mac80211: realtek: rtw88: sync with v6.16

Renamed 046..051 pending patches with the merged tag/hash.
Two patches were skipped, they make use of WQ_BH present since v6.14:
  13221be720
  3e3aa566dd
Manually refreshed 062-v6.14-wifi-rtw88-Add-support-for-LED-blinking.patch
Manually refreshed  063-v6.14-wifi-rtw88-add-RTW88_LEDS-depends-on-LEDS_CLASS-to-K.patch
Manually backported 090-v6.15-wifi-rtw88-Enable-the-new-RTL8814AE-RTL8814AU-driver.patch

git log --no-merges --pretty=oneline --abbrev-commit 4c2c372de...0daa521a drivers/net/wireless/realtek/rtw88:
4c2c372de2e1 wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds
f24d0d8c3cd7 wifi: rtw88: Fix the random "error beacon valid" messages for USB
80fe0bc1659c wifi: rtw88: usb: Upload the firmware in bigger chunks
490340faddea wifi: rtw88: usb: Reduce control message timeout to 500 ms
b7f0cc647e52 wifi: rtw88: rtw8822bu VID/PID for BUFFALO WI-U2-866DM
2c17afde9ff6 wifi: rtw88: Handle RTL8723D(S) with blank efuse
0ffa1ba81b35 wifi: rtw88: Fix RX aggregation settings for RTL8723DS
20d3c19bd8f9 wifi: rtw88: do not ignore hardware read error during DPK
fc5f5a0ec463 wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally
b2effcdc2379 wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT
581cf3a9cb61 wifi: rtw88: Fix the module names printed in dmesg
b8d49bb8d16a wifi: rtw88: Don't set SUPPORTS_AMSDU_IN_AMPDU for RTL8814AU
0d2a88690e58 wifi: rtw88: Set AMPDU factor to hardware for RTL8814A
dcbb7bb3a364 wifi: rtw88: usb: Enable RX aggregation for RTL8814AU
bf1103654df9 wifi: rtw88: usb: Enable switching the RTL8814AU to USB 3
625fbc16524a wifi: rtw88: usb: Remove redundant 'flush_workqueue()' calls
5c4cf36c538b wifi: rtw88: sdio: Remove redundant 'flush_workqueue()' calls
d58ad77d5cc2 wifi: rtw88: Add __nonstring annotations for unterminated strings
deb3ddeb1865 wifi: rtw88: Enable the new RTL8814AE/RTL8814AU drivers
bad060e8a425 wifi: rtw88: Add rtw8814au.c
dad8e8793102 wifi: rtw88: Add rtw8814ae.c
1a7545784642 wifi: rtw88: Add rtw8814a.{c,h}
e38246889cc9 wifi: rtw88: Add rtw8814a_table.c (part 2/2)
f4debfcb1b3c wifi: rtw88: Add rtw8814a_table.c (part 1/2)
679ec431477c wifi: rtw88: Add some definitions for RTL8814AU
c374281f8285 wifi: rtw88: Extend rtw_debugfs_get_tx_pwr_tbl() for RTL8814AU
cfebabdd351e wifi: rtw88: Extend rtw_debugfs_get_phy_info() for RTL8814AU
8b42c46cf665 wifi: rtw88: Extend rtw_phy_config_swing_table() for RTL8814AU
053a7aace020 wifi: rtw88: Fix rtw_rx_phy_stat() for RTL8814AU
6be7544d19fc wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU
c7eea1ba05ca wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU
86d04f8f991a wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31
e66bca16638e wifi: rtw88: Fix rtw_mac_power_switch() for RTL8814AU
80c4668d024f wifi: rtw88: Add support for Mercusys MA30N and D-Link DWA-T185 rev. A1
9f00e2218e15 wifi: rtw88: Fix rtw_update_sta_info() for RTL8814AU
0f98a5959657 wifi: rtw88: Extend TX power stuff for 3-4 spatial streams
ad815f392003 wifi: rtw88: Rename RTW_RATE_SECTION_MAX to RTW_RATE_SECTION_NUM
e66f3b5c7535 wifi: rtw88: Constify some more structs and arrays
8f0076726b66 wifi: rtw88: Extend rtw_fw_send_ra_info() for RTL8814AU
d80e7d9b6ba3 wifi: rtw88: Extend rf_base_addr and rf_sipi_addr for RTL8814AU
62f726848da4 wifi: rtw88: Extend struct rtw_pwr_track_tbl for RTL8814AU
9e8243025cc0 wifi: rtw88: Fix download_firmware_validate() for RTL8814AU
8425f5c8f04d wifi: rtw88: Fix __rtw_download_firmware() for RTL8814AU
105dc94233e4 wifi: rtw88: Fix a typo of debug message in rtw8723d_iqk_check_tx_failed()
0d1d165eff9d wifi: rtw88: Don't use static local variable in rtw8821c_set_tx_power_index_by_rate
00451eb3bec7 wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate
b4bfbc50b1b9 wifi: rtw88: add RTW88_LEDS depends on LEDS_CLASS to Kconfig
4b6652bc6d8d wifi: rtw88: Add support for LED blinking
fb2fcfbe5eef wifi: rtw88: sdio: Fix disconnection after beacon loss
a806a8160a0f wifi: rtw88: 8703b: Fix RX/TX issues
5ad483955acc wifi: rtw88: Delete rf_type member of struct rtw_sta_info
5b1b9545262b wifi: rtw88: Add USB PHY configuration
not backported (3e3aa566dd18 wifi: rtw88: usb: Preallocate and reuse the RX skbs)
not backported (13221be72034 wifi: rtw88: Handle C2H_ADAPTIVITY in rtw_fw_c2h_cmd_handle() )
e9048e2935f7 wifi: rtw88: usb: Copy instead of cloning the RX skb
74a72c367573 wifi: rtw88: 8821a/8812a: Set ptct_efuse_size to 0
59ab27a9f20f wifi: rtw88: 8812a: Support RFE type 2

Signed-off-by: Marty Jones <mj8263788@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/19052
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

package/kernel/mac80211/patches/rtl/046-v6.14-wifi-rtw88-8821au-Add-additional-devices-to-the-USB_.patch

@@ -1,14 +1,16 @@
-From ff5a1c94e53c0d24f610c2c30add82f75b728737 Mon Sep 17 00:00:00 2001
-From: Larry Finger <Larry.Finger@gmail.com>
+From 7b5ce65d90187f0944e70dc5741aa0edfac926f4 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
 Date: Wed, 6 Nov 2024 15:55:31 +0200
-Subject: [PATCH 1/6] wifi: rtw88: 8821au: Add additional devices to the
- USB_DEVICE list
+Subject: [PATCH] wifi: rtw88: 8821au: Add additional devices to the USB_DEVICE
+ list
 
 These are the entries that Nick Morrow provided. From
 https://github.com/morrownr/8821au-20210708
 
 Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
 Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/da05b866-a9ff-428c-a008-35e8cf200a98@gmail.com
 ---
  .../net/wireless/realtek/rtw88/rtw8821au.c    | 52 ++++++++++++++++++-
  1 file changed, 51 insertions(+), 1 deletion(-)

package/kernel/mac80211/patches/rtl/047-v6.14-wifi-rtw88-8812au-Add-more-device-IDs.patch

@@ -1,12 +1,14 @@
-From d21ad2e4edfb64d3f32685607a457576eea3c5cd Mon Sep 17 00:00:00 2001
+From 1ee6ff9ae3c1a9eda9081f9db04f85d3a7352d38 Mon Sep 17 00:00:00 2001
 From: Nick Morrow <usbwifi2024@gmail.com>
 Date: Wed, 6 Nov 2024 15:57:10 +0200
-Subject: [PATCH 2/6] wifi: rtw88: 8812au: Add more device IDs
+Subject: [PATCH] wifi: rtw88: 8812au: Add more device IDs
 
 From https://github.com/morrownr/8812au-20210820.
 
 Signed-off-by: Nick Morrow <usbwifi2024@gmail.com>
 Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/31b7ee6b-f96d-43e0-a32f-a9eb1174a0c1@gmail.com
 ---
  .../net/wireless/realtek/rtw88/rtw8812au.c    | 68 ++++++++++++++++++-
  1 file changed, 67 insertions(+), 1 deletion(-)

package/kernel/mac80211/patches/rtl/048-v6.14-wifi-rtw88-Add-additional-USB-IDs-for-RTL8812BU.patch

@@ -1,7 +1,7 @@
-From acadf3a63b39ad03167a633fa3cea8c0fc2ab87f Mon Sep 17 00:00:00 2001
+From d4c4903508f9e1b2bfec88f777718484e27343fb Mon Sep 17 00:00:00 2001
 From: Nick Morrow <usbwifi2024@gmail.com>
 Date: Thu, 7 Nov 2024 08:28:46 +0800
-Subject: [PATCH 6/6] wifi: rtw88: Add additional USB IDs for RTL8812BU
+Subject: [PATCH] wifi: rtw88: Add additional USB IDs for RTL8812BU
 
 Add three additional USB IDs found in
 https://github.com/morrownr/88x2bu-20210702
@@ -9,7 +9,9 @@ to support more RTL8812BU devices.
 
 Signed-off-by: Nick Morrow <usbwifi2024@gmail.com>
 Signed-off-by: Zenm Chen <zenmchen@gmail.com>
-Signed-off-by: Mikhail Novosyolov <m.novosyolov@rosalinux.ru>
+Reviewed-by: Mikhail Novosyolov <m.novosyolov@rosalinux.ru>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20241107002846.13748-1-zenmchen@gmail.com
 ---
  drivers/net/wireless/realtek/rtw88/rtw8822bu.c | 6 ++++++
  1 file changed, 6 insertions(+)

package/kernel/mac80211/patches/rtl/049-v6.14-wifi-rtw88-usb-Support-USB-3-with-RTL8812AU.patch

@@ -1,14 +1,16 @@
-From 213dfa630285bb0241f3eaeb778db8ff128f10ba Mon Sep 17 00:00:00 2001
+From 82a35723a67c29f685d7b518962154a73b7163a2 Mon Sep 17 00:00:00 2001
 From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
-Date: Fri, 8 Nov 2024 01:41:08 +0200
-Subject: [PATCH 3/6] wifi: rtw88: usb: Support USB 3 with RTL8812AU
+Date: Thu, 14 Nov 2024 17:46:08 +0200
+Subject: [PATCH] wifi: rtw88: usb: Support USB 3 with RTL8812AU
 
 Add the function to automatically switch the RTL8812AU into USB 3 mode.
 
 Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/19cda72b-f1f1-4b69-8369-0e4376b646bf@gmail.com
 ---
- drivers/net/wireless/realtek/rtw88/usb.c | 34 ++++++++++++++++++++++--
- 1 file changed, 32 insertions(+), 2 deletions(-)
+ drivers/net/wireless/realtek/rtw88/usb.c | 44 ++++++++++++++++++++++--
+ 1 file changed, 42 insertions(+), 2 deletions(-)
 
 --- a/drivers/net/wireless/realtek/rtw88/usb.c
 +++ b/drivers/net/wireless/realtek/rtw88/usb.c
@@ -45,24 +47,38 @@ Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
  static int rtw_usb_switch_mode_new(struct rtw_dev *rtwdev)
  {
  	enum usb_device_speed cur_speed;
-@@ -983,7 +1009,8 @@ static int rtw_usb_switch_mode(struct rt
+@@ -979,11 +1005,22 @@ static int rtw_usb_switch_mode_new(struc
+ 	return 1;
+ }
+ 
++static bool rtw_usb3_chip_old(u8 chip_id)
++{
++	return chip_id == RTW_CHIP_TYPE_8812A;
++}
++
++static bool rtw_usb3_chip_new(u8 chip_id)
++{
++	return chip_id == RTW_CHIP_TYPE_8822C ||
++	       chip_id == RTW_CHIP_TYPE_8822B;
++}
++
+ static int rtw_usb_switch_mode(struct rtw_dev *rtwdev)
  {
  	u8 id = rtwdev->chip->id;
  
 -	if (id != RTW_CHIP_TYPE_8822C && id != RTW_CHIP_TYPE_8822B)
-+	if (id != RTW_CHIP_TYPE_8822C && id != RTW_CHIP_TYPE_8822B &&
-+	    id != RTW_CHIP_TYPE_8812A)
++	if (!rtw_usb3_chip_new(id) && !rtw_usb3_chip_old(id))
  		return 0;
  
  	if (!rtwdev->efuse.usb_mode_switch) {
-@@ -998,7 +1025,10 @@ static int rtw_usb_switch_mode(struct rt
+@@ -998,7 +1035,10 @@ static int rtw_usb_switch_mode(struct rt
  		return 0;
  	}
  
 -	return rtw_usb_switch_mode_new(rtwdev);
-+	if (id == RTW_CHIP_TYPE_8812A)
++	if (rtw_usb3_chip_old(id))
 +		return rtw_usb_switch_mode_old(rtwdev);
-+	else /* RTL8822CU, RTL8822BU */
++	else
 +		return rtw_usb_switch_mode_new(rtwdev);
  }
  

package/kernel/mac80211/patches/rtl/050-v6.14-wifi-rtlwifi-rtl8821ae-phy-restore-removed-code-to-f.patch

@@ -1,8 +1,8 @@
-From 927dcd0ab53f39ee00a2d1f204b5aac77e28fcf9 Mon Sep 17 00:00:00 2001
+From 5e5903a442bb889a62a0f5d89ac33e53ab08592c Mon Sep 17 00:00:00 2001
 From: Colin Ian King <colin.i.king@gmail.com>
 Date: Wed, 6 Nov 2024 15:46:42 +0000
-Subject: [PATCH 5/6] wifi: rtlwifi: rtl8821ae: phy: restore removed code to
- fix infinite loop
+Subject: [PATCH] wifi: rtlwifi: rtl8821ae: phy: restore removed code to fix
+ infinite loop
 
 A previous clean-up fix removed the assignment of v2 inside a while loop
 that turned it into an infinite loop. Fix this by restoring the assignment
@@ -12,6 +12,8 @@ Fixes: cda37445718d ("wifi: rtlwifi: rtl8821ae: phy: remove some useless code")
 Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
 Tested-by: Ping-Ke Shih <pkshih@realtek.com>
 Reviewed-by: Su Hui <suhui@nfschina.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20241106154642.1627886-1-colin.i.king@gmail.com
 ---
  drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 4 +++-
  1 file changed, 3 insertions(+), 1 deletion(-)

package/kernel/mac80211/patches/rtl/051-v6.14-wifi-rtw88-usb-Enable-RX-aggregation-for-8821au-8812.patch

@@ -1,7 +1,7 @@
-From 2b38362bd3b8e0a3691f0a8e82444a54f702e384 Mon Sep 17 00:00:00 2001
+From ce5dea83ee8f945203144fb891fdcb978216e45a Mon Sep 17 00:00:00 2001
 From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
-Date: Fri, 8 Nov 2024 01:43:50 +0200
-Subject: [PATCH 4/6] wifi: rtw88: usb: Enable RX aggregation for 8821au/8812au
+Date: Thu, 14 Nov 2024 17:48:09 +0200
+Subject: [PATCH] wifi: rtw88: usb: Enable RX aggregation for 8821au/8812au
 
 USB RX aggregation improves the RX speed on certain ARM systems, like
 the NanoPi NEO Core2. With RTL8811AU, before: 30 Mbps, after: 224 Mbps.
@@ -13,13 +13,15 @@ of 7 RTL8812AU frequently tries to aggregate more frames than will fit
 in 32768 bytes. Use a size of 6 instead.
 
 Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/63012163-a425-4b15-b830-43f279c06b73@gmail.com
 ---
- drivers/net/wireless/realtek/rtw88/usb.c | 30 ++++++++++++++++++++++++
- 1 file changed, 30 insertions(+)
+ drivers/net/wireless/realtek/rtw88/usb.c | 28 ++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
 
 --- a/drivers/net/wireless/realtek/rtw88/usb.c
 +++ b/drivers/net/wireless/realtek/rtw88/usb.c
-@@ -789,6 +789,32 @@ static void rtw_usb_dynamic_rx_agg_v1(st
+@@ -789,6 +789,30 @@ static void rtw_usb_dynamic_rx_agg_v1(st
  	rtw_write16(rtwdev, REG_RXDMA_AGG_PG_TH, val16);
  }
  
@@ -29,7 +31,10 @@ Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
 +	u8 size, timeout;
 +	u16 val16;
 +
-+	if (rtwusb->udev->speed == USB_SPEED_SUPER) {
++	if (!enable) {
++		size = 0x0;
++		timeout = 0x1;
++	} else if (rtwusb->udev->speed == USB_SPEED_SUPER) {
 +		size = 0x6;
 +		timeout = 0x1a;
 +	} else {
@@ -37,11 +42,6 @@ Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
 +		timeout = 0x20;
 +	}
 +
-+	if (!enable) {
-+		size = 0x0;
-+		timeout = 0x1;
-+	}
-+
 +	val16 = u16_encode_bits(size, BIT_RXDMA_AGG_PG_TH) |
 +		u16_encode_bits(timeout, BIT_DMA_AGG_TO_V1);
 +
@@ -52,7 +52,7 @@ Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
  static void rtw_usb_dynamic_rx_agg(struct rtw_dev *rtwdev, bool enable)
  {
  	switch (rtwdev->chip->id) {
-@@ -797,6 +823,10 @@ static void rtw_usb_dynamic_rx_agg(struc
+@@ -797,6 +821,10 @@ static void rtw_usb_dynamic_rx_agg(struc
  	case RTW_CHIP_TYPE_8821C:
  		rtw_usb_dynamic_rx_agg_v1(rtwdev, enable);
  		break;

package/kernel/mac80211/patches/rtl/052-v6.14-wifi-rtw88-add-__packed-attribute-to-efuse-layout-st.patch

@@ -0,0 +1,195 @@
+From 0daa521a1c8c29ffbefe6530f0d276e74e2749d0 Mon Sep 17 00:00:00 2001
+From: Ping-Ke Shih <pkshih@realtek.com>
+Date: Thu, 12 Dec 2024 13:42:03 +0800
+Subject: [PATCH] wifi: rtw88: add __packed attribute to efuse layout struct
+
+The layout struct of efuse should not do address alignment by compiler.
+Otherwise it leads unexpected layout and size for certain arch suc as arm.
+In x86-64, the results are identical before and after this patch.
+
+Also adjust bit-field to prevent over adjacent byte to avoid warning:
+  rtw88/rtw8822b.h:66:1: note: offset of packed bit-field `res2` has changed in GCC 4.4
+   66 | } __packed;
+      | ^
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202412120131.qk0x6OhE-lkp@intel.com/
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20241212054203.135046-1-pkshih@realtek.com
+---
+ drivers/net/wireless/realtek/rtw88/main.h     | 4 ++--
+ drivers/net/wireless/realtek/rtw88/rtw8723x.h | 8 ++++----
+ drivers/net/wireless/realtek/rtw88/rtw8821c.h | 9 +++++----
+ drivers/net/wireless/realtek/rtw88/rtw8822b.h | 9 +++++----
+ drivers/net/wireless/realtek/rtw88/rtw8822c.h | 9 +++++----
+ 5 files changed, 21 insertions(+), 18 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -510,12 +510,12 @@ struct rtw_5g_txpwr_idx {
+ 	struct rtw_5g_vht_ns_pwr_idx_diff vht_2s_diff;
+ 	struct rtw_5g_vht_ns_pwr_idx_diff vht_3s_diff;
+ 	struct rtw_5g_vht_ns_pwr_idx_diff vht_4s_diff;
+-};
++} __packed;
+ 
+ struct rtw_txpwr_idx {
+ 	struct rtw_2g_txpwr_idx pwr_idx_2g;
+ 	struct rtw_5g_txpwr_idx pwr_idx_5g;
+-};
++} __packed;
+ 
+ struct rtw_channel_params {
+ 	u8 center_chan;
+--- a/drivers/net/wireless/realtek/rtw88/rtw8723x.h
++++ b/drivers/net/wireless/realtek/rtw88/rtw8723x.h
+@@ -47,7 +47,7 @@ struct rtw8723xe_efuse {
+ 	u8 device_id[2];
+ 	u8 sub_vendor_id[2];
+ 	u8 sub_device_id[2];
+-};
++} __packed;
+ 
+ struct rtw8723xu_efuse {
+ 	u8 res4[48];                    /* 0xd0 */
+@@ -56,12 +56,12 @@ struct rtw8723xu_efuse {
+ 	u8 usb_option;                  /* 0x104 */
+ 	u8 res5[2];			/* 0x105 */
+ 	u8 mac_addr[ETH_ALEN];          /* 0x107 */
+-};
++} __packed;
+ 
+ struct rtw8723xs_efuse {
+ 	u8 res4[0x4a];			/* 0xd0 */
+ 	u8 mac_addr[ETH_ALEN];		/* 0x11a */
+-};
++} __packed;
+ 
+ struct rtw8723x_efuse {
+ 	__le16 rtl_id;
+@@ -96,7 +96,7 @@ struct rtw8723x_efuse {
+ 		struct rtw8723xu_efuse u;
+ 		struct rtw8723xs_efuse s;
+ 	};
+-};
++} __packed;
+ 
+ #define RTW8723X_IQK_ADDA_REG_NUM	16
+ #define RTW8723X_IQK_MAC8_REG_NUM	3
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821c.h
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821c.h
+@@ -27,7 +27,7 @@ struct rtw8821cu_efuse {
+ 	u8 res11[0xcf];
+ 	u8 package_type;		/* 0x1fb */
+ 	u8 res12[0x4];
+-};
++} __packed;
+ 
+ struct rtw8821ce_efuse {
+ 	u8 mac_addr[ETH_ALEN];		/* 0xd0 */
+@@ -47,7 +47,8 @@ struct rtw8821ce_efuse {
+ 	u8 ltr_en:1;
+ 	u8 res1:2;
+ 	u8 obff:2;
+-	u8 res2:3;
++	u8 res2_1:1;
++	u8 res2_2:2;
+ 	u8 obff_cap:2;
+ 	u8 res3:4;
+ 	u8 res4[3];
+@@ -63,7 +64,7 @@ struct rtw8821ce_efuse {
+ 	u8 res6:1;
+ 	u8 port_t_power_on_value:5;
+ 	u8 res7;
+-};
++} __packed;
+ 
+ struct rtw8821cs_efuse {
+ 	u8 res4[0x4a];			/* 0xd0 */
+@@ -101,7 +102,7 @@ struct rtw8821c_efuse {
+ 		struct rtw8821cu_efuse u;
+ 		struct rtw8821cs_efuse s;
+ 	};
+-};
++} __packed;
+ 
+ static inline void
+ _rtw_write32s_mask(struct rtw_dev *rtwdev, u32 addr, u32 mask, u32 data)
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.h
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.h
+@@ -27,7 +27,7 @@ struct rtw8822bu_efuse {
+ 	u8 res11[0xcf];
+ 	u8 package_type;		/* 0x1fb */
+ 	u8 res12[0x4];
+-};
++} __packed;
+ 
+ struct rtw8822be_efuse {
+ 	u8 mac_addr[ETH_ALEN];		/* 0xd0 */
+@@ -47,7 +47,8 @@ struct rtw8822be_efuse {
+ 	u8 ltr_en:1;
+ 	u8 res1:2;
+ 	u8 obff:2;
+-	u8 res2:3;
++	u8 res2_1:1;
++	u8 res2_2:2;
+ 	u8 obff_cap:2;
+ 	u8 res3:4;
+ 	u8 res4[3];
+@@ -63,7 +64,7 @@ struct rtw8822be_efuse {
+ 	u8 res6:1;
+ 	u8 port_t_power_on_value:5;
+ 	u8 res7;
+-};
++} __packed;
+ 
+ struct rtw8822bs_efuse {
+ 	u8 res4[0x4a];			/* 0xd0 */
+@@ -103,7 +104,7 @@ struct rtw8822b_efuse {
+ 		struct rtw8822bu_efuse u;
+ 		struct rtw8822bs_efuse s;
+ 	};
+-};
++} __packed;
+ 
+ static inline void
+ _rtw_write32s_mask(struct rtw_dev *rtwdev, u32 addr, u32 mask, u32 data)
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822c.h
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.h
+@@ -14,7 +14,7 @@ struct rtw8822cu_efuse {
+ 	u8 res1[3];
+ 	u8 mac_addr[ETH_ALEN];		/* 0x157 */
+ 	u8 res2[0x3d];
+-};
++} __packed;
+ 
+ struct rtw8822cs_efuse {
+ 	u8 res0[0x4a];			/* 0x120 */
+@@ -39,7 +39,8 @@ struct rtw8822ce_efuse {
+ 	u8 ltr_en:1;
+ 	u8 res1:2;
+ 	u8 obff:2;
+-	u8 res2:3;
++	u8 res2_1:1;
++	u8 res2_2:2;
+ 	u8 obff_cap:2;
+ 	u8 res3:4;
+ 	u8 class_code[3];
+@@ -55,7 +56,7 @@ struct rtw8822ce_efuse {
+ 	u8 res6:1;
+ 	u8 port_t_power_on_value:5;
+ 	u8 res7;
+-};
++} __packed;
+ 
+ struct rtw8822c_efuse {
+ 	__le16 rtl_id;
+@@ -102,7 +103,7 @@ struct rtw8822c_efuse {
+ 		struct rtw8822cu_efuse u;
+ 		struct rtw8822cs_efuse s;
+ 	};
+-};
++} __packed;
+ 
+ enum rtw8822c_dpk_agc_phase {
+ 	RTW_DPK_GAIN_CHECK,

package/kernel/mac80211/patches/rtl/053-v6.14-wifi-rtw88-8812a-Support-RFE-type-2.patch

@@ -0,0 +1,28 @@
+From 59ab27a9f20f8de6f7989e8a8c3d97c04ed8199c Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 18 Dec 2024 02:13:22 +0200
+Subject: [PATCH] wifi: rtw88: 8812a: Support RFE type 2
+
+RF front end type 2 exists in the wild and can be treated like types
+0 and 1.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/2917c7fc-6d88-4007-b6a6-9130bd1991e5@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/rtw8812a.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/wireless/realtek/rtw88/rtw8812a.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8812a.c
+@@ -985,6 +985,9 @@ static const struct rtw_rfe_def rtw8812a
+ 	[1] = { .phy_pg_tbl	= &rtw8812a_bb_pg_tbl,
+ 		.txpwr_lmt_tbl	= &rtw8812a_txpwr_lmt_tbl,
+ 		.pwr_track_tbl	= &rtw8812a_rtw_pwr_track_tbl, },
++	[2] = { .phy_pg_tbl	= &rtw8812a_bb_pg_tbl,
++		.txpwr_lmt_tbl	= &rtw8812a_txpwr_lmt_tbl,
++		.pwr_track_tbl	= &rtw8812a_rtw_pwr_track_tbl, },
+ 	[3] = { .phy_pg_tbl	= &rtw8812a_bb_pg_rfe3_tbl,
+ 		.txpwr_lmt_tbl	= &rtw8812a_txpwr_lmt_tbl,
+ 		.pwr_track_tbl	= &rtw8812a_rtw_pwr_track_rfe3_tbl, },

package/kernel/mac80211/patches/rtl/054-v6.14-wifi-rtw88-8821a-8812a-Set-ptct_efuse_size-to-0.patch

@@ -0,0 +1,51 @@
+From 74a72c367573ad521becf6cc4d649e14387b3c64 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 18 Dec 2024 02:16:11 +0200
+Subject: [PATCH] wifi: rtw88: 8821a/8812a: Set ptct_efuse_size to 0
+
+Some RTL8812AU devices fail to probe:
+
+[   12.478774] rtw_8812au 1-1.3:1.0: failed to dump efuse logical map
+[   12.487712] rtw_8812au 1-1.3:1.0: failed to setup chip efuse info
+[   12.487742] rtw_8812au 1-1.3:1.0: failed to setup chip information
+[   12.491077] rtw_8812au: probe of 1-1.3:1.0 failed with error -22
+
+It turns out these chips don't need to "protect" any bytes at the end of
+the efuse.
+
+The original value of 96 was copied from rtw8821c.c.
+
+No one reported any failures with RTL8821AU yet, but the vendor driver
+uses the same efuse reading code for both chips.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/1a477adb-60c3-463c-b158-3f86c94cb821@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/rtw8812a.c | 2 +-
+ drivers/net/wireless/realtek/rtw88/rtw8821a.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/rtw8812a.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8812a.c
+@@ -1027,7 +1027,7 @@ const struct rtw_chip_info rtw8812a_hw_s
+ 	.rx_buf_desc_sz = 8,
+ 	.phy_efuse_size = 512,
+ 	.log_efuse_size = 512,
+-	.ptct_efuse_size = 96 + 1, /* TODO or just 18? */
++	.ptct_efuse_size = 0,
+ 	.txff_size = 131072,
+ 	.rxff_size = 16128,
+ 	.rsvd_drv_pg_num = 9,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821a.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821a.c
+@@ -1118,7 +1118,7 @@ const struct rtw_chip_info rtw8821a_hw_s
+ 	.rx_buf_desc_sz = 8,
+ 	.phy_efuse_size = 512,
+ 	.log_efuse_size = 512,
+-	.ptct_efuse_size = 96 + 1, /* TODO or just 18? */
++	.ptct_efuse_size = 0,
+ 	.txff_size = 65536,
+ 	.rxff_size = 16128,
+ 	.rsvd_drv_pg_num = 8,

package/kernel/mac80211/patches/rtl/055-v6.14-wifi-rtw88-usb-Copy-instead-of-cloning-the-RX-skb.patch

@@ -0,0 +1,130 @@
+From e9048e2935f7d797c2ba047c15b705b57c2fa99a Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Thu, 19 Dec 2024 00:33:20 +0200
+Subject: [PATCH] wifi: rtw88: usb: Copy instead of cloning the RX skb
+
+"iperf3 -c 192.168.0.1 -R --udp -b 0" shows about 40% of datagrams
+are lost. Many torrents don't download faster than 3 MiB/s, probably
+because the Bittorrent protocol uses UDP. This is somehow related to
+the use of skb_clone() in the RX path.
+
+Don't use skb_clone(). Instead allocate a new skb for each 802.11 frame
+received and copy the data from the big (32768 byte) skb.
+
+With this patch, "iperf3 -c 192.168.0.1 -R --udp -b 0" shows only 1-2%
+of datagrams are lost, and torrents can reach download speeds of 36
+MiB/s.
+
+Tested with RTL8812AU and RTL8822CU.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/8c9d4f9d-ebd8-4dc0-a0c4-9ebe430521dd@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/usb.c | 52 ++++++++++++++----------
+ 1 file changed, 31 insertions(+), 21 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/usb.c
++++ b/drivers/net/wireless/realtek/rtw88/usb.c
+@@ -7,6 +7,7 @@
+ #include <linux/mutex.h>
+ #include "main.h"
+ #include "debug.h"
++#include "mac.h"
+ #include "reg.h"
+ #include "tx.h"
+ #include "rx.h"
+@@ -547,49 +548,58 @@ static void rtw_usb_rx_handler(struct wo
+ {
+ 	struct rtw_usb *rtwusb = container_of(work, struct rtw_usb, rx_work);
+ 	struct rtw_dev *rtwdev = rtwusb->rtwdev;
+-	const struct rtw_chip_info *chip = rtwdev->chip;
+-	u32 pkt_desc_sz = chip->rx_pkt_desc_sz;
+ 	struct ieee80211_rx_status rx_status;
+-	u32 pkt_offset, next_pkt, urb_len;
+ 	struct rtw_rx_pkt_stat pkt_stat;
+-	struct sk_buff *next_skb;
++	struct sk_buff *rx_skb;
+ 	struct sk_buff *skb;
++	u32 pkt_desc_sz = rtwdev->chip->rx_pkt_desc_sz;
++	u32 max_skb_len = pkt_desc_sz + PHY_STATUS_SIZE * 8 +
++			  IEEE80211_MAX_MPDU_LEN_VHT_11454;
++	u32 pkt_offset, next_pkt, skb_len;
+ 	u8 *rx_desc;
+ 	int limit;
+ 
+ 	for (limit = 0; limit < 200; limit++) {
+-		skb = skb_dequeue(&rtwusb->rx_queue);
+-		if (!skb)
++		rx_skb = skb_dequeue(&rtwusb->rx_queue);
++		if (!rx_skb)
+ 			break;
+ 
+ 		if (skb_queue_len(&rtwusb->rx_queue) >= RTW_USB_MAX_RXQ_LEN) {
+ 			dev_dbg_ratelimited(rtwdev->dev, "failed to get rx_queue, overflow\n");
+-			dev_kfree_skb_any(skb);
++			dev_kfree_skb_any(rx_skb);
+ 			continue;
+ 		}
+ 
+-		urb_len = skb->len;
++		rx_desc = rx_skb->data;
+ 
+ 		do {
+-			rx_desc = skb->data;
+ 			rtw_rx_query_rx_desc(rtwdev, rx_desc, &pkt_stat,
+ 					     &rx_status);
+ 			pkt_offset = pkt_desc_sz + pkt_stat.drv_info_sz +
+ 				     pkt_stat.shift;
+ 
+-			next_pkt = round_up(pkt_stat.pkt_len + pkt_offset, 8);
++			skb_len = pkt_stat.pkt_len + pkt_offset;
++			if (skb_len > max_skb_len) {
++				rtw_dbg(rtwdev, RTW_DBG_USB,
++					"skipping too big packet: %u\n",
++					skb_len);
++				goto skip_packet;
++			}
++
++			skb = alloc_skb(skb_len, GFP_KERNEL);
++			if (!skb) {
++				rtw_dbg(rtwdev, RTW_DBG_USB,
++					"failed to allocate RX skb of size %u\n",
++					skb_len);
++				goto skip_packet;
++			}
+ 
+-			if (urb_len >= next_pkt + pkt_desc_sz)
+-				next_skb = skb_clone(skb, GFP_KERNEL);
+-			else
+-				next_skb = NULL;
++			skb_put_data(skb, rx_desc, skb_len);
+ 
+ 			if (pkt_stat.is_c2h) {
+-				skb_trim(skb, pkt_stat.pkt_len + pkt_offset);
+ 				rtw_fw_c2h_cmd_rx_irqsafe(rtwdev, pkt_offset, skb);
+ 			} else {
+ 				skb_pull(skb, pkt_offset);
+-				skb_trim(skb, pkt_stat.pkt_len);
+ 				rtw_update_rx_freq_for_invalid(rtwdev, skb,
+ 							       &rx_status,
+ 							       &pkt_stat);
+@@ -598,12 +608,12 @@ static void rtw_usb_rx_handler(struct wo
+ 				ieee80211_rx_irqsafe(rtwdev->hw, skb);
+ 			}
+ 
+-			skb = next_skb;
+-			if (skb)
+-				skb_pull(skb, next_pkt);
++skip_packet:
++			next_pkt = round_up(skb_len, 8);
++			rx_desc += next_pkt;
++		} while (rx_desc + pkt_desc_sz < rx_skb->data + rx_skb->len);
+ 
+-			urb_len -= next_pkt;
+-		} while (skb);
++		dev_kfree_skb_any(rx_skb);
+ 	}
+ }
+ 

package/kernel/mac80211/patches/rtl/058-v6.14-wifi-rtw88-Add-USB-PHY-configuration.patch

@@ -0,0 +1,141 @@
+From 5b1b9545262b5126a3c2776e7e64ff29765cbe6e Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 1 Jan 2025 18:16:32 +0200
+Subject: [PATCH] wifi: rtw88: Add USB PHY configuration
+
+Add some extra configuration for USB devices. Currently only RTL8822BU
+version (cut) D needs this. The new code makes use of the existing
+usb3_param_8822b array from rtw8822b.c.
+
+A user reported that TP-Link Archer T3U in USB 3 mode was randomly
+disconnecting from USB:
+
+[ 26.036502] usb 2-2: new SuperSpeed USB device number 3 using xhci_hcd
+...
+[ 27.576491] usb 2-2: USB disconnect, device number 3
+[ 28.621528] usb 2-2: new SuperSpeed USB device number 4 using xhci_hcd
+...
+[ 45.984521] usb 2-2: USB disconnect, device number 4
+...
+[ 46.845585] usb 2-2: new SuperSpeed USB device number 5 using xhci_hcd
+...
+[ 94.400380] usb 2-2: USB disconnect, device number 5
+...
+[ 95.590421] usb 2-2: new SuperSpeed USB device number 6 using xhci_hcd
+
+This patch fixes that.
+
+Link: https://github.com/lwfinger/rtw88/issues/262
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/9d312b14-0146-4be8-9c50-ef432234db50@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/reg.h | 10 ++++
+ drivers/net/wireless/realtek/rtw88/usb.c | 68 ++++++++++++++++++++++++
+ 2 files changed, 78 insertions(+)
+
+--- a/drivers/net/wireless/realtek/rtw88/reg.h
++++ b/drivers/net/wireless/realtek/rtw88/reg.h
+@@ -871,7 +871,17 @@
+ 
+ #define REG_USB_MOD	0xf008
+ #define REG_USB3_RXITV	0xf050
++#define REG_USB2_PHY_ADR	0xfe40
++#define REG_USB2_PHY_DAT	0xfe41
++#define REG_USB2_PHY_CMD	0xfe42
++#define BIT_USB2_PHY_CMD_TRG	0x81
+ #define REG_USB_HRPWM	0xfe58
++#define REG_USB3_PHY_ADR	0xff0c
++#define REG_USB3_PHY_DAT_L	0xff0d
++#define REG_USB3_PHY_DAT_H	0xff0e
++#define BIT_USB3_PHY_ADR_WR	BIT(7)
++#define BIT_USB3_PHY_ADR_RD	BIT(6)
++#define BIT_USB3_PHY_ADR_MASK	GENMASK(5, 0)
+ 
+ #define RF_MODE		0x00
+ #define RF_MODOPT	0x01
+--- a/drivers/net/wireless/realtek/rtw88/usb.c
++++ b/drivers/net/wireless/realtek/rtw88/usb.c
+@@ -1079,6 +1079,71 @@ static int rtw_usb_switch_mode(struct rt
+ 		return rtw_usb_switch_mode_new(rtwdev);
+ }
+ 
++#define USB_REG_PAGE	0xf4
++#define USB_PHY_PAGE0	0x9b
++#define USB_PHY_PAGE1	0xbb
++
++static void rtw_usb_phy_write(struct rtw_dev *rtwdev, u8 addr, u16 data,
++			      enum usb_device_speed speed)
++{
++	if (speed == USB_SPEED_SUPER) {
++		rtw_write8(rtwdev, REG_USB3_PHY_DAT_L, data & 0xff);
++		rtw_write8(rtwdev, REG_USB3_PHY_DAT_H, data >> 8);
++		rtw_write8(rtwdev, REG_USB3_PHY_ADR, addr | BIT_USB3_PHY_ADR_WR);
++	} else if (speed == USB_SPEED_HIGH) {
++		rtw_write8(rtwdev, REG_USB2_PHY_DAT, data);
++		rtw_write8(rtwdev, REG_USB2_PHY_ADR, addr);
++		rtw_write8(rtwdev, REG_USB2_PHY_CMD, BIT_USB2_PHY_CMD_TRG);
++	}
++}
++
++static void rtw_usb_page_switch(struct rtw_dev *rtwdev,
++				enum usb_device_speed speed, u8 page)
++{
++	if (speed == USB_SPEED_SUPER)
++		return;
++
++	rtw_usb_phy_write(rtwdev, USB_REG_PAGE, page, speed);
++}
++
++static void rtw_usb_phy_cfg(struct rtw_dev *rtwdev,
++			    enum usb_device_speed speed)
++{
++	const struct rtw_intf_phy_para *para = NULL;
++	u16 offset;
++
++	if (!rtwdev->chip->intf_table)
++		return;
++
++	if (speed == USB_SPEED_SUPER)
++		para = rtwdev->chip->intf_table->usb3_para;
++	else if (speed == USB_SPEED_HIGH)
++		para = rtwdev->chip->intf_table->usb2_para;
++
++	if (!para)
++		return;
++
++	for ( ; para->offset != 0xffff; para++) {
++		if (!(para->cut_mask & BIT(rtwdev->hal.cut_version)))
++			continue;
++
++		offset = para->offset;
++
++		if (para->ip_sel == RTW_IP_SEL_MAC) {
++			rtw_write8(rtwdev, offset, para->value);
++		} else {
++			if (offset > 0x100)
++				rtw_usb_page_switch(rtwdev, speed, USB_PHY_PAGE1);
++			else
++				rtw_usb_page_switch(rtwdev, speed, USB_PHY_PAGE0);
++
++			offset &= 0xff;
++
++			rtw_usb_phy_write(rtwdev, offset, para->value, speed);
++		}
++	}
++}
++
+ int rtw_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
+ {
+ 	struct rtw_dev *rtwdev;
+@@ -1134,6 +1199,9 @@ int rtw_usb_probe(struct usb_interface *
+ 		goto err_destroy_rxwq;
+ 	}
+ 
++	rtw_usb_phy_cfg(rtwdev, USB_SPEED_HIGH);
++	rtw_usb_phy_cfg(rtwdev, USB_SPEED_SUPER);
++
+ 	ret = rtw_usb_switch_mode(rtwdev);
+ 	if (ret) {
+ 		/* Not a fail, but we do need to skip rtw_register_hw. */

package/kernel/mac80211/patches/rtl/059-v6.14-wifi-rtw88-Delete-rf_type-member-of-struct-rtw_sta_i.patch

@@ -0,0 +1,60 @@
+From 5ad483955acc85dc91b88c7b76dc1429e8ba33bc Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 1 Jan 2025 18:27:35 +0200
+Subject: [PATCH] wifi: rtw88: Delete rf_type member of struct rtw_sta_info
+
+It's not used for anything.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/b80f7904-c6b4-4d12-a5f9-69ab9b965732@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/main.c | 9 ++-------
+ drivers/net/wireless/realtek/rtw88/main.h | 1 -
+ 2 files changed, 2 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -1217,7 +1217,6 @@ void rtw_update_sta_info(struct rtw_dev
+ 	u8 wireless_set;
+ 	u8 bw_mode;
+ 	u8 rate_id;
+-	u8 rf_type = RF_1T1R;
+ 	u8 stbc_en = 0;
+ 	u8 ldpc_en = 0;
+ 	u8 tx_num = 1;
+@@ -1302,13 +1301,10 @@ void rtw_update_sta_info(struct rtw_dev
+ 		break;
+ 	}
+ 
+-	if (sta->deflink.vht_cap.vht_supported && ra_mask & 0xffc00000) {
++	if (sta->deflink.vht_cap.vht_supported && ra_mask & 0xffc00000)
+ 		tx_num = 2;
+-		rf_type = RF_2T2R;
+-	} else if (sta->deflink.ht_cap.ht_supported && ra_mask & 0xfff00000) {
++	else if (sta->deflink.ht_cap.ht_supported && ra_mask & 0xfff00000)
+ 		tx_num = 2;
+-		rf_type = RF_2T2R;
+-	}
+ 
+ 	rate_id = get_rate_id(wireless_set, bw_mode, tx_num);
+ 
+@@ -1319,7 +1315,6 @@ void rtw_update_sta_info(struct rtw_dev
+ 	si->bw_mode = bw_mode;
+ 	si->stbc_en = stbc_en;
+ 	si->ldpc_en = ldpc_en;
+-	si->rf_type = rf_type;
+ 	si->sgi_enable = is_support_sgi;
+ 	si->vht_enable = is_vht_enable;
+ 	si->ra_mask = ra_mask;
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -757,7 +757,6 @@ struct rtw_sta_info {
+ 	u8 mac_id;
+ 	u8 rate_id;
+ 	enum rtw_bandwidth bw_mode;
+-	enum rtw_rf_type rf_type;
+ 	u8 stbc_en:2;
+ 	u8 ldpc_en:2;
+ 	bool sgi_enable;

package/kernel/mac80211/patches/rtl/060-v6.14-wifi-rtw88-8703b-Fix-RX-TX-issues.patch

@@ -0,0 +1,59 @@
+From a806a8160a0fcaff368bb510c8a52eff37faf727 Mon Sep 17 00:00:00 2001
+From: Vasily Khoruzhick <anarsoul@gmail.com>
+Date: Thu, 2 Jan 2025 23:50:53 -0800
+Subject: [PATCH] wifi: rtw88: 8703b: Fix RX/TX issues
+
+Fix 3 typos in 8703b driver. 2 typos in calibration routines are not
+fatal and do not seem to have any impact, just fix them to match vendor
+driver.
+
+However the last one in rtw8703b_set_channel_bb() clears too many bits
+in REG_OFDM0_TX_PSD_NOISE, causing TX and RX issues (neither rate goes
+above MCS0-MCS1). Vendor driver clears only 2 most significant bits.
+
+With the last typo fixed, the driver is able to reach MCS7 on Pinebook
+
+Cc: stable@vger.kernel.org
+Fixes: 9bb762b3a957 ("wifi: rtw88: Add definitions for 8703b chip")
+Signed-off-by: Vasily Khoruzhick <anarsoul@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Tested-by: Fiona Klute <fiona.klute@gmx.de>
+Tested-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250103075107.1337533-1-anarsoul@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/rtw8703b.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/rtw8703b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8703b.c
+@@ -903,7 +903,7 @@ static void rtw8703b_set_channel_bb(stru
+ 		rtw_write32_mask(rtwdev, REG_FPGA0_RFMOD, BIT_MASK_RFMOD, 0x0);
+ 		rtw_write32_mask(rtwdev, REG_FPGA1_RFMOD, BIT_MASK_RFMOD, 0x0);
+ 		rtw_write32_mask(rtwdev, REG_OFDM0_TX_PSD_NOISE,
+-				 GENMASK(31, 20), 0x0);
++				 GENMASK(31, 30), 0x0);
+ 		rtw_write32(rtwdev, REG_BBRX_DFIR, 0x4A880000);
+ 		rtw_write32(rtwdev, REG_OFDM0_A_TX_AFE, 0x19F60000);
+ 		break;
+@@ -1198,9 +1198,9 @@ static u8 rtw8703b_iqk_rx_path(struct rt
+ 	rtw_write32(rtwdev, REG_RXIQK_TONE_A_11N, 0x38008c1c);
+ 	rtw_write32(rtwdev, REG_TX_IQK_TONE_B, 0x38008c1c);
+ 	rtw_write32(rtwdev, REG_RX_IQK_TONE_B, 0x38008c1c);
+-	rtw_write32(rtwdev, REG_TXIQK_PI_A_11N, 0x8216000f);
++	rtw_write32(rtwdev, REG_TXIQK_PI_A_11N, 0x8214030f);
+ 	rtw_write32(rtwdev, REG_RXIQK_PI_A_11N, 0x28110000);
+-	rtw_write32(rtwdev, REG_TXIQK_PI_B, 0x28110000);
++	rtw_write32(rtwdev, REG_TXIQK_PI_B, 0x82110000);
+ 	rtw_write32(rtwdev, REG_RXIQK_PI_B, 0x28110000);
+ 
+ 	/* LOK setting */
+@@ -1372,7 +1372,7 @@ void rtw8703b_iqk_fill_a_matrix(struct r
+ 		return;
+ 
+ 	tmp_rx_iqi |= FIELD_PREP(BIT_MASK_RXIQ_S1_X, result[IQK_S1_RX_X]);
+-	tmp_rx_iqi |= FIELD_PREP(BIT_MASK_RXIQ_S1_Y1, result[IQK_S1_RX_X]);
++	tmp_rx_iqi |= FIELD_PREP(BIT_MASK_RXIQ_S1_Y1, result[IQK_S1_RX_Y]);
+ 	rtw_write32(rtwdev, REG_A_RXIQI, tmp_rx_iqi);
+ 	rtw_write32_mask(rtwdev, REG_RXIQK_MATRIX_LSB_11N, BIT_MASK_RXIQ_S1_Y2,
+ 			 BIT_SET_RXIQ_S1_Y2(result[IQK_S1_RX_Y]));

package/kernel/mac80211/patches/rtl/061-v6.14-wifi-rtw88-sdio-Fix-disconnection-after-beacon-loss.patch

@@ -0,0 +1,31 @@
+From fb2fcfbe5eef9ae26b0425978435ae1308951e51 Mon Sep 17 00:00:00 2001
+From: Fiona Klute <fiona.klute@gmx.de>
+Date: Mon, 6 Jan 2025 15:54:34 +0200
+Subject: [PATCH] wifi: rtw88: sdio: Fix disconnection after beacon loss
+
+This is the equivalent of commit 28818b4d871b ("wifi: rtw88: usb: Fix
+disconnection after beacon loss") for SDIO chips.
+Tested on Pinephone (RTL8723CS), random disconnections became rare,
+instead of a frequent nuisance.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
+Tested-by: Vasily Khoruzhick <anarsoul@gmail.com> # Tested on Pinebook
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250106135434.35936-1-fiona.klute@gmx.de
+---
+ drivers/net/wireless/realtek/rtw88/sdio.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/realtek/rtw88/sdio.c
++++ b/drivers/net/wireless/realtek/rtw88/sdio.c
+@@ -1192,6 +1192,8 @@ static void rtw_sdio_indicate_tx_status(
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 	struct ieee80211_hw *hw = rtwdev->hw;
+ 
++	skb_pull(skb, rtwdev->chip->tx_pkt_desc_sz);
++
+ 	/* enqueue to wait for tx report */
+ 	if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS) {
+ 		rtw_tx_report_enqueue(rtwdev, skb, tx_data->sn);

package/kernel/mac80211/patches/rtl/062-v6.14-wifi-rtw88-Add-support-for-LED-blinking.patch

@@ -0,0 +1,424 @@
+From 4b6652bc6d8d5fb0648b3a7a16ef8af4e0345bcd Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 8 Jan 2025 13:41:23 +0200
+Subject: [PATCH] wifi: rtw88: Add support for LED blinking
+
+Register a struct led_classdev with the kernel's LED subsystem and
+create a throughput-based trigger for it. Then mac80211 makes the LED
+blink.
+
+Tested with Tenda U12 (RTL8812AU), Tenda U9 (RTL8811CU), TP-Link Archer
+T2U Nano (RTL8811AU), TP-Link Archer T3U Plus (RTL8812BU), Edimax
+EW-7611UCB (RTL8821AU), LM842 (RTL8822CU).
+
+Also tested with devices which don't have LEDs: the laptop's internal
+RTL8822CE and a no-name RTL8723DU.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/6c43451f-ab2f-4e76-ac6e-ff5a18dd981d@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/Makefile   |  2 +
+ drivers/net/wireless/realtek/rtw88/led.c      | 73 +++++++++++++++++++
+ drivers/net/wireless/realtek/rtw88/led.h      | 25 +++++++
+ drivers/net/wireless/realtek/rtw88/main.c     | 12 ++-
+ drivers/net/wireless/realtek/rtw88/main.h     |  5 ++
+ drivers/net/wireless/realtek/rtw88/reg.h      | 12 +++
+ drivers/net/wireless/realtek/rtw88/rtw8812a.c | 17 +++++
+ drivers/net/wireless/realtek/rtw88/rtw8821a.c | 26 +++++++
+ drivers/net/wireless/realtek/rtw88/rtw8821c.c | 19 +++++
+ drivers/net/wireless/realtek/rtw88/rtw8822b.c | 19 +++++
+ drivers/net/wireless/realtek/rtw88/rtw8822c.c | 19 +++++
+ 11 files changed, 227 insertions(+), 2 deletions(-)
+ create mode 100644 drivers/net/wireless/realtek/rtw88/led.c
+ create mode 100644 drivers/net/wireless/realtek/rtw88/led.h
+
+--- a/drivers/net/wireless/realtek/rtw88/Makefile
++++ b/drivers/net/wireless/realtek/rtw88/Makefile
+@@ -20,6 +20,8 @@ rtw88_core-y += main.o \
+ 
+ rtw88_core-$(CONFIG_PM) += wow.o
+ 
++rtw88_core-$(CONFIG_LEDS_CLASS) += led.o
++
+ obj-$(CPTCFG_RTW88_8822B)	+= rtw88_8822b.o
+ rtw88_8822b-objs		:= rtw8822b.o rtw8822b_table.o
+ 
+--- /dev/null
++++ b/drivers/net/wireless/realtek/rtw88/led.c
+@@ -0,0 +1,73 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
++/* Copyright(c) 2025  Realtek Corporation
++ */
++
++#include "main.h"
++#include "debug.h"
++#include "led.h"
++
++static int rtw_led_set_blocking(struct led_classdev *led,
++				enum led_brightness brightness)
++{
++	struct rtw_dev *rtwdev = container_of(led, struct rtw_dev, led_cdev);
++
++	rtwdev->chip->ops->led_set(led, brightness);
++
++	return 0;
++}
++
++void rtw_led_init(struct rtw_dev *rtwdev)
++{
++	static const struct ieee80211_tpt_blink rtw_tpt_blink[] = {
++		{ .throughput = 0 * 1024, .blink_time = 334 },
++		{ .throughput = 1 * 1024, .blink_time = 260 },
++		{ .throughput = 5 * 1024, .blink_time = 220 },
++		{ .throughput = 10 * 1024, .blink_time = 190 },
++		{ .throughput = 20 * 1024, .blink_time = 170 },
++		{ .throughput = 50 * 1024, .blink_time = 150 },
++		{ .throughput = 70 * 1024, .blink_time = 130 },
++		{ .throughput = 100 * 1024, .blink_time = 110 },
++		{ .throughput = 200 * 1024, .blink_time = 80 },
++		{ .throughput = 300 * 1024, .blink_time = 50 },
++	};
++	struct led_classdev *led = &rtwdev->led_cdev;
++	int err;
++
++	if (!rtwdev->chip->ops->led_set)
++		return;
++
++	if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_PCIE)
++		led->brightness_set = rtwdev->chip->ops->led_set;
++	else
++		led->brightness_set_blocking = rtw_led_set_blocking;
++
++	snprintf(rtwdev->led_name, sizeof(rtwdev->led_name),
++		 "rtw88-%s", dev_name(rtwdev->dev));
++
++	led->name = rtwdev->led_name;
++	led->max_brightness = LED_ON;
++	led->default_trigger =
++		ieee80211_create_tpt_led_trigger(rtwdev->hw,
++						 IEEE80211_TPT_LEDTRIG_FL_RADIO,
++						 rtw_tpt_blink,
++						 ARRAY_SIZE(rtw_tpt_blink));
++
++	err = led_classdev_register(rtwdev->dev, led);
++	if (err) {
++		rtw_warn(rtwdev, "Failed to register the LED, error %d\n", err);
++		return;
++	}
++
++	rtwdev->led_registered = true;
++}
++
++void rtw_led_deinit(struct rtw_dev *rtwdev)
++{
++	struct led_classdev *led = &rtwdev->led_cdev;
++
++	if (!rtwdev->led_registered)
++		return;
++
++	rtwdev->chip->ops->led_set(led, LED_OFF);
++	led_classdev_unregister(led);
++}
+--- /dev/null
++++ b/drivers/net/wireless/realtek/rtw88/led.h
+@@ -0,0 +1,25 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */
++/* Copyright(c) 2025  Realtek Corporation
++ */
++
++#ifndef __RTW_LED_H
++#define __RTW_LED_H
++
++#ifdef CONFIG_LEDS_CLASS
++
++void rtw_led_init(struct rtw_dev *rtwdev);
++void rtw_led_deinit(struct rtw_dev *rtwdev);
++
++#else
++
++static inline void rtw_led_init(struct rtw_dev *rtwdev)
++{
++}
++
++static inline void rtw_led_deinit(struct rtw_dev *rtwdev)
++{
++}
++
++#endif
++
++#endif
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -19,6 +19,7 @@
+ #include "bf.h"
+ #include "sar.h"
+ #include "sdio.h"
++#include "led.h"
+ 
+ bool rtw_disable_lps_deep_mode;
+ EXPORT_SYMBOL(rtw_disable_lps_deep_mode);
+@@ -2292,16 +2293,18 @@ int rtw_register_hw(struct rtw_dev *rtwd
+ 		return ret;
+ 	}
+ 
++	rtw_led_init(rtwdev);
++
+ 	ret = ieee80211_register_hw(hw);
+ 	if (ret) {
+ 		rtw_err(rtwdev, "failed to register hw\n");
+-		return ret;
++		goto led_deinit;
+ 	}
+ 
+ 	ret = rtw_regd_hint(rtwdev);
+ 	if (ret) {
+ 		rtw_err(rtwdev, "failed to hint regd\n");
+-		return ret;
++		goto led_deinit;
+ 	}
+ 
+ 	rtw_debugfs_init(rtwdev);
+@@ -2310,6 +2313,10 @@ int rtw_register_hw(struct rtw_dev *rtwd
+ 	rtwdev->bf_info.bfer_su_cnt = 0;
+ 
+ 	return 0;
++
++led_deinit:
++	rtw_led_deinit(rtwdev);
++	return ret;
+ }
+ EXPORT_SYMBOL(rtw_register_hw);
+ 
+@@ -2320,6 +2327,7 @@ void rtw_unregister_hw(struct rtw_dev *r
+ 	ieee80211_unregister_hw(hw);
+ 	rtw_unset_supported_band(hw, chip);
+ 	rtw_debugfs_deinit(rtwdev);
++	rtw_led_deinit(rtwdev);
+ }
+ EXPORT_SYMBOL(rtw_unregister_hw);
+ 
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -887,6 +887,7 @@ struct rtw_chip_ops {
+ 			       bool is_tx2_path);
+ 	void (*config_txrx_mode)(struct rtw_dev *rtwdev, u8 tx_path,
+ 				 u8 rx_path, bool is_tx2_path);
++	void (*led_set)(struct led_classdev *led, enum led_brightness brightness);
+ 	/* for USB/SDIO only */
+ 	void (*fill_txdesc_checksum)(struct rtw_dev *rtwdev,
+ 				     struct rtw_tx_pkt_info *pkt_info,
+@@ -2097,6 +2098,10 @@ struct rtw_dev {
+ 	struct completion fw_scan_density;
+ 	bool ap_active;
+ 
++	bool led_registered;
++	char led_name[32];
++	struct led_classdev led_cdev;
++
+ 	/* hci related data, must be last */
+ 	u8 priv[] __aligned(sizeof(void *));
+ };
+--- a/drivers/net/wireless/realtek/rtw88/reg.h
++++ b/drivers/net/wireless/realtek/rtw88/reg.h
+@@ -78,7 +78,19 @@
+ #define BIT_PAPE_SEL_EN		BIT(25)
+ #define BIT_DPDT_WL_SEL		BIT(24)
+ #define BIT_DPDT_SEL_EN		BIT(23)
++#define BIT_GPIO13_14_WL_CTRL_EN	BIT(22)
++#define BIT_LED2_SV		BIT(19)
++#define BIT_LED2_CM		GENMASK(18, 16)
++#define BIT_LED1_SV		BIT(11)
++#define BIT_LED1_CM		GENMASK(10, 8)
++#define BIT_LED0_SV		BIT(3)
++#define BIT_LED0_CM		GENMASK(2, 0)
++#define BIT_LED_MODE_SW_CTRL	0
++#define BIT_LED_MODE_RX		6
++#define BIT_LED_MODE_TX		4
++#define BIT_LED_MODE_TRX	2
+ #define REG_LEDCFG2		0x004E
++#define REG_GPIO_PIN_CTRL_2	0x0060
+ #define REG_PAD_CTRL1		0x0064
+ #define BIT_BT_BTG_SEL		BIT(31)
+ #define BIT_PAPE_WLBT_SEL	BIT(29)
+--- a/drivers/net/wireless/realtek/rtw88/rtw8812a.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8812a.c
+@@ -868,6 +868,22 @@ static void rtw8812a_pwr_track(struct rt
+ 	dm_info->pwr_trk_triggered = false;
+ }
+ 
++static void rtw8812a_led_set(struct led_classdev *led,
++			     enum led_brightness brightness)
++{
++	struct rtw_dev *rtwdev = container_of(led, struct rtw_dev, led_cdev);
++	u8 ledcfg;
++
++	ledcfg = rtw_read8(rtwdev, REG_LED_CFG);
++	ledcfg &= BIT(6) | BIT(4);
++	ledcfg |= BIT(5);
++
++	if (brightness == LED_OFF)
++		ledcfg |= BIT(3);
++
++	rtw_write8(rtwdev, REG_LED_CFG, ledcfg);
++}
++
+ static void rtw8812a_fill_txdesc_checksum(struct rtw_dev *rtwdev,
+ 					  struct rtw_tx_pkt_info *pkt_info,
+ 					  u8 *txdesc)
+@@ -916,6 +932,7 @@ static const struct rtw_chip_ops rtw8812
+ 	.config_bfee		= NULL,
+ 	.set_gid_table		= NULL,
+ 	.cfg_csi_rate		= NULL,
++	.led_set		= rtw8812a_led_set,
+ 	.fill_txdesc_checksum	= rtw8812a_fill_txdesc_checksum,
+ 	.coex_set_init		= rtw8812a_coex_cfg_init,
+ 	.coex_set_ant_switch	= NULL,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821a.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821a.c
+@@ -706,6 +706,31 @@ static void rtw8821a_pwr_track(struct rt
+ 	dm_info->pwr_trk_triggered = false;
+ }
+ 
++static void rtw8821a_led_set(struct led_classdev *led,
++			     enum led_brightness brightness)
++{
++	struct rtw_dev *rtwdev = container_of(led, struct rtw_dev, led_cdev);
++	u32 gpio8_cfg;
++	u8 ledcfg;
++
++	if (brightness == LED_OFF) {
++		gpio8_cfg = rtw_read32(rtwdev, REG_GPIO_PIN_CTRL_2);
++		gpio8_cfg &= ~BIT(24);
++		gpio8_cfg |= BIT(16) | BIT(8);
++		rtw_write32(rtwdev, REG_GPIO_PIN_CTRL_2, gpio8_cfg);
++	} else {
++		ledcfg = rtw_read8(rtwdev, REG_LED_CFG + 2);
++		gpio8_cfg = rtw_read32(rtwdev, REG_GPIO_PIN_CTRL_2);
++
++		ledcfg &= BIT(7) | BIT(6);
++		rtw_write8(rtwdev, REG_LED_CFG + 2, ledcfg);
++
++		gpio8_cfg &= ~(BIT(24) | BIT(8));
++		gpio8_cfg |= BIT(16);
++		rtw_write32(rtwdev, REG_GPIO_PIN_CTRL_2, gpio8_cfg);
++	}
++}
++
+ static void rtw8821a_fill_txdesc_checksum(struct rtw_dev *rtwdev,
+ 					  struct rtw_tx_pkt_info *pkt_info,
+ 					  u8 *txdesc)
+@@ -853,6 +878,7 @@ static const struct rtw_chip_ops rtw8821
+ 	.config_bfee		= NULL,
+ 	.set_gid_table		= NULL,
+ 	.cfg_csi_rate		= NULL,
++	.led_set		= rtw8821a_led_set,
+ 	.fill_txdesc_checksum	= rtw8821a_fill_txdesc_checksum,
+ 	.coex_set_init		= rtw8821a_coex_cfg_init,
+ 	.coex_set_ant_switch	= rtw8821a_coex_cfg_ant_switch,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821c.c
+@@ -1206,6 +1206,24 @@ static void rtw8821c_phy_cck_pd_set(stru
+ 			 dm_info->cck_pd_default + new_lvl * 2);
+ }
+ 
++static void rtw8821c_led_set(struct led_classdev *led,
++			     enum led_brightness brightness)
++{
++	struct rtw_dev *rtwdev = container_of(led, struct rtw_dev, led_cdev);
++	u32 ledcfg;
++
++	ledcfg = rtw_read32(rtwdev, REG_LED_CFG);
++	u32p_replace_bits(&ledcfg, BIT_LED_MODE_SW_CTRL, BIT_LED2_CM);
++	ledcfg &= ~BIT_GPIO13_14_WL_CTRL_EN;
++
++	if (brightness == LED_OFF)
++		ledcfg |= BIT_LED2_SV;
++	else
++		ledcfg &= ~BIT_LED2_SV;
++
++	rtw_write32(rtwdev, REG_LED_CFG, ledcfg);
++}
++
+ static void rtw8821c_fill_txdesc_checksum(struct rtw_dev *rtwdev,
+ 					  struct rtw_tx_pkt_info *pkt_info,
+ 					  u8 *txdesc)
+@@ -1655,6 +1673,7 @@ static const struct rtw_chip_ops rtw8821
+ 	.config_bfee		= rtw8821c_bf_config_bfee,
+ 	.set_gid_table		= rtw_bf_set_gid_table,
+ 	.cfg_csi_rate		= rtw_bf_cfg_csi_rate,
++	.led_set		= rtw8821c_led_set,
+ 	.fill_txdesc_checksum	= rtw8821c_fill_txdesc_checksum,
+ 
+ 	.coex_set_init		= rtw8821c_coex_cfg_init,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
+@@ -1566,6 +1566,24 @@ static void rtw8822b_adaptivity(struct r
+ 	rtw_phy_set_edcca_th(rtwdev, l2h, h2l);
+ }
+ 
++static void rtw8822b_led_set(struct led_classdev *led,
++			     enum led_brightness brightness)
++{
++	struct rtw_dev *rtwdev = container_of(led, struct rtw_dev, led_cdev);
++	u32 ledcfg;
++
++	ledcfg = rtw_read32(rtwdev, REG_LED_CFG);
++	u32p_replace_bits(&ledcfg, BIT_LED_MODE_SW_CTRL, BIT_LED2_CM);
++	ledcfg &= ~BIT_GPIO13_14_WL_CTRL_EN;
++
++	if (brightness == LED_OFF)
++		ledcfg |= BIT_LED2_SV;
++	else
++		ledcfg &= ~BIT_LED2_SV;
++
++	rtw_write32(rtwdev, REG_LED_CFG, ledcfg);
++}
++
+ static void rtw8822b_fill_txdesc_checksum(struct rtw_dev *rtwdev,
+ 					  struct rtw_tx_pkt_info *pkt_info,
+ 					  u8 *txdesc)
+@@ -2146,6 +2164,7 @@ static const struct rtw_chip_ops rtw8822
+ 	.cfg_csi_rate		= rtw_bf_cfg_csi_rate,
+ 	.adaptivity_init	= rtw8822b_adaptivity_init,
+ 	.adaptivity		= rtw8822b_adaptivity,
++	.led_set		= rtw8822b_led_set,
+ 	.fill_txdesc_checksum	= rtw8822b_fill_txdesc_checksum,
+ 
+ 	.coex_set_init		= rtw8822b_coex_cfg_init,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
+@@ -4537,6 +4537,24 @@ static void rtw8822c_adaptivity(struct r
+ 	rtw_phy_set_edcca_th(rtwdev, l2h, h2l);
+ }
+ 
++static void rtw8822c_led_set(struct led_classdev *led,
++			     enum led_brightness brightness)
++{
++	struct rtw_dev *rtwdev = container_of(led, struct rtw_dev, led_cdev);
++	u32 ledcfg;
++
++	ledcfg = rtw_read32(rtwdev, REG_LED_CFG);
++	u32p_replace_bits(&ledcfg, BIT_LED_MODE_SW_CTRL, BIT_LED2_CM);
++	ledcfg &= ~BIT_GPIO13_14_WL_CTRL_EN;
++
++	if (brightness == LED_OFF)
++		ledcfg |= BIT_LED2_SV;
++	else
++		ledcfg &= ~BIT_LED2_SV;
++
++	rtw_write32(rtwdev, REG_LED_CFG, ledcfg);
++}
++
+ static void rtw8822c_fill_txdesc_checksum(struct rtw_dev *rtwdev,
+ 					  struct rtw_tx_pkt_info *pkt_info,
+ 					  u8 *txdesc)
+@@ -4964,6 +4982,7 @@ static const struct rtw_chip_ops rtw8822
+ 	.cfo_track		= rtw8822c_cfo_track,
+ 	.config_tx_path		= rtw8822c_config_tx_path,
+ 	.config_txrx_mode	= rtw8822c_config_trx_mode,
++	.led_set		= rtw8822c_led_set,
+ 	.fill_txdesc_checksum	= rtw8822c_fill_txdesc_checksum,
+ 
+ 	.coex_set_init		= rtw8822c_coex_cfg_init,

package/kernel/mac80211/patches/rtl/063-v6.14-wifi-rtw88-add-RTW88_LEDS-depends-on-LEDS_CLASS-to-K.patch

@@ -0,0 +1,73 @@
+From b4bfbc50b1b92a0815800eb1231f73bfc917af03 Mon Sep 17 00:00:00 2001
+From: Ping-Ke Shih <pkshih@realtek.com>
+Date: Thu, 16 Jan 2025 20:04:24 +0800
+Subject: [PATCH] wifi: rtw88: add RTW88_LEDS depends on LEDS_CLASS to Kconfig
+
+When using allmodconfig, .config has CONFIG_LEDS_CLASS=m but
+autoconf.h has CONFIG_LEDS_CLASS_MODULE (additional suffix _MODULE)
+instead of CONFIG_LEDS_CLASS, which condition CONFIG_LEDS_CLASS in
+rtw88/led.h can't work properly.
+
+Add RTW88_LEDS to Kconfig, and use it as condition to fix this problem.
+
+drivers/net/wireless/realtek/rtw88/led.c:19:6: error: redefinition of 'rtw_led_init'
+   19 | void rtw_led_init(struct rtw_dev *rtwdev)
+      |      ^~~~~~~~~~~~
+In file included from drivers/net/wireless/realtek/rtw88/led.c:7:
+drivers/net/wireless/realtek/rtw88/led.h:15:20: note: previous definition of 'rtw_led_init' with type 'void(struct rtw_dev *)'
+   15 | static inline void rtw_led_init(struct rtw_dev *rtwdev)
+      |                    ^~~~~~~~~~~~
+drivers/net/wireless/realtek/rtw88/led.c:64:6: error: redefinition of 'rtw_led_deinit'
+   64 | void rtw_led_deinit(struct rtw_dev *rtwdev)
+      |      ^~~~~~~~~~~~~~
+drivers/net/wireless/realtek/rtw88/led.h:19:20: note: previous definition of 'rtw_led_deinit' with type 'void(struct rtw_dev *)'
+   19 | static inline void rtw_led_deinit(struct rtw_dev *rtwdev)
+      |                    ^~~~~~~~~~~~~~
+
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Closes: https://lore.kernel.org/linux-wireless/e19a87ad9cd54bfa9907f3a043b25d30@realtek.com/T/#me407832de1040ce22e53517bcb18e322ad0e2260
+Fixes: 4b6652bc6d8d ("wifi: rtw88: Add support for LED blinking")
+Cc: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://patch.msgid.link/20250116120424.13174-1-pkshih@realtek.com
+---
+ drivers/net/wireless/realtek/rtw88/Kconfig  | 5 +++++
+ drivers/net/wireless/realtek/rtw88/Makefile | 2 +-
+ drivers/net/wireless/realtek/rtw88/led.h    | 2 +-
+ 3 files changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/Kconfig
++++ b/drivers/net/wireless/realtek/rtw88/Kconfig
+@@ -267,4 +267,9 @@ config RTW88_DEBUGFS
+ 
+ 	  If unsure, say Y to simplify debug problems
+ 
++config RTW88_LEDS
++	bool
++	depends on LEDS_CLASS=y || LEDS_CLASS=MAC80211
++	default y
++
+ endif
+--- a/drivers/net/wireless/realtek/rtw88/Makefile
++++ b/drivers/net/wireless/realtek/rtw88/Makefile
+@@ -20,7 +20,7 @@ rtw88_core-y += main.o \
+ 
+ rtw88_core-$(CONFIG_PM) += wow.o
+ 
+-rtw88_core-$(CONFIG_LEDS_CLASS) += led.o
++rtw88_core-$(CPTCFG_RTW88_LEDS) += led.o
+ 
+ obj-$(CPTCFG_RTW88_8822B)	+= rtw88_8822b.o
+ rtw88_8822b-objs		:= rtw8822b.o rtw8822b_table.o
+--- a/drivers/net/wireless/realtek/rtw88/led.h
++++ b/drivers/net/wireless/realtek/rtw88/led.h
+@@ -5,7 +5,7 @@
+ #ifndef __RTW_LED_H
+ #define __RTW_LED_H
+ 
+-#ifdef CONFIG_LEDS_CLASS
++#ifdef CPTCFG_RTW88_LEDS
+ 
+ void rtw_led_init(struct rtw_dev *rtwdev);
+ void rtw_led_deinit(struct rtw_dev *rtwdev);

package/kernel/mac80211/patches/rtl/064-v6.14.9-wifi-rtw88-Don-t-use-static-local-variable-in-rtw882.patch

@@ -0,0 +1,68 @@
+From 00451eb3bec763f708e7e58326468c1e575e5a66 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Sun, 26 Jan 2025 16:03:11 +0200
+Subject: [PATCH] wifi: rtw88: Don't use static local variable in
+ rtw8822b_set_tx_power_index_by_rate
+
+Some users want to plug two identical USB devices at the same time.
+This static variable could theoretically cause them to use incorrect
+TX power values.
+
+Move the variable to the caller and pass a pointer to it to
+rtw8822b_set_tx_power_index_by_rate().
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/8a60f581-0ab5-4d98-a97d-dd83b605008f@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/rtw8822b.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
+@@ -935,11 +935,11 @@ static void query_phy_status(struct rtw_
+ }
+ 
+ static void
+-rtw8822b_set_tx_power_index_by_rate(struct rtw_dev *rtwdev, u8 path, u8 rs)
++rtw8822b_set_tx_power_index_by_rate(struct rtw_dev *rtwdev, u8 path,
++				    u8 rs, u32 *phy_pwr_idx)
+ {
+ 	struct rtw_hal *hal = &rtwdev->hal;
+ 	static const u32 offset_txagc[2] = {0x1d00, 0x1d80};
+-	static u32 phy_pwr_idx;
+ 	u8 rate, rate_idx, pwr_index, shift;
+ 	int j;
+ 
+@@ -947,12 +947,12 @@ rtw8822b_set_tx_power_index_by_rate(stru
+ 		rate = rtw_rate_section[rs][j];
+ 		pwr_index = hal->tx_pwr_tbl[path][rate];
+ 		shift = rate & 0x3;
+-		phy_pwr_idx |= ((u32)pwr_index << (shift * 8));
++		*phy_pwr_idx |= ((u32)pwr_index << (shift * 8));
+ 		if (shift == 0x3) {
+ 			rate_idx = rate & 0xfc;
+ 			rtw_write32(rtwdev, offset_txagc[path] + rate_idx,
+-				    phy_pwr_idx);
+-			phy_pwr_idx = 0;
++				    *phy_pwr_idx);
++			*phy_pwr_idx = 0;
+ 		}
+ 	}
+ }
+@@ -960,11 +960,13 @@ rtw8822b_set_tx_power_index_by_rate(stru
+ static void rtw8822b_set_tx_power_index(struct rtw_dev *rtwdev)
+ {
+ 	struct rtw_hal *hal = &rtwdev->hal;
++	u32 phy_pwr_idx = 0;
+ 	int rs, path;
+ 
+ 	for (path = 0; path < hal->rf_path_num; path++) {
+ 		for (rs = 0; rs < RTW_RATE_SECTION_MAX; rs++)
+-			rtw8822b_set_tx_power_index_by_rate(rtwdev, path, rs);
++			rtw8822b_set_tx_power_index_by_rate(rtwdev, path, rs,
++							    &phy_pwr_idx);
+ 	}
+ }
+ 

package/kernel/mac80211/patches/rtl/065-v6.15-wifi-rtw88-Don-t-use-static-local-variable-in-rtw882.patch

@@ -0,0 +1,71 @@
+From 0d1d165eff9d6cfad51113e18d9d8c9a8de27d6d Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Sun, 26 Jan 2025 16:04:21 +0200
+Subject: [PATCH] wifi: rtw88: Don't use static local variable in
+ rtw8821c_set_tx_power_index_by_rate
+
+Some users want to plug two identical USB devices at the same time.
+This static variable could theoretically cause them to use incorrect
+TX power values.
+
+Move the variable to the caller and pass a pointer to it to
+rtw8821c_set_tx_power_index_by_rate().
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/fe42858c-9b9f-4f03-9aaa-737472c2cd90@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/rtw8821c.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821c.c
+@@ -680,11 +680,11 @@ static void query_phy_status(struct rtw_
+ }
+ 
+ static void
+-rtw8821c_set_tx_power_index_by_rate(struct rtw_dev *rtwdev, u8 path, u8 rs)
++rtw8821c_set_tx_power_index_by_rate(struct rtw_dev *rtwdev, u8 path,
++				    u8 rs, u32 *phy_pwr_idx)
+ {
+ 	struct rtw_hal *hal = &rtwdev->hal;
+ 	static const u32 offset_txagc[2] = {0x1d00, 0x1d80};
+-	static u32 phy_pwr_idx;
+ 	u8 rate, rate_idx, pwr_index, shift;
+ 	int j;
+ 
+@@ -692,12 +692,12 @@ rtw8821c_set_tx_power_index_by_rate(stru
+ 		rate = rtw_rate_section[rs][j];
+ 		pwr_index = hal->tx_pwr_tbl[path][rate];
+ 		shift = rate & 0x3;
+-		phy_pwr_idx |= ((u32)pwr_index << (shift * 8));
++		*phy_pwr_idx |= ((u32)pwr_index << (shift * 8));
+ 		if (shift == 0x3 || rate == DESC_RATEVHT1SS_MCS9) {
+ 			rate_idx = rate & 0xfc;
+ 			rtw_write32(rtwdev, offset_txagc[path] + rate_idx,
+-				    phy_pwr_idx);
+-			phy_pwr_idx = 0;
++				    *phy_pwr_idx);
++			*phy_pwr_idx = 0;
+ 		}
+ 	}
+ }
+@@ -705,6 +705,7 @@ rtw8821c_set_tx_power_index_by_rate(stru
+ static void rtw8821c_set_tx_power_index(struct rtw_dev *rtwdev)
+ {
+ 	struct rtw_hal *hal = &rtwdev->hal;
++	u32 phy_pwr_idx = 0;
+ 	int rs, path;
+ 
+ 	for (path = 0; path < hal->rf_path_num; path++) {
+@@ -712,7 +713,8 @@ static void rtw8821c_set_tx_power_index(
+ 			if (rs == RTW_RATE_SECTION_HT_2S ||
+ 			    rs == RTW_RATE_SECTION_VHT_2S)
+ 				continue;
+-			rtw8821c_set_tx_power_index_by_rate(rtwdev, path, rs);
++			rtw8821c_set_tx_power_index_by_rate(rtwdev, path, rs,
++							    &phy_pwr_idx);
+ 		}
+ 	}
+ }

package/kernel/mac80211/patches/rtl/066-v6.15-wifi-rtw88-Fix-a-typo-of-debug-message-in-rtw8723d_i.patch

@@ -0,0 +1,39 @@
+From 105dc94233e48ff30e572a50fb39d7e3dec810fa Mon Sep 17 00:00:00 2001
+From: Andrew Kreimer <algonell@gmail.com>
+Date: Mon, 3 Feb 2025 20:08:27 +0200
+Subject: [PATCH] wifi: rtw88: Fix a typo of debug message in
+ rtw8723d_iqk_check_tx_failed()
+
+There is a typo in debug messages:
+ - afer -> after
+
+Fix it via codespell.
+
+Signed-off-by: Andrew Kreimer <algonell@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250203180913.5435-1-algonell@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/rtw8723d.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/rtw8723d.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8723d.c
+@@ -444,7 +444,7 @@ static u8 rtw8723d_iqk_check_tx_failed(s
+ 		rtw_read32(rtwdev, REG_IQK_RES_TX),
+ 		rtw_read32(rtwdev, REG_IQK_RES_TY));
+ 	rtw_dbg(rtwdev, RTW_DBG_RFK,
+-		"[IQK] 0xe90(before IQK)= 0x%x, 0xe98(afer IQK) = 0x%x\n",
++		"[IQK] 0xe90(before IQK)= 0x%x, 0xe98(after IQK) = 0x%x\n",
+ 		rtw_read32(rtwdev, 0xe90),
+ 		rtw_read32(rtwdev, 0xe98));
+ 
+@@ -472,7 +472,7 @@ static u8 rtw8723d_iqk_check_rx_failed(s
+ 		rtw_read32(rtwdev, REG_IQK_RES_RY));
+ 
+ 	rtw_dbg(rtwdev, RTW_DBG_RFK,
+-		"[IQK] 0xea0(before IQK)= 0x%x, 0xea8(afer IQK) = 0x%x\n",
++		"[IQK] 0xea0(before IQK)= 0x%x, 0xea8(after IQK) = 0x%x\n",
+ 		rtw_read32(rtwdev, 0xea0),
+ 		rtw_read32(rtwdev, 0xea8));
+ 

package/kernel/mac80211/patches/rtl/067-v6.14.9-wifi-rtw88-Fix-__rtw_download_firmware-for-RTL8814AU.patch

@@ -0,0 +1,39 @@
+From 8425f5c8f04dbcf11ade78f984a494fc0b90e7a0 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Tue, 4 Feb 2025 20:36:56 +0200
+Subject: [PATCH] wifi: rtw88: Fix __rtw_download_firmware() for RTL8814AU
+
+Don't call ltecoex_read_reg() and ltecoex_reg_write() when the
+ltecoex_addr member of struct rtw_chip_info is NULL. The RTL8814AU
+doesn't have this feature.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/55b5641f-094e-4f94-9f79-ac053733f2cf@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/mac.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/mac.c
++++ b/drivers/net/wireless/realtek/rtw88/mac.c
+@@ -784,7 +784,8 @@ static int __rtw_download_firmware(struc
+ 	if (!check_firmware_size(data, size))
+ 		return -EINVAL;
+ 
+-	if (!ltecoex_read_reg(rtwdev, 0x38, &ltecoex_bckp))
++	if (rtwdev->chip->ltecoex_addr &&
++	    !ltecoex_read_reg(rtwdev, 0x38, &ltecoex_bckp))
+ 		return -EBUSY;
+ 
+ 	wlan_cpu_enable(rtwdev, false);
+@@ -802,7 +803,8 @@ static int __rtw_download_firmware(struc
+ 
+ 	wlan_cpu_enable(rtwdev, true);
+ 
+-	if (!ltecoex_reg_write(rtwdev, 0x38, ltecoex_bckp)) {
++	if (rtwdev->chip->ltecoex_addr &&
++	    !ltecoex_reg_write(rtwdev, 0x38, ltecoex_bckp)) {
+ 		ret = -EBUSY;
+ 		goto dlfw_fail;
+ 	}

package/kernel/mac80211/patches/rtl/068-v6.14.9-wifi-rtw88-Fix-download_firmware_validate-for-RTL881.patch

@@ -0,0 +1,39 @@
+From 9e8243025cc06abc975c876dffda052073207ab3 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Tue, 4 Feb 2025 20:37:36 +0200
+Subject: [PATCH] wifi: rtw88: Fix download_firmware_validate() for RTL8814AU
+
+After the firmware is uploaded, download_firmware_validate() checks some
+bits in REG_MCUFW_CTRL to see if everything went okay. The
+RTL8814AU power on sequence sets bits 13 and 12 to 2, which this
+function does not expect, so it thinks the firmware upload failed.
+
+Make download_firmware_validate() ignore bits 13 and 12.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/049d2887-22fc-47b7-9e59-62627cb525f8@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/reg.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/reg.h
++++ b/drivers/net/wireless/realtek/rtw88/reg.h
+@@ -130,6 +130,7 @@
+ #define BIT_SHIFT_ROM_PGE	16
+ #define BIT_FW_INIT_RDY		BIT(15)
+ #define BIT_FW_DW_RDY		BIT(14)
++#define BIT_CPU_CLK_SEL		(BIT(12) | BIT(13))
+ #define BIT_RPWM_TOGGLE		BIT(7)
+ #define BIT_RAM_DL_SEL		BIT(7)	/* legacy only */
+ #define BIT_DMEM_CHKSUM_OK	BIT(6)
+@@ -147,7 +148,7 @@
+ 				 BIT_CHECK_SUM_OK)
+ #define FW_READY_LEGACY		(BIT_MCUFWDL_RDY | BIT_FWDL_CHK_RPT |	       \
+ 				 BIT_WINTINI_RDY | BIT_RAM_DL_SEL)
+-#define FW_READY_MASK		0xffff
++#define FW_READY_MASK		(0xffff & ~BIT_CPU_CLK_SEL)
+ 
+ #define REG_MCU_TST_CFG		0x84
+ #define VAL_FW_TRIGGER		0x1

package/kernel/mac80211/patches/rtl/069-v6.15-wifi-rtw88-Extend-struct-rtw_pwr_track_tbl-for-RTL88.patch

@@ -0,0 +1,46 @@
+From 62f726848da42554e6d270dfda17ed19bfa3456f Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Tue, 4 Feb 2025 20:38:17 +0200
+Subject: [PATCH] wifi: rtw88: Extend struct rtw_pwr_track_tbl for RTL8814AU
+
+Currently this struct has the members required for chips with 2 RF
+paths. Add more members to support chips with 4 RF paths, like the
+RTL8814AU.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/be5a73f4-a0fe-43d6-9457-930cde199284@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/main.h | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -1130,14 +1130,26 @@ struct rtw_rfe_def {
+  * For 2G there are cck rate and ofdm rate with different settings.
+  */
+ struct rtw_pwr_track_tbl {
++	const u8 *pwrtrk_5gd_n[RTW_PWR_TRK_5G_NUM];
++	const u8 *pwrtrk_5gd_p[RTW_PWR_TRK_5G_NUM];
++	const u8 *pwrtrk_5gc_n[RTW_PWR_TRK_5G_NUM];
++	const u8 *pwrtrk_5gc_p[RTW_PWR_TRK_5G_NUM];
+ 	const u8 *pwrtrk_5gb_n[RTW_PWR_TRK_5G_NUM];
+ 	const u8 *pwrtrk_5gb_p[RTW_PWR_TRK_5G_NUM];
+ 	const u8 *pwrtrk_5ga_n[RTW_PWR_TRK_5G_NUM];
+ 	const u8 *pwrtrk_5ga_p[RTW_PWR_TRK_5G_NUM];
++	const u8 *pwrtrk_2gd_n;
++	const u8 *pwrtrk_2gd_p;
++	const u8 *pwrtrk_2gc_n;
++	const u8 *pwrtrk_2gc_p;
+ 	const u8 *pwrtrk_2gb_n;
+ 	const u8 *pwrtrk_2gb_p;
+ 	const u8 *pwrtrk_2ga_n;
+ 	const u8 *pwrtrk_2ga_p;
++	const u8 *pwrtrk_2g_cckd_n;
++	const u8 *pwrtrk_2g_cckd_p;
++	const u8 *pwrtrk_2g_cckc_n;
++	const u8 *pwrtrk_2g_cckc_p;
+ 	const u8 *pwrtrk_2g_cckb_n;
+ 	const u8 *pwrtrk_2g_cckb_p;
+ 	const u8 *pwrtrk_2g_ccka_n;

package/kernel/mac80211/patches/rtl/070-v6.15-wifi-rtw88-Extend-rf_base_addr-and-rf_sipi_addr-for-.patch

@@ -0,0 +1,32 @@
+From d80e7d9b6ba38102f92559dbb647330216ea290b Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Tue, 4 Feb 2025 20:38:43 +0200
+Subject: [PATCH] wifi: rtw88: Extend rf_base_addr and rf_sipi_addr for
+ RTL8814AU
+
+These members of struct rtw_chip_info each have a size of 2. Increase
+their size to 4, which is the number of RF paths the RTL8814AU has.
+
+This is required to read and write the RF registers of the RTL8814AU.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/7a4d8209-b8af-4943-b5de-f53d6edf591a@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/main.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -1239,8 +1239,8 @@ struct rtw_chip_info {
+ 
+ 	const struct rtw_hw_reg *dig;
+ 	const struct rtw_hw_reg *dig_cck;
+-	u32 rf_base_addr[2];
+-	u32 rf_sipi_addr[2];
++	u32 rf_base_addr[RTW_RF_PATH_MAX];
++	u32 rf_sipi_addr[RTW_RF_PATH_MAX];
+ 	const struct rtw_rf_sipi_addr *rf_sipi_read_addr;
+ 	u8 fix_rf_phy_num;
+ 	const struct rtw_ltecoex_addr *ltecoex_addr;

package/kernel/mac80211/patches/rtl/071-v6.14.9-wifi-rtw88-Extend-rtw_fw_send_ra_info-for-RTL8814AU.patch

@@ -0,0 +1,70 @@
+From 8f0076726b66a70727a1bef5c087c60291e90ad8 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Tue, 4 Feb 2025 20:39:29 +0200
+Subject: [PATCH] wifi: rtw88: Extend rtw_fw_send_ra_info() for RTL8814AU
+
+The existing code is suitable for chips with up to 2 spatial streams.
+Inform the firmware about the rates it's allowed to use when
+transmitting 3 spatial streams.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/08e2f328-1aab-4e50-93ac-c1e5dd9541ac@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/fw.c   | 15 +++++++++++++++
+ drivers/net/wireless/realtek/rtw88/fw.h   |  1 +
+ drivers/net/wireless/realtek/rtw88/main.h |  1 +
+ 3 files changed, 17 insertions(+)
+
+--- a/drivers/net/wireless/realtek/rtw88/fw.c
++++ b/drivers/net/wireless/realtek/rtw88/fw.c
+@@ -736,6 +736,7 @@ void rtw_fw_send_ra_info(struct rtw_dev
+ {
+ 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
+ 	bool disable_pt = true;
++	u32 mask_hi;
+ 
+ 	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_RA_INFO);
+ 
+@@ -756,6 +757,20 @@ void rtw_fw_send_ra_info(struct rtw_dev
+ 	si->init_ra_lv = 0;
+ 
+ 	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
++
++	if (rtwdev->chip->id != RTW_CHIP_TYPE_8814A)
++		return;
++
++	SET_H2C_CMD_ID_CLASS(h2c_pkt, H2C_CMD_RA_INFO_HI);
++
++	mask_hi = si->ra_mask >> 32;
++
++	SET_RA_INFO_RA_MASK0(h2c_pkt, (mask_hi & 0xff));
++	SET_RA_INFO_RA_MASK1(h2c_pkt, (mask_hi & 0xff00) >> 8);
++	SET_RA_INFO_RA_MASK2(h2c_pkt, (mask_hi & 0xff0000) >> 16);
++	SET_RA_INFO_RA_MASK3(h2c_pkt, (mask_hi & 0xff000000) >> 24);
++
++	rtw_fw_send_h2c_command(rtwdev, h2c_pkt);
+ }
+ 
+ void rtw_fw_media_status_report(struct rtw_dev *rtwdev, u8 mac_id, bool connect)
+--- a/drivers/net/wireless/realtek/rtw88/fw.h
++++ b/drivers/net/wireless/realtek/rtw88/fw.h
+@@ -557,6 +557,7 @@ static inline void rtw_h2c_pkt_set_heade
+ #define H2C_CMD_DEFAULT_PORT		0x2c
+ #define H2C_CMD_RA_INFO			0x40
+ #define H2C_CMD_RSSI_MONITOR		0x42
++#define H2C_CMD_RA_INFO_HI		0x46
+ #define H2C_CMD_BCN_FILTER_OFFLOAD_P0	0x56
+ #define H2C_CMD_BCN_FILTER_OFFLOAD_P1	0x57
+ #define H2C_CMD_WL_PHY_INFO		0x58
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -191,6 +191,7 @@ enum rtw_chip_type {
+ 	RTW_CHIP_TYPE_8703B,
+ 	RTW_CHIP_TYPE_8821A,
+ 	RTW_CHIP_TYPE_8812A,
++	RTW_CHIP_TYPE_8814A,
+ };
+ 
+ enum rtw_tx_queue_type {

package/kernel/mac80211/patches/rtl/072-v6.15-wifi-rtw88-Constify-some-more-structs-and-arrays.patch

@@ -0,0 +1,213 @@
+From e66f3b5c7535bb508e9c561a047b32de4ddc1cda Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Tue, 4 Feb 2025 20:40:22 +0200
+Subject: [PATCH] wifi: rtw88: Constify some more structs and arrays
+
+These structs and arrays are never modified, so make them const:
+
+rtw_band_2ghz
+rtw_band_5ghz
+rtw_pci_tx_queue_idx_addr
+rtw_pci_ops
+rtw_cck_rates
+rtw_ofdm_rates
+rtw_ht_1s_rates
+rtw_ht_2s_rates
+rtw_vht_1s_rates
+rtw_vht_2s_rates
+rtw_rate_section
+rtw_rate_size
+rtw_sdio_ops
+rtw_usb_ops
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/502f124e-ccf3-4c09-80a4-1e5c5304822b@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/main.c |  4 ++--
+ drivers/net/wireless/realtek/rtw88/main.h |  2 +-
+ drivers/net/wireless/realtek/rtw88/pci.c  |  4 ++--
+ drivers/net/wireless/realtek/rtw88/phy.c  | 26 ++++++++++++++---------
+ drivers/net/wireless/realtek/rtw88/phy.h  | 16 +++++++-------
+ drivers/net/wireless/realtek/rtw88/sdio.c |  2 +-
+ drivers/net/wireless/realtek/rtw88/usb.c  |  2 +-
+ 7 files changed, 31 insertions(+), 25 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -136,7 +136,7 @@ u16 rtw_desc_to_bitrate(u8 desc_rate)
+ 	return rate.bitrate;
+ }
+ 
+-static struct ieee80211_supported_band rtw_band_2ghz = {
++static const struct ieee80211_supported_band rtw_band_2ghz = {
+ 	.band = NL80211_BAND_2GHZ,
+ 
+ 	.channels = rtw_channeltable_2g,
+@@ -149,7 +149,7 @@ static struct ieee80211_supported_band r
+ 	.vht_cap = {0},
+ };
+ 
+-static struct ieee80211_supported_band rtw_band_5ghz = {
++static const struct ieee80211_supported_band rtw_band_5ghz = {
+ 	.band = NL80211_BAND_5GHZ,
+ 
+ 	.channels = rtw_channeltable_5g,
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -61,7 +61,7 @@ enum rtw_hci_type {
+ };
+ 
+ struct rtw_hci {
+-	struct rtw_hci_ops *ops;
++	const struct rtw_hci_ops *ops;
+ 	enum rtw_hci_type type;
+ 
+ 	u32 rpwm_addr;
+--- a/drivers/net/wireless/realtek/rtw88/pci.c
++++ b/drivers/net/wireless/realtek/rtw88/pci.c
+@@ -20,7 +20,7 @@ module_param_named(disable_aspm, rtw_pci
+ MODULE_PARM_DESC(disable_msi, "Set Y to disable MSI interrupt support");
+ MODULE_PARM_DESC(disable_aspm, "Set Y to disable PCI ASPM support");
+ 
+-static u32 rtw_pci_tx_queue_idx_addr[] = {
++static const u32 rtw_pci_tx_queue_idx_addr[] = {
+ 	[RTW_TX_QUEUE_BK]	= RTK_PCI_TXBD_IDX_BKQ,
+ 	[RTW_TX_QUEUE_BE]	= RTK_PCI_TXBD_IDX_BEQ,
+ 	[RTW_TX_QUEUE_VI]	= RTK_PCI_TXBD_IDX_VIQ,
+@@ -1591,7 +1591,7 @@ static void rtw_pci_destroy(struct rtw_d
+ 	rtw_pci_io_unmapping(rtwdev, pdev);
+ }
+ 
+-static struct rtw_hci_ops rtw_pci_ops = {
++static const struct rtw_hci_ops rtw_pci_ops = {
+ 	.tx_write = rtw_pci_tx_write,
+ 	.tx_kick_off = rtw_pci_tx_kick_off,
+ 	.flush_queues = rtw_pci_flush_queues,
+--- a/drivers/net/wireless/realtek/rtw88/phy.c
++++ b/drivers/net/wireless/realtek/rtw88/phy.c
+@@ -52,44 +52,50 @@ static const u32 db_invert_table[12][8]
+ 	 1995262315,	2511886432U,	3162277660U,	3981071706U}
+ };
+ 
+-u8 rtw_cck_rates[] = { DESC_RATE1M, DESC_RATE2M, DESC_RATE5_5M, DESC_RATE11M };
+-u8 rtw_ofdm_rates[] = {
++const u8 rtw_cck_rates[] = { DESC_RATE1M, DESC_RATE2M, DESC_RATE5_5M, DESC_RATE11M };
++
++const u8 rtw_ofdm_rates[] = {
+ 	DESC_RATE6M,  DESC_RATE9M,  DESC_RATE12M,
+ 	DESC_RATE18M, DESC_RATE24M, DESC_RATE36M,
+ 	DESC_RATE48M, DESC_RATE54M
+ };
+-u8 rtw_ht_1s_rates[] = {
++
++const u8 rtw_ht_1s_rates[] = {
+ 	DESC_RATEMCS0, DESC_RATEMCS1, DESC_RATEMCS2,
+ 	DESC_RATEMCS3, DESC_RATEMCS4, DESC_RATEMCS5,
+ 	DESC_RATEMCS6, DESC_RATEMCS7
+ };
+-u8 rtw_ht_2s_rates[] = {
++
++const u8 rtw_ht_2s_rates[] = {
+ 	DESC_RATEMCS8,  DESC_RATEMCS9,  DESC_RATEMCS10,
+ 	DESC_RATEMCS11, DESC_RATEMCS12, DESC_RATEMCS13,
+ 	DESC_RATEMCS14, DESC_RATEMCS15
+ };
+-u8 rtw_vht_1s_rates[] = {
++
++const u8 rtw_vht_1s_rates[] = {
+ 	DESC_RATEVHT1SS_MCS0, DESC_RATEVHT1SS_MCS1,
+ 	DESC_RATEVHT1SS_MCS2, DESC_RATEVHT1SS_MCS3,
+ 	DESC_RATEVHT1SS_MCS4, DESC_RATEVHT1SS_MCS5,
+ 	DESC_RATEVHT1SS_MCS6, DESC_RATEVHT1SS_MCS7,
+ 	DESC_RATEVHT1SS_MCS8, DESC_RATEVHT1SS_MCS9
+ };
+-u8 rtw_vht_2s_rates[] = {
++
++const u8 rtw_vht_2s_rates[] = {
+ 	DESC_RATEVHT2SS_MCS0, DESC_RATEVHT2SS_MCS1,
+ 	DESC_RATEVHT2SS_MCS2, DESC_RATEVHT2SS_MCS3,
+ 	DESC_RATEVHT2SS_MCS4, DESC_RATEVHT2SS_MCS5,
+ 	DESC_RATEVHT2SS_MCS6, DESC_RATEVHT2SS_MCS7,
+ 	DESC_RATEVHT2SS_MCS8, DESC_RATEVHT2SS_MCS9
+ };
+-u8 *rtw_rate_section[RTW_RATE_SECTION_MAX] = {
++
++const u8 * const rtw_rate_section[RTW_RATE_SECTION_MAX] = {
+ 	rtw_cck_rates, rtw_ofdm_rates,
+ 	rtw_ht_1s_rates, rtw_ht_2s_rates,
+ 	rtw_vht_1s_rates, rtw_vht_2s_rates
+ };
+ EXPORT_SYMBOL(rtw_rate_section);
+ 
+-u8 rtw_rate_size[RTW_RATE_SECTION_MAX] = {
++const u8 rtw_rate_size[RTW_RATE_SECTION_MAX] = {
+ 	ARRAY_SIZE(rtw_cck_rates),
+ 	ARRAY_SIZE(rtw_ofdm_rates),
+ 	ARRAY_SIZE(rtw_ht_1s_rates),
+@@ -2214,7 +2220,7 @@ static void rtw_phy_set_tx_power_index_b
+ {
+ 	struct rtw_hal *hal = &rtwdev->hal;
+ 	u8 regd = rtw_regd_get(rtwdev);
+-	u8 *rates;
++	const u8 *rates;
+ 	u8 size;
+ 	u8 rate;
+ 	u8 pwr_idx;
+@@ -2274,7 +2280,7 @@ EXPORT_SYMBOL(rtw_phy_set_tx_power_level
+ 
+ static void
+ rtw_phy_tx_power_by_rate_config_by_path(struct rtw_hal *hal, u8 path,
+-					u8 rs, u8 size, u8 *rates)
++					u8 rs, u8 size, const u8 *rates)
+ {
+ 	u8 rate;
+ 	u8 base_idx, rate_idx;
+--- a/drivers/net/wireless/realtek/rtw88/phy.h
++++ b/drivers/net/wireless/realtek/rtw88/phy.h
+@@ -7,14 +7,14 @@
+ 
+ #include "debug.h"
+ 
+-extern u8 rtw_cck_rates[];
+-extern u8 rtw_ofdm_rates[];
+-extern u8 rtw_ht_1s_rates[];
+-extern u8 rtw_ht_2s_rates[];
+-extern u8 rtw_vht_1s_rates[];
+-extern u8 rtw_vht_2s_rates[];
+-extern u8 *rtw_rate_section[];
+-extern u8 rtw_rate_size[];
++extern const u8 rtw_cck_rates[];
++extern const u8 rtw_ofdm_rates[];
++extern const u8 rtw_ht_1s_rates[];
++extern const u8 rtw_ht_2s_rates[];
++extern const u8 rtw_vht_1s_rates[];
++extern const u8 rtw_vht_2s_rates[];
++extern const u8 * const rtw_rate_section[];
++extern const u8 rtw_rate_size[];
+ 
+ void rtw_phy_init(struct rtw_dev *rtwdev);
+ void rtw_phy_dynamic_mechanism(struct rtw_dev *rtwdev);
+--- a/drivers/net/wireless/realtek/rtw88/sdio.c
++++ b/drivers/net/wireless/realtek/rtw88/sdio.c
+@@ -1147,7 +1147,7 @@ static void rtw_sdio_declaim(struct rtw_
+ 	sdio_release_host(sdio_func);
+ }
+ 
+-static struct rtw_hci_ops rtw_sdio_ops = {
++static const struct rtw_hci_ops rtw_sdio_ops = {
+ 	.tx_write = rtw_sdio_tx_write,
+ 	.tx_kick_off = rtw_sdio_tx_kick_off,
+ 	.setup = rtw_sdio_setup,
+--- a/drivers/net/wireless/realtek/rtw88/usb.c
++++ b/drivers/net/wireless/realtek/rtw88/usb.c
+@@ -844,7 +844,7 @@ static void rtw_usb_dynamic_rx_agg(struc
+ 	}
+ }
+ 
+-static struct rtw_hci_ops rtw_usb_ops = {
++static const struct rtw_hci_ops rtw_usb_ops = {
+ 	.tx_write = rtw_usb_tx_write,
+ 	.tx_kick_off = rtw_usb_tx_kick_off,
+ 	.setup = rtw_usb_setup,

package/kernel/mac80211/patches/rtl/073-v6.15-wifi-rtw88-Rename-RTW_RATE_SECTION_MAX-to-RTW_RATE_S.patch

@@ -0,0 +1,227 @@
+From ad815f3920035a0c5b6ffe45bddc9fb308194b49 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Tue, 4 Feb 2025 20:40:58 +0200
+Subject: [PATCH] wifi: rtw88: Rename RTW_RATE_SECTION_MAX to
+ RTW_RATE_SECTION_NUM
+
+It fits the meaning of the enum better.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/5a1c5a46-8ebb-43b0-9ab1-b78e2a22b3d2@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/main.h     | 12 +++++-----
+ drivers/net/wireless/realtek/rtw88/phy.c      | 24 +++++++++----------
+ drivers/net/wireless/realtek/rtw88/rtw8821c.c |  2 +-
+ drivers/net/wireless/realtek/rtw88/rtw8822b.c |  2 +-
+ drivers/net/wireless/realtek/rtw88/rtw8822c.c |  2 +-
+ drivers/net/wireless/realtek/rtw88/rtw88xxa.c |  2 +-
+ drivers/net/wireless/realtek/rtw88/sar.c      |  2 +-
+ 7 files changed, 23 insertions(+), 23 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -168,7 +168,7 @@ enum rtw_rate_section {
+ 	RTW_RATE_SECTION_VHT_2S,
+ 
+ 	/* keep last */
+-	RTW_RATE_SECTION_MAX,
++	RTW_RATE_SECTION_NUM,
+ };
+ 
+ enum rtw_wireless_set {
+@@ -1937,7 +1937,7 @@ union rtw_sar_cfg {
+ 
+ struct rtw_sar {
+ 	enum rtw_sar_sources src;
+-	union rtw_sar_cfg cfg[RTW_RF_PATH_MAX][RTW_RATE_SECTION_MAX];
++	union rtw_sar_cfg cfg[RTW_RF_PATH_MAX][RTW_RATE_SECTION_NUM];
+ };
+ 
+ struct rtw_hal {
+@@ -1981,16 +1981,16 @@ struct rtw_hal {
+ 	s8 tx_pwr_by_rate_offset_5g[RTW_RF_PATH_MAX]
+ 				   [DESC_RATE_MAX];
+ 	s8 tx_pwr_by_rate_base_2g[RTW_RF_PATH_MAX]
+-				 [RTW_RATE_SECTION_MAX];
++				 [RTW_RATE_SECTION_NUM];
+ 	s8 tx_pwr_by_rate_base_5g[RTW_RF_PATH_MAX]
+-				 [RTW_RATE_SECTION_MAX];
++				 [RTW_RATE_SECTION_NUM];
+ 	s8 tx_pwr_limit_2g[RTW_REGD_MAX]
+ 			  [RTW_CHANNEL_WIDTH_MAX]
+-			  [RTW_RATE_SECTION_MAX]
++			  [RTW_RATE_SECTION_NUM]
+ 			  [RTW_MAX_CHANNEL_NUM_2G];
+ 	s8 tx_pwr_limit_5g[RTW_REGD_MAX]
+ 			  [RTW_CHANNEL_WIDTH_MAX]
+-			  [RTW_RATE_SECTION_MAX]
++			  [RTW_RATE_SECTION_NUM]
+ 			  [RTW_MAX_CHANNEL_NUM_5G];
+ 	s8 tx_pwr_tbl[RTW_RF_PATH_MAX]
+ 		     [DESC_RATE_MAX];
+--- a/drivers/net/wireless/realtek/rtw88/phy.c
++++ b/drivers/net/wireless/realtek/rtw88/phy.c
+@@ -88,14 +88,14 @@ const u8 rtw_vht_2s_rates[] = {
+ 	DESC_RATEVHT2SS_MCS8, DESC_RATEVHT2SS_MCS9
+ };
+ 
+-const u8 * const rtw_rate_section[RTW_RATE_SECTION_MAX] = {
++const u8 * const rtw_rate_section[RTW_RATE_SECTION_NUM] = {
+ 	rtw_cck_rates, rtw_ofdm_rates,
+ 	rtw_ht_1s_rates, rtw_ht_2s_rates,
+ 	rtw_vht_1s_rates, rtw_vht_2s_rates
+ };
+ EXPORT_SYMBOL(rtw_rate_section);
+ 
+-const u8 rtw_rate_size[RTW_RATE_SECTION_MAX] = {
++const u8 rtw_rate_size[RTW_RATE_SECTION_NUM] = {
+ 	ARRAY_SIZE(rtw_cck_rates),
+ 	ARRAY_SIZE(rtw_ofdm_rates),
+ 	ARRAY_SIZE(rtw_ht_1s_rates),
+@@ -1596,7 +1596,7 @@ static void rtw_phy_set_tx_power_limit(s
+ 	ch_idx = rtw_channel_to_idx(band, ch);
+ 
+ 	if (regd >= RTW_REGD_MAX || bw >= RTW_CHANNEL_WIDTH_MAX ||
+-	    rs >= RTW_RATE_SECTION_MAX || ch_idx < 0) {
++	    rs >= RTW_RATE_SECTION_NUM || ch_idx < 0) {
+ 		WARN(1,
+ 		     "wrong txpwr_lmt regd=%u, band=%u bw=%u, rs=%u, ch_idx=%u, pwr_limit=%d\n",
+ 		     regd, band, bw, rs, ch_idx, pwr_limit);
+@@ -1701,7 +1701,7 @@ rtw_cfg_txpwr_lmt_by_alt(struct rtw_dev
+ 	u8 bw, rs;
+ 
+ 	for (bw = 0; bw < RTW_CHANNEL_WIDTH_MAX; bw++)
+-		for (rs = 0; rs < RTW_RATE_SECTION_MAX; rs++)
++		for (rs = 0; rs < RTW_RATE_SECTION_NUM; rs++)
+ 			__cfg_txpwr_lmt_by_alt(&rtwdev->hal, regd, regd_alt,
+ 					       bw, rs);
+ }
+@@ -2060,7 +2060,7 @@ static u8 rtw_phy_get_5g_tx_power_index(
+ 	return tx_power;
+ }
+ 
+-/* return RTW_RATE_SECTION_MAX to indicate rate is invalid */
++/* return RTW_RATE_SECTION_NUM to indicate rate is invalid */
+ static u8 rtw_phy_rate_to_rate_section(u8 rate)
+ {
+ 	if (rate >= DESC_RATE1M && rate <= DESC_RATE11M)
+@@ -2076,7 +2076,7 @@ static u8 rtw_phy_rate_to_rate_section(u
+ 	else if (rate >= DESC_RATEVHT2SS_MCS0 && rate <= DESC_RATEVHT2SS_MCS9)
+ 		return RTW_RATE_SECTION_VHT_2S;
+ 	else
+-		return RTW_RATE_SECTION_MAX;
++		return RTW_RATE_SECTION_NUM;
+ }
+ 
+ static s8 rtw_phy_get_tx_power_limit(struct rtw_dev *rtwdev, u8 band,
+@@ -2094,7 +2094,7 @@ static s8 rtw_phy_get_tx_power_limit(str
+ 	if (regd > RTW_REGD_WW)
+ 		return power_limit;
+ 
+-	if (rs == RTW_RATE_SECTION_MAX)
++	if (rs == RTW_RATE_SECTION_NUM)
+ 		goto err;
+ 
+ 	/* only 20M BW with cck and ofdm */
+@@ -2138,7 +2138,7 @@ static s8 rtw_phy_get_tx_power_sar(struc
+ 		.rs = rs,
+ 	};
+ 
+-	if (rs == RTW_RATE_SECTION_MAX)
++	if (rs == RTW_RATE_SECTION_NUM)
+ 		goto err;
+ 
+ 	return rtw_query_sar(rtwdev, &arg);
+@@ -2227,7 +2227,7 @@ static void rtw_phy_set_tx_power_index_b
+ 	u8 bw;
+ 	int i;
+ 
+-	if (rs >= RTW_RATE_SECTION_MAX)
++	if (rs >= RTW_RATE_SECTION_NUM)
+ 		return;
+ 
+ 	rates = rtw_rate_section[rs];
+@@ -2258,7 +2258,7 @@ static void rtw_phy_set_tx_power_level_b
+ 	else
+ 		rs = RTW_RATE_SECTION_OFDM;
+ 
+-	for (; rs < RTW_RATE_SECTION_MAX; rs++)
++	for (; rs < RTW_RATE_SECTION_NUM; rs++)
+ 		rtw_phy_set_tx_power_index_by_rs(rtwdev, ch, path, rs);
+ }
+ 
+@@ -2353,7 +2353,7 @@ void rtw_phy_tx_power_limit_config(struc
+ 
+ 	for (regd = 0; regd < RTW_REGD_MAX; regd++)
+ 		for (bw = 0; bw < RTW_CHANNEL_WIDTH_MAX; bw++)
+-			for (rs = 0; rs < RTW_RATE_SECTION_MAX; rs++)
++			for (rs = 0; rs < RTW_RATE_SECTION_NUM; rs++)
+ 				__rtw_phy_tx_power_limit_config(hal, regd, bw, rs);
+ }
+ 
+@@ -2389,7 +2389,7 @@ void rtw_phy_init_tx_power(struct rtw_de
+ 	/* init tx power limit */
+ 	for (regd = 0; regd < RTW_REGD_MAX; regd++)
+ 		for (bw = 0; bw < RTW_CHANNEL_WIDTH_MAX; bw++)
+-			for (rs = 0; rs < RTW_RATE_SECTION_MAX; rs++)
++			for (rs = 0; rs < RTW_RATE_SECTION_NUM; rs++)
+ 				rtw_phy_init_tx_power_limit(rtwdev, regd, bw,
+ 							    rs);
+ }
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821c.c
+@@ -709,7 +709,7 @@ static void rtw8821c_set_tx_power_index(
+ 	int rs, path;
+ 
+ 	for (path = 0; path < hal->rf_path_num; path++) {
+-		for (rs = 0; rs < RTW_RATE_SECTION_MAX; rs++) {
++		for (rs = 0; rs < RTW_RATE_SECTION_NUM; rs++) {
+ 			if (rs == RTW_RATE_SECTION_HT_2S ||
+ 			    rs == RTW_RATE_SECTION_VHT_2S)
+ 				continue;
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
+@@ -964,7 +964,7 @@ static void rtw8822b_set_tx_power_index(
+ 	int rs, path;
+ 
+ 	for (path = 0; path < hal->rf_path_num; path++) {
+-		for (rs = 0; rs < RTW_RATE_SECTION_MAX; rs++)
++		for (rs = 0; rs < RTW_RATE_SECTION_NUM; rs++)
+ 			rtw8822b_set_tx_power_index_by_rate(rtwdev, path, rs,
+ 							    &phy_pwr_idx);
+ 	}
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
+@@ -2746,7 +2746,7 @@ static void rtw8822c_set_tx_power_index(
+ 	s8 diff_idx[4];
+ 
+ 	rtw8822c_set_write_tx_power_ref(rtwdev, pwr_ref_cck, pwr_ref_ofdm);
+-	for (rs = 0; rs < RTW_RATE_SECTION_MAX; rs++) {
++	for (rs = 0; rs < RTW_RATE_SECTION_NUM; rs++) {
+ 		for (j = 0; j < rtw_rate_size[rs]; j++) {
+ 			rate = rtw_rate_section[rs][j];
+ 			pwr_a = hal->tx_pwr_tbl[RF_PATH_A][rate];
+--- a/drivers/net/wireless/realtek/rtw88/rtw88xxa.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw88xxa.c
+@@ -1637,7 +1637,7 @@ void rtw88xxa_set_tx_power_index(struct
+ 	int rs, path;
+ 
+ 	for (path = 0; path < hal->rf_path_num; path++) {
+-		for (rs = 0; rs < RTW_RATE_SECTION_MAX; rs++) {
++		for (rs = 0; rs < RTW_RATE_SECTION_NUM; rs++) {
+ 			if (hal->rf_path_num == 1 &&
+ 			    (rs == RTW_RATE_SECTION_HT_2S ||
+ 			     rs == RTW_RATE_SECTION_VHT_2S))
+--- a/drivers/net/wireless/realtek/rtw88/sar.c
++++ b/drivers/net/wireless/realtek/rtw88/sar.c
+@@ -97,7 +97,7 @@ int rtw_set_sar_specs(struct rtw_dev *rt
+ 			power, BIT(RTW_COMMON_SAR_FCT));
+ 
+ 		for (j = 0; j < RTW_RF_PATH_MAX; j++) {
+-			for (k = 0; k < RTW_RATE_SECTION_MAX; k++) {
++			for (k = 0; k < RTW_RATE_SECTION_NUM; k++) {
+ 				arg = (struct rtw_sar_arg){
+ 					.sar_band = idx,
+ 					.path = j,

package/kernel/mac80211/patches/rtl/074-v6.15-wifi-rtw88-Extend-TX-power-stuff-for-3-4-spatial-str.patch

@@ -0,0 +1,369 @@
+From 0f98a59596579b34932c06aec7d52c1e835fa1f0 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Tue, 4 Feb 2025 20:41:43 +0200
+Subject: [PATCH] wifi: rtw88: Extend TX power stuff for 3-4 spatial streams
+
+Although the RTL8814AU only has 3 spatial streams, maybe some other chip
+has 4.
+
+Correct the TX power index and TX power limit calculations for 3SS and
+4SS HT/VHT rates.
+
+With this the RTL8814AU can set the TX power correctly.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/d0c0e126-0794-4c4e-9203-ea39a707b673@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/main.h     |   5 +
+ drivers/net/wireless/realtek/rtw88/phy.c      | 145 ++++++++++++------
+ drivers/net/wireless/realtek/rtw88/phy.h      |   4 +
+ drivers/net/wireless/realtek/rtw88/rtw8821c.c |   2 +-
+ drivers/net/wireless/realtek/rtw88/rtw8822b.c |   2 +-
+ drivers/net/wireless/realtek/rtw88/rtw8822c.c |   2 +-
+ drivers/net/wireless/realtek/rtw88/rtw88xxa.c |   2 +-
+ 7 files changed, 111 insertions(+), 51 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -166,6 +166,11 @@ enum rtw_rate_section {
+ 	RTW_RATE_SECTION_HT_2S,
+ 	RTW_RATE_SECTION_VHT_1S,
+ 	RTW_RATE_SECTION_VHT_2S,
++	__RTW_RATE_SECTION_2SS_MAX = RTW_RATE_SECTION_VHT_2S,
++	RTW_RATE_SECTION_HT_3S,
++	RTW_RATE_SECTION_HT_4S,
++	RTW_RATE_SECTION_VHT_3S,
++	RTW_RATE_SECTION_VHT_4S,
+ 
+ 	/* keep last */
+ 	RTW_RATE_SECTION_NUM,
+--- a/drivers/net/wireless/realtek/rtw88/phy.c
++++ b/drivers/net/wireless/realtek/rtw88/phy.c
+@@ -88,10 +88,40 @@ const u8 rtw_vht_2s_rates[] = {
+ 	DESC_RATEVHT2SS_MCS8, DESC_RATEVHT2SS_MCS9
+ };
+ 
++const u8 rtw_ht_3s_rates[] = {
++	DESC_RATEMCS16, DESC_RATEMCS17, DESC_RATEMCS18,
++	DESC_RATEMCS19, DESC_RATEMCS20, DESC_RATEMCS21,
++	DESC_RATEMCS22, DESC_RATEMCS23
++};
++
++const u8 rtw_ht_4s_rates[] = {
++	DESC_RATEMCS24, DESC_RATEMCS25, DESC_RATEMCS26,
++	DESC_RATEMCS27, DESC_RATEMCS28, DESC_RATEMCS29,
++	DESC_RATEMCS30, DESC_RATEMCS31
++};
++
++const u8 rtw_vht_3s_rates[] = {
++	DESC_RATEVHT3SS_MCS0, DESC_RATEVHT3SS_MCS1,
++	DESC_RATEVHT3SS_MCS2, DESC_RATEVHT3SS_MCS3,
++	DESC_RATEVHT3SS_MCS4, DESC_RATEVHT3SS_MCS5,
++	DESC_RATEVHT3SS_MCS6, DESC_RATEVHT3SS_MCS7,
++	DESC_RATEVHT3SS_MCS8, DESC_RATEVHT3SS_MCS9
++};
++
++const u8 rtw_vht_4s_rates[] = {
++	DESC_RATEVHT4SS_MCS0, DESC_RATEVHT4SS_MCS1,
++	DESC_RATEVHT4SS_MCS2, DESC_RATEVHT4SS_MCS3,
++	DESC_RATEVHT4SS_MCS4, DESC_RATEVHT4SS_MCS5,
++	DESC_RATEVHT4SS_MCS6, DESC_RATEVHT4SS_MCS7,
++	DESC_RATEVHT4SS_MCS8, DESC_RATEVHT4SS_MCS9
++};
++
+ const u8 * const rtw_rate_section[RTW_RATE_SECTION_NUM] = {
+ 	rtw_cck_rates, rtw_ofdm_rates,
+ 	rtw_ht_1s_rates, rtw_ht_2s_rates,
+-	rtw_vht_1s_rates, rtw_vht_2s_rates
++	rtw_vht_1s_rates, rtw_vht_2s_rates,
++	rtw_ht_3s_rates, rtw_ht_4s_rates,
++	rtw_vht_3s_rates, rtw_vht_4s_rates
+ };
+ EXPORT_SYMBOL(rtw_rate_section);
+ 
+@@ -101,17 +131,14 @@ const u8 rtw_rate_size[RTW_RATE_SECTION_
+ 	ARRAY_SIZE(rtw_ht_1s_rates),
+ 	ARRAY_SIZE(rtw_ht_2s_rates),
+ 	ARRAY_SIZE(rtw_vht_1s_rates),
+-	ARRAY_SIZE(rtw_vht_2s_rates)
++	ARRAY_SIZE(rtw_vht_2s_rates),
++	ARRAY_SIZE(rtw_ht_3s_rates),
++	ARRAY_SIZE(rtw_ht_4s_rates),
++	ARRAY_SIZE(rtw_vht_3s_rates),
++	ARRAY_SIZE(rtw_vht_4s_rates)
+ };
+ EXPORT_SYMBOL(rtw_rate_size);
+ 
+-static const u8 rtw_cck_size = ARRAY_SIZE(rtw_cck_rates);
+-static const u8 rtw_ofdm_size = ARRAY_SIZE(rtw_ofdm_rates);
+-static const u8 rtw_ht_1s_size = ARRAY_SIZE(rtw_ht_1s_rates);
+-static const u8 rtw_ht_2s_size = ARRAY_SIZE(rtw_ht_2s_rates);
+-static const u8 rtw_vht_1s_size = ARRAY_SIZE(rtw_vht_1s_rates);
+-static const u8 rtw_vht_2s_size = ARRAY_SIZE(rtw_vht_2s_rates);
+-
+ enum rtw_phy_band_type {
+ 	PHY_BAND_2G	= 0,
+ 	PHY_BAND_5G	= 1,
+@@ -1640,11 +1667,15 @@ rtw_xref_5g_txpwr_lmt(struct rtw_dev *rt
+ static void
+ rtw_xref_txpwr_lmt_by_rs(struct rtw_dev *rtwdev, u8 regd, u8 bw, u8 ch_idx)
+ {
++	static const u8 rs_cmp[4][2] = {
++		{RTW_RATE_SECTION_HT_1S, RTW_RATE_SECTION_VHT_1S},
++		{RTW_RATE_SECTION_HT_2S, RTW_RATE_SECTION_VHT_2S},
++		{RTW_RATE_SECTION_HT_3S, RTW_RATE_SECTION_VHT_3S},
++		{RTW_RATE_SECTION_HT_4S, RTW_RATE_SECTION_VHT_4S}
++	};
+ 	u8 rs_idx, rs_ht, rs_vht;
+-	u8 rs_cmp[2][2] = {{RTW_RATE_SECTION_HT_1S, RTW_RATE_SECTION_VHT_1S},
+-			   {RTW_RATE_SECTION_HT_2S, RTW_RATE_SECTION_VHT_2S} };
+ 
+-	for (rs_idx = 0; rs_idx < 2; rs_idx++) {
++	for (rs_idx = 0; rs_idx < 4; rs_idx++) {
+ 		rs_ht = rs_cmp[rs_idx][0];
+ 		rs_vht = rs_cmp[rs_idx][1];
+ 
+@@ -1965,10 +1996,10 @@ static u8 rtw_phy_get_2g_tx_power_index(
+ 					u8 rate, u8 group)
+ {
+ 	const struct rtw_chip_info *chip = rtwdev->chip;
+-	u8 tx_power;
+-	bool mcs_rate;
+-	bool above_2ss;
++	bool above_2ss, above_3ss, above_4ss;
+ 	u8 factor = chip->txgi_factor;
++	bool mcs_rate;
++	u8 tx_power;
+ 
+ 	if (rate <= DESC_RATE11M)
+ 		tx_power = pwr_idx_2g->cck_base[group];
+@@ -1978,11 +2009,15 @@ static u8 rtw_phy_get_2g_tx_power_index(
+ 	if (rate >= DESC_RATE6M && rate <= DESC_RATE54M)
+ 		tx_power += pwr_idx_2g->ht_1s_diff.ofdm * factor;
+ 
+-	mcs_rate = (rate >= DESC_RATEMCS0 && rate <= DESC_RATEMCS15) ||
++	mcs_rate = (rate >= DESC_RATEMCS0 && rate <= DESC_RATEMCS31) ||
+ 		   (rate >= DESC_RATEVHT1SS_MCS0 &&
+-		    rate <= DESC_RATEVHT2SS_MCS9);
+-	above_2ss = (rate >= DESC_RATEMCS8 && rate <= DESC_RATEMCS15) ||
++		    rate <= DESC_RATEVHT4SS_MCS9);
++	above_2ss = (rate >= DESC_RATEMCS8 && rate <= DESC_RATEMCS31) ||
+ 		    (rate >= DESC_RATEVHT2SS_MCS0);
++	above_3ss = (rate >= DESC_RATEMCS16 && rate <= DESC_RATEMCS31) ||
++		    (rate >= DESC_RATEVHT3SS_MCS0);
++	above_4ss = (rate >= DESC_RATEMCS24 && rate <= DESC_RATEMCS31) ||
++		    (rate >= DESC_RATEVHT4SS_MCS0);
+ 
+ 	if (!mcs_rate)
+ 		return tx_power;
+@@ -1995,11 +2030,19 @@ static u8 rtw_phy_get_2g_tx_power_index(
+ 		tx_power += pwr_idx_2g->ht_1s_diff.bw20 * factor;
+ 		if (above_2ss)
+ 			tx_power += pwr_idx_2g->ht_2s_diff.bw20 * factor;
++		if (above_3ss)
++			tx_power += pwr_idx_2g->ht_3s_diff.bw20 * factor;
++		if (above_4ss)
++			tx_power += pwr_idx_2g->ht_4s_diff.bw20 * factor;
+ 		break;
+ 	case RTW_CHANNEL_WIDTH_40:
+ 		/* bw40 is the base power */
+ 		if (above_2ss)
+ 			tx_power += pwr_idx_2g->ht_2s_diff.bw40 * factor;
++		if (above_3ss)
++			tx_power += pwr_idx_2g->ht_3s_diff.bw40 * factor;
++		if (above_4ss)
++			tx_power += pwr_idx_2g->ht_4s_diff.bw40 * factor;
+ 		break;
+ 	}
+ 
+@@ -2012,19 +2055,23 @@ static u8 rtw_phy_get_5g_tx_power_index(
+ 					u8 rate, u8 group)
+ {
+ 	const struct rtw_chip_info *chip = rtwdev->chip;
+-	u8 tx_power;
++	bool above_2ss, above_3ss, above_4ss;
++	u8 factor = chip->txgi_factor;
+ 	u8 upper, lower;
+ 	bool mcs_rate;
+-	bool above_2ss;
+-	u8 factor = chip->txgi_factor;
++	u8 tx_power;
+ 
+ 	tx_power = pwr_idx_5g->bw40_base[group];
+ 
+-	mcs_rate = (rate >= DESC_RATEMCS0 && rate <= DESC_RATEMCS15) ||
++	mcs_rate = (rate >= DESC_RATEMCS0 && rate <= DESC_RATEMCS31) ||
+ 		   (rate >= DESC_RATEVHT1SS_MCS0 &&
+-		    rate <= DESC_RATEVHT2SS_MCS9);
+-	above_2ss = (rate >= DESC_RATEMCS8 && rate <= DESC_RATEMCS15) ||
++		    rate <= DESC_RATEVHT4SS_MCS9);
++	above_2ss = (rate >= DESC_RATEMCS8 && rate <= DESC_RATEMCS31) ||
+ 		    (rate >= DESC_RATEVHT2SS_MCS0);
++	above_3ss = (rate >= DESC_RATEMCS16 && rate <= DESC_RATEMCS31) ||
++		    (rate >= DESC_RATEVHT3SS_MCS0);
++	above_4ss = (rate >= DESC_RATEMCS24 && rate <= DESC_RATEMCS31) ||
++		    (rate >= DESC_RATEVHT4SS_MCS0);
+ 
+ 	if (!mcs_rate) {
+ 		tx_power += pwr_idx_5g->ht_1s_diff.ofdm * factor;
+@@ -2039,11 +2086,19 @@ static u8 rtw_phy_get_5g_tx_power_index(
+ 		tx_power += pwr_idx_5g->ht_1s_diff.bw20 * factor;
+ 		if (above_2ss)
+ 			tx_power += pwr_idx_5g->ht_2s_diff.bw20 * factor;
++		if (above_3ss)
++			tx_power += pwr_idx_5g->ht_3s_diff.bw20 * factor;
++		if (above_4ss)
++			tx_power += pwr_idx_5g->ht_4s_diff.bw20 * factor;
+ 		break;
+ 	case RTW_CHANNEL_WIDTH_40:
+ 		/* bw40 is the base power */
+ 		if (above_2ss)
+ 			tx_power += pwr_idx_5g->ht_2s_diff.bw40 * factor;
++		if (above_3ss)
++			tx_power += pwr_idx_5g->ht_3s_diff.bw40 * factor;
++		if (above_4ss)
++			tx_power += pwr_idx_5g->ht_4s_diff.bw40 * factor;
+ 		break;
+ 	case RTW_CHANNEL_WIDTH_80:
+ 		/* the base idx of bw80 is the average of bw40+/bw40- */
+@@ -2054,6 +2109,10 @@ static u8 rtw_phy_get_5g_tx_power_index(
+ 		tx_power += pwr_idx_5g->vht_1s_diff.bw80 * factor;
+ 		if (above_2ss)
+ 			tx_power += pwr_idx_5g->vht_2s_diff.bw80 * factor;
++		if (above_3ss)
++			tx_power += pwr_idx_5g->vht_3s_diff.bw80 * factor;
++		if (above_4ss)
++			tx_power += pwr_idx_5g->vht_4s_diff.bw80 * factor;
+ 		break;
+ 	}
+ 
+@@ -2071,10 +2130,18 @@ static u8 rtw_phy_rate_to_rate_section(u
+ 		return RTW_RATE_SECTION_HT_1S;
+ 	else if (rate >= DESC_RATEMCS8 && rate <= DESC_RATEMCS15)
+ 		return RTW_RATE_SECTION_HT_2S;
++	else if (rate >= DESC_RATEMCS16 && rate <= DESC_RATEMCS23)
++		return RTW_RATE_SECTION_HT_3S;
++	else if (rate >= DESC_RATEMCS24 && rate <= DESC_RATEMCS31)
++		return RTW_RATE_SECTION_HT_4S;
+ 	else if (rate >= DESC_RATEVHT1SS_MCS0 && rate <= DESC_RATEVHT1SS_MCS9)
+ 		return RTW_RATE_SECTION_VHT_1S;
+ 	else if (rate >= DESC_RATEVHT2SS_MCS0 && rate <= DESC_RATEVHT2SS_MCS9)
+ 		return RTW_RATE_SECTION_VHT_2S;
++	else if (rate >= DESC_RATEVHT3SS_MCS0 && rate <= DESC_RATEVHT3SS_MCS9)
++		return RTW_RATE_SECTION_VHT_3S;
++	else if (rate >= DESC_RATEVHT4SS_MCS0 && rate <= DESC_RATEVHT4SS_MCS9)
++		return RTW_RATE_SECTION_VHT_4S;
+ 	else
+ 		return RTW_RATE_SECTION_NUM;
+ }
+@@ -2102,7 +2169,7 @@ static s8 rtw_phy_get_tx_power_limit(str
+ 		bw = RTW_CHANNEL_WIDTH_20;
+ 
+ 	/* only 20/40M BW with ht */
+-	if (rs == RTW_RATE_SECTION_HT_1S || rs == RTW_RATE_SECTION_HT_2S)
++	if (rate >= DESC_RATEMCS0 && rate <= DESC_RATEMCS31)
+ 		bw = min_t(u8, bw, RTW_CHANNEL_WIDTH_40);
+ 
+ 	/* select min power limit among [20M BW ~ current BW] */
+@@ -2286,7 +2353,7 @@ rtw_phy_tx_power_by_rate_config_by_path(
+ 	u8 base_idx, rate_idx;
+ 	s8 base_2g, base_5g;
+ 
+-	if (rs >= RTW_RATE_SECTION_VHT_1S)
++	if (size == 10) /* VHT rates */
+ 		base_idx = rates[size - 3];
+ 	else
+ 		base_idx = rates[size - 1];
+@@ -2303,28 +2370,12 @@ rtw_phy_tx_power_by_rate_config_by_path(
+ 
+ void rtw_phy_tx_power_by_rate_config(struct rtw_hal *hal)
+ {
+-	u8 path;
++	u8 path, rs;
+ 
+-	for (path = 0; path < RTW_RF_PATH_MAX; path++) {
+-		rtw_phy_tx_power_by_rate_config_by_path(hal, path,
+-				RTW_RATE_SECTION_CCK,
+-				rtw_cck_size, rtw_cck_rates);
+-		rtw_phy_tx_power_by_rate_config_by_path(hal, path,
+-				RTW_RATE_SECTION_OFDM,
+-				rtw_ofdm_size, rtw_ofdm_rates);
+-		rtw_phy_tx_power_by_rate_config_by_path(hal, path,
+-				RTW_RATE_SECTION_HT_1S,
+-				rtw_ht_1s_size, rtw_ht_1s_rates);
+-		rtw_phy_tx_power_by_rate_config_by_path(hal, path,
+-				RTW_RATE_SECTION_HT_2S,
+-				rtw_ht_2s_size, rtw_ht_2s_rates);
+-		rtw_phy_tx_power_by_rate_config_by_path(hal, path,
+-				RTW_RATE_SECTION_VHT_1S,
+-				rtw_vht_1s_size, rtw_vht_1s_rates);
+-		rtw_phy_tx_power_by_rate_config_by_path(hal, path,
+-				RTW_RATE_SECTION_VHT_2S,
+-				rtw_vht_2s_size, rtw_vht_2s_rates);
+-	}
++	for (path = 0; path < RTW_RF_PATH_MAX; path++)
++		for (rs = 0; rs < RTW_RATE_SECTION_NUM; rs++)
++			rtw_phy_tx_power_by_rate_config_by_path(hal, path, rs,
++				rtw_rate_size[rs], rtw_rate_section[rs]);
+ }
+ 
+ static void
+--- a/drivers/net/wireless/realtek/rtw88/phy.h
++++ b/drivers/net/wireless/realtek/rtw88/phy.h
+@@ -13,6 +13,10 @@ extern const u8 rtw_ht_1s_rates[];
+ extern const u8 rtw_ht_2s_rates[];
+ extern const u8 rtw_vht_1s_rates[];
+ extern const u8 rtw_vht_2s_rates[];
++extern const u8 rtw_ht_3s_rates[];
++extern const u8 rtw_ht_4s_rates[];
++extern const u8 rtw_vht_3s_rates[];
++extern const u8 rtw_vht_4s_rates[];
+ extern const u8 * const rtw_rate_section[];
+ extern const u8 rtw_rate_size[];
+ 
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821c.c
+@@ -709,7 +709,7 @@ static void rtw8821c_set_tx_power_index(
+ 	int rs, path;
+ 
+ 	for (path = 0; path < hal->rf_path_num; path++) {
+-		for (rs = 0; rs < RTW_RATE_SECTION_NUM; rs++) {
++		for (rs = 0; rs <= __RTW_RATE_SECTION_2SS_MAX; rs++) {
+ 			if (rs == RTW_RATE_SECTION_HT_2S ||
+ 			    rs == RTW_RATE_SECTION_VHT_2S)
+ 				continue;
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
+@@ -964,7 +964,7 @@ static void rtw8822b_set_tx_power_index(
+ 	int rs, path;
+ 
+ 	for (path = 0; path < hal->rf_path_num; path++) {
+-		for (rs = 0; rs < RTW_RATE_SECTION_NUM; rs++)
++		for (rs = 0; rs <= __RTW_RATE_SECTION_2SS_MAX; rs++)
+ 			rtw8822b_set_tx_power_index_by_rate(rtwdev, path, rs,
+ 							    &phy_pwr_idx);
+ 	}
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
+@@ -2746,7 +2746,7 @@ static void rtw8822c_set_tx_power_index(
+ 	s8 diff_idx[4];
+ 
+ 	rtw8822c_set_write_tx_power_ref(rtwdev, pwr_ref_cck, pwr_ref_ofdm);
+-	for (rs = 0; rs < RTW_RATE_SECTION_NUM; rs++) {
++	for (rs = 0; rs <= __RTW_RATE_SECTION_2SS_MAX; rs++) {
+ 		for (j = 0; j < rtw_rate_size[rs]; j++) {
+ 			rate = rtw_rate_section[rs][j];
+ 			pwr_a = hal->tx_pwr_tbl[RF_PATH_A][rate];
+--- a/drivers/net/wireless/realtek/rtw88/rtw88xxa.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw88xxa.c
+@@ -1637,7 +1637,7 @@ void rtw88xxa_set_tx_power_index(struct
+ 	int rs, path;
+ 
+ 	for (path = 0; path < hal->rf_path_num; path++) {
+-		for (rs = 0; rs < RTW_RATE_SECTION_NUM; rs++) {
++		for (rs = 0; rs <= __RTW_RATE_SECTION_2SS_MAX; rs++) {
+ 			if (hal->rf_path_num == 1 &&
+ 			    (rs == RTW_RATE_SECTION_HT_2S ||
+ 			     rs == RTW_RATE_SECTION_VHT_2S))

package/kernel/mac80211/patches/rtl/075-v6.14.9-wifi-rtw88-Fix-rtw_update_sta_info-for-RTL8814AU.patch

@@ -0,0 +1,61 @@
+From 9f00e2218e15a2ea3c284567424a100c10b6fb85 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Tue, 4 Feb 2025 20:42:08 +0200
+Subject: [PATCH] wifi: rtw88: Fix rtw_update_sta_info() for RTL8814AU
+
+This function tells the firmware what rates it can use.
+
+Put the 3SS and 4SS HT rates supported by the other station into the
+rate mask.
+
+Remove the 3SS and 4SS rates from the rate mask if the hardware only has
+2 spatial streams.
+
+And finally, select the right rate ID (a parameter for the firmware)
+when the hardware has 3 spatial streams.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/48d1d90f-2aeb-4ec5-9a24-0980e10eae1e@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/main.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -1234,7 +1234,9 @@ void rtw_update_sta_info(struct rtw_dev
+ 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC)
+ 			ldpc_en = VHT_LDPC_EN;
+ 	} else if (sta->deflink.ht_cap.ht_supported) {
+-		ra_mask |= (sta->deflink.ht_cap.mcs.rx_mask[1] << 20) |
++		ra_mask |= ((u64)sta->deflink.ht_cap.mcs.rx_mask[3] << 36) |
++			   ((u64)sta->deflink.ht_cap.mcs.rx_mask[2] << 28) |
++			   (sta->deflink.ht_cap.mcs.rx_mask[1] << 20) |
+ 			   (sta->deflink.ht_cap.mcs.rx_mask[0] << 12);
+ 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
+ 			stbc_en = HT_STBC_EN;
+@@ -1244,6 +1246,9 @@ void rtw_update_sta_info(struct rtw_dev
+ 
+ 	if (efuse->hw_cap.nss == 1 || rtwdev->hal.txrx_1ss)
+ 		ra_mask &= RA_MASK_VHT_RATES_1SS | RA_MASK_HT_RATES_1SS;
++	else if (efuse->hw_cap.nss == 2)
++		ra_mask &= RA_MASK_VHT_RATES_2SS | RA_MASK_HT_RATES_2SS |
++			   RA_MASK_VHT_RATES_1SS | RA_MASK_HT_RATES_1SS;
+ 
+ 	if (hal->current_band_type == RTW_BAND_5G) {
+ 		ra_mask |= (u64)sta->deflink.supp_rates[NL80211_BAND_5GHZ] << 4;
+@@ -1302,10 +1307,9 @@ void rtw_update_sta_info(struct rtw_dev
+ 		break;
+ 	}
+ 
+-	if (sta->deflink.vht_cap.vht_supported && ra_mask & 0xffc00000)
+-		tx_num = 2;
+-	else if (sta->deflink.ht_cap.ht_supported && ra_mask & 0xfff00000)
+-		tx_num = 2;
++	if (sta->deflink.vht_cap.vht_supported ||
++	    sta->deflink.ht_cap.ht_supported)
++		tx_num = efuse->hw_cap.nss;
+ 
+ 	rate_id = get_rate_id(wireless_set, bw_mode, tx_num);
+ 

package/kernel/mac80211/patches/rtl/076-v6.14-wifi-rtw88-Add-support-for-Mercusys-MA30N-and-D-Link.patch

@@ -0,0 +1,31 @@
+From 80c4668d024ff7b5427d90b5fad655ce9461c7b1 Mon Sep 17 00:00:00 2001
+From: Zenm Chen <zenmchen@gmail.com>
+Date: Mon, 10 Feb 2025 15:36:10 +0800
+Subject: [PATCH] wifi: rtw88: Add support for Mercusys MA30N and D-Link
+ DWA-T185 rev. A1
+
+Add two more USB IDs found in
+https://github.com/RinCat/RTL88x2BU-Linux-Driver
+to support Mercusys MA30N and D-Link DWA-T185 rev. A1.
+
+Signed-off-by: Zenm Chen <zenmchen@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250210073610.4174-1-zenmchen@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/rtw8822bu.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822bu.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822bu.c
+@@ -73,6 +73,10 @@ static const struct usb_device_id rtw_88
+ 	  .driver_info = (kernel_ulong_t)&(rtw8822b_hw_spec) }, /* ELECOM WDB-867DU3S */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x2c4e, 0x0107, 0xff, 0xff, 0xff),
+ 	  .driver_info = (kernel_ulong_t)&(rtw8822b_hw_spec) }, /* Mercusys MA30H */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2c4e, 0x010a, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8822b_hw_spec) }, /* Mercusys MA30N */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3322, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8822b_hw_spec) }, /* D-Link DWA-T185 rev. A1 */
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(usb, rtw_8822bu_id_table);

package/kernel/mac80211/patches/rtl/077-v6.14.9-wifi-rtw88-Fix-rtw_mac_power_switch-for-RTL8814AU.patch

@@ -0,0 +1,27 @@
+From e66bca16638ee59e997f9d9a3711b3ae587d04d9 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Tue, 18 Feb 2025 01:28:59 +0200
+Subject: [PATCH] wifi: rtw88: Fix rtw_mac_power_switch() for RTL8814AU
+
+rtw_mac_power_switch() checks bit 8 of REG_SYS_STATUS1 to see if the
+chip is powered on. This bit appears to be always on in the RTL8814AU,
+so ignore it.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/2f0fcffb-3067-4d95-a68c-f2f3a5a47921@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/mac.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/realtek/rtw88/mac.c
++++ b/drivers/net/wireless/realtek/rtw88/mac.c
+@@ -291,6 +291,7 @@ static int rtw_mac_power_switch(struct r
+ 	if (rtw_read8(rtwdev, REG_CR) == 0xea)
+ 		cur_pwr = false;
+ 	else if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_USB &&
++		 chip->id != RTW_CHIP_TYPE_8814A &&
+ 		 (rtw_read8(rtwdev, REG_SYS_STATUS1 + 1) & BIT(0)))
+ 		cur_pwr = false;
+ 	else

package/kernel/mac80211/patches/rtl/078-v6.14.9-wifi-rtw88-Fix-rtw_desc_to_mcsrate-to-handle-MCS16-3.patch

@@ -0,0 +1,32 @@
+From 86d04f8f991a0509e318fe886d5a1cf795736c7d Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Tue, 18 Feb 2025 01:29:52 +0200
+Subject: [PATCH] wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31
+
+This function translates the rate number reported by the hardware into
+something mac80211 can understand. It was ignoring the 3SS and 4SS HT
+rates. Translate them too.
+
+Also set *nss to 0 for the HT rates, just to make sure it's
+initialised.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/d0a5a86b-4869-47f6-a5a7-01c0f987cc7f@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/util.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/util.c
++++ b/drivers/net/wireless/realtek/rtw88/util.c
+@@ -101,7 +101,8 @@ void rtw_desc_to_mcsrate(u16 rate, u8 *m
+ 		*nss = 4;
+ 		*mcs = rate - DESC_RATEVHT4SS_MCS0;
+ 	} else if (rate >= DESC_RATEMCS0 &&
+-		   rate <= DESC_RATEMCS15) {
++		   rate <= DESC_RATEMCS31) {
++		*nss = 0;
+ 		*mcs = rate - DESC_RATEMCS0;
+ 	}
+ }

package/kernel/mac80211/patches/rtl/079-v6.14.9-wifi-rtw88-Fix-rtw_init_ht_cap-for-RTL8814AU.patch

@@ -0,0 +1,49 @@
+From c7eea1ba05ca5b0dbf77a27cf2e1e6e2fb3c0043 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Tue, 18 Feb 2025 01:30:22 +0200
+Subject: [PATCH] wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU
+
+Set the RX mask and the highest RX rate according to the number of
+spatial streams the chip can receive. For RTL8814AU that is 3.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/4e786f50-ed1c-4387-8b28-e6ff00e35e81@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/main.c | 17 ++++++-----------
+ 1 file changed, 6 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -1565,6 +1565,7 @@ static void rtw_init_ht_cap(struct rtw_d
+ {
+ 	const struct rtw_chip_info *chip = rtwdev->chip;
+ 	struct rtw_efuse *efuse = &rtwdev->efuse;
++	int i;
+ 
+ 	ht_cap->ht_supported = true;
+ 	ht_cap->cap = 0;
+@@ -1584,17 +1585,11 @@ static void rtw_init_ht_cap(struct rtw_d
+ 	ht_cap->ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
+ 	ht_cap->ampdu_density = chip->ampdu_density;
+ 	ht_cap->mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
+-	if (efuse->hw_cap.nss > 1) {
+-		ht_cap->mcs.rx_mask[0] = 0xFF;
+-		ht_cap->mcs.rx_mask[1] = 0xFF;
+-		ht_cap->mcs.rx_mask[4] = 0x01;
+-		ht_cap->mcs.rx_highest = cpu_to_le16(300);
+-	} else {
+-		ht_cap->mcs.rx_mask[0] = 0xFF;
+-		ht_cap->mcs.rx_mask[1] = 0x00;
+-		ht_cap->mcs.rx_mask[4] = 0x01;
+-		ht_cap->mcs.rx_highest = cpu_to_le16(150);
+-	}
++
++	for (i = 0; i < efuse->hw_cap.nss; i++)
++		ht_cap->mcs.rx_mask[i] = 0xFF;
++	ht_cap->mcs.rx_mask[4] = 0x01;
++	ht_cap->mcs.rx_highest = cpu_to_le16(150 * efuse->hw_cap.nss);
+ }
+ 
+ static void rtw_init_vht_cap(struct rtw_dev *rtwdev,

package/kernel/mac80211/patches/rtl/080-v6.14.9-wifi-rtw88-Fix-rtw_init_vht_cap-for-RTL8814AU.patch

@@ -0,0 +1,58 @@
+From 6be7544d19fcfcb729495e793bc6181f85bb8949 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Tue, 18 Feb 2025 01:30:48 +0200
+Subject: [PATCH] wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU
+
+Set the MCS maps and the highest rates according to the number of
+spatial streams the chip has. For RTL8814AU that is 3.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/e86aa009-b5bf-4b3a-8112-ea5e3cd49465@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/main.c | 23 +++++++++--------------
+ 1 file changed, 9 insertions(+), 14 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -1596,8 +1596,9 @@ static void rtw_init_vht_cap(struct rtw_
+ 			     struct ieee80211_sta_vht_cap *vht_cap)
+ {
+ 	struct rtw_efuse *efuse = &rtwdev->efuse;
+-	u16 mcs_map;
++	u16 mcs_map = 0;
+ 	__le16 highest;
++	int i;
+ 
+ 	if (efuse->hw_cap.ptcl != EFUSE_HW_CAP_IGNORE &&
+ 	    efuse->hw_cap.ptcl != EFUSE_HW_CAP_PTCL_VHT)
+@@ -1620,21 +1621,15 @@ static void rtw_init_vht_cap(struct rtw_
+ 	if (rtw_chip_has_rx_ldpc(rtwdev))
+ 		vht_cap->cap |= IEEE80211_VHT_CAP_RXLDPC;
+ 
+-	mcs_map = IEEE80211_VHT_MCS_SUPPORT_0_9 << 0 |
+-		  IEEE80211_VHT_MCS_NOT_SUPPORTED << 4 |
+-		  IEEE80211_VHT_MCS_NOT_SUPPORTED << 6 |
+-		  IEEE80211_VHT_MCS_NOT_SUPPORTED << 8 |
+-		  IEEE80211_VHT_MCS_NOT_SUPPORTED << 10 |
+-		  IEEE80211_VHT_MCS_NOT_SUPPORTED << 12 |
+-		  IEEE80211_VHT_MCS_NOT_SUPPORTED << 14;
+-	if (efuse->hw_cap.nss > 1) {
+-		highest = cpu_to_le16(780);
+-		mcs_map |= IEEE80211_VHT_MCS_SUPPORT_0_9 << 2;
+-	} else {
+-		highest = cpu_to_le16(390);
+-		mcs_map |= IEEE80211_VHT_MCS_NOT_SUPPORTED << 2;
++	for (i = 0; i < 8; i++) {
++		if (i < efuse->hw_cap.nss)
++			mcs_map |= IEEE80211_VHT_MCS_SUPPORT_0_9 << (i * 2);
++		else
++			mcs_map |= IEEE80211_VHT_MCS_NOT_SUPPORTED << (i * 2);
+ 	}
+ 
++	highest = cpu_to_le16(390 * efuse->hw_cap.nss);
++
+ 	vht_cap->vht_mcs.rx_mcs_map = cpu_to_le16(mcs_map);
+ 	vht_cap->vht_mcs.tx_mcs_map = cpu_to_le16(mcs_map);
+ 	vht_cap->vht_mcs.rx_highest = highest;

package/kernel/mac80211/patches/rtl/081-v6.15-wifi-rtw88-Fix-rtw_rx_phy_stat-for-RTL8814AU.patch

@@ -0,0 +1,54 @@
+From 053a7aace0207593776c729f229d87f1be464b98 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Tue, 18 Feb 2025 01:31:13 +0200
+Subject: [PATCH] wifi: rtw88: Fix rtw_rx_phy_stat() for RTL8814AU
+
+Record statistics for the 3SS rates too.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/39e3c7cf-37ed-4c0e-af00-dcd9eab351f0@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/main.h | 7 +++++++
+ drivers/net/wireless/realtek/rtw88/rx.c   | 6 ++++++
+ 2 files changed, 13 insertions(+)
+
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -386,6 +386,9 @@ enum rtw_evm {
+ 	RTW_EVM_1SS,
+ 	RTW_EVM_2SS_A,
+ 	RTW_EVM_2SS_B,
++	RTW_EVM_3SS_A,
++	RTW_EVM_3SS_B,
++	RTW_EVM_3SS_C,
+ 	/* keep it last */
+ 	RTW_EVM_NUM
+ };
+@@ -403,6 +406,10 @@ enum rtw_snr {
+ 	RTW_SNR_2SS_B,
+ 	RTW_SNR_2SS_C,
+ 	RTW_SNR_2SS_D,
++	RTW_SNR_3SS_A,
++	RTW_SNR_3SS_B,
++	RTW_SNR_3SS_C,
++	RTW_SNR_3SS_D,
+ 	/* keep it last */
+ 	RTW_SNR_NUM
+ };
+--- a/drivers/net/wireless/realtek/rtw88/rx.c
++++ b/drivers/net/wireless/realtek/rtw88/rx.c
+@@ -73,6 +73,12 @@ static void rtw_rx_phy_stat(struct rtw_d
+ 		rate_ss_evm = 2;
+ 		evm_id = RTW_EVM_2SS_A;
+ 		break;
++	case DESC_RATEMCS16...DESC_RATEMCS23:
++	case DESC_RATEVHT3SS_MCS0...DESC_RATEVHT3SS_MCS9:
++		rate_ss = 3;
++		rate_ss_evm = 3;
++		evm_id = RTW_EVM_3SS_A;
++		break;
+ 	default:
+ 		rtw_warn(rtwdev, "unknown pkt rate = %d\n", pkt_stat->rate);
+ 		return;

package/kernel/mac80211/patches/rtl/082-v6.15-wifi-rtw88-Extend-rtw_phy_config_swing_table-for-RTL.patch

@@ -0,0 +1,75 @@
+From 8b42c46cf6656ef3c2f6d1ec0f113753c6875712 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Tue, 18 Feb 2025 01:31:51 +0200
+Subject: [PATCH] wifi: rtw88: Extend rtw_phy_config_swing_table() for
+ RTL8814AU
+
+Select the TX power tracking tables for RF paths C and D as well.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/e1e532c9-8733-4ec8-84fe-ced4af6c08da@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/phy.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+--- a/drivers/net/wireless/realtek/rtw88/phy.c
++++ b/drivers/net/wireless/realtek/rtw88/phy.c
+@@ -2458,32 +2458,56 @@ void rtw_phy_config_swing_table(struct r
+ 			swing_table->n[RF_PATH_A] = tbl->pwrtrk_2g_ccka_n;
+ 			swing_table->p[RF_PATH_B] = tbl->pwrtrk_2g_cckb_p;
+ 			swing_table->n[RF_PATH_B] = tbl->pwrtrk_2g_cckb_n;
++			swing_table->p[RF_PATH_C] = tbl->pwrtrk_2g_cckc_p;
++			swing_table->n[RF_PATH_C] = tbl->pwrtrk_2g_cckc_n;
++			swing_table->p[RF_PATH_D] = tbl->pwrtrk_2g_cckd_p;
++			swing_table->n[RF_PATH_D] = tbl->pwrtrk_2g_cckd_n;
+ 		} else {
+ 			swing_table->p[RF_PATH_A] = tbl->pwrtrk_2ga_p;
+ 			swing_table->n[RF_PATH_A] = tbl->pwrtrk_2ga_n;
+ 			swing_table->p[RF_PATH_B] = tbl->pwrtrk_2gb_p;
+ 			swing_table->n[RF_PATH_B] = tbl->pwrtrk_2gb_n;
++			swing_table->p[RF_PATH_C] = tbl->pwrtrk_2gc_p;
++			swing_table->n[RF_PATH_C] = tbl->pwrtrk_2gc_n;
++			swing_table->p[RF_PATH_D] = tbl->pwrtrk_2gd_p;
++			swing_table->n[RF_PATH_D] = tbl->pwrtrk_2gd_n;
+ 		}
+ 	} else if (IS_CH_5G_BAND_1(channel) || IS_CH_5G_BAND_2(channel)) {
+ 		swing_table->p[RF_PATH_A] = tbl->pwrtrk_5ga_p[RTW_PWR_TRK_5G_1];
+ 		swing_table->n[RF_PATH_A] = tbl->pwrtrk_5ga_n[RTW_PWR_TRK_5G_1];
+ 		swing_table->p[RF_PATH_B] = tbl->pwrtrk_5gb_p[RTW_PWR_TRK_5G_1];
+ 		swing_table->n[RF_PATH_B] = tbl->pwrtrk_5gb_n[RTW_PWR_TRK_5G_1];
++		swing_table->p[RF_PATH_C] = tbl->pwrtrk_5gc_p[RTW_PWR_TRK_5G_1];
++		swing_table->n[RF_PATH_C] = tbl->pwrtrk_5gc_n[RTW_PWR_TRK_5G_1];
++		swing_table->p[RF_PATH_D] = tbl->pwrtrk_5gd_p[RTW_PWR_TRK_5G_1];
++		swing_table->n[RF_PATH_D] = tbl->pwrtrk_5gd_n[RTW_PWR_TRK_5G_1];
+ 	} else if (IS_CH_5G_BAND_3(channel)) {
+ 		swing_table->p[RF_PATH_A] = tbl->pwrtrk_5ga_p[RTW_PWR_TRK_5G_2];
+ 		swing_table->n[RF_PATH_A] = tbl->pwrtrk_5ga_n[RTW_PWR_TRK_5G_2];
+ 		swing_table->p[RF_PATH_B] = tbl->pwrtrk_5gb_p[RTW_PWR_TRK_5G_2];
+ 		swing_table->n[RF_PATH_B] = tbl->pwrtrk_5gb_n[RTW_PWR_TRK_5G_2];
++		swing_table->p[RF_PATH_C] = tbl->pwrtrk_5gc_p[RTW_PWR_TRK_5G_2];
++		swing_table->n[RF_PATH_C] = tbl->pwrtrk_5gc_n[RTW_PWR_TRK_5G_2];
++		swing_table->p[RF_PATH_D] = tbl->pwrtrk_5gd_p[RTW_PWR_TRK_5G_2];
++		swing_table->n[RF_PATH_D] = tbl->pwrtrk_5gd_n[RTW_PWR_TRK_5G_2];
+ 	} else if (IS_CH_5G_BAND_4(channel)) {
+ 		swing_table->p[RF_PATH_A] = tbl->pwrtrk_5ga_p[RTW_PWR_TRK_5G_3];
+ 		swing_table->n[RF_PATH_A] = tbl->pwrtrk_5ga_n[RTW_PWR_TRK_5G_3];
+ 		swing_table->p[RF_PATH_B] = tbl->pwrtrk_5gb_p[RTW_PWR_TRK_5G_3];
+ 		swing_table->n[RF_PATH_B] = tbl->pwrtrk_5gb_n[RTW_PWR_TRK_5G_3];
++		swing_table->p[RF_PATH_C] = tbl->pwrtrk_5gc_p[RTW_PWR_TRK_5G_3];
++		swing_table->n[RF_PATH_C] = tbl->pwrtrk_5gc_n[RTW_PWR_TRK_5G_3];
++		swing_table->p[RF_PATH_D] = tbl->pwrtrk_5gd_p[RTW_PWR_TRK_5G_3];
++		swing_table->n[RF_PATH_D] = tbl->pwrtrk_5gd_n[RTW_PWR_TRK_5G_3];
+ 	} else {
+ 		swing_table->p[RF_PATH_A] = tbl->pwrtrk_2ga_p;
+ 		swing_table->n[RF_PATH_A] = tbl->pwrtrk_2ga_n;
+ 		swing_table->p[RF_PATH_B] = tbl->pwrtrk_2gb_p;
+ 		swing_table->n[RF_PATH_B] = tbl->pwrtrk_2gb_n;
++		swing_table->p[RF_PATH_C] = tbl->pwrtrk_2gc_p;
++		swing_table->n[RF_PATH_C] = tbl->pwrtrk_2gc_n;
++		swing_table->p[RF_PATH_D] = tbl->pwrtrk_2gd_p;
++		swing_table->n[RF_PATH_D] = tbl->pwrtrk_2gd_n;
+ 	}
+ }
+ EXPORT_SYMBOL(rtw_phy_config_swing_table);

package/kernel/mac80211/patches/rtl/083-v6.15-wifi-rtw88-Extend-rtw_debugfs_get_phy_info-for-RTL88.patch

@@ -0,0 +1,86 @@
+From cfebabdd351e9cbafdc99cb198db482208ec5ad9 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Tue, 18 Feb 2025 01:32:15 +0200
+Subject: [PATCH] wifi: rtw88: Extend rtw_debugfs_get_phy_info() for RTL8814AU
+
+Print information about the 3rd and 4th RF paths and about the 3rd
+spatial stream.
+
+Also, fix a small bug: don't show the average SNR and EVM for the OFDM
+and HT/VHT rates when the rate is actually CCK 11M.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/7c8e94e2-e034-40f3-bdaf-b000018b5573@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/debug.c | 37 +++++++++++++++-------
+ 1 file changed, 26 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/debug.c
++++ b/drivers/net/wireless/realtek/rtw88/debug.c
+@@ -654,10 +654,10 @@ static void rtw_print_rate(struct seq_fi
+ 	case DESC_RATE6M...DESC_RATE54M:
+ 		rtw_print_ofdm_rate_txt(m, rate);
+ 		break;
+-	case DESC_RATEMCS0...DESC_RATEMCS15:
++	case DESC_RATEMCS0...DESC_RATEMCS31:
+ 		rtw_print_ht_rate_txt(m, rate);
+ 		break;
+-	case DESC_RATEVHT1SS_MCS0...DESC_RATEVHT2SS_MCS9:
++	case DESC_RATEVHT1SS_MCS0...DESC_RATEVHT4SS_MCS9:
+ 		rtw_print_vht_rate_txt(m, rate);
+ 		break;
+ 	default:
+@@ -849,20 +849,28 @@ static int rtw_debugfs_get_phy_info(stru
+ 			   last_cnt->num_qry_pkt[rate_id + 9]);
+ 	}
+ 
+-	seq_printf(m, "[RSSI(dBm)] = {%d, %d}\n",
++	seq_printf(m, "[RSSI(dBm)] = {%d, %d, %d, %d}\n",
+ 		   dm_info->rssi[RF_PATH_A] - 100,
+-		   dm_info->rssi[RF_PATH_B] - 100);
+-	seq_printf(m, "[Rx EVM(dB)] = {-%d, -%d}\n",
++		   dm_info->rssi[RF_PATH_B] - 100,
++		   dm_info->rssi[RF_PATH_C] - 100,
++		   dm_info->rssi[RF_PATH_D] - 100);
++	seq_printf(m, "[Rx EVM(dB)] = {-%d, -%d, -%d, -%d}\n",
+ 		   dm_info->rx_evm_dbm[RF_PATH_A],
+-		   dm_info->rx_evm_dbm[RF_PATH_B]);
+-	seq_printf(m, "[Rx SNR] = {%d, %d}\n",
++		   dm_info->rx_evm_dbm[RF_PATH_B],
++		   dm_info->rx_evm_dbm[RF_PATH_C],
++		   dm_info->rx_evm_dbm[RF_PATH_D]);
++	seq_printf(m, "[Rx SNR] = {%d, %d, %d, %d}\n",
+ 		   dm_info->rx_snr[RF_PATH_A],
+-		   dm_info->rx_snr[RF_PATH_B]);
+-	seq_printf(m, "[CFO_tail(KHz)] = {%d, %d}\n",
++		   dm_info->rx_snr[RF_PATH_B],
++		   dm_info->rx_snr[RF_PATH_C],
++		   dm_info->rx_snr[RF_PATH_D]);
++	seq_printf(m, "[CFO_tail(KHz)] = {%d, %d, %d, %d}\n",
+ 		   dm_info->cfo_tail[RF_PATH_A],
+-		   dm_info->cfo_tail[RF_PATH_B]);
++		   dm_info->cfo_tail[RF_PATH_B],
++		   dm_info->cfo_tail[RF_PATH_C],
++		   dm_info->cfo_tail[RF_PATH_D]);
+ 
+-	if (dm_info->curr_rx_rate >= DESC_RATE11M) {
++	if (dm_info->curr_rx_rate >= DESC_RATE6M) {
+ 		seq_puts(m, "[Rx Average Status]:\n");
+ 		seq_printf(m, " * OFDM, EVM: {-%d}, SNR: {%d}\n",
+ 			   (u8)ewma_evm_read(&ewma_evm[RTW_EVM_OFDM]),
+@@ -875,6 +883,13 @@ static int rtw_debugfs_get_phy_info(stru
+ 			   (u8)ewma_evm_read(&ewma_evm[RTW_EVM_2SS_B]),
+ 			   (u8)ewma_snr_read(&ewma_snr[RTW_SNR_2SS_A]),
+ 			   (u8)ewma_snr_read(&ewma_snr[RTW_SNR_2SS_B]));
++		seq_printf(m, " * 3SS, EVM: {-%d, -%d, -%d}, SNR: {%d, %d, %d}\n",
++			   (u8)ewma_evm_read(&ewma_evm[RTW_EVM_3SS_A]),
++			   (u8)ewma_evm_read(&ewma_evm[RTW_EVM_3SS_B]),
++			   (u8)ewma_evm_read(&ewma_evm[RTW_EVM_3SS_C]),
++			   (u8)ewma_snr_read(&ewma_snr[RTW_SNR_3SS_A]),
++			   (u8)ewma_snr_read(&ewma_snr[RTW_SNR_3SS_B]),
++			   (u8)ewma_snr_read(&ewma_snr[RTW_SNR_3SS_C]));
+ 	}
+ 
+ 	seq_puts(m, "[Rx Counter]:\n");

package/kernel/mac80211/patches/rtl/084-v6.15-wifi-rtw88-Extend-rtw_debugfs_get_tx_pwr_tbl-for-RTL.patch

@@ -0,0 +1,65 @@
+From c374281f828545b3698cf936b584249c2f9e40c5 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Tue, 18 Feb 2025 01:32:49 +0200
+Subject: [PATCH] wifi: rtw88: Extend rtw_debugfs_get_tx_pwr_tbl() for
+ RTL8814AU
+
+Make it print the TX power details for all RF paths, not just A and B,
+and for all the rates supported by the chip, not just 1SS and 2SS
+rates.
+
+Also skip the RF paths and rates not supported by the chip.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/ea65a978-a735-4c97-af82-d7fe26f95da1@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/debug.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/debug.c
++++ b/drivers/net/wireless/realtek/rtw88/debug.c
+@@ -692,9 +692,11 @@ static int rtw_debugfs_get_tx_pwr_tbl(st
+ {
+ 	struct rtw_debugfs_priv *debugfs_priv = m->private;
+ 	struct rtw_dev *rtwdev = debugfs_priv->rtwdev;
++	struct rtw_power_params pwr_param = {0};
+ 	struct rtw_hal *hal = &rtwdev->hal;
++	u8 nss = rtwdev->efuse.hw_cap.nss;
+ 	u8 path, rate, bw, ch, regd;
+-	struct rtw_power_params pwr_param = {0};
++	u8 max_ht_rate, max_rate;
+ 
+ 	mutex_lock(&rtwdev->mutex);
+ 	bw = hal->current_band_width;
+@@ -707,19 +709,23 @@ static int rtw_debugfs_get_tx_pwr_tbl(st
+ 	seq_printf(m, "%-4s %-10s %-9s %-9s (%-4s %-4s %-4s) %-4s\n",
+ 		   "path", "rate", "pwr", "base", "byr", "lmt", "sar", "rem");
+ 
++	max_ht_rate = DESC_RATEMCS0 + nss * 8 - 1;
++
++	if (rtwdev->chip->vht_supported)
++		max_rate = DESC_RATEVHT1SS_MCS0 + nss * 10 - 1;
++	else
++		max_rate = max_ht_rate;
++
+ 	mutex_lock(&hal->tx_power_mutex);
+-	for (path = RF_PATH_A; path <= RF_PATH_B; path++) {
++	for (path = RF_PATH_A; path < hal->rf_path_num; path++) {
+ 		/* there is no CCK rates used in 5G */
+ 		if (hal->current_band_type == RTW_BAND_5G)
+ 			rate = DESC_RATE6M;
+ 		else
+ 			rate = DESC_RATE1M;
+ 
+-		/* now, not support vht 3ss and vht 4ss*/
+-		for (; rate <= DESC_RATEVHT2SS_MCS9; rate++) {
+-			/* now, not support ht 3ss and ht 4ss*/
+-			if (rate > DESC_RATEMCS15 &&
+-			    rate < DESC_RATEVHT1SS_MCS0)
++		for (; rate <= max_rate; rate++) {
++			if (rate > max_ht_rate && rate <= DESC_RATEMCS31)
+ 				continue;
+ 
+ 			rtw_get_tx_power_params(rtwdev, path, rate, bw,

package/kernel/mac80211/patches/rtl/085-v6.15-wifi-rtw88-Add-some-definitions-for-RTL8814AU.patch

@@ -0,0 +1,200 @@
+From 679ec431477cdb68d1cab068c008da0de7f842ef Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Fri, 7 Mar 2025 02:22:17 +0200
+Subject: [PATCH] wifi: rtw88: Add some definitions for RTL8814AU
+
+Add various register definitions which will be used by the new driver.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/1dcb5abb-26f8-4db5-be36-057de56465e5@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/reg.h | 66 ++++++++++++++++++++++--
+ 1 file changed, 62 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/reg.h
++++ b/drivers/net/wireless/realtek/rtw88/reg.h
+@@ -8,6 +8,7 @@
+ #define REG_SYS_FUNC_EN		0x0002
+ #define BIT_FEN_EN_25_1		BIT(13)
+ #define BIT_FEN_ELDR		BIT(12)
++#define BIT_FEN_PCIEA		BIT(6)
+ #define BIT_FEN_CPUEN		BIT(2)
+ #define BIT_FEN_USBA		BIT(2)
+ #define BIT_FEN_BB_GLB_RST	BIT(1)
+@@ -39,6 +40,9 @@
+ #define BIT_RF_RSTB		BIT(1)
+ #define BIT_RF_EN		BIT(0)
+ 
++#define REG_RF_CTRL1		0x0020
++#define REG_RF_CTRL2		0x0021
++
+ #define REG_AFE_CTRL1		0x0024
+ #define BIT_MAC_CLK_SEL		(BIT(20) | BIT(21))
+ #define REG_EFUSE_CTRL		0x0030
+@@ -73,6 +77,8 @@
+ #define BIT_BT_PTA_EN		BIT(5)
+ #define BIT_WLRFE_4_5_EN	BIT(2)
+ 
++#define REG_GPIO_PIN_CTRL	0x0044
++
+ #define REG_LED_CFG		0x004C
+ #define BIT_LNAON_SEL_EN	BIT(26)
+ #define BIT_PAPE_SEL_EN		BIT(25)
+@@ -110,6 +116,7 @@
+ #define BIT_SDIO_PAD_E5		BIT(18)
+ 
+ #define REG_RF_B_CTRL		0x76
++#define REG_RF_CTRL3		0x0076
+ 
+ #define REG_AFE_CTRL_4		0x0078
+ #define BIT_CK320M_AFE_EN	BIT(4)
+@@ -603,15 +610,25 @@
+ #define REG_CCA2ND		0x0838
+ #define REG_L1PKTH		0x0848
+ #define REG_CLKTRK		0x0860
++#define REG_CSI_MASK_SETTING1	0x0874
++#define REG_NBI_SETTING		0x087c
++#define BIT_NBI_ENABLE		BIT(13)
++#define REG_CSI_FIX_MASK0	0x0880
++#define REG_CSI_FIX_MASK1	0x0884
++#define REG_CSI_FIX_MASK6	0x0898
++#define REG_CSI_FIX_MASK7	0x089c
+ #define REG_ADCCLK		0x08AC
+ #define REG_HSSI_READ		0x08B0
+ #define REG_FPGA0_XCD_RF_PARA	0x08B4
+ #define REG_RX_MCS_LIMIT	0x08BC
+ #define REG_ADC160		0x08C4
++#define REG_DBGSEL		0x08fc
+ #define REG_ANTSEL_SW		0x0900
+ #define REG_DAC_RSTB		0x090c
++#define REG_PSD			0x0910
++#define BIT_PSD_INI		GENMASK(23, 22)
+ #define REG_SINGLE_TONE_CONT_TX	0x0914
+-
++#define REG_AGC_TABLE		0x0958
+ #define REG_RFE_CTRL_E		0x0974
+ #define REG_2ND_CCA_CTRL	0x0976
+ #define REG_IQK_COM00		0x0978
+@@ -621,10 +638,18 @@
+ 
+ #define REG_FAS			0x09a4
+ #define REG_RXSB		0x0a00
++#define BIT_RXSB_ANA_DIV	BIT(15)
+ #define REG_CCK_RX		0x0a04
+ #define REG_CCK_PD_TH		0x0a0a
+-
+-#define REG_CCK0_FAREPORT	0xa2c
++#define REG_PRECTRL		0x0a14
++#define BIT_DIS_CO_PATHSEL	BIT(7)
++#define BIT_IQ_WGT		GENMASK(9, 8)
++#define REG_CCA_MF		0x0a20
++#define BIT_MBC_WIN		GENMASK(5, 4)
++#define REG_CCK0_TX_FILTER1	0x0a20
++#define REG_CCK0_TX_FILTER2	0x0a24
++#define REG_CCK0_DEBUG_PORT	0x0a28
++#define REG_CCK0_FAREPORT	0x0a2c
+ #define BIT_CCK0_2RX		BIT(18)
+ #define BIT_CCK0_MRC		BIT(22)
+ #define REG_FA_CCK		0x0a5c
+@@ -643,10 +668,18 @@
+ #define DIS_DPD_RATEVHT2SS_MCS1	BIT(9)
+ #define DIS_DPD_RATEALL		GENMASK(9, 0)
+ 
++#define REG_CCA			0x0a70
++#define BIT_CCA_CO		BIT(7)
++#define REG_ANTSEL		0x0a74
++#define BIT_ANT_BYCO		BIT(8)
++#define REG_CCKTX		0x0a84
++#define BIT_CMB_CCA_2R		BIT(28)
++
+ #define REG_CNTRST		0x0b58
+ 
+ #define REG_3WIRE_SWA		0x0c00
+ #define REG_RX_IQC_AB_A		0x0c10
++#define REG_RX_IQC_CD_A		0x0c14
+ #define REG_TXSCALE_A		0x0c1c
+ #define BB_SWING_MASK		GENMASK(31, 21)
+ #define REG_TX_AGC_A_CCK_11_CCK_1		0xc20
+@@ -674,7 +707,7 @@
+ #define REG_LSSI_WRITE_A	0x0c90
+ #define REG_PREDISTA		0x0c90
+ #define REG_TXAGCIDX		0x0c94
+-
++#define REG_TX_AGC_A		0x0c94
+ #define REG_RFE_PINMUX_A	0x0cb0
+ #define REG_RFE_INV_A		0x0cb4
+ #define REG_RFE_CTRL8		0x0cb4
+@@ -683,6 +716,7 @@
+ #define DPDT_CTRL_PIN		0x77
+ #define RFE_INV_MASK		0x3ff00000
+ #define REG_RFECTL_A		0x0cb8
++#define REG_RFE_INV0		0x0cbc
+ #define REG_RFE_INV8		0x0cbd
+ #define BIT_MASK_RFE_INV89	GENMASK(1, 0)
+ #define REG_RFE_INV16		0x0cbe
+@@ -703,6 +737,7 @@
+ 
+ #define REG_3WIRE_SWB		0x0e00
+ #define REG_RX_IQC_AB_B		0x0e10
++#define REG_RX_IQC_CD_B		0x0e14
+ #define REG_TXSCALE_B		0x0e1c
+ #define REG_TX_AGC_B_CCK_11_CCK_1		0xe20
+ #define REG_TX_AGC_B_OFDM18_OFDM6		0xe24
+@@ -729,6 +764,7 @@
+ #define REG_LSSI_WRITE_B	0x0e90
+ #define REG_PREDISTB		0x0e90
+ #define REG_INIDLYB		0x0e94
++#define REG_TX_AGC_B		0x0e94
+ #define REG_RFE_PINMUX_B	0x0eb0
+ #define REG_RFE_INV_B		0x0eb4
+ #define REG_RFECTL_B		0x0eb8
+@@ -744,8 +780,11 @@
+ #define REG_CRC_HT		0x0f10
+ #define REG_CRC_OFDM		0x0f14
+ #define REG_FA_OFDM		0x0f48
++#define REG_DBGRPT		0x0fa0
+ #define REG_CCA_CCK		0x0fcc
+ 
++#define REG_SYS_CFG3_8814A	0x1000
++
+ #define REG_ANAPARSW_MAC_0	0x1010
+ #define BIT_CF_L_V2		GENMASK(29, 28)
+ 
+@@ -863,9 +902,27 @@
+ #define LTECOEX_WRITE_DATA REG_WL2LTECOEX_INDIRECT_ACCESS_WRITE_DATA_V1
+ #define LTECOEX_READ_DATA REG_WL2LTECOEX_INDIRECT_ACCESS_READ_DATA_V1
+ 
++#define REG_RX_IQC_AB_C		0x1810
++#define REG_RX_IQC_CD_C		0x1814
++#define REG_TXSCALE_C		0x181c
++#define REG_CK_MONHC		0x185c
++#define REG_AFE_PWR1_C		0x1860
+ #define REG_IGN_GNT_BT1	0x1860
++#define REG_TX_AGC_C		0x1894
++#define REG_RFE_PINMUX_C	0x18b4
+ 
+ #define REG_RFESEL_CTRL	0x1990
++#define REG_AGC_TBL		0x1998
++
++#define REG_RX_IQC_AB_D		0x1a10
++#define REG_RX_IQC_CD_D		0x1a14
++#define REG_TXSCALE_D		0x1a1c
++#define REG_CK_MONHD		0x1a5c
++#define REG_AFE_PWR1_D		0x1a60
++#define REG_TX_AGC_D		0x1a94
++#define REG_RFE_PINMUX_D	0x1ab4
++#define REG_RFE_INVSEL_D	0x1abc
++#define BIT_RFE_SELSW0_D	GENMASK(27, 20)
+ 
+ #define REG_NOMASK_TXBT	0x1ca7
+ #define REG_ANAPAR	0x1c30
+@@ -906,6 +963,7 @@
+ #define RF18_BAND_MASK	(BIT(16) | BIT(9) | BIT(8))
+ #define RF18_CHANNEL_MASK	(MASKBYTE0)
+ #define RF18_RFSI_MASK	(BIT(18) | BIT(17))
++#define RF_RCK1_V1	0x1c
+ #define RF_RCK		0x1d
+ #define RF_MODE_TABLE_ADDR	0x30
+ #define RF_MODE_TABLE_DATA0	0x31

package/kernel/mac80211/patches/rtl/089-v6.15-wifi-rtw88-Add-rtw8814ae.c.patch

@@ -0,0 +1,50 @@
+From dad8e879310211c1e02f09c35f169388bccbfa42 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Fri, 7 Mar 2025 02:25:09 +0200
+Subject: [PATCH] wifi: rtw88: Add rtw8814ae.c
+
+This is the entry point for the new module rtw88_8814ae.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/74ebab2f-a23e-4d87-935f-0af2b5cba672@gmail.com
+---
+ .../net/wireless/realtek/rtw88/rtw8814ae.c    | 31 +++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+ create mode 100644 drivers/net/wireless/realtek/rtw88/rtw8814ae.c
+
+--- /dev/null
++++ b/drivers/net/wireless/realtek/rtw88/rtw8814ae.c
+@@ -0,0 +1,31 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
++/* Copyright(c) 2025  Realtek Corporation
++ */
++
++#include <linux/module.h>
++#include <linux/pci.h>
++#include "pci.h"
++#include "rtw8814a.h"
++
++static const struct pci_device_id rtw_8814ae_id_table[] = {
++	{
++		PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8813),
++		.driver_data = (kernel_ulong_t)&rtw8814a_hw_spec
++	},
++	{}
++};
++MODULE_DEVICE_TABLE(pci, rtw_8814ae_id_table);
++
++static struct pci_driver rtw_8814ae_driver = {
++	.name = "rtw_8814ae",
++	.id_table = rtw_8814ae_id_table,
++	.probe = rtw_pci_probe,
++	.remove = rtw_pci_remove,
++	.driver.pm = &rtw_pm_ops,
++	.shutdown = rtw_pci_shutdown,
++};
++module_pci_driver(rtw_8814ae_driver);
++
++MODULE_AUTHOR("Bitterblue Smith <rtl8821cerfe2@gmail.com>");
++MODULE_DESCRIPTION("Realtek 802.11ac wireless 8814ae driver");
++MODULE_LICENSE("Dual BSD/GPL");

package/kernel/mac80211/patches/rtl/090-v6.15-wifi-rtw88-Add-rtw8814au.c.patch

@@ -0,0 +1,73 @@
+From bad060e8a425182809bfc2586a2e7f5ccd1a994d Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Fri, 7 Mar 2025 02:25:37 +0200
+Subject: [PATCH] wifi: rtw88: Add rtw8814au.c
+
+This is the entry point for the new module rtw88_8814au.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/71457787-5a9e-4ead-a62c-22ca44e00b89@gmail.com
+---
+ .../net/wireless/realtek/rtw88/rtw8814au.c    | 54 +++++++++++++++++++
+ 1 file changed, 54 insertions(+)
+ create mode 100644 drivers/net/wireless/realtek/rtw88/rtw8814au.c
+
+--- /dev/null
++++ b/drivers/net/wireless/realtek/rtw88/rtw8814au.c
+@@ -0,0 +1,54 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
++/* Copyright(c) 2025  Realtek Corporation
++ */
++
++#include <linux/module.h>
++#include <linux/usb.h>
++#include "main.h"
++#include "rtw8814a.h"
++#include "usb.h"
++
++static const struct usb_device_id rtw_8814au_id_table[] = {
++	{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0x8813, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8814a_hw_spec) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x056e, 0x400b, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8814a_hw_spec) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x056e, 0x400d, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8814a_hw_spec) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x0846, 0x9054, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8814a_hw_spec) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x0b05, 0x1817, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8814a_hw_spec) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x0b05, 0x1852, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8814a_hw_spec) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x0b05, 0x1853, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8814a_hw_spec) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x0e66, 0x0026, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8814a_hw_spec) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x331a, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8814a_hw_spec) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x20f4, 0x809a, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8814a_hw_spec) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x20f4, 0x809b, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8814a_hw_spec) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x0106, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8814a_hw_spec) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x7392, 0xa834, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8814a_hw_spec) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x7392, 0xa833, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8814a_hw_spec) },
++	{},
++};
++MODULE_DEVICE_TABLE(usb, rtw_8814au_id_table);
++
++static struct usb_driver rtw_8814au_driver = {
++	.name = "rtw_8814au",
++	.id_table = rtw_8814au_id_table,
++	.probe = rtw_usb_probe,
++	.disconnect = rtw_usb_disconnect,
++};
++module_usb_driver(rtw_8814au_driver);
++
++MODULE_AUTHOR("Bitterblue Smith <rtl8821cerfe2@gmail.com>");
++MODULE_DESCRIPTION("Realtek 802.11ac wireless 8814au driver");
++MODULE_LICENSE("Dual BSD/GPL");

package/kernel/mac80211/patches/rtl/091-v6.15-wifi-rtw88-Add-__nonstring-annotations-for-untermina.patch

@@ -0,0 +1,34 @@
+From d58ad77d5cc2a6d04db622a898e54d93fc7002a2 Mon Sep 17 00:00:00 2001
+From: Kees Cook <kees@kernel.org>
+Date: Mon, 10 Mar 2025 15:22:58 -0700
+Subject: [PATCH] wifi: rtw88: Add __nonstring annotations for unterminated
+ strings
+
+When a character array without a terminating NUL character has a static
+initializer, GCC 15's -Wunterminated-string-initialization will only
+warn if the array lacks the "nonstring" attribute[1]. Mark the arrays
+with __nonstring to and correctly identify the char array as "not a C
+string" and thereby eliminate the warning.
+
+Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=117178 [1]
+Cc: Ping-Ke Shih <pkshih@realtek.com>
+Cc: Johannes Berg <johannes@sipsolutions.net>
+Cc: linux-wireless@vger.kernel.org
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250310222257.work.866-kees@kernel.org
+---
+ drivers/net/wireless/realtek/rtw88/main.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -835,7 +835,7 @@ struct rtw_vif {
+ };
+ 
+ struct rtw_regulatory {
+-	char alpha2[2];
++	char alpha2[2] __nonstring;
+ 	u8 txpwr_regd_2g;
+ 	u8 txpwr_regd_5g;
+ };

package/kernel/mac80211/patches/rtl/091-v6.15wifi-rtw88-Enable-the-new-RTL8814AE-RTL8814AU-driver.patch

@@ -0,0 +1,147 @@
+From deb3ddeb18652118956fb581a39ac299e1ee5623 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Fri, 7 Mar 2025 02:26:25 +0200
+Subject: [PATCH] wifi: rtw88: Enable the new RTL8814AE/RTL8814AU drivers
+
+RTL8814A is a wifi 5 chip with 4 RF paths (chains), 3 spatial streams,
+and probably no Bluetooth.
+
+The USB-based RTL8814AU can reach 800 Mbps in the 5 GHz band in USB 3
+mode. In USB 2 mode it only uses 2 spatial streams.
+
+The PCI-based RTL8814AE is not as popular and didn't get as much
+testing so it's unclear how fast it goes. It's more like a bonus on top
+of the RTL8814AU support.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/5795b0a7-511e-40b5-ac36-476b63f174c7@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/Kconfig  | 25 +++++++++++++++++++++
+ drivers/net/wireless/realtek/rtw88/Makefile |  9 ++++++++
+ 2 files changed, 34 insertions(+)
+
+--- a/Kconfig.local
++++ b/Kconfig.local
+@@ -1153,6 +1153,9 @@ config BACKPORTED_RTW88_8821A
+ config BACKPORTED_RTW88_8812A
+ 	tristate
+ 	default RTW88_8812A
++config BACKPORTED_RTW88_8814A
++	tristate
++	default RTW88_8814A
+ config BACKPORTED_RTW88_8822BE
+ 	tristate
+ 	default RTW88_8822BE
+@@ -1198,12 +1201,21 @@ config BACKPORTED_RTW88_8821AU
+ config BACKPORTED_RTW88_8812AU
+ 	tristate
+ 	default RTW88_8812AU
++config BACKPORTED_RTW88_8814AE
++	tristate
++	default RTW88_8814AE
++config BACKPORTED_RTW88_8814AU
++	tristate
++	default RTW88_8814AU
+ config BACKPORTED_RTW88_DEBUG
+ 	tristate
+ 	default RTW88_DEBUG
+ config BACKPORTED_RTW88_DEBUGFS
+ 	tristate
+ 	default RTW88_DEBUGFS
++config BACKPORTED_RTW88_LEDS
++	tristate
++	default RTW88_LEDS
+ config BACKPORTED_RTW89
+ 	tristate
+ 	default RTW89
+--- a/drivers/net/wireless/realtek/rtw88/Kconfig
++++ b/drivers/net/wireless/realtek/rtw88/Kconfig
+@@ -68,6 +68,10 @@ config RTW88_8812A
+ 	depends on m
+ 	select RTW88_88XXA
+ 
++config RTW88_8814A
++	tristate
++	depends on m
++
+ config RTW88_8822BE
+ 	tristate "Realtek 8822BE PCI wireless network adapter"
+ 	depends on m
+@@ -251,6 +255,30 @@ config RTW88_8812AU
+ 
+ 	  802.11ac USB wireless network adapter
+ 
++config RTW88_8814AE
++	tristate "Realtek 8814AE PCI wireless network adapter"
++	depends on m
++	depends on PCI
++	select RTW88_CORE
++	select RTW88_PCI
++	select RTW88_8814A
++	help
++	  Select this option will enable support for 8814AE chipset
++
++	  802.11ac PCIe wireless network adapter
++
++config RTW88_8814AU
++	tristate "Realtek 8814AU USB wireless network adapter"
++	depends on m
++	depends on USB
++	select RTW88_CORE
++	select RTW88_USB
++	select RTW88_8814A
++	help
++	  Select this option will enable support for 8814AU chipset
++
++	  802.11ac USB wireless network adapter
++
+ config RTW88_DEBUG
+ 	bool "Realtek rtw88 debug support"
+ 	depends on RTW88_CORE
+--- a/drivers/net/wireless/realtek/rtw88/Makefile
++++ b/drivers/net/wireless/realtek/rtw88/Makefile
+@@ -94,6 +94,15 @@ rtw88_8821au-objs		:= rtw8821au.o
+ obj-$(CPTCFG_RTW88_8812AU)	+= rtw88_8812au.o
+ rtw88_8812au-objs		:= rtw8812au.o
+ 
++obj-$(CPTCFG_RTW88_8814A)	+= rtw88_8814a.o
++rtw88_8814a-objs		:= rtw8814a.o rtw8814a_table.o
++
++obj-$(CPTCFG_RTW88_8814AE)	+= rtw88_8814ae.o
++rtw88_8814ae-objs		:= rtw8814ae.o
++
++obj-$(CPTCFG_RTW88_8814AU)	+= rtw88_8814au.o
++rtw88_8814au-objs		:= rtw8814au.o
++
+ obj-$(CPTCFG_RTW88_PCI)		+= rtw88_pci.o
+ rtw88_pci-objs			:= pci.o
+ 
+--- a/local-symbols
++++ b/local-symbols
+@@ -377,6 +377,10 @@ RTW88_8723X=
+ RTW88_8703B=
+ RTW88_8723D=
+ RTW88_8821C=
++RTW88_88XXA=
++RTW88_8821A=
++RTW88_8812A=
++RTW88_8814A=
+ RTW88_8822BE=
+ RTW88_8822BS=
+ RTW88_8822BU=
+@@ -390,8 +394,13 @@ RTW88_8723DU=
+ RTW88_8821CE=
+ RTW88_8821CS=
+ RTW88_8821CU=
++RTW88_8821AU=
++RTW88_8812AU=
++RTW88_8814AE=
++RTW88_8814AU=
+ RTW88_DEBUG=
+ RTW88_DEBUGFS=
++RTW88_LEDS=
+ RTW89=
+ RTW89_CORE=
+ RTW89_PCI=

package/kernel/mac80211/patches/rtl/093-v6.16-wifi-rtw88-sdio-Remove-redundant-flush_workqueue-cal.patch

@@ -0,0 +1,36 @@
+From 5c4cf36c538bb2714e43654e365cb77b19c4a93e Mon Sep 17 00:00:00 2001
+From: Chen Ni <nichen@iscas.ac.cn>
+Date: Mon, 24 Mar 2025 15:59:10 +0800
+Subject: [PATCH] wifi: rtw88: sdio: Remove redundant 'flush_workqueue()' calls
+
+'destroy_workqueue()' already drains the queue before destroying it, so
+there is no need to flush it explicitly.
+
+Remove the redundant 'flush_workqueue()' calls.
+
+This was generated with coccinelle:
+
+@@
+expression E;
+@@
+
+- flush_workqueue(E);
+  destroy_workqueue(E);
+
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250324075910.407999-1-nichen@iscas.ac.cn
+---
+ drivers/net/wireless/realtek/rtw88/sdio.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/sdio.c
++++ b/drivers/net/wireless/realtek/rtw88/sdio.c
+@@ -1298,7 +1298,6 @@ static void rtw_sdio_deinit_tx(struct rt
+ 	struct rtw_sdio *rtwsdio = (struct rtw_sdio *)rtwdev->priv;
+ 	int i;
+ 
+-	flush_workqueue(rtwsdio->txwq);
+ 	destroy_workqueue(rtwsdio->txwq);
+ 	kfree(rtwsdio->tx_handler_data);
+ 

package/kernel/mac80211/patches/rtl/094-v6.16-wifi-rtw88-usb-Remove-redundant-flush_workqueue-call.patch

@@ -0,0 +1,44 @@
+From 625fbc16524a45488f6eb8561d98b3328efe79cd Mon Sep 17 00:00:00 2001
+From: Chen Ni <nichen@iscas.ac.cn>
+Date: Mon, 24 Mar 2025 16:03:03 +0800
+Subject: [PATCH] wifi: rtw88: usb: Remove redundant 'flush_workqueue()' calls
+
+'destroy_workqueue()' already drains the queue before destroying it, so
+there is no need to flush it explicitly.
+
+Remove the redundant 'flush_workqueue()' calls.
+
+This was generated with coccinelle:
+
+@@
+expression E;
+@@
+
+- flush_workqueue(E);
+  destroy_workqueue(E);
+
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250324080303.408084-1-nichen@iscas.ac.cn
+---
+ drivers/net/wireless/realtek/rtw88/usb.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/usb.c
++++ b/drivers/net/wireless/realtek/rtw88/usb.c
+@@ -901,7 +901,6 @@ static void rtw_usb_deinit_rx(struct rtw
+ 
+ 	skb_queue_purge(&rtwusb->rx_queue);
+ 
+-	flush_workqueue(rtwusb->rxwq);
+ 	destroy_workqueue(rtwusb->rxwq);
+ }
+ 
+@@ -928,7 +927,6 @@ static void rtw_usb_deinit_tx(struct rtw
+ {
+ 	struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev);
+ 
+-	flush_workqueue(rtwusb->txwq);
+ 	destroy_workqueue(rtwusb->txwq);
+ 	rtw_usb_tx_queue_purge(rtwusb);
+ }

package/kernel/mac80211/patches/rtl/095-v6.16-wifi-rtw88-usb-Enable-switching-the-RTL8814AU-to-USB.patch

@@ -0,0 +1,32 @@
+From bf1103654df99d50724a022c8b9fca8908a86f50 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 2 Apr 2025 18:30:02 +0300
+Subject: [PATCH] wifi: rtw88: usb: Enable switching the RTL8814AU to USB 3
+
+The Realtek wifi 5 devices which support USB 3 are weird: when first
+plugged in, they pretend to be USB 2. The driver needs to send some
+commands to the device, which make it disappear and come back as a
+USB 3 device.
+
+The method used to switch the RTL8812AU also works for the RTL8814AU.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/d3608f70-e04f-4f6b-987a-022c8e317165@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/usb.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/usb.c
++++ b/drivers/net/wireless/realtek/rtw88/usb.c
+@@ -1043,7 +1043,8 @@ static int rtw_usb_switch_mode_new(struc
+ 
+ static bool rtw_usb3_chip_old(u8 chip_id)
+ {
+-	return chip_id == RTW_CHIP_TYPE_8812A;
++	return chip_id == RTW_CHIP_TYPE_8812A ||
++	       chip_id == RTW_CHIP_TYPE_8814A;
+ }
+ 
+ static bool rtw_usb3_chip_new(u8 chip_id)

package/kernel/mac80211/patches/rtl/096-v6.16-wifi-rtw88-usb-Enable-RX-aggregation-for-RTL8814AU.patch

@@ -0,0 +1,28 @@
+From dcbb7bb3a364f218411761e2e5ee2f6818d9bdfc Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 2 Apr 2025 18:30:28 +0300
+Subject: [PATCH] wifi: rtw88: usb: Enable RX aggregation for RTL8814AU
+
+Let the chip transfer several frames in a single USB Request Block.
+This is supposed to improve the RX speed.
+
+It can use the same code used for RTL8822CU, RTL8822BU, and RTL8821CU.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/672397ac-dd4d-4420-8b3e-7011578e2243@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/realtek/rtw88/usb.c
++++ b/drivers/net/wireless/realtek/rtw88/usb.c
+@@ -829,6 +829,7 @@ static void rtw_usb_dynamic_rx_agg(struc
+ 	case RTW_CHIP_TYPE_8822C:
+ 	case RTW_CHIP_TYPE_8822B:
+ 	case RTW_CHIP_TYPE_8821C:
++	case RTW_CHIP_TYPE_8814A:
+ 		rtw_usb_dynamic_rx_agg_v1(rtwdev, enable);
+ 		break;
+ 	case RTW_CHIP_TYPE_8821A:

package/kernel/mac80211/patches/rtl/097-v6.16-wifi-rtw88-Set-AMPDU-factor-to-hardware-for-RTL8814A.patch

@@ -0,0 +1,192 @@
+From 0d2a88690e583168effb03c64fd217a323b2c444 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 2 Apr 2025 18:31:12 +0300
+Subject: [PATCH] wifi: rtw88: Set AMPDU factor to hardware for RTL8814A
+
+Tell the chip the maximum AMPDU size supported by the AP. This greatly
+improves the TX speed of RTL8814AU in the 2.4 GHz band. Before: ~90
+Mbps. After: ~300 Mbps.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/4edc2a63-81b3-431c-9a37-5a7d899a6cc2@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/mac80211.c |  2 ++
+ drivers/net/wireless/realtek/rtw88/main.c     | 32 +++++++++++++++++++
+ drivers/net/wireless/realtek/rtw88/main.h     |  3 ++
+ drivers/net/wireless/realtek/rtw88/rtw8703b.c |  1 +
+ drivers/net/wireless/realtek/rtw88/rtw8723d.c |  1 +
+ drivers/net/wireless/realtek/rtw88/rtw8812a.c |  1 +
+ drivers/net/wireless/realtek/rtw88/rtw8814a.c | 11 +++++++
+ drivers/net/wireless/realtek/rtw88/rtw8821a.c |  1 +
+ drivers/net/wireless/realtek/rtw88/rtw8821c.c |  1 +
+ drivers/net/wireless/realtek/rtw88/rtw8822b.c |  1 +
+ drivers/net/wireless/realtek/rtw88/rtw8822c.c |  1 +
+ 11 files changed, 55 insertions(+)
+
+--- a/drivers/net/wireless/realtek/rtw88/mac80211.c
++++ b/drivers/net/wireless/realtek/rtw88/mac80211.c
+@@ -396,6 +396,8 @@ static void rtw_ops_bss_info_changed(str
+ 			if (rtw_bf_support)
+ 				rtw_bf_assoc(rtwdev, vif, conf);
+ 
++			rtw_set_ampdu_factor(rtwdev, vif, conf);
++
+ 			rtw_fw_beacon_filter_config(rtwdev, true, vif);
+ 		} else {
+ 			rtw_leave_lps(rtwdev);
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -2447,6 +2447,38 @@ void rtw_core_enable_beacon(struct rtw_d
+ 	}
+ }
+ 
++void rtw_set_ampdu_factor(struct rtw_dev *rtwdev, struct ieee80211_vif *vif,
++			  struct ieee80211_bss_conf *bss_conf)
++{
++	const struct rtw_chip_ops *ops = rtwdev->chip->ops;
++	struct ieee80211_sta *sta;
++	u8 factor = 0xff;
++
++	if (!ops->set_ampdu_factor)
++		return;
++
++	rcu_read_lock();
++
++	sta = ieee80211_find_sta(vif, bss_conf->bssid);
++	if (!sta) {
++		rcu_read_unlock();
++		rtw_warn(rtwdev, "%s: failed to find station %pM\n",
++			 __func__, bss_conf->bssid);
++		return;
++	}
++
++	if (sta->deflink.vht_cap.vht_supported)
++		factor = u32_get_bits(sta->deflink.vht_cap.cap,
++				      IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK);
++	else if (sta->deflink.ht_cap.ht_supported)
++		factor = sta->deflink.ht_cap.ampdu_factor;
++
++	rcu_read_unlock();
++
++	if (factor != 0xff)
++		ops->set_ampdu_factor(rtwdev, factor);
++}
++
+ MODULE_AUTHOR("Realtek Corporation");
+ MODULE_DESCRIPTION("Realtek 802.11ac wireless core module");
+ MODULE_LICENSE("Dual BSD/GPL");
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -878,6 +878,7 @@ struct rtw_chip_ops {
+ 			   u32 antenna_rx);
+ 	void (*cfg_ldo25)(struct rtw_dev *rtwdev, bool enable);
+ 	void (*efuse_grant)(struct rtw_dev *rtwdev, bool enable);
++	void (*set_ampdu_factor)(struct rtw_dev *rtwdev, u8 factor);
+ 	void (*false_alarm_statistics)(struct rtw_dev *rtwdev);
+ 	void (*phy_calibration)(struct rtw_dev *rtwdev);
+ 	void (*dpk_track)(struct rtw_dev *rtwdev);
+@@ -2272,4 +2273,6 @@ void rtw_update_channel(struct rtw_dev *
+ void rtw_core_port_switch(struct rtw_dev *rtwdev, struct ieee80211_vif *vif);
+ bool rtw_core_check_sta_active(struct rtw_dev *rtwdev);
+ void rtw_core_enable_beacon(struct rtw_dev *rtwdev, bool enable);
++void rtw_set_ampdu_factor(struct rtw_dev *rtwdev, struct ieee80211_vif *vif,
++			  struct ieee80211_bss_conf *bss_conf);
+ #endif
+--- a/drivers/net/wireless/realtek/rtw88/rtw8703b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8703b.c
+@@ -1904,6 +1904,7 @@ static const struct rtw_chip_ops rtw8703
+ 	.set_antenna		= NULL,
+ 	.cfg_ldo25		= rtw8723x_cfg_ldo25,
+ 	.efuse_grant		= rtw8723x_efuse_grant,
++	.set_ampdu_factor	= NULL,
+ 	.false_alarm_statistics	= rtw8723x_false_alarm_statistics,
+ 	.phy_calibration	= rtw8703b_phy_calibration,
+ 	.dpk_track		= NULL,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8723d.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8723d.c
+@@ -1404,6 +1404,7 @@ static const struct rtw_chip_ops rtw8723
+ 	.set_antenna		= NULL,
+ 	.cfg_ldo25		= rtw8723x_cfg_ldo25,
+ 	.efuse_grant		= rtw8723x_efuse_grant,
++	.set_ampdu_factor	= NULL,
+ 	.false_alarm_statistics	= rtw8723x_false_alarm_statistics,
+ 	.phy_calibration	= rtw8723d_phy_calibration,
+ 	.cck_pd_set		= rtw8723d_phy_cck_pd_set,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8812a.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8812a.c
+@@ -925,6 +925,7 @@ static const struct rtw_chip_ops rtw8812
+ 	.set_tx_power_index	= rtw88xxa_set_tx_power_index,
+ 	.cfg_ldo25		= rtw8812a_cfg_ldo25,
+ 	.efuse_grant		= rtw88xxa_efuse_grant,
++	.set_ampdu_factor	= NULL,
+ 	.false_alarm_statistics	= rtw88xxa_false_alarm_statistics,
+ 	.phy_calibration	= rtw8812a_phy_calibration,
+ 	.cck_pd_set		= rtw88xxa_phy_cck_pd_set,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8814a.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8814a.c
+@@ -1332,6 +1332,16 @@ static void rtw8814a_cfg_ldo25(struct rt
+ {
+ }
+ 
++/* Without this RTL8814A sends too many frames and (some?) 11n AP
++ * can't handle it, resulting in low TX speed. Other chips seem fine.
++ */
++static void rtw8814a_set_ampdu_factor(struct rtw_dev *rtwdev, u8 factor)
++{
++	factor = min_t(u8, factor, IEEE80211_VHT_MAX_AMPDU_256K);
++
++	rtw_write32(rtwdev, REG_AMPDU_MAX_LENGTH, (8192 << factor) - 1);
++}
++
+ static void rtw8814a_false_alarm_statistics(struct rtw_dev *rtwdev)
+ {
+ 	struct rtw_dm_info *dm_info = &rtwdev->dm_info;
+@@ -2051,6 +2061,7 @@ static const struct rtw_chip_ops rtw8814
+ 	.set_antenna		= NULL,
+ 	.cfg_ldo25		= rtw8814a_cfg_ldo25,
+ 	.efuse_grant		= rtw8814a_efuse_grant,
++	.set_ampdu_factor	= rtw8814a_set_ampdu_factor,
+ 	.false_alarm_statistics	= rtw8814a_false_alarm_statistics,
+ 	.phy_calibration	= rtw8814a_phy_calibration,
+ 	.cck_pd_set		= rtw8814a_phy_cck_pd_set,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821a.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821a.c
+@@ -871,6 +871,7 @@ static const struct rtw_chip_ops rtw8821
+ 	.set_tx_power_index	= rtw88xxa_set_tx_power_index,
+ 	.cfg_ldo25		= rtw8821a_cfg_ldo25,
+ 	.efuse_grant		= rtw88xxa_efuse_grant,
++	.set_ampdu_factor	= NULL,
+ 	.false_alarm_statistics	= rtw88xxa_false_alarm_statistics,
+ 	.phy_calibration	= rtw8821a_phy_calibration,
+ 	.cck_pd_set		= rtw88xxa_phy_cck_pd_set,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821c.c
+@@ -1668,6 +1668,7 @@ static const struct rtw_chip_ops rtw8821
+ 	.set_antenna		= NULL,
+ 	.set_tx_power_index	= rtw8821c_set_tx_power_index,
+ 	.cfg_ldo25		= rtw8821c_cfg_ldo25,
++	.set_ampdu_factor	= NULL,
+ 	.false_alarm_statistics	= rtw8821c_false_alarm_statistics,
+ 	.phy_calibration	= rtw8821c_phy_calibration,
+ 	.cck_pd_set		= rtw8821c_phy_cck_pd_set,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
+@@ -2158,6 +2158,7 @@ static const struct rtw_chip_ops rtw8822
+ 	.set_tx_power_index	= rtw8822b_set_tx_power_index,
+ 	.set_antenna		= rtw8822b_set_antenna,
+ 	.cfg_ldo25		= rtw8822b_cfg_ldo25,
++	.set_ampdu_factor	= NULL,
+ 	.false_alarm_statistics	= rtw8822b_false_alarm_statistics,
+ 	.phy_calibration	= rtw8822b_phy_calibration,
+ 	.pwr_track		= rtw8822b_pwr_track,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
+@@ -4968,6 +4968,7 @@ static const struct rtw_chip_ops rtw8822
+ 	.set_tx_power_index	= rtw8822c_set_tx_power_index,
+ 	.set_antenna		= rtw8822c_set_antenna,
+ 	.cfg_ldo25		= rtw8822c_cfg_ldo25,
++	.set_ampdu_factor	= NULL,
+ 	.false_alarm_statistics	= rtw8822c_false_alarm_statistics,
+ 	.dpk_track		= rtw8822c_dpk_track,
+ 	.phy_calibration	= rtw8822c_phy_calibration,

package/kernel/mac80211/patches/rtl/098-v6.16-wifi-rtw88-Don-t-set-SUPPORTS_AMSDU_IN_AMPDU-for-RTL.patch

@@ -0,0 +1,169 @@
+From b8d49bb8d16ae7dde8e05b275d6e3b8bbf27f011 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 2 Apr 2025 18:31:36 +0300
+Subject: [PATCH] wifi: rtw88: Don't set SUPPORTS_AMSDU_IN_AMPDU for RTL8814AU
+
+RTL8814AU doesn't work well with SUPPORTS_AMSDU_IN_AMPDU. The RX speed
+is noticeably lower and the VHT RX statistics are strange. Typical
+values with SUPPORTS_AMSDU_IN_AMPDU:
+
+Reverse mode, remote host 192.168.0.1 is sending
+[  5] local 192.168.0.50 port 60710 connected to 192.168.0.1 port 5201
+[ ID] Interval           Transfer     Bitrate
+[  5]   0.00-1.00   sec  74.6 MBytes   626 Mbits/sec
+[  5]   1.00-2.00   sec  79.2 MBytes   665 Mbits/sec
+[  5]   2.00-3.00   sec  84.9 MBytes   712 Mbits/sec
+[  5]   3.00-4.00   sec  83.8 MBytes   703 Mbits/sec
+[  5]   4.00-5.00   sec  85.9 MBytes   720 Mbits/sec
+[  5]   5.00-6.00   sec  78.9 MBytes   662 Mbits/sec
+[  5]   6.00-7.00   sec  81.2 MBytes   682 Mbits/sec
+[  5]   7.00-8.00   sec  80.5 MBytes   675 Mbits/sec
+[  5]   8.00-9.00   sec  79.4 MBytes   666 Mbits/sec
+[  5]   9.00-10.00  sec  82.2 MBytes   689 Mbits/sec
+[  5]  10.00-11.00  sec  82.0 MBytes   688 Mbits/sec
+[  5]  11.00-12.00  sec  84.2 MBytes   707 Mbits/sec
+[  5]  12.00-13.00  sec  71.0 MBytes   596 Mbits/sec
+[  5]  13.00-14.00  sec  69.4 MBytes   582 Mbits/sec
+[  5]  14.00-15.00  sec  80.2 MBytes   673 Mbits/sec
+[  5]  15.00-16.00  sec  74.5 MBytes   625 Mbits/sec
+
+[Rx Counter]:
+ * CCA (CCK, OFDM, Total) = (0, 2455, 2455)
+ * False Alarm (CCK, OFDM, Total) = (0, 69, 69)
+ * CCK cnt (ok, err) = (0, 0)
+ * OFDM cnt (ok, err) = (1239, 2)
+ * HT cnt (ok, err) = (0, 0)
+ * VHT cnt (ok, err) = (21, 12109)
+
+The "VHT ok" number is not believable.
+
+And without SUPPORTS_AMSDU_IN_AMPDU:
+
+Reverse mode, remote host 192.168.0.1 is sending
+[  5] local 192.168.0.50 port 50030 connected to 192.168.0.1 port 5201
+[ ID] Interval           Transfer     Bitrate
+[  5]   0.00-1.00   sec  70.5 MBytes   591 Mbits/sec
+[  5]   1.00-2.00   sec  86.9 MBytes   729 Mbits/sec
+[  5]   2.00-3.00   sec  98.6 MBytes   827 Mbits/sec
+[  5]   3.00-4.00   sec  97.4 MBytes   817 Mbits/sec
+[  5]   4.00-5.00   sec  98.6 MBytes   827 Mbits/sec
+[  5]   5.00-6.00   sec  96.9 MBytes   813 Mbits/sec
+[  5]   6.00-7.00   sec  98.2 MBytes   824 Mbits/sec
+[  5]   7.00-8.00   sec  98.0 MBytes   822 Mbits/sec
+[  5]   8.00-9.00   sec  99.9 MBytes   838 Mbits/sec
+[  5]   9.00-10.00  sec  99.2 MBytes   833 Mbits/sec
+[  5]  10.00-11.00  sec  98.0 MBytes   822 Mbits/sec
+[  5]  11.00-12.00  sec  98.1 MBytes   823 Mbits/sec
+[  5]  12.00-13.00  sec  97.0 MBytes   814 Mbits/sec
+[  5]  13.00-14.00  sec  98.2 MBytes   824 Mbits/sec
+[  5]  14.00-15.00  sec  98.5 MBytes   826 Mbits/sec
+[  5]  15.00-16.00  sec  97.4 MBytes   817 Mbits/sec
+
+[Rx Counter]:
+ * CCA (CCK, OFDM, Total) = (0, 3860, 3860)
+ * False Alarm (CCK, OFDM, Total) = (0, 2, 2)
+ * CCK cnt (ok, err) = (0, 0)
+ * OFDM cnt (ok, err) = (1486, 0)
+ * HT cnt (ok, err) = (0, 0)
+ * VHT cnt (ok, err) = (7399, 9118)
+
+Add a new member "amsdu_in_ampdu" in struct rtw_chip_info and use it
+to set SUPPORTS_AMSDU_IN_AMPDU only for the other chips.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/6202ccfb-feb0-4107-a08d-db2699e179f0@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/main.c     | 3 ++-
+ drivers/net/wireless/realtek/rtw88/main.h     | 1 +
+ drivers/net/wireless/realtek/rtw88/rtw8812a.c | 1 +
+ drivers/net/wireless/realtek/rtw88/rtw8814a.c | 1 +
+ drivers/net/wireless/realtek/rtw88/rtw8821a.c | 1 +
+ drivers/net/wireless/realtek/rtw88/rtw8821c.c | 1 +
+ drivers/net/wireless/realtek/rtw88/rtw8822b.c | 1 +
+ drivers/net/wireless/realtek/rtw88/rtw8822c.c | 1 +
+ 8 files changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -2242,7 +2242,8 @@ int rtw_register_hw(struct rtw_dev *rtwd
+ 	ieee80211_hw_set(hw, SUPPORTS_PS);
+ 	ieee80211_hw_set(hw, SUPPORTS_DYNAMIC_PS);
+ 	ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
+-	ieee80211_hw_set(hw, SUPPORTS_AMSDU_IN_AMPDU);
++	if (rtwdev->chip->amsdu_in_ampdu)
++		ieee80211_hw_set(hw, SUPPORTS_AMSDU_IN_AMPDU);
+ 	ieee80211_hw_set(hw, HAS_RATE_CONTROL);
+ 	ieee80211_hw_set(hw, TX_AMSDU);
+ 	ieee80211_hw_set(hw, SINGLE_SCAN_ON_ALL_BANDS);
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -1230,6 +1230,7 @@ struct rtw_chip_info {
+ 	u16 fw_fifo_addr[RTW_FW_FIFO_MAX];
+ 	const struct rtw_fwcd_segs *fwcd_segs;
+ 
++	bool amsdu_in_ampdu;
+ 	u8 usb_tx_agg_desc_num;
+ 	bool hw_feature_report;
+ 	u8 c2h_ra_report_size;
+--- a/drivers/net/wireless/realtek/rtw88/rtw8812a.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8812a.c
+@@ -1076,6 +1076,7 @@ const struct rtw_chip_info rtw8812a_hw_s
+ 	.rfe_defs = rtw8812a_rfe_defs,
+ 	.rfe_defs_size = ARRAY_SIZE(rtw8812a_rfe_defs),
+ 	.rx_ldpc = false,
++	.amsdu_in_ampdu = true,
+ 	.hw_feature_report = false,
+ 	.c2h_ra_report_size = 4,
+ 	.old_datarate_fb_limit = true,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8814a.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8814a.c
+@@ -2200,6 +2200,7 @@ const struct rtw_chip_info rtw8814a_hw_s
+ 	.rx_ldpc = true,
+ 	.max_power_index = 0x3f,
+ 	.ampdu_density = IEEE80211_HT_MPDU_DENSITY_2,
++	.amsdu_in_ampdu = false, /* RX speed is better without AMSDU */
+ 	.usb_tx_agg_desc_num = 3,
+ 	.hw_feature_report = false,
+ 	.c2h_ra_report_size = 6,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821a.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821a.c
+@@ -1176,6 +1176,7 @@ const struct rtw_chip_info rtw8821a_hw_s
+ 	.rfe_defs = rtw8821a_rfe_defs,
+ 	.rfe_defs_size = ARRAY_SIZE(rtw8821a_rfe_defs),
+ 	.rx_ldpc = false,
++	.amsdu_in_ampdu = true,
+ 	.hw_feature_report = false,
+ 	.c2h_ra_report_size = 4,
+ 	.old_datarate_fb_limit = true,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821c.c
+@@ -1991,6 +1991,7 @@ const struct rtw_chip_info rtw8821c_hw_s
+ 	.band = RTW_BAND_2G | RTW_BAND_5G,
+ 	.page_size = TX_PAGE_SIZE,
+ 	.dig_min = 0x1c,
++	.amsdu_in_ampdu = true,
+ 	.usb_tx_agg_desc_num = 3,
+ 	.hw_feature_report = true,
+ 	.c2h_ra_report_size = 7,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
+@@ -2532,6 +2532,7 @@ const struct rtw_chip_info rtw8822b_hw_s
+ 	.band = RTW_BAND_2G | RTW_BAND_5G,
+ 	.page_size = TX_PAGE_SIZE,
+ 	.dig_min = 0x1c,
++	.amsdu_in_ampdu = true,
+ 	.usb_tx_agg_desc_num = 3,
+ 	.hw_feature_report = true,
+ 	.c2h_ra_report_size = 7,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
+@@ -5350,6 +5350,7 @@ const struct rtw_chip_info rtw8822c_hw_s
+ 	.band = RTW_BAND_2G | RTW_BAND_5G,
+ 	.page_size = TX_PAGE_SIZE,
+ 	.dig_min = 0x20,
++	.amsdu_in_ampdu = true,
+ 	.usb_tx_agg_desc_num = 3,
+ 	.hw_feature_report = true,
+ 	.c2h_ra_report_size = 7,

package/kernel/mac80211/patches/rtl/099-v6.16-wifi-rtw88-Fix-the-module-names-printed-in-dmesg.patch

@@ -0,0 +1,230 @@
+From 581cf3a9cb61daae1009c2380b228f40177046d8 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 2 Apr 2025 20:54:30 +0300
+Subject: [PATCH] wifi: rtw88: Fix the module names printed in dmesg
+
+The rtw88 module names all start with the "rtw88_" prefix, but the
+messages in dmesg mostly use the "rtw_" prefix. The messages from
+rtw88_8723cs don't even have the underscore.
+
+Use the KBUILD_MODNAME macro in every driver. This ensures that the
+messages in dmesg will always use the module name.
+
+Before:
+
+Mar 17 15:54:19 ideapad2 kernel: rtw_8814au 2-4:1.0: Firmware version 33.6.0, H2C version 6
+
+After:
+
+Mar 17 16:33:35 ideapad2 kernel: rtw88_8814au 2-4:1.0: Firmware version 33.6.0, H2C version 6
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/29cd29ba-bc51-4d5b-ad48-a43c6ce72d56@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/rtw8723cs.c | 2 +-
+ drivers/net/wireless/realtek/rtw88/rtw8723de.c | 2 +-
+ drivers/net/wireless/realtek/rtw88/rtw8723ds.c | 2 +-
+ drivers/net/wireless/realtek/rtw88/rtw8723du.c | 2 +-
+ drivers/net/wireless/realtek/rtw88/rtw8812au.c | 2 +-
+ drivers/net/wireless/realtek/rtw88/rtw8814ae.c | 2 +-
+ drivers/net/wireless/realtek/rtw88/rtw8814au.c | 2 +-
+ drivers/net/wireless/realtek/rtw88/rtw8821au.c | 2 +-
+ drivers/net/wireless/realtek/rtw88/rtw8821ce.c | 2 +-
+ drivers/net/wireless/realtek/rtw88/rtw8821cs.c | 2 +-
+ drivers/net/wireless/realtek/rtw88/rtw8821cu.c | 2 +-
+ drivers/net/wireless/realtek/rtw88/rtw8822be.c | 2 +-
+ drivers/net/wireless/realtek/rtw88/rtw8822bs.c | 2 +-
+ drivers/net/wireless/realtek/rtw88/rtw8822bu.c | 2 +-
+ drivers/net/wireless/realtek/rtw88/rtw8822ce.c | 2 +-
+ drivers/net/wireless/realtek/rtw88/rtw8822cs.c | 2 +-
+ drivers/net/wireless/realtek/rtw88/rtw8822cu.c | 2 +-
+ 17 files changed, 17 insertions(+), 17 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/rtw8723cs.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8723cs.c
+@@ -19,7 +19,7 @@ static const struct sdio_device_id rtw_8
+ MODULE_DEVICE_TABLE(sdio, rtw_8723cs_id_table);
+ 
+ static struct sdio_driver rtw_8723cs_driver = {
+-	.name = "rtw8723cs",
++	.name = KBUILD_MODNAME,
+ 	.id_table = rtw_8723cs_id_table,
+ 	.probe = rtw_sdio_probe,
+ 	.remove = rtw_sdio_remove,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8723de.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8723de.c
+@@ -17,7 +17,7 @@ static const struct pci_device_id rtw_87
+ MODULE_DEVICE_TABLE(pci, rtw_8723de_id_table);
+ 
+ static struct pci_driver rtw_8723de_driver = {
+-	.name = "rtw_8723de",
++	.name = KBUILD_MODNAME,
+ 	.id_table = rtw_8723de_id_table,
+ 	.probe = rtw_pci_probe,
+ 	.remove = rtw_pci_remove,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8723ds.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8723ds.c
+@@ -25,7 +25,7 @@ static const struct sdio_device_id rtw_8
+ MODULE_DEVICE_TABLE(sdio, rtw_8723ds_id_table);
+ 
+ static struct sdio_driver rtw_8723ds_driver = {
+-	.name = "rtw_8723ds",
++	.name = KBUILD_MODNAME,
+ 	.probe = rtw_sdio_probe,
+ 	.remove = rtw_sdio_remove,
+ 	.id_table = rtw_8723ds_id_table,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8723du.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8723du.c
+@@ -24,7 +24,7 @@ static int rtw8723du_probe(struct usb_in
+ }
+ 
+ static struct usb_driver rtw_8723du_driver = {
+-	.name = "rtw_8723du",
++	.name = KBUILD_MODNAME,
+ 	.id_table = rtw_8723du_id_table,
+ 	.probe = rtw8723du_probe,
+ 	.disconnect = rtw_usb_disconnect,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8812au.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8812au.c
+@@ -82,7 +82,7 @@ static const struct usb_device_id rtw_88
+ MODULE_DEVICE_TABLE(usb, rtw_8812au_id_table);
+ 
+ static struct usb_driver rtw_8812au_driver = {
+-	.name = "rtw_8812au",
++	.name = KBUILD_MODNAME,
+ 	.id_table = rtw_8812au_id_table,
+ 	.probe = rtw_usb_probe,
+ 	.disconnect = rtw_usb_disconnect,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8814ae.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8814ae.c
+@@ -17,7 +17,7 @@ static const struct pci_device_id rtw_88
+ MODULE_DEVICE_TABLE(pci, rtw_8814ae_id_table);
+ 
+ static struct pci_driver rtw_8814ae_driver = {
+-	.name = "rtw_8814ae",
++	.name = KBUILD_MODNAME,
+ 	.id_table = rtw_8814ae_id_table,
+ 	.probe = rtw_pci_probe,
+ 	.remove = rtw_pci_remove,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8814au.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8814au.c
+@@ -42,7 +42,7 @@ static const struct usb_device_id rtw_88
+ MODULE_DEVICE_TABLE(usb, rtw_8814au_id_table);
+ 
+ static struct usb_driver rtw_8814au_driver = {
+-	.name = "rtw_8814au",
++	.name = KBUILD_MODNAME,
+ 	.id_table = rtw_8814au_id_table,
+ 	.probe = rtw_usb_probe,
+ 	.disconnect = rtw_usb_disconnect,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821au.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821au.c
+@@ -66,7 +66,7 @@ static const struct usb_device_id rtw_88
+ MODULE_DEVICE_TABLE(usb, rtw_8821au_id_table);
+ 
+ static struct usb_driver rtw_8821au_driver = {
+-	.name = "rtw_8821au",
++	.name = KBUILD_MODNAME,
+ 	.id_table = rtw_8821au_id_table,
+ 	.probe = rtw_usb_probe,
+ 	.disconnect = rtw_usb_disconnect,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821ce.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821ce.c
+@@ -21,7 +21,7 @@ static const struct pci_device_id rtw_88
+ MODULE_DEVICE_TABLE(pci, rtw_8821ce_id_table);
+ 
+ static struct pci_driver rtw_8821ce_driver = {
+-	.name = "rtw_8821ce",
++	.name = KBUILD_MODNAME,
+ 	.id_table = rtw_8821ce_id_table,
+ 	.probe = rtw_pci_probe,
+ 	.remove = rtw_pci_remove,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821cs.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821cs.c
+@@ -20,7 +20,7 @@ static const struct sdio_device_id rtw_8
+ MODULE_DEVICE_TABLE(sdio, rtw_8821cs_id_table);
+ 
+ static struct sdio_driver rtw_8821cs_driver = {
+-	.name = "rtw_8821cs",
++	.name = KBUILD_MODNAME,
+ 	.probe = rtw_sdio_probe,
+ 	.remove = rtw_sdio_remove,
+ 	.id_table = rtw_8821cs_id_table,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821cu.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821cu.c
+@@ -48,7 +48,7 @@ static int rtw_8821cu_probe(struct usb_i
+ }
+ 
+ static struct usb_driver rtw_8821cu_driver = {
+-	.name = "rtw_8821cu",
++	.name = KBUILD_MODNAME,
+ 	.id_table = rtw_8821cu_id_table,
+ 	.probe = rtw_8821cu_probe,
+ 	.disconnect = rtw_usb_disconnect,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822be.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822be.c
+@@ -17,7 +17,7 @@ static const struct pci_device_id rtw_88
+ MODULE_DEVICE_TABLE(pci, rtw_8822be_id_table);
+ 
+ static struct pci_driver rtw_8822be_driver = {
+-	.name = "rtw_8822be",
++	.name = KBUILD_MODNAME,
+ 	.id_table = rtw_8822be_id_table,
+ 	.probe = rtw_pci_probe,
+ 	.remove = rtw_pci_remove,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822bs.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822bs.c
+@@ -20,7 +20,7 @@ static const struct sdio_device_id rtw_8
+ MODULE_DEVICE_TABLE(sdio, rtw_8822bs_id_table);
+ 
+ static struct sdio_driver rtw_8822bs_driver = {
+-	.name = "rtw_8822bs",
++	.name = KBUILD_MODNAME,
+ 	.probe = rtw_sdio_probe,
+ 	.remove = rtw_sdio_remove,
+ 	.id_table = rtw_8822bs_id_table,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822bu.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822bu.c
+@@ -88,7 +88,7 @@ static int rtw8822bu_probe(struct usb_in
+ }
+ 
+ static struct usb_driver rtw_8822bu_driver = {
+-	.name = "rtw_8822bu",
++	.name = KBUILD_MODNAME,
+ 	.id_table = rtw_8822bu_id_table,
+ 	.probe = rtw8822bu_probe,
+ 	.disconnect = rtw_usb_disconnect,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822ce.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822ce.c
+@@ -21,7 +21,7 @@ static const struct pci_device_id rtw_88
+ MODULE_DEVICE_TABLE(pci, rtw_8822ce_id_table);
+ 
+ static struct pci_driver rtw_8822ce_driver = {
+-	.name = "rtw_8822ce",
++	.name = KBUILD_MODNAME,
+ 	.id_table = rtw_8822ce_id_table,
+ 	.probe = rtw_pci_probe,
+ 	.remove = rtw_pci_remove,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822cs.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822cs.c
+@@ -20,7 +20,7 @@ static const struct sdio_device_id rtw_8
+ MODULE_DEVICE_TABLE(sdio, rtw_8822cs_id_table);
+ 
+ static struct sdio_driver rtw_8822cs_driver = {
+-	.name = "rtw_8822cs",
++	.name = KBUILD_MODNAME,
+ 	.probe = rtw_sdio_probe,
+ 	.remove = rtw_sdio_remove,
+ 	.id_table = rtw_8822cs_id_table,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822cu.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822cu.c
+@@ -32,7 +32,7 @@ static int rtw8822cu_probe(struct usb_in
+ }
+ 
+ static struct usb_driver rtw_8822cu_driver = {
+-	.name = "rtw_8822cu",
++	.name = KBUILD_MODNAME,
+ 	.id_table = rtw_8822cu_id_table,
+ 	.probe = rtw8822cu_probe,
+ 	.disconnect = rtw_usb_disconnect,

package/kernel/mac80211/patches/rtl/100-v6.16-wifi-rtw88-sdio-map-mgmt-frames-to-queue-TX_DESC_QSE.patch

@@ -0,0 +1,36 @@
+From b2effcdc237979dcc533d446a792fc54fd0e1213 Mon Sep 17 00:00:00 2001
+From: Zhen XIN <zhen.xin@nokia-sbell.com>
+Date: Thu, 10 Apr 2025 15:42:17 +0000
+Subject: [PATCH] wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT
+
+The rtw88-sdio do not work in AP mode due to the lack of TX status report
+for management frames.
+
+Map the management frames to queue TX_DESC_QSEL_MGMT, which enables the
+chip to generate TX reports for these frames
+
+Tested-on: rtl8723ds
+
+Fixes: 65371a3f14e7 ("wifi: rtw88: sdio: Add HCI implementation for SDIO based chipsets")
+Signed-off-by: Zhen XIN <zhen.xin@nokia-sbell.com>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250410154217.1849977-3-zhen.xin@nokia-sbell.com
+---
+ drivers/net/wireless/realtek/rtw88/sdio.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/sdio.c
++++ b/drivers/net/wireless/realtek/rtw88/sdio.c
+@@ -718,10 +718,7 @@ static u8 rtw_sdio_get_tx_qsel(struct rt
+ 	case RTW_TX_QUEUE_H2C:
+ 		return TX_DESC_QSEL_H2C;
+ 	case RTW_TX_QUEUE_MGMT:
+-		if (rtw_chip_wcpu_11n(rtwdev))
+-			return TX_DESC_QSEL_HIGH;
+-		else
+-			return TX_DESC_QSEL_MGMT;
++		return TX_DESC_QSEL_MGMT;
+ 	case RTW_TX_QUEUE_HI0:
+ 		return TX_DESC_QSEL_HIGH;
+ 	default:

package/kernel/mac80211/patches/rtl/101-v6.16-wifi-rtw88-sdio-call-rtw_sdio_indicate_tx_status-unc.patch

@@ -0,0 +1,37 @@
+From fc5f5a0ec463ae6a07850428bd3082947e01d276 Mon Sep 17 00:00:00 2001
+From: Zhen XIN <zhen.xin@nokia-sbell.com>
+Date: Thu, 10 Apr 2025 15:42:16 +0000
+Subject: [PATCH] wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status
+ unconditionally
+
+The rtw88-sdio do not work in AP mode due to the lack of TX status report
+for management frames.
+
+Make the invocation of rtw_sdio_indicate_tx_status unconditional and cover
+all packet queues
+
+Tested-on: rtl8723ds
+
+Fixes: 65371a3f14e7 ("wifi: rtw88: sdio: Add HCI implementation for SDIO based chipsets")
+Signed-off-by: Zhen XIN <zhen.xin@nokia-sbell.com>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250410154217.1849977-2-zhen.xin@nokia-sbell.com
+---
+ drivers/net/wireless/realtek/rtw88/sdio.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/sdio.c
++++ b/drivers/net/wireless/realtek/rtw88/sdio.c
+@@ -1224,10 +1224,7 @@ static void rtw_sdio_process_tx_queue(st
+ 		return;
+ 	}
+ 
+-	if (queue <= RTW_TX_QUEUE_VO)
+-		rtw_sdio_indicate_tx_status(rtwdev, skb);
+-	else
+-		dev_kfree_skb_any(skb);
++	rtw_sdio_indicate_tx_status(rtwdev, skb);
+ }
+ 
+ static void rtw_sdio_tx_handler(struct work_struct *work)

package/kernel/mac80211/patches/rtl/102-v6.16-wifi-rtw88-do-not-ignore-hardware-read-error-during-.patch

@@ -0,0 +1,32 @@
+From 20d3c19bd8f9b498173c198eadf54580c8caa336 Mon Sep 17 00:00:00 2001
+From: Dmitry Antipov <dmantipov@yandex.ru>
+Date: Tue, 15 Apr 2025 12:07:20 +0300
+Subject: [PATCH] wifi: rtw88: do not ignore hardware read error during DPK
+
+In 'rtw8822c_dpk_cal_coef1()', do not ignore error returned
+by 'check_hw_ready()' but issue a warning to denote possible
+DPK issue. Compile tested only.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 5227c2ee453d ("rtw88: 8822c: add SW DPK support")
+Suggested-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250415090720.194048-1-dmantipov@yandex.ru
+---
+ drivers/net/wireless/realtek/rtw88/rtw8822c.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
+@@ -3951,7 +3951,8 @@ static void rtw8822c_dpk_cal_coef1(struc
+ 	rtw_write32(rtwdev, REG_NCTL0, 0x00001148);
+ 	rtw_write32(rtwdev, REG_NCTL0, 0x00001149);
+ 
+-	check_hw_ready(rtwdev, 0x2d9c, MASKBYTE0, 0x55);
++	if (!check_hw_ready(rtwdev, 0x2d9c, MASKBYTE0, 0x55))
++		rtw_warn(rtwdev, "DPK stuck, performance may be suboptimal");
+ 
+ 	rtw_write8(rtwdev, 0x1b10, 0x0);
+ 	rtw_write32_mask(rtwdev, REG_NCTL0, BIT_SUBPAGE, 0x0000000c);

package/kernel/mac80211/patches/rtl/103-v6.16-wifi-rtw88-Fix-RX-aggregation-settings-for-RTL8723DS.patch

@@ -0,0 +1,44 @@
+From 0ffa1ba81b35ba147c9df6206a61499a156b0128 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Fri, 2 May 2025 14:49:01 +0300
+Subject: [PATCH] wifi: rtw88: Fix RX aggregation settings for RTL8723DS
+
+Use the same RX aggregation size and timeout used by the out-of-tree
+RTL8723DS driver. Also set mystery bit 31 of REG_RXDMA_AGG_PG_TH. This
+improves the RX speed from ~44 Mbps to ~67 Mbps.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/4c79fdc1-54bc-4986-9931-bb3ceb418b97@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/sdio.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/sdio.c
++++ b/drivers/net/wireless/realtek/rtw88/sdio.c
+@@ -677,12 +677,22 @@ static void rtw_sdio_enable_rx_aggregati
+ {
+ 	u8 size, timeout;
+ 
+-	if (rtw_chip_wcpu_11n(rtwdev)) {
++	switch (rtwdev->chip->id) {
++	case RTW_CHIP_TYPE_8703B:
++	case RTW_CHIP_TYPE_8821A:
++	case RTW_CHIP_TYPE_8812A:
+ 		size = 0x6;
+ 		timeout = 0x6;
+-	} else {
++		break;
++	case RTW_CHIP_TYPE_8723D:
++		size = 0xa;
++		timeout = 0x3;
++		rtw_write8_set(rtwdev, REG_RXDMA_AGG_PG_TH + 3, BIT(7));
++		break;
++	default:
+ 		size = 0xff;
+ 		timeout = 0x1;
++		break;
+ 	}
+ 
+ 	/* Make the firmware honor the size limit configured below */

package/kernel/mac80211/patches/rtl/104-v6.16-wifi-rtw88-Handle-RTL8723D-S-with-blank-efuse.patch

@@ -0,0 +1,198 @@
+From 2c17afde9ff6713f3e080ed1ea1a4bd7480be9aa Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Fri, 2 May 2025 14:49:34 +0300
+Subject: [PATCH] wifi: rtw88: Handle RTL8723D(S) with blank efuse
+
+Some users have RTL8723DS chips with nearly blank efuse. Currently these
+chips cannot connect when using rtw88, but they do work using the old
+out-of-tree driver.
+
+Use reasonable default values for TX power, antenna configuration, and
+crystal cap if the chip's efuse is missing these things.
+
+RTL8723D can use the same default values as RTL8703B, so simply move
+the code from rtl8703b_read_efuse() to the shared function
+__rtl8723x_read_efuse().
+
+Link: https://github.com/lwfinger/rtw88/issues/157
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/5734afe7-0870-40b2-acd4-5657a02d7c56@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/rtw8703b.c | 60 -------------------
+ drivers/net/wireless/realtek/rtw88/rtw8723x.c | 59 ++++++++++++++++++
+ 2 files changed, 59 insertions(+), 60 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/rtw8703b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8703b.c
+@@ -519,15 +519,6 @@ static const struct rtw_rqpn rqpn_table_
+ 	 RTW_DMA_MAPPING_EXTRA, RTW_DMA_MAPPING_HIGH},
+ };
+ 
+-/* Default power index table for RTL8703B, used if EFUSE does not
+- * contain valid data. Replaces EFUSE data from offset 0x10 (start of
+- * txpwr_idx_table).
+- */
+-static const u8 rtw8703b_txpwr_idx_table[] = {
+-	0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D,
+-	0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x02
+-};
+-
+ static void try_mac_from_devicetree(struct rtw_dev *rtwdev)
+ {
+ 	struct device_node *node = rtwdev->dev->of_node;
+@@ -544,15 +535,9 @@ static void try_mac_from_devicetree(stru
+ 	}
+ }
+ 
+-#define DBG_EFUSE_FIX(rtwdev, name)					\
+-	rtw_dbg(rtwdev, RTW_DBG_EFUSE, "Fixed invalid EFUSE value: "	\
+-		# name "=0x%x\n", rtwdev->efuse.name)
+-
+ static int rtw8703b_read_efuse(struct rtw_dev *rtwdev, u8 *log_map)
+ {
+ 	struct rtw_efuse *efuse = &rtwdev->efuse;
+-	u8 *pwr = (u8 *)efuse->txpwr_idx_table;
+-	bool valid = false;
+ 	int ret;
+ 
+ 	ret = rtw8723x_read_efuse(rtwdev, log_map);
+@@ -562,51 +547,6 @@ static int rtw8703b_read_efuse(struct rt
+ 	if (!is_valid_ether_addr(efuse->addr))
+ 		try_mac_from_devicetree(rtwdev);
+ 
+-	/* If TX power index table in EFUSE is invalid, fall back to
+-	 * built-in table.
+-	 */
+-	for (int i = 0; i < ARRAY_SIZE(rtw8703b_txpwr_idx_table); i++)
+-		if (pwr[i] != 0xff) {
+-			valid = true;
+-			break;
+-		}
+-	if (!valid) {
+-		for (int i = 0; i < ARRAY_SIZE(rtw8703b_txpwr_idx_table); i++)
+-			pwr[i] = rtw8703b_txpwr_idx_table[i];
+-		rtw_dbg(rtwdev, RTW_DBG_EFUSE,
+-			"Replaced invalid EFUSE TX power index table.");
+-		rtw8723x_debug_txpwr_limit(rtwdev,
+-					   efuse->txpwr_idx_table, 2);
+-	}
+-
+-	/* Override invalid antenna settings. */
+-	if (efuse->bt_setting == 0xff) {
+-		/* shared antenna */
+-		efuse->bt_setting |= BIT(0);
+-		/* RF path A */
+-		efuse->bt_setting &= ~BIT(6);
+-		DBG_EFUSE_FIX(rtwdev, bt_setting);
+-	}
+-
+-	/* Override invalid board options: The coex code incorrectly
+-	 * assumes that if bits 6 & 7 are set the board doesn't
+-	 * support coex. Regd is also derived from rf_board_option and
+-	 * should be 0 if there's no valid data.
+-	 */
+-	if (efuse->rf_board_option == 0xff) {
+-		efuse->regd = 0;
+-		efuse->rf_board_option &= GENMASK(5, 0);
+-		DBG_EFUSE_FIX(rtwdev, rf_board_option);
+-	}
+-
+-	/* Override invalid crystal cap setting, default comes from
+-	 * vendor driver. Chip specific.
+-	 */
+-	if (efuse->crystal_cap == 0xff) {
+-		efuse->crystal_cap = 0x20;
+-		DBG_EFUSE_FIX(rtwdev, crystal_cap);
+-	}
+-
+ 	return 0;
+ }
+ 
+--- a/drivers/net/wireless/realtek/rtw88/rtw8723x.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8723x.c
+@@ -69,6 +69,9 @@ static void __rtw8723x_lck(struct rtw_de
+ #define DBG_EFUSE_2BYTE(rtwdev, map, name)			\
+ 	rtw_dbg(rtwdev, RTW_DBG_EFUSE, # name "=0x%02x%02x\n",	\
+ 		(map)->name[0], (map)->name[1])
++#define DBG_EFUSE_FIX(rtwdev, name)					\
++	rtw_dbg(rtwdev, RTW_DBG_EFUSE, "Fixed invalid EFUSE value: "	\
++		# name "=0x%x\n", rtwdev->efuse.name)
+ 
+ static void rtw8723xe_efuse_debug(struct rtw_dev *rtwdev,
+ 				  struct rtw8723x_efuse *map)
+@@ -238,10 +241,21 @@ static void rtw8723xs_efuse_parsing(stru
+ 	ether_addr_copy(efuse->addr, map->s.mac_addr);
+ }
+ 
++/* Default power index table for RTL8703B/RTL8723D, used if EFUSE does
++ * not contain valid data. Replaces EFUSE data from offset 0x10 (start
++ * of txpwr_idx_table).
++ */
++static const u8 rtw8723x_txpwr_idx_table[] = {
++	0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x2D,
++	0x2D, 0x2D, 0x2D, 0x2D, 0x2D, 0x02
++};
++
+ static int __rtw8723x_read_efuse(struct rtw_dev *rtwdev, u8 *log_map)
+ {
+ 	struct rtw_efuse *efuse = &rtwdev->efuse;
++	u8 *pwr = (u8 *)efuse->txpwr_idx_table;
+ 	struct rtw8723x_efuse *map;
++	bool valid = false;
+ 	int i;
+ 
+ 	map = (struct rtw8723x_efuse *)log_map;
+@@ -279,6 +293,51 @@ static int __rtw8723x_read_efuse(struct
+ 		return -EOPNOTSUPP;
+ 	}
+ 
++	/* If TX power index table in EFUSE is invalid, fall back to
++	 * built-in table.
++	 */
++	for (i = 0; i < ARRAY_SIZE(rtw8723x_txpwr_idx_table); i++)
++		if (pwr[i] != 0xff) {
++			valid = true;
++			break;
++		}
++	if (!valid) {
++		for (i = 0; i < ARRAY_SIZE(rtw8723x_txpwr_idx_table); i++)
++			pwr[i] = rtw8723x_txpwr_idx_table[i];
++		rtw_dbg(rtwdev, RTW_DBG_EFUSE,
++			"Replaced invalid EFUSE TX power index table.");
++		rtw8723x_debug_txpwr_limit(rtwdev,
++					   efuse->txpwr_idx_table, 2);
++	}
++
++	/* Override invalid antenna settings. */
++	if (efuse->bt_setting == 0xff) {
++		/* shared antenna */
++		efuse->bt_setting |= BIT(0);
++		/* RF path A */
++		efuse->bt_setting &= ~BIT(6);
++		DBG_EFUSE_FIX(rtwdev, bt_setting);
++	}
++
++	/* Override invalid board options: The coex code incorrectly
++	 * assumes that if bits 6 & 7 are set the board doesn't
++	 * support coex. Regd is also derived from rf_board_option and
++	 * should be 0 if there's no valid data.
++	 */
++	if (efuse->rf_board_option == 0xff) {
++		efuse->regd = 0;
++		efuse->rf_board_option &= GENMASK(5, 0);
++		DBG_EFUSE_FIX(rtwdev, rf_board_option);
++	}
++
++	/* Override invalid crystal cap setting, default comes from
++	 * vendor driver. Chip specific.
++	 */
++	if (efuse->crystal_cap == 0xff) {
++		efuse->crystal_cap = 0x20;
++		DBG_EFUSE_FIX(rtwdev, crystal_cap);
++	}
++
+ 	return 0;
+ }
+ 

package/kernel/mac80211/patches/rtl/105-v6.16-wifi-rtw88-rtw8822bu-VID-PID-for-BUFFALO-WI-U2-866DM.patch

@@ -0,0 +1,27 @@
+From b7f0cc647e52296a3d4dd727b6479dcd6d7e364e Mon Sep 17 00:00:00 2001
+From: Yuuki NAGAO <wf.yn386@gmail.com>
+Date: Sat, 3 May 2025 09:32:27 +0900
+Subject: [PATCH] wifi: rtw88: rtw8822bu VID/PID for BUFFALO WI-U2-866DM
+
+Add VID/PID 0411/03d1 for recently released
+BUFFALO WI-U2-866DM USB WiFi adapter.
+
+Signed-off-by: Yuuki NAGAO <wf.yn386@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250503003227.6673-1-wf.yn386@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/rtw8822bu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822bu.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822bu.c
+@@ -77,6 +77,8 @@ static const struct usb_device_id rtw_88
+ 	  .driver_info = (kernel_ulong_t)&(rtw8822b_hw_spec) }, /* Mercusys MA30N */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3322, 0xff, 0xff, 0xff),
+ 	  .driver_info = (kernel_ulong_t)&(rtw8822b_hw_spec) }, /* D-Link DWA-T185 rev. A1 */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x0411, 0x03d1, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8822b_hw_spec) }, /* BUFFALO WI-U2-866DM */
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(usb, rtw_8822bu_id_table);

package/kernel/mac80211/patches/rtl/106-v6.16-wifi-rtw88-usb-Reduce-control-message-timeout-to-500.patch

@@ -0,0 +1,52 @@
+From 490340faddea461319652ce36dbc7c1b4482c35e Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Sat, 10 May 2025 15:21:25 +0300
+Subject: [PATCH] wifi: rtw88: usb: Reduce control message timeout to 500 ms
+
+RTL8811AU stops responding during the firmware download on some systems:
+
+[  809.256440] rtw_8821au 5-2.1:1.0: Firmware version 42.4.0, H2C version 0
+[  812.759142] rtw_8821au 5-2.1:1.0 wlp48s0f4u2u1: renamed from wlan0
+[  837.315388] rtw_8821au 1-4:1.0: write register 0x1ef4 failed with -110
+[  867.524259] rtw_8821au 1-4:1.0: write register 0x1ef8 failed with -110
+[  868.930976] rtw_8821au 5-2.1:1.0 wlp48s0f4u2u1: entered promiscuous mode
+[  897.730952] rtw_8821au 1-4:1.0: write register 0x1efc failed with -110
+
+Each write takes 30 seconds to fail because that's the timeout currently
+used for control messages in rtw_usb_write().
+
+In this scenario the firmware download takes at least 2000 seconds.
+Because this is done from the USB probe function, the long delay makes
+other things in the system hang.
+
+Reduce the timeout to 500 ms. This is the value used by the official USB
+wifi drivers from Realtek.
+
+Of course this only makes things hang for ~30 seconds instead of ~30
+minutes. It doesn't fix the firmware download.
+
+Tested with RTL8822CU, RTL8812BU, RTL8811CU, RTL8814AU, RTL8811AU,
+RTL8812AU, RTL8821AU, RTL8723DU.
+
+Cc: stable@vger.kernel.org
+Fixes: a82dfd33d123 ("wifi: rtw88: Add common USB chip support")
+Link: https://github.com/lwfinger/rtw88/issues/344
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/1e35dd26-3f10-40b1-b2b4-f72184a26611@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/usb.c
++++ b/drivers/net/wireless/realtek/rtw88/usb.c
+@@ -139,7 +139,7 @@ static void rtw_usb_write(struct rtw_dev
+ 
+ 	ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+ 			      RTW_USB_CMD_REQ, RTW_USB_CMD_WRITE,
+-			      addr, 0, data, len, 30000);
++			      addr, 0, data, len, 500);
+ 	if (ret < 0 && ret != -ENODEV && count++ < 4)
+ 		rtw_err(rtwdev, "write register 0x%x failed with %d\n",
+ 			addr, ret);

package/kernel/mac80211/patches/rtl/107-v6.16-wifi-rtw88-usb-Upload-the-firmware-in-bigger-chunks.patch

@@ -0,0 +1,214 @@
+From 80fe0bc1659c0ccc79d082e426fa376be5df9c04 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Sat, 10 May 2025 15:22:24 +0300
+Subject: [PATCH] wifi: rtw88: usb: Upload the firmware in bigger chunks
+
+RTL8811AU stops responding during the firmware download on some systems:
+
+[  809.256440] rtw_8821au 5-2.1:1.0: Firmware version 42.4.0, H2C version 0
+[  812.759142] rtw_8821au 5-2.1:1.0 wlp48s0f4u2u1: renamed from wlan0
+[  837.315388] rtw_8821au 1-4:1.0: write register 0x1ef4 failed with -110
+[  867.524259] rtw_8821au 1-4:1.0: write register 0x1ef8 failed with -110
+[  868.930976] rtw_8821au 5-2.1:1.0 wlp48s0f4u2u1: entered promiscuous mode
+[  897.730952] rtw_8821au 1-4:1.0: write register 0x1efc failed with -110
+
+Maybe it takes too long when writing the firmware 4 bytes at a time.
+
+Write 196 bytes at a time for RTL8821AU, RTL8811AU, and RTL8812AU,
+and 254 bytes at a time for RTL8723DU. These are the sizes used in
+their official drivers. Tested with all these chips.
+
+Cc: stable@vger.kernel.org
+Link: https://github.com/lwfinger/rtw88/issues/344
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/43f1daad-3ec0-4a3b-a50c-9cd9eb2c2f52@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/hci.h  |  8 ++++
+ drivers/net/wireless/realtek/rtw88/mac.c  | 11 +++--
+ drivers/net/wireless/realtek/rtw88/mac.h  |  2 +
+ drivers/net/wireless/realtek/rtw88/pci.c  |  2 +
+ drivers/net/wireless/realtek/rtw88/sdio.c |  2 +
+ drivers/net/wireless/realtek/rtw88/usb.c  | 55 +++++++++++++++++++++++
+ 6 files changed, 76 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/hci.h
++++ b/drivers/net/wireless/realtek/rtw88/hci.h
+@@ -19,6 +19,8 @@ struct rtw_hci_ops {
+ 	void (*link_ps)(struct rtw_dev *rtwdev, bool enter);
+ 	void (*interface_cfg)(struct rtw_dev *rtwdev);
+ 	void (*dynamic_rx_agg)(struct rtw_dev *rtwdev, bool enable);
++	void (*write_firmware_page)(struct rtw_dev *rtwdev, u32 page,
++				    const u8 *data, u32 size);
+ 
+ 	int (*write_data_rsvd_page)(struct rtw_dev *rtwdev, u8 *buf, u32 size);
+ 	int (*write_data_h2c)(struct rtw_dev *rtwdev, u8 *buf, u32 size);
+@@ -79,6 +81,12 @@ static inline void rtw_hci_dynamic_rx_ag
+ 		rtwdev->hci.ops->dynamic_rx_agg(rtwdev, enable);
+ }
+ 
++static inline void rtw_hci_write_firmware_page(struct rtw_dev *rtwdev, u32 page,
++					       const u8 *data, u32 size)
++{
++	rtwdev->hci.ops->write_firmware_page(rtwdev, page, data, size);
++}
++
+ static inline int
+ rtw_hci_write_data_rsvd_page(struct rtw_dev *rtwdev, u8 *buf, u32 size)
+ {
+--- a/drivers/net/wireless/realtek/rtw88/mac.c
++++ b/drivers/net/wireless/realtek/rtw88/mac.c
+@@ -856,8 +856,8 @@ fwdl_ready:
+ 	}
+ }
+ 
+-static void
+-write_firmware_page(struct rtw_dev *rtwdev, u32 page, const u8 *data, u32 size)
++void rtw_write_firmware_page(struct rtw_dev *rtwdev, u32 page,
++			     const u8 *data, u32 size)
+ {
+ 	u32 val32;
+ 	u32 block_nr;
+@@ -887,6 +887,7 @@ write_firmware_page(struct rtw_dev *rtwd
+ 		rtw_write32(rtwdev, write_addr, le32_to_cpu(remain_data));
+ 	}
+ }
++EXPORT_SYMBOL(rtw_write_firmware_page);
+ 
+ static int
+ download_firmware_legacy(struct rtw_dev *rtwdev, const u8 *data, u32 size)
+@@ -904,11 +905,13 @@ download_firmware_legacy(struct rtw_dev
+ 	rtw_write8_set(rtwdev, REG_MCUFW_CTRL, BIT_FWDL_CHK_RPT);
+ 
+ 	for (page = 0; page < total_page; page++) {
+-		write_firmware_page(rtwdev, page, data, DLFW_PAGE_SIZE_LEGACY);
++		rtw_hci_write_firmware_page(rtwdev, page, data,
++					    DLFW_PAGE_SIZE_LEGACY);
+ 		data += DLFW_PAGE_SIZE_LEGACY;
+ 	}
+ 	if (last_page_size)
+-		write_firmware_page(rtwdev, page, data, last_page_size);
++		rtw_hci_write_firmware_page(rtwdev, page, data,
++					    last_page_size);
+ 
+ 	if (!check_hw_ready(rtwdev, REG_MCUFW_CTRL, BIT_FWDL_CHK_RPT, 1)) {
+ 		rtw_err(rtwdev, "failed to check download firmware report\n");
+--- a/drivers/net/wireless/realtek/rtw88/mac.h
++++ b/drivers/net/wireless/realtek/rtw88/mac.h
+@@ -34,6 +34,8 @@ int rtw_pwr_seq_parser(struct rtw_dev *r
+ 		       const struct rtw_pwr_seq_cmd * const *cmd_seq);
+ int rtw_mac_power_on(struct rtw_dev *rtwdev);
+ void rtw_mac_power_off(struct rtw_dev *rtwdev);
++void rtw_write_firmware_page(struct rtw_dev *rtwdev, u32 page,
++			     const u8 *data, u32 size);
+ int rtw_download_firmware(struct rtw_dev *rtwdev, struct rtw_fw_state *fw);
+ int rtw_mac_init(struct rtw_dev *rtwdev);
+ void rtw_mac_flush_queues(struct rtw_dev *rtwdev, u32 queues, bool drop);
+--- a/drivers/net/wireless/realtek/rtw88/pci.c
++++ b/drivers/net/wireless/realtek/rtw88/pci.c
+@@ -12,6 +12,7 @@
+ #include "fw.h"
+ #include "ps.h"
+ #include "debug.h"
++#include "mac.h"
+ 
+ static bool rtw_disable_msi;
+ static bool rtw_pci_disable_aspm;
+@@ -1602,6 +1603,7 @@ static const struct rtw_hci_ops rtw_pci_
+ 	.link_ps = rtw_pci_link_ps,
+ 	.interface_cfg = rtw_pci_interface_cfg,
+ 	.dynamic_rx_agg = NULL,
++	.write_firmware_page = rtw_write_firmware_page,
+ 
+ 	.read8 = rtw_pci_read8,
+ 	.read16 = rtw_pci_read16,
+--- a/drivers/net/wireless/realtek/rtw88/sdio.c
++++ b/drivers/net/wireless/realtek/rtw88/sdio.c
+@@ -10,6 +10,7 @@
+ #include <linux/mmc/host.h>
+ #include <linux/mmc/sdio_func.h>
+ #include "main.h"
++#include "mac.h"
+ #include "debug.h"
+ #include "fw.h"
+ #include "ps.h"
+@@ -1164,6 +1165,7 @@ static const struct rtw_hci_ops rtw_sdio
+ 	.link_ps = rtw_sdio_link_ps,
+ 	.interface_cfg = rtw_sdio_interface_cfg,
+ 	.dynamic_rx_agg = NULL,
++	.write_firmware_page = rtw_write_firmware_page,
+ 
+ 	.read8 = rtw_sdio_read8,
+ 	.read16 = rtw_sdio_read16,
+--- a/drivers/net/wireless/realtek/rtw88/usb.c
++++ b/drivers/net/wireless/realtek/rtw88/usb.c
+@@ -165,6 +165,60 @@ static void rtw_usb_write32(struct rtw_d
+ 	rtw_usb_write(rtwdev, addr, val, 4);
+ }
+ 
++static void rtw_usb_write_firmware_page(struct rtw_dev *rtwdev, u32 page,
++					const u8 *data, u32 size)
++{
++	struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev);
++	struct usb_device *udev = rtwusb->udev;
++	u32 addr = FW_START_ADDR_LEGACY;
++	u8 *data_dup, *buf;
++	u32 n, block_size;
++	int ret;
++
++	switch (rtwdev->chip->id) {
++	case RTW_CHIP_TYPE_8723D:
++		block_size = 254;
++		break;
++	default:
++		block_size = 196;
++		break;
++	}
++
++	data_dup = kmemdup(data, size, GFP_KERNEL);
++	if (!data_dup)
++		return;
++
++	buf = data_dup;
++
++	rtw_write32_mask(rtwdev, REG_MCUFW_CTRL, BIT_ROM_PGE, page);
++
++	while (size > 0) {
++		if (size >= block_size)
++			n = block_size;
++		else if (size >= 8)
++			n = 8;
++		else
++			n = 1;
++
++		ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
++				      RTW_USB_CMD_REQ, RTW_USB_CMD_WRITE,
++				      addr, 0, buf, n, 500);
++		if (ret != n) {
++			if (ret != -ENODEV)
++				rtw_err(rtwdev,
++					"write 0x%x len %d failed: %d\n",
++					addr, n, ret);
++			break;
++		}
++
++		addr += n;
++		buf += n;
++		size -= n;
++	}
++
++	kfree(data_dup);
++}
++
+ static int dma_mapping_to_ep(enum rtw_dma_mapping dma_mapping)
+ {
+ 	switch (dma_mapping) {
+@@ -855,6 +909,7 @@ static const struct rtw_hci_ops rtw_usb_
+ 	.link_ps = rtw_usb_link_ps,
+ 	.interface_cfg = rtw_usb_interface_cfg,
+ 	.dynamic_rx_agg = rtw_usb_dynamic_rx_agg,
++	.write_firmware_page = rtw_usb_write_firmware_page,
+ 
+ 	.write8  = rtw_usb_write8,
+ 	.write16 = rtw_usb_write16,

package/kernel/mac80211/patches/rtl/108-v6.16-wifi-rtw88-Fix-the-random-error-beacon-valid-message.patch

@@ -0,0 +1,73 @@
+From f24d0d8c3cd7e4237f802c4d2f3bd4ac04572948 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Sat, 10 May 2025 16:12:34 +0300
+Subject: [PATCH] wifi: rtw88: Fix the random "error beacon valid" messages for
+ USB
+
+All the USB devices have a problem in AP mode: uploading the updated
+beacon to the chip's reserved page can randomly fail:
+
+[34996.474304] rtw88_8723du 1-2:1.2: error beacon valid
+[34996.474788] rtw88_8723du 1-2:1.2: failed to download drv rsvd page
+[34999.956369] rtw88_8723du 1-2:1.2: error beacon valid
+[34999.956846] rtw88_8723du 1-2:1.2: failed to download drv rsvd page
+[34999.956855] rtw88_8723du 1-2:1.2: failed to download beacon
+[35017.978296] rtw88_8723du 1-2:1.2: error beacon valid
+[35017.978805] rtw88_8723du 1-2:1.2: failed to download drv rsvd page
+[35017.978823] rtw88_8723du 1-2:1.2: failed to download beacon
+[35023.200395] rtw88_8723du 1-2:1.2: error beacon valid
+[35023.200869] rtw88_8723du 1-2:1.2: failed to download drv rsvd page
+[35023.200875] rtw88_8723du 1-2:1.2: failed to download beacon
+[35478.680547] rtw88_8723du 1-2:1.2: error beacon valid
+[35478.681023] rtw88_8723du 1-2:1.2: failed to download drv rsvd page
+
+Disable some beacon-related hardware functions before uploading the
+beacon and enable them again after.
+
+Tested with RTL8723DU, RTL8812BU, RTL8822CE.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/c248c40a-d432-47ed-90e0-d81ee6c32464@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/fw.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/fw.c
++++ b/drivers/net/wireless/realtek/rtw88/fw.c
+@@ -1467,7 +1467,7 @@ void rtw_add_rsvd_page_sta(struct rtw_de
+ int rtw_fw_write_data_rsvd_page(struct rtw_dev *rtwdev, u16 pg_addr,
+ 				u8 *buf, u32 size)
+ {
+-	u8 bckp[2];
++	u8 bckp[3];
+ 	u8 val;
+ 	u16 rsvd_pg_head;
+ 	u32 bcn_valid_addr;
+@@ -1479,6 +1479,8 @@ int rtw_fw_write_data_rsvd_page(struct r
+ 	if (!size)
+ 		return -EINVAL;
+ 
++	bckp[2] = rtw_read8(rtwdev, REG_BCN_CTRL);
++
+ 	if (rtw_chip_wcpu_11n(rtwdev)) {
+ 		rtw_write32_set(rtwdev, REG_DWBCN0_CTRL, BIT_BCN_VALID);
+ 	} else {
+@@ -1492,6 +1494,9 @@ int rtw_fw_write_data_rsvd_page(struct r
+ 	val |= BIT_ENSWBCN >> 8;
+ 	rtw_write8(rtwdev, REG_CR + 1, val);
+ 
++	rtw_write8(rtwdev, REG_BCN_CTRL,
++		   (bckp[2] & ~BIT_EN_BCN_FUNCTION) | BIT_DIS_TSF_UDT);
++
+ 	if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_PCIE) {
+ 		val = rtw_read8(rtwdev, REG_FWHW_TXQ_CTRL + 2);
+ 		bckp[1] = val;
+@@ -1522,6 +1527,7 @@ restore:
+ 	rsvd_pg_head = rtwdev->fifo.rsvd_boundary;
+ 	rtw_write16(rtwdev, REG_FIFOPAGE_CTRL_2,
+ 		    rsvd_pg_head | BIT_BCN_VALID_V1);
++	rtw_write8(rtwdev, REG_BCN_CTRL, bckp[2]);
+ 	if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_PCIE)
+ 		rtw_write8(rtwdev, REG_FWHW_TXQ_CTRL + 2, bckp[1]);
+ 	rtw_write8(rtwdev, REG_CR + 1, bckp[0]);

package/kernel/mac80211/patches/rtl/109-v6.16-wifi-rtw88-fix-the-para-buffer-size-to-avoid-reading.patch

@@ -0,0 +1,38 @@
+From 4c2c372de2e108319236203cce6de44d70ae15cd Mon Sep 17 00:00:00 2001
+From: Alexey Kodanev <aleksei.kodanev@bell-sw.com>
+Date: Tue, 13 May 2025 12:13:04 +0000
+Subject: [PATCH] wifi: rtw88: fix the 'para' buffer size to avoid reading out
+ of bounds
+
+Set the size to 6 instead of 2, since 'para' array is passed to
+'rtw_fw_bt_wifi_control(rtwdev, para[0], &para[1])', which reads
+5 bytes:
+
+void rtw_fw_bt_wifi_control(struct rtw_dev *rtwdev, u8 op_code, u8 *data)
+{
+    ...
+    SET_BT_WIFI_CONTROL_DATA1(h2c_pkt, *data);
+    SET_BT_WIFI_CONTROL_DATA2(h2c_pkt, *(data + 1));
+    ...
+    SET_BT_WIFI_CONTROL_DATA5(h2c_pkt, *(data + 4));
+
+Detected using the static analysis tool - Svace.
+Fixes: 4136214f7c46 ("rtw88: add BT co-existence support")
+Signed-off-by: Alexey Kodanev <aleksei.kodanev@bell-sw.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250513121304.124141-1-aleksei.kodanev@bell-sw.com
+---
+ drivers/net/wireless/realtek/rtw88/coex.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/coex.c
++++ b/drivers/net/wireless/realtek/rtw88/coex.c
+@@ -309,7 +309,7 @@ static void rtw_coex_tdma_timer_base(str
+ {
+ 	struct rtw_coex *coex = &rtwdev->coex;
+ 	struct rtw_coex_stat *coex_stat = &coex->stat;
+-	u8 para[2] = {0};
++	u8 para[6] = {};
+ 	u8 times;
+ 	u16 tbtt_interval = coex_stat->wl_beacon_interval;
+