mac80211: update to v6.1.24

Drop patches accepted upstream Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-04-16 04:13:31 +00:00 · 2023-04-17 17:17:16 +02:00 · 2023-04-17 17:17:16 +02:00 · 3167333946
commit 3167333946
parent 26f3634631
454 changed files with 14125 additions and 55601 deletions
--- a/package/kernel/ath10k-ct/patches/100-api_update.patch
+++ b/package/kernel/ath10k-ct/patches/100-api_update.patch
@ -1,29 +1,618 @@
 --- a/ath10k-5.15/mac.c
 +++ b/ath10k-5.15/mac.c
@@ -788,7 +788,7 @@ int ath10k_mac_vif_chan(struct ieee80211
 	struct ieee80211_chanctx_conf *conf;
 	rcu_read_lock();
 -	conf = rcu_dereference(vif->chanctx_conf);
 +	conf = rcu_dereference(vif->bss_conf.chanctx_conf);
 	if (!conf) {
 		rcu_read_unlock();
 		return -ENOENT;
@@ -1764,8 +1764,8 @@ static int ath10k_vdev_start_restart(str
 		arg.channel.chan_radar =
 			!!(chandef->chan->flags & IEEE80211_CHAN_RADAR);
 	} else if (arvif->vdev_type == WMI_VDEV_TYPE_IBSS) {
 -		arg.ssid = arvif->vif->bss_conf.ssid;
 -		arg.ssid_len = arvif->vif->bss_conf.ssid_len;
 +		arg.ssid = arvif->vif->cfg.ssid;
 +		arg.ssid_len = arvif->vif->cfg.ssid_len;
 	}
 	ath10k_dbg(ar, ATH10K_DBG_MAC,
@@ -1890,7 +1890,7 @@ static int ath10k_mac_setup_bcn_tmpl(str
 	    arvif->vdev_type != WMI_VDEV_TYPE_IBSS)
 		return 0;
 -	bcn = ieee80211_beacon_get_template(hw, vif, &offs);
 +	bcn = ieee80211_beacon_get_template(hw, vif, &offs, 0);
 	if (!bcn) {
 		ath10k_warn(ar, "failed to get beacon template from mac80211\n");
 		return -EPERM;
@@ -2083,8 +2083,7 @@ static void ath10k_control_beaconing(str
 }
 static void ath10k_control_ibss(struct ath10k_vif *arvif,
 -				struct ieee80211_bss_conf *info,
 -				const u8 self_peer[ETH_ALEN])
 +				struct ieee80211_vif *vif)
 {
 	struct ath10k *ar = arvif->ar;
 	u32 vdev_param;
@@ -2092,7 +2091,7 @@ static void ath10k_control_ibss(struct a
 	lockdep_assert_held(&arvif->ar->conf_mutex);
 -	if (!info->ibss_joined) {
 +	if (!vif->cfg.ibss_joined) {
 		if (is_zero_ether_addr(arvif->bssid))
 			return;
@@ -2298,7 +2297,7 @@ static void ath10k_mac_vif_ap_csa_count_
 	if (arvif->vdev_type != WMI_VDEV_TYPE_AP)
 		return;
 -	if (!vif->csa_active)
 +	if (!vif->bss_conf.csa_active)
 		return;
 	if (!arvif->is_up)
@@ -2433,7 +2432,7 @@ static void ath10k_peer_assoc_h_basic(st
 	lockdep_assert_held(&ar->conf_mutex);
 	if (vif->type == NL80211_IFTYPE_STATION)
 -		aid = vif->bss_conf.aid;
 +		aid = vif->cfg.aid;
 	else
 		aid = sta->aid;
@@ -2463,7 +2462,8 @@ static void ath10k_peer_assoc_h_crypto(s
 		return;
 	bss = cfg80211_get_bss(ar->hw->wiphy, def.chan, info->bssid,
 -			       info->ssid_len ? info->ssid : NULL, info->ssid_len,
 +			       vif->cfg.ssid_len ? vif->cfg.ssid : NULL,
 +			       vif->cfg.ssid_len,
 			       IEEE80211_BSS_TYPE_ANY, IEEE80211_PRIVACY_ANY);
 	if (bss) {
 		const struct cfg80211_bss_ies *ies;
@@ -2521,7 +2521,7 @@ static void ath10k_peer_assoc_h_rates(st
 	band = def.chan->band;
 	sband = ar->hw->wiphy->bands[band];
 -	ratemask = sta->supp_rates[band];
 +	ratemask = sta->deflink.supp_rates[band];
 	ratemask &= arvif->bitrate_mask.control[band].legacy;
 	rates = sband->bitrates;
@@ -2770,7 +2770,7 @@ static void ath10k_peer_assoc_h_ht(struc
 				   struct ieee80211_sta *sta,
 				   struct wmi_peer_assoc_complete_arg *arg)
 {
 -	const struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
 +	const struct ieee80211_sta_ht_cap *ht_cap = &sta->deflink.ht_cap;
 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
 	struct cfg80211_chan_def def;
 	enum nl80211_band band;
@@ -2814,7 +2814,7 @@ static void ath10k_peer_assoc_h_ht(struc
 	if (ht_cap->cap & IEEE80211_HT_CAP_LDPC_CODING)
 		arg->peer_flags |= ar->wmi.peer_flags->ldbc;
 -	if (sta->bandwidth >= IEEE80211_STA_RX_BW_40) {
 +	if (sta->deflink.bandwidth >= IEEE80211_STA_RX_BW_40) {
 		arg->peer_flags |= ar->wmi.peer_flags->bw40;
 		arg->peer_rate_caps |= WMI_RC_CW40_FLAG;
 	}
@@ -2883,7 +2883,7 @@ static void ath10k_peer_assoc_h_ht(struc
 			arg->peer_ht_rates.rates[i] = i;
 	} else {
 		arg->peer_ht_rates.num_rates = n;
 -		arg->peer_num_spatial_streams = min(sta->rx_nss, max_nss);
 +		arg->peer_num_spatial_streams = min(sta->deflink.rx_nss, max_nss);
 	}
 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac ht peer %pM mcs cnt %d nss %d\n",
@@ -3045,7 +3045,7 @@ static void ath10k_peer_assoc_h_vht(stru
 				    struct ieee80211_sta *sta,
 				    struct wmi_peer_assoc_complete_arg *arg)
 {
 -	const struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap;
 +	const struct ieee80211_sta_vht_cap *vht_cap = &sta->deflink.vht_cap;
 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
 	struct ath10k_hw_params *hw = &ar->hw_params;
 	struct cfg80211_chan_def def;
@@ -3087,10 +3087,10 @@ static void ath10k_peer_assoc_h_vht(stru
 				 (1U << (IEEE80211_HT_MAX_AMPDU_FACTOR +
 					ampdu_factor)) - 1);
 -	if (sta->bandwidth == IEEE80211_STA_RX_BW_80)
 +	if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_80)
 		arg->peer_flags |= ar->wmi.peer_flags->bw80;
 -	if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
 +	if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
 		arg->peer_flags |= ar->wmi.peer_flags->bw160;
 	/* Calculate peer NSS capability from VHT capabilities if STA
@@ -3104,7 +3104,7 @@ static void ath10k_peer_assoc_h_vht(stru
 		    vht_mcs_mask[i])
 			max_nss = i + 1;
 	}
 -	arg->peer_num_spatial_streams = min(sta->rx_nss, max_nss);
 +	arg->peer_num_spatial_streams = min(sta->deflink.rx_nss, max_nss);
 	arg->peer_vht_rates.rx_max_rate =
 		__le16_to_cpu(vht_cap->vht_mcs.rx_highest);
 	arg->peer_vht_rates.rx_mcs_set =
@@ -3266,7 +3266,7 @@ static bool ath10k_mac_sta_has_ofdm_only
 {
 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
 	u32 msk = arvif->bitrate_mask.control[NL80211_BAND_2GHZ].legacy &
 -		sta->supp_rates[NL80211_BAND_2GHZ];
 +		sta->deflink.supp_rates[NL80211_BAND_2GHZ];
 	/* We have 12 bits of legacy rates, first 4 are /b (CCK) rates. */
 	return (msk & 0xff0) && !(msk & 0xf);
 }
@@ -3276,7 +3276,7 @@ static bool ath10k_mac_sta_has_ofdm_and_
 {
 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
 	u32 msk = arvif->bitrate_mask.control[NL80211_BAND_2GHZ].legacy &
 -		sta->supp_rates[NL80211_BAND_2GHZ];
 +		sta->deflink.supp_rates[NL80211_BAND_2GHZ];
 	/* We have 12 bits of legacy rates, first 4 are /b (CCK) rates. */
 	return ((msk & 0xf) && (msk & 0xff0));
 }
@@ -3284,8 +3284,10 @@ static bool ath10k_mac_sta_has_ofdm_and_
 static enum wmi_phy_mode ath10k_mac_get_phymode_vht(struct ath10k *ar,
 						    struct ieee80211_sta *sta)
 {
 -	if (sta->bandwidth == IEEE80211_STA_RX_BW_160) {
 -		switch (sta->vht_cap.cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK) {
 +	struct ieee80211_sta_vht_cap *vht_cap = &sta->deflink.vht_cap;
 +
 +	if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160) {
 +		switch (vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK) {
 		case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ:
 			return MODE_11AC_VHT160;
 		case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ:
@@ -3296,13 +3298,13 @@ static enum wmi_phy_mode ath10k_mac_get_
 		}
 	}
 -	if (sta->bandwidth == IEEE80211_STA_RX_BW_80)
 +	if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_80)
 		return MODE_11AC_VHT80;
 -	if (sta->bandwidth == IEEE80211_STA_RX_BW_40)
 +	if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_40)
 		return MODE_11AC_VHT40;
 -	if (sta->bandwidth == IEEE80211_STA_RX_BW_20)
 +	if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_20)
 		return MODE_11AC_VHT20;
 	return MODE_UNKNOWN;
@@ -3329,15 +3331,15 @@ static void ath10k_peer_assoc_h_phymode(
 	switch (band) {
 	case NL80211_BAND_2GHZ:
 -		if (sta->vht_cap.vht_supported &&
 +		if (sta->deflink.vht_cap.vht_supported &&
 		    !ath10k_peer_assoc_h_vht_masked(vht_mcs_mask)) {
 -			if (sta->bandwidth == IEEE80211_STA_RX_BW_40)
 +			if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_40)
 				phymode = MODE_11AC_VHT40;
 			else
 				phymode = MODE_11AC_VHT20;
 -		} else if (sta->ht_cap.ht_supported &&
 +		} else if (sta->deflink.ht_cap.ht_supported &&
 			   !ath10k_peer_assoc_h_ht_masked(ht_mcs_mask)) {
 -			if (sta->bandwidth == IEEE80211_STA_RX_BW_40)
 +			if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_40)
 				phymode = MODE_11NG_HT40;
 			else
 				phymode = MODE_11NG_HT20;
@@ -3354,12 +3356,12 @@ static void ath10k_peer_assoc_h_phymode(
 		/*
 		 * Check VHT first.
 		 */
 -		if (sta->vht_cap.vht_supported &&
 +		if (sta->deflink.vht_cap.vht_supported &&
 		    !ath10k_peer_assoc_h_vht_masked(vht_mcs_mask)) {
 			phymode = ath10k_mac_get_phymode_vht(ar, sta);
 -		} else if (sta->ht_cap.ht_supported &&
 +		} else if (sta->deflink.ht_cap.ht_supported &&
 			   !ath10k_peer_assoc_h_ht_masked(ht_mcs_mask)) {
 -			if (sta->bandwidth >= IEEE80211_STA_RX_BW_40)
 +			if (sta->deflink.bandwidth >= IEEE80211_STA_RX_BW_40)
 				phymode = MODE_11NA_HT40;
 			else
 				phymode = MODE_11NA_HT20;
@@ -3373,8 +3375,8 @@ static void ath10k_peer_assoc_h_phymode(
 	}
 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac peer %pM phymode %s  legacy-supp-rates: 0x%x  arvif-legacy-rates: 0x%x vht-supp: %d\n",
 -		   sta->addr, ath10k_wmi_phymode_str(phymode), sta->supp_rates[band],
 -		   arvif->bitrate_mask.control[band].legacy, sta->vht_cap.vht_supported);
 +		   sta->addr, ath10k_wmi_phymode_str(phymode), sta->deflink.supp_rates[band],
 +		   arvif->bitrate_mask.control[band].legacy, sta->deflink.vht_cap.vht_supported);
 	arg->peer_phymode = phymode;
 	WARN_ON(phymode == MODE_UNKNOWN);
@@ -3677,8 +3679,8 @@ static void ath10k_bss_assoc(struct ieee
 	/* ap_sta must be accessed only within rcu section which must be left
 	 * before calling ath10k_setup_peer_smps() which might sleep.
 	 */
 -	ht_cap = ap_sta->ht_cap;
 -	vht_cap = ap_sta->vht_cap;
 +	ht_cap = ap_sta->deflink.ht_cap;
 +	vht_cap = ap_sta->deflink.vht_cap;
 	ret = ath10k_peer_assoc_prepare(ar, vif, ap_sta, &peer_arg);
 	if (ret) {
@@ -3713,11 +3715,11 @@ static void ath10k_bss_assoc(struct ieee
 	ath10k_dbg(ar, ATH10K_DBG_MAC,
 		   "mac vdev %d up (associated) bssid %pM aid %d bandwidth %d\n",
 -		   arvif->vdev_id, bss_conf->bssid, bss_conf->aid, ap_sta->bandwidth);
 +		   arvif->vdev_id, bss_conf->bssid, vif->cfg.aid, ap_sta->deflink.bandwidth);
 	WARN_ON(arvif->is_up);
 -	arvif->aid = bss_conf->aid;
 +	arvif->aid = vif->cfg.aid;
 	ether_addr_copy(arvif->bssid, bss_conf->bssid);
 	ret = ath10k_wmi_pdev_set_param(ar,
@@ -4022,7 +4024,7 @@ static int ath10k_station_assoc(struct a
 	 */
 	if (!reassoc) {
 		ret = ath10k_setup_peer_smps(ar, arvif, sta->addr,
 -					     &sta->ht_cap);
 +					     &sta->deflink.ht_cap);
 		if (ret) {
 			ath10k_warn(ar, "failed to setup peer SMPS for vdev %d: %d\n",
 				    arvif->vdev_id, ret);
@@ -6916,7 +6918,7 @@ static void ath10k_recalculate_mgmt_rate
 static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
 				    struct ieee80211_vif *vif,
 				    struct ieee80211_bss_conf *info,
 -				    u32 changed)
 +				    u64 changed)
 {
 	struct ath10k *ar = hw->priv;
 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
@@ -6930,7 +6932,7 @@ static void ath10k_bss_info_changed(stru
 	mutex_lock(&ar->conf_mutex);
 	if (changed & BSS_CHANGED_IBSS)
 -		ath10k_control_ibss(arvif, info, vif->addr);
 +		ath10k_control_ibss(arvif, vif);
 	if (changed & BSS_CHANGED_BEACON_INT) {
 		arvif->beacon_interval = info->beacon_int;
@@ -6995,9 +6997,9 @@ static void ath10k_bss_info_changed(stru
 	if (changed & BSS_CHANGED_SSID &&
 	    vif->type == NL80211_IFTYPE_AP) {
 -		arvif->u.ap.ssid_len = info->ssid_len;
 -		if (info->ssid_len)
 -			memcpy(arvif->u.ap.ssid, info->ssid, info->ssid_len);
 +		arvif->u.ap.ssid_len = vif->cfg.ssid_len;
 +		if (vif->cfg.ssid_len)
 +			memcpy(arvif->u.ap.ssid, vif->cfg.ssid, vif->cfg.ssid_len);
 		arvif->u.ap.hidden_ssid = info->hidden_ssid;
 	}
@@ -7074,7 +7076,7 @@ static void ath10k_bss_info_changed(stru
 	}
 	if (changed & BSS_CHANGED_ASSOC) {
 -		if (info->assoc) {
 +		if (vif->cfg.assoc) {
 			/* Workaround: Make sure monitor vdev is not running
 			 * when associating to prevent some firmware revisions
 			 * (e.g. 10.1 and 10.2) from crashing.
@@ -7099,7 +7101,7 @@ static void ath10k_bss_info_changed(stru
 	}
 	if (changed & BSS_CHANGED_PS) {
 -		arvif->ps = vif->bss_conf.ps;
 +		arvif->ps = vif->cfg.ps;
 		ret = ath10k_config_ps(ar);
 		if (ret)
@@ -7699,7 +7701,7 @@ static void ath10k_sta_rc_update_wk(stru
 	if (changed & IEEE80211_RC_SUPP_RATES_CHANGED) {
 		ath10k_dbg(ar, ATH10K_DBG_STA, "mac update sta %pM supp rates, bandwidth: %d\n",
 -			   sta->addr, sta->bandwidth);
 +			   sta->addr, sta->deflink.bandwidth);
 		err = ath10k_station_assoc(ar, arvif->vif, sta, true);
 		if (err)
@@ -7751,10 +7753,10 @@ static int ath10k_sta_set_txpwr(struct i
 	int ret = 0;
 	s16 txpwr;
 -	if (sta->txpwr.type == NL80211_TX_POWER_AUTOMATIC) {
 +	if (sta->deflink.txpwr.type == NL80211_TX_POWER_AUTOMATIC) {
 		txpwr = 0;
 	} else {
 -		txpwr = sta->txpwr.power;
 +		txpwr = sta->deflink.txpwr.power;
 		if (!txpwr)
 			return -EINVAL;
 	}
@@ -7874,26 +7876,29 @@ static int ath10k_mac_validate_rate_mask
 					 struct ieee80211_sta *sta,
 					 u32 rate_ctrl_flag, u8 nss)
 {
 -	if (nss > sta->rx_nss) {
 +	struct ieee80211_sta_ht_cap *ht_cap = &sta->deflink.ht_cap;
 +	struct ieee80211_sta_vht_cap *vht_cap = &sta->deflink.vht_cap;
 +
 +	if (nss > sta->deflink.rx_nss) {
 		ath10k_warn(ar, "Invalid nss field, configured %u limit %u\n",
 -			    nss, sta->rx_nss);
 +			    nss, sta->deflink.rx_nss);
 		return -EINVAL;
 	}
 	if (ATH10K_HW_PREAMBLE(rate_ctrl_flag) == WMI_RATE_PREAMBLE_VHT) {
 -		if (!sta->vht_cap.vht_supported) {
 +		if (!vht_cap->vht_supported) {
 			ath10k_warn(ar, "Invalid VHT rate for sta %pM\n",
 				    sta->addr);
 			return -EINVAL;
 		}
 	} else if (ATH10K_HW_PREAMBLE(rate_ctrl_flag) == WMI_RATE_PREAMBLE_HT) {
 -		if (!sta->ht_cap.ht_supported || sta->vht_cap.vht_supported) {
 +		if (!ht_cap->ht_supported || vht_cap->vht_supported) {
 			ath10k_warn(ar, "Invalid HT rate for sta %pM\n",
 				    sta->addr);
 			return -EINVAL;
 		}
 	} else {
 -		if (sta->ht_cap.ht_supported || sta->vht_cap.vht_supported)
 +		if (ht_cap->ht_supported || vht_cap->vht_supported)
 			return -EINVAL;
 	}
@@ -8567,7 +8572,7 @@ static int ath10k_sta_state(struct ieee8
 		 * New association.
 		 */
 		ath10k_dbg(ar, ATH10K_DBG_STA, "mac sta %pM associated, bandwidth: %d\n",
 -			   sta->addr, sta->bandwidth);
 +			   sta->addr, sta->deflink.bandwidth);
 		ret = ath10k_station_assoc(ar, vif, sta, false);
 		if (ret)
@@ -8580,7 +8585,7 @@ static int ath10k_sta_state(struct ieee8
 		 * Tdls station authorized.
 		 */
 		ath10k_dbg(ar, ATH10K_DBG_STA, "mac tdls sta %pM authorized, bandwidth: %d\n",
 -			   sta->addr, sta->bandwidth);
 +			   sta->addr, sta->deflink.bandwidth);
 		ret = ath10k_station_assoc(ar, vif, sta, false);
 		if (ret) {
@@ -8721,8 +8726,8 @@ exit:
 	return ret;
 }
 -static int ath10k_conf_tx(struct ieee80211_hw *hw,
 -			  struct ieee80211_vif *vif, u16 ac,
 +static int ath10k_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 +			  unsigned int link_id, u16 ac,
 			  const struct ieee80211_tx_queue_params *params)
 {
 	struct ath10k *ar = hw->priv;
@@ -9308,7 +9313,7 @@ static bool ath10k_mac_set_vht_bitrate_m
 	u8 rate = arvif->vht_pfr;
 	/* skip non vht and multiple rate peers */
 -	if (!sta->vht_cap.vht_supported || arvif->vht_num_rates != 1)
 +	if (!sta->deflink.vht_cap.vht_supported || arvif->vht_num_rates != 1)
 		return false;
 	err = ath10k_wmi_peer_set_param(ar, arvif->vdev_id, sta->addr,
@@ -9349,7 +9354,7 @@ static void ath10k_mac_clr_bitrate_mask_
 	int err;
 	/* clear vht peers only */
 -	if (arsta->arvif != arvif || !sta->vht_cap.vht_supported)
 +	if (arsta->arvif != arvif || !sta->deflink.vht_cap.vht_supported)
 		return;
 	err = ath10k_wmi_peer_set_param(ar, arvif->vdev_id, sta->addr,
@@ -9534,13 +9539,13 @@ static void ath10k_sta_rc_update(struct
 	ath10k_dbg(ar, ATH10K_DBG_STA,
 		   "mac sta rc update for %pM changed %08x bw %d nss %d smps %d\n",
 -		   sta->addr, changed, sta->bandwidth, sta->rx_nss,
 -		   sta->smps_mode);
 +		   sta->addr, changed, sta->deflink.bandwidth, sta->deflink.rx_nss,
 +		   sta->deflink.smps_mode);
 	if (changed & IEEE80211_RC_BW_CHANGED) {
 		bw = WMI_PEER_CHWIDTH_20MHZ;
 -		switch (sta->bandwidth) {
 +		switch (sta->deflink.bandwidth) {
 		case IEEE80211_STA_RX_BW_20:
 			bw = WMI_PEER_CHWIDTH_20MHZ;
 			break;
@@ -9555,7 +9560,7 @@ static void ath10k_sta_rc_update(struct
 			break;
 		default:
 			ath10k_warn(ar, "Invalid bandwidth %d in rc update for %pM\n",
 -				    sta->bandwidth, sta->addr);
 +				    sta->deflink.bandwidth, sta->addr);
 			bw = WMI_PEER_CHWIDTH_20MHZ;
 			break;
 		}
@@ -9564,12 +9569,12 @@ static void ath10k_sta_rc_update(struct
 	}
 	if (changed & IEEE80211_RC_NSS_CHANGED)
 -		arsta->nss = sta->rx_nss;
 +		arsta->nss = sta->deflink.rx_nss;
 	if (changed & IEEE80211_RC_SMPS_CHANGED) {
 		smps = WMI_PEER_SMPS_PS_NONE;
 -		switch (sta->smps_mode) {
 +		switch (sta->deflink.smps_mode) {
 		case IEEE80211_SMPS_AUTOMATIC:
 		case IEEE80211_SMPS_OFF:
 			smps = WMI_PEER_SMPS_PS_NONE;
@@ -9582,7 +9587,7 @@ static void ath10k_sta_rc_update(struct
 			break;
 		case IEEE80211_SMPS_NUM_MODES:
 			ath10k_warn(ar, "Invalid smps %d in sta rc update for %pM\n",
 -				    sta->smps_mode, sta->addr);
 +				    sta->deflink.smps_mode, sta->addr);
 			smps = WMI_PEER_SMPS_PS_NONE;
 			break;
 		}
@@ -9896,7 +9901,7 @@ ath10k_mac_change_chanctx_cnt_iter(void
 {
 	struct ath10k_mac_change_chanctx_arg *arg = data;
 -	if (rcu_access_pointer(vif->chanctx_conf) != arg->ctx)
 +	if (rcu_access_pointer(vif->bss_conf.chanctx_conf) != arg->ctx)
 		return;
 	arg->n_vifs++;
@@ -9909,7 +9914,7 @@ ath10k_mac_change_chanctx_fill_iter(void
 	struct ath10k_mac_change_chanctx_arg *arg = data;
 	struct ieee80211_chanctx_conf *ctx;
 -	ctx = rcu_access_pointer(vif->chanctx_conf);
 +	ctx = rcu_access_pointer(vif->bss_conf.chanctx_conf);
 	if (ctx != arg->ctx)
 		return;
@@ -9982,6 +9987,7 @@ unlock:
 static int
 ath10k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw,
 				 struct ieee80211_vif *vif,
 +				 struct ieee80211_bss_conf *link_conf,
 				 struct ieee80211_chanctx_conf *ctx)
 {
 	struct ath10k *ar = hw->priv;
@@ -10061,6 +10067,7 @@ err:
 static void
 ath10k_mac_op_unassign_vif_chanctx(struct ieee80211_hw *hw,
 				   struct ieee80211_vif *vif,
 +				   struct ieee80211_bss_conf *link_conf,
 				   struct ieee80211_chanctx_conf *ctx)
 {
 	struct ath10k *ar = hw->priv;
 --- a/ath10k-5.15/txrx.c
 +++ b/ath10k-5.15/txrx.c
@@ -260,7 +260,7 @@ int ath10k_txrx_tx_unref(struct ath10k_h
 			nf = ar->debug.nf_sum[0];
 #endif
 		info->status.ack_signal = nf + tx_done->ack_rssi;
 -		info->status.is_valid_ack_signal = true;
 +		info->status.flags |= IEEE80211_TX_STATUS_ACK_SIGNAL_VALID;
 	}
 	if (tx_done->tx_rate_code || tx_done->tx_rate_flags || ar->ok_tx_rate_status) {
 --- a/ath10k-5.15/wmi.c
 +++ b/ath10k-5.15/wmi.c
@@ -2587,7 +2587,7 @@ wmi_process_mgmt_tx_comp(struct ath10k *
 		info->flags |= IEEE80211_TX_STAT_ACK;
 		info->status.ack_signal = ath10k_get_noisefloor(0, ar) +
 					  param->ack_rssi;
 -		info->status.is_valid_ack_signal = true;
 +		info->status.flags |= IEEE80211_TX_STATUS_ACK_SIGNAL_VALID;
 	}
 	ieee80211_tx_status_irqsafe(ar->hw, msdu);
@@ -4258,13 +4258,13 @@ void ath10k_wmi_event_host_swba(struct a
 		 * Once CSA counter is completed stop sending beacons until
 		 * actual channel switch is done
 		 */
 -		if (arvif->vif->csa_active &&
 +		if (arvif->vif->bss_conf.csa_active &&
 		    ieee80211_beacon_cntdwn_is_complete(arvif->vif)) {
 			ieee80211_csa_finish(arvif->vif);
 			continue;
 		}
 -		bcn = ieee80211_beacon_get(ar->hw, arvif->vif);
 +		bcn = ieee80211_beacon_get(ar->hw, arvif->vif, 0);
 		if (!bcn) {
 			ath10k_warn(ar, "could not get mac80211 beacon, vdev_id: %i addr: %pM\n",
 				    arvif->vdev_id, arvif->vif->addr);
 --- a/ath10k-5.15/htt_rx.c
 +++ b/ath10k-5.15/htt_rx.c
@@ -4017,7 +4017,7 @@ ath10k_update_per_peer_tx_stats(struct a
 	switch (txrate.flags) {
 	case WMI_RATE_PREAMBLE_OFDM:
 		if (arsta->arvif && arsta->arvif->vif)
 -			conf = rcu_dereference(arsta->arvif->vif->chanctx_conf);
 +			conf = rcu_dereference(arsta->arvif->vif->bss_conf.chanctx_conf);
 		if (conf && conf->def.chan->band == NL80211_BAND_5GHZ)
 			arsta->tx_info.status.rates[0].idx = rate_idx - 4;
 		break;
 --- a/ath10k-5.15/wmi-tlv.c
 +++ b/ath10k-5.15/wmi-tlv.c
@@ -205,7 +205,7 @@ static int ath10k_wmi_tlv_event_bcn_tx_s
 	}
 	arvif = ath10k_get_arvif(ar, vdev_id);
 -	if (arvif && arvif->is_up && arvif->vif->csa_active)
 +	if (arvif && arvif->is_up && arvif->vif->bss_conf.csa_active)
 		ieee80211_queue_work(ar->hw, &arvif->ap_csa_work);
 	kfree(tb);
 --- a/ath10k-5.15/core.c
 +++ b/ath10k-5.15/core.c
-@@ -4151,7 +4151,11 @@
+@@ -4081,7 +4081,7 @@ static int ath10k_core_probe_fw(struct a
 		ath10k_debug_print_board_info(ar);
 	}
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 0, 0)
+-	device_get_mac_address(ar->dev, ar->mac_addr, sizeof(ar->mac_addr));
 	device_get_mac_address(ar->dev, ar->mac_addr, sizeof(ar->mac_addr));
 +#else
 +	device_get_mac_address(ar->dev, ar->mac_addr);
 +#endif
 	/* Try to get mac address from device node (from nvmem cell) */
 	of_get_mac_address(ar->dev->of_node, ar->mac_addr);
 --- a/ath10k-5.15/pci.c
 +++ b/ath10k-5.15/pci.c
-@@ -3563,8 +3563,12 @@
+@@ -3547,8 +3547,7 @@ static void ath10k_pci_free_irq(struct a
 void ath10k_pci_init_napi(struct ath10k *ar)
 {
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 0, 0)
+-	netif_napi_add(&ar->napi_dev, &ar->napi, ath10k_pci_napi_poll,
- 	netif_napi_add(&ar->napi_dev, &ar->napi, ath10k_pci_napi_poll,
+-		       ATH10K_NAPI_BUDGET);
 		       ATH10K_NAPI_BUDGET);
 +#else
 +	netif_napi_add(&ar->napi_dev, &ar->napi, ath10k_pci_napi_poll);
 +#endif
 }
 static int ath10k_pci_init_irq(struct ath10k *ar)
 --- a/ath10k-5.15/sdio.c
 +++ b/ath10k-5.15/sdio.c
@@ -2531,8 +2531,7 @@ static int ath10k_sdio_probe(struct sdio
 		return -ENOMEM;
 	}
 -	netif_napi_add(&ar->napi_dev, &ar->napi, ath10k_sdio_napi_poll,
 -		       ATH10K_NAPI_BUDGET);
 +	netif_napi_add(&ar->napi_dev, &ar->napi, ath10k_sdio_napi_poll);
 	ath10k_dbg(ar, ATH10K_DBG_BOOT,
 		   "sdio new func %d vendor 0x%x device 0x%x block 0x%x/0x%x\n",
 --- a/ath10k-5.15/snoc.c
 +++ b/ath10k-5.15/snoc.c
@@ -1242,8 +1242,7 @@ static int ath10k_snoc_napi_poll(struct
 static void ath10k_snoc_init_napi(struct ath10k *ar)
 {
 -	netif_napi_add(&ar->napi_dev, &ar->napi, ath10k_snoc_napi_poll,
 -		       ATH10K_NAPI_BUDGET);
 +	netif_napi_add(&ar->napi_dev, &ar->napi, ath10k_snoc_napi_poll);
 }
 static int ath10k_snoc_request_irq(struct ath10k *ar)
--- a/package/kernel/ath10k-ct/patches/130-ath10k-read-qcom-coexist-support-as-a-u32.patch
+++ b/package/kernel/ath10k-ct/patches/130-ath10k-read-qcom-coexist-support-as-a-u32.patch
@ -0,0 +1,60 @@
 From 630df9786fdaeb78c21f1e28c9b70ac83a1b482c Mon Sep 17 00:00:00 2001
 From: Vincent Tremblay <vincent@vtremblay.dev>
 Date: Sat, 31 Dec 2022 09:24:00 -0500
 Subject: [PATCH] ath10k: read qcom,coexist-support as a u32
 Read qcom,coexist-support as a u32 instead of a u8
 When we set the property to <1> in the DT (as specified in the doc),
 "of_property_read_u8" read 0 instead of 1. This is because of the data format. 
 By default <1> is written with 32 bits. 
 The problem is that the driver is trying to read a u8.
 The difference can be visualized using hexdump in a running device:
 Default 32 bits output:
 =======================
 0000000 0000 0100
 0000004
 8 bits output:
 ==============
 0000000 0001
 0000001
 By changing "of_property_read_u8" by "of_property_read_u32", the driver
 is aligned with the documentation and is able to read the value without
 modifying the DT.
 The other solution would be to force the value in the DT to be saved as
 an 8 bits value (qcom,coexist-support = /bits/ 8 <1>), 
 which is against the doc and less intuitive.
 Validation:
 ===========
 The patch was tested on a real device and we can see in the debug logs
 that the feature is properly initialized:
 [  109.102097] ath10k_ahb a000000.wifi: boot coex_support 1 coex_gpio_pin 52
 Signed-off-by: Vincent Tremblay <vincent@vtremblay.dev>
 --- a/ath10k-5.15/core.c
 +++ b/ath10k-5.15/core.c
@@ -2798,14 +2798,14 @@ done:
 static void ath10k_core_fetch_btcoex_dt(struct ath10k *ar)
 {
 	struct device_node *node;
 -	u8 coex_support = 0;
 +	u32 coex_support = 0;
 	int ret;
 	node = ar->dev->of_node;
 	if (!node)
 		goto out;
 -	ret = of_property_read_u8(node, "qcom,coexist-support", &coex_support);
 +	ret = of_property_read_u32(node, "qcom,coexist-support", &coex_support);
 	if (ret) {
 		ar->coex_support = true;
 		goto out;
--- a/package/kernel/ath10k-ct/patches/202-ath10k-use-tpt-trigger-by-default.patch
+++ b/package/kernel/ath10k-ct/patches/202-ath10k-use-tpt-trigger-by-default.patch
@ -42,7 +42,7 @@ Signed-off-by: Mathias Kresin <dev@kresin.me>
 	if (ret)
 --- a/ath10k-5.15/mac.c
 +++ b/ath10k-5.15/mac.c
-@@ -11544,7 +11544,7 @@ int ath10k_mac_register(struct ath10k *a
+@@ -11551,7 +11551,7 @@ int ath10k_mac_register(struct ath10k *a
 	ar->hw->weight_multiplier = ATH10K_AIRTIME_WEIGHT_MULTIPLIER;
 #ifdef CPTCFG_MAC80211_LEDS
--- a/package/kernel/mac80211/Makefile
+++ b/package/kernel/mac80211/Makefile
@ -10,10 +10,11 @@ include $(INCLUDE_DIR)/kernel.mk
 PKG_NAME:=mac80211
-PKG_VERSION:=5.15.33-1
+PKG_VERSION:=6.1.24
-PKG_RELEASE:=2
+PKG_RELEASE:=1
-PKG_SOURCE_URL:=@KERNEL/linux/kernel/projects/backports/stable/v5.15.33/
+# PKG_SOURCE_URL:=@KERNEL/linux/kernel/projects/backports/stable/v5.15.58/
-PKG_HASH:=1b6b3bded4c81814ebebe2d194c2f8966d2399005b85ebb0557285b6e73f5422
+PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources/
 PKG_HASH:=5d39aca7e34c33cb9b3e366117b2e86841b7bdd37933679d6b1e61be6b150648
 PKG_SOURCE:=backports-$(PKG_VERSION).tar.xz
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/backports-$(PKG_VERSION)
@ -162,7 +163,7 @@ endef
 define KernelPackage/mac80211-hwsim
  $(call KernelPackage/mac80211/Default)
  TITLE:=mac80211 HW simulation device
-  DEPENDS+= +kmod-mac80211 +@DRIVER_11AX_SUPPORT +@DRIVER_11AC_SUPPORT +@DRIVER_11N_SUPPORT
+  DEPENDS+= +kmod-mac80211 +@DRIVER_11AX_SUPPORT +@DRIVER_11AC_SUPPORT
  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/mac80211_hwsim.ko
  AUTOLOAD:=$(call AutoProbe,mac80211_hwsim)
 endef
@ -171,7 +172,7 @@ endef
 define KernelPackage/mt7601u
  $(call KernelPackage/mac80211/Default)
  TITLE:=MT7601U-based USB dongles Wireless Driver
-  DEPENDS+= +kmod-mac80211 +@DRIVER_11N_SUPPORT @USB_SUPPORT +kmod-usb-core +mt7601u-firmware
+  DEPENDS+= +kmod-mac80211 @USB_SUPPORT +kmod-usb-core +mt7601u-firmware
  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/mediatek/mt7601u/mt7601u.ko
  AUTOLOAD:=$(call AutoProbe,mt7601u)
 endef
@ -272,8 +273,8 @@ ifeq ($(BUILD_VARIANT),smallbuffers)
 	C_DEFINES+= -DCONFIG_ATH10K_SMALLBUFFERS
 endif
-MAKE_OPTS:= -C "$(PKG_BUILD_DIR)" \
+MAKE_OPTS:= \
-	$(KERNEL_MAKE_FLAGS) \
+	$(subst -C $(LINUX_DIR),-C "$(PKG_BUILD_DIR)",$(KERNEL_MAKEOPTS)) \
 	EXTRA_CFLAGS="-I$(PKG_BUILD_DIR)/include $(IREMAP_CFLAGS) $(C_DEFINES)" \
 	KLIB_BUILD="$(LINUX_DIR)" \
 	MODPROBE=true \
@ -306,12 +307,11 @@ define Build/Prepare
 		$(PKG_BUILD_DIR)/include/linux/crc8.h \
 		$(PKG_BUILD_DIR)/include/linux/eeprom_93cx6.h \
 		$(PKG_BUILD_DIR)/include/linux/wl12xx.h \
 		$(PKG_BUILD_DIR)/include/linux/mhi.h \
 		$(PKG_BUILD_DIR)/include/net/ieee80211.h \
 		$(PKG_BUILD_DIR)/backport-include/linux/bcm47xx_nvram.h
 	echo 'compat-wireless-$(PKG_VERSION)-$(PKG_RELEASE)-$(REVISION)' > $(PKG_BUILD_DIR)/compat_version
 	sed -i '/#define is_signed_type/i#ifndef is_signed_type' $(PKG_BUILD_DIR)/include/linux/overflow.h
 	sed -i '/#define is_signed_type/a#endif' $(PKG_BUILD_DIR)/include/linux/overflow.h
 endef
 ifneq ($(CONFIG_PACKAGE_kmod-cfg80211),)
--- a/package/kernel/mac80211/ath.mk
+++ b/package/kernel/mac80211/ath.mk
@ -13,8 +13,7 @@ PKG_CONFIG_DEPENDS += \
 	CONFIG_ATH9K_TX99 \
 	CONFIG_ATH10K_LEDS \
 	CONFIG_ATH10K_THERMAL \
-	CONFIG_ATH11K_MEM_PROFILE_512MB \
+	CONFIG_ATH11K_THERMAL \
 	CONFIG_ATH11K_MEM_PROFILE_1GB \
 	CONFIG_ATH_USER_REGD
 ifdef CONFIG_PACKAGE_MAC80211_DEBUGFS
@ -57,8 +56,7 @@ config-$(CONFIG_ATH9K_TX99) += ATH9K_TX99
 config-$(CONFIG_ATH9K_UBNTHSR) += ATH9K_UBNTHSR
 config-$(CONFIG_ATH10K_LEDS) += ATH10K_LEDS
 config-$(CONFIG_ATH10K_THERMAL) += ATH10K_THERMAL
-config-$(CONFIG_ATH11K_MEM_PROFILE_512MB) += ATH11K_MEM_PROFILE_512MB
+config-$(CONFIG_ATH11K_THERMAL) += ATH11K_THERMAL
 config-$(CONFIG_ATH11K_MEM_PROFILE_1GB) += ATH11K_MEM_PROFILE_1GB
 config-$(call config_package,ath9k-htc) += ATH9K_HTC
 config-$(call config_package,ath10k) += ATH10K
@ -204,7 +202,7 @@ define KernelPackage/ath9k-common
  TITLE:=Atheros 802.11n wireless devices (common code for ath9k and ath9k_htc)
  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
  HIDDEN:=1
-  DEPENDS+= @PCI_SUPPORT||USB_SUPPORT||TARGET_ath79 +kmod-ath +@DRIVER_11N_SUPPORT
+  DEPENDS+= @PCI_SUPPORT||USB_SUPPORT||TARGET_ath79 +kmod-ath +kmod-random-core
  FILES:= \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_common.ko \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_hw.ko
@ -231,7 +229,7 @@ define KernelPackage/ath9k/config
 		bool "Add wireless noise as source of randomness to kernel entropy pool"
 		depends on PACKAGE_kmod-ath9k
 		select PACKAGE_kmod-random-core
-		default n
+		default y
 	config ATH9K_SUPPORT_PCOEM
 		bool "Support chips used in PC OEM cards"
@ -334,11 +332,10 @@ define KernelPackage/ath11k
  $(call KernelPackage/mac80211/Default)
  TITLE:=Qualcomm 802.11ax wireless chipset support (common code)
  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath11k
-  DEPENDS+= +kmod-ath +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +@DRIVER_11AX_SUPPORT \
+  DEPENDS+= +kmod-ath +@DRIVER_11AC_SUPPORT +@DRIVER_11AX_SUPPORT \
-  +kmod-qcom-qmi-helpers +kmod-crypto-michael-mic +ATH11K_THERMAL:kmod-hwmon-core \
+  +kmod-crypto-michael-mic +ATH11K_THERMAL:kmod-hwmon-core +ATH11K_THERMAL:kmod-thermal
-  +ATH11K_THERMAL:kmod-thermal
+  FILES:=$(PKG_BUILD_DIR)/drivers/soc/qcom/qmi_helpers.ko \
-  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath11k/ath11k.ko
+  $(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath11k/ath11k.ko
  AUTOLOAD:=$(call AutoProbe,ath11k)
  MODPARAMS.ath11k:=frame_mode=2
 endef
@ -354,29 +351,13 @@ define KernelPackage/ath11k/config
               depends on PACKAGE_kmod-ath11k
               default y if TARGET_ipq807x
       if PACKAGE_kmod-ath11k
       choice
        prompt "ath11k memory profile"
        default ATH11K_MEM_PROFILE_512MB
        help
          This allows selecting the ath11k memory size profile to be used.
       config ATH11K_MEM_PROFILE_512MB
               bool "Use limits for the 512MB memory size"
       config ATH11K_MEM_PROFILE_1GB
               bool "Use limits for the 1GB memory size"
       endchoice
       endif
 endef
 define KernelPackage/ath11k-ahb
  $(call KernelPackage/mac80211/Default)
  TITLE:=Qualcomm 802.11ax AHB wireless chipset support
  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath11k
-  DEPENDS+= @(TARGET_ipq60xx||TARGET_ipq807x) +kmod-ath11k +(LINUX_5_15||LINUX_6_1):kmod-qrtr-smd
+  DEPENDS+= @(TARGET_ipq60xx||TARGET_ipq807x) +kmod-ath11k +kmod-qrtr-smd
  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath11k/ath11k_ahb.ko
  AUTOLOAD:=$(call AutoProbe,ath11k_ahb)
 endef
@ -390,7 +371,7 @@ define KernelPackage/ath11k-pci
  $(call KernelPackage/mac80211/Default)
  TITLE:=Qualcomm 802.11ax PCI wireless chipset support
  URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath11k
-  DEPENDS+= @PCI_SUPPORT +(LINUX_5_15||LINUX_6_1):kmod-qrtr-mhi +kmod-ath11k
+  DEPENDS+= @PCI_SUPPORT +kmod-qrtr-mhi +kmod-ath11k
  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath11k/ath11k_pci.ko
  AUTOLOAD:=$(call AutoProbe,ath11k_pci)
 endef
@ -403,7 +384,7 @@ endef
 define KernelPackage/carl9170
  $(call KernelPackage/mac80211/Default)
  TITLE:=Driver for Atheros AR9170 USB sticks
-  DEPENDS:=@USB_SUPPORT +kmod-mac80211 +kmod-ath +kmod-usb-core +kmod-input-core +@DRIVER_11N_SUPPORT +carl9170-firmware
+  DEPENDS:=@USB_SUPPORT +kmod-mac80211 +kmod-ath +kmod-usb-core +kmod-input-core +carl9170-firmware
  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/ath/carl9170/carl9170.ko
  AUTOLOAD:=$(call AutoProbe,carl9170)
 endef
--- a/package/kernel/mac80211/broadcom.mk
+++ b/package/kernel/mac80211/broadcom.mk
@ -381,7 +381,7 @@ define KernelPackage/brcmsmac
  $(call KernelPackage/mac80211/Default)
  TITLE:=Broadcom IEEE802.11n PCIe SoftMAC WLAN driver
  URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
-  DEPENDS+= +kmod-mac80211 +@DRIVER_11N_SUPPORT +!TARGET_bcm47xx:kmod-bcma +kmod-lib-cordic +kmod-lib-crc8 +kmod-brcmutil +!BRCMSMAC_USE_FW_FROM_WL:brcmsmac-firmware
+  DEPENDS+=@!TARGET_bcm47xx_legacy +kmod-mac80211 +!TARGET_bcm47xx:kmod-bcma +kmod-lib-cordic +kmod-lib-crc8 +kmod-brcmutil +!BRCMSMAC_USE_FW_FROM_WL:brcmsmac-firmware
  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/brcm80211/brcmsmac/brcmsmac.ko
  AUTOLOAD:=$(call AutoProbe,brcmsmac)
  MENU:=1
@ -413,7 +413,7 @@ define KernelPackage/brcmfmac
  $(call KernelPackage/mac80211/Default)
  TITLE:=Broadcom IEEE802.11n USB FullMAC WLAN driver
  URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
-  DEPENDS+= @USB_SUPPORT +kmod-mac80211 +kmod-cfg80211 +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT \
+  DEPENDS+= @USB_SUPPORT +kmod-cfg80211 +@DRIVER_11AC_SUPPORT \
  	+kmod-brcmutil +BRCMFMAC_SDIO:kmod-mmc @!TARGET_uml \
 	+BRCMFMAC_USB:kmod-usb-core +BRCMFMAC_USB:brcmfmac-firmware-usb
  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/brcm80211/brcmfmac/brcmfmac.ko
--- a/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
+++ b/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
@ -1,6 +1,7 @@
 #!/bin/sh
 . /lib/netifd/netifd-wireless.sh
 . /lib/netifd/hostapd.sh
 . /lib/functions/system.sh
 init_wireless_driver "$@"
@ -50,6 +51,8 @@ drv_mac80211_init_device_config() {
 		rx_antenna_pattern \
 		tx_antenna_pattern \
 		he_spr_sr_control \
 		he_spr_psr_enabled \
 		he_bss_color_enabled \
 		he_twt_required
 	config_add_int \
 		beamformer_antennas \
@ -413,12 +416,14 @@ mac80211_hostapd_setup_base() {
 	if [ "$enable_ax" != "0" ]; then
 		json_get_vars \
 			he_su_beamformer:1 \
-			he_su_beamformee:0 \
+			he_su_beamformee:1 \
 			he_mu_beamformer:1 \
 			he_twt_required:0 \
-			he_spr_sr_control:0 \
+			he_spr_sr_control:3 \
-			he_spr_non_srg_obss_pd_max_offset:1 \
+			he_spr_psr_enabled:0 \
-			he_bss_color
+			he_spr_non_srg_obss_pd_max_offset:0 \
 			he_bss_color:128 \
 			he_bss_color_enabled:1
 		he_phy_cap=$(iw phy "$phy" info | sed -n '/HE Iftypes: AP/,$p' | awk -F "[()]" '/HE PHY Capabilities/ { print $2 }' | head -1)
 		he_phy_cap=${he_phy_cap:2}
@ -426,16 +431,6 @@ mac80211_hostapd_setup_base() {
 		he_mac_cap=${he_mac_cap:2}
 		append base_cfg "ieee80211ax=1" "$N"
 		if [ -n "$he_bss_color" ]; then
 			append base_cfg "he_bss_color=$he_bss_color" "$N"
 		else
 			he_bss_color=$(head -1 /dev/urandom | tr -dc '0-9' | head -c2)
 			he_bss_color=$(($he_bss_color % 63))
 			he_bss_color=$(($he_bss_color + 1))
 			append base_cfg "he_bss_color=$he_bss_color" "$N"
 		fi
 		[ "$hwmode" = "a" ] && {
 			append base_cfg "he_oper_chwidth=$vht_oper_chwidth" "$N"
 			append base_cfg "he_oper_centr_freq_seg0_idx=$vht_center_seg0" "$N"
@ -445,10 +440,21 @@ mac80211_hostapd_setup_base() {
 			he_su_beamformer:${he_phy_cap:6:2}:0x80:$he_su_beamformer \
 			he_su_beamformee:${he_phy_cap:8:2}:0x1:$he_su_beamformee \
 			he_mu_beamformer:${he_phy_cap:8:2}:0x2:$he_mu_beamformer \
-			he_spr_sr_control:${he_phy_cap:14:2}:0x1:$he_spr_sr_control \
+			he_spr_psr_enabled:${he_phy_cap:14:2}:0x1:$he_spr_psr_enabled \
 			he_twt_required:${he_mac_cap:0:2}:0x6:$he_twt_required
-		[ "$he_spr_sr_control" -gt 0 ] && append base_cfg "he_spr_non_srg_obss_pd_max_offset=$he_spr_non_srg_obss_pd_max_offset" "$N"
+		if [ "$he_bss_color_enabled" -gt 0 ]; then
 			append base_cfg "he_bss_color=$he_bss_color" "$N"
 			[ "$he_spr_non_srg_obss_pd_max_offset" -gt 0 ] && { \
 				append base_cfg "he_spr_non_srg_obss_pd_max_offset=$he_spr_non_srg_obss_pd_max_offset" "$N"
 				he_spr_sr_control=$((he_spr_sr_control | (1 << 2)))
 			}
 			[ "$he_spr_psr_enabled" -gt 0 ] || he_spr_sr_control=$((he_spr_sr_control | (1 << 0)))
 			append base_cfg "he_spr_sr_control=$he_spr_sr_control" "$N"
 		else
 			append base_cfg "he_bss_color_disabled=1" "$N"
 		fi
 		append base_cfg "he_default_pe_duration=4" "$N"
 		append base_cfg "he_rts_threshold=1023" "$N"
@ -674,10 +680,12 @@ mac80211_prepare_vif() {
 	json_select ..
-	[ -n "$macaddr" ] || {
+	if [ -z "$macaddr" ]; then
 		macaddr="$(mac80211_generate_mac $phy)"
 		macidx="$(($macidx + 1))"
-	}
+	elif [ "$macaddr" = 'random' ]; then
 		macaddr="$(macaddr_random)"
 	fi
 	json_add_object data
 	json_add_string ifname "$ifname"
@ -739,8 +747,7 @@ mac80211_prepare_vif() {
 		;;
 	esac
-	# We do not set hostpad macaddr if it is 00:00:00:00:00:00
+	if [ "$mode" != "ap" ]; then
 	if [ "$mode" != "ap" ] && [ "$macaddr" != "00:00:00:00:00:00" ]; then
 		# ALL ap functionality will be passed to hostapd
 		# All interfaces must have unique mac addresses
 		# which can either be explicitly set in the device
@ -817,8 +824,8 @@ mac80211_setup_supplicant_noctl() {
 mac80211_prepare_iw_htmode() {
 	case "$htmode" in
-		VHT20|HT20) iw_htmode=HT20;;
+		VHT20|HT20|HE20) iw_htmode=HT20;;
-		HT40*|VHT40|VHT160)
+		HT40*|VHT40|VHT160|HE40)
 			case "$band" in
 				2g)
 					case "$htmode" in
@ -842,7 +849,7 @@ mac80211_prepare_iw_htmode() {
 			esac
 			[ "$auto_channel" -gt 0 ] && iw_htmode="HT40+"
 		;;
-		VHT80)
+		VHT80|HE80)
 			iw_htmode="80MHZ"
 		;;
 		NONE|NOHT)
--- a/package/kernel/mac80211/intel.mk
+++ b/package/kernel/mac80211/intel.mk
@ -6,7 +6,7 @@ config-$(CONFIG_PACKAGE_IWLWIFI_DEBUGFS)+= IWLWIFI_DEBUGFS
 define KernelPackage/iwlwifi
  $(call KernelPackage/mac80211/Default)
-  DEPENDS:= +kmod-mac80211 @PCI_SUPPORT +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT
+  DEPENDS:= +kmod-mac80211 @PCI_SUPPORT +@DRIVER_11AC_SUPPORT +@DRIVER_11AX_SUPPORT
  TITLE:=Intel AGN Wireless support
  FILES:= \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/intel/iwlwifi/iwlwifi.ko \
--- a/package/kernel/mac80211/marvell.mk
+++ b/package/kernel/mac80211/marvell.mk
@ -9,7 +9,7 @@ define KernelPackage/mwl8k
  $(call KernelPackage/mac80211/Default)
  TITLE:=Driver for Marvell TOPDOG 802.11 Wireless cards
  URL:=https://wireless.wiki.kernel.org/en/users/drivers/mwl8k
-  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +@DRIVER_11N_SUPPORT +mwl8k-firmware
+  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +mwl8k-firmware
  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwl8k.ko
  AUTOLOAD:=$(call AutoProbe,mwl8k)
 endef
@ -23,7 +23,7 @@ define KernelPackage/mwifiex-pcie
  $(call KernelPackage/mac80211/Default)
  TITLE:=Driver for Marvell 802.11n/802.11ac PCIe Wireless cards
  URL:=https://wireless.wiki.kernel.org/en/users/drivers/mwifiex
-  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +mwifiex-pcie-firmware
+  DEPENDS+= @PCI_SUPPORT +kmod-mac80211 +@DRIVER_11AC_SUPPORT +mwifiex-pcie-firmware
  FILES:= \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex.ko \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex_pcie.ko
@ -38,7 +38,7 @@ define KernelPackage/mwifiex-sdio
  $(call KernelPackage/mac80211/Default)
  TITLE:=Driver for Marvell 802.11n/802.11ac SDIO Wireless cards
  URL:=https://wireless.wiki.kernel.org/en/users/drivers/mwifiex
-  DEPENDS+= +kmod-mmc +kmod-mac80211 +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT +mwifiex-sdio-firmware
+  DEPENDS+= +kmod-mmc +kmod-mac80211 +@DRIVER_11AC_SUPPORT +mwifiex-sdio-firmware
  FILES:= \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex.ko \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/marvell/mwifiex/mwifiex_sdio.ko
--- a/package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch
+++ b/package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch
@ -82,7 +82,7 @@
 	help
 --- a/local-symbols
 +++ b/local-symbols
-@@ -83,6 +83,7 @@ ADM8211=
+@@ -102,6 +102,7 @@ ADM8211=
 ATH_COMMON=
 WLAN_VENDOR_ATH=
 ATH_DEBUG=
--- a/package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch
+++ b/package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch
@ -1,6 +1,6 @@
 --- a/net/wireless/reg.c
 +++ b/net/wireless/reg.c
-@@ -3304,6 +3304,8 @@ void regulatory_hint_country_ie(struct w
+@@ -3370,6 +3370,8 @@ void regulatory_hint_country_ie(struct w
 	enum environment_cap env = ENVIRON_ANY;
 	struct regulatory_request *request = NULL, *lr;
@ -9,7 +9,7 @@
 	/* IE len must be evenly divisible by 2 */
 	if (country_ie_len & 0x01)
 		return;
-@@ -3555,6 +3557,7 @@ static bool is_wiphy_all_set_reg_flag(en
+@@ -3621,6 +3623,7 @@ static bool is_wiphy_all_set_reg_flag(en
 void regulatory_hint_disconnect(void)
 {
--- a/package/kernel/mac80211/patches/ath/405-ath_regd_us.patch
+++ b/package/kernel/mac80211/patches/ath/405-ath_regd_us.patch
@ -8,7 +8,7 @@
 	FRANCE_RES = 0x31,
 	FCC3_FCCA = 0x3A,
 	FCC3_WORLD = 0x3B,
-@@ -172,6 +173,7 @@ static struct reg_dmn_pair_mapping regDo
+@@ -173,6 +174,7 @@ static struct reg_dmn_pair_mapping regDo
 	{FCC2_WORLD, CTL_FCC, CTL_ETSI},
 	{FCC2_ETSIC, CTL_FCC, CTL_ETSI},
 	{FCC3_FCCA, CTL_FCC, CTL_FCC},
@ -16,7 +16,7 @@
 	{FCC3_WORLD, CTL_FCC, CTL_ETSI},
 	{FCC3_ETSIC, CTL_FCC, CTL_ETSI},
 	{FCC4_FCCA, CTL_FCC, CTL_FCC},
-@@ -483,6 +485,7 @@ static struct country_code_to_enum_rd al
+@@ -486,6 +488,7 @@ static struct country_code_to_enum_rd al
 	{CTRY_UAE, NULL1_WORLD, "AE"},
 	{CTRY_UNITED_KINGDOM, ETSI1_WORLD, "GB"},
 	{CTRY_UNITED_STATES, FCC3_FCCA, "US"},
--- a/package/kernel/mac80211/patches/ath10k/080-ath10k_thermal_config.patch
+++ b/package/kernel/mac80211/patches/ath10k/080-ath10k_thermal_config.patch
@ -37,7 +37,7 @@
 void ath10k_thermal_event_temperature(struct ath10k *ar, int temperature);
 --- a/local-symbols
 +++ b/local-symbols
-@@ -142,6 +142,7 @@ ATH10K_SNOC=
+@@ -161,6 +161,7 @@ ATH10K_SNOC=
 ATH10K_DEBUG=
 ATH10K_DEBUGFS=
 ATH10K_SPECTRAL=
--- a/package/kernel/mac80211/patches/ath10k/081-01-ath10k-improve-tx-status-reporting.patch
+++ b/package/kernel/mac80211/patches/ath10k/081-01-ath10k-improve-tx-status-reporting.patch
@ -1,69 +0,0 @@
 From 2587d5198aa5adcbd8896aae4a2404dc13d48637 Mon Sep 17 00:00:00 2001
 From: Sergey Ryazanov <ryazanov.s.a@gmail.com>
 Date: Wed, 18 May 2022 10:27:26 +0300
 Subject: ath10k: improve tx status reporting
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 We use ieee80211_tx_status() to report each completed tx frame.
 Internally, this function calls sta_info_get_by_addrs(), what has a
 couple of drawbacks:
 1. additional station lookup causes a performance degradation;
 2. mac80211 can not properly account Ethernet encapsulated frames due
   to the inability to properly determine the destination (station) MAC
   address since ieee80211_tx_status() assumes the frame has a 802.11
   header.
 The latter is especially destructive if we want to use hardware frames
 encapsulation.
 To fix both of these issues, replace ieee80211_tx_status() with
 ieee80211_tx_status_ext() call and feed it station pointer from the tx
 queue associated with the transmitted frame.
 Tested-on: QCA9888 hw2.0 PCI 10.4-3.9.0.2-00131
 Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00157-QCARMSWPZ-1
 Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
 Tested-by: Oldřich Jedlička <oldium.pro@gmail.com> # TP-Link Archer C7 v4 & v5 (QCA9563 + QCA9880)
 Tested-by: Edward Matijevic <motolav@gmail.com> # TP-Link Archer C2600 (IPQ8064 + QCA9980 10.4.1.00030-1)
 Tested-by: Edward Matijevic <motolav@gmail.com> # QCA9377 PCI in Sta mode
 Tested-by: Zhijun You <hujy652@gmail.com> # NETGEAR R7800 (QCA9984 10.4-3.9.0.2-00159)
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20220516032519.29831-2-ryazanov.s.a@gmail.com
 ---
 drivers/net/wireless/ath/ath10k/txrx.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)
 --- a/drivers/net/wireless/ath/ath10k/txrx.c
 +++ b/drivers/net/wireless/ath/ath10k/txrx.c
@@ -43,6 +43,7 @@ out:
 int ath10k_txrx_tx_unref(struct ath10k_htt *htt,
 			 const struct htt_tx_done *tx_done)
 {
 +	struct ieee80211_tx_status status;
 	struct ath10k *ar = htt->ar;
 	struct device *dev = ar->dev;
 	struct ieee80211_tx_info *info;
@@ -128,7 +129,19 @@ int ath10k_txrx_tx_unref(struct ath10k_h
 		info->status.is_valid_ack_signal = true;
 	}
 -	ieee80211_tx_status(htt->ar->hw, msdu);
 +	memset(&status, 0, sizeof(status));
 +	status.skb = msdu;
 +	status.info = info;
 +
 +	rcu_read_lock();
 +
 +	if (txq)
 +		status.sta = txq->sta;
 +
 +	ieee80211_tx_status_ext(htt->ar->hw, &status);
 +
 +	rcu_read_unlock();
 +
 	/* we do not own the msdu anymore */
 	return 0;
--- a/package/kernel/mac80211/patches/ath10k/081-02-ath10k-turn-rawmode-into-frame-mode.patch
+++ b/package/kernel/mac80211/patches/ath10k/081-02-ath10k-turn-rawmode-into-frame-mode.patch
@ -1,74 +0,0 @@
 From a09740548275a74b897654b3aca5af589289b57a Mon Sep 17 00:00:00 2001
 From: Sergey Ryazanov <ryazanov.s.a@gmail.com>
 Date: Mon, 16 May 2022 13:26:00 +0300
 Subject: ath10k: turn rawmode into frame_mode
 Turn boolean rawmode module param into integer frame_mode param that
 contains value from ath10k_hw_txrx_mode enum. As earlier the default
 param value is non-RAW (native Wi-Fi) encapsulation. The param name
 is selected to be consistent with the similar ath11k param.
 This is a preparation step for upcoming encapsulation offloading
 support.
 Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20220516032519.29831-4-ryazanov.s.a@gmail.com
 ---
 drivers/net/wireless/ath/ath10k/core.c | 11 +++++++----
 drivers/net/wireless/ath/ath10k/core.h |  1 +
 2 files changed, 8 insertions(+), 4 deletions(-)
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -32,9 +32,11 @@ EXPORT_SYMBOL(ath10k_debug_mask);
 static unsigned int ath10k_cryptmode_param;
 static bool uart_print;
 static bool skip_otp;
 -static bool rawmode;
 static bool fw_diag_log;
 +/* frame mode values are mapped as per enum ath10k_hw_txrx_mode */
 +unsigned int ath10k_frame_mode = ATH10K_HW_TXRX_NATIVE_WIFI;
 +
 unsigned long ath10k_coredump_mask = BIT(ATH10K_FW_CRASH_DUMP_REGISTERS) |
 				     BIT(ATH10K_FW_CRASH_DUMP_CE_DATA);
@@ -43,15 +45,16 @@ module_param_named(debug_mask, ath10k_de
 module_param_named(cryptmode, ath10k_cryptmode_param, uint, 0644);
 module_param(uart_print, bool, 0644);
 module_param(skip_otp, bool, 0644);
 -module_param(rawmode, bool, 0644);
 module_param(fw_diag_log, bool, 0644);
 +module_param_named(frame_mode, ath10k_frame_mode, uint, 0644);
 module_param_named(coredump_mask, ath10k_coredump_mask, ulong, 0444);
 MODULE_PARM_DESC(debug_mask, "Debugging mask");
 MODULE_PARM_DESC(uart_print, "Uart target debugging");
 MODULE_PARM_DESC(skip_otp, "Skip otp failure for calibration in testmode");
 MODULE_PARM_DESC(cryptmode, "Crypto mode: 0-hardware, 1-software");
 -MODULE_PARM_DESC(rawmode, "Use raw 802.11 frame datapath");
 +MODULE_PARM_DESC(frame_mode,
 +		 "Datapath frame mode (0: raw, 1: native wifi (default))");
 MODULE_PARM_DESC(coredump_mask, "Bitfield of what to include in firmware crash file");
 MODULE_PARM_DESC(fw_diag_log, "Diag based fw log debugging");
@@ -2487,7 +2490,7 @@ static int ath10k_core_init_firmware_fea
 	ar->htt.max_num_amsdu = ATH10K_HTT_MAX_NUM_AMSDU_DEFAULT;
 	ar->htt.max_num_ampdu = ATH10K_HTT_MAX_NUM_AMPDU_DEFAULT;
 -	if (rawmode) {
 +	if (ath10k_frame_mode == ATH10K_HW_TXRX_RAW) {
 		if (!test_bit(ATH10K_FW_FEATURE_RAW_MODE_SUPPORT,
 			      fw_file->fw_features)) {
 			ath10k_err(ar, "rawmode = 1 requires support from firmware");
 --- a/drivers/net/wireless/ath/ath10k/core.h
 +++ b/drivers/net/wireless/ath/ath10k/core.h
@@ -1311,6 +1311,7 @@ static inline bool ath10k_peer_stats_ena
 	return false;
 }
 +extern unsigned int ath10k_frame_mode;
 extern unsigned long ath10k_coredump_mask;
 void ath10k_core_napi_sync_disable(struct ath10k *ar);
--- a/package/kernel/mac80211/patches/ath10k/081-03-ath10k-htt-tx-do-not-interpret-Eth-frames-as-WiFi.patch
+++ b/package/kernel/mac80211/patches/ath10k/081-03-ath10k-htt-tx-do-not-interpret-Eth-frames-as-WiFi.patch
@ -1,163 +0,0 @@
 From 70f119fb82af7f7417dc659faf02c91e1f853739 Mon Sep 17 00:00:00 2001
 From: Sergey Ryazanov <ryazanov.s.a@gmail.com>
 Date: Mon, 16 May 2022 13:26:00 +0300
 Subject: ath10k: htt_tx: do not interpret Eth frames as WiFi
 The xmit path for the Ethernet encapsulated frames become more or less
 usable since d740d8fd2439 ("ath10k: unify tx mode and dispatch"). This
 change reorganize the xmit path in a manageable way to properly support
 various tx modes, but misses that the Ethernet encapsulated frame is a
 special case. We do not have an IEEE 802.11 header at the begining of
 them. But the HTT Tx handler still interprets first bytes of each frame
 as an IEEE 802.11 Frame Control field.
 Than this code was copied by e62ee5c381c5 ("ath10k: Add support for
 htt_data_tx_desc_64 descriptor") and a2097d6444c3 ("ath10k: htt: High
 latency TX support") to another handlers. In fact the issue in the high
 latency (HL) handler was introduced by 83ac260151e7 ("ath10k: add mic
 bytes for pmf management packet").
 Ethernet encapsulated frame tx mode stay unused until 75d85fd9993c
 ("ath10k: introduce basic tdls functionality") started using it for TDLS
 frames to avoid key selection issue in some firmwares.
 Trying to interpret the begining of an Ethernet encapsulated frame as an
 IEEE 802.11 header was not hurt us noticeably since we need to meet two
 conditions: (1) xmit should be performed towards a TDLS peer, and (2)
 the TDLS peer should have a specific OUI part of its MAC address. Looks
 like that the rareness in TDLS communications of OUIs that can be
 interpreted as an 802.11 management frame saves users from facing this
 issue earlier.
 Improve Ethernet tx mode support in the HTT Tx handler by avoiding
 interpreting its first bytes as an IEEE 802.11 header. While at it, make
 the ieee80211_hdr variable local to the code block that is guarded by
 !is_eth check. In this way, we clarify in which cases a frame can be
 interpreted as IEEE 802.11, and saves us from similar issues in the
 future.
 Credits: this change as part of xmit encapsulation offloading support
 was originally made by QCA and then submitted for inclusion by John
 Crispin [1]. But the whole work was not accepted due to the lack of a
 part for 64-bits descriptors [2]. Zhijun You then pointed this out to me
 in a reply to my initial RFC patch series. And I made this slightly
 reworked version that covered all the HTT Tx handler variants.
 1. https://lore.kernel.org/all/20191216092207.31032-1-john@phrozen.org/
 2. https://patchwork.kernel.org/project/linux-wireless/patch/20191216092207.31032-1-john@phrozen.org/
 Reported-by: Zhijun You <hujy652@gmail.com>
 Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>
 Signed-off-by: John Crispin <john@phrozen.org>
 Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20220516032519.29831-3-ryazanov.s.a@gmail.com
 ---
 drivers/net/wireless/ath/ath10k/htt_tx.c | 61 ++++++++++++++++++--------------
 1 file changed, 35 insertions(+), 26 deletions(-)
 --- a/drivers/net/wireless/ath/ath10k/htt_tx.c
 +++ b/drivers/net/wireless/ath/ath10k/htt_tx.c
@@ -1295,7 +1295,6 @@ static int ath10k_htt_tx_hl(struct ath10
 	struct ath10k *ar = htt->ar;
 	int res, data_len;
 	struct htt_cmd_hdr *cmd_hdr;
 -	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)msdu->data;
 	struct htt_data_tx_desc *tx_desc;
 	struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(msdu);
 	struct sk_buff *tmp_skb;
@@ -1306,11 +1305,15 @@ static int ath10k_htt_tx_hl(struct ath10
 	u16 flags1 = 0;
 	u16 msdu_id = 0;
 -	if ((ieee80211_is_action(hdr->frame_control) ||
 -	     ieee80211_is_deauth(hdr->frame_control) ||
 -	     ieee80211_is_disassoc(hdr->frame_control)) &&
 -	     ieee80211_has_protected(hdr->frame_control)) {
 -		skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
 +	if (!is_eth) {
 +		struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)msdu->data;
 +
 +		if ((ieee80211_is_action(hdr->frame_control) ||
 +		     ieee80211_is_deauth(hdr->frame_control) ||
 +		     ieee80211_is_disassoc(hdr->frame_control)) &&
 +		     ieee80211_has_protected(hdr->frame_control)) {
 +			skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
 +		}
 	}
 	data_len = msdu->len;
@@ -1407,7 +1410,6 @@ static int ath10k_htt_tx_32(struct ath10
 {
 	struct ath10k *ar = htt->ar;
 	struct device *dev = ar->dev;
 -	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)msdu->data;
 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(msdu);
 	struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(msdu);
 	struct ath10k_hif_sg_item sg_items[2];
@@ -1439,15 +1441,19 @@ static int ath10k_htt_tx_32(struct ath10
 	txbuf_paddr = htt->txbuf.paddr +
 		      (sizeof(struct ath10k_htt_txbuf_32) * msdu_id);
 -	if ((ieee80211_is_action(hdr->frame_control) ||
 -	     ieee80211_is_deauth(hdr->frame_control) ||
 -	     ieee80211_is_disassoc(hdr->frame_control)) &&
 -	     ieee80211_has_protected(hdr->frame_control)) {
 -		skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
 -	} else if (!(skb_cb->flags & ATH10K_SKB_F_NO_HWCRYPT) &&
 -		   txmode == ATH10K_HW_TXRX_RAW &&
 -		   ieee80211_has_protected(hdr->frame_control)) {
 -		skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
 +	if (!is_eth) {
 +		struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)msdu->data;
 +
 +		if ((ieee80211_is_action(hdr->frame_control) ||
 +		     ieee80211_is_deauth(hdr->frame_control) ||
 +		     ieee80211_is_disassoc(hdr->frame_control)) &&
 +		     ieee80211_has_protected(hdr->frame_control)) {
 +			skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
 +		} else if (!(skb_cb->flags & ATH10K_SKB_F_NO_HWCRYPT) &&
 +			   txmode == ATH10K_HW_TXRX_RAW &&
 +			   ieee80211_has_protected(hdr->frame_control)) {
 +			skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
 +		}
 	}
 	skb_cb->paddr = dma_map_single(dev, msdu->data, msdu->len,
@@ -1609,7 +1615,6 @@ static int ath10k_htt_tx_64(struct ath10
 {
 	struct ath10k *ar = htt->ar;
 	struct device *dev = ar->dev;
 -	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)msdu->data;
 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(msdu);
 	struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(msdu);
 	struct ath10k_hif_sg_item sg_items[2];
@@ -1641,15 +1646,19 @@ static int ath10k_htt_tx_64(struct ath10
 	txbuf_paddr = htt->txbuf.paddr +
 		      (sizeof(struct ath10k_htt_txbuf_64) * msdu_id);
 -	if ((ieee80211_is_action(hdr->frame_control) ||
 -	     ieee80211_is_deauth(hdr->frame_control) ||
 -	     ieee80211_is_disassoc(hdr->frame_control)) &&
 -	     ieee80211_has_protected(hdr->frame_control)) {
 -		skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
 -	} else if (!(skb_cb->flags & ATH10K_SKB_F_NO_HWCRYPT) &&
 -		   txmode == ATH10K_HW_TXRX_RAW &&
 -		   ieee80211_has_protected(hdr->frame_control)) {
 -		skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
 +	if (!is_eth) {
 +		struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)msdu->data;
 +
 +		if ((ieee80211_is_action(hdr->frame_control) ||
 +		     ieee80211_is_deauth(hdr->frame_control) ||
 +		     ieee80211_is_disassoc(hdr->frame_control)) &&
 +		     ieee80211_has_protected(hdr->frame_control)) {
 +			skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
 +		} else if (!(skb_cb->flags & ATH10K_SKB_F_NO_HWCRYPT) &&
 +			   txmode == ATH10K_HW_TXRX_RAW &&
 +			   ieee80211_has_protected(hdr->frame_control)) {
 +			skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
 +		}
 	}
 	skb_cb->paddr = dma_map_single(dev, msdu->data, msdu->len,
--- a/package/kernel/mac80211/patches/ath10k/081-04-ath10k-add-encapsulation-offloading-support.patch
+++ b/package/kernel/mac80211/patches/ath10k/081-04-ath10k-add-encapsulation-offloading-support.patch
@ -1,194 +0,0 @@
 From af6d8265c47e46881b80c6b073f53c8c4af52d28 Mon Sep 17 00:00:00 2001
 From: Sergey Ryazanov <ryazanov.s.a@gmail.com>
 Date: Mon, 16 May 2022 13:26:00 +0300
 Subject: ath10k: add encapsulation offloading support
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Frame encapsulation from Ethernet into the IEEE 802.11 frame format
 takes a considerable host CPU time on the xmit path. The firmware is
 able to do this operation for us, so enable encapsulation offloading for
 AP and Sta interface types to improve overall system performance.
 The driver is almost ready for encapsulation offloading support. There
 are only a few places where the driver assumes the frame format is IEEE
 802.11 that need to be fixed.
 Encapsulation offloading is currently disabled by default and the driver
 utilizes mac80211 encapsulation support. To activate offloading, the
 frame_mode=2 parameter should be passed during module loading.
 On a QCA9563+QCA9888-based access point in bridged mode, encapsulation
 offloading increases TCP 16-streams DL throughput from 365 to 396 mbps
 (+8%) and UDP DL throughput from 436 to 483 mbps (+11%).
 Tested-on: QCA9888 hw2.0 PCI 10.4-3.9.0.2-00131
 Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00157-QCARMSWPZ-1
 Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
 Tested-by: Oldřich Jedlička <oldium.pro@gmail.com> # TP-Link Archer C7 v4 & v5 (QCA9563 + QCA9880)
 Tested-by: Edward Matijevic <motolav@gmail.com> # TP-Link Archer C2600 (IPQ8064 + QCA9980 10.4.1.00030-1)
 Tested-by: Edward Matijevic <motolav@gmail.com> # QCA9377 PCI in Sta mode
 Tested-by: Zhijun You <hujy652@gmail.com> # NETGEAR R7800 (QCA9984 10.4-3.9.0.2-00159)
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20220516032519.29831-5-ryazanov.s.a@gmail.com
 ---
 drivers/net/wireless/ath/ath10k/core.c |  2 +-
 drivers/net/wireless/ath/ath10k/mac.c  | 67 +++++++++++++++++++++++++++-------
 2 files changed, 55 insertions(+), 14 deletions(-)
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -54,7 +54,7 @@ MODULE_PARM_DESC(uart_print, "Uart targe
 MODULE_PARM_DESC(skip_otp, "Skip otp failure for calibration in testmode");
 MODULE_PARM_DESC(cryptmode, "Crypto mode: 0-hardware, 1-software");
 MODULE_PARM_DESC(frame_mode,
 -		 "Datapath frame mode (0: raw, 1: native wifi (default))");
 +		 "Datapath frame mode (0: raw, 1: native wifi (default), 2: ethernet)");
 MODULE_PARM_DESC(coredump_mask, "Bitfield of what to include in firmware crash file");
 MODULE_PARM_DESC(fw_diag_log, "Diag based fw log debugging");
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -3710,6 +3710,9 @@ ath10k_mac_tx_h_get_txmode(struct ath10k
 	const struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(skb);
 	__le16 fc = hdr->frame_control;
 +	if (IEEE80211_SKB_CB(skb)->flags & IEEE80211_TX_CTL_HW_80211_ENCAP)
 +		return ATH10K_HW_TXRX_ETHERNET;
 +
 	if (!vif || vif->type == NL80211_IFTYPE_MONITOR)
 		return ATH10K_HW_TXRX_RAW;
@@ -3870,6 +3873,12 @@ static void ath10k_mac_tx_h_fill_cb(stru
 	bool noack = false;
 	cb->flags = 0;
 +
 +	if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) {
 +		cb->flags |= ATH10K_SKB_F_QOS;	/* Assume data frames are QoS */
 +		goto finish_cb_fill;
 +	}
 +
 	if (!ath10k_tx_h_use_hwcrypto(vif, skb))
 		cb->flags |= ATH10K_SKB_F_NO_HWCRYPT;
@@ -3908,6 +3917,7 @@ static void ath10k_mac_tx_h_fill_cb(stru
 		cb->flags |= ATH10K_SKB_F_RAW_TX;
 	}
 +finish_cb_fill:
 	cb->vif = vif;
 	cb->txq = txq;
 	cb->airtime_est = airtime;
@@ -4031,7 +4041,11 @@ static int ath10k_mac_tx(struct ath10k *
 		ath10k_tx_h_seq_no(vif, skb);
 		break;
 	case ATH10K_HW_TXRX_ETHERNET:
 -		ath10k_tx_h_8023(skb);
 +		/* Convert 802.11->802.3 header only if the frame was erlier
 +		 * encapsulated to 802.11 by mac80211. Otherwise pass it as is.
 +		 */
 +		if (!(info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP))
 +			ath10k_tx_h_8023(skb);
 		break;
 	case ATH10K_HW_TXRX_RAW:
 		if (!test_bit(ATH10K_FLAG_RAW_MODE, &ar->dev_flags) &&
@@ -4643,12 +4657,10 @@ static void ath10k_mac_op_tx(struct ieee
 	struct ieee80211_vif *vif = info->control.vif;
 	struct ieee80211_sta *sta = control->sta;
 	struct ieee80211_txq *txq = NULL;
 -	struct ieee80211_hdr *hdr = (void *)skb->data;
 	enum ath10k_hw_txrx_mode txmode;
 	enum ath10k_mac_tx_path txpath;
 	bool is_htt;
 	bool is_mgmt;
 -	bool is_presp;
 	int ret;
 	u16 airtime;
@@ -4662,8 +4674,14 @@ static void ath10k_mac_op_tx(struct ieee
 	is_mgmt = (txpath == ATH10K_MAC_TX_HTT_MGMT);
 	if (is_htt) {
 +		bool is_presp = false;
 +
 		spin_lock_bh(&ar->htt.tx_lock);
 -		is_presp = ieee80211_is_probe_resp(hdr->frame_control);
 +		if (!(info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP)) {
 +			struct ieee80211_hdr *hdr = (void *)skb->data;
 +
 +			is_presp = ieee80211_is_probe_resp(hdr->frame_control);
 +		}
 		ret = ath10k_htt_tx_inc_pending(htt);
 		if (ret) {
@@ -5447,6 +5465,30 @@ static int ath10k_mac_set_txbf_conf(stru
 					 ar->wmi.vdev_param->txbf, value);
 }
 +static void ath10k_update_vif_offload(struct ieee80211_hw *hw,
 +				      struct ieee80211_vif *vif)
 +{
 +	struct ath10k_vif *arvif = (void *)vif->drv_priv;
 +	struct ath10k *ar = hw->priv;
 +	u32 vdev_param;
 +	int ret;
 +
 +	if (ath10k_frame_mode != ATH10K_HW_TXRX_ETHERNET ||
 +	    ar->wmi.vdev_param->tx_encap_type == WMI_VDEV_PARAM_UNSUPPORTED ||
 +	     (vif->type != NL80211_IFTYPE_STATION &&
 +	      vif->type != NL80211_IFTYPE_AP))
 +		vif->offload_flags &= ~IEEE80211_OFFLOAD_ENCAP_ENABLED;
 +
 +	vdev_param = ar->wmi.vdev_param->tx_encap_type;
 +	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
 +					ATH10K_HW_TXRX_NATIVE_WIFI);
 +	/* 10.X firmware does not support this VDEV parameter. Do not warn */
 +	if (ret && ret != -EOPNOTSUPP) {
 +		ath10k_warn(ar, "failed to set vdev %i TX encapsulation: %d\n",
 +			    arvif->vdev_id, ret);
 +	}
 +}
 +
 /*
  * TODO:
  * Figure out how to handle WMI_VDEV_SUBTYPE_P2P_DEVICE,
@@ -5656,15 +5698,7 @@ static int ath10k_add_interface(struct i
 	arvif->def_wep_key_idx = -1;
 -	vdev_param = ar->wmi.vdev_param->tx_encap_type;
 -	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
 -					ATH10K_HW_TXRX_NATIVE_WIFI);
 -	/* 10.X firmware does not support this VDEV parameter. Do not warn */
 -	if (ret && ret != -EOPNOTSUPP) {
 -		ath10k_warn(ar, "failed to set vdev %i TX encapsulation: %d\n",
 -			    arvif->vdev_id, ret);
 -		goto err_vdev_delete;
 -	}
 +	ath10k_update_vif_offload(hw, vif);
 	/* Configuring number of spatial stream for monitor interface is causing
 	 * target assert in qca9888 and qca6174.
@@ -9352,6 +9386,7 @@ static const struct ieee80211_ops ath10k
 	.stop				= ath10k_stop,
 	.config				= ath10k_config,
 	.add_interface			= ath10k_add_interface,
 +	.update_vif_offload		= ath10k_update_vif_offload,
 	.remove_interface		= ath10k_remove_interface,
 	.configure_filter		= ath10k_configure_filter,
 	.bss_info_changed		= ath10k_bss_info_changed,
@@ -10021,6 +10056,12 @@ int ath10k_mac_register(struct ath10k *a
 	if (test_bit(WMI_SERVICE_TDLS_UAPSD_BUFFER_STA, ar->wmi.svc_map))
 		ieee80211_hw_set(ar->hw, SUPPORTS_TDLS_BUFFER_STA);
 +	if (ath10k_frame_mode == ATH10K_HW_TXRX_ETHERNET) {
 +		if (ar->wmi.vdev_param->tx_encap_type !=
 +		    WMI_VDEV_PARAM_UNSUPPORTED)
 +			ieee80211_hw_set(ar->hw, SUPPORTS_TX_ENCAP_OFFLOAD);
 +	}
 +
 	ar->hw->wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
 	ar->hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
 	ar->hw->wiphy->max_remain_on_channel_duration = 5000;
--- a/package/kernel/mac80211/patches/ath10k/100-ath10k-support-bus-and-device-specific-API-1-BDF-sel.patch
+++ b/package/kernel/mac80211/patches/ath10k/100-ath10k-support-bus-and-device-specific-API-1-BDF-sel.patch
@ -1,65 +0,0 @@
 From f2a7064a78b22f2b68b9fcbc8a6f4c5e61c5ba64 Mon Sep 17 00:00:00 2001
 From: Robert Marko <robimarko@gmail.com>
 Date: Sun, 10 Oct 2021 00:17:11 +0200
 Subject: [PATCH] ath10k: support bus and device specific API 1 BDF selection
 Some ath10k IPQ40xx devices like the MikroTik hAP ac2 and ac3 require the
 BDF-s to be extracted from the device storage instead of shipping packaged
 API 2 BDF-s.
 This is required as MikroTik has started shipping boards that require BDF-s
 to be updated, as otherwise their WLAN performance really suffers.
 This is however impossible as the devices that require this are release
 under the same revision and its not possible to differentiate them from
 devices using the older BDF-s.
 In OpenWrt we are extracting the calibration data during runtime and we are
 able to extract the BDF-s in the same manner, however we cannot package the
 BDF-s to API 2 format on the fly and can only use API 1 to provide BDF-s on
 the fly.
 This is an issue as the ath10k driver explicitly looks only for the
 board.bin file and not for something like board-bus-device.bin like it does
 for pre-cal data.
 Due to this we have no way of providing correct BDF-s on the fly, so lets
 extend the ath10k driver to first look for BDF-s in the
 board-bus-device.bin format, for example: board-ahb-a800000.wifi.bin
 If that fails, look for the default board file name as defined previously.
 Signed-off-by: Robert Marko <robimarko@gmail.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20211009221711.2315352-1-robimarko@gmail.com
 ---
 drivers/net/wireless/ath/ath10k/core.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -1202,6 +1202,7 @@ success:
 static int ath10k_core_fetch_board_data_api_1(struct ath10k *ar, int bd_ie_type)
 {
 	const struct firmware *fw;
 +	char boardname[100];
 	if (bd_ie_type == ATH10K_BD_IE_BOARD) {
 		if (!ar->hw_params.fw.board) {
@@ -1209,9 +1210,19 @@ static int ath10k_core_fetch_board_data_
 			return -EINVAL;
 		}
 +		scnprintf(boardname, sizeof(boardname), "board-%s-%s.bin",
 +			  ath10k_bus_str(ar->hif.bus), dev_name(ar->dev));
 +
 		ar->normal_mode_fw.board = ath10k_fetch_fw_file(ar,
 								ar->hw_params.fw.dir,
 -								ar->hw_params.fw.board);
 +								boardname);
 +		if (IS_ERR(ar->normal_mode_fw.board)) {
 +			fw = ath10k_fetch_fw_file(ar,
 +						  ar->hw_params.fw.dir,
 +						  ar->hw_params.fw.board);
 +			ar->normal_mode_fw.board = fw;
 +		}
 +
 		if (IS_ERR(ar->normal_mode_fw.board))
 			return PTR_ERR(ar->normal_mode_fw.board);
--- a/package/kernel/mac80211/patches/ath10k/120-ath10k-fetch-calibration-data-via-nvmem-subsystem.patch
+++ b/package/kernel/mac80211/patches/ath10k/120-ath10k-fetch-calibration-data-via-nvmem-subsystem.patch
@ -1,162 +0,0 @@
 From e2333703373e8b81294da5d1c73c30154f75b082 Mon Sep 17 00:00:00 2001
 From: Christian Lamparter <chunkeey@gmail.com>
 Date: Fri, 15 Oct 2021 18:56:33 +0200
 Subject: [PATCH] ath10k: fetch (pre-)calibration data via nvmem subsystem
 On most embedded ath10k devices (like range extenders,
 routers, accesspoints, ...) the calibration data is
 stored in a easily accessible MTD partitions named
 "ART", "caldata", "calibration", etc...
 Since commit 4b361cfa8624 ("mtd: core: add OTP nvmem provider support"):
 MTD partitions and portions of them can be specified
 as potential nvmem-cells which are accessible through
 the nvmem subsystem.
 This feature - together with an nvmem cell definition either
 in the platform data or via device-tree allows drivers to get
 the (pre-)calibration data which is required for initializing
 the WIFI.
 Tested with Netgear EX6150v2 (IPQ4018)
 Cc: Robert Marko <robimarko@gmail.com>
 Cc: Thibaut Varene <hacks@slashdirt.org>
 Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
 ---
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -12,6 +12,7 @@
 #include <linux/dmi.h>
 #include <linux/ctype.h>
 #include <linux/pm_qos.h>
 +#include <linux/nvmem-consumer.h>
 #include <asm/byteorder.h>
 #include "core.h"
@@ -955,7 +956,8 @@ static int ath10k_core_get_board_id_from
 	}
 	if (ar->cal_mode == ATH10K_PRE_CAL_MODE_DT ||
 -	    ar->cal_mode == ATH10K_PRE_CAL_MODE_FILE)
 +	    ar->cal_mode == ATH10K_PRE_CAL_MODE_FILE ||
 +	    ar->cal_mode == ATH10K_PRE_CAL_MODE_NVMEM)
 		bmi_board_id_param = BMI_PARAM_GET_FLASH_BOARD_ID;
 	else
 		bmi_board_id_param = BMI_PARAM_GET_EEPROM_BOARD_ID;
@@ -1757,7 +1759,8 @@ static int ath10k_download_and_run_otp(s
 	/* As of now pre-cal is valid for 10_4 variants */
 	if (ar->cal_mode == ATH10K_PRE_CAL_MODE_DT ||
 -	    ar->cal_mode == ATH10K_PRE_CAL_MODE_FILE)
 +	    ar->cal_mode == ATH10K_PRE_CAL_MODE_FILE ||
 +	    ar->cal_mode == ATH10K_PRE_CAL_MODE_NVMEM)
 		bmi_otp_exe_param = BMI_PARAM_FLASH_SECTION_ALL;
 	ret = ath10k_bmi_execute(ar, address, bmi_otp_exe_param, &result);
@@ -1884,6 +1887,39 @@ out_free:
 	return ret;
 }
 +static int ath10k_download_cal_nvmem(struct ath10k *ar, const char *cell_name)
 +{
 +	struct nvmem_cell *cell;
 +	void *buf;
 +	size_t len;
 +	int ret;
 +
 +	cell = devm_nvmem_cell_get(ar->dev, cell_name);
 +	if (IS_ERR(cell)) {
 +		ret = PTR_ERR(cell);
 +		return ret;
 +	}
 +
 +	buf = nvmem_cell_read(cell, &len);
 +	if (IS_ERR(buf))
 +		return PTR_ERR(buf);
 +
 +	if (ar->hw_params.cal_data_len != len) {
 +		kfree(buf);
 +		ath10k_warn(ar, "invalid calibration data length in nvmem-cell '%s': %zu != %u\n",
 +			    cell_name, len, ar->hw_params.cal_data_len);
 +		return -EMSGSIZE;
 +	}
 +
 +	ret = ath10k_download_board_data(ar, buf, len);
 +	kfree(buf);
 +	if (ret)
 +		ath10k_warn(ar, "failed to download calibration data from nvmem-cell '%s': %d\n",
 +			    cell_name, ret);
 +
 +	return ret;
 +}
 +
 int ath10k_core_fetch_firmware_api_n(struct ath10k *ar, const char *name,
 				     struct ath10k_fw_file *fw_file)
 {
@@ -2118,6 +2154,18 @@ static int ath10k_core_pre_cal_download(
 {
 	int ret;
 +	ret = ath10k_download_cal_nvmem(ar, "pre-calibration");
 +	if (ret == 0) {
 +		ar->cal_mode = ATH10K_PRE_CAL_MODE_NVMEM;
 +		goto success;
 +	} else if (ret == -EPROBE_DEFER) {
 +		return ret;
 +	}
 +
 +	ath10k_dbg(ar, ATH10K_DBG_BOOT,
 +		   "boot did not find a pre-calibration nvmem-cell, try file next: %d\n",
 +		   ret);
 +
 	ret = ath10k_download_cal_file(ar, ar->pre_cal_file);
 	if (ret == 0) {
 		ar->cal_mode = ATH10K_PRE_CAL_MODE_FILE;
@@ -2184,6 +2232,18 @@ static int ath10k_download_cal_data(stru
 		   "pre cal download procedure failed, try cal file: %d\n",
 		   ret);
 +	ret = ath10k_download_cal_nvmem(ar, "calibration");
 +	if (ret == 0) {
 +		ar->cal_mode = ATH10K_CAL_MODE_NVMEM;
 +		goto done;
 +	} else if (ret == -EPROBE_DEFER) {
 +		return ret;
 +	}
 +
 +	ath10k_dbg(ar, ATH10K_DBG_BOOT,
 +		   "boot did not find a calibration nvmem-cell, try file next: %d\n",
 +		   ret);
 +
 	ret = ath10k_download_cal_file(ar, ar->cal_file);
 	if (ret == 0) {
 		ar->cal_mode = ATH10K_CAL_MODE_FILE;
 --- a/drivers/net/wireless/ath/ath10k/core.h
 +++ b/drivers/net/wireless/ath/ath10k/core.h
@@ -877,8 +877,10 @@ enum ath10k_cal_mode {
 	ATH10K_CAL_MODE_FILE,
 	ATH10K_CAL_MODE_OTP,
 	ATH10K_CAL_MODE_DT,
 +	ATH10K_CAL_MODE_NVMEM,
 	ATH10K_PRE_CAL_MODE_FILE,
 	ATH10K_PRE_CAL_MODE_DT,
 +	ATH10K_PRE_CAL_MODE_NVMEM,
 	ATH10K_CAL_MODE_EEPROM,
 };
@@ -898,10 +900,14 @@ static inline const char *ath10k_cal_mod
 		return "otp";
 	case ATH10K_CAL_MODE_DT:
 		return "dt";
 +	case ATH10K_CAL_MODE_NVMEM:
 +		return "nvmem";
 	case ATH10K_PRE_CAL_MODE_FILE:
 		return "pre-cal-file";
 	case ATH10K_PRE_CAL_MODE_DT:
 		return "pre-cal-dt";
 +	case ATH10K_PRE_CAL_MODE_NVMEM:
 +		return "pre-cal-nvmem";
 	case ATH10K_CAL_MODE_EEPROM:
 		return "eeprom";
 	}
--- a/package/kernel/mac80211/patches/ath10k/911-ath10k-disable-caldata-prefetch-for-sdio-bus.patch
+++ b/package/kernel/mac80211/patches/ath10k/911-ath10k-disable-caldata-prefetch-for-sdio-bus.patch
@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath10k/debug.c
 +++ b/drivers/net/wireless/ath/ath10k/debug.c
-@@ -1255,6 +1255,9 @@ static int ath10k_debug_cal_data_fetch(struct ath10k *ar)
+@@ -1260,6 +1260,9 @@ static int ath10k_debug_cal_data_fetch(struct ath10k *ar)
 	if (ar->hw_params.cal_data_len == 0)
 		return -EOPNOTSUPP;
--- a/package/kernel/mac80211/patches/ath10k/921-ath10k_init_devices_synchronously.patch
+++ b/package/kernel/mac80211/patches/ath10k/921-ath10k_init_devices_synchronously.patch
@ -14,7 +14,7 @@ Signed-off-by: Sven Eckelmann <sven@open-mesh.com>
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -3443,6 +3443,17 @@ int ath10k_core_register(struct ath10k *
+@@ -3516,6 +3516,17 @@ int ath10k_core_register(struct ath10k *
 	queue_work(ar->workqueue, &ar->register_work);
--- a/package/kernel/mac80211/patches/ath10k/930-ath10k_add_tpt_led_trigger.patch
+++ b/package/kernel/mac80211/patches/ath10k/930-ath10k_add_tpt_led_trigger.patch
@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -9878,6 +9878,21 @@ static int ath10k_mac_init_rd(struct ath
+@@ -9909,6 +9909,21 @@ static int ath10k_mac_init_rd(struct ath
 	return 0;
 }
@ -22,7 +22,7 @@
 int ath10k_mac_register(struct ath10k *ar)
 {
 	static const u32 cipher_suites[] = {
-@@ -10236,6 +10251,12 @@ int ath10k_mac_register(struct ath10k *a
+@@ -10267,6 +10282,12 @@ int ath10k_mac_register(struct ath10k *a
 	ar->hw->weight_multiplier = ATH10K_AIRTIME_WEIGHT_MULTIPLIER;
--- a/package/kernel/mac80211/patches/ath10k/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
+++ b/package/kernel/mac80211/patches/ath10k/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch
@ -114,7 +114,7 @@ v13:
 ath10k_core-$(CONFIG_DEV_COREDUMP) += coredump.o
 --- a/local-symbols
 +++ b/local-symbols
-@@ -143,6 +143,7 @@ ATH10K_DEBUG=
+@@ -162,6 +162,7 @@ ATH10K_DEBUG=
 ATH10K_DEBUGFS=
 ATH10K_SPECTRAL=
 ATH10K_THERMAL=
@ -140,7 +140,7 @@ v13:
 		.patch_load_addr = QCA988X_HW_2_0_PATCH_LOAD_ADDR,
 		.uart_pin = 7,
 		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_ALL,
-@@ -138,6 +140,7 @@ static const struct ath10k_hw_params ath
+@@ -146,6 +148,7 @@ static const struct ath10k_hw_params ath
 		.dev_id = QCA9887_1_0_DEVICE_ID,
 		.bus = ATH10K_BUS_PCI,
 		.name = "qca9887 hw1.0",
@ -148,7 +148,7 @@ v13:
 		.patch_load_addr = QCA9887_HW_1_0_PATCH_LOAD_ADDR,
 		.uart_pin = 7,
 		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_ALL,
-@@ -355,6 +358,7 @@ static const struct ath10k_hw_params ath
+@@ -387,6 +390,7 @@ static const struct ath10k_hw_params ath
 		.dev_id = QCA99X0_2_0_DEVICE_ID,
 		.bus = ATH10K_BUS_PCI,
 		.name = "qca99x0 hw2.0",
@ -156,7 +156,7 @@ v13:
 		.patch_load_addr = QCA99X0_HW_2_0_PATCH_LOAD_ADDR,
 		.uart_pin = 7,
 		.otp_exe_param = 0x00000700,
-@@ -397,6 +401,7 @@ static const struct ath10k_hw_params ath
+@@ -433,6 +437,7 @@ static const struct ath10k_hw_params ath
 		.dev_id = QCA9984_1_0_DEVICE_ID,
 		.bus = ATH10K_BUS_PCI,
 		.name = "qca9984/qca9994 hw1.0",
@ -164,7 +164,7 @@ v13:
 		.patch_load_addr = QCA9984_HW_1_0_PATCH_LOAD_ADDR,
 		.uart_pin = 7,
 		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_EACH,
-@@ -446,6 +451,7 @@ static const struct ath10k_hw_params ath
+@@ -486,6 +491,7 @@ static const struct ath10k_hw_params ath
 		.dev_id = QCA9888_2_0_DEVICE_ID,
 		.bus = ATH10K_BUS_PCI,
 		.name = "qca9888 hw2.0",
@ -172,7 +172,7 @@ v13:
 		.patch_load_addr = QCA9888_HW_2_0_PATCH_LOAD_ADDR,
 		.uart_pin = 7,
 		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_EACH,
-@@ -3158,6 +3164,10 @@ int ath10k_core_start(struct ath10k *ar,
+@@ -3231,6 +3237,10 @@ int ath10k_core_start(struct ath10k *ar,
 		goto err_hif_stop;
 	}
@ -183,7 +183,7 @@ v13:
 	return 0;
 err_hif_stop:
-@@ -3416,9 +3426,18 @@ static void ath10k_core_register_work(st
+@@ -3489,9 +3499,18 @@ static void ath10k_core_register_work(st
 		goto err_spectral_destroy;
 	}
@ -202,7 +202,7 @@ v13:
 err_spectral_destroy:
 	ath10k_spectral_destroy(ar);
 err_debug_destroy:
-@@ -3464,6 +3483,8 @@ void ath10k_core_unregister(struct ath10
+@@ -3537,6 +3556,8 @@ void ath10k_core_unregister(struct ath10
 	if (!test_bit(ATH10K_FLAG_CORE_REGISTERED, &ar->dev_flags))
 		return;
@ -221,7 +221,7 @@ v13:
 #include "htt.h"
 #include "htc.h"
-@@ -1256,6 +1257,13 @@ struct ath10k {
+@@ -1253,6 +1254,13 @@ struct ath10k {
 	} testmode;
 	struct {
@ -237,7 +237,7 @@ v13:
 		u32 fw_crash_counter;
 --- a/drivers/net/wireless/ath/ath10k/hw.h
 +++ b/drivers/net/wireless/ath/ath10k/hw.h
-@@ -517,6 +517,7 @@ struct ath10k_hw_params {
+@@ -519,6 +519,7 @@ struct ath10k_hw_params {
 	const char *name;
 	u32 patch_load_addr;
 	int uart_pin;
--- a/package/kernel/mac80211/patches/ath10k/975-ath10k-use-tpt-trigger-by-default.patch
+++ b/package/kernel/mac80211/patches/ath10k/975-ath10k-use-tpt-trigger-by-default.patch
@ -16,7 +16,7 @@ Signed-off-by: Mathias Kresin <dev@kresin.me>
 --- a/drivers/net/wireless/ath/ath10k/core.h
 +++ b/drivers/net/wireless/ath/ath10k/core.h
-@@ -1312,6 +1312,10 @@ struct ath10k {
+@@ -1309,6 +1309,10 @@ struct ath10k {
 	s32 tx_power_2g_limit;
 	s32 tx_power_5g_limit;
@ -42,7 +42,7 @@ Signed-off-by: Mathias Kresin <dev@kresin.me>
 	if (ret)
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -10253,7 +10253,7 @@ int ath10k_mac_register(struct ath10k *a
+@@ -10284,7 +10284,7 @@ int ath10k_mac_register(struct ath10k *a
 	ar->hw->weight_multiplier = ATH10K_AIRTIME_WEIGHT_MULTIPLIER;
 #ifdef CPTCFG_MAC80211_LEDS
--- a/package/kernel/mac80211/patches/ath10k/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch
+++ b/package/kernel/mac80211/patches/ath10k/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch
@ -28,7 +28,7 @@ Forwarded: no
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -1021,6 +1021,40 @@ static inline int ath10k_vdev_setup_sync
+@@ -1028,6 +1028,40 @@ static inline int ath10k_vdev_setup_sync
 	return ar->last_wmi_vdev_start_status;
 }
@ -69,7 +69,7 @@ Forwarded: no
 static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id)
 {
 	struct cfg80211_chan_def *chandef = NULL;
-@@ -1053,7 +1087,8 @@ static int ath10k_monitor_vdev_start(str
+@@ -1060,7 +1094,8 @@ static int ath10k_monitor_vdev_start(str
 	arg.channel.min_power = 0;
 	arg.channel.max_power = channel->max_power * 2;
 	arg.channel.max_reg_power = channel->max_reg_power * 2;
@ -79,7 +79,7 @@ Forwarded: no
 	reinit_completion(&ar->vdev_setup_done);
 	reinit_completion(&ar->vdev_delete_done);
-@@ -1499,7 +1534,8 @@ static int ath10k_vdev_start_restart(str
+@@ -1506,7 +1541,8 @@ static int ath10k_vdev_start_restart(str
 	arg.channel.min_power = 0;
 	arg.channel.max_power = chandef->chan->max_power * 2;
 	arg.channel.max_reg_power = chandef->chan->max_reg_power * 2;
@ -89,7 +89,7 @@ Forwarded: no
 	if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
 		arg.ssid = arvif->u.ap.ssid;
-@@ -3427,7 +3463,8 @@ static int ath10k_update_channel_list(st
+@@ -3437,7 +3473,8 @@ static int ath10k_update_channel_list(st
 			ch->min_power = 0;
 			ch->max_power = channel->max_power * 2;
 			ch->max_reg_power = channel->max_reg_power * 2;
--- a/package/kernel/mac80211/patches/ath10k/984-ath10k-Try-to-get-mac-address-from-dts.patch
+++ b/package/kernel/mac80211/patches/ath10k/984-ath10k-Try-to-get-mac-address-from-dts.patch
@ -26,9 +26,9 @@ Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
 #include <linux/property.h>
 #include <linux/dmi.h>
 #include <linux/ctype.h>
-@@ -3334,6 +3335,8 @@ static int ath10k_core_probe_fw(struct a
+@@ -3407,6 +3408,8 @@ static int ath10k_core_probe_fw(struct a
- 	device_get_mac_address(ar->dev, ar->mac_addr, sizeof(ar->mac_addr));
+ 	device_get_mac_address(ar->dev, ar->mac_addr);
 +	of_get_mac_address(ar->dev->of_node, ar->mac_addr);
 +
--- a/package/kernel/mac80211/patches/ath10k/991-ath10k-5.19.patch
+++ b/package/kernel/mac80211/patches/ath10k/991-ath10k-5.19.patch
@ -1,14 +0,0 @@
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -3333,7 +3333,11 @@ static int ath10k_core_probe_fw(struct a
 		ath10k_debug_print_board_info(ar);
 	}
 +#if LINUX_VERSION_CODE < KERNEL_VERSION(5,18,0)
 	device_get_mac_address(ar->dev, ar->mac_addr, sizeof(ar->mac_addr));
 +#else
 +	device_get_mac_address(ar->dev, ar->mac_addr);
 +#endif
 	of_get_mac_address(ar->dev->of_node, ar->mac_addr);
--- a/package/kernel/mac80211/patches/ath11k/0001-ath11k-fix-4-addr-tx-failure-for-AP-and-STA-modes.patch
+++ b/package/kernel/mac80211/patches/ath11k/0001-ath11k-fix-4-addr-tx-failure-for-AP-and-STA-modes.patch
@ -1,151 +0,0 @@
 From 34c67dc366419e06129dad0f32f521842bdff9bc Mon Sep 17 00:00:00 2001
 From: Sathishkumar Muruganandam <murugana@codeaurora.org>
 Date: Wed, 21 Jul 2021 00:31:46 +0300
 Subject: [PATCH] ath11k: fix 4-addr tx failure for AP and STA modes
 Ath11k FW requires peer parameter WMI_PEER_USE_4ADDR to be set for
 4-addr peers allowing 4-address frame transmission to those peers.
 Add ath11k driver callback for sta_set_4addr() to queue new workq
 set_4addr_wk only once based on new boolean, use_4addr_set.
 sta_set_4addr() will be called during 4-addr STA association cases
 applicable for both AP and STA modes.
 In ath11k_sta_set_4addr_wk(),
 AP mode:
        WMI_PEER_USE_4ADDR will be set for the corresponding
        associated 4-addr STA(s)
 STA mode:
        WMI_PEER_USE_4ADDR will be set for the AP to which the
        4-addr STA got associated.
 Tested-on: IPQ8074 WLAN.HK.2.1.0.1-01238-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210720213147.90042-1-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/core.h |  3 ++
 drivers/net/wireless/ath/ath11k/mac.c  | 48 ++++++++++++++++++++++++--
 2 files changed, 49 insertions(+), 2 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
@@ -368,6 +368,7 @@ struct ath11k_sta {
 	enum hal_pn_type pn_type;
 	struct work_struct update_wk;
 +	struct work_struct set_4addr_wk;
 	struct rate_info txrate;
 	struct rate_info last_txrate;
 	u64 rx_duration;
@@ -380,6 +381,8 @@ struct ath11k_sta {
 	/* protected by conf_mutex */
 	bool aggr_mode;
 #endif
 +
 +	bool use_4addr_set;
 };
 #define ATH11K_MIN_5G_FREQ 4150
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -3161,6 +3161,31 @@ static void ath11k_sta_rc_update_wk(stru
 	mutex_unlock(&ar->conf_mutex);
 }
 +static void ath11k_sta_set_4addr_wk(struct work_struct *wk)
 +{
 +	struct ath11k *ar;
 +	struct ath11k_vif *arvif;
 +	struct ath11k_sta *arsta;
 +	struct ieee80211_sta *sta;
 +	int ret = 0;
 +
 +	arsta = container_of(wk, struct ath11k_sta, set_4addr_wk);
 +	sta = container_of((void *)arsta, struct ieee80211_sta, drv_priv);
 +	arvif = arsta->arvif;
 +	ar = arvif->ar;
 +
 +	ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
 +		   "setting USE_4ADDR for peer %pM\n", sta->addr);
 +
 +	ret = ath11k_wmi_set_peer_param(ar, sta->addr,
 +					arvif->vdev_id,
 +					WMI_PEER_USE_4ADDR, 1);
 +
 +	if (ret)
 +		ath11k_warn(ar->ab, "failed to set peer %pM 4addr capability: %d\n",
 +			    sta->addr, ret);
 +}
 +
 static int ath11k_mac_inc_num_stations(struct ath11k_vif *arvif,
 				       struct ieee80211_sta *sta)
 {
@@ -3240,11 +3265,13 @@ static int ath11k_mac_station_add(struct
 	}
 	if (ieee80211_vif_is_mesh(vif)) {
 +		ath11k_dbg(ab, ATH11K_DBG_MAC,
 +			   "setting USE_4ADDR for mesh STA %pM\n", sta->addr);
 		ret = ath11k_wmi_set_peer_param(ar, sta->addr,
 						arvif->vdev_id,
 						WMI_PEER_USE_4ADDR, 1);
 		if (ret) {
 -			ath11k_warn(ab, "failed to STA %pM 4addr capability: %d\n",
 +			ath11k_warn(ab, "failed to set mesh STA %pM 4addr capability: %d\n",
 				    sta->addr, ret);
 			goto free_tx_stats;
 		}
@@ -3297,8 +3324,10 @@ static int ath11k_mac_op_sta_state(struc
 	/* cancel must be done outside the mutex to avoid deadlock */
 	if ((old_state == IEEE80211_STA_NONE &&
 -	     new_state == IEEE80211_STA_NOTEXIST))
 +	     new_state == IEEE80211_STA_NOTEXIST)) {
 		cancel_work_sync(&arsta->update_wk);
 +		cancel_work_sync(&arsta->set_4addr_wk);
 +	}
 	mutex_lock(&ar->conf_mutex);
@@ -3307,6 +3336,7 @@ static int ath11k_mac_op_sta_state(struc
 		memset(arsta, 0, sizeof(*arsta));
 		arsta->arvif = arvif;
 		INIT_WORK(&arsta->update_wk, ath11k_sta_rc_update_wk);
 +		INIT_WORK(&arsta->set_4addr_wk, ath11k_sta_set_4addr_wk);
 		ret = ath11k_mac_station_add(ar, vif, sta);
 		if (ret)
@@ -3401,6 +3431,19 @@ out:
 	return ret;
 }
 +static void ath11k_mac_op_sta_set_4addr(struct ieee80211_hw *hw,
 +					struct ieee80211_vif *vif,
 +					struct ieee80211_sta *sta, bool enabled)
 +{
 +	struct ath11k *ar = hw->priv;
 +	struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv;
 +
 +	if (enabled && !arsta->use_4addr_set) {
 +		ieee80211_queue_work(ar->hw, &arsta->set_4addr_wk);
 +		arsta->use_4addr_set = true;
 +	}
 +}
 +
 static void ath11k_mac_op_sta_rc_update(struct ieee80211_hw *hw,
 					struct ieee80211_vif *vif,
 					struct ieee80211_sta *sta,
@@ -6190,6 +6233,7 @@ static const struct ieee80211_ops ath11k
 	.cancel_hw_scan                 = ath11k_mac_op_cancel_hw_scan,
 	.set_key                        = ath11k_mac_op_set_key,
 	.sta_state                      = ath11k_mac_op_sta_state,
 +	.sta_set_4addr                  = ath11k_mac_op_sta_set_4addr,
 	.sta_set_txpwr			= ath11k_mac_op_sta_set_txpwr,
 	.sta_rc_update			= ath11k_mac_op_sta_rc_update,
 	.conf_tx                        = ath11k_mac_op_conf_tx,
--- a/package/kernel/mac80211/patches/ath11k/0001-wifi-ath11k-stop-tx-queues-immediately-upon-firmware.patch
+++ b/package/kernel/mac80211/patches/ath11k/0001-wifi-ath11k-stop-tx-queues-immediately-upon-firmware.patch
@ -0,0 +1,78 @@
 From 81e60b2dfb2744ab6642c4aa62534b4f711fdc5d Mon Sep 17 00:00:00 2001
 From: Aditya Kumar Singh <quic_adisi@quicinc.com>
 Date: Tue, 27 Sep 2022 09:18:54 +0300
 Subject: [PATCH] wifi: ath11k: stop tx queues immediately upon firmware exit
 Currently, recovery flag is set immediately upon firmware
 exit but tx queues are stopped once firmware arrives back
 and is ready which is during ath11k_core_restart. Once
 ieee80211 hw restart is completed, tx queues are resumed.
 If during the time delta between firmware exit and firmware
 ready, mac80211 send packets, currently ath11k will drop it
 since recovery flag will be set. But warning prints will
 come -
  "ath11k c000000.wifi: failed to transmit frame -108"
 If more tx packets are there, this could lead to flooding
 of above print.
 However, actually tx queues should be stopped immediately
 when firmware leaves. This will prevent packets to get
 dropped when firmware is recovering.
 Add fix to stop tx queues immediately after firmware exit.
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20220923170235.18873-1-quic_adisi@quicinc.com
 ---
 drivers/net/wireless/ath/ath11k/core.c | 5 +----
 drivers/net/wireless/ath/ath11k/core.h | 1 +
 drivers/net/wireless/ath/ath11k/qmi.c  | 3 +++
 3 files changed, 5 insertions(+), 4 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
@@ -1641,7 +1641,7 @@ static void ath11k_update_11d(struct wor
 	}
 }
 -static void ath11k_core_pre_reconfigure_recovery(struct ath11k_base *ab)
 +void ath11k_core_pre_reconfigure_recovery(struct ath11k_base *ab)
 {
 	struct ath11k *ar;
 	struct ath11k_pdev *pdev;
@@ -1730,9 +1730,6 @@ static void ath11k_core_restart(struct w
 	struct ath11k_base *ab = container_of(work, struct ath11k_base, restart_work);
 	int ret;
 -	if (!ab->is_reset)
 -		ath11k_core_pre_reconfigure_recovery(ab);
 -
 	ret = ath11k_core_reconfigure_on_crash(ab);
 	if (ret) {
 		ath11k_err(ab, "failed to reconfigure driver on crash recovery\n");
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
@@ -1158,6 +1158,7 @@ int ath11k_core_check_smbios(struct ath1
 void ath11k_core_halt(struct ath11k *ar);
 int ath11k_core_resume(struct ath11k_base *ab);
 int ath11k_core_suspend(struct ath11k_base *ab);
 +void ath11k_core_pre_reconfigure_recovery(struct ath11k_base *ab);
 const struct firmware *ath11k_core_firmware_request(struct ath11k_base *ab,
 						    const char *filename);
 --- a/drivers/net/wireless/ath/ath11k/qmi.c
 +++ b/drivers/net/wireless/ath/ath11k/qmi.c
@@ -3164,6 +3164,9 @@ static void ath11k_qmi_driver_event_work
 		case ATH11K_QMI_EVENT_SERVER_EXIT:
 			set_bit(ATH11K_FLAG_CRASH_FLUSH, &ab->dev_flags);
 			set_bit(ATH11K_FLAG_RECOVERY, &ab->dev_flags);
 +
 +			if (!ab->is_reset)
 +				ath11k_core_pre_reconfigure_recovery(ab);
 			break;
 		case ATH11K_QMI_EVENT_REQUEST_MEM:
 			ret = ath11k_qmi_event_mem_request(qmi);
--- a/package/kernel/mac80211/patches/ath11k/0002-ath11k-fix-4addr-multicast-packet-tx.patch
+++ b/package/kernel/mac80211/patches/ath11k/0002-ath11k-fix-4addr-multicast-packet-tx.patch
@ -1,123 +0,0 @@
 From e20cfa3b62aeb1b5fc5ffa86a007af97f9954767 Mon Sep 17 00:00:00 2001
 From: Karthikeyan Periyasamy <periyasa@codeaurora.org>
 Date: Wed, 21 Jul 2021 00:31:47 +0300
 Subject: [PATCH] ath11k: fix 4addr multicast packet tx
 In 4addr, AP wired backbone to STA wired backbone ping fails due to ARP
 request not getting answered. Here 4addr ARP multicast packet is sent in
 3addr, so that 4addr STA not honouring the 3addr ARP multicast packet.
 Fix this issue by sending out multicast packet in 4addr format, firmware
 expects peer meta flag instead of vdev meta flag in Tx descriptor.
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01641-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Karthikeyan Periyasamy <periyasa@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210720213147.90042-2-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/core.h  |  1 +
 drivers/net/wireless/ath/ath11k/dp_tx.c | 12 ++++++++++--
 drivers/net/wireless/ath/ath11k/dp_tx.h |  2 +-
 drivers/net/wireless/ath/ath11k/mac.c   |  6 +++++-
 drivers/net/wireless/ath/ath11k/peer.c  | 11 +++++++++++
 5 files changed, 28 insertions(+), 4 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
@@ -383,6 +383,7 @@ struct ath11k_sta {
 #endif
 	bool use_4addr_set;
 +	u16 tcl_metadata;
 };
 #define ATH11K_MIN_5G_FREQ 4150
 --- a/drivers/net/wireless/ath/ath11k/dp_tx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
@@ -78,7 +78,7 @@ enum hal_encrypt_type ath11k_dp_tx_get_e
 }
 int ath11k_dp_tx(struct ath11k *ar, struct ath11k_vif *arvif,
 -		 struct sk_buff *skb)
 +		 struct ath11k_sta *arsta, struct sk_buff *skb)
 {
 	struct ath11k_base *ab = ar->ab;
 	struct ath11k_dp *dp = &ab->dp;
@@ -145,7 +145,15 @@ tcl_ring_sel:
 		     FIELD_PREP(DP_TX_DESC_ID_MSDU_ID, ret) |
 		     FIELD_PREP(DP_TX_DESC_ID_POOL_ID, pool_id);
 	ti.encap_type = ath11k_dp_tx_get_encap_type(arvif, skb);
 -	ti.meta_data_flags = arvif->tcl_metadata;
 +
 +	if (ieee80211_has_a4(hdr->frame_control) &&
 +	    is_multicast_ether_addr(hdr->addr3) && arsta &&
 +	    arsta->use_4addr_set) {
 +		ti.meta_data_flags = arsta->tcl_metadata;
 +		ti.flags0 |= FIELD_PREP(HAL_TCL_DATA_CMD_INFO1_TO_FW, 1);
 +	} else {
 +		ti.meta_data_flags = arvif->tcl_metadata;
 +	}
 	if (ti.encap_type == HAL_TCL_ENCAP_TYPE_RAW) {
 		if (skb_cb->flags & ATH11K_SKB_CIPHER_SET) {
 --- a/drivers/net/wireless/ath/ath11k/dp_tx.h
 +++ b/drivers/net/wireless/ath/ath11k/dp_tx.h
@@ -17,7 +17,7 @@ struct ath11k_dp_htt_wbm_tx_status {
 int ath11k_dp_tx_htt_h2t_ver_req_msg(struct ath11k_base *ab);
 int ath11k_dp_tx(struct ath11k *ar, struct ath11k_vif *arvif,
 -		 struct sk_buff *skb);
 +		 struct ath11k_sta *arsta, struct sk_buff *skb);
 void ath11k_dp_tx_completion_handler(struct ath11k_base *ab, int ring_id);
 int ath11k_dp_tx_send_reo_cmd(struct ath11k_base *ab, struct dp_rx_tid *rx_tid,
 			      enum hal_reo_cmd_type type,
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -4366,6 +4366,7 @@ static void ath11k_mac_op_tx(struct ieee
 	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 	struct ieee80211_key_conf *key = info->control.hw_key;
 +	struct ath11k_sta *arsta = NULL;
 	u32 info_flags = info->flags;
 	bool is_prb_rsp;
 	int ret;
@@ -4391,7 +4392,10 @@ static void ath11k_mac_op_tx(struct ieee
 		return;
 	}
 -	ret = ath11k_dp_tx(ar, arvif, skb);
 +	if (control->sta)
 +		arsta = (struct ath11k_sta *)control->sta->drv_priv;
 +
 +	ret = ath11k_dp_tx(ar, arvif, arsta, skb);
 	if (ret) {
 		ath11k_warn(ar->ab, "failed to transmit frame %d\n", ret);
 		ieee80211_free_txskb(ar->hw, skb);
 --- a/drivers/net/wireless/ath/ath11k/peer.c
 +++ b/drivers/net/wireless/ath/ath11k/peer.c
@@ -251,6 +251,7 @@ int ath11k_peer_create(struct ath11k *ar
 		       struct ieee80211_sta *sta, struct peer_create_params *param)
 {
 	struct ath11k_peer *peer;
 +	struct ath11k_sta *arsta;
 	int ret;
 	lockdep_assert_held(&ar->conf_mutex);
@@ -319,6 +320,16 @@ int ath11k_peer_create(struct ath11k *ar
 	peer->sec_type = HAL_ENCRYPT_TYPE_OPEN;
 	peer->sec_type_grp = HAL_ENCRYPT_TYPE_OPEN;
 +	if (sta) {
 +		arsta = (struct ath11k_sta *)sta->drv_priv;
 +		arsta->tcl_metadata |= FIELD_PREP(HTT_TCL_META_DATA_TYPE, 0) |
 +				       FIELD_PREP(HTT_TCL_META_DATA_PEER_ID,
 +						  peer->peer_id);
 +
 +		/* set HTT extension valid bit to 0 by default */
 +		arsta->tcl_metadata &= ~HTT_TCL_META_DATA_VALID_HTT;
 +	}
 +
 	ar->num_peers++;
 	spin_unlock_bh(&ar->ab->base_lock);
--- a/package/kernel/mac80211/patches/ath11k/0002-wifi-ath11k-Don-t-exit-on-wakeup-failure.patch
+++ b/package/kernel/mac80211/patches/ath11k/0002-wifi-ath11k-Don-t-exit-on-wakeup-failure.patch
@ -0,0 +1,45 @@
 From 45d2e268369b0c768d5a644f319758bcfd370521 Mon Sep 17 00:00:00 2001
 From: Baochen Qiang <quic_bqiang@quicinc.com>
 Date: Wed, 28 Sep 2022 09:51:40 +0800
 Subject: [PATCH] wifi: ath11k: Don't exit on wakeup failure
 Currently, ath11k_pcic_read() returns an error if wakeup()
 fails, this makes firmware crash debug quite hard because we can
 get nothing.
 Change to go ahead on wakeup failure, in that case we still may
 get something valid to check. There should be no mislead due
 to incorrect content because we are aware of the failure with the
 log printed.
 Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
 Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20220928015140.5431-1-quic_bqiang@quicinc.com
 ---
 drivers/net/wireless/ath/ath11k/pcic.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/pcic.c
 +++ b/drivers/net/wireless/ath/ath11k/pcic.c
@@ -218,9 +218,16 @@ int ath11k_pcic_read(struct ath11k_base
 	if (wakeup_required && ab->pci.ops->wakeup) {
 		ret = ab->pci.ops->wakeup(ab);
 		if (ret) {
 -			ath11k_warn(ab, "failed to wakeup for read from 0x%x: %d\n",
 -				    start, ret);
 -			return ret;
 +			ath11k_warn(ab,
 +				    "wakeup failed, data may be invalid: %d",
 +				    ret);
 +			/* Even though wakeup() failed, continue processing rather
 +			 * than returning because some parts of the data may still
 +			 * be valid and useful in some cases, e.g. could give us
 +			 * some clues on firmware crash.
 +			 * Mislead due to invalid data could be avoided because we
 +			 * are aware of the wakeup failure.
 +			 */
 		}
 	}
--- a/package/kernel/mac80211/patches/ath11k/0003-ath11k-Rename-atf_config-to-flag1-in-target_resource.patch
+++ b/package/kernel/mac80211/patches/ath11k/0003-ath11k-Rename-atf_config-to-flag1-in-target_resource.patch
@ -1,41 +0,0 @@
 From 7e9fb2418a4c092a363d23e97973c9624150e5b2 Mon Sep 17 00:00:00 2001
 From: Seevalamuthu Mariappan <seevalam@codeaurora.org>
 Date: Wed, 21 Jul 2021 00:49:20 +0300
 Subject: [PATCH] ath11k: Rename atf_config to flag1 in target_resource_config
 The flag's purpose is not only meant for ATF configs. Rename atf_config
 to flag1, so it can be used for future purposes.
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.1.0.1-01228-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210720214922.118078-1-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/wmi.c | 2 +-
 drivers/net/wireless/ath/ath11k/wmi.h | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -3497,7 +3497,7 @@ ath11k_wmi_copy_resource_config(struct w
 	wmi_cfg->bpf_instruction_size = tg_cfg->bpf_instruction_size;
 	wmi_cfg->max_bssid_rx_filters = tg_cfg->max_bssid_rx_filters;
 	wmi_cfg->use_pdev_id = tg_cfg->use_pdev_id;
 -	wmi_cfg->flag1 = tg_cfg->atf_config;
 +	wmi_cfg->flag1 = tg_cfg->flag1;
 	wmi_cfg->peer_map_unmap_v2_support = tg_cfg->peer_map_unmap_v2_support;
 	wmi_cfg->sched_params = tg_cfg->sched_params;
 	wmi_cfg->twt_ap_pdev_count = tg_cfg->twt_ap_pdev_count;
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
@@ -5015,7 +5015,7 @@ struct target_resource_config {
 	u32 vo_minfree;
 	u32 rx_batchmode;
 	u32 tt_support;
 -	u32 atf_config;
 +	u32 flag1;
 	u32 iphdr_pad_config;
 	u32 qwrap_config:16,
 	    alloc_frag_desc_for_data_pkt:16;
--- a/package/kernel/mac80211/patches/ath11k/0004-ath11k-add-support-in-survey-dump-with-bss_chan_info.patch
+++ b/package/kernel/mac80211/patches/ath11k/0004-ath11k-add-support-in-survey-dump-with-bss_chan_info.patch
@ -1,51 +0,0 @@
 From 9b4dd38b46cf24d8cb3ab433661cdc23a35160d0 Mon Sep 17 00:00:00 2001
 From: Seevalamuthu Mariappan <seevalam@codeaurora.org>
 Date: Wed, 21 Jul 2021 00:49:21 +0300
 Subject: [PATCH] ath11k: add support in survey dump with bss_chan_info
 Survey dump statistics is not displaying channel rx and tx time because
 the service flag is not enabled. Enable the service flag "bss_chan_info"
 in wmi_resource_config to fetch and print the stats for the specific
 pdev.
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.1.0.1-01228-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Ritesh Singh <ritesi@codeaurora.org>
 Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210720214922.118078-2-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/hw.c  | 2 ++
 drivers/net/wireless/ath/ath11k/wmi.h | 2 ++
 2 files changed, 4 insertions(+)
 --- a/drivers/net/wireless/ath/ath11k/hw.c
 +++ b/drivers/net/wireless/ath/ath11k/hw.c
@@ -97,6 +97,7 @@ static void ath11k_init_wmi_config_qca63
 	config->num_multicast_filter_entries = 0x20;
 	config->num_wow_filters = 0x16;
 	config->num_keep_alive_pattern = 0;
 +	config->flag1 |= WMI_RSRC_CFG_FLAG1_BSS_CHANNEL_INFO_64;
 }
 static void ath11k_hw_ipq8074_reo_setup(struct ath11k_base *ab)
@@ -197,6 +198,7 @@ static void ath11k_init_wmi_config_ipq80
 	config->peer_map_unmap_v2_support = 1;
 	config->twt_ap_pdev_count = ab->num_radios;
 	config->twt_ap_sta_count = 1000;
 +	config->flag1 |= WMI_RSRC_CFG_FLAG1_BSS_CHANNEL_INFO_64;
 }
 static int ath11k_hw_mac_id_to_pdev_id_ipq8074(struct ath11k_hw_params *hw,
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
@@ -2244,6 +2244,8 @@ struct wmi_init_cmd {
 	u32 num_host_mem_chunks;
 } __packed;
 +#define WMI_RSRC_CFG_FLAG1_BSS_CHANNEL_INFO_64 BIT(5)
 +
 struct wmi_resource_config {
 	u32 tlv_header;
 	u32 num_vdevs;
--- a/package/kernel/mac80211/patches/ath11k/0005-wifi-ath11k-Fix-spelling-mistake-chnange-change.patch
+++ b/package/kernel/mac80211/patches/ath11k/0005-wifi-ath11k-Fix-spelling-mistake-chnange-change.patch
@ -0,0 +1,25 @@
 From a797f479bf3e02c6d179c2e6aeace7f9b22b0acd Mon Sep 17 00:00:00 2001
 From: Colin Ian King <colin.i.king@gmail.com>
 Date: Wed, 28 Sep 2022 15:38:34 +0100
 Subject: [PATCH] wifi: ath11k: Fix spelling mistake "chnange" -> "change"
 There is a spelling mistake in an ath11k_dbg debug message. Fix it.
 Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20220928143834.35189-1-colin.i.king@gmail.com
 ---
 drivers/net/wireless/ath/ath11k/wmi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -6829,7 +6829,7 @@ static void ath11k_wmi_event_peer_sta_ps
 	}
 	ath11k_dbg(ab, ATH11K_DBG_WMI,
 -		   "peer sta ps chnange ev addr %pM state %u sup_bitmap %x ps_valid %u ts %u\n",
 +		   "peer sta ps change ev addr %pM state %u sup_bitmap %x ps_valid %u ts %u\n",
 		   ev->peer_macaddr.addr, ev->peer_ps_state,
 		   ev->ps_supported_bitmap, ev->peer_ps_valid,
 		   ev->peer_ps_timestamp);
--- a/package/kernel/mac80211/patches/ath11k/0006-ath11k-move-static-function-ath11k_mac_vdev_setup_sy.patch
+++ b/package/kernel/mac80211/patches/ath11k/0006-ath11k-move-static-function-ath11k_mac_vdev_setup_sy.patch
@ -1,65 +0,0 @@
 From d37b4862312c980d1f6843d11a14ad4eda242c8d Mon Sep 17 00:00:00 2001
 From: Seevalamuthu Mariappan <seevalam@codeaurora.org>
 Date: Tue, 21 Sep 2021 16:39:29 +0300
 Subject: [PATCH] ath11k: move static function ath11k_mac_vdev_setup_sync to
 top
 This is to prepare for monitor mode clean up.
 No functional changes are done.
 Co-developed-by: Miles Hu <milehu@codeaurora.org>
 Signed-off-by: Miles Hu <milehu@codeaurora.org>
 Co-developed-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
 Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
 Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210721162053.46290-2-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/mac.c | 28 +++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -732,6 +732,20 @@ static int ath11k_monitor_vdev_up(struct
 	return 0;
 }
 +static inline int ath11k_mac_vdev_setup_sync(struct ath11k *ar)
 +{
 +	lockdep_assert_held(&ar->conf_mutex);
 +
 +	if (test_bit(ATH11K_FLAG_CRASH_FLUSH, &ar->ab->dev_flags))
 +		return -ESHUTDOWN;
 +
 +	if (!wait_for_completion_timeout(&ar->vdev_setup_done,
 +					 ATH11K_VDEV_SETUP_TIMEOUT_HZ))
 +		return -ETIMEDOUT;
 +
 +	return ar->last_wmi_vdev_start_status ? -EINVAL : 0;
 +}
 +
 static int ath11k_mac_op_config(struct ieee80211_hw *hw, u32 changed)
 {
 	/* mac80211 requires this op to be present and that's why
@@ -5175,20 +5189,6 @@ static void ath11k_mac_op_remove_chanctx
 	mutex_unlock(&ar->conf_mutex);
 }
 -static inline int ath11k_mac_vdev_setup_sync(struct ath11k *ar)
 -{
 -	lockdep_assert_held(&ar->conf_mutex);
 -
 -	if (test_bit(ATH11K_FLAG_CRASH_FLUSH, &ar->ab->dev_flags))
 -		return -ESHUTDOWN;
 -
 -	if (!wait_for_completion_timeout(&ar->vdev_setup_done,
 -					 ATH11K_VDEV_SETUP_TIMEOUT_HZ))
 -		return -ETIMEDOUT;
 -
 -	return ar->last_wmi_vdev_start_status ? -EINVAL : 0;
 -}
 -
 static int
 ath11k_mac_vdev_start_restart(struct ath11k_vif *arvif,
 			      const struct cfg80211_chan_def *chandef,
--- a/package/kernel/mac80211/patches/ath11k/0007-ath11k-add-separate-APIs-for-monitor-mode.patch
+++ b/package/kernel/mac80211/patches/ath11k/0007-ath11k-add-separate-APIs-for-monitor-mode.patch
@ -1,442 +0,0 @@
 From 64e06b78a92744d43d3993ba623d2686d8f937e7 Mon Sep 17 00:00:00 2001
 From: Seevalamuthu Mariappan <seevalam@codeaurora.org>
 Date: Tue, 21 Sep 2021 16:39:29 +0300
 Subject: [PATCH] ath11k: add separate APIs for monitor mode
 Add separate APIs for monitor_vdev_create/monitor_vdev_delete
 and monitor_vdev_start/monitor_vdev_stop.
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01725-QCAHKSWPL_SILICONZ-1
 Co-developed-by: Miles Hu <milehu@codeaurora.org>
 Signed-off-by: Miles Hu <milehu@codeaurora.org>
 Co-developed-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
 Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
 Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210721162053.46290-3-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/core.h |   5 +-
 drivers/net/wireless/ath/ath11k/mac.c  | 371 ++++++++++++++++++++++++-
 2 files changed, 370 insertions(+), 6 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
@@ -200,6 +200,9 @@ enum ath11k_dev_flags {
 enum ath11k_monitor_flags {
 	ATH11K_FLAG_MONITOR_ENABLED,
 +	ATH11K_FLAG_MONITOR_CONF_ENABLED,
 +	ATH11K_FLAG_MONITOR_STARTED,
 +	ATH11K_FLAG_MONITOR_VDEV_CREATED,
 };
 struct ath11k_vif {
@@ -494,7 +497,6 @@ struct ath11k {
 	u32 chan_tx_pwr;
 	u32 num_stations;
 	u32 max_num_stations;
 -	bool monitor_present;
 	/* To synchronize concurrent synchronous mac80211 callback operations,
 	 * concurrent debugfs configuration and concurrent FW statistics events.
 	 */
@@ -569,6 +571,7 @@ struct ath11k {
 	struct ath11k_per_peer_tx_stats cached_stats;
 	u32 last_ppdu_id;
 	u32 cached_ppdu_id;
 +	int monitor_vdev_id;
 #ifdef CPTCFG_ATH11K_DEBUGFS
 	struct ath11k_debug debug;
 #endif
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -746,14 +746,370 @@ static inline int ath11k_mac_vdev_setup_
 	return ar->last_wmi_vdev_start_status ? -EINVAL : 0;
 }
 -static int ath11k_mac_op_config(struct ieee80211_hw *hw, u32 changed)
 +static void
 +ath11k_mac_get_any_chandef_iter(struct ieee80211_hw *hw,
 +				struct ieee80211_chanctx_conf *conf,
 +				void *data)
 {
 -	/* mac80211 requires this op to be present and that's why
 -	 * there's an empty function, this can be extended when
 -	 * required.
 -	 */
 +	struct cfg80211_chan_def **def = data;
 +
 +	*def = &conf->def;
 +}
 +
 +static int ath11k_mac_monitor_vdev_start(struct ath11k *ar, int vdev_id,
 +					 struct cfg80211_chan_def *chandef)
 +{
 +	struct ieee80211_channel *channel;
 +	struct wmi_vdev_start_req_arg arg = {};
 +	int ret;
 +
 +	lockdep_assert_held(&ar->conf_mutex);
 +
 +	channel = chandef->chan;
 +
 +	arg.vdev_id = vdev_id;
 +	arg.channel.freq = channel->center_freq;
 +	arg.channel.band_center_freq1 = chandef->center_freq1;
 +	arg.channel.band_center_freq2 = chandef->center_freq2;
 +
 +	arg.channel.mode = ath11k_phymodes[chandef->chan->band][chandef->width];
 +	arg.channel.chan_radar = !!(channel->flags & IEEE80211_CHAN_RADAR);
 +
 +	arg.channel.min_power = 0;
 +	arg.channel.max_power = channel->max_power * 2;
 +	arg.channel.max_reg_power = channel->max_reg_power * 2;
 +	arg.channel.max_antenna_gain = channel->max_antenna_gain * 2;
 +
 +	arg.pref_tx_streams = ar->num_tx_chains;
 +	arg.pref_rx_streams = ar->num_rx_chains;
 +
 +	arg.channel.passive = !!(chandef->chan->flags & IEEE80211_CHAN_NO_IR);
 +
 +	reinit_completion(&ar->vdev_setup_done);
 +	reinit_completion(&ar->vdev_delete_done);
 +
 +	ret = ath11k_wmi_vdev_start(ar, &arg, false);
 +	if (ret) {
 +		ath11k_warn(ar->ab, "failed to request monitor vdev %i start: %d\n",
 +			    vdev_id, ret);
 +		return ret;
 +	}
 +
 +	ret = ath11k_mac_vdev_setup_sync(ar);
 +	if (ret) {
 +		ath11k_warn(ar->ab, "failed to synchronize setup for monitor vdev %i start: %d\n",
 +			    vdev_id, ret);
 +		return ret;
 +	}
 +
 +	ret = ath11k_wmi_vdev_up(ar, vdev_id, 0, ar->mac_addr);
 +	if (ret) {
 +		ath11k_warn(ar->ab, "failed to put up monitor vdev %i: %d\n",
 +			    vdev_id, ret);
 +		goto vdev_stop;
 +	}
 +
 +	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "mac monitor vdev %i started\n",
 +		   vdev_id);
 	return 0;
 +
 +vdev_stop:
 +	reinit_completion(&ar->vdev_setup_done);
 +
 +	ret = ath11k_wmi_vdev_stop(ar, vdev_id);
 +	if (ret) {
 +		ath11k_warn(ar->ab, "failed to stop monitor vdev %i after start failure: %d\n",
 +			    vdev_id, ret);
 +		return ret;
 +	}
 +
 +	ret = ath11k_mac_vdev_setup_sync(ar);
 +	if (ret) {
 +		ath11k_warn(ar->ab, "failed to synchronize setup for vdev %i stop: %d\n",
 +			    vdev_id, ret);
 +		return ret;
 +	}
 +
 +	return -EIO;
 +}
 +
 +static int ath11k_mac_monitor_vdev_stop(struct ath11k *ar)
 +{
 +	int ret;
 +
 +	lockdep_assert_held(&ar->conf_mutex);
 +
 +	reinit_completion(&ar->vdev_setup_done);
 +
 +	ret = ath11k_wmi_vdev_stop(ar, ar->monitor_vdev_id);
 +	if (ret) {
 +		ath11k_warn(ar->ab, "failed to request monitor vdev %i stop: %d\n",
 +			    ar->monitor_vdev_id, ret);
 +		return ret;
 +	}
 +
 +	ret = ath11k_mac_vdev_setup_sync(ar);
 +	if (ret) {
 +		ath11k_warn(ar->ab, "failed to synchronize monitor vdev %i stop: %d\n",
 +			    ar->monitor_vdev_id, ret);
 +		return ret;
 +	}
 +
 +	ret = ath11k_wmi_vdev_down(ar, ar->monitor_vdev_id);
 +	if (ret) {
 +		ath11k_warn(ar->ab, "failed to put down monitor vdev %i: %d\n",
 +			    ar->monitor_vdev_id, ret);
 +		return ret;
 +	}
 +
 +	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "mac monitor vdev %i stopped\n",
 +		   ar->monitor_vdev_id);
 +
 +	return 0;
 +}
 +
 +static int ath11k_mac_monitor_vdev_create(struct ath11k *ar)
 +{
 +	struct ath11k_pdev *pdev = ar->pdev;
 +	struct vdev_create_params param = {};
 +	int bit, ret;
 +	u8 tmp_addr[6] = {0};
 +	u16 nss;
 +
 +	lockdep_assert_held(&ar->conf_mutex);
 +
 +	if (test_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags))
 +		return 0;
 +
 +	if (ar->ab->free_vdev_map == 0) {
 +		ath11k_warn(ar->ab, "failed to find free vdev id for monitor vdev\n");
 +		return -ENOMEM;
 +	}
 +
 +	bit = __ffs64(ar->ab->free_vdev_map);
 +
 +	ar->monitor_vdev_id = bit;
 +
 +	param.if_id = ar->monitor_vdev_id;
 +	param.type = WMI_VDEV_TYPE_MONITOR;
 +	param.subtype = WMI_VDEV_SUBTYPE_NONE;
 +	param.pdev_id = pdev->pdev_id;
 +
 +	if (pdev->cap.supported_bands & WMI_HOST_WLAN_2G_CAP) {
 +		param.chains[NL80211_BAND_2GHZ].tx = ar->num_tx_chains;
 +		param.chains[NL80211_BAND_2GHZ].rx = ar->num_rx_chains;
 +	}
 +	if (pdev->cap.supported_bands & WMI_HOST_WLAN_5G_CAP) {
 +		param.chains[NL80211_BAND_5GHZ].tx = ar->num_tx_chains;
 +		param.chains[NL80211_BAND_5GHZ].rx = ar->num_rx_chains;
 +	}
 +
 +	ret = ath11k_wmi_vdev_create(ar, tmp_addr, &param);
 +	if (ret) {
 +		ath11k_warn(ar->ab, "failed to request monitor vdev %i creation: %d\n",
 +			    ar->monitor_vdev_id, ret);
 +		ar->monitor_vdev_id = -1;
 +		return ret;
 +	}
 +
 +	nss = get_num_chains(ar->cfg_tx_chainmask) ? : 1;
 +	ret = ath11k_wmi_vdev_set_param_cmd(ar, ar->monitor_vdev_id,
 +					    WMI_VDEV_PARAM_NSS, nss);
 +	if (ret) {
 +		ath11k_warn(ar->ab, "failed to set vdev %d chainmask 0x%x, nss %d :%d\n",
 +			    ar->monitor_vdev_id, ar->cfg_tx_chainmask, nss, ret);
 +		goto err_vdev_del;
 +	}
 +
 +	ret = ath11k_mac_txpower_recalc(ar);
 +	if (ret) {
 +		ath11k_warn(ar->ab, "failed to recalc txpower for monitor vdev %d: %d\n",
 +			    ar->monitor_vdev_id, ret);
 +		goto err_vdev_del;
 +	}
 +
 +	ar->allocated_vdev_map |= 1LL << ar->monitor_vdev_id;
 +	ar->ab->free_vdev_map &= ~(1LL << ar->monitor_vdev_id);
 +	ar->num_created_vdevs++;
 +	set_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags);
 +
 +	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "mac monitor vdev %d created\n",
 +		   ar->monitor_vdev_id);
 +
 +	return 0;
 +
 +err_vdev_del:
 +	ath11k_wmi_vdev_delete(ar, ar->monitor_vdev_id);
 +	ar->monitor_vdev_id = -1;
 +	return ret;
 +}
 +
 +static int ath11k_mac_monitor_vdev_delete(struct ath11k *ar)
 +{
 +	int ret;
 +	unsigned long time_left;
 +
 +	lockdep_assert_held(&ar->conf_mutex);
 +
 +	if (!test_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags))
 +		return 0;
 +
 +	reinit_completion(&ar->vdev_delete_done);
 +
 +	ret = ath11k_wmi_vdev_delete(ar, ar->monitor_vdev_id);
 +	if (ret) {
 +		ath11k_warn(ar->ab, "failed to request wmi monitor vdev %i removal: %d\n",
 +			    ar->monitor_vdev_id, ret);
 +		return ret;
 +	}
 +
 +	time_left = wait_for_completion_timeout(&ar->vdev_delete_done,
 +						ATH11K_VDEV_DELETE_TIMEOUT_HZ);
 +	if (time_left == 0) {
 +		ath11k_warn(ar->ab, "Timeout in receiving vdev delete response\n");
 +	} else {
 +		ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "mac monitor vdev %d deleted\n",
 +			   ar->monitor_vdev_id);
 +
 +		ar->allocated_vdev_map &= ~(1LL << ar->monitor_vdev_id);
 +		ar->ab->free_vdev_map |= 1LL << (ar->monitor_vdev_id);
 +		ar->num_created_vdevs--;
 +		ar->monitor_vdev_id = -1;
 +		clear_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags);
 +	}
 +
 +	return ret;
 +}
 +
 +static int ath11k_mac_monitor_start(struct ath11k *ar)
 +{
 +	struct cfg80211_chan_def *chandef = NULL;
 +	int ret;
 +
 +	lockdep_assert_held(&ar->conf_mutex);
 +
 +	if (test_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags))
 +		return 0;
 +
 +	ieee80211_iter_chan_contexts_atomic(ar->hw,
 +					    ath11k_mac_get_any_chandef_iter,
 +					    &chandef);
 +	if (!chandef)
 +		return 0;
 +
 +	ret = ath11k_mac_monitor_vdev_start(ar, ar->monitor_vdev_id, chandef);
 +	if (ret) {
 +		ath11k_warn(ar->ab, "failed to start monitor vdev: %d\n", ret);
 +		ath11k_mac_monitor_vdev_delete(ar);
 +		return ret;
 +	}
 +
 +	set_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags);
 +
 +	ar->num_started_vdevs++;
 +	ret = ath11k_dp_tx_htt_monitor_mode_ring_config(ar, false);
 +	if (ret) {
 +		ath11k_warn(ar->ab, "failed to configure htt monitor mode ring during start: %d",
 +			    ret);
 +		return ret;
 +	}
 +
 +	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "mac monitor started\n");
 +
 +	return 0;
 +}
 +
 +static int ath11k_mac_monitor_stop(struct ath11k *ar)
 +{
 +	int ret;
 +
 +	lockdep_assert_held(&ar->conf_mutex);
 +
 +	if (!test_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags))
 +		return 0;
 +
 +	ret = ath11k_mac_monitor_vdev_stop(ar);
 +	if (ret) {
 +		ath11k_warn(ar->ab, "failed to stop monitor vdev: %d\n", ret);
 +		return ret;
 +	}
 +
 +	clear_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags);
 +	ar->num_started_vdevs--;
 +
 +	ret = ath11k_dp_tx_htt_monitor_mode_ring_config(ar, true);
 +	if (ret) {
 +		ath11k_warn(ar->ab, "failed to configure htt monitor mode ring during stop: %d",
 +			    ret);
 +		return ret;
 +	}
 +
 +	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "mac monitor stopped ret %d\n", ret);
 +
 +	return 0;
 +}
 +
 +static int ath11k_mac_op_config(struct ieee80211_hw *hw, u32 changed)
 +{
 +	struct ath11k *ar = hw->priv;
 +	struct ieee80211_conf *conf = &hw->conf;
 +	int ret = 0;
 +
 +	mutex_lock(&ar->conf_mutex);
 +
 +	if (changed & IEEE80211_CONF_CHANGE_MONITOR) {
 +		if (conf->flags & IEEE80211_CONF_MONITOR) {
 +			set_bit(ATH11K_FLAG_MONITOR_CONF_ENABLED, &ar->monitor_flags);
 +
 +			if (test_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED,
 +				     &ar->monitor_flags))
 +				goto out;
 +
 +			ret = ath11k_mac_monitor_vdev_create(ar);
 +			if (ret) {
 +				ath11k_warn(ar->ab, "failed to create monitor vdev: %d",
 +					    ret);
 +				goto out;
 +			}
 +
 +			ret = ath11k_mac_monitor_start(ar);
 +			if (ret) {
 +				ath11k_warn(ar->ab, "failed to start monitor: %d",
 +					    ret);
 +				goto err_mon_del;
 +			}
 +		} else {
 +			clear_bit(ATH11K_FLAG_MONITOR_CONF_ENABLED, &ar->monitor_flags);
 +
 +			if (!test_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED,
 +				      &ar->monitor_flags))
 +				goto out;
 +
 +			ret = ath11k_mac_monitor_stop(ar);
 +			if (ret) {
 +				ath11k_warn(ar->ab, "failed to stop monitor: %d",
 +					    ret);
 +				goto out;
 +			}
 +
 +			ret = ath11k_mac_monitor_vdev_delete(ar);
 +			if (ret) {
 +				ath11k_warn(ar->ab, "failed to delete monitor vdev: %d",
 +					    ret);
 +				goto out;
 +			}
 +		}
 +	}
 +
 +out:
 +	mutex_unlock(&ar->conf_mutex);
 +	return ret;
 +
 +err_mon_del:
 +	ath11k_mac_monitor_vdev_delete(ar);
 +	mutex_unlock(&ar->conf_mutex);
 +	return ret;
 }
 static int ath11k_mac_setup_bcn_tmpl(struct ath11k_vif *arvif)
@@ -6781,7 +7137,12 @@ int ath11k_mac_allocate(struct ath11k_ba
 		INIT_WORK(&ar->wmi_mgmt_tx_work, ath11k_mgmt_over_wmi_tx_work);
 		skb_queue_head_init(&ar->wmi_mgmt_tx_queue);
 +
 		clear_bit(ATH11K_FLAG_MONITOR_ENABLED, &ar->monitor_flags);
 +		clear_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags);
 +
 +		ar->monitor_vdev_id = -1;
 +		clear_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags);
 	}
 	return 0;
--- a/package/kernel/mac80211/patches/ath11k/0007-wifi-ath11k-suppress-add-interface-error.patch
+++ b/package/kernel/mac80211/patches/ath11k/0007-wifi-ath11k-suppress-add-interface-error.patch
@ -0,0 +1,52 @@
 From 638b26652b0438563a76ec90014c8cba34db982b Mon Sep 17 00:00:00 2001
 From: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
 Date: Thu, 6 Oct 2022 06:28:42 +0530
 Subject: [PATCH 7/9] wifi: ath11k: suppress add interface error
 In the VIF (other than monitor type) creation request, we should not
 throw the error code when the monitor VIF creation fails, since the
 actual VIF creation succeeds. If we throw the error code from driver
 then the actual VIF creation get fail. So suppress the monitor VIF
 creation error by throwing warning message instead of error code.
 Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.6.0.1-00760-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20221006005842.8599-1-quic_periyasa@quicinc.com
 ---
 drivers/net/wireless/ath/ath11k/mac.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -6421,18 +6421,16 @@ static int ath11k_mac_op_add_interface(s
 	ath11k_dp_vdev_tx_attach(ar, arvif);
 +	ath11k_debugfs_add_interface(arvif);
 +
 	if (vif->type != NL80211_IFTYPE_MONITOR &&
 	    test_bit(ATH11K_FLAG_MONITOR_CONF_ENABLED, &ar->monitor_flags)) {
 		ret = ath11k_mac_monitor_vdev_create(ar);
 -		if (ret) {
 +		if (ret)
 			ath11k_warn(ar->ab, "failed to create monitor vdev during add interface: %d",
 				    ret);
 -			goto err_peer_del;
 -		}
 	}
 -	ath11k_debugfs_add_interface(arvif);
 -
 	mutex_unlock(&ar->conf_mutex);
 	return 0;
@@ -6457,7 +6455,6 @@ err_vdev_del:
 	spin_unlock_bh(&ar->data_lock);
 err:
 -	ath11k_debugfs_remove_interface(arvif);
 	mutex_unlock(&ar->conf_mutex);
 	return ret;
--- a/package/kernel/mac80211/patches/ath11k/0008-ath11k-monitor-mode-clean-up-to-use-separate-APIs.patch
+++ b/package/kernel/mac80211/patches/ath11k/0008-ath11k-monitor-mode-clean-up-to-use-separate-APIs.patch
@ -1,370 +0,0 @@
 From 689a5e6fff75229ac7c2af7a9c51dc2d3ca1882b Mon Sep 17 00:00:00 2001
 From: Seevalamuthu Mariappan <seevalam@codeaurora.org>
 Date: Tue, 21 Sep 2021 16:39:30 +0300
 Subject: [PATCH] ath11k: monitor mode clean up to use separate APIs
 If monitor interface is enabled in co-exist mode, only local traffic are
 captured. It's caused by missing monitor vdev in co-exist mode. So,
 monitor mode clean up is done with separate Monitor APIs. For this,
 introduce flags monitor_started and monitor_vdev_created.
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01725-QCAHKSWPL_SILICONZ-1
 Co-developed-by: Miles Hu <milehu@codeaurora.org>
 Signed-off-by: Miles Hu <milehu@codeaurora.org>
 Co-developed-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
 Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
 Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210721162053.46290-4-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/core.h  |   1 -
 drivers/net/wireless/ath/ath11k/dp_rx.c |   2 +-
 drivers/net/wireless/ath/ath11k/dp_tx.c |   8 +-
 drivers/net/wireless/ath/ath11k/mac.c   | 150 ++++++++++++++++--------
 4 files changed, 110 insertions(+), 51 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
@@ -199,7 +199,6 @@ enum ath11k_dev_flags {
 };
 enum ath11k_monitor_flags {
 -	ATH11K_FLAG_MONITOR_ENABLED,
 	ATH11K_FLAG_MONITOR_CONF_ENABLED,
 	ATH11K_FLAG_MONITOR_STARTED,
 	ATH11K_FLAG_MONITOR_VDEV_CREATED,
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
@@ -5032,7 +5032,7 @@ int ath11k_dp_rx_process_mon_rings(struc
 	struct ath11k *ar = ath11k_ab_to_ar(ab, mac_id);
 	int ret = 0;
 -	if (test_bit(ATH11K_FLAG_MONITOR_ENABLED, &ar->monitor_flags))
 +	if (test_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags))
 		ret = ath11k_dp_mon_process_rx(ab, mac_id, napi, budget);
 	else
 		ret = ath11k_dp_rx_process_mon_status(ab, mac_id, napi, budget);
 --- a/drivers/net/wireless/ath/ath11k/dp_tx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
@@ -1076,12 +1076,16 @@ int ath11k_dp_tx_htt_monitor_mode_ring_c
 	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
 		ring_id = dp->rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
 -		if (!reset)
 +		if (!reset) {
 			tlv_filter.rx_filter =
 					HTT_RX_MON_FILTER_TLV_FLAGS_MON_STATUS_RING;
 -		else
 +		} else {
 			tlv_filter = ath11k_mac_mon_status_filter_default;
 +			if (ath11k_debugfs_is_extd_rx_stats_enabled(ar))
 +				tlv_filter.rx_filter = ath11k_debugfs_rx_filter(ar);
 +		}
 +
 		ret = ath11k_dp_tx_htt_rx_filter_setup(ab, ring_id,
 						       dp->mac_id + i,
 						       HAL_RXDMA_MONITOR_STATUS,
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -716,22 +716,6 @@ void ath11k_mac_peer_cleanup_all(struct
 	ar->num_stations = 0;
 }
 -static int ath11k_monitor_vdev_up(struct ath11k *ar, int vdev_id)
 -{
 -	int ret = 0;
 -
 -	ret = ath11k_wmi_vdev_up(ar, vdev_id, 0, ar->mac_addr);
 -	if (ret) {
 -		ath11k_warn(ar->ab, "failed to put up monitor vdev %i: %d\n",
 -			    vdev_id, ret);
 -		return ret;
 -	}
 -
 -	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "mac monitor vdev %i started\n",
 -		   vdev_id);
 -	return 0;
 -}
 -
 static inline int ath11k_mac_vdev_setup_sync(struct ath11k *ar)
 {
 	lockdep_assert_held(&ar->conf_mutex);
@@ -2331,7 +2315,7 @@ static int ath11k_mac_config_obss_pd(str
 	/* Set and enable SRG/non-SRG OBSS PD Threshold */
 	param_id = WMI_PDEV_PARAM_SET_CMD_OBSS_PD_THRESHOLD;
 -	if (test_bit(ATH11K_FLAG_MONITOR_ENABLED, &ar->monitor_flags)) {
 +	if (test_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags)) {
 		ret = ath11k_wmi_pdev_set_param(ar, param_id, 0, pdev_id);
 		if (ret)
 			ath11k_warn(ar->ab,
@@ -5110,8 +5094,8 @@ static int ath11k_mac_op_add_interface(s
 	}
 	if (ar->num_created_vdevs > (TARGET_NUM_VDEVS - 1)) {
 -		ath11k_warn(ab, "failed to create vdev, reached max vdev limit %d\n",
 -			    TARGET_NUM_VDEVS);
 +		ath11k_warn(ab, "failed to create vdev %u, reached max vdev limit %d\n",
 +			    ar->num_created_vdevs, TARGET_NUM_VDEVS);
 		ret = -EBUSY;
 		goto err;
 	}
@@ -5151,6 +5135,7 @@ static int ath11k_mac_op_add_interface(s
 		break;
 	case NL80211_IFTYPE_MONITOR:
 		arvif->vdev_type = WMI_VDEV_TYPE_MONITOR;
 +		ar->monitor_vdev_id = bit;
 		break;
 	default:
 		WARN_ON(1);
@@ -5252,6 +5237,9 @@ static int ath11k_mac_op_add_interface(s
 			goto err_peer_del;
 		}
 		break;
 +	case WMI_VDEV_TYPE_MONITOR:
 +		set_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags);
 +		break;
 	default:
 		break;
 	}
@@ -5272,6 +5260,16 @@ static int ath11k_mac_op_add_interface(s
 	ath11k_dp_vdev_tx_attach(ar, arvif);
 +	if (vif->type != NL80211_IFTYPE_MONITOR &&
 +	    test_bit(ATH11K_FLAG_MONITOR_CONF_ENABLED, &ar->monitor_flags)) {
 +		ret = ath11k_mac_monitor_vdev_create(ar);
 +		if (ret) {
 +			ath11k_warn(ar->ab, "failed to create monitor vdev during add interface: %d",
 +				    ret);
 +			goto err_peer_del;
 +		}
 +	}
 +
 	mutex_unlock(&ar->conf_mutex);
 	return 0;
@@ -5369,6 +5367,18 @@ static void ath11k_mac_op_remove_interfa
 	ath11k_dbg(ab, ATH11K_DBG_MAC, "vdev %pM deleted, vdev_id %d\n",
 		   vif->addr, arvif->vdev_id);
 +	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
 +		clear_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags);
 +		ar->monitor_vdev_id = -1;
 +	} else if (test_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags) &&
 +		   !test_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags)) {
 +		ret = ath11k_mac_monitor_vdev_delete(ar);
 +		if (ret)
 +			/* continue even if there's an error */
 +			ath11k_warn(ar->ab, "failed to delete vdev monitor during remove interface: %d",
 +				    ret);
 +	}
 +
 err_vdev_del:
 	spin_lock_bh(&ar->data_lock);
 	list_del(&arvif->list);
@@ -5388,7 +5398,6 @@ err_vdev_del:
 	/* Recalc txpower for remaining vdev */
 	ath11k_mac_txpower_recalc(ar);
 -	clear_bit(ATH11K_FLAG_MONITOR_ENABLED, &ar->monitor_flags);
 	/* TODO: recal traffic pause state based on the available vdevs */
@@ -5411,8 +5420,6 @@ static void ath11k_mac_op_configure_filt
 					   u64 multicast)
 {
 	struct ath11k *ar = hw->priv;
 -	bool reset_flag = false;
 -	int ret = 0;
 	mutex_lock(&ar->conf_mutex);
@@ -5420,23 +5427,6 @@ static void ath11k_mac_op_configure_filt
 	*total_flags &= SUPPORTED_FILTERS;
 	ar->filter_flags = *total_flags;
 -	/* For monitor mode */
 -	reset_flag = !(ar->filter_flags & FIF_BCN_PRBRESP_PROMISC);
 -
 -	ret = ath11k_dp_tx_htt_monitor_mode_ring_config(ar, reset_flag);
 -	if (!ret) {
 -		if (!reset_flag)
 -			set_bit(ATH11K_FLAG_MONITOR_ENABLED, &ar->monitor_flags);
 -		else
 -			clear_bit(ATH11K_FLAG_MONITOR_ENABLED, &ar->monitor_flags);
 -	} else {
 -		ath11k_warn(ar->ab,
 -			    "fail to set monitor filter: %d\n", ret);
 -	}
 -	ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
 -		   "changed_flags:0x%x, total_flags:0x%x, reset_flag:%d\n",
 -		   changed_flags, *total_flags, reset_flag);
 -
 	mutex_unlock(&ar->conf_mutex);
 }
@@ -5627,7 +5617,9 @@ ath11k_mac_vdev_start_restart(struct ath
 		return ret;
 	}
 -	ar->num_started_vdevs++;
 +	if (!restart)
 +		ar->num_started_vdevs++;
 +
 	ath11k_dbg(ab, ATH11K_DBG_MAC,  "vdev %pM started, vdev_id %d\n",
 		   arvif->vif->addr, arvif->vdev_id);
@@ -5755,12 +5747,16 @@ ath11k_mac_update_vif_chan(struct ath11k
 	struct ath11k_vif *arvif;
 	int ret;
 	int i;
 +	bool monitor_vif = false;
 	lockdep_assert_held(&ar->conf_mutex);
 	for (i = 0; i < n_vifs; i++) {
 		arvif = (void *)vifs[i].vif->drv_priv;
 +		if (vifs[i].vif->type == NL80211_IFTYPE_MONITOR)
 +			monitor_vif = true;
 +
 		ath11k_dbg(ab, ATH11K_DBG_MAC,
 			   "mac chanctx switch vdev_id %i freq %u->%u width %d->%d\n",
 			   arvif->vdev_id,
@@ -5781,6 +5777,8 @@ ath11k_mac_update_vif_chan(struct ath11k
 				    arvif->vdev_id, ret);
 			continue;
 		}
 +
 +		ar->num_started_vdevs--;
 	}
 	/* All relevant vdevs are downed and associated channel resources
@@ -5818,6 +5816,24 @@ ath11k_mac_update_vif_chan(struct ath11k
 			continue;
 		}
 	}
 +
 +	/* Restart the internal monitor vdev on new channel */
 +	if (!monitor_vif &&
 +	    test_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags)) {
 +		ret = ath11k_mac_monitor_stop(ar);
 +		if (ret) {
 +			ath11k_warn(ar->ab, "failed to stop monitor during vif channel update: %d",
 +				    ret);
 +			return;
 +		}
 +
 +		ret = ath11k_mac_monitor_start(ar);
 +		if (ret) {
 +			ath11k_warn(ar->ab, "failed to start monitor during vif channel update: %d",
 +				    ret);
 +			return;
 +		}
 +	}
 }
 static void
@@ -5897,7 +5913,7 @@ static int ath11k_start_vdev_delay(struc
 	}
 	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
 -		ret = ath11k_monitor_vdev_up(ar, arvif->vdev_id);
 +		ret = ath11k_wmi_vdev_up(ar, arvif->vdev_id, 0, ar->mac_addr);
 		if (ret) {
 			ath11k_warn(ab, "failed put monitor up: %d\n", ret);
 			return ret;
@@ -5957,6 +5973,18 @@ ath11k_mac_op_assign_vif_chanctx(struct
 		}
 	}
 +	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
 +		ret = ath11k_mac_monitor_start(ar);
 +		if (ret) {
 +			ath11k_warn(ar->ab, "failed to start monitor during vif channel context assignment: %d",
 +				    ret);
 +			goto out;
 +		}
 +
 +		arvif->is_started = true;
 +		goto out;
 +	}
 +
 	ret = ath11k_mac_vdev_start(arvif, &ctx->def);
 	if (ret) {
 		ath11k_warn(ab, "failed to start vdev %i addr %pM on freq %d: %d\n",
@@ -5964,14 +5992,19 @@ ath11k_mac_op_assign_vif_chanctx(struct
 			    ctx->def.chan->center_freq, ret);
 		goto out;
 	}
 -	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
 -		ret = ath11k_monitor_vdev_up(ar, arvif->vdev_id);
 -		if (ret)
 -			goto out;
 -	}
 	arvif->is_started = true;
 +	if (arvif->vdev_type != WMI_VDEV_TYPE_MONITOR &&
 +	    test_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags)) {
 +		ret = ath11k_mac_monitor_start(ar);
 +		if (ret) {
 +			ath11k_warn(ar->ab, "failed to start monitor during vif channel context assignment: %d",
 +				    ret);
 +			goto out;
 +		}
 +	}
 +
 	/* TODO: Setup ps and cts/rts protection */
 	ret = 0;
@@ -6005,6 +6038,20 @@ ath11k_mac_op_unassign_vif_chanctx(struc
 	    ath11k_peer_find_by_addr(ab, ar->mac_addr))
 		ath11k_peer_delete(ar, arvif->vdev_id, ar->mac_addr);
 +	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
 +		ret = ath11k_mac_monitor_stop(ar);
 +		if (ret) {
 +			ath11k_warn(ar->ab, "failed to stop monitor during vif channel context unassignment: %d",
 +				    ret);
 +			mutex_unlock(&ar->conf_mutex);
 +			return;
 +		}
 +
 +		arvif->is_started = false;
 +		mutex_unlock(&ar->conf_mutex);
 +		return;
 +	}
 +
 	ret = ath11k_mac_vdev_stop(arvif);
 	if (ret)
 		ath11k_warn(ab, "failed to stop vdev %i: %d\n",
@@ -6016,6 +6063,16 @@ ath11k_mac_op_unassign_vif_chanctx(struc
 	    arvif->vdev_type == WMI_VDEV_TYPE_MONITOR)
 		ath11k_wmi_vdev_down(ar, arvif->vdev_id);
 +	if (arvif->vdev_type != WMI_VDEV_TYPE_MONITOR &&
 +	    ar->num_started_vdevs == 1 &&
 +	    test_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags)) {
 +		ret = ath11k_mac_monitor_stop(ar);
 +		if (ret)
 +			/* continue even if there's an error */
 +			ath11k_warn(ar->ab, "failed to stop monitor during vif channel context unassignment: %d",
 +				    ret);
 +	}
 +
 	mutex_unlock(&ar->conf_mutex);
 }
@@ -7138,7 +7195,6 @@ int ath11k_mac_allocate(struct ath11k_ba
 		INIT_WORK(&ar->wmi_mgmt_tx_work, ath11k_mgmt_over_wmi_tx_work);
 		skb_queue_head_init(&ar->wmi_mgmt_tx_queue);
 -		clear_bit(ATH11K_FLAG_MONITOR_ENABLED, &ar->monitor_flags);
 		clear_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags);
 		ar->monitor_vdev_id = -1;
--- a/package/kernel/mac80211/patches/ath11k/0227-wifi-ath11k-add-support-to-configure-channel-dwell-time.patch
+++ b/package/kernel/mac80211/patches/ath11k/0227-wifi-ath11k-add-support-to-configure-channel-dwell-time.patch
@ -1,7 +1,7 @@
 From c362daa213cdeb0a9e7c2ed84849544c24505720 Mon Sep 17 00:00:00 2001
 From: Manikanta Pubbisetty <quic_mpubbise@quicinc.com>
 Date: Fri, 7 Oct 2022 10:41:30 +0530
-Subject: [PATCH] wifi: ath11k: add support to configure channel dwell time
+Subject: [PATCH 8/9] wifi: ath11k: add support to configure channel dwell time
 Add support to configure channel dwell time during scan.
 Dwell time help to stay on the channel for a specified duration
@ -43,7 +43,7 @@ Link: https://lore.kernel.org/r/20221007051130.6067-1-quic_mpubbise@quicinc.com
 static const u32 ath11k_smps_map[] = {
 	[WLAN_HT_CAP_SM_PS_STATIC] = WMI_PEER_SMPS_STATIC,
-@@ -3597,6 +3600,7 @@ static int ath11k_mac_op_hw_scan(struct
+@@ -3612,6 +3615,7 @@ static int ath11k_mac_op_hw_scan(struct
 	struct scan_req_params arg;
 	int ret = 0;
 	int i;
@ -51,7 +51,7 @@ Link: https://lore.kernel.org/r/20221007051130.6067-1-quic_mpubbise@quicinc.com
 	mutex_lock(&ar->conf_mutex);
-@@ -3666,6 +3670,26 @@ static int ath11k_mac_op_hw_scan(struct
+@@ -3681,6 +3685,26 @@ static int ath11k_mac_op_hw_scan(struct
 		ether_addr_copy(arg.mac_mask.addr, req->mac_addr_mask);
 	}
@ -78,7 +78,7 @@ Link: https://lore.kernel.org/r/20221007051130.6067-1-quic_mpubbise@quicinc.com
 	ret = ath11k_start_scan(ar, &arg);
 	if (ret) {
 		ath11k_warn(ar->ab, "failed to start hw scan: %d\n", ret);
-@@ -3674,10 +3698,8 @@ static int ath11k_mac_op_hw_scan(struct
+@@ -3689,10 +3713,8 @@ static int ath11k_mac_op_hw_scan(struct
 		spin_unlock_bh(&ar->data_lock);
 	}
@ -90,7 +90,7 @@ Link: https://lore.kernel.org/r/20221007051130.6067-1-quic_mpubbise@quicinc.com
 exit:
 	kfree(arg.chan_list);
-@@ -8738,6 +8760,9 @@ static int __ath11k_mac_register(struct
+@@ -9060,6 +9082,9 @@ static int __ath11k_mac_register(struct
 				      NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP);
 	}
--- a/package/kernel/mac80211/patches/ath11k/0009-ath11k-add-support-for-setting-fixed-HE-rate-gi-ltf.patch
+++ b/package/kernel/mac80211/patches/ath11k/0009-ath11k-add-support-for-setting-fixed-HE-rate-gi-ltf.patch
--- a/package/kernel/mac80211/patches/ath11k/0010-ath11k-add-support-for-80P80-and-160-MHz-bandwidth.patch
+++ b/package/kernel/mac80211/patches/ath11k/0010-ath11k-add-support-for-80P80-and-160-MHz-bandwidth.patch
@ -1,322 +0,0 @@
 From f552d6fd2f27ce9430c74482c46272838e2de688 Mon Sep 17 00:00:00 2001
 From: P Praneesh <ppranees@codeaurora.org>
 Date: Fri, 24 Sep 2021 16:52:46 +0300
 Subject: [PATCH] ath11k: add support for 80P80 and 160 MHz bandwidth
 For 160 MHz, nss_ratio_enabled flag is added to indicate firmware
 supports sending NSS ratio information from firmware as a part of
 service ready ext event. Extract this NSS ratio info from service
 ready ext event and save this information in ath11k_pdev_cap to
 calculate NSS ratio.
 Current firmware configurations support two types of NSS ratio
 which is WMI_NSS_RATIO_1_NSS for QCN9074 and WMI_NSS_RATIO_1BY2_NSS
 for IPQ8074. Based on this two configuration, max supported
 NSS getting calculated.
 Move ath11k_peer_assoc_h_phymode() before ath11k_peer_assoc_h_vht()
 to get arg->peer_phymode updated.
 Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-00097-QCAHKSWPL_SILICONZ-1
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01467-QCAHKSWPL_SILICONZ-1
 Co-developed-by: Ganesh Sesetti <gseset@codeaurora.org>
 Signed-off-by: Ganesh Sesetti <gseset@codeaurora.org>
 Co-developed-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
 Signed-off-by: P Praneesh <ppranees@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210721173615.75637-2-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/core.h |  2 +
 drivers/net/wireless/ath/ath11k/mac.c  | 95 ++++++++++++++++++++++----
 drivers/net/wireless/ath/ath11k/mac.h  |  3 +
 drivers/net/wireless/ath/ath11k/wmi.c  | 20 +++++-
 drivers/net/wireless/ath/ath11k/wmi.h  | 30 ++++++++
 5 files changed, 136 insertions(+), 14 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
@@ -603,6 +603,8 @@ struct ath11k_pdev_cap {
 	u32 tx_chain_mask_shift;
 	u32 rx_chain_mask_shift;
 	struct ath11k_band_cap band[NUM_NL80211_BANDS];
 +	bool nss_ratio_enabled;
 +	u8 nss_ratio_info;
 };
 struct ath11k_pdev {
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -1586,6 +1586,34 @@ ath11k_peer_assoc_h_vht_limit(u16 tx_mcs
 	return tx_mcs_set;
 }
 +static u8 ath11k_get_nss_160mhz(struct ath11k *ar,
 +				u8 max_nss)
 +{
 +	u8 nss_ratio_info = ar->pdev->cap.nss_ratio_info;
 +	u8 max_sup_nss = 0;
 +
 +	switch (nss_ratio_info) {
 +	case WMI_NSS_RATIO_1BY2_NSS:
 +		max_sup_nss = max_nss >> 1;
 +		break;
 +	case WMI_NSS_RATIO_3BY4_NSS:
 +		ath11k_warn(ar->ab, "WMI_NSS_RATIO_3BY4_NSS not supported\n");
 +		break;
 +	case WMI_NSS_RATIO_1_NSS:
 +		max_sup_nss = max_nss;
 +		break;
 +	case WMI_NSS_RATIO_2_NSS:
 +		ath11k_warn(ar->ab, "WMI_NSS_RATIO_2_NSS not supported\n");
 +		break;
 +	default:
 +		ath11k_warn(ar->ab, "invalid nss ratio received from firmware: %d\n",
 +			    nss_ratio_info);
 +		break;
 +	}
 +
 +	return max_sup_nss;
 +}
 +
 static void ath11k_peer_assoc_h_vht(struct ath11k *ar,
 				    struct ieee80211_vif *vif,
 				    struct ieee80211_sta *sta,
@@ -1600,6 +1628,7 @@ static void ath11k_peer_assoc_h_vht(stru
 	u8 max_nss, vht_mcs;
 	int i, vht_nss, nss_idx;
 	bool user_rate_valid = true;
 +	u32 rx_nss, tx_nss, nss_160;
 	if (WARN_ON(ath11k_mac_vif_chan(vif, &def)))
 		return;
@@ -1692,10 +1721,29 @@ static void ath11k_peer_assoc_h_vht(stru
 	/* TODO:  Check */
 	arg->tx_max_mcs_nss = 0xFF;
 -	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "mac vht peer %pM max_mpdu %d flags 0x%x\n",
 -		   sta->addr, arg->peer_max_mpdu, arg->peer_flags);
 +	if (arg->peer_phymode == MODE_11AC_VHT160 ||
 +	    arg->peer_phymode == MODE_11AC_VHT80_80) {
 +		tx_nss = ath11k_get_nss_160mhz(ar, max_nss);
 +		rx_nss = min(arg->peer_nss, tx_nss);
 +		arg->peer_bw_rxnss_override = ATH11K_BW_NSS_MAP_ENABLE;
 +
 +		if (!rx_nss) {
 +			ath11k_warn(ar->ab, "invalid max_nss\n");
 +			return;
 +		}
 +
 +		if (arg->peer_phymode == MODE_11AC_VHT160)
 +			nss_160 = FIELD_PREP(ATH11K_PEER_RX_NSS_160MHZ, rx_nss - 1);
 +		else
 +			nss_160 = FIELD_PREP(ATH11K_PEER_RX_NSS_80_80MHZ, rx_nss - 1);
 -	/* TODO: rxnss_override */
 +		arg->peer_bw_rxnss_override |= nss_160;
 +	}
 +
 +	ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
 +		   "mac vht peer %pM max_mpdu %d flags 0x%x nss_override 0x%x\n",
 +		   sta->addr, arg->peer_max_mpdu, arg->peer_flags,
 +		   arg->peer_bw_rxnss_override);
 }
 static int ath11k_mac_get_max_he_mcs_map(u16 mcs_map, int nss)
@@ -1779,6 +1827,7 @@ static void ath11k_peer_assoc_h_he(struc
 	u16 he_tx_mcs = 0, v = 0;
 	int i, he_nss, nss_idx;
 	bool user_rate_valid = true;
 +	u32 rx_nss, tx_nss, nss_160;
 	if (WARN_ON(ath11k_mac_vif_chan(vif, &def)))
 		return;
@@ -1942,9 +1991,30 @@ static void ath11k_peer_assoc_h_he(struc
 	}
 	arg->peer_nss = min(sta->rx_nss, max_nss);
 +	if (arg->peer_phymode == MODE_11AX_HE160 ||
 +	    arg->peer_phymode == MODE_11AX_HE80_80) {
 +		tx_nss = ath11k_get_nss_160mhz(ar, max_nss);
 +		rx_nss = min(arg->peer_nss, tx_nss);
 +		arg->peer_bw_rxnss_override = ATH11K_BW_NSS_MAP_ENABLE;
 +
 +		if (!rx_nss) {
 +			ath11k_warn(ar->ab, "invalid max_nss\n");
 +			return;
 +		}
 +
 +		if (arg->peer_phymode == MODE_11AX_HE160)
 +			nss_160 = FIELD_PREP(ATH11K_PEER_RX_NSS_160MHZ, rx_nss - 1);
 +		else
 +			nss_160 = FIELD_PREP(ATH11K_PEER_RX_NSS_80_80MHZ, rx_nss - 1);
 +
 +		arg->peer_bw_rxnss_override |= nss_160;
 +	}
 +
 	ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
 -		   "mac he peer %pM nss %d mcs cnt %d\n",
 -		   sta->addr, arg->peer_nss, arg->peer_he_mcs_count);
 +		   "mac he peer %pM nss %d mcs cnt %d nss_override 0x%x\n",
 +		   sta->addr, arg->peer_nss,
 +		   arg->peer_he_mcs_count,
 +		   arg->peer_bw_rxnss_override);
 }
 static void ath11k_peer_assoc_h_smps(struct ieee80211_sta *sta,
@@ -2232,11 +2302,11 @@ static void ath11k_peer_assoc_prepare(st
 	ath11k_peer_assoc_h_basic(ar, vif, sta, arg);
 	ath11k_peer_assoc_h_crypto(ar, vif, sta, arg);
 	ath11k_peer_assoc_h_rates(ar, vif, sta, arg);
 +	ath11k_peer_assoc_h_phymode(ar, vif, sta, arg);
 	ath11k_peer_assoc_h_ht(ar, vif, sta, arg);
 	ath11k_peer_assoc_h_vht(ar, vif, sta, arg);
 	ath11k_peer_assoc_h_he(ar, vif, sta, arg);
 	ath11k_peer_assoc_h_qos(ar, vif, sta, arg);
 -	ath11k_peer_assoc_h_phymode(ar, vif, sta, arg);
 	ath11k_peer_assoc_h_smps(sta, arg);
 	/* TODO: amsdu_disable req? */
@@ -4433,11 +4503,6 @@ ath11k_create_vht_cap(struct ath11k *ar,
 	ath11k_set_vht_txbf_cap(ar, &vht_cap.cap);
 -	/* TODO: Enable back VHT160 mode once association issues are fixed */
 -	/* Disabling VHT160 and VHT80+80 modes */
 -	vht_cap.cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
 -	vht_cap.cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
 -
 	rxmcs_map = 0;
 	txmcs_map = 0;
 	for (i = 0; i < 8; i++) {
@@ -7355,7 +7420,9 @@ static int ath11k_mac_setup_iface_combin
 	combinations[0].radar_detect_widths = BIT(NL80211_CHAN_WIDTH_20_NOHT) |
 						BIT(NL80211_CHAN_WIDTH_20) |
 						BIT(NL80211_CHAN_WIDTH_40) |
 -						BIT(NL80211_CHAN_WIDTH_80);
 +						BIT(NL80211_CHAN_WIDTH_80) |
 +						BIT(NL80211_CHAN_WIDTH_80P80) |
 +						BIT(NL80211_CHAN_WIDTH_160);
 	ar->hw->wiphy->iface_combinations = combinations;
 	ar->hw->wiphy->n_iface_combinations = 1;
@@ -7494,6 +7561,10 @@ static int __ath11k_mac_register(struct
 	ieee80211_hw_set(ar->hw, SUPPORTS_TX_FRAG);
 	ieee80211_hw_set(ar->hw, REPORTS_LOW_ACK);
 	ieee80211_hw_set(ar->hw, SUPPORTS_TX_ENCAP_OFFLOAD);
 +
 +	if (cap->nss_ratio_enabled)
 +		ieee80211_hw_set(ar->hw, SUPPORTS_VHT_EXT_NSS_BW);
 +
 	if (ht_cap & WMI_HT_CAP_ENABLED) {
 		ieee80211_hw_set(ar->hw, AMPDU_AGGREGATION);
 		ieee80211_hw_set(ar->hw, TX_AMPDU_SETUP_IN_HW);
 --- a/drivers/net/wireless/ath/ath11k/mac.h
 +++ b/drivers/net/wireless/ath/ath11k/mac.h
@@ -115,6 +115,9 @@ struct ath11k_generic_iter {
 #define WMI_MAX_SPATIAL_STREAM			3
 #define ATH11K_CHAN_WIDTH_NUM			8
 +#define ATH11K_BW_NSS_MAP_ENABLE		BIT(31)
 +#define ATH11K_PEER_RX_NSS_160MHZ		GENMASK(2, 0)
 +#define ATH11K_PEER_RX_NSS_80_80MHZ		GENMASK(5, 3)
 #define ATH11K_OBSS_PD_MAX_THRESHOLD			-82
 #define ATH11K_OBSS_PD_NON_SRG_MAX_THRESHOLD		-62
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -360,6 +360,10 @@ ath11k_pull_mac_phy_cap_svc_ready_ext(st
 		pdev_cap->he_mcs = mac_phy_caps->he_supp_mcs_5g;
 		pdev_cap->tx_chain_mask = mac_phy_caps->tx_chain_mask_5g;
 		pdev_cap->rx_chain_mask = mac_phy_caps->rx_chain_mask_5g;
 +		pdev_cap->nss_ratio_enabled =
 +			WMI_NSS_RATIO_ENABLE_DISABLE_GET(mac_phy_caps->nss_ratio);
 +		pdev_cap->nss_ratio_info =
 +			WMI_NSS_RATIO_INFO_GET(mac_phy_caps->nss_ratio);
 	} else {
 		return -EINVAL;
 	}
@@ -783,14 +787,26 @@ int ath11k_wmi_vdev_down(struct ath11k *
 static void ath11k_wmi_put_wmi_channel(struct wmi_channel *chan,
 				       struct wmi_vdev_start_req_arg *arg)
 {
 +	u32 center_freq1 = arg->channel.band_center_freq1;
 +
 	memset(chan, 0, sizeof(*chan));
 	chan->mhz = arg->channel.freq;
 	chan->band_center_freq1 = arg->channel.band_center_freq1;
 -	if (arg->channel.mode == MODE_11AC_VHT80_80)
 +
 +	if (arg->channel.mode == MODE_11AX_HE160) {
 +		if (arg->channel.freq > arg->channel.band_center_freq1)
 +			chan->band_center_freq1 = center_freq1 + 40;
 +		else
 +			chan->band_center_freq1 = center_freq1 - 40;
 +
 +		chan->band_center_freq2 = arg->channel.band_center_freq1;
 +
 +	} else if (arg->channel.mode == MODE_11AC_VHT80_80) {
 		chan->band_center_freq2 = arg->channel.band_center_freq2;
 -	else
 +	} else {
 		chan->band_center_freq2 = 0;
 +	}
 	chan->info |= FIELD_PREP(WMI_CHAN_INFO_MODE, arg->channel.mode);
 	if (arg->channel.passive)
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
@@ -2146,6 +2146,24 @@ enum wmi_direct_buffer_module {
 	WMI_DIRECT_BUF_MAX
 };
 +/* enum wmi_nss_ratio - NSS ratio received from FW during service ready ext
 + *			event
 + * WMI_NSS_RATIO_1BY2_NSS -Max nss of 160MHz is equals to half of the max nss
 + *			   of 80MHz
 + * WMI_NSS_RATIO_3BY4_NSS - Max nss of 160MHz is equals to 3/4 of the max nss
 + *			    of 80MHz
 + * WMI_NSS_RATIO_1_NSS - Max nss of 160MHz is equals to the max nss of 80MHz
 + * WMI_NSS_RATIO_2_NSS - Max nss of 160MHz is equals to two times the max
 + *			 nss of 80MHz
 + */
 +
 +enum wmi_nss_ratio {
 +	WMI_NSS_RATIO_1BY2_NSS = 0x0,
 +	WMI_NSS_RATIO_3BY4_NSS = 0x1,
 +	WMI_NSS_RATIO_1_NSS = 0x2,
 +	WMI_NSS_RATIO_2_NSS = 0x3,
 +};
 +
 struct wmi_host_pdev_band_to_mac {
 	u32 pdev_id;
 	u32 start_freq;
@@ -2390,6 +2408,12 @@ struct wmi_hw_mode_capabilities {
 } __packed;
 #define WMI_MAX_HECAP_PHY_SIZE                 (3)
 +#define WMI_NSS_RATIO_ENABLE_DISABLE_BITPOS    BIT(0)
 +#define WMI_NSS_RATIO_ENABLE_DISABLE_GET(_val) \
 +	FIELD_GET(WMI_NSS_RATIO_ENABLE_DISABLE_BITPOS, _val)
 +#define WMI_NSS_RATIO_INFO_BITPOS              GENMASK(4, 1)
 +#define WMI_NSS_RATIO_INFO_GET(_val) \
 +	FIELD_GET(WMI_NSS_RATIO_INFO_BITPOS, _val)
 struct wmi_mac_phy_capabilities {
 	u32 hw_mode_id;
@@ -2423,6 +2447,12 @@ struct wmi_mac_phy_capabilities {
 	u32 he_cap_info_2g_ext;
 	u32 he_cap_info_5g_ext;
 	u32 he_cap_info_internal;
 +	u32 wireless_modes;
 +	u32 low_2ghz_chan_freq;
 +	u32 high_2ghz_chan_freq;
 +	u32 low_5ghz_chan_freq;
 +	u32 high_5ghz_chan_freq;
 +	u32 nss_ratio;
 } __packed;
 struct wmi_hal_reg_capabilities_ext {
--- a/package/kernel/mac80211/patches/ath11k/0010-wifi-ath11k-Fix-firmware-crash-on-vdev-delete-race-c.patch
+++ b/package/kernel/mac80211/patches/ath11k/0010-wifi-ath11k-Fix-firmware-crash-on-vdev-delete-race-c.patch
@ -0,0 +1,116 @@
 From 3811fa1f231f1a3e29759efef4992116604aab8b Mon Sep 17 00:00:00 2001
 From: Sowmiya Sree Elavalagan <quic_ssreeela@quicinc.com>
 Date: Tue, 11 Oct 2022 15:23:46 +0530
 Subject: [PATCH] wifi: ath11k: Fix firmware crash on vdev delete race
 condition
 Current code does not wait for vdev delete completion on vdev create
 failures and tries to send another vdev create followed by vdev set
 param to firmware with same vdev id. This causes firmware crash.
 Fix this crash by waiting for vdev delete completion on vdev
 create failures.
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.6.0.1-00905-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Sowmiya Sree Elavalagan <quic_ssreeela@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20221011095346.3901-1-quic_ssreeela@quicinc.com
 ---
 drivers/net/wireless/ath/ath11k/mac.c | 60 +++++++++++++++++----------
 1 file changed, 37 insertions(+), 23 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -6233,6 +6233,40 @@ void ath11k_mac_11d_scan_stop_all(struct
 	}
 }
 +static int ath11k_mac_vdev_delete(struct ath11k *ar, struct ath11k_vif *arvif)
 +{
 +	unsigned long time_left;
 +	struct ieee80211_vif *vif = arvif->vif;
 +	int ret = 0;
 +
 +	lockdep_assert_held(&ar->conf_mutex);
 +
 +	reinit_completion(&ar->vdev_delete_done);
 +
 +	ret = ath11k_wmi_vdev_delete(ar, arvif->vdev_id);
 +	if (ret) {
 +		ath11k_warn(ar->ab, "failed to delete WMI vdev %d: %d\n",
 +			    arvif->vdev_id, ret);
 +		return ret;
 +	}
 +
 +	time_left = wait_for_completion_timeout(&ar->vdev_delete_done,
 +						ATH11K_VDEV_DELETE_TIMEOUT_HZ);
 +	if (time_left == 0) {
 +		ath11k_warn(ar->ab, "Timeout in receiving vdev delete response\n");
 +		return -ETIMEDOUT;
 +	}
 +
 +	ar->ab->free_vdev_map |= 1LL << (arvif->vdev_id);
 +	ar->allocated_vdev_map &= ~(1LL << arvif->vdev_id);
 +	ar->num_created_vdevs--;
 +
 +	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "vdev %pM deleted, vdev_id %d\n",
 +		   vif->addr, arvif->vdev_id);
 +
 +	return ret;
 +}
 +
 static int ath11k_mac_op_add_interface(struct ieee80211_hw *hw,
 				       struct ieee80211_vif *vif)
 {
@@ -6468,10 +6502,7 @@ err_peer_del:
 	}
 err_vdev_del:
 -	ath11k_wmi_vdev_delete(ar, arvif->vdev_id);
 -	ar->num_created_vdevs--;
 -	ar->allocated_vdev_map &= ~(1LL << arvif->vdev_id);
 -	ab->free_vdev_map |= 1LL << arvif->vdev_id;
 +	ath11k_mac_vdev_delete(ar, arvif);
 	spin_lock_bh(&ar->data_lock);
 	list_del(&arvif->list);
 	spin_unlock_bh(&ar->data_lock);
@@ -6499,7 +6530,6 @@ static void ath11k_mac_op_remove_interfa
 	struct ath11k *ar = hw->priv;
 	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
 	struct ath11k_base *ab = ar->ab;
 -	unsigned long time_left;
 	int ret;
 	int i;
@@ -6520,29 +6550,13 @@ static void ath11k_mac_op_remove_interfa
 				    arvif->vdev_id, ret);
 	}
 -	reinit_completion(&ar->vdev_delete_done);
 -
 -	ret = ath11k_wmi_vdev_delete(ar, arvif->vdev_id);
 +	ret = ath11k_mac_vdev_delete(ar, arvif);
 	if (ret) {
 -		ath11k_warn(ab, "failed to delete WMI vdev %d: %d\n",
 +		ath11k_warn(ab, "failed to delete vdev %d: %d\n",
 			    arvif->vdev_id, ret);
 		goto err_vdev_del;
 	}
 -	time_left = wait_for_completion_timeout(&ar->vdev_delete_done,
 -						ATH11K_VDEV_DELETE_TIMEOUT_HZ);
 -	if (time_left == 0) {
 -		ath11k_warn(ab, "Timeout in receiving vdev delete response\n");
 -		goto err_vdev_del;
 -	}
 -
 -	ab->free_vdev_map |= 1LL << (arvif->vdev_id);
 -	ar->allocated_vdev_map &= ~(1LL << arvif->vdev_id);
 -	ar->num_created_vdevs--;
 -
 -	ath11k_dbg(ab, ATH11K_DBG_MAC, "vdev %pM deleted, vdev_id %d\n",
 -		   vif->addr, arvif->vdev_id);
 -
 	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
 		clear_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags);
 		ar->monitor_vdev_id = -1;
--- a/package/kernel/mac80211/patches/ath11k/0011-ath11k-Refactor-spectral-FFT-bin-size.patch
+++ b/package/kernel/mac80211/patches/ath11k/0011-ath11k-Refactor-spectral-FFT-bin-size.patch
@ -1,165 +0,0 @@
 From cc2ad7541486f1f755949c1ccd17e14a15bf1f4e Mon Sep 17 00:00:00 2001
 From: Karthikeyan Periyasamy <periyasa@codeaurora.org>
 Date: Fri, 24 Sep 2021 16:52:46 +0300
 Subject: [PATCH] ath11k: Refactor spectral FFT bin size
 In IPQ8074, actual FFT bin size is two bytes but hardware reports it
 with extra pad size of two bytes for each FFT bin. So finally each FFT
 bin advertise as four bytes size in the collected data. This FFT pad is
 not advertised in IPQ6018 platform. To accommodate this different
 behavior across the platforms, introduce the hw param fft_pad_sz and use
 it in spectral process. Also group all the spectral params under the new
 structure in hw param structure for scalable in future.
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01492-QCAHKSWPL_SILICONZ-1
 Tested-on: IPQ6018 hw1.0 AHB WLAN.HK.2.4.0.1-00330-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Karthikeyan Periyasamy <periyasa@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210721180809.90960-2-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/core.c     | 33 +++++++++++++++++++---
 drivers/net/wireless/ath/ath11k/hw.h       |  6 +++-
 drivers/net/wireless/ath/ath11k/spectral.c | 13 ++++-----
 3 files changed, 40 insertions(+), 12 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
@@ -59,7 +59,14 @@ static const struct ath11k_hw_params ath
 		.vdev_start_delay = false,
 		.htt_peer_map_v2 = true,
 		.tcl_0_only = false,
 -		.spectral_fft_sz = 2,
 +
 +		.spectral = {
 +			.fft_sz = 2,
 +			/* HW bug, expected BIN size is 2 bytes but HW report as 4 bytes.
 +			 * so added pad size as 2 bytes to compensate the BIN size
 +			 */
 +			.fft_pad_sz = 2,
 +		},
 		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
 					BIT(NL80211_IFTYPE_AP) |
@@ -100,7 +107,11 @@ static const struct ath11k_hw_params ath
 		.vdev_start_delay = false,
 		.htt_peer_map_v2 = true,
 		.tcl_0_only = false,
 -		.spectral_fft_sz = 4,
 +
 +		.spectral = {
 +			.fft_sz = 4,
 +			.fft_pad_sz = 0,
 +		},
 		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
 					BIT(NL80211_IFTYPE_AP) |
@@ -141,7 +152,11 @@ static const struct ath11k_hw_params ath
 		.vdev_start_delay = true,
 		.htt_peer_map_v2 = false,
 		.tcl_0_only = true,
 -		.spectral_fft_sz = 0,
 +
 +		.spectral = {
 +			.fft_sz = 0,
 +			.fft_pad_sz = 0,
 +		},
 		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
 					BIT(NL80211_IFTYPE_AP),
@@ -180,6 +195,12 @@ static const struct ath11k_hw_params ath
 		.vdev_start_delay = false,
 		.htt_peer_map_v2 = true,
 		.tcl_0_only = false,
 +
 +		.spectral = {
 +			.fft_sz = 0,
 +			.fft_pad_sz = 0,
 +		},
 +
 		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
 					BIT(NL80211_IFTYPE_AP) |
 					BIT(NL80211_IFTYPE_MESH_POINT),
@@ -219,7 +240,11 @@ static const struct ath11k_hw_params ath
 		.vdev_start_delay = true,
 		.htt_peer_map_v2 = false,
 		.tcl_0_only = true,
 -		.spectral_fft_sz = 0,
 +
 +		.spectral = {
 +			.fft_sz = 0,
 +			.fft_pad_sz = 0,
 +		},
 		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
 					BIT(NL80211_IFTYPE_AP),
 --- a/drivers/net/wireless/ath/ath11k/hw.h
 +++ b/drivers/net/wireless/ath/ath11k/hw.h
@@ -153,7 +153,11 @@ struct ath11k_hw_params {
 	bool vdev_start_delay;
 	bool htt_peer_map_v2;
 	bool tcl_0_only;
 -	u8 spectral_fft_sz;
 +
 +	struct {
 +		u8 fft_sz;
 +		u8 fft_pad_sz;
 +	} spectral;
 	u16 interface_modes;
 	bool supports_monitor;
 --- a/drivers/net/wireless/ath/ath11k/spectral.c
 +++ b/drivers/net/wireless/ath/ath11k/spectral.c
@@ -11,8 +11,6 @@
 #define ATH11K_SPECTRAL_EVENT_TIMEOUT_MS	1
 #define ATH11K_SPECTRAL_DWORD_SIZE		4
 -/* HW bug, expected BIN size is 2 bytes but HW report as 4 bytes */
 -#define ATH11K_SPECTRAL_BIN_SIZE		4
 #define ATH11K_SPECTRAL_ATH11K_MIN_BINS		64
 #define ATH11K_SPECTRAL_ATH11K_MIN_IB_BINS	32
 #define ATH11K_SPECTRAL_ATH11K_MAX_IB_BINS	256
@@ -585,12 +583,12 @@ int ath11k_spectral_process_fft(struct a
 	struct spectral_tlv *tlv;
 	int tlv_len, bin_len, num_bins;
 	u16 length, freq;
 -	u8 chan_width_mhz;
 +	u8 chan_width_mhz, bin_sz;
 	int ret;
 	lockdep_assert_held(&ar->spectral.lock);
 -	if (!ab->hw_params.spectral_fft_sz) {
 +	if (!ab->hw_params.spectral.fft_sz) {
 		ath11k_warn(ab, "invalid bin size type for hw rev %d\n",
 			    ab->hw_rev);
 		return -EINVAL;
@@ -608,7 +606,8 @@ int ath11k_spectral_process_fft(struct a
 		return -EINVAL;
 	}
 -	num_bins = bin_len / ATH11K_SPECTRAL_BIN_SIZE;
 +	bin_sz = ab->hw_params.spectral.fft_sz + ab->hw_params.spectral.fft_pad_sz;
 +	num_bins = bin_len / bin_sz;
 	/* Only In-band bins are useful to user for visualize */
 	num_bins >>= 1;
@@ -658,7 +657,7 @@ int ath11k_spectral_process_fft(struct a
 	fft_sample->freq2 = __cpu_to_be16(freq);
 	ath11k_spectral_parse_fft(fft_sample->data, fft_report->bins, num_bins,
 -				  ab->hw_params.spectral_fft_sz);
 +				  ab->hw_params.spectral.fft_sz);
 	fft_sample->max_exp = ath11k_spectral_get_max_exp(fft_sample->max_index,
 							  search.peak_mag,
@@ -966,7 +965,7 @@ int ath11k_spectral_init(struct ath11k_b
 		      ab->wmi_ab.svc_map))
 		return 0;
 -	if (!ab->hw_params.spectral_fft_sz)
 +	if (!ab->hw_params.spectral.fft_sz)
 		return 0;
 	for (i = 0; i < ab->num_radios; i++) {
--- a/package/kernel/mac80211/patches/ath11k/0011-wifi-ath11k-fix-monitor-vdev-creation-with-firmware-.patch
+++ b/package/kernel/mac80211/patches/ath11k/0011-wifi-ath11k-fix-monitor-vdev-creation-with-firmware-.patch
@ -0,0 +1,40 @@
 From f3ca72b0327101a074a871539e61775d43908ca4 Mon Sep 17 00:00:00 2001
 From: Nagarajan Maran <quic_nmaran@quicinc.com>
 Date: Fri, 14 Oct 2022 21:20:54 +0530
 Subject: [PATCH] wifi: ath11k: fix monitor vdev creation with firmware
 recovery
 During firmware recovery, the monitor interface is not
 getting created in the driver and firmware since
 the respective flags are not updated properly.
 So after firmware recovery is successful, when monitor
 interface is brought down manually, firmware assertion
 is observed, since we are trying to bring down the
 interface which is not yet created in the firmware.
 Fix this by updating the monitor flags properly per
 phy#, during firmware recovery.
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20221014155054.11471-1-quic_nmaran@quicinc.com
 ---
 drivers/net/wireless/ath/ath11k/core.c | 4 ++++
 1 file changed, 4 insertions(+)
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
@@ -1677,6 +1677,10 @@ void ath11k_core_pre_reconfigure_recover
 			     ath11k_mac_tx_mgmt_pending_free, ar);
 		idr_destroy(&ar->txmgmt_idr);
 		wake_up(&ar->txmgmt_empty_waitq);
 +
 +		ar->monitor_vdev_id = -1;
 +		clear_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags);
 +		clear_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags);
 	}
 	wake_up(&ab->wmi_ab.tx_credits_wq);
--- a/package/kernel/mac80211/patches/ath11k/0012-ath11k-Introduce-spectral-hw-configurable-param.patch
+++ b/package/kernel/mac80211/patches/ath11k/0012-ath11k-Introduce-spectral-hw-configurable-param.patch
@ -1,168 +0,0 @@
 From 1cae9c0009d35cec94ad8e1b06ebcb2d704626bf Mon Sep 17 00:00:00 2001
 From: Karthikeyan Periyasamy <periyasa@codeaurora.org>
 Date: Fri, 24 Sep 2021 16:52:46 +0300
 Subject: [PATCH] ath11k: Introduce spectral hw configurable param
 Below parameters have been identified as configurable across the platforms.
 So to scale the spectral across the platforms, move these parameter
 into hw param.
 	1. Maximum FFT bins
 	2. Summary report pad size
 	3. FFT report header length
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01492-QCAHKSWPL_SILICONZ-1
 Tested-on: IPQ6018 hw1.0 AHB WLAN.HK.2.4.0.1-00330-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Karthikeyan Periyasamy <periyasa@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210721180809.90960-3-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/core.c     | 12 +++++++++
 drivers/net/wireless/ath/ath11k/hw.h       |  3 +++
 drivers/net/wireless/ath/ath11k/spectral.c | 29 +++++++++++-----------
 3 files changed, 30 insertions(+), 14 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
@@ -66,6 +66,9 @@ static const struct ath11k_hw_params ath
 			 * so added pad size as 2 bytes to compensate the BIN size
 			 */
 			.fft_pad_sz = 2,
 +			.summary_pad_sz = 0,
 +			.fft_hdr_len = 16,
 +			.max_fft_bins = 512,
 		},
 		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
@@ -111,6 +114,9 @@ static const struct ath11k_hw_params ath
 		.spectral = {
 			.fft_sz = 4,
 			.fft_pad_sz = 0,
 +			.summary_pad_sz = 0,
 +			.fft_hdr_len = 16,
 +			.max_fft_bins = 512,
 		},
 		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
@@ -156,6 +162,9 @@ static const struct ath11k_hw_params ath
 		.spectral = {
 			.fft_sz = 0,
 			.fft_pad_sz = 0,
 +			.summary_pad_sz = 0,
 +			.fft_hdr_len = 0,
 +			.max_fft_bins = 0,
 		},
 		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
@@ -244,6 +253,9 @@ static const struct ath11k_hw_params ath
 		.spectral = {
 			.fft_sz = 0,
 			.fft_pad_sz = 0,
 +			.summary_pad_sz = 0,
 +			.fft_hdr_len = 0,
 +			.max_fft_bins = 0,
 		},
 		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
 --- a/drivers/net/wireless/ath/ath11k/hw.h
 +++ b/drivers/net/wireless/ath/ath11k/hw.h
@@ -157,6 +157,9 @@ struct ath11k_hw_params {
 	struct {
 		u8 fft_sz;
 		u8 fft_pad_sz;
 +		u8 summary_pad_sz;
 +		u8 fft_hdr_len;
 +		u16 max_fft_bins;
 	} spectral;
 	u16 interface_modes;
 --- a/drivers/net/wireless/ath/ath11k/spectral.c
 +++ b/drivers/net/wireless/ath/ath11k/spectral.c
@@ -11,20 +11,20 @@
 #define ATH11K_SPECTRAL_EVENT_TIMEOUT_MS	1
 #define ATH11K_SPECTRAL_DWORD_SIZE		4
 -#define ATH11K_SPECTRAL_ATH11K_MIN_BINS		64
 -#define ATH11K_SPECTRAL_ATH11K_MIN_IB_BINS	32
 -#define ATH11K_SPECTRAL_ATH11K_MAX_IB_BINS	256
 +#define ATH11K_SPECTRAL_MIN_BINS		64
 +#define ATH11K_SPECTRAL_MIN_IB_BINS		(ATH11K_SPECTRAL_MIN_BINS >> 1)
 +#define ATH11K_SPECTRAL_MAX_IB_BINS(x)	((x)->hw_params.spectral.max_fft_bins >> 1)
 #define ATH11K_SPECTRAL_SCAN_COUNT_MAX		4095
 /* Max channel computed by sum of 2g and 5g band channels */
 #define ATH11K_SPECTRAL_TOTAL_CHANNEL		41
 #define ATH11K_SPECTRAL_SAMPLES_PER_CHANNEL	70
 -#define ATH11K_SPECTRAL_PER_SAMPLE_SIZE		(sizeof(struct fft_sample_ath11k) + \
 -						 ATH11K_SPECTRAL_ATH11K_MAX_IB_BINS)
 +#define ATH11K_SPECTRAL_PER_SAMPLE_SIZE(x)	(sizeof(struct fft_sample_ath11k) + \
 +						 ATH11K_SPECTRAL_MAX_IB_BINS(x))
 #define ATH11K_SPECTRAL_TOTAL_SAMPLE		(ATH11K_SPECTRAL_TOTAL_CHANNEL * \
 						 ATH11K_SPECTRAL_SAMPLES_PER_CHANNEL)
 -#define ATH11K_SPECTRAL_SUB_BUFF_SIZE		ATH11K_SPECTRAL_PER_SAMPLE_SIZE
 +#define ATH11K_SPECTRAL_SUB_BUFF_SIZE(x)	ATH11K_SPECTRAL_PER_SAMPLE_SIZE(x)
 #define ATH11K_SPECTRAL_NUM_SUB_BUF		ATH11K_SPECTRAL_TOTAL_SAMPLE
 #define ATH11K_SPECTRAL_20MHZ			20
@@ -446,8 +446,8 @@ static ssize_t ath11k_write_file_spectra
 	if (kstrtoul(buf, 0, &val))
 		return -EINVAL;
 -	if (val < ATH11K_SPECTRAL_ATH11K_MIN_BINS ||
 -	    val > SPECTRAL_ATH11K_MAX_NUM_BINS)
 +	if (val < ATH11K_SPECTRAL_MIN_BINS ||
 +	    val > ar->ab->hw_params.spectral.max_fft_bins)
 		return -EINVAL;
 	if (!is_power_of_2(val))
@@ -598,7 +598,7 @@ int ath11k_spectral_process_fft(struct a
 	tlv_len = FIELD_GET(SPECTRAL_TLV_HDR_LEN, __le32_to_cpu(tlv->header));
 	/* convert Dword into bytes */
 	tlv_len *= ATH11K_SPECTRAL_DWORD_SIZE;
 -	bin_len = tlv_len - (sizeof(*fft_report) - sizeof(*tlv));
 +	bin_len = tlv_len - ab->hw_params.spectral.fft_hdr_len;
 	if (data_len < (bin_len + sizeof(*fft_report))) {
 		ath11k_warn(ab, "mismatch in expected bin len %d and data len %d\n",
@@ -611,8 +611,8 @@ int ath11k_spectral_process_fft(struct a
 	/* Only In-band bins are useful to user for visualize */
 	num_bins >>= 1;
 -	if (num_bins < ATH11K_SPECTRAL_ATH11K_MIN_IB_BINS ||
 -	    num_bins > ATH11K_SPECTRAL_ATH11K_MAX_IB_BINS ||
 +	if (num_bins < ATH11K_SPECTRAL_MIN_IB_BINS ||
 +	    num_bins > ATH11K_SPECTRAL_MAX_IB_BINS(ab) ||
 	    !is_power_of_2(num_bins)) {
 		ath11k_warn(ab, "Invalid num of bins %d\n", num_bins);
 		return -EINVAL;
@@ -693,7 +693,7 @@ static int ath11k_spectral_process_data(
 		goto unlock;
 	}
 -	sample_sz = sizeof(*fft_sample) + ATH11K_SPECTRAL_ATH11K_MAX_IB_BINS;
 +	sample_sz = sizeof(*fft_sample) + ATH11K_SPECTRAL_MAX_IB_BINS(ab);
 	fft_sample = kmalloc(sample_sz, GFP_ATOMIC);
 	if (!fft_sample) {
 		ret = -ENOBUFS;
@@ -741,7 +741,8 @@ static int ath11k_spectral_process_data(
 			 * is 4 DWORD size (16 bytes).
 			 * Need to remove this workaround once HW bug fixed
 			 */
 -			tlv_len = sizeof(*summary) - sizeof(*tlv);
 +			tlv_len = sizeof(*summary) - sizeof(*tlv) +
 +				  ab->hw_params.spectral.summary_pad_sz;
 			if (tlv_len < (sizeof(*summary) - sizeof(*tlv))) {
 				ath11k_warn(ab, "failed to parse spectral summary at bytes %d tlv_len:%d\n",
@@ -904,7 +905,7 @@ static inline int ath11k_spectral_debug_
 	ar->spectral.rfs_scan = relay_open("spectral_scan",
 					   ar->debug.debugfs_pdev,
 -					   ATH11K_SPECTRAL_SUB_BUFF_SIZE,
 +					   ATH11K_SPECTRAL_SUB_BUFF_SIZE(ar->ab),
 					   ATH11K_SPECTRAL_NUM_SUB_BUF,
 					   &rfs_scan_cb, NULL);
 	if (!ar->spectral.rfs_scan) {
--- a/package/kernel/mac80211/patches/ath11k/0012-wifi-ath11k-Fix-qmi_msg_handler-data-structure-initi.patch
+++ b/package/kernel/mac80211/patches/ath11k/0012-wifi-ath11k-Fix-qmi_msg_handler-data-structure-initi.patch
@ -0,0 +1,33 @@
 From ed3725e15a154ebebf44e0c34806c57525483f92 Mon Sep 17 00:00:00 2001
 From: Rahul Bhattacharjee <quic_rbhattac@quicinc.com>
 Date: Fri, 21 Oct 2022 14:31:26 +0530
 Subject: [PATCH] wifi: ath11k: Fix qmi_msg_handler data structure
 initialization
 qmi_msg_handler is required to be null terminated by QMI module.
 There might be a case where a handler for a msg id is not present in the
 handlers array which can lead to infinite loop while searching the handler
 and therefore out of bound access in qmi_invoke_handler().
 Hence update the initialization in qmi_msg_handler data structure.
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Rahul Bhattacharjee <quic_rbhattac@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20221021090126.28626-1-quic_rbhattac@quicinc.com
 ---
 drivers/net/wireless/ath/ath11k/qmi.c | 3 +++
 1 file changed, 3 insertions(+)
 --- a/drivers/net/wireless/ath/ath11k/qmi.c
 +++ b/drivers/net/wireless/ath/ath11k/qmi.c
@@ -1702,6 +1702,9 @@ static struct qmi_elem_info qmi_wlfw_fw_
 		.data_type = QMI_EOTI,
 		.array_type = NO_ARRAY,
 	},
 +
 +	/* end of list */
 +	{},
 };
 static int ath11k_qmi_host_cap_send(struct ath11k_base *ab)
--- a/package/kernel/mac80211/patches/ath11k/0013-ath11k-Fix-the-spectral-minimum-FFT-bin-count.patch
+++ b/package/kernel/mac80211/patches/ath11k/0013-ath11k-Fix-the-spectral-minimum-FFT-bin-count.patch
@ -1,33 +0,0 @@
 From 6dfd20c8a6cd1fcf2c68d86c9d678f42535f6ade Mon Sep 17 00:00:00 2001
 From: Karthikeyan Periyasamy <periyasa@codeaurora.org>
 Date: Fri, 24 Sep 2021 16:52:46 +0300
 Subject: [PATCH] ath11k: Fix the spectral minimum FFT bin count
 User was not able to configure the spectral with the FFT bin count 32.
 In all supported platforms, the expected minimum FFT bin count is 32 but
 it was wrongly defined as 64. This restrict the user to not configure
 down to the actually supported minimum FFT bin count. So update the
 minimum FFT bin count as 32.
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01492-QCAHKSWPL_SILICONZ-1
 Tested-on: IPQ6018 hw1.0 AHB WLAN.HK.2.4.0.1-00330-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Karthikeyan Periyasamy <periyasa@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210721180809.90960-4-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/spectral.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 --- a/drivers/net/wireless/ath/ath11k/spectral.c
 +++ b/drivers/net/wireless/ath/ath11k/spectral.c
@@ -11,7 +11,7 @@
 #define ATH11K_SPECTRAL_EVENT_TIMEOUT_MS	1
 #define ATH11K_SPECTRAL_DWORD_SIZE		4
 -#define ATH11K_SPECTRAL_MIN_BINS		64
 +#define ATH11K_SPECTRAL_MIN_BINS		32
 #define ATH11K_SPECTRAL_MIN_IB_BINS		(ATH11K_SPECTRAL_MIN_BINS >> 1)
 #define ATH11K_SPECTRAL_MAX_IB_BINS(x)	((x)->hw_params.spectral.max_fft_bins >> 1)
--- a/package/kernel/mac80211/patches/ath11k/0013-wifi-ath11k-synchronize-ath11k_mac_he_gi_to_nl80211_.patch
+++ b/package/kernel/mac80211/patches/ath11k/0013-wifi-ath11k-synchronize-ath11k_mac_he_gi_to_nl80211_.patch
@ -0,0 +1,42 @@
 From dd1c2322694522f674c874f5fa02ac5ae39135dd Mon Sep 17 00:00:00 2001
 From: "Jiri Slaby (SUSE)" <jirislaby@kernel.org>
 Date: Mon, 31 Oct 2022 12:43:41 +0100
 Subject: [PATCH] wifi: ath11k: synchronize
 ath11k_mac_he_gi_to_nl80211_he_gi()'s return type
 ath11k_mac_he_gi_to_nl80211_he_gi() generates a valid warning with gcc-13:
  drivers/net/wireless/ath/ath11k/mac.c:321:20: error: conflicting types for 'ath11k_mac_he_gi_to_nl80211_he_gi' due to enum/integer mismatch; have 'enum nl80211_he_gi(u8)'
  drivers/net/wireless/ath/ath11k/mac.h:166:5: note: previous declaration of 'ath11k_mac_he_gi_to_nl80211_he_gi' with type 'u32(u8)'
 I.e. the type of the return value ath11k_mac_he_gi_to_nl80211_he_gi() in
 the declaration is u32, while the definition spells enum nl80211_he_gi.
 Synchronize them to the latter.
 Cc: Martin Liska <mliska@suse.cz>
 Cc: Kalle Valo <kvalo@kernel.org>
 Cc: "David S. Miller" <davem@davemloft.net>
 Cc: Eric Dumazet <edumazet@google.com>
 Cc: Jakub Kicinski <kuba@kernel.org>
 Cc: Paolo Abeni <pabeni@redhat.com>
 Cc: ath11k@lists.infradead.org
 Cc: linux-wireless@vger.kernel.org
 Cc: netdev@vger.kernel.org
 Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
 Reviewed-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20221031114341.10377-1-jirislaby@kernel.org
 ---
 drivers/net/wireless/ath/ath11k/mac.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 --- a/drivers/net/wireless/ath/ath11k/mac.h
 +++ b/drivers/net/wireless/ath/ath11k/mac.h
@@ -163,7 +163,7 @@ void ath11k_mac_drain_tx(struct ath11k *
 void ath11k_mac_peer_cleanup_all(struct ath11k *ar);
 int ath11k_mac_tx_mgmt_pending_free(int buf_id, void *skb, void *ctx);
 u8 ath11k_mac_bw_to_mac80211_bw(u8 bw);
 -u32 ath11k_mac_he_gi_to_nl80211_he_gi(u8 sgi);
 +enum nl80211_he_gi ath11k_mac_he_gi_to_nl80211_he_gi(u8 sgi);
 enum nl80211_he_ru_alloc ath11k_mac_phy_he_ru_to_nl80211_he_ru_alloc(u16 ru_phy);
 enum nl80211_he_ru_alloc ath11k_mac_he_ru_tones_to_nl80211_he_ru_alloc(u16 ru_tones);
 enum ath11k_supported_bw ath11k_mac_mac80211_bw_to_ath11k_bw(enum rate_info_bw bw);
--- a/package/kernel/mac80211/patches/ath11k/0014-ath11k-Add-spectral-scan-support-for-QCN9074.patch
+++ b/package/kernel/mac80211/patches/ath11k/0014-ath11k-Add-spectral-scan-support-for-QCN9074.patch
@ -1,36 +0,0 @@
 From b72e86c07e9881d249fbb7511060692f3fb6b687 Mon Sep 17 00:00:00 2001
 From: Karthikeyan Periyasamy <periyasa@codeaurora.org>
 Date: Fri, 24 Sep 2021 16:52:46 +0300
 Subject: [PATCH] ath11k: Add spectral scan support for QCN9074
 Populate the below hw parameters as per the QCN9074 support
 	1. FFT bin size as two bytes
 	2. Maximum FFT bin count as 1024
 	3. Summary report pad size as 16
 	4. FFT report header length as 24
 Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01492-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Karthikeyan Periyasamy <periyasa@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210721180809.90960-5-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/core.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
@@ -206,8 +206,11 @@ static const struct ath11k_hw_params ath
 		.tcl_0_only = false,
 		.spectral = {
 -			.fft_sz = 0,
 +			.fft_sz = 2,
 			.fft_pad_sz = 0,
 +			.summary_pad_sz = 16,
 +			.fft_hdr_len = 24,
 +			.max_fft_bins = 1024,
 		},
 		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
--- a/package/kernel/mac80211/patches/ath11k/0015-ath11k-Wstringop-overread-warning.patch
+++ b/package/kernel/mac80211/patches/ath11k/0015-ath11k-Wstringop-overread-warning.patch
@ -1,44 +0,0 @@
 From eb19efed836a51ee30a602abe2dd21a97c47bbcc Mon Sep 17 00:00:00 2001
 From: Arnd Bergmann <arnd@arndb.de>
 Date: Fri, 24 Sep 2021 16:52:52 +0300
 Subject: [PATCH] ath11k: Wstringop-overread warning
 gcc-11 with the kernel address sanitizer prints a warning for this
 driver:
 In function 'ath11k_peer_assoc_h_vht',
    inlined from 'ath11k_peer_assoc_prepare' at drivers/net/wireless/ath/ath11k/mac.c:1632:2:
 drivers/net/wireless/ath/ath11k/mac.c:1164:13: error: 'ath11k_peer_assoc_h_vht_masked' reading 16 bytes from a region of size 4 [-Werror=stringop-overread]
 1164 |         if (ath11k_peer_assoc_h_vht_masked(vht_mcs_mask))
      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 drivers/net/wireless/ath/ath11k/mac.c: In function 'ath11k_peer_assoc_prepare':
 drivers/net/wireless/ath/ath11k/mac.c:1164:13: note: referencing argument 1 of type 'const u16 *' {aka 'const short unsigned int *'}
 drivers/net/wireless/ath/ath11k/mac.c:969:1: note: in a call to function 'ath11k_peer_assoc_h_vht_masked'
  969 | ath11k_peer_assoc_h_vht_masked(const u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
      | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 According to analysis from gcc developers, this is a glitch in the
 way gcc tracks the size of struct members. This should really get
 fixed in gcc, but it's also easy to work around this instance
 by changing the function prototype to no include the length of
 the array.
 Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99673
 Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210322160253.4032422-5-arnd@kernel.org
 ---
 drivers/net/wireless/ath/ath11k/mac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -1406,7 +1406,7 @@ ath11k_peer_assoc_h_ht_masked(const u8 h
 }
 static bool
 -ath11k_peer_assoc_h_vht_masked(const u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
 +ath11k_peer_assoc_h_vht_masked(const u16 vht_mcs_mask[])
 {
 	int nss;
--- a/package/kernel/mac80211/patches/ath11k/0016-ath11k-use-hw_params-to-access-board_size-and-cal_of.patch
+++ b/package/kernel/mac80211/patches/ath11k/0016-ath11k-use-hw_params-to-access-board_size-and-cal_of.patch
@ -1,113 +0,0 @@
 From c72aa32d6d1c04fa83d4c0e6849e4e60d9d39ae4 Mon Sep 17 00:00:00 2001
 From: Anilkumar Kolli <akolli@codeaurora.org>
 Date: Tue, 28 Sep 2021 12:05:39 +0300
 Subject: [PATCH] ath11k: use hw_params to access board_size and cal_offset
 Reuse board_size from hw_params, add cal_offset to hw params.
 This patch is clean up only, there is no change in functionality.
 cal_size was unused, so remove that.
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-00009-QCAHKSWPL_SILICONZ-1
 Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01838-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210721201927.100369-2-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/core.c | 10 +++++-----
 drivers/net/wireless/ath/ath11k/hw.h   |  2 +-
 drivers/net/wireless/ath/ath11k/qmi.c  |  4 ++--
 drivers/net/wireless/ath/ath11k/qmi.h  |  2 --
 4 files changed, 8 insertions(+), 10 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
@@ -37,7 +37,7 @@ static const struct ath11k_hw_params ath
 		.fw = {
 			.dir = "IPQ8074/hw2.0",
 			.board_size = 256 * 1024,
 -			.cal_size = 256 * 1024,
 +			.cal_offset = 128 * 1024,
 		},
 		.max_radios = 3,
 		.bdf_addr = 0x4B0C0000,
@@ -88,7 +88,7 @@ static const struct ath11k_hw_params ath
 		.fw = {
 			.dir = "IPQ6018/hw1.0",
 			.board_size = 256 * 1024,
 -			.cal_size = 256 * 1024,
 +			.cal_offset = 128 * 1024,
 		},
 		.max_radios = 2,
 		.bdf_addr = 0x4ABC0000,
@@ -136,7 +136,7 @@ static const struct ath11k_hw_params ath
 		.fw = {
 			.dir = "QCA6390/hw2.0",
 			.board_size = 256 * 1024,
 -			.cal_size = 256 * 1024,
 +			.cal_offset = 128 * 1024,
 		},
 		.max_radios = 3,
 		.bdf_addr = 0x4B0C0000,
@@ -183,7 +183,7 @@ static const struct ath11k_hw_params ath
 		.fw = {
 			.dir = "QCN9074/hw1.0",
 			.board_size = 256 * 1024,
 -			.cal_size = 256 * 1024,
 +			.cal_offset = 128 * 1024,
 		},
 		.max_radios = 1,
 		.single_pdev_only = false,
@@ -230,7 +230,7 @@ static const struct ath11k_hw_params ath
 		.fw = {
 			.dir = "WCN6855/hw2.0",
 			.board_size = 256 * 1024,
 -			.cal_size = 256 * 1024,
 +			.cal_offset = 128 * 1024,
 		},
 		.max_radios = 3,
 		.bdf_addr = 0x4B0C0000,
 --- a/drivers/net/wireless/ath/ath11k/hw.h
 +++ b/drivers/net/wireless/ath/ath11k/hw.h
@@ -128,7 +128,7 @@ struct ath11k_hw_params {
 	struct {
 		const char *dir;
 		size_t board_size;
 -		size_t cal_size;
 +		size_t cal_offset;
 	} fw;
 	const struct ath11k_hw_ops *hw_ops;
 --- a/drivers/net/wireless/ath/ath11k/qmi.c
 +++ b/drivers/net/wireless/ath/ath11k/qmi.c
@@ -1953,7 +1953,7 @@ ath11k_qmi_prepare_bdf_download(struct a
 		fw_size = min_t(u32, ab->hw_params.fw.board_size,
 				fw_entry->size);
 -		memcpy_toio(bdf_addr + ATH11K_QMI_CALDATA_OFFSET,
 +		memcpy_toio(bdf_addr + ab->hw_params.fw.cal_offset,
 			    fw_entry->data, fw_size);
 		release_firmware(fw_entry);
@@ -1979,7 +1979,7 @@ static int ath11k_qmi_load_bdf_fixed_add
 		return -ENOMEM;
 	memset(&resp, 0, sizeof(resp));
 -	bdf_addr = ioremap(ab->hw_params.bdf_addr, ATH11K_QMI_BDF_MAX_SIZE);
 +	bdf_addr = ioremap(ab->hw_params.bdf_addr, ab->hw_params.fw.board_size);
 	if (!bdf_addr) {
 		ath11k_warn(ab, "failed ioremap for board file\n");
 		ret = -EIO;
 --- a/drivers/net/wireless/ath/ath11k/qmi.h
 +++ b/drivers/net/wireless/ath/ath11k/qmi.h
@@ -13,8 +13,6 @@
 #define ATH11K_QMI_WLANFW_TIMEOUT_MS		5000
 #define ATH11K_QMI_MAX_BDF_FILE_NAME_SIZE	64
 #define ATH11K_QMI_CALDB_ADDRESS		0x4BA00000
 -#define ATH11K_QMI_BDF_MAX_SIZE			(256 * 1024)
 -#define ATH11K_QMI_CALDATA_OFFSET		(128 * 1024)
 #define ATH11K_QMI_WLANFW_MAX_BUILD_ID_LEN_V01	128
 #define ATH11K_QMI_WLFW_SERVICE_ID_V01		0x45
 #define ATH11K_QMI_WLFW_SERVICE_VERS_V01	0x01
--- a/package/kernel/mac80211/patches/ath11k/0016-wifi-ath11k-Make-QMI-message-rules-const.patch
+++ b/package/kernel/mac80211/patches/ath11k/0016-wifi-ath11k-Make-QMI-message-rules-const.patch
@ -0,0 +1,341 @@
 From 93c1592889fca46d09d833455628bab05516cdbf Mon Sep 17 00:00:00 2001
 From: Jeff Johnson <quic_jjohnson@quicinc.com>
 Date: Wed, 14 Sep 2022 17:23:03 -0700
 Subject: [PATCH] wifi: ath11k: Make QMI message rules const
 Commit ff6d365898d4 ("soc: qcom: qmi: use const for struct
 qmi_elem_info") allows QMI message encoding/decoding rules to be
 const, so do that for ath11k.
 Compile tested only.
 Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20220915002303.12206-1-quic_jjohnson@quicinc.com
 ---
 drivers/net/wireless/ath/ath11k/qmi.c | 72 +++++++++++++--------------
 1 file changed, 36 insertions(+), 36 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/qmi.c
 +++ b/drivers/net/wireless/ath/ath11k/qmi.c
@@ -29,7 +29,7 @@ module_param_named(cold_boot_cal, ath11k
 MODULE_PARM_DESC(cold_boot_cal,
 		 "Decrease the channel switch time but increase the driver load time (Default: true)");
 -static struct qmi_elem_info qmi_wlanfw_host_cap_req_msg_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_host_cap_req_msg_v01_ei[] = {
 	{
 		.data_type	= QMI_OPT_FLAG,
 		.elem_len	= 1,
@@ -280,7 +280,7 @@ static struct qmi_elem_info qmi_wlanfw_h
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_host_cap_resp_msg_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_host_cap_resp_msg_v01_ei[] = {
 	{
 		.data_type	= QMI_STRUCT,
 		.elem_len	= 1,
@@ -297,7 +297,7 @@ static struct qmi_elem_info qmi_wlanfw_h
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_ind_register_req_msg_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_ind_register_req_msg_v01_ei[] = {
 	{
 		.data_type	= QMI_OPT_FLAG,
 		.elem_len	= 1,
@@ -522,7 +522,7 @@ static struct qmi_elem_info qmi_wlanfw_i
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_ind_register_resp_msg_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_ind_register_resp_msg_v01_ei[] = {
 	{
 		.data_type	= QMI_STRUCT,
 		.elem_len	= 1,
@@ -558,7 +558,7 @@ static struct qmi_elem_info qmi_wlanfw_i
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_mem_cfg_s_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_mem_cfg_s_v01_ei[] = {
 	{
 		.data_type	= QMI_UNSIGNED_8_BYTE,
 		.elem_len	= 1,
@@ -590,7 +590,7 @@ static struct qmi_elem_info qmi_wlanfw_m
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_mem_seg_s_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_mem_seg_s_v01_ei[] = {
 	{
 		.data_type	= QMI_UNSIGNED_4_BYTE,
 		.elem_len	= 1,
@@ -632,7 +632,7 @@ static struct qmi_elem_info qmi_wlanfw_m
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_request_mem_ind_msg_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_request_mem_ind_msg_v01_ei[] = {
 	{
 		.data_type	= QMI_DATA_LEN,
 		.elem_len	= 1,
@@ -659,7 +659,7 @@ static struct qmi_elem_info qmi_wlanfw_r
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_mem_seg_resp_s_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_mem_seg_resp_s_v01_ei[] = {
 	{
 		.data_type	= QMI_UNSIGNED_8_BYTE,
 		.elem_len	= 1,
@@ -699,7 +699,7 @@ static struct qmi_elem_info qmi_wlanfw_m
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_respond_mem_req_msg_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_respond_mem_req_msg_v01_ei[] = {
 	{
 		.data_type	= QMI_DATA_LEN,
 		.elem_len	= 1,
@@ -726,7 +726,7 @@ static struct qmi_elem_info qmi_wlanfw_r
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_respond_mem_resp_msg_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_respond_mem_resp_msg_v01_ei[] = {
 	{
 		.data_type	= QMI_STRUCT,
 		.elem_len	= 1,
@@ -744,7 +744,7 @@ static struct qmi_elem_info qmi_wlanfw_r
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_cap_req_msg_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_cap_req_msg_v01_ei[] = {
 	{
 		.data_type	= QMI_EOTI,
 		.array_type	= NO_ARRAY,
@@ -752,7 +752,7 @@ static struct qmi_elem_info qmi_wlanfw_c
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_device_info_req_msg_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_device_info_req_msg_v01_ei[] = {
 	{
 		.data_type      = QMI_EOTI,
 		.array_type     = NO_ARRAY,
@@ -760,7 +760,7 @@ static struct qmi_elem_info qmi_wlanfw_d
 	},
 };
 -static struct qmi_elem_info qmi_wlfw_device_info_resp_msg_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlfw_device_info_resp_msg_v01_ei[] = {
 	{
 		.data_type	= QMI_STRUCT,
 		.elem_len	= 1,
@@ -814,7 +814,7 @@ static struct qmi_elem_info qmi_wlfw_dev
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_rf_chip_info_s_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_rf_chip_info_s_v01_ei[] = {
 	{
 		.data_type	= QMI_UNSIGNED_4_BYTE,
 		.elem_len	= 1,
@@ -840,7 +840,7 @@ static struct qmi_elem_info qmi_wlanfw_r
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_rf_board_info_s_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_rf_board_info_s_v01_ei[] = {
 	{
 		.data_type	= QMI_UNSIGNED_4_BYTE,
 		.elem_len	= 1,
@@ -857,7 +857,7 @@ static struct qmi_elem_info qmi_wlanfw_r
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_soc_info_s_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_soc_info_s_v01_ei[] = {
 	{
 		.data_type	= QMI_UNSIGNED_4_BYTE,
 		.elem_len	= 1,
@@ -873,7 +873,7 @@ static struct qmi_elem_info qmi_wlanfw_s
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_fw_version_info_s_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_fw_version_info_s_v01_ei[] = {
 	{
 		.data_type	= QMI_UNSIGNED_4_BYTE,
 		.elem_len	= 1,
@@ -899,7 +899,7 @@ static struct qmi_elem_info qmi_wlanfw_f
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_cap_resp_msg_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_cap_resp_msg_v01_ei[] = {
 	{
 		.data_type	= QMI_STRUCT,
 		.elem_len	= 1,
@@ -1100,7 +1100,7 @@ static struct qmi_elem_info qmi_wlanfw_c
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_bdf_download_req_msg_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_bdf_download_req_msg_v01_ei[] = {
 	{
 		.data_type	= QMI_UNSIGNED_1_BYTE,
 		.elem_len	= 1,
@@ -1235,7 +1235,7 @@ static struct qmi_elem_info qmi_wlanfw_b
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_bdf_download_resp_msg_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_bdf_download_resp_msg_v01_ei[] = {
 	{
 		.data_type	= QMI_STRUCT,
 		.elem_len	= 1,
@@ -1253,7 +1253,7 @@ static struct qmi_elem_info qmi_wlanfw_b
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_m3_info_req_msg_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_m3_info_req_msg_v01_ei[] = {
 	{
 		.data_type	= QMI_UNSIGNED_8_BYTE,
 		.elem_len	= 1,
@@ -1277,7 +1277,7 @@ static struct qmi_elem_info qmi_wlanfw_m
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_m3_info_resp_msg_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_m3_info_resp_msg_v01_ei[] = {
 	{
 		.data_type	= QMI_STRUCT,
 		.elem_len	= 1,
@@ -1294,7 +1294,7 @@ static struct qmi_elem_info qmi_wlanfw_m
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_ce_tgt_pipe_cfg_s_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_ce_tgt_pipe_cfg_s_v01_ei[] = {
 	{
 		.data_type	= QMI_UNSIGNED_4_BYTE,
 		.elem_len	= 1,
@@ -1347,7 +1347,7 @@ static struct qmi_elem_info qmi_wlanfw_c
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_ce_svc_pipe_cfg_s_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_ce_svc_pipe_cfg_s_v01_ei[] = {
 	{
 		.data_type	= QMI_UNSIGNED_4_BYTE,
 		.elem_len	= 1,
@@ -1382,7 +1382,7 @@ static struct qmi_elem_info qmi_wlanfw_c
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_shadow_reg_cfg_s_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_shadow_reg_cfg_s_v01_ei[] = {
 	{
 		.data_type	= QMI_UNSIGNED_2_BYTE,
 		.elem_len	= 1,
@@ -1406,7 +1406,7 @@ static struct qmi_elem_info qmi_wlanfw_s
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_shadow_reg_v2_cfg_s_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_shadow_reg_v2_cfg_s_v01_ei[] = {
 	{
 		.data_type	= QMI_UNSIGNED_4_BYTE,
 		.elem_len	= 1,
@@ -1423,7 +1423,7 @@ static struct qmi_elem_info qmi_wlanfw_s
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_wlan_mode_req_msg_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_wlan_mode_req_msg_v01_ei[] = {
 	{
 		.data_type	= QMI_UNSIGNED_4_BYTE,
 		.elem_len	= 1,
@@ -1458,7 +1458,7 @@ static struct qmi_elem_info qmi_wlanfw_w
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_wlan_mode_resp_msg_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_wlan_mode_resp_msg_v01_ei[] = {
 	{
 		.data_type	= QMI_STRUCT,
 		.elem_len	= 1,
@@ -1476,7 +1476,7 @@ static struct qmi_elem_info qmi_wlanfw_w
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_wlan_cfg_req_msg_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_wlan_cfg_req_msg_v01_ei[] = {
 	{
 		.data_type	= QMI_OPT_FLAG,
 		.elem_len	= 1,
@@ -1615,7 +1615,7 @@ static struct qmi_elem_info qmi_wlanfw_w
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_wlan_cfg_resp_msg_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_wlan_cfg_resp_msg_v01_ei[] = {
 	{
 		.data_type	= QMI_STRUCT,
 		.elem_len	= 1,
@@ -1632,28 +1632,28 @@ static struct qmi_elem_info qmi_wlanfw_w
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_mem_ready_ind_msg_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_mem_ready_ind_msg_v01_ei[] = {
 	{
 		.data_type = QMI_EOTI,
 		.array_type = NO_ARRAY,
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_fw_ready_ind_msg_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_fw_ready_ind_msg_v01_ei[] = {
 	{
 		.data_type = QMI_EOTI,
 		.array_type = NO_ARRAY,
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_cold_boot_cal_done_ind_msg_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_cold_boot_cal_done_ind_msg_v01_ei[] = {
 	{
 		.data_type = QMI_EOTI,
 		.array_type = NO_ARRAY,
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_wlan_ini_req_msg_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_wlan_ini_req_msg_v01_ei[] = {
 	{
 		.data_type	= QMI_OPT_FLAG,
 		.elem_len	= 1,
@@ -1679,7 +1679,7 @@ static struct qmi_elem_info qmi_wlanfw_w
 	},
 };
 -static struct qmi_elem_info qmi_wlanfw_wlan_ini_resp_msg_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlanfw_wlan_ini_resp_msg_v01_ei[] = {
 	{
 		.data_type	= QMI_STRUCT,
 		.elem_len	= 1,
@@ -1697,7 +1697,7 @@ static struct qmi_elem_info qmi_wlanfw_w
 	},
 };
 -static struct qmi_elem_info qmi_wlfw_fw_init_done_ind_msg_v01_ei[] = {
 +static const struct qmi_elem_info qmi_wlfw_fw_init_done_ind_msg_v01_ei[] = {
 	{
 		.data_type = QMI_EOTI,
 		.array_type = NO_ARRAY,
--- a/package/kernel/mac80211/patches/ath11k/0017-ath11k-clean-up-BDF-download-functions.patch
+++ b/package/kernel/mac80211/patches/ath11k/0017-ath11k-clean-up-BDF-download-functions.patch
@ -1,357 +0,0 @@
 From 336e7b53c82fc74d261024773a0fab43623a94fb Mon Sep 17 00:00:00 2001
 From: Anilkumar Kolli <akolli@codeaurora.org>
 Date: Tue, 28 Sep 2021 12:05:39 +0300
 Subject: [PATCH] ath11k: clean up BDF download functions
 In current code, AHB/PCI uses two separate functions to download
 BDF file. Refactor code and make a common function to send QMI BDF
 download request for both AHB and PCI devices. This patch has no
 functional change.
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-00009-QCAHKSWPL_SILICONZ-1
 Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01838-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210721201927.100369-3-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/qmi.c | 248 +++++++++++---------------
 1 file changed, 101 insertions(+), 147 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/qmi.c
 +++ b/drivers/net/wireless/ath/ath11k/qmi.c
@@ -1917,98 +1917,72 @@ out:
 	return ret;
 }
 -static int
 -ath11k_qmi_prepare_bdf_download(struct ath11k_base *ab, int type,
 -				struct qmi_wlanfw_bdf_download_req_msg_v01 *req,
 -				void __iomem *bdf_addr)
 -{
 -	const struct firmware *fw_entry;
 -	struct ath11k_board_data bd;
 -	u32 fw_size;
 -	int ret;
 -
 -	switch (type) {
 -	case ATH11K_QMI_FILE_TYPE_BDF_GOLDEN:
 -		memset(&bd, 0, sizeof(bd));
 -
 -		ret = ath11k_core_fetch_bdf(ab, &bd);
 -		if (ret) {
 -			ath11k_warn(ab, "failed to load board file: %d\n", ret);
 -			return ret;
 -		}
 -
 -		fw_size = min_t(u32, ab->hw_params.fw.board_size, bd.len);
 -		memcpy_toio(bdf_addr, bd.data, fw_size);
 -		ath11k_core_free_bdf(ab, &bd);
 -		break;
 -	case ATH11K_QMI_FILE_TYPE_CALDATA:
 -		fw_entry = ath11k_core_firmware_request(ab, ATH11K_DEFAULT_CAL_FILE);
 -		if (IS_ERR(fw_entry)) {
 -			ret = PTR_ERR(fw_entry);
 -			ath11k_warn(ab, "failed to load %s: %d\n",
 -				    ATH11K_DEFAULT_CAL_FILE, ret);
 -			return ret;
 -		}
 -
 -		fw_size = min_t(u32, ab->hw_params.fw.board_size,
 -				fw_entry->size);
 -
 -		memcpy_toio(bdf_addr + ab->hw_params.fw.cal_offset,
 -			    fw_entry->data, fw_size);
 -
 -		release_firmware(fw_entry);
 -		break;
 -	default:
 -		return -EINVAL;
 -	}
 -
 -	req->total_size = fw_size;
 -	return 0;
 -}
 -
 -static int ath11k_qmi_load_bdf_fixed_addr(struct ath11k_base *ab)
 +static int ath11k_qmi_load_file_target_mem(struct ath11k_base *ab,
 +					   const u8 *data, u32 len, u8 type)
 {
 	struct qmi_wlanfw_bdf_download_req_msg_v01 *req;
 	struct qmi_wlanfw_bdf_download_resp_msg_v01 resp;
 	struct qmi_txn txn = {};
 +	const u8 *temp = data;
 	void __iomem *bdf_addr = NULL;
 -	int type, ret;
 +	int ret;
 +	u32 remaining = len;
 	req = kzalloc(sizeof(*req), GFP_KERNEL);
 	if (!req)
 		return -ENOMEM;
 +
 	memset(&resp, 0, sizeof(resp));
 -	bdf_addr = ioremap(ab->hw_params.bdf_addr, ab->hw_params.fw.board_size);
 -	if (!bdf_addr) {
 -		ath11k_warn(ab, "failed ioremap for board file\n");
 -		ret = -EIO;
 -		goto out;
 +	if (ab->bus_params.fixed_bdf_addr) {
 +		bdf_addr = ioremap(ab->hw_params.bdf_addr, ab->hw_params.fw.board_size);
 +		if (!bdf_addr) {
 +			ath11k_warn(ab, "qmi ioremap error for bdf_addr\n");
 +			ret = -EIO;
 +			goto err_free_req;
 +		}
 	}
 -	for (type = 0; type < ATH11K_QMI_MAX_FILE_TYPE; type++) {
 +	while (remaining) {
 		req->valid = 1;
 		req->file_id_valid = 1;
 		req->file_id = ab->qmi.target.board_id;
 		req->total_size_valid = 1;
 +		req->total_size = remaining;
 		req->seg_id_valid = 1;
 -		req->seg_id = type;
 -		req->data_valid = 0;
 -		req->data_len = ATH11K_QMI_MAX_BDF_FILE_NAME_SIZE;
 -		req->bdf_type = 0;
 -		req->bdf_type_valid = 0;
 +		req->data_valid = 1;
 +		req->bdf_type = type;
 +		req->bdf_type_valid = 1;
 		req->end_valid = 1;
 -		req->end = 1;
 +		req->end = 0;
 -		ret = ath11k_qmi_prepare_bdf_download(ab, type, req, bdf_addr);
 -		if (ret < 0)
 -			goto out_qmi_bdf;
 +		if (remaining > QMI_WLANFW_MAX_DATA_SIZE_V01) {
 +			req->data_len = QMI_WLANFW_MAX_DATA_SIZE_V01;
 +		} else {
 +			req->data_len = remaining;
 +			req->end = 1;
 +		}
 +
 +		if (ab->bus_params.fixed_bdf_addr) {
 +			req->data_valid = 0;
 +			req->end = 1;
 +			req->data_len = ATH11K_QMI_MAX_BDF_FILE_NAME_SIZE;
 +		} else {
 +			memcpy(req->data, temp, req->data_len);
 +		}
 +
 +		if (ab->bus_params.fixed_bdf_addr) {
 +			if (type == ATH11K_QMI_FILE_TYPE_CALDATA)
 +				bdf_addr += ab->hw_params.fw.cal_offset;
 +
 +			memcpy_toio(bdf_addr, temp, len);
 +		}
 		ret = qmi_txn_init(&ab->qmi.handle, &txn,
 				   qmi_wlanfw_bdf_download_resp_msg_v01_ei,
 				   &resp);
 		if (ret < 0)
 -			goto out_qmi_bdf;
 +			goto err_iounmap;
 		ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi bdf download req fixed addr type %d\n",
 			   type);
@@ -2019,54 +1993,59 @@ static int ath11k_qmi_load_bdf_fixed_add
 				       qmi_wlanfw_bdf_download_req_msg_v01_ei, req);
 		if (ret < 0) {
 			qmi_txn_cancel(&txn);
 -			goto out_qmi_bdf;
 +			goto err_iounmap;
 		}
 		ret = qmi_txn_wait(&txn, msecs_to_jiffies(ATH11K_QMI_WLANFW_TIMEOUT_MS));
 -		if (ret < 0)
 -			goto out_qmi_bdf;
 +		if (ret < 0) {
 +			ath11k_warn(ab, "failed to wait board file download request: %d\n",
 +				    ret);
 +			goto err_iounmap;
 +		}
 		if (resp.resp.result != QMI_RESULT_SUCCESS_V01) {
 			ath11k_warn(ab, "board file download request failed: %d %d\n",
 				    resp.resp.result, resp.resp.error);
 			ret = -EINVAL;
 -			goto out_qmi_bdf;
 +			goto err_iounmap;
 +		}
 +
 +		if (ab->bus_params.fixed_bdf_addr) {
 +			remaining = 0;
 +		} else {
 +			remaining -= req->data_len;
 +			temp += req->data_len;
 +			req->seg_id++;
 +			ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi bdf download request remaining %i\n",
 +				   remaining);
 		}
 	}
 -out_qmi_bdf:
 -	iounmap(bdf_addr);
 -out:
 +err_iounmap:
 +	if (ab->bus_params.fixed_bdf_addr)
 +		iounmap(bdf_addr);
 +
 +err_free_req:
 	kfree(req);
 +
 	return ret;
 }
 static int ath11k_qmi_load_bdf_qmi(struct ath11k_base *ab)
 {
 -	struct qmi_wlanfw_bdf_download_req_msg_v01 *req;
 -	struct qmi_wlanfw_bdf_download_resp_msg_v01 resp;
 +	char filename[ATH11K_QMI_MAX_BDF_FILE_NAME_SIZE];
 +	const struct firmware *fw_entry;
 	struct ath11k_board_data bd;
 -	unsigned int remaining;
 -	struct qmi_txn txn = {};
 -	int ret;
 -	const u8 *temp;
 -	int bdf_type;
 -
 -	req = kzalloc(sizeof(*req), GFP_KERNEL);
 -	if (!req)
 -		return -ENOMEM;
 -	memset(&resp, 0, sizeof(resp));
 +	u32 fw_size, file_type;
 +	int ret = 0, bdf_type;
 	memset(&bd, 0, sizeof(bd));
 	ret = ath11k_core_fetch_bdf(ab, &bd);
 	if (ret) {
 -		ath11k_warn(ab, "failed to fetch board file: %d\n", ret);
 +		ath11k_warn(ab, "qmi failed to fetch board file: %d\n", ret);
 		goto out;
 	}
 -	temp = bd.data;
 -	remaining = bd.len;
 -
 	if (bd.len >= SELFMAG && memcmp(bd.data, ELFMAG, SELFMAG) == 0)
 		bdf_type = ATH11K_QMI_BDF_TYPE_ELF;
 	else
@@ -2074,67 +2053,45 @@ static int ath11k_qmi_load_bdf_qmi(struc
 	ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi bdf_type %d\n", bdf_type);
 -	while (remaining) {
 -		req->valid = 1;
 -		req->file_id_valid = 1;
 -		req->file_id = ab->qmi.target.board_id;
 -		req->total_size_valid = 1;
 -		req->total_size = bd.len;
 -		req->seg_id_valid = 1;
 -		req->data_valid = 1;
 -		req->data_len = ATH11K_QMI_MAX_BDF_FILE_NAME_SIZE;
 -		req->bdf_type = bdf_type;
 -		req->bdf_type_valid = 1;
 -		req->end_valid = 1;
 -		req->end = 0;
 -
 -		if (remaining > QMI_WLANFW_MAX_DATA_SIZE_V01) {
 -			req->data_len = QMI_WLANFW_MAX_DATA_SIZE_V01;
 -		} else {
 -			req->data_len = remaining;
 -			req->end = 1;
 -		}
 -
 -		memcpy(req->data, temp, req->data_len);
 -
 -		ret = qmi_txn_init(&ab->qmi.handle, &txn,
 -				   qmi_wlanfw_bdf_download_resp_msg_v01_ei,
 -				   &resp);
 -		if (ret < 0)
 -			goto out_qmi_bdf;
 +	fw_size = bd.len;
 +	fw_size = min_t(u32, ab->hw_params.fw.board_size, bd.len);
 -		ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi bdf download request remaining %i\n",
 -			   remaining);
 +	ret = ath11k_qmi_load_file_target_mem(ab, bd.data, fw_size, bdf_type);
 +	if (ret < 0) {
 +		ath11k_warn(ab, "qmi failed to load bdf file\n");
 +		goto out;
 +	}
 -		ret = qmi_send_request(&ab->qmi.handle, NULL, &txn,
 -				       QMI_WLANFW_BDF_DOWNLOAD_REQ_V01,
 -				       QMI_WLANFW_BDF_DOWNLOAD_REQ_MSG_V01_MAX_LEN,
 -				       qmi_wlanfw_bdf_download_req_msg_v01_ei, req);
 -		if (ret < 0) {
 -			qmi_txn_cancel(&txn);
 -			goto out_qmi_bdf;
 -		}
 +	/* QCA6390 does not support cal data file, skip it */
 +	if (bdf_type == ATH11K_QMI_BDF_TYPE_ELF)
 +		goto out;
 -		ret = qmi_txn_wait(&txn, msecs_to_jiffies(ATH11K_QMI_WLANFW_TIMEOUT_MS));
 -		if (ret < 0)
 -			goto out_qmi_bdf;
 +	file_type = ATH11K_QMI_FILE_TYPE_CALDATA;
 +	fw_entry = ath11k_core_firmware_request(ab, ATH11K_DEFAULT_CAL_FILE);
 +	if (IS_ERR(fw_entry)) {
 +		ret = PTR_ERR(fw_entry);
 +		ath11k_warn(ab,
 +			    "qmi failed to load CAL data file:%s\n",
 +			    filename);
 +		goto out;
 +	}
 -		if (resp.resp.result != QMI_RESULT_SUCCESS_V01) {
 -			ath11k_warn(ab, "bdf download request failed: %d %d\n",
 -				    resp.resp.result, resp.resp.error);
 -			ret = resp.resp.result;
 -			goto out_qmi_bdf;
 -		}
 -		remaining -= req->data_len;
 -		temp += req->data_len;
 -		req->seg_id++;
 +	fw_size = min_t(u32, ab->hw_params.fw.board_size, fw_entry->size);
 +	ret = ath11k_qmi_load_file_target_mem(ab, fw_entry->data, fw_size, file_type);
 +	if (ret < 0) {
 +		ath11k_warn(ab, "qmi failed to load caldata\n");
 +		goto out_qmi_cal;
 	}
 -out_qmi_bdf:
 -	ath11k_core_free_bdf(ab, &bd);
 +	ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi caldata downloaded: type: %u\n",
 +		   file_type);
 +out_qmi_cal:
 +	release_firmware(fw_entry);
 out:
 -	kfree(req);
 +	ath11k_core_free_bdf(ab, &bd);
 +	ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi BDF download sequence completed\n");
 +
 	return ret;
 }
@@ -2519,10 +2476,7 @@ static int ath11k_qmi_event_load_bdf(str
 		return ret;
 	}
 -	if (ab->bus_params.fixed_bdf_addr)
 -		ret = ath11k_qmi_load_bdf_fixed_addr(ab);
 -	else
 -		ret = ath11k_qmi_load_bdf_qmi(ab);
 +	ret = ath11k_qmi_load_bdf_qmi(ab);
 	if (ret < 0) {
 		ath11k_warn(ab, "failed to load board data file: %d\n", ret);
 		return ret;
--- a/package/kernel/mac80211/patches/ath11k/0017-wifi-ath11k-Trigger-sta-disconnect-on-hardware-resta.patch
+++ b/package/kernel/mac80211/patches/ath11k/0017-wifi-ath11k-Trigger-sta-disconnect-on-hardware-resta.patch
@ -0,0 +1,119 @@
 From a018750a2cceaf4427c4ee3d9ce3e83a171d5bd6 Mon Sep 17 00:00:00 2001
 From: Youghandhar Chintala <quic_youghand@quicinc.com>
 Date: Fri, 4 Nov 2022 14:24:03 +0530
 Subject: [PATCH] wifi: ath11k: Trigger sta disconnect on hardware restart
 Currently after the hardware restart triggered from the driver, the
 station interface connection remains intact, since a disconnect trigger
 is not sent to userspace. This can lead to a problem in targets where
 the wifi mac sequence is added by the firmware.
 After the target restart, its wifi mac sequence number gets reset to
 zero. Hence AP to which our device is connected will receive frames with
 a  wifi mac sequence number jump to the past, thereby resulting in the
 AP dropping all these frames, until the frame arrives with a wifi mac
 sequence number which AP was expecting.
 To avoid such frame drops, its better to trigger a station disconnect
 upon target hardware restart which can be done with API
 ieee80211_reconfig_disconnect exposed to mac80211.
 The other targets are not affected by this change, since the hardware
 params flag is not set.
 Reported-by: kernel test robot <lkp@intel.com>
 Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.1.0.1-00887-QCAMSLSWPLZ-1
 Signed-off-by: Youghandhar Chintala <quic_youghand@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20221104085403.11025-1-quic_youghand@quicinc.com
 ---
 drivers/net/wireless/ath/ath11k/core.c | 6 ++++++
 drivers/net/wireless/ath/ath11k/hw.h   | 1 +
 drivers/net/wireless/ath/ath11k/mac.c  | 7 +++++++
 3 files changed, 14 insertions(+)
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
@@ -195,6 +195,7 @@ static const struct ath11k_hw_params ath
 		.tcl_ring_retry = true,
 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
 		.smp2p_wow_exit = false,
 +		.support_fw_mac_sequence = false,
 	},
 	{
 		.name = "qca6390 hw2.0",
@@ -277,6 +278,7 @@ static const struct ath11k_hw_params ath
 		.tcl_ring_retry = true,
 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
 		.smp2p_wow_exit = false,
 +		.support_fw_mac_sequence = true,
 	},
 	{
 		.name = "qcn9074 hw1.0",
@@ -356,6 +358,7 @@ static const struct ath11k_hw_params ath
 		.tcl_ring_retry = true,
 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
 		.smp2p_wow_exit = false,
 +		.support_fw_mac_sequence = false,
 	},
 	{
 		.name = "wcn6855 hw2.0",
@@ -438,6 +441,7 @@ static const struct ath11k_hw_params ath
 		.tcl_ring_retry = true,
 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
 		.smp2p_wow_exit = false,
 +		.support_fw_mac_sequence = true,
 	},
 	{
 		.name = "wcn6855 hw2.1",
@@ -519,6 +523,7 @@ static const struct ath11k_hw_params ath
 		.tcl_ring_retry = true,
 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
 		.smp2p_wow_exit = false,
 +		.support_fw_mac_sequence = true,
 	},
 	{
 		.name = "wcn6750 hw1.0",
@@ -597,6 +602,7 @@ static const struct ath11k_hw_params ath
 		.tcl_ring_retry = false,
 		.tx_ring_size = DP_TCL_DATA_RING_SIZE_WCN6750,
 		.smp2p_wow_exit = true,
 +		.support_fw_mac_sequence = true,
 	},
 };
 --- a/drivers/net/wireless/ath/ath11k/hw.h
 +++ b/drivers/net/wireless/ath/ath11k/hw.h
@@ -219,6 +219,7 @@ struct ath11k_hw_params {
 	bool tcl_ring_retry;
 	u32 tx_ring_size;
 	bool smp2p_wow_exit;
 +	bool support_fw_mac_sequence;
 };
 struct ath11k_hw_ops {
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -8010,6 +8010,7 @@ ath11k_mac_op_reconfig_complete(struct i
 	struct ath11k *ar = hw->priv;
 	struct ath11k_base *ab = ar->ab;
 	int recovery_count;
 +	struct ath11k_vif *arvif;
 	if (reconfig_type != IEEE80211_RECONFIG_TYPE_RESTART)
 		return;
@@ -8045,6 +8046,12 @@ ath11k_mac_op_reconfig_complete(struct i
 				ath11k_dbg(ab, ATH11K_DBG_BOOT, "reset success\n");
 			}
 		}
 +		if (ar->ab->hw_params.support_fw_mac_sequence) {
 +			list_for_each_entry(arvif, &ar->arvifs, list) {
 +				if (arvif->is_up && arvif->vdev_type == WMI_VDEV_TYPE_STA)
 +					ieee80211_hw_restart_disconnect(arvif->vif);
 +			}
 +		}
 	}
 	mutex_unlock(&ar->conf_mutex);
--- a/package/kernel/mac80211/patches/ath11k/0018-ath11k-add-caldata-file-for-multiple-radios.patch
+++ b/package/kernel/mac80211/patches/ath11k/0018-ath11k-add-caldata-file-for-multiple-radios.patch
@ -1,68 +0,0 @@
 From e82dfe7b5608592c270cc69100cb4322069f949d Mon Sep 17 00:00:00 2001
 From: Anilkumar Kolli <akolli@codeaurora.org>
 Date: Tue, 28 Sep 2021 12:05:39 +0300
 Subject: [PATCH] ath11k: add caldata file for multiple radios
 If multiple PCI cards are attached, each needs its own caldata file.
 Added new Caldata file name,
 PCI Bus:
        cal-pci-0001:01:00.0.bin
        cal-pci-0000:01:00.0.bin
 AHB Bus:
 	cal-ahb-c000000.wifi1.bin
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-00009-QCAHKSWPL_SILICONZ-1
 Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01838-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210721201927.100369-4-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/qmi.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/qmi.c
 +++ b/drivers/net/wireless/ath/ath11k/qmi.c
@@ -2033,6 +2033,7 @@ err_free_req:
 static int ath11k_qmi_load_bdf_qmi(struct ath11k_base *ab)
 {
 +	struct device *dev = ab->dev;
 	char filename[ATH11K_QMI_MAX_BDF_FILE_NAME_SIZE];
 	const struct firmware *fw_entry;
 	struct ath11k_board_data bd;
@@ -2067,6 +2068,14 @@ static int ath11k_qmi_load_bdf_qmi(struc
 		goto out;
 	file_type = ATH11K_QMI_FILE_TYPE_CALDATA;
 +
 +	/* cal-<bus>-<id>.bin */
 +	snprintf(filename, sizeof(filename), "cal-%s-%s.bin",
 +		 ath11k_bus_str(ab->hif.bus), dev_name(dev));
 +	fw_entry = ath11k_core_firmware_request(ab, filename);
 +	if (!IS_ERR(fw_entry))
 +		goto success;
 +
 	fw_entry = ath11k_core_firmware_request(ab, ATH11K_DEFAULT_CAL_FILE);
 	if (IS_ERR(fw_entry)) {
 		ret = PTR_ERR(fw_entry);
@@ -2076,6 +2085,7 @@ static int ath11k_qmi_load_bdf_qmi(struc
 		goto out;
 	}
 +success:
 	fw_size = min_t(u32, ab->hw_params.fw.board_size, fw_entry->size);
 	ret = ath11k_qmi_load_file_target_mem(ab, fw_entry->data, fw_size, file_type);
 	if (ret < 0) {
@@ -2083,8 +2093,7 @@ static int ath11k_qmi_load_bdf_qmi(struc
 		goto out_qmi_cal;
 	}
 -	ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi caldata downloaded: type: %u\n",
 -		   file_type);
 +	ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi caldata type: %u\n", file_type);
 out_qmi_cal:
 	release_firmware(fw_entry);
--- a/package/kernel/mac80211/patches/ath11k/0018-wifi-ath11k-Fix-race-condition-with-struct-htt_ppdu_.patch
+++ b/package/kernel/mac80211/patches/ath11k/0018-wifi-ath11k-Fix-race-condition-with-struct-htt_ppdu_.patch
@ -0,0 +1,103 @@
 From e44de90453bb2b46a523df78c39eb896bab35dcd Mon Sep 17 00:00:00 2001
 From: Govindaraj Saminathan <quic_gsaminat@quicinc.com>
 Date: Tue, 29 Nov 2022 13:04:02 +0200
 Subject: [PATCH] wifi: ath11k: Fix race condition with struct
 htt_ppdu_stats_info
 A crash happens when running the traffic with multiple clients:
 Crash Signature : Unable to handle kernel paging request at
 virtual address ffffffd700970918 During the crash, PC points to
 "ieee80211_tx_rate_update+0x30/0x68 [mac80211]"
 LR points to "ath11k_dp_htt_htc_t2h_msg_handler+0x5a8/0x8a0 [ath11k]".
 Struct ppdu_stats_info is allocated and accessed from event callback via copy
 engine tasklet, this has a problem when freeing it from ath11k_mac_op_stop().
 Use data_lock during entire ath11k_dp_htt_get_ppdu_desc() call to protect
 struct htt_ppdu_stats_info access and to avoid race condition when accessing it
 from ath11k_mac_op_stop().
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Govindaraj Saminathan <quic_gsaminat@quicinc.com>
 Co-developed-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
 Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20221124071104.22506-1-quic_kathirve@quicinc.com
 ---
 drivers/net/wireless/ath/ath11k/dp_rx.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
@@ -1535,13 +1535,12 @@ struct htt_ppdu_stats_info *ath11k_dp_ht
 {
 	struct htt_ppdu_stats_info *ppdu_info;
 -	spin_lock_bh(&ar->data_lock);
 +	lockdep_assert_held(&ar->data_lock);
 +
 	if (!list_empty(&ar->ppdu_stats_info)) {
 		list_for_each_entry(ppdu_info, &ar->ppdu_stats_info, list) {
 -			if (ppdu_info->ppdu_id == ppdu_id) {
 -				spin_unlock_bh(&ar->data_lock);
 +			if (ppdu_info->ppdu_id == ppdu_id)
 				return ppdu_info;
 -			}
 		}
 		if (ar->ppdu_stat_list_depth > HTT_PPDU_DESC_MAX_DEPTH) {
@@ -1553,16 +1552,13 @@ struct htt_ppdu_stats_info *ath11k_dp_ht
 			kfree(ppdu_info);
 		}
 	}
 -	spin_unlock_bh(&ar->data_lock);
 	ppdu_info = kzalloc(sizeof(*ppdu_info), GFP_ATOMIC);
 	if (!ppdu_info)
 		return NULL;
 -	spin_lock_bh(&ar->data_lock);
 	list_add_tail(&ppdu_info->list, &ar->ppdu_stats_info);
 	ar->ppdu_stat_list_depth++;
 -	spin_unlock_bh(&ar->data_lock);
 	return ppdu_info;
 }
@@ -1586,16 +1582,17 @@ static int ath11k_htt_pull_ppdu_stats(st
 	ar = ath11k_mac_get_ar_by_pdev_id(ab, pdev_id);
 	if (!ar) {
 		ret = -EINVAL;
 -		goto exit;
 +		goto out;
 	}
 	if (ath11k_debugfs_is_pktlog_lite_mode_enabled(ar))
 		trace_ath11k_htt_ppdu_stats(ar, skb->data, len);
 +	spin_lock_bh(&ar->data_lock);
 	ppdu_info = ath11k_dp_htt_get_ppdu_desc(ar, ppdu_id);
 	if (!ppdu_info) {
 		ret = -EINVAL;
 -		goto exit;
 +		goto out_unlock_data;
 	}
 	ppdu_info->ppdu_id = ppdu_id;
@@ -1604,10 +1601,13 @@ static int ath11k_htt_pull_ppdu_stats(st
 				     (void *)ppdu_info);
 	if (ret) {
 		ath11k_warn(ab, "Failed to parse tlv %d\n", ret);
 -		goto exit;
 +		goto out_unlock_data;
 	}
 -exit:
 +out_unlock_data:
 +	spin_unlock_bh(&ar->data_lock);
 +
 +out:
 	rcu_read_unlock();
 	return ret;
--- a/package/kernel/mac80211/patches/ath11k/0019-ath11k-add-caldata-download-support-from-EEPROM.patch
+++ b/package/kernel/mac80211/patches/ath11k/0019-ath11k-add-caldata-download-support-from-EEPROM.patch
@ -1,282 +0,0 @@
 From 4ba3b05ebd0c3e98c7dd8c7ee03aed9d80299b79 Mon Sep 17 00:00:00 2001
 From: Anilkumar Kolli <akolli@codeaurora.org>
 Date: Tue, 28 Sep 2021 12:05:39 +0300
 Subject: [PATCH] ath11k: add caldata download support from EEPROM
 Firmware updates EEPROM support capability in QMI FW caps, send QMI BDF
 download request message with file type EEPROM, to get caldata download
 from EEPROM. Firmware takes more time to update cal data from EEPROM, so
 increase QMI timeout.
 Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01838-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210721201927.100369-5-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/qmi.c | 139 +++++++++++++++++++++-----
 drivers/net/wireless/ath/ath11k/qmi.h |  16 ++-
 2 files changed, 127 insertions(+), 28 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/qmi.c
 +++ b/drivers/net/wireless/ath/ath11k/qmi.c
@@ -951,6 +951,78 @@ static struct qmi_elem_info qmi_wlanfw_c
 					   num_macs),
 	},
 	{
 +		.data_type      = QMI_OPT_FLAG,
 +		.elem_len       = 1,
 +		.elem_size      = sizeof(u8),
 +		.array_type     = NO_ARRAY,
 +		.tlv_type       = 0x16,
 +		.offset         = offsetof(struct qmi_wlanfw_cap_resp_msg_v01,
 +					   voltage_mv_valid),
 +	},
 +	{
 +		.data_type      = QMI_UNSIGNED_4_BYTE,
 +		.elem_len       = 1,
 +		.elem_size      = sizeof(u32),
 +		.array_type     = NO_ARRAY,
 +		.tlv_type       = 0x16,
 +		.offset         = offsetof(struct qmi_wlanfw_cap_resp_msg_v01,
 +					   voltage_mv),
 +	},
 +	{
 +		.data_type      = QMI_OPT_FLAG,
 +		.elem_len       = 1,
 +		.elem_size      = sizeof(u8),
 +		.array_type     = NO_ARRAY,
 +		.tlv_type       = 0x17,
 +		.offset         = offsetof(struct qmi_wlanfw_cap_resp_msg_v01,
 +					   time_freq_hz_valid),
 +	},
 +	{
 +		.data_type      = QMI_UNSIGNED_4_BYTE,
 +		.elem_len       = 1,
 +		.elem_size      = sizeof(u32),
 +		.array_type     = NO_ARRAY,
 +		.tlv_type       = 0x17,
 +		.offset         = offsetof(struct qmi_wlanfw_cap_resp_msg_v01,
 +					   time_freq_hz),
 +	},
 +	{
 +		.data_type      = QMI_OPT_FLAG,
 +		.elem_len       = 1,
 +		.elem_size      = sizeof(u8),
 +		.array_type     = NO_ARRAY,
 +		.tlv_type       = 0x18,
 +		.offset         = offsetof(struct qmi_wlanfw_cap_resp_msg_v01,
 +					   otp_version_valid),
 +	},
 +	{
 +		.data_type      = QMI_UNSIGNED_4_BYTE,
 +		.elem_len       = 1,
 +		.elem_size      = sizeof(u32),
 +		.array_type     = NO_ARRAY,
 +		.tlv_type       = 0x18,
 +		.offset         = offsetof(struct qmi_wlanfw_cap_resp_msg_v01,
 +					   otp_version),
 +	},
 +	{
 +		.data_type      = QMI_OPT_FLAG,
 +		.elem_len       = 1,
 +		.elem_size      = sizeof(u8),
 +		.array_type     = NO_ARRAY,
 +		.tlv_type       = 0x19,
 +		.offset         = offsetof(struct qmi_wlanfw_cap_resp_msg_v01,
 +					   eeprom_read_timeout_valid),
 +	},
 +	{
 +		.data_type      = QMI_UNSIGNED_4_BYTE,
 +		.elem_len       = 1,
 +		.elem_size      = sizeof(u32),
 +		.array_type     = NO_ARRAY,
 +		.tlv_type       = 0x19,
 +		.offset         = offsetof(struct qmi_wlanfw_cap_resp_msg_v01,
 +					   eeprom_read_timeout),
 +	},
 +	{
 		.data_type	= QMI_EOTI,
 		.array_type	= NO_ARRAY,
 		.tlv_type	= QMI_COMMON_TLV_TYPE,
@@ -1846,8 +1918,8 @@ static int ath11k_qmi_request_target_cap
 	memset(&req, 0, sizeof(req));
 	memset(&resp, 0, sizeof(resp));
 -	ret = qmi_txn_init(&ab->qmi.handle, &txn,
 -			   qmi_wlanfw_cap_resp_msg_v01_ei, &resp);
 +	ret = qmi_txn_init(&ab->qmi.handle, &txn, qmi_wlanfw_cap_resp_msg_v01_ei,
 +			   &resp);
 	if (ret < 0)
 		goto out;
@@ -1900,6 +1972,12 @@ static int ath11k_qmi_request_target_cap
 		strlcpy(ab->qmi.target.fw_build_id, resp.fw_build_id,
 			sizeof(ab->qmi.target.fw_build_id));
 +	if (resp.eeprom_read_timeout_valid) {
 +		ab->qmi.target.eeprom_caldata =
 +					resp.eeprom_read_timeout;
 +		ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi cal data supported from eeprom\n");
 +	}
 +
 	ath11k_info(ab, "chip_id 0x%x chip_family 0x%x board_id 0x%x soc_id 0x%x\n",
 		    ab->qmi.target.chip_id, ab->qmi.target.chip_family,
 		    ab->qmi.target.board_id, ab->qmi.target.soc_id);
@@ -1963,7 +2041,8 @@ static int ath11k_qmi_load_file_target_m
 			req->end = 1;
 		}
 -		if (ab->bus_params.fixed_bdf_addr) {
 +		if (ab->bus_params.fixed_bdf_addr ||
 +		    type == ATH11K_QMI_FILE_TYPE_EEPROM) {
 			req->data_valid = 0;
 			req->end = 1;
 			req->data_len = ATH11K_QMI_MAX_BDF_FILE_NAME_SIZE;
@@ -2010,7 +2089,8 @@ static int ath11k_qmi_load_file_target_m
 			goto err_iounmap;
 		}
 -		if (ab->bus_params.fixed_bdf_addr) {
 +		if (ab->bus_params.fixed_bdf_addr ||
 +		    type == ATH11K_QMI_FILE_TYPE_EEPROM) {
 			remaining = 0;
 		} else {
 			remaining -= req->data_len;
@@ -2039,6 +2119,7 @@ static int ath11k_qmi_load_bdf_qmi(struc
 	struct ath11k_board_data bd;
 	u32 fw_size, file_type;
 	int ret = 0, bdf_type;
 +	const u8 *tmp;
 	memset(&bd, 0, sizeof(bd));
 	ret = ath11k_core_fetch_bdf(ab, &bd);
@@ -2063,31 +2144,38 @@ static int ath11k_qmi_load_bdf_qmi(struc
 		goto out;
 	}
 -	/* QCA6390 does not support cal data file, skip it */
 +	/* QCA6390 does not support cal data, skip it */
 	if (bdf_type == ATH11K_QMI_BDF_TYPE_ELF)
 		goto out;
 -	file_type = ATH11K_QMI_FILE_TYPE_CALDATA;
 +	if (ab->qmi.target.eeprom_caldata) {
 +		file_type = ATH11K_QMI_FILE_TYPE_EEPROM;
 +		tmp = filename;
 +		fw_size = ATH11K_QMI_MAX_BDF_FILE_NAME_SIZE;
 +	} else {
 +		file_type = ATH11K_QMI_FILE_TYPE_CALDATA;
 -	/* cal-<bus>-<id>.bin */
 -	snprintf(filename, sizeof(filename), "cal-%s-%s.bin",
 -		 ath11k_bus_str(ab->hif.bus), dev_name(dev));
 -	fw_entry = ath11k_core_firmware_request(ab, filename);
 -	if (!IS_ERR(fw_entry))
 -		goto success;
 -
 -	fw_entry = ath11k_core_firmware_request(ab, ATH11K_DEFAULT_CAL_FILE);
 -	if (IS_ERR(fw_entry)) {
 -		ret = PTR_ERR(fw_entry);
 -		ath11k_warn(ab,
 -			    "qmi failed to load CAL data file:%s\n",
 -			    filename);
 -		goto out;
 +		/* cal-<bus>-<id>.bin */
 +		snprintf(filename, sizeof(filename), "cal-%s-%s.bin",
 +			 ath11k_bus_str(ab->hif.bus), dev_name(dev));
 +		fw_entry = ath11k_core_firmware_request(ab, filename);
 +		if (!IS_ERR(fw_entry))
 +			goto success;
 +
 +		fw_entry = ath11k_core_firmware_request(ab, ATH11K_DEFAULT_CAL_FILE);
 +		if (IS_ERR(fw_entry)) {
 +			ret = PTR_ERR(fw_entry);
 +			ath11k_warn(ab,
 +				    "qmi failed to load CAL data file:%s\n",
 +				    filename);
 +			goto out;
 +		}
 +success:
 +		fw_size = min_t(u32, ab->hw_params.fw.board_size, fw_entry->size);
 +		tmp = fw_entry->data;
 	}
 -success:
 -	fw_size = min_t(u32, ab->hw_params.fw.board_size, fw_entry->size);
 -	ret = ath11k_qmi_load_file_target_mem(ab, fw_entry->data, fw_size, file_type);
 +	ret = ath11k_qmi_load_file_target_mem(ab, tmp, fw_size, file_type);
 	if (ret < 0) {
 		ath11k_warn(ab, "qmi failed to load caldata\n");
 		goto out_qmi_cal;
@@ -2096,7 +2184,8 @@ success:
 	ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi caldata type: %u\n", file_type);
 out_qmi_cal:
 -	release_firmware(fw_entry);
 +	if (!ab->qmi.target.eeprom_caldata)
 +		release_firmware(fw_entry);
 out:
 	ath11k_core_free_bdf(ab, &bd);
 	ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi BDF download sequence completed\n");
 --- a/drivers/net/wireless/ath/ath11k/qmi.h
 +++ b/drivers/net/wireless/ath/ath11k/qmi.h
@@ -10,7 +10,7 @@
 #include <linux/soc/qcom/qmi.h>
 #define ATH11K_HOST_VERSION_STRING		"WIN"
 -#define ATH11K_QMI_WLANFW_TIMEOUT_MS		5000
 +#define ATH11K_QMI_WLANFW_TIMEOUT_MS		10000
 #define ATH11K_QMI_MAX_BDF_FILE_NAME_SIZE	64
 #define ATH11K_QMI_CALDB_ADDRESS		0x4BA00000
 #define ATH11K_QMI_WLANFW_MAX_BUILD_ID_LEN_V01	128
@@ -42,6 +42,7 @@ struct ath11k_base;
 enum ath11k_qmi_file_type {
 	ATH11K_QMI_FILE_TYPE_BDF_GOLDEN,
 	ATH11K_QMI_FILE_TYPE_CALDATA,
 +	ATH11K_QMI_FILE_TYPE_EEPROM,
 	ATH11K_QMI_MAX_FILE_TYPE,
 };
@@ -102,6 +103,7 @@ struct target_info {
 	u32 board_id;
 	u32 soc_id;
 	u32 fw_version;
 +	u32 eeprom_caldata;
 	char fw_build_timestamp[ATH11K_QMI_WLANFW_MAX_TIMESTAMP_LEN_V01 + 1];
 	char fw_build_id[ATH11K_QMI_WLANFW_MAX_BUILD_ID_LEN_V01 + 1];
 	char bdf_ext[ATH11K_QMI_BDF_EXT_STR_LENGTH];
@@ -133,7 +135,7 @@ struct ath11k_qmi {
 	wait_queue_head_t cold_boot_waitq;
 };
 -#define QMI_WLANFW_HOST_CAP_REQ_MSG_V01_MAX_LEN		189
 +#define QMI_WLANFW_HOST_CAP_REQ_MSG_V01_MAX_LEN		261
 #define QMI_WLANFW_HOST_CAP_REQ_V01			0x0034
 #define QMI_WLANFW_HOST_CAP_RESP_MSG_V01_MAX_LEN	7
 #define QMI_WLFW_HOST_CAP_RESP_V01			0x0034
@@ -283,7 +285,7 @@ struct qmi_wlanfw_fw_cold_cal_done_ind_m
 };
 #define QMI_WLANFW_CAP_REQ_MSG_V01_MAX_LEN	0
 -#define QMI_WLANFW_CAP_RESP_MSG_V01_MAX_LEN	207
 +#define QMI_WLANFW_CAP_RESP_MSG_V01_MAX_LEN	235
 #define QMI_WLANFW_CAP_REQ_V01			0x0024
 #define QMI_WLANFW_CAP_RESP_V01			0x0024
@@ -364,6 +366,14 @@ struct qmi_wlanfw_cap_resp_msg_v01 {
 	char fw_build_id[ATH11K_QMI_WLANFW_MAX_BUILD_ID_LEN_V01 + 1];
 	u8 num_macs_valid;
 	u8 num_macs;
 +	u8 voltage_mv_valid;
 +	u32 voltage_mv;
 +	u8 time_freq_hz_valid;
 +	u32 time_freq_hz;
 +	u8 otp_version_valid;
 +	u32 otp_version;
 +	u8 eeprom_read_timeout_valid;
 +	u32 eeprom_read_timeout;
 };
 struct qmi_wlanfw_cap_req_msg_v01 {
--- a/package/kernel/mac80211/patches/ath11k/0019-wifi-ath11k-update-hw-params-for-IPQ5018.patch
+++ b/package/kernel/mac80211/patches/ath11k/0019-wifi-ath11k-update-hw-params-for-IPQ5018.patch
@ -0,0 +1,125 @@
 From 8dfe875aa24aec68baf6702018633c84c2c1feca Mon Sep 17 00:00:00 2001
 From: Sriram R <quic_srirrama@quicinc.com>
 Date: Fri, 2 Dec 2022 23:37:13 +0200
 Subject: [PATCH] wifi: ath11k: update hw params for IPQ5018
 Add new compatible string for IPQ5018 and add
 required hw params for IPQ5018. The hw descriptors size and
 datapath ops are similar to QCN9074, hence reuse the same.
 Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
 Co-developed-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
 Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20221122132152.17771-3-quic_kathirve@quicinc.com
 ---
 drivers/net/wireless/ath/ath11k/core.c | 71 ++++++++++++++++++++++++++
 drivers/net/wireless/ath/ath11k/core.h |  8 +++
 2 files changed, 79 insertions(+)
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
@@ -604,6 +604,77 @@ static const struct ath11k_hw_params ath
 		.smp2p_wow_exit = true,
 		.support_fw_mac_sequence = true,
 	},
 +	{
 +		.hw_rev = ATH11K_HW_IPQ5018_HW10,
 +		.name = "ipq5018 hw1.0",
 +		.fw = {
 +			.dir = "IPQ5018/hw1.0",
 +			.board_size = 256 * 1024,
 +			.cal_offset = 128 * 1024,
 +		},
 +		.max_radios = MAX_RADIOS_5018,
 +		.bdf_addr = 0x4BA00000,
 +		/* hal_desc_sz and hw ops are similar to qcn9074 */
 +		.hal_desc_sz = sizeof(struct hal_rx_desc_qcn9074),
 +		.qmi_service_ins_id = ATH11K_QMI_WLFW_SERVICE_INS_ID_V01_IPQ8074,
 +		.ring_mask = &ath11k_hw_ring_mask_ipq8074,
 +		.credit_flow = false,
 +		.max_tx_ring = 1,
 +		.spectral = {
 +			.fft_sz = 2,
 +			.fft_pad_sz = 0,
 +			.summary_pad_sz = 16,
 +			.fft_hdr_len = 24,
 +			.max_fft_bins = 1024,
 +		},
 +		.internal_sleep_clock = false,
 +		.host_ce_config = ath11k_host_ce_config_qcn9074,
 +		.ce_count = CE_CNT_5018,
 +		.rxdma1_enable = true,
 +		.num_rxmda_per_pdev = RXDMA_PER_PDEV_5018,
 +		.rx_mac_buf_ring = false,
 +		.vdev_start_delay = false,
 +		.htt_peer_map_v2 = true,
 +		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
 +			BIT(NL80211_IFTYPE_AP) |
 +			BIT(NL80211_IFTYPE_MESH_POINT),
 +		.supports_monitor = false,
 +		.supports_sta_ps = false,
 +		.supports_shadow_regs = false,
 +		.fw_mem_mode = 0,
 +		.num_vdevs = 16 + 1,
 +		.num_peers = 512,
 +		.supports_regdb = false,
 +		.idle_ps = false,
 +		.supports_suspend = false,
 +		.hal_params = &ath11k_hw_hal_params_ipq8074,
 +		.single_pdev_only = false,
 +		.cold_boot_calib = true,
 +		.fix_l1ss = true,
 +		.supports_dynamic_smps_6ghz = false,
 +		.alloc_cacheable_memory = true,
 +		.supports_rssi_stats = false,
 +		.fw_wmi_diag_event = false,
 +		.current_cc_support = false,
 +		.dbr_debug_support = true,
 +		.global_reset = false,
 +		.bios_sar_capa = NULL,
 +		.m3_fw_support = false,
 +		.fixed_bdf_addr = true,
 +		.fixed_mem_region = true,
 +		.static_window_map = false,
 +		.hybrid_bus_type = false,
 +		.fixed_fw_mem = false,
 +		.support_off_channel_tx = false,
 +		.supports_multi_bssid = false,
 +
 +		.sram_dump = {},
 +
 +		.tcl_ring_retry = true,
 +		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
 +		.smp2p_wow_exit = false,
 +		.support_fw_mac_sequence = false,
 +	},
 };
 static inline struct ath11k_pdev *ath11k_core_get_single_pdev(struct ath11k_base *ab)
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
@@ -142,6 +142,7 @@ enum ath11k_hw_rev {
 	ATH11K_HW_WCN6855_HW20,
 	ATH11K_HW_WCN6855_HW21,
 	ATH11K_HW_WCN6750_HW10,
 +	ATH11K_HW_IPQ5018_HW10,
 };
 enum ath11k_firmware_mode {
@@ -230,6 +231,13 @@ struct ath11k_he {
 #define MAX_RADIOS 3
 +/* ipq5018 hw param macros */
 +#define MAX_RADIOS_5018	1
 +#define CE_CNT_5018	6
 +#define TARGET_CE_CNT_5018	9
 +#define SVC_CE_MAP_LEN_5018	17
 +#define RXDMA_PER_PDEV_5018	1
 +
 enum {
 	WMI_HOST_TP_SCALE_MAX   = 0,
 	WMI_HOST_TP_SCALE_50    = 1,
--- a/package/kernel/mac80211/patches/ath11k/0020-ath11k-Replace-one-element-array-with-flexible-array.patch
+++ b/package/kernel/mac80211/patches/ath11k/0020-ath11k-Replace-one-element-array-with-flexible-array.patch
@ -1,144 +0,0 @@
 From b2549465cdeac3847487ce88b15ca47c37b60b88 Mon Sep 17 00:00:00 2001
 From: "Gustavo A. R. Silva" <gustavoars@kernel.org>
 Date: Tue, 28 Sep 2021 12:05:44 +0300
 Subject: [PATCH] ath11k: Replace one-element array with flexible-array member
 There is a regular need in the kernel to provide a way to declare having a
 dynamically sized set of trailing elements in a structure. Kernel code
 should always use "flexible array members"[1] for these cases. The older
 style of one-element or zero-length arrays should no longer be used[2].
 Refactor the code a bit according to the use of a flexible-array member in
 struct scan_chan_list_params instead of a one-element array, and use the
 struct_size() helper.
 Also, save 25 (too many) bytes that were being allocated:
 $ pahole -C channel_param drivers/net/wireless/ath/ath11k/reg.o
 struct channel_param {
 	u8                         chan_id;              /*     0     1 */
 	u8                         pwr;                  /*     1     1 */
 	u32                        mhz;                  /*     2     4 */
 	/* Bitfield combined with next fields */
 	u32                        half_rate:1;          /*     4:16  4 */
 	u32                        quarter_rate:1;       /*     4:17  4 */
 	u32                        dfs_set:1;            /*     4:18  4 */
 	u32                        dfs_set_cfreq2:1;     /*     4:19  4 */
 	u32                        is_chan_passive:1;    /*     4:20  4 */
 	u32                        allow_ht:1;           /*     4:21  4 */
 	u32                        allow_vht:1;          /*     4:22  4 */
 	u32                        allow_he:1;           /*     4:23  4 */
 	u32                        set_agile:1;          /*     4:24  4 */
 	u32                        psc_channel:1;        /*     4:25  4 */
 	/* XXX 6 bits hole, try to pack */
 	u32                        phy_mode;             /*     8     4 */
 	u32                        cfreq1;               /*    12     4 */
 	u32                        cfreq2;               /*    16     4 */
 	char                       maxpower;             /*    20     1 */
 	char                       minpower;             /*    21     1 */
 	char                       maxregpower;          /*    22     1 */
 	u8                         antennamax;           /*    23     1 */
 	u8                         reg_class_id;         /*    24     1 */
 	/* size: 25, cachelines: 1, members: 21 */
 	/* sum members: 23 */
 	/* sum bitfield members: 10 bits, bit holes: 1, sum bit holes: 6 bits */
 	/* last cacheline: 25 bytes */
 } __attribute__((__packed__));
 as previously, sizeof(struct scan_chan_list_params) was 32 bytes:
 $ pahole -C scan_chan_list_params drivers/net/wireless/ath/ath11k/reg.o
 struct scan_chan_list_params {
 	u32                        pdev_id;              /*     0     4 */
 	u16                        nallchans;            /*     4     2 */
 	struct channel_param       ch_param[1];          /*     6    25 */
 	/* size: 32, cachelines: 1, members: 3 */
 	/* padding: 1 */
 	/* last cacheline: 32 bytes */
 };
 and now with the flexible array transformation it is just 8 bytes:
 $ pahole -C scan_chan_list_params drivers/net/wireless/ath/ath11k/reg.o
 struct scan_chan_list_params {
 	u32                        pdev_id;              /*     0     4 */
 	u16                        nallchans;            /*     4     2 */
 	struct channel_param       ch_param[];           /*     6     0 */
 	/* size: 8, cachelines: 1, members: 3 */
 	/* padding: 2 */
 	/* last cacheline: 8 bytes */
 };
 This helps with the ongoing efforts to globally enable -Warray-bounds and
 get us closer to being able to tighten the FORTIFY_SOURCE routines on
 memcpy().
 This issue was found with the help of Coccinelle and audited and fixed,
 manually.
 [1] https://en.wikipedia.org/wiki/Flexible_array_member
 [2] https://www.kernel.org/doc/html/v5.10/process/deprecated.html#zero-length-and-one-element-arrays
 Link: https://github.com/KSPP/linux/issues/79
 Link: https://github.com/KSPP/linux/issues/109
 Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210823172159.GA25800@embeddedor
 ---
 drivers/net/wireless/ath/ath11k/reg.c | 7 ++-----
 drivers/net/wireless/ath/ath11k/wmi.c | 2 +-
 drivers/net/wireless/ath/ath11k/wmi.h | 2 +-
 3 files changed, 4 insertions(+), 7 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/reg.c
 +++ b/drivers/net/wireless/ath/ath11k/reg.c
@@ -97,7 +97,6 @@ int ath11k_reg_update_chan_list(struct a
 	struct channel_param *ch;
 	enum nl80211_band band;
 	int num_channels = 0;
 -	int params_len;
 	int i, ret;
 	bands = hw->wiphy->bands;
@@ -117,10 +116,8 @@ int ath11k_reg_update_chan_list(struct a
 	if (WARN_ON(!num_channels))
 		return -EINVAL;
 -	params_len = sizeof(struct scan_chan_list_params) +
 -			num_channels * sizeof(struct channel_param);
 -	params = kzalloc(params_len, GFP_KERNEL);
 -
 +	params = kzalloc(struct_size(params, ch_param, num_channels),
 +			 GFP_KERNEL);
 	if (!params)
 		return -ENOMEM;
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -2303,7 +2303,7 @@ int ath11k_wmi_send_scan_chan_list_cmd(s
 	u16 num_send_chans, num_sends = 0, max_chan_limit = 0;
 	u32 *reg1, *reg2;
 -	tchan_info = &chan_list->ch_param[0];
 +	tchan_info = chan_list->ch_param;
 	while (chan_list->nallchans) {
 		len = sizeof(*cmd) + TLV_HDR_SIZE;
 		max_chan_limit = (wmi->wmi_ab->max_msg_len[ar->pdev_idx] - len) /
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
@@ -3659,7 +3659,7 @@ struct wmi_stop_scan_cmd {
 struct scan_chan_list_params {
 	u32 pdev_id;
 	u16 nallchans;
 -	struct channel_param ch_param[1];
 +	struct channel_param ch_param[];
 };
 struct wmi_scan_chan_list_cmd {
--- a/package/kernel/mac80211/patches/ath11k/0020-wifi-ath11k-update-ce-configurations-for-IPQ5018.patch
+++ b/package/kernel/mac80211/patches/ath11k/0020-wifi-ath11k-update-ce-configurations-for-IPQ5018.patch
@ -0,0 +1,246 @@
 From 26af7aabd2d8225c6b2056234626ba5099610871 Mon Sep 17 00:00:00 2001
 From: Sriram R <quic_srirrama@quicinc.com>
 Date: Fri, 2 Dec 2022 23:37:14 +0200
 Subject: [PATCH] wifi: ath11k: update ce configurations for IPQ5018
 IPQ5018 is a single pdev device. Update host
 and target CE configurations accordingly.
 Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
 Co-developed-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
 Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20221122132152.17771-4-quic_kathirve@quicinc.com
 ---
 drivers/net/wireless/ath/ath11k/core.c |   4 +
 drivers/net/wireless/ath/ath11k/core.h |   3 +
 drivers/net/wireless/ath/ath11k/hw.c   | 191 +++++++++++++++++++++++++
 3 files changed, 198 insertions(+)
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
@@ -630,6 +630,10 @@ static const struct ath11k_hw_params ath
 		.internal_sleep_clock = false,
 		.host_ce_config = ath11k_host_ce_config_qcn9074,
 		.ce_count = CE_CNT_5018,
 +		.target_ce_config = ath11k_target_ce_config_wlan_ipq5018,
 +		.target_ce_count = TARGET_CE_CNT_5018,
 +		.svc_to_ce_map = ath11k_target_service_to_ce_map_wlan_ipq5018,
 +		.svc_to_ce_map_len = SVC_CE_MAP_LEN_5018,
 		.rxdma1_enable = true,
 		.num_rxmda_per_pdev = RXDMA_PER_PDEV_5018,
 		.rx_mac_buf_ring = false,
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
@@ -1145,6 +1145,9 @@ extern const struct service_to_pipe ath1
 extern const struct ce_pipe_config ath11k_target_ce_config_wlan_qca6390[];
 extern const struct service_to_pipe ath11k_target_service_to_ce_map_wlan_qca6390[];
 +extern const struct ce_pipe_config ath11k_target_ce_config_wlan_ipq5018[];
 +extern const struct service_to_pipe ath11k_target_service_to_ce_map_wlan_ipq5018[];
 +
 extern const struct ce_pipe_config ath11k_target_ce_config_wlan_qcn9074[];
 extern const struct service_to_pipe ath11k_target_service_to_ce_map_wlan_qcn9074[];
 int ath11k_core_qmi_firmware_ready(struct ath11k_base *ab);
 --- a/drivers/net/wireless/ath/ath11k/hw.c
 +++ b/drivers/net/wireless/ath/ath11k/hw.c
@@ -1972,6 +1972,197 @@ const struct ath11k_hw_ring_mask ath11k_
 	},
 };
 +/* Target firmware's Copy Engine configuration for IPQ5018 */
 +const struct ce_pipe_config ath11k_target_ce_config_wlan_ipq5018[] = {
 +	/* CE0: host->target HTC control and raw streams */
 +	{
 +		.pipenum = __cpu_to_le32(0),
 +		.pipedir = __cpu_to_le32(PIPEDIR_OUT),
 +		.nentries = __cpu_to_le32(32),
 +		.nbytes_max = __cpu_to_le32(2048),
 +		.flags = __cpu_to_le32(CE_ATTR_FLAGS),
 +		.reserved = __cpu_to_le32(0),
 +	},
 +
 +	/* CE1: target->host HTT + HTC control */
 +	{
 +		.pipenum = __cpu_to_le32(1),
 +		.pipedir = __cpu_to_le32(PIPEDIR_IN),
 +		.nentries = __cpu_to_le32(32),
 +		.nbytes_max = __cpu_to_le32(2048),
 +		.flags = __cpu_to_le32(CE_ATTR_FLAGS),
 +		.reserved = __cpu_to_le32(0),
 +	},
 +
 +	/* CE2: target->host WMI */
 +	{
 +		.pipenum = __cpu_to_le32(2),
 +		.pipedir = __cpu_to_le32(PIPEDIR_IN),
 +		.nentries = __cpu_to_le32(32),
 +		.nbytes_max = __cpu_to_le32(2048),
 +		.flags = __cpu_to_le32(CE_ATTR_FLAGS),
 +		.reserved = __cpu_to_le32(0),
 +	},
 +
 +	/* CE3: host->target WMI */
 +	{
 +		.pipenum = __cpu_to_le32(3),
 +		.pipedir = __cpu_to_le32(PIPEDIR_OUT),
 +		.nentries = __cpu_to_le32(32),
 +		.nbytes_max = __cpu_to_le32(2048),
 +		.flags = __cpu_to_le32(CE_ATTR_FLAGS),
 +		.reserved = __cpu_to_le32(0),
 +	},
 +
 +	/* CE4: host->target HTT */
 +	{
 +		.pipenum = __cpu_to_le32(4),
 +		.pipedir = __cpu_to_le32(PIPEDIR_OUT),
 +		.nentries = __cpu_to_le32(256),
 +		.nbytes_max = __cpu_to_le32(256),
 +		.flags = __cpu_to_le32(CE_ATTR_FLAGS | CE_ATTR_DIS_INTR),
 +		.reserved = __cpu_to_le32(0),
 +	},
 +
 +	/* CE5: target->host Pktlog */
 +	{
 +		.pipenum = __cpu_to_le32(5),
 +		.pipedir = __cpu_to_le32(PIPEDIR_IN),
 +		.nentries = __cpu_to_le32(32),
 +		.nbytes_max = __cpu_to_le32(2048),
 +		.flags = __cpu_to_le32(CE_ATTR_FLAGS),
 +		.reserved = __cpu_to_le32(0),
 +	},
 +
 +	/* CE6: Reserved for target autonomous hif_memcpy */
 +	{
 +		.pipenum = __cpu_to_le32(6),
 +		.pipedir = __cpu_to_le32(PIPEDIR_INOUT),
 +		.nentries = __cpu_to_le32(32),
 +		.nbytes_max = __cpu_to_le32(16384),
 +		.flags = __cpu_to_le32(CE_ATTR_FLAGS),
 +		.reserved = __cpu_to_le32(0),
 +	},
 +
 +	/* CE7 used only by Host */
 +	{
 +		.pipenum = __cpu_to_le32(7),
 +		.pipedir = __cpu_to_le32(PIPEDIR_OUT),
 +		.nentries = __cpu_to_le32(32),
 +		.nbytes_max = __cpu_to_le32(2048),
 +		.flags = __cpu_to_le32(0x2000),
 +		.reserved = __cpu_to_le32(0),
 +	},
 +
 +	/* CE8 target->host used only by IPA */
 +	{
 +		.pipenum = __cpu_to_le32(8),
 +		.pipedir = __cpu_to_le32(PIPEDIR_INOUT),
 +		.nentries = __cpu_to_le32(32),
 +		.nbytes_max = __cpu_to_le32(16384),
 +		.flags = __cpu_to_le32(CE_ATTR_FLAGS),
 +		.reserved = __cpu_to_le32(0),
 +	},
 +};
 +
 +/* Map from service/endpoint to Copy Engine for IPQ5018.
 + * This table is derived from the CE TABLE, above.
 + * It is passed to the Target at startup for use by firmware.
 + */
 +const struct service_to_pipe ath11k_target_service_to_ce_map_wlan_ipq5018[] = {
 +	{
 +		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_DATA_VO),
 +		.pipedir = __cpu_to_le32(PIPEDIR_OUT),	/* out = UL = host -> target */
 +		.pipenum = __cpu_to_le32(3),
 +	},
 +	{
 +		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_DATA_VO),
 +		.pipedir = __cpu_to_le32(PIPEDIR_IN),	/* in = DL = target -> host */
 +		.pipenum = __cpu_to_le32(2),
 +	},
 +	{
 +		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_DATA_BK),
 +		.pipedir = __cpu_to_le32(PIPEDIR_OUT),	/* out = UL = host -> target */
 +		.pipenum = __cpu_to_le32(3),
 +	},
 +	{
 +		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_DATA_BK),
 +		.pipedir = __cpu_to_le32(PIPEDIR_IN),	/* in = DL = target -> host */
 +		.pipenum = __cpu_to_le32(2),
 +	},
 +	{
 +		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_DATA_BE),
 +		.pipedir = __cpu_to_le32(PIPEDIR_OUT),	/* out = UL = host -> target */
 +		.pipenum = __cpu_to_le32(3),
 +	},
 +	{
 +		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_DATA_BE),
 +		.pipedir = __cpu_to_le32(PIPEDIR_IN),	/* in = DL = target -> host */
 +		.pipenum = __cpu_to_le32(2),
 +	},
 +	{
 +		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_DATA_VI),
 +		.pipedir = __cpu_to_le32(PIPEDIR_OUT),	/* out = UL = host -> target */
 +		.pipenum = __cpu_to_le32(3),
 +	},
 +	{
 +		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_DATA_VI),
 +		.pipedir = __cpu_to_le32(PIPEDIR_IN),	/* in = DL = target -> host */
 +		.pipenum = __cpu_to_le32(2),
 +	},
 +	{
 +		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_CONTROL),
 +		.pipedir = __cpu_to_le32(PIPEDIR_OUT),	/* out = UL = host -> target */
 +		.pipenum = __cpu_to_le32(3),
 +	},
 +	{
 +		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_WMI_CONTROL),
 +		.pipedir = __cpu_to_le32(PIPEDIR_IN),	/* in = DL = target -> host */
 +		.pipenum = __cpu_to_le32(2),
 +	},
 +
 +	{
 +		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_RSVD_CTRL),
 +		.pipedir = __cpu_to_le32(PIPEDIR_OUT),	/* out = UL = host -> target */
 +		.pipenum = __cpu_to_le32(0),
 +	},
 +	{
 +		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_RSVD_CTRL),
 +		.pipedir = __cpu_to_le32(PIPEDIR_IN),	/* in = DL = target -> host */
 +		.pipenum = __cpu_to_le32(1),
 +	},
 +
 +	{
 +		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_TEST_RAW_STREAMS),
 +		.pipedir = __cpu_to_le32(PIPEDIR_OUT),	/* out = UL = host -> target */
 +		.pipenum = __cpu_to_le32(0),
 +	},
 +	{
 +		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_TEST_RAW_STREAMS),
 +		.pipedir = __cpu_to_le32(PIPEDIR_IN),	/* in = DL = target -> host */
 +		.pipenum = __cpu_to_le32(1),
 +	},
 +	{
 +		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_HTT_DATA_MSG),
 +		.pipedir = __cpu_to_le32(PIPEDIR_OUT),	/* out = UL = host -> target */
 +		.pipenum = __cpu_to_le32(4),
 +	},
 +	{
 +		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_HTT_DATA_MSG),
 +		.pipedir = __cpu_to_le32(PIPEDIR_IN),	/* in = DL = target -> host */
 +		.pipenum = __cpu_to_le32(1),
 +	},
 +	{
 +		.service_id = __cpu_to_le32(ATH11K_HTC_SVC_ID_PKT_LOG),
 +		.pipedir = __cpu_to_le32(PIPEDIR_IN),	/* in = DL = target -> host */
 +		.pipenum = __cpu_to_le32(5),
 +	},
 +
 +       /* (Additions here) */
 +
 +	{ /* terminator entry */ }
 +};
 +
 const struct ath11k_hw_regs ipq8074_regs = {
 	/* SW2TCL(x) R0 ring configuration address */
 	.hal_tcl1_ring_base_lsb = 0x00000510,
--- a/package/kernel/mac80211/patches/ath11k/0021-wifi-ath11k-remap-ce-register-space-for-IPQ5018.patch
+++ b/package/kernel/mac80211/patches/ath11k/0021-wifi-ath11k-remap-ce-register-space-for-IPQ5018.patch
@ -0,0 +1,351 @@
 From b42b3678c91f3ca6e0888bf5a15c1e8678fd5f2d Mon Sep 17 00:00:00 2001
 From: Sriram R <quic_srirrama@quicinc.com>
 Date: Fri, 2 Dec 2022 23:37:14 +0200
 Subject: [PATCH] wifi: ath11k: remap ce register space for IPQ5018
 In IPQ5018 ce register space is moved out of wcss unlike
 ipq8074 or ipq6018 and the space is not contiguous,
 hence remap the CE registers to a new space to access them.
 Register read/write is modified to check if the register to be written
 falls in the CE register space and corresponding register is written.
 Also adjust the interrupt register address to ce irq enable/disable.
 Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
 Co-developed-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
 Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20221122132152.17771-5-quic_kathirve@quicinc.com
 ---
 drivers/net/wireless/ath/ath11k/ahb.c  | 44 ++++++++++++++++++++++----
 drivers/net/wireless/ath/ath11k/ce.h   | 16 ++++++++++
 drivers/net/wireless/ath/ath11k/core.c |  8 +++++
 drivers/net/wireless/ath/ath11k/core.h |  1 +
 drivers/net/wireless/ath/ath11k/hal.c  | 17 ++++++----
 drivers/net/wireless/ath/ath11k/hal.h  |  5 +++
 drivers/net/wireless/ath/ath11k/hw.c   | 17 ++++++++++
 drivers/net/wireless/ath/ath11k/hw.h   |  9 ++++++
 drivers/net/wireless/ath/ath11k/pci.c  |  2 ++
 9 files changed, 107 insertions(+), 12 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/ahb.c
 +++ b/drivers/net/wireless/ath/ath11k/ahb.c
@@ -267,30 +267,42 @@ static void ath11k_ahb_clearbit32(struct
 static void ath11k_ahb_ce_irq_enable(struct ath11k_base *ab, u16 ce_id)
 {
 	const struct ce_attr *ce_attr;
 +	const struct ce_ie_addr *ce_ie_addr = ab->hw_params.ce_ie_addr;
 +	u32 ie1_reg_addr, ie2_reg_addr, ie3_reg_addr;
 +
 +	ie1_reg_addr = ce_ie_addr->ie1_reg_addr + ATH11K_CE_OFFSET(ab);
 +	ie2_reg_addr = ce_ie_addr->ie2_reg_addr + ATH11K_CE_OFFSET(ab);
 +	ie3_reg_addr = ce_ie_addr->ie3_reg_addr + ATH11K_CE_OFFSET(ab);
 	ce_attr = &ab->hw_params.host_ce_config[ce_id];
 	if (ce_attr->src_nentries)
 -		ath11k_ahb_setbit32(ab, ce_id, CE_HOST_IE_ADDRESS);
 +		ath11k_ahb_setbit32(ab, ce_id, ie1_reg_addr);
 	if (ce_attr->dest_nentries) {
 -		ath11k_ahb_setbit32(ab, ce_id, CE_HOST_IE_2_ADDRESS);
 +		ath11k_ahb_setbit32(ab, ce_id, ie2_reg_addr);
 		ath11k_ahb_setbit32(ab, ce_id + CE_HOST_IE_3_SHIFT,
 -				    CE_HOST_IE_3_ADDRESS);
 +				    ie3_reg_addr);
 	}
 }
 static void ath11k_ahb_ce_irq_disable(struct ath11k_base *ab, u16 ce_id)
 {
 	const struct ce_attr *ce_attr;
 +	const struct ce_ie_addr *ce_ie_addr = ab->hw_params.ce_ie_addr;
 +	u32 ie1_reg_addr, ie2_reg_addr, ie3_reg_addr;
 +
 +	ie1_reg_addr = ce_ie_addr->ie1_reg_addr + ATH11K_CE_OFFSET(ab);
 +	ie2_reg_addr = ce_ie_addr->ie2_reg_addr + ATH11K_CE_OFFSET(ab);
 +	ie3_reg_addr = ce_ie_addr->ie3_reg_addr + ATH11K_CE_OFFSET(ab);
 	ce_attr = &ab->hw_params.host_ce_config[ce_id];
 	if (ce_attr->src_nentries)
 -		ath11k_ahb_clearbit32(ab, ce_id, CE_HOST_IE_ADDRESS);
 +		ath11k_ahb_clearbit32(ab, ce_id, ie1_reg_addr);
 	if (ce_attr->dest_nentries) {
 -		ath11k_ahb_clearbit32(ab, ce_id, CE_HOST_IE_2_ADDRESS);
 +		ath11k_ahb_clearbit32(ab, ce_id, ie2_reg_addr);
 		ath11k_ahb_clearbit32(ab, ce_id + CE_HOST_IE_3_SHIFT,
 -				      CE_HOST_IE_3_ADDRESS);
 +				      ie3_reg_addr);
 	}
 }
@@ -1142,10 +1154,26 @@ static int ath11k_ahb_probe(struct platf
 		goto err_core_free;
 	}
 +	ab->mem_ce = ab->mem;
 +
 	ret = ath11k_core_pre_init(ab);
 	if (ret)
 		goto err_core_free;
 +	if (ab->hw_params.ce_remap) {
 +		const struct ce_remap *ce_remap = ab->hw_params.ce_remap;
 +		/* ce register space is moved out of wcss unlike ipq8074 or ipq6018
 +		 * and the space is not contiguous, hence remapping the CE registers
 +		 * to a new space for accessing them.
 +		 */
 +		ab->mem_ce = ioremap(ce_remap->base, ce_remap->size);
 +		if (IS_ERR(ab->mem_ce)) {
 +			dev_err(&pdev->dev, "ce ioremap error\n");
 +			ret = -ENOMEM;
 +			goto err_core_free;
 +		}
 +	}
 +
 	ret = ath11k_ahb_setup_resources(ab);
 	if (ret)
 		goto err_core_free;
@@ -1236,6 +1264,10 @@ static void ath11k_ahb_free_resources(st
 	ath11k_ahb_release_smp2p_handle(ab);
 	ath11k_ahb_fw_resource_deinit(ab);
 	ath11k_ce_free_pipes(ab);
 +
 +	if (ab->hw_params.ce_remap)
 +		iounmap(ab->mem_ce);
 +
 	ath11k_core_free(ab);
 	platform_set_drvdata(pdev, NULL);
 }
 --- a/drivers/net/wireless/ath/ath11k/ce.h
 +++ b/drivers/net/wireless/ath/ath11k/ce.h
@@ -49,6 +49,11 @@ void ath11k_ce_byte_swap(void *mem, u32
 #define CE_HOST_IE_2_ADDRESS	0x00A18040
 #define CE_HOST_IE_3_ADDRESS	CE_HOST_IE_ADDRESS
 +/* CE IE registers are different for IPQ5018 */
 +#define CE_HOST_IPQ5018_IE_ADDRESS		0x0841804C
 +#define CE_HOST_IPQ5018_IE_2_ADDRESS		0x08418050
 +#define CE_HOST_IPQ5018_IE_3_ADDRESS		CE_HOST_IPQ5018_IE_ADDRESS
 +
 #define CE_HOST_IE_3_SHIFT	0xC
 #define CE_RING_IDX_INCR(nentries_mask, idx) (((idx) + 1) & (nentries_mask))
@@ -84,6 +89,17 @@ struct ce_pipe_config {
 	__le32 reserved;
 };
 +struct ce_ie_addr {
 +	u32 ie1_reg_addr;
 +	u32 ie2_reg_addr;
 +	u32 ie3_reg_addr;
 +};
 +
 +struct ce_remap {
 +	u32 base;
 +	u32 size;
 +};
 +
 struct ce_attr {
 	/* CE_ATTR_* values */
 	unsigned int flags;
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
@@ -54,6 +54,7 @@ static const struct ath11k_hw_params ath
 		.target_ce_count = 11,
 		.svc_to_ce_map = ath11k_target_service_to_ce_map_wlan_ipq8074,
 		.svc_to_ce_map_len = 21,
 +		.ce_ie_addr = &ath11k_ce_ie_addr_ipq8074,
 		.single_pdev_only = false,
 		.rxdma1_enable = true,
 		.num_rxmda_per_pdev = 1,
@@ -137,6 +138,7 @@ static const struct ath11k_hw_params ath
 		.target_ce_count = 11,
 		.svc_to_ce_map = ath11k_target_service_to_ce_map_wlan_ipq6018,
 		.svc_to_ce_map_len = 19,
 +		.ce_ie_addr = &ath11k_ce_ie_addr_ipq8074,
 		.single_pdev_only = false,
 		.rxdma1_enable = true,
 		.num_rxmda_per_pdev = 1,
@@ -218,6 +220,7 @@ static const struct ath11k_hw_params ath
 		.target_ce_count = 9,
 		.svc_to_ce_map = ath11k_target_service_to_ce_map_wlan_qca6390,
 		.svc_to_ce_map_len = 14,
 +		.ce_ie_addr = &ath11k_ce_ie_addr_ipq8074,
 		.single_pdev_only = true,
 		.rxdma1_enable = false,
 		.num_rxmda_per_pdev = 2,
@@ -301,6 +304,7 @@ static const struct ath11k_hw_params ath
 		.target_ce_count = 9,
 		.svc_to_ce_map = ath11k_target_service_to_ce_map_wlan_qcn9074,
 		.svc_to_ce_map_len = 18,
 +		.ce_ie_addr = &ath11k_ce_ie_addr_ipq8074,
 		.rxdma1_enable = true,
 		.num_rxmda_per_pdev = 1,
 		.rx_mac_buf_ring = false,
@@ -381,6 +385,7 @@ static const struct ath11k_hw_params ath
 		.target_ce_count = 9,
 		.svc_to_ce_map = ath11k_target_service_to_ce_map_wlan_qca6390,
 		.svc_to_ce_map_len = 14,
 +		.ce_ie_addr = &ath11k_ce_ie_addr_ipq8074,
 		.single_pdev_only = true,
 		.rxdma1_enable = false,
 		.num_rxmda_per_pdev = 2,
@@ -546,6 +551,7 @@ static const struct ath11k_hw_params ath
 		.target_ce_count = 9,
 		.svc_to_ce_map = ath11k_target_service_to_ce_map_wlan_qca6390,
 		.svc_to_ce_map_len = 14,
 +		.ce_ie_addr = &ath11k_ce_ie_addr_ipq8074,
 		.single_pdev_only = true,
 		.rxdma1_enable = false,
 		.num_rxmda_per_pdev = 1,
@@ -634,6 +640,8 @@ static const struct ath11k_hw_params ath
 		.target_ce_count = TARGET_CE_CNT_5018,
 		.svc_to_ce_map = ath11k_target_service_to_ce_map_wlan_ipq5018,
 		.svc_to_ce_map_len = SVC_CE_MAP_LEN_5018,
 +		.ce_ie_addr = &ath11k_ce_ie_addr_ipq5018,
 +		.ce_remap = &ath11k_ce_remap_ipq5018,
 		.rxdma1_enable = true,
 		.num_rxmda_per_pdev = RXDMA_PER_PDEV_5018,
 		.rx_mac_buf_ring = false,
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
@@ -851,6 +851,7 @@ struct ath11k_base {
 	struct ath11k_dp dp;
 	void __iomem *mem;
 +	void __iomem *mem_ce;
 	unsigned long mem_len;
 	struct {
 --- a/drivers/net/wireless/ath/ath11k/hal.c
 +++ b/drivers/net/wireless/ath/ath11k/hal.c
@@ -1220,16 +1220,20 @@ static int ath11k_hal_srng_create_config
 	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_TCL_REG + HAL_TCL_STATUS_RING_HP;
 	s = &hal->srng_config[HAL_CE_SRC];
 -	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(ab) + HAL_CE_DST_RING_BASE_LSB;
 -	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(ab) + HAL_CE_DST_RING_HP;
 +	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(ab) + HAL_CE_DST_RING_BASE_LSB +
 +		ATH11K_CE_OFFSET(ab);
 +	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(ab) + HAL_CE_DST_RING_HP +
 +		ATH11K_CE_OFFSET(ab);
 	s->reg_size[0] = HAL_SEQ_WCSS_UMAC_CE1_SRC_REG(ab) -
 		HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(ab);
 	s->reg_size[1] = HAL_SEQ_WCSS_UMAC_CE1_SRC_REG(ab) -
 		HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(ab);
 	s = &hal->srng_config[HAL_CE_DST];
 -	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_CE0_DST_REG(ab) + HAL_CE_DST_RING_BASE_LSB;
 -	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_CE0_DST_REG(ab) + HAL_CE_DST_RING_HP;
 +	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_CE0_DST_REG(ab) + HAL_CE_DST_RING_BASE_LSB +
 +		ATH11K_CE_OFFSET(ab);
 +	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_CE0_DST_REG(ab) + HAL_CE_DST_RING_HP +
 +		ATH11K_CE_OFFSET(ab);
 	s->reg_size[0] = HAL_SEQ_WCSS_UMAC_CE1_DST_REG(ab) -
 		HAL_SEQ_WCSS_UMAC_CE0_DST_REG(ab);
 	s->reg_size[1] = HAL_SEQ_WCSS_UMAC_CE1_DST_REG(ab) -
@@ -1237,8 +1241,9 @@ static int ath11k_hal_srng_create_config
 	s = &hal->srng_config[HAL_CE_DST_STATUS];
 	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_CE0_DST_REG(ab) +
 -		HAL_CE_DST_STATUS_RING_BASE_LSB;
 -	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_CE0_DST_REG(ab) + HAL_CE_DST_STATUS_RING_HP;
 +		HAL_CE_DST_STATUS_RING_BASE_LSB + ATH11K_CE_OFFSET(ab);
 +	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_CE0_DST_REG(ab) + HAL_CE_DST_STATUS_RING_HP +
 +		ATH11K_CE_OFFSET(ab);
 	s->reg_size[0] = HAL_SEQ_WCSS_UMAC_CE1_DST_REG(ab) -
 		HAL_SEQ_WCSS_UMAC_CE0_DST_REG(ab);
 	s->reg_size[1] = HAL_SEQ_WCSS_UMAC_CE1_DST_REG(ab) -
 --- a/drivers/net/wireless/ath/ath11k/hal.h
 +++ b/drivers/net/wireless/ath/ath11k/hal.h
@@ -321,6 +321,10 @@ struct ath11k_base;
 #define HAL_WBM2SW_RELEASE_RING_BASE_MSB_RING_SIZE	0x000fffff
 #define HAL_RXDMA_RING_MAX_SIZE				0x0000ffff
 +/* IPQ5018 ce registers */
 +#define HAL_IPQ5018_CE_WFSS_REG_BASE		0x08400000
 +#define HAL_IPQ5018_CE_SIZE			0x200000
 +
 /* Add any other errors here and return them in
  * ath11k_hal_rx_desc_get_err().
  */
@@ -519,6 +523,7 @@ enum hal_srng_dir {
 #define HAL_SRNG_FLAGS_MSI_INTR			0x00020000
 #define HAL_SRNG_FLAGS_CACHED                   0x20000000
 #define HAL_SRNG_FLAGS_LMAC_RING		0x80000000
 +#define HAL_SRNG_FLAGS_REMAP_CE_RING        0x10000000
 #define HAL_SRNG_TLV_HDR_TAG		GENMASK(9, 1)
 #define HAL_SRNG_TLV_HDR_LEN		GENMASK(25, 10)
 --- a/drivers/net/wireless/ath/ath11k/hw.c
 +++ b/drivers/net/wireless/ath/ath11k/hw.c
@@ -2163,6 +2163,23 @@ const struct service_to_pipe ath11k_targ
 	{ /* terminator entry */ }
 };
 +const struct ce_ie_addr ath11k_ce_ie_addr_ipq8074 = {
 +	.ie1_reg_addr = CE_HOST_IE_ADDRESS,
 +	.ie2_reg_addr = CE_HOST_IE_2_ADDRESS,
 +	.ie3_reg_addr = CE_HOST_IE_3_ADDRESS,
 +};
 +
 +const struct ce_ie_addr ath11k_ce_ie_addr_ipq5018 = {
 +	.ie1_reg_addr = CE_HOST_IPQ5018_IE_ADDRESS - HAL_IPQ5018_CE_WFSS_REG_BASE,
 +	.ie2_reg_addr = CE_HOST_IPQ5018_IE_2_ADDRESS - HAL_IPQ5018_CE_WFSS_REG_BASE,
 +	.ie3_reg_addr = CE_HOST_IPQ5018_IE_3_ADDRESS - HAL_IPQ5018_CE_WFSS_REG_BASE,
 +};
 +
 +const struct ce_remap ath11k_ce_remap_ipq5018 = {
 +	.base = HAL_IPQ5018_CE_WFSS_REG_BASE,
 +	.size = HAL_IPQ5018_CE_SIZE,
 +};
 +
 const struct ath11k_hw_regs ipq8074_regs = {
 	/* SW2TCL(x) R0 ring configuration address */
 	.hal_tcl1_ring_base_lsb = 0x00000510,
 --- a/drivers/net/wireless/ath/ath11k/hw.h
 +++ b/drivers/net/wireless/ath/ath11k/hw.h
@@ -80,6 +80,8 @@
 #define ATH11K_M3_FILE			"m3.bin"
 #define ATH11K_REGDB_FILE_NAME		"regdb.bin"
 +#define ATH11K_CE_OFFSET(ab)	(ab->mem_ce - ab->mem)
 +
 enum ath11k_hw_rate_cck {
 	ATH11K_HW_RATE_CCK_LP_11M = 0,
 	ATH11K_HW_RATE_CCK_LP_5_5M,
@@ -158,6 +160,8 @@ struct ath11k_hw_params {
 	u32 target_ce_count;
 	const struct service_to_pipe *svc_to_ce_map;
 	u32 svc_to_ce_map_len;
 +	const struct ce_ie_addr *ce_ie_addr;
 +	const struct ce_remap *ce_remap;
 	bool single_pdev_only;
@@ -277,6 +281,11 @@ extern const struct ath11k_hw_ring_mask
 extern const struct ath11k_hw_ring_mask ath11k_hw_ring_mask_qcn9074;
 extern const struct ath11k_hw_ring_mask ath11k_hw_ring_mask_wcn6750;
 +extern const struct ce_ie_addr ath11k_ce_ie_addr_ipq8074;
 +extern const struct ce_ie_addr ath11k_ce_ie_addr_ipq5018;
 +
 +extern const struct ce_remap ath11k_ce_remap_ipq5018;
 +
 extern const struct ath11k_hw_hal_params ath11k_hw_hal_params_ipq8074;
 extern const struct ath11k_hw_hal_params ath11k_hw_hal_params_qca6390;
 extern const struct ath11k_hw_hal_params ath11k_hw_hal_params_wcn6750;
 --- a/drivers/net/wireless/ath/ath11k/pci.c
 +++ b/drivers/net/wireless/ath/ath11k/pci.c
@@ -543,6 +543,8 @@ static int ath11k_pci_claim(struct ath11
 		goto clear_master;
 	}
 +	ab->mem_ce = ab->mem;
 +
 	ath11k_dbg(ab, ATH11K_DBG_BOOT, "boot pci_mem 0x%pK\n", ab->mem);
 	return 0;
--- a/package/kernel/mac80211/patches/ath11k/0022-wifi-ath11k-update-hal-srng-regs-for-IPQ5018.patch
+++ b/package/kernel/mac80211/patches/ath11k/0022-wifi-ath11k-update-hal-srng-regs-for-IPQ5018.patch
@ -0,0 +1,130 @@
 From 711b80acbdfb9667a9cf8374e13320a6e624ce73 Mon Sep 17 00:00:00 2001
 From: Sriram R <quic_srirrama@quicinc.com>
 Date: Fri, 2 Dec 2022 23:37:14 +0200
 Subject: [PATCH] wifi: ath11k: update hal srng regs for IPQ5018
 IPQ5018 hal srng register address & offsets are not
 similar to IPQ8074/IPQ6018/QCN9074, hence define a
 new set of srng register group data for IPQ5018.
 Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
 Co-developed-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
 Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20221122132152.17771-6-quic_kathirve@quicinc.com
 ---
 drivers/net/wireless/ath/ath11k/core.c |  1 +
 drivers/net/wireless/ath/ath11k/hw.c   | 79 ++++++++++++++++++++++++++
 drivers/net/wireless/ath/ath11k/hw.h   |  1 +
 3 files changed, 81 insertions(+)
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
@@ -634,6 +634,7 @@ static const struct ath11k_hw_params ath
 			.max_fft_bins = 1024,
 		},
 		.internal_sleep_clock = false,
 +		.regs = &ipq5018_regs,
 		.host_ce_config = ath11k_host_ce_config_qcn9074,
 		.ce_count = CE_CNT_5018,
 		.target_ce_config = ath11k_target_ce_config_wlan_ipq5018,
 --- a/drivers/net/wireless/ath/ath11k/hw.c
 +++ b/drivers/net/wireless/ath/ath11k/hw.c
@@ -2645,6 +2645,85 @@ static const struct ath11k_hw_tcl2wbm_rb
 	},
 };
 +const struct ath11k_hw_regs ipq5018_regs = {
 +	/* SW2TCL(x) R0 ring configuration address */
 +	.hal_tcl1_ring_base_lsb = 0x00000694,
 +	.hal_tcl1_ring_base_msb = 0x00000698,
 +	.hal_tcl1_ring_id =	0x0000069c,
 +	.hal_tcl1_ring_misc = 0x000006a4,
 +	.hal_tcl1_ring_tp_addr_lsb = 0x000006b0,
 +	.hal_tcl1_ring_tp_addr_msb = 0x000006b4,
 +	.hal_tcl1_ring_consumer_int_setup_ix0 = 0x000006c4,
 +	.hal_tcl1_ring_consumer_int_setup_ix1 = 0x000006c8,
 +	.hal_tcl1_ring_msi1_base_lsb = 0x000006dc,
 +	.hal_tcl1_ring_msi1_base_msb = 0x000006e0,
 +	.hal_tcl1_ring_msi1_data = 0x000006e4,
 +	.hal_tcl2_ring_base_lsb = 0x000006ec,
 +	.hal_tcl_ring_base_lsb = 0x0000079c,
 +
 +	/* TCL STATUS ring address */
 +	.hal_tcl_status_ring_base_lsb = 0x000008a4,
 +
 +	/* REO2SW(x) R0 ring configuration address */
 +	.hal_reo1_ring_base_lsb = 0x000001ec,
 +	.hal_reo1_ring_base_msb = 0x000001f0,
 +	.hal_reo1_ring_id = 0x000001f4,
 +	.hal_reo1_ring_misc = 0x000001fc,
 +	.hal_reo1_ring_hp_addr_lsb = 0x00000200,
 +	.hal_reo1_ring_hp_addr_msb = 0x00000204,
 +	.hal_reo1_ring_producer_int_setup = 0x00000210,
 +	.hal_reo1_ring_msi1_base_lsb = 0x00000234,
 +	.hal_reo1_ring_msi1_base_msb = 0x00000238,
 +	.hal_reo1_ring_msi1_data = 0x0000023c,
 +	.hal_reo2_ring_base_lsb = 0x00000244,
 +	.hal_reo1_aging_thresh_ix_0 = 0x00000564,
 +	.hal_reo1_aging_thresh_ix_1 = 0x00000568,
 +	.hal_reo1_aging_thresh_ix_2 = 0x0000056c,
 +	.hal_reo1_aging_thresh_ix_3 = 0x00000570,
 +
 +	/* REO2SW(x) R2 ring pointers (head/tail) address */
 +	.hal_reo1_ring_hp = 0x00003028,
 +	.hal_reo1_ring_tp = 0x0000302c,
 +	.hal_reo2_ring_hp = 0x00003030,
 +
 +	/* REO2TCL R0 ring configuration address */
 +	.hal_reo_tcl_ring_base_lsb = 0x000003fc,
 +	.hal_reo_tcl_ring_hp = 0x00003058,
 +
 +	/* SW2REO ring address */
 +	.hal_sw2reo_ring_base_lsb = 0x0000013c,
 +	.hal_sw2reo_ring_hp = 0x00003018,
 +
 +	/* REO CMD ring address */
 +	.hal_reo_cmd_ring_base_lsb = 0x000000e4,
 +	.hal_reo_cmd_ring_hp = 0x00003010,
 +
 +	/* REO status address */
 +	.hal_reo_status_ring_base_lsb = 0x00000504,
 +	.hal_reo_status_hp = 0x00003070,
 +
 +	/* WCSS relative address */
 +	.hal_seq_wcss_umac_ce0_src_reg = 0x08400000
 +		- HAL_IPQ5018_CE_WFSS_REG_BASE,
 +	.hal_seq_wcss_umac_ce0_dst_reg = 0x08401000
 +		- HAL_IPQ5018_CE_WFSS_REG_BASE,
 +	.hal_seq_wcss_umac_ce1_src_reg = 0x08402000
 +		- HAL_IPQ5018_CE_WFSS_REG_BASE,
 +	.hal_seq_wcss_umac_ce1_dst_reg = 0x08403000
 +		- HAL_IPQ5018_CE_WFSS_REG_BASE,
 +
 +	/* WBM Idle address */
 +	.hal_wbm_idle_link_ring_base_lsb = 0x00000874,
 +	.hal_wbm_idle_link_ring_misc = 0x00000884,
 +
 +	/* SW2WBM release address */
 +	.hal_wbm_release_ring_base_lsb = 0x000001ec,
 +
 +	/* WBM2SW release address */
 +	.hal_wbm0_release_ring_base_lsb = 0x00000924,
 +	.hal_wbm1_release_ring_base_lsb = 0x0000097c,
 +};
 +
 const struct ath11k_hw_hal_params ath11k_hw_hal_params_ipq8074 = {
 	.rx_buf_rbm = HAL_RX_BUF_RBM_SW3_BM,
 	.tcl2wbm_rbm_map = ath11k_hw_tcl2wbm_rbm_map_ipq8074,
 --- a/drivers/net/wireless/ath/ath11k/hw.h
 +++ b/drivers/net/wireless/ath/ath11k/hw.h
@@ -415,6 +415,7 @@ extern const struct ath11k_hw_regs qca63
 extern const struct ath11k_hw_regs qcn9074_regs;
 extern const struct ath11k_hw_regs wcn6855_regs;
 extern const struct ath11k_hw_regs wcn6750_regs;
 +extern const struct ath11k_hw_regs ipq5018_regs;
 static inline const char *ath11k_bd_ie_type_str(enum ath11k_bd_ie_type type)
 {
--- a/package/kernel/mac80211/patches/ath11k/0023-ath11k-Add-support-for-RX-decapsulation-offload.patch
+++ b/package/kernel/mac80211/patches/ath11k/0023-ath11k-Add-support-for-RX-decapsulation-offload.patch
@ -1,596 +0,0 @@
 From 2167fa606c0f0e64b95a04f9bc42d9fd5360838a Mon Sep 17 00:00:00 2001
 From: Sriram R <srirrama@codeaurora.org>
 Date: Tue, 28 Sep 2021 12:05:40 +0300
 Subject: [PATCH] ath11k: Add support for RX decapsulation offload
 Add support for rx decapsulation offload by advertising
 the support to mac80211 during registration. Also ensure
 the frames have the RX_FLAG_8023 flag set in decap offload
 frames before passing to mac80211.
 Since the packets delivered to the driver are in 802.3 format, these
 can be sent to the network core with minimal processing in mac80211.
 This helps in releasing some CPU cycles in the host processor and
 thereby improving the performance.
 Two exceptions are made before passing decap frames, one is
 for EAPOL packets since mac80211 8023 fast rx for the sta
 is set only after authorization, other case is for multicast
 packets to validate PN in mac80211. In both the cases the
 decap frames are converted to 80211 frame and sent to mac80211.
 Ethernet decap can be enabled by using frame_mode modparam:
 insmod ath11k frame_mode=2
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-00844-QCAHKSWPL_SILICONZ-1 v2
 Co-developed-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
 Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
 Signed-off-by: Sriram R <srirrama@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210721204217.120572-1-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/core.h     |   4 +
 drivers/net/wireless/ath/ath11k/dp_rx.c    | 194 +++++++++++++--------
 drivers/net/wireless/ath/ath11k/hal_desc.h |   2 +
 drivers/net/wireless/ath/ath11k/hw.c       |  43 +++++
 drivers/net/wireless/ath/ath11k/hw.h       |   2 +
 drivers/net/wireless/ath/ath11k/mac.c      |  25 ++-
 6 files changed, 198 insertions(+), 72 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
@@ -98,6 +98,8 @@ struct ath11k_skb_rxcb {
 	bool is_first_msdu;
 	bool is_last_msdu;
 	bool is_continuation;
 +	bool is_mcbc;
 +	bool is_eapol;
 	struct hal_rx_desc *rx_desc;
 	u8 err_rel_src;
 	u8 err_code;
@@ -105,6 +107,8 @@ struct ath11k_skb_rxcb {
 	u8 unmapped;
 	u8 is_frag;
 	u8 tid;
 +	u16 peer_id;
 +	u16 seq_no;
 };
 enum ath11k_hw_rev {
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
@@ -270,6 +270,18 @@ static bool ath11k_dp_rx_h_attn_is_mcbc(
 		 __le32_to_cpu(attn->info1)));
 }
 +static bool ath11k_dp_rxdesc_mac_addr2_valid(struct ath11k_base *ab,
 +					     struct hal_rx_desc *desc)
 +{
 +	return ab->hw_params.hw_ops->rx_desc_mac_addr2_valid(desc);
 +}
 +
 +static u8 *ath11k_dp_rxdesc_mpdu_start_addr2(struct ath11k_base *ab,
 +					     struct hal_rx_desc *desc)
 +{
 +	return ab->hw_params.hw_ops->rx_desc_mpdu_start_addr2(desc);
 +}
 +
 static void ath11k_dp_service_mon_ring(struct timer_list *t)
 {
 	struct ath11k_base *ab = from_timer(ab, t, mon_reap_timer);
@@ -2156,6 +2168,7 @@ static void ath11k_dp_rx_h_undecap(struc
 {
 	u8 *first_hdr;
 	u8 decap;
 +	struct ethhdr *ehdr;
 	first_hdr = ath11k_dp_rx_h_80211_hdr(ar->ab, rx_desc);
 	decap = ath11k_dp_rx_h_msdu_start_decap_type(ar->ab, rx_desc);
@@ -2170,9 +2183,22 @@ static void ath11k_dp_rx_h_undecap(struc
 					   decrypted);
 		break;
 	case DP_RX_DECAP_TYPE_ETHERNET2_DIX:
 -		/* TODO undecap support for middle/last msdu's of amsdu */
 -		ath11k_dp_rx_h_undecap_eth(ar, msdu, first_hdr,
 -					   enctype, status);
 +		ehdr = (struct ethhdr *)msdu->data;
 +
 +		/* mac80211 allows fast path only for authorized STA */
 +		if (ehdr->h_proto == cpu_to_be16(ETH_P_PAE)) {
 +			ATH11K_SKB_RXCB(msdu)->is_eapol = true;
 +			ath11k_dp_rx_h_undecap_eth(ar, msdu, first_hdr,
 +						   enctype, status);
 +			break;
 +		}
 +
 +		/* PN for mcast packets will be validated in mac80211;
 +		 * remove eth header and add 802.11 header.
 +		 */
 +		if (ATH11K_SKB_RXCB(msdu)->is_mcbc && decrypted)
 +			ath11k_dp_rx_h_undecap_eth(ar, msdu, first_hdr,
 +						   enctype, status);
 		break;
 	case DP_RX_DECAP_TYPE_8023:
 		/* TODO: Handle undecap for these formats */
@@ -2180,35 +2206,62 @@ static void ath11k_dp_rx_h_undecap(struc
 	}
 }
 +static struct ath11k_peer *
 +ath11k_dp_rx_h_find_peer(struct ath11k_base *ab, struct sk_buff *msdu)
 +{
 +	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
 +	struct hal_rx_desc *rx_desc = rxcb->rx_desc;
 +	struct ath11k_peer *peer = NULL;
 +
 +	lockdep_assert_held(&ab->base_lock);
 +
 +	if (rxcb->peer_id)
 +		peer = ath11k_peer_find_by_id(ab, rxcb->peer_id);
 +
 +	if (peer)
 +		return peer;
 +
 +	if (!rx_desc || !(ath11k_dp_rxdesc_mac_addr2_valid(ab, rx_desc)))
 +		return NULL;
 +
 +	peer = ath11k_peer_find_by_addr(ab,
 +					ath11k_dp_rxdesc_mpdu_start_addr2(ab, rx_desc));
 +	return peer;
 +}
 +
 static void ath11k_dp_rx_h_mpdu(struct ath11k *ar,
 				struct sk_buff *msdu,
 				struct hal_rx_desc *rx_desc,
 				struct ieee80211_rx_status *rx_status)
 {
 -	bool  fill_crypto_hdr, mcast;
 +	bool  fill_crypto_hdr;
 	enum hal_encrypt_type enctype;
 	bool is_decrypted = false;
 +	struct ath11k_skb_rxcb *rxcb;
 	struct ieee80211_hdr *hdr;
 	struct ath11k_peer *peer;
 	struct rx_attention *rx_attention;
 	u32 err_bitmap;
 -	hdr = (struct ieee80211_hdr *)msdu->data;
 -
 	/* PN for multicast packets will be checked in mac80211 */
 +	rxcb = ATH11K_SKB_RXCB(msdu);
 +	fill_crypto_hdr = ath11k_dp_rx_h_attn_is_mcbc(ar->ab, rx_desc);
 +	rxcb->is_mcbc = fill_crypto_hdr;
 -	mcast = is_multicast_ether_addr(hdr->addr1);
 -	fill_crypto_hdr = mcast;
 +	if (rxcb->is_mcbc) {
 +		rxcb->peer_id = ath11k_dp_rx_h_mpdu_start_peer_id(ar->ab, rx_desc);
 +		rxcb->seq_no = ath11k_dp_rx_h_mpdu_start_seq_no(ar->ab, rx_desc);
 +	}
 	spin_lock_bh(&ar->ab->base_lock);
 -	peer = ath11k_peer_find_by_addr(ar->ab, hdr->addr2);
 +	peer = ath11k_dp_rx_h_find_peer(ar->ab, msdu);
 	if (peer) {
 -		if (mcast)
 +		if (rxcb->is_mcbc)
 			enctype = peer->sec_type_grp;
 		else
 			enctype = peer->sec_type;
 	} else {
 -		enctype = HAL_ENCRYPT_TYPE_OPEN;
 +		enctype = ath11k_dp_rx_h_mpdu_start_enctype(ar->ab, rx_desc);
 	}
 	spin_unlock_bh(&ar->ab->base_lock);
@@ -2247,8 +2300,11 @@ static void ath11k_dp_rx_h_mpdu(struct a
 	if (!is_decrypted || fill_crypto_hdr)
 		return;
 -	hdr = (void *)msdu->data;
 -	hdr->frame_control &= ~__cpu_to_le16(IEEE80211_FCTL_PROTECTED);
 +	if (ath11k_dp_rx_h_msdu_start_decap_type(ar->ab, rx_desc) !=
 +	    DP_RX_DECAP_TYPE_ETHERNET2_DIX) {
 +		hdr = (void *)msdu->data;
 +		hdr->frame_control &= ~__cpu_to_le16(IEEE80211_FCTL_PROTECTED);
 +	}
 }
 static void ath11k_dp_rx_h_rate(struct ath11k *ar, struct hal_rx_desc *rx_desc,
@@ -2365,51 +2421,49 @@ static void ath11k_dp_rx_h_ppdu(struct a
 	ath11k_dp_rx_h_rate(ar, rx_desc, rx_status);
 }
 -static char *ath11k_print_get_tid(struct ieee80211_hdr *hdr, char *out,
 -				  size_t size)
 -{
 -	u8 *qc;
 -	int tid;
 -
 -	if (!ieee80211_is_data_qos(hdr->frame_control))
 -		return "";
 -
 -	qc = ieee80211_get_qos_ctl(hdr);
 -	tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
 -	snprintf(out, size, "tid %d", tid);
 -
 -	return out;
 -}
 -
 static void ath11k_dp_rx_deliver_msdu(struct ath11k *ar, struct napi_struct *napi,
 -				      struct sk_buff *msdu)
 +				      struct sk_buff *msdu,
 +				      struct ieee80211_rx_status *status)
 {
 	static const struct ieee80211_radiotap_he known = {
 		.data1 = cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_DATA_MCS_KNOWN |
 				     IEEE80211_RADIOTAP_HE_DATA1_BW_RU_ALLOC_KNOWN),
 		.data2 = cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA2_GI_KNOWN),
 	};
 -	struct ieee80211_rx_status *status;
 -	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)msdu->data;
 +	struct ieee80211_rx_status *rx_status;
 	struct ieee80211_radiotap_he *he = NULL;
 -	char tid[32];
 -
 -	status = IEEE80211_SKB_RXCB(msdu);
 -	if (status->encoding == RX_ENC_HE) {
 +	struct ieee80211_sta *pubsta = NULL;
 +	struct ath11k_peer *peer;
 +	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
 +	u8 decap = DP_RX_DECAP_TYPE_RAW;
 +	bool is_mcbc = rxcb->is_mcbc;
 +	bool is_eapol = rxcb->is_eapol;
 +
 +	if (status->encoding == RX_ENC_HE &&
 +	    !(status->flag & RX_FLAG_RADIOTAP_HE) &&
 +	    !(status->flag & RX_FLAG_SKIP_MONITOR)) {
 		he = skb_push(msdu, sizeof(known));
 		memcpy(he, &known, sizeof(known));
 		status->flag |= RX_FLAG_RADIOTAP_HE;
 	}
 +	if (!(status->flag & RX_FLAG_ONLY_MONITOR))
 +		decap = ath11k_dp_rx_h_msdu_start_decap_type(ar->ab, rxcb->rx_desc);
 +
 +	spin_lock_bh(&ar->ab->base_lock);
 +	peer = ath11k_dp_rx_h_find_peer(ar->ab, msdu);
 +	if (peer && peer->sta)
 +		pubsta = peer->sta;
 +	spin_unlock_bh(&ar->ab->base_lock);
 +
 	ath11k_dbg(ar->ab, ATH11K_DBG_DATA,
 -		   "rx skb %pK len %u peer %pM %s %s sn %u %s%s%s%s%s%s%s %srate_idx %u vht_nss %u freq %u band %u flag 0x%x fcs-err %i mic-err %i amsdu-more %i\n",
 +		   "rx skb %pK len %u peer %pM %d %s sn %u %s%s%s%s%s%s%s %srate_idx %u vht_nss %u freq %u band %u flag 0x%x fcs-err %i mic-err %i amsdu-more %i\n",
 		   msdu,
 		   msdu->len,
 -		   ieee80211_get_SA(hdr),
 -		   ath11k_print_get_tid(hdr, tid, sizeof(tid)),
 -		   is_multicast_ether_addr(ieee80211_get_DA(hdr)) ?
 -							"mcast" : "ucast",
 -		   (__le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ) >> 4,
 +		   peer ? peer->addr : NULL,
 +		   rxcb->tid,
 +		   is_mcbc ? "mcast" : "ucast",
 +		   rxcb->seq_no,
 		   (status->encoding == RX_ENC_LEGACY) ? "legacy" : "",
 		   (status->encoding == RX_ENC_HT) ? "ht" : "",
 		   (status->encoding == RX_ENC_VHT) ? "vht" : "",
@@ -2429,22 +2483,32 @@ static void ath11k_dp_rx_deliver_msdu(st
 	ath11k_dbg_dump(ar->ab, ATH11K_DBG_DP_RX, NULL, "dp rx msdu: ",
 			msdu->data, msdu->len);
 +	rx_status = IEEE80211_SKB_RXCB(msdu);
 +	*rx_status = *status;
 +
 	/* TODO: trace rx packet */
 -	ieee80211_rx_napi(ar->hw, NULL, msdu, napi);
 +	/* PN for multicast packets are not validate in HW,
 +	 * so skip 802.3 rx path
 +	 * Also, fast_rx expectes the STA to be authorized, hence
 +	 * eapol packets are sent in slow path.
 +	 */
 +	if (decap == DP_RX_DECAP_TYPE_ETHERNET2_DIX && !is_eapol &&
 +	    !(is_mcbc && rx_status->flag & RX_FLAG_DECRYPTED))
 +		rx_status->flag |= RX_FLAG_8023;
 +
 +	ieee80211_rx_napi(ar->hw, pubsta, msdu, napi);
 }
 static int ath11k_dp_rx_process_msdu(struct ath11k *ar,
 				     struct sk_buff *msdu,
 -				     struct sk_buff_head *msdu_list)
 +				     struct sk_buff_head *msdu_list,
 +				     struct ieee80211_rx_status *rx_status)
 {
 	struct ath11k_base *ab = ar->ab;
 	struct hal_rx_desc *rx_desc, *lrx_desc;
 	struct rx_attention *rx_attention;
 -	struct ieee80211_rx_status rx_status = {0};
 -	struct ieee80211_rx_status *status;
 	struct ath11k_skb_rxcb *rxcb;
 -	struct ieee80211_hdr *hdr;
 	struct sk_buff *last_buf;
 	u8 l3_pad_bytes;
 	u8 *hdr_status;
@@ -2500,19 +2564,11 @@ static int ath11k_dp_rx_process_msdu(str
 		}
 	}
 -	hdr = (struct ieee80211_hdr *)msdu->data;
 -
 -	/* Process only data frames */
 -	if (!ieee80211_is_data(hdr->frame_control))
 -		return -EINVAL;
 -
 -	ath11k_dp_rx_h_ppdu(ar, rx_desc, &rx_status);
 -	ath11k_dp_rx_h_mpdu(ar, msdu, rx_desc, &rx_status);
 +	ath11k_dp_rx_h_ppdu(ar, rx_desc, rx_status);
 +	ath11k_dp_rx_h_mpdu(ar, msdu, rx_desc, rx_status);
 -	rx_status.flag |= RX_FLAG_SKIP_MONITOR | RX_FLAG_DUP_VALIDATED;
 +	rx_status->flag |= RX_FLAG_SKIP_MONITOR | RX_FLAG_DUP_VALIDATED;
 -	status = IEEE80211_SKB_RXCB(msdu);
 -	*status = rx_status;
 	return 0;
 free_out:
@@ -2527,6 +2583,7 @@ static void ath11k_dp_rx_process_receive
 	struct ath11k_skb_rxcb *rxcb;
 	struct sk_buff *msdu;
 	struct ath11k *ar;
 +	struct ieee80211_rx_status rx_status = {0};
 	u8 mac_id;
 	int ret;
@@ -2549,7 +2606,7 @@ static void ath11k_dp_rx_process_receive
 			continue;
 		}
 -		ret = ath11k_dp_rx_process_msdu(ar, msdu, msdu_list);
 +		ret = ath11k_dp_rx_process_msdu(ar, msdu, msdu_list, &rx_status);
 		if (ret) {
 			ath11k_dbg(ab, ATH11K_DBG_DATA,
 				   "Unable to process msdu %d", ret);
@@ -2557,7 +2614,7 @@ static void ath11k_dp_rx_process_receive
 			continue;
 		}
 -		ath11k_dp_rx_deliver_msdu(ar, napi, msdu);
 +		ath11k_dp_rx_deliver_msdu(ar, napi, msdu, &rx_status);
 		(*quota)--;
 	}
@@ -2639,10 +2696,14 @@ try_again:
 					RX_MSDU_DESC_INFO0_LAST_MSDU_IN_MPDU);
 		rxcb->is_continuation = !!(desc.rx_msdu_info.info0 &
 					   RX_MSDU_DESC_INFO0_MSDU_CONTINUATION);
 -		rxcb->mac_id = mac_id;
 +		rxcb->peer_id = FIELD_GET(RX_MPDU_DESC_META_DATA_PEER_ID,
 +					  desc.rx_mpdu_info.meta_data);
 +		rxcb->seq_no = FIELD_GET(RX_MPDU_DESC_INFO0_SEQ_NUM,
 +					 desc.rx_mpdu_info.info0);
 		rxcb->tid = FIELD_GET(HAL_REO_DEST_RING_INFO0_RX_QUEUE_NUM,
 				      desc.info0);
 +		rxcb->mac_id = mac_id;
 		__skb_queue_tail(&msdu_list, msdu);
 		if (total_msdu_reaped >= quota && !rxcb->is_continuation) {
@@ -3944,7 +4005,6 @@ static void ath11k_dp_rx_wbm_err(struct
 {
 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
 	struct ieee80211_rx_status rxs = {0};
 -	struct ieee80211_rx_status *status;
 	bool drop = true;
 	switch (rxcb->err_rel_src) {
@@ -3964,10 +4024,7 @@ static void ath11k_dp_rx_wbm_err(struct
 		return;
 	}
 -	status = IEEE80211_SKB_RXCB(msdu);
 -	*status = rxs;
 -
 -	ath11k_dp_rx_deliver_msdu(ar, napi, msdu);
 +	ath11k_dp_rx_deliver_msdu(ar, napi, msdu, &rxs);
 }
 int ath11k_dp_rx_process_wbm_err(struct ath11k_base *ab,
@@ -4851,7 +4908,7 @@ static int ath11k_dp_rx_mon_deliver(stru
 {
 	struct ath11k_pdev_dp *dp = &ar->dp;
 	struct sk_buff *mon_skb, *skb_next, *header;
 -	struct ieee80211_rx_status *rxs = &dp->rx_status, *status;
 +	struct ieee80211_rx_status *rxs = &dp->rx_status;
 	mon_skb = ath11k_dp_rx_mon_merg_msdus(ar, mac_id, head_msdu,
 					      tail_msdu, rxs);
@@ -4877,10 +4934,7 @@ static int ath11k_dp_rx_mon_deliver(stru
 		}
 		rxs->flag |= RX_FLAG_ONLY_MONITOR;
 -		status = IEEE80211_SKB_RXCB(mon_skb);
 -		*status = *rxs;
 -
 -		ath11k_dp_rx_deliver_msdu(ar, napi, mon_skb);
 +		ath11k_dp_rx_deliver_msdu(ar, napi, mon_skb, rxs);
 		mon_skb = skb_next;
 	} while (mon_skb);
 	rxs->flag = 0;
 --- a/drivers/net/wireless/ath/ath11k/hal_desc.h
 +++ b/drivers/net/wireless/ath/ath11k/hal_desc.h
@@ -496,6 +496,8 @@ struct hal_tlv_hdr {
 #define RX_MPDU_DESC_INFO0_DA_IDX_TIMEOUT	BIT(29)
 #define RX_MPDU_DESC_INFO0_RAW_MPDU		BIT(30)
 +#define RX_MPDU_DESC_META_DATA_PEER_ID		GENMASK(15, 0)
 +
 struct rx_mpdu_desc {
 	u32 info0; /* %RX_MPDU_DESC_INFO */
 	u32 meta_data;
 --- a/drivers/net/wireless/ath/ath11k/hw.c
 +++ b/drivers/net/wireless/ath/ath11k/hw.c
@@ -374,6 +374,17 @@ static void ath11k_hw_ipq8074_rx_desc_se
 	desc->u.ipq8074.msdu_start.info1 = __cpu_to_le32(info);
 }
 +static bool ath11k_hw_ipq8074_rx_desc_mac_addr2_valid(struct hal_rx_desc *desc)
 +{
 +	return __le32_to_cpu(desc->u.ipq8074.mpdu_start.info1) &
 +	       RX_MPDU_START_INFO1_MAC_ADDR2_VALID;
 +}
 +
 +static u8 *ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2(struct hal_rx_desc *desc)
 +{
 +	return desc->u.ipq8074.mpdu_start.addr2;
 +}
 +
 static
 struct rx_attention *ath11k_hw_ipq8074_rx_desc_get_attention(struct hal_rx_desc *desc)
 {
@@ -545,6 +556,17 @@ static u8 *ath11k_hw_qcn9074_rx_desc_get
 	return &desc->u.qcn9074.msdu_payload[0];
 }
 +static bool ath11k_hw_ipq9074_rx_desc_mac_addr2_valid(struct hal_rx_desc *desc)
 +{
 +	return __le32_to_cpu(desc->u.qcn9074.mpdu_start.info11) &
 +	       RX_MPDU_START_INFO11_MAC_ADDR2_VALID;
 +}
 +
 +static u8 *ath11k_hw_ipq9074_rx_desc_mpdu_start_addr2(struct hal_rx_desc *desc)
 +{
 +	return desc->u.qcn9074.mpdu_start.addr2;
 +}
 +
 static bool ath11k_hw_wcn6855_rx_desc_get_first_msdu(struct hal_rx_desc *desc)
 {
 	return !!FIELD_GET(RX_MSDU_END_INFO2_FIRST_MSDU_WCN6855,
@@ -705,6 +727,17 @@ static u8 *ath11k_hw_wcn6855_rx_desc_get
 	return &desc->u.wcn6855.msdu_payload[0];
 }
 +static bool ath11k_hw_wcn6855_rx_desc_mac_addr2_valid(struct hal_rx_desc *desc)
 +{
 +	return __le32_to_cpu(desc->u.wcn6855.mpdu_start.info1) &
 +	       RX_MPDU_START_INFO1_MAC_ADDR2_VALID;
 +}
 +
 +static u8 *ath11k_hw_wcn6855_rx_desc_mpdu_start_addr2(struct hal_rx_desc *desc)
 +{
 +	return desc->u.wcn6855.mpdu_start.addr2;
 +}
 +
 static void ath11k_hw_wcn6855_reo_setup(struct ath11k_base *ab)
 {
 	u32 reo_base = HAL_SEQ_WCSS_UMAC_REO_REG;
@@ -801,6 +834,8 @@ const struct ath11k_hw_ops ipq8074_ops =
 	.rx_desc_get_msdu_payload = ath11k_hw_ipq8074_rx_desc_get_msdu_payload,
 	.reo_setup = ath11k_hw_ipq8074_reo_setup,
 	.mpdu_info_get_peerid = ath11k_hw_ipq8074_mpdu_info_get_peerid,
 +	.rx_desc_mac_addr2_valid = ath11k_hw_ipq8074_rx_desc_mac_addr2_valid,
 +	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2,
 };
 const struct ath11k_hw_ops ipq6018_ops = {
@@ -837,6 +872,8 @@ const struct ath11k_hw_ops ipq6018_ops =
 	.rx_desc_get_msdu_payload = ath11k_hw_ipq8074_rx_desc_get_msdu_payload,
 	.reo_setup = ath11k_hw_ipq8074_reo_setup,
 	.mpdu_info_get_peerid = ath11k_hw_ipq8074_mpdu_info_get_peerid,
 +	.rx_desc_mac_addr2_valid = ath11k_hw_ipq8074_rx_desc_mac_addr2_valid,
 +	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2,
 };
 const struct ath11k_hw_ops qca6390_ops = {
@@ -873,6 +910,8 @@ const struct ath11k_hw_ops qca6390_ops =
 	.rx_desc_get_msdu_payload = ath11k_hw_ipq8074_rx_desc_get_msdu_payload,
 	.reo_setup = ath11k_hw_ipq8074_reo_setup,
 	.mpdu_info_get_peerid = ath11k_hw_ipq8074_mpdu_info_get_peerid,
 +	.rx_desc_mac_addr2_valid = ath11k_hw_ipq8074_rx_desc_mac_addr2_valid,
 +	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2,
 };
 const struct ath11k_hw_ops qcn9074_ops = {
@@ -909,6 +948,8 @@ const struct ath11k_hw_ops qcn9074_ops =
 	.rx_desc_get_msdu_payload = ath11k_hw_qcn9074_rx_desc_get_msdu_payload,
 	.reo_setup = ath11k_hw_ipq8074_reo_setup,
 	.mpdu_info_get_peerid = ath11k_hw_ipq8074_mpdu_info_get_peerid,
 +	.rx_desc_mac_addr2_valid = ath11k_hw_ipq9074_rx_desc_mac_addr2_valid,
 +	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq9074_rx_desc_mpdu_start_addr2,
 };
 const struct ath11k_hw_ops wcn6855_ops = {
@@ -945,6 +986,8 @@ const struct ath11k_hw_ops wcn6855_ops =
 	.rx_desc_get_msdu_payload = ath11k_hw_wcn6855_rx_desc_get_msdu_payload,
 	.reo_setup = ath11k_hw_wcn6855_reo_setup,
 	.mpdu_info_get_peerid = ath11k_hw_wcn6855_mpdu_info_get_peerid,
 +	.rx_desc_mac_addr2_valid = ath11k_hw_wcn6855_rx_desc_mac_addr2_valid,
 +	.rx_desc_mpdu_start_addr2 = ath11k_hw_wcn6855_rx_desc_mpdu_start_addr2,
 };
 #define ATH11K_TX_RING_MASK_0 0x1
 --- a/drivers/net/wireless/ath/ath11k/hw.h
 +++ b/drivers/net/wireless/ath/ath11k/hw.h
@@ -209,6 +209,8 @@ struct ath11k_hw_ops {
 	u8 *(*rx_desc_get_msdu_payload)(struct hal_rx_desc *desc);
 	void (*reo_setup)(struct ath11k_base *ab);
 	u16 (*mpdu_info_get_peerid)(u8 *tlv_data);
 +	bool (*rx_desc_mac_addr2_valid)(struct hal_rx_desc *desc);
 +	u8* (*rx_desc_mpdu_start_addr2)(struct hal_rx_desc *desc);
 };
 extern const struct ath11k_hw_ops ipq8074_ops;
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -5380,7 +5380,8 @@ static void ath11k_mac_op_update_vif_off
 	if (ath11k_frame_mode != ATH11K_HW_TXRX_ETHERNET ||
 	    (vif->type != NL80211_IFTYPE_STATION &&
 	     vif->type != NL80211_IFTYPE_AP))
 -		vif->offload_flags &= ~IEEE80211_OFFLOAD_ENCAP_ENABLED;
 +		vif->offload_flags &= ~(IEEE80211_OFFLOAD_ENCAP_ENABLED |
 +					IEEE80211_OFFLOAD_DECAP_ENABLED);
 	if (vif->offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED)
 		param_value = ATH11K_HW_TXRX_ETHERNET;
@@ -5396,6 +5397,22 @@ static void ath11k_mac_op_update_vif_off
 			    arvif->vdev_id, ret);
 		vif->offload_flags &= ~IEEE80211_OFFLOAD_ENCAP_ENABLED;
 	}
 +
 +	param_id = WMI_VDEV_PARAM_RX_DECAP_TYPE;
 +	if (vif->offload_flags & IEEE80211_OFFLOAD_DECAP_ENABLED)
 +		param_value = ATH11K_HW_TXRX_ETHERNET;
 +	else if (test_bit(ATH11K_FLAG_RAW_MODE, &ab->dev_flags))
 +		param_value = ATH11K_HW_TXRX_RAW;
 +	else
 +		param_value = ATH11K_HW_TXRX_NATIVE_WIFI;
 +
 +	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id,
 +					    param_id, param_value);
 +	if (ret) {
 +		ath11k_warn(ab, "failed to set vdev %d rx decap mode: %d\n",
 +			    arvif->vdev_id, ret);
 +		vif->offload_flags &= ~IEEE80211_OFFLOAD_DECAP_ENABLED;
 +	}
 }
 static int ath11k_mac_op_add_interface(struct ieee80211_hw *hw,
@@ -7560,7 +7577,11 @@ static int __ath11k_mac_register(struct
 	ieee80211_hw_set(ar->hw, QUEUE_CONTROL);
 	ieee80211_hw_set(ar->hw, SUPPORTS_TX_FRAG);
 	ieee80211_hw_set(ar->hw, REPORTS_LOW_ACK);
 -	ieee80211_hw_set(ar->hw, SUPPORTS_TX_ENCAP_OFFLOAD);
 +
 +	if (ath11k_frame_mode == ATH11K_HW_TXRX_ETHERNET) {
 +		ieee80211_hw_set(ar->hw, SUPPORTS_TX_ENCAP_OFFLOAD);
 +		ieee80211_hw_set(ar->hw, SUPPORTS_RX_DECAP_OFFLOAD);
 +	}
 	if (cap->nss_ratio_enabled)
 		ieee80211_hw_set(ar->hw, SUPPORTS_VHT_EXT_NSS_BW);
--- a/package/kernel/mac80211/patches/ath11k/0023-wifi-ath11k-initialize-hw_ops-for-IPQ5018.patch
+++ b/package/kernel/mac80211/patches/ath11k/0023-wifi-ath11k-initialize-hw_ops-for-IPQ5018.patch
@ -0,0 +1,90 @@
 From ba60f2793d3a37a00da14bb56a26558a902d2831 Mon Sep 17 00:00:00 2001
 From: Sriram R <quic_srirrama@quicinc.com>
 Date: Fri, 2 Dec 2022 23:37:14 +0200
 Subject: [PATCH] wifi: ath11k: initialize hw_ops for IPQ5018
 The ipq5018_ops is initialized for IPQ5018. This is different from
 other platforms.
 Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
 Co-developed-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
 Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20221122132152.17771-7-quic_kathirve@quicinc.com
 ---
 drivers/net/wireless/ath/ath11k/core.c |  1 +
 drivers/net/wireless/ath/ath11k/hw.c   | 40 ++++++++++++++++++++++++++
 drivers/net/wireless/ath/ath11k/hw.h   |  1 +
 3 files changed, 42 insertions(+)
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
@@ -635,6 +635,7 @@ static const struct ath11k_hw_params ath
 		},
 		.internal_sleep_clock = false,
 		.regs = &ipq5018_regs,
 +		.hw_ops = &ipq5018_ops,
 		.host_ce_config = ath11k_host_ce_config_qcn9074,
 		.ce_count = CE_CNT_5018,
 		.target_ce_config = ath11k_target_ce_config_wlan_ipq5018,
 --- a/drivers/net/wireless/ath/ath11k/hw.c
 +++ b/drivers/net/wireless/ath/ath11k/hw.c
@@ -1084,6 +1084,46 @@ const struct ath11k_hw_ops wcn6750_ops =
 	.get_ring_selector = ath11k_hw_wcn6750_get_tcl_ring_selector,
 };
 +/* IPQ5018 hw ops is similar to QCN9074 except for the dest ring remap */
 +const struct ath11k_hw_ops ipq5018_ops = {
 +	.get_hw_mac_from_pdev_id = ath11k_hw_ipq6018_mac_from_pdev_id,
 +	.wmi_init_config = ath11k_init_wmi_config_ipq8074,
 +	.mac_id_to_pdev_id = ath11k_hw_mac_id_to_pdev_id_ipq8074,
 +	.mac_id_to_srng_id = ath11k_hw_mac_id_to_srng_id_ipq8074,
 +	.tx_mesh_enable = ath11k_hw_qcn9074_tx_mesh_enable,
 +	.rx_desc_get_first_msdu = ath11k_hw_qcn9074_rx_desc_get_first_msdu,
 +	.rx_desc_get_last_msdu = ath11k_hw_qcn9074_rx_desc_get_last_msdu,
 +	.rx_desc_get_l3_pad_bytes = ath11k_hw_qcn9074_rx_desc_get_l3_pad_bytes,
 +	.rx_desc_get_hdr_status = ath11k_hw_qcn9074_rx_desc_get_hdr_status,
 +	.rx_desc_encrypt_valid = ath11k_hw_qcn9074_rx_desc_encrypt_valid,
 +	.rx_desc_get_encrypt_type = ath11k_hw_qcn9074_rx_desc_get_encrypt_type,
 +	.rx_desc_get_decap_type = ath11k_hw_qcn9074_rx_desc_get_decap_type,
 +	.rx_desc_get_mesh_ctl = ath11k_hw_qcn9074_rx_desc_get_mesh_ctl,
 +	.rx_desc_get_ldpc_support = ath11k_hw_qcn9074_rx_desc_get_ldpc_support,
 +	.rx_desc_get_mpdu_seq_ctl_vld = ath11k_hw_qcn9074_rx_desc_get_mpdu_seq_ctl_vld,
 +	.rx_desc_get_mpdu_fc_valid = ath11k_hw_qcn9074_rx_desc_get_mpdu_fc_valid,
 +	.rx_desc_get_mpdu_start_seq_no = ath11k_hw_qcn9074_rx_desc_get_mpdu_start_seq_no,
 +	.rx_desc_get_msdu_len = ath11k_hw_qcn9074_rx_desc_get_msdu_len,
 +	.rx_desc_get_msdu_sgi = ath11k_hw_qcn9074_rx_desc_get_msdu_sgi,
 +	.rx_desc_get_msdu_rate_mcs = ath11k_hw_qcn9074_rx_desc_get_msdu_rate_mcs,
 +	.rx_desc_get_msdu_rx_bw = ath11k_hw_qcn9074_rx_desc_get_msdu_rx_bw,
 +	.rx_desc_get_msdu_freq = ath11k_hw_qcn9074_rx_desc_get_msdu_freq,
 +	.rx_desc_get_msdu_pkt_type = ath11k_hw_qcn9074_rx_desc_get_msdu_pkt_type,
 +	.rx_desc_get_msdu_nss = ath11k_hw_qcn9074_rx_desc_get_msdu_nss,
 +	.rx_desc_get_mpdu_tid = ath11k_hw_qcn9074_rx_desc_get_mpdu_tid,
 +	.rx_desc_get_mpdu_peer_id = ath11k_hw_qcn9074_rx_desc_get_mpdu_peer_id,
 +	.rx_desc_copy_attn_end_tlv = ath11k_hw_qcn9074_rx_desc_copy_attn_end,
 +	.rx_desc_get_mpdu_start_tag = ath11k_hw_qcn9074_rx_desc_get_mpdu_start_tag,
 +	.rx_desc_get_mpdu_ppdu_id = ath11k_hw_qcn9074_rx_desc_get_mpdu_ppdu_id,
 +	.rx_desc_set_msdu_len = ath11k_hw_qcn9074_rx_desc_set_msdu_len,
 +	.rx_desc_get_attention = ath11k_hw_qcn9074_rx_desc_get_attention,
 +	.rx_desc_get_msdu_payload = ath11k_hw_qcn9074_rx_desc_get_msdu_payload,
 +	.mpdu_info_get_peerid = ath11k_hw_ipq8074_mpdu_info_get_peerid,
 +	.rx_desc_mac_addr2_valid = ath11k_hw_ipq9074_rx_desc_mac_addr2_valid,
 +	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq9074_rx_desc_mpdu_start_addr2,
 +
 +};
 +
 #define ATH11K_TX_RING_MASK_0 BIT(0)
 #define ATH11K_TX_RING_MASK_1 BIT(1)
 #define ATH11K_TX_RING_MASK_2 BIT(2)
 --- a/drivers/net/wireless/ath/ath11k/hw.h
 +++ b/drivers/net/wireless/ath/ath11k/hw.h
@@ -275,6 +275,7 @@ extern const struct ath11k_hw_ops qca639
 extern const struct ath11k_hw_ops qcn9074_ops;
 extern const struct ath11k_hw_ops wcn6855_ops;
 extern const struct ath11k_hw_ops wcn6750_ops;
 +extern const struct ath11k_hw_ops ipq5018_ops;
 extern const struct ath11k_hw_ring_mask ath11k_hw_ring_mask_ipq8074;
 extern const struct ath11k_hw_ring_mask ath11k_hw_ring_mask_qca6390;
--- a/package/kernel/mac80211/patches/ath11k/0024-ath11k-Fix-pktlog-lite-rx-events.patch
+++ b/package/kernel/mac80211/patches/ath11k/0024-ath11k-Fix-pktlog-lite-rx-events.patch
@ -1,186 +0,0 @@
 From ab18e3bc1c138f2b4358c6905a45afb7289d5086 Mon Sep 17 00:00:00 2001
 From: Anilkumar Kolli <akolli@codeaurora.org>
 Date: Tue, 28 Sep 2021 12:05:40 +0300
 Subject: [PATCH] ath11k: Fix pktlog lite rx events
 Fix sending rx_buf_sz to ath11k_dp_tx_htt_rx_filter_setup()
 to enable pktlog full or lite mode. Depending on mode update the
 trace buffer with log type full/lite.
 Pktlog lite is a lighter version of pktlog. This can be used to capture
 PPDU stats. These are useful for firmware performance debugging.
 pktlog lite dumps are enabled using,
  echo "0x0 1" > ath11k/IPQ8074 hw2.0/mac0/pktlog_filter
 Tested On: IPQ8074 hw2.0 AHB WLAN.HK.2.1.0.1-01233-QCAHKSWPL_SILICONZ-1 v2
 Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210721212029.142388-1-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/debugfs.c | 25 +++++++++++++++++++----
 drivers/net/wireless/ath/ath11k/dp.h      |  1 +
 drivers/net/wireless/ath/ath11k/dp_rx.c   | 16 ++++++++++++---
 drivers/net/wireless/ath/ath11k/trace.h   | 11 ++++++----
 4 files changed, 42 insertions(+), 11 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/debugfs.c
 +++ b/drivers/net/wireless/ath/ath11k/debugfs.c
@@ -902,7 +902,7 @@ static ssize_t ath11k_write_pktlog_filte
 	struct htt_rx_ring_tlv_filter tlv_filter = {0};
 	u32 rx_filter = 0, ring_id, filter, mode;
 	u8 buf[128] = {0};
 -	int i, ret;
 +	int i, ret, rx_buf_sz = 0;
 	ssize_t rc;
 	mutex_lock(&ar->conf_mutex);
@@ -940,6 +940,17 @@ static ssize_t ath11k_write_pktlog_filte
 		}
 	}
 +	/* Clear rx filter set for monitor mode and rx status */
 +	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
 +		ring_id = ar->dp.rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
 +		ret = ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id, ar->dp.mac_id,
 +						       HAL_RXDMA_MONITOR_STATUS,
 +						       rx_buf_sz, &tlv_filter);
 +		if (ret) {
 +			ath11k_warn(ar->ab, "failed to set rx filter for monitor status ring\n");
 +			goto out;
 +		}
 +	}
 #define HTT_RX_FILTER_TLV_LITE_MODE \
 			(HTT_RX_FILTER_TLV_FLAGS_PPDU_START | \
 			HTT_RX_FILTER_TLV_FLAGS_PPDU_END | \
@@ -955,6 +966,7 @@ static ssize_t ath11k_write_pktlog_filte
 			    HTT_RX_FILTER_TLV_FLAGS_MPDU_END |
 			    HTT_RX_FILTER_TLV_FLAGS_PACKET_HEADER |
 			    HTT_RX_FILTER_TLV_FLAGS_ATTENTION;
 +		rx_buf_sz = DP_RX_BUFFER_SIZE;
 	} else if (mode == ATH11K_PKTLOG_MODE_LITE) {
 		ret = ath11k_dp_tx_htt_h2t_ppdu_stats_req(ar,
 							  HTT_PPDU_STATS_TAG_PKTLOG);
@@ -964,7 +976,12 @@ static ssize_t ath11k_write_pktlog_filte
 		}
 		rx_filter = HTT_RX_FILTER_TLV_LITE_MODE;
 +		rx_buf_sz = DP_RX_BUFFER_SIZE_LITE;
 	} else {
 +		rx_buf_sz = DP_RX_BUFFER_SIZE;
 +		tlv_filter = ath11k_mac_mon_status_filter_default;
 +		rx_filter = tlv_filter.rx_filter;
 +
 		ret = ath11k_dp_tx_htt_h2t_ppdu_stats_req(ar,
 							  HTT_PPDU_STATS_TAG_DEFAULT);
 		if (ret) {
@@ -988,7 +1005,7 @@ static ssize_t ath11k_write_pktlog_filte
 		ret = ath11k_dp_tx_htt_rx_filter_setup(ab, ring_id,
 						       ar->dp.mac_id + i,
 						       HAL_RXDMA_MONITOR_STATUS,
 -						       DP_RX_BUFFER_SIZE, &tlv_filter);
 +						       rx_buf_sz, &tlv_filter);
 		if (ret) {
 			ath11k_warn(ab, "failed to set rx filter for monitor status ring\n");
@@ -996,8 +1013,8 @@ static ssize_t ath11k_write_pktlog_filte
 		}
 	}
 -	ath11k_dbg(ab, ATH11K_DBG_WMI, "pktlog filter %d mode %s\n",
 -		   filter, ((mode == ATH11K_PKTLOG_MODE_FULL) ? "full" : "lite"));
 +	ath11k_info(ab, "pktlog mode %s\n",
 +		    ((mode == ATH11K_PKTLOG_MODE_FULL) ? "full" : "lite"));
 	ar->debug.pktlog_filter = filter;
 	ar->debug.pktlog_mode = mode;
 --- a/drivers/net/wireless/ath/ath11k/dp.h
 +++ b/drivers/net/wireless/ath/ath11k/dp.h
@@ -195,6 +195,7 @@ struct ath11k_pdev_dp {
 #define DP_RXDMA_MONITOR_DESC_RING_SIZE	4096
 #define DP_RX_BUFFER_SIZE	2048
 +#define	DP_RX_BUFFER_SIZE_LITE  1024
 #define DP_RX_BUFFER_ALIGN_SIZE	128
 #define DP_RXDMA_BUF_COOKIE_BUF_ID	GENMASK(17, 0)
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
@@ -3033,6 +3033,8 @@ int ath11k_dp_rx_process_mon_status(stru
 	struct ath11k_peer *peer;
 	struct ath11k_sta *arsta;
 	int num_buffs_reaped = 0;
 +	u32 rx_buf_sz;
 +	u16 log_type = 0;
 	__skb_queue_head_init(&skb_list);
@@ -3045,8 +3047,16 @@ int ath11k_dp_rx_process_mon_status(stru
 		memset(&ppdu_info, 0, sizeof(ppdu_info));
 		ppdu_info.peer_id = HAL_INVALID_PEERID;
 -		if (ath11k_debugfs_is_pktlog_rx_stats_enabled(ar))
 -			trace_ath11k_htt_rxdesc(ar, skb->data, DP_RX_BUFFER_SIZE);
 +		if (ath11k_debugfs_is_pktlog_lite_mode_enabled(ar)) {
 +			log_type = ATH11K_PKTLOG_TYPE_LITE_RX;
 +			rx_buf_sz = DP_RX_BUFFER_SIZE_LITE;
 +		} else if (ath11k_debugfs_is_pktlog_rx_stats_enabled(ar)) {
 +			log_type = ATH11K_PKTLOG_TYPE_RX_STATBUF;
 +			rx_buf_sz = DP_RX_BUFFER_SIZE;
 +		}
 +
 +		if (log_type)
 +			trace_ath11k_htt_rxdesc(ar, skb->data, log_type, rx_buf_sz);
 		hal_status = ath11k_hal_rx_parse_mon_status(ab, &ppdu_info, skb);
@@ -3074,7 +3084,7 @@ int ath11k_dp_rx_process_mon_status(stru
 		ath11k_dp_rx_update_peer_stats(arsta, &ppdu_info);
 		if (ath11k_debugfs_is_pktlog_peer_valid(ar, peer->addr))
 -			trace_ath11k_htt_rxdesc(ar, skb->data, DP_RX_BUFFER_SIZE);
 +			trace_ath11k_htt_rxdesc(ar, skb->data, log_type, rx_buf_sz);
 		spin_unlock_bh(&ab->base_lock);
 		rcu_read_unlock();
 --- a/drivers/net/wireless/ath/ath11k/trace.h
 +++ b/drivers/net/wireless/ath/ath11k/trace.h
@@ -79,14 +79,15 @@ TRACE_EVENT(ath11k_htt_ppdu_stats,
 );
 TRACE_EVENT(ath11k_htt_rxdesc,
 -	    TP_PROTO(struct ath11k *ar, const void *data, size_t len),
 +	    TP_PROTO(struct ath11k *ar, const void *data, size_t log_type, size_t len),
 -	TP_ARGS(ar, data, len),
 +	TP_ARGS(ar, data, log_type, len),
 	TP_STRUCT__entry(
 		__string(device, dev_name(ar->ab->dev))
 		__string(driver, dev_driver_string(ar->ab->dev))
 		__field(u16, len)
 +		__field(u16, log_type)
 		__dynamic_array(u8, rxdesc, len)
 	),
@@ -94,14 +95,16 @@ TRACE_EVENT(ath11k_htt_rxdesc,
 		__assign_str(device, dev_name(ar->ab->dev));
 		__assign_str(driver, dev_driver_string(ar->ab->dev));
 		__entry->len = len;
 +		__entry->log_type = log_type;
 		memcpy(__get_dynamic_array(rxdesc), data, len);
 	),
 	TP_printk(
 -		"%s %s rxdesc len %d",
 +		"%s %s rxdesc len %d type %d",
 		__get_str(driver),
 		__get_str(device),
 -		__entry->len
 +		__entry->len,
 +		__entry->log_type
 	 )
 );
--- a/package/kernel/mac80211/patches/ath11k/0024-wifi-ath11k-add-new-hw-ops-for-IPQ5018-to-get-rx-des.patch
+++ b/package/kernel/mac80211/patches/ath11k/0024-wifi-ath11k-add-new-hw-ops-for-IPQ5018-to-get-rx-des.patch
@ -0,0 +1,84 @@
 From 69968f88f1770d61cae0febef805fd00d66cf6a1 Mon Sep 17 00:00:00 2001
 From: Sriram R <quic_srirrama@quicinc.com>
 Date: Fri, 2 Dec 2022 23:37:15 +0200
 Subject: [PATCH] wifi: ath11k: add new hw ops for IPQ5018 to get rx dest ring
 hashmap
 The Destination ring control register is different
 for IPQ5018 when compared to IPQ8074/IPQ6018/QCN9074.
 Hence create a new hw ops to fetch the hash ring map
 for different device variants. ipq5018 hw ops
 is similar to qcn9074 except for this change, so reuse
 all the qcn9074 ops for ipq5018.
 Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
 Co-developed-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
 Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20221122132152.17771-8-quic_kathirve@quicinc.com
 ---
 drivers/net/wireless/ath/ath11k/hw.c | 44 ++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)
 --- a/drivers/net/wireless/ath/ath11k/hw.c
 +++ b/drivers/net/wireless/ath/ath11k/hw.c
@@ -791,6 +791,49 @@ static void ath11k_hw_wcn6855_reo_setup(
 			   ring_hash_map);
 }
 +static void ath11k_hw_ipq5018_reo_setup(struct ath11k_base *ab)
 +{
 +	u32 reo_base = HAL_SEQ_WCSS_UMAC_REO_REG;
 +	u32 val;
 +
 +	/* Each hash entry uses three bits to map to a particular ring. */
 +	u32 ring_hash_map = HAL_HASH_ROUTING_RING_SW1 << 0 |
 +		HAL_HASH_ROUTING_RING_SW2 << 4 |
 +		HAL_HASH_ROUTING_RING_SW3 << 8 |
 +		HAL_HASH_ROUTING_RING_SW4 << 12 |
 +		HAL_HASH_ROUTING_RING_SW1 << 16 |
 +		HAL_HASH_ROUTING_RING_SW2 << 20 |
 +		HAL_HASH_ROUTING_RING_SW3 << 24 |
 +		HAL_HASH_ROUTING_RING_SW4 << 28;
 +
 +	val = ath11k_hif_read32(ab, reo_base + HAL_REO1_GEN_ENABLE);
 +
 +	val &= ~HAL_REO1_GEN_ENABLE_FRAG_DST_RING;
 +	val |= FIELD_PREP(HAL_REO1_GEN_ENABLE_FRAG_DST_RING,
 +			HAL_SRNG_RING_ID_REO2SW1) |
 +		FIELD_PREP(HAL_REO1_GEN_ENABLE_AGING_LIST_ENABLE, 1) |
 +		FIELD_PREP(HAL_REO1_GEN_ENABLE_AGING_FLUSH_ENABLE, 1);
 +	ath11k_hif_write32(ab, reo_base + HAL_REO1_GEN_ENABLE, val);
 +
 +	ath11k_hif_write32(ab, reo_base + HAL_REO1_AGING_THRESH_IX_0(ab),
 +			   HAL_DEFAULT_REO_TIMEOUT_USEC);
 +	ath11k_hif_write32(ab, reo_base + HAL_REO1_AGING_THRESH_IX_1(ab),
 +			   HAL_DEFAULT_REO_TIMEOUT_USEC);
 +	ath11k_hif_write32(ab, reo_base + HAL_REO1_AGING_THRESH_IX_2(ab),
 +			   HAL_DEFAULT_REO_TIMEOUT_USEC);
 +	ath11k_hif_write32(ab, reo_base + HAL_REO1_AGING_THRESH_IX_3(ab),
 +			   HAL_DEFAULT_REO_TIMEOUT_USEC);
 +
 +	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_0,
 +			   ring_hash_map);
 +	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_1,
 +			   ring_hash_map);
 +	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_2,
 +			   ring_hash_map);
 +	ath11k_hif_write32(ab, reo_base + HAL_REO1_DEST_RING_CTRL_IX_3,
 +			   ring_hash_map);
 +}
 +
 static u16 ath11k_hw_ipq8074_mpdu_info_get_peerid(u8 *tlv_data)
 {
 	u16 peer_id = 0;
@@ -1117,6 +1160,7 @@ const struct ath11k_hw_ops ipq5018_ops =
 	.rx_desc_get_mpdu_ppdu_id = ath11k_hw_qcn9074_rx_desc_get_mpdu_ppdu_id,
 	.rx_desc_set_msdu_len = ath11k_hw_qcn9074_rx_desc_set_msdu_len,
 	.rx_desc_get_attention = ath11k_hw_qcn9074_rx_desc_get_attention,
 +	.reo_setup = ath11k_hw_ipq5018_reo_setup,
 	.rx_desc_get_msdu_payload = ath11k_hw_qcn9074_rx_desc_get_msdu_payload,
 	.mpdu_info_get_peerid = ath11k_hw_ipq8074_mpdu_info_get_peerid,
 	.rx_desc_mac_addr2_valid = ath11k_hw_ipq9074_rx_desc_mac_addr2_valid,
--- a/package/kernel/mac80211/patches/ath11k/0025-ath11k-Update-pdev-tx-and-rx-firmware-stats.patch
+++ b/package/kernel/mac80211/patches/ath11k/0025-ath11k-Update-pdev-tx-and-rx-firmware-stats.patch
@ -1,250 +0,0 @@
 From f394e4eae8e2c0579063e5473f1e321d22d3fe43 Mon Sep 17 00:00:00 2001
 From: Sriram R <srirrama@codeaurora.org>
 Date: Tue, 28 Sep 2021 12:05:40 +0300
 Subject: [PATCH] ath11k: Update pdev tx and rx firmware stats
 Update the fields of pdev tx and tx firmware stats structure.
 Missing fields resulted in wrong fw stats to be displayed as below.
 root@OpenWrt:/# cat /sys/kernel/debug/ath11k/
 		ipq8074\ hw2.0/mac0/fw_stats/pdev_stats | grep Illegal
 Illegal rate phy errors   36839112
 Note that this struct was missing its members from initial driver
 support and this change doesn't introduce/modify the structure for
 firmware changes.
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01734-QCAHKSWPL_SILICONZ-1 v2
 Signed-off-by: Sriram R <srirrama@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210721212029.142388-2-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/core.h | 29 ++++++++++++++++++
 drivers/net/wireless/ath/ath11k/wmi.c  | 41 ++++++++++++++++++++++++-
 drivers/net/wireless/ath/ath11k/wmi.h  | 42 ++++++++++++++++++++++++++
 3 files changed, 111 insertions(+), 1 deletion(-)
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
@@ -819,12 +819,15 @@ struct ath11k_fw_stats_pdev {
 	s32 hw_reaped;
 	/* Num underruns */
 	s32 underrun;
 +	/* Num hw paused */
 +	u32 hw_paused;
 	/* Num PPDUs cleaned up in TX abort */
 	s32 tx_abort;
 	/* Num MPDUs requeued by SW */
 	s32 mpdus_requeued;
 	/* excessive retries */
 	u32 tx_ko;
 +	u32 tx_xretry;
 	/* data hw rate code */
 	u32 data_rc;
 	/* Scheduler self triggers */
@@ -845,6 +848,30 @@ struct ath11k_fw_stats_pdev {
 	u32 phy_underrun;
 	/* MPDU is more than txop limit */
 	u32 txop_ovf;
 +	/* Num sequences posted */
 +	u32 seq_posted;
 +	/* Num sequences failed in queueing */
 +	u32 seq_failed_queueing;
 +	/* Num sequences completed */
 +	u32 seq_completed;
 +	/* Num sequences restarted */
 +	u32 seq_restarted;
 +	/* Num of MU sequences posted */
 +	u32 mu_seq_posted;
 +	/* Num MPDUs flushed by SW, HWPAUSED, SW TXABORT
 +	 * (Reset,channel change)
 +	 */
 +	s32 mpdus_sw_flush;
 +	/* Num MPDUs filtered by HW, all filter condition (TTL expired) */
 +	s32 mpdus_hw_filter;
 +	/* Num MPDUs truncated by PDG (TXOP, TBTT,
 +	 * PPDU_duration based on rate, dyn_bw)
 +	 */
 +	s32 mpdus_truncated;
 +	/* Num MPDUs that was tried but didn't receive ACK or BA */
 +	s32 mpdus_ack_failed;
 +	/* Num MPDUs that was dropped du to expiry. */
 +	s32 mpdus_expired;
 	/* PDEV RX stats */
 	/* Cnts any change in ring routing mid-ppdu */
@@ -870,6 +897,8 @@ struct ath11k_fw_stats_pdev {
 	s32 phy_err_drop;
 	/* Number of mpdu errors - FCS, MIC, ENC etc. */
 	s32 mpdu_errs;
 +	/* Num overflow errors */
 +	s32 rx_ovfl_errs;
 };
 struct ath11k_fw_stats_vdev {
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -5252,9 +5252,11 @@ ath11k_wmi_pull_pdev_stats_tx(const stru
 	dst->hw_queued = src->hw_queued;
 	dst->hw_reaped = src->hw_reaped;
 	dst->underrun = src->underrun;
 +	dst->hw_paused = src->hw_paused;
 	dst->tx_abort = src->tx_abort;
 	dst->mpdus_requeued = src->mpdus_requeued;
 	dst->tx_ko = src->tx_ko;
 +	dst->tx_xretry = src->tx_xretry;
 	dst->data_rc = src->data_rc;
 	dst->self_triggers = src->self_triggers;
 	dst->sw_retry_failure = src->sw_retry_failure;
@@ -5265,6 +5267,16 @@ ath11k_wmi_pull_pdev_stats_tx(const stru
 	dst->stateless_tid_alloc_failure = src->stateless_tid_alloc_failure;
 	dst->phy_underrun = src->phy_underrun;
 	dst->txop_ovf = src->txop_ovf;
 +	dst->seq_posted = src->seq_posted;
 +	dst->seq_failed_queueing = src->seq_failed_queueing;
 +	dst->seq_completed = src->seq_completed;
 +	dst->seq_restarted = src->seq_restarted;
 +	dst->mu_seq_posted = src->mu_seq_posted;
 +	dst->mpdus_sw_flush = src->mpdus_sw_flush;
 +	dst->mpdus_hw_filter = src->mpdus_hw_filter;
 +	dst->mpdus_truncated = src->mpdus_truncated;
 +	dst->mpdus_ack_failed = src->mpdus_ack_failed;
 +	dst->mpdus_expired = src->mpdus_expired;
 }
 static void ath11k_wmi_pull_pdev_stats_rx(const struct wmi_pdev_stats_rx *src,
@@ -5284,6 +5296,7 @@ static void ath11k_wmi_pull_pdev_stats_r
 	dst->phy_errs = src->phy_errs;
 	dst->phy_err_drop = src->phy_err_drop;
 	dst->mpdu_errs = src->mpdu_errs;
 +	dst->rx_ovfl_errs = src->rx_ovfl_errs;
 }
 static void
@@ -5521,11 +5534,15 @@ ath11k_wmi_fw_pdev_tx_stats_fill(const s
 	len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
 			 "Num underruns", pdev->underrun);
 	len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
 +			 "Num HW Paused", pdev->hw_paused);
 +	len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
 			 "PPDUs cleaned", pdev->tx_abort);
 	len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
 			 "MPDUs requeued", pdev->mpdus_requeued);
 	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
 -			 "Excessive retries", pdev->tx_ko);
 +			 "PPDU OK", pdev->tx_ko);
 +	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
 +			 "Excessive retries", pdev->tx_xretry);
 	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
 			 "HW rate", pdev->data_rc);
 	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
@@ -5549,6 +5566,26 @@ ath11k_wmi_fw_pdev_tx_stats_fill(const s
 			 "PHY underrun", pdev->phy_underrun);
 	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
 			 "MPDU is more than txop limit", pdev->txop_ovf);
 +	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
 +			 "Num sequences posted", pdev->seq_posted);
 +	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
 +			 "Num seq failed queueing ", pdev->seq_failed_queueing);
 +	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
 +			 "Num sequences completed ", pdev->seq_completed);
 +	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
 +			 "Num sequences restarted ", pdev->seq_restarted);
 +	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
 +			 "Num of MU sequences posted ", pdev->mu_seq_posted);
 +	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
 +			 "Num of MPDUS SW flushed ", pdev->mpdus_sw_flush);
 +	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
 +			 "Num of MPDUS HW filtered ", pdev->mpdus_hw_filter);
 +	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
 +			 "Num of MPDUS truncated ", pdev->mpdus_truncated);
 +	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
 +			 "Num of MPDUS ACK failed ", pdev->mpdus_ack_failed);
 +	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
 +			 "Num of MPDUS expired ", pdev->mpdus_expired);
 	*length = len;
 }
@@ -5593,6 +5630,8 @@ ath11k_wmi_fw_pdev_rx_stats_fill(const s
 			 "PHY errors drops", pdev->phy_err_drop);
 	len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
 			 "MPDU errors (FCS, MIC, ENC)", pdev->mpdu_errs);
 +	len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
 +			 "Overflow errors", pdev->rx_ovfl_errs);
 	*length = len;
 }
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
@@ -4223,6 +4223,9 @@ struct wmi_pdev_stats_tx {
 	/* Num underruns */
 	s32 underrun;
 +	/* Num hw paused */
 +	u32 hw_paused;
 +
 	/* Num PPDUs cleaned up in TX abort */
 	s32 tx_abort;
@@ -4232,6 +4235,8 @@ struct wmi_pdev_stats_tx {
 	/* excessive retries */
 	u32 tx_ko;
 +	u32 tx_xretry;
 +
 	/* data hw rate code */
 	u32 data_rc;
@@ -4261,6 +4266,40 @@ struct wmi_pdev_stats_tx {
 	/* MPDU is more than txop limit */
 	u32 txop_ovf;
 +
 +	/* Num sequences posted */
 +	u32 seq_posted;
 +
 +	/* Num sequences failed in queueing */
 +	u32 seq_failed_queueing;
 +
 +	/* Num sequences completed */
 +	u32 seq_completed;
 +
 +	/* Num sequences restarted */
 +	u32 seq_restarted;
 +
 +	/* Num of MU sequences posted */
 +	u32 mu_seq_posted;
 +
 +	/* Num MPDUs flushed by SW, HWPAUSED, SW TXABORT
 +	 * (Reset,channel change)
 +	 */
 +	s32 mpdus_sw_flush;
 +
 +	/* Num MPDUs filtered by HW, all filter condition (TTL expired) */
 +	s32 mpdus_hw_filter;
 +
 +	/* Num MPDUs truncated by PDG (TXOP, TBTT,
 +	 * PPDU_duration based on rate, dyn_bw)
 +	 */
 +	s32 mpdus_truncated;
 +
 +	/* Num MPDUs that was tried but didn't receive ACK or BA */
 +	s32 mpdus_ack_failed;
 +
 +	/* Num MPDUs that was dropped du to expiry. */
 +	s32 mpdus_expired;
 } __packed;
 struct wmi_pdev_stats_rx {
@@ -4295,6 +4334,9 @@ struct wmi_pdev_stats_rx {
 	/* Number of mpdu errors - FCS, MIC, ENC etc. */
 	s32 mpdu_errs;
 +
 +	/* Num overflow errors */
 +	s32 rx_ovfl_errs;
 } __packed;
 struct wmi_pdev_stats {
--- a/package/kernel/mac80211/patches/ath11k/0025-wifi-ath11k-add-ipq5018-device-support.patch
+++ b/package/kernel/mac80211/patches/ath11k/0025-wifi-ath11k-add-ipq5018-device-support.patch
@ -0,0 +1,31 @@
 From 25edca7bb18a2a40cc7e54c6f522e9b3c917e2c5 Mon Sep 17 00:00:00 2001
 From: Sriram R <quic_srirrama@quicinc.com>
 Date: Fri, 2 Dec 2022 23:37:15 +0200
 Subject: [PATCH] wifi: ath11k: add ipq5018 device support
 ipq5018 is a ahb 2ghz device, enable the compatible support for
 ipq5018 in ahb.
 Tested-on: IPQ5018 hw1.0 AHB WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
 Co-developed-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
 Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20221122132152.17771-9-quic_kathirve@quicinc.com
 ---
 drivers/net/wireless/ath/ath11k/ahb.c | 3 +++
 1 file changed, 3 insertions(+)
 --- a/drivers/net/wireless/ath/ath11k/ahb.c
 +++ b/drivers/net/wireless/ath/ath11k/ahb.c
@@ -32,6 +32,9 @@ static const struct of_device_id ath11k_
 	{ .compatible = "qcom,wcn6750-wifi",
 	  .data = (void *)ATH11K_HW_WCN6750_HW10,
 	},
 +	{ .compatible = "qcom,ipq5018-wifi",
 +	  .data = (void *)ATH11K_HW_IPQ5018_HW10,
 +	},
 	{ }
 };
--- a/package/kernel/mac80211/patches/ath11k/0026-wifi-ath11k-Fix-scan-request-param-frame-size-warnin.patch
+++ b/package/kernel/mac80211/patches/ath11k/0026-wifi-ath11k-Fix-scan-request-param-frame-size-warnin.patch
@ -23,7 +23,7 @@ Link: https://lore.kernel.org/r/20221205192125.13533-1-quic_kathirve@quicinc.com
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -3597,7 +3597,7 @@ static int ath11k_mac_op_hw_scan(struct
+@@ -3612,7 +3612,7 @@ static int ath11k_mac_op_hw_scan(struct
 	struct ath11k *ar = hw->priv;
 	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
 	struct cfg80211_scan_request *req = &hw_req->req;
@ -32,7 +32,7 @@ Link: https://lore.kernel.org/r/20221205192125.13533-1-quic_kathirve@quicinc.com
 	int ret = 0;
 	int i;
 	u32 scan_timeout;
-@@ -3625,72 +3625,78 @@ static int ath11k_mac_op_hw_scan(struct
+@@ -3640,72 +3640,78 @@ static int ath11k_mac_op_hw_scan(struct
 	if (ret)
 		goto exit;
@ -143,7 +143,7 @@ Link: https://lore.kernel.org/r/20221205192125.13533-1-quic_kathirve@quicinc.com
 	if (ret) {
 		ath11k_warn(ar->ab, "failed to start hw scan: %d\n", ret);
 		spin_lock_bh(&ar->data_lock);
-@@ -3702,10 +3708,11 @@ static int ath11k_mac_op_hw_scan(struct
+@@ -3717,10 +3723,11 @@ static int ath11k_mac_op_hw_scan(struct
 				     msecs_to_jiffies(scan_timeout));
 exit:
--- a/package/kernel/mac80211/patches/ath11k/0028-ath11k-Add-vdev-start-flag-to-disable-hardware-encry.patch
+++ b/package/kernel/mac80211/patches/ath11k/0028-ath11k-Add-vdev-start-flag-to-disable-hardware-encry.patch
@ -1,47 +0,0 @@
 From 8717db7ee802b71fa3f2a79b265b1325bc61210c Mon Sep 17 00:00:00 2001
 From: Seevalamuthu Mariappan <seevalam@codeaurora.org>
 Date: Tue, 28 Sep 2021 12:05:40 +0300
 Subject: [PATCH] ath11k: Add vdev start flag to disable hardware encryption
 Firmware blocks all data traffic until the key is plumbed. But, with
 software encryption mode, key is never plumbed to firmware. Due to this,
 a traffic failure in software encryption mode has been observed. Hence,
 firmware has introduced a flag to differentiate software encryption
 mode. This flag can be passed during vdev_start command.
 Enable WMI_VDEV_START_HW_ENCRYPTION_DISABLED flag in vdev_start command
 to notify firmware to disable hardware encryption for a vdev. This is set
 if raw mode software encryption is enabled.
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01421-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210721212029.142388-5-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/wmi.c | 2 ++
 drivers/net/wireless/ath/ath11k/wmi.h | 1 +
 2 files changed, 3 insertions(+)
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -884,6 +884,8 @@ int ath11k_wmi_vdev_start(struct ath11k
 	}
 	cmd->flags |= WMI_VDEV_START_LDPC_RX_ENABLED;
 +	if (test_bit(ATH11K_FLAG_HW_CRYPTO_DISABLED, &ar->ab->dev_flags))
 +		cmd->flags |= WMI_VDEV_START_HW_ENCRYPTION_DISABLED;
 	ptr = skb->data + sizeof(*cmd);
 	chan = ptr;
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
@@ -2577,6 +2577,7 @@ struct wmi_vdev_down_cmd {
 #define WMI_VDEV_START_HIDDEN_SSID  BIT(0)
 #define WMI_VDEV_START_PMF_ENABLED  BIT(1)
 #define WMI_VDEV_START_LDPC_RX_ENABLED BIT(3)
 +#define WMI_VDEV_START_HW_ENCRYPTION_DISABLED BIT(4)
 struct wmi_ssid {
 	u32 ssid_len;
--- a/package/kernel/mac80211/patches/ath11k/0029-ath11k-Assign-free_vdev_map-value-before-ieee80211_r.patch
+++ b/package/kernel/mac80211/patches/ath11k/0029-ath11k-Assign-free_vdev_map-value-before-ieee80211_r.patch
@ -1,62 +0,0 @@
 From 3c79cb4d63c0d58462d439efa0db328008354deb Mon Sep 17 00:00:00 2001
 From: Seevalamuthu Mariappan <seevalam@codeaurora.org>
 Date: Tue, 28 Sep 2021 12:05:40 +0300
 Subject: [PATCH] ath11k: Assign free_vdev_map value before
 ieee80211_register_hw
 Firmware crash is seen randomly, because of sending wrong vdev_id
 in vdev_create command. This is due to free_vdev_map value being 0.
 free_vdev_map is getting assigned after ieee80211_register_hw. In
 some race conditions, add_interface api is getting called before
 assigning value to free_vdev_map. Fix this by assigning free_vdev_map
 before ieee80211_register_hw.
 Also, moved ar->cc_freq_hz and ar->txmgmt_idr initialization before
 ieee80211_register_hw to avoid such race conditions.
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-00948-QCAHKSWPL_SILICONZ-1
 Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01734-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210721212029.142388-6-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/mac.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -7711,6 +7711,10 @@ int ath11k_mac_register(struct ath11k_ba
 	if (test_bit(ATH11K_FLAG_REGISTERED, &ab->dev_flags))
 		return 0;
 +	/* Initialize channel counters frequency value in hertz */
 +	ab->cc_freq_hz = IPQ8074_CC_FREQ_HERTZ;
 +	ab->free_vdev_map = (1LL << (ab->num_radios * TARGET_NUM_VDEVS)) - 1;
 +
 	for (i = 0; i < ab->num_radios; i++) {
 		pdev = &ab->pdevs[i];
 		ar = pdev->ar;
@@ -7721,18 +7725,14 @@ int ath11k_mac_register(struct ath11k_ba
 			ar->mac_addr[4] += i;
 		}
 +		idr_init(&ar->txmgmt_idr);
 +		spin_lock_init(&ar->txmgmt_idr_lock);
 +
 		ret = __ath11k_mac_register(ar);
 		if (ret)
 			goto err_cleanup;
 -
 -		idr_init(&ar->txmgmt_idr);
 -		spin_lock_init(&ar->txmgmt_idr_lock);
 	}
 -	/* Initialize channel counters frequency value in hertz */
 -	ab->cc_freq_hz = IPQ8074_CC_FREQ_HERTZ;
 -	ab->free_vdev_map = (1LL << (ab->num_radios * TARGET_NUM_VDEVS)) - 1;
 -
 	return 0;
 err_cleanup:
--- a/package/kernel/mac80211/patches/ath11k/0029-wifi-ath11k-Add-support-to-configure-FTM-responder-r.patch
+++ b/package/kernel/mac80211/patches/ath11k/0029-wifi-ath11k-Add-support-to-configure-FTM-responder-r.patch
@ -0,0 +1,169 @@
 From a27c6a5853eb9d4f293b99be73a6891fe88263c7 Mon Sep 17 00:00:00 2001
 From: Sowmiya Sree Elavalagan <quic_ssreeela@quicinc.com>
 Date: Tue, 10 Jan 2023 15:30:57 +0200
 Subject: [PATCH] wifi: ath11k: Add support to configure FTM responder role
 Fine Timing Measurement(FTM) support is used to measure round trip
 time between two nodes.
 Enable FTM responder feature using hw_params on supported device.
 Since FTM functionality is offloaded to firmware, adding the
 interface allows user space to enable or disable FTM responder.
 Also add support for advertising the same in extended capabilities.
 QCA6390, WCN6855 and WCN6750 do not support this feature.
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
 Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Sowmiya Sree Elavalagan <quic_ssreeela@quicinc.com>
 Signed-off-by: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20221220044435.10506-1-quic_rajkbhag@quicinc.com
 ---
 drivers/net/wireless/ath/ath11k/core.c |  8 ++++++++
 drivers/net/wireless/ath/ath11k/core.h |  1 +
 drivers/net/wireless/ath/ath11k/hw.h   |  1 +
 drivers/net/wireless/ath/ath11k/mac.c  | 20 +++++++++++++++++++-
 drivers/net/wireless/ath/ath11k/wmi.h  |  1 +
 5 files changed, 30 insertions(+), 1 deletion(-)
 --- a/drivers/net/wireless/ath/ath11k/core.c
 +++ b/drivers/net/wireless/ath/ath11k/core.c
@@ -116,6 +116,7 @@ static const struct ath11k_hw_params ath
 		.tcl_ring_retry = true,
 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
 		.smp2p_wow_exit = false,
 +		.ftm_responder = true,
 	},
 	{
 		.hw_rev = ATH11K_HW_IPQ6018_HW10,
@@ -198,6 +199,7 @@ static const struct ath11k_hw_params ath
 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
 		.smp2p_wow_exit = false,
 		.support_fw_mac_sequence = false,
 +		.ftm_responder = true,
 	},
 	{
 		.name = "qca6390 hw2.0",
@@ -282,6 +284,7 @@ static const struct ath11k_hw_params ath
 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
 		.smp2p_wow_exit = false,
 		.support_fw_mac_sequence = true,
 +		.ftm_responder = false,
 	},
 	{
 		.name = "qcn9074 hw1.0",
@@ -363,6 +366,7 @@ static const struct ath11k_hw_params ath
 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
 		.smp2p_wow_exit = false,
 		.support_fw_mac_sequence = false,
 +		.ftm_responder = true,
 	},
 	{
 		.name = "wcn6855 hw2.0",
@@ -447,6 +451,7 @@ static const struct ath11k_hw_params ath
 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
 		.smp2p_wow_exit = false,
 		.support_fw_mac_sequence = true,
 +		.ftm_responder = false,
 	},
 	{
 		.name = "wcn6855 hw2.1",
@@ -529,6 +534,7 @@ static const struct ath11k_hw_params ath
 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
 		.smp2p_wow_exit = false,
 		.support_fw_mac_sequence = true,
 +		.ftm_responder = false,
 	},
 	{
 		.name = "wcn6750 hw1.0",
@@ -609,6 +615,7 @@ static const struct ath11k_hw_params ath
 		.tx_ring_size = DP_TCL_DATA_RING_SIZE_WCN6750,
 		.smp2p_wow_exit = true,
 		.support_fw_mac_sequence = true,
 +		.ftm_responder = false,
 	},
 	{
 		.hw_rev = ATH11K_HW_IPQ5018_HW10,
@@ -688,6 +695,7 @@ static const struct ath11k_hw_params ath
 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
 		.smp2p_wow_exit = false,
 		.support_fw_mac_sequence = false,
 +		.ftm_responder = true,
 	},
 };
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
@@ -346,6 +346,7 @@ struct ath11k_vif {
 	bool is_started;
 	bool is_up;
 +	bool ftm_responder;
 	bool spectral_enabled;
 	bool ps;
 	u32 aid;
 --- a/drivers/net/wireless/ath/ath11k/hw.h
 +++ b/drivers/net/wireless/ath/ath11k/hw.h
@@ -224,6 +224,7 @@ struct ath11k_hw_params {
 	u32 tx_ring_size;
 	bool smp2p_wow_exit;
 	bool support_fw_mac_sequence;
 +	bool ftm_responder;
 };
 struct ath11k_hw_ops {
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -3110,7 +3110,7 @@ static void ath11k_mac_op_bss_info_chang
 	u16 bitrate;
 	int ret = 0;
 	u8 rateidx;
 -	u32 rate;
 +	u32 rate, param;
 	u32 ipv4_cnt;
 	mutex_lock(&ar->conf_mutex);
@@ -3412,6 +3412,20 @@ static void ath11k_mac_op_bss_info_chang
 		}
 	}
 +	if (changed & BSS_CHANGED_FTM_RESPONDER &&
 +	    arvif->ftm_responder != info->ftm_responder &&
 +	    ar->ab->hw_params.ftm_responder &&
 +	    (vif->type == NL80211_IFTYPE_AP ||
 +	     vif->type == NL80211_IFTYPE_MESH_POINT)) {
 +		arvif->ftm_responder = info->ftm_responder;
 +		param = WMI_VDEV_PARAM_ENABLE_DISABLE_RTT_RESPONDER_ROLE;
 +		ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id, param,
 +						    arvif->ftm_responder);
 +		if (ret)
 +			ath11k_warn(ar->ab, "Failed to set ftm responder %i: %d\n",
 +				    arvif->vdev_id, ret);
 +	}
 +
 	if (changed & BSS_CHANGED_FILS_DISCOVERY ||
 	    changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP)
 		ath11k_mac_fils_discovery(arvif, info);
@@ -9113,6 +9127,10 @@ static int __ath11k_mac_register(struct
 	wiphy_ext_feature_set(ar->hw->wiphy,
 			      NL80211_EXT_FEATURE_SET_SCAN_DWELL);
 +	if (ab->hw_params.ftm_responder)
 +		wiphy_ext_feature_set(ar->hw->wiphy,
 +				      NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER);
 +
 	ath11k_reg_init(ar);
 	if (!test_bit(ATH11K_FLAG_RAW_MODE, &ab->dev_flags)) {
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
@@ -1073,6 +1073,7 @@ enum wmi_tlv_vdev_param {
 	WMI_VDEV_PARAM_ENABLE_BCAST_PROBE_RESPONSE,
 	WMI_VDEV_PARAM_FILS_MAX_CHANNEL_GUARD_TIME,
 	WMI_VDEV_PARAM_HE_LTF = 0x74,
 +	WMI_VDEV_PARAM_ENABLE_DISABLE_RTT_RESPONDER_ROLE = 0x7d,
 	WMI_VDEV_PARAM_BA_MODE = 0x7e,
 	WMI_VDEV_PARAM_AUTORATE_MISC_CFG = 0x80,
 	WMI_VDEV_PARAM_SET_HE_SOUNDING_MODE = 0x87,
--- a/package/kernel/mac80211/patches/ath11k/0030-ath11k-Fix-crash-during-firmware-recovery-on-reo-cmd.patch
+++ b/package/kernel/mac80211/patches/ath11k/0030-ath11k-Fix-crash-during-firmware-recovery-on-reo-cmd.patch
@ -1,63 +0,0 @@
 From 8ee8d38ca4727667e05a1dedf546162207bde9fa Mon Sep 17 00:00:00 2001
 From: Sriram R <srirrama@codeaurora.org>
 Date: Tue, 28 Sep 2021 12:05:40 +0300
 Subject: [PATCH] ath11k: Fix crash during firmware recovery on reo cmd ring
 access
 In scenario when a peer is disassociating, there could be
 multiple places where a reo cmd ring is accessed, such as
 during aggregation teardown, tid queue cleanup, etc.
 When this happens during firmware recovery where accessing of FW/HW
 resources/registers is not recommended, accessing reo cmd ring in
 this case could lead to crash or undefined behaviour.
 Hence avoid this by checking for corresponding flag to avoid
 accessing reo cmd ring during firmware recovery.
 Sample crash:
 [ 3936.456050] Unhandled fault: imprecise external abort (0x1c06) at 0x54bb842a
 [ 3936.456411] WARN: Access Violation!!!, Run "cat /sys/kernel/debug/qcom_debug_logs/tz_log" for more details
 [ 3936.467997] pgd = b4474000
 [ 3936.477440] [54bb842a] *pgd=6fa61831, *pte=7f95d59f, *ppte=7f95de7e
 <snip>
 [ 3937.177436] [<8030ab10>] (_raw_spin_unlock_bh) from [<7f5e9eb8>] (ath11k_hal_reo_cmd_send+0x440/0x458 [ath11k])
 [ 3937.185730] [<7f5e9eb8>] (ath11k_hal_reo_cmd_send [ath11k]) from [<7f601c4c>] (ath11k_dp_tx_send_reo_cmd+0x2c/0xcc [ath11k])
 [ 3937.195524] [<7f601c4c>] (ath11k_dp_tx_send_reo_cmd [ath11k]) from [<7f602f10>] (ath11k_peer_rx_tid_reo_update+0x84/0xbc [ath11k])
 [ 3937.206984] [<7f602f10>] (ath11k_peer_rx_tid_reo_update [ath11k]) from [<7f605a9c>] (ath11k_dp_rx_ampdu_stop+0xa8/0x130 [ath11k])
 [ 3937.218532] [<7f605a9c>] (ath11k_dp_rx_ampdu_stop [ath11k]) from [<7f5f6730>] (ath11k_mac_op_ampdu_action+0x6c/0x98 [ath11k])
 [ 3937.230250] [<7f5f6730>] (ath11k_mac_op_ampdu_action [ath11k]) from [<c7b6e890>] (___ieee80211_stop_rx_ba_session+0x98/0x144 [mac80211])
 [ 3937.241499] [<c7b6e890>] (___ieee80211_stop_rx_ba_session [mac80211]) from [<c7b6cdd8>] (ieee80211_sta_tear_down_BA_sessions+0x4c/0xf4 [)
 [ 3937.253833] [<c7b6cdd8>] (ieee80211_sta_tear_down_BA_sessions [mac80211]) from [<c7b63460>] (ieee80211_sta_eosp+0x5b8/0x960 [mac80211])
 [ 3937.266764] [<c7b63460>] (ieee80211_sta_eosp [mac80211]) from [<c7b66da8>] (__sta_info_flush+0x9c/0x134 [mac80211])
 [ 3937.278826] [<c7b66da8>] (__sta_info_flush [mac80211]) from [<c7b7bd00>] (ieee80211_stop_ap+0x14c/0x28c [mac80211])
 [ 3937.289240] [<c7b7bd00>] (ieee80211_stop_ap [mac80211]) from [<7f509cf0>] (__cfg80211_stop_ap+0x4c/0xd8 [cfg80211])
 [ 3937.299629] [<7f509cf0>] (__cfg80211_stop_ap [cfg80211]) from [<7f4dddec>] (cfg80211_leave+0x24/0x30 [cfg80211])
 [ 3937.310041] [<7f4dddec>] (cfg80211_leave [cfg80211]) from [<7f4de03c>] (cfg80211_netdev_notifier_call+0x174/0x48c [cfg80211])
 [ 3937.320457] [<7f4de03c>] (cfg80211_netdev_notifier_call [cfg80211]) from [<80339928>] (notifier_call_chain+0x40/0x68)
 [ 3937.331636] [<80339928>] (notifier_call_chain) from [<803399a8>] (raw_notifier_call_chain+0x14/0x1c)
 [ 3937.342221] [<803399a8>] (raw_notifier_call_chain) from [<8073bb00>] (call_netdevice_notifiers+0xc/0x14)
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.1.0.1-01240-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Sriram R <srirrama@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210721212029.142388-7-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/dp_tx.c | 3 +++
 1 file changed, 3 insertions(+)
 --- a/drivers/net/wireless/ath/ath11k/dp_tx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
@@ -622,6 +622,9 @@ int ath11k_dp_tx_send_reo_cmd(struct ath
 	struct hal_srng *cmd_ring;
 	int cmd_num;
 +	if (test_bit(ATH11K_FLAG_CRASH_FLUSH, &ab->dev_flags))
 +		return -ESHUTDOWN;
 +
 	cmd_ring = &ab->hal.srng_list[dp->reo_cmd_ring.ring_id];
 	cmd_num = ath11k_hal_reo_cmd_send(ab, cmd_ring, type, cmd);
--- a/package/kernel/mac80211/patches/ath11k/0030-wifi-ath11k-add-channel-177-into-5-GHz-channel-list.patch
+++ b/package/kernel/mac80211/patches/ath11k/0030-wifi-ath11k-add-channel-177-into-5-GHz-channel-list.patch
@ -0,0 +1,41 @@
 From e5e94d10c85653609a2893c8d0ef24a27471b68f Mon Sep 17 00:00:00 2001
 From: Wen Gong <quic_wgong@quicinc.com>
 Date: Tue, 10 Jan 2023 15:30:58 +0200
 Subject: [PATCH] wifi: ath11k: add channel 177 into 5 GHz channel list
 Add support for the 5 GHz channel 177 with center frequency 5885 MHz and
 operating class 125 per IEEE Std 802.11ax-2021, Table E-4.
 Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3
 Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20221220101912.30816-1-quic_wgong@quicinc.com
 ---
 drivers/net/wireless/ath/ath11k/core.h | 4 ++--
 drivers/net/wireless/ath/ath11k/mac.c  | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
@@ -521,8 +521,8 @@ struct ath11k_sta {
 #define ATH11K_MIN_5G_FREQ 4150
 #define ATH11K_MIN_6G_FREQ 5925
 #define ATH11K_MAX_6G_FREQ 7115
 -#define ATH11K_NUM_CHANS 101
 -#define ATH11K_MAX_5G_CHAN 173
 +#define ATH11K_NUM_CHANS 102
 +#define ATH11K_MAX_5G_CHAN 177
 enum ath11k_state {
 	ATH11K_STATE_OFF,
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -96,6 +96,7 @@ static const struct ieee80211_channel at
 	CHAN5G(165, 5825, 0),
 	CHAN5G(169, 5845, 0),
 	CHAN5G(173, 5865, 0),
 +	CHAN5G(177, 5885, 0),
 };
 static const struct ieee80211_channel ath11k_6ghz_channels[] = {
--- a/package/kernel/mac80211/patches/ath11k/0031-ath11k-Avoid-No-VIF-found-warning-message.patch
+++ b/package/kernel/mac80211/patches/ath11k/0031-ath11k-Avoid-No-VIF-found-warning-message.patch
@ -1,44 +0,0 @@
 From 79feedfea7793d91293ab72fac5fc66aae0c6a85 Mon Sep 17 00:00:00 2001
 From: Karthikeyan Periyasamy <periyasa@codeaurora.org>
 Date: Tue, 28 Sep 2021 12:05:41 +0300
 Subject: [PATCH] ath11k: Avoid "No VIF found" warning message
 Facing below warning prints when we do wifi down in multiple VAPs scenario.
 warning print:
 ath11k c000000.wifi: No VIF found for vdev 2
 ...
 ath11k c000000.wifi: No VIF found for vdev 0
 In ath11k_mac_get_arvif_by_vdev_id(), we iterate all the radio to get the
 arvif for the requested vdev_id through ath11k_mac_get_arvif().
 ath11k_mac_get_arvif() throws a warning message if the given vdev_id is
 not found in the given radio. So to avoid the warning message, add
 the allocated_vdev_map cross check against the given vdev_id before using
 ath11k_mac_get_arvif() to ensure that vdev_id is allocated in the
 given radio.
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01492-QCAHKSWPL_SILICONZ-1
 Tested-on: IPQ6018 hw1.0 AHB WLAN.HK.2.4.0.1-00330-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Karthikeyan Periyasamy <periyasa@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210721212029.142388-8-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/mac.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -501,7 +501,8 @@ struct ath11k_vif *ath11k_mac_get_arvif_
 	for (i = 0; i < ab->num_radios; i++) {
 		pdev = rcu_dereference(ab->pdevs_active[i]);
 -		if (pdev && pdev->ar) {
 +		if (pdev && pdev->ar &&
 +		    (pdev->ar->allocated_vdev_map & (1LL << vdev_id))) {
 			arvif = ath11k_mac_get_arvif(pdev->ar, vdev_id);
 			if (arvif)
 				return arvif;
--- a/package/kernel/mac80211/patches/ath11k/0031-wifi-ath11k-fix-ce-memory-mapping-for-ahb-devices.patch
+++ b/package/kernel/mac80211/patches/ath11k/0031-wifi-ath11k-fix-ce-memory-mapping-for-ahb-devices.patch
@ -0,0 +1,114 @@
 From 53a998c4d7284debd77734d01e1466e59a1d03b2 Mon Sep 17 00:00:00 2001
 From: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
 Date: Fri, 13 Jan 2023 12:02:09 +0530
 Subject: [PATCH] wifi: ath11k: fix ce memory mapping for ahb devices
 Currently ath11k_ahb module is not loaded successfully and the wifi
 interface is not created. Kernel trace is seen while loading the
 ath11k_ahb module. The issue is seen in all ath11k AHB devices except
 in IPQ5018.
 This happens because in ath11k_ahb_probe(), ab->mem_ce is initialized
 with the value of ab->mem. However, at this instant ab->mem is not
 yet set.
 Later, during write to a particular memory via ath11k_ahb_write32()
 this ab->mem_ce is used with particular offset. Since ab->mem_ce is
 not set properly this possibly leads to memory conflict to handle
 kernel paging request and the below trace is seen.
 [   93.035047] Unable to handle kernel paging request at virtual address ffff800100a00000
 [   93.035083] Mem abort info:
 [   93.041869]   ESR = 0x0000000096000045
 [   93.044561]   EC = 0x25: DABT (current EL), IL = 32 bits
 [   93.048377]   SET = 0, FnV = 0
 [   93.053840]   EA = 0, S1PTW = 0
 [   93.056704]   FSC = 0x05: level 1 translation fault
 [   93.059745] Data abort info:
 [   93.064603]   ISV = 0, ISS = 0x00000045
 [   93.067729]   CM = 0, WnR = 1
 [   93.071287] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000042219000
 [   93.074409] [ffff800100a00000] pgd=100000007ffff003, p4d=100000007ffff003, pud=0000000000000000
 [   93.081195] Internal error: Oops: 0000000096000045 [#1] PREEMPT SMP
 [   93.089598] Modules linked in: ath11k_ahb ath11k_pci ath11k qmi_helpers
 [   93.095851] CPU: 2 PID: 66 Comm: kworker/u8:3 Not tainted 6.1.0-rc8-wt-ath-658126-g58e4b9df840c-dirty #2
 [   93.102454] Hardware name: Qualcomm Technologies, Inc. IPQ8074/AP-HK14 (DT)
 [   93.112171] Workqueue: ath11k_qmi_driver_event ath11k_qmi_driver_event_work [ath11k]
 [   93.118856] pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
 [   93.126838] pc : ath11k_ahb_write32+0xc/0x18 [ath11k_ahb]
 [   93.133520] lr : ath11k_hal_srng_setup+0x860/0x8f0 [ath11k]
 [   93.139075] sp : ffff80000aaebb70
 [   93.144452] x29: ffff80000aaebb70 x28: 0000000000000020 x27: ffff80000aaebc50
 [   93.147934] x26: ffff000004923750 x25: ffff000004921200 x24: ffff000004928000
 [   93.155051] x23: 0000000000000020 x22: ffff000004930000 x21: ffff000004923200
 [   93.162170] x20: ffff000004920000 x19: 00000000eea00000 x18: ffff0000049200f0
 [   93.169288] x17: 0000000000000000 x16: 0000000000000000 x15: 000000000000025e
 [   93.176405] x14: ffff000003c414f0 x13: 0000000000000000 x12: 0000000000000008
 [   93.183524] x11: ffff000003c41488 x10: 0000000000000040 x9 : 0000000000000000
 [   93.190641] x8 : ffff80000a9dd100 x7 : 0000000000000000 x6 : 000000000000003f
 [   93.197759] x5 : ffff800100a00400 x4 : ffff8000031f4018 x3 : 0000000000000004
 [   93.204877] x2 : 0000000047b62000 x1 : ffff800100a00000 x0 : ffff800012000000
 [   93.211996] Call trace:
 [   93.219104]  ath11k_ahb_write32+0xc/0x18 [ath11k_ahb]
 [   93.221366]  ath11k_ce_init_ring+0x184/0x278 [ath11k]
 [   93.226576]  ath11k_ce_init_pipes+0x4c/0x1a0 [ath11k]
 [   93.231610]  ath11k_core_qmi_firmware_ready+0x3c/0x568 [ath11k]
 [   93.236646]  ath11k_qmi_driver_event_work+0x168/0x4f8 [ath11k]
 [   93.242376]  process_one_work+0x144/0x350
 [   93.248275]  worker_thread+0x120/0x430
 [   93.252352]  kthread+0xf4/0x110
 [   93.255997]  ret_from_fork+0x10/0x20
 [   93.259043] Code: d503201f f94e1c00 8b214001 d50332bf (b9000022)
 [   93.262863] ---[ end trace 0000000000000000 ]---
 However, for the device IPQ5018 ath11k_hw_params .ce_remap is
 defined. This parameter is used to recalculate ab->mem_ce and hence,
 this issue is not seen in IPQ5018.
 Hence, fix this by initializing ab->mem_ce after ab->mem is set.
 ab->mem is set inside the ath11k_ahb_setup_resources() therefore
 initialize ab->mem_ce after ath11k_ahb_setup_resources().
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
 Fixes: b42b3678c91f ("wifi: ath11k: remap ce register space for IPQ5018")
 Signed-off-by: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20230113063209.7256-1-quic_rajkbhag@quicinc.com
 ---
 drivers/net/wireless/ath/ath11k/ahb.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/ahb.c
 +++ b/drivers/net/wireless/ath/ath11k/ahb.c
@@ -1157,12 +1157,16 @@ static int ath11k_ahb_probe(struct platf
 		goto err_core_free;
 	}
 -	ab->mem_ce = ab->mem;
 -
 	ret = ath11k_core_pre_init(ab);
 	if (ret)
 		goto err_core_free;
 +	ret = ath11k_ahb_setup_resources(ab);
 +	if (ret)
 +		goto err_core_free;
 +
 +	ab->mem_ce = ab->mem;
 +
 	if (ab->hw_params.ce_remap) {
 		const struct ce_remap *ce_remap = ab->hw_params.ce_remap;
 		/* ce register space is moved out of wcss unlike ipq8074 or ipq6018
@@ -1177,10 +1181,6 @@ static int ath11k_ahb_probe(struct platf
 		}
 	}
 -	ret = ath11k_ahb_setup_resources(ab);
 -	if (ret)
 -		goto err_core_free;
 -
 	ret = ath11k_ahb_fw_resources_init(ab);
 	if (ret)
 		goto err_core_free;
--- a/package/kernel/mac80211/patches/ath11k/0032-ath11k-Add-wmi-peer-create-conf-event-in-wmi_tlv_eve.patch
+++ b/package/kernel/mac80211/patches/ath11k/0032-ath11k-Add-wmi-peer-create-conf-event-in-wmi_tlv_eve.patch
@ -1,50 +0,0 @@
 From 94a6df31dcf042f74db8209680d04546ce964ad5 Mon Sep 17 00:00:00 2001
 From: P Praneesh <ppranees@codeaurora.org>
 Date: Tue, 28 Sep 2021 12:05:41 +0300
 Subject: [PATCH] ath11k: Add wmi peer create conf event in wmi_tlv_event_id
 When the driver sends a peer create cmd, the firmware responds with
 WMI_PEER_CREATE_CONF_EVENTID to confirm the firmware received
 WMI_PEER_CREATE_CMDID. Since the peer create conf event is not handled
 in ath11k_wmi_tlv_op_rx, we are getting unknown event id warning prints
 during peer creation.
 Add WMI_PEER_CREATE_CONF_EVENTID in wmi_tlv_event_id and handle
 the same as unsupported event id under wmi logs.
 warning prints:
 [ 4382.230817] ath11k_pci 0000:01:00.0: Unknown eventid: 0x601a
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01695-QCAHKSWPL_SILICONZ-1
 Signed-off-by: P Praneesh <ppranees@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210721212029.142388-9-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/wmi.c | 1 +
 drivers/net/wireless/ath/ath11k/wmi.h | 3 +++
 2 files changed, 4 insertions(+)
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -7137,6 +7137,7 @@ static void ath11k_wmi_tlv_op_rx(struct
 	case WMI_TWT_ENABLE_EVENTID:
 	case WMI_TWT_DISABLE_EVENTID:
 	case WMI_PDEV_DMA_RING_CFG_RSP_EVENTID:
 +	case WMI_PEER_CREATE_CONF_EVENTID:
 		ath11k_dbg(ab, ATH11K_DBG_WMI,
 			   "ignoring unsupported event 0x%x\n", id);
 		break;
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
@@ -663,6 +663,9 @@ enum wmi_tlv_event_id {
 	WMI_PEER_RESERVED9_EVENTID,
 	WMI_PEER_RESERVED10_EVENTID,
 	WMI_PEER_OPER_MODE_CHANGE_EVENTID,
 +	WMI_PEER_TX_PN_RESPONSE_EVENTID,
 +	WMI_PEER_CFR_CAPTURE_EVENTID,
 +	WMI_PEER_CREATE_CONF_EVENTID,
 	WMI_MGMT_RX_EVENTID = WMI_TLV_CMD(WMI_GRP_MGMT),
 	WMI_HOST_SWBA_EVENTID,
 	WMI_TBTTOFFSET_UPDATE_EVENTID,
--- a/package/kernel/mac80211/patches/ath11k/0033-ath11k-add-channel-2-into-6-GHz-channel-list.patch
+++ b/package/kernel/mac80211/patches/ath11k/0033-ath11k-add-channel-2-into-6-GHz-channel-list.patch
@ -1,43 +0,0 @@
 From 4a9550f536cc9c62210f77d875f000e560fc64b1 Mon Sep 17 00:00:00 2001
 From: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
 Date: Tue, 28 Sep 2021 14:00:43 +0300
 Subject: [PATCH] ath11k: add channel 2 into 6 GHz channel list
 Add support for the 6 GHz channel 2 with center frequency 5935 MHz and
 operating class 136 per IEEE Std 802.11ax-2021, Table E-4.
 Signed-off-by: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210722102054.43419-1-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/core.h | 4 ++--
 drivers/net/wireless/ath/ath11k/mac.c  | 3 +++
 2 files changed, 5 insertions(+), 2 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/core.h
 +++ b/drivers/net/wireless/ath/ath11k/core.h
@@ -393,9 +393,9 @@ struct ath11k_sta {
 };
 #define ATH11K_MIN_5G_FREQ 4150
 -#define ATH11K_MIN_6G_FREQ 5945
 +#define ATH11K_MIN_6G_FREQ 5925
 #define ATH11K_MAX_6G_FREQ 7115
 -#define ATH11K_NUM_CHANS 100
 +#define ATH11K_NUM_CHANS 101
 #define ATH11K_MAX_5G_CHAN 173
 enum ath11k_state {
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -151,6 +151,9 @@ static const struct ieee80211_channel at
 	CHAN6G(225, 7075, 0),
 	CHAN6G(229, 7095, 0),
 	CHAN6G(233, 7115, 0),
 +
 +	/* new addition in IEEE Std 802.11ax-2021 */
 +	CHAN6G(2, 5935, 0),
 };
 static struct ieee80211_rate ath11k_legacy_rates[] = {
--- a/package/kernel/mac80211/patches/ath11k/0033-wifi-ath11k-Set-ext-passive-scan-flag-to-adjust-pass.patch
+++ b/package/kernel/mac80211/patches/ath11k/0033-wifi-ath11k-Set-ext-passive-scan-flag-to-adjust-pass.patch
@ -0,0 +1,73 @@
 From cf8f3d4deb02a8fdc806c46d4112b69868544697 Mon Sep 17 00:00:00 2001
 From: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
 Date: Wed, 15 Feb 2023 20:31:36 +0200
 Subject: [PATCH] wifi: ath11k: Set ext passive scan flag to adjust passive
 scan start time
 Set the WMI_SCAN_FLAG_EXT_PASSIVE_SCAN_START_TIME_ENHANCE flag
 while sending the scan command.  If this flag is enabled when the
 incoming scan request comes with a strict start time and its duration
 overlaps with next TBTT, then target adjust the start time accordingly
 for passive scan. Target supporting this feature will advertise
 WMI_TLV_SERVICE_PASSIVE_SCAN_START_TIME_ENHANCE.
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01467-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Tamizh Chelvam Raja <quic_tamizhr@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20221222131720.11368-1-quic_tamizhr@quicinc.com
 ---
 drivers/net/wireless/ath/ath11k/wmi.c | 8 ++++++++
 drivers/net/wireless/ath/ath11k/wmi.h | 3 +++
 2 files changed, 11 insertions(+)
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -2068,6 +2068,12 @@ void ath11k_wmi_start_scan_init(struct a
 				  WMI_SCAN_EVENT_FOREIGN_CHAN |
 				  WMI_SCAN_EVENT_DEQUEUED;
 	arg->scan_flags |= WMI_SCAN_CHAN_STAT_EVENT;
 +
 +	if (test_bit(WMI_TLV_SERVICE_PASSIVE_SCAN_START_TIME_ENHANCE,
 +		     ar->ab->wmi_ab.svc_map))
 +		arg->scan_ctrl_flags_ext |=
 +			WMI_SCAN_FLAG_EXT_PASSIVE_SCAN_START_TIME_ENHANCE;
 +
 	arg->num_bssid = 1;
 	/* fill bssid_list[0] with 0xff, otherwise bssid and RA will be
@@ -2149,6 +2155,8 @@ ath11k_wmi_copy_scan_event_cntrl_flags(s
 	/* for adaptive scan mode using 3 bits (21 - 23 bits) */
 	WMI_SCAN_SET_DWELL_MODE(cmd->scan_ctrl_flags,
 				param->adaptive_dwell_time_mode);
 +
 +	cmd->scan_ctrl_flags_ext = param->scan_ctrl_flags_ext;
 }
 int ath11k_wmi_send_scan_start_cmd(struct ath11k *ar,
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
@@ -2093,6 +2093,7 @@ enum wmi_tlv_service {
 	WMI_TLV_SERVICE_EXT2_MSG = 220,
 	WMI_TLV_SERVICE_PEER_POWER_SAVE_DURATION_SUPPORT = 246,
 	WMI_TLV_SERVICE_SRG_SRP_SPATIAL_REUSE_SUPPORT = 249,
 +	WMI_TLV_SERVICE_PASSIVE_SCAN_START_TIME_ENHANCE = 263,
 	/* The second 128 bits */
 	WMI_MAX_EXT_SERVICE = 256,
@@ -3223,6 +3224,7 @@ struct  wmi_start_scan_cmd {
 #define WMI_SCAN_DWELL_MODE_MASK 0x00E00000
 #define WMI_SCAN_DWELL_MODE_SHIFT        21
 +#define WMI_SCAN_FLAG_EXT_PASSIVE_SCAN_START_TIME_ENHANCE   0x00000800
 enum {
 	WMI_SCAN_DWELL_MODE_DEFAULT      = 0,
@@ -3270,6 +3272,7 @@ struct scan_req_params {
 		};
 		u32 scan_events;
 	};
 +	u32 scan_ctrl_flags_ext;
 	u32 dwell_time_active;
 	u32 dwell_time_active_2g;
 	u32 dwell_time_passive;
--- a/package/kernel/mac80211/patches/ath11k/0034-wifi-ath11k-fix-return-value-check-in-ath11k_ahb_pro.patch
+++ b/package/kernel/mac80211/patches/ath11k/0034-wifi-ath11k-fix-return-value-check-in-ath11k_ahb_pro.patch
@ -0,0 +1,27 @@
 From 342fcde9d91460f01f65707e16368a1571271a3a Mon Sep 17 00:00:00 2001
 From: Yang Yingliang <yangyingliang@huawei.com>
 Date: Fri, 17 Feb 2023 11:00:31 +0800
 Subject: [PATCH] wifi: ath11k: fix return value check in ath11k_ahb_probe()
 ioremap() returns NULL pointer not PTR_ERR() when it fails,
 so replace the IS_ERR() check with NULL pointer check.
 Fixes: b42b3678c91f ("wifi: ath11k: remap ce register space for IPQ5018")
 Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20230217030031.4021289-1-yangyingliang@huawei.com
 ---
 drivers/net/wireless/ath/ath11k/ahb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 --- a/drivers/net/wireless/ath/ath11k/ahb.c
 +++ b/drivers/net/wireless/ath/ath11k/ahb.c
@@ -1174,7 +1174,7 @@ static int ath11k_ahb_probe(struct platf
 		 * to a new space for accessing them.
 		 */
 		ab->mem_ce = ioremap(ce_remap->base, ce_remap->size);
 -		if (IS_ERR(ab->mem_ce)) {
 +		if (!ab->mem_ce) {
 			dev_err(&pdev->dev, "ce ioremap error\n");
 			ret = -ENOMEM;
 			goto err_core_free;
--- a/package/kernel/mac80211/patches/ath11k/0035-ath11k-fix-survey-dump-collection-in-6-GHz.patch
+++ b/package/kernel/mac80211/patches/ath11k/0035-ath11k-fix-survey-dump-collection-in-6-GHz.patch
@ -1,35 +0,0 @@
 From b6b142f644d2d88e2ceabe0aa4479e0a09ba1ea9 Mon Sep 17 00:00:00 2001
 From: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
 Date: Tue, 28 Sep 2021 14:00:43 +0300
 Subject: [PATCH] ath11k: fix survey dump collection in 6 GHz
 When ath11k receives survey request, choose the 6 GHz band when enabled.
 Without this, survey request does not include any 6 GHz band results,
 thereby causing auto channel selection to fail.
 Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01386-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210722102054.43419-3-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/mac.c | 6 ++++++
 1 file changed, 6 insertions(+)
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -7182,7 +7182,13 @@ static int ath11k_mac_op_get_survey(stru
 	if (!sband)
 		sband = hw->wiphy->bands[NL80211_BAND_5GHZ];
 +	if (sband && idx >= sband->n_channels) {
 +		idx -= sband->n_channels;
 +		sband = NULL;
 +	}
 +	if (!sband)
 +		sband = hw->wiphy->bands[NL80211_BAND_6GHZ];
 	if (!sband || idx >= sband->n_channels) {
 		ret = -ENOENT;
 		goto exit;
--- a/package/kernel/mac80211/patches/ath11k/0035-wifi-ath11k-Use-platform_get_irq-to-get-the-interrup.patch
+++ b/package/kernel/mac80211/patches/ath11k/0035-wifi-ath11k-Use-platform_get_irq-to-get-the-interrup.patch
@ -0,0 +1,50 @@
 From f117276638b7600b981b3fe28550823cfbe1ef23 Mon Sep 17 00:00:00 2001
 From: Douglas Anderson <dianders@chromium.org>
 Date: Wed, 1 Feb 2023 08:54:42 -0800
 Subject: [PATCH] wifi: ath11k: Use platform_get_irq() to get the interrupt
 As of commit a1a2b7125e10 ("of/platform: Drop static setup of IRQ
 resource from DT core"), we need to use platform_get_irq() instead of
 platform_get_resource() to get our IRQs because
 platform_get_resource() simply won't get them anymore.
 This was already fixed in several other Atheros WiFi drivers,
 apparently in response to Zeal Robot reports. An example of another
 fix is commit 9503a1fc123d ("ath9k: Use platform_get_irq() to get the
 interrupt"). ath11k seems to have been missed in this effort, though.
 Without this change, WiFi wasn't coming up on my Qualcomm sc7280-based
 hardware. Specifically, "platform_get_resource(pdev, IORESOURCE_IRQ,
 i)" was failing even for i=0.
 Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.1.0.1-00887-QCAMSLSWPLZ-1
 Fixes: a1a2b7125e10 ("of/platform: Drop static setup of IRQ resource from DT core")
 Fixes: 00402f49d26f ("ath11k: Add support for WCN6750 device")
 Signed-off-by: Douglas Anderson <dianders@chromium.org>
 Tested-by: Jun Yu <junyuu@chromium.org>
 Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20230201084131.v2.1.I69cf3d56c97098287fe3a70084ee515098390b70@changeid
 ---
 drivers/net/wireless/ath/ath11k/ahb.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/ahb.c
 +++ b/drivers/net/wireless/ath/ath11k/ahb.c
@@ -874,11 +874,11 @@ static int ath11k_ahb_setup_msi_resource
 	ab->pci.msi.ep_base_data = int_prop + 32;
 	for (i = 0; i < ab->pci.msi.config->total_vectors; i++) {
 -		res = platform_get_resource(pdev, IORESOURCE_IRQ, i);
 -		if (!res)
 -			return -ENODEV;
 +		ret = platform_get_irq(pdev, i);
 +		if (ret < 0)
 +			return ret;
 -		ab->pci.msi.irqs[i] = res->start;
 +		ab->pci.msi.irqs[i] = ret;
 	}
 	set_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, &ab->dev_flags);
--- a/package/kernel/mac80211/patches/ath11k/0036-ath11k-re-enable-ht_cap-vht_cap-for-5G-band-for-WCN6.patch
+++ b/package/kernel/mac80211/patches/ath11k/0036-ath11k-re-enable-ht_cap-vht_cap-for-5G-band-for-WCN6.patch
@ -1,34 +0,0 @@
 From 54f40f552afd5a07e635a52221ec4b0ce765c374 Mon Sep 17 00:00:00 2001
 From: Wen Gong <wgong@codeaurora.org>
 Date: Tue, 28 Sep 2021 14:00:43 +0300
 Subject: [PATCH] ath11k: re-enable ht_cap/vht_cap for 5G band for WCN6855
 WCN6855 uses single_pdev_only, so it supports both the 5G and 6G bands
 in the same ath11k/pdev and it needs to enable ht_cap/vht_cap for the 5G
 band, otherwise it will downgrade to non-HT mode for the 5G band. Some
 chips like QCN9074 only support the 6G band, not the 5G band, and use
 the flag ar->supports_6ghz which is true to discard ht_cap/vht_cap.
 Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
 Signed-off-by: Wen Gong <wgong@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210804181217.88751-2-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/mac.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -4551,7 +4551,9 @@ static void ath11k_mac_setup_ht_vht_cap(
 						    rate_cap_rx_chainmask);
 	}
 -	if (cap->supported_bands & WMI_HOST_WLAN_5G_CAP && !ar->supports_6ghz) {
 +	if (cap->supported_bands & WMI_HOST_WLAN_5G_CAP &&
 +	    (ar->ab->hw_params.single_pdev_only ||
 +	     !ar->supports_6ghz)) {
 		band = &ar->mac.sbands[NL80211_BAND_5GHZ];
 		ht_cap = cap->band[NL80211_BAND_5GHZ].ht_cap_info;
 		if (ht_cap_info)
--- a/package/kernel/mac80211/patches/ath11k/0036-wifi-ath11k-fix-SAC-bug-on-peer-addition-with-sta-ba.patch
+++ b/package/kernel/mac80211/patches/ath11k/0036-wifi-ath11k-fix-SAC-bug-on-peer-addition-with-sta-ba.patch
@ -0,0 +1,53 @@
 From 60b7d62ba8cdbd073997bff0f1cdae8d844002c0 Mon Sep 17 00:00:00 2001
 From: Christian Marangi <ansuelsmth@gmail.com>
 Date: Thu, 9 Feb 2023 23:26:22 +0100
 Subject: [PATCH] wifi: ath11k: fix SAC bug on peer addition with sta band
 migration
 Fix sleep in atomic context warning detected by Smatch static checker
 analyzer.
 Following the locking pattern for peer_rhash_add lock tbl_mtx_lock mutex
 always even if sta is not transitioning to another band.
 This is peer_add function and a more secure locking should not cause
 performance regression.
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1
 Fixes: d673cb6fe6c0 ("wifi: ath11k: fix peer addition/deletion error on sta band migration")
 Reported-by: Dan Carpenter <error27@gmail.com>
 Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20230209222622.1751-1-ansuelsmth@gmail.com
 ---
 drivers/net/wireless/ath/ath11k/peer.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/peer.c
 +++ b/drivers/net/wireless/ath/ath11k/peer.c
@@ -382,22 +382,23 @@ int ath11k_peer_create(struct ath11k *ar
 		return -ENOBUFS;
 	}
 +	mutex_lock(&ar->ab->tbl_mtx_lock);
 	spin_lock_bh(&ar->ab->base_lock);
 	peer = ath11k_peer_find_by_addr(ar->ab, param->peer_addr);
 	if (peer) {
 		if (peer->vdev_id == param->vdev_id) {
 			spin_unlock_bh(&ar->ab->base_lock);
 +			mutex_unlock(&ar->ab->tbl_mtx_lock);
 			return -EINVAL;
 		}
 		/* Assume sta is transitioning to another band.
 		 * Remove here the peer from rhash.
 		 */
 -		mutex_lock(&ar->ab->tbl_mtx_lock);
 		ath11k_peer_rhash_delete(ar->ab, peer);
 -		mutex_unlock(&ar->ab->tbl_mtx_lock);
 	}
 	spin_unlock_bh(&ar->ab->base_lock);
 +	mutex_unlock(&ar->ab->tbl_mtx_lock);
 	ret = ath11k_wmi_send_peer_create_cmd(ar, param);
 	if (ret) {
--- a/package/kernel/mac80211/patches/ath11k/0037-ath11k-enable-6G-channels-for-WCN6855.patch
+++ b/package/kernel/mac80211/patches/ath11k/0037-ath11k-enable-6G-channels-for-WCN6855.patch
@ -1,98 +0,0 @@
 From 74bba5e5ba45d511a944082d76b64cc1849e4c2e Mon Sep 17 00:00:00 2001
 From: Wen Gong <wgong@codeaurora.org>
 Date: Tue, 28 Sep 2021 14:00:43 +0300
 Subject: [PATCH] ath11k: enable 6G channels for WCN6855
 For some chips such as WCN6855, single_pdev_only is set in struct
 ath11k_hw_params which means ath11k calls ieee80211_register_hw() only
 once and create only one device interface, and that device interface
 supports all 2G/5G/6G channels.
 ath11k_mac_setup_channels_rates() sets up the channels and it is called
 for each device interface. It is called only once for single_pdev_only,
 and then set up all channels for 2G/5G/6G. The logic of
 ath11k_mac_setup_channels_rates() is not suitable for single_pdev_only,
 it leads to all 6G channels being disabled for the device interface
 which is single_pdev_only such as WCN6855.
 Add channel frequency checks for the 6G band and enable the 6G channels
 properly based on what is supported by the chip.
 Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
 Signed-off-by: Wen Gong <wgong@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210804181217.88751-3-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/mac.c | 25 ++++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -7322,7 +7322,7 @@ static int ath11k_mac_setup_channels_rat
 					   u32 supported_bands)
 {
 	struct ieee80211_supported_band *band;
 -	struct ath11k_hal_reg_capabilities_ext *reg_cap;
 +	struct ath11k_hal_reg_capabilities_ext *reg_cap, *temp_reg_cap;
 	void *channels;
 	u32 phy_id;
@@ -7332,6 +7332,7 @@ static int ath11k_mac_setup_channels_rat
 		     ATH11K_NUM_CHANS);
 	reg_cap = &ar->ab->hal_reg_cap[ar->pdev_idx];
 +	temp_reg_cap = reg_cap;
 	if (supported_bands & WMI_HOST_WLAN_2G_CAP) {
 		channels = kmemdup(ath11k_2ghz_channels,
@@ -7350,11 +7351,11 @@ static int ath11k_mac_setup_channels_rat
 		if (ar->ab->hw_params.single_pdev_only) {
 			phy_id = ath11k_get_phy_id(ar, WMI_HOST_WLAN_2G_CAP);
 -			reg_cap = &ar->ab->hal_reg_cap[phy_id];
 +			temp_reg_cap = &ar->ab->hal_reg_cap[phy_id];
 		}
 		ath11k_mac_update_ch_list(ar, band,
 -					  reg_cap->low_2ghz_chan,
 -					  reg_cap->high_2ghz_chan);
 +					  temp_reg_cap->low_2ghz_chan,
 +					  temp_reg_cap->high_2ghz_chan);
 	}
 	if (supported_bands & WMI_HOST_WLAN_5G_CAP) {
@@ -7374,9 +7375,15 @@ static int ath11k_mac_setup_channels_rat
 			band->n_bitrates = ath11k_a_rates_size;
 			band->bitrates = ath11k_a_rates;
 			ar->hw->wiphy->bands[NL80211_BAND_6GHZ] = band;
 +
 +			if (ar->ab->hw_params.single_pdev_only) {
 +				phy_id = ath11k_get_phy_id(ar, WMI_HOST_WLAN_5G_CAP);
 +				temp_reg_cap = &ar->ab->hal_reg_cap[phy_id];
 +			}
 +
 			ath11k_mac_update_ch_list(ar, band,
 -						  reg_cap->low_5ghz_chan,
 -						  reg_cap->high_5ghz_chan);
 +						  temp_reg_cap->low_5ghz_chan,
 +						  temp_reg_cap->high_5ghz_chan);
 		}
 		if (reg_cap->low_5ghz_chan < ATH11K_MIN_6G_FREQ) {
@@ -7399,12 +7406,12 @@ static int ath11k_mac_setup_channels_rat
 			if (ar->ab->hw_params.single_pdev_only) {
 				phy_id = ath11k_get_phy_id(ar, WMI_HOST_WLAN_5G_CAP);
 -				reg_cap = &ar->ab->hal_reg_cap[phy_id];
 +				temp_reg_cap = &ar->ab->hal_reg_cap[phy_id];
 			}
 			ath11k_mac_update_ch_list(ar, band,
 -						  reg_cap->low_5ghz_chan,
 -						  reg_cap->high_5ghz_chan);
 +						  temp_reg_cap->low_5ghz_chan,
 +						  temp_reg_cap->high_5ghz_chan);
 		}
 	}
--- a/package/kernel/mac80211/patches/ath11k/0037-wifi-ath11k-allow-system-suspend-to-survive-ath11k.patch
+++ b/package/kernel/mac80211/patches/ath11k/0037-wifi-ath11k-allow-system-suspend-to-survive-ath11k.patch
@ -0,0 +1,43 @@
 From 7c15430822e71e90203d87e6d0cfe83fa058b0dc Mon Sep 17 00:00:00 2001
 From: Len Brown <len.brown@intel.com>
 Date: Wed, 1 Feb 2023 12:32:01 -0600
 Subject: [PATCH] wifi: ath11k: allow system suspend to survive ath11k
 When ath11k runs into internal errors upon suspend,
 it returns an error code to pci_pm_suspend, which
 aborts the entire system suspend.
 The driver should not abort system suspend, but should
 keep its internal errors to itself, and allow the system
 to suspend.  Otherwise, a user can suspend a laptop
 by closing the lid and sealing it into a case, assuming
 that is will suspend, rather than heating up and draining
 the battery when in transit.
 In practice, the ath11k device seems to have plenty of transient
 errors, and subsequent suspend cycles after this failure
 often succeed.
 https://bugzilla.kernel.org/show_bug.cgi?id=216968
 Fixes: d1b0c33850d29 ("ath11k: implement suspend for QCA6390 PCI devices")
 Signed-off-by: Len Brown <len.brown@intel.com>
 Cc: stable@vger.kernel.org
 Signed-off-by: Kalle Valo <kvalo@kernel.org>
 Link: https://lore.kernel.org/r/20230201183201.14431-1-len.brown@intel.com
 ---
 drivers/net/wireless/ath/ath11k/pci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 --- a/drivers/net/wireless/ath/ath11k/pci.c
 +++ b/drivers/net/wireless/ath/ath11k/pci.c
@@ -998,7 +998,7 @@ static __maybe_unused int ath11k_pci_pm_
 	if (ret)
 		ath11k_warn(ab, "failed to resume core: %d\n", ret);
 -	return ret;
 +	return 0;
 }
 static SIMPLE_DEV_PM_OPS(ath11k_pci_pm_ops,
--- a/package/kernel/mac80211/patches/ath11k/0038-ath11k-copy-cap-info-of-6G-band-under-WMI_HOST_WLAN_.patch
+++ b/package/kernel/mac80211/patches/ath11k/0038-ath11k-copy-cap-info-of-6G-band-under-WMI_HOST_WLAN_.patch
@ -1,54 +0,0 @@
 From 0f17ae43823b237c73ff138bc067229f7c57e3a2 Mon Sep 17 00:00:00 2001
 From: Wen Gong <wgong@codeaurora.org>
 Date: Tue, 28 Sep 2021 14:00:43 +0300
 Subject: [PATCH] ath11k: copy cap info of 6G band under WMI_HOST_WLAN_5G_CAP
 for WCN6855
 WCN6855 has 2 phys, one is 2G, another is 5G/6G, so it should copy the
 cap info of 6G band under the check of WMI_HOST_WLAN_5G_CAP as well as
 for the 5G band. Some chips like QCN9074 only have 6G, not have 2G and
 5G, and this 6G capability is also under WMI_HOST_WLAN_5G_CAP, so this
 change will not disturb it.
 Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
 Signed-off-by: Wen Gong <wgong@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210804181217.88751-4-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/wmi.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -407,18 +407,18 @@ ath11k_pull_mac_phy_cap_svc_ready_ext(st
 		       sizeof(u32) * PSOC_HOST_MAX_PHY_SIZE);
 		memcpy(&cap_band->he_ppet, &mac_phy_caps->he_ppet5g,
 		       sizeof(struct ath11k_ppe_threshold));
 -	}
 -	cap_band = &pdev_cap->band[NL80211_BAND_6GHZ];
 -	cap_band->max_bw_supported = mac_phy_caps->max_bw_supported_5g;
 -	cap_band->ht_cap_info = mac_phy_caps->ht_cap_info_5g;
 -	cap_band->he_cap_info[0] = mac_phy_caps->he_cap_info_5g;
 -	cap_band->he_cap_info[1] = mac_phy_caps->he_cap_info_5g_ext;
 -	cap_band->he_mcs = mac_phy_caps->he_supp_mcs_5g;
 -	memcpy(cap_band->he_cap_phy_info, &mac_phy_caps->he_cap_phy_info_5g,
 -	       sizeof(u32) * PSOC_HOST_MAX_PHY_SIZE);
 -	memcpy(&cap_band->he_ppet, &mac_phy_caps->he_ppet5g,
 -	       sizeof(struct ath11k_ppe_threshold));
 +		cap_band = &pdev_cap->band[NL80211_BAND_6GHZ];
 +		cap_band->max_bw_supported = mac_phy_caps->max_bw_supported_5g;
 +		cap_band->ht_cap_info = mac_phy_caps->ht_cap_info_5g;
 +		cap_band->he_cap_info[0] = mac_phy_caps->he_cap_info_5g;
 +		cap_band->he_cap_info[1] = mac_phy_caps->he_cap_info_5g_ext;
 +		cap_band->he_mcs = mac_phy_caps->he_supp_mcs_5g;
 +		memcpy(cap_band->he_cap_phy_info, &mac_phy_caps->he_cap_phy_info_5g,
 +		       sizeof(u32) * PSOC_HOST_MAX_PHY_SIZE);
 +		memcpy(&cap_band->he_ppet, &mac_phy_caps->he_ppet5g,
 +		       sizeof(struct ath11k_ppe_threshold));
 +	}
 	return 0;
 }
--- a/package/kernel/mac80211/patches/ath11k/0038-wifi-ath11k-modify-accessor-macros-to-match-index-si.patch
+++ b/package/kernel/mac80211/patches/ath11k/0038-wifi-ath11k-modify-accessor-macros-to-match-index-si.patch
@ -0,0 +1,61 @@
 From a96f10422e74cde27c100b321b127ec32ae75747 Mon Sep 17 00:00:00 2001
 From: Muna Sinada <quic_msinada@quicinc.com>
 Date: Fri, 24 Feb 2023 12:28:03 +0200
 Subject: [PATCH] wifi: ath11k: modify accessor macros to match index size
 HE PHY is only 11 bytes, therefore it should be using byte indexes
 instead of dword. Change corresponding macros to reflect this.
 Signed-off-by: Muna Sinada <quic_msinada@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/1666128501-12364-2-git-send-email-quic_msinada@quicinc.com
 ---
 drivers/net/wireless/ath/ath11k/wmi.h | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
@@ -2859,30 +2859,32 @@ struct rx_reorder_queue_remove_params {
 #define WMI_VDEV_PARAM_TXBF_SU_TX_BFER BIT(2)
 #define WMI_VDEV_PARAM_TXBF_MU_TX_BFER BIT(3)
 -#define HECAP_PHYDWORD_0	0
 -#define HECAP_PHYDWORD_1	1
 -#define HECAP_PHYDWORD_2	2
 +#define HE_PHYCAP_BYTE_0	0
 +#define HE_PHYCAP_BYTE_1	1
 +#define HE_PHYCAP_BYTE_2	2
 +#define HE_PHYCAP_BYTE_3	3
 +#define HE_PHYCAP_BYTE_4	4
 -#define HECAP_PHY_SU_BFER		BIT(31)
 +#define HECAP_PHY_SU_BFER		BIT(7)
 #define HECAP_PHY_SU_BFEE		BIT(0)
 #define HECAP_PHY_MU_BFER		BIT(1)
 -#define HECAP_PHY_UL_MUMIMO		BIT(22)
 -#define HECAP_PHY_UL_MUOFDMA		BIT(23)
 +#define HECAP_PHY_UL_MUMIMO		BIT(6)
 +#define HECAP_PHY_UL_MUOFDMA		BIT(7)
 #define HECAP_PHY_SUBFMR_GET(hecap_phy) \
 -	FIELD_GET(HECAP_PHY_SU_BFER, hecap_phy[HECAP_PHYDWORD_0])
 +	FIELD_GET(HECAP_PHY_SU_BFER, hecap_phy[HE_PHYCAP_BYTE_3])
 #define HECAP_PHY_SUBFME_GET(hecap_phy) \
 -	FIELD_GET(HECAP_PHY_SU_BFEE, hecap_phy[HECAP_PHYDWORD_1])
 +	FIELD_GET(HECAP_PHY_SU_BFEE, hecap_phy[HE_PHYCAP_BYTE_4])
 #define HECAP_PHY_MUBFMR_GET(hecap_phy) \
 -	FIELD_GET(HECAP_PHY_MU_BFER, hecap_phy[HECAP_PHYDWORD_1])
 +	FIELD_GET(HECAP_PHY_MU_BFER, hecap_phy[HE_PHYCAP_BYTE_4])
 #define HECAP_PHY_ULMUMIMO_GET(hecap_phy) \
 -	FIELD_GET(HECAP_PHY_UL_MUMIMO, hecap_phy[HECAP_PHYDWORD_0])
 +	FIELD_GET(HECAP_PHY_UL_MUMIMO, hecap_phy[HE_PHYCAP_BYTE_2])
 #define HECAP_PHY_ULOFDMA_GET(hecap_phy) \
 -	FIELD_GET(HECAP_PHY_UL_MUOFDMA, hecap_phy[HECAP_PHYDWORD_0])
 +	FIELD_GET(HECAP_PHY_UL_MUOFDMA, hecap_phy[HE_PHYCAP_BYTE_2])
 #define HE_MODE_SU_TX_BFEE	BIT(0)
 #define HE_MODE_SU_TX_BFER	BIT(1)
--- a/package/kernel/mac80211/patches/ath11k/0039-ath11k-Drop-MSDU-with-length-error-in-DP-rx-path.patch
+++ b/package/kernel/mac80211/patches/ath11k/0039-ath11k-Drop-MSDU-with-length-error-in-DP-rx-path.patch
@ -1,57 +0,0 @@
 From cd18ed4cf8051ceb8590263f5914cb9bb58b0f25 Mon Sep 17 00:00:00 2001
 From: Baochen Qiang <bqiang@codeaurora.org>
 Date: Tue, 28 Sep 2021 14:00:43 +0300
 Subject: [PATCH] ath11k: Drop MSDU with length error in DP rx path
 There are MSDUs whose length are invalid. For example,
 attackers may inject on purpose truncated A-MSDUs with
 invalid MSDU length.
 Such MSDUs are marked with an err bit set in rx attention
 tlvs, so we can check and drop them.
 Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1
 Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
 Signed-off-by: Baochen Qiang <bqiang@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210913180246.193388-2-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/dp_rx.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
@@ -142,6 +142,18 @@ static u32 ath11k_dp_rx_h_attn_mpdu_err(
 	return errmap;
 }
 +static bool ath11k_dp_rx_h_attn_msdu_len_err(struct ath11k_base *ab,
 +					     struct hal_rx_desc *desc)
 +{
 +	struct rx_attention *rx_attention;
 +	u32 errmap;
 +
 +	rx_attention = ath11k_dp_rx_get_attention(ab, desc);
 +	errmap = ath11k_dp_rx_h_attn_mpdu_err(rx_attention);
 +
 +	return errmap & DP_RX_MPDU_ERR_MSDU_LEN;
 +}
 +
 static u16 ath11k_dp_rx_h_msdu_start_msdu_len(struct ath11k_base *ab,
 					      struct hal_rx_desc *desc)
 {
@@ -2525,6 +2537,12 @@ static int ath11k_dp_rx_process_msdu(str
 	}
 	rx_desc = (struct hal_rx_desc *)msdu->data;
 +	if (ath11k_dp_rx_h_attn_msdu_len_err(ab, rx_desc)) {
 +		ath11k_warn(ar->ab, "msdu len not valid\n");
 +		ret = -EIO;
 +		goto free_out;
 +	}
 +
 	lrx_desc = (struct hal_rx_desc *)last_buf->data;
 	rx_attention = ath11k_dp_rx_get_attention(ab, lrx_desc);
 	if (!ath11k_dp_rx_h_attn_msdu_done(rx_attention)) {
--- a/package/kernel/mac80211/patches/ath11k/0039-wifi-ath11k-push-MU-MIMO-params-from-hostapd-to-hard.patch
+++ b/package/kernel/mac80211/patches/ath11k/0039-wifi-ath11k-push-MU-MIMO-params-from-hostapd-to-hard.patch
@ -0,0 +1,300 @@
 From 38dfe775d0abf511341f37c1cb77b919a3ad410b Mon Sep 17 00:00:00 2001
 From: Muna Sinada <quic_msinada@quicinc.com>
 Date: Fri, 24 Feb 2023 12:28:04 +0200
 Subject: [PATCH] wifi: ath11k: push MU-MIMO params from hostapd to hardware
 In the previous behaviour only HE IE in management frames are changed
 regarding MU-MIMO configurations and not in hardware. Adding push of
 MU-MIMO configurations to the hardware as well.
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-00356-QCAHKSWPL_SILICONZ-1
 Co-developed-by: Anilkumar Kolli <quic_akolli@quicinc.com>
 Signed-off-by: Anilkumar Kolli <quic_akolli@quicinc.com>
 Signed-off-by: Muna Sinada <quic_msinada@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/1666128501-12364-3-git-send-email-quic_msinada@quicinc.com
 ---
 drivers/net/wireless/ath/ath11k/mac.c | 200 ++++++++++++++++----------
 drivers/net/wireless/ath/ath11k/wmi.h |   3 +
 2 files changed, 130 insertions(+), 73 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -2699,6 +2699,117 @@ static int ath11k_setup_peer_smps(struct
 					 ath11k_smps_map[smps]);
 }
 +static bool ath11k_mac_set_he_txbf_conf(struct ath11k_vif *arvif)
 +{
 +	struct ath11k *ar = arvif->ar;
 +	u32 param, value;
 +	int ret;
 +
 +	if (!arvif->vif->bss_conf.he_support)
 +		return true;
 +
 +	param = WMI_VDEV_PARAM_SET_HEMU_MODE;
 +	value = 0;
 +	if (arvif->vif->bss_conf.he_su_beamformer) {
 +		value |= FIELD_PREP(HE_MODE_SU_TX_BFER, HE_SU_BFER_ENABLE);
 +		if (arvif->vif->bss_conf.he_mu_beamformer &&
 +		    arvif->vdev_type == WMI_VDEV_TYPE_AP)
 +			value |= FIELD_PREP(HE_MODE_MU_TX_BFER, HE_MU_BFER_ENABLE);
 +	}
 +
 +	if (arvif->vif->type != NL80211_IFTYPE_MESH_POINT) {
 +		value |= FIELD_PREP(HE_MODE_DL_OFDMA, HE_DL_MUOFDMA_ENABLE) |
 +			 FIELD_PREP(HE_MODE_UL_OFDMA, HE_UL_MUOFDMA_ENABLE);
 +
 +		if (arvif->vif->bss_conf.he_full_ul_mumimo)
 +			value |= FIELD_PREP(HE_MODE_UL_MUMIMO, HE_UL_MUMIMO_ENABLE);
 +
 +		if (arvif->vif->bss_conf.he_su_beamformee)
 +			value |= FIELD_PREP(HE_MODE_SU_TX_BFEE, HE_SU_BFEE_ENABLE);
 +	}
 +
 +	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id, param, value);
 +	if (ret) {
 +		ath11k_warn(ar->ab, "failed to set vdev %d HE MU mode: %d\n",
 +			    arvif->vdev_id, ret);
 +		return false;
 +	}
 +
 +	param = WMI_VDEV_PARAM_SET_HE_SOUNDING_MODE;
 +	value =	FIELD_PREP(HE_VHT_SOUNDING_MODE, HE_VHT_SOUNDING_MODE_ENABLE) |
 +		FIELD_PREP(HE_TRIG_NONTRIG_SOUNDING_MODE,
 +			   HE_TRIG_NONTRIG_SOUNDING_MODE_ENABLE);
 +	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id,
 +					    param, value);
 +	if (ret) {
 +		ath11k_warn(ar->ab, "failed to set vdev %d sounding mode: %d\n",
 +			    arvif->vdev_id, ret);
 +		return false;
 +	}
 +	return true;
 +}
 +
 +static bool ath11k_mac_vif_recalc_sta_he_txbf(struct ath11k *ar,
 +					      struct ieee80211_vif *vif,
 +					      struct ieee80211_sta_he_cap *he_cap)
 +{
 +	struct ath11k_vif *arvif = (void *)vif->drv_priv;
 +	struct ieee80211_he_cap_elem he_cap_elem = {0};
 +	struct ieee80211_sta_he_cap *cap_band = NULL;
 +	struct cfg80211_chan_def def;
 +	u32 param = WMI_VDEV_PARAM_SET_HEMU_MODE;
 +	u32 hemode = 0;
 +	int ret;
 +
 +	if (!vif->bss_conf.he_support)
 +		return true;
 +
 +	if (vif->type != NL80211_IFTYPE_STATION)
 +		return false;
 +
 +	if (WARN_ON(ath11k_mac_vif_chan(vif, &def)))
 +		return false;
 +
 +	if (def.chan->band == NL80211_BAND_2GHZ)
 +		cap_band = &ar->mac.iftype[NL80211_BAND_2GHZ][vif->type].he_cap;
 +	else
 +		cap_band = &ar->mac.iftype[NL80211_BAND_5GHZ][vif->type].he_cap;
 +
 +	memcpy(&he_cap_elem, &cap_band->he_cap_elem, sizeof(he_cap_elem));
 +
 +	if (HECAP_PHY_SUBFME_GET(he_cap_elem.phy_cap_info)) {
 +		if (HECAP_PHY_SUBFMR_GET(he_cap->he_cap_elem.phy_cap_info))
 +			hemode |= FIELD_PREP(HE_MODE_SU_TX_BFEE, HE_SU_BFEE_ENABLE);
 +		if (HECAP_PHY_MUBFMR_GET(he_cap->he_cap_elem.phy_cap_info))
 +			hemode |= FIELD_PREP(HE_MODE_MU_TX_BFEE, HE_MU_BFEE_ENABLE);
 +	}
 +
 +	if (vif->type != NL80211_IFTYPE_MESH_POINT) {
 +		hemode |= FIELD_PREP(HE_MODE_DL_OFDMA, HE_DL_MUOFDMA_ENABLE) |
 +			  FIELD_PREP(HE_MODE_UL_OFDMA, HE_UL_MUOFDMA_ENABLE);
 +
 +		if (HECAP_PHY_ULMUMIMO_GET(he_cap_elem.phy_cap_info))
 +			if (HECAP_PHY_ULMUMIMO_GET(he_cap->he_cap_elem.phy_cap_info))
 +				hemode |= FIELD_PREP(HE_MODE_UL_MUMIMO,
 +						     HE_UL_MUMIMO_ENABLE);
 +
 +		if (FIELD_GET(HE_MODE_MU_TX_BFEE, hemode))
 +			hemode |= FIELD_PREP(HE_MODE_SU_TX_BFEE, HE_SU_BFEE_ENABLE);
 +
 +		if (FIELD_GET(HE_MODE_MU_TX_BFER, hemode))
 +			hemode |= FIELD_PREP(HE_MODE_SU_TX_BFER, HE_SU_BFER_ENABLE);
 +	}
 +
 +	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id, param, hemode);
 +	if (ret) {
 +		ath11k_warn(ar->ab, "failed to submit vdev param txbf 0x%x: %d\n",
 +			    hemode, ret);
 +		return false;
 +	}
 +
 +	return true;
 +}
 +
 static void ath11k_bss_assoc(struct ieee80211_hw *hw,
 			     struct ieee80211_vif *vif,
 			     struct ieee80211_bss_conf *bss_conf)
@@ -2709,6 +2820,7 @@ static void ath11k_bss_assoc(struct ieee
 	struct ieee80211_sta *ap_sta;
 	struct ath11k_peer *peer;
 	bool is_auth = false;
 +	struct ieee80211_sta_he_cap  he_cap;
 	int ret;
 	lockdep_assert_held(&ar->conf_mutex);
@@ -2726,6 +2838,9 @@ static void ath11k_bss_assoc(struct ieee
 		return;
 	}
 +	/* he_cap here is updated at assoc success for sta mode only */
 +	he_cap  = ap_sta->deflink.he_cap;
 +
 	ath11k_peer_assoc_prepare(ar, vif, ap_sta, &peer_arg, false);
 	rcu_read_unlock();
@@ -2753,6 +2868,12 @@ static void ath11k_bss_assoc(struct ieee
 		return;
 	}
 +	if (!ath11k_mac_vif_recalc_sta_he_txbf(ar, vif, &he_cap)) {
 +		ath11k_warn(ar->ab, "failed to recalc he txbf for vdev %i on bss %pM\n",
 +			    arvif->vdev_id, bss_conf->bssid);
 +		return;
 +	}
 +
 	WARN_ON(arvif->is_up);
 	arvif->aid = vif->cfg.aid;
@@ -3202,6 +3323,8 @@ static void ath11k_mac_op_bss_info_chang
 		ether_addr_copy(arvif->bssid, info->bssid);
 	if (changed & BSS_CHANGED_BEACON_ENABLED) {
 +		if (info->enable_beacon)
 +			ath11k_mac_set_he_txbf_conf(arvif);
 		ath11k_control_beaconing(arvif, info);
 		if (arvif->is_up && vif->bss_conf.he_support &&
@@ -5392,6 +5515,10 @@ static int ath11k_mac_copy_he_cap(struct
 		he_cap_elem->mac_cap_info[1] &=
 			IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_MASK;
 +		he_cap_elem->phy_cap_info[0] &=
 +			~IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
 +		he_cap_elem->phy_cap_info[0] &=
 +			~IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G;
 		he_cap_elem->phy_cap_info[5] &=
 			~IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK;
@@ -6026,69 +6153,6 @@ ath11k_mac_setup_vdev_create_params(stru
 	}
 }
 -static u32
 -ath11k_mac_prepare_he_mode(struct ath11k_pdev *pdev, u32 viftype)
 -{
 -	struct ath11k_pdev_cap *pdev_cap = &pdev->cap;
 -	struct ath11k_band_cap *cap_band = NULL;
 -	u32 *hecap_phy_ptr = NULL;
 -	u32 hemode = 0;
 -
 -	if (pdev->cap.supported_bands & WMI_HOST_WLAN_2G_CAP)
 -		cap_band = &pdev_cap->band[NL80211_BAND_2GHZ];
 -	else
 -		cap_band = &pdev_cap->band[NL80211_BAND_5GHZ];
 -
 -	hecap_phy_ptr = &cap_band->he_cap_phy_info[0];
 -
 -	hemode = FIELD_PREP(HE_MODE_SU_TX_BFEE, HE_SU_BFEE_ENABLE) |
 -		 FIELD_PREP(HE_MODE_SU_TX_BFER, HECAP_PHY_SUBFMR_GET(hecap_phy_ptr)) |
 -		 FIELD_PREP(HE_MODE_UL_MUMIMO, HECAP_PHY_ULMUMIMO_GET(hecap_phy_ptr));
 -
 -	/* TODO WDS and other modes */
 -	if (viftype == NL80211_IFTYPE_AP) {
 -		hemode |= FIELD_PREP(HE_MODE_MU_TX_BFER,
 -			  HECAP_PHY_MUBFMR_GET(hecap_phy_ptr)) |
 -			  FIELD_PREP(HE_MODE_DL_OFDMA, HE_DL_MUOFDMA_ENABLE) |
 -			  FIELD_PREP(HE_MODE_UL_OFDMA, HE_UL_MUOFDMA_ENABLE);
 -	} else {
 -		hemode |= FIELD_PREP(HE_MODE_MU_TX_BFEE, HE_MU_BFEE_ENABLE);
 -	}
 -
 -	return hemode;
 -}
 -
 -static int ath11k_set_he_mu_sounding_mode(struct ath11k *ar,
 -					  struct ath11k_vif *arvif)
 -{
 -	u32 param_id, param_value;
 -	struct ath11k_base *ab = ar->ab;
 -	int ret = 0;
 -
 -	param_id = WMI_VDEV_PARAM_SET_HEMU_MODE;
 -	param_value = ath11k_mac_prepare_he_mode(ar->pdev, arvif->vif->type);
 -	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id,
 -					    param_id, param_value);
 -	if (ret) {
 -		ath11k_warn(ab, "failed to set vdev %d HE MU mode: %d param_value %x\n",
 -			    arvif->vdev_id, ret, param_value);
 -		return ret;
 -	}
 -	param_id = WMI_VDEV_PARAM_SET_HE_SOUNDING_MODE;
 -	param_value =
 -		FIELD_PREP(HE_VHT_SOUNDING_MODE, HE_VHT_SOUNDING_MODE_ENABLE) |
 -		FIELD_PREP(HE_TRIG_NONTRIG_SOUNDING_MODE,
 -			   HE_TRIG_NONTRIG_SOUNDING_MODE_ENABLE);
 -	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id,
 -					    param_id, param_value);
 -	if (ret) {
 -		ath11k_warn(ab, "failed to set vdev %d HE MU mode: %d\n",
 -			    arvif->vdev_id, ret);
 -		return ret;
 -	}
 -	return ret;
 -}
 -
 static void ath11k_mac_op_update_vif_offload(struct ieee80211_hw *hw,
 					     struct ieee80211_vif *vif)
 {
@@ -6757,7 +6821,6 @@ ath11k_mac_vdev_start_restart(struct ath
 	struct ath11k_base *ab = ar->ab;
 	struct wmi_vdev_start_req_arg arg = {};
 	const struct cfg80211_chan_def *chandef = &ctx->def;
 -	int he_support = arvif->vif->bss_conf.he_support;
 	int ret = 0;
 	lockdep_assert_held(&ar->conf_mutex);
@@ -6798,15 +6861,6 @@ ath11k_mac_vdev_start_restart(struct ath
 		spin_lock_bh(&ab->base_lock);
 		arg.regdomain = ar->ab->dfs_region;
 		spin_unlock_bh(&ab->base_lock);
 -
 -		if (he_support) {
 -			ret = ath11k_set_he_mu_sounding_mode(ar, arvif);
 -			if (ret) {
 -				ath11k_warn(ar->ab, "failed to set he mode vdev %i\n",
 -					    arg.vdev_id);
 -				return ret;
 -			}
 -		}
 	}
 	arg.channel.passive |= !!(chandef->chan->flags & IEEE80211_CHAN_NO_IR);
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
@@ -2897,8 +2897,11 @@ struct rx_reorder_queue_remove_params {
 #define HE_DL_MUOFDMA_ENABLE	1
 #define HE_UL_MUOFDMA_ENABLE	1
 #define HE_DL_MUMIMO_ENABLE	1
 +#define HE_UL_MUMIMO_ENABLE	1
 #define HE_MU_BFEE_ENABLE	1
 #define HE_SU_BFEE_ENABLE	1
 +#define HE_MU_BFER_ENABLE	1
 +#define HE_SU_BFER_ENABLE	1
 #define HE_VHT_SOUNDING_MODE_ENABLE		1
 #define HE_SU_MU_SOUNDING_MODE_ENABLE		1
--- a/package/kernel/mac80211/patches/ath11k/0040-ath11k-Fix-inaccessible-debug-registers.patch
+++ b/package/kernel/mac80211/patches/ath11k/0040-ath11k-Fix-inaccessible-debug-registers.patch
@ -1,46 +0,0 @@
 From 8a0b899f169d6b6102918327d026922140194fff Mon Sep 17 00:00:00 2001
 From: Baochen Qiang <bqiang@codeaurora.org>
 Date: Tue, 28 Sep 2021 14:00:44 +0300
 Subject: [PATCH] ath11k: Fix inaccessible debug registers
 Current code clears debug registers after SOC global reset performed
 in ath11k_pci_sw_reset. However at that time those registers are
 not accessible due to reset, thus they are actually not cleared at all.
 For WCN6855, it may cause target fail to initialize. This issue can be
 fixed by moving clear action ahead.
 In addition, on some specific platforms, need to add delay to wait
 those registers to become accessible.
 Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
 Signed-off-by: Baochen Qiang <bqiang@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210913180246.193388-3-jouni@codeaurora.org
 ---
 drivers/net/wireless/ath/ath11k/pci.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
 --- a/drivers/net/wireless/ath/ath11k/pci.c
 +++ b/drivers/net/wireless/ath/ath11k/pci.c
@@ -430,6 +430,8 @@ static void ath11k_pci_force_wake(struct
 static void ath11k_pci_sw_reset(struct ath11k_base *ab, bool power_on)
 {
 +	mdelay(100);
 +
 	if (power_on) {
 		ath11k_pci_enable_ltssm(ab);
 		ath11k_pci_clear_all_intrs(ab);
@@ -439,9 +441,9 @@ static void ath11k_pci_sw_reset(struct a
 	}
 	ath11k_mhi_clear_vector(ab);
 +	ath11k_pci_clear_dbg_registers(ab);
 	ath11k_pci_soc_global_reset(ab);
 	ath11k_mhi_set_mhictrl_reset(ab);
 -	ath11k_pci_clear_dbg_registers(ab);
 }
 int ath11k_pci_get_msi_irq(struct device *dev, unsigned int vector)
--- a/package/kernel/mac80211/patches/ath11k/0040-wifi-ath11k-move-HE-MCS-mapper-to-a-separate-functio.patch
+++ b/package/kernel/mac80211/patches/ath11k/0040-wifi-ath11k-move-HE-MCS-mapper-to-a-separate-functio.patch
@ -0,0 +1,67 @@
 From 8077c1bbbc28e527fb29143c46f32c6a9d6cadf0 Mon Sep 17 00:00:00 2001
 From: Muna Sinada <quic_msinada@quicinc.com>
 Date: Fri, 24 Feb 2023 12:28:04 +0200
 Subject: [PATCH] wifi: ath11k: move HE MCS mapper to a separate function
 Move HE MCS mapper to a separate function and call new function
 in ath11k_mac_copy_he_cap().
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-00356-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Muna Sinada <quic_msinada@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/1666128501-12364-4-git-send-email-quic_msinada@quicinc.com
 ---
 drivers/net/wireless/ath/ath11k/mac.c | 34 +++++++++++++++++----------
 1 file changed, 22 insertions(+), 12 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -5483,6 +5483,27 @@ static __le16 ath11k_mac_setup_he_6ghz_c
 	return cpu_to_le16(bcap->he_6ghz_capa);
 }
 +static void ath11k_mac_set_hemcsmap(struct ath11k *ar,
 +				    struct ath11k_pdev_cap *cap,
 +				    struct ieee80211_sta_he_cap *he_cap,
 +				    int band)
 +{
 +	struct ath11k_band_cap *band_cap = &cap->band[band];
 +
 +	he_cap->he_mcs_nss_supp.rx_mcs_80 =
 +		cpu_to_le16(band_cap->he_mcs & 0xffff);
 +	he_cap->he_mcs_nss_supp.tx_mcs_80 =
 +		cpu_to_le16(band_cap->he_mcs & 0xffff);
 +	he_cap->he_mcs_nss_supp.rx_mcs_160 =
 +		cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
 +	he_cap->he_mcs_nss_supp.tx_mcs_160 =
 +		cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
 +	he_cap->he_mcs_nss_supp.rx_mcs_80p80 =
 +		cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
 +	he_cap->he_mcs_nss_supp.tx_mcs_80p80 =
 +		cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
 +}
 +
 static int ath11k_mac_copy_he_cap(struct ath11k *ar,
 				  struct ath11k_pdev_cap *cap,
 				  struct ieee80211_sband_iftype_data *data,
@@ -5544,18 +5565,7 @@ static int ath11k_mac_copy_he_cap(struct
 			break;
 		}
 -		he_cap->he_mcs_nss_supp.rx_mcs_80 =
 -			cpu_to_le16(band_cap->he_mcs & 0xffff);
 -		he_cap->he_mcs_nss_supp.tx_mcs_80 =
 -			cpu_to_le16(band_cap->he_mcs & 0xffff);
 -		he_cap->he_mcs_nss_supp.rx_mcs_160 =
 -			cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
 -		he_cap->he_mcs_nss_supp.tx_mcs_160 =
 -			cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
 -		he_cap->he_mcs_nss_supp.rx_mcs_80p80 =
 -			cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
 -		he_cap->he_mcs_nss_supp.tx_mcs_80p80 =
 -			cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
 +		ath11k_mac_set_hemcsmap(ar, cap, he_cap, band);
 		memset(he_cap->ppe_thres, 0, sizeof(he_cap->ppe_thres));
 		if (he_cap_elem->phy_cap_info[6] &
--- a/package/kernel/mac80211/patches/ath11k/0041-wifi-ath11k-generate-rx-and-tx-mcs-maps-for-supporte.patch
+++ b/package/kernel/mac80211/patches/ath11k/0041-wifi-ath11k-generate-rx-and-tx-mcs-maps-for-supporte.patch
@ -0,0 +1,64 @@
 From ebf82988f844dd98e6b007cffcc5e95986056995 Mon Sep 17 00:00:00 2001
 From: Muna Sinada <quic_msinada@quicinc.com>
 Date: Fri, 24 Feb 2023 12:28:04 +0200
 Subject: [PATCH] wifi: ath11k: generate rx and tx mcs maps for supported HE
 mcs
 Generate rx and tx mcs maps in ath11k_mac_set_hemcsmap() and set them
 in supported mcs/nss for HE capabilities.
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-00356-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Muna Sinada <quic_msinada@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/1666128501-12364-5-git-send-email-quic_msinada@quicinc.com
 ---
 drivers/net/wireless/ath/ath11k/mac.c | 30 ++++++++++++++++++++-------
 1 file changed, 23 insertions(+), 7 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -5488,20 +5488,36 @@ static void ath11k_mac_set_hemcsmap(stru
 				    struct ieee80211_sta_he_cap *he_cap,
 				    int band)
 {
 -	struct ath11k_band_cap *band_cap = &cap->band[band];
 +	u16 txmcs_map, rxmcs_map;
 +	u32 i;
 +	rxmcs_map = 0;
 +	txmcs_map = 0;
 +	for (i = 0; i < 8; i++) {
 +		if (i < ar->num_tx_chains &&
 +		    (ar->cfg_tx_chainmask >> cap->tx_chain_mask_shift) & BIT(i))
 +			txmcs_map |= IEEE80211_HE_MCS_SUPPORT_0_11 << (i * 2);
 +		else
 +			txmcs_map |= IEEE80211_HE_MCS_NOT_SUPPORTED << (i * 2);
 +
 +		if (i < ar->num_rx_chains &&
 +		    (ar->cfg_rx_chainmask >> cap->tx_chain_mask_shift) & BIT(i))
 +			rxmcs_map |= IEEE80211_HE_MCS_SUPPORT_0_11 << (i * 2);
 +		else
 +			rxmcs_map |= IEEE80211_HE_MCS_NOT_SUPPORTED << (i * 2);
 +	}
 	he_cap->he_mcs_nss_supp.rx_mcs_80 =
 -		cpu_to_le16(band_cap->he_mcs & 0xffff);
 +		cpu_to_le16(rxmcs_map & 0xffff);
 	he_cap->he_mcs_nss_supp.tx_mcs_80 =
 -		cpu_to_le16(band_cap->he_mcs & 0xffff);
 +		cpu_to_le16(txmcs_map & 0xffff);
 	he_cap->he_mcs_nss_supp.rx_mcs_160 =
 -		cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
 +		cpu_to_le16(rxmcs_map & 0xffff);
 	he_cap->he_mcs_nss_supp.tx_mcs_160 =
 -		cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
 +		cpu_to_le16(txmcs_map & 0xffff);
 	he_cap->he_mcs_nss_supp.rx_mcs_80p80 =
 -		cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
 +		cpu_to_le16(rxmcs_map & 0xffff);
 	he_cap->he_mcs_nss_supp.tx_mcs_80p80 =
 -		cpu_to_le16((band_cap->he_mcs >> 16) & 0xffff);
 +		cpu_to_le16(txmcs_map & 0xffff);
 }
 static int ath11k_mac_copy_he_cap(struct ath11k *ar,
--- a/package/kernel/mac80211/patches/ath11k/0042-ath11k-Rename-macro-ARRAY_TO_STRING-to-PRINT_ARRAY_T.patch
+++ b/package/kernel/mac80211/patches/ath11k/0042-ath11k-Rename-macro-ARRAY_TO_STRING-to-PRINT_ARRAY_T.patch
@ -1,852 +0,0 @@
 From 9e2e2d7a4dd490ff6e95e37611070d3b3a9cf58b Mon Sep 17 00:00:00 2001
 From: Seevalamuthu Mariappan <seevalam@codeaurora.org>
 Date: Tue, 28 Sep 2021 14:00:44 +0300
 Subject: [PATCH] ath11k: Rename macro ARRAY_TO_STRING to PRINT_ARRAY_TO_BUF
 Renaming of macro is done to describe the macro functionality
 better as the macro functionality is modified in next patch-sets.
 No functional changes are done.
 Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210913223148.208026-2-jouni@codeaurora.org
 ---
 .../wireless/ath/ath11k/debugfs_htt_stats.c   | 378 +++++++++---------
 1 file changed, 189 insertions(+), 189 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.c
 +++ b/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.c
@@ -18,7 +18,7 @@
 #define HTT_TLV_HDR_LEN 4
 -#define ARRAY_TO_STRING(out, arr, len)							\
 +#define PRINT_ARRAY_TO_BUF(out, arr, len)						\
 	do {										\
 		int index = 0; u8 i;							\
 		for (i = 0; i < len; i++) {						\
@@ -195,7 +195,7 @@ htt_print_tx_pdev_stats_urrn_tlv_v(const
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "HTT_TX_PDEV_STATS_URRN_TLV_V:");
 -	ARRAY_TO_STRING(urrn_stats, htt_stats_buf->urrn_stats, num_elems);
 +	PRINT_ARRAY_TO_BUF(urrn_stats, htt_stats_buf->urrn_stats, num_elems);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "urrn_stats = %s\n", urrn_stats);
 	if (len >= buf_len)
@@ -220,7 +220,7 @@ htt_print_tx_pdev_stats_flush_tlv_v(cons
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "HTT_TX_PDEV_STATS_FLUSH_TLV_V:");
 -	ARRAY_TO_STRING(flush_errs, htt_stats_buf->flush_errs, num_elems);
 +	PRINT_ARRAY_TO_BUF(flush_errs, htt_stats_buf->flush_errs, num_elems);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "flush_errs = %s\n", flush_errs);
 	if (len >= buf_len)
@@ -245,7 +245,7 @@ htt_print_tx_pdev_stats_sifs_tlv_v(const
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "HTT_TX_PDEV_STATS_SIFS_TLV_V:");
 -	ARRAY_TO_STRING(sifs_status, htt_stats_buf->sifs_status, num_elems);
 +	PRINT_ARRAY_TO_BUF(sifs_status, htt_stats_buf->sifs_status, num_elems);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "sifs_status = %s\n",
 			   sifs_status);
@@ -271,7 +271,7 @@ htt_print_tx_pdev_stats_phy_err_tlv_v(co
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "HTT_TX_PDEV_STATS_PHY_ERR_TLV_V:");
 -	ARRAY_TO_STRING(phy_errs, htt_stats_buf->phy_errs, num_elems);
 +	PRINT_ARRAY_TO_BUF(phy_errs, htt_stats_buf->phy_errs, num_elems);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "phy_errs = %s\n", phy_errs);
 	if (len >= buf_len)
@@ -297,7 +297,7 @@ htt_print_tx_pdev_stats_sifs_hist_tlv_v(
 	len += HTT_DBG_OUT(buf + len, buf_len - len,
 			   "HTT_TX_PDEV_STATS_SIFS_HIST_TLV_V:");
 -	ARRAY_TO_STRING(sifs_hist_status, htt_stats_buf->sifs_hist_status, num_elems);
 +	PRINT_ARRAY_TO_BUF(sifs_hist_status, htt_stats_buf->sifs_hist_status, num_elems);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "sifs_hist_status = %s\n",
 			   sifs_hist_status);
@@ -363,9 +363,9 @@ htt_print_tx_pdev_stats_tried_mpdu_cnt_h
 			   htt_stats_buf->hist_bin_size);
 	if (required_buffer_size < HTT_MAX_STRING_LEN) {
 -		ARRAY_TO_STRING(tried_mpdu_cnt_hist,
 -				htt_stats_buf->tried_mpdu_cnt_hist,
 -				num_elements);
 +		PRINT_ARRAY_TO_BUF(tried_mpdu_cnt_hist,
 +				   htt_stats_buf->tried_mpdu_cnt_hist,
 +				   num_elements);
 		len += HTT_DBG_OUT(buf + len, buf_len - len, "tried_mpdu_cnt_hist = %s\n",
 				   tried_mpdu_cnt_hist);
 	} else {
@@ -667,9 +667,9 @@ static inline void htt_print_counter_tlv
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "HTT_COUNTER_TLV:");
 -	ARRAY_TO_STRING(counter_name,
 -			htt_stats_buf->counter_name,
 -			HTT_MAX_COUNTER_NAME);
 +	PRINT_ARRAY_TO_BUF(counter_name,
 +			   htt_stats_buf->counter_name,
 +			   HTT_MAX_COUNTER_NAME);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "counter_name = %s ", counter_name);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "count = %u\n",
 			   htt_stats_buf->count);
@@ -794,54 +794,54 @@ static inline void htt_print_tx_peer_rat
 			   htt_stats_buf->ack_rssi);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->tx_mcs,
 -			HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->tx_mcs,
 +			   HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_mcs = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->tx_su_mcs,
 -			HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->tx_su_mcs,
 +			   HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_su_mcs = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->tx_mu_mcs,
 -			HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->tx_mu_mcs,
 +			   HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_mu_mcs = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf,
 -			htt_stats_buf->tx_nss,
 -			HTT_TX_PDEV_STATS_NUM_SPATIAL_STREAMS);
 +	PRINT_ARRAY_TO_BUF(str_buf,
 +			   htt_stats_buf->tx_nss,
 +			   HTT_TX_PDEV_STATS_NUM_SPATIAL_STREAMS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_nss = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf,
 -			htt_stats_buf->tx_bw,
 -			HTT_TX_PDEV_STATS_NUM_BW_COUNTERS);
 +	PRINT_ARRAY_TO_BUF(str_buf,
 +			   htt_stats_buf->tx_bw,
 +			   HTT_TX_PDEV_STATS_NUM_BW_COUNTERS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_bw = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->tx_stbc,
 -			HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->tx_stbc,
 +			   HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_stbc = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->tx_pream,
 -			HTT_TX_PDEV_STATS_NUM_PREAMBLE_TYPES);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->tx_pream,
 +			   HTT_TX_PDEV_STATS_NUM_PREAMBLE_TYPES);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_pream = %s ", str_buf);
 	for (j = 0; j < HTT_TX_PEER_STATS_NUM_GI_COUNTERS; j++) {
 -		ARRAY_TO_STRING(tx_gi[j],
 -				htt_stats_buf->tx_gi[j],
 -				HTT_TX_PEER_STATS_NUM_MCS_COUNTERS);
 +		PRINT_ARRAY_TO_BUF(tx_gi[j],
 +				   htt_stats_buf->tx_gi[j],
 +				   HTT_TX_PEER_STATS_NUM_MCS_COUNTERS);
 		len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_gi[%u] = %s ",
 -				j, tx_gi[j]);
 +				   j, tx_gi[j]);
 	}
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf,
 -			htt_stats_buf->tx_dcm,
 -			HTT_TX_PDEV_STATS_NUM_DCM_COUNTERS);
 +	PRINT_ARRAY_TO_BUF(str_buf,
 +			   htt_stats_buf->tx_dcm,
 +			   HTT_TX_PDEV_STATS_NUM_DCM_COUNTERS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_dcm = %s\n", str_buf);
 	if (len >= buf_len)
@@ -895,47 +895,47 @@ static inline void htt_print_rx_peer_rat
 			   htt_stats_buf->rssi_comb);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_mcs,
 -			HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_mcs,
 +			   HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_mcs = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_nss,
 -			HTT_RX_PDEV_STATS_NUM_SPATIAL_STREAMS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_nss,
 +			   HTT_RX_PDEV_STATS_NUM_SPATIAL_STREAMS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_nss = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_dcm,
 -			HTT_RX_PDEV_STATS_NUM_DCM_COUNTERS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_dcm,
 +			   HTT_RX_PDEV_STATS_NUM_DCM_COUNTERS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_dcm = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_stbc,
 -			HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_stbc,
 +			   HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_stbc = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_bw,
 -			HTT_RX_PDEV_STATS_NUM_BW_COUNTERS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_bw,
 +			   HTT_RX_PDEV_STATS_NUM_BW_COUNTERS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_bw = %s ", str_buf);
 	for (j = 0; j < HTT_RX_PEER_STATS_NUM_SPATIAL_STREAMS; j++) {
 -		ARRAY_TO_STRING(rssi_chain[j], htt_stats_buf->rssi_chain[j],
 -				HTT_RX_PEER_STATS_NUM_BW_COUNTERS);
 +		PRINT_ARRAY_TO_BUF(rssi_chain[j], htt_stats_buf->rssi_chain[j],
 +				   HTT_RX_PEER_STATS_NUM_BW_COUNTERS);
 		len += HTT_DBG_OUT(buf + len, buf_len - len, "rssi_chain[%u] = %s ",
 				   j, rssi_chain[j]);
 	}
 	for (j = 0; j < HTT_RX_PEER_STATS_NUM_GI_COUNTERS; j++) {
 -		ARRAY_TO_STRING(rx_gi[j], htt_stats_buf->rx_gi[j],
 -				HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
 +		PRINT_ARRAY_TO_BUF(rx_gi[j], htt_stats_buf->rx_gi[j],
 +				   HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
 		len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_gi[%u] = %s ",
 -				j, rx_gi[j]);
 +				   j, rx_gi[j]);
 	}
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_pream,
 -			HTT_RX_PDEV_STATS_NUM_PREAMBLE_TYPES);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_pream,
 +			   HTT_RX_PDEV_STATS_NUM_PREAMBLE_TYPES);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_pream = %s\n", str_buf);
 	if (len >= buf_len)
@@ -1115,10 +1115,10 @@ htt_print_tx_hwq_difs_latency_stats_tlv_
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "hist_intvl = %u",
 			htt_stats_buf->hist_intvl);
 -	ARRAY_TO_STRING(difs_latency_hist, htt_stats_buf->difs_latency_hist,
 -			data_len);
 +	PRINT_ARRAY_TO_BUF(difs_latency_hist, htt_stats_buf->difs_latency_hist,
 +			   data_len);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "difs_latency_hist = %s\n",
 -			difs_latency_hist);
 +			   difs_latency_hist);
 	if (len >= buf_len)
 		buf[buf_len - 1] = 0;
@@ -1145,7 +1145,7 @@ htt_print_tx_hwq_cmd_result_stats_tlv_v(
 	len += HTT_DBG_OUT(buf + len, buf_len - len,
 			   "HTT_TX_HWQ_CMD_RESULT_STATS_TLV_V:");
 -	ARRAY_TO_STRING(cmd_result, htt_stats_buf->cmd_result, data_len);
 +	PRINT_ARRAY_TO_BUF(cmd_result, htt_stats_buf->cmd_result, data_len);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "cmd_result = %s\n", cmd_result);
@@ -1173,7 +1173,7 @@ htt_print_tx_hwq_cmd_stall_stats_tlv_v(c
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "HTT_TX_HWQ_CMD_STALL_STATS_TLV_V:");
 -	ARRAY_TO_STRING(cmd_stall_status, htt_stats_buf->cmd_stall_status, num_elems);
 +	PRINT_ARRAY_TO_BUF(cmd_stall_status, htt_stats_buf->cmd_stall_status, num_elems);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "cmd_stall_status = %s\n",
 			   cmd_stall_status);
@@ -1202,7 +1202,7 @@ htt_print_tx_hwq_fes_result_stats_tlv_v(
 	len += HTT_DBG_OUT(buf + len, buf_len - len,
 			   "HTT_TX_HWQ_FES_RESULT_STATS_TLV_V:");
 -	ARRAY_TO_STRING(fes_result, htt_stats_buf->fes_result, num_elems);
 +	PRINT_ARRAY_TO_BUF(fes_result, htt_stats_buf->fes_result, num_elems);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "fes_result = %s\n", fes_result);
 	if (len >= buf_len)
@@ -1233,9 +1233,9 @@ htt_print_tx_hwq_tried_mpdu_cnt_hist_tlv
 			   htt_stats_buf->hist_bin_size);
 	if (required_buffer_size < HTT_MAX_STRING_LEN) {
 -		ARRAY_TO_STRING(tried_mpdu_cnt_hist,
 -				htt_stats_buf->tried_mpdu_cnt_hist,
 -				num_elements);
 +		PRINT_ARRAY_TO_BUF(tried_mpdu_cnt_hist,
 +				   htt_stats_buf->tried_mpdu_cnt_hist,
 +				   num_elements);
 		len += HTT_DBG_OUT(buf + len, buf_len - len,
 				   "tried_mpdu_cnt_hist = %s\n",
 				   tried_mpdu_cnt_hist);
@@ -1269,9 +1269,9 @@ htt_print_tx_hwq_txop_used_cnt_hist_tlv_
 			   "HTT_TX_HWQ_TXOP_USED_CNT_HIST_TLV_V:");
 	if (required_buffer_size < HTT_MAX_STRING_LEN) {
 -		ARRAY_TO_STRING(txop_used_cnt_hist,
 -				htt_stats_buf->txop_used_cnt_hist,
 -				num_elements);
 +		PRINT_ARRAY_TO_BUF(txop_used_cnt_hist,
 +				   htt_stats_buf->txop_used_cnt_hist,
 +				   num_elements);
 		len += HTT_DBG_OUT(buf + len, buf_len - len, "txop_used_cnt_hist = %s\n",
 				   txop_used_cnt_hist);
 	} else {
@@ -1790,8 +1790,8 @@ htt_print_sched_txq_cmd_posted_tlv_v(con
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "HTT_SCHED_TXQ_CMD_POSTED_TLV_V:");
 -	ARRAY_TO_STRING(sched_cmd_posted, htt_stats_buf->sched_cmd_posted,
 -			num_elements);
 +	PRINT_ARRAY_TO_BUF(sched_cmd_posted, htt_stats_buf->sched_cmd_posted,
 +			   num_elements);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "sched_cmd_posted = %s\n",
 			   sched_cmd_posted);
@@ -1817,8 +1817,8 @@ htt_print_sched_txq_cmd_reaped_tlv_v(con
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "HTT_SCHED_TXQ_CMD_REAPED_TLV_V:");
 -	ARRAY_TO_STRING(sched_cmd_reaped, htt_stats_buf->sched_cmd_reaped,
 -			num_elements);
 +	PRINT_ARRAY_TO_BUF(sched_cmd_reaped, htt_stats_buf->sched_cmd_reaped,
 +			   num_elements);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "sched_cmd_reaped = %s\n",
 			   sched_cmd_reaped);
@@ -1847,8 +1847,8 @@ htt_print_sched_txq_sched_order_su_tlv_v
 	len += HTT_DBG_OUT(buf + len, buf_len - len,
 			   "HTT_SCHED_TXQ_SCHED_ORDER_SU_TLV_V:");
 -	ARRAY_TO_STRING(sched_order_su, htt_stats_buf->sched_order_su,
 -			sched_order_su_num_entries);
 +	PRINT_ARRAY_TO_BUF(sched_order_su, htt_stats_buf->sched_order_su,
 +			   sched_order_su_num_entries);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "sched_order_su = %s\n",
 			   sched_order_su);
@@ -1876,8 +1876,8 @@ htt_print_sched_txq_sched_ineligibility_
 	len += HTT_DBG_OUT(buf + len, buf_len - len,
 			   "HTT_SCHED_TXQ_SCHED_INELIGIBILITY_V:");
 -	ARRAY_TO_STRING(sched_ineligibility, htt_stats_buf->sched_ineligibility,
 -			sched_ineligibility_num_entries);
 +	PRINT_ARRAY_TO_BUF(sched_ineligibility, htt_stats_buf->sched_ineligibility,
 +			   sched_ineligibility_num_entries);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "sched_ineligibility = %s\n",
 			   sched_ineligibility);
@@ -1992,8 +1992,8 @@ htt_print_tx_tqm_gen_mpdu_stats_tlv_v(co
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "HTT_TX_TQM_GEN_MPDU_STATS_TLV_V:");
 -	ARRAY_TO_STRING(gen_mpdu_end_reason, htt_stats_buf->gen_mpdu_end_reason,
 -			num_elements);
 +	PRINT_ARRAY_TO_BUF(gen_mpdu_end_reason, htt_stats_buf->gen_mpdu_end_reason,
 +			   num_elements);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "gen_mpdu_end_reason = %s\n",
 			   gen_mpdu_end_reason);
@@ -2020,8 +2020,8 @@ htt_print_tx_tqm_list_mpdu_stats_tlv_v(c
 	len += HTT_DBG_OUT(buf + len, buf_len - len,
 			   "HTT_TX_TQM_LIST_MPDU_STATS_TLV_V:");
 -	ARRAY_TO_STRING(list_mpdu_end_reason, htt_stats_buf->list_mpdu_end_reason,
 -			num_elems);
 +	PRINT_ARRAY_TO_BUF(list_mpdu_end_reason, htt_stats_buf->list_mpdu_end_reason,
 +			   num_elems);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "list_mpdu_end_reason = %s\n",
 			   list_mpdu_end_reason);
 	if (len >= buf_len)
@@ -2047,8 +2047,8 @@ htt_print_tx_tqm_list_mpdu_cnt_tlv_v(con
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "HTT_TX_TQM_LIST_MPDU_CNT_TLV_V:");
 -	ARRAY_TO_STRING(list_mpdu_cnt_hist, htt_stats_buf->list_mpdu_cnt_hist,
 -			num_elems);
 +	PRINT_ARRAY_TO_BUF(list_mpdu_cnt_hist, htt_stats_buf->list_mpdu_cnt_hist,
 +			   num_elems);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "list_mpdu_cnt_hist = %s\n",
 			   list_mpdu_cnt_hist);
@@ -2539,9 +2539,9 @@ htt_print_tx_de_fw2wbm_ring_full_hist_tl
 			   "HTT_TX_DE_FW2WBM_RING_FULL_HIST_TLV");
 	if (required_buffer_size < HTT_MAX_STRING_LEN) {
 -		ARRAY_TO_STRING(fw2wbm_ring_full_hist,
 -				htt_stats_buf->fw2wbm_ring_full_hist,
 -				num_elements);
 +		PRINT_ARRAY_TO_BUF(fw2wbm_ring_full_hist,
 +				   htt_stats_buf->fw2wbm_ring_full_hist,
 +				   num_elements);
 		len += HTT_DBG_OUT(buf + len, buf_len - len,
 				   "fw2wbm_ring_full_hist = %s\n",
 				   fw2wbm_ring_full_hist);
@@ -2634,13 +2634,13 @@ static inline void htt_print_ring_if_sta
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "cons_blockwait_count = %u",
 			   htt_stats_buf->cons_blockwait_count);
 -	ARRAY_TO_STRING(low_wm_hit_count, htt_stats_buf->low_wm_hit_count,
 -			HTT_STATS_LOW_WM_BINS);
 +	PRINT_ARRAY_TO_BUF(low_wm_hit_count, htt_stats_buf->low_wm_hit_count,
 +			   HTT_STATS_LOW_WM_BINS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "low_wm_hit_count = %s ",
 			   low_wm_hit_count);
 -	ARRAY_TO_STRING(high_wm_hit_count, htt_stats_buf->high_wm_hit_count,
 -			HTT_STATS_HIGH_WM_BINS);
 +	PRINT_ARRAY_TO_BUF(high_wm_hit_count, htt_stats_buf->high_wm_hit_count,
 +			   HTT_STATS_HIGH_WM_BINS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "high_wm_hit_count = %s\n",
 			   high_wm_hit_count);
@@ -2687,9 +2687,9 @@ static inline void htt_print_sfm_client_
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "HTT_SFM_CLIENT_USER_TLV_V:");
 -	ARRAY_TO_STRING(dwords_used_by_user_n,
 -			htt_stats_buf->dwords_used_by_user_n,
 -			num_elems);
 +	PRINT_ARRAY_TO_BUF(dwords_used_by_user_n,
 +			   htt_stats_buf->dwords_used_by_user_n,
 +			   num_elems);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "dwords_used_by_user_n = %s\n",
 			   dwords_used_by_user_n);
@@ -2889,73 +2889,73 @@ static inline void htt_print_tx_pdev_rat
 			   htt_stats_buf->tx_legacy_ofdm_rate[7]);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->tx_mcs,
 -			HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->tx_mcs,
 +			   HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_mcs = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->ac_mu_mimo_tx_mcs,
 -			HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->ac_mu_mimo_tx_mcs,
 +			   HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "ac_mu_mimo_tx_mcs = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->ax_mu_mimo_tx_mcs,
 -			HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->ax_mu_mimo_tx_mcs,
 +			   HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "ax_mu_mimo_tx_mcs = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->ofdma_tx_mcs,
 -			HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->ofdma_tx_mcs,
 +			   HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "ofdma_tx_mcs = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->tx_nss,
 -			HTT_TX_PDEV_STATS_NUM_SPATIAL_STREAMS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->tx_nss,
 +			   HTT_TX_PDEV_STATS_NUM_SPATIAL_STREAMS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_nss = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->ac_mu_mimo_tx_nss,
 -			HTT_TX_PDEV_STATS_NUM_SPATIAL_STREAMS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->ac_mu_mimo_tx_nss,
 +			   HTT_TX_PDEV_STATS_NUM_SPATIAL_STREAMS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "ac_mu_mimo_tx_nss = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->ax_mu_mimo_tx_nss,
 -			HTT_TX_PDEV_STATS_NUM_SPATIAL_STREAMS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->ax_mu_mimo_tx_nss,
 +			   HTT_TX_PDEV_STATS_NUM_SPATIAL_STREAMS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "ax_mu_mimo_tx_nss = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->ofdma_tx_nss,
 -			HTT_TX_PDEV_STATS_NUM_SPATIAL_STREAMS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->ofdma_tx_nss,
 +			   HTT_TX_PDEV_STATS_NUM_SPATIAL_STREAMS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "ofdma_tx_nss = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->tx_bw,
 -			HTT_TX_PDEV_STATS_NUM_BW_COUNTERS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->tx_bw,
 +			   HTT_TX_PDEV_STATS_NUM_BW_COUNTERS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_bw = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->ac_mu_mimo_tx_bw,
 -			HTT_TX_PDEV_STATS_NUM_BW_COUNTERS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->ac_mu_mimo_tx_bw,
 +			   HTT_TX_PDEV_STATS_NUM_BW_COUNTERS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "ac_mu_mimo_tx_bw = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->ax_mu_mimo_tx_bw,
 -			HTT_TX_PDEV_STATS_NUM_BW_COUNTERS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->ax_mu_mimo_tx_bw,
 +			   HTT_TX_PDEV_STATS_NUM_BW_COUNTERS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "ax_mu_mimo_tx_bw = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->ofdma_tx_bw,
 -			HTT_TX_PDEV_STATS_NUM_BW_COUNTERS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->ofdma_tx_bw,
 +			   HTT_TX_PDEV_STATS_NUM_BW_COUNTERS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "ofdma_tx_bw = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->tx_stbc,
 -			HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->tx_stbc,
 +			   HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_stbc = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->tx_pream,
 -			HTT_TX_PDEV_STATS_NUM_PREAMBLE_TYPES);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->tx_pream,
 +			   HTT_TX_PDEV_STATS_NUM_PREAMBLE_TYPES);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_pream = %s ", str_buf);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "HE LTF: 1x: %u, 2x: %u, 4x: %u",
@@ -2965,16 +2965,16 @@ static inline void htt_print_tx_pdev_rat
 	/* SU GI Stats */
 	for (j = 0; j < HTT_TX_PDEV_STATS_NUM_GI_COUNTERS; j++) {
 -		ARRAY_TO_STRING(tx_gi[j], htt_stats_buf->tx_gi[j],
 -				HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
 +		PRINT_ARRAY_TO_BUF(tx_gi[j], htt_stats_buf->tx_gi[j],
 +				   HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
 		len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_gi[%u] = %s ",
 				   j, tx_gi[j]);
 	}
 	/* AC MU-MIMO GI Stats */
 	for (j = 0; j < HTT_TX_PDEV_STATS_NUM_GI_COUNTERS; j++) {
 -		ARRAY_TO_STRING(tx_gi[j], htt_stats_buf->ac_mu_mimo_tx_gi[j],
 -				HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
 +		PRINT_ARRAY_TO_BUF(tx_gi[j], htt_stats_buf->ac_mu_mimo_tx_gi[j],
 +				   HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
 		len += HTT_DBG_OUT(buf + len, buf_len - len,
 				   "ac_mu_mimo_tx_gi[%u] = %s ",
 				   j, tx_gi[j]);
@@ -2982,8 +2982,8 @@ static inline void htt_print_tx_pdev_rat
 	/* AX MU-MIMO GI Stats */
 	for (j = 0; j < HTT_TX_PDEV_STATS_NUM_GI_COUNTERS; j++) {
 -		ARRAY_TO_STRING(tx_gi[j], htt_stats_buf->ax_mu_mimo_tx_gi[j],
 -				HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
 +		PRINT_ARRAY_TO_BUF(tx_gi[j], htt_stats_buf->ax_mu_mimo_tx_gi[j],
 +				   HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
 		len += HTT_DBG_OUT(buf + len, buf_len - len,
 				   "ax_mu_mimo_tx_gi[%u] = %s ",
 				   j, tx_gi[j]);
@@ -2991,15 +2991,15 @@ static inline void htt_print_tx_pdev_rat
 	/* DL OFDMA GI Stats */
 	for (j = 0; j < HTT_TX_PDEV_STATS_NUM_GI_COUNTERS; j++) {
 -		ARRAY_TO_STRING(tx_gi[j], htt_stats_buf->ofdma_tx_gi[j],
 -				HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
 +		PRINT_ARRAY_TO_BUF(tx_gi[j], htt_stats_buf->ofdma_tx_gi[j],
 +				   HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
 		len += HTT_DBG_OUT(buf + len, buf_len - len, "ofdma_tx_gi[%u] = %s ",
 				   j, tx_gi[j]);
 	}
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->tx_dcm,
 -			HTT_TX_PDEV_STATS_NUM_DCM_COUNTERS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->tx_dcm,
 +			   HTT_TX_PDEV_STATS_NUM_DCM_COUNTERS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_dcm = %s\n", str_buf);
 	if (len >= buf_len)
@@ -3064,28 +3064,28 @@ static inline void htt_print_rx_pdev_rat
 			   htt_stats_buf->rssi_in_dbm);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_mcs,
 -			HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_mcs,
 +			   HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_mcs = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_nss,
 -			HTT_RX_PDEV_STATS_NUM_SPATIAL_STREAMS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_nss,
 +			   HTT_RX_PDEV_STATS_NUM_SPATIAL_STREAMS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_nss = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_dcm,
 -			HTT_RX_PDEV_STATS_NUM_DCM_COUNTERS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_dcm,
 +			   HTT_RX_PDEV_STATS_NUM_DCM_COUNTERS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_dcm = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_stbc,
 -			HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_stbc,
 +			   HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_stbc = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_bw,
 -			HTT_RX_PDEV_STATS_NUM_BW_COUNTERS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_bw,
 +			   HTT_RX_PDEV_STATS_NUM_BW_COUNTERS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_bw = %s ", str_buf);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_evm_nss_count = %u",
 			htt_stats_buf->nss_count);
@@ -3115,22 +3115,22 @@ static inline void htt_print_rx_pdev_rat
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "pilot_evm_dB_mean = %s ", str_buf);
 	for (j = 0; j < HTT_RX_PDEV_STATS_NUM_SPATIAL_STREAMS; j++) {
 -		ARRAY_TO_STRING(rssi_chain[j], htt_stats_buf->rssi_chain[j],
 -				HTT_RX_PDEV_STATS_NUM_BW_COUNTERS);
 +		PRINT_ARRAY_TO_BUF(rssi_chain[j], htt_stats_buf->rssi_chain[j],
 +				   HTT_RX_PDEV_STATS_NUM_BW_COUNTERS);
 		len += HTT_DBG_OUT(buf + len, buf_len - len, "rssi_chain[%u] = %s ",
 				   j, rssi_chain[j]);
 	}
 	for (j = 0; j < HTT_RX_PDEV_STATS_NUM_GI_COUNTERS; j++) {
 -		ARRAY_TO_STRING(rx_gi[j], htt_stats_buf->rx_gi[j],
 -				HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
 +		PRINT_ARRAY_TO_BUF(rx_gi[j], htt_stats_buf->rx_gi[j],
 +				   HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
 		len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_gi[%u] = %s ",
 				   j, rx_gi[j]);
 	}
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_pream,
 -			HTT_RX_PDEV_STATS_NUM_PREAMBLE_TYPES);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_pream,
 +			   HTT_RX_PDEV_STATS_NUM_PREAMBLE_TYPES);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_pream = %s", str_buf);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_11ax_su_ext = %u",
@@ -3145,14 +3145,14 @@ static inline void htt_print_rx_pdev_rat
 			   htt_stats_buf->txbf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_legacy_cck_rate,
 -			HTT_RX_PDEV_STATS_NUM_LEGACY_CCK_STATS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_legacy_cck_rate,
 +			   HTT_RX_PDEV_STATS_NUM_LEGACY_CCK_STATS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_legacy_cck_rate = %s ",
 			   str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_legacy_ofdm_rate,
 -			HTT_RX_PDEV_STATS_NUM_LEGACY_OFDM_STATS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_legacy_ofdm_rate,
 +			   HTT_RX_PDEV_STATS_NUM_LEGACY_OFDM_STATS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_legacy_ofdm_rate = %s ",
 			   str_buf);
@@ -3164,25 +3164,25 @@ static inline void htt_print_rx_pdev_rat
 			htt_stats_buf->rx_11ax_ul_ofdma);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->ul_ofdma_rx_mcs,
 -			HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->ul_ofdma_rx_mcs,
 +			   HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "ul_ofdma_rx_mcs = %s ", str_buf);
 	for (j = 0; j < HTT_RX_PDEV_STATS_NUM_GI_COUNTERS; j++) {
 -		ARRAY_TO_STRING(rx_gi[j], htt_stats_buf->ul_ofdma_rx_gi[j],
 -				HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
 +		PRINT_ARRAY_TO_BUF(rx_gi[j], htt_stats_buf->ul_ofdma_rx_gi[j],
 +				   HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
 		len += HTT_DBG_OUT(buf + len, buf_len - len, "ul_ofdma_rx_gi[%u] = %s ",
 				   j, rx_gi[j]);
 	}
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->ul_ofdma_rx_nss,
 -			HTT_RX_PDEV_STATS_NUM_SPATIAL_STREAMS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->ul_ofdma_rx_nss,
 +			   HTT_RX_PDEV_STATS_NUM_SPATIAL_STREAMS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "ul_ofdma_rx_nss = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->ul_ofdma_rx_bw,
 -			HTT_RX_PDEV_STATS_NUM_BW_COUNTERS);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->ul_ofdma_rx_bw,
 +			   HTT_RX_PDEV_STATS_NUM_BW_COUNTERS);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "ul_ofdma_rx_bw = %s ", str_buf);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "ul_ofdma_rx_stbc = %u",
@@ -3191,25 +3191,25 @@ static inline void htt_print_rx_pdev_rat
 			htt_stats_buf->ul_ofdma_rx_ldpc);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_ulofdma_non_data_ppdu,
 -			HTT_RX_PDEV_MAX_OFDMA_NUM_USER);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_ulofdma_non_data_ppdu,
 +			   HTT_RX_PDEV_MAX_OFDMA_NUM_USER);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_ulofdma_non_data_ppdu = %s ",
 			   str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_ulofdma_data_ppdu,
 -			HTT_RX_PDEV_MAX_OFDMA_NUM_USER);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_ulofdma_data_ppdu,
 +			   HTT_RX_PDEV_MAX_OFDMA_NUM_USER);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_ulofdma_data_ppdu = %s ",
 			   str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_ulofdma_mpdu_ok,
 -			HTT_RX_PDEV_MAX_OFDMA_NUM_USER);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_ulofdma_mpdu_ok,
 +			   HTT_RX_PDEV_MAX_OFDMA_NUM_USER);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_ulofdma_mpdu_ok = %s ", str_buf);
 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
 -	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_ulofdma_mpdu_fail,
 -			HTT_RX_PDEV_MAX_OFDMA_NUM_USER);
 +	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_ulofdma_mpdu_fail,
 +			   HTT_RX_PDEV_MAX_OFDMA_NUM_USER);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_ulofdma_mpdu_fail = %s",
 			   str_buf);
@@ -3320,9 +3320,9 @@ htt_print_rx_soc_fw_refill_ring_empty_tl
 	len += HTT_DBG_OUT(buf + len, buf_len - len,
 			   "HTT_RX_SOC_FW_REFILL_RING_EMPTY_TLV_V:");
 -	ARRAY_TO_STRING(refill_ring_empty_cnt,
 -			htt_stats_buf->refill_ring_empty_cnt,
 -			num_elems);
 +	PRINT_ARRAY_TO_BUF(refill_ring_empty_cnt,
 +			   htt_stats_buf->refill_ring_empty_cnt,
 +			   num_elems);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "refill_ring_empty_cnt = %s\n",
 			   refill_ring_empty_cnt);
@@ -3350,9 +3350,9 @@ htt_print_rx_soc_fw_refill_ring_num_rxdm
 	len += HTT_DBG_OUT(buf + len, buf_len - len,
 			   "HTT_RX_SOC_FW_REFILL_RING_NUM_RXDMA_ERR_TLV_V:");
 -	ARRAY_TO_STRING(rxdma_err_cnt,
 -			htt_stats_buf->rxdma_err,
 -			num_elems);
 +	PRINT_ARRAY_TO_BUF(rxdma_err_cnt,
 +			   htt_stats_buf->rxdma_err,
 +			   num_elems);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rxdma_err = %s\n",
 			   rxdma_err_cnt);
@@ -3379,9 +3379,9 @@ htt_print_rx_soc_fw_refill_ring_num_reo_
 	len += HTT_DBG_OUT(buf + len, buf_len - len,
 			   "HTT_RX_SOC_FW_REFILL_RING_NUM_REO_ERR_TLV_V:");
 -	ARRAY_TO_STRING(reo_err_cnt,
 -			htt_stats_buf->reo_err,
 -			num_elems);
 +	PRINT_ARRAY_TO_BUF(reo_err_cnt,
 +			   htt_stats_buf->reo_err,
 +			   num_elems);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "reo_err = %s\n",
 			   reo_err_cnt);
@@ -3447,9 +3447,9 @@ htt_print_rx_soc_fw_refill_ring_num_refi
 	len += HTT_DBG_OUT(buf + len, buf_len - len,
 			   "HTT_RX_SOC_FW_REFILL_RING_NUM_REFILL_TLV_V:");
 -	ARRAY_TO_STRING(refill_ring_num_refill,
 -			htt_stats_buf->refill_ring_num_refill,
 -			num_elems);
 +	PRINT_ARRAY_TO_BUF(refill_ring_num_refill,
 +			   htt_stats_buf->refill_ring_num_refill,
 +			   num_elems);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "refill_ring_num_refill = %s\n",
 			   refill_ring_num_refill);
@@ -3491,15 +3491,15 @@ static inline void htt_print_rx_pdev_fw_
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "fw_ring_mpdu_ind = %u",
 			   htt_stats_buf->fw_ring_mpdu_ind);
 -	ARRAY_TO_STRING(fw_ring_mgmt_subtype,
 -			htt_stats_buf->fw_ring_mgmt_subtype,
 -			HTT_STATS_SUBTYPE_MAX);
 +	PRINT_ARRAY_TO_BUF(fw_ring_mgmt_subtype,
 +			   htt_stats_buf->fw_ring_mgmt_subtype,
 +			   HTT_STATS_SUBTYPE_MAX);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "fw_ring_mgmt_subtype = %s ",
 			   fw_ring_mgmt_subtype);
 -	ARRAY_TO_STRING(fw_ring_ctrl_subtype,
 -			htt_stats_buf->fw_ring_ctrl_subtype,
 -			HTT_STATS_SUBTYPE_MAX);
 +	PRINT_ARRAY_TO_BUF(fw_ring_ctrl_subtype,
 +			   htt_stats_buf->fw_ring_ctrl_subtype,
 +			   HTT_STATS_SUBTYPE_MAX);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "fw_ring_ctrl_subtype = %s ",
 			   fw_ring_ctrl_subtype);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "fw_ring_mcast_data_msdu = %u",
@@ -3597,9 +3597,9 @@ htt_print_rx_pdev_fw_ring_mpdu_err_tlv_v
 	len += HTT_DBG_OUT(buf + len, buf_len - len,
 			   "HTT_RX_PDEV_FW_RING_MPDU_ERR_TLV_V:");
 -	ARRAY_TO_STRING(fw_ring_mpdu_err,
 -			htt_stats_buf->fw_ring_mpdu_err,
 -			HTT_RX_STATS_RXDMA_MAX_ERR);
 +	PRINT_ARRAY_TO_BUF(fw_ring_mpdu_err,
 +			   htt_stats_buf->fw_ring_mpdu_err,
 +			   HTT_RX_STATS_RXDMA_MAX_ERR);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "fw_ring_mpdu_err = %s\n",
 			   fw_ring_mpdu_err);
@@ -3625,9 +3625,9 @@ htt_print_rx_pdev_fw_mpdu_drop_tlv_v(con
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "HTT_RX_PDEV_FW_MPDU_DROP_TLV_V:");
 -	ARRAY_TO_STRING(fw_mpdu_drop,
 -			htt_stats_buf->fw_mpdu_drop,
 -			num_elems);
 +	PRINT_ARRAY_TO_BUF(fw_mpdu_drop,
 +			   htt_stats_buf->fw_mpdu_drop,
 +			   num_elems);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "fw_mpdu_drop = %s\n", fw_mpdu_drop);
 	if (len >= buf_len)
@@ -3654,9 +3654,9 @@ htt_print_rx_pdev_fw_stats_phy_err_tlv(c
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "total_phy_err_nct = %u",
 			   htt_stats_buf->total_phy_err_cnt);
 -	ARRAY_TO_STRING(phy_errs,
 -			htt_stats_buf->phy_err,
 -			HTT_STATS_PHY_ERR_MAX);
 +	PRINT_ARRAY_TO_BUF(phy_errs,
 +			   htt_stats_buf->phy_err,
 +			   HTT_STATS_PHY_ERR_MAX);
 	len += HTT_DBG_OUT(buf + len, buf_len - len, "phy_errs = %s\n", phy_errs);
 	if (len >= buf_len)
--- a/package/kernel/mac80211/patches/ath11k/0042-wifi-ath11k-Add-tx-ack-signal-support-for-management.patch
+++ b/package/kernel/mac80211/patches/ath11k/0042-wifi-ath11k-Add-tx-ack-signal-support-for-management.patch
@ -0,0 +1,150 @@
 From 01c6c9fccbd51c1d9eab0f5794b0271b026178df Mon Sep 17 00:00:00 2001
 From: Abinaya Kalaiselvan <quic_akalaise@quicinc.com>
 Date: Mon, 19 Dec 2022 11:08:44 +0530
 Subject: [PATCH] wifi: ath11k: Add tx ack signal support for management
 packets
 Add support to notify tx ack signal values for management
 packets to userspace through nl80211 interface.
 Advertise NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT flag
 to enable this feature and it will be used for data
 packets as well.
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Abinaya Kalaiselvan <quic_akalaise@quicinc.com>
 Signed-off-by: Maharaja Kennadyrajan <quic_mkenna@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20221219053844.4084486-1-quic_mkenna@quicinc.com
 ---
 drivers/net/wireless/ath/ath11k/hw.c  |  1 +
 drivers/net/wireless/ath/ath11k/mac.c |  5 +++++
 drivers/net/wireless/ath/ath11k/wmi.c | 27 ++++++++++++++++-----------
 drivers/net/wireless/ath/ath11k/wmi.h |  3 +++
 4 files changed, 25 insertions(+), 11 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/hw.c
 +++ b/drivers/net/wireless/ath/ath11k/hw.c
@@ -201,6 +201,7 @@ static void ath11k_init_wmi_config_ipq80
 	config->twt_ap_pdev_count = ab->num_radios;
 	config->twt_ap_sta_count = 1000;
 	config->flag1 |= WMI_RSRC_CFG_FLAG1_BSS_CHANNEL_INFO_64;
 +	config->flag1 |= WMI_RSRC_CFG_FLAG1_ACK_RSSI;
 }
 static int ath11k_hw_mac_id_to_pdev_id_ipq8074(struct ath11k_hw_params *hw,
 --- a/drivers/net/wireless/ath/ath11k/mac.c
 +++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -9174,6 +9174,11 @@ static int __ath11k_mac_register(struct
 		goto err_free_if_combs;
 	}
 +	if (test_bit(WMI_TLV_SERVICE_TX_DATA_MGMT_ACK_RSSI,
 +		     ar->ab->wmi_ab.svc_map))
 +		wiphy_ext_feature_set(ar->hw->wiphy,
 +				      NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
 +
 	ar->hw->queues = ATH11K_HW_MAX_QUEUES;
 	ar->hw->wiphy->tx_queue_len = ATH11K_QUEUE_LEN;
 	ar->hw->offchannel_tx_hw_queue = ATH11K_HW_MAX_QUEUES - 1;
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -5229,8 +5229,8 @@ static int ath11k_pull_mgmt_rx_params_tl
 	return 0;
 }
 -static int wmi_process_mgmt_tx_comp(struct ath11k *ar, u32 desc_id,
 -				    u32 status)
 +static int wmi_process_mgmt_tx_comp(struct ath11k *ar,
 +				    struct wmi_mgmt_tx_compl_event *tx_compl_param)
 {
 	struct sk_buff *msdu;
 	struct ieee80211_tx_info *info;
@@ -5238,24 +5238,29 @@ static int wmi_process_mgmt_tx_comp(stru
 	int num_mgmt;
 	spin_lock_bh(&ar->txmgmt_idr_lock);
 -	msdu = idr_find(&ar->txmgmt_idr, desc_id);
 +	msdu = idr_find(&ar->txmgmt_idr, tx_compl_param->desc_id);
 	if (!msdu) {
 		ath11k_warn(ar->ab, "received mgmt tx compl for invalid msdu_id: %d\n",
 -			    desc_id);
 +			    tx_compl_param->desc_id);
 		spin_unlock_bh(&ar->txmgmt_idr_lock);
 		return -ENOENT;
 	}
 -	idr_remove(&ar->txmgmt_idr, desc_id);
 +	idr_remove(&ar->txmgmt_idr, tx_compl_param->desc_id);
 	spin_unlock_bh(&ar->txmgmt_idr_lock);
 	skb_cb = ATH11K_SKB_CB(msdu);
 	dma_unmap_single(ar->ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
 	info = IEEE80211_SKB_CB(msdu);
 -	if ((!(info->flags & IEEE80211_TX_CTL_NO_ACK)) && !status)
 +	if ((!(info->flags & IEEE80211_TX_CTL_NO_ACK)) &&
 +	    !tx_compl_param->status) {
 		info->flags |= IEEE80211_TX_STAT_ACK;
 +		if (test_bit(WMI_TLV_SERVICE_TX_DATA_MGMT_ACK_RSSI,
 +			     ar->ab->wmi_ab.svc_map))
 +			info->status.ack_signal = tx_compl_param->ack_rssi;
 +	}
 	ieee80211_tx_status_irqsafe(ar->hw, msdu);
@@ -5267,7 +5272,7 @@ static int wmi_process_mgmt_tx_comp(stru
 	ath11k_dbg(ar->ab, ATH11K_DBG_WMI,
 		   "wmi mgmt tx comp pending %d desc id %d\n",
 -		   num_mgmt, desc_id);
 +		   num_mgmt, tx_compl_param->desc_id);
 	if (!num_mgmt)
 		wake_up(&ar->txmgmt_empty_waitq);
@@ -5300,6 +5305,7 @@ static int ath11k_pull_mgmt_tx_compl_par
 	param->pdev_id = ev->pdev_id;
 	param->desc_id = ev->desc_id;
 	param->status = ev->status;
 +	param->ack_rssi = ev->ack_rssi;
 	kfree(tb);
 	return 0;
@@ -7070,13 +7076,12 @@ static void ath11k_mgmt_tx_compl_event(s
 		goto exit;
 	}
 -	wmi_process_mgmt_tx_comp(ar, tx_compl_param.desc_id,
 -				 tx_compl_param.status);
 +	wmi_process_mgmt_tx_comp(ar, &tx_compl_param);
 	ath11k_dbg(ab, ATH11K_DBG_MGMT,
 -		   "mgmt tx compl ev pdev_id %d, desc_id %d, status %d",
 +		   "mgmt tx compl ev pdev_id %d, desc_id %d, status %d ack_rssi %d",
 		   tx_compl_param.pdev_id, tx_compl_param.desc_id,
 -		   tx_compl_param.status);
 +		   tx_compl_param.status, tx_compl_param.ack_rssi);
 exit:
 	rcu_read_unlock();
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
@@ -2311,6 +2311,7 @@ struct wmi_init_cmd {
 } __packed;
 #define WMI_RSRC_CFG_FLAG1_BSS_CHANNEL_INFO_64 BIT(5)
 +#define WMI_RSRC_CFG_FLAG1_ACK_RSSI BIT(18)
 struct wmi_resource_config {
 	u32 tlv_header;
@@ -4550,6 +4551,8 @@ struct wmi_mgmt_tx_compl_event {
 	u32 desc_id;
 	u32 status;
 	u32 pdev_id;
 +	u32 ppdu_id;
 +	u32 ack_rssi;
 } __packed;
 struct wmi_scan_event {
--- a/package/kernel/mac80211/patches/ath11k/0043-ath11k-Replace-HTT_DBG_OUT-with-scnprintf.patch
+++ b/package/kernel/mac80211/patches/ath11k/0043-ath11k-Replace-HTT_DBG_OUT-with-scnprintf.patch
--- a/package/kernel/mac80211/patches/ath11k/0043-wifi-ath11k-use-proper-regulatory-reference-for-band.patch
+++ b/package/kernel/mac80211/patches/ath11k/0043-wifi-ath11k-use-proper-regulatory-reference-for-band.patch
@ -0,0 +1,216 @@
 From 25e289e1f52e1f4fb1d07622c6a24f8d8a8e420d Mon Sep 17 00:00:00 2001
 From: Aditya Kumar Singh <quic_adisi@quicinc.com>
 Date: Wed, 1 Mar 2023 16:20:58 +0200
 Subject: [PATCH] wifi: ath11k: use proper regulatory reference for bands
 Currently, during regulatory event, 2 GHz/5 GHz is referred
 to as 2G/5G including variable names. However, there is no
 such entity as 2G or 5G.
 Re-name such occurences to its proper name. No functional changes.
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
 Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
 Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20230110121024.14051-2-quic_adisi@quicinc.com
 ---
 drivers/net/wireless/ath/ath11k/reg.c | 20 ++++-----
 drivers/net/wireless/ath/ath11k/wmi.c | 58 ++++++++++++++-------------
 drivers/net/wireless/ath/ath11k/wmi.h | 28 ++++++-------
 3 files changed, 54 insertions(+), 52 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/reg.c
 +++ b/drivers/net/wireless/ath/ath11k/reg.c
@@ -619,7 +619,7 @@ ath11k_reg_build_regd(struct ath11k_base
 	u32 flags;
 	char alpha2[3];
 -	num_rules = reg_info->num_5g_reg_rules + reg_info->num_2g_reg_rules;
 +	num_rules = reg_info->num_5ghz_reg_rules + reg_info->num_2ghz_reg_rules;
 	if (!num_rules)
 		goto ret;
@@ -644,20 +644,20 @@ ath11k_reg_build_regd(struct ath11k_base
 		   alpha2, ath11k_reg_get_regdom_str(tmp_regd->dfs_region),
 		   reg_info->dfs_region, num_rules);
 	/* Update reg_rules[] below. Firmware is expected to
 -	 * send these rules in order(2G rules first and then 5G)
 +	 * send these rules in order(2 GHz rules first and then 5 GHz)
 	 */
 	for (; i < num_rules; i++) {
 -		if (reg_info->num_2g_reg_rules &&
 -		    (i < reg_info->num_2g_reg_rules)) {
 -			reg_rule = reg_info->reg_rules_2g_ptr + i;
 +		if (reg_info->num_2ghz_reg_rules &&
 +		    (i < reg_info->num_2ghz_reg_rules)) {
 +			reg_rule = reg_info->reg_rules_2ghz_ptr + i;
 			max_bw = min_t(u16, reg_rule->max_bw,
 -				       reg_info->max_bw_2g);
 +				       reg_info->max_bw_2ghz);
 			flags = 0;
 -		} else if (reg_info->num_5g_reg_rules &&
 -			   (j < reg_info->num_5g_reg_rules)) {
 -			reg_rule = reg_info->reg_rules_5g_ptr + j++;
 +		} else if (reg_info->num_5ghz_reg_rules &&
 +			   (j < reg_info->num_5ghz_reg_rules)) {
 +			reg_rule = reg_info->reg_rules_5ghz_ptr + j++;
 			max_bw = min_t(u16, reg_rule->max_bw,
 -				       reg_info->max_bw_5g);
 +				       reg_info->max_bw_5ghz);
 			/* FW doesn't pass NL80211_RRF_AUTO_BW flag for
 			 * BW Auto correction, we can enable this by default
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -4959,7 +4959,7 @@ static int ath11k_pull_reg_chan_list_upd
 	const void **tb;
 	const struct wmi_reg_chan_list_cc_event *chan_list_event_hdr;
 	struct wmi_regulatory_rule_struct *wmi_reg_rule;
 -	u32 num_2g_reg_rules, num_5g_reg_rules;
 +	u32 num_2ghz_reg_rules, num_5ghz_reg_rules;
 	int ret;
 	ath11k_dbg(ab, ATH11K_DBG_WMI, "processing regulatory channel list\n");
@@ -4978,10 +4978,10 @@ static int ath11k_pull_reg_chan_list_upd
 		return -EPROTO;
 	}
 -	reg_info->num_2g_reg_rules = chan_list_event_hdr->num_2g_reg_rules;
 -	reg_info->num_5g_reg_rules = chan_list_event_hdr->num_5g_reg_rules;
 +	reg_info->num_2ghz_reg_rules = chan_list_event_hdr->num_2ghz_reg_rules;
 +	reg_info->num_5ghz_reg_rules = chan_list_event_hdr->num_5ghz_reg_rules;
 -	if (!(reg_info->num_2g_reg_rules + reg_info->num_5g_reg_rules)) {
 +	if (!(reg_info->num_2ghz_reg_rules + reg_info->num_5ghz_reg_rules)) {
 		ath11k_warn(ab, "No regulatory rules available in the event info\n");
 		kfree(tb);
 		return -EINVAL;
@@ -5008,46 +5008,48 @@ static int ath11k_pull_reg_chan_list_upd
 	else if (chan_list_event_hdr->status_code == WMI_REG_SET_CC_STATUS_FAIL)
 		reg_info->status_code = REG_SET_CC_STATUS_FAIL;
 -	reg_info->min_bw_2g = chan_list_event_hdr->min_bw_2g;
 -	reg_info->max_bw_2g = chan_list_event_hdr->max_bw_2g;
 -	reg_info->min_bw_5g = chan_list_event_hdr->min_bw_5g;
 -	reg_info->max_bw_5g = chan_list_event_hdr->max_bw_5g;
 +	reg_info->min_bw_2ghz = chan_list_event_hdr->min_bw_2ghz;
 +	reg_info->max_bw_2ghz = chan_list_event_hdr->max_bw_2ghz;
 +	reg_info->min_bw_5ghz = chan_list_event_hdr->min_bw_5ghz;
 +	reg_info->max_bw_5ghz = chan_list_event_hdr->max_bw_5ghz;
 -	num_2g_reg_rules = reg_info->num_2g_reg_rules;
 -	num_5g_reg_rules = reg_info->num_5g_reg_rules;
 +	num_2ghz_reg_rules = reg_info->num_2ghz_reg_rules;
 +	num_5ghz_reg_rules = reg_info->num_5ghz_reg_rules;
 	ath11k_dbg(ab, ATH11K_DBG_WMI,
 -		   "%s:cc %s dsf %d BW: min_2g %d max_2g %d min_5g %d max_5g %d",
 +		   "%s:cc %s dsf %d BW: min_2ghz %d max_2ghz %d min_5ghz %d max_5ghz %d",
 		   __func__, reg_info->alpha2, reg_info->dfs_region,
 -		   reg_info->min_bw_2g, reg_info->max_bw_2g,
 -		   reg_info->min_bw_5g, reg_info->max_bw_5g);
 +		   reg_info->min_bw_2ghz, reg_info->max_bw_2ghz,
 +		   reg_info->min_bw_5ghz, reg_info->max_bw_5ghz);
 	ath11k_dbg(ab, ATH11K_DBG_WMI,
 -		   "%s: num_2g_reg_rules %d num_5g_reg_rules %d", __func__,
 -		   num_2g_reg_rules, num_5g_reg_rules);
 +		   "%s: num_2ghz_reg_rules %d num_5ghz_reg_rules %d", __func__,
 +		   num_2ghz_reg_rules, num_5ghz_reg_rules);
 	wmi_reg_rule =
 		(struct wmi_regulatory_rule_struct *)((u8 *)chan_list_event_hdr
 						+ sizeof(*chan_list_event_hdr)
 						+ sizeof(struct wmi_tlv));
 -	if (num_2g_reg_rules) {
 -		reg_info->reg_rules_2g_ptr = create_reg_rules_from_wmi(num_2g_reg_rules,
 -								       wmi_reg_rule);
 -		if (!reg_info->reg_rules_2g_ptr) {
 +	if (num_2ghz_reg_rules) {
 +		reg_info->reg_rules_2ghz_ptr =
 +				create_reg_rules_from_wmi(num_2ghz_reg_rules,
 +							  wmi_reg_rule);
 +		if (!reg_info->reg_rules_2ghz_ptr) {
 			kfree(tb);
 -			ath11k_warn(ab, "Unable to Allocate memory for 2g rules\n");
 +			ath11k_warn(ab, "Unable to Allocate memory for 2 GHz rules\n");
 			return -ENOMEM;
 		}
 	}
 -	if (num_5g_reg_rules) {
 -		wmi_reg_rule += num_2g_reg_rules;
 -		reg_info->reg_rules_5g_ptr = create_reg_rules_from_wmi(num_5g_reg_rules,
 -								       wmi_reg_rule);
 -		if (!reg_info->reg_rules_5g_ptr) {
 +	if (num_5ghz_reg_rules) {
 +		wmi_reg_rule += num_2ghz_reg_rules;
 +		reg_info->reg_rules_5ghz_ptr =
 +				create_reg_rules_from_wmi(num_5ghz_reg_rules,
 +							  wmi_reg_rule);
 +		if (!reg_info->reg_rules_5ghz_ptr) {
 			kfree(tb);
 -			ath11k_warn(ab, "Unable to Allocate memory for 5g rules\n");
 +			ath11k_warn(ab, "Unable to Allocate memory for 5 GHz rules\n");
 			return -ENOMEM;
 		}
 	}
@@ -6619,8 +6621,8 @@ fallback:
 	WARN_ON(1);
 mem_free:
 	if (reg_info) {
 -		kfree(reg_info->reg_rules_2g_ptr);
 -		kfree(reg_info->reg_rules_5g_ptr);
 +		kfree(reg_info->reg_rules_2ghz_ptr);
 +		kfree(reg_info->reg_rules_5ghz_ptr);
 		kfree(reg_info);
 	}
 	return ret;
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
@@ -4129,14 +4129,14 @@ struct cur_regulatory_info {
 	u8 alpha2[REG_ALPHA2_LEN + 1];
 	u32 dfs_region;
 	u32 phybitmap;
 -	u32 min_bw_2g;
 -	u32 max_bw_2g;
 -	u32 min_bw_5g;
 -	u32 max_bw_5g;
 -	u32 num_2g_reg_rules;
 -	u32 num_5g_reg_rules;
 -	struct cur_reg_rule *reg_rules_2g_ptr;
 -	struct cur_reg_rule *reg_rules_5g_ptr;
 +	u32 min_bw_2ghz;
 +	u32 max_bw_2ghz;
 +	u32 min_bw_5ghz;
 +	u32 max_bw_5ghz;
 +	u32 num_2ghz_reg_rules;
 +	u32 num_5ghz_reg_rules;
 +	struct cur_reg_rule *reg_rules_2ghz_ptr;
 +	struct cur_reg_rule *reg_rules_5ghz_ptr;
 };
 struct wmi_reg_chan_list_cc_event {
@@ -4148,12 +4148,12 @@ struct wmi_reg_chan_list_cc_event {
 	u32 domain_code;
 	u32 dfs_region;
 	u32 phybitmap;
 -	u32 min_bw_2g;
 -	u32 max_bw_2g;
 -	u32 min_bw_5g;
 -	u32 max_bw_5g;
 -	u32 num_2g_reg_rules;
 -	u32 num_5g_reg_rules;
 +	u32 min_bw_2ghz;
 +	u32 max_bw_2ghz;
 +	u32 min_bw_5ghz;
 +	u32 max_bw_5ghz;
 +	u32 num_2ghz_reg_rules;
 +	u32 num_5ghz_reg_rules;
 } __packed;
 struct wmi_regulatory_rule_struct {
--- a/package/kernel/mac80211/patches/ath11k/0044-ath11k-Remove-htt-stats-fixed-size-array-usage.patch
+++ b/package/kernel/mac80211/patches/ath11k/0044-ath11k-Remove-htt-stats-fixed-size-array-usage.patch
--- a/package/kernel/mac80211/patches/ath11k/0044-wifi-ath11k-add-support-to-parse-new-WMI-event-for-6.patch
+++ b/package/kernel/mac80211/patches/ath11k/0044-wifi-ath11k-add-support-to-parse-new-WMI-event-for-6.patch
@ -0,0 +1,844 @@
 From 91fa00fa69224aae5afb720c5e68b22e4c4f7333 Mon Sep 17 00:00:00 2001
 From: Aditya Kumar Singh <quic_adisi@quicinc.com>
 Date: Wed, 1 Mar 2023 16:20:59 +0200
 Subject: [PATCH] wifi: ath11k: add support to parse new WMI event for 6 GHz
 In order to support different power levels of 6 GHz AP and client,
 new WMI event for regulatory - WMI_REG_CHAN_LIST_CC_EXT_EVENTID is
 added in firmware. This event provides new parameters required for
 6 GHz regulatory rules.
 Add support for parsing 2.4 GHz, 5 GHz and 6 GHz reg rules and other
 parameters from WMI_REG_CHAN_LIST_CC_EXT_EVENTID.
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
 Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
 Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Lavanya Suresh <quic_lavaks@quicinc.com>
 Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
 Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
 Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
 Link: https://lore.kernel.org/r/20230110121024.14051-3-quic_adisi@quicinc.com
 ---
 drivers/net/wireless/ath/ath11k/reg.c |  37 ++-
 drivers/net/wireless/ath/ath11k/wmi.c | 418 +++++++++++++++++++++++++-
 drivers/net/wireless/ath/ath11k/wmi.h | 163 +++++++++-
 3 files changed, 584 insertions(+), 34 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/reg.c
 +++ b/drivers/net/wireless/ath/ath11k/reg.c
@@ -613,7 +613,7 @@ ath11k_reg_build_regd(struct ath11k_base
 {
 	struct ieee80211_regdomain *tmp_regd, *default_regd, *new_regd = NULL;
 	struct cur_reg_rule *reg_rule;
 -	u8 i = 0, j = 0;
 +	u8 i = 0, j = 0, k = 0;
 	u8 num_rules;
 	u16 max_bw;
 	u32 flags;
@@ -621,6 +621,12 @@ ath11k_reg_build_regd(struct ath11k_base
 	num_rules = reg_info->num_5ghz_reg_rules + reg_info->num_2ghz_reg_rules;
 +	/* FIXME: Currently taking reg rules for 6 GHz only from Indoor AP mode list.
 +	 * This can be updated after complete 6 GHz regulatory support is added.
 +	 */
 +	if (reg_info->is_ext_reg_event)
 +		num_rules += reg_info->num_6ghz_rules_ap[WMI_REG_INDOOR_AP];
 +
 	if (!num_rules)
 		goto ret;
@@ -666,6 +672,14 @@ ath11k_reg_build_regd(struct ath11k_base
 			 * per other BW rule flags we pass from here
 			 */
 			flags = NL80211_RRF_AUTO_BW;
 +		} else if (reg_info->is_ext_reg_event &&
 +			   reg_info->num_6ghz_rules_ap[WMI_REG_INDOOR_AP] &&
 +			   (k < reg_info->num_6ghz_rules_ap[WMI_REG_INDOOR_AP])) {
 +			reg_rule = reg_info->reg_rules_6ghz_ap_ptr[WMI_REG_INDOOR_AP] +
 +				   k++;
 +			max_bw = min_t(u16, reg_rule->max_bw,
 +				       reg_info->max_bw_6ghz_ap[WMI_REG_INDOOR_AP]);
 +			flags = NL80211_RRF_AUTO_BW;
 		} else {
 			break;
 		}
@@ -693,12 +707,21 @@ ath11k_reg_build_regd(struct ath11k_base
 			continue;
 		}
 -		ath11k_dbg(ab, ATH11K_DBG_REG,
 -			   "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d)\n",
 -			   i + 1, reg_rule->start_freq, reg_rule->end_freq,
 -			   max_bw, reg_rule->ant_gain, reg_rule->reg_power,
 -			   tmp_regd->reg_rules[i].dfs_cac_ms,
 -			   flags);
 +		if (reg_info->is_ext_reg_event) {
 +			ath11k_dbg(ab, ATH11K_DBG_REG,
 +				   "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d) (%d, %d)\n",
 +				   i + 1, reg_rule->start_freq, reg_rule->end_freq,
 +				   max_bw, reg_rule->ant_gain, reg_rule->reg_power,
 +				   tmp_regd->reg_rules[i].dfs_cac_ms, flags,
 +				   reg_rule->psd_flag, reg_rule->psd_eirp);
 +		} else {
 +			ath11k_dbg(ab, ATH11K_DBG_REG,
 +				   "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d)\n",
 +				   i + 1, reg_rule->start_freq, reg_rule->end_freq,
 +				   max_bw, reg_rule->ant_gain, reg_rule->reg_power,
 +				   tmp_regd->reg_rules[i].dfs_cac_ms,
 +				   flags);
 +		}
 	}
 	tmp_regd->n_reg_rules = i;
 --- a/drivers/net/wireless/ath/ath11k/wmi.c
 +++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -105,6 +105,8 @@ static const struct wmi_tlv_policy wmi_t
 		= { .min_len = sizeof(struct wmi_vdev_stopped_event) },
 	[WMI_TAG_REG_CHAN_LIST_CC_EVENT]
 		= { .min_len = sizeof(struct wmi_reg_chan_list_cc_event) },
 +	[WMI_TAG_REG_CHAN_LIST_CC_EXT_EVENT]
 +		= { .min_len = sizeof(struct wmi_reg_chan_list_cc_ext_event) },
 	[WMI_TAG_MGMT_RX_HDR]
 		= { .min_len = sizeof(struct wmi_mgmt_rx_hdr) },
 	[WMI_TAG_MGMT_TX_COMPL_EVENT]
@@ -3974,6 +3976,10 @@ ath11k_wmi_copy_resource_config(struct w
 	wmi_cfg->sched_params = tg_cfg->sched_params;
 	wmi_cfg->twt_ap_pdev_count = tg_cfg->twt_ap_pdev_count;
 	wmi_cfg->twt_ap_sta_count = tg_cfg->twt_ap_sta_count;
 +	wmi_cfg->host_service_flags &=
 +		~(1 << WMI_CFG_HOST_SERVICE_FLAG_REG_CC_EXT);
 +	wmi_cfg->host_service_flags |= (tg_cfg->is_reg_cc_ext_event_supported <<
 +					WMI_CFG_HOST_SERVICE_FLAG_REG_CC_EXT);
 }
 static int ath11k_init_cmd_send(struct ath11k_pdev_wmi *wmi,
@@ -4192,6 +4198,10 @@ int ath11k_wmi_cmd_init(struct ath11k_ba
 	ab->hw_params.hw_ops->wmi_init_config(ab, &config);
 +	if (test_bit(WMI_TLV_SERVICE_REG_CC_EXT_EVENT_SUPPORT,
 +		     ab->wmi_ab.svc_map))
 +		config.is_reg_cc_ext_event_supported = 1;
 +
 	memcpy(&wmi_sc->wlan_resource_config, &config, sizeof(config));
 	init_param.res_cfg = &wmi_sc->wlan_resource_config;
@@ -4995,18 +5005,11 @@ static int ath11k_pull_reg_chan_list_upd
 	reg_info->phy_id = chan_list_event_hdr->phy_id;
 	reg_info->ctry_code = chan_list_event_hdr->country_id;
 	reg_info->reg_dmn_pair = chan_list_event_hdr->domain_code;
 -	if (chan_list_event_hdr->status_code == WMI_REG_SET_CC_STATUS_PASS)
 -		reg_info->status_code = REG_SET_CC_STATUS_PASS;
 -	else if (chan_list_event_hdr->status_code == WMI_REG_CURRENT_ALPHA2_NOT_FOUND)
 -		reg_info->status_code = REG_CURRENT_ALPHA2_NOT_FOUND;
 -	else if (chan_list_event_hdr->status_code == WMI_REG_INIT_ALPHA2_NOT_FOUND)
 -		reg_info->status_code = REG_INIT_ALPHA2_NOT_FOUND;
 -	else if (chan_list_event_hdr->status_code == WMI_REG_SET_CC_CHANGE_NOT_ALLOWED)
 -		reg_info->status_code = REG_SET_CC_CHANGE_NOT_ALLOWED;
 -	else if (chan_list_event_hdr->status_code == WMI_REG_SET_CC_STATUS_NO_MEMORY)
 -		reg_info->status_code = REG_SET_CC_STATUS_NO_MEMORY;
 -	else if (chan_list_event_hdr->status_code == WMI_REG_SET_CC_STATUS_FAIL)
 -		reg_info->status_code = REG_SET_CC_STATUS_FAIL;
 +
 +	reg_info->status_code =
 +		ath11k_wmi_cc_setting_code_to_reg(chan_list_event_hdr->status_code);
 +
 +	reg_info->is_ext_reg_event = false;
 	reg_info->min_bw_2ghz = chan_list_event_hdr->min_bw_2ghz;
 	reg_info->max_bw_2ghz = chan_list_event_hdr->max_bw_2ghz;
@@ -5060,6 +5063,372 @@ static int ath11k_pull_reg_chan_list_upd
 	return 0;
 }
 +static struct cur_reg_rule
 +*create_ext_reg_rules_from_wmi(u32 num_reg_rules,
 +			       struct wmi_regulatory_ext_rule *wmi_reg_rule)
 +{
 +	struct cur_reg_rule *reg_rule_ptr;
 +	u32 count;
 +
 +	reg_rule_ptr =  kcalloc(num_reg_rules, sizeof(*reg_rule_ptr), GFP_ATOMIC);
 +
 +	if (!reg_rule_ptr)
 +		return NULL;
 +
 +	for (count = 0; count < num_reg_rules; count++) {
 +		reg_rule_ptr[count].start_freq =
 +			u32_get_bits(wmi_reg_rule[count].freq_info,
 +				     REG_RULE_START_FREQ);
 +		reg_rule_ptr[count].end_freq =
 +			u32_get_bits(wmi_reg_rule[count].freq_info,
 +				     REG_RULE_END_FREQ);
 +		reg_rule_ptr[count].max_bw =
 +			u32_get_bits(wmi_reg_rule[count].bw_pwr_info,
 +				     REG_RULE_MAX_BW);
 +		reg_rule_ptr[count].reg_power =
 +			u32_get_bits(wmi_reg_rule[count].bw_pwr_info,
 +				     REG_RULE_REG_PWR);
 +		reg_rule_ptr[count].ant_gain =
 +			u32_get_bits(wmi_reg_rule[count].bw_pwr_info,
 +				     REG_RULE_ANT_GAIN);
 +		reg_rule_ptr[count].flags =
 +			u32_get_bits(wmi_reg_rule[count].flag_info,
 +				     REG_RULE_FLAGS);
 +		reg_rule_ptr[count].psd_flag =
 +			u32_get_bits(wmi_reg_rule[count].psd_power_info,
 +				     REG_RULE_PSD_INFO);
 +		reg_rule_ptr[count].psd_eirp =
 +			u32_get_bits(wmi_reg_rule[count].psd_power_info,
 +				     REG_RULE_PSD_EIRP);
 +	}
 +
 +	return reg_rule_ptr;
 +}
 +
 +static u8
 +ath11k_invalid_5ghz_reg_ext_rules_from_wmi(u32 num_reg_rules,
 +					   const struct wmi_regulatory_ext_rule *rule)
 +{
 +	u8 num_invalid_5ghz_rules = 0;
 +	u32 count, start_freq;
 +
 +	for (count = 0; count < num_reg_rules; count++) {
 +		start_freq = u32_get_bits(rule[count].freq_info,
 +					  REG_RULE_START_FREQ);
 +
 +		if (start_freq >= ATH11K_MIN_6G_FREQ)
 +			num_invalid_5ghz_rules++;
 +	}
 +
 +	return num_invalid_5ghz_rules;
 +}
 +
 +static int ath11k_pull_reg_chan_list_ext_update_ev(struct ath11k_base *ab,
 +						   struct sk_buff *skb,
 +						   struct cur_regulatory_info *reg_info)
 +{
 +	const void **tb;
 +	const struct wmi_reg_chan_list_cc_ext_event *ext_chan_list_event_hdr;
 +	struct wmi_regulatory_ext_rule *ext_wmi_reg_rule;
 +	u32 num_2ghz_reg_rules, num_5ghz_reg_rules;
 +	u32 num_6ghz_reg_rules_ap[WMI_REG_CURRENT_MAX_AP_TYPE];
 +	u32 num_6ghz_client[WMI_REG_CURRENT_MAX_AP_TYPE][WMI_REG_MAX_CLIENT_TYPE];
 +	u32 total_reg_rules = 0;
 +	int ret, i, j, num_invalid_5ghz_ext_rules = 0;
 +
 +	ath11k_dbg(ab, ATH11K_DBG_WMI, "processing regulatory ext channel list\n");
 +
 +	tb = ath11k_wmi_tlv_parse_alloc(ab, skb->data, skb->len, GFP_ATOMIC);
 +	if (IS_ERR(tb)) {
 +		ret = PTR_ERR(tb);
 +		ath11k_warn(ab, "failed to parse tlv: %d\n", ret);
 +		return ret;
 +	}
 +
 +	ext_chan_list_event_hdr = tb[WMI_TAG_REG_CHAN_LIST_CC_EXT_EVENT];
 +	if (!ext_chan_list_event_hdr) {
 +		ath11k_warn(ab, "failed to fetch reg chan list ext update ev\n");
 +		kfree(tb);
 +		return -EPROTO;
 +	}
 +
 +	reg_info->num_2ghz_reg_rules =
 +			ext_chan_list_event_hdr->num_2ghz_reg_rules;
 +	reg_info->num_5ghz_reg_rules =
 +			ext_chan_list_event_hdr->num_5ghz_reg_rules;
 +	reg_info->num_6ghz_rules_ap[WMI_REG_INDOOR_AP] =
 +			ext_chan_list_event_hdr->num_6ghz_reg_rules_ap_lpi;
 +	reg_info->num_6ghz_rules_ap[WMI_REG_STANDARD_POWER_AP] =
 +			ext_chan_list_event_hdr->num_6ghz_reg_rules_ap_sp;
 +	reg_info->num_6ghz_rules_ap[WMI_REG_VERY_LOW_POWER_AP] =
 +			ext_chan_list_event_hdr->num_6ghz_reg_rules_ap_vlp;
 +
 +	for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++) {
 +		reg_info->num_6ghz_rules_client[WMI_REG_INDOOR_AP][i] =
 +			ext_chan_list_event_hdr->num_6ghz_reg_rules_client_lpi[i];
 +		reg_info->num_6ghz_rules_client[WMI_REG_STANDARD_POWER_AP][i] =
 +			ext_chan_list_event_hdr->num_6ghz_reg_rules_client_sp[i];
 +		reg_info->num_6ghz_rules_client[WMI_REG_VERY_LOW_POWER_AP][i] =
 +			ext_chan_list_event_hdr->num_6ghz_reg_rules_client_vlp[i];
 +	}
 +
 +	num_2ghz_reg_rules = reg_info->num_2ghz_reg_rules;
 +	num_5ghz_reg_rules = reg_info->num_5ghz_reg_rules;
 +
 +	total_reg_rules += num_2ghz_reg_rules;
 +	total_reg_rules += num_5ghz_reg_rules;
 +
 +	if ((num_2ghz_reg_rules > MAX_REG_RULES) ||
 +	    (num_5ghz_reg_rules > MAX_REG_RULES)) {
 +		ath11k_warn(ab, "Num reg rules for 2.4 GHz/5 GHz exceeds max limit (num_2ghz_reg_rules: %d num_5ghz_reg_rules: %d max_rules: %d)\n",
 +			    num_2ghz_reg_rules, num_5ghz_reg_rules, MAX_REG_RULES);
 +		kfree(tb);
 +		return -EINVAL;
 +	}
 +
 +	for (i = 0; i < WMI_REG_CURRENT_MAX_AP_TYPE; i++) {
 +		num_6ghz_reg_rules_ap[i] = reg_info->num_6ghz_rules_ap[i];
 +
 +		if (num_6ghz_reg_rules_ap[i] > MAX_6GHZ_REG_RULES) {
 +			ath11k_warn(ab, "Num 6 GHz reg rules for AP mode(%d) exceeds max limit (num_6ghz_reg_rules_ap: %d, max_rules: %d)\n",
 +				    i, num_6ghz_reg_rules_ap[i], MAX_6GHZ_REG_RULES);
 +			kfree(tb);
 +			return -EINVAL;
 +		}
 +
 +		total_reg_rules += num_6ghz_reg_rules_ap[i];
 +	}
 +
 +	for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++) {
 +		num_6ghz_client[WMI_REG_INDOOR_AP][i] =
 +			reg_info->num_6ghz_rules_client[WMI_REG_INDOOR_AP][i];
 +		total_reg_rules += num_6ghz_client[WMI_REG_INDOOR_AP][i];
 +
 +		num_6ghz_client[WMI_REG_STANDARD_POWER_AP][i] =
 +			reg_info->num_6ghz_rules_client[WMI_REG_STANDARD_POWER_AP][i];
 +		total_reg_rules += num_6ghz_client[WMI_REG_STANDARD_POWER_AP][i];
 +
 +		num_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i] =
 +			reg_info->num_6ghz_rules_client[WMI_REG_VERY_LOW_POWER_AP][i];
 +		total_reg_rules += num_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i];
 +
 +		if ((num_6ghz_client[WMI_REG_INDOOR_AP][i] > MAX_6GHZ_REG_RULES) ||
 +		    (num_6ghz_client[WMI_REG_STANDARD_POWER_AP][i] >
 +							     MAX_6GHZ_REG_RULES) ||
 +		    (num_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i] >
 +							     MAX_6GHZ_REG_RULES)) {
 +			ath11k_warn(ab,
 +				    "Num 6 GHz client reg rules exceeds max limit, for client(type: %d)\n",
 +				    i);
 +			kfree(tb);
 +			return -EINVAL;
 +		}
 +	}
 +
 +	if (!total_reg_rules) {
 +		ath11k_warn(ab, "No reg rules available\n");
 +		kfree(tb);
 +		return -EINVAL;
 +	}
 +
 +	memcpy(reg_info->alpha2, &ext_chan_list_event_hdr->alpha2,
 +	       REG_ALPHA2_LEN);
 +
 +	reg_info->dfs_region = ext_chan_list_event_hdr->dfs_region;
 +	reg_info->phybitmap = ext_chan_list_event_hdr->phybitmap;
 +	reg_info->num_phy = ext_chan_list_event_hdr->num_phy;
 +	reg_info->phy_id = ext_chan_list_event_hdr->phy_id;
 +	reg_info->ctry_code = ext_chan_list_event_hdr->country_id;
 +	reg_info->reg_dmn_pair = ext_chan_list_event_hdr->domain_code;
 +
 +	reg_info->status_code =
 +		ath11k_wmi_cc_setting_code_to_reg(ext_chan_list_event_hdr->status_code);
 +
 +	reg_info->is_ext_reg_event = true;
 +
 +	reg_info->min_bw_2ghz = ext_chan_list_event_hdr->min_bw_2ghz;
 +	reg_info->max_bw_2ghz = ext_chan_list_event_hdr->max_bw_2ghz;
 +	reg_info->min_bw_5ghz = ext_chan_list_event_hdr->min_bw_5ghz;
 +	reg_info->max_bw_5ghz = ext_chan_list_event_hdr->max_bw_5ghz;
 +
 +	reg_info->min_bw_6ghz_ap[WMI_REG_INDOOR_AP] =
 +			ext_chan_list_event_hdr->min_bw_6ghz_ap_lpi;
 +	reg_info->max_bw_6ghz_ap[WMI_REG_INDOOR_AP] =
 +			 ext_chan_list_event_hdr->max_bw_6ghz_ap_lpi;
 +	reg_info->min_bw_6ghz_ap[WMI_REG_STANDARD_POWER_AP] =
 +			ext_chan_list_event_hdr->min_bw_6ghz_ap_sp;
 +	reg_info->max_bw_6ghz_ap[WMI_REG_STANDARD_POWER_AP] =
 +			ext_chan_list_event_hdr->max_bw_6ghz_ap_sp;
 +	reg_info->min_bw_6ghz_ap[WMI_REG_VERY_LOW_POWER_AP] =
 +			ext_chan_list_event_hdr->min_bw_6ghz_ap_vlp;
 +	reg_info->max_bw_6ghz_ap[WMI_REG_VERY_LOW_POWER_AP] =
 +			ext_chan_list_event_hdr->max_bw_6ghz_ap_vlp;
 +
 +	for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++) {
 +		reg_info->min_bw_6ghz_client[WMI_REG_INDOOR_AP][i] =
 +				ext_chan_list_event_hdr->min_bw_6ghz_client_lpi[i];
 +		reg_info->max_bw_6ghz_client[WMI_REG_INDOOR_AP][i] =
 +				ext_chan_list_event_hdr->max_bw_6ghz_client_lpi[i];
 +		reg_info->min_bw_6ghz_client[WMI_REG_STANDARD_POWER_AP][i] =
 +				ext_chan_list_event_hdr->min_bw_6ghz_client_sp[i];
 +		reg_info->max_bw_6ghz_client[WMI_REG_STANDARD_POWER_AP][i] =
 +				ext_chan_list_event_hdr->max_bw_6ghz_client_sp[i];
 +		reg_info->min_bw_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i] =
 +				ext_chan_list_event_hdr->min_bw_6ghz_client_vlp[i];
 +		reg_info->max_bw_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i] =
 +				ext_chan_list_event_hdr->max_bw_6ghz_client_vlp[i];
 +	}
 +
 +	ath11k_dbg(ab, ATH11K_DBG_WMI,
 +		   "%s:cc_ext %s dsf %d BW: min_2ghz %d max_2ghz %d min_5ghz %d max_5ghz %d",
 +		   __func__, reg_info->alpha2, reg_info->dfs_region,
 +		   reg_info->min_bw_2ghz, reg_info->max_bw_2ghz,
 +		   reg_info->min_bw_5ghz, reg_info->max_bw_5ghz);
 +
 +	ath11k_dbg(ab, ATH11K_DBG_WMI,
 +		   "num_2ghz_reg_rules %d num_5ghz_reg_rules %d",
 +		   num_2ghz_reg_rules, num_5ghz_reg_rules);
 +
 +	ath11k_dbg(ab, ATH11K_DBG_WMI,
 +		   "num_6ghz_reg_rules_ap_lpi: %d num_6ghz_reg_rules_ap_sp: %d num_6ghz_reg_rules_ap_vlp: %d",
 +		   num_6ghz_reg_rules_ap[WMI_REG_INDOOR_AP],
 +		   num_6ghz_reg_rules_ap[WMI_REG_STANDARD_POWER_AP],
 +		   num_6ghz_reg_rules_ap[WMI_REG_VERY_LOW_POWER_AP]);
 +
 +	j = WMI_REG_DEFAULT_CLIENT;
 +	ath11k_dbg(ab, ATH11K_DBG_WMI,
 +		   "6 GHz Regular client: num_6ghz_reg_rules_lpi: %d num_6ghz_reg_rules_sp: %d num_6ghz_reg_rules_vlp: %d",
 +		   num_6ghz_client[WMI_REG_INDOOR_AP][j],
 +		   num_6ghz_client[WMI_REG_STANDARD_POWER_AP][j],
 +		   num_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][j]);
 +
 +	j = WMI_REG_SUBORDINATE_CLIENT;
 +	ath11k_dbg(ab, ATH11K_DBG_WMI,
 +		   "6 GHz Subordinate client: num_6ghz_reg_rules_lpi: %d num_6ghz_reg_rules_sp: %d num_6ghz_reg_rules_vlp: %d",
 +		   num_6ghz_client[WMI_REG_INDOOR_AP][j],
 +		   num_6ghz_client[WMI_REG_STANDARD_POWER_AP][j],
 +		   num_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][j]);
 +
 +	ext_wmi_reg_rule =
 +		(struct wmi_regulatory_ext_rule *)((u8 *)ext_chan_list_event_hdr
 +						   + sizeof(*ext_chan_list_event_hdr)
 +						   + sizeof(struct wmi_tlv));
 +	if (num_2ghz_reg_rules) {
 +		reg_info->reg_rules_2ghz_ptr =
 +			create_ext_reg_rules_from_wmi(num_2ghz_reg_rules,
 +						      ext_wmi_reg_rule);
 +
 +		if (!reg_info->reg_rules_2ghz_ptr) {
 +			kfree(tb);
 +			ath11k_warn(ab, "Unable to Allocate memory for 2 GHz rules\n");
 +			return -ENOMEM;
 +		}
 +	}
 +
 +	ext_wmi_reg_rule += num_2ghz_reg_rules;
 +
 +	/* Firmware might include 6 GHz reg rule in 5 GHz rule list
 +	 * for few countries along with separate 6 GHz rule.
 +	 * Having same 6 GHz reg rule in 5 GHz and 6 GHz rules list
 +	 * causes intersect check to be true, and same rules will be
 +	 * shown multiple times in iw cmd.
 +	 * Hence, avoid parsing 6 GHz rule from 5 GHz reg rule list
 +	 */
 +	num_invalid_5ghz_ext_rules =
 +		ath11k_invalid_5ghz_reg_ext_rules_from_wmi(num_5ghz_reg_rules,
 +							   ext_wmi_reg_rule);
 +
 +	if (num_invalid_5ghz_ext_rules) {
 +		ath11k_dbg(ab, ATH11K_DBG_WMI,
 +			   "CC: %s 5 GHz reg rules number %d from fw, %d number of invalid 5 GHz rules",
 +			   reg_info->alpha2, reg_info->num_5ghz_reg_rules,
 +			   num_invalid_5ghz_ext_rules);
 +
 +		num_5ghz_reg_rules = num_5ghz_reg_rules - num_invalid_5ghz_ext_rules;
 +		reg_info->num_5ghz_reg_rules = num_5ghz_reg_rules;
 +	}
 +
 +	if (num_5ghz_reg_rules) {
 +		reg_info->reg_rules_5ghz_ptr =
 +			create_ext_reg_rules_from_wmi(num_5ghz_reg_rules,
 +						      ext_wmi_reg_rule);
 +
 +		if (!reg_info->reg_rules_5ghz_ptr) {
 +			kfree(tb);
 +			ath11k_warn(ab, "Unable to Allocate memory for 5 GHz rules\n");
 +			return -ENOMEM;
 +		}
 +	}
 +
 +	/* We have adjusted the number of 5 GHz reg rules above. But still those
 +	 * many rules needs to be adjusted in ext_wmi_reg_rule.
 +	 *
 +	 * NOTE: num_invalid_5ghz_ext_rules will be 0 for rest other cases.
 +	 */
 +	ext_wmi_reg_rule += (num_5ghz_reg_rules + num_invalid_5ghz_ext_rules);
 +
 +	for (i = 0; i < WMI_REG_CURRENT_MAX_AP_TYPE; i++) {
 +		reg_info->reg_rules_6ghz_ap_ptr[i] =
 +			create_ext_reg_rules_from_wmi(num_6ghz_reg_rules_ap[i],
 +						      ext_wmi_reg_rule);
 +
 +		if (!reg_info->reg_rules_6ghz_ap_ptr[i]) {
 +			kfree(tb);
 +			ath11k_warn(ab, "Unable to Allocate memory for 6 GHz AP rules\n");
 +			return -ENOMEM;
 +		}
 +
 +		ext_wmi_reg_rule += num_6ghz_reg_rules_ap[i];
 +	}
 +
 +	for (j = 0; j < WMI_REG_CURRENT_MAX_AP_TYPE; j++) {
 +		for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++) {
 +			reg_info->reg_rules_6ghz_client_ptr[j][i] =
 +				create_ext_reg_rules_from_wmi(num_6ghz_client[j][i],
 +							      ext_wmi_reg_rule);
 +
 +			if (!reg_info->reg_rules_6ghz_client_ptr[j][i]) {
 +				kfree(tb);
 +				ath11k_warn(ab, "Unable to Allocate memory for 6 GHz client rules\n");
 +				return -ENOMEM;
 +			}
 +
 +			ext_wmi_reg_rule += num_6ghz_client[j][i];
 +		}
 +	}
 +
 +	reg_info->client_type = ext_chan_list_event_hdr->client_type;
 +	reg_info->rnr_tpe_usable = ext_chan_list_event_hdr->rnr_tpe_usable;
 +	reg_info->unspecified_ap_usable =
 +			ext_chan_list_event_hdr->unspecified_ap_usable;
 +	reg_info->domain_code_6ghz_ap[WMI_REG_INDOOR_AP] =
 +			ext_chan_list_event_hdr->domain_code_6ghz_ap_lpi;
 +	reg_info->domain_code_6ghz_ap[WMI_REG_STANDARD_POWER_AP] =
 +			ext_chan_list_event_hdr->domain_code_6ghz_ap_sp;
 +	reg_info->domain_code_6ghz_ap[WMI_REG_VERY_LOW_POWER_AP] =
 +			ext_chan_list_event_hdr->domain_code_6ghz_ap_vlp;
 +
 +	for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++) {
 +		reg_info->domain_code_6ghz_client[WMI_REG_INDOOR_AP][i] =
 +				ext_chan_list_event_hdr->domain_code_6ghz_client_lpi[i];
 +		reg_info->domain_code_6ghz_client[WMI_REG_STANDARD_POWER_AP][i] =
 +				ext_chan_list_event_hdr->domain_code_6ghz_client_sp[i];
 +		reg_info->domain_code_6ghz_client[WMI_REG_VERY_LOW_POWER_AP][i] =
 +				ext_chan_list_event_hdr->domain_code_6ghz_client_vlp[i];
 +	}
 +
 +	reg_info->domain_code_6ghz_super_id =
 +			ext_chan_list_event_hdr->domain_code_6ghz_super_id;
 +
 +	ath11k_dbg(ab, ATH11K_DBG_WMI, "6 GHz client_type: %d domain_code_6ghz_super_id: %d",
 +		   reg_info->client_type, reg_info->domain_code_6ghz_super_id);
 +
 +	ath11k_dbg(ab, ATH11K_DBG_WMI, "processed regulatory ext channel list\n");
 +
 +	kfree(tb);
 +	return 0;
 +}
 +
 static int ath11k_pull_peer_del_resp_ev(struct ath11k_base *ab, struct sk_buff *skb,
 					struct wmi_peer_delete_resp_event *peer_del_resp)
 {
@@ -6507,12 +6876,14 @@ static bool ath11k_reg_is_world_alpha(ch
 	return false;
 }
 -static int ath11k_reg_chan_list_event(struct ath11k_base *ab, struct sk_buff *skb)
 +static int ath11k_reg_chan_list_event(struct ath11k_base *ab,
 +				      struct sk_buff *skb,
 +				      enum wmi_reg_chan_list_cmd_type id)
 {
 	struct cur_regulatory_info *reg_info = NULL;
 	struct ieee80211_regdomain *regd = NULL;
 	bool intersect = false;
 -	int ret = 0, pdev_idx;
 +	int ret = 0, pdev_idx, i, j;
 	struct ath11k *ar;
 	reg_info = kzalloc(sizeof(*reg_info), GFP_ATOMIC);
@@ -6521,7 +6892,11 @@ static int ath11k_reg_chan_list_event(st
 		goto fallback;
 	}
 -	ret = ath11k_pull_reg_chan_list_update_ev(ab, skb, reg_info);
 +	if (id == WMI_REG_CHAN_LIST_CC_ID)
 +		ret = ath11k_pull_reg_chan_list_update_ev(ab, skb, reg_info);
 +	else
 +		ret = ath11k_pull_reg_chan_list_ext_update_ev(ab, skb, reg_info);
 +
 	if (ret) {
 		ath11k_warn(ab, "failed to extract regulatory info from received event\n");
 		goto fallback;
@@ -6623,6 +6998,14 @@ mem_free:
 	if (reg_info) {
 		kfree(reg_info->reg_rules_2ghz_ptr);
 		kfree(reg_info->reg_rules_5ghz_ptr);
 +		if (reg_info->is_ext_reg_event) {
 +			for (i = 0; i < WMI_REG_CURRENT_MAX_AP_TYPE; i++)
 +				kfree(reg_info->reg_rules_6ghz_ap_ptr[i]);
 +
 +			for (j = 0; j < WMI_REG_CURRENT_MAX_AP_TYPE; j++)
 +				for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++)
 +					kfree(reg_info->reg_rules_6ghz_client_ptr[j][i]);
 +		}
 		kfree(reg_info);
 	}
 	return ret;
@@ -8054,7 +8437,10 @@ static void ath11k_wmi_tlv_op_rx(struct
 		ath11k_service_ready_ext2_event(ab, skb);
 		break;
 	case WMI_REG_CHAN_LIST_CC_EVENTID:
 -		ath11k_reg_chan_list_event(ab, skb);
 +		ath11k_reg_chan_list_event(ab, skb, WMI_REG_CHAN_LIST_CC_ID);
 +		break;
 +	case WMI_REG_CHAN_LIST_CC_EXT_EVENTID:
 +		ath11k_reg_chan_list_event(ab, skb, WMI_REG_CHAN_LIST_CC_EXT_ID);
 		break;
 	case WMI_READY_EVENTID:
 		ath11k_ready_event(ab, skb);
 --- a/drivers/net/wireless/ath/ath11k/wmi.h
 +++ b/drivers/net/wireless/ath/ath11k/wmi.h
@@ -797,6 +797,7 @@ enum wmi_tlv_event_id {
 	WMI_RMC_NEW_LEADER_EVENTID = WMI_TLV_CMD(WMI_GRP_RMC),
 	WMI_REG_CHAN_LIST_CC_EVENTID = WMI_TLV_CMD(WMI_GRP_REGULATORY),
 	WMI_11D_NEW_COUNTRY_EVENTID,
 +	WMI_REG_CHAN_LIST_CC_EXT_EVENTID,
 	WMI_NDI_CAP_RSP_EVENTID = WMI_TLV_CMD(WMI_GRP_PROTOTYPE),
 	WMI_NDP_INITIATOR_RSP_EVENTID,
 	WMI_NDP_RESPONDER_RSP_EVENTID,
@@ -1865,6 +1866,8 @@ enum wmi_tlv_tag {
 	WMI_TAG_PDEV_SRG_OBSS_BSSID_ENABLE_BITMAP_CMD,
 	WMI_TAG_PDEV_NON_SRG_OBSS_COLOR_ENABLE_BITMAP_CMD,
 	WMI_TAG_PDEV_NON_SRG_OBSS_BSSID_ENABLE_BITMAP_CMD,
 +	WMI_TAG_REGULATORY_RULE_EXT_STRUCT = 0x3A9,
 +	WMI_TAG_REG_CHAN_LIST_CC_EXT_EVENT,
 	WMI_TAG_PDEV_SET_BIOS_SAR_TABLE_CMD = 0x3D8,
 	WMI_TAG_PDEV_SET_BIOS_GEO_TABLE_CMD,
 	WMI_TAG_MAX
@@ -2097,6 +2100,7 @@ enum wmi_tlv_service {
 	/* The second 128 bits */
 	WMI_MAX_EXT_SERVICE = 256,
 +	WMI_TLV_SERVICE_REG_CC_EXT_EVENT_SUPPORT = 281,
 	WMI_TLV_SERVICE_BIOS_SAR_SUPPORT = 326,
 	/* The third 128 bits */
@@ -2313,6 +2317,8 @@ struct wmi_init_cmd {
 #define WMI_RSRC_CFG_FLAG1_BSS_CHANNEL_INFO_64 BIT(5)
 #define WMI_RSRC_CFG_FLAG1_ACK_RSSI BIT(18)
 +#define WMI_CFG_HOST_SERVICE_FLAG_REG_CC_EXT 4
 +
 struct wmi_resource_config {
 	u32 tlv_header;
 	u32 num_vdevs;
@@ -2372,6 +2378,15 @@ struct wmi_resource_config {
 	u32 sched_params;
 	u32 twt_ap_pdev_count;
 	u32 twt_ap_sta_count;
 +	u32 max_nlo_ssids;
 +	u32 num_pkt_filters;
 +	u32 num_max_sta_vdevs;
 +	u32 max_bssid_indicator;
 +	u32 ul_resp_config;
 +	u32 msdu_flow_override_config0;
 +	u32 msdu_flow_override_config1;
 +	u32 flags2;
 +	u32 host_service_flags;
 } __packed;
 struct wmi_service_ready_event {
@@ -2854,6 +2869,8 @@ struct rx_reorder_queue_remove_params {
 #define REG_RULE_MAX_BW				0x0000ffff
 #define REG_RULE_REG_PWR			0x00ff0000
 #define REG_RULE_ANT_GAIN			0xff000000
 +#define REG_RULE_PSD_INFO			BIT(0)
 +#define REG_RULE_PSD_EIRP			0xff0000
 #define WMI_VDEV_PARAM_TXBF_SU_TX_BFEE BIT(0)
 #define WMI_VDEV_PARAM_TXBF_MU_TX_BFEE BIT(1)
@@ -4049,6 +4066,7 @@ struct wmi_he_rate_set {
 #define MAX_REG_RULES 10
 #define REG_ALPHA2_LEN 2
 +#define MAX_6GHZ_REG_RULES 5
 enum wmi_start_event_param {
 	WMI_VDEV_START_RESP_EVENT = 0,
@@ -4079,16 +4097,6 @@ enum wmi_vdev_start_resp_status_code {
 	WMI_VDEV_START_RESPONSE_INVALID_REGDOMAIN = 4,
 };
 -;
 -enum cc_setting_code {
 -	REG_SET_CC_STATUS_PASS = 0,
 -	REG_CURRENT_ALPHA2_NOT_FOUND = 1,
 -	REG_INIT_ALPHA2_NOT_FOUND = 2,
 -	REG_SET_CC_CHANGE_NOT_ALLOWED = 3,
 -	REG_SET_CC_STATUS_NO_MEMORY = 4,
 -	REG_SET_CC_STATUS_FAIL = 5,
 -};
 -
 /* Regaulatory Rule Flags Passed by FW */
 #define REGULATORY_CHAN_DISABLED     BIT(0)
 #define REGULATORY_CHAN_NO_IR        BIT(1)
@@ -4102,13 +4110,72 @@ enum cc_setting_code {
 #define REGULATORY_CHAN_NO_20MHZ     BIT(11)
 #define REGULATORY_CHAN_NO_10MHZ     BIT(12)
 -enum {
 +enum wmi_reg_chan_list_cmd_type {
 +	WMI_REG_CHAN_LIST_CC_ID = 0,
 +	WMI_REG_CHAN_LIST_CC_EXT_ID = 1,
 +};
 +
 +enum wmi_reg_cc_setting_code {
 	WMI_REG_SET_CC_STATUS_PASS = 0,
 	WMI_REG_CURRENT_ALPHA2_NOT_FOUND = 1,
 	WMI_REG_INIT_ALPHA2_NOT_FOUND = 2,
 	WMI_REG_SET_CC_CHANGE_NOT_ALLOWED = 3,
 	WMI_REG_SET_CC_STATUS_NO_MEMORY = 4,
 	WMI_REG_SET_CC_STATUS_FAIL = 5,
 +
 +	/* add new setting code above, update in
 +	 * @enum cc_setting_code as well.
 +	 * Also handle it in ath11k_wmi_cc_setting_code_to_reg()
 +	 */
 +};
 +
 +enum cc_setting_code {
 +	REG_SET_CC_STATUS_PASS = 0,
 +	REG_CURRENT_ALPHA2_NOT_FOUND = 1,
 +	REG_INIT_ALPHA2_NOT_FOUND = 2,
 +	REG_SET_CC_CHANGE_NOT_ALLOWED = 3,
 +	REG_SET_CC_STATUS_NO_MEMORY = 4,
 +	REG_SET_CC_STATUS_FAIL = 5,
 +
 +	/* add new setting code above, update in
 +	 * @enum wmi_reg_cc_setting_code as well.
 +	 */
 +};
 +
 +static inline enum cc_setting_code
 +ath11k_wmi_cc_setting_code_to_reg(enum wmi_reg_cc_setting_code status_code)
 +{
 +	switch (status_code) {
 +	case WMI_REG_SET_CC_STATUS_PASS:
 +		return REG_SET_CC_STATUS_PASS;
 +	case WMI_REG_CURRENT_ALPHA2_NOT_FOUND:
 +		return REG_CURRENT_ALPHA2_NOT_FOUND;
 +	case WMI_REG_INIT_ALPHA2_NOT_FOUND:
 +		return REG_INIT_ALPHA2_NOT_FOUND;
 +	case WMI_REG_SET_CC_CHANGE_NOT_ALLOWED:
 +		return REG_SET_CC_CHANGE_NOT_ALLOWED;
 +	case WMI_REG_SET_CC_STATUS_NO_MEMORY:
 +		return REG_SET_CC_STATUS_NO_MEMORY;
 +	case WMI_REG_SET_CC_STATUS_FAIL:
 +		return REG_SET_CC_STATUS_FAIL;
 +	}
 +
 +	return REG_SET_CC_STATUS_FAIL;
 +}
 +
 +enum wmi_reg_6ghz_ap_type {
 +	WMI_REG_INDOOR_AP = 0,
 +	WMI_REG_STANDARD_POWER_AP = 1,
 +	WMI_REG_VERY_LOW_POWER_AP = 2,
 +
 +	WMI_REG_CURRENT_MAX_AP_TYPE,
 +	WMI_REG_MAX_AP_TYPE = 7,
 +};
 +
 +enum wmi_reg_6ghz_client_type {
 +	WMI_REG_DEFAULT_CLIENT = 0,
 +	WMI_REG_SUBORDINATE_CLIENT = 1,
 +	WMI_REG_MAX_CLIENT_TYPE = 2,
 };
 struct cur_reg_rule {
@@ -4118,6 +4185,8 @@ struct cur_reg_rule {
 	u8 reg_power;
 	u8 ant_gain;
 	u16 flags;
 +	bool psd_flag;
 +	s8 psd_eirp;
 };
 struct cur_regulatory_info {
@@ -4137,6 +4206,22 @@ struct cur_regulatory_info {
 	u32 num_5ghz_reg_rules;
 	struct cur_reg_rule *reg_rules_2ghz_ptr;
 	struct cur_reg_rule *reg_rules_5ghz_ptr;
 +	bool is_ext_reg_event;
 +	enum wmi_reg_6ghz_client_type client_type;
 +	bool rnr_tpe_usable;
 +	bool unspecified_ap_usable;
 +	u8 domain_code_6ghz_ap[WMI_REG_CURRENT_MAX_AP_TYPE];
 +	u8 domain_code_6ghz_client[WMI_REG_CURRENT_MAX_AP_TYPE][WMI_REG_MAX_CLIENT_TYPE];
 +	u32 domain_code_6ghz_super_id;
 +	u32 min_bw_6ghz_ap[WMI_REG_CURRENT_MAX_AP_TYPE];
 +	u32 max_bw_6ghz_ap[WMI_REG_CURRENT_MAX_AP_TYPE];
 +	u32 min_bw_6ghz_client[WMI_REG_CURRENT_MAX_AP_TYPE][WMI_REG_MAX_CLIENT_TYPE];
 +	u32 max_bw_6ghz_client[WMI_REG_CURRENT_MAX_AP_TYPE][WMI_REG_MAX_CLIENT_TYPE];
 +	u32 num_6ghz_rules_ap[WMI_REG_CURRENT_MAX_AP_TYPE];
 +	u32 num_6ghz_rules_client[WMI_REG_CURRENT_MAX_AP_TYPE][WMI_REG_MAX_CLIENT_TYPE];
 +	struct cur_reg_rule *reg_rules_6ghz_ap_ptr[WMI_REG_CURRENT_MAX_AP_TYPE];
 +	struct cur_reg_rule *reg_rules_6ghz_client_ptr
 +		[WMI_REG_CURRENT_MAX_AP_TYPE][WMI_REG_MAX_CLIENT_TYPE];
 };
 struct wmi_reg_chan_list_cc_event {
@@ -4163,6 +4248,61 @@ struct wmi_regulatory_rule_struct {
 	u32  flag_info;
 };
 +#define WMI_REG_CLIENT_MAX 4
 +
 +struct wmi_reg_chan_list_cc_ext_event {
 +	u32 status_code;
 +	u32 phy_id;
 +	u32 alpha2;
 +	u32 num_phy;
 +	u32 country_id;
 +	u32 domain_code;
 +	u32 dfs_region;
 +	u32 phybitmap;
 +	u32 min_bw_2ghz;
 +	u32 max_bw_2ghz;
 +	u32 min_bw_5ghz;
 +	u32 max_bw_5ghz;
 +	u32 num_2ghz_reg_rules;
 +	u32 num_5ghz_reg_rules;
 +	u32 client_type;
 +	u32 rnr_tpe_usable;
 +	u32 unspecified_ap_usable;
 +	u32 domain_code_6ghz_ap_lpi;
 +	u32 domain_code_6ghz_ap_sp;
 +	u32 domain_code_6ghz_ap_vlp;
 +	u32 domain_code_6ghz_client_lpi[WMI_REG_CLIENT_MAX];
 +	u32 domain_code_6ghz_client_sp[WMI_REG_CLIENT_MAX];
 +	u32 domain_code_6ghz_client_vlp[WMI_REG_CLIENT_MAX];
 +	u32 domain_code_6ghz_super_id;
 +	u32 min_bw_6ghz_ap_sp;
 +	u32 max_bw_6ghz_ap_sp;
 +	u32 min_bw_6ghz_ap_lpi;
 +	u32 max_bw_6ghz_ap_lpi;
 +	u32 min_bw_6ghz_ap_vlp;
 +	u32 max_bw_6ghz_ap_vlp;
 +	u32 min_bw_6ghz_client_sp[WMI_REG_CLIENT_MAX];
 +	u32 max_bw_6ghz_client_sp[WMI_REG_CLIENT_MAX];
 +	u32 min_bw_6ghz_client_lpi[WMI_REG_CLIENT_MAX];
 +	u32 max_bw_6ghz_client_lpi[WMI_REG_CLIENT_MAX];
 +	u32 min_bw_6ghz_client_vlp[WMI_REG_CLIENT_MAX];
 +	u32 max_bw_6ghz_client_vlp[WMI_REG_CLIENT_MAX];
 +	u32 num_6ghz_reg_rules_ap_sp;
 +	u32 num_6ghz_reg_rules_ap_lpi;
 +	u32 num_6ghz_reg_rules_ap_vlp;
 +	u32 num_6ghz_reg_rules_client_sp[WMI_REG_CLIENT_MAX];
 +	u32 num_6ghz_reg_rules_client_lpi[WMI_REG_CLIENT_MAX];
 +	u32 num_6ghz_reg_rules_client_vlp[WMI_REG_CLIENT_MAX];
 +} __packed;
 +
 +struct wmi_regulatory_ext_rule {
 +	u32 tlv_header;
 +	u32 freq_info;
 +	u32 bw_pwr_info;
 +	u32 flag_info;
 +	u32 psd_power_info;
 +} __packed;
 +
 struct wmi_vdev_delete_resp_event {
 	u32 vdev_id;
 } __packed;
@@ -5358,6 +5498,7 @@ struct target_resource_config {
 	u32 sched_params;
 	u32 twt_ap_pdev_count;
 	u32 twt_ap_sta_count;
 +	u8 is_reg_cc_ext_event_supported;
 };
 enum wmi_debug_log_param {
--- a/package/kernel/mac80211/patches/ath11k/0045-ath11k-Change-masking-and-shifting-in-htt-stats.patch
+++ b/package/kernel/mac80211/patches/ath11k/0045-ath11k-Change-masking-and-shifting-in-htt-stats.patch
@ -1,683 +0,0 @@
 From 6ed731829cf862dc1f73bbd063662d8a6c78a5b7 Mon Sep 17 00:00:00 2001
 From: Seevalamuthu Mariappan <seevalam@codeaurora.org>
 Date: Tue, 28 Sep 2021 14:00:45 +0300
 Subject: [PATCH] ath11k: Change masking and shifting in htt stats
 In debugfs_htt_stats.c, masking and shifting is done to get
 stats values. Instead use GENMASK and FIELD_GET to improve
 code readability and maintenance.
 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01105-QCAHKSWPL_SILICONZ-1
 Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 Link: https://lore.kernel.org/r/20210913223148.208026-5-jouni@codeaurora.org
 ---
 .../wireless/ath/ath11k/debugfs_htt_stats.c   | 318 ++++++++++--------
 .../wireless/ath/ath11k/debugfs_htt_stats.h   |  54 +++
 drivers/net/wireless/ath/ath11k/dp.h          |   7 +
 3 files changed, 243 insertions(+), 136 deletions(-)
 --- a/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.c
 +++ b/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.c
@@ -75,8 +75,8 @@ static inline void htt_print_tx_pdev_sta
 	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
 	len += scnprintf(buf + len, buf_len - len, "HTT_TX_PDEV_STATS_CMN_TLV:\n");
 -	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
 -			 htt_stats_buf->mac_id__word & 0xFF);
 +	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
 +			 FIELD_GET(HTT_STATS_MAC_ID, htt_stats_buf->mac_id__word));
 	len += scnprintf(buf + len, buf_len - len, "hw_queued = %u\n",
 			 htt_stats_buf->hw_queued);
 	len += scnprintf(buf + len, buf_len - len, "hw_reaped = %u\n",
@@ -428,8 +428,8 @@ static inline void htt_print_hw_stats_pd
 	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
 	len += scnprintf(buf + len, buf_len - len, "HTT_HW_STATS_PDEV_ERRS_TLV:\n");
 -	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
 -			 htt_stats_buf->mac_id__word & 0xFF);
 +	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
 +			 FIELD_GET(HTT_STATS_MAC_ID, htt_stats_buf->mac_id__word));
 	len += scnprintf(buf + len, buf_len - len, "tx_abort = %u\n",
 			 htt_stats_buf->tx_abort);
 	len += scnprintf(buf + len, buf_len - len, "tx_abort_fail_count = %u\n",
@@ -480,13 +480,15 @@ static inline void htt_print_msdu_flow_s
 			 htt_stats_buf->cur_msdu_count_in_flowq);
 	len += scnprintf(buf + len, buf_len - len, "sw_peer_id = %u\n",
 			 htt_stats_buf->sw_peer_id);
 -	len += scnprintf(buf + len, buf_len - len, "tx_flow_no = %u\n",
 -			 htt_stats_buf->tx_flow_no__tid_num__drop_rule & 0xFFFF);
 -	len += scnprintf(buf + len, buf_len - len, "tid_num = %u\n",
 -			 (htt_stats_buf->tx_flow_no__tid_num__drop_rule & 0xF0000) >> 16);
 -	len += scnprintf(buf + len, buf_len - len, "drop_rule = %u\n",
 -			 (htt_stats_buf->tx_flow_no__tid_num__drop_rule & 0x100000) >>
 -			 20);
 +	len += scnprintf(buf + len, buf_len - len, "tx_flow_no = %lu\n",
 +			 FIELD_GET(HTT_MSDU_FLOW_STATS_TX_FLOW_NO,
 +				   htt_stats_buf->tx_flow_no__tid_num__drop_rule));
 +	len += scnprintf(buf + len, buf_len - len, "tid_num = %lu\n",
 +			 FIELD_GET(HTT_MSDU_FLOW_STATS_TID_NUM,
 +				   htt_stats_buf->tx_flow_no__tid_num__drop_rule));
 +	len += scnprintf(buf + len, buf_len - len, "drop_rule = %lu\n",
 +			 FIELD_GET(HTT_MSDU_FLOW_STATS_DROP_RULE,
 +				   htt_stats_buf->tx_flow_no__tid_num__drop_rule));
 	len += scnprintf(buf + len, buf_len - len, "last_cycle_enqueue_count = %u\n",
 			 htt_stats_buf->last_cycle_enqueue_count);
 	len += scnprintf(buf + len, buf_len - len, "last_cycle_dequeue_count = %u\n",
@@ -516,15 +518,18 @@ static inline void htt_print_tx_tid_stat
 	len += scnprintf(buf + len, buf_len - len, "HTT_TX_TID_STATS_TLV:\n");
 	memcpy(tid_name, &(htt_stats_buf->tid_name[0]), MAX_HTT_TID_NAME);
 	len += scnprintf(buf + len, buf_len - len, "tid_name = %s\n", tid_name);
 -	len += scnprintf(buf + len, buf_len - len, "sw_peer_id = %u\n",
 -			 htt_stats_buf->sw_peer_id__tid_num & 0xFFFF);
 -	len += scnprintf(buf + len, buf_len - len, "tid_num = %u\n",
 -			 (htt_stats_buf->sw_peer_id__tid_num & 0xFFFF0000) >> 16);
 -	len += scnprintf(buf + len, buf_len - len, "num_sched_pending = %u\n",
 -			 htt_stats_buf->num_sched_pending__num_ppdu_in_hwq & 0xFF);
 -	len += scnprintf(buf + len, buf_len - len, "num_ppdu_in_hwq = %u\n",
 -			 (htt_stats_buf->num_sched_pending__num_ppdu_in_hwq &
 -			 0xFF00) >> 8);
 +	len += scnprintf(buf + len, buf_len - len, "sw_peer_id = %lu\n",
 +			 FIELD_GET(HTT_TX_TID_STATS_SW_PEER_ID,
 +				   htt_stats_buf->sw_peer_id__tid_num));
 +	len += scnprintf(buf + len, buf_len - len, "tid_num = %lu\n",
 +			 FIELD_GET(HTT_TX_TID_STATS_TID_NUM,
 +				   htt_stats_buf->sw_peer_id__tid_num));
 +	len += scnprintf(buf + len, buf_len - len, "num_sched_pending = %lu\n",
 +			 FIELD_GET(HTT_TX_TID_STATS_NUM_SCHED_PENDING,
 +				   htt_stats_buf->num_sched_pending__num_ppdu_in_hwq));
 +	len += scnprintf(buf + len, buf_len - len, "num_ppdu_in_hwq = %lu\n",
 +			 FIELD_GET(HTT_TX_TID_STATS_NUM_PPDU_IN_HWQ,
 +				   htt_stats_buf->num_sched_pending__num_ppdu_in_hwq));
 	len += scnprintf(buf + len, buf_len - len, "tid_flags = 0x%x\n",
 			 htt_stats_buf->tid_flags);
 	len += scnprintf(buf + len, buf_len - len, "hw_queued = %u\n",
@@ -566,15 +571,18 @@ static inline void htt_print_tx_tid_stat
 	len += scnprintf(buf + len, buf_len - len, "HTT_TX_TID_STATS_V1_TLV:\n");
 	memcpy(tid_name, &(htt_stats_buf->tid_name[0]), MAX_HTT_TID_NAME);
 	len += scnprintf(buf + len, buf_len - len, "tid_name = %s\n", tid_name);
 -	len += scnprintf(buf + len, buf_len - len, "sw_peer_id = %u\n",
 -			 htt_stats_buf->sw_peer_id__tid_num & 0xFFFF);
 -	len += scnprintf(buf + len, buf_len - len, "tid_num = %u\n",
 -			 (htt_stats_buf->sw_peer_id__tid_num & 0xFFFF0000) >> 16);
 -	len += scnprintf(buf + len, buf_len - len, "num_sched_pending = %u\n",
 -			 htt_stats_buf->num_sched_pending__num_ppdu_in_hwq & 0xFF);
 -	len += scnprintf(buf + len, buf_len - len, "num_ppdu_in_hwq = %u\n",
 -			 (htt_stats_buf->num_sched_pending__num_ppdu_in_hwq &
 -			 0xFF00) >> 8);
 +	len += scnprintf(buf + len, buf_len - len, "sw_peer_id = %lu\n",
 +			 FIELD_GET(HTT_TX_TID_STATS_V1_SW_PEER_ID,
 +				   htt_stats_buf->sw_peer_id__tid_num));
 +	len += scnprintf(buf + len, buf_len - len, "tid_num = %lu\n",
 +			 FIELD_GET(HTT_TX_TID_STATS_V1_TID_NUM,
 +				   htt_stats_buf->sw_peer_id__tid_num));
 +	len += scnprintf(buf + len, buf_len - len, "num_sched_pending = %lu\n",
 +			 FIELD_GET(HTT_TX_TID_STATS_V1_NUM_SCHED_PENDING,
 +				   htt_stats_buf->num_sched_pending__num_ppdu_in_hwq));
 +	len += scnprintf(buf + len, buf_len - len, "num_ppdu_in_hwq = %lu\n",
 +			 FIELD_GET(HTT_TX_TID_STATS_V1_NUM_PPDU_IN_HWQ,
 +				   htt_stats_buf->num_sched_pending__num_ppdu_in_hwq));
 	len += scnprintf(buf + len, buf_len - len, "tid_flags = 0x%x\n",
 			 htt_stats_buf->tid_flags);
 	len += scnprintf(buf + len, buf_len - len, "max_qdepth_bytes = %u\n",
@@ -618,10 +626,12 @@ static inline void htt_print_rx_tid_stat
 	char tid_name[MAX_HTT_TID_NAME + 1] = {0};
 	len += scnprintf(buf + len, buf_len - len, "HTT_RX_TID_STATS_TLV:\n");
 -	len += scnprintf(buf + len, buf_len - len, "sw_peer_id = %u\n",
 -			 htt_stats_buf->sw_peer_id__tid_num & 0xFFFF);
 -	len += scnprintf(buf + len, buf_len - len, "tid_num = %u\n",
 -			 (htt_stats_buf->sw_peer_id__tid_num & 0xFFFF0000) >> 16);
 +	len += scnprintf(buf + len, buf_len - len, "sw_peer_id = %lu\n",
 +			 FIELD_GET(HTT_RX_TID_STATS_SW_PEER_ID,
 +				   htt_stats_buf->sw_peer_id__tid_num));
 +	len += scnprintf(buf + len, buf_len - len, "tid_num = %lu\n",
 +			 FIELD_GET(HTT_RX_TID_STATS_TID_NUM,
 +				   htt_stats_buf->sw_peer_id__tid_num));
 	memcpy(tid_name, &(htt_stats_buf->tid_name[0]), MAX_HTT_TID_NAME);
 	len += scnprintf(buf + len, buf_len - len, "tid_name = %s\n", tid_name);
 	len += scnprintf(buf + len, buf_len - len, "dup_in_reorder = %u\n",
@@ -724,20 +734,29 @@ static inline void htt_print_peer_detail
 			 htt_stats_buf->peer_type);
 	len += scnprintf(buf + len, buf_len - len, "sw_peer_id = %u\n",
 			 htt_stats_buf->sw_peer_id);
 -	len += scnprintf(buf + len, buf_len - len, "vdev_id = %u\n",
 -			 htt_stats_buf->vdev_pdev_ast_idx & 0xFF);
 -	len += scnprintf(buf + len, buf_len - len, "pdev_id = %u\n",
 -			 (htt_stats_buf->vdev_pdev_ast_idx & 0xFF00) >> 8);
 -	len += scnprintf(buf + len, buf_len - len, "ast_idx = %u\n",
 -			 (htt_stats_buf->vdev_pdev_ast_idx & 0xFFFF0000) >> 16);
 -	len += scnprintf(buf + len, buf_len - len,
 -			 "mac_addr = %02x:%02x:%02x:%02x:%02x:%02x\n",
 -			 htt_stats_buf->mac_addr.mac_addr_l32 & 0xFF,
 -			 (htt_stats_buf->mac_addr.mac_addr_l32 & 0xFF00) >> 8,
 -			 (htt_stats_buf->mac_addr.mac_addr_l32 & 0xFF0000) >> 16,
 -			 (htt_stats_buf->mac_addr.mac_addr_l32 & 0xFF000000) >> 24,
 -			 (htt_stats_buf->mac_addr.mac_addr_h16 & 0xFF),
 -			 (htt_stats_buf->mac_addr.mac_addr_h16 & 0xFF00) >> 8);
 +	len += scnprintf(buf + len, buf_len - len, "vdev_id = %lu\n",
 +			 FIELD_GET(HTT_PEER_DETAILS_VDEV_ID,
 +				   htt_stats_buf->vdev_pdev_ast_idx));
 +	len += scnprintf(buf + len, buf_len - len, "pdev_id = %lu\n",
 +			 FIELD_GET(HTT_PEER_DETAILS_PDEV_ID,
 +				   htt_stats_buf->vdev_pdev_ast_idx));
 +	len += scnprintf(buf + len, buf_len - len, "ast_idx = %lu\n",
 +			 FIELD_GET(HTT_PEER_DETAILS_AST_IDX,
 +				   htt_stats_buf->vdev_pdev_ast_idx));
 +	len += scnprintf(buf + len, buf_len - len,
 +			 "mac_addr = %02lx:%02lx:%02lx:%02lx:%02lx:%02lx\n",
 +			 FIELD_GET(HTT_MAC_ADDR_L32_0,
 +				   htt_stats_buf->mac_addr.mac_addr_l32),
 +			 FIELD_GET(HTT_MAC_ADDR_L32_1,
 +				   htt_stats_buf->mac_addr.mac_addr_l32),
 +			 FIELD_GET(HTT_MAC_ADDR_L32_2,
 +				   htt_stats_buf->mac_addr.mac_addr_l32),
 +			 FIELD_GET(HTT_MAC_ADDR_L32_3,
 +				   htt_stats_buf->mac_addr.mac_addr_l32),
 +			 FIELD_GET(HTT_MAC_ADDR_H16_0,
 +				   htt_stats_buf->mac_addr.mac_addr_h16),
 +			 FIELD_GET(HTT_MAC_ADDR_H16_1,
 +				   htt_stats_buf->mac_addr.mac_addr_h16));
 	len += scnprintf(buf + len, buf_len - len, "peer_flags = 0x%x\n",
 			 htt_stats_buf->peer_flags);
 	len += scnprintf(buf + len, buf_len - len, "qpeer_flags = 0x%x\n\n",
@@ -799,7 +818,6 @@ static inline void htt_print_tx_peer_rat
 		buf[len] = 0;
 	stats_req->buf_len = len;
 -
 }
 static inline void htt_print_rx_peer_rate_stats_tlv(const void *tag_buf,
@@ -930,10 +948,12 @@ htt_print_tx_hwq_mu_mimo_cmn_stats_tlv(c
 	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
 	len += scnprintf(buf + len, buf_len - len, "HTT_TX_HWQ_MU_MIMO_CMN_STATS_TLV:\n");
 -	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
 -			 htt_stats_buf->mac_id__hwq_id__word & 0xFF);
 -	len += scnprintf(buf + len, buf_len - len, "hwq_id = %u\n\n",
 -			 (htt_stats_buf->mac_id__hwq_id__word & 0xFF00) >> 8);
 +	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
 +			 FIELD_GET(HTT_TX_HWQ_STATS_MAC_ID,
 +				   htt_stats_buf->mac_id__hwq_id__word));
 +	len += scnprintf(buf + len, buf_len - len, "hwq_id = %lu\n\n",
 +			 FIELD_GET(HTT_TX_HWQ_STATS_HWQ_ID,
 +				   htt_stats_buf->mac_id__hwq_id__word));
 	if (len >= buf_len)
 		buf[buf_len - 1] = 0;
@@ -953,10 +973,12 @@ htt_print_tx_hwq_stats_cmn_tlv(const voi
 	/* TODO: HKDBG */
 	len += scnprintf(buf + len, buf_len - len, "HTT_TX_HWQ_STATS_CMN_TLV:\n");
 -	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
 -			 htt_stats_buf->mac_id__hwq_id__word & 0xFF);
 -	len += scnprintf(buf + len, buf_len - len, "hwq_id = %u\n",
 -			 (htt_stats_buf->mac_id__hwq_id__word & 0xFF00) >> 8);
 +	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
 +			 FIELD_GET(HTT_TX_HWQ_STATS_MAC_ID,
 +				   htt_stats_buf->mac_id__hwq_id__word));
 +	len += scnprintf(buf + len, buf_len - len, "hwq_id = %lu\n",
 +			 FIELD_GET(HTT_TX_HWQ_STATS_HWQ_ID,
 +				   htt_stats_buf->mac_id__hwq_id__word));
 	len += scnprintf(buf + len, buf_len - len, "xretry = %u\n",
 			 htt_stats_buf->xretry);
 	len += scnprintf(buf + len, buf_len - len, "underrun_cnt = %u\n",
@@ -1281,8 +1303,8 @@ htt_print_tx_selfgen_cmn_stats_tlv(const
 	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
 	len += scnprintf(buf + len, buf_len - len, "HTT_TX_SELFGEN_CMN_STATS_TLV:\n");
 -	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
 -			 htt_stats_buf->mac_id__word & 0xFF);
 +	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
 +			 FIELD_GET(HTT_STATS_MAC_ID, htt_stats_buf->mac_id__word));
 	len += scnprintf(buf + len, buf_len - len, "su_bar = %u\n",
 			 htt_stats_buf->su_bar);
 	len += scnprintf(buf + len, buf_len - len, "rts = %u\n",
@@ -1769,10 +1791,12 @@ htt_print_tx_pdev_stats_sched_per_txq_tl
 	len += scnprintf(buf + len, buf_len - len,
 			 "HTT_TX_PDEV_STATS_SCHED_PER_TXQ_TLV:\n");
 -	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
 -			 htt_stats_buf->mac_id__txq_id__word & 0xFF);
 -	len += scnprintf(buf + len, buf_len - len, "txq_id = %u\n",
 -			 (htt_stats_buf->mac_id__txq_id__word & 0xFF00) >> 8);
 +	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
 +			 FIELD_GET(HTT_TX_PDEV_STATS_SCHED_PER_TXQ_MAC_ID,
 +				   htt_stats_buf->mac_id__txq_id__word));
 +	len += scnprintf(buf + len, buf_len - len, "txq_id = %lu\n",
 +			 FIELD_GET(HTT_TX_PDEV_STATS_SCHED_PER_TXQ_ID,
 +				   htt_stats_buf->mac_id__txq_id__word));
 	len += scnprintf(buf + len, buf_len - len, "sched_policy = %u\n",
 			 htt_stats_buf->sched_policy);
 	len += scnprintf(buf + len, buf_len - len,
@@ -1833,8 +1857,8 @@ static inline void htt_print_stats_tx_sc
 	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
 	len += scnprintf(buf + len, buf_len - len, "HTT_STATS_TX_SCHED_CMN_TLV:\n");
 -	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
 -			 htt_stats_buf->mac_id__word & 0xFF);
 +	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
 +			 FIELD_GET(HTT_STATS_MAC_ID, htt_stats_buf->mac_id__word));
 	len += scnprintf(buf + len, buf_len - len, "current_timestamp = %u\n\n",
 			 htt_stats_buf->current_timestamp);
@@ -2011,8 +2035,8 @@ static inline void htt_print_tx_tqm_cmn_
 	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
 	len += scnprintf(buf + len, buf_len - len, "HTT_TX_TQM_CMN_STATS_TLV:\n");
 -	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
 -			 htt_stats_buf->mac_id__word & 0xFF);
 +	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
 +			 FIELD_GET(HTT_STATS_MAC_ID, htt_stats_buf->mac_id__word));
 	len += scnprintf(buf + len, buf_len - len, "max_cmdq_id = %u\n",
 			 htt_stats_buf->max_cmdq_id);
 	len += scnprintf(buf + len, buf_len - len, "list_mpdu_cnt_hist_intvl = %u\n",
@@ -2069,10 +2093,12 @@ static inline void htt_print_tx_tqm_cmdq
 	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
 	len += scnprintf(buf + len, buf_len - len, "HTT_TX_TQM_CMDQ_STATUS_TLV:\n");
 -	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
 -			 htt_stats_buf->mac_id__cmdq_id__word & 0xFF);
 -	len += scnprintf(buf + len, buf_len - len, "cmdq_id = %u\n\n",
 -			 (htt_stats_buf->mac_id__cmdq_id__word & 0xFF00) >> 8);
 +	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
 +			 FIELD_GET(HTT_TX_TQM_CMDQ_STATUS_MAC_ID,
 +				   htt_stats_buf->mac_id__cmdq_id__word));
 +	len += scnprintf(buf + len, buf_len - len, "cmdq_id = %lu\n\n",
 +			 FIELD_GET(HTT_TX_TQM_CMDQ_STATUS_CMDQ_ID,
 +				   htt_stats_buf->mac_id__cmdq_id__word));
 	len += scnprintf(buf + len, buf_len - len, "sync_cmd = %u\n",
 			 htt_stats_buf->sync_cmd);
 	len += scnprintf(buf + len, buf_len - len, "write_cmd = %u\n",
@@ -2417,8 +2443,8 @@ htt_print_tx_de_cmn_stats_tlv(const void
 	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
 	len += scnprintf(buf + len, buf_len - len, "HTT_TX_DE_CMN_STATS_TLV:\n");
 -	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
 -			 htt_stats_buf->mac_id__word & 0xFF);
 +	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
 +			 FIELD_GET(HTT_STATS_MAC_ID, htt_stats_buf->mac_id__word));
 	len += scnprintf(buf + len, buf_len - len, "tcl2fw_entry_count = %u\n",
 			 htt_stats_buf->tcl2fw_entry_count);
 	len += scnprintf(buf + len, buf_len - len, "not_to_fw = %u\n",
@@ -2453,26 +2479,32 @@ static inline void htt_print_ring_if_sta
 			 htt_stats_buf->base_addr);
 	len += scnprintf(buf + len, buf_len - len, "elem_size = %u\n",
 			 htt_stats_buf->elem_size);
 -	len += scnprintf(buf + len, buf_len - len, "num_elems = %u\n",
 -			 htt_stats_buf->num_elems__prefetch_tail_idx & 0xFFFF);
 -	len += scnprintf(buf + len, buf_len - len, "prefetch_tail_idx = %u\n",
 -			 (htt_stats_buf->num_elems__prefetch_tail_idx &
 -			 0xFFFF0000) >> 16);
 -	len += scnprintf(buf + len, buf_len - len, "head_idx = %u\n",
 -			 htt_stats_buf->head_idx__tail_idx & 0xFFFF);
 -	len += scnprintf(buf + len, buf_len - len, "tail_idx = %u\n",
 -			 (htt_stats_buf->head_idx__tail_idx & 0xFFFF0000) >> 16);
 -	len += scnprintf(buf + len, buf_len - len, "shadow_head_idx = %u\n",
 -			 htt_stats_buf->shadow_head_idx__shadow_tail_idx & 0xFFFF);
 -	len += scnprintf(buf + len, buf_len - len, "shadow_tail_idx = %u\n",
 -			 (htt_stats_buf->shadow_head_idx__shadow_tail_idx &
 -			 0xFFFF0000) >> 16);
 +	len += scnprintf(buf + len, buf_len - len, "num_elems = %lu\n",
 +			 FIELD_GET(HTT_RING_IF_STATS_NUM_ELEMS,
 +				   htt_stats_buf->num_elems__prefetch_tail_idx));
 +	len += scnprintf(buf + len, buf_len - len, "prefetch_tail_idx = %lu\n",
 +			 FIELD_GET(HTT_RING_IF_STATS_PREFETCH_TAIL_INDEX,
 +				   htt_stats_buf->num_elems__prefetch_tail_idx));
 +	len += scnprintf(buf + len, buf_len - len, "head_idx = %lu\n",
 +			 FIELD_GET(HTT_RING_IF_STATS_HEAD_IDX,
 +				   htt_stats_buf->head_idx__tail_idx));
 +	len += scnprintf(buf + len, buf_len - len, "tail_idx = %lu\n",
 +			 FIELD_GET(HTT_RING_IF_STATS_TAIL_IDX,
 +				   htt_stats_buf->head_idx__tail_idx));
 +	len += scnprintf(buf + len, buf_len - len, "shadow_head_idx = %lu\n",
 +			 FIELD_GET(HTT_RING_IF_STATS_SHADOW_HEAD_IDX,
 +				   htt_stats_buf->shadow_head_idx__shadow_tail_idx));
 +	len += scnprintf(buf + len, buf_len - len, "shadow_tail_idx = %lu\n",
 +			 FIELD_GET(HTT_RING_IF_STATS_SHADOW_TAIL_IDX,
 +				   htt_stats_buf->shadow_head_idx__shadow_tail_idx));
 	len += scnprintf(buf + len, buf_len - len, "num_tail_incr = %u\n",
 			 htt_stats_buf->num_tail_incr);
 -	len += scnprintf(buf + len, buf_len - len, "lwm_thresh = %u\n",
 -			 htt_stats_buf->lwm_thresh__hwm_thresh & 0xFFFF);
 -	len += scnprintf(buf + len, buf_len - len, "hwm_thresh = %u\n",
 -			 (htt_stats_buf->lwm_thresh__hwm_thresh & 0xFFFF0000) >> 16);
 +	len += scnprintf(buf + len, buf_len - len, "lwm_thresh = %lu\n",
 +			 FIELD_GET(HTT_RING_IF_STATS_LWM_THRESH,
 +				   htt_stats_buf->lwm_thresh__hwm_thresh));
 +	len += scnprintf(buf + len, buf_len - len, "hwm_thresh = %lu\n",
 +			 FIELD_GET(HTT_RING_IF_STATS_HWM_THRESH,
 +				   htt_stats_buf->lwm_thresh__hwm_thresh));
 	len += scnprintf(buf + len, buf_len - len, "overrun_hit_count = %u\n",
 			 htt_stats_buf->overrun_hit_count);
 	len += scnprintf(buf + len, buf_len - len, "underrun_hit_count = %u\n",
@@ -2504,8 +2536,8 @@ static inline void htt_print_ring_if_cmn
 	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
 	len += scnprintf(buf + len, buf_len - len, "HTT_RING_IF_CMN_TLV:\n");
 -	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
 -			 htt_stats_buf->mac_id__word & 0xFF);
 +	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
 +			 FIELD_GET(HTT_STATS_MAC_ID, htt_stats_buf->mac_id__word));
 	len += scnprintf(buf + len, buf_len - len, "num_records = %u\n\n",
 			 htt_stats_buf->num_records);
@@ -2581,8 +2613,8 @@ static inline void htt_print_sfm_cmn_tlv
 	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
 	len += scnprintf(buf + len, buf_len - len, "HTT_SFM_CMN_TLV:\n");
 -	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
 -			 htt_stats_buf->mac_id__word & 0xFF);
 +	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
 +			 FIELD_GET(HTT_STATS_MAC_ID, htt_stats_buf->mac_id__word));
 	len += scnprintf(buf + len, buf_len - len, "buf_total = %u\n",
 			 htt_stats_buf->buf_total);
 	len += scnprintf(buf + len, buf_len - len, "mem_empty = %u\n",
@@ -2609,14 +2641,18 @@ static inline void htt_print_sring_stats
 	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
 	len += scnprintf(buf + len, buf_len - len, "HTT_SRING_STATS_TLV:\n");
 -	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
 -			 htt_stats_buf->mac_id__ring_id__arena__ep & 0xFF);
 -	len += scnprintf(buf + len, buf_len - len, "ring_id = %u\n",
 -			 (htt_stats_buf->mac_id__ring_id__arena__ep & 0xFF00) >> 8);
 -	len += scnprintf(buf + len, buf_len - len, "arena = %u\n",
 -			 (htt_stats_buf->mac_id__ring_id__arena__ep & 0xFF0000) >> 16);
 -	len += scnprintf(buf + len, buf_len - len, "ep = %u\n",
 -			 (htt_stats_buf->mac_id__ring_id__arena__ep & 0x1000000) >> 24);
 +	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
 +			 FIELD_GET(HTT_SRING_STATS_MAC_ID,
 +				   htt_stats_buf->mac_id__ring_id__arena__ep));
 +	len += scnprintf(buf + len, buf_len - len, "ring_id = %lu\n",
 +			 FIELD_GET(HTT_SRING_STATS_RING_ID,
 +				   htt_stats_buf->mac_id__ring_id__arena__ep));
 +	len += scnprintf(buf + len, buf_len - len, "arena = %lu\n",
 +			 FIELD_GET(HTT_SRING_STATS_ARENA,
 +				   htt_stats_buf->mac_id__ring_id__arena__ep));
 +	len += scnprintf(buf + len, buf_len - len, "ep = %lu\n",
 +			 FIELD_GET(HTT_SRING_STATS_EP,
 +				   htt_stats_buf->mac_id__ring_id__arena__ep));
 	len += scnprintf(buf + len, buf_len - len, "base_addr_lsb = 0x%x\n",
 			 htt_stats_buf->base_addr_lsb);
 	len += scnprintf(buf + len, buf_len - len, "base_addr_msb = 0x%x\n",
@@ -2625,25 +2661,30 @@ static inline void htt_print_sring_stats
 			 htt_stats_buf->ring_size);
 	len += scnprintf(buf + len, buf_len - len, "elem_size = %u\n",
 			 htt_stats_buf->elem_size);
 -	len += scnprintf(buf + len, buf_len - len, "num_avail_words = %u\n",
 -			 htt_stats_buf->num_avail_words__num_valid_words & 0xFFFF);
 -	len += scnprintf(buf + len, buf_len - len, "num_valid_words = %u\n",
 -			 (htt_stats_buf->num_avail_words__num_valid_words &
 -			 0xFFFF0000) >> 16);
 -	len += scnprintf(buf + len, buf_len - len, "head_ptr = %u\n",
 -			 htt_stats_buf->head_ptr__tail_ptr & 0xFFFF);
 -	len += scnprintf(buf + len, buf_len - len, "tail_ptr = %u\n",
 -			 (htt_stats_buf->head_ptr__tail_ptr & 0xFFFF0000) >> 16);
 -	len += scnprintf(buf + len, buf_len - len, "consumer_empty = %u\n",
 -			 htt_stats_buf->consumer_empty__producer_full & 0xFFFF);
 -	len += scnprintf(buf + len, buf_len - len, "producer_full = %u\n",
 -			 (htt_stats_buf->consumer_empty__producer_full &
 -			 0xFFFF0000) >> 16);
 -	len += scnprintf(buf + len, buf_len - len, "prefetch_count = %u\n",
 -			 htt_stats_buf->prefetch_count__internal_tail_ptr & 0xFFFF);
 -	len += scnprintf(buf + len, buf_len - len, "internal_tail_ptr = %u\n\n",
 -			 (htt_stats_buf->prefetch_count__internal_tail_ptr &
 -			 0xFFFF0000) >> 16);
 +	len += scnprintf(buf + len, buf_len - len, "num_avail_words = %lu\n",
 +			 FIELD_GET(HTT_SRING_STATS_NUM_AVAIL_WORDS,
 +				   htt_stats_buf->num_avail_words__num_valid_words));
 +	len += scnprintf(buf + len, buf_len - len, "num_valid_words = %lu\n",
 +			 FIELD_GET(HTT_SRING_STATS_NUM_VALID_WORDS,
 +				   htt_stats_buf->num_avail_words__num_valid_words));
 +	len += scnprintf(buf + len, buf_len - len, "head_ptr = %lu\n",
 +			 FIELD_GET(HTT_SRING_STATS_HEAD_PTR,
 +				   htt_stats_buf->head_ptr__tail_ptr));
 +	len += scnprintf(buf + len, buf_len - len, "tail_ptr = %lu\n",
 +			 FIELD_GET(HTT_SRING_STATS_TAIL_PTR,
 +				   htt_stats_buf->head_ptr__tail_ptr));
 +	len += scnprintf(buf + len, buf_len - len, "consumer_empty = %lu\n",
 +			 FIELD_GET(HTT_SRING_STATS_CONSUMER_EMPTY,
 +				   htt_stats_buf->consumer_empty__producer_full));
 +	len += scnprintf(buf + len, buf_len - len, "producer_full = %lu\n",
 +			 FIELD_GET(HTT_SRING_STATS_PRODUCER_FULL,
 +				   htt_stats_buf->consumer_empty__producer_full));
 +	len += scnprintf(buf + len, buf_len - len, "prefetch_count = %lu\n",
 +			 FIELD_GET(HTT_SRING_STATS_PREFETCH_COUNT,
 +				   htt_stats_buf->prefetch_count__internal_tail_ptr));
 +	len += scnprintf(buf + len, buf_len - len, "internal_tail_ptr = %lu\n\n",
 +			 FIELD_GET(HTT_SRING_STATS_INTERNAL_TAIL_PTR,
 +				   htt_stats_buf->prefetch_count__internal_tail_ptr));
 	if (len >= buf_len)
 		buf[buf_len - 1] = 0;
@@ -2683,8 +2724,8 @@ static inline void htt_print_tx_pdev_rat
 	u8 j;
 	len += scnprintf(buf + len, buf_len - len, "HTT_TX_PDEV_RATE_STATS_TLV:\n");
 -	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
 -			 htt_stats_buf->mac_id__word & 0xFF);
 +	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
 +			 FIELD_GET(HTT_STATS_MAC_ID, htt_stats_buf->mac_id__word));
 	len += scnprintf(buf + len, buf_len - len, "tx_ldpc = %u\n",
 			 htt_stats_buf->tx_ldpc);
 	len += scnprintf(buf + len, buf_len - len, "ac_mu_mimo_tx_ldpc = %u\n",
@@ -2809,8 +2850,8 @@ static inline void htt_print_rx_pdev_rat
 	u8 i, j;
 	len += scnprintf(buf + len, buf_len - len, "HTT_RX_PDEV_RATE_STATS_TLV:\n");
 -	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
 -			 htt_stats_buf->mac_id__word & 0xFF);
 +	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
 +			 FIELD_GET(HTT_STATS_MAC_ID, htt_stats_buf->mac_id__word));
 	len += scnprintf(buf + len, buf_len - len, "nsts = %u\n",
 			 htt_stats_buf->nsts);
 	len += scnprintf(buf + len, buf_len - len, "rx_ldpc = %u\n",
@@ -2844,7 +2885,6 @@ static inline void htt_print_rx_pdev_rat
 			 htt_stats_buf->pilot_count);
 	for (j = 0; j < HTT_RX_PDEV_STATS_NUM_SPATIAL_STREAMS; j++) {
 -
 		len += scnprintf(buf + len, buf_len - len,
 				 "pilot_evm_db[%u] = ", j);
 		for (i = 0; i < HTT_RX_PDEV_STATS_RXEVM_MAX_PILOTS_PER_NSS; i++)
@@ -3173,8 +3213,8 @@ static inline void htt_print_rx_pdev_fw_
 	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
 	len += scnprintf(buf + len, buf_len - len, "HTT_RX_PDEV_FW_STATS_TLV:\n");
 -	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
 -			 htt_stats_buf->mac_id__word & 0xFF);
 +	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
 +			 FIELD_GET(HTT_STATS_MAC_ID, htt_stats_buf->mac_id__word));
 	len += scnprintf(buf + len, buf_len - len, "ppdu_recvd = %u\n",
 			 htt_stats_buf->ppdu_recvd);
 	len += scnprintf(buf + len, buf_len - len, "mpdu_cnt_fcs_ok = %u\n",
@@ -3422,8 +3462,8 @@ static inline void htt_print_hw_stats_wh
 	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
 	len += scnprintf(buf + len, buf_len - len, "HTT_HW_STATS_WHAL_TX_TLV:\n");
 -	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
 -			 htt_stats_buf->mac_id__word & 0xFF);
 +	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
 +			 FIELD_GET(HTT_STATS_MAC_ID, htt_stats_buf->mac_id__word));
 	len += scnprintf(buf + len, buf_len - len, "last_unpause_ppdu_id = %u\n",
 			 htt_stats_buf->last_unpause_ppdu_id);
 	len += scnprintf(buf + len, buf_len - len, "hwsch_unpause_wait_tqm_write = %u\n",
@@ -3492,13 +3532,19 @@ htt_print_pdev_stats_twt_session_tlv(con
 	len += scnprintf(buf + len, buf_len - len, "vdev_id = %u\n",
 			 htt_stats_buf->vdev_id);
 	len += scnprintf(buf + len, buf_len - len,
 -			 "peer_mac = %02x:%02x:%02x:%02x:%02x:%02x\n",
 -			 htt_stats_buf->peer_mac.mac_addr_l32 & 0xFF,
 -			 (htt_stats_buf->peer_mac.mac_addr_l32 & 0xFF00) >> 8,
 -			 (htt_stats_buf->peer_mac.mac_addr_l32 & 0xFF0000) >> 16,
 -			 (htt_stats_buf->peer_mac.mac_addr_l32 & 0xFF000000) >> 24,
 -			 (htt_stats_buf->peer_mac.mac_addr_h16 & 0xFF),
 -			 (htt_stats_buf->peer_mac.mac_addr_h16 & 0xFF00) >> 8);
 +			 "peer_mac = %02lx:%02lx:%02lx:%02lx:%02lx:%02lx\n",
 +			 FIELD_GET(HTT_MAC_ADDR_L32_0,
 +				   htt_stats_buf->peer_mac.mac_addr_l32),
 +			 FIELD_GET(HTT_MAC_ADDR_L32_1,
 +				   htt_stats_buf->peer_mac.mac_addr_l32),
 +			 FIELD_GET(HTT_MAC_ADDR_L32_2,
 +				   htt_stats_buf->peer_mac.mac_addr_l32),
 +			 FIELD_GET(HTT_MAC_ADDR_L32_3,
 +				   htt_stats_buf->peer_mac.mac_addr_l32),
 +			 FIELD_GET(HTT_MAC_ADDR_H16_0,
 +				   htt_stats_buf->peer_mac.mac_addr_h16),
 +			 FIELD_GET(HTT_MAC_ADDR_H16_1,
 +				   htt_stats_buf->peer_mac.mac_addr_h16));
 	len += scnprintf(buf + len, buf_len - len, "flow_id_flags = %u\n",
 			 htt_stats_buf->flow_id_flags);
 	len += scnprintf(buf + len, buf_len - len, "dialog_id = %u\n",
 --- a/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.h
 +++ b/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.h
@@ -137,6 +137,8 @@ struct htt_stats_string_tlv {
 	u32 data[0]; /* Can be variable length */
 } __packed;
 +#define HTT_STATS_MAC_ID	GENMASK(7, 0)
 +
 /* == TX PDEV STATS == */
 struct htt_tx_pdev_stats_cmn_tlv {
 	u32 mac_id__word;
@@ -290,6 +292,10 @@ struct htt_hw_stats_whal_tx_tlv {
 };
 /* ============ PEER STATS ============ */
 +#define	HTT_MSDU_FLOW_STATS_TX_FLOW_NO	GENMASK(15, 0)
 +#define	HTT_MSDU_FLOW_STATS_TID_NUM	GENMASK(19, 16)
 +#define	HTT_MSDU_FLOW_STATS_DROP_RULE	BIT(20)
 +
 struct htt_msdu_flow_stats_tlv {
 	u32 last_update_timestamp;
 	u32 last_add_timestamp;
@@ -306,6 +312,11 @@ struct htt_msdu_flow_stats_tlv {
 #define MAX_HTT_TID_NAME 8
 +#define	HTT_TX_TID_STATS_SW_PEER_ID		GENMASK(15, 0)
 +#define	HTT_TX_TID_STATS_TID_NUM		GENMASK(31, 16)
 +#define	HTT_TX_TID_STATS_NUM_SCHED_PENDING	GENMASK(7, 0)
 +#define	HTT_TX_TID_STATS_NUM_PPDU_IN_HWQ	GENMASK(15, 8)
 +
 /* Tidq stats */
 struct htt_tx_tid_stats_tlv {
 	/* Stored as little endian */
@@ -326,6 +337,11 @@ struct htt_tx_tid_stats_tlv {
 	u32 tid_tx_airtime;
 };
 +#define	HTT_TX_TID_STATS_V1_SW_PEER_ID		GENMASK(15, 0)
 +#define	HTT_TX_TID_STATS_V1_TID_NUM		GENMASK(31, 16)
 +#define	HTT_TX_TID_STATS_V1_NUM_SCHED_PENDING	GENMASK(7, 0)
 +#define	HTT_TX_TID_STATS_V1_NUM_PPDU_IN_HWQ	GENMASK(15, 8)
 +
 /* Tidq stats */
 struct htt_tx_tid_stats_v1_tlv {
 	/* Stored as little endian */
@@ -348,6 +364,9 @@ struct htt_tx_tid_stats_v1_tlv {
 	u32 sendn_frms_allowed;
 };
 +#define	HTT_RX_TID_STATS_SW_PEER_ID	GENMASK(15, 0)
 +#define	HTT_RX_TID_STATS_TID_NUM	GENMASK(31, 16)
 +
 struct htt_rx_tid_stats_tlv {
 	u32 sw_peer_id__tid_num;
 	u8 tid_name[MAX_HTT_TID_NAME];
@@ -386,6 +405,10 @@ struct htt_peer_stats_cmn_tlv {
 	u32 inactive_time;
 };
 +#define HTT_PEER_DETAILS_VDEV_ID	GENMASK(7, 0)
 +#define HTT_PEER_DETAILS_PDEV_ID	GENMASK(15, 8)
 +#define HTT_PEER_DETAILS_AST_IDX	GENMASK(31, 16)
 +
 struct htt_peer_details_tlv {
 	u32 peer_type;
 	u32 sw_peer_id;
@@ -510,6 +533,9 @@ struct htt_tx_hwq_mu_mimo_mpdu_stats_tlv
 	u32 mu_mimo_ampdu_underrun_usr;
 };
 +#define	HTT_TX_HWQ_STATS_MAC_ID	GENMASK(7, 0)
 +#define	HTT_TX_HWQ_STATS_HWQ_ID	GENMASK(15, 8)
 +
 struct htt_tx_hwq_mu_mimo_cmn_stats_tlv {
 	u32 mac_id__hwq_id__word;
 };
@@ -789,6 +815,9 @@ struct htt_sched_txq_sched_ineligibility
 	u32 sched_ineligibility[0];
 };
 +#define	HTT_TX_PDEV_STATS_SCHED_PER_TXQ_MAC_ID	GENMASK(7, 0)
 +#define	HTT_TX_PDEV_STATS_SCHED_PER_TXQ_ID	GENMASK(15, 8)
 +
 struct htt_tx_pdev_stats_sched_per_txq_tlv {
 	u32 mac_id__txq_id__word;
 	u32 sched_policy;
@@ -910,6 +939,9 @@ struct htt_tx_tqm_error_stats_tlv {
 };
 /* == TQM CMDQ stats == */
 +#define	HTT_TX_TQM_CMDQ_STATUS_MAC_ID	GENMASK(7, 0)
 +#define	HTT_TX_TQM_CMDQ_STATUS_CMDQ_ID	GENMASK(15, 8)
 +
 struct htt_tx_tqm_cmdq_status_tlv {
 	u32 mac_id__cmdq_id__word;
 	u32 sync_cmd;
@@ -1055,6 +1087,15 @@ struct htt_tx_de_cmn_stats_tlv {
 #define HTT_STATS_LOW_WM_BINS      5
 #define HTT_STATS_HIGH_WM_BINS     5
 +#define HTT_RING_IF_STATS_NUM_ELEMS		GENMASK(15, 0)
 +#define	HTT_RING_IF_STATS_PREFETCH_TAIL_INDEX	GENMASK(31, 16)
 +#define HTT_RING_IF_STATS_HEAD_IDX		GENMASK(15, 0)
 +#define HTT_RING_IF_STATS_TAIL_IDX		GENMASK(31, 16)
 +#define HTT_RING_IF_STATS_SHADOW_HEAD_IDX	GENMASK(15, 0)
 +#define HTT_RING_IF_STATS_SHADOW_TAIL_IDX	GENMASK(31, 16)
 +#define HTT_RING_IF_STATS_LWM_THRESH		GENMASK(15, 0)
 +#define HTT_RING_IF_STATS_HWM_THRESH		GENMASK(31, 16)
 +
 struct htt_ring_if_stats_tlv {
 	u32 base_addr; /* DWORD aligned base memory address of the ring */
 	u32 elem_size;
@@ -1117,6 +1158,19 @@ struct htt_sfm_cmn_tlv {
 };
 /* == SRNG STATS == */
 +#define	HTT_SRING_STATS_MAC_ID			GENMASK(7, 0)
 +#define HTT_SRING_STATS_RING_ID			GENMASK(15, 8)
 +#define HTT_SRING_STATS_ARENA			GENMASK(23, 16)
 +#define HTT_SRING_STATS_EP			BIT(24)
 +#define HTT_SRING_STATS_NUM_AVAIL_WORDS		GENMASK(15, 0)
 +#define HTT_SRING_STATS_NUM_VALID_WORDS		GENMASK(31, 16)
 +#define HTT_SRING_STATS_HEAD_PTR		GENMASK(15, 0)
 +#define HTT_SRING_STATS_TAIL_PTR		GENMASK(31, 16)
 +#define HTT_SRING_STATS_CONSUMER_EMPTY		GENMASK(15, 0)
 +#define HTT_SRING_STATS_PRODUCER_FULL		GENMASK(31, 16)
 +#define HTT_SRING_STATS_PREFETCH_COUNT		GENMASK(15, 0)
 +#define HTT_SRING_STATS_INTERNAL_TAIL_PTR	GENMASK(31, 16)
 +
 struct htt_sring_stats_tlv {
 	u32 mac_id__ring_id__arena__ep;
 	u32 base_addr_lsb; /* DWORD aligned base memory address of the ring */
 --- a/drivers/net/wireless/ath/ath11k/dp.h
 +++ b/drivers/net/wireless/ath/ath11k/dp.h
@@ -1594,6 +1594,13 @@ struct ath11k_htt_extd_stats_msg {
 	u8 data[0];
 } __packed;
 +#define	HTT_MAC_ADDR_L32_0	GENMASK(7, 0)
 +#define	HTT_MAC_ADDR_L32_1	GENMASK(15, 8)
 +#define	HTT_MAC_ADDR_L32_2	GENMASK(23, 16)
 +#define	HTT_MAC_ADDR_L32_3	GENMASK(31, 24)
 +#define	HTT_MAC_ADDR_H16_0	GENMASK(7, 0)
 +#define	HTT_MAC_ADDR_H16_1	GENMASK(15, 8)
 +
 struct htt_mac_addr {
 	u32 mac_addr_l32;
 	u32 mac_addr_h16;
--- a/Show More
+++ b/Show More