Upload new v5.6.4 driver

2025-11-14 22:18:20 +03:00 · 2019-05-24 21:43:57 +02:00
parent b41fa340f4
commit 6c1b4a333b
575 changed files with 126775 additions and 210911 deletions
--- a/6
+++ b/6
@@ -1,6 +1,6 @@
-config RTL8821AU
-	tristate "Realtek 8821A USB WiFi"
+config RTL8812AU
+	tristate "Realtek 8812A USB WiFi"
 	depends on USB
 	---help---
-	  Help message of RTL8821AU
+	  Help message of RTL8812AU

--- a/911
+++ b/911
--- a/README.md
+++ b/README.md
@@ -44,7 +44,7 @@ make install
 ### Notes
 Download
 ```
-git clone -b v5.3.4 https://github.com/aircrack-ng/rtl8812au.git
+git clone -b v5.6.4 https://github.com/aircrack-ng/rtl8812au.git
 cd rtl*
 ```
 Package / Build dependencies (Kali)
--- a/REALTEK_README.txt
+++ b/REALTEK_README.txt
@@ -0,0 +1,248 @@
+===============================================================================
+		Software Package - Component
+===============================================================================
+	1. ReleaseNotes.pdf
+
+	2. document/
+		2.1 Quick_Start_Guide_for_Driver_Compilation_and_Installation.pdf
+		2.2 Quick_Start_Guide_for_Station_Mode.pdf
+		2.3 Quick_Start_Guide_for_SoftAP.pdf
+		2.4 Quick_Start_Guide_for_Bridge.pdf
+		2.5 Quick_Start_Guide_for_WOW.pdf
+		2.6 Quick_Start_Guide_for_Adaptivity_and_Carrier_Sensing_Test.pdf
+		2.7 HowTo_support_more_VidPids.pdf
+		2.8 HowTo_support_WIFI_certification_test.pdf
+		2.9 HowTo_enable_the_power_saving_functionality.pdf
+		2.10 HowTo_enable_driver_to_support_80211d.pdf
+		2.11 HowTo_enable_and_verify_TDLS_function_in_Wi-Fi_driver.pdf
+		2.12 How_to_set_driver_debug_log_level.pdf
+		2.13 How_to_append_vendor_specific_ie_to_driver_management_frames.pdf
+		2.14 wpa_cli_with_wpa_supplicant.pdf
+		2.15 Wireless_tools_porting_guide.pdf
+		2.16 SoftAP_Mode_features.pdf
+		2.17 linux_dhcp_server_notes.txt
+		2.18 RTK_P2P_WFD_Programming_guide.pdf
+		2.19 Realtek_WiFi_concurrent_mode_Introduction.pdf
+		2.20 Miracast_for_Realtek_WiFi.pdf
+		2.21 Driver_Configuration_for_RF_Regulatory_Certification.pdf
+
+	3. driver/
+		3.1 rtl8812AU_linux_v5.6.4_33522.20190509.tar.gz
+			Naming rule: rtlCHIPS_linux_vM.N.P[.H]_sssss.yyyymmdd[_COEX_VER][_beta].tar.gz
+			where:
+				CHIPS: supported chips
+				M: Major version
+				N: miNor version
+				P: Patch number
+				H: Hotfix number
+				s: SVN number
+				y: package year
+				m: package month
+				d: package day
+				COEX_VER: Coext version
+				_beta: beta driver
+
+	4. wpa_supplicant_hostapd/
+		4.1 wpa_supplicant_hostapd-0.8_rtw_r24647.20171025.tar.gz
+			4.1.1 wpa_supplicant
+				The tool help the wlan network to communicate under the
+				protection of WPAPSK mechanism (WPA/WPA2) and add WPS patch
+			4.1.2 hostapd
+		4.2 wpa_0_8.conf
+			 Configure file sample for wpa_supplicant-0.8
+		4.3 rtl_hostapd_2G.conf
+		4.4 rtl_hostapd_5G.conf
+			 Configure files for Soft-AP mode 2.4G/5G
+		4.5 p2p_hostapd.conf
+			 Configure file for hostapd for Wi-Fi Direct (P2P)
+
+		4.6 wpa_supplicant_8_jb_4.2_rtw_r25670.20171213.tar.gz
+			wpa_supplicant_8 from Android 4.2 SDK and patched by Realtek
+			could be used for pure-linux and Android 4.2. Support only cfg80211/nl80211.
+
+		4.7 wpa_supplicant_8_kk_4.4_rtw_r25669.20171213.tar.gz
+			wpa_supplicant_8 from Android 4.4 SDK and patched by Realtek
+			could be used for pure-linux and Android 4.4. Support only cfg80211/nl80211.
+
+		4.8 wpa_supplicant_8_L_5.x_rtw_r24600.20171025.tar.gz
+			 wpa_supplicant_8 from Android 5.x SDK and patched by Realtek
+			 could be used for pure-linux and Android 5.x Support only cfg80211/nl80211.
+
+		4.9 wpa_supplicant_8_M_6.x_rtw_r24570.20171025.tar.gz
+			wpa_supplicant_8 from Android 6.x SDK and patched by Realtek
+			could be used for pure-linux and Android 6.x. Support only cfg80211/nl80211.
+
+		4.10 wpa_supplicant_8_N_7.x_rtw_r24577.20171025.tar.gz
+			wpa_supplicant_8 from Android 7.x SDK and patched by Realtek
+			could be used for pure-linux and Android 7.x. Support only cfg80211/nl80211.
+		
+		4.11 wpa_supplicant_8_O_8.x_rtw_r31832.20190226.tar.gz
+			wpa_supplicant_8 from Android 8.x SDK and patched by Realtek
+			could be used for pure-linux and Android 8.x. Support only cfg80211/nl80211.
+		
+		4.12 wpa_supplicant_8_P_9.x_rtw_r29226.20180827.tar.gz
+			wpa_supplicant_8 from Android 8.x SDK and patched by Realtek
+			could be used for pure-linux and Android 9.x. Support only cfg80211/nl80211.
+
+	5. wireless_tools/
+		5.1 wireless_tools.30.rtl.tar.gz
+
+	6. WiFi_Direct_User_Interface/
+		6.1 p2p_api_test_linux.c
+		6.2 p2p_ui_test_linux.c
+		6.3 p2p_test.h
+		6.4 Start_Guide_P2P_User_Interface_Linux.pdf
+	
+	7. android_ref_codes_JB_4.2
+		7.1 linux-3.0.42_STATION_INFO_ASSOC_REQ_IES.diff
+			Kernel patch file for cfg80211's STATION_INFO_ASSOC_REQ_IES event for kernel 3.0.
+
+		7.2 realtek_wifi_SDK_for_android_JB_4.2_20130208.tar.gz
+			This tar ball includes our android wifi reference codes for Android 4.2
+
+		7.3 Realtek_Wi-Fi_SDK_for_Android_JB_4.2.pdf
+			Guide for porting Realtek wifi onto your Android 4.2 system
+
+	8. android_ref_codes_KK_4.4
+		8.1 linux-3.0.42_STATION_INFO_ASSOC_REQ_IES.diff
+			Kernel patch file for cfg80211's STATION_INFO_ASSOC_REQ_IES event for kernel 3.0.
+
+		8.2 realtek_wifi_SDK_for_android_KK_4.4_20140117.tar.gz
+			This tar ball includes our android wifi reference codes for Android 4.4
+
+		8.3 Realtek_Wi-Fi_SDK_for_Android_KK_4.4.pdf
+			Guide for porting Realtek wifi onto your Android 4.4 system
+
+	9. android_ref_codes_L_5.x
+		9.1 linux-3.0.42_STATION_INFO_ASSOC_REQ_IES.diff
+			Kernel patch file for cfg80211's STATION_INFO_ASSOC_REQ_IES event for kernel 3.0.
+
+		9.2 realtek_wifi_SDK_for_android_L_5.x_20150811.tgz
+			This tar ball includes our android wifi reference codes for Android 5.x
+
+		9.3 Realtek_Wi-Fi_SDK_for_Android_L_5.x.pdf
+			Guide for porting Realtek wifi onto your Android 5.x system
+			
+	10. android_ref_codes_M_6.x
+		10.1 linux-3.0.42_STATION_INFO_ASSOC_REQ_IES.diff
+			Kernel patch file for cfg80211's STATION_INFO_ASSOC_REQ_IES event for kernel 3.0.
+
+		10.2 realtek_wifi_SDK_for_android_L_6.x_20151116.tgz
+			This tar ball includes our android wifi reference codes for Android 6.x
+
+		10.3 Realtek_Wi-Fi_SDK_for_Android_M_6.x.pdf
+			Guide for porting Realtek wifi onto your Android 6.x system
+
+	11. android_ref_codes_M_7.0
+		11.1 linux-3.0.42_STATION_INFO_ASSOC_REQ_IES.diff
+			Kernel patch file for cfg80211's STATION_INFO_ASSOC_REQ_IES event for kernel 3.0.
+
+		11.2 realtek_wifi_SDK_for_android_N_7.0_20161024.zip
+			This tar ball includes our android wifi reference codes for Android 7.0
+
+		11.3 Realtek_Wi-Fi_SDK_for_Android_N_7.0.pdf
+			Guide for porting Realtek wifi onto your Android 7.0 system
+
+	12. android_ref_codes_O_8.0
+		12.1 linux-3.0.42_STATION_INFO_ASSOC_REQ_IES.diff
+			Kernel patch file for cfg80211's STATION_INFO_ASSOC_REQ_IES event for kernel 3.0.
+
+		12.2 realtek_wifi_SDK_for_android_O_8.0_20181001.tar.gz
+			This tar ball includes our android wifi reference codes for Android 8.0
+
+		12.3 Realtek_Wi-Fi_SDK_for_Android_O_8.0.pdf
+			Guide for porting Realtek wifi onto your Android 8.0 system
+
+	13. android_ref_codes_P_9.x
+		13.1 linux-3.0.42_STATION_INFO_ASSOC_REQ_IES.diff
+			Kernel patch file for cfg80211's STATION_INFO_ASSOC_REQ_IES event for kernel 3.0.
+
+		13.2 realtek_wifi_SDK_for_android_P_9.x_20180813.tar.gz
+			This tar ball includes our android wifi reference codes for Android 9.x
+
+		13.3 Realtek_Wi-Fi_SDK_for_Android_P_9.x.pdf
+			Guide for porting Realtek wifi onto your Android 9.x system
+			
+	13. install.sh 
+		Script to compile and install WiFi driver easily in PC-Linux
+
+==================================================================================================================
+		User Guide for Driver compilation and installation
+==================================================================================================================
+			(*) Please refer to document/Quick_Start_Guide_for_Driver_Compilation_and_Installation.pdf
+==================================================================================================================
+		User Guide for Station mode
+==================================================================================================================
+			(*) Please refer to document/Quick_Start_Guide_for_Station_Mode.pdf
+==================================================================================================================
+		User Guide for Soft-AP mode
+==================================================================================================================
+			(*) Please refer to document/Quick_Start_Guide_for_SoftAP.pdf
+			(*) Please use wpa_supplicant_hostapd-0.8_rtw_r24647.20171025.tar.gz
+			(*) Please refer to document/linux_dhcp_server_notes.txt
+==================================================================================================================
+		User Guide for Wi-Fi Direct
+==================================================================================================================
+		Realtek Legacy Wi-Fi Direct:
+			(*) Please refer to document/RTK_P2P_WFD_Programming_guide.pdf
+			(*) Please use wpa_supplicant_hostapd-0.8_rtw_r24647.20171025.tar.gz
+			(*) Please refer to document/linux_dhcp_server_notes.txt
+			(*) Please refer to WiFi_Direct_User_Interface/
+		Wi-Fi Direct with nl80211
+			(*) Please use:
+				or
+					wpa_supplicant_8_jb_4.2_rtw_r25670.20171213.tar.gz
+				or
+					wpa_supplicant_8_kk_4.4_rtw_r25669.20171213.tar.gz
+				or
+					wpa_supplicant_8_L_5.x_rtw_r24600.20171025.tar.gz
+				or
+					wpa_supplicant_8_M_6.x_rtw_r24570.20171025.tar.gz
+				or
+					wpa_supplicant_8_N_7.x_rtw_r24577.20171025.tar.gz
+				or
+					wpa_supplicant_8_O_8.x_rtw_r33457.20190507.tar.gz
+				or
+					wpa_supplicant_8_P_9.x_rtw_r29226.20180827.tar.gz
+
+			(*) For P2P instruction/command, please refer to:
+					README-P2P inside the wpa_supplicant folder of the wpa_supplicant_8 you choose
+			(*) For DHCP server, please refer to:
+					document/linux_dhcp_server_notes.txt
+==================================================================================================================
+		User Guide for WPS2.0
+==================================================================================================================
+			(*) Please use:
+					wpa_supplicant_hostapd-0.8_rtw_r24647.20171025.tar.gz
+				or
+					wpa_supplicant_8_jb_4.2_rtw_r25670.20171213.tar.gz
+				or
+					wpa_supplicant_8_kk_4.4_rtw_r25669.20171213.tar.gz
+				or
+					wpa_supplicant_8_L_5.x_rtw_r24600.20171025.tar.gz
+				or
+					wpa_supplicant_8_M_6.x_rtw_r24570.20171025.tar.gz
+				or
+					wpa_supplicant_8_N_7.x_rtw_r24577.20171025.tar.gz
+				or
+					wpa_supplicant_8_O_8.x_rtw_r33457.20190507.tar.gz
+				or
+					wpa_supplicant_8_P_9.x_rtw_r29226.20180827.tar.gz
+
+			(*) For WPS instruction/command, please refert to:
+					README-WPS inside the wpa_supplicant folder of the wpa_supplicant_8 you choose
+==================================================================================================================
+		User Guide for Power Saving Mode
+==================================================================================================================
+			(*) Please refer to document/HowTo_enable_the_power_saving_functionality.pdf
+==================================================================================================================
+		User Guide for Applying Wi-Fi solution onto Andriod System
+==================================================================================================================
+			(*) For Android 1.6 ~ 2.3, 4.0, 4.1, 4.3, please contact us for further information
+			(*) For Android 4.2, please refer to android_ref_codes_JB_4.2/Realtek_Wi-Fi_SDK_for_Android_JB_4.2.pdf
+			(*) For Android 4.4, please refer to android_ref_codes_KK_4.4/Realtek_Wi-Fi_SDK_for_Android_KK_4.4.pdf
+			(*) For Android 5.X, please refer to android_ref_codes_L_5.x/Realtek_Wi-Fi_SDK_for_Android_L_5.x.pdf
+			(*) For Android 6.X, please refer to android_ref_codes_M_6.x/Realtek_Wi-Fi_SDK_for_Android_M_6.x.pdf
+			(*) For Android 7.X, please refer to android_ref_codes_N_7.0/Realtek_Wi-Fi_SDK_for_Android_N_7.0.pdf
+			(*) For Android 8.X, please refer to android_ref_codes_O_8.0/Realtek_Wi-Fi_SDK_for_Android_O_8.0.pdf
+			(*) For Android 9.X, please refer to android_ref_codes_P_9.x/Realtek_Wi-Fi_SDK_for_Android_P_9.x.pdf
--- a/Realtek_Changelog.txt
+++ b/Realtek_Changelog.txt
@@ -1,123 +0,0 @@
-Product: RTL8812A USB Software Package - Linux Driver
-Version: v5.2.20.2_28373.20180619
-
-Release History:
-
-v5.2.20.2_28373.20180619
-
-  Update phydm to improve TP stability
-
-v5.2.20.1_27761.20180508
-
-  Support WiFi-HAL for Android 8
-
-v5.2.20_25672.20171213
-
-  Update PHYDM setting
-  Update FW to v52.10
-  Correct DFS master function
-  Fixed WPA2 vulnerability - key reinstallation attacks(KRACKs)(update)
-
-v5.2.9.3_24903.20171101
-
-  Fixed WPA2 vulnerability - key reinstallation attacks(KRACKs)
-
-v5.2.9.2_24491.20171027
-
-  Remove test code
-  Fix crash for BF function
-  Fix wrong memory accesse
-  Fix encrypt broadcast packet fail
-  Fix crash for TDLS
-
-v5.2.9.1_24461.20171018
-
-  (Do not use)
-
-v5.2.9_22809.20170621
-
-  Update FW to v52.2
-  Update PHYDM setting
-  Support PNO
-  Fix WOW issue
-  Fix efuse issue
-  Sync channel plan document
-  Fix DFS issue
-  Support NAPI & GRO
-  Enable Power by rate
-  Fix MP power tracking issue
-  Fix potential memory out of range
-  Support CE-RED. 2G: ETSI v2.1.1 / 5G: ETSI v2.1.0
-
-v5.1.5_19247.20160830
-
-  Update FW to v49
-  Update PHY parameters v57
-  Support TDLS
-  Enable GTK offload under WOW
-  Fix no scan results after resume
-  Fix NDPA issue under scan
-  Fix dynamic watchdog don't work
-
-v4.3.20_16317.20160108
-
-  Disable CONFIG_WIFI_TEST & CONFIG_WOWLAN in Makefile default
-
-v4.3.20_16317.20151231
-
-  Fix STBC issue
-  Fix NDPA sounding issue
-  Fix r/w rf register racing issue
-  Fix kernel panic for BT & timer
-  Fix memory leak for cmd thread
-  Fix ADDBA flow
-  Support Power limit
-  Support USB mode switch
-  Support Linux Kernel 4.2
-  Update FW to v41
-  Update PHY parameters to v55
-
-v4.3.13_14061.20150505
-
-  Update FW
-  Update Phy parameters
-  Support WOWLAN GTK offload
-  Support Adaptivity
-  Support 1T2R
-  Support 8812AU-VN
-  Fix scan timeout issue
-  Fix RFE type error
-  Fix Spur Calibration flow
-  Fix some 802.11 logo issue
-  Fix some crash issues
-
-v4.3.8_12175.20140912
-
-  Update PHY parameters to improve throughput
-  Update FW
-  Support PMF
-  Support WoWLAN
-  Modify channel plan
-  Fix MP issue
-
-v4.3.2_11100.20140411
-
-  Fix p2p issues
-  Improve throughput
-  Update FW
-
-v4.2.3_8123.20130705
-
-  Update PHY parameters to improve throughput
-
-v4.2.2_7502.20130517
-
-  Support 11AC for STA
-
-v4.2.0_7054.20130328
-
-  Fix LED behavior
-
-v4.2.0_6952.20130315
-
-  First release
--- a/ReleaseNotes.pdf
+++ b/ReleaseNotes.pdf
--- a/WiFi_Direct_User_Interface/Android.mk
+++ b/WiFi_Direct_User_Interface/Android.mk
@@ -0,0 +1,11 @@
+ifneq ($(TARGET_SIMULATOR),true)
+LOCAL_PATH:= $(call my-dir)
+
+include $(CLEAR_VARS)
+LOCAL_SRC_FILES += p2p_api_test_linux.c p2p_ui_test_linux.c
+LOCAL_SHARED_LIBRARIES := libc libcutils
+LOCAL_MODULE = P2P_UI
+LOCAL_MODULE_TAGS := optional
+include $(BUILD_EXECUTABLE)
+
+endif
--- a/WiFi_Direct_User_Interface/Start_Guide_P2P_User_Interface_Linux.pdf
+++ b/WiFi_Direct_User_Interface/Start_Guide_P2P_User_Interface_Linux.pdf
--- a/WiFi_Direct_User_Interface/install.sh
+++ b/WiFi_Direct_User_Interface/install.sh
@@ -0,0 +1,101 @@
+
+wpa_supplicant_hostapd=`ls -1 ../wpa_supplicant_hostapd/wpa_supplicant_hostapd-0.8_*`
+echo $wpa_supplicant_hostapd
+
+
+if [ -e $wpa_supplicant_hostapd ]; then
+        echo "Checking wpa_supplicant_hostatpd" 
+else
+        echo "wpa_supplicant_hostapd doesn'tt exist in corresponding folder"
+        exit
+fi
+
+if [ -e ../wpa_supplicant_hostapd/p2p_hostapd.conf ]; then
+        echo "Checking p2p_hostapd.conf"
+else
+        echo "p2p_hostapd.conf doesn't exist in corresponding folder"
+        exit
+fi
+
+if [ -e ../wpa_supplicant_hostapd/wpa_0_8.conf ]; then
+        echo "Checking wpa_0_8.conf"
+else
+        echo "wpa_0_8.conf doesn't exist in corresponding folder"
+        exit
+fi
+
+#cp ../wpa_supplicant_hostapd/wpa_supplicant_hostapd-0.8_rtw_20111118.zip ./
+cp $wpa_supplicant_hostapd ./
+wpa_supplicant_hostapd=`ls -1 ./wpa_supplicant_hostapd-0.8_*`
+echo "  "$wpa_supplicant_hostapd
+unzip $wpa_supplicant_hostapd
+
+cd wpa_supplicant_hostapd-0.8
+cd wpa_supplicant
+make clean all
+
+cd ..
+cd hostapd
+make clean all
+
+cd ..
+cd ..
+
+cp ../wpa_supplicant_hostapd/p2p_hostapd.conf ./
+cp ../wpa_supplicant_hostapd/wpa_0_8.conf ./
+cp ./wpa_supplicant_hostapd-0.8/hostapd/hostapd ./
+cp ./wpa_supplicant_hostapd-0.8/hostapd/hostapd_cli ./
+cp ./wpa_supplicant_hostapd-0.8/wpa_supplicant/wpa_supplicant ./
+cp ./wpa_supplicant_hostapd-0.8/wpa_supplicant/wpa_cli ./
+
+rm -rf wpa_supplicant_hostapd-0.8
+rm -rf $wpa_supplicant_hostapd
+
+gcc -o P2P_UI ./p2p_api_test_linux.c ./p2p_ui_test_linux.c -lpthread
+
+if [ ! -e ./p2p_hostapd.conf ]; then
+        echo "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
+        echo "Doesn't have p2p_hostapd.conf"
+        result="fail"
+fi
+
+if [ ! -e ./wpa_0_8.conf ]; then
+        echo "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
+        echo "Doesn't have wpa_0_8.conf"
+                                result="fail"
+fi
+
+if [ ! -e ./hostapd ]; then
+        echo "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
+        echo "Doesn't have hostapd"
+        result="fail"
+fi
+
+if [ ! -e ./wpa_supplicant ]; then
+        echo "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
+        echo "Doesn't have hostapd_cli"
+        result="fail"
+fi
+
+if [ ! -e ./wpa_cli ]; then
+        echo "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
+        echo "Doesn't have p2p_hostapd.conf"
+        result="fail"
+fi
+
+if [ ! -e ./P2P_UI ]; then
+        echo "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
+        echo "Doesn't have P2P_UI"
+        result="fail"
+fi
+
+if [ "$result" == "fail" ]; then
+        echo "WiFi_Direct_User_Interface install unsuccessful"
+        echo "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
+        exit
+fi
+
+echo "##################################################"
+echo "WiFi_Direct_User_Interface install complete!!!!!!!"
+echo "##################################################"
+
--- a/WiFi_Direct_User_Interface/p2p_api_test_linux.c
+++ b/WiFi_Direct_User_Interface/p2p_api_test_linux.c
--- a/WiFi_Direct_User_Interface/p2p_test.h
+++ b/WiFi_Direct_User_Interface/p2p_test.h
@@ -0,0 +1,167 @@
+#ifndef _P2P_UI_TEST_H_
+#define _P2P_UI_TEST_H_
+
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <pthread.h>
+
+#define	P2P_AUTO	1
+//#define DHCP	1
+#define CMD_SZ 100
+#define SSID_SZ	32
+
+#define SEC 1000000
+#define SCAN_POOL_NO	8
+#define NEGO_RETRY_INTERVAL 10 * SEC
+#define NEGO_QUERY_INTERVAL 0.5 * SEC
+#define PRE_NEGO_INTERVAL 0.5 * SEC
+#define MAX_PROV_RETRY 15
+#define PROV_RETRY_INTERVAL 5
+#define PROV_WAIT_TIME	1 * SEC
+#define MAX_NEGO_RETRY 60
+#define NEGO_WAIT_TIME	0.5 * SEC
+#define	WPS_RETRY 120
+#define SUPPLICANT_INIT_TIME 1 * SEC
+#define HOSTAPD_INIT_TIME	1 * SEC
+#define SUPPLICANT_INTERVAL 1 * SEC
+#define HOSTAPD_INTERVAL 1 * SEC
+#define POLLING_INTERVAL	1 * SEC
+#define _TRUE 1
+#define _FALSE 0
+
+#define WPS_CONFIG_METHOD_LABEL		0x0004
+#define WPS_CONFIG_METHOD_DISPLAY	0x0008
+#define WPS_CONFIG_METHOD_E_NFC		0x0010
+#define WPS_CONFIG_METHOD_I_NFC		0x0020
+#define WPS_CONFIG_METHOD_NFC		0x0040
+#define WPS_CONFIG_METHOD_PBC		0x0080
+#define WPS_CONFIG_METHOD_KEYPAD	0x0100
+#define WPS_CONFIG_METHOD_VPBC		0x0280
+#define WPS_CONFIG_METHOD_PPBC		0x0480
+#define WPS_CONFIG_METHOD_VDISPLAY	0x2008
+#define WPS_CONFIG_METHOD_PDISPLAY	0x4008
+
+enum thread_trigger{
+	THREAD_NONE = 0,
+	THREAD_DEVICE = 1,
+	THREAD_GO = 2,
+};
+
+enum P2P_ROLE {
+	P2P_ROLE_DISABLE = 0,
+	P2P_ROLE_DEVICE = 1,
+	P2P_ROLE_CLIENT = 2,
+	P2P_ROLE_GO = 3	
+};
+
+enum P2P_STATE {
+	P2P_STATE_NONE = 0,					//	P2P disable
+	P2P_STATE_IDLE = 1,						//	P2P had enabled and do nothing
+	P2P_STATE_LISTEN = 2,					//	In pure listen state
+	P2P_STATE_SCAN = 3,					//	In scan phase
+	P2P_STATE_FIND_PHASE_LISTEN = 4,		//	In the listen state of find phase
+	P2P_STATE_FIND_PHASE_SEARCH = 5,		//	In the search state of find phase
+	P2P_STATE_TX_PROVISION_DIS_REQ = 6,	//	In P2P provisioning discovery
+	P2P_STATE_RX_PROVISION_DIS_RSP = 7,
+	P2P_STATE_RX_PROVISION_DIS_REQ = 8,	
+	P2P_STATE_GONEGO_ING = 9,				//	Doing the group owner negoitation handshake
+	P2P_STATE_GONEGO_OK = 10,				//	finish the group negoitation handshake with success
+	P2P_STATE_GONEGO_FAIL = 11,			//	finish the group negoitation handshake with failure
+	P2P_STATE_RECV_INVITE_REQ = 12,		//	receiving the P2P Inviation request
+	P2P_STATE_PROVISIONING_ING = 13,		//	Doing the P2P WPS
+	P2P_STATE_PROVISIONING_DONE = 14,	//	Finish the P2P WPS
+};
+
+enum P2P_WPSINFO {
+	P2P_NO_WPSINFO						= 0,
+	P2P_GOT_WPSINFO_PEER_DISPLAY_PIN	= 1,
+	P2P_GOT_WPSINFO_SELF_DISPLAY_PIN	= 2,
+	P2P_GOT_WPSINFO_PBC					= 3,
+};
+
+struct scan{
+	char addr[18];
+	int go;
+};
+
+struct p2p{
+	char ifname[10];
+	int enable;
+	int status;
+	char dev_name[33];
+	int intent;
+	int listen_ch;
+	int wps_info;
+	int wpsing;
+	unsigned int pin;
+	int role;
+	char peer_devaddr[18];
+	int p2p_get;	//p2p_get==1 : print messages from ioctl p2p_get
+	char print_line[CMD_SZ];
+	int have_p2p_dev;	//have_p2p_dev==1 : after scanning p2p device
+	int show_scan_result;
+	int	count_line;
+	char peer_ifaddr[18];
+	char cmd[CMD_SZ];
+	char parse[CMD_SZ];
+	char apd_ssid[SSID_SZ];
+	int op_ch;	//operation channel
+	int wpa_open;
+	int ap_open;
+	char ap_conf[CMD_SZ];
+	char ap_path[CMD_SZ];
+	char apcli_path[CMD_SZ];
+	char wpa_conf[CMD_SZ];
+	char wpa_path[CMD_SZ];
+	char wpacli_path[CMD_SZ];
+	char ok_msg[CMD_SZ];
+	char redo_msg[CMD_SZ];
+	char fail_msg[CMD_SZ];
+	char nego_msg[CMD_SZ];
+	char scan_msg[CMD_SZ];
+	int thread_trigger;
+	pthread_t pthread;
+	pthread_t pthread_go;
+	int res;	//check if thread is created; 1: disabled, 0: enabled
+	int res_go;	//created if p2p device becomes GO
+	struct scan scan_pool[SCAN_POOL_NO];
+	int connect_go;
+	int no_sta_connected;
+};
+
+void ui_screen(struct p2p *p);
+char *naming_wpsinfo(int wps_info);
+char *naming_role(int role);
+char *naming_status(int status);
+unsigned int wps_pin_checksum(unsigned int pin);
+void p2p_enable(struct p2p *p);
+void p2p_scan(struct p2p *p);
+void scan_result(struct p2p *p);
+void p2p_intent(struct p2p *p);
+void p2p_pincode(struct p2p *p, char *ins_no, char *ins_no_again);
+void p2p_devaddr(struct p2p *p);
+void p2p_role(struct p2p *p, int flag);
+void p2p_status(struct p2p *p, int flag);
+void p2p_prov_disc_no_addr(struct p2p *p, char *msg);
+void p2p_prov_disc(struct p2p *p, char *msg, char *dis_msg, char *label_msg);
+void p2p_set_nego(struct p2p *p);
+void p2p_ifaddr(struct p2p *p);
+void p2p_client_mode(struct p2p *p);
+void p2p_go_mode(struct p2p *p);
+void p2p_get_hostapd_conf(struct p2p *p);
+void p2p_set_opch(struct p2p *p, char *msg, int print);
+void p2p_softap_ssid(struct p2p *p, char *msg, int print);
+void p2p_listen_ch(struct p2p *p, char *msg);
+void p2p_peer_devaddr(struct p2p *p, char *peer_devaddr);
+void p2p_peer_req_cm(struct p2p *p, char *peer_req_cm);
+void p2p_peer_info(struct p2p *p, char *peer_devaddr, char *peer_req_cm);
+void p2p_wps_cm(struct p2p *p, char *scan_addr, char *cms);
+void p2p_device_name(struct p2p *p, char *scan_addr, char *dns);
+void p2p_setDN(struct p2p *p);
+void *polling_status(void *arg);
+void *polling_client(void *arg);
+void *print_status(void *arg);
+
+#endif	//_P2P_UI_TEST_H_
--- a/WiFi_Direct_User_Interface/p2p_ui_test_linux.c
+++ b/WiFi_Direct_User_Interface/p2p_ui_test_linux.c
@@ -0,0 +1,536 @@
+
+#include "p2p_test.h"
+
+char *naming_wpsinfo(int wps_info)
+{
+	switch(wps_info)
+	{
+		case P2P_NO_WPSINFO: return ("P2P_NO_WPSINFO");
+		case P2P_GOT_WPSINFO_PEER_DISPLAY_PIN: return ("P2P_GOT_WPSINFO_PEER_DISPLAY_PIN");
+		case P2P_GOT_WPSINFO_SELF_DISPLAY_PIN: return ("P2P_GOT_WPSINFO_SELF_DISPLAY_PIN");
+		case P2P_GOT_WPSINFO_PBC: return ("P2P_GOT_WPSINFO_PBC");
+		default: return ("UI unknown failed");
+	}
+}
+
+char *naming_role(int role)
+{
+	switch(role)
+	{
+		case P2P_ROLE_DISABLE: return ("P2P_ROLE_DISABLE");
+		case P2P_ROLE_DEVICE: return ("P2P_ROLE_DEVICE");
+		case P2P_ROLE_CLIENT: return ("P2P_ROLE_CLIENT");
+		case P2P_ROLE_GO: return ("P2P_ROLE_GO");
+		default: return ("UI unknown failed");
+	}
+}
+
+char *naming_status(int status)
+{
+	switch(status)
+	{
+		case P2P_STATE_NONE: return ("P2P_STATE_NONE");
+		case P2P_STATE_IDLE: return ("P2P_STATE_IDLE");
+		case P2P_STATE_LISTEN: return ("P2P_STATE_LISTEN");
+		case P2P_STATE_SCAN: return ("P2P_STATE_SCAN");
+		case P2P_STATE_FIND_PHASE_LISTEN: return ("P2P_STATE_FIND_PHASE_LISTEN");
+		case P2P_STATE_FIND_PHASE_SEARCH: return ("P2P_STATE_FIND_PHASE_SEARCH");
+		case P2P_STATE_TX_PROVISION_DIS_REQ: return ("P2P_STATE_TX_PROVISION_DIS_REQ");
+		case P2P_STATE_RX_PROVISION_DIS_RSP: return ("P2P_STATE_RX_PROVISION_DIS_RSP");
+		case P2P_STATE_RX_PROVISION_DIS_REQ: return ("P2P_STATE_RX_PROVISION_DIS_REQ");
+		case P2P_STATE_GONEGO_ING: return ("P2P_STATE_GONEGO_ING");
+		case P2P_STATE_GONEGO_OK: return ("P2P_STATE_GONEGO_OK");
+		case P2P_STATE_GONEGO_FAIL: return ("P2P_STATE_GONEGO_FAIL");
+		case P2P_STATE_RECV_INVITE_REQ: return ("P2P_STATE_RECV_INVITE_REQ");
+		case P2P_STATE_PROVISIONING_ING: return ("P2P_STATE_PROVISIONING_ING");
+		case P2P_STATE_PROVISIONING_DONE: return ("P2P_STATE_PROVISIONING_DONE");
+		default: return ("UI unknown failed");
+	}
+}
+
+char* naming_enable(int enable)
+{
+	switch(enable)
+	{
+		case  P2P_ROLE_DISABLE: return ("[Disabled]");
+		case  P2P_ROLE_DEVICE: return ("[Enable/Device]");
+		case  P2P_ROLE_CLIENT: return ("[Enable/Client]");
+		case  P2P_ROLE_GO: return ("[Enable/GO]");
+		default: return ("UI unknown failed");
+	}
+}
+
+void ui_screen(struct p2p *p)
+{
+
+	system("clear");
+	printf("\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n");
+	printf("****************************************************************************************************\n");
+	printf("*                                      P2P UI TEST v0.5                                            *\n");
+	printf("****************************************************************************************************\n");
+	printf("* Enable: %-89s*\n", naming_enable(p->enable));
+	printf("* Intent: %2d                                                                                       *\n", p->intent);
+	printf("* Status: %-89s*\n", naming_status(p->status));
+	printf("* Role: %-91s*\n", naming_role(p->role));
+	printf("* WPS method: %-85s*\n", naming_wpsinfo(p->wps_info));
+	printf("* PIN code: %08d                                                                               *\n", p->pin);
+	
+	printf("* Device name: %-84s*\n", p->dev_name);
+	printf("* Peer device address: %-76s*\n", p->peer_devaddr);
+	printf("* Peer interface address: %-73s*\n", p->peer_ifaddr);
+	
+	printf("*                                                                                                  *\n");
+	printf("* e) Wi-Fi Direct Enable/Disable                                                                   *\n");
+	printf("* i) Intent ( The degree to be Group Owner/SoftAP )                                                *\n");
+	printf("* a) Scan Wi-Fi Direct devices                                                                     *\n");
+	printf("* m) Peer device address you want to test                                                          *\n");
+	printf("* p) Provision discovery                                                                           *\n");
+	printf("* c) Input PIN codes                                                                               *\n");
+	printf("* w) WPS method                                                                                    *\n");
+	printf("* n) Group owner negotiation                                                                       *\n");
+	printf("* x) Start wpa_supplicant/hostapd                                                                  *\n");
+	printf("* h) Set operation channel                        | t) Set SoftAP ssid                             *\n");
+	printf("* r) Get Current P2P Role                         | s) Get Current P2P Status                      *\n");
+	printf("* d) Set device name                              | l) Set Listen channel                          *\n");
+	printf("* f) Reflash Current State                        | q) Quit                                        *\n");
+	printf("****************************************************************************************************\n");
+	
+	
+	if(p->p2p_get==0)
+	{
+		printf("*                                                                                                  *\n");
+	}	
+	else if(p->p2p_get==1)
+	{
+		printf("*%-98s*\n", p->print_line);
+	}
+	
+	printf("****************************************************************************************************\n");
+	
+	if( ( p->show_scan_result == 1 ) && ( p->have_p2p_dev == 1 ) )
+	//if( (p->have_p2p_dev == 1) && (p->enable >= P2P_ROLE_DEVICE) && ( p->wpsing == 0 ) && (p->status >= P2P_STATE_LISTEN && p->status <= P2P_STATE_FIND_PHASE_SEARCH) )
+	{
+			scan_result(p);
+	}
+	else
+	{
+		int i=0;
+		for(i = 0; i < SCAN_POOL_NO + 1; i++ )
+			printf("*                                                                                                  *\n");
+	}	
+	
+	printf("****************************************************************************************************\n");
+
+	p->show_scan_result = 0;
+}
+
+void init_p2p(struct p2p *p)
+{
+	strcpy( p->ifname, "wlan0" );
+	p->enable = P2P_ROLE_DISABLE;
+	p->res = 1;
+	p->res_go = 1;
+	p->status = P2P_STATE_NONE;
+	p->intent = 1;
+	p->wps_info = 0;
+	p->wpsing = 0;
+	p->pin = 12345670;
+	p->role = P2P_ROLE_DISABLE;
+	p->listen_ch = 11;
+	strcpy( p->peer_devaddr, "00:00:00:00:00:00" );
+	p->p2p_get = 0;
+	memset( p->print_line, 0x00, CMD_SZ);
+	p->have_p2p_dev = 0;
+	p->count_line = 0;
+	strcpy( p->peer_ifaddr, "00:00:00:00:00:00" );
+	memset( p->cmd, 0x00, CMD_SZ);
+	p->wpa_open=0;
+	p->ap_open=0;
+	strcpy(p->ok_msg, "WiFi Direct handshake done" );
+	strcpy(p->redo_msg, "Re-do GO handshake" );
+	strcpy(p->fail_msg, "GO handshake unsuccessful" );
+	strcpy(p->nego_msg, "Start P2P negotiation" );
+	strcpy(p->wpa_conf, "./wpa_0_8.conf" );
+	strcpy(p->wpa_path, "./wpa_supplicant" );
+	strcpy(p->wpacli_path, "./wpa_cli" );
+	strcpy(p->ap_conf, "./p2p_hostapd.conf" );
+	strcpy(p->ap_path, "./hostapd" );
+	strcpy(p->apcli_path, "./hostapd_cli" );
+	strcpy(p->scan_msg, "Device haven't enable p2p functionalities" );
+	
+}
+
+void rename_intf(struct p2p *p)
+{
+	FILE *pfin = NULL;
+	FILE *pfout = NULL;
+	
+	pfin = fopen( p->ap_conf, "r" );
+	pfout = fopen( "./p2p_hostapd_temp.conf", "w" );
+	
+	if ( pfin )
+	{
+		while( !feof( pfin ) ){
+			memset(p->parse, 0x00, CMD_SZ);
+			fgets(p->parse, CMD_SZ, pfin);
+			
+			if(strncmp(p->parse, "interface=", 10) == 0)
+			{
+				memset(p->parse, 0x00, CMD_SZ);
+				sprintf( p->parse, "interface=%s\n", p->ifname );
+				fputs( p->parse, pfout );
+			}
+			else
+				fputs(p->parse, pfout);
+		}
+	}
+
+	fclose( pfout );
+	
+	system( "rm -rf ./p2p_hostapd.conf" );
+	system( "mv ./p2p_hostapd_temp.conf ./p2p_hostapd.conf" );
+	
+	return;
+}
+
+
+//int main()
+int main(int argc, char **argv)
+{
+	char	peerifa[40] = { 0x00 };
+	char	scan[CMD_SZ];	
+	struct p2p p2pstruct;
+	struct p2p *p=NULL;
+
+	p = &p2pstruct;	
+	if( p != NULL)
+	{
+		memset(p, 0x00, sizeof(struct p2p));
+		init_p2p(p);
+	}
+
+	strcpy(p->ifname, argv[1] );
+	
+	/* Disable P2P functionalities at first*/
+	p->enable=P2P_ROLE_DISABLE;
+	p2p_enable(p);
+	p2p_get_hostapd_conf(p);
+	usleep(50000);
+  
+  rename_intf(p);
+  
+	do
+	{
+		ui_screen(p);
+
+		printf("*insert cmd:");
+		memset( scan, 0x00, CMD_SZ );
+		scanf("%s", scan);
+
+		if( p->thread_trigger == THREAD_NONE )		//Active mode for user interface
+		{
+			
+			if( strncmp(scan, "e", 1) == 0 )	//Enable
+			{
+				p->show_scan_result = 1;
+				ui_screen(p);
+				printf("Please insert enable mode;[0]Disable, [1]Device, [2]Client, [3]GO:");
+				scanf("%d",&p->enable);
+	
+				p2p_enable(p);
+				p->show_scan_result = 1;
+			}
+			else if( strncmp(scan, "a", 1) == 0 )	// Scan P2P device
+			{
+				p2p_scan(p);
+				p->show_scan_result = 1;
+			}
+			else if( strncmp(scan, "d", 1) == 0 )	// Set device name
+			{
+				p->p2p_get = 0;
+				printf("Please insert device name :");
+				scanf("\n%[^\n]", p->dev_name);
+				p2p_setDN(p);
+				p->show_scan_result = 1;
+			}
+			else if( strncmp(scan, "i", 1) == 0 )	// Intent
+			{
+				p->show_scan_result = 1;
+				ui_screen(p);
+				printf("Please insert intent from [0~15(must be softap)] :");
+				scanf("%d",&p->intent);
+				p2p_intent(p);
+				p->show_scan_result = 1;
+			}
+			else if( strncmp(scan, "w", 1) == 0 )	// WPS_info
+			{
+				p->show_scan_result = 1;
+				ui_screen(p);
+				printf("Please insert WPS method\n");
+				printf("[0]None, [1]Peer Display PIN, [2]Self Display Pin, [3]PBC :");
+				scanf("%d",&p->wps_info);
+				p2p_wpsinfo(p);
+				p->show_scan_result = 1;
+			}
+			else if( strncmp(scan, "c", 1) == 0 )	// PIN_code
+			{
+				char ins_no[CMD_SZ], ins_no_again[CMD_SZ];
+				memset(ins_no, 0x00, CMD_SZ); 
+				strcpy(ins_no, "Please insert 8-digit number, eg:12345670 :" );
+				memset(ins_no_again, 0x00, CMD_SZ);
+				strcpy(ins_no_again, "Invalid number, insert again, eg:12345670 :" );
+	
+				p2p_pincode(p, ins_no, ins_no_again);
+				p->show_scan_result = 1;
+			}
+			else if( strncmp(scan, "m", 1) == 0 )	// Set peer device address
+			{
+				p->show_scan_result = 1;
+				ui_screen(p);
+				printf("Please insert number in scan list:");
+				p2p_devaddr(p);
+				p->show_scan_result = 1;
+			}
+			else if( strncmp(scan, "r", 1) == 0 )	// Get role
+			{
+				p2p_role(p,1);
+				p->show_scan_result = 1;
+			}
+			else if( strncmp(scan, "s", 1) == 0 )	// Get status
+			{
+				p2p_status(p, 1);
+				p->show_scan_result = 1;
+			}
+			else if( strncmp(scan, "p", 1) == 0 )	// Provision discovery
+			{
+				char msg[CMD_SZ];
+				memset( msg, 0x00, CMD_SZ );
+				char dis_msg[CMD_SZ];
+				memset( dis_msg, 0x00, CMD_SZ );
+				char label_msg[CMD_SZ];
+				memset( label_msg, 0x00, CMD_SZ );
+	
+	
+				if(strncmp(p->peer_devaddr, "00:00:00:00:00:00", 17) == 0)
+				{
+					strcpy( msg, "Please insert peer P2P device at first" );			
+	
+					p2p_prov_disc_no_addr(p, msg);
+					p->show_scan_result = 1;
+				}
+				else
+				{
+					strcpy( msg, "Please insert WPS configuration method ;[0]display, [1]keypad, [2]pbc, [3]label:\n" );
+					strcpy( dis_msg, "Please insert PIN code displays on peer device screen:" );
+					strcpy( label_msg, "Please insert PIN code displays on peer label:" );
+
+					p2p_prov_disc(p, msg, dis_msg, label_msg);
+				}
+			}
+			else if( strncmp(scan, "n", 1) == 0 )	// Set negotiation
+			{
+				p2p_set_nego(p);
+			}
+			else if( strncmp(scan, "f", 1) == 0 ) // Reflash current state
+			{
+				p->show_scan_result = 1;
+				p2p_status(p, 0);
+				p2p_role(p, 0);
+				p2p_ifaddr(p);
+
+				if( p->status == P2P_STATE_RX_PROVISION_DIS_REQ )
+				{
+					char peer_devaddr[18];
+					char peer_req_cm[4];
+					
+					memset( peer_devaddr, 0x00, 18);
+					memset( peer_req_cm, 0x00, 4);
+					
+					p2p_peer_devaddr(p, peer_devaddr);
+					p2p_peer_req_cm(p, peer_req_cm);
+					p2p_peer_info(p, p->peer_devaddr, peer_req_cm);
+				}
+#ifndef P2P_AUTO
+				else
+				{
+					if( p->role == P2P_ROLE_CLIENT )
+					{
+						p2p_client_mode(p);
+					}
+					else if( p->role == P2P_ROLE_GO )
+					{
+						p2p_go_mode(p);
+					}
+				}
+#endif //P2P_AUTO
+		
+			}
+			else if( strncmp(scan, "x", 1) == 0 )	// Start wpa_supplicant/hostapd
+			{
+				if( p->role == P2P_ROLE_CLIENT )
+				{
+					p2p_client_mode(p);
+				}
+				else if( p->role == P2P_ROLE_GO )
+				{
+					p2p_go_mode(p);
+				}
+			}
+			else if( strncmp(scan, "h", 1) == 0 )	// Set operation channel
+			{
+				char msg[CMD_SZ];
+				memset( msg, 0x00, CMD_SZ );
+				strcpy( msg, "Please insert desired operation channel:" );			
+	
+				p2p_set_opch(p, msg, 1);
+				p->show_scan_result = 1;
+			}
+			else if( strncmp(scan, "t", 1) == 0 )	// Set SoftAP ssid
+			{
+				char msg[CMD_SZ];
+				memset( msg, 0x00, CMD_SZ );
+				strcpy( msg, "Please insert desired SoftAP ssid:" );			
+	
+				p2p_softap_ssid(p, msg, 1);
+				p->show_scan_result = 1;
+			}
+			else if( strncmp(scan, "l", 1) == 0 )	// Set Listen channel
+			{
+				char msg[CMD_SZ];
+				memset( msg, 0x00, CMD_SZ );
+				strcpy( msg, "Please insert desired Listen channel, only ch.1.6.11 are available:" );			
+
+				p2p_listen_ch(p, msg);
+				p->show_scan_result = 1;
+			}
+			else if( strncmp(scan, "q", 1) == 0 )	// Quit
+			{
+				if( p->res == 0 )
+					p->res = 1;
+				if( p->res_go == 0 )
+					p->res_go = 1;
+				break;
+			}
+			else	// Insert wrong commamd
+			{
+				p->p2p_get=1;
+				p->show_scan_result = 1;
+				memset( p->print_line, 0x00, CMD_SZ );
+				sprintf( p->print_line, " BAD argument");
+			}
+			
+		}
+		else if( p->thread_trigger == THREAD_DEVICE )		//Passive mode for user interface
+		{
+			
+			p->thread_trigger = THREAD_NONE ;
+			
+			if( strncmp(scan, "b", 1) == 0 )
+			{
+				p->wps_info=3;
+				p2p_wpsinfo(p);
+				
+				p2p_status(p, 0);
+				
+				if(p->status != P2P_STATE_GONEGO_OK)
+				{
+					p2p_set_nego(p);
+				}
+				else
+				{
+					p2p_role(p,0);
+										
+					if( p->role == P2P_ROLE_CLIENT )
+					{
+						p2p_client_mode(p);
+					}
+					else if( p->role == P2P_ROLE_GO )
+					{
+						p2p_go_mode(p);
+					}
+				}
+			}
+			else if( strncmp(scan, "c", 1) == 0 )
+			{
+				p->wps_info=2;
+				p2p_wpsinfo(p);
+				
+				p2p_status(p, 0);
+							
+				if(p->status != P2P_STATE_GONEGO_OK)
+				{
+					p2p_set_nego(p);
+				}					
+				else
+				{
+					p2p_role(p,0);
+					p2p_ifaddr(p);
+										
+					if( p->role == P2P_ROLE_CLIENT )
+					{
+						p2p_client_mode(p);
+					}
+					else if( p->role == P2P_ROLE_GO )
+					{
+						p2p_go_mode(p);
+					}
+				}
+			}
+			else if( ('0' <= *scan ) && ( *scan <= '9') )
+			{
+				printf("In passive pin code\n");
+				
+				p->pin = atoi(scan);
+				
+				p->wps_info=1;
+				p2p_wpsinfo(p);
+				
+				p2p_set_nego(p);
+			}
+		}
+		else if( p->thread_trigger == THREAD_GO )		//Passive mode for user interface
+		{
+			
+			p->thread_trigger = THREAD_NONE ;
+			
+			if( strncmp(scan, "b", 1) == 0 )
+			{
+				p->wps_info=3;
+				p2p_wpsinfo(p);
+
+			}
+			else if( strncmp(scan, "c", 1) == 0 )
+			{
+				p->wps_info=2;
+				p2p_wpsinfo(p);
+			}
+			else if( ('0' <= *scan ) && ( *scan <= '9') )
+			{
+				printf("In passive pin code\n");
+				
+				p->pin = atoi(scan);
+				
+				p->wps_info=1;
+				p2p_wpsinfo(p);
+			}
+			
+			p2p_go_mode(p);
+			
+		}
+	}
+	while( 1 );
+
+	/* Disable P2P functionalities when exits*/
+	p->enable= -1 ;
+	p2p_enable(p);
+
+	system( "rm -f ./supp_status.txt" );
+	system( "rm -f ./temp.txt" );
+	system( "rm -f ./scan.txt" );
+	system( "rm -f ./peer.txt" );
+	system( "rm -f ./status.txt" );
+	system( "rm -f ./cm.txt" );
+	
+	return 0;
+
+}
--- a/android/android_ref_codes_JB_4.2/Realtek_Wi-Fi_SDK_for_Android_JB_4.pdf
+++ b/android/android_ref_codes_JB_4.2/Realtek_Wi-Fi_SDK_for_Android_JB_4.pdf
--- a/android/android_ref_codes_JB_4.2/linux-3.0.42_STATION_INFO_ASSOC_REQ_IES.diff
+++ b/android/android_ref_codes_JB_4.2/linux-3.0.42_STATION_INFO_ASSOC_REQ_IES.diff
@@ -0,0 +1,57 @@
+diff -urN linux-3.0.42/include/net/cfg80211.h linux-3.0.42-patch/include/net/cfg80211.h
+--- linux-3.0.42/include/net/cfg80211.h	2012-09-05 21:02:06.960467827 +0800
+++ linux-3.0.42-patch/include/net/cfg80211.h	2012-09-05 21:00:09.775049000 +0800
+@@ -426,6 +426,7 @@
+  * @STATION_INFO_RX_BITRATE: @rxrate fields are filled
+  * @STATION_INFO_BSS_PARAM: @bss_param filled
+  * @STATION_INFO_CONNECTED_TIME: @connected_time filled
+ * @STATION_INFO_ASSOC_REQ_IES: @assoc_req_ies filled
+  */
+ enum station_info_flags {
+ 	STATION_INFO_INACTIVE_TIME	= 1<<0,
+@@ -444,7 +445,8 @@
+ 	STATION_INFO_SIGNAL_AVG		= 1<<13,
+ 	STATION_INFO_RX_BITRATE		= 1<<14,
+ 	STATION_INFO_BSS_PARAM          = 1<<15,
+-	STATION_INFO_CONNECTED_TIME	= 1<<16
+	STATION_INFO_CONNECTED_TIME	= 1<<16,
+	STATION_INFO_ASSOC_REQ_IES	= 1<<17
+ };
+ 
+ /**
+@@ -536,6 +538,11 @@
+  *	This number should increase every time the list of stations
+  *	changes, i.e. when a station is added or removed, so that
+  *	userspace can tell whether it got a consistent snapshot.
+ * @assoc_req_ies: IEs from (Re)Association Request.
+ *	This is used only when in AP mode with drivers that do not use
+ *	user space MLME/SME implementation. The information is provided for
+ *	the cfg80211_new_sta() calls to notify user space of the IEs.
+ * @assoc_req_ies_len: Length of assoc_req_ies buffer in octets.
+  */
+ struct station_info {
+ 	u32 filled;
+@@ -558,6 +565,9 @@
+ 	struct sta_bss_parameters bss_param;
+ 
+ 	int generation;
+
+	const u8 *assoc_req_ies;
+	size_t assoc_req_ies_len;
+ };
+ 
+ /**
+diff -urN linux-3.0.42/net/wireless/nl80211.c linux-3.0.42-patch/net/wireless/nl80211.c
+--- linux-3.0.42/net/wireless/nl80211.c	2012-09-05 21:03:25.528853240 +0800
+++ linux-3.0.42-patch/net/wireless/nl80211.c	2012-09-05 20:47:08.472824000 +0800
+@@ -2213,6 +2213,10 @@
+ 	}
+ 	nla_nest_end(msg, sinfoattr);
+ 
+	if (sinfo->filled & STATION_INFO_ASSOC_REQ_IES)
+		NLA_PUT(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
+			sinfo->assoc_req_ies);
+
+ 	return genlmsg_end(msg, hdr);
+ 
+  nla_put_failure:
--- a/android/android_ref_codes_JB_4.2/realtek_wifi_SDK_for_android_JB_4.2_20130208.tar.gz
+++ b/android/android_ref_codes_JB_4.2/realtek_wifi_SDK_for_android_JB_4.2_20130208.tar.gz
--- a/android/android_ref_codes_KK_4.4/Realtek_Wi-Fi_SDK_for_Android_KK_4.4.pdf
+++ b/android/android_ref_codes_KK_4.4/Realtek_Wi-Fi_SDK_for_Android_KK_4.4.pdf
--- a/android/android_ref_codes_KK_4.4/linux-3.0.42_STATION_INFO_ASSOC_REQ_IES.diff
+++ b/android/android_ref_codes_KK_4.4/linux-3.0.42_STATION_INFO_ASSOC_REQ_IES.diff
@@ -0,0 +1,57 @@
+diff -urN linux-3.0.42/include/net/cfg80211.h linux-3.0.42-patch/include/net/cfg80211.h
+--- linux-3.0.42/include/net/cfg80211.h	2012-09-05 21:02:06.960467827 +0800
+++ linux-3.0.42-patch/include/net/cfg80211.h	2012-09-05 21:00:09.775049000 +0800
+@@ -426,6 +426,7 @@
+  * @STATION_INFO_RX_BITRATE: @rxrate fields are filled
+  * @STATION_INFO_BSS_PARAM: @bss_param filled
+  * @STATION_INFO_CONNECTED_TIME: @connected_time filled
+ * @STATION_INFO_ASSOC_REQ_IES: @assoc_req_ies filled
+  */
+ enum station_info_flags {
+ 	STATION_INFO_INACTIVE_TIME	= 1<<0,
+@@ -444,7 +445,8 @@
+ 	STATION_INFO_SIGNAL_AVG		= 1<<13,
+ 	STATION_INFO_RX_BITRATE		= 1<<14,
+ 	STATION_INFO_BSS_PARAM          = 1<<15,
+-	STATION_INFO_CONNECTED_TIME	= 1<<16
+	STATION_INFO_CONNECTED_TIME	= 1<<16,
+	STATION_INFO_ASSOC_REQ_IES	= 1<<17
+ };
+ 
+ /**
+@@ -536,6 +538,11 @@
+  *	This number should increase every time the list of stations
+  *	changes, i.e. when a station is added or removed, so that
+  *	userspace can tell whether it got a consistent snapshot.
+ * @assoc_req_ies: IEs from (Re)Association Request.
+ *	This is used only when in AP mode with drivers that do not use
+ *	user space MLME/SME implementation. The information is provided for
+ *	the cfg80211_new_sta() calls to notify user space of the IEs.
+ * @assoc_req_ies_len: Length of assoc_req_ies buffer in octets.
+  */
+ struct station_info {
+ 	u32 filled;
+@@ -558,6 +565,9 @@
+ 	struct sta_bss_parameters bss_param;
+ 
+ 	int generation;
+
+	const u8 *assoc_req_ies;
+	size_t assoc_req_ies_len;
+ };
+ 
+ /**
+diff -urN linux-3.0.42/net/wireless/nl80211.c linux-3.0.42-patch/net/wireless/nl80211.c
+--- linux-3.0.42/net/wireless/nl80211.c	2012-09-05 21:03:25.528853240 +0800
+++ linux-3.0.42-patch/net/wireless/nl80211.c	2012-09-05 20:47:08.472824000 +0800
+@@ -2213,6 +2213,10 @@
+ 	}
+ 	nla_nest_end(msg, sinfoattr);
+ 
+	if (sinfo->filled & STATION_INFO_ASSOC_REQ_IES)
+		NLA_PUT(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
+			sinfo->assoc_req_ies);
+
+ 	return genlmsg_end(msg, hdr);
+ 
+  nla_put_failure:
--- a/android/android_ref_codes_KK_4.4/realtek_wifi_SDK_for_android_KK_4.4_20140117.tar.gz
+++ b/android/android_ref_codes_KK_4.4/realtek_wifi_SDK_for_android_KK_4.4_20140117.tar.gz
--- a/android/android_ref_codes_L_5.x/Realtek_Wi-Fi_SDK_for_Android_L_5.pdf
+++ b/android/android_ref_codes_L_5.x/Realtek_Wi-Fi_SDK_for_Android_L_5.pdf
--- a/android/android_ref_codes_L_5.x/linux-3.0.42_STATION_INFO_ASSOC_REQ_IES.diff
+++ b/android/android_ref_codes_L_5.x/linux-3.0.42_STATION_INFO_ASSOC_REQ_IES.diff
@@ -0,0 +1,57 @@
+diff -urN linux-3.0.42/include/net/cfg80211.h linux-3.0.42-patch/include/net/cfg80211.h
+--- linux-3.0.42/include/net/cfg80211.h	2012-09-05 21:02:06.960467827 +0800
+++ linux-3.0.42-patch/include/net/cfg80211.h	2012-09-05 21:00:09.775049000 +0800
+@@ -426,6 +426,7 @@
+  * @STATION_INFO_RX_BITRATE: @rxrate fields are filled
+  * @STATION_INFO_BSS_PARAM: @bss_param filled
+  * @STATION_INFO_CONNECTED_TIME: @connected_time filled
+ * @STATION_INFO_ASSOC_REQ_IES: @assoc_req_ies filled
+  */
+ enum station_info_flags {
+ 	STATION_INFO_INACTIVE_TIME	= 1<<0,
+@@ -444,7 +445,8 @@
+ 	STATION_INFO_SIGNAL_AVG		= 1<<13,
+ 	STATION_INFO_RX_BITRATE		= 1<<14,
+ 	STATION_INFO_BSS_PARAM          = 1<<15,
+-	STATION_INFO_CONNECTED_TIME	= 1<<16
+	STATION_INFO_CONNECTED_TIME	= 1<<16,
+	STATION_INFO_ASSOC_REQ_IES	= 1<<17
+ };
+ 
+ /**
+@@ -536,6 +538,11 @@
+  *	This number should increase every time the list of stations
+  *	changes, i.e. when a station is added or removed, so that
+  *	userspace can tell whether it got a consistent snapshot.
+ * @assoc_req_ies: IEs from (Re)Association Request.
+ *	This is used only when in AP mode with drivers that do not use
+ *	user space MLME/SME implementation. The information is provided for
+ *	the cfg80211_new_sta() calls to notify user space of the IEs.
+ * @assoc_req_ies_len: Length of assoc_req_ies buffer in octets.
+  */
+ struct station_info {
+ 	u32 filled;
+@@ -558,6 +565,9 @@
+ 	struct sta_bss_parameters bss_param;
+ 
+ 	int generation;
+
+	const u8 *assoc_req_ies;
+	size_t assoc_req_ies_len;
+ };
+ 
+ /**
+diff -urN linux-3.0.42/net/wireless/nl80211.c linux-3.0.42-patch/net/wireless/nl80211.c
+--- linux-3.0.42/net/wireless/nl80211.c	2012-09-05 21:03:25.528853240 +0800
+++ linux-3.0.42-patch/net/wireless/nl80211.c	2012-09-05 20:47:08.472824000 +0800
+@@ -2213,6 +2213,10 @@
+ 	}
+ 	nla_nest_end(msg, sinfoattr);
+ 
+	if (sinfo->filled & STATION_INFO_ASSOC_REQ_IES)
+		NLA_PUT(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
+			sinfo->assoc_req_ies);
+
+ 	return genlmsg_end(msg, hdr);
+ 
+  nla_put_failure:
--- a/android/android_ref_codes_L_5.x/realtek_wifi_SDK_for_android_L_5.x_20150811.tgz
+++ b/android/android_ref_codes_L_5.x/realtek_wifi_SDK_for_android_L_5.x_20150811.tgz
--- a/android/android_ref_codes_M_6.x/Realtek_Wi-Fi_SDK_for_Android_M_6.pdf
+++ b/android/android_ref_codes_M_6.x/Realtek_Wi-Fi_SDK_for_Android_M_6.pdf
--- a/android/android_ref_codes_M_6.x/linux-3.0.42_STATION_INFO_ASSOC_REQ_IES.diff
+++ b/android/android_ref_codes_M_6.x/linux-3.0.42_STATION_INFO_ASSOC_REQ_IES.diff
@@ -0,0 +1,57 @@
+diff -urN linux-3.0.42/include/net/cfg80211.h linux-3.0.42-patch/include/net/cfg80211.h
+--- linux-3.0.42/include/net/cfg80211.h	2012-09-05 21:02:06.960467827 +0800
+++ linux-3.0.42-patch/include/net/cfg80211.h	2012-09-05 21:00:09.775049000 +0800
+@@ -426,6 +426,7 @@
+  * @STATION_INFO_RX_BITRATE: @rxrate fields are filled
+  * @STATION_INFO_BSS_PARAM: @bss_param filled
+  * @STATION_INFO_CONNECTED_TIME: @connected_time filled
+ * @STATION_INFO_ASSOC_REQ_IES: @assoc_req_ies filled
+  */
+ enum station_info_flags {
+ 	STATION_INFO_INACTIVE_TIME	= 1<<0,
+@@ -444,7 +445,8 @@
+ 	STATION_INFO_SIGNAL_AVG		= 1<<13,
+ 	STATION_INFO_RX_BITRATE		= 1<<14,
+ 	STATION_INFO_BSS_PARAM          = 1<<15,
+-	STATION_INFO_CONNECTED_TIME	= 1<<16
+	STATION_INFO_CONNECTED_TIME	= 1<<16,
+	STATION_INFO_ASSOC_REQ_IES	= 1<<17
+ };
+ 
+ /**
+@@ -536,6 +538,11 @@
+  *	This number should increase every time the list of stations
+  *	changes, i.e. when a station is added or removed, so that
+  *	userspace can tell whether it got a consistent snapshot.
+ * @assoc_req_ies: IEs from (Re)Association Request.
+ *	This is used only when in AP mode with drivers that do not use
+ *	user space MLME/SME implementation. The information is provided for
+ *	the cfg80211_new_sta() calls to notify user space of the IEs.
+ * @assoc_req_ies_len: Length of assoc_req_ies buffer in octets.
+  */
+ struct station_info {
+ 	u32 filled;
+@@ -558,6 +565,9 @@
+ 	struct sta_bss_parameters bss_param;
+ 
+ 	int generation;
+
+	const u8 *assoc_req_ies;
+	size_t assoc_req_ies_len;
+ };
+ 
+ /**
+diff -urN linux-3.0.42/net/wireless/nl80211.c linux-3.0.42-patch/net/wireless/nl80211.c
+--- linux-3.0.42/net/wireless/nl80211.c	2012-09-05 21:03:25.528853240 +0800
+++ linux-3.0.42-patch/net/wireless/nl80211.c	2012-09-05 20:47:08.472824000 +0800
+@@ -2213,6 +2213,10 @@
+ 	}
+ 	nla_nest_end(msg, sinfoattr);
+ 
+	if (sinfo->filled & STATION_INFO_ASSOC_REQ_IES)
+		NLA_PUT(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
+			sinfo->assoc_req_ies);
+
+ 	return genlmsg_end(msg, hdr);
+ 
+  nla_put_failure:
--- a/android/android_ref_codes_M_6.x/realtek_wifi_SDK_for_android_M_6.x_20151116.tgz
+++ b/android/android_ref_codes_M_6.x/realtek_wifi_SDK_for_android_M_6.x_20151116.tgz
--- a/android/android_ref_codes_N_7.0/Realtek_Wi-Fi_SDK_for_Android_N_7.0.pdf
+++ b/android/android_ref_codes_N_7.0/Realtek_Wi-Fi_SDK_for_Android_N_7.0.pdf
--- a/android/android_ref_codes_N_7.0/linux-3.0.42_STATION_INFO_ASSOC_REQ_IES.diff
+++ b/android/android_ref_codes_N_7.0/linux-3.0.42_STATION_INFO_ASSOC_REQ_IES.diff
@@ -0,0 +1,57 @@
+diff -urN linux-3.0.42/include/net/cfg80211.h linux-3.0.42-patch/include/net/cfg80211.h
+--- linux-3.0.42/include/net/cfg80211.h	2012-09-05 21:02:06.960467827 +0800
+++ linux-3.0.42-patch/include/net/cfg80211.h	2012-09-05 21:00:09.775049000 +0800
+@@ -426,6 +426,7 @@
+  * @STATION_INFO_RX_BITRATE: @rxrate fields are filled
+  * @STATION_INFO_BSS_PARAM: @bss_param filled
+  * @STATION_INFO_CONNECTED_TIME: @connected_time filled
+ * @STATION_INFO_ASSOC_REQ_IES: @assoc_req_ies filled
+  */
+ enum station_info_flags {
+ 	STATION_INFO_INACTIVE_TIME	= 1<<0,
+@@ -444,7 +445,8 @@
+ 	STATION_INFO_SIGNAL_AVG		= 1<<13,
+ 	STATION_INFO_RX_BITRATE		= 1<<14,
+ 	STATION_INFO_BSS_PARAM          = 1<<15,
+-	STATION_INFO_CONNECTED_TIME	= 1<<16
+	STATION_INFO_CONNECTED_TIME	= 1<<16,
+	STATION_INFO_ASSOC_REQ_IES	= 1<<17
+ };
+ 
+ /**
+@@ -536,6 +538,11 @@
+  *	This number should increase every time the list of stations
+  *	changes, i.e. when a station is added or removed, so that
+  *	userspace can tell whether it got a consistent snapshot.
+ * @assoc_req_ies: IEs from (Re)Association Request.
+ *	This is used only when in AP mode with drivers that do not use
+ *	user space MLME/SME implementation. The information is provided for
+ *	the cfg80211_new_sta() calls to notify user space of the IEs.
+ * @assoc_req_ies_len: Length of assoc_req_ies buffer in octets.
+  */
+ struct station_info {
+ 	u32 filled;
+@@ -558,6 +565,9 @@
+ 	struct sta_bss_parameters bss_param;
+ 
+ 	int generation;
+
+	const u8 *assoc_req_ies;
+	size_t assoc_req_ies_len;
+ };
+ 
+ /**
+diff -urN linux-3.0.42/net/wireless/nl80211.c linux-3.0.42-patch/net/wireless/nl80211.c
+--- linux-3.0.42/net/wireless/nl80211.c	2012-09-05 21:03:25.528853240 +0800
+++ linux-3.0.42-patch/net/wireless/nl80211.c	2012-09-05 20:47:08.472824000 +0800
+@@ -2213,6 +2213,10 @@
+ 	}
+ 	nla_nest_end(msg, sinfoattr);
+ 
+	if (sinfo->filled & STATION_INFO_ASSOC_REQ_IES)
+		NLA_PUT(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
+			sinfo->assoc_req_ies);
+
+ 	return genlmsg_end(msg, hdr);
+ 
+  nla_put_failure:
--- a/android/android_ref_codes_N_7.0/realtek_wifi_SDK_for_android_N_7.0_20161024.zip
+++ b/android/android_ref_codes_N_7.0/realtek_wifi_SDK_for_android_N_7.0_20161024.zip
--- a/android/android_ref_codes_O_8.0/Realtek_Wi-Fi_SDK_for_Android_O_8.0.pdf
+++ b/android/android_ref_codes_O_8.0/Realtek_Wi-Fi_SDK_for_Android_O_8.0.pdf
--- a/android/android_ref_codes_O_8.0/linux-3.0.42_STATION_INFO_ASSOC_REQ_IES.diff
+++ b/android/android_ref_codes_O_8.0/linux-3.0.42_STATION_INFO_ASSOC_REQ_IES.diff
@@ -0,0 +1,57 @@
+diff -urN linux-3.0.42/include/net/cfg80211.h linux-3.0.42-patch/include/net/cfg80211.h
+--- linux-3.0.42/include/net/cfg80211.h	2012-09-05 21:02:06.960467827 +0800
+++ linux-3.0.42-patch/include/net/cfg80211.h	2012-09-05 21:00:09.775049000 +0800
+@@ -426,6 +426,7 @@
+  * @STATION_INFO_RX_BITRATE: @rxrate fields are filled
+  * @STATION_INFO_BSS_PARAM: @bss_param filled
+  * @STATION_INFO_CONNECTED_TIME: @connected_time filled
+ * @STATION_INFO_ASSOC_REQ_IES: @assoc_req_ies filled
+  */
+ enum station_info_flags {
+ 	STATION_INFO_INACTIVE_TIME	= 1<<0,
+@@ -444,7 +445,8 @@
+ 	STATION_INFO_SIGNAL_AVG		= 1<<13,
+ 	STATION_INFO_RX_BITRATE		= 1<<14,
+ 	STATION_INFO_BSS_PARAM          = 1<<15,
+-	STATION_INFO_CONNECTED_TIME	= 1<<16
+	STATION_INFO_CONNECTED_TIME	= 1<<16,
+	STATION_INFO_ASSOC_REQ_IES	= 1<<17
+ };
+ 
+ /**
+@@ -536,6 +538,11 @@
+  *	This number should increase every time the list of stations
+  *	changes, i.e. when a station is added or removed, so that
+  *	userspace can tell whether it got a consistent snapshot.
+ * @assoc_req_ies: IEs from (Re)Association Request.
+ *	This is used only when in AP mode with drivers that do not use
+ *	user space MLME/SME implementation. The information is provided for
+ *	the cfg80211_new_sta() calls to notify user space of the IEs.
+ * @assoc_req_ies_len: Length of assoc_req_ies buffer in octets.
+  */
+ struct station_info {
+ 	u32 filled;
+@@ -558,6 +565,9 @@
+ 	struct sta_bss_parameters bss_param;
+ 
+ 	int generation;
+
+	const u8 *assoc_req_ies;
+	size_t assoc_req_ies_len;
+ };
+ 
+ /**
+diff -urN linux-3.0.42/net/wireless/nl80211.c linux-3.0.42-patch/net/wireless/nl80211.c
+--- linux-3.0.42/net/wireless/nl80211.c	2012-09-05 21:03:25.528853240 +0800
+++ linux-3.0.42-patch/net/wireless/nl80211.c	2012-09-05 20:47:08.472824000 +0800
+@@ -2213,6 +2213,10 @@
+ 	}
+ 	nla_nest_end(msg, sinfoattr);
+ 
+	if (sinfo->filled & STATION_INFO_ASSOC_REQ_IES)
+		NLA_PUT(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
+			sinfo->assoc_req_ies);
+
+ 	return genlmsg_end(msg, hdr);
+ 
+  nla_put_failure:
--- a/android/android_ref_codes_O_8.0/realtek_wifi_SDK_for_android_O_8.0_20181001.tar.gz
+++ b/android/android_ref_codes_O_8.0/realtek_wifi_SDK_for_android_O_8.0_20181001.tar.gz
--- a/android/android_ref_codes_P_9.x/Realtek_Wi-Fi_SDK_for_Android_P_9.pdf
+++ b/android/android_ref_codes_P_9.x/Realtek_Wi-Fi_SDK_for_Android_P_9.pdf
--- a/android/android_ref_codes_P_9.x/linux-3.0.42_STATION_INFO_ASSOC_REQ_IES.diff
+++ b/android/android_ref_codes_P_9.x/linux-3.0.42_STATION_INFO_ASSOC_REQ_IES.diff
@@ -0,0 +1,57 @@
+diff -urN linux-3.0.42/include/net/cfg80211.h linux-3.0.42-patch/include/net/cfg80211.h
+--- linux-3.0.42/include/net/cfg80211.h	2012-09-05 21:02:06.960467827 +0800
+++ linux-3.0.42-patch/include/net/cfg80211.h	2012-09-05 21:00:09.775049000 +0800
+@@ -426,6 +426,7 @@
+  * @STATION_INFO_RX_BITRATE: @rxrate fields are filled
+  * @STATION_INFO_BSS_PARAM: @bss_param filled
+  * @STATION_INFO_CONNECTED_TIME: @connected_time filled
+ * @STATION_INFO_ASSOC_REQ_IES: @assoc_req_ies filled
+  */
+ enum station_info_flags {
+ 	STATION_INFO_INACTIVE_TIME	= 1<<0,
+@@ -444,7 +445,8 @@
+ 	STATION_INFO_SIGNAL_AVG		= 1<<13,
+ 	STATION_INFO_RX_BITRATE		= 1<<14,
+ 	STATION_INFO_BSS_PARAM          = 1<<15,
+-	STATION_INFO_CONNECTED_TIME	= 1<<16
+	STATION_INFO_CONNECTED_TIME	= 1<<16,
+	STATION_INFO_ASSOC_REQ_IES	= 1<<17
+ };
+ 
+ /**
+@@ -536,6 +538,11 @@
+  *	This number should increase every time the list of stations
+  *	changes, i.e. when a station is added or removed, so that
+  *	userspace can tell whether it got a consistent snapshot.
+ * @assoc_req_ies: IEs from (Re)Association Request.
+ *	This is used only when in AP mode with drivers that do not use
+ *	user space MLME/SME implementation. The information is provided for
+ *	the cfg80211_new_sta() calls to notify user space of the IEs.
+ * @assoc_req_ies_len: Length of assoc_req_ies buffer in octets.
+  */
+ struct station_info {
+ 	u32 filled;
+@@ -558,6 +565,9 @@
+ 	struct sta_bss_parameters bss_param;
+ 
+ 	int generation;
+
+	const u8 *assoc_req_ies;
+	size_t assoc_req_ies_len;
+ };
+ 
+ /**
+diff -urN linux-3.0.42/net/wireless/nl80211.c linux-3.0.42-patch/net/wireless/nl80211.c
+--- linux-3.0.42/net/wireless/nl80211.c	2012-09-05 21:03:25.528853240 +0800
+++ linux-3.0.42-patch/net/wireless/nl80211.c	2012-09-05 20:47:08.472824000 +0800
+@@ -2213,6 +2213,10 @@
+ 	}
+ 	nla_nest_end(msg, sinfoattr);
+ 
+	if (sinfo->filled & STATION_INFO_ASSOC_REQ_IES)
+		NLA_PUT(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
+			sinfo->assoc_req_ies);
+
+ 	return genlmsg_end(msg, hdr);
+ 
+  nla_put_failure:
--- a/android/android_ref_codes_P_9.x/realtek_wifi_SDK_for_android_P_9.x_20181001.tar.gz
+++ b/android/android_ref_codes_P_9.x/realtek_wifi_SDK_for_android_P_9.x_20181001.tar.gz
--- a/core/efuse/rtw_efuse.c
+++ b/core/efuse/rtw_efuse.c
@@ -62,7 +62,7 @@ BOOLEAN efuse_IsMasked(PADAPTER pAdapter, u16 Offset)
 	if (pAdapter->registrypriv.boffefusemask)
 		return FALSE;

-#if DEV_BUS_TYPE == RT_USB_INTERFACE
+#ifdef CONFIG_USB_HCI
 #if defined(CONFIG_RTL8188E)
 	if (IS_HARDWARE_TYPE_8188E(pAdapter))
 		return (IS_MASKED(8188E, _MUSB, Offset)) ? TRUE : FALSE;
@@ -99,6 +99,10 @@ BOOLEAN efuse_IsMasked(PADAPTER pAdapter, u16 Offset)
 	if (IS_HARDWARE_TYPE_8188F(pAdapter))
 		return (IS_MASKED(8188F, _MUSB, Offset)) ? TRUE : FALSE;
 #endif
+#if defined(CONFIG_RTL8188GTV)
+	if (IS_HARDWARE_TYPE_8188GTV(pAdapter))
+		return (IS_MASKED(8188GTV, _MUSB, Offset)) ? TRUE : FALSE;
+#endif
 #if defined(CONFIG_RTL8822B)
 	if (IS_HARDWARE_TYPE_8822B(pAdapter))
 		return (IS_MASKED(8822B, _MUSB, Offset)) ? TRUE : FALSE;
@@ -107,13 +111,22 @@ BOOLEAN efuse_IsMasked(PADAPTER pAdapter, u16 Offset)
 	if (IS_HARDWARE_TYPE_8723D(pAdapter))
 		return (IS_MASKED(8723D, _MUSB, Offset)) ? TRUE : FALSE;
 #endif
-
+#if defined(CONFIG_RTL8710B)
+	if (IS_HARDWARE_TYPE_8710B(pAdapter))
+		return (IS_MASKED(8710B, _MUSB, Offset)) ? TRUE : FALSE;
+#endif
 #if defined(CONFIG_RTL8821C)
 	if (IS_HARDWARE_TYPE_8821CU(pAdapter))
 		return (IS_MASKED(8821C, _MUSB, Offset)) ? TRUE : FALSE;
 #endif

-#elif DEV_BUS_TYPE == RT_PCI_INTERFACE
+#if defined(CONFIG_RTL8192F)
+	if (IS_HARDWARE_TYPE_8192FU(pAdapter))
+		return (IS_MASKED(8192F, _MUSB, Offset)) ? TRUE : FALSE;
+#endif
+#endif /*CONFIG_USB_HCI*/
+
+#ifdef CONFIG_PCI_HCI
 #if defined(CONFIG_RTL8188E)
 	if (IS_HARDWARE_TYPE_8188E(pAdapter))
 		return (IS_MASKED(8188E, _MPCIE, Offset)) ? TRUE : FALSE;
@@ -147,7 +160,13 @@ BOOLEAN efuse_IsMasked(PADAPTER pAdapter, u16 Offset)
 		return (IS_MASKED(8821C, _MPCIE, Offset)) ? TRUE : FALSE;
 #endif

-#elif DEV_BUS_TYPE == RT_SDIO_INTERFACE
+#if defined(CONFIG_RTL8192F)
+	if (IS_HARDWARE_TYPE_8192FE(pAdapter))
+		return (IS_MASKED(8192F, _MPCIE, Offset)) ? TRUE : FALSE;
+#endif
+#endif /*CONFIG_PCI_HCI*/
+
+#ifdef CONFIG_SDIO_HCI
 #ifdef CONFIG_RTL8188E_SDIO
 	if (IS_HARDWARE_TYPE_8188E(pAdapter))
 		return (IS_MASKED(8188E, _MSDIO, Offset)) ? TRUE : FALSE;
@@ -156,10 +175,14 @@ BOOLEAN efuse_IsMasked(PADAPTER pAdapter, u16 Offset)
 	if (IS_HARDWARE_TYPE_8723BS(pAdapter))
 		return (IS_MASKED(8723B, _MSDIO, Offset)) ? TRUE : FALSE;
 #endif
-#ifdef CONFIG_RTL8188F_SDIO
+#ifdef CONFIG_RTL8188F
 	if (IS_HARDWARE_TYPE_8188F(pAdapter))
 		return (IS_MASKED(8188F, _MSDIO, Offset)) ? TRUE : FALSE;
 #endif
+#ifdef CONFIG_RTL8188GTV
+	if (IS_HARDWARE_TYPE_8188GTV(pAdapter))
+		return (IS_MASKED(8188GTV, _MSDIO, Offset)) ? TRUE : FALSE;
+#endif
 #ifdef CONFIG_RTL8192E
 	if (IS_HARDWARE_TYPE_8192ES(pAdapter))
 		return (IS_MASKED(8192E, _MSDIO, Offset)) ? TRUE : FALSE;
@@ -176,7 +199,11 @@ BOOLEAN efuse_IsMasked(PADAPTER pAdapter, u16 Offset)
 	if (IS_HARDWARE_TYPE_8822B(pAdapter))
 		return (IS_MASKED(8822B, _MSDIO, Offset)) ? TRUE : FALSE;
 #endif
+#if defined(CONFIG_RTL8192F)
+	if (IS_HARDWARE_TYPE_8192FS(pAdapter))
+		return (IS_MASKED(8192F, _MSDIO, Offset)) ? TRUE : FALSE;
 #endif
+#endif /*CONFIG_SDIO_HCI*/

 	return FALSE;
 }
@@ -185,7 +212,7 @@ void rtw_efuse_mask_array(PADAPTER pAdapter, u8 *pArray)
 {
 	PHAL_DATA_TYPE pHalData = GET_HAL_DATA(pAdapter);

-#if DEV_BUS_TYPE == RT_USB_INTERFACE
+#ifdef CONFIG_USB_HCI
 #if defined(CONFIG_RTL8188E)
 	if (IS_HARDWARE_TYPE_8188E(pAdapter))
 		GET_MASK_ARRAY(8188E, _MUSB, pArray);
@@ -214,6 +241,10 @@ void rtw_efuse_mask_array(PADAPTER pAdapter, u8 *pArray)
 	if (IS_HARDWARE_TYPE_8188F(pAdapter))
 		GET_MASK_ARRAY(8188F, _MUSB, pArray);
 #endif
+#if defined(CONFIG_RTL8188GTV)
+	if (IS_HARDWARE_TYPE_8188GTV(pAdapter))
+		GET_MASK_ARRAY(8188GTV, _MUSB, pArray);
+#endif
 #if defined(CONFIG_RTL8814A)
 	if (IS_HARDWARE_TYPE_8814A(pAdapter))
 		GET_MASK_ARRAY(8814A, _MUSB, pArray);
@@ -226,9 +257,13 @@ void rtw_efuse_mask_array(PADAPTER pAdapter, u8 *pArray)
 	if (IS_HARDWARE_TYPE_8821CU(pAdapter))
 		GET_MASK_ARRAY(8821C, _MUSB, pArray);
 #endif
+#if defined(CONFIG_RTL8192F)
+	if (IS_HARDWARE_TYPE_8192FU(pAdapter))
+		GET_MASK_ARRAY(8192F, _MUSB, pArray);
+#endif
+#endif /*CONFIG_USB_HCI*/

-
-#elif DEV_BUS_TYPE == RT_PCI_INTERFACE
+#ifdef CONFIG_PCI_HCI
 #if defined(CONFIG_RTL8188E)
 	if (IS_HARDWARE_TYPE_8188E(pAdapter))
 		GET_MASK_ARRAY(8188E, _MPCIE, pArray);
@@ -261,9 +296,13 @@ void rtw_efuse_mask_array(PADAPTER pAdapter, u8 *pArray)
 	if (IS_HARDWARE_TYPE_8821CE(pAdapter))
 		GET_MASK_ARRAY(8821C, _MPCIE, pArray);
 #endif
+#if defined(CONFIG_RTL8192F)
+	if (IS_HARDWARE_TYPE_8192FE(pAdapter))
+		GET_MASK_ARRAY(8192F, _MPCIE, pArray);
+#endif
+#endif /*CONFIG_PCI_HCI*/

-
-#elif DEV_BUS_TYPE == RT_SDIO_INTERFACE
+#ifdef CONFIG_SDIO_HCI
 #if defined(CONFIG_RTL8188E)
 	if (IS_HARDWARE_TYPE_8188E(pAdapter))
 		GET_MASK_ARRAY(8188E, _MSDIO, pArray);
@@ -276,6 +315,10 @@ void rtw_efuse_mask_array(PADAPTER pAdapter, u8 *pArray)
 	if (IS_HARDWARE_TYPE_8188F(pAdapter))
 		GET_MASK_ARRAY(8188F, _MSDIO, pArray);
 #endif
+#if defined(CONFIG_RTL8188GTV)
+	if (IS_HARDWARE_TYPE_8188GTV(pAdapter))
+		GET_MASK_ARRAY(8188GTV, _MSDIO, pArray);
+#endif
 #if defined(CONFIG_RTL8192E)
 	if (IS_HARDWARE_TYPE_8192ES(pAdapter))
 		GET_MASK_ARRAY(8192E, _MSDIO, pArray);
@@ -292,14 +335,18 @@ void rtw_efuse_mask_array(PADAPTER pAdapter, u8 *pArray)
 	if (IS_HARDWARE_TYPE_8822B(pAdapter))
 		GET_MASK_ARRAY(8822B , _MSDIO, pArray);
 #endif
-#endif /*#elif DEV_BUS_TYPE == RT_SDIO_INTERFACE*/
+#if defined(CONFIG_RTL8192F)
+	if (IS_HARDWARE_TYPE_8192FS(pAdapter))
+		GET_MASK_ARRAY(8192F, _MSDIO, pArray);
+#endif
+#endif /*CONFIG_SDIO_HCI*/
 }

 u16 rtw_get_efuse_mask_arraylen(PADAPTER pAdapter)
 {
 	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);

-#if DEV_BUS_TYPE == RT_USB_INTERFACE
+#ifdef CONFIG_USB_HCI
 #if defined(CONFIG_RTL8188E)
 	if (IS_HARDWARE_TYPE_8188E(pAdapter))
 		return GET_MASK_ARRAY_LEN(8188E, _MUSB);
@@ -328,6 +375,10 @@ u16 rtw_get_efuse_mask_arraylen(PADAPTER pAdapter)
 	if (IS_HARDWARE_TYPE_8188F(pAdapter))
 		return GET_MASK_ARRAY_LEN(8188F, _MUSB);
 #endif
+#if defined(CONFIG_RTL8188GTV)
+	if (IS_HARDWARE_TYPE_8188GTV(pAdapter))
+		return GET_MASK_ARRAY_LEN(8188GTV, _MUSB);
+#endif
 #if defined(CONFIG_RTL8814A)
 	if (IS_HARDWARE_TYPE_8814A(pAdapter))
 		return GET_MASK_ARRAY_LEN(8814A, _MUSB);
@@ -340,9 +391,13 @@ u16 rtw_get_efuse_mask_arraylen(PADAPTER pAdapter)
 	if (IS_HARDWARE_TYPE_8821CU(pAdapter))
 		return GET_MASK_ARRAY_LEN(8821C, _MUSB);
 #endif
+#if defined(CONFIG_RTL8192F)
+	if (IS_HARDWARE_TYPE_8192FU(pAdapter))
+		return GET_MASK_ARRAY_LEN(8192F, _MUSB);
+#endif
+#endif /*CONFIG_USB_HCI*/

-
-#elif DEV_BUS_TYPE == RT_PCI_INTERFACE
+#ifdef CONFIG_PCI_HCI
 #if defined(CONFIG_RTL8188E)
 	if (IS_HARDWARE_TYPE_8188E(pAdapter))
 		return GET_MASK_ARRAY_LEN(8188E, _MPCIE);
@@ -375,9 +430,13 @@ u16 rtw_get_efuse_mask_arraylen(PADAPTER pAdapter)
 	if (IS_HARDWARE_TYPE_8821CE(pAdapter))
 		return GET_MASK_ARRAY_LEN(8821C, _MPCIE);
 #endif
+#if defined(CONFIG_RTL8192F)
+	if (IS_HARDWARE_TYPE_8192FE(pAdapter))
+		return GET_MASK_ARRAY_LEN(8192F, _MPCIE);
+#endif
+#endif /*CONFIG_PCI_HCI*/

-
-#elif DEV_BUS_TYPE == RT_SDIO_INTERFACE
+#ifdef CONFIG_SDIO_HCI
 #if defined(CONFIG_RTL8188E)
 	if (IS_HARDWARE_TYPE_8188E(pAdapter))
 		return GET_MASK_ARRAY_LEN(8188E, _MSDIO);
@@ -390,6 +449,10 @@ u16 rtw_get_efuse_mask_arraylen(PADAPTER pAdapter)
 	if (IS_HARDWARE_TYPE_8188F(pAdapter))
 		return GET_MASK_ARRAY_LEN(8188F, _MSDIO);
 #endif
+#if defined(CONFIG_RTL8188GTV)
+	if (IS_HARDWARE_TYPE_8188GTV(pAdapter))
+		return GET_MASK_ARRAY_LEN(8188GTV, _MSDIO);
+#endif
 #if defined(CONFIG_RTL8192E)
 	if (IS_HARDWARE_TYPE_8192ES(pAdapter))
 		return GET_MASK_ARRAY_LEN(8192E, _MSDIO);
@@ -406,7 +469,11 @@ u16 rtw_get_efuse_mask_arraylen(PADAPTER pAdapter)
 	if (IS_HARDWARE_TYPE_8822B(pAdapter))
 		return GET_MASK_ARRAY_LEN(8822B, _MSDIO);
 #endif
+#if defined(CONFIG_RTL8192F)
+	if (IS_HARDWARE_TYPE_8192FS(pAdapter))
+		return GET_MASK_ARRAY_LEN(8192F, _MSDIO);
 #endif
+#endif/*CONFIG_SDIO_HCI*/
 	return 0;
 }

@@ -577,7 +644,7 @@ void rtw_efuse_analyze(PADAPTER	padapter, u8 Type, u8 Fake)
 	for (bank = startBank; bank <= endBank; bank++) {
 		if (!hal_EfuseSwitchToBank(padapter, bank, bPseudoTest)) {
 			RTW_INFO("EFUSE_SwitchToBank() Fail!!\n");
-			return;
+			goto out_free_buffer;
 		}

 		eFuse_Addr = bank * EFUSE_MAX_BANK_SIZE;
@@ -586,7 +653,7 @@ void rtw_efuse_analyze(PADAPTER	padapter, u8 Type, u8 Fake)

 		if (efuseHeader == 0xFF && bank == startBank && Fake != TRUE) {
 			RTW_INFO("Non-PGed Efuse\n");
-			return;
+			goto out_free_buffer;
 		}
 		RTW_INFO("EFUSE_REAL_CONTENT_LEN = %d\n", maprawlen);

@@ -719,6 +786,8 @@ void rtw_efuse_analyze(PADAPTER	padapter, u8 Type, u8 Fake)
 			);
 		}
 	_RTW_PRINT_SEL(RTW_DBGDUMP, "\n");
+
+out_free_buffer:
 	if (eFuseWord)
 		rtw_mfree((u8 *)eFuseWord, EFUSE_MAX_SECTION_NUM * (EFUSE_MAX_WORD_UNIT * 2));
 }
@@ -1997,6 +2066,14 @@ efuse_OneByteRead(
 		return bResult;
 	}

+#ifdef CONFIG_RTL8710B
+	/* <20171208, Peter>, Dont do the following write16(0x34) */
+	if (IS_HARDWARE_TYPE_8710B(pAdapter)) {
+		bResult = pAdapter->hal_func.efuse_indirect_read4(pAdapter, addr, data);
+		return bResult;
+	}
+#endif
+
 	if (IS_HARDWARE_TYPE_8723B(pAdapter) ||
 	    (IS_HARDWARE_TYPE_8192E(pAdapter) && (!IS_A_CUT(pHalData->version_id))) ||
 	    (IS_VENDOR_8188E_I_CUT_SERIES(pAdapter)) || (IS_CHIP_VENDOR_SMIC(pHalData->version_id))
@@ -2687,31 +2764,6 @@ EFUSE_ShadowWrite(

 }	/* EFUSE_ShadowWrite */

-VOID
-Efuse_InitSomeVar(
-	IN		PADAPTER	pAdapter
-);
-VOID
-Efuse_InitSomeVar(
-	IN		PADAPTER	pAdapter
-)
-{
-	u8 i;
-
-	_rtw_memset((PVOID)&fakeEfuseContent[0], 0xff, EFUSE_MAX_HW_SIZE);
-	_rtw_memset((PVOID)&fakeEfuseInitMap[0], 0xff, EFUSE_MAX_MAP_LEN);
-	_rtw_memset((PVOID)&fakeEfuseModifiedMap[0], 0xff, EFUSE_MAX_MAP_LEN);
-
-	for (i = 0; i < EFUSE_MAX_BT_BANK; i++)
-		_rtw_memset((PVOID)&BTEfuseContent[i][0], EFUSE_MAX_HW_SIZE, 0xff);
-	_rtw_memset((PVOID)&BTEfuseInitMap[0], 0xff, EFUSE_BT_MAX_MAP_LEN);
-	_rtw_memset((PVOID)&BTEfuseModifiedMap[0], 0xff, EFUSE_BT_MAX_MAP_LEN);
-
-	for (i = 0; i < EFUSE_MAX_BT_BANK; i++)
-		_rtw_memset((PVOID)&fakeBTEfuseContent[i][0], 0xff, EFUSE_MAX_HW_SIZE);
-	_rtw_memset((PVOID)&fakeBTEfuseInitMap[0], 0xff, EFUSE_BT_MAX_MAP_LEN);
-	_rtw_memset((PVOID)&fakeBTEfuseModifiedMap[0], 0xff, EFUSE_BT_MAX_MAP_LEN);
-}
 #endif /* !RTW_HALMAC */
 /*-----------------------------------------------------------------------------
 * Function:	efuse_ShadowRead1Byte
--- a/core/mesh/rtw_mesh.c
+++ b/core/mesh/rtw_mesh.c
@@ -234,6 +234,259 @@ exit:
 	return ret;
 }

+void rtw_mesh_bss_peering_status(WLAN_BSSID_EX *bss, u8 *nop, u8 *accept)
+{
+	u8 *ie;
+	int ie_len;
+
+	if (nop)
+		*nop = 0;
+	if (accept)
+		*accept = 0;
+
+	ie = rtw_get_ie(BSS_EX_TLV_IES(bss), WLAN_EID_MESH_CONFIG, &ie_len,
+			BSS_EX_TLV_IES_LEN(bss));
+	if (!ie || ie_len != 7)
+		goto exit;
+
+	if (nop)
+		*nop = GET_MESH_CONF_ELE_NUM_OF_PEERINGS(ie + 2);
+	if (accept)
+		*accept = GET_MESH_CONF_ELE_ACCEPT_PEERINGS(ie + 2);
+
+exit:
+	return;
+}
+
+#if CONFIG_RTW_MESH_ACNODE_PREVENT
+void rtw_mesh_update_scanned_acnode_status(_adapter *adapter, struct wlan_network *scanned)
+{
+	bool acnode;
+	u8 nop, accept;
+
+	rtw_mesh_bss_peering_status(&scanned->network, &nop, &accept);
+
+	acnode = !nop && accept;
+
+	if (acnode && scanned->acnode_stime == 0) {
+		scanned->acnode_stime = rtw_get_current_time();
+		if (scanned->acnode_stime == 0)
+			scanned->acnode_stime++;
+	} else if (!acnode) {
+		scanned->acnode_stime = 0;
+		scanned->acnode_notify_etime = 0;
+	}
+}
+
+bool rtw_mesh_scanned_is_acnode_confirmed(_adapter *adapter, struct wlan_network *scanned)
+{
+	return scanned->acnode_stime
+			&& rtw_get_passing_time_ms(scanned->acnode_stime)
+				> adapter->mesh_cfg.peer_sel_policy.acnode_conf_timeout_ms;
+}
+
+static bool rtw_mesh_scanned_is_acnode_allow_notify(_adapter *adapter, struct wlan_network *scanned)
+{
+	return scanned->acnode_notify_etime
+			&& rtw_time_after(scanned->acnode_notify_etime, rtw_get_current_time());
+}
+
+bool rtw_mesh_acnode_prevent_allow_sacrifice(_adapter *adapter)
+{
+	struct rtw_mesh_cfg *mcfg = &adapter->mesh_cfg;
+	struct sta_priv *stapriv = &adapter->stapriv;
+	bool allow = 0;
+
+	if (!mcfg->peer_sel_policy.acnode_prevent
+		|| mcfg->max_peer_links <= 1
+		|| stapriv->asoc_list_cnt < mcfg->max_peer_links)
+		goto exit;
+
+#if CONFIG_RTW_MESH_CTO_MGATE_BLACKLIST
+	if (rtw_mesh_cto_mgate_required(adapter))
+		goto exit;
+#endif
+
+	allow = 1;
+
+exit:
+	return allow;
+}
+
+static bool rtw_mesh_acnode_candidate_exist(_adapter *adapter)
+{
+	struct rtw_mesh_cfg *mcfg = &adapter->mesh_cfg;
+	struct sta_priv *stapriv = &adapter->stapriv;
+	struct mlme_priv *mlme = &adapter->mlmepriv;
+	_queue *queue = &(mlme->scanned_queue);
+	_list *head, *list;
+	_irqL irqL;
+	struct wlan_network *scanned = NULL;
+	struct sta_info *sta = NULL;
+	bool need = 0;
+
+	_enter_critical_bh(&(mlme->scanned_queue.lock), &irqL);
+
+	head = get_list_head(queue);
+	list = get_next(head);
+	while (!rtw_end_of_queue_search(head, list)) {
+		scanned = LIST_CONTAINOR(list, struct wlan_network, list);
+		list = get_next(list);
+
+		if (rtw_get_passing_time_ms(scanned->last_scanned) < mcfg->peer_sel_policy.scanr_exp_ms
+			&& rtw_mesh_scanned_is_acnode_confirmed(adapter, scanned)
+			&& (!mcfg->rssi_threshold || mcfg->rssi_threshold <= scanned->network.Rssi)
+			#if CONFIG_RTW_MACADDR_ACL
+			&& rtw_access_ctrl(adapter, scanned->network.MacAddress) == _TRUE
+			#endif
+			&& rtw_bss_is_candidate_mesh_peer(&mlme->cur_network.network, &scanned->network, 1, 1)
+			#if CONFIG_RTW_MESH_PEER_BLACKLIST
+			&& !rtw_mesh_peer_blacklist_search(adapter, scanned->network.MacAddress)
+			#endif
+			#if CONFIG_RTW_MESH_CTO_MGATE_BLACKLIST
+			&& rtw_mesh_cto_mgate_network_filter(adapter, scanned)
+			#endif
+		) {
+			need = 1;
+			break;
+		}
+	}
+
+	_exit_critical_bh(&(mlme->scanned_queue.lock), &irqL);
+
+exit:
+	return need;
+}
+
+static int rtw_mesh_acnode_prevent_sacrifice_chk(_adapter *adapter, struct sta_info **sac, struct sta_info *com)
+{
+	struct rtw_mesh_cfg *mcfg = &adapter->mesh_cfg;
+	int updated = 0;
+
+	/*
+	* TODO: compare next_hop reference cnt of forwarding info
+	* don't sacrifice working next_hop or choose sta with least cnt
+	*/
+
+	if (*sac == NULL) {
+		updated = 1;
+		goto exit;
+	}
+
+#if CONFIG_RTW_MESH_CTO_MGATE_BLACKLIST
+	if (mcfg->peer_sel_policy.cto_mgate_require
+		&& !mcfg->dot11MeshGateAnnouncementProtocol
+	) {
+		if (IS_CTO_MGATE_CONF_TIMEOUT(com->plink)) {
+			if (!IS_CTO_MGATE_CONF_TIMEOUT((*sac)->plink)) {
+				/* blacklist > not blacklist */
+				updated = 1;
+				goto exit;
+			}
+		} else if (!IS_CTO_MGATE_CONF_DISABLED(com->plink)) {
+			if (IS_CTO_MGATE_CONF_DISABLED((*sac)->plink)) {
+				/* confirming > disabled */
+				updated = 1;
+				goto exit;
+			}
+		}
+	}
+#endif
+
+exit:
+	if (updated)
+		*sac = com;
+
+	return updated;
+}
+
+struct sta_info *_rtw_mesh_acnode_prevent_pick_sacrifice(_adapter *adapter)
+{
+	struct sta_priv *stapriv = &adapter->stapriv;
+	_list *head, *list;
+	struct sta_info *sta, *sacrifice = NULL;
+	u8 nop;
+
+	head = &stapriv->asoc_list;
+	list = get_next(head);
+	while (rtw_end_of_queue_search(head, list) == _FALSE) {
+		sta = LIST_CONTAINOR(list, struct sta_info, asoc_list);
+		list = get_next(list);
+
+		if (!sta->plink || !sta->plink->scanned) {
+			rtw_warn_on(1);
+			continue;
+		}
+
+		rtw_mesh_bss_peering_status(&sta->plink->scanned->network, &nop, NULL);
+		if (nop < 2)
+			continue;
+
+		rtw_mesh_acnode_prevent_sacrifice_chk(adapter, &sacrifice, sta);
+	}
+
+	return sacrifice;
+}
+
+struct sta_info *rtw_mesh_acnode_prevent_pick_sacrifice(_adapter *adapter)
+{
+	struct sta_priv *stapriv = &adapter->stapriv;
+	struct sta_info *sacrifice = NULL;
+
+	enter_critical_bh(&stapriv->asoc_list_lock);
+
+	sacrifice = _rtw_mesh_acnode_prevent_pick_sacrifice(adapter);
+
+	exit_critical_bh(&stapriv->asoc_list_lock);
+
+	return sacrifice;
+}
+
+static void rtw_mesh_acnode_rsvd_chk(_adapter *adapter)
+{
+	struct rtw_mesh_info *minfo = &adapter->mesh_info;
+	struct mesh_plink_pool *plink_ctl = &minfo->plink_ctl;
+	u8 acnode_rsvd = 0;
+
+	if (rtw_mesh_acnode_prevent_allow_sacrifice(adapter)
+		&& rtw_mesh_acnode_prevent_pick_sacrifice(adapter)
+		&& rtw_mesh_acnode_candidate_exist(adapter))
+		acnode_rsvd = 1;
+
+	if (plink_ctl->acnode_rsvd != acnode_rsvd) {
+		plink_ctl->acnode_rsvd = acnode_rsvd;
+		RTW_INFO(FUNC_ADPT_FMT" acnode_rsvd = %d\n", FUNC_ADPT_ARG(adapter), plink_ctl->acnode_rsvd);
+		update_beacon(adapter, WLAN_EID_MESH_CONFIG, NULL, 1);
+	}
+}
+
+static void rtw_mesh_acnode_set_notify_etime(_adapter *adapter, u8 *rframe_whdr)
+{
+	if (adapter->mesh_info.plink_ctl.acnode_rsvd) {
+		struct wlan_network *scanned = rtw_find_network(&adapter->mlmepriv.scanned_queue, get_addr2_ptr(rframe_whdr));
+
+		if (rtw_mesh_scanned_is_acnode_confirmed(adapter, scanned)) {
+			scanned->acnode_notify_etime = rtw_get_current_time()
+				+ rtw_ms_to_systime(adapter->mesh_cfg.peer_sel_policy.acnode_notify_timeout_ms);
+			if (scanned->acnode_notify_etime == 0)
+				scanned->acnode_notify_etime++;
+		}
+	}
+}
+
+void dump_mesh_acnode_prevent_settings(void *sel, _adapter *adapter)
+{
+	struct mesh_peer_sel_policy *peer_sel_policy = &adapter->mesh_cfg.peer_sel_policy;
+
+	RTW_PRINT_SEL(sel, "%-6s %-12s %-14s\n"
+		, "enable", "conf_timeout", "nofity_timeout");
+	RTW_PRINT_SEL(sel, "%6u %12u %14u\n"
+		, peer_sel_policy->acnode_prevent
+		, peer_sel_policy->acnode_conf_timeout_ms
+		, peer_sel_policy->acnode_notify_timeout_ms);
+}
+#endif /* CONFIG_RTW_MESH_ACNODE_PREVENT */
+
 #if CONFIG_RTW_MESH_PEER_BLACKLIST
 int rtw_mesh_peer_blacklist_add(_adapter *adapter, const u8 *addr)
 {
@@ -355,10 +608,9 @@ void dump_mesh_cto_mgate_blacklist_settings(void *sel, _adapter *adapter)
 {
 	struct mesh_peer_sel_policy *peer_sel_policy = &adapter->mesh_cfg.peer_sel_policy;

-	RTW_PRINT_SEL(sel, "%-7s %-12s %-17s\n"
-		, "require", "conf_timeout", "blacklist_timeout");
-	RTW_PRINT_SEL(sel, "%7u %12u %17u\n"
-		, peer_sel_policy->cto_mgate_require
+	RTW_PRINT_SEL(sel, "%-12s %-17s\n"
+		, "conf_timeout", "blacklist_timeout");
+	RTW_PRINT_SEL(sel, "%12u %17u\n"
 		, peer_sel_policy->cto_mgate_conf_timeout_ms
 		, peer_sel_policy->cto_mgate_blacklist_timeout_ms);
 }
@@ -406,6 +658,7 @@ void rtw_chk_candidate_peer_notify(_adapter *adapter, struct wlan_network *scann
 	struct rtw_mesh_info *minfo = &adapter->mesh_info;
 	struct rtw_mesh_cfg *mcfg = &adapter->mesh_cfg;
 	struct mesh_plink_pool *plink_ctl = &minfo->plink_ctl;
+	bool acnode = 0;

 	if (IS_CH_WAITING(rfctl) && !IS_UNDER_CAC(rfctl))
 		goto exit;
@@ -413,8 +666,16 @@ void rtw_chk_candidate_peer_notify(_adapter *adapter, struct wlan_network *scann
 	if (plink_ctl->num >= RTW_MESH_MAX_PEER_CANDIDATES)
 		goto exit;

+#if CONFIG_RTW_MESH_ACNODE_PREVENT
+	if (plink_ctl->acnode_rsvd) {
+		acnode = rtw_mesh_scanned_is_acnode_confirmed(adapter, scanned);
+		if (acnode && !rtw_mesh_scanned_is_acnode_allow_notify(adapter, scanned))
+			goto exit;
+	}
+#endif
+
 	/* wpa_supplicant's auto peer will initiate peering when candidate peer is reported without max_peer_links consideration */
-	if (plink_ctl->num >= mcfg->max_peer_links)
+	if (plink_ctl->num >= mcfg->max_peer_links + acnode ? 1 : 0)
 		goto exit;

 	if (rtw_get_passing_time_ms(scanned->last_scanned) >= mcfg->peer_sel_policy.scanr_exp_ms
@@ -433,14 +694,19 @@ void rtw_chk_candidate_peer_notify(_adapter *adapter, struct wlan_network *scann
 	)
 		goto exit;

+#if CONFIG_RTW_MESH_ACNODE_PREVENT
+	if (acnode) {
+		scanned->acnode_notify_etime = 0;
+		RTW_INFO(FUNC_ADPT_FMT" acnode "MAC_FMT"\n"
+			, FUNC_ADPT_ARG(adapter), MAC_ARG(scanned->network.MacAddress));
+	}
+#endif
+
 #ifdef CONFIG_IOCTL_CFG80211
 	rtw_cfg80211_notify_new_peer_candidate(adapter->rtw_wdev
 		, scanned->network.MacAddress
 		, BSS_EX_TLV_IES(&scanned->network)
 		, BSS_EX_TLV_IES_LEN(&scanned->network)
-		#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 0, 0))
-		, scanned->network.Rssi
-		#endif
 		, GFP_ATOMIC
 	);
 #endif
@@ -464,7 +730,7 @@ void rtw_mesh_peer_status_chk(_adapter *adapter)
 	u8 cto_mgate, forwarding, mgate;
 #endif
 	u8 flush;
-	char flush_list[NUM_STA];
+	s8 flush_list[NUM_STA];
 	u8 flush_num = 0;
 	int i;

@@ -582,14 +848,19 @@ flush_add:

 	exit_critical_bh(&(plink_ctl->lock));

-	for (i = 0; i < flush_num; i++) {
+	if (flush_num) {
 		u8 sta_addr[ETH_ALEN];
+		u8 updated = _FALSE;

-		sta = rtw_get_stainfo_by_offset(stapriv, flush_list[i]);
-		_rtw_memcpy(sta_addr, sta->cmn.mac_addr, ETH_ALEN);
+		for (i = 0; i < flush_num; i++) {
+			sta = rtw_get_stainfo_by_offset(stapriv, flush_list[i]);
+			_rtw_memcpy(sta_addr, sta->cmn.mac_addr, ETH_ALEN);

-		ap_free_sta(adapter, sta, _TRUE, WLAN_REASON_DEAUTH_LEAVING, _FALSE);
-		rtw_mesh_expire_peer(adapter, sta_addr);
+			updated |= ap_free_sta(adapter, sta, _TRUE, WLAN_REASON_DEAUTH_LEAVING, _FALSE);
+			rtw_mesh_expire_peer(adapter, sta_addr);
+		}
+
+		associated_clients_update(adapter, updated, STA_INFO_UPDATE_ALL);
 	}

 #if CONFIG_RTW_MESH_CTO_MGATE_BLACKLIST
@@ -597,6 +868,10 @@ flush_add:
 	rtw_mesh_cto_mgate_blacklist_chk(adapter);
 #endif

+#if CONFIG_RTW_MESH_ACNODE_PREVENT
+	rtw_mesh_acnode_rsvd_chk(adapter);
+#endif
+
 	return;
 }

@@ -654,10 +929,12 @@ u8 rtw_mesh_offch_candidate_accepted(_adapter *adapter)
 {
 	struct rtw_mesh_info *minfo = &adapter->mesh_info;
 	struct mesh_plink_pool *plink_ctl = &minfo->plink_ctl;
-	u8 ret;
+	u8 ret = 0;

-	ret = MLME_IS_MESH(adapter)
-		&& check_fwstate(&adapter->mlmepriv, WIFI_ASOC_STATE) == _TRUE
+	if (!adapter->mesh_cfg.peer_sel_policy.offch_cand)
+		goto exit;
+
+	ret = MLME_IS_MESH(adapter) && MLME_IS_ASOC(adapter)
 		&& (!plink_ctl->num || rtw_mesh_offch_cto_mgate_required(adapter))
 		;

@@ -666,12 +943,12 @@ u8 rtw_mesh_offch_candidate_accepted(_adapter *adapter)
 		struct mi_state mstate_no_self;

 		rtw_mi_status_no_self(adapter, &mstate_no_self);
-		if (MSTATE_STA_LD_NUM(&mstate_no_self) || MSTATE_AP_LD_NUM(&mstate_no_self)
-			|| MSTATE_ADHOC_LD_NUM(&mstate_no_self) || MSTATE_MESH_LD_NUM(&mstate_no_self))
+		if (MSTATE_STA_LD_NUM(&mstate_no_self))
 			ret = 0;
 	}
 #endif

+exit:
 	return ret;
 }

@@ -689,12 +966,15 @@ u8 rtw_mesh_select_operating_ch(_adapter *adapter)
 	_irqL irqL;
 	struct wlan_network *scanned = NULL;
 	int i;
+	/* statistics for candidate accept peering */
+	u8 cand_ap_cnt[MAX_CHANNEL_NUM] = {0};
+	u8 max_cand_ap_ch = 0;
+	u8 max_cand_ap_cnt = 0;
+	/* statistics for candidate including not accept peering */
+	u8 cand_cnt[MAX_CHANNEL_NUM] = {0};
 	u8 max_cand_ch = 0;
 	u8 max_cand_cnt = 0;

-	for (i = 0; i < rfctl->max_chan_nums; i++)
-		rfctl->channel_set[i].mesh_candidate_cnt = 0;
-
 	_enter_critical_bh(&(mlme->scanned_queue.lock), &irqL);

 	head = get_list_head(queue);
@@ -708,7 +988,7 @@ u8 rtw_mesh_select_operating_ch(_adapter *adapter)
 			#if CONFIG_RTW_MACADDR_ACL
 			&& rtw_access_ctrl(adapter, scanned->network.MacAddress) == _TRUE
 			#endif
-			&& rtw_bss_is_candidate_mesh_peer(&mlme->cur_network.network, &scanned->network, 0, 1)
+			&& rtw_bss_is_candidate_mesh_peer(&mlme->cur_network.network, &scanned->network, 0, 0)
 			#if CONFIG_RTW_MESH_PEER_BLACKLIST
 			&& !rtw_mesh_peer_blacklist_search(adapter, scanned->network.MacAddress)
 			#endif
@@ -721,18 +1001,38 @@ u8 rtw_mesh_select_operating_ch(_adapter *adapter)
 			if (ch_set_idx >= 0
 				&& !CH_IS_NON_OCP(&rfctl->channel_set[ch_set_idx])
 			) {
-				rfctl->channel_set[ch_set_idx].mesh_candidate_cnt++;
-				if (max_cand_cnt < rfctl->channel_set[ch_set_idx].mesh_candidate_cnt) {
-					max_cand_cnt = rfctl->channel_set[ch_set_idx].mesh_candidate_cnt;
+				u8 nop, accept;
+
+				rtw_mesh_bss_peering_status(&scanned->network, &nop, &accept);
+				cand_cnt[ch_set_idx]++;
+				if (max_cand_cnt < cand_cnt[ch_set_idx]) {
+					max_cand_cnt = cand_cnt[ch_set_idx];
 					max_cand_ch = rfctl->channel_set[ch_set_idx].ChannelNum;
 				}
+				if (accept) {
+					cand_ap_cnt[ch_set_idx]++;
+					if (max_cand_ap_cnt < cand_ap_cnt[ch_set_idx]) {
+						max_cand_ap_cnt = cand_ap_cnt[ch_set_idx];
+						max_cand_ap_ch = rfctl->channel_set[ch_set_idx].ChannelNum;
+					}
+				}
 			}
 		}
 	}

 	_exit_critical_bh(&(mlme->scanned_queue.lock), &irqL);

-	return max_cand_ch;
+	return max_cand_ap_ch ? max_cand_ap_ch : max_cand_ch;
+}
+
+void dump_mesh_offch_cand_settings(void *sel, _adapter *adapter)
+{
+	struct mesh_peer_sel_policy *peer_sel_policy = &adapter->mesh_cfg.peer_sel_policy;
+
+	RTW_PRINT_SEL(sel, "%-6s %-11s\n"
+		, "enable", "find_int_ms");
+	RTW_PRINT_SEL(sel, "%6u %11u\n"
+		, peer_sel_policy->offch_cand, peer_sel_policy->offch_find_int_ms);
 }
 #endif /* CONFIG_RTW_MESH_OFFCH_CAND */

@@ -740,36 +1040,24 @@ void dump_mesh_peer_sel_policy(void *sel, _adapter *adapter)
 {
 	struct mesh_peer_sel_policy *peer_sel_policy = &adapter->mesh_cfg.peer_sel_policy;

-#if CONFIG_RTW_MESH_OFFCH_CAND
-#define OFFCH_CAND_TITLE_FMT " %-17s"
-#define OFFCH_CAND_VALUE_FMT " %17u"
-#define OFFCH_CAND_TITLE_ARG , "offch_find_int_ms"
-#define OFFCH_CAND_VALUE_ARG , peer_sel_policy->offch_find_int_ms
-#else
-#define OFFCH_CAND_TITLE_FMT ""
-#define OFFCH_CAND_VALUE_FMT ""
-#define OFFCH_CAND_TITLE_ARG
-#define OFFCH_CAND_VALUE_ARG
-#endif
-
-	RTW_PRINT_SEL(sel,
-		"%-12s"
-		OFFCH_CAND_TITLE_FMT
-		"\n"
-		, "scanr_exp_ms"
-		OFFCH_CAND_TITLE_ARG
-	);
-	RTW_PRINT_SEL(sel,
-		"%12u"
-		OFFCH_CAND_VALUE_FMT
-		"\n"
-		, peer_sel_policy->scanr_exp_ms
-		OFFCH_CAND_VALUE_ARG
-	);
+	RTW_PRINT_SEL(sel, "%-12s\n", "scanr_exp_ms");
+	RTW_PRINT_SEL(sel, "%12u\n", peer_sel_policy->scanr_exp_ms);
 }

 void dump_mesh_networks(void *sel, _adapter *adapter)
 {
+#if CONFIG_RTW_MESH_ACNODE_PREVENT
+#define NSTATE_TITLE_FMT_ACN " %-5s"
+#define NSTATE_VALUE_FMT_ACN " %5d"
+#define NSTATE_TITLE_ARG_ACN , "acn"
+#define NSTATE_VALUE_ARG_ACN , (acn_ms < 99999 ? acn_ms : 99999)
+#else
+#define NSTATE_TITLE_FMT_ACN ""
+#define NSTATE_VALUE_FMT_ACN ""
+#define NSTATE_TITLE_ARG_ACN
+#define NSTATE_VALUE_ARG_ACN
+#endif
+
 	struct mlme_priv *mlme = &(adapter->mlmepriv);
 	_queue *queue = &(mlme->scanned_queue);
 	struct wlan_network	*network;
@@ -780,13 +1068,16 @@ void dump_mesh_networks(void *sel, _adapter *adapter)
 	u8 blocked;
 	u8 established;
 	s32 age_ms;
+#if CONFIG_RTW_MESH_ACNODE_PREVENT
+	s32 acn_ms;
+#endif
 	u8 *mesh_conf_ie;
 	sint mesh_conf_ie_len;
 	struct wlan_network **mesh_networks;
 	u8 mesh_network_cnt = 0;
 	int i;

-	mesh_networks = rtw_zvmalloc(MAX_BSS_CNT * sizeof(struct wlan_network *));
+	mesh_networks = rtw_zvmalloc(mlme->max_bss_cnt * sizeof(struct wlan_network *));
 	if (!mesh_networks)
 		return;

@@ -811,9 +1102,12 @@ void dump_mesh_networks(void *sel, _adapter *adapter)

 	exit_critical_bh(&queue->lock);

-	RTW_PRINT_SEL(sel, "  %-17s %-3s %-4s %-5s %-32s %-3s %-3s %-3s\n"
-		, "bssid", "ch", "rssi", "age", "mesh_id", "nop", "fwd", "cto");
-
+	RTW_PRINT_SEL(sel, "  %-17s %-3s %-4s %-5s %-32s %-3s %-3s %-3s"
+		NSTATE_TITLE_FMT_ACN
+		"\n"
+		, "bssid", "ch", "rssi", "age", "mesh_id", "nop", "fwd", "cto"
+		NSTATE_TITLE_ARG_ACN
+	);

 	for (i = 0; i < mesh_network_cnt; i++) {
 		network = mesh_networks[i];
@@ -827,6 +1121,12 @@ void dump_mesh_networks(void *sel, _adapter *adapter)
 			continue;

 		age_ms = rtw_get_passing_time_ms(network->last_scanned);
+		#if CONFIG_RTW_MESH_ACNODE_PREVENT
+		if (network->acnode_stime == 0)
+			acn_ms = 0;
+		else
+			acn_ms = rtw_get_passing_time_ms(network->acnode_stime);
+		#endif
 		same_mbss = 0;
 		candidate = 0;
 		plink = NULL;
@@ -847,7 +1147,9 @@ void dump_mesh_networks(void *sel, _adapter *adapter)
 				same_mbss = 1;
 		}

-		RTW_PRINT_SEL(sel, "%c "MAC_FMT" %3d %4ld %5d %-32s %c%2u %3u %c%c \n"
+		RTW_PRINT_SEL(sel, "%c "MAC_FMT" %3d %4ld %5d %-32s %c%2u %3u %c%c "
+			NSTATE_VALUE_FMT_ACN
+			"\n"
 			, established ? 'E' : (blocked ? 'B' : (plink ? 'N' : (candidate ? 'C' : (same_mbss ? 'S' : ' '))))
 			, MAC_ARG(network->network.MacAddress)
 			, network->network.Configuration.DSConfig
@@ -859,10 +1161,22 @@ void dump_mesh_networks(void *sel, _adapter *adapter)
 			, GET_MESH_CONF_ELE_FORWARDING(mesh_conf_ie + 2)
 			, GET_MESH_CONF_ELE_CTO_MGATE(mesh_conf_ie + 2) ? 'G' : ' '
 			, GET_MESH_CONF_ELE_CTO_AS(mesh_conf_ie + 2) ? 'A' : ' '
+			NSTATE_VALUE_ARG_ACN
 		);
 	}

-	rtw_vmfree(mesh_networks, MAX_BSS_CNT * sizeof(struct wlan_network *));
+	rtw_vmfree(mesh_networks, mlme->max_bss_cnt * sizeof(struct wlan_network *));
+}
+
+void rtw_mesh_adjust_chbw(u8 req_ch, u8 *req_bw, u8 *req_offset)
+{
+	if (req_ch >= 5 && req_ch <= 9) {
+		/* prevent secondary channel offset mismatch */
+		if (*req_bw > CHANNEL_WIDTH_20) {
+			*req_bw = CHANNEL_WIDTH_20;
+			*req_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+		}
+	}
 }

 int rtw_sae_check_frames(_adapter *adapter, const u8 *buf, u32 len, u8 tx)
@@ -1136,37 +1450,37 @@ struct mpm_frame_info {
 };

 /*
-* pid:0x0000 llid:0x0000 chosen_pmk:0x00000000000000000000000000000000
-* aid:0x0000 pid:0x0000 llid:0x0000 plid:0x0000 chosen_pmk:0x00000000000000000000000000000000
-* pid:0x0000 llid:0x0000 plid:0x0000 reason:0x0000 chosen_pmk:0x00000000000000000000000000000000
+* pid:00000 llid:00000 chosen_pmk:0x00000000000000000000000000000000
+* aid:00000 pid:00000 llid:00000 plid:00000 chosen_pmk:0x00000000000000000000000000000000
+* pid:00000 llid:00000 plid:00000 reason:00000 chosen_pmk:0x00000000000000000000000000000000
 */
-#define MPM_LOG_BUF_LEN 96 /* this length is limited for legal combination */
+#define MPM_LOG_BUF_LEN 92 /* this length is limited for legal combination */
 static void rtw_mpm_info_msg(struct mpm_frame_info *mpm_info, u8 *mpm_log_buf)
 {
 	int cnt = 0;

 	if (mpm_info->aid) {
-		cnt += snprintf(mpm_log_buf + cnt, MPM_LOG_BUF_LEN - cnt - 1, "aid:0x%04x ", mpm_info->aid_v);
+		cnt += snprintf(mpm_log_buf + cnt, MPM_LOG_BUF_LEN - cnt - 1, "aid:%u ", mpm_info->aid_v);
 		if (cnt >= MPM_LOG_BUF_LEN - 1)
 			goto exit;
 	}
 	if (mpm_info->pid) {
-		cnt += snprintf(mpm_log_buf + cnt, MPM_LOG_BUF_LEN - cnt - 1, "pid:0x%04x ", mpm_info->pid_v);
+		cnt += snprintf(mpm_log_buf + cnt, MPM_LOG_BUF_LEN - cnt - 1, "pid:%u ", mpm_info->pid_v);
 		if (cnt >= MPM_LOG_BUF_LEN - 1)
 			goto exit;
 	}
 	if (mpm_info->llid) {
-		cnt += snprintf(mpm_log_buf + cnt, MPM_LOG_BUF_LEN - cnt - 1, "llid:0x%04x ", mpm_info->llid_v);
+		cnt += snprintf(mpm_log_buf + cnt, MPM_LOG_BUF_LEN - cnt - 1, "llid:%u ", mpm_info->llid_v);
 		if (cnt >= MPM_LOG_BUF_LEN - 1)
 			goto exit;
 	}
 	if (mpm_info->plid) {
-		cnt += snprintf(mpm_log_buf + cnt, MPM_LOG_BUF_LEN - cnt - 1, "plid:0x%04x ", mpm_info->plid_v);
+		cnt += snprintf(mpm_log_buf + cnt, MPM_LOG_BUF_LEN - cnt - 1, "plid:%u ", mpm_info->plid_v);
 		if (cnt >= MPM_LOG_BUF_LEN - 1)
 			goto exit;
 	}
 	if (mpm_info->reason) {
-		cnt += snprintf(mpm_log_buf + cnt, MPM_LOG_BUF_LEN - cnt - 1, "reason:0x%04x ", mpm_info->reason_v);
+		cnt += snprintf(mpm_log_buf + cnt, MPM_LOG_BUF_LEN - cnt - 1, "reason:%u ", mpm_info->reason_v);
 		if (cnt >= MPM_LOG_BUF_LEN - 1)
 			goto exit;
 	}
@@ -1348,6 +1662,40 @@ bypass_sync_bss:
 			rtw_mesh_plink_set_peer_conf_timeout(adapter, peer_addr);

 	} else
+#endif
+#if CONFIG_RTW_MESH_ACNODE_PREVENT
+	if (action == RTW_ACT_SELF_PROTECTED_MESH_CLOSE) {
+		if (tx && mpm_info.reason && mpm_info.reason_v == WLAN_REASON_MESH_MAX_PEERS) {
+			if (rtw_mesh_scanned_is_acnode_confirmed(adapter, plink->scanned)
+				&& rtw_mesh_acnode_prevent_allow_sacrifice(adapter)
+			) {
+				struct sta_info *sac = rtw_mesh_acnode_prevent_pick_sacrifice(adapter);
+
+				if (sac) {
+					struct sta_priv *stapriv = &adapter->stapriv;
+					_irqL irqL;
+					u8 sta_addr[ETH_ALEN];
+					u8 updated = _FALSE;
+
+					_enter_critical_bh(&stapriv->asoc_list_lock, &irqL);
+					if (!rtw_is_list_empty(&sac->asoc_list)) {
+						rtw_list_delete(&sac->asoc_list);
+						stapriv->asoc_list_cnt--;
+						STA_SET_MESH_PLINK(sac, NULL);
+					}
+					_exit_critical_bh(&stapriv->asoc_list_lock, &irqL);
+					RTW_INFO(FUNC_ADPT_FMT" sacrifice "MAC_FMT" for acnode\n"
+						, FUNC_ADPT_ARG(adapter), MAC_ARG(sac->cmn.mac_addr));
+
+					_rtw_memcpy(sta_addr, sac->cmn.mac_addr, ETH_ALEN);
+					updated = ap_free_sta(adapter, sac, 0, 0, 1);
+					rtw_mesh_expire_peer(stapriv->padapter, sta_addr);
+
+					associated_clients_update(adapter, updated, STA_INFO_UPDATE_ALL);
+				}
+			}
+		}
+	} else
 #endif
 	if (action == RTW_ACT_SELF_PROTECTED_MESH_CONF) {
 		_irqL irqL;
@@ -1478,6 +1826,31 @@ int rtw_mesh_check_frames_rx(_adapter *adapter, const u8 *buf, size_t len)
 	return rtw_mesh_check_frames(adapter, &buf, &len, _FALSE);
 }

+int rtw_mesh_on_auth(_adapter *adapter, union recv_frame *rframe)
+{
+	u8 *whdr = rframe->u.hdr.rx_data;
+
+#if CONFIG_RTW_MACADDR_ACL
+	if (rtw_access_ctrl(adapter, get_addr2_ptr(whdr)) == _FALSE)
+		return _SUCCESS;
+#endif
+
+	if (!rtw_mesh_plink_get(adapter, get_addr2_ptr(whdr))) {
+		#if CONFIG_RTW_MESH_ACNODE_PREVENT
+		rtw_mesh_acnode_set_notify_etime(adapter, whdr);
+		#endif
+
+		if (adapter_to_rfctl(adapter)->offch_state == OFFCHS_NONE)
+			issue_probereq(adapter, &adapter->mlmepriv.cur_network.network.mesh_id, get_addr2_ptr(whdr));
+
+		/* only peer being added (checked by notify conditions) is allowed */
+		return _SUCCESS;
+	}
+
+	rtw_cfg80211_rx_mframe(adapter, rframe, NULL);
+	return _SUCCESS;
+}
+
 unsigned int on_action_self_protected(_adapter *adapter, union recv_frame *rframe)
 {
 	unsigned int ret = _FAIL;
@@ -1581,6 +1954,10 @@ bool rtw_mesh_update_bss_peering_status(_adapter *adapter, WLAN_BSSID_EX *bss)
 	int ie_len;
 	bool updated = 0;

+#if CONFIG_RTW_MESH_ACNODE_PREVENT
+	accept_peerings |= plink_ctl->acnode_rsvd;
+#endif
+
 	ie = rtw_get_ie(BSS_EX_TLV_IES(bss), WLAN_EID_MESH_CONFIG, &ie_len, BSS_EX_TLV_IES_LEN(bss));
 	if (!ie || ie_len != 7) {
 		rtw_warn_on(1);
@@ -1948,6 +2325,9 @@ void dump_mesh_plink_ctl(void *sel, _adapter *adapter)
 	int i;

 	RTW_PRINT_SEL(sel, "num:%u\n", plink_ctl->num);
+	#if CONFIG_RTW_MESH_ACNODE_PREVENT
+	RTW_PRINT_SEL(sel, "acnode_rsvd:%u\n", plink_ctl->acnode_rsvd);
+	#endif

 	for (i = 0; i < RTW_MESH_MAX_PEER_CANDIDATES; i++)  {
 		ent = &plink_ctl->ent[i];
@@ -2079,6 +2459,10 @@ int rtw_mesh_peer_establish(_adapter *adapter, struct mesh_plink_ent *plink, str
 		goto exit;

 	rtw_ap_parse_sta_wmm_ie(adapter, sta, tlv_ies, tlv_ieslen);
+#ifdef CONFIG_RTS_FULL_BW
+	/*check vendor IE*/
+	rtw_parse_sta_vendor_ie_8812(adapter, sta, tlv_ies, tlv_ieslen);
+#endif/*CONFIG_RTS_FULL_BW*/

 	rtw_ap_parse_sta_ht_ie(adapter, sta, &elems);
 	rtw_ap_parse_sta_vht_ie(adapter, sta, &elems);
@@ -2106,7 +2490,8 @@ int rtw_mesh_peer_establish(_adapter *adapter, struct mesh_plink_ent *plink, str
 	_enter_critical_bh(&stapriv->asoc_list_lock, &irqL);
 	if (rtw_is_list_empty(&sta->asoc_list)) {
 		STA_SET_MESH_PLINK(sta, plink);
-		sta->expire_to = mcfg->plink_timeout / 2;
+		/* TBD: up layer timeout mechanism */
+		/* sta->expire_to = mcfg->plink_timeout / 2; */
 		rtw_list_insert_tail(&sta->asoc_list, &stapriv->asoc_list);
 		stapriv->asoc_list_cnt++;
 	}
@@ -2131,9 +2516,6 @@ void rtw_mesh_expire_peer_notify(_adapter *adapter, const u8 *peer_addr)
 		, peer_addr
 		, null_ssid
 		, 2
-		#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 0, 0))
-		, 0
-		#endif
 		, GFP_ATOMIC
 	);
 #endif
@@ -2593,13 +2975,58 @@ static int rtw_mesh_decache(_adapter *adapter, const u8 *msa, u32 seq)
 	return rtw_mrc_check(adapter, msa, seq);
 }

+#ifndef RTW_MESH_SCAN_RESULT_EXP_MS
+#define RTW_MESH_SCAN_RESULT_EXP_MS (10 * 1000)
+#endif
+
+#ifndef RTW_MESH_ACNODE_PREVENT
+#define RTW_MESH_ACNODE_PREVENT 0
+#endif
+#ifndef RTW_MESH_ACNODE_CONF_TIMEOUT_MS
+#define RTW_MESH_ACNODE_CONF_TIMEOUT_MS (20 * 1000)
+#endif
+#ifndef RTW_MESH_ACNODE_NOTIFY_TIMEOUT_MS
+#define RTW_MESH_ACNODE_NOTIFY_TIMEOUT_MS (2 * 1000)
+#endif
+
+#ifndef RTW_MESH_OFFCH_CAND
+#define RTW_MESH_OFFCH_CAND 1
+#endif
+#ifndef RTW_MESH_OFFCH_CAND_FIND_INT_MS
+#define RTW_MESH_OFFCH_CAND_FIND_INT_MS (10 * 1000)
+#endif
+
+#ifndef RTW_MESH_PEER_CONF_TIMEOUT_MS
+#define RTW_MESH_PEER_CONF_TIMEOUT_MS (20 * 1000)
+#endif
+#ifndef RTW_MESH_PEER_BLACKLIST_TIMEOUT_MS
+#define RTW_MESH_PEER_BLACKLIST_TIMEOUT_MS (20 * 1000)
+#endif
+
+#ifndef RTW_MESH_CTO_MGATE_REQUIRE
+#define RTW_MESH_CTO_MGATE_REQUIRE 0
+#endif
+#ifndef RTW_MESH_CTO_MGATE_CONF_TIMEOUT_MS
+#define RTW_MESH_CTO_MGATE_CONF_TIMEOUT_MS (20 * 1000)
+#endif
+#ifndef RTW_MESH_CTO_MGATE_BLACKLIST_TIMEOUT_MS
+#define RTW_MESH_CTO_MGATE_BLACKLIST_TIMEOUT_MS (20 * 1000)
+#endif
+
 void rtw_mesh_cfg_init_peer_sel_policy(struct rtw_mesh_cfg *mcfg)
 {
 	struct mesh_peer_sel_policy *sel_policy = &mcfg->peer_sel_policy;

 	sel_policy->scanr_exp_ms = RTW_MESH_SCAN_RESULT_EXP_MS;

+#if CONFIG_RTW_MESH_ACNODE_PREVENT
+	sel_policy->acnode_prevent = RTW_MESH_ACNODE_PREVENT;
+	sel_policy->acnode_conf_timeout_ms = RTW_MESH_ACNODE_CONF_TIMEOUT_MS;
+	sel_policy->acnode_notify_timeout_ms = RTW_MESH_ACNODE_NOTIFY_TIMEOUT_MS;
+#endif
+
 #if CONFIG_RTW_MESH_OFFCH_CAND
+	sel_policy->offch_cand = RTW_MESH_OFFCH_CAND;
 	sel_policy->offch_find_int_ms = RTW_MESH_OFFCH_CAND_FIND_INT_MS;
 #endif

@@ -2609,7 +3036,7 @@ void rtw_mesh_cfg_init_peer_sel_policy(struct rtw_mesh_cfg *mcfg)
 #endif

 #if CONFIG_RTW_MESH_CTO_MGATE_BLACKLIST
-	sel_policy->cto_mgate_require = 0;
+	sel_policy->cto_mgate_require = RTW_MESH_CTO_MGATE_REQUIRE;
 	sel_policy->cto_mgate_conf_timeout_ms = RTW_MESH_CTO_MGATE_CONF_TIMEOUT_MS;
 	sel_policy->cto_mgate_blacklist_timeout_ms = RTW_MESH_CTO_MGATE_BLACKLIST_TIMEOUT_MS;
 #endif
@@ -2641,6 +3068,10 @@ void rtw_mesh_cfg_init(_adapter *adapter)
 	mcfg->dot11MeshHWMPconfirmationInterval = RTW_MESH_ROOT_CONFIRMATION_INTERVAL;
 	mcfg->path_gate_timeout_factor = 3;
 	rtw_mesh_cfg_init_peer_sel_policy(mcfg);
+#ifdef CONFIG_RTW_MESH_ADD_ROOT_CHK
+	mcfg->sane_metric_delta = RTW_MESH_SANE_METRIC_DELTA;
+	mcfg->max_root_add_chk_cnt = RTW_MESH_MAX_ROOT_ADD_CHK_CNT;
+#endif

 #if CONFIG_RTW_MESH_DATA_BMC_TO_UC
 	mcfg->b2u_flags_msrc = 0;
@@ -3343,7 +3774,8 @@ endlookup:
 #define RTW_MESH_DECACHE_BMC 1
 #define RTW_MESH_DECACHE_UC 0

-#define RTW_MESH_FORWARD_MDA_SELF_COND 1
+#define RTW_MESH_FORWARD_MDA_SELF_COND 0
+#define DBG_RTW_MESH_FORWARD_MDA_SELF_COND 0
 int rtw_mesh_rx_msdu_act_check(union recv_frame *rframe
 	, const u8 *mda, const u8 *msa
 	, const u8 *da, const u8 *sa
@@ -3463,57 +3895,90 @@ int rtw_mesh_rx_msdu_act_check(union recv_frame *rframe
 	} else {
 		/* mDA is self */
 		#if RTW_MESH_FORWARD_MDA_SELF_COND
-		u8 is_da_self = da == mda || _rtw_memcmp(da, adapter_mac_addr(adapter), ETH_ALEN);
-
-		if (is_da_self) {
+		if (da == mda
+			|| _rtw_memcmp(da, adapter_mac_addr(adapter), ETH_ALEN)
+		) {
 			/* DA is self, indicate */
 			act |= RTW_RX_MSDU_ACT_INDICATE;
 			goto exit;
 		}

-		/* DA is not self */
-		if (rtw_mesh_nexthop_lookup(adapter, da, msa, fwd_ra) == _SUCCESS) {
+		if (rtw_get_iface_by_macddr(adapter, da)) {
+			/* DA is buddy, indicate */
+			act |= RTW_RX_MSDU_ACT_INDICATE;
+			#if DBG_RTW_MESH_FORWARD_MDA_SELF_COND
+			RTW_INFO(FUNC_ADPT_FMT" DA("MAC_FMT") is buddy("ADPT_FMT")\n"
+				, FUNC_ADPT_ARG(adapter), MAC_ARG(da), ADPT_ARG(rtw_get_iface_by_macddr(adapter, da)));
+			#endif
+			goto exit;
+		}
+
+		/* DA is not self or buddy */
+		if (rtw_mesh_nexthop_lookup(adapter, da, msa, fwd_ra) == 0) {
 			/* DA is known in fwd info */
 			if (!mcfg->dot11MeshForwarding) {
 				/* path error to? */
-				#ifdef DBG_RX_DROP_FRAME
+				#if defined(DBG_RX_DROP_FRAME) || DBG_RTW_MESH_FORWARD_MDA_SELF_COND
 				RTW_INFO("DBG_RX_DROP_FRAME "FUNC_ADPT_FMT" DA("MAC_FMT") not self, !dot11MeshForwarding\n"
 					, FUNC_ADPT_ARG(adapter), MAC_ARG(da));
 				#endif
 				goto exit;
 			}
 			mda = da;
+			#if DBG_RTW_MESH_FORWARD_MDA_SELF_COND
+			RTW_INFO(FUNC_ADPT_FMT" fwd to DA("MAC_FMT"), fwd_RA("MAC_FMT")\n"
+				, FUNC_ADPT_ARG(adapter), MAC_ARG(da), MAC_ARG(fwd_ra));
+			#endif
 			goto fwd_chk;
 		}

 		rtw_rcu_read_lock();
 		mppath = rtw_mpp_path_lookup(adapter, da);
-		if (mppath && _rtw_memcmp(mppath->mpp, adapter_mac_addr(adapter), ETH_ALEN) == _FALSE) {
-			/* DA is reached by the other gate */
-			if (!mcfg->dot11MeshForwarding) {
-				/* path error to? */
-				#ifdef DBG_RX_DROP_FRAME
-				RTW_INFO("DBG_RX_DROP_FRAME "FUNC_ADPT_FMT" DA("MAC_FMT") is reached by proxy("MAC_FMT"), !dot11MeshForwarding\n"
-					, FUNC_ADPT_ARG(adapter), MAC_ARG(da), MAC_ARG(mppath->mpp));
-				#endif
+		if (mppath) {
+			if (_rtw_memcmp(mppath->mpp, adapter_mac_addr(adapter), ETH_ALEN) == _FALSE) {
+				/* DA is proxied by others */
+				if (!mcfg->dot11MeshForwarding) {
+					/* path error to? */
+					#if defined(DBG_RX_DROP_FRAME) || DBG_RTW_MESH_FORWARD_MDA_SELF_COND
+					RTW_INFO("DBG_RX_DROP_FRAME "FUNC_ADPT_FMT" DA("MAC_FMT") is proxied by ("MAC_FMT"), !dot11MeshForwarding\n"
+						, FUNC_ADPT_ARG(adapter), MAC_ARG(da), MAC_ARG(mppath->mpp));
+					#endif
+					rtw_rcu_read_unlock();
+					goto exit;
+				}
+				_rtw_memcpy(fwd_mpp, mppath->mpp, ETH_ALEN);
+				mda = fwd_mpp;
+				msa = adapter_mac_addr(adapter);
 				rtw_rcu_read_unlock();
-				goto exit;
-			}
-			_rtw_memcpy(fwd_mpp, mppath->mpp, ETH_ALEN);
-			mda = fwd_mpp;
-			msa = adapter_mac_addr(adapter);
-			rtw_rcu_read_unlock();

-			/* resolve RA */
-			if (rtw_mesh_nexthop_lookup(adapter, mda, msa, fwd_ra) != _SUCCESS) {
-				minfo->mshstats.dropped_frames_no_route++;
-				goto exit;
+				/* resolve RA */
+				if (rtw_mesh_nexthop_lookup(adapter, mda, msa, fwd_ra) != 0) {
+					minfo->mshstats.dropped_frames_no_route++;
+					#if defined(DBG_RX_DROP_FRAME) || DBG_RTW_MESH_FORWARD_MDA_SELF_COND
+					RTW_INFO("DBG_RX_DROP_FRAME "FUNC_ADPT_FMT" DA("MAC_FMT") is proxied by ("MAC_FMT"), RA resolve fail\n"
+						, FUNC_ADPT_ARG(adapter), MAC_ARG(da), MAC_ARG(mppath->mpp));
+					#endif
+					goto exit;
+				}
+				#if DBG_RTW_MESH_FORWARD_MDA_SELF_COND
+				RTW_INFO(FUNC_ADPT_FMT" DA("MAC_FMT") is proxied by ("MAC_FMT"), fwd_RA("MAC_FMT")\n"
+					, FUNC_ADPT_ARG(adapter), MAC_ARG(da), MAC_ARG(mppath->mpp), MAC_ARG(fwd_ra));
+				#endif
+				goto fwd_chk; /*  forward to other gate */
+			} else {
+				#if DBG_RTW_MESH_FORWARD_MDA_SELF_COND
+				RTW_INFO(FUNC_ADPT_FMT" DA("MAC_FMT") is proxied by self\n"
+					, FUNC_ADPT_ARG(adapter), MAC_ARG(da));
+				#endif
 			}
-			goto fwd_chk; /*  forward to other gate */
-		} 
+		}
 		rtw_rcu_read_unlock();

 		if (!mppath) {
+			#if DBG_RTW_MESH_FORWARD_MDA_SELF_COND
+			RTW_INFO(FUNC_ADPT_FMT" DA("MAC_FMT") unknown\n"
+				, FUNC_ADPT_ARG(adapter), MAC_ARG(da));
+			#endif
 			/* DA is unknown */
 			#if 0 /* TODO: flags with AE bit */
 			rtw_mesh_path_error_tx(adapter
@@ -3527,7 +3992,7 @@ int rtw_mesh_rx_msdu_act_check(union recv_frame *rframe

 		/*
 		* indicate to DS for both cases:
-		* 1.) DA is reached by self
+		* 1.) DA is proxied by self
 		* 2.) DA is unknown
 		*/
 		#endif /* RTW_MESH_FORWARD_MDA_SELF_COND */
--- a/core/mesh/rtw_mesh.h
+++ b/core/mesh/rtw_mesh.h
@@ -19,25 +19,22 @@
 	#error "CONFIG_RTW_MESH can't be enabled when CONFIG_AP_MODE is not defined\n"
 #endif

-#ifndef RTW_MESH_SCAN_RESULT_EXP_MS
-#define RTW_MESH_SCAN_RESULT_EXP_MS (10 * 1000)
-#endif
-#ifndef RTW_MESH_OFFCH_CAND_FIND_INT_MS
-#define RTW_MESH_OFFCH_CAND_FIND_INT_MS (10 * 1000)
-#endif
-#define RTW_MESH_TTL						31
-#define RTW_MESH_PERR_MIN_INT				100
+#define RTW_MESH_TTL				31
+#define RTW_MESH_PERR_MIN_INT			100
 #define RTW_MESH_DEFAULT_ELEMENT_TTL		31
-#define RTW_MESH_RANN_INTERVAL				5000
+#define RTW_MESH_RANN_INTERVAL			5000
 #define RTW_MESH_PATH_TO_ROOT_TIMEOUT		6000
 #define RTW_MESH_DIAM_TRAVERSAL_TIME		50
-#define RTW_MESH_PATH_TIMEOUT				5000
-#define RTW_MESH_PREQ_MIN_INT				10
-#define RTW_MESH_MAX_PREQ_RETRIES			4
+#define RTW_MESH_PATH_TIMEOUT			5000
+#define RTW_MESH_PREQ_MIN_INT			10
+#define RTW_MESH_MAX_PREQ_RETRIES		4
 #define RTW_MESH_MIN_DISCOVERY_TIMEOUT 		(2 * RTW_MESH_DIAM_TRAVERSAL_TIME)
-#define RTW_MESH_ROOT_CONFIRMATION_INTERVAL 2000
-#define RTW_MESH_PATH_REFRESH_TIME			1000
-#define RTW_MESH_ROOT_INTERVAL				5000
+#define RTW_MESH_ROOT_CONFIRMATION_INTERVAL	2000
+#define RTW_MESH_PATH_REFRESH_TIME		1000
+#define RTW_MESH_ROOT_INTERVAL			5000
+
+#define RTW_MESH_SANE_METRIC_DELTA		100
+#define RTW_MESH_MAX_ROOT_ADD_CHK_CNT		2

 #define RTW_MESH_PLINK_UNKNOWN	0
 #define RTW_MESH_PLINK_LISTEN	1
@@ -105,8 +102,10 @@ extern const char *_rtw_mesh_ps_str[];
 /* Max number of paths */
 #define RTW_MESH_MAX_PATHS 1024

-#define RTW_PREQ_Q_F_START		0x1
+#define RTW_PREQ_Q_F_START	0x1
 #define RTW_PREQ_Q_F_REFRESH	0x2
+#define RTW_PREQ_Q_F_CHK	0x4
+#define RTW_PREQ_Q_F_PEER_AKA	0x8
 struct rtw_mesh_preq_queue {
 	_list list;
 	u8 dst[ETH_ALEN];
@@ -242,6 +241,10 @@ struct mesh_plink_pool {
 	u8 num; /* current ent being used */
 	struct mesh_plink_ent ent[RTW_MESH_MAX_PEER_CANDIDATES];

+#if CONFIG_RTW_MESH_ACNODE_PREVENT
+	u8 acnode_rsvd;
+#endif
+
 #if CONFIG_RTW_MESH_PEER_BLACKLIST
 	_queue peer_blacklist;
 #endif
@@ -250,16 +253,18 @@ struct mesh_plink_pool {
 #endif
 };

-#define RTW_MESH_PEER_CONF_TIMEOUT_MS (20 * 1000)
-#define RTW_MESH_PEER_BLACKLIST_TIMEOUT_MS (20 * 1000)
-#define RTW_MESH_CTO_MGATE_CONF_TIMEOUT_MS (20 * 1000)
-#define RTW_MESH_CTO_MGATE_BLACKLIST_TIMEOUT_MS (20 * 1000)
-
 struct mesh_peer_sel_policy {
 	u32 scanr_exp_ms;

+#if CONFIG_RTW_MESH_ACNODE_PREVENT
+	u8 acnode_prevent;
+	u32 acnode_conf_timeout_ms;
+	u32 acnode_notify_timeout_ms;
+#endif
+
 #if CONFIG_RTW_MESH_OFFCH_CAND
-	u32 offch_find_int_ms; /* 0 means no offch find by driver */
+	u8 offch_cand;
+	u32 offch_find_int_ms; /* 0 means no offch find triggerred by driver self*/
 #endif

 #if CONFIG_RTW_MESH_PEER_BLACKLIST
@@ -293,6 +298,11 @@ struct mesh_peer_sel_policy {
 	|| ((flags & RTW_MESH_B2U_IP_MCAST) && (IP_MCAST_MAC(mda) || ICMPV6_MCAST_MAC(mda))) \
 	)

+/**
+ * @sane_metric_delta: Controlling if trigger additional path check mechanism
+ * @max_root_add_chk_cnt: The retry cnt to send additional root confirmation
+ *	PREQ through old(last) path
+ */
 struct rtw_mesh_cfg {
 	u8 max_peer_links; /* peering limit */
 	u32 plink_timeout; /* seconds */
@@ -315,6 +325,10 @@ struct rtw_mesh_cfg {
 	u32 dot11MeshHWMPactivePathToRootTimeout;
 	u16 dot11MeshHWMProotInterval;
 	u8 path_gate_timeout_factor;
+#ifdef CONFIG_RTW_MESH_ADD_ROOT_CHK
+	u16 sane_metric_delta;
+	u8 max_root_add_chk_cnt;
+#endif

 	struct mesh_peer_sel_policy peer_sel_policy;

@@ -370,6 +384,8 @@ struct rtw_mesh_info {
 	int mpp_paths_generation;

 	int num_gates;
+	struct rtw_mesh_path *max_addr_gate;
+	bool max_addr_gate_is_larger_than_self;

 	struct rtw_mesh_stats mshstats;

@@ -401,9 +417,18 @@ void rtw_chk_candidate_peer_notify(_adapter *adapter, struct wlan_network *scann

 void rtw_mesh_peer_status_chk(_adapter *adapter);

+#if CONFIG_RTW_MESH_ACNODE_PREVENT
+void rtw_mesh_update_scanned_acnode_status(_adapter *adapter, struct wlan_network *scanned);
+bool rtw_mesh_scanned_is_acnode_confirmed(_adapter *adapter, struct wlan_network *scanned);
+bool rtw_mesh_acnode_prevent_allow_sacrifice(_adapter *adapter);
+struct sta_info *rtw_mesh_acnode_prevent_pick_sacrifice(_adapter *adapter);
+void dump_mesh_acnode_prevent_settings(void *sel, _adapter *adapter);
+#endif
+
 #if CONFIG_RTW_MESH_OFFCH_CAND
 u8 rtw_mesh_offch_candidate_accepted(_adapter *adapter);
 u8 rtw_mesh_select_operating_ch(_adapter *adapter);
+void dump_mesh_offch_cand_settings(void *sel, _adapter *adapter);
 #endif

 #if CONFIG_RTW_MESH_PEER_BLACKLIST
@@ -427,10 +452,13 @@ void dump_mesh_cto_mgate_blacklist_settings(void *sel, _adapter *adapter);
 void dump_mesh_peer_sel_policy(void *sel, _adapter *adapter);
 void dump_mesh_networks(void *sel, _adapter *adapter);

+void rtw_mesh_adjust_chbw(u8 req_ch, u8 *req_bw, u8 *req_offset);
+
 int rtw_sae_check_frames(_adapter *adapter, const u8 *buf, u32 len, u8 tx);
 int rtw_mesh_check_frames_tx(_adapter *adapter, const u8 **buf, size_t *len);
 int rtw_mesh_check_frames_rx(_adapter *adapter, const u8 *buf, size_t len);

+int rtw_mesh_on_auth(_adapter *adapter, union recv_frame *rframe);
 unsigned int on_action_self_protected(_adapter *adapter, union recv_frame *rframe);

 bool rtw_mesh_update_bss_peering_status(_adapter *adapter, WLAN_BSSID_EX *bss);
--- a/core/mesh/rtw_mesh_hwmp.c
+++ b/core/mesh/rtw_mesh_hwmp.c
@@ -826,14 +826,16 @@ static void rtw_hwmp_prep_frame_process(_adapter *adapter,
 		target_addr = RTW_PREP_IE_TARGET_ADDR(prep_elem);
 		path = rtw_mesh_path_lookup(adapter, target_addr);
 		if (path && path->gate_asked) {
-			enter_critical_bh(&path->state_lock);
-			path->gate_asked = false;
-			exit_critical_bh(&path->state_lock);
 			flags = RTW_PREP_IE_FLAGS(prep_elem);
-			if ((flags & BIT(7)) && !(flags & RTW_IEEE80211_PREQ_IS_GATE_FLAG)) {
+			if (flags & BIT(7)) {
 				enter_critical_bh(&path->state_lock);
-				rtw_mesh_gate_del(adapter->mesh_info.mesh_paths, path);
+				path->gate_asked = false;
 				exit_critical_bh(&path->state_lock);
+				if (!(flags & RTW_IEEE80211_PREQ_IS_GATE_FLAG)) {
+					enter_critical_bh(&path->state_lock);
+					rtw_mesh_gate_del(adapter->mesh_info.mesh_paths, path);
+					exit_critical_bh(&path->state_lock);
+				}
 			}
 		}

@@ -1000,9 +1002,26 @@ static void rtw_hwmp_rann_frame_process(_adapter *adapter,
 				  rtw_root_path_confirmation_jiffies(adapter)) ||
 	     rtw_time_before(rtw_get_current_time(), path->last_preq_to_root))) &&
 	     !(path->flags & RTW_MESH_PATH_FIXED) && (ttl != 0)) {
+		u8 preq_node_flag = RTW_PREQ_Q_F_START | RTW_PREQ_Q_F_REFRESH;
+
 		RTW_HWMP_DBG("time to refresh root path "MAC_FMT"\n",
 			  MAC_ARG(originator_addr));
-		rtw_mesh_queue_preq(path, RTW_PREQ_Q_F_START | RTW_PREQ_Q_F_REFRESH);
+#ifdef CONFIG_RTW_MESH_ADD_ROOT_CHK
+		if (RTW_SN_LT(path->sn, originator_sn) &&
+		    (path->rann_metric + mshcfg->sane_metric_delta < metric) &&
+		    _rtw_memcmp(bcast_addr, path->rann_snd_addr, ETH_ALEN) == _FALSE) {
+			RTW_HWMP_DBG("Trigger additional check for root "
+				     "confirm PREQ. rann_snd_addr = "MAC_FMT
+				     "add_chk_rann_snd_addr= "MAC_FMT"\n",
+					MAC_ARG(mgmt->addr2),
+					MAC_ARG(path->rann_snd_addr));
+			_rtw_memcpy(path->add_chk_rann_snd_addr,
+				    path->rann_snd_addr, ETH_ALEN);
+			preq_node_flag |= RTW_PREQ_Q_F_CHK;
+			
+		}
+#endif
+		rtw_mesh_queue_preq(path, preq_node_flag);
 		path->last_preq_to_root = rtw_get_current_time();
 	}

@@ -1138,6 +1157,13 @@ static u32 rtw_hwmp_route_info_get(_adapter *adapter,
 			path->exp_time = rtw_time_after(path->exp_time, exp_time)
 					  ?  path->exp_time : exp_time;
 			rtw_mesh_path_activate(path);
+#ifdef CONFIG_RTW_MESH_ADD_ROOT_CHK
+			if (path->is_root && (action == RTW_MPATH_PREP)) {
+				_rtw_memcpy(path->rann_snd_addr, 
+				mgmt->addr2, ETH_ALEN);
+				path->rann_metric = new_metric;
+			}
+#endif
 			exit_critical_bh(&path->state_lock);
 			rtw_mesh_path_tx_pending(path);
 		} else
@@ -1184,6 +1210,15 @@ static u32 rtw_hwmp_route_info_get(_adapter *adapter,
 	return process ? new_metric : 0;
 }

+static void rtw_mesh_rx_hwmp_frame_cnts(_adapter *adapter, u8 *addr)
+{
+	struct sta_info *sta;
+
+	sta = rtw_get_stainfo(&adapter->stapriv, addr);
+	if (sta)
+		sta->sta_stats.rx_hwmp_pkts++;
+}
+
 void rtw_mesh_rx_path_sel_frame(_adapter *adapter, union recv_frame *rframe)
 {
 	struct mesh_plink_ent *plink = NULL;
@@ -1200,6 +1235,8 @@ void rtw_mesh_rx_path_sel_frame(_adapter *adapter, union recv_frame *rframe)
 	if (!plink || plink->plink_state != RTW_MESH_PLINK_ESTAB)
 		return;

+	rtw_mesh_rx_hwmp_frame_cnts(adapter, get_addr2_ptr(pframe));
+
 	/* Mesh action frame IE offset = 2 */
 	attrib->hdrlen = sizeof(struct rtw_ieee80211_hdr_3addr);
 	left = frame_len - attrib->hdrlen - attrib->iv_len - attrib->icv_len - 2;
@@ -1276,6 +1313,12 @@ void rtw_mesh_queue_preq(struct rtw_mesh_path *path, u8 flags)
 	preq_node->flags = flags;

 	path->flags |= RTW_MESH_PATH_REQ_QUEUED;
+#ifdef CONFIG_RTW_MESH_ADD_ROOT_CHK
+	if (flags & RTW_PREQ_Q_F_CHK)
+		path->flags |= RTW_MESH_PATH_ROOT_ADD_CHK;
+#endif
+	if (flags & RTW_PREQ_Q_F_PEER_AKA)
+		path->flags |= RTW_MESH_PATH_PEER_AKA;
 	_rtw_spinunlock(&path->state_lock);

 	rtw_list_insert_tail(&preq_node->list, &minfo->preq_queue.list);
@@ -1291,7 +1334,27 @@ void rtw_mesh_queue_preq(struct rtw_mesh_path *path, u8 flags)
 		rtw_mesh_work(&adapter->mesh_work);
 	} else
 		rtw_mod_timer(&adapter->mesh_path_timer, minfo->last_preq +
-						rtw_min_preq_int_jiff(adapter));
+					rtw_min_preq_int_jiff(adapter) + 1);
+}
+
+static const u8 *rtw_hwmp_preq_da(struct rtw_mesh_path *path,
+			    BOOLEAN is_root_add_chk, BOOLEAN da_is_peer)
+{
+	const u8 *da;
+
+	if (da_is_peer)
+		da = path->dst;
+	else if (path->is_root)
+#ifdef CONFIG_RTW_MESH_ADD_ROOT_CHK
+		da = is_root_add_chk ? path->add_chk_rann_snd_addr:
+				       path->rann_snd_addr;
+#else
+		da = path->rann_snd_addr;
+#endif
+	else
+		da = bcast_addr;
+
+	return da;
 }

 void rtw_mesh_path_start_discovery(_adapter *adapter)
@@ -1304,6 +1367,8 @@ void rtw_mesh_path_start_discovery(_adapter *adapter)
 	const u8 *da;
 	u32 lifetime;
 	u8 flags = 0;
+	BOOLEAN is_root_add_chk = _FALSE;
+	BOOLEAN da_is_peer;

 	enter_critical_bh(&minfo->mesh_preq_queue_lock);
 	if (!minfo->preq_queue_len ||
@@ -1368,8 +1433,14 @@ void rtw_mesh_path_start_discovery(_adapter *adapter)
 	else
 		target_flags &= ~RTW_IEEE80211_PREQ_TO_FLAG;

+#ifdef CONFIG_RTW_MESH_ADD_ROOT_CHK
+	is_root_add_chk = !!(path->flags & RTW_MESH_PATH_ROOT_ADD_CHK);
+#endif
+	da_is_peer = !!(path->flags & RTW_MESH_PATH_PEER_AKA);
 	exit_critical_bh(&path->state_lock);
-	da = (path->is_root) ? path->rann_snd_addr : bcast_addr;
+
+	da = rtw_hwmp_preq_da(path, is_root_add_chk, da_is_peer);
+
 #ifdef CONFIG_RTW_MESH_ON_DMD_GANN
 	flags = (mshcfg->dot11MeshGateAnnouncementProtocol)
 		? RTW_IEEE80211_PREQ_IS_GATE_FLAG : 0;
@@ -1389,7 +1460,10 @@ void rtw_mesh_path_timer(void *ctx)
 	struct rtw_mesh_path *path = (void *) ctx;
 	_adapter *adapter = path->adapter;
 	int ret;
-
+	u8 retry = 0;
+#ifdef CONFIG_RTW_MESH_ADD_ROOT_CHK
+	struct rtw_mesh_cfg *mshcfg = &adapter->mesh_cfg;
+#endif
 	/* TBD: Proctect for suspend */
 #if 0
 	if (suspending)
@@ -1398,18 +1472,30 @@ void rtw_mesh_path_timer(void *ctx)
 	enter_critical_bh(&path->state_lock);
 	if (path->flags & RTW_MESH_PATH_RESOLVED ||
 			(!(path->flags & RTW_MESH_PATH_RESOLVING))) {
-		path->flags &= ~(RTW_MESH_PATH_RESOLVING | RTW_MESH_PATH_RESOLVED);
+		path->flags &= ~(RTW_MESH_PATH_RESOLVING |
+				 RTW_MESH_PATH_RESOLVED |
+				 RTW_MESH_PATH_ROOT_ADD_CHK |
+				 RTW_MESH_PATH_PEER_AKA);
 		exit_critical_bh(&path->state_lock);
 	} else if (path->discovery_retries < rtw_max_preq_retries(adapter)) {
 		++path->discovery_retries;
 		path->discovery_timeout *= 2;
 		path->flags &= ~RTW_MESH_PATH_REQ_QUEUED;
+#ifdef CONFIG_RTW_MESH_ADD_ROOT_CHK
+		if (path->discovery_retries > mshcfg->max_root_add_chk_cnt)
+			path->flags &= ~RTW_MESH_PATH_ROOT_ADD_CHK;
+#endif
+		if (path->gate_asked)
+			retry |= RTW_PREQ_Q_F_REFRESH;
+
 		exit_critical_bh(&path->state_lock);
-		rtw_mesh_queue_preq(path, 0);
+		rtw_mesh_queue_preq(path, retry);
 	} else {
 		path->flags &= ~(RTW_MESH_PATH_RESOLVING |
 				  RTW_MESH_PATH_RESOLVED |
-				  RTW_MESH_PATH_REQ_QUEUED);
+				  RTW_MESH_PATH_REQ_QUEUED |
+				  RTW_MESH_PATH_ROOT_ADD_CHK |
+				  RTW_MESH_PATH_PEER_AKA);
 		path->exp_time = rtw_get_current_time();
 		exit_critical_bh(&path->state_lock);
 		if (!path->is_gate && rtw_mesh_gate_num(adapter) > 0) {
@@ -1515,10 +1601,19 @@ void rtw_mesh_work_hdl(_workitem *work)
 {
 	_adapter *adapter = container_of(work, _adapter, mesh_work);

-	if (adapter->mesh_info.preq_queue_len &&
-		rtw_time_after(rtw_get_current_time(),
-		       adapter->mesh_info.last_preq + rtw_ms_to_systime(adapter->mesh_cfg.dot11MeshHWMPpreqMinInterval)))
-		rtw_mesh_path_start_discovery(adapter);
+	while(adapter->mesh_info.preq_queue_len) {
+		if (rtw_time_after(rtw_get_current_time(),
+		       adapter->mesh_info.last_preq + rtw_min_preq_int_jiff(adapter)))
+		       /* It will consume preq_queue_len */
+		       rtw_mesh_path_start_discovery(adapter);
+		else {
+			struct rtw_mesh_info *minfo = &adapter->mesh_info;
+
+			rtw_mod_timer(&adapter->mesh_path_timer,
+				minfo->last_preq + rtw_min_preq_int_jiff(adapter) + 1);
+			break;
+		}
+	}

 	if (rtw_test_and_clear_bit(RTW_MESH_WORK_ROOT, &adapter->wrkq_flags))
 		rtw_ieee80211_mesh_rootpath(adapter);
--- a/core/mesh/rtw_mesh_pathtbl.c
+++ b/core/mesh/rtw_mesh_pathtbl.c
@@ -324,6 +324,58 @@ rtw_mesh_path_lookup_by_idx(_adapter *adapter, int idx)
 	return __rtw_mesh_path_lookup_by_idx(adapter->mesh_info.mesh_paths, idx);
 }

+void dump_mpath(void *sel, _adapter *adapter)
+{
+	struct rtw_mesh_path *mpath;
+	int idx = 0;
+	char dst[ETH_ALEN];
+	char next_hop[ETH_ALEN];
+	u32 sn, metric, qlen;
+	u32 exp_ms = 0, dto_ms;
+	u8 drty;
+	enum rtw_mesh_path_flags flags;
+
+	RTW_PRINT_SEL(sel, "%-17s %-17s %-10s %-10s %-4s %-6s %-6s %-4s flags\n"
+		, "dst", "next_hop", "sn", "metric", "qlen", "exp_ms", "dto_ms", "drty"
+	);
+
+	do {
+		rtw_rcu_read_lock();
+
+		mpath = rtw_mesh_path_lookup_by_idx(adapter, idx);
+		if (mpath) {
+			_rtw_memcpy(dst, mpath->dst, ETH_ALEN);
+			_rtw_memcpy(next_hop, mpath->next_hop->cmn.mac_addr, ETH_ALEN);
+			sn = mpath->sn;
+			metric = mpath->metric;
+			qlen = mpath->frame_queue_len;
+			if (rtw_time_after(mpath->exp_time, rtw_get_current_time()))
+				exp_ms = rtw_get_remaining_time_ms(mpath->exp_time);
+			dto_ms = rtw_systime_to_ms(mpath->discovery_timeout);
+			drty = mpath->discovery_retries;
+			flags = mpath->flags;
+		}
+
+		rtw_rcu_read_unlock();
+
+		if (mpath) {
+			RTW_PRINT_SEL(sel, MAC_FMT" "MAC_FMT" %10u %10u %4u %6u %6u %4u%s%s%s%s%s\n"
+				, MAC_ARG(dst), MAC_ARG(next_hop), sn, metric, qlen
+				, exp_ms < 999999 ? exp_ms : 999999
+				, dto_ms < 999999 ? dto_ms : 999999
+				, drty
+				, (flags & RTW_MESH_PATH_ACTIVE) ? " ACT" : ""
+				, (flags & RTW_MESH_PATH_RESOLVING) ? " RSVING" : ""
+				, (flags & RTW_MESH_PATH_SN_VALID) ? " SN_VALID" : ""
+				, (flags & RTW_MESH_PATH_FIXED) ?  " FIXED" : ""
+				, (flags & RTW_MESH_PATH_RESOLVED) ? " RSVED" : ""
+			);
+		}
+
+		idx++;
+	} while (mpath);
+}
+
 /**
 * rtw_mpp_path_lookup_by_idx - look up a path in the proxy path table by its index
 * @idx: index
@@ -374,12 +426,26 @@ int rtw_mesh_path_add_gate(struct rtw_mesh_path *mpath)
 	ori_num_gates = minfo->num_gates;
 	minfo->num_gates++;
 	rtw_hlist_add_head_rcu(&mpath->gate_list, &tbl->known_gates);
+
+	if (ori_num_gates == 0
+		|| rtw_macaddr_is_larger(mpath->dst, minfo->max_addr_gate->dst)
+	) {
+		minfo->max_addr_gate = mpath;
+		minfo->max_addr_gate_is_larger_than_self =
+			rtw_macaddr_is_larger(mpath->dst, adapter_mac_addr(mpath->adapter));
+	}
+
 	_rtw_spinunlock(&tbl->gates_lock);

 	exit_critical_bh(&mpath->state_lock);

-	if (ori_num_gates == 0)
+	if (ori_num_gates == 0) {
 		update_beacon(mpath->adapter, WLAN_EID_MESH_CONFIG, NULL, _TRUE);
+		#if CONFIG_RTW_MESH_CTO_MGATE_CARRIER
+		if (!rtw_mesh_cto_mgate_required(mpath->adapter))
+			rtw_netif_carrier_on(mpath->adapter->pnetdev);
+		#endif
+	}

 	RTW_MPATH_DBG(
 		  FUNC_ADPT_FMT" Mesh path: Recorded new gate: %pM. %d known gates\n",
@@ -414,10 +480,32 @@ void rtw_mesh_gate_del(struct rtw_mesh_table *tbl, struct rtw_mesh_path *mpath)
 	rtw_hlist_del_rcu(&mpath->gate_list);
 	ori_num_gates = minfo->num_gates;
 	minfo->num_gates--;
+
+	if (ori_num_gates == 1) {
+		minfo->max_addr_gate = NULL;
+		minfo->max_addr_gate_is_larger_than_self = 0;
+	} else if (minfo->max_addr_gate == mpath) {
+		struct rtw_mesh_path *gate, *max_addr_gate = NULL;
+		rtw_hlist_node *node;
+
+		rtw_hlist_for_each_entry_rcu(gate, node, &tbl->known_gates, gate_list) {
+			if (!max_addr_gate || rtw_macaddr_is_larger(gate->dst, max_addr_gate->dst))
+				max_addr_gate = gate;
+		}
+		minfo->max_addr_gate = max_addr_gate;
+		minfo->max_addr_gate_is_larger_than_self =
+			rtw_macaddr_is_larger(max_addr_gate->dst, adapter_mac_addr(mpath->adapter));
+	}
+
 	exit_critical_bh(&tbl->gates_lock);

-	if (ori_num_gates == 1)
+	if (ori_num_gates == 1) {
 		update_beacon(mpath->adapter, WLAN_EID_MESH_CONFIG, NULL, _TRUE);
+		#if CONFIG_RTW_MESH_CTO_MGATE_CARRIER
+		if (rtw_mesh_cto_mgate_required(mpath->adapter))
+			rtw_netif_carrier_off(mpath->adapter->pnetdev);
+		#endif
+	}

 	RTW_MPATH_DBG(
 		  FUNC_ADPT_FMT" Mesh path: Deleted gate: %pM. %d known gates\n",
@@ -458,6 +546,45 @@ int rtw_mesh_gate_num(_adapter *adapter)
 	return adapter->mesh_info.num_gates;
 }

+bool rtw_mesh_is_primary_gate(_adapter *adapter)
+{
+	struct rtw_mesh_cfg *mcfg = &adapter->mesh_cfg;
+	struct rtw_mesh_info *minfo = &adapter->mesh_info;
+
+	return mcfg->dot11MeshGateAnnouncementProtocol
+		&& !minfo->max_addr_gate_is_larger_than_self;
+}
+
+void dump_known_gates(void *sel, _adapter *adapter)
+{
+	struct rtw_mesh_info *minfo = &adapter->mesh_info;
+	struct rtw_mesh_table *tbl;
+	struct rtw_mesh_path *gate;
+	rtw_hlist_node *node;
+
+	if (!rtw_mesh_gate_num(adapter))
+		goto exit;
+
+	rtw_rcu_read_lock();
+
+	tbl = minfo->mesh_paths;
+	if (!tbl)
+		goto unlock;
+
+	RTW_PRINT_SEL(sel, "num:%d\n", rtw_mesh_gate_num(adapter));
+
+	rtw_hlist_for_each_entry_rcu(gate, node, &tbl->known_gates, gate_list) {
+		RTW_PRINT_SEL(sel, "%c"MAC_FMT"\n"
+			, gate == minfo->max_addr_gate ? '*' : ' '
+			, MAC_ARG(gate->dst));
+	}
+
+unlock:
+	rtw_rcu_read_unlock();
+exit:
+	return;
+}
+
 static
 struct rtw_mesh_path *rtw_mesh_path_new(_adapter *adapter,
 				const u8 *dst)
@@ -574,6 +701,34 @@ int rtw_mpp_path_add(_adapter *adapter,
 	return ret;
 }

+void dump_mpp(void *sel, _adapter *adapter)
+{
+	struct rtw_mesh_path *mpath;
+	int idx = 0;
+	char dst[ETH_ALEN];
+	char mpp[ETH_ALEN];
+
+	RTW_PRINT_SEL(sel, "%-17s %-17s\n", "dst", "mpp");
+
+	do {
+		rtw_rcu_read_lock();
+
+		mpath = rtw_mpp_path_lookup_by_idx(adapter, idx);
+		if (mpath) {
+			_rtw_memcpy(dst, mpath->dst, ETH_ALEN);
+			_rtw_memcpy(mpp, mpath->mpp, ETH_ALEN);
+		}
+
+		rtw_rcu_read_unlock();
+
+		if (mpath) {
+			RTW_PRINT_SEL(sel, MAC_FMT" "MAC_FMT"\n"
+				, MAC_ARG(dst), MAC_ARG(mpp));
+		}
+
+		idx++;
+	} while (mpath);
+}

 /**
 * rtw_mesh_plink_broken - deactivates paths and sends perr when a link breaks
--- a/core/mesh/rtw_mesh_pathtbl.h
+++ b/core/mesh/rtw_mesh_pathtbl.h
@@ -38,7 +38,11 @@
 *	already queued up, waiting for the discovery process to start.
 * @RTW_MESH_PATH_DELETED: the mesh path has been deleted and should no longer
 *	be used
- *
+ * @RTW_MESH_PATH_ROOT_ADD_CHK: root additional check in root mode.
+ *	With this flag, It will try the last used rann_snd_addr
+ * @RTW_MESH_PATH_PEER_AKA: only used toward a peer, only used in active keep
+ *	alive mechanism. PREQ's da = path dst
+ * 
 * RTW_MESH_PATH_RESOLVED is used by the mesh path timer to
 * decide when to stop or cancel the mesh path discovery.
 */
@@ -50,6 +54,8 @@ enum rtw_mesh_path_flags {
 	RTW_MESH_PATH_RESOLVED =	BIT(4),
 	RTW_MESH_PATH_REQ_QUEUED =	BIT(5),
 	RTW_MESH_PATH_DELETED =	BIT(6),
+	RTW_MESH_PATH_ROOT_ADD_CHK =	BIT(7),
+	RTW_MESH_PATH_PEER_AKA =	BIT(8),
 };

 /**
@@ -111,6 +117,9 @@ struct rtw_mesh_path {
 	enum rtw_mesh_path_flags flags;
 	_lock state_lock;
 	u8 rann_snd_addr[ETH_ALEN];
+#ifdef CONFIG_RTW_MESH_ADD_ROOT_CHK
+	u8 add_chk_rann_snd_addr[ETH_ALEN];
+#endif
 	u32 rann_metric;
 	unsigned long last_preq_to_root;
 	bool is_root;
@@ -153,8 +162,12 @@ struct rtw_mesh_path *rtw_mpp_path_lookup(_adapter *adapter,
 				  const u8 *dst);
 int rtw_mpp_path_add(_adapter *adapter,
 		 const u8 *dst, const u8 *mpp);
+void dump_mpp(void *sel, _adapter *adapter);
+
 struct rtw_mesh_path *
 rtw_mesh_path_lookup_by_idx(_adapter *adapter, int idx);
+void dump_mpath(void *sel, _adapter *adapter);
+
 struct rtw_mesh_path *
 rtw_mpp_path_lookup_by_idx(_adapter *adapter, int idx);
 void rtw_mesh_path_fix_nexthop(struct rtw_mesh_path *mpath, struct sta_info *next_hop);
@@ -168,6 +181,8 @@ void rtw_mesh_gate_del(struct rtw_mesh_table *tbl, struct rtw_mesh_path *mpath);
 bool rtw_mesh_gate_search(struct rtw_mesh_table *tbl, const u8 *addr);
 int rtw_mesh_path_send_to_gates(struct rtw_mesh_path *mpath);
 int rtw_mesh_gate_num(_adapter *adapter);
+bool rtw_mesh_is_primary_gate(_adapter *adapter);
+void dump_known_gates(void *sel, _adapter *adapter);

 void rtw_mesh_plink_broken(struct sta_info *sta);

--- a/core/rtw_ap.c
+++ b/core/rtw_ap.c
--- a/core/rtw_beamforming.c
+++ b/core/rtw_beamforming.c
@@ -1071,7 +1071,7 @@ static u8 _bfer_set_entry_gid(PADAPTER adapter, u8 *addr, u8 *gid, u8 *position)
 	struct beamformer_entry bfer;

 	memset(&bfer, 0, sizeof(bfer));
-	memcpy(bfer.mac_addr, addr, 6);
+	memcpy(bfer.mac_addr, addr, ETH_ALEN);

 	/* Parsing Membership Status Array */
 	memcpy(bfer.gid_valid, gid, 8);
@@ -3047,7 +3047,7 @@ void	beamforming_wk_hdl(_adapter *padapter, u8 type, u8 *pbuf)
 		struct sta_info	*psta = (PVOID)pbuf;
 		u16			staIdx = psta->cmn.mac_id;

-		beamforming_enter(pDM_Odm, staIdx);
+		beamforming_enter(pDM_Odm, staIdx, adapter_mac_addr(psta->padapter));
 		break;
 	}
 	case BEAMFORMING_CTRL_LEAVE:
--- a/core/rtw_br_ext.c
+++ b/core/rtw_br_ext.c
@@ -301,7 +301,7 @@ static int update_nd_link_layer_addr(unsigned char *data, int len, unsigned char
 	return 0;
 }

-
+#ifdef SUPPORT_RX_UNI2MCAST
 static void convert_ipv6_mac_to_mc(struct sk_buff *skb)
 {
 	struct ipv6hdr *iph = (struct ipv6hdr *)(skb->data + ETH_HLEN);
@@ -319,6 +319,7 @@ static void convert_ipv6_mac_to_mc(struct sk_buff *skb)
 #endif
 }
 #endif /* CL_IPV6_PASS */
+#endif /* SUPPORT_RX_UNI2MCAST */


 static __inline__ int __nat25_network_hash(unsigned char *networkAddr)
--- a/core/rtw_btcoex.c
+++ b/core/rtw_btcoex.c
@@ -437,7 +437,6 @@ u8 rtw_btcoex_LPS_Leave(PADAPTER padapter)

 	if (pwrpriv->pwr_mode != PS_MODE_ACTIVE) {
 		rtw_set_ps_mode(padapter, PS_MODE_ACTIVE, 0, 0, "BTCOEX");
-		LPS_RF_ON_check(padapter, 100);
 		pwrpriv->bpower_saving = _FALSE;
 	}

--- a/core/rtw_btcoex_wifionly.c
+++ b/core/rtw_btcoex_wifionly.c
@@ -26,6 +26,11 @@ void rtw_btcoex_wifionly_scan_notify(PADAPTER padapter)
 	hal_btcoex_wifionly_scan_notify(padapter);
 }

+void rtw_btcoex_wifionly_connect_notify(PADAPTER padapter)
+{
+	hal_btcoex_wifionly_connect_notify(padapter);
+}
+
 void rtw_btcoex_wifionly_hw_config(PADAPTER padapter)
 {
 	hal_btcoex_wifionly_hw_config(padapter);
--- a/core/rtw_chplan.c
+++ b/core/rtw_chplan.c
--- a/core/rtw_chplan.h
+++ b/core/rtw_chplan.h
@@ -0,0 +1,181 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2018 Realtek Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ *****************************************************************************/
+#ifndef __RTW_CHPLAN_H__
+#define __RTW_CHPLAN_H__
+
+enum rtw_chplan_id {
+	/* ===== 0x00 ~ 0x1F, legacy channel plan ===== */
+	RTW_CHPLAN_FCC = 0x00,
+	RTW_CHPLAN_IC = 0x01,
+	RTW_CHPLAN_ETSI = 0x02,
+	RTW_CHPLAN_SPAIN = 0x03,
+	RTW_CHPLAN_FRANCE = 0x04,
+	RTW_CHPLAN_MKK = 0x05,
+	RTW_CHPLAN_MKK1 = 0x06,
+	RTW_CHPLAN_ISRAEL = 0x07,
+	RTW_CHPLAN_TELEC = 0x08,
+	RTW_CHPLAN_GLOBAL_DOAMIN = 0x09,
+	RTW_CHPLAN_WORLD_WIDE_13 = 0x0A,
+	RTW_CHPLAN_TAIWAN = 0x0B,
+	RTW_CHPLAN_CHINA = 0x0C,
+	RTW_CHPLAN_SINGAPORE_INDIA_MEXICO = 0x0D,
+	RTW_CHPLAN_KOREA = 0x0E,
+	RTW_CHPLAN_TURKEY = 0x0F,
+	RTW_CHPLAN_JAPAN = 0x10,
+	RTW_CHPLAN_FCC_NO_DFS = 0x11,
+	RTW_CHPLAN_JAPAN_NO_DFS = 0x12,
+	RTW_CHPLAN_WORLD_WIDE_5G = 0x13,
+	RTW_CHPLAN_TAIWAN_NO_DFS = 0x14,
+
+	/* ===== 0x20 ~ 0x7F, new channel plan ===== */
+	RTW_CHPLAN_WORLD_NULL = 0x20,
+	RTW_CHPLAN_ETSI1_NULL = 0x21,
+	RTW_CHPLAN_FCC1_NULL = 0x22,
+	RTW_CHPLAN_MKK1_NULL = 0x23,
+	RTW_CHPLAN_ETSI2_NULL = 0x24,
+	RTW_CHPLAN_FCC1_FCC1 = 0x25,
+	RTW_CHPLAN_WORLD_ETSI1 = 0x26,
+	RTW_CHPLAN_MKK1_MKK1 = 0x27,
+	RTW_CHPLAN_WORLD_KCC1 = 0x28,
+	RTW_CHPLAN_WORLD_FCC2 = 0x29,
+	RTW_CHPLAN_FCC2_NULL = 0x2A,
+	RTW_CHPLAN_IC1_IC2 = 0x2B,
+	RTW_CHPLAN_MKK2_NULL = 0x2C,
+	RTW_CHPLAN_WORLD_CHILE1= 0x2D,
+	RTW_CHPLAN_WORLD1_WORLD1 = 0x2E,
+	RTW_CHPLAN_WORLD_CHILE2 = 0x2F,
+	RTW_CHPLAN_WORLD_FCC3 = 0x30,
+	RTW_CHPLAN_WORLD_FCC4 = 0x31,
+	RTW_CHPLAN_WORLD_FCC5 = 0x32,
+	RTW_CHPLAN_WORLD_FCC6 = 0x33,
+	RTW_CHPLAN_FCC1_FCC7 = 0x34,
+	RTW_CHPLAN_WORLD_ETSI2 = 0x35,
+	RTW_CHPLAN_WORLD_ETSI3 = 0x36,
+	RTW_CHPLAN_MKK1_MKK2 = 0x37,
+	RTW_CHPLAN_MKK1_MKK3 = 0x38,
+	RTW_CHPLAN_FCC1_NCC1 = 0x39,
+	RTW_CHPLAN_ETSI1_ETSI1 = 0x3A,
+	RTW_CHPLAN_ETSI1_ACMA1 = 0x3B,
+	RTW_CHPLAN_ETSI1_ETSI6 = 0x3C,
+	RTW_CHPLAN_ETSI1_ETSI12 = 0x3D,
+	RTW_CHPLAN_KCC1_KCC2 = 0x3E,
+	RTW_CHPLAN_FCC1_FCC11 = 0x3F,
+	RTW_CHPLAN_FCC1_NCC2 = 0x40,
+	RTW_CHPLAN_GLOBAL_NULL = 0x41,
+	RTW_CHPLAN_ETSI1_ETSI4 = 0x42,
+	RTW_CHPLAN_FCC1_FCC2 = 0x43,
+	RTW_CHPLAN_FCC1_NCC3 = 0x44,
+	RTW_CHPLAN_WORLD_ACMA1 = 0x45,
+	RTW_CHPLAN_FCC1_FCC8 = 0x46,
+	RTW_CHPLAN_WORLD_ETSI6 = 0x47,
+	RTW_CHPLAN_WORLD_ETSI7 = 0x48,
+	RTW_CHPLAN_WORLD_ETSI8 = 0x49,
+	RTW_CHPLAN_IC2_IC2 = 0x4A,
+	RTW_CHPLAN_WORLD_ETSI9 = 0x50,
+	RTW_CHPLAN_WORLD_ETSI10 = 0x51,
+	RTW_CHPLAN_WORLD_ETSI11 = 0x52,
+	RTW_CHPLAN_FCC1_NCC4 = 0x53,
+	RTW_CHPLAN_WORLD_ETSI12 = 0x54,
+	RTW_CHPLAN_FCC1_FCC9 = 0x55,
+	RTW_CHPLAN_WORLD_ETSI13 = 0x56,
+	RTW_CHPLAN_FCC1_FCC10 = 0x57,
+	RTW_CHPLAN_MKK2_MKK4 = 0x58,
+	RTW_CHPLAN_WORLD_ETSI14 = 0x59,
+	RTW_CHPLAN_FCC1_FCC5 = 0x60,
+	RTW_CHPLAN_FCC2_FCC7 = 0x61,
+	RTW_CHPLAN_FCC2_FCC1 = 0x62,
+	RTW_CHPLAN_WORLD_ETSI15 = 0x63,
+	RTW_CHPLAN_MKK2_MKK5 = 0x64,
+	RTW_CHPLAN_ETSI1_ETSI16 = 0x65,
+	RTW_CHPLAN_FCC1_FCC14 = 0x66,
+	RTW_CHPLAN_FCC1_FCC12 = 0x67,
+	RTW_CHPLAN_FCC2_FCC14 = 0x68,
+	RTW_CHPLAN_FCC2_FCC12 = 0x69,
+	RTW_CHPLAN_ETSI1_ETSI17 = 0x6A,
+	RTW_CHPLAN_WORLD_FCC16 = 0x6B,
+	RTW_CHPLAN_WORLD_FCC13 = 0x6C,
+	RTW_CHPLAN_FCC2_FCC15 = 0x6D,
+	RTW_CHPLAN_WORLD_FCC12 = 0x6E,
+	RTW_CHPLAN_NULL_ETSI8 = 0x6F,
+	RTW_CHPLAN_NULL_ETSI18 = 0x70,
+	RTW_CHPLAN_NULL_ETSI17 = 0x71,
+	RTW_CHPLAN_NULL_ETSI19 = 0x72,
+	RTW_CHPLAN_WORLD_FCC7 = 0x73,
+	RTW_CHPLAN_FCC2_FCC17 = 0x74,
+	RTW_CHPLAN_WORLD_ETSI20 = 0x75,
+	RTW_CHPLAN_FCC2_FCC11 = 0x76,
+	RTW_CHPLAN_WORLD_ETSI21 = 0x77,
+	RTW_CHPLAN_FCC1_FCC18 = 0x78,
+	RTW_CHPLAN_MKK2_MKK1 = 0x79,
+
+	RTW_CHPLAN_MAX,
+	RTW_CHPLAN_REALTEK_DEFINE = 0x7F,
+	RTW_CHPLAN_UNSPECIFIED = 0xFF,
+};
+
+u8 rtw_chplan_get_default_regd(u8 id);
+bool rtw_chplan_is_empty(u8 id);
+#define rtw_is_channel_plan_valid(chplan) (((chplan) < RTW_CHPLAN_MAX || (chplan) == RTW_CHPLAN_REALTEK_DEFINE) && !rtw_chplan_is_empty(chplan))
+#define rtw_is_legacy_channel_plan(chplan) ((chplan) < 0x20)
+
+struct _RT_CHANNEL_INFO;
+u8 init_channel_set(_adapter *padapter, u8 ChannelPlan, struct _RT_CHANNEL_INFO *channel_set);
+
+#define IS_ALPHA2_NO_SPECIFIED(_alpha2) ((*((u16 *)(_alpha2))) == 0xFFFF)
+
+#define RTW_MODULE_RTL8821AE_HMC_M2		BIT0	/* RTL8821AE(HMC + M.2) */
+#define RTW_MODULE_RTL8821AU			BIT1	/* RTL8821AU */
+#define RTW_MODULE_RTL8812AENF_NGFF		BIT2	/* RTL8812AENF(8812AE+8761)_NGFF */
+#define RTW_MODULE_RTL8812AEBT_HMC		BIT3	/* RTL8812AEBT(8812AE+8761)_HMC */
+#define RTW_MODULE_RTL8188EE_HMC_M2		BIT4	/* RTL8188EE(HMC + M.2) */
+#define RTW_MODULE_RTL8723BE_HMC_M2		BIT5	/* RTL8723BE(HMC + M.2) */
+#define RTW_MODULE_RTL8723BS_NGFF1216	BIT6	/* RTL8723BS(NGFF1216) */
+#define RTW_MODULE_RTL8192EEBT_HMC_M2	BIT7	/* RTL8192EEBT(8192EE+8761AU)_(HMC + M.2) */
+#define RTW_MODULE_RTL8723DE_NGFF1630	BIT8	/* RTL8723DE(NGFF1630) */
+#define RTW_MODULE_RTL8822BE			BIT9	/* RTL8822BE */
+#define RTW_MODULE_RTL8821CE			BIT10	/* RTL8821CE */
+
+struct country_chplan {
+	char alpha2[2];
+	u8 chplan;
+#ifdef CONFIG_80211AC_VHT
+	u8 en_11ac;
+#endif
+#if RTW_DEF_MODULE_REGULATORY_CERT
+	u16 def_module_flags; /* RTW_MODULE_RTLXXX */
+#endif
+};
+
+#ifdef CONFIG_80211AC_VHT
+#define COUNTRY_CHPLAN_EN_11AC(_ent) ((_ent)->en_11ac)
+#else
+#define COUNTRY_CHPLAN_EN_11AC(_ent) 0
+#endif
+
+#if RTW_DEF_MODULE_REGULATORY_CERT
+#define COUNTRY_CHPLAN_DEF_MODULE_FALGS(_ent) ((_ent)->def_module_flags)
+#else
+#define COUNTRY_CHPLAN_DEF_MODULE_FALGS(_ent) 0
+#endif
+
+const struct country_chplan *rtw_get_chplan_from_country(const char *country_code);
+
+void dump_country_chplan(void *sel, const struct country_chplan *ent);
+void dump_country_chplan_map(void *sel);
+void dump_chplan_id_list(void *sel);
+void dump_chplan_test(void *sel);
+void dump_chplan_ver(void *sel);
+
+#endif /* __RTW_CHPLAN_H__ */
--- a/core/rtw_cmd.c
+++ b/core/rtw_cmd.c
--- a/core/rtw_debug.c
+++ b/core/rtw_debug.c
--- a/core/rtw_ieee80211.c
+++ b/core/rtw_ieee80211.c
@@ -127,6 +127,19 @@ int rtw_get_bit_value_from_ieee_value(u8 val)
 	}
 	return 0;
 }
+uint rtw_get_cckrate_size(u8 *rate, u32 rate_length)
+{
+	int i = 0;
+	while(i < rate_length){
+		RTW_DBG("%s, rate[%d]=%u\n", __FUNCTION__, i, rate[i]);
+		if (((rate[i] & 0x7f) == 2) || ((rate[i] & 0x7f) == 4) ||
+			((rate[i] & 0x7f) == 11)  || ((rate[i] & 0x7f) == 22))
+			i++;
+		else
+			break;
+	}
+	return i;
+}

 uint	rtw_is_cckrates_included(u8 *rate)
 {
@@ -381,6 +394,52 @@ exit:
 	return ret;
 }

+ /* Returns:  remove size OR  _FAIL: not updated*/
+int rtw_remove_ie_g_rate(u8 *ie, uint *ie_len, uint offset, u8 eid)
+{
+	int ret = _FAIL;
+	u8 *tem_target_ie;
+	u8 *target_ie;
+	u32 target_ielen,temp_target_ielen,cck_rate_size,rm_size;
+	u8 *start;
+	uint search_len;
+	u8 *remain_ies;
+	uint remain_len;
+	if (!ie || !ie_len || *ie_len <= offset)
+		goto exit;
+
+	start = ie + offset;
+	search_len = *ie_len - offset;
+
+	while (1) {
+		tem_target_ie=rtw_get_ie(start,eid,&temp_target_ielen,search_len);
+		
+		/*if(tem_target_ie)
+			RTW_INFO("%s, tem_target_ie=%u\n", __FUNCTION__,*tem_target_ie);*/
+		if (tem_target_ie && temp_target_ielen) {
+			cck_rate_size = rtw_get_cckrate_size((tem_target_ie+2), temp_target_ielen);
+			rm_size = temp_target_ielen - cck_rate_size;
+			RTW_DBG("%s,cck_rate_size=%u rm_size=%u\n", __FUNCTION__, cck_rate_size, rm_size);
+			temp_target_ielen=temp_target_ielen + 2;/*org size of  Supposrted Rates(include id + length)*/
+			/*RTW_INFO("%s, temp_target_ielen=%u\n", __FUNCTION__,temp_target_ielen);*/
+			remain_ies = tem_target_ie + temp_target_ielen;
+			remain_len = search_len - (remain_ies - start);
+			target_ielen=cck_rate_size;/*discount g mode rate 6, 9 12,18Mbps,id , length*/
+			*(tem_target_ie+1)=target_ielen;/*set new length to Supposrted Rates*/
+			target_ie=tem_target_ie+target_ielen + 2;/*set target ie to address of rate 6Mbps */
+	
+			_rtw_memmove(target_ie, remain_ies, remain_len);
+			*ie_len = *ie_len - rm_size;
+			ret = rm_size;
+
+			start = target_ie;
+			search_len = remain_len;
+		} else
+			break;
+	}
+exit:
+	return ret;
+}
 void rtw_set_supported_rate(u8 *SupportedRates, uint mode)
 {

@@ -496,7 +555,7 @@ int rtw_generate_ie(struct registry_priv *pregistrypriv)

 #ifdef CONFIG_80211N_HT
 	/* HT Cap. */
-	if (((pregistrypriv->wireless_mode & WIRELESS_11_5N) || (pregistrypriv->wireless_mode & WIRELESS_11_24N))
+	if (is_supported_ht(pregistrypriv->wireless_mode)
 	    && (pregistrypriv->ht_enable == _TRUE)) {
 		/* todo: */
 	}
@@ -677,7 +736,6 @@ int rtw_parse_wpa_ie(u8 *wpa_ie, int wpa_ie_len, int *group_cipher, int *pairwis

 int rtw_rsne_info_parse(const u8 *ie, uint ie_len, struct rsne_info *info)
 {
-	int i;
 	const u8 *pos = ie;
 	u16 cnt;

@@ -819,7 +877,7 @@ exit:
 int rtw_get_wapi_ie(u8 *in_ie, uint in_len, u8 *wapi_ie, u16 *wapi_len)
 {
 	int len = 0;
-	u8 authmode, i;
+	u8 authmode;
 	uint	cnt;
 	u8 wapi_oui1[4] = {0x0, 0x14, 0x72, 0x01};
 	u8 wapi_oui2[4] = {0x0, 0x14, 0x72, 0x02};
@@ -862,7 +920,7 @@ int rtw_get_wapi_ie(u8 *in_ie, uint in_len, u8 *wapi_ie, u16 *wapi_len)

 int rtw_get_sec_ie(u8 *in_ie, uint in_len, u8 *rsn_ie, u16 *rsn_len, u8 *wpa_ie, u16 *wpa_len)
 {
-	u8 authmode, sec_idx, i;
+	u8 authmode, sec_idx;
 	u8 wpa_oui[4] = {0x0, 0x50, 0xf2, 0x01};
 	uint	cnt;

@@ -1287,7 +1345,7 @@ ParseRes rtw_ieee802_11_parse_elems(u8 *start, uint len,
 			elems->timeout_int = pos;
 			elems->timeout_int_len = elen;
 			break;
-		case WLAN_EID_HT_CAPABILITY:
+		case WLAN_EID_HT_CAP:
 			elems->ht_capabilities = pos;
 			elems->ht_capabilities_len = elen;
 			break;
@@ -1303,7 +1361,7 @@ ParseRes rtw_ieee802_11_parse_elems(u8 *start, uint len,
 			elems->vht_operation = pos;
 			elems->vht_operation_len = elen;
 			break;
-		case WLAN_EID_OPMODE_NOTIF:
+		case WLAN_EID_VHT_OP_MODE_NOTIFY:
 			elems->vht_op_mode_notify = pos;
 			elems->vht_op_mode_notify_len = elen;
 			break;
@@ -1543,14 +1601,10 @@ void dump_ht_cap_ie_content(void *sel, const u8 *buf, u32 buf_len)

 void dump_ht_cap_ie(void *sel, const u8 *ie, u32 ie_len)
 {
-	const u8 *pos = ie;
-	u16 id;
-	u16 len;
-
 	const u8 *ht_cap_ie;
 	sint ht_cap_ielen;

-	ht_cap_ie = rtw_get_ie(ie, WLAN_EID_HT_CAPABILITY, &ht_cap_ielen, ie_len);
+	ht_cap_ie = rtw_get_ie(ie, WLAN_EID_HT_CAP, &ht_cap_ielen, ie_len);
 	if (!ie || ht_cap_ie != ie)
 		return;

@@ -1580,10 +1634,6 @@ void dump_ht_op_ie_content(void *sel, const u8 *buf, u32 buf_len)

 void dump_ht_op_ie(void *sel, const u8 *ie, u32 ie_len)
 {
-	const u8 *pos = ie;
-	u16 id;
-	u16 len;
-
 	const u8 *ht_op_ie;
 	sint ht_op_ielen;

@@ -1841,7 +1891,7 @@ u32 rtw_get_p2p_merged_ies_len(u8 *in_ie, u32 in_len)
 	PNDIS_802_11_VARIABLE_IEs	pIE;
 	u8 OUI[4] = { 0x50, 0x6f, 0x9a, 0x09 };
 	int i = 0;
-	int j = 0, len = 0;
+	int len = 0;

 	while (i < in_len) {
 		pIE = (PNDIS_802_11_VARIABLE_IEs)(in_ie + i);
--- a/core/rtw_io.c
+++ b/core/rtw_io.c
@@ -419,9 +419,13 @@ u32 _rtw_write_port_and_wait(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem, int

 	ret = _rtw_write_port(adapter, addr, cnt, pmem);

-	if (ret == _SUCCESS)
+	if (ret == _SUCCESS) {
 		ret = rtw_sctx_wait(&sctx, __func__);

+		if (ret != _SUCCESS)
+			pxmitbuf->sctx = NULL;
+	}
+
 	return ret;
 }

@@ -484,39 +488,192 @@ void rtw_reset_continual_io_error(struct dvobj_priv *dvobj)
 }

 #ifdef DBG_IO
+#define RTW_IO_SNIFF_TYPE_RANGE	0 /* specific address range is accessed */
+#define RTW_IO_SNIFF_TYPE_EN	1 /* part or all sniffed range is enabled */
+#define RTW_IO_SNIFF_TYPE_DIS	2 /* part or all sniffed range is disabled */

-u32 read_sniff_ranges[][2] = {
-	/* {0x520, 0x523}, */
+struct rtw_io_sniff_ent {
+	u8 chip;
+	u8 hci;
+	u32 addr;
+	u8 type;
+	union {
+		u32 end_addr;
+		u32 mask;
+	} u;
+	char *tag;
 };

-u32 write_sniff_ranges[][2] = {
-	/* {0x520, 0x523}, */
-	/* {0x4c, 0x4c}, */
-};
-
-int read_sniff_num = sizeof(read_sniff_ranges) / sizeof(u32) / 2;
-int write_sniff_num = sizeof(write_sniff_ranges) / sizeof(u32) / 2;
-
-bool match_read_sniff_ranges(u32 addr, u16 len)
+const char *rtw_io_sniff_ent_get_tag(const struct rtw_io_sniff_ent *ent)
 {
-	int i;
-	for (i = 0; i < read_sniff_num; i++) {
-		if (addr + len > read_sniff_ranges[i][0] && addr <= read_sniff_ranges[i][1])
-			return _TRUE;
-	}
-
-	return _FALSE;
+	return ent->tag;
 }

-bool match_write_sniff_ranges(u32 addr, u16 len)
+#define RTW_IO_SNIFF_RANGE_ENT(_chip, _hci, _addr, _end_addr, _tag) \
+	{.chip = _chip, .hci = _hci, .addr = _addr, .u.end_addr = _end_addr, .tag = _tag, .type = RTW_IO_SNIFF_TYPE_RANGE,}
+
+#define RTW_IO_SNIFF_EN_ENT(_chip, _hci, _addr, _mask, _tag) \
+	{.chip = _chip, .hci = _hci, .addr = _addr, .u.mask = _mask, .tag = _tag, .type = RTW_IO_SNIFF_TYPE_EN,}
+
+#define RTW_IO_SNIFF_DIS_ENT(_chip, _hci, _addr, _mask, _tag) \
+	{.chip = _chip, .hci = _hci, .addr = _addr, .u.mask = _mask, .tag = _tag, .type = RTW_IO_SNIFF_TYPE_DIS,}
+
+const struct rtw_io_sniff_ent read_sniff[] = {
+#ifdef DBG_IO_HCI_EN_CHK
+	RTW_IO_SNIFF_EN_ENT(MAX_CHIP_TYPE, RTW_SDIO, 0x02, 0x1FC, "SDIO 0x02[8:2] not all 0"),
+	RTW_IO_SNIFF_EN_ENT(MAX_CHIP_TYPE, RTW_USB, 0x02, 0x1E0, "USB 0x02[8:5] not all 0"),
+	RTW_IO_SNIFF_EN_ENT(MAX_CHIP_TYPE, RTW_PCIE, 0x02, 0x01C, "PCI 0x02[4:2] not all 0"),
+#endif
+#ifdef DBG_IO_SNIFF_EXAMPLE
+	RTW_IO_SNIFF_RANGE_ENT(MAX_CHIP_TYPE, 0, 0x522, 0x522, "read TXPAUSE"),
+	RTW_IO_SNIFF_DIS_ENT(MAX_CHIP_TYPE, 0, 0x02, 0x3, "0x02[1:0] not all 1"),
+#endif
+};
+
+const int read_sniff_num = sizeof(read_sniff) / sizeof(struct rtw_io_sniff_ent);
+
+const struct rtw_io_sniff_ent write_sniff[] = {
+#ifdef DBG_IO_HCI_EN_CHK
+	RTW_IO_SNIFF_EN_ENT(MAX_CHIP_TYPE, RTW_SDIO, 0x02, 0x1FC, "SDIO 0x02[8:2] not all 0"),
+	RTW_IO_SNIFF_EN_ENT(MAX_CHIP_TYPE, RTW_USB, 0x02, 0x1E0, "USB 0x02[8:5] not all 0"),
+	RTW_IO_SNIFF_EN_ENT(MAX_CHIP_TYPE, RTW_PCIE, 0x02, 0x01C, "PCI 0x02[4:2] not all 0"),
+#endif
+#ifdef DBG_IO_SNIFF_EXAMPLE
+	RTW_IO_SNIFF_RANGE_ENT(MAX_CHIP_TYPE, 0, 0x522, 0x522, "write TXPAUSE"),
+	RTW_IO_SNIFF_DIS_ENT(MAX_CHIP_TYPE, 0, 0x02, 0x3, "0x02[1:0] not all 1"),
+#endif
+};
+
+const int write_sniff_num = sizeof(write_sniff) / sizeof(struct rtw_io_sniff_ent);
+
+static bool match_io_sniff_ranges(_adapter *adapter
+	, const struct rtw_io_sniff_ent *sniff, int i, u32 addr, u16 len)
 {
-	int i;
-	for (i = 0; i < write_sniff_num; i++) {
-		if (addr + len > write_sniff_ranges[i][0] && addr <= write_sniff_ranges[i][1])
-			return _TRUE;
+
+	/* check if IO range after sniff end address */
+	if (addr > sniff->u.end_addr)
+		return 0;
+
+	return 1;
+}
+
+static bool match_io_sniff_en(_adapter *adapter
+	, const struct rtw_io_sniff_ent *sniff, int i, u32 addr, u8 len, u32 val)
+{
+	u8 sniff_len;
+	u8 shift;
+	u32 mask;
+	bool ret = 0;
+
+	/* check if IO range after sniff end address */
+	sniff_len = 4;
+	while (!(sniff->u.mask & (0xFF << ((sniff_len - 1) * 8)))) {
+		sniff_len--;
+		if (sniff_len == 0)
+			goto exit;
+	}
+	if (sniff->addr + sniff_len <= addr)
+		goto exit;
+
+	if (sniff->addr > addr) {
+		shift = (sniff->addr - addr) * 8;
+		mask = sniff->u.mask << shift;
+	} else if (sniff->addr < addr) {
+		shift = (addr - sniff->addr) * 8;
+		mask = sniff->u.mask >> shift;
+	} else {
+		shift = 0;
+		mask = sniff->u.mask;
 	}

-	return _FALSE;
+	if (sniff->type == RTW_IO_SNIFF_TYPE_DIS) {
+		if (len == 4)
+			mask &= 0xFFFFFFFF;
+		else if (len == 3)
+			mask &= 0x00FFFFFF;
+		else if (len == 2)
+			mask &= 0x0000FFFF;
+		else if (len == 1)
+			mask &= 0x000000FF;
+		else
+			mask &= 0x00000000;
+	}
+	
+	if ((sniff->type == RTW_IO_SNIFF_TYPE_EN && (mask & val))
+		|| (sniff->type == RTW_IO_SNIFF_TYPE_DIS && (mask & val) != mask)
+	) {
+		ret = 1;
+		if (0)
+			RTW_INFO(FUNC_ADPT_FMT" addr:0x%x len:%u val:0x%x i:%d sniff_len:%u shift:%u mask:0x%x\n"
+				, FUNC_ADPT_ARG(adapter), addr, len, val, i, sniff_len, shift, mask);
+	}
+
+exit:
+	return ret;
+}
+
+static bool match_io_sniff(_adapter *adapter
+	, const struct rtw_io_sniff_ent *sniff, int i, u32 addr, u8 len, u32 val)
+{
+	bool ret = 0;
+
+	if (sniff->chip != MAX_CHIP_TYPE
+		&& sniff->chip != rtw_get_chip_type(adapter))
+		goto exit;
+	if (sniff->hci
+		&& !(sniff->hci & rtw_get_intf_type(adapter)))
+		goto exit;
+	if (sniff->addr >= addr + len) /* IO range below sniff start address */
+		goto exit;
+
+	switch (sniff->type) {
+	case RTW_IO_SNIFF_TYPE_RANGE:
+		ret = match_io_sniff_ranges(adapter, sniff, i, addr, len);
+		break;
+	case RTW_IO_SNIFF_TYPE_EN:
+	case RTW_IO_SNIFF_TYPE_DIS:
+		if (len == 1 || len == 2 || len == 4)
+			ret = match_io_sniff_en(adapter, sniff, i, addr, len, val);
+		break;
+	default:
+		rtw_warn_on(1);
+		break;
+	}
+
+exit:
+	return ret;
+}
+
+const struct rtw_io_sniff_ent *match_read_sniff(_adapter *adapter
+	, u32 addr, u16 len, u32 val)
+{
+	int i;
+	bool ret = 0;
+
+	for (i = 0; i < read_sniff_num; i++) {
+		ret = match_io_sniff(adapter, &read_sniff[i], i, addr, len, val);
+		if (ret)
+			goto exit;
+	}
+
+exit:
+	return ret ? &read_sniff[i] : NULL;
+}
+
+const struct rtw_io_sniff_ent *match_write_sniff(_adapter *adapter
+	, u32 addr, u16 len, u32 val)
+{
+	int i;
+	bool ret = 0;
+
+	for (i = 0; i < write_sniff_num; i++) {
+		ret = match_io_sniff(adapter, &write_sniff[i], i, addr, len, val);
+		if (ret)
+			goto exit;
+	}
+
+exit:
+	return ret ? &write_sniff[i] : NULL;
 }

 struct rf_sniff_ent {
@@ -538,7 +695,7 @@ struct rf_sniff_ent rf_write_sniff_ranges[] = {
 int rf_read_sniff_num = sizeof(rf_read_sniff_ranges) / sizeof(struct rf_sniff_ent);
 int rf_write_sniff_num = sizeof(rf_write_sniff_ranges) / sizeof(struct rf_sniff_ent);

-bool match_rf_read_sniff_ranges(u8 path, u32 addr, u32 mask)
+bool match_rf_read_sniff_ranges(_adapter *adapter, u8 path, u32 addr, u32 mask)
 {
 	int i;

@@ -551,7 +708,7 @@ bool match_rf_read_sniff_ranges(u8 path, u32 addr, u32 mask)
 	return _FALSE;
 }

-bool match_rf_write_sniff_ranges(u8 path, u32 addr, u32 mask)
+bool match_rf_write_sniff_ranges(_adapter *adapter, u8 path, u32 addr, u32 mask)
 {
 	int i;

@@ -567,9 +724,12 @@ bool match_rf_write_sniff_ranges(u8 path, u32 addr, u32 mask)
 u8 dbg_rtw_read8(_adapter *adapter, u32 addr, const char *caller, const int line)
 {
 	u8 val = _rtw_read8(adapter, addr);
+	const struct rtw_io_sniff_ent *ent = match_read_sniff(adapter, addr, 1, val);

-	if (match_read_sniff_ranges(addr, 1))
-		RTW_INFO("DBG_IO %s:%d rtw_read8(0x%04x) return 0x%02x\n", caller, line, addr, val);
+	if (ent) {
+		RTW_INFO("DBG_IO %s:%d rtw_read8(0x%04x) return 0x%02x %s\n"
+			, caller, line, addr, val, rtw_io_sniff_ent_get_tag(ent));
+	}

 	return val;
 }
@@ -577,9 +737,12 @@ u8 dbg_rtw_read8(_adapter *adapter, u32 addr, const char *caller, const int line
 u16 dbg_rtw_read16(_adapter *adapter, u32 addr, const char *caller, const int line)
 {
 	u16 val = _rtw_read16(adapter, addr);
+	const struct rtw_io_sniff_ent *ent = match_read_sniff(adapter, addr, 2, val);

-	if (match_read_sniff_ranges(addr, 2))
-		RTW_INFO("DBG_IO %s:%d rtw_read16(0x%04x) return 0x%04x\n", caller, line, addr, val);
+	if (ent) {
+		RTW_INFO("DBG_IO %s:%d rtw_read16(0x%04x) return 0x%04x %s\n"
+			, caller, line, addr, val, rtw_io_sniff_ent_get_tag(ent));
+	}

 	return val;
 }
@@ -587,38 +750,57 @@ u16 dbg_rtw_read16(_adapter *adapter, u32 addr, const char *caller, const int li
 u32 dbg_rtw_read32(_adapter *adapter, u32 addr, const char *caller, const int line)
 {
 	u32 val = _rtw_read32(adapter, addr);
+	const struct rtw_io_sniff_ent *ent = match_read_sniff(adapter, addr, 4, val);

-	if (match_read_sniff_ranges(addr, 4))
-		RTW_INFO("DBG_IO %s:%d rtw_read32(0x%04x) return 0x%08x\n", caller, line, addr, val);
+	if (ent) {
+		RTW_INFO("DBG_IO %s:%d rtw_read32(0x%04x) return 0x%08x %s\n"
+			, caller, line, addr, val, rtw_io_sniff_ent_get_tag(ent));
+	}

 	return val;
 }

 int dbg_rtw_write8(_adapter *adapter, u32 addr, u8 val, const char *caller, const int line)
 {
-	if (match_write_sniff_ranges(addr, 1))
-		RTW_INFO("DBG_IO %s:%d rtw_write8(0x%04x, 0x%02x)\n", caller, line, addr, val);
+	const struct rtw_io_sniff_ent *ent = match_write_sniff(adapter, addr, 1, val);
+
+	if (ent) {
+		RTW_INFO("DBG_IO %s:%d rtw_write8(0x%04x, 0x%02x) %s\n"
+			, caller, line, addr, val, rtw_io_sniff_ent_get_tag(ent));
+	}

 	return _rtw_write8(adapter, addr, val);
 }
 int dbg_rtw_write16(_adapter *adapter, u32 addr, u16 val, const char *caller, const int line)
 {
-	if (match_write_sniff_ranges(addr, 2))
-		RTW_INFO("DBG_IO %s:%d rtw_write16(0x%04x, 0x%04x)\n", caller, line, addr, val);
+	const struct rtw_io_sniff_ent *ent = match_write_sniff(adapter, addr, 2, val);
+
+	if (ent) {
+		RTW_INFO("DBG_IO %s:%d rtw_write16(0x%04x, 0x%04x) %s\n"
+			, caller, line, addr, val, rtw_io_sniff_ent_get_tag(ent));
+	}

 	return _rtw_write16(adapter, addr, val);
 }
 int dbg_rtw_write32(_adapter *adapter, u32 addr, u32 val, const char *caller, const int line)
 {
-	if (match_write_sniff_ranges(addr, 4))
-		RTW_INFO("DBG_IO %s:%d rtw_write32(0x%04x, 0x%08x)\n", caller, line, addr, val);
+	const struct rtw_io_sniff_ent *ent = match_write_sniff(adapter, addr, 4, val);
+
+	if (ent) {
+		RTW_INFO("DBG_IO %s:%d rtw_write32(0x%04x, 0x%08x) %s\n"
+			, caller, line, addr, val, rtw_io_sniff_ent_get_tag(ent));
+	}

 	return _rtw_write32(adapter, addr, val);
 }
 int dbg_rtw_writeN(_adapter *adapter, u32 addr , u32 length , u8 *data, const char *caller, const int line)
 {
-	if (match_write_sniff_ranges(addr, length))
-		RTW_INFO("DBG_IO %s:%d rtw_writeN(0x%04x, %u)\n", caller, line, addr, length);
+	const struct rtw_io_sniff_ent *ent = match_write_sniff(adapter, addr, length, 0);
+
+	if (ent) {
+		RTW_INFO("DBG_IO %s:%d rtw_writeN(0x%04x, %u) %s\n"
+			, caller, line, addr, length, rtw_io_sniff_ent_get_tag(ent));
+	}

 	return _rtw_writeN(adapter, addr, length, data);
 }
@@ -629,8 +811,12 @@ u8 dbg_rtw_sd_f0_read8(_adapter *adapter, u32 addr, const char *caller, const in
 	u8 val = _rtw_sd_f0_read8(adapter, addr);

 #if 0
-	if (match_read_sniff_ranges(addr, 1))
-		RTW_INFO("DBG_IO %s:%d rtw_sd_f0_read8(0x%04x) return 0x%02x\n", caller, line, addr, val);
+	const struct rtw_io_sniff_ent *ent = match_read_sniff(adapter, addr, 1, val);
+
+	if (ent) {
+		RTW_INFO("DBG_IO %s:%d rtw_sd_f0_read8(0x%04x) return 0x%02x %s\n"
+			, caller, line, addr, val, rtw_io_sniff_ent_get_tag(ent));
+	}
 #endif

 	return val;
@@ -640,9 +826,12 @@ u8 dbg_rtw_sd_f0_read8(_adapter *adapter, u32 addr, const char *caller, const in
 u8 dbg_rtw_sd_iread8(_adapter *adapter, u32 addr, const char *caller, const int line)
 {
 	u8 val = rtw_sd_iread8(adapter, addr);
+	const struct rtw_io_sniff_ent *ent = match_read_sniff(adapter, addr, 1, val);

-	if (match_read_sniff_ranges(addr, 1))
-		RTW_INFO("DBG_IO %s:%d rtw_sd_iread8(0x%04x) return 0x%02x\n", caller, line, addr, val);
+	if (ent) {
+		RTW_INFO("DBG_IO %s:%d rtw_sd_iread8(0x%04x) return 0x%02x %s\n"
+			, caller, line, addr, val, rtw_io_sniff_ent_get_tag(ent));
+	}

 	return val;
 }
@@ -650,9 +839,12 @@ u8 dbg_rtw_sd_iread8(_adapter *adapter, u32 addr, const char *caller, const int
 u16 dbg_rtw_sd_iread16(_adapter *adapter, u32 addr, const char *caller, const int line)
 {
 	u16 val = _rtw_sd_iread16(adapter, addr);
+	const struct rtw_io_sniff_ent *ent = match_read_sniff(adapter, addr, 2, val);

-	if (match_read_sniff_ranges(addr, 2))
-		RTW_INFO("DBG_IO %s:%d rtw_sd_iread16(0x%04x) return 0x%04x\n", caller, line, addr, val);
+	if (ent) {
+		RTW_INFO("DBG_IO %s:%d rtw_sd_iread16(0x%04x) return 0x%04x %s\n"
+			, caller, line, addr, val, rtw_io_sniff_ent_get_tag(ent));
+	}

 	return val;
 }
@@ -660,31 +852,46 @@ u16 dbg_rtw_sd_iread16(_adapter *adapter, u32 addr, const char *caller, const in
 u32 dbg_rtw_sd_iread32(_adapter *adapter, u32 addr, const char *caller, const int line)
 {
 	u32 val = _rtw_sd_iread32(adapter, addr);
+	const struct rtw_io_sniff_ent *ent = match_read_sniff(adapter, addr, 4, val);

-	if (match_read_sniff_ranges(addr, 4))
-		RTW_INFO("DBG_IO %s:%d rtw_sd_iread32(0x%04x) return 0x%08x\n", caller, line, addr, val);
+	if (ent) {
+		RTW_INFO("DBG_IO %s:%d rtw_sd_iread32(0x%04x) return 0x%08x %s\n"
+			, caller, line, addr, val, rtw_io_sniff_ent_get_tag(ent));
+	}

 	return val;
 }

 int dbg_rtw_sd_iwrite8(_adapter *adapter, u32 addr, u8 val, const char *caller, const int line)
 {
-	if (match_write_sniff_ranges(addr, 1))
-		RTW_INFO("DBG_IO %s:%d rtw_sd_iwrite8(0x%04x, 0x%02x)\n", caller, line, addr, val);
+	const struct rtw_io_sniff_ent *ent = match_write_sniff(adapter, addr, 1, val);
+
+	if (ent) {
+		RTW_INFO("DBG_IO %s:%d rtw_sd_iwrite8(0x%04x, 0x%02x) %s\n"
+			, caller, line, addr, val, rtw_io_sniff_ent_get_tag(ent));
+	}

 	return _rtw_sd_iwrite8(adapter, addr, val);
 }
 int dbg_rtw_sd_iwrite16(_adapter *adapter, u32 addr, u16 val, const char *caller, const int line)
 {
-	if (match_write_sniff_ranges(addr, 2))
-		RTW_INFO("DBG_IO %s:%d rtw_sd_iwrite16(0x%04x, 0x%04x)\n", caller, line, addr, val);
+	const struct rtw_io_sniff_ent *ent = match_write_sniff(adapter, addr, 2, val);
+
+	if (ent) {
+		RTW_INFO("DBG_IO %s:%d rtw_sd_iwrite16(0x%04x, 0x%04x) %s\n"
+			, caller, line, addr, val, rtw_io_sniff_ent_get_tag(ent));
+	}

 	return _rtw_sd_iwrite16(adapter, addr, val);
 }
 int dbg_rtw_sd_iwrite32(_adapter *adapter, u32 addr, u32 val, const char *caller, const int line)
 {
-	if (match_write_sniff_ranges(addr, 4))
-		RTW_INFO("DBG_IO %s:%d rtw_sd_iwrite32(0x%04x, 0x%08x)\n", caller, line, addr, val);
+	const struct rtw_io_sniff_ent *ent = match_write_sniff(adapter, addr, 4, val);
+
+	if (ent) {
+		RTW_INFO("DBG_IO %s:%d rtw_sd_iwrite32(0x%04x, 0x%08x) %s\n"
+			, caller, line, addr, val, rtw_io_sniff_ent_get_tag(ent));
+	}

 	return _rtw_sd_iwrite32(adapter, addr, val);
 }
--- a/core/rtw_ioctl_set.c
+++ b/core/rtw_ioctl_set.c
@@ -42,7 +42,9 @@ u8 rtw_validate_bssid(u8 *bssid)

 u8 rtw_validate_ssid(NDIS_802_11_SSID *ssid)
 {
+#ifdef CONFIG_VALIDATE_SSID
 	u8	 i;
+#endif
 	u8	ret = _TRUE;


@@ -106,10 +108,17 @@ u8 rtw_do_join(_adapter *padapter)
 		if (pmlmepriv->LinkDetectInfo.bBusyTraffic == _FALSE
 		    || rtw_to_roam(padapter) > 0
 		   ) {
-			/* submit site_survey_cmd */
-			ret = rtw_sitesurvey_cmd(padapter, &parm);
-			if (_SUCCESS != ret) {
+			u8 ssc_chk = rtw_sitesurvey_condition_check(padapter, _FALSE);
+
+			if ((ssc_chk == SS_ALLOW) || (ssc_chk == SS_DENY_BUSY_TRAFFIC) ){
+				/* submit site_survey_cmd */
+				ret = rtw_sitesurvey_cmd(padapter, &parm);
+				if (_SUCCESS != ret)
+					pmlmepriv->to_join = _FALSE;
+			} else {
+				/*if (ssc_chk == SS_DENY_BUDDY_UNDER_SURVEY)*/
 				pmlmepriv->to_join = _FALSE;
+				ret = _FAIL;
 			}
 		} else {
 			pmlmepriv->to_join = _FALSE;
@@ -155,26 +164,22 @@ u8 rtw_do_join(_adapter *padapter)
 				/* can't associate ; reset under-linking			 */
 				_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);

-#if 0
-				if ((check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _TRUE)) {
-					if (_rtw_memcmp(pmlmepriv->cur_network.network.Ssid.Ssid, pmlmepriv->assoc_ssid.Ssid, pmlmepriv->assoc_ssid.SsidLength)) {
-						/* for funk to do roaming */
-						/* funk will reconnect, but funk will not sitesurvey before reconnect */
-						if (pmlmepriv->sitesurveyctrl.traffic_busy == _FALSE)
-							rtw_sitesurvey_cmd(padapter, &parm);
-					}
-
-				}
-#endif
-
 				/* when set_ssid/set_bssid for rtw_do_join(), but there are no desired bss in scanning queue */
 				/* we try to issue sitesurvey firstly			 */
 				if (pmlmepriv->LinkDetectInfo.bBusyTraffic == _FALSE
 				    || rtw_to_roam(padapter) > 0
 				   ) {
-					/* RTW_INFO("rtw_do_join() when   no desired bss in scanning queue\n"); */
-					ret = rtw_sitesurvey_cmd(padapter, &parm);
-					if (_SUCCESS != ret) {
+					u8 ssc_chk = rtw_sitesurvey_condition_check(padapter, _FALSE);
+
+					if ((ssc_chk == SS_ALLOW) || (ssc_chk == SS_DENY_BUSY_TRAFFIC)){
+						/* RTW_INFO(("rtw_do_join() when   no desired bss in scanning queue\n"); */
+						ret = rtw_sitesurvey_cmd(padapter, &parm);
+						if (_SUCCESS != ret)
+							pmlmepriv->to_join = _FALSE;
+					} else {
+						/*if (ssc_chk == SS_DENY_BUDDY_UNDER_SURVEY) {
+						} else {*/
+						ret = _FAIL;
 						pmlmepriv->to_join = _FALSE;
 					}
 				} else {
@@ -307,7 +312,7 @@ u8 rtw_set_802_11_bssid(_adapter *padapter, u8 *bssid)
 			if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
 				rtw_indicate_disconnect(padapter, 0, _FALSE);

-			rtw_free_assoc_resources(padapter, 1);
+			rtw_free_assoc_resources_cmd(padapter, _TRUE, 0);

 			if ((check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE)) {
 				_clr_fwstate_(pmlmepriv, WIFI_ADHOC_MASTER_STATE);
@@ -344,7 +349,6 @@ u8 rtw_set_802_11_ssid(_adapter *padapter, NDIS_802_11_SSID *ssid)
 {
 	_irqL irqL;
 	u8 status = _SUCCESS;
-	u32 cur_time = 0;

 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
 	struct wlan_network *pnetwork = &pmlmepriv->cur_network;
@@ -379,7 +383,7 @@ u8 rtw_set_802_11_ssid(_adapter *padapter, NDIS_802_11_SSID *ssid)
 					if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
 						rtw_indicate_disconnect(padapter, 0, _FALSE);

-					rtw_free_assoc_resources(padapter, 1);
+					rtw_free_assoc_resources_cmd(padapter, _TRUE, 0);

 					if (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE) {
 						_clr_fwstate_(pmlmepriv, WIFI_ADHOC_MASTER_STATE);
@@ -400,7 +404,7 @@ u8 rtw_set_802_11_ssid(_adapter *padapter, NDIS_802_11_SSID *ssid)
 			if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
 				rtw_indicate_disconnect(padapter, 0, _FALSE);

-			rtw_free_assoc_resources(padapter, 1);
+			rtw_free_assoc_resources_cmd(padapter, _TRUE, 0);

 			if (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE) {
 				_clr_fwstate_(pmlmepriv, WIFI_ADHOC_MASTER_STATE);
@@ -442,7 +446,6 @@ u8 rtw_set_802_11_connect(_adapter *padapter, u8 *bssid, NDIS_802_11_SSID *ssid)
 {
 	_irqL irqL;
 	u8 status = _SUCCESS;
-	u32 cur_time = 0;
 	bool bssid_valid = _TRUE;
 	bool ssid_valid = _TRUE;
 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
@@ -508,7 +511,7 @@ exit:
 }

 u8 rtw_set_802_11_infrastructure_mode(_adapter *padapter,
-			      NDIS_802_11_NETWORK_INFRASTRUCTURE networktype)
+			      NDIS_802_11_NETWORK_INFRASTRUCTURE networktype, u8 flags)
 {
 	_irqL irqL;
 	struct	mlme_priv	*pmlmepriv = &padapter->mlmepriv;
@@ -516,6 +519,7 @@ u8 rtw_set_802_11_infrastructure_mode(_adapter *padapter,
 	NDIS_802_11_NETWORK_INFRASTRUCTURE *pold_state = &(cur_network->network.InfrastructureMode);
 	u8 ap2sta_mode = _FALSE;
 	u8 ret = _TRUE;
+	u8 is_linked = _FALSE, is_adhoc_master = _FALSE;

 	if (*pold_state != networktype) {
 		/* RTW_INFO("change mode, old_mode=%d, new_mode=%d, fw_state=0x%x\n", *pold_state, networktype, get_fwstate(pmlmepriv)); */
@@ -532,20 +536,30 @@ u8 rtw_set_802_11_infrastructure_mode(_adapter *padapter,
 		}

 		_enter_critical_bh(&pmlmepriv->lock, &irqL);
+		is_linked = check_fwstate(pmlmepriv, _FW_LINKED);
+		is_adhoc_master = check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE);

-		if ((check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE) || (*pold_state == Ndis802_11IBSS))
-			rtw_disassoc_cmd(padapter, 0, 0);
+		/* flags = 0, means enqueue cmd and no wait */
+		if (flags != 0)
+			_exit_critical_bh(&pmlmepriv->lock, &irqL);

-		if ((check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE) ||
-		    (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE))
-			rtw_free_assoc_resources(padapter, 1);
+		if ((is_linked == _TRUE) || (*pold_state == Ndis802_11IBSS))
+			rtw_disassoc_cmd(padapter, 0, flags);
+
+		if ((is_linked == _TRUE) ||
+		    (is_adhoc_master == _TRUE))
+			rtw_free_assoc_resources_cmd(padapter, _TRUE, flags);

 		if ((*pold_state == Ndis802_11Infrastructure) || (*pold_state == Ndis802_11IBSS)) {
-			if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE) {
+			if (is_linked == _TRUE) {
 				rtw_indicate_disconnect(padapter, 0, _FALSE); /*will clr Linked_state; before this function, we must have checked whether issue dis-assoc_cmd or not*/
 			}
 		}

+		/* flags = 0, means enqueue cmd and no wait */
+		if (flags != 0)
+			_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
 		*pold_state = networktype;

 		_clr_fwstate_(pmlmepriv, ~WIFI_NULL_STATE);
@@ -612,7 +626,7 @@ u8 rtw_set_802_11_disassociate(_adapter *padapter)
 		rtw_disassoc_cmd(padapter, 0, 0);
 		rtw_indicate_disconnect(padapter, 0, _FALSE);
 		/* modify for CONFIG_IEEE80211W, none 11w can use it */
-		rtw_free_assoc_resources_cmd(padapter);
+		rtw_free_assoc_resources_cmd(padapter, _TRUE, 0);
 		if (_FAIL == rtw_pwr_wakeup(padapter))
 			RTW_INFO("%s(): rtw_pwr_wakeup fail !!!\n", __FUNCTION__);
 	}
@@ -768,10 +782,13 @@ exit:
 */
 u16 rtw_get_cur_max_rate(_adapter *adapter)
 {
+	int j;
 	int	i = 0;
 	u16	rate = 0, max_rate = 0;
 	struct mlme_priv	*pmlmepriv = &adapter->mlmepriv;
 	WLAN_BSSID_EX	*pcur_bss = &pmlmepriv->cur_network.network;
+	int	sta_bssrate_len = 0;
+	unsigned char	sta_bssrate[NumRates];
 	struct sta_info *psta = NULL;
 	u8	short_GI = 0;
 #ifdef CONFIG_80211N_HT
@@ -811,16 +828,38 @@ u16 rtw_get_cur_max_rate(_adapter *adapter)
 	else
 #endif /* CONFIG_80211N_HT */
 	{
+		/*station mode show :station && ap support rate; softap :show ap support rate*/	
+		if (check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _TRUE)
+			get_rate_set(adapter, sta_bssrate, &sta_bssrate_len);/*get sta rate and length*/
+
+
 		while ((pcur_bss->SupportedRates[i] != 0) && (pcur_bss->SupportedRates[i] != 0xFF)) {
-			rate = pcur_bss->SupportedRates[i] & 0x7F;
-			if (rate > max_rate)
-				max_rate = rate;
+			rate = pcur_bss->SupportedRates[i] & 0x7F;/*AP support rates*/
+			/*RTW_INFO("%s rate=%02X \n", __func__, rate);*/
+
+			/*check STA  support rate or not */
+			if (check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _TRUE) {
+				for (j = 0; j < sta_bssrate_len; j++) {
+					/* Avoid the proprietary data rate (22Mbps) of Handlink WSG-4000 AP */
+					if ((rate | IEEE80211_BASIC_RATE_MASK)
+					    == (sta_bssrate[j] | IEEE80211_BASIC_RATE_MASK)) {
+						if (rate > max_rate) {
+							max_rate = rate;
+						}
+						break;
+					}
+				}
+			} else {
+			
+				if (rate > max_rate)
+					max_rate = rate;
+
+			}
 			i++;
 		}

 		max_rate = max_rate * 10 / 2;
 	}
-
 	return max_rate;
 }

@@ -850,9 +889,6 @@ int rtw_set_scan_mode(_adapter *adapter, RT_SCAN_TYPE scan_mode)
 */
 int rtw_set_channel_plan(_adapter *adapter, u8 channel_plan)
 {
-	struct registry_priv *pregistrypriv = &adapter->registrypriv;
-	struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
-
 	/* handle by cmd_thread to sync with scan operation */
 	return rtw_set_chplan_cmd(adapter, RTW_CMDF_WAIT_ACK, channel_plan, 1);
 }
--- a/core/rtw_iol.c
+++ b/core/rtw_iol.c
@@ -301,24 +301,36 @@ int _rtw_IOL_append_WD_cmd(struct xmit_frame *xmit_frame, u16 addr, u32 value)
 #ifdef DBG_IO
 int dbg_rtw_IOL_append_WB_cmd(struct xmit_frame *xmit_frame, u16 addr, u8 value, const char *caller, const int line)
 {
-	if (match_write_sniff_ranges(addr, 1))
-		RTW_INFO("DBG_IO %s:%d IOL_WB(0x%04x, 0x%02x)\n", caller, line, addr, value);
+	const struct rtw_io_sniff_ent *ent = match_write_sniff(xmit_frame->padapter, addr, 1, value);
+
+	if (ent) {
+		RTW_INFO("DBG_IO %s:%d IOL_WB(0x%04x, 0x%02x) %s\n"
+			, caller, line, addr, value, rtw_io_sniff_ent_get_tag(ent));
+	}

 	return _rtw_IOL_append_WB_cmd(xmit_frame, addr, value);
 }

 int dbg_rtw_IOL_append_WW_cmd(struct xmit_frame *xmit_frame, u16 addr, u16 value, const char *caller, const int line)
 {
-	if (match_write_sniff_ranges(addr, 2))
-		RTW_INFO("DBG_IO %s:%d IOL_WW(0x%04x, 0x%04x)\n", caller, line, addr, value);
+	const struct rtw_io_sniff_ent *ent = match_write_sniff(xmit_frame->padapter, addr, 2, value);
+
+	if (ent) {
+		RTW_INFO("DBG_IO %s:%d IOL_WW(0x%04x, 0x%04x) %s\n"
+			, caller, line, addr, value, rtw_io_sniff_ent_get_tag(ent));
+	}

 	return _rtw_IOL_append_WW_cmd(xmit_frame, addr, value);
 }

 int dbg_rtw_IOL_append_WD_cmd(struct xmit_frame *xmit_frame, u16 addr, u32 value, const char *caller, const int line)
 {
-	if (match_write_sniff_ranges(addr, 4))
-		RTW_INFO("DBG_IO %s:%d IOL_WD(0x%04x, 0x%08x)\n", caller, line, addr, value);
+	const struct rtw_io_sniff_ent *ent = match_write_sniff(xmit_frame->padapter, addr, 4, value);
+
+	if (ent) {
+		RTW_INFO("DBG_IO %s:%d IOL_WD(0x%04x, 0x%08x) %s\n"
+			, caller, line, addr, value, rtw_io_sniff_ent_get_tag(ent));
+	}

 	return _rtw_IOL_append_WD_cmd(xmit_frame, addr, value);
 }
--- a/core/rtw_mi.c
+++ b/core/rtw_mi.c
@@ -27,6 +27,7 @@ void rtw_mi_update_union_chan_inf(_adapter *adapter, u8 ch, u8 offset , u8 bw)
 	iface_state->union_offset = offset;
 }

+#ifdef DBG_IFACE_STATUS
 #ifdef CONFIG_P2P
 static u8 _rtw_mi_p2p_listen_scan_chk(_adapter *adapter)
 {
@@ -46,6 +47,8 @@ static u8 _rtw_mi_p2p_listen_scan_chk(_adapter *adapter)
 	return p2p_listen_scan_state;
 }
 #endif
+#endif
+
 u8 rtw_mi_stayin_union_ch_chk(_adapter *adapter)
 {
 	u8 rst = _TRUE;
@@ -104,9 +107,8 @@ u8 rtw_mi_stayin_union_band_chk(_adapter *adapter)
 }

 /* Find union about ch, bw, ch_offset of all linked/linking interfaces */
-int _rtw_mi_get_ch_setting_union(_adapter *adapter, u8 *ch, u8 *bw, u8 *offset, bool include_self)
+int rtw_mi_get_ch_setting_union_by_ifbmp(struct dvobj_priv *dvobj, u8 ifbmp, u8 *ch, u8 *bw, u8 *offset)
 {
-	struct dvobj_priv *dvobj = adapter_to_dvobj(adapter);
 	_adapter *iface;
 	struct mlme_ext_priv *mlmeext;
 	int i;
@@ -124,6 +126,9 @@ int _rtw_mi_get_ch_setting_union(_adapter *adapter, u8 *ch, u8 *bw, u8 *offset,

 	for (i = 0; i < dvobj->iface_nums; i++) {
 		iface = dvobj->padapters[i];
+		if (!iface || !(ifbmp & BIT(iface->iface_id)))
+			continue;
+
 		mlmeext = &iface->mlmeextpriv;

 		if (!check_fwstate(&iface->mlmepriv, _FW_LINKED | _FW_UNDER_LINKING))
@@ -132,9 +137,6 @@ int _rtw_mi_get_ch_setting_union(_adapter *adapter, u8 *ch, u8 *bw, u8 *offset,
 		if (check_fwstate(&iface->mlmepriv, WIFI_OP_CH_SWITCHING))
 			continue;

-		if (include_self == _FALSE && adapter == iface)
-			continue;
-
 		if (num == 0) {
 			ch_ret = mlmeext->cur_channel;
 			bw_ret = mlmeext->cur_bwmode;
@@ -173,22 +175,17 @@ int _rtw_mi_get_ch_setting_union(_adapter *adapter, u8 *ch, u8 *bw, u8 *offset,

 inline int rtw_mi_get_ch_setting_union(_adapter *adapter, u8 *ch, u8 *bw, u8 *offset)
 {
-	return _rtw_mi_get_ch_setting_union(adapter, ch, bw, offset, 1);
+	return rtw_mi_get_ch_setting_union_by_ifbmp(adapter_to_dvobj(adapter), 0xFF, ch, bw, offset);
 }

 inline int rtw_mi_get_ch_setting_union_no_self(_adapter *adapter, u8 *ch, u8 *bw, u8 *offset)
 {
-	return _rtw_mi_get_ch_setting_union(adapter, ch, bw, offset, 0);
+	return rtw_mi_get_ch_setting_union_by_ifbmp(adapter_to_dvobj(adapter), 0xFF & ~BIT(adapter->iface_id), ch, bw, offset);
 }

-#define MI_STATUS_SELF_ONLY		0
-#define MI_STATUS_OTHERS_ONLY	1
-#define MI_STATUS_ALL			2
-
 /* For now, not return union_ch/bw/offset */
-void _rtw_mi_status(_adapter *adapter, struct mi_state *mstate, u8 target_sel)
+void rtw_mi_status_by_ifbmp(struct dvobj_priv *dvobj, u8 ifbmp, struct mi_state *mstate)
 {
-	struct dvobj_priv *dvobj = adapter_to_dvobj(adapter);
 	_adapter *iface;
 	int i;

@@ -196,10 +193,7 @@ void _rtw_mi_status(_adapter *adapter, struct mi_state *mstate, u8 target_sel)

 	for (i = 0; i < dvobj->iface_nums; i++) {
 		iface = dvobj->padapters[i];
-
-		if (target_sel == MI_STATUS_SELF_ONLY && iface != adapter)
-			continue;
-		if (target_sel == MI_STATUS_OTHERS_ONLY && iface == adapter)
+		if (!iface || !(ifbmp & BIT(iface->iface_id)))
 			continue;

 		if (check_fwstate(&iface->mlmepriv, WIFI_STATION_STATE) == _TRUE) {
@@ -211,6 +205,10 @@ void _rtw_mi_status(_adapter *adapter, struct mi_state *mstate, u8 target_sel)
 				if (iface->tdlsinfo.link_established == _TRUE)
 					MSTATE_TDLS_LD_NUM(mstate)++;
 				#endif
+				#ifdef CONFIG_P2P
+				if (MLME_IS_GC(iface))
+					MSTATE_P2P_GC_NUM(mstate)++;
+				#endif
 			}
 			if (check_fwstate(&iface->mlmepriv, _FW_UNDER_LINKING) == _TRUE)
 				MSTATE_STA_LG_NUM(mstate)++;
@@ -221,6 +219,10 @@ void _rtw_mi_status(_adapter *adapter, struct mi_state *mstate, u8 target_sel)
 				MSTATE_AP_NUM(mstate)++;
 				if (iface->stapriv.asoc_sta_count > 2)
 					MSTATE_AP_LD_NUM(mstate)++;
+				#ifdef CONFIG_P2P
+				if (MLME_IS_GO(iface))
+					MSTATE_P2P_GO_NUM(mstate)++;
+				#endif
 			} else
 				MSTATE_AP_STARTING_NUM(mstate)++;
 #endif
@@ -262,23 +264,26 @@ void _rtw_mi_status(_adapter *adapter, struct mi_state *mstate, u8 target_sel)
 			MSTATE_ROCH_NUM(mstate)++;
 		#endif
 #endif /* CONFIG_IOCTL_CFG80211 */
-
+#ifdef CONFIG_P2P
+		if (MLME_IS_PD(iface))
+			MSTATE_P2P_DV_NUM(mstate)++;
+#endif
 	}
 }

 inline void rtw_mi_status(_adapter *adapter, struct mi_state *mstate)
 {
-	return _rtw_mi_status(adapter, mstate, MI_STATUS_ALL);
+	return rtw_mi_status_by_ifbmp(adapter_to_dvobj(adapter), 0xFF, mstate);
 }

 inline void rtw_mi_status_no_self(_adapter *adapter, struct mi_state *mstate)
 {
-	return _rtw_mi_status(adapter, mstate, MI_STATUS_OTHERS_ONLY);
+	return rtw_mi_status_by_ifbmp(adapter_to_dvobj(adapter), 0xFF & ~BIT(adapter->iface_id), mstate);
 }

 inline void rtw_mi_status_no_others(_adapter *adapter, struct mi_state *mstate)
 {
-	return _rtw_mi_status(adapter, mstate, MI_STATUS_SELF_ONLY);
+	return rtw_mi_status_by_ifbmp(adapter_to_dvobj(adapter), BIT(adapter->iface_id), mstate);
 }

 /* For now, not handle union_ch/bw/offset */
@@ -332,7 +337,9 @@ void dump_mi_status(void *sel, struct dvobj_priv *dvobj)
 	RTW_PRINT_SEL(sel, "linked_mesh_num:%d\n", DEV_MESH_LD_NUM(dvobj));
 #endif
 #ifdef CONFIG_P2P
-	RTW_PRINT_SEL(sel, "p2p_device_num:%d\n", rtw_mi_stay_in_p2p_mode(dvobj_get_primary_adapter(dvobj)));
+	RTW_PRINT_SEL(sel, "p2p_device_num:%d\n", DEV_P2P_DV_NUM(dvobj));
+	RTW_PRINT_SEL(sel, "p2p_gc_num:%d\n", DEV_P2P_GC_NUM(dvobj));
+	RTW_PRINT_SEL(sel, "p2p_go_num:%d\n", DEV_P2P_GO_NUM(dvobj));
 #endif
 	RTW_PRINT_SEL(sel, "scan_num:%d\n", DEV_SCAN_NUM(dvobj));
 	RTW_PRINT_SEL(sel, "under_wps_num:%d\n", DEV_WPS_NUM(dvobj));
@@ -360,9 +367,7 @@ inline void rtw_mi_update_iface_status(struct mlme_priv *pmlmepriv, sint state)
 	struct dvobj_priv *dvobj = adapter_to_dvobj(adapter);
 	struct mi_state *iface_state = &dvobj->iface_state;
 	struct mi_state tmp_mstate;
-	u8 i;
 	u8 u_ch, u_offset, u_bw;
-	_adapter *iface;

 	if (state == WIFI_MONITOR_STATE
 		|| state == 0xFFFFFFFF
@@ -748,6 +753,30 @@ void rtw_mi_buddy_intf_stop(_adapter *adapter)
 	_rtw_mi_process(adapter, _TRUE, NULL, _rtw_mi_intf_stop);
 }

+#ifdef CONFIG_NEW_NETDEV_HDL
+static u8 _rtw_mi_hal_iface_init(_adapter *padapter, void *data)
+{
+	if (rtw_hal_iface_init(padapter) == _SUCCESS)
+		return _TRUE;
+	return _FALSE;
+}
+u8 rtw_mi_hal_iface_init(_adapter *padapter)
+{
+	int i;
+	_adapter *iface;
+	struct dvobj_priv *dvobj = adapter_to_dvobj(padapter);
+
+	u8 ret = _TRUE;
+
+	for (i = 0; i < dvobj->iface_nums; i++) {
+		iface = dvobj->padapters[i];
+		if (iface && iface->netif_up)
+			rtw_hal_iface_init(padapter);
+	}
+	return ret;
+}
+#endif
+
 static u8 _rtw_mi_suspend_free_assoc_resource(_adapter *padapter, void *data)
 {
 	return rtw_suspend_free_assoc_resource(padapter);
@@ -864,7 +893,6 @@ u8 _rtw_mi_busy_traffic_check(_adapter *padapter, void *data)
 		if (check_sc_interval) {
 			/* Miracast can't do AP scan*/
 			passtime = rtw_get_passing_time_ms(pmlmepriv->lastscantime);
-			pmlmepriv->lastscantime = rtw_get_current_time();
 			if (passtime > BUSY_TRAFFIC_SCAN_DENY_PERIOD) {
 				RTW_INFO(ADPT_FMT" bBusyTraffic == _TRUE\n", ADPT_ARG(padapter));
 				return _TRUE;
@@ -1089,20 +1117,6 @@ u8 rtw_mi_buddy_dynamic_check_timer_handlder(_adapter *padapter)
 	return _rtw_mi_process(padapter, _TRUE, NULL, _rtw_mi_dynamic_check_timer_handlder);
 }

-static u8 _rtw_mi_dev_unload(_adapter *adapter, void *data)
-{
-	rtw_dev_unload(adapter);
-	return _TRUE;
-}
-u8 rtw_mi_dev_unload(_adapter *padapter)
-{
-	return _rtw_mi_process(padapter, _FALSE, NULL, _rtw_mi_dev_unload);
-}
-u8 rtw_mi_buddy_dev_unload(_adapter *padapter)
-{
-	return _rtw_mi_process(padapter, _TRUE, NULL, _rtw_mi_dev_unload);
-}
-
 static u8 _rtw_mi_dynamic_chk_wk_hdl(_adapter *adapter, void *data)
 {
 	rtw_iface_dynamic_chk_wk_hdl(adapter);
@@ -1163,6 +1177,29 @@ u8 rtw_mi_sreset_adapter_hdl(_adapter *padapter, u8 bstart)

 	return _rtw_mi_process(padapter, _FALSE, &in_data, _rtw_mi_sreset_adapter_hdl);
 }
+
+#if defined(DBG_CONFIG_ERROR_RESET) && defined(CONFIG_CONCURRENT_MODE)
+void rtw_mi_ap_info_restore(_adapter *adapter)
+{
+	int i;
+	_adapter *iface;
+	struct mlme_priv *pmlmepriv;
+	struct dvobj_priv *dvobj = adapter_to_dvobj(adapter);
+
+	for (i = 0; i < dvobj->iface_nums; i++) {
+		iface = dvobj->padapters[i];
+		if (iface) {
+			pmlmepriv = &iface->mlmepriv;
+
+			if (MLME_IS_AP(iface) || MLME_IS_MESH(iface)) {
+				RTW_INFO(FUNC_ADPT_FMT" %s\n", FUNC_ADPT_ARG(iface), MLME_IS_AP(iface) ? "AP" : "MESH");
+				rtw_iface_bcmc_sec_cam_map_restore(iface);
+			}
+		}
+	}
+}
+#endif /*#if defined(DBG_CONFIG_ERROR_RESET) && defined(CONFIG_CONCURRENT_MODE)*/
+
 u8 rtw_mi_buddy_sreset_adapter_hdl(_adapter *padapter, u8 bstart)
 {
 	u8 in_data = bstart;
@@ -1176,7 +1213,7 @@ static u8 _rtw_mi_tx_beacon_hdl(_adapter *adapter, void *data)
 	) {
 		adapter->mlmepriv.update_bcn = _TRUE;
 #ifndef CONFIG_INTERRUPT_BASED_TXBCN
-#if defined(CONFIG_USB_HCI) || defined(CONFIG_SDIO_HCI) || defined(CONFIG_GSPI_HCI)
+#if defined(CONFIG_USB_HCI) || defined(CONFIG_SDIO_HCI) || defined(CONFIG_GSPI_HCI) || defined(CONFIG_PCI_BCN_POLLING)
 		tx_beacon_hdl(adapter, NULL);
 #endif
 #endif
@@ -1262,7 +1299,7 @@ _adapter *rtw_get_iface_by_id(_adapter *padapter, u8 iface_id)
 	return  dvobj->padapters[iface_id];
 }

-_adapter *rtw_get_iface_by_macddr(_adapter *padapter, u8 *mac_addr)
+_adapter *rtw_get_iface_by_macddr(_adapter *padapter, const u8 *mac_addr)
 {
 	int i;
 	_adapter *iface = NULL;
@@ -1354,9 +1391,10 @@ void rtw_dbg_skb_process(_adapter *padapter, union recv_frame *precvframe, union
 static s32 _rtw_mi_buddy_clone_bcmc_packet(_adapter *adapter, union recv_frame *precvframe, u8 *pphy_status, union recv_frame *pcloneframe)
 {
 	s32 ret = _SUCCESS;
+#ifdef CONFIG_SKB_ALLOCATED
 	u8 *pbuf = precvframe->u.hdr.rx_data;
+#endif
 	struct rx_pkt_attrib *pattrib = NULL;
-	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(adapter);

 	if (pcloneframe) {
 		pcloneframe->u.hdr.adapter = adapter;
@@ -1451,6 +1489,45 @@ _adapter *rtw_mi_get_ap_adapter(_adapter *padapter)
 }
 #endif

+u8 rtw_mi_get_ld_sta_ifbmp(_adapter *adapter)
+{
+	struct dvobj_priv *dvobj = adapter_to_dvobj(adapter);
+	int i;
+	_adapter *iface = NULL;
+	u8 ifbmp = 0;
+
+	for (i = 0; i < dvobj->iface_nums; i++) {
+		iface = dvobj->padapters[i];
+		if (!iface)
+			continue;
+
+		if (MLME_IS_STA(iface) && MLME_IS_ASOC(iface))
+			ifbmp |= BIT(i);
+	}
+
+	return ifbmp;
+}
+
+u8 rtw_mi_get_ap_mesh_ifbmp(_adapter *adapter)
+{
+	struct dvobj_priv *dvobj = adapter_to_dvobj(adapter);
+	int i;
+	_adapter *iface = NULL;
+	u8 ifbmp = 0;
+
+	for (i = 0; i < dvobj->iface_nums; i++) {
+		iface = dvobj->padapters[i];
+		if (!iface)
+			continue;
+
+		if (CHK_MLME_STATE(iface, WIFI_AP_STATE | WIFI_MESH_STATE)
+			&& MLME_IS_ASOC(iface))
+			ifbmp |= BIT(i);
+	}
+
+	return ifbmp;
+}
+
 void rtw_mi_update_ap_bmc_camid(_adapter *padapter, u8 camid_a, u8 camid_b)
 {
 #ifdef CONFIG_CONCURRENT_MODE
@@ -1476,3 +1553,19 @@ void rtw_mi_update_ap_bmc_camid(_adapter *padapter, u8 camid_a, u8 camid_b)
 #endif
 }

+u8 rtw_mi_get_assoc_if_num(_adapter *adapter)
+{
+	struct dvobj_priv *dvobj = adapter_to_dvobj(adapter);
+	u8 n_assoc_iface = 0;
+#if 1
+	u8 i;
+
+	for (i = 0; i < dvobj->iface_nums; i++) {
+		if (check_fwstate(&(dvobj->padapters[i]->mlmepriv), WIFI_ASOC_STATE))
+			n_assoc_iface++;
+	}
+#else
+	n_assoc_iface = DEV_STA_LD_NUM(dvobj) + DEV_AP_NUM(dvobj) + DEV_ADHOC_NUM(dvobj) + DEV_MESH_NUM(dvobj);
+#endif
+	return n_assoc_iface;
+}
--- a/core/rtw_mlme.c
+++ b/core/rtw_mlme.c
--- a/core/rtw_mlme_ext.c
+++ b/core/rtw_mlme_ext.c
--- a/core/rtw_mp.c
+++ b/core/rtw_mp.c
@@ -120,7 +120,7 @@ static void _init_mp_priv_(struct mp_priv *pmp_priv)

 	pmp_priv->channel = 1;
 	pmp_priv->bandwidth = CHANNEL_WIDTH_20;
-	pmp_priv->prime_channel_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
+	pmp_priv->prime_channel_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
 	pmp_priv->rateidx = RATE_1M;
 	pmp_priv->txpoweridx = 0x2A;

@@ -147,6 +147,7 @@ static void _init_mp_priv_(struct mp_priv *pmp_priv)
 	pmp_priv->bloopback = _FALSE;

 	pmp_priv->bloadefusemap = _FALSE;
+	pmp_priv->brx_filter_beacon = _FALSE;

 	pnetwork = &pmp_priv->mp_network.network;
 	_rtw_memcpy(pnetwork->MacAddress, pmp_priv->network_macaddr, ETH_ALEN);
@@ -222,6 +223,7 @@ static int init_mp_priv_by_os(struct mp_priv *pmp_priv)
 #endif

 #ifdef PLATFORM_LINUX
+#if 0
 static int init_mp_priv_by_os(struct mp_priv *pmp_priv)
 {
 	int i, res;
@@ -263,6 +265,7 @@ _exit_init_mp_priv:
 	return res;
 }
 #endif
+#endif

 static void mp_init_xmit_attrib(struct mp_tx *pmptx, PADAPTER padapter)
 {
@@ -298,6 +301,11 @@ static void mp_init_xmit_attrib(struct mp_tx *pmptx, PADAPTER padapter)

 	pattrib->pktlen = 1500;

+	if (pHalData->rf_type == RF_2T2R)
+		pattrib->raid = RATEID_IDX_BGN_40M_2SS;
+	else
+		pattrib->raid = RATEID_IDX_BGN_40M_1SS;
+
 #ifdef CONFIG_80211AC_VHT
 	if (pHalData->rf_type == RF_1T1R)
 		pattrib->raid = RATEID_IDX_VHT_1SS;
@@ -363,7 +371,7 @@ void free_mp_priv(struct mp_priv *pmp_priv)
 	pmp_priv->pmp_xmtframe_buf = NULL;
 }

-
+#if 0
 static VOID PHY_IQCalibrate_default(
 	IN	PADAPTER	pAdapter,
 	IN	BOOLEAN	bReCovery
@@ -386,7 +394,7 @@ static VOID PHY_SetRFPathSwitch_default(
 {
 	RTW_INFO("%s\n", __func__);
 }
-
+#endif

 void mpt_InitHWConfig(PADAPTER Adapter)
 {
@@ -453,8 +461,8 @@ void mpt_InitHWConfig(PADAPTER Adapter)
 	else if (IS_HARDWARE_TYPE_8821C(Adapter))
 		PlatformEFIOWrite2Byte(Adapter, REG_RXFLTMAP1_8821C, 0x2000);
 #endif /* CONFIG_RTL8821C */
-#ifdef CONFIG_RTL8188F
-	else if (IS_HARDWARE_TYPE_8188F(Adapter)) {
+#if defined(CONFIG_RTL8188F) || defined(CONFIG_RTL8188GTV)
+	else if (IS_HARDWARE_TYPE_8188F(Adapter) || IS_HARDWARE_TYPE_8188GTV(Adapter)) {
 		if (IS_A_CUT(hal->version_id) || IS_B_CUT(hal->version_id)) {
 			RTW_INFO("%s() Active large power detection\n", __func__);
 			phy_active_large_power_detection_8188f(&(GET_HAL_DATA(Adapter)->odmpriv));
@@ -504,6 +512,10 @@ static u8 PHY_QueryRFPathSwitch(PADAPTER padapter)
 	} else if (IS_HARDWARE_TYPE_8188F(padapter)) {
 #ifdef CONFIG_RTL8188F
 		bmain = PHY_QueryRFPathSwitch_8188F(padapter);
+#endif
+	} else if (IS_HARDWARE_TYPE_8188GTV(padapter)) {
+#ifdef CONFIG_RTL8188GTV
+		bmain = PHY_QueryRFPathSwitch_8188GTV(padapter);
 #endif
 	} else if (IS_HARDWARE_TYPE_8822B(padapter)) {
 #ifdef CONFIG_RTL8822B
@@ -538,7 +550,7 @@ static void  PHY_SetRFPathSwitch(PADAPTER padapter , BOOLEAN bMain) {
 #ifdef CONFIG_RTL8188E
 		phy_set_rf_path_switch_8188e(phydm, bMain);
 #endif
-	} else if (IS_HARDWARE_TYPE_8814A(padapter)) {	
+	} else if (IS_HARDWARE_TYPE_8814A(padapter)) {
 #ifdef CONFIG_RTL8814A
 		phy_set_rf_path_switch_8814a(phydm, bMain);
 #endif
@@ -554,9 +566,13 @@ static void  PHY_SetRFPathSwitch(PADAPTER padapter , BOOLEAN bMain) {
 #ifdef CONFIG_RTL8703B
 		phy_set_rf_path_switch_8703b(phydm, bMain);
 #endif
-	} else if (IS_HARDWARE_TYPE_8188F(padapter)) {
-#ifdef CONFIG_RTL8188F
+	} else if (IS_HARDWARE_TYPE_8188F(padapter) || IS_HARDWARE_TYPE_8188GTV(padapter)) {
+#if defined(CONFIG_RTL8188F) || defined(CONFIG_RTL8188GTV)
 		phy_set_rf_path_switch_8188f(phydm, bMain);
+#endif
+	} else if (IS_HARDWARE_TYPE_8192F(padapter)) {
+#ifdef CONFIG_RTL8192F
+		phy_set_rf_path_switch_8192f(padapter, bMain);
 #endif
 	} else if (IS_HARDWARE_TYPE_8822B(padapter)) {
 #ifdef CONFIG_RTL8822B
@@ -575,17 +591,16 @@ static void  PHY_SetRFPathSwitch(PADAPTER padapter , BOOLEAN bMain) {


 static void phy_switch_rf_path_set(PADAPTER padapter , u8 *prf_set_State) {
-
+#ifdef CONFIG_RTL8821C
 	HAL_DATA_TYPE *pHalData = GET_HAL_DATA(padapter);
 	struct dm_struct *p_dm = &pHalData->odmpriv;

-#ifdef CONFIG_RTL8821C
 	if (IS_HARDWARE_TYPE_8821C(padapter)) {
 		config_phydm_set_ant_path(p_dm, *prf_set_State, p_dm->current_ant_num_8821c);
 		/* Do IQK when switching to BTG/WLG, requested by RF Binson */
 		if (*prf_set_State == SWITCH_TO_BTG || *prf_set_State == SWITCH_TO_WLG)
 			PHY_IQCalibrate(padapter, FALSE);
-	}		
+	}
 #endif

 }
@@ -619,7 +634,6 @@ MPT_InitializeAdapter(
 	s32		rtStatus = _SUCCESS;
 	PMPT_CONTEXT	pMptCtx = &pAdapter->mppriv.mpt_ctx;
 	u32		ledsetting;
-	struct mlme_priv *pmlmepriv = &pAdapter->mlmepriv;

 	pMptCtx->bMptDrvUnload = _FALSE;
 	pMptCtx->bMassProdTest = _FALSE;
@@ -644,9 +658,9 @@ MPT_InitializeAdapter(
 		phy_set_bb_reg(pAdapter, 0xA00, BIT8, 0x0);
 		PHY_SetRFPathSwitch(pAdapter, 1/*pHalData->bDefaultAntenna*/); /*default use Main*/

-		if (pHalData->PackageType == PACKAGE_DEFAULT) 
+		if (pHalData->PackageType == PACKAGE_DEFAULT)
 			phy_set_rf_reg(pAdapter, RF_PATH_A, 0x51, bRFRegOffsetMask, 0x6B04E);
-		else 
+		else
 			phy_set_rf_reg(pAdapter, RF_PATH_A, 0x51, bRFRegOffsetMask, 0x6F10E);

 	}
@@ -826,6 +840,9 @@ void MPT_PwrCtlDM(PADAPTER padapter, u32 bstart)
 				else if (pDM_Odm->support_ic_type == ODM_RTL8723D) {
 					(*c.odm_tx_pwr_track_set_pwr)(pDM_Odm, BBSWING, RF_PATH_A, chnl);
 					SetTxPower(padapter);
+				} else if (pDM_Odm->support_ic_type == ODM_RTL8192F) {
+					(*c.odm_tx_pwr_track_set_pwr)(pDM_Odm, MIX_MODE, RF_PATH_A, chnl);
+					(*c.odm_tx_pwr_track_set_pwr)(pDM_Odm, MIX_MODE, RF_PATH_B, chnl);
 				} else {
 					(*c.odm_tx_pwr_track_set_pwr)(pDM_Odm, BBSWING, RF_PATH_A, chnl);
 					(*c.odm_tx_pwr_track_set_pwr)(pDM_Odm, BBSWING, RF_PATH_B, chnl);
@@ -842,7 +859,6 @@ u32 mp_join(PADAPTER padapter, u8 mode)
 	WLAN_BSSID_EX bssid;
 	struct sta_info *psta;
 	u32 length;
-	u8 val8, join_type;
 	_irqL irqL;
 	s32 res = _SUCCESS;

@@ -853,9 +869,6 @@ u32 mp_join(PADAPTER padapter, u8 mode)
 	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
 	WLAN_BSSID_EX		*pnetwork = (WLAN_BSSID_EX *)(&(pmlmeinfo->network));

-#ifdef CONFIG_IOCTL_CFG80211
-	struct wireless_dev *pwdev = padapter->rtw_wdev;
-#endif /* #ifdef CONFIG_IOCTL_CFG80211 */
 	/* 1. initialize a new WLAN_BSSID_EX */
 	_rtw_memset(&bssid, 0, sizeof(WLAN_BSSID_EX));
 	RTW_INFO("%s ,pmppriv->network_macaddr=%x %x %x %x %x %x\n", __func__,
@@ -894,7 +907,7 @@ u32 mp_join(PADAPTER padapter, u8 mode)
 	if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE) {
 		rtw_disassoc_cmd(padapter, 500, 0);
 		rtw_indicate_disconnect(padapter, 0, _FALSE);
-		rtw_free_assoc_resources(padapter, 1);
+		rtw_free_assoc_resources_cmd(padapter, _TRUE, 0);
 	}
 	pmppriv->prev_fw_state = get_fwstate(pmlmepriv);
 	/*pmlmepriv->fw_state = WIFI_MP_STATE;*/
@@ -962,6 +975,9 @@ end_of_mp_start_test:
 s32 mp_start_test(PADAPTER padapter)
 {
 	struct mp_priv *pmppriv = &padapter->mppriv;
+#ifdef CONFIG_PCI_HCI
+	PHAL_DATA_TYPE hal;
+#endif
 	s32 res = _SUCCESS;

 	padapter->registrypriv.mp_mode = 1;
@@ -985,6 +1001,9 @@ s32 mp_start_test(PADAPTER padapter)
 #ifdef CONFIG_RTL8188F
 	rtl8188f_InitHalDm(padapter);
 #endif
+#ifdef CONFIG_RTL8188GTV
+	rtl8188gtv_InitHalDm(padapter);
+#endif
 #ifdef CONFIG_RTL8188E
 	rtl8188e_InitHalDm(padapter);
 #endif
@@ -992,6 +1011,13 @@ s32 mp_start_test(PADAPTER padapter)
 	rtl8723d_InitHalDm(padapter);
 #endif /* CONFIG_RTL8723D */

+#ifdef CONFIG_PCI_HCI
+	hal = GET_HAL_DATA(padapter);
+	hal->pci_backdoor_ctrl = 0;
+	rtw_pci_aspm_config(padapter);
+#endif
+
+
 	/* 3 0. update mp_priv */

 	if (!RF_TYPE_VALID(padapter->registrypriv.rf_config)) {
@@ -1031,6 +1057,10 @@ void mp_stop_test(PADAPTER padapter)
 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
 	struct wlan_network *tgt_network = &pmlmepriv->cur_network;
 	struct sta_info *psta;
+#ifdef CONFIG_PCI_HCI
+	struct registry_priv  *registry_par = &padapter->registrypriv;
+	PHAL_DATA_TYPE hal;
+#endif

 	_irqL irqL;

@@ -1044,7 +1074,7 @@ void mp_stop_test(PADAPTER padapter)
 		rtw_indicate_disconnect(padapter, 0, _FALSE);

 		/* 3 2. clear psta used in mp test mode.
-		*	rtw_free_assoc_resources(padapter, 1); */
+		*	rtw_free_assoc_resources(padapter, _TRUE); */
 		psta = rtw_get_stainfo(&padapter->stapriv, tgt_network->network.MacAddress);
 		if (psta)
 			rtw_free_stainfo(padapter, psta);
@@ -1062,6 +1092,12 @@ end_of_mp_stop_test:

 		_exit_critical_bh(&pmlmepriv->lock, &irqL);

+#ifdef CONFIG_PCI_HCI
+		hal = GET_HAL_DATA(padapter);
+		hal->pci_backdoor_ctrl = registry_par->pci_aspm_config;
+		rtw_pci_aspm_config(padapter);
+#endif
+
 #ifdef CONFIG_RTL8812A
 		rtl8812_InitHalDm(padapter);
 #endif
@@ -1077,6 +1113,9 @@ end_of_mp_stop_test:
 #ifdef CONFIG_RTL8188F
 		rtl8188f_InitHalDm(padapter);
 #endif
+#ifdef CONFIG_RTL8188GTV
+		rtl8188gtv_InitHalDm(padapter);
+#endif
 #ifdef CONFIG_RTL8723D
 		rtl8723d_InitHalDm(padapter);
 #endif
@@ -1142,6 +1181,7 @@ static VOID mpt_AdjustRFRegByRateByChan92CU(PADAPTER pAdapter, u8 RateIdx, u8 Ch
 * 01/09/2009	MHC		Add CCK modification for 40MHZ. Suggestion from SD3.
 *
 *---------------------------------------------------------------------------*/
+#if 0
 static void mpt_SwitchRfSetting(PADAPTER pAdapter)
 {
 	hal_mpt_SwitchRfSetting(pAdapter);
@@ -1153,6 +1193,7 @@ static void MPT_CCKTxPowerAdjust(PADAPTER Adapter, BOOLEAN bInCH14)
 {
 	hal_mpt_CCKTxPowerAdjust(Adapter, bInCH14);
 }
+#endif

 /*---------------------------hal\rtl8192c\MPT_HelperFunc.c---------------------------*/

@@ -1231,6 +1272,7 @@ s32 SetThermalMeter(PADAPTER pAdapter, u8 target_ther)
 	return hal_mpt_SetThermalMeter(pAdapter, target_ther);
 }

+#if 0
 static void TriggerRFThermalMeter(PADAPTER pAdapter)
 {
 	hal_mpt_TriggerRFThermalMeter(pAdapter);
@@ -1240,6 +1282,7 @@ static u8 ReadRFThermalMeter(PADAPTER pAdapter)
 {
 	return hal_mpt_ReadRFThermalMeter(pAdapter);
 }
+#endif

 void GetThermalMeter(PADAPTER pAdapter, u8 *value)
 {
@@ -1313,7 +1356,7 @@ static struct xmit_frame *alloc_mp_xmitframe(struct xmit_priv *pxmitpriv)

 }

-#ifdef CONFIG_PCIE_HCI
+#ifdef CONFIG_PCI_HCI
 static u8 check_nic_enough_desc(_adapter *padapter, struct pkt_attrib *pattrib)
 {
 	u32 prio;
@@ -1373,7 +1416,7 @@ static thread_return mp_xmit_packet_thread(thread_context context)
 	RTW_INFO("%s:pkTx Start\n", __func__);
 	while (1) {
 		pxmitframe = alloc_mp_xmitframe(pxmitpriv);
-#ifdef CONFIG_PCIE_HCI
+#ifdef CONFIG_PCI_HCI
 		if(check_nic_enough_desc(padapter, &pmptx->attrib) == _FALSE) {
 			rtw_usleep_os(1000);
 			continue;
@@ -1487,7 +1530,7 @@ void fill_tx_desc_8814a(PADAPTER padapter)

 	u32	pkt_size = pattrib->last_txcmdsz;
 	s32 bmcast = IS_MCAST(pattrib->ra);
-	u8 data_rate, pwr_status, offset;
+	u8 offset;

 	/* SET_TX_DESC_FIRST_SEG_8814A(pDesc, 1); */
 	SET_TX_DESC_LAST_SEG_8814A(pDesc, 1);
@@ -1741,6 +1784,37 @@ void fill_tx_desc_8188f(PADAPTER padapter)
 }
 #endif

+#if defined(CONFIG_RTL8188GTV)
+void fill_tx_desc_8188gtv(PADAPTER padapter)
+{
+	struct mp_priv *pmp_priv = &padapter->mppriv;
+	struct pkt_attrib *pattrib = &(pmp_priv->tx.attrib);
+	u8 *ptxdesc = pmp_priv->tx.desc;
+
+	SET_TX_DESC_AGG_BREAK_8188GTV(ptxdesc, 1);
+	SET_TX_DESC_MACID_8188GTV(ptxdesc, pattrib->mac_id);
+	SET_TX_DESC_QUEUE_SEL_8188GTV(ptxdesc, pattrib->qsel);
+
+	SET_TX_DESC_RATE_ID_8188GTV(ptxdesc, pattrib->raid);
+	SET_TX_DESC_SEQ_8188GTV(ptxdesc, pattrib->seqnum);
+	SET_TX_DESC_HWSEQ_EN_8188GTV(ptxdesc, 1);
+	SET_TX_DESC_USE_RATE_8188GTV(ptxdesc, 1);
+	SET_TX_DESC_DISABLE_FB_8188GTV(ptxdesc, 1);
+
+	if (pmp_priv->preamble)
+		if (HwRateToMPTRate(pmp_priv->rateidx) <=  MPT_RATE_54M)
+			SET_TX_DESC_DATA_SHORT_8188GTV(ptxdesc, 1);
+
+	if (pmp_priv->bandwidth == CHANNEL_WIDTH_40)
+		SET_TX_DESC_DATA_BW_8188GTV(ptxdesc, 1);
+
+	SET_TX_DESC_TX_RATE_8188GTV(ptxdesc, pmp_priv->rateidx);
+
+	SET_TX_DESC_DATA_RATE_FB_LIMIT_8188GTV(ptxdesc, 0x1F);
+	SET_TX_DESC_RTS_RATE_FB_LIMIT_8188GTV(ptxdesc, 0xF);
+}
+#endif
+
 #if defined(CONFIG_RTL8723D)
 void fill_tx_desc_8723d(PADAPTER padapter)
 {
@@ -1773,6 +1847,70 @@ void fill_tx_desc_8723d(PADAPTER padapter)
 }
 #endif

+#if defined(CONFIG_RTL8710B)
+void fill_tx_desc_8710b(PADAPTER padapter)
+{
+	struct mp_priv *pmp_priv = &padapter->mppriv;
+	struct pkt_attrib *pattrib = &(pmp_priv->tx.attrib);
+	u8 *ptxdesc = pmp_priv->tx.desc;
+
+	SET_TX_DESC_BK_8710B(ptxdesc, 1);
+	SET_TX_DESC_MACID_8710B(ptxdesc, pattrib->mac_id);
+	SET_TX_DESC_QUEUE_SEL_8710B(ptxdesc, pattrib->qsel);
+
+	SET_TX_DESC_RATE_ID_8710B(ptxdesc, pattrib->raid);
+	SET_TX_DESC_SEQ_8710B(ptxdesc, pattrib->seqnum);
+	SET_TX_DESC_HWSEQ_EN_8710B(ptxdesc, 1);
+	SET_TX_DESC_USE_RATE_8710B(ptxdesc, 1);
+	SET_TX_DESC_DISABLE_FB_8710B(ptxdesc, 1);
+
+	if (pmp_priv->preamble) {
+		if (HwRateToMPTRate(pmp_priv->rateidx) <=  MPT_RATE_54M)
+			SET_TX_DESC_DATA_SHORT_8710B(ptxdesc, 1);
+	}
+
+	if (pmp_priv->bandwidth == CHANNEL_WIDTH_40)
+		SET_TX_DESC_DATA_BW_8710B(ptxdesc, 1);
+
+	SET_TX_DESC_TX_RATE_8710B(ptxdesc, pmp_priv->rateidx);
+
+	SET_TX_DESC_DATA_RATE_FB_LIMIT_8710B(ptxdesc, 0x1F);
+	SET_TX_DESC_RTS_RATE_FB_LIMIT_8710B(ptxdesc, 0xF);
+}
+#endif
+
+#if defined(CONFIG_RTL8192F)
+void fill_tx_desc_8192f(PADAPTER padapter)
+{
+	struct mp_priv *pmp_priv = &padapter->mppriv;
+	struct pkt_attrib *pattrib = &(pmp_priv->tx.attrib);
+	u8 *ptxdesc = pmp_priv->tx.desc;
+
+	SET_TX_DESC_BK_8192F(ptxdesc, 1);
+	SET_TX_DESC_MACID_8192F(ptxdesc, pattrib->mac_id);
+	SET_TX_DESC_QUEUE_SEL_8192F(ptxdesc, pattrib->qsel);
+
+	SET_TX_DESC_RATE_ID_8192F(ptxdesc, pattrib->raid);
+	SET_TX_DESC_SEQ_8192F(ptxdesc, pattrib->seqnum);
+	SET_TX_DESC_HWSEQ_EN_8192F(ptxdesc, 1);
+	SET_TX_DESC_USE_RATE_8192F(ptxdesc, 1);
+	SET_TX_DESC_DISABLE_FB_8192F(ptxdesc, 1);
+
+	if (pmp_priv->preamble) {
+		if (HwRateToMPTRate(pmp_priv->rateidx) <=  MPT_RATE_54M)
+			SET_TX_DESC_DATA_SHORT_8192F(ptxdesc, 1);
+	}
+
+	if (pmp_priv->bandwidth == CHANNEL_WIDTH_40)
+		SET_TX_DESC_DATA_BW_8192F(ptxdesc, 1);
+
+	SET_TX_DESC_TX_RATE_8192F(ptxdesc, pmp_priv->rateidx);
+
+	SET_TX_DESC_DATA_RATE_FB_LIMIT_8192F(ptxdesc, 0x1F);
+	SET_TX_DESC_RTS_RATE_FB_LIMIT_8192F(ptxdesc, 0xF);
+}
+
+#endif
 static void Rtw_MPSetMacTxEDCA(PADAPTER padapter)
 {

@@ -1790,8 +1928,8 @@ static void Rtw_MPSetMacTxEDCA(PADAPTER padapter)

 void SetPacketTx(PADAPTER padapter)
 {
-	u8 *ptr, *pkt_start, *pkt_end, *fctrl;
-	u32 pkt_size, offset, startPlace, i;
+	u8 *ptr, *pkt_start, *pkt_end;
+	u32 pkt_size, i;
 	struct rtw_ieee80211_hdr *hdr;
 	u8 payload;
 	s32 bmcast;
@@ -1812,7 +1950,7 @@ void SetPacketTx(PADAPTER padapter)
 	_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
 	_rtw_memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
 	bmcast = IS_MCAST(pattrib->ra);
-	if (bmcast) 
+	if (bmcast)
 		pattrib->psta = rtw_get_bcmc_stainfo(padapter);
 	else
 		pattrib->psta = rtw_get_stainfo(&padapter->stapriv, get_bssid(&padapter->mlmepriv));
@@ -1885,10 +2023,24 @@ void SetPacketTx(PADAPTER padapter)
 		fill_tx_desc_8188f(padapter);
 #endif

+#if defined(CONFIG_RTL8188GTV)
+	if (IS_HARDWARE_TYPE_8188GTV(padapter))
+		fill_tx_desc_8188gtv(padapter);
+#endif
+
 #if defined(CONFIG_RTL8723D)
 	if (IS_HARDWARE_TYPE_8723D(padapter))
 		fill_tx_desc_8723d(padapter);
 #endif
+#if defined(CONFIG_RTL8192F)
+		if (IS_HARDWARE_TYPE_8192F(padapter))
+			fill_tx_desc_8192f(padapter);
+#endif
+
+#if defined(CONFIG_RTL8710B)
+	if (IS_HARDWARE_TYPE_8710B(padapter))
+		fill_tx_desc_8710b(padapter);
+#endif

 	/* 3 4. make wlan header, make_wlanhdr() */
 	hdr = (struct rtw_ieee80211_hdr *)pkt_start;
@@ -1984,6 +2136,7 @@ void SetPacketRx(PADAPTER pAdapter, u8 bStartRx, u8 bAB)
 			write_bbreg(pAdapter, 0x550, BIT3, bEnable);
 #endif
 			rtw_write16(pAdapter, REG_RXFLTMAP0, 0xFFEF); /* REG_RXFLTMAP0 (RX Filter Map Group 0) */
+			pmppriv->brx_filter_beacon = _TRUE;

 		} else {
 			pHalData->ReceiveConfig |= RCR_ADF;
@@ -2053,6 +2206,167 @@ u32 GetPhyRxPktCRC32Error(PADAPTER pAdapter)
 	return OFDM_cnt + CCK_cnt + HT_cnt;
 }

+struct psd_init_regs {
+	/* 3 wire */
+	int reg_88c;
+	int reg_c00;
+	int reg_e00;
+	int reg_1800;
+	int reg_1a00;
+	/* cck */
+	int reg_800;
+	int reg_808;
+};
+
+static int rtw_mp_psd_init(PADAPTER padapter, struct psd_init_regs *regs)
+{
+	HAL_DATA_TYPE	*phal_data	= GET_HAL_DATA(padapter);
+
+	switch (phal_data->rf_type) {
+	/* 1R */
+	case RF_1T1R:
+		if (hal_chk_proto_cap(padapter, PROTO_CAP_11AC)) {
+			/* 11AC 1R PSD Setting 3wire & cck off */
+			regs->reg_c00 = rtw_read32(padapter, 0xC00);
+			phy_set_bb_reg(padapter, 0xC00, 0x3, 0x00);
+			regs->reg_808 = rtw_read32(padapter, 0x808);
+			phy_set_bb_reg(padapter, 0x808, 0x10000000, 0x0);
+		} else {
+			/* 11N 3-wire off 1 */
+			regs->reg_88c = rtw_read32(padapter, 0x88C);
+			phy_set_bb_reg(padapter, 0x88C, 0x300000, 0x3);
+			/* 11N CCK off */
+			regs->reg_800 = rtw_read32(padapter, 0x800);
+			phy_set_bb_reg(padapter, 0x800, 0x1000000, 0x0);
+		}
+	break;
+
+	/* 2R */
+	case RF_1T2R:
+	case RF_2T2R:
+		if (hal_chk_proto_cap(padapter, PROTO_CAP_11AC)) {
+			/* 11AC 2R PSD Setting 3wire & cck off */
+			regs->reg_c00 = rtw_read32(padapter, 0xC00);
+			regs->reg_e00 = rtw_read32(padapter, 0xE00);
+			phy_set_bb_reg(padapter, 0xC00, 0x3, 0x00);
+			phy_set_bb_reg(padapter, 0xE00, 0x3, 0x00);
+			regs->reg_808 = rtw_read32(padapter, 0x808);
+			phy_set_bb_reg(padapter, 0x808, 0x10000000, 0x0);
+		} else {
+			/* 11N 3-wire off 2 */
+			regs->reg_88c = rtw_read32(padapter, 0x88C);
+			phy_set_bb_reg(padapter, 0x88C, 0xF00000, 0xF);
+			/* 11N CCK off */
+			regs->reg_800 = rtw_read32(padapter, 0x800);
+			phy_set_bb_reg(padapter, 0x800, 0x1000000, 0x0);
+		}
+	break;
+
+	/* 3R */
+	case RF_2T3R:
+	case RF_3T3R:
+		if (hal_chk_proto_cap(padapter, PROTO_CAP_11AC)) {
+			/* 11AC 3R PSD Setting 3wire & cck off */
+			regs->reg_c00 = rtw_read32(padapter, 0xC00);
+			regs->reg_e00 = rtw_read32(padapter, 0xE00);
+			regs->reg_1800 = rtw_read32(padapter, 0x1800);
+			phy_set_bb_reg(padapter, 0xC00, 0x3, 0x00);
+			phy_set_bb_reg(padapter, 0xE00, 0x3, 0x00);
+			phy_set_bb_reg(padapter, 0x1800, 0x3, 0x00);
+			regs->reg_808 = rtw_read32(padapter, 0x808);
+			phy_set_bb_reg(padapter, 0x808, 0x10000000, 0x0);
+		} else {
+			RTW_ERR("%s: 11n don't support 3R\n", __func__);
+			return -1;
+		}
+		break;
+
+	/* 4R */
+	case RF_2T4R:
+	case RF_3T4R:
+	case RF_4T4R:
+		if (hal_chk_proto_cap(padapter, PROTO_CAP_11AC)) {
+			/* 11AC 4R PSD Setting 3wire & cck off */
+			regs->reg_c00 = rtw_read32(padapter, 0xC00);
+			regs->reg_e00 = rtw_read32(padapter, 0xE00);
+			regs->reg_1800 = rtw_read32(padapter, 0x1800);
+			regs->reg_1a00 = rtw_read32(padapter, 0x1A00);
+			phy_set_bb_reg(padapter, 0xC00, 0x3, 0x00);
+			phy_set_bb_reg(padapter, 0xE00, 0x3, 0x00);
+			phy_set_bb_reg(padapter, 0x1800, 0x3, 0x00);
+			phy_set_bb_reg(padapter, 0x1A00, 0x3, 0x00);
+			regs->reg_808 = rtw_read32(padapter, 0x808);
+			phy_set_bb_reg(padapter, 0x808, 0x10000000, 0x0);
+		} else {
+			RTW_ERR("%s: 11n don't support 4R\n", __func__);
+			return -1;
+		}
+		break;
+
+	default:
+		RTW_ERR("%s: unknown %d rf type\n", __func__, phal_data->rf_type);
+		return -1;
+	}
+
+	/* Set PSD points, 0=128, 1=256, 2=512, 3=1024 */
+	if (hal_chk_proto_cap(padapter, PROTO_CAP_11AC))
+		phy_set_bb_reg(padapter, 0x910, 0xC000, 3);
+	else
+		phy_set_bb_reg(padapter, 0x808, 0xC000, 3);
+
+	RTW_INFO("%s: set %d rf type done\n", __func__, phal_data->rf_type);
+	return 0;
+}
+
+static int rtw_mp_psd_close(PADAPTER padapter, struct psd_init_regs *regs)
+{
+	HAL_DATA_TYPE	*phal_data	= GET_HAL_DATA(padapter);
+
+
+	if (!hal_chk_proto_cap(padapter, PROTO_CAP_11AC)) {
+		/* 11n 3wire restore */
+		rtw_write32(padapter, 0x88C, regs->reg_88c);
+		/* 11n cck restore */
+		rtw_write32(padapter, 0x800, regs->reg_800);
+		RTW_INFO("%s: restore %d rf type\n", __func__, phal_data->rf_type);
+		return 0;
+	}
+
+	/* 11ac 3wire restore */
+	switch (phal_data->rf_type) {
+	case RF_1T1R:
+		rtw_write32(padapter, 0xC00, regs->reg_c00);
+		break;
+	case RF_1T2R:
+	case RF_2T2R:
+		rtw_write32(padapter, 0xC00, regs->reg_c00);
+		rtw_write32(padapter, 0xE00, regs->reg_e00);
+		break;
+	case RF_2T3R:
+	case RF_3T3R:
+		rtw_write32(padapter, 0xC00, regs->reg_c00);
+		rtw_write32(padapter, 0xE00, regs->reg_e00);
+		rtw_write32(padapter, 0x1800, regs->reg_1800);
+		break;
+	case RF_2T4R:
+	case RF_3T4R:
+	case RF_4T4R:
+		rtw_write32(padapter, 0xC00, regs->reg_c00);
+		rtw_write32(padapter, 0xE00, regs->reg_e00);
+		rtw_write32(padapter, 0x1800, regs->reg_1800);
+		rtw_write32(padapter, 0x1A00, regs->reg_1a00);
+		break;
+	default:
+		RTW_WARN("%s: unknown %d rf type\n", __func__, phal_data->rf_type);
+		break;
+	}
+
+	/* 11ac cck restore */
+	rtw_write32(padapter, 0x808, regs->reg_808);
+	RTW_INFO("%s: restore %d rf type done\n", __func__, phal_data->rf_type);
+	return 0;
+}
+
 /* reg 0x808[9:0]: FFT data x
 * reg 0x808[22]:  0  -->  1  to get 1 FFT data y
 * reg 0x8B4[15:0]: FFT data y report */
@@ -2102,7 +2416,8 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data)
 {
 	u32 i, psd_pts = 0, psd_start = 0, psd_stop = 0;
 	u32 psd_data = 0;
-
+	struct psd_init_regs regs = {};
+	int psd_analysis = 0;

 #ifdef PLATFORM_LINUX
 	if (!netif_running(pAdapter->pnetdev)) {
@@ -2118,6 +2433,11 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data)
 		psd_pts = 128;
 		psd_start = 64;
 		psd_stop = 128;
+	} else if (strncmp(data, "analysis,", 9) == 0) {
+		if (rtw_mp_psd_init(pAdapter, &regs) != 0)
+			return 0;
+		psd_analysis = 1;
+		sscanf(data + 9, "pts=%d,start=%d,stop=%d", &psd_pts, &psd_start, &psd_stop);
 	} else
 		sscanf(data, "pts=%d,start=%d,stop=%d", &psd_pts, &psd_start, &psd_stop);

@@ -2139,6 +2459,9 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data)
 	rtw_mdelay_os(100);
 #endif

+	if (psd_analysis)
+		rtw_mp_psd_close(pAdapter, &regs);
+
 	return strlen(data) + 1;
 }

@@ -2735,7 +3058,6 @@ ULONG mpt_ProQueryCalTxPower(
 	PMPT_CONTEXT		pMptCtx = &(pAdapter->mppriv.mpt_ctx);

 	ULONG			TxPower = 1;
-	u1Byte			rate = 0;
 	struct txpwr_idx_comp tic;
 	u8 mgn_rate = mpt_to_mgnt_rate(pMptCtx->mpt_rate_index);

@@ -2746,10 +3068,14 @@ ULONG mpt_ProQueryCalTxPower(
 		, TxPower, tic.base, (tic.by_rate > tic.limit ? tic.limit : tic.by_rate), tic.by_rate, tic.limit, tic.tpt, tic.ebias);

 	pAdapter->mppriv.txpoweridx = (u8)TxPower;
-	pMptCtx->TxPwrLevel[RF_PATH_A] = (u8)TxPower;
-	pMptCtx->TxPwrLevel[RF_PATH_B] = (u8)TxPower;
-	pMptCtx->TxPwrLevel[RF_PATH_C] = (u8)TxPower;
-	pMptCtx->TxPwrLevel[RF_PATH_D]  = (u8)TxPower;
+	if (RfPath == RF_PATH_A)
+		pMptCtx->TxPwrLevel[RF_PATH_A] = (u8)TxPower;
+	else if (RfPath == RF_PATH_B)
+		pMptCtx->TxPwrLevel[RF_PATH_B] = (u8)TxPower;
+	else if (RfPath == RF_PATH_C)
+		pMptCtx->TxPwrLevel[RF_PATH_C] = (u8)TxPower;
+	else if (RfPath == RF_PATH_D)
+		pMptCtx->TxPwrLevel[RF_PATH_D]    = (u8)TxPower;
 	hal_mpt_SetTxPower(pAdapter);

 	return TxPower;
--- a/core/rtw_odm.c
+++ b/core/rtw_odm.c
@@ -103,43 +103,16 @@ void rtw_odm_adaptivity_mode_msg(void *sel, _adapter *adapter)
 		_RTW_PRINT_SEL(sel, "INVALID\n");
 }

-#define RTW_ADAPTIVITY_DML_DISABLE 0
-#define RTW_ADAPTIVITY_DML_ENABLE 1
-
-void rtw_odm_adaptivity_dml_msg(void *sel, _adapter *adapter)
-{
-	struct registry_priv *regsty = &adapter->registrypriv;
-
-	RTW_PRINT_SEL(sel, "RTW_ADAPTIVITY_DML_");
-
-	if (regsty->adaptivity_dml == RTW_ADAPTIVITY_DML_DISABLE)
-		_RTW_PRINT_SEL(sel, "DISABLE\n");
-	else if (regsty->adaptivity_dml == RTW_ADAPTIVITY_DML_ENABLE)
-		_RTW_PRINT_SEL(sel, "ENABLE\n");
-	else
-		_RTW_PRINT_SEL(sel, "INVALID\n");
-}
-
-void rtw_odm_adaptivity_dc_backoff_msg(void *sel, _adapter *adapter)
-{
-	struct registry_priv *regsty = &adapter->registrypriv;
-
-	RTW_PRINT_SEL(sel, "RTW_ADAPTIVITY_DC_BACKOFF:%u\n", regsty->adaptivity_dc_backoff);
-}
-
 void rtw_odm_adaptivity_config_msg(void *sel, _adapter *adapter)
 {
 	rtw_odm_adaptivity_ver_msg(sel, adapter);
 	rtw_odm_adaptivity_en_msg(sel, adapter);
 	rtw_odm_adaptivity_mode_msg(sel, adapter);
-	rtw_odm_adaptivity_dml_msg(sel, adapter);
-	rtw_odm_adaptivity_dc_backoff_msg(sel, adapter);
 }

 bool rtw_odm_adaptivity_needed(_adapter *adapter)
 {
 	struct registry_priv *regsty = &adapter->registrypriv;
-	struct mlme_priv *mlme = &adapter->mlmepriv;
 	bool ret = _FALSE;

 	if (regsty->adaptivity_en == RTW_ADAPTIVITY_EN_ENABLE)
@@ -154,32 +127,20 @@ void rtw_odm_adaptivity_parm_msg(void *sel, _adapter *adapter)

 	rtw_odm_adaptivity_config_msg(sel, adapter);

-	RTW_PRINT_SEL(sel, "%10s %16s %16s %22s %12s\n"
-		, "th_l2h_ini", "th_edcca_hl_diff", "th_l2h_ini_mode2", "th_edcca_hl_diff_mode2", "edcca_enable");
-	RTW_PRINT_SEL(sel, "0x%-8x %-16d 0x%-14x %-22d %-12d\n"
+	RTW_PRINT_SEL(sel, "%10s %16s\n"
+		, "th_l2h_ini", "th_edcca_hl_diff");
+	RTW_PRINT_SEL(sel, "0x%-8x %-16d\n"
 		, (u8)odm->th_l2h_ini
 		, odm->th_edcca_hl_diff
-		, (u8)odm->th_l2h_ini_mode2
-		, odm->th_edcca_hl_diff_mode2
-		, odm->edcca_enable
-	);
-
-	RTW_PRINT_SEL(sel, "%15s %9s\n", "AdapEnableState", "Adap_Flag");
-	RTW_PRINT_SEL(sel, "%-15x %-9x\n"
-		, odm->adaptivity_enable
-		, odm->adaptivity_flag
 	);
 }

-void rtw_odm_adaptivity_parm_set(_adapter *adapter, s8 th_l2h_ini, s8 th_edcca_hl_diff, s8 th_l2h_ini_mode2, s8 th_edcca_hl_diff_mode2, u8 edcca_enable)
+void rtw_odm_adaptivity_parm_set(_adapter *adapter, s8 th_l2h_ini, s8 th_edcca_hl_diff)
 {
 	struct dm_struct *odm = adapter_to_phydm(adapter);

 	odm->th_l2h_ini = th_l2h_ini;
 	odm->th_edcca_hl_diff = th_edcca_hl_diff;
-	odm->th_l2h_ini_mode2 = th_l2h_ini_mode2;
-	odm->th_edcca_hl_diff_mode2 = th_edcca_hl_diff_mode2;
-	odm->edcca_enable = edcca_enable;
 }

 void rtw_odm_get_perpkt_rssi(void *sel, _adapter *adapter)
@@ -217,10 +178,10 @@ void rtw_odm_releasespinlock(_adapter *adapter,	enum rt_spinlock_type type)
 	}
 }

-inline u8 rtw_odm_get_dfs_domain(_adapter *adapter)
+inline u8 rtw_odm_get_dfs_domain(struct dvobj_priv *dvobj)
 {
 #ifdef CONFIG_DFS_MASTER
-	struct dm_struct *pDM_Odm = adapter_to_phydm(adapter);
+	struct dm_struct *pDM_Odm = dvobj_to_phydm(dvobj);

 	return pDM_Odm->dfs_region_domain;
 #else
@@ -228,10 +189,10 @@ inline u8 rtw_odm_get_dfs_domain(_adapter *adapter)
 #endif
 }

-inline u8 rtw_odm_dfs_domain_unknown(_adapter *adapter)
+inline u8 rtw_odm_dfs_domain_unknown(struct dvobj_priv *dvobj)
 {
 #ifdef CONFIG_DFS_MASTER
-	return rtw_odm_get_dfs_domain(adapter) == PHYDM_DFS_DOMAIN_UNKNOWN;
+	return rtw_odm_get_dfs_domain(dvobj) == PHYDM_DFS_DOMAIN_UNKNOWN;
 #else
 	return 1;
 #endif
@@ -258,6 +219,11 @@ inline BOOLEAN rtw_odm_radar_detect(_adapter *adapter)
 {
 	return phydm_radar_detect(adapter_to_phydm(adapter));
 }
+
+inline u8 rtw_odm_radar_detect_polling_int_ms(struct dvobj_priv *dvobj)
+{
+	return phydm_dfs_polling_time(dvobj_to_phydm(dvobj));
+}
 #endif /* CONFIG_DFS_MASTER */

 void rtw_odm_parse_rx_phy_status_chinfo(union recv_frame *rframe, u8 *phys)
@@ -301,7 +267,7 @@ void rtw_odm_parse_rx_phy_status_chinfo(union recv_frame *rframe, u8 *phys)
 		*/

 		if ((*phys & 0xf) == 0) {
-			struct phy_status_rpt_jaguar2_type0 *phys_t0 = (struct phy_status_rpt_jaguar2_type0 *)phys;
+			struct phy_sts_rpt_jgr2_type0 *phys_t0 = (struct phy_sts_rpt_jgr2_type0 *)phys;

 			if (DBG_RX_PHYSTATUS_CHINFO) {
 				RTW_PRINT("phys_t%u ta="MAC_FMT" %s, %s(band:%u, ch:%u, l_rxsc:%u)\n"
@@ -314,7 +280,7 @@ void rtw_odm_parse_rx_phy_status_chinfo(union recv_frame *rframe, u8 *phys)
 			}

 		} else if ((*phys & 0xf) == 1) {
-			struct phy_status_rpt_jaguar2_type1 *phys_t1 = (struct phy_status_rpt_jaguar2_type1 *)phys;
+			struct phy_sts_rpt_jgr2_type1 *phys_t1 = (struct phy_sts_rpt_jgr2_type1 *)phys;
 			u8 rxsc = (attrib->data_rate > DESC_RATE11M && attrib->data_rate < DESC_RATEMCS0) ? phys_t1->l_rxsc : phys_t1->ht_rxsc;
 			u8 pkt_cch = 0;
 			u8 pkt_bw = CHANNEL_WIDTH_20;
@@ -435,7 +401,7 @@ type1_end:
 				attrib->ch = pkt_cch;

 		} else {
-			struct phy_status_rpt_jaguar2_type2 *phys_t2 = (struct phy_status_rpt_jaguar2_type2 *)phys;
+			struct phy_sts_rpt_jgr2_type2 *phys_t2 = (struct phy_sts_rpt_jgr2_type2 *)phys;

 			if (DBG_RX_PHYSTATUS_CHINFO) {
 				RTW_PRINT("phys_t%u ta="MAC_FMT" %s, %s(band:%u, ch:%u, l_rxsc:%u, ht_rxsc:%u)\n"
--- a/core/rtw_p2p.c
+++ b/core/rtw_p2p.c
@@ -290,7 +290,6 @@ static void issue_p2p_provision_resp(struct wifidirect_info *pwdinfo, u8 *raddr,
 	unsigned short				*fctrl;
 	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
 	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
-	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);


 	pmgntframe = alloc_mgtxmitframe(pxmitpriv);
@@ -2807,8 +2806,6 @@ u8 process_p2p_group_negotation_resp(struct wifidirect_info *pwdinfo, u8 *pframe
 		u8	attr_content = 0x00;
 		u32	attr_contentlen = 0;
 		u8	operatingch_info[5] = { 0x00 };
-		uint	ch_cnt = 0;
-		u8	ch_content[100] = { 0x00 };
 		u8	groupid[38];
 		u16	cap_attr;
 		u8	peer_ch_list[100] = { 0x00 };
@@ -2974,7 +2971,9 @@ u8 process_p2p_group_negotation_resp(struct wifidirect_info *pwdinfo, u8 *pframe

 u8 process_p2p_group_negotation_confirm(struct wifidirect_info *pwdinfo, u8 *pframe, uint len)
 {
+#ifdef CONFIG_CONCURRENT_MODE
 	_adapter *padapter = pwdinfo->padapter;
+#endif
 	u8 *ies;
 	u32 ies_len;
 	u8 *p2p_ie;
@@ -3097,8 +3096,6 @@ void p2p_concurrent_handler(_adapter *padapter);
 void restore_p2p_state_handler(_adapter	*padapter)
 {
 	struct wifidirect_info  *pwdinfo = &padapter->wdinfo;
-	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
-

 	if (rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_ING) || rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_FAIL))
 		rtw_p2p_set_role(pwdinfo, P2P_ROLE_DEVICE);
@@ -3295,16 +3292,15 @@ u8 roch_stay_in_cur_chan(_adapter *padapter)
 		if (iface) {
 			pmlmepriv = &iface->mlmepriv;

-			if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING | WIFI_UNDER_WPS) == _TRUE) {
-				RTW_ERR(ADPT_FMT"- _FW_UNDER_LINKING |WIFI_UNDER_WPS (mlme state:0x%x)\n",
+			if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING | WIFI_UNDER_WPS | WIFI_UNDER_KEY_HANDSHAKE) == _TRUE) {
+				RTW_INFO(ADPT_FMT"- _FW_UNDER_LINKING |WIFI_UNDER_WPS | WIFI_UNDER_KEY_HANDSHAKE (mlme state:0x%x)\n",
 						ADPT_ARG(iface), get_fwstate(&iface->mlmepriv));
 				rst = _TRUE;
 				break;
 			}
 			#ifdef CONFIG_AP_MODE
 			if (MLME_IS_AP(iface) || MLME_IS_MESH(iface)) {
-				if (rtw_ap_sta_linking_state_check(iface) == _TRUE) {
-					RTW_ERR(ADPT_FMT"- SoftAP/Mesh -have sta under linking\n", ADPT_ARG(iface));
+				if (rtw_ap_sta_states_check(iface) == _TRUE) {
 					rst = _TRUE;
 					break;
 				}
@@ -3322,8 +3318,12 @@ static int ro_ch_handler(_adapter *adapter, u8 *buf)
 	struct p2p_roch_parm *roch_parm = (struct p2p_roch_parm *)buf;
 	struct rtw_wdev_priv *pwdev_priv = adapter_wdev_data(adapter);
 	struct cfg80211_wifidirect_info *pcfg80211_wdinfo = &adapter->cfg80211_wdinfo;
-	struct wifidirect_info *pwdinfo = &adapter->wdinfo;
+#ifdef CONFIG_CONCURRENT_MODE
 	struct mlme_ext_priv *pmlmeext = &adapter->mlmeextpriv;
+#ifdef RTW_ROCH_BACK_OP
+	struct wifidirect_info *pwdinfo = &adapter->wdinfo;
+#endif
+#endif
 	u8 ready_on_channel = _FALSE;
 	u8 remain_ch;
 	unsigned int duration;
@@ -3442,6 +3442,7 @@ static int cancel_ro_ch_handler(_adapter *padapter, u8 *buf)

 #if defined(RTW_ROCH_BACK_OP) && defined(CONFIG_CONCURRENT_MODE)
 	_cancel_timer_ex(&pwdinfo->ap_p2p_switch_timer);
+	ATOMIC_SET(&pwdev_priv->switch_ch_to, 1);
 #endif

 	if (rtw_mi_get_ch_setting_union(padapter, &ch, &bw, &offset) != 0) {
@@ -3503,6 +3504,7 @@ static void ro_ch_timer_process(void *FunctionContext)
 	p2p_cancel_roch_cmd(adapter, 0, NULL, 0);
 }

+#if 0
 static void rtw_change_p2pie_op_ch(_adapter *padapter, const u8 *frame_body, u32 len, u8 ch)
 {
 	u8 *ies, *p2p_ie;
@@ -3533,7 +3535,9 @@ static void rtw_change_p2pie_op_ch(_adapter *padapter, const u8 *frame_body, u32
 		p2p_ie = rtw_get_p2p_ie(p2p_ie + p2p_ielen, ies_len - (p2p_ie - ies + p2p_ielen), NULL, &p2p_ielen);
 	}
 }
+#endif

+#if defined(CONFIG_CONCURRENT_MODE) && defined(CONFIG_CFG80211_ONECHANNEL_UNDER_CONCURRENT)
 static void rtw_change_p2pie_ch_list(_adapter *padapter, const u8 *frame_body, u32 len, u8 ch)
 {
 	u8 *ies, *p2p_ie;
@@ -3577,11 +3581,12 @@ static void rtw_change_p2pie_ch_list(_adapter *padapter, const u8 *frame_body, u
 		p2p_ie = rtw_get_p2p_ie(p2p_ie + p2p_ielen, ies_len - (p2p_ie - ies + p2p_ielen), NULL, &p2p_ielen);
 	}
 }
+#endif

+#if defined(CONFIG_CONCURRENT_MODE) && defined(CONFIG_CFG80211_ONECHANNEL_UNDER_CONCURRENT)
 static bool rtw_chk_p2pie_ch_list_with_buddy(_adapter *padapter, const u8 *frame_body, u32 len)
 {
 	bool fit = _FALSE;
-#ifdef CONFIG_CONCURRENT_MODE
 	u8 *ies, *p2p_ie;
 	u32 ies_len, p2p_ielen;
 	u8 union_ch = rtw_mi_get_union_chan(padapter);
@@ -3623,14 +3628,14 @@ static bool rtw_chk_p2pie_ch_list_with_buddy(_adapter *padapter, const u8 *frame
 		/* Get the next P2P IE */
 		p2p_ie = rtw_get_p2p_ie(p2p_ie + p2p_ielen, ies_len - (p2p_ie - ies + p2p_ielen), NULL, &p2p_ielen);
 	}
-#endif
+
 	return fit;
 }

+#if defined(CONFIG_P2P_INVITE_IOT)
 static bool rtw_chk_p2pie_op_ch_with_buddy(_adapter *padapter, const u8 *frame_body, u32 len)
 {
 	bool fit = _FALSE;
-#ifdef CONFIG_CONCURRENT_MODE
 	u8 *ies, *p2p_ie;
 	u32 ies_len, p2p_ielen;
 	u8 union_ch = rtw_mi_get_union_chan(padapter);
@@ -3659,13 +3664,13 @@ static bool rtw_chk_p2pie_op_ch_with_buddy(_adapter *padapter, const u8 *frame_b
 		/* Get the next P2P IE */
 		p2p_ie = rtw_get_p2p_ie(p2p_ie + p2p_ielen, ies_len - (p2p_ie - ies + p2p_ielen), NULL, &p2p_ielen);
 	}
-#endif
+
 	return fit;
 }
+#endif

 static void rtw_cfg80211_adjust_p2pie_channel(_adapter *padapter, const u8 *frame_body, u32 len)
 {
-#ifdef CONFIG_CONCURRENT_MODE
 	u8 *ies, *p2p_ie;
 	u32 ies_len, p2p_ielen;
 	u8 union_ch = rtw_mi_get_union_chan(padapter);
@@ -3728,8 +3733,8 @@ static void rtw_cfg80211_adjust_p2pie_channel(_adapter *padapter, const u8 *fram

 	}

-#endif
 }
+#endif

 #ifdef CONFIG_WFD
 u32 rtw_xframe_build_wfd_ie(struct xmit_frame *xframe)
@@ -3813,8 +3818,6 @@ u32 rtw_xframe_build_wfd_ie(struct xmit_frame *xframe)
 bool rtw_xframe_del_wfd_ie(struct xmit_frame *xframe)
 {
 #define DBG_XFRAME_DEL_WFD_IE 0
-
-	_adapter *adapter = xframe->padapter;
 	u8 *frame = xframe->buf_addr + TXDESC_OFFSET;
 	u8 *frame_body = frame + sizeof(struct rtw_ieee80211_hdr_3addr);
 	u8 *frame_tail = frame + xframe->attrib.pktlen;
@@ -3861,12 +3864,9 @@ bool rtw_xframe_del_wfd_ie(struct xmit_frame *xframe)
 void rtw_xframe_chk_wfd_ie(struct xmit_frame *xframe)
 {
 	_adapter *adapter = xframe->padapter;
-	u8 *frame = xframe->buf_addr + TXDESC_OFFSET;
-	u8 *frame_body = frame + sizeof(struct rtw_ieee80211_hdr_3addr);
-	u8 *frame_tail = frame + xframe->attrib.pktlen;
-
+#ifdef CONFIG_IOCTL_CFG80211
 	struct wifidirect_info *wdinfo = &adapter->wdinfo;
-	struct mlme_priv *mlme = &adapter->mlmepriv;
+#endif
 	u8 build = 0;
 	u8 del = 0;

@@ -3874,7 +3874,7 @@ void rtw_xframe_chk_wfd_ie(struct xmit_frame *xframe)
 		del = 1;

 #ifdef CONFIG_IOCTL_CFG80211
-	if (_TRUE == wdinfo->wfd_info->wfd_enable)
+	if (wdinfo->wfd_info->wfd_enable == _TRUE)
 #endif
 		del = build = 1;

@@ -3894,7 +3894,6 @@ u8 *dump_p2p_attr_ch_list(u8 *p2p_ie, uint p2p_ielen, u8 *buf, u32 buf_len)
 	int w_sz = 0;
 	u8 ch_cnt = 0;
 	u8 ch_list[40];
-	bool continuous = _FALSE;

 	pattr = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_CH_LIST, NULL, &attr_contentlen);
 	if (pattr != NULL) {
@@ -4353,7 +4352,6 @@ void rtw_init_cfg80211_wifidirect_info(_adapter	*padapter)
 s32 p2p_protocol_wk_hdl(_adapter *padapter, int intCmdType, u8 *buf)
 {
 	int ret = H2C_SUCCESS;
-	struct wifidirect_info	*pwdinfo = &(padapter->wdinfo);

 	switch (intCmdType) {
 	case P2P_FIND_PHASE_WK:
@@ -4430,7 +4428,6 @@ int process_p2p_cross_connect_ie(PADAPTER padapter, u8 *IEs, u32 IELength)
 	u8	p2p_attr[MAX_P2P_IE_LEN] = { 0x00 };/* NoA length should be n*(13) + 2 */
 	u32	attr_contentlen = 0;

-	struct wifidirect_info	*pwdinfo = &(padapter->wdinfo);


 	if (IELength <= _BEACON_IE_OFFSET_)
@@ -4553,7 +4550,6 @@ void p2p_ps_wk_hdl(_adapter *padapter, u8 p2p_ps_state)
 {
 	struct pwrctrl_priv		*pwrpriv = adapter_to_pwrctl(padapter);
 	struct wifidirect_info	*pwdinfo = &(padapter->wdinfo);
-	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
 	u32 ps_deny = 0;

 	/* Pre action for p2p state */
@@ -4731,7 +4727,6 @@ static void pre_tx_scan_timer_process(void *FunctionContext)
 	struct	wifidirect_info				*pwdinfo = &adapter->wdinfo;
 	_irqL							irqL;
 	struct mlme_priv					*pmlmepriv = &adapter->mlmepriv;
-	u8								_status = 0;

 	if (rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
 		return;
@@ -5045,7 +5040,6 @@ void init_wifidirect_info(_adapter *padapter, enum P2P_ROLE role)
 #ifdef CONFIG_WFD
 	struct wifi_display_info	*pwfd_info = &padapter->wfd_info;
 #endif
-	u8 union_ch = 0;
 	pwdinfo = &padapter->wdinfo;

 	pwdinfo->padapter = padapter;
@@ -5060,6 +5054,8 @@ void init_wifidirect_info(_adapter *padapter, enum P2P_ROLE role)
 		&& pwdinfo->driver_interface != DRIVER_CFG80211
 	) {
 		#ifdef CONFIG_CONCURRENT_MODE
+		u8 union_ch = 0;
+
 		if (rtw_mi_check_status(padapter, MI_LINKED))
 			union_ch = rtw_mi_get_union_chan(padapter);

@@ -5195,6 +5191,14 @@ void init_wifidirect_info(_adapter *padapter, enum P2P_ROLE role)
 	pwdinfo->p2p_info.scan_op_ch_only = 0;
 }

+void _rtw_p2p_set_role(struct wifidirect_info *wdinfo, enum P2P_ROLE role)
+{
+	if (wdinfo->role != role) {
+		wdinfo->role = role;
+		rtw_mi_update_iface_status(&(wdinfo->padapter->mlmepriv), 0);
+	}
+}
+
 #ifdef CONFIG_DBG_P2P

 /**
@@ -5343,9 +5347,6 @@ int rtw_p2p_enable(_adapter *padapter, enum P2P_ROLE role)
 	struct wifidirect_info *pwdinfo = &(padapter->wdinfo);

 	if (role == P2P_ROLE_DEVICE || role == P2P_ROLE_CLIENT || role == P2P_ROLE_GO) {
-		u8 channel, ch_offset;
-		u16 bwmode;
-
 #if defined(CONFIG_CONCURRENT_MODE) && (!defined(RTW_P2P_GROUP_INTERFACE) || !RTW_P2P_GROUP_INTERFACE)
 		/*	Commented by Albert 2011/12/30 */
 		/*	The driver just supports 1 P2P group operation. */
--- a/core/rtw_pwrctrl.c
+++ b/core/rtw_pwrctrl.c
@@ -18,13 +18,13 @@
 #include <hal_data.h>
 #include <hal_com_h2c.h>

+#ifdef DBG_CHECK_FW_PS_STATE
 int rtw_fw_ps_state(PADAPTER padapter)
 {
 	struct dvobj_priv *psdpriv = padapter->dvobj;
 	struct debug_priv *pdbgpriv = &psdpriv->drv_dbg;
 	int ret = _FAIL, dont_care = 0;
 	u16 fw_ps_state = 0;
-	u32 start_time;
 	struct pwrctrl_priv *pwrpriv = adapter_to_pwrctl(padapter);
 	struct registry_priv  *registry_par = &padapter->registrypriv;

@@ -40,6 +40,15 @@ int rtw_fw_ps_state(PADAPTER padapter)
 			 , rtw_is_drv_stopped(padapter) ? "True" : "False");
 		goto exit_fw_ps_state;
 	}
+	#if defined(CONFIG_RTL8822B) || defined(CONFIG_RTL8821C) || defined(CONFIG_RTL8822C)
+	rtw_hal_get_hwreg(padapter, HW_VAR_FW_PS_STATE, (u8 *)&fw_ps_state);
+	if ((fw_ps_state & BIT_LPS_STATUS) == 0)
+		ret = _SUCCESS;
+	else {
+		pdbgpriv->dbg_poll_fail_cnt++;
+		RTW_INFO("%s: fw_ps_state=%04x\n", __FUNCTION__, fw_ps_state);
+	}
+	#else
 	rtw_hal_set_hwreg(padapter, HW_VAR_SET_REQ_FW_PS, (u8 *)&dont_care);
 	{
 		/* 4. if 0x88[7]=1, driver set cmd to leave LPS/IPS. */
@@ -58,13 +67,13 @@ int rtw_fw_ps_state(PADAPTER padapter)
 			RTW_INFO("%s: fw_ps_state=%04x\n", __FUNCTION__, fw_ps_state);
 		}
 	}
-
+	#endif

 exit_fw_ps_state:
 	_exit_pwrlock(&pwrpriv->check_32k_lock);
 	return ret;
 }
-
+#endif /*DBG_CHECK_FW_PS_STATE*/
 #ifdef CONFIG_IPS
 void _ips_enter(_adapter *padapter)
 {
@@ -144,8 +153,10 @@ int _ips_leave(_adapter *padapter)
 int ips_leave(_adapter *padapter)
 {
 	struct pwrctrl_priv *pwrpriv = adapter_to_pwrctl(padapter);
+#ifdef DBG_CHECK_FW_PS_STATE
 	struct dvobj_priv *psdpriv = padapter->dvobj;
 	struct debug_priv *pdbgpriv = &psdpriv->drv_dbg;
+#endif
 	int ret;

 	if (!is_primary_adapter(padapter))
@@ -263,9 +274,6 @@ exit:
 */
 void rtw_ps_processor(_adapter *padapter)
 {
-#ifdef CONFIG_P2P
-	struct wifidirect_info	*pwdinfo = &(padapter->wdinfo);
-#endif /* CONFIG_P2P */
 	struct pwrctrl_priv *pwrpriv = adapter_to_pwrctl(padapter);
 	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
 	struct dvobj_priv *psdpriv = padapter->dvobj;
@@ -398,9 +406,69 @@ void pwr_state_check_handler(void *ctx)
 }

 #ifdef CONFIG_LPS
+#ifdef CONFIG_CHECK_LEAVE_LPS
+#ifdef CONFIG_LPS_CHK_BY_TP
+void traffic_check_for_leave_lps_by_tp(PADAPTER padapter, u8 tx, struct sta_info *sta)
+{
+	struct stainfo_stats *pstats = &sta->sta_stats;
+	u64 cur_acc_tx_bytes = 0, cur_acc_rx_bytes = 0;
+	u32 tx_tp_kbyte = 0, rx_tp_kbyte = 0;
+	u32 tx_tp_th = 0, rx_tp_th = 0;
+	struct pwrctrl_priv *pwrpriv = adapter_to_pwrctl(padapter);
+	u8	leave_lps = _FALSE;
+
+	if (tx) { /* from tx */
+		cur_acc_tx_bytes = pstats->tx_bytes - pstats->acc_tx_bytes;
+		tx_tp_kbyte = cur_acc_tx_bytes >> 10;
+		tx_tp_th = pwrpriv->lps_tx_tp_th * 1024 / 8 * 2; /*KBytes @2s*/
+
+		if (tx_tp_kbyte >= tx_tp_th ||
+			padapter->mlmepriv.LinkDetectInfo.NumTxOkInPeriod >= pwrpriv->lps_tx_pkts){
+			if (pwrpriv->bLeisurePs
+				&& (pwrpriv->pwr_mode != PS_MODE_ACTIVE)
+				#ifdef CONFIG_BT_COEXIST
+				&& (rtw_btcoex_IsBtControlLps(padapter) == _FALSE)
+				#endif
+			) {
+				leave_lps = _TRUE;
+			}
+		}
+
+	} else { /* from rx path */
+		cur_acc_rx_bytes = pstats->rx_bytes - pstats->acc_rx_bytes;
+		rx_tp_kbyte = cur_acc_rx_bytes >> 10;
+		rx_tp_th = pwrpriv->lps_rx_tp_th * 1024 / 8 * 2;
+
+		if (rx_tp_kbyte>= rx_tp_th ||
+			padapter->mlmepriv.LinkDetectInfo.NumRxUnicastOkInPeriod >= pwrpriv->lps_rx_pkts) {
+			if (pwrpriv->bLeisurePs
+				&& (pwrpriv->pwr_mode != PS_MODE_ACTIVE)
+				#ifdef CONFIG_BT_COEXIST
+				&& (rtw_btcoex_IsBtControlLps(padapter) == _FALSE)
+				#endif
+			) {
+				leave_lps = _TRUE;
+			}
+		}
+	}
+
+	if (leave_lps) {
+		#ifdef DBG_LPS_CHK_BY_TP
+		RTW_INFO("leave lps via %s, ", tx ? "Tx" : "Rx");
+		if (tx)
+			RTW_INFO("Tx = %d [%d] (KB)\n", tx_tp_kbyte, tx_tp_th);
+		else
+			RTW_INFO("Rx = %d [%d] (KB)\n", rx_tp_kbyte, rx_tp_th);
+		#endif
+		pwrpriv->lps_chk_cnt = pwrpriv->lps_chk_cnt_th;
+		/* rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_LEAVE, 1); */
+		rtw_lps_ctrl_wk_cmd(padapter, tx ? LPS_CTRL_TX_TRAFFIC_LEAVE : LPS_CTRL_RX_TRAFFIC_LEAVE, 1);
+	}
+}
+#endif /*CONFIG_LPS_CHK_BY_TP*/
+
 void	traffic_check_for_leave_lps(PADAPTER padapter, u8 tx, u32 tx_packets)
 {
-#ifdef CONFIG_CHECK_LEAVE_LPS
 	static systime start_time = 0;
 	static u32 xmit_cnt = 0;
 	u8	bLeaveLPS = _FALSE;
@@ -450,62 +518,76 @@ void	traffic_check_for_leave_lps(PADAPTER padapter, u8 tx, u32 tx_packets)
 		/* rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_LEAVE, 1); */
 		rtw_lps_ctrl_wk_cmd(padapter, tx ? LPS_CTRL_TX_TRAFFIC_LEAVE : LPS_CTRL_RX_TRAFFIC_LEAVE, tx ? 0 : 1);
 	}
-#endif /* CONFIG_CHECK_LEAVE_LPS */
 }
+#endif /* CONFIG_CHECK_LEAVE_LPS */

 #ifdef CONFIG_LPS_LCLK
-u8 rtw_cpwm_polling(_adapter *adapter, u8 cpwm_orig)
+#define LPS_CPWM_TIMEOUT_MS	10 /*ms*/
+#define LPS_RPWM_RETRY_CNT		3
+
+u8 rtw_cpwm_polling(_adapter *adapter, u8 rpwm, u8 cpwm_orig)
 {
-	u8 result = _FAIL;
-	u8 cpwm_now;
-	u8 poll_cnt = 0;
+	u8 rst = _FAIL;
+	u8 cpwm_now = 0;
 	systime start_time;
 	struct pwrctrl_priv *pwrpriv = adapter_to_pwrctl(adapter);
+	#ifdef DBG_CHECK_FW_PS_STATE
 	struct debug_priv *pdbgpriv = &(adapter_to_dvobj(adapter)->drv_dbg);
+	#endif

-	/*RTW_INFO("%s.....\n", __func__);*/
+	pwrpriv->rpwm_retry = 0;

-	start_time = rtw_get_current_time();
-
-	/* polling cpwm */
 	do {
-		rtw_msleep_os(1);
-		poll_cnt++;
-		cpwm_now = 0;
-		rtw_hal_get_hwreg(adapter, HW_VAR_CPWM, &cpwm_now);
+		start_time = rtw_get_current_time();
+		do {
+			rtw_msleep_os(1);
+			rtw_hal_get_hwreg(adapter, HW_VAR_CPWM, &cpwm_now);

-		if ((cpwm_orig ^ cpwm_now) & 0x80) {
-			pwrpriv->cpwm = PS_STATE_S4;
-			pwrpriv->cpwm_tog = cpwm_now & PS_TOGGLE;
-			#ifdef DBG_CHECK_FW_PS_STATE
-			RTW_INFO("%s: polling cpwm OK! poll_cnt=%d, cpwm_orig=%02x, cpwm_now=%02x , 0x100=0x%x\n"
-				, __func__, poll_cnt, cpwm_orig, cpwm_now, rtw_read8(adapter, REG_CR));
-			if (rtw_fw_ps_state(adapter) == _FAIL) {
-				RTW_INFO("leave 32k but fw state in 32k\n");
-				pdbgpriv->dbg_rpwm_toogle_cnt++;
+			if ((cpwm_orig ^ cpwm_now) & 0x80) {
+				pwrpriv->cpwm = PS_STATE_S4;
+				pwrpriv->cpwm_tog = cpwm_now & PS_TOGGLE;
+				rst = _SUCCESS;
+				break;
 			}
-			#endif /* DBG_CHECK_FW_PS_STATE */
-			result = _SUCCESS;
-			break;
-		}
+		} while (rtw_get_passing_time_ms(start_time) < LPS_CPWM_TIMEOUT_MS && !RTW_CANNOT_RUN(adapter));

-		if (rtw_get_passing_time_ms(start_time) > LPS_RPWM_WAIT_MS) {
-			RTW_ERR("%s: polling cpwm timeout! poll_cnt=%d, cpwm_orig=%02x, cpwm_now=%02x\n"
-				, __func__, poll_cnt, cpwm_orig, cpwm_now);
-			#ifdef DBG_CHECK_FW_PS_STATE
-			if (rtw_fw_ps_state(adapter) == _FAIL) {
-				RTW_INFO("rpwm timeout and fw ps state in 32k\n");
-				pdbgpriv->dbg_rpwm_timeout_fail_cnt++;
-			}
-			#endif /* DBG_CHECK_FW_PS_STATE */
-
-			#ifdef CONFIG_LPS_RPWM_TIMER
-			_set_timer(&pwrpriv->pwr_rpwm_timer, 1);
-			#endif /* CONFIG_LPS_RPWM_TIMER */
+		if (rst == _SUCCESS)
 			break;
+		else {
+			/* rpwm retry */
+			cpwm_orig = cpwm_now;
+			rpwm &= ~PS_TOGGLE;
+			rpwm |= pwrpriv->tog;
+			rtw_hal_set_hwreg(adapter, HW_VAR_SET_RPWM, (u8 *)(&rpwm));
+			pwrpriv->tog += 0x80;
 		}
-	} while (1);
-	return result;
+	} while (pwrpriv->rpwm_retry++ < LPS_RPWM_RETRY_CNT && !RTW_CANNOT_RUN(adapter));
+
+	if (rst == _SUCCESS) {
+		#ifdef DBG_CHECK_FW_PS_STATE
+		RTW_INFO("%s: polling cpwm OK! rpwm_retry=%d, cpwm_orig=%02x, cpwm_now=%02x , 0x100=0x%x\n"
+			, __func__, pwrpriv->rpwm_retry, cpwm_orig, cpwm_now, rtw_read8(adapter, REG_CR));
+		if (rtw_fw_ps_state(adapter) == _FAIL) {
+			RTW_INFO("leave 32k but fw state in 32k\n");
+			pdbgpriv->dbg_rpwm_toogle_cnt++;
+		}
+		#endif /* DBG_CHECK_FW_PS_STATE */
+	} else {
+		RTW_ERR("%s: polling cpwm timeout! rpwm_retry=%d, cpwm_orig=%02x, cpwm_now=%02x\n"
+				, __func__, pwrpriv->rpwm_retry, cpwm_orig, cpwm_now);
+		#ifdef DBG_CHECK_FW_PS_STATE
+		if (rtw_fw_ps_state(adapter) == _FAIL) {
+			RTW_INFO("rpwm timeout and fw ps state in 32k\n");
+			pdbgpriv->dbg_rpwm_timeout_fail_cnt++;
+		}
+		#endif /* DBG_CHECK_FW_PS_STATE */
+
+		#ifdef CONFIG_LPS_RPWM_TIMER
+		_set_timer(&pwrpriv->pwr_rpwm_timer, 1);
+		#endif /* CONFIG_LPS_RPWM_TIMER */
+	}
+
+	return rst;
 }
 #endif
 /*
@@ -517,15 +599,13 @@ u8 rtw_cpwm_polling(_adapter *adapter, u8 cpwm_orig)
 *	pslv			power state level, only could be PS_STATE_S0 ~ PS_STATE_S4
 *
 */
-void rtw_set_rpwm(PADAPTER padapter, u8 pslv)
+u8 rtw_set_rpwm(PADAPTER padapter, u8 pslv)
 {
-	u8	rpwm;
+	u8	rpwm = 0xFF;
 	struct pwrctrl_priv *pwrpriv = adapter_to_pwrctl(padapter);
 #ifdef CONFIG_LPS_LCLK
 	u8 cpwm_orig;
 #endif
-	struct dvobj_priv *psdpriv = padapter->dvobj;
-	struct debug_priv *pdbgpriv = &psdpriv->drv_dbg;

 	pslv = PS_STATE(pslv);

@@ -541,7 +621,7 @@ void rtw_set_rpwm(PADAPTER padapter, u8 pslv)
 #endif
 			|| (pwrpriv->lps_level == LPS_NORMAL)
 		   ) {
-			return;
+			return rpwm;
 		}
 	}

@@ -550,12 +630,12 @@ void rtw_set_rpwm(PADAPTER padapter, u8 pslv)

 		pwrpriv->cpwm = PS_STATE_S4;

-		return;
+		return rpwm;
 	}

 	if (rtw_is_drv_stopped(padapter))
 		if (pslv < PS_STATE_S2)
-			return;
+			return rpwm;

 	rpwm = pslv | pwrpriv->tog;
 #ifdef CONFIG_LPS_LCLK
@@ -573,9 +653,16 @@ void rtw_set_rpwm(PADAPTER padapter, u8 pslv)
 #endif

 #if defined(CONFIG_LPS_RPWM_TIMER) && !defined(CONFIG_DETECT_CPWM_BY_POLLING)
-	if (rpwm & PS_ACK)
-		_set_timer(&pwrpriv->pwr_rpwm_timer, LPS_RPWM_WAIT_MS);
+	if (rpwm & PS_ACK) {
+		#if defined(CONFIG_WOWLAN) || defined(CONFIG_AP_WOWLAN) || defined(CONFIG_P2P_WOWLAN)
+		if (pwrpriv->wowlan_mode != _TRUE &&
+			pwrpriv->wowlan_ap_mode != _TRUE &&
+			pwrpriv->wowlan_p2p_mode != _TRUE)
+		#endif
+		_set_timer(&pwrpriv->pwr_rpwm_timer, LPS_CPWM_TIMEOUT_MS);
+	}
 #endif /* CONFIG_LPS_RPWM_TIMER & !CONFIG_DETECT_CPWM_BY_POLLING */
+
 	rtw_hal_set_hwreg(padapter, HW_VAR_SET_RPWM, (u8 *)(&rpwm));

 	pwrpriv->tog += 0x80;
@@ -583,14 +670,14 @@ void rtw_set_rpwm(PADAPTER padapter, u8 pslv)
 #ifdef CONFIG_LPS_LCLK
 	/* No LPS 32K, No Ack */
 	if (rpwm & PS_ACK) {
-#ifdef CONFIG_DETECT_CPWM_BY_POLLING
-		rtw_cpwm_polling(padapter, cpwm_orig);
+		#ifdef CONFIG_DETECT_CPWM_BY_POLLING
+		rtw_cpwm_polling(padapter, rpwm, cpwm_orig);
 		#else
 		#if defined(CONFIG_WOWLAN) || defined(CONFIG_AP_WOWLAN) || defined(CONFIG_P2P_WOWLAN)
 		if (pwrpriv->wowlan_mode == _TRUE ||
 			pwrpriv->wowlan_ap_mode == _TRUE ||
 			pwrpriv->wowlan_p2p_mode == _TRUE)
-				rtw_cpwm_polling(padapter, cpwm_orig);
+				rtw_cpwm_polling(padapter, rpwm, cpwm_orig);
 		#endif /*#if defined(CONFIG_WOWLAN) || defined(CONFIG_AP_WOWLAN) || defined(CONFIG_P2P_WOWLAN)*/
 		#endif /*#ifdef CONFIG_DETECT_CPWM_BY_POLLING*/
 	} else
@@ -599,6 +686,7 @@ void rtw_set_rpwm(PADAPTER padapter, u8 pslv)
 		pwrpriv->cpwm = pslv;
 	}

+	return rpwm;
 }

 u8 PS_RDY_CHECK(_adapter *padapter)
@@ -606,12 +694,6 @@ u8 PS_RDY_CHECK(_adapter *padapter)
 	u32 delta_ms;
 	struct pwrctrl_priv	*pwrpriv = adapter_to_pwrctl(padapter);
 	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
-#ifdef CONFIG_P2P
-	struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
-#ifdef CONFIG_IOCTL_CFG80211
-	struct cfg80211_wifidirect_info *pcfg80211_wdinfo = &padapter->cfg80211_wdinfo;
-#endif /* CONFIG_IOCTL_CFG80211 */
-#endif /* CONFIG_P2P */