d\n",
-+					    sta->addr, arvif->vdev_id);
-+			else
-+				ath11k_dbg(ar->ab,
-+					   ATH11K_DBG_MAC,
-+					   "Removed peer: %pM for VDEV: %d\n",
-+					   sta->addr, arvif->vdev_id);
-+		}
-+
-+		ath11k_mac_dec_num_stations(arvif, sta);
-+		mutex_lock(&ar->ab->tbl_mtx_lock);
-+		spin_lock_bh(&ar->ab->base_lock);
-+		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
-+		if (skip_peer_delete && peer) {
-+			peer->sta = NULL;
-+		} else if (peer && peer->sta == sta) {
-+			ath11k_warn(ar->ab, "Found peer entry %pM n vdev %i after it was supposedly removed\n",
-+				    vif->addr, arvif->vdev_id);
-+			ath11k_peer_rhash_delete(ar->ab, peer);
-+			peer->sta = NULL;
-+			list_del(&peer->list);
-+			kfree(peer);
-+			ar->num_peers--;
-+		}
-+		spin_unlock_bh(&ar->ab->base_lock);
-+		mutex_unlock(&ar->ab->tbl_mtx_lock);
-+
-+		kfree(arsta->tx_stats);
-+		arsta->tx_stats = NULL;
-+
-+		kfree(arsta->rx_stats);
-+		arsta->rx_stats = NULL;
-+	} else if (old_state == IEEE80211_STA_AUTH &&
-+		   new_state == IEEE80211_STA_ASSOC &&
-+		   (vif->type == NL80211_IFTYPE_AP ||
-+		    vif->type == NL80211_IFTYPE_MESH_POINT ||
-+		    vif->type == NL80211_IFTYPE_ADHOC)) {
-+		ret = ath11k_station_assoc(ar, vif, sta, false);
-+		if (ret)
-+			ath11k_warn(ar->ab, "Failed to associate station: %pM\n",
-+				    sta->addr);
-+
-+		spin_lock_bh(&ar->data_lock);
-+		/* Set arsta bw and prev bw */
-+		arsta->bw = ath11k_mac_ieee80211_sta_bw_to_wmi(ar, sta);
-+		arsta->bw_prev = arsta->bw;
-+		spin_unlock_bh(&ar->data_lock);
-+
-+		/* Driver should clear the peer keys during mac80211's ref ptr
-+		 * gets cleared in __sta_info_destroy_part2 (trans from
-+		 * IEEE80211_STA_AUTHORIZED to IEEE80211_STA_ASSOC)
-+		 */
-+		ret = ath11k_clear_peer_keys(arvif, sta->addr);
-+		if (ret) {
-+			ath11k_warn(ar->ab, "failed to clear all peer keys for vdev %i: %d\n",
-+					arvif->vdev_id, ret);
-+			return ret;
-+		}
-+	} else if (old_state == IEEE80211_STA_ASSOC &&
-+		   new_state == IEEE80211_STA_AUTHORIZED) {
-+		spin_lock_bh(&ar->ab->base_lock);
-+
-+		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
-+		if (peer)
-+			peer->is_authorized = true;
-+
-+		spin_unlock_bh(&ar->ab->base_lock);
-+
-+		if (vif->type == NL80211_IFTYPE_STATION && arvif->is_up) {
-+			ret = ath11k_wmi_set_peer_param(ar, sta->addr,
-+							arvif->vdev_id,
-+							WMI_PEER_AUTHORIZE,
-+							1);
-+			if (ret)
-+				ath11k_warn(ar->ab, "Unable to authorize peer %pM vdev %d: %d\n",
-+					    sta->addr, arvif->vdev_id, ret);
-+		} else if (ar->ab->nss.enabled &&
-+			   vif->type == NL80211_IFTYPE_AP_VLAN &&
-+			   !arsta->use_4addr_set) {
-+
-+			if (ar->state == ATH11K_STATE_RESTARTED) {
-+				/* During ieee80211_reconfig(), at this point, nss ext vdev peer is not
-+				 * authorized. Hence ath11k_mac_cfg_dyn_vlan() will return error. We save
-+				 * the state vars here and use it later once nss ext vdev is authorized
-+				 * in ath11k_mac_op_set_key() */
-+				struct ath11k_dyn_vlan_cfg *ar_dyn_vlan_cfg;
-+				ar_dyn_vlan_cfg = kzalloc(sizeof(*ar_dyn_vlan_cfg), GFP_ATOMIC);
-+
-+				if (!ar_dyn_vlan_cfg) {
-+					ath11k_warn(ar->ab, "failed to save state for dynamic AP_VLAN configuration (%d)",
-+						    -ENOSPC);
-+				} else {
-+					INIT_LIST_HEAD(&ar_dyn_vlan_cfg->cfg_list);
-+					ar_dyn_vlan_cfg->arvif = arvif;
-+					ar_dyn_vlan_cfg->sta = sta;
-+					/* save it to arvif (AP_VLAN) list */
-+					list_add_tail(&ar_dyn_vlan_cfg->cfg_list, &arvif->dyn_vlan_cfg);
-+				}
-+			} else {
-+				ret = ath11k_mac_cfg_dyn_vlan(ar->ab, arvif, sta);
-+				if (ret)
-+					ath11k_warn(ar->ab, "failed to cfg dyn vlan for peer %pM: %d\n",
-+						    sta->addr, ret);
-+			}
-+		}
-+	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
-+		   new_state == IEEE80211_STA_ASSOC) {
-+
-+		spin_lock_bh(&ar->ab->base_lock);
-+		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
-+		if (peer)
-+			peer->is_authorized = false;
-+		spin_unlock_bh(&ar->ab->base_lock);
-+	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
-+		   new_state == IEEE80211_STA_ASSOC) {
-+		spin_lock_bh(&ar->ab->base_lock);
-+
-+		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
-+		if (peer)
-+			peer->is_authorized = false;
-+
-+		spin_unlock_bh(&ar->ab->base_lock);
-+	} else if (old_state == IEEE80211_STA_ASSOC &&
-+		   new_state == IEEE80211_STA_AUTH &&
-+		   (vif->type == NL80211_IFTYPE_AP ||
-+		    vif->type == NL80211_IFTYPE_MESH_POINT ||
-+		    vif->type == NL80211_IFTYPE_ADHOC)) {
-+		ret = ath11k_station_disassoc(ar, vif, sta);
-+		if (ret)
-+			ath11k_warn(ar->ab, "Failed to disassociate station: %pM\n",
-+				    sta->addr);
-+	}
-+
-+	mutex_unlock(&ar->conf_mutex);
-+	return ret;
-+}
-+
- static const struct ieee80211_ops ath11k_ops = {
- 	.tx				= ath11k_mac_op_tx,
- 	.wake_tx_queue			= ieee80211_handle_wake_tx_queue,
diff --git a/package/kernel/mac80211/patches/nss/ath11k/907-04-wifi-ath11k-fix-connection-failure-due-to-unexpected-peer-delete.patch b/package/kernel/mac80211/patches/nss/ath11k/907-04-wifi-ath11k-fix-connection-failure-due-to-unexpected-peer-delete.patch
deleted file mode 100644
index 462e8cad727b5a..00000000000000
--- a/package/kernel/mac80211/patches/nss/ath11k/907-04-wifi-ath11k-fix-connection-failure-due-to-unexpected-peer-delete.patch
+++ /dev/null
@@ -1,257 +0,0 @@
-From: Baochen Qiang <quic_bqiang@quicinc.com>
-To: <ath11k@lists.infradead.org>
-Subject: [PATCH 4/4] wifi: ath11k: fix connection failure due to unexpected
- peer delete
-Date: Tue, 23 Jan 2024 10:57:00 +0800
-
-Currently ath11k_mac_op_unassign_vif_chanctx() deletes peer but
-ath11k_mac_op_assign_vif_chanctx() doesn't create it. This results in
-connection failure if MAC80211 calls drv_unassign_vif_chanctx() and
-drv_assign_vif_chanctx() during AUTH and ASSOC, see below log:
-
-[  102.372431] wlan0: authenticated
-[  102.372585] ath11k_pci 0000:01:00.0: wlan0: disabling HT/VHT/HE as WMM/QoS is not supported by the AP
-[  102.372593] ath11k_pci 0000:01:00.0: mac chanctx unassign ptr ffff895084638598 vdev_id 0
-[  102.372808] ath11k_pci 0000:01:00.0: WMI vdev stop id 0x0
-[  102.383114] ath11k_pci 0000:01:00.0: vdev stopped for vdev id 0
-[  102.384689] ath11k_pci 0000:01:00.0: WMI peer delete vdev_id 0 peer_addr 20:e5:2a:21:c4:51
-[  102.396676] ath11k_pci 0000:01:00.0: htt peer unmap vdev 0 peer 20:e5:2a:21:c4:51 id 3
-[  102.396711] ath11k_pci 0000:01:00.0: peer delete resp for vdev id 0 addr 20:e5:2a:21:c4:51
-[  102.396722] ath11k_pci 0000:01:00.0: mac removed peer 20:e5:2a:21:c4:51  vdev 0 after vdev stop
-[  102.396780] ath11k_pci 0000:01:00.0: mac chanctx assign ptr ffff895084639c18 vdev_id 0
-[  102.400628] wlan0: associate with 20:e5:2a:21:c4:51 (try 1/3)
-[  102.508864] wlan0: associate with 20:e5:2a:21:c4:51 (try 2/3)
-[  102.612815] wlan0: associate with 20:e5:2a:21:c4:51 (try 3/3)
-[  102.720846] wlan0: association with 20:e5:2a:21:c4:51 timed out
-
-The peer delete logic in ath11k_mac_op_unassign_vif_chanctx() is
-introduced by commit b4a0f54156ac ("ath11k: move peer delete after
-vdev stop of station for QCA6390 and WCN6855") to fix firmware
-crash issue caused by unexpected vdev stop/peer delete sequence.
-
-Actually for a STA interface peer should be deleted in
-ath11k_mac_op_sta_state() when STA's state changes from
-IEEE80211_STA_NONE to IEEE80211_STA_NOTEXIST, which also coincides
-with current peer creation design that peer is created during
-IEEE80211_STA_NOTEXIST -> IEEE80211_STA_NONE transition. So move
-peer delete back to ath11k_mac_op_sta_state(), also stop vdev before
-deleting peer to fix the firmware crash issue mentioned there. In
-this way the connection failure mentioned here is also fixed.
-
-Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1
-Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23
-Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
-Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
-
-Fixes: b4a0f54156ac ("ath11k: move peer delete after vdev stop of station for QCA6390 and WCN6855")
-Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
-Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
----
- drivers/net/wireless/ath/ath11k/mac.c | 139 ++++++++++++++++----------
- 1 file changed, 85 insertions(+), 54 deletions(-)
-
---- a/drivers/net/wireless/ath/ath11k/mac.c
-+++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -7928,6 +7928,30 @@ static int ath11k_mac_start_vdev_delay(s
- 	return 0;
- }
- 
-+static int ath11k_mac_stop_vdev_early(struct ieee80211_hw *hw,
-+				      struct ieee80211_vif *vif)
-+{
-+	struct ath11k *ar = hw->priv;
-+	struct ath11k_base *ab = ar->ab;
-+	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
-+	int ret;
-+
-+	if (WARN_ON(!arvif->is_started))
-+		return -EBUSY;
-+
-+	ret = ath11k_mac_vdev_stop(arvif);
-+	if (ret) {
-+		ath11k_warn(ab, "failed to stop vdev %i: %d\n",
-+			    arvif->vdev_id, ret);
-+		return ret;
-+	}
-+
-+	arvif->is_started = false;
-+
-+	/* TODO: Setup ps and cts/rts protection */
-+	return 0;
-+}
-+
- static int
- ath11k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw,
- 				 struct ieee80211_vif *vif,
-@@ -7972,15 +7996,17 @@ ath11k_mac_op_assign_vif_chanctx(struct
- 		goto out;
- 	}
- 
--	ret = ath11k_mac_vdev_start(arvif, ctx);
--	if (ret) {
--		ath11k_warn(ab, "failed to start vdev %i addr %pM on freq %d: %d\n",
--			    arvif->vdev_id, vif->addr,
--			    ctx->def.chan->center_freq, ret);
--		goto out;
--	}
-+	if (!arvif->is_started) {
-+		ret = ath11k_mac_vdev_start(arvif, ctx);
-+		if (ret) {
-+			ath11k_warn(ab, "failed to start vdev %i addr %pM on freq %d: %d\n",
-+				    arvif->vdev_id, vif->addr,
-+				    ctx->def.chan->center_freq, ret);
-+			goto out;
-+		}
- 
--	arvif->is_started = true;
-+		arvif->is_started = true;
-+	}
- 
- 	if (arvif->vdev_type != WMI_VDEV_TYPE_MONITOR &&
- 	    test_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags)) {
-@@ -8020,8 +8046,6 @@ ath11k_mac_op_unassign_vif_chanctx(struc
- 		   "chanctx unassign ptr %p vdev_id %i\n",
- 		   ctx, arvif->vdev_id);
- 
--	WARN_ON(!arvif->is_started);
--
- 	if (ab->hw_params.vdev_start_delay &&
- 	    arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
- 		spin_lock_bh(&ab->base_lock);
-@@ -8045,24 +8069,13 @@ ath11k_mac_op_unassign_vif_chanctx(struc
- 		return;
- 	}
- 
--	ret = ath11k_mac_vdev_stop(arvif);
--	if (ret)
--		ath11k_warn(ab, "failed to stop vdev %i: %d\n",
--			    arvif->vdev_id, ret);
--
--	arvif->is_started = false;
--
--	if (ab->hw_params.vdev_start_delay &&
--	    arvif->vdev_type == WMI_VDEV_TYPE_STA) {
--		ret = ath11k_peer_delete(ar, arvif->vdev_id, arvif->bssid);
-+	if (arvif->is_started) {
-+		ret = ath11k_mac_vdev_stop(arvif);
- 		if (ret)
--			ath11k_warn(ar->ab,
--				    "failed to delete peer %pM for vdev %d: %d\n",
--				    arvif->bssid, arvif->vdev_id, ret);
--		else
--			ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
--				   "removed peer %pM  vdev %d after vdev stop\n",
--				   arvif->bssid, arvif->vdev_id);
-+			ath11k_warn(ab, "failed to stop vdev %i: %d\n",
-+				    arvif->vdev_id, ret);
-+
-+		arvif->is_started = false;
- 	}
- 
- 	if (ab->hw_params.vdev_start_delay &&
-@@ -9552,6 +9565,46 @@ exit:
- 	return ret;
- }
- 
-+static int ath11k_mac_station_remove(struct ath11k *ar,
-+				     struct ieee80211_vif *vif,
-+				     struct ieee80211_sta *sta)
-+{
-+	struct ath11k_base *ab = ar->ab;
-+	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
-+	struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);
-+	int ret;
-+
-+	if (ab->hw_params.vdev_start_delay &&
-+	    arvif->is_started &&
-+	    arvif->vdev_type != WMI_VDEV_TYPE_AP) {
-+		ret = ath11k_mac_stop_vdev_early(ar->hw, vif);
-+		if (ret) {
-+			ath11k_warn(ab, "failed to do early vdev stop: %d\n", ret);
-+			return ret;
-+		}
-+	}
-+
-+	ath11k_dp_peer_cleanup(ar, arvif->vdev_id, sta->addr);
-+
-+	ret = ath11k_peer_delete(ar, arvif->vdev_id, sta->addr);
-+	if (ret)
-+		ath11k_warn(ab, "Failed to delete peer: %pM for VDEV: %d\n",
-+			    sta->addr, arvif->vdev_id);
-+	else
-+		ath11k_dbg(ab, ATH11K_DBG_MAC, "Removed peer: %pM for VDEV: %d\n",
-+			   sta->addr, arvif->vdev_id);
-+
-+	ath11k_mac_dec_num_stations(arvif, sta);
-+
-+	kfree(arsta->tx_stats);
-+	arsta->tx_stats = NULL;
-+
-+	kfree(arsta->rx_stats);
-+	arsta->rx_stats = NULL;
-+
-+	return ret;
-+}
-+
- static int ath11k_mac_op_sta_state(struct ieee80211_hw *hw,
- 				   struct ieee80211_vif *vif,
- 				   struct ieee80211_sta *sta,
-@@ -9587,31 +9640,15 @@ static int ath11k_mac_op_sta_state(struc
- 				    sta->addr, arvif->vdev_id);
- 	} else if ((old_state == IEEE80211_STA_NONE &&
- 		    new_state == IEEE80211_STA_NOTEXIST)) {
--		bool skip_peer_delete = ar->ab->hw_params.vdev_start_delay &&
--			vif->type == NL80211_IFTYPE_STATION;
--
--		ath11k_dp_peer_cleanup(ar, arvif->vdev_id, sta->addr);
--
--		if (!skip_peer_delete) {
--			ret = ath11k_peer_delete(ar, arvif->vdev_id, sta->addr);
--			if (ret)
--				ath11k_warn(ar->ab,
--					    "Failed to delete peer: %pM for VDEV: %d\n",
--					    sta->addr, arvif->vdev_id);
--			else
--				ath11k_dbg(ar->ab,
--					   ATH11K_DBG_MAC,
--					   "Removed peer: %pM for VDEV: %d\n",
--					   sta->addr, arvif->vdev_id);
--		}
-+		ret = ath11k_mac_station_remove(ar, vif, sta);
-+		if (ret)
-+			ath11k_warn(ar->ab, "Failed to remove station: %pM for VDEV: %d\n",
-+				    sta->addr, arvif->vdev_id);
- 
--		ath11k_mac_dec_num_stations(arvif, sta);
- 		mutex_lock(&ar->ab->tbl_mtx_lock);
- 		spin_lock_bh(&ar->ab->base_lock);
- 		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
--		if (skip_peer_delete && peer) {
--			peer->sta = NULL;
--		} else if (peer && peer->sta == sta) {
-+		if (peer && peer->sta == sta) {
- 			ath11k_warn(ar->ab, "Found peer entry %pM n vdev %i after it was supposedly removed\n",
- 				    vif->addr, arvif->vdev_id);
- 			ath11k_peer_rhash_delete(ar->ab, peer);
-@@ -9622,12 +9659,6 @@ static int ath11k_mac_op_sta_state(struc
- 		}
- 		spin_unlock_bh(&ar->ab->base_lock);
- 		mutex_unlock(&ar->ab->tbl_mtx_lock);
--
--		kfree(arsta->tx_stats);
--		arsta->tx_stats = NULL;
--
--		kfree(arsta->rx_stats);
--		arsta->rx_stats = NULL;
- 	} else if (old_state == IEEE80211_STA_AUTH &&
- 		   new_state == IEEE80211_STA_ASSOC &&
- 		   (vif->type == NL80211_IFTYPE_AP ||
-@@ -10200,6 +10231,8 @@ static int __ath11k_mac_register(struct
- 
- 	wiphy_ext_feature_set(ar->hw->wiphy, NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
- 
-+	wiphy_ext_feature_set(ar->hw->wiphy, NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
-+
- 	ar->hw->queues = ATH11K_HW_MAX_QUEUES;
- 	ar->hw->wiphy->tx_queue_len = ATH11K_QUEUE_LEN;
- 	ar->hw->offchannel_tx_hw_queue = ATH11K_HW_MAX_QUEUES - 1;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/908-ath11k-make-debugfs-sta-htt-stats-modular.patch b/package/kernel/mac80211/patches/nss/ath11k/908-ath11k-make-debugfs-sta-htt-stats-modular.patch
index 829f59bfdc43b5..3ebad50617b79b 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/908-ath11k-make-debugfs-sta-htt-stats-modular.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/908-ath11k-make-debugfs-sta-htt-stats-modular.patch
@@ -27,9 +27,9 @@
  	depends on ATH11K && EVENT_TRACING
 --- a/drivers/net/wireless/ath/ath11k/Makefile
 +++ b/drivers/net/wireless/ath/ath11k/Makefile
-@@ -19,7 +19,9 @@ ath11k-y += core.o \
- 	    hw.o \
- 	    pcic.o
+@@ -20,7 +20,9 @@ ath11k-y += core.o \
+ 	    pcic.o \
+ 	    fw.o
  
 -ath11k-$(CPTCFG_ATH11K_DEBUGFS) += debugfs.o debugfs_htt_stats.o debugfs_sta.o
 +ath11k-$(CPTCFG_ATH11K_DEBUGFS) += debugfs.o
@@ -40,7 +40,7 @@
  ath11k-$(CPTCFG_ATH11K_THERMAL) += thermal.o
 --- a/drivers/net/wireless/ath/ath11k/debugfs.c
 +++ b/drivers/net/wireless/ath/ath11k/debugfs.c
-@@ -1875,7 +1875,9 @@ int ath11k_debugfs_register(struct ath11
+@@ -1876,7 +1876,9 @@ int ath11k_debugfs_register(struct ath11
  	snprintf(buf, 100, "../../ath11k/%pd2", ar->debug.debugfs_pdev);
  	debugfs_create_symlink("ath11k", ar->hw->wiphy->debugfsdir, buf);
  
@@ -52,7 +52,7 @@
  
 --- a/drivers/net/wireless/ath/ath11k/debugfs_sta.c
 +++ b/drivers/net/wireless/ath/ath11k/debugfs_sta.c
-@@ -11,7 +11,9 @@
+@@ -12,7 +12,9 @@
  #include "debug.h"
  #include "dp_tx.h"
  #include "dp_rx.h"
@@ -62,7 +62,7 @@
  
  static inline u32 ath11k_he_tones_in_ru_to_nl80211_he_ru_alloc(u16 ru_tones)
  {
-@@ -551,6 +553,7 @@ static const struct file_operations fops
+@@ -552,6 +554,7 @@ static const struct file_operations fops
  	.llseek = default_llseek,
  };
  
@@ -70,7 +70,7 @@
  static int
  ath11k_dbg_sta_open_htt_peer_stats(struct inode *inode, struct file *file)
  {
-@@ -622,6 +625,7 @@ static const struct file_operations fops
+@@ -623,6 +626,7 @@ static const struct file_operations fops
  	.owner = THIS_MODULE,
  	.llseek = default_llseek,
  };
@@ -78,7 +78,7 @@
  
  static ssize_t ath11k_dbg_sta_write_peer_pktlog(struct file *file,
  						const char __user *buf,
-@@ -906,6 +910,7 @@ static const struct file_operations fops
+@@ -907,6 +911,7 @@ static const struct file_operations fops
  	.llseek = default_llseek,
  };
  
@@ -86,7 +86,7 @@
  static ssize_t
  ath11k_write_htt_peer_stats_reset(struct file *file,
  				  const char __user *user_buf,
-@@ -965,6 +970,7 @@ static const struct file_operations fops
+@@ -966,6 +971,7 @@ static const struct file_operations fops
  	.owner = THIS_MODULE,
  	.llseek = default_llseek,
  };
@@ -94,7 +94,7 @@
  
  static ssize_t ath11k_dbg_sta_read_peer_ps_state(struct file *file,
  						 char __user *user_buf,
-@@ -1111,8 +1117,10 @@ void ath11k_debugfs_sta_op_add(struct ie
+@@ -1112,8 +1118,10 @@ void ath11k_debugfs_sta_op_add(struct ie
  				    &fops_reset_rx_stats);
  	}
  
@@ -105,7 +105,7 @@
  
  	debugfs_create_file("peer_pktlog", 0644, dir, sta,
  			    &fops_peer_pktlog);
-@@ -1122,10 +1130,12 @@ void ath11k_debugfs_sta_op_add(struct ie
+@@ -1123,10 +1131,12 @@ void ath11k_debugfs_sta_op_add(struct ie
  	debugfs_create_file("addba_resp", 0200, dir, sta, &fops_addba_resp);
  	debugfs_create_file("delba", 0200, dir, sta, &fops_delba);
  
@@ -120,7 +120,7 @@
  			    &fops_peer_ps_state);
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -1723,8 +1723,10 @@ ath11k_update_per_peer_tx_stats(struct a
+@@ -1724,8 +1724,10 @@ ath11k_update_per_peer_tx_stats(struct a
  		peer_stats->mu_pos   = mu_pos;
  		peer_stats->ru_tones = arsta->txrate.he_ru_alloc;
  
@@ -131,7 +131,7 @@
  	}
  
  	usr_stats->rate_stats_updated = true;
-@@ -2170,7 +2172,9 @@ void ath11k_dp_htt_htc_t2h_msg_handler(s
+@@ -2171,7 +2173,9 @@ void ath11k_dp_htt_htc_t2h_msg_handler(s
  		ath11k_htt_pull_ppdu_stats(ab, skb);
  		break;
  	case HTT_T2H_MSG_TYPE_EXT_STATS_CONF:
@@ -176,18 +176,18 @@
  	spin_unlock_bh(&ab->base_lock);
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -9809,7 +9809,7 @@ static const struct ieee80211_ops ath11k
+@@ -10327,7 +10327,7 @@ static const struct ieee80211_ops ath11k
  	.set_wakeup			= ath11k_wow_op_set_wakeup,
  #endif
  
 -#ifdef CPTCFG_ATH11K_DEBUGFS
 +#ifdef CPTCFG_ATH11K_DEBUGFS_STA
+ 	.vif_add_debugfs		= ath11k_debugfs_op_vif_add,
  	.sta_add_debugfs		= ath11k_debugfs_sta_op_add,
  #endif
- 
 --- a/local-symbols
 +++ b/local-symbols
-@@ -176,6 +176,8 @@ ATH11K_MEM_PROFILE_256M=
+@@ -169,6 +169,8 @@ ATH11K_MEM_PROFILE_256M=
  ATH11K_MEM_PROFILE_512M=
  ATH11K_DEBUG=
  ATH11K_DEBUGFS=
diff --git a/package/kernel/mac80211/patches/nss/ath11k/909-wifi-ath11k-fix-invalid-access-to-memory.patch b/package/kernel/mac80211/patches/nss/ath11k/909-wifi-ath11k-fix-invalid-access-to-memory.patch
index da069c0de63163..c6550184edcddb 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/909-wifi-ath11k-fix-invalid-access-to-memory.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/909-wifi-ath11k-fix-invalid-access-to-memory.patch
@@ -18,7 +18,7 @@ Signed-off-by: Sarika Sharma <quic_sarishar@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -2202,6 +2202,7 @@ static int ath11k_dp_rx_msdu_coalesce(st
+@@ -2203,6 +2203,7 @@ static int ath11k_dp_rx_msdu_coalesce(st
  	struct hal_rx_desc *ldesc;
  	int space_extra, rem_len, buf_len;
  	u32 hal_rx_desc_sz = ar->ab->hw_params.hal_desc_sz;
@@ -26,7 +26,7 @@ Signed-off-by: Sarika Sharma <quic_sarishar@quicinc.com>
  
  	/* As the msdu is spread across multiple rx buffers,
  	 * find the offset to the start of msdu for computing
-@@ -2250,7 +2251,8 @@ static int ath11k_dp_rx_msdu_coalesce(st
+@@ -2251,7 +2252,8 @@ static int ath11k_dp_rx_msdu_coalesce(st
  	rem_len = msdu_len - buf_first_len;
  	while ((skb = __skb_dequeue(msdu_list)) != NULL && rem_len > 0) {
  		rxcb = ATH11K_SKB_RXCB(skb);
@@ -36,7 +36,7 @@ Signed-off-by: Sarika Sharma <quic_sarishar@quicinc.com>
  			buf_len = DP_RX_BUFFER_SIZE - hal_rx_desc_sz;
  		else
  			buf_len = rem_len;
-@@ -2268,7 +2270,7 @@ static int ath11k_dp_rx_msdu_coalesce(st
+@@ -2269,7 +2271,7 @@ static int ath11k_dp_rx_msdu_coalesce(st
  		dev_kfree_skb_any(skb);
  
  		rem_len -= buf_len;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch b/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
index ae7f1f8434af16..0e8d17cd5043aa 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
@@ -12,7 +12,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/debugfs.c
 +++ b/drivers/net/wireless/ath/ath11k/debugfs.c
-@@ -668,6 +668,7 @@ static ssize_t ath11k_write_extd_rx_stat
+@@ -669,6 +669,7 @@ static ssize_t ath11k_write_extd_rx_stat
  	}
  
  	ar->debug.rx_filter = tlv_filter.rx_filter;
@@ -20,7 +20,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
  		ring_id = ar->dp.rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
-@@ -1228,6 +1229,7 @@ static ssize_t ath11k_write_pktlog_filte
+@@ -1229,6 +1230,7 @@ static ssize_t ath11k_write_pktlog_filte
  	}
  
  	/* Clear rx filter set for monitor mode and rx status */
@@ -179,7 +179,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  #define HTT_RX_FULL_MON_MODE_CFG_CMD_INFO0_MSG_TYPE	GENMASK(7, 0)
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -73,6 +73,12 @@ static inline bool ath11k_dp_rx_h_mpdu_s
+@@ -74,6 +74,12 @@ static inline bool ath11k_dp_rx_h_mpdu_s
  	return ab->hw_params.hw_ops->rx_desc_get_mpdu_fc_valid(desc);
  }
  
@@ -192,7 +192,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  static inline bool ath11k_dp_rx_h_mpdu_start_more_frags(struct ath11k_base *ab,
  							struct sk_buff *skb)
  {
-@@ -309,6 +315,35 @@ static u8 *ath11k_dp_rxdesc_mpdu_start_a
+@@ -310,6 +316,35 @@ static u8 *ath11k_dp_rxdesc_mpdu_start_a
  	return ab->hw_params.hw_ops->rx_desc_mpdu_start_addr2(desc);
  }
  
@@ -228,7 +228,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  static void ath11k_dp_service_mon_ring(struct timer_list *t)
  {
  	struct ath11k_base *ab = from_timer(ab, t, mon_reap_timer);
-@@ -2389,6 +2424,49 @@ int ath11k_dp_rx_crypto_icv_len(struct a
+@@ -2390,6 +2425,49 @@ int ath11k_dp_rx_crypto_icv_len(struct a
  	return 0;
  }
  
@@ -278,7 +278,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  static void ath11k_dp_rx_h_undecap_nwifi(struct ath11k *ar,
  					 struct sk_buff *msdu,
  					 u8 *first_hdr,
-@@ -2402,7 +2480,8 @@ static void ath11k_dp_rx_h_undecap_nwifi
+@@ -2403,7 +2481,8 @@ static void ath11k_dp_rx_h_undecap_nwifi
  	u8 da[ETH_ALEN];
  	u8 sa[ETH_ALEN];
  	u16 qos_ctl = 0;
@@ -288,7 +288,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  	/* copy SA & DA and pull decapped header */
  	hdr = (struct ieee80211_hdr *)msdu->data;
-@@ -2411,7 +2490,7 @@ static void ath11k_dp_rx_h_undecap_nwifi
+@@ -2412,7 +2491,7 @@ static void ath11k_dp_rx_h_undecap_nwifi
  	ether_addr_copy(sa, ieee80211_get_SA(hdr));
  	skb_pull(msdu, ieee80211_hdrlen(hdr->frame_control));
  
@@ -297,7 +297,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		/* original 802.11 header is valid for the first msdu
  		 * hence we can reuse the same header
  		 */
-@@ -2441,16 +2520,23 @@ static void ath11k_dp_rx_h_undecap_nwifi
+@@ -2442,16 +2521,23 @@ static void ath11k_dp_rx_h_undecap_nwifi
  
  		/* copy decap header before overwriting for reuse below */
  		memcpy(decap_hdr, (uint8_t *)hdr, hdr_len);
@@ -326,7 +326,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		memcpy(skb_push(msdu,
  				IEEE80211_QOS_CTL_LEN), &qos_ctl,
  				IEEE80211_QOS_CTL_LEN);
-@@ -2566,6 +2652,20 @@ static void ath11k_dp_rx_h_undecap_eth(s
+@@ -2567,6 +2653,20 @@ static void ath11k_dp_rx_h_undecap_eth(s
  	u8 da[ETH_ALEN];
  	u8 sa[ETH_ALEN];
  	void *rfc1042;
@@ -347,7 +347,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  	rfc1042 = ath11k_dp_rx_h_find_rfc1042(ar, msdu, enctype);
  	if (WARN_ON_ONCE(!rfc1042))
-@@ -2594,6 +2694,7 @@ static void ath11k_dp_rx_h_undecap_eth(s
+@@ -2595,6 +2695,7 @@ static void ath11k_dp_rx_h_undecap_eth(s
  
  	memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
  
@@ -355,7 +355,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	/* original 802.11 header has a different DA and in
  	 * case of 4addr it may also have different SA
  	 */
-@@ -2612,6 +2713,7 @@ static void ath11k_dp_rx_h_undecap_snap(
+@@ -2613,6 +2714,7 @@ static void ath11k_dp_rx_h_undecap_snap(
  	size_t hdr_len;
  	u8 l3_pad_bytes;
  	struct hal_rx_desc *rx_desc;
@@ -363,7 +363,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  	/* Delivered decapped frame:
  	 * [amsdu header] <-- replaced with 802.11 hdr
-@@ -2625,6 +2727,11 @@ static void ath11k_dp_rx_h_undecap_snap(
+@@ -2626,6 +2728,11 @@ static void ath11k_dp_rx_h_undecap_snap(
  	skb_put(msdu, l3_pad_bytes);
  	skb_pull(msdu, sizeof(struct ath11k_dp_amsdu_subframe_hdr) + l3_pad_bytes);
  
@@ -375,7 +375,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	hdr = (struct ieee80211_hdr *)first_hdr;
  	hdr_len = ieee80211_hdrlen(hdr->frame_control);
  
-@@ -3098,6 +3205,20 @@ static int ath11k_dp_rx_process_msdu(str
+@@ -3099,6 +3206,20 @@ static int ath11k_dp_rx_process_msdu(str
  		goto free_out;
  	}
  
@@ -396,7 +396,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	rxcb = ATH11K_SKB_RXCB(msdu);
  	rxcb->rx_desc = rx_desc;
  	msdu_len = ath11k_dp_rx_h_msdu_start_msdu_len(ab, rx_desc);
-@@ -3110,8 +3231,9 @@ static int ath11k_dp_rx_process_msdu(str
+@@ -3111,8 +3232,9 @@ static int ath11k_dp_rx_process_msdu(str
  			hdr_status = ath11k_dp_rx_h_80211_hdr(ab, rx_desc);
  			ret = -EINVAL;
  			ath11k_warn(ab, "invalid msdu len %u\n", msdu_len);
@@ -408,7 +408,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  			ath11k_dbg_dump(ab, ATH11K_DBG_DATA, NULL, "", rx_desc,
  					sizeof(struct hal_rx_desc));
  			goto free_out;
-@@ -4070,6 +4192,7 @@ static int ath11k_dp_rx_h_verify_tkip_mi
+@@ -4072,6 +4194,7 @@ static int ath11k_dp_rx_h_verify_tkip_mi
  
  	hdr = (struct ieee80211_hdr *)(msdu->data + hal_rx_desc_sz);
  	hdr_len = ieee80211_hdrlen(hdr->frame_control);
@@ -416,7 +416,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	head_len = hdr_len + hal_rx_desc_sz + IEEE80211_TKIP_IV_LEN;
  	tail_len = IEEE80211_CCMP_MIC_LEN + IEEE80211_TKIP_ICV_LEN + FCS_LEN;
  
-@@ -4350,8 +4473,8 @@ static void ath11k_dp_rx_h_sort_frags(st
+@@ -4352,8 +4475,8 @@ static void ath11k_dp_rx_h_sort_frags(st
  
  static u64 ath11k_dp_rx_h_get_pn(struct ath11k *ar, struct sk_buff *skb)
  {
@@ -426,7 +426,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	u8 *ehdr;
  	u32 hal_rx_desc_sz = ar->ab->hw_params.hal_desc_sz;
  
-@@ -4581,8 +4704,9 @@ ath11k_dp_process_rx_err_buf(struct ath1
+@@ -4583,8 +4706,9 @@ ath11k_dp_process_rx_err_buf(struct ath1
  	if ((msdu_len + hal_rx_desc_sz) > DP_RX_BUFFER_SIZE) {
  		hdr_status = ath11k_dp_rx_h_80211_hdr(ar->ab, rx_desc);
  		ath11k_warn(ar->ab, "invalid msdu leng %u", msdu_len);
@@ -438,7 +438,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "", rx_desc,
  				sizeof(struct hal_rx_desc));
  		dev_kfree_skb_any(msdu);
-@@ -5207,6 +5331,47 @@ void ath11k_dp_rx_pdev_free(struct ath11
+@@ -5209,6 +5333,47 @@ void ath11k_dp_rx_pdev_free(struct ath11
  	ath11k_dp_rxdma_pdev_buf_free(ar);
  }
  
@@ -486,7 +486,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  int ath11k_dp_rx_pdev_alloc(struct ath11k_base *ab, int mac_id)
  {
  	struct ath11k *ar = ab->pdevs[mac_id].ar;
-@@ -5300,6 +5465,12 @@ config_refill_ring:
+@@ -5302,6 +5467,12 @@ config_refill_ring:
  		}
  	}
  
@@ -914,7 +914,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  struct ath11k_hw_ring_mask {
  	u8 tx[ATH11K_EXT_IRQ_GRP_NUM_MAX];
  	u8 rx_mon_status[ATH11K_EXT_IRQ_GRP_NUM_MAX];
-@@ -287,6 +297,16 @@ struct ath11k_hw_ops {
+@@ -288,6 +298,16 @@ struct ath11k_hw_ops {
  	u8* (*rx_desc_mpdu_start_addr2)(struct hal_rx_desc *desc);
  	u32 (*get_ring_selector)(struct sk_buff *skb);
  	u32 (*rx_desc_get_hal_mpdu_len)(struct hal_rx_mpdu_info *mpdu_info);
@@ -933,7 +933,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  extern const struct ath11k_hw_ops ipq8074_ops;
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -6448,6 +6448,7 @@ static int ath11k_mac_config_mon_status_
+@@ -6438,6 +6438,7 @@ static int ath11k_mac_config_mon_status_
  			tlv_filter.rx_filter = ath11k_debugfs_rx_filter(ar);
  	}
  
@@ -943,7 +943,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		ret = ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id,
 --- a/drivers/net/wireless/ath/ath11k/rx_desc.h
 +++ b/drivers/net/wireless/ath/ath11k/rx_desc.h
-@@ -1507,4 +1507,17 @@ struct hal_rx_desc {
+@@ -1508,4 +1508,17 @@ struct hal_rx_desc {
  #define RU_484 18
  #define RU_996 37
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-336-0001-ath11k-idr-optimization.patch b/package/kernel/mac80211/patches/nss/ath11k/999-336-0001-ath11k-idr-optimization.patch
index abcc7a197e4300..f38eade8144d05 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-336-0001-ath11k-idr-optimization.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-336-0001-ath11k-idr-optimization.patch
@@ -28,7 +28,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  }
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -3385,18 +3385,16 @@ try_again:
+@@ -3386,18 +3386,16 @@ try_again:
  		ar = ab->pdevs[mac_id].ar;
  		rx_ring = &ar->dp.rx_refill_buf_ring;
  		spin_lock_bh(&rx_ring->idr_lock);
@@ -50,7 +50,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  		dma_unmap_single(ab->dev, rxcb->paddr,
  				 msdu->len + skb_tailroom(msdu),
  				 DMA_FROM_DEVICE);
-@@ -4667,17 +4665,14 @@ ath11k_dp_process_rx_err_buf(struct ath1
+@@ -4669,17 +4667,14 @@ ath11k_dp_process_rx_err_buf(struct ath1
  	u32 hal_rx_desc_sz = ar->ab->hw_params.hal_desc_sz;
  
  	spin_lock_bh(&rx_ring->idr_lock);
@@ -70,7 +70,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	rxcb = ATH11K_SKB_RXCB(msdu);
  	dma_unmap_single(ar->ab->dev, rxcb->paddr,
  			 msdu->len + skb_tailroom(msdu),
-@@ -5083,18 +5078,16 @@ int ath11k_dp_rx_process_wbm_err(struct
+@@ -5085,18 +5080,16 @@ int ath11k_dp_rx_process_wbm_err(struct
  		rx_ring = &ar->dp.rx_refill_buf_ring;
  
  		spin_lock_bh(&rx_ring->idr_lock);
@@ -92,7 +92,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  		dma_unmap_single(ab->dev, rxcb->paddr,
  				 msdu->len + skb_tailroom(msdu),
  				 DMA_FROM_DEVICE);
-@@ -5209,16 +5202,14 @@ int ath11k_dp_process_rxdma_err(struct a
+@@ -5211,16 +5204,14 @@ int ath11k_dp_process_rxdma_err(struct a
  					   msdu_cookies[i]);
  
  			spin_lock_bh(&rx_ring->idr_lock);
@@ -111,7 +111,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  
  			rxcb = ATH11K_SKB_RXCB(skb);
  			dma_unmap_single(ab->dev, rxcb->paddr,
-@@ -6423,16 +6414,14 @@ ath11k_dp_rx_full_mon_mpdu_pop(struct at
+@@ -6425,16 +6416,14 @@ ath11k_dp_rx_full_mon_mpdu_pop(struct at
  					   msdu_list.sw_cookie[i]);
  
  			spin_lock_bh(&rx_ring->idr_lock);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch b/package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch
index 9a212c39440f29..5058823dcfcd96 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch
@@ -18,7 +18,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -662,6 +662,11 @@ struct ath11k_per_peer_tx_stats {
+@@ -700,6 +700,11 @@ struct ath11k_per_peer_tx_stats {
  #define ATH11K_FLUSH_TIMEOUT (5 * HZ)
  #define ATH11K_VDEV_DELETE_TIMEOUT_HZ (5 * HZ)
  
@@ -30,17 +30,17 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  struct ath11k {
  	struct ath11k_base *ab;
  	struct ath11k_pdev *pdev;
-@@ -811,6 +816,7 @@ struct ath11k {
- 	/* protected by conf_mutex */
+@@ -849,6 +854,7 @@ struct ath11k {
  	bool ps_state_enable;
  	bool ps_timekeeper_enable;
+ 	s8 max_allowed_tx_power;
 +	struct ath11k_rx_buf_id rx_buf_id;
  };
  
  struct ath11k_band_cap {
 --- a/drivers/net/wireless/ath/ath11k/dp.c
 +++ b/drivers/net/wireless/ath/ath11k/dp.c
-@@ -897,7 +897,7 @@ int ath11k_dp_service_srng(struct ath11k
+@@ -911,7 +911,7 @@ int ath11k_dp_service_srng(struct ath11k
  
  				hal_params = ab->hw_params.hal_params;
  				ath11k_dp_rxbufs_replenish(ab, id, rx_ring, 0,
@@ -51,7 +51,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	}
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -388,7 +388,8 @@ static inline u8 ath11k_dp_rx_h_msdu_sta
+@@ -389,7 +389,8 @@ static inline u8 ath11k_dp_rx_h_msdu_sta
  int ath11k_dp_rxbufs_replenish(struct ath11k_base *ab, int mac_id,
  			       struct dp_rxdma_ring *rx_ring,
  			       int req_entries,
@@ -61,7 +61,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  {
  	struct hal_srng *srng;
  	u32 *desc;
-@@ -396,9 +397,15 @@ int ath11k_dp_rxbufs_replenish(struct at
+@@ -397,9 +398,15 @@ int ath11k_dp_rxbufs_replenish(struct at
  	int num_free;
  	int num_remain;
  	int buf_id;
@@ -77,7 +77,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	req_entries = min(req_entries, rx_ring->bufs_max);
  
  	srng = &ab->hal.srng_list[rx_ring->refill_buf_ring.ring_id];
-@@ -434,8 +441,14 @@ int ath11k_dp_rxbufs_replenish(struct at
+@@ -435,8 +442,14 @@ int ath11k_dp_rxbufs_replenish(struct at
  			goto fail_free_skb;
  
  		spin_lock_bh(&rx_ring->idr_lock);
@@ -92,7 +92,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  		spin_unlock_bh(&rx_ring->idr_lock);
  		if (buf_id <= 0)
  			goto fail_dma_unmap;
-@@ -458,6 +471,12 @@ int ath11k_dp_rxbufs_replenish(struct at
+@@ -459,6 +472,12 @@ int ath11k_dp_rxbufs_replenish(struct at
  
  	spin_unlock_bh(&srng->lock);
  
@@ -105,7 +105,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	return req_entries - num_remain;
  
  fail_idr_remove:
-@@ -532,7 +551,7 @@ static int ath11k_dp_rxdma_ring_buf_setu
+@@ -533,7 +552,7 @@ static int ath11k_dp_rxdma_ring_buf_setu
  
  	rx_ring->bufs_max = num_entries;
  	ath11k_dp_rxbufs_replenish(ar->ab, dp->mac_id, rx_ring, num_entries,
@@ -114,7 +114,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	return 0;
  }
  
-@@ -3347,11 +3366,14 @@ int ath11k_dp_process_rx(struct ath11k_b
+@@ -3348,11 +3367,14 @@ int ath11k_dp_process_rx(struct ath11k_b
  	struct ath11k *ar;
  	struct hal_reo_dest_ring *desc;
  	enum hal_reo_dest_ring_push_reason push_reason;
@@ -130,7 +130,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  
  	srng = &ab->hal.srng_list[dp->reo_dst_ring[ring_id].ring_id];
  
-@@ -3384,8 +3406,15 @@ try_again:
+@@ -3385,8 +3407,15 @@ try_again:
  
  		ar = ab->pdevs[mac_id].ar;
  		rx_ring = &ar->dp.rx_refill_buf_ring;
@@ -147,7 +147,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  		spin_unlock_bh(&rx_ring->idr_lock);
  		if (unlikely(!msdu)) {
  			ath11k_warn(ab, "frame rx with invalid buf_id %d\n",
-@@ -3463,9 +3492,12 @@ try_again:
+@@ -3464,9 +3493,12 @@ try_again:
  		rx_ring = &ar->dp.rx_refill_buf_ring;
  
  		ath11k_dp_rxbufs_replenish(ab, i, rx_ring, num_buffs_reaped[i],
@@ -161,7 +161,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	return total_msdu_reaped;
  }
  
-@@ -4827,7 +4859,7 @@ exit:
+@@ -4829,7 +4861,7 @@ exit:
  		rx_ring = &ar->dp.rx_refill_buf_ring;
  
  		ath11k_dp_rxbufs_replenish(ab, i, rx_ring, n_bufs_reaped[i],
@@ -170,7 +170,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	}
  
  	return tot_n_bufs_reaped;
-@@ -5043,14 +5075,17 @@ int ath11k_dp_rx_process_wbm_err(struct
+@@ -5045,14 +5077,17 @@ int ath11k_dp_rx_process_wbm_err(struct
  	struct sk_buff *msdu;
  	struct sk_buff_head msdu_list[MAX_RADIOS];
  	struct ath11k_skb_rxcb *rxcb;
@@ -189,7 +189,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  
  	srng = &ab->hal.srng_list[dp->rx_rel_ring.ring_id];
  
-@@ -5076,9 +5111,15 @@ int ath11k_dp_rx_process_wbm_err(struct
+@@ -5078,9 +5113,15 @@ int ath11k_dp_rx_process_wbm_err(struct
  
  		ar = ab->pdevs[mac_id].ar;
  		rx_ring = &ar->dp.rx_refill_buf_ring;
@@ -206,7 +206,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  		spin_unlock_bh(&rx_ring->idr_lock);
  		if (!msdu) {
  			ath11k_warn(ab, "frame rx with invalid buf_id %d pdev %d\n",
-@@ -5123,7 +5164,7 @@ int ath11k_dp_rx_process_wbm_err(struct
+@@ -5125,7 +5166,7 @@ int ath11k_dp_rx_process_wbm_err(struct
  		rx_ring = &ar->dp.rx_refill_buf_ring;
  
  		ath11k_dp_rxbufs_replenish(ab, i, rx_ring, num_buffs_reaped[i],
@@ -215,7 +215,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	}
  
  	rcu_read_lock();
-@@ -5145,6 +5186,8 @@ int ath11k_dp_rx_process_wbm_err(struct
+@@ -5147,6 +5188,8 @@ int ath11k_dp_rx_process_wbm_err(struct
  	}
  	rcu_read_unlock();
  done:
@@ -224,7 +224,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	return total_num_buffs_reaped;
  }
  
-@@ -5230,7 +5273,7 @@ int ath11k_dp_process_rxdma_err(struct a
+@@ -5232,7 +5275,7 @@ int ath11k_dp_process_rxdma_err(struct a
  
  	if (num_buf_freed)
  		ath11k_dp_rxbufs_replenish(ab, mac_id, rx_ring, num_buf_freed,
@@ -233,7 +233,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  
  	return budget - quota;
  }
-@@ -6176,12 +6219,12 @@ static void ath11k_dp_rx_mon_dest_proces
+@@ -6178,12 +6221,12 @@ static void ath11k_dp_rx_mon_dest_proces
  			ath11k_dp_rxbufs_replenish(ar->ab, dp->mac_id,
  						   &dp->rxdma_mon_buf_ring,
  						   rx_bufs_used,
@@ -248,7 +248,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	}
  }
  
-@@ -6691,7 +6734,7 @@ next_entry:
+@@ -6693,7 +6736,7 @@ next_entry:
  		ath11k_dp_rxbufs_replenish(ar->ab, dp->mac_id,
  					   &dp->rxdma_mon_buf_ring,
  					   rx_bufs_used,
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-374-ath11k-Check-skb_headroom-before-using-skb_push.patch b/package/kernel/mac80211/patches/nss/ath11k/999-374-ath11k-Check-skb_headroom-before-using-skb_push.patch
index 988717c1dbc257..513d975954823a 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-374-ath11k-Check-skb_headroom-before-using-skb_push.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-374-ath11k-Check-skb_headroom-before-using-skb_push.patch
@@ -35,7 +35,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -2454,16 +2454,27 @@ static void ath11k_get_dot11_hdr_from_rx
+@@ -2455,16 +2455,27 @@ static void ath11k_get_dot11_hdr_from_rx
  	size_t hdr_len, crypto_len;
  	struct ieee80211_hdr *hdr;
  	u16 fc, qos_ctl = 0;
@@ -63,7 +63,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	skb_push(msdu, hdr_len);
  	hdr = (struct ieee80211_hdr *)msdu->data;
  	hdr->frame_control = fc;
-@@ -2499,6 +2510,7 @@ static void ath11k_dp_rx_h_undecap_nwifi
+@@ -2500,6 +2511,7 @@ static void ath11k_dp_rx_h_undecap_nwifi
  	u8 da[ETH_ALEN];
  	u8 sa[ETH_ALEN];
  	u16 qos_ctl = 0;
@@ -71,7 +71,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	u8 *qos, *crypto_hdr;
  	bool add_qos_ctrl = false;
  
-@@ -2543,26 +2555,46 @@ static void ath11k_dp_rx_h_undecap_nwifi
+@@ -2544,26 +2556,46 @@ static void ath11k_dp_rx_h_undecap_nwifi
  	}
  
  	if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
@@ -123,7 +123,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
  
  	/* original 802.11 header has a different DA and in
-@@ -2671,6 +2703,7 @@ static void ath11k_dp_rx_h_undecap_eth(s
+@@ -2672,6 +2704,7 @@ static void ath11k_dp_rx_h_undecap_eth(s
  	u8 da[ETH_ALEN];
  	u8 sa[ETH_ALEN];
  	void *rfc1042;
@@ -131,7 +131,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
  	struct ath11k_dp_rfc1042_hdr rfc = {0xaa, 0xaa, 0x03, {0x00, 0x00, 0x00}};
  
-@@ -2680,6 +2713,11 @@ static void ath11k_dp_rx_h_undecap_eth(s
+@@ -2681,6 +2714,11 @@ static void ath11k_dp_rx_h_undecap_eth(s
  		ether_addr_copy(sa, eth->h_source);
  		rfc.snap_type = eth->h_proto;
  		skb_pull(msdu, sizeof(struct ethhdr));
@@ -143,7 +143,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  		memcpy(skb_push(msdu, sizeof(struct ath11k_dp_rfc1042_hdr)), &rfc,
  		       sizeof(struct ath11k_dp_rfc1042_hdr));
  		ath11k_get_dot11_hdr_from_rx_desc(ar, msdu, rxcb, status, enctype);
-@@ -2697,6 +2735,11 @@ static void ath11k_dp_rx_h_undecap_eth(s
+@@ -2698,6 +2736,11 @@ static void ath11k_dp_rx_h_undecap_eth(s
  	skb_pull(msdu, sizeof(struct ethhdr));
  
  	/* push rfc1042/llc/snap */
@@ -155,7 +155,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	memcpy(skb_push(msdu, sizeof(struct ath11k_dp_rfc1042_hdr)), rfc1042,
  	       sizeof(struct ath11k_dp_rfc1042_hdr));
  
-@@ -2705,12 +2748,22 @@ static void ath11k_dp_rx_h_undecap_eth(s
+@@ -2706,12 +2749,22 @@ static void ath11k_dp_rx_h_undecap_eth(s
  	hdr_len = ieee80211_hdrlen(hdr->frame_control);
  
  	if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
@@ -182,7 +182,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
  
  exit:
-@@ -2731,6 +2784,7 @@ static void ath11k_dp_rx_h_undecap_snap(
+@@ -2732,6 +2785,7 @@ static void ath11k_dp_rx_h_undecap_snap(
  	struct ieee80211_hdr *hdr;
  	size_t hdr_len;
  	u8 l3_pad_bytes;
@@ -190,7 +190,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	struct hal_rx_desc *rx_desc;
  	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
  
-@@ -2755,12 +2809,22 @@ static void ath11k_dp_rx_h_undecap_snap(
+@@ -2756,12 +2810,22 @@ static void ath11k_dp_rx_h_undecap_snap(
  	hdr_len = ieee80211_hdrlen(hdr->frame_control);
  
  	if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
@@ -217,7 +217,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
  }
  
-@@ -2889,7 +2953,7 @@ static void ath11k_dp_rx_h_mpdu(struct a
+@@ -2890,7 +2954,7 @@ static void ath11k_dp_rx_h_mpdu(struct a
  				struct ieee80211_rx_status *rx_status,
  				bool *fast_rx)
  {
@@ -226,7 +226,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	enum hal_encrypt_type enctype;
  	bool is_decrypted = false;
  	struct ath11k_skb_rxcb *rxcb;
-@@ -3122,10 +3186,16 @@ static void ath11k_dp_rx_deliver_msdu(st
+@@ -3123,10 +3187,16 @@ static void ath11k_dp_rx_deliver_msdu(st
  	u8 decap = DP_RX_DECAP_TYPE_RAW;
  	bool is_mcbc = rxcb->is_mcbc;
  	bool is_eapol = rxcb->is_eapol;
@@ -243,7 +243,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  		he = skb_push(msdu, sizeof(known));
  		memcpy(he, &known, sizeof(known));
  		status->flag |= RX_FLAG_RADIOTAP_HE;
-@@ -3181,6 +3251,7 @@ static void ath11k_dp_rx_deliver_msdu(st
+@@ -3182,6 +3252,7 @@ static void ath11k_dp_rx_deliver_msdu(st
  	    !(is_mcbc && rx_status->flag & RX_FLAG_DECRYPTED))
  		rx_status->flag |= RX_FLAG_8023;
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-783-001-wifi-ath11k-Fix-BCCA-counter-for-EMA.patch b/package/kernel/mac80211/patches/nss/ath11k/999-783-001-wifi-ath11k-Fix-BCCA-counter-for-EMA.patch
index cf712593cc15b8..e04b01aa4d4473 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-783-001-wifi-ath11k-Fix-BCCA-counter-for-EMA.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-783-001-wifi-ath11k-Fix-BCCA-counter-for-EMA.patch
@@ -20,7 +20,7 @@ Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -1601,27 +1601,6 @@ static int ath11k_mac_setup_bcn_tmpl(str
+@@ -1594,27 +1594,6 @@ static int ath11k_mac_setup_bcn_tmpl(str
  	return ath11k_mac_setup_bcn_tmpl_mbssid(arvif);
  }
  
@@ -32,7 +32,7 @@ Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
 -		return;
 -
 -	if (vif->bss_conf.color_change_active &&
--	    ieee80211_beacon_cntdwn_is_complete(vif)) {
+-	    ieee80211_beacon_cntdwn_is_complete(vif, 0)) {
 -		arvif->bcca_zero_sent = true;
 -		ieee80211_color_change_finish(vif);
 -		return;
@@ -41,7 +41,7 @@ Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
 -	arvif->bcca_zero_sent = false;
 -
 -	if (vif->bss_conf.color_change_active)
--		ieee80211_beacon_update_cntdwn(vif);
+-		ieee80211_beacon_update_cntdwn(vif, 0);
 -	ath11k_mac_setup_bcn_tmpl(arvif);
 -}
 -
@@ -50,7 +50,7 @@ Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
  {
 --- a/drivers/net/wireless/ath/ath11k/mac.h
 +++ b/drivers/net/wireless/ath/ath11k/mac.h
-@@ -170,7 +170,6 @@ enum ath11k_supported_bw ath11k_mac_mac8
+@@ -171,7 +171,6 @@ enum ath11k_supported_bw ath11k_mac_mac8
  enum hal_encrypt_type ath11k_dp_tx_get_encrypt_type(u32 cipher);
  void ath11k_mac_handle_beacon(struct ath11k *ar, struct sk_buff *skb);
  void ath11k_mac_handle_beacon_miss(struct ath11k *ar, u32 vdev_id);
@@ -72,7 +72,7 @@ Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
  	}
  
  	cmd->buf_len = bcn->len;
-@@ -7586,7 +7587,6 @@ static void ath11k_bcn_tx_status_event(s
+@@ -7567,7 +7568,6 @@ static void ath11k_bcn_tx_status_event(s
  		rcu_read_unlock();
  		return;
  	}
@@ -80,7 +80,7 @@ Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
  	rcu_read_unlock();
  }
  
-@@ -8500,10 +8500,7 @@ ath11k_wmi_process_csa_switch_count_even
+@@ -8481,10 +8481,7 @@ ath11k_wmi_process_csa_switch_count_even
  {
  	int i;
  	struct ath11k_vif *arvif;
@@ -92,19 +92,19 @@ Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
  
  	rcu_read_lock();
  	for (i = 0; i < ev->num_vdevs; i++) {
-@@ -8515,8 +8512,18 @@ ath11k_wmi_process_csa_switch_count_even
+@@ -8496,8 +8493,18 @@ ath11k_wmi_process_csa_switch_count_even
  			continue;
  		}
  
 -		if (arvif->is_up && arvif->vif->bss_conf.csa_active)
--			ieee80211_csa_finish(arvif->vif);
+-			ieee80211_csa_finish(arvif->vif, 0);
 +		bss_conf = &arvif->vif->bss_conf;
 +		if (arvif->is_up && (bss_conf->csa_active || bss_conf->color_change_active)) {
 +			if (!ev->current_switch_count) {
 +				if (bss_conf->csa_active)
-+					ieee80211_csa_finish(arvif->vif);
++					ieee80211_csa_finish(arvif->vif, 0);
 +			} else if (ev->current_switch_count > 1) {
-+				ieee80211_beacon_update_cntdwn(arvif->vif);
++				ieee80211_beacon_update_cntdwn(arvif->vif, 0);
 +			} else {
 +				if (bss_conf->color_change_active)
 +					ieee80211_color_change_finish(arvif->vif);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-800-ath11k-Add-threaded-napi.patch b/package/kernel/mac80211/patches/nss/ath11k/999-800-ath11k-Add-threaded-napi.patch
index 4f24a267cf172c..e11983a03d929c 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-800-ath11k-Add-threaded-napi.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-800-ath11k-Add-threaded-napi.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath11k/ahb.c
 +++ b/drivers/net/wireless/ath/ath11k/ahb.c
-@@ -494,8 +494,7 @@ static int ath11k_ahb_ext_grp_napi_poll(
+@@ -495,8 +495,7 @@ static int ath11k_ahb_ext_grp_napi_poll(
  	int work_done;
  
  	work_done = ath11k_dp_service_srng(ab, irq_grp, budget);
@@ -10,7 +10,7 @@
  		ath11k_ahb_ext_grp_enable(irq_grp);
  	}
  
-@@ -526,6 +525,7 @@ static int ath11k_ahb_config_ext_irq(str
+@@ -527,6 +526,7 @@ static int ath11k_ahb_config_ext_irq(str
  	int irq;
  	int ret;
  	bool nss_offload;
@@ -18,7 +18,7 @@
  
  	/* TCL Completion, REO Dest, ERR, Exception and h2rxdma rings are offloaded
  	 * to nss when its enabled, hence don't enable these interrupts
-@@ -539,8 +539,12 @@ static int ath11k_ahb_config_ext_irq(str
+@@ -540,8 +540,12 @@ static int ath11k_ahb_config_ext_irq(str
  		irq_grp->ab = ab;
  		irq_grp->grp_id = i;
  		init_dummy_netdev(&irq_grp->napi_ndev);
@@ -31,7 +31,7 @@
  
  		for (j = 0; j < ATH11K_EXT_IRQ_NUM_MAX; j++) {
  			if (!nss_offload && ab->hw_params.ring_mask->tx[i] & BIT(j)) {
-@@ -604,6 +608,8 @@ static int ath11k_ahb_config_ext_irq(str
+@@ -605,6 +609,8 @@ static int ath11k_ahb_config_ext_irq(str
  		}
  	}
  
@@ -42,7 +42,7 @@
  
 --- a/drivers/net/wireless/ath/ath11k/pcic.c
 +++ b/drivers/net/wireless/ath/ath11k/pcic.c
-@@ -505,8 +505,7 @@ static int ath11k_pcic_ext_grp_napi_poll
+@@ -516,8 +516,7 @@ static int ath11k_pcic_ext_grp_napi_poll
  	int i;
  
  	work_done = ath11k_dp_service_srng(ab, irq_grp, budget);
@@ -52,7 +52,7 @@
  		for (i = 0; i < irq_grp->num_irq; i++)
  			enable_irq(irq_grp->ab->irq_num[irq_grp->irqs[i]]);
  	}
-@@ -550,6 +549,7 @@ static int ath11k_pcic_ext_irq_config(st
+@@ -561,6 +560,7 @@ static int ath11k_pcic_ext_irq_config(st
  	int i, j, ret, num_vectors = 0;
  	u32 user_base_data = 0, base_vector = 0;
  	unsigned long irq_flags;
@@ -60,7 +60,7 @@
  
  	ret = ath11k_pcic_get_user_msi_assignment(ab, "DP", &num_vectors,
  						  &user_base_data,
-@@ -568,8 +568,12 @@ static int ath11k_pcic_ext_irq_config(st
+@@ -579,8 +579,12 @@ static int ath11k_pcic_ext_irq_config(st
  		irq_grp->ab = ab;
  		irq_grp->grp_id = i;
  		init_dummy_netdev(&irq_grp->napi_ndev);
@@ -73,7 +73,7 @@
  
  		/* tcl, reo, rx_err, wbm release, rxdma rings are offloaded to nss. */
  		if (ab->nss.enabled &&
-@@ -616,6 +620,8 @@ static int ath11k_pcic_ext_irq_config(st
+@@ -627,6 +631,8 @@ static int ath11k_pcic_ext_irq_config(st
  		ath11k_pcic_ext_grp_disable(irq_grp);
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/007-fix_compilation_issue.patch b/package/kernel/mac80211/patches/nss/subsys/007-fix_compilation_issue.patch
deleted file mode 100644
index 7a9b58411d0e1c..00000000000000
--- a/package/kernel/mac80211/patches/nss/subsys/007-fix_compilation_issue.patch
+++ /dev/null
@@ -1,134 +0,0 @@
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -9247,7 +9247,7 @@ void cfg80211_bss_flush(struct wiphy *wi
-  * @count: the number of TBTTs until the color change happens
-  * @color_bitmap: representations of the colors that the local BSS is aware of
-  */
--int cfg80211_bss_color_notify(struct net_device *dev,
-+int cfg80211_bss_color_notify(struct net_device *dev, gfp_t gfp,
- 			      enum nl80211_commands cmd, u8 count,
- 			      u64 color_bitmap);
- 
-@@ -9257,9 +9257,9 @@ int cfg80211_bss_color_notify(struct net
-  * @color_bitmap: representations of the colors that the local BSS is aware of
-  */
- static inline int cfg80211_obss_color_collision_notify(struct net_device *dev,
--						       u64 color_bitmap)
-+						       u64 color_bitmap, gfp_t gfp)
- {
--	return cfg80211_bss_color_notify(dev, NL80211_CMD_OBSS_COLOR_COLLISION,
-+	return cfg80211_bss_color_notify(dev, gfp, NL80211_CMD_OBSS_COLOR_COLLISION,
- 					 0, color_bitmap);
- }
- 
-@@ -9273,7 +9273,7 @@ static inline int cfg80211_obss_color_co
- static inline int cfg80211_color_change_started_notify(struct net_device *dev,
- 						       u8 count)
- {
--	return cfg80211_bss_color_notify(dev, NL80211_CMD_COLOR_CHANGE_STARTED,
-+	return cfg80211_bss_color_notify(dev, GFP_KERNEL, NL80211_CMD_COLOR_CHANGE_STARTED,
- 					 count, 0);
- }
- 
-@@ -9285,7 +9285,7 @@ static inline int cfg80211_color_change_
-  */
- static inline int cfg80211_color_change_aborted_notify(struct net_device *dev)
- {
--	return cfg80211_bss_color_notify(dev, NL80211_CMD_COLOR_CHANGE_ABORTED,
-+	return cfg80211_bss_color_notify(dev, GFP_KERNEL, NL80211_CMD_COLOR_CHANGE_ABORTED,
- 					 0, 0);
- }
- 
-@@ -9297,7 +9297,7 @@ static inline int cfg80211_color_change_
-  */
- static inline int cfg80211_color_change_notify(struct net_device *dev)
- {
--	return cfg80211_bss_color_notify(dev,
-+	return cfg80211_bss_color_notify(dev, GFP_KERNEL,
- 					 NL80211_CMD_COLOR_CHANGE_COMPLETED,
- 					 0, 0);
- }
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -4779,7 +4779,7 @@ void ieee80211_color_collision_detection
- 	struct ieee80211_sub_if_data *sdata = link->sdata;
- 
- 	sdata_lock(sdata);
--	cfg80211_obss_color_collision_notify(sdata->dev, link->color_bitmap);
-+	cfg80211_obss_color_collision_notify(sdata->dev, link->color_bitmap, GFP_KERNEL);
- 	sdata_unlock(sdata);
- }
- 
---- a/net/mac80211/debugfs_netdev.c
-+++ b/net/mac80211/debugfs_netdev.c
-@@ -889,7 +889,7 @@ void ieee80211_debugfs_add_netdev(struct
- {
- 	char buf[10+IFNAMSIZ];
- 
--	sprintf(buf, "netdev:%s", sdata->name);
-+	snprintf(buf, 10 + IFNAMSIZ, "netdev:%s", sdata->name);
- 	sdata->vif.debugfs_dir = debugfs_create_dir(buf,
- 		sdata->local->hw.wiphy->debugfsdir);
- 	sdata->debugfs.subdir_stations = debugfs_create_dir("stations",
---- a/net/mac80211/sta_info.c
-+++ b/net/mac80211/sta_info.c
-@@ -1414,18 +1414,6 @@ static void __sta_info_destroy_part2(str
- 		WARN_ON_ONCE(ret);
- 	}
- 
--	/* Flush queues before removing keys, as that might remove them
--	 * from hardware, and then depending on the offload method, any
--	 * frames sitting on hardware queues might be sent out without
--	 * any encryption at all.
--	 */
--	if (local->ops->set_key) {
--		if (local->ops->flush_sta)
--			drv_flush_sta(local, sta->sdata, sta);
--		else
--			ieee80211_flush_queues(local, sta->sdata, false);
--	}
--
- 	/* now keys can no longer be reached */
- 	ieee80211_free_sta_keys(local, sta);
- 
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -19484,7 +19484,7 @@ void cfg80211_ch_switch_started_notify(s
- }
- EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
- 
--int cfg80211_bss_color_notify(struct net_device *dev,
-+int cfg80211_bss_color_notify(struct net_device *dev, gfp_t gfp,
- 			      enum nl80211_commands cmd, u8 count,
- 			      u64 color_bitmap)
- {
-@@ -19498,7 +19498,7 @@ int cfg80211_bss_color_notify(struct net
- 
- 	trace_cfg80211_bss_color_notify(dev, cmd, count, color_bitmap);
- 
--	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
-+	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
- 	if (!msg)
- 		return -ENOMEM;
- 
-@@ -19521,7 +19521,7 @@ int cfg80211_bss_color_notify(struct net
- 	genlmsg_end(msg, hdr);
- 
- 	return genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
--				       msg, 0, NL80211_MCGRP_MLME, GFP_KERNEL);
-+				       msg, 0, NL80211_MCGRP_MLME, gfp);
- 
- nla_put_failure:
- 	nlmsg_free(msg);
---- a/backport-include/linux/netdevice.h
-+++ b/backport-include/linux/netdevice.h
-@@ -70,6 +70,9 @@ static inline void netif_trans_update(st
- 	(_dev)->needs_free_netdev = true;
- #endif
- 
-+#define netdev_tstats(dev)  dev->tstats
-+#define netdev_assign_tstats(dev, e)    dev->tstats = (e);
-+
- #if LINUX_VERSION_IS_LESS(4,15,0)
- static inline int _bp_netdev_upper_dev_link(struct net_device *dev,
- 					    struct net_device *upper_dev)
diff --git a/package/kernel/mac80211/patches/nss/subsys/146-mac80211-enable-TKIP-when-using-encapsulation-offloading.patch b/package/kernel/mac80211/patches/nss/subsys/146-mac80211-enable-TKIP-when-using-encapsulation-offloading.patch
index 86b2f2169bb79f..a97eb7b987e156 100644
--- a/package/kernel/mac80211/patches/nss/subsys/146-mac80211-enable-TKIP-when-using-encapsulation-offloading.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/146-mac80211-enable-TKIP-when-using-encapsulation-offloading.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4689,8 +4689,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4716,8 +4716,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  	if (!key)
  		key = rcu_dereference(sdata->default_unicast_key);
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch b/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch
index 94560505fe052b..239d52bf0a61bd 100644
--- a/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch
@@ -14,9 +14,20 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  net/mac80211/util.c    | 16 ++++++++++++++++
  3 files changed, 30 insertions(+)
 
+--- a/backport-include/linux/netdevice.h
++++ b/backport-include/linux/netdevice.h
+@@ -4,6 +4,8 @@
+ #include <linux/version.h>
+ #include <backport/magic.h>
+ 
++#define netdev_tstats(dev)  dev->tstats
++
+ #if LINUX_VERSION_IS_LESS(4,15,0)
+ static inline int _bp_netdev_upper_dev_link(struct net_device *dev,
+ 					    struct net_device *upper_dev)
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -380,6 +380,20 @@ enum ieee80211_bss_change {
+@@ -404,6 +404,20 @@ enum ieee80211_bss_change {
  	/* when adding here, make sure to change ieee80211_reconfig */
  };
  
@@ -37,7 +48,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  /*
   * The maximum number of IPv4 addresses listed for ARP filtering. If the number
   * of addresses for an interface increase beyond this value, hardware ARP
-@@ -683,6 +697,7 @@ struct ieee80211_fils_discovery {
+@@ -703,6 +717,7 @@ struct ieee80211_fils_discovery {
   *	beamformee
   * @eht_mu_beamformer: in AP-mode, does this BSS enable operation as an EHT MU
   *	beamformer
@@ -45,7 +56,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   */
  struct ieee80211_bss_conf {
  	struct ieee80211_vif *vif;
-@@ -776,6 +791,7 @@ struct ieee80211_bss_conf {
+@@ -795,6 +810,7 @@ struct ieee80211_bss_conf {
  	bool eht_su_beamformer;
  	bool eht_su_beamformee;
  	bool eht_mu_beamformer;
@@ -53,7 +64,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  };
  
  /**
-@@ -1413,7 +1429,7 @@ ieee80211_tx_info_clear_status(struct ie
+@@ -1445,7 +1461,7 @@ ieee80211_tx_info_clear_status(struct ie
   * @RX_FLAG_AMPDU_EOF_BIT_KNOWN: The EOF value is known
   * @RX_FLAG_RADIOTAP_HE: HE radiotap data is present
   *	(&struct ieee80211_radiotap_he, mac80211 will fill in
@@ -62,7 +73,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   *	 - DATA3_DATA_MCS
   *	 - DATA3_DATA_DCM
   *	 - DATA3_CODING
-@@ -1421,7 +1437,7 @@ ieee80211_tx_info_clear_status(struct ie
+@@ -1453,7 +1469,7 @@ ieee80211_tx_info_clear_status(struct ie
   *	 - DATA5_DATA_BW_RU_ALLOC
   *	 - DATA6_NSTS
   *	 - DATA3_STBC
@@ -71,8 +82,8 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   *	from the RX info data, so leave those zeroed when building this data)
   * @RX_FLAG_RADIOTAP_HE_MU: HE MU radiotap data is present
   *	(&struct ieee80211_radiotap_he_mu)
-@@ -1996,6 +2012,16 @@ static inline bool lockdep_vif_mutex_hel
- 			      lockdep_vif_mutex_held(vif))
+@@ -2084,6 +2100,16 @@ static inline bool lockdep_vif_wiphy_mut
+ 			      lockdep_vif_wiphy_mutex_held(vif))
  
  /**
 + * ieee80211_vif_to_wdev_relaxed - return a wdev struct from a vif
@@ -88,24 +99,24 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   * enum ieee80211_key_flags - key flags
   *
   * These flags are used for communication about keys between the driver
-@@ -2687,6 +2713,8 @@ struct ieee80211_txq {
-  * @IEEE80211_HW_MLO_MCAST_MULTI_LINK_TX: Hardware/driver handles transmitting
-  *	multicast frames on all links, mac80211 should not do that.
+@@ -2788,6 +2814,8 @@ struct ieee80211_txq {
+  *	implements MLO, so operation can continue on other links when one
+  *	link is switching.
   *
 + *  @IEEE80211_HW_SUPPORTS_NSS_OFFLOAD: Hardware/driver supports NSS offload
 + *
   * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
   */
  enum ieee80211_hw_flags {
-@@ -2744,6 +2772,7 @@ enum ieee80211_hw_flags {
- 	IEEE80211_HW_SUPPORTS_CONC_MON_RX_DECAP,
- 	IEEE80211_HW_DETECTS_COLOR_COLLISION,
+@@ -2847,6 +2875,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_MLO_MCAST_MULTI_LINK_TX,
+ 	IEEE80211_HW_DISALLOW_PUNCTURING,
+ 	IEEE80211_HW_HANDLES_QUIET_CSA,
 +	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
  
  	/* keep last, obviously */
  	NUM_IEEE80211_HW_FLAGS
-@@ -3756,6 +3785,10 @@ struct ieee80211_prep_tx_info {
+@@ -3860,6 +3889,10 @@ struct ieee80211_prep_tx_info {
   *	non-MLO connections.
   *	The callback can sleep.
   *
@@ -116,7 +127,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   * @prepare_multicast: Prepare for multicast filter configuration.
   *	This callback is optional, and its return value is passed
   *	to configure_filter(). This callback must be atomic.
-@@ -4307,7 +4340,9 @@ struct ieee80211_ops {
+@@ -4425,7 +4458,9 @@ struct ieee80211_ops {
  				  struct ieee80211_vif *vif,
  				  struct ieee80211_bss_conf *info,
  				  u64 changed);
@@ -127,7 +138,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	int (*start_ap)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			struct ieee80211_bss_conf *link_conf);
  	void (*stop_ap)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-@@ -4612,7 +4647,7 @@ struct ieee80211_ops {
+@@ -4735,7 +4770,7 @@ struct ieee80211_ops {
  	int (*reset_tid_config)(struct ieee80211_hw *hw,
  				struct ieee80211_vif *vif,
  				struct ieee80211_sta *sta, u8 tids);
@@ -138,17 +149,17 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  			      struct ieee80211_sta *sta, bool enabled);
 --- a/net/mac80211/debugfs.c
 +++ b/net/mac80211/debugfs.c
-@@ -505,6 +505,7 @@ static const char *hw_flag_names[] = {
- 	FLAG(SUPPORTS_CONC_MON_RX_DECAP),
- 	FLAG(DETECTS_COLOR_COLLISION),
+@@ -508,6 +508,7 @@ static const char *hw_flag_names[] = {
  	FLAG(MLO_MCAST_MULTI_LINK_TX),
+ 	FLAG(DISALLOW_PUNCTURING),
+ 	FLAG(HANDLES_QUIET_CSA),
 +	FLAG(SUPPORTS_NSS_OFFLOAD),
  #undef FLAG
  };
  
 --- a/net/mac80211/util.c
 +++ b/net/mac80211/util.c
-@@ -868,6 +868,22 @@ struct wireless_dev *ieee80211_vif_to_wd
+@@ -874,6 +874,22 @@ struct wireless_dev *ieee80211_vif_to_wd
  }
  EXPORT_SYMBOL_GPL(ieee80211_vif_to_wdev);
  
@@ -173,7 +184,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   * the suspend->resume cycle. Since we can't check each caller
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -291,6 +291,17 @@ void ieee80211_link_info_change_notify(s
+@@ -413,6 +413,17 @@ void ieee80211_link_info_change_notify(s
  	drv_link_info_changed(local, sdata, link->conf, link->link_id, changed);
  }
  
@@ -191,7 +202,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  u64 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata)
  {
  	sdata->vif.bss_conf.use_cts_prot = false;
-@@ -691,12 +702,6 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+@@ -844,12 +855,6 @@ struct ieee80211_hw *ieee80211_alloc_hw_
  			   NL80211_FEATURE_FULL_AP_CLIENT_STATE;
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_FILS_STA);
  	wiphy_ext_feature_set(wiphy,
@@ -204,7 +215,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  			      NL80211_EXT_FEATURE_SCAN_FREQ_KHZ);
  	wiphy_ext_feature_set(wiphy,
  			      NL80211_EXT_FEATURE_POWERED_ADDR_CHANGE);
-@@ -1005,6 +1010,18 @@ int ieee80211_register_hw(struct ieee802
+@@ -1180,6 +1185,18 @@ int ieee80211_register_hw(struct ieee802
  			return -EINVAL;
  	}
  
@@ -225,7 +236,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		return -EINVAL;
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -2390,6 +2390,9 @@ sta_get_last_rx_stats(struct sta_info *s
+@@ -2416,6 +2416,9 @@ sta_get_last_rx_stats(struct sta_info *s
  	struct ieee80211_sta_rx_stats *stats = &sta->deflink.rx_stats;
  	int cpu;
  
@@ -237,7 +248,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -1029,11 +1029,23 @@ ieee80211_tx_h_stats(struct ieee80211_tx
+@@ -1027,11 +1027,23 @@ ieee80211_tx_h_stats(struct ieee80211_tx
  {
  	struct sk_buff *skb;
  	int ac = -1;
@@ -261,26 +272,29 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		ac = skb_get_queue_mapping(skb);
  		tx->sta->deflink.tx_stats.bytes[ac] += skb->len;
  	}
-@@ -2858,7 +2870,9 @@ static struct sk_buff *ieee80211_build_h
- 
- 	if (unlikely(!multicast && ((skb->sk &&
- 		     skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS) ||
--		     ctrl_flags & IEEE80211_TX_CTL_REQ_TX_STATUS)))
+@@ -2877,7 +2889,9 @@ static struct sk_buff *ieee80211_build_h
+ 	if (unlikely(!multicast &&
+ 		     ((skb->sk &&
+ 		       skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS) ||
+-		      ctrl_flags & IEEE80211_TX_CTL_REQ_TX_STATUS)))
 +		     ctrl_flags & IEEE80211_TX_CTL_REQ_TX_STATUS) &&
 +		     !(ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD) &&
 +		       ieee80211_is_data(fc) && !ieee80211_is_qos_nullfunc(fc))))
  		info_id = ieee80211_store_ack_skb(local, skb, &info_flags,
  						  cookie);
  
-@@ -4642,13 +4656,16 @@ static void ieee80211_8023_xmit(struct i
+@@ -4666,7 +4680,8 @@ static void ieee80211_8023_xmit(struct i
  	}
  
  	if (unlikely(skb->sk &&
--		     skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS))
+-		     skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS)) {
 +		     skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS &&
-+		     !ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD)))
- 		info->ack_frame_id = ieee80211_store_ack_skb(local, skb,
- 							     &info->flags, NULL);
++		     !ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD))) {
+ 		info->status_data = ieee80211_store_ack_skb(local, skb,
+ 							    &info->flags, NULL);
+ 		if (info->status_data)
+@@ -4674,8 +4689,10 @@ static void ieee80211_8023_xmit(struct i
+ 	}
  
  	dev_sw_netstats_tx_add(dev, skbs, len);
 -	sta->deflink.tx_stats.packets[queue] += skbs;
@@ -294,7 +308,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
 --- a/net/wireless/util.c
 +++ b/net/wireless/util.c
-@@ -2447,6 +2447,9 @@ bool cfg80211_does_bw_fit_range(const st
+@@ -2627,6 +2627,9 @@ bool cfg80211_does_bw_fit_range(const st
  
  int cfg80211_sinfo_alloc_tid_stats(struct station_info *sinfo, gfp_t gfp)
  {
@@ -306,7 +320,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  				gfp);
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2678,7 +2678,7 @@ static int ieee80211_change_bss(struct w
+@@ -2676,7 +2676,7 @@ static int ieee80211_change_bss(struct w
  	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	struct ieee80211_link_data *link;
  	struct ieee80211_supported_band *sband;
@@ -315,7 +329,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	link = ieee80211_link_or_deflink(sdata, params->link_id, true);
  	if (IS_ERR(link))
-@@ -2728,6 +2728,8 @@ static int ieee80211_change_bss(struct w
+@@ -2726,6 +2726,8 @@ static int ieee80211_change_bss(struct w
  			sdata->flags |= IEEE80211_SDATA_DONT_BRIDGE_PACKETS;
  		else
  			sdata->flags &= ~IEEE80211_SDATA_DONT_BRIDGE_PACKETS;
@@ -324,7 +338,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		ieee80211_check_fast_rx_iface(sdata);
  	}
  
-@@ -2756,6 +2758,8 @@ static int ieee80211_change_bss(struct w
+@@ -2754,6 +2756,8 @@ static int ieee80211_change_bss(struct w
  
  	ieee80211_link_info_change_notify(sdata, link, changed);
  
@@ -335,7 +349,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
 --- a/net/mac80211/driver-ops.h
 +++ b/net/mac80211/driver-ops.h
-@@ -172,6 +172,23 @@ void drv_link_info_changed(struct ieee80
+@@ -180,6 +180,23 @@ void drv_link_info_changed(struct ieee80
  			   struct ieee80211_bss_conf *info,
  			   int link_id, u64 changed);
  
@@ -361,7 +375,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  {
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1844,6 +1844,8 @@ void ieee80211_vif_cfg_change_notify(str
+@@ -1842,6 +1842,8 @@ void ieee80211_vif_cfg_change_notify(str
  void ieee80211_link_info_change_notify(struct ieee80211_sub_if_data *sdata,
  				       struct ieee80211_link_data *link,
  				       u64 changed);
@@ -372,7 +386,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
 --- a/net/mac80211/trace.h
 +++ b/net/mac80211/trace.h
-@@ -389,6 +389,38 @@ TRACE_EVENT(drv_config,
+@@ -412,6 +412,38 @@ TRACE_EVENT(drv_config,
  		LOCAL_PR_ARG, __entry->changed, CHANDEF_PR_ARG
  	)
  );
@@ -413,7 +427,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	TP_PROTO(struct ieee80211_local *local,
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -969,7 +969,8 @@ static bool ieee80211_set_sdata_offload_
+@@ -982,7 +982,8 @@ static bool ieee80211_set_sdata_offload_
  		    local->hw.wiphy->frag_threshold != (u32)-1)
  			flags &= ~IEEE80211_OFFLOAD_ENCAP_ENABLED;
  
@@ -425,7 +439,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		flags &= ~IEEE80211_OFFLOAD_ENCAP_ENABLED;
 --- a/net/mac80211/Kconfig
 +++ b/net/mac80211/Kconfig
-@@ -104,6 +104,15 @@ menuconfig MAC80211_DEBUG_MENU
+@@ -115,6 +115,15 @@ menuconfig MAC80211_DEBUG_MENU
  	help
  	  This option collects various mac80211 debug settings.
  
@@ -443,11 +457,11 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	depends on MAC80211_DEBUG_MENU
 --- a/local-symbols
 +++ b/local-symbols
-@@ -65,6 +65,7 @@ MAC80211_MESH_PS_DEBUG=
+@@ -59,6 +59,7 @@ MAC80211_MESH_PS_DEBUG=
  MAC80211_TDLS_DEBUG=
  MAC80211_DEBUG_COUNTERS=
  MAC80211_STA_HASH_MAX_SIZE=
 +MAC80211_NSS_SUPPORT=
  QCOM_AOSS_QMP=
  QCOM_COMMAND_DB=
- QCOM_CPR=
+ QCOM_GENI_SE=
diff --git a/package/kernel/mac80211/patches/nss/subsys/199-mac80211-fix-xmit-callback-when-hwencap-enable-in-st.patch b/package/kernel/mac80211/patches/nss/subsys/199-mac80211-fix-xmit-callback-when-hwencap-enable-in-st.patch
index 01740e29803580..0a1afb841e251e 100644
--- a/package/kernel/mac80211/patches/nss/subsys/199-mac80211-fix-xmit-callback-when-hwencap-enable-in-st.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/199-mac80211-fix-xmit-callback-when-hwencap-enable-in-st.patch
@@ -18,9 +18,9 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -6216,7 +6216,13 @@ start_xmit:
- 	mutex_lock(&local->mtx);
+@@ -6259,7 +6259,13 @@ int ieee80211_tx_control_port(struct wip
  
+ start_xmit:
  	local_bh_disable();
 -	__ieee80211_subif_start_xmit(skb, skb->dev, flags, ctrl_flags, cookie);
 +
@@ -32,4 +32,4 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
 +
  	local_bh_enable();
  
- 	mutex_unlock(&local->mtx);
+ 	return 0;
diff --git a/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch b/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
index bb7d15fb426238..cd2ffad52b290b 100644
--- a/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
@@ -31,9 +31,9 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
 
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -9327,4 +9327,15 @@ bool cfg80211_valid_disable_subchannel_b
-  */
- void cfg80211_links_removed(struct net_device *dev, u16 link_mask);
+@@ -9574,4 +9574,15 @@ ssize_t wiphy_locked_debugfs_write(struc
+ 				   void *data);
+ #endif
  
 +/**
 + * cfg80211_update_muedca_params_event - Notify the updated MU-EDCA parameters
@@ -49,7 +49,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  #endif /* __NET_CFG80211_H */
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -7368,6 +7368,20 @@ u32 ieee80211_calc_rx_airtime(struct iee
+@@ -7506,6 +7506,20 @@ u32 ieee80211_calc_rx_airtime(struct iee
  			      int len);
  
  /**
@@ -72,9 +72,9 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
   * This function calculates the estimated airtime usage of a frame based on the
 --- a/include/uapi/linux/nl80211.h
 +++ b/include/uapi/linux/nl80211.h
-@@ -1314,6 +1314,10 @@
-  *	Multi-Link reconfiguration. %NL80211_ATTR_MLO_LINKS is used to provide
-  *	information about the removed STA MLD setup links.
+@@ -1334,6 +1334,10 @@
+  *      %NL80211_ATTR_MLO_TTLM_ULINK attributes are used to specify the
+  *      TID to Link mapping for downlink/uplink traffic.
   *
 + * @NL80211_CMD_UPDATE_HE_MUEDCA_PARAMS: Updated MU-EDCA parameters from driver.
 + *	This event is used to update dynamic MU-EDCA parameters in Beacon frame,
@@ -83,26 +83,26 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
   * @NL80211_CMD_MAX: highest used command number
   * @__NL80211_CMD_AFTER_LAST: internal use
   */
-@@ -1569,6 +1573,7 @@ enum nl80211_commands {
+@@ -1591,6 +1595,7 @@ enum nl80211_commands {
  
- 	NL80211_CMD_LINKS_REMOVED,
+ 	NL80211_CMD_SET_TID_TO_LINK_MAPPING,
  
 +	NL80211_CMD_UPDATE_HE_MUEDCA_PARAMS,
  	/* add new commands above here */
  
  	/* used to define NL80211_CMD_MAX below */
-@@ -2815,6 +2820,8 @@ enum nl80211_commands {
-  * @NL80211_ATTR_MLO_LINK_DISABLED: Flag attribute indicating that the link is
-  *	disabled.
+@@ -2868,6 +2873,8 @@ enum nl80211_commands {
+  *	nested item, it contains attributes defined in
+  *	&enum nl80211_if_combination_attrs.
   *
 + * @NL80211_ATTR_HE_MUEDCA_PARAMS: MU-EDCA AC parameters for the
 + *	%NL80211_CMD_UPDATE_HE_MUEDCA_PARAMS command.
   * @NUM_NL80211_ATTR: total number of nl80211_attrs available
   * @NL80211_ATTR_MAX: highest attribute number currently defined
   * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -3353,6 +3360,8 @@ enum nl80211_attrs {
- 
- 	NL80211_ATTR_MLO_LINK_DISABLED,
+@@ -3416,6 +3423,8 @@ enum nl80211_attrs {
+ 	NL80211_ATTR_WIPHY_RADIOS,
+ 	NL80211_ATTR_WIPHY_INTERFACE_COMBINATIONS,
  
 +	NL80211_ATTR_HE_MUEDCA_PARAMS,
 +
@@ -111,7 +111,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  	__NL80211_ATTR_AFTER_LAST,
 --- a/net/mac80211/mlme.c
 +++ b/net/mac80211/mlme.c
-@@ -7954,3 +7954,15 @@ void ieee80211_disable_rssi_reports(stru
+@@ -8727,3 +8727,15 @@ void ieee80211_disable_rssi_reports(stru
  	_ieee80211_enable_rssi_reports(sdata, 0, 0);
  }
  EXPORT_SYMBOL(ieee80211_disable_rssi_reports);
@@ -129,7 +129,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
 +EXPORT_SYMBOL(ieee80211_update_muedca_params);
 --- a/net/mac80211/trace.h
 +++ b/net/mac80211/trace.h
-@@ -3092,6 +3092,26 @@ TRACE_EVENT(stop_queue,
+@@ -3125,6 +3125,26 @@ TRACE_EVENT(stop_queue,
  	)
  );
  
@@ -153,22 +153,22 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
 +	)
 +);
 +
- #endif /* !__MAC80211_DRIVER_TRACE || TRACE_HEADER_MULTI_READ */
- 
- #undef TRACE_INCLUDE_PATH
+ TRACE_EVENT(drv_can_neg_ttlm,
+ 	    TP_PROTO(struct ieee80211_local *local,
+ 		     struct ieee80211_sub_if_data *sdata,
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -812,6 +812,7 @@ static const struct nla_policy nl80211_p
+@@ -820,6 +820,7 @@ static const struct nla_policy nl80211_p
  	[NL80211_ATTR_HW_TIMESTAMP_ENABLED] = { .type = NLA_FLAG },
  	[NL80211_ATTR_EMA_RNR_ELEMS] = { .type = NLA_NESTED },
  	[NL80211_ATTR_MLO_LINK_DISABLED] = { .type = NLA_FLAG },
 +	[NL80211_ATTR_HE_MUEDCA_PARAMS] = NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_mu_edca_param_set)),
- };
- 
- /* policy for the key attributes */
-@@ -20211,6 +20212,42 @@ nla_put_failure:
+ 	[NL80211_ATTR_BSS_DUMP_INCLUDE_USE_DATA] = { .type = NLA_FLAG },
+ 	[NL80211_ATTR_MLO_TTLM_DLINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
+ 	[NL80211_ATTR_MLO_TTLM_ULINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
+@@ -20324,6 +20325,42 @@ void cfg80211_schedule_channels_check(st
  }
- EXPORT_SYMBOL(cfg80211_update_owe_info_event);
+ EXPORT_SYMBOL(cfg80211_schedule_channels_check);
  
 +void cfg80211_update_muedca_params_event(struct wiphy *wiphy,
 +					 struct ieee80211_mu_edca_param_set
@@ -211,7 +211,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  int __init nl80211_init(void)
 --- a/net/wireless/trace.h
 +++ b/net/wireless/trace.h
-@@ -3805,6 +3805,46 @@ TRACE_EVENT(cfg80211_update_owe_info_eve
+@@ -3809,6 +3809,46 @@ TRACE_EVENT(cfg80211_update_owe_info_eve
  		  __entry->assoc_link_id, __entry->peer_mld_addr)
  );
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/207-ath11k-Add-support-for-dynamic-vlan.patch b/package/kernel/mac80211/patches/nss/subsys/207-ath11k-Add-support-for-dynamic-vlan.patch
index f82584a9fdf3d0..ab75fef4e528a6 100644
--- a/package/kernel/mac80211/patches/nss/subsys/207-ath11k-Add-support-for-dynamic-vlan.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/207-ath11k-Add-support-for-dynamic-vlan.patch
@@ -29,7 +29,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  /* misc utils */
  
  static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
-@@ -4271,6 +4274,8 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4293,6 +4296,8 @@ void __ieee80211_subif_start_xmit(struct
  	struct sta_info *sta;
  	struct sk_buff *next;
  	int len = skb->len;
@@ -38,7 +38,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  
  	if (unlikely(!ieee80211_sdata_running(sdata) || skb->len < ETH_HLEN)) {
  		kfree_skb(skb);
-@@ -4292,6 +4297,19 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4314,6 +4319,19 @@ void __ieee80211_subif_start_xmit(struct
  	if (IS_ERR(sta))
  		sta = NULL;
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch b/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
index cfd026aea172cb..9ffad0818805e3 100644
--- a/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
@@ -40,7 +40,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  
  extern const struct cfg80211_ops mac80211_config_ops;
  
-@@ -1120,6 +1123,9 @@ struct ieee80211_sub_if_data {
+@@ -1171,6 +1174,9 @@ struct ieee80211_sub_if_data {
  		struct dentry *default_beacon_key;
  	} debugfs;
  #endif
@@ -65,9 +65,9 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  /**
   * DOC: Interface list locking
   *
-@@ -752,6 +758,13 @@ static int ieee80211_stop(struct net_dev
- 
- 	cancel_work_sync(&sdata->activate_links_work);
+@@ -763,6 +769,13 @@ static int ieee80211_stop(struct net_dev
+ 		ieee80211_stop_mbssid(sdata);
+ 	}
  
 +#ifdef CPTCFG_MAC80211_NSS_SUPPORT
 +	if (sdata->nssctx) {
@@ -77,9 +77,9 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
 +#endif
 +
  	wiphy_lock(sdata->local->hw.wiphy);
- 	ieee80211_do_stop(sdata, true);
- 	wiphy_unlock(sdata->local->hw.wiphy);
-@@ -1219,6 +1232,34 @@ void ieee80211_del_virtual_monitor(struc
+ 	wiphy_work_cancel(sdata->local->hw.wiphy, &sdata->activate_links_work);
+ 
+@@ -1217,6 +1230,34 @@ void ieee80211_del_virtual_monitor(struc
  	kfree(sdata);
  }
  
@@ -114,7 +114,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  /*
   * NOTE: Be very careful when changing this function, it must NOT return
   * an error on interface type changes that have been pre-checked, so most
-@@ -1450,6 +1491,21 @@ int ieee80211_do_open(struct wireless_de
+@@ -1444,6 +1485,21 @@ int ieee80211_do_open(struct wireless_de
  
  	ieee80211_recalc_ps(local);
  
@@ -138,7 +138,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	return 0;
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -2569,6 +2569,58 @@ static bool ieee80211_frame_allowed(stru
+@@ -2606,6 +2606,58 @@ static bool ieee80211_frame_allowed(stru
  	return true;
  }
  
@@ -197,7 +197,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  static void ieee80211_deliver_skb_to_local_stack(struct sk_buff *skb,
  						 struct ieee80211_rx_data *rx)
  {
-@@ -2608,11 +2660,15 @@ static void ieee80211_deliver_skb_to_loc
+@@ -2645,11 +2697,15 @@ static void ieee80211_deliver_skb_to_loc
  			     !ether_addr_equal(ehdr->h_dest, sdata->vif.addr)))
  			ether_addr_copy(ehdr->h_dest, sdata->vif.addr);
  
@@ -215,7 +215,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -1727,6 +1727,16 @@ static bool ieee80211_tx_frags(struct ie
+@@ -1725,6 +1725,16 @@ static bool ieee80211_tx_frags(struct ie
  				}
  			} else {
  
@@ -232,7 +232,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  				/*
  				 * Since queue is stopped, queue up frames for
  				 * later transmission from the tx-pending
-@@ -4504,6 +4514,35 @@ static void ieee80211_mlo_multicast_tx(s
+@@ -4526,6 +4536,35 @@ static void ieee80211_mlo_multicast_tx(s
  	kfree_skb(skb);
  }
  
@@ -268,7 +268,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  /**
   * ieee80211_subif_start_xmit - netif start_xmit function for 802.3 vifs
   * @skb: packet to be sent
-@@ -4517,6 +4556,10 @@ netdev_tx_t ieee80211_subif_start_xmit(s
+@@ -4541,6 +4580,10 @@ netdev_tx_t ieee80211_subif_start_xmit(s
  	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	const struct ethhdr *eth = (void *)skb->data;
  
@@ -279,7 +279,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	if (likely(!is_multicast_ether_addr(eth->h_dest)))
  		goto normal;
  
-@@ -4703,6 +4746,9 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4730,6 +4773,9 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  	struct ieee80211_key *key;
  	struct sta_info *sta;
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch b/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
index d0379441a09848..30fb8521368f5b 100644
--- a/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
@@ -21,7 +21,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -5105,6 +5105,17 @@ void ieee80211_sta_pspoll(struct ieee802
+@@ -5234,6 +5234,17 @@ void ieee80211_sta_pspoll(struct ieee802
   */
  void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *sta, u8 tid);
  
@@ -41,7 +41,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
   * This is enough for the radiotap header.
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2180,7 +2180,13 @@ static int ieee80211_change_station(stru
+@@ -2189,7 +2189,13 @@ static int ieee80211_change_station(stru
  
  			rcu_assign_pointer(vlansdata->u.vlan.sta, sta);
  			__ieee80211_check_fast_rx_iface(vlansdata);
@@ -58,9 +58,9 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		if (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
 --- a/net/mac80211/driver-ops.c
 +++ b/net/mac80211/driver-ops.c
-@@ -59,10 +59,9 @@ int drv_add_interface(struct ieee80211_l
- 
+@@ -62,10 +62,9 @@ int drv_add_interface(struct ieee80211_l
  	might_sleep();
+ 	lockdep_assert_wiphy(local->hw.wiphy);
  
 -	if (WARN_ON(sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
 -		    (sdata->vif.type == NL80211_IFTYPE_MONITOR &&
@@ -73,7 +73,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	trace_drv_add_interface(local, sdata);
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -676,6 +676,9 @@ static void ieee80211_do_stop(struct iee
+@@ -686,6 +686,9 @@ static void ieee80211_do_stop(struct iee
  
  	switch (sdata->vif.type) {
  	case NL80211_IFTYPE_AP_VLAN:
@@ -83,7 +83,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		break;
  	case NL80211_IFTYPE_MONITOR:
  		if (local->monitors == 0)
-@@ -960,6 +963,7 @@ static bool ieee80211_iftype_supports_hd
+@@ -973,6 +976,7 @@ static bool ieee80211_iftype_supports_hd
  	switch (iftype) {
  	/* P2P GO and client are mapped to AP/STATION types */
  	case NL80211_IFTYPE_AP:
@@ -91,7 +91,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	case NL80211_IFTYPE_STATION:
  		return true;
  	default:
-@@ -1014,7 +1018,8 @@ static void ieee80211_set_vif_encap_ops(
+@@ -1027,7 +1031,8 @@ static void ieee80211_set_vif_encap_ops(
  	struct ieee80211_sub_if_data *bss = sdata;
  	bool enabled;
  
@@ -101,7 +101,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		if (!sdata->bss)
  			return;
  
-@@ -1359,10 +1364,17 @@ int ieee80211_do_open(struct wireless_de
+@@ -1353,10 +1358,17 @@ int ieee80211_do_open(struct wireless_de
  
  	switch (sdata->vif.type) {
  	case NL80211_IFTYPE_AP_VLAN:
@@ -122,7 +122,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  			netif_carrier_off(dev);
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -1656,6 +1656,12 @@ void ieee80211_sta_uapsd_trigger(struct
+@@ -1683,6 +1683,12 @@ void ieee80211_sta_uapsd_trigger(struct
  }
  EXPORT_SYMBOL(ieee80211_sta_uapsd_trigger);
  
@@ -137,7 +137,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  {
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4308,8 +4308,11 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4330,8 +4330,11 @@ void __ieee80211_subif_start_xmit(struct
  		sta = NULL;
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
@@ -151,7 +151,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		if (ap_sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED &&
  		    !is_multicast_ether_addr(skb->data)) {
  			if (sta)
-@@ -4699,7 +4702,8 @@ static void ieee80211_8023_xmit(struct i
+@@ -4723,7 +4726,8 @@ static void ieee80211_8023_xmit(struct i
  
  	info->hw_queue = sdata->vif.hw_queue[queue];
  
@@ -163,17 +163,17 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
 --- a/net/mac80211/util.c
 +++ b/net/mac80211/util.c
-@@ -2410,6 +2410,9 @@ static void ieee80211_assign_chanctx(str
- 	if (!local->use_chanctx)
- 		return;
+@@ -1664,6 +1664,9 @@ static void ieee80211_assign_chanctx(str
+ 
+ 	lockdep_assert_wiphy(local->hw.wiphy);
  
 +	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
 +		return;
 +
- 	mutex_lock(&local->chanctx_mtx);
  	conf = rcu_dereference_protected(link->conf->chanctx_conf,
- 					 lockdep_is_held(&local->chanctx_mtx));
-@@ -2615,7 +2618,8 @@ int ieee80211_reconfig(struct ieee80211_
+ 					 lockdep_is_held(&local->hw.wiphy->mtx));
+ 	if (conf) {
+@@ -1869,7 +1872,8 @@ int ieee80211_reconfig(struct ieee80211_
  	}
  
  	list_for_each_entry(sdata, &local->interfaces, list) {
@@ -183,7 +183,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		    sdata->vif.type != NL80211_IFTYPE_MONITOR &&
  		    ieee80211_sdata_running(sdata)) {
  			res = drv_add_interface(local, sdata);
-@@ -2630,7 +2634,8 @@ int ieee80211_reconfig(struct ieee80211_
+@@ -1884,7 +1888,8 @@ int ieee80211_reconfig(struct ieee80211_
  	if (res) {
  		list_for_each_entry_continue_reverse(sdata, &local->interfaces,
  						     list)
@@ -195,7 +195,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  				drv_remove_interface(local, sdata);
 --- a/net/mac80211/mlme.c
 +++ b/net/mac80211/mlme.c
-@@ -5259,7 +5259,8 @@ static bool ieee80211_assoc_success(stru
+@@ -5297,7 +5297,8 @@ static bool ieee80211_assoc_success(stru
  	 * If we're using 4-addr mode, let the AP know that we're
  	 * doing so, so that it can create the STA VLAN on its side
  	 */
@@ -207,9 +207,9 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	/*
 --- a/net/mac80211/driver-ops.h
 +++ b/net/mac80211/driver-ops.h
-@@ -1457,7 +1457,9 @@ static inline void drv_sta_set_4addr(str
- 				     struct ieee80211_sub_if_data *sdata,
- 				     struct ieee80211_sta *sta, bool enabled)
+@@ -619,7 +619,9 @@ static inline void drv_sta_rate_tbl_upda
+ 					   struct ieee80211_sub_if_data *sdata,
+ 					   struct ieee80211_sta *sta)
  {
 -	sdata = get_bss_sdata(sdata);
 +	if (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD))
diff --git a/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch b/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
index 94b731218a7445..08455308e72a11 100644
--- a/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
@@ -24,7 +24,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2093,6 +2093,8 @@ enum ieee80211_key_flags {
+@@ -2184,6 +2184,8 @@ enum ieee80211_key_flags {
   * @tx_pn: PN used for TX keys, may be used by the driver as well if it
   *	needs to do software PN assignment by itself (e.g. due to TSO)
   * @flags: key flags, see &enum ieee80211_key_flags.
@@ -33,7 +33,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
   * @keyidx: the key index (0-3)
   * @keylen: key material length
   * @key: key material. For ALG_TKIP the key is encoded as a 256-bit (32 byte)
-@@ -2112,6 +2114,7 @@ struct ieee80211_key_conf {
+@@ -2203,6 +2205,7 @@ struct ieee80211_key_conf {
  	u8 hw_key_idx;
  	s8 keyidx;
  	u16 flags;
@@ -43,7 +43,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	u8 key[];
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -538,6 +538,7 @@ static int ieee80211_add_key(struct wiph
+@@ -535,6 +535,7 @@ static int ieee80211_add_key(struct wiph
  		break;
  	case NL80211_IFTYPE_AP:
  	case NL80211_IFTYPE_AP_VLAN:
@@ -53,9 +53,9 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  			key->conf.flags |= IEEE80211_KEY_FLAG_RX_MGMT;
 --- a/net/mac80211/driver-ops.c
 +++ b/net/mac80211/driver-ops.c
-@@ -116,7 +116,11 @@ int drv_sta_state(struct ieee80211_local
- 
+@@ -134,7 +134,11 @@ int drv_sta_state(struct ieee80211_local
  	might_sleep();
+ 	lockdep_assert_wiphy(local->hw.wiphy);
  
 -	sdata = get_bss_sdata(sdata);
 +	if (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD) ||
@@ -68,9 +68,9 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
 --- a/net/mac80211/driver-ops.h
 +++ b/net/mac80211/driver-ops.h
-@@ -453,7 +453,9 @@ static inline int drv_sta_add(struct iee
- 
+@@ -474,7 +474,9 @@ static inline int drv_sta_add(struct iee
  	might_sleep();
+ 	lockdep_assert_wiphy(local->hw.wiphy);
  
 -	sdata = get_bss_sdata(sdata);
 +	if (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD))
@@ -81,7 +81,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
 --- a/net/mac80211/key.c
 +++ b/net/mac80211/key.c
-@@ -166,7 +166,8 @@ static int ieee80211_key_enable_hw_accel
+@@ -160,7 +160,8 @@ static int ieee80211_key_enable_hw_accel
  	if (sta && !sta->uploaded)
  		goto out_unsupported;
  
@@ -91,7 +91,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		/*
  		 * The driver doesn't know anything about VLAN interfaces.
  		 * Hence, don't send GTKs for VLAN interfaces to the driver.
-@@ -610,6 +611,8 @@ ieee80211_key_alloc(u32 cipher, int idx,
+@@ -606,6 +607,8 @@ ieee80211_key_alloc(u32 cipher, int idx,
  	 */
  	key->conf.flags = 0;
  	key->flags = 0;
@@ -102,7 +102,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	key->conf.cipher = cipher;
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4658,16 +4658,25 @@ static void ieee80211_8023_xmit(struct i
+@@ -4682,16 +4682,25 @@ static void ieee80211_8023_xmit(struct i
  				struct ieee80211_key *key, struct sk_buff *skb)
  {
  	struct ieee80211_tx_info *info;
diff --git a/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch b/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch
index 021fa9826d534a..2e629bc28f42a5 100644
--- a/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch
@@ -20,7 +20,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
 
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -207,6 +207,7 @@ enum ieee80211_rx_flags {
+@@ -216,6 +216,7 @@ enum ieee80211_rx_flags {
  };
  
  struct ieee80211_rx_data {
@@ -30,7 +30,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	struct ieee80211_local *local;
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4687,19 +4687,21 @@ static void ieee80211_8023_xmit(struct i
+@@ -4711,19 +4711,21 @@ static void ieee80211_8023_xmit(struct i
  
  	ieee80211_aggr_check(sdata, sta, skb);
  
@@ -64,7 +64,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	}
  
  	skb = ieee80211_tx_skb_fixup(skb, ieee80211_sdata_netdev_features(sdata));
-@@ -4756,7 +4758,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4783,7 +4785,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  {
  	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	struct ethhdr *ehdr = (struct ethhdr *)skb->data;
@@ -73,7 +73,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	struct sta_info *sta;
  
  #ifdef CPTCFG_MAC80211_NSS_SUPPORT
-@@ -4774,9 +4776,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4801,9 +4803,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		goto out;
  	}
  
@@ -90,7 +90,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  		goto skip_offload;
  
  	key = rcu_dereference(sta->ptk[sta->ptk_idx]);
-@@ -4787,6 +4793,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4814,6 +4820,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		goto skip_offload;
  
  	sk_pacing_shift_update(skb->sk, sdata->local->hw.tx_sk_pacing_shift);
@@ -98,9 +98,9 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	ieee80211_8023_xmit(sdata, dev, sta, key, skb);
  	goto out;
  
-@@ -6293,13 +6300,7 @@ start_xmit:
- 	mutex_lock(&local->mtx);
+@@ -6336,13 +6343,7 @@ int ieee80211_tx_control_port(struct wip
  
+ start_xmit:
  	local_bh_disable();
 -
 -	/* added hardware encap check for ethernet mode */
@@ -112,4 +112,4 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
 +	__ieee80211_subif_start_xmit(skb, skb->dev, flags, ctrl_flags, cookie);
  	local_bh_enable();
  
- 	mutex_unlock(&local->mtx);
+ 	return 0;
diff --git a/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch b/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
index 27a7cf3bdf48ca..c19f9606a90f8f 100644
--- a/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
@@ -48,7 +48,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  /**
   * enum ieee80211_max_queues - maximum number of queues
   *
-@@ -387,11 +390,17 @@ enum ieee80211_bss_change {
+@@ -411,11 +414,17 @@ enum ieee80211_bss_change {
   * to indicate which NSS BSS parameter changed.
   *
   * @BSS_CHANGED_NSS_AP_ISOLATE: AP Isolate feature in NSS mode
@@ -66,7 +66,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  };
  
  /*
-@@ -790,6 +799,11 @@ struct ieee80211_bss_conf {
+@@ -809,6 +818,11 @@ struct ieee80211_bss_conf {
  	bool he_full_ul_mumimo;
  	bool eht_su_beamformer;
  	bool eht_su_beamformee;
@@ -78,7 +78,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	bool eht_mu_beamformer;
  	bool nss_ap_isolate;
  };
-@@ -1275,6 +1289,8 @@ struct ieee80211_rate_status {
+@@ -1302,6 +1316,8 @@ struct ieee80211_rate_status {
   * @ack_hwtstamp: Hardware timestamp of the received ack in nanoseconds
   *	Only needed for Timing measurement and Fine timing measurement action
   *	frames. Only reported by devices that have timestamping enabled.
@@ -87,7 +87,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
   */
  struct ieee80211_tx_status {
  	struct ieee80211_sta *sta;
-@@ -1285,6 +1301,8 @@ struct ieee80211_tx_status {
+@@ -1312,6 +1328,8 @@ struct ieee80211_tx_status {
  	u8 n_rates;
  
  	struct list_head *free_list;
@@ -96,31 +96,31 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  };
  
  /**
-@@ -1782,6 +1800,7 @@ struct ieee80211_channel_switch {
-  *	this is not pure P2P vif.
-  * @IEEE80211_VIF_DISABLE_SMPS_OVERRIDE: disable user configuration of
-  *	SMPS mode via debugfs.
+@@ -1820,6 +1838,7 @@ struct ieee80211_channel_switch {
+  *	operation on this interface and request a channel context without
+  *	the AP definition. Use this e.g. because the device is able to
+  *	handle OFDMA (downlink and trigger for uplink) on a per-AP basis.
 + * @IEEE80211_HW_NSS_OFFLOAD_DEBUG_MODE: It enables the debug mode of nss offload.
   */
  enum ieee80211_vif_flags {
  	IEEE80211_VIF_BEACON_FILTER		= BIT(0),
-@@ -1789,6 +1808,7 @@ enum ieee80211_vif_flags {
- 	IEEE80211_VIF_SUPPORTS_UAPSD		= BIT(2),
+@@ -1828,6 +1847,7 @@ enum ieee80211_vif_flags {
  	IEEE80211_VIF_GET_NOA_UPDATE		= BIT(3),
- 	IEEE80211_VIF_DISABLE_SMPS_OVERRIDE	= BIT(4),
-+	IEEE80211_VIF_NSS_OFFLOAD_DEBUG_MODE    = BIT(5),
+ 	IEEE80211_VIF_EML_ACTIVE	        = BIT(4),
+ 	IEEE80211_VIF_IGNORE_OFDMA_WIDER_BW	= BIT(5),
++	IEEE80211_VIF_NSS_OFFLOAD_DEBUG_MODE = BIT(6),
  };
  
  
-@@ -2776,6 +2796,7 @@ enum ieee80211_hw_flags {
- 	IEEE80211_HW_DETECTS_COLOR_COLLISION,
- 	IEEE80211_HW_MLO_MCAST_MULTI_LINK_TX,
+@@ -2879,6 +2899,7 @@ enum ieee80211_hw_flags {
+ 	IEEE80211_HW_DISALLOW_PUNCTURING,
+ 	IEEE80211_HW_HANDLES_QUIET_CSA,
  	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
 +	IEEE80211_HW_SUPPORTS_MESH_NSS_OFFLOAD,
  
  	/* keep last, obviously */
  	NUM_IEEE80211_HW_FLAGS
-@@ -4276,6 +4297,8 @@ struct ieee80211_prep_tx_info {
+@@ -4388,6 +4409,8 @@ struct ieee80211_prep_tx_info {
   * @set_sar_specs: Update the SAR (TX power) settings.
   * @sta_set_decap_offload: Called to notify the driver when a station is allowed
   *	to use rx decapsulation offload
@@ -129,7 +129,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
   * @add_twt_setup: Update hw with TWT agreement parameters received from the peer.
   *	This callback allows the hw to check if requested parameters
   *	are supported and if there is enough room for a new agreement.
-@@ -4659,6 +4682,12 @@ struct ieee80211_ops {
+@@ -4782,6 +4805,12 @@ struct ieee80211_ops {
  	void (*sta_set_decap_offload)(struct ieee80211_hw *hw,
  				      struct ieee80211_vif *vif,
  				      struct ieee80211_sta *sta, bool enabled);
@@ -142,9 +142,9 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	void (*add_twt_setup)(struct ieee80211_hw *hw,
  			      struct ieee80211_sta *sta,
  			      struct ieee80211_twt_setup *twt);
-@@ -7517,4 +7546,100 @@ int ieee80211_set_active_links(struct ie
- void ieee80211_set_active_links_async(struct ieee80211_vif *vif,
- 				      u16 active_links);
+@@ -7667,4 +7696,100 @@ int ieee80211_emulate_switch_vif_chanctx
+ 					 int n_vifs,
+ 					 enum ieee80211_chanctx_switch_mode mode);
  
 +/* Defines for Mesh NSS offload */
 +
@@ -245,7 +245,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  #endif /* MAC80211_H */
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2522,6 +2522,7 @@ static int ieee80211_update_mesh_config(
+@@ -2519,6 +2519,7 @@ static int ieee80211_update_mesh_config(
  	struct mesh_config *conf;
  	struct ieee80211_sub_if_data *sdata;
  	struct ieee80211_if_mesh *ifmsh;
@@ -253,7 +253,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  
  	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	ifmsh = &sdata->u.mesh;
-@@ -2538,8 +2539,11 @@ static int ieee80211_update_mesh_config(
+@@ -2535,8 +2536,11 @@ static int ieee80211_update_mesh_config(
  		conf->dot11MeshMaxPeerLinks = nconf->dot11MeshMaxPeerLinks;
  	if (_chg_mesh_attr(NL80211_MESHCONF_MAX_RETRIES, mask))
  		conf->dot11MeshMaxRetries = nconf->dot11MeshMaxRetries;
@@ -266,7 +266,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	if (_chg_mesh_attr(NL80211_MESHCONF_ELEMENT_TTL, mask))
  		conf->element_ttl = nconf->element_ttl;
  	if (_chg_mesh_attr(NL80211_MESHCONF_AUTO_OPEN_PLINKS, mask)) {
-@@ -2553,8 +2557,12 @@ static int ieee80211_update_mesh_config(
+@@ -2550,8 +2554,12 @@ static int ieee80211_update_mesh_config(
  	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, mask))
  		conf->dot11MeshHWMPmaxPREQretries =
  			nconf->dot11MeshHWMPmaxPREQretries;
@@ -280,7 +280,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	if (_chg_mesh_attr(NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, mask))
  		conf->min_discovery_timeout = nconf->min_discovery_timeout;
  	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, mask))
-@@ -2589,8 +2597,12 @@ static int ieee80211_update_mesh_config(
+@@ -2586,8 +2594,12 @@ static int ieee80211_update_mesh_config(
  	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_RANN_INTERVAL, mask))
  		conf->dot11MeshHWMPRannInterval =
  			nconf->dot11MeshHWMPRannInterval;
@@ -294,7 +294,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	if (_chg_mesh_attr(NL80211_MESHCONF_RSSI_THRESHOLD, mask)) {
  		/* our RSSI threshold implementation is supported only for
  		 * devices that report signal in dBm.
-@@ -2632,6 +2644,7 @@ static int ieee80211_update_mesh_config(
+@@ -2629,6 +2641,7 @@ static int ieee80211_update_mesh_config(
  		conf->dot11MeshConnectedToAuthServer =
  			nconf->dot11MeshConnectedToAuthServer;
  	ieee80211_mbss_info_change_notify(sdata, BSS_CHANGED_BEACON);
@@ -317,7 +317,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  #ifdef CPTCFG_MAC80211_TDLS_DEBUG
  #define MAC80211_TDLS_DEBUG 1
  #else
-@@ -215,6 +221,10 @@ do {									\
+@@ -216,6 +222,10 @@ do {									\
  	_sdata_dbg(MAC80211_MESH_PS_DEBUG,				\
  		   sdata, fmt, ##__VA_ARGS__)
  
@@ -330,9 +330,9 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  		   sdata, fmt, ##__VA_ARGS__)
 --- a/net/mac80211/debugfs.c
 +++ b/net/mac80211/debugfs.c
-@@ -506,6 +506,7 @@ static const char *hw_flag_names[] = {
- 	FLAG(DETECTS_COLOR_COLLISION),
- 	FLAG(MLO_MCAST_MULTI_LINK_TX),
+@@ -509,6 +509,7 @@ static const char *hw_flag_names[] = {
+ 	FLAG(DISALLOW_PUNCTURING),
+ 	FLAG(HANDLES_QUIET_CSA),
  	FLAG(SUPPORTS_NSS_OFFLOAD),
 +	FLAG(SUPPORTS_MESH_NSS_OFFLOAD),
  #undef FLAG
@@ -340,7 +340,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  
 --- a/net/mac80211/driver-ops.c
 +++ b/net/mac80211/driver-ops.c
-@@ -579,3 +579,23 @@ int drv_change_sta_links(struct ieee8021
+@@ -621,3 +621,23 @@ int drv_change_sta_links(struct ieee8021
  
  	return 0;
  }
@@ -364,22 +364,9 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
 +	/* TODO: trace event */
 +}
 +#endif
---- a/net/mac80211/driver-ops.h
-+++ b/net/mac80211/driver-ops.h
-@@ -1571,4 +1571,10 @@ int drv_change_sta_links(struct ieee8021
- 			 struct ieee80211_sta *sta,
- 			 u16 old_links, u16 new_links);
- 
-+#ifdef CPTCFG_MAC80211_MESH
-+void drv_config_mesh_offload_path(struct ieee80211_local *local,
-+				  struct ieee80211_sub_if_data *sdata,
-+				  enum ieee80211_mesh_path_offld_cmd cmd,
-+				  struct ieee80211_mesh_path_offld *path);
-+#endif /* CPTCFG_MAC80211_MESH */
- #endif /* __MAC80211_DRIVER_OPS */
 --- a/net/mac80211/mesh.h
 +++ b/net/mac80211/mesh.h
-@@ -320,6 +320,10 @@ void mesh_rx_path_sel_frame(struct ieee8
+@@ -321,6 +321,10 @@ void mesh_rx_path_sel_frame(struct ieee8
  			    struct ieee80211_mgmt *mgmt, size_t len);
  struct mesh_path *
  mesh_path_add(struct ieee80211_sub_if_data *sdata, const u8 *dst);
@@ -390,7 +377,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  
  int mesh_path_add_gate(struct mesh_path *mpath);
  int mesh_path_send_to_gates(struct mesh_path *mpath);
-@@ -361,6 +365,7 @@ void mesh_path_discard_frame(struct ieee
+@@ -362,6 +366,7 @@ void mesh_path_discard_frame(struct ieee
  void mesh_path_tx_root_frame(struct ieee80211_sub_if_data *sdata);
  
  bool mesh_action_is_path_sel(struct ieee80211_mgmt *mgmt);
@@ -400,7 +387,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  		 struct ieee80211_mesh_fast_tx_key *key);
 --- a/net/mac80211/mesh_hwmp.c
 +++ b/net/mac80211/mesh_hwmp.c
-@@ -365,6 +365,13 @@ u32 airtime_link_metric_get(struct ieee8
+@@ -367,6 +367,13 @@ u32 airtime_link_metric_get(struct ieee8
  	return (u32)result;
  }
  
@@ -414,7 +401,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  /**
   * hwmp_route_info_get - Update routing info to originator and transmitter
   *
-@@ -388,9 +395,10 @@ static u32 hwmp_route_info_get(struct ie
+@@ -390,9 +397,10 @@ static u32 hwmp_route_info_get(struct ie
  {
  	struct ieee80211_local *local = sdata->local;
  	struct mesh_path *mpath;
@@ -426,7 +413,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	u32 orig_sn, orig_metric;
  	unsigned long orig_lifetime, exp_time;
  	u32 last_hop_metric, new_metric;
-@@ -492,7 +500,10 @@ static u32 hwmp_route_info_get(struct ie
+@@ -494,7 +502,10 @@ static u32 hwmp_route_info_get(struct ie
  		}
  
  		if (fresh_info) {
@@ -438,7 +425,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  				mpath->path_change_count++;
  				flush_mpath = true;
  			}
-@@ -514,6 +525,8 @@ static u32 hwmp_route_info_get(struct ie
+@@ -516,6 +527,8 @@ static u32 hwmp_route_info_get(struct ie
  			/* draft says preq_id should be saved to, but there does
  			 * not seem to be any use for it, skipping by now
  			 */
@@ -447,7 +434,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  		} else
  			spin_unlock_bh(&mpath->state_lock);
  	}
-@@ -544,7 +557,14 @@ static u32 hwmp_route_info_get(struct ie
+@@ -546,7 +559,14 @@ static u32 hwmp_route_info_get(struct ie
  		}
  
  		if (fresh_info) {
@@ -463,7 +450,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  				mpath->path_change_count++;
  				flush_mpath = true;
  			}
-@@ -561,6 +581,8 @@ static u32 hwmp_route_info_get(struct ie
+@@ -563,6 +583,8 @@ static u32 hwmp_route_info_get(struct ie
  			/* init it at a low value - 0 start is tricky */
  			ewma_mesh_fail_avg_add(&sta->mesh->fail_avg, 1);
  			mesh_path_tx_pending(mpath);
@@ -472,7 +459,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  		} else
  			spin_unlock_bh(&mpath->state_lock);
  	}
-@@ -697,15 +719,6 @@ static void hwmp_preq_frame_process(stru
+@@ -699,15 +721,6 @@ static void hwmp_preq_frame_process(stru
  	}
  }
  
@@ -488,7 +475,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
  				    struct ieee80211_mgmt *mgmt,
  				    const u8 *prep_elem, u32 metric)
-@@ -1349,3 +1362,274 @@ void mesh_path_tx_root_frame(struct ieee
+@@ -1351,3 +1364,274 @@ void mesh_path_tx_root_frame(struct ieee
  		return;
  	}
  }
@@ -765,7 +752,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
 +EXPORT_SYMBOL(ieee80211_mesh_path_offld_change_notify);
 --- a/net/mac80211/mesh_pathtbl.c
 +++ b/net/mac80211/mesh_pathtbl.c
-@@ -15,6 +15,7 @@
+@@ -16,6 +16,7 @@
  #include "ieee80211_i.h"
  #include "mesh.h"
  #include <linux/rhashtable.h>
@@ -773,7 +760,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  
  static void mesh_path_free_rcu(struct mesh_table *tbl, struct mesh_path *mpath);
  
-@@ -103,6 +104,63 @@ static void mesh_table_free(struct mesh_
+@@ -104,6 +105,63 @@ static void mesh_table_free(struct mesh_
  				    mesh_path_rht_free, tbl);
  }
  
@@ -837,7 +824,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  /**
   * mesh_path_assign_nexthop - update mesh path next hop
   *
-@@ -240,16 +298,23 @@ static void mesh_path_move_to_queue(stru
+@@ -241,16 +299,23 @@ static void mesh_path_move_to_queue(stru
  
  
  static struct mesh_path *mpath_lookup(struct mesh_table *tbl, const u8 *dst,
@@ -862,7 +849,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	}
  	return mpath;
  }
-@@ -266,13 +331,13 @@ static struct mesh_path *mpath_lookup(st
+@@ -267,13 +332,13 @@ static struct mesh_path *mpath_lookup(st
  struct mesh_path *
  mesh_path_lookup(struct ieee80211_sub_if_data *sdata, const u8 *dst)
  {
@@ -878,7 +865,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  }
  
  static struct mesh_path *
-@@ -334,6 +399,7 @@ mpp_path_lookup_by_idx(struct ieee80211_
+@@ -337,6 +402,7 @@ mpp_path_lookup_by_idx(struct ieee80211_
  int mesh_path_add_gate(struct mesh_path *mpath)
  {
  	struct mesh_table *tbl;
@@ -886,7 +873,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	int err;
  
  	rcu_read_lock();
-@@ -346,6 +412,7 @@ int mesh_path_add_gate(struct mesh_path
+@@ -349,6 +415,7 @@ int mesh_path_add_gate(struct mesh_path
  		goto err_rcu;
  	}
  	mpath->is_gate = true;
@@ -894,7 +881,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	mpath->sdata->u.mesh.num_gates++;
  
  	spin_lock(&tbl->gates_lock);
-@@ -354,6 +421,8 @@ int mesh_path_add_gate(struct mesh_path
+@@ -357,6 +424,8 @@ int mesh_path_add_gate(struct mesh_path
  
  	spin_unlock_bh(&mpath->state_lock);
  
@@ -903,7 +890,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	mpath_dbg(mpath->sdata,
  		  "Mesh path: Recorded new gate: %pM. %d known gates\n",
  		  mpath->dst, mpath->sdata->u.mesh.num_gates);
-@@ -370,16 +439,21 @@ err_rcu:
+@@ -373,16 +442,21 @@ err_rcu:
   */
  static void mesh_gate_del(struct mesh_table *tbl, struct mesh_path *mpath)
  {
@@ -925,7 +912,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	mpath_dbg(mpath->sdata,
  		  "Mesh path: Deleted gate: %pM. %d known gates\n",
  		  mpath->dst, mpath->sdata->u.mesh.num_gates);
-@@ -667,17 +741,8 @@ void mesh_fast_tx_flush_addr(struct ieee
+@@ -668,17 +742,8 @@ void mesh_fast_tx_flush_addr(struct ieee
  	spin_unlock_bh(&cache->walk_lock);
  }
  
@@ -945,7 +932,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  {
  	struct mesh_table *tbl;
  	struct mesh_path *mpath, *new_mpath;
-@@ -718,8 +783,36 @@ struct mesh_path *mesh_path_add(struct i
+@@ -719,8 +784,36 @@ struct mesh_path *mesh_path_add(struct i
  	return new_mpath;
  }
  
@@ -984,7 +971,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  {
  	struct mesh_table *tbl;
  	struct mesh_path *new_mpath;
-@@ -757,6 +850,25 @@ int mpp_path_add(struct ieee80211_sub_if
+@@ -758,6 +851,25 @@ int mpp_path_add(struct ieee80211_sub_if
  	return ret;
  }
  
@@ -1010,7 +997,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  
  /**
   * mesh_plink_broken - deactivates paths and sends perr when a link breaks
-@@ -807,8 +919,29 @@ static void mesh_path_free_rcu(struct me
+@@ -808,8 +920,29 @@ static void mesh_path_free_rcu(struct me
  	kfree_rcu(mpath, rcu);
  }
  
@@ -1041,7 +1028,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	hlist_del_rcu(&mpath->walk_list);
  	rhashtable_remove_fast(&tbl->rhead, &mpath->rhash, mesh_rht_params);
  	if (tbl == &mpath->sdata->u.mesh.mpp_paths)
-@@ -816,6 +949,11 @@ static void __mesh_path_del(struct mesh_
+@@ -817,6 +950,11 @@ static void __mesh_path_del(struct mesh_
  	else
  		mesh_fast_tx_flush_mpath(mpath);
  	mesh_path_free_rcu(tbl, mpath);
@@ -1053,7 +1040,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  }
  
  /**
-@@ -839,7 +977,7 @@ void mesh_path_flush_by_nexthop(struct s
+@@ -840,7 +978,7 @@ void mesh_path_flush_by_nexthop(struct s
  	spin_lock_bh(&tbl->walk_lock);
  	hlist_for_each_entry_safe(mpath, n, &tbl->walk_head, walk_list) {
  		if (rcu_access_pointer(mpath->next_hop) == sta)
@@ -1062,7 +1049,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	}
  	spin_unlock_bh(&tbl->walk_lock);
  }
-@@ -854,19 +992,19 @@ static void mpp_flush_by_proxy(struct ie
+@@ -855,19 +993,19 @@ static void mpp_flush_by_proxy(struct ie
  	spin_lock_bh(&tbl->walk_lock);
  	hlist_for_each_entry_safe(mpath, n, &tbl->walk_head, walk_list) {
  		if (ether_addr_equal(mpath->mpp, proxy))
@@ -1123,7 +1110,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	sdata->u.mesh.mesh_paths_generation++;
  	return err;
  }
-@@ -1031,7 +1169,10 @@ void mesh_path_flush_pending(struct mesh
+@@ -1046,7 +1184,10 @@ void mesh_path_flush_pending(struct mesh
   */
  void mesh_path_fix_nexthop(struct mesh_path *mpath, struct sta_info *next_hop)
  {
@@ -1134,7 +1121,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	mesh_path_assign_nexthop(mpath, next_hop);
  	mpath->sn = 0xffff;
  	mpath->metric = 0;
-@@ -1045,6 +1186,8 @@ void mesh_path_fix_nexthop(struct mesh_p
+@@ -1060,6 +1201,8 @@ void mesh_path_fix_nexthop(struct mesh_p
  	/* init it at a low value - 0 start is tricky */
  	ewma_mesh_fail_avg_add(&next_hop->mesh->fail_avg, 1);
  	mesh_path_tx_pending(mpath);
@@ -1143,7 +1130,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  }
  
  void mesh_pathtbl_init(struct ieee80211_sub_if_data *sdata)
-@@ -1056,7 +1199,7 @@ void mesh_pathtbl_init(struct ieee80211_
+@@ -1071,7 +1214,7 @@ void mesh_pathtbl_init(struct ieee80211_
  
  static
  void mesh_path_tbl_expire(struct ieee80211_sub_if_data *sdata,
@@ -1152,7 +1139,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  {
  	struct mesh_path *mpath;
  	struct hlist_node *n;
-@@ -1066,15 +1209,15 @@ void mesh_path_tbl_expire(struct ieee802
+@@ -1081,15 +1224,15 @@ void mesh_path_tbl_expire(struct ieee802
  		if ((!(mpath->flags & MESH_PATH_RESOLVING)) &&
  		    (!(mpath->flags & MESH_PATH_FIXED)) &&
  		     time_after(jiffies, mpath->exp_time + MESH_PATH_EXPIRE))
@@ -1173,7 +1160,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  void mesh_pathtbl_unregister(struct ieee80211_sub_if_data *sdata)
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -2620,7 +2620,7 @@ static struct sk_buff *ieee80211_build_h
+@@ -2638,7 +2638,7 @@ static struct sk_buff *ieee80211_build_h
  	bool multicast;
  	u16 info_id = 0;
  	struct ieee80211_chanctx_conf *chanctx_conf = NULL;
@@ -1182,7 +1169,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	int ret;
  	u8 link_id = u32_get_bits(ctrl_flags, IEEE80211_TX_CTRL_MLO_LINK);
  
-@@ -2632,6 +2632,9 @@ static struct sk_buff *ieee80211_build_h
+@@ -2650,6 +2650,9 @@ static struct sk_buff *ieee80211_build_h
  		info_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
  #endif
  
@@ -1192,7 +1179,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	/* convert Ethernet header to proper 802.11 header (based on
  	 * operation mode) */
  	ethertype = (skb->data[12] << 8) | skb->data[13];
-@@ -2702,6 +2705,13 @@ static struct sk_buff *ieee80211_build_h
+@@ -2720,6 +2723,13 @@ static struct sk_buff *ieee80211_build_h
  		break;
  #ifdef CPTCFG_MAC80211_MESH
  	case NL80211_IFTYPE_MESH_POINT:
@@ -1206,22 +1193,17 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  		if (!is_multicast_ether_addr(skb->data)) {
  			struct sta_info *next_hop;
  			bool mpp_lookup = true;
-@@ -2965,10 +2975,10 @@ static struct sk_buff *ieee80211_build_h
+@@ -2984,6 +2994,9 @@ static struct sk_buff *ieee80211_build_h
  
  	skb_reset_mac_header(skb);
  
--	info = IEEE80211_SKB_CB(skb);
--	memset(info, 0, sizeof(*info));
--
--	info->flags = info_flags;
 +#ifdef CPTCFG_MAC80211_MESH
 +nss_mesh:
 +#endif
-+	info->flags |= info_flags;
- 	info->ack_frame_id = info_id;
- 	info->band = band;
+ 	info = IEEE80211_SKB_CB(skb);
+ 	memset(info, 0, sizeof(*info));
  
-@@ -4285,6 +4295,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4307,6 +4320,7 @@ void __ieee80211_subif_start_xmit(struct
  	struct sk_buff *next;
  	int len = skb->len;
  	struct ieee80211_key *key = NULL;
@@ -1229,7 +1211,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	struct ieee80211_sub_if_data *ap_sdata;
  
  	if (unlikely(!ieee80211_sdata_running(sdata) || skb->len < ETH_HLEN)) {
-@@ -4359,9 +4370,15 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4381,9 +4395,15 @@ void __ieee80211_subif_start_xmit(struct
  			goto out;
  		}
  
@@ -1248,3 +1230,16 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	}
  	goto out;
   out_free:
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -1737,4 +1737,10 @@ drv_can_neg_ttlm(struct ieee80211_local
+ 
+ 	return res;
+ }
++#ifdef CPTCFG_MAC80211_MESH
++void drv_config_mesh_offload_path(struct ieee80211_local *local,
++				  struct ieee80211_sub_if_data *sdata,
++				  enum ieee80211_mesh_path_offld_cmd cmd,
++				  struct ieee80211_mesh_path_offld *path);
++#endif /* CPTCFG_MAC80211_MESH */
+ #endif /* __MAC80211_DRIVER_OPS */
diff --git a/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch b/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
index 1dd927098b88e9..81b4e1b24744bb 100644
--- a/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
@@ -16,7 +16,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2738,6 +2738,8 @@ struct ieee80211_txq {
+@@ -2839,6 +2839,8 @@ struct ieee80211_txq {
   *
   *  @IEEE80211_HW_SUPPORTS_NSS_OFFLOAD: Hardware/driver supports NSS offload
   *
@@ -25,8 +25,8 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
   * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
   */
  enum ieee80211_hw_flags {
-@@ -2797,6 +2799,7 @@ enum ieee80211_hw_flags {
- 	IEEE80211_HW_MLO_MCAST_MULTI_LINK_TX,
+@@ -2900,6 +2902,7 @@ enum ieee80211_hw_flags {
+ 	IEEE80211_HW_HANDLES_QUIET_CSA,
  	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
  	IEEE80211_HW_SUPPORTS_MESH_NSS_OFFLOAD,
 +	IEEE80211_HW_SUPPORTS_TID_CLASS_OFFLOAD,
@@ -35,8 +35,8 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	NUM_IEEE80211_HW_FLAGS
 --- a/net/mac80211/debugfs.c
 +++ b/net/mac80211/debugfs.c
-@@ -507,6 +507,7 @@ static const char *hw_flag_names[] = {
- 	FLAG(MLO_MCAST_MULTI_LINK_TX),
+@@ -510,6 +510,7 @@ static const char *hw_flag_names[] = {
+ 	FLAG(HANDLES_QUIET_CSA),
  	FLAG(SUPPORTS_NSS_OFFLOAD),
  	FLAG(SUPPORTS_MESH_NSS_OFFLOAD),
 +	FLAG(SUPPORTS_TID_CLASS_OFFLOAD),
diff --git a/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch b/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch
index 49145299b20628..1cc506b1677eb0 100644
--- a/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch
@@ -14,7 +14,7 @@ Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4770,6 +4770,67 @@ out_free:
+@@ -4800,6 +4800,67 @@ out_free:
  	kfree_skb(skb);
  }
  
@@ -43,7 +43,7 @@ Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
 +
 +	if (unlikely(skb->sk &&
 +		     skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS))
-+		info->ack_frame_id = ieee80211_store_ack_skb(local, skb,
++		info->status_data = ieee80211_store_ack_skb(local, skb,
 +							     &info->flags, NULL);
 +
 +	info->flags |= IEEE80211_TX_CTL_HW_80211_ENCAP;
@@ -82,7 +82,7 @@ Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
  netdev_tx_t ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
  					    struct net_device *dev)
  {
-@@ -4809,6 +4870,11 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4839,6 +4900,11 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  	if (key && (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)))
  		goto skip_offload;
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/336-mac80211-Mesh-Fast-rx-support.patch b/package/kernel/mac80211/patches/nss/subsys/336-mac80211-Mesh-Fast-rx-support.patch
index abdf3c9bd2195e..91de098697d937 100644
--- a/package/kernel/mac80211/patches/nss/subsys/336-mac80211-Mesh-Fast-rx-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/336-mac80211-Mesh-Fast-rx-support.patch
@@ -20,7 +20,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -1750,6 +1750,8 @@ static void sta_apply_mesh_params(struct
+@@ -1759,6 +1759,8 @@ static void sta_apply_mesh_params(struct
  			/* init at low value */
  			ewma_mesh_tx_rate_avg_add(&sta->mesh->tx_rate_avg, 10);
  
@@ -29,7 +29,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  			break;
  		case NL80211_PLINK_LISTEN:
  		case NL80211_PLINK_BLOCKED:
-@@ -1764,6 +1766,7 @@ static void sta_apply_mesh_params(struct
+@@ -1773,6 +1775,7 @@ static void sta_apply_mesh_params(struct
  			ieee80211_mps_sta_status_update(sta);
  			changed |= ieee80211_mps_set_sta_local_pm(sta,
  					NL80211_MESH_POWER_UNKNOWN);
@@ -39,7 +39,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  			/*  nothing  */
 --- a/net/mac80211/mesh_plink.c
 +++ b/net/mac80211/mesh_plink.c
-@@ -381,6 +381,8 @@ static u64 __mesh_plink_deactivate(struc
+@@ -389,6 +389,8 @@ static u64 __mesh_plink_deactivate(struc
  	changed |= ieee80211_mps_set_sta_local_pm(sta,
  			NL80211_MESH_POWER_UNKNOWN);
  
@@ -48,7 +48,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  	return changed;
  }
  
-@@ -846,6 +848,7 @@ static u64 mesh_plink_establish(struct i
+@@ -856,6 +858,7 @@ static u64 mesh_plink_establish(struct i
  	mpl_dbg(sdata, "Mesh plink with %pM ESTABLISHED\n", sta->sta.addr);
  	ieee80211_mps_sta_status_update(sta);
  	changed |= ieee80211_mps_set_sta_local_pm(sta, mshcfg->power_mode);
@@ -56,7 +56,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  	return changed;
  }
  
-@@ -864,7 +867,7 @@ static u64 mesh_plink_fsm(struct ieee802
+@@ -874,7 +877,7 @@ static u64 mesh_plink_fsm(struct ieee802
  	struct mesh_config *mshcfg = &sdata->u.mesh.mshcfg;
  	enum ieee80211_self_protected_actioncode action = 0;
  	u64 changed = 0;
@@ -65,7 +65,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  
  	mpl_dbg(sdata, "peer %pM in state %s got event %s\n", sta->sta.addr,
  		mplstates[sta->mesh->plink_state], mplevents[event]);
-@@ -924,6 +927,7 @@ static u64 mesh_plink_fsm(struct ieee802
+@@ -934,6 +937,7 @@ static u64 mesh_plink_fsm(struct ieee802
  			break;
  		case CNF_ACPT:
  			changed |= mesh_plink_establish(sdata, sta);
@@ -73,7 +73,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  			break;
  		default:
  			break;
-@@ -939,6 +943,7 @@ static u64 mesh_plink_fsm(struct ieee802
+@@ -949,6 +953,7 @@ static u64 mesh_plink_fsm(struct ieee802
  			break;
  		case OPN_ACPT:
  			changed |= mesh_plink_establish(sdata, sta);
@@ -81,7 +81,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  			action = WLAN_SP_MESH_PEERING_CONFIRM;
  			break;
  		default:
-@@ -985,6 +990,10 @@ static u64 mesh_plink_fsm(struct ieee802
+@@ -995,6 +1000,10 @@ static u64 mesh_plink_fsm(struct ieee802
  		break;
  	}
  	spin_unlock_bh(&sta->mesh->plink_lock);
@@ -94,7 +94,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  	if (action) {
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -4653,10 +4653,15 @@ void ieee80211_check_fast_rx(struct sta_
+@@ -4711,10 +4711,15 @@ void ieee80211_check_fast_rx(struct sta_
  
  		break;
  	case NL80211_IFTYPE_MESH_POINT:
@@ -112,7 +112,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  		break;
  	default:
  		goto clear;
-@@ -4697,7 +4702,7 @@ void ieee80211_check_fast_rx(struct sta_
+@@ -4755,7 +4760,7 @@ void ieee80211_check_fast_rx(struct sta_
  	__release(check_fast_rx);
  
  	if (assign)
@@ -121,7 +121,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  
  	offload_flags = get_bss_sdata(sdata)->vif.offload_flags;
  	offload = offload_flags & IEEE80211_OFFLOAD_DECAP_ENABLED;
-@@ -4879,6 +4884,10 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4937,6 +4942,10 @@ static bool ieee80211_invoke_fast_rx(str
  		u8 sa[ETH_ALEN];
  	} addrs __aligned(2);
  	struct ieee80211_sta_rx_stats *stats;
@@ -132,7 +132,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  
  	/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
  	 * to a common data structure; drivers can implement that per queue
-@@ -4928,6 +4937,37 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4986,6 +4995,37 @@ static bool ieee80211_invoke_fast_rx(str
  		snap_offs += IEEE80211_CCMP_HDR_LEN;
  	}
  
@@ -170,7 +170,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  	if (!ieee80211_vif_is_mesh(&rx->sdata->vif) &&
  	    !(status->rx_flags & IEEE80211_RX_AMSDU)) {
  		if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
-@@ -4965,9 +5005,33 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -5023,9 +5063,33 @@ static bool ieee80211_invoke_fast_rx(str
  		return true;
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch b/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch
index bbc9a32cf0a720..0f3ffe14a00c8a 100644
--- a/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch
@@ -33,7 +33,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4704,7 +4704,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4731,7 +4731,7 @@ static void ieee80211_8023_xmit(struct i
  
  	ieee80211_aggr_check(sdata, sta, skb);
  
@@ -42,8 +42,8 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  		tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
  		tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
  		if (tid_tx) {
-@@ -4755,7 +4755,7 @@ static void ieee80211_8023_xmit(struct i
- 							     &info->flags, NULL);
+@@ -4785,7 +4785,7 @@ static void ieee80211_8023_xmit(struct i
+ 	}
  
  	dev_sw_netstats_tx_add(dev, skbs, len);
 -	if (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD)) {
diff --git a/package/kernel/mac80211/patches/nss/subsys/345-mac80211-fix-mixed-declaration.patch b/package/kernel/mac80211/patches/nss/subsys/345-mac80211-fix-mixed-declaration.patch
deleted file mode 100644
index 808f69e644ed61..00000000000000
--- a/package/kernel/mac80211/patches/nss/subsys/345-mac80211-fix-mixed-declaration.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From b3215eee07d071137e6977d60eee3cf685241fbb Mon Sep 17 00:00:00 2001
-From: Hari Chandrakanthan <quic_haric@quicinc.com>
-Date: Thu, 3 Feb 2022 13:55:53 +0530
-Subject: [PATCH] mac80211 : fix mixed declaration
-
-Fix mixed declaration in the api ieee80211_parse_ch_switch_ie
-
-Signed-off-by: Hari Chandrakanthan <quic_haric@quicinc.com>
----
- net/mac80211/spectmgmt.c | 22 +++++++++-------------
- 1 file changed, 9 insertions(+), 13 deletions(-)
-
---- a/net/mac80211/spectmgmt.c
-+++ b/net/mac80211/spectmgmt.c
-@@ -33,7 +33,10 @@ int ieee80211_parse_ch_switch_ie(struct
- 	struct cfg80211_chan_def new_vht_chandef = {};
- 	const struct ieee80211_sec_chan_offs_ie *sec_chan_offs;
- 	const struct ieee80211_wide_bw_chansw_ie *wide_bw_chansw_ie;
-+	struct ieee80211_vht_operation vht_oper;
-+	struct ieee80211_ht_operation ht_oper;
- 	int secondary_channel_offset = -1;
-+	u8 new_seg1;
- 
- 	memset(csa_ie, 0, sizeof(*csa_ie));
- 
-@@ -133,20 +136,13 @@ int ieee80211_parse_ch_switch_ie(struct
- 	}
- 
- 	if (wide_bw_chansw_ie) {
--		u8 new_seg1 = wide_bw_chansw_ie->new_center_freq_seg1;
--		struct ieee80211_vht_operation vht_oper = {
--			.chan_width =
--				wide_bw_chansw_ie->new_channel_width,
--			.center_freq_seg0_idx =
--				wide_bw_chansw_ie->new_center_freq_seg0,
--			.center_freq_seg1_idx = new_seg1,
-+		new_seg1 = wide_bw_chansw_ie->new_center_freq_seg1;
-+		vht_oper.chan_width = wide_bw_chansw_ie->new_channel_width;
-+		vht_oper.center_freq_seg0_idx = wide_bw_chansw_ie->new_center_freq_seg0;
-+		vht_oper.center_freq_seg1_idx = new_seg1;
- 			/* .basic_mcs_set doesn't matter */
--		};
--		struct ieee80211_ht_operation ht_oper = {
--			.operation_mode =
--				cpu_to_le16(new_seg1 <<
--					    IEEE80211_HT_OP_MODE_CCFS2_SHIFT),
--		};
-+		ht_oper.operation_mode = cpu_to_le16(new_seg1 <<
-+						     IEEE80211_HT_OP_MODE_CCFS2_SHIFT);
- 
- 		/* default, for the case of IEEE80211_VHT_CHANWIDTH_USE_HT,
- 		 * to the previously parsed chandef
diff --git a/package/kernel/mac80211/patches/nss/subsys/346-mac80211-fix-bw-change-to-40Mhz-during-channel-switc.patch b/package/kernel/mac80211/patches/nss/subsys/346-mac80211-fix-bw-change-to-40Mhz-during-channel-switc.patch
deleted file mode 100644
index df2b3a9257b115..00000000000000
--- a/package/kernel/mac80211/patches/nss/subsys/346-mac80211-fix-bw-change-to-40Mhz-during-channel-switc.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From 9c7571646a01eedb85350dfce12b499a0267ab2b Mon Sep 17 00:00:00 2001
-From: Hari Chandrakanthan <quic_haric@quicinc.com>
-Date: Thu, 3 Feb 2022 14:01:57 +0530
-Subject: [PATCH] mac80211 : fix bw change to 40Mhz during channel switch
-
-When AP reduces its channel bandwidth to 40Mhz, the associated
-sta reduces the channel bandwidth to 20Mhz.
-
-From spec 802.11 ac, section 8.4.2.165 :
-The Wide Bandwidth Channel Switch subelement is present under the following conditions:
-1.Channel switching to a BSS operating channel width of 40 MHz or wider
-2.Extended channel switching to a BSS operating channel width of 80 MHz or wider
-
-So when wide bandwidth channel switch subelement is present,
-the default bandwidth is chosen as 40Mhz.
-
-Signed-off-by: Hari Chandrakanthan <quic_haric@quicinc.com>
----
- net/mac80211/spectmgmt.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
---- a/net/mac80211/spectmgmt.c
-+++ b/net/mac80211/spectmgmt.c
-@@ -136,6 +136,10 @@ int ieee80211_parse_ch_switch_ie(struct
- 	}
- 
- 	if (wide_bw_chansw_ie) {
-+		csa_ie->chandef.width = NL80211_CHAN_WIDTH_40;
-+		csa_ie->chandef.center_freq1 =
-+			ieee80211_channel_to_frequency(wide_bw_chansw_ie->new_center_freq_seg0,
-+						       new_chan->band);
- 		new_seg1 = wide_bw_chansw_ie->new_center_freq_seg1;
- 		vht_oper.chan_width = wide_bw_chansw_ie->new_channel_width;
- 		vht_oper.center_freq_seg0_idx = wide_bw_chansw_ie->new_center_freq_seg0;
diff --git a/package/kernel/mac80211/patches/nss/subsys/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch b/package/kernel/mac80211/patches/nss/subsys/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch
index ba80b62d0ac732..6c6bca1b16f27a 100644
--- a/package/kernel/mac80211/patches/nss/subsys/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch
@@ -21,7 +21,7 @@ Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
 
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -998,7 +998,8 @@ static bool ieee80211_set_sdata_offload_
+@@ -1011,7 +1011,8 @@ static bool ieee80211_set_sdata_offload_
  		flags |= IEEE80211_OFFLOAD_DECAP_ENABLED;
  
  		if (local->monitors &&
diff --git a/package/kernel/mac80211/patches/nss/subsys/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch b/package/kernel/mac80211/patches/nss/subsys/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
index 5683bdec18da5c..0cfa65742f9f06 100644
--- a/package/kernel/mac80211/patches/nss/subsys/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
@@ -14,7 +14,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1410,8 +1410,6 @@ ieee80211_tx_info_clear_status(struct ie
+@@ -1442,8 +1442,6 @@ ieee80211_tx_info_clear_status(struct ie
   * @RX_FLAG_AMPDU_IS_LAST: this subframe is the last subframe of the A-MPDU
   * @RX_FLAG_AMPDU_DELIM_CRC_ERROR: A delimiter CRC error has been detected
   *	on this subframe
@@ -23,7 +23,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
   * @RX_FLAG_MIC_STRIPPED: The mic was stripped of this packet. Decryption was
   *	done by the hardware
   * @RX_FLAG_ONLY_MONITOR: Report frame only to monitor interfaces without
-@@ -1468,39 +1466,38 @@ ieee80211_tx_info_clear_status(struct ie
+@@ -1500,39 +1498,38 @@ ieee80211_tx_info_clear_status(struct ie
   *	hardware or driver)
   */
  enum mac80211_rx_flags {
@@ -34,14 +34,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
 -	RX_FLAG_IV_STRIPPED		= BIT(4),
 -	RX_FLAG_FAILED_FCS_CRC		= BIT(5),
 -	RX_FLAG_FAILED_PLCP_CRC 	= BIT(6),
-+	RX_FLAG_MMIC_ERROR              = BIT(0),
-+	RX_FLAG_DECRYPTED               = BIT(1),
-+	RX_FLAG_ONLY_MONITOR            = BIT(2),
-+	RX_FLAG_MMIC_STRIPPED           = BIT(3),
-+	RX_FLAG_IV_STRIPPED             = BIT(4),
-+	RX_FLAG_FAILED_FCS_CRC          = BIT(5),
-+	RX_FLAG_FAILED_PLCP_CRC         = BIT(6),
- 	/* one free bit at 7 */
+-	RX_FLAG_MACTIME_IS_RTAP_TS64	= BIT(7),
 -	RX_FLAG_NO_SIGNAL_VAL		= BIT(8),
 -	RX_FLAG_AMPDU_DETAILS		= BIT(9),
 -	RX_FLAG_PN_VALIDATED		= BIT(10),
@@ -67,36 +60,44 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
 -	RX_FLAG_RADIOTAP_LSIG		= BIT(28),
 -	RX_FLAG_NO_PSDU			= BIT(29),
 -	RX_FLAG_8023			= BIT(30),
-+	RX_FLAG_NO_SIGNAL_VAL           = BIT(8),
-+	RX_FLAG_AMPDU_DETAILS           = BIT(9),
-+	RX_FLAG_PN_VALIDATED            = BIT(10),
-+	RX_FLAG_DUP_VALIDATED           = BIT(11),
-+	RX_FLAG_AMPDU_LAST_KNOWN        = BIT(12),
-+	RX_FLAG_AMPDU_IS_LAST           = BIT(13),
-+	RX_FLAG_AMPDU_DELIM_CRC_ERROR   = BIT(14),
-+	RX_FLAG_MACTIME                 = BIT(15) | BIT(16),
-+	RX_FLAG_MACTIME_PLCP_START      = 1 << 15,
-+	RX_FLAG_MACTIME_START           = 2 << 15,
-+	RX_FLAG_MACTIME_END             = 3 << 15,
-+	RX_FLAG_SKIP_MONITOR            = BIT(17),
-+	RX_FLAG_AMSDU_MORE              = BIT(18),
-+	RX_FLAG_RADIOTAP_TLV_AT_END     = BIT(19),
-+	RX_FLAG_MIC_STRIPPED            = BIT(20),
-+	RX_FLAG_ALLOW_SAME_PN           = BIT(21),
-+	RX_FLAG_ICV_STRIPPED            = BIT(22),
-+	RX_FLAG_AMPDU_EOF_BIT           = BIT(23),
-+	RX_FLAG_AMPDU_EOF_BIT_KNOWN     = BIT(24),
-+	RX_FLAG_RADIOTAP_HE             = BIT(25),
-+	RX_FLAG_RADIOTAP_HE_MU          = BIT(26),
-+	RX_FLAG_RADIOTAP_LSIG           = BIT(27),
-+	RX_FLAG_NO_PSDU                 = BIT(28),
-+	RX_FLAG_8023                    = BIT(29),
++	RX_FLAG_MMIC_ERROR            = BIT(0),
++	RX_FLAG_DECRYPTED             = BIT(1),
++	RX_FLAG_ONLY_MONITOR          = BIT(2),
++	RX_FLAG_MMIC_STRIPPED         = BIT(3),
++	RX_FLAG_IV_STRIPPED           = BIT(4),
++	RX_FLAG_FAILED_FCS_CRC        = BIT(5),
++	RX_FLAG_FAILED_PLCP_CRC       = BIT(6),
++	RX_FLAG_MACTIME_IS_RTAP_TS64  = BIT(7),
++	RX_FLAG_NO_SIGNAL_VAL         = BIT(8),
++	RX_FLAG_AMPDU_DETAILS         = BIT(9),
++	RX_FLAG_PN_VALIDATED          = BIT(10),
++	RX_FLAG_DUP_VALIDATED         = BIT(11),
++	RX_FLAG_AMPDU_LAST_KNOWN      = BIT(12),
++	RX_FLAG_AMPDU_IS_LAST         = BIT(13),
++	RX_FLAG_AMPDU_DELIM_CRC_ERROR = BIT(14),
++	RX_FLAG_MACTIME               = BIT(15) | BIT(16),
++	RX_FLAG_MACTIME_PLCP_START    = 1 << 15,
++	RX_FLAG_MACTIME_START         = 2 << 15,
++	RX_FLAG_MACTIME_END           = 3 << 15,
++	RX_FLAG_SKIP_MONITOR          = BIT(17),
++	RX_FLAG_AMSDU_MORE            = BIT(18),
++	RX_FLAG_RADIOTAP_TLV_AT_END   = BIT(19),
++	RX_FLAG_MIC_STRIPPED          = BIT(20),
++	RX_FLAG_ALLOW_SAME_PN         = BIT(21),
++	RX_FLAG_ICV_STRIPPED          = BIT(22),
++	RX_FLAG_AMPDU_EOF_BIT         = BIT(23),
++	RX_FLAG_AMPDU_EOF_BIT_KNOWN   = BIT(24),
++	RX_FLAG_RADIOTAP_HE           = BIT(25),
++	RX_FLAG_RADIOTAP_HE_MU        = BIT(26),
++	RX_FLAG_RADIOTAP_LSIG         = BIT(27),
++	RX_FLAG_NO_PSDU               = BIT(28),
++	RX_FLAG_8023                  = BIT(29),
  };
  
  /**
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -507,18 +507,13 @@ ieee80211_add_rx_radiotap_header(struct
+@@ -508,18 +508,13 @@ ieee80211_add_rx_radiotap_header(struct
  			flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
  		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
  			flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
diff --git a/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch b/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
index e36b1b89c9bfa4..05f75c2172d665 100644
--- a/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
@@ -44,7 +44,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  /* misc utils */
  
  static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
-@@ -4328,7 +4329,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4353,7 +4354,7 @@ void __ieee80211_subif_start_xmit(struct
  		    !is_multicast_ether_addr(skb->data)) {
  			if (sta)
  				key = rcu_dereference(sta->ptk[sta->ptk_idx]);
@@ -53,7 +53,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  			rcu_read_unlock();
  			return;
  		}
-@@ -4374,7 +4375,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4399,7 +4400,7 @@ void __ieee80211_subif_start_xmit(struct
  		if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) {
  		    	if (sta)
  				key = rcu_dereference(sta->ptk[sta->ptk_idx]);
@@ -62,7 +62,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  		} else {
  			dev_sw_netstats_tx_add(dev, 1, skb->len);
  			ieee80211_xmit(sdata, sta, skb);
-@@ -4672,7 +4673,8 @@ static bool ieee80211_tx_8023(struct iee
+@@ -4699,7 +4700,8 @@ static bool ieee80211_tx_8023(struct iee
  
  static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
  				struct net_device *dev, struct sta_info *sta,
@@ -72,7 +72,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  {
  	struct ieee80211_tx_info *info;
  	struct ethhdr *ehdr = (struct ethhdr *)skb->data;
-@@ -4728,6 +4730,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4755,6 +4757,7 @@ static void ieee80211_8023_xmit(struct i
  	info = IEEE80211_SKB_CB(skb);
  	memset(info, 0, sizeof(*info));
  
@@ -80,23 +80,23 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  	info->hw_queue = sdata->vif.hw_queue[queue];
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
-@@ -4748,11 +4751,12 @@ static void ieee80211_8023_xmit(struct i
+@@ -4775,11 +4778,12 @@ static void ieee80211_8023_xmit(struct i
  			memcpy(IEEE80211_SKB_CB(seg), info, sizeof(*info));
  	}
  
 -	if (unlikely(skb->sk &&
 -		     skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS &&
 +	if (unlikely(((skb->sk &&
-+		       skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS) ||
++		     skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS) ||
 +		      ((ctrl_flags & IEEE80211_TX_CTL_REQ_TX_STATUS) && !multicast)) &&
- 		     !ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD)))
- 		info->ack_frame_id = ieee80211_store_ack_skb(local, skb,
--							     &info->flags, NULL);
-+							     &info->flags, cookie);
- 
- 	dev_sw_netstats_tx_add(dev, skbs, len);
- 	if (!ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD) && sta) {
-@@ -4772,7 +4776,8 @@ out_free:
+ 		     !ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD))) {
+ 		info->status_data = ieee80211_store_ack_skb(local, skb,
+-							    &info->flags, NULL);
++							    &info->flags, cookie);
+ 		if (info->status_data)
+ 			info->status_data_idr = 1;
+ 	}
+@@ -4802,7 +4806,8 @@ out_free:
  
  void ieee80211_8023_xmit_ap(struct ieee80211_sub_if_data *sdata,
  			    struct net_device *dev, struct sta_info *sta,
@@ -106,7 +106,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  {
  	struct ieee80211_tx_info *info;
  	struct ieee80211_local *local = sdata->local;
-@@ -4781,6 +4786,9 @@ void ieee80211_8023_xmit_ap(struct ieee8
+@@ -4811,6 +4816,9 @@ void ieee80211_8023_xmit_ap(struct ieee8
  	unsigned long flags;
  	int q;
  	u16 q_map;
@@ -116,7 +116,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  	/*
  	 * If the skb is shared we need to obtain our own copy.
-@@ -4792,11 +4800,13 @@ void ieee80211_8023_xmit_ap(struct ieee8
+@@ -4822,11 +4830,13 @@ void ieee80211_8023_xmit_ap(struct ieee8
  
  	info = IEEE80211_SKB_CB(skb);
  	memset(info, 0, sizeof(*info));
@@ -127,13 +127,13 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
 +	if (unlikely((skb->sk &&
 +		     skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS) ||
 +		     ((ctrl_flags & IEEE80211_TX_CTL_REQ_TX_STATUS) && !multicast)))
- 		info->ack_frame_id = ieee80211_store_ack_skb(local, skb,
+ 		info->status_data = ieee80211_store_ack_skb(local, skb,
 -							     &info->flags, NULL);
 +							     &info->flags, cookie);
  
  	info->flags |= IEEE80211_TX_CTL_HW_80211_ENCAP;
  	info->control.vif = &sdata->vif;
-@@ -4830,14 +4840,23 @@ void ieee80211_8023_xmit_ap(struct ieee8
+@@ -4860,14 +4870,23 @@ void ieee80211_8023_xmit_ap(struct ieee8
  	drv_tx(local, &control, skb);
  
  }
@@ -158,7 +158,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  #ifdef CPTCFG_MAC80211_NSS_SUPPORT
  	ieee80211_xmit_nss_fixup(skb, dev);
-@@ -4853,14 +4872,15 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4883,14 +4902,15 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		kfree_skb(skb);
  		goto out;
  	}
@@ -176,7 +176,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  		goto skip_offload;
  
  	key = rcu_dereference(sta->ptk[sta->ptk_idx]);
-@@ -4871,13 +4891,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4901,13 +4921,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		goto skip_offload;
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP) {
@@ -192,9 +192,9 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  	goto out;
  
  skip_offload:
-@@ -6383,7 +6403,10 @@ start_xmit:
- 	mutex_lock(&local->mtx);
+@@ -6429,7 +6449,10 @@ int ieee80211_tx_control_port(struct wip
  
+ start_xmit:
  	local_bh_disable();
 -	__ieee80211_subif_start_xmit(skb, skb->dev, flags, ctrl_flags, cookie);
 +	if (sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED)
@@ -203,4 +203,4 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
 +		__ieee80211_subif_start_xmit(skb, skb->dev, flags, ctrl_flags, cookie);
  	local_bh_enable();
  
- 	mutex_unlock(&local->mtx);
+ 	return 0;
diff --git a/package/kernel/mac80211/patches/nss/subsys/686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch b/package/kernel/mac80211/patches/nss/subsys/686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch
index 62916f15eddb56..3d15c53397f43a 100644
--- a/package/kernel/mac80211/patches/nss/subsys/686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch
@@ -72,7 +72,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2349,7 +2349,7 @@ static void mpath_set_pinfo(struct mesh_
+@@ -2346,7 +2346,7 @@ static void mpath_set_pinfo(struct mesh_
  	if (mpath->flags & MESH_PATH_RESOLVED)
  		pinfo->flags |= NL80211_MPATH_FLAG_RESOLVED;
  	pinfo->hop_count = mpath->hop_count;
@@ -83,7 +83,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
  static int ieee80211_get_mpath(struct wiphy *wiphy, struct net_device *dev,
 --- a/net/mac80211/mesh.h
 +++ b/net/mac80211/mesh.h
-@@ -126,7 +126,7 @@ struct mesh_path {
+@@ -127,7 +127,7 @@ struct mesh_path {
  	unsigned long fast_tx_check;
  	bool is_root;
  	bool is_gate;
@@ -94,7 +94,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
  #define MESH_FAST_TX_CACHE_MAX_SIZE		512
 --- a/net/mac80211/mesh_hwmp.c
 +++ b/net/mac80211/mesh_hwmp.c
-@@ -504,7 +504,7 @@ static u32 hwmp_route_info_get(struct ie
+@@ -506,7 +506,7 @@ static u32 hwmp_route_info_get(struct ie
  			if (next_hop)
  				ether_addr_copy(old_next_hop_addr, next_hop->sta.addr);
  			if (next_hop != sta) {
@@ -103,7 +103,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
  				flush_mpath = true;
  			}
  			mesh_path_assign_nexthop(mpath, sta);
-@@ -565,7 +565,7 @@ static u32 hwmp_route_info_get(struct ie
+@@ -567,7 +567,7 @@ static u32 hwmp_route_info_get(struct ie
  			if (next_hop)
  				ether_addr_copy(old_next_hop_addr, next_hop->sta.addr);
  			if (next_hop != sta) {
diff --git a/package/kernel/mac80211/patches/nss/subsys/751-mac80211-Get-valid-last_rate-for-rx_bitrate-from-cpu.patch b/package/kernel/mac80211/patches/nss/subsys/751-mac80211-Get-valid-last_rate-for-rx_bitrate-from-cpu.patch
index ea83021014ad26..6a836fa46a42ff 100644
--- a/package/kernel/mac80211/patches/nss/subsys/751-mac80211-Get-valid-last_rate-for-rx_bitrate-from-cpu.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/751-mac80211-Get-valid-last_rate-for-rx_bitrate-from-cpu.patch
@@ -16,7 +16,7 @@ Signed-off-by: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
 
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -2385,7 +2385,7 @@ void ieee80211_sta_update_pending_airtim
+@@ -2411,7 +2411,7 @@ void ieee80211_sta_update_pending_airtim
  }
  
  static struct ieee80211_sta_rx_stats *
@@ -25,7 +25,7 @@ Signed-off-by: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
  {
  	struct ieee80211_sta_rx_stats *stats = &sta->deflink.rx_stats;
  	int cpu;
-@@ -2398,8 +2398,13 @@ sta_get_last_rx_stats(struct sta_info *s
+@@ -2424,8 +2424,13 @@ sta_get_last_rx_stats(struct sta_info *s
  
  	for_each_possible_cpu(cpu) {
  		struct ieee80211_sta_rx_stats *cpustats;
@@ -39,7 +39,7 @@ Signed-off-by: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
  
  		if (time_after(cpustats->last_rx, stats->last_rx))
  			stats = cpustats;
-@@ -2476,7 +2481,7 @@ static void sta_stats_decode_rate(struct
+@@ -2502,7 +2507,7 @@ static void sta_stats_decode_rate(struct
  
  static int sta_set_rate_info_rx(struct sta_info *sta, struct rate_info *rinfo)
  {
@@ -48,7 +48,7 @@ Signed-off-by: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
  
  	if (rate == STA_STATS_RATE_INVALID)
  		return -EINVAL;
-@@ -2576,7 +2581,7 @@ void sta_set_sinfo(struct sta_info *sta,
+@@ -2602,7 +2607,7 @@ void sta_set_sinfo(struct sta_info *sta,
  	int i, ac, cpu;
  	struct ieee80211_sta_rx_stats *last_rxstats;
  
@@ -57,7 +57,7 @@ Signed-off-by: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
  
  	sinfo->generation = sdata->local->sta_generation;
  
-@@ -2859,7 +2864,7 @@ u32 sta_get_expected_throughput(struct s
+@@ -2886,7 +2891,7 @@ u32 sta_get_expected_throughput(struct s
  
  unsigned long ieee80211_sta_last_active(struct sta_info *sta)
  {
diff --git a/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch b/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
index 4dff812589e263..702e8d57c0f72e 100644
--- a/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
@@ -31,7 +31,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
  				struct net_device *dev, struct sta_info *sta,
  				struct ieee80211_key *key, struct sk_buff *skb,
-@@ -3642,7 +3644,7 @@ ieee80211_sdata_netdev_features(struct i
+@@ -3668,7 +3670,7 @@ ieee80211_sdata_netdev_features(struct i
  }
  
  static struct sk_buff *
@@ -40,7 +40,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  {
  	if (skb_is_gso(skb)) {
  		struct sk_buff *segs;
-@@ -3660,7 +3662,7 @@ ieee80211_tx_skb_fixup(struct sk_buff *s
+@@ -3686,7 +3688,7 @@ ieee80211_tx_skb_fixup(struct sk_buff *s
  	if (skb_needs_linearize(skb, features) && __skb_linearize(skb))
  		goto free;
  
@@ -49,7 +49,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  		int ofs = skb_checksum_start_offset(skb);
  
  		if (skb->encapsulation)
-@@ -3806,7 +3808,7 @@ static bool ieee80211_xmit_fast(struct i
+@@ -3832,7 +3834,7 @@ static bool ieee80211_xmit_fast(struct i
  	memcpy(&eth, skb->data, ETH_HLEN - 2);
  
  	/* after this point (skb is modified) we cannot return false */
@@ -58,7 +58,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	if (!skb)
  		return true;
  
-@@ -4352,7 +4354,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4377,7 +4379,7 @@ void __ieee80211_subif_start_xmit(struct
  	 * things so we cannot really handle checksum or GSO offload.
  	 * fix it up in software before we handle anything else.
  	 */
@@ -67,7 +67,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	if (!skb) {
  		len = 0;
  		goto out;
-@@ -4723,7 +4725,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4750,7 +4752,7 @@ static void ieee80211_8023_xmit(struct i
  		}
  	}
  
@@ -78,7 +78,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -2269,6 +2269,10 @@ int ieee80211_if_add(struct ieee80211_lo
+@@ -2263,6 +2263,10 @@ int ieee80211_if_add(struct ieee80211_lo
  
  		ndev->features |= local->hw.netdev_features;
  		ndev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
@@ -100,7 +100,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  static int mesh_allocated;
  static struct kmem_cache *rm_cache;
  
-@@ -797,7 +799,7 @@ bool ieee80211_mesh_xmit_fast(struct iee
+@@ -779,7 +781,7 @@ bool ieee80211_mesh_xmit_fast(struct iee
  	if (skb->sk && skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS)
  		return false;
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch b/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
index fb422592a0de31..201e65cab69230 100644
--- a/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
@@ -23,7 +23,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2737,6 +2737,9 @@ struct ieee80211_txq {
+@@ -2838,6 +2838,9 @@ struct ieee80211_txq {
   *
   * @IEEE80211_HW_SUPPORTS_TID_CLASS_OFFLOAD: Hardware suports tid calssification offload.
   *
@@ -33,7 +33,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
   * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
   */
  enum ieee80211_hw_flags {
-@@ -2797,6 +2800,7 @@ enum ieee80211_hw_flags {
+@@ -2900,6 +2903,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
  	IEEE80211_HW_SUPPORTS_MESH_NSS_OFFLOAD,
  	IEEE80211_HW_SUPPORTS_TID_CLASS_OFFLOAD,
@@ -43,7 +43,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	NUM_IEEE80211_HW_FLAGS
 --- a/net/mac80211/debugfs.c
 +++ b/net/mac80211/debugfs.c
-@@ -508,6 +508,7 @@ static const char *hw_flag_names[] = {
+@@ -511,6 +511,7 @@ static const char *hw_flag_names[] = {
  	FLAG(SUPPORTS_NSS_OFFLOAD),
  	FLAG(SUPPORTS_MESH_NSS_OFFLOAD),
  	FLAG(SUPPORTS_TID_CLASS_OFFLOAD),
@@ -53,7 +53,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -1603,6 +1603,9 @@ int ieee80211_txq_setup_flows(struct iee
+@@ -1601,6 +1601,9 @@ int ieee80211_txq_setup_flows(struct iee
  	bool supp_vht = false;
  	enum nl80211_band band;
  
@@ -63,7 +63,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	ret = fq_init(fq, 4096);
  	if (ret)
  		return ret;
-@@ -1650,6 +1653,9 @@ void ieee80211_txq_teardown_flows(struct
+@@ -1648,6 +1651,9 @@ void ieee80211_txq_teardown_flows(struct
  {
  	struct fq *fq = &local->fq;
  
@@ -73,7 +73,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	kfree(local->cvars);
  	local->cvars = NULL;
  
-@@ -1666,7 +1672,8 @@ static bool ieee80211_queue_skb(struct i
+@@ -1664,7 +1670,8 @@ static bool ieee80211_queue_skb(struct i
  	struct ieee80211_vif *vif;
  	struct txq_info *txqi;
  
@@ -83,7 +83,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  		return false;
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-@@ -4337,7 +4344,8 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4362,7 +4369,8 @@ void __ieee80211_subif_start_xmit(struct
  		}
  	}
  
@@ -93,7 +93,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	ieee80211_aggr_check(sdata, sta, skb);
  
  	if (sta) {
-@@ -4689,8 +4697,10 @@ static void ieee80211_8023_xmit(struct i
+@@ -4716,8 +4724,10 @@ static void ieee80211_8023_xmit(struct i
  	bool multicast;
  	u8 tid;
  
@@ -106,7 +106,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  
  	multicast = is_multicast_ether_addr(ra);
  
-@@ -6387,9 +6397,12 @@ int ieee80211_tx_control_port(struct wip
+@@ -6436,9 +6446,12 @@ int ieee80211_tx_control_port(struct wip
  	}
  
  	if (!IS_ERR(sta)) {
@@ -123,7 +123,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  		 * for MLO STA, the SA should be the AP MLD address, but
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -4524,6 +4524,9 @@ static int ieee80211_get_txq_stats(struc
+@@ -4565,6 +4565,9 @@ static int ieee80211_get_txq_stats(struc
  	struct ieee80211_sub_if_data *sdata;
  	int ret = 0;
  
@@ -135,7 +135,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -839,7 +839,10 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+@@ -993,7 +993,10 @@ struct ieee80211_hw *ieee80211_alloc_hw_
  		atomic_set(&local->agg_queue_stop[i], 0);
  	}
  	tasklet_setup(&local->tx_pending_tasklet, ieee80211_tx_pending);
@@ -149,7 +149,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	skb_queue_head_init(&local->skb_queue);
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -1549,6 +1549,9 @@ static void sta_ps_start(struct sta_info
+@@ -1576,6 +1576,9 @@ static void sta_ps_start(struct sta_info
  
  	ieee80211_clear_fast_xmit(sta);
  
@@ -161,9 +161,9 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  		struct txq_info *txqi = to_txq_info(txq);
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -140,15 +140,17 @@ static void __cleanup_single_sta(struct
- 		atomic_dec(&ps->num_sta_ps);
- 	}
+@@ -118,15 +118,17 @@ void ieee80211_purge_sta_txqs(struct sta
+ 	struct ieee80211_local *local = sta->sdata->local;
+ 	int i;
  
 -	for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
 -		struct txq_info *txqi;
@@ -183,9 +183,9 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
 +			ieee80211_txq_purge(local, txqi);
 +		}
  	}
+ }
  
- 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
-@@ -430,7 +432,9 @@ void sta_info_free(struct ieee80211_loca
+@@ -436,7 +438,9 @@ void sta_info_free(struct ieee80211_loca
  
  	sta_dbg(sta->sdata, "Destroyed STA %pM\n", sta->sta.addr);
  
@@ -196,7 +196,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	kfree(rcu_dereference_raw(sta->sta.rates));
  #ifdef CPTCFG_MAC80211_MESH
  	kfree(sta->mesh);
-@@ -532,8 +536,6 @@ __sta_info_alloc(struct ieee80211_sub_if
+@@ -537,8 +541,6 @@ __sta_info_alloc(struct ieee80211_sub_if
  	struct ieee80211_local *local = sdata->local;
  	struct ieee80211_hw *hw = &local->hw;
  	struct sta_info *sta;
@@ -205,7 +205,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	int i;
  
  	sta = kzalloc(sizeof(*sta) + hw->sta_data_size, gfp);
-@@ -611,18 +613,22 @@ __sta_info_alloc(struct ieee80211_sub_if
+@@ -615,18 +617,22 @@ __sta_info_alloc(struct ieee80211_sub_if
  
  	sta->last_connected = ktime_get_seconds();
  
@@ -237,7 +237,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	}
  
  	if (sta_prepare_rate_control(local, sta, gfp))
-@@ -696,7 +702,8 @@ __sta_info_alloc(struct ieee80211_sub_if
+@@ -700,7 +706,8 @@ __sta_info_alloc(struct ieee80211_sub_if
  	return sta;
  
  free_txq:
@@ -247,7 +247,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  free:
  	sta_info_free_link(&sta->deflink);
  #ifdef CPTCFG_MAC80211_MESH
-@@ -1691,11 +1698,13 @@ void ieee80211_sta_ps_deliver_wakeup(str
+@@ -1719,11 +1726,13 @@ void ieee80211_sta_ps_deliver_wakeup(str
  	if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
  		drv_sta_notify(local, sdata, STA_NOTIFY_AWAKE, &sta->sta);
  
@@ -265,7 +265,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	}
  
  	skb_queue_head_init(&pending);
-@@ -2110,6 +2119,9 @@ ieee80211_sta_ps_deliver_response(struct
+@@ -2138,6 +2147,9 @@ ieee80211_sta_ps_deliver_response(struct
  		 * TIM recalculation.
  		 */
  
@@ -275,7 +275,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  		for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
  			if (!sta->sta.txq[tid] ||
  			    !(driver_release_tids & BIT(tid)) ||
-@@ -2546,7 +2558,7 @@ static void sta_set_tidstats(struct sta_
+@@ -2572,7 +2584,7 @@ static void sta_set_tidstats(struct sta_
  		tidstats->tx_msdu_failed = sta->deflink.status_stats.msdu_failed[tid];
  	}
  
@@ -284,7 +284,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  		spin_lock_bh(&local->fq.lock);
  		rcu_read_lock();
  
-@@ -2874,6 +2886,9 @@ unsigned long ieee80211_sta_last_active(
+@@ -2901,6 +2913,9 @@ unsigned long ieee80211_sta_last_active(
  
  static void sta_update_codel_params(struct sta_info *sta, u32 thr)
  {
@@ -316,7 +316,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  
 --- a/net/mac80211/mesh.c
 +++ b/net/mac80211/mesh.c
-@@ -832,7 +832,8 @@ bool ieee80211_mesh_xmit_fast(struct iee
+@@ -814,7 +814,8 @@ bool ieee80211_mesh_xmit_fast(struct iee
  	if (!skb)
  		return true;
  
@@ -328,7 +328,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	if ((meshhdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6) {
 --- a/net/mac80211/util.c
 +++ b/net/mac80211/util.c
-@@ -477,10 +477,8 @@ static void __ieee80211_wake_queue(struc
+@@ -470,10 +470,8 @@ static void __ieee80211_wake_queue(struc
  	 * release someone's lock, but it is fine because all the callers of
  	 * __ieee80211_wake_queue call it right before releasing the lock.
  	 */
diff --git a/package/kernel/mac80211/patches/nss/subsys/829-mac80211-fix-mesh-ping-issue.patch b/package/kernel/mac80211/patches/nss/subsys/829-mac80211-fix-mesh-ping-issue.patch
index 7532ef1e713125..2274c6f1a4a099 100644
--- a/package/kernel/mac80211/patches/nss/subsys/829-mac80211-fix-mesh-ping-issue.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/829-mac80211-fix-mesh-ping-issue.patch
@@ -10,7 +10,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
 
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -4651,16 +4651,14 @@ void ieee80211_check_fast_rx(struct sta_
+@@ -4709,16 +4709,14 @@ void ieee80211_check_fast_rx(struct sta_
  
  		break;
  	case NL80211_IFTYPE_MESH_POINT:
@@ -30,7 +30,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  	default:
  		goto clear;
  	}
-@@ -4882,10 +4880,7 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4940,10 +4938,7 @@ static bool ieee80211_invoke_fast_rx(str
  		u8 sa[ETH_ALEN];
  	} addrs __aligned(2);
  	struct ieee80211_sta_rx_stats *stats;
@@ -41,7 +41,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  	/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
  	 * to a common data structure; drivers can implement that per queue
-@@ -4935,37 +4930,6 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4993,37 +4988,6 @@ static bool ieee80211_invoke_fast_rx(str
  		snap_offs += IEEE80211_CCMP_HDR_LEN;
  	}
  
@@ -79,7 +79,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  	if (!ieee80211_vif_is_mesh(&rx->sdata->vif) &&
  	    !(status->rx_flags & IEEE80211_RX_AMSDU)) {
  		if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
-@@ -5003,30 +4967,6 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -5061,30 +5025,6 @@ static bool ieee80211_invoke_fast_rx(str
  		return true;
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/902-wifi-mac80211-Fix-memory-corruption-during-mesh-beac.patch b/package/kernel/mac80211/patches/nss/subsys/902-wifi-mac80211-Fix-memory-corruption-during-mesh-beac.patch
index 0f8289a892d4a4..2f03604b6c457f 100644
--- a/package/kernel/mac80211/patches/nss/subsys/902-wifi-mac80211-Fix-memory-corruption-during-mesh-beac.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/902-wifi-mac80211-Fix-memory-corruption-during-mesh-beac.patch
@@ -25,7 +25,7 @@ Signed-off-by: Manish Dharanenthiran <quic_mdharane@quicinc.com>
 
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -682,7 +682,7 @@ struct ieee80211_if_mesh {
+@@ -728,7 +728,7 @@ struct ieee80211_if_mesh {
  	struct timer_list mesh_path_root_timer;
  
  	unsigned long wrkq_flags;
@@ -36,7 +36,7 @@ Signed-off-by: Manish Dharanenthiran <quic_mdharane@quicinc.com>
  
 --- a/net/mac80211/mesh.c
 +++ b/net/mac80211/mesh.c
-@@ -1184,7 +1184,7 @@ void ieee80211_mbss_info_change_notify(s
+@@ -1168,7 +1168,7 @@ void ieee80211_mbss_info_change_notify(s
  
  	/* if we race with running work, worst case this work becomes a noop */
  	for_each_set_bit(bit, &bits, sizeof(changed) * BITS_PER_BYTE)
@@ -45,7 +45,7 @@ Signed-off-by: Manish Dharanenthiran <quic_mdharane@quicinc.com>
  	set_bit(MESH_WORK_MBSS_CHANGED, &ifmsh->wrkq_flags);
  	wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
  }
-@@ -1266,7 +1266,7 @@ void ieee80211_stop_mesh(struct ieee8021
+@@ -1250,7 +1250,7 @@ void ieee80211_stop_mesh(struct ieee8021
  
  	/* clear any mesh work (for next join) we may have accrued */
  	ifmsh->wrkq_flags = 0;
@@ -54,7 +54,7 @@ Signed-off-by: Manish Dharanenthiran <quic_mdharane@quicinc.com>
  
  	local->fif_other_bss--;
  	atomic_dec(&local->iff_allmultis);
-@@ -1733,9 +1733,9 @@ static void mesh_bss_info_changed(struct
+@@ -1719,9 +1719,9 @@ static void mesh_bss_info_changed(struct
  	u32 bit;
  	u64 changed = 0;
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/970-mac80211-ath10k-fix-airtime-underflow.patch b/package/kernel/mac80211/patches/nss/subsys/970-mac80211-ath10k-fix-airtime-underflow.patch
index d91b691291f6af..11f4f29ef7a2dc 100644
--- a/package/kernel/mac80211/patches/nss/subsys/970-mac80211-ath10k-fix-airtime-underflow.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/970-mac80211-ath10k-fix-airtime-underflow.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -2386,10 +2386,7 @@ void ieee80211_sta_update_pending_airtim
+@@ -2412,10 +2412,7 @@ void ieee80211_sta_update_pending_airtim
  	atomic_sub(tx_airtime, &local->aql_total_pending_airtime);
  	tx_pending = atomic_sub_return(tx_airtime,
  				       &local->aql_ac_pending_airtime[ac]);

From 6cf1cb7c266ba0d20e7f1c581a8089deb6c4a316 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 13 Jul 2024 16:50:59 -0400
Subject: [PATCH 148/225] ath11k_nss: optimize qca-nss-pbuf init script

New:
* Add UCI option to /etc/config/pbuf
  1. `stats_disable` - Allows disabling extended stats
     collection. (Default: '1')

  2. `scaling_governor` - Allow specifying CPU governor.
     (Default: disabled )

     Choices depend on what your system is compiled with. Can be found
     using:

     ```sh
     cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_available_governors
     ondemand performance schedutil
     ```

Changes:

* Rather than hardcode every device model's memory profile. Simply read the
  memory available from `/proc/meminfo`.
* Scaling governor is no longer forced as `performance`. It is now user
  configurable.
* Hash bitmap is now calculated from number of CPUs rather than hardcoded to `15`
* Limit `n2h_queue_limit_core` to `256`. This was set to `2048` which is
  too high when NSS wifi is also enabled.

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 package/kernel/mac80211/files/pbuf.uci        |   1 +
 .../kernel/mac80211/files/qca-nss-pbuf.init   | 158 ++++++++++--------
 2 files changed, 89 insertions(+), 70 deletions(-)

diff --git a/package/kernel/mac80211/files/pbuf.uci b/package/kernel/mac80211/files/pbuf.uci
index 7057843ecdb3ac..ffbbc8cafd4dfb 100644
--- a/package/kernel/mac80211/files/pbuf.uci
+++ b/package/kernel/mac80211/files/pbuf.uci
@@ -5,3 +5,4 @@ config general opt
   # option memory_profile '1gb'
   # option memory_profile '512mb'
   # option memory_profile '256mb'
+  option scaling_governor 'performance'
diff --git a/package/kernel/mac80211/files/qca-nss-pbuf.init b/package/kernel/mac80211/files/qca-nss-pbuf.init
index 5d88d1a67fe0b2..44176f74223c9c 100755
--- a/package/kernel/mac80211/files/qca-nss-pbuf.init
+++ b/package/kernel/mac80211/files/qca-nss-pbuf.init
@@ -1,5 +1,5 @@
 #!/bin/sh /etc/rc.common
-# shellcheck disable=3043
+# shellcheck disable=3043,3010
 # Copyright (c) 2021 The Linux Foundation. All rights reserved.
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -15,6 +15,12 @@
 #
 
 START=71
+NAME=qca-nss-pbuf
+
+get_num_cpus() {
+  local num_cpus=$(awk -F': ' '/^processor/ {count++} END {print count}' /proc/cpuinfo)
+  echo ${num_cpus:-1}
+}
 
 apply_sysctl() {
   [ "$(sysctl -n -e dev.nss.general.redirect)" -eq 0 ] && /etc/init.d/qca-nss-ecm start
@@ -22,134 +28,146 @@ apply_sysctl() {
   # Running this script multiple times is useless, as extra_pbuf_core0
   # can't be changed if it is allocated, assume it's already been run.
   if [ "$(sysctl -n -e dev.nss.n2hcfg.extra_pbuf_core0)" -eq 0 ]; then
-    logger -t ath11k_nss "$board - setting dev.nss.n2hcfg.extra_pbuf_core0=$extra_pbuf_core0"
+    logger -t $NAME "$board - setting dev.nss.n2hcfg.extra_pbuf_core0=$extra_pbuf_core0"
     sysctl -w dev.nss.n2hcfg.extra_pbuf_core0="$extra_pbuf_core0" > /dev/null 2>&1
   else
-    logger -t ath11k_nss "Sysctl key 'extra_pbuf_core0' already set to '""$extra_pbuf_core0""'. Skipping applying wifi nss configs"
+    logger -t $NAME "Sysctl key 'extra_pbuf_core0' already set to '""$extra_pbuf_core0""'. Skipping applying wifi nss configs"
   fi
 
   sysctl -w dev.nss.n2hcfg.n2h_high_water_core0="$n2h_high_water_core0" > /dev/null 2>&1
 
-  logger -t ath11k_nss "$board - setting dev.nss.n2hcfg.n2h_wifi_pool_buf=$n2h_wifi_pool_buf"
+  logger -t $NAME "$board - setting dev.nss.n2hcfg.n2h_wifi_pool_buf=$n2h_wifi_pool_buf"
   sysctl -w dev.nss.n2hcfg.n2h_wifi_pool_buf="$n2h_wifi_pool_buf" > /dev/null 2>&1
 
-  logger -t ath11k_nss "$board - setting dev.nss.n2hcfg.n2h_high_water_core0=$n2h_high_water_core0"
+  logger -t $NAME "$board - setting dev.nss.n2hcfg.n2h_high_water_core0=$n2h_high_water_core0"
   sysctl -w dev.nss.n2hcfg.n2h_high_water_core0="$n2h_high_water_core0" > /dev/null 2>&1
 
 }
 
 apply_nss_config() {
-  local auto_scale n2h_queue_limit_core0 n2h_queue_limit_core1
+  local auto_scale n2h_queue_limit_core0 n2h_queue_limit_core1 num_cpus
+  local hash_bitmap
 
   if [ ! -r /sys/module/ath11k/parameters/nss_offload ]; then
-    logger -t ath11k_nss "Module parameter '/sys/module/ath11k/parameters/nss_offload' does NOT exist. Skipping applying wifi nss configs"
+    logger -t $NAME "Module parameter '/sys/module/ath11k/parameters/nss_offload' does NOT exist. Skipping applying wifi nss configs"
     exit 1
   fi
 
   enable_nss_offload=$(cat /sys/module/ath11k/parameters/nss_offload)
 
   if [ "$enable_nss_offload" -ne "1" ]; then
-    logger -t ath11k_nss -s user.warn "Module parameter 'nss_offload=0'. Skipping applying wifi nss configs"
+    logger -t $NAME -s user.warn "Module parameter 'nss_offload=0'. Skipping applying wifi nss configs"
     exit 1
   fi
 
   [ ! -d "/proc/sys/dev/nss/rps" ] && {
-    logger -s -t ath11k_nss -p user.error "NSS driver not loaded or disabled! Exiting... "
+    logger -s -t $NAME -p user.error "NSS driver not loaded or disabled! Exiting... "
     exit 1
   }
 
-  config_load     pbuf
-  config_get_bool auto_scale            opt auto_scale            0
-  config_get      n2h_queue_limit_core0 opt n2h_queue_limit_core0 2048
-  config_get      n2h_queue_limit_core1 opt n2h_queue_limit_core1 2048
+  config_load pbuf
+  config_get_bool auto_scale opt auto_scale 0
+  config_get n2h_queue_limit_core0 opt n2h_queue_limit_core0 256
+  config_get n2h_queue_limit_core1 opt n2h_queue_limit_core1 256
 
   sysctl -w dev.nss.clock.auto_scale="$auto_scale" > /dev/null 2>&1
 
   sysctl -w dev.nss.n2hcfg.n2h_queue_limit_core0="$n2h_queue_limit_core0" > /dev/null 2>&1
   sysctl -w dev.nss.n2hcfg.n2h_queue_limit_core1="$n2h_queue_limit_core1" > /dev/null 2>&1
 
-  sysctl -w dev.nss.rps.hash_bitmap=15 > /dev/null 2>&1
+  local memory_profile memtotal board
+  board=$(board_name)
 
-  local memory_profile
   if memory_profile=$(uci_get pbuf.opt.memory_profile); then
     case "$memory_profile" in
-       1g*|512m*|256m*)
-          board=$memory_profile
-          logger -t ath11k_nss "Using custom memory profile - $board"
-          ;;
-        off*|false*|disable*|0)
-          logger -s -t ath11k_nss -p user.warn "NSS pbuf option 'memory_profile=off'. Not running. Enable if you have issues connecting more than 65 clients"
-          exit 0
-          ;;
-        auto)
-          board=$(board_name)
-          logger -t ath11k_nss "Setting n2hcfg values for board: $board"
-          ;;
-          *)
-            logger -s -t ath11k_nss -p user.error "Unknown profile $memory_profile. Choose auto, 1gb, 512mb, or 256mb"
-          exit 1
-          ;;
+      1024 | 1g* | 512 | 512m* | 256 | 256m*)
+        logger -t $NAME "Using custom memory profile - $board"
+        ;;
+      off* | false* | disable* | 0)
+        logger -s -t $NAME -p user.warn "NSS pbuf option 'memory_profile=off'. Not running. Enable if you have issues connecting more than 65 clients"
+        exit 0
+        ;;
+      auto)
+        memtotal=$(awk '/MemTotal/{print $2}' /proc/meminfo)
+        [ "$memtotal" -gt 512000 ] && memory_profile=1024
+        [ "$memtotal" -le 512000 ] && memory_profile=512
+        [ "$memtotal" -le 256000 ] && memory_profile=256
+        logger -t $NAME "Setting n2hcfg values for board: $board"
+        ;;
+      *)
+        logger -s -t $NAME -p user.error "Unknown profile $memory_profile. Choose auto, 1gb, 512mb, or 256mb"
+        exit 1
+        ;;
     esac
   else
     exit 0
   fi
 
-  case "$board" in
+  case "$memory_profile" in
     # 1GB+ profile
-    arcadyan,aw1000 | \
-    buffalo,wxr-5950ax12 | \
-    dynalink,dl-wrx36 | \
-    edgecore,eap102 | \
-    linksys,mx4200v2 | \
-    linksys,mx5300 | \
-    netgear,rax120v2 | \
-    netgear,wax620 | \
-    netgear,wax630 | \
-    prpl,haze | \
-    qnap,301w | \
-    xiaomi,ax9000 | \
-    yuncore,ax880 | \
-    zyxel,nbg7815 | \
-    1g*)
+    1024 | 1g*)
       extra_pbuf_core0=10000000 n2h_high_water_core0=72512 n2h_wifi_pool_buf=36864 apply_sysctl
       ;;
-    # 512MB profile
-    edimax,cax1800 | \
-    compex,wpq873 | \
-    linksys,mx4200v1 | \
-    redmi,ax6 | \
-    xiaomi,ax3600 | \
-    zte,mf269 | \
-    512m*)
-      extra_pbuf_core0=3100000  n2h_high_water_core0=30624 n2h_wifi_pool_buf=8192 apply_sysctl
+      # 512MB profile
+    512 | 512m*)
+      extra_pbuf_core0=3100000 n2h_high_water_core0=30624 n2h_wifi_pool_buf=8192 apply_sysctl
       ;;
-    # 256MB profile
-    netgear,wax218 | \
-    256m*)
-      extra_pbuf_core0=3100000  n2h_high_water_core0=30258 n2h_wifi_pool_buf=4096 apply_sysctl
+      # 256MB profile
+    256 | 256m*)
+      extra_pbuf_core0=3100000 n2h_high_water_core0=30258 n2h_wifi_pool_buf=4096 apply_sysctl
       ;;
   esac
 }
 
-boost_performance() {
+set_stats_disable() {
 
-  find /sys/kernel/debug/ath11k -name stats_disable| while read -r stats_disable; do
-    echo 1 > "$stats_disable"
-  done
+  local stats_disable
+  config_load pbuf
+  config_get stats_disable opt stats_disable 1
 
-  ubus call iwinfo devices | jsonfilter -e "@.devices[*]"| while read -r device; do
-    tc qdisc replace dev "${device}" root noqueue
+  find /sys/kernel/debug/ath11k -name stats_disable | while read -r stats_file; do
+    stats_msg_prefix="Disabling"
+    [ "$stats_disable" -eq 0 ] && stats_msg_prefix="Enabling"
+    logger -t $NAME -p user.notice "$stats_msg_prefix ath11k stats"
+    echo "$stats_disable" > "$stats_file"
   done
+}
 
-  for num in 0 1 2 3; do
-    echo "performance" > /sys/devices/system/cpu/cpu${num}/cpufreq/scaling_governor
-  done
+set_scaling_governor() {
+
+  local scaling_governor num_cpus
+  config_load pbuf
+  config_get scaling_governor opt scaling_governor
 
+  scaling_available_governors=/sys/devices/system/cpu/cpu0/cpufreq/scaling_available_governors
+
+  if [ -r "$scaling_available_governors" ]; then
+    scaling_available_governors=$(cat $scaling_available_governors)
+  else
+    return 0
+  fi
+
+  if [ -n "$scaling_available_governors" ] && [ -n "$scaling_governor" ]; then
+    if [[ "$scaling_available_governors" =~ $scaling_governor ]]; then
+      logger -t $NAME -p user.notice "Setting CPU scaling governor to '$scaling_governor'"
+      num_cpus=$(get_num_cpus)
+      for num in $(seq 0 $((num_cpus - 1))); do
+        echo "$scaling_governor" > "/sys/devices/system/cpu/cpu${num}/cpufreq/scaling_governor"
+      done
+    else
+      logger -t $NAME -p user.error "'$scaling_governor' not available in CPU governors [ $scaling_available_governors ]"
+    fi
+  fi
 }
 
 start() {
 
-  boost_performance
+  set_scaling_governor
+  set_stats_disable
   apply_nss_config
 
+  num_cpus=$(get_num_cpus)
+  hash_bitmap="$(((1 << num_cpus) - 1))"
+  sysctl -w dev.nss.rps.hash_bitmap=$hash_bitmap > /dev/null 2>&1
+
 }

From 8aeff71a9edd22380e62f2d04604661562be4d26 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 13 Jul 2024 18:27:39 -0400
Subject: [PATCH 149/225] qualcommax: Switch to upstream default config

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 target/linux/qualcommax/config-6.6 | 33 +++++++++---------------------
 1 file changed, 10 insertions(+), 23 deletions(-)

diff --git a/target/linux/qualcommax/config-6.6 b/target/linux/qualcommax/config-6.6
index 291e8cf1b974df..ac5059682a5cdf 100644
--- a/target/linux/qualcommax/config-6.6
+++ b/target/linux/qualcommax/config-6.6
@@ -76,11 +76,11 @@ CONFIG_COREDUMP=y
 CONFIG_CPUFREQ_DT=y
 CONFIG_CPUFREQ_DT_PLATDEV=y
 CONFIG_CPU_FREQ=y
-CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
-# CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL=y
 CONFIG_CPU_FREQ_GOV_ATTR_SET=y
 # CONFIG_CPU_FREQ_GOV_CONSERVATIVE is not set
-CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+# CONFIG_CPU_FREQ_GOV_ONDEMAND is not set
 CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
 # CONFIG_CPU_FREQ_GOV_POWERSAVE is not set
 CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
@@ -99,15 +99,15 @@ CONFIG_CRC8=y
 CONFIG_CRYPTO_AUTHENC=y
 CONFIG_CRYPTO_CBC=y
 CONFIG_CRYPTO_DEFLATE=y
-# CONFIG_CRYPTO_DEV_QCE is not set
-# CONFIG_CRYPTO_DEV_QCE_AEAD is not set
+CONFIG_CRYPTO_DEV_QCE=y
+CONFIG_CRYPTO_DEV_QCE_AEAD=y
 # CONFIG_CRYPTO_DEV_QCE_ENABLE_AEAD is not set
-# CONFIG_CRYPTO_DEV_QCE_ENABLE_ALL is not set
+CONFIG_CRYPTO_DEV_QCE_ENABLE_ALL=y
 # CONFIG_CRYPTO_DEV_QCE_ENABLE_SHA is not set
 # CONFIG_CRYPTO_DEV_QCE_ENABLE_SKCIPHER is not set
-# CONFIG_CRYPTO_DEV_QCE_SHA is not set
-# CONFIG_CRYPTO_DEV_QCE_SKCIPHER is not set
-# CONFIG_CRYPTO_DEV_QCE_SW_MAX_LEN is not set
+CONFIG_CRYPTO_DEV_QCE_SHA=y
+CONFIG_CRYPTO_DEV_QCE_SKCIPHER=y
+CONFIG_CRYPTO_DEV_QCE_SW_MAX_LEN=512
 CONFIG_CRYPTO_DEV_QCOM_RNG=y
 CONFIG_CRYPTO_ECB=y
 CONFIG_CRYPTO_HASH_INFO=y
@@ -212,9 +212,6 @@ CONFIG_IRQ_DOMAIN_HIERARCHY=y
 CONFIG_IRQ_FASTEOI_HIERARCHY_HANDLERS=y
 CONFIG_IRQ_FORCED_THREADING=y
 CONFIG_IRQ_WORK=y
-CONFIG_IRQ_TIME_ACCOUNTING=y
-CONFIG_MULTI_IRQ_HANDLER=y
-CONFIG_HANDLE_DOMAIN_IRQ=y
 # CONFIG_KPSS_XCC is not set
 CONFIG_LEDS_TLC591XX=y
 CONFIG_LIBFDT=y
@@ -274,10 +271,8 @@ CONFIG_NET_SELFTESTS=y
 CONFIG_NET_SWITCHDEV=y
 CONFIG_NET_XGRESS=y
 CONFIG_NLS=y
-CONFIG_HZ_FIXED=0
 CONFIG_NO_HZ_COMMON=y
 CONFIG_NO_HZ_IDLE=y
-CONFIG_NO_HZ=y
 CONFIG_NR_CPUS=4
 CONFIG_NVIDIA_CARMEL_CNP_ERRATUM=y
 CONFIG_NVMEM=y
@@ -378,10 +373,7 @@ CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y
 CONFIG_POWER_RESET=y
 # CONFIG_POWER_RESET_MSM is not set
 CONFIG_POWER_SUPPLY=y
-CONFIG_PREEMPT=y
-CONFIG_PREEMPT_COUNT=y
-# CONFIG_PREEMPT_NONE is not set
-CONFIG_PREEMPT_RCU=y
+CONFIG_PREEMPT_NONE_BUILD=y
 CONFIG_PRINTK_TIME=y
 CONFIG_PTP_1588_CLOCK_OPTIONAL=y
 CONFIG_QCA807X_PHY=y
@@ -511,11 +503,6 @@ CONFIG_SERIAL_MSM=y
 CONFIG_SERIAL_MSM_CONSOLE=y
 CONFIG_SGL_ALLOC=y
 CONFIG_SG_POOL=y
-# CONFIG_ALLOC_SKB_PAGE_FRAG_DISABLE is not set
-# CONFIG_DEBUG_OBJECTS_SKBUFF is not set
-CONFIG_SKB_RECYCLER=y
-CONFIG_SKB_RECYCLER_MULTI_CPU=y
-# CONFIG_SKB_FAST_RECYCLABLE_DEBUG_ENABLE is not set
 CONFIG_SMP=y
 # CONFIG_SM_CAMCC_6350 is not set
 # CONFIG_SM_CAMCC_8450 is not set

From 418408e15ad9a5bac8dacb7410c6ac514ddc891b Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 13 Jul 2024 18:30:25 -0400
Subject: [PATCH 150/225] qualcommax: Add new menu item for IPQ settings

Rather mess with target 'config-*' files, introduce a custom menu item
that consolidates all IPQ related kernel settings in one menu.

Most of these can be left as default since the options are derived from the
initial NSS fork for 'config-6.6'.

Options include:
1) enable or disable building `skbuff_recycle`
2) enable or disable preemption
3) select IPQ memory profile

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 Config.in            |   2 +
 config/Config-ipq.in | 140 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 142 insertions(+)
 create mode 100644 config/Config-ipq.in

diff --git a/Config.in b/Config.in
index 6d71d4c6e6f291..3210af928c69b2 100644
--- a/Config.in
+++ b/Config.in
@@ -38,3 +38,5 @@ source "target/sdk/Config.in"
 source "target/toolchain/Config.in"
 
 source "tmp/.config-package.in"
+
+source "config/Config-ipq.in"
diff --git a/config/Config-ipq.in b/config/Config-ipq.in
new file mode 100644
index 00000000000000..edd091105437ad
--- /dev/null
+++ b/config/Config-ipq.in
@@ -0,0 +1,140 @@
+# vim: set ft=kconfig
+menu "Qualcomm IPQ Options"
+
+comment "Kernel build options"
+
+choice KERNEL_IPQ_MEM_PROFILE
+	prompt "IPQ memory profile"
+	default IPQ_MEM_PROFILE_512 if TARGET_qualcommax_ipq807x_DEVICE_edimax_cax1800
+	default IPQ_MEM_PROFILE_512 if TARGET_qualcommax_ipq807x_DEVICE_compex_wpq87
+	default IPQ_MEM_PROFILE_512 if TARGET_qualcommax_ipq807x_DEVICE_linksys_mx4200v1
+	default IPQ_MEM_PROFILE_512 if TARGET_qualcommax_ipq807x_DEVICE_redmi_ax6
+	default IPQ_MEM_PROFILE_512 if TARGET_qualcommax_ipq807x_DEVICE_xiaomi_ax3600
+	default IPQ_MEM_PROFILE_512 if TARGET_qualcommax_ipq807x_DEVICE_zte_mf269
+
+	config IPQ_MEM_PROFILE_1024
+			bool "1024"
+	config IPQ_MEM_PROFILE_512
+			bool "512"
+	config IPQ_MEM_PROFILE_256
+			bool "256"
+endchoice
+
+config KERNEL_IPQ_MEM_PROFILE
+	int
+	default 1024 if IPQ_MEM_PROFILE_1024
+	default 512 if IPQ_MEM_PROFILE_512
+	default 256 if IPQ_MEM_PROFILE_256
+
+	help
+	  This option select memory profile to used, which defines
+	  the reserved memory configuration used in device tree
+
+config KERNEL_SKB_RECYCLER
+	bool "Generic SKB recycling"
+	default y if KERNEL_IPQ_MEM_PROFILE < 1024
+
+choice KERNEL_SKB_RECYCLE_SIZE
+	prompt "SKB recycler size"
+	default SKB_RECYCLE_SIZE_2304
+	default SKB_RECYCLE_SIZE_1856 if KERNEL_IPQ_MEM_PROFILE < 1024
+
+	depends on KERNEL_SKB_RECYCLER
+	config SKB_RECYCLE_SIZE_1856
+			bool "1856"
+	config SKB_RECYCLE_SIZE_2304
+			bool "2304"
+endchoice
+
+config KERNEL_SKB_RECYCLE_SIZE
+	int
+	depends on KERNEL_SKB_RECYCLER
+	default 2304 if SKB_RECYCLE_SIZE_2304
+	default 1856 if SKB_RECYCLE_SIZE_1856
+
+	help
+	SKB recycler default size
+
+config KERNEL_SKB_RECYCLER_MULTI_CPU
+	bool "Cross-CPU recycling for CPU-locked workloads"
+	depends on KERNEL_SKB_RECYCLER
+	default y
+
+config KERNEL_SKB_RECYCLER_PREALLOC
+	bool "Enable preallocation of SKBs"
+	depends on KERNEL_SKB_RECYCLER
+	default n
+
+config KERNEL_SKB_RECYCLE_MAX_PREALLOC_SKBS
+	int "Number of SKBs to be preallocated"
+	depends on KERNEL_SKB_RECYCLER_PREALLOC
+	default 16384
+
+config KERNEL_SKB_FIXED_SIZE_2K
+	bool "SKB size fixed at 2K"
+	default n
+	help
+	   SKB size fixed at 2K.
+
+config KERNEL_ALLOC_SKB_PAGE_FRAG_DISABLE
+	depends on KERNEL_SKB_RECYCLER
+	bool "Disable alloc skb page frag"
+	default n
+
+choice KERNEL_PREEMPTION
+	prompt "Kernel preemption level"
+	default KERNEL_PREEMPT
+
+config KERNEL_PREEMPT_NONE
+	bool "No Forced Preemption (Server)"
+	help
+	  This is the traditional Linux preemption model, geared towards
+	  throughput. It will still provide good latencies most of the time,
+	  but there are no guarantees and occasional longer delays are
+	  possible.
+
+	  Select this option if you are building a kernel for a server or
+	  scientific/computation system, or if you want to maximize the
+	  raw processing power of the kernel, irrespective of scheduling
+	  latencies.
+
+config KERNEL_PREEMPT_NONE_BUILD
+	depends on KERNEL_PREEMPT_NONE
+	bool
+	default y
+
+config KERNEL_PREEMPT
+	bool "Preemptible Kernel (Low-Latency)"
+	help
+	  This option reduces the latency of the kernel by making
+	  all kernel code (that is not executing in a critical section)
+	  preemptible.  This allows reaction to interactive events by
+	  permitting a low priority process to be preempted involuntarily
+	  even if it is in kernel mode executing a system call and would
+	  otherwise not be about to reach a natural preemption point.
+	  This allows applications to run more 'smoothly' even when the
+	  system is under load, at the cost of slightly lower throughput
+	  and a slight runtime overhead to kernel code.
+
+	  Select this if you are building a kernel for a desktop or
+	  embedded system with latency requirements in the milliseconds
+	  range.
+
+if KERNEL_PREEMPT
+	config KERNEL_PREEMPT_RCU
+	bool "Preemptible RCU"
+	default y
+	select KERNEL_PREEMPT_COUNT
+	help
+	  This option selects the RCU implementation that is
+	  designed for very large SMP systems with hundreds or
+	  thousands of CPUs, but for which real-time response
+	  is also required.  It also scales down nicely to
+	  smaller systems.
+
+	  Select this option if you are unsure.
+
+endif
+endchoice
+
+endmenu

From 964b414b71739cec046bff73a20b2a8c0fa6bf9d Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 13 Jul 2024 18:36:51 -0400
Subject: [PATCH 151/225] qualcommax: skbuff_recycle: add proc option to
 enable/disable

There are instances where `skbuff_recycle` messes up skb headers causing
various issues in network related activities. This was initially meant
to resolve issues with memory usage issues on 6.1.

Introduce a proc option to enable or disable skbuff_recycle. The default
is to have it enabled. Users on 512M platforms should test if memory
leaks still occur with this option disabled.

echo 0 > /proc/net/skb_recycler/skb_recycler_enable

echo 1 > /proc/net/skb_recycler/skb_recycler_enable

NOTE: There is a new script in `qca-nss-drv` that will automatically
manage this as an UCI configurable option.

commit 217a4fa43ba2ad0a02e8080dfde11ad23534aa8c (HEAD -> NSS-12.5-K6.x)
Author:     Sean Khan <datapronix@protonmail.com>
AuthorDate: Sat Jul 13 18:43:52 2024 -0400
Commit:     Sean Khan <datapronix@protonmail.com>
CommitDate: Sat Jul 13 18:43:52 2024 -0400

    nss-drv: add skb_recycler init script

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../files/net/core/skbuff_recycle.c           | 87 +++++++++++++++++--
 .../files/net/core/skbuff_recycle.h           |  9 +-
 2 files changed, 87 insertions(+), 9 deletions(-)

diff --git a/target/linux/qualcommax/files/net/core/skbuff_recycle.c b/target/linux/qualcommax/files/net/core/skbuff_recycle.c
index 3f1afcb1981d90..fc126abab03371 100644
--- a/target/linux/qualcommax/files/net/core/skbuff_recycle.c
+++ b/target/linux/qualcommax/files/net/core/skbuff_recycle.c
@@ -33,14 +33,20 @@ static struct global_recycler glob_recycler;
 static int skb_recycle_spare_max_skbs = SKB_RECYCLE_SPARE_MAX_SKBS;
 #endif
 
+static int skb_recycling_enable = 1;
 inline struct sk_buff *skb_recycler_alloc(struct net_device *dev,
-					  unsigned int length)
+					  unsigned int length, bool reset_skb)
 {
 	unsigned long flags;
 	struct sk_buff_head *h;
 	struct sk_buff *skb = NULL;
 	struct sk_buff *ln = NULL;
 
+	/* Allocate the recycled skbs if the skb_recycling_enable */
+	if (unlikely(!skb_recycling_enable)) {
+		return NULL;
+	}
+
 	if (unlikely(length > SKB_RECYCLE_SIZE))
 		return NULL;
 
@@ -106,10 +112,15 @@ inline struct sk_buff *skb_recycler_alloc(struct net_device *dev,
 		 * zero most of the structure so prefetch the start
 		 * of the shinfo region now so it's in the D-cache
 		 * before we start to write that.
+		 * For buffers recycled by PPE DS rings, the packets wouldnt
+		 * have been processed by host and hence shinfo reset can be
+		 * avoided. Avoid it if specifically requested for it
+		 * (by DS rings), and the buffer is found to be recycled by
+		 * DS previously
 		 */
+
 		shinfo = skb_shinfo(skb);
 		prefetchw(shinfo);
-
 		zero_struct(skb, offsetof(struct sk_buff, tail));
 		refcount_set(&skb->users, 1);
 		skb->mac_header = (typeof(skb->mac_header))~0U;
@@ -131,6 +142,12 @@ inline bool skb_recycler_consume(struct sk_buff *skb)
 	unsigned long flags;
 	struct sk_buff_head *h;
 	struct sk_buff *ln = NULL;
+
+	/* Consume the skbs if the skb_recycling_enable */
+	if (unlikely(!skb_recycling_enable)) {
+		return false;
+	}
+
 	/* Can we recycle this skb?  If not, simply return that we cannot */
 	if (unlikely(!consume_skb_can_recycle(skb, SKB_RECYCLE_MIN_SIZE,
 					      SKB_RECYCLE_MAX_SIZE)))
@@ -237,7 +254,9 @@ inline bool skb_recycler_consume(struct sk_buff *skb)
 inline bool skb_recycler_consume_list_fast(struct sk_buff_head *skb_list)
 {
 	struct sk_buff *skb = NULL, *next = NULL;
-
+	if (unlikely(!skb_recycling_enable)) {
+		return false;
+	}
 	skb_queue_walk_safe(skb_list, skb, next) {
 		if (skb) {
 			__skb_unlink(skb, skb_list);
@@ -253,6 +272,11 @@ inline bool skb_recycler_consume_list_fast(struct sk_buff_head *skb_list)
 	unsigned long flags;
 	struct sk_buff_head *h;
 
+	/* Allocate the recycled skbs if the skb_recycling_enable */
+	if (unlikely(!skb_recycling_enable)) {
+		return false;
+	}
+
 	h = &get_cpu_var(recycle_list);
 	local_irq_save(flags);
 	/* Attempt to enqueue the CPU hot recycle list first */
@@ -537,6 +561,46 @@ static const struct proc_ops proc_skb_max_spare_skbs_fops = {
 };
 #endif /* CONFIG_SKB_RECYCLER_MULTI_CPU */
 
+/* procfs: skb_recycler_enable
+ * By default, recycler is disabled for QSDK_512 profile.
+ * Can be enabled for alder/miami QSDK_512 profile.
+ */
+static int proc_skb_recycler_enable_show(struct seq_file *seq, void *v) {
+	seq_printf(seq, "%d\n", skb_recycling_enable);
+	return 0;
+}
+
+static int proc_skb_recycle_enable_open(struct inode *inode, struct file *file) {
+	return single_open(file, proc_skb_recycler_enable_show,
+			   pde_data(inode));
+}
+
+static ssize_t proc_skb_recycle_enable_write(struct file *file,
+					     const char __user *buf,
+					     size_t count, loff_t *ppos) {
+	int ret;
+	int enable;
+	char buffer[13];
+
+	memset(buffer, 0, sizeof(buffer));
+	if (count > sizeof(buffer) - 1)
+		count = sizeof(buffer) - 1;
+	if (copy_from_user(buffer, buf, count) != 0)
+		return -EFAULT;
+	ret = kstrtoint(strstrip(buffer), 10, &enable);
+	if (ret == 0 && enable >= 0)
+		skb_recycling_enable = enable;
+
+	return count;
+}
+
+static const struct proc_ops proc_skb_recycle_enable_fops = {
+	.proc_open = proc_skb_recycle_enable_open,
+	.proc_read = seq_read,
+	.proc_write = proc_skb_recycle_enable_write,
+	.proc_release = single_release,
+};
+
 static void skb_recycler_init_procfs(void)
 {
 	proc_net_skbrecycler = proc_mkdir("skb_recycler", init_net.proc_net);
@@ -570,6 +634,13 @@ static void skb_recycler_init_procfs(void)
 			 &proc_skb_max_spare_skbs_fops))
 		pr_err("cannot create proc net skb_recycle max_spare_skbs\n");
 #endif
+
+	if (!proc_create("skb_recycler_enable",
+			 S_IRUGO | S_IWUGO,
+			 proc_net_skbrecycler,
+			 &proc_skb_recycle_enable_fops))
+		pr_err("cannot create proc net skb_recycle enable\n");
+
 }
 
 void __init skb_recycler_init(void)
@@ -607,6 +678,7 @@ void __init skb_recycler_init(void)
 
 void skb_recycler_print_all_lists(void)
 {
+
 	unsigned long flags;
 	int cpu;
 #ifdef CONFIG_SKB_RECYCLER_MULTI_CPU
@@ -637,6 +709,7 @@ void skb_recycler_print_all_lists(void)
 
 	local_irq_restore(flags);
 	preempt_enable();
+
 }
 
 #ifdef CONFIG_SKB_FAST_RECYCLABLE_DEBUG_ENABLE
@@ -717,11 +790,11 @@ static inline bool consume_skb_can_fast_recycle_debug(const struct sk_buff *skb,
 }
 
 /**
- *      check_skb_fast_recyclable - Debug API to flag any sanity check failures
- *      			    on a fast recycled skb
- *      @skb: buffer to be checked
+ * check_skb_fast_recyclable - Debug API to flag any sanity check failures
+ * 			    on a fast recycled skb
+ * @skb: buffer to be checked
  *
- *      Checks skb recyclability
+ * Checks skb recyclability
  */
 void check_skb_fast_recyclable(struct sk_buff *skb)
 {
diff --git a/target/linux/qualcommax/files/net/core/skbuff_recycle.h b/target/linux/qualcommax/files/net/core/skbuff_recycle.h
index dd4b5b39d2411a..bfc46920177fc1 100644
--- a/target/linux/qualcommax/files/net/core/skbuff_recycle.h
+++ b/target/linux/qualcommax/files/net/core/skbuff_recycle.h
@@ -162,20 +162,25 @@ static inline bool consume_skb_can_recycle(const struct sk_buff *skb,
 	if (unlikely(skb_pfmemalloc(skb)))
 		return false;
 
+	if (skb->active_extensions)
+		return false;
+
 	return true;
 }
 
 #ifdef CONFIG_SKB_RECYCLER
 void __init skb_recycler_init(void);
-struct sk_buff *skb_recycler_alloc(struct net_device *dev, unsigned int length);
+struct sk_buff *skb_recycler_alloc(struct net_device *dev, unsigned int length, bool reset_skb);
 bool skb_recycler_consume(struct sk_buff *skb);
 bool skb_recycler_consume_list_fast(struct sk_buff_head *skb_list);
 void skb_recycler_print_all_lists(void);
+void skb_recycler_clear_flags(struct sk_buff *skb);
 #else
 #define skb_recycler_init()  {}
-#define skb_recycler_alloc(dev, len) NULL
+#define skb_recycler_alloc(dev, len, reset_skb) NULL
 #define skb_recycler_consume(skb) false
 #define skb_recycler_consume_list_fast(skb_list) false
 #define skb_recycler_print_all_lists() false
+#define skb_recycler_clear_flags(skb) {}
 #endif
 #endif

From 5392a55d1831cb5bb48a7d87cc3fb192b96facd8 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 13 Jul 2024 18:54:57 -0400
Subject: [PATCH 152/225] qualcommax: skbuff: at latest changes from QSDK

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../0981-1-qca-skb_recycler-support.patch     | 101 +++++++++++++-----
 1 file changed, 74 insertions(+), 27 deletions(-)

diff --git a/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch b/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch
index 33ff213b0dc259..b44f50e1921e96 100644
--- a/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch
+++ b/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch
@@ -42,7 +42,7 @@
  bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,
 --- a/net/Kconfig
 +++ b/net/Kconfig
-@@ -369,6 +369,27 @@ config NET_FLOW_LIMIT
+@@ -369,6 +369,52 @@ config NET_FLOW_LIMIT
  	  with many clients some protection against DoS by a single (spoofed)
  	  flow that greatly exceeds average workload.
  
@@ -60,6 +60,31 @@
 +	depends on SMP && SKB_RECYCLER
 +	default n
 +
++config SKB_RECYCLER_PREALLOC
++	bool "Enable preallocation of SKBs"
++	depends on SKB_RECYCLER
++	default n
++	help
++	 Preallocates SKBs in recycling lists and the number of
++	 SKBs are configured through CONFIG_SKB_RECYCLE_MAX_PREALLOC_SKBS.
++	 This needs SKB_RECYCLER to be enabled.
++	 The number of preallocated SKBs can be passed using
++	 SKB_RECYCLE_MAX_PREALLOC_SKBS.
++
++config SKB_RECYCLE_MAX_PREALLOC_SKBS
++	int "Number of SKBs to be preallocated"
++	depends on SKB_RECYCLER_PREALLOC
++	default 16384
++	help
++	 Number of SKBs each of 4K size to be preallocated for recycling
++
++config SKB_RECYCLE_SIZE
++	int "Minimum size for a recycled buffer"
++	depends on SKB_RECYCLER
++	default 2304
++	help
++	Minimum size for a recycled buffer
++
 +config ALLOC_SKB_PAGE_FRAG_DISABLE
 +	bool "Disable page fragment based skbuff payload allocations"
 +	depends on !SKB_RECYCLER
@@ -99,13 +124,14 @@
  			input_queue_head_incr(sd);
 --- a/net/core/skbuff.c
 +++ b/net/core/skbuff.c
-@@ -87,6 +87,31 @@
+@@ -87,6 +87,38 @@
  
  #include "dev.h"
  #include "sock_destructor.h"
 +#include "skbuff_recycle.h"
 +
 +struct kmem_cache *skb_data_cache;
++struct kmem_cache *skb_data_cache_2100;
 +/*
 + * For low memory profile, NSS_SKB_FIXED_SIZE_2K is enabled and
 + * CONFIG_SKB_RECYCLER is disabled. For premium and enterprise profile
@@ -115,23 +141,29 @@
 + */
 +#if defined(CONFIG_SKB_RECYCLER)
 +/*
-+ * 2688 for 64bit arch, 2624 for 32bit arch
++ * Both caches are kept same size when recycler is enabled so that all the
++ * skbs could be recycled. 2688 for 64bit arch, 2624 for 32bit arch
 + */
 +#define SKB_DATA_CACHE_SIZE (SKB_DATA_ALIGN(SKB_RECYCLE_SIZE + NET_SKB_PAD) + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
++#define SKB_DATA_CACHE_SIZE_2100 SKB_DATA_CACHE_SIZE
 +#else
 +/*
-+ * 2368 for 64bit arch, 2176 for 32bit arch
++ * DATA CACHE is 2368 for 64bit arch, 2176 for 32bit arch
++ * DATA_CACHE_2100 is 2496 for 64bit arch, 2432 for 32bit arch
++ * DATA CACHE size should always be lesser than that of DATA_CACHE_2100 size
 + */
 +#if defined(__LP64__)
-+#define SKB_DATA_CACHE_SIZE ((SKB_DATA_ALIGN(1984 + NET_SKB_PAD)) + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
++#define SKB_DATA_CACHE_SIZE (SKB_DATA_ALIGN(1984 + NET_SKB_PAD) + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
++#define SKB_DATA_CACHE_SIZE_2100 (SKB_DATA_ALIGN(2100 + NET_SKB_PAD) + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
 +#else
-+#define SKB_DATA_CACHE_SIZE ((SKB_DATA_ALIGN(1856 + NET_SKB_PAD)) + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
++#define SKB_DATA_CACHE_SIZE (SKB_DATA_ALIGN(1856 + NET_SKB_PAD) + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
++#define SKB_DATA_CACHE_SIZE_2100 (SKB_DATA_ALIGN(2100 + NET_SKB_PAD) + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
 +#endif
 +#endif
  
  struct kmem_cache *skbuff_cache __ro_after_init;
  static struct kmem_cache *skbuff_fclone_cache __ro_after_init;
-@@ -551,21 +576,20 @@ static void *kmalloc_reserve(unsigned in
+@@ -551,21 +583,31 @@ static void *kmalloc_reserve(unsigned in
  			     bool *pfmemalloc)
  {
  	bool ret_pfmemalloc = false;
@@ -151,16 +183,27 @@
 +						flags | __GFP_NOMEMALLOC | __GFP_NOWARN,
 +						node);
 +		*size = SKB_DATA_CACHE_SIZE;
++		if (obj || !(gfp_pfmemalloc_allowed(flags)))
++			goto out;
++		/* Try again but now we are using pfmemalloc reserves */
++		ret_pfmemalloc = true;
++		obj = kmem_cache_alloc_node(skb_data_cache, flags, node);
++		goto out;
++	} else if (obj_size > SZ_2K && obj_size <= SKB_DATA_CACHE_SIZE_2100) {
++		obj = kmem_cache_alloc_node(skb_data_cache_2100,
++						flags | __GFP_NOMEMALLOC | __GFP_NOWARN,
++						node);
++		*size = SKB_DATA_CACHE_SIZE_2100;
  		if (obj || !(gfp_pfmemalloc_allowed(flags)))
  			goto out;
  		/* Try again but now we are using pfmemalloc reserves */
  		ret_pfmemalloc = true;
 -		obj = kmem_cache_alloc_node(skb_small_head_cache, flags, node);
-+		obj = kmem_cache_alloc_node(skb_data_cache, flags, node);
++		obj = kmem_cache_alloc_node(skb_data_cache_2100, flags, node);
  		goto out;
  	}
  
-@@ -648,10 +672,12 @@ struct sk_buff *__alloc_skb(unsigned int
+@@ -648,10 +690,12 @@ struct sk_buff *__alloc_skb(unsigned int
  	 * aligned memory blocks, unless SLUB/SLAB debug is enabled.
  	 * Both skb->head and skb_shared_info are cache line aligned.
  	 */
@@ -174,7 +217,7 @@
  	 * Put skb_shared_info exactly at the end of allocated zone,
  	 * to allow max possible filling before reallocation.
  	 */
-@@ -686,7 +712,7 @@ EXPORT_SYMBOL(__alloc_skb);
+@@ -686,7 +730,7 @@ EXPORT_SYMBOL(__alloc_skb);
  /**
   *	__netdev_alloc_skb - allocate an skbuff for rx on a specific device
   *	@dev: network device to receive on
@@ -183,7 +226,7 @@
   *	@gfp_mask: get_free_pages mask, passed to alloc_skb
   *
   *	Allocate a new &sk_buff and assign it a usage count of one. The
-@@ -696,29 +722,53 @@ EXPORT_SYMBOL(__alloc_skb);
+@@ -696,29 +740,53 @@ EXPORT_SYMBOL(__alloc_skb);
   *
   *	%NULL is returned if there is no free memory.
   */
@@ -197,7 +240,7 @@
 +	unsigned int len = length;
 +
 +#ifdef CONFIG_SKB_RECYCLER
-+	skb = skb_recycler_alloc(dev, length);
++	skb = skb_recycler_alloc(dev, length, true);
 +	if (likely(skb))
 +		return skb;
 +
@@ -242,7 +285,7 @@
  
  	if (sk_memalloc_socks())
  		gfp_mask |= __GFP_MEMALLOC;
-@@ -747,6 +797,7 @@ struct sk_buff *__netdev_alloc_skb(struc
+@@ -747,6 +815,7 @@ struct sk_buff *__netdev_alloc_skb(struc
  	if (pfmemalloc)
  		skb->pfmemalloc = 1;
  	skb->head_frag = 1;
@@ -250,7 +293,7 @@
  
  skb_success:
  	skb_reserve(skb, NET_SKB_PAD);
-@@ -817,7 +868,8 @@ struct sk_buff *__napi_alloc_skb(struct
+@@ -817,7 +886,8 @@ struct sk_buff *__napi_alloc_skb(struct
  		data = page_frag_alloc_1k(&nc->page_small, gfp_mask);
  		pfmemalloc = NAPI_SMALL_PAGE_PFMEMALLOC(nc->page_small);
  	} else {
@@ -260,7 +303,7 @@
  
  		data = page_frag_alloc(&nc->page, len, gfp_mask);
  		pfmemalloc = nc->page.pfmemalloc;
-@@ -975,7 +1027,7 @@ static void skb_free_head(struct sk_buff
+@@ -975,7 +1045,7 @@ static void skb_free_head(struct sk_buff
  	}
  }
  
@@ -269,7 +312,7 @@
  			     bool napi_safe)
  {
  	struct skb_shared_info *shinfo = skb_shinfo(skb);
-@@ -1018,7 +1070,7 @@ exit:
+@@ -1018,7 +1088,7 @@ exit:
  /*
   *	Free an skbuff by memory without cleaning the state.
   */
@@ -278,7 +321,7 @@
  {
  	struct sk_buff_fclones *fclones;
  
-@@ -1282,7 +1334,6 @@ void skb_tx_error(struct sk_buff *skb)
+@@ -1282,7 +1352,6 @@ void skb_tx_error(struct sk_buff *skb)
  }
  EXPORT_SYMBOL(skb_tx_error);
  
@@ -286,7 +329,7 @@
  /**
   *	consume_skb - free an skbuff
   *	@skb: buffer to free
-@@ -1291,13 +1342,48 @@ EXPORT_SYMBOL(skb_tx_error);
+@@ -1291,13 +1360,48 @@ EXPORT_SYMBOL(skb_tx_error);
   *	Functions identically to kfree_skb, but kfree_skb assumes that the frame
   *	is being dropped after a failure and notes that
   */
@@ -300,7 +343,7 @@
 +	/*Tian: Not sure if we need to continue using this since
 +	 * since unref does the work in 5.4
 +	 */
- 
++
 +	/*
 +	if (likely(atomic_read(&skb->users) == 1))
 +		smp_rmb();
@@ -321,7 +364,7 @@
 +	 */
 +	if (likely(skb->head) && likely(skb_recycler_consume(skb)))
 +		return;
-+
+ 
 +#ifdef CONFIG_TRACEPOINTS
  	trace_consume_skb(skb, __builtin_return_address(0));
 -	__kfree_skb(skb);
@@ -336,27 +379,31 @@
  }
  EXPORT_SYMBOL(consume_skb);
  #endif
-@@ -2113,6 +2199,8 @@ int pskb_expand_head(struct sk_buff *skb
+@@ -2112,6 +2216,8 @@ int pskb_expand_head(struct sk_buff *skb
+ 
  	if (skb_pfmemalloc(skb))
  		gfp_mask |= __GFP_MEMALLOC;
- 
 +	size = SKB_DATA_ALIGN(size);
 +	size += SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
+ 
  	data = kmalloc_reserve(&size, gfp_mask, NUMA_NO_NODE, NULL);
  	if (!data)
- 		goto nodata;
-@@ -4865,6 +4953,10 @@ static void skb_extensions_init(void) {}
+@@ -4865,6 +4971,14 @@ static void skb_extensions_init(void) {}
  
  void __init skb_init(void)
  {
 +	skb_data_cache = kmem_cache_create_usercopy("skb_data_cache",
 +						SKB_DATA_CACHE_SIZE,
 +						0, SLAB_PANIC, 0, SKB_DATA_CACHE_SIZE,
++						NULL);
++	skb_data_cache_2100 = kmem_cache_create_usercopy("skb_data_cache_2100",
++						SKB_DATA_CACHE_SIZE_2100,
++						0, SLAB_PANIC, 0, SKB_DATA_CACHE_SIZE,
 +						NULL);
  	skbuff_cache = kmem_cache_create_usercopy("skbuff_head_cache",
  					      sizeof(struct sk_buff),
  					      0,
-@@ -4890,6 +4982,7 @@ void __init skb_init(void)
+@@ -4890,6 +5004,7 @@ void __init skb_init(void)
  						SKB_SMALL_HEAD_HEADROOM,
  						NULL);
  	skb_extensions_init();
@@ -364,7 +411,7 @@
  }
  
  static int
-@@ -6393,6 +6486,8 @@ static int pskb_carve_inside_header(stru
+@@ -6393,6 +6508,8 @@ static int pskb_carve_inside_header(stru
  	if (skb_pfmemalloc(skb))
  		gfp_mask |= __GFP_MEMALLOC;
  
@@ -373,7 +420,7 @@
  	data = kmalloc_reserve(&size, gfp_mask, NUMA_NO_NODE, NULL);
  	if (!data)
  		return -ENOMEM;
-@@ -6509,6 +6604,8 @@ static int pskb_carve_inside_nonlinear(s
+@@ -6509,6 +6626,8 @@ static int pskb_carve_inside_nonlinear(s
  	if (skb_pfmemalloc(skb))
  		gfp_mask |= __GFP_MEMALLOC;
  

From a3b871d2b341c88be42e5e54f312c55cf73a6d27 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 13 Jul 2024 18:56:43 -0400
Subject: [PATCH 153/225] iproute2: NSS: sync patch from QSDK 12.5

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../iproute2/patches/400-add-nss-qdisc.patch  | 27 +++++++++++--------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/package/network/utils/iproute2/patches/400-add-nss-qdisc.patch b/package/network/utils/iproute2/patches/400-add-nss-qdisc.patch
index a50b8b81a3e3d6..06106df76e2243 100644
--- a/package/network/utils/iproute2/patches/400-add-nss-qdisc.patch
+++ b/package/network/utils/iproute2/patches/400-add-nss-qdisc.patch
@@ -36,6 +36,7 @@
 +
 +#define TCA_NSSWRED_MAX (__TCA_NSSWRED_MAX - 1)
 +#define NSSWRED_CLASS_MAX 6
++
 +struct tc_red_alg_parameter {
 +	__u32	min;	/* qlen_avg < min: pkts are all enqueued */
 +	__u32	max;	/* qlen_avg > max: pkts are all dropped */
@@ -247,7 +248,6 @@
 +	__u8	set_default;	/* Sets qdisc to be the default qdisc for enqueue */
 +	__u8	accel_mode;	/* Dictates which data plane offloads the qdisc */
 +};
-+
 +
  /* FIFO section */
  
@@ -264,7 +264,7 @@
  
 --- /dev/null
 +++ b/tc/q_nss.c
-@@ -0,0 +1,1825 @@
+@@ -0,0 +1,1830 @@
 +/*
 + **************************************************************************
 + * Copyright (c) 2015, 2018 The Linux Foundation. All rights reserved.
@@ -1112,6 +1112,7 @@
 +{
 +	struct rtattr *tb[TCA_NSSTBL_MAX + 1];
 +	struct tc_nsstbl_qopt *qopt;
++	SPRINT_BUF(b1);
 +
 +	if (opt == NULL)
 +		return 0;
@@ -1126,9 +1127,9 @@
 +
 +	qopt = RTA_DATA(tb[TCA_NSSTBL_PARMS]);
 +
-+	print_size(PRINT_FP, NULL, "buffer/maxburst %s ", qopt->burst);
++	fprintf(f, "buffer/maxburst %s ", sprint_size(qopt->burst, b1));
 +	tc_print_rate(PRINT_FP, NULL, "rate %s ", qopt->rate);
-+	print_size(PRINT_FP, NULL, "mtu %s ", qopt->mtu);
++	fprintf(f, "mtu %s ", sprint_size(qopt->mtu, b1));
 +	fprintf(f, "accel_mode %d ", qopt->accel_mode);
 +
 +	return 0;
@@ -1417,6 +1418,7 @@
 +{
 +	struct rtattr *tb[TCA_NSSBF_MAX + 1];
 +	struct tc_nssbf_class_qopt *qopt;
++	SPRINT_BUF(b1);
 +
 +	if (opt == NULL)
 +		return 0;
@@ -1431,10 +1433,11 @@
 +
 +	qopt = RTA_DATA(tb[TCA_NSSBF_CLASS_PARMS]);
 +
-+	print_size(PRINT_FP, NULL, "burst %s ", qopt->burst);
++
++	fprintf(f, "burst %s ", sprint_size(qopt->burst, b1));
 +	tc_print_rate(PRINT_FP, NULL, "rate %s ", qopt->rate);
-+	print_size(PRINT_FP, NULL, "quantum %s ", qopt->quantum);
-+	print_size(PRINT_FP, NULL, "mtu %s ", qopt->mtu);
++	fprintf(f, "quantum %s ", sprint_size(qopt->quantum, b1));
++	fprintf(f, "mtu %s ", sprint_size(qopt->mtu, b1));
 +
 +	return 0;
 +}
@@ -1593,6 +1596,7 @@
 +	.print_copt	= nsswrr_print_class_opt,
 +};
 +
++
 +/* ======================== NSSWFQ =======================*/
 +
 +static void nsswfq_explain_qdisc(void)
@@ -1975,6 +1979,7 @@
 +{
 +	struct rtattr *tb[TCA_NSSHTB_MAX + 1];
 +	struct tc_nsshtb_class_qopt *qopt;
++	SPRINT_BUF(b1);
 +
 +	if (opt == NULL)
 +		return 0;
@@ -1989,13 +1994,13 @@
 +
 +	qopt = RTA_DATA(tb[TCA_NSSHTB_CLASS_PARMS]);
 +
-+	print_size(PRINT_FP, NULL, "burst %s ", qopt->burst);
++	fprintf(f, "burst %s ", sprint_size(qopt->burst, b1));
 +	tc_print_rate(PRINT_FP, NULL, "rate %s ", qopt->rate);
-+	print_size(PRINT_FP, NULL, "cburst %s ", qopt->cburst);
++	fprintf(f, "cburst %s ", sprint_size(qopt->cburst, b1));
 +	tc_print_rate(PRINT_FP, NULL, "crate %s ", qopt->crate);
 +	fprintf(f, "priority %u ", qopt->priority);
-+	print_size(PRINT_FP, NULL, "quantum %s ", qopt->quantum);
-+	print_size(PRINT_FP, NULL, "overhead %s ", qopt->overhead);
++	fprintf(f, "quantum %s ", sprint_size(qopt->quantum, b1));
++	fprintf(f, "overhead %s ", sprint_size(qopt->overhead, b1));
 +
 +	return 0;
 +}

From 0abdb5425bae34e1331c7ed83f46080652d2968f Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sun, 14 Jul 2024 18:40:29 -0400
Subject: [PATCH 154/225] qualcommax: enable skb_recycle for IPQ > 256M

Also set SKB_FIXED_SIZE_2K if IPQ memory profile is < 512M

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 config/Config-ipq.in | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/config/Config-ipq.in b/config/Config-ipq.in
index edd091105437ad..71255055daf1f9 100644
--- a/config/Config-ipq.in
+++ b/config/Config-ipq.in
@@ -32,7 +32,7 @@ config KERNEL_IPQ_MEM_PROFILE
 
 config KERNEL_SKB_RECYCLER
 	bool "Generic SKB recycling"
-	default y if KERNEL_IPQ_MEM_PROFILE < 1024
+	default y if KERNEL_IPQ_MEM_PROFILE > 256
 
 choice KERNEL_SKB_RECYCLE_SIZE
 	prompt "SKB recycler size"
@@ -73,6 +73,7 @@ config KERNEL_SKB_RECYCLE_MAX_PREALLOC_SKBS
 config KERNEL_SKB_FIXED_SIZE_2K
 	bool "SKB size fixed at 2K"
 	default n
+	default y if KERNEL_IPQ_MEM_PROFILE < 512
 	help
 	   SKB size fixed at 2K.
 

From a80c2d93d114457f7b587cb63bc55a865489ddc0 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sun, 14 Jul 2024 19:39:14 -0400
Subject: [PATCH 155/225] qualcommax: add notes about SKB_RECYCLER_PREALLOC and
 SKB_FIXED_SIZE_2K

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 config/Config-ipq.in | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/config/Config-ipq.in b/config/Config-ipq.in
index 71255055daf1f9..7b36443b1c8c5a 100644
--- a/config/Config-ipq.in
+++ b/config/Config-ipq.in
@@ -61,9 +61,18 @@ config KERNEL_SKB_RECYCLER_MULTI_CPU
 	default y
 
 config KERNEL_SKB_RECYCLER_PREALLOC
-	bool "Enable preallocation of SKBs"
+	bool "Enable preallocation of SKBs (For SFE not NSS)"
 	depends on KERNEL_SKB_RECYCLER
 	default n
+	help
+	  NOTE: This is primarily for platforms utilizing SFE (Shortcut Forwarding Engine)
+	  and not NSS (Network Subsystem) offload.
+
+	  NSS offload platforms mostly utilize the SKB recycling feature when managing memory.
+	  Mostly when to "reclaim" it.
+
+	  This option enables preallocation of SKBs.
+	  The default is '16384' which means 16384 x 4096 (Size of SKB) = 64MB.
 
 config KERNEL_SKB_RECYCLE_MAX_PREALLOC_SKBS
 	int "Number of SKBs to be preallocated"
@@ -75,7 +84,7 @@ config KERNEL_SKB_FIXED_SIZE_2K
 	default n
 	default y if KERNEL_IPQ_MEM_PROFILE < 512
 	help
-	   SKB size fixed at 2K.
+	   SKB size fixed at 2K. Primarily for platforms with less than 512MB memory.
 
 config KERNEL_ALLOC_SKB_PAGE_FRAG_DISABLE
 	depends on KERNEL_SKB_RECYCLER

From cc8c03916c6da8dde822975601c1d7453b34ffae Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Mon, 22 Jul 2024 18:49:04 -0400
Subject: [PATCH 156/225] qualcommax: NSS: Refresh patches against 6.6.41

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...-2-qca-nss-ecm-support-PPPOE-offload.patch | 12 ++---
 ...3-3-qca-nss-clients-add-PPTP-support.patch |  6 +--
 ...-clients-add-l2tp-offloading-support.patch |  4 +-
 .../0981-1-qca-skb_recycler-support.patch     |  4 +-
 ...com-disable-swiotlb-for-64mb-savings.patch | 44 -------------------
 5 files changed, 13 insertions(+), 57 deletions(-)

diff --git a/target/linux/qualcommax/patches-6.6/0600-2-qca-nss-ecm-support-PPPOE-offload.patch b/target/linux/qualcommax/patches-6.6/0600-2-qca-nss-ecm-support-PPPOE-offload.patch
index 2e28409fa0dbf7..f7271a6886a98b 100644
--- a/target/linux/qualcommax/patches-6.6/0600-2-qca-nss-ecm-support-PPPOE-offload.patch
+++ b/target/linux/qualcommax/patches-6.6/0600-2-qca-nss-ecm-support-PPPOE-offload.patch
@@ -8,7 +8,7 @@
  
  #include <linux/nsproxy.h>
  #include <net/net_namespace.h>
-@@ -254,6 +255,25 @@ struct ppp_net {
+@@ -255,6 +256,25 @@ struct ppp_net {
  #define seq_before(a, b)	((s32)((a) - (b)) < 0)
  #define seq_after(a, b)		((s32)((a) - (b)) > 0)
  
@@ -34,7 +34,7 @@
  /* Prototypes. */
  static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf,
  			struct file *file, unsigned int cmd, unsigned long arg);
-@@ -3453,7 +3473,10 @@ ppp_connect_channel(struct channel *pch,
+@@ -3468,7 +3488,10 @@ ppp_connect_channel(struct channel *pch,
  	struct ppp_net *pn;
  	int ret = -ENXIO;
  	int hdrlen;
@@ -45,7 +45,7 @@
  	pn = ppp_pernet(pch->chan_net);
  
  	mutex_lock(&pn->all_ppp_mutex);
-@@ -3485,13 +3508,40 @@ ppp_connect_channel(struct channel *pch,
+@@ -3500,13 +3523,40 @@ ppp_connect_channel(struct channel *pch,
  	++ppp->n_channels;
  	pch->ppp = ppp;
  	refcount_inc(&ppp->file.refcnt);
@@ -87,7 +87,7 @@
  	return ret;
  }
  
-@@ -3509,6 +3559,13 @@ ppp_disconnect_channel(struct channel *p
+@@ -3524,6 +3574,13 @@ ppp_disconnect_channel(struct channel *p
  	pch->ppp = NULL;
  	write_unlock_bh(&pch->upl);
  	if (ppp) {
@@ -101,7 +101,7 @@
  		/* remove it from the ppp unit's list */
  		ppp_lock(ppp);
  		list_del(&pch->clist);
-@@ -3588,6 +3645,222 @@ static void *unit_find(struct idr *p, in
+@@ -3603,6 +3660,222 @@ static void *unit_find(struct idr *p, in
  	return idr_find(p, n);
  }
  
@@ -324,7 +324,7 @@
  /* Module/initialization stuff */
  
  module_init(ppp_init);
-@@ -3604,6 +3877,7 @@ EXPORT_SYMBOL(ppp_input_error);
+@@ -3619,6 +3892,7 @@ EXPORT_SYMBOL(ppp_input_error);
  EXPORT_SYMBOL(ppp_output_wakeup);
  EXPORT_SYMBOL(ppp_register_compressor);
  EXPORT_SYMBOL(ppp_unregister_compressor);
diff --git a/target/linux/qualcommax/patches-6.6/0603-3-qca-nss-clients-add-PPTP-support.patch b/target/linux/qualcommax/patches-6.6/0603-3-qca-nss-clients-add-PPTP-support.patch
index 5fb9917bc9067e..2c431a5d257731 100644
--- a/target/linux/qualcommax/patches-6.6/0603-3-qca-nss-clients-add-PPTP-support.patch
+++ b/target/linux/qualcommax/patches-6.6/0603-3-qca-nss-clients-add-PPTP-support.patch
@@ -51,7 +51,7 @@
  #endif /* !(__LINUX_IF_PPPOX_H) */
 --- a/drivers/net/ppp/ppp_generic.c
 +++ b/drivers/net/ppp/ppp_generic.c
-@@ -2973,6 +2973,20 @@ char *ppp_dev_name(struct ppp_channel *c
+@@ -2988,6 +2988,20 @@ char *ppp_dev_name(struct ppp_channel *c
  	return name;
  }
  
@@ -72,7 +72,7 @@
  
  /*
   * Disconnect a channel from the generic layer.
-@@ -3681,6 +3695,28 @@ void ppp_update_stats(struct net_device
+@@ -3696,6 +3710,28 @@ void ppp_update_stats(struct net_device
  	ppp_recv_unlock(ppp);
  }
  
@@ -101,7 +101,7 @@
  /* Returns >0 if the device is a multilink PPP netdevice, 0 if not or < 0 if
   * the device is not PPP.
   */
-@@ -3872,6 +3908,7 @@ EXPORT_SYMBOL(ppp_unregister_channel);
+@@ -3887,6 +3923,7 @@ EXPORT_SYMBOL(ppp_unregister_channel);
  EXPORT_SYMBOL(ppp_channel_index);
  EXPORT_SYMBOL(ppp_unit_number);
  EXPORT_SYMBOL(ppp_dev_name);
diff --git a/target/linux/qualcommax/patches-6.6/0603-6-qca-nss-clients-add-l2tp-offloading-support.patch b/target/linux/qualcommax/patches-6.6/0603-6-qca-nss-clients-add-l2tp-offloading-support.patch
index 4032eb3c227134..1cc92442e9370a 100644
--- a/target/linux/qualcommax/patches-6.6/0603-6-qca-nss-clients-add-l2tp-offloading-support.patch
+++ b/target/linux/qualcommax/patches-6.6/0603-6-qca-nss-clients-add-l2tp-offloading-support.patch
@@ -261,7 +261,7 @@
  
 --- a/drivers/net/ppp/ppp_generic.c
 +++ b/drivers/net/ppp/ppp_generic.c
-@@ -3743,6 +3743,32 @@ int ppp_is_multilink(struct net_device *
+@@ -3758,6 +3758,32 @@ int ppp_is_multilink(struct net_device *
  }
  EXPORT_SYMBOL(ppp_is_multilink);
  
@@ -294,7 +294,7 @@
  /* ppp_channel_get_protocol()
   *	Call this to obtain the underlying protocol of the PPP channel,
   *	e.g. PX_PROTO_OE
-@@ -3881,6 +3907,59 @@ int ppp_hold_channels(struct net_device
+@@ -3896,6 +3922,59 @@ int ppp_hold_channels(struct net_device
  }
  EXPORT_SYMBOL(ppp_hold_channels);
  
diff --git a/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch b/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch
index b44f50e1921e96..d10a0e69f0e541 100644
--- a/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch
+++ b/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch
@@ -350,7 +350,7 @@
 +	else if (likely(!atomic_dec_and_test(&skb->users)))
 +		return;
 +	*/
-+
+ 
 +	/* If possible we'd like to recycle any skb rather than just free it,
 +	 * but in order to do that we need to release any head state too.
 +	 * We don't want to do this later because we'll be in a pre-emption
@@ -364,7 +364,7 @@
 +	 */
 +	if (likely(skb->head) && likely(skb_recycler_consume(skb)))
 +		return;
- 
++
 +#ifdef CONFIG_TRACEPOINTS
  	trace_consume_skb(skb, __builtin_return_address(0));
 -	__kfree_skb(skb);
diff --git a/target/linux/qualcommax/patches-6.6/0982-1-arm64-dts-qcom-disable-swiotlb-for-64mb-savings.patch b/target/linux/qualcommax/patches-6.6/0982-1-arm64-dts-qcom-disable-swiotlb-for-64mb-savings.patch
index ffe31ee712e03c..70808a29b8703c 100644
--- a/target/linux/qualcommax/patches-6.6/0982-1-arm64-dts-qcom-disable-swiotlb-for-64mb-savings.patch
+++ b/target/linux/qualcommax/patches-6.6/0982-1-arm64-dts-qcom-disable-swiotlb-for-64mb-savings.patch
@@ -1,5 +1,3 @@
-diff --git a/arch/arm64/boot/dts/qcom/ipq6010-wax214.dts b/arch/arm64/boot/dts/qcom/ipq6010-wax214.dts
-index 90a4828c17..bb13f6fb4a 100644
 --- a/arch/arm64/boot/dts/qcom/ipq6010-wax214.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq6010-wax214.dts
 @@ -25,7 +25,7 @@
@@ -11,8 +9,6 @@ index 90a4828c17..bb13f6fb4a 100644
  	};
  
  	keys {
-diff --git a/arch/arm64/boot/dts/qcom/ipq6018-fap650.dts b/arch/arm64/boot/dts/qcom/ipq6018-fap650.dts
-index e9ebcc9063..7420dc75dc 100644
 --- a/arch/arm64/boot/dts/qcom/ipq6018-fap650.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq6018-fap650.dts
 @@ -30,7 +30,7 @@
@@ -24,8 +20,6 @@ index e9ebcc9063..7420dc75dc 100644
  	};
  
  	keys {
-diff --git a/arch/arm64/boot/dts/qcom/ipq8070-cax1800.dts b/arch/arm64/boot/dts/qcom/ipq8070-cax1800.dts
-index 4359c3d5b1..8ca6eb6dac 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8070-cax1800.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq8070-cax1800.dts
 @@ -27,7 +27,7 @@
@@ -37,8 +31,6 @@ index 4359c3d5b1..8ca6eb6dac 100644
  	};
  
  	keys {
-diff --git a/arch/arm64/boot/dts/qcom/ipq8070-rm2-6.dts b/arch/arm64/boot/dts/qcom/ipq8070-rm2-6.dts
-index 52a9468f99..7ba0bda97c 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8070-rm2-6.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq8070-rm2-6.dts
 @@ -33,7 +33,7 @@
@@ -50,8 +42,6 @@ index 52a9468f99..7ba0bda97c 100644
  	};
  
  	keys {
-diff --git a/arch/arm64/boot/dts/qcom/ipq8071-ax3600.dtsi b/arch/arm64/boot/dts/qcom/ipq8071-ax3600.dtsi
-index c2c5f4ce83..f198df9183 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8071-ax3600.dtsi
 +++ b/arch/arm64/boot/dts/qcom/ipq8071-ax3600.dtsi
 @@ -20,7 +20,7 @@
@@ -63,8 +53,6 @@ index c2c5f4ce83..f198df9183 100644
  	};
  
  	keys {
-diff --git a/arch/arm64/boot/dts/qcom/ipq8071-eap102.dts b/arch/arm64/boot/dts/qcom/ipq8071-eap102.dts
-index bcf0285220..760a00fc7f 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8071-eap102.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq8071-eap102.dts
 @@ -30,7 +30,7 @@
@@ -76,8 +64,6 @@ index bcf0285220..760a00fc7f 100644
  	};
  
  	keys {
-diff --git a/arch/arm64/boot/dts/qcom/ipq8071-mf269.dts b/arch/arm64/boot/dts/qcom/ipq8071-mf269.dts
-index c5b21bd29a..3ff700fe63 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8071-mf269.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq8071-mf269.dts
 @@ -25,7 +25,7 @@
@@ -89,8 +75,6 @@ index c5b21bd29a..3ff700fe63 100644
  	};
  
  	keys {
-diff --git a/arch/arm64/boot/dts/qcom/ipq8072-aw1000.dts b/arch/arm64/boot/dts/qcom/ipq8072-aw1000.dts
-index fbad0e79e5..28b5bc3506 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8072-aw1000.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq8072-aw1000.dts
 @@ -35,7 +35,7 @@
@@ -102,8 +86,6 @@ index fbad0e79e5..28b5bc3506 100644
  	};
  
  	gpio-export {
-diff --git a/arch/arm64/boot/dts/qcom/ipq8072-ax880.dts b/arch/arm64/boot/dts/qcom/ipq8072-ax880.dts
-index af5a497b39..3510705344 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8072-ax880.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq8072-ax880.dts
 @@ -30,7 +30,7 @@
@@ -115,8 +97,6 @@ index af5a497b39..3510705344 100644
  	};
  
  	keys {
-diff --git a/arch/arm64/boot/dts/qcom/ipq8072-ax9000.dts b/arch/arm64/boot/dts/qcom/ipq8072-ax9000.dts
-index fe5a136722..b555b9e6d5 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8072-ax9000.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq8072-ax9000.dts
 @@ -26,7 +26,7 @@
@@ -128,8 +108,6 @@ index fe5a136722..b555b9e6d5 100644
  	};
  
  	keys {
-diff --git a/arch/arm64/boot/dts/qcom/ipq8072-dl-wrx36.dts b/arch/arm64/boot/dts/qcom/ipq8072-dl-wrx36.dts
-index 24dd51b47f..8096807d3a 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8072-dl-wrx36.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq8072-dl-wrx36.dts
 @@ -32,7 +32,7 @@
@@ -141,8 +119,6 @@ index 24dd51b47f..8096807d3a 100644
  	};
  
  	keys {
-diff --git a/arch/arm64/boot/dts/qcom/ipq8072-mx5300.dts b/arch/arm64/boot/dts/qcom/ipq8072-mx5300.dts
-index 6e2e95c00a..02106cf753 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8072-mx5300.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq8072-mx5300.dts
 @@ -33,7 +33,7 @@
@@ -154,8 +130,6 @@ index 6e2e95c00a..02106cf753 100644
  	};
  
  	keys {
-diff --git a/arch/arm64/boot/dts/qcom/ipq8072-mx8500.dts b/arch/arm64/boot/dts/qcom/ipq8072-mx8500.dts
-index a4fcb3e18d..075faf8f12 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8072-mx8500.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq8072-mx8500.dts
 @@ -25,7 +25,7 @@
@@ -167,8 +141,6 @@ index a4fcb3e18d..075faf8f12 100644
  	};
  
  	gpio_export {
-diff --git a/arch/arm64/boot/dts/qcom/ipq8072-wax218.dts b/arch/arm64/boot/dts/qcom/ipq8072-wax218.dts
-index 2c1e0f5e47..2354aff1bb 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8072-wax218.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq8072-wax218.dts
 @@ -27,7 +27,7 @@
@@ -180,8 +152,6 @@ index 2c1e0f5e47..2354aff1bb 100644
  	};
  
  	keys {
-diff --git a/arch/arm64/boot/dts/qcom/ipq8072-wax620.dts b/arch/arm64/boot/dts/qcom/ipq8072-wax620.dts
-index 5762899889..32b84c7560 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8072-wax620.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq8072-wax620.dts
 @@ -30,7 +30,7 @@
@@ -193,8 +163,6 @@ index 5762899889..32b84c7560 100644
  	};
  
  	keys {
-diff --git a/arch/arm64/boot/dts/qcom/ipq8072-wpq873.dts b/arch/arm64/boot/dts/qcom/ipq8072-wpq873.dts
-index ebc68e15a8..d6690d1b66 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8072-wpq873.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq8072-wpq873.dts
 @@ -31,7 +31,7 @@
@@ -206,8 +174,6 @@ index ebc68e15a8..d6690d1b66 100644
  	};
  
  	keys {
-diff --git a/arch/arm64/boot/dts/qcom/ipq8072-zbt-z800ax.dts b/arch/arm64/boot/dts/qcom/ipq8072-zbt-z800ax.dts
-index 2398bf9295..99b746245e 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8072-zbt-z800ax.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq8072-zbt-z800ax.dts
 @@ -33,7 +33,7 @@
@@ -219,8 +185,6 @@ index 2398bf9295..99b746245e 100644
  	};
  
  	gpio-export {
-diff --git a/arch/arm64/boot/dts/qcom/ipq8074-rax120v2.dts b/arch/arm64/boot/dts/qcom/ipq8074-rax120v2.dts
-index 5331f98587..57e0bde3cb 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8074-rax120v2.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq8074-rax120v2.dts
 @@ -25,7 +25,7 @@
@@ -232,8 +196,6 @@ index 5331f98587..57e0bde3cb 100644
  	};
  
  	keys {
-diff --git a/arch/arm64/boot/dts/qcom/ipq8074-sxk80.dtsi b/arch/arm64/boot/dts/qcom/ipq8074-sxk80.dtsi
-index 7a29f945d5..315472635b 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8074-sxk80.dtsi
 +++ b/arch/arm64/boot/dts/qcom/ipq8074-sxk80.dtsi
 @@ -26,7 +26,7 @@
@@ -245,8 +207,6 @@ index 7a29f945d5..315472635b 100644
  	};
  
  	keys {
-diff --git a/arch/arm64/boot/dts/qcom/ipq8074-wax630.dts b/arch/arm64/boot/dts/qcom/ipq8074-wax630.dts
-index d241ae642a..bb400beb0f 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8074-wax630.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq8074-wax630.dts
 @@ -29,7 +29,7 @@
@@ -258,8 +218,6 @@ index d241ae642a..bb400beb0f 100644
  	};
  
  	keys {
-diff --git a/arch/arm64/boot/dts/qcom/ipq8074-wxr-5950ax12.dts b/arch/arm64/boot/dts/qcom/ipq8074-wxr-5950ax12.dts
-index 5f463b6c62..52d9f9c4e9 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8074-wxr-5950ax12.dts
 +++ b/arch/arm64/boot/dts/qcom/ipq8074-wxr-5950ax12.dts
 @@ -25,7 +25,7 @@
@@ -271,8 +229,6 @@ index 5f463b6c62..52d9f9c4e9 100644
  	};
  
  	leds {
-diff --git a/arch/arm64/boot/dts/qcom/ipq8174-mx4200.dtsi b/arch/arm64/boot/dts/qcom/ipq8174-mx4200.dtsi
-index 741c00bdcb..a4a379bb4a 100644
 --- a/arch/arm64/boot/dts/qcom/ipq8174-mx4200.dtsi
 +++ b/arch/arm64/boot/dts/qcom/ipq8174-mx4200.dtsi
 @@ -30,7 +30,7 @@

From f452ebfd9de3f5b3a5c8aa1642bf87542377fcf1 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Mon, 22 Jul 2024 18:50:38 -0400
Subject: [PATCH 157/225] ath11k_nss: Revert logic from coconut branch in NSS
 redirect

There was logic that was initially included in the coconut branch of
QSDK for older mac80211 NSS implementation. It was brought over to
address an issue with ath10k where during heavy traffic, AP would trigger
`failed to increase tx pending count: -16, dropping`.

The issue was actually caused by `skb_recyler` malforming some packets.
Disabling `skb_recyler` fixed the error, and therefore the logic
regarding `skb_queue_len(&local->pending[q]) >= 1000` can be reverted to
match what is currently upstream with QSDK.

Alsi refreshed remaning patches after rebase.

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...07-mac80211-add-nss-redirect-support.patch | 29 +++++--------------
 ...N-iftype-support-on-NSS-offload-case.patch |  4 +--
 ...-dynamic-VLAN-support-on-NSS-offload.patch |  2 +-
 .../nss/subsys/245-compilation_fix.patch      | 10 +++----
 .../300-ath11k-nss-mesh-offload-support.patch | 12 ++++----
 ...-0005-mac80211-simple-tx-for-AP-mode.patch |  4 +--
 .../336-mac80211-Mesh-Fast-rx-support.patch   | 10 +++----
 ...mac80211-fix-unconditional-sta-usage.patch |  4 +--
 ...ncapsulation-of-EAPOL-frames-if-OFFL.patch | 24 +++++++--------
 ...se-HW-checksum-offload-only-for-ethm.patch | 10 +++----
 ...1-Add-mac-hw-flag-to-avoid-queue-skb.patch |  6 ++--
 .../829-mac80211-fix-mesh-ping-issue.patch    |  8 ++---
 12 files changed, 54 insertions(+), 69 deletions(-)

diff --git a/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch b/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
index 9ffad0818805e3..32a4f78e87057f 100644
--- a/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
@@ -138,7 +138,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	return 0;
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -2606,6 +2606,58 @@ static bool ieee80211_frame_allowed(stru
+@@ -2606,6 +2606,60 @@ static bool ieee80211_frame_allowed(stru
  	return true;
  }
  
@@ -179,6 +179,8 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
 +	ret = nss_virt_if_tx_buf(sdata->nssctx, skb);
 +	if (ret) {
 +		if (net_ratelimit()) {
++			if (NSS_TX_FAILURE_NOT_ENABLED == ret)
++			  goto out;
 +			sdata_err(sdata, "NSS TX failed with error: %s\n",
 +				  nss_tx_status_str(ret));
 +		}
@@ -197,7 +199,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  static void ieee80211_deliver_skb_to_local_stack(struct sk_buff *skb,
  						 struct ieee80211_rx_data *rx)
  {
-@@ -2645,11 +2697,15 @@ static void ieee80211_deliver_skb_to_loc
+@@ -2645,11 +2699,15 @@ static void ieee80211_deliver_skb_to_loc
  			     !ether_addr_equal(ehdr->h_dest, sdata->vif.addr)))
  			ether_addr_copy(ehdr->h_dest, sdata->vif.addr);
  
@@ -215,24 +217,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -1725,6 +1725,16 @@ static bool ieee80211_tx_frags(struct ie
- 				}
- 			} else {
- 
-+#ifdef CPTCFG_MAC80211_NSS_SUPPORT
-+				if (skb_queue_len(&local->pending[q]) >= 1000) {
-+					spin_unlock_irqrestore(
-+						&local->queue_stop_reason_lock,
-+						flags);
-+					ieee80211_purge_tx_queue(&local->hw,
-+								 skbs);
-+					return false;
-+				}
-+#endif
- 				/*
- 				 * Since queue is stopped, queue up frames for
- 				 * later transmission from the tx-pending
-@@ -4526,6 +4536,35 @@ static void ieee80211_mlo_multicast_tx(s
+@@ -4526,6 +4526,35 @@ static void ieee80211_mlo_multicast_tx(s
  	kfree_skb(skb);
  }
  
@@ -268,7 +253,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  /**
   * ieee80211_subif_start_xmit - netif start_xmit function for 802.3 vifs
   * @skb: packet to be sent
-@@ -4541,6 +4580,10 @@ netdev_tx_t ieee80211_subif_start_xmit(s
+@@ -4541,6 +4570,10 @@ netdev_tx_t ieee80211_subif_start_xmit(s
  	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	const struct ethhdr *eth = (void *)skb->data;
  
@@ -279,7 +264,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	if (likely(!is_multicast_ether_addr(eth->h_dest)))
  		goto normal;
  
-@@ -4730,6 +4773,9 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4730,6 +4763,9 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  	struct ieee80211_key *key;
  	struct sta_info *sta;
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch b/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
index 30fb8521368f5b..77e7c3b637e933 100644
--- a/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
@@ -137,7 +137,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  {
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4330,8 +4330,11 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4320,8 +4320,11 @@ void __ieee80211_subif_start_xmit(struct
  		sta = NULL;
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
@@ -151,7 +151,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		if (ap_sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED &&
  		    !is_multicast_ether_addr(skb->data)) {
  			if (sta)
-@@ -4723,7 +4726,8 @@ static void ieee80211_8023_xmit(struct i
+@@ -4713,7 +4716,8 @@ static void ieee80211_8023_xmit(struct i
  
  	info->hw_queue = sdata->vif.hw_queue[queue];
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch b/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
index 08455308e72a11..fd5d052ce140f5 100644
--- a/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
@@ -102,7 +102,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	key->conf.cipher = cipher;
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4682,16 +4682,25 @@ static void ieee80211_8023_xmit(struct i
+@@ -4672,16 +4672,25 @@ static void ieee80211_8023_xmit(struct i
  				struct ieee80211_key *key, struct sk_buff *skb)
  {
  	struct ieee80211_tx_info *info;
diff --git a/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch b/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch
index 2e629bc28f42a5..427b1aa264a08f 100644
--- a/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch
@@ -30,7 +30,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	struct ieee80211_local *local;
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4711,19 +4711,21 @@ static void ieee80211_8023_xmit(struct i
+@@ -4701,19 +4701,21 @@ static void ieee80211_8023_xmit(struct i
  
  	ieee80211_aggr_check(sdata, sta, skb);
  
@@ -64,7 +64,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	}
  
  	skb = ieee80211_tx_skb_fixup(skb, ieee80211_sdata_netdev_features(sdata));
-@@ -4783,7 +4785,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4773,7 +4775,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  {
  	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	struct ethhdr *ehdr = (struct ethhdr *)skb->data;
@@ -73,7 +73,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	struct sta_info *sta;
  
  #ifdef CPTCFG_MAC80211_NSS_SUPPORT
-@@ -4801,9 +4803,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4791,9 +4793,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		goto out;
  	}
  
@@ -90,7 +90,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  		goto skip_offload;
  
  	key = rcu_dereference(sta->ptk[sta->ptk_idx]);
-@@ -4814,6 +4820,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4804,6 +4810,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		goto skip_offload;
  
  	sk_pacing_shift_update(skb->sk, sdata->local->hw.tx_sk_pacing_shift);
@@ -98,7 +98,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	ieee80211_8023_xmit(sdata, dev, sta, key, skb);
  	goto out;
  
-@@ -6336,13 +6343,7 @@ int ieee80211_tx_control_port(struct wip
+@@ -6326,13 +6333,7 @@ int ieee80211_tx_control_port(struct wip
  
  start_xmit:
  	local_bh_disable();
diff --git a/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch b/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
index c19f9606a90f8f..0915c24550c19a 100644
--- a/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
@@ -1160,7 +1160,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  void mesh_pathtbl_unregister(struct ieee80211_sub_if_data *sdata)
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -2638,7 +2638,7 @@ static struct sk_buff *ieee80211_build_h
+@@ -2628,7 +2628,7 @@ static struct sk_buff *ieee80211_build_h
  	bool multicast;
  	u16 info_id = 0;
  	struct ieee80211_chanctx_conf *chanctx_conf = NULL;
@@ -1169,7 +1169,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	int ret;
  	u8 link_id = u32_get_bits(ctrl_flags, IEEE80211_TX_CTRL_MLO_LINK);
  
-@@ -2650,6 +2650,9 @@ static struct sk_buff *ieee80211_build_h
+@@ -2640,6 +2640,9 @@ static struct sk_buff *ieee80211_build_h
  		info_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
  #endif
  
@@ -1179,7 +1179,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	/* convert Ethernet header to proper 802.11 header (based on
  	 * operation mode) */
  	ethertype = (skb->data[12] << 8) | skb->data[13];
-@@ -2720,6 +2723,13 @@ static struct sk_buff *ieee80211_build_h
+@@ -2710,6 +2713,13 @@ static struct sk_buff *ieee80211_build_h
  		break;
  #ifdef CPTCFG_MAC80211_MESH
  	case NL80211_IFTYPE_MESH_POINT:
@@ -1193,7 +1193,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  		if (!is_multicast_ether_addr(skb->data)) {
  			struct sta_info *next_hop;
  			bool mpp_lookup = true;
-@@ -2984,6 +2994,9 @@ static struct sk_buff *ieee80211_build_h
+@@ -2974,6 +2984,9 @@ static struct sk_buff *ieee80211_build_h
  
  	skb_reset_mac_header(skb);
  
@@ -1203,7 +1203,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	info = IEEE80211_SKB_CB(skb);
  	memset(info, 0, sizeof(*info));
  
-@@ -4307,6 +4320,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4297,6 +4310,7 @@ void __ieee80211_subif_start_xmit(struct
  	struct sk_buff *next;
  	int len = skb->len;
  	struct ieee80211_key *key = NULL;
@@ -1211,7 +1211,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	struct ieee80211_sub_if_data *ap_sdata;
  
  	if (unlikely(!ieee80211_sdata_running(sdata) || skb->len < ETH_HLEN)) {
-@@ -4381,9 +4395,15 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4371,9 +4385,15 @@ void __ieee80211_subif_start_xmit(struct
  			goto out;
  		}
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch b/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch
index 1cc506b1677eb0..5a5b79060833c2 100644
--- a/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch
@@ -14,7 +14,7 @@ Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4800,6 +4800,67 @@ out_free:
+@@ -4790,6 +4790,67 @@ out_free:
  	kfree_skb(skb);
  }
  
@@ -82,7 +82,7 @@ Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
  netdev_tx_t ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
  					    struct net_device *dev)
  {
-@@ -4839,6 +4900,11 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4829,6 +4890,11 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  	if (key && (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)))
  		goto skip_offload;
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/336-mac80211-Mesh-Fast-rx-support.patch b/package/kernel/mac80211/patches/nss/subsys/336-mac80211-Mesh-Fast-rx-support.patch
index 91de098697d937..3ea2eef1267275 100644
--- a/package/kernel/mac80211/patches/nss/subsys/336-mac80211-Mesh-Fast-rx-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/336-mac80211-Mesh-Fast-rx-support.patch
@@ -94,7 +94,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  	if (action) {
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -4711,10 +4711,15 @@ void ieee80211_check_fast_rx(struct sta_
+@@ -4713,10 +4713,15 @@ void ieee80211_check_fast_rx(struct sta_
  
  		break;
  	case NL80211_IFTYPE_MESH_POINT:
@@ -112,7 +112,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  		break;
  	default:
  		goto clear;
-@@ -4755,7 +4760,7 @@ void ieee80211_check_fast_rx(struct sta_
+@@ -4757,7 +4762,7 @@ void ieee80211_check_fast_rx(struct sta_
  	__release(check_fast_rx);
  
  	if (assign)
@@ -121,7 +121,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  
  	offload_flags = get_bss_sdata(sdata)->vif.offload_flags;
  	offload = offload_flags & IEEE80211_OFFLOAD_DECAP_ENABLED;
-@@ -4937,6 +4942,10 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4939,6 +4944,10 @@ static bool ieee80211_invoke_fast_rx(str
  		u8 sa[ETH_ALEN];
  	} addrs __aligned(2);
  	struct ieee80211_sta_rx_stats *stats;
@@ -132,7 +132,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  
  	/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
  	 * to a common data structure; drivers can implement that per queue
-@@ -4986,6 +4995,37 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4988,6 +4997,37 @@ static bool ieee80211_invoke_fast_rx(str
  		snap_offs += IEEE80211_CCMP_HDR_LEN;
  	}
  
@@ -170,7 +170,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  	if (!ieee80211_vif_is_mesh(&rx->sdata->vif) &&
  	    !(status->rx_flags & IEEE80211_RX_AMSDU)) {
  		if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
-@@ -5023,9 +5063,33 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -5025,9 +5065,33 @@ static bool ieee80211_invoke_fast_rx(str
  		return true;
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch b/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch
index 0f3ffe14a00c8a..941a2b77371208 100644
--- a/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch
@@ -33,7 +33,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4731,7 +4731,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4721,7 +4721,7 @@ static void ieee80211_8023_xmit(struct i
  
  	ieee80211_aggr_check(sdata, sta, skb);
  
@@ -42,7 +42,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  		tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
  		tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
  		if (tid_tx) {
-@@ -4785,7 +4785,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4775,7 +4775,7 @@ static void ieee80211_8023_xmit(struct i
  	}
  
  	dev_sw_netstats_tx_add(dev, skbs, len);
diff --git a/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch b/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
index 05f75c2172d665..99feb3b6b0555b 100644
--- a/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
@@ -44,7 +44,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  /* misc utils */
  
  static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
-@@ -4353,7 +4354,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4343,7 +4344,7 @@ void __ieee80211_subif_start_xmit(struct
  		    !is_multicast_ether_addr(skb->data)) {
  			if (sta)
  				key = rcu_dereference(sta->ptk[sta->ptk_idx]);
@@ -53,7 +53,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  			rcu_read_unlock();
  			return;
  		}
-@@ -4399,7 +4400,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4389,7 +4390,7 @@ void __ieee80211_subif_start_xmit(struct
  		if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) {
  		    	if (sta)
  				key = rcu_dereference(sta->ptk[sta->ptk_idx]);
@@ -62,7 +62,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  		} else {
  			dev_sw_netstats_tx_add(dev, 1, skb->len);
  			ieee80211_xmit(sdata, sta, skb);
-@@ -4699,7 +4700,8 @@ static bool ieee80211_tx_8023(struct iee
+@@ -4689,7 +4690,8 @@ static bool ieee80211_tx_8023(struct iee
  
  static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
  				struct net_device *dev, struct sta_info *sta,
@@ -72,7 +72,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  {
  	struct ieee80211_tx_info *info;
  	struct ethhdr *ehdr = (struct ethhdr *)skb->data;
-@@ -4755,6 +4757,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4745,6 +4747,7 @@ static void ieee80211_8023_xmit(struct i
  	info = IEEE80211_SKB_CB(skb);
  	memset(info, 0, sizeof(*info));
  
@@ -80,7 +80,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  	info->hw_queue = sdata->vif.hw_queue[queue];
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
-@@ -4775,11 +4778,12 @@ static void ieee80211_8023_xmit(struct i
+@@ -4765,11 +4768,12 @@ static void ieee80211_8023_xmit(struct i
  			memcpy(IEEE80211_SKB_CB(seg), info, sizeof(*info));
  	}
  
@@ -96,7 +96,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  		if (info->status_data)
  			info->status_data_idr = 1;
  	}
-@@ -4802,7 +4806,8 @@ out_free:
+@@ -4792,7 +4796,8 @@ out_free:
  
  void ieee80211_8023_xmit_ap(struct ieee80211_sub_if_data *sdata,
  			    struct net_device *dev, struct sta_info *sta,
@@ -106,7 +106,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  {
  	struct ieee80211_tx_info *info;
  	struct ieee80211_local *local = sdata->local;
-@@ -4811,6 +4816,9 @@ void ieee80211_8023_xmit_ap(struct ieee8
+@@ -4801,6 +4806,9 @@ void ieee80211_8023_xmit_ap(struct ieee8
  	unsigned long flags;
  	int q;
  	u16 q_map;
@@ -116,7 +116,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  	/*
  	 * If the skb is shared we need to obtain our own copy.
-@@ -4822,11 +4830,13 @@ void ieee80211_8023_xmit_ap(struct ieee8
+@@ -4812,11 +4820,13 @@ void ieee80211_8023_xmit_ap(struct ieee8
  
  	info = IEEE80211_SKB_CB(skb);
  	memset(info, 0, sizeof(*info));
@@ -133,7 +133,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  	info->flags |= IEEE80211_TX_CTL_HW_80211_ENCAP;
  	info->control.vif = &sdata->vif;
-@@ -4860,14 +4870,23 @@ void ieee80211_8023_xmit_ap(struct ieee8
+@@ -4850,14 +4860,23 @@ void ieee80211_8023_xmit_ap(struct ieee8
  	drv_tx(local, &control, skb);
  
  }
@@ -158,7 +158,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  #ifdef CPTCFG_MAC80211_NSS_SUPPORT
  	ieee80211_xmit_nss_fixup(skb, dev);
-@@ -4883,14 +4902,15 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4873,14 +4892,15 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		kfree_skb(skb);
  		goto out;
  	}
@@ -176,7 +176,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  		goto skip_offload;
  
  	key = rcu_dereference(sta->ptk[sta->ptk_idx]);
-@@ -4901,13 +4921,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4891,13 +4911,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		goto skip_offload;
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP) {
@@ -192,7 +192,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  	goto out;
  
  skip_offload:
-@@ -6429,7 +6449,10 @@ int ieee80211_tx_control_port(struct wip
+@@ -6419,7 +6439,10 @@ int ieee80211_tx_control_port(struct wip
  
  start_xmit:
  	local_bh_disable();
diff --git a/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch b/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
index 702e8d57c0f72e..e4a9c645cf5935 100644
--- a/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
@@ -31,7 +31,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
  				struct net_device *dev, struct sta_info *sta,
  				struct ieee80211_key *key, struct sk_buff *skb,
-@@ -3668,7 +3670,7 @@ ieee80211_sdata_netdev_features(struct i
+@@ -3658,7 +3660,7 @@ ieee80211_sdata_netdev_features(struct i
  }
  
  static struct sk_buff *
@@ -40,7 +40,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  {
  	if (skb_is_gso(skb)) {
  		struct sk_buff *segs;
-@@ -3686,7 +3688,7 @@ ieee80211_tx_skb_fixup(struct sk_buff *s
+@@ -3676,7 +3678,7 @@ ieee80211_tx_skb_fixup(struct sk_buff *s
  	if (skb_needs_linearize(skb, features) && __skb_linearize(skb))
  		goto free;
  
@@ -49,7 +49,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  		int ofs = skb_checksum_start_offset(skb);
  
  		if (skb->encapsulation)
-@@ -3832,7 +3834,7 @@ static bool ieee80211_xmit_fast(struct i
+@@ -3822,7 +3824,7 @@ static bool ieee80211_xmit_fast(struct i
  	memcpy(&eth, skb->data, ETH_HLEN - 2);
  
  	/* after this point (skb is modified) we cannot return false */
@@ -58,7 +58,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	if (!skb)
  		return true;
  
-@@ -4377,7 +4379,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4367,7 +4369,7 @@ void __ieee80211_subif_start_xmit(struct
  	 * things so we cannot really handle checksum or GSO offload.
  	 * fix it up in software before we handle anything else.
  	 */
@@ -67,7 +67,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	if (!skb) {
  		len = 0;
  		goto out;
-@@ -4750,7 +4752,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4740,7 +4742,7 @@ static void ieee80211_8023_xmit(struct i
  		}
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch b/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
index 201e65cab69230..0280f765e036dd 100644
--- a/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
@@ -83,7 +83,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  		return false;
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-@@ -4362,7 +4369,8 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4352,7 +4359,8 @@ void __ieee80211_subif_start_xmit(struct
  		}
  	}
  
@@ -93,7 +93,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	ieee80211_aggr_check(sdata, sta, skb);
  
  	if (sta) {
-@@ -4716,8 +4724,10 @@ static void ieee80211_8023_xmit(struct i
+@@ -4706,8 +4714,10 @@ static void ieee80211_8023_xmit(struct i
  	bool multicast;
  	u8 tid;
  
@@ -106,7 +106,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  
  	multicast = is_multicast_ether_addr(ra);
  
-@@ -6436,9 +6446,12 @@ int ieee80211_tx_control_port(struct wip
+@@ -6426,9 +6436,12 @@ int ieee80211_tx_control_port(struct wip
  	}
  
  	if (!IS_ERR(sta)) {
diff --git a/package/kernel/mac80211/patches/nss/subsys/829-mac80211-fix-mesh-ping-issue.patch b/package/kernel/mac80211/patches/nss/subsys/829-mac80211-fix-mesh-ping-issue.patch
index 2274c6f1a4a099..5a4423d5c7900f 100644
--- a/package/kernel/mac80211/patches/nss/subsys/829-mac80211-fix-mesh-ping-issue.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/829-mac80211-fix-mesh-ping-issue.patch
@@ -10,7 +10,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
 
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -4709,16 +4709,14 @@ void ieee80211_check_fast_rx(struct sta_
+@@ -4711,16 +4711,14 @@ void ieee80211_check_fast_rx(struct sta_
  
  		break;
  	case NL80211_IFTYPE_MESH_POINT:
@@ -30,7 +30,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  	default:
  		goto clear;
  	}
-@@ -4940,10 +4938,7 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4942,10 +4940,7 @@ static bool ieee80211_invoke_fast_rx(str
  		u8 sa[ETH_ALEN];
  	} addrs __aligned(2);
  	struct ieee80211_sta_rx_stats *stats;
@@ -41,7 +41,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  	/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
  	 * to a common data structure; drivers can implement that per queue
-@@ -4993,37 +4988,6 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4995,37 +4990,6 @@ static bool ieee80211_invoke_fast_rx(str
  		snap_offs += IEEE80211_CCMP_HDR_LEN;
  	}
  
@@ -79,7 +79,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  	if (!ieee80211_vif_is_mesh(&rx->sdata->vif) &&
  	    !(status->rx_flags & IEEE80211_RX_AMSDU)) {
  		if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
-@@ -5061,30 +5025,6 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -5063,30 +5027,6 @@ static bool ieee80211_invoke_fast_rx(str
  		return true;
  	}
  

From 365b7481df8d969319d5ef265d673609c08259cd Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Thu, 1 Aug 2024 11:39:59 -0400
Subject: [PATCH 158/225] ath11k_nss: Possible fix for WDS

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...75-wifi-mac80211-Changes-for-WDS-MLD.patch | 210 ++++++++++++++++++
 1 file changed, 210 insertions(+)
 create mode 100644 package/kernel/mac80211/patches/nss/subsys/999-775-wifi-mac80211-Changes-for-WDS-MLD.patch

diff --git a/package/kernel/mac80211/patches/nss/subsys/999-775-wifi-mac80211-Changes-for-WDS-MLD.patch b/package/kernel/mac80211/patches/nss/subsys/999-775-wifi-mac80211-Changes-for-WDS-MLD.patch
new file mode 100644
index 00000000000000..b3410578a5a02d
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/subsys/999-775-wifi-mac80211-Changes-for-WDS-MLD.patch
@@ -0,0 +1,210 @@
+From abd9e23af3835b9d21b9e0b9d885142dff73d741 Mon Sep 17 00:00:00 2001
+From: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
+Date: Wed, 17 May 2023 16:26:23 +0530
+Subject: [PATCH] cfg80211/mac80211: Changes for WDS MLD
+
+Add link id attributes for NL80211_CMD_UNEXPECTED_4ADDR_FRAME.
+
+Based on the station's link, add links to the vlan interface
+
+Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
+---
+ include/net/cfg80211.h |  4 +++-
+ net/mac80211/cfg.c     | 37 +++++++++++++++++++++++++++++++++++++
+ net/mac80211/rx.c      |  8 +++++---
+ net/wireless/nl80211.c | 13 +++++++++----
+ 4 files changed, 54 insertions(+), 8 deletions(-)
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -8760,6 +8760,7 @@ bool cfg80211_rx_spurious_frame(struct n
+  * @dev: The device the frame matched to
+  * @addr: the transmitter address
+  * @gfp: context flags
++ * @link_id: link id
+  *
+  * This function is used in AP mode (only!) to inform userspace that
+  * an associated station sent a 4addr frame but that wasn't expected.
+@@ -8769,7 +8770,8 @@ bool cfg80211_rx_spurious_frame(struct n
+  * for a reason other than not having a subscription.)
+  */
+ bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
+-					const u8 *addr, gfp_t gfp);
++					const u8 *addr, gfp_t gfp,
++					const int link_id);
+ 
+ /**
+  * cfg80211_probe_status - notify userspace about probe status
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -2189,9 +2189,16 @@ static int ieee80211_change_station(stru
+ 		vlansdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
+ 
+ 		if (params->vlan->ieee80211_ptr->use_4addr) {
++			struct ieee80211_sub_if_data *master;
++			struct wireless_dev *wdev;
++
+ 			if (vlansdata->u.vlan.sta)
+ 				return -EBUSY;
+ 
++			wdev = &vlansdata->wdev;
++			master = container_of(vlansdata->bss,
++					      struct ieee80211_sub_if_data, u.ap);
++
+ 			rcu_assign_pointer(vlansdata->u.vlan.sta, sta);
+ 			__ieee80211_check_fast_rx_iface(vlansdata);
+ 
+@@ -2201,6 +2208,39 @@ static int ieee80211_change_station(stru
+ 			else
+ 				drv_sta_set_4addr(local, sta->sdata, &sta->sta,
+ 						  true);
++			if (sta->sta.valid_links) {
++				int link_id;
++				unsigned long valid_links = master->vif.valid_links;
++				for_each_set_bit(link_id,
++						 &valid_links,
++						 IEEE80211_MLD_MAX_NUM_LINKS) {
++					if (!(sta->sta.valid_links & BIT(link_id))) {
++						rcu_assign_pointer(
++						vlansdata->vif.link_conf[link_id],
++						NULL);
++						rcu_assign_pointer(
++						vlansdata->link[link_id],
++						NULL);
++						memset(wdev->links[link_id].addr,
++						       0, ETH_ALEN);
++						vlansdata->vif.valid_links &=
++								~BIT(link_id);
++						wdev->valid_links &= ~BIT(link_id);
++					}
++					else {
++						rcu_assign_pointer(
++						vlansdata->vif.link_conf[link_id],
++						master->vif.link_conf[link_id]);
++						rcu_assign_pointer(vlansdata->link[link_id],
++								   master->link[link_id]);
++						memcpy(wdev->links[link_id].addr,
++						       vlansdata->vif.link_conf[link_id]->bssid,
++							ETH_ALEN);
++						vlansdata->vif.valid_links |= BIT(link_id);
++						wdev->valid_links |= BIT(link_id);
++					}
++				}
++			}
+ 		}
+ 
+ 		if (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1683,7 +1683,7 @@ EXPORT_SYMBOL(ieee80211_sta_uapsd_trigge
+ 
+ void ieee80211_rx_nss_notify_4addr(struct net_device *dev, u8 *sta_addr)
+ {
+-	cfg80211_rx_unexpected_4addr_frame(dev, sta_addr, GFP_ATOMIC);
++	cfg80211_rx_unexpected_4addr_frame(dev, sta_addr, GFP_ATOMIC, -1);
+ }
+ EXPORT_SYMBOL(ieee80211_rx_nss_notify_4addr);
+ 
+@@ -1858,7 +1858,8 @@ ieee80211_rx_h_sta_process(struct ieee80
+ 			if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT))
+ 				cfg80211_rx_unexpected_4addr_frame(
+ 					rx->sdata->dev, sta->sta.addr,
+-					GFP_ATOMIC);
++					GFP_ATOMIC,
++					rx->link_id);
+ 			return RX_DROP_M_UNEXPECTED_4ADDR_FRAME;
+ 		}
+ 		/*
+@@ -3245,7 +3246,8 @@ ieee80211_rx_h_data(struct ieee80211_rx_
+ 		if (rx->sta &&
+ 		    !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT))
+ 			cfg80211_rx_unexpected_4addr_frame(
+-				rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC);
++				rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC,
++				rx->link_id);
+ 		return RX_DROP_MONITOR;
+ 	}
+ 
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -18887,7 +18887,8 @@ void cfg80211_conn_failed(struct net_dev
+ EXPORT_SYMBOL(cfg80211_conn_failed);
+ 
+ static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
+-				       const u8 *addr, gfp_t gfp)
++				       const u8 *addr, gfp_t gfp,
++				       const int link_id)
+ {
+ 	struct wireless_dev *wdev = dev->ieee80211_ptr;
+ 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
+@@ -18913,6 +18914,9 @@ static bool __nl80211_unexpected_frame(s
+ 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
+ 		goto nla_put_failure;
+ 
++	if (link_id != -1)
++		nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id);
++
+ 	genlmsg_end(msg, hdr);
+ 	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
+ 	return true;
+@@ -18936,14 +18940,15 @@ bool cfg80211_rx_spurious_frame(struct n
+ 		return false;
+ 	}
+ 	ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
+-					 addr, gfp);
++					 addr, gfp, -1);
+ 	trace_cfg80211_return_bool(ret);
+ 	return ret;
+ }
+ EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
+ 
+ bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
+-					const u8 *addr, gfp_t gfp)
++					const u8 *addr, gfp_t gfp,
++					const int link_id)
+ {
+ 	struct wireless_dev *wdev = dev->ieee80211_ptr;
+ 	bool ret;
+@@ -18958,7 +18963,7 @@ bool cfg80211_rx_unexpected_4addr_frame(
+ 	}
+ 	ret = __nl80211_unexpected_frame(dev,
+ 					 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
+-					 addr, gfp);
++					 addr, gfp, link_id);
+ 	trace_cfg80211_return_bool(ret);
+ 	return ret;
+ }
+--- a/net/mac80211/chan.c
++++ b/net/mac80211/chan.c
+@@ -979,6 +979,8 @@ __ieee80211_link_copy_chanctx_to_vlans(s
+ 	list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list) {
+ 		struct ieee80211_bss_conf *vlan_conf;
+ 
++		if (!(vlan->vif.valid_links & BIT(link_id)))
++			continue;
+ 		vlan_conf = wiphy_dereference(local->hw.wiphy,
+ 					      vlan->vif.link_conf[link_id]);
+ 		if (WARN_ON(!vlan_conf))
+@@ -1220,6 +1222,8 @@ ieee80211_link_update_chanreq(struct iee
+ 	list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list) {
+ 		struct ieee80211_bss_conf *vlan_conf;
+ 
++		if (!(vlan->vif.valid_links & BIT(link_id)))
++			continue;
+ 		vlan_conf = wiphy_dereference(sdata->local->hw.wiphy,
+ 					      vlan->vif.link_conf[link_id]);
+ 		if (WARN_ON(!vlan_conf))
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -1847,9 +1847,9 @@ void ieee80211_send_4addr_nullfunc(struc
+ 	fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
+ 			 IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
+ 	nullfunc->frame_control = fc;
+-	memcpy(nullfunc->addr1, sdata->deflink.u.mgd.bssid, ETH_ALEN);
++	memcpy(nullfunc->addr1, sdata->vif.cfg.ap_addr, ETH_ALEN);
+ 	memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
+-	memcpy(nullfunc->addr3, sdata->deflink.u.mgd.bssid, ETH_ALEN);
++	memcpy(nullfunc->addr3, sdata->vif.cfg.ap_addr, ETH_ALEN);
+ 	memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);
+ 
+ 	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;

From 63f22734cec9968bec09ea5d1755ff16df047253 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Thu, 1 Aug 2024 11:08:38 -0400
Subject: [PATCH 159/225] ath11k_nss: Fix RX thermal throttling on newer 2.12
 firmware
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There is an issue when enabling thermal support on newer ath11k firmware.
TX/RX rates are being limited, often times 50% of client's HE
capabilities.

The issue stems from a mismatch in WMI API structure. The range to
throttle is currently "-100°C" to "150°C", this essentially means
"always" throttle.

Integrate patch from dd-wrt which adds missing WMI structures and
proper thermal ranges for IPQ5018, IPQ807x, and QCN9000.

Patch-by: Sebastian Gottschall <s.gottschall@dd-wrt.com>
Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...99-802-ath11k-fixup-thermal-throttle.patch | 241 ++++++++++++++++++
 1 file changed, 241 insertions(+)
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/999-802-ath11k-fixup-thermal-throttle.patch

diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-802-ath11k-fixup-thermal-throttle.patch b/package/kernel/mac80211/patches/nss/ath11k/999-802-ath11k-fixup-thermal-throttle.patch
new file mode 100644
index 00000000000000..d392a16a978246
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-802-ath11k-fixup-thermal-throttle.patch
@@ -0,0 +1,241 @@
+--- a/drivers/net/wireless/ath/ath11k/thermal.c
++++ b/drivers/net/wireless/ath/ath11k/thermal.c
+@@ -135,16 +135,69 @@ int ath11k_thermal_set_throttling(struct
+ 	if (ar->state != ATH11K_STATE_ON)
+ 		return 0;
+ 
++	ar->thermal.throttle_state = throttle_state;
+ 	memset(&param, 0, sizeof(param));
+ 	param.pdev_id = ar->pdev->pdev_id;
+ 	param.enable = throttle_state ? 1 : 0;
+ 	param.dc = ATH11K_THERMAL_DEFAULT_DUTY_CYCLE;
+ 	param.dc_per_event = 0xFFFFFFFF;
+ 
+-	param.levelconf[0].tmplwm = ATH11K_THERMAL_TEMP_LOW_MARK;
+-	param.levelconf[0].tmphwm = ATH11K_THERMAL_TEMP_HIGH_MARK;
+-	param.levelconf[0].dcoffpercent = throttle_state;
+-	param.levelconf[0].priority = 0; /* disable all data tx queues */
++	switch (ab->hw_rev) {
++	case ATH11K_HW_QCN9074_HW10:
++		param.levelconf[0].tmplwm =
++			ATH11K_THERMAL_TEMP0_LOW_MARK_QCN9000;
++		param.levelconf[0].tmphwm =
++			ATH11K_THERMAL_TEMP0_HIGH_MARK_QCN9000;
++		param.levelconf[1].tmplwm =
++			ATH11K_THERMAL_TEMP1_LOW_MARK_QCN9000;
++		param.levelconf[1].tmphwm =
++			ATH11K_THERMAL_TEMP1_HIGH_MARK_QCN9000;
++		param.levelconf[2].tmplwm =
++			ATH11K_THERMAL_TEMP2_LOW_MARK_QCN9000;
++		param.levelconf[2].tmphwm =
++			ATH11K_THERMAL_TEMP2_HIGH_MARK_QCN9000;
++		param.levelconf[3].tmplwm =
++			ATH11K_THERMAL_TEMP3_LOW_MARK_QCN9000;
++		param.levelconf[3].tmphwm =
++			ATH11K_THERMAL_TEMP3_HIGH_MARK_QCN9000;
++		break;
++	case ATH11K_HW_IPQ5018_HW10:
++		param.levelconf[0].tmplwm =
++			ATH11K_THERMAL_TEMP0_LOW_MARK_IPQ5018;
++		param.levelconf[0].tmphwm =
++			ATH11K_THERMAL_TEMP0_HIGH_MARK_IPQ5018;
++		param.levelconf[1].tmplwm =
++			ATH11K_THERMAL_TEMP1_LOW_MARK_IPQ5018;
++		param.levelconf[1].tmphwm =
++			ATH11K_THERMAL_TEMP1_HIGH_MARK_IPQ5018;
++		param.levelconf[2].tmplwm =
++			ATH11K_THERMAL_TEMP2_LOW_MARK_IPQ5018;
++		param.levelconf[2].tmphwm =
++			ATH11K_THERMAL_TEMP2_HIGH_MARK_IPQ5018;
++		param.levelconf[3].tmplwm =
++			ATH11K_THERMAL_TEMP3_LOW_MARK_IPQ5018;
++		param.levelconf[3].tmphwm =
++			ATH11K_THERMAL_TEMP3_HIGH_MARK_IPQ5018;
++		break;
++	default:
++		param.levelconf[0].tmplwm = ATH11K_THERMAL_TEMP0_LOW_MARK;
++		param.levelconf[0].tmphwm = ATH11K_THERMAL_TEMP0_HIGH_MARK;
++		param.levelconf[1].tmplwm = ATH11K_THERMAL_TEMP1_LOW_MARK;
++		param.levelconf[1].tmphwm = ATH11K_THERMAL_TEMP1_HIGH_MARK;
++		param.levelconf[2].tmplwm = ATH11K_THERMAL_TEMP2_LOW_MARK;
++		param.levelconf[2].tmphwm = ATH11K_THERMAL_TEMP2_HIGH_MARK;
++		param.levelconf[3].tmplwm = ATH11K_THERMAL_TEMP3_LOW_MARK;
++		param.levelconf[3].tmphwm = ATH11K_THERMAL_TEMP3_HIGH_MARK;
++		break;
++	}
++	param.levelconf[0].dcoffpercent = ATH11K_THERMAL_CONFIG_DCOFF0;
++	param.levelconf[0].priority = 7; /* all unicast frames */
++	param.levelconf[1].dcoffpercent = ATH11K_THERMAL_CONFIG_DCOFF1;
++	param.levelconf[1].priority = 7; /* all unicast frames */
++	param.levelconf[2].dcoffpercent = ATH11K_THERMAL_CONFIG_DCOFF2;
++	param.levelconf[2].priority = 7; /* all unicast frames */
++	param.levelconf[3].dcoffpercent = ATH11K_THERMAL_CONFIG_DCOFF3;
++	param.levelconf[3].priority = 7; /* all unicast frames */
+ 
+ 	ret = ath11k_wmi_send_thermal_mitigation_param_cmd(ar, &param);
+ 	if (ret) {
+--- a/drivers/net/wireless/ath/ath11k/thermal.h
++++ b/drivers/net/wireless/ath/ath11k/thermal.h
+@@ -7,8 +7,56 @@
+ #ifndef _ATH11K_THERMAL_
+ #define _ATH11K_THERMAL_
+ 
+-#define ATH11K_THERMAL_TEMP_LOW_MARK -100
+-#define ATH11K_THERMAL_TEMP_HIGH_MARK 150
++
++#define ATH11K_THERMAL_MAX_TEMPERATURE_QCN9000 120
++#define ATH11K_THERMAL_MAX_TEMPERATURE 150
++
++#define ATH11K_THERMAL_TEMP_INFINITE -100
++#define ATH11K_THERMAL_TEMP0_LOW_MARK ATH11K_THERMAL_TEMP_INFINITE
++#define ATH11K_THERMAL_TEMP1_LOW_MARK 100
++#define ATH11K_THERMAL_TEMP2_LOW_MARK 110
++#define ATH11K_THERMAL_TEMP3_LOW_MARK 125
++
++#define ATH11K_THERMAL_TEMP0_HIGH_MARK 110
++#define ATH11K_THERMAL_TEMP1_HIGH_MARK 120
++#define ATH11K_THERMAL_TEMP2_HIGH_MARK 135
++#define ATH11K_THERMAL_TEMP3_HIGH_MARK ATH11K_THERMAL_MAX_TEMPERATURE
++
++#define ATH11K_THERMAL_TEMP0_LOW_MARK_QCN9000 ATH11K_THERMAL_TEMP_INFINITE
++#define ATH11K_THERMAL_TEMP1_LOW_MARK_QCN9000 95
++#define ATH11K_THERMAL_TEMP2_LOW_MARK_QCN9000 100
++#define ATH11K_THERMAL_TEMP3_LOW_MARK_QCN9000 105
++
++#define ATH11K_THERMAL_TEMP0_HIGH_MARK_QCN9000 100
++#define ATH11K_THERMAL_TEMP1_HIGH_MARK_QCN9000 105
++#define ATH11K_THERMAL_TEMP2_HIGH_MARK_QCN9000 110
++#define ATH11K_THERMAL_TEMP3_HIGH_MARK_QCN9000 ATH11K_THERMAL_MAX_TEMPERATURE_QCN9000
++
++#define ATH11K_THERMAL_TEMP0_LOW_MARK_IPQ5018 ATH11K_THERMAL_TEMP_INFINITE
++#define ATH11K_THERMAL_TEMP1_LOW_MARK_IPQ5018 95
++#define ATH11K_THERMAL_TEMP2_LOW_MARK_IPQ5018 100
++#define ATH11K_THERMAL_TEMP3_LOW_MARK_IPQ5018 105
++
++#define ATH11K_THERMAL_TEMP0_HIGH_MARK_IPQ5018 105
++#define ATH11K_THERMAL_TEMP1_HIGH_MARK_IPQ5018 110
++#define ATH11K_THERMAL_TEMP2_HIGH_MARK_IPQ5018 115
++#define ATH11K_THERMAL_TEMP3_HIGH_MARK_IPQ5018 ATH11K_THERMAL_MAX_TEMPERATURE_QCN9000
++
++#define ATH11K_THERMAL_CONFIG_DCOFF0 0
++#define ATH11K_THERMAL_CONFIG_DCOFF1 50
++#define ATH11K_THERMAL_CONFIG_DCOFF2 90
++#define ATH11K_THERMAL_CONFIG_DCOFF3 100
++
++/* This is TX power reduction scaling factor in terms of 0.25db.
++ * Currently for all the levels from 1 to 4 in the enhanced thermal
++ * levels, the pout value will be reduced by -3dB (12 * 0.25).
++ * Customer will have option to configure the power out per thermal level.
++ */
++#define ATH11K_THERMAL_CONFIG_POUT1 12
++#define ATH11K_THERMAL_CONFIG_POUT2 12
++#define ATH11K_THERMAL_CONFIG_POUT3 12
++#define ATH11K_THERMAL_CONFIG_POUT4 12
++
+ #define ATH11K_THERMAL_THROTTLE_MAX     100
+ #define ATH11K_THERMAL_DEFAULT_DUTY_CYCLE 100
+ #define ATH11K_HWMON_NAME_LEN           15
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -3193,6 +3193,7 @@ ath11k_wmi_send_thermal_mitigation_param
+ 		lvl_conf->temp_hwm = param->levelconf[i].tmphwm;
+ 		lvl_conf->dc_off_percent = param->levelconf[i].dcoffpercent;
+ 		lvl_conf->prio = param->levelconf[i].priority;
++		lvl_conf->pout_reduction_25db = 0;
+ 		lvl_conf++;
+ 	}
+ 
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -4053,12 +4053,14 @@ struct wmi_11d_new_cc_ev {
+ 	u32 new_alpha2;
+ } __packed;
+ 
+-#define THERMAL_LEVELS  1
++#define THERMAL_LEVELS  4
+ struct tt_level_config {
+ 	u32 tmplwm;
+ 	u32 tmphwm;
+ 	u32 dcoffpercent;
+ 	u32 priority;
++	u32 pout_reduction_25db;
++	u32 tx_chain_mask;
+ };
+ 
+ struct thermal_mitigation_params {
+@@ -4069,6 +4071,14 @@ struct thermal_mitigation_params {
+ 	struct tt_level_config levelconf[THERMAL_LEVELS];
+ };
+ 
++typedef enum {
++    WMI_THERMAL_CLIENT_UNSPECIFIED = 0,
++    WMI_THERMAL_CLIENT_APPS        = 1,
++    WMI_THERMAL_CLIENT_WPSS        = 2,
++    WMI_THERMAL_CLIENT_FW          = 3,
++    WMI_THERMAL_CLIENT_MAX
++} WMI_THERMAL_MITIGATION_CLIENTS;
++
+ struct wmi_therm_throt_config_request_cmd {
+ 	u32 tlv_header;
+ 	u32 pdev_id;
+@@ -4076,14 +4086,48 @@ struct wmi_therm_throt_config_request_cm
+ 	u32 dc;
+ 	u32 dc_per_event;
+ 	u32 therm_throt_levels;
++	u32 client_id; /* Indicates the client from whom the request is being forwarded to FW. Refer to WMI_THERMAL_MITIGATION_CLIENTS. */
++	u32 priority;  /* Indicates the priority, higher the value, higher the priority. Varies from 1 to WMI_THERMAL_CLIENT_MAX_PRIORITY. */
+ } __packed;
+ 
+ struct wmi_therm_throt_level_config_info {
+ 	u32 tlv_header;
++	/** temp_lwm:
++	 * temperature sensor value in celsius when to exit to lower zone,
++	 * this value can be lower than HWM of lower zone as zone overlapping
++	 * is permitted by design to provide hysteresis
++	 */
+ 	u32 temp_lwm;
++	/** temp_hwm:
++	 * temperature sensor value in celsius when to exit to higher zone,
++	 * this value can be higher than LWM of higher zone as zone overlapping
++	 * is permitted by design to provide hysteresis
++	 */
+ 	u32 temp_hwm;
++	/** dc_off_percent:
++	 * duty cycle off percent 0-100.
++	 * 0 means no off, 100 means no on (shutdown the phy).
++	 */
+ 	u32 dc_off_percent;
++	/** prio:
++	 * Disable only the transmit queues in firmware that have lower priority
++	 * than value defined by prio.
++	 * Prioritization:
++	 * 0 = disable all data tx queues, No Prioritization defined
++	 * 1 = disable BK tx queue
++	 * 2 = disable BK+BE tx queues
++	 * 3 = disable BK+BE+VI tx queues
++	 */
+ 	u32 prio;
++	/**
++	 * Pout power reduction in 0.25 dB units.
++	 * For example, a value of 5 causes a power reduction of 1.25 dB.
++	 */
++	u32 pout_reduction_25db;
++	/** tx chain mask:
++	 * Chain mask to apply based on the temp level
++	 */
++	u32 tx_chain_mask;
+ } __packed;
+ 
+ struct wmi_delba_send_cmd {
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -6591,6 +6591,9 @@ static int ath11k_mac_op_start(struct ie
+ 		}
+ 	}
+ 
++	/* set default thermal throttling */
++	ath11k_thermal_set_throttling(ar, 1);
++
+ 	mutex_unlock(&ar->conf_mutex);
+ 
+ 	rcu_assign_pointer(ab->pdevs_active[ar->pdev_idx],

From aa7068170e2bae04346b7a5beed1f73ef8be284d Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Thu, 1 Aug 2024 11:41:56 -0400
Subject: [PATCH 160/225] ath11k_nss: WAR for association failure issue with
 WDS

Every 100 milliseconds, the station sends an "association request" and
the AP adds the peer and the AP responds to the station with an
"association response".

But "association response" takes time to reach the station. Because of
this, the station sends another "association request" to the AP.

In the second associate request, the AP removes the peer and re-adds
the station. Meanwhile, "association response" is reached to station
and station sends "QoS NULL" frame to AP.

The moment the station sends a QoS NULL frame to the ap, the peer on
the AP is deleted and the AP sends a de-authentication to the station.

To fix this issue, increased the assoc timeout period from 100 milli-
seconds to 500 milli seconds.

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...R-for-association-failure-issue-with.patch | 38 +++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 package/kernel/mac80211/patches/nss/subsys/917-QSDK-mac80211-WAR-for-association-failure-issue-with.patch

diff --git a/package/kernel/mac80211/patches/nss/subsys/917-QSDK-mac80211-WAR-for-association-failure-issue-with.patch b/package/kernel/mac80211/patches/nss/subsys/917-QSDK-mac80211-WAR-for-association-failure-issue-with.patch
new file mode 100644
index 00000000000000..6efc623307939e
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/subsys/917-QSDK-mac80211-WAR-for-association-failure-issue-with.patch
@@ -0,0 +1,38 @@
+From 3bce46935954d8439e980a2188a6befbb42a3803 Mon Sep 17 00:00:00 2001
+From: Balamurugan Ramar <quic_bramar@quicinc.com>
+Date: Wed, 8 May 2024 23:01:34 +0530
+Subject: [PATCH] QSDK: mac80211: WAR for association failure issue with WDS
+
+Every 100 milliseconds, the station sends an "association request" and
+the AP adds the peer and the AP responds to the station with an
+"association response".
+
+But "association response" takes time to reach the station. Because of
+this, the station sends another "association request" to the AP.
+
+In the second associate request, the AP removes the peer and re-adds
+the station. Meanwhile, "association response" is reached to station
+and station sends "QoS NULL" frame to AP.
+
+The moment the station sends a QoS NULL frame to the ap, the peer on
+the AP is deleted and the AP sends a de-authentication to the station.
+
+To fix this issue, increased the assoc timeout period from 100 milli-
+seconds to 500 milli seconds.
+
+Signed-off-by: Balamurugan Ramar <quic_bramar@quicinc.com>
+---
+ net/mac80211/mlme.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -7144,7 +7144,7 @@ void ieee80211_sta_work(struct ieee80211
+ 			 */
+ 			if (status_acked) {
+ 				ifmgd->assoc_data->timeout =
+-					jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
++					jiffies + IEEE80211_ASSOC_TIMEOUT_LONG;
+ 				run_again(sdata, ifmgd->assoc_data->timeout);
+ 			} else {
+ 				ifmgd->assoc_data->timeout = jiffies - 1;

From 398746fc696f8ed9e01b4c57a7f6e280a162a4a4 Mon Sep 17 00:00:00 2001
From: Sebastian Gottschall <s.gottschall@dd-wrt.com>
Date: Tue, 6 Aug 2024 14:34:54 +0700
Subject: [PATCH 161/225] ath11k_nss: fix bss transition firmware crash

fixes: ath11k: fix peer addition/deletion error on sta band migration: d673cb6fe6c03b2be157cc6c5db40481828d282d

the fix for sta band migration raises a new bug which causes the wifi
firmware to crash if you switch between 2 bssid's on the same band. this is
usually caused since the firmware observes 2 stations with the same
bss

Signed-off-by: Sebastian Gottschall <s.gottschall@dd-wrt.com>

Update 999-900-bss-transition-handling.patch

Signed-off-by: qosmio <datapronix@protonmail.com>
---
 .../999-900-bss-transition-handling.patch     | 2632 +++++++++++++++++
 1 file changed, 2632 insertions(+)
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch

diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch b/package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch
new file mode 100644
index 00000000000000..1c87a83ea3e079
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch
@@ -0,0 +1,2632 @@
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -2041,10 +2041,10 @@ void ath11k_core_pre_reconfigure_recover
+ 		ar->monitor_vdev_id = -1;
+ 		clear_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags);
+ 		clear_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags);
++		wake_up(&ar->peer_mapping_wq);
+ 	}
+ 
+ 	wake_up(&ab->wmi_ab.tx_credits_wq);
+-	wake_up(&ab->peer_mapping_wq);
+ 
+ 	reinit_completion(&ab->driver_recovery);
+ }
+@@ -2320,7 +2320,6 @@ struct ath11k_base *ath11k_core_alloc(st
+ 		goto err_free_wq;
+ 
+ 	mutex_init(&ab->core_lock);
+-	mutex_init(&ab->tbl_mtx_lock);
+ 	mutex_init(&ab->base_ast_lock);
+ 	spin_lock_init(&ab->base_lock);
+ 	mutex_init(&ab->vdev_id_11d_lock);
+@@ -2328,8 +2327,6 @@ struct ath11k_base *ath11k_core_alloc(st
+ 	init_completion(&ab->reconfigure_complete);
+ 	init_completion(&ab->recovery_start);
+ 
+-	INIT_LIST_HEAD(&ab->peers);
+-	init_waitqueue_head(&ab->peer_mapping_wq);
+ 	init_waitqueue_head(&ab->wmi_ab.tx_credits_wq);
+ 	init_waitqueue_head(&ab->qmi.cold_boot_waitq);
+ 	INIT_WORK(&ab->restart_work, ath11k_core_restart);
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -739,9 +739,22 @@ struct ath11k {
+ 			iftype[NUM_NL80211_BANDS][NUM_NL80211_IFTYPES];
+ 	} mac;
+ 
++	/* To synchronize rhash tbl write operation */
++	struct mutex tbl_mtx_lock;
++
++	/* The rhashtable containing struct ath11k_peer keyed by mac addr */
++	struct rhashtable *rhead_peer_addr;
++	struct rhashtable_params rhash_peer_addr_param;
++
++	/* The rhashtable containing struct ath11k_peer keyed by id  */
++	struct rhashtable *rhead_peer_id;
++	struct rhashtable_params rhash_peer_id_param;
++
++
+ 	unsigned long dev_flags;
+ 	unsigned int filter_flags;
+ 	unsigned long monitor_flags;
++	u32 ack_timeout;
+ 	u32 min_tx_power;
+ 	u32 max_tx_power;
+ 	u32 txpower_limit_2g;
+@@ -819,6 +832,9 @@ struct ath11k {
+ 	struct work_struct wmi_mgmt_tx_work;
+ 	struct sk_buff_head wmi_mgmt_tx_queue;
+ 
++	struct list_head peers;
++	wait_queue_head_t peer_mapping_wq;
++
+ 	struct ath11k_wow wow;
+ 	struct completion target_suspend;
+ 	bool target_suspend_ack;
+@@ -1022,19 +1038,7 @@ struct ath11k_base {
+ 	struct ath11k_hal_reg_capabilities_ext hal_reg_cap[MAX_RADIOS];
+ 	unsigned long long free_vdev_map;
+ 
+-	/* To synchronize rhash tbl write operation */
+-	struct mutex tbl_mtx_lock;
+-
+-	/* The rhashtable containing struct ath11k_peer keyed by mac addr */
+-	struct rhashtable *rhead_peer_addr;
+-	struct rhashtable_params rhash_peer_addr_param;
+ 
+-	/* The rhashtable containing struct ath11k_peer keyed by id  */
+-	struct rhashtable *rhead_peer_id;
+-	struct rhashtable_params rhash_peer_id_param;
+-
+-	struct list_head peers;
+-	wait_queue_head_t peer_mapping_wq;
+ 	u8 mac_addr[ETH_ALEN];
+ 	int userpd_id;
+ 	int irq_num[ATH11K_IRQ_NUM_MAX];
+@@ -1411,4 +1415,36 @@ static inline const char *ath11k_bus_str
+ 	return "unknown";
+ }
+ 
++static inline struct ath11k_peer *ath11k_peer_find_by_addr(struct ath11k *ar,
++					     const u8 *addr)
++{
++	struct ath11k_peer *peer;
++
++	lockdep_assert_held(&ar->ab->base_lock);
++
++	if (!ar->rhead_peer_addr)
++		return NULL;
++
++	peer = rhashtable_lookup_fast(ar->rhead_peer_addr, addr,
++				      ar->rhash_peer_addr_param);
++
++	return peer;
++}
++
++static inline struct ath11k_peer *ath11k_peer_find_by_id(struct ath11k *ar,
++					   int peer_id)
++{
++	struct ath11k_peer *peer;
++
++	lockdep_assert_held(&ar->ab->base_lock);
++
++	if (!ar->rhead_peer_id)
++		return NULL;
++
++	peer = rhashtable_lookup_fast(ar->rhead_peer_id, &peer_id,
++				      ar->rhash_peer_id_param);
++
++	return peer;
++}
++
+ #endif /* _CORE_H_ */
+--- a/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.c
+@@ -4161,7 +4161,7 @@ void htt_print_peer_ctrl_path_txrx_stats
+ 	stats_req->buf_len = len;
+ }
+ 
+-static int ath11k_dbg_htt_ext_stats_parse(struct ath11k_base *ab,
++static int ath11k_dbg_htt_ext_stats_parse(struct ath11k *ar,
+ 					  u16 tag, u16 len, const void *tag_buf,
+ 					  void *user_data)
+ {
+@@ -4591,7 +4591,7 @@ void ath11k_debugfs_htt_ext_stats_handle
+ 	spin_unlock_bh(&ar->debug.htt_stats.lock);
+ 
+ 	len = FIELD_GET(HTT_T2H_EXT_STATS_INFO1_LENGTH, msg->info1);
+-	ret = ath11k_dp_htt_tlv_iter(ab, msg->data, len,
++	ret = ath11k_dp_htt_tlv_iter(ar, msg->data, len,
+ 				     ath11k_dbg_htt_ext_stats_parse,
+ 				     stats_req);
+ 	if (ret)
+--- a/drivers/net/wireless/ath/ath11k/dp.c
++++ b/drivers/net/wireless/ath/ath11k/dp.c
+@@ -27,7 +27,7 @@ void ath11k_dp_peer_cleanup(struct ath11
+ 	/* TODO: Any other peer specific DP cleanup */
+ 
+ 	spin_lock_bh(&ab->base_lock);
+-	peer = ath11k_peer_find(ab, vdev_id, addr);
++	peer = ath11k_peer_find(ar, vdev_id, addr);
+ 	if (!peer) {
+ 		ath11k_warn(ab, "failed to lookup peer %pM on vdev %d\n",
+ 			    addr, vdev_id);
+@@ -90,7 +90,7 @@ int ath11k_dp_peer_setup(struct ath11k *
+ peer_clean:
+ 	spin_lock_bh(&ab->base_lock);
+ 
+-	peer = ath11k_peer_find(ab, vdev_id, addr);
++	peer = ath11k_peer_find(ar, vdev_id, addr);
+ 	if (!peer) {
+ 		ath11k_warn(ab, "failed to find the peer to del rx tid\n");
+ 		spin_unlock_bh(&ab->base_lock);
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -564,7 +564,7 @@ static int ath11k_dp_rxdma_pdev_buf_setu
+ 	int i;
+ 
+ 	/* RXDMA BUF ring is offloaded to NSS */
+-	if (!ar->ab->nss.enabled)
++	if (!ab->nss.enabled)
+ 		ath11k_dp_rxdma_ring_buf_setup(ar, rx_ring, HAL_RXDMA_BUF);
+ 
+ 	if (ar->ab->hw_params.rxdma1_enable) {
+@@ -1118,17 +1118,17 @@ static int ath11k_peer_rx_tid_reo_update
+ 	return 0;
+ }
+ 
+-static void ath11k_dp_rx_tid_mem_free(struct ath11k_base *ab,
++static void ath11k_dp_rx_tid_mem_free(struct ath11k *ar,
+ 				      const u8 *peer_mac, int vdev_id, u8 tid)
+ {
+ 	struct ath11k_peer *peer;
+ 	struct dp_rx_tid *rx_tid;
+ 
+-	spin_lock_bh(&ab->base_lock);
++	spin_lock_bh(&ar->ab->base_lock);
+ 
+-	peer = ath11k_peer_find(ab, vdev_id, peer_mac);
++	peer = ath11k_peer_find(ar, vdev_id, peer_mac);
+ 	if (!peer) {
+-		ath11k_warn(ab, "failed to find the peer to free up rx tid mem\n");
++		ath11k_warn(ar->ab, "failed to find the peer to free up rx tid mem\n");
+ 		goto unlock_exit;
+ 	}
+ 
+@@ -1136,7 +1136,7 @@ static void ath11k_dp_rx_tid_mem_free(st
+ 	if (!rx_tid->active)
+ 		goto unlock_exit;
+ 
+-	dma_unmap_single(ab->dev, rx_tid->paddr, rx_tid->size,
++	dma_unmap_single(ar->ab->dev, rx_tid->paddr, rx_tid->size,
+ 			 DMA_BIDIRECTIONAL);
+ 	kfree(rx_tid->vaddr);
+ 	rx_tid->vaddr = NULL;
+@@ -1144,7 +1144,7 @@ static void ath11k_dp_rx_tid_mem_free(st
+ 	rx_tid->active = false;
+ 
+ unlock_exit:
+-	spin_unlock_bh(&ab->base_lock);
++	spin_unlock_bh(&ar->ab->base_lock);
+ }
+ 
+ /* Sends WMI config to filter packets to route packets to WBM release ring */
+@@ -1185,7 +1185,7 @@ int ath11k_peer_rx_tid_setup(struct ath1
+ 
+ 	spin_lock_bh(&ab->base_lock);
+ 
+-	peer = ath11k_peer_find(ab, vdev_id, peer_mac);
++	peer = ath11k_peer_find(ar, vdev_id, peer_mac);
+ 	if (!peer) {
+ 		ath11k_warn(ab, "failed to find the peer %pM to set up rx tid\n",
+ 			    peer_mac);
+@@ -1261,7 +1261,7 @@ int ath11k_peer_rx_tid_setup(struct ath1
+ 	if (ret) {
+ 		ath11k_warn(ar->ab, "failed to setup rx reorder queue for peer %pM tid %d: %d\n",
+ 			    peer_mac, tid, ret);
+-		ath11k_dp_rx_tid_mem_free(ab, peer_mac, vdev_id, tid);
++		ath11k_dp_rx_tid_mem_free(ar, peer_mac, vdev_id, tid);
+ 	}
+ 
+ 	return ret;
+@@ -1304,7 +1304,7 @@ int ath11k_dp_rx_ampdu_stop(struct ath11
+ 
+ 	spin_lock_bh(&ab->base_lock);
+ 
+-	peer = ath11k_peer_find(ab, vdev_id, params->sta->addr);
++	peer = ath11k_peer_find(ar, vdev_id, params->sta->addr);
+ 	if (!peer) {
+ 		ath11k_warn(ab, "failed to find the peer to stop rx aggregation\n");
+ 		spin_unlock_bh(&ab->base_lock);
+@@ -1381,7 +1381,7 @@ int ath11k_dp_peer_rx_pn_replay_config(s
+ 
+ 	spin_lock_bh(&ab->base_lock);
+ 
+-	peer = ath11k_peer_find(ab, arvif->vdev_id, peer_addr);
++	peer = ath11k_peer_find(ar, arvif->vdev_id, peer_addr);
+ 	if (!peer) {
+ 		ath11k_warn(ab, "failed to find the peer to configure pn replay detection\n");
+ 		spin_unlock_bh(&ab->base_lock);
+@@ -1426,7 +1426,7 @@ static inline int ath11k_get_ppdu_user_i
+ 	return -EINVAL;
+ }
+ 
+-static int ath11k_htt_tlv_ppdu_stats_parse(struct ath11k_base *ab,
++static int ath11k_htt_tlv_ppdu_stats_parse(struct ath11k *ar,
+ 					   u16 tag, u16 len, const void *ptr,
+ 					   void *data)
+ {
+@@ -1441,7 +1441,7 @@ static int ath11k_htt_tlv_ppdu_stats_par
+ 	switch (tag) {
+ 	case HTT_PPDU_STATS_TAG_COMMON:
+ 		if (len < sizeof(struct htt_ppdu_stats_common)) {
+-			ath11k_warn(ab, "Invalid len %d for the tag 0x%x\n",
++			ath11k_warn(ar->ab, "Invalid len %d for the tag 0x%x\n",
+ 				    len, tag);
+ 			return -EINVAL;
+ 		}
+@@ -1470,7 +1470,7 @@ static int ath11k_htt_tlv_ppdu_stats_par
+ 		break;
+ 	case HTT_PPDU_STATS_TAG_USR_RATE:
+ 		if (len < sizeof(struct htt_ppdu_stats_user_rate)) {
+-			ath11k_warn(ab, "Invalid len %d for the tag 0x%x\n",
++			ath11k_warn(ar->ab, "Invalid len %d for the tag 0x%x\n",
+ 				    len, tag);
+ 			return -EINVAL;
+ 		}
+@@ -1489,7 +1489,7 @@ static int ath11k_htt_tlv_ppdu_stats_par
+ 		break;
+ 	case HTT_PPDU_STATS_TAG_USR_COMPLTN_COMMON:
+ 		if (len < sizeof(struct htt_ppdu_stats_usr_cmpltn_cmn)) {
+-			ath11k_warn(ab, "Invalid len %d for the tag 0x%x\n",
++			ath11k_warn(ar->ab, "Invalid len %d for the tag 0x%x\n",
+ 				    len, tag);
+ 			return -EINVAL;
+ 		}
+@@ -1510,7 +1510,7 @@ static int ath11k_htt_tlv_ppdu_stats_par
+ 	case HTT_PPDU_STATS_TAG_USR_COMPLTN_ACK_BA_STATUS:
+ 		if (len <
+ 		    sizeof(struct htt_ppdu_stats_usr_cmpltn_ack_ba_status)) {
+-			ath11k_warn(ab, "Invalid len %d for the tag 0x%x\n",
++			ath11k_warn(ar->ab, "Invalid len %d for the tag 0x%x\n",
+ 				    len, tag);
+ 			return -EINVAL;
+ 		}
+@@ -1533,7 +1533,7 @@ static int ath11k_htt_tlv_ppdu_stats_par
+ 		break;
+ 	case HTT_PPDU_STATS_TAG_USR_COMMON:
+ 		if (len < sizeof(struct htt_ppdu_stats_user_common)) {
+-			ath11k_warn(ab, "Invalid len %d for the tag 0x%x\n",
++			ath11k_warn(ar->ab, "Invalid len %d for the tag 0x%x\n",
+ 				    len, tag);
+ 			return -EINVAL;
+ 		}
+@@ -1558,23 +1558,22 @@ static int ath11k_htt_tlv_ppdu_stats_par
+ 	return 0;
+ }
+ 
+-static void ath11k_dp_ppdu_stats_flush_tlv_parse(struct ath11k_base *ab,
++static void ath11k_dp_ppdu_stats_flush_tlv_parse(struct ath11k *ar,
+ 					  struct htt_ppdu_stats_cmpltn_flush *msg)
+ {
+-	struct ath11k *ar;
+ 	struct ieee80211_sta *sta;
+ 	struct ath11k_sta *arsta;
+ 	struct ath11k_peer *peer = NULL;
+ 	struct ieee80211_tx_status status;
+ 	struct ieee80211_rate_status status_rate = { 0 };
+ 
+-	if (!ab->nss.mesh_nss_offload_enabled)
++	if (!ar->ab->nss.mesh_nss_offload_enabled)
+ 		return;
+ 
+ 	rcu_read_lock();
+ 
+-	spin_lock_bh(&ab->base_lock);
+-	peer = ath11k_peer_find_by_id(ab, msg->sw_peer_id);
++	spin_lock_bh(&ar->ab->base_lock);
++	peer = ath11k_peer_find_by_id(ar, msg->sw_peer_id);
+ 	if (!peer)
+ 		goto exit;
+ 
+@@ -1599,22 +1598,22 @@ static void ath11k_dp_ppdu_stats_flush_t
+ 	ieee80211s_update_metric_ppdu(ar->hw, &status);
+ 
+ exit:
+-	spin_unlock_bh(&ab->base_lock);
++	spin_unlock_bh(&ar->ab->base_lock);
+ 	rcu_read_unlock();
+ }
+ 
+-static int ath11k_htt_tlv_ppdu_soc_stats_parse(struct ath11k_base *ab,
++static int ath11k_htt_tlv_ppdu_soc_stats_parse(struct ath11k *ar,
+ 					       u16 tag, u16 len, const void *ptr,
+ 					       void *data)
+ {
+ 	switch (tag) {
+ 	case HTT_PPDU_STATS_TAG_USR_COMPLTN_FLUSH:
+ 		if (len < sizeof(struct htt_ppdu_stats_cmpltn_flush)) {
+-			ath11k_warn(ab, "Invalid len %d for the tag 0x%x\n",
++			ath11k_warn(ar->ab, "Invalid len %d for the tag 0x%x\n",
+ 				    len, tag);
+ 			return -EINVAL;
+ 		}
+-		ath11k_dp_ppdu_stats_flush_tlv_parse(ab, (struct htt_ppdu_stats_cmpltn_flush *)ptr);
++		ath11k_dp_ppdu_stats_flush_tlv_parse(ar, (struct htt_ppdu_stats_cmpltn_flush *)ptr);
+ 		break;
+ 	default:
+ 		break;
+@@ -1710,7 +1709,7 @@ ath11k_update_per_peer_tx_stats(struct a
+ 
+ 	rcu_read_lock();
+ 	spin_lock_bh(&ab->base_lock);
+-	peer = ath11k_peer_find_by_id(ab, usr_stats->peer_id);
++	peer = ath11k_peer_find_by_id(ar, usr_stats->peer_id);
+ 
+ 	if (!peer || !peer->sta) {
+ 		spin_unlock_bh(&ab->base_lock);
+@@ -1863,8 +1862,8 @@ void ath11k_copy_to_bar(struct ath11k_pe
+ 	peer->delayba_flag = false;
+ }
+ 
+-int ath11k_dp_htt_tlv_iter(struct ath11k_base *ab, const void *ptr, size_t len,
+-			   int (*iter)(struct ath11k_base *ar, u16 tag, u16 len,
++int ath11k_dp_htt_tlv_iter(struct ath11k *ar, const void *ptr, size_t len,
++			   int (*iter)(struct ath11k *ar, u16 tag, u16 len,
+ 				       const void *ptr, void *data),
+ 			   void *data)
+ {
+@@ -1880,7 +1879,7 @@ int ath11k_dp_htt_tlv_iter(struct ath11k
+ 	}
+ 	while (len > 0) {
+ 		if (len < sizeof(*tlv)) {
+-			ath11k_err(ab, "htt tlv parse failure at byte %zd (%zu bytes left, %zu expected)\n",
++			ath11k_err(ar->ab, "htt tlv parse failure at byte %zd (%zu bytes left, %zu expected)\n",
+ 				   ptr - begin, len, sizeof(*tlv));
+ 			return -EINVAL;
+ 		}
+@@ -1891,12 +1890,12 @@ int ath11k_dp_htt_tlv_iter(struct ath11k
+ 		len -= sizeof(*tlv);
+ 
+ 		if (tlv_len > len) {
+-			ath11k_err(ab, "htt tlv parse failure of tag %hu at byte %zd (%zu bytes left, %hu expected)\n",
++			ath11k_err(ar->ab, "htt tlv parse failure of tag %hu at byte %zd (%zu bytes left, %hu expected)\n",
+ 				   tlv_tag, ptr - begin, len, tlv_len);
+ 			return -EINVAL;
+ 		}
+ 
+-		ret = iter(ab, tlv_tag, tlv_len, ptr, ppdu_info);
++		ret = iter(ar, tlv_tag, tlv_len, ptr, ppdu_info);
+ 		if (ret == -ENOMEM)
+ 			return ret;
+ 
+@@ -1923,7 +1922,7 @@ ath11k_dp_rx_ppdu_stats_update_tx_comp_s
+ 
+ 	lockdep_assert_held(&ar->data_lock);
+ 
+-	if (!ar->ab->nss.mesh_nss_offload_enabled)
++	if (!ab->nss.mesh_nss_offload_enabled)
+ 		return;
+ 
+ 	ath11k_htt_update_ppdu_stats(ar, &ppdu_info->ppdu_stats);
+@@ -1934,7 +1933,7 @@ ath11k_dp_rx_ppdu_stats_update_tx_comp_s
+ 		usr_stats = &ppdu_info->ppdu_stats.user_stats[i];
+ 		peer_id = usr_stats->peer_id;
+ 		spin_lock_bh(&ab->base_lock);
+-		peer = ath11k_peer_find_by_id(ab, peer_id);
++		peer = ath11k_peer_find_by_id(ar, peer_id);
+ 		if (!peer) {
+ 			spin_unlock_bh(&ab->base_lock);
+ 			continue;
+@@ -1988,7 +1987,7 @@ static int ath11k_htt_pull_ppdu_stats(st
+ 	ppdu_id = msg->ppdu_id;
+ 
+ 	if (pdev_id == 0) {
+-		ret = ath11k_dp_htt_tlv_iter(ab, msg->data, len,
++		ret = ath11k_dp_htt_tlv_iter(ar, msg->data, len,
+ 					     ath11k_htt_tlv_ppdu_soc_stats_parse,
+ 					     NULL);
+ 		if (ret)
+@@ -2014,7 +2013,7 @@ static int ath11k_htt_pull_ppdu_stats(st
+ 	}
+ 
+ 	ppdu_info->ppdu_id = ppdu_id;
+-	ret = ath11k_dp_htt_tlv_iter(ab, msg->data, len,
++	ret = ath11k_dp_htt_tlv_iter(ar, msg->data, len,
+ 				     ath11k_htt_tlv_ppdu_stats_parse,
+ 				     (void *)ppdu_info);
+ 	if (ret) {
+@@ -2030,7 +2029,7 @@ static int ath11k_htt_pull_ppdu_stats(st
+ 		for (i = 0; i < ppdu_info->ppdu_stats.common.num_users; i++) {
+ 			peer_id = ppdu_info->ppdu_stats.user_stats[i].peer_id;
+ 			spin_lock_bh(&ab->base_lock);
+-			peer = ath11k_peer_find_by_id(ab, peer_id);
++			peer = ath11k_peer_find_by_id(ar, peer_id);
+ 			if (!peer) {
+ 				spin_unlock_bh(&ab->base_lock);
+ 				continue;
+@@ -2050,7 +2049,7 @@ static int ath11k_htt_pull_ppdu_stats(st
+ 		for (i = 0; i < ppdu_info->bar_num_users; i++) {
+ 			peer_id = ppdu_info->ppdu_stats.user_stats[i].peer_id;
+ 			spin_lock_bh(&ab->base_lock);
+-			peer = ath11k_peer_find_by_id(ab, peer_id);
++			peer = ath11k_peer_find_by_id(ar, peer_id);
+ 			if (!peer) {
+ 				spin_unlock_bh(&ab->base_lock);
+ 				continue;
+@@ -2155,6 +2154,7 @@ void ath11k_dp_htt_htc_t2h_msg_handler(s
+ 				       struct sk_buff *skb)
+ {
+ 	struct ath11k_dp *dp = &ab->dp;
++	struct ath11k *ar;
+ 	struct htt_resp_msg *resp = (struct htt_resp_msg *)skb->data;
+ 	enum htt_t2h_msg_type type = FIELD_GET(HTT_T2H_MSG_TYPE, *(u32 *)resp);
+ 	u16 peer_id;
+@@ -2185,7 +2185,10 @@ void ath11k_dp_htt_htc_t2h_msg_handler(s
+ 					 resp->peer_map_ev.info1);
+ 		ath11k_dp_get_mac_addr(resp->peer_map_ev.mac_addr_l32,
+ 				       peer_mac_h16, mac_addr);
+-		ath11k_peer_map_event(ab, vdev_id, peer_id, mac_addr, 0, 0);
++		rcu_read_lock();
++		ar = ath11k_mac_get_ar_by_vdev_id(ab, vdev_id);
++		ath11k_peer_map_event(ar, vdev_id, peer_id, mac_addr, 0, 0);
++		rcu_read_unlock();
+ 		break;
+ 	case HTT_T2H_MSG_TYPE_PEER_MAP2:
+ 		vdev_id = FIELD_GET(HTT_T2H_PEER_MAP_INFO_VDEV_ID,
+@@ -2202,17 +2205,27 @@ void ath11k_dp_htt_htc_t2h_msg_handler(s
+ 				       resp->peer_map_ev.info1);
+ 		is_wds = FIELD_GET(HTT_T2H_PEER_MAP_INFO2_NEXT_HOP_M,
+ 				   resp->peer_map_ev.info2);
+-		ath11k_peer_map_v2_event(ab, vdev_id, peer_id, mac_addr, ast_hash,
++		rcu_read_lock();
++		ar = ath11k_mac_get_ar_by_vdev_id(ab, vdev_id);
++		ath11k_peer_map_v2_event(ar, vdev_id, peer_id, mac_addr, ast_hash,
+ 				         hw_peer_id, is_wds);
++		rcu_read_unlock();
+ 		break;
+ 	case HTT_T2H_MSG_TYPE_PEER_UNMAP:
+ 		peer_id = FIELD_GET(HTT_T2H_PEER_UNMAP_INFO_PEER_ID,
+ 				    resp->peer_unmap_ev.info);
+-		ath11k_peer_unmap_event(ab, peer_id);
++		vdev_id = FIELD_GET(HTT_T2H_PEER_UNMAP_INFO_VDEV_ID,
++				    resp->peer_unmap_ev.info);
++		rcu_read_lock();
++		ar = ath11k_mac_get_ar_by_vdev_id(ab, vdev_id);
++		ath11k_peer_unmap_event(ar, peer_id);
++		rcu_read_unlock();
+ 		break;
+ 	case HTT_T2H_MSG_TYPE_PEER_UNMAP2:
+ 		peer_id = FIELD_GET(HTT_T2H_PEER_UNMAP_INFO_PEER_ID,
+ 				    resp->peer_unmap_ev.info);
++		vdev_id = FIELD_GET(HTT_T2H_PEER_UNMAP_INFO_VDEV_ID,
++				    resp->peer_unmap_ev.info);
+ 		peer_mac_h16 = FIELD_GET(HTT_T2H_PEER_UNMAP_INFO1_MAC_ADDR_H16,
+ 					 resp->peer_unmap_ev.info1);
+ 		ath11k_dp_get_mac_addr(resp->peer_map_ev.mac_addr_l32,
+@@ -2221,7 +2234,10 @@ void ath11k_dp_htt_htc_t2h_msg_handler(s
+ 				   resp->peer_unmap_ev.info1);
+ 		free_wds_count = FIELD_GET(HTT_T2H_PEER_UNMAP_INFO3_WDS_FREE_COUNT,
+ 					   resp->peer_unmap_ev.info3);
+-		ath11k_peer_unmap_v2_event(ab, peer_id, mac_addr, is_wds, free_wds_count);
++		rcu_read_lock();
++		ar = ath11k_mac_get_ar_by_vdev_id(ab, vdev_id);
++		ath11k_peer_unmap_v2_event(ar, peer_id, mac_addr, is_wds, free_wds_count);
++		rcu_read_unlock();
+ 		break;
+ 	case HTT_T2H_MSG_TYPE_PPDU_STATS_IND:
+ 		ath11k_htt_pull_ppdu_stats(ab, skb);
+@@ -2877,25 +2893,25 @@ static void ath11k_dp_rx_h_undecap(struc
+ }
+ 
+ static struct ath11k_peer *
+-ath11k_dp_rx_h_find_peer(struct ath11k_base *ab, struct sk_buff *msdu)
++ath11k_dp_rx_h_find_peer(struct ath11k *ar, struct sk_buff *msdu)
+ {
+ 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
+ 	struct hal_rx_desc *rx_desc = rxcb->rx_desc;
+ 	struct ath11k_peer *peer = NULL;
+ 
+-	lockdep_assert_held(&ab->base_lock);
++	lockdep_assert_held(&ar->ab->base_lock);
+ 
+ 	if (rxcb->peer_id)
+-		peer = ath11k_peer_find_by_id(ab, rxcb->peer_id);
++		peer = ath11k_peer_find_by_id(ar, rxcb->peer_id);
+ 
+ 	if (peer)
+ 		return peer;
+ 
+-	if (!rx_desc || !(ath11k_dp_rxdesc_mac_addr2_valid(ab, rx_desc)))
++	if (!rx_desc || !(ath11k_dp_rxdesc_mac_addr2_valid(ar->ab, rx_desc)))
+ 		return NULL;
+ 
+-	peer = ath11k_peer_find_by_addr(ab,
+-					ath11k_dp_rxdesc_mpdu_start_addr2(ab, rx_desc));
++	peer = ath11k_peer_find_by_addr(ar,
++					ath11k_dp_rxdesc_mpdu_start_addr2(ar->ab, rx_desc));
+ 	return peer;
+ }
+ 
+@@ -2939,7 +2955,7 @@ static bool ath11k_dp_rx_check_fast_rx(s
+ 		return false;
+ 
+ 	/* check if the msdu needs to be bridged to our connected peer */
+-	f_peer = ath11k_peer_find_by_addr(ar->ab, ehdr->h_dest);
++	f_peer = ath11k_peer_find_by_addr(ar, ehdr->h_dest);
+ 
+ 	if (f_peer && f_peer != peer)
+ 		return false;
+@@ -2978,7 +2994,7 @@ static void ath11k_dp_rx_h_mpdu(struct a
+ 	}
+ 
+ 	spin_lock_bh(&ar->ab->base_lock);
+-	peer = ath11k_dp_rx_h_find_peer(ar->ab, msdu);
++	peer = ath11k_dp_rx_h_find_peer(ar, msdu);
+ 	if (peer) {
+ 		/* If the pkt is a valid IP packet and peer supports
+ 		 * fast rx, deliver directly to net, also note that
+@@ -3206,7 +3222,7 @@ static void ath11k_dp_rx_deliver_msdu(st
+ 		decap = ath11k_dp_rx_h_msdu_start_decap_type(ar->ab, rxcb->rx_desc);
+ 
+ 	spin_lock_bh(&ar->ab->base_lock);
+-	peer = ath11k_dp_rx_h_find_peer(ar->ab, msdu);
++	peer = ath11k_dp_rx_h_find_peer(ar, msdu);
+ 	if (peer && peer->sta)
+ 		pubsta = peer->sta;
+ 	spin_unlock_bh(&ar->ab->base_lock);
+@@ -3505,7 +3521,7 @@ try_again:
+ 		if (unlikely(push_reason !=
+ 			     HAL_REO_DEST_RING_PUSH_REASON_ROUTING_INSTRUCTION)) {
+ 			dev_kfree_skb_any(msdu);
+-			ab->soc_stats.hal_reo_error[dp->reo_dst_ring[ring_id].ring_id]++;
++			ab->soc_stats.hal_reo_error[ring_id]++;
+ 			continue;
+ 		}
+ 
+@@ -3737,11 +3753,10 @@ static void ath11k_dp_rx_update_user_sta
+ 	if (user_stats->ast_index == 0 || user_stats->ast_index == 0xFFFF)
+ 		return;
+ 
+-	peer = ath11k_peer_find_by_ast(ar->ab, user_stats->ast_index);
++	peer = ath11k_peer_find_by_ast(ar, user_stats->ast_index);
+ 
+ 	if (peer == NULL) {
+-		if (!ar->ab->nss.enabled)
+-		  ath11k_warn(ar->ab, "peer ast idx %d can't be found\n",
++		ath11k_warn(ar->ab, "peer ast idx %d can't be found\n",
+ 			    user_stats->ast_index);
+ 		return;
+ 	}
+@@ -4212,7 +4227,7 @@ int ath11k_peer_rx_frag_setup(struct ath
+ 
+ 	spin_lock_bh(&ab->base_lock);
+ 
+-	peer = ath11k_peer_find(ab, vdev_id, peer_mac);
++	peer = ath11k_peer_find(ar, vdev_id, peer_mac);
+ 	if (!peer) {
+ 		ath11k_warn(ab, "failed to find the peer to set up fragment info\n");
+ 		spin_unlock_bh(&ab->base_lock);
+@@ -4668,7 +4683,7 @@ static int ath11k_dp_rx_frag_h_mpdu(stru
+ 		return -EINVAL;
+ 
+ 	spin_lock_bh(&ab->base_lock);
+-	peer = ath11k_peer_find_by_id(ab, peer_id);
++	peer = ath11k_peer_find_by_id(ar, peer_id);
+ 	if (!peer) {
+ 		ath11k_warn(ab, "failed to find the peer to de-fragment received fragment peer_id %d\n",
+ 			    peer_id);
+@@ -4730,7 +4745,7 @@ static int ath11k_dp_rx_frag_h_mpdu(stru
+ 	del_timer_sync(&rx_tid->frag_timer);
+ 	spin_lock_bh(&ab->base_lock);
+ 
+-	peer = ath11k_peer_find_by_id(ab, peer_id);
++	peer = ath11k_peer_find_by_id(ar, peer_id);
+ 	if (!peer)
+ 		goto err_frags_cleanup;
+ 
+@@ -6394,7 +6409,7 @@ int ath11k_dp_rx_process_mon_status(stru
+ 			trace_ath11k_htt_rxdesc(ar, skb->data, log_type, rx_buf_sz);
+ 
+ 		ppdu_info->peer_id = HAL_INVALID_PEERID;
+-		hal_status = ath11k_hal_rx_parse_mon_status(ab, ppdu_info, skb);
++		hal_status = ath11k_hal_rx_parse_mon_status(ar, ppdu_info, skb);
+ 
+ 		if (test_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags) &&
+ 		    pmon->mon_ppdu_status == DP_PPDU_STATUS_START &&
+@@ -6425,7 +6440,7 @@ int ath11k_dp_rx_process_mon_status(stru
+ 		}
+ 		rcu_read_lock();
+ 		spin_lock_bh(&ab->base_lock);
+-		peer = ath11k_peer_find_by_id(ab, ppdu_info->peer_id);
++		peer = ath11k_peer_find_by_id(ar, ppdu_info->peer_id);
+ 
+ 		if (!peer || !peer->sta) {
+ 			ath11k_dbg(ab, ATH11K_DBG_DATA,
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.h
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.h
+@@ -129,8 +129,8 @@ int ath11k_dp_rxbufs_replenish(struct at
+ 			       int req_entries,
+  			       enum hal_rx_buf_return_buf_manager mgr,
+ 			       u32 *buf_id);
+-int ath11k_dp_htt_tlv_iter(struct ath11k_base *ab, const void *ptr, size_t len,
+-			   int (*iter)(struct ath11k_base *ar, u16 tag, u16 len,
++int ath11k_dp_htt_tlv_iter(struct ath11k *ar, const void *ptr, size_t len,
++			   int (*iter)(struct ath11k *ar, u16 tag, u16 len,
+ 				       const void *ptr, void *data),
+ 			   void *data);
+ int ath11k_dp_rx_process_mon_rings(struct ath11k_base *ab, int mac_id,
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -478,7 +478,7 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
+ 	}
+ 
+ 	spin_lock_bh(&ab->base_lock);
+-	peer = ath11k_peer_find_by_id(ab, ts->peer_id);
++	peer = ath11k_peer_find_by_id(ar, ts->peer_id);
+ 	if (!peer || !peer->sta) {
+ 		ath11k_dbg(ab, ATH11K_DBG_DATA,
+ 			   "dp_tx: failed to find the peer with peer_id %d\n",
+@@ -576,7 +576,7 @@ void ath11k_dp_tx_update_txcompl(struct
+ 	int ret;
+ 
+ 	spin_lock_bh(&ab->base_lock);
+-	peer = ath11k_peer_find_by_id(ab, ts->peer_id);
++	peer = ath11k_peer_find_by_id(ar, ts->peer_id);
+ 	if (!peer || !peer->sta) {
+ 		ath11k_dbg(ab, ATH11K_DBG_DP_TX,
+ 			   "failed to find the peer by id %u\n", ts->peer_id);
+@@ -791,7 +791,7 @@ static void ath11k_dp_tx_complete_msdu(s
+ 	}
+ 
+ 	spin_lock_bh(&ab->base_lock);
+-	peer = ath11k_peer_find_by_id(ab, ts.peer_id);
++	peer = ath11k_peer_find_by_id(ar, ts.peer_id);
+ 	if (unlikely(!peer || !peer->sta)) {
+ 		ath11k_dbg(ab, ATH11K_DBG_DATA,
+ 			   "dp_tx: failed to find the peer with peer_id %d\n",
+--- a/drivers/net/wireless/ath/ath11k/hal_rx.c
++++ b/drivers/net/wireless/ath/ath11k/hal_rx.c
+@@ -9,7 +9,6 @@
+ #include "hal_tx.h"
+ #include "hal_rx.h"
+ #include "hal_desc.h"
+-#include "hif.h"
+ 
+ static void ath11k_hal_reo_set_desc_hdr(struct hal_desc_header *hdr,
+ 					u8 owner, u8 buffer_type, u32 magic)
+@@ -875,7 +874,7 @@ static u16 ath11k_hal_rx_mpduinfo_get_pe
+ }
+ 
+ static enum hal_rx_mon_status
+-ath11k_hal_rx_parse_mon_status_tlv(struct ath11k_base *ab,
++ath11k_hal_rx_parse_mon_status_tlv(struct ath11k *ar,
+ 				   struct hal_rx_mon_ppdu_info *ppdu_info,
+ 				   u32 tlv_tag, u8 *tlv_data, u32 userid)
+ {
+@@ -1498,7 +1497,7 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+ 	case HAL_PHYRX_RSSI_LEGACY: {
+ 		int i;
+ 		bool db2dbm = test_bit(WMI_TLV_SERVICE_HW_DB2DBM_CONVERSION_SUPPORT,
+-				       ab->wmi_ab.svc_map);
++				       ar->ab->wmi_ab.svc_map);
+ 		struct hal_rx_phyrx_rssi_legacy_info *rssi =
+ 			(struct hal_rx_phyrx_rssi_legacy_info *)tlv_data;
+ 		u32 reception_type = 0;
+@@ -1541,11 +1540,11 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+ 				(struct hal_rx_mpdu_info *)tlv_data;
+ 		u16 peer_id;
+ 
+-		peer_id = ath11k_hal_rx_mpduinfo_get_peerid(ab, mpdu_info);
++		peer_id = ath11k_hal_rx_mpduinfo_get_peerid(ar->ab, mpdu_info);
+ 		if (peer_id)
+ 			ppdu_info->peer_id = peer_id;
+ 
+-		ppdu_info->mpdu_len += ab->hw_params.hw_ops->rx_desc_get_hal_mpdu_len(mpdu_info);
++		ppdu_info->mpdu_len += ar->ab->hw_params.hw_ops->rx_desc_get_hal_mpdu_len(mpdu_info);
+ 
+ 		break;
+ 	}
+@@ -1573,7 +1572,7 @@ ath11k_hal_rx_parse_mon_status_tlv(struc
+ }
+ 
+ enum hal_rx_mon_status
+-ath11k_hal_rx_parse_mon_status(struct ath11k_base *ab,
++ath11k_hal_rx_parse_mon_status(struct ath11k *ar,
+ 			       struct hal_rx_mon_ppdu_info *ppdu_info,
+ 			       struct sk_buff *skb)
+ {
+@@ -1599,7 +1598,7 @@ ath11k_hal_rx_parse_mon_status(struct at
+ 		if (tlv_tag == HAL_RX_PPDU_END)
+ 			tlv_len = sizeof(struct hal_rx_rxpcu_classification_overview);
+ 
+-		hal_status = ath11k_hal_rx_parse_mon_status_tlv(ab, ppdu_info,
++		hal_status = ath11k_hal_rx_parse_mon_status_tlv(ar, ppdu_info,
+ 								tlv_tag, ptr, tlv_userid);
+ 		ptr += tlv_len;
+ 		ptr = PTR_ALIGN(ptr, HAL_TLV_ALIGN);
+--- a/drivers/net/wireless/ath/ath11k/hal_rx.h
++++ b/drivers/net/wireless/ath/ath11k/hal_rx.h
+@@ -559,7 +559,7 @@ void
+ ath11k_hal_rx_sw_mon_ring_buf_paddr_get(void *rx_desc,
+ 					struct hal_sw_mon_ring_entries *sw_mon_ent);
+ enum hal_rx_mon_status
+-ath11k_hal_rx_parse_mon_status(struct ath11k_base *ab,
++ath11k_hal_rx_parse_mon_status(struct ath11k *ar,
+ 			       struct hal_rx_mon_ppdu_info *ppdu_info,
+ 			       struct sk_buff *skb);
+ 
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -343,7 +343,7 @@ enum nl80211_he_gi ath11k_mac_he_gi_to_n
+ 	return ret;
+ }
+ 
+-static int ath11k_mac_cfg_dyn_vlan(struct ath11k_base *ab,
++static int ath11k_mac_cfg_dyn_vlan(struct ath11k *ar,
+ 				   struct ath11k_vif *ap_vlan_arvif,
+ 				   struct ieee80211_sta *sta);
+ 
+@@ -912,16 +912,16 @@ void ath11k_mac_peer_cleanup_all(struct
+ 
+ 	lockdep_assert_held(&ar->conf_mutex);
+ 
+-	mutex_lock(&ab->tbl_mtx_lock);
++	mutex_lock(&ar->tbl_mtx_lock);
+ 	spin_lock_bh(&ab->base_lock);
+-	list_for_each_entry_safe(peer, tmp, &ab->peers, list) {
++	list_for_each_entry_safe(peer, tmp, &ar->peers, list) {
+ 		ath11k_peer_rx_tid_cleanup(ar, peer);
+-		ath11k_peer_rhash_delete(ab, peer);
++		ath11k_peer_rhash_delete(ar, peer);
+ 		list_del(&peer->list);
+ 		kfree(peer);
+ 	}
+ 	spin_unlock_bh(&ab->base_lock);
+-	mutex_unlock(&ab->tbl_mtx_lock);
++	mutex_unlock(&ar->tbl_mtx_lock);
+ 
+ 	ar->num_peers = 0;
+ 	ar->num_stations = 0;
+@@ -3109,7 +3109,7 @@ static void ath11k_bss_assoc(struct ieee
+ 
+ 	spin_lock_bh(&ar->ab->base_lock);
+ 
+-	peer = ath11k_peer_find(ar->ab, arvif->vdev_id, arvif->bssid);
++	peer = ath11k_peer_find(ar, arvif->vdev_id, arvif->bssid);
+ 	if (peer && peer->is_authorized)
+ 		is_auth = true;
+ 
+@@ -4269,7 +4269,7 @@ static int ath11k_clear_peer_keys(struct
+ 	lockdep_assert_held(&ar->conf_mutex);
+ 
+ 	spin_lock_bh(&ab->base_lock);
+-	peer = ath11k_peer_find(ab, arvif->vdev_id, addr);
++	peer = ath11k_peer_find(ar, arvif->vdev_id, addr);
+ 	if (!peer) {
+ 		spin_unlock_bh(&ab->base_lock);
+ 		return -ENOENT;
+@@ -4385,7 +4385,7 @@ static int ath11k_mac_op_set_key(struct
+ 	 * we already hold conf_mutex. we just make sure its there now.
+ 	 */
+ 	spin_lock_bh(&ab->base_lock);
+-	peer = ath11k_peer_find(ab, arvif->vdev_id, peer_addr);
++	peer = ath11k_peer_find(ar, arvif->vdev_id, peer_addr);
+ 
+ 	/* flush the fragments cache during key (re)install to
+ 	 * ensure all frags in the new frag list belong to the same key.
+@@ -4494,7 +4494,7 @@ static int ath11k_mac_op_set_key(struct
+ 	}
+ 
+ 	spin_lock_bh(&ab->base_lock);
+-	peer = ath11k_peer_find(ab, arvif->vdev_id, peer_addr);
++	peer = ath11k_peer_find(ar, arvif->vdev_id, peer_addr);
+ 
+ 	/* TODO: Check if vdev specific security cfg is mandatory */
+ 	ret = ath11k_nss_vdev_set_cmd(arvif, ATH11K_NSS_WIFI_VDEV_SECURITY_TYPE_CMD, key->cipher);
+@@ -4525,7 +4525,7 @@ static int ath11k_mac_op_set_key(struct
+ 		list_for_each_entry_safe(dyn_vlan_cfg, tmp, &ap_vlan_arvif->dyn_vlan_cfg, cfg_list) {
+ 			struct ieee80211_sta *vlan_sta = dyn_vlan_cfg->sta;
+ 
+-			ret = ath11k_mac_cfg_dyn_vlan(ar->ab, ap_vlan_arvif, vlan_sta);
++			ret = ath11k_mac_cfg_dyn_vlan(ar, ap_vlan_arvif, vlan_sta);
+ 			if (ret)
+ 				ath11k_warn(ar->ab, "failed to cfg dyn vlan for peer %pM: %d\n",
+ 					    vlan_sta->addr, ret);
+@@ -5135,7 +5135,7 @@ static void ath11k_sta_set_4addr_wk(stru
+ 	vif = ap_vlan_arvif->vif;
+ 
+ 	spin_lock_bh(&ab->base_lock);
+-	wds_peer = ath11k_peer_find_by_addr(ab, sta->addr);
++	wds_peer = ath11k_peer_find(ar, arvif->vdev_id, sta->addr);
+ 	if (!wds_peer) {
+ 		spin_unlock_bh(&ab->base_lock);
+ 		ath11k_warn(ab, "mac sta use 4addr failed to find peer %pM\n",
+@@ -5358,7 +5358,7 @@ static void ath11k_mac_op_sta_rc_update(
+ 
+ 	spin_lock_bh(&ar->ab->base_lock);
+ 
+-	peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
++	peer = ath11k_peer_find(ar, arvif->vdev_id, sta->addr);
+ 	if (!peer) {
+ 		spin_unlock_bh(&ar->ab->base_lock);
+ 		ath11k_warn(ar->ab, "mac sta rc update failed to find peer %pM on vdev %i\n",
+@@ -8464,7 +8464,7 @@ ath11k_mac_op_assign_vif_chanctx(struct
+ 	if (ab->hw_params.vdev_start_delay &&
+ 	    arvif->vdev_type != WMI_VDEV_TYPE_AP &&
+ 	    arvif->vdev_type != WMI_VDEV_TYPE_MONITOR &&
+-	    !ath11k_peer_find_by_vdev_id(ab, arvif->vdev_id)) {
++	    !ath11k_peer_find_by_vdev_id(ar, arvif->vdev_id)) {
+ 		memcpy(&arvif->chanctx, ctx, sizeof(*ctx));
+ 		ret = 0;
+ 		goto out;
+@@ -8540,7 +8540,7 @@ ath11k_mac_op_unassign_vif_chanctx(struc
+ 	if (ab->hw_params.vdev_start_delay &&
+ 	    arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
+ 		spin_lock_bh(&ab->base_lock);
+-		peer = ath11k_peer_find_by_addr(ab, ar->mac_addr);
++		peer = ath11k_peer_find(ar, arvif->vdev_id, ar->mac_addr);
+ 		spin_unlock_bh(&ab->base_lock);
+ 		if (peer)
+ 			ath11k_peer_delete(ar, arvif->vdev_id, ar->mac_addr);
+@@ -9114,7 +9114,7 @@ ath11k_mac_validate_vht_he_fixed_rate_se
+ 
+ 	rcu_read_lock();
+ 	spin_lock_bh(&ar->ab->base_lock);
+-	list_for_each_entry(peer, &ar->ab->peers, list) {
++	list_for_each_entry(peer, &ar->peers, list) {
+ 		if (peer->sta) {
+ 			deflink = &peer->sta->deflink;
+ 
+@@ -10066,26 +10066,26 @@ static int ath11k_mac_station_remove(str
+ 	return ret;
+ }
+ 
+-static int ath11k_mac_cfg_dyn_vlan(struct ath11k_base *ab,
++static int ath11k_mac_cfg_dyn_vlan(struct ath11k *ar,
+ 				   struct ath11k_vif *ap_vlan_arvif,
+ 				   struct ieee80211_sta *sta)
+ {
+ 	struct ath11k_peer *peer;
+ 	int peer_id, ret;
+ 
+-	spin_lock_bh(&ab->base_lock);
+-	peer = ath11k_peer_find_by_addr(ab, sta->addr);
++	spin_lock_bh(&ar->ab->base_lock);
++	peer = ath11k_peer_find_by_addr(ar, sta->addr);
+ 	if (!peer) {
+-		ath11k_warn(ab, "failed to find peer for %pM\n", sta->addr);
+-		spin_unlock_bh(&ab->base_lock);
++		ath11k_warn(ar->ab, "failed to find peer for %pM\n", sta->addr);
++		spin_unlock_bh(&ar->ab->base_lock);
+ 		return -EINVAL;
+ 	}
+ 	peer_id = peer->peer_id;
+-	spin_unlock_bh(&ab->base_lock);
++	spin_unlock_bh(&ar->ab->base_lock);
+ 
+ 	ret = ath11k_nss_ext_vdev_wds_4addr_allow(ap_vlan_arvif, peer_id);
+ 	if (ret) {
+-		ath11k_warn(ab, "failed to set 4addr allow for %pM:%d\n",
++		ath11k_warn(ar->ab, "failed to set 4addr allow for %pM:%d\n",
+ 			    sta->addr, ret);
+ 		return ret;
+ 	}
+@@ -10135,20 +10135,20 @@ static int ath11k_mac_op_sta_state(struc
+ 			ath11k_warn(ar->ab, "Failed to remove station: %pM for VDEV: %d\n",
+ 				    sta->addr, arvif->vdev_id);
+ 
+-		mutex_lock(&ar->ab->tbl_mtx_lock);
++		mutex_lock(&ar->tbl_mtx_lock);
+ 		spin_lock_bh(&ar->ab->base_lock);
+-		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
++		peer = ath11k_peer_find(ar, arvif->vdev_id, sta->addr);
+ 		if (peer && peer->sta == sta) {
+ 			ath11k_warn(ar->ab, "Found peer entry %pM n vdev %i after it was supposedly removed\n",
+ 				    vif->addr, arvif->vdev_id);
+-			ath11k_peer_rhash_delete(ar->ab, peer);
++			ath11k_peer_rhash_delete(ar, peer);
+ 			peer->sta = NULL;
+ 			list_del(&peer->list);
+ 			kfree(peer);
+ 			ar->num_peers--;
+ 		}
+ 		spin_unlock_bh(&ar->ab->base_lock);
+-		mutex_unlock(&ar->ab->tbl_mtx_lock);
++		mutex_unlock(&ar->tbl_mtx_lock);
+ 	} else if (old_state == IEEE80211_STA_AUTH &&
+ 		   new_state == IEEE80211_STA_ASSOC &&
+ 		   (vif->type == NL80211_IFTYPE_AP ||
+@@ -10179,7 +10179,7 @@ static int ath11k_mac_op_sta_state(struc
+ 		   new_state == IEEE80211_STA_AUTHORIZED) {
+ 		spin_lock_bh(&ar->ab->base_lock);
+ 
+-		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
++		peer = ath11k_peer_find(ar, arvif->vdev_id, sta->addr);
+ 		if (peer)
+ 			peer->is_authorized = true;
+ 
+@@ -10216,7 +10216,7 @@ static int ath11k_mac_op_sta_state(struc
+ 					list_add_tail(&ar_dyn_vlan_cfg->cfg_list, &arvif->dyn_vlan_cfg);
+ 				}
+ 			} else {
+-				ret = ath11k_mac_cfg_dyn_vlan(ar->ab, arvif, sta);
++				ret = ath11k_mac_cfg_dyn_vlan(ar, arvif, sta);
+ 				if (ret)
+ 					ath11k_warn(ar->ab, "failed to cfg dyn vlan for peer %pM: %d\n",
+ 						    sta->addr, ret);
+@@ -10249,7 +10249,7 @@ static int ath11k_mac_op_sta_state(struc
+ 		   new_state == IEEE80211_STA_ASSOC) {
+ 
+ 		spin_lock_bh(&ar->ab->base_lock);
+-		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
++		peer = ath11k_peer_find(ar, arvif->vdev_id, sta->addr);
+ 		if (peer)
+ 			peer->is_authorized = false;
+ 		spin_unlock_bh(&ar->ab->base_lock);
+@@ -10257,7 +10257,7 @@ static int ath11k_mac_op_sta_state(struc
+ 		   new_state == IEEE80211_STA_ASSOC) {
+ 		spin_lock_bh(&ar->ab->base_lock);
+ 
+-		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
++		peer = ath11k_peer_find(ar, arvif->vdev_id, sta->addr);
+ 		if (peer)
+ 			peer->is_authorized = false;
+ 
+@@ -10662,9 +10662,9 @@ void ath11k_mac_unregister(struct ath11k
+ 			continue;
+ 
+ 		__ath11k_mac_unregister(ar);
++		ath11k_peer_rhash_tbl_destroy(ar);
+ 	}
+ 
+-	ath11k_peer_rhash_tbl_destroy(ab);
+ }
+ 
+ static int __ath11k_mac_register(struct ath11k *ar)
+@@ -10951,15 +10951,15 @@ int ath11k_mac_register(struct ath11k_ba
+ 	ab->cc_freq_hz = IPQ8074_CC_FREQ_HERTZ;
+ 	ab->free_vdev_map = (1LL << (ab->num_radios * TARGET_NUM_VDEVS(ab))) - 1;
+ 
+-	ret = ath11k_peer_rhash_tbl_init(ab);
+-	if (ret)
+-		return ret;
+ 
+ 	device_get_mac_address(ab->dev, mac_addr);
+ 
+ 	for (i = 0; i < ab->num_radios; i++) {
+ 		pdev = &ab->pdevs[i];
+ 		ar = pdev->ar;
++		ret = ath11k_peer_rhash_tbl_init(ar);
++		if (ret)
++			return ret;
+ 		if (ab->pdevs_macaddr_valid) {
+ 			ether_addr_copy(ar->mac_addr, pdev->mac_addr);
+ 		} else {
+@@ -10987,9 +10987,9 @@ err_cleanup:
+ 		pdev = &ab->pdevs[i];
+ 		ar = pdev->ar;
+ 		__ath11k_mac_unregister(ar);
++		ath11k_peer_rhash_tbl_destroy(ar);
+ 	}
+ 
+-	ath11k_peer_rhash_tbl_destroy(ab);
+ 
+ 	return ret;
+ }
+@@ -11033,9 +11033,12 @@ int ath11k_mac_allocate(struct ath11k_ba
+ 		ar->num_rx_chains = get_num_chains(pdev->cap.rx_chain_mask);
+ 
+ 		pdev->ar = ar;
++		mutex_init(&ar->tbl_mtx_lock);
+ 		spin_lock_init(&ar->data_lock);
+ 		INIT_LIST_HEAD(&ar->arvifs);
+ 		INIT_LIST_HEAD(&ar->ppdu_stats_info);
++		INIT_LIST_HEAD(&ar->peers);
++		init_waitqueue_head(&ar->peer_mapping_wq);
+ 		mutex_init(&ar->conf_mutex);
+ 		init_completion(&ar->vdev_setup_done);
+ 		init_completion(&ar->vdev_delete_done);
+--- a/drivers/net/wireless/ath/ath11k/nss.c
++++ b/drivers/net/wireless/ath/ath11k/nss.c
+@@ -143,7 +143,7 @@ static void ath11k_nss_get_peer_stats(st
+ {
+ 	struct ath11k_peer *peer;
+ 	struct nss_wifili_peer_ctrl_stats *pstats = NULL;
+-	int i, j;
++	int i, j, i2;
+ 	u64 tx_packets, tx_bytes, tx_dropped = 0;
+ 	u64 rx_packets, rx_bytes, rx_dropped;
+ 
+@@ -156,7 +156,13 @@ static void ath11k_nss_get_peer_stats(st
+ 		rcu_read_lock();
+ 		spin_lock_bh(&ab->base_lock);
+ 
+-		peer = ath11k_peer_find_by_id(ab, pstats->peer_id);
++		for (i2 = 0; i2 < ab->num_radios; i2++) {
++			struct ath11k_pdev *pdev = &ab->pdevs[i2];
++			struct ath11k *ar = pdev->ar;
++			peer = ath11k_peer_find_by_id(ar, pstats->peer_id);
++			if (peer)
++				break;
++		}
+ 		if (!peer || !peer->sta) {
+ 			ath11k_dbg(ab, ATH11K_DBG_NSS, "nss wifili: unable to find peer %d\n", pstats->peer_id);
+ 			spin_unlock_bh(&ab->base_lock);
+@@ -278,28 +284,28 @@ static void ath11k_nss_tx_encap_raw(stru
+ static void ath11k_nss_peer_mem_free(struct ath11k_base *ab, u32 peer_id)
+ {
+ 	struct ath11k_peer *peer;
++	struct ath11k *ar;
++	int i;
+ 
+ 	spin_lock_bh(&ab->base_lock);
+ 
+-	peer = ath11k_peer_find_by_id(ab, peer_id);
+-	if (!peer) {
+-		spin_unlock_bh(&ab->base_lock);
+-		if(ab->nss.debug_mode)
+-      ath11k_warn(ab, "ath11k_nss: unable to free peer mem, peer_id:%d\n",
+-            peer_id);
+-		return;
+-	}
++	for (i = 0; i < ab->num_radios; i++) {
++		struct ath11k_pdev *pdev = &ab->pdevs[i];
++		ar = pdev->ar;
++		peer = ath11k_peer_find_by_id(ar, peer_id);
++		if (!peer)
++			continue;
+ 
+-	dma_unmap_single(ab->dev, peer->nss.paddr,
+-			 WIFILI_NSS_PEER_BYTE_SIZE, DMA_FROM_DEVICE);
++		dma_unmap_single(ab->dev, peer->nss.paddr,
++				 WIFILI_NSS_PEER_BYTE_SIZE, DMA_FROM_DEVICE);
+ 
+-	kfree(peer->nss.vaddr);
+-	if (peer->nss.nss_stats) {
+-		kfree(peer->nss.nss_stats);
+-		peer->nss.nss_stats = NULL;
++		kfree(peer->nss.vaddr);
++		if (peer->nss.nss_stats) {
++			kfree(peer->nss.nss_stats);
++			peer->nss.nss_stats = NULL;
++		}
++		complete(&peer->nss.complete);
+ 	}
+-
+-	complete(&peer->nss.complete);
+ 	spin_unlock_bh(&ab->base_lock);
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_NSS, "nss peer %d mem freed\n", peer_id);
+@@ -420,6 +426,7 @@ void ath11k_nss_wifili_event_receive(str
+ void ath11k_nss_process_mic_error(struct ath11k_base *ab, struct sk_buff *skb)
+ {
+ 	struct ath11k_vif *arvif;
++	struct ath11k *ar;
+ 	struct ath11k_peer *peer = NULL;
+ 	struct hal_rx_desc *desc = (struct hal_rx_desc *)skb->data;
+ 	struct wireless_dev *wdev;
+@@ -427,6 +434,7 @@ void ath11k_nss_process_mic_error(struct
+ 	u8 peer_addr[ETH_ALEN];
+ 	u8 ucast_keyidx, mcast_keyidx;
+ 	bool is_mcbc;
++	int i;
+ 
+ 	if (!ath11k_dp_rx_h_msdu_end_first_msdu(ab, desc))
+ 		goto fail;
+@@ -435,7 +443,13 @@ void ath11k_nss_process_mic_error(struct
+ 	peer_id = ath11k_dp_rx_h_mpdu_start_peer_id(ab, desc);
+ 
+ 	spin_lock_bh(&ab->base_lock);
+-	peer = ath11k_peer_find_by_id(ab, peer_id);
++	for (i = 0; i < ab->num_radios; i++) {
++		struct ath11k_pdev *pdev = &ab->pdevs[i];
++		ar = pdev->ar;
++		peer = ath11k_peer_find_by_id(ar, peer_id);
++		if (peer)
++			break;
++	}
+ 	if (!peer) {
+ 		ath11k_info(ab, "ath11k_nss:peer not found");
+ 		spin_unlock_bh(&ab->base_lock);
+@@ -604,7 +618,7 @@ static int ath11k_nss_undecap_raw(struct
+ 
+ 	spin_lock_bh(&ab->base_lock);
+ 
+-	peer = ath11k_peer_find_by_addr(ab, hdr->addr2);
++	peer = ath11k_peer_find_by_addr(ar, hdr->addr2);
+ 	if (!peer) {
+ 		ath11k_warn(ab, "peer not found for raw/nwifi undecap, drop this packet\n");
+ 		spin_unlock_bh(&ab->base_lock);
+@@ -646,16 +660,48 @@ static int ath11k_nss_undecap_nwifi(stru
+ 	return 0;
+ }
+ 
+-static void ath11k_nss_wds_type_rx(struct ath11k *ar, struct net_device *dev,
++static bool vdev_check_local_dev(u8 *wds_src_mac)
++{
++    struct net_device *dev = NULL;
++
++    rcu_read_lock();
++    for_each_netdev_rcu(&init_net, dev) {
++        if (!dev) {
++            continue;
++        }
++        if (!memcmp(dev->dev_addr, wds_src_mac, 6)) {
++            rcu_read_unlock();
++            return true;
++        }
++    }
++    rcu_read_unlock();
++    return false;
++}
++
++static void ath11k_nss_wds_type_rx(struct ath11k_vif *arvif, struct net_device *dev,
+ 				   u8* src_mac, u8 is_sa_valid, u8 addr4_valid,
+ 				   u16 peer_id)
+ {
++	struct ath11k *ar = arvif->ar;
+ 	struct ath11k_base *ab = ar->ab;
+ 	struct ath11k_ast_entry *ast_entry = NULL;
+ 	struct ath11k_peer *ta_peer = NULL;
++	struct wireless_dev *wdev = NULL;
++	struct ieee80211_vif *vif = NULL;
+ 
+ 	spin_lock_bh(&ab->base_lock);
+-	ta_peer = ath11k_peer_find_by_id(ab, peer_id);
++
++	wdev = dev->ieee80211_ptr;
++	if (!wdev) {
++		return;
++	}
++
++	vif = wdev_to_ieee80211_vif(wdev);
++	if (!vif) {
++		return;
++	}
++
++	ta_peer = ath11k_peer_find_by_id(ar, peer_id);
+ 
+ 	if (!ta_peer) {
+ 		spin_unlock_bh(&ab->base_lock);
+@@ -666,7 +712,32 @@ static void ath11k_nss_wds_type_rx(struc
+ 		   ta_peer->addr);
+ 
+ 	if (addr4_valid) {
+-		ast_entry = ath11k_peer_ast_find_by_addr(ab, src_mac);
++		ast_entry = ath11k_peer_ast_find_by_addr(ar, src_mac);
++
++		/*
++		 * If WDS update is coming back on same peer it indicates that it is not roamed
++		 * This situation can happen if a MEC packet reached in Rx direction even before the
++		 * ast entry installation in happend in HW
++		 */
++		if (ast_entry) {
++			if (ast_entry->peer && (ast_entry->peer->peer_id == ta_peer->peer_id) && (vif->type == NL80211_IFTYPE_STATION)) {
++				spin_unlock_bh(&ab->base_lock);
++				return;
++			}
++		}
++
++		/*
++		 * Avoid WDS learning if src mac address matches
++		 * any of local netdevice mac address.
++		 */
++		if (vif->type == NL80211_IFTYPE_AP || vif->type == NL80211_IFTYPE_AP_VLAN) {
++			if (vdev_check_local_dev(src_mac)) {
++				spin_unlock_bh(&ab->base_lock);
++				return;
++			}
++		}
++
++
+ 		if (!is_sa_valid) {
+ 			ath11k_peer_add_ast(ar, ta_peer, src_mac,
+ 					    ATH11K_AST_TYPE_WDS);
+@@ -749,7 +820,7 @@ static void ath11k_nss_vdev_spl_receive_
+ 
+ 	switch (wds_type) {
+ 		case NSS_WIFI_VDEV_WDS_TYPE_RX:
+-			ath11k_nss_wds_type_rx(ar, skb->dev, src_mac, is_sa_valid,
++			ath11k_nss_wds_type_rx(arvif, skb->dev, src_mac, is_sa_valid,
+ 					       addr4_valid, peer_id);
+ 			break;
+ 		case NSS_WIFI_VDEV_WDS_TYPE_MEC:
+@@ -774,7 +845,7 @@ static bool ath11k_nss_vdev_data_receive
+ 		   src_mac);
+ 
+ 	spin_lock_bh(&ab->base_lock);
+-	ast_entry = ath11k_peer_ast_find_by_addr(ab, src_mac);
++	ast_entry = ath11k_peer_ast_find_by_addr(ar, src_mac);
+ 
+ 	if (ast_entry && ast_entry->type == ATH11K_AST_TYPE_MEC) {
+ 		spin_unlock_bh(&ab->base_lock);
+@@ -880,7 +951,7 @@ ath11k_nss_vdev_special_data_receive(str
+ 			addr4_metadata = &wifi_metadata->metadata.addr4_metadata;
+ 
+ 			spin_lock_bh(&ab->base_lock);
+-			ta_peer = ath11k_peer_find_by_id(ab, addr4_metadata->peer_id);
++			ta_peer = ath11k_peer_find_by_id(arvif->ar, addr4_metadata->peer_id);
+ 			if (!ta_peer) {
+ 				spin_unlock_bh(&ab->base_lock);
+ 				dev_kfree_skb_any(skb);
+@@ -3485,7 +3556,7 @@ void ath11k_nss_update_sta_stats(struct
+ 		return;
+ 
+ 	spin_lock_bh(&ab->base_lock);
+-	peer = ath11k_peer_find_by_addr(ab, sta->addr);
++	peer = ath11k_peer_find_by_addr(ar, sta->addr);
+ 	if (!peer) {
+ 		ath11k_dbg(ab, ATH11K_DBG_NSS, "sta stats: unable to find peer %pM\n",
+ 					sta->addr);
+@@ -3642,7 +3713,7 @@ void ath11k_nss_update_sta_rxrate(struct
+ 	peer->nss.nss_stats->rxrate.bw = ath11k_mac_bw_to_mac80211_bw(ppdu_info->bw);
+ }
+ 
+-int ath11k_nss_peer_delete(struct ath11k_base *ab, u32 vdev_id, const u8 *addr)
++int ath11k_nss_peer_delete(struct ath11k *ar, u32 vdev_id, const u8 *addr)
+ {
+ 	struct nss_wifili_peer_msg *peer_msg;
+ 	struct nss_wifili_msg *wlmsg = NULL;
+@@ -3651,29 +3722,29 @@ int ath11k_nss_peer_delete(struct ath11k
+ 	nss_tx_status_t status;
+ 	int ret;
+ 
+-	if (!ab->nss.enabled)
++	if (!ar->ab->nss.enabled)
+ 		return 0;
+ 
+-	spin_lock_bh(&ab->base_lock);
++	spin_lock_bh(&ar->ab->base_lock);
+ 
+-	peer = ath11k_peer_find(ab, vdev_id, addr);
++	peer = ath11k_peer_find(ar, vdev_id, addr);
+ 	if (!peer) {
+-		ath11k_warn(ab, "peer (%pM) not found on vdev_id %d for nss peer delete\n",
++		ath11k_warn(ar->ab, "peer (%pM) not found on vdev_id %d for nss peer delete\n",
+ 			    addr, vdev_id);
+-		spin_unlock_bh(&ab->base_lock);
++		spin_unlock_bh(&ar->ab->base_lock);
+ 		return -EINVAL;
+ 	}
+ 
+ 	if (!peer->nss.vaddr) {
+-		ath11k_warn(ab, "peer already deleted or peer create failed %pM\n",
++		ath11k_warn(ar->ab, "peer already deleted or peer create failed %pM\n",
+ 			    addr);
+-		spin_unlock_bh(&ab->base_lock);
++		spin_unlock_bh(&ar->ab->base_lock);
+ 		return -EINVAL;
+ 	}
+ 
+ 	wlmsg = kzalloc(sizeof(struct nss_wifili_msg), GFP_ATOMIC);
+ 	if (!wlmsg) {
+-		ath11k_warn(ab, "nss send peer delete msg alloc failure\n");
++		ath11k_warn(ar->ab, "nss send peer delete msg alloc failure\n");
+ 		ret = -ENOMEM;
+ 		goto free_peer;
+ 	}
+@@ -3685,27 +3756,27 @@ int ath11k_nss_peer_delete(struct ath11k
+ 
+ 	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
+ 
+-	nss_cmn_msg_init(&wlmsg->cm, ab->nss.if_num,
++	nss_cmn_msg_init(&wlmsg->cm, ar->ab->nss.if_num,
+ 			 NSS_WIFILI_PEER_DELETE_MSG,
+ 			 sizeof(struct nss_wifili_peer_msg),
+ 			 msg_cb, NULL);
+ 
+ 	reinit_completion(&peer->nss.complete);
+ 
+-	status = nss_wifili_tx_msg(ab->nss.ctx, wlmsg);
++	status = nss_wifili_tx_msg(ar->ab->nss.ctx, wlmsg);
+ 	if (status != NSS_TX_SUCCESS) {
+-		ath11k_warn(ab, "nss send peer (%pM) delete msg tx error %d\n",
++		ath11k_warn(ar->ab, "nss send peer (%pM) delete msg tx error %d\n",
+ 			    addr, status);
+ 		ret = -EINVAL;
+ 		kfree(wlmsg);
+ 		goto free_peer;
+ 	} else {
+-		ath11k_dbg(ab, ATH11K_DBG_NSS, "nss peer delete message success : peer_id %d\n",
++		ath11k_dbg(ar->ab, ATH11K_DBG_NSS, "nss peer delete message success : peer_id %d\n",
+ 			   peer->peer_id);
+ 		ret = 0;
+ 	}
+ 
+-	spin_unlock_bh(&ab->base_lock);
++	spin_unlock_bh(&ar->ab->base_lock);
+ 
+ 	kfree(wlmsg);
+ 
+@@ -3715,20 +3786,20 @@ int ath11k_nss_peer_delete(struct ath11k
+ 	 */
+ 	ret = wait_for_completion_timeout(&peer->nss.complete,
+ 					  msecs_to_jiffies(ATH11K_NSS_MSG_TIMEOUT_MS));
+-	if (ab->nss.debug_mode && !ret)
+-		ath11k_warn(ab, "timeout while waiting for nss peer delete msg response\n");
++	if (ar->ab->nss.debug_mode && !ret)
++		ath11k_warn(ar->ab, "timeout while waiting for nss peer delete msg response\n");
+ 
+ 	return 0;
+ 
+ free_peer:
+-	dma_unmap_single(ab->dev, peer->nss.paddr,
++	dma_unmap_single(ar->ab->dev, peer->nss.paddr,
+ 		 WIFILI_NSS_PEER_BYTE_SIZE, DMA_FROM_DEVICE);
+ 	kfree(peer->nss.vaddr);
+ 	if (peer->nss.nss_stats) {
+ 		kfree(peer->nss.nss_stats);
+ 		peer->nss.nss_stats = NULL;
+ 	}
+-	spin_unlock_bh(&ab->base_lock);
++	spin_unlock_bh(&ar->ab->base_lock);
+ 	return ret;
+ }
+ 
+@@ -4467,10 +4538,11 @@ static int ath11k_nss_init(struct ath11k
+ 		ath11k_warn(ab, "timeout while waiting for nss init msg response\n");
+ 		goto unregister;
+ 	}
+-
+ 	/* Check if the response is success from the callback */
+-	if (ab->nss.response != ATH11K_NSS_MSG_ACK)
++	if (ab->nss.response != ATH11K_NSS_MSG_ACK) {
++	  ath11k_warn(ab, "non ack response from nss received (%d)\n", ab->nss.response);
+ 		goto unregister;
++	}
+ 
+ 	kfree(wlmsg);
+ 
+@@ -4580,6 +4652,7 @@ int ath11k_nss_pdev_init(struct ath11k_b
+ 	 * for messages related to vdev/radio
+ 	 */
+ 	ar->nss.if_num = radio_if_num;
++	spin_lock_init(&ar->nss.dump_lock);
+ 
+ 	/* No callbacks are registered for radio specific events/data */
+ 	ar->nss.ctx = nss_register_wifili_radio_if((u32)radio_if_num, NULL,
+--- a/drivers/net/wireless/ath/ath11k/nss.h
++++ b/drivers/net/wireless/ath/ath11k/nss.h
+@@ -283,7 +283,7 @@ int ath11k_nss_vdev_create(struct ath11k
+ void ath11k_nss_vdev_delete(struct ath11k_vif *arvif);
+ int ath11k_nss_vdev_up(struct ath11k_vif *arvif);
+ int ath11k_nss_vdev_down(struct ath11k_vif *arvif);
+-int ath11k_nss_peer_delete(struct ath11k_base *ab, u32 vdev_id, const u8 *addr);
++int ath11k_nss_peer_delete(struct ath11k *ar, u32 vdev_id, const u8 *addr);
+ int ath11k_nss_set_peer_authorize(struct ath11k *ar, u16 peer_id);
+ int ath11k_nss_peer_create(struct ath11k *ar, struct ath11k_peer *peer);
+ void ath11k_nss_peer_stats_enable(struct ath11k *ar);
+@@ -393,7 +393,7 @@ static inline int ath11k_nss_vdev_down(s
+ 	return 0;
+ }
+ 
+-static inline int ath11k_nss_peer_delete(struct ath11k_base *ab, u32 vdev_id,
++static inline int ath11k_nss_peer_delete(struct ath11k *ar, u32 vdev_id,
+                                          const u8 *addr)
+ {
+ 	return 0;
+--- a/drivers/net/wireless/ath/ath11k/peer.c
++++ b/drivers/net/wireless/ath/ath11k/peer.c
+@@ -9,14 +9,14 @@
+ #include "debug.h"
+ #include "nss.h"
+ 
+-static struct ath11k_peer *ath11k_peer_find_list_by_id(struct ath11k_base *ab,
++static struct ath11k_peer *ath11k_peer_find_list_by_id(struct ath11k *ar,
+ 						       int peer_id)
+ {
+ 	struct ath11k_peer *peer;
+ 
+-	lockdep_assert_held(&ab->base_lock);
++	lockdep_assert_held(&ar->ab->base_lock);
+ 
+-	list_for_each_entry(peer, &ab->peers, list) {
++	list_for_each_entry(peer, &ar->peers, list) {
+ 		if (peer->peer_id != peer_id)
+ 			continue;
+ 
+@@ -26,14 +26,14 @@ static struct ath11k_peer *ath11k_peer_f
+ 	return NULL;
+ }
+ 
+-struct ath11k_peer *ath11k_peer_find(struct ath11k_base *ab, int vdev_id,
++struct ath11k_peer *ath11k_peer_find(struct ath11k *ar, int vdev_id,
+ 				     const u8 *addr)
+ {
+ 	struct ath11k_peer *peer;
+ 
+-	lockdep_assert_held(&ab->base_lock);
++	lockdep_assert_held(&ar->ab->base_lock);
+ 
+-	list_for_each_entry(peer, &ab->peers, list) {
++	list_for_each_entry(peer, &ar->peers, list) {
+ 		if (peer->vdev_id != vdev_id)
+ 			continue;
+ 		if (!ether_addr_equal(peer->addr, addr))
+@@ -45,63 +45,31 @@ struct ath11k_peer *ath11k_peer_find(str
+ 	return NULL;
+ }
+ 
+-struct ath11k_peer *ath11k_peer_find_by_addr(struct ath11k_base *ab,
+-					     const u8 *addr)
+-{
+-	struct ath11k_peer *peer;
+-
+-	lockdep_assert_held(&ab->base_lock);
+-
+-	if (!ab->rhead_peer_addr)
+-		return NULL;
+-
+-	peer = rhashtable_lookup_fast(ab->rhead_peer_addr, addr,
+-				      ab->rhash_peer_addr_param);
+-
+-	return peer;
+-}
+-
+-struct ath11k_peer *ath11k_peer_find_by_id(struct ath11k_base *ab,
+-					   int peer_id)
+-{
+-	struct ath11k_peer *peer;
+-
+-	lockdep_assert_held(&ab->base_lock);
+-
+-	if (!ab->rhead_peer_id)
+-		return NULL;
+-
+-	peer = rhashtable_lookup_fast(ab->rhead_peer_id, &peer_id,
+-				      ab->rhash_peer_id_param);
+-
+-	return peer;
+-}
+-
+-struct ath11k_peer *ath11k_peer_find_by_vdev_id(struct ath11k_base *ab,
++struct ath11k_peer *ath11k_peer_find_by_vdev_id(struct ath11k *ar,
+ 						int vdev_id)
+ {
+ 	struct ath11k_peer *peer;
+ 
+-	spin_lock_bh(&ab->base_lock);
++	spin_lock_bh(&ar->ab->base_lock);
+ 
+-	list_for_each_entry(peer, &ab->peers, list) {
++	list_for_each_entry(peer, &ar->peers, list) {
+ 		if (vdev_id == peer->vdev_id) {
+-			spin_unlock_bh(&ab->base_lock);
++			spin_unlock_bh(&ar->ab->base_lock);
+ 			return peer;
+ 		}
+ 	}
+-	spin_unlock_bh(&ab->base_lock);
++	spin_unlock_bh(&ar->ab->base_lock);
+ 	return NULL;
+ }
+ 
+-struct ath11k_peer *ath11k_peer_find_by_ast(struct ath11k_base *ab,
++struct ath11k_peer *ath11k_peer_find_by_ast(struct ath11k *ar,
+ 					   int ast_hash)
+ {
+ 	struct ath11k_peer *peer;
+ 
+-	lockdep_assert_held(&ab->base_lock);
++	lockdep_assert_held(&ar->ab->base_lock);
+ 
+-	list_for_each_entry(peer, &ab->peers, list)
++	list_for_each_entry(peer, &ar->peers, list)
+ 		if (ast_hash == peer->ast_hash)
+ 			return peer;
+ 
+@@ -109,13 +77,13 @@ struct ath11k_peer *ath11k_peer_find_by_
+ }
+ 
+ #ifdef CPTCFG_ATH11K_NSS_SUPPORT
+-struct ath11k_ast_entry *ath11k_peer_ast_find_by_peer(struct ath11k_base *ab,
++struct ath11k_ast_entry *ath11k_peer_ast_find_by_peer(struct ath11k *ar,
+ 						      struct ath11k_peer *peer,
+ 						      u8* addr)
+ {
+ 	struct ath11k_ast_entry *ast_entry;
+ 
+-	lockdep_assert_held(&ab->base_lock);
++	lockdep_assert_held(&ar->ab->base_lock);
+ 
+ 	list_for_each_entry(ast_entry, &peer->ast_entry_list, ase_list)
+ 		if (ether_addr_equal(ast_entry->addr, addr))
+@@ -124,15 +92,15 @@ struct ath11k_ast_entry *ath11k_peer_ast
+ 	return NULL;
+ }
+ 
+-struct ath11k_ast_entry *ath11k_peer_ast_find_by_addr(struct ath11k_base *ab,
++struct ath11k_ast_entry *ath11k_peer_ast_find_by_addr(struct ath11k *ar,
+ 						      u8* addr)
+ {
+ 	struct ath11k_ast_entry *ast_entry;
+ 	struct ath11k_peer *peer;
+ 
+-	lockdep_assert_held(&ab->base_lock);
++	lockdep_assert_held(&ar->ab->base_lock);
+ 
+-	list_for_each_entry(peer, &ab->peers, list)
++	list_for_each_entry(peer, &ar->peers, list)
+ 		list_for_each_entry(ast_entry, &peer->ast_entry_list, ase_list)
+ 			if (ether_addr_equal(ast_entry->addr, addr))
+ 				return ast_entry;
+@@ -149,7 +117,7 @@ struct ath11k_ast_entry *ath11k_peer_ast
+ 
+ 	lockdep_assert_held(&ab->base_lock);
+ 
+-	list_for_each_entry(peer, &ab->peers, list)
++	list_for_each_entry(peer, &ar->peers, list)
+ 		list_for_each_entry(ast_entry, &peer->ast_entry_list, ase_list)
+ 			if (ether_addr_equal(ast_entry->addr, addr) &&
+ 			    ast_entry->pdev_idx == ar->pdev_idx)
+@@ -186,7 +154,7 @@ void ath11k_peer_ast_wds_wmi_wk(struct w
+ 		memcpy(peer_addr, peer->addr, sizeof(peer_addr));
+ 		peer_id = peer->peer_id;
+ 
+-		ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
++		ath11k_dbg(ab, ATH11K_DBG_MAC,
+ 			   "ath11k_peer_ast_wds_wmi_wk action %d ast_entry %pM peer %pM vdev %d\n",
+ 			   ast_entry->action, ast_entry->addr, peer_addr,
+ 			   ast_entry->vdev_id);
+@@ -198,7 +166,7 @@ void ath11k_peer_ast_wds_wmi_wk(struct w
+ 								       ast_entry->vdev_id,
+ 								       true);
+ 			if (ret) {
+-				ath11k_warn(ar->ab, "add wds_entry_cmd failed %d for %pM, peer %pM\n",
++				ath11k_warn(ab, "add wds_entry_cmd failed %d for %pM, peer %pM\n",
+ 					    ret, ast_entry->addr, peer_addr);
+ 				if (peer)
+ 					ath11k_nss_del_wds_peer(ar, peer_addr, peer_id,
+@@ -214,7 +182,7 @@ void ath11k_peer_ast_wds_wmi_wk(struct w
+ 									       ast_entry->vdev_id,
+ 									       false);
+ 				if (ret)
+-					ath11k_warn(ar->ab, "update wds_entry_cmd failed %d for %pM on peer %pM\n",
++					ath11k_warn(ab, "update wds_entry_cmd failed %d for %pM on peer %pM\n",
+ 						    ret, ast_entry->addr, peer_addr);
+ 		}
+ 		spin_lock_bh(&ab->base_lock);
+@@ -363,7 +331,7 @@ void ath11k_peer_map_ast(struct ath11k *
+ 	if (!peer)
+ 		return;
+ 
+-	ast_entry = ath11k_peer_ast_find_by_peer(ab, peer, mac_addr);
++	ast_entry = ath11k_peer_ast_find_by_peer(ar, peer, mac_addr);
+ 
+ 	if (ast_entry) {
+ 		ast_entry->ast_idx = hw_peer_id;
+@@ -418,6 +386,7 @@ void ath11k_peer_ast_cleanup(struct ath1
+                              bool is_wds, u32 free_wds_count)
+ {
+ 	struct ath11k_ast_entry *ast_entry, *tmp;
++	struct ath11k_base *ab = ar->ab;
+ 	u32 ast_deleted_count = 0;
+ 
+ 	if (peer->self_ast_entry) {
+@@ -435,22 +404,23 @@ void ath11k_peer_ast_cleanup(struct ath1
+ 
+ 	if (!is_wds) {
+ 		if (ast_deleted_count != free_wds_count)
+-			ath11k_warn(ar->ab, "ast_deleted_count (%d) mismatch on peer %pM free_wds_count (%d)!\n",
++			ath11k_warn(ab, "ast_deleted_count (%d) mismatch on peer %pM free_wds_count (%d)!\n",
+ 				    ast_deleted_count, peer->addr, free_wds_count);
+ 		else
+-			ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "ast_deleted_count (%d) on peer %pM free_wds_count (%d)\n",
++			ath11k_dbg(ab, ATH11K_DBG_MAC, "ast_deleted_count (%d) on peer %pM free_wds_count (%d)\n",
+ 				   ast_deleted_count, peer->addr, free_wds_count);
+ 	}
+ }
+ #endif
+ 
+-void ath11k_peer_unmap_event(struct ath11k_base *ab, u16 peer_id)
++void ath11k_peer_unmap_event(struct ath11k *ar, u16 peer_id)
+ {
+ 	struct ath11k_peer *peer;
++	struct ath11k_base *ab = ar->ab;
+ 
+ 	spin_lock_bh(&ab->base_lock);
+ 
+-	peer = ath11k_peer_find_list_by_id(ab, peer_id);
++	peer = ath11k_peer_find_list_by_id(ar, peer_id);
+ 	if (!peer) {
+ 		ath11k_warn(ab, "peer-unmap-event: unknown peer id %d\n",
+ 			    peer_id);
+@@ -462,34 +432,27 @@ void ath11k_peer_unmap_event(struct ath1
+ 
+ 	list_del(&peer->list);
+ 	kfree(peer);
+-	wake_up(&ab->peer_mapping_wq);
++	wake_up(&ar->peer_mapping_wq);
+ 
+ exit:
+ 	spin_unlock_bh(&ab->base_lock);
+ }
+ 
+-void ath11k_peer_unmap_v2_event(struct ath11k_base *ab, u16 peer_id, u8 *mac_addr,
++void ath11k_peer_unmap_v2_event(struct ath11k *ar, u16 peer_id, u8 *mac_addr,
+ 				bool is_wds, u32 free_wds_count)
+ {
+ 	struct ath11k_peer *peer;
+-	struct ath11k *ar;
++	struct ath11k_base *ab = ar->ab;
+ 
+ 	spin_lock_bh(&ab->base_lock);
+ 
+-	peer = ath11k_peer_find_list_by_id(ab, peer_id);
++	peer = ath11k_peer_find_list_by_id(ar, peer_id);
+ 	if (!peer) {
+ 		ath11k_warn(ab, "peer-unmap-event: unknown peer id %d\n",
+ 			    peer_id);
+ 		goto exit;
+ 	}
+ 
+-	rcu_read_lock();
+-	ar = ath11k_mac_get_ar_by_vdev_id(ab, peer->vdev_id);
+-	if (!ar) {
+-		ath11k_warn(ab, "peer-unmap-event: unknown peer vdev id %d\n",
+-			    peer->vdev_id);
+-		goto free_peer;
+-	}
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_DP_HTT, "htt peer unmap vdev %d peer %pM id %d is_wds %d free_wds_count %d\n",
+ 		   peer->vdev_id, peer->addr, peer_id, is_wds, free_wds_count);
+@@ -497,11 +460,10 @@ void ath11k_peer_unmap_v2_event(struct a
+ 	if (ab->nss.enabled) {
+ 		if (is_wds) {
+ 			struct ath11k_ast_entry *ast_entry =
+-				ath11k_peer_ast_find_by_peer(ab, peer, mac_addr);
++				ath11k_peer_ast_find_by_peer(ar, peer, mac_addr);
+ 
+ 			if (ast_entry)
+ 				ath11k_peer_del_ast(ar, ast_entry);
+-			rcu_read_unlock();
+ 			goto exit;
+ 		} else
+ 			ath11k_peer_ast_cleanup(ar, peer, is_wds, free_wds_count);
+@@ -511,26 +473,22 @@ void ath11k_peer_unmap_v2_event(struct a
+ 	if (ar->bss_peer && ether_addr_equal(ar->bss_peer->addr, peer->addr))
+ 		ar->bss_peer = NULL;
+ #endif
+-free_peer:
+-	rcu_read_unlock();
+ 	list_del(&peer->list);
+ 	kfree(peer);
+-	wake_up(&ab->peer_mapping_wq);
++	wake_up(&ar->peer_mapping_wq);
+ 
+ exit:
+ 	spin_unlock_bh(&ab->base_lock);
+ }
+ 
+-void ath11k_peer_map_event(struct ath11k_base *ab, u8 vdev_id, u16 peer_id,
++void ath11k_peer_map_event(struct ath11k *ar, u8 vdev_id, u16 peer_id,
+ 			   u8 *mac_addr, u16 ast_hash, u16 hw_peer_id)
+ {
+ 	struct ath11k_peer *peer;
+-	struct ath11k *ar = NULL;
++	struct ath11k_base *ab = ar->ab;
+ 
+-	rcu_read_lock();
+-	ar = ath11k_mac_get_ar_by_vdev_id(ab, vdev_id);
+ 	spin_lock_bh(&ab->base_lock);
+-	peer = ath11k_peer_find(ab, vdev_id, mac_addr);
++	peer = ath11k_peer_find(ar, vdev_id, mac_addr);
+ 	if (!peer) {
+ 		peer = kzalloc(sizeof(*peer), GFP_ATOMIC);
+ 		if (!peer)
+@@ -541,8 +499,8 @@ void ath11k_peer_map_event(struct ath11k
+ 		peer->ast_hash = ast_hash;
+ 		peer->hw_peer_id = hw_peer_id;
+ 		ether_addr_copy(peer->addr, mac_addr);
+-		list_add(&peer->list, &ab->peers);
+-		wake_up(&ab->peer_mapping_wq);
++		list_add(&peer->list, &ar->peers);
++		wake_up(&ar->peer_mapping_wq);
+ 		if (ab->nss.enabled && ar)
+ 			ath11k_nss_peer_create(ar, peer);
+ 	}
+@@ -552,21 +510,18 @@ void ath11k_peer_map_event(struct ath11k
+ 
+ exit:
+ 	spin_unlock_bh(&ab->base_lock);
+-	rcu_read_unlock();
+ }
+ 
+-void ath11k_peer_map_v2_event(struct ath11k_base *ab, u8 vdev_id, u16 peer_id,
++void ath11k_peer_map_v2_event(struct ath11k *ar, u8 vdev_id, u16 peer_id,
+ 			      u8 *mac_addr, u16 ast_hash, u16 hw_peer_id,
+ 			      bool is_wds)
+ {
+ 	struct ath11k_peer *peer;
+-	struct ath11k *ar = NULL;
++	struct ath11k_base *ab = ar->ab;
+ 	int ret;
+ 
+-	rcu_read_lock();
+-	ar = ath11k_mac_get_ar_by_vdev_id(ab, vdev_id);
+ 	spin_lock_bh(&ab->base_lock);
+-	peer = ath11k_peer_find(ab, vdev_id, mac_addr);
++	peer = ath11k_peer_find(ar, vdev_id, mac_addr);
+ 	if (!peer && !is_wds) {
+ 		peer = kzalloc(sizeof(*peer), GFP_ATOMIC);
+ 		if (!peer) {
+@@ -581,7 +536,7 @@ void ath11k_peer_map_v2_event(struct ath
+ 		peer->ast_hash = ast_hash;
+ 		peer->hw_peer_id = hw_peer_id;
+ 		ether_addr_copy(peer->addr, mac_addr);
+-		list_add(&peer->list, &ab->peers);
++		list_add(&peer->list, &ar->peers);
+ #ifdef CPTCFG_ATH11K_NSS_SUPPORT
+ 		INIT_LIST_HEAD(&peer->ast_entry_list);
+ #endif
+@@ -593,11 +548,11 @@ void ath11k_peer_map_v2_event(struct ath
+ 				goto peer_free;
+ 			}
+ 		}
+-		wake_up(&ab->peer_mapping_wq);
++		wake_up(&ar->peer_mapping_wq);
+ 	}
+ 
+ 	if (is_wds)
+-		peer = ath11k_peer_find_by_id(ab, peer_id);
++		peer = ath11k_peer_find_by_id(ar, peer_id);
+ 
+ 	if (ab->nss.enabled && ar)
+ 		ath11k_peer_map_ast(ar, peer, mac_addr, hw_peer_id, ast_hash);
+@@ -614,23 +569,22 @@ peer_free:
+ 	ath11k_peer_delete(ar, vdev_id, mac_addr);
+ 	mutex_unlock(&ar->conf_mutex);
+ exit:
+-	rcu_read_unlock();
+ }
+ 
+-static int ath11k_wait_for_peer_common(struct ath11k_base *ab, int vdev_id,
++static int ath11k_wait_for_peer_common(struct ath11k *ar, int vdev_id,
+ 				       const u8 *addr, bool expect_mapped)
+ {
+ 	int ret;
+ 
+-	ret = wait_event_timeout(ab->peer_mapping_wq, ({
++	ret = wait_event_timeout(ar->peer_mapping_wq, ({
+ 				bool mapped;
+ 
+-				spin_lock_bh(&ab->base_lock);
+-				mapped = !!ath11k_peer_find(ab, vdev_id, addr);
+-				spin_unlock_bh(&ab->base_lock);
++				spin_lock_bh(&ar->ab->base_lock);
++				mapped = !!ath11k_peer_find(ar, vdev_id, addr);
++				spin_unlock_bh(&ar->ab->base_lock);
+ 
+ 				(mapped == expect_mapped ||
+-				 test_bit(ATH11K_FLAG_CRASH_FLUSH, &ab->dev_flags));
++				 test_bit(ATH11K_FLAG_CRASH_FLUSH, &ar->ab->dev_flags));
+ 				}), 3 * HZ);
+ 
+ 	if (ret <= 0)
+@@ -639,7 +593,7 @@ static int ath11k_wait_for_peer_common(s
+ 	return 0;
+ }
+ 
+-static inline int ath11k_peer_rhash_insert(struct ath11k_base *ab,
++static inline int ath11k_peer_rhash_insert(struct ath11k *ar,
+ 					   struct rhashtable *rtbl,
+ 					   struct rhash_head *rhead,
+ 					   struct rhashtable_params *params,
+@@ -647,7 +601,7 @@ static inline int ath11k_peer_rhash_inse
+ {
+ 	struct ath11k_peer *tmp;
+ 
+-	lockdep_assert_held(&ab->tbl_mtx_lock);
++	lockdep_assert_held(&ar->tbl_mtx_lock);
+ 
+ 	tmp = rhashtable_lookup_get_insert_fast(rtbl, rhead, *params);
+ 
+@@ -659,14 +613,14 @@ static inline int ath11k_peer_rhash_inse
+ 		return -EEXIST;
+ }
+ 
+-static inline int ath11k_peer_rhash_remove(struct ath11k_base *ab,
++static inline int ath11k_peer_rhash_remove(struct ath11k *ar,
+ 					   struct rhashtable *rtbl,
+ 					   struct rhash_head *rhead,
+ 					   struct rhashtable_params *params)
+ {
+ 	int ret;
+ 
+-	lockdep_assert_held(&ab->tbl_mtx_lock);
++	lockdep_assert_held(&ar->tbl_mtx_lock);
+ 
+ 	ret = rhashtable_remove_fast(rtbl, rhead, *params);
+ 	if (ret && ret != -ENOENT)
+@@ -675,26 +629,27 @@ static inline int ath11k_peer_rhash_remo
+ 	return 0;
+ }
+ 
+-static int ath11k_peer_rhash_add(struct ath11k_base *ab, struct ath11k_peer *peer)
++static int ath11k_peer_rhash_add(struct ath11k *ar, struct ath11k_peer *peer)
+ {
+ 	int ret;
++	struct ath11k_base *ab = ar->ab;
+ 
+ 	lockdep_assert_held(&ab->base_lock);
+-	lockdep_assert_held(&ab->tbl_mtx_lock);
++	lockdep_assert_held(&ar->tbl_mtx_lock);
+ 
+-	if (!ab->rhead_peer_id || !ab->rhead_peer_addr)
++	if (!ar->rhead_peer_id || !ar->rhead_peer_addr)
+ 		return -EPERM;
+ 
+-	ret = ath11k_peer_rhash_insert(ab, ab->rhead_peer_id, &peer->rhash_id,
+-				       &ab->rhash_peer_id_param, &peer->peer_id);
++	ret = ath11k_peer_rhash_insert(ar, ar->rhead_peer_id, &peer->rhash_id,
++				       &ar->rhash_peer_id_param, &peer->peer_id);
+ 	if (ret) {
+ 		ath11k_warn(ab, "failed to add peer %pM with id %d in rhash_id ret %d\n",
+ 			    peer->addr, peer->peer_id, ret);
+ 		return ret;
+ 	}
+ 
+-	ret = ath11k_peer_rhash_insert(ab, ab->rhead_peer_addr, &peer->rhash_addr,
+-				       &ab->rhash_peer_addr_param, &peer->addr);
++	ret = ath11k_peer_rhash_insert(ar, ar->rhead_peer_addr, &peer->rhash_addr,
++				       &ar->rhash_peer_addr_param, &peer->addr);
+ 	if (ret) {
+ 		ath11k_warn(ab, "failed to add peer %pM with id %d in rhash_addr ret %d\n",
+ 			    peer->addr, peer->peer_id, ret);
+@@ -704,8 +659,8 @@ static int ath11k_peer_rhash_add(struct
+ 	return 0;
+ 
+ err_clean:
+-	ath11k_peer_rhash_remove(ab, ab->rhead_peer_id, &peer->rhash_id,
+-				 &ab->rhash_peer_id_param);
++	ath11k_peer_rhash_remove(ar, ar->rhead_peer_id, &peer->rhash_id,
++				 &ar->rhash_peer_id_param);
+ 	return ret;
+ }
+ 
+@@ -723,9 +678,9 @@ void ath11k_peer_cleanup(struct ath11k *
+ 	mutex_lock(&ab->base_ast_lock);
+ #endif
+ 
+-	mutex_lock(&ab->tbl_mtx_lock);
++	mutex_lock(&ar->tbl_mtx_lock);
+ 	spin_lock_bh(&ab->base_lock);
+-	list_for_each_entry_safe(peer, tmp_peer, &ab->peers, list) {
++	list_for_each_entry_safe(peer, tmp_peer, &ar->peers, list) {
+ 		if (peer->vdev_id != vdev_id)
+ 			continue;
+ 
+@@ -743,14 +698,14 @@ void ath11k_peer_cleanup(struct ath11k *
+ 			ath11k_peer_del_ast(ar, ast_entry);
+ #endif
+ 
+-		ath11k_peer_rhash_delete(ab, peer);
++		ath11k_peer_rhash_delete(ar, peer);
+ 		list_del(&peer->list);
+ 		kfree(peer);
+ 		ar->num_peers--;
+ 	}
+ 
+ 	spin_unlock_bh(&ab->base_lock);
+-	mutex_unlock(&ab->tbl_mtx_lock);
++	mutex_unlock(&ar->tbl_mtx_lock);
+ #ifdef CPTCFG_ATH11K_NSS_SUPPORT
+ 	mutex_unlock(&ab->base_ast_lock);
+ #endif
+@@ -758,25 +713,26 @@ void ath11k_peer_cleanup(struct ath11k *
+ 
+ static int ath11k_wait_for_peer_deleted(struct ath11k *ar, int vdev_id, const u8 *addr)
+ {
+-	return ath11k_wait_for_peer_common(ar->ab, vdev_id, addr, false);
++	return ath11k_wait_for_peer_common(ar, vdev_id, addr, false);
+ }
+ 
+ int ath11k_wait_for_peer_delete_done(struct ath11k *ar, u32 vdev_id,
+ 				     const u8 *addr)
+ {
++	struct ath11k_base *ab = ar->ab;
+ 	int ret;
+ 	unsigned long time_left;
+ 
+ 	ret = ath11k_wait_for_peer_deleted(ar, vdev_id, addr);
+ 	if (ret) {
+-		ath11k_warn(ar->ab, "failed wait for peer deleted");
++		ath11k_warn(ab, "failed wait for peer deleted");
+ 		return ret;
+ 	}
+ 
+ 	time_left = wait_for_completion_timeout(&ar->peer_delete_done,
+ 						3 * HZ);
+ 	if (time_left == 0) {
+-		ath11k_warn(ar->ab, "Timeout in receiving peer delete response\n");
++		ath11k_warn(ab, "Timeout in receiving peer delete response\n");
+ 		return -ETIMEDOUT;
+ 	}
+ 
+@@ -795,26 +751,22 @@ static int __ath11k_peer_delete(struct a
+ 	lockdep_assert_held(&ar->conf_mutex);
+ 
+ 	reinit_completion(&ar->peer_delete_done);
+-	ath11k_nss_peer_delete(ar->ab, vdev_id, addr);
++	ath11k_nss_peer_delete(ar, vdev_id, addr);
+ 
+ #ifdef CPTCFG_ATH11K_NSS_SUPPORT
+ 	mutex_lock(&ab->base_ast_lock);
+ #endif
+-	mutex_lock(&ab->tbl_mtx_lock);
++	mutex_lock(&ar->tbl_mtx_lock);
+ 	spin_lock_bh(&ab->base_lock);
+ 
+-	peer = ath11k_peer_find_by_addr(ab, addr);
+-
+-	/* Fallback to peer list search if the correct peer can't be found.
+-	 * Skip the deletion of the peer from the rhash since it has already
+-	 * been deleted in peer add.
+-	 */
+-	if (!peer)
+-		peer = ath11k_peer_find(ab, vdev_id, addr);
++	peer = ath11k_peer_find(ar, vdev_id, addr);
+ 
+ 	if (!peer) {
+ 		spin_unlock_bh(&ab->base_lock);
+-		mutex_unlock(&ab->tbl_mtx_lock);
++		mutex_unlock(&ar->tbl_mtx_lock);
++#ifdef CPTCFG_ATH11K_NSS_SUPPORT
++		mutex_unlock(&ab->base_ast_lock);
++#endif
+ 
+ 		ath11k_warn(ab,
+ 			    "failed to find peer vdev_id %d addr %pM in delete\n",
+@@ -835,18 +787,18 @@ static int __ath11k_peer_delete(struct a
+ 			if ((ast_entry->type == ATH11K_AST_TYPE_WDS) ||
+ 			    (ast_entry->type == ATH11K_AST_TYPE_MEC)) {
+ 				if (!list_empty(&ast_entry->wmi_list)) {
+-					ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
++					ath11k_dbg(ab, ATH11K_DBG_MAC,
+ 						   "%s deleting unprocessed ast entry %pM of peer %pM from wmi list\n",
+ 						   __func__, ast_entry->addr, addr);
+ 					list_del_init(&ast_entry->wmi_list);
+ 				}
+ 			}
+ #endif
+-		ath11k_peer_rhash_delete(ab, peer);
++		ath11k_peer_rhash_delete(ar, peer);
+ 	}
+ 
+ 	spin_unlock_bh(&ab->base_lock);
+-	mutex_unlock(&ab->tbl_mtx_lock);
++	mutex_unlock(&ar->tbl_mtx_lock);
+ 
+ #ifdef CPTCFG_ATH11K_NSS_SUPPORT
+ 	mutex_unlock(&ab->base_ast_lock);
+@@ -884,7 +836,7 @@ int ath11k_peer_delete(struct ath11k *ar
+ 
+ static int ath11k_wait_for_peer_created(struct ath11k *ar, int vdev_id, const u8 *addr)
+ {
+-	return ath11k_wait_for_peer_common(ar->ab, vdev_id, addr, true);
++	return ath11k_wait_for_peer_common(ar, vdev_id, addr, true);
+ }
+ 
+ int ath11k_peer_create(struct ath11k *ar, struct ath11k_vif *arvif,
+@@ -892,38 +844,41 @@ int ath11k_peer_create(struct ath11k *ar
+ {
+ 	struct ath11k_peer *peer;
+ 	struct ieee80211_vif *vif = arvif->vif;
++	struct ath11k_base *ab = ar->ab;
+ 	struct ath11k_sta *arsta;
+ 	int ret, fbret;
+ 
+ 	lockdep_assert_held(&ar->conf_mutex);
+ 
+ 	if (ar->num_peers > (ar->max_num_peers - 1)) {
+-		ath11k_warn(ar->ab,
++		ath11k_warn(ab,
+ 			    "failed to create peer due to insufficient peer entry resource in firmware\n");
+ 		return -ENOBUFS;
+ 	}
+ 
+-	mutex_lock(&ar->ab->tbl_mtx_lock);
+-	spin_lock_bh(&ar->ab->base_lock);
+-	peer = ath11k_peer_find_by_addr(ar->ab, param->peer_addr);
+-	if (peer) {
+-		if (peer->vdev_id == param->vdev_id) {
+-			spin_unlock_bh(&ar->ab->base_lock);
+-			mutex_unlock(&ar->ab->tbl_mtx_lock);
+-			return -EINVAL;
+-		}
++	mutex_lock(&ar->tbl_mtx_lock);
++	spin_lock_bh(&ab->base_lock);
+ 
+-		/* Assume sta is transitioning to another band.
+-		 * Remove here the peer from rhash.
+-		 */
+-		ath11k_peer_rhash_delete(ar->ab, peer);
++	/* try exact match first to prevent double addition */
++	peer = ath11k_peer_find(ar, param->vdev_id, param->peer_addr);
++	if (peer) {
++		spin_unlock_bh(&ab->base_lock);
++		mutex_unlock(&ar->tbl_mtx_lock);
++		return -EINVAL;
+ 	}
+-	spin_unlock_bh(&ar->ab->base_lock);
+-	mutex_unlock(&ar->ab->tbl_mtx_lock);
++	/* try loose match now and check if peer mac is already associated at another bssid on the same mac */
++	peer = ath11k_peer_find_by_addr(ar, param->peer_addr);
++	if (peer) {
++		/* if found, remove it from the hash list, so it wont be handled by datapath anymore, since we expect a disassoc soon */
++		peer->delete_in_progress = true;
++		ath11k_peer_rhash_delete(ar, peer);
++	}
++	spin_unlock_bh(&ab->base_lock);
++	mutex_unlock(&ar->tbl_mtx_lock);
+ 
+ 	ret = ath11k_wmi_send_peer_create_cmd(ar, param);
+ 	if (ret) {
+-		ath11k_warn(ar->ab,
++		ath11k_warn(ab,
+ 			    "failed to send peer create vdev_id %d ret %d\n",
+ 			    param->vdev_id, ret);
+ 		return ret;
+@@ -934,24 +889,23 @@ int ath11k_peer_create(struct ath11k *ar
+ 	if (ret)
+ 		return ret;
+ 
+-	mutex_lock(&ar->ab->tbl_mtx_lock);
+-	spin_lock_bh(&ar->ab->base_lock);
++	mutex_lock(&ar->tbl_mtx_lock);
++	spin_lock_bh(&ab->base_lock);
+ 
+-	peer = ath11k_peer_find(ar->ab, param->vdev_id, param->peer_addr);
++	peer = ath11k_peer_find(ar, param->vdev_id, param->peer_addr);
+ 	if (!peer) {
+-		spin_unlock_bh(&ar->ab->base_lock);
+-		mutex_unlock(&ar->ab->tbl_mtx_lock);
+-		ath11k_warn(ar->ab, "failed to find peer %pM on vdev %i after creation\n",
++		spin_unlock_bh(&ab->base_lock);
++		mutex_unlock(&ar->tbl_mtx_lock);
++		ath11k_warn(ab, "failed to find peer %pM on vdev %i after creation\n",
+ 			    param->peer_addr, param->vdev_id);
+-
+ 		ret = -ENOENT;
+ 		goto cleanup;
+ 	}
+ 
+-	ret = ath11k_peer_rhash_add(ar->ab, peer);
++	ret = ath11k_peer_rhash_add(ar, peer);
+ 	if (ret) {
+-		spin_unlock_bh(&ar->ab->base_lock);
+-		mutex_unlock(&ar->ab->tbl_mtx_lock);
++		spin_unlock_bh(&ab->base_lock);
++		mutex_unlock(&ar->tbl_mtx_lock);
+ 		goto cleanup;
+ 	}
+ 
+@@ -968,7 +922,7 @@ int ath11k_peer_create(struct ath11k *ar
+ 	peer->vif = arvif->vif;
+ 
+ #ifdef CPTCFG_ATH11K_NSS_SUPPORT
+-	if (vif->type == NL80211_IFTYPE_STATION && ar->ab->nss.enabled)
++	if (vif->type == NL80211_IFTYPE_STATION && ab->nss.enabled)
+ 		ar->bss_peer = peer;
+ 	else
+ 		ar->bss_peer = NULL;
+@@ -986,40 +940,41 @@ int ath11k_peer_create(struct ath11k *ar
+ 
+ 	ar->num_peers++;
+ 
+-	spin_unlock_bh(&ar->ab->base_lock);
+-	mutex_unlock(&ar->ab->tbl_mtx_lock);
++	spin_unlock_bh(&ab->base_lock);
++	mutex_unlock(&ar->tbl_mtx_lock);
+ 
+ 	return 0;
+ 
+ cleanup:
+ 	fbret = __ath11k_peer_delete(ar, param->vdev_id, param->peer_addr);
+ 	if (fbret)
+-		ath11k_warn(ar->ab, "failed peer %pM delete vdev_id %d fallback ret %d\n",
++		ath11k_warn(ab, "failed peer %pM delete vdev_id %d fallback ret %d\n",
+ 			    param->peer_addr, param->vdev_id, fbret);
+ 
+ 	return ret;
+ }
+ 
+-int ath11k_peer_rhash_delete(struct ath11k_base *ab, struct ath11k_peer *peer)
++int ath11k_peer_rhash_delete(struct ath11k *ar, struct ath11k_peer *peer)
+ {
++	struct ath11k_base *ab = ar->ab;
+ 	int ret;
+ 
+ 	lockdep_assert_held(&ab->base_lock);
+-	lockdep_assert_held(&ab->tbl_mtx_lock);
++	lockdep_assert_held(&ar->tbl_mtx_lock);
+ 
+-	if (!ab->rhead_peer_id || !ab->rhead_peer_addr)
++	if (!ar->rhead_peer_id || !ar->rhead_peer_addr)
+ 		return -EPERM;
+ 
+-	ret = ath11k_peer_rhash_remove(ab, ab->rhead_peer_addr, &peer->rhash_addr,
+-				       &ab->rhash_peer_addr_param);
++	ret = ath11k_peer_rhash_remove(ar, ar->rhead_peer_addr, &peer->rhash_addr,
++				       &ar->rhash_peer_addr_param);
+ 	if (ret) {
+ 		ath11k_warn(ab, "failed to remove peer %pM id %d in rhash_addr ret %d\n",
+ 			    peer->addr, peer->peer_id, ret);
+ 		return ret;
+ 	}
+ 
+-	ret = ath11k_peer_rhash_remove(ab, ab->rhead_peer_id, &peer->rhash_id,
+-				       &ab->rhash_peer_id_param);
++	ret = ath11k_peer_rhash_remove(ar, ar->rhead_peer_id, &peer->rhash_id,
++				       &ar->rhash_peer_id_param);
+ 	if (ret) {
+ 		ath11k_warn(ab, "failed to remove peer %pM id %d in rhash_id ret %d\n",
+ 			    peer->addr, peer->peer_id, ret);
+@@ -1029,19 +984,20 @@ int ath11k_peer_rhash_delete(struct ath1
+ 	return 0;
+ }
+ 
+-static int ath11k_peer_rhash_id_tbl_init(struct ath11k_base *ab)
++static int ath11k_peer_rhash_id_tbl_init(struct ath11k *ar)
+ {
++	struct ath11k_base *ab = ar->ab;
+ 	struct rhashtable_params *param;
+ 	struct rhashtable *rhash_id_tbl;
+ 	int ret;
+ 	size_t size;
+ 
+-	lockdep_assert_held(&ab->tbl_mtx_lock);
++	lockdep_assert_held(&ar->tbl_mtx_lock);
+ 
+-	if (ab->rhead_peer_id)
++	if (ar->rhead_peer_id)
+ 		return 0;
+ 
+-	size = sizeof(*ab->rhead_peer_id);
++	size = sizeof(*ar->rhead_peer_id);
+ 	rhash_id_tbl = kzalloc(size, GFP_KERNEL);
+ 	if (!rhash_id_tbl) {
+ 		ath11k_warn(ab, "failed to init rhash id table due to no mem (size %zu)\n",
+@@ -1049,13 +1005,13 @@ static int ath11k_peer_rhash_id_tbl_init
+ 		return -ENOMEM;
+ 	}
+ 
+-	param = &ab->rhash_peer_id_param;
++	param = &ar->rhash_peer_id_param;
+ 
+ 	param->key_offset = offsetof(struct ath11k_peer, peer_id);
+ 	param->head_offset = offsetof(struct ath11k_peer, rhash_id);
+ 	param->key_len = sizeof_field(struct ath11k_peer, peer_id);
+ 	param->automatic_shrinking = true;
+-	param->nelem_hint = ab->num_radios * TARGET_NUM_PEERS_PDEV(ab);
++	param->nelem_hint = TARGET_NUM_PEERS_PDEV(ab);
+ 
+ 	ret = rhashtable_init(rhash_id_tbl, param);
+ 	if (ret) {
+@@ -1063,10 +1019,10 @@ static int ath11k_peer_rhash_id_tbl_init
+ 		goto err_free;
+ 	}
+ 
+-	spin_lock_bh(&ab->base_lock);
++	spin_lock_bh(&ab->base_lock); // todo removw
+ 
+-	if (!ab->rhead_peer_id) {
+-		ab->rhead_peer_id = rhash_id_tbl;
++	if (!ar->rhead_peer_id) {
++		ar->rhead_peer_id = rhash_id_tbl;
+ 	} else {
+ 		spin_unlock_bh(&ab->base_lock);
+ 		goto cleanup_tbl;
+@@ -1084,19 +1040,20 @@ err_free:
+ 	return ret;
+ }
+ 
+-static int ath11k_peer_rhash_addr_tbl_init(struct ath11k_base *ab)
++static int ath11k_peer_rhash_addr_tbl_init(struct ath11k *ar)
+ {
++	struct ath11k_base *ab = ar->ab;
+ 	struct rhashtable_params *param;
+ 	struct rhashtable *rhash_addr_tbl;
+ 	int ret;
+ 	size_t size;
+ 
+-	lockdep_assert_held(&ab->tbl_mtx_lock);
++	lockdep_assert_held(&ar->tbl_mtx_lock);
+ 
+-	if (ab->rhead_peer_addr)
++	if (ar->rhead_peer_addr)
+ 		return 0;
+ 
+-	size = sizeof(*ab->rhead_peer_addr);
++	size = sizeof(*ar->rhead_peer_addr);
+ 	rhash_addr_tbl = kzalloc(size, GFP_KERNEL);
+ 	if (!rhash_addr_tbl) {
+ 		ath11k_warn(ab, "failed to init rhash addr table due to no mem (size %zu)\n",
+@@ -1104,13 +1061,13 @@ static int ath11k_peer_rhash_addr_tbl_in
+ 		return -ENOMEM;
+ 	}
+ 
+-	param = &ab->rhash_peer_addr_param;
++	param = &ar->rhash_peer_addr_param;
+ 
+ 	param->key_offset = offsetof(struct ath11k_peer, addr);
+ 	param->head_offset = offsetof(struct ath11k_peer, rhash_addr);
+ 	param->key_len = sizeof_field(struct ath11k_peer, addr);
+ 	param->automatic_shrinking = true;
+-	param->nelem_hint = ab->num_radios * TARGET_NUM_PEERS_PDEV(ab);
++	param->nelem_hint = TARGET_NUM_PEERS_PDEV(ab);
+ 
+ 	ret = rhashtable_init(rhash_addr_tbl, param);
+ 	if (ret) {
+@@ -1118,10 +1075,10 @@ static int ath11k_peer_rhash_addr_tbl_in
+ 		goto err_free;
+ 	}
+ 
+-	spin_lock_bh(&ab->base_lock);
++	spin_lock_bh(&ab->base_lock); // todo remove
+ 
+-	if (!ab->rhead_peer_addr) {
+-		ab->rhead_peer_addr = rhash_addr_tbl;
++	if (!ar->rhead_peer_addr) {
++		ar->rhead_peer_addr = rhash_addr_tbl;
+ 	} else {
+ 		spin_unlock_bh(&ab->base_lock);
+ 		goto cleanup_tbl;
+@@ -1139,61 +1096,61 @@ err_free:
+ 	return ret;
+ }
+ 
+-static inline void ath11k_peer_rhash_id_tbl_destroy(struct ath11k_base *ab)
++static inline void ath11k_peer_rhash_id_tbl_destroy(struct ath11k *ar)
+ {
+-	lockdep_assert_held(&ab->tbl_mtx_lock);
++	lockdep_assert_held(&ar->tbl_mtx_lock);
+ 
+-	if (!ab->rhead_peer_id)
++	if (!ar->rhead_peer_id)
+ 		return;
+ 
+-	rhashtable_destroy(ab->rhead_peer_id);
+-	kfree(ab->rhead_peer_id);
+-	ab->rhead_peer_id = NULL;
++	rhashtable_destroy(ar->rhead_peer_id);
++	kfree(ar->rhead_peer_id);
++	ar->rhead_peer_id = NULL;
+ }
+ 
+-static inline void ath11k_peer_rhash_addr_tbl_destroy(struct ath11k_base *ab)
++static inline void ath11k_peer_rhash_addr_tbl_destroy(struct ath11k *ar)
+ {
+-	lockdep_assert_held(&ab->tbl_mtx_lock);
++	lockdep_assert_held(&ar->tbl_mtx_lock);
+ 
+-	if (!ab->rhead_peer_addr)
++	if (!ar->rhead_peer_addr)
+ 		return;
+ 
+-	rhashtable_destroy(ab->rhead_peer_addr);
+-	kfree(ab->rhead_peer_addr);
+-	ab->rhead_peer_addr = NULL;
++	rhashtable_destroy(ar->rhead_peer_addr);
++	kfree(ar->rhead_peer_addr);
++	ar->rhead_peer_addr = NULL;
+ }
+ 
+-int ath11k_peer_rhash_tbl_init(struct ath11k_base *ab)
++int ath11k_peer_rhash_tbl_init(struct ath11k *ar)
+ {
+ 	int ret;
+ 
+-	mutex_lock(&ab->tbl_mtx_lock);
++	mutex_lock(&ar->tbl_mtx_lock);
+ 
+-	ret = ath11k_peer_rhash_id_tbl_init(ab);
++	ret = ath11k_peer_rhash_id_tbl_init(ar);
+ 	if (ret)
+ 		goto out;
+ 
+-	ret = ath11k_peer_rhash_addr_tbl_init(ab);
++	ret = ath11k_peer_rhash_addr_tbl_init(ar);
+ 	if (ret)
+ 		goto cleanup_tbl;
+ 
+-	mutex_unlock(&ab->tbl_mtx_lock);
++	mutex_unlock(&ar->tbl_mtx_lock);
+ 
+ 	return 0;
+ 
+ cleanup_tbl:
+-	ath11k_peer_rhash_id_tbl_destroy(ab);
++	ath11k_peer_rhash_id_tbl_destroy(ar);
+ out:
+-	mutex_unlock(&ab->tbl_mtx_lock);
++	mutex_unlock(&ar->tbl_mtx_lock);
+ 	return ret;
+ }
+ 
+-void ath11k_peer_rhash_tbl_destroy(struct ath11k_base *ab)
++void ath11k_peer_rhash_tbl_destroy(struct ath11k *ar)
+ {
+-	mutex_lock(&ab->tbl_mtx_lock);
++	mutex_lock(&ar->tbl_mtx_lock);
+ 
+-	ath11k_peer_rhash_addr_tbl_destroy(ab);
+-	ath11k_peer_rhash_id_tbl_destroy(ab);
++	ath11k_peer_rhash_addr_tbl_destroy(ar);
++	ath11k_peer_rhash_id_tbl_destroy(ar);
+ 
+-	mutex_unlock(&ab->tbl_mtx_lock);
++	mutex_unlock(&ar->tbl_mtx_lock);
+ }
+--- a/drivers/net/wireless/ath/ath11k/peer.h
++++ b/drivers/net/wireless/ath/ath11k/peer.h
+@@ -99,34 +99,32 @@ struct ath11k_peer {
+ 	bool delete_in_progress;
+ };
+ 
+-void ath11k_peer_unmap_event(struct ath11k_base *ab, u16 peer_id);
+-void ath11k_peer_unmap_v2_event(struct ath11k_base *ab, u16 peer_id, u8 *mac_addr,
++
++void ath11k_peer_unmap_event(struct ath11k *ar, u16 peer_id);
++void ath11k_peer_unmap_v2_event(struct ath11k *ar, u16 peer_id, u8 *mac_addr,
+ 			        bool is_wds, u32 free_wds_count);
+-void ath11k_peer_map_event(struct ath11k_base *ab, u8 vdev_id, u16 peer_id,
++void ath11k_peer_map_event(struct ath11k *ar, u8 vdev_id, u16 peer_id,
+ 			   u8 *mac_addr, u16 ast_hash, u16 hw_peer_id);
+-void ath11k_peer_map_v2_event(struct ath11k_base *ab, u8 vdev_id, u16 peer_id,
++void ath11k_peer_map_v2_event(struct ath11k *ar, u8 vdev_id, u16 peer_id,
+ 			      u8 *mac_addr, u16 ast_hash, u16 hw_peer_id,
+ 			      bool is_wds);
+-struct ath11k_peer *ath11k_peer_find(struct ath11k_base *ab, int vdev_id,
++struct ath11k_peer *ath11k_peer_find(struct ath11k *at, int vdev_id,
+ 				     const u8 *addr);
+-struct ath11k_peer *ath11k_peer_find_by_addr(struct ath11k_base *ab,
+-					     const u8 *addr);
+-struct ath11k_peer *ath11k_peer_find_by_id(struct ath11k_base *ab, int peer_id);
+-struct ath11k_peer *ath11k_peer_find_by_ast(struct ath11k_base *ab, int ast_hash);
++struct ath11k_peer *ath11k_peer_find_by_ast(struct ath11k *ar, int ast_hash);
+ void ath11k_peer_cleanup(struct ath11k *ar, u32 vdev_id);
+ int ath11k_peer_delete(struct ath11k *ar, u32 vdev_id, u8 *addr);
+ int ath11k_peer_create(struct ath11k *ar, struct ath11k_vif *arvif,
+ 		       struct ieee80211_sta *sta, struct peer_create_params *param);
+ int ath11k_wait_for_peer_delete_done(struct ath11k *ar, u32 vdev_id,
+ 				     const u8 *addr);
+-struct ath11k_peer *ath11k_peer_find_by_vdev_id(struct ath11k_base *ab,
++struct ath11k_peer *ath11k_peer_find_by_vdev_id(struct ath11k *ar,
+ 						int vdev_id);
+-int ath11k_peer_rhash_tbl_init(struct ath11k_base *ab);
+-void ath11k_peer_rhash_tbl_destroy(struct ath11k_base *ab);
+-int ath11k_peer_rhash_delete(struct ath11k_base *ab, struct ath11k_peer *peer);
++int ath11k_peer_rhash_tbl_init(struct ath11k *ar);
++void ath11k_peer_rhash_tbl_destroy(struct ath11k *ar);
++int ath11k_peer_rhash_delete(struct ath11k *ar, struct ath11k_peer *peer);
+ 
+ #ifdef CPTCFG_ATH11K_NSS_SUPPORT
+-struct ath11k_ast_entry *ath11k_peer_ast_find_by_addr(struct ath11k_base *ab,
++struct ath11k_ast_entry *ath11k_peer_ast_find_by_addr(struct ath11k *ar,
+ 						      u8* addr);
+ struct ath11k_ast_entry *ath11k_peer_ast_find_by_pdev_idx(struct ath11k *ar,
+ 							  u8* addr);
+@@ -140,11 +138,11 @@ void ath11k_peer_del_ast(struct ath11k *
+ void ath11k_peer_ast_cleanup(struct ath11k *ar, struct ath11k_peer *peer,
+ 			     bool is_wds, u32 free_wds_count);
+ void ath11k_peer_ast_wds_wmi_wk(struct work_struct *wk);
+-struct ath11k_ast_entry *ath11k_peer_ast_find_by_peer(struct ath11k_base *ab,
++struct ath11k_ast_entry *ath11k_peer_ast_find_by_peer(struct ath11k *ar,
+ 						      struct ath11k_peer *peer,
+ 						      u8* addr);
+ #else
+-static inline struct ath11k_ast_entry *ath11k_peer_ast_find_by_addr(struct ath11k_base *ab,
++static inline struct ath11k_ast_entry *ath11k_peer_ast_find_by_addr(struct ath11k *ar,
+ 								    u8* addr)
+ {
+ 	return NULL;
+@@ -192,7 +190,7 @@ static inline void ath11k_peer_ast_wds_w
+ 	return;
+ }
+ 
+-static inline struct ath11k_ast_entry *ath11k_peer_ast_find_by_peer(struct ath11k_base *ab,
++static inline struct ath11k_ast_entry *ath11k_peer_ast_find_by_peer(struct ath11k *ar,
+ 								    struct ath11k_peer *peer,
+ 								    u8* addr)
+ {
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -7579,10 +7579,12 @@ static void ath11k_wmi_event_peer_sta_ps
+ 	struct ieee80211_sta *sta;
+ 	struct ath11k_peer *peer;
+ 	struct ath11k *ar;
++	struct ath11k_pdev *pdev;
+ 	struct ath11k_sta *arsta;
+ 	const void **tb;
+ 	enum ath11k_wmi_peer_ps_state peer_previous_ps_state;
+ 	int ret;
++	int i;
+ 
+ 	tb = ath11k_wmi_tlv_parse_alloc(ab, skb, GFP_ATOMIC);
+ 	if (IS_ERR(tb)) {
+@@ -7606,64 +7608,60 @@ static void ath11k_wmi_event_peer_sta_ps
+ 
+ 	rcu_read_lock();
+ 
+-	spin_lock_bh(&ab->base_lock);
+ 
+-	peer = ath11k_peer_find_by_addr(ab, ev->peer_macaddr.addr);
++	for (i = 0; i < ab->num_radios; i++) {
++		spin_lock_bh(&ab->base_lock);
++		pdev = &ab->pdevs[i];
++		ar = pdev->ar;
++		peer = ath11k_peer_find_by_addr(ar, ev->peer_macaddr.addr);
++		if (!peer) {
++			spin_unlock_bh(&ab->base_lock);
++			continue;
++		}
+ 
+-	if (!peer) {
+-		spin_unlock_bh(&ab->base_lock);
+-		ath11k_warn(ab, "peer not found %pM\n", ev->peer_macaddr.addr);
+-		goto exit;
+-	}
++		ar = ath11k_mac_get_ar_by_vdev_id(ab, peer->vdev_id);
+ 
+-	ar = ath11k_mac_get_ar_by_vdev_id(ab, peer->vdev_id);
++		if (!ar) {
++			spin_unlock_bh(&ab->base_lock);
++			ath11k_warn(ab, "invalid vdev id in peer sta ps state change ev %d", peer->vdev_id);
+ 
+-	if (!ar) {
+-		spin_unlock_bh(&ab->base_lock);
+-		ath11k_warn(ab, "invalid vdev id in peer sta ps state change ev %d",
+-			    peer->vdev_id);
++			goto exit;
++		}
+ 
+-		goto exit;
+-	}
++		sta = peer->sta;
+ 
+-	sta = peer->sta;
++		spin_unlock_bh(&ab->base_lock);
+ 
+-	spin_unlock_bh(&ab->base_lock);
++		if (!sta) {
++			ath11k_warn(ab, "failed to find station entry %pM\n", ev->peer_macaddr.addr);
++			goto exit;
++		}
+ 
+-	if (!sta) {
+-		ath11k_warn(ab, "failed to find station entry %pM\n",
+-			    ev->peer_macaddr.addr);
+-		goto exit;
+-	}
++		arsta = ath11k_sta_to_arsta(sta);
+ 
+-	arsta = ath11k_sta_to_arsta(sta);
++		spin_lock_bh(&ar->data_lock);
+ 
+-	spin_lock_bh(&ar->data_lock);
++		peer_previous_ps_state = arsta->peer_ps_state;
++		arsta->peer_ps_state = ev->peer_ps_state;
++		arsta->peer_current_ps_valid = !!ev->peer_ps_valid;
++
++		if (test_bit(WMI_TLV_SERVICE_PEER_POWER_SAVE_DURATION_SUPPORT, ar->ab->wmi_ab.svc_map)) {
++			if (!(ev->ps_supported_bitmap & WMI_PEER_PS_VALID) ||
++			    !(ev->ps_supported_bitmap & WMI_PEER_PS_STATE_TIMESTAMP) || !ev->peer_ps_valid)
++				goto out;
++
++			if (arsta->peer_ps_state == WMI_PEER_PS_STATE_ON) {
++				arsta->ps_start_time = ev->peer_ps_timestamp;
++				arsta->ps_start_jiffies = jiffies;
++			} else if (arsta->peer_ps_state == WMI_PEER_PS_STATE_OFF &&
++				   peer_previous_ps_state == WMI_PEER_PS_STATE_ON) {
++				arsta->ps_total_duration =
++					arsta->ps_total_duration + (ev->peer_ps_timestamp - arsta->ps_start_time);
++			}
+ 
+-	peer_previous_ps_state = arsta->peer_ps_state;
+-	arsta->peer_ps_state = ev->peer_ps_state;
+-	arsta->peer_current_ps_valid = !!ev->peer_ps_valid;
+-
+-	if (test_bit(WMI_TLV_SERVICE_PEER_POWER_SAVE_DURATION_SUPPORT,
+-		     ar->ab->wmi_ab.svc_map)) {
+-		if (!(ev->ps_supported_bitmap & WMI_PEER_PS_VALID) ||
+-		    !(ev->ps_supported_bitmap & WMI_PEER_PS_STATE_TIMESTAMP) ||
+-		    !ev->peer_ps_valid)
+-			goto out;
+-
+-		if (arsta->peer_ps_state == WMI_PEER_PS_STATE_ON) {
+-			arsta->ps_start_time = ev->peer_ps_timestamp;
+-			arsta->ps_start_jiffies = jiffies;
+-		} else if (arsta->peer_ps_state == WMI_PEER_PS_STATE_OFF &&
+-			   peer_previous_ps_state == WMI_PEER_PS_STATE_ON) {
+-			arsta->ps_total_duration = arsta->ps_total_duration +
+-					(ev->peer_ps_timestamp - arsta->ps_start_time);
++			if (ar->ps_timekeeper_enable)
++				trace_ath11k_ps_timekeeper(ar, ev->peer_macaddr.addr, ev->peer_ps_timestamp, arsta->peer_ps_state);
+ 		}
+-
+-		if (ar->ps_timekeeper_enable)
+-			trace_ath11k_ps_timekeeper(ar, ev->peer_macaddr.addr,
+-						   ev->peer_ps_timestamp,
+-						   arsta->peer_ps_state);
+ 	}
+ 
+ out:
+@@ -7783,9 +7781,9 @@ static void ath11k_mgmt_rx_event(struct
+ 
+ 	spin_lock_bh(&ab->base_lock);
+ 
+-	peer = ath11k_peer_find_by_addr(ab, hdr->addr1);
++	peer = ath11k_peer_find_by_addr(ar, hdr->addr1);
+ 	if(!peer)
+-		peer = ath11k_peer_find_by_addr(ab, hdr->addr3);
++		peer = ath11k_peer_find_by_addr(ar, hdr->addr3);
+ 	if (!peer) {
+ 		spin_unlock_bh(&ab->base_lock);
+ 		goto skip_mgmt_stats;
+@@ -8013,9 +8011,8 @@ static void ath11k_peer_sta_kickout_even
+ {
+ 	struct wmi_peer_sta_kickout_arg arg = {};
+ 	struct ieee80211_sta *sta;
+-	struct ath11k_peer *peer;
+ 	struct ath11k *ar;
+-	u32 vdev_id;
++	int i;
+ 
+ 	if (ath11k_pull_peer_sta_kickout_ev(ab, skb, &arg) != 0) {
+ 		ath11k_warn(ab, "failed to extract peer sta kickout event");
+@@ -8024,42 +8021,22 @@ static void ath11k_peer_sta_kickout_even
+ 
+ 	rcu_read_lock();
+ 
+-	spin_lock_bh(&ab->base_lock);
+-
+-	peer = ath11k_peer_find_by_addr(ab, arg.mac_addr);
+ 
+-	if (!peer) {
+-		ath11k_warn(ab, "peer not found %pM\n",
+-			    arg.mac_addr);
+-		spin_unlock_bh(&ab->base_lock);
+-		goto exit;
+-	}
+-
+-	vdev_id = peer->vdev_id;
+-
+-	spin_unlock_bh(&ab->base_lock);
++	for (i = 0; i < ab->num_radios; i++) {
++		struct ath11k_pdev *pdev = &ab->pdevs[i];
++		ar = pdev->ar;
++		sta = ieee80211_find_sta_by_ifaddr(ar->hw, arg.mac_addr, NULL);
++		if (!sta) {
++			    continue;
++		}
+ 
+-	ar = ath11k_mac_get_ar_by_vdev_id(ab, vdev_id);
+-	if (!ar) {
+-		ath11k_warn(ab, "invalid vdev id in peer sta kickout ev %d",
+-			    peer->vdev_id);
+-		goto exit;
+-	}
++		ath11k_dbg(ab, ATH11K_DBG_WMI, "event peer sta kickout %pM", arg.mac_addr);
+ 
+-	sta = ieee80211_find_sta_by_ifaddr(ar->hw,
+-					   arg.mac_addr, NULL);
+-	if (!sta) {
+-		ath11k_warn(ab, "Spurious quick kickout for STA %pM\n",
+-			    arg.mac_addr);
+-		goto exit;
++		ieee80211_report_low_ack(sta, 10);
+ 	}
++	if (!sta)
++		ath11k_dbg(ab, ATH11K_DBG_WMI, "Spurious quick kickout for STA %pM\n", arg.mac_addr);
+ 
+-	ath11k_dbg(ab, ATH11K_DBG_WMI, "event peer sta kickout %pM",
+-		   arg.mac_addr);
+-
+-	ieee80211_report_low_ack(sta, 10);
+-
+-exit:
+ 	rcu_read_unlock();
+ }

From 2b5a4e881608cab7b6fb168d85bdc199f7d2cf7a Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Fri, 9 Aug 2024 01:26:00 -0400
Subject: [PATCH 162/225] ath11k_nss: utilize existing function to get arvif
 from dev

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...SS-use-ath11k_nss_get_arvif_from_dev.patch | 51 +++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/999-901-ath11k-NSS-use-ath11k_nss_get_arvif_from_dev.patch

diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-901-ath11k-NSS-use-ath11k_nss_get_arvif_from_dev.patch b/package/kernel/mac80211/patches/nss/ath11k/999-901-ath11k-NSS-use-ath11k_nss_get_arvif_from_dev.patch
new file mode 100644
index 00000000000000..b50dcdd0d88508
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-901-ath11k-NSS-use-ath11k_nss_get_arvif_from_dev.patch
@@ -0,0 +1,51 @@
+--- a/drivers/net/wireless/ath/ath11k/nss.c
++++ b/drivers/net/wireless/ath/ath11k/nss.c
+@@ -978,36 +978,20 @@ ath11k_nss_vdev_data_receive(struct net_
+ 			     __attribute__((unused)) struct napi_struct *napi)
+ {
+ 	struct wireless_dev *wdev = NULL;
+-	struct ieee80211_vif *vif = NULL;
+ 	struct ath11k_vif *arvif;
+ 	struct ath11k_base *ab;
+ 	bool eth_decap = false;
+ 	int data_offs = 0;
+ 	int ret;
+ 
+-	if (!dev) {
+-		dev_kfree_skb_any(skb);
+-		return;
+-	}
+-
+-	wdev = dev->ieee80211_ptr;
+-	if (!wdev) {
+-		dev_kfree_skb_any(skb);
+-		return;
+-	}
+-
+-	vif = wdev_to_ieee80211_vif(wdev);
+-	if (!vif) {
+-		dev_kfree_skb_any(skb);
+-		return;
+-	}
+-
+-	arvif = (struct ath11k_vif *)vif->drv_priv;
++	arvif = ath11k_nss_get_arvif_from_dev(dev);
+ 	if (!arvif) {
+ 		dev_kfree_skb_any(skb);
+ 		return;
+ 	}
+ 
++	wdev = ieee80211_vif_to_wdev_relaxed(arvif->vif);
++
+ 	ab = arvif->ar->ab;
+ 
+ 	skb->dev = dev;
+@@ -1016,7 +1000,7 @@ ath11k_nss_vdev_data_receive(struct net_
+ 	ath11k_dbg_dump(ab, ATH11K_DBG_DP_RX, "", "dp rx msdu from nss: ",
+ 			skb->data, skb->len);
+ 
+-	if ((vif->type == NL80211_IFTYPE_STATION && wdev->use_4addr) &&
++	if ((arvif->vif->type == NL80211_IFTYPE_STATION && wdev->use_4addr) &&
+ 	     ath11k_nss_vdev_data_receive_mec_check(arvif->ar, skb)) {
+ 		dev_kfree_skb_any(skb);
+ 		return;

From bc14b302f5846c3f16fc96c5c354b331f91c4067 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Fri, 9 Aug 2024 01:55:17 -0400
Subject: [PATCH 163/225] qualcommax: NSS: refresh patches for 6.6.51

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../0600-1-qca-nss-ecm-support-CORE.patch     |  8 +++----
 ...00-3-qca-nss-ecm-support-net-bonding.patch |  6 ++---
 ...pport-net-bonding-over-LAG-interface.patch | 24 +++++++++----------
 ...-1-qca-nss-clients-add-qdisc-support.patch |  2 +-
 ...3-2-qca-nss-clients-add-l2tp-support.patch |  2 +-
 ...qca-nss-clients-add-iptunnel-support.patch |  2 +-
 ...a-nss-clients-iptunnel-lock-this-cpu.patch |  2 +-
 .../0605-1-qca-nss-cfi-support.patch          | 16 ++++++-------
 .../0981-1-qca-skb_recycler-support.patch     |  8 +++----
 9 files changed, 35 insertions(+), 35 deletions(-)

diff --git a/target/linux/qualcommax/patches-6.6/0600-1-qca-nss-ecm-support-CORE.patch b/target/linux/qualcommax/patches-6.6/0600-1-qca-nss-ecm-support-CORE.patch
index de641dad8988ec..72acefc8441e43 100644
--- a/target/linux/qualcommax/patches-6.6/0600-1-qca-nss-ecm-support-CORE.patch
+++ b/target/linux/qualcommax/patches-6.6/0600-1-qca-nss-ecm-support-CORE.patch
@@ -94,7 +94,7 @@
  
 --- a/include/net/ip6_route.h
 +++ b/include/net/ip6_route.h
-@@ -207,6 +207,11 @@ void rt6_multipath_rebalance(struct fib6
+@@ -215,6 +215,11 @@ void rt6_multipath_rebalance(struct fib6
  void rt6_uncached_list_add(struct rt6_info *rt);
  void rt6_uncached_list_del(struct rt6_info *rt);
  
@@ -610,7 +610,7 @@
  	return 0;
  
  out_remove_new_fa:
-@@ -1775,6 +1781,9 @@ int fib_table_delete(struct net *net, st
+@@ -1776,6 +1782,9 @@ int fib_table_delete(struct net *net, st
  	if (fa_to_delete->fa_state & FA_S_ACCESSED)
  		rt_cache_flush(cfg->fc_nlinfo.nl_net);
  
@@ -620,7 +620,7 @@
  	fib_release_info(fa_to_delete->fa_info);
  	alias_free_mem_rcu(fa_to_delete);
  	return 0;
-@@ -2407,6 +2416,20 @@ void __init fib_trie_init(void)
+@@ -2408,6 +2417,20 @@ void __init fib_trie_init(void)
  					   0, SLAB_PANIC | SLAB_ACCOUNT, NULL);
  }
  
@@ -643,7 +643,7 @@
  	struct fib_table *tb;
 --- a/net/ipv6/ndisc.c
 +++ b/net/ipv6/ndisc.c
-@@ -666,6 +666,7 @@ void ndisc_send_ns(struct net_device *de
+@@ -668,6 +668,7 @@ void ndisc_send_ns(struct net_device *de
  	if (skb)
  		ndisc_send_skb(skb, daddr, saddr);
  }
diff --git a/target/linux/qualcommax/patches-6.6/0600-3-qca-nss-ecm-support-net-bonding.patch b/target/linux/qualcommax/patches-6.6/0600-3-qca-nss-ecm-support-net-bonding.patch
index 4e683e3a3e7e8e..e615943782f60b 100644
--- a/target/linux/qualcommax/patches-6.6/0600-3-qca-nss-ecm-support-net-bonding.patch
+++ b/target/linux/qualcommax/patches-6.6/0600-3-qca-nss-ecm-support-net-bonding.patch
@@ -8,7 +8,7 @@
  
  static const struct flow_dissector_key flow_keys_bonding_keys[] = {
  	{
-@@ -5872,6 +5873,11 @@ static void bond_destructor(struct net_d
+@@ -5911,6 +5912,11 @@ static void bond_destructor(struct net_d
  	if (bond->wq)
  		destroy_workqueue(bond->wq);
  
@@ -20,7 +20,7 @@
  	free_percpu(bond->rr_tx_counter);
  }
  
-@@ -6421,6 +6427,13 @@ int bond_create(struct net *net, const c
+@@ -6464,6 +6470,13 @@ int bond_create(struct net *net, const c
  
  	bond_work_init_all(bond);
  
@@ -37,7 +37,7 @@
 --- a/include/net/bonding.h
 +++ b/include/net/bonding.h
 @@ -261,6 +261,7 @@ struct bonding {
- 	spinlock_t ipsec_lock;
+ 	struct mutex ipsec_lock;
  #endif /* CONFIG_XFRM_OFFLOAD */
  	struct bpf_prog *xdp_prog;
 +	u32 id;/* QCA NSS ECM bonding support */
diff --git a/target/linux/qualcommax/patches-6.6/0600-4-qca-nss-ecm-support-net-bonding-over-LAG-interface.patch b/target/linux/qualcommax/patches-6.6/0600-4-qca-nss-ecm-support-net-bonding-over-LAG-interface.patch
index e02e9090db8c4e..0f0bf62fb819cb 100644
--- a/target/linux/qualcommax/patches-6.6/0600-4-qca-nss-ecm-support-net-bonding-over-LAG-interface.patch
+++ b/target/linux/qualcommax/patches-6.6/0600-4-qca-nss-ecm-support-net-bonding-over-LAG-interface.patch
@@ -227,7 +227,7 @@
  /**
   * bond_dev_queue_xmit - Prepare skb for xmit.
   *
-@@ -1189,6 +1204,23 @@ void bond_change_active_slave(struct bon
+@@ -1228,6 +1243,23 @@ void bond_change_active_slave(struct bon
  			if (BOND_MODE(bond) == BOND_MODE_8023AD)
  				bond_3ad_handle_link_change(new_active, BOND_LINK_UP);
  
@@ -251,7 +251,7 @@
  			if (bond_is_lb(bond))
  				bond_alb_handle_link_change(bond, new_active, BOND_LINK_UP);
  		} else {
-@@ -1833,6 +1865,7 @@ int bond_enslave(struct net_device *bond
+@@ -1872,6 +1904,7 @@ int bond_enslave(struct net_device *bond
  	const struct net_device_ops *slave_ops = slave_dev->netdev_ops;
  	struct slave *new_slave = NULL, *prev_slave;
  	struct sockaddr_storage ss;
@@ -259,7 +259,7 @@
  	int link_reporting;
  	int res = 0, i;
  
-@@ -2278,6 +2311,15 @@ int bond_enslave(struct net_device *bond
+@@ -2317,6 +2350,15 @@ int bond_enslave(struct net_device *bond
  		   bond_is_active_slave(new_slave) ? "an active" : "a backup",
  		   new_slave->link != BOND_LINK_DOWN ? "an up" : "a down");
  
@@ -275,7 +275,7 @@
  	/* enslave is successful */
  	bond_queue_slave_event(new_slave);
  	return 0;
-@@ -2343,6 +2385,15 @@ err_undo_flags:
+@@ -2382,6 +2424,15 @@ err_undo_flags:
  		}
  	}
  
@@ -291,7 +291,7 @@
  	return res;
  }
  
-@@ -2364,6 +2415,7 @@ static int __bond_release_one(struct net
+@@ -2403,6 +2454,7 @@ static int __bond_release_one(struct net
  	struct bonding *bond = netdev_priv(bond_dev);
  	struct slave *slave, *oldcurrent;
  	struct sockaddr_storage ss;
@@ -299,7 +299,7 @@
  	int old_flags = bond_dev->flags;
  	netdev_features_t old_features = bond_dev->features;
  
-@@ -2386,6 +2438,15 @@ static int __bond_release_one(struct net
+@@ -2425,6 +2477,15 @@ static int __bond_release_one(struct net
  
  	bond_set_slave_inactive_flags(slave, BOND_SLAVE_NOTIFY_NOW);
  
@@ -315,7 +315,7 @@
  	bond_sysfs_slave_del(slave);
  
  	/* recompute stats just before removing the slave */
-@@ -2708,6 +2769,8 @@ static void bond_miimon_commit(struct bo
+@@ -2747,6 +2808,8 @@ static void bond_miimon_commit(struct bo
  	struct slave *slave, *primary, *active;
  	bool do_failover = false;
  	struct list_head *iter;
@@ -324,7 +324,7 @@
  
  	ASSERT_RTNL();
  
-@@ -2747,6 +2810,12 @@ static void bond_miimon_commit(struct bo
+@@ -2786,6 +2849,12 @@ static void bond_miimon_commit(struct bo
  				bond_set_active_slave(slave);
  			}
  
@@ -337,7 +337,7 @@
  			slave_info(bond->dev, slave->dev, "link status definitely up, %u Mbps %s duplex\n",
  				   slave->speed == SPEED_UNKNOWN ? 0 : slave->speed,
  				   slave->duplex ? "full" : "half");
-@@ -2795,6 +2864,16 @@ static void bond_miimon_commit(struct bo
+@@ -2834,6 +2903,16 @@ static void bond_miimon_commit(struct bo
  		unblock_netpoll_tx();
  	}
  
@@ -354,7 +354,7 @@
  	bond_set_carrier(bond);
  }
  
-@@ -4047,8 +4126,219 @@ static inline u32 bond_eth_hash(struct s
+@@ -4086,8 +4165,219 @@ static inline u32 bond_eth_hash(struct s
  		return 0;
  
  	ep = (struct ethhdr *)(data + mhoff);
@@ -575,7 +575,7 @@
  
  static bool bond_flow_ip(struct sk_buff *skb, struct flow_keys *fk, const void *data,
  			 int hlen, __be16 l2_proto, int *nhoff, int *ip_proto, bool l34)
-@@ -5177,15 +5467,18 @@ static netdev_tx_t bond_3ad_xor_xmit(str
+@@ -5216,15 +5506,18 @@ static netdev_tx_t bond_3ad_xor_xmit(str
  				     struct net_device *dev)
  {
  	struct bonding *bond = netdev_priv(dev);
@@ -601,7 +601,7 @@
  }
  
  /* in broadcast mode, we send everything to all usable interfaces. */
-@@ -5435,8 +5728,9 @@ static netdev_tx_t __bond_start_xmit(str
+@@ -5474,8 +5767,9 @@ static netdev_tx_t __bond_start_xmit(str
  		return bond_xmit_roundrobin(skb, dev);
  	case BOND_MODE_ACTIVEBACKUP:
  		return bond_xmit_activebackup(skb, dev);
diff --git a/target/linux/qualcommax/patches-6.6/0603-1-qca-nss-clients-add-qdisc-support.patch b/target/linux/qualcommax/patches-6.6/0603-1-qca-nss-clients-add-qdisc-support.patch
index 156eaf4b240fc7..82d9af7952aa3b 100644
--- a/target/linux/qualcommax/patches-6.6/0603-1-qca-nss-clients-add-qdisc-support.patch
+++ b/target/linux/qualcommax/patches-6.6/0603-1-qca-nss-clients-add-qdisc-support.patch
@@ -370,7 +370,7 @@
  subsys_initcall(pktsched_init);
 --- a/net/sched/sch_generic.c
 +++ b/net/sched/sch_generic.c
-@@ -1073,6 +1073,7 @@ static void __qdisc_destroy(struct Qdisc
+@@ -1074,6 +1074,7 @@ static void __qdisc_destroy(struct Qdisc
  
  	call_rcu(&qdisc->rcu, qdisc_free_cb);
  }
diff --git a/target/linux/qualcommax/patches-6.6/0603-2-qca-nss-clients-add-l2tp-support.patch b/target/linux/qualcommax/patches-6.6/0603-2-qca-nss-clients-add-l2tp-support.patch
index 7fa9184df25155..95ae02b7ee58b2 100644
--- a/target/linux/qualcommax/patches-6.6/0603-2-qca-nss-clients-add-l2tp-support.patch
+++ b/target/linux/qualcommax/patches-6.6/0603-2-qca-nss-clients-add-l2tp-support.patch
@@ -1,6 +1,6 @@
 --- a/net/l2tp/l2tp_core.c
 +++ b/net/l2tp/l2tp_core.c
-@@ -398,6 +398,31 @@ err_tlock:
+@@ -403,6 +403,31 @@ err_tlock:
  }
  EXPORT_SYMBOL_GPL(l2tp_session_register);
  
diff --git a/target/linux/qualcommax/patches-6.6/0603-4-qca-nss-clients-add-iptunnel-support.patch b/target/linux/qualcommax/patches-6.6/0603-4-qca-nss-clients-add-iptunnel-support.patch
index fb51c88e18d651..86c9688adeaf7c 100644
--- a/target/linux/qualcommax/patches-6.6/0603-4-qca-nss-clients-add-iptunnel-support.patch
+++ b/target/linux/qualcommax/patches-6.6/0603-4-qca-nss-clients-add-iptunnel-support.patch
@@ -22,7 +22,7 @@
  #endif /* __NET_IP_TUNNELS_H */
 --- a/net/ipv6/ip6_tunnel.c
 +++ b/net/ipv6/ip6_tunnel.c
-@@ -2412,6 +2412,26 @@ nla_put_failure:
+@@ -2414,6 +2414,26 @@ nla_put_failure:
  	return -EMSGSIZE;
  }
  
diff --git a/target/linux/qualcommax/patches-6.6/0603-7-qca-nss-clients-iptunnel-lock-this-cpu.patch b/target/linux/qualcommax/patches-6.6/0603-7-qca-nss-clients-iptunnel-lock-this-cpu.patch
index 671d8d1e37bc80..9c80e643474a65 100644
--- a/target/linux/qualcommax/patches-6.6/0603-7-qca-nss-clients-iptunnel-lock-this-cpu.patch
+++ b/target/linux/qualcommax/patches-6.6/0603-7-qca-nss-clients-iptunnel-lock-this-cpu.patch
@@ -1,6 +1,6 @@
 --- a/net/ipv6/ip6_tunnel.c
 +++ b/net/ipv6/ip6_tunnel.c
-@@ -2418,7 +2418,7 @@ nla_put_failure:
+@@ -2420,7 +2420,7 @@ nla_put_failure:
   */
  void ip6_update_offload_stats(struct net_device *dev, void *ptr)
  {
diff --git a/target/linux/qualcommax/patches-6.6/0605-1-qca-nss-cfi-support.patch b/target/linux/qualcommax/patches-6.6/0605-1-qca-nss-cfi-support.patch
index 329dee7db654d4..23d5089631e91f 100644
--- a/target/linux/qualcommax/patches-6.6/0605-1-qca-nss-cfi-support.patch
+++ b/target/linux/qualcommax/patches-6.6/0605-1-qca-nss-cfi-support.patch
@@ -33,7 +33,7 @@
  #include <linux/err.h>
  #include <linux/module.h>
  #include <net/ip.h>
-@@ -658,6 +659,7 @@ static int esp_output(struct xfrm_state
+@@ -657,6 +658,7 @@ static int esp_output(struct xfrm_state
  	struct ip_esp_hdr *esph;
  	struct crypto_aead *aead;
  	struct esp_info esp;
@@ -41,7 +41,7 @@
  
  	esp.inplace = true;
  
-@@ -669,6 +671,11 @@ static int esp_output(struct xfrm_state
+@@ -668,6 +670,11 @@ static int esp_output(struct xfrm_state
  	aead = x->data;
  	alen = crypto_aead_authsize(aead);
  
@@ -53,7 +53,7 @@
  	esp.tfclen = 0;
  	if (x->tfcpad) {
  		struct xfrm_dst *dst = (struct xfrm_dst *)skb_dst(skb);
-@@ -890,6 +897,7 @@ static int esp_input(struct xfrm_state *
+@@ -889,6 +896,7 @@ static int esp_input(struct xfrm_state *
  	u8 *iv;
  	struct scatterlist *sg;
  	int err = -EINVAL;
@@ -61,7 +61,7 @@
  
  	if (!pskb_may_pull(skb, sizeof(struct ip_esp_hdr) + ivlen))
  		goto out;
-@@ -897,6 +905,12 @@ static int esp_input(struct xfrm_state *
+@@ -896,6 +904,12 @@ static int esp_input(struct xfrm_state *
  	if (elen <= 0)
  		goto out;
  
@@ -84,7 +84,7 @@
  #include <linux/err.h>
  #include <linux/module.h>
  #include <net/ip.h>
-@@ -696,6 +697,7 @@ static int esp6_output(struct xfrm_state
+@@ -695,6 +696,7 @@ static int esp6_output(struct xfrm_state
  	struct ip_esp_hdr *esph;
  	struct crypto_aead *aead;
  	struct esp_info esp;
@@ -92,7 +92,7 @@
  
  	esp.inplace = true;
  
-@@ -707,6 +709,11 @@ static int esp6_output(struct xfrm_state
+@@ -706,6 +708,11 @@ static int esp6_output(struct xfrm_state
  	aead = x->data;
  	alen = crypto_aead_authsize(aead);
  
@@ -104,7 +104,7 @@
  	esp.tfclen = 0;
  	if (x->tfcpad) {
  		struct xfrm_dst *dst = (struct xfrm_dst *)skb_dst(skb);
-@@ -934,6 +941,7 @@ static int esp6_input(struct xfrm_state
+@@ -933,6 +940,7 @@ static int esp6_input(struct xfrm_state
  	__be32 *seqhi;
  	u8 *iv;
  	struct scatterlist *sg;
@@ -112,7 +112,7 @@
  
  	if (!pskb_may_pull(skb, sizeof(struct ip_esp_hdr) + ivlen)) {
  		ret = -EINVAL;
-@@ -945,6 +953,12 @@ static int esp6_input(struct xfrm_state
+@@ -944,6 +952,12 @@ static int esp6_input(struct xfrm_state
  		goto out;
  	}
  
diff --git a/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch b/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch
index d10a0e69f0e541..3e15ddf49dfe43 100644
--- a/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch
+++ b/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch
@@ -388,7 +388,7 @@
  
  	data = kmalloc_reserve(&size, gfp_mask, NUMA_NO_NODE, NULL);
  	if (!data)
-@@ -4865,6 +4971,14 @@ static void skb_extensions_init(void) {}
+@@ -4869,6 +4975,14 @@ static void skb_extensions_init(void) {}
  
  void __init skb_init(void)
  {
@@ -403,7 +403,7 @@
  	skbuff_cache = kmem_cache_create_usercopy("skbuff_head_cache",
  					      sizeof(struct sk_buff),
  					      0,
-@@ -4890,6 +5004,7 @@ void __init skb_init(void)
+@@ -4894,6 +5008,7 @@ void __init skb_init(void)
  						SKB_SMALL_HEAD_HEADROOM,
  						NULL);
  	skb_extensions_init();
@@ -411,7 +411,7 @@
  }
  
  static int
-@@ -6393,6 +6508,8 @@ static int pskb_carve_inside_header(stru
+@@ -6397,6 +6512,8 @@ static int pskb_carve_inside_header(stru
  	if (skb_pfmemalloc(skb))
  		gfp_mask |= __GFP_MEMALLOC;
  
@@ -420,7 +420,7 @@
  	data = kmalloc_reserve(&size, gfp_mask, NUMA_NO_NODE, NULL);
  	if (!data)
  		return -ENOMEM;
-@@ -6509,6 +6626,8 @@ static int pskb_carve_inside_nonlinear(s
+@@ -6513,6 +6630,8 @@ static int pskb_carve_inside_nonlinear(s
  	if (skb_pfmemalloc(skb))
  		gfp_mask |= __GFP_MEMALLOC;
  

From 69aa14c99b4efeefdcc4e3ae337fc23a8a4934cd Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Thu, 19 Sep 2024 03:11:53 -0400
Subject: [PATCH 164/225] hostapd: fix MUEDCA patch for hostapd 2024-09-15

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...=> 900-hostapd-update-muedca-params.patch} | 56 +++++++++----------
 1 file changed, 28 insertions(+), 28 deletions(-)
 rename package/network/services/hostapd/patches/{780-hostapd-update-muedca-params.patch => 900-hostapd-update-muedca-params.patch} (87%)

diff --git a/package/network/services/hostapd/patches/780-hostapd-update-muedca-params.patch b/package/network/services/hostapd/patches/900-hostapd-update-muedca-params.patch
similarity index 87%
rename from package/network/services/hostapd/patches/780-hostapd-update-muedca-params.patch
rename to package/network/services/hostapd/patches/900-hostapd-update-muedca-params.patch
index fabae7dba881e5..684122d5be11b0 100644
--- a/package/network/services/hostapd/patches/780-hostapd-update-muedca-params.patch
+++ b/package/network/services/hostapd/patches/900-hostapd-update-muedca-params.patch
@@ -14,15 +14,15 @@
  					   "Failed to update beacons with WMM parameters");
 --- a/src/ap/drv_callbacks.c
 +++ b/src/ap/drv_callbacks.c
-@@ -20,6 +20,7 @@
- #include "common/hw_features_common.h"
+@@ -21,6 +21,7 @@
+ #include "common/nan_de.h"
  #include "crypto/random.h"
  #include "p2p/p2p.h"
 +#include "wpa_debug.h"
  #include "wps/wps.h"
  #include "fst/fst.h"
  #include "wnm_ap.h"
-@@ -2267,6 +2268,47 @@ static void hostapd_event_wds_sta_interf
+@@ -2316,6 +2317,47 @@ static void hostapd_event_wds_sta_interf
  		ifname, MAC2STR(addr));
  }
  
@@ -70,19 +70,19 @@
  
  #ifdef CONFIG_OWE
  static int hostapd_notif_update_dh_ie(struct hostapd_data *hapd,
-@@ -2677,6 +2719,9 @@ void hostapd_wpa_event(void *ctx, enum w
- 		hostapd_cleanup_cca_params(hapd);
+@@ -2874,6 +2916,9 @@ void hostapd_wpa_event(void *ctx, enum w
+ 			   hapd->conf->iface);
+ 		hostapd_event_color_change(hapd, true);
  		break;
- #endif /* CONFIG_IEEE80211AX */
 +	case EVENT_UPDATE_MUEDCA_PARAMS:
 +		 hostapd_event_update_muedca_params(hapd, &data->update_muedca);
 +		 break;
- 	default:
- 		wpa_printf(MSG_DEBUG, "Unknown event %d", event);
- 		break;
+ #endif /* CONFIG_IEEE80211AX */
+ #ifdef CONFIG_IEEE80211BE
+ 	case EVENT_MLD_INTERFACE_FREED:
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -4100,6 +4100,10 @@ static int hostapd_fill_csa_settings(str
+@@ -4511,6 +4511,10 @@ static int hostapd_fill_csa_settings(str
  	hapd->cs_count = settings->cs_count;
  	hapd->cs_block_tx = settings->block_tx;
  
@@ -157,7 +157,7 @@
  			  size_t len);
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -5786,6 +5786,16 @@ enum wpa_event_type {
+@@ -5980,6 +5980,16 @@ enum wpa_event_type {
  	EVENT_LINK_CH_SWITCH_STARTED,
  
  	/**
@@ -174,7 +174,7 @@
  	 * EVENT_TID_LINK_MAP - MLD event to set TID-to-link mapping
  	 *
  	 * This event is used by the driver to indicate the received TID-to-link
-@@ -6752,6 +6762,16 @@ union wpa_event_data {
+@@ -6963,6 +6973,16 @@ union wpa_event_data {
  	struct pasn_auth pasn_auth;
  
  	/**
@@ -200,7 +200,7 @@
 +	E2S(UPDATE_MUEDCA_PARAMS);
  	E2S(TID_LINK_MAP);
  	E2S(LINK_RECONFIG);
- 	}
+ 	E2S(MLD_INTERFACE_FREED);
 --- a/src/drivers/driver_nl80211_event.c
 +++ b/src/drivers/driver_nl80211_event.c
 @@ -184,6 +184,7 @@ static const char * nl80211_command_to_s
@@ -210,9 +210,9 @@
 +	C2S(NL80211_CMD_UPDATE_HE_MUEDCA_PARAMS)
  	C2S(NL80211_CMD_SET_HW_TIMESTAMP)
  	C2S(NL80211_CMD_LINKS_REMOVED)
- 	C2S(__NL80211_CMD_AFTER_LAST)
-@@ -3644,6 +3645,35 @@ static void nl80211_sta_opmode_change_ev
- 	wpa_supplicant_event(drv->ctx, EVENT_STATION_OPMODE_CHANGED, &ed);
+ 	C2S(NL80211_CMD_SET_TID_TO_LINK_MAPPING)
+@@ -3650,6 +3651,35 @@ static void nl80211_port_authorized(stru
+ 	wpa_supplicant_event(drv->ctx, EVENT_PORT_AUTHORIZED, &event);
  }
  
 +static void nl80211_update_muedca_params_event(struct wpa_driver_nl80211_data *drv,
@@ -245,9 +245,9 @@
 +	wpa_supplicant_event(drv->ctx, EVENT_UPDATE_MUEDCA_PARAMS, &ed);
 +}
  
- static void nl80211_control_port_frame(struct wpa_driver_nl80211_data *drv,
- 				       struct nlattr **tb)
-@@ -4090,6 +4120,9 @@ static void do_process_drv_event(struct
+ static void nl80211_sta_opmode_change_event(struct wpa_driver_nl80211_data *drv,
+ 					    struct nlattr **tb)
+@@ -4177,6 +4207,9 @@ static void do_process_drv_event(struct
  	case NL80211_CMD_LINKS_REMOVED:
  		wpa_supplicant_event(drv->ctx, EVENT_LINK_RECONFIG, NULL);
  		break;
@@ -259,9 +259,9 @@
  			"(cmd=%d)", cmd);
 --- a/src/drivers/nl80211_copy.h
 +++ b/src/drivers/nl80211_copy.h
-@@ -1323,6 +1323,11 @@
-  *	Multi-Link reconfiguration. %NL80211_ATTR_MLO_LINKS is used to provide
-  *	information about the removed STA MLD setup links.
+@@ -1329,6 +1329,11 @@
+  *      %NL80211_ATTR_MLO_TTLM_ULINK attributes are used to specify the
+  *      TID to Link mapping for downlink/uplink traffic.
   *
 + * @NL80211_CMD_UPDATE_HE_MUEDCA_PARAMS: Updated MU-EDCA parameters from driver.
 + *	This event is used to update MU-EDCA parameters in Beacon frame, which
@@ -271,15 +271,15 @@
   * @NL80211_CMD_MAX: highest used command number
   * @__NL80211_CMD_AFTER_LAST: internal use
   */
-@@ -1578,6 +1583,7 @@ enum nl80211_commands {
+@@ -1586,6 +1591,7 @@ enum nl80211_commands {
  
- 	NL80211_CMD_LINKS_REMOVED,
+ 	NL80211_CMD_SET_TID_TO_LINK_MAPPING,
  
 +	NL80211_CMD_UPDATE_HE_MUEDCA_PARAMS,
  	/* add new commands above here */
  
  	/* used to define NL80211_CMD_MAX below */
-@@ -2799,6 +2805,9 @@ enum nl80211_commands {
+@@ -2816,6 +2822,9 @@ enum nl80211_commands {
   *	the incoming frame RX timestamp.
   * @NL80211_ATTR_TD_BITMAP: Transition Disable bitmap, for subsequent
   *	(re)associations.
@@ -289,9 +289,9 @@
   *
   * @NL80211_ATTR_PUNCT_BITMAP: (u32) Preamble puncturing bitmap, lowest
   *	bit corresponds to the lowest 20 MHz channel. Each bit set to 1
-@@ -3364,6 +3373,7 @@ enum nl80211_attrs {
- 
- 	NL80211_ATTR_MLO_LINK_DISABLED,
+@@ -3416,6 +3425,7 @@ enum nl80211_attrs {
+ 	NL80211_ATTR_WIPHY_RADIOS,
+ 	NL80211_ATTR_WIPHY_INTERFACE_COMBINATIONS,
  
 +	NL80211_ATTR_HE_MUEDCA_PARAMS,
  	/* add attributes here, update the policy in nl80211.c */

From 98a552ae4c1c04e4d54a43df0eac153108acb741 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Fri, 20 Sep 2024 17:13:24 -0400
Subject: [PATCH 165/225] ath11k_nss: skip status ring entry processing (V5)

Update patch from latest version found on patchwork

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...1k-skip-status-ring-entry-processing.patch | 111 +++++++++++-------
 1 file changed, 70 insertions(+), 41 deletions(-)

diff --git a/package/kernel/mac80211/patches/nss/ath11k/336-ath11k-skip-status-ring-entry-processing.patch b/package/kernel/mac80211/patches/nss/ath11k/336-ath11k-skip-status-ring-entry-processing.patch
index 3fa320ec26c2f9..c912fe604c61cf 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/336-ath11k-skip-status-ring-entry-processing.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/336-ath11k-skip-status-ring-entry-processing.patch
@@ -1,52 +1,77 @@
-From 0e79fe8c6937e080816230892d5382af5a5a86c6 Mon Sep 17 00:00:00 2001
 From: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
-Date: Mon, 29 Nov 2021 11:07:53 +0530
-Subject: [PATCH] ath11k: skip status ring entry processing
+Date: Mon, 29 Apr 2024 13:06:24 +0530
+Subject: [PATCHv5] wifi: ath11k: skip status ring entry processing
 
 If STATUS_BUFFER_DONE is not set for a monitor status ring entry,
 we don't process the status ring until STATUS_BUFFER_DONE set
 for that status ring entry.
 
-During LMAC reset it may happnen that HW will not write
+During LMAC reset it may happen that hardware will not write
 STATUS_BUFFER_DONE tlv in status buffer, in that case we end up
 waiting for STATUS_BUFFER_DONE leading to backpressure on monitor
 status ring.
 
-As per MAC team's suggestion, when HP + 1 entry is peeked and if DMA
+To fix the issue, when HP(Head Pointer) + 1 entry is peeked and if DMA
 is not done and if HP + 2 entry's DMA done is set,
 replenish HP + 1 entry and start processing in next interrupt.
-If HP + 2 entry's DMA done is not set,
-poll onto HP + 1 entry DMA done to be set.
+If HP + 2 entry's DMA done is not set, poll onto HP + 1 entry DMA
+done to be set.
 
-Also, During monitor attach HP points to the end of the ring and TP
-points to the start of the ring. Using ath11k_hal_srng_src_peek()
-may result in processing invali buffer for the very first interrupt.
-Since, HW starts writing buffer from TP.
+Also, during monitor attach HP points to the end of the ring and
+TP(Tail Pointer) points to the start of the ring.
+Using ath11k_hal_srng_src_peek() may result in processing invalid buffer
+for the very first interrupt. Since, HW starts writing buffer from TP.
 
-Hence, replaced ath11k_hal_srng_src_peek() with
-ath11k_hal_srng_src_next_peek().
+To avoid this issue call ath11k_hal_srng_src_next_peek() instead of
+calling ath11k_hal_srng_src_peek().
+
+Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1
 
 Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
+Co-developed-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
+Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
+Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 ---
- drivers/net/wireless/ath/ath11k/dp_rx.c | 92 ++++++++++++++++++++++++++++-----
- drivers/net/wireless/ath/ath11k/hal.c   | 30 +++++++++++
- drivers/net/wireless/ath/ath11k/hal.h   |  4 ++
- 3 files changed, 113 insertions(+), 13 deletions(-)
+v5:
+  * Updated copyright info in dp_rx.c and hal.c
+v4:
+  * Removed kernel reported compilation warning from Signed off place
+v3:
+  * Rebased on top of ToT
+v2:
+  * Fixed compilation warning Reported-by: kernel test robot <lkp@intel.com>
+
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 90 ++++++++++++++++++++++---
+ drivers/net/wireless/ath/ath11k/hal.c   | 16 ++++-
+ drivers/net/wireless/ath/ath11k/hal.h   |  2 +
+ 3 files changed, 96 insertions(+), 12 deletions(-)
+
+
+base-commit: bf99bc7423e18aa3475ef00a7a6fb773c31ce6df
 
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -3662,6 +3662,46 @@ ath11k_dp_rx_mon_update_status_buf_state
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: BSD-3-Clause-Clear
+ /*
+  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
+- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ 
+ #include <linux/ieee80211.h>
+@@ -3662,11 +3662,52 @@ ath11k_dp_rx_mon_update_status_buf_state
  	}
  }
  
-+enum dp_mon_status_buf_state
-+dp_rx_mon_handle_status_buf_done(struct ath11k_base *ab, struct hal_srng *srng,
-+				 struct dp_rxdma_ring *rx_ring)
++static enum dp_mon_status_buf_state
++ath11k_dp_rx_mon_handle_status_buf_done(struct ath11k_base *ab, struct hal_srng *srng,
++					struct dp_rxdma_ring *rx_ring)
 +{
-+	void *status_desc;
-+	struct sk_buff *skb;
 +	struct ath11k_skb_rxcb *rxcb;
 +	struct hal_tlv_hdr *tlv;
++	struct sk_buff *skb;
++	void *status_desc;
 +	dma_addr_t paddr;
 +	u32 cookie;
 +	int buf_id;
@@ -69,8 +94,8 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
 +
 +	rxcb = ATH11K_SKB_RXCB(skb);
 +	dma_sync_single_for_cpu(ab->dev, rxcb->paddr,
-+			skb->len + skb_tailroom(skb),
-+			DMA_FROM_DEVICE);
++				skb->len + skb_tailroom(skb),
++				DMA_FROM_DEVICE);
 +
 +	tlv = (struct hal_tlv_hdr *)skb->data;
 +	if (FIELD_GET(HAL_TLV_HDR_TAG, tlv->tl) != HAL_RX_STATUS_BUFFER_DONE)
@@ -82,14 +107,12 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  static int ath11k_dp_rx_reap_mon_status_ring(struct ath11k_base *ab, int mac_id,
  					     int *budget, struct sk_buff_head *skb_list)
  {
-@@ -3675,6 +3715,7 @@ static int ath11k_dp_rx_reap_mon_status_
- 	struct sk_buff *skb;
- 	struct ath11k_skb_rxcb *rxcb;
- 	struct hal_tlv_hdr *tlv;
+ 	struct ath11k *ar;
+ 	const struct ath11k_hw_hal_params *hal_params;
 +	enum dp_mon_status_buf_state reap_status;
- 	u32 cookie;
- 	int buf_id, srng_id;
- 	dma_addr_t paddr;
+ 	struct ath11k_pdev_dp *dp;
+ 	struct dp_rxdma_ring *rx_ring;
+ 	struct ath11k_mon_data *pmon;
 @@ -3694,8 +3735,7 @@ static int ath11k_dp_rx_reap_mon_status_
  	ath11k_hal_srng_access_begin(ab, srng);
  	while (*budget) {
@@ -100,13 +123,10 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  		if (!rx_mon_status_desc) {
  			pmon->buf_state = DP_MON_STATUS_REPLINISH;
  			break;
-@@ -3726,18 +3766,43 @@ static int ath11k_dp_rx_reap_mon_status_
- 			tlv = (struct hal_tlv_hdr *)skb->data;
- 			if (FIELD_GET(HAL_TLV_HDR_TAG, tlv->tl) !=
- 					HAL_RX_STATUS_BUFFER_DONE) {
--				ath11k_warn(ab, "mon status DONE not set %lx, buf_id %d\n",
--					    FIELD_GET(HAL_TLV_HDR_TAG,
--						      tlv->tl), buf_id);
+@@ -3729,15 +3769,43 @@ static int ath11k_dp_rx_reap_mon_status_
+ 				ath11k_warn(ab, "mon status DONE not set %lx, buf_id %d\n",
+ 					    FIELD_GET(HAL_TLV_HDR_TAG,
+ 						      tlv->tl), buf_id);
 -				/* If done status is missing, hold onto status
 -				 * ring until status is done for this status
 -				 * ring buffer.
@@ -131,8 +151,8 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
 +				 *    dp_rx_mon_status_srng_process
 +				 */
 +
-+				reap_status = dp_rx_mon_handle_status_buf_done(ab, srng,
-+									       rx_ring);
++				reap_status = ath11k_dp_rx_mon_handle_status_buf_done(ab, srng,
++										      rx_ring);
 +				if (reap_status == DP_MON_STATUS_NO_DMA) {
 +					continue;
 +				} else if (reap_status == DP_MON_STATUS_REPLINISH) {
@@ -157,6 +177,15 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  			spin_lock_bh(&rx_ring->idr_lock);
 --- a/drivers/net/wireless/ath/ath11k/hal.c
 +++ b/drivers/net/wireless/ath/ath11k/hal.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: BSD-3-Clause-Clear
+ /*
+  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
+- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ #include <linux/dma-mapping.h>
+ #include "hal_tx.h"
 @@ -852,6 +852,20 @@ u32 *ath11k_hal_srng_src_get_next_reaped
  	return desc;
  }

From 34e1ec043447ccdfdf97f434d5747aee7542a434 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Fri, 20 Sep 2024 17:30:58 -0400
Subject: [PATCH 166/225] ath11k_nss: Refresh patches for 6.9.9

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...oid-memset-of-ppdu-info-for-next-skb.patch |  6 +-
 ...11k-Disable-rx_header-tlv-for-2K-SKB.patch | 10 ++--
 ...999-336-0001-ath11k-idr-optimization.patch |  8 +--
 .../999-336-0002-ath11k-Use-idr_replace.patch | 16 ++---
 ...99-802-ath11k-fixup-thermal-throttle.patch |  2 +-
 .../999-900-bss-transition-handling.patch     | 59 ++++++++++---------
 ...75-wifi-mac80211-Changes-for-WDS-MLD.patch | 16 ++---
 7 files changed, 59 insertions(+), 58 deletions(-)

diff --git a/package/kernel/mac80211/patches/nss/ath11k/457-wifi-ath11k-Avoid-memset-of-ppdu-info-for-next-skb.patch b/package/kernel/mac80211/patches/nss/ath11k/457-wifi-ath11k-Avoid-memset-of-ppdu-info-for-next-skb.patch
index a6ae251ad33602..f2a0b74f627f03 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/457-wifi-ath11k-Avoid-memset-of-ppdu-info-for-next-skb.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/457-wifi-ath11k-Avoid-memset-of-ppdu-info-for-next-skb.patch
@@ -48,7 +48,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -6091,7 +6091,9 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -6094,7 +6094,9 @@ int ath11k_dp_rx_process_mon_status(stru
  	if (!num_buffs_reaped)
  		goto exit;
  
@@ -59,7 +59,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	ppdu_info->peer_id = HAL_INVALID_PEERID;
  
  	while ((skb = __skb_dequeue(&skb_list))) {
-@@ -6109,7 +6111,6 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -6112,7 +6114,6 @@ int ath11k_dp_rx_process_mon_status(stru
  		if (log_type != ATH11K_PKTLOG_TYPE_INVALID)
  			trace_ath11k_htt_rxdesc(ar, skb->data, log_type, rx_buf_sz);
  
@@ -67,7 +67,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  		ppdu_info->peer_id = HAL_INVALID_PEERID;
  		hal_status = ath11k_hal_rx_parse_mon_status(ab, ppdu_info, skb);
  
-@@ -6137,6 +6138,7 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -6140,6 +6141,7 @@ int ath11k_dp_rx_process_mon_status(stru
  		if ((ppdu_info->peer_id == HAL_INVALID_PEERID ||
  		    hal_status != HAL_RX_MON_STATUS_PPDU_DONE)) {
  			dev_kfree_skb_any(skb);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch b/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
index 0e8d17cd5043aa..cb751f2867b8f7 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
@@ -408,7 +408,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  			ath11k_dbg_dump(ab, ATH11K_DBG_DATA, NULL, "", rx_desc,
  					sizeof(struct hal_rx_desc));
  			goto free_out;
-@@ -4072,6 +4194,7 @@ static int ath11k_dp_rx_h_verify_tkip_mi
+@@ -4075,6 +4197,7 @@ static int ath11k_dp_rx_h_verify_tkip_mi
  
  	hdr = (struct ieee80211_hdr *)(msdu->data + hal_rx_desc_sz);
  	hdr_len = ieee80211_hdrlen(hdr->frame_control);
@@ -416,7 +416,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	head_len = hdr_len + hal_rx_desc_sz + IEEE80211_TKIP_IV_LEN;
  	tail_len = IEEE80211_CCMP_MIC_LEN + IEEE80211_TKIP_ICV_LEN + FCS_LEN;
  
-@@ -4352,8 +4475,8 @@ static void ath11k_dp_rx_h_sort_frags(st
+@@ -4355,8 +4478,8 @@ static void ath11k_dp_rx_h_sort_frags(st
  
  static u64 ath11k_dp_rx_h_get_pn(struct ath11k *ar, struct sk_buff *skb)
  {
@@ -426,7 +426,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	u8 *ehdr;
  	u32 hal_rx_desc_sz = ar->ab->hw_params.hal_desc_sz;
  
-@@ -4583,8 +4706,9 @@ ath11k_dp_process_rx_err_buf(struct ath1
+@@ -4586,8 +4709,9 @@ ath11k_dp_process_rx_err_buf(struct ath1
  	if ((msdu_len + hal_rx_desc_sz) > DP_RX_BUFFER_SIZE) {
  		hdr_status = ath11k_dp_rx_h_80211_hdr(ar->ab, rx_desc);
  		ath11k_warn(ar->ab, "invalid msdu leng %u", msdu_len);
@@ -438,7 +438,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "", rx_desc,
  				sizeof(struct hal_rx_desc));
  		dev_kfree_skb_any(msdu);
-@@ -5209,6 +5333,47 @@ void ath11k_dp_rx_pdev_free(struct ath11
+@@ -5212,6 +5336,47 @@ void ath11k_dp_rx_pdev_free(struct ath11
  	ath11k_dp_rxdma_pdev_buf_free(ar);
  }
  
@@ -486,7 +486,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  int ath11k_dp_rx_pdev_alloc(struct ath11k_base *ab, int mac_id)
  {
  	struct ath11k *ar = ab->pdevs[mac_id].ar;
-@@ -5302,6 +5467,12 @@ config_refill_ring:
+@@ -5305,6 +5470,12 @@ config_refill_ring:
  		}
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-336-0001-ath11k-idr-optimization.patch b/package/kernel/mac80211/patches/nss/ath11k/999-336-0001-ath11k-idr-optimization.patch
index f38eade8144d05..2c74d53d7d31f0 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-336-0001-ath11k-idr-optimization.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-336-0001-ath11k-idr-optimization.patch
@@ -50,7 +50,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  		dma_unmap_single(ab->dev, rxcb->paddr,
  				 msdu->len + skb_tailroom(msdu),
  				 DMA_FROM_DEVICE);
-@@ -4669,17 +4667,14 @@ ath11k_dp_process_rx_err_buf(struct ath1
+@@ -4672,17 +4670,14 @@ ath11k_dp_process_rx_err_buf(struct ath1
  	u32 hal_rx_desc_sz = ar->ab->hw_params.hal_desc_sz;
  
  	spin_lock_bh(&rx_ring->idr_lock);
@@ -70,7 +70,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	rxcb = ATH11K_SKB_RXCB(msdu);
  	dma_unmap_single(ar->ab->dev, rxcb->paddr,
  			 msdu->len + skb_tailroom(msdu),
-@@ -5085,18 +5080,16 @@ int ath11k_dp_rx_process_wbm_err(struct
+@@ -5088,18 +5083,16 @@ int ath11k_dp_rx_process_wbm_err(struct
  		rx_ring = &ar->dp.rx_refill_buf_ring;
  
  		spin_lock_bh(&rx_ring->idr_lock);
@@ -92,7 +92,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  		dma_unmap_single(ab->dev, rxcb->paddr,
  				 msdu->len + skb_tailroom(msdu),
  				 DMA_FROM_DEVICE);
-@@ -5211,16 +5204,14 @@ int ath11k_dp_process_rxdma_err(struct a
+@@ -5214,16 +5207,14 @@ int ath11k_dp_process_rxdma_err(struct a
  					   msdu_cookies[i]);
  
  			spin_lock_bh(&rx_ring->idr_lock);
@@ -111,7 +111,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  
  			rxcb = ATH11K_SKB_RXCB(skb);
  			dma_unmap_single(ab->dev, rxcb->paddr,
-@@ -6425,16 +6416,14 @@ ath11k_dp_rx_full_mon_mpdu_pop(struct at
+@@ -6428,16 +6419,14 @@ ath11k_dp_rx_full_mon_mpdu_pop(struct at
  					   msdu_list.sw_cookie[i]);
  
  			spin_lock_bh(&rx_ring->idr_lock);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch b/package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch
index 5058823dcfcd96..dad3b759888b35 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch
@@ -161,7 +161,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	return total_msdu_reaped;
  }
  
-@@ -4829,7 +4861,7 @@ exit:
+@@ -4832,7 +4864,7 @@ exit:
  		rx_ring = &ar->dp.rx_refill_buf_ring;
  
  		ath11k_dp_rxbufs_replenish(ab, i, rx_ring, n_bufs_reaped[i],
@@ -170,7 +170,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	}
  
  	return tot_n_bufs_reaped;
-@@ -5045,14 +5077,17 @@ int ath11k_dp_rx_process_wbm_err(struct
+@@ -5048,14 +5080,17 @@ int ath11k_dp_rx_process_wbm_err(struct
  	struct sk_buff *msdu;
  	struct sk_buff_head msdu_list[MAX_RADIOS];
  	struct ath11k_skb_rxcb *rxcb;
@@ -189,7 +189,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  
  	srng = &ab->hal.srng_list[dp->rx_rel_ring.ring_id];
  
-@@ -5078,9 +5113,15 @@ int ath11k_dp_rx_process_wbm_err(struct
+@@ -5081,9 +5116,15 @@ int ath11k_dp_rx_process_wbm_err(struct
  
  		ar = ab->pdevs[mac_id].ar;
  		rx_ring = &ar->dp.rx_refill_buf_ring;
@@ -206,7 +206,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  		spin_unlock_bh(&rx_ring->idr_lock);
  		if (!msdu) {
  			ath11k_warn(ab, "frame rx with invalid buf_id %d pdev %d\n",
-@@ -5125,7 +5166,7 @@ int ath11k_dp_rx_process_wbm_err(struct
+@@ -5128,7 +5169,7 @@ int ath11k_dp_rx_process_wbm_err(struct
  		rx_ring = &ar->dp.rx_refill_buf_ring;
  
  		ath11k_dp_rxbufs_replenish(ab, i, rx_ring, num_buffs_reaped[i],
@@ -215,7 +215,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	}
  
  	rcu_read_lock();
-@@ -5147,6 +5188,8 @@ int ath11k_dp_rx_process_wbm_err(struct
+@@ -5150,6 +5191,8 @@ int ath11k_dp_rx_process_wbm_err(struct
  	}
  	rcu_read_unlock();
  done:
@@ -224,7 +224,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	return total_num_buffs_reaped;
  }
  
-@@ -5232,7 +5275,7 @@ int ath11k_dp_process_rxdma_err(struct a
+@@ -5235,7 +5278,7 @@ int ath11k_dp_process_rxdma_err(struct a
  
  	if (num_buf_freed)
  		ath11k_dp_rxbufs_replenish(ab, mac_id, rx_ring, num_buf_freed,
@@ -233,7 +233,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  
  	return budget - quota;
  }
-@@ -6178,12 +6221,12 @@ static void ath11k_dp_rx_mon_dest_proces
+@@ -6181,12 +6224,12 @@ static void ath11k_dp_rx_mon_dest_proces
  			ath11k_dp_rxbufs_replenish(ar->ab, dp->mac_id,
  						   &dp->rxdma_mon_buf_ring,
  						   rx_bufs_used,
@@ -248,7 +248,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	}
  }
  
-@@ -6693,7 +6736,7 @@ next_entry:
+@@ -6696,7 +6739,7 @@ next_entry:
  		ath11k_dp_rxbufs_replenish(ar->ab, dp->mac_id,
  					   &dp->rxdma_mon_buf_ring,
  					   rx_bufs_used,
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-802-ath11k-fixup-thermal-throttle.patch b/package/kernel/mac80211/patches/nss/ath11k/999-802-ath11k-fixup-thermal-throttle.patch
index d392a16a978246..719fd02867944f 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-802-ath11k-fixup-thermal-throttle.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-802-ath11k-fixup-thermal-throttle.patch
@@ -229,7 +229,7 @@
  struct wmi_delba_send_cmd {
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -6591,6 +6591,9 @@ static int ath11k_mac_op_start(struct ie
+@@ -6586,6 +6586,9 @@ static int ath11k_mac_op_start(struct ie
  		}
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch b/package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch
index 1c87a83ea3e079..e75a70988502a6 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch
@@ -31,7 +31,7 @@
  	INIT_WORK(&ab->restart_work, ath11k_core_restart);
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -739,9 +739,22 @@ struct ath11k {
+@@ -737,9 +737,22 @@ struct ath11k {
  			iftype[NUM_NL80211_BANDS][NUM_NL80211_IFTYPES];
  	} mac;
  
@@ -54,7 +54,7 @@
  	u32 min_tx_power;
  	u32 max_tx_power;
  	u32 txpower_limit_2g;
-@@ -819,6 +832,9 @@ struct ath11k {
+@@ -817,6 +830,9 @@ struct ath11k {
  	struct work_struct wmi_mgmt_tx_work;
  	struct sk_buff_head wmi_mgmt_tx_queue;
  
@@ -64,7 +64,7 @@
  	struct ath11k_wow wow;
  	struct completion target_suspend;
  	bool target_suspend_ack;
-@@ -1022,19 +1038,7 @@ struct ath11k_base {
+@@ -1020,19 +1036,7 @@ struct ath11k_base {
  	struct ath11k_hal_reg_capabilities_ext hal_reg_cap[MAX_RADIOS];
  	unsigned long long free_vdev_map;
  
@@ -84,7 +84,7 @@
  	u8 mac_addr[ETH_ALEN];
  	int userpd_id;
  	int irq_num[ATH11K_IRQ_NUM_MAX];
-@@ -1411,4 +1415,36 @@ static inline const char *ath11k_bus_str
+@@ -1409,4 +1413,36 @@ static inline const char *ath11k_bus_str
  	return "unknown";
  }
  
@@ -599,7 +599,7 @@
  			    user_stats->ast_index);
  		return;
  	}
-@@ -4212,7 +4227,7 @@ int ath11k_peer_rx_frag_setup(struct ath
+@@ -4215,7 +4230,7 @@ int ath11k_peer_rx_frag_setup(struct ath
  
  	spin_lock_bh(&ab->base_lock);
  
@@ -608,7 +608,7 @@
  	if (!peer) {
  		ath11k_warn(ab, "failed to find the peer to set up fragment info\n");
  		spin_unlock_bh(&ab->base_lock);
-@@ -4668,7 +4683,7 @@ static int ath11k_dp_rx_frag_h_mpdu(stru
+@@ -4671,7 +4686,7 @@ static int ath11k_dp_rx_frag_h_mpdu(stru
  		return -EINVAL;
  
  	spin_lock_bh(&ab->base_lock);
@@ -617,7 +617,7 @@
  	if (!peer) {
  		ath11k_warn(ab, "failed to find the peer to de-fragment received fragment peer_id %d\n",
  			    peer_id);
-@@ -4730,7 +4745,7 @@ static int ath11k_dp_rx_frag_h_mpdu(stru
+@@ -4733,7 +4748,7 @@ static int ath11k_dp_rx_frag_h_mpdu(stru
  	del_timer_sync(&rx_tid->frag_timer);
  	spin_lock_bh(&ab->base_lock);
  
@@ -626,7 +626,7 @@
  	if (!peer)
  		goto err_frags_cleanup;
  
-@@ -6394,7 +6409,7 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -6397,7 +6412,7 @@ int ath11k_dp_rx_process_mon_status(stru
  			trace_ath11k_htt_rxdesc(ar, skb->data, log_type, rx_buf_sz);
  
  		ppdu_info->peer_id = HAL_INVALID_PEERID;
@@ -635,7 +635,7 @@
  
  		if (test_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags) &&
  		    pmon->mon_ppdu_status == DP_PPDU_STATUS_START &&
-@@ -6425,7 +6440,7 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -6428,7 +6443,7 @@ int ath11k_dp_rx_process_mon_status(stru
  		}
  		rcu_read_lock();
  		spin_lock_bh(&ab->base_lock);
@@ -789,7 +789,7 @@
  
  	ar->num_peers = 0;
  	ar->num_stations = 0;
-@@ -3109,7 +3109,7 @@ static void ath11k_bss_assoc(struct ieee
+@@ -3100,7 +3100,7 @@ static void ath11k_bss_assoc(struct ieee
  
  	spin_lock_bh(&ar->ab->base_lock);
  
@@ -798,7 +798,7 @@
  	if (peer && peer->is_authorized)
  		is_auth = true;
  
-@@ -4269,7 +4269,7 @@ static int ath11k_clear_peer_keys(struct
+@@ -4260,7 +4260,7 @@ static int ath11k_clear_peer_keys(struct
  	lockdep_assert_held(&ar->conf_mutex);
  
  	spin_lock_bh(&ab->base_lock);
@@ -807,7 +807,7 @@
  	if (!peer) {
  		spin_unlock_bh(&ab->base_lock);
  		return -ENOENT;
-@@ -4385,7 +4385,7 @@ static int ath11k_mac_op_set_key(struct
+@@ -4376,7 +4376,7 @@ static int ath11k_mac_op_set_key(struct
  	 * we already hold conf_mutex. we just make sure its there now.
  	 */
  	spin_lock_bh(&ab->base_lock);
@@ -816,7 +816,7 @@
  
  	/* flush the fragments cache during key (re)install to
  	 * ensure all frags in the new frag list belong to the same key.
-@@ -4494,7 +4494,7 @@ static int ath11k_mac_op_set_key(struct
+@@ -4485,7 +4485,7 @@ static int ath11k_mac_op_set_key(struct
  	}
  
  	spin_lock_bh(&ab->base_lock);
@@ -825,7 +825,7 @@
  
  	/* TODO: Check if vdev specific security cfg is mandatory */
  	ret = ath11k_nss_vdev_set_cmd(arvif, ATH11K_NSS_WIFI_VDEV_SECURITY_TYPE_CMD, key->cipher);
-@@ -4525,7 +4525,7 @@ static int ath11k_mac_op_set_key(struct
+@@ -4516,7 +4516,7 @@ static int ath11k_mac_op_set_key(struct
  		list_for_each_entry_safe(dyn_vlan_cfg, tmp, &ap_vlan_arvif->dyn_vlan_cfg, cfg_list) {
  			struct ieee80211_sta *vlan_sta = dyn_vlan_cfg->sta;
  
@@ -834,7 +834,7 @@
  			if (ret)
  				ath11k_warn(ar->ab, "failed to cfg dyn vlan for peer %pM: %d\n",
  					    vlan_sta->addr, ret);
-@@ -5135,7 +5135,7 @@ static void ath11k_sta_set_4addr_wk(stru
+@@ -5126,7 +5126,7 @@ static void ath11k_sta_set_4addr_wk(stru
  	vif = ap_vlan_arvif->vif;
  
  	spin_lock_bh(&ab->base_lock);
@@ -843,7 +843,7 @@
  	if (!wds_peer) {
  		spin_unlock_bh(&ab->base_lock);
  		ath11k_warn(ab, "mac sta use 4addr failed to find peer %pM\n",
-@@ -5358,7 +5358,7 @@ static void ath11k_mac_op_sta_rc_update(
+@@ -5349,7 +5349,7 @@ static void ath11k_mac_op_sta_rc_update(
  
  	spin_lock_bh(&ar->ab->base_lock);
  
@@ -852,7 +852,7 @@
  	if (!peer) {
  		spin_unlock_bh(&ar->ab->base_lock);
  		ath11k_warn(ar->ab, "mac sta rc update failed to find peer %pM on vdev %i\n",
-@@ -8464,7 +8464,7 @@ ath11k_mac_op_assign_vif_chanctx(struct
+@@ -8430,7 +8430,7 @@ ath11k_mac_op_assign_vif_chanctx(struct
  	if (ab->hw_params.vdev_start_delay &&
  	    arvif->vdev_type != WMI_VDEV_TYPE_AP &&
  	    arvif->vdev_type != WMI_VDEV_TYPE_MONITOR &&
@@ -861,7 +861,7 @@
  		memcpy(&arvif->chanctx, ctx, sizeof(*ctx));
  		ret = 0;
  		goto out;
-@@ -8540,7 +8540,7 @@ ath11k_mac_op_unassign_vif_chanctx(struc
+@@ -8506,7 +8506,7 @@ ath11k_mac_op_unassign_vif_chanctx(struc
  	if (ab->hw_params.vdev_start_delay &&
  	    arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
  		spin_lock_bh(&ab->base_lock);
@@ -870,7 +870,7 @@
  		spin_unlock_bh(&ab->base_lock);
  		if (peer)
  			ath11k_peer_delete(ar, arvif->vdev_id, ar->mac_addr);
-@@ -9114,7 +9114,7 @@ ath11k_mac_validate_vht_he_fixed_rate_se
+@@ -9080,7 +9080,7 @@ ath11k_mac_validate_vht_he_fixed_rate_se
  
  	rcu_read_lock();
  	spin_lock_bh(&ar->ab->base_lock);
@@ -879,7 +879,7 @@
  		if (peer->sta) {
  			deflink = &peer->sta->deflink;
  
-@@ -10066,26 +10066,26 @@ static int ath11k_mac_station_remove(str
+@@ -10032,26 +10032,26 @@ static int ath11k_mac_station_remove(str
  	return ret;
  }
  
@@ -913,7 +913,7 @@
  			    sta->addr, ret);
  		return ret;
  	}
-@@ -10135,20 +10135,20 @@ static int ath11k_mac_op_sta_state(struc
+@@ -10101,20 +10101,20 @@ static int ath11k_mac_op_sta_state(struc
  			ath11k_warn(ar->ab, "Failed to remove station: %pM for VDEV: %d\n",
  				    sta->addr, arvif->vdev_id);
  
@@ -938,7 +938,7 @@
  	} else if (old_state == IEEE80211_STA_AUTH &&
  		   new_state == IEEE80211_STA_ASSOC &&
  		   (vif->type == NL80211_IFTYPE_AP ||
-@@ -10179,7 +10179,7 @@ static int ath11k_mac_op_sta_state(struc
+@@ -10145,7 +10145,7 @@ static int ath11k_mac_op_sta_state(struc
  		   new_state == IEEE80211_STA_AUTHORIZED) {
  		spin_lock_bh(&ar->ab->base_lock);
  
@@ -947,7 +947,7 @@
  		if (peer)
  			peer->is_authorized = true;
  
-@@ -10216,7 +10216,7 @@ static int ath11k_mac_op_sta_state(struc
+@@ -10182,7 +10182,7 @@ static int ath11k_mac_op_sta_state(struc
  					list_add_tail(&ar_dyn_vlan_cfg->cfg_list, &arvif->dyn_vlan_cfg);
  				}
  			} else {
@@ -956,7 +956,7 @@
  				if (ret)
  					ath11k_warn(ar->ab, "failed to cfg dyn vlan for peer %pM: %d\n",
  						    sta->addr, ret);
-@@ -10249,7 +10249,7 @@ static int ath11k_mac_op_sta_state(struc
+@@ -10215,7 +10215,7 @@ static int ath11k_mac_op_sta_state(struc
  		   new_state == IEEE80211_STA_ASSOC) {
  
  		spin_lock_bh(&ar->ab->base_lock);
@@ -965,7 +965,7 @@
  		if (peer)
  			peer->is_authorized = false;
  		spin_unlock_bh(&ar->ab->base_lock);
-@@ -10257,7 +10257,7 @@ static int ath11k_mac_op_sta_state(struc
+@@ -10223,7 +10223,7 @@ static int ath11k_mac_op_sta_state(struc
  		   new_state == IEEE80211_STA_ASSOC) {
  		spin_lock_bh(&ar->ab->base_lock);
  
@@ -974,7 +974,7 @@
  		if (peer)
  			peer->is_authorized = false;
  
-@@ -10662,9 +10662,9 @@ void ath11k_mac_unregister(struct ath11k
+@@ -10628,9 +10628,9 @@ void ath11k_mac_unregister(struct ath11k
  			continue;
  
  		__ath11k_mac_unregister(ar);
@@ -985,7 +985,7 @@
  }
  
  static int __ath11k_mac_register(struct ath11k *ar)
-@@ -10951,15 +10951,15 @@ int ath11k_mac_register(struct ath11k_ba
+@@ -10917,15 +10917,15 @@ int ath11k_mac_register(struct ath11k_ba
  	ab->cc_freq_hz = IPQ8074_CC_FREQ_HERTZ;
  	ab->free_vdev_map = (1LL << (ab->num_radios * TARGET_NUM_VDEVS(ab))) - 1;
  
@@ -1004,7 +1004,7 @@
  		if (ab->pdevs_macaddr_valid) {
  			ether_addr_copy(ar->mac_addr, pdev->mac_addr);
  		} else {
-@@ -10987,9 +10987,9 @@ err_cleanup:
+@@ -10953,9 +10953,9 @@ err_cleanup:
  		pdev = &ab->pdevs[i];
  		ar = pdev->ar;
  		__ath11k_mac_unregister(ar);
@@ -1015,7 +1015,7 @@
  
  	return ret;
  }
-@@ -11033,9 +11033,12 @@ int ath11k_mac_allocate(struct ath11k_ba
+@@ -10999,9 +10999,12 @@ int ath11k_mac_allocate(struct ath11k_ba
  		ar->num_rx_chains = get_num_chains(pdev->cap.rx_chain_mask);
  
  		pdev->ar = ar;
@@ -2630,3 +2630,4 @@
 -exit:
  	rcu_read_unlock();
  }
+ 
diff --git a/package/kernel/mac80211/patches/nss/subsys/999-775-wifi-mac80211-Changes-for-WDS-MLD.patch b/package/kernel/mac80211/patches/nss/subsys/999-775-wifi-mac80211-Changes-for-WDS-MLD.patch
index b3410578a5a02d..999d7108446107 100644
--- a/package/kernel/mac80211/patches/nss/subsys/999-775-wifi-mac80211-Changes-for-WDS-MLD.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/999-775-wifi-mac80211-Changes-for-WDS-MLD.patch
@@ -17,7 +17,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
 
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -8760,6 +8760,7 @@ bool cfg80211_rx_spurious_frame(struct n
+@@ -8756,6 +8756,7 @@ bool cfg80211_rx_spurious_frame(struct n
   * @dev: The device the frame matched to
   * @addr: the transmitter address
   * @gfp: context flags
@@ -25,7 +25,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
   *
   * This function is used in AP mode (only!) to inform userspace that
   * an associated station sent a 4addr frame but that wasn't expected.
-@@ -8769,7 +8770,8 @@ bool cfg80211_rx_spurious_frame(struct n
+@@ -8765,7 +8766,8 @@ bool cfg80211_rx_spurious_frame(struct n
   * for a reason other than not having a subscription.)
   */
  bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
@@ -37,7 +37,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
   * cfg80211_probe_status - notify userspace about probe status
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2189,9 +2189,16 @@ static int ieee80211_change_station(stru
+@@ -2188,9 +2188,16 @@ static int ieee80211_change_station(stru
  		vlansdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
  
  		if (params->vlan->ieee80211_ptr->use_4addr) {
@@ -54,7 +54,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  			rcu_assign_pointer(vlansdata->u.vlan.sta, sta);
  			__ieee80211_check_fast_rx_iface(vlansdata);
  
-@@ -2201,6 +2208,39 @@ static int ieee80211_change_station(stru
+@@ -2200,6 +2207,39 @@ static int ieee80211_change_station(stru
  			else
  				drv_sta_set_4addr(local, sta->sdata, &sta->sta,
  						  true);
@@ -127,7 +127,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -18887,7 +18887,8 @@ void cfg80211_conn_failed(struct net_dev
+@@ -18877,7 +18877,8 @@ void cfg80211_conn_failed(struct net_dev
  EXPORT_SYMBOL(cfg80211_conn_failed);
  
  static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
@@ -137,7 +137,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  {
  	struct wireless_dev *wdev = dev->ieee80211_ptr;
  	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
-@@ -18913,6 +18914,9 @@ static bool __nl80211_unexpected_frame(s
+@@ -18903,6 +18904,9 @@ static bool __nl80211_unexpected_frame(s
  	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
  		goto nla_put_failure;
  
@@ -147,7 +147,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  	genlmsg_end(msg, hdr);
  	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
  	return true;
-@@ -18936,14 +18940,15 @@ bool cfg80211_rx_spurious_frame(struct n
+@@ -18926,14 +18930,15 @@ bool cfg80211_rx_spurious_frame(struct n
  		return false;
  	}
  	ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
@@ -165,7 +165,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  {
  	struct wireless_dev *wdev = dev->ieee80211_ptr;
  	bool ret;
-@@ -18958,7 +18963,7 @@ bool cfg80211_rx_unexpected_4addr_frame(
+@@ -18948,7 +18953,7 @@ bool cfg80211_rx_unexpected_4addr_frame(
  	}
  	ret = __nl80211_unexpected_frame(dev,
  					 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,

From 8947ccd1d0361274bd730e71c10cfb52b1a17699 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 21 Sep 2024 16:03:48 -0400
Subject: [PATCH 167/225] nat46: Bump to version 2024-08-12

Brings in following changes

```
2024-07-31|b42c37d|Fix crash when viewing nat46 kernel module config
2024-07-18|3a9f630|nat46-module: fix modpost warning
2024-07-02|cb69317| "Add network namespace awareness to nat46" - take two.
```

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 package/kernel/nat46/Makefile                               | 6 +++---
 package/kernel/nat46/patches/102-mapt.patch                 | 6 +++---
 package/kernel/nat46/patches/105-longest-prefix-match.patch | 2 +-
 package/kernel/nat46/patches/106-dummy_header.patch         | 2 +-
 package/kernel/nat46/patches/118-performance_fix.patch      | 2 +-
 5 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/package/kernel/nat46/Makefile b/package/kernel/nat46/Makefile
index dd1d55b84eef02..bcd0cbd9f6a2f0 100644
--- a/package/kernel/nat46/Makefile
+++ b/package/kernel/nat46/Makefile
@@ -3,11 +3,11 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=nat46
 
-PKG_MIRROR_HASH:=09b93f31d10030d3b4f326066b544b70b1f60236d0482f27c384ed93b298c0a6
 PKG_SOURCE_URL:=https://github.com/ayourtch/nat46.git
-PKG_SOURCE_DATE:=2022-09-19
+PKG_SOURCE_DATE:=2024-08-12
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=4c5beee236841724219598fabb1edc93d4f08ce5
+PKG_SOURCE_VERSION:=b42c37d5c6dee4593df0fc60b37bc7ec4ee243a4
+PKG_MIRROR_HASH:=2d7bbb6cc22808f7e81d716e6bd7a27d9978fb802496304851946627e21534a5
 
 PKG_MAINTAINER:=Hans Dedecker <dedeckeh@gmail.com>
 PKG_LICENSE:=GPL-2.0
diff --git a/package/kernel/nat46/patches/102-mapt.patch b/package/kernel/nat46/patches/102-mapt.patch
index 1e83481c967f8b..072d0cc44715fc 100644
--- a/package/kernel/nat46/patches/102-mapt.patch
+++ b/package/kernel/nat46/patches/102-mapt.patch
@@ -161,7 +161,7 @@ Signed-off-by: Pavithra R <pavir@codeaurora.org>
  void *netdev_nat46_instance(struct net_device *dev) {
  	nat46_netdev_priv_t *priv = netdev_priv(dev);
  	return priv->nat46;
-@@ -159,6 +173,11 @@ int nat46_netdev_create(char *basename,
+@@ -160,6 +174,11 @@ int nat46_netdev_create(struct net *net,
  	printk("nat46: netdevice nat46 '%s' created successfully.\n", devname);
  	kfree(devname);
  
@@ -173,7 +173,7 @@ Signed-off-by: Pavithra R <pavir@codeaurora.org>
  	return 0;
  
  err_register_dev:
-@@ -175,10 +194,24 @@ void nat46_netdev_destroy(struct net_dev
+@@ -176,10 +195,24 @@ void nat46_netdev_destroy(struct net_dev
  	netif_stop_queue(dev);
  	netdev_nat46_set_instance(dev, NULL);
  	unregister_netdev(dev);
@@ -200,7 +200,7 @@ Signed-off-by: Pavithra R <pavir@codeaurora.org>
  	return (priv && (NAT46_DEVICE_SIGNATURE == priv->sig));
 --- a/nat46/modules/nat46-netdev.h
 +++ b/nat46/modules/nat46-netdev.h
-@@ -26,3 +26,6 @@ void nat64_show_all_configs(struct seq_f
+@@ -26,3 +26,6 @@ void nat64_show_all_configs(struct net *
  void nat46_netdev_count_xmit(struct sk_buff *skb, struct net_device *dev);
  void *netdev_nat46_instance(struct net_device *dev);
  
diff --git a/package/kernel/nat46/patches/105-longest-prefix-match.patch b/package/kernel/nat46/patches/105-longest-prefix-match.patch
index 95fe6af973f45b..af7f2c770b2902 100644
--- a/package/kernel/nat46/patches/105-longest-prefix-match.patch
+++ b/package/kernel/nat46/patches/105-longest-prefix-match.patch
@@ -622,7 +622,7 @@ Signed-off-by: Pavithra R <pavir@codeaurora.org>
  int nat46_ipv6_input(struct sk_buff *old_skb);
 --- a/nat46/modules/nat46-netdev.c
 +++ b/nat46/modules/nat46-netdev.c
-@@ -270,7 +270,14 @@ int nat46_insert(char *devname, char *bu
+@@ -270,7 +270,14 @@ int nat46_insert(struct net *net, char *
  	int ret = -1;
  	if(dev) {
  		nat46_instance_t *nat46 = netdev_nat46_instance(dev);
diff --git a/package/kernel/nat46/patches/106-dummy_header.patch b/package/kernel/nat46/patches/106-dummy_header.patch
index 1d4351166fb963..bad08339e6afcf 100644
--- a/package/kernel/nat46/patches/106-dummy_header.patch
+++ b/package/kernel/nat46/patches/106-dummy_header.patch
@@ -76,7 +76,7 @@ Signed-off-by: Pavithra R <pavir@codeaurora.org>
  #endif
 --- a/nat46/modules/nat46-module.c
 +++ b/nat46/modules/nat46-module.c
-@@ -56,12 +56,16 @@ MODULE_AUTHOR("Andrew Yourtchenko <ayour
+@@ -59,12 +59,16 @@ MODULE_AUTHOR("Andrew Yourtchenko <ayour
  MODULE_DESCRIPTION("NAT46 stateless translation");
  
  int debug = 0;
diff --git a/package/kernel/nat46/patches/118-performance_fix.patch b/package/kernel/nat46/patches/118-performance_fix.patch
index 5de4906ef99f7f..5f10ca10bb67bd 100644
--- a/package/kernel/nat46/patches/118-performance_fix.patch
+++ b/package/kernel/nat46/patches/118-performance_fix.patch
@@ -412,4 +412,4 @@ Date: Fri Dec 17 13:37:15 2021 -0800
 +	dev->priv_flags_ext = IFF_EXT_MAPT;
  }
  
- int nat46_netdev_create(char *basename, struct net_device **dev)
+ int nat46_netdev_create(struct net *net, char *basename, struct net_device **dev)

From 5d601d724c5f3a6009e5253aaa71eab9e34946b7 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 28 Sep 2024 15:03:55 -0400
Subject: [PATCH 168/225] ath11k_nss: Remove unecessary ignore frags patch

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...-frags-from-uninitialized-peer-in-dp.patch | 74 -------------------
 1 file changed, 74 deletions(-)
 delete mode 100644 package/kernel/mac80211/patches/nss/ath11k/353-ath11k-ignore-frags-from-uninitialized-peer-in-dp.patch

diff --git a/package/kernel/mac80211/patches/nss/ath11k/353-ath11k-ignore-frags-from-uninitialized-peer-in-dp.patch b/package/kernel/mac80211/patches/nss/ath11k/353-ath11k-ignore-frags-from-uninitialized-peer-in-dp.patch
deleted file mode 100644
index 0e99521c4d5ff0..00000000000000
--- a/package/kernel/mac80211/patches/nss/ath11k/353-ath11k-ignore-frags-from-uninitialized-peer-in-dp.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From 0ab84604de1db0f589f7303507f38148ba8f3f04 Mon Sep 17 00:00:00 2001
-From: Nagarajan Maran <quic_nmaran@quicinc.com>
-Date: Tue, 28 Jun 2022 11:31:50 +0530
-Subject: [PATCH] ath11k: Ignore frags from uninitialized peer in dp
-
-In certain scenario, fragmented packet is received for self peer,
-for which rx_tid and rx_frags are not initialized in datapath. 
-While handling this fragment, crash is observed as the 
-rx_frag list is uninitialised and when we walk in 
-ath11k_dp_rx_h_sort_frags, skb null leads to exception.
-
-To address this, before processing received fragments we
-check dp_setup_done flag is set to ensure that peer
-has completed its dp peer setup for fragment queue,
-else ignore processing the fragments.
-
-Also, __fls would have an undefined behavior if the argument
-is passed as "0". Hence, added changes to handle the same.
-
-Below is the call trace of the crash:
-
-  CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.164 #0
-  Hardware name: Qualcomm Technologies, Inc. IPQ6018/AP-CP01-C1 (DT)
-  pstate: a0400005 (NzCv daif +PAN -UAO)
-  pc : ath11k_dp_process_rx_err+0x550/0x1084 [ath11k]
-  lr : ath11k_dp_process_rx_err+0x4e0/0x1084 [ath11k]
-  
-  Call trace:
-  ath11k_dp_process_rx_err+0x550/0x1084 [ath11k]
-  ath11k_dp_service_srng+0x70/0x370 [ath11k]
-  0xffffffc009693a04
-  __napi_poll+0x30/0xa4
-  net_rx_action+0x118/0x270
-  __do_softirq+0x10c/0x244
-  irq_exit+0x64/0xb4
-  __handle_domain_irq+0x88/0xac
-  gic_handle_irq+0x74/0xbc
-  el1_irq+0xf0/0x1c0
-  arch_cpu_idle+0x10/0x18
-  do_idle+0x104/0x248
-  cpu_startup_entry+0x20/0x64
-  rest_init+0xd0/0xdc
-  arch_call_rest_init+0xc/0x14
-  start_kernel+0x480/0x4b8
-  Code: f9400281 f94066a2 91405021 b94a0023 (f9406401)
-
-Signed-off-by: Harshitha Prem <quic_hprem@quicinc.com>
-Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
----
- drivers/net/wireless/ath/ath11k/dp.c    |  3 ++-
- drivers/net/wireless/ath/ath11k/dp_rx.c | 11 ++++++++++-
- drivers/net/wireless/ath/ath11k/peer.h  |  2 ++
- 3 files changed, 14 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/ath/ath11k/dp.c
-+++ b/drivers/net/wireless/ath/ath11k/dp.c
-@@ -38,6 +38,7 @@ void ath11k_dp_peer_cleanup(struct ath11
- 	ath11k_peer_rx_tid_cleanup(ar, peer);
- 	peer->dp_setup_done = false;
- 	crypto_free_shash(peer->tfm_mmic);
-+	peer->dp_setup_done = false;
- 	spin_unlock_bh(&ab->base_lock);
- }
- 
---- a/drivers/net/wireless/ath/ath11k/peer.h
-+++ b/drivers/net/wireless/ath/ath11k/peer.h
-@@ -92,6 +92,7 @@ struct ath11k_peer {
- 	u16 sec_type;
- 	u16 sec_type_grp;
- 	bool is_authorized;
-+	/* Peer's datapath set flag */
- 	bool dp_setup_done;
- 	struct ppdu_user_delayba ppdu_stats_delayba;
- 	bool delayba_flag;

From 67be5d9b100c875d4acea30bdc466735311cfb4e Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Thu, 26 Sep 2024 16:23:17 -0400
Subject: [PATCH 169/225] ath11k_nss: Fix patches for backports 6.11

deleted: (merged upstream)
package/kernel/mac80211/patches/nss/ath11k/336-ath11k-skip-status-ring-entry-processing.patch

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../999-800-ath10k-Add-threaded-napi.patch    |  17 +-
 .../068-ath11k-add-rx-histogram-stats.patch   |  30 +--
 .../199-003-ath11k-add-nss-support.patch      |  35 +--
 ...-support-on-NSS-offload-for-STA-mode.patch |  16 +-
 ...14-ath11k-qos-null-frame-tx-over-wmi.patch |  10 +-
 ...pport-for-WDS-offload-in-NSS-offload.patch |   6 +-
 ...ow-fast-rx-by-bypassing-stats-update.patch |   2 +-
 ...-0001-ath11k-optimize-tx-completions.patch |  11 +-
 ...1k-skip-status-ring-entry-processing.patch | 220 ------------------
 ...11k-Disable-rx_header-tlv-for-2K-SKB.patch |   8 +-
 ...wifi-ath11k-Fix-BCCA-counter-for-EMA.patch |   6 +-
 .../999-800-ath11k-Add-threaded-napi.patch    |  50 ++--
 .../199-001-mac80211-add-nss-support.patch    |  22 +-
 ...1-Add-mac-hw-flag-to-avoid-queue-skb.patch |   2 +-
 14 files changed, 106 insertions(+), 329 deletions(-)
 delete mode 100644 package/kernel/mac80211/patches/nss/ath11k/336-ath11k-skip-status-ring-entry-processing.patch

diff --git a/package/kernel/mac80211/patches/nss/ath10k/999-800-ath10k-Add-threaded-napi.patch b/package/kernel/mac80211/patches/nss/ath10k/999-800-ath10k-Add-threaded-napi.patch
index 4293e2ccfdfc13..c97fd769193751 100644
--- a/package/kernel/mac80211/patches/nss/ath10k/999-800-ath10k-Add-threaded-napi.patch
+++ b/package/kernel/mac80211/patches/nss/ath10k/999-800-ath10k-Add-threaded-napi.patch
@@ -4,7 +4,7 @@
  
  	ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot hif start\n");
  
-+	dev_set_threaded(&ar->napi_dev, true);
++	dev_set_threaded(ar->napi_dev, true);
  	ath10k_core_napi_enable(ar);
  
  	ath10k_pci_irq_enable(ar);
@@ -20,22 +20,23 @@
  	/* Sleep 20 ms before HIF interrupts are disabled.
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -3722,6 +3722,9 @@ struct ath10k *ath10k_core_create(size_t
- 		  ath10k_core_set_coverage_class_work);
+@@ -3707,6 +3707,10 @@ struct ath10k *ath10k_core_create(size_t
+ 	if (!ar->napi_dev)
+ 		goto err_free_tx_complete;
  
- 	init_dummy_netdev(&ar->napi_dev);
-+	snprintf(ar->napi_dev.name, sizeof(ar->napi_dev.name), "ath10k_%s",
++	snprintf(ar->napi_dev->name, sizeof(ar->napi_dev->name), "ath10k_%s",
 +		 wiphy_name(ar->hw->wiphy));
-+	dev_set_threaded(&ar->napi_dev, true);
- 
++	dev_set_threaded(ar->napi_dev, true);
++
  	ret = ath10k_coredump_create(ar);
  	if (ret)
+ 		goto err_free_netdev;
 --- a/drivers/net/wireless/ath/ath10k/ahb.c
 +++ b/drivers/net/wireless/ath/ath10k/ahb.c
 @@ -622,6 +622,7 @@ static int ath10k_ahb_hif_start(struct a
  	ath10k_core_napi_enable(ar);
  	ath10k_ce_enable_interrupts(ar);
- 	ath10k_pci_enable_legacy_irq(ar);
+ 	ath10k_pci_enable_intx_irq(ar);
 +	dev_set_threaded(&ar->napi_dev, true);
  
  	ath10k_pci_rx_post(ar);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/068-ath11k-add-rx-histogram-stats.patch b/package/kernel/mac80211/patches/nss/ath11k/068-ath11k-add-rx-histogram-stats.patch
index 646cd697750ee5..35a07b9e4055e5 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/068-ath11k-add-rx-histogram-stats.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/068-ath11k-add-rx-histogram-stats.patch
@@ -411,21 +411,21 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  
 +static inline u32 ath11k_he_gi_to_nl80211_he_gi(u8 sgi)
 +{
-+        u32 ret = 0;
-+
-+        switch (sgi) {
-+        case RX_MSDU_START_SGI_0_8_US:
-+                ret = NL80211_RATE_INFO_HE_GI_0_8;
-+                break;
-+        case RX_MSDU_START_SGI_1_6_US:
-+                ret = NL80211_RATE_INFO_HE_GI_1_6;
-+                break;
-+        case RX_MSDU_START_SGI_3_2_US:
-+                ret = NL80211_RATE_INFO_HE_GI_3_2;
-+                break;
-+        }
-+
-+        return ret;
++	u32 ret = 0;
++
++	switch (sgi) {
++	case RX_MSDU_START_SGI_0_8_US:
++		ret = NL80211_RATE_INFO_HE_GI_0_8;
++		break;
++	case RX_MSDU_START_SGI_1_6_US:
++		ret = NL80211_RATE_INFO_HE_GI_1_6;
++		break;
++	case RX_MSDU_START_SGI_3_2_US:
++		ret = NL80211_RATE_INFO_HE_GI_3_2;
++		break;
++	}
++
++	return ret;
 +}
 +
  int ath11k_dp_rx_ampdu_start(struct ath11k *ar,
diff --git a/package/kernel/mac80211/patches/nss/ath11k/199-003-ath11k-add-nss-support.patch b/package/kernel/mac80211/patches/nss/ath11k/199-003-ath11k-add-nss-support.patch
index 94ab2544935c41..691f8f6718c463 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/199-003-ath11k-add-nss-support.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/199-003-ath11k-add-nss-support.patch
@@ -292,8 +292,8 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
 -	for (i = 0; i < ab->num_radios; i++) {
 +	for (i = 0; !nss_offload && i < ab->num_radios; i++) {
- 		for (j = 0; j < ab->hw_params.num_rxmda_per_pdev; j++) {
- 			int id = i * ab->hw_params.num_rxmda_per_pdev + j;
+ 		for (j = 0; j < ab->hw_params.num_rxdma_per_pdev; j++) {
+ 			int id = i * ab->hw_params.num_rxdma_per_pdev + j;
  
 --- a/drivers/net/wireless/ath/ath11k/dp.h
 +++ b/drivers/net/wireless/ath/ath11k/dp.h
@@ -357,16 +357,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	if (ar->ab->hw_params.rxdma1_enable) {
  		rx_ring = &dp->rxdma_mon_buf_ring;
-@@ -2036,7 +2039,7 @@ static void ath11k_dp_rx_h_csum_offload(
- 			  CHECKSUM_NONE : CHECKSUM_UNNECESSARY;
- }
- 
--static int ath11k_dp_rx_crypto_mic_len(struct ath11k *ar,
-+int ath11k_dp_rx_crypto_mic_len(struct ath11k *ar,
- 				       enum hal_encrypt_type enctype)
- {
- 	switch (enctype) {
-@@ -2063,7 +2066,7 @@ static int ath11k_dp_rx_crypto_mic_len(s
+@@ -2062,7 +2065,7 @@ int ath11k_dp_rx_crypto_mic_len(struct a
  	return 0;
  }
  
@@ -462,12 +453,10 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  				ath11k_dp_rx_update_peer_mu_stats(ar, ppdu_info);
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.h
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.h
-@@ -145,4 +145,18 @@ int ath11k_peer_rx_frag_setup(struct ath
- int ath11k_dp_rx_pktlog_start(struct ath11k_base *ab);
- int ath11k_dp_rx_pktlog_stop(struct ath11k_base *ab, bool stop_timer);
+@@ -148,4 +148,16 @@ int ath11k_dp_rx_pktlog_stop(struct ath1
+ 
+ int ath11k_dp_rx_crypto_mic_len(struct ath11k *ar, enum hal_encrypt_type enctype);
  
-+int ath11k_dp_rx_crypto_mic_len(struct ath11k *ar,
-+				       enum hal_encrypt_type enctype);
 +int ath11k_dp_rx_crypto_param_len(struct ath11k *ar,
 +					 enum hal_encrypt_type enctype);
 +int ath11k_dp_rx_crypto_icv_len(struct ath11k *ar,
@@ -740,16 +729,16 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	}
  
  	/* Restart the internal monitor vdev on new channel */
-@@ -8982,6 +9087,8 @@ static void ath11k_mac_op_sta_statistics
- 	sinfo->signal_avg = ewma_avg_rssi_read(&arsta->avg_rssi) +
- 		ATH11K_DEFAULT_NOISE_FLOOR;
+@@ -9014,6 +9119,8 @@ static void ath11k_mac_op_sta_statistics
+ 		sinfo->signal_avg += ATH11K_DEFAULT_NOISE_FLOOR;
+ 
  	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
 +
 +	ath11k_nss_update_sta_stats(sinfo, sta, arsta);
  }
  
  #if IS_ENABLED(CONFIG_IPV6)
-@@ -9674,6 +9781,7 @@ static const struct ieee80211_ops ath11k
+@@ -9711,6 +9818,7 @@ static const struct ieee80211_ops ath11k
  	.update_vif_offload		= ath11k_mac_op_update_vif_offload,
  	.config                         = ath11k_mac_op_config,
  	.bss_info_changed               = ath11k_mac_op_bss_info_changed,
@@ -1195,8 +1184,8 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_3,
 --- a/drivers/net/wireless/ath/ath11k/pcic.c
 +++ b/drivers/net/wireless/ath/ath11k/pcic.c
-@@ -582,6 +582,12 @@ static int ath11k_pcic_ext_irq_config(st
- 		netif_napi_add(&irq_grp->napi_ndev, &irq_grp->napi,
+@@ -589,6 +589,12 @@ static int ath11k_pcic_ext_irq_config(st
+ 		netif_napi_add(irq_grp->napi_ndev, &irq_grp->napi,
  			       ath11k_pcic_ext_grp_napi_poll);
  
 +		/* tcl, reo, rx_err, wbm release, rxdma rings are offloaded to nss. */
diff --git a/package/kernel/mac80211/patches/nss/ath11k/211-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch b/package/kernel/mac80211/patches/nss/ath11k/211-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch
index 8ab1971384c8dc..274425c8b9a635 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/211-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/211-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch
@@ -776,16 +776,16 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  #endif /* _PEER_H_ */
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
-@@ -156,6 +156,8 @@ static const struct wmi_tlv_policy wmi_t
- 		.min_len = sizeof(struct wmi_per_chain_rssi_stats) },
- 	[WMI_TAG_TWT_ADD_DIALOG_COMPLETE_EVENT] = {
- 		.min_len = sizeof(struct wmi_twt_add_dialog_event) },
+@@ -161,6 +161,8 @@ static const struct wmi_tlv_policy wmi_t
+ 		.min_len = sizeof(struct ath11k_wmi_p2p_noa_info) },
+ 	[WMI_TAG_P2P_NOA_EVENT] = {
+ 		.min_len = sizeof(struct wmi_p2p_noa_event) },
 +	[WMI_TAG_WDS_ADDR_EVENT] = {
 +		.min_len = sizeof(struct wmi_wds_addr_event) },
  };
  
  #define PRIMAP(_hw_mode_) \
-@@ -1126,6 +1128,51 @@ int ath11k_wmi_send_peer_delete_cmd(stru
+@@ -1131,6 +1133,51 @@ int ath11k_wmi_send_peer_delete_cmd(stru
  	return ret;
  }
  
@@ -905,9 +905,9 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  static void ath11k_wmi_tlv_op_rx(struct ath11k_base *ab, struct sk_buff *skb)
  {
  	struct wmi_cmd_hdr *cmd_hdr;
-@@ -8908,6 +9002,9 @@ static void ath11k_wmi_tlv_op_rx(struct
- 	case WMI_GTK_OFFLOAD_STATUS_EVENTID:
- 		ath11k_wmi_gtk_offload_status_event(ab, skb);
+@@ -9008,6 +9102,9 @@ static void ath11k_wmi_tlv_op_rx(struct
+ 	case WMI_P2P_NOA_EVENTID:
+ 		ath11k_wmi_p2p_noa_event(ab, skb);
  		break;
 +	case WMI_WDS_PEER_EVENTID:
 +		ath11k_wmi_wds_peer_event(ab, skb);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/214-ath11k-qos-null-frame-tx-over-wmi.patch b/package/kernel/mac80211/patches/nss/ath11k/214-ath11k-qos-null-frame-tx-over-wmi.patch
index aca1676d6fcfa7..01cb6fb7af2eb0 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/214-ath11k-qos-null-frame-tx-over-wmi.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/214-ath11k-qos-null-frame-tx-over-wmi.patch
@@ -378,13 +378,13 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
 +	u32 tx_params_valid;
 +} __packed;
 +
- #define WMI_MAX_MEM_REQS 32
- 
  #define MAX_RADIOS 3
-@@ -6422,6 +6451,8 @@ int ath11k_wmi_cmd_send(struct ath11k_pd
- struct sk_buff *ath11k_wmi_alloc_skb(struct ath11k_wmi_base *wmi_sc, u32 len);
- int ath11k_wmi_mgmt_send(struct ath11k *ar, u32 vdev_id, u32 buf_id,
+ 
+ #define WMI_SERVICE_READY_TIMEOUT_HZ (5 * HZ)
+@@ -6428,6 +6457,8 @@ int ath11k_wmi_mgmt_send(struct ath11k *
  			 struct sk_buff *frame);
+ int ath11k_wmi_p2p_go_bcn_ie(struct ath11k *ar, u32 vdev_id,
+ 			     const u8 *p2p_ie);
 +int ath11k_wmi_qos_null_send(struct ath11k *ar, u32 vdev_id, u32 buf_id,
 +			     struct sk_buff *frame);
  int ath11k_wmi_bcn_tmpl(struct ath11k *ar, u32 vdev_id,
diff --git a/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch b/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
index 6581ca9653a081..1042a6c013246a 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
@@ -263,14 +263,14 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	INIT_DELAYED_WORK(&arvif->connection_loss_work,
  			  ath11k_mac_vif_sta_connection_loss_work);
  
-@@ -6689,6 +6839,7 @@ static int ath11k_mac_op_add_interface(s
+@@ -6788,6 +6938,7 @@ static int ath11k_mac_op_add_interface(s
  		fallthrough;
  	case NL80211_IFTYPE_AP:
  		arvif->vdev_type = WMI_VDEV_TYPE_AP;
 +		INIT_LIST_HEAD(&arvif->ap_vlan_arvifs);
+ 		if (vif->p2p)
+ 			arvif->vdev_subtype = WMI_VDEV_SUBTYPE_P2P_GO;
  		break;
- 	case NL80211_IFTYPE_MONITOR:
- 		arvif->vdev_type = WMI_VDEV_TYPE_MONITOR;
 @@ -6917,13 +7068,30 @@ static void ath11k_mac_op_remove_interfa
  	struct ath11k *ar = hw->priv;
  	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/237-001-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch b/package/kernel/mac80211/patches/nss/ath11k/237-001-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
index 0ce88c62ec55c6..6b187ee9ab2c7e 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/237-001-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/237-001-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
@@ -24,7 +24,7 @@
 +	if (enable)
 +		tlv_filter = ath11k_mac_mon_status_filter_default;
 +
-+	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
++	for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
 +		ring_id = ar->dp.rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
 +		ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id,
 +						 ar->dp.mac_id + i,
diff --git a/package/kernel/mac80211/patches/nss/ath11k/335-0001-ath11k-optimize-tx-completions.patch b/package/kernel/mac80211/patches/nss/ath11k/335-0001-ath11k-optimize-tx-completions.patch
index 60f3b246550641..34b2537d3e18bf 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/335-0001-ath11k-optimize-tx-completions.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/335-0001-ath11k-optimize-tx-completions.patch
@@ -95,7 +95,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  	if (unlikely(!rcu_access_pointer(ab->pdevs_active[ar->pdev_idx]))) {
  		ieee80211_free_txskb(ar->hw, msdu);
  		return;
-@@ -704,48 +743,48 @@ static void ath11k_dp_tx_complete_msdu(s
+@@ -704,10 +743,10 @@ static void ath11k_dp_tx_complete_msdu(s
  	/* skip tx rate update from ieee80211_status*/
  	info->status.rates[0].idx = -1;
  
@@ -103,9 +103,12 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
 +	if (ts.status == HAL_WBM_TQM_REL_REASON_FRAME_ACKED &&
  	    !(info->flags & IEEE80211_TX_CTL_NO_ACK)) {
  		info->flags |= IEEE80211_TX_STAT_ACK;
- 		info->status.ack_signal = ATH11K_DEFAULT_NOISE_FLOOR +
--					  ts->ack_rssi;
-+					  ts.ack_rssi;
+-		info->status.ack_signal = ts->ack_rssi;
++		info->status.ack_signal = ts.ack_rssi;
+ 
+ 		if (!test_bit(WMI_TLV_SERVICE_HW_DB2DBM_CONVERSION_SUPPORT,
+ 			      ab->wmi_ab.svc_map))
+@@ -720,40 +759,40 @@ static void ath11k_dp_tx_complete_msdu(s
  		info->status.flags |= IEEE80211_TX_STATUS_ACK_SIGNAL_VALID;
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/336-ath11k-skip-status-ring-entry-processing.patch b/package/kernel/mac80211/patches/nss/ath11k/336-ath11k-skip-status-ring-entry-processing.patch
deleted file mode 100644
index c912fe604c61cf..00000000000000
--- a/package/kernel/mac80211/patches/nss/ath11k/336-ath11k-skip-status-ring-entry-processing.patch
+++ /dev/null
@@ -1,220 +0,0 @@
-From: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
-Date: Mon, 29 Apr 2024 13:06:24 +0530
-Subject: [PATCHv5] wifi: ath11k: skip status ring entry processing
-
-If STATUS_BUFFER_DONE is not set for a monitor status ring entry,
-we don't process the status ring until STATUS_BUFFER_DONE set
-for that status ring entry.
-
-During LMAC reset it may happen that hardware will not write
-STATUS_BUFFER_DONE tlv in status buffer, in that case we end up
-waiting for STATUS_BUFFER_DONE leading to backpressure on monitor
-status ring.
-
-To fix the issue, when HP(Head Pointer) + 1 entry is peeked and if DMA
-is not done and if HP + 2 entry's DMA done is set,
-replenish HP + 1 entry and start processing in next interrupt.
-If HP + 2 entry's DMA done is not set, poll onto HP + 1 entry DMA
-done to be set.
-
-Also, during monitor attach HP points to the end of the ring and
-TP(Tail Pointer) points to the start of the ring.
-Using ath11k_hal_srng_src_peek() may result in processing invalid buffer
-for the very first interrupt. Since, HW starts writing buffer from TP.
-
-To avoid this issue call ath11k_hal_srng_src_next_peek() instead of
-calling ath11k_hal_srng_src_peek().
-
-Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1
-
-Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
-Co-developed-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
-Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
-Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
----
-v5:
-  * Updated copyright info in dp_rx.c and hal.c
-v4:
-  * Removed kernel reported compilation warning from Signed off place
-v3:
-  * Rebased on top of ToT
-v2:
-  * Fixed compilation warning Reported-by: kernel test robot <lkp@intel.com>
-
- drivers/net/wireless/ath/ath11k/dp_rx.c | 90 ++++++++++++++++++++++---
- drivers/net/wireless/ath/ath11k/hal.c   | 16 ++++-
- drivers/net/wireless/ath/ath11k/hal.h   |  2 +
- 3 files changed, 96 insertions(+), 12 deletions(-)
-
-
-base-commit: bf99bc7423e18aa3475ef00a7a6fb773c31ce6df
-
---- a/drivers/net/wireless/ath/ath11k/dp_rx.c
-+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -1,7 +1,7 @@
- // SPDX-License-Identifier: BSD-3-Clause-Clear
- /*
-  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
-- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
-+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
-  */
- 
- #include <linux/ieee80211.h>
-@@ -3662,11 +3662,52 @@ ath11k_dp_rx_mon_update_status_buf_state
- 	}
- }
- 
-+static enum dp_mon_status_buf_state
-+ath11k_dp_rx_mon_handle_status_buf_done(struct ath11k_base *ab, struct hal_srng *srng,
-+					struct dp_rxdma_ring *rx_ring)
-+{
-+	struct ath11k_skb_rxcb *rxcb;
-+	struct hal_tlv_hdr *tlv;
-+	struct sk_buff *skb;
-+	void *status_desc;
-+	dma_addr_t paddr;
-+	u32 cookie;
-+	int buf_id;
-+	u8 rbm;
-+
-+	status_desc = ath11k_hal_srng_src_next_peek(ab, srng);
-+	if (!status_desc)
-+		return DP_MON_STATUS_NO_DMA;
-+
-+	ath11k_hal_rx_buf_addr_info_get(status_desc, &paddr, &cookie, &rbm);
-+
-+	buf_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_BUF_ID, cookie);
-+
-+	spin_lock_bh(&rx_ring->idr_lock);
-+	skb = idr_find(&rx_ring->bufs_idr, buf_id);
-+	spin_unlock_bh(&rx_ring->idr_lock);
-+
-+	if (!skb)
-+		return DP_MON_STATUS_NO_DMA;
-+
-+	rxcb = ATH11K_SKB_RXCB(skb);
-+	dma_sync_single_for_cpu(ab->dev, rxcb->paddr,
-+				skb->len + skb_tailroom(skb),
-+				DMA_FROM_DEVICE);
-+
-+	tlv = (struct hal_tlv_hdr *)skb->data;
-+	if (FIELD_GET(HAL_TLV_HDR_TAG, tlv->tl) != HAL_RX_STATUS_BUFFER_DONE)
-+		return DP_MON_STATUS_NO_DMA;
-+
-+	return DP_MON_STATUS_REPLINISH;
-+}
-+
- static int ath11k_dp_rx_reap_mon_status_ring(struct ath11k_base *ab, int mac_id,
- 					     int *budget, struct sk_buff_head *skb_list)
- {
- 	struct ath11k *ar;
- 	const struct ath11k_hw_hal_params *hal_params;
-+	enum dp_mon_status_buf_state reap_status;
- 	struct ath11k_pdev_dp *dp;
- 	struct dp_rxdma_ring *rx_ring;
- 	struct ath11k_mon_data *pmon;
-@@ -3694,8 +3735,7 @@ static int ath11k_dp_rx_reap_mon_status_
- 	ath11k_hal_srng_access_begin(ab, srng);
- 	while (*budget) {
- 		*budget -= 1;
--		rx_mon_status_desc =
--			ath11k_hal_srng_src_peek(ab, srng);
-+		rx_mon_status_desc = ath11k_hal_srng_src_peek(ab, srng);
- 		if (!rx_mon_status_desc) {
- 			pmon->buf_state = DP_MON_STATUS_REPLINISH;
- 			break;
-@@ -3729,15 +3769,43 @@ static int ath11k_dp_rx_reap_mon_status_
- 				ath11k_warn(ab, "mon status DONE not set %lx, buf_id %d\n",
- 					    FIELD_GET(HAL_TLV_HDR_TAG,
- 						      tlv->tl), buf_id);
--				/* If done status is missing, hold onto status
--				 * ring until status is done for this status
--				 * ring buffer.
--				 * Keep HP in mon_status_ring unchanged,
--				 * and break from here.
--				 * Check status for same buffer for next time
-+				/* RxDMA status done bit might not be set even
-+				 * though tp is moved by HW.
- 				 */
--				pmon->buf_state = DP_MON_STATUS_NO_DMA;
--				break;
-+
-+				/* If done status is missing:
-+				 * 1. As per MAC team's suggestion,
-+				 *    when HP + 1 entry is peeked and if DMA
-+				 *    is not done and if HP + 2 entry's DMA done
-+				 *    is set. skip HP + 1 entry and
-+				 *    start processing in next interrupt.
-+				 * 2. If HP + 2 entry's DMA done is not set,
-+				 *    poll onto HP + 1 entry DMA done to be set.
-+				 *    Check status for same buffer for next time
-+				 *    dp_rx_mon_status_srng_process
-+				 */
-+
-+				reap_status = ath11k_dp_rx_mon_handle_status_buf_done(ab, srng,
-+										      rx_ring);
-+				if (reap_status == DP_MON_STATUS_NO_DMA) {
-+					continue;
-+				} else if (reap_status == DP_MON_STATUS_REPLINISH) {
-+					ath11k_warn(ab, "mon status DONE not set %lx, buf_id %d\n",
-+						    FIELD_GET(HAL_TLV_HDR_TAG, tlv->tl),
-+						    buf_id);
-+
-+					spin_lock_bh(&rx_ring->idr_lock);
-+					idr_remove(&rx_ring->bufs_idr, buf_id);
-+					spin_unlock_bh(&rx_ring->idr_lock);
-+
-+					dma_unmap_single(ab->dev, rxcb->paddr,
-+							 skb->len + skb_tailroom(skb),
-+							 DMA_FROM_DEVICE);
-+
-+					dev_kfree_skb_any(skb);
-+					pmon->buf_state = DP_MON_STATUS_REPLINISH;
-+					goto move_next;
-+				}
- 			}
- 
- 			spin_lock_bh(&rx_ring->idr_lock);
---- a/drivers/net/wireless/ath/ath11k/hal.c
-+++ b/drivers/net/wireless/ath/ath11k/hal.c
-@@ -1,7 +1,7 @@
- // SPDX-License-Identifier: BSD-3-Clause-Clear
- /*
-  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
-- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
-+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
-  */
- #include <linux/dma-mapping.h>
- #include "hal_tx.h"
-@@ -852,6 +852,20 @@ u32 *ath11k_hal_srng_src_get_next_reaped
- 	return desc;
- }
- 
-+u32 *ath11k_hal_srng_src_next_peek(struct ath11k_base *ab, struct hal_srng *srng)
-+{
-+	u32 next_hp;
-+
-+	lockdep_assert_held(&srng->lock);
-+
-+	next_hp = (srng->u.src_ring.hp + srng->entry_size) % srng->ring_size;
-+
-+	if (next_hp != srng->u.src_ring.cached_tp)
-+		return srng->ring_base_vaddr + next_hp;
-+
-+	return NULL;
-+}
-+
- u32 *ath11k_hal_srng_src_peek(struct ath11k_base *ab, struct hal_srng *srng)
- {
- 	lockdep_assert_held(&srng->lock);
---- a/drivers/net/wireless/ath/ath11k/hal.h
-+++ b/drivers/net/wireless/ath/ath11k/hal.h
-@@ -953,6 +953,8 @@ int ath11k_hal_srng_dst_num_free(struct
- void ath11k_hal_srng_dst_invalidate_entry(struct ath11k_base *ab,
- 					  struct hal_srng *srng, int entries);
- u32 *ath11k_hal_srng_src_peek(struct ath11k_base *ab, struct hal_srng *srng);
-+u32 *ath11k_hal_srng_src_next_peek(struct ath11k_base *ab,
-+				   struct hal_srng *srng);
- u32 *ath11k_hal_srng_src_get_next_reaped(struct ath11k_base *ab,
- 					 struct hal_srng *srng);
- u32 *ath11k_hal_srng_src_reap_next(struct ath11k_base *ab,
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch b/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
index cb751f2867b8f7..4677e45f7c279a 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
@@ -18,14 +18,14 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	ar->debug.rx_filter = tlv_filter.rx_filter;
 +	tlv_filter.offset_valid = false;
  
- 	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
+ 	for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
  		ring_id = ar->dp.rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
 @@ -1229,6 +1230,7 @@ static ssize_t ath11k_write_pktlog_filte
  	}
  
  	/* Clear rx filter set for monitor mode and rx status */
 +	tlv_filter.offset_valid = false;
- 	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
+ 	for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
  		ring_id = ar->dp.rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
  		ret = ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id, ar->dp.mac_id,
 --- a/drivers/net/wireless/ath/ath11k/dp.h
@@ -933,12 +933,12 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  extern const struct ath11k_hw_ops ipq8074_ops;
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -6438,6 +6438,7 @@ static int ath11k_mac_config_mon_status_
+@@ -6535,6 +6535,7 @@ static int ath11k_mac_config_mon_status_
  			tlv_filter.rx_filter = ath11k_debugfs_rx_filter(ar);
  	}
  
 +	tlv_filter.offset_valid = false;
- 	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
+ 	for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
  		ring_id = ar->dp.rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
  		ret = ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id,
 --- a/drivers/net/wireless/ath/ath11k/rx_desc.h
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-783-001-wifi-ath11k-Fix-BCCA-counter-for-EMA.patch b/package/kernel/mac80211/patches/nss/ath11k/999-783-001-wifi-ath11k-Fix-BCCA-counter-for-EMA.patch
index e04b01aa4d4473..54269c2dcac5b2 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-783-001-wifi-ath11k-Fix-BCCA-counter-for-EMA.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-783-001-wifi-ath11k-Fix-BCCA-counter-for-EMA.patch
@@ -20,7 +20,7 @@ Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -1594,27 +1594,6 @@ static int ath11k_mac_setup_bcn_tmpl(str
+@@ -1681,27 +1681,6 @@ static int ath11k_mac_setup_bcn_tmpl(str
  	return ath11k_mac_setup_bcn_tmpl_mbssid(arvif);
  }
  
@@ -34,7 +34,7 @@ Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
 -	if (vif->bss_conf.color_change_active &&
 -	    ieee80211_beacon_cntdwn_is_complete(vif, 0)) {
 -		arvif->bcca_zero_sent = true;
--		ieee80211_color_change_finish(vif);
+-		ieee80211_color_change_finish(vif, 0);
 -		return;
 -	}
 -
@@ -107,7 +107,7 @@ Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
 +				ieee80211_beacon_update_cntdwn(arvif->vif, 0);
 +			} else {
 +				if (bss_conf->color_change_active)
-+					ieee80211_color_change_finish(arvif->vif);
++					ieee80211_color_change_finish(arvif->vif, 0);
 +			}
 +		}
  	}
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-800-ath11k-Add-threaded-napi.patch b/package/kernel/mac80211/patches/nss/ath11k/999-800-ath11k-Add-threaded-napi.patch
index e11983a03d929c..7abc6dc66c29e2 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-800-ath11k-Add-threaded-napi.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-800-ath11k-Add-threaded-napi.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath11k/ahb.c
 +++ b/drivers/net/wireless/ath/ath11k/ahb.c
-@@ -495,8 +495,7 @@ static int ath11k_ahb_ext_grp_napi_poll(
+@@ -496,8 +496,7 @@ static int ath11k_ahb_ext_grp_napi_poll(
  	int work_done;
  
  	work_done = ath11k_dp_service_srng(ab, irq_grp, budget);
@@ -10,7 +10,7 @@
  		ath11k_ahb_ext_grp_enable(irq_grp);
  	}
  
-@@ -527,6 +526,7 @@ static int ath11k_ahb_config_ext_irq(str
+@@ -528,6 +527,7 @@ static int ath11k_ahb_config_ext_irq(str
  	int irq;
  	int ret;
  	bool nss_offload;
@@ -18,20 +18,22 @@
  
  	/* TCL Completion, REO Dest, ERR, Exception and h2rxdma rings are offloaded
  	 * to nss when its enabled, hence don't enable these interrupts
-@@ -540,8 +540,12 @@ static int ath11k_ahb_config_ext_irq(str
- 		irq_grp->ab = ab;
- 		irq_grp->grp_id = i;
- 		init_dummy_netdev(&irq_grp->napi_ndev);
-+		snprintf(irq_grp->napi_ndev.name, sizeof(irq_grp->napi_ndev.name), "%s%d:%d",
+@@ -545,9 +545,14 @@ static int ath11k_ahb_config_ext_irq(str
+ 		if (!irq_grp->napi_ndev)
+ 			return -ENOMEM;
+ 
++		snprintf(irq_grp->napi_ndev->name, sizeof(irq_grp->napi_ndev->name), "%s%d:%d",
 +			 "ath11k_ahb", devidx, i);
 +
- 		netif_napi_add(&irq_grp->napi_ndev, &irq_grp->napi,
+ 		netif_napi_add(irq_grp->napi_ndev, &irq_grp->napi,
  			       ath11k_ahb_ext_grp_napi_poll);
-+		dev_set_threaded(&irq_grp->napi_ndev, true);
  
++		dev_set_threaded(irq_grp->napi_ndev, true);
++
  		for (j = 0; j < ATH11K_EXT_IRQ_NUM_MAX; j++) {
  			if (!nss_offload && ab->hw_params.ring_mask->tx[i] & BIT(j)) {
-@@ -605,6 +609,8 @@ static int ath11k_ahb_config_ext_irq(str
+ 				irq_grp->irqs[num_irq++] =
+@@ -610,6 +615,8 @@ static int ath11k_ahb_config_ext_irq(str
  		}
  	}
  
@@ -42,7 +44,7 @@
  
 --- a/drivers/net/wireless/ath/ath11k/pcic.c
 +++ b/drivers/net/wireless/ath/ath11k/pcic.c
-@@ -516,8 +516,7 @@ static int ath11k_pcic_ext_grp_napi_poll
+@@ -517,8 +517,7 @@ static int ath11k_pcic_ext_grp_napi_poll
  	int i;
  
  	work_done = ath11k_dp_service_srng(ab, irq_grp, budget);
@@ -52,33 +54,35 @@
  		for (i = 0; i < irq_grp->num_irq; i++)
  			enable_irq(irq_grp->ab->irq_num[irq_grp->irqs[i]]);
  	}
-@@ -561,6 +560,7 @@ static int ath11k_pcic_ext_irq_config(st
- 	int i, j, ret, num_vectors = 0;
+@@ -563,6 +562,7 @@ static int ath11k_pcic_ext_irq_config(st
  	u32 user_base_data = 0, base_vector = 0;
+ 	struct ath11k_ext_irq_grp *irq_grp;
  	unsigned long irq_flags;
 +	static int devidx = 0;
  
  	ret = ath11k_pcic_get_user_msi_assignment(ab, "DP", &num_vectors,
  						  &user_base_data,
-@@ -579,8 +579,12 @@ static int ath11k_pcic_ext_irq_config(st
- 		irq_grp->ab = ab;
- 		irq_grp->grp_id = i;
- 		init_dummy_netdev(&irq_grp->napi_ndev);
-+		snprintf(irq_grp->napi_ndev.name, sizeof(irq_grp->napi_ndev.name), "%s%d:%d",
+@@ -586,9 +586,14 @@ static int ath11k_pcic_ext_irq_config(st
+ 			goto fail_allocate;
+ 		}
+ 
++		snprintf(irq_grp->napi_ndev->name, sizeof(irq_grp->napi_ndev->name), "%s%d:%d",
 +			 "ath11k_pci", devidx, i);
 +
- 		netif_napi_add(&irq_grp->napi_ndev, &irq_grp->napi,
+ 		netif_napi_add(irq_grp->napi_ndev, &irq_grp->napi,
  			       ath11k_pcic_ext_grp_napi_poll);
-+		dev_set_threaded(&irq_grp->napi_ndev, true);
  
++		dev_set_threaded(irq_grp->napi_ndev, true);
++
  		/* tcl, reo, rx_err, wbm release, rxdma rings are offloaded to nss. */
  		if (ab->nss.enabled &&
-@@ -627,6 +631,8 @@ static int ath11k_pcic_ext_irq_config(st
+ 		    !(ab->hw_params.ring_mask->reo_status[i] ||
+@@ -640,6 +645,8 @@ static int ath11k_pcic_ext_irq_config(st
  		ath11k_pcic_ext_grp_disable(irq_grp);
  	}
  
 +	devidx++;
 +
  	return 0;
- }
- 
+ fail_irq:
+ 	/* i ->napi_ndev was properly allocated. Free it also */
diff --git a/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch b/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch
index 239d52bf0a61bd..1e34e5e05a3959 100644
--- a/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch
@@ -48,23 +48,23 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  /*
   * The maximum number of IPv4 addresses listed for ARP filtering. If the number
   * of addresses for an interface increase beyond this value, hardware ARP
-@@ -703,6 +717,7 @@ struct ieee80211_fils_discovery {
-  *	beamformee
-  * @eht_mu_beamformer: in AP-mode, does this BSS enable operation as an EHT MU
-  *	beamformer
+@@ -740,6 +754,7 @@ struct ieee80211_parsed_tpe {
+  * @eht_80mhz_full_bw_ul_mumimo: in AP-mode, does this BSS support the
+  *	reception of an EHT TB PPDU on an RU that spans the entire PPDU
+  *	bandwidth
 + * @nss_ap_isolate: Used for notifying the NSS host about AP isolate feature
   */
  struct ieee80211_bss_conf {
  	struct ieee80211_vif *vif;
-@@ -795,6 +810,7 @@ struct ieee80211_bss_conf {
- 	bool eht_su_beamformer;
+@@ -834,6 +849,7 @@ struct ieee80211_bss_conf {
  	bool eht_su_beamformee;
  	bool eht_mu_beamformer;
+ 	bool eht_80mhz_full_bw_ul_mumimo;
 +	bool nss_ap_isolate;
  };
  
  /**
-@@ -1445,7 +1461,7 @@ ieee80211_tx_info_clear_status(struct ie
+@@ -1484,7 +1500,7 @@ ieee80211_tx_info_clear_status(struct ie
   * @RX_FLAG_AMPDU_EOF_BIT_KNOWN: The EOF value is known
   * @RX_FLAG_RADIOTAP_HE: HE radiotap data is present
   *	(&struct ieee80211_radiotap_he, mac80211 will fill in
@@ -108,15 +108,15 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
   */
  enum ieee80211_hw_flags {
-@@ -2847,6 +2875,7 @@ enum ieee80211_hw_flags {
- 	IEEE80211_HW_MLO_MCAST_MULTI_LINK_TX,
+@@ -2884,6 +2912,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_DISALLOW_PUNCTURING,
+ 	IEEE80211_HW_DISALLOW_PUNCTURING_5GHZ,
  	IEEE80211_HW_HANDLES_QUIET_CSA,
 +	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
  
  	/* keep last, obviously */
  	NUM_IEEE80211_HW_FLAGS
-@@ -3860,6 +3889,10 @@ struct ieee80211_prep_tx_info {
+@@ -3899,6 +3928,10 @@ struct ieee80211_prep_tx_info {
   *	non-MLO connections.
   *	The callback can sleep.
   *
@@ -150,8 +150,8 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
 --- a/net/mac80211/debugfs.c
 +++ b/net/mac80211/debugfs.c
 @@ -508,6 +508,7 @@ static const char *hw_flag_names[] = {
- 	FLAG(MLO_MCAST_MULTI_LINK_TX),
  	FLAG(DISALLOW_PUNCTURING),
+ 	FLAG(DISALLOW_PUNCTURING_5GHZ),
  	FLAG(HANDLES_QUIET_CSA),
 +	FLAG(SUPPORTS_NSS_OFFLOAD),
  #undef FLAG
diff --git a/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch b/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
index 0280f765e036dd..82fd4a6bdf2410 100644
--- a/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
@@ -70,7 +70,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
 +	if (ieee80211_hw_check(&local->hw, HAS_TX_QUEUE))
 +		return;
 +
- 	kfree(local->cvars);
+ 	kvfree(local->cvars);
  	local->cvars = NULL;
  
 @@ -1664,7 +1670,8 @@ static bool ieee80211_queue_skb(struct i

From c7edda5276fc3e3637c046db6a3569effaadcf4d Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Fri, 27 Sep 2024 15:09:45 -0400
Subject: [PATCH 170/225] ath11k_nss: Refresh patches for backports 6.11

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...th11k-fix-for-peer-memory-corruption.patch |   4 +-
 .../068-ath11k-add-rx-histogram-stats.patch   |  18 ++--
 ...69-ath11k-add-HE-stats-in-peer-stats.patch |   6 +-
 ...dma-counter-increamenting-improperly.patch |   2 +-
 ...ul-ofdma-ru-allocation-in-peer-stats.patch |  14 +--
 .../113-ath11k-add-8023-undecap-support.patch |   4 +-
 ...-adding-support-for-mgmt-frame-stats.patch |  20 ++--
 ...11k-remove-error-on-soc-debugfs-fail.patch |   2 +-
 ...91-ath11k-add-mgmt-and-data-ack-rssi.patch |   4 +-
 ...-ath11k_nss-add-nss-driver-interface.patch |  20 ++--
 .../199-003-ath11k-add-nss-support.patch      |  76 ++++++-------
 ...03-mac80211-ath11k-fw-dynamic-muedca.patch |  12 +--
 ...-ath11k-Add-support-for-dynamic-vlan.patch |   2 +-
 ...207-ath11k-Enable-256_512MB-profiles.patch |  26 ++---
 ...-support-on-NSS-offload-for-STA-mode.patch |  18 ++--
 ...14-ath11k-qos-null-frame-tx-over-wmi.patch |  46 ++++----
 ...pport-for-WDS-offload-in-NSS-offload.patch |  36 +++----
 ...-dynamic-VLAN-support-in-NSS-offload.patch |  46 ++++----
 ...ow-fast-rx-by-bypassing-stats-update.patch |   2 +-
 ...dst-ring-descriptors-from-cacheable-.patch |   8 +-
 ...ow-fast-rx-by-bypassing-stats-update.patch |  26 ++---
 .../nss/ath11k/244-ath11k-dp-tx-perf.patch    |  24 ++---
 .../300-ath11k-nss-mesh-offload-support.patch |  12 +--
 ...lookup-failure-in-mgmt-tx-completion.patch |  10 +-
 ...avoid-stack-corrupt-in-nwifi-undecap.patch |   2 +-
 ...30-ath11k-sync-wds_ast_entry-updates.patch |   8 +-
 ...-0001-ath11k-optimize-tx-completions.patch |  18 ++--
 ...se-DECLARE_BITMAP-for-idr-operations.patch |   4 +-
 ...TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch |   2 +-
 ...ing-rx-stats-with-monitor-vif-enable.patch |   8 +-
 ...rt-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch |   2 +-
 ...356-ath11k-invalid-desc-sanity-check.patch |   4 +-
 ...-fix-clear-peer-keys-during-disassoc.patch |   4 +-
 ...Add-retry-mechanism-for-update_rx_qu.patch |   4 +-
 ...ix-mutex-dead-lock-and-q6-dump-crash.patch |   2 +-
 ...agement-frames-to-firmware-before-wa.patch |   2 +-
 ...th11k-Advertise-TX_QUEUE-mac-hw-flag.patch |   2 +-
 ...oid-memset-of-ppdu-info-for-next-skb.patch |   6 +-
 ...k-make-debugfs-sta-htt-stats-modular.patch |  16 +--
 ...lock-when-accessing-idr_pool-of-tx_r.patch |   2 +-
 ...11k-Disable-rx_header-tlv-for-2K-SKB.patch |  36 +++----
 ...999-336-0001-ath11k-idr-optimization.patch |  10 +-
 .../999-336-0002-ath11k-Use-idr_replace.patch |  32 +++---
 ...k-skb_headroom-before-using-skb_push.patch |  24 ++---
 ...wifi-ath11k-Fix-BCCA-counter-for-EMA.patch |   8 +-
 ...99-802-ath11k-fixup-thermal-throttle.patch |  10 +-
 .../999-900-bss-transition-handling.patch     | 102 +++++++++---------
 ...-when-using-encapsulation-offloading.patch |   2 +-
 .../199-001-mac80211-add-nss-support.patch    |  40 +++----
 ...t-callback-when-hwencap-enable-in-st.patch |   2 +-
 ...03-mac80211-ath11k-fw-dynamic-muedca.patch |  18 ++--
 ...-ath11k-Add-support-for-dynamic-vlan.patch |   4 +-
 ...07-mac80211-add-nss-redirect-support.patch |  16 +--
 ...N-iftype-support-on-NSS-offload-case.patch |  24 ++---
 ...-dynamic-VLAN-support-on-NSS-offload.patch |   6 +-
 .../nss/subsys/245-compilation_fix.patch      |  12 +--
 .../300-ath11k-nss-mesh-offload-support.patch |  44 ++++----
 ...TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch |   4 +-
 ...-0005-mac80211-simple-tx-for-AP-mode.patch |   4 +-
 .../336-mac80211-Mesh-Fast-rx-support.patch   |  14 +--
 ...mac80211-fix-unconditional-sta-usage.patch |   4 +-
 ...rning-with-monitor-interface-restart.patch |   2 +-
 ...unused-RX_FLAGS-from-mac80211_rx_fla.patch |   4 +-
 ...ncapsulation-of-EAPOL-frames-if-OFFL.patch |  26 ++---
 ...fix-RCU-stall-in-mesh-fast-xmit-path.patch |   2 +-
 ...id-last_rate-for-rx_bitrate-from-cpu.patch |  10 +-
 ...se-HW-checksum-offload-only-for-ethm.patch |  12 +--
 ...1-Add-mac-hw-flag-to-avoid-queue-skb.patch |  26 ++---
 .../829-mac80211-fix-mesh-ping-issue.patch    |   8 +-
 ...x-memory-corruption-during-mesh-beac.patch |   2 +-
 ...R-for-association-failure-issue-with.patch |   2 +-
 ...ac80211-ath10k-fix-airtime-underflow.patch |   2 +-
 ...75-wifi-mac80211-Changes-for-WDS-MLD.patch |  22 ++--
 73 files changed, 529 insertions(+), 529 deletions(-)

diff --git a/package/kernel/mac80211/patches/nss/ath11k/033-ath11k-fix-for-peer-memory-corruption.patch b/package/kernel/mac80211/patches/nss/ath11k/033-ath11k-fix-for-peer-memory-corruption.patch
index a537d85cd1e0ef..6764ffbcebc26d 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/033-ath11k-fix-for-peer-memory-corruption.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/033-ath11k-fix-for-peer-memory-corruption.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -4186,22 +4186,28 @@ static int ath11k_clear_peer_keys(struct
+@@ -4275,22 +4275,28 @@ static int ath11k_clear_peer_keys(struct
  	int ret;
  	int i;
  	u32 flags = 0;
@@ -35,7 +35,7 @@
  					 DISABLE_KEY, addr, flags);
  		if (ret < 0 && first_errno == 0)
  			first_errno = ret;
-@@ -4209,10 +4215,6 @@ static int ath11k_clear_peer_keys(struct
+@@ -4298,10 +4304,6 @@ static int ath11k_clear_peer_keys(struct
  		if (ret < 0)
  			ath11k_warn(ab, "failed to remove peer key %d: %d\n",
  				    i, ret);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/068-ath11k-add-rx-histogram-stats.patch b/package/kernel/mac80211/patches/nss/ath11k/068-ath11k-add-rx-histogram-stats.patch
index 35a07b9e4055e5..068511ab0e5c4b 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/068-ath11k-add-rx-histogram-stats.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/068-ath11k-add-rx-histogram-stats.patch
@@ -29,7 +29,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  
  /* SMBIOS type containing Board Data File Name Extension */
  #define ATH11K_SMBIOS_BDF_EXT_TYPE 0xF8
-@@ -415,6 +417,17 @@ struct ath11k_vif_iter {
+@@ -418,6 +420,17 @@ struct ath11k_vif_iter {
  	struct ath11k_vif *arvif;
  };
  
@@ -47,7 +47,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  struct ath11k_rx_peer_stats {
  	u64 num_msdu;
  	u64 num_mpdu_fcs_ok;
-@@ -426,10 +439,6 @@ struct ath11k_rx_peer_stats {
+@@ -429,10 +442,6 @@ struct ath11k_rx_peer_stats {
  	u64 non_ampdu_msdu_count;
  	u64 stbc_count;
  	u64 beamformed_count;
@@ -58,7 +58,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  	u64 coding_count[HAL_RX_SU_MU_CODING_MAX];
  	u64 tid_count[IEEE80211_NUM_TIDS + 1];
  	u64 pream_cnt[HAL_RX_PREAMBLE_MAX];
-@@ -437,6 +446,8 @@ struct ath11k_rx_peer_stats {
+@@ -440,6 +449,8 @@ struct ath11k_rx_peer_stats {
  	u64 rx_duration;
  	u64 dcm_count;
  	u64 ru_alloc_cnt[HAL_RX_RU_ALLOC_TYPE_MAX];
@@ -269,7 +269,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  			    &fops_htt_peer_stats);
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -2763,10 +2763,43 @@ exit:
+@@ -2762,10 +2762,43 @@ exit:
  	return total_msdu_reaped;
  }
  
@@ -313,7 +313,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  	u32 num_msdu;
  	int i;
  
-@@ -2776,6 +2809,8 @@ static void ath11k_dp_rx_update_peer_sta
+@@ -2775,6 +2808,8 @@ static void ath11k_dp_rx_update_peer_sta
  	arsta->rssi_comb = ppdu_info->rssi_comb;
  	ewma_avg_rssi_add(&arsta->avg_rssi, ppdu_info->rssi_comb);
  
@@ -322,7 +322,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  	num_msdu = ppdu_info->tcp_msdu_count + ppdu_info->tcp_ack_msdu_count +
  		   ppdu_info->udp_msdu_count + ppdu_info->other_msdu_count;
  
-@@ -2792,18 +2827,6 @@ static void ath11k_dp_rx_update_peer_sta
+@@ -2791,18 +2826,6 @@ static void ath11k_dp_rx_update_peer_sta
  		ppdu_info->tid = IEEE80211_NUM_TIDS;
  	}
  
@@ -341,7 +341,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  	if (ppdu_info->ldpc < HAL_RX_SU_MU_CODING_MAX)
  		rx_stats->coding_count[ppdu_info->ldpc] += num_msdu;
  
-@@ -2832,8 +2855,6 @@ static void ath11k_dp_rx_update_peer_sta
+@@ -2831,8 +2854,6 @@ static void ath11k_dp_rx_update_peer_sta
  	rx_stats->dcm_count += ppdu_info->dcm;
  	rx_stats->ru_alloc_cnt[ppdu_info->ru_alloc] += num_msdu;
  
@@ -350,7 +350,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  	BUILD_BUG_ON(ARRAY_SIZE(arsta->chain_signal) >
  			     ARRAY_SIZE(ppdu_info->rssi_chain_pri20));
  
-@@ -2842,6 +2863,52 @@ static void ath11k_dp_rx_update_peer_sta
+@@ -2841,6 +2862,52 @@ static void ath11k_dp_rx_update_peer_sta
  
  	rx_stats->rx_duration += ppdu_info->rx_duration;
  	arsta->rx_duration = rx_stats->rx_duration;
@@ -405,7 +405,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  static struct sk_buff *ath11k_dp_rx_alloc_mon_status_buf(struct ath11k_base *ab,
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.h
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.h
-@@ -41,6 +41,25 @@ struct ath11k_dp_rfc1042_hdr {
+@@ -42,6 +42,25 @@ struct ath11k_dp_rfc1042_hdr {
  	__be16 snap_type;
  } __packed;
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/069-ath11k-add-HE-stats-in-peer-stats.patch b/package/kernel/mac80211/patches/nss/ath11k/069-ath11k-add-HE-stats-in-peer-stats.patch
index 13c87a0470c9a6..e121c48a18726a 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/069-ath11k-add-HE-stats-in-peer-stats.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/069-ath11k-add-HE-stats-in-peer-stats.patch
@@ -23,7 +23,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  #include "fw.h"
  
  #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
-@@ -508,6 +509,8 @@ struct ath11k_htt_data_stats {
+@@ -511,6 +512,8 @@ struct ath11k_htt_data_stats {
  	u64 bw[ATH11K_COUNTER_TYPE_MAX][ATH11K_BW_NUM];
  	u64 nss[ATH11K_COUNTER_TYPE_MAX][ATH11K_NSS_NUM];
  	u64 gi[ATH11K_COUNTER_TYPE_MAX][ATH11K_GI_NUM];
@@ -32,7 +32,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  };
  
  struct ath11k_htt_tx_stats {
-@@ -515,6 +518,9 @@ struct ath11k_htt_tx_stats {
+@@ -518,6 +521,9 @@ struct ath11k_htt_tx_stats {
  	u64 tx_duration;
  	u64 ba_fails;
  	u64 ack_fails;
@@ -42,7 +42,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  };
  
  struct ath11k_per_ppdu_tx_stats {
-@@ -631,11 +637,16 @@ struct ath11k_per_peer_tx_stats {
+@@ -634,11 +640,16 @@ struct ath11k_per_peer_tx_stats {
  	u32 succ_bytes;
  	u32 retry_bytes;
  	u32 failed_bytes;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/087-ath11k-fix-ul-ofdma-counter-increamenting-improperly.patch b/package/kernel/mac80211/patches/nss/ath11k/087-ath11k-fix-ul-ofdma-counter-increamenting-improperly.patch
index 706082dc5119e4..2a98923fa46254 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/087-ath11k-fix-ul-ofdma-counter-increamenting-improperly.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/087-ath11k-fix-ul-ofdma-counter-increamenting-improperly.patch
@@ -5,7 +5,7 @@
 
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -5452,8 +5452,11 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -5515,8 +5515,11 @@ int ath11k_dp_rx_process_mon_status(stru
  			goto next_skb;
  		}
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/108-ath11k-enable-ul-ofdma-ru-allocation-in-peer-stats.patch b/package/kernel/mac80211/patches/nss/ath11k/108-ath11k-enable-ul-ofdma-ru-allocation-in-peer-stats.patch
index 3406836981d920..ce57ea9aed2ec6 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/108-ath11k-enable-ul-ofdma-ru-allocation-in-peer-stats.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/108-ath11k-enable-ul-ofdma-ru-allocation-in-peer-stats.patch
@@ -15,7 +15,7 @@
  
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -2902,11 +2902,12 @@ exit:
+@@ -2901,11 +2901,12 @@ exit:
  static void
  ath11k_dp_rx_update_peer_rate_table_stats(struct ath11k_rx_peer_stats *rx_stats,
  					  struct hal_rx_mon_ppdu_info *ppdu_info,
@@ -30,7 +30,7 @@
  	u32 bw_idx = ppdu_info->bw;
  	u32 gi_idx = ppdu_info->gi;
  
-@@ -2928,10 +2929,13 @@ ath11k_dp_rx_update_peer_rate_table_stat
+@@ -2927,10 +2928,13 @@ ath11k_dp_rx_update_peer_rate_table_stat
  	}
  
  	rx_stats->pkt_stats.rx_rate[rate_idx] += num_msdu;
@@ -46,7 +46,7 @@
  					   struct hal_rx_mon_ppdu_info *ppdu_info)
  {
  	struct ath11k_rx_peer_stats *rx_stats = arsta->rx_stats;
-@@ -2989,7 +2993,6 @@ static void ath11k_dp_rx_update_peer_sta
+@@ -2988,7 +2992,6 @@ static void ath11k_dp_rx_update_peer_sta
  	rx_stats->num_mpdu_fcs_ok += ppdu_info->num_mpdu_fcs_ok;
  	rx_stats->num_mpdu_fcs_err += ppdu_info->num_mpdu_fcs_err;
  	rx_stats->dcm_count += ppdu_info->dcm;
@@ -54,7 +54,7 @@
  
  	BUILD_BUG_ON(ARRAY_SIZE(arsta->chain_signal) >
  			     ARRAY_SIZE(ppdu_info->rssi_chain_pri20));
-@@ -3007,10 +3010,10 @@ static void ath11k_dp_rx_update_peer_sta
+@@ -3006,10 +3009,10 @@ static void ath11k_dp_rx_update_peer_sta
  
  	if (ppdu_info->preamble_type == HAL_RX_PREAMBLE_11N &&
  	    ppdu_info->mcs <= HAL_RX_MAX_MCS_HT) {
@@ -69,7 +69,7 @@
  	}
  
  	if (ppdu_info->preamble_type == HAL_RX_PREAMBLE_11AC &&
-@@ -3043,7 +3046,120 @@ static void ath11k_dp_rx_update_peer_sta
+@@ -3042,7 +3045,120 @@ static void ath11k_dp_rx_update_peer_sta
  		rx_stats->byte_stats.bw_count[ppdu_info->bw] += ppdu_info->mpdu_len;
  	}
  
@@ -191,7 +191,7 @@
  
  }
  
-@@ -5381,6 +5497,55 @@ static void ath11k_dp_rx_mon_dest_proces
+@@ -5444,6 +5560,55 @@ static void ath11k_dp_rx_mon_dest_proces
  	}
  }
  
@@ -247,7 +247,7 @@
  int ath11k_dp_rx_process_mon_status(struct ath11k_base *ab, int mac_id,
  				    struct napi_struct *napi, int budget)
  {
-@@ -5454,8 +5619,13 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -5517,8 +5682,13 @@ int ath11k_dp_rx_process_mon_status(stru
  
  		if ((ppdu_info->fc_valid) &&
  		    (ppdu_info->ast_index != HAL_AST_IDX_INVALID)) {
diff --git a/package/kernel/mac80211/patches/nss/ath11k/113-ath11k-add-8023-undecap-support.patch b/package/kernel/mac80211/patches/nss/ath11k/113-ath11k-add-8023-undecap-support.patch
index c08aa58c8c64e9..2ba2411c3ef54b 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/113-ath11k-add-8023-undecap-support.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/113-ath11k-add-8023-undecap-support.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -2306,6 +2306,42 @@ static void ath11k_dp_rx_h_undecap_eth(s
+@@ -2305,6 +2305,42 @@ static void ath11k_dp_rx_h_undecap_eth(s
  	ether_addr_copy(ieee80211_get_SA(hdr), sa);
  }
  
@@ -43,7 +43,7 @@
  static void ath11k_dp_rx_h_undecap(struct ath11k *ar, struct sk_buff *msdu,
  				   struct hal_rx_desc *rx_desc,
  				   enum hal_encrypt_type enctype,
-@@ -2347,7 +2383,8 @@ static void ath11k_dp_rx_h_undecap(struc
+@@ -2346,7 +2382,8 @@ static void ath11k_dp_rx_h_undecap(struc
  						   enctype, status);
  		break;
  	case DP_RX_DECAP_TYPE_8023:
diff --git a/package/kernel/mac80211/patches/nss/ath11k/142-ath11k-adding-support-for-mgmt-frame-stats.patch b/package/kernel/mac80211/patches/nss/ath11k/142-ath11k-adding-support-for-mgmt-frame-stats.patch
index d6b94cdde10b0c..78556e5f15c64f 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/142-ath11k-adding-support-for-mgmt-frame-stats.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/142-ath11k-adding-support-for-mgmt-frame-stats.patch
@@ -16,8 +16,8 @@
  
  #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
  
-@@ -355,6 +355,16 @@ struct ath11k_reg_tpc_power_info {
- 	struct ath11k_chan_power_info chan_power_info[IEEE80211_MAX_NUM_PWR_LEVEL];
+@@ -358,6 +358,16 @@ struct ath11k_reg_tpc_power_info {
+ 	struct ath11k_chan_power_info chan_power_info[ATH11K_NUM_PWR_LEVELS];
  };
  
 +#define ATH11K_STATS_MGMT_FRM_TYPE_MAX 16
@@ -33,7 +33,7 @@
  struct ath11k_vif {
  	u32 vdev_id;
  	enum wmi_vdev_type vdev_type;
-@@ -411,6 +421,7 @@ struct ath11k_vif {
+@@ -414,6 +424,7 @@ struct ath11k_vif {
  	struct ath11k_rekey_data rekey_data;
  
  	struct ath11k_reg_tpc_power_info reg_tpc_info;
@@ -143,7 +143,7 @@
  		debugfs_create_file("dfs_simulate_radar", 0200,
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -5934,9 +5934,9 @@ static int ath11k_mac_mgmt_tx(struct ath
+@@ -6031,9 +6031,9 @@ static int ath11k_mac_mgmt_tx(struct ath
  	 */
  	if (is_prb_rsp &&
  	    atomic_read(&ar->num_pending_mgmt_tx) > ATH11K_PRB_RSP_DROP_THRESHOLD) {
@@ -155,7 +155,7 @@
  	}
  
  	if (skb_queue_len_lockless(q) >= ATH11K_TX_MGMT_NUM_PENDING_MAX) {
-@@ -5962,9 +5962,11 @@ static void ath11k_mac_op_tx(struct ieee
+@@ -6059,9 +6059,11 @@ static void ath11k_mac_op_tx(struct ieee
  	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
  	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
  	struct ieee80211_key_conf *key = info->control.hw_key;
@@ -167,7 +167,7 @@
  	int ret;
  
  	memset(skb_cb, 0, sizeof(*skb_cb));
-@@ -5978,12 +5980,21 @@ static void ath11k_mac_op_tx(struct ieee
+@@ -6075,12 +6077,21 @@ static void ath11k_mac_op_tx(struct ieee
  	if (info_flags & IEEE80211_TX_CTL_HW_80211_ENCAP) {
  		skb_cb->flags |= ATH11K_SKB_HW_80211_ENCAP;
  	} else if (ieee80211_is_mgmt(hdr->frame_control)) {
@@ -213,7 +213,7 @@
  	int peer_id;
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
-@@ -5896,6 +5896,12 @@ static int wmi_process_mgmt_tx_comp(stru
+@@ -5941,6 +5941,12 @@ static int wmi_process_mgmt_tx_comp(stru
  	struct sk_buff *msdu;
  	struct ieee80211_tx_info *info;
  	struct ath11k_skb_cb *skb_cb;
@@ -226,7 +226,7 @@
  	int num_mgmt;
  
  	spin_lock_bh(&ar->txmgmt_idr_lock);
-@@ -5923,6 +5929,31 @@ static int wmi_process_mgmt_tx_comp(stru
+@@ -5968,6 +5974,31 @@ static int wmi_process_mgmt_tx_comp(stru
  			info->status.ack_signal = tx_compl_param->ack_rssi;
  	}
  
@@ -258,7 +258,7 @@
  	ieee80211_tx_status_irqsafe(ar->hw, msdu);
  
  	num_mgmt = atomic_dec_if_positive(&ar->num_pending_mgmt_tx);
-@@ -7500,6 +7531,11 @@ static void ath11k_mgmt_rx_event(struct
+@@ -7545,6 +7576,11 @@ static void ath11k_mgmt_rx_event(struct
  	struct ieee80211_hdr *hdr;
  	u16 fc;
  	struct ieee80211_supported_band *sband;
@@ -270,7 +270,7 @@
  
  	if (ath11k_pull_mgmt_rx_params_tlv(ab, skb, &rx_ev) != 0) {
  		ath11k_warn(ab, "failed to extract mgmt rx event");
-@@ -7565,7 +7601,34 @@ static void ath11k_mgmt_rx_event(struct
+@@ -7610,7 +7646,34 @@ static void ath11k_mgmt_rx_event(struct
  
  	hdr = (struct ieee80211_hdr *)skb->data;
  	fc = le16_to_cpu(hdr->frame_control);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/181-ath11k-remove-error-on-soc-debugfs-fail.patch b/package/kernel/mac80211/patches/nss/ath11k/181-ath11k-remove-error-on-soc-debugfs-fail.patch
index 0e46d98da442b5..05055586ccea73 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/181-ath11k-remove-error-on-soc-debugfs-fail.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/181-ath11k-remove-error-on-soc-debugfs-fail.patch
@@ -34,7 +34,7 @@ Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
-@@ -2294,5 +2294,17 @@ err_sc_free:
+@@ -2303,5 +2303,17 @@ err_sc_free:
  }
  EXPORT_SYMBOL(ath11k_core_alloc);
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/191-ath11k-add-mgmt-and-data-ack-rssi.patch b/package/kernel/mac80211/patches/nss/ath11k/191-ath11k-add-mgmt-and-data-ack-rssi.patch
index 35d05f1b687ccc..2261d86b2fabb0 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/191-ath11k-add-mgmt-and-data-ack-rssi.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/191-ath11k-add-mgmt-and-data-ack-rssi.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -10159,6 +10159,8 @@ static int __ath11k_mac_register(struct
+@@ -10199,6 +10199,8 @@ static int __ath11k_mac_register(struct
  		wiphy_ext_feature_set(ar->hw->wiphy,
  				      NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
  
@@ -11,7 +11,7 @@
  	ar->hw->offchannel_tx_hw_queue = ATH11K_HW_MAX_QUEUES - 1;
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
-@@ -4128,6 +4128,7 @@ ath11k_wmi_copy_resource_config(struct w
+@@ -4173,6 +4173,7 @@ ath11k_wmi_copy_resource_config(struct w
  	wmi_cfg->max_bssid_rx_filters = tg_cfg->max_bssid_rx_filters;
  	wmi_cfg->use_pdev_id = tg_cfg->use_pdev_id;
  	wmi_cfg->flag1 = tg_cfg->flag1;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/199-002-ath11k_nss-add-nss-driver-interface.patch b/package/kernel/mac80211/patches/nss/ath11k/199-002-ath11k_nss-add-nss-driver-interface.patch
index 11badcab663f24..35f5af2e4e4913 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/199-002-ath11k_nss-add-nss-driver-interface.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/199-002-ath11k_nss-add-nss-driver-interface.patch
@@ -38,7 +38,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	depends on m
 --- a/drivers/net/wireless/ath/ath11k/Makefile
 +++ b/drivers/net/wireless/ath/ath11k/Makefile
-@@ -26,6 +26,7 @@ ath11k-$(CPTCFG_ATH11K_TRACING) += trace
+@@ -27,6 +27,7 @@ ath11k-$(CPTCFG_ATH11K_TRACING) += trace
  ath11k-$(CPTCFG_ATH11K_THERMAL) += thermal.o
  ath11k-$(CPTCFG_ATH11K_SPECTRAL) += spectral.o
  ath11k-$(CONFIG_PM) += wow.o
@@ -2848,7 +2848,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  			     enum hal_pn_type pn_type)
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
-@@ -1164,6 +1164,44 @@ int ath11k_wmi_send_pdev_set_regdomain(s
+@@ -1169,6 +1169,44 @@ int ath11k_wmi_send_pdev_set_regdomain(s
  	return ret;
  }
  
@@ -2895,7 +2895,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  {
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
-@@ -2894,6 +2894,27 @@ struct pdev_set_regdomain_params {
+@@ -2890,6 +2890,27 @@ struct pdev_set_regdomain_params {
  	u32 pdev_id;
  };
  
@@ -2923,7 +2923,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  struct rx_reorder_queue_remove_params {
  	u8 *peer_macaddr;
  	u16 vdev_id;
-@@ -3142,6 +3163,16 @@ struct wmi_pdev_set_regdomain_cmd {
+@@ -3138,6 +3159,16 @@ struct wmi_pdev_set_regdomain_cmd {
  	u32 dfs_domain;
  } __packed;
  
@@ -2940,7 +2940,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  struct wmi_peer_set_param_cmd {
  	u32 tlv_header;
  	u32 vdev_id;
-@@ -6384,6 +6415,8 @@ int ath11k_wmi_send_peer_create_cmd(stru
+@@ -6390,6 +6421,8 @@ int ath11k_wmi_send_peer_create_cmd(stru
  int ath11k_wmi_vdev_set_param_cmd(struct ath11k *ar, u32 vdev_id,
  				  u32 param_id, u32 param_value);
  
@@ -2951,7 +2951,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  int ath11k_wmi_force_fw_hang_cmd(struct ath11k *ar, u32 type, u32 delay_time_ms);
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.h
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.h
-@@ -20,6 +20,34 @@
+@@ -21,6 +21,34 @@
  #define DP_RX_MPDU_ERR_MPDU_LEN			BIT(6)
  #define DP_RX_MPDU_ERR_UNENCRYPTED_FRAME	BIT(7)
  
@@ -2986,7 +2986,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  enum dp_rx_decap_type {
  	DP_RX_DECAP_TYPE_RAW,
  	DP_RX_DECAP_TYPE_NATIVE_WIFI,
-@@ -75,6 +103,9 @@ void ath11k_peer_rx_tid_delete(struct at
+@@ -76,6 +104,9 @@ void ath11k_peer_rx_tid_delete(struct at
  int ath11k_peer_rx_tid_setup(struct ath11k *ar, const u8 *peer_mac, int vdev_id,
  			     u8 tid, u32 ba_win_sz, u16 ssn,
  			     enum hal_pn_type pn_type);
@@ -2998,7 +2998,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  int ath11k_dp_pdev_reo_setup(struct ath11k_base *ab);
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -6153,6 +6153,16 @@ static int ath11k_mac_op_start(struct ie
+@@ -6250,6 +6250,16 @@ static int ath11k_mac_op_start(struct ie
  		goto err;
  	}
  
@@ -3017,7 +3017,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	/* TODO: Do we need to enable ANI? */
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -887,6 +887,8 @@ struct ath11k_soc_dp_tx_err_stats {
+@@ -890,6 +890,8 @@ struct ath11k_soc_dp_tx_err_stats {
  	 * idr unavailable etc.
  	 */
  	atomic_t misc_fail;
@@ -3026,7 +3026,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  };
  
  struct ath11k_soc_dp_stats {
-@@ -973,6 +975,7 @@ struct ath11k_base {
+@@ -976,6 +978,7 @@ struct ath11k_base {
  	struct list_head peers;
  	wait_queue_head_t peer_mapping_wq;
  	u8 mac_addr[ETH_ALEN];
diff --git a/package/kernel/mac80211/patches/nss/ath11k/199-003-ath11k-add-nss-support.patch b/package/kernel/mac80211/patches/nss/ath11k/199-003-ath11k-add-nss-support.patch
index 691f8f6718c463..040db3c68f5718 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/199-003-ath11k-add-nss-support.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/199-003-ath11k-add-nss-support.patch
@@ -24,7 +24,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/ahb.c
 +++ b/drivers/net/wireless/ath/ath11k/ahb.c
-@@ -526,6 +526,12 @@ static int ath11k_ahb_config_ext_irq(str
+@@ -527,6 +527,12 @@ static int ath11k_ahb_config_ext_irq(str
  	int i, j;
  	int irq;
  	int ret;
@@ -37,7 +37,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	for (i = 0; i < ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {
  		struct ath11k_ext_irq_grp *irq_grp = &ab->ext_irq_grp[i];
-@@ -538,20 +544,20 @@ static int ath11k_ahb_config_ext_irq(str
+@@ -543,20 +549,20 @@ static int ath11k_ahb_config_ext_irq(str
  			       ath11k_ahb_ext_grp_napi_poll);
  
  		for (j = 0; j < ATH11K_EXT_IRQ_NUM_MAX; j++) {
@@ -62,7 +62,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  				irq_grp->irqs[num_irq++] = wbm2host_rx_release;
  
  			if (ab->hw_params.ring_mask->reo_status[i] & BIT(j))
-@@ -564,7 +570,7 @@ static int ath11k_ahb_config_ext_irq(str
+@@ -569,7 +575,7 @@ static int ath11k_ahb_config_ext_irq(str
  						ath11k_hw_get_mac_from_pdev_id(hw, j);
  				}
  
@@ -71,7 +71,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  					irq_grp->irqs[num_irq++] =
  						host2rxdma_host_buf_ring_mac1 -
  						ath11k_hw_get_mac_from_pdev_id(hw, j);
-@@ -905,6 +911,7 @@ static int ath11k_ahb_setup_resources(st
+@@ -910,6 +916,7 @@ static int ath11k_ahb_setup_resources(st
  	}
  
  	ab->mem = mem;
@@ -94,7 +94,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  unsigned int ath11k_debug_mask;
  EXPORT_SYMBOL(ath11k_debug_mask);
  module_param_named(debug_mask, ath11k_debug_mask, uint, 0644);
-@@ -1624,10 +1630,16 @@ static int ath11k_core_pdev_create(struc
+@@ -1636,10 +1642,16 @@ static int ath11k_core_pdev_create(struc
  		goto err_pdev_debug;
  	}
  
@@ -112,7 +112,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	}
  
  	ret = ath11k_thermal_register(ab);
-@@ -1649,6 +1661,8 @@ err_thermal_unregister:
+@@ -1661,6 +1673,8 @@ err_thermal_unregister:
  	ath11k_thermal_unregister(ab);
  err_mac_unregister:
  	ath11k_mac_unregister(ab);
@@ -121,7 +121,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  err_dp_pdev_free:
  	ath11k_dp_pdev_free(ab);
  err_pdev_debug:
-@@ -1662,6 +1676,10 @@ static void ath11k_core_pdev_destroy(str
+@@ -1674,6 +1688,10 @@ static void ath11k_core_pdev_destroy(str
  	ath11k_spectral_deinit(ab);
  	ath11k_thermal_unregister(ab);
  	ath11k_mac_unregister(ab);
@@ -132,7 +132,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	ath11k_hif_irq_disable(ab);
  	ath11k_dp_pdev_free(ab);
  	ath11k_debugfs_pdev_destroy(ab);
-@@ -1868,6 +1886,10 @@ static int ath11k_core_reconfigure_on_cr
+@@ -1880,6 +1898,10 @@ static int ath11k_core_reconfigure_on_cr
  	int ret;
  
  	mutex_lock(&ab->core_lock);
@@ -143,7 +143,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	ath11k_thermal_unregister(ab);
  	ath11k_dp_pdev_free(ab);
  	ath11k_spectral_deinit(ab);
-@@ -2199,6 +2221,10 @@ int ath11k_core_pre_init(struct ath11k_b
+@@ -2208,6 +2230,10 @@ int ath11k_core_pre_init(struct ath11k_b
  		ath11k_err(ab, "failed to pre init firmware: %d", ret);
  		return ret;
  	}
@@ -164,7 +164,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
  
-@@ -422,6 +423,9 @@ struct ath11k_vif {
+@@ -425,6 +426,9 @@ struct ath11k_vif {
  
  	struct ath11k_reg_tpc_power_info reg_tpc_info;
  	struct ath11k_mgmt_frame_stats mgmt_stats;
@@ -174,7 +174,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  };
  
  struct ath11k_vif_iter {
-@@ -575,6 +579,9 @@ struct ath11k_sta {
+@@ -578,6 +582,9 @@ struct ath11k_sta {
  #endif
  
  	bool use_4addr_set;
@@ -184,7 +184,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	u16 tcl_metadata;
  
  	/* Protected with ar->data_lock */
-@@ -669,6 +676,9 @@ struct ath11k {
+@@ -672,6 +679,9 @@ struct ath11k {
  	struct ath11k_pdev *pdev;
  	struct ieee80211_hw *hw;
  	struct ath11k_pdev_wmi *wmi;
@@ -194,7 +194,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	struct ath11k_pdev_dp dp;
  	u8 mac_addr[ETH_ALEN];
  	struct ath11k_he ar_he;
-@@ -930,9 +940,11 @@ struct ath11k_base {
+@@ -933,9 +943,11 @@ struct ath11k_base {
  	struct ath11k_htc htc;
  
  	struct ath11k_dp dp;
@@ -366,7 +366,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  					 enum hal_encrypt_type enctype)
  {
  	switch (enctype) {
-@@ -2091,7 +2094,7 @@ static int ath11k_dp_rx_crypto_param_len
+@@ -2090,7 +2093,7 @@ static int ath11k_dp_rx_crypto_param_len
  	return 0;
  }
  
@@ -375,7 +375,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  				       enum hal_encrypt_type enctype)
  {
  	switch (enctype) {
-@@ -2827,6 +2830,22 @@ static void ath11k_dp_rx_process_receive
+@@ -2826,6 +2829,22 @@ static void ath11k_dp_rx_process_receive
  	}
  }
  
@@ -398,7 +398,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  int ath11k_dp_process_rx(struct ath11k_base *ab, int ring_id,
  			 struct napi_struct *napi, int budget)
  {
-@@ -3126,7 +3145,8 @@ static void ath11k_dp_rx_update_user_sta
+@@ -3125,7 +3144,8 @@ static void ath11k_dp_rx_update_user_sta
  	peer = ath11k_peer_find_by_ast(ar->ab, user_stats->ast_index);
  
  	if (peer == NULL) {
@@ -408,7 +408,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  			    user_stats->ast_index);
  		return;
  	}
-@@ -3134,6 +3154,13 @@ static void ath11k_dp_rx_update_user_sta
+@@ -3133,6 +3153,13 @@ static void ath11k_dp_rx_update_user_sta
  	arsta = (struct ath11k_sta *)peer->sta->drv_priv;
  	rx_stats = arsta->rx_stats;
  
@@ -422,7 +422,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	if (!rx_stats)
  		return;
  
-@@ -3210,8 +3237,10 @@ static void ath11k_dp_rx_update_peer_mu_
+@@ -3209,8 +3236,10 @@ static void ath11k_dp_rx_update_peer_mu_
  {
  	u32 num_users, i;
  
@@ -434,7 +434,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	num_users = ppdu_info->num_users;
  	if (num_users > HAL_MAX_UL_MU_USERS)
-@@ -5614,7 +5643,7 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -5677,7 +5706,7 @@ int ath11k_dp_rx_process_mon_status(stru
  	struct sk_buff *skb;
  	struct sk_buff_head skb_list;
  	struct ath11k_peer *peer;
@@ -443,7 +443,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	int num_buffs_reaped = 0;
  	u32 rx_buf_sz;
  	u16 log_type;
-@@ -5682,6 +5711,7 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -5745,6 +5774,7 @@ int ath11k_dp_rx_process_mon_status(stru
  			if (ppdu_info->reception_type == HAL_RX_RECEPTION_TYPE_SU) {
  				arsta = (struct ath11k_sta *)peer->sta->drv_priv;
  				ath11k_dp_rx_update_peer_su_stats(arsta, ppdu_info);
@@ -506,7 +506,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  #define CHAN2G(_channel, _freq, _flags) { \
  	.band                   = NL80211_BAND_2GHZ, \
-@@ -1593,6 +1594,11 @@ static void ath11k_control_beaconing(str
+@@ -1680,6 +1681,11 @@ static void ath11k_control_beaconing(str
  	lockdep_assert_held(&arvif->ar->conf_mutex);
  
  	if (!info->enable_beacon) {
@@ -518,7 +518,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		ret = ath11k_wmi_vdev_down(ar, arvif->vdev_id);
  		if (ret)
  			ath11k_warn(ar->ab, "failed to down vdev_id %i: %d\n",
-@@ -1632,6 +1638,12 @@ static void ath11k_control_beaconing(str
+@@ -1719,6 +1725,12 @@ static void ath11k_control_beaconing(str
  
  	arvif->is_up = true;
  
@@ -531,7 +531,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "vdev %d up\n", arvif->vdev_id);
  }
  
-@@ -3070,6 +3082,12 @@ static void ath11k_bss_assoc(struct ieee
+@@ -3157,6 +3169,12 @@ static void ath11k_bss_assoc(struct ieee
  		   "vdev %d up (associated) bssid %pM aid %d\n",
  		   arvif->vdev_id, bss_conf->bssid, vif->cfg.aid);
  
@@ -544,7 +544,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	spin_lock_bh(&ar->ab->base_lock);
  
  	peer = ath11k_peer_find(ar->ab, arvif->vdev_id, arvif->bssid);
-@@ -3112,6 +3130,10 @@ static void ath11k_bss_disassoc(struct i
+@@ -3199,6 +3217,10 @@ static void ath11k_bss_disassoc(struct i
  
  	lockdep_assert_held(&ar->conf_mutex);
  
@@ -555,7 +555,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "vdev %i disassoc bssid %pM\n",
  		   arvif->vdev_id, arvif->bssid);
  
-@@ -3404,6 +3426,28 @@ static bool ath11k_mac_supports_station_
+@@ -3491,6 +3513,28 @@ static bool ath11k_mac_supports_station_
  		chandef->chan->band == NL80211_BAND_6GHZ;
  }
  
@@ -584,7 +584,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  static void ath11k_mac_op_bss_info_changed(struct ieee80211_hw *hw,
  					   struct ieee80211_vif *vif,
  					   struct ieee80211_bss_conf *info,
-@@ -4303,6 +4347,26 @@ static int ath11k_mac_op_set_key(struct
+@@ -4392,6 +4436,26 @@ static int ath11k_mac_op_set_key(struct
  
  	spin_lock_bh(&ab->base_lock);
  	peer = ath11k_peer_find(ab, arvif->vdev_id, peer_addr);
@@ -611,7 +611,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	if (peer && cmd == SET_KEY) {
  		peer->keys[key->keyidx] = key;
  		if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
-@@ -4341,9 +4405,8 @@ static int ath11k_mac_op_set_key(struct
+@@ -4430,9 +4494,8 @@ static int ath11k_mac_op_set_key(struct
  			break;
  		}
  	}
@@ -622,7 +622,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  exit:
  	mutex_unlock(&ar->conf_mutex);
  	return ret;
-@@ -6002,10 +6065,14 @@ static void ath11k_mac_op_tx(struct ieee
+@@ -6099,10 +6162,14 @@ static void ath11k_mac_op_tx(struct ieee
  	if (control->sta)
  		arsta = ath11k_sta_to_arsta(control->sta);
  
@@ -638,7 +638,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	}
  }
  
-@@ -6027,6 +6094,8 @@ static int ath11k_mac_config_mon_status_
+@@ -6124,6 +6191,8 @@ static int ath11k_mac_config_mon_status_
  
  	if (enable) {
  		tlv_filter = ath11k_mac_mon_status_filter_default;
@@ -647,7 +647,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		if (ath11k_debugfs_rx_filter(ar))
  			tlv_filter.rx_filter = ath11k_debugfs_rx_filter(ar);
  	}
-@@ -6325,7 +6394,7 @@ static int ath11k_mac_setup_vdev_create_
+@@ -6422,7 +6491,7 @@ static int ath11k_mac_setup_vdev_create_
  	return 0;
  }
  
@@ -656,7 +656,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  					     struct ieee80211_vif *vif)
  {
  	struct ath11k *ar = hw->priv;
-@@ -6371,6 +6440,8 @@ static void ath11k_mac_op_update_vif_off
+@@ -6468,6 +6537,8 @@ static void ath11k_mac_op_update_vif_off
  			    arvif->vdev_id, ret);
  		vif->offload_flags &= ~IEEE80211_OFFLOAD_DECAP_ENABLED;
  	}
@@ -665,7 +665,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  }
  
  static bool ath11k_mac_vif_ap_active_any(struct ath11k_base *ab)
-@@ -6501,6 +6572,8 @@ static int ath11k_mac_vdev_delete(struct
+@@ -6598,6 +6669,8 @@ static int ath11k_mac_vdev_delete(struct
  
  	reinit_completion(&ar->vdev_delete_done);
  
@@ -674,7 +674,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	ret = ath11k_wmi_vdev_delete(ar, arvif->vdev_id);
  	if (ret) {
  		ath11k_warn(ar->ab, "failed to delete WMI vdev %d: %d\n",
-@@ -6634,7 +6707,34 @@ static int ath11k_mac_op_add_interface(s
+@@ -6740,7 +6813,34 @@ static int ath11k_mac_op_add_interface(s
  	list_add(&arvif->list, &ar->arvifs);
  	spin_unlock_bh(&ar->data_lock);
  
@@ -710,7 +710,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	nss = get_num_chains(ar->cfg_tx_chainmask) ? : 1;
  	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id,
-@@ -6764,6 +6864,7 @@ err_peer_del:
+@@ -6870,6 +6970,7 @@ err_peer_del:
  	}
  
  err_vdev_del:
@@ -718,7 +718,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	ath11k_mac_vdev_delete(ar, arvif);
  	spin_lock_bh(&ar->data_lock);
  	list_del(&arvif->list);
-@@ -7281,6 +7382,10 @@ ath11k_mac_update_vif_chan(struct ath11k
+@@ -7387,6 +7488,10 @@ ath11k_mac_update_vif_chan(struct ath11k
  				    arvif->vdev_id, ret);
  			continue;
  		}
@@ -746,7 +746,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	.configure_filter		= ath11k_mac_op_configure_filter,
  	.hw_scan                        = ath11k_mac_op_hw_scan,
  	.cancel_hw_scan                 = ath11k_mac_op_cancel_hw_scan,
-@@ -10109,7 +10217,8 @@ static int __ath11k_mac_register(struct
+@@ -10149,7 +10257,8 @@ static int __ath11k_mac_register(struct
  		ieee80211_hw_set(ar->hw, TX_AMPDU_SETUP_IN_HW);
  		ieee80211_hw_set(ar->hw, SUPPORTS_REORDERING_BUFFER);
  		ieee80211_hw_set(ar->hw, SUPPORTS_AMSDU_IN_AMPDU);
@@ -756,7 +756,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	}
  
  	ar->hw->wiphy->features |= NL80211_FEATURE_STATIC_SMPS;
-@@ -10224,6 +10333,9 @@ static int __ath11k_mac_register(struct
+@@ -10264,6 +10373,9 @@ static int __ath11k_mac_register(struct
  	    ab->hw_params.bios_sar_capa)
  		ar->hw->wiphy->sar_capa = ab->hw_params.bios_sar_capa;
  
@@ -1199,7 +1199,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		    ab->hw_params.ring_mask->rx_err[i] ||
 --- a/local-symbols
 +++ b/local-symbols
-@@ -163,6 +163,7 @@ WCN36XX_DEBUGFS=
+@@ -165,6 +165,7 @@ WCN36XX_DEBUGFS=
  ATH11K=
  ATH11K_AHB=
  ATH11K_PCI=
diff --git a/package/kernel/mac80211/patches/nss/ath11k/203-mac80211-ath11k-fw-dynamic-muedca.patch b/package/kernel/mac80211/patches/nss/ath11k/203-mac80211-ath11k-fw-dynamic-muedca.patch
index a5200d21833001..0bdc221f6b29cd 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/203-mac80211-ath11k-fw-dynamic-muedca.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/203-mac80211-ath11k-fw-dynamic-muedca.patch
@@ -31,7 +31,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
-@@ -148,6 +148,8 @@ static const struct wmi_tlv_policy wmi_t
+@@ -149,6 +149,8 @@ static const struct wmi_tlv_policy wmi_t
  		.min_len = sizeof(struct wmi_vdev_delete_resp_event) },
  	[WMI_TAG_OBSS_COLOR_COLLISION_EVT] = {
  		.min_len = sizeof(struct wmi_obss_color_collision_event) },
@@ -40,7 +40,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  	[WMI_TAG_11D_NEW_COUNTRY_EVENT] = {
  		.min_len = sizeof(struct wmi_11d_new_cc_ev) },
  	[WMI_TAG_PER_CHAIN_RSSI_STATS] = {
-@@ -8708,6 +8710,74 @@ exit:
+@@ -8805,6 +8807,74 @@ out:
  	kfree(tb);
  }
  
@@ -115,7 +115,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  static void ath11k_wmi_tlv_op_rx(struct ath11k_base *ab, struct sk_buff *skb)
  {
  	struct wmi_cmd_hdr *cmd_hdr;
-@@ -8826,6 +8896,9 @@ static void ath11k_wmi_tlv_op_rx(struct
+@@ -8923,6 +8993,9 @@ static void ath11k_wmi_tlv_op_rx(struct
  	case WMI_11D_NEW_COUNTRY_EVENTID:
  		ath11k_reg_11d_new_cc_event(ab, skb);
  		break;
@@ -127,7 +127,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  		break;
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
-@@ -776,6 +776,7 @@ enum wmi_tlv_event_id {
+@@ -772,6 +772,7 @@ enum wmi_tlv_event_id {
  	WMI_READ_DATA_FROM_FLASH_EVENTID,
  	WMI_REPORT_RX_AGGR_FAILURE_EVENTID,
  	WMI_PKGID_EVENTID,
@@ -135,7 +135,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  	WMI_GPIO_INPUT_EVENTID = WMI_TLV_CMD(WMI_GRP_GPIO),
  	WMI_UPLOADH_EVENTID,
  	WMI_CAPTUREH_EVENTID,
-@@ -1888,6 +1889,7 @@ enum wmi_tlv_tag {
+@@ -1884,6 +1885,7 @@ enum wmi_tlv_tag {
  	WMI_TAG_NDP_EVENT,
  	WMI_TAG_PDEV_PEER_PKTLOG_FILTER_CMD = 0x301,
  	WMI_TAG_PDEV_PEER_PKTLOG_FILTER_INFO,
@@ -143,7 +143,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  	WMI_TAG_FILS_DISCOVERY_TMPL_CMD = 0x344,
  	WMI_TAG_PDEV_SRG_BSS_COLOR_BITMAP_CMD = 0x37b,
  	WMI_TAG_PDEV_SRG_PARTIAL_BSSID_BITMAP_CMD,
-@@ -4890,6 +4892,16 @@ struct wmi_pdev_temperature_event {
+@@ -4896,6 +4898,16 @@ struct wmi_pdev_temperature_event {
  	u32 pdev_id;
  } __packed;
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Add-support-for-dynamic-vlan.patch b/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Add-support-for-dynamic-vlan.patch
index 809c61df4ab720..f82f4577603739 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Add-support-for-dynamic-vlan.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Add-support-for-dynamic-vlan.patch
@@ -369,7 +369,7 @@ Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
  int ath11k_dp_tx(struct ath11k *ar, struct ath11k_vif *arvif,
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -10350,6 +10350,9 @@ static int __ath11k_mac_register(struct
+@@ -10390,6 +10390,9 @@ static int __ath11k_mac_register(struct
  		 */
  		ar->hw->wiphy->interface_modes &= ~BIT(NL80211_IFTYPE_MONITOR);
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Enable-256_512MB-profiles.patch b/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Enable-256_512MB-profiles.patch
index 2adfb3ba99b4be..5c7a9423bda557 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Enable-256_512MB-profiles.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Enable-256_512MB-profiles.patch
@@ -125,7 +125,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	ATH11K_QMI_FILE_TYPE_BDF_GOLDEN,
 --- a/local-symbols
 +++ b/local-symbols
-@@ -164,6 +164,8 @@ ATH11K=
+@@ -166,6 +166,8 @@ ATH11K=
  ATH11K_AHB=
  ATH11K_PCI=
  ATH11K_NSS_SUPPORT=
@@ -152,7 +152,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
  
-@@ -925,6 +925,11 @@ struct ath11k_msi_config {
+@@ -928,6 +928,11 @@ struct ath11k_msi_config {
  	u16 hw_rev;
  };
  
@@ -164,7 +164,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  /* Master structure to hold the hw data which may be used in core module */
  struct ath11k_base {
  	enum ath11k_hw_rev hw_rev;
-@@ -1082,6 +1087,8 @@ struct ath11k_base {
+@@ -1085,6 +1090,8 @@ struct ath11k_base {
  		DECLARE_BITMAP(fw_features, ATH11K_FW_FEATURE_COUNT);
  	} fw;
  
@@ -225,7 +225,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  	dma_unmap_single(ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
  
-@@ -825,6 +828,7 @@ void ath11k_dp_tx_completion_handler(str
+@@ -833,6 +836,7 @@ void ath11k_dp_tx_completion_handler(str
  			wake_up(&ar->dp.tx_empty_waitq);
  
  		ath11k_dp_tx_complete_msdu(ar, msdu, &ts);
@@ -261,7 +261,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		.num_vdevs = 16 + 1,
  		.num_peers = 512,
  		.supports_suspend = false,
-@@ -262,7 +265,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -265,7 +268,7 @@ static struct ath11k_hw_params ath11k_hw
  		.coldboot_cal_mm = false,
  		.coldboot_cal_ftm = false,
  		.cbcal_restart_fw = false,
@@ -270,7 +270,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		.num_vdevs = 2 + 1,
  		.num_peers = 512,
  		.supports_suspend = true,
-@@ -431,7 +434,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -437,7 +440,7 @@ static struct ath11k_hw_params ath11k_hw
  		.coldboot_cal_mm = false,
  		.coldboot_cal_ftm = false,
  		.cbcal_restart_fw = false,
@@ -279,7 +279,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		.num_vdevs = 2 + 1,
  		.num_peers = 512,
  		.supports_suspend = true,
-@@ -467,6 +470,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -473,6 +476,7 @@ static struct ath11k_hw_params ath11k_hw
  		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
  		.smp2p_wow_exit = false,
  		.support_fw_mac_sequence = true,
@@ -287,7 +287,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		.support_dual_stations = true,
  	},
  	{
-@@ -515,7 +519,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -524,7 +528,7 @@ static struct ath11k_hw_params ath11k_hw
  		.coldboot_cal_mm = false,
  		.coldboot_cal_ftm = false,
  		.cbcal_restart_fw = false,
@@ -296,7 +296,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		.num_vdevs = 2 + 1,
  		.num_peers = 512,
  		.supports_suspend = true,
-@@ -551,6 +555,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -560,6 +564,7 @@ static struct ath11k_hw_params ath11k_hw
  		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
  		.smp2p_wow_exit = false,
  		.support_fw_mac_sequence = true,
@@ -304,7 +304,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		.support_dual_stations = true,
  	},
  	{
-@@ -600,7 +605,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -609,7 +614,7 @@ static struct ath11k_hw_params ath11k_hw
  		.coldboot_cal_mm = true,
  		.coldboot_cal_ftm = true,
  		.cbcal_restart_fw = false,
@@ -313,7 +313,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		.num_vdevs = 3,
  		.num_peers = 512,
  		.supports_suspend = false,
-@@ -680,7 +685,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -689,7 +694,7 @@ static struct ath11k_hw_params ath11k_hw
  		.supports_monitor = false,
  		.supports_sta_ps = false,
  		.supports_shadow_regs = false,
@@ -322,7 +322,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		.num_vdevs = 16 + 1,
  		.num_peers = 512,
  		.supports_regdb = false,
-@@ -715,6 +720,7 @@ static struct ath11k_hw_params ath11k_hw
+@@ -724,6 +729,7 @@ static struct ath11k_hw_params ath11k_hw
  		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
  		.smp2p_wow_exit = false,
  		.support_fw_mac_sequence = false,
@@ -330,7 +330,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		.support_dual_stations = false,
  	},
  	{
-@@ -805,6 +811,21 @@ static struct ath11k_hw_params ath11k_hw
+@@ -817,6 +823,21 @@ static struct ath11k_hw_params ath11k_hw
  	},
  };
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/211-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch b/package/kernel/mac80211/patches/nss/ath11k/211-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch
index 274425c8b9a635..99250b69317817 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/211-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/211-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch
@@ -26,7 +26,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -679,6 +679,7 @@ struct ath11k {
+@@ -682,6 +682,7 @@ struct ath11k {
  	struct ath11k_pdev_wmi *wmi;
  #ifdef CPTCFG_ATH11K_NSS_SUPPORT
  	struct ath11k_nss nss;
@@ -34,7 +34,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  #endif
  	struct ath11k_pdev_dp dp;
  	u8 mac_addr[ETH_ALEN];
-@@ -1097,6 +1098,9 @@ struct ath11k_base {
+@@ -1100,6 +1101,9 @@ struct ath11k_base {
  	} testmode;
  #endif
  
@@ -111,7 +111,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		break;
 --- a/drivers/net/wireless/ath/ath11k/dp_tx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
-@@ -495,7 +495,7 @@ ath11k_dp_tx_process_htt_tx_complete(str
+@@ -499,7 +499,7 @@ ath11k_dp_tx_process_htt_tx_complete(str
  		break;
  	case HAL_WBM_REL_HTT_TX_COMP_STATUS_MEC_NOTIFY:
  		/* This event is to be handled only when the driver decides to
@@ -837,7 +837,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  int ath11k_wmi_send_pdev_set_regdomain(struct ath11k *ar,
  				       struct pdev_set_regdomain_params *param)
  {
-@@ -6436,6 +6483,36 @@ static int ath11k_pull_peer_assoc_conf_e
+@@ -6481,6 +6528,36 @@ static int ath11k_pull_peer_assoc_conf_e
  	return 0;
  }
  
@@ -874,7 +874,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  static void ath11k_wmi_pull_pdev_stats_base(const struct wmi_pdev_stats_base *src,
  					    struct ath11k_fw_stats_pdev *dst)
  {
-@@ -7260,6 +7337,7 @@ static int ath11k_wmi_tlv_rdy_parse(stru
+@@ -7305,6 +7382,7 @@ static int ath11k_wmi_tlv_rdy_parse(stru
  
  		ether_addr_copy(ab->mac_addr,
  				fixed_param.ready_event_min.mac_addr.addr);
@@ -882,7 +882,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		ab->pktlog_defs_checksum = fixed_param.pktlog_defs_checksum;
  		break;
  	case WMI_TAG_ARRAY_FIXED_STRUCT:
-@@ -8778,6 +8856,22 @@ exit:
+@@ -8875,6 +8953,22 @@ exit:
  	kfree(tb);
  }
  
@@ -917,7 +917,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		break;
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
-@@ -3032,6 +3032,21 @@ struct wmi_peer_delete_cmd {
+@@ -3028,6 +3028,21 @@ struct wmi_peer_delete_cmd {
  	struct wmi_mac_addr peer_macaddr;
  } __packed;
  
@@ -939,7 +939,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  struct wmi_peer_reorder_queue_setup_cmd {
  	u32 tlv_header;
  	u32 vdev_id;
-@@ -4635,6 +4650,21 @@ struct wmi_probe_resp_tx_status_event {
+@@ -4641,6 +4656,21 @@ struct wmi_probe_resp_tx_status_event {
  	u32 tx_status;
  } __packed;
  
@@ -961,7 +961,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  /*
   * PDEV statistics
   */
-@@ -6434,6 +6464,9 @@ int ath11k_wmi_set_sta_ps_param(struct a
+@@ -6440,6 +6470,9 @@ int ath11k_wmi_set_sta_ps_param(struct a
  int ath11k_wmi_force_fw_hang_cmd(struct ath11k *ar, u32 type, u32 delay_time_ms);
  int ath11k_wmi_send_peer_delete_cmd(struct ath11k *ar,
  				    const u8 *peer_addr, u8 vdev_id);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/214-ath11k-qos-null-frame-tx-over-wmi.patch b/package/kernel/mac80211/patches/nss/ath11k/214-ath11k-qos-null-frame-tx-over-wmi.patch
index 01cb6fb7af2eb0..d176a926c2722d 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/214-ath11k-qos-null-frame-tx-over-wmi.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/214-ath11k-qos-null-frame-tx-over-wmi.patch
@@ -22,7 +22,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -5915,6 +5915,16 @@ static int ath11k_mac_mgmt_tx_wmi(struct
+@@ -6012,6 +6012,16 @@ static int ath11k_mac_mgmt_tx_wmi(struct
  
  	ATH11K_SKB_CB(skb)->paddr = paddr;
  
@@ -39,7 +39,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	ret = ath11k_wmi_mgmt_send(ar, arvif->vdev_id, buf_id, skb);
  	if (ret) {
  		ath11k_warn(ar->ab, "failed to send mgmt frame: %d\n", ret);
-@@ -5982,8 +5992,8 @@ static void ath11k_mgmt_over_wmi_tx_work
+@@ -6079,8 +6089,8 @@ static void ath11k_mgmt_over_wmi_tx_work
  	}
  }
  
@@ -50,7 +50,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  {
  	struct sk_buff_head *q = &ar->wmi_mgmt_tx_queue;
  
-@@ -6045,7 +6055,7 @@ static void ath11k_mac_op_tx(struct ieee
+@@ -6142,7 +6152,7 @@ static void ath11k_mac_op_tx(struct ieee
  	} else if (ieee80211_is_mgmt(hdr->frame_control)) {
  		frm_type = FIELD_GET(IEEE80211_FCTL_STYPE, hdr->frame_control);
  		is_prb_rsp = ieee80211_is_probe_resp(hdr->frame_control);
@@ -59,7 +59,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  		if (ret) {
  			if (ret != -EBUSY)
  				ath11k_warn(ar->ab, "failed to queue management frame %d\n",
-@@ -6060,6 +6070,20 @@ static void ath11k_mac_op_tx(struct ieee
+@@ -6157,6 +6167,20 @@ static void ath11k_mac_op_tx(struct ieee
  			spin_unlock_bh(&ar->data_lock);
  		}
  		return;
@@ -82,7 +82,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	if (control->sta)
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
-@@ -117,7 +117,7 @@ static const struct wmi_tlv_policy wmi_t
+@@ -118,7 +118,7 @@ static const struct wmi_tlv_policy wmi_t
  	[WMI_TAG_MGMT_RX_HDR]
  		= { .min_len = sizeof(struct wmi_mgmt_rx_hdr) },
  	[WMI_TAG_MGMT_TX_COMPL_EVENT]
@@ -91,7 +91,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	[WMI_TAG_SCAN_EVENT]
  		= { .min_len = sizeof(struct wmi_scan_event) },
  	[WMI_TAG_PEER_STA_KICKOUT_EVENT]
-@@ -701,6 +701,55 @@ int ath11k_wmi_mgmt_send(struct ath11k *
+@@ -706,6 +706,55 @@ int ath11k_wmi_mgmt_send(struct ath11k *
  	return ret;
  }
  
@@ -147,7 +147,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  int ath11k_wmi_vdev_create(struct ath11k *ar, u8 *macaddr,
  			   struct vdev_create_params *param)
  {
-@@ -5978,8 +6027,8 @@ static int ath11k_pull_mgmt_rx_params_tl
+@@ -6023,8 +6072,8 @@ static int ath11k_pull_mgmt_rx_params_tl
  	return 0;
  }
  
@@ -158,7 +158,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  {
  	struct sk_buff *msdu;
  	struct ieee80211_tx_info *info;
-@@ -6017,6 +6066,11 @@ static int wmi_process_mgmt_tx_comp(stru
+@@ -6062,6 +6111,11 @@ static int wmi_process_mgmt_tx_comp(stru
  			info->status.ack_signal = tx_compl_param->ack_rssi;
  	}
  
@@ -170,7 +170,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	hdr = (struct ieee80211_hdr *)msdu->data;
  	frm_type = FIELD_GET(IEEE80211_FCTL_STYPE, hdr->frame_control);
  
-@@ -6035,10 +6089,13 @@ static int wmi_process_mgmt_tx_comp(stru
+@@ -6080,10 +6134,13 @@ static int wmi_process_mgmt_tx_comp(stru
  	arvif = ath11k_vif_to_arvif(vif);
  	mgmt_stats = &arvif->mgmt_stats;
  
@@ -188,7 +188,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	spin_unlock_bh(&ar->data_lock);
  
  skip_mgmt_stats:
-@@ -6060,12 +6117,13 @@ skip_mgmt_stats:
+@@ -6105,12 +6162,13 @@ skip_mgmt_stats:
  	return 0;
  }
  
@@ -206,7 +206,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	int ret;
  
  	tb = ath11k_wmi_tlv_parse_alloc(ab, skb, GFP_ATOMIC);
-@@ -6075,7 +6133,7 @@ static int ath11k_pull_mgmt_tx_compl_par
+@@ -6120,7 +6178,7 @@ static int ath11k_pull_mgmt_tx_compl_par
  		return ret;
  	}
  
@@ -215,7 +215,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	if (!ev) {
  		ath11k_warn(ab, "failed to fetch mgmt tx compl ev");
  		kfree(tb);
-@@ -7791,10 +7849,11 @@ exit:
+@@ -7836,10 +7894,11 @@ exit:
  
  static void ath11k_mgmt_tx_compl_event(struct ath11k_base *ab, struct sk_buff *skb)
  {
@@ -229,7 +229,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  		ath11k_warn(ab, "failed to extract mgmt tx compl event");
  		return;
  	}
-@@ -7807,7 +7866,7 @@ static void ath11k_mgmt_tx_compl_event(s
+@@ -7852,7 +7911,7 @@ static void ath11k_mgmt_tx_compl_event(s
  		goto exit;
  	}
  
@@ -238,7 +238,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  
  	ath11k_dbg(ab, ATH11K_DBG_MGMT,
  		   "event mgmt tx compl ev pdev_id %d, desc_id %d, status %d ack_rssi %d",
-@@ -7818,6 +7877,36 @@ exit:
+@@ -7863,6 +7922,36 @@ exit:
  	rcu_read_unlock();
  }
  
@@ -275,7 +275,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  static struct ath11k *ath11k_get_ar_on_scan_state(struct ath11k_base *ab,
  						  u32 vdev_id,
  						  enum ath11k_scan_state state)
-@@ -9005,6 +9094,10 @@ static void ath11k_wmi_tlv_op_rx(struct
+@@ -9105,6 +9194,10 @@ static void ath11k_wmi_tlv_op_rx(struct
  	case WMI_WDS_PEER_EVENTID:
  		ath11k_wmi_wds_peer_event(ab, skb);
  		break;
@@ -288,7 +288,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  		break;
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
-@@ -380,6 +380,7 @@ enum wmi_tlv_cmd_id {
+@@ -376,6 +376,7 @@ enum wmi_tlv_cmd_id {
  	WMI_BSS_COLOR_CHANGE_ENABLE_CMDID,
  	WMI_VDEV_BCN_OFFLOAD_QUIET_CONFIG_CMDID,
  	WMI_FILS_DISCOVERY_TMPL_CMDID,
@@ -296,7 +296,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	WMI_ADDBA_CLEAR_RESP_CMDID = WMI_TLV_CMD(WMI_GRP_BA_NEG),
  	WMI_ADDBA_SEND_CMDID,
  	WMI_ADDBA_STATUS_CMDID,
-@@ -710,6 +711,8 @@ enum wmi_tlv_event_id {
+@@ -706,6 +707,8 @@ enum wmi_tlv_event_id {
  	WMI_TBTTOFFSET_EXT_UPDATE_EVENTID,
  	WMI_OFFCHAN_DATA_TX_COMPLETION_EVENTID,
  	WMI_HOST_FILS_DISCOVERY_EVENTID,
@@ -305,7 +305,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	WMI_TX_DELBA_COMPLETE_EVENTID = WMI_TLV_CMD(WMI_GRP_BA_NEG),
  	WMI_TX_ADDBA_COMPLETE_EVENTID,
  	WMI_BA_RSP_SSN_EVENTID,
-@@ -1899,6 +1902,9 @@ enum wmi_tlv_tag {
+@@ -1895,6 +1898,9 @@ enum wmi_tlv_tag {
  	WMI_TAG_PDEV_NON_SRG_OBSS_BSSID_ENABLE_BITMAP_CMD,
  	WMI_TAG_REGULATORY_RULE_EXT_STRUCT = 0x3A9,
  	WMI_TAG_REG_CHAN_LIST_CC_EXT_EVENT,
@@ -315,7 +315,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	WMI_TAG_VDEV_SET_TPC_POWER_CMD = 0x3B5,
  	WMI_TAG_VDEV_CH_POWER_INFO,
  	WMI_TAG_PDEV_SET_BIOS_SAR_TABLE_CMD = 0x3D8,
-@@ -2130,7 +2136,17 @@ enum wmi_tlv_service {
+@@ -2126,7 +2132,17 @@ enum wmi_tlv_service {
  	WMI_TLV_SERVICE_PEER_POWER_SAVE_DURATION_SUPPORT = 246,
  	WMI_TLV_SERVICE_SRG_SRP_SPATIAL_REUSE_SUPPORT = 249,
  	WMI_TLV_SERVICE_MBSS_PARAM_IN_VDEV_START_SUPPORT = 253,
@@ -333,7 +333,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  
  	/* The second 128 bits */
  	WMI_MAX_EXT_SERVICE = 256,
-@@ -3877,6 +3893,7 @@ struct wmi_scan_prob_req_oui_cmd {
+@@ -3883,6 +3899,7 @@ struct wmi_scan_prob_req_oui_cmd {
  }  __packed;
  
  #define WMI_MGMT_SEND_DOWNLD_LEN	64
@@ -341,7 +341,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  
  #define WMI_TX_PARAMS_DWORD0_POWER		GENMASK(7, 0)
  #define WMI_TX_PARAMS_DWORD0_MCS_MASK		GENMASK(19, 8)
-@@ -3887,9 +3904,10 @@ struct wmi_scan_prob_req_oui_cmd {
+@@ -3893,9 +3910,10 @@ struct wmi_scan_prob_req_oui_cmd {
  #define WMI_TX_PARAMS_DWORD1_BW_MASK		GENMASK(14, 8)
  #define WMI_TX_PARAMS_DWORD1_PREAMBLE_TYPE	GENMASK(19, 15)
  #define WMI_TX_PARAMS_DWORD1_FRAME_TYPE		BIT(20)
@@ -354,7 +354,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	u32 tlv_header;
  	u32 tx_params_dword0;
  	u32 tx_params_dword1;
-@@ -4981,7 +4999,7 @@ struct wmi_rssi_ctl_ext {
+@@ -4987,7 +5005,7 @@ struct wmi_rssi_ctl_ext {
  	u32 rssi_ctl_ext[MAX_ANTENNA_EIGHT - ATH_MAX_ANTENNA];
  };
  
@@ -363,7 +363,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	u32 desc_id;
  	u32 status;
  	u32 pdev_id;
-@@ -5813,6 +5831,17 @@ struct wmi_debug_log_config_cmd_fixed_pa
+@@ -5819,6 +5837,17 @@ struct wmi_debug_log_config_cmd_fixed_pa
  	u32 value;
  } __packed;
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch b/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
index 1042a6c013246a..bc26bfa6926fd5 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
@@ -33,7 +33,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -427,6 +427,7 @@ struct ath11k_vif {
+@@ -430,6 +430,7 @@ struct ath11k_vif {
  #ifdef CPTCFG_ATH11K_NSS_SUPPORT
  	struct arvif_nss nss;
  #endif
@@ -43,7 +43,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  struct ath11k_vif_iter {
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -4755,6 +4755,11 @@ static void ath11k_sta_rc_update_wk(stru
+@@ -4844,6 +4844,11 @@ static void ath11k_sta_rc_update_wk(stru
  	arvif = arsta->arvif;
  	ar = arvif->ar;
  
@@ -55,7 +55,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	if (WARN_ON(ath11k_mac_vif_chan(arvif->vif, &def)))
  		return;
  
-@@ -4924,17 +4929,28 @@ err_rc_bw_changed:
+@@ -5013,17 +5018,28 @@ err_rc_bw_changed:
  static void ath11k_sta_set_4addr_wk(struct work_struct *wk)
  {
  	struct ath11k *ar;
@@ -86,7 +86,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		   "setting USE_4ADDR for peer %pM\n", sta->addr);
  
  	ret = ath11k_wmi_set_peer_param(ar, sta->addr,
-@@ -4942,8 +4958,93 @@ static void ath11k_sta_set_4addr_wk(stru
+@@ -5031,8 +5047,93 @@ static void ath11k_sta_set_4addr_wk(stru
  					WMI_PEER_USE_4ADDR, 1);
  
  	if (ret)
@@ -181,7 +181,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  }
  
  static int ath11k_mac_inc_num_stations(struct ath11k_vif *arvif,
-@@ -5045,9 +5146,32 @@ static void ath11k_mac_op_sta_set_4addr(
+@@ -5134,9 +5235,32 @@ static void ath11k_mac_op_sta_set_4addr(
  					struct ieee80211_sta *sta, bool enabled)
  {
  	struct ath11k *ar = hw->priv;
@@ -214,7 +214,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		ieee80211_queue_work(ar->hw, &arsta->set_4addr_wk);
  		arsta->use_4addr_set = true;
  	}
-@@ -6427,6 +6551,9 @@ static int ath11k_mac_op_update_vif_offl
+@@ -6524,6 +6648,9 @@ static int ath11k_mac_op_update_vif_offl
  	u32 param_id, param_value;
  	int ret;
  
@@ -224,7 +224,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	param_id = WMI_VDEV_PARAM_TX_ENCAP_TYPE;
  	if (ath11k_frame_mode != ATH11K_HW_TXRX_ETHERNET ||
  	    (vif->type != NL80211_IFTYPE_STATION &&
-@@ -6647,7 +6774,8 @@ static int ath11k_mac_op_add_interface(s
+@@ -6744,7 +6871,8 @@ static int ath11k_mac_op_add_interface(s
  		goto err;
  	}
  
@@ -234,7 +234,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		ath11k_warn(ab, "failed to create vdev %u, reached max vdev limit %d\n",
  			    ar->num_created_vdevs, TARGET_NUM_VDEVS(ab));
  		ret = -EBUSY;
-@@ -6660,6 +6788,28 @@ static int ath11k_mac_op_add_interface(s
+@@ -6757,6 +6885,28 @@ static int ath11k_mac_op_add_interface(s
  	arvif->vif = vif;
  
  	INIT_LIST_HEAD(&arvif->list);
@@ -271,7 +271,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		if (vif->p2p)
  			arvif->vdev_subtype = WMI_VDEV_SUBTYPE_P2P_GO;
  		break;
-@@ -6917,13 +7068,30 @@ static void ath11k_mac_op_remove_interfa
+@@ -7023,13 +7174,30 @@ static void ath11k_mac_op_remove_interfa
  	struct ath11k *ar = hw->priv;
  	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
  	struct ath11k_base *ab = ar->ab;
@@ -304,7 +304,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	ath11k_dbg(ab, ATH11K_DBG_MAC, "remove interface (vdev %d)\n",
  		   arvif->vdev_id);
  
-@@ -6940,6 +7108,14 @@ static void ath11k_mac_op_remove_interfa
+@@ -7046,6 +7214,14 @@ static void ath11k_mac_op_remove_interfa
  		if (ret)
  			ath11k_warn(ab, "failed to submit AP self-peer removal on vdev %d: %d\n",
  				    arvif->vdev_id, ret);
@@ -319,7 +319,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	}
  
  	ret = ath11k_mac_vdev_delete(ar, arvif);
-@@ -6981,8 +7157,7 @@ err_vdev_del:
+@@ -7087,8 +7263,7 @@ err_vdev_del:
  	/* Recalc txpower for remaining vdev */
  	ath11k_mac_txpower_recalc(ar);
  
@@ -329,7 +329,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	mutex_unlock(&ar->conf_mutex);
  }
  
-@@ -7042,16 +7217,17 @@ static int ath11k_mac_op_ampdu_action(st
+@@ -7148,16 +7323,17 @@ static int ath11k_mac_op_ampdu_action(st
  				      struct ieee80211_ampdu_params *params)
  {
  	struct ath11k *ar = hw->priv;
@@ -349,7 +349,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		break;
  	case IEEE80211_AMPDU_TX_START:
  	case IEEE80211_AMPDU_TX_STOP_CONT:
-@@ -9056,6 +9232,7 @@ static void ath11k_mac_op_sta_statistics
+@@ -9085,6 +9261,7 @@ static void ath11k_mac_op_sta_statistics
  {
  	struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);
  	struct ath11k *ar = arsta->arvif->ar;
@@ -357,8 +357,8 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	s8 signal;
  	bool db2dbm = test_bit(WMI_TLV_SERVICE_HW_DB2DBM_CONVERSION_SUPPORT,
  			       ar->ab->wmi_ab.svc_map);
-@@ -9112,7 +9289,8 @@ static void ath11k_mac_op_sta_statistics
- 		ATH11K_DEFAULT_NOISE_FLOOR;
+@@ -9144,7 +9321,8 @@ static void ath11k_mac_op_sta_statistics
+ 
  	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
  
 -	ath11k_nss_update_sta_stats(sinfo, sta, arsta);
@@ -369,7 +369,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  #if IS_ENABLED(CONFIG_IPV6)
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
-@@ -5105,6 +5105,8 @@ enum wmi_vdev_subtype {
+@@ -5111,6 +5111,8 @@ enum wmi_vdev_subtype {
  	WMI_VDEV_SUBTYPE_MESH_11S,
  };
  
@@ -415,8 +415,8 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	int ret;
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.h
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.h
-@@ -88,9 +88,9 @@ static inline u32 ath11k_he_gi_to_nl8021
-         return ret;
+@@ -89,9 +89,9 @@ static inline u32 ath11k_he_gi_to_nl8021
+ 	return ret;
  }
  
 -int ath11k_dp_rx_ampdu_start(struct ath11k *ar,
diff --git a/package/kernel/mac80211/patches/nss/ath11k/236-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch b/package/kernel/mac80211/patches/nss/ath11k/236-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch
index b9e89bae07f942..50f78eca0d76fc 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/236-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/236-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch
@@ -48,7 +48,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  static inline enum wme_ac ath11k_tid_to_ac(u32 tid)
  {
  	return (((tid == 0) || (tid == 3)) ? WME_AC_BE :
-@@ -367,6 +372,20 @@ struct ath11k_mgmt_frame_stats {
+@@ -370,6 +375,20 @@ struct ath11k_mgmt_frame_stats {
  	u32 tx_compl_fail[ATH11K_STATS_MGMT_FRM_TYPE_MAX];
  };
  
@@ -69,7 +69,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  struct ath11k_vif {
  	u32 vdev_id;
  	enum wmi_vdev_type vdev_type;
-@@ -428,6 +447,11 @@ struct ath11k_vif {
+@@ -431,6 +450,11 @@ struct ath11k_vif {
  	struct arvif_nss nss;
  #endif
  	struct list_head ap_vlan_arvifs;
@@ -128,7 +128,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  static void ath11k_pdev_caps_update(struct ath11k *ar)
  {
  	struct ath11k_base *ab = ar->ab;
-@@ -4175,6 +4206,9 @@ static int ath11k_install_key(struct ath
+@@ -4265,6 +4296,9 @@ static int ath11k_install_key(struct ath
  	if (test_bit(ATH11K_FLAG_HW_CRYPTO_DISABLED, &ar->ab->dev_flags))
  		return 0;
  
@@ -138,7 +138,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	if (cmd == DISABLE_KEY) {
  		arg.key_cipher = WMI_CIPHER_NONE;
  		arg.key_data = NULL;
-@@ -4264,15 +4298,40 @@ static int ath11k_clear_peer_keys(struct
+@@ -4353,15 +4387,40 @@ static int ath11k_clear_peer_keys(struct
  	return first_errno;
  }
  
@@ -181,7 +181,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	const u8 *peer_addr;
  	int ret = 0;
  	u32 flags = 0;
-@@ -4290,17 +4349,38 @@ static int ath11k_mac_op_set_key(struct
+@@ -4379,17 +4438,38 @@ static int ath11k_mac_op_set_key(struct
  	if (key->keyidx > WMI_MAX_KEY_INDEX)
  		return -ENOSPC;
  
@@ -224,7 +224,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	/* the peer should not disappear in mid-way (unless FW goes awry) since
  	 * we already hold conf_mutex. we just make sure its there now.
  	 */
-@@ -4345,6 +4425,74 @@ static int ath11k_mac_op_set_key(struct
+@@ -4434,6 +4514,74 @@ static int ath11k_mac_op_set_key(struct
  		goto exit;
  	}
  
@@ -299,7 +299,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	spin_lock_bh(&ab->base_lock);
  	peer = ath11k_peer_find(ab, arvif->vdev_id, peer_addr);
  
-@@ -4367,6 +4515,27 @@ static int ath11k_mac_op_set_key(struct
+@@ -4456,6 +4604,27 @@ static int ath11k_mac_op_set_key(struct
  		goto unlock;
  	}
  
@@ -327,7 +327,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	if (peer && cmd == SET_KEY) {
  		peer->keys[key->keyidx] = key;
  		if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
-@@ -4376,18 +4545,23 @@ static int ath11k_mac_op_set_key(struct
+@@ -4465,18 +4634,23 @@ static int ath11k_mac_op_set_key(struct
  			peer->mcast_keyidx = key->keyidx;
  			peer->sec_type_grp = ath11k_dp_tx_get_encrypt_type(key->cipher);
  		}
@@ -354,7 +354,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
  		switch (key->cipher) {
  		case WLAN_CIPHER_SUITE_TKIP:
-@@ -6792,7 +6966,7 @@ static int ath11k_mac_op_add_interface(s
+@@ -6889,7 +7063,7 @@ static int ath11k_mac_op_add_interface(s
  	if ((vif->type == NL80211_IFTYPE_AP_VLAN ||
  	     vif->type == NL80211_IFTYPE_STATION) && ab->nss.enabled) {
  		if (ath11k_frame_mode == ATH11K_HW_TXRX_ETHERNET &&
@@ -363,7 +363,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  			vif->offload_flags |= IEEE80211_OFFLOAD_ENCAP_4ADDR;
  			arvif->nss.encap = ATH11K_HW_TXRX_ETHERNET;
  			arvif->nss.decap = ATH11K_HW_TXRX_ETHERNET;
-@@ -6805,6 +6979,7 @@ static int ath11k_mac_op_add_interface(s
+@@ -6902,6 +7076,7 @@ static int ath11k_mac_op_add_interface(s
  					    vif->addr, ret);
  				goto err;
  			}
@@ -371,7 +371,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  			mutex_unlock(&ar->conf_mutex);
  			return ret;
  		}
-@@ -6829,6 +7004,20 @@ static int ath11k_mac_op_add_interface(s
+@@ -6926,6 +7101,20 @@ static int ath11k_mac_op_add_interface(s
  	arvif->vdev_id = bit;
  	arvif->vdev_subtype = WMI_VDEV_SUBTYPE_NONE;
  
@@ -392,7 +392,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	switch (vif->type) {
  	case NL80211_IFTYPE_UNSPECIFIED:
  	case NL80211_IFTYPE_STATION:
-@@ -6869,7 +7058,7 @@ static int ath11k_mac_op_add_interface(s
+@@ -6975,7 +7164,7 @@ static int ath11k_mac_op_add_interface(s
  	if (ret) {
  		ath11k_warn(ab, "failed to create WMI vdev %d: %d\n",
  			    arvif->vdev_id, ret);
@@ -401,7 +401,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	}
  
  	ar->num_created_vdevs++;
-@@ -7034,7 +7223,7 @@ err_peer_del:
+@@ -7140,7 +7329,7 @@ err_peer_del:
  		if (fbret) {
  			ath11k_warn(ar->ab, "fallback fail to delete peer addr %pM vdev_id %d ret %d\n",
  				    vif->addr, arvif->vdev_id, fbret);
@@ -410,7 +410,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		}
  	}
  
-@@ -7045,6 +7234,8 @@ err_vdev_del:
+@@ -7151,6 +7340,8 @@ err_vdev_del:
  	list_del(&arvif->list);
  	spin_unlock_bh(&ar->data_lock);
  
@@ -419,7 +419,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  err:
  	mutex_unlock(&ar->conf_mutex);
  
-@@ -7142,6 +7333,7 @@ err_vdev_del:
+@@ -7248,6 +7439,7 @@ err_vdev_del:
  	list_del(&arvif->list);
  	spin_unlock_bh(&ar->data_lock);
  
@@ -427,7 +427,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	ath11k_peer_cleanup(ar, arvif->vdev_id);
  
  	idr_for_each(&ar->txmgmt_idr,
-@@ -9835,6 +10027,33 @@ static int ath11k_mac_station_remove(str
+@@ -9872,6 +10064,33 @@ static int ath11k_mac_station_remove(str
  	return ret;
  }
  
@@ -461,7 +461,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  static int ath11k_mac_op_sta_state(struct ieee80211_hw *hw,
  				   struct ieee80211_vif *vif,
  				   struct ieee80211_sta *sta,
-@@ -9924,6 +10143,34 @@ static int ath11k_mac_op_sta_state(struc
+@@ -9961,6 +10180,34 @@ static int ath11k_mac_op_sta_state(struc
  			if (ret)
  				ath11k_warn(ar->ab, "Unable to authorize peer %pM vdev %d: %d\n",
  					    sta->addr, arvif->vdev_id, ret);
@@ -496,7 +496,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		}
  
  		if (!ret &&
-@@ -10535,8 +10782,11 @@ static int __ath11k_mac_register(struct
+@@ -10575,8 +10822,11 @@ static int __ath11k_mac_register(struct
  	    ab->hw_params.bios_sar_capa)
  		ar->hw->wiphy->sar_capa = ab->hw_params.bios_sar_capa;
  
@@ -511,7 +511,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	if (ret) {
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
-@@ -1938,6 +1938,7 @@ int ath11k_wmi_vdev_install_key(struct a
+@@ -1982,6 +1982,7 @@ int ath11k_wmi_vdev_install_key(struct a
  	cmd->key_len = arg->key_len;
  	cmd->key_txmic_len = arg->key_txmic_len;
  	cmd->key_rxmic_len = arg->key_rxmic_len;
@@ -519,7 +519,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
  	if (arg->key_rsc_counter)
  		memcpy(&cmd->key_rsc_counter, &arg->key_rsc_counter,
-@@ -4276,6 +4277,7 @@ ath11k_wmi_copy_resource_config(struct w
+@@ -4321,6 +4322,7 @@ ath11k_wmi_copy_resource_config(struct w
  	wmi_cfg->flags2 = WMI_RSRC_CFG_FLAG2_CALC_NEXT_DTIM_COUNT_SET;
  	wmi_cfg->ema_max_vap_cnt = tg_cfg->ema_max_vap_cnt;
  	wmi_cfg->ema_max_profile_period = tg_cfg->ema_max_profile_period;
@@ -527,7 +527,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  }
  
  static int ath11k_init_cmd_send(struct ath11k_pdev_wmi *wmi,
-@@ -4498,6 +4500,9 @@ int ath11k_wmi_cmd_init(struct ath11k_ba
+@@ -4543,6 +4545,9 @@ int ath11k_wmi_cmd_init(struct ath11k_ba
  	memset(&init_param, 0, sizeof(init_param));
  	memset(&config, 0, sizeof(config));
  
@@ -539,7 +539,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	if (test_bit(WMI_TLV_SERVICE_REG_CC_EXT_EVENT_SUPPORT,
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
-@@ -3749,6 +3749,7 @@ struct wmi_vdev_install_key_arg {
+@@ -3755,6 +3755,7 @@ struct wmi_vdev_install_key_arg {
  	u32 vdev_id;
  	const u8 *macaddr;
  	u32 key_idx;
@@ -547,7 +547,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	u32 key_flags;
  	u32 key_cipher;
  	u32 key_len;
-@@ -5809,6 +5810,7 @@ struct target_resource_config {
+@@ -5815,6 +5816,7 @@ struct target_resource_config {
  	u32 bpf_instruction_size;
  	u32 max_bssid_rx_filters;
  	u32 use_pdev_id;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/237-001-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch b/package/kernel/mac80211/patches/nss/ath11k/237-001-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
index 6b187ee9ab2c7e..510b0f5f6b668e 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/237-001-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/237-001-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -1126,6 +1126,7 @@ struct ath11k_base {
+@@ -1129,6 +1129,7 @@ struct ath11k_base {
  	u32 max_ast_index;
  	u32 num_ast_entries;
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/237-003-ath11k-allocate-dst-ring-descriptors-from-cacheable-.patch b/package/kernel/mac80211/patches/nss/ath11k/237-003-ath11k-allocate-dst-ring-descriptors-from-cacheable-.patch
index 2342ebcba910db..5316894fd2ef06 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/237-003-ath11k-allocate-dst-ring-descriptors-from-cacheable-.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/237-003-ath11k-allocate-dst-ring-descriptors-from-cacheable-.patch
@@ -24,7 +24,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/dp_tx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
-@@ -761,6 +761,7 @@ void ath11k_dp_tx_completion_handler(str
+@@ -769,6 +769,7 @@ void ath11k_dp_tx_completion_handler(str
  	struct sk_buff *msdu;
  	struct hal_tx_status ts = { 0 };
  	struct dp_tx_ring *tx_ring = &dp->tx_ring[ring_id];
@@ -32,7 +32,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	u32 *desc;
  	u32 msdu_id;
  	u8 mac_id;
-@@ -769,9 +770,18 @@ void ath11k_dp_tx_completion_handler(str
+@@ -777,9 +778,18 @@ void ath11k_dp_tx_completion_handler(str
  
  	ath11k_hal_srng_access_begin(ab, status_ring);
  
@@ -143,5 +143,5 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
 +void ath11k_hal_srng_dst_invalidate_entry(struct ath11k_base *ab,
 +					  struct hal_srng *srng, int entries);
  u32 *ath11k_hal_srng_src_peek(struct ath11k_base *ab, struct hal_srng *srng);
- u32 *ath11k_hal_srng_src_get_next_reaped(struct ath11k_base *ab,
- 					 struct hal_srng *srng);
+ u32 *ath11k_hal_srng_src_next_peek(struct ath11k_base *ab,
+ 				   struct hal_srng *srng);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch b/package/kernel/mac80211/patches/nss/ath11k/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
index 7692d633bc3798..0b12de5f7ccc20 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
@@ -55,7 +55,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  				   tlv_tag, ptr - begin, len, tlv_len);
  			return -EINVAL;
  		}
-@@ -2455,10 +2461,60 @@ ath11k_dp_rx_h_find_peer(struct ath11k_b
+@@ -2454,10 +2460,60 @@ ath11k_dp_rx_h_find_peer(struct ath11k_b
  	return peer;
  }
  
@@ -117,7 +117,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  {
  	bool  fill_crypto_hdr;
  	enum hal_encrypt_type enctype;
-@@ -2469,9 +2525,13 @@ static void ath11k_dp_rx_h_mpdu(struct a
+@@ -2468,9 +2524,13 @@ static void ath11k_dp_rx_h_mpdu(struct a
  	struct rx_attention *rx_attention;
  	u32 err_bitmap;
  
@@ -132,7 +132,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	rxcb->is_mcbc = fill_crypto_hdr;
  
  	if (rxcb->is_mcbc) {
-@@ -2482,6 +2542,26 @@ static void ath11k_dp_rx_h_mpdu(struct a
+@@ -2481,6 +2541,26 @@ static void ath11k_dp_rx_h_mpdu(struct a
  	spin_lock_bh(&ar->ab->base_lock);
  	peer = ath11k_dp_rx_h_find_peer(ar->ab, msdu);
  	if (peer) {
@@ -159,7 +159,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		if (rxcb->is_mcbc)
  			enctype = peer->sec_type_grp;
  		else
-@@ -2491,6 +2571,8 @@ static void ath11k_dp_rx_h_mpdu(struct a
+@@ -2490,6 +2570,8 @@ static void ath11k_dp_rx_h_mpdu(struct a
  	}
  	spin_unlock_bh(&ar->ab->base_lock);
  
@@ -168,7 +168,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	rx_attention = ath11k_dp_rx_get_attention(ar->ab, rx_desc);
  	err_bitmap = ath11k_dp_rx_h_attn_mpdu_err(rx_attention);
  	if (enctype != HAL_ENCRYPT_TYPE_OPEN && !err_bitmap)
-@@ -2732,7 +2814,8 @@ static void ath11k_dp_rx_deliver_msdu(st
+@@ -2731,7 +2813,8 @@ static void ath11k_dp_rx_deliver_msdu(st
  static int ath11k_dp_rx_process_msdu(struct ath11k *ar,
  				     struct sk_buff *msdu,
  				     struct sk_buff_head *msdu_list,
@@ -178,7 +178,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  {
  	struct ath11k_base *ab = ar->ab;
  	struct hal_rx_desc *rx_desc, *lrx_desc;
-@@ -2799,8 +2882,13 @@ static int ath11k_dp_rx_process_msdu(str
+@@ -2798,8 +2881,13 @@ static int ath11k_dp_rx_process_msdu(str
  		}
  	}
  
@@ -193,7 +193,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  
  	rx_status->flag |= RX_FLAG_SKIP_MONITOR | RX_FLAG_DUP_VALIDATED;
  
-@@ -2815,10 +2903,12 @@ static void ath11k_dp_rx_process_receive
+@@ -2814,10 +2902,12 @@ static void ath11k_dp_rx_process_receive
  						  struct sk_buff_head *msdu_list,
  						  int mac_id)
  {
@@ -206,7 +206,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  
  	if (skb_queue_empty(msdu_list))
  		return;
-@@ -2835,7 +2925,12 @@ static void ath11k_dp_rx_process_receive
+@@ -2834,7 +2924,12 @@ static void ath11k_dp_rx_process_receive
  	}
  
  	while ((msdu = __skb_dequeue(msdu_list))) {
@@ -220,7 +220,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		if (unlikely(ret)) {
  			ath11k_dbg(ab, ATH11K_DBG_DATA,
  				   "Unable to process msdu %d", ret);
-@@ -2843,7 +2938,10 @@ static void ath11k_dp_rx_process_receive
+@@ -2842,7 +2937,10 @@ static void ath11k_dp_rx_process_receive
  			continue;
  		}
  
@@ -232,7 +232,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	}
  }
  
-@@ -2852,11 +2950,12 @@ void ath11k_dp_rx_from_nss(struct ath11k
+@@ -2851,11 +2949,12 @@ void ath11k_dp_rx_from_nss(struct ath11k
  {
  	struct ieee80211_rx_status rx_status = {0};
  	struct ath11k_skb_rxcb *rxcb;
@@ -246,7 +246,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  
  	rx_status.flag |= RX_FLAG_SKIP_MONITOR | RX_FLAG_DUP_VALIDATED;
  
-@@ -4324,6 +4423,7 @@ static int ath11k_dp_rx_h_null_q_desc(st
+@@ -4387,6 +4486,7 @@ static int ath11k_dp_rx_h_null_q_desc(st
  				      struct ieee80211_rx_status *status,
  				      struct sk_buff_head *msdu_list)
  {
@@ -254,7 +254,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	u16 msdu_len;
  	struct hal_rx_desc *desc = (struct hal_rx_desc *)msdu->data;
  	struct rx_attention *rx_attention;
-@@ -4373,7 +4473,8 @@ static int ath11k_dp_rx_h_null_q_desc(st
+@@ -4436,7 +4536,8 @@ static int ath11k_dp_rx_h_null_q_desc(st
  	}
  	ath11k_dp_rx_h_ppdu(ar, desc, status);
  
@@ -328,7 +328,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	bool (*rx_desc_get_mpdu_fc_valid)(struct hal_rx_desc *desc);
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -10197,6 +10197,14 @@ static int ath11k_mac_op_sta_state(struc
+@@ -10234,6 +10234,14 @@ static int ath11k_mac_op_sta_state(struc
  		}
  	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
  		   new_state == IEEE80211_STA_ASSOC) {
diff --git a/package/kernel/mac80211/patches/nss/ath11k/244-ath11k-dp-tx-perf.patch b/package/kernel/mac80211/patches/nss/ath11k/244-ath11k-dp-tx-perf.patch
index c7acb122a584c6..dc8d17f95bf445 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/244-ath11k-dp-tx-perf.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/244-ath11k-dp-tx-perf.patch
@@ -34,7 +34,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  };
  
  struct ath11k_skb_cb {
-@@ -921,10 +922,13 @@ struct ath11k_dp_ring_bp_stats {
+@@ -924,10 +925,13 @@ struct ath11k_dp_ring_bp_stats {
  struct ath11k_soc_dp_tx_err_stats {
  	/* TCL Ring Descriptor unavailable */
  	u32 desc_na[DP_TCL_NUM_RING_MAX];
@@ -295,7 +295,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	if (!skb_cb->vif) {
  		ieee80211_free_txskb(ar->hw, msdu);
  		return;
-@@ -632,6 +663,7 @@ static void ath11k_dp_tx_complete_msdu(s
+@@ -636,6 +667,7 @@ static void ath11k_dp_tx_complete_msdu(s
  	struct ath11k_peer *peer;
  	struct ath11k_sta *arsta;
  	struct rate_info rate;
@@ -303,7 +303,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  
  	if (WARN_ON_ONCE(ts->buf_rel_source != HAL_WBM_REL_SRC_MODULE_TQM)) {
  		/* Must not happen */
-@@ -642,6 +674,20 @@ static void ath11k_dp_tx_complete_msdu(s
+@@ -646,6 +678,20 @@ static void ath11k_dp_tx_complete_msdu(s
  
  	dma_unmap_single(ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
  
@@ -324,7 +324,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	if (unlikely(!rcu_access_pointer(ab->pdevs_active[ar->pdev_idx]))) {
  		ieee80211_free_txskb(ar->hw, msdu);
  		return;
-@@ -696,7 +742,7 @@ static void ath11k_dp_tx_complete_msdu(s
+@@ -704,7 +750,7 @@ static void ath11k_dp_tx_complete_msdu(s
  
  	spin_lock_bh(&ab->base_lock);
  	peer = ath11k_peer_find_by_id(ab, ts->peer_id);
@@ -333,7 +333,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		ath11k_dbg(ab, ATH11K_DBG_DATA,
  			   "dp_tx: failed to find the peer with peer_id %d\n",
  			    ts->peer_id);
-@@ -752,19 +798,36 @@ static inline void ath11k_dp_tx_status_p
+@@ -760,19 +806,36 @@ static inline void ath11k_dp_tx_status_p
  		ts->rate_stats = 0;
  }
  
@@ -372,7 +372,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  
  	spin_lock_bh(&status_ring->lock);
  
-@@ -779,33 +842,27 @@ void ath11k_dp_tx_completion_handler(str
+@@ -787,33 +850,27 @@ void ath11k_dp_tx_completion_handler(str
  
  	ath11k_hal_srng_dst_invalidate_entry(ab, status_ring, valid_entries);
  
@@ -420,7 +420,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		ath11k_dp_tx_status_parse(ab, tx_status, &ts);
  
  		desc_id = FIELD_GET(BUFFER_ADDR_INFO1_SW_COOKIE,
-@@ -838,7 +895,6 @@ void ath11k_dp_tx_completion_handler(str
+@@ -846,7 +903,6 @@ void ath11k_dp_tx_completion_handler(str
  			wake_up(&ar->dp.tx_empty_waitq);
  
  		ath11k_dp_tx_complete_msdu(ar, msdu, &ts);
@@ -430,7 +430,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -6387,12 +6387,22 @@ static void ath11k_mac_op_tx(struct ieee
+@@ -6484,12 +6484,22 @@ static void ath11k_mac_op_tx(struct ieee
  	if (control->sta)
  		arsta = ath11k_sta_to_arsta(control->sta);
  
@@ -454,7 +454,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		ieee80211_free_txskb(ar->hw, skb);
  		return;
  	}
-@@ -7339,7 +7349,7 @@ err_vdev_del:
+@@ -7445,7 +7455,7 @@ err_vdev_del:
  	idr_for_each(&ar->txmgmt_idr,
  		     ath11k_mac_vif_txmgmt_idr_remove, vif);
  
@@ -507,7 +507,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	},
  	{
  		.name = "qca6390 hw2.0",
-@@ -359,7 +360,6 @@ static struct ath11k_hw_params ath11k_hw
+@@ -362,7 +363,6 @@ static struct ath11k_hw_params ath11k_hw
  		.supports_regdb = false,
  		.fix_l1ss = true,
  		.credit_flow = false,
@@ -515,7 +515,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		.hal_params = &ath11k_hw_hal_params_ipq8074,
  		.supports_dynamic_smps_6ghz = true,
  		.alloc_cacheable_memory = true,
-@@ -385,6 +385,8 @@ static struct ath11k_hw_params ath11k_hw
+@@ -388,6 +388,8 @@ static struct ath11k_hw_params ath11k_hw
  		.smp2p_wow_exit = false,
  		.support_fw_mac_sequence = false,
  		.support_dual_stations = false,
@@ -524,7 +524,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	},
  	{
  		.name = "wcn6855 hw2.0",
-@@ -2247,6 +2249,9 @@ int ath11k_core_pre_init(struct ath11k_b
+@@ -2256,6 +2258,9 @@ int ath11k_core_pre_init(struct ath11k_b
  	if (nss_offload)
  		ab->nss.stats_enabled = 1;
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch b/package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch
index 7ba7eacdc364e3..c1e3d63e5963bd 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch
@@ -36,7 +36,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/Makefile
 +++ b/drivers/net/wireless/ath/ath11k/Makefile
-@@ -28,6 +28,10 @@ ath11k-$(CPTCFG_ATH11K_SPECTRAL) += spec
+@@ -29,6 +29,10 @@ ath11k-$(CPTCFG_ATH11K_SPECTRAL) += spec
  ath11k-$(CONFIG_PM) += wow.o
  ath11k-$(CPTCFG_ATH11K_NSS_SUPPORT) += nss.o
  
@@ -1238,7 +1238,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -3476,6 +3476,18 @@ static void ath11k_mac_op_nss_bss_info_c
+@@ -3563,6 +3563,18 @@ static void ath11k_mac_op_nss_bss_info_c
  			ath11k_warn(ar->ab, "failed to set ap_isolate in nss %d\n", ret);
  	}
  
@@ -1257,7 +1257,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  	mutex_unlock(&ar->conf_mutex);
  }
  
-@@ -10237,6 +10249,28 @@ static int ath11k_mac_op_sta_state(struc
+@@ -10274,6 +10286,28 @@ static int ath11k_mac_op_sta_state(struc
  	return ret;
  }
  
@@ -1286,7 +1286,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  static const struct ieee80211_ops ath11k_ops = {
  	.tx				= ath11k_mac_op_tx,
  	.wake_tx_queue			= ieee80211_handle_wake_tx_queue,
-@@ -10295,6 +10329,9 @@ static const struct ieee80211_ops ath11k
+@@ -10332,6 +10366,9 @@ static const struct ieee80211_ops ath11k
  	.set_sar_specs			= ath11k_mac_op_set_bios_sar_specs,
  	.remain_on_channel		= ath11k_mac_op_remain_on_channel,
  	.cancel_remain_on_channel	= ath11k_mac_op_cancel_remain_on_channel,
@@ -1296,7 +1296,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  };
  
  static void ath11k_mac_update_ch_list(struct ath11k *ar,
-@@ -10804,6 +10841,8 @@ static int __ath11k_mac_register(struct
+@@ -10844,6 +10881,8 @@ static int __ath11k_mac_register(struct
  		ieee80211_hw_set(ar->hw, SUPPORTS_NSS_OFFLOAD);
  		wiphy_ext_feature_set(ar->hw->wiphy,
  				      NL80211_EXT_FEATURE_VLAN_OFFLOAD);
@@ -3337,7 +3337,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  	ATH11K_DBG_WMI		= 0x00000002,
 --- a/local-symbols
 +++ b/local-symbols
-@@ -164,6 +164,7 @@ ATH11K=
+@@ -166,6 +166,7 @@ ATH11K=
  ATH11K_AHB=
  ATH11K_PCI=
  ATH11K_NSS_SUPPORT=
diff --git a/package/kernel/mac80211/patches/nss/ath11k/314-ath11k-Fix-peer-lookup-failure-in-mgmt-tx-completion.patch b/package/kernel/mac80211/patches/nss/ath11k/314-ath11k-Fix-peer-lookup-failure-in-mgmt-tx-completion.patch
index d0b57fe27e5275..7a97e10ddc4415 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/314-ath11k-Fix-peer-lookup-failure-in-mgmt-tx-completion.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/314-ath11k-Fix-peer-lookup-failure-in-mgmt-tx-completion.patch
@@ -23,7 +23,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -7358,8 +7358,10 @@ err_vdev_del:
+@@ -7464,8 +7464,10 @@ err_vdev_del:
  	kfree(arvif->vlan_keyid_map);
  	ath11k_peer_cleanup(ar, arvif->vdev_id);
  
@@ -36,7 +36,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  		spin_lock_bh(&ab->dp.tx_ring[i].tx_idr_lock);
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
-@@ -6039,13 +6039,13 @@ static int wmi_process_tx_comp(struct at
+@@ -6084,13 +6084,13 @@ static int wmi_process_tx_comp(struct at
  	struct ieee80211_tx_info *info;
  	struct ath11k_skb_cb *skb_cb;
  	struct ieee80211_hdr *hdr;
@@ -51,7 +51,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  	spin_lock_bh(&ar->txmgmt_idr_lock);
  	msdu = idr_find(&ar->txmgmt_idr, tx_compl_param->desc_id);
  
-@@ -6053,6 +6053,7 @@ static int wmi_process_tx_comp(struct at
+@@ -6098,6 +6098,7 @@ static int wmi_process_tx_comp(struct at
  		ath11k_warn(ar->ab, "received mgmt tx compl for invalid msdu_id: %d\n",
  			    tx_compl_param->desc_id);
  		spin_unlock_bh(&ar->txmgmt_idr_lock);
@@ -59,7 +59,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  		return -ENOENT;
  	}
  
-@@ -6061,6 +6062,28 @@ static int wmi_process_tx_comp(struct at
+@@ -6106,6 +6107,28 @@ static int wmi_process_tx_comp(struct at
  
  	skb_cb = ATH11K_SKB_CB(msdu);
  	dma_unmap_single(ar->ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
@@ -88,7 +88,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  
  	info = IEEE80211_SKB_CB(msdu);
  	if ((!(info->flags & IEEE80211_TX_CTL_NO_ACK)) &&
-@@ -6076,34 +6099,6 @@ static int wmi_process_tx_comp(struct at
+@@ -6121,34 +6144,6 @@ static int wmi_process_tx_comp(struct at
  	 */
  	info->status.rates[0].idx = -1;
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/318-ath11k-avoid-stack-corrupt-in-nwifi-undecap.patch b/package/kernel/mac80211/patches/nss/ath11k/318-ath11k-avoid-stack-corrupt-in-nwifi-undecap.patch
index 9189729b77f595..770c6dc66456c7 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/318-ath11k-avoid-stack-corrupt-in-nwifi-undecap.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/318-ath11k-avoid-stack-corrupt-in-nwifi-undecap.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.h
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.h
-@@ -9,7 +9,7 @@
+@@ -10,7 +10,7 @@
  #include "rx_desc.h"
  #include "debug.h"
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/330-ath11k-sync-wds_ast_entry-updates.patch b/package/kernel/mac80211/patches/nss/ath11k/330-ath11k-sync-wds_ast_entry-updates.patch
index 61c4cec5189737..4434bd0add243c 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/330-ath11k-sync-wds_ast_entry-updates.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/330-ath11k-sync-wds_ast_entry-updates.patch
@@ -46,7 +46,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/ahb.c
 +++ b/drivers/net/wireless/ath/ath11k/ahb.c
-@@ -1239,6 +1239,7 @@ static void ath11k_ahb_remove_prepare(st
+@@ -1265,6 +1265,7 @@ static void ath11k_ahb_remove_prepare(st
  	set_bit(ATH11K_FLAG_UNREGISTERING, &ab->dev_flags);
  	cancel_work_sync(&ab->restart_work);
  	cancel_work_sync(&ab->qmi.event_work);
@@ -56,7 +56,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  static void ath11k_ahb_free_resources(struct ath11k_base *ab)
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
-@@ -2316,6 +2316,7 @@ struct ath11k_base *ath11k_core_alloc(st
+@@ -2325,6 +2325,7 @@ struct ath11k_base *ath11k_core_alloc(st
  
  	mutex_init(&ab->core_lock);
  	mutex_init(&ab->tbl_mtx_lock);
@@ -64,7 +64,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  	spin_lock_init(&ab->base_lock);
  	mutex_init(&ab->vdev_id_11d_lock);
  	init_completion(&ab->reset_complete);
-@@ -2329,6 +2330,8 @@ struct ath11k_base *ath11k_core_alloc(st
+@@ -2338,6 +2339,8 @@ struct ath11k_base *ath11k_core_alloc(st
  	INIT_WORK(&ab->restart_work, ath11k_core_restart);
  	INIT_WORK(&ab->update_11d_work, ath11k_update_11d);
  	INIT_WORK(&ab->reset_work, ath11k_core_reset);
@@ -83,7 +83,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  #include "fw.h"
  
  #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
-@@ -1130,6 +1131,9 @@ struct ath11k_base {
+@@ -1133,6 +1134,9 @@ struct ath11k_base {
  
  	u32 max_ast_index;
  	u32 num_ast_entries;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/335-0001-ath11k-optimize-tx-completions.patch b/package/kernel/mac80211/patches/nss/ath11k/335-0001-ath11k-optimize-tx-completions.patch
index 34b2537d3e18bf..000e75f1db6ac2 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/335-0001-ath11k-optimize-tx-completions.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/335-0001-ath11k-optimize-tx-completions.patch
@@ -13,7 +13,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/dp_tx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
-@@ -651,9 +651,41 @@ err_out:
+@@ -655,9 +655,41 @@ err_out:
  	spin_unlock_bh(&ab->base_lock);
  }
  
@@ -56,7 +56,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  {
  	struct ieee80211_tx_status status = { 0 };
  	struct ieee80211_rate_status status_rate = { 0 };
-@@ -663,9 +695,11 @@ static void ath11k_dp_tx_complete_msdu(s
+@@ -667,9 +699,11 @@ static void ath11k_dp_tx_complete_msdu(s
  	struct ath11k_peer *peer;
  	struct ath11k_sta *arsta;
  	struct rate_info rate;
@@ -69,7 +69,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  		/* Must not happen */
  		return;
  	}
-@@ -674,11 +708,14 @@ static void ath11k_dp_tx_complete_msdu(s
+@@ -678,11 +712,14 @@ static void ath11k_dp_tx_complete_msdu(s
  
  	dma_unmap_single(ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
  
@@ -86,7 +86,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  		}
  		if (skb_has_frag_list(msdu)) {
  			kfree_skb_list(skb_shinfo(msdu)->frag_list);
-@@ -688,6 +725,8 @@ static void ath11k_dp_tx_complete_msdu(s
+@@ -692,6 +729,8 @@ static void ath11k_dp_tx_complete_msdu(s
  		return;
  	}
  
@@ -95,7 +95,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  	if (unlikely(!rcu_access_pointer(ab->pdevs_active[ar->pdev_idx]))) {
  		ieee80211_free_txskb(ar->hw, msdu);
  		return;
-@@ -704,10 +743,10 @@ static void ath11k_dp_tx_complete_msdu(s
+@@ -708,10 +747,10 @@ static void ath11k_dp_tx_complete_msdu(s
  	/* skip tx rate update from ieee80211_status*/
  	info->status.rates[0].idx = -1;
  
@@ -159,7 +159,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  		spin_unlock_bh(&ab->base_lock);
  		ieee80211_free_txskb(ar->hw, msdu);
  		return;
-@@ -767,37 +806,6 @@ static void ath11k_dp_tx_complete_msdu(s
+@@ -775,37 +814,6 @@ static void ath11k_dp_tx_complete_msdu(s
  	ieee80211_tx_status_ext(ar->hw, &status);
  }
  
@@ -197,7 +197,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  static inline bool ath11k_dp_tx_completion_valid(struct hal_wbm_release_ring *desc)
  {
  	struct htt_tx_wbm_completion *status_desc;
-@@ -821,9 +829,9 @@ void ath11k_dp_tx_completion_handler(str
+@@ -829,9 +837,9 @@ void ath11k_dp_tx_completion_handler(str
  	int hal_ring_id = dp->tx_ring[ring_id].tcl_comp_ring.ring_id, count = 0, i = 0;
  	struct hal_srng *status_ring = &ab->hal.srng_list[hal_ring_id];
  	struct sk_buff *msdu;
@@ -208,7 +208,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  	u32 *desc;
  	u32 msdu_id, desc_id;
  	u8 mac_id;
-@@ -863,14 +871,16 @@ void ath11k_dp_tx_completion_handler(str
+@@ -871,14 +879,16 @@ void ath11k_dp_tx_completion_handler(str
  
  	while (count--) {
  		tx_status = &tx_ring->tx_status[i++];
@@ -227,7 +227,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  			ath11k_dp_tx_process_htt_tx_complete(ab,
  							     (void *)tx_status,
  							     mac_id, msdu_id,
-@@ -894,7 +904,7 @@ void ath11k_dp_tx_completion_handler(str
+@@ -902,7 +912,7 @@ void ath11k_dp_tx_completion_handler(str
  		if (atomic_dec_and_test(&ar->dp.num_tx_pending))
  			wake_up(&ar->dp.tx_empty_waitq);
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/335-0002-ath11k-use-DECLARE_BITMAP-for-idr-operations.patch b/package/kernel/mac80211/patches/nss/ath11k/335-0002-ath11k-use-DECLARE_BITMAP-for-idr-operations.patch
index 4efdbe00c2aa6e..7cff4f768ddc8c 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/335-0002-ath11k-use-DECLARE_BITMAP-for-idr-operations.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/335-0002-ath11k-use-DECLARE_BITMAP-for-idr-operations.patch
@@ -251,7 +251,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  
  	if (unlikely(!msdu)) {
  		ath11k_warn(ab, "htt tx completion for unknown msdu_id %d\n",
-@@ -870,6 +881,7 @@ void ath11k_dp_tx_completion_handler(str
+@@ -878,6 +889,7 @@ void ath11k_dp_tx_completion_handler(str
  	}
  
  	while (count--) {
@@ -259,7 +259,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  		tx_status = &tx_ring->tx_status[i++];
  
  		desc_id = FIELD_GET(BUFFER_ADDR_INFO1_SW_COOKIE,
-@@ -888,17 +900,19 @@ void ath11k_dp_tx_completion_handler(str
+@@ -896,17 +908,19 @@ void ath11k_dp_tx_completion_handler(str
  			continue;
  		}
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch b/package/kernel/mac80211/patches/nss/ath11k/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
index 851a32bc35cf20..0bf4fccf827d79 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
@@ -58,7 +58,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  	tcl_cmd.info3 = FIELD_PREP(HAL_TCL_DATA_CMD_INFO3_DSCP_TID_TABLE_IDX,
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -10727,6 +10727,8 @@ static int __ath11k_mac_register(struct
+@@ -10767,6 +10767,8 @@ static int __ath11k_mac_register(struct
  			ieee80211_hw_set(ar->hw, USES_RSS);
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/336-ath11k-Fix-updating-rx-stats-with-monitor-vif-enable.patch b/package/kernel/mac80211/patches/nss/ath11k/336-ath11k-Fix-updating-rx-stats-with-monitor-vif-enable.patch
index cf0f88068a37b9..730d7487429fee 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/336-ath11k-Fix-updating-rx-stats-with-monitor-vif-enable.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/336-ath11k-Fix-updating-rx-stats-with-monitor-vif-enable.patch
@@ -16,7 +16,7 @@ Signed-off-by: Anilkumar Kolli <quic_akolli@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -5955,12 +5955,23 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -6018,12 +6018,23 @@ int ath11k_dp_rx_process_mon_status(stru
  			pmon->mon_ppdu_status = DP_PPDU_STATUS_START;
  		}
  
@@ -43,7 +43,7 @@ Signed-off-by: Anilkumar Kolli <quic_akolli@quicinc.com>
  		rcu_read_lock();
  		spin_lock_bh(&ab->base_lock);
  		peer = ath11k_peer_find_by_id(ab, ppdu_info->peer_id);
-@@ -6284,6 +6295,13 @@ static int ath11k_dp_full_mon_process_rx
+@@ -6347,6 +6358,13 @@ static int ath11k_dp_full_mon_process_rx
  
  	spin_lock_bh(&pmon->mon_lock);
  
@@ -57,7 +57,7 @@ Signed-off-by: Anilkumar Kolli <quic_akolli@quicinc.com>
  	sw_mon_entries = &pmon->sw_mon_entries;
  	rx_mon_stats = &pmon->rx_mon_stats;
  
-@@ -6323,7 +6341,6 @@ static int ath11k_dp_full_mon_process_rx
+@@ -6386,7 +6404,6 @@ static int ath11k_dp_full_mon_process_rx
  		}
  
  		rx_mon_stats->dest_ppdu_done++;
@@ -65,7 +65,7 @@ Signed-off-by: Anilkumar Kolli <quic_akolli@quicinc.com>
  		pmon->buf_state = DP_MON_STATUS_LAG;
  		pmon->mon_status_paddr = sw_mon_entries->mon_status_paddr;
  		pmon->hold_mon_dst_ring = true;
-@@ -6354,16 +6371,10 @@ reap_status_ring:
+@@ -6417,16 +6434,10 @@ reap_status_ring:
  int ath11k_dp_rx_process_mon_rings(struct ath11k_base *ab, int mac_id,
  				   struct napi_struct *napi, int budget)
  {
diff --git a/package/kernel/mac80211/patches/nss/ath11k/341-ath11k-fix-support-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch b/package/kernel/mac80211/patches/nss/ath11k/341-ath11k-fix-support-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch
index 1a02b0db6ce8bb..dbc2b61dc16b9c 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/341-ath11k-fix-support-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/341-ath11k-fix-support-for-ext-vdev-in-NSS-for-AP_VLAN-v.patch
@@ -38,7 +38,7 @@ Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
-@@ -1932,6 +1932,11 @@ static int ath11k_core_reconfigure_on_cr
+@@ -1944,6 +1944,11 @@ static int ath11k_core_reconfigure_on_cr
  
  	clear_bit(ATH11K_FLAG_CRASH_FLUSH, &ab->dev_flags);
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/356-ath11k-invalid-desc-sanity-check.patch b/package/kernel/mac80211/patches/nss/ath11k/356-ath11k-invalid-desc-sanity-check.patch
index c2980acbe58472..efb38b457b1523 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/356-ath11k-invalid-desc-sanity-check.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/356-ath11k-invalid-desc-sanity-check.patch
@@ -57,7 +57,7 @@ Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
  		spin_unlock_bh(&rx_ring->idr_lock);
  		if (buf_id <= 0)
  			goto fail_dma_unmap;
-@@ -3142,6 +3142,16 @@ try_again:
+@@ -3141,6 +3141,16 @@ try_again:
  	while (likely(desc =
  	      (struct hal_reo_dest_ring *)ath11k_hal_srng_dst_get_next_entry(ab,
  									     srng))) {
@@ -74,7 +74,7 @@ Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
  		cookie = FIELD_GET(BUFFER_ADDR_INFO1_SW_COOKIE,
  				   desc->buf_addr_info.info1);
  		buf_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_BUF_ID,
-@@ -3172,8 +3182,6 @@ try_again:
+@@ -3171,8 +3181,6 @@ try_again:
  
  		num_buffs_reaped[mac_id]++;
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/357-ath11k-fix-clear-peer-keys-during-disassoc.patch b/package/kernel/mac80211/patches/nss/ath11k/357-ath11k-fix-clear-peer-keys-during-disassoc.patch
index 4bb88126851913..ce615da68a16b2 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/357-ath11k-fix-clear-peer-keys-during-disassoc.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/357-ath11k-fix-clear-peer-keys-during-disassoc.patch
@@ -17,7 +17,7 @@ Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -4902,12 +4902,6 @@ static int ath11k_station_disassoc(struc
+@@ -4991,12 +4991,6 @@ static int ath11k_station_disassoc(struc
  			return ret;
  	}
  
@@ -30,7 +30,7 @@ Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
  	return 0;
  }
  
-@@ -10149,6 +10143,17 @@ static int ath11k_mac_op_sta_state(struc
+@@ -10186,6 +10180,17 @@ static int ath11k_mac_op_sta_state(struc
  		arsta->bw = ath11k_mac_ieee80211_sta_bw_to_wmi(ar, sta);
  		arsta->bw_prev = arsta->bw;
  		spin_unlock_bh(&ar->data_lock);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/373-ath11k-Add-retry-mechanism-for-update_rx_qu.patch b/package/kernel/mac80211/patches/nss/ath11k/373-ath11k-Add-retry-mechanism-for-update_rx_qu.patch
index 6510e290c51cf1..487ec5513f18b2 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/373-ath11k-Add-retry-mechanism-for-update_rx_qu.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/373-ath11k-Add-retry-mechanism-for-update_rx_qu.patch
@@ -41,7 +41,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -940,6 +940,9 @@ struct ath11k_soc_dp_stats {
+@@ -943,6 +943,9 @@ struct ath11k_soc_dp_stats {
  	u32 rxdma_error[HAL_REO_ENTR_RING_RXDMA_ECODE_MAX];
  	u32 reo_error[HAL_REO_DEST_RING_ERROR_CODE_MAX];
  	u32 hal_reo_error[DP_REO_DST_RING_MAX];
@@ -74,7 +74,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	if (len > size)
 --- a/drivers/net/wireless/ath/ath11k/dp.c
 +++ b/drivers/net/wireless/ath/ath11k/dp.c
-@@ -1116,8 +1116,10 @@ int ath11k_dp_alloc(struct ath11k_base *
+@@ -1115,8 +1115,10 @@ int ath11k_dp_alloc(struct ath11k_base *
  
  	INIT_LIST_HEAD(&dp->reo_cmd_list);
  	INIT_LIST_HEAD(&dp->reo_cmd_cache_flush_list);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/401-ath11k-Fix-mutex-dead-lock-and-q6-dump-crash.patch b/package/kernel/mac80211/patches/nss/ath11k/401-ath11k-Fix-mutex-dead-lock-and-q6-dump-crash.patch
index 0514302a0d22c9..9f8295e77c56a2 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/401-ath11k-Fix-mutex-dead-lock-and-q6-dump-crash.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/401-ath11k-Fix-mutex-dead-lock-and-q6-dump-crash.patch
@@ -36,7 +36,7 @@ Signed-off-by: Rajat Soni <quic_rajson@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -6496,7 +6496,9 @@ static int ath11k_mac_op_start(struct ie
+@@ -6593,7 +6593,9 @@ static int ath11k_mac_op_start(struct ie
  		break;
  	case ATH11K_STATE_RESTARTING:
  		ar->state = ATH11K_STATE_RESTARTED;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/453-ath11k-flush-management-frames-to-firmware-before-wa.patch b/package/kernel/mac80211/patches/nss/ath11k/453-ath11k-flush-management-frames-to-firmware-before-wa.patch
index ad090f56ba007a..4501664c810371 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/453-ath11k-flush-management-frames-to-firmware-before-wa.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/453-ath11k-flush-management-frames-to-firmware-before-wa.patch
@@ -27,7 +27,7 @@ Signed-off-by: Hari Chandrakanthan <quic_haric@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -8655,6 +8655,8 @@ static int ath11k_mac_flush_tx_complete(
+@@ -8688,6 +8688,8 @@ static int ath11k_mac_flush_tx_complete(
  		ret = -ETIMEDOUT;
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/456-wifi-ath11k-Advertise-TX_QUEUE-mac-hw-flag.patch b/package/kernel/mac80211/patches/nss/ath11k/456-wifi-ath11k-Advertise-TX_QUEUE-mac-hw-flag.patch
index 48696c975db76b..27e1e9506edaa6 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/456-wifi-ath11k-Advertise-TX_QUEUE-mac-hw-flag.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/456-wifi-ath11k-Advertise-TX_QUEUE-mac-hw-flag.patch
@@ -13,7 +13,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -10718,6 +10718,7 @@ static int __ath11k_mac_register(struct
+@@ -10758,6 +10758,7 @@ static int __ath11k_mac_register(struct
  	ieee80211_hw_set(ar->hw, QUEUE_CONTROL);
  	ieee80211_hw_set(ar->hw, SUPPORTS_TX_FRAG);
  	ieee80211_hw_set(ar->hw, REPORTS_LOW_ACK);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/457-wifi-ath11k-Avoid-memset-of-ppdu-info-for-next-skb.patch b/package/kernel/mac80211/patches/nss/ath11k/457-wifi-ath11k-Avoid-memset-of-ppdu-info-for-next-skb.patch
index f2a0b74f627f03..6f02ed6b50a62a 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/457-wifi-ath11k-Avoid-memset-of-ppdu-info-for-next-skb.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/457-wifi-ath11k-Avoid-memset-of-ppdu-info-for-next-skb.patch
@@ -48,7 +48,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -6094,7 +6094,9 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -6089,7 +6089,9 @@ int ath11k_dp_rx_process_mon_status(stru
  	if (!num_buffs_reaped)
  		goto exit;
  
@@ -59,7 +59,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	ppdu_info->peer_id = HAL_INVALID_PEERID;
  
  	while ((skb = __skb_dequeue(&skb_list))) {
-@@ -6112,7 +6114,6 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -6107,7 +6109,6 @@ int ath11k_dp_rx_process_mon_status(stru
  		if (log_type != ATH11K_PKTLOG_TYPE_INVALID)
  			trace_ath11k_htt_rxdesc(ar, skb->data, log_type, rx_buf_sz);
  
@@ -67,7 +67,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  		ppdu_info->peer_id = HAL_INVALID_PEERID;
  		hal_status = ath11k_hal_rx_parse_mon_status(ab, ppdu_info, skb);
  
-@@ -6140,6 +6141,7 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -6135,6 +6136,7 @@ int ath11k_dp_rx_process_mon_status(stru
  		if ((ppdu_info->peer_id == HAL_INVALID_PEERID ||
  		    hal_status != HAL_RX_MON_STATUS_PPDU_DONE)) {
  			dev_kfree_skb_any(skb);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/908-ath11k-make-debugfs-sta-htt-stats-modular.patch b/package/kernel/mac80211/patches/nss/ath11k/908-ath11k-make-debugfs-sta-htt-stats-modular.patch
index 3ebad50617b79b..21cd546db8f07d 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/908-ath11k-make-debugfs-sta-htt-stats-modular.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/908-ath11k-make-debugfs-sta-htt-stats-modular.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath11k/Kconfig
 +++ b/drivers/net/wireless/ath/ath11k/Kconfig
-@@ -80,6 +80,24 @@ config ATH11K_DEBUGFS
+@@ -81,6 +81,24 @@ config ATH11K_DEBUGFS
  
  	  If unsure, say Y to make it easier to debug problems.
  
@@ -27,9 +27,9 @@
  	depends on ATH11K && EVENT_TRACING
 --- a/drivers/net/wireless/ath/ath11k/Makefile
 +++ b/drivers/net/wireless/ath/ath11k/Makefile
-@@ -20,7 +20,9 @@ ath11k-y += core.o \
- 	    pcic.o \
- 	    fw.o
+@@ -21,7 +21,9 @@ ath11k-y += core.o \
+ 	    fw.o \
+ 	    p2p.o
  
 -ath11k-$(CPTCFG_ATH11K_DEBUGFS) += debugfs.o debugfs_htt_stats.o debugfs_sta.o
 +ath11k-$(CPTCFG_ATH11K_DEBUGFS) += debugfs.o
@@ -153,7 +153,7 @@
  #include "hw.h"
  #include "peer.h"
  #include "mac.h"
-@@ -550,7 +552,9 @@ static void ath11k_dp_tx_cache_peer_stat
+@@ -554,7 +556,9 @@ static void ath11k_dp_tx_cache_peer_stat
  void ath11k_dp_tx_update_txcompl(struct ath11k *ar, struct hal_tx_status *ts)
  {
  	struct ath11k_base *ab = ar->ab;
@@ -163,7 +163,7 @@
  	enum hal_tx_rate_stats_pkt_type pkt_type;
  	enum hal_tx_rate_stats_sgi sgi;
  	enum hal_tx_rate_stats_bw bw;
-@@ -639,8 +643,10 @@ void ath11k_dp_tx_update_txcompl(struct
+@@ -643,8 +647,10 @@ void ath11k_dp_tx_update_txcompl(struct
  			ath11k_mac_he_ru_tones_to_nl80211_he_ru_alloc(ru_tones);
  	}
  
@@ -176,7 +176,7 @@
  	spin_unlock_bh(&ab->base_lock);
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -10327,7 +10327,7 @@ static const struct ieee80211_ops ath11k
+@@ -10364,7 +10364,7 @@ static const struct ieee80211_ops ath11k
  	.set_wakeup			= ath11k_wow_op_set_wakeup,
  #endif
  
@@ -187,7 +187,7 @@
  #endif
 --- a/local-symbols
 +++ b/local-symbols
-@@ -169,6 +169,8 @@ ATH11K_MEM_PROFILE_256M=
+@@ -171,6 +171,8 @@ ATH11K_MEM_PROFILE_256M=
  ATH11K_MEM_PROFILE_512M=
  ATH11K_DEBUG=
  ATH11K_DEBUGFS=
diff --git a/package/kernel/mac80211/patches/nss/ath11k/910-wifi-ath11k-Add-lock-when-accessing-idr_pool-of-tx_r.patch b/package/kernel/mac80211/patches/nss/ath11k/910-wifi-ath11k-Add-lock-when-accessing-idr_pool-of-tx_r.patch
index 38188636a58cd4..3bcd37c665dff7 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/910-wifi-ath11k-Add-lock-when-accessing-idr_pool-of-tx_r.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/910-wifi-ath11k-Add-lock-when-accessing-idr_pool-of-tx_r.patch
@@ -58,7 +58,7 @@ Signed-off-by: Aishwarya R <quic_aisr@quicinc.com>
  
  	if (unlikely(!msdu)) {
  		ath11k_warn(ab, "htt tx completion for unknown msdu_id %d\n",
-@@ -890,12 +896,14 @@ void ath11k_dp_tx_completion_handler(str
+@@ -898,12 +904,14 @@ void ath11k_dp_tx_completion_handler(str
  			continue;
  		}
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch b/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
index 4677e45f7c279a..ed4dc540b14ec9 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
@@ -228,7 +228,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  static void ath11k_dp_service_mon_ring(struct timer_list *t)
  {
  	struct ath11k_base *ab = from_timer(ab, t, mon_reap_timer);
-@@ -2390,6 +2425,49 @@ int ath11k_dp_rx_crypto_icv_len(struct a
+@@ -2389,6 +2424,49 @@ int ath11k_dp_rx_crypto_icv_len(struct a
  	return 0;
  }
  
@@ -278,7 +278,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  static void ath11k_dp_rx_h_undecap_nwifi(struct ath11k *ar,
  					 struct sk_buff *msdu,
  					 u8 *first_hdr,
-@@ -2403,7 +2481,8 @@ static void ath11k_dp_rx_h_undecap_nwifi
+@@ -2402,7 +2480,8 @@ static void ath11k_dp_rx_h_undecap_nwifi
  	u8 da[ETH_ALEN];
  	u8 sa[ETH_ALEN];
  	u16 qos_ctl = 0;
@@ -288,7 +288,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  	/* copy SA & DA and pull decapped header */
  	hdr = (struct ieee80211_hdr *)msdu->data;
-@@ -2412,7 +2491,7 @@ static void ath11k_dp_rx_h_undecap_nwifi
+@@ -2411,7 +2490,7 @@ static void ath11k_dp_rx_h_undecap_nwifi
  	ether_addr_copy(sa, ieee80211_get_SA(hdr));
  	skb_pull(msdu, ieee80211_hdrlen(hdr->frame_control));
  
@@ -297,7 +297,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		/* original 802.11 header is valid for the first msdu
  		 * hence we can reuse the same header
  		 */
-@@ -2442,16 +2521,23 @@ static void ath11k_dp_rx_h_undecap_nwifi
+@@ -2441,16 +2520,23 @@ static void ath11k_dp_rx_h_undecap_nwifi
  
  		/* copy decap header before overwriting for reuse below */
  		memcpy(decap_hdr, (uint8_t *)hdr, hdr_len);
@@ -326,7 +326,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		memcpy(skb_push(msdu,
  				IEEE80211_QOS_CTL_LEN), &qos_ctl,
  				IEEE80211_QOS_CTL_LEN);
-@@ -2567,6 +2653,20 @@ static void ath11k_dp_rx_h_undecap_eth(s
+@@ -2566,6 +2652,20 @@ static void ath11k_dp_rx_h_undecap_eth(s
  	u8 da[ETH_ALEN];
  	u8 sa[ETH_ALEN];
  	void *rfc1042;
@@ -347,7 +347,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  	rfc1042 = ath11k_dp_rx_h_find_rfc1042(ar, msdu, enctype);
  	if (WARN_ON_ONCE(!rfc1042))
-@@ -2595,6 +2695,7 @@ static void ath11k_dp_rx_h_undecap_eth(s
+@@ -2594,6 +2694,7 @@ static void ath11k_dp_rx_h_undecap_eth(s
  
  	memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
  
@@ -355,7 +355,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	/* original 802.11 header has a different DA and in
  	 * case of 4addr it may also have different SA
  	 */
-@@ -2613,6 +2714,7 @@ static void ath11k_dp_rx_h_undecap_snap(
+@@ -2612,6 +2713,7 @@ static void ath11k_dp_rx_h_undecap_snap(
  	size_t hdr_len;
  	u8 l3_pad_bytes;
  	struct hal_rx_desc *rx_desc;
@@ -363,7 +363,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  	/* Delivered decapped frame:
  	 * [amsdu header] <-- replaced with 802.11 hdr
-@@ -2626,6 +2728,11 @@ static void ath11k_dp_rx_h_undecap_snap(
+@@ -2625,6 +2727,11 @@ static void ath11k_dp_rx_h_undecap_snap(
  	skb_put(msdu, l3_pad_bytes);
  	skb_pull(msdu, sizeof(struct ath11k_dp_amsdu_subframe_hdr) + l3_pad_bytes);
  
@@ -375,7 +375,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	hdr = (struct ieee80211_hdr *)first_hdr;
  	hdr_len = ieee80211_hdrlen(hdr->frame_control);
  
-@@ -3099,6 +3206,20 @@ static int ath11k_dp_rx_process_msdu(str
+@@ -3098,6 +3205,20 @@ static int ath11k_dp_rx_process_msdu(str
  		goto free_out;
  	}
  
@@ -396,7 +396,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	rxcb = ATH11K_SKB_RXCB(msdu);
  	rxcb->rx_desc = rx_desc;
  	msdu_len = ath11k_dp_rx_h_msdu_start_msdu_len(ab, rx_desc);
-@@ -3111,8 +3232,9 @@ static int ath11k_dp_rx_process_msdu(str
+@@ -3110,8 +3231,9 @@ static int ath11k_dp_rx_process_msdu(str
  			hdr_status = ath11k_dp_rx_h_80211_hdr(ab, rx_desc);
  			ret = -EINVAL;
  			ath11k_warn(ab, "invalid msdu len %u\n", msdu_len);
@@ -408,7 +408,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  			ath11k_dbg_dump(ab, ATH11K_DBG_DATA, NULL, "", rx_desc,
  					sizeof(struct hal_rx_desc));
  			goto free_out;
-@@ -4075,6 +4197,7 @@ static int ath11k_dp_rx_h_verify_tkip_mi
+@@ -4070,6 +4192,7 @@ static int ath11k_dp_rx_h_verify_tkip_mi
  
  	hdr = (struct ieee80211_hdr *)(msdu->data + hal_rx_desc_sz);
  	hdr_len = ieee80211_hdrlen(hdr->frame_control);
@@ -416,7 +416,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	head_len = hdr_len + hal_rx_desc_sz + IEEE80211_TKIP_IV_LEN;
  	tail_len = IEEE80211_CCMP_MIC_LEN + IEEE80211_TKIP_ICV_LEN + FCS_LEN;
  
-@@ -4355,8 +4478,8 @@ static void ath11k_dp_rx_h_sort_frags(st
+@@ -4350,8 +4473,8 @@ static void ath11k_dp_rx_h_sort_frags(st
  
  static u64 ath11k_dp_rx_h_get_pn(struct ath11k *ar, struct sk_buff *skb)
  {
@@ -426,7 +426,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	u8 *ehdr;
  	u32 hal_rx_desc_sz = ar->ab->hw_params.hal_desc_sz;
  
-@@ -4586,8 +4709,9 @@ ath11k_dp_process_rx_err_buf(struct ath1
+@@ -4581,8 +4704,9 @@ ath11k_dp_process_rx_err_buf(struct ath1
  	if ((msdu_len + hal_rx_desc_sz) > DP_RX_BUFFER_SIZE) {
  		hdr_status = ath11k_dp_rx_h_80211_hdr(ar->ab, rx_desc);
  		ath11k_warn(ar->ab, "invalid msdu leng %u", msdu_len);
@@ -438,7 +438,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "", rx_desc,
  				sizeof(struct hal_rx_desc));
  		dev_kfree_skb_any(msdu);
-@@ -5212,6 +5336,47 @@ void ath11k_dp_rx_pdev_free(struct ath11
+@@ -5207,6 +5331,47 @@ void ath11k_dp_rx_pdev_free(struct ath11
  	ath11k_dp_rxdma_pdev_buf_free(ar);
  }
  
@@ -486,7 +486,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  int ath11k_dp_rx_pdev_alloc(struct ath11k_base *ab, int mac_id)
  {
  	struct ath11k *ar = ab->pdevs[mac_id].ar;
-@@ -5305,6 +5470,12 @@ config_refill_ring:
+@@ -5300,6 +5465,12 @@ config_refill_ring:
  		}
  	}
  
@@ -501,7 +501,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
 --- a/drivers/net/wireless/ath/ath11k/dp_tx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
-@@ -1275,6 +1275,8 @@ int ath11k_dp_tx_htt_rx_filter_setup(str
+@@ -1283,6 +1283,8 @@ int ath11k_dp_tx_htt_rx_filter_setup(str
  				 !!(params.flags & HAL_SRNG_FLAGS_MSI_SWAP));
  	cmd->info0 |= FIELD_PREP(HTT_RX_RING_SELECTION_CFG_CMD_INFO0_PS,
  				 !!(params.flags & HAL_SRNG_FLAGS_DATA_TLV_SWAP));
@@ -510,7 +510,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  	cmd->info1 = FIELD_PREP(HTT_RX_RING_SELECTION_CFG_CMD_INFO1_BUF_SIZE,
  				rx_buf_size);
-@@ -1284,6 +1286,26 @@ int ath11k_dp_tx_htt_rx_filter_setup(str
+@@ -1292,6 +1294,26 @@ int ath11k_dp_tx_htt_rx_filter_setup(str
  	cmd->pkt_type_en_flags3 = tlv_filter->pkt_filter_flags3;
  	cmd->rx_filter_tlv = tlv_filter->rx_filter;
  
@@ -537,7 +537,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  	ret = ath11k_htc_send(&ab->htc, ab->dp.eid, skb);
  	if (ret)
  		goto err_free;
-@@ -1362,6 +1384,7 @@ int ath11k_dp_tx_htt_monitor_mode_ring_c
+@@ -1370,6 +1392,7 @@ int ath11k_dp_tx_htt_monitor_mode_ring_c
  	}
  
  	ring_id = dp->rxdma_mon_buf_ring.refill_buf_ring.ring_id;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-336-0001-ath11k-idr-optimization.patch b/package/kernel/mac80211/patches/nss/ath11k/999-336-0001-ath11k-idr-optimization.patch
index 2c74d53d7d31f0..abcc7a197e4300 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-336-0001-ath11k-idr-optimization.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-336-0001-ath11k-idr-optimization.patch
@@ -28,7 +28,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  }
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -3386,18 +3386,16 @@ try_again:
+@@ -3385,18 +3385,16 @@ try_again:
  		ar = ab->pdevs[mac_id].ar;
  		rx_ring = &ar->dp.rx_refill_buf_ring;
  		spin_lock_bh(&rx_ring->idr_lock);
@@ -50,7 +50,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  		dma_unmap_single(ab->dev, rxcb->paddr,
  				 msdu->len + skb_tailroom(msdu),
  				 DMA_FROM_DEVICE);
-@@ -4672,17 +4670,14 @@ ath11k_dp_process_rx_err_buf(struct ath1
+@@ -4667,17 +4665,14 @@ ath11k_dp_process_rx_err_buf(struct ath1
  	u32 hal_rx_desc_sz = ar->ab->hw_params.hal_desc_sz;
  
  	spin_lock_bh(&rx_ring->idr_lock);
@@ -70,7 +70,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	rxcb = ATH11K_SKB_RXCB(msdu);
  	dma_unmap_single(ar->ab->dev, rxcb->paddr,
  			 msdu->len + skb_tailroom(msdu),
-@@ -5088,18 +5083,16 @@ int ath11k_dp_rx_process_wbm_err(struct
+@@ -5083,18 +5078,16 @@ int ath11k_dp_rx_process_wbm_err(struct
  		rx_ring = &ar->dp.rx_refill_buf_ring;
  
  		spin_lock_bh(&rx_ring->idr_lock);
@@ -92,7 +92,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  		dma_unmap_single(ab->dev, rxcb->paddr,
  				 msdu->len + skb_tailroom(msdu),
  				 DMA_FROM_DEVICE);
-@@ -5214,16 +5207,14 @@ int ath11k_dp_process_rxdma_err(struct a
+@@ -5209,16 +5202,14 @@ int ath11k_dp_process_rxdma_err(struct a
  					   msdu_cookies[i]);
  
  			spin_lock_bh(&rx_ring->idr_lock);
@@ -111,7 +111,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  
  			rxcb = ATH11K_SKB_RXCB(skb);
  			dma_unmap_single(ab->dev, rxcb->paddr,
-@@ -6428,16 +6419,14 @@ ath11k_dp_rx_full_mon_mpdu_pop(struct at
+@@ -6423,16 +6414,14 @@ ath11k_dp_rx_full_mon_mpdu_pop(struct at
  					   msdu_list.sw_cookie[i]);
  
  			spin_lock_bh(&rx_ring->idr_lock);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch b/package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch
index dad3b759888b35..0cccb5e5bcf025 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch
@@ -18,7 +18,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -700,6 +700,11 @@ struct ath11k_per_peer_tx_stats {
+@@ -703,6 +703,11 @@ struct ath11k_per_peer_tx_stats {
  #define ATH11K_FLUSH_TIMEOUT (5 * HZ)
  #define ATH11K_VDEV_DELETE_TIMEOUT_HZ (5 * HZ)
  
@@ -30,7 +30,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  struct ath11k {
  	struct ath11k_base *ab;
  	struct ath11k_pdev *pdev;
-@@ -849,6 +854,7 @@ struct ath11k {
+@@ -852,6 +857,7 @@ struct ath11k {
  	bool ps_state_enable;
  	bool ps_timekeeper_enable;
  	s8 max_allowed_tx_power;
@@ -40,7 +40,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  struct ath11k_band_cap {
 --- a/drivers/net/wireless/ath/ath11k/dp.c
 +++ b/drivers/net/wireless/ath/ath11k/dp.c
-@@ -911,7 +911,7 @@ int ath11k_dp_service_srng(struct ath11k
+@@ -910,7 +910,7 @@ int ath11k_dp_service_srng(struct ath11k
  
  				hal_params = ab->hw_params.hal_params;
  				ath11k_dp_rxbufs_replenish(ab, id, rx_ring, 0,
@@ -114,7 +114,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	return 0;
  }
  
-@@ -3348,11 +3367,14 @@ int ath11k_dp_process_rx(struct ath11k_b
+@@ -3347,11 +3366,14 @@ int ath11k_dp_process_rx(struct ath11k_b
  	struct ath11k *ar;
  	struct hal_reo_dest_ring *desc;
  	enum hal_reo_dest_ring_push_reason push_reason;
@@ -130,7 +130,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  
  	srng = &ab->hal.srng_list[dp->reo_dst_ring[ring_id].ring_id];
  
-@@ -3385,8 +3407,15 @@ try_again:
+@@ -3384,8 +3406,15 @@ try_again:
  
  		ar = ab->pdevs[mac_id].ar;
  		rx_ring = &ar->dp.rx_refill_buf_ring;
@@ -147,7 +147,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  		spin_unlock_bh(&rx_ring->idr_lock);
  		if (unlikely(!msdu)) {
  			ath11k_warn(ab, "frame rx with invalid buf_id %d\n",
-@@ -3464,9 +3493,12 @@ try_again:
+@@ -3463,9 +3492,12 @@ try_again:
  		rx_ring = &ar->dp.rx_refill_buf_ring;
  
  		ath11k_dp_rxbufs_replenish(ab, i, rx_ring, num_buffs_reaped[i],
@@ -161,7 +161,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	return total_msdu_reaped;
  }
  
-@@ -4832,7 +4864,7 @@ exit:
+@@ -4827,7 +4859,7 @@ exit:
  		rx_ring = &ar->dp.rx_refill_buf_ring;
  
  		ath11k_dp_rxbufs_replenish(ab, i, rx_ring, n_bufs_reaped[i],
@@ -170,7 +170,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	}
  
  	return tot_n_bufs_reaped;
-@@ -5048,14 +5080,17 @@ int ath11k_dp_rx_process_wbm_err(struct
+@@ -5043,14 +5075,17 @@ int ath11k_dp_rx_process_wbm_err(struct
  	struct sk_buff *msdu;
  	struct sk_buff_head msdu_list[MAX_RADIOS];
  	struct ath11k_skb_rxcb *rxcb;
@@ -189,7 +189,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  
  	srng = &ab->hal.srng_list[dp->rx_rel_ring.ring_id];
  
-@@ -5081,9 +5116,15 @@ int ath11k_dp_rx_process_wbm_err(struct
+@@ -5076,9 +5111,15 @@ int ath11k_dp_rx_process_wbm_err(struct
  
  		ar = ab->pdevs[mac_id].ar;
  		rx_ring = &ar->dp.rx_refill_buf_ring;
@@ -206,7 +206,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  		spin_unlock_bh(&rx_ring->idr_lock);
  		if (!msdu) {
  			ath11k_warn(ab, "frame rx with invalid buf_id %d pdev %d\n",
-@@ -5128,7 +5169,7 @@ int ath11k_dp_rx_process_wbm_err(struct
+@@ -5123,7 +5164,7 @@ int ath11k_dp_rx_process_wbm_err(struct
  		rx_ring = &ar->dp.rx_refill_buf_ring;
  
  		ath11k_dp_rxbufs_replenish(ab, i, rx_ring, num_buffs_reaped[i],
@@ -215,7 +215,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	}
  
  	rcu_read_lock();
-@@ -5150,6 +5191,8 @@ int ath11k_dp_rx_process_wbm_err(struct
+@@ -5145,6 +5186,8 @@ int ath11k_dp_rx_process_wbm_err(struct
  	}
  	rcu_read_unlock();
  done:
@@ -224,7 +224,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	return total_num_buffs_reaped;
  }
  
-@@ -5235,7 +5278,7 @@ int ath11k_dp_process_rxdma_err(struct a
+@@ -5230,7 +5273,7 @@ int ath11k_dp_process_rxdma_err(struct a
  
  	if (num_buf_freed)
  		ath11k_dp_rxbufs_replenish(ab, mac_id, rx_ring, num_buf_freed,
@@ -233,7 +233,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  
  	return budget - quota;
  }
-@@ -6181,12 +6224,12 @@ static void ath11k_dp_rx_mon_dest_proces
+@@ -6176,12 +6219,12 @@ static void ath11k_dp_rx_mon_dest_proces
  			ath11k_dp_rxbufs_replenish(ar->ab, dp->mac_id,
  						   &dp->rxdma_mon_buf_ring,
  						   rx_bufs_used,
@@ -248,7 +248,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  	}
  }
  
-@@ -6696,7 +6739,7 @@ next_entry:
+@@ -6691,7 +6734,7 @@ next_entry:
  		ath11k_dp_rxbufs_replenish(ar->ab, dp->mac_id,
  					   &dp->rxdma_mon_buf_ring,
  					   rx_bufs_used,
@@ -259,7 +259,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  reap_status_ring:
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.h
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.h
-@@ -11,6 +11,8 @@
+@@ -12,6 +12,8 @@
  
  #define DP_MAX_NWIFI_HDR_LEN	36
  
@@ -268,7 +268,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  #define DP_RX_MPDU_ERR_FCS			BIT(0)
  #define DP_RX_MPDU_ERR_DECRYPT			BIT(1)
  #define DP_RX_MPDU_ERR_TKIP_MIC			BIT(2)
-@@ -125,7 +127,8 @@ int ath11k_dp_process_rx(struct ath11k_b
+@@ -126,7 +128,8 @@ int ath11k_dp_process_rx(struct ath11k_b
  int ath11k_dp_rxbufs_replenish(struct ath11k_base *ab, int mac_id,
  			       struct dp_rxdma_ring *rx_ring,
  			       int req_entries,
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-374-ath11k-Check-skb_headroom-before-using-skb_push.patch b/package/kernel/mac80211/patches/nss/ath11k/999-374-ath11k-Check-skb_headroom-before-using-skb_push.patch
index 513d975954823a..988717c1dbc257 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-374-ath11k-Check-skb_headroom-before-using-skb_push.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-374-ath11k-Check-skb_headroom-before-using-skb_push.patch
@@ -35,7 +35,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -2455,16 +2455,27 @@ static void ath11k_get_dot11_hdr_from_rx
+@@ -2454,16 +2454,27 @@ static void ath11k_get_dot11_hdr_from_rx
  	size_t hdr_len, crypto_len;
  	struct ieee80211_hdr *hdr;
  	u16 fc, qos_ctl = 0;
@@ -63,7 +63,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	skb_push(msdu, hdr_len);
  	hdr = (struct ieee80211_hdr *)msdu->data;
  	hdr->frame_control = fc;
-@@ -2500,6 +2511,7 @@ static void ath11k_dp_rx_h_undecap_nwifi
+@@ -2499,6 +2510,7 @@ static void ath11k_dp_rx_h_undecap_nwifi
  	u8 da[ETH_ALEN];
  	u8 sa[ETH_ALEN];
  	u16 qos_ctl = 0;
@@ -71,7 +71,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	u8 *qos, *crypto_hdr;
  	bool add_qos_ctrl = false;
  
-@@ -2544,26 +2556,46 @@ static void ath11k_dp_rx_h_undecap_nwifi
+@@ -2543,26 +2555,46 @@ static void ath11k_dp_rx_h_undecap_nwifi
  	}
  
  	if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
@@ -123,7 +123,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
  
  	/* original 802.11 header has a different DA and in
-@@ -2672,6 +2704,7 @@ static void ath11k_dp_rx_h_undecap_eth(s
+@@ -2671,6 +2703,7 @@ static void ath11k_dp_rx_h_undecap_eth(s
  	u8 da[ETH_ALEN];
  	u8 sa[ETH_ALEN];
  	void *rfc1042;
@@ -131,7 +131,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
  	struct ath11k_dp_rfc1042_hdr rfc = {0xaa, 0xaa, 0x03, {0x00, 0x00, 0x00}};
  
-@@ -2681,6 +2714,11 @@ static void ath11k_dp_rx_h_undecap_eth(s
+@@ -2680,6 +2713,11 @@ static void ath11k_dp_rx_h_undecap_eth(s
  		ether_addr_copy(sa, eth->h_source);
  		rfc.snap_type = eth->h_proto;
  		skb_pull(msdu, sizeof(struct ethhdr));
@@ -143,7 +143,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  		memcpy(skb_push(msdu, sizeof(struct ath11k_dp_rfc1042_hdr)), &rfc,
  		       sizeof(struct ath11k_dp_rfc1042_hdr));
  		ath11k_get_dot11_hdr_from_rx_desc(ar, msdu, rxcb, status, enctype);
-@@ -2698,6 +2736,11 @@ static void ath11k_dp_rx_h_undecap_eth(s
+@@ -2697,6 +2735,11 @@ static void ath11k_dp_rx_h_undecap_eth(s
  	skb_pull(msdu, sizeof(struct ethhdr));
  
  	/* push rfc1042/llc/snap */
@@ -155,7 +155,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	memcpy(skb_push(msdu, sizeof(struct ath11k_dp_rfc1042_hdr)), rfc1042,
  	       sizeof(struct ath11k_dp_rfc1042_hdr));
  
-@@ -2706,12 +2749,22 @@ static void ath11k_dp_rx_h_undecap_eth(s
+@@ -2705,12 +2748,22 @@ static void ath11k_dp_rx_h_undecap_eth(s
  	hdr_len = ieee80211_hdrlen(hdr->frame_control);
  
  	if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
@@ -182,7 +182,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
  
  exit:
-@@ -2732,6 +2785,7 @@ static void ath11k_dp_rx_h_undecap_snap(
+@@ -2731,6 +2784,7 @@ static void ath11k_dp_rx_h_undecap_snap(
  	struct ieee80211_hdr *hdr;
  	size_t hdr_len;
  	u8 l3_pad_bytes;
@@ -190,7 +190,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	struct hal_rx_desc *rx_desc;
  	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
  
-@@ -2756,12 +2810,22 @@ static void ath11k_dp_rx_h_undecap_snap(
+@@ -2755,12 +2809,22 @@ static void ath11k_dp_rx_h_undecap_snap(
  	hdr_len = ieee80211_hdrlen(hdr->frame_control);
  
  	if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
@@ -217,7 +217,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
  }
  
-@@ -2890,7 +2954,7 @@ static void ath11k_dp_rx_h_mpdu(struct a
+@@ -2889,7 +2953,7 @@ static void ath11k_dp_rx_h_mpdu(struct a
  				struct ieee80211_rx_status *rx_status,
  				bool *fast_rx)
  {
@@ -226,7 +226,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	enum hal_encrypt_type enctype;
  	bool is_decrypted = false;
  	struct ath11k_skb_rxcb *rxcb;
-@@ -3123,10 +3187,16 @@ static void ath11k_dp_rx_deliver_msdu(st
+@@ -3122,10 +3186,16 @@ static void ath11k_dp_rx_deliver_msdu(st
  	u8 decap = DP_RX_DECAP_TYPE_RAW;
  	bool is_mcbc = rxcb->is_mcbc;
  	bool is_eapol = rxcb->is_eapol;
@@ -243,7 +243,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  		he = skb_push(msdu, sizeof(known));
  		memcpy(he, &known, sizeof(known));
  		status->flag |= RX_FLAG_RADIOTAP_HE;
-@@ -3182,6 +3252,7 @@ static void ath11k_dp_rx_deliver_msdu(st
+@@ -3181,6 +3251,7 @@ static void ath11k_dp_rx_deliver_msdu(st
  	    !(is_mcbc && rx_status->flag & RX_FLAG_DECRYPTED))
  		rx_status->flag |= RX_FLAG_8023;
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-783-001-wifi-ath11k-Fix-BCCA-counter-for-EMA.patch b/package/kernel/mac80211/patches/nss/ath11k/999-783-001-wifi-ath11k-Fix-BCCA-counter-for-EMA.patch
index 54269c2dcac5b2..1a852aa2c822f2 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-783-001-wifi-ath11k-Fix-BCCA-counter-for-EMA.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-783-001-wifi-ath11k-Fix-BCCA-counter-for-EMA.patch
@@ -60,7 +60,7 @@ Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
  				 enum wmi_sta_keepalive_method method,
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
-@@ -1874,9 +1874,10 @@ int ath11k_wmi_bcn_tmpl(struct ath11k *a
+@@ -1918,9 +1918,10 @@ int ath11k_wmi_bcn_tmpl(struct ath11k *a
  	cmd->vdev_id = vdev_id;
  	cmd->tim_ie_offset = offs->tim_offset;
  
@@ -72,7 +72,7 @@ Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
  	}
  
  	cmd->buf_len = bcn->len;
-@@ -7567,7 +7568,6 @@ static void ath11k_bcn_tx_status_event(s
+@@ -7612,7 +7613,6 @@ static void ath11k_bcn_tx_status_event(s
  		rcu_read_unlock();
  		return;
  	}
@@ -80,7 +80,7 @@ Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
  	rcu_read_unlock();
  }
  
-@@ -8481,10 +8481,7 @@ ath11k_wmi_process_csa_switch_count_even
+@@ -8526,10 +8526,7 @@ ath11k_wmi_process_csa_switch_count_even
  {
  	int i;
  	struct ath11k_vif *arvif;
@@ -92,7 +92,7 @@ Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
  
  	rcu_read_lock();
  	for (i = 0; i < ev->num_vdevs; i++) {
-@@ -8496,8 +8493,18 @@ ath11k_wmi_process_csa_switch_count_even
+@@ -8541,8 +8538,18 @@ ath11k_wmi_process_csa_switch_count_even
  			continue;
  		}
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-802-ath11k-fixup-thermal-throttle.patch b/package/kernel/mac80211/patches/nss/ath11k/999-802-ath11k-fixup-thermal-throttle.patch
index 719fd02867944f..b40066e24dbd83 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-802-ath11k-fixup-thermal-throttle.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-802-ath11k-fixup-thermal-throttle.patch
@@ -137,7 +137,7 @@
  #define ATH11K_HWMON_NAME_LEN           15
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
-@@ -3193,6 +3193,7 @@ ath11k_wmi_send_thermal_mitigation_param
+@@ -3237,6 +3237,7 @@ ath11k_wmi_send_thermal_mitigation_param
  		lvl_conf->temp_hwm = param->levelconf[i].tmphwm;
  		lvl_conf->dc_off_percent = param->levelconf[i].dcoffpercent;
  		lvl_conf->prio = param->levelconf[i].priority;
@@ -147,7 +147,7 @@
  
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
-@@ -4053,12 +4053,14 @@ struct wmi_11d_new_cc_ev {
+@@ -4059,12 +4059,14 @@ struct wmi_11d_new_cc_ev {
  	u32 new_alpha2;
  } __packed;
  
@@ -163,7 +163,7 @@
  };
  
  struct thermal_mitigation_params {
-@@ -4069,6 +4071,14 @@ struct thermal_mitigation_params {
+@@ -4075,6 +4077,14 @@ struct thermal_mitigation_params {
  	struct tt_level_config levelconf[THERMAL_LEVELS];
  };
  
@@ -178,7 +178,7 @@
  struct wmi_therm_throt_config_request_cmd {
  	u32 tlv_header;
  	u32 pdev_id;
-@@ -4076,14 +4086,48 @@ struct wmi_therm_throt_config_request_cm
+@@ -4082,14 +4092,48 @@ struct wmi_therm_throt_config_request_cm
  	u32 dc;
  	u32 dc_per_event;
  	u32 therm_throt_levels;
@@ -229,7 +229,7 @@
  struct wmi_delba_send_cmd {
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -6586,6 +6586,9 @@ static int ath11k_mac_op_start(struct ie
+@@ -6683,6 +6683,9 @@ static int ath11k_mac_op_start(struct ie
  		}
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch b/package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch
index e75a70988502a6..92fdd794e40bc4 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
-@@ -2041,10 +2041,10 @@ void ath11k_core_pre_reconfigure_recover
+@@ -2050,10 +2050,10 @@ void ath11k_core_pre_reconfigure_recover
  		ar->monitor_vdev_id = -1;
  		clear_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags);
  		clear_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags);
@@ -12,7 +12,7 @@
  
  	reinit_completion(&ab->driver_recovery);
  }
-@@ -2320,7 +2320,6 @@ struct ath11k_base *ath11k_core_alloc(st
+@@ -2329,7 +2329,6 @@ struct ath11k_base *ath11k_core_alloc(st
  		goto err_free_wq;
  
  	mutex_init(&ab->core_lock);
@@ -20,7 +20,7 @@
  	mutex_init(&ab->base_ast_lock);
  	spin_lock_init(&ab->base_lock);
  	mutex_init(&ab->vdev_id_11d_lock);
-@@ -2328,8 +2327,6 @@ struct ath11k_base *ath11k_core_alloc(st
+@@ -2337,8 +2336,6 @@ struct ath11k_base *ath11k_core_alloc(st
  	init_completion(&ab->reconfigure_complete);
  	init_completion(&ab->recovery_start);
  
@@ -31,7 +31,7 @@
  	INIT_WORK(&ab->restart_work, ath11k_core_restart);
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -737,9 +737,22 @@ struct ath11k {
+@@ -740,9 +740,22 @@ struct ath11k {
  			iftype[NUM_NL80211_BANDS][NUM_NL80211_IFTYPES];
  	} mac;
  
@@ -54,7 +54,7 @@
  	u32 min_tx_power;
  	u32 max_tx_power;
  	u32 txpower_limit_2g;
-@@ -817,6 +830,9 @@ struct ath11k {
+@@ -820,6 +833,9 @@ struct ath11k {
  	struct work_struct wmi_mgmt_tx_work;
  	struct sk_buff_head wmi_mgmt_tx_queue;
  
@@ -64,7 +64,7 @@
  	struct ath11k_wow wow;
  	struct completion target_suspend;
  	bool target_suspend_ack;
-@@ -1020,19 +1036,7 @@ struct ath11k_base {
+@@ -1023,19 +1039,7 @@ struct ath11k_base {
  	struct ath11k_hal_reg_capabilities_ext hal_reg_cap[MAX_RADIOS];
  	unsigned long long free_vdev_map;
  
@@ -84,7 +84,7 @@
  	u8 mac_addr[ETH_ALEN];
  	int userpd_id;
  	int irq_num[ATH11K_IRQ_NUM_MAX];
-@@ -1409,4 +1413,36 @@ static inline const char *ath11k_bus_str
+@@ -1412,4 +1416,36 @@ static inline const char *ath11k_bus_str
  	return "unknown";
  }
  
@@ -152,7 +152,7 @@
  	if (!peer) {
  		ath11k_warn(ab, "failed to lookup peer %pM on vdev %d\n",
  			    addr, vdev_id);
-@@ -90,7 +90,7 @@ int ath11k_dp_peer_setup(struct ath11k *
+@@ -89,7 +89,7 @@ int ath11k_dp_peer_setup(struct ath11k *
  peer_clean:
  	spin_lock_bh(&ab->base_lock);
  
@@ -517,7 +517,7 @@
  		break;
  	case HTT_T2H_MSG_TYPE_PPDU_STATS_IND:
  		ath11k_htt_pull_ppdu_stats(ab, skb);
-@@ -2877,25 +2893,25 @@ static void ath11k_dp_rx_h_undecap(struc
+@@ -2876,25 +2892,25 @@ static void ath11k_dp_rx_h_undecap(struc
  }
  
  static struct ath11k_peer *
@@ -549,7 +549,7 @@
  	return peer;
  }
  
-@@ -2939,7 +2955,7 @@ static bool ath11k_dp_rx_check_fast_rx(s
+@@ -2938,7 +2954,7 @@ static bool ath11k_dp_rx_check_fast_rx(s
  		return false;
  
  	/* check if the msdu needs to be bridged to our connected peer */
@@ -558,7 +558,7 @@
  
  	if (f_peer && f_peer != peer)
  		return false;
-@@ -2978,7 +2994,7 @@ static void ath11k_dp_rx_h_mpdu(struct a
+@@ -2977,7 +2993,7 @@ static void ath11k_dp_rx_h_mpdu(struct a
  	}
  
  	spin_lock_bh(&ar->ab->base_lock);
@@ -567,7 +567,7 @@
  	if (peer) {
  		/* If the pkt is a valid IP packet and peer supports
  		 * fast rx, deliver directly to net, also note that
-@@ -3206,7 +3222,7 @@ static void ath11k_dp_rx_deliver_msdu(st
+@@ -3205,7 +3221,7 @@ static void ath11k_dp_rx_deliver_msdu(st
  		decap = ath11k_dp_rx_h_msdu_start_decap_type(ar->ab, rxcb->rx_desc);
  
  	spin_lock_bh(&ar->ab->base_lock);
@@ -576,7 +576,7 @@
  	if (peer && peer->sta)
  		pubsta = peer->sta;
  	spin_unlock_bh(&ar->ab->base_lock);
-@@ -3505,7 +3521,7 @@ try_again:
+@@ -3504,7 +3520,7 @@ try_again:
  		if (unlikely(push_reason !=
  			     HAL_REO_DEST_RING_PUSH_REASON_ROUTING_INSTRUCTION)) {
  			dev_kfree_skb_any(msdu);
@@ -585,7 +585,7 @@
  			continue;
  		}
  
-@@ -3737,11 +3753,10 @@ static void ath11k_dp_rx_update_user_sta
+@@ -3736,11 +3752,10 @@ static void ath11k_dp_rx_update_user_sta
  	if (user_stats->ast_index == 0 || user_stats->ast_index == 0xFFFF)
  		return;
  
@@ -599,7 +599,7 @@
  			    user_stats->ast_index);
  		return;
  	}
-@@ -4215,7 +4230,7 @@ int ath11k_peer_rx_frag_setup(struct ath
+@@ -4210,7 +4225,7 @@ int ath11k_peer_rx_frag_setup(struct ath
  
  	spin_lock_bh(&ab->base_lock);
  
@@ -608,7 +608,7 @@
  	if (!peer) {
  		ath11k_warn(ab, "failed to find the peer to set up fragment info\n");
  		spin_unlock_bh(&ab->base_lock);
-@@ -4671,7 +4686,7 @@ static int ath11k_dp_rx_frag_h_mpdu(stru
+@@ -4666,7 +4681,7 @@ static int ath11k_dp_rx_frag_h_mpdu(stru
  		return -EINVAL;
  
  	spin_lock_bh(&ab->base_lock);
@@ -617,7 +617,7 @@
  	if (!peer) {
  		ath11k_warn(ab, "failed to find the peer to de-fragment received fragment peer_id %d\n",
  			    peer_id);
-@@ -4733,7 +4748,7 @@ static int ath11k_dp_rx_frag_h_mpdu(stru
+@@ -4728,7 +4743,7 @@ static int ath11k_dp_rx_frag_h_mpdu(stru
  	del_timer_sync(&rx_tid->frag_timer);
  	spin_lock_bh(&ab->base_lock);
  
@@ -626,7 +626,7 @@
  	if (!peer)
  		goto err_frags_cleanup;
  
-@@ -6397,7 +6412,7 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -6392,7 +6407,7 @@ int ath11k_dp_rx_process_mon_status(stru
  			trace_ath11k_htt_rxdesc(ar, skb->data, log_type, rx_buf_sz);
  
  		ppdu_info->peer_id = HAL_INVALID_PEERID;
@@ -635,7 +635,7 @@
  
  		if (test_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags) &&
  		    pmon->mon_ppdu_status == DP_PPDU_STATUS_START &&
-@@ -6428,7 +6443,7 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -6423,7 +6438,7 @@ int ath11k_dp_rx_process_mon_status(stru
  		}
  		rcu_read_lock();
  		spin_lock_bh(&ab->base_lock);
@@ -646,7 +646,7 @@
  			ath11k_dbg(ab, ATH11K_DBG_DATA,
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.h
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.h
-@@ -129,8 +129,8 @@ int ath11k_dp_rxbufs_replenish(struct at
+@@ -130,8 +130,8 @@ int ath11k_dp_rxbufs_replenish(struct at
  			       int req_entries,
   			       enum hal_rx_buf_return_buf_manager mgr,
  			       u32 *buf_id);
@@ -659,7 +659,7 @@
  int ath11k_dp_rx_process_mon_rings(struct ath11k_base *ab, int mac_id,
 --- a/drivers/net/wireless/ath/ath11k/dp_tx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
-@@ -478,7 +478,7 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
+@@ -482,7 +482,7 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
  	}
  
  	spin_lock_bh(&ab->base_lock);
@@ -668,7 +668,7 @@
  	if (!peer || !peer->sta) {
  		ath11k_dbg(ab, ATH11K_DBG_DATA,
  			   "dp_tx: failed to find the peer with peer_id %d\n",
-@@ -576,7 +576,7 @@ void ath11k_dp_tx_update_txcompl(struct
+@@ -580,7 +580,7 @@ void ath11k_dp_tx_update_txcompl(struct
  	int ret;
  
  	spin_lock_bh(&ab->base_lock);
@@ -677,7 +677,7 @@
  	if (!peer || !peer->sta) {
  		ath11k_dbg(ab, ATH11K_DBG_DP_TX,
  			   "failed to find the peer by id %u\n", ts->peer_id);
-@@ -791,7 +791,7 @@ static void ath11k_dp_tx_complete_msdu(s
+@@ -799,7 +799,7 @@ static void ath11k_dp_tx_complete_msdu(s
  	}
  
  	spin_lock_bh(&ab->base_lock);
@@ -789,7 +789,7 @@
  
  	ar->num_peers = 0;
  	ar->num_stations = 0;
-@@ -3100,7 +3100,7 @@ static void ath11k_bss_assoc(struct ieee
+@@ -3187,7 +3187,7 @@ static void ath11k_bss_assoc(struct ieee
  
  	spin_lock_bh(&ar->ab->base_lock);
  
@@ -798,7 +798,7 @@
  	if (peer && peer->is_authorized)
  		is_auth = true;
  
-@@ -4260,7 +4260,7 @@ static int ath11k_clear_peer_keys(struct
+@@ -4349,7 +4349,7 @@ static int ath11k_clear_peer_keys(struct
  	lockdep_assert_held(&ar->conf_mutex);
  
  	spin_lock_bh(&ab->base_lock);
@@ -807,7 +807,7 @@
  	if (!peer) {
  		spin_unlock_bh(&ab->base_lock);
  		return -ENOENT;
-@@ -4376,7 +4376,7 @@ static int ath11k_mac_op_set_key(struct
+@@ -4465,7 +4465,7 @@ static int ath11k_mac_op_set_key(struct
  	 * we already hold conf_mutex. we just make sure its there now.
  	 */
  	spin_lock_bh(&ab->base_lock);
@@ -816,7 +816,7 @@
  
  	/* flush the fragments cache during key (re)install to
  	 * ensure all frags in the new frag list belong to the same key.
-@@ -4485,7 +4485,7 @@ static int ath11k_mac_op_set_key(struct
+@@ -4574,7 +4574,7 @@ static int ath11k_mac_op_set_key(struct
  	}
  
  	spin_lock_bh(&ab->base_lock);
@@ -825,7 +825,7 @@
  
  	/* TODO: Check if vdev specific security cfg is mandatory */
  	ret = ath11k_nss_vdev_set_cmd(arvif, ATH11K_NSS_WIFI_VDEV_SECURITY_TYPE_CMD, key->cipher);
-@@ -4516,7 +4516,7 @@ static int ath11k_mac_op_set_key(struct
+@@ -4605,7 +4605,7 @@ static int ath11k_mac_op_set_key(struct
  		list_for_each_entry_safe(dyn_vlan_cfg, tmp, &ap_vlan_arvif->dyn_vlan_cfg, cfg_list) {
  			struct ieee80211_sta *vlan_sta = dyn_vlan_cfg->sta;
  
@@ -834,7 +834,7 @@
  			if (ret)
  				ath11k_warn(ar->ab, "failed to cfg dyn vlan for peer %pM: %d\n",
  					    vlan_sta->addr, ret);
-@@ -5126,7 +5126,7 @@ static void ath11k_sta_set_4addr_wk(stru
+@@ -5215,7 +5215,7 @@ static void ath11k_sta_set_4addr_wk(stru
  	vif = ap_vlan_arvif->vif;
  
  	spin_lock_bh(&ab->base_lock);
@@ -843,7 +843,7 @@
  	if (!wds_peer) {
  		spin_unlock_bh(&ab->base_lock);
  		ath11k_warn(ab, "mac sta use 4addr failed to find peer %pM\n",
-@@ -5349,7 +5349,7 @@ static void ath11k_mac_op_sta_rc_update(
+@@ -5438,7 +5438,7 @@ static void ath11k_mac_op_sta_rc_update(
  
  	spin_lock_bh(&ar->ab->base_lock);
  
@@ -852,7 +852,7 @@
  	if (!peer) {
  		spin_unlock_bh(&ar->ab->base_lock);
  		ath11k_warn(ar->ab, "mac sta rc update failed to find peer %pM on vdev %i\n",
-@@ -8430,7 +8430,7 @@ ath11k_mac_op_assign_vif_chanctx(struct
+@@ -8463,7 +8463,7 @@ ath11k_mac_op_assign_vif_chanctx(struct
  	if (ab->hw_params.vdev_start_delay &&
  	    arvif->vdev_type != WMI_VDEV_TYPE_AP &&
  	    arvif->vdev_type != WMI_VDEV_TYPE_MONITOR &&
@@ -861,7 +861,7 @@
  		memcpy(&arvif->chanctx, ctx, sizeof(*ctx));
  		ret = 0;
  		goto out;
-@@ -8506,7 +8506,7 @@ ath11k_mac_op_unassign_vif_chanctx(struc
+@@ -8539,7 +8539,7 @@ ath11k_mac_op_unassign_vif_chanctx(struc
  	if (ab->hw_params.vdev_start_delay &&
  	    arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
  		spin_lock_bh(&ab->base_lock);
@@ -870,7 +870,7 @@
  		spin_unlock_bh(&ab->base_lock);
  		if (peer)
  			ath11k_peer_delete(ar, arvif->vdev_id, ar->mac_addr);
-@@ -9080,7 +9080,7 @@ ath11k_mac_validate_vht_he_fixed_rate_se
+@@ -9113,7 +9113,7 @@ ath11k_mac_validate_vht_he_fixed_rate_se
  
  	rcu_read_lock();
  	spin_lock_bh(&ar->ab->base_lock);
@@ -879,7 +879,7 @@
  		if (peer->sta) {
  			deflink = &peer->sta->deflink;
  
-@@ -10032,26 +10032,26 @@ static int ath11k_mac_station_remove(str
+@@ -10069,26 +10069,26 @@ static int ath11k_mac_station_remove(str
  	return ret;
  }
  
@@ -913,7 +913,7 @@
  			    sta->addr, ret);
  		return ret;
  	}
-@@ -10101,20 +10101,20 @@ static int ath11k_mac_op_sta_state(struc
+@@ -10138,20 +10138,20 @@ static int ath11k_mac_op_sta_state(struc
  			ath11k_warn(ar->ab, "Failed to remove station: %pM for VDEV: %d\n",
  				    sta->addr, arvif->vdev_id);
  
@@ -938,7 +938,7 @@
  	} else if (old_state == IEEE80211_STA_AUTH &&
  		   new_state == IEEE80211_STA_ASSOC &&
  		   (vif->type == NL80211_IFTYPE_AP ||
-@@ -10145,7 +10145,7 @@ static int ath11k_mac_op_sta_state(struc
+@@ -10182,7 +10182,7 @@ static int ath11k_mac_op_sta_state(struc
  		   new_state == IEEE80211_STA_AUTHORIZED) {
  		spin_lock_bh(&ar->ab->base_lock);
  
@@ -947,7 +947,7 @@
  		if (peer)
  			peer->is_authorized = true;
  
-@@ -10182,7 +10182,7 @@ static int ath11k_mac_op_sta_state(struc
+@@ -10219,7 +10219,7 @@ static int ath11k_mac_op_sta_state(struc
  					list_add_tail(&ar_dyn_vlan_cfg->cfg_list, &arvif->dyn_vlan_cfg);
  				}
  			} else {
@@ -956,7 +956,7 @@
  				if (ret)
  					ath11k_warn(ar->ab, "failed to cfg dyn vlan for peer %pM: %d\n",
  						    sta->addr, ret);
-@@ -10215,7 +10215,7 @@ static int ath11k_mac_op_sta_state(struc
+@@ -10252,7 +10252,7 @@ static int ath11k_mac_op_sta_state(struc
  		   new_state == IEEE80211_STA_ASSOC) {
  
  		spin_lock_bh(&ar->ab->base_lock);
@@ -965,7 +965,7 @@
  		if (peer)
  			peer->is_authorized = false;
  		spin_unlock_bh(&ar->ab->base_lock);
-@@ -10223,7 +10223,7 @@ static int ath11k_mac_op_sta_state(struc
+@@ -10260,7 +10260,7 @@ static int ath11k_mac_op_sta_state(struc
  		   new_state == IEEE80211_STA_ASSOC) {
  		spin_lock_bh(&ar->ab->base_lock);
  
@@ -974,7 +974,7 @@
  		if (peer)
  			peer->is_authorized = false;
  
-@@ -10628,9 +10628,9 @@ void ath11k_mac_unregister(struct ath11k
+@@ -10668,9 +10668,9 @@ void ath11k_mac_unregister(struct ath11k
  			continue;
  
  		__ath11k_mac_unregister(ar);
@@ -985,7 +985,7 @@
  }
  
  static int __ath11k_mac_register(struct ath11k *ar)
-@@ -10917,15 +10917,15 @@ int ath11k_mac_register(struct ath11k_ba
+@@ -10954,15 +10954,15 @@ int ath11k_mac_register(struct ath11k_ba
  	ab->cc_freq_hz = IPQ8074_CC_FREQ_HERTZ;
  	ab->free_vdev_map = (1LL << (ab->num_radios * TARGET_NUM_VDEVS(ab))) - 1;
  
@@ -1004,7 +1004,7 @@
  		if (ab->pdevs_macaddr_valid) {
  			ether_addr_copy(ar->mac_addr, pdev->mac_addr);
  		} else {
-@@ -10953,9 +10953,9 @@ err_cleanup:
+@@ -10990,9 +10990,9 @@ err_cleanup:
  		pdev = &ab->pdevs[i];
  		ar = pdev->ar;
  		__ath11k_mac_unregister(ar);
@@ -1015,7 +1015,7 @@
  
  	return ret;
  }
-@@ -10999,9 +10999,12 @@ int ath11k_mac_allocate(struct ath11k_ba
+@@ -11036,9 +11036,12 @@ int ath11k_mac_allocate(struct ath11k_ba
  		ar->num_rx_chains = get_num_chains(pdev->cap.rx_chain_mask);
  
  		pdev->ar = ar;
@@ -2362,7 +2362,7 @@
  }
 --- a/drivers/net/wireless/ath/ath11k/peer.h
 +++ b/drivers/net/wireless/ath/ath11k/peer.h
-@@ -99,34 +99,32 @@ struct ath11k_peer {
+@@ -98,34 +98,32 @@ struct ath11k_peer {
  	bool delete_in_progress;
  };
  
@@ -2409,7 +2409,7 @@
  						      u8* addr);
  struct ath11k_ast_entry *ath11k_peer_ast_find_by_pdev_idx(struct ath11k *ar,
  							  u8* addr);
-@@ -140,11 +138,11 @@ void ath11k_peer_del_ast(struct ath11k *
+@@ -139,11 +137,11 @@ void ath11k_peer_del_ast(struct ath11k *
  void ath11k_peer_ast_cleanup(struct ath11k *ar, struct ath11k_peer *peer,
  			     bool is_wds, u32 free_wds_count);
  void ath11k_peer_ast_wds_wmi_wk(struct work_struct *wk);
@@ -2423,7 +2423,7 @@
  								    u8* addr)
  {
  	return NULL;
-@@ -192,7 +190,7 @@ static inline void ath11k_peer_ast_wds_w
+@@ -191,7 +189,7 @@ static inline void ath11k_peer_ast_wds_w
  	return;
  }
  
@@ -2434,7 +2434,7 @@
  {
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
-@@ -7579,10 +7579,12 @@ static void ath11k_wmi_event_peer_sta_ps
+@@ -7624,10 +7624,12 @@ static void ath11k_wmi_event_peer_sta_ps
  	struct ieee80211_sta *sta;
  	struct ath11k_peer *peer;
  	struct ath11k *ar;
@@ -2447,7 +2447,7 @@
  
  	tb = ath11k_wmi_tlv_parse_alloc(ab, skb, GFP_ATOMIC);
  	if (IS_ERR(tb)) {
-@@ -7606,64 +7608,60 @@ static void ath11k_wmi_event_peer_sta_ps
+@@ -7651,64 +7653,60 @@ static void ath11k_wmi_event_peer_sta_ps
  
  	rcu_read_lock();
  
@@ -2554,7 +2554,7 @@
  	}
  
  out:
-@@ -7783,9 +7781,9 @@ static void ath11k_mgmt_rx_event(struct
+@@ -7828,9 +7826,9 @@ static void ath11k_mgmt_rx_event(struct
  
  	spin_lock_bh(&ab->base_lock);
  
@@ -2566,7 +2566,7 @@
  	if (!peer) {
  		spin_unlock_bh(&ab->base_lock);
  		goto skip_mgmt_stats;
-@@ -8013,9 +8011,8 @@ static void ath11k_peer_sta_kickout_even
+@@ -8058,9 +8056,8 @@ static void ath11k_peer_sta_kickout_even
  {
  	struct wmi_peer_sta_kickout_arg arg = {};
  	struct ieee80211_sta *sta;
@@ -2577,7 +2577,7 @@
  
  	if (ath11k_pull_peer_sta_kickout_ev(ab, skb, &arg) != 0) {
  		ath11k_warn(ab, "failed to extract peer sta kickout event");
-@@ -8024,42 +8021,22 @@ static void ath11k_peer_sta_kickout_even
+@@ -8069,42 +8066,22 @@ static void ath11k_peer_sta_kickout_even
  
  	rcu_read_lock();
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/146-mac80211-enable-TKIP-when-using-encapsulation-offloading.patch b/package/kernel/mac80211/patches/nss/subsys/146-mac80211-enable-TKIP-when-using-encapsulation-offloading.patch
index a97eb7b987e156..65b94504309c35 100644
--- a/package/kernel/mac80211/patches/nss/subsys/146-mac80211-enable-TKIP-when-using-encapsulation-offloading.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/146-mac80211-enable-TKIP-when-using-encapsulation-offloading.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4716,8 +4716,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4715,8 +4715,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  	if (!key)
  		key = rcu_dereference(sdata->default_unicast_key);
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch b/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch
index 1e34e5e05a3959..48dab8e186d7ad 100644
--- a/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch
@@ -27,7 +27,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  					    struct net_device *upper_dev)
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -404,6 +404,20 @@ enum ieee80211_bss_change {
+@@ -406,6 +406,20 @@ enum ieee80211_bss_change {
  	/* when adding here, make sure to change ieee80211_reconfig */
  };
  
@@ -73,7 +73,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   *	 - DATA3_DATA_MCS
   *	 - DATA3_DATA_DCM
   *	 - DATA3_CODING
-@@ -1453,7 +1469,7 @@ ieee80211_tx_info_clear_status(struct ie
+@@ -1492,7 +1508,7 @@ ieee80211_tx_info_clear_status(struct ie
   *	 - DATA5_DATA_BW_RU_ALLOC
   *	 - DATA6_NSTS
   *	 - DATA3_STBC
@@ -82,7 +82,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   *	from the RX info data, so leave those zeroed when building this data)
   * @RX_FLAG_RADIOTAP_HE_MU: HE MU radiotap data is present
   *	(&struct ieee80211_radiotap_he_mu)
-@@ -2084,6 +2100,16 @@ static inline bool lockdep_vif_wiphy_mut
+@@ -2127,6 +2143,16 @@ static inline bool lockdep_vif_wiphy_mut
  			      lockdep_vif_wiphy_mutex_held(vif))
  
  /**
@@ -99,7 +99,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   * enum ieee80211_key_flags - key flags
   *
   * These flags are used for communication about keys between the driver
-@@ -2788,6 +2814,8 @@ struct ieee80211_txq {
+@@ -2825,6 +2851,8 @@ struct ieee80211_txq {
   *	implements MLO, so operation can continue on other links when one
   *	link is switching.
   *
@@ -127,7 +127,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   * @prepare_multicast: Prepare for multicast filter configuration.
   *	This callback is optional, and its return value is passed
   *	to configure_filter(). This callback must be atomic.
-@@ -4425,7 +4458,9 @@ struct ieee80211_ops {
+@@ -4461,7 +4494,9 @@ struct ieee80211_ops {
  				  struct ieee80211_vif *vif,
  				  struct ieee80211_bss_conf *info,
  				  u64 changed);
@@ -138,7 +138,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	int (*start_ap)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			struct ieee80211_bss_conf *link_conf);
  	void (*stop_ap)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-@@ -4735,7 +4770,7 @@ struct ieee80211_ops {
+@@ -4771,7 +4806,7 @@ struct ieee80211_ops {
  	int (*reset_tid_config)(struct ieee80211_hw *hw,
  				struct ieee80211_vif *vif,
  				struct ieee80211_sta *sta, u8 tids);
@@ -184,7 +184,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   * the suspend->resume cycle. Since we can't check each caller
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -413,6 +413,17 @@ void ieee80211_link_info_change_notify(s
+@@ -414,6 +414,17 @@ void ieee80211_link_info_change_notify(s
  	drv_link_info_changed(local, sdata, link->conf, link->link_id, changed);
  }
  
@@ -202,7 +202,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  u64 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata)
  {
  	sdata->vif.bss_conf.use_cts_prot = false;
-@@ -844,12 +855,6 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+@@ -852,12 +863,6 @@ struct ieee80211_hw *ieee80211_alloc_hw_
  			   NL80211_FEATURE_FULL_AP_CLIENT_STATE;
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_FILS_STA);
  	wiphy_ext_feature_set(wiphy,
@@ -215,7 +215,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  			      NL80211_EXT_FEATURE_SCAN_FREQ_KHZ);
  	wiphy_ext_feature_set(wiphy,
  			      NL80211_EXT_FEATURE_POWERED_ADDR_CHANGE);
-@@ -1180,6 +1185,18 @@ int ieee80211_register_hw(struct ieee802
+@@ -1185,6 +1190,18 @@ int ieee80211_register_hw(struct ieee802
  			return -EINVAL;
  	}
  
@@ -236,7 +236,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		return -EINVAL;
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -2416,6 +2416,9 @@ sta_get_last_rx_stats(struct sta_info *s
+@@ -2412,6 +2412,9 @@ sta_get_last_rx_stats(struct sta_info *s
  	struct ieee80211_sta_rx_stats *stats = &sta->deflink.rx_stats;
  	int cpu;
  
@@ -272,7 +272,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		ac = skb_get_queue_mapping(skb);
  		tx->sta->deflink.tx_stats.bytes[ac] += skb->len;
  	}
-@@ -2877,7 +2889,9 @@ static struct sk_buff *ieee80211_build_h
+@@ -2876,7 +2888,9 @@ static struct sk_buff *ieee80211_build_h
  	if (unlikely(!multicast &&
  		     ((skb->sk &&
  		       skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS) ||
@@ -283,7 +283,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		info_id = ieee80211_store_ack_skb(local, skb, &info_flags,
  						  cookie);
  
-@@ -4666,7 +4680,8 @@ static void ieee80211_8023_xmit(struct i
+@@ -4665,7 +4679,8 @@ static void ieee80211_8023_xmit(struct i
  	}
  
  	if (unlikely(skb->sk &&
@@ -293,7 +293,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		info->status_data = ieee80211_store_ack_skb(local, skb,
  							    &info->flags, NULL);
  		if (info->status_data)
-@@ -4674,8 +4689,10 @@ static void ieee80211_8023_xmit(struct i
+@@ -4673,8 +4688,10 @@ static void ieee80211_8023_xmit(struct i
  	}
  
  	dev_sw_netstats_tx_add(dev, skbs, len);
@@ -308,7 +308,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
 --- a/net/wireless/util.c
 +++ b/net/wireless/util.c
-@@ -2627,6 +2627,9 @@ bool cfg80211_does_bw_fit_range(const st
+@@ -2629,6 +2629,9 @@ bool cfg80211_does_bw_fit_range(const st
  
  int cfg80211_sinfo_alloc_tid_stats(struct station_info *sinfo, gfp_t gfp)
  {
@@ -320,7 +320,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  				gfp);
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2676,7 +2676,7 @@ static int ieee80211_change_bss(struct w
+@@ -2695,7 +2695,7 @@ static int ieee80211_change_bss(struct w
  	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	struct ieee80211_link_data *link;
  	struct ieee80211_supported_band *sband;
@@ -329,7 +329,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	link = ieee80211_link_or_deflink(sdata, params->link_id, true);
  	if (IS_ERR(link))
-@@ -2726,6 +2726,8 @@ static int ieee80211_change_bss(struct w
+@@ -2745,6 +2745,8 @@ static int ieee80211_change_bss(struct w
  			sdata->flags |= IEEE80211_SDATA_DONT_BRIDGE_PACKETS;
  		else
  			sdata->flags &= ~IEEE80211_SDATA_DONT_BRIDGE_PACKETS;
@@ -338,7 +338,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		ieee80211_check_fast_rx_iface(sdata);
  	}
  
-@@ -2754,6 +2756,8 @@ static int ieee80211_change_bss(struct w
+@@ -2773,6 +2775,8 @@ static int ieee80211_change_bss(struct w
  
  	ieee80211_link_info_change_notify(sdata, link, changed);
  
@@ -375,7 +375,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  {
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1842,6 +1842,8 @@ void ieee80211_vif_cfg_change_notify(str
+@@ -1859,6 +1859,8 @@ void ieee80211_vif_cfg_change_notify(str
  void ieee80211_link_info_change_notify(struct ieee80211_sub_if_data *sdata,
  				       struct ieee80211_link_data *link,
  				       u64 changed);
@@ -386,7 +386,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
 --- a/net/mac80211/trace.h
 +++ b/net/mac80211/trace.h
-@@ -412,6 +412,38 @@ TRACE_EVENT(drv_config,
+@@ -421,6 +421,38 @@ TRACE_EVENT(drv_config,
  		LOCAL_PR_ARG, __entry->changed, CHANDEF_PR_ARG
  	)
  );
@@ -427,7 +427,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	TP_PROTO(struct ieee80211_local *local,
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -982,7 +982,8 @@ static bool ieee80211_set_sdata_offload_
+@@ -969,7 +969,8 @@ static bool ieee80211_set_sdata_offload_
  		    local->hw.wiphy->frag_threshold != (u32)-1)
  			flags &= ~IEEE80211_OFFLOAD_ENCAP_ENABLED;
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/199-mac80211-fix-xmit-callback-when-hwencap-enable-in-st.patch b/package/kernel/mac80211/patches/nss/subsys/199-mac80211-fix-xmit-callback-when-hwencap-enable-in-st.patch
index 0a1afb841e251e..7ae59db8cf1c07 100644
--- a/package/kernel/mac80211/patches/nss/subsys/199-mac80211-fix-xmit-callback-when-hwencap-enable-in-st.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/199-mac80211-fix-xmit-callback-when-hwencap-enable-in-st.patch
@@ -18,7 +18,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -6259,7 +6259,13 @@ int ieee80211_tx_control_port(struct wip
+@@ -6260,7 +6260,13 @@ int ieee80211_tx_control_port(struct wip
  
  start_xmit:
  	local_bh_disable();
diff --git a/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch b/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
index cd2ffad52b290b..512d10633e9673 100644
--- a/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
@@ -31,7 +31,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
 
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -9574,4 +9574,15 @@ ssize_t wiphy_locked_debugfs_write(struc
+@@ -9698,4 +9698,15 @@ ssize_t wiphy_locked_debugfs_write(struc
  				   void *data);
  #endif
  
@@ -49,7 +49,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  #endif /* __NET_CFG80211_H */
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -7506,6 +7506,20 @@ u32 ieee80211_calc_rx_airtime(struct iee
+@@ -7557,6 +7557,20 @@ u32 ieee80211_calc_rx_airtime(struct iee
  			      int len);
  
  /**
@@ -72,7 +72,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
   * This function calculates the estimated airtime usage of a frame based on the
 --- a/include/uapi/linux/nl80211.h
 +++ b/include/uapi/linux/nl80211.h
-@@ -1334,6 +1334,10 @@
+@@ -1329,6 +1329,10 @@
   *      %NL80211_ATTR_MLO_TTLM_ULINK attributes are used to specify the
   *      TID to Link mapping for downlink/uplink traffic.
   *
@@ -83,7 +83,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
   * @NL80211_CMD_MAX: highest used command number
   * @__NL80211_CMD_AFTER_LAST: internal use
   */
-@@ -1591,6 +1595,7 @@ enum nl80211_commands {
+@@ -1586,6 +1590,7 @@ enum nl80211_commands {
  
  	NL80211_CMD_SET_TID_TO_LINK_MAPPING,
  
@@ -111,7 +111,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  	__NL80211_ATTR_AFTER_LAST,
 --- a/net/mac80211/mlme.c
 +++ b/net/mac80211/mlme.c
-@@ -8727,3 +8727,15 @@ void ieee80211_disable_rssi_reports(stru
+@@ -9336,3 +9336,15 @@ void ieee80211_disable_rssi_reports(stru
  	_ieee80211_enable_rssi_reports(sdata, 0, 0);
  }
  EXPORT_SYMBOL(ieee80211_disable_rssi_reports);
@@ -129,7 +129,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
 +EXPORT_SYMBOL(ieee80211_update_muedca_params);
 --- a/net/mac80211/trace.h
 +++ b/net/mac80211/trace.h
-@@ -3125,6 +3125,26 @@ TRACE_EVENT(stop_queue,
+@@ -3134,6 +3134,26 @@ TRACE_EVENT(stop_queue,
  	)
  );
  
@@ -158,7 +158,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  		     struct ieee80211_sub_if_data *sdata,
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -820,6 +820,7 @@ static const struct nla_policy nl80211_p
+@@ -825,6 +825,7 @@ static const struct nla_policy nl80211_p
  	[NL80211_ATTR_HW_TIMESTAMP_ENABLED] = { .type = NLA_FLAG },
  	[NL80211_ATTR_EMA_RNR_ELEMS] = { .type = NLA_NESTED },
  	[NL80211_ATTR_MLO_LINK_DISABLED] = { .type = NLA_FLAG },
@@ -166,7 +166,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  	[NL80211_ATTR_BSS_DUMP_INCLUDE_USE_DATA] = { .type = NLA_FLAG },
  	[NL80211_ATTR_MLO_TTLM_DLINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
  	[NL80211_ATTR_MLO_TTLM_ULINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
-@@ -20324,6 +20325,42 @@ void cfg80211_schedule_channels_check(st
+@@ -20367,6 +20368,42 @@ void cfg80211_schedule_channels_check(st
  }
  EXPORT_SYMBOL(cfg80211_schedule_channels_check);
  
@@ -211,7 +211,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  int __init nl80211_init(void)
 --- a/net/wireless/trace.h
 +++ b/net/wireless/trace.h
-@@ -3809,6 +3809,46 @@ TRACE_EVENT(cfg80211_update_owe_info_eve
+@@ -3957,6 +3957,46 @@ TRACE_EVENT(cfg80211_update_owe_info_eve
  		  __entry->assoc_link_id, __entry->peer_mld_addr)
  );
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/207-ath11k-Add-support-for-dynamic-vlan.patch b/package/kernel/mac80211/patches/nss/subsys/207-ath11k-Add-support-for-dynamic-vlan.patch
index ab75fef4e528a6..03d6e9db15bc60 100644
--- a/package/kernel/mac80211/patches/nss/subsys/207-ath11k-Add-support-for-dynamic-vlan.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/207-ath11k-Add-support-for-dynamic-vlan.patch
@@ -29,7 +29,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  /* misc utils */
  
  static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
-@@ -4293,6 +4296,8 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4292,6 +4295,8 @@ void __ieee80211_subif_start_xmit(struct
  	struct sta_info *sta;
  	struct sk_buff *next;
  	int len = skb->len;
@@ -38,7 +38,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  
  	if (unlikely(!ieee80211_sdata_running(sdata) || skb->len < ETH_HLEN)) {
  		kfree_skb(skb);
-@@ -4314,6 +4319,19 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4313,6 +4318,19 @@ void __ieee80211_subif_start_xmit(struct
  	if (IS_ERR(sta))
  		sta = NULL;
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch b/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
index 32a4f78e87057f..11cd18458422fa 100644
--- a/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
@@ -30,7 +30,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
 
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -34,6 +34,9 @@
+@@ -35,6 +35,9 @@
  #include "sta_info.h"
  #include "debug.h"
  #include "drop.h"
@@ -40,7 +40,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  
  extern const struct cfg80211_ops mac80211_config_ops;
  
-@@ -1171,6 +1174,9 @@ struct ieee80211_sub_if_data {
+@@ -1184,6 +1187,9 @@ struct ieee80211_sub_if_data {
  		struct dentry *default_beacon_key;
  	} debugfs;
  #endif
@@ -65,7 +65,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  /**
   * DOC: Interface list locking
   *
-@@ -763,6 +769,13 @@ static int ieee80211_stop(struct net_dev
+@@ -759,6 +765,13 @@ static int ieee80211_stop(struct net_dev
  		ieee80211_stop_mbssid(sdata);
  	}
  
@@ -79,7 +79,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	wiphy_lock(sdata->local->hw.wiphy);
  	wiphy_work_cancel(sdata->local->hw.wiphy, &sdata->activate_links_work);
  
-@@ -1217,6 +1230,34 @@ void ieee80211_del_virtual_monitor(struc
+@@ -1204,6 +1217,34 @@ void ieee80211_del_virtual_monitor(struc
  	kfree(sdata);
  }
  
@@ -114,7 +114,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  /*
   * NOTE: Be very careful when changing this function, it must NOT return
   * an error on interface type changes that have been pre-checked, so most
-@@ -1444,6 +1485,21 @@ int ieee80211_do_open(struct wireless_de
+@@ -1431,6 +1472,21 @@ int ieee80211_do_open(struct wireless_de
  
  	ieee80211_recalc_ps(local);
  
@@ -217,7 +217,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4526,6 +4526,35 @@ static void ieee80211_mlo_multicast_tx(s
+@@ -4525,6 +4525,35 @@ static void ieee80211_mlo_multicast_tx(s
  	kfree_skb(skb);
  }
  
@@ -253,7 +253,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  /**
   * ieee80211_subif_start_xmit - netif start_xmit function for 802.3 vifs
   * @skb: packet to be sent
-@@ -4541,6 +4570,10 @@ netdev_tx_t ieee80211_subif_start_xmit(s
+@@ -4540,6 +4569,10 @@ netdev_tx_t ieee80211_subif_start_xmit(s
  	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	const struct ethhdr *eth = (void *)skb->data;
  
@@ -264,7 +264,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	if (likely(!is_multicast_ether_addr(eth->h_dest)))
  		goto normal;
  
-@@ -4730,6 +4763,9 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4729,6 +4762,9 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  	struct ieee80211_key *key;
  	struct sta_info *sta;
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch b/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
index 77e7c3b637e933..941a0c87859bfc 100644
--- a/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
@@ -21,7 +21,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -5234,6 +5234,17 @@ void ieee80211_sta_pspoll(struct ieee802
+@@ -5270,6 +5270,17 @@ void ieee80211_sta_pspoll(struct ieee802
   */
  void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *sta, u8 tid);
  
@@ -41,7 +41,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
   * This is enough for the radiotap header.
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2189,7 +2189,13 @@ static int ieee80211_change_station(stru
+@@ -2208,7 +2208,13 @@ static int ieee80211_change_station(stru
  
  			rcu_assign_pointer(vlansdata->u.vlan.sta, sta);
  			__ieee80211_check_fast_rx_iface(vlansdata);
@@ -73,7 +73,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	trace_drv_add_interface(local, sdata);
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -686,6 +686,9 @@ static void ieee80211_do_stop(struct iee
+@@ -682,6 +682,9 @@ static void ieee80211_do_stop(struct iee
  
  	switch (sdata->vif.type) {
  	case NL80211_IFTYPE_AP_VLAN:
@@ -83,7 +83,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		break;
  	case NL80211_IFTYPE_MONITOR:
  		if (local->monitors == 0)
-@@ -973,6 +976,7 @@ static bool ieee80211_iftype_supports_hd
+@@ -960,6 +963,7 @@ static bool ieee80211_iftype_supports_hd
  	switch (iftype) {
  	/* P2P GO and client are mapped to AP/STATION types */
  	case NL80211_IFTYPE_AP:
@@ -91,7 +91,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	case NL80211_IFTYPE_STATION:
  		return true;
  	default:
-@@ -1027,7 +1031,8 @@ static void ieee80211_set_vif_encap_ops(
+@@ -1014,7 +1018,8 @@ static void ieee80211_set_vif_encap_ops(
  	struct ieee80211_sub_if_data *bss = sdata;
  	bool enabled;
  
@@ -101,7 +101,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		if (!sdata->bss)
  			return;
  
-@@ -1353,10 +1358,17 @@ int ieee80211_do_open(struct wireless_de
+@@ -1340,10 +1345,17 @@ int ieee80211_do_open(struct wireless_de
  
  	switch (sdata->vif.type) {
  	case NL80211_IFTYPE_AP_VLAN:
@@ -137,7 +137,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  {
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4320,8 +4320,11 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4319,8 +4319,11 @@ void __ieee80211_subif_start_xmit(struct
  		sta = NULL;
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
@@ -151,7 +151,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		if (ap_sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED &&
  		    !is_multicast_ether_addr(skb->data)) {
  			if (sta)
-@@ -4713,7 +4716,8 @@ static void ieee80211_8023_xmit(struct i
+@@ -4712,7 +4715,8 @@ static void ieee80211_8023_xmit(struct i
  
  	info->hw_queue = sdata->vif.hw_queue[queue];
  
@@ -163,7 +163,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
 --- a/net/mac80211/util.c
 +++ b/net/mac80211/util.c
-@@ -1664,6 +1664,9 @@ static void ieee80211_assign_chanctx(str
+@@ -1668,6 +1668,9 @@ static void ieee80211_assign_chanctx(str
  
  	lockdep_assert_wiphy(local->hw.wiphy);
  
@@ -173,7 +173,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	conf = rcu_dereference_protected(link->conf->chanctx_conf,
  					 lockdep_is_held(&local->hw.wiphy->mtx));
  	if (conf) {
-@@ -1869,7 +1872,8 @@ int ieee80211_reconfig(struct ieee80211_
+@@ -1873,7 +1876,8 @@ int ieee80211_reconfig(struct ieee80211_
  	}
  
  	list_for_each_entry(sdata, &local->interfaces, list) {
@@ -183,7 +183,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		    sdata->vif.type != NL80211_IFTYPE_MONITOR &&
  		    ieee80211_sdata_running(sdata)) {
  			res = drv_add_interface(local, sdata);
-@@ -1884,7 +1888,8 @@ int ieee80211_reconfig(struct ieee80211_
+@@ -1888,7 +1892,8 @@ int ieee80211_reconfig(struct ieee80211_
  	if (res) {
  		list_for_each_entry_continue_reverse(sdata, &local->interfaces,
  						     list)
@@ -195,7 +195,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  				drv_remove_interface(local, sdata);
 --- a/net/mac80211/mlme.c
 +++ b/net/mac80211/mlme.c
-@@ -5297,7 +5297,8 @@ static bool ieee80211_assoc_success(stru
+@@ -5696,7 +5696,8 @@ static bool ieee80211_assoc_success(stru
  	 * If we're using 4-addr mode, let the AP know that we're
  	 * doing so, so that it can create the STA VLAN on its side
  	 */
diff --git a/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch b/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
index fd5d052ce140f5..84424056bb6638 100644
--- a/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
@@ -24,7 +24,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2184,6 +2184,8 @@ enum ieee80211_key_flags {
+@@ -2227,6 +2227,8 @@ enum ieee80211_key_flags {
   * @tx_pn: PN used for TX keys, may be used by the driver as well if it
   *	needs to do software PN assignment by itself (e.g. due to TSO)
   * @flags: key flags, see &enum ieee80211_key_flags.
@@ -33,7 +33,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
   * @keyidx: the key index (0-3)
   * @keylen: key material length
   * @key: key material. For ALG_TKIP the key is encoded as a 256-bit (32 byte)
-@@ -2203,6 +2205,7 @@ struct ieee80211_key_conf {
+@@ -2246,6 +2248,7 @@ struct ieee80211_key_conf {
  	u8 hw_key_idx;
  	s8 keyidx;
  	u16 flags;
@@ -102,7 +102,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	key->conf.cipher = cipher;
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4672,16 +4672,25 @@ static void ieee80211_8023_xmit(struct i
+@@ -4671,16 +4671,25 @@ static void ieee80211_8023_xmit(struct i
  				struct ieee80211_key *key, struct sk_buff *skb)
  {
  	struct ieee80211_tx_info *info;
diff --git a/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch b/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch
index 427b1aa264a08f..43bef1ef8c443d 100644
--- a/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch
@@ -20,7 +20,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
 
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -216,6 +216,7 @@ enum ieee80211_rx_flags {
+@@ -218,6 +218,7 @@ enum ieee80211_rx_flags {
  };
  
  struct ieee80211_rx_data {
@@ -30,7 +30,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	struct ieee80211_local *local;
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4701,19 +4701,21 @@ static void ieee80211_8023_xmit(struct i
+@@ -4700,19 +4700,21 @@ static void ieee80211_8023_xmit(struct i
  
  	ieee80211_aggr_check(sdata, sta, skb);
  
@@ -64,7 +64,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	}
  
  	skb = ieee80211_tx_skb_fixup(skb, ieee80211_sdata_netdev_features(sdata));
-@@ -4773,7 +4775,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4772,7 +4774,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  {
  	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	struct ethhdr *ehdr = (struct ethhdr *)skb->data;
@@ -73,7 +73,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	struct sta_info *sta;
  
  #ifdef CPTCFG_MAC80211_NSS_SUPPORT
-@@ -4791,9 +4793,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4790,9 +4792,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		goto out;
  	}
  
@@ -90,7 +90,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  		goto skip_offload;
  
  	key = rcu_dereference(sta->ptk[sta->ptk_idx]);
-@@ -4804,6 +4810,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4803,6 +4809,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		goto skip_offload;
  
  	sk_pacing_shift_update(skb->sk, sdata->local->hw.tx_sk_pacing_shift);
@@ -98,7 +98,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	ieee80211_8023_xmit(sdata, dev, sta, key, skb);
  	goto out;
  
-@@ -6326,13 +6333,7 @@ int ieee80211_tx_control_port(struct wip
+@@ -6327,13 +6334,7 @@ int ieee80211_tx_control_port(struct wip
  
  start_xmit:
  	local_bh_disable();
diff --git a/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch b/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
index 0915c24550c19a..6b5b2e6f771c0a 100644
--- a/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
@@ -48,7 +48,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  /**
   * enum ieee80211_max_queues - maximum number of queues
   *
-@@ -411,11 +414,17 @@ enum ieee80211_bss_change {
+@@ -413,11 +416,17 @@ enum ieee80211_bss_change {
   * to indicate which NSS BSS parameter changed.
   *
   * @BSS_CHANGED_NSS_AP_ISOLATE: AP Isolate feature in NSS mode
@@ -66,7 +66,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  };
  
  /*
-@@ -809,6 +818,11 @@ struct ieee80211_bss_conf {
+@@ -847,6 +856,11 @@ struct ieee80211_bss_conf {
  	bool he_full_ul_mumimo;
  	bool eht_su_beamformer;
  	bool eht_su_beamformee;
@@ -76,9 +76,9 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
 +	bool nss_offld_mesh_forward_enabled;
 +	u32 nss_offld_mpath_refresh_time;
  	bool eht_mu_beamformer;
+ 	bool eht_80mhz_full_bw_ul_mumimo;
  	bool nss_ap_isolate;
- };
-@@ -1302,6 +1316,8 @@ struct ieee80211_rate_status {
+@@ -1341,6 +1355,8 @@ struct ieee80211_rate_status {
   * @ack_hwtstamp: Hardware timestamp of the received ack in nanoseconds
   *	Only needed for Timing measurement and Fine timing measurement action
   *	frames. Only reported by devices that have timestamping enabled.
@@ -87,7 +87,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
   */
  struct ieee80211_tx_status {
  	struct ieee80211_sta *sta;
-@@ -1312,6 +1328,8 @@ struct ieee80211_tx_status {
+@@ -1351,6 +1367,8 @@ struct ieee80211_tx_status {
  	u8 n_rates;
  
  	struct list_head *free_list;
@@ -96,7 +96,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  };
  
  /**
-@@ -1820,6 +1838,7 @@ struct ieee80211_channel_switch {
+@@ -1859,6 +1877,7 @@ struct ieee80211_channel_switch {
   *	operation on this interface and request a channel context without
   *	the AP definition. Use this e.g. because the device is able to
   *	handle OFDMA (downlink and trigger for uplink) on a per-AP basis.
@@ -104,7 +104,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
   */
  enum ieee80211_vif_flags {
  	IEEE80211_VIF_BEACON_FILTER		= BIT(0),
-@@ -1828,6 +1847,7 @@ enum ieee80211_vif_flags {
+@@ -1867,6 +1886,7 @@ enum ieee80211_vif_flags {
  	IEEE80211_VIF_GET_NOA_UPDATE		= BIT(3),
  	IEEE80211_VIF_EML_ACTIVE	        = BIT(4),
  	IEEE80211_VIF_IGNORE_OFDMA_WIDER_BW	= BIT(5),
@@ -112,15 +112,15 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  };
  
  
-@@ -2879,6 +2899,7 @@ enum ieee80211_hw_flags {
- 	IEEE80211_HW_DISALLOW_PUNCTURING,
+@@ -2916,6 +2936,7 @@ enum ieee80211_hw_flags {
+ 	IEEE80211_HW_DISALLOW_PUNCTURING_5GHZ,
  	IEEE80211_HW_HANDLES_QUIET_CSA,
  	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
 +	IEEE80211_HW_SUPPORTS_MESH_NSS_OFFLOAD,
  
  	/* keep last, obviously */
  	NUM_IEEE80211_HW_FLAGS
-@@ -4388,6 +4409,8 @@ struct ieee80211_prep_tx_info {
+@@ -4424,6 +4445,8 @@ struct ieee80211_prep_tx_info {
   * @set_sar_specs: Update the SAR (TX power) settings.
   * @sta_set_decap_offload: Called to notify the driver when a station is allowed
   *	to use rx decapsulation offload
@@ -129,7 +129,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
   * @add_twt_setup: Update hw with TWT agreement parameters received from the peer.
   *	This callback allows the hw to check if requested parameters
   *	are supported and if there is enough room for a new agreement.
-@@ -4782,6 +4805,12 @@ struct ieee80211_ops {
+@@ -4818,6 +4841,12 @@ struct ieee80211_ops {
  	void (*sta_set_decap_offload)(struct ieee80211_hw *hw,
  				      struct ieee80211_vif *vif,
  				      struct ieee80211_sta *sta, bool enabled);
@@ -142,7 +142,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	void (*add_twt_setup)(struct ieee80211_hw *hw,
  			      struct ieee80211_sta *sta,
  			      struct ieee80211_twt_setup *twt);
-@@ -7667,4 +7696,100 @@ int ieee80211_emulate_switch_vif_chanctx
+@@ -7722,4 +7751,100 @@ int ieee80211_emulate_switch_vif_chanctx
  					 int n_vifs,
  					 enum ieee80211_chanctx_switch_mode mode);
  
@@ -245,7 +245,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  #endif /* MAC80211_H */
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2519,6 +2519,7 @@ static int ieee80211_update_mesh_config(
+@@ -2538,6 +2538,7 @@ static int ieee80211_update_mesh_config(
  	struct mesh_config *conf;
  	struct ieee80211_sub_if_data *sdata;
  	struct ieee80211_if_mesh *ifmsh;
@@ -253,7 +253,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  
  	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	ifmsh = &sdata->u.mesh;
-@@ -2535,8 +2536,11 @@ static int ieee80211_update_mesh_config(
+@@ -2554,8 +2555,11 @@ static int ieee80211_update_mesh_config(
  		conf->dot11MeshMaxPeerLinks = nconf->dot11MeshMaxPeerLinks;
  	if (_chg_mesh_attr(NL80211_MESHCONF_MAX_RETRIES, mask))
  		conf->dot11MeshMaxRetries = nconf->dot11MeshMaxRetries;
@@ -266,7 +266,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	if (_chg_mesh_attr(NL80211_MESHCONF_ELEMENT_TTL, mask))
  		conf->element_ttl = nconf->element_ttl;
  	if (_chg_mesh_attr(NL80211_MESHCONF_AUTO_OPEN_PLINKS, mask)) {
-@@ -2550,8 +2554,12 @@ static int ieee80211_update_mesh_config(
+@@ -2569,8 +2573,12 @@ static int ieee80211_update_mesh_config(
  	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, mask))
  		conf->dot11MeshHWMPmaxPREQretries =
  			nconf->dot11MeshHWMPmaxPREQretries;
@@ -280,7 +280,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	if (_chg_mesh_attr(NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, mask))
  		conf->min_discovery_timeout = nconf->min_discovery_timeout;
  	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, mask))
-@@ -2586,8 +2594,12 @@ static int ieee80211_update_mesh_config(
+@@ -2605,8 +2613,12 @@ static int ieee80211_update_mesh_config(
  	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_RANN_INTERVAL, mask))
  		conf->dot11MeshHWMPRannInterval =
  			nconf->dot11MeshHWMPRannInterval;
@@ -294,7 +294,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	if (_chg_mesh_attr(NL80211_MESHCONF_RSSI_THRESHOLD, mask)) {
  		/* our RSSI threshold implementation is supported only for
  		 * devices that report signal in dBm.
-@@ -2629,6 +2641,7 @@ static int ieee80211_update_mesh_config(
+@@ -2648,6 +2660,7 @@ static int ieee80211_update_mesh_config(
  		conf->dot11MeshConnectedToAuthServer =
  			nconf->dot11MeshConnectedToAuthServer;
  	ieee80211_mbss_info_change_notify(sdata, BSS_CHANGED_BEACON);
@@ -331,7 +331,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
 --- a/net/mac80211/debugfs.c
 +++ b/net/mac80211/debugfs.c
 @@ -509,6 +509,7 @@ static const char *hw_flag_names[] = {
- 	FLAG(DISALLOW_PUNCTURING),
+ 	FLAG(DISALLOW_PUNCTURING_5GHZ),
  	FLAG(HANDLES_QUIET_CSA),
  	FLAG(SUPPORTS_NSS_OFFLOAD),
 +	FLAG(SUPPORTS_MESH_NSS_OFFLOAD),
@@ -1193,7 +1193,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  		if (!is_multicast_ether_addr(skb->data)) {
  			struct sta_info *next_hop;
  			bool mpp_lookup = true;
-@@ -2974,6 +2984,9 @@ static struct sk_buff *ieee80211_build_h
+@@ -2973,6 +2983,9 @@ static struct sk_buff *ieee80211_build_h
  
  	skb_reset_mac_header(skb);
  
@@ -1203,7 +1203,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	info = IEEE80211_SKB_CB(skb);
  	memset(info, 0, sizeof(*info));
  
-@@ -4297,6 +4310,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4296,6 +4309,7 @@ void __ieee80211_subif_start_xmit(struct
  	struct sk_buff *next;
  	int len = skb->len;
  	struct ieee80211_key *key = NULL;
@@ -1211,7 +1211,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	struct ieee80211_sub_if_data *ap_sdata;
  
  	if (unlikely(!ieee80211_sdata_running(sdata) || skb->len < ETH_HLEN)) {
-@@ -4371,9 +4385,15 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4370,9 +4384,15 @@ void __ieee80211_subif_start_xmit(struct
  			goto out;
  		}
  
@@ -1232,7 +1232,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
   out_free:
 --- a/net/mac80211/driver-ops.h
 +++ b/net/mac80211/driver-ops.h
-@@ -1737,4 +1737,10 @@ drv_can_neg_ttlm(struct ieee80211_local
+@@ -1749,4 +1749,10 @@ drv_can_neg_ttlm(struct ieee80211_local
  
  	return res;
  }
diff --git a/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch b/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
index 81b4e1b24744bb..481087fd110158 100644
--- a/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
@@ -16,7 +16,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2839,6 +2839,8 @@ struct ieee80211_txq {
+@@ -2876,6 +2876,8 @@ struct ieee80211_txq {
   *
   *  @IEEE80211_HW_SUPPORTS_NSS_OFFLOAD: Hardware/driver supports NSS offload
   *
@@ -25,7 +25,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
   * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
   */
  enum ieee80211_hw_flags {
-@@ -2900,6 +2902,7 @@ enum ieee80211_hw_flags {
+@@ -2937,6 +2939,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_HANDLES_QUIET_CSA,
  	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
  	IEEE80211_HW_SUPPORTS_MESH_NSS_OFFLOAD,
diff --git a/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch b/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch
index 5a5b79060833c2..f69088b2540d8b 100644
--- a/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch
@@ -14,7 +14,7 @@ Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4790,6 +4790,67 @@ out_free:
+@@ -4789,6 +4789,67 @@ out_free:
  	kfree_skb(skb);
  }
  
@@ -82,7 +82,7 @@ Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
  netdev_tx_t ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
  					    struct net_device *dev)
  {
-@@ -4829,6 +4890,11 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4828,6 +4889,11 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  	if (key && (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)))
  		goto skip_offload;
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/336-mac80211-Mesh-Fast-rx-support.patch b/package/kernel/mac80211/patches/nss/subsys/336-mac80211-Mesh-Fast-rx-support.patch
index 3ea2eef1267275..ba3b72110124e1 100644
--- a/package/kernel/mac80211/patches/nss/subsys/336-mac80211-Mesh-Fast-rx-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/336-mac80211-Mesh-Fast-rx-support.patch
@@ -20,7 +20,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -1759,6 +1759,8 @@ static void sta_apply_mesh_params(struct
+@@ -1761,6 +1761,8 @@ static void sta_apply_mesh_params(struct
  			/* init at low value */
  			ewma_mesh_tx_rate_avg_add(&sta->mesh->tx_rate_avg, 10);
  
@@ -29,7 +29,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  			break;
  		case NL80211_PLINK_LISTEN:
  		case NL80211_PLINK_BLOCKED:
-@@ -1773,6 +1775,7 @@ static void sta_apply_mesh_params(struct
+@@ -1775,6 +1777,7 @@ static void sta_apply_mesh_params(struct
  			ieee80211_mps_sta_status_update(sta);
  			changed |= ieee80211_mps_set_sta_local_pm(sta,
  					NL80211_MESH_POWER_UNKNOWN);
@@ -94,7 +94,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  	if (action) {
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -4713,10 +4713,15 @@ void ieee80211_check_fast_rx(struct sta_
+@@ -4717,10 +4717,15 @@ void ieee80211_check_fast_rx(struct sta_
  
  		break;
  	case NL80211_IFTYPE_MESH_POINT:
@@ -112,7 +112,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  		break;
  	default:
  		goto clear;
-@@ -4757,7 +4762,7 @@ void ieee80211_check_fast_rx(struct sta_
+@@ -4761,7 +4766,7 @@ void ieee80211_check_fast_rx(struct sta_
  	__release(check_fast_rx);
  
  	if (assign)
@@ -121,7 +121,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  
  	offload_flags = get_bss_sdata(sdata)->vif.offload_flags;
  	offload = offload_flags & IEEE80211_OFFLOAD_DECAP_ENABLED;
-@@ -4939,6 +4944,10 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4943,6 +4948,10 @@ static bool ieee80211_invoke_fast_rx(str
  		u8 sa[ETH_ALEN];
  	} addrs __aligned(2);
  	struct ieee80211_sta_rx_stats *stats;
@@ -132,7 +132,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  
  	/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
  	 * to a common data structure; drivers can implement that per queue
-@@ -4988,6 +4997,37 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4992,6 +5001,37 @@ static bool ieee80211_invoke_fast_rx(str
  		snap_offs += IEEE80211_CCMP_HDR_LEN;
  	}
  
@@ -170,7 +170,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  	if (!ieee80211_vif_is_mesh(&rx->sdata->vif) &&
  	    !(status->rx_flags & IEEE80211_RX_AMSDU)) {
  		if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
-@@ -5025,9 +5065,33 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -5029,9 +5069,33 @@ static bool ieee80211_invoke_fast_rx(str
  		return true;
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch b/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch
index 941a2b77371208..e87a824ab068b6 100644
--- a/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch
@@ -33,7 +33,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4721,7 +4721,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4720,7 +4720,7 @@ static void ieee80211_8023_xmit(struct i
  
  	ieee80211_aggr_check(sdata, sta, skb);
  
@@ -42,7 +42,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  		tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
  		tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
  		if (tid_tx) {
-@@ -4775,7 +4775,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4774,7 +4774,7 @@ static void ieee80211_8023_xmit(struct i
  	}
  
  	dev_sw_netstats_tx_add(dev, skbs, len);
diff --git a/package/kernel/mac80211/patches/nss/subsys/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch b/package/kernel/mac80211/patches/nss/subsys/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch
index 6c6bca1b16f27a..ba80b62d0ac732 100644
--- a/package/kernel/mac80211/patches/nss/subsys/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch
@@ -21,7 +21,7 @@ Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
 
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -1011,7 +1011,8 @@ static bool ieee80211_set_sdata_offload_
+@@ -998,7 +998,8 @@ static bool ieee80211_set_sdata_offload_
  		flags |= IEEE80211_OFFLOAD_DECAP_ENABLED;
  
  		if (local->monitors &&
diff --git a/package/kernel/mac80211/patches/nss/subsys/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch b/package/kernel/mac80211/patches/nss/subsys/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
index 0cfa65742f9f06..d28628ab1043f5 100644
--- a/package/kernel/mac80211/patches/nss/subsys/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
@@ -14,7 +14,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1442,8 +1442,6 @@ ieee80211_tx_info_clear_status(struct ie
+@@ -1481,8 +1481,6 @@ ieee80211_tx_info_clear_status(struct ie
   * @RX_FLAG_AMPDU_IS_LAST: this subframe is the last subframe of the A-MPDU
   * @RX_FLAG_AMPDU_DELIM_CRC_ERROR: A delimiter CRC error has been detected
   *	on this subframe
@@ -23,7 +23,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
   * @RX_FLAG_MIC_STRIPPED: The mic was stripped of this packet. Decryption was
   *	done by the hardware
   * @RX_FLAG_ONLY_MONITOR: Report frame only to monitor interfaces without
-@@ -1500,39 +1498,38 @@ ieee80211_tx_info_clear_status(struct ie
+@@ -1539,39 +1537,38 @@ ieee80211_tx_info_clear_status(struct ie
   *	hardware or driver)
   */
  enum mac80211_rx_flags {
diff --git a/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch b/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
index 99feb3b6b0555b..ee509ae0cbb839 100644
--- a/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
@@ -20,7 +20,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
 
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -2060,6 +2060,11 @@ netdev_tx_t ieee80211_subif_start_xmit(s
+@@ -2080,6 +2080,11 @@ netdev_tx_t ieee80211_subif_start_xmit(s
  				       struct net_device *dev);
  netdev_tx_t ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
  					    struct net_device *dev);
@@ -44,7 +44,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  /* misc utils */
  
  static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
-@@ -4343,7 +4344,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4342,7 +4343,7 @@ void __ieee80211_subif_start_xmit(struct
  		    !is_multicast_ether_addr(skb->data)) {
  			if (sta)
  				key = rcu_dereference(sta->ptk[sta->ptk_idx]);
@@ -53,7 +53,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  			rcu_read_unlock();
  			return;
  		}
-@@ -4389,7 +4390,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4388,7 +4389,7 @@ void __ieee80211_subif_start_xmit(struct
  		if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) {
  		    	if (sta)
  				key = rcu_dereference(sta->ptk[sta->ptk_idx]);
@@ -62,7 +62,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  		} else {
  			dev_sw_netstats_tx_add(dev, 1, skb->len);
  			ieee80211_xmit(sdata, sta, skb);
-@@ -4689,7 +4690,8 @@ static bool ieee80211_tx_8023(struct iee
+@@ -4688,7 +4689,8 @@ static bool ieee80211_tx_8023(struct iee
  
  static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
  				struct net_device *dev, struct sta_info *sta,
@@ -72,7 +72,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  {
  	struct ieee80211_tx_info *info;
  	struct ethhdr *ehdr = (struct ethhdr *)skb->data;
-@@ -4745,6 +4747,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4744,6 +4746,7 @@ static void ieee80211_8023_xmit(struct i
  	info = IEEE80211_SKB_CB(skb);
  	memset(info, 0, sizeof(*info));
  
@@ -80,7 +80,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  	info->hw_queue = sdata->vif.hw_queue[queue];
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
-@@ -4765,11 +4768,12 @@ static void ieee80211_8023_xmit(struct i
+@@ -4764,11 +4767,12 @@ static void ieee80211_8023_xmit(struct i
  			memcpy(IEEE80211_SKB_CB(seg), info, sizeof(*info));
  	}
  
@@ -96,7 +96,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  		if (info->status_data)
  			info->status_data_idr = 1;
  	}
-@@ -4792,7 +4796,8 @@ out_free:
+@@ -4791,7 +4795,8 @@ out_free:
  
  void ieee80211_8023_xmit_ap(struct ieee80211_sub_if_data *sdata,
  			    struct net_device *dev, struct sta_info *sta,
@@ -106,7 +106,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  {
  	struct ieee80211_tx_info *info;
  	struct ieee80211_local *local = sdata->local;
-@@ -4801,6 +4806,9 @@ void ieee80211_8023_xmit_ap(struct ieee8
+@@ -4800,6 +4805,9 @@ void ieee80211_8023_xmit_ap(struct ieee8
  	unsigned long flags;
  	int q;
  	u16 q_map;
@@ -116,7 +116,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  	/*
  	 * If the skb is shared we need to obtain our own copy.
-@@ -4812,11 +4820,13 @@ void ieee80211_8023_xmit_ap(struct ieee8
+@@ -4811,11 +4819,13 @@ void ieee80211_8023_xmit_ap(struct ieee8
  
  	info = IEEE80211_SKB_CB(skb);
  	memset(info, 0, sizeof(*info));
@@ -133,7 +133,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  	info->flags |= IEEE80211_TX_CTL_HW_80211_ENCAP;
  	info->control.vif = &sdata->vif;
-@@ -4850,14 +4860,23 @@ void ieee80211_8023_xmit_ap(struct ieee8
+@@ -4849,14 +4859,23 @@ void ieee80211_8023_xmit_ap(struct ieee8
  	drv_tx(local, &control, skb);
  
  }
@@ -158,7 +158,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  #ifdef CPTCFG_MAC80211_NSS_SUPPORT
  	ieee80211_xmit_nss_fixup(skb, dev);
-@@ -4873,14 +4892,15 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4872,14 +4891,15 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		kfree_skb(skb);
  		goto out;
  	}
@@ -176,7 +176,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  		goto skip_offload;
  
  	key = rcu_dereference(sta->ptk[sta->ptk_idx]);
-@@ -4891,13 +4911,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4890,13 +4910,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		goto skip_offload;
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP) {
@@ -192,7 +192,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  	goto out;
  
  skip_offload:
-@@ -6419,7 +6439,10 @@ int ieee80211_tx_control_port(struct wip
+@@ -6420,7 +6440,10 @@ int ieee80211_tx_control_port(struct wip
  
  start_xmit:
  	local_bh_disable();
diff --git a/package/kernel/mac80211/patches/nss/subsys/686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch b/package/kernel/mac80211/patches/nss/subsys/686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch
index 3d15c53397f43a..03bdf150828250 100644
--- a/package/kernel/mac80211/patches/nss/subsys/686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch
@@ -72,7 +72,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2346,7 +2346,7 @@ static void mpath_set_pinfo(struct mesh_
+@@ -2365,7 +2365,7 @@ static void mpath_set_pinfo(struct mesh_
  	if (mpath->flags & MESH_PATH_RESOLVED)
  		pinfo->flags |= NL80211_MPATH_FLAG_RESOLVED;
  	pinfo->hop_count = mpath->hop_count;
diff --git a/package/kernel/mac80211/patches/nss/subsys/751-mac80211-Get-valid-last_rate-for-rx_bitrate-from-cpu.patch b/package/kernel/mac80211/patches/nss/subsys/751-mac80211-Get-valid-last_rate-for-rx_bitrate-from-cpu.patch
index 6a836fa46a42ff..4170336f3dad67 100644
--- a/package/kernel/mac80211/patches/nss/subsys/751-mac80211-Get-valid-last_rate-for-rx_bitrate-from-cpu.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/751-mac80211-Get-valid-last_rate-for-rx_bitrate-from-cpu.patch
@@ -16,7 +16,7 @@ Signed-off-by: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
 
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -2411,7 +2411,7 @@ void ieee80211_sta_update_pending_airtim
+@@ -2407,7 +2407,7 @@ void ieee80211_sta_update_pending_airtim
  }
  
  static struct ieee80211_sta_rx_stats *
@@ -25,7 +25,7 @@ Signed-off-by: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
  {
  	struct ieee80211_sta_rx_stats *stats = &sta->deflink.rx_stats;
  	int cpu;
-@@ -2424,8 +2424,13 @@ sta_get_last_rx_stats(struct sta_info *s
+@@ -2420,8 +2420,13 @@ sta_get_last_rx_stats(struct sta_info *s
  
  	for_each_possible_cpu(cpu) {
  		struct ieee80211_sta_rx_stats *cpustats;
@@ -39,7 +39,7 @@ Signed-off-by: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
  
  		if (time_after(cpustats->last_rx, stats->last_rx))
  			stats = cpustats;
-@@ -2502,7 +2507,7 @@ static void sta_stats_decode_rate(struct
+@@ -2498,7 +2503,7 @@ static void sta_stats_decode_rate(struct
  
  static int sta_set_rate_info_rx(struct sta_info *sta, struct rate_info *rinfo)
  {
@@ -48,7 +48,7 @@ Signed-off-by: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
  
  	if (rate == STA_STATS_RATE_INVALID)
  		return -EINVAL;
-@@ -2602,7 +2607,7 @@ void sta_set_sinfo(struct sta_info *sta,
+@@ -2598,7 +2603,7 @@ void sta_set_sinfo(struct sta_info *sta,
  	int i, ac, cpu;
  	struct ieee80211_sta_rx_stats *last_rxstats;
  
@@ -57,7 +57,7 @@ Signed-off-by: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
  
  	sinfo->generation = sdata->local->sta_generation;
  
-@@ -2886,7 +2891,7 @@ u32 sta_get_expected_throughput(struct s
+@@ -2882,7 +2887,7 @@ u32 sta_get_expected_throughput(struct s
  
  unsigned long ieee80211_sta_last_active(struct sta_info *sta)
  {
diff --git a/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch b/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
index e4a9c645cf5935..843f8d80324a10 100644
--- a/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
@@ -31,7 +31,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
  				struct net_device *dev, struct sta_info *sta,
  				struct ieee80211_key *key, struct sk_buff *skb,
-@@ -3658,7 +3660,7 @@ ieee80211_sdata_netdev_features(struct i
+@@ -3656,7 +3658,7 @@ ieee80211_sdata_netdev_features(struct i
  }
  
  static struct sk_buff *
@@ -40,7 +40,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  {
  	if (skb_is_gso(skb)) {
  		struct sk_buff *segs;
-@@ -3676,7 +3678,7 @@ ieee80211_tx_skb_fixup(struct sk_buff *s
+@@ -3674,7 +3676,7 @@ ieee80211_tx_skb_fixup(struct sk_buff *s
  	if (skb_needs_linearize(skb, features) && __skb_linearize(skb))
  		goto free;
  
@@ -49,7 +49,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  		int ofs = skb_checksum_start_offset(skb);
  
  		if (skb->encapsulation)
-@@ -3822,7 +3824,7 @@ static bool ieee80211_xmit_fast(struct i
+@@ -3820,7 +3822,7 @@ static bool ieee80211_xmit_fast(struct i
  	memcpy(&eth, skb->data, ETH_HLEN - 2);
  
  	/* after this point (skb is modified) we cannot return false */
@@ -58,7 +58,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	if (!skb)
  		return true;
  
-@@ -4367,7 +4369,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4366,7 +4368,7 @@ void __ieee80211_subif_start_xmit(struct
  	 * things so we cannot really handle checksum or GSO offload.
  	 * fix it up in software before we handle anything else.
  	 */
@@ -67,7 +67,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	if (!skb) {
  		len = 0;
  		goto out;
-@@ -4740,7 +4742,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4739,7 +4741,7 @@ static void ieee80211_8023_xmit(struct i
  		}
  	}
  
@@ -78,7 +78,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -2263,6 +2263,10 @@ int ieee80211_if_add(struct ieee80211_lo
+@@ -2246,6 +2246,10 @@ int ieee80211_if_add(struct ieee80211_lo
  
  		ndev->features |= local->hw.netdev_features;
  		ndev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
diff --git a/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch b/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
index 82fd4a6bdf2410..1369dc2b60d8e7 100644
--- a/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
@@ -23,7 +23,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2838,6 +2838,9 @@ struct ieee80211_txq {
+@@ -2875,6 +2875,9 @@ struct ieee80211_txq {
   *
   * @IEEE80211_HW_SUPPORTS_TID_CLASS_OFFLOAD: Hardware suports tid calssification offload.
   *
@@ -33,7 +33,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
   * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
   */
  enum ieee80211_hw_flags {
-@@ -2900,6 +2903,7 @@ enum ieee80211_hw_flags {
+@@ -2937,6 +2940,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
  	IEEE80211_HW_SUPPORTS_MESH_NSS_OFFLOAD,
  	IEEE80211_HW_SUPPORTS_TID_CLASS_OFFLOAD,
@@ -83,7 +83,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  		return false;
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-@@ -4352,7 +4359,8 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4351,7 +4358,8 @@ void __ieee80211_subif_start_xmit(struct
  		}
  	}
  
@@ -93,7 +93,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	ieee80211_aggr_check(sdata, sta, skb);
  
  	if (sta) {
-@@ -4706,8 +4714,10 @@ static void ieee80211_8023_xmit(struct i
+@@ -4705,8 +4713,10 @@ static void ieee80211_8023_xmit(struct i
  	bool multicast;
  	u8 tid;
  
@@ -106,7 +106,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  
  	multicast = is_multicast_ether_addr(ra);
  
-@@ -6426,9 +6436,12 @@ int ieee80211_tx_control_port(struct wip
+@@ -6427,9 +6437,12 @@ int ieee80211_tx_control_port(struct wip
  	}
  
  	if (!IS_ERR(sta)) {
@@ -123,7 +123,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  		 * for MLO STA, the SA should be the AP MLD address, but
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -4565,6 +4565,9 @@ static int ieee80211_get_txq_stats(struc
+@@ -4576,6 +4576,9 @@ static int ieee80211_get_txq_stats(struc
  	struct ieee80211_sub_if_data *sdata;
  	int ret = 0;
  
@@ -135,7 +135,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -993,7 +993,10 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+@@ -1001,7 +1001,10 @@ struct ieee80211_hw *ieee80211_alloc_hw_
  		atomic_set(&local->agg_queue_stop[i], 0);
  	}
  	tasklet_setup(&local->tx_pending_tasklet, ieee80211_tx_pending);
@@ -205,7 +205,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	int i;
  
  	sta = kzalloc(sizeof(*sta) + hw->sta_data_size, gfp);
-@@ -615,18 +617,22 @@ __sta_info_alloc(struct ieee80211_sub_if
+@@ -611,18 +613,22 @@ __sta_info_alloc(struct ieee80211_sub_if
  
  	sta->last_connected = ktime_get_seconds();
  
@@ -237,7 +237,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	}
  
  	if (sta_prepare_rate_control(local, sta, gfp))
-@@ -700,7 +706,8 @@ __sta_info_alloc(struct ieee80211_sub_if
+@@ -696,7 +702,8 @@ __sta_info_alloc(struct ieee80211_sub_if
  	return sta;
  
  free_txq:
@@ -247,7 +247,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  free:
  	sta_info_free_link(&sta->deflink);
  #ifdef CPTCFG_MAC80211_MESH
-@@ -1719,11 +1726,13 @@ void ieee80211_sta_ps_deliver_wakeup(str
+@@ -1715,11 +1722,13 @@ void ieee80211_sta_ps_deliver_wakeup(str
  	if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
  		drv_sta_notify(local, sdata, STA_NOTIFY_AWAKE, &sta->sta);
  
@@ -265,7 +265,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	}
  
  	skb_queue_head_init(&pending);
-@@ -2138,6 +2147,9 @@ ieee80211_sta_ps_deliver_response(struct
+@@ -2134,6 +2143,9 @@ ieee80211_sta_ps_deliver_response(struct
  		 * TIM recalculation.
  		 */
  
@@ -275,7 +275,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  		for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
  			if (!sta->sta.txq[tid] ||
  			    !(driver_release_tids & BIT(tid)) ||
-@@ -2572,7 +2584,7 @@ static void sta_set_tidstats(struct sta_
+@@ -2568,7 +2580,7 @@ static void sta_set_tidstats(struct sta_
  		tidstats->tx_msdu_failed = sta->deflink.status_stats.msdu_failed[tid];
  	}
  
@@ -284,7 +284,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  		spin_lock_bh(&local->fq.lock);
  		rcu_read_lock();
  
-@@ -2901,6 +2913,9 @@ unsigned long ieee80211_sta_last_active(
+@@ -2897,6 +2909,9 @@ unsigned long ieee80211_sta_last_active(
  
  static void sta_update_codel_params(struct sta_info *sta, u32 thr)
  {
diff --git a/package/kernel/mac80211/patches/nss/subsys/829-mac80211-fix-mesh-ping-issue.patch b/package/kernel/mac80211/patches/nss/subsys/829-mac80211-fix-mesh-ping-issue.patch
index 5a4423d5c7900f..0a805bd2e6d933 100644
--- a/package/kernel/mac80211/patches/nss/subsys/829-mac80211-fix-mesh-ping-issue.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/829-mac80211-fix-mesh-ping-issue.patch
@@ -10,7 +10,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
 
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -4711,16 +4711,14 @@ void ieee80211_check_fast_rx(struct sta_
+@@ -4715,16 +4715,14 @@ void ieee80211_check_fast_rx(struct sta_
  
  		break;
  	case NL80211_IFTYPE_MESH_POINT:
@@ -30,7 +30,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  	default:
  		goto clear;
  	}
-@@ -4942,10 +4940,7 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4946,10 +4944,7 @@ static bool ieee80211_invoke_fast_rx(str
  		u8 sa[ETH_ALEN];
  	} addrs __aligned(2);
  	struct ieee80211_sta_rx_stats *stats;
@@ -41,7 +41,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  	/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
  	 * to a common data structure; drivers can implement that per queue
-@@ -4995,37 +4990,6 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4999,37 +4994,6 @@ static bool ieee80211_invoke_fast_rx(str
  		snap_offs += IEEE80211_CCMP_HDR_LEN;
  	}
  
@@ -79,7 +79,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  	if (!ieee80211_vif_is_mesh(&rx->sdata->vif) &&
  	    !(status->rx_flags & IEEE80211_RX_AMSDU)) {
  		if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
-@@ -5063,30 +5027,6 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -5067,30 +5031,6 @@ static bool ieee80211_invoke_fast_rx(str
  		return true;
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/902-wifi-mac80211-Fix-memory-corruption-during-mesh-beac.patch b/package/kernel/mac80211/patches/nss/subsys/902-wifi-mac80211-Fix-memory-corruption-during-mesh-beac.patch
index 2f03604b6c457f..a070e2c4b5fbab 100644
--- a/package/kernel/mac80211/patches/nss/subsys/902-wifi-mac80211-Fix-memory-corruption-during-mesh-beac.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/902-wifi-mac80211-Fix-memory-corruption-during-mesh-beac.patch
@@ -25,7 +25,7 @@ Signed-off-by: Manish Dharanenthiran <quic_mdharane@quicinc.com>
 
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -728,7 +728,7 @@ struct ieee80211_if_mesh {
+@@ -731,7 +731,7 @@ struct ieee80211_if_mesh {
  	struct timer_list mesh_path_root_timer;
  
  	unsigned long wrkq_flags;
diff --git a/package/kernel/mac80211/patches/nss/subsys/917-QSDK-mac80211-WAR-for-association-failure-issue-with.patch b/package/kernel/mac80211/patches/nss/subsys/917-QSDK-mac80211-WAR-for-association-failure-issue-with.patch
index 6efc623307939e..dc3719a7eba95a 100644
--- a/package/kernel/mac80211/patches/nss/subsys/917-QSDK-mac80211-WAR-for-association-failure-issue-with.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/917-QSDK-mac80211-WAR-for-association-failure-issue-with.patch
@@ -27,7 +27,7 @@ Signed-off-by: Balamurugan Ramar <quic_bramar@quicinc.com>
 
 --- a/net/mac80211/mlme.c
 +++ b/net/mac80211/mlme.c
-@@ -7144,7 +7144,7 @@ void ieee80211_sta_work(struct ieee80211
+@@ -7752,7 +7752,7 @@ void ieee80211_sta_work(struct ieee80211
  			 */
  			if (status_acked) {
  				ifmgd->assoc_data->timeout =
diff --git a/package/kernel/mac80211/patches/nss/subsys/970-mac80211-ath10k-fix-airtime-underflow.patch b/package/kernel/mac80211/patches/nss/subsys/970-mac80211-ath10k-fix-airtime-underflow.patch
index 11f4f29ef7a2dc..ce79cdad0c57d1 100644
--- a/package/kernel/mac80211/patches/nss/subsys/970-mac80211-ath10k-fix-airtime-underflow.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/970-mac80211-ath10k-fix-airtime-underflow.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -2412,10 +2412,7 @@ void ieee80211_sta_update_pending_airtim
+@@ -2408,10 +2408,7 @@ void ieee80211_sta_update_pending_airtim
  	atomic_sub(tx_airtime, &local->aql_total_pending_airtime);
  	tx_pending = atomic_sub_return(tx_airtime,
  				       &local->aql_ac_pending_airtime[ac]);
diff --git a/package/kernel/mac80211/patches/nss/subsys/999-775-wifi-mac80211-Changes-for-WDS-MLD.patch b/package/kernel/mac80211/patches/nss/subsys/999-775-wifi-mac80211-Changes-for-WDS-MLD.patch
index 999d7108446107..961b549e0c82fe 100644
--- a/package/kernel/mac80211/patches/nss/subsys/999-775-wifi-mac80211-Changes-for-WDS-MLD.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/999-775-wifi-mac80211-Changes-for-WDS-MLD.patch
@@ -17,7 +17,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
 
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -8756,6 +8756,7 @@ bool cfg80211_rx_spurious_frame(struct n
+@@ -8803,6 +8803,7 @@ bool cfg80211_rx_spurious_frame(struct n
   * @dev: The device the frame matched to
   * @addr: the transmitter address
   * @gfp: context flags
@@ -25,7 +25,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
   *
   * This function is used in AP mode (only!) to inform userspace that
   * an associated station sent a 4addr frame but that wasn't expected.
-@@ -8765,7 +8766,8 @@ bool cfg80211_rx_spurious_frame(struct n
+@@ -8812,7 +8813,8 @@ bool cfg80211_rx_spurious_frame(struct n
   * for a reason other than not having a subscription.)
   */
  bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
@@ -37,7 +37,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
   * cfg80211_probe_status - notify userspace about probe status
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2188,9 +2188,16 @@ static int ieee80211_change_station(stru
+@@ -2207,9 +2207,16 @@ static int ieee80211_change_station(stru
  		vlansdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
  
  		if (params->vlan->ieee80211_ptr->use_4addr) {
@@ -54,7 +54,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  			rcu_assign_pointer(vlansdata->u.vlan.sta, sta);
  			__ieee80211_check_fast_rx_iface(vlansdata);
  
-@@ -2200,6 +2207,39 @@ static int ieee80211_change_station(stru
+@@ -2219,6 +2226,39 @@ static int ieee80211_change_station(stru
  			else
  				drv_sta_set_4addr(local, sta->sdata, &sta->sta,
  						  true);
@@ -127,7 +127,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -18877,7 +18877,8 @@ void cfg80211_conn_failed(struct net_dev
+@@ -18916,7 +18916,8 @@ void cfg80211_conn_failed(struct net_dev
  EXPORT_SYMBOL(cfg80211_conn_failed);
  
  static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
@@ -137,7 +137,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  {
  	struct wireless_dev *wdev = dev->ieee80211_ptr;
  	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
-@@ -18903,6 +18904,9 @@ static bool __nl80211_unexpected_frame(s
+@@ -18942,6 +18943,9 @@ static bool __nl80211_unexpected_frame(s
  	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
  		goto nla_put_failure;
  
@@ -147,7 +147,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  	genlmsg_end(msg, hdr);
  	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
  	return true;
-@@ -18926,14 +18930,15 @@ bool cfg80211_rx_spurious_frame(struct n
+@@ -18965,14 +18969,15 @@ bool cfg80211_rx_spurious_frame(struct n
  		return false;
  	}
  	ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
@@ -165,7 +165,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  {
  	struct wireless_dev *wdev = dev->ieee80211_ptr;
  	bool ret;
-@@ -18948,7 +18953,7 @@ bool cfg80211_rx_unexpected_4addr_frame(
+@@ -18987,7 +18992,7 @@ bool cfg80211_rx_unexpected_4addr_frame(
  	}
  	ret = __nl80211_unexpected_frame(dev,
  					 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
@@ -176,7 +176,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  }
 --- a/net/mac80211/chan.c
 +++ b/net/mac80211/chan.c
-@@ -979,6 +979,8 @@ __ieee80211_link_copy_chanctx_to_vlans(s
+@@ -1035,6 +1035,8 @@ __ieee80211_link_copy_chanctx_to_vlans(s
  	list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list) {
  		struct ieee80211_bss_conf *vlan_conf;
  
@@ -185,7 +185,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  		vlan_conf = wiphy_dereference(local->hw.wiphy,
  					      vlan->vif.link_conf[link_id]);
  		if (WARN_ON(!vlan_conf))
-@@ -1220,6 +1222,8 @@ ieee80211_link_update_chanreq(struct iee
+@@ -1276,6 +1278,8 @@ ieee80211_link_update_chanreq(struct iee
  	list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list) {
  		struct ieee80211_bss_conf *vlan_conf;
  
@@ -196,7 +196,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  		if (WARN_ON(!vlan_conf))
 --- a/net/mac80211/mlme.c
 +++ b/net/mac80211/mlme.c
-@@ -1847,9 +1847,9 @@ void ieee80211_send_4addr_nullfunc(struc
+@@ -2062,9 +2062,9 @@ void ieee80211_send_4addr_nullfunc(struc
  	fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
  			 IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
  	nullfunc->frame_control = fc;

From 0d665b2258bbb2b2edb9d4cc433d143a8c93bf33 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Fri, 27 Sep 2024 18:52:25 -0400
Subject: [PATCH 171/225] ath11k_nss: Revert patch for 512M + 2KB RX header

These patches should not be needed anymore. They are more problematic
than helpful.

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...11k-Disable-rx_header-tlv-for-2K-SKB.patch | 981 ++++++++++++++++++
 ...207-ath11k-Enable-256_512MB-profiles.patch | 327 ++++++
 2 files changed, 1308 insertions(+)
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/999-902-Revert-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/999-903-Revert-207-ath11k-Enable-256_512MB-profiles.patch

diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-902-Revert-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch b/package/kernel/mac80211/patches/nss/ath11k/999-902-Revert-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
new file mode 100644
index 00000000000000..2466b95ab5d2ac
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-902-Revert-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
@@ -0,0 +1,981 @@
+reverted:
+--- a/drivers/net/wireless/ath/ath11k/debugfs.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs.c
+@@ -669,7 +669,6 @@ static ssize_t ath11k_write_extd_rx_stat
+ 	}
+ 
+ 	ar->debug.rx_filter = tlv_filter.rx_filter;
+-	tlv_filter.offset_valid = false;
+ 
+ 	for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
+ 		ring_id = ar->dp.rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
+@@ -1230,7 +1229,6 @@ static ssize_t ath11k_write_pktlog_filte
+ 	}
+ 
+ 	/* Clear rx filter set for monitor mode and rx status */
+-	tlv_filter.offset_valid = false;
+ 	for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
+ 		ring_id = ar->dp.rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
+ 		ret = ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id, ar->dp.mac_id,
+--- a/drivers/net/wireless/ath/ath11k/dp.h
++++ b/drivers/net/wireless/ath/ath11k/dp.h
+@@ -237,8 +237,7 @@ struct ath11k_pdev_dp {
+ #define DP_REO_CMD_RING_SIZE		256
+ #define DP_REO_STATUS_RING_SIZE		2048
+ #define DP_RXDMA_BUF_RING_SIZE		4096
+-#define DP_RXDMA_REFILL_RING_SIZE	ATH11K_DP_RXDMA_REFILL_RING_SIZE
+-#define DP_RXDMA_NSS_REFILL_RING_SIZE	ATH11K_DP_RXDMA_NSS_REFILL_RING_SIZE
++#define DP_RXDMA_REFILL_RING_SIZE	2048
+ #define DP_RXDMA_ERR_DST_RING_SIZE	1024
+ #define DP_RXDMA_MON_STATUS_RING_SIZE	ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE
+ #define DP_RXDMA_MONITOR_BUF_RING_SIZE	ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE
+@@ -673,7 +672,7 @@ enum htt_stats_internal_ppdu_frametype {
+  *
+  *    |31       26|25|24|23            16|15             8|7             0|
+  *    |-----------------+----------------+----------------+---------------|
+- *    |   rsvd1|OV|PS|SS|     ring_id    |     pdev_id    |    msg_type   |
++ *    |   rsvd1   |PS|SS|     ring_id    |     pdev_id    |    msg_type   |
+  *    |-------------------------------------------------------------------|
+  *    |              rsvd2               |           ring_buffer_size     |
+  *    |-------------------------------------------------------------------|
+@@ -687,14 +686,6 @@ enum htt_stats_internal_ppdu_frametype {
+  *    |-------------------------------------------------------------------|
+  *    |                         tlv_filter_in_flags                       |
+  *    |-------------------------------------------------------------------|
+- *    |         rx_header_offset         |       rx_packet_offset         |
+- *    |-------------------------------------------------------------------|
+- *    |       rx_mpdu_start_offset       |      rx_mpdu_end_offset        |
+- *    |-------------------------------------------------------------------|
+- *    |       rx_msdu_start_offset       |      rx_msdu_end_offset        |
+- *    |-------------------------------------------------------------------|
+- *    |              rsvd3               |      rx_attention_offset       |
+- *    |-------------------------------------------------------------------|
+  * Where:
+  *     PS = pkt_swap
+  *     SS = status_swap
+@@ -708,10 +699,7 @@ enum htt_stats_internal_ppdu_frametype {
+  *                    More details can be got from enum htt_srng_ring_id
+  *          b'24    - status_swap: 1 is to swap status TLV
+  *          b'25    - pkt_swap:  1 is to swap packet TLV
+- *          b'26    - rx_offset_valid (OV): flag to indicate rx offsets
+- *                    configuration fields are valid
+- *
+- *          b'27:31 - rsvd1:  reserved for future use
++ *          b'26:31 - rsvd1:  reserved for future use
+  * dword1 - b'0:16  - ring_buffer_size: size of buffers referenced by rx ring,
+  *                    in byte units.
+  *                    Valid only for HW_TO_SW_RING and SW_TO_HW_RING
+@@ -740,42 +728,6 @@ enum htt_stats_internal_ppdu_frametype {
+  * dword6 - b'0:31 -  tlv_filter_in_flags:
+  *                    Filter in Attention/MPDU/PPDU/Header/User tlvs
+  *                    Refer to CFG_TLV_FILTER_IN_FLAG defs
+- * dword7 - b'0:15 -  rx_packet_offset: rx_packet_offset in byte units
+- *		      Valid only for HW_TO_SW_RING and SW_TO_HW_RING
+- *		      A value of 0 will be considered as ignore this config.
+- *		      Refer to BUF_RING_CFG_1 defs within HW .h files,
+- *		      e.g. wmac_top_reg_seq_hwioreg.h
+- *	  - b'16:31 - rx_header_offset: rx_header_offset in byte units
+- *		      Valid only for HW_TO_SW_RING and SW_TO_HW_RING
+- *		      A value of 0 will be considered as ignore this config.
+- *		      Refer to BUF_RING_CFG_1 defs within HW .h files,
+- *		      e.g. wmac_top_reg_seq_hwioreg.h
+- * dword8 - b'0:15 -  rx_mpdu_end_offset: rx_mpdu_end_offset in byte units
+- *	              Valid only for HW_TO_SW_RING and SW_TO_HW_RING
+- *		      A value of 0 will be considered as ignore this config.
+- *		      Refer to BUF_RING_CFG_2 defs within HW .h files,
+- *		      e.g. wmac_top_reg_seq_hwioreg.h
+- *	  - b'16:31 - rx_mpdu_start_offset: rx_mpdu_start_offset in byte units
+- *		      Valid only for HW_TO_SW_RING and SW_TO_HW_RING
+- *		      A value of 0 will be considered as ignore this config.
+- *		      Refer to BUF_RING_CFG_2 defs within HW .h files,
+- *		      e.g. wmac_top_reg_seq_hwioreg.h
+- * dword9 - b'0:15 -  rx_msdu_end_offset: rx_msdu_end_offset in byte units
+- *		      Valid only for HW_TO_SW_RING and SW_TO_HW_RING
+- *		      A value of 0 will be considered as ignore this config.
+- *		      Refer to BUF_RING_CFG_3 defs within HW .h files,
+- *		      e.g. wmac_top_reg_seq_hwioreg.h
+- *	  - b'16:31 - rx_msdu_start_offset: rx_msdu_start_offset in byte units
+- *		      Valid only for HW_TO_SW_RING and SW_TO_HW_RING
+- *		      A value of 0 will be considered as ignore this config.
+- *		      Refer to BUF_RING_CFG_3 defs within HW .h files,
+- *		      e.g. wmac_top_reg_seq_hwioreg.h
+- * dword10- b'0:15  - rx_attention_offset: rx_attention_offset in byte units
+- *		      Valid only for HW_TO_SW_RING and SW_TO_HW_RING
+- *		      A value of 0 will be considered as ignore this config.
+- *		      Refer to BUF_RING_CFG_4 defs within HW .h files,
+- *		      e.g. wmac_top_reg_seq_hwioreg.h
+- *	  - b'16:31 - rsvd3 for future use
+  */
+ 
+ #define HTT_RX_RING_SELECTION_CFG_CMD_INFO0_MSG_TYPE	GENMASK(7, 0)
+@@ -783,16 +735,8 @@ enum htt_stats_internal_ppdu_frametype {
+ #define HTT_RX_RING_SELECTION_CFG_CMD_INFO0_RING_ID	GENMASK(23, 16)
+ #define HTT_RX_RING_SELECTION_CFG_CMD_INFO0_SS		BIT(24)
+ #define HTT_RX_RING_SELECTION_CFG_CMD_INFO0_PS		BIT(25)
+-#define HTT_RX_RING_SELECTION_CFG_CMD_OFFSET_VALID      BIT(26)
+ 
+ #define HTT_RX_RING_SELECTION_CFG_CMD_INFO1_BUF_SIZE	GENMASK(15, 0)
+-#define HTT_RX_RING_SELECTION_CFG_RX_PACKET_OFFSET      GENMASK(15, 0)
+-#define HTT_RX_RING_SELECTION_CFG_RX_HEADER_OFFSET      GENMASK(31, 16)
+-#define HTT_RX_RING_SELECTION_CFG_RX_MPDU_END_OFFSET    GENMASK(15, 0)
+-#define HTT_RX_RING_SELECTION_CFG_RX_MPDU_START_OFFSET  GENMASK(31, 16)
+-#define HTT_RX_RING_SELECTION_CFG_RX_MSDU_END_OFFSET    GENMASK(15, 0)
+-#define HTT_RX_RING_SELECTION_CFG_RX_MSDU_START_OFFSET  GENMASK(31, 16)
+-#define HTT_RX_RING_SELECTION_CFG_RX_ATTENTION_OFFSET   GENMASK(15, 0)
+ 
+ enum htt_rx_filter_tlv_flags {
+ 	HTT_RX_FILTER_TLV_FLAGS_MPDU_START		= BIT(0),
+@@ -1096,14 +1040,6 @@ enum htt_rx_data_pkt_filter_tlv_flasg3 {
+ 		HTT_RX_FILTER_TLV_FLAGS_PER_MSDU_HEADER | \
+ 		HTT_RX_FILTER_TLV_FLAGS_ATTENTION)
+ 
+-#define HTT_RX_RXDMA_FILTER_TLV_FLAGS_BUF_RING \
+-		(HTT_RX_FILTER_TLV_FLAGS_MPDU_START | \
+-		HTT_RX_FILTER_TLV_FLAGS_MSDU_START | \
+-		HTT_RX_FILTER_TLV_FLAGS_RX_PACKET | \
+-		HTT_RX_FILTER_TLV_FLAGS_MSDU_END | \
+-		HTT_RX_FILTER_TLV_FLAGS_MPDU_END | \
+-		HTT_RX_FILTER_TLV_FLAGS_ATTENTION)
+-
+ struct htt_rx_ring_selection_cfg_cmd {
+ 	u32 info0;
+ 	u32 info1;
+@@ -1112,10 +1048,6 @@ struct htt_rx_ring_selection_cfg_cmd {
+ 	u32 pkt_type_en_flags2;
+ 	u32 pkt_type_en_flags3;
+ 	u32 rx_filter_tlv;
+-	u32 rx_packet_offset;
+-	u32 rx_mpdu_offset;
+-	u32 rx_msdu_offset;
+-	u32 rx_attn_offset;
+ } __packed;
+ 
+ struct htt_rx_ring_tlv_filter {
+@@ -1124,14 +1056,6 @@ struct htt_rx_ring_tlv_filter {
+ 	u32 pkt_filter_flags1; /* MGMT */
+ 	u32 pkt_filter_flags2; /* CTRL */
+ 	u32 pkt_filter_flags3; /* DATA */
+-	bool offset_valid;
+-	u16 rx_packet_offset;
+-	u16 rx_header_offset;
+-	u16 rx_mpdu_end_offset;
+-	u16 rx_mpdu_start_offset;
+-	u16 rx_msdu_end_offset;
+-	u16 rx_msdu_start_offset;
+-	u16 rx_attn_offset;
+ };
+ 
+ #define HTT_RX_FULL_MON_MODE_CFG_CMD_INFO0_MSG_TYPE	GENMASK(7, 0)
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -74,12 +74,6 @@ static inline bool ath11k_dp_rx_h_mpdu_s
+ 	return ab->hw_params.hw_ops->rx_desc_get_mpdu_fc_valid(desc);
+ }
+ 
+-static u16 ath11k_dp_rxdesc_get_mpdu_frame_ctrl(struct ath11k_base *ab,
+-						struct hal_rx_desc *desc)
+-{
+-	return ab->hw_params.hw_ops->rx_desc_get_mpdu_frame_ctl(desc);
+-}
+-
+ static inline bool ath11k_dp_rx_h_mpdu_start_more_frags(struct ath11k_base *ab,
+ 							struct sk_buff *skb)
+ {
+@@ -316,35 +310,6 @@ static u8 *ath11k_dp_rxdesc_mpdu_start_a
+ 	return ab->hw_params.hw_ops->rx_desc_mpdu_start_addr2(desc);
+ }
+ 
+-#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
+-static void ath11k_dp_get_rx_header_offset(struct ath11k_base *ab,
+-					   struct htt_rx_ring_tlv_filter *tlv_filter)
+-{
+-	ab->hw_params.hw_ops->rx_desc_get_offset(tlv_filter);
+-}
+-#endif
+-
+-static bool ath11k_dp_rx_desc_dot11_hdr_fields_valid(struct ath11k_base *ab,
+-						     struct hal_rx_desc *desc)
+-{
+-	return ab->hw_params.hw_ops->rx_desc_dot11_hdr_fields_valid(desc);
+-}
+-
+-static void ath11k_dp_rx_desc_get_dot11_hdr(struct ath11k_base *ab,
+-					    struct hal_rx_desc *desc,
+-					    struct ieee80211_hdr *hdr)
+-{
+-	ab->hw_params.hw_ops->rx_desc_get_dot11_hdr(desc, hdr);
+-}
+-
+-static void ath11k_dp_rx_desc_get_crypto_header(struct ath11k_base *ab,
+-						struct hal_rx_desc *desc,
+-						u8 *crypto_hdr,
+-						enum hal_encrypt_type enctype)
+-{
+-	ab->hw_params.hw_ops->rx_desc_get_crypto_header(desc, crypto_hdr, enctype);
+-}
+-
+ static void ath11k_dp_service_mon_ring(struct timer_list *t)
+ {
+ 	struct ath11k_base *ab = from_timer(ab, t, mon_reap_timer);
+@@ -2459,60 +2424,6 @@ int ath11k_dp_rx_crypto_icv_len(struct a
+ 	return 0;
+ }
+ 
+-static void ath11k_get_dot11_hdr_from_rx_desc(struct ath11k *ar,
+-					      struct sk_buff *msdu,
+-					      struct ath11k_skb_rxcb *rxcb,
+-					      struct ieee80211_rx_status *status,
+-					      enum hal_encrypt_type enctype)
+-{
+-	struct hal_rx_desc *rx_desc = rxcb->rx_desc;
+-	struct ath11k_base *ab = ar->ab;
+-	size_t hdr_len, crypto_len;
+-	struct ieee80211_hdr *hdr;
+-	u16 fc, qos_ctl = 0;
+-	int expand_by;
+-	u8 *crypto_hdr;
+-
+-	if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
+-		crypto_len = ath11k_dp_rx_crypto_param_len(ar, enctype);
+-		if (skb_headroom(msdu) < crypto_len) {
+-			expand_by = crypto_len - skb_headroom(msdu);
+-			if (WARN_ON_ONCE(pskb_expand_head(msdu, expand_by, 0, GFP_ATOMIC)))
+-				return;
+-		}
+-		crypto_hdr = skb_push(msdu, crypto_len);
+-		ath11k_dp_rx_desc_get_crypto_header(ab, rx_desc, crypto_hdr, enctype);
+-	}
+-
+-	fc = ath11k_dp_rxdesc_get_mpdu_frame_ctrl(ab, rx_desc);
+-	hdr_len = ieee80211_hdrlen(fc);
+-	if (skb_headroom(msdu) < hdr_len) {
+-		expand_by = hdr_len - skb_headroom(msdu);
+-		if (WARN_ON_ONCE(pskb_expand_head(msdu, expand_by, 0, GFP_ATOMIC)))
+-			return;
+-	}
+-	skb_push(msdu, hdr_len);
+-	hdr = (struct ieee80211_hdr *)msdu->data;
+-	hdr->frame_control = fc;
+-
+-	/* Get wifi header from rx_desc */
+-	ath11k_dp_rx_desc_get_dot11_hdr(ab, rx_desc, hdr);
+-
+-	if (rxcb->is_mcbc)
+-		status->flag &= ~RX_FLAG_PN_VALIDATED;
+-
+-	/* Add QOS header */
+-	if (ieee80211_is_data_qos(hdr->frame_control)) {
+-		qos_ctl = rxcb->tid;
+-		if (ath11k_dp_rx_h_msdu_start_mesh_ctl_present(ab, rx_desc))
+-			qos_ctl |= IEEE80211_QOS_CTL_MESH_CONTROL_PRESENT;
+-
+-		/* TODO Add other QoS ctl fields when required */
+-		memcpy(msdu->data + (hdr_len - IEEE80211_QOS_CTL_LEN),
+-		       &qos_ctl, IEEE80211_QOS_CTL_LEN);
+-	}
+-}
+-
+ static void ath11k_dp_rx_h_undecap_nwifi(struct ath11k *ar,
+ 					 struct sk_buff *msdu,
+ 					 u8 *first_hdr,
+@@ -2527,8 +2438,7 @@ static void ath11k_dp_rx_h_undecap_nwifi
+ 	u8 sa[ETH_ALEN];
+ 	u16 qos_ctl = 0;
+ 	int expand_by = 0;
+-	u8 *qos, *crypto_hdr;
+-	bool add_qos_ctrl = false;
++	u8 *qos;
+ 
+ 	/* copy SA & DA and pull decapped header */
+ 	hdr = (struct ieee80211_hdr *)msdu->data;
+@@ -2537,7 +2447,7 @@ static void ath11k_dp_rx_h_undecap_nwifi
+ 	ether_addr_copy(sa, ieee80211_get_SA(hdr));
+ 	skb_pull(msdu, ieee80211_hdrlen(hdr->frame_control));
+ 
+-	if (rxcb->is_first_msdu && first_hdr) {
++	if (rxcb->is_first_msdu) {
+ 		/* original 802.11 header is valid for the first msdu
+ 		 * hence we can reuse the same header
+ 		 */
+@@ -2567,7 +2477,6 @@ static void ath11k_dp_rx_h_undecap_nwifi
+ 
+ 		/* copy decap header before overwriting for reuse below */
+ 		memcpy(decap_hdr, (uint8_t *)hdr, hdr_len);
+-		add_qos_ctrl = true;
+ 	}
+ 
+ 	if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
+@@ -2578,17 +2487,13 @@ static void ath11k_dp_rx_h_undecap_nwifi
+ 			if (WARN_ON_ONCE(pskb_expand_head(msdu, expand_by, 0, GFP_ATOMIC)))
+ 				return;
+ 		}
+-		if (first_hdr) {
+-			memcpy(skb_push(msdu, crypto_param_len),
+-			       (void *)hdr + hdr_len, crypto_param_len);
+-		} else {
+-			crypto_hdr = skb_push(msdu, crypto_param_len);
+-			ath11k_dp_rx_desc_get_crypto_header(ar->ab,
+-							    rxcb->rx_desc, crypto_hdr, enctype);
+-		}
++		memcpy(skb_push(msdu,
++				ath11k_dp_rx_crypto_param_len(ar, enctype)),
++		       (void *)hdr + hdr_len,
++		       ath11k_dp_rx_crypto_param_len(ar, enctype));
+ 	}
+ 
+-	if (!rxcb->is_first_msdu || add_qos_ctrl) {
++	if (!rxcb->is_first_msdu) {
+ 		if (skb_headroom(msdu) < IEEE80211_QOS_CTL_LEN) {
+ 			expand_by = IEEE80211_QOS_CTL_LEN - skb_headroom(msdu);
+ 			if (WARN_ON_ONCE(pskb_expand_head(msdu, expand_by, 0, GFP_ATOMIC)))
+@@ -2720,25 +2625,6 @@ static void ath11k_dp_rx_h_undecap_eth(s
+ 	u8 sa[ETH_ALEN];
+ 	void *rfc1042;
+ 	int expand_by;
+-	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
+-	struct ath11k_dp_rfc1042_hdr rfc = {0xaa, 0xaa, 0x03, {0x00, 0x00, 0x00}};
+-
+-	if (!first_hdr) {
+-		eth = (struct ethhdr *)msdu->data;
+-		ether_addr_copy(da, eth->h_dest);
+-		ether_addr_copy(sa, eth->h_source);
+-		rfc.snap_type = eth->h_proto;
+-		skb_pull(msdu, sizeof(struct ethhdr));
+-		if (skb_headroom(msdu) < sizeof(struct ath11k_dp_rfc1042_hdr)) {
+-			expand_by = sizeof(struct ath11k_dp_rfc1042_hdr) - skb_headroom(msdu);
+-			if (WARN_ON_ONCE(pskb_expand_head(msdu, expand_by, 0, GFP_ATOMIC)))
+-				return;
+-		}
+-		memcpy(skb_push(msdu, sizeof(struct ath11k_dp_rfc1042_hdr)), &rfc,
+-		       sizeof(struct ath11k_dp_rfc1042_hdr));
+-		ath11k_get_dot11_hdr_from_rx_desc(ar, msdu, rxcb, status, enctype);
+-		goto exit;
+-	}
+ 
+ 	rfc1042 = ath11k_dp_rx_h_find_rfc1042(ar, msdu, enctype);
+ 	if (WARN_ON_ONCE(!rfc1042))
+@@ -2782,7 +2668,6 @@ static void ath11k_dp_rx_h_undecap_eth(s
+ 	}
+ 	memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
+ 
+-exit:
+ 	/* original 802.11 header has a different DA and in
+ 	 * case of 4addr it may also have different SA
+ 	 */
+@@ -2802,7 +2687,6 @@ static void ath11k_dp_rx_h_undecap_snap(
+ 	u8 l3_pad_bytes;
+ 	int expand_by;
+ 	struct hal_rx_desc *rx_desc;
+-	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
+ 
+ 	/* Delivered decapped frame:
+ 	 * [amsdu header] <-- replaced with 802.11 hdr
+@@ -2816,11 +2700,6 @@ static void ath11k_dp_rx_h_undecap_snap(
+ 	skb_put(msdu, l3_pad_bytes);
+ 	skb_pull(msdu, sizeof(struct ath11k_dp_amsdu_subframe_hdr) + l3_pad_bytes);
+ 
+-	if (!first_hdr) {
+-		ath11k_get_dot11_hdr_from_rx_desc(ar, msdu, rxcb, status, enctype);
+-		return;
+-	}
+-
+ 	hdr = (struct ieee80211_hdr *)first_hdr;
+ 	hdr_len = ieee80211_hdrlen(hdr->frame_control);
+ 
+@@ -3311,20 +3190,6 @@ static int ath11k_dp_rx_process_msdu(str
+ 		goto free_out;
+ 	}
+ 
+-	hdr_status = ath11k_dp_rx_h_80211_hdr(ab, rx_desc);
+-	/* wifi hdr fields validation for 512M::
+-	 * Mcast packets in ethernet frame mode
+-	 * will need wifi hdr in msdu to validate PN.
+-	 * Header will be added in undecap routine.
+-	 * Validation on wifi hdr fields from rx_desc.
+-	 */
+-	if (!hdr_status && ath11k_dp_rx_h_attn_is_mcbc(ab, rx_desc) &&
+-	    !ath11k_dp_rx_desc_dot11_hdr_fields_valid(ab, rx_desc)) {
+-		ath11k_warn(ab, "One or more invalid dot11 header fields\n");
+-		ret = -EIO;
+-		goto free_out;
+-	}
+-
+ 	rxcb = ATH11K_SKB_RXCB(msdu);
+ 	rxcb->rx_desc = rx_desc;
+ 	msdu_len = ath11k_dp_rx_h_msdu_start_msdu_len(ab, rx_desc);
+@@ -3337,9 +3202,8 @@ static int ath11k_dp_rx_process_msdu(str
+ 			hdr_status = ath11k_dp_rx_h_80211_hdr(ab, rx_desc);
+ 			ret = -EINVAL;
+ 			ath11k_warn(ab, "invalid msdu len %u\n", msdu_len);
+-			if (hdr_status)
+-				ath11k_dbg_dump(ab, ATH11K_DBG_DATA, NULL, "", hdr_status,
+-						sizeof(struct ieee80211_hdr));
++			ath11k_dbg_dump(ab, ATH11K_DBG_DATA, NULL, "", hdr_status,
++					sizeof(struct ieee80211_hdr));
+ 			ath11k_dbg_dump(ab, ATH11K_DBG_DATA, NULL, "", rx_desc,
+ 					sizeof(struct hal_rx_desc));
+ 			goto free_out;
+@@ -4308,7 +4172,6 @@ static int ath11k_dp_rx_h_verify_tkip_mi
+ 
+ 	hdr = (struct ieee80211_hdr *)(msdu->data + hal_rx_desc_sz);
+ 	hdr_len = ieee80211_hdrlen(hdr->frame_control);
+-
+ 	head_len = hdr_len + hal_rx_desc_sz + IEEE80211_TKIP_IV_LEN;
+ 	tail_len = IEEE80211_CCMP_MIC_LEN + IEEE80211_TKIP_ICV_LEN + FCS_LEN;
+ 
+@@ -4589,8 +4452,8 @@ static void ath11k_dp_rx_h_sort_frags(st
+ 
+ static u64 ath11k_dp_rx_h_get_pn(struct ath11k *ar, struct sk_buff *skb)
+ {
+-	u64 pn = 0;
+ 	struct ieee80211_hdr *hdr;
++	u64 pn = 0;
+ 	u8 *ehdr;
+ 	u32 hal_rx_desc_sz = ar->ab->hw_params.hal_desc_sz;
+ 
+@@ -4817,9 +4680,8 @@ ath11k_dp_process_rx_err_buf(struct ath1
+ 	if ((msdu_len + hal_rx_desc_sz) > DP_RX_BUFFER_SIZE) {
+ 		hdr_status = ath11k_dp_rx_h_80211_hdr(ar->ab, rx_desc);
+ 		ath11k_warn(ar->ab, "invalid msdu leng %u", msdu_len);
+-		if (hdr_status)
+-			ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "", hdr_status,
+-					sizeof(struct ieee80211_hdr));
++		ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "", hdr_status,
++				sizeof(struct ieee80211_hdr));
+ 		ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "", rx_desc,
+ 				sizeof(struct hal_rx_desc));
+ 		dev_kfree_skb_any(msdu);
+@@ -5451,47 +5313,6 @@ void ath11k_dp_rx_pdev_free(struct ath11
+ 	ath11k_dp_rxdma_pdev_buf_free(ar);
+ }
+ 
+-#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
+-static int ath11k_dp_rxdma_ring_sel_config(struct ath11k *ar)
+-{
+-	struct ath11k_pdev_dp *dp = &ar->dp;
+-	struct htt_rx_ring_tlv_filter tlv_filter = {0};
+-	u32 ring_id;
+-	int ret;
+-	u32 hal_rx_desc_sz = ar->ab->hw_params.hal_desc_sz;
+-
+-	ring_id = dp->rx_refill_buf_ring.refill_buf_ring.ring_id;
+-
+-	tlv_filter.rx_filter = HTT_RX_RXDMA_FILTER_TLV_FLAGS_BUF_RING;
+-	tlv_filter.pkt_filter_flags2 = HTT_RX_FP_CTRL_PKT_FILTER_TLV_FLAGS2_BAR;
+-	tlv_filter.pkt_filter_flags3 = HTT_RX_FP_DATA_PKT_FILTER_TLV_FLASG3_MCAST |
+-					HTT_RX_FP_DATA_PKT_FILTER_TLV_FLASG3_UCAST;
+-	tlv_filter.offset_valid = true;
+-	tlv_filter.rx_packet_offset = hal_rx_desc_sz;
+-	tlv_filter.rx_header_offset = 0;
+-
+-	ath11k_dp_get_rx_header_offset(ar->ab, &tlv_filter);
+-
+-	if (!ar->ab->nss.enabled)
+-		ret = ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id, dp->mac_id,
+-						       HAL_RXDMA_BUF,
+-						       DP_RXDMA_REFILL_RING_SIZE,
+-						       &tlv_filter);
+-	else
+-		ret = ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id, dp->mac_id,
+-						       HAL_RXDMA_BUF,
+-						       DP_RXDMA_NSS_REFILL_RING_SIZE,
+-						       &tlv_filter);
+-
+-	return ret;
+-}
+-#else
+-static int ath11k_dp_rxdma_ring_sel_config(struct ath11k *ar)
+-{
+-	return 0;
+-}
+-#endif
+-
+ int ath11k_dp_rx_pdev_alloc(struct ath11k_base *ab, int mac_id)
+ {
+ 	struct ath11k *ar = ab->pdevs[mac_id].ar;
+@@ -5585,12 +5406,6 @@ config_refill_ring:
+ 		}
+ 	}
+ 
+-	ret = ath11k_dp_rxdma_ring_sel_config(ar);
+-	if (ret) {
+-		ath11k_warn(ab, "failed to setup rxdma ring selection config\n");
+-		return ret;
+-	}
+-
+ 	return 0;
+ }
+ 
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -1283,8 +1283,6 @@ int ath11k_dp_tx_htt_rx_filter_setup(str
+ 				 !!(params.flags & HAL_SRNG_FLAGS_MSI_SWAP));
+ 	cmd->info0 |= FIELD_PREP(HTT_RX_RING_SELECTION_CFG_CMD_INFO0_PS,
+ 				 !!(params.flags & HAL_SRNG_FLAGS_DATA_TLV_SWAP));
+-	cmd->info0 |= FIELD_PREP(HTT_RX_RING_SELECTION_CFG_CMD_OFFSET_VALID,
+-				tlv_filter->offset_valid);
+ 
+ 	cmd->info1 = FIELD_PREP(HTT_RX_RING_SELECTION_CFG_CMD_INFO1_BUF_SIZE,
+ 				rx_buf_size);
+@@ -1294,26 +1292,6 @@ int ath11k_dp_tx_htt_rx_filter_setup(str
+ 	cmd->pkt_type_en_flags3 = tlv_filter->pkt_filter_flags3;
+ 	cmd->rx_filter_tlv = tlv_filter->rx_filter;
+ 
+-	if (tlv_filter->offset_valid) {
+-		cmd->rx_packet_offset = FIELD_PREP(HTT_RX_RING_SELECTION_CFG_RX_PACKET_OFFSET,
+-						   tlv_filter->rx_packet_offset);
+-		cmd->rx_packet_offset |= FIELD_PREP(HTT_RX_RING_SELECTION_CFG_RX_HEADER_OFFSET,
+-						    tlv_filter->rx_header_offset);
+-
+-		cmd->rx_mpdu_offset = FIELD_PREP(HTT_RX_RING_SELECTION_CFG_RX_MPDU_END_OFFSET,
+-						 tlv_filter->rx_mpdu_end_offset);
+-		cmd->rx_mpdu_offset |= FIELD_PREP(HTT_RX_RING_SELECTION_CFG_RX_MPDU_START_OFFSET,
+-						  tlv_filter->rx_mpdu_start_offset);
+-
+-		cmd->rx_msdu_offset = FIELD_PREP(HTT_RX_RING_SELECTION_CFG_RX_MSDU_END_OFFSET,
+-						 tlv_filter->rx_msdu_end_offset);
+-		cmd->rx_msdu_offset |= FIELD_PREP(HTT_RX_RING_SELECTION_CFG_RX_MSDU_START_OFFSET,
+-						  tlv_filter->rx_msdu_start_offset);
+-
+-		cmd->rx_attn_offset = FIELD_PREP(HTT_RX_RING_SELECTION_CFG_RX_ATTENTION_OFFSET,
+-						 tlv_filter->rx_attn_offset);
+-	}
+-
+ 	ret = ath11k_htc_send(&ab->htc, ab->dp.eid, skb);
+ 	if (ret)
+ 		goto err_free;
+@@ -1392,7 +1370,6 @@ int ath11k_dp_tx_htt_monitor_mode_ring_c
+ 	}
+ 
+ 	ring_id = dp->rxdma_mon_buf_ring.refill_buf_ring.ring_id;
+-	tlv_filter.offset_valid = false;
+ 
+ 	if (!reset) {
+ 		tlv_filter.rx_filter = HTT_RX_MON_FILTER_TLV_FLAGS_MON_BUF_RING;
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -260,11 +260,7 @@ static u8 ath11k_hw_ipq8074_rx_desc_get_
+ 
+ static u8 *ath11k_hw_ipq8074_rx_desc_get_hdr_status(struct hal_rx_desc *desc)
+ {
+-#ifndef CPTCFG_ATH11K_MEM_PROFILE_512M
+ 	return desc->u.ipq8074.hdr_status;
+-#else
+-	return NULL;
+-#endif
+ }
+ 
+ static bool ath11k_hw_ipq8074_rx_desc_encrypt_valid(struct hal_rx_desc *desc)
+@@ -409,132 +405,26 @@ static void ath11k_hw_ipq8074_rx_desc_se
+ 	desc->u.ipq8074.msdu_start.info1 = __cpu_to_le32(info);
+ }
+ 
+-static
+-struct rx_attention *ath11k_hw_ipq8074_rx_desc_get_attention(struct hal_rx_desc *desc)
+-{
+-	return &desc->u.ipq8074.attention;
+-}
+-
+-static u8 *ath11k_hw_ipq8074_rx_desc_get_msdu_payload(struct hal_rx_desc *desc)
+-{
+-	return &desc->u.ipq8074.msdu_payload[0];
+-}
+-
+-#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
+-static void ath11k_hw_ipq8074_rx_desc_get_offset(struct htt_rx_ring_tlv_filter *tlv_filter)
+-{
+-	tlv_filter->rx_mpdu_end_offset = __le16_to_cpu(offsetof
+-			(struct hal_rx_desc_ipq8074, mpdu_end_tag));
+-	tlv_filter->rx_mpdu_start_offset = __le16_to_cpu(offsetof
+-			(struct hal_rx_desc_ipq8074, mpdu_start_tag));
+-	tlv_filter->rx_msdu_end_offset = __le16_to_cpu(offsetof
+-			(struct hal_rx_desc_ipq8074, msdu_end_tag));
+-	tlv_filter->rx_msdu_start_offset = __le16_to_cpu(offsetof
+-			(struct hal_rx_desc_ipq8074, msdu_start_tag));
+-	tlv_filter->rx_attn_offset = __le16_to_cpu(offsetof
+-			(struct hal_rx_desc_ipq8074, rx_attn_tag));
+-}
+-#endif
+-
+-static u16 ath11k_hw_ipq8074_rx_desc_get_mpdu_frame_ctl(struct hal_rx_desc *desc)
+-{
+-	return __le16_to_cpu(desc->u.ipq8074.mpdu_start.frame_ctrl);
+-}
+-
+ static bool ath11k_hw_ipq8074_rx_desc_mac_addr2_valid(struct hal_rx_desc *desc)
+ {
+ 	return __le32_to_cpu(desc->u.ipq8074.mpdu_start.info1) &
+ 	       RX_MPDU_START_INFO1_MAC_ADDR2_VALID;
+ }
+ 
+-static u8* ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2(struct hal_rx_desc *desc)
++static u8 *ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2(struct hal_rx_desc *desc)
+ {
+ 	return desc->u.ipq8074.mpdu_start.addr2;
+ }
+ 
+-static bool ath11k_hw_ipq8074_rx_desc_dot11_hdr_fields_valid(struct hal_rx_desc *desc)
+-{
+-	if ((ath11k_hw_ipq8074_rx_desc_get_mpdu_seq_ctl_vld(desc) &&
+-	     ath11k_hw_ipq8074_rx_desc_get_mpdu_fc_valid(desc) &&
+-	     __le32_to_cpu(desc->u.ipq8074.mpdu_start.info1) &
+-			   RX_MPDU_START_INFO1_MAC_ADDR1_VALID &&
+-	     ath11k_hw_ipq8074_rx_desc_mac_addr2_valid(desc) &&
+-	     __le32_to_cpu(desc->u.ipq8074.mpdu_start.info1) &
+-			   RX_MPDU_START_INFO1_MAC_ADDR3_VALID &&
+-	     FIELD_GET((RX_MPDU_START_INFO1_MPDU_DUR_VALID),
+-			__le32_to_cpu(desc->u.ipq8074.mpdu_start.info1)))) {
+-		return true;
+-	}
+-	return false;
+-}
+-
+-static void ath11k_hw_ipq8074_rx_desc_get_dot11_hdr(struct hal_rx_desc *desc,
+-						    struct ieee80211_hdr *hdr)
+-{
+-	hdr->frame_control = __le16_to_cpu(desc->u.ipq8074.mpdu_start.frame_ctrl);
+-	hdr->duration_id = __le16_to_cpu(desc->u.ipq8074.mpdu_start.duration);
+-	ether_addr_copy(hdr->addr1, desc->u.ipq8074.mpdu_start.addr1);
+-	ether_addr_copy(hdr->addr2, desc->u.ipq8074.mpdu_start.addr2);
+-	ether_addr_copy(hdr->addr3, desc->u.ipq8074.mpdu_start.addr3);
+-	if (__le32_to_cpu(desc->u.ipq8074.mpdu_start.info1) &
+-			RX_MPDU_START_INFO1_MAC_ADDR4_VALID) {
+-		ether_addr_copy(hdr->addr4, desc->u.ipq8074.mpdu_start.addr4);
+-	}
+-	hdr->seq_ctrl = __le16_to_cpu(desc->u.ipq8074.mpdu_start.seq_ctrl);
+-}
+-
+-static void ath11k_hw_ipq8074_rx_desc_get_crypto_hdr(struct hal_rx_desc *desc,
+-						     u8 *crypto_hdr,
+-						     enum hal_encrypt_type enctype)
+-{
+-	unsigned int key_id;
+-
+-	switch (enctype) {
+-	case HAL_ENCRYPT_TYPE_OPEN:
+-		return;
+-	case HAL_ENCRYPT_TYPE_TKIP_NO_MIC:
+-	case HAL_ENCRYPT_TYPE_TKIP_MIC:
+-		crypto_hdr[0] =
+-			HAL_RX_MPDU_INFO_PN_GET_BYTE2(desc->u.ipq8074.mpdu_start.pn[0]);
+-		crypto_hdr[1] = 0;
+-		crypto_hdr[2] =
+-			HAL_RX_MPDU_INFO_PN_GET_BYTE1(desc->u.ipq8074.mpdu_start.pn[0]);
+-		break;
+-	case HAL_ENCRYPT_TYPE_CCMP_128:
+-	case HAL_ENCRYPT_TYPE_CCMP_256:
+-	case HAL_ENCRYPT_TYPE_GCMP_128:
+-	case HAL_ENCRYPT_TYPE_AES_GCMP_256:
+-		crypto_hdr[0] =
+-			HAL_RX_MPDU_INFO_PN_GET_BYTE1(desc->u.ipq8074.mpdu_start.pn[0]);
+-		crypto_hdr[1] =
+-			HAL_RX_MPDU_INFO_PN_GET_BYTE2(desc->u.ipq8074.mpdu_start.pn[0]);
+-		crypto_hdr[2] = 0;
+-		break;
+-	case HAL_ENCRYPT_TYPE_WEP_40:
+-	case HAL_ENCRYPT_TYPE_WEP_104:
+-	case HAL_ENCRYPT_TYPE_WEP_128:
+-	case HAL_ENCRYPT_TYPE_WAPI_GCM_SM4:
+-	case HAL_ENCRYPT_TYPE_WAPI:
+-		return;
+-	}
+-	key_id        = FIELD_GET(RX_MPDU_START_INFO5_KEY_ID,
+-				  __le32_to_cpu(desc->u.ipq8074.mpdu_start.info5));
+-	crypto_hdr[3] = 0x20 | (key_id << 6);
+-	crypto_hdr[4] = HAL_RX_MPDU_INFO_PN_GET_BYTE3(desc->u.ipq8074.mpdu_start.pn[0]);
+-	crypto_hdr[5] = HAL_RX_MPDU_INFO_PN_GET_BYTE4(desc->u.ipq8074.mpdu_start.pn[0]);
+-	crypto_hdr[6] = HAL_RX_MPDU_INFO_PN_GET_BYTE1(desc->u.ipq8074.mpdu_start.pn[1]);
+-	crypto_hdr[7] = HAL_RX_MPDU_INFO_PN_GET_BYTE2(desc->u.ipq8074.mpdu_start.pn[1]);
+-}
+-
+-static bool ath11k_hw_qcn9074_rx_desc_mac_addr2_valid(struct hal_rx_desc *desc)
++static
++struct rx_attention *ath11k_hw_ipq8074_rx_desc_get_attention(struct hal_rx_desc *desc)
+ {
+-        return __le32_to_cpu(desc->u.qcn9074.mpdu_start.info11) &
+-	       RX_MPDU_START_INFO11_MAC_ADDR2_VALID;
++	return &desc->u.ipq8074.attention;
+ }
+ 
+-static u8* ath11k_hw_qcn9074_rx_desc_mpdu_start_addr2(struct hal_rx_desc *desc)
++static u8 *ath11k_hw_ipq8074_rx_desc_get_msdu_payload(struct hal_rx_desc *desc)
+ {
+-        return desc->u.qcn9074.mpdu_start.addr2;
++	return &desc->u.ipq8074.msdu_payload[0];
+ }
+ 
+ static bool ath11k_hw_qcn9074_rx_desc_get_first_msdu(struct hal_rx_desc *desc)
+@@ -557,11 +447,7 @@ static u8 ath11k_hw_qcn9074_rx_desc_get_
+ 
+ static u8 *ath11k_hw_qcn9074_rx_desc_get_hdr_status(struct hal_rx_desc *desc)
+ {
+-#ifndef CPTCFG_ATH11K_MEM_PROFILE_512M
+ 	return desc->u.qcn9074.hdr_status;
+-#else
+-	return NULL;
+-#endif
+ }
+ 
+ static bool ath11k_hw_qcn9074_rx_desc_encrypt_valid(struct hal_rx_desc *desc)
+@@ -748,11 +634,7 @@ static u8 ath11k_hw_wcn6855_rx_desc_get_
+ 
+ static u8 *ath11k_hw_wcn6855_rx_desc_get_hdr_status(struct hal_rx_desc *desc)
+ {
+-#ifndef CPTCFG_ATH11K_MEM_PROFILE_512M
+ 	return desc->u.wcn6855.hdr_status;
+-#else
+-	return NULL;
+-#endif
+ }
+ 
+ static bool ath11k_hw_wcn6855_rx_desc_encrypt_valid(struct hal_rx_desc *desc)
+@@ -902,96 +784,6 @@ static u8 *ath11k_hw_wcn6855_rx_desc_mpd
+ {
+ 	return desc->u.wcn6855.mpdu_start.addr2;
+ }
+-#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
+-static void ath11k_hw_qcn9074_rx_desc_get_offset(struct htt_rx_ring_tlv_filter *tlv_filter)
+-{
+-	tlv_filter->rx_mpdu_end_offset = __le16_to_cpu(offsetof
+-			(struct hal_rx_desc_qcn9074, mpdu_end_tag));
+-	tlv_filter->rx_mpdu_start_offset = __le16_to_cpu(offsetof
+-			(struct hal_rx_desc_qcn9074, mpdu_start_tag));
+-	tlv_filter->rx_msdu_end_offset = __le16_to_cpu(offsetof
+-			(struct hal_rx_desc_qcn9074, msdu_end_tag));
+-	tlv_filter->rx_msdu_start_offset = __le16_to_cpu(offsetof
+-			(struct hal_rx_desc_qcn9074, msdu_start_tag));
+-	tlv_filter->rx_attn_offset = __le16_to_cpu(offsetof
+-			(struct hal_rx_desc_qcn9074, rx_attn_tag));
+-}
+-#endif
+-
+-static u16 ath11k_hw_qcn9074_rx_desc_get_mpdu_frame_ctl(struct hal_rx_desc *desc)
+-{
+-	return __le16_to_cpu(desc->u.qcn9074.mpdu_start.frame_ctrl);
+-}
+-
+-static bool ath11k_hw_qcn9074_rx_desc_dot11_hdr_fields_valid(struct hal_rx_desc *desc)
+-{
+-	if ((ath11k_hw_qcn9074_rx_desc_get_mpdu_seq_ctl_vld(desc) &&
+-	     ath11k_hw_qcn9074_rx_desc_get_mpdu_fc_valid(desc) &&
+-	     (__le32_to_cpu(desc->u.qcn9074.mpdu_start.info11) &
+-			     RX_MPDU_START_INFO11_MAC_ADDR1_VALID) &&
+-	     ath11k_hw_qcn9074_rx_desc_mac_addr2_valid(desc) &&
+-	     (__le32_to_cpu(desc->u.qcn9074.mpdu_start.info11) &
+-			    RX_MPDU_START_INFO11_MAC_ADDR3_VALID) &&
+-	     FIELD_GET((RX_MPDU_START_INFO11_MPDU_DUR_VALID),
+-			__le32_to_cpu(desc->u.qcn9074.mpdu_start.info11)))) {
+-		return true;
+-	}
+-	return false;
+-}
+-
+-static void ath11k_hw_qcn9074_rx_desc_get_dot11_hdr(struct hal_rx_desc *desc,
+-						    struct ieee80211_hdr *hdr)
+-{
+-	hdr->frame_control = __le16_to_cpu(desc->u.qcn9074.mpdu_start.frame_ctrl);
+-	hdr->duration_id = __le16_to_cpu(desc->u.qcn9074.mpdu_start.duration);
+-	ether_addr_copy(hdr->addr1, desc->u.qcn9074.mpdu_start.addr1);
+-	ether_addr_copy(hdr->addr2, desc->u.qcn9074.mpdu_start.addr2);
+-	ether_addr_copy(hdr->addr3, desc->u.qcn9074.mpdu_start.addr3);
+-	if (__le32_to_cpu(desc->u.qcn9074.mpdu_start.info11) &
+-			  RX_MPDU_START_INFO11_MAC_ADDR4_VALID) {
+-		ether_addr_copy(hdr->addr4, desc->u.qcn9074.mpdu_start.addr4);
+-	}
+-	hdr->seq_ctrl = __le16_to_cpu(desc->u.qcn9074.mpdu_start.seq_ctrl);
+-}
+-
+-static void ath11k_hw_qcn9074_rx_desc_get_crypto_hdr(struct hal_rx_desc *desc,
+-						     u8 *crypto_hdr,
+-						     enum hal_encrypt_type enctype)
+-{
+-	unsigned int key_id;
+-
+-	switch (enctype) {
+-	case HAL_ENCRYPT_TYPE_OPEN:
+-		return;
+-	case HAL_ENCRYPT_TYPE_TKIP_NO_MIC:
+-	case HAL_ENCRYPT_TYPE_TKIP_MIC:
+-		crypto_hdr[0] = HAL_RX_MPDU_INFO_PN_GET_BYTE2(desc->u.qcn9074.mpdu_start.pn[0]);
+-		crypto_hdr[1] = 0;
+-		crypto_hdr[2] = HAL_RX_MPDU_INFO_PN_GET_BYTE1(desc->u.qcn9074.mpdu_start.pn[0]);
+-		break;
+-	case HAL_ENCRYPT_TYPE_CCMP_128:
+-	case HAL_ENCRYPT_TYPE_CCMP_256:
+-	case HAL_ENCRYPT_TYPE_GCMP_128:
+-	case HAL_ENCRYPT_TYPE_AES_GCMP_256:
+-		crypto_hdr[0] = HAL_RX_MPDU_INFO_PN_GET_BYTE1(desc->u.qcn9074.mpdu_start.pn[0]);
+-		crypto_hdr[1] = HAL_RX_MPDU_INFO_PN_GET_BYTE2(desc->u.qcn9074.mpdu_start.pn[0]);
+-		crypto_hdr[2] = 0;
+-		break;
+-	case HAL_ENCRYPT_TYPE_WEP_40:
+-	case HAL_ENCRYPT_TYPE_WEP_104:
+-	case HAL_ENCRYPT_TYPE_WEP_128:
+-	case HAL_ENCRYPT_TYPE_WAPI_GCM_SM4:
+-	case HAL_ENCRYPT_TYPE_WAPI:
+-		return;
+-	}
+-	key_id        = FIELD_GET(RX_MPDU_START_INFO12_KEY_ID,
+-				  __le32_to_cpu(desc->u.qcn9074.mpdu_start.info12));
+-	crypto_hdr[3] = 0x20 | (key_id << 6);
+-	crypto_hdr[4] = HAL_RX_MPDU_INFO_PN_GET_BYTE3(desc->u.qcn9074.mpdu_start.pn[0]);
+-	crypto_hdr[5] = HAL_RX_MPDU_INFO_PN_GET_BYTE4(desc->u.qcn9074.mpdu_start.pn[0]);
+-	crypto_hdr[6] = HAL_RX_MPDU_INFO_PN_GET_BYTE1(desc->u.qcn9074.mpdu_start.pn[1]);
+-	crypto_hdr[7] = HAL_RX_MPDU_INFO_PN_GET_BYTE2(desc->u.qcn9074.mpdu_start.pn[1]);
+-}
+ 
+ static void ath11k_hw_wcn6855_reo_setup(struct ath11k_base *ab)
+ {
+@@ -1196,13 +988,6 @@ const struct ath11k_hw_ops ipq8074_ops =
+ 	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2,
+ 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
+ 	.rx_desc_get_hal_mpdu_len = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_len,
+-#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
+-	.rx_desc_get_offset = ath11k_hw_ipq8074_rx_desc_get_offset,
+-#endif
+-	.rx_desc_get_mpdu_frame_ctl = ath11k_hw_ipq8074_rx_desc_get_mpdu_frame_ctl,
+-	.rx_desc_dot11_hdr_fields_valid = ath11k_hw_ipq8074_rx_desc_dot11_hdr_fields_valid,
+-	.rx_desc_get_dot11_hdr = ath11k_hw_ipq8074_rx_desc_get_dot11_hdr,
+-	.rx_desc_get_crypto_header = ath11k_hw_ipq8074_rx_desc_get_crypto_hdr,
+ };
+ 
+ const struct ath11k_hw_ops ipq6018_ops = {
+@@ -1244,13 +1029,6 @@ const struct ath11k_hw_ops ipq6018_ops =
+ 	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2,
+ 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
+ 	.rx_desc_get_hal_mpdu_len = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_len,
+-#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
+-	.rx_desc_get_offset = ath11k_hw_ipq8074_rx_desc_get_offset,
+-#endif
+-	.rx_desc_get_mpdu_frame_ctl = ath11k_hw_ipq8074_rx_desc_get_mpdu_frame_ctl,
+-	.rx_desc_dot11_hdr_fields_valid = ath11k_hw_ipq8074_rx_desc_dot11_hdr_fields_valid,
+-	.rx_desc_get_dot11_hdr = ath11k_hw_ipq8074_rx_desc_get_dot11_hdr,
+-	.rx_desc_get_crypto_header = ath11k_hw_ipq8074_rx_desc_get_crypto_hdr,
+ };
+ 
+ const struct ath11k_hw_ops qca6390_ops = {
+@@ -1293,13 +1071,6 @@ const struct ath11k_hw_ops qca6390_ops =
+ 	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2,
+ 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
+ 	.rx_desc_get_hal_mpdu_len = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_len,
+-#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
+-	.rx_desc_get_offset = ath11k_hw_ipq8074_rx_desc_get_offset,
+-#endif
+-	.rx_desc_get_mpdu_frame_ctl = ath11k_hw_ipq8074_rx_desc_get_mpdu_frame_ctl,
+-	.rx_desc_dot11_hdr_fields_valid = ath11k_hw_ipq8074_rx_desc_dot11_hdr_fields_valid,
+-	.rx_desc_get_dot11_hdr = ath11k_hw_ipq8074_rx_desc_get_dot11_hdr,
+-	.rx_desc_get_crypto_header = ath11k_hw_ipq8074_rx_desc_get_crypto_hdr,
+ };
+ 
+ const struct ath11k_hw_ops qcn9074_ops = {
+@@ -1337,17 +1108,10 @@ const struct ath11k_hw_ops qcn9074_ops =
+ 	.rx_desc_get_msdu_payload = ath11k_hw_qcn9074_rx_desc_get_msdu_payload,
+ 	.reo_setup = ath11k_hw_ipq8074_reo_setup,
+ 	.mpdu_info_get_peerid = ath11k_hw_qcn9074_mpdu_info_get_peerid,
+-	.rx_desc_mac_addr2_valid = ath11k_hw_qcn9074_rx_desc_mac_addr2_valid,
+-	.rx_desc_mpdu_start_addr2 = ath11k_hw_qcn9074_rx_desc_mpdu_start_addr2,
++	.rx_desc_mac_addr2_valid = ath11k_hw_ipq9074_rx_desc_mac_addr2_valid,
++	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq9074_rx_desc_mpdu_start_addr2,
+ 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
+ 	.rx_desc_get_hal_mpdu_len = ath11k_hw_qcn9074_rx_desc_get_hal_mpdu_len,
+-#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
+-	.rx_desc_get_offset = ath11k_hw_qcn9074_rx_desc_get_offset,
+-#endif
+-	.rx_desc_get_mpdu_frame_ctl = ath11k_hw_qcn9074_rx_desc_get_mpdu_frame_ctl,
+-	.rx_desc_dot11_hdr_fields_valid = ath11k_hw_qcn9074_rx_desc_dot11_hdr_fields_valid,
+-	.rx_desc_get_dot11_hdr = ath11k_hw_qcn9074_rx_desc_get_dot11_hdr,
+-	.rx_desc_get_crypto_header = ath11k_hw_qcn9074_rx_desc_get_crypto_hdr,
+ };
+ 
+ const struct ath11k_hw_ops wcn6855_ops = {
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -22,11 +22,6 @@
+ #define ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE	512
+ #define ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE	128
+ #define ATH11K_DP_RXDMA_MONITOR_DST_RING_SIZE	128
+-#define ATH11K_DP_RXDMA_REFILL_RING_SIZE	2048
+-/* 256b desc TLV + 4b(rounded) Pad + 30byte max nwifi header +
+- * 18byte mesh hdr + 8byte snap + 1500 eth payload
+- */
+-#define ATH11K_DP_RXDMA_NSS_REFILL_RING_SIZE	1816
+ #else
+ /* Num VDEVS per radio */
+ #define TARGET_NUM_VDEVS(ab)	(ab->hw_params.num_vdevs_peers[ab->qmi.target_mem_mode].num_vdevs)
+@@ -38,8 +33,6 @@
+ #define ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE	1024
+ #define ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE	4096
+ #define ATH11K_DP_RXDMA_MONITOR_DST_RING_SIZE	2048
+-#define ATH11K_DP_RXDMA_REFILL_RING_SIZE	2048
+-#define ATH11K_DP_RXDMA_NSS_REFILL_RING_SIZE	2048
+ #endif
+ 
+ /* Num of peers for Single Radio mode */
+@@ -136,9 +129,6 @@ enum ath11k_bus {
+ struct hal_rx_desc;
+ struct hal_tcl_data_cmd;
+ 
+-struct htt_rx_ring_tlv_filter;
+-enum hal_encrypt_type;
+-
+ struct ath11k_hw_ring_mask {
+ 	u8 tx[ATH11K_EXT_IRQ_GRP_NUM_MAX];
+ 	u8 rx_mon_status[ATH11K_EXT_IRQ_GRP_NUM_MAX];
+@@ -298,16 +288,6 @@ struct ath11k_hw_ops {
+ 	u8* (*rx_desc_mpdu_start_addr2)(struct hal_rx_desc *desc);
+ 	u32 (*get_ring_selector)(struct sk_buff *skb);
+ 	u32 (*rx_desc_get_hal_mpdu_len)(struct hal_rx_mpdu_info *mpdu_info);
+-#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
+-	void (*rx_desc_get_offset)(struct htt_rx_ring_tlv_filter *tlv_filter);
+-#endif
+-	u16 (*rx_desc_get_mpdu_frame_ctl)(struct hal_rx_desc *desc);
+-	bool (*rx_desc_dot11_hdr_fields_valid)(struct hal_rx_desc *desc);
+-	void (*rx_desc_get_dot11_hdr)(struct hal_rx_desc *desc,
+-				      struct ieee80211_hdr *hdr);
+-	void (*rx_desc_get_crypto_header)(struct hal_rx_desc *desc,
+-					  u8 *crypto_hdr,
+-					  enum hal_encrypt_type enctype);
+ };
+ 
+ extern const struct ath11k_hw_ops ipq8074_ops;
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -6514,7 +6514,6 @@ static int ath11k_mac_config_mon_status_
+ 			tlv_filter.rx_filter = ath11k_debugfs_rx_filter(ar);
+ 	}
+ 
+-	tlv_filter.offset_valid = false;
+ 	for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
+ 		ring_id = ar->dp.rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
+ 		ret = ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id,
+--- a/drivers/net/wireless/ath/ath11k/rx_desc.h
++++ b/drivers/net/wireless/ath/ath11k/rx_desc.h
+@@ -1508,17 +1508,4 @@ struct hal_rx_desc {
+ #define RU_484 18
+ #define RU_996 37
+ 
+-#define HAL_RX_MPDU_INFO_PN_GET_BYTE1(__val) \
+-	FIELD_GET(GENMASK(7, 0), __le32_to_cpu(__val))
+-
+-#define HAL_RX_MPDU_INFO_PN_GET_BYTE2(__val) \
+-	FIELD_GET(GENMASK(15, 8), __le32_to_cpu(__val))
+-
+-#define HAL_RX_MPDU_INFO_PN_GET_BYTE3(__val) \
+-	FIELD_GET(GENMASK(23, 16), __le32_to_cpu(__val))
+-
+-#define HAL_RX_MPDU_INFO_PN_GET_BYTE4(__val) \
+-	FIELD_GET(GENMASK(31, 24), __le32_to_cpu(__val))
+-
+-
+ #endif /* ATH11K_RX_DESC_H */
+--- a/drivers/net/wireless/ath/ath11k/nss.c
++++ b/drivers/net/wireless/ath/ath11k/nss.c
+@@ -4424,7 +4424,7 @@ static int ath11k_nss_init(struct ath11k
+ 
+ 	/* fill rx parameters to initialize rx context */
+ 	wim->wrip.tlv_size = ab->hw_params.hal_desc_sz;
+-	wim->wrip.rx_buf_len = DP_RXDMA_NSS_REFILL_RING_SIZE;
++	wim->wrip.rx_buf_len = DP_RX_BUFFER_SIZE;
+ 	if (of_property_read_bool(dev->of_node, "nss-radio-priority"))
+ 		wim->flags |= WIFILI_MULTISOC_THREAD_MAP_ENABLE;
+ 
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-903-Revert-207-ath11k-Enable-256_512MB-profiles.patch b/package/kernel/mac80211/patches/nss/ath11k/999-903-Revert-207-ath11k-Enable-256_512MB-profiles.patch
new file mode 100644
index 00000000000000..7132fe38176926
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-903-Revert-207-ath11k-Enable-256_512MB-profiles.patch
@@ -0,0 +1,327 @@
+reverted:
+--- a/drivers/net/wireless/ath/ath11k/Kconfig
++++ b/drivers/net/wireless/ath/ath11k/Kconfig
+@@ -32,20 +32,6 @@ config ATH11K_NSS_MESH_SUPPORT
+ 
+ 	  If unsure, say Y to enable NSS offload support.
+ 
+-config ATH11K_MEM_PROFILE_512M
+-	bool "ath11k enable 512MB memory profile"
+-	depends on ATH11K
+-	default n
+-	---help---
+-	Enables 512MB memory profile for ath11k
+-
+-config ATH11K_MEM_PROFILE_256M
+-	bool "ath11k enable 256MB memory profile"
+-	depends on ATH11K
+-	default n
+-	---help---
+-	Enables 256MB memory profile for ath11k
+-
+ config ATH11K_AHB
+ 	tristate "Atheros ath11k AHB support"
+ 	depends on m
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -11,29 +11,11 @@
+ #include "wmi.h"
+ 
+ /* Target configuration defines */
+-#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
+ 
+-#define TARGET_NUM_VDEVS(ab)	8
+-#define TARGET_NUM_PEERS_PDEV(ab)	(128 + TARGET_NUM_VDEVS(ab))
+-/* Max num of stations (per radio) */
+-#define TARGET_NUM_STATIONS(ab)	128
+-#define ATH11K_QMI_TARGET_MEM_MODE	ATH11K_QMI_TARGET_MEM_MODE_512M
+-#define ATH11K_DP_TX_COMP_RING_SIZE	8192
+-#define ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE	512
+-#define ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE	128
+-#define ATH11K_DP_RXDMA_MONITOR_DST_RING_SIZE	128
+-#else
+ /* Num VDEVS per radio */
+-#define TARGET_NUM_VDEVS(ab)	(ab->hw_params.num_vdevs_peers[ab->qmi.target_mem_mode].num_vdevs)
+-#define TARGET_NUM_PEERS_PDEV(ab) (ab->hw_params.num_vdevs_peers[ab->qmi.target_mem_mode].num_peers + TARGET_NUM_VDEVS(ab))
+-/* Max num of stations (per radio) */
+-#define TARGET_NUM_STATIONS(ab) (ab->hw_params.num_vdevs_peers[ab->qmi.target_mem_mode].num_peers)
+-#define ATH11K_QMI_TARGET_MEM_MODE		ATH11K_QMI_TARGET_MEM_MODE_DEFAULT
+-#define ATH11K_DP_TX_COMP_RING_SIZE		32768
+-#define ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE	1024
+-#define ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE	4096
+-#define ATH11K_DP_RXDMA_MONITOR_DST_RING_SIZE	2048
+-#endif
++#define TARGET_NUM_VDEVS(ab)	(ab->hw_params.num_vdevs)
++
++#define TARGET_NUM_PEERS_PDEV(ab) (ab->hw_params.num_peers + TARGET_NUM_VDEVS(ab))
+ 
+ /* Num of peers for Single Radio mode */
+ #define TARGET_NUM_PEERS_SINGLE(ab) (TARGET_NUM_PEERS_PDEV(ab))
+@@ -44,6 +26,9 @@
+ /* Num of peers for DBS_SBS */
+ #define TARGET_NUM_PEERS_DBS_SBS(ab)	(3 * TARGET_NUM_PEERS_PDEV(ab))
+ 
++/* Max num of stations (per radio) */
++#define TARGET_NUM_STATIONS(ab)	(ab->hw_params.num_peers)
++
+ #define TARGET_NUM_PEERS(ab, x)	TARGET_NUM_PEERS_##x(ab)
+ #define TARGET_NUM_PEER_KEYS	2
+ #define TARGET_NUM_TIDS(ab, x)	(2 * TARGET_NUM_PEERS(ab, x) +	\
+@@ -241,7 +226,6 @@ struct ath11k_hw_params {
+ 	u32 tx_ring_size;
+ 	bool smp2p_wow_exit;
+ 	bool support_fw_mac_sequence;
+-	const struct ath11k_num_vdevs_peers *num_vdevs_peers;
+ 	bool support_dual_stations;
+ };
+ 
+--- a/drivers/net/wireless/ath/ath11k/qmi.h
++++ b/drivers/net/wireless/ath/ath11k/qmi.h
+@@ -29,12 +29,6 @@
+ #define ATH11K_QMI_BDF_EXT_STR_LENGTH		0x20
+ #define ATH11K_QMI_FW_MEM_REQ_SEGMENT_CNT	5
+ 
+-#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
+-#define ATH11K_QMI_IPQ8074_M3_DUMP_ADDRESS     0x4E800000
+-#else
+-#define ATH11K_QMI_IPQ8074_M3_DUMP_ADDRESS     0x51000000
+-#endif
+-
+ #define QMI_WLFW_REQUEST_MEM_IND_V01		0x0035
+ #define QMI_WLFW_FW_MEM_READY_IND_V01		0x0037
+ #define QMI_WLFW_COLD_BOOT_CAL_DONE_IND_V01	0x003E
+@@ -48,11 +42,6 @@
+ #define ATH11K_QMI_DEVICE_BAR_SIZE		0x200000
+ 
+ struct ath11k_base;
+-enum ath11k_target_mem_mode {
+- 	ATH11K_QMI_TARGET_MEM_MODE_DEFAULT = 0,
+- 	ATH11K_QMI_TARGET_MEM_MODE_512M,
+-	ATH11K_QMI_TARGET_MEM_MODE_256M,
+-};
+ 
+ enum ath11k_qmi_file_type {
+ 	ATH11K_QMI_FILE_TYPE_BDF_GOLDEN,
+--- a/local-symbols
++++ b/local-symbols
+@@ -167,8 +167,6 @@ ATH11K_AHB=
+ ATH11K_PCI=
+ ATH11K_NSS_SUPPORT=
+ ATH11K_NSS_MESH_SUPPORT=
+-ATH11K_MEM_PROFILE_256M=
+-ATH11K_MEM_PROFILE_512M=
+ ATH11K_DEBUG=
+ ATH11K_DEBUGFS=
+ ATH11K_DEBUGFS_STA=
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -985,11 +985,6 @@ struct ath11k_msi_config {
+ 	u16 hw_rev;
+ };
+ 
+-struct ath11k_num_vdevs_peers {
+-	u32 num_vdevs;
+-	u32 num_peers;
+-};
+-
+ /* Master structure to hold the hw data which may be used in core module */
+ struct ath11k_base {
+ 	enum ath11k_hw_rev hw_rev;
+@@ -1135,8 +1130,6 @@ struct ath11k_base {
+ 		DECLARE_BITMAP(fw_features, ATH11K_FW_FEATURE_COUNT);
+ 	} fw;
+ 
+-	atomic_t num_max_allowed;
+-
+ #ifdef CPTCFG_NL80211_TESTMODE
+ 	struct {
+ 		u32 data_pos;
+--- a/drivers/net/wireless/ath/ath11k/dp.h
++++ b/drivers/net/wireless/ath/ath11k/dp.h
+@@ -93,7 +93,7 @@ struct idr_entry {
+ 	void *buf;
+ };
+ 
+-#define DP_TX_IDR_SIZE	ATH11K_DP_TX_COMP_RING_SIZE
++#define DP_TX_IDR_SIZE	32768
+ 
+ struct dp_tx_ring {
+ 	u8 tcl_data_ring_id;
+@@ -225,8 +225,7 @@ struct ath11k_pdev_dp {
+ #define DP_WBM_RELEASE_RING_SIZE	64
+ #define DP_TCL_DATA_RING_SIZE		512
+ #define DP_TCL_DATA_RING_SIZE_WCN6750	2048
+-#define DP_TX_COMP_RING_SIZE		ATH11K_DP_TX_COMP_RING_SIZE
+-#define DP_TX_COMP_MAX_ALLOWED         DP_TX_COMP_RING_SIZE
++#define DP_TX_COMP_RING_SIZE		32768
+ #define DP_TCL_CMD_RING_SIZE		32
+ #define DP_TCL_STATUS_RING_SIZE		32
+ #define DP_REO_DST_RING_MAX		4
+@@ -239,9 +238,9 @@ struct ath11k_pdev_dp {
+ #define DP_RXDMA_BUF_RING_SIZE		4096
+ #define DP_RXDMA_REFILL_RING_SIZE	2048
+ #define DP_RXDMA_ERR_DST_RING_SIZE	1024
+-#define DP_RXDMA_MON_STATUS_RING_SIZE	ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE
+-#define DP_RXDMA_MONITOR_BUF_RING_SIZE	ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE
+-#define DP_RXDMA_MONITOR_DST_RING_SIZE	ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE
++#define DP_RXDMA_MON_STATUS_RING_SIZE	1024
++#define DP_RXDMA_MONITOR_BUF_RING_SIZE	4096
++#define DP_RXDMA_MONITOR_DST_RING_SIZE	2048
+ #define DP_RXDMA_MONITOR_DESC_RING_SIZE	4096
+ 
+ #define DP_RX_RELEASE_RING_NUM	3
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -132,12 +132,6 @@ int ath11k_dp_tx(struct ath11k *ar, stru
+ 
+ 	max_tx_ring = ab->hw_params.max_tx_ring;
+ 
+-#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
+-	if (unlikely(atomic_read(&ab->num_max_allowed) > DP_TX_COMP_MAX_ALLOWED)) {
+-		atomic_inc(&ab->soc_stats.tx_err.max_fail);
+-		return -ENOSPC;
+-	}
+-#endif
+ 	ring_selector = smp_processor_id();;
+ 	pool_id = ring_selector;
+ 
+@@ -327,7 +321,6 @@ tcl_ring_sel:
+ 					 sizeof(struct hal_tlv_hdr), &ti);
+ 
+ 	atomic_inc(&ar->dp.num_tx_pending);
+-	atomic_inc(&ab->num_max_allowed);
+ 	ath11k_hal_srng_access_end(ab, tcl_ring);
+ 
+ 	ath11k_dp_shadow_start_timer(ab, tcl_ring, &dp->tx_ring_timer[ti.buf_id]);
+@@ -882,12 +875,6 @@ void ath11k_dp_tx_completion_handler(str
+ 
+ 	spin_unlock_bh(&status_ring->lock);
+ 
+-	if (atomic_sub_return(count, &ab->num_max_allowed) < 0) {
+-		ath11k_warn(ab, "tx completion mismatch count %d ring id %d max_num %d\n",
+-			    count, tx_ring->tcl_data_ring_id,
+-			    atomic_read(&ab->num_max_allowed));
+-	}
+-
+ 	while (count--) {
+ 		msdu=NULL;
+ 		tx_status = &tx_ring->tx_status[i++];
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -43,8 +43,6 @@ bool ath11k_ftm_mode;
+ module_param_named(ftm_mode, ath11k_ftm_mode, bool, 0444);
+ MODULE_PARM_DESC(ftm_mode, "Boots up in factory test mode");
+ 
+-static const struct ath11k_num_vdevs_peers ath11k_vdevs_peers[];
+-
+ static struct ath11k_hw_params ath11k_hw_params[] = {
+ 	{
+ 		.hw_rev = ATH11K_HW_IPQ8074,
+@@ -130,7 +128,6 @@ static struct ath11k_hw_params ath11k_hw
+ 		.tcl_ring_retry = true,
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+-		.num_vdevs_peers = ath11k_vdevs_peers,
+ 		.support_dual_stations = false,
+ 	},
+ 	{
+@@ -182,7 +179,7 @@ static struct ath11k_hw_params ath11k_hw
+ 		.coldboot_cal_mm = false,
+ 		.coldboot_cal_ftm = false,
+ 		.cbcal_restart_fw = true,
+-		.fw_mem_mode = ATH11K_QMI_TARGET_MEM_MODE,
++		.fw_mem_mode = 0,
+ 		.num_vdevs = 16 + 1,
+ 		.num_peers = 512,
+ 		.supports_suspend = false,
+@@ -269,7 +266,7 @@ static struct ath11k_hw_params ath11k_hw
+ 		.coldboot_cal_mm = false,
+ 		.coldboot_cal_ftm = false,
+ 		.cbcal_restart_fw = false,
+-		.fw_mem_mode = ATH11K_QMI_TARGET_MEM_MODE,
++		.fw_mem_mode = 0,
+ 		.num_vdevs = 2 + 1,
+ 		.num_peers = 512,
+ 		.supports_suspend = true,
+@@ -442,7 +439,7 @@ static struct ath11k_hw_params ath11k_hw
+ 		.coldboot_cal_mm = false,
+ 		.coldboot_cal_ftm = false,
+ 		.cbcal_restart_fw = false,
+-		.fw_mem_mode = ATH11K_QMI_TARGET_MEM_MODE,
++		.fw_mem_mode = 0,
+ 		.num_vdevs = 2 + 1,
+ 		.num_peers = 512,
+ 		.supports_suspend = true,
+@@ -478,7 +475,6 @@ static struct ath11k_hw_params ath11k_hw
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = true,
+-		.num_vdevs_peers = ath11k_vdevs_peers,
+ 		.support_dual_stations = true,
+ 	},
+ 	{
+@@ -530,7 +526,7 @@ static struct ath11k_hw_params ath11k_hw
+ 		.coldboot_cal_mm = false,
+ 		.coldboot_cal_ftm = false,
+ 		.cbcal_restart_fw = false,
+-		.fw_mem_mode = ATH11K_QMI_TARGET_MEM_MODE,
++		.fw_mem_mode = 0,
+ 		.num_vdevs = 2 + 1,
+ 		.num_peers = 512,
+ 		.supports_suspend = true,
+@@ -566,7 +562,6 @@ static struct ath11k_hw_params ath11k_hw
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = true,
+-		.num_vdevs_peers = ath11k_vdevs_peers,
+ 		.support_dual_stations = true,
+ 	},
+ 	{
+@@ -616,7 +611,7 @@ static struct ath11k_hw_params ath11k_hw
+ 		.coldboot_cal_mm = true,
+ 		.coldboot_cal_ftm = true,
+ 		.cbcal_restart_fw = false,
+-		.fw_mem_mode = ATH11K_QMI_TARGET_MEM_MODE,
++		.fw_mem_mode = 0,
+ 		.num_vdevs = 3,
+ 		.num_peers = 512,
+ 		.supports_suspend = false,
+@@ -696,7 +691,7 @@ static struct ath11k_hw_params ath11k_hw
+ 		.supports_monitor = false,
+ 		.supports_sta_ps = false,
+ 		.supports_shadow_regs = false,
+-		.fw_mem_mode = ATH11K_QMI_TARGET_MEM_MODE,
++		.fw_mem_mode = 0,
+ 		.num_vdevs = 16 + 1,
+ 		.num_peers = 512,
+ 		.supports_regdb = false,
+@@ -731,7 +726,6 @@ static struct ath11k_hw_params ath11k_hw
+ 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
+ 		.smp2p_wow_exit = false,
+ 		.support_fw_mac_sequence = false,
+-		.num_vdevs_peers = ath11k_vdevs_peers,
+ 		.support_dual_stations = false,
+ 	},
+ 	{
+@@ -825,21 +819,6 @@ static struct ath11k_hw_params ath11k_hw
+ 	},
+ };
+ 
+-static const struct ath11k_num_vdevs_peers ath11k_vdevs_peers[] = {
+-	{
+-		.num_vdevs = (16 + 1),
+-		.num_peers = 512,
+-	},
+-	{
+-		.num_vdevs = (8 + 1),
+-		.num_peers = 128,
+-	},
+-	{
+-		.num_vdevs = 8,
+-		.num_peers = 128,
+-	},
+-};
+-
+ static inline struct ath11k_pdev *ath11k_core_get_single_pdev(struct ath11k_base *ab)
+ {
+ 	WARN_ON(!ab->hw_params.single_pdev_only);

From e6a6427eb73094111cd5c8485649e3f6281e2ad6 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sun, 29 Sep 2024 20:09:59 -0400
Subject: [PATCH 172/225] ath11k_nss: Consolidate
 Allow-fast-rx-by-bypassing-stats-update

This original patch: 237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
was split into two patches:

237-001-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch

Merge them back together to avoid confusion

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...ow-fast-rx-by-bypassing-stats-update.patch | 101 ---------------
 ...ow-fast-rx-by-bypassing-stats-update.patch | 115 ++++++++++++++++--
 2 files changed, 106 insertions(+), 110 deletions(-)
 delete mode 100644 package/kernel/mac80211/patches/nss/ath11k/237-001-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch

diff --git a/package/kernel/mac80211/patches/nss/ath11k/237-001-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch b/package/kernel/mac80211/patches/nss/ath11k/237-001-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
deleted file mode 100644
index 510b0f5f6b668e..00000000000000
--- a/package/kernel/mac80211/patches/nss/ath11k/237-001-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
+++ /dev/null
@@ -1,101 +0,0 @@
---- a/drivers/net/wireless/ath/ath11k/core.h
-+++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -1129,6 +1129,7 @@ struct ath11k_base {
- 	u32 max_ast_index;
- 	u32 num_ast_entries;
- 
-+	bool stats_disable;
- 	/* must be last */
- 	u8 drv_priv[] __aligned(sizeof(void *));
- };
---- a/drivers/net/wireless/ath/ath11k/debugfs.c
-+++ b/drivers/net/wireless/ath/ath11k/debugfs.c
-@@ -974,6 +974,79 @@ static const struct file_operations fops
- 	.llseek = default_llseek,
- };
- 
-+static void ath11k_debug_config_mon_status(struct ath11k *ar, bool enable)
-+{
-+	struct htt_rx_ring_tlv_filter tlv_filter = {0};
-+	struct ath11k_base *ab = ar->ab;
-+	int i;
-+	u32 ring_id;
-+
-+	if (enable)
-+		tlv_filter = ath11k_mac_mon_status_filter_default;
-+
-+	for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
-+		ring_id = ar->dp.rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
-+		ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id,
-+						 ar->dp.mac_id + i,
-+						 HAL_RXDMA_MONITOR_STATUS,
-+						 DP_RX_BUFFER_SIZE,
-+						 &tlv_filter);
-+	}
-+}
-+
-+static ssize_t ath11k_write_stats_disable(struct file *file,
-+					  const char __user *user_buf,
-+					  size_t count, loff_t *ppos)
-+{
-+	struct ath11k_base *ab = file->private_data;
-+	struct ath11k_pdev *pdev;
-+	bool disable;
-+	int ret, i, radioup = 0;
-+	u32 mask = 0;
-+
-+	for (i = 0; i < ab->num_radios; i++) {
-+		pdev = &ab->pdevs[i];
-+		if (pdev && pdev->ar) {
-+			radioup = 1;
-+			break;
-+		}
-+	}
-+
-+	if (radioup == 0) {
-+		ath11k_err(ab, "radio is not up\n");
-+		ret = -ENETDOWN;
-+		goto exit;
-+	}
-+
-+	if (kstrtobool_from_user(user_buf, count, &disable))
-+		 return -EINVAL;
-+
-+	 if (disable != ab->stats_disable) {
-+		ab->stats_disable = disable;
-+		for (i = 0; i < ab->num_radios; i++) {
-+			pdev = &ab->pdevs[i];
-+			if (pdev && pdev->ar) {
-+				ath11k_debug_config_mon_status(pdev->ar, !disable);
-+
-+				if (!disable)
-+					mask = HTT_PPDU_STATS_TAG_DEFAULT;
-+
-+				ath11k_dp_tx_htt_h2t_ppdu_stats_req(pdev->ar, mask);
-+			}
-+		}
-+	 }
-+
-+	ret = count;
-+
-+exit:
-+	return ret;
-+}
-+
-+static const struct file_operations fops_soc_stats_disable = {
-+	.open = simple_open,
-+	.write = ath11k_write_stats_disable,
-+};
-+
- int ath11k_debugfs_pdev_create(struct ath11k_base *ab)
- {
- 	if (test_bit(ATH11K_FLAG_REGISTERED, &ab->dev_flags))
-@@ -1023,6 +1096,8 @@ int ath11k_debugfs_soc_create(struct ath
- 		ret = PTR_ERR(ab->debugfs_soc);
- 		goto out;
- 	}
-+	debugfs_create_file("stats_disable", 0600, ab->debugfs_soc, ab,
-+                            &fops_soc_stats_disable);
- 
- 	ret = 0;
- 
diff --git a/package/kernel/mac80211/patches/nss/ath11k/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch b/package/kernel/mac80211/patches/nss/ath11k/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
index 0b12de5f7ccc20..80f4f3d5cb0abb 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
@@ -11,15 +11,13 @@ bypassing mac80211 stats update
 Signed-off-by: Sriram R <srirrama@codeaurora.org>
 Signed-off-by: P Praneesh <ppranees@codeaurora.org>
 ---
- drivers/net/wireless/ath/ath11k/core.h  |  3 ++
- drivers/net/wireless/ath/ath11k/debugfs.c | 76 +++++++++++++++++++++++++++++++++
- drivers/net/wireless/ath/ath11k/dp.c    | 45 +++++++++++++++++++
- drivers/net/wireless/ath/ath11k/dp_rx.c | 54 ++++++++++++++++++++---
- drivers/net/wireless/ath/ath11k/hw.c    | 25 +++++++++++
- drivers/net/wireless/ath/ath11k/hw.h    |  1 +
- drivers/net/wireless/ath/ath11k/mac.c   |  2 +
- drivers/net/wireless/ath/ath11k/peer.h  |  1 +
- 8 files changed, 201 insertions(+), 6 deletions(-)
+ drivers/net/wireless/ath/ath11k/core.h    |    2
+ drivers/net/wireless/ath/ath11k/debugfs.c |   75 ++++++++++++++++++
+ drivers/net/wireless/ath/ath11k/dp_rx.c   |  119 +++++++++++++++++++++++++++---
+ drivers/net/wireless/ath/ath11k/hw.c      |   22 +++++
+ drivers/net/wireless/ath/ath11k/hw.h      |    1
+ drivers/net/wireless/ath/ath11k/mac.c     |    8 ++
+ 6 files changed, 218 insertions(+), 9 deletions(-)
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
@@ -31,6 +29,105 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  };
  
  enum ath11k_hw_rev {
+@@ -1129,6 +1130,7 @@ struct ath11k_base {
+ 	u32 max_ast_index;
+ 	u32 num_ast_entries;
+ 
++	bool stats_disable;
+ 	/* must be last */
+ 	u8 drv_priv[] __aligned(sizeof(void *));
+ };
+--- a/drivers/net/wireless/ath/ath11k/debugfs.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs.c
+@@ -974,6 +974,79 @@ static const struct file_operations fops
+ 	.llseek = default_llseek,
+ };
+ 
++static void ath11k_debug_config_mon_status(struct ath11k *ar, bool enable)
++{
++	struct htt_rx_ring_tlv_filter tlv_filter = {0};
++	struct ath11k_base *ab = ar->ab;
++	int i;
++	u32 ring_id;
++
++	if (enable)
++		tlv_filter = ath11k_mac_mon_status_filter_default;
++
++	for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
++		ring_id = ar->dp.rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
++		ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id,
++						 ar->dp.mac_id + i,
++						 HAL_RXDMA_MONITOR_STATUS,
++						 DP_RX_BUFFER_SIZE,
++						 &tlv_filter);
++	}
++}
++
++static ssize_t ath11k_write_stats_disable(struct file *file,
++					  const char __user *user_buf,
++					  size_t count, loff_t *ppos)
++{
++	struct ath11k_base *ab = file->private_data;
++	struct ath11k_pdev *pdev;
++	bool disable;
++	int ret, i, radioup = 0;
++	u32 mask = 0;
++
++	for (i = 0; i < ab->num_radios; i++) {
++		pdev = &ab->pdevs[i];
++		if (pdev && pdev->ar) {
++			radioup = 1;
++			break;
++		}
++	}
++
++	if (radioup == 0) {
++		ath11k_err(ab, "radio is not up\n");
++		ret = -ENETDOWN;
++		goto exit;
++	}
++
++	if (kstrtobool_from_user(user_buf, count, &disable))
++		 return -EINVAL;
++
++	 if (disable != ab->stats_disable) {
++		ab->stats_disable = disable;
++		for (i = 0; i < ab->num_radios; i++) {
++			pdev = &ab->pdevs[i];
++			if (pdev && pdev->ar) {
++				ath11k_debug_config_mon_status(pdev->ar, !disable);
++
++				if (!disable)
++					mask = HTT_PPDU_STATS_TAG_DEFAULT;
++
++				ath11k_dp_tx_htt_h2t_ppdu_stats_req(pdev->ar, mask);
++			}
++		}
++	 }
++
++	ret = count;
++
++exit:
++	return ret;
++}
++
++static const struct file_operations fops_soc_stats_disable = {
++	.open = simple_open,
++	.write = ath11k_write_stats_disable,
++};
++
+ int ath11k_debugfs_pdev_create(struct ath11k_base *ab)
+ {
+ 	if (test_bit(ATH11K_FLAG_REGISTERED, &ab->dev_flags))
+@@ -1023,6 +1096,8 @@ int ath11k_debugfs_soc_create(struct ath
+ 		ret = PTR_ERR(ab->debugfs_soc);
+ 		goto out;
+ 	}
++	debugfs_create_file("stats_disable", 0600, ab->debugfs_soc, ab,
++                            &fops_soc_stats_disable);
+ 
+ 	ret = 0;
+ 
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
 @@ -341,6 +341,12 @@ static int ath11k_dp_purge_mon_ring(stru

From b1e66a5f8dc6e2e9978ec32cd6c8e6d6bdd8657c Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sun, 29 Sep 2024 18:09:47 -0400
Subject: [PATCH 173/225] ath11k_nss: remove call trace while rebooting AP

When a station idles for a long time, hostapd will try to send
a QoS Null frame to the station as "poll". NL80211_CMD_PROBE_CLIENT
is used for this purpose.
And the skb will be added to ack_status_frame - waiting for a
completion via ieee80211_report_ack_skb().

But when the peer was already removed before the tx_complete arrives,
the peer will be missing. And when using dev_kfree_skb_any (instead
of going through mac80211), the entry will stay inside
ack_status_frames thus not clean up related information in its
internal data structures. This IDR will therefore run full after
8K request were generated for such clients.
At this point, the access point <M-[>48;55;187;1760;2992will then just stall and not allow
any new clients because idr_alloc() for ack_status_frame will fail.

ieee80211_free_txskb() on the other hand will (when required) call
ieee80211_report_ack_skb() and make sure that (when required) remove
the entry from the ack_status_frame and clean up related
information in its internal data structures.

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...remove-call-trace-while-rebooting-AP.patch | 43 +++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/910-wifi-ath11k-remove-call-trace-while-rebooting-AP.patch

diff --git a/package/kernel/mac80211/patches/nss/ath11k/910-wifi-ath11k-remove-call-trace-while-rebooting-AP.patch b/package/kernel/mac80211/patches/nss/ath11k/910-wifi-ath11k-remove-call-trace-while-rebooting-AP.patch
new file mode 100644
index 00000000000000..dd2af91aa0940b
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/910-wifi-ath11k-remove-call-trace-while-rebooting-AP.patch
@@ -0,0 +1,43 @@
+From 214fcc7e98445c0af0ef75df3174227484da13e2 Mon Sep 17 00:00:00 2001
+From: Sarika Sharma <quic_sarishar@quicinc.com>
+Date: Wed, 21 Feb 2024 10:23:35 +0530
+Subject: [PATCH] wifi: ath11k: remove call trace while rebooting AP
+
+When a station idles for a long time, hostapd will try to send
+a QoS Null frame to the station as "poll". NL80211_CMD_PROBE_CLIENT
+is used for this purpose.
+And the skb will be added to ack_status_frame - waiting for a
+completion via ieee80211_report_ack_skb().
+
+But when the peer was already removed before the tx_complete arrives,
+the peer will be missing. And when using dev_kfree_skb_any (instead
+of going through mac80211), the entry will stay inside
+ack_status_frames thus not clean up related information in its
+internal data structures. This IDR will therefore run full after
+8K request were generated for such clients.
+At this point, the access point will then just stall and not allow
+any new clients because idr_alloc() for ack_status_frame will fail.
+
+ieee80211_free_txskb() on the other hand will (when required) call
+ieee80211_report_ack_skb() and make sure that (when required) remove
+the entry from the ack_status_frame and clean up related
+information in its internal data structures.
+
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+
+Signed-off-by: Sarika Sharma <quic_sarishar@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/dp_tx.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -451,7 +451,7 @@ ath11k_dp_tx_htt_tx_complete_buf(struct
+ 	}
+ 
+ 	if (unlikely(!skb_cb->vif)) {
+-		dev_kfree_skb_any(msdu);
++		ieee80211_free_txskb(ar->hw, msdu);
+ 		return;
+ 	}
+ 

From 3ca38b016fe881bb2c3b0cadc695ee678baeb0a2 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 28 Sep 2024 14:51:17 -0400
Subject: [PATCH 174/225] ath11k_nss: mac80211: fix NULL pointer access,
 Klocwork issue

Currently we are dereferencing dev pointer without a NULL
check.

Fix this issue by adding a NULL check.

Patch-dependency: none
Patch-work: none
Fixes: 4b7afb52c8e2 (mac80211: reorganize code to remove a forward declaration)
Note: ath.git commit id is mentioned in the Fixes tag

Signed-off-by: Monika Korada <quic_koramoni@quicinc.com>

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...x-NULL-pointer-access-Klocwork-issue.patch | 62 +++++++++++++++++++
 1 file changed, 62 insertions(+)
 create mode 100644 package/kernel/mac80211/patches/nss/subsys/999-918-mac80211-fix-NULL-pointer-access-Klocwork-issue.patch

diff --git a/package/kernel/mac80211/patches/nss/subsys/999-918-mac80211-fix-NULL-pointer-access-Klocwork-issue.patch b/package/kernel/mac80211/patches/nss/subsys/999-918-mac80211-fix-NULL-pointer-access-Klocwork-issue.patch
new file mode 100644
index 00000000000000..4da35289524e66
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/subsys/999-918-mac80211-fix-NULL-pointer-access-Klocwork-issue.patch
@@ -0,0 +1,62 @@
+From f5a907934f596f77b4c59e549eff5d56b1a4e226 Mon Sep 17 00:00:00 2001
+From: Monika Korada <quic_koramoni@quicinc.com>
+Date: Mon, 27 May 2024 11:32:49 +0530
+Subject: [PATCH] KW: wifi: mac80211: fix NULL pointer access, Klocwork issue
+
+Currently we are dereferencing dev pointer without a NULL
+check.
+
+Fix this issue by adding a NULL check.
+
+Patch-dependency: none
+Patch-work: none
+Fixes: 4b7afb52c8e2 (mac80211: reorganize code to remove a forward declaration)
+Note: ath.git commit id is mentioned in the Fixes tag
+
+Signed-off-by: Monika Korada <quic_koramoni@quicinc.com>
+---
+ net/mac80211/iface.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -1348,7 +1348,8 @@ int ieee80211_do_open(struct wireless_de
+ 	case NL80211_IFTYPE_AP_VLAN:
+ 		if (sdata->bss->active) {
+ 			ieee80211_link_vlan_copy_chanctx(&sdata->deflink);
+-			netif_carrier_on(dev);
++			if (dev)
++				netif_carrier_on(dev);
+ 
+ 			if (ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD)) {
+ 				ieee80211_set_sdata_offload_flags(sdata);
+@@ -1359,7 +1360,8 @@ int ieee80211_do_open(struct wireless_de
+ 
+ 			ieee80211_set_vif_encap_ops(sdata);
+ 		} else {
+-			netif_carrier_off(dev);
++			if (dev)
++				netif_carrier_off(dev);
+ 		}
+ 		break;
+ 	case NL80211_IFTYPE_MONITOR:
+@@ -1390,7 +1392,8 @@ int ieee80211_do_open(struct wireless_de
+ 		ieee80211_recalc_offload(local);
+ 		ieee80211_recalc_idle(local);
+ 
+-		netif_carrier_on(dev);
++		if (dev)
++			netif_carrier_on(dev);
+ 		break;
+ 	default:
+ 		if (coming_up) {
+@@ -1434,7 +1437,8 @@ int ieee80211_do_open(struct wireless_de
+ 		case NL80211_IFTYPE_AP:
+ 		case NL80211_IFTYPE_MESH_POINT:
+ 		case NL80211_IFTYPE_OCB:
+-			netif_carrier_off(dev);
++			if (dev)
++				netif_carrier_off(dev);
+ 			break;
+ 		case NL80211_IFTYPE_P2P_DEVICE:
+ 		case NL80211_IFTYPE_NAN:

From 7a6d8138aab9c8a5c76e50c651b9178f70d2f661 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sun, 29 Sep 2024 18:01:47 -0400
Subject: [PATCH 175/225] ath11k_nss: fix WDS instability by disabling NAWDS
 mode

This patch replaces the problematic NAWDS stateless mode with standard
WDS in the ath11k driver. NAWDS has shown incompatibility with WDS AP
and STA modes in ath11k, leading to issues like MAC address
duplication and unstable connections. By switching to standard WDS,
this patch aims to resolve these issues.

It also enables WDS backhaul in NSS for better handling of backhaul links.

Testing is still ongoing, but early results indicate improved
stability and fewer connection problems in affected environments

Authored-by: Sebastian Gottschall <s.gottschall@dd-wrt.com>
Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...902-ath11k-fix-WDS-by-disabling-nwds.patch | 76 +++++++++++++++++++
 1 file changed, 76 insertions(+)
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/999-902-ath11k-fix-WDS-by-disabling-nwds.patch

diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-902-ath11k-fix-WDS-by-disabling-nwds.patch b/package/kernel/mac80211/patches/nss/ath11k/999-902-ath11k-fix-WDS-by-disabling-nwds.patch
new file mode 100644
index 00000000000000..73a471aaa42f9e
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-902-ath11k-fix-WDS-by-disabling-nwds.patch
@@ -0,0 +1,76 @@
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -5274,14 +5274,19 @@ skip_nss_ext:
+ 	 * AP vif of the AP_VLAN vif
+ 	 */
+ 	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id,
+-					    WMI_VDEV_PARAM_AP_ENABLE_NAWDS,
+-					    MIN_IDLE_INACTIVE_TIME_SECS);
++					    WMI_VDEV_PARAM_WDS,
++					    1);
+ 	if (ret) {
+-		ath11k_warn(ab, "failed to set vdev %i nawds parameters: %d\n",
++		ath11k_warn(ab, "failed to set vdev %i wds parameters: %d\n",
+ 			    arvif->vdev_id, ret);
+ 		goto ext_vdev_down;
+ 	}
+ 
++	ret = ath11k_nss_vdev_set_cmd(arvif, ATH11K_NSS_WIFI_VDEV_CFG_WDS_BACKHAUL_CMD, true);
++	if (ret) {
++		ath11k_warn(ab, "failed to cfg wds backhaul in nss %d\n", ret);
++	}
++
+ 	return;
+ 
+ ext_vdev_down:
+@@ -7207,6 +7212,23 @@ static int ath11k_mac_op_add_interface(s
+ 		goto err_vdev_del;
+ 	}
+ 
++	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id,
++					    WMI_VDEV_PARAM_WDS, 1);
++	if (ret) {
++		ath11k_warn(ab, "failed to enable wds%d\n", ret);
++	}
++
++	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id,
++					    WMI_VDEV_PARAM_CAPABILITIES,
++					    WMI_VDEV_WDS_LRN_ENABLED);
++	if (ret) {
++		ath11k_warn(
++			ab,
++			"failed to set vdev %d capability 0x%x, nss %d :%d\n",
++			arvif->vdev_id, WMI_VDEV_WDS_LRN_ENABLED, nss, ret);
++		goto err_vdev_del;
++	}
++
+ 	nss = get_num_chains(ar->cfg_tx_chainmask) ? : 1;
+ 	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id,
+ 					    WMI_VDEV_PARAM_NSS, nss);
+--- a/drivers/net/wireless/ath/ath11k/nss.c
++++ b/drivers/net/wireless/ath/ath11k/nss.c
+@@ -3255,6 +3255,11 @@ int ath11k_nss_ext_vdev_create(struct at
+ 		   "nss ext vdev interface created ctx %pK, ifnum %d\n",
+ 		   arvif->nss.ctx, arvif->nss.if_num);
+ 
++	ret = ath11k_nss_vdev_set_cmd(arvif, ATH11K_NSS_WIFI_VDEV_CFG_WDS_BACKHAUL_CMD, true);
++	if (ret) {
++		ath11k_warn(ab, "failed to enable wds backhaul %d\n", ret);
++	}
++
+ 	return ret;
+ 
+ free_ext_vdev:
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -1112,6 +1112,10 @@ enum wmi_tlv_vdev_param {
+ 	WMI_VDEV_PARAM_HEOPS_0_31 = 0x8003,
+ };
+ 
++#define WMI_VDEV_BEACON_SUPPORT  0x1
++#define WMI_VDEV_WDS_LRN_ENABLED 0x2
++#define WMI_VDEV_VOW_ENABLED     0x4
++
+ enum wmi_tlv_peer_flags {
+ 	WMI_PEER_AUTH		= 0x00000001,
+ 	WMI_PEER_QOS		= 0x00000002,

From bb763312c9ac77a8f27119d2f2d596a54fa26371 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sun, 29 Sep 2024 20:23:28 -0400
Subject: [PATCH 176/225] Revert "ath11k_nss: Revert patch for 512M + 2KB RX
 header"

This reverts commit 08db8048d06b9a3e45bbcb7ab49463a21c769dc7.
---
 ...11k-Disable-rx_header-tlv-for-2K-SKB.patch | 981 ------------------
 ...207-ath11k-Enable-256_512MB-profiles.patch | 327 ------
 2 files changed, 1308 deletions(-)
 delete mode 100644 package/kernel/mac80211/patches/nss/ath11k/999-902-Revert-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
 delete mode 100644 package/kernel/mac80211/patches/nss/ath11k/999-903-Revert-207-ath11k-Enable-256_512MB-profiles.patch

diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-902-Revert-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch b/package/kernel/mac80211/patches/nss/ath11k/999-902-Revert-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
deleted file mode 100644
index 2466b95ab5d2ac..00000000000000
--- a/package/kernel/mac80211/patches/nss/ath11k/999-902-Revert-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
+++ /dev/null
@@ -1,981 +0,0 @@
-reverted:
---- a/drivers/net/wireless/ath/ath11k/debugfs.c
-+++ b/drivers/net/wireless/ath/ath11k/debugfs.c
-@@ -669,7 +669,6 @@ static ssize_t ath11k_write_extd_rx_stat
- 	}
- 
- 	ar->debug.rx_filter = tlv_filter.rx_filter;
--	tlv_filter.offset_valid = false;
- 
- 	for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
- 		ring_id = ar->dp.rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
-@@ -1230,7 +1229,6 @@ static ssize_t ath11k_write_pktlog_filte
- 	}
- 
- 	/* Clear rx filter set for monitor mode and rx status */
--	tlv_filter.offset_valid = false;
- 	for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
- 		ring_id = ar->dp.rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
- 		ret = ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id, ar->dp.mac_id,
---- a/drivers/net/wireless/ath/ath11k/dp.h
-+++ b/drivers/net/wireless/ath/ath11k/dp.h
-@@ -237,8 +237,7 @@ struct ath11k_pdev_dp {
- #define DP_REO_CMD_RING_SIZE		256
- #define DP_REO_STATUS_RING_SIZE		2048
- #define DP_RXDMA_BUF_RING_SIZE		4096
--#define DP_RXDMA_REFILL_RING_SIZE	ATH11K_DP_RXDMA_REFILL_RING_SIZE
--#define DP_RXDMA_NSS_REFILL_RING_SIZE	ATH11K_DP_RXDMA_NSS_REFILL_RING_SIZE
-+#define DP_RXDMA_REFILL_RING_SIZE	2048
- #define DP_RXDMA_ERR_DST_RING_SIZE	1024
- #define DP_RXDMA_MON_STATUS_RING_SIZE	ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE
- #define DP_RXDMA_MONITOR_BUF_RING_SIZE	ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE
-@@ -673,7 +672,7 @@ enum htt_stats_internal_ppdu_frametype {
-  *
-  *    |31       26|25|24|23            16|15             8|7             0|
-  *    |-----------------+----------------+----------------+---------------|
-- *    |   rsvd1|OV|PS|SS|     ring_id    |     pdev_id    |    msg_type   |
-+ *    |   rsvd1   |PS|SS|     ring_id    |     pdev_id    |    msg_type   |
-  *    |-------------------------------------------------------------------|
-  *    |              rsvd2               |           ring_buffer_size     |
-  *    |-------------------------------------------------------------------|
-@@ -687,14 +686,6 @@ enum htt_stats_internal_ppdu_frametype {
-  *    |-------------------------------------------------------------------|
-  *    |                         tlv_filter_in_flags                       |
-  *    |-------------------------------------------------------------------|
-- *    |         rx_header_offset         |       rx_packet_offset         |
-- *    |-------------------------------------------------------------------|
-- *    |       rx_mpdu_start_offset       |      rx_mpdu_end_offset        |
-- *    |-------------------------------------------------------------------|
-- *    |       rx_msdu_start_offset       |      rx_msdu_end_offset        |
-- *    |-------------------------------------------------------------------|
-- *    |              rsvd3               |      rx_attention_offset       |
-- *    |-------------------------------------------------------------------|
-  * Where:
-  *     PS = pkt_swap
-  *     SS = status_swap
-@@ -708,10 +699,7 @@ enum htt_stats_internal_ppdu_frametype {
-  *                    More details can be got from enum htt_srng_ring_id
-  *          b'24    - status_swap: 1 is to swap status TLV
-  *          b'25    - pkt_swap:  1 is to swap packet TLV
-- *          b'26    - rx_offset_valid (OV): flag to indicate rx offsets
-- *                    configuration fields are valid
-- *
-- *          b'27:31 - rsvd1:  reserved for future use
-+ *          b'26:31 - rsvd1:  reserved for future use
-  * dword1 - b'0:16  - ring_buffer_size: size of buffers referenced by rx ring,
-  *                    in byte units.
-  *                    Valid only for HW_TO_SW_RING and SW_TO_HW_RING
-@@ -740,42 +728,6 @@ enum htt_stats_internal_ppdu_frametype {
-  * dword6 - b'0:31 -  tlv_filter_in_flags:
-  *                    Filter in Attention/MPDU/PPDU/Header/User tlvs
-  *                    Refer to CFG_TLV_FILTER_IN_FLAG defs
-- * dword7 - b'0:15 -  rx_packet_offset: rx_packet_offset in byte units
-- *		      Valid only for HW_TO_SW_RING and SW_TO_HW_RING
-- *		      A value of 0 will be considered as ignore this config.
-- *		      Refer to BUF_RING_CFG_1 defs within HW .h files,
-- *		      e.g. wmac_top_reg_seq_hwioreg.h
-- *	  - b'16:31 - rx_header_offset: rx_header_offset in byte units
-- *		      Valid only for HW_TO_SW_RING and SW_TO_HW_RING
-- *		      A value of 0 will be considered as ignore this config.
-- *		      Refer to BUF_RING_CFG_1 defs within HW .h files,
-- *		      e.g. wmac_top_reg_seq_hwioreg.h
-- * dword8 - b'0:15 -  rx_mpdu_end_offset: rx_mpdu_end_offset in byte units
-- *	              Valid only for HW_TO_SW_RING and SW_TO_HW_RING
-- *		      A value of 0 will be considered as ignore this config.
-- *		      Refer to BUF_RING_CFG_2 defs within HW .h files,
-- *		      e.g. wmac_top_reg_seq_hwioreg.h
-- *	  - b'16:31 - rx_mpdu_start_offset: rx_mpdu_start_offset in byte units
-- *		      Valid only for HW_TO_SW_RING and SW_TO_HW_RING
-- *		      A value of 0 will be considered as ignore this config.
-- *		      Refer to BUF_RING_CFG_2 defs within HW .h files,
-- *		      e.g. wmac_top_reg_seq_hwioreg.h
-- * dword9 - b'0:15 -  rx_msdu_end_offset: rx_msdu_end_offset in byte units
-- *		      Valid only for HW_TO_SW_RING and SW_TO_HW_RING
-- *		      A value of 0 will be considered as ignore this config.
-- *		      Refer to BUF_RING_CFG_3 defs within HW .h files,
-- *		      e.g. wmac_top_reg_seq_hwioreg.h
-- *	  - b'16:31 - rx_msdu_start_offset: rx_msdu_start_offset in byte units
-- *		      Valid only for HW_TO_SW_RING and SW_TO_HW_RING
-- *		      A value of 0 will be considered as ignore this config.
-- *		      Refer to BUF_RING_CFG_3 defs within HW .h files,
-- *		      e.g. wmac_top_reg_seq_hwioreg.h
-- * dword10- b'0:15  - rx_attention_offset: rx_attention_offset in byte units
-- *		      Valid only for HW_TO_SW_RING and SW_TO_HW_RING
-- *		      A value of 0 will be considered as ignore this config.
-- *		      Refer to BUF_RING_CFG_4 defs within HW .h files,
-- *		      e.g. wmac_top_reg_seq_hwioreg.h
-- *	  - b'16:31 - rsvd3 for future use
-  */
- 
- #define HTT_RX_RING_SELECTION_CFG_CMD_INFO0_MSG_TYPE	GENMASK(7, 0)
-@@ -783,16 +735,8 @@ enum htt_stats_internal_ppdu_frametype {
- #define HTT_RX_RING_SELECTION_CFG_CMD_INFO0_RING_ID	GENMASK(23, 16)
- #define HTT_RX_RING_SELECTION_CFG_CMD_INFO0_SS		BIT(24)
- #define HTT_RX_RING_SELECTION_CFG_CMD_INFO0_PS		BIT(25)
--#define HTT_RX_RING_SELECTION_CFG_CMD_OFFSET_VALID      BIT(26)
- 
- #define HTT_RX_RING_SELECTION_CFG_CMD_INFO1_BUF_SIZE	GENMASK(15, 0)
--#define HTT_RX_RING_SELECTION_CFG_RX_PACKET_OFFSET      GENMASK(15, 0)
--#define HTT_RX_RING_SELECTION_CFG_RX_HEADER_OFFSET      GENMASK(31, 16)
--#define HTT_RX_RING_SELECTION_CFG_RX_MPDU_END_OFFSET    GENMASK(15, 0)
--#define HTT_RX_RING_SELECTION_CFG_RX_MPDU_START_OFFSET  GENMASK(31, 16)
--#define HTT_RX_RING_SELECTION_CFG_RX_MSDU_END_OFFSET    GENMASK(15, 0)
--#define HTT_RX_RING_SELECTION_CFG_RX_MSDU_START_OFFSET  GENMASK(31, 16)
--#define HTT_RX_RING_SELECTION_CFG_RX_ATTENTION_OFFSET   GENMASK(15, 0)
- 
- enum htt_rx_filter_tlv_flags {
- 	HTT_RX_FILTER_TLV_FLAGS_MPDU_START		= BIT(0),
-@@ -1096,14 +1040,6 @@ enum htt_rx_data_pkt_filter_tlv_flasg3 {
- 		HTT_RX_FILTER_TLV_FLAGS_PER_MSDU_HEADER | \
- 		HTT_RX_FILTER_TLV_FLAGS_ATTENTION)
- 
--#define HTT_RX_RXDMA_FILTER_TLV_FLAGS_BUF_RING \
--		(HTT_RX_FILTER_TLV_FLAGS_MPDU_START | \
--		HTT_RX_FILTER_TLV_FLAGS_MSDU_START | \
--		HTT_RX_FILTER_TLV_FLAGS_RX_PACKET | \
--		HTT_RX_FILTER_TLV_FLAGS_MSDU_END | \
--		HTT_RX_FILTER_TLV_FLAGS_MPDU_END | \
--		HTT_RX_FILTER_TLV_FLAGS_ATTENTION)
--
- struct htt_rx_ring_selection_cfg_cmd {
- 	u32 info0;
- 	u32 info1;
-@@ -1112,10 +1048,6 @@ struct htt_rx_ring_selection_cfg_cmd {
- 	u32 pkt_type_en_flags2;
- 	u32 pkt_type_en_flags3;
- 	u32 rx_filter_tlv;
--	u32 rx_packet_offset;
--	u32 rx_mpdu_offset;
--	u32 rx_msdu_offset;
--	u32 rx_attn_offset;
- } __packed;
- 
- struct htt_rx_ring_tlv_filter {
-@@ -1124,14 +1056,6 @@ struct htt_rx_ring_tlv_filter {
- 	u32 pkt_filter_flags1; /* MGMT */
- 	u32 pkt_filter_flags2; /* CTRL */
- 	u32 pkt_filter_flags3; /* DATA */
--	bool offset_valid;
--	u16 rx_packet_offset;
--	u16 rx_header_offset;
--	u16 rx_mpdu_end_offset;
--	u16 rx_mpdu_start_offset;
--	u16 rx_msdu_end_offset;
--	u16 rx_msdu_start_offset;
--	u16 rx_attn_offset;
- };
- 
- #define HTT_RX_FULL_MON_MODE_CFG_CMD_INFO0_MSG_TYPE	GENMASK(7, 0)
---- a/drivers/net/wireless/ath/ath11k/dp_rx.c
-+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -74,12 +74,6 @@ static inline bool ath11k_dp_rx_h_mpdu_s
- 	return ab->hw_params.hw_ops->rx_desc_get_mpdu_fc_valid(desc);
- }
- 
--static u16 ath11k_dp_rxdesc_get_mpdu_frame_ctrl(struct ath11k_base *ab,
--						struct hal_rx_desc *desc)
--{
--	return ab->hw_params.hw_ops->rx_desc_get_mpdu_frame_ctl(desc);
--}
--
- static inline bool ath11k_dp_rx_h_mpdu_start_more_frags(struct ath11k_base *ab,
- 							struct sk_buff *skb)
- {
-@@ -316,35 +310,6 @@ static u8 *ath11k_dp_rxdesc_mpdu_start_a
- 	return ab->hw_params.hw_ops->rx_desc_mpdu_start_addr2(desc);
- }
- 
--#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
--static void ath11k_dp_get_rx_header_offset(struct ath11k_base *ab,
--					   struct htt_rx_ring_tlv_filter *tlv_filter)
--{
--	ab->hw_params.hw_ops->rx_desc_get_offset(tlv_filter);
--}
--#endif
--
--static bool ath11k_dp_rx_desc_dot11_hdr_fields_valid(struct ath11k_base *ab,
--						     struct hal_rx_desc *desc)
--{
--	return ab->hw_params.hw_ops->rx_desc_dot11_hdr_fields_valid(desc);
--}
--
--static void ath11k_dp_rx_desc_get_dot11_hdr(struct ath11k_base *ab,
--					    struct hal_rx_desc *desc,
--					    struct ieee80211_hdr *hdr)
--{
--	ab->hw_params.hw_ops->rx_desc_get_dot11_hdr(desc, hdr);
--}
--
--static void ath11k_dp_rx_desc_get_crypto_header(struct ath11k_base *ab,
--						struct hal_rx_desc *desc,
--						u8 *crypto_hdr,
--						enum hal_encrypt_type enctype)
--{
--	ab->hw_params.hw_ops->rx_desc_get_crypto_header(desc, crypto_hdr, enctype);
--}
--
- static void ath11k_dp_service_mon_ring(struct timer_list *t)
- {
- 	struct ath11k_base *ab = from_timer(ab, t, mon_reap_timer);
-@@ -2459,60 +2424,6 @@ int ath11k_dp_rx_crypto_icv_len(struct a
- 	return 0;
- }
- 
--static void ath11k_get_dot11_hdr_from_rx_desc(struct ath11k *ar,
--					      struct sk_buff *msdu,
--					      struct ath11k_skb_rxcb *rxcb,
--					      struct ieee80211_rx_status *status,
--					      enum hal_encrypt_type enctype)
--{
--	struct hal_rx_desc *rx_desc = rxcb->rx_desc;
--	struct ath11k_base *ab = ar->ab;
--	size_t hdr_len, crypto_len;
--	struct ieee80211_hdr *hdr;
--	u16 fc, qos_ctl = 0;
--	int expand_by;
--	u8 *crypto_hdr;
--
--	if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
--		crypto_len = ath11k_dp_rx_crypto_param_len(ar, enctype);
--		if (skb_headroom(msdu) < crypto_len) {
--			expand_by = crypto_len - skb_headroom(msdu);
--			if (WARN_ON_ONCE(pskb_expand_head(msdu, expand_by, 0, GFP_ATOMIC)))
--				return;
--		}
--		crypto_hdr = skb_push(msdu, crypto_len);
--		ath11k_dp_rx_desc_get_crypto_header(ab, rx_desc, crypto_hdr, enctype);
--	}
--
--	fc = ath11k_dp_rxdesc_get_mpdu_frame_ctrl(ab, rx_desc);
--	hdr_len = ieee80211_hdrlen(fc);
--	if (skb_headroom(msdu) < hdr_len) {
--		expand_by = hdr_len - skb_headroom(msdu);
--		if (WARN_ON_ONCE(pskb_expand_head(msdu, expand_by, 0, GFP_ATOMIC)))
--			return;
--	}
--	skb_push(msdu, hdr_len);
--	hdr = (struct ieee80211_hdr *)msdu->data;
--	hdr->frame_control = fc;
--
--	/* Get wifi header from rx_desc */
--	ath11k_dp_rx_desc_get_dot11_hdr(ab, rx_desc, hdr);
--
--	if (rxcb->is_mcbc)
--		status->flag &= ~RX_FLAG_PN_VALIDATED;
--
--	/* Add QOS header */
--	if (ieee80211_is_data_qos(hdr->frame_control)) {
--		qos_ctl = rxcb->tid;
--		if (ath11k_dp_rx_h_msdu_start_mesh_ctl_present(ab, rx_desc))
--			qos_ctl |= IEEE80211_QOS_CTL_MESH_CONTROL_PRESENT;
--
--		/* TODO Add other QoS ctl fields when required */
--		memcpy(msdu->data + (hdr_len - IEEE80211_QOS_CTL_LEN),
--		       &qos_ctl, IEEE80211_QOS_CTL_LEN);
--	}
--}
--
- static void ath11k_dp_rx_h_undecap_nwifi(struct ath11k *ar,
- 					 struct sk_buff *msdu,
- 					 u8 *first_hdr,
-@@ -2527,8 +2438,7 @@ static void ath11k_dp_rx_h_undecap_nwifi
- 	u8 sa[ETH_ALEN];
- 	u16 qos_ctl = 0;
- 	int expand_by = 0;
--	u8 *qos, *crypto_hdr;
--	bool add_qos_ctrl = false;
-+	u8 *qos;
- 
- 	/* copy SA & DA and pull decapped header */
- 	hdr = (struct ieee80211_hdr *)msdu->data;
-@@ -2537,7 +2447,7 @@ static void ath11k_dp_rx_h_undecap_nwifi
- 	ether_addr_copy(sa, ieee80211_get_SA(hdr));
- 	skb_pull(msdu, ieee80211_hdrlen(hdr->frame_control));
- 
--	if (rxcb->is_first_msdu && first_hdr) {
-+	if (rxcb->is_first_msdu) {
- 		/* original 802.11 header is valid for the first msdu
- 		 * hence we can reuse the same header
- 		 */
-@@ -2567,7 +2477,6 @@ static void ath11k_dp_rx_h_undecap_nwifi
- 
- 		/* copy decap header before overwriting for reuse below */
- 		memcpy(decap_hdr, (uint8_t *)hdr, hdr_len);
--		add_qos_ctrl = true;
- 	}
- 
- 	if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
-@@ -2578,17 +2487,13 @@ static void ath11k_dp_rx_h_undecap_nwifi
- 			if (WARN_ON_ONCE(pskb_expand_head(msdu, expand_by, 0, GFP_ATOMIC)))
- 				return;
- 		}
--		if (first_hdr) {
--			memcpy(skb_push(msdu, crypto_param_len),
--			       (void *)hdr + hdr_len, crypto_param_len);
--		} else {
--			crypto_hdr = skb_push(msdu, crypto_param_len);
--			ath11k_dp_rx_desc_get_crypto_header(ar->ab,
--							    rxcb->rx_desc, crypto_hdr, enctype);
--		}
-+		memcpy(skb_push(msdu,
-+				ath11k_dp_rx_crypto_param_len(ar, enctype)),
-+		       (void *)hdr + hdr_len,
-+		       ath11k_dp_rx_crypto_param_len(ar, enctype));
- 	}
- 
--	if (!rxcb->is_first_msdu || add_qos_ctrl) {
-+	if (!rxcb->is_first_msdu) {
- 		if (skb_headroom(msdu) < IEEE80211_QOS_CTL_LEN) {
- 			expand_by = IEEE80211_QOS_CTL_LEN - skb_headroom(msdu);
- 			if (WARN_ON_ONCE(pskb_expand_head(msdu, expand_by, 0, GFP_ATOMIC)))
-@@ -2720,25 +2625,6 @@ static void ath11k_dp_rx_h_undecap_eth(s
- 	u8 sa[ETH_ALEN];
- 	void *rfc1042;
- 	int expand_by;
--	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
--	struct ath11k_dp_rfc1042_hdr rfc = {0xaa, 0xaa, 0x03, {0x00, 0x00, 0x00}};
--
--	if (!first_hdr) {
--		eth = (struct ethhdr *)msdu->data;
--		ether_addr_copy(da, eth->h_dest);
--		ether_addr_copy(sa, eth->h_source);
--		rfc.snap_type = eth->h_proto;
--		skb_pull(msdu, sizeof(struct ethhdr));
--		if (skb_headroom(msdu) < sizeof(struct ath11k_dp_rfc1042_hdr)) {
--			expand_by = sizeof(struct ath11k_dp_rfc1042_hdr) - skb_headroom(msdu);
--			if (WARN_ON_ONCE(pskb_expand_head(msdu, expand_by, 0, GFP_ATOMIC)))
--				return;
--		}
--		memcpy(skb_push(msdu, sizeof(struct ath11k_dp_rfc1042_hdr)), &rfc,
--		       sizeof(struct ath11k_dp_rfc1042_hdr));
--		ath11k_get_dot11_hdr_from_rx_desc(ar, msdu, rxcb, status, enctype);
--		goto exit;
--	}
- 
- 	rfc1042 = ath11k_dp_rx_h_find_rfc1042(ar, msdu, enctype);
- 	if (WARN_ON_ONCE(!rfc1042))
-@@ -2782,7 +2668,6 @@ static void ath11k_dp_rx_h_undecap_eth(s
- 	}
- 	memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
- 
--exit:
- 	/* original 802.11 header has a different DA and in
- 	 * case of 4addr it may also have different SA
- 	 */
-@@ -2802,7 +2687,6 @@ static void ath11k_dp_rx_h_undecap_snap(
- 	u8 l3_pad_bytes;
- 	int expand_by;
- 	struct hal_rx_desc *rx_desc;
--	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
- 
- 	/* Delivered decapped frame:
- 	 * [amsdu header] <-- replaced with 802.11 hdr
-@@ -2816,11 +2700,6 @@ static void ath11k_dp_rx_h_undecap_snap(
- 	skb_put(msdu, l3_pad_bytes);
- 	skb_pull(msdu, sizeof(struct ath11k_dp_amsdu_subframe_hdr) + l3_pad_bytes);
- 
--	if (!first_hdr) {
--		ath11k_get_dot11_hdr_from_rx_desc(ar, msdu, rxcb, status, enctype);
--		return;
--	}
--
- 	hdr = (struct ieee80211_hdr *)first_hdr;
- 	hdr_len = ieee80211_hdrlen(hdr->frame_control);
- 
-@@ -3311,20 +3190,6 @@ static int ath11k_dp_rx_process_msdu(str
- 		goto free_out;
- 	}
- 
--	hdr_status = ath11k_dp_rx_h_80211_hdr(ab, rx_desc);
--	/* wifi hdr fields validation for 512M::
--	 * Mcast packets in ethernet frame mode
--	 * will need wifi hdr in msdu to validate PN.
--	 * Header will be added in undecap routine.
--	 * Validation on wifi hdr fields from rx_desc.
--	 */
--	if (!hdr_status && ath11k_dp_rx_h_attn_is_mcbc(ab, rx_desc) &&
--	    !ath11k_dp_rx_desc_dot11_hdr_fields_valid(ab, rx_desc)) {
--		ath11k_warn(ab, "One or more invalid dot11 header fields\n");
--		ret = -EIO;
--		goto free_out;
--	}
--
- 	rxcb = ATH11K_SKB_RXCB(msdu);
- 	rxcb->rx_desc = rx_desc;
- 	msdu_len = ath11k_dp_rx_h_msdu_start_msdu_len(ab, rx_desc);
-@@ -3337,9 +3202,8 @@ static int ath11k_dp_rx_process_msdu(str
- 			hdr_status = ath11k_dp_rx_h_80211_hdr(ab, rx_desc);
- 			ret = -EINVAL;
- 			ath11k_warn(ab, "invalid msdu len %u\n", msdu_len);
--			if (hdr_status)
--				ath11k_dbg_dump(ab, ATH11K_DBG_DATA, NULL, "", hdr_status,
--						sizeof(struct ieee80211_hdr));
-+			ath11k_dbg_dump(ab, ATH11K_DBG_DATA, NULL, "", hdr_status,
-+					sizeof(struct ieee80211_hdr));
- 			ath11k_dbg_dump(ab, ATH11K_DBG_DATA, NULL, "", rx_desc,
- 					sizeof(struct hal_rx_desc));
- 			goto free_out;
-@@ -4308,7 +4172,6 @@ static int ath11k_dp_rx_h_verify_tkip_mi
- 
- 	hdr = (struct ieee80211_hdr *)(msdu->data + hal_rx_desc_sz);
- 	hdr_len = ieee80211_hdrlen(hdr->frame_control);
--
- 	head_len = hdr_len + hal_rx_desc_sz + IEEE80211_TKIP_IV_LEN;
- 	tail_len = IEEE80211_CCMP_MIC_LEN + IEEE80211_TKIP_ICV_LEN + FCS_LEN;
- 
-@@ -4589,8 +4452,8 @@ static void ath11k_dp_rx_h_sort_frags(st
- 
- static u64 ath11k_dp_rx_h_get_pn(struct ath11k *ar, struct sk_buff *skb)
- {
--	u64 pn = 0;
- 	struct ieee80211_hdr *hdr;
-+	u64 pn = 0;
- 	u8 *ehdr;
- 	u32 hal_rx_desc_sz = ar->ab->hw_params.hal_desc_sz;
- 
-@@ -4817,9 +4680,8 @@ ath11k_dp_process_rx_err_buf(struct ath1
- 	if ((msdu_len + hal_rx_desc_sz) > DP_RX_BUFFER_SIZE) {
- 		hdr_status = ath11k_dp_rx_h_80211_hdr(ar->ab, rx_desc);
- 		ath11k_warn(ar->ab, "invalid msdu leng %u", msdu_len);
--		if (hdr_status)
--			ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "", hdr_status,
--					sizeof(struct ieee80211_hdr));
-+		ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "", hdr_status,
-+				sizeof(struct ieee80211_hdr));
- 		ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "", rx_desc,
- 				sizeof(struct hal_rx_desc));
- 		dev_kfree_skb_any(msdu);
-@@ -5451,47 +5313,6 @@ void ath11k_dp_rx_pdev_free(struct ath11
- 	ath11k_dp_rxdma_pdev_buf_free(ar);
- }
- 
--#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
--static int ath11k_dp_rxdma_ring_sel_config(struct ath11k *ar)
--{
--	struct ath11k_pdev_dp *dp = &ar->dp;
--	struct htt_rx_ring_tlv_filter tlv_filter = {0};
--	u32 ring_id;
--	int ret;
--	u32 hal_rx_desc_sz = ar->ab->hw_params.hal_desc_sz;
--
--	ring_id = dp->rx_refill_buf_ring.refill_buf_ring.ring_id;
--
--	tlv_filter.rx_filter = HTT_RX_RXDMA_FILTER_TLV_FLAGS_BUF_RING;
--	tlv_filter.pkt_filter_flags2 = HTT_RX_FP_CTRL_PKT_FILTER_TLV_FLAGS2_BAR;
--	tlv_filter.pkt_filter_flags3 = HTT_RX_FP_DATA_PKT_FILTER_TLV_FLASG3_MCAST |
--					HTT_RX_FP_DATA_PKT_FILTER_TLV_FLASG3_UCAST;
--	tlv_filter.offset_valid = true;
--	tlv_filter.rx_packet_offset = hal_rx_desc_sz;
--	tlv_filter.rx_header_offset = 0;
--
--	ath11k_dp_get_rx_header_offset(ar->ab, &tlv_filter);
--
--	if (!ar->ab->nss.enabled)
--		ret = ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id, dp->mac_id,
--						       HAL_RXDMA_BUF,
--						       DP_RXDMA_REFILL_RING_SIZE,
--						       &tlv_filter);
--	else
--		ret = ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id, dp->mac_id,
--						       HAL_RXDMA_BUF,
--						       DP_RXDMA_NSS_REFILL_RING_SIZE,
--						       &tlv_filter);
--
--	return ret;
--}
--#else
--static int ath11k_dp_rxdma_ring_sel_config(struct ath11k *ar)
--{
--	return 0;
--}
--#endif
--
- int ath11k_dp_rx_pdev_alloc(struct ath11k_base *ab, int mac_id)
- {
- 	struct ath11k *ar = ab->pdevs[mac_id].ar;
-@@ -5585,12 +5406,6 @@ config_refill_ring:
- 		}
- 	}
- 
--	ret = ath11k_dp_rxdma_ring_sel_config(ar);
--	if (ret) {
--		ath11k_warn(ab, "failed to setup rxdma ring selection config\n");
--		return ret;
--	}
--
- 	return 0;
- }
- 
---- a/drivers/net/wireless/ath/ath11k/dp_tx.c
-+++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
-@@ -1283,8 +1283,6 @@ int ath11k_dp_tx_htt_rx_filter_setup(str
- 				 !!(params.flags & HAL_SRNG_FLAGS_MSI_SWAP));
- 	cmd->info0 |= FIELD_PREP(HTT_RX_RING_SELECTION_CFG_CMD_INFO0_PS,
- 				 !!(params.flags & HAL_SRNG_FLAGS_DATA_TLV_SWAP));
--	cmd->info0 |= FIELD_PREP(HTT_RX_RING_SELECTION_CFG_CMD_OFFSET_VALID,
--				tlv_filter->offset_valid);
- 
- 	cmd->info1 = FIELD_PREP(HTT_RX_RING_SELECTION_CFG_CMD_INFO1_BUF_SIZE,
- 				rx_buf_size);
-@@ -1294,26 +1292,6 @@ int ath11k_dp_tx_htt_rx_filter_setup(str
- 	cmd->pkt_type_en_flags3 = tlv_filter->pkt_filter_flags3;
- 	cmd->rx_filter_tlv = tlv_filter->rx_filter;
- 
--	if (tlv_filter->offset_valid) {
--		cmd->rx_packet_offset = FIELD_PREP(HTT_RX_RING_SELECTION_CFG_RX_PACKET_OFFSET,
--						   tlv_filter->rx_packet_offset);
--		cmd->rx_packet_offset |= FIELD_PREP(HTT_RX_RING_SELECTION_CFG_RX_HEADER_OFFSET,
--						    tlv_filter->rx_header_offset);
--
--		cmd->rx_mpdu_offset = FIELD_PREP(HTT_RX_RING_SELECTION_CFG_RX_MPDU_END_OFFSET,
--						 tlv_filter->rx_mpdu_end_offset);
--		cmd->rx_mpdu_offset |= FIELD_PREP(HTT_RX_RING_SELECTION_CFG_RX_MPDU_START_OFFSET,
--						  tlv_filter->rx_mpdu_start_offset);
--
--		cmd->rx_msdu_offset = FIELD_PREP(HTT_RX_RING_SELECTION_CFG_RX_MSDU_END_OFFSET,
--						 tlv_filter->rx_msdu_end_offset);
--		cmd->rx_msdu_offset |= FIELD_PREP(HTT_RX_RING_SELECTION_CFG_RX_MSDU_START_OFFSET,
--						  tlv_filter->rx_msdu_start_offset);
--
--		cmd->rx_attn_offset = FIELD_PREP(HTT_RX_RING_SELECTION_CFG_RX_ATTENTION_OFFSET,
--						 tlv_filter->rx_attn_offset);
--	}
--
- 	ret = ath11k_htc_send(&ab->htc, ab->dp.eid, skb);
- 	if (ret)
- 		goto err_free;
-@@ -1392,7 +1370,6 @@ int ath11k_dp_tx_htt_monitor_mode_ring_c
- 	}
- 
- 	ring_id = dp->rxdma_mon_buf_ring.refill_buf_ring.ring_id;
--	tlv_filter.offset_valid = false;
- 
- 	if (!reset) {
- 		tlv_filter.rx_filter = HTT_RX_MON_FILTER_TLV_FLAGS_MON_BUF_RING;
---- a/drivers/net/wireless/ath/ath11k/hw.c
-+++ b/drivers/net/wireless/ath/ath11k/hw.c
-@@ -260,11 +260,7 @@ static u8 ath11k_hw_ipq8074_rx_desc_get_
- 
- static u8 *ath11k_hw_ipq8074_rx_desc_get_hdr_status(struct hal_rx_desc *desc)
- {
--#ifndef CPTCFG_ATH11K_MEM_PROFILE_512M
- 	return desc->u.ipq8074.hdr_status;
--#else
--	return NULL;
--#endif
- }
- 
- static bool ath11k_hw_ipq8074_rx_desc_encrypt_valid(struct hal_rx_desc *desc)
-@@ -409,132 +405,26 @@ static void ath11k_hw_ipq8074_rx_desc_se
- 	desc->u.ipq8074.msdu_start.info1 = __cpu_to_le32(info);
- }
- 
--static
--struct rx_attention *ath11k_hw_ipq8074_rx_desc_get_attention(struct hal_rx_desc *desc)
--{
--	return &desc->u.ipq8074.attention;
--}
--
--static u8 *ath11k_hw_ipq8074_rx_desc_get_msdu_payload(struct hal_rx_desc *desc)
--{
--	return &desc->u.ipq8074.msdu_payload[0];
--}
--
--#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
--static void ath11k_hw_ipq8074_rx_desc_get_offset(struct htt_rx_ring_tlv_filter *tlv_filter)
--{
--	tlv_filter->rx_mpdu_end_offset = __le16_to_cpu(offsetof
--			(struct hal_rx_desc_ipq8074, mpdu_end_tag));
--	tlv_filter->rx_mpdu_start_offset = __le16_to_cpu(offsetof
--			(struct hal_rx_desc_ipq8074, mpdu_start_tag));
--	tlv_filter->rx_msdu_end_offset = __le16_to_cpu(offsetof
--			(struct hal_rx_desc_ipq8074, msdu_end_tag));
--	tlv_filter->rx_msdu_start_offset = __le16_to_cpu(offsetof
--			(struct hal_rx_desc_ipq8074, msdu_start_tag));
--	tlv_filter->rx_attn_offset = __le16_to_cpu(offsetof
--			(struct hal_rx_desc_ipq8074, rx_attn_tag));
--}
--#endif
--
--static u16 ath11k_hw_ipq8074_rx_desc_get_mpdu_frame_ctl(struct hal_rx_desc *desc)
--{
--	return __le16_to_cpu(desc->u.ipq8074.mpdu_start.frame_ctrl);
--}
--
- static bool ath11k_hw_ipq8074_rx_desc_mac_addr2_valid(struct hal_rx_desc *desc)
- {
- 	return __le32_to_cpu(desc->u.ipq8074.mpdu_start.info1) &
- 	       RX_MPDU_START_INFO1_MAC_ADDR2_VALID;
- }
- 
--static u8* ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2(struct hal_rx_desc *desc)
-+static u8 *ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2(struct hal_rx_desc *desc)
- {
- 	return desc->u.ipq8074.mpdu_start.addr2;
- }
- 
--static bool ath11k_hw_ipq8074_rx_desc_dot11_hdr_fields_valid(struct hal_rx_desc *desc)
--{
--	if ((ath11k_hw_ipq8074_rx_desc_get_mpdu_seq_ctl_vld(desc) &&
--	     ath11k_hw_ipq8074_rx_desc_get_mpdu_fc_valid(desc) &&
--	     __le32_to_cpu(desc->u.ipq8074.mpdu_start.info1) &
--			   RX_MPDU_START_INFO1_MAC_ADDR1_VALID &&
--	     ath11k_hw_ipq8074_rx_desc_mac_addr2_valid(desc) &&
--	     __le32_to_cpu(desc->u.ipq8074.mpdu_start.info1) &
--			   RX_MPDU_START_INFO1_MAC_ADDR3_VALID &&
--	     FIELD_GET((RX_MPDU_START_INFO1_MPDU_DUR_VALID),
--			__le32_to_cpu(desc->u.ipq8074.mpdu_start.info1)))) {
--		return true;
--	}
--	return false;
--}
--
--static void ath11k_hw_ipq8074_rx_desc_get_dot11_hdr(struct hal_rx_desc *desc,
--						    struct ieee80211_hdr *hdr)
--{
--	hdr->frame_control = __le16_to_cpu(desc->u.ipq8074.mpdu_start.frame_ctrl);
--	hdr->duration_id = __le16_to_cpu(desc->u.ipq8074.mpdu_start.duration);
--	ether_addr_copy(hdr->addr1, desc->u.ipq8074.mpdu_start.addr1);
--	ether_addr_copy(hdr->addr2, desc->u.ipq8074.mpdu_start.addr2);
--	ether_addr_copy(hdr->addr3, desc->u.ipq8074.mpdu_start.addr3);
--	if (__le32_to_cpu(desc->u.ipq8074.mpdu_start.info1) &
--			RX_MPDU_START_INFO1_MAC_ADDR4_VALID) {
--		ether_addr_copy(hdr->addr4, desc->u.ipq8074.mpdu_start.addr4);
--	}
--	hdr->seq_ctrl = __le16_to_cpu(desc->u.ipq8074.mpdu_start.seq_ctrl);
--}
--
--static void ath11k_hw_ipq8074_rx_desc_get_crypto_hdr(struct hal_rx_desc *desc,
--						     u8 *crypto_hdr,
--						     enum hal_encrypt_type enctype)
--{
--	unsigned int key_id;
--
--	switch (enctype) {
--	case HAL_ENCRYPT_TYPE_OPEN:
--		return;
--	case HAL_ENCRYPT_TYPE_TKIP_NO_MIC:
--	case HAL_ENCRYPT_TYPE_TKIP_MIC:
--		crypto_hdr[0] =
--			HAL_RX_MPDU_INFO_PN_GET_BYTE2(desc->u.ipq8074.mpdu_start.pn[0]);
--		crypto_hdr[1] = 0;
--		crypto_hdr[2] =
--			HAL_RX_MPDU_INFO_PN_GET_BYTE1(desc->u.ipq8074.mpdu_start.pn[0]);
--		break;
--	case HAL_ENCRYPT_TYPE_CCMP_128:
--	case HAL_ENCRYPT_TYPE_CCMP_256:
--	case HAL_ENCRYPT_TYPE_GCMP_128:
--	case HAL_ENCRYPT_TYPE_AES_GCMP_256:
--		crypto_hdr[0] =
--			HAL_RX_MPDU_INFO_PN_GET_BYTE1(desc->u.ipq8074.mpdu_start.pn[0]);
--		crypto_hdr[1] =
--			HAL_RX_MPDU_INFO_PN_GET_BYTE2(desc->u.ipq8074.mpdu_start.pn[0]);
--		crypto_hdr[2] = 0;
--		break;
--	case HAL_ENCRYPT_TYPE_WEP_40:
--	case HAL_ENCRYPT_TYPE_WEP_104:
--	case HAL_ENCRYPT_TYPE_WEP_128:
--	case HAL_ENCRYPT_TYPE_WAPI_GCM_SM4:
--	case HAL_ENCRYPT_TYPE_WAPI:
--		return;
--	}
--	key_id        = FIELD_GET(RX_MPDU_START_INFO5_KEY_ID,
--				  __le32_to_cpu(desc->u.ipq8074.mpdu_start.info5));
--	crypto_hdr[3] = 0x20 | (key_id << 6);
--	crypto_hdr[4] = HAL_RX_MPDU_INFO_PN_GET_BYTE3(desc->u.ipq8074.mpdu_start.pn[0]);
--	crypto_hdr[5] = HAL_RX_MPDU_INFO_PN_GET_BYTE4(desc->u.ipq8074.mpdu_start.pn[0]);
--	crypto_hdr[6] = HAL_RX_MPDU_INFO_PN_GET_BYTE1(desc->u.ipq8074.mpdu_start.pn[1]);
--	crypto_hdr[7] = HAL_RX_MPDU_INFO_PN_GET_BYTE2(desc->u.ipq8074.mpdu_start.pn[1]);
--}
--
--static bool ath11k_hw_qcn9074_rx_desc_mac_addr2_valid(struct hal_rx_desc *desc)
-+static
-+struct rx_attention *ath11k_hw_ipq8074_rx_desc_get_attention(struct hal_rx_desc *desc)
- {
--        return __le32_to_cpu(desc->u.qcn9074.mpdu_start.info11) &
--	       RX_MPDU_START_INFO11_MAC_ADDR2_VALID;
-+	return &desc->u.ipq8074.attention;
- }
- 
--static u8* ath11k_hw_qcn9074_rx_desc_mpdu_start_addr2(struct hal_rx_desc *desc)
-+static u8 *ath11k_hw_ipq8074_rx_desc_get_msdu_payload(struct hal_rx_desc *desc)
- {
--        return desc->u.qcn9074.mpdu_start.addr2;
-+	return &desc->u.ipq8074.msdu_payload[0];
- }
- 
- static bool ath11k_hw_qcn9074_rx_desc_get_first_msdu(struct hal_rx_desc *desc)
-@@ -557,11 +447,7 @@ static u8 ath11k_hw_qcn9074_rx_desc_get_
- 
- static u8 *ath11k_hw_qcn9074_rx_desc_get_hdr_status(struct hal_rx_desc *desc)
- {
--#ifndef CPTCFG_ATH11K_MEM_PROFILE_512M
- 	return desc->u.qcn9074.hdr_status;
--#else
--	return NULL;
--#endif
- }
- 
- static bool ath11k_hw_qcn9074_rx_desc_encrypt_valid(struct hal_rx_desc *desc)
-@@ -748,11 +634,7 @@ static u8 ath11k_hw_wcn6855_rx_desc_get_
- 
- static u8 *ath11k_hw_wcn6855_rx_desc_get_hdr_status(struct hal_rx_desc *desc)
- {
--#ifndef CPTCFG_ATH11K_MEM_PROFILE_512M
- 	return desc->u.wcn6855.hdr_status;
--#else
--	return NULL;
--#endif
- }
- 
- static bool ath11k_hw_wcn6855_rx_desc_encrypt_valid(struct hal_rx_desc *desc)
-@@ -902,96 +784,6 @@ static u8 *ath11k_hw_wcn6855_rx_desc_mpd
- {
- 	return desc->u.wcn6855.mpdu_start.addr2;
- }
--#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
--static void ath11k_hw_qcn9074_rx_desc_get_offset(struct htt_rx_ring_tlv_filter *tlv_filter)
--{
--	tlv_filter->rx_mpdu_end_offset = __le16_to_cpu(offsetof
--			(struct hal_rx_desc_qcn9074, mpdu_end_tag));
--	tlv_filter->rx_mpdu_start_offset = __le16_to_cpu(offsetof
--			(struct hal_rx_desc_qcn9074, mpdu_start_tag));
--	tlv_filter->rx_msdu_end_offset = __le16_to_cpu(offsetof
--			(struct hal_rx_desc_qcn9074, msdu_end_tag));
--	tlv_filter->rx_msdu_start_offset = __le16_to_cpu(offsetof
--			(struct hal_rx_desc_qcn9074, msdu_start_tag));
--	tlv_filter->rx_attn_offset = __le16_to_cpu(offsetof
--			(struct hal_rx_desc_qcn9074, rx_attn_tag));
--}
--#endif
--
--static u16 ath11k_hw_qcn9074_rx_desc_get_mpdu_frame_ctl(struct hal_rx_desc *desc)
--{
--	return __le16_to_cpu(desc->u.qcn9074.mpdu_start.frame_ctrl);
--}
--
--static bool ath11k_hw_qcn9074_rx_desc_dot11_hdr_fields_valid(struct hal_rx_desc *desc)
--{
--	if ((ath11k_hw_qcn9074_rx_desc_get_mpdu_seq_ctl_vld(desc) &&
--	     ath11k_hw_qcn9074_rx_desc_get_mpdu_fc_valid(desc) &&
--	     (__le32_to_cpu(desc->u.qcn9074.mpdu_start.info11) &
--			     RX_MPDU_START_INFO11_MAC_ADDR1_VALID) &&
--	     ath11k_hw_qcn9074_rx_desc_mac_addr2_valid(desc) &&
--	     (__le32_to_cpu(desc->u.qcn9074.mpdu_start.info11) &
--			    RX_MPDU_START_INFO11_MAC_ADDR3_VALID) &&
--	     FIELD_GET((RX_MPDU_START_INFO11_MPDU_DUR_VALID),
--			__le32_to_cpu(desc->u.qcn9074.mpdu_start.info11)))) {
--		return true;
--	}
--	return false;
--}
--
--static void ath11k_hw_qcn9074_rx_desc_get_dot11_hdr(struct hal_rx_desc *desc,
--						    struct ieee80211_hdr *hdr)
--{
--	hdr->frame_control = __le16_to_cpu(desc->u.qcn9074.mpdu_start.frame_ctrl);
--	hdr->duration_id = __le16_to_cpu(desc->u.qcn9074.mpdu_start.duration);
--	ether_addr_copy(hdr->addr1, desc->u.qcn9074.mpdu_start.addr1);
--	ether_addr_copy(hdr->addr2, desc->u.qcn9074.mpdu_start.addr2);
--	ether_addr_copy(hdr->addr3, desc->u.qcn9074.mpdu_start.addr3);
--	if (__le32_to_cpu(desc->u.qcn9074.mpdu_start.info11) &
--			  RX_MPDU_START_INFO11_MAC_ADDR4_VALID) {
--		ether_addr_copy(hdr->addr4, desc->u.qcn9074.mpdu_start.addr4);
--	}
--	hdr->seq_ctrl = __le16_to_cpu(desc->u.qcn9074.mpdu_start.seq_ctrl);
--}
--
--static void ath11k_hw_qcn9074_rx_desc_get_crypto_hdr(struct hal_rx_desc *desc,
--						     u8 *crypto_hdr,
--						     enum hal_encrypt_type enctype)
--{
--	unsigned int key_id;
--
--	switch (enctype) {
--	case HAL_ENCRYPT_TYPE_OPEN:
--		return;
--	case HAL_ENCRYPT_TYPE_TKIP_NO_MIC:
--	case HAL_ENCRYPT_TYPE_TKIP_MIC:
--		crypto_hdr[0] = HAL_RX_MPDU_INFO_PN_GET_BYTE2(desc->u.qcn9074.mpdu_start.pn[0]);
--		crypto_hdr[1] = 0;
--		crypto_hdr[2] = HAL_RX_MPDU_INFO_PN_GET_BYTE1(desc->u.qcn9074.mpdu_start.pn[0]);
--		break;
--	case HAL_ENCRYPT_TYPE_CCMP_128:
--	case HAL_ENCRYPT_TYPE_CCMP_256:
--	case HAL_ENCRYPT_TYPE_GCMP_128:
--	case HAL_ENCRYPT_TYPE_AES_GCMP_256:
--		crypto_hdr[0] = HAL_RX_MPDU_INFO_PN_GET_BYTE1(desc->u.qcn9074.mpdu_start.pn[0]);
--		crypto_hdr[1] = HAL_RX_MPDU_INFO_PN_GET_BYTE2(desc->u.qcn9074.mpdu_start.pn[0]);
--		crypto_hdr[2] = 0;
--		break;
--	case HAL_ENCRYPT_TYPE_WEP_40:
--	case HAL_ENCRYPT_TYPE_WEP_104:
--	case HAL_ENCRYPT_TYPE_WEP_128:
--	case HAL_ENCRYPT_TYPE_WAPI_GCM_SM4:
--	case HAL_ENCRYPT_TYPE_WAPI:
--		return;
--	}
--	key_id        = FIELD_GET(RX_MPDU_START_INFO12_KEY_ID,
--				  __le32_to_cpu(desc->u.qcn9074.mpdu_start.info12));
--	crypto_hdr[3] = 0x20 | (key_id << 6);
--	crypto_hdr[4] = HAL_RX_MPDU_INFO_PN_GET_BYTE3(desc->u.qcn9074.mpdu_start.pn[0]);
--	crypto_hdr[5] = HAL_RX_MPDU_INFO_PN_GET_BYTE4(desc->u.qcn9074.mpdu_start.pn[0]);
--	crypto_hdr[6] = HAL_RX_MPDU_INFO_PN_GET_BYTE1(desc->u.qcn9074.mpdu_start.pn[1]);
--	crypto_hdr[7] = HAL_RX_MPDU_INFO_PN_GET_BYTE2(desc->u.qcn9074.mpdu_start.pn[1]);
--}
- 
- static void ath11k_hw_wcn6855_reo_setup(struct ath11k_base *ab)
- {
-@@ -1196,13 +988,6 @@ const struct ath11k_hw_ops ipq8074_ops =
- 	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2,
- 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
- 	.rx_desc_get_hal_mpdu_len = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_len,
--#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
--	.rx_desc_get_offset = ath11k_hw_ipq8074_rx_desc_get_offset,
--#endif
--	.rx_desc_get_mpdu_frame_ctl = ath11k_hw_ipq8074_rx_desc_get_mpdu_frame_ctl,
--	.rx_desc_dot11_hdr_fields_valid = ath11k_hw_ipq8074_rx_desc_dot11_hdr_fields_valid,
--	.rx_desc_get_dot11_hdr = ath11k_hw_ipq8074_rx_desc_get_dot11_hdr,
--	.rx_desc_get_crypto_header = ath11k_hw_ipq8074_rx_desc_get_crypto_hdr,
- };
- 
- const struct ath11k_hw_ops ipq6018_ops = {
-@@ -1244,13 +1029,6 @@ const struct ath11k_hw_ops ipq6018_ops =
- 	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2,
- 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
- 	.rx_desc_get_hal_mpdu_len = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_len,
--#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
--	.rx_desc_get_offset = ath11k_hw_ipq8074_rx_desc_get_offset,
--#endif
--	.rx_desc_get_mpdu_frame_ctl = ath11k_hw_ipq8074_rx_desc_get_mpdu_frame_ctl,
--	.rx_desc_dot11_hdr_fields_valid = ath11k_hw_ipq8074_rx_desc_dot11_hdr_fields_valid,
--	.rx_desc_get_dot11_hdr = ath11k_hw_ipq8074_rx_desc_get_dot11_hdr,
--	.rx_desc_get_crypto_header = ath11k_hw_ipq8074_rx_desc_get_crypto_hdr,
- };
- 
- const struct ath11k_hw_ops qca6390_ops = {
-@@ -1293,13 +1071,6 @@ const struct ath11k_hw_ops qca6390_ops =
- 	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2,
- 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
- 	.rx_desc_get_hal_mpdu_len = ath11k_hw_ipq8074_rx_desc_get_hal_mpdu_len,
--#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
--	.rx_desc_get_offset = ath11k_hw_ipq8074_rx_desc_get_offset,
--#endif
--	.rx_desc_get_mpdu_frame_ctl = ath11k_hw_ipq8074_rx_desc_get_mpdu_frame_ctl,
--	.rx_desc_dot11_hdr_fields_valid = ath11k_hw_ipq8074_rx_desc_dot11_hdr_fields_valid,
--	.rx_desc_get_dot11_hdr = ath11k_hw_ipq8074_rx_desc_get_dot11_hdr,
--	.rx_desc_get_crypto_header = ath11k_hw_ipq8074_rx_desc_get_crypto_hdr,
- };
- 
- const struct ath11k_hw_ops qcn9074_ops = {
-@@ -1337,17 +1108,10 @@ const struct ath11k_hw_ops qcn9074_ops =
- 	.rx_desc_get_msdu_payload = ath11k_hw_qcn9074_rx_desc_get_msdu_payload,
- 	.reo_setup = ath11k_hw_ipq8074_reo_setup,
- 	.mpdu_info_get_peerid = ath11k_hw_qcn9074_mpdu_info_get_peerid,
--	.rx_desc_mac_addr2_valid = ath11k_hw_qcn9074_rx_desc_mac_addr2_valid,
--	.rx_desc_mpdu_start_addr2 = ath11k_hw_qcn9074_rx_desc_mpdu_start_addr2,
-+	.rx_desc_mac_addr2_valid = ath11k_hw_ipq9074_rx_desc_mac_addr2_valid,
-+	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq9074_rx_desc_mpdu_start_addr2,
- 	.get_ring_selector = ath11k_hw_ipq8074_get_tcl_ring_selector,
- 	.rx_desc_get_hal_mpdu_len = ath11k_hw_qcn9074_rx_desc_get_hal_mpdu_len,
--#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
--	.rx_desc_get_offset = ath11k_hw_qcn9074_rx_desc_get_offset,
--#endif
--	.rx_desc_get_mpdu_frame_ctl = ath11k_hw_qcn9074_rx_desc_get_mpdu_frame_ctl,
--	.rx_desc_dot11_hdr_fields_valid = ath11k_hw_qcn9074_rx_desc_dot11_hdr_fields_valid,
--	.rx_desc_get_dot11_hdr = ath11k_hw_qcn9074_rx_desc_get_dot11_hdr,
--	.rx_desc_get_crypto_header = ath11k_hw_qcn9074_rx_desc_get_crypto_hdr,
- };
- 
- const struct ath11k_hw_ops wcn6855_ops = {
---- a/drivers/net/wireless/ath/ath11k/hw.h
-+++ b/drivers/net/wireless/ath/ath11k/hw.h
-@@ -22,11 +22,6 @@
- #define ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE	512
- #define ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE	128
- #define ATH11K_DP_RXDMA_MONITOR_DST_RING_SIZE	128
--#define ATH11K_DP_RXDMA_REFILL_RING_SIZE	2048
--/* 256b desc TLV + 4b(rounded) Pad + 30byte max nwifi header +
-- * 18byte mesh hdr + 8byte snap + 1500 eth payload
-- */
--#define ATH11K_DP_RXDMA_NSS_REFILL_RING_SIZE	1816
- #else
- /* Num VDEVS per radio */
- #define TARGET_NUM_VDEVS(ab)	(ab->hw_params.num_vdevs_peers[ab->qmi.target_mem_mode].num_vdevs)
-@@ -38,8 +33,6 @@
- #define ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE	1024
- #define ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE	4096
- #define ATH11K_DP_RXDMA_MONITOR_DST_RING_SIZE	2048
--#define ATH11K_DP_RXDMA_REFILL_RING_SIZE	2048
--#define ATH11K_DP_RXDMA_NSS_REFILL_RING_SIZE	2048
- #endif
- 
- /* Num of peers for Single Radio mode */
-@@ -136,9 +129,6 @@ enum ath11k_bus {
- struct hal_rx_desc;
- struct hal_tcl_data_cmd;
- 
--struct htt_rx_ring_tlv_filter;
--enum hal_encrypt_type;
--
- struct ath11k_hw_ring_mask {
- 	u8 tx[ATH11K_EXT_IRQ_GRP_NUM_MAX];
- 	u8 rx_mon_status[ATH11K_EXT_IRQ_GRP_NUM_MAX];
-@@ -298,16 +288,6 @@ struct ath11k_hw_ops {
- 	u8* (*rx_desc_mpdu_start_addr2)(struct hal_rx_desc *desc);
- 	u32 (*get_ring_selector)(struct sk_buff *skb);
- 	u32 (*rx_desc_get_hal_mpdu_len)(struct hal_rx_mpdu_info *mpdu_info);
--#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
--	void (*rx_desc_get_offset)(struct htt_rx_ring_tlv_filter *tlv_filter);
--#endif
--	u16 (*rx_desc_get_mpdu_frame_ctl)(struct hal_rx_desc *desc);
--	bool (*rx_desc_dot11_hdr_fields_valid)(struct hal_rx_desc *desc);
--	void (*rx_desc_get_dot11_hdr)(struct hal_rx_desc *desc,
--				      struct ieee80211_hdr *hdr);
--	void (*rx_desc_get_crypto_header)(struct hal_rx_desc *desc,
--					  u8 *crypto_hdr,
--					  enum hal_encrypt_type enctype);
- };
- 
- extern const struct ath11k_hw_ops ipq8074_ops;
---- a/drivers/net/wireless/ath/ath11k/mac.c
-+++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -6514,7 +6514,6 @@ static int ath11k_mac_config_mon_status_
- 			tlv_filter.rx_filter = ath11k_debugfs_rx_filter(ar);
- 	}
- 
--	tlv_filter.offset_valid = false;
- 	for (i = 0; i < ab->hw_params.num_rxdma_per_pdev; i++) {
- 		ring_id = ar->dp.rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
- 		ret = ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id,
---- a/drivers/net/wireless/ath/ath11k/rx_desc.h
-+++ b/drivers/net/wireless/ath/ath11k/rx_desc.h
-@@ -1508,17 +1508,4 @@ struct hal_rx_desc {
- #define RU_484 18
- #define RU_996 37
- 
--#define HAL_RX_MPDU_INFO_PN_GET_BYTE1(__val) \
--	FIELD_GET(GENMASK(7, 0), __le32_to_cpu(__val))
--
--#define HAL_RX_MPDU_INFO_PN_GET_BYTE2(__val) \
--	FIELD_GET(GENMASK(15, 8), __le32_to_cpu(__val))
--
--#define HAL_RX_MPDU_INFO_PN_GET_BYTE3(__val) \
--	FIELD_GET(GENMASK(23, 16), __le32_to_cpu(__val))
--
--#define HAL_RX_MPDU_INFO_PN_GET_BYTE4(__val) \
--	FIELD_GET(GENMASK(31, 24), __le32_to_cpu(__val))
--
--
- #endif /* ATH11K_RX_DESC_H */
---- a/drivers/net/wireless/ath/ath11k/nss.c
-+++ b/drivers/net/wireless/ath/ath11k/nss.c
-@@ -4424,7 +4424,7 @@ static int ath11k_nss_init(struct ath11k
- 
- 	/* fill rx parameters to initialize rx context */
- 	wim->wrip.tlv_size = ab->hw_params.hal_desc_sz;
--	wim->wrip.rx_buf_len = DP_RXDMA_NSS_REFILL_RING_SIZE;
-+	wim->wrip.rx_buf_len = DP_RX_BUFFER_SIZE;
- 	if (of_property_read_bool(dev->of_node, "nss-radio-priority"))
- 		wim->flags |= WIFILI_MULTISOC_THREAD_MAP_ENABLE;
- 
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-903-Revert-207-ath11k-Enable-256_512MB-profiles.patch b/package/kernel/mac80211/patches/nss/ath11k/999-903-Revert-207-ath11k-Enable-256_512MB-profiles.patch
deleted file mode 100644
index 7132fe38176926..00000000000000
--- a/package/kernel/mac80211/patches/nss/ath11k/999-903-Revert-207-ath11k-Enable-256_512MB-profiles.patch
+++ /dev/null
@@ -1,327 +0,0 @@
-reverted:
---- a/drivers/net/wireless/ath/ath11k/Kconfig
-+++ b/drivers/net/wireless/ath/ath11k/Kconfig
-@@ -32,20 +32,6 @@ config ATH11K_NSS_MESH_SUPPORT
- 
- 	  If unsure, say Y to enable NSS offload support.
- 
--config ATH11K_MEM_PROFILE_512M
--	bool "ath11k enable 512MB memory profile"
--	depends on ATH11K
--	default n
--	---help---
--	Enables 512MB memory profile for ath11k
--
--config ATH11K_MEM_PROFILE_256M
--	bool "ath11k enable 256MB memory profile"
--	depends on ATH11K
--	default n
--	---help---
--	Enables 256MB memory profile for ath11k
--
- config ATH11K_AHB
- 	tristate "Atheros ath11k AHB support"
- 	depends on m
---- a/drivers/net/wireless/ath/ath11k/hw.h
-+++ b/drivers/net/wireless/ath/ath11k/hw.h
-@@ -11,29 +11,11 @@
- #include "wmi.h"
- 
- /* Target configuration defines */
--#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
- 
--#define TARGET_NUM_VDEVS(ab)	8
--#define TARGET_NUM_PEERS_PDEV(ab)	(128 + TARGET_NUM_VDEVS(ab))
--/* Max num of stations (per radio) */
--#define TARGET_NUM_STATIONS(ab)	128
--#define ATH11K_QMI_TARGET_MEM_MODE	ATH11K_QMI_TARGET_MEM_MODE_512M
--#define ATH11K_DP_TX_COMP_RING_SIZE	8192
--#define ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE	512
--#define ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE	128
--#define ATH11K_DP_RXDMA_MONITOR_DST_RING_SIZE	128
--#else
- /* Num VDEVS per radio */
--#define TARGET_NUM_VDEVS(ab)	(ab->hw_params.num_vdevs_peers[ab->qmi.target_mem_mode].num_vdevs)
--#define TARGET_NUM_PEERS_PDEV(ab) (ab->hw_params.num_vdevs_peers[ab->qmi.target_mem_mode].num_peers + TARGET_NUM_VDEVS(ab))
--/* Max num of stations (per radio) */
--#define TARGET_NUM_STATIONS(ab) (ab->hw_params.num_vdevs_peers[ab->qmi.target_mem_mode].num_peers)
--#define ATH11K_QMI_TARGET_MEM_MODE		ATH11K_QMI_TARGET_MEM_MODE_DEFAULT
--#define ATH11K_DP_TX_COMP_RING_SIZE		32768
--#define ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE	1024
--#define ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE	4096
--#define ATH11K_DP_RXDMA_MONITOR_DST_RING_SIZE	2048
--#endif
-+#define TARGET_NUM_VDEVS(ab)	(ab->hw_params.num_vdevs)
-+
-+#define TARGET_NUM_PEERS_PDEV(ab) (ab->hw_params.num_peers + TARGET_NUM_VDEVS(ab))
- 
- /* Num of peers for Single Radio mode */
- #define TARGET_NUM_PEERS_SINGLE(ab) (TARGET_NUM_PEERS_PDEV(ab))
-@@ -44,6 +26,9 @@
- /* Num of peers for DBS_SBS */
- #define TARGET_NUM_PEERS_DBS_SBS(ab)	(3 * TARGET_NUM_PEERS_PDEV(ab))
- 
-+/* Max num of stations (per radio) */
-+#define TARGET_NUM_STATIONS(ab)	(ab->hw_params.num_peers)
-+
- #define TARGET_NUM_PEERS(ab, x)	TARGET_NUM_PEERS_##x(ab)
- #define TARGET_NUM_PEER_KEYS	2
- #define TARGET_NUM_TIDS(ab, x)	(2 * TARGET_NUM_PEERS(ab, x) +	\
-@@ -241,7 +226,6 @@ struct ath11k_hw_params {
- 	u32 tx_ring_size;
- 	bool smp2p_wow_exit;
- 	bool support_fw_mac_sequence;
--	const struct ath11k_num_vdevs_peers *num_vdevs_peers;
- 	bool support_dual_stations;
- };
- 
---- a/drivers/net/wireless/ath/ath11k/qmi.h
-+++ b/drivers/net/wireless/ath/ath11k/qmi.h
-@@ -29,12 +29,6 @@
- #define ATH11K_QMI_BDF_EXT_STR_LENGTH		0x20
- #define ATH11K_QMI_FW_MEM_REQ_SEGMENT_CNT	5
- 
--#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
--#define ATH11K_QMI_IPQ8074_M3_DUMP_ADDRESS     0x4E800000
--#else
--#define ATH11K_QMI_IPQ8074_M3_DUMP_ADDRESS     0x51000000
--#endif
--
- #define QMI_WLFW_REQUEST_MEM_IND_V01		0x0035
- #define QMI_WLFW_FW_MEM_READY_IND_V01		0x0037
- #define QMI_WLFW_COLD_BOOT_CAL_DONE_IND_V01	0x003E
-@@ -48,11 +42,6 @@
- #define ATH11K_QMI_DEVICE_BAR_SIZE		0x200000
- 
- struct ath11k_base;
--enum ath11k_target_mem_mode {
-- 	ATH11K_QMI_TARGET_MEM_MODE_DEFAULT = 0,
-- 	ATH11K_QMI_TARGET_MEM_MODE_512M,
--	ATH11K_QMI_TARGET_MEM_MODE_256M,
--};
- 
- enum ath11k_qmi_file_type {
- 	ATH11K_QMI_FILE_TYPE_BDF_GOLDEN,
---- a/local-symbols
-+++ b/local-symbols
-@@ -167,8 +167,6 @@ ATH11K_AHB=
- ATH11K_PCI=
- ATH11K_NSS_SUPPORT=
- ATH11K_NSS_MESH_SUPPORT=
--ATH11K_MEM_PROFILE_256M=
--ATH11K_MEM_PROFILE_512M=
- ATH11K_DEBUG=
- ATH11K_DEBUGFS=
- ATH11K_DEBUGFS_STA=
---- a/drivers/net/wireless/ath/ath11k/core.h
-+++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -985,11 +985,6 @@ struct ath11k_msi_config {
- 	u16 hw_rev;
- };
- 
--struct ath11k_num_vdevs_peers {
--	u32 num_vdevs;
--	u32 num_peers;
--};
--
- /* Master structure to hold the hw data which may be used in core module */
- struct ath11k_base {
- 	enum ath11k_hw_rev hw_rev;
-@@ -1135,8 +1130,6 @@ struct ath11k_base {
- 		DECLARE_BITMAP(fw_features, ATH11K_FW_FEATURE_COUNT);
- 	} fw;
- 
--	atomic_t num_max_allowed;
--
- #ifdef CPTCFG_NL80211_TESTMODE
- 	struct {
- 		u32 data_pos;
---- a/drivers/net/wireless/ath/ath11k/dp.h
-+++ b/drivers/net/wireless/ath/ath11k/dp.h
-@@ -93,7 +93,7 @@ struct idr_entry {
- 	void *buf;
- };
- 
--#define DP_TX_IDR_SIZE	ATH11K_DP_TX_COMP_RING_SIZE
-+#define DP_TX_IDR_SIZE	32768
- 
- struct dp_tx_ring {
- 	u8 tcl_data_ring_id;
-@@ -225,8 +225,7 @@ struct ath11k_pdev_dp {
- #define DP_WBM_RELEASE_RING_SIZE	64
- #define DP_TCL_DATA_RING_SIZE		512
- #define DP_TCL_DATA_RING_SIZE_WCN6750	2048
--#define DP_TX_COMP_RING_SIZE		ATH11K_DP_TX_COMP_RING_SIZE
--#define DP_TX_COMP_MAX_ALLOWED         DP_TX_COMP_RING_SIZE
-+#define DP_TX_COMP_RING_SIZE		32768
- #define DP_TCL_CMD_RING_SIZE		32
- #define DP_TCL_STATUS_RING_SIZE		32
- #define DP_REO_DST_RING_MAX		4
-@@ -239,9 +238,9 @@ struct ath11k_pdev_dp {
- #define DP_RXDMA_BUF_RING_SIZE		4096
- #define DP_RXDMA_REFILL_RING_SIZE	2048
- #define DP_RXDMA_ERR_DST_RING_SIZE	1024
--#define DP_RXDMA_MON_STATUS_RING_SIZE	ATH11K_DP_RXDMA_MON_STATUS_RING_SIZE
--#define DP_RXDMA_MONITOR_BUF_RING_SIZE	ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE
--#define DP_RXDMA_MONITOR_DST_RING_SIZE	ATH11K_DP_RXDMA_MONITOR_BUF_RING_SIZE
-+#define DP_RXDMA_MON_STATUS_RING_SIZE	1024
-+#define DP_RXDMA_MONITOR_BUF_RING_SIZE	4096
-+#define DP_RXDMA_MONITOR_DST_RING_SIZE	2048
- #define DP_RXDMA_MONITOR_DESC_RING_SIZE	4096
- 
- #define DP_RX_RELEASE_RING_NUM	3
---- a/drivers/net/wireless/ath/ath11k/dp_tx.c
-+++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
-@@ -132,12 +132,6 @@ int ath11k_dp_tx(struct ath11k *ar, stru
- 
- 	max_tx_ring = ab->hw_params.max_tx_ring;
- 
--#ifdef CPTCFG_ATH11K_MEM_PROFILE_512M
--	if (unlikely(atomic_read(&ab->num_max_allowed) > DP_TX_COMP_MAX_ALLOWED)) {
--		atomic_inc(&ab->soc_stats.tx_err.max_fail);
--		return -ENOSPC;
--	}
--#endif
- 	ring_selector = smp_processor_id();;
- 	pool_id = ring_selector;
- 
-@@ -327,7 +321,6 @@ tcl_ring_sel:
- 					 sizeof(struct hal_tlv_hdr), &ti);
- 
- 	atomic_inc(&ar->dp.num_tx_pending);
--	atomic_inc(&ab->num_max_allowed);
- 	ath11k_hal_srng_access_end(ab, tcl_ring);
- 
- 	ath11k_dp_shadow_start_timer(ab, tcl_ring, &dp->tx_ring_timer[ti.buf_id]);
-@@ -882,12 +875,6 @@ void ath11k_dp_tx_completion_handler(str
- 
- 	spin_unlock_bh(&status_ring->lock);
- 
--	if (atomic_sub_return(count, &ab->num_max_allowed) < 0) {
--		ath11k_warn(ab, "tx completion mismatch count %d ring id %d max_num %d\n",
--			    count, tx_ring->tcl_data_ring_id,
--			    atomic_read(&ab->num_max_allowed));
--	}
--
- 	while (count--) {
- 		msdu=NULL;
- 		tx_status = &tx_ring->tx_status[i++];
---- a/drivers/net/wireless/ath/ath11k/core.c
-+++ b/drivers/net/wireless/ath/ath11k/core.c
-@@ -43,8 +43,6 @@ bool ath11k_ftm_mode;
- module_param_named(ftm_mode, ath11k_ftm_mode, bool, 0444);
- MODULE_PARM_DESC(ftm_mode, "Boots up in factory test mode");
- 
--static const struct ath11k_num_vdevs_peers ath11k_vdevs_peers[];
--
- static struct ath11k_hw_params ath11k_hw_params[] = {
- 	{
- 		.hw_rev = ATH11K_HW_IPQ8074,
-@@ -130,7 +128,6 @@ static struct ath11k_hw_params ath11k_hw
- 		.tcl_ring_retry = true,
- 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
- 		.smp2p_wow_exit = false,
--		.num_vdevs_peers = ath11k_vdevs_peers,
- 		.support_dual_stations = false,
- 	},
- 	{
-@@ -182,7 +179,7 @@ static struct ath11k_hw_params ath11k_hw
- 		.coldboot_cal_mm = false,
- 		.coldboot_cal_ftm = false,
- 		.cbcal_restart_fw = true,
--		.fw_mem_mode = ATH11K_QMI_TARGET_MEM_MODE,
-+		.fw_mem_mode = 0,
- 		.num_vdevs = 16 + 1,
- 		.num_peers = 512,
- 		.supports_suspend = false,
-@@ -269,7 +266,7 @@ static struct ath11k_hw_params ath11k_hw
- 		.coldboot_cal_mm = false,
- 		.coldboot_cal_ftm = false,
- 		.cbcal_restart_fw = false,
--		.fw_mem_mode = ATH11K_QMI_TARGET_MEM_MODE,
-+		.fw_mem_mode = 0,
- 		.num_vdevs = 2 + 1,
- 		.num_peers = 512,
- 		.supports_suspend = true,
-@@ -442,7 +439,7 @@ static struct ath11k_hw_params ath11k_hw
- 		.coldboot_cal_mm = false,
- 		.coldboot_cal_ftm = false,
- 		.cbcal_restart_fw = false,
--		.fw_mem_mode = ATH11K_QMI_TARGET_MEM_MODE,
-+		.fw_mem_mode = 0,
- 		.num_vdevs = 2 + 1,
- 		.num_peers = 512,
- 		.supports_suspend = true,
-@@ -478,7 +475,6 @@ static struct ath11k_hw_params ath11k_hw
- 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
- 		.smp2p_wow_exit = false,
- 		.support_fw_mac_sequence = true,
--		.num_vdevs_peers = ath11k_vdevs_peers,
- 		.support_dual_stations = true,
- 	},
- 	{
-@@ -530,7 +526,7 @@ static struct ath11k_hw_params ath11k_hw
- 		.coldboot_cal_mm = false,
- 		.coldboot_cal_ftm = false,
- 		.cbcal_restart_fw = false,
--		.fw_mem_mode = ATH11K_QMI_TARGET_MEM_MODE,
-+		.fw_mem_mode = 0,
- 		.num_vdevs = 2 + 1,
- 		.num_peers = 512,
- 		.supports_suspend = true,
-@@ -566,7 +562,6 @@ static struct ath11k_hw_params ath11k_hw
- 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
- 		.smp2p_wow_exit = false,
- 		.support_fw_mac_sequence = true,
--		.num_vdevs_peers = ath11k_vdevs_peers,
- 		.support_dual_stations = true,
- 	},
- 	{
-@@ -616,7 +611,7 @@ static struct ath11k_hw_params ath11k_hw
- 		.coldboot_cal_mm = true,
- 		.coldboot_cal_ftm = true,
- 		.cbcal_restart_fw = false,
--		.fw_mem_mode = ATH11K_QMI_TARGET_MEM_MODE,
-+		.fw_mem_mode = 0,
- 		.num_vdevs = 3,
- 		.num_peers = 512,
- 		.supports_suspend = false,
-@@ -696,7 +691,7 @@ static struct ath11k_hw_params ath11k_hw
- 		.supports_monitor = false,
- 		.supports_sta_ps = false,
- 		.supports_shadow_regs = false,
--		.fw_mem_mode = ATH11K_QMI_TARGET_MEM_MODE,
-+		.fw_mem_mode = 0,
- 		.num_vdevs = 16 + 1,
- 		.num_peers = 512,
- 		.supports_regdb = false,
-@@ -731,7 +726,6 @@ static struct ath11k_hw_params ath11k_hw
- 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
- 		.smp2p_wow_exit = false,
- 		.support_fw_mac_sequence = false,
--		.num_vdevs_peers = ath11k_vdevs_peers,
- 		.support_dual_stations = false,
- 	},
- 	{
-@@ -825,21 +819,6 @@ static struct ath11k_hw_params ath11k_hw
- 	},
- };
- 
--static const struct ath11k_num_vdevs_peers ath11k_vdevs_peers[] = {
--	{
--		.num_vdevs = (16 + 1),
--		.num_peers = 512,
--	},
--	{
--		.num_vdevs = (8 + 1),
--		.num_peers = 128,
--	},
--	{
--		.num_vdevs = 8,
--		.num_peers = 128,
--	},
--};
--
- static inline struct ath11k_pdev *ath11k_core_get_single_pdev(struct ath11k_base *ab)
- {
- 	WARN_ON(!ab->hw_params.single_pdev_only);

From a6bb6e7b62e41b9ec84b3c9def186deeab0ee89e Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Mon, 30 Sep 2024 01:04:29 -0400
Subject: [PATCH 177/225] ath11k_nss: Fix iface stats showing up as 0

Generic ndo_get_stats64 was removed in kernel > 6.9. This ends up
breaking interface stats on NSS builds.

```
phy0-ap0  Link encap:Ethernet  HWaddr
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:841 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

phy1-ap0  Link encap:Ethernet  HWaddr
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
```

Until a better workaround is implemented revert the following patch.
```
commit c018411d355518a0b2a304d7543564cdd1b808b6
Author:     Breno Leitao <leitao@debian.org>
AuthorDate: Fri Jun 7 03:20:44 2024 -0700
Commit:     Johannes Berg <johannes.berg@intel.com>
CommitDate: Wed Jun 12 13:04:24 2024 +0200

    wifi: mac80211: Remove generic .ndo_get_stats64

    Commit 3e2f544dd8a33 ("net: get stats64 if device if driver is
    configured") moved the callback to dev_get_tstats64() to net core, so,
    unless the driver is doing some custom stats collection, it does not
    need to set .ndo_get_stats64.

    Since this driver is now relying in NETDEV_PCPU_STAT_TSTATS, then, it
    doesn't need to set the dev_get_tstats64() generic .ndo_get_stats64
    function pointer.

    In this driver specifically, .ndo_get_stats64 basically points to
    dev_fetch_sw_netstats(). Now it will point to dev_get_tstats64(), which
    calls netdev_stats_to_stats64() and dev_fetch_sw_netstats().
    netdev_stats_to_stats64() seems irrelevant for this driver.
```

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...evert-Remove-generic-ndo_get_stats64.patch | 39 +++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 package/kernel/mac80211/patches/nss/subsys/999-919-Fix-dev-stats-Revert-Remove-generic-ndo_get_stats64.patch

diff --git a/package/kernel/mac80211/patches/nss/subsys/999-919-Fix-dev-stats-Revert-Remove-generic-ndo_get_stats64.patch b/package/kernel/mac80211/patches/nss/subsys/999-919-Fix-dev-stats-Revert-Remove-generic-ndo_get_stats64.patch
new file mode 100644
index 00000000000000..96aa0c936c4661
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/subsys/999-919-Fix-dev-stats-Revert-Remove-generic-ndo_get_stats64.patch
@@ -0,0 +1,39 @@
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -832,6 +832,12 @@ static void ieee80211_uninit(struct net_
+ 	ieee80211_teardown_sdata(IEEE80211_DEV_TO_SUB_IF(dev));
+ }
+ 
++static void
++ieee80211_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
++{
++	dev_fetch_sw_netstats(stats, dev->tstats);
++}
++
+ static int ieee80211_netdev_setup_tc(struct net_device *dev,
+ 				     enum tc_setup_type type, void *type_data)
+ {
+@@ -848,6 +854,7 @@ static const struct net_device_ops ieee8
+ 	.ndo_start_xmit		= ieee80211_subif_start_xmit,
+ 	.ndo_set_rx_mode	= ieee80211_set_multicast_list,
+ 	.ndo_set_mac_address 	= ieee80211_change_mac,
++	.ndo_get_stats64	= ieee80211_get_stats64,
+ 	.ndo_setup_tc		= ieee80211_netdev_setup_tc,
+ };
+ 
+@@ -887,6 +894,7 @@ static const struct net_device_ops ieee8
+ 	.ndo_set_rx_mode	= ieee80211_set_multicast_list,
+ 	.ndo_set_mac_address 	= ieee80211_change_mac,
+ 	.ndo_select_queue	= ieee80211_monitor_select_queue,
++	.ndo_get_stats64	= ieee80211_get_stats64,
+ };
+ 
+ static int ieee80211_netdev_fill_forward_path(struct net_device_path_ctx *ctx,
+@@ -954,6 +962,7 @@ static const struct net_device_ops ieee8
+ 	.ndo_start_xmit		= ieee80211_subif_start_xmit_8023,
+ 	.ndo_set_rx_mode	= ieee80211_set_multicast_list,
+ 	.ndo_set_mac_address	= ieee80211_change_mac,
++	.ndo_get_stats64	= ieee80211_get_stats64,
+ 	.ndo_fill_forward_path	= ieee80211_netdev_fill_forward_path,
+ 	.ndo_setup_tc		= ieee80211_netdev_setup_tc,
+ };

From f7935a17aa63e4a1aeb2a58e62325f0aa7f70c41 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Mon, 30 Sep 2024 21:25:55 -0400
Subject: [PATCH 178/225] docs: Update README for NSS specific info

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 README.md | 184 ++++++++++++++++++++++++++++++++----------------------
 1 file changed, 111 insertions(+), 73 deletions(-)

diff --git a/README.md b/README.md
index 9141b2392df73e..8bd2ae7d65f7a7 100644
--- a/README.md
+++ b/README.md
@@ -1,108 +1,146 @@
-![OpenWrt logo](include/logo.png)
+# NSS Fork for IPQ807x
 
-OpenWrt Project is a Linux operating system targeting embedded devices. Instead
-of trying to create a single, static firmware, OpenWrt provides a fully
-writable filesystem with package management. This frees you from the
-application selection and configuration provided by the vendor and allows you
-to customize the device through the use of packages to suit any application.
-For developers, OpenWrt is the framework to build an application without having
-to build a complete firmware around it; for users this means the ability for
-full customization, to use the device in ways never envisioned.
+## Table of Contents
+- [Overview](#overview)
+- [What's NSS?](#whats-nss)
+- [How Does OpenWrt "Offload" Traffic?](#how-does-openwrt-offload-traffic)
+- [How Is NSS Different from OpenWrt's Offloading Options?](#how-is-nss-different-from-openwrts-offloading-options)
+- [Do I Need NSS?](#do-i-need-nss)
+- [OK, I Want NSS. Does My Device Support It?](#ok-i-want-nss-does-my-device-support-it)
+- [Quickstart](#quickstart)
+- [Important Note](#important-note)
 
-Sunshine!
+---
 
-## Download
+## Overview
+This repository contains a fork of OpenWrt that integrates Qualcomm's NSS (Network Subsystem) support for the IPQ807x and IPQ6018 series of SoCs. The goal of this project is to provide enhanced network performance and reliability through hardware offloading, leveraging NSS's capabilities to improve throughput and reduce CPU load.
 
-Built firmware images are available for many architectures and come with a
-package selection to be used as WiFi home router. To quickly find a factory
-image usable to migrate from a vendor stock firmware to OpenWrt, try the
-*Firmware Selector*.
+---
+#### What's NSS?
 
-* [OpenWrt Firmware Selector](https://firmware-selector.openwrt.org/)
+NSS (**N**etwork **S**ub**s**ystem) is a specialized hardware offloading engine developed by Qualcomm, integrated into their IPQ series SoCs (System-on-Chip), such as the IPQ807x and IPQ6018. NSS is designed to handle high-throughput network tasks like NAT, routing, and even security tasks such as IPsec, without burdening the main CPU cores.
 
-If your device is supported, please follow the **Info** link to see install
-instructions or consult the support resources listed below.
+---
+#### How Does OpenWrt "Offload" Traffic?
 
-## 
+OpenWrt offers three primary methods for offloading network traffic, each aimed at reducing CPU load and improving throughput:
 
-An advanced user may require additional or specific package. (Toolchain, SDK, ...) For everything else than simple firmware download, try the wiki download page:
+1. **Packet Steering**: Distributes network processing across multiple CPU cores. It helps balance the load on multi-core CPUs but still relies on the CPU to handle packet processing.
 
-* [OpenWrt Wiki Download](https://openwrt.org/downloads)
+2. **Software Flow Offloading**: Accelerates traffic processing by using the CPU’s fast path, allowing more efficient handling of routing and NAT (Network Address Translation) by bypassing the kernel's normal slow path. This relies entirely on the CPU to speed up packet forwarding.
 
-## Development
+3. **Hardware Flow Offloading**: Available only on select devices (e.g., Mediatek), this method offloads packet forwarding directly to the network hardware using kernel-based mechanisms (nftables/iptables) to accelerate traffic. However, this is limited to devices that have hardware acceleration capabilities supported by OpenWrt.
 
-To build your own firmware you need a GNU/Linux, BSD or macOS system (case
-sensitive filesystem required). Cygwin is unsupported because of the lack of a
-case sensitive file system.
+---
+#### Why Isn't NSS Supported in Vanilla OpenWrt?
 
-### Requirements
+NSS requires proprietary binaries (NSS firmware) and extensive patches to the Linux kernel and networking stack. Qualcomm does not openly release the necessary firmware or detailed documentation on how to integrate NSS support, making it extremely difficult for the OpenWrt community to maintain. The required patches are invasive and complex, altering significant portions of the network stack, which makes upstream integration into OpenWrt unlikely. Maintaining compatibility with each new kernel version is another barrier, as Qualcomm’s support for these patches is minimal and sporadic.
 
-You need the following tools to compile OpenWrt, the package names vary between
-distributions. A complete list with distribution specific packages is found in
-the [Build System Setup](https://openwrt.org/docs/guide-developer/build-system/install-buildsystem)
-documentation.
+---
 
-```
-binutils bzip2 diff find flex gawk gcc-6+ getopt grep install libc-dev libz-dev
-make4.1+ perl python3.7+ rsync subversion unzip which
-```
+#### How Is NSS Different from OpenWrt's Offloading Options?
 
-### Quickstart
+The main difference between NSS and OpenWrt's offloading methods is that NSS provides **hardware acceleration** directly within the SoC, bypassing the CPU almost entirely for certain network tasks. OpenWrt's offloading, on the other hand, relies heavily on the **CPU** to manage and accelerate traffic, either via multi-core CPU distribution (Packet Steering) or kernel-level acceleration (Software/Hardware Flow Offloading).
 
-1. Run `./scripts/feeds update -a` to obtain all the latest package definitions
-   defined in feeds.conf / feeds.conf.default
+NSS doesn’t play nice with OpenWrt’s built-in offloading because they conflict in how they handle packets, leading to performance issues or even outright failures.
 
-2. Run `./scripts/feeds install -a` to install symlinks for all obtained
-   packages into package/feeds/
+---
 
-3. Run `make menuconfig` to select your preferred configuration for the
-   toolchain, target system & firmware packages.
+#### Key Differences:
 
-4. Run `make` to build your firmware. This will download all sources, build the
-   cross-compile toolchain and then cross-compile the GNU/Linux kernel & all chosen
-   applications for your target system.
+- **Packet Steering**: While it redistributes packet processing across multiple CPU cores, it still involves the CPU heavily. With NSS, dedicated hardware cores handle packet processing, so packet steering can interfere by unnecessarily involving the CPU, reducing the benefits of offloading to hardware.
 
-### Related Repositories
+- **Software Flow Offloading**: This uses kernel-level mechanisms (nftables/iptables) to accelerate packet forwarding by utilizing the CPU’s fast path. NSS, however, bypasses the kernel’s networking stack and offloads these tasks directly to the hardware. If both are enabled, packet handling may be done redundantly in software and hardware, leading to inefficiencies or conflicts.
 
-The main repository uses multiple sub-repositories to manage packages of
-different categories. All packages are installed via the OpenWrt package
-manager called `opkg`. If you're looking to develop the web interface or port
-packages to OpenWrt, please find the fitting repository below.
+- **Hardware Flow Offloading**: Available only for certain devices like Mediatek, this method offloads packet processing to specific hardware via kernel drivers. However, this hardware-based acceleration is entirely separate from NSS and not as efficient on Qualcomm devices. Using it alongside NSS can lead to unpredictable behavior, as both try to accelerate traffic but in incompatible ways.
 
-* [LuCI Web Interface](https://github.com/openwrt/luci): Modern and modular
-  interface to control the device via a web browser.
+---
 
-* [OpenWrt Packages](https://github.com/openwrt/packages): Community repository
-  of ported packages.
+#### Do I Need NSS?
 
-* [OpenWrt Routing](https://github.com/openwrt/routing): Packages specifically
-  focused on (mesh) routing.
+Here are some reasons you might need NSS:
 
-* [OpenWrt Video](https://github.com/openwrt/video): Packages specifically
-  focused on display servers and clients (Xorg and Wayland).
+- You require high network throughput (e.g., gigabit speeds) on devices like the IPQ807x or IPQ6018 series.
+- Your router handles resource-intensive tasks like NAT, VPN (IPsec), or other routing-heavy activities that would otherwise overwhelm the CPU.
+- You’re seeking better performance than what OpenWrt’s software and hardware offloading options can provide.
 
-## Support Information
+However, it’s important to note that **NSS is NOT supported upstream** in OpenWrt. As of now, there are only a few community-driven projects that maintain NSS patches.
 
-For a list of supported devices see the [OpenWrt Hardware Database](https://openwrt.org/supported_devices)
+I personally maintain an NSS fork of OpenWrt [qosmio/openwrt-ipq](https://github.com/qosmio/openwrt-ipq) and the necessary NSS packages [qosmio/nss-packages](https://github.com/qosmio/nss-packages).
 
-### Documentation
+---
 
-* [Quick Start Guide](https://openwrt.org/docs/guide-quick-start/start)
-* [User Guide](https://openwrt.org/docs/guide-user/start)
-* [Developer Documentation](https://openwrt.org/docs/guide-developer/start)
-* [Technical Reference](https://openwrt.org/docs/techref/start)
+#### OK, I Want NSS. Does My Device Support It?
 
-### Support Community
+NSS is available for most Qualcomm IPQ807x and IPQ6018 devices. If your device is part of this chipset family and supported in OpenWrt, it can run NSS.
 
-* [Forum](https://forum.openwrt.org): For usage, projects, discussions and hardware advise.
-* [Support Chat](https://webchat.oftc.net/#openwrt): Channel `#openwrt` on **oftc.net**.
+Supported devices include, but are not limited to:
+- Devices based on the **IPQ807x** (e.g., some high-end Netgear and TP-Link routers)
+- Devices based on the **IPQ6018** (e.g., certain enterprise routers)
 
-### Developer Community
+---
 
-* [Bug Reports](https://bugs.openwrt.org): Report bugs in OpenWrt
-* [Dev Mailing List](https://lists.openwrt.org/mailman/listinfo/openwrt-devel): Send patches
-* [Dev Chat](https://webchat.oftc.net/#openwrt-devel): Channel `#openwrt-devel` on **oftc.net**.
+## Quickstart
 
-## License
+1. Clone this repository:
+   ```bash
+   git clone https://github.com/qosmio/openwrt-ipq -b qualcommax-6.x-nss-wifi-6.11
+   cd openwrt-ipq
+   ```
+2. Update feeds:
+   ```bash
+   ./scripts/feeds update
+   ./scripts/feeds install -a
+   ```
+3. Copy over the seed file
+   ```bash
+   cp nss-setup/config-nss.seed .config
+   ```
+4. Open the `.config` in a text editor, find your device, and remove the "#" and change `"is not set"` to `"=y"`
 
-OpenWrt is licensed under GPL-2.0
+   Example:
+   ```diff
+   -# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_dynalink_dl-wrx36 is not set
+   +CONFIG_TARGET_qualcommax_ipq807x_DEVICE_dynalink_dl-wrx36=y
+   ```
+6. Generate the full config
+   ```bash
+   make defconfig V=s
+   ```
+7. Now run full build
+   ```bash
+   make download -j$(nproc) V=s
+   make -j$(nproc) V=s
+   ```
+---
+### Important Note:
+
+Many users report issues after enabling Packet Steering or Flow Offloading (Software or Hardware), often because they are used to these options or they get carried over during a sysupgrade. Even if the setup seems to work initially, it is not optimized for NSS offloading, and you are losing the full benefits of hardware acceleration.
+
+If you plan to use NSS, **start fresh** and **disable all other offloading options**.
+
+By default OpenWrt's offloading is disabled, but if you ever happen to enable it accidentally, make sure you disable it.
+
+---
+   ```bash
+   uci set network.@device[0].packet_steering=0
+   uci set network.@device[0].flow_offloading=0
+   uci set network.@device[0].flow_offloading_hw=0
+   uci commit network
+   ```
+If you have questions or issues, please join the discussion on OpenWrt's forums.
+[Qualcomm NSS Build](https://forum.openwrt.org/t/qualcommax-nss-build)
+
+## Please remember when posting about an issue:
+   1. Include your device make and model.
+   2. Relevant logs and screenshots.
+   3. State clearly and concisely the issue you're having.
+      > "My router doesn't work", "I'm getting an error"
+
+      Is not something I can help with.
+   4. Include the specific commit you're building from.
+      > "I'm building from latest"
+
+      Also not helpful as I'm always pushing changes...
+
+   5. Be respectful and mindful. I dedicate my free time to maintain and improve this project, and I do it for the benefit of the community. Remember that I'm not a full-time developer or support team—I'm just an individual sharing my work. Constructive feedback is always welcome, but please refrain from being overly critical or demanding.

From b2ce31d9aef13bf1980deb702d55b27a66001340 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 10 Aug 2024 03:37:18 -0400
Subject: [PATCH 179/225] nss-setup: Add example NSS configs/scripts

Included starter config seed NSS offloading for MX4300. Although it can
be used by any compatible ipq807x NSS setup.

There is also an example 'uci-defaults' script that you can use to build
a single image for multiple nodes.

Although the script includes options to set low/high band for mesh backhaul.
Only the high-band works for offloading.

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 nss-setup/config-nss.seed          | 136 ++++++++++
 nss-setup/example/01-mesh-node     | 109 ++++++++
 nss-setup/example/02-mesh-sat-node | 109 ++++++++
 nss-setup/example/03-uci-defaults  | 403 +++++++++++++++++++++++++++++
 4 files changed, 757 insertions(+)
 create mode 100644 nss-setup/config-nss.seed
 create mode 100644 nss-setup/example/01-mesh-node
 create mode 100644 nss-setup/example/02-mesh-sat-node
 create mode 100644 nss-setup/example/03-uci-defaults

diff --git a/nss-setup/config-nss.seed b/nss-setup/config-nss.seed
new file mode 100644
index 00000000000000..919793ef1eab73
--- /dev/null
+++ b/nss-setup/config-nss.seed
@@ -0,0 +1,136 @@
+# copy to `.config` and run `make defconfig`
+# This builds for all ipq807x targets. 
+# To use this config, you must build from https://github.com/qosmio/openwrt-ipq
+
+# 1. copy this config to root of build folder name it ".config"
+# 2. run `make defconfig`
+#
+# use `make menuconfig` to further customize building just for your target or adding custom packages.
+# Target platform
+CONFIG_TARGET_qualcommax=y
+CONFIG_TARGET_qualcommax_ipq807x=y
+
+# Uncomment target device you want to build for, set '=y'
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_arcadyan_aw1000 is not set
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_asus_rt-ax89x is not set
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_buffalo_wxr-5950ax12 is not set
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_cmcc_rm2-6 is not set
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_compex_wpq873 is not set
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_dynalink_dl-wrx36 is not set
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_edgecore_eap102 is not set
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_edimax_cax1800 is not set
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_linksys_mx4200v1 is not set
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_linksys_mx4200v2 is not set
+CONFIG_TARGET_qualcommax_ipq807x_DEVICE_linksys_mx4300=y
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_linksys_mx5300 is not set
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_linksys_mx8500 is not set
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_netgear_rax120v2 is not set
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_netgear_sxr80 is not set
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_netgear_sxs80 is not set
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_netgear_wax218 is not set
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_netgear_wax620 is not set
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_netgear_wax630 is not set
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_prpl_haze is not set
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_qnap_301w is not set
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_redmi_ax6 is not set
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_spectrum_sax1v1k is not set
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_xiaomi_ax3600 is not set
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_xiaomi_ax9000 is not set
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_yuncore_ax880 is not set
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_zbtlink_zbt-z800ax is not set
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_zte_mf269 is not set
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_zyxel_nbg7815 is not set
+
+# NSS Offloading
+CONFIG_ATH11K_NSS_SUPPORT=y
+CONFIG_ATH11K_NSS_MESH_SUPPORT=y
+CONFIG_PACKAGE_MAC80211_NSS_SUPPORT=y
+
+# Additional NSS packages (VLAN, Multicast Snooping, etc)
+CONFIG_PACKAGE_kmod-qca-nss-drv-vlan-mgr=y
+CONFIG_PACKAGE_kmod-qca-mcs=y
+
+# NSS SQM Traffic Shaping
+CONFIG_PACKAGE_sqm-scripts=y
+CONFIG_PACKAGE_sqm-scripts-nss=y
+
+# Compiler Optimization
+CONFIG_BUILD_PATENTED=y
+CONFIG_CCACHE=y
+CONFIG_DEVEL=y
+CONFIG_EXPERIMENTAL=y
+CONFIG_TOOLCHAINOPTS=y
+CONFIG_TARGET_OPTIONS=y
+CONFIG_TARGET_OPTIMIZATION="-O3 -pipe -mcpu=cortex-a53+crc+crypto"
+CONFIG_TARGET_INIT_PATH="/usr/sbin:/usr/bin:/sbin:/bin:/opt/usr/bin:/opt/bin:/opt/sbin:/opt/usr/sbin"
+CONFIG_USE_GC_SECTIONS=y
+
+# Kernel Config
+CONFIG_COLLECT_KERNEL_DEBUG=y
+CONFIG_KERNEL_PERF_EVENTS=y
+CONFIG_KERNEL_DYNAMIC_DEBUG=y
+CONFIG_KERNEL_ARM_PMU=y
+CONFIG_KERNEL_ARM_PMUV3=y
+CONFIG_KERNEL_PREEMPT_NONE=y
+CONFIG_KERNEL_PREEMPT_NONE_BUILD=y
+
+# SSL Configuration
+CONFIG_PACKAGE_libustream-openssl=y
+CONFIG_PACKAGE_libustream-mbedtls=n
+CONFIG_PACKAGE_libopenssl=y
+CONFIG_LUA_ECO_OPENSSL=y
+CONFIG_LUA_ECO_MBEDTLS=n
+CONFIG_OPENSSL_OPTIMIZE_SPEED=y
+
+# LUCI Config
+CONFIG_PACKAGE_luci=y
+CONFIG_PACKAGE_luci-ssl-openssl=y
+CONFIG_PACKAGE_wpad-mesh-openssl=y
+CONFIG_PACKAGE_wpad-basic-mbedtls=n
+
+# LUCI Applications
+CONFIG_PACKAGE_luci-app-firewall=y
+CONFIG_PACKAGE_luci-app-opkg=y
+CONFIG_PACKAGE_luci-app-sqm=y
+CONFIG_PACKAGE_luci-app-statistics=y
+CONFIG_PACKAGE_luci-app-acme=y
+CONFIG_PACKAGE_luci-app-firewall=y
+CONFIG_PACKAGE_luci-app-nlbwmon=y
+CONFIG_PACKAGE_luci-app-opkg=y
+CONFIG_PACKAGE_luci-app-sqm=y
+CONFIG_PACKAGE_luci-app-statistics=y
+CONFIG_PACKAGE_luci-app-watchcat=y
+CONFIG_PACKAGE_luci-proto-wireguard=y
+
+# Library Optimization
+CONFIG_ZLIB_OPTIMIZE_SPEED=y
+CONFIG_ZSTD_OPTIMIZE_O3=y
+
+# Reduce kernel module size
+CONFIG_ATH11K_DEBUGFS_HTT_STATS=n
+CONFIG_ATH11K_DEBUGFS_STA=n
+CONFIG_ATH11K_THERMAL=n
+
+# Additional kernel modules
+CONFIG_PACKAGE_kmod-fs-vfat=y
+CONFIG_PACKAGE_kmod-fs-f2fs=y
+CONFIG_PACKAGE_kmod-fs-ntfs3=y
+CONFIG_PACKAGE_kmod-nft-bridge=y
+CONFIG_PACKAGE_kmod-usb-storage=y
+CONFIG_PACKAGE_kmod-ramoops=y
+
+# Additional packages
+CONFIG_PACKAGE_iperf3=y
+CONFIG_PACKAGE_htop=y
+CONFIG_PACKAGE_curl=y
+CONFIG_PACKAGE_rsync=y
+CONFIG_PACKAGE_jq=y
+CONFIG_PACKAGE_pigz=y
+CONFIG_PACKAGE_tar=y
+CONFIG_PACKAGE_tcpdump=y
+
+CONFIG_HTOP_LMSENSORS=n
+
+# Prevent opkg from adding custom feeds to /etc/opkg/distfeeds.conf
+CONFIG_FEED_nss=n
+CONFIG_FEED_sqm_scripts_nss=n
diff --git a/nss-setup/example/01-mesh-node b/nss-setup/example/01-mesh-node
new file mode 100644
index 00000000000000..f13c2e9a073722
--- /dev/null
+++ b/nss-setup/example/01-mesh-node
@@ -0,0 +1,109 @@
+
+config wifi-device 'radio0'
+	option type 'mac80211'
+	option path 'platform/soc@0/c000000.wifi'
+	option band '5g'
+	option txpower '21'
+	option country 'US'
+	option htmode 'HE80'
+	option channel '64'
+	option cell_density '0'
+	option noscan '1'
+
+config wifi-device 'radio1'
+	option type 'mac80211'
+	option path 'platform/soc@0/c000000.wifi+1'
+	option band '2g'
+	option txpower '24'
+	option country 'US'
+	option htmode 'HE20'
+	option channel '1'
+	option cell_density '0'
+
+config wifi-device 'radio2'
+	option type 'mac80211'
+	option path 'platform/soc@0/c000000.wifi+2'
+	option band '5g'
+	option txpower '30'
+	option country 'US'
+	option htmode 'HE80'
+	option channel '161'
+	option cell_density '3'
+	option noscan '1'
+
+config wifi-iface '5g'
+	option device 'radio1'
+	option mode 'ap'
+	option network 'lan'
+	option ssid 'MX4300'
+	option encryption 'psk2+ccmp'
+	option key 'xxxxxxxxxxxxx'
+	option beacon_int '97'
+	option bss_transition '1'
+	option disassoc_low_ack '0'
+	option dtim_period '3'
+	option ft_over_ds '0'
+	option ft_psk_generate_local '1'
+	option ieee80211r '1'
+	option ieee80211k '1'
+	option proxy_arp '1'
+	option reassociation_deadline '20000'
+	option skip_inactivity_poll '1'
+	option time_advertisement '2'
+	option time_zone 'GMT0'
+	option wnm_sleep_mode '1'
+	option wpa_group_rekey '86400'
+	option pmk_r1_push '1'
+	option macaddr '80:69:1A:22:FF:BA'
+
+config wifi-iface '2g'
+	option device 'radio1'
+	option mode 'ap'
+	option network 'lan'
+	option ssid 'MX4300'
+	option encryption 'psk2+ccmp'
+	option key 'xxxxxxxxxxxxx'
+	option bss_transition '1'
+	option beacon_int '100'
+	option disassoc_low_ack '0'
+	option dtim_period '3'
+	option ft_over_ds '0'
+	option ft_psk_generate_local '1'
+	option ieee80211r '1'
+	option ieee80211k '1'
+	option proxy_arp '1'
+	option reassociation_deadline '20000'
+	option skip_inactivity_poll '1'
+	option time_advertisement '2'
+	option time_zone 'GMT0'
+	option wnm_sleep_mode '1'
+	option wpa_group_rekey '86400'
+	option max_inactivity '4260'
+	option pmk_r1_push '1'
+	option macaddr '80:69:1A:22:FF:BB'
+
+config wifi-iface 'mesh'
+	option device 'radio2'
+	option encryption 'sae'
+	option key '4b22dd0c95846d36a8760ec90b703601c60f31ce4c8db1d9ade683cd3a2c2326'
+	option mesh_id 'MX4300-MESH'
+	option mode 'mesh'
+	option network 'lan'
+	option mesh_fwding '1'
+	option mesh_gate_announcements '1'
+	option mesh_hwmp_rootmode '2'
+	option mesh_max_peer_links '16'
+	option mesh_rssi_threshold '-65'
+	option disabled '0'
+	option macaddr '80:69:1A:22:AA:BC'
+
+config wifi-iface 'wds'
+	option device 'radio2'
+	option mode 'sta'
+	option network 'lan'
+	option ssid 'MX4300-WDS'
+	option encryption 'psk2+ccmp'
+	option key '4b22dd0c95846d36a8760ec90b703601c60f31ce4c8db1d9ade683cd3a2c2326'
+	option wds '1'
+	option disabled '1'
+	option macaddr '80:69:1A:22:AA:BC'
diff --git a/nss-setup/example/02-mesh-sat-node b/nss-setup/example/02-mesh-sat-node
new file mode 100644
index 00000000000000..7eef194be44a04
--- /dev/null
+++ b/nss-setup/example/02-mesh-sat-node
@@ -0,0 +1,109 @@
+
+config wifi-device 'radio0'
+	option type 'mac80211'
+	option path 'platform/soc@0/c000000.wifi'
+	option band '5g'
+	option txpower '21'
+	option country 'US'
+	option htmode 'HE80'
+	option channel '64'
+	option cell_density '0'
+	option noscan '1'
+
+config wifi-device 'radio1'
+	option type 'mac80211'
+	option path 'platform/soc@0/c000000.wifi+1'
+	option band '2g'
+	option txpower '24'
+	option country 'US'
+	option htmode 'HE20'
+	option channel '1'
+	option cell_density '0'
+
+config wifi-device 'radio2'
+	option type 'mac80211'
+	option path 'platform/soc@0/c000000.wifi+2'
+	option band '5g'
+	option txpower '30'
+	option country 'US'
+	option htmode 'HE80'
+	option channel '161'
+	option cell_density '3'
+	option noscan '1'
+
+config wifi-iface '5g'
+	option device 'radio1'
+	option mode 'ap'
+	option network 'lan'
+	option ssid 'MX4300'
+	option encryption 'psk2+ccmp'
+	option key 'xxxxxxxxxxxxx'
+	option beacon_int '97'
+	option bss_transition '1'
+	option disassoc_low_ack '0'
+	option dtim_period '3'
+	option ft_over_ds '0'
+	option ft_psk_generate_local '1'
+	option ieee80211r '1'
+	option ieee80211k '1'
+	option proxy_arp '1'
+	option reassociation_deadline '20000'
+	option skip_inactivity_poll '1'
+	option time_advertisement '2'
+	option time_zone 'GMT0'
+	option wnm_sleep_mode '1'
+	option wpa_group_rekey '86400'
+	option pmk_r1_push '1'
+	option macaddr '80:69:1A:22:FF:FF'
+
+config wifi-iface '2g'
+	option device 'radio1'
+	option mode 'ap'
+	option network 'lan'
+	option ssid 'MX4300'
+	option encryption 'psk2+ccmp'
+	option key 'xxxxxxxxxxxxx'
+	option bss_transition '1'
+	option beacon_int '100'
+	option disassoc_low_ack '0'
+	option dtim_period '3'
+	option ft_over_ds '0'
+	option ft_psk_generate_local '1'
+	option ieee80211r '1'
+	option ieee80211k '1'
+	option proxy_arp '1'
+	option reassociation_deadline '20000'
+	option skip_inactivity_poll '1'
+	option time_advertisement '2'
+	option time_zone 'GMT0'
+	option wnm_sleep_mode '1'
+	option wpa_group_rekey '86400'
+	option max_inactivity '4260'
+	option pmk_r1_push '1'
+	option macaddr '80:69:1A:22:FF:FE'
+
+config wifi-iface 'mesh'
+	option device 'radio2'
+	option encryption 'sae'
+	option key '4b22dd0c95846d36a8760ec90b703601c60f31ce4c8db1d9ade683cd3a2c2326'
+	option mesh_id 'MX4300-MESH'
+	option mode 'mesh'
+	option network 'lan'
+	option mesh_fwding '0'
+	option mesh_gate_announcements '0'
+	option mesh_hwmp_rootmode '0'
+	option mesh_max_peer_links '16'
+	option mesh_rssi_threshold '-65'
+	option disabled '0'
+	option macaddr '80:69:1A:22:AA:AA'
+
+config wifi-iface 'wds'
+	option device 'radio2'
+	option mode 'sta'
+	option network 'lan'
+	option ssid 'MX4300-WDS'
+	option encryption 'psk2+ccmp'
+	option key '4b22dd0c95846d36a8760ec90b703601c60f31ce4c8db1d9ade683cd3a2c2326'
+	option wds '1'
+	option disabled '1'
+	option macaddr '80:69:1A:22:AA:AA'
diff --git a/nss-setup/example/03-uci-defaults b/nss-setup/example/03-uci-defaults
new file mode 100644
index 00000000000000..230c8b8c01cd70
--- /dev/null
+++ b/nss-setup/example/03-uci-defaults
@@ -0,0 +1,403 @@
+#!/bin/sh -e
+# shellcheck disable=3037,2091,3010 shell=busybox
+# Custom UCI defaults script for Linksys MX4200/4300/5300 etc
+# Create folder "files/etc/uci-defaults/" in your buildroot and copy this script there.
+# Customize to your needs.
+
+# Uncomment the following line to capture all output to a log file
+# exec > /root/uci-defaults.log 2>&1
+
+mac=$(fw_printenv -n ethaddr | tr '[:upper:]' '[:lower:]')
+
+# Set to '0' to enable WDS and disable mesh
+wds_disable=1
+bridge_mode=true
+
+channel_2g=6
+
+ap_5g_radio="radio0"
+ap_2g_radio="radio1"
+mesh_radio="radio2"
+wds_radio="${mesh_radio}"
+
+mesh_channel="161"
+ap_5g_channel="64"
+
+# Unique UCI config names for each interface
+ap_5g_iface="ap_5g"
+ap_2g_iface="ap_2g"
+mesh_iface="mesh"
+wds_iface="wds"
+
+# Must be the same SSID for both 2G and 5G for 802.11 k/v/r
+ap_2g_ssid="OpenWrt"
+ap_5g_ssid="${ap_2g_ssid}"
+
+mesh_id="OpenWrt-Mesh"
+wds_ssid="OpenWrt-WDS"
+
+mesh_gate_key='SOME_KEY'
+ap_key='SOME_KEY'
+wds_key="${mesh_gate_key}"
+
+country="US"
+timezone="EST5EDT,M3.2.0,M11.1.0"
+zonename="America/New_York"
+
+# In case you want to reset firmware in future, but want to use different mesh band
+# use `fw_setenv mesh_band low_5g` to use "radio0" (low 5G band) (36-64)
+# use `fw_setenv mesh_band high_5g` to use "radio2" (high 5G band) (100-165)
+# This will then be used to set the channel for the mesh interface.
+# Default is high_5g (radio2) (channel 161)
+mesh_band="$(fw_printenv -n mesh_band 2> /dev/null)"
+mesh_band="${mesh_band:-high_5g}"
+mesh_rssi_threshold='-65'
+
+if [ "$mesh_band" = "low_5g" ]; then
+  mesh_radio="radio0"
+  mesh_channel="64"
+  ap_5g_radio="radio2"
+  ap_5g_channel="100"
+fi
+
+# Setup satellite nodes to simply extend wifi coverage from the main router.
+# This avoids "daisy chaining" traffic through multiple nodes.
+# This usecase covers 99% for typical home setups.
+mesh_gate_announcements='0'
+mesh_hwmp_rootmode='0'
+mesh_fwding='0'
+
+stp_priority=8192
+
+# Only version version 11.4.0.5 has mesh offload support, so disable and use WDS instead
+if ! grep -q NSS.HK.11.4.0.5 /lib/firmware/qca-nss0-retail.bin 2> /dev/null; then
+  wds_disable=0
+fi
+
+# For Linksys MX4200/4300/5300 etc, only need to match the first 5 bytes
+# replace 'xx:xx' with the one found on the bottom of the device
+if [[ "${mac}" =~ "80:69:1a:xx:xx" ]]; then
+  suffix=0
+  wds_mode=ap
+  # Not required as it will generate based on device mac.
+  # But recommended to set static mac address after the
+  # device is up and running.
+  ap_5g_channel="64"
+  # If the node is connected to a router via cable, or itself is acting as a router.
+  mesh_gate_announcements='1'
+  mesh_hwmp_rootmode='2'
+  mesh_fwding='1'
+elif [[ "${mac}" =~ "80:69:1a:22:xx" ]]; then
+  suffix=1
+  wds_mode=sta
+  channel_2g=1
+  if [ "$mesh_band" = "low_5g" ]; then
+    ap_5g_channel="144"
+  fi
+fi
+
+hostname="MX4300-$((suffix + 1))"
+router=192.168.1.1
+netmask=24
+ipaddr="192.168.1.$((suffix + 1))"
+ip6addr="fd00:cafe:cafe::$((suffix + 1))"
+
+[ -n "$hostname" ] && {
+  uci batch <<- EOF > /dev/null
+	del system.@system[0]
+	add system system
+	set system.@system[0]=system
+	set system.@system[0].hostname='${hostname}'
+	set system.@system[0].timezone='${timezone}'
+	set system.@system[0].ttylogin='0'
+	set system.@system[0].log_size='128'
+	set system.@system[0].urandom_seed='1'
+	set system.@system[0].zonename='${zonename}'
+	set system.@system[0].cronloglevel='9'
+	set system.@system[0].conloglevel='6'
+	del system.ntp
+	set system.ntp=timeserver
+	set system.ntp.enable_server='1'
+	set system.ntp.interface='lan'
+	add_list system.ntp.server='${router}'
+	add_list system.ntp.server='129.6.15.28'
+	add_list system.ntp.server='129.6.15.29'
+	add_list system.ntp.server='129.6.15.30'
+	add_list system.ntp.server='2610:20:6f15:15::27'
+	add_list system.ntp.server='2610:20:6f15:15::28'
+	add_list system.ntp.server='129.6.15.27'
+	add_list system.ntp.server='129.6.15.26'
+EOF
+}
+
+# satellite nodes should not have any DHCP/DNS services running.
+# Nor should they have any firewall/dnsmasq rules.
+
+${bridge_mode} && {
+
+  # Disable services services in case we are running as dumb ap
+  for prog in firewall sqm unbound adblock-fast banip; do
+    CMD=/etc/init.d/${prog}
+    if [ -r ${CMD} ]; then
+      ${CMD} disable
+    fi
+  done
+
+  [ -r /etc/hotplug.d/ntp/25-unbound ] && rm /etc/hotplug.d/ntp/25-unbound
+
+  uci import <<- EOF > /dev/null
+
+package dhcp
+
+config dnsmasq
+	option boguspriv '0'
+	option rebind_protection '0'
+	option domain 'lan'
+	option expandhosts '1'
+	option readethers '1'
+	option leasefile '/tmp/dhcp.leases'
+	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
+	option localservice '0'
+	option ednspacket_max '1232'
+
+config dhcp 'lan'
+	option interface 'lan'
+	option dhcpv4 'disabled'
+	option dhcpv6 'disabled'
+	option ignore '1'
+	option dynamicdhcp '0'
+
+config odhcpd 'odhcpd'
+	option maindhcp '0'
+	option leasefile '/tmp/hosts/odhcpd'
+	option leasetrigger '/usr/sbin/odhcpd-update'
+	option loglevel '4'
+
+EOF
+
+  uci import <<- EOF > /dev/null
+package network
+
+config globals 'globals'
+
+config interface 'loopback'
+	option device 'lo'
+	option proto 'static'
+	option ipaddr '127.0.0.1'
+	option netmask '255.0.0.0'
+
+config device
+	option name 'br-lan'
+	option type 'bridge'
+	list ports 'lan1'
+	list ports 'lan2'
+	list ports 'lan3'
+	option macaddr '${mac}'
+	option stp '1'
+	option igmp_snooping '1'
+	option arp_accept '1'
+	option priority '$((stp_priority + suffix))'
+
+config interface 'lan'
+	option device 'br-lan'
+	option proto 'static'
+	list ipaddr '${ipaddr}/${netmask:-24}'
+	list ip6addr '${ip6addr}'
+	list dns '${router}'
+	option gateway '${router}'
+	option delegate '0'
+
+config interface 'lan6'
+	option device '@lan'
+	option proto 'dhcpv6'
+	option reqaddress 'try'
+	option reqprefix 'no'
+	option delegate '0'
+
+config device
+	option name 'lan1'
+	option macaddr '${mac}'
+
+config device
+	option name 'lan2'
+	option macaddr '${mac}'
+
+config device
+	option name 'lan3'
+	option macaddr '${mac}'
+EOF
+}
+
+# If not in bridge mode, then assume setting up as a router
+${bridge_mode} || {
+  uci batch <<- EOF > /dev/null
+	set network.lan.proto='static'
+	set network.lan.ipaddr=''${ipaddr}/${netmask:-24}''
+EOF
+}
+
+uci import <<- EOF
+package wireless
+
+config wifi-device 'radio0'
+	option type 'mac80211'
+	option path 'platform/soc@0/c000000.wifi'
+	option band '5g'
+	option txpower '21'
+	option country '${country:-US}'
+	option htmode 'HE80'
+	option channel '64'
+	option cell_density '0'
+	option noscan '1'
+
+config wifi-device 'radio1'
+	option type 'mac80211'
+	option path 'platform/soc@0/c000000.wifi+1'
+	option band '2g'
+	option txpower '24'
+	option country '${country:-US}'
+	option htmode 'HE20'
+	option channel '${channel_2g:-6}'
+	option cell_density '0'
+
+config wifi-device 'radio2'
+	option type 'mac80211'
+	option path 'platform/soc@0/c000000.wifi+2'
+	option band '5g'
+	option txpower '30'
+	option country '${country:-US}'
+	option htmode 'HE80'
+	option channel '161'
+	option cell_density '3'
+	option noscan '1'
+
+config wifi-iface '${ap_5g_iface}'
+	option device '${ap_5g_radio}'
+	option mode 'ap'
+	option network 'lan'
+	option ssid '${ap_5g_ssid}'
+	option encryption 'psk2+ccmp'
+	option key '${ap_key}'
+	option beacon_int '97'
+	option bss_transition '1'
+	option disassoc_low_ack '0'
+	option dtim_period '3'
+	option ft_over_ds '0'
+	option ft_psk_generate_local '1'
+	option ieee80211r '1'
+	option ieee80211k '1'
+	option proxy_arp '1'
+	option reassociation_deadline '20000'
+	option time_advertisement '2'
+	option time_zone 'GMT0'
+	option wnm_sleep_mode '1'
+	option wpa_group_rekey '86400'
+	option pmk_r1_push '1'
+
+config wifi-iface '${ap_2g_iface}'
+	option device '${ap_2g_radio}'
+	option mode 'ap'
+	option network 'lan'
+	option ssid '${ap_2g_ssid}'
+	option encryption 'psk2+ccmp'
+	option key '${ap_key}'
+	option bss_transition '1'
+	option beacon_int '100'
+	option disassoc_low_ack '0'
+	option dtim_period '3'
+	option ft_over_ds '0'
+	option ft_psk_generate_local '1'
+	option ieee80211r '1'
+	option ieee80211k '1'
+	option proxy_arp '1'
+	option reassociation_deadline '20000'
+	option time_advertisement '2'
+	option time_zone 'GMT0'
+	option wnm_sleep_mode '1'
+	option wpa_group_rekey '86400'
+	option max_inactivity '4260'
+	option pmk_r1_push '1'
+
+config wifi-iface '${mesh_iface}'
+	option device '${mesh_radio}'
+	option encryption 'sae'
+	option key '${mesh_gate_key}'
+	option mesh_id '${mesh_id}'
+	option mode 'mesh'
+	option network 'lan'
+	option mesh_fwding '${mesh_fwding:-0}'
+	option mesh_gate_announcements '${mesh_gate_announcements:-0}'
+	option mesh_hwmp_rootmode '${mesh_hwmp_rootmode:-0}'
+	option mesh_max_peer_links '16'
+	option mesh_rssi_threshold '${mesh_rssi_threshold}'
+	option disabled $([ ${wds_disable:-1} -eq 1 ] && echo '0' || echo '1')
+
+config wifi-iface '${wds_iface}'
+	option device '${wds_radio}'
+	option mode '${wds_mode:-ap}'
+	option network 'lan'
+	option ssid '${wds_ssid}'
+	option encryption 'psk2+ccmp'
+	option key '${wds_key}'
+	option wds '1'
+	option disabled '${wds_disable:-1}'
+	$([ "${wds_mode:-ap}" = "ap" ] && echo "option hidden '1'")
+EOF
+
+cat << EOF | uci batch
+	set wireless.${mesh_radio}.channel=''${mesh_channel}''
+	set wireless.${ap_5g_radio}.channel=''${ap_5g_channel}''
+
+	set wireless.${mesh_radio}.cell_density='3'
+	set wireless.${ap_5g_radio}.cell_density='0'
+
+	set wireless.${mesh_iface}.device=''${mesh_radio}''
+	set wireless.${wds_iface}.device=''${mesh_radio}''
+	set wireless.${ap_5g_iface}.device=''${ap_5g_radio}''
+EOF
+
+# Set to a less annoying dim green color
+uci import <<- EOF
+package system
+
+config led
+	option name 'Blue Off'
+	option sysfs 'blue:status'
+	option trigger 'none'
+	option default '0'
+
+config led
+	option name 'Red Off'
+	option sysfs 'red:status'
+	option trigger 'none'
+	option default '0'
+EOF
+
+# Sometimes nodes may not be able to reach the gateway for whatever reason
+# Since they will be connected via wifi it's cumbersome having to hardwire just to troubleshoot
+# Install the `watchcat` package to automatically reboot the node if it can't reach the gateway
+uci import <<- EOF > /dev/null
+
+package watchcat
+
+config watchcat
+	option period '5m'
+	option mode 'ping_reboot'
+	option pinghosts '${router}'
+	option addressfamily 'any'
+	option pingperiod '10s'
+	option pingsize 'standard'
+	option forcedelay '1m'
+EOF
+
+uci changes
+
+uci commit system
+uci commit luci_statistics
+uci commit dhcp
+uci commit network
+uci commit wireless
+
+fw_setenv mesh_band "${mesh_band}"
+
+exit 0

From 353758447090a1736bbe8b98c6554faeb9b74132 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sun, 11 Aug 2024 20:31:33 -0400
Subject: [PATCH 180/225] nss-setup: Refactor and add options for setting up
 nodes to use DHCP

* Refactor and clean up script and add more helpful docs.
* If a device's MAC doesn't match or isn't specified the following will
  be configured:
  1.) lan network will use DHCP ("lan_proto=dhcp") to retrieve an IP
  2.) device name will be "mx4300-xxxx", where "xxxx" represents the
      last 4 characters of the device MAC address found on the bottom of
      sticker.
* When in bridge mode, devices can be setup to use static or dhcp for their lan interface.
  This is specified with option "lan_proto=dhcp" under each devices's
  config, or if no suffix is specified, it is assumed the IP needs to be
  optained.
* Add fallback mgmt IP address 10.1.1.1 that can be used in case mesh
  fails to come up and hardwire connection is required. Make sure to set
  a static IP for your computer in the 10.1.1.x subnet in order to
  connect.

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 nss-setup/example/03-uci-defaults | 221 ++++++++++++++++++------------
 1 file changed, 133 insertions(+), 88 deletions(-)

diff --git a/nss-setup/example/03-uci-defaults b/nss-setup/example/03-uci-defaults
index 230c8b8c01cd70..260d5d49ae8a70 100644
--- a/nss-setup/example/03-uci-defaults
+++ b/nss-setup/example/03-uci-defaults
@@ -1,34 +1,39 @@
 #!/bin/sh -e
-# shellcheck disable=3037,2091,3010 shell=busybox
+# shellcheck disable=2034,2091,3010,3037,3060 shell=busybox
 # Custom UCI defaults script for Linksys MX4200/4300/5300 etc
-# Create folder "files/etc/uci-defaults/" in your buildroot and copy this script there.
+# Create folder "files/etc/uci-defaults/" in build root and copy this script there.
 # Customize to your needs.
 
 # Uncomment the following line to capture all output to a log file
 # exec > /root/uci-defaults.log 2>&1
 
+# We will also use this MAC to set br-lan, and lan ports 1,2,3.
+# That is how they are supposed to be but there's an issue on MX4300
+# where the MAC is not set correctly for lan 2 and 3 and randomly changes each boot.
 mac=$(fw_printenv -n ethaddr | tr '[:upper:]' '[:lower:]')
 
 # Set to '0' to enable WDS and disable mesh
 wds_disable=1
 bridge_mode=true
 
-channel_2g=6
-
 ap_5g_radio="radio0"
 ap_2g_radio="radio1"
 mesh_radio="radio2"
 wds_radio="${mesh_radio}"
 
-mesh_channel="161"
-ap_5g_channel="64"
+# for 80mhz channel 161 will use channels 149-161 (leave as is)
+mesh_channel=161
+# for 80mhz channel 64 will use channels 52-64 (change below for specific devices if needed)
+ap_5g_channel=64
+ap_2g_channel=6
 
-# Unique UCI config names for each interface
+# Unique UCI config names for each section
 ap_5g_iface="ap_5g"
 ap_2g_iface="ap_2g"
 mesh_iface="mesh"
 wds_iface="wds"
 
+# You should start customizing from here
 # Must be the same SSID for both 2G and 5G for 802.11 k/v/r
 ap_2g_ssid="OpenWrt"
 ap_5g_ssid="${ap_2g_ssid}"
@@ -36,22 +41,34 @@ ap_5g_ssid="${ap_2g_ssid}"
 mesh_id="OpenWrt-Mesh"
 wds_ssid="OpenWrt-WDS"
 
-mesh_gate_key='SOME_KEY'
-ap_key='SOME_KEY'
+ap_key="SOME_KEY"
+mesh_gate_key="SOME_LONG_RANDOM_KEY"
 wds_key="${mesh_gate_key}"
 
 country="US"
 timezone="EST5EDT,M3.2.0,M11.1.0"
-zonename="America/New_York"
+zonename="America/New York"
+
+router="192.168.1.1"
+netmask=24
+lan_proto="static"
+prefix="mx4300"
+
+# If node is setup to use DHCP and fails to get an IP,
+# a cable connection can be used to login and manage it.
+# You'll need to set a static IP on your computer in the same subnet.
+# (i.e. 10.1.1.2/24) and connect to the fallback management IP.
+fallback_mgmt_ip="10.1.1.1"
 
 # In case you want to reset firmware in future, but want to use different mesh band
 # use `fw_setenv mesh_band low_5g` to use "radio0" (low 5G band) (36-64)
 # use `fw_setenv mesh_band high_5g` to use "radio2" (high 5G band) (100-165)
 # This will then be used to set the channel for the mesh interface.
 # Default is high_5g (radio2) (channel 161)
+# NOTE: ON MX4300 ONLY THE 2ND RADIO WORKS WITH MESH. LEAVE THIS UNCHANGED.
 mesh_band="$(fw_printenv -n mesh_band 2> /dev/null)"
 mesh_band="${mesh_band:-high_5g}"
-mesh_rssi_threshold='-65'
+mesh_rssi_threshold="-65"
 
 if [ "$mesh_band" = "low_5g" ]; then
   mesh_radio="radio0"
@@ -62,10 +79,10 @@ fi
 
 # Setup satellite nodes to simply extend wifi coverage from the main router.
 # This avoids "daisy chaining" traffic through multiple nodes.
-# This usecase covers 99% for typical home setups.
-mesh_gate_announcements='0'
-mesh_hwmp_rootmode='0'
-mesh_fwding='0'
+# This usecase covers 99% of typical home setups.
+mesh_gate_announcements="0"
+mesh_hwmp_rootmode="0"
+mesh_fwding="0"
 
 stp_priority=8192
 
@@ -75,35 +92,55 @@ if ! grep -q NSS.HK.11.4.0.5 /lib/firmware/qca-nss0-retail.bin 2> /dev/null; the
 fi
 
 # For Linksys MX4200/4300/5300 etc, only need to match the first 5 bytes
-# replace 'xx:xx' with the one found on the bottom of the device
+# of the MAC address to determine it's the same device.
+# Replace 'xx:xx' with the one found on the bottom of your device.
+# Add a new `elif` block for each device if needed.
 if [[ "${mac}" =~ "80:69:1a:xx:xx" ]]; then
-  suffix=0
+  suffix=2
+  # If the node is in bridge mode and connected to a router via ethernet, or itself is a router.
+  # set the following for gate announcements, rootmode and forwarding.
+  mesh_gate_announcements=1
+  mesh_hwmp_rootmode=2
+  mesh_fwding=1
+  # Only ONE of the nodes should be in ap mode if setting up WDS.
   wds_mode=ap
-  # Not required as it will generate based on device mac.
-  # But recommended to set static mac address after the
-  # device is up and running.
-  ap_5g_channel="64"
-  # If the node is connected to a router via cable, or itself is acting as a router.
-  mesh_gate_announcements='1'
-  mesh_hwmp_rootmode='2'
-  mesh_fwding='1'
-elif [[ "${mac}" =~ "80:69:1a:22:xx" ]]; then
-  suffix=1
+elif [[ "${mac}" =~ "80:69:1a:xx:xx" ]]; then
+  suffix=3
   wds_mode=sta
-  channel_2g=1
-  if [ "$mesh_band" = "low_5g" ]; then
-    ap_5g_channel="144"
+  # it's a good idea to spread out the channels on the AP
+  # to ensure they don't interfere with each other.
+  # This is especially important if you have multiple APs in close proximity.
+  # For 80mhz channel 48 will use channels 36-48
+  ap_5g_channel=48
+  ap_2g_channel=1
+else
+  lan_proto="dhcp"
+fi
+
+if { [ "$lan_proto" = "dhcp" ] && [ -z "$suffix" ]; } || [ -z "$suffix" ] ; then
+  # get last 2 octets of the MAC address
+  # The final hostname will be "${prefix}-${suffix}", e.g. "mx4300-9efc"
+  # otherwise, the suffix will be you specified above.
+  suffix="${mac#*:*:*:*:}"
+  suffix="${suffix/:/}"
+else
+  # If bridge mode      : true
+  # and router IP is    : 192.168.1.1
+  # and suffix is       : 2
+  # then the IP will be : 192.168.1.2
+  if $bridge_mode; then
+    ipaddr="${router%.*}.${suffix}"
+  else
+    # otherwise assume the node is a router and set the IP to the router IP specified above.
+    # If you DO disable bridge mode for a device, make sure you ONLY do it for ONE device.
+    ipaddr="${router}"
+    stp_priority=0
   fi
 fi
 
-hostname="MX4300-$((suffix + 1))"
-router=192.168.1.1
-netmask=24
-ipaddr="192.168.1.$((suffix + 1))"
-ip6addr="fd00:cafe:cafe::$((suffix + 1))"
+hostname="${prefix}-${suffix}"
 
-[ -n "$hostname" ] && {
-  uci batch <<- EOF > /dev/null
+uci batch <<- EOF > /dev/null
 	del system.@system[0]
 	add system system
 	set system.@system[0]=system
@@ -114,12 +151,10 @@ ip6addr="fd00:cafe:cafe::$((suffix + 1))"
 	set system.@system[0].urandom_seed='1'
 	set system.@system[0].zonename='${zonename}'
 	set system.@system[0].cronloglevel='9'
-	set system.@system[0].conloglevel='6'
 	del system.ntp
 	set system.ntp=timeserver
 	set system.ntp.enable_server='1'
 	set system.ntp.interface='lan'
-	add_list system.ntp.server='${router}'
 	add_list system.ntp.server='129.6.15.28'
 	add_list system.ntp.server='129.6.15.29'
 	add_list system.ntp.server='129.6.15.30'
@@ -127,8 +162,18 @@ ip6addr="fd00:cafe:cafe::$((suffix + 1))"
 	add_list system.ntp.server='2610:20:6f15:15::28'
 	add_list system.ntp.server='129.6.15.27'
 	add_list system.ntp.server='129.6.15.26'
+	# Set the LED to a less annoying dim green color
+	set system.@led[0]=led
+	set system.@led[0].name='Blue Off'
+	set system.@led[0].sysfs='blue:status'
+	set system.@led[0].trigger='none'
+	set system.@led[0].default='0'
+	set system.@led[1]=led
+	set system.@led[1].name='Red Off'
+	set system.@led[1].sysfs='red:status'
+	set system.@led[1].trigger='none'
+	set system.@led[1].default='0'
 EOF
-}
 
 # satellite nodes should not have any DHCP/DNS services running.
 # Nor should they have any firewall/dnsmasq rules.
@@ -146,7 +191,6 @@ ${bridge_mode} && {
   [ -r /etc/hotplug.d/ntp/25-unbound ] && rm /etc/hotplug.d/ntp/25-unbound
 
   uci import <<- EOF > /dev/null
-
 package dhcp
 
 config dnsmasq
@@ -196,16 +240,33 @@ config device
 	option stp '1'
 	option igmp_snooping '1'
 	option arp_accept '1'
-	option priority '$((stp_priority + suffix))'
+	option priority '${stp_priority}'
 
 config interface 'lan'
 	option device 'br-lan'
+$(
+    if [ "$lan_proto" = "static" ]; then
+      cat <<- EOD
 	option proto 'static'
 	list ipaddr '${ipaddr}/${netmask:-24}'
-	list ip6addr '${ip6addr}'
 	list dns '${router}'
 	option gateway '${router}'
 	option delegate '0'
+EOD
+    else
+      cat <<- EOD
+	option proto 'dhcp'
+	option delegate '0'
+
+config interface 'mgmt'
+	option device '@lan'
+	option proto 'static'
+	option ipaddr '${fallback_mgmt_ip}'
+	option netmask '255.255.255.0'
+	option delegate '0'
+EOD
+    fi
+  )
 
 config interface 'lan6'
 	option device '@lan'
@@ -226,13 +287,31 @@ config device
 	option name 'lan3'
 	option macaddr '${mac}'
 EOF
+
+# Sometimes nodes may not be able to reach the gateway for whatever reason
+# Since they will be connected via wifi it's cumbersome having to hardwire just to troubleshoot
+# Install the `watchcat` package to automatically reboot the node if it can't reach the gateway
+uci import <<- EOF > /dev/null
+
+package watchcat
+
+config watchcat
+	option period '5m'
+	option mode 'ping_reboot'
+	option pinghosts '${router}'
+	option addressfamily 'any'
+	option pingperiod '10s'
+	option pingsize 'standard'
+	option forcedelay '1m'
+EOF
 }
 
 # If not in bridge mode, then assume setting up as a router
 ${bridge_mode} || {
   uci batch <<- EOF > /dev/null
 	set network.lan.proto='static'
-	set network.lan.ipaddr=''${ipaddr}/${netmask:-24}''
+	del_list network.lan.ipaddr
+	set network.lan.ipaddr='${router}/${netmask:-24}'
 EOF
 }
 
@@ -246,7 +325,7 @@ config wifi-device 'radio0'
 	option txpower '21'
 	option country '${country:-US}'
 	option htmode 'HE80'
-	option channel '64'
+	option channel '${ap_5g_channel:-64}'
 	option cell_density '0'
 	option noscan '1'
 
@@ -257,8 +336,9 @@ config wifi-device 'radio1'
 	option txpower '24'
 	option country '${country:-US}'
 	option htmode 'HE20'
-	option channel '${channel_2g:-6}'
+	option channel '${ap_2g_channel:-6}'
 	option cell_density '0'
+	option noscan '1'
 
 config wifi-device 'radio2'
 	option type 'mac80211'
@@ -267,7 +347,7 @@ config wifi-device 'radio2'
 	option txpower '30'
 	option country '${country:-US}'
 	option htmode 'HE80'
-	option channel '161'
+	option channel '${mesh_channel:-161}'
 	option cell_density '3'
 	option noscan '1'
 
@@ -344,56 +424,21 @@ config wifi-iface '${wds_iface}'
 	$([ "${wds_mode:-ap}" = "ap" ] && echo "option hidden '1'")
 EOF
 
-cat << EOF | uci batch
-	set wireless.${mesh_radio}.channel=''${mesh_channel}''
-	set wireless.${ap_5g_radio}.channel=''${ap_5g_channel}''
+uci batch <<- EOF
+	set wireless.${mesh_radio}.channel='${mesh_channel}'
+	set wireless.${ap_5g_radio}.channel='${ap_5g_channel}'
 
 	set wireless.${mesh_radio}.cell_density='3'
 	set wireless.${ap_5g_radio}.cell_density='0'
 
-	set wireless.${mesh_iface}.device=''${mesh_radio}''
-	set wireless.${wds_iface}.device=''${mesh_radio}''
-	set wireless.${ap_5g_iface}.device=''${ap_5g_radio}''
-EOF
-
-# Set to a less annoying dim green color
-uci import <<- EOF
-package system
-
-config led
-	option name 'Blue Off'
-	option sysfs 'blue:status'
-	option trigger 'none'
-	option default '0'
-
-config led
-	option name 'Red Off'
-	option sysfs 'red:status'
-	option trigger 'none'
-	option default '0'
-EOF
-
-# Sometimes nodes may not be able to reach the gateway for whatever reason
-# Since they will be connected via wifi it's cumbersome having to hardwire just to troubleshoot
-# Install the `watchcat` package to automatically reboot the node if it can't reach the gateway
-uci import <<- EOF > /dev/null
-
-package watchcat
-
-config watchcat
-	option period '5m'
-	option mode 'ping_reboot'
-	option pinghosts '${router}'
-	option addressfamily 'any'
-	option pingperiod '10s'
-	option pingsize 'standard'
-	option forcedelay '1m'
+	set wireless.${mesh_iface}.device='${mesh_radio}'
+	set wireless.${wds_iface}.device='${mesh_radio}'
+	set wireless.${ap_5g_iface}.device='${ap_5g_radio}'
 EOF
 
 uci changes
 
 uci commit system
-uci commit luci_statistics
 uci commit dhcp
 uci commit network
 uci commit wireless

From ebc8a30041556f29b7a199debd46366e331da011 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Mon, 12 Aug 2024 00:34:11 -0400
Subject: [PATCH 181/225] nss-setup: fix led configs not generating

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 nss-setup/example/03-uci-defaults | 68 ++++++++++++++++---------------
 1 file changed, 35 insertions(+), 33 deletions(-)

diff --git a/nss-setup/example/03-uci-defaults b/nss-setup/example/03-uci-defaults
index 260d5d49ae8a70..f32e3fe6324f36 100644
--- a/nss-setup/example/03-uci-defaults
+++ b/nss-setup/example/03-uci-defaults
@@ -140,39 +140,41 @@ fi
 
 hostname="${prefix}-${suffix}"
 
-uci batch <<- EOF > /dev/null
-	del system.@system[0]
-	add system system
-	set system.@system[0]=system
-	set system.@system[0].hostname='${hostname}'
-	set system.@system[0].timezone='${timezone}'
-	set system.@system[0].ttylogin='0'
-	set system.@system[0].log_size='128'
-	set system.@system[0].urandom_seed='1'
-	set system.@system[0].zonename='${zonename}'
-	set system.@system[0].cronloglevel='9'
-	del system.ntp
-	set system.ntp=timeserver
-	set system.ntp.enable_server='1'
-	set system.ntp.interface='lan'
-	add_list system.ntp.server='129.6.15.28'
-	add_list system.ntp.server='129.6.15.29'
-	add_list system.ntp.server='129.6.15.30'
-	add_list system.ntp.server='2610:20:6f15:15::27'
-	add_list system.ntp.server='2610:20:6f15:15::28'
-	add_list system.ntp.server='129.6.15.27'
-	add_list system.ntp.server='129.6.15.26'
-	# Set the LED to a less annoying dim green color
-	set system.@led[0]=led
-	set system.@led[0].name='Blue Off'
-	set system.@led[0].sysfs='blue:status'
-	set system.@led[0].trigger='none'
-	set system.@led[0].default='0'
-	set system.@led[1]=led
-	set system.@led[1].name='Red Off'
-	set system.@led[1].sysfs='red:status'
-	set system.@led[1].trigger='none'
-	set system.@led[1].default='0'
+uci import <<- EOF
+package system
+
+config system
+	option hostname '${hostname}'
+	option timezone '${timezone}'
+	option ttylogin '0'
+	option log_size '128'
+	option urandom_seed '1'
+	option zonename '${zonename}'
+	option cronloglevel '9'
+
+config timeserver 'ntp'
+	option enable_server '1'
+	option interface 'lan'
+	$(${bridge_mode} && echo list server ''${router}'')
+	list server '129.6.15.28'
+	list server '129.6.15.29'
+	list server '129.6.15.30'
+	list server '2610:20:6f15:15::27'
+	list server '2610:20:6f15:15::28'
+	list server '129.6.15.27'
+	list server '129.6.15.26'
+
+config led
+	option name 'Blue Off'
+	option sysfs 'blue:status'
+	option trigger 'none'
+	option default '0'
+
+config led
+	option name 'Red Off'
+	option sysfs 'red:status'
+	option trigger 'none'
+	option default '0'
 EOF
 
 # satellite nodes should not have any DHCP/DNS services running.

From 5abad454dbaf4eb8ba5711d106ebf965f2d72a6c Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Fri, 20 Sep 2024 17:51:54 -0400
Subject: [PATCH 182/225] nss-setup: Add additional notes

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 nss-setup/example/03-uci-defaults | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/nss-setup/example/03-uci-defaults b/nss-setup/example/03-uci-defaults
index f32e3fe6324f36..91c54c52abfa9e 100644
--- a/nss-setup/example/03-uci-defaults
+++ b/nss-setup/example/03-uci-defaults
@@ -94,6 +94,8 @@ fi
 # For Linksys MX4200/4300/5300 etc, only need to match the first 5 bytes
 # of the MAC address to determine it's the same device.
 # Replace 'xx:xx' with the one found on the bottom of your device.
+# NOTE: '80:69:1a' is just one of the OUI for Linksys. Yours may be different.
+# i.e. 'D8:EC:5E:xx:xx', or others. We just need the first 10 characters.
 # Add a new `elif` block for each device if needed.
 if [[ "${mac}" =~ "80:69:1a:xx:xx" ]]; then
   suffix=2
@@ -156,6 +158,8 @@ config timeserver 'ntp'
 	option enable_server '1'
 	option interface 'lan'
 	$(${bridge_mode} && echo list server ''${router}'')
+	# The following NTP servers are NIST Internet Time Servers.
+	# Change them to suit your needs/regional location.
 	list server '129.6.15.28'
 	list server '129.6.15.29'
 	list server '129.6.15.30'

From b88b2fe0ba06f27fbb516e10fa617ee07845dced Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Wed, 25 Sep 2024 23:32:42 -0400
Subject: [PATCH 183/225] feeds: fix disable nss feed from being packaged

Fix typo in feeds name

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 nss-setup/config-nss.seed | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nss-setup/config-nss.seed b/nss-setup/config-nss.seed
index 919793ef1eab73..1645b499936288 100644
--- a/nss-setup/config-nss.seed
+++ b/nss-setup/config-nss.seed
@@ -132,5 +132,5 @@ CONFIG_PACKAGE_tcpdump=y
 CONFIG_HTOP_LMSENSORS=n
 
 # Prevent opkg from adding custom feeds to /etc/opkg/distfeeds.conf
-CONFIG_FEED_nss=n
+CONFIG_FEED_nss_packages=n
 CONFIG_FEED_sqm_scripts_nss=n

From d04f3ebff84120cdf48785cefadffc8392d4d34d Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Mon, 30 Sep 2024 21:31:25 -0400
Subject: [PATCH 184/225] nss-setup: change default optimization to '-O2'

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 nss-setup/config-nss.seed | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nss-setup/config-nss.seed b/nss-setup/config-nss.seed
index 1645b499936288..7d3aa8279681d5 100644
--- a/nss-setup/config-nss.seed
+++ b/nss-setup/config-nss.seed
@@ -61,7 +61,7 @@ CONFIG_DEVEL=y
 CONFIG_EXPERIMENTAL=y
 CONFIG_TOOLCHAINOPTS=y
 CONFIG_TARGET_OPTIONS=y
-CONFIG_TARGET_OPTIMIZATION="-O3 -pipe -mcpu=cortex-a53+crc+crypto"
+CONFIG_TARGET_OPTIMIZATION="-O2 -pipe -mcpu=cortex-a53+crc+crypto"
 CONFIG_TARGET_INIT_PATH="/usr/sbin:/usr/bin:/sbin:/bin:/opt/usr/bin:/opt/bin:/opt/sbin:/opt/usr/sbin"
 CONFIG_USE_GC_SECTIONS=y
 

From 5b71fb7a230bd2eec509dd08901110e28420bdd7 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Mon, 30 Sep 2024 21:32:55 -0400
Subject: [PATCH 185/225] nss-setup: Make sure user selects their own target

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 nss-setup/config-nss.seed | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nss-setup/config-nss.seed b/nss-setup/config-nss.seed
index 7d3aa8279681d5..85cdd3c11d19a9 100644
--- a/nss-setup/config-nss.seed
+++ b/nss-setup/config-nss.seed
@@ -21,7 +21,7 @@ CONFIG_TARGET_qualcommax_ipq807x=y
 # CONFIG_TARGET_qualcommax_ipq807x_DEVICE_edimax_cax1800 is not set
 # CONFIG_TARGET_qualcommax_ipq807x_DEVICE_linksys_mx4200v1 is not set
 # CONFIG_TARGET_qualcommax_ipq807x_DEVICE_linksys_mx4200v2 is not set
-CONFIG_TARGET_qualcommax_ipq807x_DEVICE_linksys_mx4300=y
+# CONFIG_TARGET_qualcommax_ipq807x_DEVICE_linksys_mx4300 is not set
 # CONFIG_TARGET_qualcommax_ipq807x_DEVICE_linksys_mx5300 is not set
 # CONFIG_TARGET_qualcommax_ipq807x_DEVICE_linksys_mx8500 is not set
 # CONFIG_TARGET_qualcommax_ipq807x_DEVICE_netgear_rax120v2 is not set

From 90fa4b0bd4fe8eae91e6facb52661f6e78e4eda2 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Fri, 4 Oct 2024 19:40:21 -0400
Subject: [PATCH 186/225] ath11k_nss: 6.11.2: fix
 235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch

Signed-off-by: Sean Khan <datapronix@protonmail.com>

ath11k_nss: 6.11.2 refresh 235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...pport-for-WDS-offload-in-NSS-offload.patch | 35 ++++++++++---------
 1 file changed, 18 insertions(+), 17 deletions(-)

diff --git a/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch b/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
index bc26bfa6926fd5..0be8370d4eb04a 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/235-003-ath11k-add-AP_VLAN-vif-support-for-WDS-offload-in-NSS-offload.patch
@@ -33,7 +33,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -430,6 +430,7 @@ struct ath11k_vif {
+@@ -431,6 +431,7 @@ struct ath11k_vif {
  #ifdef CPTCFG_ATH11K_NSS_SUPPORT
  	struct arvif_nss nss;
  #endif
@@ -224,7 +224,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	param_id = WMI_VDEV_PARAM_TX_ENCAP_TYPE;
  	if (ath11k_frame_mode != ATH11K_HW_TXRX_ETHERNET ||
  	    (vif->type != NL80211_IFTYPE_STATION &&
-@@ -6744,7 +6871,8 @@ static int ath11k_mac_op_add_interface(s
+@@ -6754,7 +6881,8 @@ static int ath11k_mac_op_add_interface(s
  		goto err;
  	}
  
@@ -234,7 +234,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		ath11k_warn(ab, "failed to create vdev %u, reached max vdev limit %d\n",
  			    ar->num_created_vdevs, TARGET_NUM_VDEVS(ab));
  		ret = -EBUSY;
-@@ -6757,6 +6885,28 @@ static int ath11k_mac_op_add_interface(s
+@@ -6767,6 +6895,28 @@ static int ath11k_mac_op_add_interface(s
  	arvif->vif = vif;
  
  	INIT_LIST_HEAD(&arvif->list);
@@ -260,10 +260,10 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 +		}
 +	}
 +
+ 	INIT_WORK(&arvif->bcn_tx_work, ath11k_mac_bcn_tx_work);
  	INIT_DELAYED_WORK(&arvif->connection_loss_work,
  			  ath11k_mac_vif_sta_connection_loss_work);
- 
-@@ -6788,6 +6938,7 @@ static int ath11k_mac_op_add_interface(s
+@@ -6799,6 +6949,7 @@ static int ath11k_mac_op_add_interface(s
  		fallthrough;
  	case NL80211_IFTYPE_AP:
  		arvif->vdev_type = WMI_VDEV_TYPE_AP;
@@ -271,7 +271,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		if (vif->p2p)
  			arvif->vdev_subtype = WMI_VDEV_SUBTYPE_P2P_GO;
  		break;
-@@ -7023,13 +7174,30 @@ static void ath11k_mac_op_remove_interfa
+@@ -7034,14 +7185,31 @@ static void ath11k_mac_op_remove_interfa
  	struct ath11k *ar = hw->priv;
  	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
  	struct ath11k_base *ab = ar->ab;
@@ -279,10 +279,8 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	int ret;
  	int i;
  
--	cancel_delayed_work_sync(&arvif->connection_loss_work);
--
- 	mutex_lock(&ar->conf_mutex);
- 
++	mutex_lock(&ar->conf_mutex);
++
 +	if (vif->type == NL80211_IFTYPE_AP_VLAN) {
 +		ath11k_nss_ext_vdev_delete(arvif);
 +
@@ -299,12 +297,15 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 +		goto unlock;
 +	}
 +
-+	cancel_delayed_work_sync(&arvif->connection_loss_work);
-+
+ 	cancel_delayed_work_sync(&arvif->connection_loss_work);
+ 	cancel_work_sync(&arvif->bcn_tx_work);
+ 
+-	mutex_lock(&ar->conf_mutex);
+-
  	ath11k_dbg(ab, ATH11K_DBG_MAC, "remove interface (vdev %d)\n",
  		   arvif->vdev_id);
  
-@@ -7046,6 +7214,14 @@ static void ath11k_mac_op_remove_interfa
+@@ -7058,6 +7226,14 @@ static void ath11k_mac_op_remove_interfa
  		if (ret)
  			ath11k_warn(ab, "failed to submit AP self-peer removal on vdev %d: %d\n",
  				    arvif->vdev_id, ret);
@@ -319,7 +320,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	}
  
  	ret = ath11k_mac_vdev_delete(ar, arvif);
-@@ -7087,8 +7263,7 @@ err_vdev_del:
+@@ -7099,8 +7275,7 @@ err_vdev_del:
  	/* Recalc txpower for remaining vdev */
  	ath11k_mac_txpower_recalc(ar);
  
@@ -329,7 +330,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	mutex_unlock(&ar->conf_mutex);
  }
  
-@@ -7148,16 +7323,17 @@ static int ath11k_mac_op_ampdu_action(st
+@@ -7160,16 +7335,17 @@ static int ath11k_mac_op_ampdu_action(st
  				      struct ieee80211_ampdu_params *params)
  {
  	struct ath11k *ar = hw->priv;
@@ -349,7 +350,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		break;
  	case IEEE80211_AMPDU_TX_START:
  	case IEEE80211_AMPDU_TX_STOP_CONT:
-@@ -9085,6 +9261,7 @@ static void ath11k_mac_op_sta_statistics
+@@ -9097,6 +9273,7 @@ static void ath11k_mac_op_sta_statistics
  {
  	struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);
  	struct ath11k *ar = arsta->arvif->ar;
@@ -357,7 +358,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	s8 signal;
  	bool db2dbm = test_bit(WMI_TLV_SERVICE_HW_DB2DBM_CONVERSION_SUPPORT,
  			       ar->ab->wmi_ab.svc_map);
-@@ -9144,7 +9321,8 @@ static void ath11k_mac_op_sta_statistics
+@@ -9156,7 +9333,8 @@ static void ath11k_mac_op_sta_statistics
  
  	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
  

From f6db916bad512df344c2bca710dacd18687abe92 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Fri, 4 Oct 2024 19:38:49 -0400
Subject: [PATCH 187/225] ath11k_nss: 6.11.2: fix
 999-783-001-wifi-ath11k-Fix-BCCA-counter-for-EMA.patch

Signed-off-by: Sean Khan <datapronix@protonmail.com>

ath11k_nss: 6.11.2 refresh 999-783-001-wifi-ath11k-Fix-BCCA-counter-for-EMA.patch

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...wifi-ath11k-Fix-BCCA-counter-for-EMA.patch | 37 ++++++++++++++-----
 1 file changed, 27 insertions(+), 10 deletions(-)

diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-783-001-wifi-ath11k-Fix-BCCA-counter-for-EMA.patch b/package/kernel/mac80211/patches/nss/ath11k/999-783-001-wifi-ath11k-Fix-BCCA-counter-for-EMA.patch
index 1a852aa2c822f2..bf5cd8393b0b64 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-783-001-wifi-ath11k-Fix-BCCA-counter-for-EMA.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-783-001-wifi-ath11k-Fix-BCCA-counter-for-EMA.patch
@@ -48,6 +48,31 @@ Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
  static void ath11k_control_beaconing(struct ath11k_vif *arvif,
  				     struct ieee80211_bss_conf *info)
  {
+@@ -7039,16 +7018,6 @@ static int ath11k_mac_vdev_delete(struct
+ 	return ret;
+ }
+ 
+-static void ath11k_mac_bcn_tx_work(struct work_struct *work)
+-{
+-	struct ath11k_vif *arvif = container_of(work, struct ath11k_vif,
+-						bcn_tx_work);
+-
+-	mutex_lock(&arvif->ar->conf_mutex);
+-	ath11k_mac_bcn_tx_event(arvif);
+-	mutex_unlock(&arvif->ar->conf_mutex);
+-}
+-
+ static int ath11k_mac_op_add_interface(struct ieee80211_hw *hw,
+ 				       struct ieee80211_vif *vif)
+ {
+@@ -7111,7 +7080,6 @@ static int ath11k_mac_op_add_interface(s
+ 		}
+ 	}
+ 
+-	INIT_WORK(&arvif->bcn_tx_work, ath11k_mac_bcn_tx_work);
+ 	INIT_DELAYED_WORK(&arvif->connection_loss_work,
+ 			  ath11k_mac_vif_sta_connection_loss_work);
+ 
 --- a/drivers/net/wireless/ath/ath11k/mac.h
 +++ b/drivers/net/wireless/ath/ath11k/mac.h
 @@ -171,7 +171,6 @@ enum ath11k_supported_bw ath11k_mac_mac8
@@ -72,15 +97,7 @@ Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
  	}
  
  	cmd->buf_len = bcn->len;
-@@ -7612,7 +7613,6 @@ static void ath11k_bcn_tx_status_event(s
- 		rcu_read_unlock();
- 		return;
- 	}
--	ath11k_mac_bcn_tx_event(arvif);
- 	rcu_read_unlock();
- }
- 
-@@ -8526,10 +8526,7 @@ ath11k_wmi_process_csa_switch_count_even
+@@ -8528,10 +8529,7 @@ ath11k_wmi_process_csa_switch_count_even
  {
  	int i;
  	struct ath11k_vif *arvif;
@@ -92,7 +109,7 @@ Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
  
  	rcu_read_lock();
  	for (i = 0; i < ev->num_vdevs; i++) {
-@@ -8541,8 +8538,18 @@ ath11k_wmi_process_csa_switch_count_even
+@@ -8543,8 +8541,18 @@ ath11k_wmi_process_csa_switch_count_even
  			continue;
  		}
  

From bebcc71e5f8f8e42b533caca5da6b45bc146d780 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Fri, 4 Oct 2024 22:30:13 -0400
Subject: [PATCH 188/225] ath11k_nss: Delete
 999-783-001-wifi-ath11k-Fix-BCCA-counter-for-EMA.patch

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...wifi-ath11k-Fix-BCCA-counter-for-EMA.patch | 132 ------------------
 1 file changed, 132 deletions(-)
 delete mode 100644 package/kernel/mac80211/patches/nss/ath11k/999-783-001-wifi-ath11k-Fix-BCCA-counter-for-EMA.patch

diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-783-001-wifi-ath11k-Fix-BCCA-counter-for-EMA.patch b/package/kernel/mac80211/patches/nss/ath11k/999-783-001-wifi-ath11k-Fix-BCCA-counter-for-EMA.patch
deleted file mode 100644
index bf5cd8393b0b64..00000000000000
--- a/package/kernel/mac80211/patches/nss/ath11k/999-783-001-wifi-ath11k-Fix-BCCA-counter-for-EMA.patch
+++ /dev/null
@@ -1,132 +0,0 @@
-From ea4988df80e62204c411a60bafadfbff23eaa773 Mon Sep 17 00:00:00 2001
-From: Rameshkumar Sundaram <quic_ramess@quicinc.com>
-Date: Thu, 15 Jun 2023 14:33:55 +0530
-Subject: [PATCH] wifi: ath11k: Fix BCCA counter for EMA
-
-Currently BCCA counter is updated to FW via csa counter offs and
-beacon with new countdown is updated for every beacon tx completion event.
-For EMA, all EMA beacons are updated in one shot, and counter update for
-every tx event will mess up the actual sequence of countdown sent over the air.
-
-Allow FW to update the countdown till 1 and finalize the color
-change.
-
-Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
----
- drivers/net/wireless/ath/ath11k/mac.c | 21 ---------------------
- drivers/net/wireless/ath/ath11k/mac.h |  1 -
- drivers/net/wireless/ath/ath11k/wmi.c | 23 +++++++++++++++--------
- 3 files changed, 15 insertions(+), 30 deletions(-)
-
---- a/drivers/net/wireless/ath/ath11k/mac.c
-+++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -1681,27 +1681,6 @@ static int ath11k_mac_setup_bcn_tmpl(str
- 	return ath11k_mac_setup_bcn_tmpl_mbssid(arvif);
- }
- 
--void ath11k_mac_bcn_tx_event(struct ath11k_vif *arvif)
--{
--	struct ieee80211_vif *vif = arvif->vif;
--
--	if (!vif->bss_conf.color_change_active && !arvif->bcca_zero_sent)
--		return;
--
--	if (vif->bss_conf.color_change_active &&
--	    ieee80211_beacon_cntdwn_is_complete(vif, 0)) {
--		arvif->bcca_zero_sent = true;
--		ieee80211_color_change_finish(vif, 0);
--		return;
--	}
--
--	arvif->bcca_zero_sent = false;
--
--	if (vif->bss_conf.color_change_active)
--		ieee80211_beacon_update_cntdwn(vif, 0);
--	ath11k_mac_setup_bcn_tmpl(arvif);
--}
--
- static void ath11k_control_beaconing(struct ath11k_vif *arvif,
- 				     struct ieee80211_bss_conf *info)
- {
-@@ -7039,16 +7018,6 @@ static int ath11k_mac_vdev_delete(struct
- 	return ret;
- }
- 
--static void ath11k_mac_bcn_tx_work(struct work_struct *work)
--{
--	struct ath11k_vif *arvif = container_of(work, struct ath11k_vif,
--						bcn_tx_work);
--
--	mutex_lock(&arvif->ar->conf_mutex);
--	ath11k_mac_bcn_tx_event(arvif);
--	mutex_unlock(&arvif->ar->conf_mutex);
--}
--
- static int ath11k_mac_op_add_interface(struct ieee80211_hw *hw,
- 				       struct ieee80211_vif *vif)
- {
-@@ -7111,7 +7080,6 @@ static int ath11k_mac_op_add_interface(s
- 		}
- 	}
- 
--	INIT_WORK(&arvif->bcn_tx_work, ath11k_mac_bcn_tx_work);
- 	INIT_DELAYED_WORK(&arvif->connection_loss_work,
- 			  ath11k_mac_vif_sta_connection_loss_work);
- 
---- a/drivers/net/wireless/ath/ath11k/mac.h
-+++ b/drivers/net/wireless/ath/ath11k/mac.h
-@@ -171,7 +171,6 @@ enum ath11k_supported_bw ath11k_mac_mac8
- enum hal_encrypt_type ath11k_dp_tx_get_encrypt_type(u32 cipher);
- void ath11k_mac_handle_beacon(struct ath11k *ar, struct sk_buff *skb);
- void ath11k_mac_handle_beacon_miss(struct ath11k *ar, u32 vdev_id);
--void ath11k_mac_bcn_tx_event(struct ath11k_vif *arvif);
- int ath11k_mac_wait_tx_complete(struct ath11k *ar);
- int ath11k_mac_vif_set_keepalive(struct ath11k_vif *arvif,
- 				 enum wmi_sta_keepalive_method method,
---- a/drivers/net/wireless/ath/ath11k/wmi.c
-+++ b/drivers/net/wireless/ath/ath11k/wmi.c
-@@ -1918,9 +1918,10 @@ int ath11k_wmi_bcn_tmpl(struct ath11k *a
- 	cmd->vdev_id = vdev_id;
- 	cmd->tim_ie_offset = offs->tim_offset;
- 
--	if (vif->bss_conf.csa_active) {
-+	if (vif->bss_conf.csa_active || vif->bss_conf.color_change_active) {
- 		cmd->csa_switch_count_offset = offs->cntdwn_counter_offs[0];
- 		cmd->ext_csa_switch_count_offset = offs->cntdwn_counter_offs[1];
-+		cmd->csa_event_bitmap = cpu_to_le32(0xFFFFFFFF);
- 	}
- 
- 	cmd->buf_len = bcn->len;
-@@ -8528,10 +8529,7 @@ ath11k_wmi_process_csa_switch_count_even
- {
- 	int i;
- 	struct ath11k_vif *arvif;
--
--	/* Finish CSA once the switch count becomes NULL */
--	if (ev->current_switch_count)
--		return;
-+	struct ieee80211_bss_conf *bss_conf;
- 
- 	rcu_read_lock();
- 	for (i = 0; i < ev->num_vdevs; i++) {
-@@ -8543,8 +8541,18 @@ ath11k_wmi_process_csa_switch_count_even
- 			continue;
- 		}
- 
--		if (arvif->is_up && arvif->vif->bss_conf.csa_active)
--			ieee80211_csa_finish(arvif->vif, 0);
-+		bss_conf = &arvif->vif->bss_conf;
-+		if (arvif->is_up && (bss_conf->csa_active || bss_conf->color_change_active)) {
-+			if (!ev->current_switch_count) {
-+				if (bss_conf->csa_active)
-+					ieee80211_csa_finish(arvif->vif, 0);
-+			} else if (ev->current_switch_count > 1) {
-+				ieee80211_beacon_update_cntdwn(arvif->vif, 0);
-+			} else {
-+				if (bss_conf->color_change_active)
-+					ieee80211_color_change_finish(arvif->vif, 0);
-+			}
-+		}
- 	}
- 	rcu_read_unlock();
- }

From af62b1d6a447a68e4838c67b6fa231d101ff1745 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Fri, 4 Oct 2024 17:27:42 -0400
Subject: [PATCH 189/225] ath11k_nss: Possible workaround to 0 wifi stats

Signed-off-by: Sean Khan <datapronix@protonmail.com>
(cherry picked from commit 0056ba46ffe980c88ab4d250eb4799cb0a632de7)
---
 package/kernel/mac80211/files/qca-nss-pbuf.init | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)
 mode change 100755 => 100644 package/kernel/mac80211/files/qca-nss-pbuf.init

diff --git a/package/kernel/mac80211/files/qca-nss-pbuf.init b/package/kernel/mac80211/files/qca-nss-pbuf.init
old mode 100755
new mode 100644
index 44176f74223c9c..bca42e943b3f2f
--- a/package/kernel/mac80211/files/qca-nss-pbuf.init
+++ b/package/kernel/mac80211/files/qca-nss-pbuf.init
@@ -14,12 +14,20 @@
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 #
 
-START=71
+START=95
 NAME=qca-nss-pbuf
 
+reload_wifi() {
+  if [ -r /sys/module/ath11k/parameters/nss_offload ]; then
+    nss_offload=$(cat /sys/module/ath11k/parameters/nss_offload 2> /dev/null)
+    [ "$nss_offload" -eq 1 ] && wifi up
+  fi
+}
+
 get_num_cpus() {
-  local num_cpus=$(awk -F': ' '/^processor/ {count++} END {print count}' /proc/cpuinfo)
-  echo ${num_cpus:-1}
+  local num_cpus
+  num_cpus=$(awk -F': ' '/^processor/ {count++} END {print count}' /proc/cpuinfo)
+  echo "${num_cpus:-1}"
 }
 
 apply_sysctl() {
@@ -169,5 +177,6 @@ start() {
   num_cpus=$(get_num_cpus)
   hash_bitmap="$(((1 << num_cpus) - 1))"
   sysctl -w dev.nss.rps.hash_bitmap=$hash_bitmap > /dev/null 2>&1
+  reload_wifi
 
 }

From 30b04048866f42e19c17469aa90e3345c7347442 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 5 Oct 2024 03:37:23 -0400
Subject: [PATCH 190/225] ath11k_nss: Add diagnostic gathering utility

This is meant to ease debugging when asking for support. Just run the
command "nss_diag" and include in your issues/forum posts.

Example of output
```
     MODEL: Linksys MX5300
   OPENWRT: r27645+154-f9a0485c99
IPQ BRANCH: qualcommax-6.x-nss-mx4300-6.11
IPQ COMMIT: 04c2d8a2db
  IPQ DATE: 2024-10-04
    NSS FW: NSS.HK.11.4.0.5-6-R
  MAC80211: v6.11.2-0-g7aa21fec187b
 ATH11K FW: WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1
  GRO FRAG: wan         : off
            br-lan      : off
            lan1        : off
            lan2        : off
            lan3        : off
            lan4        : off
            phy0-mesh0  : off
            phy1-ap0    : off
            phy2-ap0    : off

  NSS PKGS: kmod-qca-nss-cfi-cryptoapi - 6.6.54.12.5.2022.12.15~5cd07ce-r3
            kmod-qca-nss-crypto - 6.6.54.12.5.2022.12.15~3c5a574-r3
            kmod-qca-nss-dp - 6.6.54.2024.04.16~5bf8b91e-r1
            kmod-qca-nss-drv - 6.6.54.11.4.0.5.2021.09.13~53e5863-r14
            kmod-qca-nss-drv-bridge-mgr - 6.6.54.11.4.0.5.2021.08.17~c4049d1-r7
            kmod-qca-nss-drv-igs - 6.6.54.11.4.0.5.2021.08.17~c4049d1-r7
            kmod-qca-nss-drv-qdisc - 6.6.54.11.4.0.5.2021.08.17~c4049d1-r7
            kmod-qca-nss-drv-vlan-mgr - 6.6.54.11.4.0.5.2021.08.17~c4049d1-r7
            kmod-qca-nss-drv-wifi-meshmgr - 6.6.54.11.4.0.5.2021.08.17~c4049d1-r7
            kmod-qca-nss-ecm - 6.6.54.12.5.5.2024.09.02~bd5057b-r2
            nss-eip-firmware - 2.5.7-r3
            nss-firmware-default - 2024.08.04~794fe373-r1
            nss-firmware-ipq8074 - 2024.08.04~794fe373-r1
```

Signed-off-by: Sean Khan <datapronix@protonmail.com>
(cherry picked from commit a58914b4f788f6b5ee70ddad0a1f5c4e464a5629)
---
 package/kernel/mac80211/Makefile          |  11 ++-
 package/kernel/mac80211/files/nss_diag.sh | 100 ++++++++++++++++++++++
 2 files changed, 109 insertions(+), 2 deletions(-)
 create mode 100644 package/kernel/mac80211/files/nss_diag.sh

diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile
index b4b364b6930e5c..be222a6f1344b3 100644
--- a/package/kernel/mac80211/Makefile
+++ b/package/kernel/mac80211/Makefile
@@ -47,6 +47,9 @@ include $(INCLUDE_DIR)/package.mk
 WMENU:=Wireless Drivers
 
 NSS_PATCH:= subsys ath10k ath11k
+IPQ_BRANCH:=$(shell git -C $(TOPDIR) rev-parse --abbrev-ref HEAD)
+IPQ_DATE:=$(shell git -C $(TOPDIR) log -1 --format=%cd --date=format:%Y-%m-%d)
+IPQ_COMMIT:=$(shell git -C $(TOPDIR) log -1 --format=%h)
 
 define KernelPackage/mac80211/Default
   SUBMENU:=$(WMENU)
@@ -438,9 +441,13 @@ endef
 
 ifdef CONFIG_ATH11K_NSS_SUPPORT
 define KernelPackage/ath11k/install
-	$(INSTALL_DIR) $(1)/etc/init.d $(1)/etc/config
+	$(INSTALL_DIR) $(1)/etc/init.d $(1)/etc/config $(1)/usr/bin
 	$(INSTALL_BIN) ./files/qca-nss-pbuf.init $(1)/etc/init.d/qca-nss-pbuf
-	$(INSTALL_BIN) ./files/pbuf.uci $(1)/etc/config/pbuf
+	$(INSTALL_DATA) ./files/pbuf.uci $(1)/etc/config/pbuf
+	$(INSTALL_BIN) ./files/nss_diag.sh $(1)/usr/bin/nss_diag
+	echo "IPQ_BRANCH=$(IPQ_BRANCH)" > $(1)/etc/ipq_release
+	echo "IPQ_DATE=$(IPQ_DATE)" >> $(1)/etc/ipq_release
+	echo "IPQ_COMMIT=$(IPQ_COMMIT)" >> $(1)/etc/ipq_release
 endef
 endif
 
diff --git a/package/kernel/mac80211/files/nss_diag.sh b/package/kernel/mac80211/files/nss_diag.sh
new file mode 100644
index 00000000000000..674b6b342356bb
--- /dev/null
+++ b/package/kernel/mac80211/files/nss_diag.sh
@@ -0,0 +1,100 @@
+#!/bin/sh
+# shellcheck disable=3037,3060,2034,1091
+
+# check if stdout is a terminal, then set colors.
+if test -t 1; then
+  fg=$(printf '\033[38;5;')
+  bg=$(printf '\033[48;5;')
+  red=$(printf '\033[31m')
+  green=$(printf '\033[32m')
+  yellow=$(printf '\033[33m')
+  blue=$(printf '\033[34m')
+  magenta=$(printf '\033[35m')
+  cyan=$(printf '\033[36m')
+  white=$(printf '\033[37m')
+  reset=$(printf '\033[m')
+  bold=$(printf '\033[1m')
+  underline=$(printf '\033[4m')
+  blink=$(printf '\033[5m')
+  invert=$(printf '\033[7m')
+  resetbold=$(printf '\033[21m')
+  resetunderline=$(printf '\033[24m')
+else
+  fg=""
+  bg=""
+  red=""
+  green=""
+  yellow=""
+  blue=""
+  magenta=""
+  cyan=""
+  white=""
+  reset=""
+  bold=""
+  underline=""
+  blink=""
+  invert=""
+  resetbold=""
+  resetunderline=""
+fi
+
+[ -r /etc/openwrt_version ] && openwrt_rev=$(cat /etc/openwrt_version)
+model=$(jsonfilter -e ''@.model.name'' < /etc/board.json | sed -e "s/,/_/g")
+
+# NSS firmware version
+nss_fw="/lib/firmware/qca*.bin"
+[ "$(ls $nss_fw 2> /dev/null)" ] && nss_version=$(grep -h -m 1 -a -o 'Version:.[^[:cntrl:]]*' $nss_fw | head -1 | cut -d ' ' -f 2)
+
+# ATH11K firmware version
+ath11k_fw=$(grep -h -m 1 -a -o 'WLAN.[^[:cntrl:]]*SILICONZ-1' /lib/firmware/*/q6* | head -1)
+
+# MAC80211 (backports) version
+mac80211_version=$(awk '/version/{print $NF;exit}' /lib/modules/*/compat.ko)
+
+# OpenWRT IPQ
+[ -r /etc/ipq_release ] && . /etc/ipq_release
+ipq_branch=${IPQ_BRANCH:-"N/A"}
+ipq_commit=${IPQ_COMMIT:-"N/A"}
+ipq_date=${IPQ_DATE:-"N/A"}
+
+[ -z "$openwrt_rev" ] && openwrt_rev="N/A"
+[ -z "$model" ] && model="N/A"
+
+
+[ -z "$nss_version" ] && nss_version="N/A"
+[ -z "$ath11k_fw" ] && ath11k_fw="N/A"
+[ -z "$mac80211_version" ] && mac80211_version="N/A"
+
+echo -e "${bold}${red}     MODEL${reset}: ${white}${model}${reset}"
+echo -e "${bold}${red}   OPENWRT${reset}: ${yellow}${openwrt_rev}${reset}"
+echo -e "${bold}${red}IPQ BRANCH${reset}: ${green}${ipq_branch}${reset}"
+echo -e "${bold}${red}IPQ COMMIT${reset}: ${green}${ipq_commit}${reset}"
+echo -e "${bold}${red}  IPQ DATE${reset}: ${green}${ipq_date}${reset}"
+echo -e "${bold}${red}    NSS FW${reset}: ${cyan}${nss_version}${reset}"
+echo -e "${bold}${red}  MAC80211${reset}: ${white}${mac80211_version}${reset}${reset}"
+echo -e "${bold}${red} ATH11K FW${reset}: ${cyan}${ath11k_fw}${reset}"
+echo -ne "${bold}${red}  GRO FRAG${reset}: ${white}"
+
+count=0
+
+for i in wan br-lan /sys/class/net/br-lan/brif/*; do
+  i=${i##*\/}
+  ethtool -k ${i} | awk -v count=$count -v i=$i -v white=$white -v green=$green -v r=$reset '
+  /rx-gro-list/ {
+  if(count>0) tab="            "
+  color=red
+  if($2=="off") color=green
+  printf "%s%-11s : %s%s%s\n",tab,i,color,$2,r
+  }'
+  count=$((count + 1))
+done
+
+echo -e "${reset}"
+echo -ne "${bold}${red}  NSS PKGS${reset}: ${white}"
+opkg list-installed | awk -v count=0 '
+  /kmod-qca-nss|^nss/ {
+  if(count>0) tab="            "
+  print tab $0
+  count++
+}'
+echo -ne "${reset}"

From d8c906afa5f6b117a3f94aee5bb1a07c83347c2b Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 5 Oct 2024 14:50:44 -0400
Subject: [PATCH 191/225] ath11k_nss: Enhance nss_diag to properly list ifaces

Also optimized to use more native functions

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 package/kernel/mac80211/files/nss_diag.sh | 116 ++++++++++------------
 1 file changed, 52 insertions(+), 64 deletions(-)

diff --git a/package/kernel/mac80211/files/nss_diag.sh b/package/kernel/mac80211/files/nss_diag.sh
index 674b6b342356bb..1868adda2edc3e 100644
--- a/package/kernel/mac80211/files/nss_diag.sh
+++ b/package/kernel/mac80211/files/nss_diag.sh
@@ -1,92 +1,80 @@
 #!/bin/sh
-# shellcheck disable=3037,3060,2034,1091
+# shellcheck disable=3037,3060,2034,1091,2166
+
+blue=""
+red=""
+green=""
+yellow=""
+white=""
+reset=""
+bold=""
 
 # check if stdout is a terminal, then set colors.
-if test -t 1; then
-  fg=$(printf '\033[38;5;')
-  bg=$(printf '\033[48;5;')
-  red=$(printf '\033[31m')
-  green=$(printf '\033[32m')
-  yellow=$(printf '\033[33m')
-  blue=$(printf '\033[34m')
-  magenta=$(printf '\033[35m')
-  cyan=$(printf '\033[36m')
-  white=$(printf '\033[37m')
-  reset=$(printf '\033[m')
-  bold=$(printf '\033[1m')
-  underline=$(printf '\033[4m')
-  blink=$(printf '\033[5m')
-  invert=$(printf '\033[7m')
-  resetbold=$(printf '\033[21m')
-  resetunderline=$(printf '\033[24m')
-else
-  fg=""
-  bg=""
-  red=""
-  green=""
-  yellow=""
-  blue=""
-  magenta=""
-  cyan=""
-  white=""
-  reset=""
-  bold=""
-  underline=""
-  blink=""
-  invert=""
-  resetbold=""
-  resetunderline=""
+if [ -t 1 ]; then
+  red="\033[31m"
+  green="\033[32m"
+  yellow="\033[33m"
+  blue="\033[34m"
+  magenta="\033[35m"
+  cyan="\033[36m"
+  white="\033[37m"
+  reset="\033[m"
+  bold="\033[1m"
 fi
 
+# Retrieve OpenWRT version
 [ -r /etc/openwrt_version ] && openwrt_rev=$(cat /etc/openwrt_version)
+
+# Retrieve device model
 model=$(jsonfilter -e ''@.model.name'' < /etc/board.json | sed -e "s/,/_/g")
 
 # NSS firmware version
 nss_fw="/lib/firmware/qca*.bin"
+# shellcheck disable=2086
 [ "$(ls $nss_fw 2> /dev/null)" ] && nss_version=$(grep -h -m 1 -a -o 'Version:.[^[:cntrl:]]*' $nss_fw | head -1 | cut -d ' ' -f 2)
 
 # ATH11K firmware version
-ath11k_fw=$(grep -h -m 1 -a -o 'WLAN.[^[:cntrl:]]*SILICONZ-1' /lib/firmware/*/q6* | head -1)
+ath11k_fw=$(grep -hm1 -a -o 'WLAN.[^[:cntrl:]]*SILICONZ-1' /lib/firmware/*/q6* | head -1)
 
 # MAC80211 (backports) version
 mac80211_version=$(awk '/version/{print $NF;exit}' /lib/modules/*/compat.ko)
 
-# OpenWRT IPQ
+# OpenWRT IPQ release details
 [ -r /etc/ipq_release ] && . /etc/ipq_release
 ipq_branch=${IPQ_BRANCH:-"N/A"}
 ipq_commit=${IPQ_COMMIT:-"N/A"}
 ipq_date=${IPQ_DATE:-"N/A"}
 
-[ -z "$openwrt_rev" ] && openwrt_rev="N/A"
-[ -z "$model" ] && model="N/A"
-
+# Defaults for empty variables
+openwrt_rev=${openwrt_rev:-"N/A"}
+model=${model:-"N/A"}
+nss_version=${nss_version:-"N/A"}
+ath11k_fw=${ath11k_fw:-"N/A"}
+mac80211_version=${mac80211_version:-"N/A"}
 
-[ -z "$nss_version" ] && nss_version="N/A"
-[ -z "$ath11k_fw" ] && ath11k_fw="N/A"
-[ -z "$mac80211_version" ] && mac80211_version="N/A"
+# Display the information
+echo -e "${bold}${red}     MODEL${reset}: ${blue}${bold}${model}${reset}"
+echo -e "${bold}${red}   OPENWRT${reset}: ${white}${openwrt_rev}${reset}"
+echo -e "${bold}${red}IPQ BRANCH${reset}: ${cyan}${ipq_branch}${reset}"
+echo -e "${bold}${red}IPQ COMMIT${reset}: ${cyan}${ipq_commit}${reset}"
+echo -e "${bold}${red}  IPQ DATE${reset}: ${cyan}${ipq_date}${reset}"
+echo -e "${bold}${red}    NSS FW${reset}: ${magenta}${nss_version}${reset}"
+echo -e "${bold}${red}  MAC80211${reset}: ${yellow}${mac80211_version}${reset}"
+echo -e "${bold}${red} ATH11K FW${reset}: ${green}${ath11k_fw}${reset}"
 
-echo -e "${bold}${red}     MODEL${reset}: ${white}${model}${reset}"
-echo -e "${bold}${red}   OPENWRT${reset}: ${yellow}${openwrt_rev}${reset}"
-echo -e "${bold}${red}IPQ BRANCH${reset}: ${green}${ipq_branch}${reset}"
-echo -e "${bold}${red}IPQ COMMIT${reset}: ${green}${ipq_commit}${reset}"
-echo -e "${bold}${red}  IPQ DATE${reset}: ${green}${ipq_date}${reset}"
-echo -e "${bold}${red}    NSS FW${reset}: ${cyan}${nss_version}${reset}"
-echo -e "${bold}${red}  MAC80211${reset}: ${white}${mac80211_version}${reset}${reset}"
-echo -e "${bold}${red} ATH11K FW${reset}: ${cyan}${ath11k_fw}${reset}"
+# Display GRO Fragmentation status using BusyBox
 echo -ne "${bold}${red}  GRO FRAG${reset}: ${white}"
-
-count=0
-
-for i in wan br-lan /sys/class/net/br-lan/brif/*; do
-  i=${i##*\/}
-  ethtool -k ${i} | awk -v count=$count -v i=$i -v white=$white -v green=$green -v r=$reset '
-  /rx-gro-list/ {
-  if(count>0) tab="            "
-  color=red
-  if($2=="off") color=green
-  printf "%s%-11s : %s%s%s\n",tab,i,color,$2,r
-  }'
-  count=$((count + 1))
+n=0
+for iface in /sys/class/net/*; do
+  iface=${iface##*/}
+  [ "$iface" = "lo" -o "$iface" = "miireg" ] && continue
+  gro_status=$(ethtool -k "$iface" 2> /dev/null | awk '/rx-gro-list/{print $2}')
+  gro_status=${gro_status:-"N/A"}
+  color=$green
+  [ "$gro_status" = "on" ] && color=$red
+  [ $n -gt 0 ] && spacing="            "
+  printf "%s%-11s : %b%s%b\n" "$spacing" "$iface" "$color" "$gro_status" "$reset"
+  n=$((n + 1))
 done
 
 echo -e "${reset}"

From d20d1cc4344b0e819515c5d586d4151b8011d3a9 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Tue, 8 Oct 2024 20:16:16 -0400
Subject: [PATCH 192/225] ath11k_nss: only show peer ast warning if NSS is off

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../999-900-bss-transition-handling.patch     | 19 +++++++------------
 1 file changed, 7 insertions(+), 12 deletions(-)

diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch b/package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch
index 92fdd794e40bc4..6b85483b2ec618 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch
@@ -585,7 +585,7 @@
  			continue;
  		}
  
-@@ -3736,11 +3752,10 @@ static void ath11k_dp_rx_update_user_sta
+@@ -3736,7 +3752,7 @@ static void ath11k_dp_rx_update_user_sta
  	if (user_stats->ast_index == 0 || user_stats->ast_index == 0xFFFF)
  		return;
  
@@ -593,13 +593,8 @@
 +	peer = ath11k_peer_find_by_ast(ar, user_stats->ast_index);
  
  	if (peer == NULL) {
--		if (!ar->ab->nss.enabled)
--		  ath11k_warn(ar->ab, "peer ast idx %d can't be found\n",
-+		ath11k_warn(ar->ab, "peer ast idx %d can't be found\n",
- 			    user_stats->ast_index);
- 		return;
- 	}
-@@ -4210,7 +4225,7 @@ int ath11k_peer_rx_frag_setup(struct ath
+ 		if (!ar->ab->nss.enabled)
+@@ -4210,7 +4226,7 @@ int ath11k_peer_rx_frag_setup(struct ath
  
  	spin_lock_bh(&ab->base_lock);
  
@@ -608,7 +603,7 @@
  	if (!peer) {
  		ath11k_warn(ab, "failed to find the peer to set up fragment info\n");
  		spin_unlock_bh(&ab->base_lock);
-@@ -4666,7 +4681,7 @@ static int ath11k_dp_rx_frag_h_mpdu(stru
+@@ -4666,7 +4682,7 @@ static int ath11k_dp_rx_frag_h_mpdu(stru
  		return -EINVAL;
  
  	spin_lock_bh(&ab->base_lock);
@@ -617,7 +612,7 @@
  	if (!peer) {
  		ath11k_warn(ab, "failed to find the peer to de-fragment received fragment peer_id %d\n",
  			    peer_id);
-@@ -4728,7 +4743,7 @@ static int ath11k_dp_rx_frag_h_mpdu(stru
+@@ -4728,7 +4744,7 @@ static int ath11k_dp_rx_frag_h_mpdu(stru
  	del_timer_sync(&rx_tid->frag_timer);
  	spin_lock_bh(&ab->base_lock);
  
@@ -626,7 +621,7 @@
  	if (!peer)
  		goto err_frags_cleanup;
  
-@@ -6392,7 +6407,7 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -6392,7 +6408,7 @@ int ath11k_dp_rx_process_mon_status(stru
  			trace_ath11k_htt_rxdesc(ar, skb->data, log_type, rx_buf_sz);
  
  		ppdu_info->peer_id = HAL_INVALID_PEERID;
@@ -635,7 +630,7 @@
  
  		if (test_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags) &&
  		    pmon->mon_ppdu_status == DP_PPDU_STATUS_START &&
-@@ -6423,7 +6438,7 @@ int ath11k_dp_rx_process_mon_status(stru
+@@ -6423,7 +6439,7 @@ int ath11k_dp_rx_process_mon_status(stru
  		}
  		rcu_read_lock();
  		spin_lock_bh(&ab->base_lock);

From b21957f460e508dfe997ce9c67065e797cd84883 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Mon, 30 Sep 2024 23:33:21 -0400
Subject: [PATCH 193/225] ath11k_nss: Refresh patches for backports 6.11.2

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../068-ath11k-add-rx-histogram-stats.patch   |  6 +-
 ...69-ath11k-add-HE-stats-in-peer-stats.patch |  6 +-
 ...-adding-support-for-mgmt-frame-stats.patch |  6 +-
 ...91-ath11k-add-mgmt-and-data-ack-rssi.patch |  2 +-
 ...-ath11k_nss-add-nss-driver-interface.patch | 14 +--
 .../199-003-ath11k-add-nss-support.patch      | 24 ++---
 ...03-mac80211-ath11k-fw-dynamic-muedca.patch |  4 +-
 ...-ath11k-Add-support-for-dynamic-vlan.patch |  2 +-
 ...207-ath11k-Enable-256_512MB-profiles.patch |  4 +-
 ...load-changes-to-NSS-driver-interface.patch |  2 +-
 ...-support-on-NSS-offload-for-STA-mode.patch | 10 +-
 ...14-ath11k-qos-null-frame-tx-over-wmi.patch |  8 +-
 ...vdev-in-NSS-for-AP_VLAN-vif-handling.patch |  8 +-
 ...-dynamic-VLAN-support-in-NSS-offload.patch | 24 ++---
 ...ow-fast-rx-by-bypassing-stats-update.patch |  6 +-
 .../nss/ath11k/244-ath11k-dp-tx-perf.patch    |  4 +-
 .../300-ath11k-nss-mesh-offload-support.patch |  8 +-
 ...lookup-failure-in-mgmt-tx-completion.patch |  2 +-
 ...30-ath11k-sync-wds_ast_entry-updates.patch |  4 +-
 ...TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch |  2 +-
 ...-fix-clear-peer-keys-during-disassoc.patch |  2 +-
 ...Add-retry-mechanism-for-update_rx_qu.patch |  2 +-
 ...agement-frames-to-firmware-before-wa.patch |  2 +-
 ...th11k-Advertise-TX_QUEUE-mac-hw-flag.patch |  2 +-
 ...k-make-debugfs-sta-htt-stats-modular.patch |  2 +-
 ...11k-Disable-rx_header-tlv-for-2K-SKB.patch |  7 +-
 .../999-336-0002-ath11k-Use-idr_replace.patch |  4 +-
 ...99-802-ath11k-fixup-thermal-throttle.patch | 14 +--
 .../999-900-bss-transition-handling.patch     | 92 +++++++++----------
 ...902-ath11k-fix-WDS-by-disabling-nwds.patch |  4 +-
 .../199-001-mac80211-add-nss-support.patch    | 32 +++----
 ...03-mac80211-ath11k-fw-dynamic-muedca.patch | 10 +-
 ...07-mac80211-add-nss-redirect-support.patch |  8 +-
 ...N-iftype-support-on-NSS-offload-case.patch | 12 +--
 ...-dynamic-VLAN-support-on-NSS-offload.patch |  4 +-
 .../300-ath11k-nss-mesh-offload-support.patch | 16 ++--
 ...TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch |  4 +-
 ...rning-with-monitor-interface-restart.patch |  2 +-
 ...unused-RX_FLAGS-from-mac80211_rx_fla.patch |  4 +-
 ...ncapsulation-of-EAPOL-frames-if-OFFL.patch |  2 +-
 ...se-HW-checksum-offload-only-for-ethm.patch |  2 +-
 ...1-Add-mac-hw-flag-to-avoid-queue-skb.patch |  6 +-
 ...R-for-association-failure-issue-with.patch |  2 +-
 ...75-wifi-mac80211-Changes-for-WDS-MLD.patch | 16 ++--
 ...x-NULL-pointer-access-Klocwork-issue.patch |  8 +-
 ...evert-Remove-generic-ndo_get_stats64.patch |  8 +-
 46 files changed, 206 insertions(+), 207 deletions(-)

diff --git a/package/kernel/mac80211/patches/nss/ath11k/068-ath11k-add-rx-histogram-stats.patch b/package/kernel/mac80211/patches/nss/ath11k/068-ath11k-add-rx-histogram-stats.patch
index 068511ab0e5c4b..3b21ce04e7c083 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/068-ath11k-add-rx-histogram-stats.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/068-ath11k-add-rx-histogram-stats.patch
@@ -29,7 +29,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  
  /* SMBIOS type containing Board Data File Name Extension */
  #define ATH11K_SMBIOS_BDF_EXT_TYPE 0xF8
-@@ -418,6 +420,17 @@ struct ath11k_vif_iter {
+@@ -419,6 +421,17 @@ struct ath11k_vif_iter {
  	struct ath11k_vif *arvif;
  };
  
@@ -47,7 +47,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  struct ath11k_rx_peer_stats {
  	u64 num_msdu;
  	u64 num_mpdu_fcs_ok;
-@@ -429,10 +442,6 @@ struct ath11k_rx_peer_stats {
+@@ -430,10 +443,6 @@ struct ath11k_rx_peer_stats {
  	u64 non_ampdu_msdu_count;
  	u64 stbc_count;
  	u64 beamformed_count;
@@ -58,7 +58,7 @@ Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
  	u64 coding_count[HAL_RX_SU_MU_CODING_MAX];
  	u64 tid_count[IEEE80211_NUM_TIDS + 1];
  	u64 pream_cnt[HAL_RX_PREAMBLE_MAX];
-@@ -440,6 +449,8 @@ struct ath11k_rx_peer_stats {
+@@ -441,6 +450,8 @@ struct ath11k_rx_peer_stats {
  	u64 rx_duration;
  	u64 dcm_count;
  	u64 ru_alloc_cnt[HAL_RX_RU_ALLOC_TYPE_MAX];
diff --git a/package/kernel/mac80211/patches/nss/ath11k/069-ath11k-add-HE-stats-in-peer-stats.patch b/package/kernel/mac80211/patches/nss/ath11k/069-ath11k-add-HE-stats-in-peer-stats.patch
index e121c48a18726a..d1773499512d35 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/069-ath11k-add-HE-stats-in-peer-stats.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/069-ath11k-add-HE-stats-in-peer-stats.patch
@@ -23,7 +23,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  #include "fw.h"
  
  #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
-@@ -511,6 +512,8 @@ struct ath11k_htt_data_stats {
+@@ -512,6 +513,8 @@ struct ath11k_htt_data_stats {
  	u64 bw[ATH11K_COUNTER_TYPE_MAX][ATH11K_BW_NUM];
  	u64 nss[ATH11K_COUNTER_TYPE_MAX][ATH11K_NSS_NUM];
  	u64 gi[ATH11K_COUNTER_TYPE_MAX][ATH11K_GI_NUM];
@@ -32,7 +32,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  };
  
  struct ath11k_htt_tx_stats {
-@@ -518,6 +521,9 @@ struct ath11k_htt_tx_stats {
+@@ -519,6 +522,9 @@ struct ath11k_htt_tx_stats {
  	u64 tx_duration;
  	u64 ba_fails;
  	u64 ack_fails;
@@ -42,7 +42,7 @@ Signed-off-by: Miles Hu <milehu@codeaurora.org>
  };
  
  struct ath11k_per_ppdu_tx_stats {
-@@ -634,11 +640,16 @@ struct ath11k_per_peer_tx_stats {
+@@ -635,11 +641,16 @@ struct ath11k_per_peer_tx_stats {
  	u32 succ_bytes;
  	u32 retry_bytes;
  	u32 failed_bytes;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/142-ath11k-adding-support-for-mgmt-frame-stats.patch b/package/kernel/mac80211/patches/nss/ath11k/142-ath11k-adding-support-for-mgmt-frame-stats.patch
index 78556e5f15c64f..7d33113a097632 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/142-ath11k-adding-support-for-mgmt-frame-stats.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/142-ath11k-adding-support-for-mgmt-frame-stats.patch
@@ -33,7 +33,7 @@
  struct ath11k_vif {
  	u32 vdev_id;
  	enum wmi_vdev_type vdev_type;
-@@ -414,6 +424,7 @@ struct ath11k_vif {
+@@ -415,6 +425,7 @@ struct ath11k_vif {
  	struct ath11k_rekey_data rekey_data;
  
  	struct ath11k_reg_tpc_power_info reg_tpc_info;
@@ -258,7 +258,7 @@
  	ieee80211_tx_status_irqsafe(ar->hw, msdu);
  
  	num_mgmt = atomic_dec_if_positive(&ar->num_pending_mgmt_tx);
-@@ -7545,6 +7576,11 @@ static void ath11k_mgmt_rx_event(struct
+@@ -7547,6 +7578,11 @@ static void ath11k_mgmt_rx_event(struct
  	struct ieee80211_hdr *hdr;
  	u16 fc;
  	struct ieee80211_supported_band *sband;
@@ -270,7 +270,7 @@
  
  	if (ath11k_pull_mgmt_rx_params_tlv(ab, skb, &rx_ev) != 0) {
  		ath11k_warn(ab, "failed to extract mgmt rx event");
-@@ -7610,7 +7646,34 @@ static void ath11k_mgmt_rx_event(struct
+@@ -7612,7 +7648,34 @@ static void ath11k_mgmt_rx_event(struct
  
  	hdr = (struct ieee80211_hdr *)skb->data;
  	fc = le16_to_cpu(hdr->frame_control);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/191-ath11k-add-mgmt-and-data-ack-rssi.patch b/package/kernel/mac80211/patches/nss/ath11k/191-ath11k-add-mgmt-and-data-ack-rssi.patch
index 2261d86b2fabb0..0d1de3b2f45b08 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/191-ath11k-add-mgmt-and-data-ack-rssi.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/191-ath11k-add-mgmt-and-data-ack-rssi.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -10199,6 +10199,8 @@ static int __ath11k_mac_register(struct
+@@ -10211,6 +10211,8 @@ static int __ath11k_mac_register(struct
  		wiphy_ext_feature_set(ar->hw->wiphy,
  				      NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/199-002-ath11k_nss-add-nss-driver-interface.patch b/package/kernel/mac80211/patches/nss/ath11k/199-002-ath11k_nss-add-nss-driver-interface.patch
index 35f5af2e4e4913..4bb181536a3bc0 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/199-002-ath11k_nss-add-nss-driver-interface.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/199-002-ath11k_nss-add-nss-driver-interface.patch
@@ -260,8 +260,8 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
 +	if (!peer) {
 +		spin_unlock_bh(&ab->base_lock);
 +		if(ab->nss.debug_mode)
-+      ath11k_warn(ab, "ath11k_nss: unable to free peer mem, peer_id:%d\n",
-+            peer_id);
++			ath11k_warn(ab, "ath11k_nss: unable to free peer mem, peer_id:%d\n",
++					peer_id);
 +		return;
 +	}
 +
@@ -1298,9 +1298,9 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
 +		preamble_type = ppdu_info->preamble_type;
 +	}
 +
-+        if ((preamble_type == WMI_RATE_PREAMBLE_CCK ||
-+                preamble_type == WMI_RATE_PREAMBLE_OFDM) &&
-+                (ppdu_info->rate < ATH11K_LEGACY_NUM)) {
++	if ((preamble_type == WMI_RATE_PREAMBLE_CCK ||
++		preamble_type == WMI_RATE_PREAMBLE_OFDM) &&
++		(ppdu_info->rate < ATH11K_LEGACY_NUM)) {
 +		rate = ath11k_hal_rx_legacy_rates[ppdu_info->rate];
 +	}
 +
@@ -3017,7 +3017,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	/* TODO: Do we need to enable ANI? */
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -890,6 +890,8 @@ struct ath11k_soc_dp_tx_err_stats {
+@@ -891,6 +891,8 @@ struct ath11k_soc_dp_tx_err_stats {
  	 * idr unavailable etc.
  	 */
  	atomic_t misc_fail;
@@ -3026,7 +3026,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  };
  
  struct ath11k_soc_dp_stats {
-@@ -976,6 +978,7 @@ struct ath11k_base {
+@@ -977,6 +979,7 @@ struct ath11k_base {
  	struct list_head peers;
  	wait_queue_head_t peer_mapping_wq;
  	u8 mac_addr[ETH_ALEN];
diff --git a/package/kernel/mac80211/patches/nss/ath11k/199-003-ath11k-add-nss-support.patch b/package/kernel/mac80211/patches/nss/ath11k/199-003-ath11k-add-nss-support.patch
index 040db3c68f5718..63148a4a922143 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/199-003-ath11k-add-nss-support.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/199-003-ath11k-add-nss-support.patch
@@ -164,7 +164,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
  
-@@ -425,6 +426,9 @@ struct ath11k_vif {
+@@ -426,6 +427,9 @@ struct ath11k_vif {
  
  	struct ath11k_reg_tpc_power_info reg_tpc_info;
  	struct ath11k_mgmt_frame_stats mgmt_stats;
@@ -174,7 +174,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  };
  
  struct ath11k_vif_iter {
-@@ -578,6 +582,9 @@ struct ath11k_sta {
+@@ -579,6 +583,9 @@ struct ath11k_sta {
  #endif
  
  	bool use_4addr_set;
@@ -184,7 +184,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	u16 tcl_metadata;
  
  	/* Protected with ar->data_lock */
-@@ -672,6 +679,9 @@ struct ath11k {
+@@ -673,6 +680,9 @@ struct ath11k {
  	struct ath11k_pdev *pdev;
  	struct ieee80211_hw *hw;
  	struct ath11k_pdev_wmi *wmi;
@@ -194,7 +194,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	struct ath11k_pdev_dp dp;
  	u8 mac_addr[ETH_ALEN];
  	struct ath11k_he ar_he;
-@@ -933,9 +943,11 @@ struct ath11k_base {
+@@ -934,9 +944,11 @@ struct ath11k_base {
  	struct ath11k_htc htc;
  
  	struct ath11k_dp dp;
@@ -380,7 +380,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  }
  
 +void ath11k_dp_rx_from_nss(struct ath11k *ar, struct sk_buff *msdu,
-+                           struct napi_struct *napi)
++			   struct napi_struct *napi)
 +{
 +	struct ieee80211_rx_status rx_status = {0};
 +	struct ath11k_skb_rxcb *rxcb;
@@ -674,7 +674,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	ret = ath11k_wmi_vdev_delete(ar, arvif->vdev_id);
  	if (ret) {
  		ath11k_warn(ar->ab, "failed to delete WMI vdev %d: %d\n",
-@@ -6740,7 +6813,34 @@ static int ath11k_mac_op_add_interface(s
+@@ -6751,7 +6824,34 @@ static int ath11k_mac_op_add_interface(s
  	list_add(&arvif->list, &ar->arvifs);
  	spin_unlock_bh(&ar->data_lock);
  
@@ -710,7 +710,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	nss = get_num_chains(ar->cfg_tx_chainmask) ? : 1;
  	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id,
-@@ -6870,6 +6970,7 @@ err_peer_del:
+@@ -6881,6 +6981,7 @@ err_peer_del:
  	}
  
  err_vdev_del:
@@ -718,7 +718,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	ath11k_mac_vdev_delete(ar, arvif);
  	spin_lock_bh(&ar->data_lock);
  	list_del(&arvif->list);
-@@ -7387,6 +7488,10 @@ ath11k_mac_update_vif_chan(struct ath11k
+@@ -7399,6 +7500,10 @@ ath11k_mac_update_vif_chan(struct ath11k
  				    arvif->vdev_id, ret);
  			continue;
  		}
@@ -729,7 +729,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	}
  
  	/* Restart the internal monitor vdev on new channel */
-@@ -9014,6 +9119,8 @@ static void ath11k_mac_op_sta_statistics
+@@ -9026,6 +9131,8 @@ static void ath11k_mac_op_sta_statistics
  		sinfo->signal_avg += ATH11K_DEFAULT_NOISE_FLOOR;
  
  	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
@@ -738,7 +738,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  }
  
  #if IS_ENABLED(CONFIG_IPV6)
-@@ -9711,6 +9818,7 @@ static const struct ieee80211_ops ath11k
+@@ -9723,6 +9830,7 @@ static const struct ieee80211_ops ath11k
  	.update_vif_offload		= ath11k_mac_op_update_vif_offload,
  	.config                         = ath11k_mac_op_config,
  	.bss_info_changed               = ath11k_mac_op_bss_info_changed,
@@ -746,7 +746,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	.configure_filter		= ath11k_mac_op_configure_filter,
  	.hw_scan                        = ath11k_mac_op_hw_scan,
  	.cancel_hw_scan                 = ath11k_mac_op_cancel_hw_scan,
-@@ -10149,7 +10257,8 @@ static int __ath11k_mac_register(struct
+@@ -10161,7 +10269,8 @@ static int __ath11k_mac_register(struct
  		ieee80211_hw_set(ar->hw, TX_AMPDU_SETUP_IN_HW);
  		ieee80211_hw_set(ar->hw, SUPPORTS_REORDERING_BUFFER);
  		ieee80211_hw_set(ar->hw, SUPPORTS_AMSDU_IN_AMPDU);
@@ -756,7 +756,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	}
  
  	ar->hw->wiphy->features |= NL80211_FEATURE_STATIC_SMPS;
-@@ -10264,6 +10373,9 @@ static int __ath11k_mac_register(struct
+@@ -10276,6 +10385,9 @@ static int __ath11k_mac_register(struct
  	    ab->hw_params.bios_sar_capa)
  		ar->hw->wiphy->sar_capa = ab->hw_params.bios_sar_capa;
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/203-mac80211-ath11k-fw-dynamic-muedca.patch b/package/kernel/mac80211/patches/nss/ath11k/203-mac80211-ath11k-fw-dynamic-muedca.patch
index 0bdc221f6b29cd..7c3b2cc605c0fc 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/203-mac80211-ath11k-fw-dynamic-muedca.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/203-mac80211-ath11k-fw-dynamic-muedca.patch
@@ -40,7 +40,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  	[WMI_TAG_11D_NEW_COUNTRY_EVENT] = {
  		.min_len = sizeof(struct wmi_11d_new_cc_ev) },
  	[WMI_TAG_PER_CHAIN_RSSI_STATS] = {
-@@ -8805,6 +8807,74 @@ out:
+@@ -8807,6 +8809,74 @@ out:
  	kfree(tb);
  }
  
@@ -115,7 +115,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  static void ath11k_wmi_tlv_op_rx(struct ath11k_base *ab, struct sk_buff *skb)
  {
  	struct wmi_cmd_hdr *cmd_hdr;
-@@ -8923,6 +8993,9 @@ static void ath11k_wmi_tlv_op_rx(struct
+@@ -8925,6 +8995,9 @@ static void ath11k_wmi_tlv_op_rx(struct
  	case WMI_11D_NEW_COUNTRY_EVENTID:
  		ath11k_reg_11d_new_cc_event(ab, skb);
  		break;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Add-support-for-dynamic-vlan.patch b/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Add-support-for-dynamic-vlan.patch
index f82f4577603739..1b9cae352afd66 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Add-support-for-dynamic-vlan.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Add-support-for-dynamic-vlan.patch
@@ -369,7 +369,7 @@ Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
  int ath11k_dp_tx(struct ath11k *ar, struct ath11k_vif *arvif,
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -10390,6 +10390,9 @@ static int __ath11k_mac_register(struct
+@@ -10402,6 +10402,9 @@ static int __ath11k_mac_register(struct
  		 */
  		ar->hw->wiphy->interface_modes &= ~BIT(NL80211_IFTYPE_MONITOR);
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Enable-256_512MB-profiles.patch b/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Enable-256_512MB-profiles.patch
index 5c7a9423bda557..37ef93a5574c7b 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Enable-256_512MB-profiles.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/207-ath11k-Enable-256_512MB-profiles.patch
@@ -152,7 +152,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  
  #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
  
-@@ -928,6 +928,11 @@ struct ath11k_msi_config {
+@@ -929,6 +929,11 @@ struct ath11k_msi_config {
  	u16 hw_rev;
  };
  
@@ -164,7 +164,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  /* Master structure to hold the hw data which may be used in core module */
  struct ath11k_base {
  	enum ath11k_hw_rev hw_rev;
-@@ -1085,6 +1090,8 @@ struct ath11k_base {
+@@ -1086,6 +1091,8 @@ struct ath11k_base {
  		DECLARE_BITMAP(fw_features, ATH11K_FW_FEATURE_COUNT);
  	} fw;
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/211-001-ath11k-add-WDS-offload-changes-to-NSS-driver-interface.patch b/package/kernel/mac80211/patches/nss/ath11k/211-001-ath11k-add-WDS-offload-changes-to-NSS-driver-interface.patch
index 687bbd1f6aff46..4d06a032a78d18 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/211-001-ath11k-add-WDS-offload-changes-to-NSS-driver-interface.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/211-001-ath11k-add-WDS-offload-changes-to-NSS-driver-interface.patch
@@ -652,7 +652,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
 -static inline int ath11k_nss_peer_delete(struct ath11k_base *ab, const u8 *addr)
 +static inline int ath11k_nss_peer_delete(struct ath11k_base *ab, u32 vdev_id,
-+                                         const u8 *addr)
++					 const u8 *addr)
  {
  	return 0;
  }
diff --git a/package/kernel/mac80211/patches/nss/ath11k/211-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch b/package/kernel/mac80211/patches/nss/ath11k/211-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch
index 99250b69317817..70d217b8c73650 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/211-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/211-002-ath11k-add-WDS-offload-support-on-NSS-offload-for-STA-mode.patch
@@ -26,7 +26,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -682,6 +682,7 @@ struct ath11k {
+@@ -683,6 +683,7 @@ struct ath11k {
  	struct ath11k_pdev_wmi *wmi;
  #ifdef CPTCFG_ATH11K_NSS_SUPPORT
  	struct ath11k_nss nss;
@@ -34,7 +34,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  #endif
  	struct ath11k_pdev_dp dp;
  	u8 mac_addr[ETH_ALEN];
-@@ -1100,6 +1101,9 @@ struct ath11k_base {
+@@ -1101,6 +1102,9 @@ struct ath11k_base {
  	} testmode;
  #endif
  
@@ -378,7 +378,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 +}
 +
 +void ath11k_peer_ast_cleanup(struct ath11k *ar, struct ath11k_peer *peer,
-+                             bool is_wds, u32 free_wds_count)
++			     bool is_wds, u32 free_wds_count)
 +{
 +	struct ath11k_ast_entry *ast_entry, *tmp;
 +	u32 ast_deleted_count = 0;
@@ -882,7 +882,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		ab->pktlog_defs_checksum = fixed_param.pktlog_defs_checksum;
  		break;
  	case WMI_TAG_ARRAY_FIXED_STRUCT:
-@@ -8875,6 +8953,22 @@ exit:
+@@ -8877,6 +8955,22 @@ exit:
  	kfree(tb);
  }
  
@@ -905,7 +905,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  static void ath11k_wmi_tlv_op_rx(struct ath11k_base *ab, struct sk_buff *skb)
  {
  	struct wmi_cmd_hdr *cmd_hdr;
-@@ -9008,6 +9102,9 @@ static void ath11k_wmi_tlv_op_rx(struct
+@@ -9010,6 +9104,9 @@ static void ath11k_wmi_tlv_op_rx(struct
  	case WMI_P2P_NOA_EVENTID:
  		ath11k_wmi_p2p_noa_event(ab, skb);
  		break;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/214-ath11k-qos-null-frame-tx-over-wmi.patch b/package/kernel/mac80211/patches/nss/ath11k/214-ath11k-qos-null-frame-tx-over-wmi.patch
index d176a926c2722d..80bbf23a58b04d 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/214-ath11k-qos-null-frame-tx-over-wmi.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/214-ath11k-qos-null-frame-tx-over-wmi.patch
@@ -215,7 +215,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	if (!ev) {
  		ath11k_warn(ab, "failed to fetch mgmt tx compl ev");
  		kfree(tb);
-@@ -7836,10 +7894,11 @@ exit:
+@@ -7838,10 +7896,11 @@ exit:
  
  static void ath11k_mgmt_tx_compl_event(struct ath11k_base *ab, struct sk_buff *skb)
  {
@@ -229,7 +229,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  		ath11k_warn(ab, "failed to extract mgmt tx compl event");
  		return;
  	}
-@@ -7852,7 +7911,7 @@ static void ath11k_mgmt_tx_compl_event(s
+@@ -7854,7 +7913,7 @@ static void ath11k_mgmt_tx_compl_event(s
  		goto exit;
  	}
  
@@ -238,7 +238,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  
  	ath11k_dbg(ab, ATH11K_DBG_MGMT,
  		   "event mgmt tx compl ev pdev_id %d, desc_id %d, status %d ack_rssi %d",
-@@ -7863,6 +7922,36 @@ exit:
+@@ -7865,6 +7924,36 @@ exit:
  	rcu_read_unlock();
  }
  
@@ -275,7 +275,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  static struct ath11k *ath11k_get_ar_on_scan_state(struct ath11k_base *ab,
  						  u32 vdev_id,
  						  enum ath11k_scan_state state)
-@@ -9105,6 +9194,10 @@ static void ath11k_wmi_tlv_op_rx(struct
+@@ -9107,6 +9196,10 @@ static void ath11k_wmi_tlv_op_rx(struct
  	case WMI_WDS_PEER_EVENTID:
  		ath11k_wmi_wds_peer_event(ab, skb);
  		break;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/235-002-ath11k-add-support-for-ext-vdev-in-NSS-for-AP_VLAN-vif-handling.patch b/package/kernel/mac80211/patches/nss/ath11k/235-002-ath11k-add-support-for-ext-vdev-in-NSS-for-AP_VLAN-vif-handling.patch
index 07f341cd047d59..8eed908cfc7e1f 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/235-002-ath11k-add-support-for-ext-vdev-in-NSS-for-AP_VLAN-vif-handling.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/235-002-ath11k-add-support-for-ext-vdev-in-NSS-for-AP_VLAN-vif-handling.patch
@@ -215,8 +215,8 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	ath11k_dbg(ar->ab, ATH11K_DBG_NSS, "nss vdev up tx msg success\n");
 +
 +	if (arvif->vif->type == NL80211_IFTYPE_AP)
-+		list_for_each_entry_safe(ap_vlan_arvif, tmp, &arvif->ap_vlan_arvifs,
-+                                         list)
++		list_for_each_entry_safe(ap_vlan_arvif, tmp,
++					 &arvif->ap_vlan_arvifs, list)
 +			if (ap_vlan_arvif->nss.added)
 +				ath11k_nss_ext_vdev_up(ap_vlan_arvif);
  free:
@@ -236,8 +236,8 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	ath11k_dbg(ar->ab, ATH11K_DBG_NSS, "nss vdev down tx msg success\n");
 +
 +	if (arvif->vif->type == NL80211_IFTYPE_AP)
-+		list_for_each_entry_safe(ap_vlan_arvif, tmp, &arvif->ap_vlan_arvifs,
-+                                         list)
++		list_for_each_entry_safe(ap_vlan_arvif, tmp,
++					 &arvif->ap_vlan_arvifs, list)
 +			ath11k_nss_ext_vdev_down(ap_vlan_arvif);
  free:
  	kfree(vdev_msg);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/236-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch b/package/kernel/mac80211/patches/nss/ath11k/236-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch
index 50f78eca0d76fc..360ff2212712b9 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/236-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/236-003-ath11k-add-dynamic-VLAN-support-in-NSS-offload.patch
@@ -69,7 +69,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  struct ath11k_vif {
  	u32 vdev_id;
  	enum wmi_vdev_type vdev_type;
-@@ -431,6 +450,11 @@ struct ath11k_vif {
+@@ -432,6 +451,11 @@ struct ath11k_vif {
  	struct arvif_nss nss;
  #endif
  	struct list_head ap_vlan_arvifs;
@@ -346,7 +346,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 +	} else if (!peer) {
  		/* impossible unless FW goes crazy */
  		ath11k_warn(ab, "peer %pM disappeared!\n", peer_addr);
-+  }
++	}
  
 -	if (sta) {
 -		arsta = ath11k_sta_to_arsta(sta);
@@ -354,7 +354,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
  		switch (key->cipher) {
  		case WLAN_CIPHER_SUITE_TKIP:
-@@ -6889,7 +7063,7 @@ static int ath11k_mac_op_add_interface(s
+@@ -6899,7 +7073,7 @@ static int ath11k_mac_op_add_interface(s
  	if ((vif->type == NL80211_IFTYPE_AP_VLAN ||
  	     vif->type == NL80211_IFTYPE_STATION) && ab->nss.enabled) {
  		if (ath11k_frame_mode == ATH11K_HW_TXRX_ETHERNET &&
@@ -363,7 +363,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  			vif->offload_flags |= IEEE80211_OFFLOAD_ENCAP_4ADDR;
  			arvif->nss.encap = ATH11K_HW_TXRX_ETHERNET;
  			arvif->nss.decap = ATH11K_HW_TXRX_ETHERNET;
-@@ -6902,6 +7076,7 @@ static int ath11k_mac_op_add_interface(s
+@@ -6912,6 +7086,7 @@ static int ath11k_mac_op_add_interface(s
  					    vif->addr, ret);
  				goto err;
  			}
@@ -371,7 +371,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  			mutex_unlock(&ar->conf_mutex);
  			return ret;
  		}
-@@ -6926,6 +7101,20 @@ static int ath11k_mac_op_add_interface(s
+@@ -6937,6 +7112,20 @@ static int ath11k_mac_op_add_interface(s
  	arvif->vdev_id = bit;
  	arvif->vdev_subtype = WMI_VDEV_SUBTYPE_NONE;
  
@@ -392,7 +392,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	switch (vif->type) {
  	case NL80211_IFTYPE_UNSPECIFIED:
  	case NL80211_IFTYPE_STATION:
-@@ -6975,7 +7164,7 @@ static int ath11k_mac_op_add_interface(s
+@@ -6986,7 +7175,7 @@ static int ath11k_mac_op_add_interface(s
  	if (ret) {
  		ath11k_warn(ab, "failed to create WMI vdev %d: %d\n",
  			    arvif->vdev_id, ret);
@@ -401,7 +401,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	}
  
  	ar->num_created_vdevs++;
-@@ -7140,7 +7329,7 @@ err_peer_del:
+@@ -7151,7 +7340,7 @@ err_peer_del:
  		if (fbret) {
  			ath11k_warn(ar->ab, "fallback fail to delete peer addr %pM vdev_id %d ret %d\n",
  				    vif->addr, arvif->vdev_id, fbret);
@@ -410,7 +410,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		}
  	}
  
-@@ -7151,6 +7340,8 @@ err_vdev_del:
+@@ -7162,6 +7351,8 @@ err_vdev_del:
  	list_del(&arvif->list);
  	spin_unlock_bh(&ar->data_lock);
  
@@ -419,7 +419,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  err:
  	mutex_unlock(&ar->conf_mutex);
  
-@@ -7248,6 +7439,7 @@ err_vdev_del:
+@@ -7260,6 +7451,7 @@ err_vdev_del:
  	list_del(&arvif->list);
  	spin_unlock_bh(&ar->data_lock);
  
@@ -427,7 +427,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	ath11k_peer_cleanup(ar, arvif->vdev_id);
  
  	idr_for_each(&ar->txmgmt_idr,
-@@ -9872,6 +10064,33 @@ static int ath11k_mac_station_remove(str
+@@ -9884,6 +10076,33 @@ static int ath11k_mac_station_remove(str
  	return ret;
  }
  
@@ -461,7 +461,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  static int ath11k_mac_op_sta_state(struct ieee80211_hw *hw,
  				   struct ieee80211_vif *vif,
  				   struct ieee80211_sta *sta,
-@@ -9961,6 +10180,34 @@ static int ath11k_mac_op_sta_state(struc
+@@ -9973,6 +10192,34 @@ static int ath11k_mac_op_sta_state(struc
  			if (ret)
  				ath11k_warn(ar->ab, "Unable to authorize peer %pM vdev %d: %d\n",
  					    sta->addr, arvif->vdev_id, ret);
@@ -496,7 +496,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		}
  
  		if (!ret &&
-@@ -10575,8 +10822,11 @@ static int __ath11k_mac_register(struct
+@@ -10587,8 +10834,11 @@ static int __ath11k_mac_register(struct
  	    ab->hw_params.bios_sar_capa)
  		ar->hw->wiphy->sar_capa = ab->hw_params.bios_sar_capa;
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch b/package/kernel/mac80211/patches/nss/ath11k/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
index 80f4f3d5cb0abb..b73f78772b8fda 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/237-006-ath11k-Allow-fast-rx-by-bypassing-stats-update.patch
@@ -29,7 +29,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  };
  
  enum ath11k_hw_rev {
-@@ -1129,6 +1130,7 @@ struct ath11k_base {
+@@ -1130,6 +1131,7 @@ struct ath11k_base {
  	u32 max_ast_index;
  	u32 num_ast_entries;
  
@@ -124,7 +124,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		goto out;
  	}
 +	debugfs_create_file("stats_disable", 0600, ab->debugfs_soc, ab,
-+                            &fops_soc_stats_disable);
++				    &fops_soc_stats_disable);
  
  	ret = 0;
  
@@ -425,7 +425,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  	bool (*rx_desc_get_mpdu_fc_valid)(struct hal_rx_desc *desc);
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -10234,6 +10234,14 @@ static int ath11k_mac_op_sta_state(struc
+@@ -10246,6 +10246,14 @@ static int ath11k_mac_op_sta_state(struc
  		}
  	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
  		   new_state == IEEE80211_STA_ASSOC) {
diff --git a/package/kernel/mac80211/patches/nss/ath11k/244-ath11k-dp-tx-perf.patch b/package/kernel/mac80211/patches/nss/ath11k/244-ath11k-dp-tx-perf.patch
index dc8d17f95bf445..11c07f2f5deafa 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/244-ath11k-dp-tx-perf.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/244-ath11k-dp-tx-perf.patch
@@ -34,7 +34,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  };
  
  struct ath11k_skb_cb {
-@@ -924,10 +925,13 @@ struct ath11k_dp_ring_bp_stats {
+@@ -925,10 +926,13 @@ struct ath11k_dp_ring_bp_stats {
  struct ath11k_soc_dp_tx_err_stats {
  	/* TCL Ring Descriptor unavailable */
  	u32 desc_na[DP_TCL_NUM_RING_MAX];
@@ -454,7 +454,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
  		ieee80211_free_txskb(ar->hw, skb);
  		return;
  	}
-@@ -7445,7 +7455,7 @@ err_vdev_del:
+@@ -7457,7 +7467,7 @@ err_vdev_del:
  	idr_for_each(&ar->txmgmt_idr,
  		     ath11k_mac_vif_txmgmt_idr_remove, vif);
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch b/package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch
index c1e3d63e5963bd..32ad0a5b549bd2 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/300-ath11k-nss-mesh-offload-support.patch
@@ -1257,7 +1257,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  	mutex_unlock(&ar->conf_mutex);
  }
  
-@@ -10274,6 +10286,28 @@ static int ath11k_mac_op_sta_state(struc
+@@ -10286,6 +10298,28 @@ static int ath11k_mac_op_sta_state(struc
  	return ret;
  }
  
@@ -1286,7 +1286,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  static const struct ieee80211_ops ath11k_ops = {
  	.tx				= ath11k_mac_op_tx,
  	.wake_tx_queue			= ieee80211_handle_wake_tx_queue,
-@@ -10332,6 +10366,9 @@ static const struct ieee80211_ops ath11k
+@@ -10344,6 +10378,9 @@ static const struct ieee80211_ops ath11k
  	.set_sar_specs			= ath11k_mac_op_set_bios_sar_specs,
  	.remain_on_channel		= ath11k_mac_op_remain_on_channel,
  	.cancel_remain_on_channel	= ath11k_mac_op_cancel_remain_on_channel,
@@ -1296,7 +1296,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
  };
  
  static void ath11k_mac_update_ch_list(struct ath11k *ar,
-@@ -10844,6 +10881,8 @@ static int __ath11k_mac_register(struct
+@@ -10856,6 +10893,8 @@ static int __ath11k_mac_register(struct
  		ieee80211_hw_set(ar->hw, SUPPORTS_NSS_OFFLOAD);
  		wiphy_ext_feature_set(ar->hw->wiphy,
  				      NL80211_EXT_FEATURE_VLAN_OFFLOAD);
@@ -3272,7 +3272,7 @@ Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
 +				enum ieee80211_mesh_path_offld_cmd cmd,
 +				struct ieee80211_mesh_path_offld *path)
 +{
-+  return 0;
++	return 0;
 +}
 +#endif
 +int ath11k_nss_mesh_config_update(struct ieee80211_vif *vif, int changed);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/314-ath11k-Fix-peer-lookup-failure-in-mgmt-tx-completion.patch b/package/kernel/mac80211/patches/nss/ath11k/314-ath11k-Fix-peer-lookup-failure-in-mgmt-tx-completion.patch
index 7a97e10ddc4415..5a3497c1ee0bb2 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/314-ath11k-Fix-peer-lookup-failure-in-mgmt-tx-completion.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/314-ath11k-Fix-peer-lookup-failure-in-mgmt-tx-completion.patch
@@ -23,7 +23,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -7464,8 +7464,10 @@ err_vdev_del:
+@@ -7476,8 +7476,10 @@ err_vdev_del:
  	kfree(arvif->vlan_keyid_map);
  	ath11k_peer_cleanup(ar, arvif->vdev_id);
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/330-ath11k-sync-wds_ast_entry-updates.patch b/package/kernel/mac80211/patches/nss/ath11k/330-ath11k-sync-wds_ast_entry-updates.patch
index 4434bd0add243c..504d3b959b1c3e 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/330-ath11k-sync-wds_ast_entry-updates.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/330-ath11k-sync-wds_ast_entry-updates.patch
@@ -83,7 +83,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  #include "fw.h"
  
  #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
-@@ -1133,6 +1134,9 @@ struct ath11k_base {
+@@ -1134,6 +1135,9 @@ struct ath11k_base {
  
  	u32 max_ast_index;
  	u32 num_ast_entries;
@@ -358,7 +358,7 @@ Signed-off-by: Rameshkumar Sundaram <ramess@codeaurora.org>
  		return 0;
  
 +	if (peer && peer->delete_in_progress)
-+                return -EINVAL;
++		return -EINVAL;
 +
  	ast_entry->vdev_id = peer->vdev_id;
  	ast_entry->pdev_idx = peer->pdev_idx;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch b/package/kernel/mac80211/patches/nss/ath11k/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
index 0bf4fccf827d79..ddce2ead1ba3ae 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
@@ -58,7 +58,7 @@ Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
  	tcl_cmd.info3 = FIELD_PREP(HAL_TCL_DATA_CMD_INFO3_DSCP_TID_TABLE_IDX,
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -10767,6 +10767,8 @@ static int __ath11k_mac_register(struct
+@@ -10779,6 +10779,8 @@ static int __ath11k_mac_register(struct
  			ieee80211_hw_set(ar->hw, USES_RSS);
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/357-ath11k-fix-clear-peer-keys-during-disassoc.patch b/package/kernel/mac80211/patches/nss/ath11k/357-ath11k-fix-clear-peer-keys-during-disassoc.patch
index ce615da68a16b2..7bf1eadb9431d3 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/357-ath11k-fix-clear-peer-keys-during-disassoc.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/357-ath11k-fix-clear-peer-keys-during-disassoc.patch
@@ -30,7 +30,7 @@ Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
  	return 0;
  }
  
-@@ -10186,6 +10180,17 @@ static int ath11k_mac_op_sta_state(struc
+@@ -10198,6 +10192,17 @@ static int ath11k_mac_op_sta_state(struc
  		arsta->bw = ath11k_mac_ieee80211_sta_bw_to_wmi(ar, sta);
  		arsta->bw_prev = arsta->bw;
  		spin_unlock_bh(&ar->data_lock);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/373-ath11k-Add-retry-mechanism-for-update_rx_qu.patch b/package/kernel/mac80211/patches/nss/ath11k/373-ath11k-Add-retry-mechanism-for-update_rx_qu.patch
index 487ec5513f18b2..dcc20f88098fe3 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/373-ath11k-Add-retry-mechanism-for-update_rx_qu.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/373-ath11k-Add-retry-mechanism-for-update_rx_qu.patch
@@ -41,7 +41,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -943,6 +943,9 @@ struct ath11k_soc_dp_stats {
+@@ -944,6 +944,9 @@ struct ath11k_soc_dp_stats {
  	u32 rxdma_error[HAL_REO_ENTR_RING_RXDMA_ECODE_MAX];
  	u32 reo_error[HAL_REO_DEST_RING_ERROR_CODE_MAX];
  	u32 hal_reo_error[DP_REO_DST_RING_MAX];
diff --git a/package/kernel/mac80211/patches/nss/ath11k/453-ath11k-flush-management-frames-to-firmware-before-wa.patch b/package/kernel/mac80211/patches/nss/ath11k/453-ath11k-flush-management-frames-to-firmware-before-wa.patch
index 4501664c810371..9321d845c6e77e 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/453-ath11k-flush-management-frames-to-firmware-before-wa.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/453-ath11k-flush-management-frames-to-firmware-before-wa.patch
@@ -27,7 +27,7 @@ Signed-off-by: Hari Chandrakanthan <quic_haric@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -8688,6 +8688,8 @@ static int ath11k_mac_flush_tx_complete(
+@@ -8700,6 +8700,8 @@ static int ath11k_mac_flush_tx_complete(
  		ret = -ETIMEDOUT;
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/456-wifi-ath11k-Advertise-TX_QUEUE-mac-hw-flag.patch b/package/kernel/mac80211/patches/nss/ath11k/456-wifi-ath11k-Advertise-TX_QUEUE-mac-hw-flag.patch
index 27e1e9506edaa6..124f62f9242fd5 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/456-wifi-ath11k-Advertise-TX_QUEUE-mac-hw-flag.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/456-wifi-ath11k-Advertise-TX_QUEUE-mac-hw-flag.patch
@@ -13,7 +13,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -10758,6 +10758,7 @@ static int __ath11k_mac_register(struct
+@@ -10770,6 +10770,7 @@ static int __ath11k_mac_register(struct
  	ieee80211_hw_set(ar->hw, QUEUE_CONTROL);
  	ieee80211_hw_set(ar->hw, SUPPORTS_TX_FRAG);
  	ieee80211_hw_set(ar->hw, REPORTS_LOW_ACK);
diff --git a/package/kernel/mac80211/patches/nss/ath11k/908-ath11k-make-debugfs-sta-htt-stats-modular.patch b/package/kernel/mac80211/patches/nss/ath11k/908-ath11k-make-debugfs-sta-htt-stats-modular.patch
index 21cd546db8f07d..a7968c4e10f387 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/908-ath11k-make-debugfs-sta-htt-stats-modular.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/908-ath11k-make-debugfs-sta-htt-stats-modular.patch
@@ -176,7 +176,7 @@
  	spin_unlock_bh(&ab->base_lock);
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -10364,7 +10364,7 @@ static const struct ieee80211_ops ath11k
+@@ -10376,7 +10376,7 @@ static const struct ieee80211_ops ath11k
  	.set_wakeup			= ath11k_wow_op_set_wakeup,
  #endif
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch b/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
index ed4dc540b14ec9..3de8497a321a2f 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
@@ -688,13 +688,13 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
 +static bool ath11k_hw_qcn9074_rx_desc_mac_addr2_valid(struct hal_rx_desc *desc)
  {
 -	return &desc->u.ipq8074.msdu_payload[0];
-+        return __le32_to_cpu(desc->u.qcn9074.mpdu_start.info11) &
++	return __le32_to_cpu(desc->u.qcn9074.mpdu_start.info11) &
 +	       RX_MPDU_START_INFO11_MAC_ADDR2_VALID;
 +}
 +
 +static u8* ath11k_hw_qcn9074_rx_desc_mpdu_start_addr2(struct hal_rx_desc *desc)
 +{
-+        return desc->u.qcn9074.mpdu_start.addr2;
++	return desc->u.qcn9074.mpdu_start.addr2;
  }
  
  static bool ath11k_hw_qcn9074_rx_desc_get_first_msdu(struct hal_rx_desc *desc)
@@ -943,7 +943,7 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
  		ret = ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id,
 --- a/drivers/net/wireless/ath/ath11k/rx_desc.h
 +++ b/drivers/net/wireless/ath/ath11k/rx_desc.h
-@@ -1508,4 +1508,17 @@ struct hal_rx_desc {
+@@ -1508,4 +1508,16 @@ struct hal_rx_desc {
  #define RU_484 18
  #define RU_996 37
  
@@ -958,7 +958,6 @@ Signed-off-by: Ramya Gnanasekar <rgnanase@codeaurora.org>
 +
 +#define HAL_RX_MPDU_INFO_PN_GET_BYTE4(__val) \
 +	FIELD_GET(GENMASK(31, 24), __le32_to_cpu(__val))
-+
 +
  #endif /* ATH11K_RX_DESC_H */
 --- a/drivers/net/wireless/ath/ath11k/nss.c
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch b/package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch
index 0cccb5e5bcf025..aa0f1f80af5d41 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-336-0002-ath11k-Use-idr_replace.patch
@@ -18,7 +18,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
 
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -703,6 +703,11 @@ struct ath11k_per_peer_tx_stats {
+@@ -704,6 +704,11 @@ struct ath11k_per_peer_tx_stats {
  #define ATH11K_FLUSH_TIMEOUT (5 * HZ)
  #define ATH11K_VDEV_DELETE_TIMEOUT_HZ (5 * HZ)
  
@@ -30,7 +30,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  struct ath11k {
  	struct ath11k_base *ab;
  	struct ath11k_pdev *pdev;
-@@ -852,6 +857,7 @@ struct ath11k {
+@@ -853,6 +858,7 @@ struct ath11k {
  	bool ps_state_enable;
  	bool ps_timekeeper_enable;
  	s8 max_allowed_tx_power;
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-802-ath11k-fixup-thermal-throttle.patch b/package/kernel/mac80211/patches/nss/ath11k/999-802-ath11k-fixup-thermal-throttle.patch
index b40066e24dbd83..6b9626b423f547 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-802-ath11k-fixup-thermal-throttle.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-802-ath11k-fixup-thermal-throttle.patch
@@ -137,7 +137,7 @@
  #define ATH11K_HWMON_NAME_LEN           15
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
-@@ -3237,6 +3237,7 @@ ath11k_wmi_send_thermal_mitigation_param
+@@ -3236,6 +3236,7 @@ ath11k_wmi_send_thermal_mitigation_param
  		lvl_conf->temp_hwm = param->levelconf[i].tmphwm;
  		lvl_conf->dc_off_percent = param->levelconf[i].dcoffpercent;
  		lvl_conf->prio = param->levelconf[i].priority;
@@ -168,11 +168,11 @@
  };
  
 +typedef enum {
-+    WMI_THERMAL_CLIENT_UNSPECIFIED = 0,
-+    WMI_THERMAL_CLIENT_APPS        = 1,
-+    WMI_THERMAL_CLIENT_WPSS        = 2,
-+    WMI_THERMAL_CLIENT_FW          = 3,
-+    WMI_THERMAL_CLIENT_MAX
++	WMI_THERMAL_CLIENT_UNSPECIFIED = 0,
++	WMI_THERMAL_CLIENT_APPS        = 1,
++	WMI_THERMAL_CLIENT_WPSS        = 2,
++	WMI_THERMAL_CLIENT_FW          = 3,
++	WMI_THERMAL_CLIENT_MAX
 +} WMI_THERMAL_MITIGATION_CLIENTS;
 +
  struct wmi_therm_throt_config_request_cmd {
@@ -229,7 +229,7 @@
  struct wmi_delba_send_cmd {
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -6683,6 +6683,9 @@ static int ath11k_mac_op_start(struct ie
+@@ -6704,6 +6704,9 @@ static int ath11k_mac_op_start(struct ie
  		}
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch b/package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch
index 6b85483b2ec618..ab66b9306b138f 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch
@@ -31,7 +31,7 @@
  	INIT_WORK(&ab->restart_work, ath11k_core_restart);
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -740,9 +740,22 @@ struct ath11k {
+@@ -741,9 +741,22 @@ struct ath11k {
  			iftype[NUM_NL80211_BANDS][NUM_NL80211_IFTYPES];
  	} mac;
  
@@ -54,7 +54,7 @@
  	u32 min_tx_power;
  	u32 max_tx_power;
  	u32 txpower_limit_2g;
-@@ -820,6 +833,9 @@ struct ath11k {
+@@ -821,6 +834,9 @@ struct ath11k {
  	struct work_struct wmi_mgmt_tx_work;
  	struct sk_buff_head wmi_mgmt_tx_queue;
  
@@ -64,7 +64,7 @@
  	struct ath11k_wow wow;
  	struct completion target_suspend;
  	bool target_suspend_ack;
-@@ -1023,19 +1039,7 @@ struct ath11k_base {
+@@ -1024,19 +1040,7 @@ struct ath11k_base {
  	struct ath11k_hal_reg_capabilities_ext hal_reg_cap[MAX_RADIOS];
  	unsigned long long free_vdev_map;
  
@@ -84,7 +84,7 @@
  	u8 mac_addr[ETH_ALEN];
  	int userpd_id;
  	int irq_num[ATH11K_IRQ_NUM_MAX];
-@@ -1412,4 +1416,36 @@ static inline const char *ath11k_bus_str
+@@ -1413,4 +1417,36 @@ static inline const char *ath11k_bus_str
  	return "unknown";
  }
  
@@ -784,7 +784,7 @@
  
  	ar->num_peers = 0;
  	ar->num_stations = 0;
-@@ -3187,7 +3187,7 @@ static void ath11k_bss_assoc(struct ieee
+@@ -3208,7 +3208,7 @@ static void ath11k_bss_assoc(struct ieee
  
  	spin_lock_bh(&ar->ab->base_lock);
  
@@ -793,7 +793,7 @@
  	if (peer && peer->is_authorized)
  		is_auth = true;
  
-@@ -4349,7 +4349,7 @@ static int ath11k_clear_peer_keys(struct
+@@ -4370,7 +4370,7 @@ static int ath11k_clear_peer_keys(struct
  	lockdep_assert_held(&ar->conf_mutex);
  
  	spin_lock_bh(&ab->base_lock);
@@ -802,7 +802,7 @@
  	if (!peer) {
  		spin_unlock_bh(&ab->base_lock);
  		return -ENOENT;
-@@ -4465,7 +4465,7 @@ static int ath11k_mac_op_set_key(struct
+@@ -4486,7 +4486,7 @@ static int ath11k_mac_op_set_key(struct
  	 * we already hold conf_mutex. we just make sure its there now.
  	 */
  	spin_lock_bh(&ab->base_lock);
@@ -811,7 +811,7 @@
  
  	/* flush the fragments cache during key (re)install to
  	 * ensure all frags in the new frag list belong to the same key.
-@@ -4574,7 +4574,7 @@ static int ath11k_mac_op_set_key(struct
+@@ -4595,7 +4595,7 @@ static int ath11k_mac_op_set_key(struct
  	}
  
  	spin_lock_bh(&ab->base_lock);
@@ -820,7 +820,7 @@
  
  	/* TODO: Check if vdev specific security cfg is mandatory */
  	ret = ath11k_nss_vdev_set_cmd(arvif, ATH11K_NSS_WIFI_VDEV_SECURITY_TYPE_CMD, key->cipher);
-@@ -4605,7 +4605,7 @@ static int ath11k_mac_op_set_key(struct
+@@ -4626,7 +4626,7 @@ static int ath11k_mac_op_set_key(struct
  		list_for_each_entry_safe(dyn_vlan_cfg, tmp, &ap_vlan_arvif->dyn_vlan_cfg, cfg_list) {
  			struct ieee80211_sta *vlan_sta = dyn_vlan_cfg->sta;
  
@@ -829,7 +829,7 @@
  			if (ret)
  				ath11k_warn(ar->ab, "failed to cfg dyn vlan for peer %pM: %d\n",
  					    vlan_sta->addr, ret);
-@@ -5215,7 +5215,7 @@ static void ath11k_sta_set_4addr_wk(stru
+@@ -5236,7 +5236,7 @@ static void ath11k_sta_set_4addr_wk(stru
  	vif = ap_vlan_arvif->vif;
  
  	spin_lock_bh(&ab->base_lock);
@@ -838,7 +838,7 @@
  	if (!wds_peer) {
  		spin_unlock_bh(&ab->base_lock);
  		ath11k_warn(ab, "mac sta use 4addr failed to find peer %pM\n",
-@@ -5438,7 +5438,7 @@ static void ath11k_mac_op_sta_rc_update(
+@@ -5459,7 +5459,7 @@ static void ath11k_mac_op_sta_rc_update(
  
  	spin_lock_bh(&ar->ab->base_lock);
  
@@ -847,7 +847,7 @@
  	if (!peer) {
  		spin_unlock_bh(&ar->ab->base_lock);
  		ath11k_warn(ar->ab, "mac sta rc update failed to find peer %pM on vdev %i\n",
-@@ -8463,7 +8463,7 @@ ath11k_mac_op_assign_vif_chanctx(struct
+@@ -8496,7 +8496,7 @@ ath11k_mac_op_assign_vif_chanctx(struct
  	if (ab->hw_params.vdev_start_delay &&
  	    arvif->vdev_type != WMI_VDEV_TYPE_AP &&
  	    arvif->vdev_type != WMI_VDEV_TYPE_MONITOR &&
@@ -856,7 +856,7 @@
  		memcpy(&arvif->chanctx, ctx, sizeof(*ctx));
  		ret = 0;
  		goto out;
-@@ -8539,7 +8539,7 @@ ath11k_mac_op_unassign_vif_chanctx(struc
+@@ -8572,7 +8572,7 @@ ath11k_mac_op_unassign_vif_chanctx(struc
  	if (ab->hw_params.vdev_start_delay &&
  	    arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
  		spin_lock_bh(&ab->base_lock);
@@ -865,7 +865,7 @@
  		spin_unlock_bh(&ab->base_lock);
  		if (peer)
  			ath11k_peer_delete(ar, arvif->vdev_id, ar->mac_addr);
-@@ -9113,7 +9113,7 @@ ath11k_mac_validate_vht_he_fixed_rate_se
+@@ -9146,7 +9146,7 @@ ath11k_mac_validate_vht_he_fixed_rate_se
  
  	rcu_read_lock();
  	spin_lock_bh(&ar->ab->base_lock);
@@ -874,7 +874,7 @@
  		if (peer->sta) {
  			deflink = &peer->sta->deflink;
  
-@@ -10069,26 +10069,26 @@ static int ath11k_mac_station_remove(str
+@@ -10102,26 +10102,26 @@ static int ath11k_mac_station_remove(str
  	return ret;
  }
  
@@ -908,7 +908,7 @@
  			    sta->addr, ret);
  		return ret;
  	}
-@@ -10138,20 +10138,20 @@ static int ath11k_mac_op_sta_state(struc
+@@ -10171,20 +10171,20 @@ static int ath11k_mac_op_sta_state(struc
  			ath11k_warn(ar->ab, "Failed to remove station: %pM for VDEV: %d\n",
  				    sta->addr, arvif->vdev_id);
  
@@ -933,7 +933,7 @@
  	} else if (old_state == IEEE80211_STA_AUTH &&
  		   new_state == IEEE80211_STA_ASSOC &&
  		   (vif->type == NL80211_IFTYPE_AP ||
-@@ -10182,7 +10182,7 @@ static int ath11k_mac_op_sta_state(struc
+@@ -10215,7 +10215,7 @@ static int ath11k_mac_op_sta_state(struc
  		   new_state == IEEE80211_STA_AUTHORIZED) {
  		spin_lock_bh(&ar->ab->base_lock);
  
@@ -942,7 +942,7 @@
  		if (peer)
  			peer->is_authorized = true;
  
-@@ -10219,7 +10219,7 @@ static int ath11k_mac_op_sta_state(struc
+@@ -10252,7 +10252,7 @@ static int ath11k_mac_op_sta_state(struc
  					list_add_tail(&ar_dyn_vlan_cfg->cfg_list, &arvif->dyn_vlan_cfg);
  				}
  			} else {
@@ -951,7 +951,7 @@
  				if (ret)
  					ath11k_warn(ar->ab, "failed to cfg dyn vlan for peer %pM: %d\n",
  						    sta->addr, ret);
-@@ -10252,7 +10252,7 @@ static int ath11k_mac_op_sta_state(struc
+@@ -10285,7 +10285,7 @@ static int ath11k_mac_op_sta_state(struc
  		   new_state == IEEE80211_STA_ASSOC) {
  
  		spin_lock_bh(&ar->ab->base_lock);
@@ -960,7 +960,7 @@
  		if (peer)
  			peer->is_authorized = false;
  		spin_unlock_bh(&ar->ab->base_lock);
-@@ -10260,7 +10260,7 @@ static int ath11k_mac_op_sta_state(struc
+@@ -10293,7 +10293,7 @@ static int ath11k_mac_op_sta_state(struc
  		   new_state == IEEE80211_STA_ASSOC) {
  		spin_lock_bh(&ar->ab->base_lock);
  
@@ -969,7 +969,7 @@
  		if (peer)
  			peer->is_authorized = false;
  
-@@ -10668,9 +10668,9 @@ void ath11k_mac_unregister(struct ath11k
+@@ -10701,9 +10701,9 @@ void ath11k_mac_unregister(struct ath11k
  			continue;
  
  		__ath11k_mac_unregister(ar);
@@ -980,7 +980,7 @@
  }
  
  static int __ath11k_mac_register(struct ath11k *ar)
-@@ -10954,15 +10954,15 @@ int ath11k_mac_register(struct ath11k_ba
+@@ -10987,15 +10987,15 @@ int ath11k_mac_register(struct ath11k_ba
  	ab->cc_freq_hz = IPQ8074_CC_FREQ_HERTZ;
  	ab->free_vdev_map = (1LL << (ab->num_radios * TARGET_NUM_VDEVS(ab))) - 1;
  
@@ -999,7 +999,7 @@
  		if (ab->pdevs_macaddr_valid) {
  			ether_addr_copy(ar->mac_addr, pdev->mac_addr);
  		} else {
-@@ -10990,9 +10990,9 @@ err_cleanup:
+@@ -11023,9 +11023,9 @@ err_cleanup:
  		pdev = &ab->pdevs[i];
  		ar = pdev->ar;
  		__ath11k_mac_unregister(ar);
@@ -1010,7 +1010,7 @@
  
  	return ret;
  }
-@@ -11036,9 +11036,12 @@ int ath11k_mac_allocate(struct ath11k_ba
+@@ -11069,9 +11069,12 @@ int ath11k_mac_allocate(struct ath11k_ba
  		ar->num_rx_chains = get_num_chains(pdev->cap.rx_chain_mask);
  
  		pdev->ar = ar;
@@ -1062,8 +1062,8 @@
 -	if (!peer) {
 -		spin_unlock_bh(&ab->base_lock);
 -		if(ab->nss.debug_mode)
--      ath11k_warn(ab, "ath11k_nss: unable to free peer mem, peer_id:%d\n",
--            peer_id);
+-			ath11k_warn(ab, "ath11k_nss: unable to free peer mem, peer_id:%d\n",
+-					peer_id);
 -		return;
 -	}
 +	for (i = 0; i < ab->num_radios; i++) {
@@ -1141,20 +1141,20 @@
 -static void ath11k_nss_wds_type_rx(struct ath11k *ar, struct net_device *dev,
 +static bool vdev_check_local_dev(u8 *wds_src_mac)
 +{
-+    struct net_device *dev = NULL;
++	struct net_device *dev = NULL;
 +
-+    rcu_read_lock();
-+    for_each_netdev_rcu(&init_net, dev) {
-+        if (!dev) {
-+            continue;
-+        }
-+        if (!memcmp(dev->dev_addr, wds_src_mac, 6)) {
-+            rcu_read_unlock();
-+            return true;
-+        }
-+    }
-+    rcu_read_unlock();
-+    return false;
++	rcu_read_lock();
++	for_each_netdev_rcu(&init_net, dev) {
++		if (!dev) {
++			continue;
++		}
++		if (!memcmp(dev->dev_addr, wds_src_mac, 6)) {
++			rcu_read_unlock();
++			return true;
++		}
++	}
++	rcu_read_unlock();
++	return false;
 +}
 +
 +static void ath11k_nss_wds_type_rx(struct ath11k_vif *arvif, struct net_device *dev,
@@ -1399,7 +1399,7 @@
  
 -static inline int ath11k_nss_peer_delete(struct ath11k_base *ab, u32 vdev_id,
 +static inline int ath11k_nss_peer_delete(struct ath11k *ar, u32 vdev_id,
-                                          const u8 *addr)
+ 					 const u8 *addr)
  {
  	return 0;
 --- a/drivers/net/wireless/ath/ath11k/peer.c
@@ -1593,7 +1593,7 @@
  	if (ast_entry) {
  		ast_entry->ast_idx = hw_peer_id;
 @@ -418,6 +386,7 @@ void ath11k_peer_ast_cleanup(struct ath1
-                              bool is_wds, u32 free_wds_count)
+ 			     bool is_wds, u32 free_wds_count)
  {
  	struct ath11k_ast_entry *ast_entry, *tmp;
 +	struct ath11k_base *ab = ar->ab;
@@ -2429,7 +2429,7 @@
  {
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
-@@ -7624,10 +7624,12 @@ static void ath11k_wmi_event_peer_sta_ps
+@@ -7626,10 +7626,12 @@ static void ath11k_wmi_event_peer_sta_ps
  	struct ieee80211_sta *sta;
  	struct ath11k_peer *peer;
  	struct ath11k *ar;
@@ -2442,7 +2442,7 @@
  
  	tb = ath11k_wmi_tlv_parse_alloc(ab, skb, GFP_ATOMIC);
  	if (IS_ERR(tb)) {
-@@ -7651,64 +7653,60 @@ static void ath11k_wmi_event_peer_sta_ps
+@@ -7653,64 +7655,60 @@ static void ath11k_wmi_event_peer_sta_ps
  
  	rcu_read_lock();
  
@@ -2549,7 +2549,7 @@
  	}
  
  out:
-@@ -7828,9 +7826,9 @@ static void ath11k_mgmt_rx_event(struct
+@@ -7830,9 +7828,9 @@ static void ath11k_mgmt_rx_event(struct
  
  	spin_lock_bh(&ab->base_lock);
  
@@ -2561,7 +2561,7 @@
  	if (!peer) {
  		spin_unlock_bh(&ab->base_lock);
  		goto skip_mgmt_stats;
-@@ -8058,9 +8056,8 @@ static void ath11k_peer_sta_kickout_even
+@@ -8060,9 +8058,8 @@ static void ath11k_peer_sta_kickout_even
  {
  	struct wmi_peer_sta_kickout_arg arg = {};
  	struct ieee80211_sta *sta;
@@ -2572,7 +2572,7 @@
  
  	if (ath11k_pull_peer_sta_kickout_ev(ab, skb, &arg) != 0) {
  		ath11k_warn(ab, "failed to extract peer sta kickout event");
-@@ -8069,42 +8066,22 @@ static void ath11k_peer_sta_kickout_even
+@@ -8071,42 +8068,22 @@ static void ath11k_peer_sta_kickout_even
  
  	rcu_read_lock();
  
diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-902-ath11k-fix-WDS-by-disabling-nwds.patch b/package/kernel/mac80211/patches/nss/ath11k/999-902-ath11k-fix-WDS-by-disabling-nwds.patch
index 73a471aaa42f9e..2fa2b082dbeac1 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-902-ath11k-fix-WDS-by-disabling-nwds.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-902-ath11k-fix-WDS-by-disabling-nwds.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -5274,14 +5274,19 @@ skip_nss_ext:
+@@ -5295,14 +5295,19 @@ skip_nss_ext:
  	 * AP vif of the AP_VLAN vif
  	 */
  	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id,
@@ -23,7 +23,7 @@
  	return;
  
  ext_vdev_down:
-@@ -7207,6 +7212,23 @@ static int ath11k_mac_op_add_interface(s
+@@ -7239,6 +7244,23 @@ static int ath11k_mac_op_add_interface(s
  		goto err_vdev_del;
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch b/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch
index 48dab8e186d7ad..a1a39556d3dbcc 100644
--- a/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch
@@ -64,7 +64,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  };
  
  /**
-@@ -1484,7 +1500,7 @@ ieee80211_tx_info_clear_status(struct ie
+@@ -1485,7 +1501,7 @@ ieee80211_tx_info_clear_status(struct ie
   * @RX_FLAG_AMPDU_EOF_BIT_KNOWN: The EOF value is known
   * @RX_FLAG_RADIOTAP_HE: HE radiotap data is present
   *	(&struct ieee80211_radiotap_he, mac80211 will fill in
@@ -73,7 +73,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   *	 - DATA3_DATA_MCS
   *	 - DATA3_DATA_DCM
   *	 - DATA3_CODING
-@@ -1492,7 +1508,7 @@ ieee80211_tx_info_clear_status(struct ie
+@@ -1493,7 +1509,7 @@ ieee80211_tx_info_clear_status(struct ie
   *	 - DATA5_DATA_BW_RU_ALLOC
   *	 - DATA6_NSTS
   *	 - DATA3_STBC
@@ -82,7 +82,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   *	from the RX info data, so leave those zeroed when building this data)
   * @RX_FLAG_RADIOTAP_HE_MU: HE MU radiotap data is present
   *	(&struct ieee80211_radiotap_he_mu)
-@@ -2127,6 +2143,16 @@ static inline bool lockdep_vif_wiphy_mut
+@@ -2128,6 +2144,16 @@ static inline bool lockdep_vif_wiphy_mut
  			      lockdep_vif_wiphy_mutex_held(vif))
  
  /**
@@ -99,7 +99,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   * enum ieee80211_key_flags - key flags
   *
   * These flags are used for communication about keys between the driver
-@@ -2825,6 +2851,8 @@ struct ieee80211_txq {
+@@ -2826,6 +2852,8 @@ struct ieee80211_txq {
   *	implements MLO, so operation can continue on other links when one
   *	link is switching.
   *
@@ -108,7 +108,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
   */
  enum ieee80211_hw_flags {
-@@ -2884,6 +2912,7 @@ enum ieee80211_hw_flags {
+@@ -2885,6 +2913,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_DISALLOW_PUNCTURING,
  	IEEE80211_HW_DISALLOW_PUNCTURING_5GHZ,
  	IEEE80211_HW_HANDLES_QUIET_CSA,
@@ -116,7 +116,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	/* keep last, obviously */
  	NUM_IEEE80211_HW_FLAGS
-@@ -3899,6 +3928,10 @@ struct ieee80211_prep_tx_info {
+@@ -3900,6 +3929,10 @@ struct ieee80211_prep_tx_info {
   *	non-MLO connections.
   *	The callback can sleep.
   *
@@ -127,7 +127,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   * @prepare_multicast: Prepare for multicast filter configuration.
   *	This callback is optional, and its return value is passed
   *	to configure_filter(). This callback must be atomic.
-@@ -4461,7 +4494,9 @@ struct ieee80211_ops {
+@@ -4462,7 +4495,9 @@ struct ieee80211_ops {
  				  struct ieee80211_vif *vif,
  				  struct ieee80211_bss_conf *info,
  				  u64 changed);
@@ -138,7 +138,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	int (*start_ap)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			struct ieee80211_bss_conf *link_conf);
  	void (*stop_ap)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-@@ -4771,7 +4806,7 @@ struct ieee80211_ops {
+@@ -4772,7 +4807,7 @@ struct ieee80211_ops {
  	int (*reset_tid_config)(struct ieee80211_hw *hw,
  				struct ieee80211_vif *vif,
  				struct ieee80211_sta *sta, u8 tids);
@@ -189,14 +189,14 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  }
  
 +void ieee80211_nss_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
-+                                         u64 changed)
++					  u64 changed)
 +{
-+       struct ieee80211_local *local = sdata->local;
++	struct ieee80211_local *local = sdata->local;
 +
-+       if (!changed || sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-+               return;
++	if (!changed || sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
++		return;
 +
-+       drv_nss_bss_info_changed(local, sdata, &sdata->vif.bss_conf, changed);
++	drv_nss_bss_info_changed(local, sdata, &sdata->vif.bss_conf, changed);
 +}
 +
  u64 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata)
@@ -308,7 +308,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
 --- a/net/wireless/util.c
 +++ b/net/wireless/util.c
-@@ -2629,6 +2629,9 @@ bool cfg80211_does_bw_fit_range(const st
+@@ -2631,6 +2631,9 @@ bool cfg80211_does_bw_fit_range(const st
  
  int cfg80211_sinfo_alloc_tid_stats(struct station_info *sinfo, gfp_t gfp)
  {
@@ -375,7 +375,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  {
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1859,6 +1859,8 @@ void ieee80211_vif_cfg_change_notify(str
+@@ -1860,6 +1860,8 @@ void ieee80211_vif_cfg_change_notify(str
  void ieee80211_link_info_change_notify(struct ieee80211_sub_if_data *sdata,
  				       struct ieee80211_link_data *link,
  				       u64 changed);
@@ -427,7 +427,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	TP_PROTO(struct ieee80211_local *local,
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -969,7 +969,8 @@ static bool ieee80211_set_sdata_offload_
+@@ -984,7 +984,8 @@ static bool ieee80211_set_sdata_offload_
  		    local->hw.wiphy->frag_threshold != (u32)-1)
  			flags &= ~IEEE80211_OFFLOAD_ENCAP_ENABLED;
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch b/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
index 512d10633e9673..c5e8e2704869b1 100644
--- a/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
@@ -31,7 +31,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
 
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -9698,4 +9698,15 @@ ssize_t wiphy_locked_debugfs_write(struc
+@@ -9701,4 +9701,15 @@ ssize_t wiphy_locked_debugfs_write(struc
  				   void *data);
  #endif
  
@@ -49,7 +49,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  #endif /* __NET_CFG80211_H */
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -7557,6 +7557,20 @@ u32 ieee80211_calc_rx_airtime(struct iee
+@@ -7561,6 +7561,20 @@ u32 ieee80211_calc_rx_airtime(struct iee
  			      int len);
  
  /**
@@ -111,7 +111,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  	__NL80211_ATTR_AFTER_LAST,
 --- a/net/mac80211/mlme.c
 +++ b/net/mac80211/mlme.c
-@@ -9336,3 +9336,15 @@ void ieee80211_disable_rssi_reports(stru
+@@ -9341,3 +9341,15 @@ void ieee80211_disable_rssi_reports(stru
  	_ieee80211_enable_rssi_reports(sdata, 0, 0);
  }
  EXPORT_SYMBOL(ieee80211_disable_rssi_reports);
@@ -166,7 +166,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  	[NL80211_ATTR_BSS_DUMP_INCLUDE_USE_DATA] = { .type = NLA_FLAG },
  	[NL80211_ATTR_MLO_TTLM_DLINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
  	[NL80211_ATTR_MLO_TTLM_ULINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
-@@ -20367,6 +20368,42 @@ void cfg80211_schedule_channels_check(st
+@@ -20396,6 +20397,42 @@ void cfg80211_schedule_channels_check(st
  }
  EXPORT_SYMBOL(cfg80211_schedule_channels_check);
  
@@ -211,7 +211,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  int __init nl80211_init(void)
 --- a/net/wireless/trace.h
 +++ b/net/wireless/trace.h
-@@ -3957,6 +3957,46 @@ TRACE_EVENT(cfg80211_update_owe_info_eve
+@@ -3975,6 +3975,46 @@ TRACE_EVENT(cfg80211_update_owe_info_eve
  		  __entry->assoc_link_id, __entry->peer_mld_addr)
  );
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch b/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
index 11cd18458422fa..63b2f9e9546d6a 100644
--- a/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
@@ -40,7 +40,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  
  extern const struct cfg80211_ops mac80211_config_ops;
  
-@@ -1184,6 +1187,9 @@ struct ieee80211_sub_if_data {
+@@ -1185,6 +1188,9 @@ struct ieee80211_sub_if_data {
  		struct dentry *default_beacon_key;
  	} debugfs;
  #endif
@@ -65,7 +65,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  /**
   * DOC: Interface list locking
   *
-@@ -759,6 +765,13 @@ static int ieee80211_stop(struct net_dev
+@@ -774,6 +780,13 @@ static int ieee80211_stop(struct net_dev
  		ieee80211_stop_mbssid(sdata);
  	}
  
@@ -79,7 +79,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	wiphy_lock(sdata->local->hw.wiphy);
  	wiphy_work_cancel(sdata->local->hw.wiphy, &sdata->activate_links_work);
  
-@@ -1204,6 +1217,34 @@ void ieee80211_del_virtual_monitor(struc
+@@ -1219,6 +1232,34 @@ void ieee80211_del_virtual_monitor(struc
  	kfree(sdata);
  }
  
@@ -114,7 +114,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  /*
   * NOTE: Be very careful when changing this function, it must NOT return
   * an error on interface type changes that have been pre-checked, so most
-@@ -1431,6 +1472,21 @@ int ieee80211_do_open(struct wireless_de
+@@ -1446,6 +1487,21 @@ int ieee80211_do_open(struct wireless_de
  
  	ieee80211_recalc_ps(local);
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch b/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
index 941a0c87859bfc..92f6c120a63320 100644
--- a/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
@@ -21,7 +21,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -5270,6 +5270,17 @@ void ieee80211_sta_pspoll(struct ieee802
+@@ -5271,6 +5271,17 @@ void ieee80211_sta_pspoll(struct ieee802
   */
  void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *sta, u8 tid);
  
@@ -73,7 +73,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	trace_drv_add_interface(local, sdata);
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -682,6 +682,9 @@ static void ieee80211_do_stop(struct iee
+@@ -697,6 +697,9 @@ static void ieee80211_do_stop(struct iee
  
  	switch (sdata->vif.type) {
  	case NL80211_IFTYPE_AP_VLAN:
@@ -83,7 +83,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		break;
  	case NL80211_IFTYPE_MONITOR:
  		if (local->monitors == 0)
-@@ -960,6 +963,7 @@ static bool ieee80211_iftype_supports_hd
+@@ -975,6 +978,7 @@ static bool ieee80211_iftype_supports_hd
  	switch (iftype) {
  	/* P2P GO and client are mapped to AP/STATION types */
  	case NL80211_IFTYPE_AP:
@@ -91,7 +91,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	case NL80211_IFTYPE_STATION:
  		return true;
  	default:
-@@ -1014,7 +1018,8 @@ static void ieee80211_set_vif_encap_ops(
+@@ -1029,7 +1033,8 @@ static void ieee80211_set_vif_encap_ops(
  	struct ieee80211_sub_if_data *bss = sdata;
  	bool enabled;
  
@@ -101,7 +101,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		if (!sdata->bss)
  			return;
  
-@@ -1340,10 +1345,17 @@ int ieee80211_do_open(struct wireless_de
+@@ -1355,10 +1360,17 @@ int ieee80211_do_open(struct wireless_de
  
  	switch (sdata->vif.type) {
  	case NL80211_IFTYPE_AP_VLAN:
@@ -195,7 +195,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  				drv_remove_interface(local, sdata);
 --- a/net/mac80211/mlme.c
 +++ b/net/mac80211/mlme.c
-@@ -5696,7 +5696,8 @@ static bool ieee80211_assoc_success(stru
+@@ -5700,7 +5700,8 @@ static bool ieee80211_assoc_success(stru
  	 * If we're using 4-addr mode, let the AP know that we're
  	 * doing so, so that it can create the STA VLAN on its side
  	 */
diff --git a/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch b/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
index 84424056bb6638..3795dcf9ac2dcf 100644
--- a/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
@@ -24,7 +24,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2227,6 +2227,8 @@ enum ieee80211_key_flags {
+@@ -2228,6 +2228,8 @@ enum ieee80211_key_flags {
   * @tx_pn: PN used for TX keys, may be used by the driver as well if it
   *	needs to do software PN assignment by itself (e.g. due to TSO)
   * @flags: key flags, see &enum ieee80211_key_flags.
@@ -33,7 +33,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
   * @keyidx: the key index (0-3)
   * @keylen: key material length
   * @key: key material. For ALG_TKIP the key is encoded as a 256-bit (32 byte)
-@@ -2246,6 +2248,7 @@ struct ieee80211_key_conf {
+@@ -2247,6 +2249,7 @@ struct ieee80211_key_conf {
  	u8 hw_key_idx;
  	s8 keyidx;
  	u16 flags;
diff --git a/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch b/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
index 6b5b2e6f771c0a..d1140193157d6f 100644
--- a/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
@@ -78,7 +78,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	bool eht_mu_beamformer;
  	bool eht_80mhz_full_bw_ul_mumimo;
  	bool nss_ap_isolate;
-@@ -1341,6 +1355,8 @@ struct ieee80211_rate_status {
+@@ -1342,6 +1356,8 @@ struct ieee80211_rate_status {
   * @ack_hwtstamp: Hardware timestamp of the received ack in nanoseconds
   *	Only needed for Timing measurement and Fine timing measurement action
   *	frames. Only reported by devices that have timestamping enabled.
@@ -87,7 +87,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
   */
  struct ieee80211_tx_status {
  	struct ieee80211_sta *sta;
-@@ -1351,6 +1367,8 @@ struct ieee80211_tx_status {
+@@ -1352,6 +1368,8 @@ struct ieee80211_tx_status {
  	u8 n_rates;
  
  	struct list_head *free_list;
@@ -96,7 +96,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  };
  
  /**
-@@ -1859,6 +1877,7 @@ struct ieee80211_channel_switch {
+@@ -1860,6 +1878,7 @@ struct ieee80211_channel_switch {
   *	operation on this interface and request a channel context without
   *	the AP definition. Use this e.g. because the device is able to
   *	handle OFDMA (downlink and trigger for uplink) on a per-AP basis.
@@ -104,7 +104,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
   */
  enum ieee80211_vif_flags {
  	IEEE80211_VIF_BEACON_FILTER		= BIT(0),
-@@ -1867,6 +1886,7 @@ enum ieee80211_vif_flags {
+@@ -1868,6 +1887,7 @@ enum ieee80211_vif_flags {
  	IEEE80211_VIF_GET_NOA_UPDATE		= BIT(3),
  	IEEE80211_VIF_EML_ACTIVE	        = BIT(4),
  	IEEE80211_VIF_IGNORE_OFDMA_WIDER_BW	= BIT(5),
@@ -112,7 +112,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  };
  
  
-@@ -2916,6 +2936,7 @@ enum ieee80211_hw_flags {
+@@ -2917,6 +2937,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_DISALLOW_PUNCTURING_5GHZ,
  	IEEE80211_HW_HANDLES_QUIET_CSA,
  	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
@@ -120,7 +120,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  
  	/* keep last, obviously */
  	NUM_IEEE80211_HW_FLAGS
-@@ -4424,6 +4445,8 @@ struct ieee80211_prep_tx_info {
+@@ -4425,6 +4446,8 @@ struct ieee80211_prep_tx_info {
   * @set_sar_specs: Update the SAR (TX power) settings.
   * @sta_set_decap_offload: Called to notify the driver when a station is allowed
   *	to use rx decapsulation offload
@@ -129,7 +129,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
   * @add_twt_setup: Update hw with TWT agreement parameters received from the peer.
   *	This callback allows the hw to check if requested parameters
   *	are supported and if there is enough room for a new agreement.
-@@ -4818,6 +4841,12 @@ struct ieee80211_ops {
+@@ -4819,6 +4842,12 @@ struct ieee80211_ops {
  	void (*sta_set_decap_offload)(struct ieee80211_hw *hw,
  				      struct ieee80211_vif *vif,
  				      struct ieee80211_sta *sta, bool enabled);
@@ -142,7 +142,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	void (*add_twt_setup)(struct ieee80211_hw *hw,
  			      struct ieee80211_sta *sta,
  			      struct ieee80211_twt_setup *twt);
-@@ -7722,4 +7751,100 @@ int ieee80211_emulate_switch_vif_chanctx
+@@ -7726,4 +7755,100 @@ int ieee80211_emulate_switch_vif_chanctx
  					 int n_vifs,
  					 enum ieee80211_chanctx_switch_mode mode);
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch b/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
index 481087fd110158..1adf62f35f93c4 100644
--- a/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
@@ -16,7 +16,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2876,6 +2876,8 @@ struct ieee80211_txq {
+@@ -2877,6 +2877,8 @@ struct ieee80211_txq {
   *
   *  @IEEE80211_HW_SUPPORTS_NSS_OFFLOAD: Hardware/driver supports NSS offload
   *
@@ -25,7 +25,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
   * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
   */
  enum ieee80211_hw_flags {
-@@ -2937,6 +2939,7 @@ enum ieee80211_hw_flags {
+@@ -2938,6 +2940,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_HANDLES_QUIET_CSA,
  	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
  	IEEE80211_HW_SUPPORTS_MESH_NSS_OFFLOAD,
diff --git a/package/kernel/mac80211/patches/nss/subsys/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch b/package/kernel/mac80211/patches/nss/subsys/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch
index ba80b62d0ac732..15905c1090aa4b 100644
--- a/package/kernel/mac80211/patches/nss/subsys/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch
@@ -21,7 +21,7 @@ Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
 
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -998,7 +998,8 @@ static bool ieee80211_set_sdata_offload_
+@@ -1013,7 +1013,8 @@ static bool ieee80211_set_sdata_offload_
  		flags |= IEEE80211_OFFLOAD_DECAP_ENABLED;
  
  		if (local->monitors &&
diff --git a/package/kernel/mac80211/patches/nss/subsys/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch b/package/kernel/mac80211/patches/nss/subsys/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
index d28628ab1043f5..c1b285366ddaba 100644
--- a/package/kernel/mac80211/patches/nss/subsys/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
@@ -14,7 +14,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1481,8 +1481,6 @@ ieee80211_tx_info_clear_status(struct ie
+@@ -1482,8 +1482,6 @@ ieee80211_tx_info_clear_status(struct ie
   * @RX_FLAG_AMPDU_IS_LAST: this subframe is the last subframe of the A-MPDU
   * @RX_FLAG_AMPDU_DELIM_CRC_ERROR: A delimiter CRC error has been detected
   *	on this subframe
@@ -23,7 +23,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
   * @RX_FLAG_MIC_STRIPPED: The mic was stripped of this packet. Decryption was
   *	done by the hardware
   * @RX_FLAG_ONLY_MONITOR: Report frame only to monitor interfaces without
-@@ -1539,39 +1537,38 @@ ieee80211_tx_info_clear_status(struct ie
+@@ -1540,39 +1538,38 @@ ieee80211_tx_info_clear_status(struct ie
   *	hardware or driver)
   */
  enum mac80211_rx_flags {
diff --git a/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch b/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
index ee509ae0cbb839..3a034ac1c076ab 100644
--- a/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
@@ -20,7 +20,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
 
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -2080,6 +2080,11 @@ netdev_tx_t ieee80211_subif_start_xmit(s
+@@ -2081,6 +2081,11 @@ netdev_tx_t ieee80211_subif_start_xmit(s
  				       struct net_device *dev);
  netdev_tx_t ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
  					    struct net_device *dev);
diff --git a/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch b/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
index 843f8d80324a10..9243aff80d5d19 100644
--- a/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
@@ -78,7 +78,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -2246,6 +2246,10 @@ int ieee80211_if_add(struct ieee80211_lo
+@@ -2259,6 +2259,10 @@ int ieee80211_if_add(struct ieee80211_lo
  
  		ndev->features |= local->hw.netdev_features;
  		ndev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
diff --git a/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch b/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
index 1369dc2b60d8e7..338a9d2dd1a8d6 100644
--- a/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
@@ -23,7 +23,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2875,6 +2875,9 @@ struct ieee80211_txq {
+@@ -2876,6 +2876,9 @@ struct ieee80211_txq {
   *
   * @IEEE80211_HW_SUPPORTS_TID_CLASS_OFFLOAD: Hardware suports tid calssification offload.
   *
@@ -33,7 +33,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
   * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
   */
  enum ieee80211_hw_flags {
-@@ -2937,6 +2940,7 @@ enum ieee80211_hw_flags {
+@@ -2938,6 +2941,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
  	IEEE80211_HW_SUPPORTS_MESH_NSS_OFFLOAD,
  	IEEE80211_HW_SUPPORTS_TID_CLASS_OFFLOAD,
@@ -123,7 +123,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  		 * for MLO STA, the SA should be the AP MLD address, but
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -4576,6 +4576,9 @@ static int ieee80211_get_txq_stats(struc
+@@ -4584,6 +4584,9 @@ static int ieee80211_get_txq_stats(struc
  	struct ieee80211_sub_if_data *sdata;
  	int ret = 0;
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/917-QSDK-mac80211-WAR-for-association-failure-issue-with.patch b/package/kernel/mac80211/patches/nss/subsys/917-QSDK-mac80211-WAR-for-association-failure-issue-with.patch
index dc3719a7eba95a..c0e43a73c34878 100644
--- a/package/kernel/mac80211/patches/nss/subsys/917-QSDK-mac80211-WAR-for-association-failure-issue-with.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/917-QSDK-mac80211-WAR-for-association-failure-issue-with.patch
@@ -27,7 +27,7 @@ Signed-off-by: Balamurugan Ramar <quic_bramar@quicinc.com>
 
 --- a/net/mac80211/mlme.c
 +++ b/net/mac80211/mlme.c
-@@ -7752,7 +7752,7 @@ void ieee80211_sta_work(struct ieee80211
+@@ -7757,7 +7757,7 @@ void ieee80211_sta_work(struct ieee80211
  			 */
  			if (status_acked) {
  				ifmgd->assoc_data->timeout =
diff --git a/package/kernel/mac80211/patches/nss/subsys/999-775-wifi-mac80211-Changes-for-WDS-MLD.patch b/package/kernel/mac80211/patches/nss/subsys/999-775-wifi-mac80211-Changes-for-WDS-MLD.patch
index 961b549e0c82fe..3246b1f9304ee8 100644
--- a/package/kernel/mac80211/patches/nss/subsys/999-775-wifi-mac80211-Changes-for-WDS-MLD.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/999-775-wifi-mac80211-Changes-for-WDS-MLD.patch
@@ -17,7 +17,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
 
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -8803,6 +8803,7 @@ bool cfg80211_rx_spurious_frame(struct n
+@@ -8806,6 +8806,7 @@ bool cfg80211_rx_spurious_frame(struct n
   * @dev: The device the frame matched to
   * @addr: the transmitter address
   * @gfp: context flags
@@ -25,7 +25,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
   *
   * This function is used in AP mode (only!) to inform userspace that
   * an associated station sent a 4addr frame but that wasn't expected.
-@@ -8812,7 +8813,8 @@ bool cfg80211_rx_spurious_frame(struct n
+@@ -8815,7 +8816,8 @@ bool cfg80211_rx_spurious_frame(struct n
   * for a reason other than not having a subscription.)
   */
  bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
@@ -127,7 +127,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -18916,7 +18916,8 @@ void cfg80211_conn_failed(struct net_dev
+@@ -18945,7 +18945,8 @@ void cfg80211_conn_failed(struct net_dev
  EXPORT_SYMBOL(cfg80211_conn_failed);
  
  static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
@@ -137,7 +137,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  {
  	struct wireless_dev *wdev = dev->ieee80211_ptr;
  	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
-@@ -18942,6 +18943,9 @@ static bool __nl80211_unexpected_frame(s
+@@ -18971,6 +18972,9 @@ static bool __nl80211_unexpected_frame(s
  	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
  		goto nla_put_failure;
  
@@ -147,7 +147,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  	genlmsg_end(msg, hdr);
  	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
  	return true;
-@@ -18965,14 +18969,15 @@ bool cfg80211_rx_spurious_frame(struct n
+@@ -18994,14 +18998,15 @@ bool cfg80211_rx_spurious_frame(struct n
  		return false;
  	}
  	ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
@@ -165,7 +165,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  {
  	struct wireless_dev *wdev = dev->ieee80211_ptr;
  	bool ret;
-@@ -18987,7 +18992,7 @@ bool cfg80211_rx_unexpected_4addr_frame(
+@@ -19016,7 +19021,7 @@ bool cfg80211_rx_unexpected_4addr_frame(
  	}
  	ret = __nl80211_unexpected_frame(dev,
  					 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
@@ -176,7 +176,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  }
 --- a/net/mac80211/chan.c
 +++ b/net/mac80211/chan.c
-@@ -1035,6 +1035,8 @@ __ieee80211_link_copy_chanctx_to_vlans(s
+@@ -1036,6 +1036,8 @@ __ieee80211_link_copy_chanctx_to_vlans(s
  	list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list) {
  		struct ieee80211_bss_conf *vlan_conf;
  
@@ -185,7 +185,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  		vlan_conf = wiphy_dereference(local->hw.wiphy,
  					      vlan->vif.link_conf[link_id]);
  		if (WARN_ON(!vlan_conf))
-@@ -1276,6 +1278,8 @@ ieee80211_link_update_chanreq(struct iee
+@@ -1277,6 +1279,8 @@ ieee80211_link_update_chanreq(struct iee
  	list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list) {
  		struct ieee80211_bss_conf *vlan_conf;
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/999-918-mac80211-fix-NULL-pointer-access-Klocwork-issue.patch b/package/kernel/mac80211/patches/nss/subsys/999-918-mac80211-fix-NULL-pointer-access-Klocwork-issue.patch
index 4da35289524e66..633b70fb14038a 100644
--- a/package/kernel/mac80211/patches/nss/subsys/999-918-mac80211-fix-NULL-pointer-access-Klocwork-issue.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/999-918-mac80211-fix-NULL-pointer-access-Klocwork-issue.patch
@@ -20,7 +20,7 @@ Signed-off-by: Monika Korada <quic_koramoni@quicinc.com>
 
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -1348,7 +1348,8 @@ int ieee80211_do_open(struct wireless_de
+@@ -1363,7 +1363,8 @@ int ieee80211_do_open(struct wireless_de
  	case NL80211_IFTYPE_AP_VLAN:
  		if (sdata->bss->active) {
  			ieee80211_link_vlan_copy_chanctx(&sdata->deflink);
@@ -30,7 +30,7 @@ Signed-off-by: Monika Korada <quic_koramoni@quicinc.com>
  
  			if (ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD)) {
  				ieee80211_set_sdata_offload_flags(sdata);
-@@ -1359,7 +1360,8 @@ int ieee80211_do_open(struct wireless_de
+@@ -1374,7 +1375,8 @@ int ieee80211_do_open(struct wireless_de
  
  			ieee80211_set_vif_encap_ops(sdata);
  		} else {
@@ -40,7 +40,7 @@ Signed-off-by: Monika Korada <quic_koramoni@quicinc.com>
  		}
  		break;
  	case NL80211_IFTYPE_MONITOR:
-@@ -1390,7 +1392,8 @@ int ieee80211_do_open(struct wireless_de
+@@ -1405,7 +1407,8 @@ int ieee80211_do_open(struct wireless_de
  		ieee80211_recalc_offload(local);
  		ieee80211_recalc_idle(local);
  
@@ -50,7 +50,7 @@ Signed-off-by: Monika Korada <quic_koramoni@quicinc.com>
  		break;
  	default:
  		if (coming_up) {
-@@ -1434,7 +1437,8 @@ int ieee80211_do_open(struct wireless_de
+@@ -1449,7 +1452,8 @@ int ieee80211_do_open(struct wireless_de
  		case NL80211_IFTYPE_AP:
  		case NL80211_IFTYPE_MESH_POINT:
  		case NL80211_IFTYPE_OCB:
diff --git a/package/kernel/mac80211/patches/nss/subsys/999-919-Fix-dev-stats-Revert-Remove-generic-ndo_get_stats64.patch b/package/kernel/mac80211/patches/nss/subsys/999-919-Fix-dev-stats-Revert-Remove-generic-ndo_get_stats64.patch
index 96aa0c936c4661..c25e619031cc4d 100644
--- a/package/kernel/mac80211/patches/nss/subsys/999-919-Fix-dev-stats-Revert-Remove-generic-ndo_get_stats64.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/999-919-Fix-dev-stats-Revert-Remove-generic-ndo_get_stats64.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -832,6 +832,12 @@ static void ieee80211_uninit(struct net_
+@@ -847,6 +847,12 @@ static void ieee80211_uninit(struct net_
  	ieee80211_teardown_sdata(IEEE80211_DEV_TO_SUB_IF(dev));
  }
  
@@ -13,7 +13,7 @@
  static int ieee80211_netdev_setup_tc(struct net_device *dev,
  				     enum tc_setup_type type, void *type_data)
  {
-@@ -848,6 +854,7 @@ static const struct net_device_ops ieee8
+@@ -863,6 +869,7 @@ static const struct net_device_ops ieee8
  	.ndo_start_xmit		= ieee80211_subif_start_xmit,
  	.ndo_set_rx_mode	= ieee80211_set_multicast_list,
  	.ndo_set_mac_address 	= ieee80211_change_mac,
@@ -21,7 +21,7 @@
  	.ndo_setup_tc		= ieee80211_netdev_setup_tc,
  };
  
-@@ -887,6 +894,7 @@ static const struct net_device_ops ieee8
+@@ -902,6 +909,7 @@ static const struct net_device_ops ieee8
  	.ndo_set_rx_mode	= ieee80211_set_multicast_list,
  	.ndo_set_mac_address 	= ieee80211_change_mac,
  	.ndo_select_queue	= ieee80211_monitor_select_queue,
@@ -29,7 +29,7 @@
  };
  
  static int ieee80211_netdev_fill_forward_path(struct net_device_path_ctx *ctx,
-@@ -954,6 +962,7 @@ static const struct net_device_ops ieee8
+@@ -969,6 +977,7 @@ static const struct net_device_ops ieee8
  	.ndo_start_xmit		= ieee80211_subif_start_xmit_8023,
  	.ndo_set_rx_mode	= ieee80211_set_multicast_list,
  	.ndo_set_mac_address	= ieee80211_change_mac,

From ac6d0a0abb11158a3d1c0c57c1aef6073331b556 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 5 Oct 2024 16:19:34 -0400
Subject: [PATCH 194/225] iproute2: NSS fixup for 6.11.0

Signed-off-by: Sean Khan <datapronix@protonmail.com>
(cherry picked from commit c4781eb3c1145282bc099ec2981cbaf66f3e455c)
---
 .../network/utils/iproute2/patches/500-add-nssmirred.patch    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/network/utils/iproute2/patches/500-add-nssmirred.patch b/package/network/utils/iproute2/patches/500-add-nssmirred.patch
index 08bc935b2cc0ce..46999ee257df85 100644
--- a/package/network/utils/iproute2/patches/500-add-nssmirred.patch
+++ b/package/network/utils/iproute2/patches/500-add-nssmirred.patch
@@ -142,7 +142,7 @@
 + * print_nss_mirred()
 + *	Print information related to nssmirred action.
 + */
-+static int print_nss_mirred(const struct action_util *au, FILE * f, struct rtattr *arg)
++static int print_nss_mirred(const struct action_util *au, FILE *f, struct rtattr *arg)
 +{
 +	struct tc_nss_mirred *p;
 +	struct rtattr *tb[TCA_NSS_MIRRED_MAX + 1];
@@ -176,7 +176,7 @@
 +	if (show_stats) {
 +		if (tb[TCA_NSS_MIRRED_TM]) {
 +			struct tcf_t *tm = RTA_DATA(tb[TCA_NSS_MIRRED_TM]);
-+			print_tm(f,tm);
++			print_tm(tm);
 +		}
 +	}
 +	return 0;

From 63aafa254830335a8e81646395725f59e38d7c40 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Mon, 30 Sep 2024 21:34:57 -0400
Subject: [PATCH 195/225] docs: Change default branch

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 8bd2ae7d65f7a7..30463d70ac97bd 100644
--- a/README.md
+++ b/README.md
@@ -84,7 +84,7 @@ Supported devices include, but are not limited to:
 
 1. Clone this repository:
    ```bash
-   git clone https://github.com/qosmio/openwrt-ipq -b qualcommax-6.x-nss-wifi-6.11
+   git clone https://github.com/qosmio/openwrt-ipq -b qualcommax-6.x-nss-wifi
    cd openwrt-ipq
    ```
 2. Update feeds:

From 20fd3d4a76252111c78080d616e01440ae38a388 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Mon, 7 Oct 2024 21:28:40 -0400
Subject: [PATCH 196/225] docs: Add donation links

Not obligatory at all. Just adding for folks who appreciate my work, and
wanting to contribute. :)
---
 README.md   |  22 ++++++++++++++++++++++
 cashapp.png | Bin 0 -> 22092 bytes
 paypal.png  | Bin 0 -> 8307 bytes
 3 files changed, 22 insertions(+)
 create mode 100644 cashapp.png
 create mode 100644 paypal.png

diff --git a/README.md b/README.md
index 30463d70ac97bd..b0680d77490a62 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,14 @@
 # NSS Fork for IPQ807x
+| Branch                                                                                  | mac80211 Version | Notes                                                                 |
+|-----------------------------------------------------------------------------------------|------------------|----------------------------------------------------------------------|
+| [qualcommax-6.x-nss-wifi](https://github.com/qosmio/openwrt-ipq/tree/qualcommax-6.x-nss-wifi)             |6.11|Current with upstream|
+| [qualcommax-6.x-nss-mx4300](https://github.com/qosmio/openwrt-ipq/tree/qualcommax-6.x-nss-mx4300)         |6.11|Current with upstream. [Supports Linksys MX4300](https://github.com/openwrt/openwrt/pull/16070) |
+| [qualcommax-6.x-nss-wifi-6.9](https://github.com/qosmio/openwrt-ipq/tree/qualcommax-6.x-nss-wifi-6.9)     |6.9.9|Current with upstream, except older mac80211|
+| [qualcommax-6.x-nss-mx4300-6.9](https://github.com/qosmio/openwrt-ipq/tree/qualcommax-6.x-nss-mx4300-6.11) |6.9.9|Current with upstream, except older mac80211. [Supports Linksys MX4300](https://github.com/openwrt/openwrt/pull/16070) |
+
+NOTE: The 6.9 branches are meant for folks having issues with the current 6.11.2 version of backports/mac80211. These are mostly just meant as a workaround for the time being. I don't plan on supporting these branches longterm.
+
+The MX4300 branches will soon be merged in once the PR for MX4300 is approved upstream.
 
 ## Table of Contents
 - [Overview](#overview)
@@ -9,6 +19,7 @@
 - [OK, I Want NSS. Does My Device Support It?](#ok-i-want-nss-does-my-device-support-it)
 - [Quickstart](#quickstart)
 - [Important Note](#important-note)
+- [Donate](#donate)
 
 ---
 
@@ -144,3 +155,14 @@ If you have questions or issues, please join the discussion on OpenWrt's forums.
       Also not helpful as I'm always pushing changes...
 
    5. Be respectful and mindful. I dedicate my free time to maintain and improve this project, and I do it for the benefit of the community. Remember that I'm not a full-time developer or support team—I'm just an individual sharing my work. Constructive feedback is always welcome, but please refrain from being overly critical or demanding.
+
+## Support the Project
+
+I never really thought about setting up donations before, but with so many people being receptive and appreciative and asking how to contribute, I figured, why not? Of course, this project also builds on the incredible work done by the talented devs upstream who put in countless hours into OpenWrt itself. I’ll definitely continue working on this, but if you’d like to support, every bit helps.
+
+[![Donate with PayPal](./paypal.png)](https://www.paypal.com/donate?business=3V3H2SZFY7DNQ&item_name=Maintaining+NSS+fork+of+OpenWRT+and+NSS+packages.)
+<a href="https://cash.app/$austinzk">
+  <img src="./cashapp.png" alt="Cashapp" width="150px"/>
+</a>
+
+Consider donating to the [OpenWrt Foundation](https://openwrt.org/donate)
diff --git a/cashapp.png b/cashapp.png
new file mode 100644
index 0000000000000000000000000000000000000000..ad2881916cb8533c1832894b6d2b72f50de9cf49
GIT binary patch
literal 22092
zcmdS9g<D)d*ER~pofdZ}&frjFa47EX?(Q;ZTdcs~?(XjH?pEB2I}~>~{N#Dx=lZ^L
z{(!UR+LM)J-7CqRl|4Ia5~3g{j)I7f2mt|sA}R4z2?7Fg{9X2ihkgGRvypOoPoT|(
zWQ8Cgsw0t}4PoB%q{b3TvJeoSR1gr~0w5qB-;2H-KtQ-MLqHrEKtKSKARurY(pnUG
z-zx%4H6+bsWg+O^Wq1e}$WIVZ?-Jzu2Lciw;xB9O5`+{a!T-ogkTn15e1L!mwuFHG
zS4ZnT{p*r=zyHGglR{-d{;$QX5C74I9M6LKj|}1a7wiQ8PX0YXaFEb+hJZlA`0Iv*
zNJ+zmfcU^}siNVcAu9tkwzp+8G_f}_W%RIh_zMNW>j8WhZB1PaNj+?B?3{rfe4qc;
z0KUtA6*GM%{aeMwn(woQtOBWsy^|>^2O~2h^JjiUQc_Z0ClfQE(pRy6;qN)V&lWB&
z4nQU*cXxM2cQ!_QCvzqiZf<TSW>zLvR)%*C24|3+i=hXDoiq7AM*d^xtEscGlcj@;
zrM(^LUv>?R>|I^>K7anJq5rx5>8GiO<^Q&1=lt)m-UrC^R}B*jBQw+g8_dPh?EeGy
zSIs}LzsL1YbG&~U11ea0nA&K5wX`+0bAIm{KPxjcGw<K+{9jf7+tdGoYWy#h?f-!O
zSJnRs6|uLmcT#pRG&bdD`M0(ID*7+&zj_Xocd|5nC-pDt{!;(H%Kp{oW%`TP|Kj<d
zN&LI?eHQr<d71vlBlr<NNMyY`lOTlTS0NP-$kTMVG(FMgH*@#e!*pl~%J2k*e0ZJ5
zd@))&qR|^B(P=Nmik|xHAB*i>^@goSs(n8~X{0dnIE8@FN)luN(88W%!)I@I>1>m!
zwdRv6ZX344yiXvvy|HA_Uh>8m?_@Ift}CO`SJKbuAAiDsh5r2E<M*F}|NqI-1PbaF
z$JX;Mtgg!F-Wc`Bl{O~W7744>UUGz_9v>b36c7D(R16T`QC;<%;<$$Oj0gt@%E!N(
zEO$zt4n~XpM}s(2a6H{iLy-eMvY;$>s<}gogp8PKU5r<Qm((FwIH`t9n>?Zw%2tZ@
z`_=aScvmS_&uD*TSYoKY@)IW=eblnNb{8QWzIqmni4n!$d|o3%TkWy?*Pc+CS9PaU
z)H#NdQ1C0X1$+F!E#y|vscoSw<@q?_lJ8ON(Qxm0@v;RMIQ}UxBS6*|A0QoR`0q5h
z=tEm=HT58l3?tmnB}K?9#!h09(3!bvf;Fo1)pZU%s#(`)`NA{TDj5n$N~d`G1Tf|N
zC}SOrj$7tJ)10IKoztu*vM7#6+Zo1oBc*2(gohtVs`=5jidwo$Q<s_+`{Uo2tJBZr
zvJaEyhiBl!9g7Za_uyQ;i_`XPG5bJtc3jbzwEsFu3)zQLCkfWucGHs$6)qLqr|5g#
z>~Jm!LRdht+uX+;TLegtD%bEUcDP5jegO*P1^fhH1m?f~wTAhfgNGdt<R>q;*<rO3
zzNNTzKtJkU$1TrDqw(Eo;|iL4!W?Dx^0QIIzm9l-2)(?+KHdc2m6LjUaz+Hj#1-nV
zP$=&<aP)wFXl9}lQx1Y6nQuz(%2B|J>wlxBFwl#ZyOR~wJ@WAH8>b||e&-oezwL^0
z4TCZG6e6z3dYcH2@KyhrdhIVCRJmpGoZq@aduWAEX<6h4Ql>XbzT22@qljcwt;t3>
ze`mH+ILH*UD?HKQ{g(x+0EoL^bf57Ym;Ur%WGs{_xFlhbsVh>c9db>OZEYxg2u9fJ
zBNzR5N!<x%85PpHf*b-D$SV}83K!MHDa5S=KJ0O!VGd*>Zt?D&;t)~(X8|&x7g<n}
zliRJ-@RZD$_v1SA%P54;s@_VNq8soeEGW+Zbf2?w&M?$3(BUQem)P`gg86ch!75qO
zeOxkX$?*xQ^AcE}zxC=coiV+71ezK({D)5p=#dKc`kCT|&_c;gu0wW_Re2jgj+~Nn
zX~{s9ZnoMv#fg4B|6+;4&+zcSSI-*ycPX{7+nW@3DL+E0QW@#vAX&O{C1vMWK>s)c
zf1tLO8eBSzb_Zb}Q&$`LuW928)W^Yp9w{~-;Z?TSo81v)<$q)}GgwblbyTd!ZvlN$
zyDx)o-9!y|AcC52gwzi{9fSW}sow;L3)y-bNGth~m0ueJSmU{t?O>SY(9Pl7YkaF$
z7VDzbfm(-)WvT~R144EdOxPe@si2FF9^WVzUA#t%);a;B-M^n=UE~TgmUM6{Kgyik
zu&#KLc+pK@b*D3g_LwU*J<6Y^jx$w}sH7Y-8YPu2taSbE`kG2tiT&N?IP7ZG^2^h$
zTU6ls%auCzTWjx0jE=)lOISny;p5|XC-^w$Z)R<UFhaa}Gr91CaO2vI3aD2bYi=m5
z&8J7O&4#YMYkyj75m!6ys#Z#U%lNtdN}u|z{Vq*gh76TBn+WEE+HV3E7+%Bv9rc8G
z)~eL3-j~gnF=8q9><I>qyU?C>rv#tXtMO8-eb4Tc!lEtf`{;z03p<%@iBEAgAngTe
zmoow7iK@o!iMh}7*#9~L4D?7j`zd6cW8fz~c2?(89Z+|?ZzUeJRPRzly+E1;6H)UX
z$Zo$Q)*IkTQq5C0UzG^FsP$aS7Rf<<=dEi#OmI5hjCpF0y*YE~bU4FP)?0V$&x!Be
z?6F>){_1qO)gHA#EJ6Jt>`mgV&U#s+<&m4q_EUsh=FyQy&B<Du?#kTbueMj_`9)uj
z2H;6aAoICSEOAT?uNqa*m#>08$|pT3k&5>5i-iN$w0VtM-csLdDANE(>~mb>AwcJp
zUJ+v!owW#$^G{o<pJ+gC=CviIsq-zZ8^0Fbj>K9_U)47EoIAd~q9n|EH-o~hPrl5B
zAEdJ{5LWCS<~R@>^$Ws4HT2`s)dydQo7>2Qe@W41F*UJaSyVw5gfqpgxJDx3sP;N$
zuri{LDJ*}P7uG-nDx|(Zf#T~@+xq_;3&}>5n4#0`vir<4OTe0pxQ6wX)qX9GPgQHB
zJl4OfOrZC^QoUOq;9NaHVQLNLU~p`A5pb4W%o^v&@=M?ADG)vLf01)txxMw3I;)q|
zZWxPZ%zy3XvSmRPI=$GIgQe8GMbgW+E&Wzl=l-!)prbv>-4DNC2j!ya>UgVpYrjvv
z<Qa)dWS3>jn>-m!<f|3+ho0z*fnzfRdB3Im-sCL?z6oIE!F=@=G*bPX{?|CG#&mLf
z8sjiDA)Mkua)l8~R_-i*BVX9E74(%Vd~jg=E&)M8E44b`{+aGWQ7h;)_iP;{()#Tt
zQ)okowK-PD_=U^IY;e!#xS(w~!%kN}(|9;ldQGC7!)sGQlxrVYZiEswpU=Y{SjjvM
zcig9&Cv3Z1$Pc9eE^|)+W)yA5_IdXil2o5s&}b!a6g{)Ob9TQFBN=?vEWTlhTUPVQ
zC`bo7fNTPio=GVPEzB{B<JJMf$Mp;{aG!RAZnScnA>o%;r<F=mB|fO$BWugRut{Tu
zh1CYhG5QW+)44Ie9+~B23EqUKZ3_R`B2Xm$r{k6wNl=k=q8=CXN{}x7{%zrcox8sF
zh1XqAs^7fA9AdTa4?SAEl0p+NYmm}DmR@P0(Y|A64Kj*qh$*jTsr#2sc83<Prz-MQ
zJAXIYu~3&a)30+|b%uQUJq4DR7vKGfTi3|fyh>3zFfa%Ic<X?BW%Q#A9UO|>Tw{qc
z6YNS!Oc|zZLw$5z(VZ0g<;!iSs^iJHmGGc#z_e*OWlRafuOvNp+9St)FvT+K#6DWK
zD#|YmF@wLN+5t9W^t;<n(~kL?WCna>+VeD6E^@NOw{#EO%ng%cQ8<^bW_@YcYJVoB
zU-#s6E>V&fgLek*T$PXDMpGA>=aeq$_fWJFOb0Ee3mPnh1%|tZTV!kFJ0^Tgy138M
zq6?e&ZmOY%T>iijJxx~a=_VJac#M|G0~?l?r3M!zK2P}OZmrP1x?XrG)hESXKg8*2
ziWdXoaKNMu4&kqPL*l9%Hh+`|trLlm6F7tLpaYU$kbl1d^M_UMMaf(5v-~tf9Y^<&
zdTy`O#0Iq~ihaVZsCfu1Wk$l42dHoY28&K?wSi*VCWAPZnCd6}L$EMGaA!)(m}*G?
z&I&i2&TCcoEr7V?WKH+!;(eu->a8=AC8tRc@s4JeL%M#^;wS}sZ;Da}!m+Ab(fU5&
zhILBns<r;z>6cD-uXdN8tu|+k&pt}pyBt{9BD<yyY;f8Kx)FZb%cLUTYx^uWndK9~
zct(U&ut^L8X?V81htm@yJao;IlH9l;E`8)VgspuQ67AsBzCZ@;eDM-O$W~Irez^_Y
z`94YiE^q6cT4Cer)FAQdslAh>Y?&{{Ue-NzgZ1@svvmV1`>tgwC?aa^C@qCeHrt4I
zXWW@C8yXi_jq2NYCD{}0G~&%V4Nkd@sqv*&+_mI*fC%0OXY((Wt~~5APCU23RUf;4
z^|b>{^VSu;&cQ}-xxVH$enU+WjdHz3(3!_)E*X0dEOXZfzy&%>DduuOwc)dAtDvMR
z2J6Yz4+aD9<DKexWK_VFO4?O)i8!f!l(rVbV})lpu=*?RU>WN}_)4tETzuV1+8zR3
zYxn>uD}6bJHhO8vmk(>}mX}j#rLCOxyN@Bw`tF<+PqBo1j%OEpyEPrdI9@eg_8d7c
zP$DC};z&VOLToy`U)}J7&G+GJO=x%0R@&quK<O*>3qru7(+JRm!d?A?fWvXh`VPpO
ziCVj3U~oPSKkSstkrnl@5ZNy~rO7V@%G9(+L^l8DnF&_t6?q<Vnp`cTk`tiEQ0o;<
zBC#_{L@aF1j$Nz#cPN4>Ix_*N?(&q>%v(#VIA_Oj?8<?ll|+Hi4*`|$(T_4+9;$W1
z0q)A<G>2d{Qq6Drbm<u4oY~PrVc9b!hHH3QYe;6k;S`s<CHyg~yJio|&hm=Yr^_H-
z?Puz0k%RA#jHER=yZA@~++;$t;P%poG-7o8GH)-Aj59_}&yJ^^Rr@BCn9&E`LF*bT
z^qh!d6(~m{fN%tYu1_P)t8)KRMi1l%hw3@v2S*oNyvu6D{)dlBuyTcp!Mo~pSekfh
z^@GxpsY4&t(o%U^RI8KFKUxHS+h9;U(%eMeX5=Bk>$FtHtidKO<6@(zS{_TNZ(}(j
zgU37-bgke+XO^-Bsf{VuA!o_8YSjeW?Um{NrWyw>g_n_Rt0#IRGw}#p!cRyug*J72
zs_x{=Ub)B?1^XVmJNgq)wKUF0I`|xUHqR})wbvegsoychN-9?J%*eL;L6CnXa)iGI
z0Cwtx;ioyd!GzV@eu9QOpk0IG)H&8mVjVnP^b;26BQ()qQmt<t`ps0$Kke8^d1!$q
z>#Zl{D+liF+r%QU#wE-8V%{L=NGu4FDwA_6?Tgz@AD1-BX!9vef>R__%K}RR<h4>9
z(#q^QnUDo&UWNvJ=1<V25|^yDIR-G#$kFdzi5y05iF`&x$MbtGoB+Ao457FHE0ViD
z@lr#!KB#^Urt)%2?-|DlZM}hmvzRZ&()}Y{i}=D7L!%!tsCX<#;){ntD6CBT1^Irl
zjVZegwn--$(^4#@sLf-BjC1~i(wuy!jJOUJJcfTb*D$&34Z}rr-X1%AQ{8jblC4wc
zo8t-8niCh8oF>bBrq>!C4ewfAIY$jUHes)qH)N*))NHN-Y`SQ!?1%O^FTx}K1ep%@
z=XZvjEof-|bn1hz-ngpNg7?cU=K^@p&Pjt3qmv=cX9i%bSrX$PB7t_;e%ju_f1sap
z@;sZOcvPRyw`j@8CphhSjaQ5Jz2m(EYy5&XXILKI_XAR7UH!PmNnXiZW7i&Y*(4(1
zeDS`t{f}OkD=>t+rysV{L;W-fi-XA(#*!{FQp?$!M~w1^MF`z?e{GHrAk^G6dv8m*
zca2@GUZv_elOMx2QTnbnsCh*V97>gcy3wj`wf?nxHf6|5q=#3&@G_iit>@Ip*gB|N
z_gsj7dv&vO!oNH+cMJ%8Oj(^M@e5KbiuDS2cb9Kl=8@G#QCCw|ZAL!kRIyUWdr~i#
zFNv9vOwLbLxjwJH=z><?HSX^x#M4TKOsTwwQ=Q-N+6gc*w9#^BrJmy%Ip&1y5*fq^
ztNa}>WI`pL`gUaqPyF^4JaQK79r#-tYkEMTtH<U+PP1Dr2QIWYyv)1gGqWo9*;|8G
zKHl|MZ;7%)Ny#R6@-zvu=-uJ9(AJ3uNANv=Isx@-&f*N_jfwFk!tnCwr&iVzgcl_#
z@v2<?7DN%S9AzBm9{}yb9`A?o%HMls>E{_64y_pmd@^V|Wj7IZU$ok&W`3)2jJu*m
zbWXIpO0aTp4j(??$UCY17!pTCIac0SktJw~-B%WqaTn0{_J6v*9CdBy8b4JMkP)D4
z5YxxO-N{(0>ynM`efApU8DqCgkML=^q}u{hBKMgZ5t_|=&=d>0oiXO8Wg+|)Sk2;6
zKkyE2$P-cCh>lcc(5}><xj039qbH{2AkQy4H;OogLTrqpDS@9=Ktm-oYD((0<AWY1
zB?rL5?HD_<)O^VXGaf*SHG3*#UvdVp68^B9ZZj#uDwbPDh5fa!|1dlv##BA2EDf%?
zsoTeWnUW<VVdbJ35;iCQV~*qR#`?PWa-XxfY-bEk$7H;`jVtq~ywVG_ZLx?&mXA}1
zp17rT{Q)X{$YmYF)2A}XU`QqEZ1$nX!-_ttb&ML92Ri$MmO@ofpNEvMy?)gR)D;#u
zm&LP+ewy*ml1QkK^|f64AoQH#naW?7+07<9ZkI#6mt1=xdN=+3{1#RD+hZEaCY#6M
zDz<u|rV6>1lYcDnf_vQ4uY0uS+ys&xIc<+XFW+r}>vu;yOAeQB4he5<<)PNu9k9^G
z4%U(K6}neLH_T!~z?4&Q7WkB6vr?f6okWkD+N!$eAXh>tXWJg3E$cR6F8RPLe5^W=
zw%;3iUdnzJXgA5t0{i3YSH0G=W_+s>nMw`uu#ujF0Mh=MdOarV%!6-eF53fc+^<I9
zfvQ8?NHD6DUF%gGGAtbqe7OsPXH^ZH_2u_dx?NrBg782$y2_0LHBW$XvG*6Ux$nfd
ztv`fR@VTm8CH12^l=i!6+O-XE$feFWOkjVwuaLUPtw>)N`kkwKVV9&=((-HbN~VoV
z3rxM%_T2?}WZS#wuoM$}v9?=0L=`gIxt`dk7R9*WPeOMcI`-m9M{aP0<IPb^JaYlS
zP{X!D#k~BwgXMdnGew!^cwFLM3sQ_%;3oUd%lojHsDhn{!fVol`{iYY-X2bzQtd`{
z`I!xl2yMipNew&Sk<<A*wm=Mg%|MUlpKm2LLz8ZR(%F~blSAS|_wc97(S;^}`b#BG
z^|{O4nq#J$@uOI<=7&in*N9-dBzlls?030G-iwt!uCaCeKQ@_avUG!4U7%Y<?~I;Y
zmoccXhYMO2a~G7rw;Ex;FXbM9!R#7jTq<f<URy3V6@2aZGA_4Ikr-F_kQ1Q~+pY>t
zI;=(8+!y{^UP`Wy-atlNhIA(Bn0<Agk)JFgca1b$U&mm2Fj+X~93^mZuBkT=ceRWD
zfG&ECz>m&GvC~C$Zsng<_@x>66Dl9?l!F?>&_2myI$IB>?J1@EDGs`aypgu=(d60A
ztD&~W<skut7(aB!dqsnw*QZGC;W|eAVslo_CvVxd5rLW@+_00f-_JD<F*>5J+IWGy
zaiA((q8a04PvU5uG%gPjAicNFn*-4-(`xIo(Ac6-P<U!{r~qAuu6N<cQc`h~y$aI}
zC>>Kk#%U@ZWZ%Myvj;%Cxqm2vcv$Z)LB2XQxyUx!BXAC99UGnlzJ>Of_xa&$<Ty!V
zehzkAv*e-swG^5M9hx&{!2%0u)S9DQR2&jKpORXccGqimw{yQYJlRpY#K+d&e3slu
zD|2<dS3H@qe3Egn@|+Iywm)iPwWWJ|J3Ua4S4@C8p~=<>8ZW5VGhi@LFG@Ci3A%iu
zj=+56x17_|O(IQi6H?&P8S_zx_m8CnvLF81+avE;?4g+ppja7Ix_7(Kd5<@e%QkI^
z9?vvmHywGPvB(F$ihz~vkT%<Vsri}nMZ!Gk`3OqDwpX6US=&f`k)bQX*Zn?QXd%s3
zcX?c51z5CedoTQ<BJ<|MikBPA56B<lc2Meidi&ge0`gr)?x8NKNU7Be)uh}Ueq3L8
z((JfW!u!VzbZ`A;?*FCuOvBRmQ1-Fr!Q0cqdiuiRawdBRZ@?eRPf7=jecZPrqsd?O
zN22<J=!`kdi*WV$xmdrWw`j<f(d?B~zw|UWyb`S6_fm(@dmsxAN&F`qgN2{X5Q5k@
zUOwDsG?yqRG@GX}D>+_Tgms@<1K_^lqdF{9wrI-_RNToA*Z3?G8y&~1Qg^zrW^ZUL
z$jfiI{T2~8Rje-^)!LUy{Jav{{CSL^Nk=l~4ya4CUfexCm){wqs@001DT5ohx{_A(
zhm-|2?TO@_J?@J8>14?}xr+@<A7QYFL12iZvFNu~%K~J7FuGhOxldG*D&oYGxRKf~
z+=-Y7<^666O`mmRO!M7GB9>Aa8r{S>SszeKl$Z}(NGHHo=#mM0MR|hKRq@ryL=M$B
zFv1Uq<Rc;;u_aM$i!t*gmO$m@H4bV=J23EQ1#1!U&lo98yKP!5bj8%m42a5uD)`Jd
zkSS!?n)Uq`a}Xw(E-}IKAv7>(6mq006_+Rqp|*zHgg+c}g%MQ%;87l7k6Ftj)Zx-e
z3MF@kv_IS!drx=47UKx-lgq_}nD261YQDR9+iz(EpDrUHoO)&MtmM@E=l*BT2{?@m
zR{ENZ#Pt&=(X408K>z%M5#h6FOh0R4SUm4ju1$Tm-7))|!^V3UOKp{vZeH0Y|MKf;
z-{a=l1n0SnfR0BxQ}FDzSN)LWnS&Y{uKwqoGDZR)i;eVhy%}uX&xbVo>mRj-cgEdt
zEZch@Dg&8QsVN%yst|Ic06yB~^^110(&kQqZT5=KnZP@qi)f?ez5r7rEw7|8%YmOP
z+z6Z3+<RENG6Qg!`%->MM}U2<@ju?ergk6Yv5f^~aE|I)%Iszgcp9z>;7q3jiNY#F
zSpvj!!?s=#)2mSGSmU}ibw~?{O@3q^8UT}h4_%nGnD&gq=9tk&zM+9y0#q7R{siId
zI}0m(SerF5etnEOQ0Jm+6dP>JXDiq;vyN0F;-O)(ZLCvisF}WQBeNUC{%oKbb@{WW
zw(mOR+&a+md3JkX2F2?!#<8*X-tN$wtcgZWd)Ae<7>mqZSE9ac3B3&0YeNY_Ifw<Z
z0gQJ7(}KRA7EV4pJHTQ3__LE%(+|`6J9wMIFIYhvST2G|OXZ?-ehRbwnJlP;LydEv
zD$py&`MS832>;drr{e<V?x9(o#}^~^d=61CeV3=&b5u!(K~YU@Y_zE1Bq2i|O8L(t
z<OpA>zlay!Z%x+U_Uf;Lw1vnVA+?|tS1>=k!cQmBbH}8!>>3ifRcRab#)H9~JO*Um
z)IXt~MvHjCdDxH-wC1eybREI>2?|URWB?2(BaBz!-QBGpz%B%+m^m03?%-+Wy`)=Z
zR8~HkFvhs-aGp?mRi8wf06LZc$%&oLLw*@nJEfUdBQV8{LD@-L4kZGZ*@H{&Kt86i
z{V^Pix~ApF*kVS}NN{L3M>!Ji4@zKdDP;cDY81u8E1Dt+slWG2zuR|BS~)$zJrdK|
zG0RyWp3OUVB6+M?rabjorXf-N0V1G?y5wH|5y5iiKyT*Qv+?tEqk@+BR>H*mvnkLl
z-f|mTXIL2_nVw+b8qUWpafdZB$$0m=EH6V1R0dft=aLv8`7(ec<}0|Yzq3;!%Jkz#
zX9;S(^0_C}dbNRV<Jh<Q0L^amvHz96^nG7`sGi0D<<*+{0|$+JBB2`6E)^z#`{$_;
z+li#q!YgO)xVOP4GXz~0;yo2hYD;E}^%<;j%7#*hw5O0tcy44Kzaj)wDjAoC=?X*;
z?zI`bNK9qy<5ax!f%O=R({v>7>j&ZNkEYB44T$%lM+7*?hF==KJz6{s_RaPi^d>|_
zZ+_r#U==;JIYu80k>e^Z)y_Qoh1q+umOWqgv5;>{x5u{PkFj~z^6~7AeKsy{Sp5?+
zYf0MhR#m%+TmX;>i-bzdSFe+q1AN$O<arcFqHXZOPw12nryYwGc3GI?EK+TAGPE1D
zj9yn!Kk?8!`vz&h_A7`$1di4Y&AfVR>{h?QW^Qm!Caxr~vG5yk04I~C5Tug1y+-e|
zY5;biZJYy2113V+o4Tx=&NZLqIL-F(&O$*Oj%W;Th1&I&;qGa^FjA-u_PzREE^DEq
z%lDh>BypTo$(Xp#6Kk|VQnE7?;&5++Q~6Z<D<Yc0;$YM<gFcDh4)Dpp>xc?$6Dlki
zVe{CEvm=YwtGoYrJoof*Kt1+Tr0Nfo^2i$eWc&r!{@GXTIq6>VLfR;e?J+tSy?M#E
z+Bdb-S-KznMFk}r4hQPD32dAvGLs8u0sn;Qje^p5=CdK7tj7tpH}H8~C3_EDvAs-T
zaXGUfuUFV<IVtvQD_JYVwMLMW&VAW@v$jvf{3#5YgKz24A7?Q`HD8+LJqRDz(C(Q5
zG}kS{>2&siAQm6-<Tl3~6Zr#+?QOUjkbHeD-(6<(7aGdgM@bR5>jM7SN#PkT@eHH5
z)zMjuo|y|avRFffGMTx<FE|?Yu%d{I307}G9cRzk)Xgh6FI~2??;%dj%;DVqa=6-l
zq0I7Sy&j*z0cF=<kNT&v%gT_2W)aWMwRZQZ>9efvrzTn`s;2eFcdtNIffA~*m0L{4
zO%UvAfh1Q3+k6^R3BnO6P#UOBN=qqZyZBfVRd}0ZqGP-1f{Qzb5`<AF{Os`?2a^%m
z67jhgJ{F6Zkza0Xr@$w`QW*P&rFs(6PgjOWN3vF{Tk@pfzS_v*>bFb;inv<;2Bx!s
zZG=bQh*QMr+AE^Q#Vm<<*b*!uQ&15B(NGxKkM+VD-huPR+L*kO*V(rrio9_%c{RES
zyU~6f`mEktBlukN2XEmc64og9i2G>t^Ra5-wW&iRWFa+mmu!6pFlQLqvYpAr24Hie
zPt&-E<>ec=_WgCHxOU$5E1Gp!{dZu9|FQEHXW#WWG|S2{m|*ByI)dY^v3g|jq2nGR
zoX9U#D7)Uv`D}*8Aq%|On-pNHGp3OCa2uNB4Nh<GYYnx;IW_Rr1c@Sj<sr-P?G$R^
zTZ_0zml%1TEd6C(9f}#D_JI@)d$w8AI4duLjJRvlcWXqpbZweV;DmUYYcRZWL#)#^
zWP4{p^m5oUz!$gRqS;p0zJ07wQb48LappP)@y5OI+9#FAXK4CNkXvEBoxKO-77OQ#
zd~7-sj@IDbI(cAeV{p>U+Nla8W@tdLa`?1N(WVHJSJETyD6Wr|SWs8hd8`8dE_v8c
z`9odY!^L){`J(mgzN?uAOeBa0^SN%}7^UeGW6u{hO0Khv*xxVlCHbj0zkMVy3-#>D
zGN7OT8L6-o>|>Se7Za)22k9-<=1j$d8tY!?{dAfZA&a9X{Dxi_o@y!`%z={Zh6^MF
z-c{geQVkOp-DhuA{&dILH_SD$=d#=<WXX)!8J3FtNX-*dMjW`<SlEYqP?j;z<QH!@
z8^5q3-_Hk2h=GHmxU}Do>vilb%BQK{kw?DgDry@ilhLt<aAB;98f@!?$slF<QmIm5
zFFkN#V>e8gS2x?IkD2S-l7^}sW%x&L__28edmwVl*A76K^=UG6Fid(_*rA1}@%Y~9
zf-lB)JCrwr;tpMu5rc%Wfbjl_Um=N#ksj}fYuvp^M|Kb$s%|Al>!?uy?hCTR0=Pqi
z`6ag0l23W9D0!^W@@jZ$o}9NOZ8>jl51#>r<6xy;q|Wt8jWgSj)BWX9e6=`ieQ#g_
zxMsh>-yRx9pjq$>qxNCOm=3;(gq;|P$$UjsTrW|>eGFm9wUK2o&#eAI8D;}x5=);l
zqomF~#E*P$jgz?XJl;sp^rEshfE~PyLFe9<6pyVw-p`2Yrk4CVG6^G&kCw)0l0+#U
zvPt&J7Z1`feN<xX*EqUn@iZE{ADMY8CInc3KMp`YQXG!>`}e^&#LLJ(z5rtC8}D(9
z&YAt?fMweNQ9niEW%o*48{RX-S(9z^oKKEg3g)_b+I+#Kaz_QWhaJ;~n@RB$&;vn`
z#uBo(5&l@Ww*2D9EZ=01U!hr0(LY3L#d4P}P~Pk35mcItq58}i5dzXH*<UmsEbjb`
zu4y?Kkz?g)&}{d9%sz(aSq%}An7&HaL||_)zz)_$5R>F@%S0-yGlfk<ogm!<?E0*d
zT==P~BS)Ag%lsJRQ$?V%#y<dCviRC+7qW`a5~ewu9|-Kx@ns(=V|@AZUXAz~@Wz3s
z-@hDh9}^I1H!=;ofq%(=m$l`U&GpS{u<JZ>%XI$nG|8>+Hd*1Rco{=&1~Q;gQiSF`
z!3X=q`vX*IDgpGTa}?5dk0ew@3yK#=d21$tBp8!MIU!zQFYzTa9{3AMl}BA}V{{PY
zErP5XAQ8<%OAX|OW?SzFlgkys6^=a34hIc*y}G2MO;vp33Ilq%pK|L-*?wH^#UnKz
z)@28IA-)o6zQ}mzlkG-3H=Fpz2*<35pPWh+sRzH_WcmWlq&n2c=!iuuPSxrJ6B?8y
zXoEzv1;an9ohJ(s%aPlXOcV8v!hFPmh>Dkth<PhGClUE<%8{BwG3_7#*eSk&0t~@z
zeA(&^;5kQh&YnYm>>HrZu1viOtu1veN>XKANh>JKfyv>k^Ky^prpogyR2xzRL397U
z$t-y)J)j=g+yu`8ACc%MLR?EC(ql{eujQ-5n4BN?Y0ykwVhHQE{X7-wL}UiBZ%PHq
znIo6>(A@_YpVq8p+16xyczq&Uy7BvmBL&rG(8Vg;e?CsOrcZKI{u;y~Se?-FiLg%E
zd-b}pU#;U7ZwBBzSH8Jo5#t)Qawsu=;DArou?dVL2g^26$O@15?^siX8h=e{;}T5U
zO5Kuz`)(M+89i$YSLu5gfX-y*EpxUqMD63DLju*Kt`&;vv)kMAd+a4t<09E;efnB`
zEp2i-dxk=Lc$JzvQHqMR#>v!m<pa~v$16z&=JZ@dUmUvOt*<=gCrMF-d_dTb`A{x6
z)91Z$SA9_{#&L9(s5^|ix<zeVS!J&#oIY<A_n)e{@kEhKeB8=*z&Up5)pf!J_+R;H
zmaaKl@sEZ1%KPYuAaIqr<kH5yM5tUEZ}UbqNz$=DU0vo~?e`Z4U%c|nJ#3VuHjz|<
zk|mY-85?X)d{r(A`}@;c$0<94zCOLYsPEcyx_%X}*Dlt9Op&u{<1xDbZa2`Ex{Ba)
z>nv|~U$0<)TRPF_qr`eBP|K>RnI`MW>zFy}!qR_xYNT5Qo{dzMKdY~7wKyDH?Pe3$
zQBQA}86OE5gn`Bt(S%awN)Fw@OZs(K5pJc#!p`3JT=L1>QoW=cQ<<0$dMu&HT>|km
zV-_Ck_ba0cGER`W=TEIPxQMK>k3G!HHY^ZrOoNSXj(Y@szFdXZ2HHsJQ{$tm#GRi}
z4{^OBYF!oVznB2^u@N`X0jJwMB6tIGEPNh8IkiK`^f;8{{ntJX=Q5KUu=$}&a-CQ-
z^o!W_ZdywUbydRnB>@=1Ih&TCW&9bq1K&!Qdv2eKC@gbLC4NHcm;0ZrZ>*R!Ks1+E
z=3VpE?Wh`$_>xGL(Il~jFoxV6ih`w2PCW{V`r${{`yvVS9Tc+yLj>f$rMNY|auLh-
zof?CUiaLW>z5NKxotG<?U0?4~hc_G+Y~6D?v~IMM2+mwbuN|i3mTS`U^m!%KG7(<$
z@tg1tO`hC3_y-38fYvX>=Na=-Zp&%8YcHe3H+S6Ip|utpAL?`iamMp7IHsg`4`-b5
z^>q##lA2gyxk&sX703WQR2emtAS}<|yeKT9J5-Q_|EW5gUT6X(TM|>;kR)-?N#K@d
z$@@+__h!5Az}WMi;eGpzO4z!<9bXvJp)?&6fDGQTxk%s1dkMgrDT_kGOD!}U?fJsu
zz#xjvSHtfoKV<k~2*VW_y{||4g0!ng3J<qzjJgAxS-T7KNpe21Z*nWM2>T^QLhAKO
z5Km<Unu=TNwej`dQKDci!HipW&xF!}1arhFA#d-E^Td~-t!YxrW-db;_+{Qs1$Kbc
zm=aCkc){O4%gO~=R10qYe%`#r5)mM9_T{$xe0yT?47$<cl4%W1T<0`s?#`W!L+9Mg
zKBbVv+2)tAB~<-Q$?4qG#_m*&V)sH|hMnFf)nUedR?ym7=UC<$vHpXNOIrD$zfe%M
z&cdS$S^p&pZJx^&JSr6zK}8GF9Xyt~X|VETtRm=M;>CCCst<R_yzl8}a#uY5OC4mp
z^e*WLz8$~Nn+?3NLzCwK=v8tI!-iMw&Ff;<Xx%xD%B&P+t$ku-dnK<5+XOb0<YsTZ
zm^(zubVaSbzIevz%Ov&Ml9HLVn>d01t4fq@B;LbHd}449^X1a3<gwZPYQ=j%f5-G{
z<(^CCvVaV&*^<om=Sq{8tmzx}Na|U9C>tM%(sz*2<Iu7(D}8trQoj}a!~Cs4zz@|Y
zGDFeMYD8FLno{GKl;;gL!l}tqV&?+ymLGN``+B)=G~XMn8;{v~(%Bwe+%JC`uR@J7
zIdtm!ranDrt+7rQ-s$vyx08B7FBeN)m1=kDQKL6bR4ok$+Za~|J-S7umXov*t1k?e
zmu;+_w*OYP8;;9t`WW8(EQK>jMEhL<Dp7nd%ob2!h@Z}X5aC$wAF-QFf*ih)fEa57
zM<kCekH9NQX1U#Ov!5R#q*i`W3)tdO!5-w19qX5HbDan<pP+)`X0cc$=y&KoM;Adp
z=bm{{3>@lPoK!hDRs_NpY8jVol^^6sDV3Aanf}&No#{s4NNyH@Yxo`05N2QrIw{t4
zBPpA7X`w{W2D9NZDS9MMWKf7PmU56Y8-t?<tc4OoiwpS{7Z<%`T(6KwUm-b$%Yqj5
z3JA~7`HO#S_Zvh}xfH&Do%g<eG1*;Y-HWH90SHKzpS(ehxMeIp(&&y1?0)?u(iv6B
zceAS&S5dbz@Io~FCks`(klYi^nHtPH^5Sucb=EA&*=jBJ+;zIZyga_@QJB$`P8QtU
zeOh+9a^Vzkt4b!qz9QinkG1b@`*2o**4>KY-fFEc>!t<mo$cMQI`2YH$X<wumfeQG
zoWY4}%e?JE`uo%^uK`mnKJ*Ub%6B0$|3KM@aOrf*x{m~>Q+X_OhLCDtl1DQTH-?um
zE=?X%`lxWVP=s*@lPxQ)w@O=gC)bydVIVo1Ptv<2X~Dt+cZY*z5Et!CsCrk&1~IDq
zla{Vz!C8v<=^*zvynxv;@+uhXfqVU-EY`C1C5*}4s9@i3zRA!X^1^lKi>n6i5W34(
zk77bapC^N$Vl(;GS>;mWx<}eIKG%j{u#iO(CDLrkYj!*UwKPnZc$aF0Kl`YRHGt7O
zpoBYaBOb8TRX~WYPwd(^OMHU^EqZo|kjlK7^=p!6hw(Tq+6f!m9aWEJoj%7$Xl||S
zU?*qSbEk5fPZKO?hZN-#?R0}nQ^$gL(^v~F$_t(2;b*nw`nFaMu3k1kAt5k_!Z?EK
zQh<cIEk=|(#uDp}AruT{W8=&&4=<z7vsz@&Ystyyi-)c1<WNfj+rSVu2m|ISENIw-
zE4MNWQwrW^j=~-RsmRKrUw$FQaON6P8HeA9#R{m&?rV+s5ED)Yu`Z>?H?a0c#HTs#
zMD_fny(7s4d;`15W;`OZ>ciEo12#t%n^ZyEXnVWMa>N5ryQE;x1n(EARZZ`_BqX-S
zWy0nh)sL>il@vm$Z>fZ>xDDI9-$g`n#zWe8L6*|&XSgd0-1M<J3~$<a#7#Ah>#T!&
z<c|=0pDR_gITC3;jvfzvT53I~b<Sw84J+`*-0aG>zwmy2WUKdiN@_J*LOE-2-AF9v
zSr4Btan2qvFFsw)Z*j=f;_TvU-DEnGTwCe06tfD1D6KX!5wmDxtvVe_ARFkZ=)*b%
z#(ccijz?tC62OW?T2AtnVKrVhIyIc>!4(spu}s9%oGD4qvI*bp<1dav@NLE=w`x%c
zKFqOD967R-i~Haeavt|At%`OhxN^)DMmG&5_YKKK>=WkNr$Q#UkUOLYD?Dc3gUZ@I
zE?EMoUz!X{9@gim--b1{zkkq)st;_lc|VBSm|w28?<v|e^xNmc$SFz0LH6gwa?VhL
ztz!<C!V}ApqLbVC>MfUhZ(QlBzSsustnxWF$Hm9{b$)$X^yje>g6-GlJ?_kLLYHDz
z?O|?$yvV>?>{fWTTtA(m1%`oiDthf48&xCrH>v?cRs<H4I+y{39H!oH0OJXvJjV!L
z8Hufy=(9$9P#2`J!TWnKuOv<+b<o#q(RePEvF*14B-a=?K7*aqO?CFfDSsy_f2X)+
znHz7$Um<7OSTNw`yPs@zUfsXr#LX7FTeTW4VyF|@OJk|C8x{RXH)cZPX%p<Os?}aJ
zL(-hKE0ZeXhZxm3(oxlR{|FB@93@wb4vwnMmk7#Bb$!1y{>3HVV88kLsCc|BPI$H_
z`<Ts>=Sb}X@rvSOQ++Ku1UxZWyS1ASf_WWY%LovHJGO%To(OIh`0iL;*H*G2nu82g
zY3{PP7;AI3ut^abGqKIQ^l42$xdI8#G0CUz5W!Y1l)a)PTAHUh#ZT{9{9?aPJj6Y2
z%%09$1X-0&QFWbw|62W-nB_5@v>*e^$e|Ws?y`w1GCJ45{Z%yVlj-<RZ@nABY~VBB
zL=I)c7{>gd&QSO#f5T!Hkxb_ftp-mO_QbL`v7?g<GC0@z;Gp`#s*#kd`tk*(EgMzs
z@(B_2l4^0?xdhqcUiWa@dTklhEBv4`+hIk5SNEh%D}P3Y&?(kaWsl&(kkejlyb`XV
z3Vu$GV-Z*%@#gc0=CA0CH)?QoVPqZM0yGN??H!hZD^p<I4-am}=eyTCe#jmlBR49Q
zc+OC5hn-V!Q6W~eA0km6M(|>z$}a_L6o10ec`!hWcPU4dACYC!97^nWU|2B+Cs#}X
z@x=Yf+w`7UE~2-Jjrb+qYwlSuHu`=;#HaR2R(yV=go8msJEnOxzZf3r2)k#$XzaTS
z#R(%r=621YcE)da`~dRFHp$Gqn%aMP<KVhis3?S;Z#+jpsoI{fLo*v>te8NJUvaE&
z(IB7-`r)QiO}H1ts{OJJh%z>=N_rTZw|x*RW_<b<m~VQO0Bm427N&A(sIzI_mC{I-
zwK-;qEnoSFiXcuc5`BREK`r!j4ZnVl`iDCn^HTcKKCb)PBix$9i|5G9XO01}jKDS2
zstVO1Sh~pV+Hp&<m6_=XE;+>9SK14PEhAXn!jeMfB|NrO3?ME-=(fiFSfsx0;o?zW
z^j2I`&4#*63pY@dZ+dM$sFLpWOT2zc+VZnLYZOfE1`ki5nG2>ZPci@bqSE8lw?TWT
zSw=NXj6R+)cbs$DbrD`U8)pJMZ1p<9`E?OW^O7S^H8P*Z{@CT=Kw|A$j9-h!!v0sx
zTbRaB4b_5L+CMM4xyE8efPMa2%6Tg?kHUua+e0R7u()prx(vk{*{c=VRl{F2>-q;q
zbfn9e*)?<H{X*|qs`FK8azq=}dOmKi4%C?n%3EYF_jwm)Sh3uEn0YJPJgj33Pwo90
z(#g=i@iKTax=Mm=Y&<93f@XO~<0DM)w#h}-VAp8fbyhZ=k+$UNSJK}pHaB|Y>+vGE
zAT7TyOw~(bv-W0#zD|#;hYh8$Zqm=pT*WeTzCb$AT#cm#xU961*rTTSL#%N@(AQeT
zsQ0l;BE_)=xO5wE3C^iM#-JNzV*azP4aNGQ76xp%EzSEH>lR~d8j5G2uUY>_v2k4}
z_eA$m>;mONpuh8zpVqV6@WA&o>eo7t1YBJiCQ<Du_Yo;F0h0*<?q#R9S-AsD7Gre6
zOJvTbXdL6QMN2etf8baYK#O#yxhSu43W1d<Hh1K8rD;WZ+k`rlSquQs8rpSKXeNs5
z3B---58_DjUCk*9nhI_Z4yF`JeO*c7z|$m}6_ypZ17&%&4hh;NMrmQm@r>zrKAO7^
zd|s*x@>y+E^PTXqTytL&H5T~&`0MWWj%x0ngNL!>Q(r07amswFIp@Se6mAZI3doJk
zGTFVT<&L|-k%wEB08nq`I+>8`+x4(nrAGJMtaYWoWdt=#_2(|`jz1nGM7E(=|Ab=u
zL4@^0HG!P+x3v&F#uWw2hIPBrCeDwD0|U7ihES0Lb*H$r!d!ioWcw%@JQ*%<X*^}K
zAaF9T-VKc@&BFNWWt&{dEEq~|CXMh>K|iH9B%V>8@)b%gg9-3leBW*~Vz%FU$fLO5
zfcQb(u<u3x;F@CS1?}v*+lEC9r_kJkR_hDdx!{EXi_<|X`w}j%a)^F(#A~{2;M}he
znE}3u^afqVg30ps_l?xG0azaA4kwlE-LntA@;C5hGUTa|WS5VPuX3x(=p2ZgOrVZ9
zn+zoqtsHKl1^d(Q9r9ugN~@|=M`@YJyz@%m(%o);!L!QPE`MQh`+k&+zy8_jZYQ;N
zHE}@afa;cDzqHPs?MoG%Th_1IV##y!`MVha#bmSg!dw68R8^(#*JyS5OLI~3?Oaeo
z>au%GrFwcGWT|LvBPJe4b@RgQxse_PM{cYgIR?u1_#EGP+bK2SgO!v%k@}VO=aC9V
z1nu0I?$%7ME`bM(VTwKn1A1n+H(KA!%Qk(`TN#&Wu`|zBj*U5Mh+|5mlM-m$&`ASK
zv8*p>V9|63Z@NoWZ2DTt-{~X4(QgTNXMtj@4<u}qKzb;~SZj{jOcdoWx_8{N?FU6D
z4|jCJXLB5;VV-_`!}G^og~F`)f)<@nz+ORu9l=>B-|(dZSgE%3hCYjSZJjdp-SbYN
z!(Vm3J=8eUR<*!F^y`KQNkUpFMR3@X)Buxlc!xOWL9gWRK@m3@T>cX$dgO;BHci6b
zVl_xxYJtqGon#2NfRbhpGr39(eNrkr9K=v;cp?;ms(_-}H5E(p6<tMINXy`dS#{ri
zqP<@O%0wjceu|Z)d~<Chr_09%ccrd(Et0kJ&I|3HxxOvd@f#JUqu7ZdP`jyh0YlPn
z(J^ToJ69Ydh8;D&A*~M4j7~>|@IEJAtVXq-w{u(?{k;ON+pE7`d4jw-%xan&CyY@%
z&u|R#k_F$06sm?3VFJH{*;a&}e~z4%I6d2Z3<77i((zEm2iq$7>UP_Q)A8%poMCKN
z6)hmcVT4YYQt}9UmtWS9plvo8(pY20{5q<bDxdIE+(a-ss%IAkkS~k1VqT(S04(g;
zvEUkO@}6HiN`wiiYBWF-$S|?r*R>E~hb*k|R(Ta*Sg>o2CkVTE(_4dO3}|o9>(nrU
zYUbS+oasjhaKJ)rM`c}E4c9QXhGPyw_p&Sj>mXMubI!LxN7~ZPeiqr`A(l1H{bj<|
zkfKXAoRu6vf2A78*E)XEkyT$>X=qfG^-h}!G5N}cot`Adrd8a=lJc0wos~x;bk`n0
z+P_mT(fH)gHFn3u-!E&;D~sw}?g@tbp-?@+N4?K2m)TFC$2pUJb0m2-l}zH&IgNcb
zdW`)L9eA~qTDSK#w%+`bq%kGUK8n)XEt1}^M>g|{<!&knXLYe9`;kAPQJTS}#y`4+
zG;O7>Pxk!EjWhr4Yo^VkRt73659Sm8k)7P7({P`}3YLK$mYW@1y0;F-w>jEU_s->C
zEU3Mm95EPl+TEI{)1Wl=*u;2ppb0fP)X)rbR1h_&e49a5GQ&nsraC~03@Ak%dlMLi
z0~bhEmP9eA4^Oiy8<>GPsqhRHlkS@`zag#askoGek&7{bQ#J@oS*E*Lm9;UNP(>O1
z`}5X^%FN}5iK%&dDvA}4Ce4QjSO9=r8mXTSsYsdo)Myv7-~4BB?1eg5PNi8$XhAAX
zR}FQW2+px$M~8yjO+M{ulgn>UJw?*I?KgNa{$2~+;);s!5rR-+U-+1l-?X+CEf@=?
zE{vN^@5J3tMW8araWk!u+>*<c5f-jw?7aT~G6Lk>&HUCpA!6IjLYw@M2`5D*JxE;h
zp)Y$}gKwqXZ<yB3>RkCIdu%RH$~JGS=pLK?{-i|pAT|}dWmccByLsVt&Zq1x`Ya35
ztC{FY)`6U$(ecIW#@*-Ga}*v)aah0BvfRtKmzC3a+{S%2)NA!_;kmDpd2l|`3F+4z
zms#l`otetE0o>(p`PrAVwCqgB7lOw}EWo21tLfbF&e5oPVRu=zj>p}_TXEl-(Ev^?
zr+t^vPuxGaH*bndSD3!y-nk|WDi;2F(+PQPJb=K`3$)PY99WXe{c!V%WK>@ITKa<!
z7M&btnPvKpA+l4_T~O%=ZytJKntT2cQObm4|BEdQT&Sgb2BXvjb-ZbQ#Iymyja#)X
z(VK)N?!C0jt0kbE-Otc)Fu5u#c4p)KEZ#xJ+%W7V2Jk%&oB?@B-T2K9Eb_RAdx1)p
z(I4R3coAwC1pTt-H7cp3`ZlLKj9n~jN5<^i4V3;REf9`H0x&aOPI%1%$3GPu5$0}(
z&B3--%^D(Iw$N-m#XoL4!15snyO^0Un^(rRf#xe*g6OsuA$EvpxzPZ;+N}EYiWy;D
zYp$=2M$CEitTkUra>?Cx5;rL<zhs|$8^#zR{lOEGaua)d^V(X)B~_X<6_GjXc51=b
z#@2L!dDrGE_&74R&<apLD*pyNZJU#KnZ34Mx^R8ewBl}@dki1rNyWCNnV5eMOkXL#
z@Qra&g1)<*-iyYb9GKQ^GB+yw@fOy=-92!+k8uQ3oSr{>C9|&?NVpsnyd}rs|H6Iq
z!qlVx(rg5y2d<Sh5=H8}H+GugS5x1>@Dnj5Q67@A&hW^`#i!4p_YL!~ug3GHLXG9I
z{{dLCAK&`(D)0FsSTo)Grw`$jd;%4c@`2stRmwC%SyK(ZIqz!Qb&KwTr?0Ls29$4u
zP|S-~_>E|{$uFo^2e60hQ`if90|dSSI^-V~XvSu>hY@Jsf-!reMKqtsX*%+pBOj56
zN9yR-XcwRk*M!Uo;0~#x1{PBQ9e}i=<nH)3flvX)fudPIjtHz9ACs3JQ8Kw&6B6Yj
zc(R2Ny*w@f!9TizjbZy?cmmfq5*M#qSN*|ZWV2-4%g-dBgYgHZ;2mD%-r~>?&S_7y
zoC5TJj03s)_xk{S=+1sP7kFFF{oq|AROLd%)7PNAVY=Zys_0HCm0@U0CK^htdexN)
zD5_?CyE}3B`JCA6xFbm?k7evRKG{EzWO2-*8hDJDW=O7;jz4X7yB>*jHi9IDOP1QR
z>&!XY3o`S6e}<Y_oJLcQEZvyCv0LmfpOX(@P+Gbf2{R#3m0Zu`Y$5?FIKhSJuel^X
zWjby+Lg7EU&(Y1Qkh8<jSgtWl+~UanK1QULXh!PWTbzOIxgKDdW~BPO32{O89Sf5(
zHrYMjGH@R7qqj}`v5kp>H4SX17;x>9k}kpo-i5x1HDpcgHcWMo@({mJ+;R^s4t|aw
zqcyb_sv~#|OhWo_ZHDx5D{Z*nqKio~GZ>4XECb*xGNy1wKCtNo=>$$Hb^Ph9c@iy2
z;KyjAv8i@l_4D#hLg}fgb99j~7nYC&KYBqOEK;@Q|H(#ue&lybF-Wi`6H6Xz|0e9v
zrR|8AnrII&MvzIT7Z)Xsx7>YiSRwQN?>;gEcIBsS2*(sK!OsTe2*+sgA+qztyoIpS
zKG=2x7ZX%AVgvzP+~DCRs!8Sx^y=u{`fZn?)jVB!330x<tq`|4aGC!I!q*E_@-$4;
zld)4dmzC?5QKBbAH@BZF<%VUcg<h$E0COjMHX-KnF~soJT`*rc4MxfAybXzFns3J)
zrz8hx&$)90XO;JL#))QBVkxgJmz^<a)KcJT&wh<WY~$pXm^Zwfvok#H*L3llB3r3d
zA)SJ(DSpupy5ybED`*nq6J8dKWXZ(+of(Yy2G*frG|gZ<SQ*w9I(gIwvJuwmq~CX8
zk)LLRapf93xB~1jCvpCtX72hc3a0G?_>Cx_aud?sEsINcDX}!turw0Fg0zH$G%Sm-
zEG)2;l(e+y5)w-<t+Yxl4bshv_x(K2-|+rEbLKi{=FB-W=lXt<C~)i1JH57#YF|bq
zBqP)$p*aXL8rtWj0q=!#0jeZNbfY0zCB$Bf6nAoqKT_t)1UmRCkxbdh-dGURE%c41
zohW21U|Te`mpX{uh`;-|_7T?fM?8q&;_QAo@Yi3DR{vN4Qf{-MM>Q>(-LQ^au6rdJ
zYKK(zVF}y-Ociy3Q&Hg56i1<Mau3*6=PR@lf-kUlmwH)9ti<%|E8EkLGhU_2L;(=C
z4Lfk>H_~saGdieAE;k2ndZvT(#NgiA<^%ahk-kGh1a<JZz}jc{zeoxkX2k*)j*t)%
z-(g+!sP=A4dQf1eN3hTiSVHdsXJ{UZ+klv^kH!B(!=hp6eiREMe}H(dcDl|YH$_Y{
zJY>|N8M7tA5V9H4aFw{ToZQnmIPv+lT8Sxz%;%iUK2m}X2A1yO^q&J=;sItV2=>nr
zpszn;GB`gnd1F6ojT%Qj%>(S;=m*F8d_<(?E-NV*la>2kKL8pMJ8cv&!lgD%)l1}+
zeMIRdJUmr2Q~FTlVAA;Hr<PVGQ7-Sb>zS4mTOyYW0JLU|1`ANq&xL#tQ!EvMU()wO
zb=*ArqA&`K45R6a0s-$Z>}B$`CTa1jnOClpD&<M7RRnL=)k(53tqnZ4&v6r9==G05
zUO$5!3HSm-B#X5%P#TQnQWfnqY^c1y9mhCCm$7BHvOhLT!Nfu{Om5J0^!K_rW>lck
z{v4&#z`oD^P+AiymmlH;gIgKYV)?jIRn22k`@dItONzx3Mog7mZKryC&P_xwv{X5X
zIl7^BS&Vj9xYyMR)p)hOy%Q`K;Tqt}oUnTVpTiex#FSP0m2K`?O`U$S7)KAz1CK-e
z&;0^N)ExwD1t$CQ#VX<D5NluhisPBc_rAICdU#iLoY}7tZelz*VEwMjj8g9tr>}((
z^5ua6giwJ?bh&op#>n<X|9~82zwPa#7LS0ipkwbBdVT0JpAk3oF&S54*VvYaJ}w$B
zjF#BwmDPbNiDl4I%pkBy!O(~m(6BAm6Ix})5lg(BVS5%k6Jp;^FrPp!T<758(o!3s
z!DLVcp7z3N_6_G8(3VyPZFVXBa-f$O@OU%a>Fk#@eVbf9BmmboO9q+~!;GEGTcyUY
zibPK4^4&tYO9gMTB2L3oASRK1#TV)Jn6R43qC(?H_rd$CTkOEyq*nIqnI$Og@W{i(
zbvvKBW~VnKfHlOoQ4A`@g6zfE(mCV$Ys(Sf{0?>0jQ2Z<S6Vq@VXEd&x4|)yk~%w{
z`>kAUs{0H2yI$TrH`q6C)^PLhS54;Kq=vb?oF%cI%ubEIn(%DhZ>1H|XY^zj6fK8v
z%Bwl7-E$hzp|nnPkEQUMtVHPk(N63y!gI9c))N;-ihP5;l3Mc=f@%pO`gTddMrD8M
z8+ENFo4acdW-vdw>wzWCX3FAIdTCx-!VdDB3)V+(^p9$H`}jMdaXMUuqW!18@+D_c
zYcZaRJlt$vbp(l*sF*m8h~Q<3g6Nvh%7b#c8)9b55iUG0hD=KXcc-SMtpJXiJ8r-4
z)JUlwDw6Dv(X#O*A-3YYjD^nLHK_)dZJfbA{ysVLL8%q9sE#|Bs?$g6yFN6N+EjpR
zs>`r-ib$0Wh0bCfW4>atCn1pc#SAYEEH(K$!0%|}S9$?N^~R_e{PmFxklwMvm8+<-
z@0A|m4c(*mv6&2}abrx!A<`Bl!m~rQ%a<WCYRy(Vqq%m9j$~wYyr(G#g`Bsc1X**3
z1R1^$q>5V#hdySik!TpvXSblpOXZ;d%b))DM0pxv$fQ*3uJg%nPh5Y%^}>}ySJNCY
z@yn;PEM_W&-Dp=Vw~nB-*vRtbtLYM^hWI(7S@dPz;p=Hwci_fxcjE9DI)<w66pbFA
zGzoIHnP-2IoFMM!zOuh?-`!L#s|-7ET}w42P%Bxq9x!&<JO9oi`YwRbv-A|)_d_$d
zk`^C^_u_e0vg1b)Pn)bYN5iposHK1=YCFeY^BT`iJ~K?Ku`!<hK9(=H+QieiBbUm6
z2OG8DtG#J|l;w`%VL3~W)lEmaQkrM4#Q<4JwNU5Iq~-3tGD-;h7dt<64KC9)et?4G
zPPu?DKHvusZ`SKX>r4NA^`Y~yz}@GwF&e&X&9VoSLx5Sm`-`p3LtT5?-(^jzi8<6Z
zr)$X6p0c)ul6`s-xm->)O}ms++|aE&a~~rVyG!*n;FQy8=K6<&70a`{hmuHU>f?tv
zLD4N`uX5Hm3q6y=bJg;OmladX!rZhB>osn_w~zr(&rXkpn<S}494UpdFO{rd%W~Yd
z<6Uj!1q^Q#6~f``2ogRg`xx{{!=feUX0?*q%&4uQkD_pR(OrrRoj0oJ2-+nGzV0ZD
zr_r@Y?Q1~gLOrIX-Y@)%@3h>``xgqHvy(|9FEoJAOkbYnua(YLd_%eLTJT8h2KOht
zmSZp6@%(otVH=i{G^H=i_pdNs7<h}!%N|S0F<$QR$3O+8Zg_C3?q~H}KNEqg49X}(
zF05zs)ZsRgauF93SDv4qdPefQI%>F*GF1!XQ%XfSZB7<gDhp5Dhf@ZtL#+(DR-B`S
z!91<z!k-j+yYWu+ZgR)uA7icd@_r!t4>VU?CUZ3o2$XOw`lCS1<+dHOjg+CRDwq!#
z{RAly7s{5=<zf$7Dmh>#jlv0B+_Mugq$Dh9UA*XGL1<x$-uAZ=!BZfoc?HvKP`T|l
z>cO_}EY}!{8seV&lB9=uB=}R+)jG&3PiUg*b<3=*GG0zfNSjb-tRHyZm(@jmi;^B8
z<T-hJD!bm9#%mpOXVV_xSBDIFaz%CIAii{G<tk@?zlcem;ICE|vRsY@Yq!?|Gx6^R
z?(ynu_3-Zs<!}}}W=>OMlaHtow{nx_+vtONByTOHejld6@`fPaCdDR^m$2L!vlYlJ
zPi>12<&?Tc@F9exsw_ax_R9Kug<*ssw&<*@lkD#79nnh5g@BDbK(Oi0@E1wV5v$uv
z3O?;YSph7(wEQv6S~wjy)CS3JTN6X6wdi!~iMmADaHBlqx1bNI^NvJQ)Q*T*?Op<!
zsonhW{HiIpxi4`r$a4-TA0XPffaexC=oS5K2*kcjeH}~7p}~`!F7V^buF)4crK=eY
zu?Ma{pwPpWu_KCL9gQ$psee*CoC-z>kH-J{?iDbCBsg@O5!?+=JHPFq20u7wO)7WO
z)vzC+3HGDe<z*Jce0s%}KtgNX=^VWX&8DefMmPZsJijFiG(!xlm>}@X)UqPCzOtz^
zV|bI?c3o{*()9rBp0B}}?$5k~5I6piibaI9_Bn%8NH9N^(e`pnU_k|)NIMP9>RzPj
zMwfkk&<Wo+5h)&WGTag^edb$Fn=b9R<4xX@^%{z#DjK?xiWjLG^-k<CUIA^YD^J@k
z%jn1dZjUsnGR0ukn@*(8T%LrCZL*Z-Joir;JI{W|ao!@9I9ARxAil5$VDxR4@j6wi
z6yd$+L|mFZ-)9?`-O(mCCMc6Xh6@6tfKg+%wIcxx2uxwrE~SZ9O8D1b8cuKrN=B{j
zJIa_a&tJbtne5e>?}MMCd~A$H3WZ&kB9jHcl!f<3cI<GEbFt&N3e)lJ@w7PWsG3LR
z$Pc<1TwZk{2+Cr2M4#_RB_YOF!r}bn$o>c&ehXrj-DflWGDg~L@sB6ht78-TCIc|+
zSh1#|d$wY+g`51w*3!DMCYE&$BE>EeZ~AbDrg$A(pck~`haR?C>5oS+@O;ZbOO-d-
zUDnBxIl!=ll>H_bFb$RIuecN)IKe1wpE>=qZ|U#VYfcjH0!CcHX8qKM*{^~gjth`$
zuXhbWAGg-*<Y9VkO-rr3&!jBO$}HuFP&Eo`IX6~ng6D7Zg36}ED<=q7Wv}pMQj{6s
zFwjgU#A6`<Wi$i@Yw!?je{MyqzPGNjRnl3jGhV5H8S{8OQl9;!of1RNwf{sIRBT=4
zU8~itya5;^c!hW3HsAfML4z=Yy|!-_FkQ+2@O~LZkBj8$hE7%jqWVQ(J4tX0hY)*K
z&7}Jq=ceV0MuB=y%R&u>9CPqr)B~oQKI?H2P1k&J2^+;X=(@@V=9OiHS7xe;r}WUS
zD|`gOsdyE?m-zR<{P4oWgO(7a1^1Dja8R?1X%jw;Xxk3S%eisLY*3_0R^@m1JsaHy
zGQj<NpU&M+?v^#~V|!VM)vL%iq2~u1MA6*4hTSgtmQ*+)L{0e<{;}xHLnHF(A{*zE
z=Bkbw<l-2Q>*x3v5dT2upr%H)((83maM``a4-%yPvuEk$RCDBKkYcQLlb)4V&W`ZO
zq^iW`@VANH7SQ~#Y~e|jyIys8rN|*F^-Rgg7c^VF6{O=`Q2Y;{lXt;xqf>*7ZZyLD
zz38qO7X%*OwQvu7E}*s0Jdsw3OxJ~iHV3dXn4ZJVQTP?J#Xf7YSP6q@5&A*#)<d>(
zrgR}X@BfNMF|2x6ml^h*485S{OQ!dQ_Zu#fF4m}$g-9-7t>#zJ?jdW;CBlWxpz=YS
z&(2mj&6lMnsgC%QLbADOSkzW=%aKY7{f*i`n$i%_vx|>(2_%V#FC{J)KV;ty7Hpx_
z)Nnq1Wic1YZkXdL51(A-&~TZPA(2bZ9O2*<rz}i<m3~_ch|c@dSPRcP+d%^dv=yG2
zHK*F|(0`b%DX3x&-CVFZ=4G@ZsH8N=`5Fj`s$OSfTmacmNB;(xRXNVA5DE8yKHZ)=
zBY?K#AoJ-Ssl->a$(yHB2SKk?SgwTT&tHq*;!sl^WFH(<%s@G?=pq!!3f8|q1d?Xm
z=T{D)*jE;uSkV>Bph#82NxkGt?bIkSd0hP+jk~PFJ4(;<;<}pfHm4E$qYTZ&hY6a#
z=9xzN^Ti#w1G{9>EJ0HO<9PF03ga~Mr#4DSg&NQr$V01Y>M>{f*%cT?{SmcShgTw6
zYwYb+$w}|z5)qp2l|WZ0(ToL4WGC&Pov@(0<LK=a<#)jM)C~x2VO`dg9f5ML9o}5q
zS%0w)j<k3G(2}b>PReu<<MU;^3y>-JsH1d;Y05}bUvQGO(b;9nEvoG~<|Mw^>nGeU
z`DM~y!=g2xZ!(^Q8X;+}yfn7UVUIX&3AvrvFgHAwh@Y-1B9u9tOvBVALdBl4l0{hv
zoN<)id2q^D_>EEZ*@KO4UGU>oktE6Bo#sc2in!QnvZsYdyk%>vHFWM#!E2^Jst;7N
zF~+sexAnt(YHEqa8CU6n*4w!rQ~otpHRrdYRUQK?YY=PQNQ;T%Sk3$0%j3w#W#0f5
z9o_6MBNCRK6}}mdyGoFAQIniUz{;>NOFApI3QwdBvnQaPf`dG~k^yfTKO<_@%I-$Q
z>%pdh7CnyNoY<E#Wo)!sG6LXo^%w?|{KniM==$1-7{Ej>4HednJuABRrN?F8Zp!a2
z@c?1ufl@4Ra26n(_D8U4e0KNa-vQejI<OBsYseVe=6dkY1gb|w*VmaH*{L`X@I-8A
zibjBXe1OA-7GUsgUTlwsXz4T)6fpN6@oc1&$gp0{mA(&Ir#;|7-I`aw&X%1uOnapc
zdD_m%Z9&y@FXld`(P&n@w8rp1M%)Brco~YjVE}o+5IX1j<!MaMy~IJ!<6gOqk!UPQ
zd;CdRJ8VzS_FV51ZyXKV9nOEnzcqIv!);NQFsMvhQ1lX7CFUa5n%e#{;5~H&OLmDO
zud<CjZB2`uCc5b(TEd2&$&vi0o!37ruD$$Yvgu1p>NJwGjQ=wHUEPfakl)VfW%Eu0
zn}(53-53ta4dOZ;z)!6IhoDKQ<dqSI@6V7Kt1V0kT#K)qp<n+nwAvY(?uVaO=sYwq
zdx*RJ9+Pt4*4T7*iKH&6JeE@4muGD?#P0i%L|R;i;VC}**KC_-443UOYUmd}ugF}+
zPl++{34RY7CTC#-96cPV_{{1Jpyn=}zX_#RNK(3wNZ*{xUSuIEX-gq>D$N7+MC14U
zkHyPkzh&{ZpX-zSWmbWFU;))&D5}TrB8)$|%^4?Al0Iq*a5a7LMWm*7bv7ZPyRI9Z
z>79!_5lZJh<aGPQ18(mhv#0&9ZATNHDW&ad_bSItWnV0kx?1}uZ>qfVphqBtgPDDm
zqw@)F%gQ=XK!nL84N%}?5!)##$2@1ogq&R7Tr67rK5<QLeV~8g@(}4U)|}H=mNxTm
zmF?dW|Imc=I#TzI;j4$QC@m(%9h?;`K1%jhR$Z;vkS+alVcTdb<~_X~#wta&@pfST
zLX&2*)Dy)?LsZeY6kl6%Y&RkEAG_}V8}m5gO@4Yq{P@Ok94FHK$4CXK=sc@Zwt4%1
DzZsdP

literal 0
HcmV?d00001

diff --git a/paypal.png b/paypal.png
new file mode 100644
index 0000000000000000000000000000000000000000..efc29921bf61c5d24e37f744b7271af822db9aad
GIT binary patch
literal 8307
zcmZ{JWmH^C)9xU_f=h6B0?go&VQ_aRxDArv5G28ZyA19w!7UIVxCUqN00{#G4^Gg)
zCFh)b-gn*ae!W-ks;+vTs_N>!_MeW_P?N{OqQC+G062;YGFp$a<8d-!pgq1<I$yLu
z3RGK3RY?G#KK|*Q#goT1ot1)?Dgf}71po*P0RV0uO@TWAz#9+%uxAbch^7Moq%PTQ
zn&3xA2-HB)MpYHS@u*_}o*)qdP#!g;#|MB!0r(T`Q3EI;QU0rIA+h~~K?VTA?E$F&
zU<@DSpP}$L|8V}6DEUbLiI|W4FS;Wi<zJoY4~@jkpyg3ux+uJK2LPTD{h3IB%xp3M
z0GZcb$H2otRYlaw*^%4A+SwAy?d|CDhXnw8i$1E3P!9__Z$}3wcTsOKhQAP^kNO`o
zkb&+mh{tO&1_M<MI%#J&D4ifTh#SNJ!J?z11G`z<h-%5m{X>6Ti80uDc({lHfnHu-
z++KX#&Th6q9uW}{Acz;p%ggnM;BxnI^04sca&l+<JIMcyBLj7}a<g~wuy=N%`xDo~
z()o>t7z4wfME{Pz>x6pS|0k1^`#;-y+#v9e2gt(>0{;JK9`-i>3+<2RZ`xn``a2!?
zPcTspdvB=2OBs7dsFV9+X%Jx$2>e%?|Ka&hq5s7+_+Od-<@tY^(#{UfZrUyuR!|7f
zKgs^f^k3*db&IOI*+U;&`loS!;Qzz+4;~Es)7Ag#^4~}Jm-X=sAy{DGzuyA{OF*3*
z4*;O1RFsj_@kaV-g6?fRmvaC89I^+i<{nKo29X(q1ewvKFi|mln-Vk{kWx`$s&q@C
zCaEFTih*RXI;OfhOjHG_z&dj&K4Hv7v<*|HB{$8FRgj|HA00~%pQjb9TJb?aoRzme
zHm0qYE2sDFhXE5E>Uvr#!%A+VAW-1JXjCB`PzXJ$M;JD9bV*Ns7_LYiR2X(~r<O*^
zl7tCX+_q|U0Y%90;>z;uEXdT%{IG<a$#h1#UQ@az45r{dPeO^}qP?$+GSH&0iP6x)
zES^Pmb91*4G?D{xp!;{xo_tzUCvQ~?p#ftGGg~QX7o@W(0BYqDPX&-W$6c=Hr6UC-
zrakN6f+i9CO3ntU3gNQ?hTmm65%n2lY5aN+kSR7zvC2@NeNFJ3UVMl<+WN$YsTikq
zhgmjTNe!XlrF?yU)fe6HTVF_!iE{9qT`)aDTFshq>Nh&wov@K|;vl<D2r`Yq4<-}&
zRKXJ9@jHjw&B4ERP$#VLfvO!t9EHF6g)ElNJ~ZO(#QTyxchFKtpt(Mw>oW{g+`4n6
zfPe>#oq;w=Y&37M(|u+F;nUSdv_*GdG6s?}I4aN5lsGAOtrml}CQzQp-Vzm(OMqW7
z7Vor#sTGTr?-XLwj*3{{$G@OKM@eBUVMhG&R`eNb`#9M&E}^VGFnm+4$V*O?A`{$j
zwxB^lDxt`ak~;HJ9k+*OJv=jvNt`Hf5__}%Xh;M(=*2paWP?@dxIK|KPcB=qXRZx(
zB5o-EgKIf^uo_3m*9ackYipqt?A+9BL;4lJeG`e>xxfr_eK0YNwVoQ673SOKz{rhA
zf-4z02{ydg`t`XUXWCDgxp8?(_ZsZDy=Tx|GBtKMxtn`zQwf45|Hw>nVUh~1-Qa@f
zn_cN*|4~22ok>jKns!w{ME3(H=X=`TnS1x#r=HBQb>3wC=lirlhV<309%3kc-9L-@
zY(aT>8LZtk@k{*+4~YbHrrJny-V=1k0jO5XGomZZxeSm>niL(~6!}dB)X(#cxPybO
z_DYO112Q)<a%<*DwJOqfMUdwHe1UyYolrNg*|+{vay-^B!Op(*l#^pT67&RvIP)K7
z_>&^36E(*Hr@jp0t8N0wj;s3Q@4m}~3&i^kt30J`dO>s@?}19(XMv2G`5u>on(s#+
z%AvDkULgh=?%Xp9#aP6v(0$?XG57M!5EG2=&#vtUl<b?Op^%{c1{V^EUW2Cr<66Zr
z#*2mTx5HC&cl4Ld!W+&SHL5&}-;`ZwQ23)drnB92GUgLZy(iPJ#Di@{3Rm-_a~i)_
zIp{j|PB@VFW)C%oKh<sAc_vn52}i3x5!40<p6Tt$2=q*XQ3EKtkMy~a)PqHn*`!pM
zF=Q!5w+w#81~W9yMI~wG{J<a<54Phu$%zT9S41fi;3;m)4eH@f5?d$kE>$Ux_d-QI
zkaMSM7me1ul%RgrrX2wvHXKHd@ulKdy|J~CB-H0T7_{dz8djIrr_<)lLn>_o<CIQA
zb}rLdb5QMyE;kiM_Pg$Qd5x*(RIYCJYBz8KxLLB`jh%{<FsYcvaqGsYGi9$0*oUs*
zQ80iDYMVo`OxGk^Ym%1c6h8JWW1c+*Y0zc)>+53)^~l`qn_efdOD{F&k!6kaIOp4W
zysH5;Wz->IO1<y21fwr<hdhIF70-^s2=4{tuXJo+WOr93zZU{#_5^+*#hCq+=YC0(
zgD=&Gl&?5?f9zKv0nZd$#l{mdm=ffRoDi<XIU(8@k`!(gsQM|0s5hHi8$eePwmtM@
z+7L`PP$MuWtm>;?lNJE!sg}^;SlSPk^IgJ4v_9wMV9V9d!n{}UCAuESzz~VdEZzcb
zW))a+$!RXehDu|ufnl=+cV;=U7j*#Z!Y1ZXa>hjnCMTxz=sGiBnS%#;hYr?OzN`?N
z=2any!PclWIgXS3Y|QmH`nKfue3nn;#r-c2i&Tt@c{lrr0|>*`a1`F!_VN?2dn{ex
z9>6mQ9PikkQ>QQof-=L=x!p5ZRFrA#e0W>pH}wG(Ui%6m)+r=D#vA6W!Y^3t=E8b_
zF1!)so8nw2h#Q7y1QkJCKe_WYf@jj#l^9%B3+b@3IewiR9UBx;zY(Em&cpBx@F7sk
zm_|$ElUmE-S#$3rZKhWw7c@j5dy&zQ_LPmhVqzyc8o)Fp$I}GV`Vkw)Set_s%HkF0
z#)dy$76=(*_H(6w@m<Ea8a=xOjSHZP+t2xR3>+U@%)gcX)Y5^huVxhVasV$$G?^a1
zRx-c?w^#AST=<2-Z#GW{hVniQAKF2ub6GVB<^C|MY7S8{mb}F8y_rAnhB4yh3Aa-O
z`aQeXOfa;WgfT9sD8inXxw^n-7QJ<z2gVbvv@c6V3_by|Tgpq?7m!^0JfoIby4X8>
zLm|JEc45`(1&Yozk&A=IXFK#w#s9G9+wFTBak@)|{xA>4KbEE^$?33|O?knVcfkL_
zwJaa0BiJ?Mi#&(2LsK0s_7$8Z_`L^<%|QE4j~xX^&wgx!bkZR_;8*N;z9@s0kV0{)
z=y!T;nv!c>Le?_r<^g4`#PQXfy_qz8o>z<A7Qv7*g@FZivi_2%UcCrx#8OKsV$b%e
zW_l%JQ_&UdKaO_l);vSiH{v)ad_t<5ZdPcCV+#{&xhP;Xs4?=aj4^@-8rgOQWyoH-
z1E>ue&bYJNod~o%Gv7^+^?2j9g-;BwQUc|rr-Jp%&8Nc9SIQAzS0q=2-9>DEJY?W;
zM>H3_QbT3gBc>dEX$5<YcSfp7A5Ix?EboG<ANgAPNerU8u5ME21|#MbC1qc%=!VV*
zTsdTL_s{$p;BsJ|*y{T-)BV9B;K9J>TBmMzXOEeW3V5*GG%kWs_B37(J8z7OxP848
z`Hasn`DF8AY#`Yf)~}196O8?Qi}|EMWCrb1#U+*N^VOyp2k1zR_N27S<t?H2!4D_0
zDl~^B>i&njkEAXcb#6(t57)-%eH{)$DXMUT>)lH9>t_&04IZ-QjSMxu3PothJSTU2
zA5@irz`a)~Q1=IswT06Hi{P`jI%KhmcL(Ey;FC}2FFaigcWmWvV?c|<9w9MTBh^XA
zSuJJown3gH>9*<dcdm>SH{%f+k;Gb==EHHzW*l?N9X4rCy!>o1bO$=TE3@8JjZxf$
zpe+>+w|LEfaz-RM`iX%jy)1iYXsYEauXjuWODOk`M*yzGMM*j4?{-La5_`d)Yf<Gp
z{0M%9+SJ`a9CotC1WTs6GqycAtaGbVPKEnory7G}rW1|VAyfn1_cB@egUFlbk#uDx
ztFxb^^s*6e<hA+=MzJE|vY<m^LTc01?Q}P0Z>`cj4h^dwQgGaDyvdO^?07Lht>7|p
z3Kl`0GNBI3R0+Rv15R4OCkHAhc7HNkQTX}?^*aTP52DMSH(v~#%-hh`h<G)Cbhr2z
zC^YR8lZMYu3+gIjbW@v|g^3h@KKmduQKB|NAWHy^sCV$GC-L$vi6RZ;s<!a(gri$R
z_(qAhOBp%*9L$h@L^IfK?jz%!lw79gAF;?vreR*s74rpSseQQYTO$jix0imcPte)I
zfv#J^VfYsN>Q@km>kT2FGUKO%TuGJZm~;yn-H<Ml7O+{Is{iTnfFkE>myNa=2evQF
z3tQMQE0)DVtU|)yJhyees$6;wO^BVZOoE!qwW1#~E=w(2^EyKnWsQ0xUPs?(tlx0m
z9!P>UL(Pupx)|)xW$39al7(9|5=#-cXF`ZgSPomm?XGSAvE?YT@9RsQv2B%)EOyfJ
z`KfM7$IZaBhSu-VO}nVIc-+cQhd#tuflXC{8LJW?11-|g=r7+G(|lEf;GPr@k)EH9
zNu%1r)?gYkF#fXQ*|_ZhFphf1*H{txANh^XgJ{9?Q8e&S44<<u-+DsUiAiazVA}YO
z`CzFQ%-YY(@gJbLD{uU8uuiM5_S+=yHoY9{;AV>rtT7L5P>QYD*8207pI5(ML#V{6
zQH0F&;)Dzi)kZwwN|P0?>&-y@#LLWK0Rb|f>gwlF;lg|?Zya$%%7b16%mrz0Z?0_;
zoz~mxW2is0l5Xc21eWQauZ`L!uibzDxY5C-NhJ>*w`eytdJ(}yvUc5dZgDbgdbg~b
zd}Iy2_1nc2h-f^R@I$4@(Tn_=uh7@r;j3{(72A_Qj@M}tm>YpK!<?-e9Pn+W!$oxc
z)BgIUU1bazMjJtdf#!~?r6?n~Qo$=hLnB9;Zkpm973U^JDV~3WBeEc|%SI4Xw!A{8
z{=-0se9eKZ;<Vbqp%}_OquOjj<^hW;CabEq#e(|qrK-U<fhTxw&xCuP4RLf4#nZNv
zJMD94>)&c;+b)J`obzMLjM{^>(qS{QeY_;}nz%OvBF&Q6a@&Z3e4>kNXr}N!Ro24z
zJFx@l&_m}suZ;xM^A&+A!tF@57TOotQ~+`^T=0<}m0|@v=?;EU$$)o1-pTg8U(0m{
zZe!e3jGvaP7sFx*CpTM($W7atzM-f)kMy(iJ|*+rKE?7q>!kMn-GOBM_7zX=+Ya>0
z@4_T=sHdgX{#5S21)0o@0-a5b2S0FzIvX2A*^Jzj<sA)XiRZ)yAwSRchtkr}QMX=H
zaCqk66fmT28P(ZT%5W2A^Td2Qo9?LdClU71M4A`GDQKQWLr>ZGI2SCMFYCYG3rf{s
z*Z=&YdtdVI)M)0oI(pRgq}r%1%2CAK6{#fv)W!?nMReN!-g&ATlTh`#gm1S%`^ykd
zq~7(5(bM-m$cEN7rGybu{GP}_|90w`%CFPQdGVwRx@$|SrgxD|7$~UvA%5)Inv)9Z
zGu%X5dQ-hKmdn+y6EYk)n63H=e2hJJBVn)1UvT+XM~!3(lYGb_Ba^VrkJ3v_B;(LU
z8in*Ij1nDjTQFka8`^1*>s?cSs%|Dvn-d$`QKA3l&`uWMkQ0mUw{kwv@U|(uv4=^S
zaG7aOI*N%;Dl35I)*>{gL6+c^n;~1O9~J8>)t)|foJ0KYn|v>GoX~KX_yruE@cKXo
z%~Euqn(XeyyGE(6_iFFVCUC3NdTmSuq{oD%;w$YOn0iS<N*7?ai9&hOAjfaAujFpr
zzpH9bt<dz0Hub~2PIMp&zcj7e6cWd1_?oK^q~k^-NcR0a$^}GoF;{+#s;ziikgqfi
zt|xr8tL}0ktQI8!E!g*8)^H8rlkiND_GO0AuXtc`kuC2Pt6=6wzoA`M>Ct#9RSfZ}
zt1k4`x@0aR?IWd&hhQ&4BSJ4JF$(GB`1G3HLuXP7sWqmg*V^sspNb$2W!N@wg-+_o
zx?J~iYbEL(?6dbO;!Vh$>7}w;qghf8aFiOB^J5|jOzu)GsN>?R%S|}BQl%BGtN(Ox
zHpL3~W*R83|194cYgen10O;=y!~&0HdE~n$s8u<6Y1^wgtK`E;7A)*pk4$&45QR~4
z*}50RyEgb<wGUptE%mwGHbqa?wwPXJ8{Za$+TJO2dCIEcb1!2#IJbu6=;0IZJI5DJ
zO^=+dxO!NYAgL4|V)N0Byys!JA*DVp@=4^E4?u}R5sp&?f!5a)bx|kdeu4JLad>7l
zn+&WYGdE;jF%nC2)@Y!yTOnFIrTS<i0WV()l4!f0O?vhYm5;zShJB(PMaL6&1r!Yn
z_IU%C158?DQJh17<<qa0>u(S*tN2#w{2ML03ztl*z6r{Rn)g2`<~?#a*#LTI4QQqD
z!JC3dpbT42kP53fmRTHOg8K-S3FDwNRP=?hUy);dtnBIi5_IU!(}wDoc6P;m*L{3`
zS6_Eul;@x0u=P8rbt~Ujy<qhqe7LREwfp8YP}RoN7te7B4wrntM^oj*-D4YI_`c9h
zFpeM_W{jNC7_mwyZ{klF@YO;Z+8I@8#x2DiiUa$eCnglc+-R6FDIs2peS`zYfcJXA
z1gWiJ*IH%O-3IuFx6Lgz=#X2Wcth2BzjaPbx96@7e~EG)%N=tUfxFV1akllU*Trrq
zp4awnVZ;*u;GRgj>(0ElT&1<!`uH3yx%t&lIMq0V8px_g>#G+d3{w)oe&!=Nvc9gu
zAG&sY5(XYWQPm3?W0ELh79t@2*)*26+DT-aBt^WHUT^6r(=spDLXIe4Vpl}xz_dn6
z6Ha+caZeDs*eDc*{;(L%dX)aYHsK+<=z6d%B3GYS7CUzgn^5WC2dCS!_r6QAKhlL(
zgZ)QH#U)OmY!gjb=z5Mcy+_{<O1_&9X=-N+Uv9BvgQ9(xCGXV(qh~nqG(NQnFC=_K
zXE6zDQgv#qe(V0@4y3q%8Dx6|$T5&JHI{;swPu*{p*kM|u<ZSwx_KW&G(ZY)SZ-v`
zt$r<PDo`}07~kz(`}^AT7=HTv+iq`NrO!dNSgK6DwC|{}5dX8BXh+I*F>$dt+>q3)
zj;%mD+Vn|F&PP&Q#GP@+`Ox!YrS4FMAc&OwnRPtv+&5^<s!+jHE2hsc6DqYD^r@wk
z)fl7O$`5qx9{Bxl=GkhpeSk{jjd)C8@8_E`%(gt5cT3lfoZ6ElroiyTPDcBA<S<^Y
z(r1H6!nZN6E#n0adw6tQ9kTmr&2H3Mx1=t_rEKF0id|#oMp3>k;tz1)9mqh~<+JB~
z2TJKbdpJ|?RbJICHtXVzcV}lcBgDD6da@{ei@BlY)t>7nG~xEuPc&dMm}tm~$)qn`
z4=sh9u3U*u%lXBMxs-6Z3=(Do36kYacZPy?9Y38OD5lG|dB8vJyUYiHS8iNbQ&+X+
zAHoPy5l@(rnzEpAHSUG3UKoN5byW&rdHlO3gIQe71nw@C4R)QW)4YID&#@1e-7*7M
z3G3FdbFPxC`>~Y12dAS#-!KlYVx|UR-BfkUgeJFU%XH21KnV0Wx2oaTEIC?(5bqe2
zd3OF5Xj><{d8;Ppy^?NJW9b-A5Y1uvnWm`7sU&n>Ls!DwUCLHFQMq$ffw>(qOZRNH
znWv&>fN93`+#ONQXw%0Kru2?%K09q;NK_X&^(=^?vWmAdGM-_U>x)G`sJSRa!gR>3
zYtiF*lmq=rM>~z_SB+IO1g9>-vGl;|n8toZ3Z6ITVHrQNpC9u{VGKOqhX)VuP-fLr
zc95PuXAbkJ){si{=9p@us7XyioM$UV1Npa$)GaTVm=-1dsfZ+8@<R-hL1Wv6y0kA5
zn?$>;E?I`s=`!JsVf->^Z`k@(l@LrL-l{4)-5OG9e39KxVP74fW5!b17bI#PaG_zw
z1<%CFBO3+Rgq535ADW7rM#hV^R%5WgtZUIj6+1GR9AQsbztEO35YNOb9Q!XwP$hXg
zl**DGej93gatv!eEO2uf<ggT%(j-aR#a7;fE^6gkTf~LFNA{^gS9cTZi2}ZLftY$n
z#yMb8N>aez4T;uNxNSe@Du-BMlcvq-2D8VZo8`pTu1Z$a1!4``VP{6vX%|Wab~X4}
zL}N~_EW|w}b(9TCBx~df^2)5JKSmcQuP$`cnwa2zV&v@HJ66G6^W>Alklx1iPi5Dh
zWmewLiZAJ(eiQpGG6sAX;nC<scD@@H@kTIHwEpAvQ{h+F%r|3P5Y!+lQqk(Qu@DeW
z23r+h#A5405|$rkbXwlHeb~s*FnpqswkLT-=tJ^A^0<GDwiY&SNLVVPVLRcWQq6E!
zkhBIh6r)5fRGX+px|Bljo>5J77_<BplIt(+;(=Mao*yvZ{=KakOCX0ir@qag#goLT
zyzn@ys3^wDR-bHkR7Kc#sL<M#)#h&#!OR8@1!zCv=&vveE#feGGR=HYkTZvE@`rVY
zQ`6FKD*6{UFS*l{%13Qz3V2D9*wjzYa+6*I)L1W*j*a1(*s*&Tr@8uHhs;{F6_^u?
z!=GOip>#3jNsUr(?`>||-nz`62h!-Wy9^~TdISf4p{Zy>O=W25+)Dm=ypq%Z;+=7w
zJHc*KmT$V=*Z4G{v^{l@cPG-&+_@Xorr)-Q(VGm1XTO~s_CRYBjehAbzYVz7B{&j#
z7~=HBqZo+VGA=CJ=?Gg3h~OmiWbn$_^4Nz5>TF!R3>~ezu}05*EtXlJ$JoMgb=+Ff
z(kf~k$|Bk?H*c~|7t4dIrP%xFk}NT2bF9w}W<|Qc`E`tJY1iLh=ev%mRu;aRwAwD`
zDp2R`yLVTq`6Tbd$}|YC<rlLzY=4$eBH!2B9|Wg>k*PDzc`wf`?<hoQQyI6d&PIJa
zAzwIVjo^!)cPnoLlxY-~czK81#Ec*p3g=c#(9_ry9vA{29jm(KTr_8=jb%p3z3za)
zsF}-!lq4lL+5`C&;!E%KF7duwu_ibzL&}h?u}?j9yk{J^X(`%5$&W_d#9L*k$uIGI
z;<&hmOota`H^u@eJFFtts)M?uAox{~<}l4*P$9Fos$z@DZ*i!-Vd@JSTXNBD<eibg
zD-q~ShJb?UE+w=gg_GqcWvvW0d3FS9YM<E^W%5{Ske|i5Tt$)?UTOm~*&;uB(m?M{
zd}0S#crwxeLPj~ao>Lt?^*)6=gUi<89_1)@UQqC8Cuh3o;MDEHWt$vI!IcA{FtR!L
zUB7L}pqj?Jz&9`Ap8NZG1N1rXr#`JXSxo-H!3#tI9tehE%|k7x9K&BlEF_*5{CM&4
z(LWv&FW^IX;1ToMmml&Btj5f`m<At17~qrQ9ZGM7IqiyBN!m0KUqx&e4$@!jrscvR
zfu*jil3XJ&E=aF8OZ_PUw#;6l{<}dJS$;sTP|^t*=b>c?R%dL_`<4%_YPg#SQPEtS
z-w*6Y61l&9x-{_v%SfbilVqBI0rNB|7;QtCsNuI}wfPI9SK>vYZ0c)4K3u3WqEwkC
zX&N}86D7hGZH=PX_Xl9B_!(dDmuxM)kuT12al^1B`7whnL%ClDinOb(Yx+EG5!)#s
zRTHfCtdTJ$O@ZL$pIfy3CoTj-QE(Ab^X}70Y?98w-2}=T*1(5pu~2mh*u5o&{rJ97
z<;l({F0p%(;gAzb?t`yTU%tQLj%McrCcpDa1u+)m6%M+oY&?R}B^f9uOeM!g3>Pmt
z8pai(C!~<sA5AObs3jMa7bvStsG;7N@5Sud03)-XyTr#<ycp<H6TDo?5<&5$*goZ7
zTa7?#DG&qE=03S}m5hRf-q~mIBU#T1jb<w&UGMkiaK#>XxucNsQ6M}fONn~Bn0pCs
z^1*Mi^R_~+x?EAMpSp$>?aPu)UpFB^g4G8$<)&JYf8G;mx(*WEQ3{*h|8VHc80h+y
z`2NPfrV(JOtt;$4y7ux4-}7uB@Y~@6rsq9@zMMCc-&Zu{quH`MWyaX)PdW5w*Zg9A
z*eF8jWO{m4JBPj`)rrqFeYTtt=cy90@^7Sbe@9$4o@Y>ETk+2JRsUM?TxtLD(x9#D
z{g+T&w}<P`6FY#iC}N@G2rS=BG|<dL<oB*4f~g{%buywN--~E(oolZheV6IP_fwfe
znj%M96!w^nr4JB4ehO%WesfmwbVb4nZG@2+u3Uw5V6=IF7vC>OZ>r|*_)qXJ1ELH3
z234WNoL^I%q~50E5)WYS8r}M-Z)TB^BK3#&BlT3C0KNMy-|_G_g&$FBX!TsKRks6t
zN-l~wRy4o-Jk5B(kois|5F?J%31409FdHu<c=Cks^{O}yHg50tM)aOIfhn|wZYraJ
zAE7^u?Ke(Q#E~5vicnxR#<z2zM0GTKOJj&IE~*^=o^MZ%(W&;#b=#q0-7}zEPx8Pp
zdxaDoF(R7BcR7aaS^lWm#>C{dnN-39HS6;XCTUNY`<HA#6D!rzJbv%!(rzQ;Q9p|9
zo)H}7FA;e3X6R-`lyFVj*kQ_}m@hU};(1l$hij*2<wW$c8N)(6+_Y%uSoQXs^X83>
z_(`LWe<&^nHF>0JW=sC=mHf2OUF?!+t~(I-11TO`S@3eD%gmpvbVXS;nHnkcp#K9`
C=q;=O

literal 0
HcmV?d00001


From 3f026a0fcee8208e10b00159492f3cf135a8dc87 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Tue, 8 Oct 2024 20:19:30 -0400
Subject: [PATCH 197/225] ath11k_nss: consistently use ath11k_sta_to_arsta

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...9-903-ath11k-use-ath11k_sta_to_arsta.patch | 70 +++++++++++++++++++
 1 file changed, 70 insertions(+)
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/999-903-ath11k-use-ath11k_sta_to_arsta.patch

diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-903-ath11k-use-ath11k_sta_to_arsta.patch b/package/kernel/mac80211/patches/nss/ath11k/999-903-ath11k-use-ath11k_sta_to_arsta.patch
new file mode 100644
index 00000000000000..ae3b44597e19ee
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-903-ath11k-use-ath11k_sta_to_arsta.patch
@@ -0,0 +1,70 @@
+--- a/drivers/net/wireless/ath/ath11k/debugfs_sta.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs_sta.c
+@@ -1074,7 +1074,7 @@ static ssize_t ath11k_dbg_sta_reset_rx_s
+ 					     size_t count, loff_t *ppos)
+ {
+ 	struct ieee80211_sta *sta = file->private_data;
+-	struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv;
++	struct ath11k_sta *arsta = ath11k_sta_to_arsta(sta);
+ 	struct ath11k *ar = arsta->arvif->ar;
+ 	int ret, reset;
+ 
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -1584,7 +1584,7 @@ static void ath11k_dp_ppdu_stats_flush_t
+ 		goto exit;
+ 
+ 	sta = peer->sta;
+-	arsta = (struct ath11k_sta *)sta->drv_priv;
++	arsta = ath11k_sta_to_arsta(sta);
+ 
+ 	memset(&status, 0, sizeof(status));
+ 
+@@ -1950,7 +1950,7 @@ ath11k_dp_rx_ppdu_stats_update_tx_comp_s
+ 		}
+ 
+ 		sta = peer->sta;
+-		arsta = (struct ath11k_sta *)sta->drv_priv;
++		arsta = ath11k_sta_to_arsta(sta);
+ 
+ 		memset(&status, 0, sizeof(status));
+ 
+@@ -3009,8 +3009,7 @@ static void ath11k_dp_rx_h_mpdu(struct a
+ 				msdu->protocol = eth_type_trans(msdu, msdu->dev);
+ 				napi_gro_receive(rxcb->napi, msdu);
+ 				if (peer->sta)
+-					arsta =
+-					(struct ath11k_sta *)peer->sta->drv_priv;
++					arsta = ath11k_sta_to_arsta(peer->sta);
+ 				return;
+ 			}
+ 		}
+@@ -3761,7 +3760,7 @@ static void ath11k_dp_rx_update_user_sta
+ 		return;
+ 	}
+ 
+-	arsta = (struct ath11k_sta *)peer->sta->drv_priv;
++	arsta = ath11k_sta_to_arsta(peer->sta);
+ 	rx_stats = arsta->rx_stats;
+ 
+ 	if (ar->ab->nss.enabled)
+@@ -6451,7 +6450,7 @@ int ath11k_dp_rx_process_mon_status(stru
+ 		if ((ppdu_info->fc_valid) &&
+ 		    (ppdu_info->ast_index != HAL_AST_IDX_INVALID)) {
+ 			if (ppdu_info->reception_type == HAL_RX_RECEPTION_TYPE_SU) {
+-				arsta = (struct ath11k_sta *)peer->sta->drv_priv;
++				arsta = ath11k_sta_to_arsta(peer->sta);
+ 				ath11k_dp_rx_update_peer_su_stats(arsta, ppdu_info);
+ 				ath11k_nss_update_sta_rxrate(ppdu_info, peer, NULL);
+ 			} else {
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -4455,7 +4455,7 @@ static int ath11k_mac_op_set_key(struct
+ 	mutex_lock(&ar->conf_mutex);
+ 	if (sta) {
+ 		peer_addr = sta->addr;
+-		arsta = (struct ath11k_sta *)sta->drv_priv;
++		arsta = ath11k_sta_to_arsta(sta);
+ 	} else if (arvif->vdev_type == WMI_VDEV_TYPE_STA) {
+ 		peer_addr = vif->bss_conf.bssid;
+ 	} else {

From 9dffdb261eda3341ff8090557d0b50ae8e4af0aa Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Thu, 10 Oct 2024 20:18:05 -0400
Subject: [PATCH 198/225] qualcommax: Remove swiotlb 64m savings patch

already remediated upstream:
target/linux/generic/backport-6.6/300-v6.7-arm64-swiotlb-Reduce-the-default-size-if-no-ZONE_DMA.patch

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...com-disable-swiotlb-for-64mb-savings.patch | 242 ------------------
 1 file changed, 242 deletions(-)
 delete mode 100644 target/linux/qualcommax/patches-6.6/0982-1-arm64-dts-qcom-disable-swiotlb-for-64mb-savings.patch

diff --git a/target/linux/qualcommax/patches-6.6/0982-1-arm64-dts-qcom-disable-swiotlb-for-64mb-savings.patch b/target/linux/qualcommax/patches-6.6/0982-1-arm64-dts-qcom-disable-swiotlb-for-64mb-savings.patch
deleted file mode 100644
index 70808a29b8703c..00000000000000
--- a/target/linux/qualcommax/patches-6.6/0982-1-arm64-dts-qcom-disable-swiotlb-for-64mb-savings.patch
+++ /dev/null
@@ -1,242 +0,0 @@
---- a/arch/arm64/boot/dts/qcom/ipq6010-wax214.dts
-+++ b/arch/arm64/boot/dts/qcom/ipq6010-wax214.dts
-@@ -25,7 +25,7 @@
- 
- 	chosen {
- 		stdout-path = "serial0:115200n8";
--		bootargs-append = " root=/dev/ubiblock0_1";
-+		bootargs-append = " root=/dev/ubiblock0_1 coherent_pool=2M swiotlb=noforce";
- 	};
- 
- 	keys {
---- a/arch/arm64/boot/dts/qcom/ipq6018-fap650.dts
-+++ b/arch/arm64/boot/dts/qcom/ipq6018-fap650.dts
-@@ -30,7 +30,7 @@
- 
- 	chosen {
- 		stdout-path = "serial0:115200n8";
--		bootargs-append = " root=/dev/ubiblock0_1";
-+		bootargs-append = " root=/dev/ubiblock0_1 coherent_pool=2M swiotlb=noforce";
- 	};
- 
- 	keys {
---- a/arch/arm64/boot/dts/qcom/ipq8070-cax1800.dts
-+++ b/arch/arm64/boot/dts/qcom/ipq8070-cax1800.dts
-@@ -27,7 +27,7 @@
- 
- 	chosen {
- 		stdout-path = "serial0:115200n8";
--		bootargs-append = " root=/dev/ubiblock0_1";
-+		bootargs-append = " root=/dev/ubiblock0_1 coherent_pool=2M swiotlb=noforce";
- 	};
- 
- 	keys {
---- a/arch/arm64/boot/dts/qcom/ipq8070-rm2-6.dts
-+++ b/arch/arm64/boot/dts/qcom/ipq8070-rm2-6.dts
-@@ -33,7 +33,7 @@
- 
- 	chosen {
- 		stdout-path = "serial0:115200n8";
--		bootargs-append = " root=/dev/ubiblock0_1";
-+		bootargs-append = " root=/dev/ubiblock0_1 coherent_pool=2M swiotlb=noforce";
- 	};
- 
- 	keys {
---- a/arch/arm64/boot/dts/qcom/ipq8071-ax3600.dtsi
-+++ b/arch/arm64/boot/dts/qcom/ipq8071-ax3600.dtsi
-@@ -20,7 +20,7 @@
- 
- 	chosen {
- 		stdout-path = "serial0:115200n8";
--		bootargs-append = " root=/dev/ubiblock0_0";
-+		bootargs-append = " root=/dev/ubiblock0_0 coherent_pool=2M swiotlb=noforce";
- 	};
- 
- 	keys {
---- a/arch/arm64/boot/dts/qcom/ipq8071-eap102.dts
-+++ b/arch/arm64/boot/dts/qcom/ipq8071-eap102.dts
-@@ -30,7 +30,7 @@
- 
- 	chosen {
- 		stdout-path = "serial0:115200n8";
--		bootargs-append = " root=/dev/ubiblock0_1";
-+		bootargs-append = " root=/dev/ubiblock0_1 coherent_pool=2M swiotlb=noforce";
- 	};
- 
- 	keys {
---- a/arch/arm64/boot/dts/qcom/ipq8071-mf269.dts
-+++ b/arch/arm64/boot/dts/qcom/ipq8071-mf269.dts
-@@ -25,7 +25,7 @@
- 
- 	chosen {
- 		stdout-path = "serial0:115200n8";
--		bootargs-append = " root=/dev/ubiblock0_0";
-+		bootargs-append = " root=/dev/ubiblock0_0 coherent_pool=2M swiotlb=noforce";
- 	};
- 
- 	keys {
---- a/arch/arm64/boot/dts/qcom/ipq8072-aw1000.dts
-+++ b/arch/arm64/boot/dts/qcom/ipq8072-aw1000.dts
-@@ -35,7 +35,7 @@
- 
- 	chosen {
- 		stdout-path = "serial0:115200n8";
--		bootargs-append = " root=/dev/ubiblock0_1";
-+		bootargs-append = " root=/dev/ubiblock0_1 coherent_pool=2M swiotlb=noforce";
- 	};
- 
- 	gpio-export {
---- a/arch/arm64/boot/dts/qcom/ipq8072-ax880.dts
-+++ b/arch/arm64/boot/dts/qcom/ipq8072-ax880.dts
-@@ -30,7 +30,7 @@
- 
- 	chosen {
- 		stdout-path = "serial0:115200n8";
--		bootargs-append = " root=/dev/ubiblock0_1";
-+		bootargs-append = " root=/dev/ubiblock0_1 coherent_pool=2M swiotlb=noforce";
- 	};
- 
- 	keys {
---- a/arch/arm64/boot/dts/qcom/ipq8072-ax9000.dts
-+++ b/arch/arm64/boot/dts/qcom/ipq8072-ax9000.dts
-@@ -26,7 +26,7 @@
- 
- 	chosen {
- 		stdout-path = "serial0:115200n8";
--		bootargs-append = " root=/dev/ubiblock0_0";
-+		bootargs-append = " root=/dev/ubiblock0_0 coherent_pool=2M swiotlb=noforce";
- 	};
- 
- 	keys {
---- a/arch/arm64/boot/dts/qcom/ipq8072-dl-wrx36.dts
-+++ b/arch/arm64/boot/dts/qcom/ipq8072-dl-wrx36.dts
-@@ -32,7 +32,7 @@
- 
- 	chosen {
- 		stdout-path = "serial0:115200n8";
--		bootargs-append = " root=/dev/ubiblock0_1";
-+		bootargs-append = " root=/dev/ubiblock0_1 coherent_pool=2M swiotlb=noforce";
- 	};
- 
- 	keys {
---- a/arch/arm64/boot/dts/qcom/ipq8072-mx5300.dts
-+++ b/arch/arm64/boot/dts/qcom/ipq8072-mx5300.dts
-@@ -33,7 +33,7 @@
- 
- 	chosen {
- 		stdout-path = "serial0:115200n8";
--		bootargs-append = " root=/dev/ubiblock0_0 rootfstype=squashfs ro";
-+		bootargs-append = " root=/dev/ubiblock0_0 rootfstype=squashfs ro coherent_pool=2M swiotlb=noforce";
- 	};
- 
- 	keys {
---- a/arch/arm64/boot/dts/qcom/ipq8072-mx8500.dts
-+++ b/arch/arm64/boot/dts/qcom/ipq8072-mx8500.dts
-@@ -25,7 +25,7 @@
- 
- 	chosen {
- 		stdout-path = "serial0:115200n8";
--		bootargs-append = " root=/dev/ubiblock0_0 rootfstype=squashfs ro";
-+		bootargs-append = " root=/dev/ubiblock0_0 rootfstype=squashfs ro coherent_pool=2M swiotlb=noforce";
- 	};
- 
- 	gpio_export {
---- a/arch/arm64/boot/dts/qcom/ipq8072-wax218.dts
-+++ b/arch/arm64/boot/dts/qcom/ipq8072-wax218.dts
-@@ -27,7 +27,7 @@
- 		 * Netgear's U-Boot adds "ubi.mtd=rootfs root=mtd:ubi_rootfs"
- 		 * That fails to create a UBI block device, so add it here.
- 		*/
--		bootargs-append = " ubi.block=0,rootfs root=/dev/ubiblock0_1";
-+		bootargs-append = " ubi.block=0,rootfs root=/dev/ubiblock0_1 coherent_pool=2M swiotlb=noforce";
- 	};
- 
- 	keys {
---- a/arch/arm64/boot/dts/qcom/ipq8072-wax620.dts
-+++ b/arch/arm64/boot/dts/qcom/ipq8072-wax620.dts
-@@ -30,7 +30,7 @@
- 		 * Netgear's U-Boot adds "ubi.mtd=rootfs root=mtd:ubi_rootfs"
- 		 * That fails to create a UBI block device, so add it here.
- 		*/
--		bootargs-append = " root=/dev/ubiblock0_1";
-+		bootargs-append = " root=/dev/ubiblock0_1 coherent_pool=2M swiotlb=noforce";
- 	};
- 
- 	keys {
---- a/arch/arm64/boot/dts/qcom/ipq8072-wpq873.dts
-+++ b/arch/arm64/boot/dts/qcom/ipq8072-wpq873.dts
-@@ -31,7 +31,7 @@
- 
- 	chosen {
- 		stdout-path = "serial0:115200n8";
--		bootargs-append = " root=/dev/ubiblock0_1";
-+		bootargs-append = " root=/dev/ubiblock0_1 coherent_pool=2M swiotlb=noforce";
- 	};
- 
- 	keys {
---- a/arch/arm64/boot/dts/qcom/ipq8072-zbt-z800ax.dts
-+++ b/arch/arm64/boot/dts/qcom/ipq8072-zbt-z800ax.dts
-@@ -33,7 +33,7 @@
- 
- 	chosen {
- 		stdout-path = "serial0:115200n8";
--		bootargs-append = " root=/dev/ubiblock0_1";
-+		bootargs-append = " root=/dev/ubiblock0_1 coherent_pool=2M swiotlb=noforce";
- 	};
- 
- 	gpio-export {
---- a/arch/arm64/boot/dts/qcom/ipq8074-rax120v2.dts
-+++ b/arch/arm64/boot/dts/qcom/ipq8074-rax120v2.dts
-@@ -25,7 +25,7 @@
- 
- 	chosen {
- 		stdout-path = "serial0:115200n8";
--		bootargs-append = " ubi.mtd=rootfs root=/dev/ubiblock0_0";
-+		bootargs-append = " ubi.mtd=rootfs root=/dev/ubiblock0_0 coherent_pool=2M swiotlb=noforce";
- 	};
- 
- 	keys {
---- a/arch/arm64/boot/dts/qcom/ipq8074-sxk80.dtsi
-+++ b/arch/arm64/boot/dts/qcom/ipq8074-sxk80.dtsi
-@@ -26,7 +26,7 @@
- 
- 	chosen {
- 		stdout-path = "serial0:115200n8";
--		bootargs-append = " ubi.mtd=rootfs root=/dev/ubiblock0_0";
-+		bootargs-append = " ubi.mtd=rootfs root=/dev/ubiblock0_0 coherent_pool=2M swiotlb=noforce";
- 	};
- 
- 	keys {
---- a/arch/arm64/boot/dts/qcom/ipq8074-wax630.dts
-+++ b/arch/arm64/boot/dts/qcom/ipq8074-wax630.dts
-@@ -29,7 +29,7 @@
- 
- 	chosen {
- 		stdout-path = "serial0:115200n8";
--		bootargs-append = " root=/dev/ubiblock0_1";
-+		bootargs-append = " root=/dev/ubiblock0_1 coherent_pool=2M swiotlb=noforce";
- 	};
- 
- 	keys {
---- a/arch/arm64/boot/dts/qcom/ipq8074-wxr-5950ax12.dts
-+++ b/arch/arm64/boot/dts/qcom/ipq8074-wxr-5950ax12.dts
-@@ -25,7 +25,7 @@
- 
- 	chosen {
- 		stdout-path = "serial0:115200n8";
--		bootargs-append = " ubi.mtd=user_property root=/dev/ubiblock1_0";
-+		bootargs-append = " ubi.mtd=user_property root=/dev/ubiblock1_0 coherent_pool=2M swiotlb=noforce";
- 	};
- 
- 	leds {
---- a/arch/arm64/boot/dts/qcom/ipq8174-mx4200.dtsi
-+++ b/arch/arm64/boot/dts/qcom/ipq8174-mx4200.dtsi
-@@ -30,7 +30,7 @@
- 
- 	chosen {
- 		stdout-path = "serial0:115200n8";
--		bootargs-append = " root=/dev/ubiblock0_0";
-+		bootargs-append = " root=/dev/ubiblock0_0 coherent_pool=2M swiotlb=noforce";
- 	};
- 
- 	keys {

From 8d2b08c4bb5dedeb17407fa4e71d170e1f38e4f6 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Thu, 10 Oct 2024 20:22:32 -0400
Subject: [PATCH 199/225] ath11k_nss: Remove generic-ndo-get_stats64 patch

already remediated upstream:
target/linux/generic/backport-6.6/612-v6.9-net-get-stats64-if-device-if-driver-is-configured.patch

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...evert-Remove-generic-ndo_get_stats64.patch | 39 -------------------
 1 file changed, 39 deletions(-)
 delete mode 100644 package/kernel/mac80211/patches/nss/subsys/999-919-Fix-dev-stats-Revert-Remove-generic-ndo_get_stats64.patch

diff --git a/package/kernel/mac80211/patches/nss/subsys/999-919-Fix-dev-stats-Revert-Remove-generic-ndo_get_stats64.patch b/package/kernel/mac80211/patches/nss/subsys/999-919-Fix-dev-stats-Revert-Remove-generic-ndo_get_stats64.patch
deleted file mode 100644
index c25e619031cc4d..00000000000000
--- a/package/kernel/mac80211/patches/nss/subsys/999-919-Fix-dev-stats-Revert-Remove-generic-ndo_get_stats64.patch
+++ /dev/null
@@ -1,39 +0,0 @@
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -847,6 +847,12 @@ static void ieee80211_uninit(struct net_
- 	ieee80211_teardown_sdata(IEEE80211_DEV_TO_SUB_IF(dev));
- }
- 
-+static void
-+ieee80211_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
-+{
-+	dev_fetch_sw_netstats(stats, dev->tstats);
-+}
-+
- static int ieee80211_netdev_setup_tc(struct net_device *dev,
- 				     enum tc_setup_type type, void *type_data)
- {
-@@ -863,6 +869,7 @@ static const struct net_device_ops ieee8
- 	.ndo_start_xmit		= ieee80211_subif_start_xmit,
- 	.ndo_set_rx_mode	= ieee80211_set_multicast_list,
- 	.ndo_set_mac_address 	= ieee80211_change_mac,
-+	.ndo_get_stats64	= ieee80211_get_stats64,
- 	.ndo_setup_tc		= ieee80211_netdev_setup_tc,
- };
- 
-@@ -902,6 +909,7 @@ static const struct net_device_ops ieee8
- 	.ndo_set_rx_mode	= ieee80211_set_multicast_list,
- 	.ndo_set_mac_address 	= ieee80211_change_mac,
- 	.ndo_select_queue	= ieee80211_monitor_select_queue,
-+	.ndo_get_stats64	= ieee80211_get_stats64,
- };
- 
- static int ieee80211_netdev_fill_forward_path(struct net_device_path_ctx *ctx,
-@@ -969,6 +977,7 @@ static const struct net_device_ops ieee8
- 	.ndo_start_xmit		= ieee80211_subif_start_xmit_8023,
- 	.ndo_set_rx_mode	= ieee80211_set_multicast_list,
- 	.ndo_set_mac_address	= ieee80211_change_mac,
-+	.ndo_get_stats64	= ieee80211_get_stats64,
- 	.ndo_fill_forward_path	= ieee80211_netdev_fill_forward_path,
- 	.ndo_setup_tc		= ieee80211_netdev_setup_tc,
- };

From 3f5ea5e93ead68e022437fbdf91e43f8cf62e4bf Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Fri, 11 Oct 2024 22:05:54 -0400
Subject: [PATCH 200/225] qualcommax: add console-size + increase record-size

Signed-off-by: Sean Khan <datapronix@protonmail.com>
(cherry picked from commit 4ea718f6ebcaadfe6b274b96d9323970151b78f1)
---
 .../0911-arm64-dts-qcom-ipq8074-add-ramoops.patch            | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/linux/qualcommax/patches-6.6/0911-arm64-dts-qcom-ipq8074-add-ramoops.patch b/target/linux/qualcommax/patches-6.6/0911-arm64-dts-qcom-ipq8074-add-ramoops.patch
index 4da27793e55bae..2aad7fc3f89b40 100644
--- a/target/linux/qualcommax/patches-6.6/0911-arm64-dts-qcom-ipq8074-add-ramoops.patch
+++ b/target/linux/qualcommax/patches-6.6/0911-arm64-dts-qcom-ipq8074-add-ramoops.patch
@@ -1,6 +1,6 @@
 --- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
 +++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
-@@ -198,6 +198,13 @@
+@@ -198,6 +198,14 @@
  			no-map;
  			reg = <0x0 0x51000000 0x0 0x100000>;
  		};
@@ -9,7 +9,8 @@
 +			compatible = "ramoops";
 +			reg = <0x0 0x51200000 0x0 0x100000>;
 +			no-map;
-+			record-size = <0x1000>;
++			record-size = <0x4000>;
++			console-size = <0x4000>;
 +		};
  	};
  

From 85d68d0399cfd91defe31ffcba3a6d61ef875979 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Fri, 11 Oct 2024 22:33:58 -0400
Subject: [PATCH 201/225] qualcommax: NSS: refresh patches for 6.6.56

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../0603-1-qca-nss-clients-add-qdisc-support.patch     |  2 +-
 .../patches-6.6/0981-1-qca-skb_recycler-support.patch  | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/linux/qualcommax/patches-6.6/0603-1-qca-nss-clients-add-qdisc-support.patch b/target/linux/qualcommax/patches-6.6/0603-1-qca-nss-clients-add-qdisc-support.patch
index 82d9af7952aa3b..b1318e06b8607c 100644
--- a/target/linux/qualcommax/patches-6.6/0603-1-qca-nss-clients-add-qdisc-support.patch
+++ b/target/linux/qualcommax/patches-6.6/0603-1-qca-nss-clients-add-qdisc-support.patch
@@ -68,7 +68,7 @@
   *  __dev_uc_sync - Synchonize device's unicast list
   *  @dev:  device to sync
   *  @sync: function to call if address should be added
-@@ -5219,6 +5228,11 @@ static inline bool netif_is_failover_sla
+@@ -5237,6 +5246,11 @@ static inline bool netif_is_failover_sla
  	return dev->priv_flags & IFF_FAILOVER_SLAVE;
  }
  
diff --git a/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch b/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch
index 3e15ddf49dfe43..8c4c996b5b9baf 100644
--- a/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch
+++ b/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch
@@ -104,7 +104,7 @@
 +obj-$(CONFIG_SKB_RECYCLER) += skbuff_recycle.o
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -6043,10 +6043,16 @@ static int process_backlog(struct napi_s
+@@ -6047,10 +6047,16 @@ static int process_backlog(struct napi_s
  
  	napi->weight = READ_ONCE(dev_rx_weight);
  	while (again) {
@@ -388,7 +388,7 @@
  
  	data = kmalloc_reserve(&size, gfp_mask, NUMA_NO_NODE, NULL);
  	if (!data)
-@@ -4869,6 +4975,14 @@ static void skb_extensions_init(void) {}
+@@ -4865,6 +4971,14 @@ static void skb_extensions_init(void) {}
  
  void __init skb_init(void)
  {
@@ -403,7 +403,7 @@
  	skbuff_cache = kmem_cache_create_usercopy("skbuff_head_cache",
  					      sizeof(struct sk_buff),
  					      0,
-@@ -4894,6 +5008,7 @@ void __init skb_init(void)
+@@ -4890,6 +5004,7 @@ void __init skb_init(void)
  						SKB_SMALL_HEAD_HEADROOM,
  						NULL);
  	skb_extensions_init();
@@ -411,7 +411,7 @@
  }
  
  static int
-@@ -6397,6 +6512,8 @@ static int pskb_carve_inside_header(stru
+@@ -6393,6 +6508,8 @@ static int pskb_carve_inside_header(stru
  	if (skb_pfmemalloc(skb))
  		gfp_mask |= __GFP_MEMALLOC;
  
@@ -420,7 +420,7 @@
  	data = kmalloc_reserve(&size, gfp_mask, NUMA_NO_NODE, NULL);
  	if (!data)
  		return -ENOMEM;
-@@ -6513,6 +6630,8 @@ static int pskb_carve_inside_nonlinear(s
+@@ -6509,6 +6626,8 @@ static int pskb_carve_inside_nonlinear(s
  	if (skb_pfmemalloc(skb))
  		gfp_mask |= __GFP_MEMALLOC;
  

From 65ccaa6c378ee8dc6ec9ad29a6abceb6c62c620d Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 12 Oct 2024 01:12:55 -0400
Subject: [PATCH 202/225] ath10k: change 'peer unmap' warning to debug

It's just log spam. It doesn't affect usage.

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...10k-move-peer-unmap-warning-to-debug.patch | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 package/kernel/mac80211/patches/nss/ath10k/100-ath10k-move-peer-unmap-warning-to-debug.patch

diff --git a/package/kernel/mac80211/patches/nss/ath10k/100-ath10k-move-peer-unmap-warning-to-debug.patch b/package/kernel/mac80211/patches/nss/ath10k/100-ath10k-move-peer-unmap-warning-to-debug.patch
new file mode 100644
index 00000000000000..f09519e4c73b61
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath10k/100-ath10k-move-peer-unmap-warning-to-debug.patch
@@ -0,0 +1,20 @@
+Remove not needed warning when get peer unmap
+event from the firmware. This is not critical
+message. Instead print this as a debug message.
+
+Signed-off-by: Janusz Dziedzic <janusz.dziedzic at tieto.com>
+---
+ drivers/net/wireless/ath/ath10k/txrx.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath10k/txrx.c
++++ b/drivers/net/wireless/ath/ath10k/txrx.c
+@@ -266,7 +266,7 @@ void ath10k_peer_unmap_event(struct ath1
+ 	spin_lock_bh(&ar->data_lock);
+ 	peer = ath10k_peer_find_by_id(ar, ev->peer_id);
+ 	if (!peer) {
+-		ath10k_warn(ar, "peer-unmap-event: unknown peer id %d\n",
++		ath10k_dbg(ar, ATH10K_DBG_HTT, "peer-unmap-event: unknown peer id %d\n",
+ 			    ev->peer_id);
+ 		goto exit;
+ 	}

From 1288928482ef83146b92aa5a65df3a261ebfc7ae Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 12 Oct 2024 18:32:35 -0400
Subject: [PATCH 203/225] nss-setup: Reorg and make uci-defaults pluggable

1.) Clarify what radio_5g_high, and radio_5g_low mean
2.) Make txpower configurable
3.) Don't hardcode radio names in the generated config, but allow
    specifiying them as variables.
4.) Set `cell_density` to 0 (don't enforce rates, let driver choose)
5.) Remove `pmk_r1_push` as `ft_psk_generate_local` already deals with
    generating key locally
6.) Reduce `mesh_max_peer_links` and lower ttl

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 nss-setup/example/03-uci-defaults | 64 ++++++++++++++++++-------------
 1 file changed, 37 insertions(+), 27 deletions(-)

diff --git a/nss-setup/example/03-uci-defaults b/nss-setup/example/03-uci-defaults
index 91c54c52abfa9e..509af373947418 100644
--- a/nss-setup/example/03-uci-defaults
+++ b/nss-setup/example/03-uci-defaults
@@ -16,10 +16,16 @@ mac=$(fw_printenv -n ethaddr | tr '[:upper:]' '[:lower:]')
 wds_disable=1
 bridge_mode=true
 
-ap_5g_radio="radio0"
-ap_2g_radio="radio1"
-mesh_radio="radio2"
-wds_radio="${mesh_radio}"
+# radio_5g_low is the low 5G band (36-64)
+# radio_5g_high is the high 5G band (100-165)
+radio_5g_low="radio0"
+radio_2g="radio1"
+radio_5g_high="radio2"
+
+ap_5g_radio="${radio_5g_low}"
+ap_2g_radio="${radio_2g}"
+mesh_radio="${radio_5g_high}"
+wds_radio="${radio_5g_high}"
 
 # for 80mhz channel 161 will use channels 149-161 (leave as is)
 mesh_channel=161
@@ -27,6 +33,10 @@ mesh_channel=161
 ap_5g_channel=64
 ap_2g_channel=6
 
+ap_2g_txpower=24
+ap_5g_txpower=21
+mesh_txpower=30
+
 # Unique UCI config names for each section
 ap_5g_iface="ap_5g"
 ap_2g_iface="ap_2g"
@@ -68,13 +78,13 @@ fallback_mgmt_ip="10.1.1.1"
 # NOTE: ON MX4300 ONLY THE 2ND RADIO WORKS WITH MESH. LEAVE THIS UNCHANGED.
 mesh_band="$(fw_printenv -n mesh_band 2> /dev/null)"
 mesh_band="${mesh_band:-high_5g}"
-mesh_rssi_threshold="-65"
 
 if [ "$mesh_band" = "low_5g" ]; then
-  mesh_radio="radio0"
+  mesh_radio="${radio_5g_low}"
+  wds_radio="${radio_5g_low}"
   mesh_channel="64"
-  ap_5g_radio="radio2"
-  ap_5g_channel="100"
+  ap_5g_radio="${radio_5g_high}"
+  ap_5g_channel="161"
 fi
 
 # Setup satellite nodes to simply extend wifi coverage from the main router.
@@ -83,6 +93,7 @@ fi
 mesh_gate_announcements="0"
 mesh_hwmp_rootmode="0"
 mesh_fwding="0"
+mesh_rssi_threshold="-65"
 
 stp_priority=8192
 
@@ -251,16 +262,16 @@ config device
 config interface 'lan'
 	option device 'br-lan'
 $(
-    if [ "$lan_proto" = "static" ]; then
-      cat <<- EOD
+	if [ "$lan_proto" = "static" ]; then
+	  cat <<- EOD
 	option proto 'static'
 	list ipaddr '${ipaddr}/${netmask:-24}'
 	list dns '${router}'
 	option gateway '${router}'
 	option delegate '0'
 EOD
-    else
-      cat <<- EOD
+	else
+	  cat <<- EOD
 	option proto 'dhcp'
 	option delegate '0'
 
@@ -271,8 +282,8 @@ config interface 'mgmt'
 	option netmask '255.255.255.0'
 	option delegate '0'
 EOD
-    fi
-  )
+	fi
+)
 
 config interface 'lan6'
 	option device '@lan'
@@ -324,37 +335,37 @@ EOF
 uci import <<- EOF
 package wireless
 
-config wifi-device 'radio0'
+config wifi-device '${radio_5g_low}'
 	option type 'mac80211'
 	option path 'platform/soc@0/c000000.wifi'
 	option band '5g'
-	option txpower '21'
+	option txpower '${ap_5g_txpower}'
 	option country '${country:-US}'
 	option htmode 'HE80'
 	option channel '${ap_5g_channel:-64}'
 	option cell_density '0'
 	option noscan '1'
 
-config wifi-device 'radio1'
+config wifi-device '${radio_2g}'
 	option type 'mac80211'
 	option path 'platform/soc@0/c000000.wifi+1'
 	option band '2g'
-	option txpower '24'
+	option txpower '${ap_2g_txpower}'
 	option country '${country:-US}'
 	option htmode 'HE20'
 	option channel '${ap_2g_channel:-6}'
 	option cell_density '0'
 	option noscan '1'
 
-config wifi-device 'radio2'
+config wifi-device '${radio_5g_high}'
 	option type 'mac80211'
 	option path 'platform/soc@0/c000000.wifi+2'
 	option band '5g'
-	option txpower '30'
+	option txpower '${mesh_txpower}'
 	option country '${country:-US}'
 	option htmode 'HE80'
 	option channel '${mesh_channel:-161}'
-	option cell_density '3'
+	option cell_density '0'
 	option noscan '1'
 
 config wifi-iface '${ap_5g_iface}'
@@ -366,7 +377,6 @@ config wifi-iface '${ap_5g_iface}'
 	option key '${ap_key}'
 	option beacon_int '97'
 	option bss_transition '1'
-	option disassoc_low_ack '0'
 	option dtim_period '3'
 	option ft_over_ds '0'
 	option ft_psk_generate_local '1'
@@ -378,7 +388,6 @@ config wifi-iface '${ap_5g_iface}'
 	option time_zone 'GMT0'
 	option wnm_sleep_mode '1'
 	option wpa_group_rekey '86400'
-	option pmk_r1_push '1'
 
 config wifi-iface '${ap_2g_iface}'
 	option device '${ap_2g_radio}'
@@ -389,7 +398,6 @@ config wifi-iface '${ap_2g_iface}'
 	option key '${ap_key}'
 	option bss_transition '1'
 	option beacon_int '100'
-	option disassoc_low_ack '0'
 	option dtim_period '3'
 	option ft_over_ds '0'
 	option ft_psk_generate_local '1'
@@ -402,7 +410,6 @@ config wifi-iface '${ap_2g_iface}'
 	option wnm_sleep_mode '1'
 	option wpa_group_rekey '86400'
 	option max_inactivity '4260'
-	option pmk_r1_push '1'
 
 config wifi-iface '${mesh_iface}'
 	option device '${mesh_radio}'
@@ -414,7 +421,10 @@ config wifi-iface '${mesh_iface}'
 	option mesh_fwding '${mesh_fwding:-0}'
 	option mesh_gate_announcements '${mesh_gate_announcements:-0}'
 	option mesh_hwmp_rootmode '${mesh_hwmp_rootmode:-0}'
-	option mesh_max_peer_links '16'
+	option mesh_max_peer_links '5'
+	option mesh_ttl '5'
+	option mesh_element_ttl '3'
+	option mesh_hwmp_max_preq_retries '2'
 	option mesh_rssi_threshold '${mesh_rssi_threshold}'
 	option disabled $([ ${wds_disable:-1} -eq 1 ] && echo '0' || echo '1')
 
@@ -434,7 +444,7 @@ uci batch <<- EOF
 	set wireless.${mesh_radio}.channel='${mesh_channel}'
 	set wireless.${ap_5g_radio}.channel='${ap_5g_channel}'
 
-	set wireless.${mesh_radio}.cell_density='3'
+	set wireless.${mesh_radio}.cell_density='0'
 	set wireless.${ap_5g_radio}.cell_density='0'
 
 	set wireless.${mesh_iface}.device='${mesh_radio}'

From 822d2551f4e4f05e283d0c8a7ad51fb8107aafc3 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 12 Oct 2024 18:39:54 -0400
Subject: [PATCH 204/225] nss-setup: Optimize mesh node/sat configs

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 nss-setup/example/01-mesh-node     | 15 +++++++++------
 nss-setup/example/02-mesh-sat-node | 11 +++++++----
 2 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/nss-setup/example/01-mesh-node b/nss-setup/example/01-mesh-node
index f13c2e9a073722..ea70cec257a3b4 100644
--- a/nss-setup/example/01-mesh-node
+++ b/nss-setup/example/01-mesh-node
@@ -28,7 +28,7 @@ config wifi-device 'radio2'
 	option country 'US'
 	option htmode 'HE80'
 	option channel '161'
-	option cell_density '3'
+	option cell_density '0'
 	option noscan '1'
 
 config wifi-iface '5g'
@@ -36,7 +36,7 @@ config wifi-iface '5g'
 	option mode 'ap'
 	option network 'lan'
 	option ssid 'MX4300'
-	option encryption 'psk2+ccmp'
+	option encryption 'psk2'
 	option key 'xxxxxxxxxxxxx'
 	option beacon_int '97'
 	option bss_transition '1'
@@ -61,7 +61,7 @@ config wifi-iface '2g'
 	option mode 'ap'
 	option network 'lan'
 	option ssid 'MX4300'
-	option encryption 'psk2+ccmp'
+	option encryption 'psk2'
 	option key 'xxxxxxxxxxxxx'
 	option bss_transition '1'
 	option beacon_int '100'
@@ -91,9 +91,12 @@ config wifi-iface 'mesh'
 	option network 'lan'
 	option mesh_fwding '1'
 	option mesh_gate_announcements '1'
-	option mesh_hwmp_rootmode '2'
-	option mesh_max_peer_links '16'
-	option mesh_rssi_threshold '-65'
+	option mesh_hwmp_rootmode '4'
+	option mesh_max_peer_links '5'
+	option mesh_ttl '5'
+	option mesh_element_ttl '3'
+	option mesh_hwmp_max_preq_retries '2'
+	option mesh_rssi_threshold '-70'
 	option disabled '0'
 	option macaddr '80:69:1A:22:AA:BC'
 
diff --git a/nss-setup/example/02-mesh-sat-node b/nss-setup/example/02-mesh-sat-node
index 7eef194be44a04..cb0660274530f8 100644
--- a/nss-setup/example/02-mesh-sat-node
+++ b/nss-setup/example/02-mesh-sat-node
@@ -36,7 +36,7 @@ config wifi-iface '5g'
 	option mode 'ap'
 	option network 'lan'
 	option ssid 'MX4300'
-	option encryption 'psk2+ccmp'
+	option encryption 'psk2'
 	option key 'xxxxxxxxxxxxx'
 	option beacon_int '97'
 	option bss_transition '1'
@@ -61,7 +61,7 @@ config wifi-iface '2g'
 	option mode 'ap'
 	option network 'lan'
 	option ssid 'MX4300'
-	option encryption 'psk2+ccmp'
+	option encryption 'psk2'
 	option key 'xxxxxxxxxxxxx'
 	option bss_transition '1'
 	option beacon_int '100'
@@ -92,7 +92,10 @@ config wifi-iface 'mesh'
 	option mesh_fwding '0'
 	option mesh_gate_announcements '0'
 	option mesh_hwmp_rootmode '0'
-	option mesh_max_peer_links '16'
+	option mesh_max_peer_links '3'
+	option mesh_ttl '5'
+	option mesh_element_ttl '3'
+	option mesh_hwmp_max_preq_retries '2'
 	option mesh_rssi_threshold '-65'
 	option disabled '0'
 	option macaddr '80:69:1A:22:AA:AA'
@@ -102,7 +105,7 @@ config wifi-iface 'wds'
 	option mode 'sta'
 	option network 'lan'
 	option ssid 'MX4300-WDS'
-	option encryption 'psk2+ccmp'
+	option encryption 'psk2'
 	option key '4b22dd0c95846d36a8760ec90b703601c60f31ce4c8db1d9ade683cd3a2c2326'
 	option wds '1'
 	option disabled '1'

From c65cb6b1857b2830eedda4bc8375dec369a935ca Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 12 Oct 2024 18:41:25 -0400
Subject: [PATCH 205/225] nss-setup: Include example for setting up VLANs

For NSS setups, you CANNOT enable option for vlan filtering.
This is done internally by NSS (via `kmod-qca-nss-drv-vlan-mgr`).

Check if you have it enabled by running the following command:
`uci show network | grep vlan_filtering`

If it's enabled, you might see:
`network.@device[0].vlan_filtering='1'`

Disable it by running the following commands:
```sh
uci del network.@device[0].vlan_filtering
uci commit network
service network restart
```
Or reboot the device

You also cannot use tagging in the typical way, as the NSS does not support it.
That means your config must not anything like:

```
  list ports 'lan1:u*'
  list ports 'lan2:t'
  list ports 'lan3:t'
```

To set up VLANs you must:

1.) Set them up on specific ports
2.) Bridge them into interfaces (they can be left unmanaged)
3.) Create firewall rules

Check `nss-setup/example/04-vlans` for more examples

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 nss-setup/example/04-vlans | 166 +++++++++++++++++++++++++++++++++++++
 1 file changed, 166 insertions(+)
 create mode 100644 nss-setup/example/04-vlans

diff --git a/nss-setup/example/04-vlans b/nss-setup/example/04-vlans
new file mode 100644
index 00000000000000..221460f5ff1b14
--- /dev/null
+++ b/nss-setup/example/04-vlans
@@ -0,0 +1,166 @@
+# For NSS setups, you CANNOT enable the option for vlan filtering.
+# This is done internally by NSS (via `kmod-qca-nss-drv-vlan-mgr`).
+#
+# Check if you have it enabled by running the following command:
+# `uci show network | grep vlan_filtering`
+#
+# If it's enabled, you might see:
+# `network.@device[0].vlan_filtering='1'`
+#
+# Disable it by running the following commands:
+# `uci del network.@device[0].vlan_filtering`
+# `uci commit network`
+# `service network restart` (or reboot the device)
+#
+# You also cannot use tagging in the typical way, as the NSS does not support it.
+# That means your config must not anything like:
+#
+# 'list ports 'lan1:u*'
+# 'list ports 'lan2:t'
+# 'list ports 'lan3:t'
+#
+# To set up VLANs you must:
+# 1.) Set them up on specific ports
+# 2.) Bridge them into interfaces (they can be left unmanaged)
+# 3.) Create firewall rules
+
+# Example setup:
+# 1.) Primary Network (vlan10) - untagged
+# 2.) Guest Network (vlan30)
+# 3.) IoT Network (vlan40)
+
+# /etc/config/network
+config interface 'loopback'
+	option device 'lo'
+	option proto 'static'
+	option ipaddr '127.0.0.1'
+	option netmask '255.0.0.0'
+
+config globals 'globals'
+	option ula_prefix 'fd32:aa0c:9a35::/48'
+
+config device
+	option name 'br-lan'
+	option type 'bridge'
+	list ports 'lan1'
+	list ports 'lan2'
+	list ports 'lan3'
+	list ports 'lan4'
+	list ports 'wan'
+	option igmp_snooping '1'
+
+config device
+	option name 'lan1'
+	option macaddr 'AA:BB:CC:DD:EE:FF'
+
+config device
+	option name 'lan2'
+	option macaddr 'AA:BB:CC:DD:EE:FF'
+
+config device
+	option name 'lan3'
+	option macaddr 'AA:BB:CC:DD:EE:FF'
+
+config device
+	option name 'lan4'
+	option macaddr 'AA:BB:CC:DD:EE:FF'
+
+config interface 'lan'
+	option device 'br-lan'
+	option proto 'static'
+	option ip6assign '60'
+	list ipaddr '192.168.1.1/24'
+	option force_link '0'
+
+config device
+	option type '8021q'
+	option ifname 'wan'
+	option vid '30'
+	option name 'wan.30'
+
+config device
+	option type '8021q'
+	option ifname 'wan'
+	option vid '40'
+	option name 'wan.40'
+
+config device
+	option type 'bridge'
+	option name 'br-iot'
+	list ports 'wan.40'
+	option igmp_snooping '1'
+
+config device
+	option type 'bridge'
+	option name 'br-guest'
+	list ports 'wan.30'
+	option igmp_snooping '1'
+
+config interface 'guest'
+	option proto 'none'
+	option device 'br-guest'
+
+config interface 'iot'
+	option proto 'none'
+	option device 'br-iot'
+
+# /etc/config/wireless
+
+config wifi-iface 'default_radio0''
+	option device 'radio0'
+	option mode 'ap'
+	option network 'lan'
+	option ssid 'OpenWrt'
+	option encryption 'psk2'
+	option key '********'
+	option ocv '0'
+	option bss_transition '1'
+	option dtim_period '3'
+
+config wifi-iface 'guest'
+	option device 'radio0'
+	option mode 'ap'
+	option network 'br-guest'
+	option ssid 'OpenWrt-Guest'
+	option encryption 'psk2'
+	option key '********'
+	option ocv '0'
+	option bss_transition '1'
+	option dtim_period '3'
+
+config wifi-iface 'iot'
+	option device 'radio0'
+	option mode 'ap'
+	option network 'br-iot'
+	option ssid 'OpenWrt-IoT'
+	option encryption 'psk2'
+	option key '********'
+	option ocv '0'
+	option bss_transition '1'
+	option dtim_period '3'
+
+# For creating VLANs on physical ports with a VLAN for DMZ on ports 3 and 4 (lan3,lan4)
+# Change the following:
+config device
+	option name 'br-lan'
+	option type 'bridge'
+	list ports 'lan1'
+	list ports 'lan2'
+	list ports 'wan'
+
+config device
+	option type '8021q'
+	option ifname 'wan'
+	option vid '30'
+	option name 'dmz.30'
+
+config device
+	option type 'bridge'
+	option name 'br-dmz'
+	list ports 'dmz.30'
+	list ports 'lan3'
+	list ports 'lan4'
+
+config interface 'dmz'
+	option proto 'none'
+	option device 'br-dmz'

From fddd92b0dd839d060663eec468888ae7d662454b Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sun, 13 Oct 2024 08:08:15 -0400
Subject: [PATCH 206/225] nss-setup: clean up mesh base and sat config

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 nss-setup/example/01-mesh-node     | 4 ----
 nss-setup/example/02-mesh-sat-node | 8 ++------
 2 files changed, 2 insertions(+), 10 deletions(-)

diff --git a/nss-setup/example/01-mesh-node b/nss-setup/example/01-mesh-node
index ea70cec257a3b4..6fe47e876ba16d 100644
--- a/nss-setup/example/01-mesh-node
+++ b/nss-setup/example/01-mesh-node
@@ -54,7 +54,6 @@ config wifi-iface '5g'
 	option wnm_sleep_mode '1'
 	option wpa_group_rekey '86400'
 	option pmk_r1_push '1'
-	option macaddr '80:69:1A:22:FF:BA'
 
 config wifi-iface '2g'
 	option device 'radio1'
@@ -80,7 +79,6 @@ config wifi-iface '2g'
 	option wpa_group_rekey '86400'
 	option max_inactivity '4260'
 	option pmk_r1_push '1'
-	option macaddr '80:69:1A:22:FF:BB'
 
 config wifi-iface 'mesh'
 	option device 'radio2'
@@ -98,7 +96,6 @@ config wifi-iface 'mesh'
 	option mesh_hwmp_max_preq_retries '2'
 	option mesh_rssi_threshold '-70'
 	option disabled '0'
-	option macaddr '80:69:1A:22:AA:BC'
 
 config wifi-iface 'wds'
 	option device 'radio2'
@@ -109,4 +106,3 @@ config wifi-iface 'wds'
 	option key '4b22dd0c95846d36a8760ec90b703601c60f31ce4c8db1d9ade683cd3a2c2326'
 	option wds '1'
 	option disabled '1'
-	option macaddr '80:69:1A:22:AA:BC'
diff --git a/nss-setup/example/02-mesh-sat-node b/nss-setup/example/02-mesh-sat-node
index cb0660274530f8..5b3a42bd109ab0 100644
--- a/nss-setup/example/02-mesh-sat-node
+++ b/nss-setup/example/02-mesh-sat-node
@@ -28,7 +28,7 @@ config wifi-device 'radio2'
 	option country 'US'
 	option htmode 'HE80'
 	option channel '161'
-	option cell_density '3'
+	option cell_density '0'
 	option noscan '1'
 
 config wifi-iface '5g'
@@ -54,7 +54,6 @@ config wifi-iface '5g'
 	option wnm_sleep_mode '1'
 	option wpa_group_rekey '86400'
 	option pmk_r1_push '1'
-	option macaddr '80:69:1A:22:FF:FF'
 
 config wifi-iface '2g'
 	option device 'radio1'
@@ -80,7 +79,6 @@ config wifi-iface '2g'
 	option wpa_group_rekey '86400'
 	option max_inactivity '4260'
 	option pmk_r1_push '1'
-	option macaddr '80:69:1A:22:FF:FE'
 
 config wifi-iface 'mesh'
 	option device 'radio2'
@@ -98,15 +96,13 @@ config wifi-iface 'mesh'
 	option mesh_hwmp_max_preq_retries '2'
 	option mesh_rssi_threshold '-65'
 	option disabled '0'
-	option macaddr '80:69:1A:22:AA:AA'
 
 config wifi-iface 'wds'
 	option device 'radio2'
 	option mode 'sta'
 	option network 'lan'
 	option ssid 'MX4300-WDS'
-	option encryption 'psk2'
+	option encryption 'psk2+ccmp'
 	option key '4b22dd0c95846d36a8760ec90b703601c60f31ce4c8db1d9ade683cd3a2c2326'
 	option wds '1'
 	option disabled '1'
-	option macaddr '80:69:1A:22:AA:AA'

From 543fb5baf2edf31180869dd1c181faf7a50e67d4 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Mon, 14 Oct 2024 19:41:12 -0400
Subject: [PATCH 207/225] nss-setup: explicitly require nss-ecm

Although qca-nss-ecm isn't explicitly depended on by other
nss packages, it is still required for proper offloading.
There are also a few init and hotplug scripts needed
to mitigate issues (like disabling rx-gro-list)

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 nss-setup/config-nss.seed | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/nss-setup/config-nss.seed b/nss-setup/config-nss.seed
index 85cdd3c11d19a9..97719f5f8d525d 100644
--- a/nss-setup/config-nss.seed
+++ b/nss-setup/config-nss.seed
@@ -45,13 +45,15 @@ CONFIG_TARGET_qualcommax_ipq807x=y
 CONFIG_ATH11K_NSS_SUPPORT=y
 CONFIG_ATH11K_NSS_MESH_SUPPORT=y
 CONFIG_PACKAGE_MAC80211_NSS_SUPPORT=y
+CONFIG_PACKAGE_kmod-qca-nss-drv=y
+CONFIG_PACKAGE_kmod-qca-nss-drv-bridge-mgr=y
+CONFIG_PACKAGE_kmod-qca-nss-ecm=y
 
 # Additional NSS packages (VLAN, Multicast Snooping, etc)
 CONFIG_PACKAGE_kmod-qca-nss-drv-vlan-mgr=y
 CONFIG_PACKAGE_kmod-qca-mcs=y
 
 # NSS SQM Traffic Shaping
-CONFIG_PACKAGE_sqm-scripts=y
 CONFIG_PACKAGE_sqm-scripts-nss=y
 
 # Compiler Optimization

From e75303148b9189d5af02f57b47fee16702a4c302 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Wed, 16 Oct 2024 16:45:54 -0400
Subject: [PATCH 208/225] nss-setup: reorg seed file with additional
 instructions and clarifications

- Added detailed build instructions for new users,
  including the use of `scripts/env` for reproducible builds.
- Updated comments to provide context for each config setting and package.
- Clarified steps for selecting target devices and running make commands.
- Included notes on SSL preferences, performance optimizations, and optional packages.
- Removed redundant or unnecessary package entries for improved readability.

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 nss-setup/config-nss.seed | 172 +++++++++++++++++++++++++++++++-------
 1 file changed, 141 insertions(+), 31 deletions(-)

diff --git a/nss-setup/config-nss.seed b/nss-setup/config-nss.seed
index 97719f5f8d525d..db499bda7cb364 100644
--- a/nss-setup/config-nss.seed
+++ b/nss-setup/config-nss.seed
@@ -1,16 +1,45 @@
-# copy to `.config` and run `make defconfig`
+# vi: set syntax=make:
+
 # This builds for all ipq807x targets. 
 # To use this config, you must build from https://github.com/qosmio/openwrt-ipq
 
-# 1. copy this config to root of build folder name it ".config"
-# 2. run `make defconfig`
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~IMPORTANT~~~~~~~~~~~~~~~~~~~~~~~~~~
+# 	Use `scripts/env` to create version controlled build environments.
+# 	This ensures you can easily reproduce builds and view changes
+# 	made during `make menuconfig`.
+#
+# 	It will also version control custom files you add to `files/`
+
+# 	To create a new environment, run:
+# 	(e.g `./scripts/env new nss`)
+# 	For more information, see `./scripts/env help`
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 #
+# 1. Copy this config to root of build folder name it ".config"
+#    `cp nss-setup/config-nss.seed .config`
+# 2. Uncomment the device you want to build for listed below, replace 'is not set' with '=y'
+#    (e.g. CONFIG_TARGET_qualcommax_ipq807x_DEVICE_linksys_mx4300=y)
+# 3. Update feeds
+#    `./scripts/feeds update -a && ./scripts/feeds install -a`
+# 4. Expand your seed file to a full config
+#    `make defconfig V=s`
+# 5. If you want to make further customizations, use `make menuconfig`
+# 6. Build the firmware
+#    `make -j$(nproc) V=s`
+
 # use `make menuconfig` to further customize building just for your target or adding custom packages.
+
+#####################################################################
 # Target platform
+#####################################################################
 CONFIG_TARGET_qualcommax=y
 CONFIG_TARGET_qualcommax_ipq807x=y
 
+#####################################################################
+# Target device
+#####################################################################
 # Uncomment target device you want to build for, set '=y'
+
 # CONFIG_TARGET_qualcommax_ipq807x_DEVICE_arcadyan_aw1000 is not set
 # CONFIG_TARGET_qualcommax_ipq807x_DEVICE_asus_rt-ax89x is not set
 # CONFIG_TARGET_qualcommax_ipq807x_DEVICE_buffalo_wxr-5950ax12 is not set
@@ -41,7 +70,9 @@ CONFIG_TARGET_qualcommax_ipq807x=y
 # CONFIG_TARGET_qualcommax_ipq807x_DEVICE_zte_mf269 is not set
 # CONFIG_TARGET_qualcommax_ipq807x_DEVICE_zyxel_nbg7815 is not set
 
+#####################################################################
 # NSS Offloading
+#####################################################################
 CONFIG_ATH11K_NSS_SUPPORT=y
 CONFIG_ATH11K_NSS_MESH_SUPPORT=y
 CONFIG_PACKAGE_MAC80211_NSS_SUPPORT=y
@@ -56,17 +87,24 @@ CONFIG_PACKAGE_kmod-qca-mcs=y
 # NSS SQM Traffic Shaping
 CONFIG_PACKAGE_sqm-scripts-nss=y
 
+#####################################################################
 # Compiler Optimization
+#####################################################################
 CONFIG_BUILD_PATENTED=y
+# Use ccache to speed up subsequent builds
 CONFIG_CCACHE=y
 CONFIG_DEVEL=y
 CONFIG_EXPERIMENTAL=y
 CONFIG_TOOLCHAINOPTS=y
 CONFIG_TARGET_OPTIONS=y
 CONFIG_TARGET_OPTIMIZATION="-O2 -pipe -mcpu=cortex-a53+crc+crypto"
-CONFIG_TARGET_INIT_PATH="/usr/sbin:/usr/bin:/sbin:/bin:/opt/usr/bin:/opt/bin:/opt/sbin:/opt/usr/sbin"
 CONFIG_USE_GC_SECTIONS=y
 
+# If your device supports USB and plan on installing packages via opkg
+# Use a USB device, as these devices have limited storage and you avoid wearing out the internal flash.
+# We update the PATH to include the USB device. '/opt' is a common mount point.
+CONFIG_TARGET_INIT_PATH="/usr/sbin:/usr/bin:/sbin:/bin:/opt/usr/bin:/opt/bin:/opt/sbin:/opt/usr/sbin"
+
 # Kernel Config
 CONFIG_COLLECT_KERNEL_DEBUG=y
 CONFIG_KERNEL_PERF_EVENTS=y
@@ -76,63 +114,135 @@ CONFIG_KERNEL_ARM_PMUV3=y
 CONFIG_KERNEL_PREEMPT_NONE=y
 CONFIG_KERNEL_PREEMPT_NONE_BUILD=y
 
+# Reduce kernel module size
+# Disable unnecessary debugging for Wi-Fi driver.
+CONFIG_ATH11K_DEBUGFS_HTT_STATS=n
+CONFIG_ATH11K_DEBUGFS_STA=n
+# Disables thermal throttling support for ath11k.
+CONFIG_ATH11K_THERMAL=n
+
+#####################################################################
 # SSL Configuration
+#####################################################################
+# Use OpenSSL as the preferred SSL library
 CONFIG_PACKAGE_libustream-openssl=y
 CONFIG_PACKAGE_libustream-mbedtls=n
 CONFIG_PACKAGE_libopenssl=y
 CONFIG_LUA_ECO_OPENSSL=y
 CONFIG_LUA_ECO_MBEDTLS=n
+# Optimize OpenSSL for speed over size
 CONFIG_OPENSSL_OPTIMIZE_SPEED=y
 
-# LUCI Config
-CONFIG_PACKAGE_luci=y
-CONFIG_PACKAGE_luci-ssl-openssl=y
+#####################################################################
+# Wireless Configuration
+#####################################################################
+# Enable WPA3 and Mesh support
 CONFIG_PACKAGE_wpad-mesh-openssl=y
+# Avoid using mbedTLS for consistency across packages and to avoid mixed SSL libraries.
 CONFIG_PACKAGE_wpad-basic-mbedtls=n
 
+#####################################################################
+# Library Optimization
+#####################################################################
+# Optimize common libraries (zlib, zstd) for speed, improving performance on compression tasks.
+CONFIG_ZLIB_OPTIMIZE_SPEED=y
+CONFIG_ZSTD_OPTIMIZE_O3=y
+
+#####################################################################
+# Feeds Configuration
+#####################################################################
+# Prevent opkg from adding custom feeds to /etc/opkg/distfeeds.conf in the final image.
+CONFIG_FEED_nss_packages=n
+CONFIG_FEED_sqm_scripts_nss=n
+
+# --- Essential Packages ---
+
+#####################################################################
+# LUCI (the web interface)
+#####################################################################
+CONFIG_PACKAGE_luci=y
+# Enable HTTPS support
+CONFIG_PACKAGE_luci-ssl-openssl=y
+
+#####################################################################
 # LUCI Applications
+#####################################################################
+# - Firewall: Manage firewall rules via LUCI.
 CONFIG_PACKAGE_luci-app-firewall=y
+# - OPKG: Package manager for OpenWRT, manage installed packages via LUCI.
 CONFIG_PACKAGE_luci-app-opkg=y
+
+# - iperf3: CLI tool to measure network performance.
+#           This is essential to test WiFi speeds,
+#           as posting speedtest.net results is useless
+#           without knowing the network conditions.
+CONFIG_PACKAGE_iperf3=y
+
+# --- Optional Packages --- #
+
+#### EVERYTHING BELOW THIS SECTION IS OPTIONAL!!
+
+#### You can delete or comment out with '#' any package you don't want to install.
+
+#####################################################################
+# LUCI Applications
+#####################################################################
+
+# - SQM: Smart Queue Management for bufferbloat control.
 CONFIG_PACKAGE_luci-app-sqm=y
+# - Statistics: Monitor your router’s performance (CPU, memory, bandwidth).
 CONFIG_PACKAGE_luci-app-statistics=y
+# - ACME: Automated SSL cert management. If you want to access your router via HTTPS and have a domain.
 CONFIG_PACKAGE_luci-app-acme=y
-CONFIG_PACKAGE_luci-app-firewall=y
-CONFIG_PACKAGE_luci-app-nlbwmon=y
-CONFIG_PACKAGE_luci-app-opkg=y
-CONFIG_PACKAGE_luci-app-sqm=y
-CONFIG_PACKAGE_luci-app-statistics=y
+# - Watchcat: Automate reboots on connection loss.
 CONFIG_PACKAGE_luci-app-watchcat=y
+# - WireGuard: VPN support. Will also select the kernel module.
 CONFIG_PACKAGE_luci-proto-wireguard=y
+# - NLBWMon: Network usage monitoring to track bandwidth by host.
+CONFIG_PACKAGE_luci-app-nlbwmon=y
 
-# Library Optimization
-CONFIG_ZLIB_OPTIMIZE_SPEED=y
-CONFIG_ZSTD_OPTIMIZE_O3=y
-
-# Reduce kernel module size
-CONFIG_ATH11K_DEBUGFS_HTT_STATS=n
-CONFIG_ATH11K_DEBUGFS_STA=n
-CONFIG_ATH11K_THERMAL=n
-
-# Additional kernel modules
+#####################################################################
+# Kernel Modules
+#####################################################################
+# Filesystem support for USB storage:
+# FAT32: Useful to load recovery or new images that can be booted by u-boot
 CONFIG_PACKAGE_kmod-fs-vfat=y
-CONFIG_PACKAGE_kmod-fs-f2fs=y
+# NTFS: Mostly useful for Windows users.
 CONFIG_PACKAGE_kmod-fs-ntfs3=y
+
+# Network
+# Bridge module support for working with nftables for more complex firewall setups.
 CONFIG_PACKAGE_kmod-nft-bridge=y
+
+# USB Storage
+# NOTE: Not all IPQ807x devices have USB ports, so this is optional.
 CONFIG_PACKAGE_kmod-usb-storage=y
+
+# Logging/Debugging
+
+# ramoops: kernel module that logs crashes to RAM which can be read after a reboot.
+# Check '/sys/fs/pstore' for logs after a crash.
 CONFIG_PACKAGE_kmod-ramoops=y
 
-# Additional packages
-CONFIG_PACKAGE_iperf3=y
-CONFIG_PACKAGE_htop=y
+#####################################################################
+# Packages
+#####################################################################
+
+# - curl: CLI tool to transfer data with URLs. Useful for scripting, and supperior to wget.
 CONFIG_PACKAGE_curl=y
+CONFIG_LIBCURL_OPENSSL=y
+CONFIG_LIBCURL_MBEDTLS=n
+# - rsync: Efficient file transfers and backups.
 CONFIG_PACKAGE_rsync=y
+# - jq: Parse JSON data from the command line. Useful for scripting, and WAY better than `jsonfilter`.
 CONFIG_PACKAGE_jq=y
+# - pigz: Parallel gzip for faster compression.
 CONFIG_PACKAGE_pigz=y
+# - tar: Archiving utility. The default busybox tar is very limited.
 CONFIG_PACKAGE_tar=y
+# - tcpdump: Capture and analyze network traffic.
 CONFIG_PACKAGE_tcpdump=y
-
+# - htop: CLI tool to monitor system resource usage.
+CONFIG_PACKAGE_htop=y
+# lm-sensors isn't needed for IPQ807x devices.
 CONFIG_HTOP_LMSENSORS=n
-
-# Prevent opkg from adding custom feeds to /etc/opkg/distfeeds.conf
-CONFIG_FEED_nss_packages=n
-CONFIG_FEED_sqm_scripts_nss=n

From 97581b3fcf2161a524e62221bbdecebc3fba9680 Mon Sep 17 00:00:00 2001
From: AgustinLorenzo <agustin.lorenzo@thinco.es>
Date: Sun, 20 Oct 2024 01:30:15 +0200
Subject: [PATCH 209/225] qualcommax: ath10k-ct: bump patch for 6.7 to 6.10

---
 ...99-001-fix-ath10k_update_vif_offload.patch |  8 +++---
 .../999-800-ath10k-Add-threaded-napi.patch    | 25 ++++++++++---------
 2 files changed, 17 insertions(+), 16 deletions(-)

diff --git a/package/kernel/ath10k-ct/patches/999-001-fix-ath10k_update_vif_offload.patch b/package/kernel/ath10k-ct/patches/999-001-fix-ath10k_update_vif_offload.patch
index 6d0f8b4f8fd4cc..98c6459a924034 100644
--- a/package/kernel/ath10k-ct/patches/999-001-fix-ath10k_update_vif_offload.patch
+++ b/package/kernel/ath10k-ct/patches/999-001-fix-ath10k_update_vif_offload.patch
@@ -1,6 +1,6 @@
---- a/ath10k-6.7/mac.c
-+++ b/ath10k-6.7/mac.c
-@@ -6364,7 +6364,7 @@ static int ath10k_mac_set_txbf_conf(stru
+--- a/ath10k-6.10/mac.c
++++ b/ath10k-6.10/mac.c
+@@ -6365,7 +6365,7 @@ static int ath10k_mac_set_txbf_conf(stru
  					 ar->wmi.vdev_param->txbf, value);
  }
  
@@ -9,7 +9,7 @@
  				      struct ieee80211_vif *vif)
  {
  	struct ath10k_vif *arvif = (void *)vif->drv_priv;
-@@ -6386,6 +6386,8 @@ static void ath10k_update_vif_offload(st
+@@ -6387,6 +6387,8 @@ static void ath10k_update_vif_offload(st
  		ath10k_warn(ar, "failed to set vdev %i TX encapsulation: %d\n",
  			    arvif->vdev_id, ret);
  	}
diff --git a/package/kernel/ath10k-ct/patches/999-800-ath10k-Add-threaded-napi.patch b/package/kernel/ath10k-ct/patches/999-800-ath10k-Add-threaded-napi.patch
index 8290bc19751fa1..ebbea4f4132260 100644
--- a/package/kernel/ath10k-ct/patches/999-800-ath10k-Add-threaded-napi.patch
+++ b/package/kernel/ath10k-ct/patches/999-800-ath10k-Add-threaded-napi.patch
@@ -1,6 +1,6 @@
---- a/ath10k-6.7/pci.c
-+++ b/ath10k-6.7/pci.c
-@@ -2284,6 +2284,7 @@ static int ath10k_pci_hif_start(struct a
+--- a/ath10k-6.10/pci.c
++++ b/ath10k-6.10/pci.c
+@@ -2285,6 +2285,7 @@ static int ath10k_pci_hif_start(struct a
  
  	ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot hif start\n");
  
@@ -8,9 +8,9 @@
  	ath10k_core_napi_enable(ar);
  
  	ath10k_pci_irq_enable(ar);
---- a/ath10k-6.7/sdio.c
-+++ b/ath10k-6.7/sdio.c
-@@ -1862,6 +1862,7 @@ static int ath10k_sdio_hif_start(struct
+--- a/ath10k-6.10/sdio.c
++++ b/ath10k-6.10/sdio.c
+@@ -1863,6 +1863,7 @@ static int ath10k_sdio_hif_start(struct
  	struct ath10k_sdio *ar_sdio = ath10k_sdio_priv(ar);
  	int ret;
  
@@ -18,15 +18,16 @@
  	ath10k_core_napi_enable(ar);
  
  	/* Sleep 20 ms before HIF interrupts are disabled.
---- a/ath10k-6.7/core.c
-+++ b/ath10k-6.7/core.c
-@@ -4571,6 +4571,9 @@ struct ath10k *ath10k_core_create(size_t
- 	INIT_WORK(&ar->stop_scan_work, ath10k_wmi_stop_scan_work);
+--- a/ath10k-6.10/core.c
++++ b/ath10k-6.10/core.c
+@@ -4576,6 +4576,10 @@ struct ath10k *ath10k_core_create(size_t
+	if (!ar->napi_dev)
+		goto err_free_tx_complete;
  
- 	init_dummy_netdev(&ar->napi_dev);
 +	snprintf(ar->napi_dev.name, sizeof(ar->napi_dev.name), "ath10k_%s",
 +		 wiphy_name(ar->hw->wiphy));
 +	dev_set_threaded(&ar->napi_dev, true);
- 
++
  	ret = ath10k_coredump_create(ar);
  	if (ret)
+		goto err_free_netdev;

From 23ac8afcdcd2848179cf446516a80210f7c5e9d7 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 19 Oct 2024 22:15:49 -0400
Subject: [PATCH 210/225] ath11k_nss: add disable_mesh_chksum_ath11k.hotplug

Rather than pollute `qca-nss-ecm` with logic specific to ath11k, move
into its own hotplug script managed by mac80211. Also enforce
`qca-nss-ecm` dependency.

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 package/kernel/mac80211/Makefile              |  3 ++-
 package/kernel/mac80211/ath.mk                |  1 +
 .../files/disable_mesh_chksum_ath11k.hotplug  | 24 +++++++++++++++++++
 3 files changed, 27 insertions(+), 1 deletion(-)
 create mode 100644 package/kernel/mac80211/files/disable_mesh_chksum_ath11k.hotplug

diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile
index be222a6f1344b3..67cfdff20f8414 100644
--- a/package/kernel/mac80211/Makefile
+++ b/package/kernel/mac80211/Makefile
@@ -441,10 +441,11 @@ endef
 
 ifdef CONFIG_ATH11K_NSS_SUPPORT
 define KernelPackage/ath11k/install
-	$(INSTALL_DIR) $(1)/etc/init.d $(1)/etc/config $(1)/usr/bin
+	$(INSTALL_DIR) $(1)/etc/init.d $(1)/etc/config $(1)/usr/bin $(1)/etc/hotplug.d/net
 	$(INSTALL_BIN) ./files/qca-nss-pbuf.init $(1)/etc/init.d/qca-nss-pbuf
 	$(INSTALL_DATA) ./files/pbuf.uci $(1)/etc/config/pbuf
 	$(INSTALL_BIN) ./files/nss_diag.sh $(1)/usr/bin/nss_diag
+	$(INSTALL_DATA) ./files/disable_mesh_chksum_ath11k.hotplug $(1)/etc/hotplug.d/net/99-disable_mesh_chksum_ath11k
 	echo "IPQ_BRANCH=$(IPQ_BRANCH)" > $(1)/etc/ipq_release
 	echo "IPQ_DATE=$(IPQ_DATE)" >> $(1)/etc/ipq_release
 	echo "IPQ_COMMIT=$(IPQ_COMMIT)" >> $(1)/etc/ipq_release
diff --git a/package/kernel/mac80211/ath.mk b/package/kernel/mac80211/ath.mk
index 5c382d43f78389..44e95b953a43b3 100644
--- a/package/kernel/mac80211/ath.mk
+++ b/package/kernel/mac80211/ath.mk
@@ -377,6 +377,7 @@ define KernelPackage/ath11k/config
                	 TARGET_qualcommax_ipq807x_DEVICE_xiaomi_ax3600 || \
                	 TARGET_qualcommax_ipq807x_DEVICE_zte_mf269 )
                select ATH11K_MEM_PROFILE_256M if TARGET_qualcommax_ipq807x_DEVICE_netgear_wax218
+               select PACKAGE_kmod-qca-nss-ecm
                default y
                help
                   Say Y to enable NSS WiFi offload support. Ensure you enable feeds for NSS drivers.
diff --git a/package/kernel/mac80211/files/disable_mesh_chksum_ath11k.hotplug b/package/kernel/mac80211/files/disable_mesh_chksum_ath11k.hotplug
new file mode 100644
index 00000000000000..a118e7b55c1b53
--- /dev/null
+++ b/package/kernel/mac80211/files/disable_mesh_chksum_ath11k.hotplug
@@ -0,0 +1,24 @@
+#!/bin/sh
+# shellcheck disable=1090
+PROG=${0##*/}
+[ "$ACTION" = "add" ] && [ "$DEVTYPE" = "wlan" ] || exit 0
+
+UEVENT="/sys/class/net/$INTERFACE/device/uevent"
+[ -r "$UEVENT" ] || exit 0
+
+DRIVER=$(awk -F= '/^DRIVER/{print $2}' "$UEVENT")
+case "$DRIVER" in
+  *ath11k*)
+    mode=$(ubus call network.wireless status \
+      | jsonfilter -e "@[*].interfaces[@.ifname='$INTERFACE'].config.mode" 2> /dev/null)
+    [ "$mode" = "mesh" ] || exit 0
+
+    INC="/lib/netifd/offload/disable_offloads.sh"
+    . "$INC" 2> /dev/null || {
+      logger -t "$PROG" -p user.error "missing include script $INC. exiting..."
+      exit 1
+    }
+
+    disable_feature tx-checksumming "$INTERFACE"
+    ;;
+esac

From 4a52fbdfbdf46d4fe71e5b26ba9be9b9077da92f Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 19 Oct 2024 22:36:23 -0400
Subject: [PATCH 211/225] ath11k_nss: Improve NSS event callback handling

Improve NSS event callback ihandling for better clarity and type safety

This patch modifies ath11k_nss_wifili_event_receive to take a context parameter
, enhancing code clarity by explicitly passing the ath11k_base.

A wrapper function, ath11k_nss_wifili_ext_callback_wrapper, retrieves
the ath11k_base from the net_device's private data, ensuring correct
context handling.

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...ath11k-nss-use-wrapper-to-avoid-cast.patch | 270 ++++++++++++++++++
 1 file changed, 270 insertions(+)
 create mode 100644 package/kernel/mac80211/patches/nss/ath11k/999-904-ath11k-nss-use-wrapper-to-avoid-cast.patch

diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-904-ath11k-nss-use-wrapper-to-avoid-cast.patch b/package/kernel/mac80211/patches/nss/ath11k/999-904-ath11k-nss-use-wrapper-to-avoid-cast.patch
new file mode 100644
index 00000000000000..02ba6dffebc099
--- /dev/null
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-904-ath11k-nss-use-wrapper-to-avoid-cast.patch
@@ -0,0 +1,270 @@
+--- a/drivers/net/wireless/ath/ath11k/nss.c
++++ b/drivers/net/wireless/ath/ath11k/nss.c
+@@ -313,13 +313,14 @@ static void ath11k_nss_peer_mem_free(str
+ 
+ /*-----------------------------Events/Callbacks------------------------------*/
+ 
+-void ath11k_nss_wifili_event_receive(struct ath11k_base *ab, struct nss_wifili_msg *msg)
++void ath11k_nss_wifili_event_receive(void *context, struct nss_wifili_msg *msg)
+ {
+ 	u32 msg_type = msg->cm.type;
+ 	enum nss_cmn_response response = msg->cm.response;
+ 	u32 error =  msg->cm.error;
+ 	u32 peer_id;
+ 	struct nss_wifili_peer_stats *peer_stats;
++	struct ath11k_base *ab = (struct ath11k_base *)context;
+ 
+ 	if (!ab)
+ 		return;
+@@ -519,6 +520,17 @@ ath11k_nss_wifili_ext_callback_fn(struct
+ 	}
+ }
+ 
++static inline void ath11k_nss_wifili_ext_callback_wrapper(struct net_device *netdev,
++						   struct sk_buff *skb,
++						   struct napi_struct *napi)
++{
++	// Retrieve the ath11k_base from the net_device's private data
++	struct ath11k_base *ab = (struct ath11k_base *)netdev_priv(netdev);
++
++	// Call the original function with the retrieved ath11k_base
++	ath11k_nss_wifili_ext_callback_fn(ab, skb, napi);
++}
++
+ void ath11k_nss_vdev_cfg_cb(void *app_data, struct nss_cmn_msg *msg)
+ {
+ 	struct ath11k_vif *arvif = (struct ath11k_vif *)app_data;
+@@ -1431,7 +1443,7 @@ int ath11k_nss_mesh_exception_flags(stru
+ 	nss_tx_status_t status;
+ 	int ret = 0;
+ 
+-	msg_cb = (nss_wifi_mesh_msg_callback_t)ath11k_nss_mesh_wifili_event_receive;
++	msg_cb = ath11k_nss_mesh_wifili_event_receive;
+ 
+ 	status = (nss_tx_status_t)nss_wifi_meshmgr_mesh_path_exception(arvif->nss.mesh_handle, nss_msg,
+ 			msg_cb, arvif->ar->ab);
+@@ -1532,7 +1544,7 @@ static int ath11k_nss_mesh_mpath_add(str
+ 	if (!msg)
+ 		return -ENOMEM;
+ 
+-	msg_cb = (nss_wifi_mesh_msg_callback_t)ath11k_nss_mesh_wifili_event_receive;
++	msg_cb = ath11k_nss_mesh_wifili_event_receive;
+ 
+ 	ether_addr_copy(msg->dest_mac_addr, path->mesh_da);
+ 	ether_addr_copy(msg->next_hop_mac_addr, path->next_hop);
+@@ -1578,7 +1590,7 @@ static int ath11k_nss_mesh_mpath_update(
+ 	if (!msg)
+ 		return -ENOMEM;
+ 
+-	msg_cb = (nss_wifi_mesh_msg_callback_t)ath11k_nss_mesh_wifili_event_receive;
++	msg_cb = ath11k_nss_mesh_wifili_event_receive;
+ 
+ 	ether_addr_copy(msg->dest_mac_addr, path->mesh_da);
+ 	ether_addr_copy(msg->next_hop_mac_addr, path->next_hop);
+@@ -1634,7 +1646,7 @@ static int ath11k_nss_mesh_mpath_del(str
+ 	if (!msg)
+ 		return -ENOMEM;
+ 
+-	msg_cb = (nss_wifi_mesh_msg_callback_t)ath11k_nss_mesh_wifili_event_receive;
++	msg_cb = ath11k_nss_mesh_wifili_event_receive;
+ 
+ 	ether_addr_copy(msg->mesh_dest_mac_addr, path->mesh_da);
+ 	ether_addr_copy(msg->next_hop_mac_addr, path->next_hop);
+@@ -1670,7 +1682,7 @@ static int ath11k_nss_mesh_mpp_add_cmd(s
+ 	if (!msg)
+ 		return -ENOMEM;
+ 
+-	msg_cb = (nss_wifi_mesh_msg_callback_t)ath11k_nss_mesh_wifili_event_receive;
++	msg_cb = ath11k_nss_mesh_wifili_event_receive;
+ 
+ 	ether_addr_copy(msg->dest_mac_addr, path->da);
+ 	ether_addr_copy(msg->mesh_dest_mac, path->mesh_da);
+@@ -1706,7 +1718,7 @@ static int ath11k_nss_mesh_mpp_update_cm
+ 	if (!msg)
+ 		return -ENOMEM;
+ 
+-	msg_cb = (nss_wifi_mesh_msg_callback_t)ath11k_nss_mesh_wifili_event_receive;
++	msg_cb = ath11k_nss_mesh_wifili_event_receive;
+ 
+ 	ether_addr_copy(msg->dest_mac_addr, path->da);
+ 	ether_addr_copy(msg->mesh_dest_mac, path->mesh_da);
+@@ -1744,7 +1756,7 @@ static int ath11k_nss_mesh_mpp_del_cmd(s
+ 	if (!msg)
+ 		return -ENOMEM;
+ 
+-	msg_cb = (nss_wifi_mesh_msg_callback_t)ath11k_nss_mesh_wifili_event_receive;
++	msg_cb = ath11k_nss_mesh_wifili_event_receive;
+ 
+ 	ether_addr_copy(msg->dest_mac_addr, path->da);
+ 	ether_addr_copy(msg->mesh_dest_mac_addr, path->mesh_da);
+@@ -1933,7 +1945,7 @@ void ath11k_nss_mpp_timer_cb(struct time
+ 	LIST_HEAD(local_entry);
+ 	nss_tx_status_t status;
+ 
+-	msg_cb = (nss_wifi_mesh_msg_callback_t)ath11k_nss_mesh_wifili_event_receive;
++	msg_cb = ath11k_nss_mesh_wifili_event_receive;
+ 
+ 	if (!arvif->nss.mpp_dump_req)
+ 		arvif->nss.mpp_dump_num_entries = 0;
+@@ -3067,7 +3079,7 @@ int ath11k_nss_ext_vdev_wds_4addr_allow(
+ 	cfg_4addr_msg->if_num = arvif->nss.if_num;
+ 	cfg_4addr_msg->enable = true;
+ 
+-	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++	msg_cb = ath11k_nss_wifili_event_receive;
+ 
+ 	nss_cmn_msg_init(&wlmsg->cm, ar->ab->nss.if_num,
+ 			 NSS_WIFILI_PEER_4ADDR_EVENT_MSG,
+@@ -3472,7 +3484,7 @@ int ath11k_nss_set_peer_sec_type(struct
+ 		memcpy(&sec_msg->mic_key[0], mic_key, NSS_WIFILI_MIC_KEY_LEN);
+ 	}
+ 
+-	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++	msg_cb = ath11k_nss_wifili_event_receive;
+ 
+ 	nss_cmn_msg_init(&wlmsg->cm, ar->ab->nss.if_num,
+ 			 NSS_WIFILI_PEER_SECURITY_TYPE_MSG,
+@@ -3511,7 +3523,7 @@ int ath11k_nss_set_peer_authorize(struct
+ 	auth_msg->peer_id = peer_id;
+ 	auth_msg->auth_flag = 1;
+ 
+-	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++	msg_cb = ath11k_nss_wifili_event_receive;
+ 
+ 	nss_cmn_msg_init(&wlmsg->cm, ar->ab->nss.if_num,
+ 			 NSS_WIFILI_PEER_UPDATE_AUTH_FLAG,
+@@ -3743,7 +3755,7 @@ int ath11k_nss_peer_delete(struct ath11k
+ 	peer_msg->vdev_id = peer->vdev_id;
+ 	peer_msg->peer_id = peer->peer_id;
+ 
+-	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++	msg_cb = ath11k_nss_wifili_event_receive;
+ 
+ 	nss_cmn_msg_init(&wlmsg->cm, ar->ab->nss.if_num,
+ 			 NSS_WIFILI_PEER_DELETE_MSG,
+@@ -3841,7 +3853,7 @@ int ath11k_nss_peer_create(struct ath11k
+ 	peer_msg->nss_peer_mem = peer->nss.paddr;
+ 	peer_msg->psta_vdev_id = peer->vdev_id;
+ 
+-	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++	msg_cb = ath11k_nss_wifili_event_receive;
+ 
+ 	nss_cmn_msg_init(&wlmsg->cm, ab->nss.if_num,
+ 			 NSS_WIFILI_PEER_CREATE_MSG,
+@@ -3909,7 +3921,7 @@ int ath11k_nss_add_wds_peer(struct ath11
+ 	ether_addr_copy(wds_peer_msg->peer_mac, peer->addr);
+ 	ether_addr_copy(wds_peer_msg->dest_mac, dest_mac);
+ 
+-	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++	msg_cb = ath11k_nss_wifili_event_receive;
+ 
+ 	nss_cmn_msg_init(&wlmsg->cm, ab->nss.if_num,
+ 			 NSS_WIFILI_WDS_PEER_ADD_MSG,
+@@ -3955,7 +3967,7 @@ int ath11k_nss_update_wds_peer(struct at
+ 	ether_addr_copy(wds_peer_msg->peer_mac, peer->addr);
+ 	ether_addr_copy(wds_peer_msg->dest_mac, dest_mac);
+ 
+-	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++	msg_cb = ath11k_nss_wifili_event_receive;
+ 
+ 	nss_cmn_msg_init(&wlmsg->cm, ab->nss.if_num,
+ 			 NSS_WIFILI_WDS_PEER_UPDATE_MSG,
+@@ -4006,7 +4018,7 @@ int ath11k_nss_map_wds_peer(struct ath11
+ 
+ 	ether_addr_copy(wds_peer_map_msg->dest_mac, dest_mac);
+ 
+-	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++	msg_cb = ath11k_nss_wifili_event_receive;
+ 
+ 	nss_cmn_msg_init(&wlmsg->cm, ab->nss.if_num,
+ 			 NSS_WIFILI_WDS_PEER_MAP_MSG,
+@@ -4052,7 +4064,7 @@ int ath11k_nss_del_wds_peer(struct ath11
+ 	ether_addr_copy(wds_peer_msg->peer_mac, peer_addr);
+ 	ether_addr_copy(wds_peer_msg->dest_mac, dest_mac);
+ 
+-	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++	msg_cb = ath11k_nss_wifili_event_receive;
+ 
+ 	nss_cmn_msg_init(&wlmsg->cm, ab->nss.if_num,
+ 			 NSS_WIFILI_WDS_PEER_DEL_MSG,
+@@ -4366,7 +4378,7 @@ static int ath11k_nss_mesh_capability(st
+ 	if (!wlmsg)
+ 		return -ENOMEM;
+ 
+-	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++	msg_cb = ath11k_nss_wifili_event_receive;
+ 
+ 	reinit_completion(&ab->nss.complete);
+ 
+@@ -4483,7 +4495,7 @@ static int ath11k_nss_init(struct ath11k
+ 
+ 	/* register callbacks for events and exceptions with nss */
+ 	nss_contex = nss_register_wifili_if(ab->nss.if_num, NULL,
+-					    (nss_wifili_callback_t)ath11k_nss_wifili_ext_callback_fn,
++					    (nss_wifili_callback_t)ath11k_nss_wifili_ext_callback_wrapper,
+ 					    (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive,
+ 					    (struct net_device *)ab, features);
+ 
+@@ -4502,7 +4514,7 @@ static int ath11k_nss_init(struct ath11k
+ 	 */
+ 	ab->nss.ctx = nss_contex;
+ 
+-	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++	msg_cb = ath11k_nss_wifili_event_receive;
+ 
+ 	/* Initialize the common part of the wlmsg */
+ 	nss_cmn_msg_init(&wlmsg->cm, ab->nss.if_num,
+@@ -4574,7 +4586,7 @@ static int ath11k_nss_stats_cfg(struct a
+ 	stats_cfg = &wlmsg->msg.scm;
+ 	stats_cfg->cfg = enable;
+ 
+-	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++	msg_cb = ath11k_nss_wifili_event_receive;
+ 
+ 	nss_cmn_msg_init(&wlmsg->cm, ab->nss.if_num,
+ 			 nss_msg,
+@@ -4684,7 +4696,7 @@ int ath11k_nss_pdev_init(struct ath11k_b
+ 	refill_ring_id = ar->dp.rx_refill_buf_ring.refill_buf_ring.ring_id;
+ 	ath11k_nss_fill_srng_info(ab, refill_ring_id, &pdevmsg->rxdma_ring);
+ 
+-	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++	msg_cb = ath11k_nss_wifili_event_receive;
+ 
+ 	nss_cmn_msg_init(&wlmsg->cm, ab->nss.if_num,
+ 			 NSS_WIFILI_PDEV_INIT_MSG,
+@@ -4758,7 +4770,7 @@ int ath11k_nss_start(struct ath11k_base
+ 	if (!wlmsg)
+ 		return -ENOMEM;
+ 
+-	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++	msg_cb = ath11k_nss_wifili_event_receive;
+ 
+ 	/* Empty message for NSS Start message */
+ 	nss_cmn_msg_init(&wlmsg->cm, ab->nss.if_num,
+@@ -4816,7 +4828,7 @@ static void ath11k_nss_reset(struct ath1
+ 		return;
+ 	}
+ 
+-	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++	msg_cb = ath11k_nss_wifili_event_receive;
+ 
+ 	/* Empty message for NSS Reset message */
+ 	nss_cmn_msg_init(&wlmsg->cm, ab->nss.if_num,
+@@ -4869,7 +4881,7 @@ static int ath11k_nss_stop(struct ath11k
+ 	if (!wlmsg)
+ 		return -ENOMEM;
+ 
+-	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++	msg_cb = ath11k_nss_wifili_event_receive;
+ 
+ 	/* Empty message for Stop command */
+ 	nss_cmn_msg_init(&wlmsg->cm, ab->nss.if_num,
+@@ -4936,7 +4948,7 @@ int ath11k_nss_pdev_deinit(struct ath11k
+ 	deinit = &wlmsg->msg.pdevdeinit;
+ 	deinit->ifnum = radio_id;
+ 
+-	msg_cb = (nss_wifili_msg_callback_t)ath11k_nss_wifili_event_receive;
++	msg_cb = ath11k_nss_wifili_event_receive;
+ 
+ 	nss_cmn_msg_init(&wlmsg->cm, ab->nss.if_num,
+ 			 NSS_WIFILI_PDEV_DEINIT_MSG,

From 94250a62b034b723bab4ac9d9fc098b267ca84ac Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sun, 20 Oct 2024 04:50:21 -0400
Subject: [PATCH 212/225] ath10k-ct: fix incompatible pointer type

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../patches/999-800-ath10k-Add-threaded-napi.patch   | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/package/kernel/ath10k-ct/patches/999-800-ath10k-Add-threaded-napi.patch b/package/kernel/ath10k-ct/patches/999-800-ath10k-Add-threaded-napi.patch
index ebbea4f4132260..e2eff29bb459cd 100644
--- a/package/kernel/ath10k-ct/patches/999-800-ath10k-Add-threaded-napi.patch
+++ b/package/kernel/ath10k-ct/patches/999-800-ath10k-Add-threaded-napi.patch
@@ -4,7 +4,7 @@
  
  	ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot hif start\n");
  
-+	dev_set_threaded(&ar->napi_dev, true);
++	dev_set_threaded(ar->napi_dev, true);
  	ath10k_core_napi_enable(ar);
  
  	ath10k_pci_irq_enable(ar);
@@ -21,13 +21,13 @@
 --- a/ath10k-6.10/core.c
 +++ b/ath10k-6.10/core.c
 @@ -4576,6 +4576,10 @@ struct ath10k *ath10k_core_create(size_t
-	if (!ar->napi_dev)
-		goto err_free_tx_complete;
+ 	if (!ar->napi_dev)
+ 		goto err_free_tx_complete;
  
-+	snprintf(ar->napi_dev.name, sizeof(ar->napi_dev.name), "ath10k_%s",
++	snprintf(ar->napi_dev->name, sizeof(ar->napi_dev->name), "ath10k_%s",
 +		 wiphy_name(ar->hw->wiphy));
-+	dev_set_threaded(&ar->napi_dev, true);
++	dev_set_threaded(ar->napi_dev, true);
 +
  	ret = ath10k_coredump_create(ar);
  	if (ret)
-		goto err_free_netdev;
+ 		goto err_free_netdev;

From c5f63d103a0c92a0ce0817fab4f420863c0a9b06 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sun, 20 Oct 2024 04:52:06 -0400
Subject: [PATCH 213/225] qualcommax: set non-ct ath10k as default

The firmware for 'ct' does not support ethernet frames, which is
required for partial offload with mac80211

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 target/linux/qualcommax/image/ipq807x.mk | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/linux/qualcommax/image/ipq807x.mk b/target/linux/qualcommax/image/ipq807x.mk
index 60af8654593a46..760000ed3fab46 100644
--- a/target/linux/qualcommax/image/ipq807x.mk
+++ b/target/linux/qualcommax/image/ipq807x.mk
@@ -187,7 +187,7 @@ define Device/linksys_mx5300
 	$(call Device/linksys_mx)
 	DEVICE_MODEL := MX5300
 	DEVICE_PACKAGES += kmod-rtc-ds1307 ipq-wifi-linksys_mx5300 \
-		kmod-ath10k-ct ath10k-firmware-qca9984-ct
+		kmod-ath10k ath10k-firmware-qca9984
 endef
 TARGET_DEVICES += linksys_mx5300
 
@@ -368,7 +368,7 @@ define Device/xiaomi_ax3600
 	DEVICE_DTS_CONFIG := config@ac04
 	SOC := ipq8071
 	KERNEL_SIZE := 36608k
-	DEVICE_PACKAGES := ipq-wifi-xiaomi_ax3600 kmod-ath10k-ct-smallbuffers ath10k-firmware-qca9887-ct
+	DEVICE_PACKAGES := ipq-wifi-xiaomi_ax3600 kmod-ath10k-smallbuffers ath10k-firmware-qca9887
 ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
 	ARTIFACTS := initramfs-factory.ubi
 	ARTIFACT/initramfs-factory.ubi := append-image-stage initramfs-uImage.itb | ubinize-kernel
@@ -387,7 +387,7 @@ define Device/xiaomi_ax9000
 	SOC := ipq8072
 	KERNEL_SIZE := 57344k
 	DEVICE_PACKAGES := ipq-wifi-xiaomi_ax9000 kmod-ath11k-pci ath11k-firmware-qcn9074 \
-		kmod-ath10k-ct ath10k-firmware-qca9887-ct
+		kmod-ath10k ath10k-firmware-qca9887
 ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
 	ARTIFACTS := initramfs-factory.ubi
 	ARTIFACT/initramfs-factory.ubi := append-image-stage initramfs-uImage.itb | ubinize-kernel

From 45038db84dea6f8ff65827d3cca4bbf8e8e20ee0 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 19 Oct 2024 22:33:37 -0400
Subject: [PATCH 214/225] ath11k_nss: replace rcu_read_unlock with spin_unlock

Mistakenly edited the patch by hand thinking I had incorrectly imported
it from @BS.

Original patch was throwing
```
peer.c:572:1: error: label at end of compound statement is a C23 extension
```

Moved spin_unlocks into exit as that's what it would have been doing
anyways.

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../999-900-bss-transition-handling.patch     | 67 ++++++++++++-------
 1 file changed, 41 insertions(+), 26 deletions(-)

diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch b/package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch
index ab66b9306b138f..d7860ab3d012b9 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch
@@ -1722,7 +1722,7 @@
  		if (ab->nss.enabled && ar)
  			ath11k_nss_peer_create(ar, peer);
  	}
-@@ -552,21 +510,18 @@ void ath11k_peer_map_event(struct ath11k
+@@ -552,27 +510,23 @@ void ath11k_peer_map_event(struct ath11k
  
  exit:
  	spin_unlock_bh(&ab->base_lock);
@@ -1747,7 +1747,13 @@
  	if (!peer && !is_wds) {
  		peer = kzalloc(sizeof(*peer), GFP_ATOMIC);
  		if (!peer) {
-@@ -581,7 +536,7 @@ void ath11k_peer_map_v2_event(struct ath
+ 			ath11k_warn(ab, "failed to allocated peer for %pM vdev_id %d\n",
+ 				    mac_addr, vdev_id);
+-			spin_unlock_bh(&ab->base_lock);
+ 			goto exit;
+ 		}
+ 
+@@ -581,7 +535,7 @@ void ath11k_peer_map_v2_event(struct ath
  		peer->ast_hash = ast_hash;
  		peer->hw_peer_id = hw_peer_id;
  		ether_addr_copy(peer->addr, mac_addr);
@@ -1756,7 +1762,7 @@
  #ifdef CPTCFG_ATH11K_NSS_SUPPORT
  		INIT_LIST_HEAD(&peer->ast_entry_list);
  #endif
-@@ -593,11 +548,11 @@ void ath11k_peer_map_v2_event(struct ath
+@@ -593,11 +547,11 @@ void ath11k_peer_map_v2_event(struct ath
  				goto peer_free;
  			}
  		}
@@ -1770,11 +1776,20 @@
  
  	if (ab->nss.enabled && ar)
  		ath11k_peer_map_ast(ar, peer, mac_addr, hw_peer_id, ast_hash);
-@@ -614,23 +569,22 @@ peer_free:
+@@ -605,7 +559,6 @@ void ath11k_peer_map_v2_event(struct ath
+ 	ath11k_dbg(ab, ATH11K_DBG_DP_HTT, "htt peer map vdev %d peer %pM id %d is_wds %d\n",
+ 		   vdev_id, mac_addr, peer_id, is_wds);
+ 
+-	spin_unlock_bh(&ab->base_lock);
+ 	goto exit;
+ 
+ peer_free:
+@@ -614,23 +567,23 @@ peer_free:
  	ath11k_peer_delete(ar, vdev_id, mac_addr);
  	mutex_unlock(&ar->conf_mutex);
  exit:
 -	rcu_read_unlock();
++	spin_unlock_bh(&ab->base_lock);
  }
  
 -static int ath11k_wait_for_peer_common(struct ath11k_base *ab, int vdev_id,
@@ -1800,7 +1815,7 @@
  				}), 3 * HZ);
  
  	if (ret <= 0)
-@@ -639,7 +593,7 @@ static int ath11k_wait_for_peer_common(s
+@@ -639,7 +592,7 @@ static int ath11k_wait_for_peer_common(s
  	return 0;
  }
  
@@ -1809,7 +1824,7 @@
  					   struct rhashtable *rtbl,
  					   struct rhash_head *rhead,
  					   struct rhashtable_params *params,
-@@ -647,7 +601,7 @@ static inline int ath11k_peer_rhash_inse
+@@ -647,7 +600,7 @@ static inline int ath11k_peer_rhash_inse
  {
  	struct ath11k_peer *tmp;
  
@@ -1818,7 +1833,7 @@
  
  	tmp = rhashtable_lookup_get_insert_fast(rtbl, rhead, *params);
  
-@@ -659,14 +613,14 @@ static inline int ath11k_peer_rhash_inse
+@@ -659,14 +612,14 @@ static inline int ath11k_peer_rhash_inse
  		return -EEXIST;
  }
  
@@ -1835,7 +1850,7 @@
  
  	ret = rhashtable_remove_fast(rtbl, rhead, *params);
  	if (ret && ret != -ENOENT)
-@@ -675,26 +629,27 @@ static inline int ath11k_peer_rhash_remo
+@@ -675,26 +628,27 @@ static inline int ath11k_peer_rhash_remo
  	return 0;
  }
  
@@ -1870,7 +1885,7 @@
  	if (ret) {
  		ath11k_warn(ab, "failed to add peer %pM with id %d in rhash_addr ret %d\n",
  			    peer->addr, peer->peer_id, ret);
-@@ -704,8 +659,8 @@ static int ath11k_peer_rhash_add(struct
+@@ -704,8 +658,8 @@ static int ath11k_peer_rhash_add(struct
  	return 0;
  
  err_clean:
@@ -1881,7 +1896,7 @@
  	return ret;
  }
  
-@@ -723,9 +678,9 @@ void ath11k_peer_cleanup(struct ath11k *
+@@ -723,9 +677,9 @@ void ath11k_peer_cleanup(struct ath11k *
  	mutex_lock(&ab->base_ast_lock);
  #endif
  
@@ -1893,7 +1908,7 @@
  		if (peer->vdev_id != vdev_id)
  			continue;
  
-@@ -743,14 +698,14 @@ void ath11k_peer_cleanup(struct ath11k *
+@@ -743,14 +697,14 @@ void ath11k_peer_cleanup(struct ath11k *
  			ath11k_peer_del_ast(ar, ast_entry);
  #endif
  
@@ -1910,7 +1925,7 @@
  #ifdef CPTCFG_ATH11K_NSS_SUPPORT
  	mutex_unlock(&ab->base_ast_lock);
  #endif
-@@ -758,25 +713,26 @@ void ath11k_peer_cleanup(struct ath11k *
+@@ -758,25 +712,26 @@ void ath11k_peer_cleanup(struct ath11k *
  
  static int ath11k_wait_for_peer_deleted(struct ath11k *ar, int vdev_id, const u8 *addr)
  {
@@ -1940,7 +1955,7 @@
  		return -ETIMEDOUT;
  	}
  
-@@ -795,26 +751,22 @@ static int __ath11k_peer_delete(struct a
+@@ -795,26 +750,22 @@ static int __ath11k_peer_delete(struct a
  	lockdep_assert_held(&ar->conf_mutex);
  
  	reinit_completion(&ar->peer_delete_done);
@@ -1974,7 +1989,7 @@
  
  		ath11k_warn(ab,
  			    "failed to find peer vdev_id %d addr %pM in delete\n",
-@@ -835,18 +787,18 @@ static int __ath11k_peer_delete(struct a
+@@ -835,18 +786,18 @@ static int __ath11k_peer_delete(struct a
  			if ((ast_entry->type == ATH11K_AST_TYPE_WDS) ||
  			    (ast_entry->type == ATH11K_AST_TYPE_MEC)) {
  				if (!list_empty(&ast_entry->wmi_list)) {
@@ -1996,7 +2011,7 @@
  
  #ifdef CPTCFG_ATH11K_NSS_SUPPORT
  	mutex_unlock(&ab->base_ast_lock);
-@@ -884,7 +836,7 @@ int ath11k_peer_delete(struct ath11k *ar
+@@ -884,7 +835,7 @@ int ath11k_peer_delete(struct ath11k *ar
  
  static int ath11k_wait_for_peer_created(struct ath11k *ar, int vdev_id, const u8 *addr)
  {
@@ -2005,7 +2020,7 @@
  }
  
  int ath11k_peer_create(struct ath11k *ar, struct ath11k_vif *arvif,
-@@ -892,38 +844,41 @@ int ath11k_peer_create(struct ath11k *ar
+@@ -892,38 +843,41 @@ int ath11k_peer_create(struct ath11k *ar
  {
  	struct ath11k_peer *peer;
  	struct ieee80211_vif *vif = arvif->vif;
@@ -2064,7 +2079,7 @@
  			    "failed to send peer create vdev_id %d ret %d\n",
  			    param->vdev_id, ret);
  		return ret;
-@@ -934,24 +889,23 @@ int ath11k_peer_create(struct ath11k *ar
+@@ -934,24 +888,23 @@ int ath11k_peer_create(struct ath11k *ar
  	if (ret)
  		return ret;
  
@@ -2098,7 +2113,7 @@
  		goto cleanup;
  	}
  
-@@ -968,7 +922,7 @@ int ath11k_peer_create(struct ath11k *ar
+@@ -968,7 +921,7 @@ int ath11k_peer_create(struct ath11k *ar
  	peer->vif = arvif->vif;
  
  #ifdef CPTCFG_ATH11K_NSS_SUPPORT
@@ -2107,7 +2122,7 @@
  		ar->bss_peer = peer;
  	else
  		ar->bss_peer = NULL;
-@@ -986,40 +940,41 @@ int ath11k_peer_create(struct ath11k *ar
+@@ -986,40 +939,41 @@ int ath11k_peer_create(struct ath11k *ar
  
  	ar->num_peers++;
  
@@ -2159,7 +2174,7 @@
  	if (ret) {
  		ath11k_warn(ab, "failed to remove peer %pM id %d in rhash_id ret %d\n",
  			    peer->addr, peer->peer_id, ret);
-@@ -1029,19 +984,20 @@ int ath11k_peer_rhash_delete(struct ath1
+@@ -1029,19 +983,20 @@ int ath11k_peer_rhash_delete(struct ath1
  	return 0;
  }
  
@@ -2184,7 +2199,7 @@
  	rhash_id_tbl = kzalloc(size, GFP_KERNEL);
  	if (!rhash_id_tbl) {
  		ath11k_warn(ab, "failed to init rhash id table due to no mem (size %zu)\n",
-@@ -1049,13 +1005,13 @@ static int ath11k_peer_rhash_id_tbl_init
+@@ -1049,13 +1004,13 @@ static int ath11k_peer_rhash_id_tbl_init
  		return -ENOMEM;
  	}
  
@@ -2200,7 +2215,7 @@
  
  	ret = rhashtable_init(rhash_id_tbl, param);
  	if (ret) {
-@@ -1063,10 +1019,10 @@ static int ath11k_peer_rhash_id_tbl_init
+@@ -1063,10 +1018,10 @@ static int ath11k_peer_rhash_id_tbl_init
  		goto err_free;
  	}
  
@@ -2214,7 +2229,7 @@
  	} else {
  		spin_unlock_bh(&ab->base_lock);
  		goto cleanup_tbl;
-@@ -1084,19 +1040,20 @@ err_free:
+@@ -1084,19 +1039,20 @@ err_free:
  	return ret;
  }
  
@@ -2239,7 +2254,7 @@
  	rhash_addr_tbl = kzalloc(size, GFP_KERNEL);
  	if (!rhash_addr_tbl) {
  		ath11k_warn(ab, "failed to init rhash addr table due to no mem (size %zu)\n",
-@@ -1104,13 +1061,13 @@ static int ath11k_peer_rhash_addr_tbl_in
+@@ -1104,13 +1060,13 @@ static int ath11k_peer_rhash_addr_tbl_in
  		return -ENOMEM;
  	}
  
@@ -2255,7 +2270,7 @@
  
  	ret = rhashtable_init(rhash_addr_tbl, param);
  	if (ret) {
-@@ -1118,10 +1075,10 @@ static int ath11k_peer_rhash_addr_tbl_in
+@@ -1118,10 +1074,10 @@ static int ath11k_peer_rhash_addr_tbl_in
  		goto err_free;
  	}
  
@@ -2269,7 +2284,7 @@
  	} else {
  		spin_unlock_bh(&ab->base_lock);
  		goto cleanup_tbl;
-@@ -1139,61 +1096,61 @@ err_free:
+@@ -1139,61 +1095,61 @@ err_free:
  	return ret;
  }
  

From 92b1fd0ad5001824512e50242de7eb24b1b05f44 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Mon, 21 Oct 2024 19:04:53 -0400
Subject: [PATCH 215/225] nss-setup: Initial README for examples

Initial README for the example scripts/configs. Right now it's only for
VLAN setup.

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 nss-setup/example/README.md | 217 ++++++++++++++++++++++++++++++++++++
 1 file changed, 217 insertions(+)
 create mode 100644 nss-setup/example/README.md

diff --git a/nss-setup/example/README.md b/nss-setup/example/README.md
new file mode 100644
index 00000000000000..4df517f6cd9f85
--- /dev/null
+++ b/nss-setup/example/README.md
@@ -0,0 +1,217 @@
+---
+# **Configuring VLANs with OpenWRT on NSS-Enabled Devices**
+## **Important Note:** No VLAN Filtering for NSS Devices
+
+For **NSS setups**, you **cannot** enable VLAN filtering directly because **NSS handles VLAN internally** through the module `kmod-qca-nss-drv-vlan-mgr`.
+Enabling VLAN filtering via the standard method will interfere with the NSS. To check whether it's enabled, follow the steps below.
+---
+
+### 1. **Check if VLAN Filtering is Enabled**
+Run the following command to check if VLAN filtering is active:
+```vim
+uci show network | grep vlan_filtering
+```
+If you see a line like this:
+```vim
+network.@device[0].vlan_filtering='1'
+```
+VLAN filtering is enabled and you need to **disable it**. Follow the next steps.
+
+### 2. **Disable VLAN Filtering**
+## **VLAN Tagging Restrictions**
+To disable VLAN filtering, run:
+```vim
+uci del 'network.@device[0].vlan_filtering'
+uci commit network
+service network restart
+```
+Alternatively, you can reboot your device to apply the changes:
+```vim
+reboot
+```
+---
+## **VLAN Tagging Restrictions**
+
+NSS does not support VLAN tagging in the usual way. This means **you can't use tags like `u*` (untagged) or `t` (tagged)** in your configuration.
+
+**Example of what to avoid**:
+```bash
+list ports 'lan1:u*'
+list ports 'lan2:t'
+list ports 'lan3:t'
+```
+---
+
+## **How to Set Up VLANs on NSS-Enabled Devices**
+
+Instead of tagging, you'll need to follow a different approach. Here's a step-by-step process:
+
+1. **Set up VLANs on specific ports.**
+2. **Bridge these VLANs into interfaces** (you can leave them **unmanaged** if needed).
+3. **Create firewall rules** to manage traffic between VLANs.
+
+---
+
+## **Example VLAN Setup**
+
+Below is an example of how you can configure your VLANs on an OpenWRT router with **NSS support**. This setup includes:
+
+- A **Primary Network** on VLAN 10 (untagged).
+- A **Guest Network** on VLAN 30.
+- An **IoT Network** on VLAN 40.
+
+### **Network Configuration**
+This is an example of `/etc/config/network`:
+```vim
+config interface 'loopback'
+    option device 'lo'
+    option proto 'static'
+    option ipaddr '127.0.0.1'
+    option netmask '255.0.0.0'
+
+config globals 'globals'
+    option ula_prefix 'fd32:aa0c:9a35::/48'
+
+config device
+    option name 'br-lan'
+    option type 'bridge'
+    list ports 'lan1'
+    list ports 'lan2'
+    list ports 'lan3'
+    list ports 'lan4'
+    list ports 'wan'
+    option igmp_snooping '1'
+
+config device
+    option name 'lan1'
+    option macaddr 'AA:BB:CC:DD:EE:FF'
+
+config device
+    option name 'lan2'
+    option macaddr 'AA:BB:CC:DD:EE:FF'
+
+config device
+    option name 'lan3'
+    option macaddr 'AA:BB:CC:DD:EE:FF'
+
+config device
+    option name 'lan4'
+    option macaddr 'AA:BB:CC:DD:EE:FF'
+
+config interface 'lan'
+    option device 'br-lan'
+    option proto 'static'
+    option ip6assign '60'
+    list ipaddr '192.168.1.1/24'
+    option force_link '0'
+
+config device
+    option type '8021q'
+    option ifname 'wan'
+    option vid '30'
+    option name 'wan.30'
+
+config device
+    option type '8021q'
+    option ifname 'wan'
+    option vid '40'
+    option name 'wan.40'
+
+config device
+    option type 'bridge'
+    option name 'br-iot'
+    list ports 'wan.40'
+    option igmp_snooping '1'
+
+config device
+    option type 'bridge'
+    option name 'br-guest'
+    list ports 'wan.30'
+    option igmp_snooping '1'
+
+config interface 'guest'
+    option proto 'none'
+    option device 'br-guest'
+
+config interface 'iot'
+    option proto 'none'
+    option device 'br-iot'
+```
+### **Explanation**
+
+- **Primary Network (VLAN 10)**: Connected through the LAN ports, untagged.
+- **Guest Network (VLAN 30)**: Runs on a bridge called `br-guest` and spans across the **WAN** port tagged with VLAN ID 30.
+- **IoT Network (VLAN 40)**: Runs on a bridge called `br-iot` and uses VLAN ID 40 on the **WAN** port.
+---
+
+## **WiFi Configuration**
+
+Here is an example of how to configure the WiFi interfaces for different networks in `/etc/config/wireless`:
+```vim
+config wifi-iface 'default_radio0'
+    option device 'radio0'
+    option mode 'ap'
+    option network 'lan'
+    option ssid 'OpenWrt'
+    option encryption 'psk2'
+    option key '********'
+    option ocv '0'
+    option bss_transition '1'
+    option dtim_period '3'
+
+config wifi-iface 'guest'
+    option device 'radio0'
+    option mode 'ap'
+    option network 'br-guest'
+    option ssid 'OpenWrt-Guest'
+    option encryption 'psk2'
+    option key '********'
+    option ocv '0'
+    option bss_transition '1'
+    option dtim_period '3'
+
+config wifi-iface 'iot'
+    option device 'radio0'
+    option mode 'ap'
+    option network 'br-iot'
+    option ssid 'OpenWrt-IoT'
+    option encryption 'psk2'
+    option key '********'
+    option ocv '0'
+    option bss_transition '1'
+    option dtim_period '3'
+```
+### **Explanation**
+
+- **LAN WiFi**: The `default_radio0` interface is associated with the **Primary Network** on **VLAN 10**.
+- **Guest WiFi**: The `guest` interface is associated with the **Guest Network** on **VLAN 30**.
+- **IoT WiFi**: The `iot` interface is associated with the **IoT Network** on **VLAN 40**.
+---
+
+## **Advanced VLAN Setup for DMZ**
+To create a DMZ using **VLAN 30** on **LAN ports 3 and 4**, you can modify your configuration like this:
+```vim
+config device
+    option name 'br-lan'
+    option type 'bridge'
+    list ports 'lan1'
+    list ports 'lan2'
+    list ports 'wan'
+
+config device
+    option type '8021q'
+    option ifname 'wan'
+    option vid '30'
+    option name 'dmz.30'
+
+config device
+    option type 'bridge'
+    option name 'br-dmz'
+    list ports 'dmz.30'
+    list ports 'lan3'
+    list ports 'lan4'
+
+config interface 'dmz'
+    option proto 'none'
+    option device 'br-dmz'
+```

From 36bdb676c2f836c15c11378b0ed8ed4fae520e4b Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Fri, 25 Oct 2024 02:58:55 -0400
Subject: [PATCH 216/225] ath11k_nss: Rebase against 87033c3

Rebased against upstream commit 87033
mac80211: improve single-wiphy multi-radio support

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 ...-when-using-encapsulation-offloading.patch |  2 +-
 .../199-001-mac80211-add-nss-support.patch    | 34 ++++++-------
 ...t-callback-when-hwencap-enable-in-st.patch |  2 +-
 ...03-mac80211-ath11k-fw-dynamic-muedca.patch | 20 ++++----
 ...-ath11k-Add-support-for-dynamic-vlan.patch |  4 +-
 ...07-mac80211-add-nss-redirect-support.patch | 16 +++---
 ...N-iftype-support-on-NSS-offload-case.patch | 43 ++++++++--------
 ...-dynamic-VLAN-support-on-NSS-offload.patch | 10 ++--
 .../nss/subsys/245-compilation_fix.patch      | 10 ++--
 .../300-ath11k-nss-mesh-offload-support.patch | 38 +++++++-------
 ...TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch |  6 +--
 ...-0005-mac80211-simple-tx-for-AP-mode.patch |  4 +-
 .../336-mac80211-Mesh-Fast-rx-support.patch   | 14 +++---
 ...mac80211-fix-unconditional-sta-usage.patch |  4 +-
 ...rning-with-monitor-interface-restart.patch |  2 +-
 ...unused-RX_FLAGS-from-mac80211_rx_fla.patch | 49 +------------------
 ...ncapsulation-of-EAPOL-frames-if-OFFL.patch | 24 ++++-----
 ...fix-RCU-stall-in-mesh-fast-xmit-path.patch |  2 +-
 ...se-HW-checksum-offload-only-for-ethm.patch | 12 ++---
 ...1-Add-mac-hw-flag-to-avoid-queue-skb.patch | 16 +++---
 .../829-mac80211-fix-mesh-ping-issue.patch    |  8 +--
 ...75-wifi-mac80211-Changes-for-WDS-MLD.patch | 26 +++++-----
 ...x-NULL-pointer-access-Klocwork-issue.patch |  8 +--
 23 files changed, 155 insertions(+), 199 deletions(-)

diff --git a/package/kernel/mac80211/patches/nss/subsys/146-mac80211-enable-TKIP-when-using-encapsulation-offloading.patch b/package/kernel/mac80211/patches/nss/subsys/146-mac80211-enable-TKIP-when-using-encapsulation-offloading.patch
index 65b94504309c35..7d896ac65442aa 100644
--- a/package/kernel/mac80211/patches/nss/subsys/146-mac80211-enable-TKIP-when-using-encapsulation-offloading.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/146-mac80211-enable-TKIP-when-using-encapsulation-offloading.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4715,8 +4715,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4717,8 +4717,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  	if (!key)
  		key = rcu_dereference(sdata->default_unicast_key);
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch b/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch
index a1a39556d3dbcc..9325a083e4683e 100644
--- a/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch
@@ -64,7 +64,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  };
  
  /**
-@@ -1485,7 +1501,7 @@ ieee80211_tx_info_clear_status(struct ie
+@@ -1483,7 +1499,7 @@ ieee80211_tx_info_clear_status(struct ie
   * @RX_FLAG_AMPDU_EOF_BIT_KNOWN: The EOF value is known
   * @RX_FLAG_RADIOTAP_HE: HE radiotap data is present
   *	(&struct ieee80211_radiotap_he, mac80211 will fill in
@@ -73,7 +73,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   *	 - DATA3_DATA_MCS
   *	 - DATA3_DATA_DCM
   *	 - DATA3_CODING
-@@ -1493,7 +1509,7 @@ ieee80211_tx_info_clear_status(struct ie
+@@ -1491,7 +1507,7 @@ ieee80211_tx_info_clear_status(struct ie
   *	 - DATA5_DATA_BW_RU_ALLOC
   *	 - DATA6_NSTS
   *	 - DATA3_STBC
@@ -82,7 +82,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   *	from the RX info data, so leave those zeroed when building this data)
   * @RX_FLAG_RADIOTAP_HE_MU: HE MU radiotap data is present
   *	(&struct ieee80211_radiotap_he_mu)
-@@ -2128,6 +2144,16 @@ static inline bool lockdep_vif_wiphy_mut
+@@ -2124,6 +2140,16 @@ static inline bool lockdep_vif_wiphy_mut
  			      lockdep_vif_wiphy_mutex_held(vif))
  
  /**
@@ -99,7 +99,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   * enum ieee80211_key_flags - key flags
   *
   * These flags are used for communication about keys between the driver
-@@ -2826,6 +2852,8 @@ struct ieee80211_txq {
+@@ -2827,6 +2853,8 @@ struct ieee80211_txq {
   *	implements MLO, so operation can continue on other links when one
   *	link is switching.
   *
@@ -108,7 +108,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
   */
  enum ieee80211_hw_flags {
-@@ -2885,6 +2913,7 @@ enum ieee80211_hw_flags {
+@@ -2887,6 +2915,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_DISALLOW_PUNCTURING,
  	IEEE80211_HW_DISALLOW_PUNCTURING_5GHZ,
  	IEEE80211_HW_HANDLES_QUIET_CSA,
@@ -116,7 +116,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	/* keep last, obviously */
  	NUM_IEEE80211_HW_FLAGS
-@@ -3900,6 +3929,10 @@ struct ieee80211_prep_tx_info {
+@@ -3902,6 +3931,10 @@ struct ieee80211_prep_tx_info {
   *	non-MLO connections.
   *	The callback can sleep.
   *
@@ -127,7 +127,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   * @prepare_multicast: Prepare for multicast filter configuration.
   *	This callback is optional, and its return value is passed
   *	to configure_filter(). This callback must be atomic.
-@@ -4462,7 +4495,9 @@ struct ieee80211_ops {
+@@ -4464,7 +4497,9 @@ struct ieee80211_ops {
  				  struct ieee80211_vif *vif,
  				  struct ieee80211_bss_conf *info,
  				  u64 changed);
@@ -138,7 +138,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	int (*start_ap)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			struct ieee80211_bss_conf *link_conf);
  	void (*stop_ap)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-@@ -4772,7 +4807,7 @@ struct ieee80211_ops {
+@@ -4774,7 +4809,7 @@ struct ieee80211_ops {
  	int (*reset_tid_config)(struct ieee80211_hw *hw,
  				struct ieee80211_vif *vif,
  				struct ieee80211_sta *sta, u8 tids);
@@ -149,7 +149,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  			      struct ieee80211_sta *sta, bool enabled);
 --- a/net/mac80211/debugfs.c
 +++ b/net/mac80211/debugfs.c
-@@ -508,6 +508,7 @@ static const char *hw_flag_names[] = {
+@@ -509,6 +509,7 @@ static const char *hw_flag_names[] = {
  	FLAG(DISALLOW_PUNCTURING),
  	FLAG(DISALLOW_PUNCTURING_5GHZ),
  	FLAG(HANDLES_QUIET_CSA),
@@ -159,7 +159,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
 --- a/net/mac80211/util.c
 +++ b/net/mac80211/util.c
-@@ -874,6 +874,22 @@ struct wireless_dev *ieee80211_vif_to_wd
+@@ -875,6 +875,22 @@ struct wireless_dev *ieee80211_vif_to_wd
  }
  EXPORT_SYMBOL_GPL(ieee80211_vif_to_wdev);
  
@@ -272,7 +272,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		ac = skb_get_queue_mapping(skb);
  		tx->sta->deflink.tx_stats.bytes[ac] += skb->len;
  	}
-@@ -2876,7 +2888,9 @@ static struct sk_buff *ieee80211_build_h
+@@ -2877,7 +2889,9 @@ static struct sk_buff *ieee80211_build_h
  	if (unlikely(!multicast &&
  		     ((skb->sk &&
  		       skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS) ||
@@ -283,7 +283,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		info_id = ieee80211_store_ack_skb(local, skb, &info_flags,
  						  cookie);
  
-@@ -4665,7 +4679,8 @@ static void ieee80211_8023_xmit(struct i
+@@ -4667,7 +4681,8 @@ static void ieee80211_8023_xmit(struct i
  	}
  
  	if (unlikely(skb->sk &&
@@ -293,7 +293,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		info->status_data = ieee80211_store_ack_skb(local, skb,
  							    &info->flags, NULL);
  		if (info->status_data)
-@@ -4673,8 +4688,10 @@ static void ieee80211_8023_xmit(struct i
+@@ -4675,8 +4690,10 @@ static void ieee80211_8023_xmit(struct i
  	}
  
  	dev_sw_netstats_tx_add(dev, skbs, len);
@@ -320,7 +320,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  				gfp);
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2695,7 +2695,7 @@ static int ieee80211_change_bss(struct w
+@@ -2704,7 +2704,7 @@ static int ieee80211_change_bss(struct w
  	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	struct ieee80211_link_data *link;
  	struct ieee80211_supported_band *sband;
@@ -329,7 +329,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	link = ieee80211_link_or_deflink(sdata, params->link_id, true);
  	if (IS_ERR(link))
-@@ -2745,6 +2745,8 @@ static int ieee80211_change_bss(struct w
+@@ -2754,6 +2754,8 @@ static int ieee80211_change_bss(struct w
  			sdata->flags |= IEEE80211_SDATA_DONT_BRIDGE_PACKETS;
  		else
  			sdata->flags &= ~IEEE80211_SDATA_DONT_BRIDGE_PACKETS;
@@ -338,7 +338,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  		ieee80211_check_fast_rx_iface(sdata);
  	}
  
-@@ -2773,6 +2775,8 @@ static int ieee80211_change_bss(struct w
+@@ -2782,6 +2784,8 @@ static int ieee80211_change_bss(struct w
  
  	ieee80211_link_info_change_notify(sdata, link, changed);
  
@@ -427,7 +427,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	TP_PROTO(struct ieee80211_local *local,
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -984,7 +984,8 @@ static bool ieee80211_set_sdata_offload_
+@@ -991,7 +991,8 @@ static bool ieee80211_set_sdata_offload_
  		    local->hw.wiphy->frag_threshold != (u32)-1)
  			flags &= ~IEEE80211_OFFLOAD_ENCAP_ENABLED;
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/199-mac80211-fix-xmit-callback-when-hwencap-enable-in-st.patch b/package/kernel/mac80211/patches/nss/subsys/199-mac80211-fix-xmit-callback-when-hwencap-enable-in-st.patch
index 7ae59db8cf1c07..713ed77c750568 100644
--- a/package/kernel/mac80211/patches/nss/subsys/199-mac80211-fix-xmit-callback-when-hwencap-enable-in-st.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/199-mac80211-fix-xmit-callback-when-hwencap-enable-in-st.patch
@@ -18,7 +18,7 @@ Signed-off-by: P Praneesh <ppranees@codeaurora.org>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -6260,7 +6260,13 @@ int ieee80211_tx_control_port(struct wip
+@@ -6262,7 +6262,13 @@ int ieee80211_tx_control_port(struct wip
  
  start_xmit:
  	local_bh_disable();
diff --git a/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch b/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
index c5e8e2704869b1..fdd9f709c9a177 100644
--- a/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
@@ -31,7 +31,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
 
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -9701,4 +9701,15 @@ ssize_t wiphy_locked_debugfs_write(struc
+@@ -9722,4 +9722,15 @@ ssize_t wiphy_locked_debugfs_write(struc
  				   void *data);
  #endif
  
@@ -49,7 +49,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  #endif /* __NET_CFG80211_H */
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -7561,6 +7561,20 @@ u32 ieee80211_calc_rx_airtime(struct iee
+@@ -7563,6 +7563,20 @@ u32 ieee80211_calc_rx_airtime(struct iee
  			      int len);
  
  /**
@@ -91,18 +91,18 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  	/* add new commands above here */
  
  	/* used to define NL80211_CMD_MAX below */
-@@ -2868,6 +2873,8 @@ enum nl80211_commands {
-  *	nested item, it contains attributes defined in
-  *	&enum nl80211_if_combination_attrs.
+@@ -2871,6 +2876,8 @@ enum nl80211_commands {
+  * @NL80211_ATTR_VIF_RADIO_MASK: Bitmask of allowed radios (u32).
+  *	A value of 0 means all radios.
   *
 + * @NL80211_ATTR_HE_MUEDCA_PARAMS: MU-EDCA AC parameters for the
 + *	%NL80211_CMD_UPDATE_HE_MUEDCA_PARAMS command.
   * @NUM_NL80211_ATTR: total number of nl80211_attrs available
   * @NL80211_ATTR_MAX: highest attribute number currently defined
   * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -3416,6 +3423,8 @@ enum nl80211_attrs {
- 	NL80211_ATTR_WIPHY_RADIOS,
- 	NL80211_ATTR_WIPHY_INTERFACE_COMBINATIONS,
+@@ -3421,6 +3428,8 @@ enum nl80211_attrs {
+ 
+ 	NL80211_ATTR_VIF_RADIO_MASK,
  
 +	NL80211_ATTR_HE_MUEDCA_PARAMS,
 +
@@ -166,7 +166,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  	[NL80211_ATTR_BSS_DUMP_INCLUDE_USE_DATA] = { .type = NLA_FLAG },
  	[NL80211_ATTR_MLO_TTLM_DLINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
  	[NL80211_ATTR_MLO_TTLM_ULINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
-@@ -20396,6 +20397,42 @@ void cfg80211_schedule_channels_check(st
+@@ -20446,6 +20447,42 @@ void cfg80211_schedule_channels_check(st
  }
  EXPORT_SYMBOL(cfg80211_schedule_channels_check);
  
@@ -211,7 +211,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  int __init nl80211_init(void)
 --- a/net/wireless/trace.h
 +++ b/net/wireless/trace.h
-@@ -3975,6 +3975,46 @@ TRACE_EVENT(cfg80211_update_owe_info_eve
+@@ -3977,6 +3977,46 @@ TRACE_EVENT(cfg80211_update_owe_info_eve
  		  __entry->assoc_link_id, __entry->peer_mld_addr)
  );
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/207-ath11k-Add-support-for-dynamic-vlan.patch b/package/kernel/mac80211/patches/nss/subsys/207-ath11k-Add-support-for-dynamic-vlan.patch
index 03d6e9db15bc60..18470318f1a68d 100644
--- a/package/kernel/mac80211/patches/nss/subsys/207-ath11k-Add-support-for-dynamic-vlan.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/207-ath11k-Add-support-for-dynamic-vlan.patch
@@ -29,7 +29,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  /* misc utils */
  
  static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
-@@ -4292,6 +4295,8 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4294,6 +4297,8 @@ void __ieee80211_subif_start_xmit(struct
  	struct sta_info *sta;
  	struct sk_buff *next;
  	int len = skb->len;
@@ -38,7 +38,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  
  	if (unlikely(!ieee80211_sdata_running(sdata) || skb->len < ETH_HLEN)) {
  		kfree_skb(skb);
-@@ -4313,6 +4318,19 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4315,6 +4320,19 @@ void __ieee80211_subif_start_xmit(struct
  	if (IS_ERR(sta))
  		sta = NULL;
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch b/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
index 63b2f9e9546d6a..f462df6248b8f8 100644
--- a/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
@@ -65,7 +65,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  /**
   * DOC: Interface list locking
   *
-@@ -774,6 +780,13 @@ static int ieee80211_stop(struct net_dev
+@@ -781,6 +787,13 @@ static int ieee80211_stop(struct net_dev
  		ieee80211_stop_mbssid(sdata);
  	}
  
@@ -79,7 +79,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	wiphy_lock(sdata->local->hw.wiphy);
  	wiphy_work_cancel(sdata->local->hw.wiphy, &sdata->activate_links_work);
  
-@@ -1219,6 +1232,34 @@ void ieee80211_del_virtual_monitor(struc
+@@ -1232,6 +1245,34 @@ void ieee80211_del_virtual_monitor(struc
  	kfree(sdata);
  }
  
@@ -114,7 +114,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  /*
   * NOTE: Be very careful when changing this function, it must NOT return
   * an error on interface type changes that have been pre-checked, so most
-@@ -1446,6 +1487,21 @@ int ieee80211_do_open(struct wireless_de
+@@ -1460,6 +1501,21 @@ int ieee80211_do_open(struct wireless_de
  
  	ieee80211_recalc_ps(local);
  
@@ -138,7 +138,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	return 0;
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -2606,6 +2606,60 @@ static bool ieee80211_frame_allowed(stru
+@@ -2613,6 +2613,60 @@ static bool ieee80211_frame_allowed(stru
  	return true;
  }
  
@@ -199,7 +199,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  static void ieee80211_deliver_skb_to_local_stack(struct sk_buff *skb,
  						 struct ieee80211_rx_data *rx)
  {
-@@ -2645,11 +2699,15 @@ static void ieee80211_deliver_skb_to_loc
+@@ -2652,11 +2706,15 @@ static void ieee80211_deliver_skb_to_loc
  			     !ether_addr_equal(ehdr->h_dest, sdata->vif.addr)))
  			ether_addr_copy(ehdr->h_dest, sdata->vif.addr);
  
@@ -217,7 +217,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4525,6 +4525,35 @@ static void ieee80211_mlo_multicast_tx(s
+@@ -4527,6 +4527,35 @@ static void ieee80211_mlo_multicast_tx(s
  	kfree_skb(skb);
  }
  
@@ -253,7 +253,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  /**
   * ieee80211_subif_start_xmit - netif start_xmit function for 802.3 vifs
   * @skb: packet to be sent
-@@ -4540,6 +4569,10 @@ netdev_tx_t ieee80211_subif_start_xmit(s
+@@ -4542,6 +4571,10 @@ netdev_tx_t ieee80211_subif_start_xmit(s
  	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	const struct ethhdr *eth = (void *)skb->data;
  
@@ -264,7 +264,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	if (likely(!is_multicast_ether_addr(eth->h_dest)))
  		goto normal;
  
-@@ -4729,6 +4762,9 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4731,6 +4764,9 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  	struct ieee80211_key *key;
  	struct sta_info *sta;
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch b/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
index 92f6c120a63320..86c9c37333a0d0 100644
--- a/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
@@ -21,7 +21,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -5271,6 +5271,17 @@ void ieee80211_sta_pspoll(struct ieee802
+@@ -5273,6 +5273,17 @@ void ieee80211_sta_pspoll(struct ieee802
   */
  void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *sta, u8 tid);
  
@@ -41,7 +41,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
   * This is enough for the radiotap header.
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2208,7 +2208,13 @@ static int ieee80211_change_station(stru
+@@ -2217,7 +2217,13 @@ static int ieee80211_change_station(stru
  
  			rcu_assign_pointer(vlansdata->u.vlan.sta, sta);
  			__ieee80211_check_fast_rx_iface(vlansdata);
@@ -58,7 +58,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		if (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
 --- a/net/mac80211/driver-ops.c
 +++ b/net/mac80211/driver-ops.c
-@@ -62,10 +62,9 @@ int drv_add_interface(struct ieee80211_l
+@@ -62,11 +62,10 @@ int drv_add_interface(struct ieee80211_l
  	might_sleep();
  	lockdep_assert_wiphy(local->hw.wiphy);
  
@@ -66,6 +66,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 -		    (sdata->vif.type == NL80211_IFTYPE_MONITOR &&
 +	if (WARN_ON(sdata->vif.type == NL80211_IFTYPE_MONITOR &&
  		     !ieee80211_hw_check(&local->hw, WANT_MONITOR_VIF) &&
+ 		     !ieee80211_hw_check(&local->hw, NO_VIRTUAL_MONITOR) &&
 -		     !(sdata->u.mntr.flags & MONITOR_FLAG_ACTIVE))))
 +		     !(sdata->u.mntr.flags & MONITOR_FLAG_ACTIVE)))
  		return -EINVAL;
@@ -73,7 +74,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	trace_drv_add_interface(local, sdata);
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -697,6 +697,9 @@ static void ieee80211_do_stop(struct iee
+@@ -702,6 +702,9 @@ static void ieee80211_do_stop(struct iee
  
  	switch (sdata->vif.type) {
  	case NL80211_IFTYPE_AP_VLAN:
@@ -83,7 +84,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		break;
  	case NL80211_IFTYPE_MONITOR:
  		if (local->monitors == 0)
-@@ -975,6 +978,7 @@ static bool ieee80211_iftype_supports_hd
+@@ -982,6 +985,7 @@ static bool ieee80211_iftype_supports_hd
  	switch (iftype) {
  	/* P2P GO and client are mapped to AP/STATION types */
  	case NL80211_IFTYPE_AP:
@@ -91,7 +92,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	case NL80211_IFTYPE_STATION:
  		return true;
  	default:
-@@ -1029,7 +1033,8 @@ static void ieee80211_set_vif_encap_ops(
+@@ -1036,7 +1040,8 @@ static void ieee80211_set_vif_encap_ops(
  	struct ieee80211_sub_if_data *bss = sdata;
  	bool enabled;
  
@@ -101,7 +102,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		if (!sdata->bss)
  			return;
  
-@@ -1355,10 +1360,17 @@ int ieee80211_do_open(struct wireless_de
+@@ -1368,10 +1373,17 @@ int ieee80211_do_open(struct wireless_de
  
  	switch (sdata->vif.type) {
  	case NL80211_IFTYPE_AP_VLAN:
@@ -122,7 +123,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  			netif_carrier_off(dev);
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -1683,6 +1683,12 @@ void ieee80211_sta_uapsd_trigger(struct
+@@ -1690,6 +1690,12 @@ void ieee80211_sta_uapsd_trigger(struct
  }
  EXPORT_SYMBOL(ieee80211_sta_uapsd_trigger);
  
@@ -137,7 +138,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  {
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4319,8 +4319,11 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4321,8 +4321,11 @@ void __ieee80211_subif_start_xmit(struct
  		sta = NULL;
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
@@ -151,7 +152,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		if (ap_sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED &&
  		    !is_multicast_ether_addr(skb->data)) {
  			if (sta)
-@@ -4712,7 +4715,8 @@ static void ieee80211_8023_xmit(struct i
+@@ -4714,7 +4717,8 @@ static void ieee80211_8023_xmit(struct i
  
  	info->hw_queue = sdata->vif.hw_queue[queue];
  
@@ -163,7 +164,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  
 --- a/net/mac80211/util.c
 +++ b/net/mac80211/util.c
-@@ -1668,6 +1668,9 @@ static void ieee80211_assign_chanctx(str
+@@ -1669,6 +1669,9 @@ static void ieee80211_assign_chanctx(str
  
  	lockdep_assert_wiphy(local->hw.wiphy);
  
@@ -173,26 +174,26 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	conf = rcu_dereference_protected(link->conf->chanctx_conf,
  					 lockdep_is_held(&local->hw.wiphy->mtx));
  	if (conf) {
-@@ -1873,7 +1876,8 @@ int ieee80211_reconfig(struct ieee80211_
- 	}
- 
- 	list_for_each_entry(sdata, &local->interfaces, list) {
+@@ -1877,7 +1880,8 @@ int ieee80211_reconfig(struct ieee80211_
+ 		if (sdata->vif.type == NL80211_IFTYPE_MONITOR &&
+ 		    !ieee80211_hw_check(&local->hw, NO_VIRTUAL_MONITOR))
+ 			continue;
 -		if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
 +		if ((sdata->vif.type != NL80211_IFTYPE_AP_VLAN ||
 +		    ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD)) &&
- 		    sdata->vif.type != NL80211_IFTYPE_MONITOR &&
  		    ieee80211_sdata_running(sdata)) {
  			res = drv_add_interface(local, sdata);
-@@ -1888,7 +1892,8 @@ int ieee80211_reconfig(struct ieee80211_
- 	if (res) {
- 		list_for_each_entry_continue_reverse(sdata, &local->interfaces,
- 						     list)
+ 			if (WARN_ON(res))
+@@ -1894,7 +1898,8 @@ int ieee80211_reconfig(struct ieee80211_
+ 			if (sdata->vif.type == NL80211_IFTYPE_MONITOR &&
+ 			    !ieee80211_hw_check(&local->hw, NO_VIRTUAL_MONITOR))
+ 				continue;
 -			if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
 +			if ((sdata->vif.type != NL80211_IFTYPE_AP_VLAN ||
 +			    ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD)) &&
- 			    sdata->vif.type != NL80211_IFTYPE_MONITOR &&
  			    ieee80211_sdata_running(sdata))
  				drv_remove_interface(local, sdata);
+ 		}
 --- a/net/mac80211/mlme.c
 +++ b/net/mac80211/mlme.c
 @@ -5700,7 +5700,8 @@ static bool ieee80211_assoc_success(stru
diff --git a/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch b/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
index 3795dcf9ac2dcf..c08d15ac6f0cc0 100644
--- a/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
@@ -24,7 +24,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2228,6 +2228,8 @@ enum ieee80211_key_flags {
+@@ -2224,6 +2224,8 @@ enum ieee80211_key_flags {
   * @tx_pn: PN used for TX keys, may be used by the driver as well if it
   *	needs to do software PN assignment by itself (e.g. due to TSO)
   * @flags: key flags, see &enum ieee80211_key_flags.
@@ -33,7 +33,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
   * @keyidx: the key index (0-3)
   * @keylen: key material length
   * @key: key material. For ALG_TKIP the key is encoded as a 256-bit (32 byte)
-@@ -2247,6 +2249,7 @@ struct ieee80211_key_conf {
+@@ -2243,6 +2245,7 @@ struct ieee80211_key_conf {
  	u8 hw_key_idx;
  	s8 keyidx;
  	u16 flags;
@@ -43,7 +43,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	u8 key[];
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -535,6 +535,7 @@ static int ieee80211_add_key(struct wiph
+@@ -540,6 +540,7 @@ static int ieee80211_add_key(struct wiph
  		break;
  	case NL80211_IFTYPE_AP:
  	case NL80211_IFTYPE_AP_VLAN:
@@ -53,7 +53,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  			key->conf.flags |= IEEE80211_KEY_FLAG_RX_MGMT;
 --- a/net/mac80211/driver-ops.c
 +++ b/net/mac80211/driver-ops.c
-@@ -134,7 +134,11 @@ int drv_sta_state(struct ieee80211_local
+@@ -135,7 +135,11 @@ int drv_sta_state(struct ieee80211_local
  	might_sleep();
  	lockdep_assert_wiphy(local->hw.wiphy);
  
@@ -102,7 +102,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	key->conf.cipher = cipher;
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4671,16 +4671,25 @@ static void ieee80211_8023_xmit(struct i
+@@ -4673,16 +4673,25 @@ static void ieee80211_8023_xmit(struct i
  				struct ieee80211_key *key, struct sk_buff *skb)
  {
  	struct ieee80211_tx_info *info;
diff --git a/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch b/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch
index 43bef1ef8c443d..d8f7350d9484cc 100644
--- a/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/245-compilation_fix.patch
@@ -30,7 +30,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	struct ieee80211_local *local;
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4700,19 +4700,21 @@ static void ieee80211_8023_xmit(struct i
+@@ -4702,19 +4702,21 @@ static void ieee80211_8023_xmit(struct i
  
  	ieee80211_aggr_check(sdata, sta, skb);
  
@@ -64,7 +64,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	}
  
  	skb = ieee80211_tx_skb_fixup(skb, ieee80211_sdata_netdev_features(sdata));
-@@ -4772,7 +4774,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4774,7 +4776,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  {
  	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	struct ethhdr *ehdr = (struct ethhdr *)skb->data;
@@ -73,7 +73,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	struct sta_info *sta;
  
  #ifdef CPTCFG_MAC80211_NSS_SUPPORT
-@@ -4790,9 +4792,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4792,9 +4794,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		goto out;
  	}
  
@@ -90,7 +90,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  		goto skip_offload;
  
  	key = rcu_dereference(sta->ptk[sta->ptk_idx]);
-@@ -4803,6 +4809,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4805,6 +4811,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		goto skip_offload;
  
  	sk_pacing_shift_update(skb->sk, sdata->local->hw.tx_sk_pacing_shift);
@@ -98,7 +98,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	ieee80211_8023_xmit(sdata, dev, sta, key, skb);
  	goto out;
  
-@@ -6327,13 +6334,7 @@ int ieee80211_tx_control_port(struct wip
+@@ -6329,13 +6336,7 @@ int ieee80211_tx_control_port(struct wip
  
  start_xmit:
  	local_bh_disable();
diff --git a/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch b/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
index d1140193157d6f..9d960895afb644 100644
--- a/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
@@ -96,7 +96,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  };
  
  /**
-@@ -1860,6 +1878,7 @@ struct ieee80211_channel_switch {
+@@ -1856,6 +1874,7 @@ struct ieee80211_channel_switch {
   *	operation on this interface and request a channel context without
   *	the AP definition. Use this e.g. because the device is able to
   *	handle OFDMA (downlink and trigger for uplink) on a per-AP basis.
@@ -104,7 +104,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
   */
  enum ieee80211_vif_flags {
  	IEEE80211_VIF_BEACON_FILTER		= BIT(0),
-@@ -1868,6 +1887,7 @@ enum ieee80211_vif_flags {
+@@ -1864,6 +1883,7 @@ enum ieee80211_vif_flags {
  	IEEE80211_VIF_GET_NOA_UPDATE		= BIT(3),
  	IEEE80211_VIF_EML_ACTIVE	        = BIT(4),
  	IEEE80211_VIF_IGNORE_OFDMA_WIDER_BW	= BIT(5),
@@ -112,7 +112,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  };
  
  
-@@ -2917,6 +2937,7 @@ enum ieee80211_hw_flags {
+@@ -2919,6 +2939,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_DISALLOW_PUNCTURING_5GHZ,
  	IEEE80211_HW_HANDLES_QUIET_CSA,
  	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
@@ -120,7 +120,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  
  	/* keep last, obviously */
  	NUM_IEEE80211_HW_FLAGS
-@@ -4425,6 +4446,8 @@ struct ieee80211_prep_tx_info {
+@@ -4427,6 +4448,8 @@ struct ieee80211_prep_tx_info {
   * @set_sar_specs: Update the SAR (TX power) settings.
   * @sta_set_decap_offload: Called to notify the driver when a station is allowed
   *	to use rx decapsulation offload
@@ -129,7 +129,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
   * @add_twt_setup: Update hw with TWT agreement parameters received from the peer.
   *	This callback allows the hw to check if requested parameters
   *	are supported and if there is enough room for a new agreement.
-@@ -4819,6 +4842,12 @@ struct ieee80211_ops {
+@@ -4821,6 +4844,12 @@ struct ieee80211_ops {
  	void (*sta_set_decap_offload)(struct ieee80211_hw *hw,
  				      struct ieee80211_vif *vif,
  				      struct ieee80211_sta *sta, bool enabled);
@@ -142,7 +142,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	void (*add_twt_setup)(struct ieee80211_hw *hw,
  			      struct ieee80211_sta *sta,
  			      struct ieee80211_twt_setup *twt);
-@@ -7726,4 +7755,100 @@ int ieee80211_emulate_switch_vif_chanctx
+@@ -7728,4 +7757,100 @@ int ieee80211_emulate_switch_vif_chanctx
  					 int n_vifs,
  					 enum ieee80211_chanctx_switch_mode mode);
  
@@ -245,7 +245,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  #endif /* MAC80211_H */
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2538,6 +2538,7 @@ static int ieee80211_update_mesh_config(
+@@ -2547,6 +2547,7 @@ static int ieee80211_update_mesh_config(
  	struct mesh_config *conf;
  	struct ieee80211_sub_if_data *sdata;
  	struct ieee80211_if_mesh *ifmsh;
@@ -253,7 +253,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  
  	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  	ifmsh = &sdata->u.mesh;
-@@ -2554,8 +2555,11 @@ static int ieee80211_update_mesh_config(
+@@ -2563,8 +2564,11 @@ static int ieee80211_update_mesh_config(
  		conf->dot11MeshMaxPeerLinks = nconf->dot11MeshMaxPeerLinks;
  	if (_chg_mesh_attr(NL80211_MESHCONF_MAX_RETRIES, mask))
  		conf->dot11MeshMaxRetries = nconf->dot11MeshMaxRetries;
@@ -266,7 +266,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	if (_chg_mesh_attr(NL80211_MESHCONF_ELEMENT_TTL, mask))
  		conf->element_ttl = nconf->element_ttl;
  	if (_chg_mesh_attr(NL80211_MESHCONF_AUTO_OPEN_PLINKS, mask)) {
-@@ -2569,8 +2573,12 @@ static int ieee80211_update_mesh_config(
+@@ -2578,8 +2582,12 @@ static int ieee80211_update_mesh_config(
  	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, mask))
  		conf->dot11MeshHWMPmaxPREQretries =
  			nconf->dot11MeshHWMPmaxPREQretries;
@@ -280,7 +280,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	if (_chg_mesh_attr(NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, mask))
  		conf->min_discovery_timeout = nconf->min_discovery_timeout;
  	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, mask))
-@@ -2605,8 +2613,12 @@ static int ieee80211_update_mesh_config(
+@@ -2614,8 +2622,12 @@ static int ieee80211_update_mesh_config(
  	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_RANN_INTERVAL, mask))
  		conf->dot11MeshHWMPRannInterval =
  			nconf->dot11MeshHWMPRannInterval;
@@ -294,7 +294,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	if (_chg_mesh_attr(NL80211_MESHCONF_RSSI_THRESHOLD, mask)) {
  		/* our RSSI threshold implementation is supported only for
  		 * devices that report signal in dBm.
-@@ -2648,6 +2660,7 @@ static int ieee80211_update_mesh_config(
+@@ -2657,6 +2669,7 @@ static int ieee80211_update_mesh_config(
  		conf->dot11MeshConnectedToAuthServer =
  			nconf->dot11MeshConnectedToAuthServer;
  	ieee80211_mbss_info_change_notify(sdata, BSS_CHANGED_BEACON);
@@ -330,7 +330,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  		   sdata, fmt, ##__VA_ARGS__)
 --- a/net/mac80211/debugfs.c
 +++ b/net/mac80211/debugfs.c
-@@ -509,6 +509,7 @@ static const char *hw_flag_names[] = {
+@@ -510,6 +510,7 @@ static const char *hw_flag_names[] = {
  	FLAG(DISALLOW_PUNCTURING_5GHZ),
  	FLAG(HANDLES_QUIET_CSA),
  	FLAG(SUPPORTS_NSS_OFFLOAD),
@@ -340,7 +340,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  
 --- a/net/mac80211/driver-ops.c
 +++ b/net/mac80211/driver-ops.c
-@@ -621,3 +621,23 @@ int drv_change_sta_links(struct ieee8021
+@@ -622,3 +622,23 @@ int drv_change_sta_links(struct ieee8021
  
  	return 0;
  }
@@ -1160,7 +1160,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  void mesh_pathtbl_unregister(struct ieee80211_sub_if_data *sdata)
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -2628,7 +2628,7 @@ static struct sk_buff *ieee80211_build_h
+@@ -2629,7 +2629,7 @@ static struct sk_buff *ieee80211_build_h
  	bool multicast;
  	u16 info_id = 0;
  	struct ieee80211_chanctx_conf *chanctx_conf = NULL;
@@ -1169,7 +1169,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	int ret;
  	u8 link_id = u32_get_bits(ctrl_flags, IEEE80211_TX_CTRL_MLO_LINK);
  
-@@ -2640,6 +2640,9 @@ static struct sk_buff *ieee80211_build_h
+@@ -2641,6 +2641,9 @@ static struct sk_buff *ieee80211_build_h
  		info_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
  #endif
  
@@ -1179,7 +1179,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	/* convert Ethernet header to proper 802.11 header (based on
  	 * operation mode) */
  	ethertype = (skb->data[12] << 8) | skb->data[13];
-@@ -2710,6 +2713,13 @@ static struct sk_buff *ieee80211_build_h
+@@ -2711,6 +2714,13 @@ static struct sk_buff *ieee80211_build_h
  		break;
  #ifdef CPTCFG_MAC80211_MESH
  	case NL80211_IFTYPE_MESH_POINT:
@@ -1193,7 +1193,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  		if (!is_multicast_ether_addr(skb->data)) {
  			struct sta_info *next_hop;
  			bool mpp_lookup = true;
-@@ -2973,6 +2983,9 @@ static struct sk_buff *ieee80211_build_h
+@@ -2974,6 +2984,9 @@ static struct sk_buff *ieee80211_build_h
  
  	skb_reset_mac_header(skb);
  
@@ -1203,7 +1203,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	info = IEEE80211_SKB_CB(skb);
  	memset(info, 0, sizeof(*info));
  
-@@ -4296,6 +4309,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4298,6 +4311,7 @@ void __ieee80211_subif_start_xmit(struct
  	struct sk_buff *next;
  	int len = skb->len;
  	struct ieee80211_key *key = NULL;
@@ -1211,7 +1211,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	struct ieee80211_sub_if_data *ap_sdata;
  
  	if (unlikely(!ieee80211_sdata_running(sdata) || skb->len < ETH_HLEN)) {
-@@ -4370,9 +4384,15 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4372,9 +4386,15 @@ void __ieee80211_subif_start_xmit(struct
  			goto out;
  		}
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch b/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
index 1adf62f35f93c4..c9b07a95606aba 100644
--- a/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
@@ -16,7 +16,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2877,6 +2877,8 @@ struct ieee80211_txq {
+@@ -2878,6 +2878,8 @@ struct ieee80211_txq {
   *
   *  @IEEE80211_HW_SUPPORTS_NSS_OFFLOAD: Hardware/driver supports NSS offload
   *
@@ -25,7 +25,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
   * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
   */
  enum ieee80211_hw_flags {
-@@ -2938,6 +2940,7 @@ enum ieee80211_hw_flags {
+@@ -2940,6 +2942,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_HANDLES_QUIET_CSA,
  	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
  	IEEE80211_HW_SUPPORTS_MESH_NSS_OFFLOAD,
@@ -35,7 +35,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	NUM_IEEE80211_HW_FLAGS
 --- a/net/mac80211/debugfs.c
 +++ b/net/mac80211/debugfs.c
-@@ -510,6 +510,7 @@ static const char *hw_flag_names[] = {
+@@ -511,6 +511,7 @@ static const char *hw_flag_names[] = {
  	FLAG(HANDLES_QUIET_CSA),
  	FLAG(SUPPORTS_NSS_OFFLOAD),
  	FLAG(SUPPORTS_MESH_NSS_OFFLOAD),
diff --git a/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch b/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch
index f69088b2540d8b..603b8cd67c18da 100644
--- a/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/335-0005-mac80211-simple-tx-for-AP-mode.patch
@@ -14,7 +14,7 @@ Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4789,6 +4789,67 @@ out_free:
+@@ -4791,6 +4791,67 @@ out_free:
  	kfree_skb(skb);
  }
  
@@ -82,7 +82,7 @@ Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
  netdev_tx_t ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
  					    struct net_device *dev)
  {
-@@ -4828,6 +4889,11 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4830,6 +4891,11 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  	if (key && (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)))
  		goto skip_offload;
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/336-mac80211-Mesh-Fast-rx-support.patch b/package/kernel/mac80211/patches/nss/subsys/336-mac80211-Mesh-Fast-rx-support.patch
index ba3b72110124e1..86543781338107 100644
--- a/package/kernel/mac80211/patches/nss/subsys/336-mac80211-Mesh-Fast-rx-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/336-mac80211-Mesh-Fast-rx-support.patch
@@ -20,7 +20,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -1761,6 +1761,8 @@ static void sta_apply_mesh_params(struct
+@@ -1770,6 +1770,8 @@ static void sta_apply_mesh_params(struct
  			/* init at low value */
  			ewma_mesh_tx_rate_avg_add(&sta->mesh->tx_rate_avg, 10);
  
@@ -29,7 +29,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  			break;
  		case NL80211_PLINK_LISTEN:
  		case NL80211_PLINK_BLOCKED:
-@@ -1775,6 +1777,7 @@ static void sta_apply_mesh_params(struct
+@@ -1784,6 +1786,7 @@ static void sta_apply_mesh_params(struct
  			ieee80211_mps_sta_status_update(sta);
  			changed |= ieee80211_mps_set_sta_local_pm(sta,
  					NL80211_MESH_POWER_UNKNOWN);
@@ -94,7 +94,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  	if (action) {
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -4717,10 +4717,15 @@ void ieee80211_check_fast_rx(struct sta_
+@@ -4724,10 +4724,15 @@ void ieee80211_check_fast_rx(struct sta_
  
  		break;
  	case NL80211_IFTYPE_MESH_POINT:
@@ -112,7 +112,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  		break;
  	default:
  		goto clear;
-@@ -4761,7 +4766,7 @@ void ieee80211_check_fast_rx(struct sta_
+@@ -4768,7 +4773,7 @@ void ieee80211_check_fast_rx(struct sta_
  	__release(check_fast_rx);
  
  	if (assign)
@@ -121,7 +121,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  
  	offload_flags = get_bss_sdata(sdata)->vif.offload_flags;
  	offload = offload_flags & IEEE80211_OFFLOAD_DECAP_ENABLED;
-@@ -4943,6 +4948,10 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4950,6 +4955,10 @@ static bool ieee80211_invoke_fast_rx(str
  		u8 sa[ETH_ALEN];
  	} addrs __aligned(2);
  	struct ieee80211_sta_rx_stats *stats;
@@ -132,7 +132,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  
  	/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
  	 * to a common data structure; drivers can implement that per queue
-@@ -4992,6 +5001,37 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4999,6 +5008,37 @@ static bool ieee80211_invoke_fast_rx(str
  		snap_offs += IEEE80211_CCMP_HDR_LEN;
  	}
  
@@ -170,7 +170,7 @@ Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
  	if (!ieee80211_vif_is_mesh(&rx->sdata->vif) &&
  	    !(status->rx_flags & IEEE80211_RX_AMSDU)) {
  		if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
-@@ -5029,9 +5069,33 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -5036,9 +5076,33 @@ static bool ieee80211_invoke_fast_rx(str
  		return true;
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch b/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch
index e87a824ab068b6..bdaf7f1884f3ad 100644
--- a/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/342-mac80211-fix-unconditional-sta-usage.patch
@@ -33,7 +33,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4720,7 +4720,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4722,7 +4722,7 @@ static void ieee80211_8023_xmit(struct i
  
  	ieee80211_aggr_check(sdata, sta, skb);
  
@@ -42,7 +42,7 @@ Signed-off-by: Tamizh Chelvam <quic_tamizhr@quicinc.com>
  		tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
  		tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
  		if (tid_tx) {
-@@ -4774,7 +4774,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4776,7 +4776,7 @@ static void ieee80211_8023_xmit(struct i
  	}
  
  	dev_sw_netstats_tx_add(dev, skbs, len);
diff --git a/package/kernel/mac80211/patches/nss/subsys/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch b/package/kernel/mac80211/patches/nss/subsys/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch
index 15905c1090aa4b..4d4c788b7e1ea7 100644
--- a/package/kernel/mac80211/patches/nss/subsys/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch
@@ -21,7 +21,7 @@ Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
 
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -1013,7 +1013,8 @@ static bool ieee80211_set_sdata_offload_
+@@ -1020,7 +1020,8 @@ static bool ieee80211_set_sdata_offload_
  		flags |= IEEE80211_OFFLOAD_DECAP_ENABLED;
  
  		if (local->monitors &&
diff --git a/package/kernel/mac80211/patches/nss/subsys/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch b/package/kernel/mac80211/patches/nss/subsys/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
index c1b285366ddaba..1a22f5a77977d4 100644
--- a/package/kernel/mac80211/patches/nss/subsys/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/640-006-01-mac80211-Remove-unused-RX_FLAGS-from-mac80211_rx_fla.patch
@@ -1,29 +1,6 @@
-From 11d0cce62afc157468e1d97ea80a2510091ea2c2 Mon Sep 17 00:00:00 2001
-From: P Praneesh <quic_ppranees@quicinc.com>
-Date: Fri, 1 Jul 2022 11:57:00 +0530
-Subject: [PATCH] mac80211: Remove unused RX_FLAGS from mac80211_rx_flags
-
-Remove unused RX_FLAG_AMPDU_DELIM_CRC_KNOWN flag from
-mac80211_rx_flags to provide space for new EHT flags.
-
-Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
----
- include/net/mac80211.h | 33 +++++++++++++++------------------
- net/mac80211/rx.c      |  7 +------
- 2 files changed, 16 insertions(+), 24 deletions(-)
-
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1482,8 +1482,6 @@ ieee80211_tx_info_clear_status(struct ie
-  * @RX_FLAG_AMPDU_IS_LAST: this subframe is the last subframe of the A-MPDU
-  * @RX_FLAG_AMPDU_DELIM_CRC_ERROR: A delimiter CRC error has been detected
-  *	on this subframe
-- * @RX_FLAG_AMPDU_DELIM_CRC_KNOWN: The delimiter CRC field is known (the CRC
-- *	is stored in the @ampdu_delimiter_crc field)
-  * @RX_FLAG_MIC_STRIPPED: The mic was stripped of this packet. Decryption was
-  *	done by the hardware
-  * @RX_FLAG_ONLY_MONITOR: Report frame only to monitor interfaces without
-@@ -1540,39 +1538,38 @@ ieee80211_tx_info_clear_status(struct ie
+@@ -1538,39 +1538,38 @@ ieee80211_tx_info_clear_status(struct ie
   *	hardware or driver)
   */
  enum mac80211_rx_flags {
@@ -42,7 +19,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
 -	RX_FLAG_AMPDU_LAST_KNOWN	= BIT(12),
 -	RX_FLAG_AMPDU_IS_LAST		= BIT(13),
 -	RX_FLAG_AMPDU_DELIM_CRC_ERROR	= BIT(14),
--	RX_FLAG_AMPDU_DELIM_CRC_KNOWN	= BIT(15),
+-	/* one free bit at 15 */
 -	RX_FLAG_MACTIME			= BIT(16) | BIT(17),
 -	RX_FLAG_MACTIME_PLCP_START	= 1 << 16,
 -	RX_FLAG_MACTIME_START		= 2 << 16,
@@ -95,25 +72,3 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
  };
  
  /**
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -508,18 +508,13 @@ ieee80211_add_rx_radiotap_header(struct
- 			flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
- 		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
- 			flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
--		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
--			flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN;
- 		if (status->flag & RX_FLAG_AMPDU_EOF_BIT_KNOWN)
- 			flags |= IEEE80211_RADIOTAP_AMPDU_EOF_KNOWN;
- 		if (status->flag & RX_FLAG_AMPDU_EOF_BIT)
- 			flags |= IEEE80211_RADIOTAP_AMPDU_EOF;
- 		put_unaligned_le16(flags, pos);
- 		pos += 2;
--		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
--			*pos++ = status->ampdu_delimiter_crc;
--		else
--			*pos++ = 0;
-+		*pos++ = 0;
- 		*pos++ = 0;
- 	}
- 
diff --git a/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch b/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
index 3a034ac1c076ab..080634bcf7e5f1 100644
--- a/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
@@ -44,7 +44,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  /* misc utils */
  
  static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
-@@ -4342,7 +4343,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4344,7 +4345,7 @@ void __ieee80211_subif_start_xmit(struct
  		    !is_multicast_ether_addr(skb->data)) {
  			if (sta)
  				key = rcu_dereference(sta->ptk[sta->ptk_idx]);
@@ -53,7 +53,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  			rcu_read_unlock();
  			return;
  		}
-@@ -4388,7 +4389,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4390,7 +4391,7 @@ void __ieee80211_subif_start_xmit(struct
  		if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) {
  		    	if (sta)
  				key = rcu_dereference(sta->ptk[sta->ptk_idx]);
@@ -62,7 +62,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  		} else {
  			dev_sw_netstats_tx_add(dev, 1, skb->len);
  			ieee80211_xmit(sdata, sta, skb);
-@@ -4688,7 +4689,8 @@ static bool ieee80211_tx_8023(struct iee
+@@ -4690,7 +4691,8 @@ static bool ieee80211_tx_8023(struct iee
  
  static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
  				struct net_device *dev, struct sta_info *sta,
@@ -72,7 +72,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  {
  	struct ieee80211_tx_info *info;
  	struct ethhdr *ehdr = (struct ethhdr *)skb->data;
-@@ -4744,6 +4746,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4746,6 +4748,7 @@ static void ieee80211_8023_xmit(struct i
  	info = IEEE80211_SKB_CB(skb);
  	memset(info, 0, sizeof(*info));
  
@@ -80,7 +80,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  	info->hw_queue = sdata->vif.hw_queue[queue];
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
-@@ -4764,11 +4767,12 @@ static void ieee80211_8023_xmit(struct i
+@@ -4766,11 +4769,12 @@ static void ieee80211_8023_xmit(struct i
  			memcpy(IEEE80211_SKB_CB(seg), info, sizeof(*info));
  	}
  
@@ -96,7 +96,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  		if (info->status_data)
  			info->status_data_idr = 1;
  	}
-@@ -4791,7 +4795,8 @@ out_free:
+@@ -4793,7 +4797,8 @@ out_free:
  
  void ieee80211_8023_xmit_ap(struct ieee80211_sub_if_data *sdata,
  			    struct net_device *dev, struct sta_info *sta,
@@ -106,7 +106,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  {
  	struct ieee80211_tx_info *info;
  	struct ieee80211_local *local = sdata->local;
-@@ -4800,6 +4805,9 @@ void ieee80211_8023_xmit_ap(struct ieee8
+@@ -4802,6 +4807,9 @@ void ieee80211_8023_xmit_ap(struct ieee8
  	unsigned long flags;
  	int q;
  	u16 q_map;
@@ -116,7 +116,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  	/*
  	 * If the skb is shared we need to obtain our own copy.
-@@ -4811,11 +4819,13 @@ void ieee80211_8023_xmit_ap(struct ieee8
+@@ -4813,11 +4821,13 @@ void ieee80211_8023_xmit_ap(struct ieee8
  
  	info = IEEE80211_SKB_CB(skb);
  	memset(info, 0, sizeof(*info));
@@ -133,7 +133,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  	info->flags |= IEEE80211_TX_CTL_HW_80211_ENCAP;
  	info->control.vif = &sdata->vif;
-@@ -4849,14 +4859,23 @@ void ieee80211_8023_xmit_ap(struct ieee8
+@@ -4851,14 +4861,23 @@ void ieee80211_8023_xmit_ap(struct ieee8
  	drv_tx(local, &control, skb);
  
  }
@@ -158,7 +158,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  #ifdef CPTCFG_MAC80211_NSS_SUPPORT
  	ieee80211_xmit_nss_fixup(skb, dev);
-@@ -4872,14 +4891,15 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4874,14 +4893,15 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		kfree_skb(skb);
  		goto out;
  	}
@@ -176,7 +176,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  		goto skip_offload;
  
  	key = rcu_dereference(sta->ptk[sta->ptk_idx]);
-@@ -4890,13 +4910,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4892,13 +4912,13 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		goto skip_offload;
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP) {
@@ -192,7 +192,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  	goto out;
  
  skip_offload:
-@@ -6420,7 +6440,10 @@ int ieee80211_tx_control_port(struct wip
+@@ -6422,7 +6442,10 @@ int ieee80211_tx_control_port(struct wip
  
  start_xmit:
  	local_bh_disable();
diff --git a/package/kernel/mac80211/patches/nss/subsys/686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch b/package/kernel/mac80211/patches/nss/subsys/686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch
index 03bdf150828250..fbae3e18769dd1 100644
--- a/package/kernel/mac80211/patches/nss/subsys/686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/686-mac80211-fix-RCU-stall-in-mesh-fast-xmit-path.patch
@@ -72,7 +72,7 @@ Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2365,7 +2365,7 @@ static void mpath_set_pinfo(struct mesh_
+@@ -2374,7 +2374,7 @@ static void mpath_set_pinfo(struct mesh_
  	if (mpath->flags & MESH_PATH_RESOLVED)
  		pinfo->flags |= NL80211_MPATH_FLAG_RESOLVED;
  	pinfo->hop_count = mpath->hop_count;
diff --git a/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch b/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
index 9243aff80d5d19..c20c795fdaba99 100644
--- a/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
@@ -31,7 +31,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
  				struct net_device *dev, struct sta_info *sta,
  				struct ieee80211_key *key, struct sk_buff *skb,
-@@ -3656,7 +3658,7 @@ ieee80211_sdata_netdev_features(struct i
+@@ -3657,7 +3659,7 @@ ieee80211_sdata_netdev_features(struct i
  }
  
  static struct sk_buff *
@@ -40,7 +40,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  {
  	if (skb_is_gso(skb)) {
  		struct sk_buff *segs;
-@@ -3674,7 +3676,7 @@ ieee80211_tx_skb_fixup(struct sk_buff *s
+@@ -3675,7 +3677,7 @@ ieee80211_tx_skb_fixup(struct sk_buff *s
  	if (skb_needs_linearize(skb, features) && __skb_linearize(skb))
  		goto free;
  
@@ -49,7 +49,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  		int ofs = skb_checksum_start_offset(skb);
  
  		if (skb->encapsulation)
-@@ -3820,7 +3822,7 @@ static bool ieee80211_xmit_fast(struct i
+@@ -3821,7 +3823,7 @@ static bool ieee80211_xmit_fast(struct i
  	memcpy(&eth, skb->data, ETH_HLEN - 2);
  
  	/* after this point (skb is modified) we cannot return false */
@@ -58,7 +58,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	if (!skb)
  		return true;
  
-@@ -4366,7 +4368,7 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4368,7 +4370,7 @@ void __ieee80211_subif_start_xmit(struct
  	 * things so we cannot really handle checksum or GSO offload.
  	 * fix it up in software before we handle anything else.
  	 */
@@ -67,7 +67,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  	if (!skb) {
  		len = 0;
  		goto out;
-@@ -4739,7 +4741,7 @@ static void ieee80211_8023_xmit(struct i
+@@ -4741,7 +4743,7 @@ static void ieee80211_8023_xmit(struct i
  		}
  	}
  
@@ -78,7 +78,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -2259,6 +2259,10 @@ int ieee80211_if_add(struct ieee80211_lo
+@@ -2273,6 +2273,10 @@ int ieee80211_if_add(struct ieee80211_lo
  
  		ndev->features |= local->hw.netdev_features;
  		ndev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
diff --git a/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch b/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
index 338a9d2dd1a8d6..4a47aa2d9a2f65 100644
--- a/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
@@ -23,7 +23,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2876,6 +2876,9 @@ struct ieee80211_txq {
+@@ -2879,6 +2879,9 @@ struct ieee80211_txq {
   *
   * @IEEE80211_HW_SUPPORTS_TID_CLASS_OFFLOAD: Hardware suports tid calssification offload.
   *
@@ -33,7 +33,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
   * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
   */
  enum ieee80211_hw_flags {
-@@ -2938,6 +2941,7 @@ enum ieee80211_hw_flags {
+@@ -2942,6 +2945,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
  	IEEE80211_HW_SUPPORTS_MESH_NSS_OFFLOAD,
  	IEEE80211_HW_SUPPORTS_TID_CLASS_OFFLOAD,
@@ -43,7 +43,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	NUM_IEEE80211_HW_FLAGS
 --- a/net/mac80211/debugfs.c
 +++ b/net/mac80211/debugfs.c
-@@ -511,6 +511,7 @@ static const char *hw_flag_names[] = {
+@@ -512,6 +512,7 @@ static const char *hw_flag_names[] = {
  	FLAG(SUPPORTS_NSS_OFFLOAD),
  	FLAG(SUPPORTS_MESH_NSS_OFFLOAD),
  	FLAG(SUPPORTS_TID_CLASS_OFFLOAD),
@@ -83,7 +83,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  		return false;
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-@@ -4351,7 +4358,8 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4353,7 +4360,8 @@ void __ieee80211_subif_start_xmit(struct
  		}
  	}
  
@@ -93,7 +93,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	ieee80211_aggr_check(sdata, sta, skb);
  
  	if (sta) {
-@@ -4705,8 +4713,10 @@ static void ieee80211_8023_xmit(struct i
+@@ -4707,8 +4715,10 @@ static void ieee80211_8023_xmit(struct i
  	bool multicast;
  	u8 tid;
  
@@ -106,7 +106,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  
  	multicast = is_multicast_ether_addr(ra);
  
-@@ -6427,9 +6437,12 @@ int ieee80211_tx_control_port(struct wip
+@@ -6429,9 +6439,12 @@ int ieee80211_tx_control_port(struct wip
  	}
  
  	if (!IS_ERR(sta)) {
@@ -123,7 +123,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  		 * for MLO STA, the SA should be the AP MLD address, but
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -4584,6 +4584,9 @@ static int ieee80211_get_txq_stats(struc
+@@ -4597,6 +4597,9 @@ static int ieee80211_get_txq_stats(struc
  	struct ieee80211_sub_if_data *sdata;
  	int ret = 0;
  
@@ -149,7 +149,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  	skb_queue_head_init(&local->skb_queue);
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -1576,6 +1576,9 @@ static void sta_ps_start(struct sta_info
+@@ -1588,6 +1588,9 @@ static void sta_ps_start(struct sta_info
  
  	ieee80211_clear_fast_xmit(sta);
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/829-mac80211-fix-mesh-ping-issue.patch b/package/kernel/mac80211/patches/nss/subsys/829-mac80211-fix-mesh-ping-issue.patch
index 0a805bd2e6d933..6ae63db080448c 100644
--- a/package/kernel/mac80211/patches/nss/subsys/829-mac80211-fix-mesh-ping-issue.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/829-mac80211-fix-mesh-ping-issue.patch
@@ -10,7 +10,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
 
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -4715,16 +4715,14 @@ void ieee80211_check_fast_rx(struct sta_
+@@ -4727,16 +4727,14 @@ void ieee80211_check_fast_rx(struct sta_
  
  		break;
  	case NL80211_IFTYPE_MESH_POINT:
@@ -30,7 +30,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  	default:
  		goto clear;
  	}
-@@ -4946,10 +4944,7 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -4958,10 +4956,7 @@ static bool ieee80211_invoke_fast_rx(str
  		u8 sa[ETH_ALEN];
  	} addrs __aligned(2);
  	struct ieee80211_sta_rx_stats *stats;
@@ -41,7 +41,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  
  	/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
  	 * to a common data structure; drivers can implement that per queue
-@@ -4999,37 +4994,6 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -5011,37 +5006,6 @@ static bool ieee80211_invoke_fast_rx(str
  		snap_offs += IEEE80211_CCMP_HDR_LEN;
  	}
  
@@ -79,7 +79,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
  	if (!ieee80211_vif_is_mesh(&rx->sdata->vif) &&
  	    !(status->rx_flags & IEEE80211_RX_AMSDU)) {
  		if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
-@@ -5067,30 +5031,6 @@ static bool ieee80211_invoke_fast_rx(str
+@@ -5079,30 +5043,6 @@ static bool ieee80211_invoke_fast_rx(str
  		return true;
  	}
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/999-775-wifi-mac80211-Changes-for-WDS-MLD.patch b/package/kernel/mac80211/patches/nss/subsys/999-775-wifi-mac80211-Changes-for-WDS-MLD.patch
index 3246b1f9304ee8..59da8e96e22da4 100644
--- a/package/kernel/mac80211/patches/nss/subsys/999-775-wifi-mac80211-Changes-for-WDS-MLD.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/999-775-wifi-mac80211-Changes-for-WDS-MLD.patch
@@ -17,7 +17,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
 
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -8806,6 +8806,7 @@ bool cfg80211_rx_spurious_frame(struct n
+@@ -8827,6 +8827,7 @@ bool cfg80211_rx_spurious_frame(struct n
   * @dev: The device the frame matched to
   * @addr: the transmitter address
   * @gfp: context flags
@@ -25,7 +25,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
   *
   * This function is used in AP mode (only!) to inform userspace that
   * an associated station sent a 4addr frame but that wasn't expected.
-@@ -8815,7 +8816,8 @@ bool cfg80211_rx_spurious_frame(struct n
+@@ -8836,7 +8837,8 @@ bool cfg80211_rx_spurious_frame(struct n
   * for a reason other than not having a subscription.)
   */
  bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
@@ -37,7 +37,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
   * cfg80211_probe_status - notify userspace about probe status
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2207,9 +2207,16 @@ static int ieee80211_change_station(stru
+@@ -2216,9 +2216,16 @@ static int ieee80211_change_station(stru
  		vlansdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
  
  		if (params->vlan->ieee80211_ptr->use_4addr) {
@@ -54,7 +54,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  			rcu_assign_pointer(vlansdata->u.vlan.sta, sta);
  			__ieee80211_check_fast_rx_iface(vlansdata);
  
-@@ -2219,6 +2226,39 @@ static int ieee80211_change_station(stru
+@@ -2228,6 +2235,39 @@ static int ieee80211_change_station(stru
  			else
  				drv_sta_set_4addr(local, sta->sdata, &sta->sta,
  						  true);
@@ -96,7 +96,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  		if (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -1683,7 +1683,7 @@ EXPORT_SYMBOL(ieee80211_sta_uapsd_trigge
+@@ -1695,7 +1695,7 @@ EXPORT_SYMBOL(ieee80211_sta_uapsd_trigge
  
  void ieee80211_rx_nss_notify_4addr(struct net_device *dev, u8 *sta_addr)
  {
@@ -105,7 +105,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  }
  EXPORT_SYMBOL(ieee80211_rx_nss_notify_4addr);
  
-@@ -1858,7 +1858,8 @@ ieee80211_rx_h_sta_process(struct ieee80
+@@ -1870,7 +1870,8 @@ ieee80211_rx_h_sta_process(struct ieee80
  			if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT))
  				cfg80211_rx_unexpected_4addr_frame(
  					rx->sdata->dev, sta->sta.addr,
@@ -115,7 +115,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  			return RX_DROP_M_UNEXPECTED_4ADDR_FRAME;
  		}
  		/*
-@@ -3245,7 +3246,8 @@ ieee80211_rx_h_data(struct ieee80211_rx_
+@@ -3257,7 +3258,8 @@ ieee80211_rx_h_data(struct ieee80211_rx_
  		if (rx->sta &&
  		    !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT))
  			cfg80211_rx_unexpected_4addr_frame(
@@ -127,7 +127,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -18945,7 +18945,8 @@ void cfg80211_conn_failed(struct net_dev
+@@ -18995,7 +18995,8 @@ void cfg80211_conn_failed(struct net_dev
  EXPORT_SYMBOL(cfg80211_conn_failed);
  
  static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
@@ -137,7 +137,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  {
  	struct wireless_dev *wdev = dev->ieee80211_ptr;
  	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
-@@ -18971,6 +18972,9 @@ static bool __nl80211_unexpected_frame(s
+@@ -19021,6 +19022,9 @@ static bool __nl80211_unexpected_frame(s
  	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
  		goto nla_put_failure;
  
@@ -147,7 +147,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  	genlmsg_end(msg, hdr);
  	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
  	return true;
-@@ -18994,14 +18998,15 @@ bool cfg80211_rx_spurious_frame(struct n
+@@ -19044,14 +19048,15 @@ bool cfg80211_rx_spurious_frame(struct n
  		return false;
  	}
  	ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
@@ -165,7 +165,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  {
  	struct wireless_dev *wdev = dev->ieee80211_ptr;
  	bool ret;
-@@ -19016,7 +19021,7 @@ bool cfg80211_rx_unexpected_4addr_frame(
+@@ -19066,7 +19071,7 @@ bool cfg80211_rx_unexpected_4addr_frame(
  	}
  	ret = __nl80211_unexpected_frame(dev,
  					 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
@@ -176,7 +176,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  }
 --- a/net/mac80211/chan.c
 +++ b/net/mac80211/chan.c
-@@ -1036,6 +1036,8 @@ __ieee80211_link_copy_chanctx_to_vlans(s
+@@ -1048,6 +1048,8 @@ __ieee80211_link_copy_chanctx_to_vlans(s
  	list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list) {
  		struct ieee80211_bss_conf *vlan_conf;
  
@@ -185,7 +185,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  		vlan_conf = wiphy_dereference(local->hw.wiphy,
  					      vlan->vif.link_conf[link_id]);
  		if (WARN_ON(!vlan_conf))
-@@ -1277,6 +1279,8 @@ ieee80211_link_update_chanreq(struct iee
+@@ -1294,6 +1296,8 @@ ieee80211_link_update_chanreq(struct iee
  	list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list) {
  		struct ieee80211_bss_conf *vlan_conf;
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/999-918-mac80211-fix-NULL-pointer-access-Klocwork-issue.patch b/package/kernel/mac80211/patches/nss/subsys/999-918-mac80211-fix-NULL-pointer-access-Klocwork-issue.patch
index 633b70fb14038a..d3b895d5fb6786 100644
--- a/package/kernel/mac80211/patches/nss/subsys/999-918-mac80211-fix-NULL-pointer-access-Klocwork-issue.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/999-918-mac80211-fix-NULL-pointer-access-Klocwork-issue.patch
@@ -20,7 +20,7 @@ Signed-off-by: Monika Korada <quic_koramoni@quicinc.com>
 
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -1363,7 +1363,8 @@ int ieee80211_do_open(struct wireless_de
+@@ -1376,7 +1376,8 @@ int ieee80211_do_open(struct wireless_de
  	case NL80211_IFTYPE_AP_VLAN:
  		if (sdata->bss->active) {
  			ieee80211_link_vlan_copy_chanctx(&sdata->deflink);
@@ -30,7 +30,7 @@ Signed-off-by: Monika Korada <quic_koramoni@quicinc.com>
  
  			if (ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD)) {
  				ieee80211_set_sdata_offload_flags(sdata);
-@@ -1374,7 +1375,8 @@ int ieee80211_do_open(struct wireless_de
+@@ -1387,7 +1388,8 @@ int ieee80211_do_open(struct wireless_de
  
  			ieee80211_set_vif_encap_ops(sdata);
  		} else {
@@ -40,7 +40,7 @@ Signed-off-by: Monika Korada <quic_koramoni@quicinc.com>
  		}
  		break;
  	case NL80211_IFTYPE_MONITOR:
-@@ -1405,7 +1407,8 @@ int ieee80211_do_open(struct wireless_de
+@@ -1419,7 +1421,8 @@ int ieee80211_do_open(struct wireless_de
  		ieee80211_recalc_offload(local);
  		ieee80211_recalc_idle(local);
  
@@ -50,7 +50,7 @@ Signed-off-by: Monika Korada <quic_koramoni@quicinc.com>
  		break;
  	default:
  		if (coming_up) {
-@@ -1449,7 +1452,8 @@ int ieee80211_do_open(struct wireless_de
+@@ -1463,7 +1466,8 @@ int ieee80211_do_open(struct wireless_de
  		case NL80211_IFTYPE_AP:
  		case NL80211_IFTYPE_MESH_POINT:
  		case NL80211_IFTYPE_OCB:

From 6f198ccd173d76cb0933c7be738e3e3e18a95d73 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sat, 26 Oct 2024 02:06:18 -0400
Subject: [PATCH 217/225] nss-setup: update wifi configs for WPA3

* 802.11 k/v/r now fully works in sae-mixed mode. So we can now switch
  from psk2 (WPA2) to WPA2/WPA3 mixed mode.
* Clean up uncessary configs
* Remove WDS example as it's not applicable in this example

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 nss-setup/example/01-mesh-node     | 31 +++++-----------------------
 nss-setup/example/02-mesh-sat-node | 33 ++++++------------------------
 2 files changed, 11 insertions(+), 53 deletions(-)

diff --git a/nss-setup/example/01-mesh-node b/nss-setup/example/01-mesh-node
index 6fe47e876ba16d..1d1699aa5f3b22 100644
--- a/nss-setup/example/01-mesh-node
+++ b/nss-setup/example/01-mesh-node
@@ -36,49 +36,38 @@ config wifi-iface '5g'
 	option mode 'ap'
 	option network 'lan'
 	option ssid 'MX4300'
-	option encryption 'psk2'
+	option encryption 'sae-mixed'
 	option key 'xxxxxxxxxxxxx'
 	option beacon_int '97'
 	option bss_transition '1'
-	option disassoc_low_ack '0'
 	option dtim_period '3'
 	option ft_over_ds '0'
-	option ft_psk_generate_local '1'
 	option ieee80211r '1'
 	option ieee80211k '1'
 	option proxy_arp '1'
-	option reassociation_deadline '20000'
-	option skip_inactivity_poll '1'
 	option time_advertisement '2'
 	option time_zone 'GMT0'
 	option wnm_sleep_mode '1'
-	option wpa_group_rekey '86400'
-	option pmk_r1_push '1'
+	option ocv '0'
 
 config wifi-iface '2g'
 	option device 'radio1'
 	option mode 'ap'
 	option network 'lan'
 	option ssid 'MX4300'
-	option encryption 'psk2'
+	option encryption 'sae-mixed'
 	option key 'xxxxxxxxxxxxx'
 	option bss_transition '1'
-	option beacon_int '100'
-	option disassoc_low_ack '0'
 	option dtim_period '3'
 	option ft_over_ds '0'
-	option ft_psk_generate_local '1'
 	option ieee80211r '1'
 	option ieee80211k '1'
 	option proxy_arp '1'
-	option reassociation_deadline '20000'
-	option skip_inactivity_poll '1'
 	option time_advertisement '2'
 	option time_zone 'GMT0'
 	option wnm_sleep_mode '1'
-	option wpa_group_rekey '86400'
-	option max_inactivity '4260'
-	option pmk_r1_push '1'
+	option max_inactivity '86400'
+	option ocv '0'
 
 config wifi-iface 'mesh'
 	option device 'radio2'
@@ -96,13 +85,3 @@ config wifi-iface 'mesh'
 	option mesh_hwmp_max_preq_retries '2'
 	option mesh_rssi_threshold '-70'
 	option disabled '0'
-
-config wifi-iface 'wds'
-	option device 'radio2'
-	option mode 'sta'
-	option network 'lan'
-	option ssid 'MX4300-WDS'
-	option encryption 'psk2+ccmp'
-	option key '4b22dd0c95846d36a8760ec90b703601c60f31ce4c8db1d9ade683cd3a2c2326'
-	option wds '1'
-	option disabled '1'
diff --git a/nss-setup/example/02-mesh-sat-node b/nss-setup/example/02-mesh-sat-node
index 5b3a42bd109ab0..17f639535e31fb 100644
--- a/nss-setup/example/02-mesh-sat-node
+++ b/nss-setup/example/02-mesh-sat-node
@@ -36,49 +36,38 @@ config wifi-iface '5g'
 	option mode 'ap'
 	option network 'lan'
 	option ssid 'MX4300'
-	option encryption 'psk2'
+	option encryption 'sae-mixed'
 	option key 'xxxxxxxxxxxxx'
 	option beacon_int '97'
 	option bss_transition '1'
-	option disassoc_low_ack '0'
 	option dtim_period '3'
 	option ft_over_ds '0'
-	option ft_psk_generate_local '1'
 	option ieee80211r '1'
 	option ieee80211k '1'
 	option proxy_arp '1'
-	option reassociation_deadline '20000'
-	option skip_inactivity_poll '1'
 	option time_advertisement '2'
 	option time_zone 'GMT0'
 	option wnm_sleep_mode '1'
-	option wpa_group_rekey '86400'
-	option pmk_r1_push '1'
+	option ocv '0'
 
 config wifi-iface '2g'
 	option device 'radio1'
 	option mode 'ap'
 	option network 'lan'
 	option ssid 'MX4300'
-	option encryption 'psk2'
+	option encryption 'sae-mixed'
 	option key 'xxxxxxxxxxxxx'
 	option bss_transition '1'
-	option beacon_int '100'
-	option disassoc_low_ack '0'
 	option dtim_period '3'
 	option ft_over_ds '0'
-	option ft_psk_generate_local '1'
 	option ieee80211r '1'
 	option ieee80211k '1'
 	option proxy_arp '1'
-	option reassociation_deadline '20000'
-	option skip_inactivity_poll '1'
 	option time_advertisement '2'
 	option time_zone 'GMT0'
 	option wnm_sleep_mode '1'
-	option wpa_group_rekey '86400'
-	option max_inactivity '4260'
-	option pmk_r1_push '1'
+	option max_inactivity '86400'
+	option ocv '0'
 
 config wifi-iface 'mesh'
 	option device 'radio2'
@@ -94,15 +83,5 @@ config wifi-iface 'mesh'
 	option mesh_ttl '5'
 	option mesh_element_ttl '3'
 	option mesh_hwmp_max_preq_retries '2'
-	option mesh_rssi_threshold '-65'
+	option mesh_rssi_threshold '-70'
 	option disabled '0'
-
-config wifi-iface 'wds'
-	option device 'radio2'
-	option mode 'sta'
-	option network 'lan'
-	option ssid 'MX4300-WDS'
-	option encryption 'psk2+ccmp'
-	option key '4b22dd0c95846d36a8760ec90b703601c60f31ce4c8db1d9ade683cd3a2c2326'
-	option wds '1'
-	option disabled '1'

From 30d32b49157ee3d4ae8025a93c5829ce8ac4e76c Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Sun, 27 Oct 2024 18:26:57 -0400
Subject: [PATCH 218/225] ath11k_nss: Refactor nss_diag interface display

Change "GRO FRAG" to "Interface" to account for additional information
of other interface features (i.e. tx-checksumming)

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 package/kernel/mac80211/files/nss_diag.sh | 28 +++++++++--------------
 1 file changed, 11 insertions(+), 17 deletions(-)

diff --git a/package/kernel/mac80211/files/nss_diag.sh b/package/kernel/mac80211/files/nss_diag.sh
index 1868adda2edc3e..d3bee1978b9145 100644
--- a/package/kernel/mac80211/files/nss_diag.sh
+++ b/package/kernel/mac80211/files/nss_diag.sh
@@ -1,14 +1,6 @@
 #!/bin/sh
 # shellcheck disable=3037,3060,2034,1091,2166
 
-blue=""
-red=""
-green=""
-yellow=""
-white=""
-reset=""
-bold=""
-
 # check if stdout is a terminal, then set colors.
 if [ -t 1 ]; then
   red="\033[31m"
@@ -63,17 +55,19 @@ echo -e "${bold}${red}  MAC80211${reset}: ${yellow}${mac80211_version}${reset}"
 echo -e "${bold}${red} ATH11K FW${reset}: ${green}${ath11k_fw}${reset}"
 
 # Display GRO Fragmentation status using BusyBox
-echo -ne "${bold}${red}  GRO FRAG${reset}: ${white}"
+echo -ne "${bold}${red} INTERFACE${reset}: ${white}"
 n=0
-for iface in /sys/class/net/*; do
+for iface in /sys/class/net/br-lan/device /sys/class/net/*/device; do
+  iface=${iface%/*}
   iface=${iface##*/}
-  [ "$iface" = "lo" -o "$iface" = "miireg" ] && continue
-  gro_status=$(ethtool -k "$iface" 2> /dev/null | awk '/rx-gro-list/{print $2}')
-  gro_status=${gro_status:-"N/A"}
-  color=$green
-  [ "$gro_status" = "on" ] && color=$red
-  [ $n -gt 0 ] && spacing="            "
-  printf "%s%-11s : %b%s%b\n" "$spacing" "$iface" "$color" "$gro_status" "$reset"
+  ethtool -k "$iface" | awk -v n=$n -v i="$iface" -v rst="${reset}" -v red="${red}" -v green="${green}" '
+    BEGIN { settings=""; if(n>0) spacing="            " }
+    /tx-checksumming|rx-gro-list/ {
+      color=green
+      if($2=="off") color=red
+      settings = settings $1 " " sprintf("%s%-3s%s", color,$2,rst) " ";
+    }
+  END { printf "%s%-11s%s\n", spacing, i, settings; }'
   n=$((n + 1))
 done
 

From caed6240adfc7128b21091d6abc3f013198290ac Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Tue, 29 Oct 2024 13:24:11 -0400
Subject: [PATCH 219/225] nss-setup: fix network in wifi + formatting

- fix issue #15: minor config mistake in the new nss setup vlan readme guide
- fix formatting of primary subsection displaying too large.

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 nss-setup/example/README.md | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/nss-setup/example/README.md b/nss-setup/example/README.md
index 4df517f6cd9f85..5c3564b0b797ae 100644
--- a/nss-setup/example/README.md
+++ b/nss-setup/example/README.md
@@ -1,11 +1,11 @@
 ---
 # **Configuring VLANs with OpenWRT on NSS-Enabled Devices**
-## **Important Note:** No VLAN Filtering for NSS Devices
+### **Important Note:** No VLAN Filtering for NSS Devices
 
 For **NSS setups**, you **cannot** enable VLAN filtering directly because **NSS handles VLAN internally** through the module `kmod-qca-nss-drv-vlan-mgr`.
 Enabling VLAN filtering via the standard method will interfere with the NSS. To check whether it's enabled, follow the steps below.
----
 
+---
 ### 1. **Check if VLAN Filtering is Enabled**
 Run the following command to check if VLAN filtering is active:
 ```vim
@@ -148,7 +148,7 @@ config interface 'iot'
 
 Here is an example of how to configure the WiFi interfaces for different networks in `/etc/config/wireless`:
 ```vim
-config wifi-iface 'default_radio0'
+config wifi-iface 'lan'
     option device 'radio0'
     option mode 'ap'
     option network 'lan'
@@ -162,7 +162,7 @@ config wifi-iface 'default_radio0'
 config wifi-iface 'guest'
     option device 'radio0'
     option mode 'ap'
-    option network 'br-guest'
+    option network 'guest'
     option ssid 'OpenWrt-Guest'
     option encryption 'psk2'
     option key '********'
@@ -173,7 +173,7 @@ config wifi-iface 'guest'
 config wifi-iface 'iot'
     option device 'radio0'
     option mode 'ap'
-    option network 'br-iot'
+    option network 'iot'
     option ssid 'OpenWrt-IoT'
     option encryption 'psk2'
     option key '********'

From 24799f58f86361c9984262502ca95f222bd1f7cb Mon Sep 17 00:00:00 2001
From: Bruno Martins <bgcngm@gmail.com>
Date: Sun, 3 Nov 2024 15:32:10 +0000
Subject: [PATCH 220/225] nss-setup: Detail advanced setup with trunk ports

---
 nss-setup/example/README.md | 71 +++++++++++++++++++++++++++++++++++++
 1 file changed, 71 insertions(+)

diff --git a/nss-setup/example/README.md b/nss-setup/example/README.md
index 5c3564b0b797ae..a358e118646730 100644
--- a/nss-setup/example/README.md
+++ b/nss-setup/example/README.md
@@ -215,3 +215,74 @@ config interface 'dmz'
     option proto 'none'
     option device 'br-dmz'
 ```
+---
+
+## **Advanced VLAN Setup with trunk ports**
+Assuming other managed network devices need to be connected to your NSS-enabled router, you need to configure trunk ports. The setup in the example below consists of:
+
+- A **Primary Network** on VLAN 1.
+- An **IoT Network** on VLAN 10.
+- **LAN ports 1 and 2** set up as trunk ports for **VLAN 1 and 10**
+- **LAN port 3** untagged and bridged into the **Primary Network**
+- **LAN port 4** untagged and bridged into the **IoT Network**
+
+```vim
+config interface 'lan'
+        option device 'br-lan'
+        option proto 'static'
+        option ipaddr '192.168.1.1'
+        option netmask '255.255.255.0'
+        option ip6assign '60'
+
+config interface 'iot'
+        option proto 'static'
+        option device 'br-iot'
+        option ipaddr '192.168.10.1'
+        option netmask '255.255.255.0'
+
+config interface 'wan'
+        option device 'wan'
+        option proto 'dhcp'
+
+config interface 'wan6'
+        option device 'wan'
+        option proto 'dhcpv6'
+
+config device
+        option type '8021q'
+        option ifname 'lan1'
+        option vid '1'
+        option name 'lan1.1'
+
+config device
+        option type '8021q'
+        option ifname 'lan2'
+        option vid '1'
+        option name 'lan2.1'
+
+config device
+        option type '8021q'
+        option ifname 'lan1'
+        option vid '10'
+        option name 'lan1.10'
+
+config device
+        option type '8021q'
+        option ifname 'lan2'
+        option vid '10'
+        option name 'lan2.10'
+
+config device
+        option name 'br-lan'
+        option type 'bridge'
+        list ports 'lan1.1'
+        list ports 'lan2.1'
+        list ports 'lan3'
+
+config device
+        option type 'bridge'
+        option name 'br-iot'
+        list ports 'lan1.10'
+        list ports 'lan2.10'
+        list ports 'lan4'
+```

From 59cbad9dfee19657eefb1d8b3bb94a6d53bf68db Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Thu, 14 Nov 2024 13:32:27 -0500
Subject: [PATCH 221/225] qualcommax: NSS: refresh patches for 6.6.60

Signed-off-by: Sean Khan <datapronix@protonmail.com>
(cherry picked from commit 8efd9fedbff95990ffe192f504491fe63e9a7d55)
---
 .../patches-6.6/0600-1-qca-nss-ecm-support-CORE.patch  |  2 +-
 .../0603-1-qca-nss-clients-add-qdisc-support.patch     | 10 +++++-----
 .../patches-6.6/0604-1-qca-add-mcs-support.patch       |  2 +-
 .../patches-6.6/0981-1-qca-skb_recycler-support.patch  |  2 +-
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/target/linux/qualcommax/patches-6.6/0600-1-qca-nss-ecm-support-CORE.patch b/target/linux/qualcommax/patches-6.6/0600-1-qca-nss-ecm-support-CORE.patch
index 72acefc8441e43..46228b4b899fcf 100644
--- a/target/linux/qualcommax/patches-6.6/0600-1-qca-nss-ecm-support-CORE.patch
+++ b/target/linux/qualcommax/patches-6.6/0600-1-qca-nss-ecm-support-CORE.patch
@@ -156,7 +156,7 @@
  void fib_del_ifaddr(struct in_ifaddr *, struct in_ifaddr *);
 --- a/net/bridge/br_private.h
 +++ b/net/bridge/br_private.h
-@@ -2267,4 +2267,6 @@ void br_do_suppress_nd(struct sk_buff *s
+@@ -2268,4 +2268,6 @@ void br_do_suppress_nd(struct sk_buff *s
  		       u16 vid, struct net_bridge_port *p, struct nd_msg *msg);
  struct nd_msg *br_is_nd_neigh_msg(struct sk_buff *skb, struct nd_msg *m);
  bool br_is_neigh_suppress_enabled(const struct net_bridge_port *p, u16 vid);
diff --git a/target/linux/qualcommax/patches-6.6/0603-1-qca-nss-clients-add-qdisc-support.patch b/target/linux/qualcommax/patches-6.6/0603-1-qca-nss-clients-add-qdisc-support.patch
index b1318e06b8607c..4a3782466c864c 100644
--- a/target/linux/qualcommax/patches-6.6/0603-1-qca-nss-clients-add-qdisc-support.patch
+++ b/target/linux/qualcommax/patches-6.6/0603-1-qca-nss-clients-add-qdisc-support.patch
@@ -52,7 +52,7 @@
  	dev->needs_free_netdev = true;
 --- a/include/linux/netdevice.h
 +++ b/include/linux/netdevice.h
-@@ -4693,6 +4693,15 @@ void dev_uc_flush(struct net_device *dev
+@@ -4708,6 +4708,15 @@ void dev_uc_flush(struct net_device *dev
  void dev_uc_init(struct net_device *dev);
  
  /**
@@ -68,7 +68,7 @@
   *  __dev_uc_sync - Synchonize device's unicast list
   *  @dev:  device to sync
   *  @sync: function to call if address should be added
-@@ -5237,6 +5246,11 @@ static inline bool netif_is_failover_sla
+@@ -5252,6 +5261,11 @@ static inline bool netif_is_failover_sla
  	return dev->priv_flags & IFF_FAILOVER_SLAVE;
  }
  
@@ -341,7 +341,7 @@
  
  struct Qdisc *qdisc_lookup_rcu(struct net_device *dev, u32 handle)
  {
-@@ -2390,4 +2391,26 @@ static int __init pktsched_init(void)
+@@ -2395,4 +2396,26 @@ static int __init pktsched_init(void)
  	return 0;
  }
  
@@ -370,7 +370,7 @@
  subsys_initcall(pktsched_init);
 --- a/net/sched/sch_generic.c
 +++ b/net/sched/sch_generic.c
-@@ -1074,6 +1074,7 @@ static void __qdisc_destroy(struct Qdisc
+@@ -1083,6 +1083,7 @@ static void __qdisc_destroy(struct Qdisc
  
  	call_rcu(&qdisc->rcu, qdisc_free_cb);
  }
@@ -431,7 +431,7 @@
  /* Reset all TX qdiscs greater than index of a device.  */
  static inline void qdisc_reset_all_tx_gt(struct net_device *dev, unsigned int i)
  {
-@@ -1324,4 +1361,9 @@ static inline void qdisc_synchronize(con
+@@ -1323,4 +1360,9 @@ static inline void qdisc_synchronize(con
  		msleep(1);
  }
  
diff --git a/target/linux/qualcommax/patches-6.6/0604-1-qca-add-mcs-support.patch b/target/linux/qualcommax/patches-6.6/0604-1-qca-add-mcs-support.patch
index bbac5a709c4156..8c0c601423a2b7 100644
--- a/target/linux/qualcommax/patches-6.6/0604-1-qca-add-mcs-support.patch
+++ b/target/linux/qualcommax/patches-6.6/0604-1-qca-add-mcs-support.patch
@@ -47,7 +47,7 @@
  int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb);
  rx_handler_func_t *br_get_rx_handler(const struct net_device *dev);
  
-@@ -2269,4 +2270,14 @@ struct nd_msg *br_is_nd_neigh_msg(struct
+@@ -2270,4 +2271,14 @@ struct nd_msg *br_is_nd_neigh_msg(struct
  bool br_is_neigh_suppress_enabled(const struct net_bridge_port *p, u16 vid);
  #define __br_get(__hook, __default, __args ...) \
  		(__hook ? (__hook(__args)) : (__default)) /* QCA NSS ECM support */
diff --git a/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch b/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch
index 8c4c996b5b9baf..a686c323c31e17 100644
--- a/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch
+++ b/target/linux/qualcommax/patches-6.6/0981-1-qca-skb_recycler-support.patch
@@ -104,7 +104,7 @@
 +obj-$(CONFIG_SKB_RECYCLER) += skbuff_recycle.o
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -6047,10 +6047,16 @@ static int process_backlog(struct napi_s
+@@ -6051,10 +6051,16 @@ static int process_backlog(struct napi_s
  
  	napi->weight = READ_ONCE(dev_rx_weight);
  	while (again) {

From ba583c4a813ecf9c49b56c7602072af8d50be0fe Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Fri, 15 Nov 2024 18:50:56 -0500
Subject: [PATCH 222/225] ath11k_nss: Fix null pointer dereference in BSS
 transition handling

There is a null pointer bug caused by inconsistent handling of the
`ath11k_base` structure. Previously, functions accessing
`ar->ab` internally, assumed it was always valid. If `ar->ab` was
not properly initialized, this led to null pointer dereferences.

This patch resolves the issue by:
- Explicitly passing `struct ath11k_base *ab` to functions that
  require it, instead of relying on `ar->ab`.
- Replacing all instances of `ar->ab` with `ab` for direct access.

Patch by: Sebastian Gottschall <s.gottschall@dd-wrt.com>

Signed-off-by: Sean Khan <datapronix@protonmail.com>
(cherry picked from commit 1f6f55f9c737ece5e3d8156bbe280f84ea4bd480)
---
 .../999-900-bss-transition-handling.patch     | 97 ++++---------------
 1 file changed, 18 insertions(+), 79 deletions(-)

diff --git a/package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch b/package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch
index d7860ab3d012b9..1e70cacdc7883f 100644
--- a/package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch
+++ b/package/kernel/mac80211/patches/nss/ath11k/999-900-bss-transition-handling.patch
@@ -128,7 +128,7 @@
  }
  
 -static int ath11k_dbg_htt_ext_stats_parse(struct ath11k_base *ab,
-+static int ath11k_dbg_htt_ext_stats_parse(struct ath11k *ar,
++static int ath11k_dbg_htt_ext_stats_parse(struct ath11k_base *ab, struct ath11k *ar,
  					  u16 tag, u16 len, const void *tag_buf,
  					  void *user_data)
  {
@@ -137,7 +137,7 @@
  
  	len = FIELD_GET(HTT_T2H_EXT_STATS_INFO1_LENGTH, msg->info1);
 -	ret = ath11k_dp_htt_tlv_iter(ab, msg->data, len,
-+	ret = ath11k_dp_htt_tlv_iter(ar, msg->data, len,
++	ret = ath11k_dp_htt_tlv_iter(ab, ar, msg->data, len,
  				     ath11k_dbg_htt_ext_stats_parse,
  				     stats_req);
  	if (ret)
@@ -253,107 +253,46 @@
  }
  
 -static int ath11k_htt_tlv_ppdu_stats_parse(struct ath11k_base *ab,
-+static int ath11k_htt_tlv_ppdu_stats_parse(struct ath11k *ar,
++static int ath11k_htt_tlv_ppdu_stats_parse(struct ath11k_base *ab, struct ath11k *ar,
  					   u16 tag, u16 len, const void *ptr,
  					   void *data)
  {
-@@ -1441,7 +1441,7 @@ static int ath11k_htt_tlv_ppdu_stats_par
- 	switch (tag) {
- 	case HTT_PPDU_STATS_TAG_COMMON:
- 		if (len < sizeof(struct htt_ppdu_stats_common)) {
--			ath11k_warn(ab, "Invalid len %d for the tag 0x%x\n",
-+			ath11k_warn(ar->ab, "Invalid len %d for the tag 0x%x\n",
- 				    len, tag);
- 			return -EINVAL;
- 		}
-@@ -1470,7 +1470,7 @@ static int ath11k_htt_tlv_ppdu_stats_par
- 		break;
- 	case HTT_PPDU_STATS_TAG_USR_RATE:
- 		if (len < sizeof(struct htt_ppdu_stats_user_rate)) {
--			ath11k_warn(ab, "Invalid len %d for the tag 0x%x\n",
-+			ath11k_warn(ar->ab, "Invalid len %d for the tag 0x%x\n",
- 				    len, tag);
- 			return -EINVAL;
- 		}
-@@ -1489,7 +1489,7 @@ static int ath11k_htt_tlv_ppdu_stats_par
- 		break;
- 	case HTT_PPDU_STATS_TAG_USR_COMPLTN_COMMON:
- 		if (len < sizeof(struct htt_ppdu_stats_usr_cmpltn_cmn)) {
--			ath11k_warn(ab, "Invalid len %d for the tag 0x%x\n",
-+			ath11k_warn(ar->ab, "Invalid len %d for the tag 0x%x\n",
- 				    len, tag);
- 			return -EINVAL;
- 		}
-@@ -1510,7 +1510,7 @@ static int ath11k_htt_tlv_ppdu_stats_par
- 	case HTT_PPDU_STATS_TAG_USR_COMPLTN_ACK_BA_STATUS:
- 		if (len <
- 		    sizeof(struct htt_ppdu_stats_usr_cmpltn_ack_ba_status)) {
--			ath11k_warn(ab, "Invalid len %d for the tag 0x%x\n",
-+			ath11k_warn(ar->ab, "Invalid len %d for the tag 0x%x\n",
- 				    len, tag);
- 			return -EINVAL;
- 		}
-@@ -1533,7 +1533,7 @@ static int ath11k_htt_tlv_ppdu_stats_par
- 		break;
- 	case HTT_PPDU_STATS_TAG_USR_COMMON:
- 		if (len < sizeof(struct htt_ppdu_stats_user_common)) {
--			ath11k_warn(ab, "Invalid len %d for the tag 0x%x\n",
-+			ath11k_warn(ar->ab, "Invalid len %d for the tag 0x%x\n",
- 				    len, tag);
- 			return -EINVAL;
- 		}
-@@ -1558,23 +1558,22 @@ static int ath11k_htt_tlv_ppdu_stats_par
+@@ -1558,10 +1558,9 @@ static int ath11k_htt_tlv_ppdu_stats_par
  	return 0;
  }
  
 -static void ath11k_dp_ppdu_stats_flush_tlv_parse(struct ath11k_base *ab,
-+static void ath11k_dp_ppdu_stats_flush_tlv_parse(struct ath11k *ar,
++static void ath11k_dp_ppdu_stats_flush_tlv_parse(struct ath11k_base *ab, struct ath11k *ar,
  					  struct htt_ppdu_stats_cmpltn_flush *msg)
  {
 -	struct ath11k *ar;
  	struct ieee80211_sta *sta;
  	struct ath11k_sta *arsta;
  	struct ath11k_peer *peer = NULL;
- 	struct ieee80211_tx_status status;
- 	struct ieee80211_rate_status status_rate = { 0 };
- 
--	if (!ab->nss.mesh_nss_offload_enabled)
-+	if (!ar->ab->nss.mesh_nss_offload_enabled)
- 		return;
- 
+@@ -1574,7 +1573,7 @@ static void ath11k_dp_ppdu_stats_flush_t
  	rcu_read_lock();
  
--	spin_lock_bh(&ab->base_lock);
+ 	spin_lock_bh(&ab->base_lock);
 -	peer = ath11k_peer_find_by_id(ab, msg->sw_peer_id);
-+	spin_lock_bh(&ar->ab->base_lock);
 +	peer = ath11k_peer_find_by_id(ar, msg->sw_peer_id);
  	if (!peer)
  		goto exit;
  
-@@ -1599,22 +1598,22 @@ static void ath11k_dp_ppdu_stats_flush_t
- 	ieee80211s_update_metric_ppdu(ar->hw, &status);
- 
- exit:
--	spin_unlock_bh(&ab->base_lock);
-+	spin_unlock_bh(&ar->ab->base_lock);
+@@ -1603,7 +1602,7 @@ exit:
  	rcu_read_unlock();
  }
  
 -static int ath11k_htt_tlv_ppdu_soc_stats_parse(struct ath11k_base *ab,
-+static int ath11k_htt_tlv_ppdu_soc_stats_parse(struct ath11k *ar,
++static int ath11k_htt_tlv_ppdu_soc_stats_parse(struct ath11k_base *ab, struct ath11k *ar,
  					       u16 tag, u16 len, const void *ptr,
  					       void *data)
  {
- 	switch (tag) {
- 	case HTT_PPDU_STATS_TAG_USR_COMPLTN_FLUSH:
- 		if (len < sizeof(struct htt_ppdu_stats_cmpltn_flush)) {
--			ath11k_warn(ab, "Invalid len %d for the tag 0x%x\n",
-+			ath11k_warn(ar->ab, "Invalid len %d for the tag 0x%x\n",
+@@ -1614,7 +1613,7 @@ static int ath11k_htt_tlv_ppdu_soc_stats
  				    len, tag);
  			return -EINVAL;
  		}
 -		ath11k_dp_ppdu_stats_flush_tlv_parse(ab, (struct htt_ppdu_stats_cmpltn_flush *)ptr);
-+		ath11k_dp_ppdu_stats_flush_tlv_parse(ar, (struct htt_ppdu_stats_cmpltn_flush *)ptr);
++		ath11k_dp_ppdu_stats_flush_tlv_parse(ab, ar, (struct htt_ppdu_stats_cmpltn_flush *)ptr);
  		break;
  	default:
  		break;
@@ -372,8 +311,8 @@
  
 -int ath11k_dp_htt_tlv_iter(struct ath11k_base *ab, const void *ptr, size_t len,
 -			   int (*iter)(struct ath11k_base *ar, u16 tag, u16 len,
-+int ath11k_dp_htt_tlv_iter(struct ath11k *ar, const void *ptr, size_t len,
-+			   int (*iter)(struct ath11k *ar, u16 tag, u16 len,
++int ath11k_dp_htt_tlv_iter(struct ath11k_base *ab, struct ath11k *ar, const void *ptr, size_t len,
++			   int (*iter)(struct ath11k_base *ab, struct ath11k *ar, u16 tag, u16 len,
  				       const void *ptr, void *data),
  			   void *data)
  {
@@ -397,7 +336,7 @@
  		}
  
 -		ret = iter(ab, tlv_tag, tlv_len, ptr, ppdu_info);
-+		ret = iter(ar, tlv_tag, tlv_len, ptr, ppdu_info);
++		ret = iter(ab, ar, tlv_tag, tlv_len, ptr, ppdu_info);
  		if (ret == -ENOMEM)
  			return ret;
  
@@ -424,7 +363,7 @@
  
  	if (pdev_id == 0) {
 -		ret = ath11k_dp_htt_tlv_iter(ab, msg->data, len,
-+		ret = ath11k_dp_htt_tlv_iter(ar, msg->data, len,
++		ret = ath11k_dp_htt_tlv_iter(ab, ar, msg->data, len,
  					     ath11k_htt_tlv_ppdu_soc_stats_parse,
  					     NULL);
  		if (ret)
@@ -433,7 +372,7 @@
  
  	ppdu_info->ppdu_id = ppdu_id;
 -	ret = ath11k_dp_htt_tlv_iter(ab, msg->data, len,
-+	ret = ath11k_dp_htt_tlv_iter(ar, msg->data, len,
++	ret = ath11k_dp_htt_tlv_iter(ab, ar, msg->data, len,
  				     ath11k_htt_tlv_ppdu_stats_parse,
  				     (void *)ppdu_info);
  	if (ret) {
@@ -647,8 +586,8 @@
  			       u32 *buf_id);
 -int ath11k_dp_htt_tlv_iter(struct ath11k_base *ab, const void *ptr, size_t len,
 -			   int (*iter)(struct ath11k_base *ar, u16 tag, u16 len,
-+int ath11k_dp_htt_tlv_iter(struct ath11k *ar, const void *ptr, size_t len,
-+			   int (*iter)(struct ath11k *ar, u16 tag, u16 len,
++int ath11k_dp_htt_tlv_iter(struct ath11k_base *ab, struct ath11k *ar, const void *ptr, size_t len,
++			   int (*iter)(struct ath11k_base *ab, struct ath11k *ar, u16 tag, u16 len,
  				       const void *ptr, void *data),
  			   void *data);
  int ath11k_dp_rx_process_mon_rings(struct ath11k_base *ab, int mac_id,

From 57a2f05223ac8bc927fa61b6b3caa63821a5921b Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Wed, 20 Nov 2024 17:27:52 -0500
Subject: [PATCH 223/225] nss-setup: switch to using apk package manager

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 nss-setup/config-nss.seed | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/nss-setup/config-nss.seed b/nss-setup/config-nss.seed
index db499bda7cb364..c58dbcc232d874 100644
--- a/nss-setup/config-nss.seed
+++ b/nss-setup/config-nss.seed
@@ -100,10 +100,6 @@ CONFIG_TARGET_OPTIONS=y
 CONFIG_TARGET_OPTIMIZATION="-O2 -pipe -mcpu=cortex-a53+crc+crypto"
 CONFIG_USE_GC_SECTIONS=y
 
-# If your device supports USB and plan on installing packages via opkg
-# Use a USB device, as these devices have limited storage and you avoid wearing out the internal flash.
-# We update the PATH to include the USB device. '/opt' is a common mount point.
-CONFIG_TARGET_INIT_PATH="/usr/sbin:/usr/bin:/sbin:/bin:/opt/usr/bin:/opt/bin:/opt/sbin:/opt/usr/sbin"
 
 # Kernel Config
 CONFIG_COLLECT_KERNEL_DEBUG=y
@@ -151,7 +147,8 @@ CONFIG_ZSTD_OPTIMIZE_O3=y
 #####################################################################
 # Feeds Configuration
 #####################################################################
-# Prevent opkg from adding custom feeds to /etc/opkg/distfeeds.conf in the final image.
+# Prevent package manager from adding custom feeds as repositories in final image.
+# They don't exist upstream and will cause errors when trying to update
 CONFIG_FEED_nss_packages=n
 CONFIG_FEED_sqm_scripts_nss=n
 
@@ -169,8 +166,8 @@ CONFIG_PACKAGE_luci-ssl-openssl=y
 #####################################################################
 # - Firewall: Manage firewall rules via LUCI.
 CONFIG_PACKAGE_luci-app-firewall=y
-# - OPKG: Package manager for OpenWRT, manage installed packages via LUCI.
-CONFIG_PACKAGE_luci-app-opkg=y
+# - Package manager for OpenWRT, manage installed packages via LUCI.
+CONFIG_PACKAGE_luci-app-package-manager=y
 
 # - iperf3: CLI tool to measure network performance.
 #           This is essential to test WiFi speeds,

From 2dbb073908bebe7a2597dc5d57706dea9c04c065 Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Wed, 20 Nov 2024 17:31:02 -0500
Subject: [PATCH 224/225] ath11k_nss: nss_diag: check for opkg/apk

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 package/kernel/mac80211/files/nss_diag.sh | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/package/kernel/mac80211/files/nss_diag.sh b/package/kernel/mac80211/files/nss_diag.sh
index d3bee1978b9145..34ee50f5ab0726 100644
--- a/package/kernel/mac80211/files/nss_diag.sh
+++ b/package/kernel/mac80211/files/nss_diag.sh
@@ -73,8 +73,21 @@ done
 
 echo -e "${reset}"
 echo -ne "${bold}${red}  NSS PKGS${reset}: ${white}"
-opkg list-installed | awk -v count=0 '
-  /kmod-qca-nss|^nss/ {
+
+if cmd=$(command -v apk) > /dev/null; then
+  flags="list -I"
+else
+  cmd=$(command -v opkg)
+  flags="list-installed"
+fi
+
+if [ -z "$cmd" ]; then
+  echo -e "${red}No package manager found${reset}"
+  exit 1
+fi
+
+$cmd $flags | awk -v count=0 '
+  /kmod-qca|^nss/ {
   if(count>0) tab="            "
   print tab $0
   count++

From dbb4a1128ccebca9af6cbae1ed434f9a0a61eaab Mon Sep 17 00:00:00 2001
From: Sean Khan <datapronix@protonmail.com>
Date: Wed, 20 Nov 2024 17:38:36 -0500
Subject: [PATCH 225/225] ath11k_nss: Refresh patches against rebase 53eab61

Author:     Felix Fietkau <nbd@nbd.name>
AuthorDate: Mon Nov 18 11:21:02 2024 +0100
Commit:     Felix Fietkau <nbd@nbd.name>
CommitDate: Mon Nov 18 11:44:44 2024 +0100

    mac80211: backport some upstream fixes

    Fix various issues, including potential crashes

    Signed-off-by: Felix Fietkau <nbd@nbd.name>

Signed-off-by: Sean Khan <datapronix@protonmail.com>
---
 .../199-001-mac80211-add-nss-support.patch    | 22 +++++++++----------
 ...03-mac80211-ath11k-fw-dynamic-muedca.patch |  6 ++---
 ...07-mac80211-add-nss-redirect-support.patch |  8 +++----
 ...N-iftype-support-on-NSS-offload-case.patch | 12 +++++-----
 ...-dynamic-VLAN-support-on-NSS-offload.patch |  4 ++--
 .../300-ath11k-nss-mesh-offload-support.patch |  8 +++----
 ...TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch |  4 ++--
 ...rning-with-monitor-interface-restart.patch |  2 +-
 ...ncapsulation-of-EAPOL-frames-if-OFFL.patch |  2 +-
 ...se-HW-checksum-offload-only-for-ethm.patch |  2 +-
 ...1-Add-mac-hw-flag-to-avoid-queue-skb.patch |  6 ++---
 ...75-wifi-mac80211-Changes-for-WDS-MLD.patch | 12 +++++-----
 ...x-NULL-pointer-access-Klocwork-issue.patch |  8 +++----
 13 files changed, 48 insertions(+), 48 deletions(-)

diff --git a/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch b/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch
index 9325a083e4683e..495b034687242b 100644
--- a/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/199-001-mac80211-add-nss-support.patch
@@ -82,7 +82,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   *	from the RX info data, so leave those zeroed when building this data)
   * @RX_FLAG_RADIOTAP_HE_MU: HE MU radiotap data is present
   *	(&struct ieee80211_radiotap_he_mu)
-@@ -2124,6 +2140,16 @@ static inline bool lockdep_vif_wiphy_mut
+@@ -2127,6 +2143,16 @@ static inline bool lockdep_vif_wiphy_mut
  			      lockdep_vif_wiphy_mutex_held(vif))
  
  /**
@@ -99,7 +99,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   * enum ieee80211_key_flags - key flags
   *
   * These flags are used for communication about keys between the driver
-@@ -2827,6 +2853,8 @@ struct ieee80211_txq {
+@@ -2830,6 +2856,8 @@ struct ieee80211_txq {
   *	implements MLO, so operation can continue on other links when one
   *	link is switching.
   *
@@ -108,7 +108,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
   */
  enum ieee80211_hw_flags {
-@@ -2887,6 +2915,7 @@ enum ieee80211_hw_flags {
+@@ -2890,6 +2918,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_DISALLOW_PUNCTURING,
  	IEEE80211_HW_DISALLOW_PUNCTURING_5GHZ,
  	IEEE80211_HW_HANDLES_QUIET_CSA,
@@ -116,7 +116,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  
  	/* keep last, obviously */
  	NUM_IEEE80211_HW_FLAGS
-@@ -3902,6 +3931,10 @@ struct ieee80211_prep_tx_info {
+@@ -3905,6 +3934,10 @@ struct ieee80211_prep_tx_info {
   *	non-MLO connections.
   *	The callback can sleep.
   *
@@ -127,7 +127,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   * @prepare_multicast: Prepare for multicast filter configuration.
   *	This callback is optional, and its return value is passed
   *	to configure_filter(). This callback must be atomic.
-@@ -4464,7 +4497,9 @@ struct ieee80211_ops {
+@@ -4467,7 +4500,9 @@ struct ieee80211_ops {
  				  struct ieee80211_vif *vif,
  				  struct ieee80211_bss_conf *info,
  				  u64 changed);
@@ -138,7 +138,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	int (*start_ap)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			struct ieee80211_bss_conf *link_conf);
  	void (*stop_ap)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-@@ -4774,7 +4809,7 @@ struct ieee80211_ops {
+@@ -4777,7 +4812,7 @@ struct ieee80211_ops {
  	int (*reset_tid_config)(struct ieee80211_hw *hw,
  				struct ieee80211_vif *vif,
  				struct ieee80211_sta *sta, u8 tids);
@@ -184,7 +184,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
   * the suspend->resume cycle. Since we can't check each caller
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -414,6 +414,17 @@ void ieee80211_link_info_change_notify(s
+@@ -416,6 +416,17 @@ void ieee80211_link_info_change_notify(s
  	drv_link_info_changed(local, sdata, link->conf, link->link_id, changed);
  }
  
@@ -202,7 +202,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  u64 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata)
  {
  	sdata->vif.bss_conf.use_cts_prot = false;
-@@ -852,12 +863,6 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+@@ -854,12 +865,6 @@ struct ieee80211_hw *ieee80211_alloc_hw_
  			   NL80211_FEATURE_FULL_AP_CLIENT_STATE;
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_FILS_STA);
  	wiphy_ext_feature_set(wiphy,
@@ -215,7 +215,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  			      NL80211_EXT_FEATURE_SCAN_FREQ_KHZ);
  	wiphy_ext_feature_set(wiphy,
  			      NL80211_EXT_FEATURE_POWERED_ADDR_CHANGE);
-@@ -1185,6 +1190,18 @@ int ieee80211_register_hw(struct ieee802
+@@ -1187,6 +1192,18 @@ int ieee80211_register_hw(struct ieee802
  			return -EINVAL;
  	}
  
@@ -375,7 +375,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  {
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1860,6 +1860,8 @@ void ieee80211_vif_cfg_change_notify(str
+@@ -1861,6 +1861,8 @@ void ieee80211_vif_cfg_change_notify(str
  void ieee80211_link_info_change_notify(struct ieee80211_sub_if_data *sdata,
  				       struct ieee80211_link_data *link,
  				       u64 changed);
@@ -427,7 +427,7 @@ Signed-off-by: Sriram R <srirrama@codeaurora.org>
  	TP_PROTO(struct ieee80211_local *local,
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -991,7 +991,8 @@ static bool ieee80211_set_sdata_offload_
+@@ -986,7 +986,8 @@ static bool ieee80211_set_sdata_offload_
  		    local->hw.wiphy->frag_threshold != (u32)-1)
  			flags &= ~IEEE80211_OFFLOAD_ENCAP_ENABLED;
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch b/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
index fdd9f709c9a177..7800bad4423e04 100644
--- a/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/203-mac80211-ath11k-fw-dynamic-muedca.patch
@@ -31,7 +31,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
 
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -9722,4 +9722,15 @@ ssize_t wiphy_locked_debugfs_write(struc
+@@ -9766,4 +9766,15 @@ ssize_t wiphy_locked_debugfs_write(struc
  				   void *data);
  #endif
  
@@ -49,7 +49,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  #endif /* __NET_CFG80211_H */
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -7563,6 +7563,20 @@ u32 ieee80211_calc_rx_airtime(struct iee
+@@ -7566,6 +7566,20 @@ u32 ieee80211_calc_rx_airtime(struct iee
  			      int len);
  
  /**
@@ -166,7 +166,7 @@ Signed-off-by: Muna Sinada <msinada@codeaurora.org>
  	[NL80211_ATTR_BSS_DUMP_INCLUDE_USE_DATA] = { .type = NLA_FLAG },
  	[NL80211_ATTR_MLO_TTLM_DLINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
  	[NL80211_ATTR_MLO_TTLM_ULINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
-@@ -20446,6 +20447,42 @@ void cfg80211_schedule_channels_check(st
+@@ -20442,6 +20443,42 @@ void cfg80211_schedule_channels_check(st
  }
  EXPORT_SYMBOL(cfg80211_schedule_channels_check);
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch b/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
index f462df6248b8f8..cf8ecba3c5de42 100644
--- a/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/207-mac80211-add-nss-redirect-support.patch
@@ -40,7 +40,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  
  extern const struct cfg80211_ops mac80211_config_ops;
  
-@@ -1185,6 +1188,9 @@ struct ieee80211_sub_if_data {
+@@ -1186,6 +1189,9 @@ struct ieee80211_sub_if_data {
  		struct dentry *default_beacon_key;
  	} debugfs;
  #endif
@@ -65,7 +65,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  /**
   * DOC: Interface list locking
   *
-@@ -781,6 +787,13 @@ static int ieee80211_stop(struct net_dev
+@@ -776,6 +782,13 @@ static int ieee80211_stop(struct net_dev
  		ieee80211_stop_mbssid(sdata);
  	}
  
@@ -79,7 +79,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  	wiphy_lock(sdata->local->hw.wiphy);
  	wiphy_work_cancel(sdata->local->hw.wiphy, &sdata->activate_links_work);
  
-@@ -1232,6 +1245,34 @@ void ieee80211_del_virtual_monitor(struc
+@@ -1227,6 +1240,34 @@ void ieee80211_del_virtual_monitor(struc
  	kfree(sdata);
  }
  
@@ -114,7 +114,7 @@ Signed-off-by: Sowmiya Sree Elavalagan <ssreeela@codeaurora.org>
  /*
   * NOTE: Be very careful when changing this function, it must NOT return
   * an error on interface type changes that have been pre-checked, so most
-@@ -1460,6 +1501,21 @@ int ieee80211_do_open(struct wireless_de
+@@ -1457,6 +1498,21 @@ int ieee80211_do_open(struct wireless_de
  
  	ieee80211_recalc_ps(local);
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch b/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
index 86c9c37333a0d0..b1ec5d17770af8 100644
--- a/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/235-001-mac80211-add-AP_VLAN-iftype-support-on-NSS-offload-case.patch
@@ -21,7 +21,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -5273,6 +5273,17 @@ void ieee80211_sta_pspoll(struct ieee802
+@@ -5276,6 +5276,17 @@ void ieee80211_sta_pspoll(struct ieee802
   */
  void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *sta, u8 tid);
  
@@ -74,7 +74,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	trace_drv_add_interface(local, sdata);
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -702,6 +702,9 @@ static void ieee80211_do_stop(struct iee
+@@ -697,6 +697,9 @@ static void ieee80211_do_stop(struct iee
  
  	switch (sdata->vif.type) {
  	case NL80211_IFTYPE_AP_VLAN:
@@ -84,7 +84,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		break;
  	case NL80211_IFTYPE_MONITOR:
  		if (local->monitors == 0)
-@@ -982,6 +985,7 @@ static bool ieee80211_iftype_supports_hd
+@@ -977,6 +980,7 @@ static bool ieee80211_iftype_supports_hd
  	switch (iftype) {
  	/* P2P GO and client are mapped to AP/STATION types */
  	case NL80211_IFTYPE_AP:
@@ -92,7 +92,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  	case NL80211_IFTYPE_STATION:
  		return true;
  	default:
-@@ -1036,7 +1040,8 @@ static void ieee80211_set_vif_encap_ops(
+@@ -1031,7 +1035,8 @@ static void ieee80211_set_vif_encap_ops(
  	struct ieee80211_sub_if_data *bss = sdata;
  	bool enabled;
  
@@ -102,8 +102,8 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
  		if (!sdata->bss)
  			return;
  
-@@ -1368,10 +1373,17 @@ int ieee80211_do_open(struct wireless_de
- 
+@@ -1365,10 +1370,17 @@ int ieee80211_do_open(struct wireless_de
+ 				(sdata->u.mntr.flags & MONITOR_FLAG_ACTIVE);
  	switch (sdata->vif.type) {
  	case NL80211_IFTYPE_AP_VLAN:
 -		/* no need to tell driver, but set carrier and chanctx */
diff --git a/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch b/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
index c08d15ac6f0cc0..4e16510932bd46 100644
--- a/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/236-001-mac80211-add-dynamic-VLAN-support-on-NSS-offload.patch
@@ -24,7 +24,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2224,6 +2224,8 @@ enum ieee80211_key_flags {
+@@ -2227,6 +2227,8 @@ enum ieee80211_key_flags {
   * @tx_pn: PN used for TX keys, may be used by the driver as well if it
   *	needs to do software PN assignment by itself (e.g. due to TSO)
   * @flags: key flags, see &enum ieee80211_key_flags.
@@ -33,7 +33,7 @@ Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
   * @keyidx: the key index (0-3)
   * @keylen: key material length
   * @key: key material. For ALG_TKIP the key is encoded as a 256-bit (32 byte)
-@@ -2243,6 +2245,7 @@ struct ieee80211_key_conf {
+@@ -2246,6 +2248,7 @@ struct ieee80211_key_conf {
  	u8 hw_key_idx;
  	s8 keyidx;
  	u16 flags;
diff --git a/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch b/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
index 9d960895afb644..76743390fc087f 100644
--- a/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/300-ath11k-nss-mesh-offload-support.patch
@@ -112,7 +112,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  };
  
  
-@@ -2919,6 +2939,7 @@ enum ieee80211_hw_flags {
+@@ -2922,6 +2942,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_DISALLOW_PUNCTURING_5GHZ,
  	IEEE80211_HW_HANDLES_QUIET_CSA,
  	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
@@ -120,7 +120,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  
  	/* keep last, obviously */
  	NUM_IEEE80211_HW_FLAGS
-@@ -4427,6 +4448,8 @@ struct ieee80211_prep_tx_info {
+@@ -4430,6 +4451,8 @@ struct ieee80211_prep_tx_info {
   * @set_sar_specs: Update the SAR (TX power) settings.
   * @sta_set_decap_offload: Called to notify the driver when a station is allowed
   *	to use rx decapsulation offload
@@ -129,7 +129,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
   * @add_twt_setup: Update hw with TWT agreement parameters received from the peer.
   *	This callback allows the hw to check if requested parameters
   *	are supported and if there is enough room for a new agreement.
-@@ -4821,6 +4844,12 @@ struct ieee80211_ops {
+@@ -4824,6 +4847,12 @@ struct ieee80211_ops {
  	void (*sta_set_decap_offload)(struct ieee80211_hw *hw,
  				      struct ieee80211_vif *vif,
  				      struct ieee80211_sta *sta, bool enabled);
@@ -142,7 +142,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
  	void (*add_twt_setup)(struct ieee80211_hw *hw,
  			      struct ieee80211_sta *sta,
  			      struct ieee80211_twt_setup *twt);
-@@ -7728,4 +7757,100 @@ int ieee80211_emulate_switch_vif_chanctx
+@@ -7731,4 +7760,100 @@ int ieee80211_emulate_switch_vif_chanctx
  					 int n_vifs,
  					 enum ieee80211_chanctx_switch_mode mode);
  
diff --git a/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch b/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
index c9b07a95606aba..49ab2a064eaa00 100644
--- a/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/335-0003-ath11k-skip-HAL_TCL_DATA_CMD_INFO2_TID_OVERWRITE-con.patch
@@ -16,7 +16,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2878,6 +2878,8 @@ struct ieee80211_txq {
+@@ -2881,6 +2881,8 @@ struct ieee80211_txq {
   *
   *  @IEEE80211_HW_SUPPORTS_NSS_OFFLOAD: Hardware/driver supports NSS offload
   *
@@ -25,7 +25,7 @@ Signed-off-by: Gautham Kumar Senthilkumaran <quic_gauthamk@quicinc.com>
   * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
   */
  enum ieee80211_hw_flags {
-@@ -2940,6 +2942,7 @@ enum ieee80211_hw_flags {
+@@ -2943,6 +2945,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_HANDLES_QUIET_CSA,
  	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
  	IEEE80211_HW_SUPPORTS_MESH_NSS_OFFLOAD,
diff --git a/package/kernel/mac80211/patches/nss/subsys/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch b/package/kernel/mac80211/patches/nss/subsys/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch
index 4d4c788b7e1ea7..8579a4c10d33d5 100644
--- a/package/kernel/mac80211/patches/nss/subsys/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/353-mac80211-fix-dynamic-vlan-warning-with-monitor-interface-restart.patch
@@ -21,7 +21,7 @@ Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
 
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -1020,7 +1020,8 @@ static bool ieee80211_set_sdata_offload_
+@@ -1015,7 +1015,8 @@ static bool ieee80211_set_sdata_offload_
  		flags |= IEEE80211_OFFLOAD_DECAP_ENABLED;
  
  		if (local->monitors &&
diff --git a/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch b/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
index 080634bcf7e5f1..4e4e7885108bfa 100644
--- a/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/657-mac80211-Avoid-encapsulation-of-EAPOL-frames-if-OFFL.patch
@@ -20,7 +20,7 @@ Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com>
 
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -2081,6 +2081,11 @@ netdev_tx_t ieee80211_subif_start_xmit(s
+@@ -2083,6 +2083,11 @@ netdev_tx_t ieee80211_subif_start_xmit(s
  				       struct net_device *dev);
  netdev_tx_t ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
  					    struct net_device *dev);
diff --git a/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch b/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
index c20c795fdaba99..d2a558ad2f7458 100644
--- a/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/780-mac80211-Advertise-HW-checksum-offload-only-for-ethm.patch
@@ -78,7 +78,7 @@ Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
  
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -2273,6 +2273,10 @@ int ieee80211_if_add(struct ieee80211_lo
+@@ -2270,6 +2270,10 @@ int ieee80211_if_add(struct ieee80211_lo
  
  		ndev->features |= local->hw.netdev_features;
  		ndev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
diff --git a/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch b/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
index 4a47aa2d9a2f65..8e6e9ca32ed64b 100644
--- a/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/785-wifi-mac80211-Add-mac-hw-flag-to-avoid-queue-skb.patch
@@ -23,7 +23,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2879,6 +2879,9 @@ struct ieee80211_txq {
+@@ -2882,6 +2882,9 @@ struct ieee80211_txq {
   *
   * @IEEE80211_HW_SUPPORTS_TID_CLASS_OFFLOAD: Hardware suports tid calssification offload.
   *
@@ -33,7 +33,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
   * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
   */
  enum ieee80211_hw_flags {
-@@ -2942,6 +2945,7 @@ enum ieee80211_hw_flags {
+@@ -2945,6 +2948,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_SUPPORTS_NSS_OFFLOAD,
  	IEEE80211_HW_SUPPORTS_MESH_NSS_OFFLOAD,
  	IEEE80211_HW_SUPPORTS_TID_CLASS_OFFLOAD,
@@ -135,7 +135,7 @@ Signed-off-by: Yuvasree Sivasankaran <quic_ysivasan@quicinc.com>
  
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -1001,7 +1001,10 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+@@ -1003,7 +1003,10 @@ struct ieee80211_hw *ieee80211_alloc_hw_
  		atomic_set(&local->agg_queue_stop[i], 0);
  	}
  	tasklet_setup(&local->tx_pending_tasklet, ieee80211_tx_pending);
diff --git a/package/kernel/mac80211/patches/nss/subsys/999-775-wifi-mac80211-Changes-for-WDS-MLD.patch b/package/kernel/mac80211/patches/nss/subsys/999-775-wifi-mac80211-Changes-for-WDS-MLD.patch
index 59da8e96e22da4..312484631694e0 100644
--- a/package/kernel/mac80211/patches/nss/subsys/999-775-wifi-mac80211-Changes-for-WDS-MLD.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/999-775-wifi-mac80211-Changes-for-WDS-MLD.patch
@@ -17,7 +17,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
 
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -8827,6 +8827,7 @@ bool cfg80211_rx_spurious_frame(struct n
+@@ -8871,6 +8871,7 @@ bool cfg80211_rx_spurious_frame(struct n
   * @dev: The device the frame matched to
   * @addr: the transmitter address
   * @gfp: context flags
@@ -25,7 +25,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
   *
   * This function is used in AP mode (only!) to inform userspace that
   * an associated station sent a 4addr frame but that wasn't expected.
-@@ -8836,7 +8837,8 @@ bool cfg80211_rx_spurious_frame(struct n
+@@ -8880,7 +8881,8 @@ bool cfg80211_rx_spurious_frame(struct n
   * for a reason other than not having a subscription.)
   */
  bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
@@ -127,7 +127,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -18995,7 +18995,8 @@ void cfg80211_conn_failed(struct net_dev
+@@ -18991,7 +18991,8 @@ void cfg80211_conn_failed(struct net_dev
  EXPORT_SYMBOL(cfg80211_conn_failed);
  
  static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
@@ -137,7 +137,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  {
  	struct wireless_dev *wdev = dev->ieee80211_ptr;
  	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
-@@ -19021,6 +19022,9 @@ static bool __nl80211_unexpected_frame(s
+@@ -19017,6 +19018,9 @@ static bool __nl80211_unexpected_frame(s
  	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
  		goto nla_put_failure;
  
@@ -147,7 +147,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  	genlmsg_end(msg, hdr);
  	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
  	return true;
-@@ -19044,14 +19048,15 @@ bool cfg80211_rx_spurious_frame(struct n
+@@ -19040,14 +19044,15 @@ bool cfg80211_rx_spurious_frame(struct n
  		return false;
  	}
  	ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
@@ -165,7 +165,7 @@ Signed-off-by: Ramasamy Kaliappan <quic_rkaliapp@quicinc.com>
  {
  	struct wireless_dev *wdev = dev->ieee80211_ptr;
  	bool ret;
-@@ -19066,7 +19071,7 @@ bool cfg80211_rx_unexpected_4addr_frame(
+@@ -19062,7 +19067,7 @@ bool cfg80211_rx_unexpected_4addr_frame(
  	}
  	ret = __nl80211_unexpected_frame(dev,
  					 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
diff --git a/package/kernel/mac80211/patches/nss/subsys/999-918-mac80211-fix-NULL-pointer-access-Klocwork-issue.patch b/package/kernel/mac80211/patches/nss/subsys/999-918-mac80211-fix-NULL-pointer-access-Klocwork-issue.patch
index d3b895d5fb6786..5444178b10b5ad 100644
--- a/package/kernel/mac80211/patches/nss/subsys/999-918-mac80211-fix-NULL-pointer-access-Klocwork-issue.patch
+++ b/package/kernel/mac80211/patches/nss/subsys/999-918-mac80211-fix-NULL-pointer-access-Klocwork-issue.patch
@@ -20,7 +20,7 @@ Signed-off-by: Monika Korada <quic_koramoni@quicinc.com>
 
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -1376,7 +1376,8 @@ int ieee80211_do_open(struct wireless_de
+@@ -1373,7 +1373,8 @@ int ieee80211_do_open(struct wireless_de
  	case NL80211_IFTYPE_AP_VLAN:
  		if (sdata->bss->active) {
  			ieee80211_link_vlan_copy_chanctx(&sdata->deflink);
@@ -30,7 +30,7 @@ Signed-off-by: Monika Korada <quic_koramoni@quicinc.com>
  
  			if (ieee80211_hw_check(&local->hw, SUPPORTS_NSS_OFFLOAD)) {
  				ieee80211_set_sdata_offload_flags(sdata);
-@@ -1387,7 +1388,8 @@ int ieee80211_do_open(struct wireless_de
+@@ -1384,7 +1385,8 @@ int ieee80211_do_open(struct wireless_de
  
  			ieee80211_set_vif_encap_ops(sdata);
  		} else {
@@ -40,7 +40,7 @@ Signed-off-by: Monika Korada <quic_koramoni@quicinc.com>
  		}
  		break;
  	case NL80211_IFTYPE_MONITOR:
-@@ -1419,7 +1421,8 @@ int ieee80211_do_open(struct wireless_de
+@@ -1416,7 +1418,8 @@ int ieee80211_do_open(struct wireless_de
  		ieee80211_recalc_offload(local);
  		ieee80211_recalc_idle(local);
  
@@ -50,7 +50,7 @@ Signed-off-by: Monika Korada <quic_koramoni@quicinc.com>
  		break;
  	default:
  		if (coming_up) {
-@@ -1463,7 +1466,8 @@ int ieee80211_do_open(struct wireless_de
+@@ -1460,7 +1463,8 @@ int ieee80211_do_open(struct wireless_de
  		case NL80211_IFTYPE_AP:
  		case NL80211_IFTYPE_MESH_POINT:
  		case NL80211_IFTYPE_OCB: