mac80211: revert to linux 5.15

package/kernel/ath10k-ct/patches/100-api_update.patch

@@ -1,618 +0,0 @@
---- a/ath10k-5.15/mac.c
-+++ b/ath10k-5.15/mac.c
-@@ -788,7 +788,7 @@ int ath10k_mac_vif_chan(struct ieee80211
- 	struct ieee80211_chanctx_conf *conf;
- 
- 	rcu_read_lock();
--	conf = rcu_dereference(vif->chanctx_conf);
-+	conf = rcu_dereference(vif->bss_conf.chanctx_conf);
- 	if (!conf) {
- 		rcu_read_unlock();
- 		return -ENOENT;
-@@ -1764,8 +1764,8 @@ static int ath10k_vdev_start_restart(str
- 		arg.channel.chan_radar =
- 			!!(chandef->chan->flags & IEEE80211_CHAN_RADAR);
- 	} else if (arvif->vdev_type == WMI_VDEV_TYPE_IBSS) {
--		arg.ssid = arvif->vif->bss_conf.ssid;
--		arg.ssid_len = arvif->vif->bss_conf.ssid_len;
-+		arg.ssid = arvif->vif->cfg.ssid;
-+		arg.ssid_len = arvif->vif->cfg.ssid_len;
- 	}
- 
- 	ath10k_dbg(ar, ATH10K_DBG_MAC,
-@@ -1890,7 +1890,7 @@ static int ath10k_mac_setup_bcn_tmpl(str
- 	    arvif->vdev_type != WMI_VDEV_TYPE_IBSS)
- 		return 0;
- 
--	bcn = ieee80211_beacon_get_template(hw, vif, &offs);
-+	bcn = ieee80211_beacon_get_template(hw, vif, &offs, 0);
- 	if (!bcn) {
- 		ath10k_warn(ar, "failed to get beacon template from mac80211\n");
- 		return -EPERM;
-@@ -2083,8 +2083,7 @@ static void ath10k_control_beaconing(str
- }
- 
- static void ath10k_control_ibss(struct ath10k_vif *arvif,
--				struct ieee80211_bss_conf *info,
--				const u8 self_peer[ETH_ALEN])
-+				struct ieee80211_vif *vif)
- {
- 	struct ath10k *ar = arvif->ar;
- 	u32 vdev_param;
-@@ -2092,7 +2091,7 @@ static void ath10k_control_ibss(struct a
- 
- 	lockdep_assert_held(&arvif->ar->conf_mutex);
- 
--	if (!info->ibss_joined) {
-+	if (!vif->cfg.ibss_joined) {
- 		if (is_zero_ether_addr(arvif->bssid))
- 			return;
- 
-@@ -2298,7 +2297,7 @@ static void ath10k_mac_vif_ap_csa_count_
- 	if (arvif->vdev_type != WMI_VDEV_TYPE_AP)
- 		return;
- 
--	if (!vif->csa_active)
-+	if (!vif->bss_conf.csa_active)
- 		return;
- 
- 	if (!arvif->is_up)
-@@ -2433,7 +2432,7 @@ static void ath10k_peer_assoc_h_basic(st
- 	lockdep_assert_held(&ar->conf_mutex);
- 
- 	if (vif->type == NL80211_IFTYPE_STATION)
--		aid = vif->bss_conf.aid;
-+		aid = vif->cfg.aid;
- 	else
- 		aid = sta->aid;
- 
-@@ -2463,7 +2462,8 @@ static void ath10k_peer_assoc_h_crypto(s
- 		return;
- 
- 	bss = cfg80211_get_bss(ar->hw->wiphy, def.chan, info->bssid,
--			       info->ssid_len ? info->ssid : NULL, info->ssid_len,
-+			       vif->cfg.ssid_len ? vif->cfg.ssid : NULL,
-+			       vif->cfg.ssid_len,
- 			       IEEE80211_BSS_TYPE_ANY, IEEE80211_PRIVACY_ANY);
- 	if (bss) {
- 		const struct cfg80211_bss_ies *ies;
-@@ -2521,7 +2521,7 @@ static void ath10k_peer_assoc_h_rates(st
- 
- 	band = def.chan->band;
- 	sband = ar->hw->wiphy->bands[band];
--	ratemask = sta->supp_rates[band];
-+	ratemask = sta->deflink.supp_rates[band];
- 	ratemask &= arvif->bitrate_mask.control[band].legacy;
- 	rates = sband->bitrates;
- 
-@@ -2770,7 +2770,7 @@ static void ath10k_peer_assoc_h_ht(struc
- 				   struct ieee80211_sta *sta,
- 				   struct wmi_peer_assoc_complete_arg *arg)
- {
--	const struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
-+	const struct ieee80211_sta_ht_cap *ht_cap = &sta->deflink.ht_cap;
- 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
- 	struct cfg80211_chan_def def;
- 	enum nl80211_band band;
-@@ -2814,7 +2814,7 @@ static void ath10k_peer_assoc_h_ht(struc
- 	if (ht_cap->cap & IEEE80211_HT_CAP_LDPC_CODING)
- 		arg->peer_flags |= ar->wmi.peer_flags->ldbc;
- 
--	if (sta->bandwidth >= IEEE80211_STA_RX_BW_40) {
-+	if (sta->deflink.bandwidth >= IEEE80211_STA_RX_BW_40) {
- 		arg->peer_flags |= ar->wmi.peer_flags->bw40;
- 		arg->peer_rate_caps |= WMI_RC_CW40_FLAG;
- 	}
-@@ -2883,7 +2883,7 @@ static void ath10k_peer_assoc_h_ht(struc
- 			arg->peer_ht_rates.rates[i] = i;
- 	} else {
- 		arg->peer_ht_rates.num_rates = n;
--		arg->peer_num_spatial_streams = min(sta->rx_nss, max_nss);
-+		arg->peer_num_spatial_streams = min(sta->deflink.rx_nss, max_nss);
- 	}
- 
- 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac ht peer %pM mcs cnt %d nss %d\n",
-@@ -3045,7 +3045,7 @@ static void ath10k_peer_assoc_h_vht(stru
- 				    struct ieee80211_sta *sta,
- 				    struct wmi_peer_assoc_complete_arg *arg)
- {
--	const struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap;
-+	const struct ieee80211_sta_vht_cap *vht_cap = &sta->deflink.vht_cap;
- 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
- 	struct ath10k_hw_params *hw = &ar->hw_params;
- 	struct cfg80211_chan_def def;
-@@ -3087,10 +3087,10 @@ static void ath10k_peer_assoc_h_vht(stru
- 				 (1U << (IEEE80211_HT_MAX_AMPDU_FACTOR +
- 					ampdu_factor)) - 1);
- 
--	if (sta->bandwidth == IEEE80211_STA_RX_BW_80)
-+	if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_80)
- 		arg->peer_flags |= ar->wmi.peer_flags->bw80;
- 
--	if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
-+	if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
- 		arg->peer_flags |= ar->wmi.peer_flags->bw160;
- 
- 	/* Calculate peer NSS capability from VHT capabilities if STA
-@@ -3104,7 +3104,7 @@ static void ath10k_peer_assoc_h_vht(stru
- 		    vht_mcs_mask[i])
- 			max_nss = i + 1;
- 	}
--	arg->peer_num_spatial_streams = min(sta->rx_nss, max_nss);
-+	arg->peer_num_spatial_streams = min(sta->deflink.rx_nss, max_nss);
- 	arg->peer_vht_rates.rx_max_rate =
- 		__le16_to_cpu(vht_cap->vht_mcs.rx_highest);
- 	arg->peer_vht_rates.rx_mcs_set =
-@@ -3266,7 +3266,7 @@ static bool ath10k_mac_sta_has_ofdm_only
- {
- 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
- 	u32 msk = arvif->bitrate_mask.control[NL80211_BAND_2GHZ].legacy &
--		sta->supp_rates[NL80211_BAND_2GHZ];
-+		sta->deflink.supp_rates[NL80211_BAND_2GHZ];
- 	/* We have 12 bits of legacy rates, first 4 are /b (CCK) rates. */
- 	return (msk & 0xff0) && !(msk & 0xf);
- }
-@@ -3276,7 +3276,7 @@ static bool ath10k_mac_sta_has_ofdm_and_
- {
- 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
- 	u32 msk = arvif->bitrate_mask.control[NL80211_BAND_2GHZ].legacy &
--		sta->supp_rates[NL80211_BAND_2GHZ];
-+		sta->deflink.supp_rates[NL80211_BAND_2GHZ];
- 	/* We have 12 bits of legacy rates, first 4 are /b (CCK) rates. */
- 	return ((msk & 0xf) && (msk & 0xff0));
- }
-@@ -3284,8 +3284,10 @@ static bool ath10k_mac_sta_has_ofdm_and_
- static enum wmi_phy_mode ath10k_mac_get_phymode_vht(struct ath10k *ar,
- 						    struct ieee80211_sta *sta)
- {
--	if (sta->bandwidth == IEEE80211_STA_RX_BW_160) {
--		switch (sta->vht_cap.cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK) {
-+	struct ieee80211_sta_vht_cap *vht_cap = &sta->deflink.vht_cap;
-+
-+	if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160) {
-+		switch (vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK) {
- 		case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ:
- 			return MODE_11AC_VHT160;
- 		case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ:
-@@ -3296,13 +3298,13 @@ static enum wmi_phy_mode ath10k_mac_get_
- 		}
- 	}
- 
--	if (sta->bandwidth == IEEE80211_STA_RX_BW_80)
-+	if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_80)
- 		return MODE_11AC_VHT80;
- 
--	if (sta->bandwidth == IEEE80211_STA_RX_BW_40)
-+	if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_40)
- 		return MODE_11AC_VHT40;
- 
--	if (sta->bandwidth == IEEE80211_STA_RX_BW_20)
-+	if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_20)
- 		return MODE_11AC_VHT20;
- 
- 	return MODE_UNKNOWN;
-@@ -3329,15 +3331,15 @@ static void ath10k_peer_assoc_h_phymode(
- 
- 	switch (band) {
- 	case NL80211_BAND_2GHZ:
--		if (sta->vht_cap.vht_supported &&
-+		if (sta->deflink.vht_cap.vht_supported &&
- 		    !ath10k_peer_assoc_h_vht_masked(vht_mcs_mask)) {
--			if (sta->bandwidth == IEEE80211_STA_RX_BW_40)
-+			if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_40)
- 				phymode = MODE_11AC_VHT40;
- 			else
- 				phymode = MODE_11AC_VHT20;
--		} else if (sta->ht_cap.ht_supported &&
-+		} else if (sta->deflink.ht_cap.ht_supported &&
- 			   !ath10k_peer_assoc_h_ht_masked(ht_mcs_mask)) {
--			if (sta->bandwidth == IEEE80211_STA_RX_BW_40)
-+			if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_40)
- 				phymode = MODE_11NG_HT40;
- 			else
- 				phymode = MODE_11NG_HT20;
-@@ -3354,12 +3356,12 @@ static void ath10k_peer_assoc_h_phymode(
- 		/*
- 		 * Check VHT first.
- 		 */
--		if (sta->vht_cap.vht_supported &&
-+		if (sta->deflink.vht_cap.vht_supported &&
- 		    !ath10k_peer_assoc_h_vht_masked(vht_mcs_mask)) {
- 			phymode = ath10k_mac_get_phymode_vht(ar, sta);
--		} else if (sta->ht_cap.ht_supported &&
-+		} else if (sta->deflink.ht_cap.ht_supported &&
- 			   !ath10k_peer_assoc_h_ht_masked(ht_mcs_mask)) {
--			if (sta->bandwidth >= IEEE80211_STA_RX_BW_40)
-+			if (sta->deflink.bandwidth >= IEEE80211_STA_RX_BW_40)
- 				phymode = MODE_11NA_HT40;
- 			else
- 				phymode = MODE_11NA_HT20;
-@@ -3373,8 +3375,8 @@ static void ath10k_peer_assoc_h_phymode(
- 	}
- 
- 	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac peer %pM phymode %s  legacy-supp-rates: 0x%x  arvif-legacy-rates: 0x%x vht-supp: %d\n",
--		   sta->addr, ath10k_wmi_phymode_str(phymode), sta->supp_rates[band],
--		   arvif->bitrate_mask.control[band].legacy, sta->vht_cap.vht_supported);
-+		   sta->addr, ath10k_wmi_phymode_str(phymode), sta->deflink.supp_rates[band],
-+		   arvif->bitrate_mask.control[band].legacy, sta->deflink.vht_cap.vht_supported);
- 
- 	arg->peer_phymode = phymode;
- 	WARN_ON(phymode == MODE_UNKNOWN);
-@@ -3677,8 +3679,8 @@ static void ath10k_bss_assoc(struct ieee
- 	/* ap_sta must be accessed only within rcu section which must be left
- 	 * before calling ath10k_setup_peer_smps() which might sleep.
- 	 */
--	ht_cap = ap_sta->ht_cap;
--	vht_cap = ap_sta->vht_cap;
-+	ht_cap = ap_sta->deflink.ht_cap;
-+	vht_cap = ap_sta->deflink.vht_cap;
- 
- 	ret = ath10k_peer_assoc_prepare(ar, vif, ap_sta, &peer_arg);
- 	if (ret) {
-@@ -3713,11 +3715,11 @@ static void ath10k_bss_assoc(struct ieee
- 
- 	ath10k_dbg(ar, ATH10K_DBG_MAC,
- 		   "mac vdev %d up (associated) bssid %pM aid %d bandwidth %d\n",
--		   arvif->vdev_id, bss_conf->bssid, bss_conf->aid, ap_sta->bandwidth);
-+		   arvif->vdev_id, bss_conf->bssid, vif->cfg.aid, ap_sta->deflink.bandwidth);
- 
- 	WARN_ON(arvif->is_up);
- 
--	arvif->aid = bss_conf->aid;
-+	arvif->aid = vif->cfg.aid;
- 	ether_addr_copy(arvif->bssid, bss_conf->bssid);
- 
- 	ret = ath10k_wmi_pdev_set_param(ar,
-@@ -4022,7 +4024,7 @@ static int ath10k_station_assoc(struct a
- 	 */
- 	if (!reassoc) {
- 		ret = ath10k_setup_peer_smps(ar, arvif, sta->addr,
--					     &sta->ht_cap);
-+					     &sta->deflink.ht_cap);
- 		if (ret) {
- 			ath10k_warn(ar, "failed to setup peer SMPS for vdev %d: %d\n",
- 				    arvif->vdev_id, ret);
-@@ -6916,7 +6918,7 @@ static void ath10k_recalculate_mgmt_rate
- static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
- 				    struct ieee80211_vif *vif,
- 				    struct ieee80211_bss_conf *info,
--				    u32 changed)
-+				    u64 changed)
- {
- 	struct ath10k *ar = hw->priv;
- 	struct ath10k_vif *arvif = (void *)vif->drv_priv;
-@@ -6930,7 +6932,7 @@ static void ath10k_bss_info_changed(stru
- 	mutex_lock(&ar->conf_mutex);
- 
- 	if (changed & BSS_CHANGED_IBSS)
--		ath10k_control_ibss(arvif, info, vif->addr);
-+		ath10k_control_ibss(arvif, vif);
- 
- 	if (changed & BSS_CHANGED_BEACON_INT) {
- 		arvif->beacon_interval = info->beacon_int;
-@@ -6995,9 +6997,9 @@ static void ath10k_bss_info_changed(stru
- 
- 	if (changed & BSS_CHANGED_SSID &&
- 	    vif->type == NL80211_IFTYPE_AP) {
--		arvif->u.ap.ssid_len = info->ssid_len;
--		if (info->ssid_len)
--			memcpy(arvif->u.ap.ssid, info->ssid, info->ssid_len);
-+		arvif->u.ap.ssid_len = vif->cfg.ssid_len;
-+		if (vif->cfg.ssid_len)
-+			memcpy(arvif->u.ap.ssid, vif->cfg.ssid, vif->cfg.ssid_len);
- 		arvif->u.ap.hidden_ssid = info->hidden_ssid;
- 	}
- 
-@@ -7074,7 +7076,7 @@ static void ath10k_bss_info_changed(stru
- 	}
- 
- 	if (changed & BSS_CHANGED_ASSOC) {
--		if (info->assoc) {
-+		if (vif->cfg.assoc) {
- 			/* Workaround: Make sure monitor vdev is not running
- 			 * when associating to prevent some firmware revisions
- 			 * (e.g. 10.1 and 10.2) from crashing.
-@@ -7099,7 +7101,7 @@ static void ath10k_bss_info_changed(stru
- 	}
- 
- 	if (changed & BSS_CHANGED_PS) {
--		arvif->ps = vif->bss_conf.ps;
-+		arvif->ps = vif->cfg.ps;
- 
- 		ret = ath10k_config_ps(ar);
- 		if (ret)
-@@ -7699,7 +7701,7 @@ static void ath10k_sta_rc_update_wk(stru
- 
- 	if (changed & IEEE80211_RC_SUPP_RATES_CHANGED) {
- 		ath10k_dbg(ar, ATH10K_DBG_STA, "mac update sta %pM supp rates, bandwidth: %d\n",
--			   sta->addr, sta->bandwidth);
-+			   sta->addr, sta->deflink.bandwidth);
- 
- 		err = ath10k_station_assoc(ar, arvif->vif, sta, true);
- 		if (err)
-@@ -7751,10 +7753,10 @@ static int ath10k_sta_set_txpwr(struct i
- 	int ret = 0;
- 	s16 txpwr;
- 
--	if (sta->txpwr.type == NL80211_TX_POWER_AUTOMATIC) {
-+	if (sta->deflink.txpwr.type == NL80211_TX_POWER_AUTOMATIC) {
- 		txpwr = 0;
- 	} else {
--		txpwr = sta->txpwr.power;
-+		txpwr = sta->deflink.txpwr.power;
- 		if (!txpwr)
- 			return -EINVAL;
- 	}
-@@ -7874,26 +7876,29 @@ static int ath10k_mac_validate_rate_mask
- 					 struct ieee80211_sta *sta,
- 					 u32 rate_ctrl_flag, u8 nss)
- {
--	if (nss > sta->rx_nss) {
-+	struct ieee80211_sta_ht_cap *ht_cap = &sta->deflink.ht_cap;
-+	struct ieee80211_sta_vht_cap *vht_cap = &sta->deflink.vht_cap;
-+
-+	if (nss > sta->deflink.rx_nss) {
- 		ath10k_warn(ar, "Invalid nss field, configured %u limit %u\n",
--			    nss, sta->rx_nss);
-+			    nss, sta->deflink.rx_nss);
- 		return -EINVAL;
- 	}
- 
- 	if (ATH10K_HW_PREAMBLE(rate_ctrl_flag) == WMI_RATE_PREAMBLE_VHT) {
--		if (!sta->vht_cap.vht_supported) {
-+		if (!vht_cap->vht_supported) {
- 			ath10k_warn(ar, "Invalid VHT rate for sta %pM\n",
- 				    sta->addr);
- 			return -EINVAL;
- 		}
- 	} else if (ATH10K_HW_PREAMBLE(rate_ctrl_flag) == WMI_RATE_PREAMBLE_HT) {
--		if (!sta->ht_cap.ht_supported || sta->vht_cap.vht_supported) {
-+		if (!ht_cap->ht_supported || vht_cap->vht_supported) {
- 			ath10k_warn(ar, "Invalid HT rate for sta %pM\n",
- 				    sta->addr);
- 			return -EINVAL;
- 		}
- 	} else {
--		if (sta->ht_cap.ht_supported || sta->vht_cap.vht_supported)
-+		if (ht_cap->ht_supported || vht_cap->vht_supported)
- 			return -EINVAL;
- 	}
- 
-@@ -8567,7 +8572,7 @@ static int ath10k_sta_state(struct ieee8
- 		 * New association.
- 		 */
- 		ath10k_dbg(ar, ATH10K_DBG_STA, "mac sta %pM associated, bandwidth: %d\n",
--			   sta->addr, sta->bandwidth);
-+			   sta->addr, sta->deflink.bandwidth);
- 
- 		ret = ath10k_station_assoc(ar, vif, sta, false);
- 		if (ret)
-@@ -8580,7 +8585,7 @@ static int ath10k_sta_state(struct ieee8
- 		 * Tdls station authorized.
- 		 */
- 		ath10k_dbg(ar, ATH10K_DBG_STA, "mac tdls sta %pM authorized, bandwidth: %d\n",
--			   sta->addr, sta->bandwidth);
-+			   sta->addr, sta->deflink.bandwidth);
- 
- 		ret = ath10k_station_assoc(ar, vif, sta, false);
- 		if (ret) {
-@@ -8721,8 +8726,8 @@ exit:
- 	return ret;
- }
- 
--static int ath10k_conf_tx(struct ieee80211_hw *hw,
--			  struct ieee80211_vif *vif, u16 ac,
-+static int ath10k_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-+			  unsigned int link_id, u16 ac,
- 			  const struct ieee80211_tx_queue_params *params)
- {
- 	struct ath10k *ar = hw->priv;
-@@ -9308,7 +9313,7 @@ static bool ath10k_mac_set_vht_bitrate_m
- 	u8 rate = arvif->vht_pfr;
- 
- 	/* skip non vht and multiple rate peers */
--	if (!sta->vht_cap.vht_supported || arvif->vht_num_rates != 1)
-+	if (!sta->deflink.vht_cap.vht_supported || arvif->vht_num_rates != 1)
- 		return false;
- 
- 	err = ath10k_wmi_peer_set_param(ar, arvif->vdev_id, sta->addr,
-@@ -9349,7 +9354,7 @@ static void ath10k_mac_clr_bitrate_mask_
- 	int err;
- 
- 	/* clear vht peers only */
--	if (arsta->arvif != arvif || !sta->vht_cap.vht_supported)
-+	if (arsta->arvif != arvif || !sta->deflink.vht_cap.vht_supported)
- 		return;
- 
- 	err = ath10k_wmi_peer_set_param(ar, arvif->vdev_id, sta->addr,
-@@ -9534,13 +9539,13 @@ static void ath10k_sta_rc_update(struct
- 
- 	ath10k_dbg(ar, ATH10K_DBG_STA,
- 		   "mac sta rc update for %pM changed %08x bw %d nss %d smps %d\n",
--		   sta->addr, changed, sta->bandwidth, sta->rx_nss,
--		   sta->smps_mode);
-+		   sta->addr, changed, sta->deflink.bandwidth, sta->deflink.rx_nss,
-+		   sta->deflink.smps_mode);
- 
- 	if (changed & IEEE80211_RC_BW_CHANGED) {
- 		bw = WMI_PEER_CHWIDTH_20MHZ;
- 
--		switch (sta->bandwidth) {
-+		switch (sta->deflink.bandwidth) {
- 		case IEEE80211_STA_RX_BW_20:
- 			bw = WMI_PEER_CHWIDTH_20MHZ;
- 			break;
-@@ -9555,7 +9560,7 @@ static void ath10k_sta_rc_update(struct
- 			break;
- 		default:
- 			ath10k_warn(ar, "Invalid bandwidth %d in rc update for %pM\n",
--				    sta->bandwidth, sta->addr);
-+				    sta->deflink.bandwidth, sta->addr);
- 			bw = WMI_PEER_CHWIDTH_20MHZ;
- 			break;
- 		}
-@@ -9564,12 +9569,12 @@ static void ath10k_sta_rc_update(struct
- 	}
- 
- 	if (changed & IEEE80211_RC_NSS_CHANGED)
--		arsta->nss = sta->rx_nss;
-+		arsta->nss = sta->deflink.rx_nss;
- 
- 	if (changed & IEEE80211_RC_SMPS_CHANGED) {
- 		smps = WMI_PEER_SMPS_PS_NONE;
- 
--		switch (sta->smps_mode) {
-+		switch (sta->deflink.smps_mode) {
- 		case IEEE80211_SMPS_AUTOMATIC:
- 		case IEEE80211_SMPS_OFF:
- 			smps = WMI_PEER_SMPS_PS_NONE;
-@@ -9582,7 +9587,7 @@ static void ath10k_sta_rc_update(struct
- 			break;
- 		case IEEE80211_SMPS_NUM_MODES:
- 			ath10k_warn(ar, "Invalid smps %d in sta rc update for %pM\n",
--				    sta->smps_mode, sta->addr);
-+				    sta->deflink.smps_mode, sta->addr);
- 			smps = WMI_PEER_SMPS_PS_NONE;
- 			break;
- 		}
-@@ -9896,7 +9901,7 @@ ath10k_mac_change_chanctx_cnt_iter(void
- {
- 	struct ath10k_mac_change_chanctx_arg *arg = data;
- 
--	if (rcu_access_pointer(vif->chanctx_conf) != arg->ctx)
-+	if (rcu_access_pointer(vif->bss_conf.chanctx_conf) != arg->ctx)
- 		return;
- 
- 	arg->n_vifs++;
-@@ -9909,7 +9914,7 @@ ath10k_mac_change_chanctx_fill_iter(void
- 	struct ath10k_mac_change_chanctx_arg *arg = data;
- 	struct ieee80211_chanctx_conf *ctx;
- 
--	ctx = rcu_access_pointer(vif->chanctx_conf);
-+	ctx = rcu_access_pointer(vif->bss_conf.chanctx_conf);
- 	if (ctx != arg->ctx)
- 		return;
- 
-@@ -9982,6 +9987,7 @@ unlock:
- static int
- ath10k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw,
- 				 struct ieee80211_vif *vif,
-+				 struct ieee80211_bss_conf *link_conf,
- 				 struct ieee80211_chanctx_conf *ctx)
- {
- 	struct ath10k *ar = hw->priv;
-@@ -10061,6 +10067,7 @@ err:
- static void
- ath10k_mac_op_unassign_vif_chanctx(struct ieee80211_hw *hw,
- 				   struct ieee80211_vif *vif,
-+				   struct ieee80211_bss_conf *link_conf,
- 				   struct ieee80211_chanctx_conf *ctx)
- {
- 	struct ath10k *ar = hw->priv;
---- a/ath10k-5.15/txrx.c
-+++ b/ath10k-5.15/txrx.c
-@@ -260,7 +260,7 @@ int ath10k_txrx_tx_unref(struct ath10k_h
- 			nf = ar->debug.nf_sum[0];
- #endif
- 		info->status.ack_signal = nf + tx_done->ack_rssi;
--		info->status.is_valid_ack_signal = true;
-+		info->status.flags |= IEEE80211_TX_STATUS_ACK_SIGNAL_VALID;
- 	}
- 
- 	if (tx_done->tx_rate_code || tx_done->tx_rate_flags || ar->ok_tx_rate_status) {
---- a/ath10k-5.15/wmi.c
-+++ b/ath10k-5.15/wmi.c
-@@ -2587,7 +2587,7 @@ wmi_process_mgmt_tx_comp(struct ath10k *
- 		info->flags |= IEEE80211_TX_STAT_ACK;
- 		info->status.ack_signal = ath10k_get_noisefloor(0, ar) +
- 					  param->ack_rssi;
--		info->status.is_valid_ack_signal = true;
-+		info->status.flags |= IEEE80211_TX_STATUS_ACK_SIGNAL_VALID;
- 	}
- 
- 	ieee80211_tx_status_irqsafe(ar->hw, msdu);
-@@ -4258,13 +4258,13 @@ void ath10k_wmi_event_host_swba(struct a
- 		 * Once CSA counter is completed stop sending beacons until
- 		 * actual channel switch is done
- 		 */
--		if (arvif->vif->csa_active &&
-+		if (arvif->vif->bss_conf.csa_active &&
- 		    ieee80211_beacon_cntdwn_is_complete(arvif->vif)) {
- 			ieee80211_csa_finish(arvif->vif);
- 			continue;
- 		}
- 
--		bcn = ieee80211_beacon_get(ar->hw, arvif->vif);
-+		bcn = ieee80211_beacon_get(ar->hw, arvif->vif, 0);
- 		if (!bcn) {
- 			ath10k_warn(ar, "could not get mac80211 beacon, vdev_id: %i addr: %pM\n",
- 				    arvif->vdev_id, arvif->vif->addr);
---- a/ath10k-5.15/htt_rx.c
-+++ b/ath10k-5.15/htt_rx.c
-@@ -4017,7 +4017,7 @@ ath10k_update_per_peer_tx_stats(struct a
- 	switch (txrate.flags) {
- 	case WMI_RATE_PREAMBLE_OFDM:
- 		if (arsta->arvif && arsta->arvif->vif)
--			conf = rcu_dereference(arsta->arvif->vif->chanctx_conf);
-+			conf = rcu_dereference(arsta->arvif->vif->bss_conf.chanctx_conf);
- 		if (conf && conf->def.chan->band == NL80211_BAND_5GHZ)
- 			arsta->tx_info.status.rates[0].idx = rate_idx - 4;
- 		break;
---- a/ath10k-5.15/wmi-tlv.c
-+++ b/ath10k-5.15/wmi-tlv.c
-@@ -205,7 +205,7 @@ static int ath10k_wmi_tlv_event_bcn_tx_s
- 	}
- 
- 	arvif = ath10k_get_arvif(ar, vdev_id);
--	if (arvif && arvif->is_up && arvif->vif->csa_active)
-+	if (arvif && arvif->is_up && arvif->vif->bss_conf.csa_active)
- 		ieee80211_queue_work(ar->hw, &arvif->ap_csa_work);
- 
- 	kfree(tb);
---- a/ath10k-5.15/core.c
-+++ b/ath10k-5.15/core.c
-@@ -4081,7 +4081,7 @@ static int ath10k_core_probe_fw(struct a
- 		ath10k_debug_print_board_info(ar);
- 	}
- 
--	device_get_mac_address(ar->dev, ar->mac_addr, sizeof(ar->mac_addr));
-+	device_get_mac_address(ar->dev, ar->mac_addr);
- 
- 	/* Try to get mac address from device node (from nvmem cell) */
- 	of_get_mac_address(ar->dev->of_node, ar->mac_addr);
---- a/ath10k-5.15/pci.c
-+++ b/ath10k-5.15/pci.c
-@@ -3547,8 +3547,7 @@ static void ath10k_pci_free_irq(struct a
- 
- void ath10k_pci_init_napi(struct ath10k *ar)
- {
--	netif_napi_add(&ar->napi_dev, &ar->napi, ath10k_pci_napi_poll,
--		       ATH10K_NAPI_BUDGET);
-+	netif_napi_add(&ar->napi_dev, &ar->napi, ath10k_pci_napi_poll);
- }
- 
- static int ath10k_pci_init_irq(struct ath10k *ar)
---- a/ath10k-5.15/sdio.c
-+++ b/ath10k-5.15/sdio.c
-@@ -2531,8 +2531,7 @@ static int ath10k_sdio_probe(struct sdio
- 		return -ENOMEM;
- 	}
- 
--	netif_napi_add(&ar->napi_dev, &ar->napi, ath10k_sdio_napi_poll,
--		       ATH10K_NAPI_BUDGET);
-+	netif_napi_add(&ar->napi_dev, &ar->napi, ath10k_sdio_napi_poll);
- 
- 	ath10k_dbg(ar, ATH10K_DBG_BOOT,
- 		   "sdio new func %d vendor 0x%x device 0x%x block 0x%x/0x%x\n",
---- a/ath10k-5.15/snoc.c
-+++ b/ath10k-5.15/snoc.c
-@@ -1242,8 +1242,7 @@ static int ath10k_snoc_napi_poll(struct
- 
- static void ath10k_snoc_init_napi(struct ath10k *ar)
- {
--	netif_napi_add(&ar->napi_dev, &ar->napi, ath10k_snoc_napi_poll,
--		       ATH10K_NAPI_BUDGET);
-+	netif_napi_add(&ar->napi_dev, &ar->napi, ath10k_snoc_napi_poll);
- }
- 
- static int ath10k_snoc_request_irq(struct ath10k *ar)

package/kernel/ath10k-ct/patches/202-ath10k-use-tpt-trigger-by-default.patch

@@ -42,7 +42,7 @@ Signed-off-by: Mathias Kresin <dev@kresin.me>
  	if (ret)
 --- a/ath10k-5.15/mac.c
 +++ b/ath10k-5.15/mac.c
-@@ -11551,7 +11551,7 @@ int ath10k_mac_register(struct ath10k *a
+@@ -11544,7 +11544,7 @@ int ath10k_mac_register(struct ath10k *a
  	ar->hw->weight_multiplier = ATH10K_AIRTIME_WEIGHT_MULTIPLIER;
  
  #ifdef CPTCFG_MAC80211_LEDS

package/kernel/mac80211/Makefile

@@ -10,11 +10,10 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=mac80211
 
-PKG_VERSION:=6.1-rc8
+PKG_VERSION:=5.15.33-1
 PKG_RELEASE:=2
-# PKG_SOURCE_URL:=@KERNEL/linux/kernel/projects/backports/stable/v5.15.58/
+PKG_SOURCE_URL:=@KERNEL/linux/kernel/projects/backports/stable/v5.15.33/
-PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources/
+PKG_HASH:=1b6b3bded4c81814ebebe2d194c2f8966d2399005b85ebb0557285b6e73f5422
-PKG_HASH:=7f3d96c2573183cd79d6a3ebe5e1b7b73c19d1326d443c85b69c4181f14e6e2b
 
 PKG_SOURCE:=backports-$(PKG_VERSION).tar.xz
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/backports-$(PKG_VERSION)
@@ -307,7 +306,6 @@ define Build/Prepare
 		$(PKG_BUILD_DIR)/include/linux/crc8.h \
 		$(PKG_BUILD_DIR)/include/linux/eeprom_93cx6.h \
 		$(PKG_BUILD_DIR)/include/linux/wl12xx.h \
-		$(PKG_BUILD_DIR)/include/linux/mhi.h \
 		$(PKG_BUILD_DIR)/include/net/ieee80211.h \
 		$(PKG_BUILD_DIR)/backport-include/linux/bcm47xx_nvram.h
 

package/kernel/mac80211/ath.mk

@@ -13,7 +13,6 @@ PKG_CONFIG_DEPENDS += \
 	CONFIG_ATH9K_TX99 \
 	CONFIG_ATH10K_LEDS \
 	CONFIG_ATH10K_THERMAL \
-	CONFIG_ATH11K_THERMAL \
 	CONFIG_ATH11K_MEM_PROFILE_512MB \
 	CONFIG_ATH11K_MEM_PROFILE_1GB \
 	CONFIG_ATH_USER_REGD
@@ -58,7 +57,6 @@ config-$(CONFIG_ATH9K_TX99) += ATH9K_TX99
 config-$(CONFIG_ATH9K_UBNTHSR) += ATH9K_UBNTHSR
 config-$(CONFIG_ATH10K_LEDS) += ATH10K_LEDS
 config-$(CONFIG_ATH10K_THERMAL) += ATH10K_THERMAL
-config-$(CONFIG_ATH11K_THERMAL) += ATH11K_THERMA
 config-$(CONFIG_ATH11K_MEM_PROFILE_512MB) += ATH11K_MEM_PROFILE_512MB
 config-$(CONFIG_ATH11K_MEM_PROFILE_1GB) += ATH11K_MEM_PROFILE_1GB
 
@@ -206,7 +204,7 @@ define KernelPackage/ath9k-common
   TITLE:=Atheros 802.11n wireless devices (common code for ath9k and ath9k_htc)
   URL:=https://wireless.wiki.kernel.org/en/users/drivers/ath9k
   HIDDEN:=1
-  DEPENDS+= @PCI_SUPPORT||USB_SUPPORT||TARGET_ath79 +kmod-ath +@DRIVER_11N_SUPPORT +kmod-random-core
+  DEPENDS+= @PCI_SUPPORT||USB_SUPPORT||TARGET_ath79 +kmod-ath +@DRIVER_11N_SUPPORT
   FILES:= \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_common.ko \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath9k/ath9k_hw.ko

package/kernel/mac80211/broadcom.mk

@@ -413,7 +413,7 @@ define KernelPackage/brcmfmac
   $(call KernelPackage/mac80211/Default)
   TITLE:=Broadcom IEEE802.11n USB FullMAC WLAN driver
   URL:=https://wireless.wiki.kernel.org/en/users/drivers/brcm80211
-  DEPENDS+= @USB_SUPPORT +kmod-cfg80211 +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT \
+  DEPENDS+= @USB_SUPPORT +kmod-mac80211 +kmod-cfg80211 +@DRIVER_11N_SUPPORT +@DRIVER_11AC_SUPPORT \
   	+kmod-brcmutil +BRCMFMAC_SDIO:kmod-mmc @!TARGET_uml \
 	+BRCMFMAC_USB:kmod-usb-core +BRCMFMAC_USB:brcmfmac-firmware-usb
   FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/broadcom/brcm80211/brcmfmac/brcmfmac.ko

package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh

@@ -1,7 +1,6 @@
 #!/bin/sh
 . /lib/netifd/netifd-wireless.sh
 . /lib/netifd/hostapd.sh
-. /lib/functions/system.sh
 
 init_wireless_driver "$@"
 
@@ -51,8 +50,6 @@ drv_mac80211_init_device_config() {
 		rx_antenna_pattern \
 		tx_antenna_pattern \
 		he_spr_sr_control \
-		he_spr_psr_enabled \
-		he_bss_color_enabled \
 		he_twt_required
 	config_add_int \
 		beamformer_antennas \
@@ -416,14 +413,12 @@ mac80211_hostapd_setup_base() {
 	if [ "$enable_ax" != "0" ]; then
 		json_get_vars \
 			he_su_beamformer:1 \
-			he_su_beamformee:1 \
+			he_su_beamformee:0 \
 			he_mu_beamformer:1 \
 			he_twt_required:0 \
-			he_spr_sr_control:3 \
+			he_spr_sr_control:0 \
-			he_spr_psr_enabled:0 \
+			he_spr_non_srg_obss_pd_max_offset:1 \
-			he_spr_non_srg_obss_pd_max_offset:0 \
+			he_bss_color
-			he_bss_color:128 \
-			he_bss_color_enabled:1
 
 		he_phy_cap=$(iw phy "$phy" info | sed -n '/HE Iftypes: AP/,$p' | awk -F "[()]" '/HE PHY Capabilities/ { print $2 }' | head -1)
 		he_phy_cap=${he_phy_cap:2}
@@ -431,6 +426,16 @@ mac80211_hostapd_setup_base() {
 		he_mac_cap=${he_mac_cap:2}
 
 		append base_cfg "ieee80211ax=1" "$N"
+
+		if [ -n "$he_bss_color" ]; then
+			append base_cfg "he_bss_color=$he_bss_color" "$N"
+		else
+			he_bss_color=$(head -1 /dev/urandom | tr -dc '0-9' | head -c2)
+			he_bss_color=$(($he_bss_color % 63))
+			he_bss_color=$(($he_bss_color + 1))
+			append base_cfg "he_bss_color=$he_bss_color" "$N"
+		fi
+
 		[ "$hwmode" = "a" ] && {
 			append base_cfg "he_oper_chwidth=$vht_oper_chwidth" "$N"
 			append base_cfg "he_oper_centr_freq_seg0_idx=$vht_center_seg0" "$N"
@@ -440,21 +445,10 @@ mac80211_hostapd_setup_base() {
 			he_su_beamformer:${he_phy_cap:6:2}:0x80:$he_su_beamformer \
 			he_su_beamformee:${he_phy_cap:8:2}:0x1:$he_su_beamformee \
 			he_mu_beamformer:${he_phy_cap:8:2}:0x2:$he_mu_beamformer \
-			he_spr_psr_enabled:${he_phy_cap:14:2}:0x1:$he_spr_psr_enabled \
+			he_spr_sr_control:${he_phy_cap:14:2}:0x1:$he_spr_sr_control \
 			he_twt_required:${he_mac_cap:0:2}:0x6:$he_twt_required
 
-		if [ "$he_bss_color_enabled" -gt 0 ]; then
+		[ "$he_spr_sr_control" -gt 0 ] && append base_cfg "he_spr_non_srg_obss_pd_max_offset=$he_spr_non_srg_obss_pd_max_offset" "$N"
-			append base_cfg "he_bss_color=$he_bss_color" "$N"
-			[ "$he_spr_non_srg_obss_pd_max_offset" -gt 0 ] && { \
-				append base_cfg "he_spr_non_srg_obss_pd_max_offset=$he_spr_non_srg_obss_pd_max_offset" "$N"
-				he_spr_sr_control=$((he_spr_sr_control | (1 << 2)))
-			}
-			[ "$he_spr_psr_enabled" -gt 0 ] || he_spr_sr_control=$((he_spr_sr_control | (1 << 0)))
-			append base_cfg "he_spr_sr_control=$he_spr_sr_control" "$N"
-		else
-			append base_cfg "he_bss_color_disabled=1" "$N"
-		fi
-
 
 		append base_cfg "he_default_pe_duration=4" "$N"
 		append base_cfg "he_rts_threshold=1023" "$N"
@@ -680,12 +674,10 @@ mac80211_prepare_vif() {
 
 	json_select ..
 
-	if [ -z "$macaddr" ]; then
+	[ -n "$macaddr" ] || {
 		macaddr="$(mac80211_generate_mac $phy)"
 		macidx="$(($macidx + 1))"
-	elif [ "$macaddr" = 'random' ]; then
+	}
-		macaddr="$(macaddr_random)"
-	fi
 
 	json_add_object data
 	json_add_string ifname "$ifname"

package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch

@@ -82,7 +82,7 @@
  	help
 --- a/local-symbols
 +++ b/local-symbols
-@@ -110,6 +110,7 @@ ADM8211=
+@@ -83,6 +83,7 @@ ADM8211=
  ATH_COMMON=
  WLAN_VENDOR_ATH=
  ATH_DEBUG=

package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch

@@ -1,6 +1,6 @@
 --- a/net/wireless/reg.c
 +++ b/net/wireless/reg.c
-@@ -3370,6 +3370,8 @@ void regulatory_hint_country_ie(struct w
+@@ -3304,6 +3304,8 @@ void regulatory_hint_country_ie(struct w
  	enum environment_cap env = ENVIRON_ANY;
  	struct regulatory_request *request = NULL, *lr;
  
@@ -9,7 +9,7 @@
  	/* IE len must be evenly divisible by 2 */
  	if (country_ie_len & 0x01)
  		return;
-@@ -3621,6 +3623,7 @@ static bool is_wiphy_all_set_reg_flag(en
+@@ -3555,6 +3557,7 @@ static bool is_wiphy_all_set_reg_flag(en
  
  void regulatory_hint_disconnect(void)
  {

package/kernel/mac80211/patches/ath/405-ath_regd_us.patch

@@ -8,7 +8,7 @@
  	FRANCE_RES = 0x31,
  	FCC3_FCCA = 0x3A,
  	FCC3_WORLD = 0x3B,
-@@ -173,6 +174,7 @@ static struct reg_dmn_pair_mapping regDo
+@@ -172,6 +173,7 @@ static struct reg_dmn_pair_mapping regDo
  	{FCC2_WORLD, CTL_FCC, CTL_ETSI},
  	{FCC2_ETSIC, CTL_FCC, CTL_ETSI},
  	{FCC3_FCCA, CTL_FCC, CTL_FCC},
@@ -16,7 +16,7 @@
  	{FCC3_WORLD, CTL_FCC, CTL_ETSI},
  	{FCC3_ETSIC, CTL_FCC, CTL_ETSI},
  	{FCC4_FCCA, CTL_FCC, CTL_FCC},
-@@ -486,6 +488,7 @@ static struct country_code_to_enum_rd al
+@@ -483,6 +485,7 @@ static struct country_code_to_enum_rd al
  	{CTRY_UAE, NULL1_WORLD, "AE"},
  	{CTRY_UNITED_KINGDOM, ETSI1_WORLD, "GB"},
  	{CTRY_UNITED_STATES, FCC3_FCCA, "US"},

package/kernel/mac80211/patches/ath10k/080-ath10k_thermal_config.patch

@@ -37,7 +37,7 @@
  void ath10k_thermal_event_temperature(struct ath10k *ar, int temperature);
 --- a/local-symbols
 +++ b/local-symbols
-@@ -169,6 +169,7 @@ ATH10K_SNOC=
+@@ -142,6 +142,7 @@ ATH10K_SNOC=
  ATH10K_DEBUG=
  ATH10K_DEBUGFS=
  ATH10K_SPECTRAL=

package/kernel/mac80211/patches/ath10k/081-01-ath10k-improve-tx-status-reporting.patch

@@ -0,0 +1,69 @@
+From 2587d5198aa5adcbd8896aae4a2404dc13d48637 Mon Sep 17 00:00:00 2001
+From: Sergey Ryazanov <ryazanov.s.a@gmail.com>
+Date: Wed, 18 May 2022 10:27:26 +0300
+Subject: ath10k: improve tx status reporting
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+We use ieee80211_tx_status() to report each completed tx frame.
+Internally, this function calls sta_info_get_by_addrs(), what has a
+couple of drawbacks:
+1. additional station lookup causes a performance degradation;
+2. mac80211 can not properly account Ethernet encapsulated frames due
+   to the inability to properly determine the destination (station) MAC
+   address since ieee80211_tx_status() assumes the frame has a 802.11
+   header.
+
+The latter is especially destructive if we want to use hardware frames
+encapsulation.
+
+To fix both of these issues, replace ieee80211_tx_status() with
+ieee80211_tx_status_ext() call and feed it station pointer from the tx
+queue associated with the transmitted frame.
+
+Tested-on: QCA9888 hw2.0 PCI 10.4-3.9.0.2-00131
+Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00157-QCARMSWPZ-1
+
+Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
+Tested-by: Oldřich Jedlička <oldium.pro@gmail.com> # TP-Link Archer C7 v4 & v5 (QCA9563 + QCA9880)
+Tested-by: Edward Matijevic <motolav@gmail.com> # TP-Link Archer C2600 (IPQ8064 + QCA9980 10.4.1.00030-1)
+Tested-by: Edward Matijevic <motolav@gmail.com> # QCA9377 PCI in Sta mode
+Tested-by: Zhijun You <hujy652@gmail.com> # NETGEAR R7800 (QCA9984 10.4-3.9.0.2-00159)
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20220516032519.29831-2-ryazanov.s.a@gmail.com
+---
+ drivers/net/wireless/ath/ath10k/txrx.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath10k/txrx.c
++++ b/drivers/net/wireless/ath/ath10k/txrx.c
+@@ -43,6 +43,7 @@ out:
+ int ath10k_txrx_tx_unref(struct ath10k_htt *htt,
+ 			 const struct htt_tx_done *tx_done)
+ {
++	struct ieee80211_tx_status status;
+ 	struct ath10k *ar = htt->ar;
+ 	struct device *dev = ar->dev;
+ 	struct ieee80211_tx_info *info;
+@@ -128,7 +129,19 @@ int ath10k_txrx_tx_unref(struct ath10k_h
+ 		info->status.is_valid_ack_signal = true;
+ 	}
+ 
+-	ieee80211_tx_status(htt->ar->hw, msdu);
++	memset(&status, 0, sizeof(status));
++	status.skb = msdu;
++	status.info = info;
++
++	rcu_read_lock();
++
++	if (txq)
++		status.sta = txq->sta;
++
++	ieee80211_tx_status_ext(htt->ar->hw, &status);
++
++	rcu_read_unlock();
++
+ 	/* we do not own the msdu anymore */
+ 
+ 	return 0;

package/kernel/mac80211/patches/ath10k/081-02-ath10k-turn-rawmode-into-frame-mode.patch

@@ -0,0 +1,74 @@
+From a09740548275a74b897654b3aca5af589289b57a Mon Sep 17 00:00:00 2001
+From: Sergey Ryazanov <ryazanov.s.a@gmail.com>
+Date: Mon, 16 May 2022 13:26:00 +0300
+Subject: ath10k: turn rawmode into frame_mode
+
+Turn boolean rawmode module param into integer frame_mode param that
+contains value from ath10k_hw_txrx_mode enum. As earlier the default
+param value is non-RAW (native Wi-Fi) encapsulation. The param name
+is selected to be consistent with the similar ath11k param.
+
+This is a preparation step for upcoming encapsulation offloading
+support.
+
+Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20220516032519.29831-4-ryazanov.s.a@gmail.com
+---
+ drivers/net/wireless/ath/ath10k/core.c | 11 +++++++----
+ drivers/net/wireless/ath/ath10k/core.h |  1 +
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath10k/core.c
++++ b/drivers/net/wireless/ath/ath10k/core.c
+@@ -32,9 +32,11 @@ EXPORT_SYMBOL(ath10k_debug_mask);
+ static unsigned int ath10k_cryptmode_param;
+ static bool uart_print;
+ static bool skip_otp;
+-static bool rawmode;
+ static bool fw_diag_log;
+ 
++/* frame mode values are mapped as per enum ath10k_hw_txrx_mode */
++unsigned int ath10k_frame_mode = ATH10K_HW_TXRX_NATIVE_WIFI;
++
+ unsigned long ath10k_coredump_mask = BIT(ATH10K_FW_CRASH_DUMP_REGISTERS) |
+ 				     BIT(ATH10K_FW_CRASH_DUMP_CE_DATA);
+ 
+@@ -43,15 +45,16 @@ module_param_named(debug_mask, ath10k_de
+ module_param_named(cryptmode, ath10k_cryptmode_param, uint, 0644);
+ module_param(uart_print, bool, 0644);
+ module_param(skip_otp, bool, 0644);
+-module_param(rawmode, bool, 0644);
+ module_param(fw_diag_log, bool, 0644);
++module_param_named(frame_mode, ath10k_frame_mode, uint, 0644);
+ module_param_named(coredump_mask, ath10k_coredump_mask, ulong, 0444);
+ 
+ MODULE_PARM_DESC(debug_mask, "Debugging mask");
+ MODULE_PARM_DESC(uart_print, "Uart target debugging");
+ MODULE_PARM_DESC(skip_otp, "Skip otp failure for calibration in testmode");
+ MODULE_PARM_DESC(cryptmode, "Crypto mode: 0-hardware, 1-software");
+-MODULE_PARM_DESC(rawmode, "Use raw 802.11 frame datapath");
++MODULE_PARM_DESC(frame_mode,
++		 "Datapath frame mode (0: raw, 1: native wifi (default))");
+ MODULE_PARM_DESC(coredump_mask, "Bitfield of what to include in firmware crash file");
+ MODULE_PARM_DESC(fw_diag_log, "Diag based fw log debugging");
+ 
+@@ -2487,7 +2490,7 @@ static int ath10k_core_init_firmware_fea
+ 	ar->htt.max_num_amsdu = ATH10K_HTT_MAX_NUM_AMSDU_DEFAULT;
+ 	ar->htt.max_num_ampdu = ATH10K_HTT_MAX_NUM_AMPDU_DEFAULT;
+ 
+-	if (rawmode) {
++	if (ath10k_frame_mode == ATH10K_HW_TXRX_RAW) {
+ 		if (!test_bit(ATH10K_FW_FEATURE_RAW_MODE_SUPPORT,
+ 			      fw_file->fw_features)) {
+ 			ath10k_err(ar, "rawmode = 1 requires support from firmware");
+--- a/drivers/net/wireless/ath/ath10k/core.h
++++ b/drivers/net/wireless/ath/ath10k/core.h
+@@ -1311,6 +1311,7 @@ static inline bool ath10k_peer_stats_ena
+ 	return false;
+ }
+ 
++extern unsigned int ath10k_frame_mode;
+ extern unsigned long ath10k_coredump_mask;
+ 
+ void ath10k_core_napi_sync_disable(struct ath10k *ar);

package/kernel/mac80211/patches/ath10k/081-03-ath10k-htt-tx-do-not-interpret-Eth-frames-as-WiFi.patch

@@ -0,0 +1,163 @@
+From 70f119fb82af7f7417dc659faf02c91e1f853739 Mon Sep 17 00:00:00 2001
+From: Sergey Ryazanov <ryazanov.s.a@gmail.com>
+Date: Mon, 16 May 2022 13:26:00 +0300
+Subject: ath10k: htt_tx: do not interpret Eth frames as WiFi
+
+The xmit path for the Ethernet encapsulated frames become more or less
+usable since d740d8fd2439 ("ath10k: unify tx mode and dispatch"). This
+change reorganize the xmit path in a manageable way to properly support
+various tx modes, but misses that the Ethernet encapsulated frame is a
+special case. We do not have an IEEE 802.11 header at the begining of
+them. But the HTT Tx handler still interprets first bytes of each frame
+as an IEEE 802.11 Frame Control field.
+
+Than this code was copied by e62ee5c381c5 ("ath10k: Add support for
+htt_data_tx_desc_64 descriptor") and a2097d6444c3 ("ath10k: htt: High
+latency TX support") to another handlers. In fact the issue in the high
+latency (HL) handler was introduced by 83ac260151e7 ("ath10k: add mic
+bytes for pmf management packet").
+
+Ethernet encapsulated frame tx mode stay unused until 75d85fd9993c
+("ath10k: introduce basic tdls functionality") started using it for TDLS
+frames to avoid key selection issue in some firmwares.
+
+Trying to interpret the begining of an Ethernet encapsulated frame as an
+IEEE 802.11 header was not hurt us noticeably since we need to meet two
+conditions: (1) xmit should be performed towards a TDLS peer, and (2)
+the TDLS peer should have a specific OUI part of its MAC address. Looks
+like that the rareness in TDLS communications of OUIs that can be
+interpreted as an 802.11 management frame saves users from facing this
+issue earlier.
+
+Improve Ethernet tx mode support in the HTT Tx handler by avoiding
+interpreting its first bytes as an IEEE 802.11 header. While at it, make
+the ieee80211_hdr variable local to the code block that is guarded by
+!is_eth check. In this way, we clarify in which cases a frame can be
+interpreted as IEEE 802.11, and saves us from similar issues in the
+future.
+
+Credits: this change as part of xmit encapsulation offloading support
+was originally made by QCA and then submitted for inclusion by John
+Crispin [1]. But the whole work was not accepted due to the lack of a
+part for 64-bits descriptors [2]. Zhijun You then pointed this out to me
+in a reply to my initial RFC patch series. And I made this slightly
+reworked version that covered all the HTT Tx handler variants.
+
+1. https://lore.kernel.org/all/20191216092207.31032-1-john@phrozen.org/
+2. https://patchwork.kernel.org/project/linux-wireless/patch/20191216092207.31032-1-john@phrozen.org/
+
+Reported-by: Zhijun You <hujy652@gmail.com>
+Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>
+Signed-off-by: John Crispin <john@phrozen.org>
+Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20220516032519.29831-3-ryazanov.s.a@gmail.com
+---
+ drivers/net/wireless/ath/ath10k/htt_tx.c | 61 ++++++++++++++++++--------------
+ 1 file changed, 35 insertions(+), 26 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath10k/htt_tx.c
++++ b/drivers/net/wireless/ath/ath10k/htt_tx.c
+@@ -1295,7 +1295,6 @@ static int ath10k_htt_tx_hl(struct ath10
+ 	struct ath10k *ar = htt->ar;
+ 	int res, data_len;
+ 	struct htt_cmd_hdr *cmd_hdr;
+-	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)msdu->data;
+ 	struct htt_data_tx_desc *tx_desc;
+ 	struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(msdu);
+ 	struct sk_buff *tmp_skb;
+@@ -1306,11 +1305,15 @@ static int ath10k_htt_tx_hl(struct ath10
+ 	u16 flags1 = 0;
+ 	u16 msdu_id = 0;
+ 
+-	if ((ieee80211_is_action(hdr->frame_control) ||
+-	     ieee80211_is_deauth(hdr->frame_control) ||
+-	     ieee80211_is_disassoc(hdr->frame_control)) &&
+-	     ieee80211_has_protected(hdr->frame_control)) {
+-		skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
++	if (!is_eth) {
++		struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)msdu->data;
++
++		if ((ieee80211_is_action(hdr->frame_control) ||
++		     ieee80211_is_deauth(hdr->frame_control) ||
++		     ieee80211_is_disassoc(hdr->frame_control)) &&
++		     ieee80211_has_protected(hdr->frame_control)) {
++			skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
++		}
+ 	}
+ 
+ 	data_len = msdu->len;
+@@ -1407,7 +1410,6 @@ static int ath10k_htt_tx_32(struct ath10
+ {
+ 	struct ath10k *ar = htt->ar;
+ 	struct device *dev = ar->dev;
+-	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)msdu->data;
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(msdu);
+ 	struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(msdu);
+ 	struct ath10k_hif_sg_item sg_items[2];
+@@ -1439,15 +1441,19 @@ static int ath10k_htt_tx_32(struct ath10
+ 	txbuf_paddr = htt->txbuf.paddr +
+ 		      (sizeof(struct ath10k_htt_txbuf_32) * msdu_id);
+ 
+-	if ((ieee80211_is_action(hdr->frame_control) ||
+-	     ieee80211_is_deauth(hdr->frame_control) ||
+-	     ieee80211_is_disassoc(hdr->frame_control)) &&
+-	     ieee80211_has_protected(hdr->frame_control)) {
+-		skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
+-	} else if (!(skb_cb->flags & ATH10K_SKB_F_NO_HWCRYPT) &&
+-		   txmode == ATH10K_HW_TXRX_RAW &&
+-		   ieee80211_has_protected(hdr->frame_control)) {
+-		skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
++	if (!is_eth) {
++		struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)msdu->data;
++
++		if ((ieee80211_is_action(hdr->frame_control) ||
++		     ieee80211_is_deauth(hdr->frame_control) ||
++		     ieee80211_is_disassoc(hdr->frame_control)) &&
++		     ieee80211_has_protected(hdr->frame_control)) {
++			skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
++		} else if (!(skb_cb->flags & ATH10K_SKB_F_NO_HWCRYPT) &&
++			   txmode == ATH10K_HW_TXRX_RAW &&
++			   ieee80211_has_protected(hdr->frame_control)) {
++			skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
++		}
+ 	}
+ 
+ 	skb_cb->paddr = dma_map_single(dev, msdu->data, msdu->len,
+@@ -1609,7 +1615,6 @@ static int ath10k_htt_tx_64(struct ath10
+ {
+ 	struct ath10k *ar = htt->ar;
+ 	struct device *dev = ar->dev;
+-	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)msdu->data;
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(msdu);
+ 	struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(msdu);
+ 	struct ath10k_hif_sg_item sg_items[2];
+@@ -1641,15 +1646,19 @@ static int ath10k_htt_tx_64(struct ath10
+ 	txbuf_paddr = htt->txbuf.paddr +
+ 		      (sizeof(struct ath10k_htt_txbuf_64) * msdu_id);
+ 
+-	if ((ieee80211_is_action(hdr->frame_control) ||
+-	     ieee80211_is_deauth(hdr->frame_control) ||
+-	     ieee80211_is_disassoc(hdr->frame_control)) &&
+-	     ieee80211_has_protected(hdr->frame_control)) {
+-		skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
+-	} else if (!(skb_cb->flags & ATH10K_SKB_F_NO_HWCRYPT) &&
+-		   txmode == ATH10K_HW_TXRX_RAW &&
+-		   ieee80211_has_protected(hdr->frame_control)) {
+-		skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
++	if (!is_eth) {
++		struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)msdu->data;
++
++		if ((ieee80211_is_action(hdr->frame_control) ||
++		     ieee80211_is_deauth(hdr->frame_control) ||
++		     ieee80211_is_disassoc(hdr->frame_control)) &&
++		     ieee80211_has_protected(hdr->frame_control)) {
++			skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
++		} else if (!(skb_cb->flags & ATH10K_SKB_F_NO_HWCRYPT) &&
++			   txmode == ATH10K_HW_TXRX_RAW &&
++			   ieee80211_has_protected(hdr->frame_control)) {
++			skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
++		}
+ 	}
+ 
+ 	skb_cb->paddr = dma_map_single(dev, msdu->data, msdu->len,

package/kernel/mac80211/patches/ath10k/081-04-ath10k-add-encapsulation-offloading-support.patch

@@ -0,0 +1,194 @@
+From af6d8265c47e46881b80c6b073f53c8c4af52d28 Mon Sep 17 00:00:00 2001
+From: Sergey Ryazanov <ryazanov.s.a@gmail.com>
+Date: Mon, 16 May 2022 13:26:00 +0300
+Subject: ath10k: add encapsulation offloading support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Frame encapsulation from Ethernet into the IEEE 802.11 frame format
+takes a considerable host CPU time on the xmit path. The firmware is
+able to do this operation for us, so enable encapsulation offloading for
+AP and Sta interface types to improve overall system performance.
+
+The driver is almost ready for encapsulation offloading support. There
+are only a few places where the driver assumes the frame format is IEEE
+802.11 that need to be fixed.
+
+Encapsulation offloading is currently disabled by default and the driver
+utilizes mac80211 encapsulation support. To activate offloading, the
+frame_mode=2 parameter should be passed during module loading.
+
+On a QCA9563+QCA9888-based access point in bridged mode, encapsulation
+offloading increases TCP 16-streams DL throughput from 365 to 396 mbps
+(+8%) and UDP DL throughput from 436 to 483 mbps (+11%).
+
+Tested-on: QCA9888 hw2.0 PCI 10.4-3.9.0.2-00131
+Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00157-QCARMSWPZ-1
+Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
+Tested-by: Oldřich Jedlička <oldium.pro@gmail.com> # TP-Link Archer C7 v4 & v5 (QCA9563 + QCA9880)
+Tested-by: Edward Matijevic <motolav@gmail.com> # TP-Link Archer C2600 (IPQ8064 + QCA9980 10.4.1.00030-1)
+Tested-by: Edward Matijevic <motolav@gmail.com> # QCA9377 PCI in Sta mode
+Tested-by: Zhijun You <hujy652@gmail.com> # NETGEAR R7800 (QCA9984 10.4-3.9.0.2-00159)
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20220516032519.29831-5-ryazanov.s.a@gmail.com
+---
+ drivers/net/wireless/ath/ath10k/core.c |  2 +-
+ drivers/net/wireless/ath/ath10k/mac.c  | 67 +++++++++++++++++++++++++++-------
+ 2 files changed, 55 insertions(+), 14 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath10k/core.c
++++ b/drivers/net/wireless/ath/ath10k/core.c
+@@ -54,7 +54,7 @@ MODULE_PARM_DESC(uart_print, "Uart targe
+ MODULE_PARM_DESC(skip_otp, "Skip otp failure for calibration in testmode");
+ MODULE_PARM_DESC(cryptmode, "Crypto mode: 0-hardware, 1-software");
+ MODULE_PARM_DESC(frame_mode,
+-		 "Datapath frame mode (0: raw, 1: native wifi (default))");
++		 "Datapath frame mode (0: raw, 1: native wifi (default), 2: ethernet)");
+ MODULE_PARM_DESC(coredump_mask, "Bitfield of what to include in firmware crash file");
+ MODULE_PARM_DESC(fw_diag_log, "Diag based fw log debugging");
+ 
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -3710,6 +3710,9 @@ ath10k_mac_tx_h_get_txmode(struct ath10k
+ 	const struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(skb);
+ 	__le16 fc = hdr->frame_control;
+ 
++	if (IEEE80211_SKB_CB(skb)->flags & IEEE80211_TX_CTL_HW_80211_ENCAP)
++		return ATH10K_HW_TXRX_ETHERNET;
++
+ 	if (!vif || vif->type == NL80211_IFTYPE_MONITOR)
+ 		return ATH10K_HW_TXRX_RAW;
+ 
+@@ -3870,6 +3873,12 @@ static void ath10k_mac_tx_h_fill_cb(stru
+ 	bool noack = false;
+ 
+ 	cb->flags = 0;
++
++	if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) {
++		cb->flags |= ATH10K_SKB_F_QOS;	/* Assume data frames are QoS */
++		goto finish_cb_fill;
++	}
++
+ 	if (!ath10k_tx_h_use_hwcrypto(vif, skb))
+ 		cb->flags |= ATH10K_SKB_F_NO_HWCRYPT;
+ 
+@@ -3908,6 +3917,7 @@ static void ath10k_mac_tx_h_fill_cb(stru
+ 		cb->flags |= ATH10K_SKB_F_RAW_TX;
+ 	}
+ 
++finish_cb_fill:
+ 	cb->vif = vif;
+ 	cb->txq = txq;
+ 	cb->airtime_est = airtime;
+@@ -4031,7 +4041,11 @@ static int ath10k_mac_tx(struct ath10k *
+ 		ath10k_tx_h_seq_no(vif, skb);
+ 		break;
+ 	case ATH10K_HW_TXRX_ETHERNET:
+-		ath10k_tx_h_8023(skb);
++		/* Convert 802.11->802.3 header only if the frame was erlier
++		 * encapsulated to 802.11 by mac80211. Otherwise pass it as is.
++		 */
++		if (!(info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP))
++			ath10k_tx_h_8023(skb);
+ 		break;
+ 	case ATH10K_HW_TXRX_RAW:
+ 		if (!test_bit(ATH10K_FLAG_RAW_MODE, &ar->dev_flags) &&
+@@ -4643,12 +4657,10 @@ static void ath10k_mac_op_tx(struct ieee
+ 	struct ieee80211_vif *vif = info->control.vif;
+ 	struct ieee80211_sta *sta = control->sta;
+ 	struct ieee80211_txq *txq = NULL;
+-	struct ieee80211_hdr *hdr = (void *)skb->data;
+ 	enum ath10k_hw_txrx_mode txmode;
+ 	enum ath10k_mac_tx_path txpath;
+ 	bool is_htt;
+ 	bool is_mgmt;
+-	bool is_presp;
+ 	int ret;
+ 	u16 airtime;
+ 
+@@ -4662,8 +4674,14 @@ static void ath10k_mac_op_tx(struct ieee
+ 	is_mgmt = (txpath == ATH10K_MAC_TX_HTT_MGMT);
+ 
+ 	if (is_htt) {
++		bool is_presp = false;
++
+ 		spin_lock_bh(&ar->htt.tx_lock);
+-		is_presp = ieee80211_is_probe_resp(hdr->frame_control);
++		if (!(info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP)) {
++			struct ieee80211_hdr *hdr = (void *)skb->data;
++
++			is_presp = ieee80211_is_probe_resp(hdr->frame_control);
++		}
+ 
+ 		ret = ath10k_htt_tx_inc_pending(htt);
+ 		if (ret) {
+@@ -5447,6 +5465,30 @@ static int ath10k_mac_set_txbf_conf(stru
+ 					 ar->wmi.vdev_param->txbf, value);
+ }
+ 
++static void ath10k_update_vif_offload(struct ieee80211_hw *hw,
++				      struct ieee80211_vif *vif)
++{
++	struct ath10k_vif *arvif = (void *)vif->drv_priv;
++	struct ath10k *ar = hw->priv;
++	u32 vdev_param;
++	int ret;
++
++	if (ath10k_frame_mode != ATH10K_HW_TXRX_ETHERNET ||
++	    ar->wmi.vdev_param->tx_encap_type == WMI_VDEV_PARAM_UNSUPPORTED ||
++	     (vif->type != NL80211_IFTYPE_STATION &&
++	      vif->type != NL80211_IFTYPE_AP))
++		vif->offload_flags &= ~IEEE80211_OFFLOAD_ENCAP_ENABLED;
++
++	vdev_param = ar->wmi.vdev_param->tx_encap_type;
++	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
++					ATH10K_HW_TXRX_NATIVE_WIFI);
++	/* 10.X firmware does not support this VDEV parameter. Do not warn */
++	if (ret && ret != -EOPNOTSUPP) {
++		ath10k_warn(ar, "failed to set vdev %i TX encapsulation: %d\n",
++			    arvif->vdev_id, ret);
++	}
++}
++
+ /*
+  * TODO:
+  * Figure out how to handle WMI_VDEV_SUBTYPE_P2P_DEVICE,
+@@ -5656,15 +5698,7 @@ static int ath10k_add_interface(struct i
+ 
+ 	arvif->def_wep_key_idx = -1;
+ 
+-	vdev_param = ar->wmi.vdev_param->tx_encap_type;
+-	ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
+-					ATH10K_HW_TXRX_NATIVE_WIFI);
+-	/* 10.X firmware does not support this VDEV parameter. Do not warn */
+-	if (ret && ret != -EOPNOTSUPP) {
+-		ath10k_warn(ar, "failed to set vdev %i TX encapsulation: %d\n",
+-			    arvif->vdev_id, ret);
+-		goto err_vdev_delete;
+-	}
++	ath10k_update_vif_offload(hw, vif);
+ 
+ 	/* Configuring number of spatial stream for monitor interface is causing
+ 	 * target assert in qca9888 and qca6174.
+@@ -9352,6 +9386,7 @@ static const struct ieee80211_ops ath10k
+ 	.stop				= ath10k_stop,
+ 	.config				= ath10k_config,
+ 	.add_interface			= ath10k_add_interface,
++	.update_vif_offload		= ath10k_update_vif_offload,
+ 	.remove_interface		= ath10k_remove_interface,
+ 	.configure_filter		= ath10k_configure_filter,
+ 	.bss_info_changed		= ath10k_bss_info_changed,
+@@ -10021,6 +10056,12 @@ int ath10k_mac_register(struct ath10k *a
+ 	if (test_bit(WMI_SERVICE_TDLS_UAPSD_BUFFER_STA, ar->wmi.svc_map))
+ 		ieee80211_hw_set(ar->hw, SUPPORTS_TDLS_BUFFER_STA);
+ 
++	if (ath10k_frame_mode == ATH10K_HW_TXRX_ETHERNET) {
++		if (ar->wmi.vdev_param->tx_encap_type !=
++		    WMI_VDEV_PARAM_UNSUPPORTED)
++			ieee80211_hw_set(ar->hw, SUPPORTS_TX_ENCAP_OFFLOAD);
++	}
++
+ 	ar->hw->wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
+ 	ar->hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
+ 	ar->hw->wiphy->max_remain_on_channel_duration = 5000;

package/kernel/mac80211/patches/ath10k/100-ath10k-support-bus-and-device-specific-API-1-BDF-sel.patch

@@ -0,0 +1,65 @@
+From f2a7064a78b22f2b68b9fcbc8a6f4c5e61c5ba64 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Sun, 10 Oct 2021 00:17:11 +0200
+Subject: [PATCH] ath10k: support bus and device specific API 1 BDF selection
+
+Some ath10k IPQ40xx devices like the MikroTik hAP ac2 and ac3 require the
+BDF-s to be extracted from the device storage instead of shipping packaged
+API 2 BDF-s.
+
+This is required as MikroTik has started shipping boards that require BDF-s
+to be updated, as otherwise their WLAN performance really suffers.
+This is however impossible as the devices that require this are release
+under the same revision and its not possible to differentiate them from
+devices using the older BDF-s.
+
+In OpenWrt we are extracting the calibration data during runtime and we are
+able to extract the BDF-s in the same manner, however we cannot package the
+BDF-s to API 2 format on the fly and can only use API 1 to provide BDF-s on
+the fly.
+This is an issue as the ath10k driver explicitly looks only for the
+board.bin file and not for something like board-bus-device.bin like it does
+for pre-cal data.
+Due to this we have no way of providing correct BDF-s on the fly, so lets
+extend the ath10k driver to first look for BDF-s in the
+board-bus-device.bin format, for example: board-ahb-a800000.wifi.bin
+If that fails, look for the default board file name as defined previously.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20211009221711.2315352-1-robimarko@gmail.com
+---
+ drivers/net/wireless/ath/ath10k/core.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath10k/core.c
++++ b/drivers/net/wireless/ath/ath10k/core.c
+@@ -1202,6 +1202,7 @@ success:
+ static int ath10k_core_fetch_board_data_api_1(struct ath10k *ar, int bd_ie_type)
+ {
+ 	const struct firmware *fw;
++	char boardname[100];
+ 
+ 	if (bd_ie_type == ATH10K_BD_IE_BOARD) {
+ 		if (!ar->hw_params.fw.board) {
+@@ -1209,9 +1210,19 @@ static int ath10k_core_fetch_board_data_
+ 			return -EINVAL;
+ 		}
+ 
++		scnprintf(boardname, sizeof(boardname), "board-%s-%s.bin",
++			  ath10k_bus_str(ar->hif.bus), dev_name(ar->dev));
++
+ 		ar->normal_mode_fw.board = ath10k_fetch_fw_file(ar,
+ 								ar->hw_params.fw.dir,
+-								ar->hw_params.fw.board);
++								boardname);
++		if (IS_ERR(ar->normal_mode_fw.board)) {
++			fw = ath10k_fetch_fw_file(ar,
++						  ar->hw_params.fw.dir,
++						  ar->hw_params.fw.board);
++			ar->normal_mode_fw.board = fw;
++		}
++
+ 		if (IS_ERR(ar->normal_mode_fw.board))
+ 			return PTR_ERR(ar->normal_mode_fw.board);
+ 

package/kernel/mac80211/patches/ath10k/120-ath10k-fetch-calibration-data-via-nvmem-subsystem.patch

@@ -0,0 +1,162 @@
+From e2333703373e8b81294da5d1c73c30154f75b082 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@gmail.com>
+Date: Fri, 15 Oct 2021 18:56:33 +0200
+Subject: [PATCH] ath10k: fetch (pre-)calibration data via nvmem subsystem
+
+On most embedded ath10k devices (like range extenders,
+routers, accesspoints, ...) the calibration data is
+stored in a easily accessible MTD partitions named
+"ART", "caldata", "calibration", etc...
+
+Since commit 4b361cfa8624 ("mtd: core: add OTP nvmem provider support"):
+MTD partitions and portions of them can be specified
+as potential nvmem-cells which are accessible through
+the nvmem subsystem.
+
+This feature - together with an nvmem cell definition either
+in the platform data or via device-tree allows drivers to get
+the (pre-)calibration data which is required for initializing
+the WIFI.
+
+Tested with Netgear EX6150v2 (IPQ4018)
+
+Cc: Robert Marko <robimarko@gmail.com>
+Cc: Thibaut Varene <hacks@slashdirt.org>
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+---
+--- a/drivers/net/wireless/ath/ath10k/core.c
++++ b/drivers/net/wireless/ath/ath10k/core.c
+@@ -12,6 +12,7 @@
+ #include <linux/dmi.h>
+ #include <linux/ctype.h>
+ #include <linux/pm_qos.h>
++#include <linux/nvmem-consumer.h>
+ #include <asm/byteorder.h>
+ 
+ #include "core.h"
+@@ -955,7 +956,8 @@ static int ath10k_core_get_board_id_from
+ 	}
+ 
+ 	if (ar->cal_mode == ATH10K_PRE_CAL_MODE_DT ||
+-	    ar->cal_mode == ATH10K_PRE_CAL_MODE_FILE)
++	    ar->cal_mode == ATH10K_PRE_CAL_MODE_FILE ||
++	    ar->cal_mode == ATH10K_PRE_CAL_MODE_NVMEM)
+ 		bmi_board_id_param = BMI_PARAM_GET_FLASH_BOARD_ID;
+ 	else
+ 		bmi_board_id_param = BMI_PARAM_GET_EEPROM_BOARD_ID;
+@@ -1757,7 +1759,8 @@ static int ath10k_download_and_run_otp(s
+ 
+ 	/* As of now pre-cal is valid for 10_4 variants */
+ 	if (ar->cal_mode == ATH10K_PRE_CAL_MODE_DT ||
+-	    ar->cal_mode == ATH10K_PRE_CAL_MODE_FILE)
++	    ar->cal_mode == ATH10K_PRE_CAL_MODE_FILE ||
++	    ar->cal_mode == ATH10K_PRE_CAL_MODE_NVMEM)
+ 		bmi_otp_exe_param = BMI_PARAM_FLASH_SECTION_ALL;
+ 
+ 	ret = ath10k_bmi_execute(ar, address, bmi_otp_exe_param, &result);
+@@ -1884,6 +1887,39 @@ out_free:
+ 	return ret;
+ }
+ 
++static int ath10k_download_cal_nvmem(struct ath10k *ar, const char *cell_name)
++{
++	struct nvmem_cell *cell;
++	void *buf;
++	size_t len;
++	int ret;
++
++	cell = devm_nvmem_cell_get(ar->dev, cell_name);
++	if (IS_ERR(cell)) {
++		ret = PTR_ERR(cell);
++		return ret;
++	}
++
++	buf = nvmem_cell_read(cell, &len);
++	if (IS_ERR(buf))
++		return PTR_ERR(buf);
++
++	if (ar->hw_params.cal_data_len != len) {
++		kfree(buf);
++		ath10k_warn(ar, "invalid calibration data length in nvmem-cell '%s': %zu != %u\n",
++			    cell_name, len, ar->hw_params.cal_data_len);
++		return -EMSGSIZE;
++	}
++
++	ret = ath10k_download_board_data(ar, buf, len);
++	kfree(buf);
++	if (ret)
++		ath10k_warn(ar, "failed to download calibration data from nvmem-cell '%s': %d\n",
++			    cell_name, ret);
++
++	return ret;
++}
++
+ int ath10k_core_fetch_firmware_api_n(struct ath10k *ar, const char *name,
+ 				     struct ath10k_fw_file *fw_file)
+ {
+@@ -2118,6 +2154,18 @@ static int ath10k_core_pre_cal_download(
+ {
+ 	int ret;
+ 
++	ret = ath10k_download_cal_nvmem(ar, "pre-calibration");
++	if (ret == 0) {
++		ar->cal_mode = ATH10K_PRE_CAL_MODE_NVMEM;
++		goto success;
++	} else if (ret == -EPROBE_DEFER) {
++		return ret;
++	}
++
++	ath10k_dbg(ar, ATH10K_DBG_BOOT,
++		   "boot did not find a pre-calibration nvmem-cell, try file next: %d\n",
++		   ret);
++
+ 	ret = ath10k_download_cal_file(ar, ar->pre_cal_file);
+ 	if (ret == 0) {
+ 		ar->cal_mode = ATH10K_PRE_CAL_MODE_FILE;
+@@ -2184,6 +2232,18 @@ static int ath10k_download_cal_data(stru
+ 		   "pre cal download procedure failed, try cal file: %d\n",
+ 		   ret);
+ 
++	ret = ath10k_download_cal_nvmem(ar, "calibration");
++	if (ret == 0) {
++		ar->cal_mode = ATH10K_CAL_MODE_NVMEM;
++		goto done;
++	} else if (ret == -EPROBE_DEFER) {
++		return ret;
++	}
++
++	ath10k_dbg(ar, ATH10K_DBG_BOOT,
++		   "boot did not find a calibration nvmem-cell, try file next: %d\n",
++		   ret);
++
+ 	ret = ath10k_download_cal_file(ar, ar->cal_file);
+ 	if (ret == 0) {
+ 		ar->cal_mode = ATH10K_CAL_MODE_FILE;
+--- a/drivers/net/wireless/ath/ath10k/core.h
++++ b/drivers/net/wireless/ath/ath10k/core.h
+@@ -877,8 +877,10 @@ enum ath10k_cal_mode {
+ 	ATH10K_CAL_MODE_FILE,
+ 	ATH10K_CAL_MODE_OTP,
+ 	ATH10K_CAL_MODE_DT,
++	ATH10K_CAL_MODE_NVMEM,
+ 	ATH10K_PRE_CAL_MODE_FILE,
+ 	ATH10K_PRE_CAL_MODE_DT,
++	ATH10K_PRE_CAL_MODE_NVMEM,
+ 	ATH10K_CAL_MODE_EEPROM,
+ };
+ 
+@@ -898,10 +900,14 @@ static inline const char *ath10k_cal_mod
+ 		return "otp";
+ 	case ATH10K_CAL_MODE_DT:
+ 		return "dt";
++	case ATH10K_CAL_MODE_NVMEM:
++		return "nvmem";
+ 	case ATH10K_PRE_CAL_MODE_FILE:
+ 		return "pre-cal-file";
+ 	case ATH10K_PRE_CAL_MODE_DT:
+ 		return "pre-cal-dt";
++	case ATH10K_PRE_CAL_MODE_NVMEM:
++		return "pre-cal-nvmem";
+ 	case ATH10K_CAL_MODE_EEPROM:
+ 		return "eeprom";
+ 	}

package/kernel/mac80211/patches/ath10k/921-ath10k_init_devices_synchronously.patch

@@ -14,7 +14,7 @@ Signed-off-by: Sven Eckelmann <sven@open-mesh.com>
 
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -3500,6 +3500,16 @@ int ath10k_core_register(struct ath10k *
+@@ -3443,6 +3443,16 @@ int ath10k_core_register(struct ath10k *
  
  	queue_work(ar->workqueue, &ar->register_work);
  

package/kernel/mac80211/patches/ath10k/930-ath10k_add_tpt_led_trigger.patch

@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -9909,6 +9909,21 @@ static int ath10k_mac_init_rd(struct ath
+@@ -9878,6 +9878,21 @@ static int ath10k_mac_init_rd(struct ath
  	return 0;
  }
  
@@ -22,7 +22,7 @@
  int ath10k_mac_register(struct ath10k *ar)
  {
  	static const u32 cipher_suites[] = {
-@@ -10267,6 +10282,12 @@ int ath10k_mac_register(struct ath10k *a
+@@ -10236,6 +10251,12 @@ int ath10k_mac_register(struct ath10k *a
  
  	ar->hw->weight_multiplier = ATH10K_AIRTIME_WEIGHT_MULTIPLIER;
  

package/kernel/mac80211/patches/ath10k/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch

@@ -114,7 +114,7 @@ v13:
  ath10k_core-$(CONFIG_DEV_COREDUMP) += coredump.o
 --- a/local-symbols
 +++ b/local-symbols
-@@ -170,6 +170,7 @@ ATH10K_DEBUG=
+@@ -143,6 +143,7 @@ ATH10K_DEBUG=
  ATH10K_DEBUGFS=
  ATH10K_SPECTRAL=
  ATH10K_THERMAL=
@@ -140,7 +140,7 @@ v13:
  		.patch_load_addr = QCA988X_HW_2_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_ALL,
-@@ -144,6 +146,7 @@ static const struct ath10k_hw_params ath
+@@ -138,6 +140,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA9887_1_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca9887 hw1.0",
@@ -148,7 +148,7 @@ v13:
  		.patch_load_addr = QCA9887_HW_1_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_ALL,
-@@ -379,6 +382,7 @@ static const struct ath10k_hw_params ath
+@@ -355,6 +358,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA99X0_2_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca99x0 hw2.0",
@@ -156,7 +156,7 @@ v13:
  		.patch_load_addr = QCA99X0_HW_2_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.otp_exe_param = 0x00000700,
-@@ -424,6 +428,7 @@ static const struct ath10k_hw_params ath
+@@ -397,6 +401,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA9984_1_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca9984/qca9994 hw1.0",
@@ -164,7 +164,7 @@ v13:
  		.patch_load_addr = QCA9984_HW_1_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_EACH,
-@@ -476,6 +481,7 @@ static const struct ath10k_hw_params ath
+@@ -446,6 +451,7 @@ static const struct ath10k_hw_params ath
  		.dev_id = QCA9888_2_0_DEVICE_ID,
  		.bus = ATH10K_BUS_PCI,
  		.name = "qca9888 hw2.0",
@@ -172,7 +172,7 @@ v13:
  		.patch_load_addr = QCA9888_HW_2_0_PATCH_LOAD_ADDR,
  		.uart_pin = 7,
  		.cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_EACH,
-@@ -3215,6 +3221,10 @@ int ath10k_core_start(struct ath10k *ar,
+@@ -3158,6 +3164,10 @@ int ath10k_core_start(struct ath10k *ar,
  		goto err_hif_stop;
  	}
  
@@ -183,7 +183,7 @@ v13:
  	return 0;
  
  err_hif_stop:
-@@ -3473,9 +3483,18 @@ static void ath10k_core_register_work(st
+@@ -3416,9 +3426,18 @@ static void ath10k_core_register_work(st
  		goto err_spectral_destroy;
  	}
  
@@ -202,7 +202,7 @@ v13:
  err_spectral_destroy:
  	ath10k_spectral_destroy(ar);
  err_debug_destroy:
-@@ -3521,6 +3540,8 @@ void ath10k_core_unregister(struct ath10
+@@ -3464,6 +3483,8 @@ void ath10k_core_unregister(struct ath10
  	if (!test_bit(ATH10K_FLAG_CORE_REGISTERED, &ar->dev_flags))
  		return;
  
@@ -221,7 +221,7 @@ v13:
  
  #include "htt.h"
  #include "htc.h"
-@@ -1253,6 +1254,13 @@ struct ath10k {
+@@ -1256,6 +1257,13 @@ struct ath10k {
  	} testmode;
  
  	struct {
@@ -237,7 +237,7 @@ v13:
  		u32 fw_crash_counter;
 --- a/drivers/net/wireless/ath/ath10k/hw.h
 +++ b/drivers/net/wireless/ath/ath10k/hw.h
-@@ -519,6 +519,7 @@ struct ath10k_hw_params {
+@@ -517,6 +517,7 @@ struct ath10k_hw_params {
  	const char *name;
  	u32 patch_load_addr;
  	int uart_pin;

package/kernel/mac80211/patches/ath10k/975-ath10k-use-tpt-trigger-by-default.patch

@@ -16,7 +16,7 @@ Signed-off-by: Mathias Kresin <dev@kresin.me>
 
 --- a/drivers/net/wireless/ath/ath10k/core.h
 +++ b/drivers/net/wireless/ath/ath10k/core.h
-@@ -1309,6 +1309,10 @@ struct ath10k {
+@@ -1312,6 +1312,10 @@ struct ath10k {
  	s32 tx_power_2g_limit;
  	s32 tx_power_5g_limit;
  
@@ -42,7 +42,7 @@ Signed-off-by: Mathias Kresin <dev@kresin.me>
  	if (ret)
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -10284,7 +10284,7 @@ int ath10k_mac_register(struct ath10k *a
+@@ -10253,7 +10253,7 @@ int ath10k_mac_register(struct ath10k *a
  	ar->hw->weight_multiplier = ATH10K_AIRTIME_WEIGHT_MULTIPLIER;
  
  #ifdef CPTCFG_MAC80211_LEDS

package/kernel/mac80211/patches/ath10k/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch

@@ -28,7 +28,7 @@ Forwarded: no
 
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -1028,6 +1028,40 @@ static inline int ath10k_vdev_setup_sync
+@@ -1021,6 +1021,40 @@ static inline int ath10k_vdev_setup_sync
  	return ar->last_wmi_vdev_start_status;
  }
  
@@ -69,7 +69,7 @@ Forwarded: no
  static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id)
  {
  	struct cfg80211_chan_def *chandef = NULL;
-@@ -1060,7 +1094,8 @@ static int ath10k_monitor_vdev_start(str
+@@ -1053,7 +1087,8 @@ static int ath10k_monitor_vdev_start(str
  	arg.channel.min_power = 0;
  	arg.channel.max_power = channel->max_power * 2;
  	arg.channel.max_reg_power = channel->max_reg_power * 2;
@@ -79,7 +79,7 @@ Forwarded: no
  
  	reinit_completion(&ar->vdev_setup_done);
  	reinit_completion(&ar->vdev_delete_done);
-@@ -1506,7 +1541,8 @@ static int ath10k_vdev_start_restart(str
+@@ -1499,7 +1534,8 @@ static int ath10k_vdev_start_restart(str
  	arg.channel.min_power = 0;
  	arg.channel.max_power = chandef->chan->max_power * 2;
  	arg.channel.max_reg_power = chandef->chan->max_reg_power * 2;
@@ -89,7 +89,7 @@ Forwarded: no
  
  	if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
  		arg.ssid = arvif->u.ap.ssid;
-@@ -3437,7 +3473,8 @@ static int ath10k_update_channel_list(st
+@@ -3427,7 +3463,8 @@ static int ath10k_update_channel_list(st
  			ch->min_power = 0;
  			ch->max_power = channel->max_power * 2;
  			ch->max_reg_power = channel->max_reg_power * 2;

package/kernel/mac80211/patches/ath10k/984-ath10k-Try-to-get-mac-address-from-dts.patch

@@ -26,9 +26,9 @@ Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
  #include <linux/property.h>
  #include <linux/dmi.h>
  #include <linux/ctype.h>
-@@ -3391,6 +3392,8 @@ static int ath10k_core_probe_fw(struct a
+@@ -3334,6 +3335,8 @@ static int ath10k_core_probe_fw(struct a
  
- 	device_get_mac_address(ar->dev, ar->mac_addr);
+ 	device_get_mac_address(ar->dev, ar->mac_addr, sizeof(ar->mac_addr));
  
 +	of_get_mac_address(ar->dev->of_node, ar->mac_addr);
 +

package/kernel/mac80211/patches/ath10k/991-ath10k-5.19.patch

@@ -0,0 +1,14 @@
+--- a/drivers/net/wireless/ath/ath10k/core.c
++++ b/drivers/net/wireless/ath/ath10k/core.c
+@@ -3333,7 +3333,11 @@ static int ath10k_core_probe_fw(struct a
+ 		ath10k_debug_print_board_info(ar);
+ 	}
+ 
++#if LINUX_VERSION_CODE < KERNEL_VERSION(5,18,0)
+ 	device_get_mac_address(ar->dev, ar->mac_addr, sizeof(ar->mac_addr));
++#else
++	device_get_mac_address(ar->dev, ar->mac_addr);
++#endif
+ 
+ 	of_get_mac_address(ar->dev->of_node, ar->mac_addr);
+ 

package/kernel/mac80211/patches/ath11k/0001-ath11k-fix-4-addr-tx-failure-for-AP-and-STA-modes.patch

@@ -0,0 +1,151 @@
+From 34c67dc366419e06129dad0f32f521842bdff9bc Mon Sep 17 00:00:00 2001
+From: Sathishkumar Muruganandam <murugana@codeaurora.org>
+Date: Wed, 21 Jul 2021 00:31:46 +0300
+Subject: [PATCH] ath11k: fix 4-addr tx failure for AP and STA modes
+
+Ath11k FW requires peer parameter WMI_PEER_USE_4ADDR to be set for
+4-addr peers allowing 4-address frame transmission to those peers.
+
+Add ath11k driver callback for sta_set_4addr() to queue new workq
+set_4addr_wk only once based on new boolean, use_4addr_set.
+
+sta_set_4addr() will be called during 4-addr STA association cases
+applicable for both AP and STA modes.
+
+In ath11k_sta_set_4addr_wk(),
+
+AP mode:
+        WMI_PEER_USE_4ADDR will be set for the corresponding
+        associated 4-addr STA(s)
+
+STA mode:
+        WMI_PEER_USE_4ADDR will be set for the AP to which the
+        4-addr STA got associated.
+
+Tested-on: IPQ8074 WLAN.HK.2.1.0.1-01238-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210720213147.90042-1-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/core.h |  3 ++
+ drivers/net/wireless/ath/ath11k/mac.c  | 48 ++++++++++++++++++++++++--
+ 2 files changed, 49 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -368,6 +368,7 @@ struct ath11k_sta {
+ 	enum hal_pn_type pn_type;
+ 
+ 	struct work_struct update_wk;
++	struct work_struct set_4addr_wk;
+ 	struct rate_info txrate;
+ 	struct rate_info last_txrate;
+ 	u64 rx_duration;
+@@ -380,6 +381,8 @@ struct ath11k_sta {
+ 	/* protected by conf_mutex */
+ 	bool aggr_mode;
+ #endif
++
++	bool use_4addr_set;
+ };
+ 
+ #define ATH11K_MIN_5G_FREQ 4150
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -3161,6 +3161,31 @@ static void ath11k_sta_rc_update_wk(stru
+ 	mutex_unlock(&ar->conf_mutex);
+ }
+ 
++static void ath11k_sta_set_4addr_wk(struct work_struct *wk)
++{
++	struct ath11k *ar;
++	struct ath11k_vif *arvif;
++	struct ath11k_sta *arsta;
++	struct ieee80211_sta *sta;
++	int ret = 0;
++
++	arsta = container_of(wk, struct ath11k_sta, set_4addr_wk);
++	sta = container_of((void *)arsta, struct ieee80211_sta, drv_priv);
++	arvif = arsta->arvif;
++	ar = arvif->ar;
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
++		   "setting USE_4ADDR for peer %pM\n", sta->addr);
++
++	ret = ath11k_wmi_set_peer_param(ar, sta->addr,
++					arvif->vdev_id,
++					WMI_PEER_USE_4ADDR, 1);
++
++	if (ret)
++		ath11k_warn(ar->ab, "failed to set peer %pM 4addr capability: %d\n",
++			    sta->addr, ret);
++}
++
+ static int ath11k_mac_inc_num_stations(struct ath11k_vif *arvif,
+ 				       struct ieee80211_sta *sta)
+ {
+@@ -3240,11 +3265,13 @@ static int ath11k_mac_station_add(struct
+ 	}
+ 
+ 	if (ieee80211_vif_is_mesh(vif)) {
++		ath11k_dbg(ab, ATH11K_DBG_MAC,
++			   "setting USE_4ADDR for mesh STA %pM\n", sta->addr);
+ 		ret = ath11k_wmi_set_peer_param(ar, sta->addr,
+ 						arvif->vdev_id,
+ 						WMI_PEER_USE_4ADDR, 1);
+ 		if (ret) {
+-			ath11k_warn(ab, "failed to STA %pM 4addr capability: %d\n",
++			ath11k_warn(ab, "failed to set mesh STA %pM 4addr capability: %d\n",
+ 				    sta->addr, ret);
+ 			goto free_tx_stats;
+ 		}
+@@ -3297,8 +3324,10 @@ static int ath11k_mac_op_sta_state(struc
+ 
+ 	/* cancel must be done outside the mutex to avoid deadlock */
+ 	if ((old_state == IEEE80211_STA_NONE &&
+-	     new_state == IEEE80211_STA_NOTEXIST))
++	     new_state == IEEE80211_STA_NOTEXIST)) {
+ 		cancel_work_sync(&arsta->update_wk);
++		cancel_work_sync(&arsta->set_4addr_wk);
++	}
+ 
+ 	mutex_lock(&ar->conf_mutex);
+ 
+@@ -3307,6 +3336,7 @@ static int ath11k_mac_op_sta_state(struc
+ 		memset(arsta, 0, sizeof(*arsta));
+ 		arsta->arvif = arvif;
+ 		INIT_WORK(&arsta->update_wk, ath11k_sta_rc_update_wk);
++		INIT_WORK(&arsta->set_4addr_wk, ath11k_sta_set_4addr_wk);
+ 
+ 		ret = ath11k_mac_station_add(ar, vif, sta);
+ 		if (ret)
+@@ -3401,6 +3431,19 @@ out:
+ 	return ret;
+ }
+ 
++static void ath11k_mac_op_sta_set_4addr(struct ieee80211_hw *hw,
++					struct ieee80211_vif *vif,
++					struct ieee80211_sta *sta, bool enabled)
++{
++	struct ath11k *ar = hw->priv;
++	struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv;
++
++	if (enabled && !arsta->use_4addr_set) {
++		ieee80211_queue_work(ar->hw, &arsta->set_4addr_wk);
++		arsta->use_4addr_set = true;
++	}
++}
++
+ static void ath11k_mac_op_sta_rc_update(struct ieee80211_hw *hw,
+ 					struct ieee80211_vif *vif,
+ 					struct ieee80211_sta *sta,
+@@ -6190,6 +6233,7 @@ static const struct ieee80211_ops ath11k
+ 	.cancel_hw_scan                 = ath11k_mac_op_cancel_hw_scan,
+ 	.set_key                        = ath11k_mac_op_set_key,
+ 	.sta_state                      = ath11k_mac_op_sta_state,
++	.sta_set_4addr                  = ath11k_mac_op_sta_set_4addr,
+ 	.sta_set_txpwr			= ath11k_mac_op_sta_set_txpwr,
+ 	.sta_rc_update			= ath11k_mac_op_sta_rc_update,
+ 	.conf_tx                        = ath11k_mac_op_conf_tx,

package/kernel/mac80211/patches/ath11k/0001-wifi-ath11k-stop-tx-queues-immediately-upon-firmware.patch

@@ -1,78 +0,0 @@
-From 81e60b2dfb2744ab6642c4aa62534b4f711fdc5d Mon Sep 17 00:00:00 2001
-From: Aditya Kumar Singh <quic_adisi@quicinc.com>
-Date: Tue, 27 Sep 2022 09:18:54 +0300
-Subject: [PATCH] wifi: ath11k: stop tx queues immediately upon firmware exit
-
-Currently, recovery flag is set immediately upon firmware
-exit but tx queues are stopped once firmware arrives back
-and is ready which is during ath11k_core_restart. Once
-ieee80211 hw restart is completed, tx queues are resumed.
-If during the time delta between firmware exit and firmware
-ready, mac80211 send packets, currently ath11k will drop it
-since recovery flag will be set. But warning prints will
-come -
-  "ath11k c000000.wifi: failed to transmit frame -108"
-
-If more tx packets are there, this could lead to flooding
-of above print.
-
-However, actually tx queues should be stopped immediately
-when firmware leaves. This will prevent packets to get
-dropped when firmware is recovering.
-
-Add fix to stop tx queues immediately after firmware exit.
-
-Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
-
-Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
-Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
-Link: https://lore.kernel.org/r/20220923170235.18873-1-quic_adisi@quicinc.com
----
- drivers/net/wireless/ath/ath11k/core.c | 5 +----
- drivers/net/wireless/ath/ath11k/core.h | 1 +
- drivers/net/wireless/ath/ath11k/qmi.c  | 3 +++
- 3 files changed, 5 insertions(+), 4 deletions(-)
-
---- a/drivers/net/wireless/ath/ath11k/core.c
-+++ b/drivers/net/wireless/ath/ath11k/core.c
-@@ -1641,7 +1641,7 @@ static void ath11k_update_11d(struct wor
- 	}
- }
- 
--static void ath11k_core_pre_reconfigure_recovery(struct ath11k_base *ab)
-+void ath11k_core_pre_reconfigure_recovery(struct ath11k_base *ab)
- {
- 	struct ath11k *ar;
- 	struct ath11k_pdev *pdev;
-@@ -1730,9 +1730,6 @@ static void ath11k_core_restart(struct w
- 	struct ath11k_base *ab = container_of(work, struct ath11k_base, restart_work);
- 	int ret;
- 
--	if (!ab->is_reset)
--		ath11k_core_pre_reconfigure_recovery(ab);
--
- 	ret = ath11k_core_reconfigure_on_crash(ab);
- 	if (ret) {
- 		ath11k_err(ab, "failed to reconfigure driver on crash recovery\n");
---- a/drivers/net/wireless/ath/ath11k/core.h
-+++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -1157,6 +1157,7 @@ int ath11k_core_check_smbios(struct ath1
- void ath11k_core_halt(struct ath11k *ar);
- int ath11k_core_resume(struct ath11k_base *ab);
- int ath11k_core_suspend(struct ath11k_base *ab);
-+void ath11k_core_pre_reconfigure_recovery(struct ath11k_base *ab);
- 
- const struct firmware *ath11k_core_firmware_request(struct ath11k_base *ab,
- 						    const char *filename);
---- a/drivers/net/wireless/ath/ath11k/qmi.c
-+++ b/drivers/net/wireless/ath/ath11k/qmi.c
-@@ -3158,6 +3158,9 @@ static void ath11k_qmi_driver_event_work
- 		case ATH11K_QMI_EVENT_SERVER_EXIT:
- 			set_bit(ATH11K_FLAG_CRASH_FLUSH, &ab->dev_flags);
- 			set_bit(ATH11K_FLAG_RECOVERY, &ab->dev_flags);
-+
-+			if (!ab->is_reset)
-+				ath11k_core_pre_reconfigure_recovery(ab);
- 			break;
- 		case ATH11K_QMI_EVENT_REQUEST_MEM:
- 			ret = ath11k_qmi_event_mem_request(qmi);

package/kernel/mac80211/patches/ath11k/0002-ath11k-fix-4addr-multicast-packet-tx.patch

@@ -0,0 +1,123 @@
+From e20cfa3b62aeb1b5fc5ffa86a007af97f9954767 Mon Sep 17 00:00:00 2001
+From: Karthikeyan Periyasamy <periyasa@codeaurora.org>
+Date: Wed, 21 Jul 2021 00:31:47 +0300
+Subject: [PATCH] ath11k: fix 4addr multicast packet tx
+
+In 4addr, AP wired backbone to STA wired backbone ping fails due to ARP
+request not getting answered. Here 4addr ARP multicast packet is sent in
+3addr, so that 4addr STA not honouring the 3addr ARP multicast packet.
+Fix this issue by sending out multicast packet in 4addr format, firmware
+expects peer meta flag instead of vdev meta flag in Tx descriptor.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01641-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Karthikeyan Periyasamy <periyasa@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210720213147.90042-2-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/core.h  |  1 +
+ drivers/net/wireless/ath/ath11k/dp_tx.c | 12 ++++++++++--
+ drivers/net/wireless/ath/ath11k/dp_tx.h |  2 +-
+ drivers/net/wireless/ath/ath11k/mac.c   |  6 +++++-
+ drivers/net/wireless/ath/ath11k/peer.c  | 11 +++++++++++
+ 5 files changed, 28 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -383,6 +383,7 @@ struct ath11k_sta {
+ #endif
+ 
+ 	bool use_4addr_set;
++	u16 tcl_metadata;
+ };
+ 
+ #define ATH11K_MIN_5G_FREQ 4150
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -78,7 +78,7 @@ enum hal_encrypt_type ath11k_dp_tx_get_e
+ }
+ 
+ int ath11k_dp_tx(struct ath11k *ar, struct ath11k_vif *arvif,
+-		 struct sk_buff *skb)
++		 struct ath11k_sta *arsta, struct sk_buff *skb)
+ {
+ 	struct ath11k_base *ab = ar->ab;
+ 	struct ath11k_dp *dp = &ab->dp;
+@@ -145,7 +145,15 @@ tcl_ring_sel:
+ 		     FIELD_PREP(DP_TX_DESC_ID_MSDU_ID, ret) |
+ 		     FIELD_PREP(DP_TX_DESC_ID_POOL_ID, pool_id);
+ 	ti.encap_type = ath11k_dp_tx_get_encap_type(arvif, skb);
+-	ti.meta_data_flags = arvif->tcl_metadata;
++
++	if (ieee80211_has_a4(hdr->frame_control) &&
++	    is_multicast_ether_addr(hdr->addr3) && arsta &&
++	    arsta->use_4addr_set) {
++		ti.meta_data_flags = arsta->tcl_metadata;
++		ti.flags0 |= FIELD_PREP(HAL_TCL_DATA_CMD_INFO1_TO_FW, 1);
++	} else {
++		ti.meta_data_flags = arvif->tcl_metadata;
++	}
+ 
+ 	if (ti.encap_type == HAL_TCL_ENCAP_TYPE_RAW) {
+ 		if (skb_cb->flags & ATH11K_SKB_CIPHER_SET) {
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.h
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.h
+@@ -17,7 +17,7 @@ struct ath11k_dp_htt_wbm_tx_status {
+ 
+ int ath11k_dp_tx_htt_h2t_ver_req_msg(struct ath11k_base *ab);
+ int ath11k_dp_tx(struct ath11k *ar, struct ath11k_vif *arvif,
+-		 struct sk_buff *skb);
++		 struct ath11k_sta *arsta, struct sk_buff *skb);
+ void ath11k_dp_tx_completion_handler(struct ath11k_base *ab, int ring_id);
+ int ath11k_dp_tx_send_reo_cmd(struct ath11k_base *ab, struct dp_rx_tid *rx_tid,
+ 			      enum hal_reo_cmd_type type,
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -4366,6 +4366,7 @@ static void ath11k_mac_op_tx(struct ieee
+ 	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+ 	struct ieee80211_key_conf *key = info->control.hw_key;
++	struct ath11k_sta *arsta = NULL;
+ 	u32 info_flags = info->flags;
+ 	bool is_prb_rsp;
+ 	int ret;
+@@ -4391,7 +4392,10 @@ static void ath11k_mac_op_tx(struct ieee
+ 		return;
+ 	}
+ 
+-	ret = ath11k_dp_tx(ar, arvif, skb);
++	if (control->sta)
++		arsta = (struct ath11k_sta *)control->sta->drv_priv;
++
++	ret = ath11k_dp_tx(ar, arvif, arsta, skb);
+ 	if (ret) {
+ 		ath11k_warn(ar->ab, "failed to transmit frame %d\n", ret);
+ 		ieee80211_free_txskb(ar->hw, skb);
+--- a/drivers/net/wireless/ath/ath11k/peer.c
++++ b/drivers/net/wireless/ath/ath11k/peer.c
+@@ -251,6 +251,7 @@ int ath11k_peer_create(struct ath11k *ar
+ 		       struct ieee80211_sta *sta, struct peer_create_params *param)
+ {
+ 	struct ath11k_peer *peer;
++	struct ath11k_sta *arsta;
+ 	int ret;
+ 
+ 	lockdep_assert_held(&ar->conf_mutex);
+@@ -319,6 +320,16 @@ int ath11k_peer_create(struct ath11k *ar
+ 	peer->sec_type = HAL_ENCRYPT_TYPE_OPEN;
+ 	peer->sec_type_grp = HAL_ENCRYPT_TYPE_OPEN;
+ 
++	if (sta) {
++		arsta = (struct ath11k_sta *)sta->drv_priv;
++		arsta->tcl_metadata |= FIELD_PREP(HTT_TCL_META_DATA_TYPE, 0) |
++				       FIELD_PREP(HTT_TCL_META_DATA_PEER_ID,
++						  peer->peer_id);
++
++		/* set HTT extension valid bit to 0 by default */
++		arsta->tcl_metadata &= ~HTT_TCL_META_DATA_VALID_HTT;
++	}
++
+ 	ar->num_peers++;
+ 
+ 	spin_unlock_bh(&ar->ab->base_lock);

package/kernel/mac80211/patches/ath11k/0002-wifi-ath11k-Don-t-exit-on-wakeup-failure.patch

@@ -1,45 +0,0 @@
-From 45d2e268369b0c768d5a644f319758bcfd370521 Mon Sep 17 00:00:00 2001
-From: Baochen Qiang <quic_bqiang@quicinc.com>
-Date: Wed, 28 Sep 2022 09:51:40 +0800
-Subject: [PATCH] wifi: ath11k: Don't exit on wakeup failure
-
-Currently, ath11k_pcic_read() returns an error if wakeup()
-fails, this makes firmware crash debug quite hard because we can
-get nothing.
-
-Change to go ahead on wakeup failure, in that case we still may
-get something valid to check. There should be no mislead due
-to incorrect content because we are aware of the failure with the
-log printed.
-
-Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
-
-Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
-Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
-Link: https://lore.kernel.org/r/20220928015140.5431-1-quic_bqiang@quicinc.com
----
- drivers/net/wireless/ath/ath11k/pcic.c | 13 ++++++++++---
- 1 file changed, 10 insertions(+), 3 deletions(-)
-
---- a/drivers/net/wireless/ath/ath11k/pcic.c
-+++ b/drivers/net/wireless/ath/ath11k/pcic.c
-@@ -218,9 +218,16 @@ int ath11k_pcic_read(struct ath11k_base
- 	if (wakeup_required && ab->pci.ops->wakeup) {
- 		ret = ab->pci.ops->wakeup(ab);
- 		if (ret) {
--			ath11k_warn(ab, "failed to wakeup for read from 0x%x: %d\n",
--				    start, ret);
--			return ret;
-+			ath11k_warn(ab,
-+				    "wakeup failed, data may be invalid: %d",
-+				    ret);
-+			/* Even though wakeup() failed, continue processing rather
-+			 * than returning because some parts of the data may still
-+			 * be valid and useful in some cases, e.g. could give us
-+			 * some clues on firmware crash.
-+			 * Mislead due to invalid data could be avoided because we
-+			 * are aware of the wakeup failure.
-+			 */
- 		}
- 	}
- 

package/kernel/mac80211/patches/ath11k/0003-ath11k-Rename-atf_config-to-flag1-in-target_resource.patch

@@ -0,0 +1,41 @@
+From 7e9fb2418a4c092a363d23e97973c9624150e5b2 Mon Sep 17 00:00:00 2001
+From: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+Date: Wed, 21 Jul 2021 00:49:20 +0300
+Subject: [PATCH] ath11k: Rename atf_config to flag1 in target_resource_config
+
+The flag's purpose is not only meant for ATF configs. Rename atf_config
+to flag1, so it can be used for future purposes.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.1.0.1-01228-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210720214922.118078-1-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/wmi.c | 2 +-
+ drivers/net/wireless/ath/ath11k/wmi.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -3497,7 +3497,7 @@ ath11k_wmi_copy_resource_config(struct w
+ 	wmi_cfg->bpf_instruction_size = tg_cfg->bpf_instruction_size;
+ 	wmi_cfg->max_bssid_rx_filters = tg_cfg->max_bssid_rx_filters;
+ 	wmi_cfg->use_pdev_id = tg_cfg->use_pdev_id;
+-	wmi_cfg->flag1 = tg_cfg->atf_config;
++	wmi_cfg->flag1 = tg_cfg->flag1;
+ 	wmi_cfg->peer_map_unmap_v2_support = tg_cfg->peer_map_unmap_v2_support;
+ 	wmi_cfg->sched_params = tg_cfg->sched_params;
+ 	wmi_cfg->twt_ap_pdev_count = tg_cfg->twt_ap_pdev_count;
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -5015,7 +5015,7 @@ struct target_resource_config {
+ 	u32 vo_minfree;
+ 	u32 rx_batchmode;
+ 	u32 tt_support;
+-	u32 atf_config;
++	u32 flag1;
+ 	u32 iphdr_pad_config;
+ 	u32 qwrap_config:16,
+ 	    alloc_frag_desc_for_data_pkt:16;

package/kernel/mac80211/patches/ath11k/0003-wifi-ath11k-fix-warning-in-dma_free_coherent-of-memo.patch

@@ -1,139 +0,0 @@
-From f74878433d5ade360447da5d92e9c2e535780d80 Mon Sep 17 00:00:00 2001
-From: Wen Gong <quic_wgong@quicinc.com>
-Date: Wed, 28 Sep 2022 03:38:32 -0400
-Subject: [PATCH] wifi: ath11k: fix warning in dma_free_coherent() of memory
- chunks while recovery
-
-Commit 26f3a021b37c ("ath11k: allocate smaller chunks of memory for
-firmware") and commit f6f92968e1e5 ("ath11k: qmi: try to allocate a
-big block of DMA memory first") change ath11k to allocate the memory
-chunks for target twice while wlan load. It fails for the 1st time
-because of large memory and then changed to allocate many small chunks
-for the 2nd time sometimes as below log.
-
-1st time failed:
-[10411.640620] ath11k_pci 0000:05:00.0: qmi firmware request memory request
-[10411.640625] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 6881280
-[10411.640630] ath11k_pci 0000:05:00.0: qmi mem seg type 4 size 3784704
-[10411.640658] ath11k_pci 0000:05:00.0: qmi dma allocation failed (6881280 B type 1), will try later with small size
-[10411.640671] ath11k_pci 0000:05:00.0: qmi delays mem_request 2
-[10411.640677] ath11k_pci 0000:05:00.0: qmi respond memory request delayed 1
-2nd time success:
-[10411.642004] ath11k_pci 0000:05:00.0: qmi firmware request memory request
-[10411.642008] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 524288
-[10411.642012] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 524288
-[10411.642014] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 524288
-[10411.642016] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 524288
-[10411.642018] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 524288
-[10411.642020] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 524288
-[10411.642022] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 524288
-[10411.642024] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 524288
-[10411.642027] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 524288
-[10411.642029] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 524288
-[10411.642031] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 458752
-[10411.642033] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 131072
-[10411.642035] ath11k_pci 0000:05:00.0: qmi mem seg type 4 size 524288
-[10411.642037] ath11k_pci 0000:05:00.0: qmi mem seg type 4 size 524288
-[10411.642039] ath11k_pci 0000:05:00.0: qmi mem seg type 4 size 524288
-[10411.642041] ath11k_pci 0000:05:00.0: qmi mem seg type 4 size 524288
-[10411.642043] ath11k_pci 0000:05:00.0: qmi mem seg type 4 size 524288
-[10411.642045] ath11k_pci 0000:05:00.0: qmi mem seg type 4 size 524288
-[10411.642047] ath11k_pci 0000:05:00.0: qmi mem seg type 4 size 491520
-[10411.642049] ath11k_pci 0000:05:00.0: qmi mem seg type 1 size 524288
-
-And then commit 5962f370ce41 ("ath11k: Reuse the available memory after
-firmware reload") skip the ath11k_qmi_free_resource() which frees the
-memory chunks while recovery, after that, when run recovery test on
-WCN6855, a warning happened every time as below and finally leads fail
-for recovery.
-
-[  159.570318] BUG: Bad page state in process kworker/u16:5  pfn:33300
-[  159.570320] page:0000000096ffdbb9 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33300
-[  159.570324] flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff)
-[  159.570329] raw: 000fffffc0000000 0000000000000000 dead000000000122 0000000000000000
-[  159.570332] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
-[  159.570334] page dumped because: nonzero _refcount
-[  159.570440]  firewire_ohci syscopyarea sysfillrect psmouse sdhci_pci ahci sysimgblt firewire_core fb_sys_fops libahci crc_itu_t cqhci drm sdhci e1000e wmi video
-[  159.570460] CPU: 2 PID: 217 Comm: kworker/u16:5 Kdump: loaded Tainted: G    B             5.19.0-rc1-wt-ath+ #3
-[  159.570465] Hardware name: LENOVO 418065C/418065C, BIOS 83ET63WW (1.33 ) 07/29/2011
-[  159.570467] Workqueue: qmi_msg_handler qmi_data_ready_work [qmi_helpers]
-[  159.570475] Call Trace:
-[  159.570476]  <TASK>
-[  159.570478]  dump_stack_lvl+0x49/0x5f
-[  159.570486]  dump_stack+0x10/0x12
-[  159.570493]  bad_page+0xab/0xf0
-[  159.570502]  check_free_page_bad+0x66/0x70
-[  159.570511]  __free_pages_ok+0x530/0x9a0
-[  159.570517]  ? __dev_printk+0x58/0x6b
-[  159.570525]  ? _dev_printk+0x56/0x72
-[  159.570534]  ? qmi_decode+0x119/0x470 [qmi_helpers]
-[  159.570543]  __free_pages+0x91/0xd0
-[  159.570548]  dma_free_contiguous+0x50/0x60
-[  159.570556]  dma_direct_free+0xe5/0x140
-[  159.570564]  dma_free_attrs+0x35/0x50
-[  159.570570]  ath11k_qmi_msg_mem_request_cb+0x2ae/0x3c0 [ath11k]
-[  159.570620]  qmi_invoke_handler+0xac/0xe0 [qmi_helpers]
-[  159.570630]  qmi_handle_message+0x6d/0x180 [qmi_helpers]
-[  159.570643]  qmi_data_ready_work+0x2ca/0x440 [qmi_helpers]
-[  159.570656]  process_one_work+0x227/0x440
-[  159.570667]  worker_thread+0x31/0x3d0
-[  159.570676]  ? process_one_work+0x440/0x440
-[  159.570685]  kthread+0xfe/0x130
-[  159.570692]  ? kthread_complete_and_exit+0x20/0x20
-[  159.570701]  ret_from_fork+0x22/0x30
-[  159.570712]  </TASK>
-
-The reason is because when wlan start to recovery, the type, size and
-count is not same for the 1st and 2nd QMI_WLFW_REQUEST_MEM_IND message,
-Then it leads the parameter size is not correct for the dma_free_coherent().
-For the chunk[1], the actual dma size is 524288 which allocate in the
-2nd time of the initial wlan load phase, and the size which pass to
-dma_free_coherent() is 3784704 which is got in the 1st time of recovery
-phase, then warning above happened.
-
-Change to use prev_size of struct target_mem_chunk for the paramter of
-dma_free_coherent() since prev_size is the real size of last load/recovery.
-Also change to check both type and size of struct target_mem_chunk to
-reuse the memory to avoid mismatch buffer size for target. Then the
-warning disappear and recovery success. When the 1st QMI_WLFW_REQUEST_MEM_IND
-for recovery arrived, the trunk[0] is freed in ath11k_qmi_alloc_target_mem_chunk()
-and then dma_alloc_coherent() failed caused by large size, and then
-trunk[1] is freed in ath11k_qmi_free_target_mem_chunk(), the left 18
-trunks will be reuse for the 2nd QMI_WLFW_REQUEST_MEM_IND message.
-
-Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3
-
-Fixes: 5962f370ce41 ("ath11k: Reuse the available memory after firmware reload")
-Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
-Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
-Link: https://lore.kernel.org/r/20220928073832.16251-1-quic_wgong@quicinc.com
----
- drivers/net/wireless/ath/ath11k/qmi.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
---- a/drivers/net/wireless/ath/ath11k/qmi.c
-+++ b/drivers/net/wireless/ath/ath11k/qmi.c
-@@ -1961,7 +1961,7 @@ static void ath11k_qmi_free_target_mem_c
- 			continue;
- 
- 		dma_free_coherent(ab->dev,
--				  ab->qmi.target_mem[i].size,
-+				  ab->qmi.target_mem[i].prev_size,
- 				  ab->qmi.target_mem[i].vaddr,
- 				  ab->qmi.target_mem[i].paddr);
- 		ab->qmi.target_mem[i].vaddr = NULL;
-@@ -1982,12 +1982,12 @@ static int ath11k_qmi_alloc_target_mem_c
- 		 * in such case, no need to allocate memory for FW again.
- 		 */
- 		if (chunk->vaddr) {
--			if (chunk->prev_type == chunk->type ||
-+			if (chunk->prev_type == chunk->type &&
- 			    chunk->prev_size == chunk->size)
- 				continue;
- 
- 			/* cannot reuse the existing chunk */
--			dma_free_coherent(ab->dev, chunk->size,
-+			dma_free_coherent(ab->dev, chunk->prev_size,
- 					  chunk->vaddr, chunk->paddr);
- 			chunk->vaddr = NULL;
- 		}

package/kernel/mac80211/patches/ath11k/0004-ath11k-add-support-in-survey-dump-with-bss_chan_info.patch

@@ -0,0 +1,51 @@
+From 9b4dd38b46cf24d8cb3ab433661cdc23a35160d0 Mon Sep 17 00:00:00 2001
+From: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+Date: Wed, 21 Jul 2021 00:49:21 +0300
+Subject: [PATCH] ath11k: add support in survey dump with bss_chan_info
+
+Survey dump statistics is not displaying channel rx and tx time because
+the service flag is not enabled. Enable the service flag "bss_chan_info"
+in wmi_resource_config to fetch and print the stats for the specific
+pdev.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.1.0.1-01228-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Ritesh Singh <ritesi@codeaurora.org>
+Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210720214922.118078-2-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/hw.c  | 2 ++
+ drivers/net/wireless/ath/ath11k/wmi.h | 2 ++
+ 2 files changed, 4 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -97,6 +97,7 @@ static void ath11k_init_wmi_config_qca63
+ 	config->num_multicast_filter_entries = 0x20;
+ 	config->num_wow_filters = 0x16;
+ 	config->num_keep_alive_pattern = 0;
++	config->flag1 |= WMI_RSRC_CFG_FLAG1_BSS_CHANNEL_INFO_64;
+ }
+ 
+ static void ath11k_hw_ipq8074_reo_setup(struct ath11k_base *ab)
+@@ -197,6 +198,7 @@ static void ath11k_init_wmi_config_ipq80
+ 	config->peer_map_unmap_v2_support = 1;
+ 	config->twt_ap_pdev_count = ab->num_radios;
+ 	config->twt_ap_sta_count = 1000;
++	config->flag1 |= WMI_RSRC_CFG_FLAG1_BSS_CHANNEL_INFO_64;
+ }
+ 
+ static int ath11k_hw_mac_id_to_pdev_id_ipq8074(struct ath11k_hw_params *hw,
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -2244,6 +2244,8 @@ struct wmi_init_cmd {
+ 	u32 num_host_mem_chunks;
+ } __packed;
+ 
++#define WMI_RSRC_CFG_FLAG1_BSS_CHANNEL_INFO_64 BIT(5)
++
+ struct wmi_resource_config {
+ 	u32 tlv_header;
+ 	u32 num_vdevs;

package/kernel/mac80211/patches/ath11k/0005-wifi-ath11k-Fix-spelling-mistake-chnange-change.patch

@@ -1,25 +0,0 @@
-From a797f479bf3e02c6d179c2e6aeace7f9b22b0acd Mon Sep 17 00:00:00 2001
-From: Colin Ian King <colin.i.king@gmail.com>
-Date: Wed, 28 Sep 2022 15:38:34 +0100
-Subject: [PATCH] wifi: ath11k: Fix spelling mistake "chnange" -> "change"
-
-There is a spelling mistake in an ath11k_dbg debug message. Fix it.
-
-Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
-Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
-Link: https://lore.kernel.org/r/20220928143834.35189-1-colin.i.king@gmail.com
----
- drivers/net/wireless/ath/ath11k/wmi.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/net/wireless/ath/ath11k/wmi.c
-+++ b/drivers/net/wireless/ath/ath11k/wmi.c
-@@ -6829,7 +6829,7 @@ static void ath11k_wmi_event_peer_sta_ps
- 	}
- 
- 	ath11k_dbg(ab, ATH11K_DBG_WMI,
--		   "peer sta ps chnange ev addr %pM state %u sup_bitmap %x ps_valid %u ts %u\n",
-+		   "peer sta ps change ev addr %pM state %u sup_bitmap %x ps_valid %u ts %u\n",
- 		   ev->peer_macaddr.addr, ev->peer_ps_state,
- 		   ev->ps_supported_bitmap, ev->peer_ps_valid,
- 		   ev->peer_ps_timestamp);

package/kernel/mac80211/patches/ath11k/0006-ath11k-move-static-function-ath11k_mac_vdev_setup_sy.patch

@@ -0,0 +1,65 @@
+From d37b4862312c980d1f6843d11a14ad4eda242c8d Mon Sep 17 00:00:00 2001
+From: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+Date: Tue, 21 Sep 2021 16:39:29 +0300
+Subject: [PATCH] ath11k: move static function ath11k_mac_vdev_setup_sync to
+ top
+
+This is to prepare for monitor mode clean up.
+No functional changes are done.
+
+Co-developed-by: Miles Hu <milehu@codeaurora.org>
+Signed-off-by: Miles Hu <milehu@codeaurora.org>
+Co-developed-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
+Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
+Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210721162053.46290-2-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 28 +++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -732,6 +732,20 @@ static int ath11k_monitor_vdev_up(struct
+ 	return 0;
+ }
+ 
++static inline int ath11k_mac_vdev_setup_sync(struct ath11k *ar)
++{
++	lockdep_assert_held(&ar->conf_mutex);
++
++	if (test_bit(ATH11K_FLAG_CRASH_FLUSH, &ar->ab->dev_flags))
++		return -ESHUTDOWN;
++
++	if (!wait_for_completion_timeout(&ar->vdev_setup_done,
++					 ATH11K_VDEV_SETUP_TIMEOUT_HZ))
++		return -ETIMEDOUT;
++
++	return ar->last_wmi_vdev_start_status ? -EINVAL : 0;
++}
++
+ static int ath11k_mac_op_config(struct ieee80211_hw *hw, u32 changed)
+ {
+ 	/* mac80211 requires this op to be present and that's why
+@@ -5175,20 +5189,6 @@ static void ath11k_mac_op_remove_chanctx
+ 	mutex_unlock(&ar->conf_mutex);
+ }
+ 
+-static inline int ath11k_mac_vdev_setup_sync(struct ath11k *ar)
+-{
+-	lockdep_assert_held(&ar->conf_mutex);
+-
+-	if (test_bit(ATH11K_FLAG_CRASH_FLUSH, &ar->ab->dev_flags))
+-		return -ESHUTDOWN;
+-
+-	if (!wait_for_completion_timeout(&ar->vdev_setup_done,
+-					 ATH11K_VDEV_SETUP_TIMEOUT_HZ))
+-		return -ETIMEDOUT;
+-
+-	return ar->last_wmi_vdev_start_status ? -EINVAL : 0;
+-}
+-
+ static int
+ ath11k_mac_vdev_start_restart(struct ath11k_vif *arvif,
+ 			      const struct cfg80211_chan_def *chandef,

package/kernel/mac80211/patches/ath11k/0006-wifi-ath11k-fix-firmware-assert-during-bandwidth-cha.patch

@@ -1,225 +0,0 @@
-From 3ff51d7416ee1ea2d771051a0ffa1ec8be054768 Mon Sep 17 00:00:00 2001
-From: Aditya Kumar Singh <quic_adisi@quicinc.com>
-Date: Wed, 5 Oct 2022 15:24:30 +0530
-Subject: [PATCH 6/9] wifi: ath11k: fix firmware assert during bandwidth change
- for peer sta
-
-Currently, ath11k sends peer assoc command for each peer to
-firmware when bandwidth changes. Peer assoc command is a
-bulky command and if many clients are connected, this could
-lead to firmware buffer getting overflowed leading to a firmware
-assert.
-
-However, during bandwidth change, only phymode and bandwidth
-also can be updated by WMI set peer param command. This makes
-the overall command light when compared to peer assoc and for
-multi-client cases, firmware buffer overflow also does not
-occur.
-
-Remove sending peer assoc command during sta bandwidth change
-and instead add sending WMI set peer param command for phymode
-and bandwidth.
-
-Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
-
-Fixes: f187fe8e3bc65 ("ath11k: fix firmware crash during channel switch")
-Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
-Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
-Link: https://lore.kernel.org/r/20221005095430.19890-1-quic_adisi@quicinc.com
----
- drivers/net/wireless/ath/ath11k/core.h |   2 +
- drivers/net/wireless/ath/ath11k/mac.c  | 122 +++++++++++++++++--------
- 2 files changed, 87 insertions(+), 37 deletions(-)
-
---- a/drivers/net/wireless/ath/ath11k/core.h
-+++ b/drivers/net/wireless/ath/ath11k/core.h
-@@ -505,6 +505,8 @@ struct ath11k_sta {
- 	u64 ps_start_jiffies;
- 	u64 ps_total_duration;
- 	bool peer_current_ps_valid;
-+
-+	u32 bw_prev;
- };
- 
- #define ATH11K_MIN_5G_FREQ 4150
---- a/drivers/net/wireless/ath/ath11k/mac.c
-+++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -4215,10 +4215,11 @@ static void ath11k_sta_rc_update_wk(stru
- 	const u8 *ht_mcs_mask;
- 	const u16 *vht_mcs_mask;
- 	const u16 *he_mcs_mask;
--	u32 changed, bw, nss, smps;
-+	u32 changed, bw, nss, smps, bw_prev;
- 	int err, num_vht_rates, num_he_rates;
- 	const struct cfg80211_bitrate_mask *mask;
- 	struct peer_assoc_params peer_arg;
-+	enum wmi_phy_mode peer_phymode;
- 
- 	arsta = container_of(wk, struct ath11k_sta, update_wk);
- 	sta = container_of((void *)arsta, struct ieee80211_sta, drv_priv);
-@@ -4239,6 +4240,7 @@ static void ath11k_sta_rc_update_wk(stru
- 	arsta->changed = 0;
- 
- 	bw = arsta->bw;
-+	bw_prev = arsta->bw_prev;
- 	nss = arsta->nss;
- 	smps = arsta->smps;
- 
-@@ -4252,26 +4254,57 @@ static void ath11k_sta_rc_update_wk(stru
- 			   ath11k_mac_max_he_nss(he_mcs_mask)));
- 
- 	if (changed & IEEE80211_RC_BW_CHANGED) {
--		/* Send peer assoc command before set peer bandwidth param to
--		 * avoid the mismatch between the peer phymode and the peer
--		 * bandwidth.
--		 */
--		ath11k_peer_assoc_prepare(ar, arvif->vif, sta, &peer_arg, true);
-+		/* Get the peer phymode */
-+		ath11k_peer_assoc_h_phymode(ar, arvif->vif, sta, &peer_arg);
-+		peer_phymode = peer_arg.peer_phymode;
-+
-+		ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "mac update sta %pM peer bw %d phymode %d\n",
-+			   sta->addr, bw, peer_phymode);
-+
-+		if (bw > bw_prev) {
-+			/* BW is upgraded. In this case we send WMI_PEER_PHYMODE
-+			 * followed by WMI_PEER_CHWIDTH
-+			 */
-+			ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "mac BW upgrade for sta %pM new BW %d, old BW %d\n",
-+				   sta->addr, bw, bw_prev);
-+
-+			err = ath11k_wmi_set_peer_param(ar, sta->addr, arvif->vdev_id,
-+							WMI_PEER_PHYMODE, peer_phymode);
-+
-+			if (err) {
-+				ath11k_warn(ar->ab, "failed to update STA %pM peer phymode %d: %d\n",
-+					    sta->addr, peer_phymode, err);
-+				goto err_rc_bw_changed;
-+			}
- 
--		peer_arg.is_assoc = false;
--		err = ath11k_wmi_send_peer_assoc_cmd(ar, &peer_arg);
--		if (err) {
--			ath11k_warn(ar->ab, "failed to send peer assoc for STA %pM vdev %i: %d\n",
--				    sta->addr, arvif->vdev_id, err);
--		} else if (wait_for_completion_timeout(&ar->peer_assoc_done, 1 * HZ)) {
- 			err = ath11k_wmi_set_peer_param(ar, sta->addr, arvif->vdev_id,
- 							WMI_PEER_CHWIDTH, bw);
-+
- 			if (err)
- 				ath11k_warn(ar->ab, "failed to update STA %pM peer bw %d: %d\n",
- 					    sta->addr, bw, err);
- 		} else {
--			ath11k_warn(ar->ab, "failed to get peer assoc conf event for %pM vdev %i\n",
--				    sta->addr, arvif->vdev_id);
-+			/* BW is downgraded. In this case we send WMI_PEER_CHWIDTH
-+			 * followed by WMI_PEER_PHYMODE
-+			 */
-+			ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "mac BW downgrade for sta %pM new BW %d,old BW %d\n",
-+				   sta->addr, bw, bw_prev);
-+
-+			err = ath11k_wmi_set_peer_param(ar, sta->addr, arvif->vdev_id,
-+							WMI_PEER_CHWIDTH, bw);
-+
-+			if (err) {
-+				ath11k_warn(ar->ab, "failed to update STA %pM peer bw %d: %d\n",
-+					    sta->addr, bw, err);
-+				goto err_rc_bw_changed;
-+			}
-+
-+			err = ath11k_wmi_set_peer_param(ar, sta->addr, arvif->vdev_id,
-+							WMI_PEER_PHYMODE, peer_phymode);
-+
-+			if (err)
-+				ath11k_warn(ar->ab, "failed to update STA %pM peer phymode %d: %d\n",
-+					    sta->addr, peer_phymode, err);
- 		}
- 	}
- 
-@@ -4352,6 +4385,7 @@ static void ath11k_sta_rc_update_wk(stru
- 		}
- 	}
- 
-+err_rc_bw_changed:
- 	mutex_unlock(&ar->conf_mutex);
- }
- 
-@@ -4505,6 +4539,34 @@ exit:
- 	return ret;
- }
- 
-+static u32 ath11k_mac_ieee80211_sta_bw_to_wmi(struct ath11k *ar,
-+					      struct ieee80211_sta *sta)
-+{
-+	u32 bw = WMI_PEER_CHWIDTH_20MHZ;
-+
-+	switch (sta->deflink.bandwidth) {
-+	case IEEE80211_STA_RX_BW_20:
-+		bw = WMI_PEER_CHWIDTH_20MHZ;
-+		break;
-+	case IEEE80211_STA_RX_BW_40:
-+		bw = WMI_PEER_CHWIDTH_40MHZ;
-+		break;
-+	case IEEE80211_STA_RX_BW_80:
-+		bw = WMI_PEER_CHWIDTH_80MHZ;
-+		break;
-+	case IEEE80211_STA_RX_BW_160:
-+		bw = WMI_PEER_CHWIDTH_160MHZ;
-+		break;
-+	default:
-+		ath11k_warn(ar->ab, "Invalid bandwidth %d for %pM\n",
-+			    sta->deflink.bandwidth, sta->addr);
-+		bw = WMI_PEER_CHWIDTH_20MHZ;
-+		break;
-+	}
-+
-+	return bw;
-+}
-+
- static int ath11k_mac_op_sta_state(struct ieee80211_hw *hw,
- 				   struct ieee80211_vif *vif,
- 				   struct ieee80211_sta *sta,
-@@ -4590,6 +4652,12 @@ static int ath11k_mac_op_sta_state(struc
- 		if (ret)
- 			ath11k_warn(ar->ab, "Failed to associate station: %pM\n",
- 				    sta->addr);
-+
-+		spin_lock_bh(&ar->data_lock);
-+		/* Set arsta bw and prev bw */
-+		arsta->bw = ath11k_mac_ieee80211_sta_bw_to_wmi(ar, sta);
-+		arsta->bw_prev = arsta->bw;
-+		spin_unlock_bh(&ar->data_lock);
- 	} else if (old_state == IEEE80211_STA_ASSOC &&
- 		   new_state == IEEE80211_STA_AUTHORIZED) {
- 		spin_lock_bh(&ar->ab->base_lock);
-@@ -4713,28 +4781,8 @@ static void ath11k_mac_op_sta_rc_update(
- 	spin_lock_bh(&ar->data_lock);
- 
- 	if (changed & IEEE80211_RC_BW_CHANGED) {
--		bw = WMI_PEER_CHWIDTH_20MHZ;
--
--		switch (sta->deflink.bandwidth) {
--		case IEEE80211_STA_RX_BW_20:
--			bw = WMI_PEER_CHWIDTH_20MHZ;
--			break;
--		case IEEE80211_STA_RX_BW_40:
--			bw = WMI_PEER_CHWIDTH_40MHZ;
--			break;
--		case IEEE80211_STA_RX_BW_80:
--			bw = WMI_PEER_CHWIDTH_80MHZ;
--			break;
--		case IEEE80211_STA_RX_BW_160:
--			bw = WMI_PEER_CHWIDTH_160MHZ;
--			break;
--		default:
--			ath11k_warn(ar->ab, "Invalid bandwidth %d in rc update for %pM\n",
--				    sta->deflink.bandwidth, sta->addr);
--			bw = WMI_PEER_CHWIDTH_20MHZ;
--			break;
--		}
--
-+		bw = ath11k_mac_ieee80211_sta_bw_to_wmi(ar, sta);
-+		arsta->bw_prev = arsta->bw;
- 		arsta->bw = bw;
- 	}
- 

package/kernel/mac80211/patches/ath11k/0007-ath11k-add-separate-APIs-for-monitor-mode.patch

@@ -0,0 +1,442 @@
+From 64e06b78a92744d43d3993ba623d2686d8f937e7 Mon Sep 17 00:00:00 2001
+From: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+Date: Tue, 21 Sep 2021 16:39:29 +0300
+Subject: [PATCH] ath11k: add separate APIs for monitor mode
+
+Add separate APIs for monitor_vdev_create/monitor_vdev_delete
+and monitor_vdev_start/monitor_vdev_stop.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01725-QCAHKSWPL_SILICONZ-1
+
+Co-developed-by: Miles Hu <milehu@codeaurora.org>
+Signed-off-by: Miles Hu <milehu@codeaurora.org>
+Co-developed-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
+Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
+Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210721162053.46290-3-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/core.h |   5 +-
+ drivers/net/wireless/ath/ath11k/mac.c  | 371 ++++++++++++++++++++++++-
+ 2 files changed, 370 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -200,6 +200,9 @@ enum ath11k_dev_flags {
+ 
+ enum ath11k_monitor_flags {
+ 	ATH11K_FLAG_MONITOR_ENABLED,
++	ATH11K_FLAG_MONITOR_CONF_ENABLED,
++	ATH11K_FLAG_MONITOR_STARTED,
++	ATH11K_FLAG_MONITOR_VDEV_CREATED,
+ };
+ 
+ struct ath11k_vif {
+@@ -494,7 +497,6 @@ struct ath11k {
+ 	u32 chan_tx_pwr;
+ 	u32 num_stations;
+ 	u32 max_num_stations;
+-	bool monitor_present;
+ 	/* To synchronize concurrent synchronous mac80211 callback operations,
+ 	 * concurrent debugfs configuration and concurrent FW statistics events.
+ 	 */
+@@ -569,6 +571,7 @@ struct ath11k {
+ 	struct ath11k_per_peer_tx_stats cached_stats;
+ 	u32 last_ppdu_id;
+ 	u32 cached_ppdu_id;
++	int monitor_vdev_id;
+ #ifdef CPTCFG_ATH11K_DEBUGFS
+ 	struct ath11k_debug debug;
+ #endif
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -746,14 +746,370 @@ static inline int ath11k_mac_vdev_setup_
+ 	return ar->last_wmi_vdev_start_status ? -EINVAL : 0;
+ }
+ 
+-static int ath11k_mac_op_config(struct ieee80211_hw *hw, u32 changed)
++static void
++ath11k_mac_get_any_chandef_iter(struct ieee80211_hw *hw,
++				struct ieee80211_chanctx_conf *conf,
++				void *data)
+ {
+-	/* mac80211 requires this op to be present and that's why
+-	 * there's an empty function, this can be extended when
+-	 * required.
+-	 */
++	struct cfg80211_chan_def **def = data;
++
++	*def = &conf->def;
++}
++
++static int ath11k_mac_monitor_vdev_start(struct ath11k *ar, int vdev_id,
++					 struct cfg80211_chan_def *chandef)
++{
++	struct ieee80211_channel *channel;
++	struct wmi_vdev_start_req_arg arg = {};
++	int ret;
++
++	lockdep_assert_held(&ar->conf_mutex);
++
++	channel = chandef->chan;
++
++	arg.vdev_id = vdev_id;
++	arg.channel.freq = channel->center_freq;
++	arg.channel.band_center_freq1 = chandef->center_freq1;
++	arg.channel.band_center_freq2 = chandef->center_freq2;
++
++	arg.channel.mode = ath11k_phymodes[chandef->chan->band][chandef->width];
++	arg.channel.chan_radar = !!(channel->flags & IEEE80211_CHAN_RADAR);
++
++	arg.channel.min_power = 0;
++	arg.channel.max_power = channel->max_power * 2;
++	arg.channel.max_reg_power = channel->max_reg_power * 2;
++	arg.channel.max_antenna_gain = channel->max_antenna_gain * 2;
++
++	arg.pref_tx_streams = ar->num_tx_chains;
++	arg.pref_rx_streams = ar->num_rx_chains;
++
++	arg.channel.passive = !!(chandef->chan->flags & IEEE80211_CHAN_NO_IR);
++
++	reinit_completion(&ar->vdev_setup_done);
++	reinit_completion(&ar->vdev_delete_done);
++
++	ret = ath11k_wmi_vdev_start(ar, &arg, false);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to request monitor vdev %i start: %d\n",
++			    vdev_id, ret);
++		return ret;
++	}
++
++	ret = ath11k_mac_vdev_setup_sync(ar);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to synchronize setup for monitor vdev %i start: %d\n",
++			    vdev_id, ret);
++		return ret;
++	}
++
++	ret = ath11k_wmi_vdev_up(ar, vdev_id, 0, ar->mac_addr);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to put up monitor vdev %i: %d\n",
++			    vdev_id, ret);
++		goto vdev_stop;
++	}
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "mac monitor vdev %i started\n",
++		   vdev_id);
+ 
+ 	return 0;
++
++vdev_stop:
++	reinit_completion(&ar->vdev_setup_done);
++
++	ret = ath11k_wmi_vdev_stop(ar, vdev_id);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to stop monitor vdev %i after start failure: %d\n",
++			    vdev_id, ret);
++		return ret;
++	}
++
++	ret = ath11k_mac_vdev_setup_sync(ar);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to synchronize setup for vdev %i stop: %d\n",
++			    vdev_id, ret);
++		return ret;
++	}
++
++	return -EIO;
++}
++
++static int ath11k_mac_monitor_vdev_stop(struct ath11k *ar)
++{
++	int ret;
++
++	lockdep_assert_held(&ar->conf_mutex);
++
++	reinit_completion(&ar->vdev_setup_done);
++
++	ret = ath11k_wmi_vdev_stop(ar, ar->monitor_vdev_id);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to request monitor vdev %i stop: %d\n",
++			    ar->monitor_vdev_id, ret);
++		return ret;
++	}
++
++	ret = ath11k_mac_vdev_setup_sync(ar);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to synchronize monitor vdev %i stop: %d\n",
++			    ar->monitor_vdev_id, ret);
++		return ret;
++	}
++
++	ret = ath11k_wmi_vdev_down(ar, ar->monitor_vdev_id);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to put down monitor vdev %i: %d\n",
++			    ar->monitor_vdev_id, ret);
++		return ret;
++	}
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "mac monitor vdev %i stopped\n",
++		   ar->monitor_vdev_id);
++
++	return 0;
++}
++
++static int ath11k_mac_monitor_vdev_create(struct ath11k *ar)
++{
++	struct ath11k_pdev *pdev = ar->pdev;
++	struct vdev_create_params param = {};
++	int bit, ret;
++	u8 tmp_addr[6] = {0};
++	u16 nss;
++
++	lockdep_assert_held(&ar->conf_mutex);
++
++	if (test_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags))
++		return 0;
++
++	if (ar->ab->free_vdev_map == 0) {
++		ath11k_warn(ar->ab, "failed to find free vdev id for monitor vdev\n");
++		return -ENOMEM;
++	}
++
++	bit = __ffs64(ar->ab->free_vdev_map);
++
++	ar->monitor_vdev_id = bit;
++
++	param.if_id = ar->monitor_vdev_id;
++	param.type = WMI_VDEV_TYPE_MONITOR;
++	param.subtype = WMI_VDEV_SUBTYPE_NONE;
++	param.pdev_id = pdev->pdev_id;
++
++	if (pdev->cap.supported_bands & WMI_HOST_WLAN_2G_CAP) {
++		param.chains[NL80211_BAND_2GHZ].tx = ar->num_tx_chains;
++		param.chains[NL80211_BAND_2GHZ].rx = ar->num_rx_chains;
++	}
++	if (pdev->cap.supported_bands & WMI_HOST_WLAN_5G_CAP) {
++		param.chains[NL80211_BAND_5GHZ].tx = ar->num_tx_chains;
++		param.chains[NL80211_BAND_5GHZ].rx = ar->num_rx_chains;
++	}
++
++	ret = ath11k_wmi_vdev_create(ar, tmp_addr, &param);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to request monitor vdev %i creation: %d\n",
++			    ar->monitor_vdev_id, ret);
++		ar->monitor_vdev_id = -1;
++		return ret;
++	}
++
++	nss = get_num_chains(ar->cfg_tx_chainmask) ? : 1;
++	ret = ath11k_wmi_vdev_set_param_cmd(ar, ar->monitor_vdev_id,
++					    WMI_VDEV_PARAM_NSS, nss);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to set vdev %d chainmask 0x%x, nss %d :%d\n",
++			    ar->monitor_vdev_id, ar->cfg_tx_chainmask, nss, ret);
++		goto err_vdev_del;
++	}
++
++	ret = ath11k_mac_txpower_recalc(ar);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to recalc txpower for monitor vdev %d: %d\n",
++			    ar->monitor_vdev_id, ret);
++		goto err_vdev_del;
++	}
++
++	ar->allocated_vdev_map |= 1LL << ar->monitor_vdev_id;
++	ar->ab->free_vdev_map &= ~(1LL << ar->monitor_vdev_id);
++	ar->num_created_vdevs++;
++	set_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags);
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "mac monitor vdev %d created\n",
++		   ar->monitor_vdev_id);
++
++	return 0;
++
++err_vdev_del:
++	ath11k_wmi_vdev_delete(ar, ar->monitor_vdev_id);
++	ar->monitor_vdev_id = -1;
++	return ret;
++}
++
++static int ath11k_mac_monitor_vdev_delete(struct ath11k *ar)
++{
++	int ret;
++	unsigned long time_left;
++
++	lockdep_assert_held(&ar->conf_mutex);
++
++	if (!test_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags))
++		return 0;
++
++	reinit_completion(&ar->vdev_delete_done);
++
++	ret = ath11k_wmi_vdev_delete(ar, ar->monitor_vdev_id);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to request wmi monitor vdev %i removal: %d\n",
++			    ar->monitor_vdev_id, ret);
++		return ret;
++	}
++
++	time_left = wait_for_completion_timeout(&ar->vdev_delete_done,
++						ATH11K_VDEV_DELETE_TIMEOUT_HZ);
++	if (time_left == 0) {
++		ath11k_warn(ar->ab, "Timeout in receiving vdev delete response\n");
++	} else {
++		ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "mac monitor vdev %d deleted\n",
++			   ar->monitor_vdev_id);
++
++		ar->allocated_vdev_map &= ~(1LL << ar->monitor_vdev_id);
++		ar->ab->free_vdev_map |= 1LL << (ar->monitor_vdev_id);
++		ar->num_created_vdevs--;
++		ar->monitor_vdev_id = -1;
++		clear_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags);
++	}
++
++	return ret;
++}
++
++static int ath11k_mac_monitor_start(struct ath11k *ar)
++{
++	struct cfg80211_chan_def *chandef = NULL;
++	int ret;
++
++	lockdep_assert_held(&ar->conf_mutex);
++
++	if (test_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags))
++		return 0;
++
++	ieee80211_iter_chan_contexts_atomic(ar->hw,
++					    ath11k_mac_get_any_chandef_iter,
++					    &chandef);
++	if (!chandef)
++		return 0;
++
++	ret = ath11k_mac_monitor_vdev_start(ar, ar->monitor_vdev_id, chandef);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to start monitor vdev: %d\n", ret);
++		ath11k_mac_monitor_vdev_delete(ar);
++		return ret;
++	}
++
++	set_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags);
++
++	ar->num_started_vdevs++;
++	ret = ath11k_dp_tx_htt_monitor_mode_ring_config(ar, false);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to configure htt monitor mode ring during start: %d",
++			    ret);
++		return ret;
++	}
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "mac monitor started\n");
++
++	return 0;
++}
++
++static int ath11k_mac_monitor_stop(struct ath11k *ar)
++{
++	int ret;
++
++	lockdep_assert_held(&ar->conf_mutex);
++
++	if (!test_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags))
++		return 0;
++
++	ret = ath11k_mac_monitor_vdev_stop(ar);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to stop monitor vdev: %d\n", ret);
++		return ret;
++	}
++
++	clear_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags);
++	ar->num_started_vdevs--;
++
++	ret = ath11k_dp_tx_htt_monitor_mode_ring_config(ar, true);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to configure htt monitor mode ring during stop: %d",
++			    ret);
++		return ret;
++	}
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "mac monitor stopped ret %d\n", ret);
++
++	return 0;
++}
++
++static int ath11k_mac_op_config(struct ieee80211_hw *hw, u32 changed)
++{
++	struct ath11k *ar = hw->priv;
++	struct ieee80211_conf *conf = &hw->conf;
++	int ret = 0;
++
++	mutex_lock(&ar->conf_mutex);
++
++	if (changed & IEEE80211_CONF_CHANGE_MONITOR) {
++		if (conf->flags & IEEE80211_CONF_MONITOR) {
++			set_bit(ATH11K_FLAG_MONITOR_CONF_ENABLED, &ar->monitor_flags);
++
++			if (test_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED,
++				     &ar->monitor_flags))
++				goto out;
++
++			ret = ath11k_mac_monitor_vdev_create(ar);
++			if (ret) {
++				ath11k_warn(ar->ab, "failed to create monitor vdev: %d",
++					    ret);
++				goto out;
++			}
++
++			ret = ath11k_mac_monitor_start(ar);
++			if (ret) {
++				ath11k_warn(ar->ab, "failed to start monitor: %d",
++					    ret);
++				goto err_mon_del;
++			}
++		} else {
++			clear_bit(ATH11K_FLAG_MONITOR_CONF_ENABLED, &ar->monitor_flags);
++
++			if (!test_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED,
++				      &ar->monitor_flags))
++				goto out;
++
++			ret = ath11k_mac_monitor_stop(ar);
++			if (ret) {
++				ath11k_warn(ar->ab, "failed to stop monitor: %d",
++					    ret);
++				goto out;
++			}
++
++			ret = ath11k_mac_monitor_vdev_delete(ar);
++			if (ret) {
++				ath11k_warn(ar->ab, "failed to delete monitor vdev: %d",
++					    ret);
++				goto out;
++			}
++		}
++	}
++
++out:
++	mutex_unlock(&ar->conf_mutex);
++	return ret;
++
++err_mon_del:
++	ath11k_mac_monitor_vdev_delete(ar);
++	mutex_unlock(&ar->conf_mutex);
++	return ret;
+ }
+ 
+ static int ath11k_mac_setup_bcn_tmpl(struct ath11k_vif *arvif)
+@@ -6781,7 +7137,12 @@ int ath11k_mac_allocate(struct ath11k_ba
+ 
+ 		INIT_WORK(&ar->wmi_mgmt_tx_work, ath11k_mgmt_over_wmi_tx_work);
+ 		skb_queue_head_init(&ar->wmi_mgmt_tx_queue);
++
+ 		clear_bit(ATH11K_FLAG_MONITOR_ENABLED, &ar->monitor_flags);
++		clear_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags);
++
++		ar->monitor_vdev_id = -1;
++		clear_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags);
+ 	}
+ 
+ 	return 0;

package/kernel/mac80211/patches/ath11k/0007-wifi-ath11k-suppress-add-interface-error.patch

@@ -1,52 +0,0 @@
-From 638b26652b0438563a76ec90014c8cba34db982b Mon Sep 17 00:00:00 2001
-From: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
-Date: Thu, 6 Oct 2022 06:28:42 +0530
-Subject: [PATCH 7/9] wifi: ath11k: suppress add interface error
-
-In the VIF (other than monitor type) creation request, we should not
-throw the error code when the monitor VIF creation fails, since the
-actual VIF creation succeeds. If we throw the error code from driver
-then the actual VIF creation get fail. So suppress the monitor VIF
-creation error by throwing warning message instead of error code.
-
-Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.6.0.1-00760-QCAHKSWPL_SILICONZ-1
-
-Signed-off-by: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
-Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
-Link: https://lore.kernel.org/r/20221006005842.8599-1-quic_periyasa@quicinc.com
----
- drivers/net/wireless/ath/ath11k/mac.c | 9 +++------
- 1 file changed, 3 insertions(+), 6 deletions(-)
-
---- a/drivers/net/wireless/ath/ath11k/mac.c
-+++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -6421,18 +6421,16 @@ static int ath11k_mac_op_add_interface(s
- 
- 	ath11k_dp_vdev_tx_attach(ar, arvif);
- 
-+	ath11k_debugfs_add_interface(arvif);
-+
- 	if (vif->type != NL80211_IFTYPE_MONITOR &&
- 	    test_bit(ATH11K_FLAG_MONITOR_CONF_ENABLED, &ar->monitor_flags)) {
- 		ret = ath11k_mac_monitor_vdev_create(ar);
--		if (ret) {
-+		if (ret)
- 			ath11k_warn(ar->ab, "failed to create monitor vdev during add interface: %d",
- 				    ret);
--			goto err_peer_del;
--		}
- 	}
- 
--	ath11k_debugfs_add_interface(arvif);
--
- 	mutex_unlock(&ar->conf_mutex);
- 
- 	return 0;
-@@ -6457,7 +6455,6 @@ err_vdev_del:
- 	spin_unlock_bh(&ar->data_lock);
- 
- err:
--	ath11k_debugfs_remove_interface(arvif);
- 	mutex_unlock(&ar->conf_mutex);
- 
- 	return ret;

package/kernel/mac80211/patches/ath11k/0008-ath11k-monitor-mode-clean-up-to-use-separate-APIs.patch

@@ -0,0 +1,370 @@
+From 689a5e6fff75229ac7c2af7a9c51dc2d3ca1882b Mon Sep 17 00:00:00 2001
+From: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+Date: Tue, 21 Sep 2021 16:39:30 +0300
+Subject: [PATCH] ath11k: monitor mode clean up to use separate APIs
+
+If monitor interface is enabled in co-exist mode, only local traffic are
+captured. It's caused by missing monitor vdev in co-exist mode. So,
+monitor mode clean up is done with separate Monitor APIs. For this,
+introduce flags monitor_started and monitor_vdev_created.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01725-QCAHKSWPL_SILICONZ-1
+
+Co-developed-by: Miles Hu <milehu@codeaurora.org>
+Signed-off-by: Miles Hu <milehu@codeaurora.org>
+Co-developed-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
+Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@codeaurora.org>
+Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210721162053.46290-4-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/core.h  |   1 -
+ drivers/net/wireless/ath/ath11k/dp_rx.c |   2 +-
+ drivers/net/wireless/ath/ath11k/dp_tx.c |   8 +-
+ drivers/net/wireless/ath/ath11k/mac.c   | 150 ++++++++++++++++--------
+ 4 files changed, 110 insertions(+), 51 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -199,7 +199,6 @@ enum ath11k_dev_flags {
+ };
+ 
+ enum ath11k_monitor_flags {
+-	ATH11K_FLAG_MONITOR_ENABLED,
+ 	ATH11K_FLAG_MONITOR_CONF_ENABLED,
+ 	ATH11K_FLAG_MONITOR_STARTED,
+ 	ATH11K_FLAG_MONITOR_VDEV_CREATED,
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -5032,7 +5032,7 @@ int ath11k_dp_rx_process_mon_rings(struc
+ 	struct ath11k *ar = ath11k_ab_to_ar(ab, mac_id);
+ 	int ret = 0;
+ 
+-	if (test_bit(ATH11K_FLAG_MONITOR_ENABLED, &ar->monitor_flags))
++	if (test_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags))
+ 		ret = ath11k_dp_mon_process_rx(ab, mac_id, napi, budget);
+ 	else
+ 		ret = ath11k_dp_rx_process_mon_status(ab, mac_id, napi, budget);
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -1076,12 +1076,16 @@ int ath11k_dp_tx_htt_monitor_mode_ring_c
+ 
+ 	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
+ 		ring_id = dp->rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
+-		if (!reset)
++		if (!reset) {
+ 			tlv_filter.rx_filter =
+ 					HTT_RX_MON_FILTER_TLV_FLAGS_MON_STATUS_RING;
+-		else
++		} else {
+ 			tlv_filter = ath11k_mac_mon_status_filter_default;
+ 
++			if (ath11k_debugfs_is_extd_rx_stats_enabled(ar))
++				tlv_filter.rx_filter = ath11k_debugfs_rx_filter(ar);
++		}
++
+ 		ret = ath11k_dp_tx_htt_rx_filter_setup(ab, ring_id,
+ 						       dp->mac_id + i,
+ 						       HAL_RXDMA_MONITOR_STATUS,
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -716,22 +716,6 @@ void ath11k_mac_peer_cleanup_all(struct
+ 	ar->num_stations = 0;
+ }
+ 
+-static int ath11k_monitor_vdev_up(struct ath11k *ar, int vdev_id)
+-{
+-	int ret = 0;
+-
+-	ret = ath11k_wmi_vdev_up(ar, vdev_id, 0, ar->mac_addr);
+-	if (ret) {
+-		ath11k_warn(ar->ab, "failed to put up monitor vdev %i: %d\n",
+-			    vdev_id, ret);
+-		return ret;
+-	}
+-
+-	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "mac monitor vdev %i started\n",
+-		   vdev_id);
+-	return 0;
+-}
+-
+ static inline int ath11k_mac_vdev_setup_sync(struct ath11k *ar)
+ {
+ 	lockdep_assert_held(&ar->conf_mutex);
+@@ -2331,7 +2315,7 @@ static int ath11k_mac_config_obss_pd(str
+ 
+ 	/* Set and enable SRG/non-SRG OBSS PD Threshold */
+ 	param_id = WMI_PDEV_PARAM_SET_CMD_OBSS_PD_THRESHOLD;
+-	if (test_bit(ATH11K_FLAG_MONITOR_ENABLED, &ar->monitor_flags)) {
++	if (test_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags)) {
+ 		ret = ath11k_wmi_pdev_set_param(ar, param_id, 0, pdev_id);
+ 		if (ret)
+ 			ath11k_warn(ar->ab,
+@@ -5110,8 +5094,8 @@ static int ath11k_mac_op_add_interface(s
+ 	}
+ 
+ 	if (ar->num_created_vdevs > (TARGET_NUM_VDEVS - 1)) {
+-		ath11k_warn(ab, "failed to create vdev, reached max vdev limit %d\n",
+-			    TARGET_NUM_VDEVS);
++		ath11k_warn(ab, "failed to create vdev %u, reached max vdev limit %d\n",
++			    ar->num_created_vdevs, TARGET_NUM_VDEVS);
+ 		ret = -EBUSY;
+ 		goto err;
+ 	}
+@@ -5151,6 +5135,7 @@ static int ath11k_mac_op_add_interface(s
+ 		break;
+ 	case NL80211_IFTYPE_MONITOR:
+ 		arvif->vdev_type = WMI_VDEV_TYPE_MONITOR;
++		ar->monitor_vdev_id = bit;
+ 		break;
+ 	default:
+ 		WARN_ON(1);
+@@ -5252,6 +5237,9 @@ static int ath11k_mac_op_add_interface(s
+ 			goto err_peer_del;
+ 		}
+ 		break;
++	case WMI_VDEV_TYPE_MONITOR:
++		set_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags);
++		break;
+ 	default:
+ 		break;
+ 	}
+@@ -5272,6 +5260,16 @@ static int ath11k_mac_op_add_interface(s
+ 
+ 	ath11k_dp_vdev_tx_attach(ar, arvif);
+ 
++	if (vif->type != NL80211_IFTYPE_MONITOR &&
++	    test_bit(ATH11K_FLAG_MONITOR_CONF_ENABLED, &ar->monitor_flags)) {
++		ret = ath11k_mac_monitor_vdev_create(ar);
++		if (ret) {
++			ath11k_warn(ar->ab, "failed to create monitor vdev during add interface: %d",
++				    ret);
++			goto err_peer_del;
++		}
++	}
++
+ 	mutex_unlock(&ar->conf_mutex);
+ 
+ 	return 0;
+@@ -5369,6 +5367,18 @@ static void ath11k_mac_op_remove_interfa
+ 	ath11k_dbg(ab, ATH11K_DBG_MAC, "vdev %pM deleted, vdev_id %d\n",
+ 		   vif->addr, arvif->vdev_id);
+ 
++	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
++		clear_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags);
++		ar->monitor_vdev_id = -1;
++	} else if (test_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags) &&
++		   !test_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags)) {
++		ret = ath11k_mac_monitor_vdev_delete(ar);
++		if (ret)
++			/* continue even if there's an error */
++			ath11k_warn(ar->ab, "failed to delete vdev monitor during remove interface: %d",
++				    ret);
++	}
++
+ err_vdev_del:
+ 	spin_lock_bh(&ar->data_lock);
+ 	list_del(&arvif->list);
+@@ -5388,7 +5398,6 @@ err_vdev_del:
+ 
+ 	/* Recalc txpower for remaining vdev */
+ 	ath11k_mac_txpower_recalc(ar);
+-	clear_bit(ATH11K_FLAG_MONITOR_ENABLED, &ar->monitor_flags);
+ 
+ 	/* TODO: recal traffic pause state based on the available vdevs */
+ 
+@@ -5411,8 +5420,6 @@ static void ath11k_mac_op_configure_filt
+ 					   u64 multicast)
+ {
+ 	struct ath11k *ar = hw->priv;
+-	bool reset_flag = false;
+-	int ret = 0;
+ 
+ 	mutex_lock(&ar->conf_mutex);
+ 
+@@ -5420,23 +5427,6 @@ static void ath11k_mac_op_configure_filt
+ 	*total_flags &= SUPPORTED_FILTERS;
+ 	ar->filter_flags = *total_flags;
+ 
+-	/* For monitor mode */
+-	reset_flag = !(ar->filter_flags & FIF_BCN_PRBRESP_PROMISC);
+-
+-	ret = ath11k_dp_tx_htt_monitor_mode_ring_config(ar, reset_flag);
+-	if (!ret) {
+-		if (!reset_flag)
+-			set_bit(ATH11K_FLAG_MONITOR_ENABLED, &ar->monitor_flags);
+-		else
+-			clear_bit(ATH11K_FLAG_MONITOR_ENABLED, &ar->monitor_flags);
+-	} else {
+-		ath11k_warn(ar->ab,
+-			    "fail to set monitor filter: %d\n", ret);
+-	}
+-	ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
+-		   "changed_flags:0x%x, total_flags:0x%x, reset_flag:%d\n",
+-		   changed_flags, *total_flags, reset_flag);
+-
+ 	mutex_unlock(&ar->conf_mutex);
+ }
+ 
+@@ -5627,7 +5617,9 @@ ath11k_mac_vdev_start_restart(struct ath
+ 		return ret;
+ 	}
+ 
+-	ar->num_started_vdevs++;
++	if (!restart)
++		ar->num_started_vdevs++;
++
+ 	ath11k_dbg(ab, ATH11K_DBG_MAC,  "vdev %pM started, vdev_id %d\n",
+ 		   arvif->vif->addr, arvif->vdev_id);
+ 
+@@ -5755,12 +5747,16 @@ ath11k_mac_update_vif_chan(struct ath11k
+ 	struct ath11k_vif *arvif;
+ 	int ret;
+ 	int i;
++	bool monitor_vif = false;
+ 
+ 	lockdep_assert_held(&ar->conf_mutex);
+ 
+ 	for (i = 0; i < n_vifs; i++) {
+ 		arvif = (void *)vifs[i].vif->drv_priv;
+ 
++		if (vifs[i].vif->type == NL80211_IFTYPE_MONITOR)
++			monitor_vif = true;
++
+ 		ath11k_dbg(ab, ATH11K_DBG_MAC,
+ 			   "mac chanctx switch vdev_id %i freq %u->%u width %d->%d\n",
+ 			   arvif->vdev_id,
+@@ -5781,6 +5777,8 @@ ath11k_mac_update_vif_chan(struct ath11k
+ 				    arvif->vdev_id, ret);
+ 			continue;
+ 		}
++
++		ar->num_started_vdevs--;
+ 	}
+ 
+ 	/* All relevant vdevs are downed and associated channel resources
+@@ -5818,6 +5816,24 @@ ath11k_mac_update_vif_chan(struct ath11k
+ 			continue;
+ 		}
+ 	}
++
++	/* Restart the internal monitor vdev on new channel */
++	if (!monitor_vif &&
++	    test_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags)) {
++		ret = ath11k_mac_monitor_stop(ar);
++		if (ret) {
++			ath11k_warn(ar->ab, "failed to stop monitor during vif channel update: %d",
++				    ret);
++			return;
++		}
++
++		ret = ath11k_mac_monitor_start(ar);
++		if (ret) {
++			ath11k_warn(ar->ab, "failed to start monitor during vif channel update: %d",
++				    ret);
++			return;
++		}
++	}
+ }
+ 
+ static void
+@@ -5897,7 +5913,7 @@ static int ath11k_start_vdev_delay(struc
+ 	}
+ 
+ 	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
+-		ret = ath11k_monitor_vdev_up(ar, arvif->vdev_id);
++		ret = ath11k_wmi_vdev_up(ar, arvif->vdev_id, 0, ar->mac_addr);
+ 		if (ret) {
+ 			ath11k_warn(ab, "failed put monitor up: %d\n", ret);
+ 			return ret;
+@@ -5957,6 +5973,18 @@ ath11k_mac_op_assign_vif_chanctx(struct
+ 		}
+ 	}
+ 
++	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
++		ret = ath11k_mac_monitor_start(ar);
++		if (ret) {
++			ath11k_warn(ar->ab, "failed to start monitor during vif channel context assignment: %d",
++				    ret);
++			goto out;
++		}
++
++		arvif->is_started = true;
++		goto out;
++	}
++
+ 	ret = ath11k_mac_vdev_start(arvif, &ctx->def);
+ 	if (ret) {
+ 		ath11k_warn(ab, "failed to start vdev %i addr %pM on freq %d: %d\n",
+@@ -5964,14 +5992,19 @@ ath11k_mac_op_assign_vif_chanctx(struct
+ 			    ctx->def.chan->center_freq, ret);
+ 		goto out;
+ 	}
+-	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
+-		ret = ath11k_monitor_vdev_up(ar, arvif->vdev_id);
+-		if (ret)
+-			goto out;
+-	}
+ 
+ 	arvif->is_started = true;
+ 
++	if (arvif->vdev_type != WMI_VDEV_TYPE_MONITOR &&
++	    test_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags)) {
++		ret = ath11k_mac_monitor_start(ar);
++		if (ret) {
++			ath11k_warn(ar->ab, "failed to start monitor during vif channel context assignment: %d",
++				    ret);
++			goto out;
++		}
++	}
++
+ 	/* TODO: Setup ps and cts/rts protection */
+ 
+ 	ret = 0;
+@@ -6005,6 +6038,20 @@ ath11k_mac_op_unassign_vif_chanctx(struc
+ 	    ath11k_peer_find_by_addr(ab, ar->mac_addr))
+ 		ath11k_peer_delete(ar, arvif->vdev_id, ar->mac_addr);
+ 
++	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
++		ret = ath11k_mac_monitor_stop(ar);
++		if (ret) {
++			ath11k_warn(ar->ab, "failed to stop monitor during vif channel context unassignment: %d",
++				    ret);
++			mutex_unlock(&ar->conf_mutex);
++			return;
++		}
++
++		arvif->is_started = false;
++		mutex_unlock(&ar->conf_mutex);
++		return;
++	}
++
+ 	ret = ath11k_mac_vdev_stop(arvif);
+ 	if (ret)
+ 		ath11k_warn(ab, "failed to stop vdev %i: %d\n",
+@@ -6016,6 +6063,16 @@ ath11k_mac_op_unassign_vif_chanctx(struc
+ 	    arvif->vdev_type == WMI_VDEV_TYPE_MONITOR)
+ 		ath11k_wmi_vdev_down(ar, arvif->vdev_id);
+ 
++	if (arvif->vdev_type != WMI_VDEV_TYPE_MONITOR &&
++	    ar->num_started_vdevs == 1 &&
++	    test_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags)) {
++		ret = ath11k_mac_monitor_stop(ar);
++		if (ret)
++			/* continue even if there's an error */
++			ath11k_warn(ar->ab, "failed to stop monitor during vif channel context unassignment: %d",
++				    ret);
++	}
++
+ 	mutex_unlock(&ar->conf_mutex);
+ }
+ 
+@@ -7138,7 +7195,6 @@ int ath11k_mac_allocate(struct ath11k_ba
+ 		INIT_WORK(&ar->wmi_mgmt_tx_work, ath11k_mgmt_over_wmi_tx_work);
+ 		skb_queue_head_init(&ar->wmi_mgmt_tx_queue);
+ 
+-		clear_bit(ATH11K_FLAG_MONITOR_ENABLED, &ar->monitor_flags);
+ 		clear_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags);
+ 
+ 		ar->monitor_vdev_id = -1;

package/kernel/mac80211/patches/ath11k/0008-wifi-ath11k-add-support-to-configure-channel-dwell-t.patch

@@ -1,102 +0,0 @@
-From c362daa213cdeb0a9e7c2ed84849544c24505720 Mon Sep 17 00:00:00 2001
-From: Manikanta Pubbisetty <quic_mpubbise@quicinc.com>
-Date: Fri, 7 Oct 2022 10:41:30 +0530
-Subject: [PATCH 8/9] wifi: ath11k: add support to configure channel dwell time
-
-Add support to configure channel dwell time during scan.
-Dwell time help to stay on the channel for a specified duration
-during scan and aid userspace in finding WiFi networks. Very
-useful in passive scans where longer dwell times are needed
-to find the WiFi networks.
-
-Configure channel dwell time from duration of the scan request
-received from mac80211 when the duration is non-zero. When the
-scan request does not have duration value, use the default ones,
-the current implementation.
-
-Advertise corresponding feature flag NL80211_EXT_FEATURE_SET_SCAN_DWELL
-to enable the feature.
-
-Change is applicable for all ath11k hardware.
-
-Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.1.0.1-00887-QCAMSLSWPLZ-1
-
-Signed-off-by: Manikanta Pubbisetty <quic_mpubbise@quicinc.com>
-Reviewed-by: Jeff Johnson <quic_jjohnson@quicinc.com>
-Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
-Link: https://lore.kernel.org/r/20221007051130.6067-1-quic_mpubbise@quicinc.com
----
- drivers/net/wireless/ath/ath11k/mac.c | 33 +++++++++++++++++++++++----
- 1 file changed, 29 insertions(+), 4 deletions(-)
-
---- a/drivers/net/wireless/ath/ath11k/mac.c
-+++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -241,7 +241,10 @@ const struct htt_rx_ring_tlv_filter ath1
- #define ath11k_a_rates (ath11k_legacy_rates + 4)
- #define ath11k_a_rates_size (ARRAY_SIZE(ath11k_legacy_rates) - 4)
- 
--#define ATH11K_MAC_SCAN_TIMEOUT_MSECS 200 /* in msecs */
-+#define ATH11K_MAC_SCAN_CMD_EVT_OVERHEAD		200 /* in msecs */
-+
-+/* Overhead due to the processing of channel switch events from FW */
-+#define ATH11K_SCAN_CHANNEL_SWITCH_WMI_EVT_OVERHEAD	10 /* in msecs */
- 
- static const u32 ath11k_smps_map[] = {
- 	[WLAN_HT_CAP_SM_PS_STATIC] = WMI_PEER_SMPS_STATIC,
-@@ -3612,6 +3615,7 @@ static int ath11k_mac_op_hw_scan(struct
- 	struct scan_req_params arg;
- 	int ret = 0;
- 	int i;
-+	u32 scan_timeout;
- 
- 	mutex_lock(&ar->conf_mutex);
- 
-@@ -3681,6 +3685,26 @@ static int ath11k_mac_op_hw_scan(struct
- 		ether_addr_copy(arg.mac_mask.addr, req->mac_addr_mask);
- 	}
- 
-+	/* if duration is set, default dwell times will be overwritten */
-+	if (req->duration) {
-+		arg.dwell_time_active = req->duration;
-+		arg.dwell_time_active_2g = req->duration;
-+		arg.dwell_time_active_6g = req->duration;
-+		arg.dwell_time_passive = req->duration;
-+		arg.dwell_time_passive_6g = req->duration;
-+		arg.burst_duration = req->duration;
-+
-+		scan_timeout = min_t(u32, arg.max_rest_time *
-+				(arg.num_chan - 1) + (req->duration +
-+				ATH11K_SCAN_CHANNEL_SWITCH_WMI_EVT_OVERHEAD) *
-+				arg.num_chan, arg.max_scan_time);
-+	} else {
-+		scan_timeout = arg.max_scan_time;
-+	}
-+
-+	/* Add a margin to account for event/command processing */
-+	scan_timeout += ATH11K_MAC_SCAN_CMD_EVT_OVERHEAD;
-+
- 	ret = ath11k_start_scan(ar, &arg);
- 	if (ret) {
- 		ath11k_warn(ar->ab, "failed to start hw scan: %d\n", ret);
-@@ -3689,10 +3713,8 @@ static int ath11k_mac_op_hw_scan(struct
- 		spin_unlock_bh(&ar->data_lock);
- 	}
- 
--	/* Add a 200ms margin to account for event/command processing */
- 	ieee80211_queue_delayed_work(ar->hw, &ar->scan.timeout,
--				     msecs_to_jiffies(arg.max_scan_time +
--						      ATH11K_MAC_SCAN_TIMEOUT_MSECS));
-+				     msecs_to_jiffies(scan_timeout));
- 
- exit:
- 	kfree(arg.chan_list);
-@@ -9060,6 +9082,9 @@ static int __ath11k_mac_register(struct
- 				      NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP);
- 	}
- 
-+	wiphy_ext_feature_set(ar->hw->wiphy,
-+			      NL80211_EXT_FEATURE_SET_SCAN_DWELL);
-+
- 	ath11k_reg_init(ar);
- 
- 	if (!test_bit(ATH11K_FLAG_RAW_MODE, &ab->dev_flags)) {

package/kernel/mac80211/patches/ath11k/0009-wifi-ath11k-Send-PME-message-during-wakeup-from-D3co.patch

@@ -1,39 +0,0 @@
-From 3f9b09ccf7d5f23066b02881a737bee42def9d1a Mon Sep 17 00:00:00 2001
-From: Baochen Qiang <quic_bqiang@quicinc.com>
-Date: Mon, 10 Oct 2022 11:32:37 +0800
-Subject: [PATCH 9/9] wifi: ath11k: Send PME message during wakeup from D3cold
-
-We are seeing system stuck on some specific platforms due to
-WLAN chip fails to wakeup from D3cold state.
-
-With this flag, firmware will send PME message during wakeup
-and this issue is gone.
-
-Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3
-
-Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
-Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
-Link: https://lore.kernel.org/r/20221010033237.415478-1-quic_bqiang@quicinc.com
----
- drivers/net/wireless/ath/ath11k/qmi.c | 3 +++
- 1 file changed, 3 insertions(+)
-
---- a/drivers/net/wireless/ath/ath11k/qmi.c
-+++ b/drivers/net/wireless/ath/ath11k/qmi.c
-@@ -19,6 +19,7 @@
- #define SLEEP_CLOCK_SELECT_INTERNAL_BIT	0x02
- #define HOST_CSTATE_BIT			0x04
- #define PLATFORM_CAP_PCIE_GLOBAL_RESET	0x08
-+#define PLATFORM_CAP_PCIE_PME_D3COLD	0x10
- 
- #define FW_BUILD_ID_MASK "QC_IMAGE_VERSION_STRING="
- 
-@@ -1752,6 +1753,8 @@ static int ath11k_qmi_host_cap_send(stru
- 	if (ab->hw_params.global_reset)
- 		req.nm_modem |= PLATFORM_CAP_PCIE_GLOBAL_RESET;
- 
-+	req.nm_modem |= PLATFORM_CAP_PCIE_PME_D3COLD;
-+
- 	ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi host cap request\n");
- 
- 	ret = qmi_txn_init(&ab->qmi.handle, &txn,

package/kernel/mac80211/patches/ath11k/0010-ath11k-add-support-for-80P80-and-160-MHz-bandwidth.patch

@@ -0,0 +1,322 @@
+From f552d6fd2f27ce9430c74482c46272838e2de688 Mon Sep 17 00:00:00 2001
+From: P Praneesh <ppranees@codeaurora.org>
+Date: Fri, 24 Sep 2021 16:52:46 +0300
+Subject: [PATCH] ath11k: add support for 80P80 and 160 MHz bandwidth
+
+For 160 MHz, nss_ratio_enabled flag is added to indicate firmware
+supports sending NSS ratio information from firmware as a part of
+service ready ext event. Extract this NSS ratio info from service
+ready ext event and save this information in ath11k_pdev_cap to
+calculate NSS ratio.
+
+Current firmware configurations support two types of NSS ratio
+which is WMI_NSS_RATIO_1_NSS for QCN9074 and WMI_NSS_RATIO_1BY2_NSS
+for IPQ8074. Based on this two configuration, max supported
+NSS getting calculated.
+
+Move ath11k_peer_assoc_h_phymode() before ath11k_peer_assoc_h_vht()
+to get arg->peer_phymode updated.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-00097-QCAHKSWPL_SILICONZ-1
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01467-QCAHKSWPL_SILICONZ-1
+
+Co-developed-by: Ganesh Sesetti <gseset@codeaurora.org>
+Signed-off-by: Ganesh Sesetti <gseset@codeaurora.org>
+Co-developed-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
+Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
+Signed-off-by: P Praneesh <ppranees@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210721173615.75637-2-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/core.h |  2 +
+ drivers/net/wireless/ath/ath11k/mac.c  | 95 ++++++++++++++++++++++----
+ drivers/net/wireless/ath/ath11k/mac.h  |  3 +
+ drivers/net/wireless/ath/ath11k/wmi.c  | 20 +++++-
+ drivers/net/wireless/ath/ath11k/wmi.h  | 30 ++++++++
+ 5 files changed, 136 insertions(+), 14 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -603,6 +603,8 @@ struct ath11k_pdev_cap {
+ 	u32 tx_chain_mask_shift;
+ 	u32 rx_chain_mask_shift;
+ 	struct ath11k_band_cap band[NUM_NL80211_BANDS];
++	bool nss_ratio_enabled;
++	u8 nss_ratio_info;
+ };
+ 
+ struct ath11k_pdev {
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -1586,6 +1586,34 @@ ath11k_peer_assoc_h_vht_limit(u16 tx_mcs
+ 	return tx_mcs_set;
+ }
+ 
++static u8 ath11k_get_nss_160mhz(struct ath11k *ar,
++				u8 max_nss)
++{
++	u8 nss_ratio_info = ar->pdev->cap.nss_ratio_info;
++	u8 max_sup_nss = 0;
++
++	switch (nss_ratio_info) {
++	case WMI_NSS_RATIO_1BY2_NSS:
++		max_sup_nss = max_nss >> 1;
++		break;
++	case WMI_NSS_RATIO_3BY4_NSS:
++		ath11k_warn(ar->ab, "WMI_NSS_RATIO_3BY4_NSS not supported\n");
++		break;
++	case WMI_NSS_RATIO_1_NSS:
++		max_sup_nss = max_nss;
++		break;
++	case WMI_NSS_RATIO_2_NSS:
++		ath11k_warn(ar->ab, "WMI_NSS_RATIO_2_NSS not supported\n");
++		break;
++	default:
++		ath11k_warn(ar->ab, "invalid nss ratio received from firmware: %d\n",
++			    nss_ratio_info);
++		break;
++	}
++
++	return max_sup_nss;
++}
++
+ static void ath11k_peer_assoc_h_vht(struct ath11k *ar,
+ 				    struct ieee80211_vif *vif,
+ 				    struct ieee80211_sta *sta,
+@@ -1600,6 +1628,7 @@ static void ath11k_peer_assoc_h_vht(stru
+ 	u8 max_nss, vht_mcs;
+ 	int i, vht_nss, nss_idx;
+ 	bool user_rate_valid = true;
++	u32 rx_nss, tx_nss, nss_160;
+ 
+ 	if (WARN_ON(ath11k_mac_vif_chan(vif, &def)))
+ 		return;
+@@ -1692,10 +1721,29 @@ static void ath11k_peer_assoc_h_vht(stru
+ 	/* TODO:  Check */
+ 	arg->tx_max_mcs_nss = 0xFF;
+ 
+-	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "mac vht peer %pM max_mpdu %d flags 0x%x\n",
+-		   sta->addr, arg->peer_max_mpdu, arg->peer_flags);
++	if (arg->peer_phymode == MODE_11AC_VHT160 ||
++	    arg->peer_phymode == MODE_11AC_VHT80_80) {
++		tx_nss = ath11k_get_nss_160mhz(ar, max_nss);
++		rx_nss = min(arg->peer_nss, tx_nss);
++		arg->peer_bw_rxnss_override = ATH11K_BW_NSS_MAP_ENABLE;
++
++		if (!rx_nss) {
++			ath11k_warn(ar->ab, "invalid max_nss\n");
++			return;
++		}
++
++		if (arg->peer_phymode == MODE_11AC_VHT160)
++			nss_160 = FIELD_PREP(ATH11K_PEER_RX_NSS_160MHZ, rx_nss - 1);
++		else
++			nss_160 = FIELD_PREP(ATH11K_PEER_RX_NSS_80_80MHZ, rx_nss - 1);
+ 
+-	/* TODO: rxnss_override */
++		arg->peer_bw_rxnss_override |= nss_160;
++	}
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
++		   "mac vht peer %pM max_mpdu %d flags 0x%x nss_override 0x%x\n",
++		   sta->addr, arg->peer_max_mpdu, arg->peer_flags,
++		   arg->peer_bw_rxnss_override);
+ }
+ 
+ static int ath11k_mac_get_max_he_mcs_map(u16 mcs_map, int nss)
+@@ -1779,6 +1827,7 @@ static void ath11k_peer_assoc_h_he(struc
+ 	u16 he_tx_mcs = 0, v = 0;
+ 	int i, he_nss, nss_idx;
+ 	bool user_rate_valid = true;
++	u32 rx_nss, tx_nss, nss_160;
+ 
+ 	if (WARN_ON(ath11k_mac_vif_chan(vif, &def)))
+ 		return;
+@@ -1942,9 +1991,30 @@ static void ath11k_peer_assoc_h_he(struc
+ 	}
+ 	arg->peer_nss = min(sta->rx_nss, max_nss);
+ 
++	if (arg->peer_phymode == MODE_11AX_HE160 ||
++	    arg->peer_phymode == MODE_11AX_HE80_80) {
++		tx_nss = ath11k_get_nss_160mhz(ar, max_nss);
++		rx_nss = min(arg->peer_nss, tx_nss);
++		arg->peer_bw_rxnss_override = ATH11K_BW_NSS_MAP_ENABLE;
++
++		if (!rx_nss) {
++			ath11k_warn(ar->ab, "invalid max_nss\n");
++			return;
++		}
++
++		if (arg->peer_phymode == MODE_11AX_HE160)
++			nss_160 = FIELD_PREP(ATH11K_PEER_RX_NSS_160MHZ, rx_nss - 1);
++		else
++			nss_160 = FIELD_PREP(ATH11K_PEER_RX_NSS_80_80MHZ, rx_nss - 1);
++
++		arg->peer_bw_rxnss_override |= nss_160;
++	}
++
+ 	ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
+-		   "mac he peer %pM nss %d mcs cnt %d\n",
+-		   sta->addr, arg->peer_nss, arg->peer_he_mcs_count);
++		   "mac he peer %pM nss %d mcs cnt %d nss_override 0x%x\n",
++		   sta->addr, arg->peer_nss,
++		   arg->peer_he_mcs_count,
++		   arg->peer_bw_rxnss_override);
+ }
+ 
+ static void ath11k_peer_assoc_h_smps(struct ieee80211_sta *sta,
+@@ -2232,11 +2302,11 @@ static void ath11k_peer_assoc_prepare(st
+ 	ath11k_peer_assoc_h_basic(ar, vif, sta, arg);
+ 	ath11k_peer_assoc_h_crypto(ar, vif, sta, arg);
+ 	ath11k_peer_assoc_h_rates(ar, vif, sta, arg);
++	ath11k_peer_assoc_h_phymode(ar, vif, sta, arg);
+ 	ath11k_peer_assoc_h_ht(ar, vif, sta, arg);
+ 	ath11k_peer_assoc_h_vht(ar, vif, sta, arg);
+ 	ath11k_peer_assoc_h_he(ar, vif, sta, arg);
+ 	ath11k_peer_assoc_h_qos(ar, vif, sta, arg);
+-	ath11k_peer_assoc_h_phymode(ar, vif, sta, arg);
+ 	ath11k_peer_assoc_h_smps(sta, arg);
+ 
+ 	/* TODO: amsdu_disable req? */
+@@ -4433,11 +4503,6 @@ ath11k_create_vht_cap(struct ath11k *ar,
+ 
+ 	ath11k_set_vht_txbf_cap(ar, &vht_cap.cap);
+ 
+-	/* TODO: Enable back VHT160 mode once association issues are fixed */
+-	/* Disabling VHT160 and VHT80+80 modes */
+-	vht_cap.cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
+-	vht_cap.cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
+-
+ 	rxmcs_map = 0;
+ 	txmcs_map = 0;
+ 	for (i = 0; i < 8; i++) {
+@@ -7355,7 +7420,9 @@ static int ath11k_mac_setup_iface_combin
+ 	combinations[0].radar_detect_widths = BIT(NL80211_CHAN_WIDTH_20_NOHT) |
+ 						BIT(NL80211_CHAN_WIDTH_20) |
+ 						BIT(NL80211_CHAN_WIDTH_40) |
+-						BIT(NL80211_CHAN_WIDTH_80);
++						BIT(NL80211_CHAN_WIDTH_80) |
++						BIT(NL80211_CHAN_WIDTH_80P80) |
++						BIT(NL80211_CHAN_WIDTH_160);
+ 
+ 	ar->hw->wiphy->iface_combinations = combinations;
+ 	ar->hw->wiphy->n_iface_combinations = 1;
+@@ -7494,6 +7561,10 @@ static int __ath11k_mac_register(struct
+ 	ieee80211_hw_set(ar->hw, SUPPORTS_TX_FRAG);
+ 	ieee80211_hw_set(ar->hw, REPORTS_LOW_ACK);
+ 	ieee80211_hw_set(ar->hw, SUPPORTS_TX_ENCAP_OFFLOAD);
++
++	if (cap->nss_ratio_enabled)
++		ieee80211_hw_set(ar->hw, SUPPORTS_VHT_EXT_NSS_BW);
++
+ 	if (ht_cap & WMI_HT_CAP_ENABLED) {
+ 		ieee80211_hw_set(ar->hw, AMPDU_AGGREGATION);
+ 		ieee80211_hw_set(ar->hw, TX_AMPDU_SETUP_IN_HW);
+--- a/drivers/net/wireless/ath/ath11k/mac.h
++++ b/drivers/net/wireless/ath/ath11k/mac.h
+@@ -115,6 +115,9 @@ struct ath11k_generic_iter {
+ #define WMI_MAX_SPATIAL_STREAM			3
+ 
+ #define ATH11K_CHAN_WIDTH_NUM			8
++#define ATH11K_BW_NSS_MAP_ENABLE		BIT(31)
++#define ATH11K_PEER_RX_NSS_160MHZ		GENMASK(2, 0)
++#define ATH11K_PEER_RX_NSS_80_80MHZ		GENMASK(5, 3)
+ 
+ #define ATH11K_OBSS_PD_MAX_THRESHOLD			-82
+ #define ATH11K_OBSS_PD_NON_SRG_MAX_THRESHOLD		-62
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -360,6 +360,10 @@ ath11k_pull_mac_phy_cap_svc_ready_ext(st
+ 		pdev_cap->he_mcs = mac_phy_caps->he_supp_mcs_5g;
+ 		pdev_cap->tx_chain_mask = mac_phy_caps->tx_chain_mask_5g;
+ 		pdev_cap->rx_chain_mask = mac_phy_caps->rx_chain_mask_5g;
++		pdev_cap->nss_ratio_enabled =
++			WMI_NSS_RATIO_ENABLE_DISABLE_GET(mac_phy_caps->nss_ratio);
++		pdev_cap->nss_ratio_info =
++			WMI_NSS_RATIO_INFO_GET(mac_phy_caps->nss_ratio);
+ 	} else {
+ 		return -EINVAL;
+ 	}
+@@ -783,14 +787,26 @@ int ath11k_wmi_vdev_down(struct ath11k *
+ static void ath11k_wmi_put_wmi_channel(struct wmi_channel *chan,
+ 				       struct wmi_vdev_start_req_arg *arg)
+ {
++	u32 center_freq1 = arg->channel.band_center_freq1;
++
+ 	memset(chan, 0, sizeof(*chan));
+ 
+ 	chan->mhz = arg->channel.freq;
+ 	chan->band_center_freq1 = arg->channel.band_center_freq1;
+-	if (arg->channel.mode == MODE_11AC_VHT80_80)
++
++	if (arg->channel.mode == MODE_11AX_HE160) {
++		if (arg->channel.freq > arg->channel.band_center_freq1)
++			chan->band_center_freq1 = center_freq1 + 40;
++		else
++			chan->band_center_freq1 = center_freq1 - 40;
++
++		chan->band_center_freq2 = arg->channel.band_center_freq1;
++
++	} else if (arg->channel.mode == MODE_11AC_VHT80_80) {
+ 		chan->band_center_freq2 = arg->channel.band_center_freq2;
+-	else
++	} else {
+ 		chan->band_center_freq2 = 0;
++	}
+ 
+ 	chan->info |= FIELD_PREP(WMI_CHAN_INFO_MODE, arg->channel.mode);
+ 	if (arg->channel.passive)
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -2146,6 +2146,24 @@ enum wmi_direct_buffer_module {
+ 	WMI_DIRECT_BUF_MAX
+ };
+ 
++/* enum wmi_nss_ratio - NSS ratio received from FW during service ready ext
++ *			event
++ * WMI_NSS_RATIO_1BY2_NSS -Max nss of 160MHz is equals to half of the max nss
++ *			   of 80MHz
++ * WMI_NSS_RATIO_3BY4_NSS - Max nss of 160MHz is equals to 3/4 of the max nss
++ *			    of 80MHz
++ * WMI_NSS_RATIO_1_NSS - Max nss of 160MHz is equals to the max nss of 80MHz
++ * WMI_NSS_RATIO_2_NSS - Max nss of 160MHz is equals to two times the max
++ *			 nss of 80MHz
++ */
++
++enum wmi_nss_ratio {
++	WMI_NSS_RATIO_1BY2_NSS = 0x0,
++	WMI_NSS_RATIO_3BY4_NSS = 0x1,
++	WMI_NSS_RATIO_1_NSS = 0x2,
++	WMI_NSS_RATIO_2_NSS = 0x3,
++};
++
+ struct wmi_host_pdev_band_to_mac {
+ 	u32 pdev_id;
+ 	u32 start_freq;
+@@ -2390,6 +2408,12 @@ struct wmi_hw_mode_capabilities {
+ } __packed;
+ 
+ #define WMI_MAX_HECAP_PHY_SIZE                 (3)
++#define WMI_NSS_RATIO_ENABLE_DISABLE_BITPOS    BIT(0)
++#define WMI_NSS_RATIO_ENABLE_DISABLE_GET(_val) \
++	FIELD_GET(WMI_NSS_RATIO_ENABLE_DISABLE_BITPOS, _val)
++#define WMI_NSS_RATIO_INFO_BITPOS              GENMASK(4, 1)
++#define WMI_NSS_RATIO_INFO_GET(_val) \
++	FIELD_GET(WMI_NSS_RATIO_INFO_BITPOS, _val)
+ 
+ struct wmi_mac_phy_capabilities {
+ 	u32 hw_mode_id;
+@@ -2423,6 +2447,12 @@ struct wmi_mac_phy_capabilities {
+ 	u32 he_cap_info_2g_ext;
+ 	u32 he_cap_info_5g_ext;
+ 	u32 he_cap_info_internal;
++	u32 wireless_modes;
++	u32 low_2ghz_chan_freq;
++	u32 high_2ghz_chan_freq;
++	u32 low_5ghz_chan_freq;
++	u32 high_5ghz_chan_freq;
++	u32 nss_ratio;
+ } __packed;
+ 
+ struct wmi_hal_reg_capabilities_ext {

package/kernel/mac80211/patches/ath11k/0010-wifi-ath11k-Fix-firmware-crash-on-vdev-delete-race-c.patch

@@ -1,116 +0,0 @@
-From 3811fa1f231f1a3e29759efef4992116604aab8b Mon Sep 17 00:00:00 2001
-From: Sowmiya Sree Elavalagan <quic_ssreeela@quicinc.com>
-Date: Tue, 11 Oct 2022 15:23:46 +0530
-Subject: [PATCH] wifi: ath11k: Fix firmware crash on vdev delete race
- condition
-
-Current code does not wait for vdev delete completion on vdev create
-failures and tries to send another vdev create followed by vdev set
-param to firmware with same vdev id. This causes firmware crash.
-Fix this crash by waiting for vdev delete completion on vdev
-create failures.
-
-Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.6.0.1-00905-QCAHKSWPL_SILICONZ-1
-
-Signed-off-by: Sowmiya Sree Elavalagan <quic_ssreeela@quicinc.com>
-Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
-Link: https://lore.kernel.org/r/20221011095346.3901-1-quic_ssreeela@quicinc.com
----
- drivers/net/wireless/ath/ath11k/mac.c | 60 +++++++++++++++++----------
- 1 file changed, 37 insertions(+), 23 deletions(-)
-
---- a/drivers/net/wireless/ath/ath11k/mac.c
-+++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -6233,6 +6233,40 @@ void ath11k_mac_11d_scan_stop_all(struct
- 	}
- }
- 
-+static int ath11k_mac_vdev_delete(struct ath11k *ar, struct ath11k_vif *arvif)
-+{
-+	unsigned long time_left;
-+	struct ieee80211_vif *vif = arvif->vif;
-+	int ret = 0;
-+
-+	lockdep_assert_held(&ar->conf_mutex);
-+
-+	reinit_completion(&ar->vdev_delete_done);
-+
-+	ret = ath11k_wmi_vdev_delete(ar, arvif->vdev_id);
-+	if (ret) {
-+		ath11k_warn(ar->ab, "failed to delete WMI vdev %d: %d\n",
-+			    arvif->vdev_id, ret);
-+		return ret;
-+	}
-+
-+	time_left = wait_for_completion_timeout(&ar->vdev_delete_done,
-+						ATH11K_VDEV_DELETE_TIMEOUT_HZ);
-+	if (time_left == 0) {
-+		ath11k_warn(ar->ab, "Timeout in receiving vdev delete response\n");
-+		return -ETIMEDOUT;
-+	}
-+
-+	ar->ab->free_vdev_map |= 1LL << (arvif->vdev_id);
-+	ar->allocated_vdev_map &= ~(1LL << arvif->vdev_id);
-+	ar->num_created_vdevs--;
-+
-+	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "vdev %pM deleted, vdev_id %d\n",
-+		   vif->addr, arvif->vdev_id);
-+
-+	return ret;
-+}
-+
- static int ath11k_mac_op_add_interface(struct ieee80211_hw *hw,
- 				       struct ieee80211_vif *vif)
- {
-@@ -6468,10 +6502,7 @@ err_peer_del:
- 	}
- 
- err_vdev_del:
--	ath11k_wmi_vdev_delete(ar, arvif->vdev_id);
--	ar->num_created_vdevs--;
--	ar->allocated_vdev_map &= ~(1LL << arvif->vdev_id);
--	ab->free_vdev_map |= 1LL << arvif->vdev_id;
-+	ath11k_mac_vdev_delete(ar, arvif);
- 	spin_lock_bh(&ar->data_lock);
- 	list_del(&arvif->list);
- 	spin_unlock_bh(&ar->data_lock);
-@@ -6499,7 +6530,6 @@ static void ath11k_mac_op_remove_interfa
- 	struct ath11k *ar = hw->priv;
- 	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
- 	struct ath11k_base *ab = ar->ab;
--	unsigned long time_left;
- 	int ret;
- 	int i;
- 
-@@ -6520,29 +6550,13 @@ static void ath11k_mac_op_remove_interfa
- 				    arvif->vdev_id, ret);
- 	}
- 
--	reinit_completion(&ar->vdev_delete_done);
--
--	ret = ath11k_wmi_vdev_delete(ar, arvif->vdev_id);
-+	ret = ath11k_mac_vdev_delete(ar, arvif);
- 	if (ret) {
--		ath11k_warn(ab, "failed to delete WMI vdev %d: %d\n",
-+		ath11k_warn(ab, "failed to delete vdev %d: %d\n",
- 			    arvif->vdev_id, ret);
- 		goto err_vdev_del;
- 	}
- 
--	time_left = wait_for_completion_timeout(&ar->vdev_delete_done,
--						ATH11K_VDEV_DELETE_TIMEOUT_HZ);
--	if (time_left == 0) {
--		ath11k_warn(ab, "Timeout in receiving vdev delete response\n");
--		goto err_vdev_del;
--	}
--
--	ab->free_vdev_map |= 1LL << (arvif->vdev_id);
--	ar->allocated_vdev_map &= ~(1LL << arvif->vdev_id);
--	ar->num_created_vdevs--;
--
--	ath11k_dbg(ab, ATH11K_DBG_MAC, "vdev %pM deleted, vdev_id %d\n",
--		   vif->addr, arvif->vdev_id);
--
- 	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
- 		clear_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags);
- 		ar->monitor_vdev_id = -1;

package/kernel/mac80211/patches/ath11k/0011-ath11k-Refactor-spectral-FFT-bin-size.patch

@@ -0,0 +1,165 @@
+From cc2ad7541486f1f755949c1ccd17e14a15bf1f4e Mon Sep 17 00:00:00 2001
+From: Karthikeyan Periyasamy <periyasa@codeaurora.org>
+Date: Fri, 24 Sep 2021 16:52:46 +0300
+Subject: [PATCH] ath11k: Refactor spectral FFT bin size
+
+In IPQ8074, actual FFT bin size is two bytes but hardware reports it
+with extra pad size of two bytes for each FFT bin. So finally each FFT
+bin advertise as four bytes size in the collected data. This FFT pad is
+not advertised in IPQ6018 platform. To accommodate this different
+behavior across the platforms, introduce the hw param fft_pad_sz and use
+it in spectral process. Also group all the spectral params under the new
+structure in hw param structure for scalable in future.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01492-QCAHKSWPL_SILICONZ-1
+Tested-on: IPQ6018 hw1.0 AHB WLAN.HK.2.4.0.1-00330-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Karthikeyan Periyasamy <periyasa@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210721180809.90960-2-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/core.c     | 33 +++++++++++++++++++---
+ drivers/net/wireless/ath/ath11k/hw.h       |  6 +++-
+ drivers/net/wireless/ath/ath11k/spectral.c | 13 ++++-----
+ 3 files changed, 40 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -59,7 +59,14 @@ static const struct ath11k_hw_params ath
+ 		.vdev_start_delay = false,
+ 		.htt_peer_map_v2 = true,
+ 		.tcl_0_only = false,
+-		.spectral_fft_sz = 2,
++
++		.spectral = {
++			.fft_sz = 2,
++			/* HW bug, expected BIN size is 2 bytes but HW report as 4 bytes.
++			 * so added pad size as 2 bytes to compensate the BIN size
++			 */
++			.fft_pad_sz = 2,
++		},
+ 
+ 		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
+ 					BIT(NL80211_IFTYPE_AP) |
+@@ -100,7 +107,11 @@ static const struct ath11k_hw_params ath
+ 		.vdev_start_delay = false,
+ 		.htt_peer_map_v2 = true,
+ 		.tcl_0_only = false,
+-		.spectral_fft_sz = 4,
++
++		.spectral = {
++			.fft_sz = 4,
++			.fft_pad_sz = 0,
++		},
+ 
+ 		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
+ 					BIT(NL80211_IFTYPE_AP) |
+@@ -141,7 +152,11 @@ static const struct ath11k_hw_params ath
+ 		.vdev_start_delay = true,
+ 		.htt_peer_map_v2 = false,
+ 		.tcl_0_only = true,
+-		.spectral_fft_sz = 0,
++
++		.spectral = {
++			.fft_sz = 0,
++			.fft_pad_sz = 0,
++		},
+ 
+ 		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
+ 					BIT(NL80211_IFTYPE_AP),
+@@ -180,6 +195,12 @@ static const struct ath11k_hw_params ath
+ 		.vdev_start_delay = false,
+ 		.htt_peer_map_v2 = true,
+ 		.tcl_0_only = false,
++
++		.spectral = {
++			.fft_sz = 0,
++			.fft_pad_sz = 0,
++		},
++
+ 		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
+ 					BIT(NL80211_IFTYPE_AP) |
+ 					BIT(NL80211_IFTYPE_MESH_POINT),
+@@ -219,7 +240,11 @@ static const struct ath11k_hw_params ath
+ 		.vdev_start_delay = true,
+ 		.htt_peer_map_v2 = false,
+ 		.tcl_0_only = true,
+-		.spectral_fft_sz = 0,
++
++		.spectral = {
++			.fft_sz = 0,
++			.fft_pad_sz = 0,
++		},
+ 
+ 		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
+ 					BIT(NL80211_IFTYPE_AP),
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -153,7 +153,11 @@ struct ath11k_hw_params {
+ 	bool vdev_start_delay;
+ 	bool htt_peer_map_v2;
+ 	bool tcl_0_only;
+-	u8 spectral_fft_sz;
++
++	struct {
++		u8 fft_sz;
++		u8 fft_pad_sz;
++	} spectral;
+ 
+ 	u16 interface_modes;
+ 	bool supports_monitor;
+--- a/drivers/net/wireless/ath/ath11k/spectral.c
++++ b/drivers/net/wireless/ath/ath11k/spectral.c
+@@ -11,8 +11,6 @@
+ #define ATH11K_SPECTRAL_EVENT_TIMEOUT_MS	1
+ 
+ #define ATH11K_SPECTRAL_DWORD_SIZE		4
+-/* HW bug, expected BIN size is 2 bytes but HW report as 4 bytes */
+-#define ATH11K_SPECTRAL_BIN_SIZE		4
+ #define ATH11K_SPECTRAL_ATH11K_MIN_BINS		64
+ #define ATH11K_SPECTRAL_ATH11K_MIN_IB_BINS	32
+ #define ATH11K_SPECTRAL_ATH11K_MAX_IB_BINS	256
+@@ -585,12 +583,12 @@ int ath11k_spectral_process_fft(struct a
+ 	struct spectral_tlv *tlv;
+ 	int tlv_len, bin_len, num_bins;
+ 	u16 length, freq;
+-	u8 chan_width_mhz;
++	u8 chan_width_mhz, bin_sz;
+ 	int ret;
+ 
+ 	lockdep_assert_held(&ar->spectral.lock);
+ 
+-	if (!ab->hw_params.spectral_fft_sz) {
++	if (!ab->hw_params.spectral.fft_sz) {
+ 		ath11k_warn(ab, "invalid bin size type for hw rev %d\n",
+ 			    ab->hw_rev);
+ 		return -EINVAL;
+@@ -608,7 +606,8 @@ int ath11k_spectral_process_fft(struct a
+ 		return -EINVAL;
+ 	}
+ 
+-	num_bins = bin_len / ATH11K_SPECTRAL_BIN_SIZE;
++	bin_sz = ab->hw_params.spectral.fft_sz + ab->hw_params.spectral.fft_pad_sz;
++	num_bins = bin_len / bin_sz;
+ 	/* Only In-band bins are useful to user for visualize */
+ 	num_bins >>= 1;
+ 
+@@ -658,7 +657,7 @@ int ath11k_spectral_process_fft(struct a
+ 	fft_sample->freq2 = __cpu_to_be16(freq);
+ 
+ 	ath11k_spectral_parse_fft(fft_sample->data, fft_report->bins, num_bins,
+-				  ab->hw_params.spectral_fft_sz);
++				  ab->hw_params.spectral.fft_sz);
+ 
+ 	fft_sample->max_exp = ath11k_spectral_get_max_exp(fft_sample->max_index,
+ 							  search.peak_mag,
+@@ -966,7 +965,7 @@ int ath11k_spectral_init(struct ath11k_b
+ 		      ab->wmi_ab.svc_map))
+ 		return 0;
+ 
+-	if (!ab->hw_params.spectral_fft_sz)
++	if (!ab->hw_params.spectral.fft_sz)
+ 		return 0;
+ 
+ 	for (i = 0; i < ab->num_radios; i++) {

package/kernel/mac80211/patches/ath11k/0011-wifi-ath11k-fix-monitor-vdev-creation-with-firmware-.patch

@@ -1,40 +0,0 @@
-From f3ca72b0327101a074a871539e61775d43908ca4 Mon Sep 17 00:00:00 2001
-From: Nagarajan Maran <quic_nmaran@quicinc.com>
-Date: Fri, 14 Oct 2022 21:20:54 +0530
-Subject: [PATCH] wifi: ath11k: fix monitor vdev creation with firmware
- recovery
-
-During firmware recovery, the monitor interface is not
-getting created in the driver and firmware since
-the respective flags are not updated properly.
-
-So after firmware recovery is successful, when monitor
-interface is brought down manually, firmware assertion
-is observed, since we are trying to bring down the
-interface which is not yet created in the firmware.
-
-Fix this by updating the monitor flags properly per
-phy#, during firmware recovery.
-
-Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
-
-Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
-Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
-Link: https://lore.kernel.org/r/20221014155054.11471-1-quic_nmaran@quicinc.com
----
- drivers/net/wireless/ath/ath11k/core.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
---- a/drivers/net/wireless/ath/ath11k/core.c
-+++ b/drivers/net/wireless/ath/ath11k/core.c
-@@ -1677,6 +1677,10 @@ void ath11k_core_pre_reconfigure_recover
- 			     ath11k_mac_tx_mgmt_pending_free, ar);
- 		idr_destroy(&ar->txmgmt_idr);
- 		wake_up(&ar->txmgmt_empty_waitq);
-+
-+		ar->monitor_vdev_id = -1;
-+		clear_bit(ATH11K_FLAG_MONITOR_STARTED, &ar->monitor_flags);
-+		clear_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags);
- 	}
- 
- 	wake_up(&ab->wmi_ab.tx_credits_wq);

package/kernel/mac80211/patches/ath11k/0012-ath11k-Introduce-spectral-hw-configurable-param.patch

@@ -0,0 +1,168 @@
+From 1cae9c0009d35cec94ad8e1b06ebcb2d704626bf Mon Sep 17 00:00:00 2001
+From: Karthikeyan Periyasamy <periyasa@codeaurora.org>
+Date: Fri, 24 Sep 2021 16:52:46 +0300
+Subject: [PATCH] ath11k: Introduce spectral hw configurable param
+
+Below parameters have been identified as configurable across the platforms.
+So to scale the spectral across the platforms, move these parameter
+into hw param.
+
+	1. Maximum FFT bins
+	2. Summary report pad size
+	3. FFT report header length
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01492-QCAHKSWPL_SILICONZ-1
+Tested-on: IPQ6018 hw1.0 AHB WLAN.HK.2.4.0.1-00330-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Karthikeyan Periyasamy <periyasa@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210721180809.90960-3-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/core.c     | 12 +++++++++
+ drivers/net/wireless/ath/ath11k/hw.h       |  3 +++
+ drivers/net/wireless/ath/ath11k/spectral.c | 29 +++++++++++-----------
+ 3 files changed, 30 insertions(+), 14 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -66,6 +66,9 @@ static const struct ath11k_hw_params ath
+ 			 * so added pad size as 2 bytes to compensate the BIN size
+ 			 */
+ 			.fft_pad_sz = 2,
++			.summary_pad_sz = 0,
++			.fft_hdr_len = 16,
++			.max_fft_bins = 512,
+ 		},
+ 
+ 		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
+@@ -111,6 +114,9 @@ static const struct ath11k_hw_params ath
+ 		.spectral = {
+ 			.fft_sz = 4,
+ 			.fft_pad_sz = 0,
++			.summary_pad_sz = 0,
++			.fft_hdr_len = 16,
++			.max_fft_bins = 512,
+ 		},
+ 
+ 		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
+@@ -156,6 +162,9 @@ static const struct ath11k_hw_params ath
+ 		.spectral = {
+ 			.fft_sz = 0,
+ 			.fft_pad_sz = 0,
++			.summary_pad_sz = 0,
++			.fft_hdr_len = 0,
++			.max_fft_bins = 0,
+ 		},
+ 
+ 		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
+@@ -244,6 +253,9 @@ static const struct ath11k_hw_params ath
+ 		.spectral = {
+ 			.fft_sz = 0,
+ 			.fft_pad_sz = 0,
++			.summary_pad_sz = 0,
++			.fft_hdr_len = 0,
++			.max_fft_bins = 0,
+ 		},
+ 
+ 		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -157,6 +157,9 @@ struct ath11k_hw_params {
+ 	struct {
+ 		u8 fft_sz;
+ 		u8 fft_pad_sz;
++		u8 summary_pad_sz;
++		u8 fft_hdr_len;
++		u16 max_fft_bins;
+ 	} spectral;
+ 
+ 	u16 interface_modes;
+--- a/drivers/net/wireless/ath/ath11k/spectral.c
++++ b/drivers/net/wireless/ath/ath11k/spectral.c
+@@ -11,20 +11,20 @@
+ #define ATH11K_SPECTRAL_EVENT_TIMEOUT_MS	1
+ 
+ #define ATH11K_SPECTRAL_DWORD_SIZE		4
+-#define ATH11K_SPECTRAL_ATH11K_MIN_BINS		64
+-#define ATH11K_SPECTRAL_ATH11K_MIN_IB_BINS	32
+-#define ATH11K_SPECTRAL_ATH11K_MAX_IB_BINS	256
++#define ATH11K_SPECTRAL_MIN_BINS		64
++#define ATH11K_SPECTRAL_MIN_IB_BINS		(ATH11K_SPECTRAL_MIN_BINS >> 1)
++#define ATH11K_SPECTRAL_MAX_IB_BINS(x)	((x)->hw_params.spectral.max_fft_bins >> 1)
+ 
+ #define ATH11K_SPECTRAL_SCAN_COUNT_MAX		4095
+ 
+ /* Max channel computed by sum of 2g and 5g band channels */
+ #define ATH11K_SPECTRAL_TOTAL_CHANNEL		41
+ #define ATH11K_SPECTRAL_SAMPLES_PER_CHANNEL	70
+-#define ATH11K_SPECTRAL_PER_SAMPLE_SIZE		(sizeof(struct fft_sample_ath11k) + \
+-						 ATH11K_SPECTRAL_ATH11K_MAX_IB_BINS)
++#define ATH11K_SPECTRAL_PER_SAMPLE_SIZE(x)	(sizeof(struct fft_sample_ath11k) + \
++						 ATH11K_SPECTRAL_MAX_IB_BINS(x))
+ #define ATH11K_SPECTRAL_TOTAL_SAMPLE		(ATH11K_SPECTRAL_TOTAL_CHANNEL * \
+ 						 ATH11K_SPECTRAL_SAMPLES_PER_CHANNEL)
+-#define ATH11K_SPECTRAL_SUB_BUFF_SIZE		ATH11K_SPECTRAL_PER_SAMPLE_SIZE
++#define ATH11K_SPECTRAL_SUB_BUFF_SIZE(x)	ATH11K_SPECTRAL_PER_SAMPLE_SIZE(x)
+ #define ATH11K_SPECTRAL_NUM_SUB_BUF		ATH11K_SPECTRAL_TOTAL_SAMPLE
+ 
+ #define ATH11K_SPECTRAL_20MHZ			20
+@@ -446,8 +446,8 @@ static ssize_t ath11k_write_file_spectra
+ 	if (kstrtoul(buf, 0, &val))
+ 		return -EINVAL;
+ 
+-	if (val < ATH11K_SPECTRAL_ATH11K_MIN_BINS ||
+-	    val > SPECTRAL_ATH11K_MAX_NUM_BINS)
++	if (val < ATH11K_SPECTRAL_MIN_BINS ||
++	    val > ar->ab->hw_params.spectral.max_fft_bins)
+ 		return -EINVAL;
+ 
+ 	if (!is_power_of_2(val))
+@@ -598,7 +598,7 @@ int ath11k_spectral_process_fft(struct a
+ 	tlv_len = FIELD_GET(SPECTRAL_TLV_HDR_LEN, __le32_to_cpu(tlv->header));
+ 	/* convert Dword into bytes */
+ 	tlv_len *= ATH11K_SPECTRAL_DWORD_SIZE;
+-	bin_len = tlv_len - (sizeof(*fft_report) - sizeof(*tlv));
++	bin_len = tlv_len - ab->hw_params.spectral.fft_hdr_len;
+ 
+ 	if (data_len < (bin_len + sizeof(*fft_report))) {
+ 		ath11k_warn(ab, "mismatch in expected bin len %d and data len %d\n",
+@@ -611,8 +611,8 @@ int ath11k_spectral_process_fft(struct a
+ 	/* Only In-band bins are useful to user for visualize */
+ 	num_bins >>= 1;
+ 
+-	if (num_bins < ATH11K_SPECTRAL_ATH11K_MIN_IB_BINS ||
+-	    num_bins > ATH11K_SPECTRAL_ATH11K_MAX_IB_BINS ||
++	if (num_bins < ATH11K_SPECTRAL_MIN_IB_BINS ||
++	    num_bins > ATH11K_SPECTRAL_MAX_IB_BINS(ab) ||
+ 	    !is_power_of_2(num_bins)) {
+ 		ath11k_warn(ab, "Invalid num of bins %d\n", num_bins);
+ 		return -EINVAL;
+@@ -693,7 +693,7 @@ static int ath11k_spectral_process_data(
+ 		goto unlock;
+ 	}
+ 
+-	sample_sz = sizeof(*fft_sample) + ATH11K_SPECTRAL_ATH11K_MAX_IB_BINS;
++	sample_sz = sizeof(*fft_sample) + ATH11K_SPECTRAL_MAX_IB_BINS(ab);
+ 	fft_sample = kmalloc(sample_sz, GFP_ATOMIC);
+ 	if (!fft_sample) {
+ 		ret = -ENOBUFS;
+@@ -741,7 +741,8 @@ static int ath11k_spectral_process_data(
+ 			 * is 4 DWORD size (16 bytes).
+ 			 * Need to remove this workaround once HW bug fixed
+ 			 */
+-			tlv_len = sizeof(*summary) - sizeof(*tlv);
++			tlv_len = sizeof(*summary) - sizeof(*tlv) +
++				  ab->hw_params.spectral.summary_pad_sz;
+ 
+ 			if (tlv_len < (sizeof(*summary) - sizeof(*tlv))) {
+ 				ath11k_warn(ab, "failed to parse spectral summary at bytes %d tlv_len:%d\n",
+@@ -904,7 +905,7 @@ static inline int ath11k_spectral_debug_
+ 
+ 	ar->spectral.rfs_scan = relay_open("spectral_scan",
+ 					   ar->debug.debugfs_pdev,
+-					   ATH11K_SPECTRAL_SUB_BUFF_SIZE,
++					   ATH11K_SPECTRAL_SUB_BUFF_SIZE(ar->ab),
+ 					   ATH11K_SPECTRAL_NUM_SUB_BUF,
+ 					   &rfs_scan_cb, NULL);
+ 	if (!ar->spectral.rfs_scan) {

package/kernel/mac80211/patches/ath11k/0012-wifi-ath11k-Fix-qmi_msg_handler-data-structure-initi.patch

@@ -1,33 +0,0 @@
-From ed3725e15a154ebebf44e0c34806c57525483f92 Mon Sep 17 00:00:00 2001
-From: Rahul Bhattacharjee <quic_rbhattac@quicinc.com>
-Date: Fri, 21 Oct 2022 14:31:26 +0530
-Subject: [PATCH] wifi: ath11k: Fix qmi_msg_handler data structure
- initialization
-
-qmi_msg_handler is required to be null terminated by QMI module.
-There might be a case where a handler for a msg id is not present in the
-handlers array which can lead to infinite loop while searching the handler
-and therefore out of bound access in qmi_invoke_handler().
-Hence update the initialization in qmi_msg_handler data structure.
-
-Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
-
-Signed-off-by: Rahul Bhattacharjee <quic_rbhattac@quicinc.com>
-Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
-Link: https://lore.kernel.org/r/20221021090126.28626-1-quic_rbhattac@quicinc.com
----
- drivers/net/wireless/ath/ath11k/qmi.c | 3 +++
- 1 file changed, 3 insertions(+)
-
---- a/drivers/net/wireless/ath/ath11k/qmi.c
-+++ b/drivers/net/wireless/ath/ath11k/qmi.c
-@@ -3090,6 +3090,9 @@ static const struct qmi_msg_handler ath1
- 			sizeof(struct qmi_wlfw_fw_init_done_ind_msg_v01),
- 		.fn = ath11k_qmi_msg_fw_init_done_cb,
- 	},
-+
-+	/* end of list */
-+	{},
- };
- 
- static int ath11k_qmi_ops_new_server(struct qmi_handle *qmi_hdl,

package/kernel/mac80211/patches/ath11k/0013-ath11k-Fix-the-spectral-minimum-FFT-bin-count.patch

@@ -0,0 +1,33 @@
+From 6dfd20c8a6cd1fcf2c68d86c9d678f42535f6ade Mon Sep 17 00:00:00 2001
+From: Karthikeyan Periyasamy <periyasa@codeaurora.org>
+Date: Fri, 24 Sep 2021 16:52:46 +0300
+Subject: [PATCH] ath11k: Fix the spectral minimum FFT bin count
+
+User was not able to configure the spectral with the FFT bin count 32.
+In all supported platforms, the expected minimum FFT bin count is 32 but
+it was wrongly defined as 64. This restrict the user to not configure
+down to the actually supported minimum FFT bin count. So update the
+minimum FFT bin count as 32.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01492-QCAHKSWPL_SILICONZ-1
+Tested-on: IPQ6018 hw1.0 AHB WLAN.HK.2.4.0.1-00330-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Karthikeyan Periyasamy <periyasa@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210721180809.90960-4-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/spectral.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/spectral.c
++++ b/drivers/net/wireless/ath/ath11k/spectral.c
+@@ -11,7 +11,7 @@
+ #define ATH11K_SPECTRAL_EVENT_TIMEOUT_MS	1
+ 
+ #define ATH11K_SPECTRAL_DWORD_SIZE		4
+-#define ATH11K_SPECTRAL_MIN_BINS		64
++#define ATH11K_SPECTRAL_MIN_BINS		32
+ #define ATH11K_SPECTRAL_MIN_IB_BINS		(ATH11K_SPECTRAL_MIN_BINS >> 1)
+ #define ATH11K_SPECTRAL_MAX_IB_BINS(x)	((x)->hw_params.spectral.max_fft_bins >> 1)
+ 

package/kernel/mac80211/patches/ath11k/0013-wifi-ath11k-synchronize-ath11k_mac_he_gi_to_nl80211_.patch

@@ -1,42 +0,0 @@
-From dd1c2322694522f674c874f5fa02ac5ae39135dd Mon Sep 17 00:00:00 2001
-From: "Jiri Slaby (SUSE)" <jirislaby@kernel.org>
-Date: Mon, 31 Oct 2022 12:43:41 +0100
-Subject: [PATCH] wifi: ath11k: synchronize
- ath11k_mac_he_gi_to_nl80211_he_gi()'s return type
-
-ath11k_mac_he_gi_to_nl80211_he_gi() generates a valid warning with gcc-13:
-  drivers/net/wireless/ath/ath11k/mac.c:321:20: error: conflicting types for 'ath11k_mac_he_gi_to_nl80211_he_gi' due to enum/integer mismatch; have 'enum nl80211_he_gi(u8)'
-  drivers/net/wireless/ath/ath11k/mac.h:166:5: note: previous declaration of 'ath11k_mac_he_gi_to_nl80211_he_gi' with type 'u32(u8)'
-
-I.e. the type of the return value ath11k_mac_he_gi_to_nl80211_he_gi() in
-the declaration is u32, while the definition spells enum nl80211_he_gi.
-Synchronize them to the latter.
-
-Cc: Martin Liska <mliska@suse.cz>
-Cc: Kalle Valo <kvalo@kernel.org>
-Cc: "David S. Miller" <davem@davemloft.net>
-Cc: Eric Dumazet <edumazet@google.com>
-Cc: Jakub Kicinski <kuba@kernel.org>
-Cc: Paolo Abeni <pabeni@redhat.com>
-Cc: ath11k@lists.infradead.org
-Cc: linux-wireless@vger.kernel.org
-Cc: netdev@vger.kernel.org
-Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
-Reviewed-by: Jeff Johnson <quic_jjohnson@quicinc.com>
-Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
-Link: https://lore.kernel.org/r/20221031114341.10377-1-jirislaby@kernel.org
----
- drivers/net/wireless/ath/ath11k/mac.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/net/wireless/ath/ath11k/mac.h
-+++ b/drivers/net/wireless/ath/ath11k/mac.h
-@@ -163,7 +163,7 @@ void ath11k_mac_drain_tx(struct ath11k *
- void ath11k_mac_peer_cleanup_all(struct ath11k *ar);
- int ath11k_mac_tx_mgmt_pending_free(int buf_id, void *skb, void *ctx);
- u8 ath11k_mac_bw_to_mac80211_bw(u8 bw);
--u32 ath11k_mac_he_gi_to_nl80211_he_gi(u8 sgi);
-+enum nl80211_he_gi ath11k_mac_he_gi_to_nl80211_he_gi(u8 sgi);
- enum nl80211_he_ru_alloc ath11k_mac_phy_he_ru_to_nl80211_he_ru_alloc(u16 ru_phy);
- enum nl80211_he_ru_alloc ath11k_mac_he_ru_tones_to_nl80211_he_ru_alloc(u16 ru_tones);
- enum ath11k_supported_bw ath11k_mac_mac80211_bw_to_ath11k_bw(enum rate_info_bw bw);

package/kernel/mac80211/patches/ath11k/0014-ath11k-Add-spectral-scan-support-for-QCN9074.patch

@@ -0,0 +1,36 @@
+From b72e86c07e9881d249fbb7511060692f3fb6b687 Mon Sep 17 00:00:00 2001
+From: Karthikeyan Periyasamy <periyasa@codeaurora.org>
+Date: Fri, 24 Sep 2021 16:52:46 +0300
+Subject: [PATCH] ath11k: Add spectral scan support for QCN9074
+
+Populate the below hw parameters as per the QCN9074 support
+	1. FFT bin size as two bytes
+	2. Maximum FFT bin count as 1024
+	3. Summary report pad size as 16
+	4. FFT report header length as 24
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01492-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Karthikeyan Periyasamy <periyasa@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210721180809.90960-5-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/core.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -206,8 +206,11 @@ static const struct ath11k_hw_params ath
+ 		.tcl_0_only = false,
+ 
+ 		.spectral = {
+-			.fft_sz = 0,
++			.fft_sz = 2,
+ 			.fft_pad_sz = 0,
++			.summary_pad_sz = 16,
++			.fft_hdr_len = 24,
++			.max_fft_bins = 1024,
+ 		},
+ 
+ 		.interface_modes = BIT(NL80211_IFTYPE_STATION) |

package/kernel/mac80211/patches/ath11k/0015-ath11k-Wstringop-overread-warning.patch

@@ -0,0 +1,44 @@
+From eb19efed836a51ee30a602abe2dd21a97c47bbcc Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 24 Sep 2021 16:52:52 +0300
+Subject: [PATCH] ath11k: Wstringop-overread warning
+
+gcc-11 with the kernel address sanitizer prints a warning for this
+driver:
+
+In function 'ath11k_peer_assoc_h_vht',
+    inlined from 'ath11k_peer_assoc_prepare' at drivers/net/wireless/ath/ath11k/mac.c:1632:2:
+drivers/net/wireless/ath/ath11k/mac.c:1164:13: error: 'ath11k_peer_assoc_h_vht_masked' reading 16 bytes from a region of size 4 [-Werror=stringop-overread]
+ 1164 |         if (ath11k_peer_assoc_h_vht_masked(vht_mcs_mask))
+      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/net/wireless/ath/ath11k/mac.c: In function 'ath11k_peer_assoc_prepare':
+drivers/net/wireless/ath/ath11k/mac.c:1164:13: note: referencing argument 1 of type 'const u16 *' {aka 'const short unsigned int *'}
+drivers/net/wireless/ath/ath11k/mac.c:969:1: note: in a call to function 'ath11k_peer_assoc_h_vht_masked'
+  969 | ath11k_peer_assoc_h_vht_masked(const u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
+      | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+According to analysis from gcc developers, this is a glitch in the
+way gcc tracks the size of struct members. This should really get
+fixed in gcc, but it's also easy to work around this instance
+by changing the function prototype to no include the length of
+the array.
+
+Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99673
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210322160253.4032422-5-arnd@kernel.org
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -1406,7 +1406,7 @@ ath11k_peer_assoc_h_ht_masked(const u8 h
+ }
+ 
+ static bool
+-ath11k_peer_assoc_h_vht_masked(const u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
++ath11k_peer_assoc_h_vht_masked(const u16 vht_mcs_mask[])
+ {
+ 	int nss;
+ 

package/kernel/mac80211/patches/ath11k/0016-ath11k-use-hw_params-to-access-board_size-and-cal_of.patch

@@ -0,0 +1,113 @@
+From c72aa32d6d1c04fa83d4c0e6849e4e60d9d39ae4 Mon Sep 17 00:00:00 2001
+From: Anilkumar Kolli <akolli@codeaurora.org>
+Date: Tue, 28 Sep 2021 12:05:39 +0300
+Subject: [PATCH] ath11k: use hw_params to access board_size and cal_offset
+
+Reuse board_size from hw_params, add cal_offset to hw params.
+This patch is clean up only, there is no change in functionality.
+
+cal_size was unused, so remove that.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-00009-QCAHKSWPL_SILICONZ-1
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01838-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210721201927.100369-2-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/core.c | 10 +++++-----
+ drivers/net/wireless/ath/ath11k/hw.h   |  2 +-
+ drivers/net/wireless/ath/ath11k/qmi.c  |  4 ++--
+ drivers/net/wireless/ath/ath11k/qmi.h  |  2 --
+ 4 files changed, 8 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -37,7 +37,7 @@ static const struct ath11k_hw_params ath
+ 		.fw = {
+ 			.dir = "IPQ8074/hw2.0",
+ 			.board_size = 256 * 1024,
+-			.cal_size = 256 * 1024,
++			.cal_offset = 128 * 1024,
+ 		},
+ 		.max_radios = 3,
+ 		.bdf_addr = 0x4B0C0000,
+@@ -88,7 +88,7 @@ static const struct ath11k_hw_params ath
+ 		.fw = {
+ 			.dir = "IPQ6018/hw1.0",
+ 			.board_size = 256 * 1024,
+-			.cal_size = 256 * 1024,
++			.cal_offset = 128 * 1024,
+ 		},
+ 		.max_radios = 2,
+ 		.bdf_addr = 0x4ABC0000,
+@@ -136,7 +136,7 @@ static const struct ath11k_hw_params ath
+ 		.fw = {
+ 			.dir = "QCA6390/hw2.0",
+ 			.board_size = 256 * 1024,
+-			.cal_size = 256 * 1024,
++			.cal_offset = 128 * 1024,
+ 		},
+ 		.max_radios = 3,
+ 		.bdf_addr = 0x4B0C0000,
+@@ -183,7 +183,7 @@ static const struct ath11k_hw_params ath
+ 		.fw = {
+ 			.dir = "QCN9074/hw1.0",
+ 			.board_size = 256 * 1024,
+-			.cal_size = 256 * 1024,
++			.cal_offset = 128 * 1024,
+ 		},
+ 		.max_radios = 1,
+ 		.single_pdev_only = false,
+@@ -230,7 +230,7 @@ static const struct ath11k_hw_params ath
+ 		.fw = {
+ 			.dir = "WCN6855/hw2.0",
+ 			.board_size = 256 * 1024,
+-			.cal_size = 256 * 1024,
++			.cal_offset = 128 * 1024,
+ 		},
+ 		.max_radios = 3,
+ 		.bdf_addr = 0x4B0C0000,
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -128,7 +128,7 @@ struct ath11k_hw_params {
+ 	struct {
+ 		const char *dir;
+ 		size_t board_size;
+-		size_t cal_size;
++		size_t cal_offset;
+ 	} fw;
+ 
+ 	const struct ath11k_hw_ops *hw_ops;
+--- a/drivers/net/wireless/ath/ath11k/qmi.c
++++ b/drivers/net/wireless/ath/ath11k/qmi.c
+@@ -1953,7 +1953,7 @@ ath11k_qmi_prepare_bdf_download(struct a
+ 		fw_size = min_t(u32, ab->hw_params.fw.board_size,
+ 				fw_entry->size);
+ 
+-		memcpy_toio(bdf_addr + ATH11K_QMI_CALDATA_OFFSET,
++		memcpy_toio(bdf_addr + ab->hw_params.fw.cal_offset,
+ 			    fw_entry->data, fw_size);
+ 
+ 		release_firmware(fw_entry);
+@@ -1979,7 +1979,7 @@ static int ath11k_qmi_load_bdf_fixed_add
+ 		return -ENOMEM;
+ 	memset(&resp, 0, sizeof(resp));
+ 
+-	bdf_addr = ioremap(ab->hw_params.bdf_addr, ATH11K_QMI_BDF_MAX_SIZE);
++	bdf_addr = ioremap(ab->hw_params.bdf_addr, ab->hw_params.fw.board_size);
+ 	if (!bdf_addr) {
+ 		ath11k_warn(ab, "failed ioremap for board file\n");
+ 		ret = -EIO;
+--- a/drivers/net/wireless/ath/ath11k/qmi.h
++++ b/drivers/net/wireless/ath/ath11k/qmi.h
+@@ -13,8 +13,6 @@
+ #define ATH11K_QMI_WLANFW_TIMEOUT_MS		5000
+ #define ATH11K_QMI_MAX_BDF_FILE_NAME_SIZE	64
+ #define ATH11K_QMI_CALDB_ADDRESS		0x4BA00000
+-#define ATH11K_QMI_BDF_MAX_SIZE			(256 * 1024)
+-#define ATH11K_QMI_CALDATA_OFFSET		(128 * 1024)
+ #define ATH11K_QMI_WLANFW_MAX_BUILD_ID_LEN_V01	128
+ #define ATH11K_QMI_WLFW_SERVICE_ID_V01		0x45
+ #define ATH11K_QMI_WLFW_SERVICE_VERS_V01	0x01

package/kernel/mac80211/patches/ath11k/0016-wifi-ath11k-Make-QMI-message-rules-const.patch

@@ -1,341 +0,0 @@
-From 93c1592889fca46d09d833455628bab05516cdbf Mon Sep 17 00:00:00 2001
-From: Jeff Johnson <quic_jjohnson@quicinc.com>
-Date: Wed, 14 Sep 2022 17:23:03 -0700
-Subject: [PATCH] wifi: ath11k: Make QMI message rules const
-
-Commit ff6d365898d4 ("soc: qcom: qmi: use const for struct
-qmi_elem_info") allows QMI message encoding/decoding rules to be
-const, so do that for ath11k.
-
-Compile tested only.
-
-Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com>
-Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
-Link: https://lore.kernel.org/r/20220915002303.12206-1-quic_jjohnson@quicinc.com
----
- drivers/net/wireless/ath/ath11k/qmi.c | 72 +++++++++++++--------------
- 1 file changed, 36 insertions(+), 36 deletions(-)
-
---- a/drivers/net/wireless/ath/ath11k/qmi.c
-+++ b/drivers/net/wireless/ath/ath11k/qmi.c
-@@ -29,7 +29,7 @@ module_param_named(cold_boot_cal, ath11k
- MODULE_PARM_DESC(cold_boot_cal,
- 		 "Decrease the channel switch time but increase the driver load time (Default: true)");
- 
--static struct qmi_elem_info qmi_wlanfw_host_cap_req_msg_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_host_cap_req_msg_v01_ei[] = {
- 	{
- 		.data_type	= QMI_OPT_FLAG,
- 		.elem_len	= 1,
-@@ -280,7 +280,7 @@ static struct qmi_elem_info qmi_wlanfw_h
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_host_cap_resp_msg_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_host_cap_resp_msg_v01_ei[] = {
- 	{
- 		.data_type	= QMI_STRUCT,
- 		.elem_len	= 1,
-@@ -297,7 +297,7 @@ static struct qmi_elem_info qmi_wlanfw_h
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_ind_register_req_msg_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_ind_register_req_msg_v01_ei[] = {
- 	{
- 		.data_type	= QMI_OPT_FLAG,
- 		.elem_len	= 1,
-@@ -522,7 +522,7 @@ static struct qmi_elem_info qmi_wlanfw_i
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_ind_register_resp_msg_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_ind_register_resp_msg_v01_ei[] = {
- 	{
- 		.data_type	= QMI_STRUCT,
- 		.elem_len	= 1,
-@@ -558,7 +558,7 @@ static struct qmi_elem_info qmi_wlanfw_i
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_mem_cfg_s_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_mem_cfg_s_v01_ei[] = {
- 	{
- 		.data_type	= QMI_UNSIGNED_8_BYTE,
- 		.elem_len	= 1,
-@@ -590,7 +590,7 @@ static struct qmi_elem_info qmi_wlanfw_m
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_mem_seg_s_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_mem_seg_s_v01_ei[] = {
- 	{
- 		.data_type	= QMI_UNSIGNED_4_BYTE,
- 		.elem_len	= 1,
-@@ -632,7 +632,7 @@ static struct qmi_elem_info qmi_wlanfw_m
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_request_mem_ind_msg_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_request_mem_ind_msg_v01_ei[] = {
- 	{
- 		.data_type	= QMI_DATA_LEN,
- 		.elem_len	= 1,
-@@ -659,7 +659,7 @@ static struct qmi_elem_info qmi_wlanfw_r
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_mem_seg_resp_s_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_mem_seg_resp_s_v01_ei[] = {
- 	{
- 		.data_type	= QMI_UNSIGNED_8_BYTE,
- 		.elem_len	= 1,
-@@ -699,7 +699,7 @@ static struct qmi_elem_info qmi_wlanfw_m
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_respond_mem_req_msg_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_respond_mem_req_msg_v01_ei[] = {
- 	{
- 		.data_type	= QMI_DATA_LEN,
- 		.elem_len	= 1,
-@@ -726,7 +726,7 @@ static struct qmi_elem_info qmi_wlanfw_r
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_respond_mem_resp_msg_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_respond_mem_resp_msg_v01_ei[] = {
- 	{
- 		.data_type	= QMI_STRUCT,
- 		.elem_len	= 1,
-@@ -744,7 +744,7 @@ static struct qmi_elem_info qmi_wlanfw_r
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_cap_req_msg_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_cap_req_msg_v01_ei[] = {
- 	{
- 		.data_type	= QMI_EOTI,
- 		.array_type	= NO_ARRAY,
-@@ -752,7 +752,7 @@ static struct qmi_elem_info qmi_wlanfw_c
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_device_info_req_msg_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_device_info_req_msg_v01_ei[] = {
- 	{
- 		.data_type      = QMI_EOTI,
- 		.array_type     = NO_ARRAY,
-@@ -760,7 +760,7 @@ static struct qmi_elem_info qmi_wlanfw_d
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlfw_device_info_resp_msg_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlfw_device_info_resp_msg_v01_ei[] = {
- 	{
- 		.data_type	= QMI_STRUCT,
- 		.elem_len	= 1,
-@@ -814,7 +814,7 @@ static struct qmi_elem_info qmi_wlfw_dev
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_rf_chip_info_s_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_rf_chip_info_s_v01_ei[] = {
- 	{
- 		.data_type	= QMI_UNSIGNED_4_BYTE,
- 		.elem_len	= 1,
-@@ -840,7 +840,7 @@ static struct qmi_elem_info qmi_wlanfw_r
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_rf_board_info_s_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_rf_board_info_s_v01_ei[] = {
- 	{
- 		.data_type	= QMI_UNSIGNED_4_BYTE,
- 		.elem_len	= 1,
-@@ -857,7 +857,7 @@ static struct qmi_elem_info qmi_wlanfw_r
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_soc_info_s_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_soc_info_s_v01_ei[] = {
- 	{
- 		.data_type	= QMI_UNSIGNED_4_BYTE,
- 		.elem_len	= 1,
-@@ -873,7 +873,7 @@ static struct qmi_elem_info qmi_wlanfw_s
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_fw_version_info_s_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_fw_version_info_s_v01_ei[] = {
- 	{
- 		.data_type	= QMI_UNSIGNED_4_BYTE,
- 		.elem_len	= 1,
-@@ -899,7 +899,7 @@ static struct qmi_elem_info qmi_wlanfw_f
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_cap_resp_msg_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_cap_resp_msg_v01_ei[] = {
- 	{
- 		.data_type	= QMI_STRUCT,
- 		.elem_len	= 1,
-@@ -1100,7 +1100,7 @@ static struct qmi_elem_info qmi_wlanfw_c
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_bdf_download_req_msg_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_bdf_download_req_msg_v01_ei[] = {
- 	{
- 		.data_type	= QMI_UNSIGNED_1_BYTE,
- 		.elem_len	= 1,
-@@ -1235,7 +1235,7 @@ static struct qmi_elem_info qmi_wlanfw_b
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_bdf_download_resp_msg_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_bdf_download_resp_msg_v01_ei[] = {
- 	{
- 		.data_type	= QMI_STRUCT,
- 		.elem_len	= 1,
-@@ -1253,7 +1253,7 @@ static struct qmi_elem_info qmi_wlanfw_b
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_m3_info_req_msg_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_m3_info_req_msg_v01_ei[] = {
- 	{
- 		.data_type	= QMI_UNSIGNED_8_BYTE,
- 		.elem_len	= 1,
-@@ -1277,7 +1277,7 @@ static struct qmi_elem_info qmi_wlanfw_m
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_m3_info_resp_msg_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_m3_info_resp_msg_v01_ei[] = {
- 	{
- 		.data_type	= QMI_STRUCT,
- 		.elem_len	= 1,
-@@ -1294,7 +1294,7 @@ static struct qmi_elem_info qmi_wlanfw_m
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_ce_tgt_pipe_cfg_s_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_ce_tgt_pipe_cfg_s_v01_ei[] = {
- 	{
- 		.data_type	= QMI_UNSIGNED_4_BYTE,
- 		.elem_len	= 1,
-@@ -1347,7 +1347,7 @@ static struct qmi_elem_info qmi_wlanfw_c
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_ce_svc_pipe_cfg_s_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_ce_svc_pipe_cfg_s_v01_ei[] = {
- 	{
- 		.data_type	= QMI_UNSIGNED_4_BYTE,
- 		.elem_len	= 1,
-@@ -1382,7 +1382,7 @@ static struct qmi_elem_info qmi_wlanfw_c
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_shadow_reg_cfg_s_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_shadow_reg_cfg_s_v01_ei[] = {
- 	{
- 		.data_type	= QMI_UNSIGNED_2_BYTE,
- 		.elem_len	= 1,
-@@ -1406,7 +1406,7 @@ static struct qmi_elem_info qmi_wlanfw_s
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_shadow_reg_v2_cfg_s_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_shadow_reg_v2_cfg_s_v01_ei[] = {
- 	{
- 		.data_type	= QMI_UNSIGNED_4_BYTE,
- 		.elem_len	= 1,
-@@ -1423,7 +1423,7 @@ static struct qmi_elem_info qmi_wlanfw_s
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_wlan_mode_req_msg_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_wlan_mode_req_msg_v01_ei[] = {
- 	{
- 		.data_type	= QMI_UNSIGNED_4_BYTE,
- 		.elem_len	= 1,
-@@ -1458,7 +1458,7 @@ static struct qmi_elem_info qmi_wlanfw_w
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_wlan_mode_resp_msg_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_wlan_mode_resp_msg_v01_ei[] = {
- 	{
- 		.data_type	= QMI_STRUCT,
- 		.elem_len	= 1,
-@@ -1476,7 +1476,7 @@ static struct qmi_elem_info qmi_wlanfw_w
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_wlan_cfg_req_msg_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_wlan_cfg_req_msg_v01_ei[] = {
- 	{
- 		.data_type	= QMI_OPT_FLAG,
- 		.elem_len	= 1,
-@@ -1615,7 +1615,7 @@ static struct qmi_elem_info qmi_wlanfw_w
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_wlan_cfg_resp_msg_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_wlan_cfg_resp_msg_v01_ei[] = {
- 	{
- 		.data_type	= QMI_STRUCT,
- 		.elem_len	= 1,
-@@ -1632,28 +1632,28 @@ static struct qmi_elem_info qmi_wlanfw_w
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_mem_ready_ind_msg_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_mem_ready_ind_msg_v01_ei[] = {
- 	{
- 		.data_type = QMI_EOTI,
- 		.array_type = NO_ARRAY,
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_fw_ready_ind_msg_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_fw_ready_ind_msg_v01_ei[] = {
- 	{
- 		.data_type = QMI_EOTI,
- 		.array_type = NO_ARRAY,
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_cold_boot_cal_done_ind_msg_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_cold_boot_cal_done_ind_msg_v01_ei[] = {
- 	{
- 		.data_type = QMI_EOTI,
- 		.array_type = NO_ARRAY,
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_wlan_ini_req_msg_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_wlan_ini_req_msg_v01_ei[] = {
- 	{
- 		.data_type	= QMI_OPT_FLAG,
- 		.elem_len	= 1,
-@@ -1679,7 +1679,7 @@ static struct qmi_elem_info qmi_wlanfw_w
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlanfw_wlan_ini_resp_msg_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlanfw_wlan_ini_resp_msg_v01_ei[] = {
- 	{
- 		.data_type	= QMI_STRUCT,
- 		.elem_len	= 1,
-@@ -1697,7 +1697,7 @@ static struct qmi_elem_info qmi_wlanfw_w
- 	},
- };
- 
--static struct qmi_elem_info qmi_wlfw_fw_init_done_ind_msg_v01_ei[] = {
-+static const struct qmi_elem_info qmi_wlfw_fw_init_done_ind_msg_v01_ei[] = {
- 	{
- 		.data_type = QMI_EOTI,
- 		.array_type = NO_ARRAY,

package/kernel/mac80211/patches/ath11k/0017-ath11k-clean-up-BDF-download-functions.patch

@@ -0,0 +1,357 @@
+From 336e7b53c82fc74d261024773a0fab43623a94fb Mon Sep 17 00:00:00 2001
+From: Anilkumar Kolli <akolli@codeaurora.org>
+Date: Tue, 28 Sep 2021 12:05:39 +0300
+Subject: [PATCH] ath11k: clean up BDF download functions
+
+In current code, AHB/PCI uses two separate functions to download
+BDF file. Refactor code and make a common function to send QMI BDF
+download request for both AHB and PCI devices. This patch has no
+functional change.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-00009-QCAHKSWPL_SILICONZ-1
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01838-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210721201927.100369-3-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/qmi.c | 248 +++++++++++---------------
+ 1 file changed, 101 insertions(+), 147 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/qmi.c
++++ b/drivers/net/wireless/ath/ath11k/qmi.c
+@@ -1917,98 +1917,72 @@ out:
+ 	return ret;
+ }
+ 
+-static int
+-ath11k_qmi_prepare_bdf_download(struct ath11k_base *ab, int type,
+-				struct qmi_wlanfw_bdf_download_req_msg_v01 *req,
+-				void __iomem *bdf_addr)
+-{
+-	const struct firmware *fw_entry;
+-	struct ath11k_board_data bd;
+-	u32 fw_size;
+-	int ret;
+-
+-	switch (type) {
+-	case ATH11K_QMI_FILE_TYPE_BDF_GOLDEN:
+-		memset(&bd, 0, sizeof(bd));
+-
+-		ret = ath11k_core_fetch_bdf(ab, &bd);
+-		if (ret) {
+-			ath11k_warn(ab, "failed to load board file: %d\n", ret);
+-			return ret;
+-		}
+-
+-		fw_size = min_t(u32, ab->hw_params.fw.board_size, bd.len);
+-		memcpy_toio(bdf_addr, bd.data, fw_size);
+-		ath11k_core_free_bdf(ab, &bd);
+-		break;
+-	case ATH11K_QMI_FILE_TYPE_CALDATA:
+-		fw_entry = ath11k_core_firmware_request(ab, ATH11K_DEFAULT_CAL_FILE);
+-		if (IS_ERR(fw_entry)) {
+-			ret = PTR_ERR(fw_entry);
+-			ath11k_warn(ab, "failed to load %s: %d\n",
+-				    ATH11K_DEFAULT_CAL_FILE, ret);
+-			return ret;
+-		}
+-
+-		fw_size = min_t(u32, ab->hw_params.fw.board_size,
+-				fw_entry->size);
+-
+-		memcpy_toio(bdf_addr + ab->hw_params.fw.cal_offset,
+-			    fw_entry->data, fw_size);
+-
+-		release_firmware(fw_entry);
+-		break;
+-	default:
+-		return -EINVAL;
+-	}
+-
+-	req->total_size = fw_size;
+-	return 0;
+-}
+-
+-static int ath11k_qmi_load_bdf_fixed_addr(struct ath11k_base *ab)
++static int ath11k_qmi_load_file_target_mem(struct ath11k_base *ab,
++					   const u8 *data, u32 len, u8 type)
+ {
+ 	struct qmi_wlanfw_bdf_download_req_msg_v01 *req;
+ 	struct qmi_wlanfw_bdf_download_resp_msg_v01 resp;
+ 	struct qmi_txn txn = {};
++	const u8 *temp = data;
+ 	void __iomem *bdf_addr = NULL;
+-	int type, ret;
++	int ret;
++	u32 remaining = len;
+ 
+ 	req = kzalloc(sizeof(*req), GFP_KERNEL);
+ 	if (!req)
+ 		return -ENOMEM;
++
+ 	memset(&resp, 0, sizeof(resp));
+ 
+-	bdf_addr = ioremap(ab->hw_params.bdf_addr, ab->hw_params.fw.board_size);
+-	if (!bdf_addr) {
+-		ath11k_warn(ab, "failed ioremap for board file\n");
+-		ret = -EIO;
+-		goto out;
++	if (ab->bus_params.fixed_bdf_addr) {
++		bdf_addr = ioremap(ab->hw_params.bdf_addr, ab->hw_params.fw.board_size);
++		if (!bdf_addr) {
++			ath11k_warn(ab, "qmi ioremap error for bdf_addr\n");
++			ret = -EIO;
++			goto err_free_req;
++		}
+ 	}
+ 
+-	for (type = 0; type < ATH11K_QMI_MAX_FILE_TYPE; type++) {
++	while (remaining) {
+ 		req->valid = 1;
+ 		req->file_id_valid = 1;
+ 		req->file_id = ab->qmi.target.board_id;
+ 		req->total_size_valid = 1;
++		req->total_size = remaining;
+ 		req->seg_id_valid = 1;
+-		req->seg_id = type;
+-		req->data_valid = 0;
+-		req->data_len = ATH11K_QMI_MAX_BDF_FILE_NAME_SIZE;
+-		req->bdf_type = 0;
+-		req->bdf_type_valid = 0;
++		req->data_valid = 1;
++		req->bdf_type = type;
++		req->bdf_type_valid = 1;
+ 		req->end_valid = 1;
+-		req->end = 1;
++		req->end = 0;
+ 
+-		ret = ath11k_qmi_prepare_bdf_download(ab, type, req, bdf_addr);
+-		if (ret < 0)
+-			goto out_qmi_bdf;
++		if (remaining > QMI_WLANFW_MAX_DATA_SIZE_V01) {
++			req->data_len = QMI_WLANFW_MAX_DATA_SIZE_V01;
++		} else {
++			req->data_len = remaining;
++			req->end = 1;
++		}
++
++		if (ab->bus_params.fixed_bdf_addr) {
++			req->data_valid = 0;
++			req->end = 1;
++			req->data_len = ATH11K_QMI_MAX_BDF_FILE_NAME_SIZE;
++		} else {
++			memcpy(req->data, temp, req->data_len);
++		}
++
++		if (ab->bus_params.fixed_bdf_addr) {
++			if (type == ATH11K_QMI_FILE_TYPE_CALDATA)
++				bdf_addr += ab->hw_params.fw.cal_offset;
++
++			memcpy_toio(bdf_addr, temp, len);
++		}
+ 
+ 		ret = qmi_txn_init(&ab->qmi.handle, &txn,
+ 				   qmi_wlanfw_bdf_download_resp_msg_v01_ei,
+ 				   &resp);
+ 		if (ret < 0)
+-			goto out_qmi_bdf;
++			goto err_iounmap;
+ 
+ 		ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi bdf download req fixed addr type %d\n",
+ 			   type);
+@@ -2019,54 +1993,59 @@ static int ath11k_qmi_load_bdf_fixed_add
+ 				       qmi_wlanfw_bdf_download_req_msg_v01_ei, req);
+ 		if (ret < 0) {
+ 			qmi_txn_cancel(&txn);
+-			goto out_qmi_bdf;
++			goto err_iounmap;
+ 		}
+ 
+ 		ret = qmi_txn_wait(&txn, msecs_to_jiffies(ATH11K_QMI_WLANFW_TIMEOUT_MS));
+-		if (ret < 0)
+-			goto out_qmi_bdf;
++		if (ret < 0) {
++			ath11k_warn(ab, "failed to wait board file download request: %d\n",
++				    ret);
++			goto err_iounmap;
++		}
+ 
+ 		if (resp.resp.result != QMI_RESULT_SUCCESS_V01) {
+ 			ath11k_warn(ab, "board file download request failed: %d %d\n",
+ 				    resp.resp.result, resp.resp.error);
+ 			ret = -EINVAL;
+-			goto out_qmi_bdf;
++			goto err_iounmap;
++		}
++
++		if (ab->bus_params.fixed_bdf_addr) {
++			remaining = 0;
++		} else {
++			remaining -= req->data_len;
++			temp += req->data_len;
++			req->seg_id++;
++			ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi bdf download request remaining %i\n",
++				   remaining);
+ 		}
+ 	}
+ 
+-out_qmi_bdf:
+-	iounmap(bdf_addr);
+-out:
++err_iounmap:
++	if (ab->bus_params.fixed_bdf_addr)
++		iounmap(bdf_addr);
++
++err_free_req:
+ 	kfree(req);
++
+ 	return ret;
+ }
+ 
+ static int ath11k_qmi_load_bdf_qmi(struct ath11k_base *ab)
+ {
+-	struct qmi_wlanfw_bdf_download_req_msg_v01 *req;
+-	struct qmi_wlanfw_bdf_download_resp_msg_v01 resp;
++	char filename[ATH11K_QMI_MAX_BDF_FILE_NAME_SIZE];
++	const struct firmware *fw_entry;
+ 	struct ath11k_board_data bd;
+-	unsigned int remaining;
+-	struct qmi_txn txn = {};
+-	int ret;
+-	const u8 *temp;
+-	int bdf_type;
+-
+-	req = kzalloc(sizeof(*req), GFP_KERNEL);
+-	if (!req)
+-		return -ENOMEM;
+-	memset(&resp, 0, sizeof(resp));
++	u32 fw_size, file_type;
++	int ret = 0, bdf_type;
+ 
+ 	memset(&bd, 0, sizeof(bd));
+ 	ret = ath11k_core_fetch_bdf(ab, &bd);
+ 	if (ret) {
+-		ath11k_warn(ab, "failed to fetch board file: %d\n", ret);
++		ath11k_warn(ab, "qmi failed to fetch board file: %d\n", ret);
+ 		goto out;
+ 	}
+ 
+-	temp = bd.data;
+-	remaining = bd.len;
+-
+ 	if (bd.len >= SELFMAG && memcmp(bd.data, ELFMAG, SELFMAG) == 0)
+ 		bdf_type = ATH11K_QMI_BDF_TYPE_ELF;
+ 	else
+@@ -2074,67 +2053,45 @@ static int ath11k_qmi_load_bdf_qmi(struc
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi bdf_type %d\n", bdf_type);
+ 
+-	while (remaining) {
+-		req->valid = 1;
+-		req->file_id_valid = 1;
+-		req->file_id = ab->qmi.target.board_id;
+-		req->total_size_valid = 1;
+-		req->total_size = bd.len;
+-		req->seg_id_valid = 1;
+-		req->data_valid = 1;
+-		req->data_len = ATH11K_QMI_MAX_BDF_FILE_NAME_SIZE;
+-		req->bdf_type = bdf_type;
+-		req->bdf_type_valid = 1;
+-		req->end_valid = 1;
+-		req->end = 0;
+-
+-		if (remaining > QMI_WLANFW_MAX_DATA_SIZE_V01) {
+-			req->data_len = QMI_WLANFW_MAX_DATA_SIZE_V01;
+-		} else {
+-			req->data_len = remaining;
+-			req->end = 1;
+-		}
+-
+-		memcpy(req->data, temp, req->data_len);
+-
+-		ret = qmi_txn_init(&ab->qmi.handle, &txn,
+-				   qmi_wlanfw_bdf_download_resp_msg_v01_ei,
+-				   &resp);
+-		if (ret < 0)
+-			goto out_qmi_bdf;
++	fw_size = bd.len;
++	fw_size = min_t(u32, ab->hw_params.fw.board_size, bd.len);
+ 
+-		ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi bdf download request remaining %i\n",
+-			   remaining);
++	ret = ath11k_qmi_load_file_target_mem(ab, bd.data, fw_size, bdf_type);
++	if (ret < 0) {
++		ath11k_warn(ab, "qmi failed to load bdf file\n");
++		goto out;
++	}
+ 
+-		ret = qmi_send_request(&ab->qmi.handle, NULL, &txn,
+-				       QMI_WLANFW_BDF_DOWNLOAD_REQ_V01,
+-				       QMI_WLANFW_BDF_DOWNLOAD_REQ_MSG_V01_MAX_LEN,
+-				       qmi_wlanfw_bdf_download_req_msg_v01_ei, req);
+-		if (ret < 0) {
+-			qmi_txn_cancel(&txn);
+-			goto out_qmi_bdf;
+-		}
++	/* QCA6390 does not support cal data file, skip it */
++	if (bdf_type == ATH11K_QMI_BDF_TYPE_ELF)
++		goto out;
+ 
+-		ret = qmi_txn_wait(&txn, msecs_to_jiffies(ATH11K_QMI_WLANFW_TIMEOUT_MS));
+-		if (ret < 0)
+-			goto out_qmi_bdf;
++	file_type = ATH11K_QMI_FILE_TYPE_CALDATA;
++	fw_entry = ath11k_core_firmware_request(ab, ATH11K_DEFAULT_CAL_FILE);
++	if (IS_ERR(fw_entry)) {
++		ret = PTR_ERR(fw_entry);
++		ath11k_warn(ab,
++			    "qmi failed to load CAL data file:%s\n",
++			    filename);
++		goto out;
++	}
+ 
+-		if (resp.resp.result != QMI_RESULT_SUCCESS_V01) {
+-			ath11k_warn(ab, "bdf download request failed: %d %d\n",
+-				    resp.resp.result, resp.resp.error);
+-			ret = resp.resp.result;
+-			goto out_qmi_bdf;
+-		}
+-		remaining -= req->data_len;
+-		temp += req->data_len;
+-		req->seg_id++;
++	fw_size = min_t(u32, ab->hw_params.fw.board_size, fw_entry->size);
++	ret = ath11k_qmi_load_file_target_mem(ab, fw_entry->data, fw_size, file_type);
++	if (ret < 0) {
++		ath11k_warn(ab, "qmi failed to load caldata\n");
++		goto out_qmi_cal;
+ 	}
+ 
+-out_qmi_bdf:
+-	ath11k_core_free_bdf(ab, &bd);
++	ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi caldata downloaded: type: %u\n",
++		   file_type);
+ 
++out_qmi_cal:
++	release_firmware(fw_entry);
+ out:
+-	kfree(req);
++	ath11k_core_free_bdf(ab, &bd);
++	ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi BDF download sequence completed\n");
++
+ 	return ret;
+ }
+ 
+@@ -2519,10 +2476,7 @@ static int ath11k_qmi_event_load_bdf(str
+ 		return ret;
+ 	}
+ 
+-	if (ab->bus_params.fixed_bdf_addr)
+-		ret = ath11k_qmi_load_bdf_fixed_addr(ab);
+-	else
+-		ret = ath11k_qmi_load_bdf_qmi(ab);
++	ret = ath11k_qmi_load_bdf_qmi(ab);
+ 	if (ret < 0) {
+ 		ath11k_warn(ab, "failed to load board data file: %d\n", ret);
+ 		return ret;

package/kernel/mac80211/patches/ath11k/0017-wifi-ath11k-Trigger-sta-disconnect-on-hardware-resta.patch

@@ -1,119 +0,0 @@
-From a018750a2cceaf4427c4ee3d9ce3e83a171d5bd6 Mon Sep 17 00:00:00 2001
-From: Youghandhar Chintala <quic_youghand@quicinc.com>
-Date: Fri, 4 Nov 2022 14:24:03 +0530
-Subject: [PATCH] wifi: ath11k: Trigger sta disconnect on hardware restart
-
-Currently after the hardware restart triggered from the driver, the
-station interface connection remains intact, since a disconnect trigger
-is not sent to userspace. This can lead to a problem in targets where
-the wifi mac sequence is added by the firmware.
-
-After the target restart, its wifi mac sequence number gets reset to
-zero. Hence AP to which our device is connected will receive frames with
-a  wifi mac sequence number jump to the past, thereby resulting in the
-AP dropping all these frames, until the frame arrives with a wifi mac
-sequence number which AP was expecting.
-
-To avoid such frame drops, its better to trigger a station disconnect
-upon target hardware restart which can be done with API
-ieee80211_reconfig_disconnect exposed to mac80211.
-
-The other targets are not affected by this change, since the hardware
-params flag is not set.
-
-Reported-by: kernel test robot <lkp@intel.com>
-
-Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.1.0.1-00887-QCAMSLSWPLZ-1
-
-Signed-off-by: Youghandhar Chintala <quic_youghand@quicinc.com>
-Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
-Link: https://lore.kernel.org/r/20221104085403.11025-1-quic_youghand@quicinc.com
----
- drivers/net/wireless/ath/ath11k/core.c | 6 ++++++
- drivers/net/wireless/ath/ath11k/hw.h   | 1 +
- drivers/net/wireless/ath/ath11k/mac.c  | 7 +++++++
- 3 files changed, 14 insertions(+)
-
---- a/drivers/net/wireless/ath/ath11k/core.c
-+++ b/drivers/net/wireless/ath/ath11k/core.c
-@@ -195,6 +195,7 @@ static const struct ath11k_hw_params ath
- 		.tcl_ring_retry = true,
- 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
- 		.smp2p_wow_exit = false,
-+		.support_fw_mac_sequence = false,
- 	},
- 	{
- 		.name = "qca6390 hw2.0",
-@@ -277,6 +278,7 @@ static const struct ath11k_hw_params ath
- 		.tcl_ring_retry = true,
- 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
- 		.smp2p_wow_exit = false,
-+		.support_fw_mac_sequence = true,
- 	},
- 	{
- 		.name = "qcn9074 hw1.0",
-@@ -356,6 +358,7 @@ static const struct ath11k_hw_params ath
- 		.tcl_ring_retry = true,
- 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
- 		.smp2p_wow_exit = false,
-+		.support_fw_mac_sequence = false,
- 	},
- 	{
- 		.name = "wcn6855 hw2.0",
-@@ -438,6 +441,7 @@ static const struct ath11k_hw_params ath
- 		.tcl_ring_retry = true,
- 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
- 		.smp2p_wow_exit = false,
-+		.support_fw_mac_sequence = true,
- 	},
- 	{
- 		.name = "wcn6855 hw2.1",
-@@ -519,6 +523,7 @@ static const struct ath11k_hw_params ath
- 		.tcl_ring_retry = true,
- 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
- 		.smp2p_wow_exit = false,
-+		.support_fw_mac_sequence = true,
- 	},
- 	{
- 		.name = "wcn6750 hw1.0",
-@@ -597,6 +602,7 @@ static const struct ath11k_hw_params ath
- 		.tcl_ring_retry = false,
- 		.tx_ring_size = DP_TCL_DATA_RING_SIZE_WCN6750,
- 		.smp2p_wow_exit = true,
-+		.support_fw_mac_sequence = true,
- 	},
- };
- 
---- a/drivers/net/wireless/ath/ath11k/hw.h
-+++ b/drivers/net/wireless/ath/ath11k/hw.h
-@@ -219,6 +219,7 @@ struct ath11k_hw_params {
- 	bool tcl_ring_retry;
- 	u32 tx_ring_size;
- 	bool smp2p_wow_exit;
-+	bool support_fw_mac_sequence;
- };
- 
- struct ath11k_hw_ops {
---- a/drivers/net/wireless/ath/ath11k/mac.c
-+++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -8010,6 +8010,7 @@ ath11k_mac_op_reconfig_complete(struct i
- 	struct ath11k *ar = hw->priv;
- 	struct ath11k_base *ab = ar->ab;
- 	int recovery_count;
-+	struct ath11k_vif *arvif;
- 
- 	if (reconfig_type != IEEE80211_RECONFIG_TYPE_RESTART)
- 		return;
-@@ -8045,6 +8046,12 @@ ath11k_mac_op_reconfig_complete(struct i
- 				ath11k_dbg(ab, ATH11K_DBG_BOOT, "reset success\n");
- 			}
- 		}
-+		if (ar->ab->hw_params.support_fw_mac_sequence) {
-+			list_for_each_entry(arvif, &ar->arvifs, list) {
-+				if (arvif->is_up && arvif->vdev_type == WMI_VDEV_TYPE_STA)
-+					ieee80211_hw_restart_disconnect(arvif->vif);
-+			}
-+		}
- 	}
- 
- 	mutex_unlock(&ar->conf_mutex);

package/kernel/mac80211/patches/ath11k/0018-ath11k-add-caldata-file-for-multiple-radios.patch

@@ -0,0 +1,68 @@
+From e82dfe7b5608592c270cc69100cb4322069f949d Mon Sep 17 00:00:00 2001
+From: Anilkumar Kolli <akolli@codeaurora.org>
+Date: Tue, 28 Sep 2021 12:05:39 +0300
+Subject: [PATCH] ath11k: add caldata file for multiple radios
+
+If multiple PCI cards are attached, each needs its own caldata file.
+
+Added new Caldata file name,
+PCI Bus:
+        cal-pci-0001:01:00.0.bin
+        cal-pci-0000:01:00.0.bin
+AHB Bus:
+	cal-ahb-c000000.wifi1.bin
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-00009-QCAHKSWPL_SILICONZ-1
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01838-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210721201927.100369-4-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/qmi.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/qmi.c
++++ b/drivers/net/wireless/ath/ath11k/qmi.c
+@@ -2033,6 +2033,7 @@ err_free_req:
+ 
+ static int ath11k_qmi_load_bdf_qmi(struct ath11k_base *ab)
+ {
++	struct device *dev = ab->dev;
+ 	char filename[ATH11K_QMI_MAX_BDF_FILE_NAME_SIZE];
+ 	const struct firmware *fw_entry;
+ 	struct ath11k_board_data bd;
+@@ -2067,6 +2068,14 @@ static int ath11k_qmi_load_bdf_qmi(struc
+ 		goto out;
+ 
+ 	file_type = ATH11K_QMI_FILE_TYPE_CALDATA;
++
++	/* cal-<bus>-<id>.bin */
++	snprintf(filename, sizeof(filename), "cal-%s-%s.bin",
++		 ath11k_bus_str(ab->hif.bus), dev_name(dev));
++	fw_entry = ath11k_core_firmware_request(ab, filename);
++	if (!IS_ERR(fw_entry))
++		goto success;
++
+ 	fw_entry = ath11k_core_firmware_request(ab, ATH11K_DEFAULT_CAL_FILE);
+ 	if (IS_ERR(fw_entry)) {
+ 		ret = PTR_ERR(fw_entry);
+@@ -2076,6 +2085,7 @@ static int ath11k_qmi_load_bdf_qmi(struc
+ 		goto out;
+ 	}
+ 
++success:
+ 	fw_size = min_t(u32, ab->hw_params.fw.board_size, fw_entry->size);
+ 	ret = ath11k_qmi_load_file_target_mem(ab, fw_entry->data, fw_size, file_type);
+ 	if (ret < 0) {
+@@ -2083,8 +2093,7 @@ static int ath11k_qmi_load_bdf_qmi(struc
+ 		goto out_qmi_cal;
+ 	}
+ 
+-	ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi caldata downloaded: type: %u\n",
+-		   file_type);
++	ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi caldata type: %u\n", file_type);
+ 
+ out_qmi_cal:
+ 	release_firmware(fw_entry);

package/kernel/mac80211/patches/ath11k/0018-wifi-ath11k-Fix-race-condition-with-struct-htt_ppdu_.patch

@@ -1,103 +0,0 @@
-From e44de90453bb2b46a523df78c39eb896bab35dcd Mon Sep 17 00:00:00 2001
-From: Govindaraj Saminathan <quic_gsaminat@quicinc.com>
-Date: Tue, 29 Nov 2022 13:04:02 +0200
-Subject: [PATCH] wifi: ath11k: Fix race condition with struct
- htt_ppdu_stats_info
-
-A crash happens when running the traffic with multiple clients:
-
-Crash Signature : Unable to handle kernel paging request at
-virtual address ffffffd700970918 During the crash, PC points to
-"ieee80211_tx_rate_update+0x30/0x68 [mac80211]"
-LR points to "ath11k_dp_htt_htc_t2h_msg_handler+0x5a8/0x8a0 [ath11k]".
-
-Struct ppdu_stats_info is allocated and accessed from event callback via copy
-engine tasklet, this has a problem when freeing it from ath11k_mac_op_stop().
-
-Use data_lock during entire ath11k_dp_htt_get_ppdu_desc() call to protect
-struct htt_ppdu_stats_info access and to avoid race condition when accessing it
-from ath11k_mac_op_stop().
-
-Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
-
-Signed-off-by: Govindaraj Saminathan <quic_gsaminat@quicinc.com>
-Co-developed-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
-Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
-Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
-Link: https://lore.kernel.org/r/20221124071104.22506-1-quic_kathirve@quicinc.com
----
- drivers/net/wireless/ath/ath11k/dp_rx.c | 22 +++++++++++-----------
- 1 file changed, 11 insertions(+), 11 deletions(-)
-
---- a/drivers/net/wireless/ath/ath11k/dp_rx.c
-+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -1535,13 +1535,12 @@ struct htt_ppdu_stats_info *ath11k_dp_ht
- {
- 	struct htt_ppdu_stats_info *ppdu_info;
- 
--	spin_lock_bh(&ar->data_lock);
-+	lockdep_assert_held(&ar->data_lock);
-+
- 	if (!list_empty(&ar->ppdu_stats_info)) {
- 		list_for_each_entry(ppdu_info, &ar->ppdu_stats_info, list) {
--			if (ppdu_info->ppdu_id == ppdu_id) {
--				spin_unlock_bh(&ar->data_lock);
-+			if (ppdu_info->ppdu_id == ppdu_id)
- 				return ppdu_info;
--			}
- 		}
- 
- 		if (ar->ppdu_stat_list_depth > HTT_PPDU_DESC_MAX_DEPTH) {
-@@ -1553,16 +1552,13 @@ struct htt_ppdu_stats_info *ath11k_dp_ht
- 			kfree(ppdu_info);
- 		}
- 	}
--	spin_unlock_bh(&ar->data_lock);
- 
- 	ppdu_info = kzalloc(sizeof(*ppdu_info), GFP_ATOMIC);
- 	if (!ppdu_info)
- 		return NULL;
- 
--	spin_lock_bh(&ar->data_lock);
- 	list_add_tail(&ppdu_info->list, &ar->ppdu_stats_info);
- 	ar->ppdu_stat_list_depth++;
--	spin_unlock_bh(&ar->data_lock);
- 
- 	return ppdu_info;
- }
-@@ -1586,16 +1582,17 @@ static int ath11k_htt_pull_ppdu_stats(st
- 	ar = ath11k_mac_get_ar_by_pdev_id(ab, pdev_id);
- 	if (!ar) {
- 		ret = -EINVAL;
--		goto exit;
-+		goto out;
- 	}
- 
- 	if (ath11k_debugfs_is_pktlog_lite_mode_enabled(ar))
- 		trace_ath11k_htt_ppdu_stats(ar, skb->data, len);
- 
-+	spin_lock_bh(&ar->data_lock);
- 	ppdu_info = ath11k_dp_htt_get_ppdu_desc(ar, ppdu_id);
- 	if (!ppdu_info) {
- 		ret = -EINVAL;
--		goto exit;
-+		goto out_unlock_data;
- 	}
- 
- 	ppdu_info->ppdu_id = ppdu_id;
-@@ -1604,10 +1601,13 @@ static int ath11k_htt_pull_ppdu_stats(st
- 				     (void *)ppdu_info);
- 	if (ret) {
- 		ath11k_warn(ab, "Failed to parse tlv %d\n", ret);
--		goto exit;
-+		goto out_unlock_data;
- 	}
- 
--exit:
-+out_unlock_data:
-+	spin_unlock_bh(&ar->data_lock);
-+
-+out:
- 	rcu_read_unlock();
- 
- 	return ret;

package/kernel/mac80211/patches/ath11k/0019-ath11k-add-caldata-download-support-from-EEPROM.patch

@@ -0,0 +1,282 @@
+From 4ba3b05ebd0c3e98c7dd8c7ee03aed9d80299b79 Mon Sep 17 00:00:00 2001
+From: Anilkumar Kolli <akolli@codeaurora.org>
+Date: Tue, 28 Sep 2021 12:05:39 +0300
+Subject: [PATCH] ath11k: add caldata download support from EEPROM
+
+Firmware updates EEPROM support capability in QMI FW caps, send QMI BDF
+download request message with file type EEPROM, to get caldata download
+from EEPROM. Firmware takes more time to update cal data from EEPROM, so
+increase QMI timeout.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01838-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210721201927.100369-5-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/qmi.c | 139 +++++++++++++++++++++-----
+ drivers/net/wireless/ath/ath11k/qmi.h |  16 ++-
+ 2 files changed, 127 insertions(+), 28 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/qmi.c
++++ b/drivers/net/wireless/ath/ath11k/qmi.c
+@@ -951,6 +951,78 @@ static struct qmi_elem_info qmi_wlanfw_c
+ 					   num_macs),
+ 	},
+ 	{
++		.data_type      = QMI_OPT_FLAG,
++		.elem_len       = 1,
++		.elem_size      = sizeof(u8),
++		.array_type     = NO_ARRAY,
++		.tlv_type       = 0x16,
++		.offset         = offsetof(struct qmi_wlanfw_cap_resp_msg_v01,
++					   voltage_mv_valid),
++	},
++	{
++		.data_type      = QMI_UNSIGNED_4_BYTE,
++		.elem_len       = 1,
++		.elem_size      = sizeof(u32),
++		.array_type     = NO_ARRAY,
++		.tlv_type       = 0x16,
++		.offset         = offsetof(struct qmi_wlanfw_cap_resp_msg_v01,
++					   voltage_mv),
++	},
++	{
++		.data_type      = QMI_OPT_FLAG,
++		.elem_len       = 1,
++		.elem_size      = sizeof(u8),
++		.array_type     = NO_ARRAY,
++		.tlv_type       = 0x17,
++		.offset         = offsetof(struct qmi_wlanfw_cap_resp_msg_v01,
++					   time_freq_hz_valid),
++	},
++	{
++		.data_type      = QMI_UNSIGNED_4_BYTE,
++		.elem_len       = 1,
++		.elem_size      = sizeof(u32),
++		.array_type     = NO_ARRAY,
++		.tlv_type       = 0x17,
++		.offset         = offsetof(struct qmi_wlanfw_cap_resp_msg_v01,
++					   time_freq_hz),
++	},
++	{
++		.data_type      = QMI_OPT_FLAG,
++		.elem_len       = 1,
++		.elem_size      = sizeof(u8),
++		.array_type     = NO_ARRAY,
++		.tlv_type       = 0x18,
++		.offset         = offsetof(struct qmi_wlanfw_cap_resp_msg_v01,
++					   otp_version_valid),
++	},
++	{
++		.data_type      = QMI_UNSIGNED_4_BYTE,
++		.elem_len       = 1,
++		.elem_size      = sizeof(u32),
++		.array_type     = NO_ARRAY,
++		.tlv_type       = 0x18,
++		.offset         = offsetof(struct qmi_wlanfw_cap_resp_msg_v01,
++					   otp_version),
++	},
++	{
++		.data_type      = QMI_OPT_FLAG,
++		.elem_len       = 1,
++		.elem_size      = sizeof(u8),
++		.array_type     = NO_ARRAY,
++		.tlv_type       = 0x19,
++		.offset         = offsetof(struct qmi_wlanfw_cap_resp_msg_v01,
++					   eeprom_read_timeout_valid),
++	},
++	{
++		.data_type      = QMI_UNSIGNED_4_BYTE,
++		.elem_len       = 1,
++		.elem_size      = sizeof(u32),
++		.array_type     = NO_ARRAY,
++		.tlv_type       = 0x19,
++		.offset         = offsetof(struct qmi_wlanfw_cap_resp_msg_v01,
++					   eeprom_read_timeout),
++	},
++	{
+ 		.data_type	= QMI_EOTI,
+ 		.array_type	= NO_ARRAY,
+ 		.tlv_type	= QMI_COMMON_TLV_TYPE,
+@@ -1846,8 +1918,8 @@ static int ath11k_qmi_request_target_cap
+ 	memset(&req, 0, sizeof(req));
+ 	memset(&resp, 0, sizeof(resp));
+ 
+-	ret = qmi_txn_init(&ab->qmi.handle, &txn,
+-			   qmi_wlanfw_cap_resp_msg_v01_ei, &resp);
++	ret = qmi_txn_init(&ab->qmi.handle, &txn, qmi_wlanfw_cap_resp_msg_v01_ei,
++			   &resp);
+ 	if (ret < 0)
+ 		goto out;
+ 
+@@ -1900,6 +1972,12 @@ static int ath11k_qmi_request_target_cap
+ 		strlcpy(ab->qmi.target.fw_build_id, resp.fw_build_id,
+ 			sizeof(ab->qmi.target.fw_build_id));
+ 
++	if (resp.eeprom_read_timeout_valid) {
++		ab->qmi.target.eeprom_caldata =
++					resp.eeprom_read_timeout;
++		ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi cal data supported from eeprom\n");
++	}
++
+ 	ath11k_info(ab, "chip_id 0x%x chip_family 0x%x board_id 0x%x soc_id 0x%x\n",
+ 		    ab->qmi.target.chip_id, ab->qmi.target.chip_family,
+ 		    ab->qmi.target.board_id, ab->qmi.target.soc_id);
+@@ -1963,7 +2041,8 @@ static int ath11k_qmi_load_file_target_m
+ 			req->end = 1;
+ 		}
+ 
+-		if (ab->bus_params.fixed_bdf_addr) {
++		if (ab->bus_params.fixed_bdf_addr ||
++		    type == ATH11K_QMI_FILE_TYPE_EEPROM) {
+ 			req->data_valid = 0;
+ 			req->end = 1;
+ 			req->data_len = ATH11K_QMI_MAX_BDF_FILE_NAME_SIZE;
+@@ -2010,7 +2089,8 @@ static int ath11k_qmi_load_file_target_m
+ 			goto err_iounmap;
+ 		}
+ 
+-		if (ab->bus_params.fixed_bdf_addr) {
++		if (ab->bus_params.fixed_bdf_addr ||
++		    type == ATH11K_QMI_FILE_TYPE_EEPROM) {
+ 			remaining = 0;
+ 		} else {
+ 			remaining -= req->data_len;
+@@ -2039,6 +2119,7 @@ static int ath11k_qmi_load_bdf_qmi(struc
+ 	struct ath11k_board_data bd;
+ 	u32 fw_size, file_type;
+ 	int ret = 0, bdf_type;
++	const u8 *tmp;
+ 
+ 	memset(&bd, 0, sizeof(bd));
+ 	ret = ath11k_core_fetch_bdf(ab, &bd);
+@@ -2063,31 +2144,38 @@ static int ath11k_qmi_load_bdf_qmi(struc
+ 		goto out;
+ 	}
+ 
+-	/* QCA6390 does not support cal data file, skip it */
++	/* QCA6390 does not support cal data, skip it */
+ 	if (bdf_type == ATH11K_QMI_BDF_TYPE_ELF)
+ 		goto out;
+ 
+-	file_type = ATH11K_QMI_FILE_TYPE_CALDATA;
++	if (ab->qmi.target.eeprom_caldata) {
++		file_type = ATH11K_QMI_FILE_TYPE_EEPROM;
++		tmp = filename;
++		fw_size = ATH11K_QMI_MAX_BDF_FILE_NAME_SIZE;
++	} else {
++		file_type = ATH11K_QMI_FILE_TYPE_CALDATA;
+ 
+-	/* cal-<bus>-<id>.bin */
+-	snprintf(filename, sizeof(filename), "cal-%s-%s.bin",
+-		 ath11k_bus_str(ab->hif.bus), dev_name(dev));
+-	fw_entry = ath11k_core_firmware_request(ab, filename);
+-	if (!IS_ERR(fw_entry))
+-		goto success;
+-
+-	fw_entry = ath11k_core_firmware_request(ab, ATH11K_DEFAULT_CAL_FILE);
+-	if (IS_ERR(fw_entry)) {
+-		ret = PTR_ERR(fw_entry);
+-		ath11k_warn(ab,
+-			    "qmi failed to load CAL data file:%s\n",
+-			    filename);
+-		goto out;
++		/* cal-<bus>-<id>.bin */
++		snprintf(filename, sizeof(filename), "cal-%s-%s.bin",
++			 ath11k_bus_str(ab->hif.bus), dev_name(dev));
++		fw_entry = ath11k_core_firmware_request(ab, filename);
++		if (!IS_ERR(fw_entry))
++			goto success;
++
++		fw_entry = ath11k_core_firmware_request(ab, ATH11K_DEFAULT_CAL_FILE);
++		if (IS_ERR(fw_entry)) {
++			ret = PTR_ERR(fw_entry);
++			ath11k_warn(ab,
++				    "qmi failed to load CAL data file:%s\n",
++				    filename);
++			goto out;
++		}
++success:
++		fw_size = min_t(u32, ab->hw_params.fw.board_size, fw_entry->size);
++		tmp = fw_entry->data;
+ 	}
+ 
+-success:
+-	fw_size = min_t(u32, ab->hw_params.fw.board_size, fw_entry->size);
+-	ret = ath11k_qmi_load_file_target_mem(ab, fw_entry->data, fw_size, file_type);
++	ret = ath11k_qmi_load_file_target_mem(ab, tmp, fw_size, file_type);
+ 	if (ret < 0) {
+ 		ath11k_warn(ab, "qmi failed to load caldata\n");
+ 		goto out_qmi_cal;
+@@ -2096,7 +2184,8 @@ success:
+ 	ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi caldata type: %u\n", file_type);
+ 
+ out_qmi_cal:
+-	release_firmware(fw_entry);
++	if (!ab->qmi.target.eeprom_caldata)
++		release_firmware(fw_entry);
+ out:
+ 	ath11k_core_free_bdf(ab, &bd);
+ 	ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi BDF download sequence completed\n");
+--- a/drivers/net/wireless/ath/ath11k/qmi.h
++++ b/drivers/net/wireless/ath/ath11k/qmi.h
+@@ -10,7 +10,7 @@
+ #include <linux/soc/qcom/qmi.h>
+ 
+ #define ATH11K_HOST_VERSION_STRING		"WIN"
+-#define ATH11K_QMI_WLANFW_TIMEOUT_MS		5000
++#define ATH11K_QMI_WLANFW_TIMEOUT_MS		10000
+ #define ATH11K_QMI_MAX_BDF_FILE_NAME_SIZE	64
+ #define ATH11K_QMI_CALDB_ADDRESS		0x4BA00000
+ #define ATH11K_QMI_WLANFW_MAX_BUILD_ID_LEN_V01	128
+@@ -42,6 +42,7 @@ struct ath11k_base;
+ enum ath11k_qmi_file_type {
+ 	ATH11K_QMI_FILE_TYPE_BDF_GOLDEN,
+ 	ATH11K_QMI_FILE_TYPE_CALDATA,
++	ATH11K_QMI_FILE_TYPE_EEPROM,
+ 	ATH11K_QMI_MAX_FILE_TYPE,
+ };
+ 
+@@ -102,6 +103,7 @@ struct target_info {
+ 	u32 board_id;
+ 	u32 soc_id;
+ 	u32 fw_version;
++	u32 eeprom_caldata;
+ 	char fw_build_timestamp[ATH11K_QMI_WLANFW_MAX_TIMESTAMP_LEN_V01 + 1];
+ 	char fw_build_id[ATH11K_QMI_WLANFW_MAX_BUILD_ID_LEN_V01 + 1];
+ 	char bdf_ext[ATH11K_QMI_BDF_EXT_STR_LENGTH];
+@@ -133,7 +135,7 @@ struct ath11k_qmi {
+ 	wait_queue_head_t cold_boot_waitq;
+ };
+ 
+-#define QMI_WLANFW_HOST_CAP_REQ_MSG_V01_MAX_LEN		189
++#define QMI_WLANFW_HOST_CAP_REQ_MSG_V01_MAX_LEN		261
+ #define QMI_WLANFW_HOST_CAP_REQ_V01			0x0034
+ #define QMI_WLANFW_HOST_CAP_RESP_MSG_V01_MAX_LEN	7
+ #define QMI_WLFW_HOST_CAP_RESP_V01			0x0034
+@@ -283,7 +285,7 @@ struct qmi_wlanfw_fw_cold_cal_done_ind_m
+ };
+ 
+ #define QMI_WLANFW_CAP_REQ_MSG_V01_MAX_LEN	0
+-#define QMI_WLANFW_CAP_RESP_MSG_V01_MAX_LEN	207
++#define QMI_WLANFW_CAP_RESP_MSG_V01_MAX_LEN	235
+ #define QMI_WLANFW_CAP_REQ_V01			0x0024
+ #define QMI_WLANFW_CAP_RESP_V01			0x0024
+ 
+@@ -364,6 +366,14 @@ struct qmi_wlanfw_cap_resp_msg_v01 {
+ 	char fw_build_id[ATH11K_QMI_WLANFW_MAX_BUILD_ID_LEN_V01 + 1];
+ 	u8 num_macs_valid;
+ 	u8 num_macs;
++	u8 voltage_mv_valid;
++	u32 voltage_mv;
++	u8 time_freq_hz_valid;
++	u32 time_freq_hz;
++	u8 otp_version_valid;
++	u32 otp_version;
++	u8 eeprom_read_timeout_valid;
++	u32 eeprom_read_timeout;
+ };
+ 
+ struct qmi_wlanfw_cap_req_msg_v01 {

package/kernel/mac80211/patches/ath11k/0020-ath11k-Replace-one-element-array-with-flexible-array.patch

@@ -0,0 +1,144 @@
+From b2549465cdeac3847487ce88b15ca47c37b60b88 Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavoars@kernel.org>
+Date: Tue, 28 Sep 2021 12:05:44 +0300
+Subject: [PATCH] ath11k: Replace one-element array with flexible-array member
+
+There is a regular need in the kernel to provide a way to declare having a
+dynamically sized set of trailing elements in a structure. Kernel code
+should always use "flexible array members"[1] for these cases. The older
+style of one-element or zero-length arrays should no longer be used[2].
+
+Refactor the code a bit according to the use of a flexible-array member in
+struct scan_chan_list_params instead of a one-element array, and use the
+struct_size() helper.
+
+Also, save 25 (too many) bytes that were being allocated:
+
+$ pahole -C channel_param drivers/net/wireless/ath/ath11k/reg.o
+struct channel_param {
+	u8                         chan_id;              /*     0     1 */
+	u8                         pwr;                  /*     1     1 */
+	u32                        mhz;                  /*     2     4 */
+
+	/* Bitfield combined with next fields */
+
+	u32                        half_rate:1;          /*     4:16  4 */
+	u32                        quarter_rate:1;       /*     4:17  4 */
+	u32                        dfs_set:1;            /*     4:18  4 */
+	u32                        dfs_set_cfreq2:1;     /*     4:19  4 */
+	u32                        is_chan_passive:1;    /*     4:20  4 */
+	u32                        allow_ht:1;           /*     4:21  4 */
+	u32                        allow_vht:1;          /*     4:22  4 */
+	u32                        allow_he:1;           /*     4:23  4 */
+	u32                        set_agile:1;          /*     4:24  4 */
+	u32                        psc_channel:1;        /*     4:25  4 */
+
+	/* XXX 6 bits hole, try to pack */
+
+	u32                        phy_mode;             /*     8     4 */
+	u32                        cfreq1;               /*    12     4 */
+	u32                        cfreq2;               /*    16     4 */
+	char                       maxpower;             /*    20     1 */
+	char                       minpower;             /*    21     1 */
+	char                       maxregpower;          /*    22     1 */
+	u8                         antennamax;           /*    23     1 */
+	u8                         reg_class_id;         /*    24     1 */
+
+	/* size: 25, cachelines: 1, members: 21 */
+	/* sum members: 23 */
+	/* sum bitfield members: 10 bits, bit holes: 1, sum bit holes: 6 bits */
+	/* last cacheline: 25 bytes */
+} __attribute__((__packed__));
+
+as previously, sizeof(struct scan_chan_list_params) was 32 bytes:
+
+$ pahole -C scan_chan_list_params drivers/net/wireless/ath/ath11k/reg.o
+struct scan_chan_list_params {
+	u32                        pdev_id;              /*     0     4 */
+	u16                        nallchans;            /*     4     2 */
+	struct channel_param       ch_param[1];          /*     6    25 */
+
+	/* size: 32, cachelines: 1, members: 3 */
+	/* padding: 1 */
+	/* last cacheline: 32 bytes */
+};
+
+and now with the flexible array transformation it is just 8 bytes:
+
+$ pahole -C scan_chan_list_params drivers/net/wireless/ath/ath11k/reg.o
+struct scan_chan_list_params {
+	u32                        pdev_id;              /*     0     4 */
+	u16                        nallchans;            /*     4     2 */
+	struct channel_param       ch_param[];           /*     6     0 */
+
+	/* size: 8, cachelines: 1, members: 3 */
+	/* padding: 2 */
+	/* last cacheline: 8 bytes */
+};
+
+This helps with the ongoing efforts to globally enable -Warray-bounds and
+get us closer to being able to tighten the FORTIFY_SOURCE routines on
+memcpy().
+
+This issue was found with the help of Coccinelle and audited and fixed,
+manually.
+
+[1] https://en.wikipedia.org/wiki/Flexible_array_member
+[2] https://www.kernel.org/doc/html/v5.10/process/deprecated.html#zero-length-and-one-element-arrays
+
+Link: https://github.com/KSPP/linux/issues/79
+Link: https://github.com/KSPP/linux/issues/109
+Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210823172159.GA25800@embeddedor
+---
+ drivers/net/wireless/ath/ath11k/reg.c | 7 ++-----
+ drivers/net/wireless/ath/ath11k/wmi.c | 2 +-
+ drivers/net/wireless/ath/ath11k/wmi.h | 2 +-
+ 3 files changed, 4 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/reg.c
++++ b/drivers/net/wireless/ath/ath11k/reg.c
+@@ -97,7 +97,6 @@ int ath11k_reg_update_chan_list(struct a
+ 	struct channel_param *ch;
+ 	enum nl80211_band band;
+ 	int num_channels = 0;
+-	int params_len;
+ 	int i, ret;
+ 
+ 	bands = hw->wiphy->bands;
+@@ -117,10 +116,8 @@ int ath11k_reg_update_chan_list(struct a
+ 	if (WARN_ON(!num_channels))
+ 		return -EINVAL;
+ 
+-	params_len = sizeof(struct scan_chan_list_params) +
+-			num_channels * sizeof(struct channel_param);
+-	params = kzalloc(params_len, GFP_KERNEL);
+-
++	params = kzalloc(struct_size(params, ch_param, num_channels),
++			 GFP_KERNEL);
+ 	if (!params)
+ 		return -ENOMEM;
+ 
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -2303,7 +2303,7 @@ int ath11k_wmi_send_scan_chan_list_cmd(s
+ 	u16 num_send_chans, num_sends = 0, max_chan_limit = 0;
+ 	u32 *reg1, *reg2;
+ 
+-	tchan_info = &chan_list->ch_param[0];
++	tchan_info = chan_list->ch_param;
+ 	while (chan_list->nallchans) {
+ 		len = sizeof(*cmd) + TLV_HDR_SIZE;
+ 		max_chan_limit = (wmi->wmi_ab->max_msg_len[ar->pdev_idx] - len) /
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -3659,7 +3659,7 @@ struct wmi_stop_scan_cmd {
+ struct scan_chan_list_params {
+ 	u32 pdev_id;
+ 	u16 nallchans;
+-	struct channel_param ch_param[1];
++	struct channel_param ch_param[];
+ };
+ 
+ struct wmi_scan_chan_list_cmd {

package/kernel/mac80211/patches/ath11k/0023-ath11k-Add-support-for-RX-decapsulation-offload.patch

@@ -0,0 +1,596 @@
+From 2167fa606c0f0e64b95a04f9bc42d9fd5360838a Mon Sep 17 00:00:00 2001
+From: Sriram R <srirrama@codeaurora.org>
+Date: Tue, 28 Sep 2021 12:05:40 +0300
+Subject: [PATCH] ath11k: Add support for RX decapsulation offload
+
+Add support for rx decapsulation offload by advertising
+the support to mac80211 during registration. Also ensure
+the frames have the RX_FLAG_8023 flag set in decap offload
+frames before passing to mac80211.
+
+Since the packets delivered to the driver are in 802.3 format, these
+can be sent to the network core with minimal processing in mac80211.
+This helps in releasing some CPU cycles in the host processor and
+thereby improving the performance.
+
+Two exceptions are made before passing decap frames, one is
+for EAPOL packets since mac80211 8023 fast rx for the sta
+is set only after authorization, other case is for multicast
+packets to validate PN in mac80211. In both the cases the
+decap frames are converted to 80211 frame and sent to mac80211.
+
+Ethernet decap can be enabled by using frame_mode modparam:
+
+insmod ath11k frame_mode=2
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-00844-QCAHKSWPL_SILICONZ-1 v2
+
+Co-developed-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
+Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
+Signed-off-by: Sriram R <srirrama@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210721204217.120572-1-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/core.h     |   4 +
+ drivers/net/wireless/ath/ath11k/dp_rx.c    | 194 +++++++++++++--------
+ drivers/net/wireless/ath/ath11k/hal_desc.h |   2 +
+ drivers/net/wireless/ath/ath11k/hw.c       |  43 +++++
+ drivers/net/wireless/ath/ath11k/hw.h       |   2 +
+ drivers/net/wireless/ath/ath11k/mac.c      |  25 ++-
+ 6 files changed, 198 insertions(+), 72 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -98,6 +98,8 @@ struct ath11k_skb_rxcb {
+ 	bool is_first_msdu;
+ 	bool is_last_msdu;
+ 	bool is_continuation;
++	bool is_mcbc;
++	bool is_eapol;
+ 	struct hal_rx_desc *rx_desc;
+ 	u8 err_rel_src;
+ 	u8 err_code;
+@@ -105,6 +107,8 @@ struct ath11k_skb_rxcb {
+ 	u8 unmapped;
+ 	u8 is_frag;
+ 	u8 tid;
++	u16 peer_id;
++	u16 seq_no;
+ };
+ 
+ enum ath11k_hw_rev {
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -270,6 +270,18 @@ static bool ath11k_dp_rx_h_attn_is_mcbc(
+ 		 __le32_to_cpu(attn->info1)));
+ }
+ 
++static bool ath11k_dp_rxdesc_mac_addr2_valid(struct ath11k_base *ab,
++					     struct hal_rx_desc *desc)
++{
++	return ab->hw_params.hw_ops->rx_desc_mac_addr2_valid(desc);
++}
++
++static u8 *ath11k_dp_rxdesc_mpdu_start_addr2(struct ath11k_base *ab,
++					     struct hal_rx_desc *desc)
++{
++	return ab->hw_params.hw_ops->rx_desc_mpdu_start_addr2(desc);
++}
++
+ static void ath11k_dp_service_mon_ring(struct timer_list *t)
+ {
+ 	struct ath11k_base *ab = from_timer(ab, t, mon_reap_timer);
+@@ -2156,6 +2168,7 @@ static void ath11k_dp_rx_h_undecap(struc
+ {
+ 	u8 *first_hdr;
+ 	u8 decap;
++	struct ethhdr *ehdr;
+ 
+ 	first_hdr = ath11k_dp_rx_h_80211_hdr(ar->ab, rx_desc);
+ 	decap = ath11k_dp_rx_h_msdu_start_decap_type(ar->ab, rx_desc);
+@@ -2170,9 +2183,22 @@ static void ath11k_dp_rx_h_undecap(struc
+ 					   decrypted);
+ 		break;
+ 	case DP_RX_DECAP_TYPE_ETHERNET2_DIX:
+-		/* TODO undecap support for middle/last msdu's of amsdu */
+-		ath11k_dp_rx_h_undecap_eth(ar, msdu, first_hdr,
+-					   enctype, status);
++		ehdr = (struct ethhdr *)msdu->data;
++
++		/* mac80211 allows fast path only for authorized STA */
++		if (ehdr->h_proto == cpu_to_be16(ETH_P_PAE)) {
++			ATH11K_SKB_RXCB(msdu)->is_eapol = true;
++			ath11k_dp_rx_h_undecap_eth(ar, msdu, first_hdr,
++						   enctype, status);
++			break;
++		}
++
++		/* PN for mcast packets will be validated in mac80211;
++		 * remove eth header and add 802.11 header.
++		 */
++		if (ATH11K_SKB_RXCB(msdu)->is_mcbc && decrypted)
++			ath11k_dp_rx_h_undecap_eth(ar, msdu, first_hdr,
++						   enctype, status);
+ 		break;
+ 	case DP_RX_DECAP_TYPE_8023:
+ 		/* TODO: Handle undecap for these formats */
+@@ -2180,35 +2206,62 @@ static void ath11k_dp_rx_h_undecap(struc
+ 	}
+ }
+ 
++static struct ath11k_peer *
++ath11k_dp_rx_h_find_peer(struct ath11k_base *ab, struct sk_buff *msdu)
++{
++	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
++	struct hal_rx_desc *rx_desc = rxcb->rx_desc;
++	struct ath11k_peer *peer = NULL;
++
++	lockdep_assert_held(&ab->base_lock);
++
++	if (rxcb->peer_id)
++		peer = ath11k_peer_find_by_id(ab, rxcb->peer_id);
++
++	if (peer)
++		return peer;
++
++	if (!rx_desc || !(ath11k_dp_rxdesc_mac_addr2_valid(ab, rx_desc)))
++		return NULL;
++
++	peer = ath11k_peer_find_by_addr(ab,
++					ath11k_dp_rxdesc_mpdu_start_addr2(ab, rx_desc));
++	return peer;
++}
++
+ static void ath11k_dp_rx_h_mpdu(struct ath11k *ar,
+ 				struct sk_buff *msdu,
+ 				struct hal_rx_desc *rx_desc,
+ 				struct ieee80211_rx_status *rx_status)
+ {
+-	bool  fill_crypto_hdr, mcast;
++	bool  fill_crypto_hdr;
+ 	enum hal_encrypt_type enctype;
+ 	bool is_decrypted = false;
++	struct ath11k_skb_rxcb *rxcb;
+ 	struct ieee80211_hdr *hdr;
+ 	struct ath11k_peer *peer;
+ 	struct rx_attention *rx_attention;
+ 	u32 err_bitmap;
+ 
+-	hdr = (struct ieee80211_hdr *)msdu->data;
+-
+ 	/* PN for multicast packets will be checked in mac80211 */
++	rxcb = ATH11K_SKB_RXCB(msdu);
++	fill_crypto_hdr = ath11k_dp_rx_h_attn_is_mcbc(ar->ab, rx_desc);
++	rxcb->is_mcbc = fill_crypto_hdr;
+ 
+-	mcast = is_multicast_ether_addr(hdr->addr1);
+-	fill_crypto_hdr = mcast;
++	if (rxcb->is_mcbc) {
++		rxcb->peer_id = ath11k_dp_rx_h_mpdu_start_peer_id(ar->ab, rx_desc);
++		rxcb->seq_no = ath11k_dp_rx_h_mpdu_start_seq_no(ar->ab, rx_desc);
++	}
+ 
+ 	spin_lock_bh(&ar->ab->base_lock);
+-	peer = ath11k_peer_find_by_addr(ar->ab, hdr->addr2);
++	peer = ath11k_dp_rx_h_find_peer(ar->ab, msdu);
+ 	if (peer) {
+-		if (mcast)
++		if (rxcb->is_mcbc)
+ 			enctype = peer->sec_type_grp;
+ 		else
+ 			enctype = peer->sec_type;
+ 	} else {
+-		enctype = HAL_ENCRYPT_TYPE_OPEN;
++		enctype = ath11k_dp_rx_h_mpdu_start_enctype(ar->ab, rx_desc);
+ 	}
+ 	spin_unlock_bh(&ar->ab->base_lock);
+ 
+@@ -2247,8 +2300,11 @@ static void ath11k_dp_rx_h_mpdu(struct a
+ 	if (!is_decrypted || fill_crypto_hdr)
+ 		return;
+ 
+-	hdr = (void *)msdu->data;
+-	hdr->frame_control &= ~__cpu_to_le16(IEEE80211_FCTL_PROTECTED);
++	if (ath11k_dp_rx_h_msdu_start_decap_type(ar->ab, rx_desc) !=
++	    DP_RX_DECAP_TYPE_ETHERNET2_DIX) {
++		hdr = (void *)msdu->data;
++		hdr->frame_control &= ~__cpu_to_le16(IEEE80211_FCTL_PROTECTED);
++	}
+ }
+ 
+ static void ath11k_dp_rx_h_rate(struct ath11k *ar, struct hal_rx_desc *rx_desc,
+@@ -2365,51 +2421,49 @@ static void ath11k_dp_rx_h_ppdu(struct a
+ 	ath11k_dp_rx_h_rate(ar, rx_desc, rx_status);
+ }
+ 
+-static char *ath11k_print_get_tid(struct ieee80211_hdr *hdr, char *out,
+-				  size_t size)
+-{
+-	u8 *qc;
+-	int tid;
+-
+-	if (!ieee80211_is_data_qos(hdr->frame_control))
+-		return "";
+-
+-	qc = ieee80211_get_qos_ctl(hdr);
+-	tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
+-	snprintf(out, size, "tid %d", tid);
+-
+-	return out;
+-}
+-
+ static void ath11k_dp_rx_deliver_msdu(struct ath11k *ar, struct napi_struct *napi,
+-				      struct sk_buff *msdu)
++				      struct sk_buff *msdu,
++				      struct ieee80211_rx_status *status)
+ {
+ 	static const struct ieee80211_radiotap_he known = {
+ 		.data1 = cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_DATA_MCS_KNOWN |
+ 				     IEEE80211_RADIOTAP_HE_DATA1_BW_RU_ALLOC_KNOWN),
+ 		.data2 = cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA2_GI_KNOWN),
+ 	};
+-	struct ieee80211_rx_status *status;
+-	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)msdu->data;
++	struct ieee80211_rx_status *rx_status;
+ 	struct ieee80211_radiotap_he *he = NULL;
+-	char tid[32];
+-
+-	status = IEEE80211_SKB_RXCB(msdu);
+-	if (status->encoding == RX_ENC_HE) {
++	struct ieee80211_sta *pubsta = NULL;
++	struct ath11k_peer *peer;
++	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
++	u8 decap = DP_RX_DECAP_TYPE_RAW;
++	bool is_mcbc = rxcb->is_mcbc;
++	bool is_eapol = rxcb->is_eapol;
++
++	if (status->encoding == RX_ENC_HE &&
++	    !(status->flag & RX_FLAG_RADIOTAP_HE) &&
++	    !(status->flag & RX_FLAG_SKIP_MONITOR)) {
+ 		he = skb_push(msdu, sizeof(known));
+ 		memcpy(he, &known, sizeof(known));
+ 		status->flag |= RX_FLAG_RADIOTAP_HE;
+ 	}
+ 
++	if (!(status->flag & RX_FLAG_ONLY_MONITOR))
++		decap = ath11k_dp_rx_h_msdu_start_decap_type(ar->ab, rxcb->rx_desc);
++
++	spin_lock_bh(&ar->ab->base_lock);
++	peer = ath11k_dp_rx_h_find_peer(ar->ab, msdu);
++	if (peer && peer->sta)
++		pubsta = peer->sta;
++	spin_unlock_bh(&ar->ab->base_lock);
++
+ 	ath11k_dbg(ar->ab, ATH11K_DBG_DATA,
+-		   "rx skb %pK len %u peer %pM %s %s sn %u %s%s%s%s%s%s%s %srate_idx %u vht_nss %u freq %u band %u flag 0x%x fcs-err %i mic-err %i amsdu-more %i\n",
++		   "rx skb %pK len %u peer %pM %d %s sn %u %s%s%s%s%s%s%s %srate_idx %u vht_nss %u freq %u band %u flag 0x%x fcs-err %i mic-err %i amsdu-more %i\n",
+ 		   msdu,
+ 		   msdu->len,
+-		   ieee80211_get_SA(hdr),
+-		   ath11k_print_get_tid(hdr, tid, sizeof(tid)),
+-		   is_multicast_ether_addr(ieee80211_get_DA(hdr)) ?
+-							"mcast" : "ucast",
+-		   (__le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ) >> 4,
++		   peer ? peer->addr : NULL,
++		   rxcb->tid,
++		   is_mcbc ? "mcast" : "ucast",
++		   rxcb->seq_no,
+ 		   (status->encoding == RX_ENC_LEGACY) ? "legacy" : "",
+ 		   (status->encoding == RX_ENC_HT) ? "ht" : "",
+ 		   (status->encoding == RX_ENC_VHT) ? "vht" : "",
+@@ -2429,22 +2483,32 @@ static void ath11k_dp_rx_deliver_msdu(st
+ 	ath11k_dbg_dump(ar->ab, ATH11K_DBG_DP_RX, NULL, "dp rx msdu: ",
+ 			msdu->data, msdu->len);
+ 
++	rx_status = IEEE80211_SKB_RXCB(msdu);
++	*rx_status = *status;
++
+ 	/* TODO: trace rx packet */
+ 
+-	ieee80211_rx_napi(ar->hw, NULL, msdu, napi);
++	/* PN for multicast packets are not validate in HW,
++	 * so skip 802.3 rx path
++	 * Also, fast_rx expectes the STA to be authorized, hence
++	 * eapol packets are sent in slow path.
++	 */
++	if (decap == DP_RX_DECAP_TYPE_ETHERNET2_DIX && !is_eapol &&
++	    !(is_mcbc && rx_status->flag & RX_FLAG_DECRYPTED))
++		rx_status->flag |= RX_FLAG_8023;
++
++	ieee80211_rx_napi(ar->hw, pubsta, msdu, napi);
+ }
+ 
+ static int ath11k_dp_rx_process_msdu(struct ath11k *ar,
+ 				     struct sk_buff *msdu,
+-				     struct sk_buff_head *msdu_list)
++				     struct sk_buff_head *msdu_list,
++				     struct ieee80211_rx_status *rx_status)
+ {
+ 	struct ath11k_base *ab = ar->ab;
+ 	struct hal_rx_desc *rx_desc, *lrx_desc;
+ 	struct rx_attention *rx_attention;
+-	struct ieee80211_rx_status rx_status = {0};
+-	struct ieee80211_rx_status *status;
+ 	struct ath11k_skb_rxcb *rxcb;
+-	struct ieee80211_hdr *hdr;
+ 	struct sk_buff *last_buf;
+ 	u8 l3_pad_bytes;
+ 	u8 *hdr_status;
+@@ -2500,19 +2564,11 @@ static int ath11k_dp_rx_process_msdu(str
+ 		}
+ 	}
+ 
+-	hdr = (struct ieee80211_hdr *)msdu->data;
+-
+-	/* Process only data frames */
+-	if (!ieee80211_is_data(hdr->frame_control))
+-		return -EINVAL;
+-
+-	ath11k_dp_rx_h_ppdu(ar, rx_desc, &rx_status);
+-	ath11k_dp_rx_h_mpdu(ar, msdu, rx_desc, &rx_status);
++	ath11k_dp_rx_h_ppdu(ar, rx_desc, rx_status);
++	ath11k_dp_rx_h_mpdu(ar, msdu, rx_desc, rx_status);
+ 
+-	rx_status.flag |= RX_FLAG_SKIP_MONITOR | RX_FLAG_DUP_VALIDATED;
++	rx_status->flag |= RX_FLAG_SKIP_MONITOR | RX_FLAG_DUP_VALIDATED;
+ 
+-	status = IEEE80211_SKB_RXCB(msdu);
+-	*status = rx_status;
+ 	return 0;
+ 
+ free_out:
+@@ -2527,6 +2583,7 @@ static void ath11k_dp_rx_process_receive
+ 	struct ath11k_skb_rxcb *rxcb;
+ 	struct sk_buff *msdu;
+ 	struct ath11k *ar;
++	struct ieee80211_rx_status rx_status = {0};
+ 	u8 mac_id;
+ 	int ret;
+ 
+@@ -2549,7 +2606,7 @@ static void ath11k_dp_rx_process_receive
+ 			continue;
+ 		}
+ 
+-		ret = ath11k_dp_rx_process_msdu(ar, msdu, msdu_list);
++		ret = ath11k_dp_rx_process_msdu(ar, msdu, msdu_list, &rx_status);
+ 		if (ret) {
+ 			ath11k_dbg(ab, ATH11K_DBG_DATA,
+ 				   "Unable to process msdu %d", ret);
+@@ -2557,7 +2614,7 @@ static void ath11k_dp_rx_process_receive
+ 			continue;
+ 		}
+ 
+-		ath11k_dp_rx_deliver_msdu(ar, napi, msdu);
++		ath11k_dp_rx_deliver_msdu(ar, napi, msdu, &rx_status);
+ 		(*quota)--;
+ 	}
+ 
+@@ -2639,10 +2696,14 @@ try_again:
+ 					RX_MSDU_DESC_INFO0_LAST_MSDU_IN_MPDU);
+ 		rxcb->is_continuation = !!(desc.rx_msdu_info.info0 &
+ 					   RX_MSDU_DESC_INFO0_MSDU_CONTINUATION);
+-		rxcb->mac_id = mac_id;
++		rxcb->peer_id = FIELD_GET(RX_MPDU_DESC_META_DATA_PEER_ID,
++					  desc.rx_mpdu_info.meta_data);
++		rxcb->seq_no = FIELD_GET(RX_MPDU_DESC_INFO0_SEQ_NUM,
++					 desc.rx_mpdu_info.info0);
+ 		rxcb->tid = FIELD_GET(HAL_REO_DEST_RING_INFO0_RX_QUEUE_NUM,
+ 				      desc.info0);
+ 
++		rxcb->mac_id = mac_id;
+ 		__skb_queue_tail(&msdu_list, msdu);
+ 
+ 		if (total_msdu_reaped >= quota && !rxcb->is_continuation) {
+@@ -3944,7 +4005,6 @@ static void ath11k_dp_rx_wbm_err(struct
+ {
+ 	struct ath11k_skb_rxcb *rxcb = ATH11K_SKB_RXCB(msdu);
+ 	struct ieee80211_rx_status rxs = {0};
+-	struct ieee80211_rx_status *status;
+ 	bool drop = true;
+ 
+ 	switch (rxcb->err_rel_src) {
+@@ -3964,10 +4024,7 @@ static void ath11k_dp_rx_wbm_err(struct
+ 		return;
+ 	}
+ 
+-	status = IEEE80211_SKB_RXCB(msdu);
+-	*status = rxs;
+-
+-	ath11k_dp_rx_deliver_msdu(ar, napi, msdu);
++	ath11k_dp_rx_deliver_msdu(ar, napi, msdu, &rxs);
+ }
+ 
+ int ath11k_dp_rx_process_wbm_err(struct ath11k_base *ab,
+@@ -4851,7 +4908,7 @@ static int ath11k_dp_rx_mon_deliver(stru
+ {
+ 	struct ath11k_pdev_dp *dp = &ar->dp;
+ 	struct sk_buff *mon_skb, *skb_next, *header;
+-	struct ieee80211_rx_status *rxs = &dp->rx_status, *status;
++	struct ieee80211_rx_status *rxs = &dp->rx_status;
+ 
+ 	mon_skb = ath11k_dp_rx_mon_merg_msdus(ar, mac_id, head_msdu,
+ 					      tail_msdu, rxs);
+@@ -4877,10 +4934,7 @@ static int ath11k_dp_rx_mon_deliver(stru
+ 		}
+ 		rxs->flag |= RX_FLAG_ONLY_MONITOR;
+ 
+-		status = IEEE80211_SKB_RXCB(mon_skb);
+-		*status = *rxs;
+-
+-		ath11k_dp_rx_deliver_msdu(ar, napi, mon_skb);
++		ath11k_dp_rx_deliver_msdu(ar, napi, mon_skb, rxs);
+ 		mon_skb = skb_next;
+ 	} while (mon_skb);
+ 	rxs->flag = 0;
+--- a/drivers/net/wireless/ath/ath11k/hal_desc.h
++++ b/drivers/net/wireless/ath/ath11k/hal_desc.h
+@@ -496,6 +496,8 @@ struct hal_tlv_hdr {
+ #define RX_MPDU_DESC_INFO0_DA_IDX_TIMEOUT	BIT(29)
+ #define RX_MPDU_DESC_INFO0_RAW_MPDU		BIT(30)
+ 
++#define RX_MPDU_DESC_META_DATA_PEER_ID		GENMASK(15, 0)
++
+ struct rx_mpdu_desc {
+ 	u32 info0; /* %RX_MPDU_DESC_INFO */
+ 	u32 meta_data;
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -374,6 +374,17 @@ static void ath11k_hw_ipq8074_rx_desc_se
+ 	desc->u.ipq8074.msdu_start.info1 = __cpu_to_le32(info);
+ }
+ 
++static bool ath11k_hw_ipq8074_rx_desc_mac_addr2_valid(struct hal_rx_desc *desc)
++{
++	return __le32_to_cpu(desc->u.ipq8074.mpdu_start.info1) &
++	       RX_MPDU_START_INFO1_MAC_ADDR2_VALID;
++}
++
++static u8 *ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2(struct hal_rx_desc *desc)
++{
++	return desc->u.ipq8074.mpdu_start.addr2;
++}
++
+ static
+ struct rx_attention *ath11k_hw_ipq8074_rx_desc_get_attention(struct hal_rx_desc *desc)
+ {
+@@ -545,6 +556,17 @@ static u8 *ath11k_hw_qcn9074_rx_desc_get
+ 	return &desc->u.qcn9074.msdu_payload[0];
+ }
+ 
++static bool ath11k_hw_ipq9074_rx_desc_mac_addr2_valid(struct hal_rx_desc *desc)
++{
++	return __le32_to_cpu(desc->u.qcn9074.mpdu_start.info11) &
++	       RX_MPDU_START_INFO11_MAC_ADDR2_VALID;
++}
++
++static u8 *ath11k_hw_ipq9074_rx_desc_mpdu_start_addr2(struct hal_rx_desc *desc)
++{
++	return desc->u.qcn9074.mpdu_start.addr2;
++}
++
+ static bool ath11k_hw_wcn6855_rx_desc_get_first_msdu(struct hal_rx_desc *desc)
+ {
+ 	return !!FIELD_GET(RX_MSDU_END_INFO2_FIRST_MSDU_WCN6855,
+@@ -705,6 +727,17 @@ static u8 *ath11k_hw_wcn6855_rx_desc_get
+ 	return &desc->u.wcn6855.msdu_payload[0];
+ }
+ 
++static bool ath11k_hw_wcn6855_rx_desc_mac_addr2_valid(struct hal_rx_desc *desc)
++{
++	return __le32_to_cpu(desc->u.wcn6855.mpdu_start.info1) &
++	       RX_MPDU_START_INFO1_MAC_ADDR2_VALID;
++}
++
++static u8 *ath11k_hw_wcn6855_rx_desc_mpdu_start_addr2(struct hal_rx_desc *desc)
++{
++	return desc->u.wcn6855.mpdu_start.addr2;
++}
++
+ static void ath11k_hw_wcn6855_reo_setup(struct ath11k_base *ab)
+ {
+ 	u32 reo_base = HAL_SEQ_WCSS_UMAC_REO_REG;
+@@ -801,6 +834,8 @@ const struct ath11k_hw_ops ipq8074_ops =
+ 	.rx_desc_get_msdu_payload = ath11k_hw_ipq8074_rx_desc_get_msdu_payload,
+ 	.reo_setup = ath11k_hw_ipq8074_reo_setup,
+ 	.mpdu_info_get_peerid = ath11k_hw_ipq8074_mpdu_info_get_peerid,
++	.rx_desc_mac_addr2_valid = ath11k_hw_ipq8074_rx_desc_mac_addr2_valid,
++	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2,
+ };
+ 
+ const struct ath11k_hw_ops ipq6018_ops = {
+@@ -837,6 +872,8 @@ const struct ath11k_hw_ops ipq6018_ops =
+ 	.rx_desc_get_msdu_payload = ath11k_hw_ipq8074_rx_desc_get_msdu_payload,
+ 	.reo_setup = ath11k_hw_ipq8074_reo_setup,
+ 	.mpdu_info_get_peerid = ath11k_hw_ipq8074_mpdu_info_get_peerid,
++	.rx_desc_mac_addr2_valid = ath11k_hw_ipq8074_rx_desc_mac_addr2_valid,
++	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2,
+ };
+ 
+ const struct ath11k_hw_ops qca6390_ops = {
+@@ -873,6 +910,8 @@ const struct ath11k_hw_ops qca6390_ops =
+ 	.rx_desc_get_msdu_payload = ath11k_hw_ipq8074_rx_desc_get_msdu_payload,
+ 	.reo_setup = ath11k_hw_ipq8074_reo_setup,
+ 	.mpdu_info_get_peerid = ath11k_hw_ipq8074_mpdu_info_get_peerid,
++	.rx_desc_mac_addr2_valid = ath11k_hw_ipq8074_rx_desc_mac_addr2_valid,
++	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq8074_rx_desc_mpdu_start_addr2,
+ };
+ 
+ const struct ath11k_hw_ops qcn9074_ops = {
+@@ -909,6 +948,8 @@ const struct ath11k_hw_ops qcn9074_ops =
+ 	.rx_desc_get_msdu_payload = ath11k_hw_qcn9074_rx_desc_get_msdu_payload,
+ 	.reo_setup = ath11k_hw_ipq8074_reo_setup,
+ 	.mpdu_info_get_peerid = ath11k_hw_ipq8074_mpdu_info_get_peerid,
++	.rx_desc_mac_addr2_valid = ath11k_hw_ipq9074_rx_desc_mac_addr2_valid,
++	.rx_desc_mpdu_start_addr2 = ath11k_hw_ipq9074_rx_desc_mpdu_start_addr2,
+ };
+ 
+ const struct ath11k_hw_ops wcn6855_ops = {
+@@ -945,6 +986,8 @@ const struct ath11k_hw_ops wcn6855_ops =
+ 	.rx_desc_get_msdu_payload = ath11k_hw_wcn6855_rx_desc_get_msdu_payload,
+ 	.reo_setup = ath11k_hw_wcn6855_reo_setup,
+ 	.mpdu_info_get_peerid = ath11k_hw_wcn6855_mpdu_info_get_peerid,
++	.rx_desc_mac_addr2_valid = ath11k_hw_wcn6855_rx_desc_mac_addr2_valid,
++	.rx_desc_mpdu_start_addr2 = ath11k_hw_wcn6855_rx_desc_mpdu_start_addr2,
+ };
+ 
+ #define ATH11K_TX_RING_MASK_0 0x1
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -209,6 +209,8 @@ struct ath11k_hw_ops {
+ 	u8 *(*rx_desc_get_msdu_payload)(struct hal_rx_desc *desc);
+ 	void (*reo_setup)(struct ath11k_base *ab);
+ 	u16 (*mpdu_info_get_peerid)(u8 *tlv_data);
++	bool (*rx_desc_mac_addr2_valid)(struct hal_rx_desc *desc);
++	u8* (*rx_desc_mpdu_start_addr2)(struct hal_rx_desc *desc);
+ };
+ 
+ extern const struct ath11k_hw_ops ipq8074_ops;
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -5380,7 +5380,8 @@ static void ath11k_mac_op_update_vif_off
+ 	if (ath11k_frame_mode != ATH11K_HW_TXRX_ETHERNET ||
+ 	    (vif->type != NL80211_IFTYPE_STATION &&
+ 	     vif->type != NL80211_IFTYPE_AP))
+-		vif->offload_flags &= ~IEEE80211_OFFLOAD_ENCAP_ENABLED;
++		vif->offload_flags &= ~(IEEE80211_OFFLOAD_ENCAP_ENABLED |
++					IEEE80211_OFFLOAD_DECAP_ENABLED);
+ 
+ 	if (vif->offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED)
+ 		param_value = ATH11K_HW_TXRX_ETHERNET;
+@@ -5396,6 +5397,22 @@ static void ath11k_mac_op_update_vif_off
+ 			    arvif->vdev_id, ret);
+ 		vif->offload_flags &= ~IEEE80211_OFFLOAD_ENCAP_ENABLED;
+ 	}
++
++	param_id = WMI_VDEV_PARAM_RX_DECAP_TYPE;
++	if (vif->offload_flags & IEEE80211_OFFLOAD_DECAP_ENABLED)
++		param_value = ATH11K_HW_TXRX_ETHERNET;
++	else if (test_bit(ATH11K_FLAG_RAW_MODE, &ab->dev_flags))
++		param_value = ATH11K_HW_TXRX_RAW;
++	else
++		param_value = ATH11K_HW_TXRX_NATIVE_WIFI;
++
++	ret = ath11k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id,
++					    param_id, param_value);
++	if (ret) {
++		ath11k_warn(ab, "failed to set vdev %d rx decap mode: %d\n",
++			    arvif->vdev_id, ret);
++		vif->offload_flags &= ~IEEE80211_OFFLOAD_DECAP_ENABLED;
++	}
+ }
+ 
+ static int ath11k_mac_op_add_interface(struct ieee80211_hw *hw,
+@@ -7560,7 +7577,11 @@ static int __ath11k_mac_register(struct
+ 	ieee80211_hw_set(ar->hw, QUEUE_CONTROL);
+ 	ieee80211_hw_set(ar->hw, SUPPORTS_TX_FRAG);
+ 	ieee80211_hw_set(ar->hw, REPORTS_LOW_ACK);
+-	ieee80211_hw_set(ar->hw, SUPPORTS_TX_ENCAP_OFFLOAD);
++
++	if (ath11k_frame_mode == ATH11K_HW_TXRX_ETHERNET) {
++		ieee80211_hw_set(ar->hw, SUPPORTS_TX_ENCAP_OFFLOAD);
++		ieee80211_hw_set(ar->hw, SUPPORTS_RX_DECAP_OFFLOAD);
++	}
+ 
+ 	if (cap->nss_ratio_enabled)
+ 		ieee80211_hw_set(ar->hw, SUPPORTS_VHT_EXT_NSS_BW);

package/kernel/mac80211/patches/ath11k/0024-ath11k-Fix-pktlog-lite-rx-events.patch

@@ -0,0 +1,186 @@
+From ab18e3bc1c138f2b4358c6905a45afb7289d5086 Mon Sep 17 00:00:00 2001
+From: Anilkumar Kolli <akolli@codeaurora.org>
+Date: Tue, 28 Sep 2021 12:05:40 +0300
+Subject: [PATCH] ath11k: Fix pktlog lite rx events
+
+Fix sending rx_buf_sz to ath11k_dp_tx_htt_rx_filter_setup()
+to enable pktlog full or lite mode. Depending on mode update the
+trace buffer with log type full/lite.
+
+Pktlog lite is a lighter version of pktlog. This can be used to capture
+PPDU stats. These are useful for firmware performance debugging.
+
+pktlog lite dumps are enabled using,
+  echo "0x0 1" > ath11k/IPQ8074 hw2.0/mac0/pktlog_filter
+
+Tested On: IPQ8074 hw2.0 AHB WLAN.HK.2.1.0.1-01233-QCAHKSWPL_SILICONZ-1 v2
+
+Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210721212029.142388-1-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/debugfs.c | 25 +++++++++++++++++++----
+ drivers/net/wireless/ath/ath11k/dp.h      |  1 +
+ drivers/net/wireless/ath/ath11k/dp_rx.c   | 16 ++++++++++++---
+ drivers/net/wireless/ath/ath11k/trace.h   | 11 ++++++----
+ 4 files changed, 42 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/debugfs.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs.c
+@@ -902,7 +902,7 @@ static ssize_t ath11k_write_pktlog_filte
+ 	struct htt_rx_ring_tlv_filter tlv_filter = {0};
+ 	u32 rx_filter = 0, ring_id, filter, mode;
+ 	u8 buf[128] = {0};
+-	int i, ret;
++	int i, ret, rx_buf_sz = 0;
+ 	ssize_t rc;
+ 
+ 	mutex_lock(&ar->conf_mutex);
+@@ -940,6 +940,17 @@ static ssize_t ath11k_write_pktlog_filte
+ 		}
+ 	}
+ 
++	/* Clear rx filter set for monitor mode and rx status */
++	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
++		ring_id = ar->dp.rx_mon_status_refill_ring[i].refill_buf_ring.ring_id;
++		ret = ath11k_dp_tx_htt_rx_filter_setup(ar->ab, ring_id, ar->dp.mac_id,
++						       HAL_RXDMA_MONITOR_STATUS,
++						       rx_buf_sz, &tlv_filter);
++		if (ret) {
++			ath11k_warn(ar->ab, "failed to set rx filter for monitor status ring\n");
++			goto out;
++		}
++	}
+ #define HTT_RX_FILTER_TLV_LITE_MODE \
+ 			(HTT_RX_FILTER_TLV_FLAGS_PPDU_START | \
+ 			HTT_RX_FILTER_TLV_FLAGS_PPDU_END | \
+@@ -955,6 +966,7 @@ static ssize_t ath11k_write_pktlog_filte
+ 			    HTT_RX_FILTER_TLV_FLAGS_MPDU_END |
+ 			    HTT_RX_FILTER_TLV_FLAGS_PACKET_HEADER |
+ 			    HTT_RX_FILTER_TLV_FLAGS_ATTENTION;
++		rx_buf_sz = DP_RX_BUFFER_SIZE;
+ 	} else if (mode == ATH11K_PKTLOG_MODE_LITE) {
+ 		ret = ath11k_dp_tx_htt_h2t_ppdu_stats_req(ar,
+ 							  HTT_PPDU_STATS_TAG_PKTLOG);
+@@ -964,7 +976,12 @@ static ssize_t ath11k_write_pktlog_filte
+ 		}
+ 
+ 		rx_filter = HTT_RX_FILTER_TLV_LITE_MODE;
++		rx_buf_sz = DP_RX_BUFFER_SIZE_LITE;
+ 	} else {
++		rx_buf_sz = DP_RX_BUFFER_SIZE;
++		tlv_filter = ath11k_mac_mon_status_filter_default;
++		rx_filter = tlv_filter.rx_filter;
++
+ 		ret = ath11k_dp_tx_htt_h2t_ppdu_stats_req(ar,
+ 							  HTT_PPDU_STATS_TAG_DEFAULT);
+ 		if (ret) {
+@@ -988,7 +1005,7 @@ static ssize_t ath11k_write_pktlog_filte
+ 		ret = ath11k_dp_tx_htt_rx_filter_setup(ab, ring_id,
+ 						       ar->dp.mac_id + i,
+ 						       HAL_RXDMA_MONITOR_STATUS,
+-						       DP_RX_BUFFER_SIZE, &tlv_filter);
++						       rx_buf_sz, &tlv_filter);
+ 
+ 		if (ret) {
+ 			ath11k_warn(ab, "failed to set rx filter for monitor status ring\n");
+@@ -996,8 +1013,8 @@ static ssize_t ath11k_write_pktlog_filte
+ 		}
+ 	}
+ 
+-	ath11k_dbg(ab, ATH11K_DBG_WMI, "pktlog filter %d mode %s\n",
+-		   filter, ((mode == ATH11K_PKTLOG_MODE_FULL) ? "full" : "lite"));
++	ath11k_info(ab, "pktlog mode %s\n",
++		    ((mode == ATH11K_PKTLOG_MODE_FULL) ? "full" : "lite"));
+ 
+ 	ar->debug.pktlog_filter = filter;
+ 	ar->debug.pktlog_mode = mode;
+--- a/drivers/net/wireless/ath/ath11k/dp.h
++++ b/drivers/net/wireless/ath/ath11k/dp.h
+@@ -195,6 +195,7 @@ struct ath11k_pdev_dp {
+ #define DP_RXDMA_MONITOR_DESC_RING_SIZE	4096
+ 
+ #define DP_RX_BUFFER_SIZE	2048
++#define	DP_RX_BUFFER_SIZE_LITE  1024
+ #define DP_RX_BUFFER_ALIGN_SIZE	128
+ 
+ #define DP_RXDMA_BUF_COOKIE_BUF_ID	GENMASK(17, 0)
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -3033,6 +3033,8 @@ int ath11k_dp_rx_process_mon_status(stru
+ 	struct ath11k_peer *peer;
+ 	struct ath11k_sta *arsta;
+ 	int num_buffs_reaped = 0;
++	u32 rx_buf_sz;
++	u16 log_type = 0;
+ 
+ 	__skb_queue_head_init(&skb_list);
+ 
+@@ -3045,8 +3047,16 @@ int ath11k_dp_rx_process_mon_status(stru
+ 		memset(&ppdu_info, 0, sizeof(ppdu_info));
+ 		ppdu_info.peer_id = HAL_INVALID_PEERID;
+ 
+-		if (ath11k_debugfs_is_pktlog_rx_stats_enabled(ar))
+-			trace_ath11k_htt_rxdesc(ar, skb->data, DP_RX_BUFFER_SIZE);
++		if (ath11k_debugfs_is_pktlog_lite_mode_enabled(ar)) {
++			log_type = ATH11K_PKTLOG_TYPE_LITE_RX;
++			rx_buf_sz = DP_RX_BUFFER_SIZE_LITE;
++		} else if (ath11k_debugfs_is_pktlog_rx_stats_enabled(ar)) {
++			log_type = ATH11K_PKTLOG_TYPE_RX_STATBUF;
++			rx_buf_sz = DP_RX_BUFFER_SIZE;
++		}
++
++		if (log_type)
++			trace_ath11k_htt_rxdesc(ar, skb->data, log_type, rx_buf_sz);
+ 
+ 		hal_status = ath11k_hal_rx_parse_mon_status(ab, &ppdu_info, skb);
+ 
+@@ -3074,7 +3084,7 @@ int ath11k_dp_rx_process_mon_status(stru
+ 		ath11k_dp_rx_update_peer_stats(arsta, &ppdu_info);
+ 
+ 		if (ath11k_debugfs_is_pktlog_peer_valid(ar, peer->addr))
+-			trace_ath11k_htt_rxdesc(ar, skb->data, DP_RX_BUFFER_SIZE);
++			trace_ath11k_htt_rxdesc(ar, skb->data, log_type, rx_buf_sz);
+ 
+ 		spin_unlock_bh(&ab->base_lock);
+ 		rcu_read_unlock();
+--- a/drivers/net/wireless/ath/ath11k/trace.h
++++ b/drivers/net/wireless/ath/ath11k/trace.h
+@@ -79,14 +79,15 @@ TRACE_EVENT(ath11k_htt_ppdu_stats,
+ );
+ 
+ TRACE_EVENT(ath11k_htt_rxdesc,
+-	    TP_PROTO(struct ath11k *ar, const void *data, size_t len),
++	    TP_PROTO(struct ath11k *ar, const void *data, size_t log_type, size_t len),
+ 
+-	TP_ARGS(ar, data, len),
++	TP_ARGS(ar, data, log_type, len),
+ 
+ 	TP_STRUCT__entry(
+ 		__string(device, dev_name(ar->ab->dev))
+ 		__string(driver, dev_driver_string(ar->ab->dev))
+ 		__field(u16, len)
++		__field(u16, log_type)
+ 		__dynamic_array(u8, rxdesc, len)
+ 	),
+ 
+@@ -94,14 +95,16 @@ TRACE_EVENT(ath11k_htt_rxdesc,
+ 		__assign_str(device, dev_name(ar->ab->dev));
+ 		__assign_str(driver, dev_driver_string(ar->ab->dev));
+ 		__entry->len = len;
++		__entry->log_type = log_type;
+ 		memcpy(__get_dynamic_array(rxdesc), data, len);
+ 	),
+ 
+ 	TP_printk(
+-		"%s %s rxdesc len %d",
++		"%s %s rxdesc len %d type %d",
+ 		__get_str(driver),
+ 		__get_str(device),
+-		__entry->len
++		__entry->len,
++		__entry->log_type
+ 	 )
+ );
+ 

package/kernel/mac80211/patches/ath11k/0025-ath11k-Update-pdev-tx-and-rx-firmware-stats.patch

@@ -0,0 +1,250 @@
+From f394e4eae8e2c0579063e5473f1e321d22d3fe43 Mon Sep 17 00:00:00 2001
+From: Sriram R <srirrama@codeaurora.org>
+Date: Tue, 28 Sep 2021 12:05:40 +0300
+Subject: [PATCH] ath11k: Update pdev tx and rx firmware stats
+
+Update the fields of pdev tx and tx firmware stats structure.
+Missing fields resulted in wrong fw stats to be displayed as below.
+
+root@OpenWrt:/# cat /sys/kernel/debug/ath11k/
+		ipq8074\ hw2.0/mac0/fw_stats/pdev_stats | grep Illegal
+Illegal rate phy errors   36839112
+
+Note that this struct was missing its members from initial driver
+support and this change doesn't introduce/modify the structure for
+firmware changes.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01734-QCAHKSWPL_SILICONZ-1 v2
+
+Signed-off-by: Sriram R <srirrama@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210721212029.142388-2-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/core.h | 29 ++++++++++++++++++
+ drivers/net/wireless/ath/ath11k/wmi.c  | 41 ++++++++++++++++++++++++-
+ drivers/net/wireless/ath/ath11k/wmi.h  | 42 ++++++++++++++++++++++++++
+ 3 files changed, 111 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -819,12 +819,15 @@ struct ath11k_fw_stats_pdev {
+ 	s32 hw_reaped;
+ 	/* Num underruns */
+ 	s32 underrun;
++	/* Num hw paused */
++	u32 hw_paused;
+ 	/* Num PPDUs cleaned up in TX abort */
+ 	s32 tx_abort;
+ 	/* Num MPDUs requeued by SW */
+ 	s32 mpdus_requeued;
+ 	/* excessive retries */
+ 	u32 tx_ko;
++	u32 tx_xretry;
+ 	/* data hw rate code */
+ 	u32 data_rc;
+ 	/* Scheduler self triggers */
+@@ -845,6 +848,30 @@ struct ath11k_fw_stats_pdev {
+ 	u32 phy_underrun;
+ 	/* MPDU is more than txop limit */
+ 	u32 txop_ovf;
++	/* Num sequences posted */
++	u32 seq_posted;
++	/* Num sequences failed in queueing */
++	u32 seq_failed_queueing;
++	/* Num sequences completed */
++	u32 seq_completed;
++	/* Num sequences restarted */
++	u32 seq_restarted;
++	/* Num of MU sequences posted */
++	u32 mu_seq_posted;
++	/* Num MPDUs flushed by SW, HWPAUSED, SW TXABORT
++	 * (Reset,channel change)
++	 */
++	s32 mpdus_sw_flush;
++	/* Num MPDUs filtered by HW, all filter condition (TTL expired) */
++	s32 mpdus_hw_filter;
++	/* Num MPDUs truncated by PDG (TXOP, TBTT,
++	 * PPDU_duration based on rate, dyn_bw)
++	 */
++	s32 mpdus_truncated;
++	/* Num MPDUs that was tried but didn't receive ACK or BA */
++	s32 mpdus_ack_failed;
++	/* Num MPDUs that was dropped du to expiry. */
++	s32 mpdus_expired;
+ 
+ 	/* PDEV RX stats */
+ 	/* Cnts any change in ring routing mid-ppdu */
+@@ -870,6 +897,8 @@ struct ath11k_fw_stats_pdev {
+ 	s32 phy_err_drop;
+ 	/* Number of mpdu errors - FCS, MIC, ENC etc. */
+ 	s32 mpdu_errs;
++	/* Num overflow errors */
++	s32 rx_ovfl_errs;
+ };
+ 
+ struct ath11k_fw_stats_vdev {
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -5252,9 +5252,11 @@ ath11k_wmi_pull_pdev_stats_tx(const stru
+ 	dst->hw_queued = src->hw_queued;
+ 	dst->hw_reaped = src->hw_reaped;
+ 	dst->underrun = src->underrun;
++	dst->hw_paused = src->hw_paused;
+ 	dst->tx_abort = src->tx_abort;
+ 	dst->mpdus_requeued = src->mpdus_requeued;
+ 	dst->tx_ko = src->tx_ko;
++	dst->tx_xretry = src->tx_xretry;
+ 	dst->data_rc = src->data_rc;
+ 	dst->self_triggers = src->self_triggers;
+ 	dst->sw_retry_failure = src->sw_retry_failure;
+@@ -5265,6 +5267,16 @@ ath11k_wmi_pull_pdev_stats_tx(const stru
+ 	dst->stateless_tid_alloc_failure = src->stateless_tid_alloc_failure;
+ 	dst->phy_underrun = src->phy_underrun;
+ 	dst->txop_ovf = src->txop_ovf;
++	dst->seq_posted = src->seq_posted;
++	dst->seq_failed_queueing = src->seq_failed_queueing;
++	dst->seq_completed = src->seq_completed;
++	dst->seq_restarted = src->seq_restarted;
++	dst->mu_seq_posted = src->mu_seq_posted;
++	dst->mpdus_sw_flush = src->mpdus_sw_flush;
++	dst->mpdus_hw_filter = src->mpdus_hw_filter;
++	dst->mpdus_truncated = src->mpdus_truncated;
++	dst->mpdus_ack_failed = src->mpdus_ack_failed;
++	dst->mpdus_expired = src->mpdus_expired;
+ }
+ 
+ static void ath11k_wmi_pull_pdev_stats_rx(const struct wmi_pdev_stats_rx *src,
+@@ -5284,6 +5296,7 @@ static void ath11k_wmi_pull_pdev_stats_r
+ 	dst->phy_errs = src->phy_errs;
+ 	dst->phy_err_drop = src->phy_err_drop;
+ 	dst->mpdu_errs = src->mpdu_errs;
++	dst->rx_ovfl_errs = src->rx_ovfl_errs;
+ }
+ 
+ static void
+@@ -5521,11 +5534,15 @@ ath11k_wmi_fw_pdev_tx_stats_fill(const s
+ 	len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
+ 			 "Num underruns", pdev->underrun);
+ 	len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
++			 "Num HW Paused", pdev->hw_paused);
++	len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
+ 			 "PPDUs cleaned", pdev->tx_abort);
+ 	len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
+ 			 "MPDUs requeued", pdev->mpdus_requeued);
+ 	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
+-			 "Excessive retries", pdev->tx_ko);
++			 "PPDU OK", pdev->tx_ko);
++	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
++			 "Excessive retries", pdev->tx_xretry);
+ 	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
+ 			 "HW rate", pdev->data_rc);
+ 	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
+@@ -5549,6 +5566,26 @@ ath11k_wmi_fw_pdev_tx_stats_fill(const s
+ 			 "PHY underrun", pdev->phy_underrun);
+ 	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
+ 			 "MPDU is more than txop limit", pdev->txop_ovf);
++	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
++			 "Num sequences posted", pdev->seq_posted);
++	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
++			 "Num seq failed queueing ", pdev->seq_failed_queueing);
++	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
++			 "Num sequences completed ", pdev->seq_completed);
++	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
++			 "Num sequences restarted ", pdev->seq_restarted);
++	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
++			 "Num of MU sequences posted ", pdev->mu_seq_posted);
++	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
++			 "Num of MPDUS SW flushed ", pdev->mpdus_sw_flush);
++	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
++			 "Num of MPDUS HW filtered ", pdev->mpdus_hw_filter);
++	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
++			 "Num of MPDUS truncated ", pdev->mpdus_truncated);
++	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
++			 "Num of MPDUS ACK failed ", pdev->mpdus_ack_failed);
++	len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
++			 "Num of MPDUS expired ", pdev->mpdus_expired);
+ 	*length = len;
+ }
+ 
+@@ -5593,6 +5630,8 @@ ath11k_wmi_fw_pdev_rx_stats_fill(const s
+ 			 "PHY errors drops", pdev->phy_err_drop);
+ 	len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
+ 			 "MPDU errors (FCS, MIC, ENC)", pdev->mpdu_errs);
++	len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
++			 "Overflow errors", pdev->rx_ovfl_errs);
+ 	*length = len;
+ }
+ 
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -4223,6 +4223,9 @@ struct wmi_pdev_stats_tx {
+ 	/* Num underruns */
+ 	s32 underrun;
+ 
++	/* Num hw paused */
++	u32 hw_paused;
++
+ 	/* Num PPDUs cleaned up in TX abort */
+ 	s32 tx_abort;
+ 
+@@ -4232,6 +4235,8 @@ struct wmi_pdev_stats_tx {
+ 	/* excessive retries */
+ 	u32 tx_ko;
+ 
++	u32 tx_xretry;
++
+ 	/* data hw rate code */
+ 	u32 data_rc;
+ 
+@@ -4261,6 +4266,40 @@ struct wmi_pdev_stats_tx {
+ 
+ 	/* MPDU is more than txop limit */
+ 	u32 txop_ovf;
++
++	/* Num sequences posted */
++	u32 seq_posted;
++
++	/* Num sequences failed in queueing */
++	u32 seq_failed_queueing;
++
++	/* Num sequences completed */
++	u32 seq_completed;
++
++	/* Num sequences restarted */
++	u32 seq_restarted;
++
++	/* Num of MU sequences posted */
++	u32 mu_seq_posted;
++
++	/* Num MPDUs flushed by SW, HWPAUSED, SW TXABORT
++	 * (Reset,channel change)
++	 */
++	s32 mpdus_sw_flush;
++
++	/* Num MPDUs filtered by HW, all filter condition (TTL expired) */
++	s32 mpdus_hw_filter;
++
++	/* Num MPDUs truncated by PDG (TXOP, TBTT,
++	 * PPDU_duration based on rate, dyn_bw)
++	 */
++	s32 mpdus_truncated;
++
++	/* Num MPDUs that was tried but didn't receive ACK or BA */
++	s32 mpdus_ack_failed;
++
++	/* Num MPDUs that was dropped du to expiry. */
++	s32 mpdus_expired;
+ } __packed;
+ 
+ struct wmi_pdev_stats_rx {
+@@ -4295,6 +4334,9 @@ struct wmi_pdev_stats_rx {
+ 
+ 	/* Number of mpdu errors - FCS, MIC, ENC etc. */
+ 	s32 mpdu_errs;
++
++	/* Num overflow errors */
++	s32 rx_ovfl_errs;
+ } __packed;
+ 
+ struct wmi_pdev_stats {

package/kernel/mac80211/patches/ath11k/0028-ath11k-Add-vdev-start-flag-to-disable-hardware-encry.patch

@@ -0,0 +1,47 @@
+From 8717db7ee802b71fa3f2a79b265b1325bc61210c Mon Sep 17 00:00:00 2001
+From: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+Date: Tue, 28 Sep 2021 12:05:40 +0300
+Subject: [PATCH] ath11k: Add vdev start flag to disable hardware encryption
+
+Firmware blocks all data traffic until the key is plumbed. But, with
+software encryption mode, key is never plumbed to firmware. Due to this,
+a traffic failure in software encryption mode has been observed. Hence,
+firmware has introduced a flag to differentiate software encryption
+mode. This flag can be passed during vdev_start command.
+
+Enable WMI_VDEV_START_HW_ENCRYPTION_DISABLED flag in vdev_start command
+to notify firmware to disable hardware encryption for a vdev. This is set
+if raw mode software encryption is enabled.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01421-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210721212029.142388-5-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/wmi.c | 2 ++
+ drivers/net/wireless/ath/ath11k/wmi.h | 1 +
+ 2 files changed, 3 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -884,6 +884,8 @@ int ath11k_wmi_vdev_start(struct ath11k
+ 	}
+ 
+ 	cmd->flags |= WMI_VDEV_START_LDPC_RX_ENABLED;
++	if (test_bit(ATH11K_FLAG_HW_CRYPTO_DISABLED, &ar->ab->dev_flags))
++		cmd->flags |= WMI_VDEV_START_HW_ENCRYPTION_DISABLED;
+ 
+ 	ptr = skb->data + sizeof(*cmd);
+ 	chan = ptr;
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -2577,6 +2577,7 @@ struct wmi_vdev_down_cmd {
+ #define WMI_VDEV_START_HIDDEN_SSID  BIT(0)
+ #define WMI_VDEV_START_PMF_ENABLED  BIT(1)
+ #define WMI_VDEV_START_LDPC_RX_ENABLED BIT(3)
++#define WMI_VDEV_START_HW_ENCRYPTION_DISABLED BIT(4)
+ 
+ struct wmi_ssid {
+ 	u32 ssid_len;

package/kernel/mac80211/patches/ath11k/0029-ath11k-Assign-free_vdev_map-value-before-ieee80211_r.patch

@@ -0,0 +1,62 @@
+From 3c79cb4d63c0d58462d439efa0db328008354deb Mon Sep 17 00:00:00 2001
+From: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+Date: Tue, 28 Sep 2021 12:05:40 +0300
+Subject: [PATCH] ath11k: Assign free_vdev_map value before
+ ieee80211_register_hw
+
+Firmware crash is seen randomly, because of sending wrong vdev_id
+in vdev_create command. This is due to free_vdev_map value being 0.
+free_vdev_map is getting assigned after ieee80211_register_hw. In
+some race conditions, add_interface api is getting called before
+assigning value to free_vdev_map. Fix this by assigning free_vdev_map
+before ieee80211_register_hw.
+
+Also, moved ar->cc_freq_hz and ar->txmgmt_idr initialization before
+ieee80211_register_hw to avoid such race conditions.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-00948-QCAHKSWPL_SILICONZ-1
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01734-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210721212029.142388-6-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -7711,6 +7711,10 @@ int ath11k_mac_register(struct ath11k_ba
+ 	if (test_bit(ATH11K_FLAG_REGISTERED, &ab->dev_flags))
+ 		return 0;
+ 
++	/* Initialize channel counters frequency value in hertz */
++	ab->cc_freq_hz = IPQ8074_CC_FREQ_HERTZ;
++	ab->free_vdev_map = (1LL << (ab->num_radios * TARGET_NUM_VDEVS)) - 1;
++
+ 	for (i = 0; i < ab->num_radios; i++) {
+ 		pdev = &ab->pdevs[i];
+ 		ar = pdev->ar;
+@@ -7721,18 +7725,14 @@ int ath11k_mac_register(struct ath11k_ba
+ 			ar->mac_addr[4] += i;
+ 		}
+ 
++		idr_init(&ar->txmgmt_idr);
++		spin_lock_init(&ar->txmgmt_idr_lock);
++
+ 		ret = __ath11k_mac_register(ar);
+ 		if (ret)
+ 			goto err_cleanup;
+-
+-		idr_init(&ar->txmgmt_idr);
+-		spin_lock_init(&ar->txmgmt_idr_lock);
+ 	}
+ 
+-	/* Initialize channel counters frequency value in hertz */
+-	ab->cc_freq_hz = IPQ8074_CC_FREQ_HERTZ;
+-	ab->free_vdev_map = (1LL << (ab->num_radios * TARGET_NUM_VDEVS)) - 1;
+-
+ 	return 0;
+ 
+ err_cleanup:

package/kernel/mac80211/patches/ath11k/0030-ath11k-Fix-crash-during-firmware-recovery-on-reo-cmd.patch

@@ -0,0 +1,63 @@
+From 8ee8d38ca4727667e05a1dedf546162207bde9fa Mon Sep 17 00:00:00 2001
+From: Sriram R <srirrama@codeaurora.org>
+Date: Tue, 28 Sep 2021 12:05:40 +0300
+Subject: [PATCH] ath11k: Fix crash during firmware recovery on reo cmd ring
+ access
+
+In scenario when a peer is disassociating, there could be
+multiple places where a reo cmd ring is accessed, such as
+during aggregation teardown, tid queue cleanup, etc.
+
+When this happens during firmware recovery where accessing of FW/HW
+resources/registers is not recommended, accessing reo cmd ring in
+this case could lead to crash or undefined behaviour.
+
+Hence avoid this by checking for corresponding flag to avoid
+accessing reo cmd ring during firmware recovery.
+
+Sample crash:
+
+[ 3936.456050] Unhandled fault: imprecise external abort (0x1c06) at 0x54bb842a
+[ 3936.456411] WARN: Access Violation!!!, Run "cat /sys/kernel/debug/qcom_debug_logs/tz_log" for more details
+[ 3936.467997] pgd = b4474000
+[ 3936.477440] [54bb842a] *pgd=6fa61831, *pte=7f95d59f, *ppte=7f95de7e
+<snip>
+[ 3937.177436] [<8030ab10>] (_raw_spin_unlock_bh) from [<7f5e9eb8>] (ath11k_hal_reo_cmd_send+0x440/0x458 [ath11k])
+[ 3937.185730] [<7f5e9eb8>] (ath11k_hal_reo_cmd_send [ath11k]) from [<7f601c4c>] (ath11k_dp_tx_send_reo_cmd+0x2c/0xcc [ath11k])
+[ 3937.195524] [<7f601c4c>] (ath11k_dp_tx_send_reo_cmd [ath11k]) from [<7f602f10>] (ath11k_peer_rx_tid_reo_update+0x84/0xbc [ath11k])
+[ 3937.206984] [<7f602f10>] (ath11k_peer_rx_tid_reo_update [ath11k]) from [<7f605a9c>] (ath11k_dp_rx_ampdu_stop+0xa8/0x130 [ath11k])
+[ 3937.218532] [<7f605a9c>] (ath11k_dp_rx_ampdu_stop [ath11k]) from [<7f5f6730>] (ath11k_mac_op_ampdu_action+0x6c/0x98 [ath11k])
+[ 3937.230250] [<7f5f6730>] (ath11k_mac_op_ampdu_action [ath11k]) from [<c7b6e890>] (___ieee80211_stop_rx_ba_session+0x98/0x144 [mac80211])
+[ 3937.241499] [<c7b6e890>] (___ieee80211_stop_rx_ba_session [mac80211]) from [<c7b6cdd8>] (ieee80211_sta_tear_down_BA_sessions+0x4c/0xf4 [)
+[ 3937.253833] [<c7b6cdd8>] (ieee80211_sta_tear_down_BA_sessions [mac80211]) from [<c7b63460>] (ieee80211_sta_eosp+0x5b8/0x960 [mac80211])
+[ 3937.266764] [<c7b63460>] (ieee80211_sta_eosp [mac80211]) from [<c7b66da8>] (__sta_info_flush+0x9c/0x134 [mac80211])
+[ 3937.278826] [<c7b66da8>] (__sta_info_flush [mac80211]) from [<c7b7bd00>] (ieee80211_stop_ap+0x14c/0x28c [mac80211])
+[ 3937.289240] [<c7b7bd00>] (ieee80211_stop_ap [mac80211]) from [<7f509cf0>] (__cfg80211_stop_ap+0x4c/0xd8 [cfg80211])
+[ 3937.299629] [<7f509cf0>] (__cfg80211_stop_ap [cfg80211]) from [<7f4dddec>] (cfg80211_leave+0x24/0x30 [cfg80211])
+[ 3937.310041] [<7f4dddec>] (cfg80211_leave [cfg80211]) from [<7f4de03c>] (cfg80211_netdev_notifier_call+0x174/0x48c [cfg80211])
+[ 3937.320457] [<7f4de03c>] (cfg80211_netdev_notifier_call [cfg80211]) from [<80339928>] (notifier_call_chain+0x40/0x68)
+[ 3937.331636] [<80339928>] (notifier_call_chain) from [<803399a8>] (raw_notifier_call_chain+0x14/0x1c)
+[ 3937.342221] [<803399a8>] (raw_notifier_call_chain) from [<8073bb00>] (call_netdevice_notifiers+0xc/0x14)
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.1.0.1-01240-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sriram R <srirrama@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210721212029.142388-7-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/dp_tx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -622,6 +622,9 @@ int ath11k_dp_tx_send_reo_cmd(struct ath
+ 	struct hal_srng *cmd_ring;
+ 	int cmd_num;
+ 
++	if (test_bit(ATH11K_FLAG_CRASH_FLUSH, &ab->dev_flags))
++		return -ESHUTDOWN;
++
+ 	cmd_ring = &ab->hal.srng_list[dp->reo_cmd_ring.ring_id];
+ 	cmd_num = ath11k_hal_reo_cmd_send(ab, cmd_ring, type, cmd);
+ 

package/kernel/mac80211/patches/ath11k/0031-ath11k-Avoid-No-VIF-found-warning-message.patch

@@ -0,0 +1,44 @@
+From 79feedfea7793d91293ab72fac5fc66aae0c6a85 Mon Sep 17 00:00:00 2001
+From: Karthikeyan Periyasamy <periyasa@codeaurora.org>
+Date: Tue, 28 Sep 2021 12:05:41 +0300
+Subject: [PATCH] ath11k: Avoid "No VIF found" warning message
+
+Facing below warning prints when we do wifi down in multiple VAPs scenario.
+
+warning print:
+
+ath11k c000000.wifi: No VIF found for vdev 2
+...
+ath11k c000000.wifi: No VIF found for vdev 0
+
+In ath11k_mac_get_arvif_by_vdev_id(), we iterate all the radio to get the
+arvif for the requested vdev_id through ath11k_mac_get_arvif().
+ath11k_mac_get_arvif() throws a warning message if the given vdev_id is
+not found in the given radio. So to avoid the warning message, add
+the allocated_vdev_map cross check against the given vdev_id before using
+ath11k_mac_get_arvif() to ensure that vdev_id is allocated in the
+given radio.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01492-QCAHKSWPL_SILICONZ-1
+Tested-on: IPQ6018 hw1.0 AHB WLAN.HK.2.4.0.1-00330-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Karthikeyan Periyasamy <periyasa@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210721212029.142388-8-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -501,7 +501,8 @@ struct ath11k_vif *ath11k_mac_get_arvif_
+ 
+ 	for (i = 0; i < ab->num_radios; i++) {
+ 		pdev = rcu_dereference(ab->pdevs_active[i]);
+-		if (pdev && pdev->ar) {
++		if (pdev && pdev->ar &&
++		    (pdev->ar->allocated_vdev_map & (1LL << vdev_id))) {
+ 			arvif = ath11k_mac_get_arvif(pdev->ar, vdev_id);
+ 			if (arvif)
+ 				return arvif;

package/kernel/mac80211/patches/ath11k/0032-ath11k-Add-wmi-peer-create-conf-event-in-wmi_tlv_eve.patch

@@ -0,0 +1,50 @@
+From 94a6df31dcf042f74db8209680d04546ce964ad5 Mon Sep 17 00:00:00 2001
+From: P Praneesh <ppranees@codeaurora.org>
+Date: Tue, 28 Sep 2021 12:05:41 +0300
+Subject: [PATCH] ath11k: Add wmi peer create conf event in wmi_tlv_event_id
+
+When the driver sends a peer create cmd, the firmware responds with
+WMI_PEER_CREATE_CONF_EVENTID to confirm the firmware received
+WMI_PEER_CREATE_CMDID. Since the peer create conf event is not handled
+in ath11k_wmi_tlv_op_rx, we are getting unknown event id warning prints
+during peer creation.
+
+Add WMI_PEER_CREATE_CONF_EVENTID in wmi_tlv_event_id and handle
+the same as unsupported event id under wmi logs.
+
+warning prints:
+[ 4382.230817] ath11k_pci 0000:01:00.0: Unknown eventid: 0x601a
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01695-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: P Praneesh <ppranees@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210721212029.142388-9-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/wmi.c | 1 +
+ drivers/net/wireless/ath/ath11k/wmi.h | 3 +++
+ 2 files changed, 4 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -7137,6 +7137,7 @@ static void ath11k_wmi_tlv_op_rx(struct
+ 	case WMI_TWT_ENABLE_EVENTID:
+ 	case WMI_TWT_DISABLE_EVENTID:
+ 	case WMI_PDEV_DMA_RING_CFG_RSP_EVENTID:
++	case WMI_PEER_CREATE_CONF_EVENTID:
+ 		ath11k_dbg(ab, ATH11K_DBG_WMI,
+ 			   "ignoring unsupported event 0x%x\n", id);
+ 		break;
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -663,6 +663,9 @@ enum wmi_tlv_event_id {
+ 	WMI_PEER_RESERVED9_EVENTID,
+ 	WMI_PEER_RESERVED10_EVENTID,
+ 	WMI_PEER_OPER_MODE_CHANGE_EVENTID,
++	WMI_PEER_TX_PN_RESPONSE_EVENTID,
++	WMI_PEER_CFR_CAPTURE_EVENTID,
++	WMI_PEER_CREATE_CONF_EVENTID,
+ 	WMI_MGMT_RX_EVENTID = WMI_TLV_CMD(WMI_GRP_MGMT),
+ 	WMI_HOST_SWBA_EVENTID,
+ 	WMI_TBTTOFFSET_UPDATE_EVENTID,

package/kernel/mac80211/patches/ath11k/0033-ath11k-add-channel-2-into-6-GHz-channel-list.patch

@@ -0,0 +1,43 @@
+From 4a9550f536cc9c62210f77d875f000e560fc64b1 Mon Sep 17 00:00:00 2001
+From: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
+Date: Tue, 28 Sep 2021 14:00:43 +0300
+Subject: [PATCH] ath11k: add channel 2 into 6 GHz channel list
+
+Add support for the 6 GHz channel 2 with center frequency 5935 MHz and
+operating class 136 per IEEE Std 802.11ax-2021, Table E-4.
+
+Signed-off-by: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210722102054.43419-1-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/core.h | 4 ++--
+ drivers/net/wireless/ath/ath11k/mac.c  | 3 +++
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -393,9 +393,9 @@ struct ath11k_sta {
+ };
+ 
+ #define ATH11K_MIN_5G_FREQ 4150
+-#define ATH11K_MIN_6G_FREQ 5945
++#define ATH11K_MIN_6G_FREQ 5925
+ #define ATH11K_MAX_6G_FREQ 7115
+-#define ATH11K_NUM_CHANS 100
++#define ATH11K_NUM_CHANS 101
+ #define ATH11K_MAX_5G_CHAN 173
+ 
+ enum ath11k_state {
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -151,6 +151,9 @@ static const struct ieee80211_channel at
+ 	CHAN6G(225, 7075, 0),
+ 	CHAN6G(229, 7095, 0),
+ 	CHAN6G(233, 7115, 0),
++
++	/* new addition in IEEE Std 802.11ax-2021 */
++	CHAN6G(2, 5935, 0),
+ };
+ 
+ static struct ieee80211_rate ath11k_legacy_rates[] = {

package/kernel/mac80211/patches/ath11k/0035-ath11k-fix-survey-dump-collection-in-6-GHz.patch

@@ -0,0 +1,35 @@
+From b6b142f644d2d88e2ceabe0aa4479e0a09ba1ea9 Mon Sep 17 00:00:00 2001
+From: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
+Date: Tue, 28 Sep 2021 14:00:43 +0300
+Subject: [PATCH] ath11k: fix survey dump collection in 6 GHz
+
+When ath11k receives survey request, choose the 6 GHz band when enabled.
+Without this, survey request does not include any 6 GHz band results,
+thereby causing auto channel selection to fail.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01386-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210722102054.43419-3-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -7182,7 +7182,13 @@ static int ath11k_mac_op_get_survey(stru
+ 
+ 	if (!sband)
+ 		sband = hw->wiphy->bands[NL80211_BAND_5GHZ];
++	if (sband && idx >= sband->n_channels) {
++		idx -= sband->n_channels;
++		sband = NULL;
++	}
+ 
++	if (!sband)
++		sband = hw->wiphy->bands[NL80211_BAND_6GHZ];
+ 	if (!sband || idx >= sband->n_channels) {
+ 		ret = -ENOENT;
+ 		goto exit;

package/kernel/mac80211/patches/ath11k/0036-ath11k-re-enable-ht_cap-vht_cap-for-5G-band-for-WCN6.patch

@@ -0,0 +1,34 @@
+From 54f40f552afd5a07e635a52221ec4b0ce765c374 Mon Sep 17 00:00:00 2001
+From: Wen Gong <wgong@codeaurora.org>
+Date: Tue, 28 Sep 2021 14:00:43 +0300
+Subject: [PATCH] ath11k: re-enable ht_cap/vht_cap for 5G band for WCN6855
+
+WCN6855 uses single_pdev_only, so it supports both the 5G and 6G bands
+in the same ath11k/pdev and it needs to enable ht_cap/vht_cap for the 5G
+band, otherwise it will downgrade to non-HT mode for the 5G band. Some
+chips like QCN9074 only support the 6G band, not the 5G band, and use
+the flag ar->supports_6ghz which is true to discard ht_cap/vht_cap.
+
+Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
+
+Signed-off-by: Wen Gong <wgong@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210804181217.88751-2-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -4551,7 +4551,9 @@ static void ath11k_mac_setup_ht_vht_cap(
+ 						    rate_cap_rx_chainmask);
+ 	}
+ 
+-	if (cap->supported_bands & WMI_HOST_WLAN_5G_CAP && !ar->supports_6ghz) {
++	if (cap->supported_bands & WMI_HOST_WLAN_5G_CAP &&
++	    (ar->ab->hw_params.single_pdev_only ||
++	     !ar->supports_6ghz)) {
+ 		band = &ar->mac.sbands[NL80211_BAND_5GHZ];
+ 		ht_cap = cap->band[NL80211_BAND_5GHZ].ht_cap_info;
+ 		if (ht_cap_info)

package/kernel/mac80211/patches/ath11k/0037-ath11k-enable-6G-channels-for-WCN6855.patch

@@ -0,0 +1,98 @@
+From 74bba5e5ba45d511a944082d76b64cc1849e4c2e Mon Sep 17 00:00:00 2001
+From: Wen Gong <wgong@codeaurora.org>
+Date: Tue, 28 Sep 2021 14:00:43 +0300
+Subject: [PATCH] ath11k: enable 6G channels for WCN6855
+
+For some chips such as WCN6855, single_pdev_only is set in struct
+ath11k_hw_params which means ath11k calls ieee80211_register_hw() only
+once and create only one device interface, and that device interface
+supports all 2G/5G/6G channels.
+
+ath11k_mac_setup_channels_rates() sets up the channels and it is called
+for each device interface. It is called only once for single_pdev_only,
+and then set up all channels for 2G/5G/6G. The logic of
+ath11k_mac_setup_channels_rates() is not suitable for single_pdev_only,
+it leads to all 6G channels being disabled for the device interface
+which is single_pdev_only such as WCN6855.
+
+Add channel frequency checks for the 6G band and enable the 6G channels
+properly based on what is supported by the chip.
+
+Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
+
+Signed-off-by: Wen Gong <wgong@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210804181217.88751-3-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 25 ++++++++++++++++---------
+ 1 file changed, 16 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -7322,7 +7322,7 @@ static int ath11k_mac_setup_channels_rat
+ 					   u32 supported_bands)
+ {
+ 	struct ieee80211_supported_band *band;
+-	struct ath11k_hal_reg_capabilities_ext *reg_cap;
++	struct ath11k_hal_reg_capabilities_ext *reg_cap, *temp_reg_cap;
+ 	void *channels;
+ 	u32 phy_id;
+ 
+@@ -7332,6 +7332,7 @@ static int ath11k_mac_setup_channels_rat
+ 		     ATH11K_NUM_CHANS);
+ 
+ 	reg_cap = &ar->ab->hal_reg_cap[ar->pdev_idx];
++	temp_reg_cap = reg_cap;
+ 
+ 	if (supported_bands & WMI_HOST_WLAN_2G_CAP) {
+ 		channels = kmemdup(ath11k_2ghz_channels,
+@@ -7350,11 +7351,11 @@ static int ath11k_mac_setup_channels_rat
+ 
+ 		if (ar->ab->hw_params.single_pdev_only) {
+ 			phy_id = ath11k_get_phy_id(ar, WMI_HOST_WLAN_2G_CAP);
+-			reg_cap = &ar->ab->hal_reg_cap[phy_id];
++			temp_reg_cap = &ar->ab->hal_reg_cap[phy_id];
+ 		}
+ 		ath11k_mac_update_ch_list(ar, band,
+-					  reg_cap->low_2ghz_chan,
+-					  reg_cap->high_2ghz_chan);
++					  temp_reg_cap->low_2ghz_chan,
++					  temp_reg_cap->high_2ghz_chan);
+ 	}
+ 
+ 	if (supported_bands & WMI_HOST_WLAN_5G_CAP) {
+@@ -7374,9 +7375,15 @@ static int ath11k_mac_setup_channels_rat
+ 			band->n_bitrates = ath11k_a_rates_size;
+ 			band->bitrates = ath11k_a_rates;
+ 			ar->hw->wiphy->bands[NL80211_BAND_6GHZ] = band;
++
++			if (ar->ab->hw_params.single_pdev_only) {
++				phy_id = ath11k_get_phy_id(ar, WMI_HOST_WLAN_5G_CAP);
++				temp_reg_cap = &ar->ab->hal_reg_cap[phy_id];
++			}
++
+ 			ath11k_mac_update_ch_list(ar, band,
+-						  reg_cap->low_5ghz_chan,
+-						  reg_cap->high_5ghz_chan);
++						  temp_reg_cap->low_5ghz_chan,
++						  temp_reg_cap->high_5ghz_chan);
+ 		}
+ 
+ 		if (reg_cap->low_5ghz_chan < ATH11K_MIN_6G_FREQ) {
+@@ -7399,12 +7406,12 @@ static int ath11k_mac_setup_channels_rat
+ 
+ 			if (ar->ab->hw_params.single_pdev_only) {
+ 				phy_id = ath11k_get_phy_id(ar, WMI_HOST_WLAN_5G_CAP);
+-				reg_cap = &ar->ab->hal_reg_cap[phy_id];
++				temp_reg_cap = &ar->ab->hal_reg_cap[phy_id];
+ 			}
+ 
+ 			ath11k_mac_update_ch_list(ar, band,
+-						  reg_cap->low_5ghz_chan,
+-						  reg_cap->high_5ghz_chan);
++						  temp_reg_cap->low_5ghz_chan,
++						  temp_reg_cap->high_5ghz_chan);
+ 		}
+ 	}
+ 

package/kernel/mac80211/patches/ath11k/0038-ath11k-copy-cap-info-of-6G-band-under-WMI_HOST_WLAN_.patch

@@ -0,0 +1,54 @@
+From 0f17ae43823b237c73ff138bc067229f7c57e3a2 Mon Sep 17 00:00:00 2001
+From: Wen Gong <wgong@codeaurora.org>
+Date: Tue, 28 Sep 2021 14:00:43 +0300
+Subject: [PATCH] ath11k: copy cap info of 6G band under WMI_HOST_WLAN_5G_CAP
+ for WCN6855
+
+WCN6855 has 2 phys, one is 2G, another is 5G/6G, so it should copy the
+cap info of 6G band under the check of WMI_HOST_WLAN_5G_CAP as well as
+for the 5G band. Some chips like QCN9074 only have 6G, not have 2G and
+5G, and this 6G capability is also under WMI_HOST_WLAN_5G_CAP, so this
+change will not disturb it.
+
+Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
+
+Signed-off-by: Wen Gong <wgong@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210804181217.88751-4-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/wmi.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -407,18 +407,18 @@ ath11k_pull_mac_phy_cap_svc_ready_ext(st
+ 		       sizeof(u32) * PSOC_HOST_MAX_PHY_SIZE);
+ 		memcpy(&cap_band->he_ppet, &mac_phy_caps->he_ppet5g,
+ 		       sizeof(struct ath11k_ppe_threshold));
+-	}
+ 
+-	cap_band = &pdev_cap->band[NL80211_BAND_6GHZ];
+-	cap_band->max_bw_supported = mac_phy_caps->max_bw_supported_5g;
+-	cap_band->ht_cap_info = mac_phy_caps->ht_cap_info_5g;
+-	cap_band->he_cap_info[0] = mac_phy_caps->he_cap_info_5g;
+-	cap_band->he_cap_info[1] = mac_phy_caps->he_cap_info_5g_ext;
+-	cap_band->he_mcs = mac_phy_caps->he_supp_mcs_5g;
+-	memcpy(cap_band->he_cap_phy_info, &mac_phy_caps->he_cap_phy_info_5g,
+-	       sizeof(u32) * PSOC_HOST_MAX_PHY_SIZE);
+-	memcpy(&cap_band->he_ppet, &mac_phy_caps->he_ppet5g,
+-	       sizeof(struct ath11k_ppe_threshold));
++		cap_band = &pdev_cap->band[NL80211_BAND_6GHZ];
++		cap_band->max_bw_supported = mac_phy_caps->max_bw_supported_5g;
++		cap_band->ht_cap_info = mac_phy_caps->ht_cap_info_5g;
++		cap_band->he_cap_info[0] = mac_phy_caps->he_cap_info_5g;
++		cap_band->he_cap_info[1] = mac_phy_caps->he_cap_info_5g_ext;
++		cap_band->he_mcs = mac_phy_caps->he_supp_mcs_5g;
++		memcpy(cap_band->he_cap_phy_info, &mac_phy_caps->he_cap_phy_info_5g,
++		       sizeof(u32) * PSOC_HOST_MAX_PHY_SIZE);
++		memcpy(&cap_band->he_ppet, &mac_phy_caps->he_ppet5g,
++		       sizeof(struct ath11k_ppe_threshold));
++	}
+ 
+ 	return 0;
+ }

package/kernel/mac80211/patches/ath11k/0039-ath11k-Drop-MSDU-with-length-error-in-DP-rx-path.patch

@@ -0,0 +1,57 @@
+From cd18ed4cf8051ceb8590263f5914cb9bb58b0f25 Mon Sep 17 00:00:00 2001
+From: Baochen Qiang <bqiang@codeaurora.org>
+Date: Tue, 28 Sep 2021 14:00:43 +0300
+Subject: [PATCH] ath11k: Drop MSDU with length error in DP rx path
+
+There are MSDUs whose length are invalid. For example,
+attackers may inject on purpose truncated A-MSDUs with
+invalid MSDU length.
+
+Such MSDUs are marked with an err bit set in rx attention
+tlvs, so we can check and drop them.
+
+Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1
+Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
+
+Signed-off-by: Baochen Qiang <bqiang@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210913180246.193388-2-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -142,6 +142,18 @@ static u32 ath11k_dp_rx_h_attn_mpdu_err(
+ 	return errmap;
+ }
+ 
++static bool ath11k_dp_rx_h_attn_msdu_len_err(struct ath11k_base *ab,
++					     struct hal_rx_desc *desc)
++{
++	struct rx_attention *rx_attention;
++	u32 errmap;
++
++	rx_attention = ath11k_dp_rx_get_attention(ab, desc);
++	errmap = ath11k_dp_rx_h_attn_mpdu_err(rx_attention);
++
++	return errmap & DP_RX_MPDU_ERR_MSDU_LEN;
++}
++
+ static u16 ath11k_dp_rx_h_msdu_start_msdu_len(struct ath11k_base *ab,
+ 					      struct hal_rx_desc *desc)
+ {
+@@ -2525,6 +2537,12 @@ static int ath11k_dp_rx_process_msdu(str
+ 	}
+ 
+ 	rx_desc = (struct hal_rx_desc *)msdu->data;
++	if (ath11k_dp_rx_h_attn_msdu_len_err(ab, rx_desc)) {
++		ath11k_warn(ar->ab, "msdu len not valid\n");
++		ret = -EIO;
++		goto free_out;
++	}
++
+ 	lrx_desc = (struct hal_rx_desc *)last_buf->data;
+ 	rx_attention = ath11k_dp_rx_get_attention(ab, lrx_desc);
+ 	if (!ath11k_dp_rx_h_attn_msdu_done(rx_attention)) {

package/kernel/mac80211/patches/ath11k/0040-ath11k-Fix-inaccessible-debug-registers.patch

@@ -0,0 +1,46 @@
+From 8a0b899f169d6b6102918327d026922140194fff Mon Sep 17 00:00:00 2001
+From: Baochen Qiang <bqiang@codeaurora.org>
+Date: Tue, 28 Sep 2021 14:00:44 +0300
+Subject: [PATCH] ath11k: Fix inaccessible debug registers
+
+Current code clears debug registers after SOC global reset performed
+in ath11k_pci_sw_reset. However at that time those registers are
+not accessible due to reset, thus they are actually not cleared at all.
+For WCN6855, it may cause target fail to initialize. This issue can be
+fixed by moving clear action ahead.
+
+In addition, on some specific platforms, need to add delay to wait
+those registers to become accessible.
+
+Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
+
+Signed-off-by: Baochen Qiang <bqiang@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210913180246.193388-3-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/pci.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/pci.c
++++ b/drivers/net/wireless/ath/ath11k/pci.c
+@@ -430,6 +430,8 @@ static void ath11k_pci_force_wake(struct
+ 
+ static void ath11k_pci_sw_reset(struct ath11k_base *ab, bool power_on)
+ {
++	mdelay(100);
++
+ 	if (power_on) {
+ 		ath11k_pci_enable_ltssm(ab);
+ 		ath11k_pci_clear_all_intrs(ab);
+@@ -439,9 +441,9 @@ static void ath11k_pci_sw_reset(struct a
+ 	}
+ 
+ 	ath11k_mhi_clear_vector(ab);
++	ath11k_pci_clear_dbg_registers(ab);
+ 	ath11k_pci_soc_global_reset(ab);
+ 	ath11k_mhi_set_mhictrl_reset(ab);
+-	ath11k_pci_clear_dbg_registers(ab);
+ }
+ 
+ int ath11k_pci_get_msi_irq(struct device *dev, unsigned int vector)

package/kernel/mac80211/patches/ath11k/0042-ath11k-Rename-macro-ARRAY_TO_STRING-to-PRINT_ARRAY_T.patch

@@ -0,0 +1,852 @@
+From 9e2e2d7a4dd490ff6e95e37611070d3b3a9cf58b Mon Sep 17 00:00:00 2001
+From: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+Date: Tue, 28 Sep 2021 14:00:44 +0300
+Subject: [PATCH] ath11k: Rename macro ARRAY_TO_STRING to PRINT_ARRAY_TO_BUF
+
+Renaming of macro is done to describe the macro functionality
+better as the macro functionality is modified in next patch-sets.
+No functional changes are done.
+
+Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210913223148.208026-2-jouni@codeaurora.org
+---
+ .../wireless/ath/ath11k/debugfs_htt_stats.c   | 378 +++++++++---------
+ 1 file changed, 189 insertions(+), 189 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.c
+@@ -18,7 +18,7 @@
+ 
+ #define HTT_TLV_HDR_LEN 4
+ 
+-#define ARRAY_TO_STRING(out, arr, len)							\
++#define PRINT_ARRAY_TO_BUF(out, arr, len)						\
+ 	do {										\
+ 		int index = 0; u8 i;							\
+ 		for (i = 0; i < len; i++) {						\
+@@ -195,7 +195,7 @@ htt_print_tx_pdev_stats_urrn_tlv_v(const
+ 
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "HTT_TX_PDEV_STATS_URRN_TLV_V:");
+ 
+-	ARRAY_TO_STRING(urrn_stats, htt_stats_buf->urrn_stats, num_elems);
++	PRINT_ARRAY_TO_BUF(urrn_stats, htt_stats_buf->urrn_stats, num_elems);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "urrn_stats = %s\n", urrn_stats);
+ 
+ 	if (len >= buf_len)
+@@ -220,7 +220,7 @@ htt_print_tx_pdev_stats_flush_tlv_v(cons
+ 
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "HTT_TX_PDEV_STATS_FLUSH_TLV_V:");
+ 
+-	ARRAY_TO_STRING(flush_errs, htt_stats_buf->flush_errs, num_elems);
++	PRINT_ARRAY_TO_BUF(flush_errs, htt_stats_buf->flush_errs, num_elems);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "flush_errs = %s\n", flush_errs);
+ 
+ 	if (len >= buf_len)
+@@ -245,7 +245,7 @@ htt_print_tx_pdev_stats_sifs_tlv_v(const
+ 
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "HTT_TX_PDEV_STATS_SIFS_TLV_V:");
+ 
+-	ARRAY_TO_STRING(sifs_status, htt_stats_buf->sifs_status, num_elems);
++	PRINT_ARRAY_TO_BUF(sifs_status, htt_stats_buf->sifs_status, num_elems);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "sifs_status = %s\n",
+ 			   sifs_status);
+ 
+@@ -271,7 +271,7 @@ htt_print_tx_pdev_stats_phy_err_tlv_v(co
+ 
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "HTT_TX_PDEV_STATS_PHY_ERR_TLV_V:");
+ 
+-	ARRAY_TO_STRING(phy_errs, htt_stats_buf->phy_errs, num_elems);
++	PRINT_ARRAY_TO_BUF(phy_errs, htt_stats_buf->phy_errs, num_elems);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "phy_errs = %s\n", phy_errs);
+ 
+ 	if (len >= buf_len)
+@@ -297,7 +297,7 @@ htt_print_tx_pdev_stats_sifs_hist_tlv_v(
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len,
+ 			   "HTT_TX_PDEV_STATS_SIFS_HIST_TLV_V:");
+ 
+-	ARRAY_TO_STRING(sifs_hist_status, htt_stats_buf->sifs_hist_status, num_elems);
++	PRINT_ARRAY_TO_BUF(sifs_hist_status, htt_stats_buf->sifs_hist_status, num_elems);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "sifs_hist_status = %s\n",
+ 			   sifs_hist_status);
+ 
+@@ -363,9 +363,9 @@ htt_print_tx_pdev_stats_tried_mpdu_cnt_h
+ 			   htt_stats_buf->hist_bin_size);
+ 
+ 	if (required_buffer_size < HTT_MAX_STRING_LEN) {
+-		ARRAY_TO_STRING(tried_mpdu_cnt_hist,
+-				htt_stats_buf->tried_mpdu_cnt_hist,
+-				num_elements);
++		PRINT_ARRAY_TO_BUF(tried_mpdu_cnt_hist,
++				   htt_stats_buf->tried_mpdu_cnt_hist,
++				   num_elements);
+ 		len += HTT_DBG_OUT(buf + len, buf_len - len, "tried_mpdu_cnt_hist = %s\n",
+ 				   tried_mpdu_cnt_hist);
+ 	} else {
+@@ -667,9 +667,9 @@ static inline void htt_print_counter_tlv
+ 
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "HTT_COUNTER_TLV:");
+ 
+-	ARRAY_TO_STRING(counter_name,
+-			htt_stats_buf->counter_name,
+-			HTT_MAX_COUNTER_NAME);
++	PRINT_ARRAY_TO_BUF(counter_name,
++			   htt_stats_buf->counter_name,
++			   HTT_MAX_COUNTER_NAME);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "counter_name = %s ", counter_name);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "count = %u\n",
+ 			   htt_stats_buf->count);
+@@ -794,54 +794,54 @@ static inline void htt_print_tx_peer_rat
+ 			   htt_stats_buf->ack_rssi);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->tx_mcs,
+-			HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->tx_mcs,
++			   HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_mcs = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->tx_su_mcs,
+-			HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->tx_su_mcs,
++			   HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_su_mcs = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->tx_mu_mcs,
+-			HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->tx_mu_mcs,
++			   HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_mu_mcs = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf,
+-			htt_stats_buf->tx_nss,
+-			HTT_TX_PDEV_STATS_NUM_SPATIAL_STREAMS);
++	PRINT_ARRAY_TO_BUF(str_buf,
++			   htt_stats_buf->tx_nss,
++			   HTT_TX_PDEV_STATS_NUM_SPATIAL_STREAMS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_nss = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf,
+-			htt_stats_buf->tx_bw,
+-			HTT_TX_PDEV_STATS_NUM_BW_COUNTERS);
++	PRINT_ARRAY_TO_BUF(str_buf,
++			   htt_stats_buf->tx_bw,
++			   HTT_TX_PDEV_STATS_NUM_BW_COUNTERS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_bw = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->tx_stbc,
+-			HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->tx_stbc,
++			   HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_stbc = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->tx_pream,
+-			HTT_TX_PDEV_STATS_NUM_PREAMBLE_TYPES);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->tx_pream,
++			   HTT_TX_PDEV_STATS_NUM_PREAMBLE_TYPES);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_pream = %s ", str_buf);
+ 
+ 	for (j = 0; j < HTT_TX_PEER_STATS_NUM_GI_COUNTERS; j++) {
+-		ARRAY_TO_STRING(tx_gi[j],
+-				htt_stats_buf->tx_gi[j],
+-				HTT_TX_PEER_STATS_NUM_MCS_COUNTERS);
++		PRINT_ARRAY_TO_BUF(tx_gi[j],
++				   htt_stats_buf->tx_gi[j],
++				   HTT_TX_PEER_STATS_NUM_MCS_COUNTERS);
+ 		len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_gi[%u] = %s ",
+-				j, tx_gi[j]);
++				   j, tx_gi[j]);
+ 	}
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf,
+-			htt_stats_buf->tx_dcm,
+-			HTT_TX_PDEV_STATS_NUM_DCM_COUNTERS);
++	PRINT_ARRAY_TO_BUF(str_buf,
++			   htt_stats_buf->tx_dcm,
++			   HTT_TX_PDEV_STATS_NUM_DCM_COUNTERS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_dcm = %s\n", str_buf);
+ 
+ 	if (len >= buf_len)
+@@ -895,47 +895,47 @@ static inline void htt_print_rx_peer_rat
+ 			   htt_stats_buf->rssi_comb);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_mcs,
+-			HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_mcs,
++			   HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_mcs = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_nss,
+-			HTT_RX_PDEV_STATS_NUM_SPATIAL_STREAMS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_nss,
++			   HTT_RX_PDEV_STATS_NUM_SPATIAL_STREAMS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_nss = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_dcm,
+-			HTT_RX_PDEV_STATS_NUM_DCM_COUNTERS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_dcm,
++			   HTT_RX_PDEV_STATS_NUM_DCM_COUNTERS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_dcm = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_stbc,
+-			HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_stbc,
++			   HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_stbc = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_bw,
+-			HTT_RX_PDEV_STATS_NUM_BW_COUNTERS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_bw,
++			   HTT_RX_PDEV_STATS_NUM_BW_COUNTERS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_bw = %s ", str_buf);
+ 
+ 	for (j = 0; j < HTT_RX_PEER_STATS_NUM_SPATIAL_STREAMS; j++) {
+-		ARRAY_TO_STRING(rssi_chain[j], htt_stats_buf->rssi_chain[j],
+-				HTT_RX_PEER_STATS_NUM_BW_COUNTERS);
++		PRINT_ARRAY_TO_BUF(rssi_chain[j], htt_stats_buf->rssi_chain[j],
++				   HTT_RX_PEER_STATS_NUM_BW_COUNTERS);
+ 		len += HTT_DBG_OUT(buf + len, buf_len - len, "rssi_chain[%u] = %s ",
+ 				   j, rssi_chain[j]);
+ 	}
+ 
+ 	for (j = 0; j < HTT_RX_PEER_STATS_NUM_GI_COUNTERS; j++) {
+-		ARRAY_TO_STRING(rx_gi[j], htt_stats_buf->rx_gi[j],
+-				HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
++		PRINT_ARRAY_TO_BUF(rx_gi[j], htt_stats_buf->rx_gi[j],
++				   HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
+ 		len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_gi[%u] = %s ",
+-				j, rx_gi[j]);
++				   j, rx_gi[j]);
+ 	}
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_pream,
+-			HTT_RX_PDEV_STATS_NUM_PREAMBLE_TYPES);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_pream,
++			   HTT_RX_PDEV_STATS_NUM_PREAMBLE_TYPES);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_pream = %s\n", str_buf);
+ 
+ 	if (len >= buf_len)
+@@ -1115,10 +1115,10 @@ htt_print_tx_hwq_difs_latency_stats_tlv_
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "hist_intvl = %u",
+ 			htt_stats_buf->hist_intvl);
+ 
+-	ARRAY_TO_STRING(difs_latency_hist, htt_stats_buf->difs_latency_hist,
+-			data_len);
++	PRINT_ARRAY_TO_BUF(difs_latency_hist, htt_stats_buf->difs_latency_hist,
++			   data_len);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "difs_latency_hist = %s\n",
+-			difs_latency_hist);
++			   difs_latency_hist);
+ 
+ 	if (len >= buf_len)
+ 		buf[buf_len - 1] = 0;
+@@ -1145,7 +1145,7 @@ htt_print_tx_hwq_cmd_result_stats_tlv_v(
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len,
+ 			   "HTT_TX_HWQ_CMD_RESULT_STATS_TLV_V:");
+ 
+-	ARRAY_TO_STRING(cmd_result, htt_stats_buf->cmd_result, data_len);
++	PRINT_ARRAY_TO_BUF(cmd_result, htt_stats_buf->cmd_result, data_len);
+ 
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "cmd_result = %s\n", cmd_result);
+ 
+@@ -1173,7 +1173,7 @@ htt_print_tx_hwq_cmd_stall_stats_tlv_v(c
+ 
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "HTT_TX_HWQ_CMD_STALL_STATS_TLV_V:");
+ 
+-	ARRAY_TO_STRING(cmd_stall_status, htt_stats_buf->cmd_stall_status, num_elems);
++	PRINT_ARRAY_TO_BUF(cmd_stall_status, htt_stats_buf->cmd_stall_status, num_elems);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "cmd_stall_status = %s\n",
+ 			   cmd_stall_status);
+ 
+@@ -1202,7 +1202,7 @@ htt_print_tx_hwq_fes_result_stats_tlv_v(
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len,
+ 			   "HTT_TX_HWQ_FES_RESULT_STATS_TLV_V:");
+ 
+-	ARRAY_TO_STRING(fes_result, htt_stats_buf->fes_result, num_elems);
++	PRINT_ARRAY_TO_BUF(fes_result, htt_stats_buf->fes_result, num_elems);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "fes_result = %s\n", fes_result);
+ 
+ 	if (len >= buf_len)
+@@ -1233,9 +1233,9 @@ htt_print_tx_hwq_tried_mpdu_cnt_hist_tlv
+ 			   htt_stats_buf->hist_bin_size);
+ 
+ 	if (required_buffer_size < HTT_MAX_STRING_LEN) {
+-		ARRAY_TO_STRING(tried_mpdu_cnt_hist,
+-				htt_stats_buf->tried_mpdu_cnt_hist,
+-				num_elements);
++		PRINT_ARRAY_TO_BUF(tried_mpdu_cnt_hist,
++				   htt_stats_buf->tried_mpdu_cnt_hist,
++				   num_elements);
+ 		len += HTT_DBG_OUT(buf + len, buf_len - len,
+ 				   "tried_mpdu_cnt_hist = %s\n",
+ 				   tried_mpdu_cnt_hist);
+@@ -1269,9 +1269,9 @@ htt_print_tx_hwq_txop_used_cnt_hist_tlv_
+ 			   "HTT_TX_HWQ_TXOP_USED_CNT_HIST_TLV_V:");
+ 
+ 	if (required_buffer_size < HTT_MAX_STRING_LEN) {
+-		ARRAY_TO_STRING(txop_used_cnt_hist,
+-				htt_stats_buf->txop_used_cnt_hist,
+-				num_elements);
++		PRINT_ARRAY_TO_BUF(txop_used_cnt_hist,
++				   htt_stats_buf->txop_used_cnt_hist,
++				   num_elements);
+ 		len += HTT_DBG_OUT(buf + len, buf_len - len, "txop_used_cnt_hist = %s\n",
+ 				   txop_used_cnt_hist);
+ 	} else {
+@@ -1790,8 +1790,8 @@ htt_print_sched_txq_cmd_posted_tlv_v(con
+ 
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "HTT_SCHED_TXQ_CMD_POSTED_TLV_V:");
+ 
+-	ARRAY_TO_STRING(sched_cmd_posted, htt_stats_buf->sched_cmd_posted,
+-			num_elements);
++	PRINT_ARRAY_TO_BUF(sched_cmd_posted, htt_stats_buf->sched_cmd_posted,
++			   num_elements);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "sched_cmd_posted = %s\n",
+ 			   sched_cmd_posted);
+ 
+@@ -1817,8 +1817,8 @@ htt_print_sched_txq_cmd_reaped_tlv_v(con
+ 
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "HTT_SCHED_TXQ_CMD_REAPED_TLV_V:");
+ 
+-	ARRAY_TO_STRING(sched_cmd_reaped, htt_stats_buf->sched_cmd_reaped,
+-			num_elements);
++	PRINT_ARRAY_TO_BUF(sched_cmd_reaped, htt_stats_buf->sched_cmd_reaped,
++			   num_elements);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "sched_cmd_reaped = %s\n",
+ 			   sched_cmd_reaped);
+ 
+@@ -1847,8 +1847,8 @@ htt_print_sched_txq_sched_order_su_tlv_v
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len,
+ 			   "HTT_SCHED_TXQ_SCHED_ORDER_SU_TLV_V:");
+ 
+-	ARRAY_TO_STRING(sched_order_su, htt_stats_buf->sched_order_su,
+-			sched_order_su_num_entries);
++	PRINT_ARRAY_TO_BUF(sched_order_su, htt_stats_buf->sched_order_su,
++			   sched_order_su_num_entries);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "sched_order_su = %s\n",
+ 			   sched_order_su);
+ 
+@@ -1876,8 +1876,8 @@ htt_print_sched_txq_sched_ineligibility_
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len,
+ 			   "HTT_SCHED_TXQ_SCHED_INELIGIBILITY_V:");
+ 
+-	ARRAY_TO_STRING(sched_ineligibility, htt_stats_buf->sched_ineligibility,
+-			sched_ineligibility_num_entries);
++	PRINT_ARRAY_TO_BUF(sched_ineligibility, htt_stats_buf->sched_ineligibility,
++			   sched_ineligibility_num_entries);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "sched_ineligibility = %s\n",
+ 			   sched_ineligibility);
+ 
+@@ -1992,8 +1992,8 @@ htt_print_tx_tqm_gen_mpdu_stats_tlv_v(co
+ 
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "HTT_TX_TQM_GEN_MPDU_STATS_TLV_V:");
+ 
+-	ARRAY_TO_STRING(gen_mpdu_end_reason, htt_stats_buf->gen_mpdu_end_reason,
+-			num_elements);
++	PRINT_ARRAY_TO_BUF(gen_mpdu_end_reason, htt_stats_buf->gen_mpdu_end_reason,
++			   num_elements);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "gen_mpdu_end_reason = %s\n",
+ 			   gen_mpdu_end_reason);
+ 
+@@ -2020,8 +2020,8 @@ htt_print_tx_tqm_list_mpdu_stats_tlv_v(c
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len,
+ 			   "HTT_TX_TQM_LIST_MPDU_STATS_TLV_V:");
+ 
+-	ARRAY_TO_STRING(list_mpdu_end_reason, htt_stats_buf->list_mpdu_end_reason,
+-			num_elems);
++	PRINT_ARRAY_TO_BUF(list_mpdu_end_reason, htt_stats_buf->list_mpdu_end_reason,
++			   num_elems);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "list_mpdu_end_reason = %s\n",
+ 			   list_mpdu_end_reason);
+ 	if (len >= buf_len)
+@@ -2047,8 +2047,8 @@ htt_print_tx_tqm_list_mpdu_cnt_tlv_v(con
+ 
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "HTT_TX_TQM_LIST_MPDU_CNT_TLV_V:");
+ 
+-	ARRAY_TO_STRING(list_mpdu_cnt_hist, htt_stats_buf->list_mpdu_cnt_hist,
+-			num_elems);
++	PRINT_ARRAY_TO_BUF(list_mpdu_cnt_hist, htt_stats_buf->list_mpdu_cnt_hist,
++			   num_elems);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "list_mpdu_cnt_hist = %s\n",
+ 			   list_mpdu_cnt_hist);
+ 
+@@ -2539,9 +2539,9 @@ htt_print_tx_de_fw2wbm_ring_full_hist_tl
+ 			   "HTT_TX_DE_FW2WBM_RING_FULL_HIST_TLV");
+ 
+ 	if (required_buffer_size < HTT_MAX_STRING_LEN) {
+-		ARRAY_TO_STRING(fw2wbm_ring_full_hist,
+-				htt_stats_buf->fw2wbm_ring_full_hist,
+-				num_elements);
++		PRINT_ARRAY_TO_BUF(fw2wbm_ring_full_hist,
++				   htt_stats_buf->fw2wbm_ring_full_hist,
++				   num_elements);
+ 		len += HTT_DBG_OUT(buf + len, buf_len - len,
+ 				   "fw2wbm_ring_full_hist = %s\n",
+ 				   fw2wbm_ring_full_hist);
+@@ -2634,13 +2634,13 @@ static inline void htt_print_ring_if_sta
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "cons_blockwait_count = %u",
+ 			   htt_stats_buf->cons_blockwait_count);
+ 
+-	ARRAY_TO_STRING(low_wm_hit_count, htt_stats_buf->low_wm_hit_count,
+-			HTT_STATS_LOW_WM_BINS);
++	PRINT_ARRAY_TO_BUF(low_wm_hit_count, htt_stats_buf->low_wm_hit_count,
++			   HTT_STATS_LOW_WM_BINS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "low_wm_hit_count = %s ",
+ 			   low_wm_hit_count);
+ 
+-	ARRAY_TO_STRING(high_wm_hit_count, htt_stats_buf->high_wm_hit_count,
+-			HTT_STATS_HIGH_WM_BINS);
++	PRINT_ARRAY_TO_BUF(high_wm_hit_count, htt_stats_buf->high_wm_hit_count,
++			   HTT_STATS_HIGH_WM_BINS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "high_wm_hit_count = %s\n",
+ 			   high_wm_hit_count);
+ 
+@@ -2687,9 +2687,9 @@ static inline void htt_print_sfm_client_
+ 
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "HTT_SFM_CLIENT_USER_TLV_V:");
+ 
+-	ARRAY_TO_STRING(dwords_used_by_user_n,
+-			htt_stats_buf->dwords_used_by_user_n,
+-			num_elems);
++	PRINT_ARRAY_TO_BUF(dwords_used_by_user_n,
++			   htt_stats_buf->dwords_used_by_user_n,
++			   num_elems);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "dwords_used_by_user_n = %s\n",
+ 			   dwords_used_by_user_n);
+ 
+@@ -2889,73 +2889,73 @@ static inline void htt_print_tx_pdev_rat
+ 			   htt_stats_buf->tx_legacy_ofdm_rate[7]);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->tx_mcs,
+-			HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->tx_mcs,
++			   HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_mcs = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->ac_mu_mimo_tx_mcs,
+-			HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->ac_mu_mimo_tx_mcs,
++			   HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "ac_mu_mimo_tx_mcs = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->ax_mu_mimo_tx_mcs,
+-			HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->ax_mu_mimo_tx_mcs,
++			   HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "ax_mu_mimo_tx_mcs = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->ofdma_tx_mcs,
+-			HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->ofdma_tx_mcs,
++			   HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "ofdma_tx_mcs = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->tx_nss,
+-			HTT_TX_PDEV_STATS_NUM_SPATIAL_STREAMS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->tx_nss,
++			   HTT_TX_PDEV_STATS_NUM_SPATIAL_STREAMS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_nss = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->ac_mu_mimo_tx_nss,
+-			HTT_TX_PDEV_STATS_NUM_SPATIAL_STREAMS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->ac_mu_mimo_tx_nss,
++			   HTT_TX_PDEV_STATS_NUM_SPATIAL_STREAMS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "ac_mu_mimo_tx_nss = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->ax_mu_mimo_tx_nss,
+-			HTT_TX_PDEV_STATS_NUM_SPATIAL_STREAMS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->ax_mu_mimo_tx_nss,
++			   HTT_TX_PDEV_STATS_NUM_SPATIAL_STREAMS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "ax_mu_mimo_tx_nss = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->ofdma_tx_nss,
+-			HTT_TX_PDEV_STATS_NUM_SPATIAL_STREAMS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->ofdma_tx_nss,
++			   HTT_TX_PDEV_STATS_NUM_SPATIAL_STREAMS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "ofdma_tx_nss = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->tx_bw,
+-			HTT_TX_PDEV_STATS_NUM_BW_COUNTERS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->tx_bw,
++			   HTT_TX_PDEV_STATS_NUM_BW_COUNTERS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_bw = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->ac_mu_mimo_tx_bw,
+-			HTT_TX_PDEV_STATS_NUM_BW_COUNTERS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->ac_mu_mimo_tx_bw,
++			   HTT_TX_PDEV_STATS_NUM_BW_COUNTERS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "ac_mu_mimo_tx_bw = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->ax_mu_mimo_tx_bw,
+-			HTT_TX_PDEV_STATS_NUM_BW_COUNTERS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->ax_mu_mimo_tx_bw,
++			   HTT_TX_PDEV_STATS_NUM_BW_COUNTERS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "ax_mu_mimo_tx_bw = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->ofdma_tx_bw,
+-			HTT_TX_PDEV_STATS_NUM_BW_COUNTERS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->ofdma_tx_bw,
++			   HTT_TX_PDEV_STATS_NUM_BW_COUNTERS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "ofdma_tx_bw = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->tx_stbc,
+-			HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->tx_stbc,
++			   HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_stbc = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->tx_pream,
+-			HTT_TX_PDEV_STATS_NUM_PREAMBLE_TYPES);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->tx_pream,
++			   HTT_TX_PDEV_STATS_NUM_PREAMBLE_TYPES);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_pream = %s ", str_buf);
+ 
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "HE LTF: 1x: %u, 2x: %u, 4x: %u",
+@@ -2965,16 +2965,16 @@ static inline void htt_print_tx_pdev_rat
+ 
+ 	/* SU GI Stats */
+ 	for (j = 0; j < HTT_TX_PDEV_STATS_NUM_GI_COUNTERS; j++) {
+-		ARRAY_TO_STRING(tx_gi[j], htt_stats_buf->tx_gi[j],
+-				HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
++		PRINT_ARRAY_TO_BUF(tx_gi[j], htt_stats_buf->tx_gi[j],
++				   HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
+ 		len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_gi[%u] = %s ",
+ 				   j, tx_gi[j]);
+ 	}
+ 
+ 	/* AC MU-MIMO GI Stats */
+ 	for (j = 0; j < HTT_TX_PDEV_STATS_NUM_GI_COUNTERS; j++) {
+-		ARRAY_TO_STRING(tx_gi[j], htt_stats_buf->ac_mu_mimo_tx_gi[j],
+-				HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
++		PRINT_ARRAY_TO_BUF(tx_gi[j], htt_stats_buf->ac_mu_mimo_tx_gi[j],
++				   HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
+ 		len += HTT_DBG_OUT(buf + len, buf_len - len,
+ 				   "ac_mu_mimo_tx_gi[%u] = %s ",
+ 				   j, tx_gi[j]);
+@@ -2982,8 +2982,8 @@ static inline void htt_print_tx_pdev_rat
+ 
+ 	/* AX MU-MIMO GI Stats */
+ 	for (j = 0; j < HTT_TX_PDEV_STATS_NUM_GI_COUNTERS; j++) {
+-		ARRAY_TO_STRING(tx_gi[j], htt_stats_buf->ax_mu_mimo_tx_gi[j],
+-				HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
++		PRINT_ARRAY_TO_BUF(tx_gi[j], htt_stats_buf->ax_mu_mimo_tx_gi[j],
++				   HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
+ 		len += HTT_DBG_OUT(buf + len, buf_len - len,
+ 				   "ax_mu_mimo_tx_gi[%u] = %s ",
+ 				   j, tx_gi[j]);
+@@ -2991,15 +2991,15 @@ static inline void htt_print_tx_pdev_rat
+ 
+ 	/* DL OFDMA GI Stats */
+ 	for (j = 0; j < HTT_TX_PDEV_STATS_NUM_GI_COUNTERS; j++) {
+-		ARRAY_TO_STRING(tx_gi[j], htt_stats_buf->ofdma_tx_gi[j],
+-				HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
++		PRINT_ARRAY_TO_BUF(tx_gi[j], htt_stats_buf->ofdma_tx_gi[j],
++				   HTT_TX_PDEV_STATS_NUM_MCS_COUNTERS);
+ 		len += HTT_DBG_OUT(buf + len, buf_len - len, "ofdma_tx_gi[%u] = %s ",
+ 				   j, tx_gi[j]);
+ 	}
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->tx_dcm,
+-			HTT_TX_PDEV_STATS_NUM_DCM_COUNTERS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->tx_dcm,
++			   HTT_TX_PDEV_STATS_NUM_DCM_COUNTERS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "tx_dcm = %s\n", str_buf);
+ 
+ 	if (len >= buf_len)
+@@ -3064,28 +3064,28 @@ static inline void htt_print_rx_pdev_rat
+ 			   htt_stats_buf->rssi_in_dbm);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_mcs,
+-			HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_mcs,
++			   HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_mcs = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_nss,
+-			HTT_RX_PDEV_STATS_NUM_SPATIAL_STREAMS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_nss,
++			   HTT_RX_PDEV_STATS_NUM_SPATIAL_STREAMS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_nss = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_dcm,
+-			HTT_RX_PDEV_STATS_NUM_DCM_COUNTERS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_dcm,
++			   HTT_RX_PDEV_STATS_NUM_DCM_COUNTERS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_dcm = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_stbc,
+-			HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_stbc,
++			   HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_stbc = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_bw,
+-			HTT_RX_PDEV_STATS_NUM_BW_COUNTERS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_bw,
++			   HTT_RX_PDEV_STATS_NUM_BW_COUNTERS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_bw = %s ", str_buf);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_evm_nss_count = %u",
+ 			htt_stats_buf->nss_count);
+@@ -3115,22 +3115,22 @@ static inline void htt_print_rx_pdev_rat
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "pilot_evm_dB_mean = %s ", str_buf);
+ 
+ 	for (j = 0; j < HTT_RX_PDEV_STATS_NUM_SPATIAL_STREAMS; j++) {
+-		ARRAY_TO_STRING(rssi_chain[j], htt_stats_buf->rssi_chain[j],
+-				HTT_RX_PDEV_STATS_NUM_BW_COUNTERS);
++		PRINT_ARRAY_TO_BUF(rssi_chain[j], htt_stats_buf->rssi_chain[j],
++				   HTT_RX_PDEV_STATS_NUM_BW_COUNTERS);
+ 		len += HTT_DBG_OUT(buf + len, buf_len - len, "rssi_chain[%u] = %s ",
+ 				   j, rssi_chain[j]);
+ 	}
+ 
+ 	for (j = 0; j < HTT_RX_PDEV_STATS_NUM_GI_COUNTERS; j++) {
+-		ARRAY_TO_STRING(rx_gi[j], htt_stats_buf->rx_gi[j],
+-				HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
++		PRINT_ARRAY_TO_BUF(rx_gi[j], htt_stats_buf->rx_gi[j],
++				   HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
+ 		len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_gi[%u] = %s ",
+ 				   j, rx_gi[j]);
+ 	}
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_pream,
+-			HTT_RX_PDEV_STATS_NUM_PREAMBLE_TYPES);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_pream,
++			   HTT_RX_PDEV_STATS_NUM_PREAMBLE_TYPES);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_pream = %s", str_buf);
+ 
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_11ax_su_ext = %u",
+@@ -3145,14 +3145,14 @@ static inline void htt_print_rx_pdev_rat
+ 			   htt_stats_buf->txbf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_legacy_cck_rate,
+-			HTT_RX_PDEV_STATS_NUM_LEGACY_CCK_STATS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_legacy_cck_rate,
++			   HTT_RX_PDEV_STATS_NUM_LEGACY_CCK_STATS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_legacy_cck_rate = %s ",
+ 			   str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_legacy_ofdm_rate,
+-			HTT_RX_PDEV_STATS_NUM_LEGACY_OFDM_STATS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_legacy_ofdm_rate,
++			   HTT_RX_PDEV_STATS_NUM_LEGACY_OFDM_STATS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_legacy_ofdm_rate = %s ",
+ 			   str_buf);
+ 
+@@ -3164,25 +3164,25 @@ static inline void htt_print_rx_pdev_rat
+ 			htt_stats_buf->rx_11ax_ul_ofdma);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->ul_ofdma_rx_mcs,
+-			HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->ul_ofdma_rx_mcs,
++			   HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "ul_ofdma_rx_mcs = %s ", str_buf);
+ 
+ 	for (j = 0; j < HTT_RX_PDEV_STATS_NUM_GI_COUNTERS; j++) {
+-		ARRAY_TO_STRING(rx_gi[j], htt_stats_buf->ul_ofdma_rx_gi[j],
+-				HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
++		PRINT_ARRAY_TO_BUF(rx_gi[j], htt_stats_buf->ul_ofdma_rx_gi[j],
++				   HTT_RX_PDEV_STATS_NUM_MCS_COUNTERS);
+ 		len += HTT_DBG_OUT(buf + len, buf_len - len, "ul_ofdma_rx_gi[%u] = %s ",
+ 				   j, rx_gi[j]);
+ 	}
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->ul_ofdma_rx_nss,
+-			HTT_RX_PDEV_STATS_NUM_SPATIAL_STREAMS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->ul_ofdma_rx_nss,
++			   HTT_RX_PDEV_STATS_NUM_SPATIAL_STREAMS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "ul_ofdma_rx_nss = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->ul_ofdma_rx_bw,
+-			HTT_RX_PDEV_STATS_NUM_BW_COUNTERS);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->ul_ofdma_rx_bw,
++			   HTT_RX_PDEV_STATS_NUM_BW_COUNTERS);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "ul_ofdma_rx_bw = %s ", str_buf);
+ 
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "ul_ofdma_rx_stbc = %u",
+@@ -3191,25 +3191,25 @@ static inline void htt_print_rx_pdev_rat
+ 			htt_stats_buf->ul_ofdma_rx_ldpc);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_ulofdma_non_data_ppdu,
+-			HTT_RX_PDEV_MAX_OFDMA_NUM_USER);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_ulofdma_non_data_ppdu,
++			   HTT_RX_PDEV_MAX_OFDMA_NUM_USER);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_ulofdma_non_data_ppdu = %s ",
+ 			   str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_ulofdma_data_ppdu,
+-			HTT_RX_PDEV_MAX_OFDMA_NUM_USER);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_ulofdma_data_ppdu,
++			   HTT_RX_PDEV_MAX_OFDMA_NUM_USER);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_ulofdma_data_ppdu = %s ",
+ 			   str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_ulofdma_mpdu_ok,
+-			HTT_RX_PDEV_MAX_OFDMA_NUM_USER);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_ulofdma_mpdu_ok,
++			   HTT_RX_PDEV_MAX_OFDMA_NUM_USER);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_ulofdma_mpdu_ok = %s ", str_buf);
+ 
+ 	memset(str_buf, 0x0, HTT_MAX_STRING_LEN);
+-	ARRAY_TO_STRING(str_buf, htt_stats_buf->rx_ulofdma_mpdu_fail,
+-			HTT_RX_PDEV_MAX_OFDMA_NUM_USER);
++	PRINT_ARRAY_TO_BUF(str_buf, htt_stats_buf->rx_ulofdma_mpdu_fail,
++			   HTT_RX_PDEV_MAX_OFDMA_NUM_USER);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rx_ulofdma_mpdu_fail = %s",
+ 			   str_buf);
+ 
+@@ -3320,9 +3320,9 @@ htt_print_rx_soc_fw_refill_ring_empty_tl
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len,
+ 			   "HTT_RX_SOC_FW_REFILL_RING_EMPTY_TLV_V:");
+ 
+-	ARRAY_TO_STRING(refill_ring_empty_cnt,
+-			htt_stats_buf->refill_ring_empty_cnt,
+-			num_elems);
++	PRINT_ARRAY_TO_BUF(refill_ring_empty_cnt,
++			   htt_stats_buf->refill_ring_empty_cnt,
++			   num_elems);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "refill_ring_empty_cnt = %s\n",
+ 			   refill_ring_empty_cnt);
+ 
+@@ -3350,9 +3350,9 @@ htt_print_rx_soc_fw_refill_ring_num_rxdm
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len,
+ 			   "HTT_RX_SOC_FW_REFILL_RING_NUM_RXDMA_ERR_TLV_V:");
+ 
+-	ARRAY_TO_STRING(rxdma_err_cnt,
+-			htt_stats_buf->rxdma_err,
+-			num_elems);
++	PRINT_ARRAY_TO_BUF(rxdma_err_cnt,
++			   htt_stats_buf->rxdma_err,
++			   num_elems);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "rxdma_err = %s\n",
+ 			   rxdma_err_cnt);
+ 
+@@ -3379,9 +3379,9 @@ htt_print_rx_soc_fw_refill_ring_num_reo_
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len,
+ 			   "HTT_RX_SOC_FW_REFILL_RING_NUM_REO_ERR_TLV_V:");
+ 
+-	ARRAY_TO_STRING(reo_err_cnt,
+-			htt_stats_buf->reo_err,
+-			num_elems);
++	PRINT_ARRAY_TO_BUF(reo_err_cnt,
++			   htt_stats_buf->reo_err,
++			   num_elems);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "reo_err = %s\n",
+ 			   reo_err_cnt);
+ 
+@@ -3447,9 +3447,9 @@ htt_print_rx_soc_fw_refill_ring_num_refi
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len,
+ 			   "HTT_RX_SOC_FW_REFILL_RING_NUM_REFILL_TLV_V:");
+ 
+-	ARRAY_TO_STRING(refill_ring_num_refill,
+-			htt_stats_buf->refill_ring_num_refill,
+-			num_elems);
++	PRINT_ARRAY_TO_BUF(refill_ring_num_refill,
++			   htt_stats_buf->refill_ring_num_refill,
++			   num_elems);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "refill_ring_num_refill = %s\n",
+ 			   refill_ring_num_refill);
+ 
+@@ -3491,15 +3491,15 @@ static inline void htt_print_rx_pdev_fw_
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "fw_ring_mpdu_ind = %u",
+ 			   htt_stats_buf->fw_ring_mpdu_ind);
+ 
+-	ARRAY_TO_STRING(fw_ring_mgmt_subtype,
+-			htt_stats_buf->fw_ring_mgmt_subtype,
+-			HTT_STATS_SUBTYPE_MAX);
++	PRINT_ARRAY_TO_BUF(fw_ring_mgmt_subtype,
++			   htt_stats_buf->fw_ring_mgmt_subtype,
++			   HTT_STATS_SUBTYPE_MAX);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "fw_ring_mgmt_subtype = %s ",
+ 			   fw_ring_mgmt_subtype);
+ 
+-	ARRAY_TO_STRING(fw_ring_ctrl_subtype,
+-			htt_stats_buf->fw_ring_ctrl_subtype,
+-			HTT_STATS_SUBTYPE_MAX);
++	PRINT_ARRAY_TO_BUF(fw_ring_ctrl_subtype,
++			   htt_stats_buf->fw_ring_ctrl_subtype,
++			   HTT_STATS_SUBTYPE_MAX);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "fw_ring_ctrl_subtype = %s ",
+ 			   fw_ring_ctrl_subtype);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "fw_ring_mcast_data_msdu = %u",
+@@ -3597,9 +3597,9 @@ htt_print_rx_pdev_fw_ring_mpdu_err_tlv_v
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len,
+ 			   "HTT_RX_PDEV_FW_RING_MPDU_ERR_TLV_V:");
+ 
+-	ARRAY_TO_STRING(fw_ring_mpdu_err,
+-			htt_stats_buf->fw_ring_mpdu_err,
+-			HTT_RX_STATS_RXDMA_MAX_ERR);
++	PRINT_ARRAY_TO_BUF(fw_ring_mpdu_err,
++			   htt_stats_buf->fw_ring_mpdu_err,
++			   HTT_RX_STATS_RXDMA_MAX_ERR);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "fw_ring_mpdu_err = %s\n",
+ 			   fw_ring_mpdu_err);
+ 
+@@ -3625,9 +3625,9 @@ htt_print_rx_pdev_fw_mpdu_drop_tlv_v(con
+ 
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "HTT_RX_PDEV_FW_MPDU_DROP_TLV_V:");
+ 
+-	ARRAY_TO_STRING(fw_mpdu_drop,
+-			htt_stats_buf->fw_mpdu_drop,
+-			num_elems);
++	PRINT_ARRAY_TO_BUF(fw_mpdu_drop,
++			   htt_stats_buf->fw_mpdu_drop,
++			   num_elems);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "fw_mpdu_drop = %s\n", fw_mpdu_drop);
+ 
+ 	if (len >= buf_len)
+@@ -3654,9 +3654,9 @@ htt_print_rx_pdev_fw_stats_phy_err_tlv(c
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "total_phy_err_nct = %u",
+ 			   htt_stats_buf->total_phy_err_cnt);
+ 
+-	ARRAY_TO_STRING(phy_errs,
+-			htt_stats_buf->phy_err,
+-			HTT_STATS_PHY_ERR_MAX);
++	PRINT_ARRAY_TO_BUF(phy_errs,
++			   htt_stats_buf->phy_err,
++			   HTT_STATS_PHY_ERR_MAX);
+ 	len += HTT_DBG_OUT(buf + len, buf_len - len, "phy_errs = %s\n", phy_errs);
+ 
+ 	if (len >= buf_len)

package/kernel/mac80211/patches/ath11k/0045-ath11k-Change-masking-and-shifting-in-htt-stats.patch

@@ -0,0 +1,683 @@
+From 6ed731829cf862dc1f73bbd063662d8a6c78a5b7 Mon Sep 17 00:00:00 2001
+From: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+Date: Tue, 28 Sep 2021 14:00:45 +0300
+Subject: [PATCH] ath11k: Change masking and shifting in htt stats
+
+In debugfs_htt_stats.c, masking and shifting is done to get
+stats values. Instead use GENMASK and FIELD_GET to improve
+code readability and maintenance.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01105-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210913223148.208026-5-jouni@codeaurora.org
+---
+ .../wireless/ath/ath11k/debugfs_htt_stats.c   | 318 ++++++++++--------
+ .../wireless/ath/ath11k/debugfs_htt_stats.h   |  54 +++
+ drivers/net/wireless/ath/ath11k/dp.h          |   7 +
+ 3 files changed, 243 insertions(+), 136 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.c
+@@ -75,8 +75,8 @@ static inline void htt_print_tx_pdev_sta
+ 	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
+ 
+ 	len += scnprintf(buf + len, buf_len - len, "HTT_TX_PDEV_STATS_CMN_TLV:\n");
+-	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
+-			 htt_stats_buf->mac_id__word & 0xFF);
++	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
++			 FIELD_GET(HTT_STATS_MAC_ID, htt_stats_buf->mac_id__word));
+ 	len += scnprintf(buf + len, buf_len - len, "hw_queued = %u\n",
+ 			 htt_stats_buf->hw_queued);
+ 	len += scnprintf(buf + len, buf_len - len, "hw_reaped = %u\n",
+@@ -428,8 +428,8 @@ static inline void htt_print_hw_stats_pd
+ 	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
+ 
+ 	len += scnprintf(buf + len, buf_len - len, "HTT_HW_STATS_PDEV_ERRS_TLV:\n");
+-	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
+-			 htt_stats_buf->mac_id__word & 0xFF);
++	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
++			 FIELD_GET(HTT_STATS_MAC_ID, htt_stats_buf->mac_id__word));
+ 	len += scnprintf(buf + len, buf_len - len, "tx_abort = %u\n",
+ 			 htt_stats_buf->tx_abort);
+ 	len += scnprintf(buf + len, buf_len - len, "tx_abort_fail_count = %u\n",
+@@ -480,13 +480,15 @@ static inline void htt_print_msdu_flow_s
+ 			 htt_stats_buf->cur_msdu_count_in_flowq);
+ 	len += scnprintf(buf + len, buf_len - len, "sw_peer_id = %u\n",
+ 			 htt_stats_buf->sw_peer_id);
+-	len += scnprintf(buf + len, buf_len - len, "tx_flow_no = %u\n",
+-			 htt_stats_buf->tx_flow_no__tid_num__drop_rule & 0xFFFF);
+-	len += scnprintf(buf + len, buf_len - len, "tid_num = %u\n",
+-			 (htt_stats_buf->tx_flow_no__tid_num__drop_rule & 0xF0000) >> 16);
+-	len += scnprintf(buf + len, buf_len - len, "drop_rule = %u\n",
+-			 (htt_stats_buf->tx_flow_no__tid_num__drop_rule & 0x100000) >>
+-			 20);
++	len += scnprintf(buf + len, buf_len - len, "tx_flow_no = %lu\n",
++			 FIELD_GET(HTT_MSDU_FLOW_STATS_TX_FLOW_NO,
++				   htt_stats_buf->tx_flow_no__tid_num__drop_rule));
++	len += scnprintf(buf + len, buf_len - len, "tid_num = %lu\n",
++			 FIELD_GET(HTT_MSDU_FLOW_STATS_TID_NUM,
++				   htt_stats_buf->tx_flow_no__tid_num__drop_rule));
++	len += scnprintf(buf + len, buf_len - len, "drop_rule = %lu\n",
++			 FIELD_GET(HTT_MSDU_FLOW_STATS_DROP_RULE,
++				   htt_stats_buf->tx_flow_no__tid_num__drop_rule));
+ 	len += scnprintf(buf + len, buf_len - len, "last_cycle_enqueue_count = %u\n",
+ 			 htt_stats_buf->last_cycle_enqueue_count);
+ 	len += scnprintf(buf + len, buf_len - len, "last_cycle_dequeue_count = %u\n",
+@@ -516,15 +518,18 @@ static inline void htt_print_tx_tid_stat
+ 	len += scnprintf(buf + len, buf_len - len, "HTT_TX_TID_STATS_TLV:\n");
+ 	memcpy(tid_name, &(htt_stats_buf->tid_name[0]), MAX_HTT_TID_NAME);
+ 	len += scnprintf(buf + len, buf_len - len, "tid_name = %s\n", tid_name);
+-	len += scnprintf(buf + len, buf_len - len, "sw_peer_id = %u\n",
+-			 htt_stats_buf->sw_peer_id__tid_num & 0xFFFF);
+-	len += scnprintf(buf + len, buf_len - len, "tid_num = %u\n",
+-			 (htt_stats_buf->sw_peer_id__tid_num & 0xFFFF0000) >> 16);
+-	len += scnprintf(buf + len, buf_len - len, "num_sched_pending = %u\n",
+-			 htt_stats_buf->num_sched_pending__num_ppdu_in_hwq & 0xFF);
+-	len += scnprintf(buf + len, buf_len - len, "num_ppdu_in_hwq = %u\n",
+-			 (htt_stats_buf->num_sched_pending__num_ppdu_in_hwq &
+-			 0xFF00) >> 8);
++	len += scnprintf(buf + len, buf_len - len, "sw_peer_id = %lu\n",
++			 FIELD_GET(HTT_TX_TID_STATS_SW_PEER_ID,
++				   htt_stats_buf->sw_peer_id__tid_num));
++	len += scnprintf(buf + len, buf_len - len, "tid_num = %lu\n",
++			 FIELD_GET(HTT_TX_TID_STATS_TID_NUM,
++				   htt_stats_buf->sw_peer_id__tid_num));
++	len += scnprintf(buf + len, buf_len - len, "num_sched_pending = %lu\n",
++			 FIELD_GET(HTT_TX_TID_STATS_NUM_SCHED_PENDING,
++				   htt_stats_buf->num_sched_pending__num_ppdu_in_hwq));
++	len += scnprintf(buf + len, buf_len - len, "num_ppdu_in_hwq = %lu\n",
++			 FIELD_GET(HTT_TX_TID_STATS_NUM_PPDU_IN_HWQ,
++				   htt_stats_buf->num_sched_pending__num_ppdu_in_hwq));
+ 	len += scnprintf(buf + len, buf_len - len, "tid_flags = 0x%x\n",
+ 			 htt_stats_buf->tid_flags);
+ 	len += scnprintf(buf + len, buf_len - len, "hw_queued = %u\n",
+@@ -566,15 +571,18 @@ static inline void htt_print_tx_tid_stat
+ 	len += scnprintf(buf + len, buf_len - len, "HTT_TX_TID_STATS_V1_TLV:\n");
+ 	memcpy(tid_name, &(htt_stats_buf->tid_name[0]), MAX_HTT_TID_NAME);
+ 	len += scnprintf(buf + len, buf_len - len, "tid_name = %s\n", tid_name);
+-	len += scnprintf(buf + len, buf_len - len, "sw_peer_id = %u\n",
+-			 htt_stats_buf->sw_peer_id__tid_num & 0xFFFF);
+-	len += scnprintf(buf + len, buf_len - len, "tid_num = %u\n",
+-			 (htt_stats_buf->sw_peer_id__tid_num & 0xFFFF0000) >> 16);
+-	len += scnprintf(buf + len, buf_len - len, "num_sched_pending = %u\n",
+-			 htt_stats_buf->num_sched_pending__num_ppdu_in_hwq & 0xFF);
+-	len += scnprintf(buf + len, buf_len - len, "num_ppdu_in_hwq = %u\n",
+-			 (htt_stats_buf->num_sched_pending__num_ppdu_in_hwq &
+-			 0xFF00) >> 8);
++	len += scnprintf(buf + len, buf_len - len, "sw_peer_id = %lu\n",
++			 FIELD_GET(HTT_TX_TID_STATS_V1_SW_PEER_ID,
++				   htt_stats_buf->sw_peer_id__tid_num));
++	len += scnprintf(buf + len, buf_len - len, "tid_num = %lu\n",
++			 FIELD_GET(HTT_TX_TID_STATS_V1_TID_NUM,
++				   htt_stats_buf->sw_peer_id__tid_num));
++	len += scnprintf(buf + len, buf_len - len, "num_sched_pending = %lu\n",
++			 FIELD_GET(HTT_TX_TID_STATS_V1_NUM_SCHED_PENDING,
++				   htt_stats_buf->num_sched_pending__num_ppdu_in_hwq));
++	len += scnprintf(buf + len, buf_len - len, "num_ppdu_in_hwq = %lu\n",
++			 FIELD_GET(HTT_TX_TID_STATS_V1_NUM_PPDU_IN_HWQ,
++				   htt_stats_buf->num_sched_pending__num_ppdu_in_hwq));
+ 	len += scnprintf(buf + len, buf_len - len, "tid_flags = 0x%x\n",
+ 			 htt_stats_buf->tid_flags);
+ 	len += scnprintf(buf + len, buf_len - len, "max_qdepth_bytes = %u\n",
+@@ -618,10 +626,12 @@ static inline void htt_print_rx_tid_stat
+ 	char tid_name[MAX_HTT_TID_NAME + 1] = {0};
+ 
+ 	len += scnprintf(buf + len, buf_len - len, "HTT_RX_TID_STATS_TLV:\n");
+-	len += scnprintf(buf + len, buf_len - len, "sw_peer_id = %u\n",
+-			 htt_stats_buf->sw_peer_id__tid_num & 0xFFFF);
+-	len += scnprintf(buf + len, buf_len - len, "tid_num = %u\n",
+-			 (htt_stats_buf->sw_peer_id__tid_num & 0xFFFF0000) >> 16);
++	len += scnprintf(buf + len, buf_len - len, "sw_peer_id = %lu\n",
++			 FIELD_GET(HTT_RX_TID_STATS_SW_PEER_ID,
++				   htt_stats_buf->sw_peer_id__tid_num));
++	len += scnprintf(buf + len, buf_len - len, "tid_num = %lu\n",
++			 FIELD_GET(HTT_RX_TID_STATS_TID_NUM,
++				   htt_stats_buf->sw_peer_id__tid_num));
+ 	memcpy(tid_name, &(htt_stats_buf->tid_name[0]), MAX_HTT_TID_NAME);
+ 	len += scnprintf(buf + len, buf_len - len, "tid_name = %s\n", tid_name);
+ 	len += scnprintf(buf + len, buf_len - len, "dup_in_reorder = %u\n",
+@@ -724,20 +734,29 @@ static inline void htt_print_peer_detail
+ 			 htt_stats_buf->peer_type);
+ 	len += scnprintf(buf + len, buf_len - len, "sw_peer_id = %u\n",
+ 			 htt_stats_buf->sw_peer_id);
+-	len += scnprintf(buf + len, buf_len - len, "vdev_id = %u\n",
+-			 htt_stats_buf->vdev_pdev_ast_idx & 0xFF);
+-	len += scnprintf(buf + len, buf_len - len, "pdev_id = %u\n",
+-			 (htt_stats_buf->vdev_pdev_ast_idx & 0xFF00) >> 8);
+-	len += scnprintf(buf + len, buf_len - len, "ast_idx = %u\n",
+-			 (htt_stats_buf->vdev_pdev_ast_idx & 0xFFFF0000) >> 16);
+-	len += scnprintf(buf + len, buf_len - len,
+-			 "mac_addr = %02x:%02x:%02x:%02x:%02x:%02x\n",
+-			 htt_stats_buf->mac_addr.mac_addr_l32 & 0xFF,
+-			 (htt_stats_buf->mac_addr.mac_addr_l32 & 0xFF00) >> 8,
+-			 (htt_stats_buf->mac_addr.mac_addr_l32 & 0xFF0000) >> 16,
+-			 (htt_stats_buf->mac_addr.mac_addr_l32 & 0xFF000000) >> 24,
+-			 (htt_stats_buf->mac_addr.mac_addr_h16 & 0xFF),
+-			 (htt_stats_buf->mac_addr.mac_addr_h16 & 0xFF00) >> 8);
++	len += scnprintf(buf + len, buf_len - len, "vdev_id = %lu\n",
++			 FIELD_GET(HTT_PEER_DETAILS_VDEV_ID,
++				   htt_stats_buf->vdev_pdev_ast_idx));
++	len += scnprintf(buf + len, buf_len - len, "pdev_id = %lu\n",
++			 FIELD_GET(HTT_PEER_DETAILS_PDEV_ID,
++				   htt_stats_buf->vdev_pdev_ast_idx));
++	len += scnprintf(buf + len, buf_len - len, "ast_idx = %lu\n",
++			 FIELD_GET(HTT_PEER_DETAILS_AST_IDX,
++				   htt_stats_buf->vdev_pdev_ast_idx));
++	len += scnprintf(buf + len, buf_len - len,
++			 "mac_addr = %02lx:%02lx:%02lx:%02lx:%02lx:%02lx\n",
++			 FIELD_GET(HTT_MAC_ADDR_L32_0,
++				   htt_stats_buf->mac_addr.mac_addr_l32),
++			 FIELD_GET(HTT_MAC_ADDR_L32_1,
++				   htt_stats_buf->mac_addr.mac_addr_l32),
++			 FIELD_GET(HTT_MAC_ADDR_L32_2,
++				   htt_stats_buf->mac_addr.mac_addr_l32),
++			 FIELD_GET(HTT_MAC_ADDR_L32_3,
++				   htt_stats_buf->mac_addr.mac_addr_l32),
++			 FIELD_GET(HTT_MAC_ADDR_H16_0,
++				   htt_stats_buf->mac_addr.mac_addr_h16),
++			 FIELD_GET(HTT_MAC_ADDR_H16_1,
++				   htt_stats_buf->mac_addr.mac_addr_h16));
+ 	len += scnprintf(buf + len, buf_len - len, "peer_flags = 0x%x\n",
+ 			 htt_stats_buf->peer_flags);
+ 	len += scnprintf(buf + len, buf_len - len, "qpeer_flags = 0x%x\n\n",
+@@ -799,7 +818,6 @@ static inline void htt_print_tx_peer_rat
+ 		buf[len] = 0;
+ 
+ 	stats_req->buf_len = len;
+-
+ }
+ 
+ static inline void htt_print_rx_peer_rate_stats_tlv(const void *tag_buf,
+@@ -930,10 +948,12 @@ htt_print_tx_hwq_mu_mimo_cmn_stats_tlv(c
+ 	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
+ 
+ 	len += scnprintf(buf + len, buf_len - len, "HTT_TX_HWQ_MU_MIMO_CMN_STATS_TLV:\n");
+-	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
+-			 htt_stats_buf->mac_id__hwq_id__word & 0xFF);
+-	len += scnprintf(buf + len, buf_len - len, "hwq_id = %u\n\n",
+-			 (htt_stats_buf->mac_id__hwq_id__word & 0xFF00) >> 8);
++	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
++			 FIELD_GET(HTT_TX_HWQ_STATS_MAC_ID,
++				   htt_stats_buf->mac_id__hwq_id__word));
++	len += scnprintf(buf + len, buf_len - len, "hwq_id = %lu\n\n",
++			 FIELD_GET(HTT_TX_HWQ_STATS_HWQ_ID,
++				   htt_stats_buf->mac_id__hwq_id__word));
+ 
+ 	if (len >= buf_len)
+ 		buf[buf_len - 1] = 0;
+@@ -953,10 +973,12 @@ htt_print_tx_hwq_stats_cmn_tlv(const voi
+ 
+ 	/* TODO: HKDBG */
+ 	len += scnprintf(buf + len, buf_len - len, "HTT_TX_HWQ_STATS_CMN_TLV:\n");
+-	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
+-			 htt_stats_buf->mac_id__hwq_id__word & 0xFF);
+-	len += scnprintf(buf + len, buf_len - len, "hwq_id = %u\n",
+-			 (htt_stats_buf->mac_id__hwq_id__word & 0xFF00) >> 8);
++	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
++			 FIELD_GET(HTT_TX_HWQ_STATS_MAC_ID,
++				   htt_stats_buf->mac_id__hwq_id__word));
++	len += scnprintf(buf + len, buf_len - len, "hwq_id = %lu\n",
++			 FIELD_GET(HTT_TX_HWQ_STATS_HWQ_ID,
++				   htt_stats_buf->mac_id__hwq_id__word));
+ 	len += scnprintf(buf + len, buf_len - len, "xretry = %u\n",
+ 			 htt_stats_buf->xretry);
+ 	len += scnprintf(buf + len, buf_len - len, "underrun_cnt = %u\n",
+@@ -1281,8 +1303,8 @@ htt_print_tx_selfgen_cmn_stats_tlv(const
+ 	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
+ 
+ 	len += scnprintf(buf + len, buf_len - len, "HTT_TX_SELFGEN_CMN_STATS_TLV:\n");
+-	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
+-			 htt_stats_buf->mac_id__word & 0xFF);
++	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
++			 FIELD_GET(HTT_STATS_MAC_ID, htt_stats_buf->mac_id__word));
+ 	len += scnprintf(buf + len, buf_len - len, "su_bar = %u\n",
+ 			 htt_stats_buf->su_bar);
+ 	len += scnprintf(buf + len, buf_len - len, "rts = %u\n",
+@@ -1769,10 +1791,12 @@ htt_print_tx_pdev_stats_sched_per_txq_tl
+ 
+ 	len += scnprintf(buf + len, buf_len - len,
+ 			 "HTT_TX_PDEV_STATS_SCHED_PER_TXQ_TLV:\n");
+-	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
+-			 htt_stats_buf->mac_id__txq_id__word & 0xFF);
+-	len += scnprintf(buf + len, buf_len - len, "txq_id = %u\n",
+-			 (htt_stats_buf->mac_id__txq_id__word & 0xFF00) >> 8);
++	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
++			 FIELD_GET(HTT_TX_PDEV_STATS_SCHED_PER_TXQ_MAC_ID,
++				   htt_stats_buf->mac_id__txq_id__word));
++	len += scnprintf(buf + len, buf_len - len, "txq_id = %lu\n",
++			 FIELD_GET(HTT_TX_PDEV_STATS_SCHED_PER_TXQ_ID,
++				   htt_stats_buf->mac_id__txq_id__word));
+ 	len += scnprintf(buf + len, buf_len - len, "sched_policy = %u\n",
+ 			 htt_stats_buf->sched_policy);
+ 	len += scnprintf(buf + len, buf_len - len,
+@@ -1833,8 +1857,8 @@ static inline void htt_print_stats_tx_sc
+ 	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
+ 
+ 	len += scnprintf(buf + len, buf_len - len, "HTT_STATS_TX_SCHED_CMN_TLV:\n");
+-	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
+-			 htt_stats_buf->mac_id__word & 0xFF);
++	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
++			 FIELD_GET(HTT_STATS_MAC_ID, htt_stats_buf->mac_id__word));
+ 	len += scnprintf(buf + len, buf_len - len, "current_timestamp = %u\n\n",
+ 			 htt_stats_buf->current_timestamp);
+ 
+@@ -2011,8 +2035,8 @@ static inline void htt_print_tx_tqm_cmn_
+ 	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
+ 
+ 	len += scnprintf(buf + len, buf_len - len, "HTT_TX_TQM_CMN_STATS_TLV:\n");
+-	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
+-			 htt_stats_buf->mac_id__word & 0xFF);
++	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
++			 FIELD_GET(HTT_STATS_MAC_ID, htt_stats_buf->mac_id__word));
+ 	len += scnprintf(buf + len, buf_len - len, "max_cmdq_id = %u\n",
+ 			 htt_stats_buf->max_cmdq_id);
+ 	len += scnprintf(buf + len, buf_len - len, "list_mpdu_cnt_hist_intvl = %u\n",
+@@ -2069,10 +2093,12 @@ static inline void htt_print_tx_tqm_cmdq
+ 	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
+ 
+ 	len += scnprintf(buf + len, buf_len - len, "HTT_TX_TQM_CMDQ_STATUS_TLV:\n");
+-	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
+-			 htt_stats_buf->mac_id__cmdq_id__word & 0xFF);
+-	len += scnprintf(buf + len, buf_len - len, "cmdq_id = %u\n\n",
+-			 (htt_stats_buf->mac_id__cmdq_id__word & 0xFF00) >> 8);
++	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
++			 FIELD_GET(HTT_TX_TQM_CMDQ_STATUS_MAC_ID,
++				   htt_stats_buf->mac_id__cmdq_id__word));
++	len += scnprintf(buf + len, buf_len - len, "cmdq_id = %lu\n\n",
++			 FIELD_GET(HTT_TX_TQM_CMDQ_STATUS_CMDQ_ID,
++				   htt_stats_buf->mac_id__cmdq_id__word));
+ 	len += scnprintf(buf + len, buf_len - len, "sync_cmd = %u\n",
+ 			 htt_stats_buf->sync_cmd);
+ 	len += scnprintf(buf + len, buf_len - len, "write_cmd = %u\n",
+@@ -2417,8 +2443,8 @@ htt_print_tx_de_cmn_stats_tlv(const void
+ 	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
+ 
+ 	len += scnprintf(buf + len, buf_len - len, "HTT_TX_DE_CMN_STATS_TLV:\n");
+-	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
+-			 htt_stats_buf->mac_id__word & 0xFF);
++	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
++			 FIELD_GET(HTT_STATS_MAC_ID, htt_stats_buf->mac_id__word));
+ 	len += scnprintf(buf + len, buf_len - len, "tcl2fw_entry_count = %u\n",
+ 			 htt_stats_buf->tcl2fw_entry_count);
+ 	len += scnprintf(buf + len, buf_len - len, "not_to_fw = %u\n",
+@@ -2453,26 +2479,32 @@ static inline void htt_print_ring_if_sta
+ 			 htt_stats_buf->base_addr);
+ 	len += scnprintf(buf + len, buf_len - len, "elem_size = %u\n",
+ 			 htt_stats_buf->elem_size);
+-	len += scnprintf(buf + len, buf_len - len, "num_elems = %u\n",
+-			 htt_stats_buf->num_elems__prefetch_tail_idx & 0xFFFF);
+-	len += scnprintf(buf + len, buf_len - len, "prefetch_tail_idx = %u\n",
+-			 (htt_stats_buf->num_elems__prefetch_tail_idx &
+-			 0xFFFF0000) >> 16);
+-	len += scnprintf(buf + len, buf_len - len, "head_idx = %u\n",
+-			 htt_stats_buf->head_idx__tail_idx & 0xFFFF);
+-	len += scnprintf(buf + len, buf_len - len, "tail_idx = %u\n",
+-			 (htt_stats_buf->head_idx__tail_idx & 0xFFFF0000) >> 16);
+-	len += scnprintf(buf + len, buf_len - len, "shadow_head_idx = %u\n",
+-			 htt_stats_buf->shadow_head_idx__shadow_tail_idx & 0xFFFF);
+-	len += scnprintf(buf + len, buf_len - len, "shadow_tail_idx = %u\n",
+-			 (htt_stats_buf->shadow_head_idx__shadow_tail_idx &
+-			 0xFFFF0000) >> 16);
++	len += scnprintf(buf + len, buf_len - len, "num_elems = %lu\n",
++			 FIELD_GET(HTT_RING_IF_STATS_NUM_ELEMS,
++				   htt_stats_buf->num_elems__prefetch_tail_idx));
++	len += scnprintf(buf + len, buf_len - len, "prefetch_tail_idx = %lu\n",
++			 FIELD_GET(HTT_RING_IF_STATS_PREFETCH_TAIL_INDEX,
++				   htt_stats_buf->num_elems__prefetch_tail_idx));
++	len += scnprintf(buf + len, buf_len - len, "head_idx = %lu\n",
++			 FIELD_GET(HTT_RING_IF_STATS_HEAD_IDX,
++				   htt_stats_buf->head_idx__tail_idx));
++	len += scnprintf(buf + len, buf_len - len, "tail_idx = %lu\n",
++			 FIELD_GET(HTT_RING_IF_STATS_TAIL_IDX,
++				   htt_stats_buf->head_idx__tail_idx));
++	len += scnprintf(buf + len, buf_len - len, "shadow_head_idx = %lu\n",
++			 FIELD_GET(HTT_RING_IF_STATS_SHADOW_HEAD_IDX,
++				   htt_stats_buf->shadow_head_idx__shadow_tail_idx));
++	len += scnprintf(buf + len, buf_len - len, "shadow_tail_idx = %lu\n",
++			 FIELD_GET(HTT_RING_IF_STATS_SHADOW_TAIL_IDX,
++				   htt_stats_buf->shadow_head_idx__shadow_tail_idx));
+ 	len += scnprintf(buf + len, buf_len - len, "num_tail_incr = %u\n",
+ 			 htt_stats_buf->num_tail_incr);
+-	len += scnprintf(buf + len, buf_len - len, "lwm_thresh = %u\n",
+-			 htt_stats_buf->lwm_thresh__hwm_thresh & 0xFFFF);
+-	len += scnprintf(buf + len, buf_len - len, "hwm_thresh = %u\n",
+-			 (htt_stats_buf->lwm_thresh__hwm_thresh & 0xFFFF0000) >> 16);
++	len += scnprintf(buf + len, buf_len - len, "lwm_thresh = %lu\n",
++			 FIELD_GET(HTT_RING_IF_STATS_LWM_THRESH,
++				   htt_stats_buf->lwm_thresh__hwm_thresh));
++	len += scnprintf(buf + len, buf_len - len, "hwm_thresh = %lu\n",
++			 FIELD_GET(HTT_RING_IF_STATS_HWM_THRESH,
++				   htt_stats_buf->lwm_thresh__hwm_thresh));
+ 	len += scnprintf(buf + len, buf_len - len, "overrun_hit_count = %u\n",
+ 			 htt_stats_buf->overrun_hit_count);
+ 	len += scnprintf(buf + len, buf_len - len, "underrun_hit_count = %u\n",
+@@ -2504,8 +2536,8 @@ static inline void htt_print_ring_if_cmn
+ 	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
+ 
+ 	len += scnprintf(buf + len, buf_len - len, "HTT_RING_IF_CMN_TLV:\n");
+-	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
+-			 htt_stats_buf->mac_id__word & 0xFF);
++	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
++			 FIELD_GET(HTT_STATS_MAC_ID, htt_stats_buf->mac_id__word));
+ 	len += scnprintf(buf + len, buf_len - len, "num_records = %u\n\n",
+ 			 htt_stats_buf->num_records);
+ 
+@@ -2581,8 +2613,8 @@ static inline void htt_print_sfm_cmn_tlv
+ 	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
+ 
+ 	len += scnprintf(buf + len, buf_len - len, "HTT_SFM_CMN_TLV:\n");
+-	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
+-			 htt_stats_buf->mac_id__word & 0xFF);
++	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
++			 FIELD_GET(HTT_STATS_MAC_ID, htt_stats_buf->mac_id__word));
+ 	len += scnprintf(buf + len, buf_len - len, "buf_total = %u\n",
+ 			 htt_stats_buf->buf_total);
+ 	len += scnprintf(buf + len, buf_len - len, "mem_empty = %u\n",
+@@ -2609,14 +2641,18 @@ static inline void htt_print_sring_stats
+ 	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
+ 
+ 	len += scnprintf(buf + len, buf_len - len, "HTT_SRING_STATS_TLV:\n");
+-	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
+-			 htt_stats_buf->mac_id__ring_id__arena__ep & 0xFF);
+-	len += scnprintf(buf + len, buf_len - len, "ring_id = %u\n",
+-			 (htt_stats_buf->mac_id__ring_id__arena__ep & 0xFF00) >> 8);
+-	len += scnprintf(buf + len, buf_len - len, "arena = %u\n",
+-			 (htt_stats_buf->mac_id__ring_id__arena__ep & 0xFF0000) >> 16);
+-	len += scnprintf(buf + len, buf_len - len, "ep = %u\n",
+-			 (htt_stats_buf->mac_id__ring_id__arena__ep & 0x1000000) >> 24);
++	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
++			 FIELD_GET(HTT_SRING_STATS_MAC_ID,
++				   htt_stats_buf->mac_id__ring_id__arena__ep));
++	len += scnprintf(buf + len, buf_len - len, "ring_id = %lu\n",
++			 FIELD_GET(HTT_SRING_STATS_RING_ID,
++				   htt_stats_buf->mac_id__ring_id__arena__ep));
++	len += scnprintf(buf + len, buf_len - len, "arena = %lu\n",
++			 FIELD_GET(HTT_SRING_STATS_ARENA,
++				   htt_stats_buf->mac_id__ring_id__arena__ep));
++	len += scnprintf(buf + len, buf_len - len, "ep = %lu\n",
++			 FIELD_GET(HTT_SRING_STATS_EP,
++				   htt_stats_buf->mac_id__ring_id__arena__ep));
+ 	len += scnprintf(buf + len, buf_len - len, "base_addr_lsb = 0x%x\n",
+ 			 htt_stats_buf->base_addr_lsb);
+ 	len += scnprintf(buf + len, buf_len - len, "base_addr_msb = 0x%x\n",
+@@ -2625,25 +2661,30 @@ static inline void htt_print_sring_stats
+ 			 htt_stats_buf->ring_size);
+ 	len += scnprintf(buf + len, buf_len - len, "elem_size = %u\n",
+ 			 htt_stats_buf->elem_size);
+-	len += scnprintf(buf + len, buf_len - len, "num_avail_words = %u\n",
+-			 htt_stats_buf->num_avail_words__num_valid_words & 0xFFFF);
+-	len += scnprintf(buf + len, buf_len - len, "num_valid_words = %u\n",
+-			 (htt_stats_buf->num_avail_words__num_valid_words &
+-			 0xFFFF0000) >> 16);
+-	len += scnprintf(buf + len, buf_len - len, "head_ptr = %u\n",
+-			 htt_stats_buf->head_ptr__tail_ptr & 0xFFFF);
+-	len += scnprintf(buf + len, buf_len - len, "tail_ptr = %u\n",
+-			 (htt_stats_buf->head_ptr__tail_ptr & 0xFFFF0000) >> 16);
+-	len += scnprintf(buf + len, buf_len - len, "consumer_empty = %u\n",
+-			 htt_stats_buf->consumer_empty__producer_full & 0xFFFF);
+-	len += scnprintf(buf + len, buf_len - len, "producer_full = %u\n",
+-			 (htt_stats_buf->consumer_empty__producer_full &
+-			 0xFFFF0000) >> 16);
+-	len += scnprintf(buf + len, buf_len - len, "prefetch_count = %u\n",
+-			 htt_stats_buf->prefetch_count__internal_tail_ptr & 0xFFFF);
+-	len += scnprintf(buf + len, buf_len - len, "internal_tail_ptr = %u\n\n",
+-			 (htt_stats_buf->prefetch_count__internal_tail_ptr &
+-			 0xFFFF0000) >> 16);
++	len += scnprintf(buf + len, buf_len - len, "num_avail_words = %lu\n",
++			 FIELD_GET(HTT_SRING_STATS_NUM_AVAIL_WORDS,
++				   htt_stats_buf->num_avail_words__num_valid_words));
++	len += scnprintf(buf + len, buf_len - len, "num_valid_words = %lu\n",
++			 FIELD_GET(HTT_SRING_STATS_NUM_VALID_WORDS,
++				   htt_stats_buf->num_avail_words__num_valid_words));
++	len += scnprintf(buf + len, buf_len - len, "head_ptr = %lu\n",
++			 FIELD_GET(HTT_SRING_STATS_HEAD_PTR,
++				   htt_stats_buf->head_ptr__tail_ptr));
++	len += scnprintf(buf + len, buf_len - len, "tail_ptr = %lu\n",
++			 FIELD_GET(HTT_SRING_STATS_TAIL_PTR,
++				   htt_stats_buf->head_ptr__tail_ptr));
++	len += scnprintf(buf + len, buf_len - len, "consumer_empty = %lu\n",
++			 FIELD_GET(HTT_SRING_STATS_CONSUMER_EMPTY,
++				   htt_stats_buf->consumer_empty__producer_full));
++	len += scnprintf(buf + len, buf_len - len, "producer_full = %lu\n",
++			 FIELD_GET(HTT_SRING_STATS_PRODUCER_FULL,
++				   htt_stats_buf->consumer_empty__producer_full));
++	len += scnprintf(buf + len, buf_len - len, "prefetch_count = %lu\n",
++			 FIELD_GET(HTT_SRING_STATS_PREFETCH_COUNT,
++				   htt_stats_buf->prefetch_count__internal_tail_ptr));
++	len += scnprintf(buf + len, buf_len - len, "internal_tail_ptr = %lu\n\n",
++			 FIELD_GET(HTT_SRING_STATS_INTERNAL_TAIL_PTR,
++				   htt_stats_buf->prefetch_count__internal_tail_ptr));
+ 
+ 	if (len >= buf_len)
+ 		buf[buf_len - 1] = 0;
+@@ -2683,8 +2724,8 @@ static inline void htt_print_tx_pdev_rat
+ 	u8 j;
+ 
+ 	len += scnprintf(buf + len, buf_len - len, "HTT_TX_PDEV_RATE_STATS_TLV:\n");
+-	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
+-			 htt_stats_buf->mac_id__word & 0xFF);
++	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
++			 FIELD_GET(HTT_STATS_MAC_ID, htt_stats_buf->mac_id__word));
+ 	len += scnprintf(buf + len, buf_len - len, "tx_ldpc = %u\n",
+ 			 htt_stats_buf->tx_ldpc);
+ 	len += scnprintf(buf + len, buf_len - len, "ac_mu_mimo_tx_ldpc = %u\n",
+@@ -2809,8 +2850,8 @@ static inline void htt_print_rx_pdev_rat
+ 	u8 i, j;
+ 
+ 	len += scnprintf(buf + len, buf_len - len, "HTT_RX_PDEV_RATE_STATS_TLV:\n");
+-	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
+-			 htt_stats_buf->mac_id__word & 0xFF);
++	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
++			 FIELD_GET(HTT_STATS_MAC_ID, htt_stats_buf->mac_id__word));
+ 	len += scnprintf(buf + len, buf_len - len, "nsts = %u\n",
+ 			 htt_stats_buf->nsts);
+ 	len += scnprintf(buf + len, buf_len - len, "rx_ldpc = %u\n",
+@@ -2844,7 +2885,6 @@ static inline void htt_print_rx_pdev_rat
+ 			 htt_stats_buf->pilot_count);
+ 
+ 	for (j = 0; j < HTT_RX_PDEV_STATS_NUM_SPATIAL_STREAMS; j++) {
+-
+ 		len += scnprintf(buf + len, buf_len - len,
+ 				 "pilot_evm_db[%u] = ", j);
+ 		for (i = 0; i < HTT_RX_PDEV_STATS_RXEVM_MAX_PILOTS_PER_NSS; i++)
+@@ -3173,8 +3213,8 @@ static inline void htt_print_rx_pdev_fw_
+ 	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
+ 
+ 	len += scnprintf(buf + len, buf_len - len, "HTT_RX_PDEV_FW_STATS_TLV:\n");
+-	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
+-			 htt_stats_buf->mac_id__word & 0xFF);
++	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
++			 FIELD_GET(HTT_STATS_MAC_ID, htt_stats_buf->mac_id__word));
+ 	len += scnprintf(buf + len, buf_len - len, "ppdu_recvd = %u\n",
+ 			 htt_stats_buf->ppdu_recvd);
+ 	len += scnprintf(buf + len, buf_len - len, "mpdu_cnt_fcs_ok = %u\n",
+@@ -3422,8 +3462,8 @@ static inline void htt_print_hw_stats_wh
+ 	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
+ 
+ 	len += scnprintf(buf + len, buf_len - len, "HTT_HW_STATS_WHAL_TX_TLV:\n");
+-	len += scnprintf(buf + len, buf_len - len, "mac_id = %u\n",
+-			 htt_stats_buf->mac_id__word & 0xFF);
++	len += scnprintf(buf + len, buf_len - len, "mac_id = %lu\n",
++			 FIELD_GET(HTT_STATS_MAC_ID, htt_stats_buf->mac_id__word));
+ 	len += scnprintf(buf + len, buf_len - len, "last_unpause_ppdu_id = %u\n",
+ 			 htt_stats_buf->last_unpause_ppdu_id);
+ 	len += scnprintf(buf + len, buf_len - len, "hwsch_unpause_wait_tqm_write = %u\n",
+@@ -3492,13 +3532,19 @@ htt_print_pdev_stats_twt_session_tlv(con
+ 	len += scnprintf(buf + len, buf_len - len, "vdev_id = %u\n",
+ 			 htt_stats_buf->vdev_id);
+ 	len += scnprintf(buf + len, buf_len - len,
+-			 "peer_mac = %02x:%02x:%02x:%02x:%02x:%02x\n",
+-			 htt_stats_buf->peer_mac.mac_addr_l32 & 0xFF,
+-			 (htt_stats_buf->peer_mac.mac_addr_l32 & 0xFF00) >> 8,
+-			 (htt_stats_buf->peer_mac.mac_addr_l32 & 0xFF0000) >> 16,
+-			 (htt_stats_buf->peer_mac.mac_addr_l32 & 0xFF000000) >> 24,
+-			 (htt_stats_buf->peer_mac.mac_addr_h16 & 0xFF),
+-			 (htt_stats_buf->peer_mac.mac_addr_h16 & 0xFF00) >> 8);
++			 "peer_mac = %02lx:%02lx:%02lx:%02lx:%02lx:%02lx\n",
++			 FIELD_GET(HTT_MAC_ADDR_L32_0,
++				   htt_stats_buf->peer_mac.mac_addr_l32),
++			 FIELD_GET(HTT_MAC_ADDR_L32_1,
++				   htt_stats_buf->peer_mac.mac_addr_l32),
++			 FIELD_GET(HTT_MAC_ADDR_L32_2,
++				   htt_stats_buf->peer_mac.mac_addr_l32),
++			 FIELD_GET(HTT_MAC_ADDR_L32_3,
++				   htt_stats_buf->peer_mac.mac_addr_l32),
++			 FIELD_GET(HTT_MAC_ADDR_H16_0,
++				   htt_stats_buf->peer_mac.mac_addr_h16),
++			 FIELD_GET(HTT_MAC_ADDR_H16_1,
++				   htt_stats_buf->peer_mac.mac_addr_h16));
+ 	len += scnprintf(buf + len, buf_len - len, "flow_id_flags = %u\n",
+ 			 htt_stats_buf->flow_id_flags);
+ 	len += scnprintf(buf + len, buf_len - len, "dialog_id = %u\n",
+--- a/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.h
++++ b/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.h
+@@ -137,6 +137,8 @@ struct htt_stats_string_tlv {
+ 	u32 data[0]; /* Can be variable length */
+ } __packed;
+ 
++#define HTT_STATS_MAC_ID	GENMASK(7, 0)
++
+ /* == TX PDEV STATS == */
+ struct htt_tx_pdev_stats_cmn_tlv {
+ 	u32 mac_id__word;
+@@ -290,6 +292,10 @@ struct htt_hw_stats_whal_tx_tlv {
+ };
+ 
+ /* ============ PEER STATS ============ */
++#define	HTT_MSDU_FLOW_STATS_TX_FLOW_NO	GENMASK(15, 0)
++#define	HTT_MSDU_FLOW_STATS_TID_NUM	GENMASK(19, 16)
++#define	HTT_MSDU_FLOW_STATS_DROP_RULE	BIT(20)
++
+ struct htt_msdu_flow_stats_tlv {
+ 	u32 last_update_timestamp;
+ 	u32 last_add_timestamp;
+@@ -306,6 +312,11 @@ struct htt_msdu_flow_stats_tlv {
+ 
+ #define MAX_HTT_TID_NAME 8
+ 
++#define	HTT_TX_TID_STATS_SW_PEER_ID		GENMASK(15, 0)
++#define	HTT_TX_TID_STATS_TID_NUM		GENMASK(31, 16)
++#define	HTT_TX_TID_STATS_NUM_SCHED_PENDING	GENMASK(7, 0)
++#define	HTT_TX_TID_STATS_NUM_PPDU_IN_HWQ	GENMASK(15, 8)
++
+ /* Tidq stats */
+ struct htt_tx_tid_stats_tlv {
+ 	/* Stored as little endian */
+@@ -326,6 +337,11 @@ struct htt_tx_tid_stats_tlv {
+ 	u32 tid_tx_airtime;
+ };
+ 
++#define	HTT_TX_TID_STATS_V1_SW_PEER_ID		GENMASK(15, 0)
++#define	HTT_TX_TID_STATS_V1_TID_NUM		GENMASK(31, 16)
++#define	HTT_TX_TID_STATS_V1_NUM_SCHED_PENDING	GENMASK(7, 0)
++#define	HTT_TX_TID_STATS_V1_NUM_PPDU_IN_HWQ	GENMASK(15, 8)
++
+ /* Tidq stats */
+ struct htt_tx_tid_stats_v1_tlv {
+ 	/* Stored as little endian */
+@@ -348,6 +364,9 @@ struct htt_tx_tid_stats_v1_tlv {
+ 	u32 sendn_frms_allowed;
+ };
+ 
++#define	HTT_RX_TID_STATS_SW_PEER_ID	GENMASK(15, 0)
++#define	HTT_RX_TID_STATS_TID_NUM	GENMASK(31, 16)
++
+ struct htt_rx_tid_stats_tlv {
+ 	u32 sw_peer_id__tid_num;
+ 	u8 tid_name[MAX_HTT_TID_NAME];
+@@ -386,6 +405,10 @@ struct htt_peer_stats_cmn_tlv {
+ 	u32 inactive_time;
+ };
+ 
++#define HTT_PEER_DETAILS_VDEV_ID	GENMASK(7, 0)
++#define HTT_PEER_DETAILS_PDEV_ID	GENMASK(15, 8)
++#define HTT_PEER_DETAILS_AST_IDX	GENMASK(31, 16)
++
+ struct htt_peer_details_tlv {
+ 	u32 peer_type;
+ 	u32 sw_peer_id;
+@@ -510,6 +533,9 @@ struct htt_tx_hwq_mu_mimo_mpdu_stats_tlv
+ 	u32 mu_mimo_ampdu_underrun_usr;
+ };
+ 
++#define	HTT_TX_HWQ_STATS_MAC_ID	GENMASK(7, 0)
++#define	HTT_TX_HWQ_STATS_HWQ_ID	GENMASK(15, 8)
++
+ struct htt_tx_hwq_mu_mimo_cmn_stats_tlv {
+ 	u32 mac_id__hwq_id__word;
+ };
+@@ -789,6 +815,9 @@ struct htt_sched_txq_sched_ineligibility
+ 	u32 sched_ineligibility[0];
+ };
+ 
++#define	HTT_TX_PDEV_STATS_SCHED_PER_TXQ_MAC_ID	GENMASK(7, 0)
++#define	HTT_TX_PDEV_STATS_SCHED_PER_TXQ_ID	GENMASK(15, 8)
++
+ struct htt_tx_pdev_stats_sched_per_txq_tlv {
+ 	u32 mac_id__txq_id__word;
+ 	u32 sched_policy;
+@@ -910,6 +939,9 @@ struct htt_tx_tqm_error_stats_tlv {
+ };
+ 
+ /* == TQM CMDQ stats == */
++#define	HTT_TX_TQM_CMDQ_STATUS_MAC_ID	GENMASK(7, 0)
++#define	HTT_TX_TQM_CMDQ_STATUS_CMDQ_ID	GENMASK(15, 8)
++
+ struct htt_tx_tqm_cmdq_status_tlv {
+ 	u32 mac_id__cmdq_id__word;
+ 	u32 sync_cmd;
+@@ -1055,6 +1087,15 @@ struct htt_tx_de_cmn_stats_tlv {
+ #define HTT_STATS_LOW_WM_BINS      5
+ #define HTT_STATS_HIGH_WM_BINS     5
+ 
++#define HTT_RING_IF_STATS_NUM_ELEMS		GENMASK(15, 0)
++#define	HTT_RING_IF_STATS_PREFETCH_TAIL_INDEX	GENMASK(31, 16)
++#define HTT_RING_IF_STATS_HEAD_IDX		GENMASK(15, 0)
++#define HTT_RING_IF_STATS_TAIL_IDX		GENMASK(31, 16)
++#define HTT_RING_IF_STATS_SHADOW_HEAD_IDX	GENMASK(15, 0)
++#define HTT_RING_IF_STATS_SHADOW_TAIL_IDX	GENMASK(31, 16)
++#define HTT_RING_IF_STATS_LWM_THRESH		GENMASK(15, 0)
++#define HTT_RING_IF_STATS_HWM_THRESH		GENMASK(31, 16)
++
+ struct htt_ring_if_stats_tlv {
+ 	u32 base_addr; /* DWORD aligned base memory address of the ring */
+ 	u32 elem_size;
+@@ -1117,6 +1158,19 @@ struct htt_sfm_cmn_tlv {
+ };
+ 
+ /* == SRNG STATS == */
++#define	HTT_SRING_STATS_MAC_ID			GENMASK(7, 0)
++#define HTT_SRING_STATS_RING_ID			GENMASK(15, 8)
++#define HTT_SRING_STATS_ARENA			GENMASK(23, 16)
++#define HTT_SRING_STATS_EP			BIT(24)
++#define HTT_SRING_STATS_NUM_AVAIL_WORDS		GENMASK(15, 0)
++#define HTT_SRING_STATS_NUM_VALID_WORDS		GENMASK(31, 16)
++#define HTT_SRING_STATS_HEAD_PTR		GENMASK(15, 0)
++#define HTT_SRING_STATS_TAIL_PTR		GENMASK(31, 16)
++#define HTT_SRING_STATS_CONSUMER_EMPTY		GENMASK(15, 0)
++#define HTT_SRING_STATS_PRODUCER_FULL		GENMASK(31, 16)
++#define HTT_SRING_STATS_PREFETCH_COUNT		GENMASK(15, 0)
++#define HTT_SRING_STATS_INTERNAL_TAIL_PTR	GENMASK(31, 16)
++
+ struct htt_sring_stats_tlv {
+ 	u32 mac_id__ring_id__arena__ep;
+ 	u32 base_addr_lsb; /* DWORD aligned base memory address of the ring */
+--- a/drivers/net/wireless/ath/ath11k/dp.h
++++ b/drivers/net/wireless/ath/ath11k/dp.h
+@@ -1594,6 +1594,13 @@ struct ath11k_htt_extd_stats_msg {
+ 	u8 data[0];
+ } __packed;
+ 
++#define	HTT_MAC_ADDR_L32_0	GENMASK(7, 0)
++#define	HTT_MAC_ADDR_L32_1	GENMASK(15, 8)
++#define	HTT_MAC_ADDR_L32_2	GENMASK(23, 16)
++#define	HTT_MAC_ADDR_L32_3	GENMASK(31, 24)
++#define	HTT_MAC_ADDR_H16_0	GENMASK(7, 0)
++#define	HTT_MAC_ADDR_H16_1	GENMASK(15, 8)
++
+ struct htt_mac_addr {
+ 	u32 mac_addr_l32;
+ 	u32 mac_addr_h16;

package/kernel/mac80211/patches/ath11k/0046-ath11k-add-HTT-stats-support-for-new-stats.patch

@@ -0,0 +1,677 @@
+From ac83b6034cfa3bec010c1e01d6e6b44673135afe Mon Sep 17 00:00:00 2001
+From: Venkateswara Naralasetty <vnaralas@codeaurora.org>
+Date: Tue, 28 Sep 2021 14:00:45 +0300
+Subject: [PATCH] ath11k: add HTT stats support for new stats
+
+Add HTT stats support for,
+
+29-ATH11K_DBG_HTT_EXT_STATS_PEER_CTRL_PATH_TXRX_STATS:
+Used to dump the control path txrx stats for each connected peer.
+Usage:
+echo 29 > /sys/kernel/debug/ieee80211/phyx/ath11k/htt_stats_type
+cat /sys/kernel/debug/ieee80211/phyx/netdev\:wlan0/stations/
+<sta mac>/htt_peer_stats.
+
+31-ATH11K_DBG_HTT_EXT_STATS_PDEV_TX_RATE_TXBF_STATS:
+Used to dump the per pdev tx rate txbf stats.
+Usage:
+echo 31 > /sys/kernel/debug/ieee80211/phyx/ath11k/htt_stats_type
+cat /sys/kernel/debug/ieee80211/phyx/ath11k/htt_stats
+
+32-ATH11k_DBG_HTT_EXT_STATS_TXBF_OFDMA:
+Used to dump the TXBF ofdma stats for all ofdma users.
+Usage:
+echo 32 > /sys/kernel/debug/ieee80211/phyx/ath11k/htt_stats_type
+cat /sys/kernel/debug/ieee80211/phyx/ath11k/htt_stats
+
+37-ATH11K_DBG_HTT_EXT_PHY_COUNTERS_AND_PHY_STATS:
+Used to dump the mac and phy txrx counts and phy stats like per chain rssi
+and ANI level.
+Usage:
+echo 37 > /sys/kernel/debug/ieee80211/phyx/ath11k/htt_stats_type
+cat /sys/kernel/debug/ieee80211/phyx/ath11k/htt_stats
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-00486-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Venkateswara Naralasetty <vnaralas@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210913223148.208026-6-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/debugfs.h     |   4 +
+ .../wireless/ath/ath11k/debugfs_htt_stats.c   | 368 +++++++++++++++++-
+ .../wireless/ath/ath11k/debugfs_htt_stats.h   | 172 ++++++++
+ drivers/net/wireless/ath/ath11k/debugfs_sta.c |   8 +-
+ 4 files changed, 548 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/debugfs.h
++++ b/drivers/net/wireless/ath/ath11k/debugfs.h
+@@ -38,6 +38,10 @@ enum ath11k_dbg_htt_ext_stats_type {
+ 	ATH11K_DBG_HTT_EXT_STATS_TX_SOUNDING_INFO           =  22,
+ 	ATH11K_DBG_HTT_EXT_STATS_PDEV_OBSS_PD_STATS	    =  23,
+ 	ATH11K_DBG_HTT_EXT_STATS_RING_BACKPRESSURE_STATS    =  24,
++	ATH11K_DBG_HTT_EXT_STATS_PEER_CTRL_PATH_TXRX_STATS  =  29,
++	ATH11K_DBG_HTT_EXT_STATS_PDEV_TX_RATE_TXBF_STATS    =  31,
++	ATH11K_DBG_HTT_EXT_STATS_TXBF_OFDMA		    =  32,
++	ATH11K_DBG_HTT_EXT_PHY_COUNTERS_AND_PHY_STATS	    =  37,
+ 
+ 	/* keep this last */
+ 	ATH11K_DBG_HTT_NUM_EXT_STATS,
+--- a/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.c
+@@ -3639,6 +3639,334 @@ static inline void htt_print_backpressur
+ 	}
+ }
+ 
++static inline
++void htt_print_pdev_tx_rate_txbf_stats_tlv(const void *tag_buf,
++					   struct debug_htt_stats_req *stats_req)
++{
++	const struct htt_pdev_txrate_txbf_stats_tlv *htt_stats_buf = tag_buf;
++	u8 *buf = stats_req->buf;
++	u32 len = stats_req->buf_len;
++	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
++	int i;
++
++	len += scnprintf(buf + len, buf_len - len,
++			 "HTT_STATS_PDEV_TX_RATE_TXBF_STATS:\n");
++
++	len += scnprintf(buf + len, buf_len - len, "tx_ol_mcs = ");
++	for (i = 0; i < HTT_TX_TXBF_RATE_STATS_NUM_MCS_COUNTERS; i++)
++		len += scnprintf(buf + len, buf_len - len,
++				 "%d:%u,", i, htt_stats_buf->tx_su_ol_mcs[i]);
++	len--;
++
++	len += scnprintf(buf + len, buf_len - len, "\ntx_ibf_mcs = ");
++	for (i = 0; i < HTT_TX_TXBF_RATE_STATS_NUM_MCS_COUNTERS; i++)
++		len += scnprintf(buf + len, buf_len - len,
++				 "%d:%u,", i, htt_stats_buf->tx_su_ibf_mcs[i]);
++	len--;
++
++	len += scnprintf(buf + len, buf_len - len, "\ntx_txbf_mcs =");
++	for (i = 0; i < HTT_TX_TXBF_RATE_STATS_NUM_MCS_COUNTERS; i++)
++		len += scnprintf(buf + len, buf_len - len,
++				 "%d:%u,", i, htt_stats_buf->tx_su_txbf_mcs[i]);
++	len--;
++
++	len += scnprintf(buf + len, buf_len - len, "\ntx_ol_nss = ");
++	for (i = 0; i < HTT_TX_PDEV_STATS_NUM_SPATIAL_STREAMS; i++)
++		len += scnprintf(buf + len, buf_len - len,
++				 "%d:%u,", i, htt_stats_buf->tx_su_ol_nss[i]);
++	len--;
++
++	len += scnprintf(buf + len, buf_len - len, "\ntx_ibf_nss = ");
++	for (i = 0; i < HTT_TX_PDEV_STATS_NUM_SPATIAL_STREAMS; i++)
++		len += scnprintf(buf + len, buf_len - len,
++				 "%d:%u,", i, htt_stats_buf->tx_su_ibf_nss[i]);
++	len--;
++
++	len += scnprintf(buf + len, buf_len - len, "\ntx_txbf_nss = ");
++	for (i = 0; i < HTT_TX_PDEV_STATS_NUM_SPATIAL_STREAMS; i++)
++		len += scnprintf(buf + len, buf_len - len,
++				 "%d:%u,", i, htt_stats_buf->tx_su_txbf_nss[i]);
++	len--;
++
++	len += scnprintf(buf + len, buf_len - len, "\ntx_ol_bw = ");
++	for (i = 0; i < HTT_TX_TXBF_RATE_STATS_NUM_BW_COUNTERS; i++)
++		len += scnprintf(buf + len, buf_len - len,
++				 "%d:%u,", i, htt_stats_buf->tx_su_ol_bw[i]);
++	len--;
++
++	len += scnprintf(buf + len, buf_len - len, "\ntx_ibf_bw = ");
++	for (i = 0; i < HTT_TX_TXBF_RATE_STATS_NUM_BW_COUNTERS; i++)
++		len += scnprintf(buf + len, buf_len - len,
++				 "%d:%u,", i, htt_stats_buf->tx_su_ibf_bw[i]);
++	len--;
++
++	len += scnprintf(buf + len, buf_len - len, "\ntx_txbf_bw = ");
++	for (i = 0; i < HTT_TX_TXBF_RATE_STATS_NUM_BW_COUNTERS; i++)
++		len += scnprintf(buf + len, buf_len - len,
++				 "%d:%u,", i, htt_stats_buf->tx_su_txbf_bw[i]);
++	len--;
++
++	len += scnprintf(buf + len, buf_len - len, "\n");
++
++	stats_req->buf_len = len;
++}
++
++static inline
++void htt_print_txbf_ofdma_ndpa_stats_tlv(const void *tag_buf,
++					 struct debug_htt_stats_req *stats_req)
++{
++	const struct htt_txbf_ofdma_ndpa_stats_tlv *htt_stats_buf = tag_buf;
++	u8 *buf = stats_req->buf;
++	u32 len = stats_req->buf_len;
++	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
++	int i;
++
++	len += scnprintf(buf + len, buf_len - len,
++			 "HTT_TXBF_OFDMA_NDPA_STATS_TLV:\n");
++
++	for (i = 0; i < HTT_TX_PDEV_STATS_NUM_OFDMA_USER_STATS; i++) {
++		len += scnprintf(buf + len, buf_len - len,
++				 "ax_ofdma_ndpa_queued_user%d = %u\n",
++				 i, htt_stats_buf->ax_ofdma_ndpa_queued[i]);
++		len += scnprintf(buf + len, buf_len - len,
++				 "ax_ofdma_ndpa_tried_user%d = %u\n",
++				 i, htt_stats_buf->ax_ofdma_ndpa_tried[i]);
++		len += scnprintf(buf + len, buf_len - len,
++				 "ax_ofdma_ndpa_flushed_user%d = %u\n",
++				 i, htt_stats_buf->ax_ofdma_ndpa_flushed[i]);
++		len += scnprintf(buf + len, buf_len - len,
++				 "ax_ofdma_ndpa_err_user%d = %u\n",
++				 i, htt_stats_buf->ax_ofdma_ndpa_err[i]);
++		len += scnprintf(buf + len, buf_len - len, "\n");
++	}
++
++	stats_req->buf_len = len;
++}
++
++static inline
++void htt_print_txbf_ofdma_ndp_stats_tlv(const void *tag_buf,
++					struct debug_htt_stats_req *stats_req)
++{
++	const struct htt_txbf_ofdma_ndp_stats_tlv *htt_stats_buf = tag_buf;
++	u8 *buf = stats_req->buf;
++	u32 len = stats_req->buf_len;
++	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
++	int i;
++
++	len += scnprintf(buf + len, buf_len - len,
++			 "HTT_TXBF_OFDMA_NDP_STATS_TLV:\n");
++
++	for (i = 0; i < HTT_TX_PDEV_STATS_NUM_OFDMA_USER_STATS; i++) {
++		len += scnprintf(buf + len, buf_len - len,
++				 "ax_ofdma_ndp_queued_user%d = %u\n",
++				 i, htt_stats_buf->ax_ofdma_ndp_queued[i]);
++		len += scnprintf(buf + len, buf_len - len,
++				 "ax_ofdma_ndp_tried_user%d = %u\n",
++				 i, htt_stats_buf->ax_ofdma_ndp_tried[i]);
++		len += scnprintf(buf + len, buf_len - len,
++				 "ax_ofdma_ndp_flushed_user%d = %u\n",
++				 i, htt_stats_buf->ax_ofdma_ndp_flushed[i]);
++		len += scnprintf(buf + len, buf_len - len,
++				 "ax_ofdma_ndp_err_user%d = %u\n",
++				 i, htt_stats_buf->ax_ofdma_ndp_err[i]);
++		len += scnprintf(buf + len, buf_len - len, "\n");
++	}
++
++	stats_req->buf_len = len;
++}
++
++static inline
++void htt_print_txbf_ofdma_brp_stats_tlv(const void *tag_buf,
++					struct debug_htt_stats_req *stats_req)
++{
++	const struct htt_txbf_ofdma_brp_stats_tlv *htt_stats_buf = tag_buf;
++	u8 *buf = stats_req->buf;
++	u32 len = stats_req->buf_len;
++	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
++	int i;
++
++	len += scnprintf(buf + len, buf_len - len,
++			 "HTT_TXBF_OFDMA_BRP_STATS_TLV:\n");
++
++	for (i = 0; i < HTT_TX_PDEV_STATS_NUM_OFDMA_USER_STATS; i++) {
++		len += scnprintf(buf + len, buf_len - len,
++				 "ax_ofdma_brpoll_queued_user%d = %u\n",
++				 i, htt_stats_buf->ax_ofdma_brpoll_queued[i]);
++		len += scnprintf(buf + len, buf_len - len,
++				 "ax_ofdma_brpoll_tried_user%d = %u\n",
++				 i, htt_stats_buf->ax_ofdma_brpoll_tried[i]);
++		len += scnprintf(buf + len, buf_len - len,
++				 "ax_ofdma_brpoll_flushed_user%d = %u\n",
++				 i, htt_stats_buf->ax_ofdma_brpoll_flushed[i]);
++		len += scnprintf(buf + len, buf_len - len,
++				 "ax_ofdma_brp_err_user%d = %u\n",
++				 i, htt_stats_buf->ax_ofdma_brp_err[i]);
++		len += scnprintf(buf + len, buf_len - len,
++				 "ax_ofdma_brp_err_num_cbf_rcvd_user%d = %u\n",
++				 i, htt_stats_buf->ax_ofdma_brp_err_num_cbf_rcvd[i]);
++		len += scnprintf(buf + len, buf_len - len, "\n");
++	}
++
++	stats_req->buf_len = len;
++}
++
++static inline
++void htt_print_txbf_ofdma_steer_stats_tlv(const void *tag_buf,
++					  struct debug_htt_stats_req *stats_req)
++{
++	const struct htt_txbf_ofdma_steer_stats_tlv *htt_stats_buf = tag_buf;
++	u8 *buf = stats_req->buf;
++	u32 len = stats_req->buf_len;
++	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
++	int i;
++
++	len += scnprintf(buf + len, buf_len - len,
++			 "HTT_TXBF_OFDMA_STEER_STATS_TLV:\n");
++
++	for (i = 0; i < HTT_TX_PDEV_STATS_NUM_OFDMA_USER_STATS; i++) {
++		len += scnprintf(buf + len, buf_len - len,
++				 "ax_ofdma_num_ppdu_steer_user%d = %u\n",
++				 i, htt_stats_buf->ax_ofdma_num_ppdu_steer[i]);
++		len += scnprintf(buf + len, buf_len - len,
++				 "ax_ofdma_num_ppdu_ol_user%d = %u\n",
++				 i, htt_stats_buf->ax_ofdma_num_ppdu_ol[i]);
++		len += scnprintf(buf + len, buf_len - len,
++				 "ax_ofdma_num_usrs_prefetch_user%d = %u\n",
++				 i, htt_stats_buf->ax_ofdma_num_usrs_prefetch[i]);
++		len += scnprintf(buf + len, buf_len - len,
++				 "ax_ofdma_num_usrs_sound_user%d = %u\n",
++				 i, htt_stats_buf->ax_ofdma_num_usrs_sound[i]);
++		len += scnprintf(buf + len, buf_len - len,
++				 "ax_ofdma_num_usrs_force_sound_user%d = %u\n",
++				 i, htt_stats_buf->ax_ofdma_num_usrs_force_sound[i]);
++		len += scnprintf(buf + len, buf_len - len, "\n");
++	}
++
++	stats_req->buf_len = len;
++}
++
++static inline
++void htt_print_phy_counters_tlv(const void *tag_buf,
++				struct debug_htt_stats_req *stats_req)
++{
++	const struct htt_phy_counters_tlv *htt_stats_buf = tag_buf;
++	u8 *buf = stats_req->buf;
++	u32 len = stats_req->buf_len;
++	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
++	int i;
++
++	len += scnprintf(buf + len, buf_len - len, "HTT_PHY_COUNTERS_TLV:\n");
++	len += scnprintf(buf + len, buf_len - len, "rx_ofdma_timing_err_cnt = %u\n",
++			 htt_stats_buf->rx_ofdma_timing_err_cnt);
++	len += scnprintf(buf + len, buf_len - len, "rx_cck_fail_cnt = %u\n",
++			 htt_stats_buf->rx_cck_fail_cnt);
++	len += scnprintf(buf + len, buf_len - len, "mactx_abort_cnt = %u\n",
++			 htt_stats_buf->mactx_abort_cnt);
++	len += scnprintf(buf + len, buf_len - len, "macrx_abort_cnt = %u\n",
++			 htt_stats_buf->macrx_abort_cnt);
++	len += scnprintf(buf + len, buf_len - len, "phytx_abort_cnt = %u\n",
++			 htt_stats_buf->phytx_abort_cnt);
++	len += scnprintf(buf + len, buf_len - len, "phyrx_abort_cnt = %u\n",
++			 htt_stats_buf->phyrx_abort_cnt);
++	len += scnprintf(buf + len, buf_len - len, "phyrx_defer_abort_cnt = %u\n",
++			 htt_stats_buf->phyrx_defer_abort_cnt);
++	len += scnprintf(buf + len, buf_len - len, "rx_gain_adj_lstf_event_cnt = %u\n",
++			 htt_stats_buf->rx_gain_adj_lstf_event_cnt);
++	len += scnprintf(buf + len, buf_len - len, "rx_gain_adj_non_legacy_cnt = %u\n",
++			 htt_stats_buf->rx_gain_adj_non_legacy_cnt);
++
++	for (i = 0; i < HTT_MAX_RX_PKT_CNT; i++)
++		len += scnprintf(buf + len, buf_len - len, "rx_pkt_cnt[%d] = %u\n",
++				 i, htt_stats_buf->rx_pkt_cnt[i]);
++
++	for (i = 0; i < HTT_MAX_RX_PKT_CRC_PASS_CNT; i++)
++		len += scnprintf(buf + len, buf_len - len,
++				 "rx_pkt_crc_pass_cnt[%d] = %u\n",
++				 i, htt_stats_buf->rx_pkt_crc_pass_cnt[i]);
++
++	for (i = 0; i < HTT_MAX_PER_BLK_ERR_CNT; i++)
++		len += scnprintf(buf + len, buf_len - len,
++				 "per_blk_err_cnt[%d] = %u\n",
++				 i, htt_stats_buf->per_blk_err_cnt[i]);
++
++	for (i = 0; i < HTT_MAX_RX_OTA_ERR_CNT; i++)
++		len += scnprintf(buf + len, buf_len - len,
++				 "rx_ota_err_cnt[%d] = %u\n",
++				 i, htt_stats_buf->rx_ota_err_cnt[i]);
++
++	stats_req->buf_len = len;
++}
++
++static inline
++void htt_print_phy_stats_tlv(const void *tag_buf,
++			     struct debug_htt_stats_req *stats_req)
++{
++	const struct htt_phy_stats_tlv *htt_stats_buf = tag_buf;
++	u8 *buf = stats_req->buf;
++	u32 len = stats_req->buf_len;
++	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
++	int i;
++
++	len += scnprintf(buf + len, buf_len - len, "HTT_PHY_STATS_TLV:\n");
++
++	for (i = 0; i < HTT_STATS_MAX_CHAINS; i++)
++		len += scnprintf(buf + len, buf_len - len, "nf_chain[%d] = %d\n",
++				 i, htt_stats_buf->nf_chain[i]);
++
++	len += scnprintf(buf + len, buf_len - len, "false_radar_cnt = %u\n",
++			 htt_stats_buf->false_radar_cnt);
++	len += scnprintf(buf + len, buf_len - len, "radar_cs_cnt = %u\n",
++			 htt_stats_buf->radar_cs_cnt);
++	len += scnprintf(buf + len, buf_len - len, "ani_level = %d\n",
++			 htt_stats_buf->ani_level);
++	len += scnprintf(buf + len, buf_len - len, "fw_run_time = %u\n",
++			 htt_stats_buf->fw_run_time);
++
++	stats_req->buf_len = len;
++}
++
++static inline
++void htt_print_peer_ctrl_path_txrx_stats_tlv(const void *tag_buf,
++					     struct debug_htt_stats_req *stats_req)
++{
++	const struct htt_peer_ctrl_path_txrx_stats_tlv *htt_stat_buf = tag_buf;
++	u8 *buf = stats_req->buf;
++	u32 len = stats_req->buf_len;
++	u32 buf_len = ATH11K_HTT_STATS_BUF_SIZE;
++	int i;
++	const char *mgmt_frm_type[ATH11K_STATS_MGMT_FRM_TYPE_MAX - 1] = {
++		"assoc_req", "assoc_resp",
++		"reassoc_req", "reassoc_resp",
++		"probe_req", "probe_resp",
++		"timing_advertisement", "reserved",
++		"beacon", "atim", "disassoc",
++		"auth", "deauth", "action", "action_no_ack"};
++
++	len += scnprintf(buf + len, buf_len - len,
++			 "HTT_STATS_PEER_CTRL_PATH_TXRX_STATS_TAG:\n");
++	len += scnprintf(buf + len, buf_len - len,
++			 "peer_mac_addr = %02x:%02x:%02x:%02x:%02x:%02x\n",
++			 htt_stat_buf->peer_mac_addr[0], htt_stat_buf->peer_mac_addr[1],
++			 htt_stat_buf->peer_mac_addr[2], htt_stat_buf->peer_mac_addr[3],
++			 htt_stat_buf->peer_mac_addr[4], htt_stat_buf->peer_mac_addr[5]);
++
++	len += scnprintf(buf + len, buf_len - len, "peer_tx_mgmt_subtype:\n");
++	for (i = 0; i < ATH11K_STATS_MGMT_FRM_TYPE_MAX - 1; i++)
++		len += scnprintf(buf + len, buf_len - len, "%s:%u\n",
++				 mgmt_frm_type[i],
++				 htt_stat_buf->peer_rx_mgmt_subtype[i]);
++
++	len += scnprintf(buf + len, buf_len - len, "peer_rx_mgmt_subtype:\n");
++	for (i = 0; i < ATH11K_STATS_MGMT_FRM_TYPE_MAX - 1; i++)
++		len += scnprintf(buf + len, buf_len - len, "%s:%u\n",
++				 mgmt_frm_type[i],
++				 htt_stat_buf->peer_rx_mgmt_subtype[i]);
++
++	len += scnprintf(buf + len, buf_len - len, "\n");
++
++	stats_req->buf_len = len;
++}
++
+ static int ath11k_dbg_htt_ext_stats_parse(struct ath11k_base *ab,
+ 					  u16 tag, u16 len, const void *tag_buf,
+ 					  void *user_data)
+@@ -3990,6 +4318,30 @@ static int ath11k_dbg_htt_ext_stats_pars
+ 	case HTT_STATS_RING_BACKPRESSURE_STATS_TAG:
+ 		htt_print_backpressure_stats_tlv_v(tag_buf, user_data);
+ 		break;
++	case HTT_STATS_PDEV_TX_RATE_TXBF_STATS_TAG:
++		htt_print_pdev_tx_rate_txbf_stats_tlv(tag_buf, stats_req);
++		break;
++	case HTT_STATS_TXBF_OFDMA_NDPA_STATS_TAG:
++		htt_print_txbf_ofdma_ndpa_stats_tlv(tag_buf, stats_req);
++		break;
++	case HTT_STATS_TXBF_OFDMA_NDP_STATS_TAG:
++		htt_print_txbf_ofdma_ndp_stats_tlv(tag_buf, stats_req);
++		break;
++	case HTT_STATS_TXBF_OFDMA_BRP_STATS_TAG:
++		htt_print_txbf_ofdma_brp_stats_tlv(tag_buf, stats_req);
++		break;
++	case HTT_STATS_TXBF_OFDMA_STEER_STATS_TAG:
++		htt_print_txbf_ofdma_steer_stats_tlv(tag_buf, stats_req);
++		break;
++	case HTT_STATS_PHY_COUNTERS_TAG:
++		htt_print_phy_counters_tlv(tag_buf, stats_req);
++		break;
++	case HTT_STATS_PHY_STATS_TAG:
++		htt_print_phy_stats_tlv(tag_buf, stats_req);
++		break;
++	case HTT_STATS_PEER_CTRL_PATH_TXRX_STATS_TAG:
++		htt_print_peer_ctrl_path_txrx_stats_tlv(tag_buf, stats_req);
++		break;
+ 	default:
+ 		break;
+ 	}
+@@ -4077,8 +4429,7 @@ static ssize_t ath11k_write_htt_stats_ty
+ 	if (type >= ATH11K_DBG_HTT_NUM_EXT_STATS)
+ 		return -E2BIG;
+ 
+-	if (type == ATH11K_DBG_HTT_EXT_STATS_RESET ||
+-	    type == ATH11K_DBG_HTT_EXT_STATS_PEER_INFO)
++	if (type == ATH11K_DBG_HTT_EXT_STATS_RESET)
+ 		return -EPERM;
+ 
+ 	ar->debug.htt_stats.type = type;
+@@ -4139,6 +4490,15 @@ static int ath11k_prep_htt_stats_cfg_par
+ 	case ATH11K_DBG_HTT_EXT_STATS_TX_SOUNDING_INFO:
+ 		cfg_params->cfg0 = HTT_STAT_DEFAULT_CFG0_ACTIVE_VDEVS;
+ 		break;
++	case ATH11K_DBG_HTT_EXT_STATS_PEER_CTRL_PATH_TXRX_STATS:
++		cfg_params->cfg0 = HTT_STAT_PEER_INFO_MAC_ADDR;
++		cfg_params->cfg1 |= FIELD_PREP(GENMASK(7, 0), mac_addr[0]);
++		cfg_params->cfg1 |= FIELD_PREP(GENMASK(15, 8), mac_addr[1]);
++		cfg_params->cfg1 |= FIELD_PREP(GENMASK(23, 16), mac_addr[2]);
++		cfg_params->cfg1 |= FIELD_PREP(GENMASK(31, 24), mac_addr[3]);
++		cfg_params->cfg2 |= FIELD_PREP(GENMASK(7, 0), mac_addr[4]);
++		cfg_params->cfg2 |= FIELD_PREP(GENMASK(15, 8), mac_addr[5]);
++		break;
+ 	default:
+ 		break;
+ 	}
+@@ -4196,7 +4556,9 @@ static int ath11k_open_htt_stats(struct
+ 	u8 type = ar->debug.htt_stats.type;
+ 	int ret;
+ 
+-	if (type == ATH11K_DBG_HTT_EXT_STATS_RESET)
++	if (type == ATH11K_DBG_HTT_EXT_STATS_RESET ||
++	    type == ATH11K_DBG_HTT_EXT_STATS_PEER_INFO ||
++	    type == ATH11K_DBG_HTT_EXT_STATS_PEER_CTRL_PATH_TXRX_STATS)
+ 		return -EPERM;
+ 
+ 	mutex_lock(&ar->conf_mutex);
+--- a/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.h
++++ b/drivers/net/wireless/ath/ath11k/debugfs_htt_stats.h
+@@ -102,6 +102,14 @@ enum htt_tlv_tag_t {
+ 	HTT_STATS_PDEV_OBSS_PD_TAG                          = 88,
+ 	HTT_STATS_HW_WAR_TAG				    = 89,
+ 	HTT_STATS_RING_BACKPRESSURE_STATS_TAG		    = 90,
++	HTT_STATS_PEER_CTRL_PATH_TXRX_STATS_TAG		    = 101,
++	HTT_STATS_PDEV_TX_RATE_TXBF_STATS_TAG		    = 108,
++	HTT_STATS_TXBF_OFDMA_NDPA_STATS_TAG		    = 113,
++	HTT_STATS_TXBF_OFDMA_NDP_STATS_TAG		    = 114,
++	HTT_STATS_TXBF_OFDMA_BRP_STATS_TAG		    = 115,
++	HTT_STATS_TXBF_OFDMA_STEER_STATS_TAG		    = 116,
++	HTT_STATS_PHY_COUNTERS_TAG			    = 121,
++	HTT_STATS_PHY_STATS_TAG				    = 122,
+ 
+ 	HTT_STATS_MAX_TAG,
+ };
+@@ -1750,6 +1758,170 @@ struct htt_ring_backpressure_stats_tlv {
+ 	u32 backpressure_hist[5];
+ };
+ 
++#define HTT_TX_TXBF_RATE_STATS_NUM_MCS_COUNTERS 14
++#define HTT_TX_TXBF_RATE_STATS_NUM_BW_COUNTERS 5
++#define HTT_TX_PDEV_STATS_NUM_SPATIAL_STREAMS 8
++
++struct htt_pdev_txrate_txbf_stats_tlv {
++	/* SU TxBF TX MCS stats */
++	u32 tx_su_txbf_mcs[HTT_TX_TXBF_RATE_STATS_NUM_MCS_COUNTERS];
++	/* Implicit BF TX MCS stats */
++	u32 tx_su_ibf_mcs[HTT_TX_TXBF_RATE_STATS_NUM_MCS_COUNTERS];
++	/* Open loop TX MCS stats */
++	u32 tx_su_ol_mcs[HTT_TX_TXBF_RATE_STATS_NUM_MCS_COUNTERS];
++	/* SU TxBF TX NSS stats */
++	u32 tx_su_txbf_nss[HTT_TX_PDEV_STATS_NUM_SPATIAL_STREAMS];
++	/* Implicit BF TX NSS stats */
++	u32 tx_su_ibf_nss[HTT_TX_PDEV_STATS_NUM_SPATIAL_STREAMS];
++	/* Open loop TX NSS stats */
++	u32 tx_su_ol_nss[HTT_TX_PDEV_STATS_NUM_SPATIAL_STREAMS];
++	/* SU TxBF TX BW stats */
++	u32 tx_su_txbf_bw[HTT_TX_TXBF_RATE_STATS_NUM_BW_COUNTERS];
++	/* Implicit BF TX BW stats */
++	u32 tx_su_ibf_bw[HTT_TX_TXBF_RATE_STATS_NUM_BW_COUNTERS];
++	/* Open loop TX BW stats */
++	u32 tx_su_ol_bw[HTT_TX_TXBF_RATE_STATS_NUM_BW_COUNTERS];
++};
++
++struct htt_txbf_ofdma_ndpa_stats_tlv {
++	/* 11AX HE OFDMA NDPA frame queued to the HW */
++	u32 ax_ofdma_ndpa_queued[HTT_TX_PDEV_STATS_NUM_OFDMA_USER_STATS];
++	/* 11AX HE OFDMA NDPA frame sent over the air */
++	u32 ax_ofdma_ndpa_tried[HTT_TX_PDEV_STATS_NUM_OFDMA_USER_STATS];
++	/* 11AX HE OFDMA NDPA frame flushed by HW */
++	u32 ax_ofdma_ndpa_flushed[HTT_TX_PDEV_STATS_NUM_OFDMA_USER_STATS];
++	/* 11AX HE OFDMA NDPA frame completed with error(s) */
++	u32 ax_ofdma_ndpa_err[HTT_TX_PDEV_STATS_NUM_OFDMA_USER_STATS];
++};
++
++struct htt_txbf_ofdma_ndp_stats_tlv {
++	/* 11AX HE OFDMA NDP frame queued to the HW */
++	u32 ax_ofdma_ndp_queued[HTT_TX_PDEV_STATS_NUM_OFDMA_USER_STATS];
++	/* 11AX HE OFDMA NDPA frame sent over the air */
++	u32 ax_ofdma_ndp_tried[HTT_TX_PDEV_STATS_NUM_OFDMA_USER_STATS];
++	/* 11AX HE OFDMA NDPA frame flushed by HW */
++	u32 ax_ofdma_ndp_flushed[HTT_TX_PDEV_STATS_NUM_OFDMA_USER_STATS];
++	/* 11AX HE OFDMA NDPA frame completed with error(s) */
++	u32 ax_ofdma_ndp_err[HTT_TX_PDEV_STATS_NUM_OFDMA_USER_STATS];
++};
++
++struct htt_txbf_ofdma_brp_stats_tlv {
++	/* 11AX HE OFDMA MU BRPOLL frame queued to the HW */
++	u32 ax_ofdma_brpoll_queued[HTT_TX_PDEV_STATS_NUM_OFDMA_USER_STATS];
++	/* 11AX HE OFDMA MU BRPOLL frame sent over the air */
++	u32 ax_ofdma_brpoll_tried[HTT_TX_PDEV_STATS_NUM_OFDMA_USER_STATS];
++	/* 11AX HE OFDMA MU BRPOLL frame flushed by HW */
++	u32 ax_ofdma_brpoll_flushed[HTT_TX_PDEV_STATS_NUM_OFDMA_USER_STATS];
++	/* 11AX HE OFDMA MU BRPOLL frame completed with error(s) */
++	u32 ax_ofdma_brp_err[HTT_TX_PDEV_STATS_NUM_OFDMA_USER_STATS];
++	/* Number of CBF(s) received when 11AX HE OFDMA MU BRPOLL frame
++	 * completed with error(s).
++	 */
++	u32 ax_ofdma_brp_err_num_cbf_rcvd[HTT_TX_PDEV_STATS_NUM_OFDMA_USER_STATS + 1];
++};
++
++struct htt_txbf_ofdma_steer_stats_tlv {
++	/* 11AX HE OFDMA PPDUs that were sent over the air with steering (TXBF + OFDMA) */
++	u32 ax_ofdma_num_ppdu_steer[HTT_TX_PDEV_STATS_NUM_OFDMA_USER_STATS];
++	/* 11AX HE OFDMA PPDUs that were sent over the air in open loop */
++	u32 ax_ofdma_num_ppdu_ol[HTT_TX_PDEV_STATS_NUM_OFDMA_USER_STATS];
++	/* 11AX HE OFDMA number of users for which CBF prefetch was
++	 * initiated to PHY HW during TX.
++	 */
++	u32 ax_ofdma_num_usrs_prefetch[HTT_TX_PDEV_STATS_NUM_OFDMA_USER_STATS];
++	/* 11AX HE OFDMA number of users for which sounding was initiated during TX */
++	u32 ax_ofdma_num_usrs_sound[HTT_TX_PDEV_STATS_NUM_OFDMA_USER_STATS];
++	/* 11AX HE OFDMA number of users for which sounding was forced during TX */
++	u32 ax_ofdma_num_usrs_force_sound[HTT_TX_PDEV_STATS_NUM_OFDMA_USER_STATS];
++};
++
++#define HTT_MAX_RX_PKT_CNT 8
++#define HTT_MAX_RX_PKT_CRC_PASS_CNT 8
++#define HTT_MAX_PER_BLK_ERR_CNT 20
++#define HTT_MAX_RX_OTA_ERR_CNT 14
++#define HTT_STATS_MAX_CHAINS 8
++#define ATH11K_STATS_MGMT_FRM_TYPE_MAX 16
++
++struct htt_phy_counters_tlv {
++	/* number of RXTD OFDMA OTA error counts except power surge and drop */
++	u32 rx_ofdma_timing_err_cnt;
++	/* rx_cck_fail_cnt:
++	 * number of cck error counts due to rx reception failure because of
++	 * timing error in cck
++	 */
++	u32 rx_cck_fail_cnt;
++	/* number of times tx abort initiated by mac */
++	u32 mactx_abort_cnt;
++	/* number of times rx abort initiated by mac */
++	u32 macrx_abort_cnt;
++	/* number of times tx abort initiated by phy */
++	u32 phytx_abort_cnt;
++	/* number of times rx abort initiated by phy */
++	u32 phyrx_abort_cnt;
++	/* number of rx defered count initiated by phy */
++	u32 phyrx_defer_abort_cnt;
++	/* number of sizing events generated at LSTF */
++	u32 rx_gain_adj_lstf_event_cnt;
++	/* number of sizing events generated at non-legacy LTF */
++	u32 rx_gain_adj_non_legacy_cnt;
++	/* rx_pkt_cnt -
++	 * Received EOP (end-of-packet) count per packet type;
++	 * [0] = 11a; [1] = 11b; [2] = 11n; [3] = 11ac; [4] = 11ax; [5] = GF
++	 * [6-7]=RSVD
++	 */
++	u32 rx_pkt_cnt[HTT_MAX_RX_PKT_CNT];
++	/* rx_pkt_crc_pass_cnt -
++	 * Received EOP (end-of-packet) count per packet type;
++	 * [0] = 11a; [1] = 11b; [2] = 11n; [3] = 11ac; [4] = 11ax; [5] = GF
++	 * [6-7]=RSVD
++	 */
++	u32 rx_pkt_crc_pass_cnt[HTT_MAX_RX_PKT_CRC_PASS_CNT];
++	/* per_blk_err_cnt -
++	 * Error count per error source;
++	 * [0] = unknown; [1] = LSIG; [2] = HTSIG; [3] = VHTSIG; [4] = HESIG;
++	 * [5] = RXTD_OTA; [6] = RXTD_FATAL; [7] = DEMF; [8] = ROBE;
++	 * [9] = PMI; [10] = TXFD; [11] = TXTD; [12] = PHYRF
++	 * [13-19]=RSVD
++	 */
++	u32 per_blk_err_cnt[HTT_MAX_PER_BLK_ERR_CNT];
++	/* rx_ota_err_cnt -
++	 * RXTD OTA (over-the-air) error count per error reason;
++	 * [0] = voting fail; [1] = weak det fail; [2] = strong sig fail;
++	 * [3] = cck fail; [4] = power surge; [5] = power drop;
++	 * [6] = btcf timing timeout error; [7] = btcf packet detect error;
++	 * [8] = coarse timing timeout error
++	 * [9-13]=RSVD
++	 */
++	u32 rx_ota_err_cnt[HTT_MAX_RX_OTA_ERR_CNT];
++};
++
++struct htt_phy_stats_tlv {
++	/* per chain hw noise floor values in dBm */
++	s32 nf_chain[HTT_STATS_MAX_CHAINS];
++	/* number of false radars detected */
++	u32 false_radar_cnt;
++	/* number of channel switches happened due to radar detection */
++	u32 radar_cs_cnt;
++	/* ani_level -
++	 * ANI level (noise interference) corresponds to the channel
++	 * the desense levels range from -5 to 15 in dB units,
++	 * higher values indicating more noise interference.
++	 */
++	s32 ani_level;
++	/* running time in minutes since FW boot */
++	u32 fw_run_time;
++};
++
++struct htt_peer_ctrl_path_txrx_stats_tlv {
++	/* peer mac address */
++	u8 peer_mac_addr[ETH_ALEN];
++	u8 rsvd[2];
++	/* Num of tx mgmt frames with subtype on peer level */
++	u32 peer_tx_mgmt_subtype[ATH11K_STATS_MGMT_FRM_TYPE_MAX];
++	/* Num of rx mgmt frames with subtype on peer level */
++	u32 peer_rx_mgmt_subtype[ATH11K_STATS_MGMT_FRM_TYPE_MAX];
++};
++
+ #ifdef CPTCFG_ATH11K_DEBUGFS
+ 
+ void ath11k_debugfs_htt_stats_init(struct ath11k *ar);
+--- a/drivers/net/wireless/ath/ath11k/debugfs_sta.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs_sta.c
+@@ -419,15 +419,21 @@ ath11k_dbg_sta_open_htt_peer_stats(struc
+ 	struct ath11k_sta *arsta = (struct ath11k_sta *)sta->drv_priv;
+ 	struct ath11k *ar = arsta->arvif->ar;
+ 	struct debug_htt_stats_req *stats_req;
++	int type = ar->debug.htt_stats.type;
+ 	int ret;
+ 
++	if ((type != ATH11K_DBG_HTT_EXT_STATS_PEER_INFO &&
++	     type != ATH11K_DBG_HTT_EXT_STATS_PEER_CTRL_PATH_TXRX_STATS) ||
++	    type == ATH11K_DBG_HTT_EXT_STATS_RESET)
++		return -EPERM;
++
+ 	stats_req = vzalloc(sizeof(*stats_req) + ATH11K_HTT_STATS_BUF_SIZE);
+ 	if (!stats_req)
+ 		return -ENOMEM;
+ 
+ 	mutex_lock(&ar->conf_mutex);
+ 	ar->debug.htt_stats.stats_req = stats_req;
+-	stats_req->type = ATH11K_DBG_HTT_EXT_STATS_PEER_INFO;
++	stats_req->type = type;
+ 	memcpy(stats_req->peer_addr, sta->addr, ETH_ALEN);
+ 	ret = ath11k_debugfs_htt_stats_req(ar);
+ 	mutex_unlock(&ar->conf_mutex);

package/kernel/mac80211/patches/ath11k/0048-ath11k-indicate-scan-complete-for-scan-canceled-when.patch

@@ -0,0 +1,76 @@
+From c677d4b1bcc4f7330043d8f039f494557d720ed4 Mon Sep 17 00:00:00 2001
+From: Wen Gong <wgong@codeaurora.org>
+Date: Tue, 28 Sep 2021 14:00:45 +0300
+Subject: [PATCH] ath11k: indicate scan complete for scan canceled when scan
+ running
+
+ath11k prints "Received scan event for unknown vdev" when doing the
+following test:
+1. trigger scan
+2. wait 0.2 second
+3. iw reg set or 11d scan complete from firmware
+
+Reason: When iw reg set or 11d scan complete, the new country code will
+be set to the firmware, and the new regdomain info indicated to ath11k,
+then the new channel list will be sent to the firmware. The firmware
+will cancel the current scan after receiving WMI_SCAN_CHAN_LIST_CMDID
+which is used for the new channel list, and the state of ath11k is
+ATH11K_SCAN_RUNNING, then ath11k_get_ar_on_scan_abort() returns NULL and
+ath11k_scan_event() returns at this point and does not indicate scan
+completion to mac80211.
+
+Indicate scan completion to mac80211 and get rid of the "Received scan
+event for unknown vdev" print for the above case.
+
+Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
+
+Signed-off-by: Wen Gong <wgong@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210914164226.38843-2-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/wmi.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -6290,8 +6290,9 @@ exit:
+ 	rcu_read_unlock();
+ }
+ 
+-static struct ath11k *ath11k_get_ar_on_scan_abort(struct ath11k_base *ab,
+-						  u32 vdev_id)
++static struct ath11k *ath11k_get_ar_on_scan_state(struct ath11k_base *ab,
++						  u32 vdev_id,
++						  enum ath11k_scan_state state)
+ {
+ 	int i;
+ 	struct ath11k_pdev *pdev;
+@@ -6303,7 +6304,7 @@ static struct ath11k *ath11k_get_ar_on_s
+ 			ar = pdev->ar;
+ 
+ 			spin_lock_bh(&ar->data_lock);
+-			if (ar->scan.state == ATH11K_SCAN_ABORTING &&
++			if (ar->scan.state == state &&
+ 			    ar->scan.vdev_id == vdev_id) {
+ 				spin_unlock_bh(&ar->data_lock);
+ 				return ar;
+@@ -6333,10 +6334,15 @@ static void ath11k_scan_event(struct ath
+ 	 * aborting scan's vdev id matches this event info.
+ 	 */
+ 	if (scan_ev.event_type == WMI_SCAN_EVENT_COMPLETED &&
+-	    scan_ev.reason == WMI_SCAN_REASON_CANCELLED)
+-		ar = ath11k_get_ar_on_scan_abort(ab, scan_ev.vdev_id);
+-	else
++	    scan_ev.reason == WMI_SCAN_REASON_CANCELLED) {
++		ar = ath11k_get_ar_on_scan_state(ab, scan_ev.vdev_id,
++						 ATH11K_SCAN_ABORTING);
++		if (!ar)
++			ar = ath11k_get_ar_on_scan_state(ab, scan_ev.vdev_id,
++							 ATH11K_SCAN_RUNNING);
++	} else {
+ 		ar = ath11k_mac_get_ar_by_vdev_id(ab, scan_ev.vdev_id);
++	}
+ 
+ 	if (!ar) {
+ 		ath11k_warn(ab, "Received scan event for unknown vdev");

package/kernel/mac80211/patches/ath11k/0049-ath11k-indicate-to-mac80211-scan-complete-with-abort.patch

@@ -0,0 +1,71 @@
+From 62db14ea95b1017c53ebb8f724119ea4d90ecc07 Mon Sep 17 00:00:00 2001
+From: Wen Gong <wgong@codeaurora.org>
+Date: Tue, 28 Sep 2021 14:00:45 +0300
+Subject: [PATCH] ath11k: indicate to mac80211 scan complete with aborted flag
+ for ATH11K_SCAN_STARTING state
+
+Scan failure can not be recovered from when running a loop of the
+following steps:
+1. run scan: "iw wlan scan".
+2. run command: echo assert > /sys/kernel/debug/ath11k/qca6490\ hw2.0/simulate_fw_crash
+   immediately after step 1.
+
+result:
+scan failed and can not recover even when wlan recovery succeeds:
+command failed: Device or resource busy (-16)
+
+reason:
+When scan arrives, WMI_START_SCAN_CMDID is sent to the firmware and
+function ath11k_mac_op_hw_scan() returns, then simulate_fw_crash arrives
+and the scan started event does not arrive, and then it starts to do
+recovery of wlan. __ath11k_mac_scan_finish() which is called from
+ath11k_core_halt() is one step of recovery, it will not call
+ieee80211_scan_completed() by logic currently because the scan state is
+ATH11K_SCAN_STARTING. Thus it leads the scan not being completed in
+mac80211, and leads all consecutive scans failing with -EBUSY in
+nl80211_trigger_scan even after wlan recovery success.
+
+Indicate scan complete with aborted flag to mac80211 for
+ATH11K_SCAN_STARTING to allow recovery from scan failed with "Device or
+resource busy (-16)" after wlan recovery.
+
+Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
+
+Signed-off-by: Wen Gong <wgong@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210914164226.38843-3-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -2987,18 +2987,21 @@ void __ath11k_mac_scan_finish(struct ath
+ 		break;
+ 	case ATH11K_SCAN_RUNNING:
+ 	case ATH11K_SCAN_ABORTING:
++		if (ar->scan.is_roc && ar->scan.roc_notify)
++			ieee80211_remain_on_channel_expired(ar->hw);
++		fallthrough;
++	case ATH11K_SCAN_STARTING:
+ 		if (!ar->scan.is_roc) {
+ 			struct cfg80211_scan_info info = {
+-				.aborted = (ar->scan.state ==
+-					    ATH11K_SCAN_ABORTING),
++				.aborted = ((ar->scan.state ==
++					    ATH11K_SCAN_ABORTING) ||
++					    (ar->scan.state ==
++					    ATH11K_SCAN_STARTING)),
+ 			};
+ 
+ 			ieee80211_scan_completed(ar->hw, &info);
+-		} else if (ar->scan.roc_notify) {
+-			ieee80211_remain_on_channel_expired(ar->hw);
+ 		}
+-		fallthrough;
+-	case ATH11K_SCAN_STARTING:
++
+ 		ar->scan.state = ATH11K_SCAN_IDLE;
+ 		ar->scan_channel = NULL;
+ 		ar->scan.roc_freq = 0;

package/kernel/mac80211/patches/ath11k/0050-ath11k-add-6-GHz-params-in-peer-assoc-command.patch

@@ -0,0 +1,94 @@
+From c3a7d7eb4c9853bb457b792cef42ddd4a029a914 Mon Sep 17 00:00:00 2001
+From: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
+Date: Tue, 28 Sep 2021 14:00:46 +0300
+Subject: [PATCH] ath11k: add 6 GHz params in peer assoc command
+
+Currently A-MPDU aggregation parameters are not being configured
+during peer association for 6 GHz band. Hence, extract these
+parameters from station's capabilities received in association
+request and send to firmware. Without this, A-MPDU aggregation
+is not happening in 6 GHz band.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01386-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210913175510.193005-2-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 50 ++++++++++++++++++++++++++-
+ 1 file changed, 49 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -2021,6 +2021,53 @@ static void ath11k_peer_assoc_h_he(struc
+ 		   arg->peer_bw_rxnss_override);
+ }
+ 
++static void ath11k_peer_assoc_h_he_6ghz(struct ath11k *ar,
++					struct ieee80211_vif *vif,
++					struct ieee80211_sta *sta,
++					struct peer_assoc_params *arg)
++{
++	const struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
++	struct cfg80211_chan_def def;
++	enum nl80211_band band;
++	u8  ampdu_factor;
++
++	if (WARN_ON(ath11k_mac_vif_chan(vif, &def)))
++		return;
++
++	band = def.chan->band;
++
++	if (!arg->he_flag || band != NL80211_BAND_6GHZ || !sta->he_6ghz_capa.capa)
++		return;
++
++	if (sta->bandwidth == IEEE80211_STA_RX_BW_80)
++		arg->bw_80 = true;
++
++	if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
++		arg->bw_160 = true;
++
++	arg->peer_he_caps_6ghz = le16_to_cpu(sta->he_6ghz_capa.capa);
++	arg->peer_mpdu_density =
++		ath11k_parse_mpdudensity(FIELD_GET(IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START,
++						   arg->peer_he_caps_6ghz));
++
++	/* From IEEE Std 802.11ax-2021 - Section 10.12.2: An HE STA shall be capable of
++	 * receiving A-MPDU where the A-MPDU pre-EOF padding length is up to the value
++	 * indicated by the Maximum A-MPDU Length Exponent Extension field in the HE
++	 * Capabilities element and the Maximum A-MPDU Length Exponent field in HE 6 GHz
++	 * Band Capabilities element in the 6 GHz band.
++	 *
++	 * Here, we are extracting the Max A-MPDU Exponent Extension from HE caps and
++	 * factor is the Maximum A-MPDU Length Exponent from HE 6 GHZ Band capability.
++	 */
++	ampdu_factor = FIELD_GET(IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_MASK,
++				 he_cap->he_cap_elem.mac_cap_info[3]) +
++			FIELD_GET(IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP,
++				  arg->peer_he_caps_6ghz);
++
++	arg->peer_max_mpdu = (1u << (IEEE80211_HE_6GHZ_MAX_AMPDU_FACTOR +
++				     ampdu_factor)) - 1;
++}
++
+ static void ath11k_peer_assoc_h_smps(struct ieee80211_sta *sta,
+ 				     struct peer_assoc_params *arg)
+ {
+@@ -2310,6 +2357,7 @@ static void ath11k_peer_assoc_prepare(st
+ 	ath11k_peer_assoc_h_ht(ar, vif, sta, arg);
+ 	ath11k_peer_assoc_h_vht(ar, vif, sta, arg);
+ 	ath11k_peer_assoc_h_he(ar, vif, sta, arg);
++	ath11k_peer_assoc_h_he_6ghz(ar, vif, sta, arg);
+ 	ath11k_peer_assoc_h_qos(ar, vif, sta, arg);
+ 	ath11k_peer_assoc_h_smps(sta, arg);
+ 
+@@ -7608,7 +7656,7 @@ static int __ath11k_mac_register(struct
+ 	if (cap->nss_ratio_enabled)
+ 		ieee80211_hw_set(ar->hw, SUPPORTS_VHT_EXT_NSS_BW);
+ 
+-	if (ht_cap & WMI_HT_CAP_ENABLED) {
++	if ((ht_cap & WMI_HT_CAP_ENABLED) || ar->supports_6ghz) {
+ 		ieee80211_hw_set(ar->hw, AMPDU_AGGREGATION);
+ 		ieee80211_hw_set(ar->hw, TX_AMPDU_SETUP_IN_HW);
+ 		ieee80211_hw_set(ar->hw, SUPPORTS_REORDERING_BUFFER);

package/kernel/mac80211/patches/ath11k/0051-ath11k-support-SMPS-configuration-for-6-GHz.patch

@@ -0,0 +1,93 @@
+From 6f4d70308e5eb63c99702e93f7c0d8e55f360da2 Mon Sep 17 00:00:00 2001
+From: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
+Date: Tue, 28 Sep 2021 14:00:46 +0300
+Subject: [PATCH] ath11k: support SMPS configuration for 6 GHz
+
+Parse SMPS configuration from IEs and configure. Without this,
+SMPS is not enabled for 6 GHz band.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01386-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210913175510.193005-3-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 31 ++++++++++++++++++---------
+ 1 file changed, 21 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -2074,11 +2074,16 @@ static void ath11k_peer_assoc_h_smps(str
+ 	const struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
+ 	int smps;
+ 
+-	if (!ht_cap->ht_supported)
++	if (!ht_cap->ht_supported && !sta->he_6ghz_capa.capa)
+ 		return;
+ 
+-	smps = ht_cap->cap & IEEE80211_HT_CAP_SM_PS;
+-	smps >>= IEEE80211_HT_CAP_SM_PS_SHIFT;
++	if (ht_cap->ht_supported) {
++		smps = ht_cap->cap & IEEE80211_HT_CAP_SM_PS;
++		smps >>= IEEE80211_HT_CAP_SM_PS_SHIFT;
++	} else {
++		smps = FIELD_GET(IEEE80211_HE_6GHZ_CAP_SM_PS,
++				 le16_to_cpu(sta->he_6ghz_capa.capa));
++	}
+ 
+ 	switch (smps) {
+ 	case WLAN_HT_CAP_SM_PS_STATIC:
+@@ -2366,15 +2371,20 @@ static void ath11k_peer_assoc_prepare(st
+ 
+ static int ath11k_setup_peer_smps(struct ath11k *ar, struct ath11k_vif *arvif,
+ 				  const u8 *addr,
+-				  const struct ieee80211_sta_ht_cap *ht_cap)
++				  const struct ieee80211_sta_ht_cap *ht_cap,
++				  u16 he_6ghz_capa)
+ {
+ 	int smps;
+ 
+-	if (!ht_cap->ht_supported)
++	if (!ht_cap->ht_supported && !he_6ghz_capa)
+ 		return 0;
+ 
+-	smps = ht_cap->cap & IEEE80211_HT_CAP_SM_PS;
+-	smps >>= IEEE80211_HT_CAP_SM_PS_SHIFT;
++	if (ht_cap->ht_supported) {
++		smps = ht_cap->cap & IEEE80211_HT_CAP_SM_PS;
++		smps >>= IEEE80211_HT_CAP_SM_PS_SHIFT;
++	} else {
++		smps = FIELD_GET(IEEE80211_HE_6GHZ_CAP_SM_PS, he_6ghz_capa);
++	}
+ 
+ 	if (smps >= ARRAY_SIZE(ath11k_smps_map))
+ 		return -EINVAL;
+@@ -2427,7 +2437,8 @@ static void ath11k_bss_assoc(struct ieee
+ 	}
+ 
+ 	ret = ath11k_setup_peer_smps(ar, arvif, bss_conf->bssid,
+-				     &ap_sta->ht_cap);
++				     &ap_sta->ht_cap,
++				     le16_to_cpu(ap_sta->he_6ghz_capa.capa));
+ 	if (ret) {
+ 		ath11k_warn(ar->ab, "failed to setup peer SMPS for vdev %d: %d\n",
+ 			    arvif->vdev_id, ret);
+@@ -3720,7 +3731,7 @@ static int ath11k_station_assoc(struct a
+ 		return 0;
+ 
+ 	ret = ath11k_setup_peer_smps(ar, arvif, sta->addr,
+-				     &sta->ht_cap);
++				     &sta->ht_cap, le16_to_cpu(sta->he_6ghz_capa.capa));
+ 	if (ret) {
+ 		ath11k_warn(ar->ab, "failed to setup peer SMPS for vdev %d: %d\n",
+ 			    arvif->vdev_id, ret);
+@@ -7671,7 +7682,7 @@ static int __ath11k_mac_register(struct
+ 	 * for each band for a dual band capable radio. It will be tricky to
+ 	 * handle it when the ht capability different for each band.
+ 	 */
+-	if (ht_cap & WMI_HT_CAP_DYNAMIC_SMPS)
++	if (ht_cap & WMI_HT_CAP_DYNAMIC_SMPS || ar->supports_6ghz)
+ 		ar->hw->wiphy->features |= NL80211_FEATURE_DYNAMIC_SMPS;
+ 
+ 	ar->hw->wiphy->max_scan_ssids = WLAN_SCAN_PARAMS_MAX_SSID;

package/kernel/mac80211/patches/ath11k/0053-ath11k-Remove-unused-variable-in-ath11k_dp_rx_mon_me.patch

@@ -0,0 +1,70 @@
+From 7210b4b77fe47697890d2d3b2ce57ac9f767bffc Mon Sep 17 00:00:00 2001
+From: Tim Gardner <tim.gardner@canonical.com>
+Date: Tue, 5 Oct 2021 16:55:54 +0300
+Subject: [PATCH] ath11k: Remove unused variable in
+ ath11k_dp_rx_mon_merg_msdus()
+
+Coverity complains that a constant variable guards dead code. In fact,
+mpdu_buf is set NULL and never updated.
+
+4834err_merge_fail:
+    	null: At condition mpdu_buf, the value of mpdu_buf must be NULL.
+    	dead_error_condition: The condition mpdu_buf cannot be true.
+CID 92162 (#1 of 1): 'Constant' variable guards dead code (DEADCODE)
+dead_error_line: Execution cannot reach the expression decap_format !=
+  DP_RX_DECAP_TYPE_RAW inside this statement: if (mpdu_buf && decap_forma....
+Local variable mpdu_buf is assigned only once, to a constant value, making it
+  effectively constant throughout its scope. If this is not the intent, examine
+  the logic to see if there is a missing assignment that would make mpdu_buf not
+  remain constant.
+4835        if (mpdu_buf && decap_format != DP_RX_DECAP_TYPE_RAW) {
+
+Fix this by removing mpdu_buf and unreachable code.
+
+Cc: Kalle Valo <kvalo@codeaurora.org>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: ath11k@lists.infradead.org
+Cc: linux-wireless@vger.kernel.org
+Cc: netdev@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210927150743.19816-1-tim.gardner@canonical.com
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 10 +---------
+ 1 file changed, 1 insertion(+), 9 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -4828,7 +4828,7 @@ ath11k_dp_rx_mon_merg_msdus(struct ath11
+ 			    struct ieee80211_rx_status *rxs)
+ {
+ 	struct ath11k_base *ab = ar->ab;
+-	struct sk_buff *msdu, *mpdu_buf, *prev_buf;
++	struct sk_buff *msdu, *prev_buf;
+ 	u32 wifi_hdr_len;
+ 	struct hal_rx_desc *rx_desc;
+ 	char *hdr_desc;
+@@ -4836,8 +4836,6 @@ ath11k_dp_rx_mon_merg_msdus(struct ath11
+ 	struct ieee80211_hdr_3addr *wh;
+ 	struct rx_attention *rx_attention;
+ 
+-	mpdu_buf = NULL;
+-
+ 	if (!head_msdu)
+ 		goto err_merge_fail;
+ 
+@@ -4920,12 +4918,6 @@ ath11k_dp_rx_mon_merg_msdus(struct ath11
+ 	return head_msdu;
+ 
+ err_merge_fail:
+-	if (mpdu_buf && decap_format != DP_RX_DECAP_TYPE_RAW) {
+-		ath11k_dbg(ab, ATH11K_DBG_DATA,
+-			   "err_merge_fail mpdu_buf %pK", mpdu_buf);
+-		/* Free the head buffer */
+-		dev_kfree_skb_any(mpdu_buf);
+-	}
+ 	return NULL;
+ }
+ 

package/kernel/mac80211/patches/ath11k/0054-ath11k-Fix-spelling-mistake-incompaitiblity-incompat.patch

@@ -0,0 +1,26 @@
+From 567ec33a76c7d8e7fbd7a73c81dd16b9efc7ae6d Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Wed, 6 Oct 2021 09:32:17 +0100
+Subject: [PATCH] ath11k: Fix spelling mistake "incompaitiblity" ->
+ "incompatibility"
+
+There is a spelling mistake in an ath11k_warn message. Fix it.
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20211006083217.349596-1-colin.king@canonical.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -7091,7 +7091,7 @@ ath11k_mac_op_set_bitrate_mask(struct ie
+ 
+ 		if (!ath11k_mac_validate_vht_he_fixed_rate_settings(ar, band, mask))
+ 			ath11k_warn(ar->ab,
+-				    "could not update fixed rate settings to all peers due to mcs/nss incompaitiblity\n");
++				    "could not update fixed rate settings to all peers due to mcs/nss incompatibility\n");
+ 		nss = min_t(u32, ar->num_tx_chains,
+ 			    max(max(ath11k_mac_max_ht_nss(ht_mcs_mask),
+ 				    ath11k_mac_max_vht_nss(vht_mcs_mask)),

package/kernel/mac80211/patches/ath11k/0055-ath11k-fix-m68k-and-xtensa-build-failure-in-ath11k_p.patch

@@ -0,0 +1,56 @@
+From 16bdce2ada5a4c3c91b7c4e81780d2de50bd6ab5 Mon Sep 17 00:00:00 2001
+From: Kalle Valo <kvalo@codeaurora.org>
+Date: Fri, 8 Oct 2021 17:39:32 +0300
+Subject: [PATCH] ath11k: fix m68k and xtensa build failure in
+ ath11k_peer_assoc_h_smps()
+
+Stephen reported that ath11k was failing to build on m68k and xtensa:
+
+In file included from <command-line>:0:0:
+In function 'ath11k_peer_assoc_h_smps',
+    inlined from 'ath11k_peer_assoc_prepare' at drivers/net/wireless/ath/ath11k/mac.c:2362:2:
+include/linux/compiler_types.h:317:38: error: call to '__compiletime_assert_650' declared with attribute error: FIELD_GET: type of reg too small for mask
+  _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
+                                      ^
+include/linux/compiler_types.h:298:4: note: in definition of macro '__compiletime_assert'
+    prefix ## suffix();    \
+    ^
+include/linux/compiler_types.h:317:2: note: in expansion of macro '_compiletime_assert'
+  _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
+  ^
+include/linux/build_bug.h:39:37: note: in expansion of macro 'compiletime_assert'
+ #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg)
+                                     ^
+include/linux/bitfield.h:52:3: note: in expansion of macro 'BUILD_BUG_ON_MSG'
+   BUILD_BUG_ON_MSG((_mask) > (typeof(_reg))~0ull,  \
+   ^
+include/linux/bitfield.h:108:3: note: in expansion of macro '__BF_FIELD_CHECK'
+   __BF_FIELD_CHECK(_mask, _reg, 0U, "FIELD_GET: "); \
+   ^
+drivers/net/wireless/ath/ath11k/mac.c:2079:10: note: in expansion of macro 'FIELD_GET'
+   smps = FIELD_GET(IEEE80211_HE_6GHZ_CAP_SM_PS,
+
+Fix the issue by using le16_get_bits() to specify the size explicitly.
+
+Fixes: 6f4d70308e5e ("ath11k: support SMPS configuration for 6 GHz")
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Tested-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -2081,8 +2081,8 @@ static void ath11k_peer_assoc_h_smps(str
+ 		smps = ht_cap->cap & IEEE80211_HT_CAP_SM_PS;
+ 		smps >>= IEEE80211_HT_CAP_SM_PS_SHIFT;
+ 	} else {
+-		smps = FIELD_GET(IEEE80211_HE_6GHZ_CAP_SM_PS,
+-				 le16_to_cpu(sta->he_6ghz_capa.capa));
++		smps = le16_get_bits(sta->he_6ghz_capa.capa,
++				     IEEE80211_HE_6GHZ_CAP_SM_PS);
+ 	}
+ 
+ 	switch (smps) {

package/kernel/mac80211/patches/ath11k/0056-ath11k-Remove-redundant-assignment-to-variable-fw_si.patch

@@ -0,0 +1,28 @@
+From 4f50bdfb4e5fc3d753c8cf94b94b43aaa2c49b95 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Thu, 7 Oct 2021 18:16:24 +0300
+Subject: [PATCH] ath11k: Remove redundant assignment to variable fw_size
+
+Variable fw_size is being assigned a value that is never read and
+being re-assigned a new value in the next statement. The assignment
+is redundant and can be removed.
+
+Addresses-Coverity: ("Unused value")
+Fixes: 336e7b53c82f ("ath11k: clean up BDF download functions")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20211006105529.1011239-1-colin.king@canonical.com
+---
+ drivers/net/wireless/ath/ath11k/qmi.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/qmi.c
++++ b/drivers/net/wireless/ath/ath11k/qmi.c
+@@ -2135,7 +2135,6 @@ static int ath11k_qmi_load_bdf_qmi(struc
+ 
+ 	ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi bdf_type %d\n", bdf_type);
+ 
+-	fw_size = bd.len;
+ 	fw_size = min_t(u32, ab->hw_params.fw.board_size, bd.len);
+ 
+ 	ret = ath11k_qmi_load_file_target_mem(ab, bd.data, fw_size, bdf_type);

package/kernel/mac80211/patches/ath11k/0057-ath11k-Use-kcalloc-instead-of-kzalloc.patch

@@ -0,0 +1,40 @@
+From ec4363384c3f110561dc5ee2e59adee02dbd9f73 Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavoars@kernel.org>
+Date: Thu, 7 Oct 2021 18:16:24 +0300
+Subject: [PATCH] ath11k: Use kcalloc() instead of kzalloc()
+
+Use 2-factor multiplication argument form kcalloc() instead
+of kzalloc().
+
+Link: https://github.com/KSPP/linux/issues/162
+Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20211006181204.GA913553@embeddedor
+---
+ drivers/net/wireless/ath/ath11k/wmi.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -4066,8 +4066,8 @@ static int ath11k_wmi_tlv_mac_phy_caps_p
+ 
+ 	len = min_t(u16, len, sizeof(struct wmi_mac_phy_capabilities));
+ 	if (!svc_rdy_ext->n_mac_phy_caps) {
+-		svc_rdy_ext->mac_phy_caps = kzalloc((svc_rdy_ext->tot_phy_id) * len,
+-						    GFP_ATOMIC);
++		svc_rdy_ext->mac_phy_caps = kcalloc(svc_rdy_ext->tot_phy_id,
++						    len, GFP_ATOMIC);
+ 		if (!svc_rdy_ext->mac_phy_caps)
+ 			return -ENOMEM;
+ 	}
+@@ -4467,8 +4467,8 @@ static struct cur_reg_rule
+ 	struct cur_reg_rule *reg_rule_ptr;
+ 	u32 count;
+ 
+-	reg_rule_ptr =  kzalloc((num_reg_rules * sizeof(*reg_rule_ptr)),
+-				GFP_ATOMIC);
++	reg_rule_ptr = kcalloc(num_reg_rules, sizeof(*reg_rule_ptr),
++			       GFP_ATOMIC);
+ 
+ 	if (!reg_rule_ptr)
+ 		return NULL;

package/kernel/mac80211/patches/ath11k/0058-ath11k-Handle-MSI-enablement-during-rmmod-and-SSR.patch

@@ -0,0 +1,139 @@
+From 96527d527b271d950367ad13e3de8b0673545622 Mon Sep 17 00:00:00 2001
+From: Baochen Qiang <bqiang@codeaurora.org>
+Date: Mon, 11 Oct 2021 09:33:08 +0300
+Subject: [PATCH] ath11k: Handle MSI enablement during rmmod and SSR
+
+When doing "rmmod ath11k_pci", ath11k performs global SOC reset
+and MHI reset, where 0 address access is captured by IOMMU. See
+log below:
+
+...
+[  133.953860] ath11k_pci 0000:02:00.0: setting mhi state: DEINIT(1)
+[  133.959714] ath11k_pci 0000:02:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x000a address=0x0 flags=0x0020]
+[  133.973854] ath11k_pci 0000:02:00.0: MHISTATUS 0xff04
+[  133.974095] ath11k_pci 0000:02:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x000a address=0x0 flags=0x0020]
+...
+
+This issue is also observed in SSR process, cause a similar
+sequence as above is performed.
+
+Such an invalid access occurs because, during rmmod or SSR, MSI
+address is cleared but HW MSI functionality not disabled, thus HW
+target is able to raise an MSI transaction with 0 as MSI address.
+
+So it can be fixed by simply disabling MSI before reset. For SSR,
+since MSI functionality is still needed after target is brought
+back, we need to reenable it.
+
+Also change naming of some interfaces related.
+
+Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1
+Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
+
+Signed-off-by: Baochen Qiang <bqiang@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210913180246.193388-5-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/pci.c | 41 +++++++++++++++++++++++----
+ 1 file changed, 36 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/pci.c
++++ b/drivers/net/wireless/ath/ath11k/pci.c
+@@ -861,7 +861,32 @@ static void ath11k_pci_ce_irqs_enable(st
+ 	}
+ }
+ 
+-static int ath11k_pci_enable_msi(struct ath11k_pci *ab_pci)
++static void ath11k_pci_msi_config(struct ath11k_pci *ab_pci, bool enable)
++{
++	struct pci_dev *dev = ab_pci->pdev;
++	u16 control;
++
++	pci_read_config_word(dev, dev->msi_cap + PCI_MSI_FLAGS, &control);
++
++	if (enable)
++		control |= PCI_MSI_FLAGS_ENABLE;
++	else
++		control &= ~PCI_MSI_FLAGS_ENABLE;
++
++	pci_write_config_word(dev, dev->msi_cap + PCI_MSI_FLAGS, control);
++}
++
++static void ath11k_pci_msi_enable(struct ath11k_pci *ab_pci)
++{
++	ath11k_pci_msi_config(ab_pci, true);
++}
++
++static void ath11k_pci_msi_disable(struct ath11k_pci *ab_pci)
++{
++	ath11k_pci_msi_config(ab_pci, false);
++}
++
++static int ath11k_pci_alloc_msi(struct ath11k_pci *ab_pci)
+ {
+ 	struct ath11k_base *ab = ab_pci->ab;
+ 	const struct ath11k_msi_config *msi_config = ab_pci->msi_config;
+@@ -882,6 +907,7 @@ static int ath11k_pci_enable_msi(struct
+ 		else
+ 			return num_vectors;
+ 	}
++	ath11k_pci_msi_disable(ab_pci);
+ 
+ 	msi_desc = irq_get_msi_desc(ab_pci->pdev->irq);
+ 	if (!msi_desc) {
+@@ -904,7 +930,7 @@ free_msi_vector:
+ 	return ret;
+ }
+ 
+-static void ath11k_pci_disable_msi(struct ath11k_pci *ab_pci)
++static void ath11k_pci_free_msi(struct ath11k_pci *ab_pci)
+ {
+ 	pci_free_irq_vectors(ab_pci->pdev);
+ }
+@@ -1025,6 +1051,8 @@ static int ath11k_pci_power_up(struct at
+ 	 */
+ 	ath11k_pci_aspm_disable(ab_pci);
+ 
++	ath11k_pci_msi_enable(ab_pci);
++
+ 	ret = ath11k_mhi_start(ab_pci);
+ 	if (ret) {
+ 		ath11k_err(ab, "failed to start mhi: %d\n", ret);
+@@ -1045,6 +1073,9 @@ static void ath11k_pci_power_down(struct
+ 	ath11k_pci_aspm_restore(ab_pci);
+ 
+ 	ath11k_pci_force_wake(ab_pci->ab);
++
++	ath11k_pci_msi_disable(ab_pci);
++
+ 	ath11k_mhi_stop(ab_pci);
+ 	clear_bit(ATH11K_PCI_FLAG_INIT_DONE, &ab_pci->flags);
+ 	ath11k_pci_sw_reset(ab_pci->ab, false);
+@@ -1279,7 +1310,7 @@ static int ath11k_pci_probe(struct pci_d
+ 		goto err_pci_free_region;
+ 	}
+ 
+-	ret = ath11k_pci_enable_msi(ab_pci);
++	ret = ath11k_pci_alloc_msi(ab_pci);
+ 	if (ret) {
+ 		ath11k_err(ab, "failed to enable msi: %d\n", ret);
+ 		goto err_pci_free_region;
+@@ -1333,7 +1364,7 @@ err_mhi_unregister:
+ 	ath11k_mhi_unregister(ab_pci);
+ 
+ err_pci_disable_msi:
+-	ath11k_pci_disable_msi(ab_pci);
++	ath11k_pci_free_msi(ab_pci);
+ 
+ err_pci_free_region:
+ 	ath11k_pci_free_region(ab_pci);
+@@ -1364,7 +1395,7 @@ qmi_fail:
+ 	ath11k_mhi_unregister(ab_pci);
+ 
+ 	ath11k_pci_free_irq(ab);
+-	ath11k_pci_disable_msi(ab_pci);
++	ath11k_pci_free_msi(ab_pci);
+ 	ath11k_pci_free_region(ab_pci);
+ 
+ 	ath11k_hal_srng_deinit(ab);

package/kernel/mac80211/patches/ath11k/0059-ath11k-Change-number-of-TCL-rings-to-one-for-QCA6390.patch

@@ -0,0 +1,241 @@
+From 31582373a4a8e888b29ed759d28330a1995f2162 Mon Sep 17 00:00:00 2001
+From: Baochen Qiang <bqiang@codeaurora.org>
+Date: Mon, 11 Oct 2021 09:33:09 +0300
+Subject: [PATCH] ath11k: Change number of TCL rings to one for QCA6390
+
+Some targets, QCA6390 for example, use only one TCL ring, it is better to
+initialize only one ring and leave others untouched for such targets.
+
+This is a theoretical fix found during code review, no visible impact.
+
+Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1
+
+Signed-off-by: Baochen Qiang <bqiang@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210914163726.38604-1-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/core.c    | 10 +++++-----
+ drivers/net/wireless/ath/ath11k/debugfs.c |  2 +-
+ drivers/net/wireless/ath/ath11k/dp.c      | 10 +++++-----
+ drivers/net/wireless/ath/ath11k/dp.h      |  1 +
+ drivers/net/wireless/ath/ath11k/dp_tx.c   | 13 +++++--------
+ drivers/net/wireless/ath/ath11k/hw.h      |  2 +-
+ drivers/net/wireless/ath/ath11k/mac.c     |  2 +-
+ 7 files changed, 19 insertions(+), 21 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -58,7 +58,6 @@ static const struct ath11k_hw_params ath
+ 		.rx_mac_buf_ring = false,
+ 		.vdev_start_delay = false,
+ 		.htt_peer_map_v2 = true,
+-		.tcl_0_only = false,
+ 
+ 		.spectral = {
+ 			.fft_sz = 2,
+@@ -81,6 +80,7 @@ static const struct ath11k_hw_params ath
+ 		.supports_suspend = false,
+ 		.hal_desc_sz = sizeof(struct hal_rx_desc_ipq8074),
+ 		.fix_l1ss = true,
++		.max_tx_ring = DP_TCL_NUM_RING_MAX,
+ 	},
+ 	{
+ 		.hw_rev = ATH11K_HW_IPQ6018_HW10,
+@@ -109,7 +109,6 @@ static const struct ath11k_hw_params ath
+ 		.rx_mac_buf_ring = false,
+ 		.vdev_start_delay = false,
+ 		.htt_peer_map_v2 = true,
+-		.tcl_0_only = false,
+ 
+ 		.spectral = {
+ 			.fft_sz = 4,
+@@ -129,6 +128,7 @@ static const struct ath11k_hw_params ath
+ 		.supports_suspend = false,
+ 		.hal_desc_sz = sizeof(struct hal_rx_desc_ipq8074),
+ 		.fix_l1ss = true,
++		.max_tx_ring = DP_TCL_NUM_RING_MAX,
+ 	},
+ 	{
+ 		.name = "qca6390 hw2.0",
+@@ -157,7 +157,6 @@ static const struct ath11k_hw_params ath
+ 		.rx_mac_buf_ring = true,
+ 		.vdev_start_delay = true,
+ 		.htt_peer_map_v2 = false,
+-		.tcl_0_only = true,
+ 
+ 		.spectral = {
+ 			.fft_sz = 0,
+@@ -176,6 +175,7 @@ static const struct ath11k_hw_params ath
+ 		.supports_suspend = true,
+ 		.hal_desc_sz = sizeof(struct hal_rx_desc_ipq8074),
+ 		.fix_l1ss = true,
++		.max_tx_ring = DP_TCL_NUM_RING_MAX_QCA6390,
+ 	},
+ 	{
+ 		.name = "qcn9074 hw1.0",
+@@ -203,7 +203,6 @@ static const struct ath11k_hw_params ath
+ 		.rx_mac_buf_ring = false,
+ 		.vdev_start_delay = false,
+ 		.htt_peer_map_v2 = true,
+-		.tcl_0_only = false,
+ 
+ 		.spectral = {
+ 			.fft_sz = 2,
+@@ -223,6 +222,7 @@ static const struct ath11k_hw_params ath
+ 		.supports_suspend = false,
+ 		.hal_desc_sz = sizeof(struct hal_rx_desc_qcn9074),
+ 		.fix_l1ss = true,
++		.max_tx_ring = DP_TCL_NUM_RING_MAX,
+ 	},
+ 	{
+ 		.name = "wcn6855 hw2.0",
+@@ -251,7 +251,6 @@ static const struct ath11k_hw_params ath
+ 		.rx_mac_buf_ring = true,
+ 		.vdev_start_delay = true,
+ 		.htt_peer_map_v2 = false,
+-		.tcl_0_only = true,
+ 
+ 		.spectral = {
+ 			.fft_sz = 0,
+@@ -270,6 +269,7 @@ static const struct ath11k_hw_params ath
+ 		.supports_suspend = true,
+ 		.hal_desc_sz = sizeof(struct hal_rx_desc_wcn6855),
+ 		.fix_l1ss = false,
++		.max_tx_ring = DP_TCL_NUM_RING_MAX_QCA6390,
+ 	},
+ };
+ 
+--- a/drivers/net/wireless/ath/ath11k/debugfs.c
++++ b/drivers/net/wireless/ath/ath11k/debugfs.c
+@@ -806,7 +806,7 @@ static ssize_t ath11k_debugfs_dump_soc_d
+ 	len += scnprintf(buf + len, size - len, "\nSOC TX STATS:\n");
+ 	len += scnprintf(buf + len, size - len, "\nTCL Ring Full Failures:\n");
+ 
+-	for (i = 0; i < DP_TCL_NUM_RING_MAX; i++)
++	for (i = 0; i < ab->hw_params.max_tx_ring; i++)
+ 		len += scnprintf(buf + len, size - len, "ring%d: %u\n",
+ 				 i, soc_stats->tx_err.desc_na[i]);
+ 
+--- a/drivers/net/wireless/ath/ath11k/dp.c
++++ b/drivers/net/wireless/ath/ath11k/dp.c
+@@ -311,7 +311,7 @@ void ath11k_dp_stop_shadow_timers(struct
+ 	if (!ab->hw_params.supports_shadow_regs)
+ 		return;
+ 
+-	for (i = 0; i < DP_TCL_NUM_RING_MAX; i++)
++	for (i = 0; i < ab->hw_params.max_tx_ring; i++)
+ 		ath11k_dp_shadow_stop_timer(ab, &ab->dp.tx_ring_timer[i]);
+ 
+ 	ath11k_dp_shadow_stop_timer(ab, &ab->dp.reo_cmd_timer);
+@@ -326,7 +326,7 @@ static void ath11k_dp_srng_common_cleanu
+ 	ath11k_dp_srng_cleanup(ab, &dp->wbm_desc_rel_ring);
+ 	ath11k_dp_srng_cleanup(ab, &dp->tcl_cmd_ring);
+ 	ath11k_dp_srng_cleanup(ab, &dp->tcl_status_ring);
+-	for (i = 0; i < DP_TCL_NUM_RING_MAX; i++) {
++	for (i = 0; i < ab->hw_params.max_tx_ring; i++) {
+ 		ath11k_dp_srng_cleanup(ab, &dp->tx_ring[i].tcl_data_ring);
+ 		ath11k_dp_srng_cleanup(ab, &dp->tx_ring[i].tcl_comp_ring);
+ 	}
+@@ -366,7 +366,7 @@ static int ath11k_dp_srng_common_setup(s
+ 		goto err;
+ 	}
+ 
+-	for (i = 0; i < DP_TCL_NUM_RING_MAX; i++) {
++	for (i = 0; i < ab->hw_params.max_tx_ring; i++) {
+ 		ret = ath11k_dp_srng_setup(ab, &dp->tx_ring[i].tcl_data_ring,
+ 					   HAL_TCL_DATA, i, 0,
+ 					   DP_TCL_DATA_RING_SIZE);
+@@ -996,7 +996,7 @@ void ath11k_dp_free(struct ath11k_base *
+ 
+ 	ath11k_dp_reo_cmd_list_cleanup(ab);
+ 
+-	for (i = 0; i < DP_TCL_NUM_RING_MAX; i++) {
++	for (i = 0; i < ab->hw_params.max_tx_ring; i++) {
+ 		spin_lock_bh(&dp->tx_ring[i].tx_idr_lock);
+ 		idr_for_each(&dp->tx_ring[i].txbuf_idr,
+ 			     ath11k_dp_tx_pending_cleanup, ab);
+@@ -1046,7 +1046,7 @@ int ath11k_dp_alloc(struct ath11k_base *
+ 
+ 	size = sizeof(struct hal_wbm_release_ring) * DP_TX_COMP_RING_SIZE;
+ 
+-	for (i = 0; i < DP_TCL_NUM_RING_MAX; i++) {
++	for (i = 0; i < ab->hw_params.max_tx_ring; i++) {
+ 		idr_init(&dp->tx_ring[i].txbuf_idr);
+ 		spin_lock_init(&dp->tx_ring[i].tx_idr_lock);
+ 		dp->tx_ring[i].tcl_data_ring_id = i;
+--- a/drivers/net/wireless/ath/ath11k/dp.h
++++ b/drivers/net/wireless/ath/ath11k/dp.h
+@@ -170,6 +170,7 @@ struct ath11k_pdev_dp {
+ #define DP_BA_WIN_SZ_MAX	256
+ 
+ #define DP_TCL_NUM_RING_MAX	3
++#define DP_TCL_NUM_RING_MAX_QCA6390	1
+ 
+ #define DP_IDLE_SCATTER_BUFS_MAX 16
+ 
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -115,11 +115,8 @@ int ath11k_dp_tx(struct ath11k *ar, stru
+ 
+ tcl_ring_sel:
+ 	tcl_ring_retry = false;
+-	/* For some chip, it can only use tcl0 to tx */
+-	if (ar->ab->hw_params.tcl_0_only)
+-		ti.ring_id = 0;
+-	else
+-		ti.ring_id = ring_selector % DP_TCL_NUM_RING_MAX;
++
++	ti.ring_id = ring_selector % ab->hw_params.max_tx_ring;
+ 
+ 	ring_map |= BIT(ti.ring_id);
+ 
+@@ -131,7 +128,7 @@ tcl_ring_sel:
+ 	spin_unlock_bh(&tx_ring->tx_idr_lock);
+ 
+ 	if (ret < 0) {
+-		if (ring_map == (BIT(DP_TCL_NUM_RING_MAX) - 1)) {
++		if (ring_map == (BIT(ab->hw_params.max_tx_ring) - 1)) {
+ 			atomic_inc(&ab->soc_stats.tx_err.misc_fail);
+ 			return -ENOSPC;
+ 		}
+@@ -248,8 +245,8 @@ tcl_ring_sel:
+ 		 * checking this ring earlier for each pkt tx.
+ 		 * Restart ring selection if some rings are not checked yet.
+ 		 */
+-		if (ring_map != (BIT(DP_TCL_NUM_RING_MAX) - 1) &&
+-		    !ar->ab->hw_params.tcl_0_only) {
++		if (ring_map != (BIT(ab->hw_params.max_tx_ring) - 1) &&
++		    ab->hw_params.max_tx_ring > 1) {
+ 			tcl_ring_retry = true;
+ 			ring_selector++;
+ 		}
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -152,7 +152,6 @@ struct ath11k_hw_params {
+ 	bool rx_mac_buf_ring;
+ 	bool vdev_start_delay;
+ 	bool htt_peer_map_v2;
+-	bool tcl_0_only;
+ 
+ 	struct {
+ 		u8 fft_sz;
+@@ -170,6 +169,7 @@ struct ath11k_hw_params {
+ 	bool supports_suspend;
+ 	u32 hal_desc_sz;
+ 	bool fix_l1ss;
++	u8 max_tx_ring;
+ };
+ 
+ struct ath11k_hw_ops {
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -5807,7 +5807,7 @@ err_vdev_del:
+ 	idr_for_each(&ar->txmgmt_idr,
+ 		     ath11k_mac_vif_txmgmt_idr_remove, vif);
+ 
+-	for (i = 0; i < DP_TCL_NUM_RING_MAX; i++) {
++	for (i = 0; i < ab->hw_params.max_tx_ring; i++) {
+ 		spin_lock_bh(&ab->dp.tx_ring[i].tx_idr_lock);
+ 		idr_for_each(&ab->dp.tx_ring[i].txbuf_idr,
+ 			     ath11k_mac_vif_unref, vif);

package/kernel/mac80211/patches/ath11k/0060-ath11k-Identify-DFS-channel-when-sending-scan-channe.patch

@@ -0,0 +1,33 @@
+From 8cd5c0847160aa9482d7f93ed63c4d72bad70cdf Mon Sep 17 00:00:00 2001
+From: Baochen Qiang <bqiang@codeaurora.org>
+Date: Mon, 11 Oct 2021 18:18:00 +0300
+Subject: [PATCH] ath11k: Identify DFS channel when sending scan channel list
+ command
+
+WMI_CHAN_INFO_DFS flag should be set when configuring a DFS channel
+included in scan channel list. Without it, firmware will not send a
+probe request frame which is needed in connection to an AP configured
+with hidden SSID/network_id. So fix this to allow probe request frames
+to be sent in cases where a beacon frame has been seen on the channel
+first.
+
+Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
+
+Signed-off-by: Baochen Qiang <bqiang@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20211011054919.77071-1-bqiang@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/wmi.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -2372,6 +2372,8 @@ int ath11k_wmi_send_scan_chan_list_cmd(s
+ 				chan_info->info |= WMI_CHAN_INFO_QUARTER_RATE;
+ 			if (tchan_info->psc_channel)
+ 				chan_info->info |= WMI_CHAN_INFO_PSC;
++			if (tchan_info->dfs_set)
++				chan_info->info |= WMI_CHAN_INFO_DFS;
+ 
+ 			chan_info->info |= FIELD_PREP(WMI_CHAN_INFO_MODE,
+ 						      tchan_info->phy_mode);

package/kernel/mac80211/patches/ath11k/0061-ath11k-change-return-buffer-manager-for-QCA6390.patch

@@ -0,0 +1,299 @@
+From 734223d78428de3c7c7d7bc04daf258085780d90 Mon Sep 17 00:00:00 2001
+From: Baochen Qiang <bqiang@codeaurora.org>
+Date: Wed, 20 Oct 2021 11:59:06 +0300
+Subject: [PATCH] ath11k: change return buffer manager for QCA6390
+
+QCA6390 firmware uses HAL_RX_BUF_RBM_SW1_BM, not HAL_RX_BUF_RBM_SW3_BM. This is
+needed to fix a case where an A-MSDU has an unexpected LLC/SNAP header in the
+first subframe (CVE-2020-24588).
+
+Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1
+
+Signed-off-by: Baochen Qiang <bqiang@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210914163726.38604-2-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/core.c   |  5 ++++
+ drivers/net/wireless/ath/ath11k/dp.c     |  4 +++-
+ drivers/net/wireless/ath/ath11k/dp_rx.c  | 29 +++++++++++++++---------
+ drivers/net/wireless/ath/ath11k/hal_rx.c |  6 +++--
+ drivers/net/wireless/ath/ath11k/hw.c     | 11 ++++++++-
+ drivers/net/wireless/ath/ath11k/hw.h     |  9 ++++++++
+ 6 files changed, 49 insertions(+), 15 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -81,6 +81,7 @@ static const struct ath11k_hw_params ath
+ 		.hal_desc_sz = sizeof(struct hal_rx_desc_ipq8074),
+ 		.fix_l1ss = true,
+ 		.max_tx_ring = DP_TCL_NUM_RING_MAX,
++		.hal_params = &ath11k_hw_hal_params_ipq8074,
+ 	},
+ 	{
+ 		.hw_rev = ATH11K_HW_IPQ6018_HW10,
+@@ -129,6 +130,7 @@ static const struct ath11k_hw_params ath
+ 		.hal_desc_sz = sizeof(struct hal_rx_desc_ipq8074),
+ 		.fix_l1ss = true,
+ 		.max_tx_ring = DP_TCL_NUM_RING_MAX,
++		.hal_params = &ath11k_hw_hal_params_ipq8074,
+ 	},
+ 	{
+ 		.name = "qca6390 hw2.0",
+@@ -176,6 +178,7 @@ static const struct ath11k_hw_params ath
+ 		.hal_desc_sz = sizeof(struct hal_rx_desc_ipq8074),
+ 		.fix_l1ss = true,
+ 		.max_tx_ring = DP_TCL_NUM_RING_MAX_QCA6390,
++		.hal_params = &ath11k_hw_hal_params_qca6390,
+ 	},
+ 	{
+ 		.name = "qcn9074 hw1.0",
+@@ -223,6 +226,7 @@ static const struct ath11k_hw_params ath
+ 		.hal_desc_sz = sizeof(struct hal_rx_desc_qcn9074),
+ 		.fix_l1ss = true,
+ 		.max_tx_ring = DP_TCL_NUM_RING_MAX,
++		.hal_params = &ath11k_hw_hal_params_ipq8074,
+ 	},
+ 	{
+ 		.name = "wcn6855 hw2.0",
+@@ -270,6 +274,7 @@ static const struct ath11k_hw_params ath
+ 		.hal_desc_sz = sizeof(struct hal_rx_desc_wcn6855),
+ 		.fix_l1ss = false,
+ 		.max_tx_ring = DP_TCL_NUM_RING_MAX_QCA6390,
++		.hal_params = &ath11k_hw_hal_params_qca6390,
+ 	},
+ };
+ 
+--- a/drivers/net/wireless/ath/ath11k/dp.c
++++ b/drivers/net/wireless/ath/ath11k/dp.c
+@@ -739,6 +739,7 @@ int ath11k_dp_service_srng(struct ath11k
+ 			   int budget)
+ {
+ 	struct napi_struct *napi = &irq_grp->napi;
++	const struct ath11k_hw_hal_params *hal_params;
+ 	int grp_id = irq_grp->grp_id;
+ 	int work_done = 0;
+ 	int i = 0, j;
+@@ -821,8 +822,9 @@ int ath11k_dp_service_srng(struct ath11k
+ 				struct ath11k_pdev_dp *dp = &ar->dp;
+ 				struct dp_rxdma_ring *rx_ring = &dp->rx_refill_buf_ring;
+ 
++				hal_params = ab->hw_params.hal_params;
+ 				ath11k_dp_rxbufs_replenish(ab, id, rx_ring, 0,
+-							   HAL_RX_BUF_RBM_SW3_BM);
++							   hal_params->rx_buf_rbm);
+ 			}
+ 		}
+ 	}
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -499,7 +499,7 @@ static int ath11k_dp_rxdma_ring_buf_setu
+ 
+ 	rx_ring->bufs_max = num_entries;
+ 	ath11k_dp_rxbufs_replenish(ar->ab, dp->mac_id, rx_ring, num_entries,
+-				   HAL_RX_BUF_RBM_SW3_BM);
++				   ar->ab->hw_params.hal_params->rx_buf_rbm);
+ 	return 0;
+ }
+ 
+@@ -2756,7 +2756,7 @@ try_again:
+ 		rx_ring = &ar->dp.rx_refill_buf_ring;
+ 
+ 		ath11k_dp_rxbufs_replenish(ab, i, rx_ring, num_buffs_reaped[i],
+-					   HAL_RX_BUF_RBM_SW3_BM);
++					   ab->hw_params.hal_params->rx_buf_rbm);
+ 	}
+ 
+ 	ath11k_dp_rx_process_received_packets(ab, napi, &msdu_list,
+@@ -2949,6 +2949,7 @@ static int ath11k_dp_rx_reap_mon_status_
+ 					     int *budget, struct sk_buff_head *skb_list)
+ {
+ 	struct ath11k *ar;
++	const struct ath11k_hw_hal_params *hal_params;
+ 	struct ath11k_pdev_dp *dp;
+ 	struct dp_rxdma_ring *rx_ring;
+ 	struct hal_srng *srng;
+@@ -3019,8 +3020,9 @@ move_next:
+ 							&buf_id);
+ 
+ 		if (!skb) {
++			hal_params = ab->hw_params.hal_params;
+ 			ath11k_hal_rx_buf_addr_info_set(rx_mon_status_desc, 0, 0,
+-							HAL_RX_BUF_RBM_SW3_BM);
++							hal_params->rx_buf_rbm);
+ 			num_buffs_reaped++;
+ 			break;
+ 		}
+@@ -3030,7 +3032,8 @@ move_next:
+ 			 FIELD_PREP(DP_RXDMA_BUF_COOKIE_BUF_ID, buf_id);
+ 
+ 		ath11k_hal_rx_buf_addr_info_set(rx_mon_status_desc, rxcb->paddr,
+-						cookie, HAL_RX_BUF_RBM_SW3_BM);
++						cookie,
++						ab->hw_params.hal_params->rx_buf_rbm);
+ 		ath11k_hal_srng_src_get_next_entry(ab, srng);
+ 		num_buffs_reaped++;
+ 	}
+@@ -3419,7 +3422,8 @@ static int ath11k_dp_rx_h_defrag_reo_rei
+ 	cookie = FIELD_PREP(DP_RXDMA_BUF_COOKIE_PDEV_ID, dp->mac_id) |
+ 		 FIELD_PREP(DP_RXDMA_BUF_COOKIE_BUF_ID, buf_id);
+ 
+-	ath11k_hal_rx_buf_addr_info_set(msdu0, paddr, cookie, HAL_RX_BUF_RBM_SW3_BM);
++	ath11k_hal_rx_buf_addr_info_set(msdu0, paddr, cookie,
++					ab->hw_params.hal_params->rx_buf_rbm);
+ 
+ 	/* Fill mpdu details into reo entrace ring */
+ 	srng = &ab->hal.srng_list[ab->dp.reo_reinject_ring.ring_id];
+@@ -3796,7 +3800,7 @@ int ath11k_dp_process_rx_err(struct ath1
+ 		ath11k_hal_rx_msdu_link_info_get(link_desc_va, &num_msdus, msdu_cookies,
+ 						 &rbm);
+ 		if (rbm != HAL_RX_BUF_RBM_WBM_IDLE_DESC_LIST &&
+-		    rbm != HAL_RX_BUF_RBM_SW3_BM) {
++		    rbm != ab->hw_params.hal_params->rx_buf_rbm) {
+ 			ab->soc_stats.invalid_rbm++;
+ 			ath11k_warn(ab, "invalid return buffer manager %d\n", rbm);
+ 			ath11k_dp_rx_link_desc_return(ab, desc,
+@@ -3852,7 +3856,7 @@ exit:
+ 		rx_ring = &ar->dp.rx_refill_buf_ring;
+ 
+ 		ath11k_dp_rxbufs_replenish(ab, i, rx_ring, n_bufs_reaped[i],
+-					   HAL_RX_BUF_RBM_SW3_BM);
++					   ab->hw_params.hal_params->rx_buf_rbm);
+ 	}
+ 
+ 	return tot_n_bufs_reaped;
+@@ -4148,7 +4152,7 @@ int ath11k_dp_rx_process_wbm_err(struct
+ 		rx_ring = &ar->dp.rx_refill_buf_ring;
+ 
+ 		ath11k_dp_rxbufs_replenish(ab, i, rx_ring, num_buffs_reaped[i],
+-					   HAL_RX_BUF_RBM_SW3_BM);
++					   ab->hw_params.hal_params->rx_buf_rbm);
+ 	}
+ 
+ 	rcu_read_lock();
+@@ -4257,7 +4261,7 @@ int ath11k_dp_process_rxdma_err(struct a
+ 
+ 	if (num_buf_freed)
+ 		ath11k_dp_rxbufs_replenish(ab, mac_id, rx_ring, num_buf_freed,
+-					   HAL_RX_BUF_RBM_SW3_BM);
++					   ab->hw_params.hal_params->rx_buf_rbm);
+ 
+ 	return budget - quota;
+ }
+@@ -4976,6 +4980,7 @@ static void ath11k_dp_rx_mon_dest_proces
+ {
+ 	struct ath11k_pdev_dp *dp = &ar->dp;
+ 	struct ath11k_mon_data *pmon = (struct ath11k_mon_data *)&dp->mon_data;
++	const struct ath11k_hw_hal_params *hal_params;
+ 	void *ring_entry;
+ 	void *mon_dst_srng;
+ 	u32 ppdu_id;
+@@ -5039,16 +5044,18 @@ static void ath11k_dp_rx_mon_dest_proces
+ 
+ 	if (rx_bufs_used) {
+ 		rx_mon_stats->dest_ppdu_done++;
++		hal_params = ar->ab->hw_params.hal_params;
++
+ 		if (ar->ab->hw_params.rxdma1_enable)
+ 			ath11k_dp_rxbufs_replenish(ar->ab, dp->mac_id,
+ 						   &dp->rxdma_mon_buf_ring,
+ 						   rx_bufs_used,
+-						   HAL_RX_BUF_RBM_SW3_BM);
++						   hal_params->rx_buf_rbm);
+ 		else
+ 			ath11k_dp_rxbufs_replenish(ar->ab, dp->mac_id,
+ 						   &dp->rx_refill_buf_ring,
+ 						   rx_bufs_used,
+-						   HAL_RX_BUF_RBM_SW3_BM);
++						   hal_params->rx_buf_rbm);
+ 	}
+ }
+ 
+--- a/drivers/net/wireless/ath/ath11k/hal_rx.c
++++ b/drivers/net/wireless/ath/ath11k/hal_rx.c
+@@ -356,6 +356,7 @@ int ath11k_hal_wbm_desc_parse_err(struct
+ 	struct hal_wbm_release_ring *wbm_desc = desc;
+ 	enum hal_wbm_rel_desc_type type;
+ 	enum hal_wbm_rel_src_module rel_src;
++	enum hal_rx_buf_return_buf_manager ret_buf_mgr;
+ 
+ 	type = FIELD_GET(HAL_WBM_RELEASE_INFO0_DESC_TYPE,
+ 			 wbm_desc->info0);
+@@ -371,8 +372,9 @@ int ath11k_hal_wbm_desc_parse_err(struct
+ 	    rel_src != HAL_WBM_REL_SRC_MODULE_REO)
+ 		return -EINVAL;
+ 
+-	if (FIELD_GET(BUFFER_ADDR_INFO1_RET_BUF_MGR,
+-		      wbm_desc->buf_addr_info.info1) != HAL_RX_BUF_RBM_SW3_BM) {
++	ret_buf_mgr = FIELD_GET(BUFFER_ADDR_INFO1_RET_BUF_MGR,
++				wbm_desc->buf_addr_info.info1);
++	if (ret_buf_mgr != ab->hw_params.hal_params->rx_buf_rbm) {
+ 		ab->soc_stats.invalid_rbm++;
+ 		return -EINVAL;
+ 	}
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -7,10 +7,11 @@
+ #include <linux/bitops.h>
+ #include <linux/bitfield.h>
+ 
+-#include "hw.h"
+ #include "core.h"
+ #include "ce.h"
+ #include "hif.h"
++#include "hal.h"
++#include "hw.h"
+ 
+ /* Map from pdev index to hw mac index */
+ static u8 ath11k_hw_ipq8074_mac_from_pdev_id(int pdev_idx)
+@@ -2122,3 +2123,11 @@ const struct ath11k_hw_regs wcn6855_regs
+ 	.pcie_qserdes_sysclk_en_sel = 0x01e0c0ac,
+ 	.pcie_pcs_osc_dtct_config_base = 0x01e0c628,
+ };
++
++const struct ath11k_hw_hal_params ath11k_hw_hal_params_ipq8074 = {
++	.rx_buf_rbm = HAL_RX_BUF_RBM_SW3_BM,
++};
++
++const struct ath11k_hw_hal_params ath11k_hw_hal_params_qca6390 = {
++	.rx_buf_rbm = HAL_RX_BUF_RBM_SW1_BM,
++};
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -6,6 +6,7 @@
+ #ifndef ATH11K_HW_H
+ #define ATH11K_HW_H
+ 
++#include "hal.h"
+ #include "wmi.h"
+ 
+ /* Target configuration defines */
+@@ -119,6 +120,10 @@ struct ath11k_hw_ring_mask {
+ 	u8 host2rxdma[ATH11K_EXT_IRQ_GRP_NUM_MAX];
+ };
+ 
++struct ath11k_hw_hal_params {
++	enum hal_rx_buf_return_buf_manager rx_buf_rbm;
++};
++
+ struct ath11k_hw_params {
+ 	const char *name;
+ 	u16 hw_rev;
+@@ -170,6 +175,7 @@ struct ath11k_hw_params {
+ 	u32 hal_desc_sz;
+ 	bool fix_l1ss;
+ 	u8 max_tx_ring;
++	const struct ath11k_hw_hal_params *hal_params;
+ };
+ 
+ struct ath11k_hw_ops {
+@@ -223,6 +229,9 @@ extern const struct ath11k_hw_ring_mask
+ extern const struct ath11k_hw_ring_mask ath11k_hw_ring_mask_qca6390;
+ extern const struct ath11k_hw_ring_mask ath11k_hw_ring_mask_qcn9074;
+ 
++extern const struct ath11k_hw_hal_params ath11k_hw_hal_params_ipq8074;
++extern const struct ath11k_hw_hal_params ath11k_hw_hal_params_qca6390;
++
+ static inline
+ int ath11k_hw_get_mac_from_pdev_id(struct ath11k_hw_params *hw,
+ 				   int pdev_idx)

package/kernel/mac80211/patches/ath11k/0062-ath11k-set-correct-NL80211_FEATURE_DYNAMIC_SMPS-for-.patch

@@ -0,0 +1,93 @@
+From 82c434c103408842a87404e873992b7698b6df2b Mon Sep 17 00:00:00 2001
+From: Wen Gong <wgong@codeaurora.org>
+Date: Thu, 28 Oct 2021 10:46:28 +0300
+Subject: [PATCH] ath11k: set correct NL80211_FEATURE_DYNAMIC_SMPS for WCN6855
+
+Commit 6f4d70308e5e ("ath11k: support SMPS configuration for 6 GHz") changed
+"if (ht_cap & WMI_HT_CAP_DYNAMIC_SMPS)" to "if (ht_cap &
+WMI_HT_CAP_DYNAMIC_SMPS || ar->supports_6ghz)" which means
+NL80211_FEATURE_DYNAMIC_SMPS is enabled for all chips which support 6 GHz.
+However, WCN6855 supports 6 GHz but it does not support feature
+NL80211_FEATURE_DYNAMIC_SMPS, and this can lead to MU-MIMO test failures for
+WCN6855.
+
+Disable NL80211_FEATURE_DYNAMIC_SMPS for WCN6855 since its ht_cap does not
+support WMI_HT_CAP_DYNAMIC_SMPS. Enable the feature only on QCN9074 as that's
+the only other device supporting 6 GHz band.
+
+Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
+
+Signed-off-by: Wen Gong <wgong@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210914163726.38604-3-jouni@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/core.c | 5 +++++
+ drivers/net/wireless/ath/ath11k/hw.h   | 1 +
+ drivers/net/wireless/ath/ath11k/mac.c  | 3 ++-
+ 3 files changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -82,6 +82,7 @@ static const struct ath11k_hw_params ath
+ 		.fix_l1ss = true,
+ 		.max_tx_ring = DP_TCL_NUM_RING_MAX,
+ 		.hal_params = &ath11k_hw_hal_params_ipq8074,
++		.supports_dynamic_smps_6ghz = false,
+ 	},
+ 	{
+ 		.hw_rev = ATH11K_HW_IPQ6018_HW10,
+@@ -131,6 +132,7 @@ static const struct ath11k_hw_params ath
+ 		.fix_l1ss = true,
+ 		.max_tx_ring = DP_TCL_NUM_RING_MAX,
+ 		.hal_params = &ath11k_hw_hal_params_ipq8074,
++		.supports_dynamic_smps_6ghz = false,
+ 	},
+ 	{
+ 		.name = "qca6390 hw2.0",
+@@ -179,6 +181,7 @@ static const struct ath11k_hw_params ath
+ 		.fix_l1ss = true,
+ 		.max_tx_ring = DP_TCL_NUM_RING_MAX_QCA6390,
+ 		.hal_params = &ath11k_hw_hal_params_qca6390,
++		.supports_dynamic_smps_6ghz = false,
+ 	},
+ 	{
+ 		.name = "qcn9074 hw1.0",
+@@ -227,6 +230,7 @@ static const struct ath11k_hw_params ath
+ 		.fix_l1ss = true,
+ 		.max_tx_ring = DP_TCL_NUM_RING_MAX,
+ 		.hal_params = &ath11k_hw_hal_params_ipq8074,
++		.supports_dynamic_smps_6ghz = true,
+ 	},
+ 	{
+ 		.name = "wcn6855 hw2.0",
+@@ -275,6 +279,7 @@ static const struct ath11k_hw_params ath
+ 		.fix_l1ss = false,
+ 		.max_tx_ring = DP_TCL_NUM_RING_MAX_QCA6390,
+ 		.hal_params = &ath11k_hw_hal_params_qca6390,
++		.supports_dynamic_smps_6ghz = false,
+ 	},
+ };
+ 
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -176,6 +176,7 @@ struct ath11k_hw_params {
+ 	bool fix_l1ss;
+ 	u8 max_tx_ring;
+ 	const struct ath11k_hw_hal_params *hal_params;
++	bool supports_dynamic_smps_6ghz;
+ };
+ 
+ struct ath11k_hw_ops {
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -7682,7 +7682,8 @@ static int __ath11k_mac_register(struct
+ 	 * for each band for a dual band capable radio. It will be tricky to
+ 	 * handle it when the ht capability different for each band.
+ 	 */
+-	if (ht_cap & WMI_HT_CAP_DYNAMIC_SMPS || ar->supports_6ghz)
++	if (ht_cap & WMI_HT_CAP_DYNAMIC_SMPS ||
++	    (ar->supports_6ghz && ab->hw_params.supports_dynamic_smps_6ghz))
+ 		ar->hw->wiphy->features |= NL80211_FEATURE_DYNAMIC_SMPS;
+ 
+ 	ar->hw->wiphy->max_scan_ssids = WLAN_SCAN_PARAMS_MAX_SSID;

package/kernel/mac80211/patches/ath11k/0063-ath11k-convert-ath11k_wmi_pdev_set_ps_mode-to-use-en.patch

@@ -0,0 +1,73 @@
+From af3d89649bb69bd5be273cf6c001cd19c2604ca2 Mon Sep 17 00:00:00 2001
+From: Kalle Valo <kvalo@codeaurora.org>
+Date: Mon, 8 Nov 2021 14:38:25 +0200
+Subject: [PATCH] ath11k: convert ath11k_wmi_pdev_set_ps_mode() to use enum
+ wmi_sta_ps_mode
+
+It's more descriptive to use the actual enum used by the firmware instead of a
+boolean so change ath11k_wmi_pdev_set_ps_mode() to use a boolean.
+
+Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1
+
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20211108123826.8463-1-kvalo@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 3 ++-
+ drivers/net/wireless/ath/ath11k/wmi.c | 7 ++++---
+ drivers/net/wireless/ath/ath11k/wmi.h | 3 ++-
+ 3 files changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -5648,7 +5648,8 @@ static int ath11k_mac_op_add_interface(s
+ 			goto err_peer_del;
+ 		}
+ 
+-		ret = ath11k_wmi_pdev_set_ps_mode(ar, arvif->vdev_id, false);
++		ret = ath11k_wmi_pdev_set_ps_mode(ar, arvif->vdev_id,
++						  WMI_STA_PS_MODE_DISABLED);
+ 		if (ret) {
+ 			ath11k_warn(ar->ab, "failed to disable vdev %d ps mode: %d\n",
+ 				    arvif->vdev_id, ret);
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -1244,7 +1244,8 @@ int ath11k_wmi_pdev_set_param(struct ath
+ 	return ret;
+ }
+ 
+-int ath11k_wmi_pdev_set_ps_mode(struct ath11k *ar, int vdev_id, u32 enable)
++int ath11k_wmi_pdev_set_ps_mode(struct ath11k *ar, int vdev_id,
++				enum wmi_sta_ps_mode psmode)
+ {
+ 	struct ath11k_pdev_wmi *wmi = ar->wmi;
+ 	struct wmi_pdev_set_ps_mode_cmd *cmd;
+@@ -1259,7 +1260,7 @@ int ath11k_wmi_pdev_set_ps_mode(struct a
+ 	cmd->tlv_header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_STA_POWERSAVE_MODE_CMD) |
+ 			  FIELD_PREP(WMI_TLV_LEN, sizeof(*cmd) - TLV_HDR_SIZE);
+ 	cmd->vdev_id = vdev_id;
+-	cmd->sta_ps_mode = enable;
++	cmd->sta_ps_mode = psmode;
+ 
+ 	ret = ath11k_wmi_cmd_send(wmi, skb, WMI_STA_POWERSAVE_MODE_CMDID);
+ 	if (ret) {
+@@ -1269,7 +1270,7 @@ int ath11k_wmi_pdev_set_ps_mode(struct a
+ 
+ 	ath11k_dbg(ar->ab, ATH11K_DBG_WMI,
+ 		   "WMI vdev set psmode %d vdev id %d\n",
+-		   enable, vdev_id);
++		   psmode, vdev_id);
+ 
+ 	return ret;
+ }
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -5351,7 +5351,8 @@ int ath11k_wmi_set_peer_param(struct ath
+ 			      u32 vdev_id, u32 param_id, u32 param_val);
+ int ath11k_wmi_pdev_set_param(struct ath11k *ar, u32 param_id,
+ 			      u32 param_value, u8 pdev_id);
+-int ath11k_wmi_pdev_set_ps_mode(struct ath11k *ar, int vdev_id, u32 enable);
++int ath11k_wmi_pdev_set_ps_mode(struct ath11k *ar, int vdev_id,
++				enum wmi_sta_ps_mode psmode);
+ int ath11k_wmi_wait_for_unified_ready(struct ath11k_base *ab);
+ int ath11k_wmi_cmd_init(struct ath11k_base *ab);
+ int ath11k_wmi_wait_for_service_ready(struct ath11k_base *ab);

package/kernel/mac80211/patches/ath11k/0064-ath11k-enable-802.11-power-save-mode-in-station-mode.patch

@@ -0,0 +1,192 @@
+From b2beffa7d9a67b59b085616a27f1d10b1e80784f Mon Sep 17 00:00:00 2001
+From: Carl Huang <cjhuang@codeaurora.org>
+Date: Mon, 8 Nov 2021 14:38:26 +0200
+Subject: [PATCH] ath11k: enable 802.11 power save mode in station mode
+
+To reduce power consumption enable 802.11 power save mode in station mode. This
+allows both radio and CPU to sleep more.
+
+Only enable the mode on QCA6390 and WCN6855, it's unknown how other hardware
+families support this feature.
+
+To test that power save mode is running run "iw dev wls1 set power_save off",
+check there is no NULL Data frame seen by a sniffer. And run "iw dev wls1 set power_save
+on" and check there is a NULL Data frame in sniffer.
+
+Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1
+
+Signed-off-by: Carl Huang <cjhuang@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20211108123826.8463-2-kvalo@codeaurora.org
+---
+ drivers/net/wireless/ath/ath11k/core.c |  5 ++
+ drivers/net/wireless/ath/ath11k/core.h |  1 +
+ drivers/net/wireless/ath/ath11k/hw.h   |  1 +
+ drivers/net/wireless/ath/ath11k/mac.c  | 87 ++++++++++++++++++++++++++
+ 4 files changed, 94 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -76,6 +76,7 @@ static const struct ath11k_hw_params ath
+ 		.supports_monitor = true,
+ 		.supports_shadow_regs = false,
+ 		.idle_ps = false,
++		.supports_sta_ps = false,
+ 		.cold_boot_calib = true,
+ 		.supports_suspend = false,
+ 		.hal_desc_sz = sizeof(struct hal_rx_desc_ipq8074),
+@@ -126,6 +127,7 @@ static const struct ath11k_hw_params ath
+ 		.supports_monitor = true,
+ 		.supports_shadow_regs = false,
+ 		.idle_ps = false,
++		.supports_sta_ps = false,
+ 		.cold_boot_calib = true,
+ 		.supports_suspend = false,
+ 		.hal_desc_sz = sizeof(struct hal_rx_desc_ipq8074),
+@@ -175,6 +177,7 @@ static const struct ath11k_hw_params ath
+ 		.supports_monitor = false,
+ 		.supports_shadow_regs = true,
+ 		.idle_ps = true,
++		.supports_sta_ps = true,
+ 		.cold_boot_calib = false,
+ 		.supports_suspend = true,
+ 		.hal_desc_sz = sizeof(struct hal_rx_desc_ipq8074),
+@@ -224,6 +227,7 @@ static const struct ath11k_hw_params ath
+ 		.supports_monitor = true,
+ 		.supports_shadow_regs = false,
+ 		.idle_ps = false,
++		.supports_sta_ps = false,
+ 		.cold_boot_calib = false,
+ 		.supports_suspend = false,
+ 		.hal_desc_sz = sizeof(struct hal_rx_desc_qcn9074),
+@@ -273,6 +277,7 @@ static const struct ath11k_hw_params ath
+ 		.supports_monitor = false,
+ 		.supports_shadow_regs = true,
+ 		.idle_ps = true,
++		.supports_sta_ps = true,
+ 		.cold_boot_calib = false,
+ 		.supports_suspend = true,
+ 		.hal_desc_sz = sizeof(struct hal_rx_desc_wcn6855),
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -246,6 +246,7 @@ struct ath11k_vif {
+ 	bool is_started;
+ 	bool is_up;
+ 	bool spectral_enabled;
++	bool ps;
+ 	u32 aid;
+ 	u8 bssid[ETH_ALEN];
+ 	struct cfg80211_bitrate_mask bitrate_mask;
+--- a/drivers/net/wireless/ath/ath11k/hw.h
++++ b/drivers/net/wireless/ath/ath11k/hw.h
+@@ -170,6 +170,7 @@ struct ath11k_hw_params {
+ 	bool supports_monitor;
+ 	bool supports_shadow_regs;
+ 	bool idle_ps;
++	bool supports_sta_ps;
+ 	bool cold_boot_calib;
+ 	bool supports_suspend;
+ 	u32 hal_desc_sz;
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -1050,6 +1050,83 @@ static int ath11k_mac_monitor_stop(struc
+ 	return 0;
+ }
+ 
++static int ath11k_mac_vif_setup_ps(struct ath11k_vif *arvif)
++{
++	struct ath11k *ar = arvif->ar;
++	struct ieee80211_vif *vif = arvif->vif;
++	struct ieee80211_conf *conf = &ar->hw->conf;
++	enum wmi_sta_powersave_param param;
++	enum wmi_sta_ps_mode psmode;
++	int ret;
++	int timeout;
++	bool enable_ps;
++
++	lockdep_assert_held(&arvif->ar->conf_mutex);
++
++	if (arvif->vif->type != NL80211_IFTYPE_STATION)
++		return 0;
++
++	enable_ps = arvif->ps;
++
++	if (!arvif->is_started) {
++		/* mac80211 can update vif powersave state while disconnected.
++		 * Firmware doesn't behave nicely and consumes more power than
++		 * necessary if PS is disabled on a non-started vdev. Hence
++		 * force-enable PS for non-running vdevs.
++		 */
++		psmode = WMI_STA_PS_MODE_ENABLED;
++	} else if (enable_ps) {
++		psmode = WMI_STA_PS_MODE_ENABLED;
++		param = WMI_STA_PS_PARAM_INACTIVITY_TIME;
++
++		timeout = conf->dynamic_ps_timeout;
++		if (timeout == 0) {
++			/* firmware doesn't like 0 */
++			timeout = ieee80211_tu_to_usec(vif->bss_conf.beacon_int) / 1000;
++		}
++
++		ret = ath11k_wmi_set_sta_ps_param(ar, arvif->vdev_id, param,
++						  timeout);
++		if (ret) {
++			ath11k_warn(ar->ab, "failed to set inactivity time for vdev %d: %i\n",
++				    arvif->vdev_id, ret);
++			return ret;
++		}
++	} else {
++		psmode = WMI_STA_PS_MODE_DISABLED;
++	}
++
++	ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "mac vdev %d psmode %s\n",
++		   arvif->vdev_id, psmode ? "enable" : "disable");
++
++	ret = ath11k_wmi_pdev_set_ps_mode(ar, arvif->vdev_id, psmode);
++	if (ret) {
++		ath11k_warn(ar->ab, "failed to set sta power save mode %d for vdev %d: %d\n",
++			    psmode, arvif->vdev_id, ret);
++		return ret;
++	}
++
++	return 0;
++}
++
++static int ath11k_mac_config_ps(struct ath11k *ar)
++{
++	struct ath11k_vif *arvif;
++	int ret = 0;
++
++	lockdep_assert_held(&ar->conf_mutex);
++
++	list_for_each_entry(arvif, &ar->arvifs, list) {
++		ret = ath11k_mac_vif_setup_ps(arvif);
++		if (ret) {
++			ath11k_warn(ar->ab, "failed to setup powersave: %d\n", ret);
++			break;
++		}
++	}
++
++	return ret;
++}
++
+ static int ath11k_mac_op_config(struct ieee80211_hw *hw, u32 changed)
+ {
+ 	struct ath11k *ar = hw->priv;
+@@ -2947,6 +3024,16 @@ static void ath11k_mac_op_bss_info_chang
+ 		ath11k_mac_txpower_recalc(ar);
+ 	}
+ 
++	if (changed & BSS_CHANGED_PS &&
++	    ar->ab->hw_params.supports_sta_ps) {
++		arvif->ps = vif->bss_conf.ps;
++
++		ret = ath11k_mac_config_ps(ar);
++		if (ret)
++			ath11k_warn(ar->ab, "failed to setup ps on vdev %i: %d\n",
++				    arvif->vdev_id, ret);
++	}
++
+ 	if (changed & BSS_CHANGED_MCAST_RATE &&
+ 	    !ath11k_mac_vif_chan(arvif->vif, &def)) {
+ 		band = def.chan->band;

package/kernel/mac80211/patches/ath11k/0066-ath11k-Clear-auth-flag-only-for-actual-association-i.patch

@@ -0,0 +1,72 @@
+From c802b6d7815d7c3f556efea28d0b79ef57ebcfd4 Mon Sep 17 00:00:00 2001
+From: Rameshkumar Sundaram <quic_ramess@quicinc.com>
+Date: Mon, 25 Oct 2021 21:33:06 +0530
+Subject: [PATCH] ath11k: Clear auth flag only for actual association in
+ security mode
+
+AUTH flag is needed when peer assoc command is sent from host in
+security mode for non-assoc cases. Firmware will handle AUTH flag
+when client is associating as AUTH flag will be set after key exchange.
+For internally provided peer assoc commands from host, there won't be
+any key exchange, so AUTH flag is expected to be set in host.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01838-QCAHKSWPL_SILICONZ-1
+
+Co-developed-by: Lavanya Suresh <lavaks@codeaurora.org>
+Signed-off-by: Lavanya Suresh <lavaks@codeaurora.org>
+Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/1635177786-20854-1-git-send-email-quic_ramess@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 3 +++
+ drivers/net/wireless/ath/ath11k/wmi.c | 2 +-
+ drivers/net/wireless/ath/ath11k/wmi.h | 1 +
+ 3 files changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -2500,6 +2500,7 @@ static void ath11k_bss_assoc(struct ieee
+ 
+ 	rcu_read_unlock();
+ 
++	peer_arg.is_assoc = true;
+ 	ret = ath11k_wmi_send_peer_assoc_cmd(ar, &peer_arg);
+ 	if (ret) {
+ 		ath11k_warn(ar->ab, "failed to run peer assoc for %pM vdev %i: %d\n",
+@@ -3778,6 +3779,7 @@ static int ath11k_station_assoc(struct a
+ 
+ 	ath11k_peer_assoc_prepare(ar, vif, sta, &peer_arg, reassoc);
+ 
++	peer_arg.is_assoc = true;
+ 	ret = ath11k_wmi_send_peer_assoc_cmd(ar, &peer_arg);
+ 	if (ret) {
+ 		ath11k_warn(ar->ab, "failed to run peer assoc for STA %pM vdev %i: %d\n",
+@@ -3989,6 +3991,7 @@ static void ath11k_sta_rc_update_wk(stru
+ 			ath11k_peer_assoc_prepare(ar, arvif->vif, sta,
+ 						  &peer_arg, true);
+ 
++			peer_arg.is_assoc = false;
+ 			err = ath11k_wmi_send_peer_assoc_cmd(ar, &peer_arg);
+ 			if (err)
+ 				ath11k_warn(ar->ab, "failed to run peer assoc for STA %pM vdev %i: %d\n",
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -1764,7 +1764,7 @@ ath11k_wmi_copy_peer_flags(struct wmi_pe
+ 		cmd->peer_flags |= WMI_PEER_AUTH;
+ 	if (param->need_ptk_4_way) {
+ 		cmd->peer_flags |= WMI_PEER_NEED_PTK_4_WAY;
+-		if (!hw_crypto_disabled)
++		if (!hw_crypto_disabled && param->is_assoc)
+ 			cmd->peer_flags &= ~WMI_PEER_AUTH;
+ 	}
+ 	if (param->need_gtk_2_way)
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -3617,6 +3617,7 @@ struct peer_assoc_params {
+ 	u32 peer_he_tx_mcs_set[WMI_HOST_MAX_HE_RATE_SET];
+ 	bool twt_responder;
+ 	bool twt_requester;
++	bool is_assoc;
+ 	struct ath11k_ppe_threshold peer_ppet;
+ };
+ 

package/kernel/mac80211/patches/ath11k/0067-ath11k-fix-fw-crash-due-to-peer-get-authorized-befor.patch

@@ -0,0 +1,114 @@
+From 85f36923be47b6990215ad444545a6a85133a0c6 Mon Sep 17 00:00:00 2001
+From: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
+Date: Fri, 12 Nov 2021 10:03:40 +0200
+Subject: [PATCH] ath11k: fix fw crash due to peer get authorized before key
+ install
+
+Firmware expects host to authorize the peer after the successful key
+install. But host authorize the peer before the key install, this trigger
+the firmware assert which leads to Q6 crash. To avoid this Q6 crash, host
+should authorize the peer after the key install. So introduce is_authorized
+in peer object to identify that peer is authorize or not. When
+IEEE80211_STA_CONTROL_PORT flag is unset, peer move to authorize state
+before the vdev up. When the same flag is set then peer move to authorize
+state after vdev up. So added authorise check in ath11k_bss_assoc() to
+handle the earlier state transition case. Also added the WMI authorize
+procedure in ath11k_mac_op_sta_state() to handle the non-earlier state
+transition case.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01492-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/1636554200-12345-1-git-send-email-quic_periyasa@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c  | 53 ++++++++++++++++++++++----
+ drivers/net/wireless/ath/ath11k/peer.h |  1 +
+ 2 files changed, 47 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -2479,6 +2479,8 @@ static void ath11k_bss_assoc(struct ieee
+ 	struct ath11k_vif *arvif = (void *)vif->drv_priv;
+ 	struct peer_assoc_params peer_arg;
+ 	struct ieee80211_sta *ap_sta;
++	struct ath11k_peer *peer;
++	bool is_auth = false;
+ 	int ret;
+ 
+ 	lockdep_assert_held(&ar->conf_mutex);
+@@ -2541,13 +2543,22 @@ static void ath11k_bss_assoc(struct ieee
+ 		   "mac vdev %d up (associated) bssid %pM aid %d\n",
+ 		   arvif->vdev_id, bss_conf->bssid, bss_conf->aid);
+ 
+-	/* Authorize BSS Peer */
+-	ret = ath11k_wmi_set_peer_param(ar, arvif->bssid,
+-					arvif->vdev_id,
+-					WMI_PEER_AUTHORIZE,
+-					1);
+-	if (ret)
+-		ath11k_warn(ar->ab, "Unable to authorize BSS peer: %d\n", ret);
++	spin_lock_bh(&ar->ab->base_lock);
++
++	peer = ath11k_peer_find(ar->ab, arvif->vdev_id, arvif->bssid);
++	if (peer && peer->is_authorized)
++		is_auth = true;
++
++	spin_unlock_bh(&ar->ab->base_lock);
++
++	if (is_auth) {
++		ret = ath11k_wmi_set_peer_param(ar, arvif->bssid,
++						arvif->vdev_id,
++						WMI_PEER_AUTHORIZE,
++						1);
++		if (ret)
++			ath11k_warn(ar->ab, "Unable to authorize BSS peer: %d\n", ret);
++	}
+ 
+ 	ret = ath11k_wmi_send_obss_spr_cmd(ar, arvif->vdev_id,
+ 					   &bss_conf->he_obss_pd);
+@@ -4227,6 +4238,34 @@ static int ath11k_mac_op_sta_state(struc
+ 			ath11k_warn(ar->ab, "Failed to associate station: %pM\n",
+ 				    sta->addr);
+ 	} else if (old_state == IEEE80211_STA_ASSOC &&
++		   new_state == IEEE80211_STA_AUTHORIZED) {
++		spin_lock_bh(&ar->ab->base_lock);
++
++		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
++		if (peer)
++			peer->is_authorized = true;
++
++		spin_unlock_bh(&ar->ab->base_lock);
++
++		if (vif->type == NL80211_IFTYPE_STATION && arvif->is_up) {
++			ret = ath11k_wmi_set_peer_param(ar, sta->addr,
++							arvif->vdev_id,
++							WMI_PEER_AUTHORIZE,
++							1);
++			if (ret)
++				ath11k_warn(ar->ab, "Unable to authorize peer %pM vdev %d: %d\n",
++					    sta->addr, arvif->vdev_id, ret);
++		}
++	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
++		   new_state == IEEE80211_STA_ASSOC) {
++		spin_lock_bh(&ar->ab->base_lock);
++
++		peer = ath11k_peer_find(ar->ab, arvif->vdev_id, sta->addr);
++		if (peer)
++			peer->is_authorized = false;
++
++		spin_unlock_bh(&ar->ab->base_lock);
++	} else if (old_state == IEEE80211_STA_ASSOC &&
+ 		   new_state == IEEE80211_STA_AUTH &&
+ 		   (vif->type == NL80211_IFTYPE_AP ||
+ 		    vif->type == NL80211_IFTYPE_MESH_POINT ||
+--- a/drivers/net/wireless/ath/ath11k/peer.h
++++ b/drivers/net/wireless/ath/ath11k/peer.h
+@@ -28,6 +28,7 @@ struct ath11k_peer {
+ 	u8 ucast_keyidx;
+ 	u16 sec_type;
+ 	u16 sec_type_grp;
++	bool is_authorized;
+ };
+ 
+ void ath11k_peer_unmap_event(struct ath11k_base *ab, u16 peer_id);

package/kernel/mac80211/patches/ath11k/0068-ath11k-fix-error-routine-when-fallback-of-add-interf.patch

@@ -0,0 +1,60 @@
+From 4ea03443ecdac6920eb7aa3a9da2cd0b8cc6dfc8 Mon Sep 17 00:00:00 2001
+From: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
+Date: Wed, 10 Nov 2021 21:05:57 +0530
+Subject: [PATCH] ath11k: fix error routine when fallback of add interface
+ fails
+
+When there is an error in add interface process from
+ath11k_mac_set_kickout(), the code attempts to handle a
+fallback for add_interface. When this fallback succeeds, the
+driver returns zero rather than error code. This leads to
+success for the non created VAP. In cleanup, driver gets
+remove interface callback for the non created VAP and
+proceeds to self peer delete request which leads to FW assert.
+Since it was already deleted on the fallback of add interface,
+return the actual error code instead of fallback return code.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-00729-QCAHKSWPL_SILICONZ-3 v2
+
+Signed-off-by: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/1636558557-2874-1-git-send-email-quic_periyasa@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -5623,7 +5623,7 @@ static int ath11k_mac_op_add_interface(s
+ 	u32 param_id, param_value;
+ 	u16 nss;
+ 	int i;
+-	int ret;
++	int ret, fbret;
+ 	int bit;
+ 
+ 	vif->driver_flags |= IEEE80211_VIF_SUPPORTS_UAPSD;
+@@ -5826,17 +5826,17 @@ err_peer_del:
+ 	if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
+ 		reinit_completion(&ar->peer_delete_done);
+ 
+-		ret = ath11k_wmi_send_peer_delete_cmd(ar, vif->addr,
+-						      arvif->vdev_id);
+-		if (ret) {
++		fbret = ath11k_wmi_send_peer_delete_cmd(ar, vif->addr,
++							arvif->vdev_id);
++		if (fbret) {
+ 			ath11k_warn(ar->ab, "failed to delete peer vdev_id %d addr %pM\n",
+ 				    arvif->vdev_id, vif->addr);
+ 			goto err;
+ 		}
+ 
+-		ret = ath11k_wait_for_peer_delete_done(ar, arvif->vdev_id,
+-						       vif->addr);
+-		if (ret)
++		fbret = ath11k_wait_for_peer_delete_done(ar, arvif->vdev_id,
++							 vif->addr);
++		if (fbret)
+ 			goto err;
+ 
+ 		ar->num_peers--;

package/kernel/mac80211/patches/ath11k/0069-ath11k-avoid-unnecessary-BH-disable-lock-in-STA-kick.patch

@@ -0,0 +1,57 @@
+From 4c375743c5fe1ef84d1dd7269dd12585957f403e Mon Sep 17 00:00:00 2001
+From: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
+Date: Wed, 10 Nov 2021 21:36:28 +0530
+Subject: [PATCH] ath11k: avoid unnecessary BH disable lock in STA kickout
+ event
+
+In STA kickout event processing, the peer object is protected
+under spin lock BH. Release this lock after picking up the vdev_id
+from the peer object instead after ieee80211_report_low_ack().
+This will minimize the lock hold period which will improve
+performance since base_lock is used across the data path.
+This was found in code review.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-00729-QCAHKSWPL_SILICONZ-3 v2
+
+Signed-off-by: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/1636560388-24955-1-git-send-email-quic_periyasa@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/wmi.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -6400,6 +6400,7 @@ static void ath11k_peer_sta_kickout_even
+ 	struct ieee80211_sta *sta;
+ 	struct ath11k_peer *peer;
+ 	struct ath11k *ar;
++	u32 vdev_id;
+ 
+ 	if (ath11k_pull_peer_sta_kickout_ev(ab, skb, &arg) != 0) {
+ 		ath11k_warn(ab, "failed to extract peer sta kickout event");
+@@ -6415,10 +6416,15 @@ static void ath11k_peer_sta_kickout_even
+ 	if (!peer) {
+ 		ath11k_warn(ab, "peer not found %pM\n",
+ 			    arg.mac_addr);
++		spin_unlock_bh(&ab->base_lock);
+ 		goto exit;
+ 	}
+ 
+-	ar = ath11k_mac_get_ar_by_vdev_id(ab, peer->vdev_id);
++	vdev_id = peer->vdev_id;
++
++	spin_unlock_bh(&ab->base_lock);
++
++	ar = ath11k_mac_get_ar_by_vdev_id(ab, vdev_id);
+ 	if (!ar) {
+ 		ath11k_warn(ab, "invalid vdev id in peer sta kickout ev %d",
+ 			    peer->vdev_id);
+@@ -6439,7 +6445,6 @@ static void ath11k_peer_sta_kickout_even
+ 	ieee80211_report_low_ack(sta, 10);
+ 
+ exit:
+-	spin_unlock_bh(&ab->base_lock);
+ 	rcu_read_unlock();
+ }
+ 

package/kernel/mac80211/patches/ath11k/0070-ath11k-fix-DMA-memory-free-in-CE-pipe-cleanup.patch

@@ -0,0 +1,74 @@
+From 31aeaf547d7e3b64ba5d5442dabc530bdb9e216e Mon Sep 17 00:00:00 2001
+From: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
+Date: Wed, 10 Nov 2021 21:51:30 +0530
+Subject: [PATCH] ath11k: fix DMA memory free in CE pipe cleanup
+
+In CE pipe cleanup, DMA memory gets freed by the aligned address
+(base_addr_owner_space) which is wrong. It needs to be freed
+by the address (base_addr_owner_space_unaligned) returned by
+dma_alloc. So free the dma memory by the proper address.
+This was found in code review.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-00729-QCAHKSWPL_SILICONZ-3 v2
+
+Signed-off-by: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/1636561290-18966-1-git-send-email-quic_periyasa@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/ce.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/ce.c
++++ b/drivers/net/wireless/ath/ath11k/ce.c
+@@ -953,6 +953,7 @@ int ath11k_ce_init_pipes(struct ath11k_b
+ void ath11k_ce_free_pipes(struct ath11k_base *ab)
+ {
+ 	struct ath11k_ce_pipe *pipe;
++	struct ath11k_ce_ring *ce_ring;
+ 	int desc_sz;
+ 	int i;
+ 
+@@ -964,22 +965,24 @@ void ath11k_ce_free_pipes(struct ath11k_
+ 
+ 		if (pipe->src_ring) {
+ 			desc_sz = ath11k_hal_ce_get_desc_size(HAL_CE_DESC_SRC);
++			ce_ring = pipe->src_ring;
+ 			dma_free_coherent(ab->dev,
+ 					  pipe->src_ring->nentries * desc_sz +
+ 					  CE_DESC_RING_ALIGN,
+-					  pipe->src_ring->base_addr_owner_space,
+-					  pipe->src_ring->base_addr_ce_space);
++					  ce_ring->base_addr_owner_space_unaligned,
++					  ce_ring->base_addr_ce_space_unaligned);
+ 			kfree(pipe->src_ring);
+ 			pipe->src_ring = NULL;
+ 		}
+ 
+ 		if (pipe->dest_ring) {
+ 			desc_sz = ath11k_hal_ce_get_desc_size(HAL_CE_DESC_DST);
++			ce_ring = pipe->dest_ring;
+ 			dma_free_coherent(ab->dev,
+ 					  pipe->dest_ring->nentries * desc_sz +
+ 					  CE_DESC_RING_ALIGN,
+-					  pipe->dest_ring->base_addr_owner_space,
+-					  pipe->dest_ring->base_addr_ce_space);
++					  ce_ring->base_addr_owner_space_unaligned,
++					  ce_ring->base_addr_ce_space_unaligned);
+ 			kfree(pipe->dest_ring);
+ 			pipe->dest_ring = NULL;
+ 		}
+@@ -987,11 +990,12 @@ void ath11k_ce_free_pipes(struct ath11k_
+ 		if (pipe->status_ring) {
+ 			desc_sz =
+ 			  ath11k_hal_ce_get_desc_size(HAL_CE_DESC_DST_STATUS);
++			ce_ring = pipe->status_ring;
+ 			dma_free_coherent(ab->dev,
+ 					  pipe->status_ring->nentries * desc_sz +
+ 					  CE_DESC_RING_ALIGN,
+-					  pipe->status_ring->base_addr_owner_space,
+-					  pipe->status_ring->base_addr_ce_space);
++					  ce_ring->base_addr_owner_space_unaligned,
++					  ce_ring->base_addr_ce_space_unaligned);
+ 			kfree(pipe->status_ring);
+ 			pipe->status_ring = NULL;
+ 		}

package/kernel/mac80211/patches/ath11k/0071-ath11k-Fix-unused-but-set-parameter-error.patch

@@ -0,0 +1,30 @@
+From 624e0a3170309eeb5b729f7a43c1ba3234325f02 Mon Sep 17 00:00:00 2001
+From: Seevalamuthu Mariappan <quic_seevalam@quicinc.com>
+Date: Thu, 11 Nov 2021 11:22:47 +0530
+Subject: [PATCH] ath11k: Fix 'unused-but-set-parameter' error
+
+Below compilation error is reported when built with W=1,
+
+drivers/net/wireless/ath/ath11k/mac.c:5408:22: error: parameter 'changed_flags' set but not used [-Werror,-Wunused-but-set-parameter]
+
+changed_flags is set, but left unused. So, remove unnecessary set.
+Compile tested only.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Seevalamuthu Mariappan <quic_seevalam@quicinc.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/1636609967-5114-1-git-send-email-quic_seevalam@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -5971,7 +5971,6 @@ static void ath11k_mac_op_configure_filt
+ 
+ 	mutex_lock(&ar->conf_mutex);
+ 
+-	changed_flags &= SUPPORTED_FILTERS;
+ 	*total_flags &= SUPPORTED_FILTERS;
+ 	ar->filter_flags = *total_flags;
+ 

package/kernel/mac80211/patches/ath11k/0072-ath11k-fix-firmware-crash-during-channel-switch.patch

@@ -0,0 +1,65 @@
+From f187fe8e3bc65cc4d7b0916947e2d6cd65d9cd3a Mon Sep 17 00:00:00 2001
+From: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
+Date: Thu, 11 Nov 2021 20:50:02 +0530
+Subject: [PATCH] ath11k: fix firmware crash during channel switch
+
+Currently the updated bandwidth for the peer will be configured
+to the firmware after channel switch from the sta_rc_update_wk.
+If the updated bandwidth is greater than the configured peer phymode
+during the peer assoc may result firmware assert.
+
+For example, initially AP is in HE40 mode and the peer phymode is
+configured as MODE_11AX_HE40 during peer assoc. Now user change the
+channel width to HE80 then, the peer bandwidth will be updated as
+HE80 to the firmware.
+
+This will trigger firmware assert due to peer bandwidth is greater than
+the peer phymode.
+
+Fix this issue by sending peer assoc command before setting the updated
+peer bandwith to firmware.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/1636644002-25446-1-git-send-email-quic_vnaralas@quicinc.com
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 26 +++++++++++++++++++++-----
+ 1 file changed, 21 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -3930,11 +3930,27 @@ static void ath11k_sta_rc_update_wk(stru
+ 			   ath11k_mac_max_he_nss(he_mcs_mask)));
+ 
+ 	if (changed & IEEE80211_RC_BW_CHANGED) {
+-		err = ath11k_wmi_set_peer_param(ar, sta->addr, arvif->vdev_id,
+-						WMI_PEER_CHWIDTH, bw);
+-		if (err)
+-			ath11k_warn(ar->ab, "failed to update STA %pM peer bw %d: %d\n",
+-				    sta->addr, bw, err);
++		/* Send peer assoc command before set peer bandwidth param to
++		 * avoid the mismatch between the peer phymode and the peer
++		 * bandwidth.
++		 */
++		ath11k_peer_assoc_prepare(ar, arvif->vif, sta, &peer_arg, true);
++
++		peer_arg.is_assoc = false;
++		err = ath11k_wmi_send_peer_assoc_cmd(ar, &peer_arg);
++		if (err) {
++			ath11k_warn(ar->ab, "failed to send peer assoc for STA %pM vdev %i: %d\n",
++				    sta->addr, arvif->vdev_id, err);
++		} else if (wait_for_completion_timeout(&ar->peer_assoc_done, 1 * HZ)) {
++			err = ath11k_wmi_set_peer_param(ar, sta->addr, arvif->vdev_id,
++							WMI_PEER_CHWIDTH, bw);
++			if (err)
++				ath11k_warn(ar->ab, "failed to update STA %pM peer bw %d: %d\n",
++					    sta->addr, bw, err);
++		} else {
++			ath11k_warn(ar->ab, "failed to get peer assoc conf event for %pM vdev %i\n",
++				    sta->addr, arvif->vdev_id);
++		}
+ 	}
+ 
+ 	if (changed & IEEE80211_RC_NSS_CHANGED) {