mediatek/hostap: fix roaming ASSOC REJECT

During roaming validation, an issue was detected with
the ASSOC-REJECT event, which had a status code of 55.

To resolve this, the SNonce from the Auth Request Frame
was copied, and the random ANonce is now used
only when expired.

Fixes: WIFI-14326

Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>

.github/workflows/build-dev.yml

@@ -21,7 +21,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: [ 'cig_wf186h', 'cig_wf186w', 'cig_wf188n', 'cig_wf189', 'cig_wf196', 'cig_wf196', 'cybertan_eww631-a1', 'cybertan_eww631-b1', 'sonicfi_rap630w-312g', 'sonicfi_rap63xc-211g', 'sonicfi_rap630c-311g', 'sonicfi_rap630w-311g', 'sonicfi_rap630w-211g', 'sonicfi_rap7110c-341x', 'edgecore_eap101', 'edgecore_eap102', 'edgecore_eap104', 'edgecore_eap105', 'edgecore_eap111', 'edgecore_eap112', 'edgecore_oap101', 'edgecore_oap101-6e', 'edgecore_oap101e', 'edgecore_oap101e-6e', 'edgecore_oap103', 'hfcl_ion4xe', 'hfcl_ion4xi', 'hfcl_ion4x', 'hfcl_ion4x_2', 'hfcl_ion4x_3', 'hfcl_ion4xi_w', 'hfcl_ion4x_w', 'indio_um-305ax', 'senao_iap4300m', 'senao_iap2300m', 'senao_jeap6500', 'udaya_a6-id2', 'udaya_a6-od2', 'yuncore_ax820', 'yuncore_ax840', 'yuncore_fap640', 'yuncore_fap650', 'yuncore_fap655' ]
+        target: [ 'cig_wf186h', 'cig_wf186w', 'cig_wf188n', 'cig_wf189', 'cig_wf196', 'cig_wf196', 'cybertan_eww631-a1', 'cybertan_eww631-b1', 'sonicfi_rap630w-312g', 'sonicfi_rap63xc-211g', 'sonicfi_rap630c-311g', 'sonicfi_rap630w-311g', 'sonicfi_rap630w-211g', 'sonicfi_rap7110c-341x', 'sonicfi_rap750w-311a', 'edgecore_eap101', 'edgecore_eap102', 'edgecore_eap104', 'edgecore_eap105', 'edgecore_eap111', 'edgecore_eap112', 'edgecore_oap101', 'edgecore_oap101-6e', 'edgecore_oap101e', 'edgecore_oap101e-6e', 'edgecore_oap103', 'hfcl_ion4xe', 'hfcl_ion4xi', 'hfcl_ion4x', 'hfcl_ion4x_2', 'hfcl_ion4x_3', 'hfcl_ion4xi_w', 'hfcl_ion4x_w', 'indio_um-305ax', 'senao_iap4300m', 'senao_iap2300m', 'senao_jeap6500', 'udaya_a6-id2', 'udaya_a6-od2', 'yuncore_ax820', 'yuncore_ax840', 'yuncore_fap640', 'yuncore_fap650', 'yuncore_fap655' ]
     steps:
     - uses: actions/checkout@v3
 

feeds/hostapd/hostapd/patches/zzzz-001-fix-assoc-reject-during-roaming.patch

@@ -0,0 +1,46 @@
+Index: hostapd-2023-09-08-e5ccbfc6/src/ap/wpa_auth_ft.c
+===================================================================
+--- hostapd-2023-09-08-e5ccbfc6.orig/src/ap/wpa_auth_ft.c
++++ hostapd-2023-09-08-e5ccbfc6/src/ap/wpa_auth_ft.c
+@@ -3293,6 +3297,8 @@ static int wpa_ft_process_auth_req(struc
+ 	size_t identity_len = 0, radius_cui_len = 0;
+ 	size_t pmk_r1_len, kdk_len, len;
+ 	int retval = WLAN_STATUS_UNSPECIFIED_FAILURE;
++	struct os_reltime now;
++	struct rsn_ftie *ftie;
+ 
+ 	*resp_ies = NULL;
+ 	*resp_ies_len = 0;
+@@ -3324,6 +3330,9 @@ static int wpa_ft_process_auth_req(struc
+ 		goto out;
+ 	}
+ 
++	ftie = (struct rsn_ftie *) parse.ftie;
++	os_memcpy(sm->SNonce, ftie->snonce, WPA_NONCE_LEN);
++
+ 	if (parse.r0kh_id == NULL) {
+ 		wpa_printf(MSG_DEBUG, "FT: Invalid FTIE - no R0KH-ID");
+ 		retval = WLAN_STATUS_INVALID_FTIE;
+@@ -3424,10 +3433,18 @@ pmk_r1_derived:
+ 	os_memcpy(sm->pmk_r1, pmk_r1, pmk_r1_len);
+ 	sm->pmk_r1_len = pmk_r1_len;
+ 
+-	if (random_get_bytes(sm->ANonce, WPA_NONCE_LEN)) {
+-		wpa_printf(MSG_DEBUG, "FT: Failed to get random data for "
+-			   "ANonce");
+-		goto out;
++	if (os_get_reltime(&now) < 0 ||
++	    os_reltime_expired(&now, &sm->ANonce_time, 1)) {
++		if (random_get_bytes(sm->ANonce, WPA_NONCE_LEN)) {
++			wpa_printf(MSG_DEBUG, "FT: Failed to get random data for "
++				   "ANonce");
++			return WLAN_STATUS_UNSPECIFIED_FAILURE;
++		}
++		sm->ANonce_time.sec = now.sec;
++		sm->ANonce_time.usec = now.usec;
++		wpa_printf(MSG_INFO, "FT: ANonce was randomized");
++	} else {
++		wpa_printf(MSG_INFO, "FT: ANonce has not expired");
+ 	}
+ 
+ 	/* Now that we know the correct PMK-R1 length and as such, the length

feeds/ipq807x_v5.4/mac80211/patches/pending/a-001-fix-roaming-between-phys.patch

@@ -0,0 +1,116 @@
+Index: backports-20210222_001-5.4.164-b157d2276/drivers/net/wireless/ath/ath11k/peer.c
+===================================================================
+--- backports-20210222_001-5.4.164-b157d2276.orig/drivers/net/wireless/ath/ath11k/peer.c
++++ backports-20210222_001-5.4.164-b157d2276/drivers/net/wireless/ath/ath11k/peer.c
+@@ -789,8 +789,6 @@ int ath11k_peer_delete(struct ath11k *ar
+ #endif
+ 	lockdep_assert_held(&ar->conf_mutex);
+ 
+-	reinit_completion(&ar->peer_delete_done);
+-
+ 	ath11k_nss_peer_delete(ar->ab, vdev_id, addr);
+ #ifdef CCPTCFG_ATH11K_NSS_SUPPORTPTCFG_ATH11K_NSS_SUPPORT
+ 	mutex_lock(&ar->ab->base_ast_lock);
+@@ -799,33 +797,60 @@ int ath11k_peer_delete(struct ath11k *ar
+ 	spin_lock_bh(&ar->ab->base_lock);
+ 
+ 	peer = ath11k_peer_find_by_addr(ar->ab, addr);
+-	if (peer) {
++	/* Check if the found peer is what we want to remove.
++	 * While the sta is transitioning to another band we may
++	 * have 2 peer with the same addr assigned to different
++	 * vdev_id. Make sure we are deleting the correct peer.
++	 */
++	if (peer && peer->vdev_id == vdev_id)
++		ath11k_peer_rhash_delete(ar->ab, peer);
++
++	/* Fallback to peer list search if the correct peer can't be found.
++	 * Skip the deletion of the peer from the rhash since it has already
++	 * been deleted in peer add.
++	 */
++	if (!peer)
++		peer = ath11k_peer_find(ar->ab, vdev_id, addr);
++
++
++	if (!peer) {
++		spin_unlock_bh(&ar->ab->base_lock);
++		mutex_unlock(&ar->ab->tbl_mtx_lock);
+ #ifdef CPTCFG_ATH11K_NSS_SUPPORT
+-		peer->delete_in_progress = true;
+-		if (peer->self_ast_entry) {
+-			ath11k_peer_del_ast(ar, peer->self_ast_entry);
+-			peer->self_ast_entry = NULL;
+-		}
++		mutex_unlock(&ar->ab->base_ast_lock);
++#endif
++		ath11k_warn(ar->ab,
++			    "failed to find peer vdev_id %d addr %pM in delete\n",
++			    vdev_id, addr);
++		return -EINVAL;
++        }
++
++#ifdef CPTCFG_ATH11K_NSS_SUPPORT
++	peer->delete_in_progress = true;
++	if (peer->self_ast_entry) {
++		ath11k_peer_del_ast(ar, peer->self_ast_entry);
++		peer->self_ast_entry = NULL;
++	}
+ 
+-		list_for_each_entry_safe(ast_entry, tmp_ast,
+-					 &peer->ast_entry_list, ase_list)
+-			if ((ast_entry->type == ATH11K_AST_TYPE_WDS) ||
+-			    (ast_entry->type == ATH11K_AST_TYPE_MEC)) {
+-				if (!list_empty(&ast_entry->wmi_list)) {
+-					ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
+-						   "%s deleting unprocessed ast entry %pM of peer %pM from wmi list\n",
+-						    __func__, ast_entry->addr, addr);
+-					list_del_init(&ast_entry->wmi_list);
+-				}
++	list_for_each_entry_safe(ast_entry, tmp_ast,
++				 &peer->ast_entry_list, ase_list)
++		if ((ast_entry->type == ATH11K_AST_TYPE_WDS) ||
++		    (ast_entry->type == ATH11K_AST_TYPE_MEC)) {
++			if (!list_empty(&ast_entry->wmi_list)) {
++				ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
++					   "%s deleting unprocessed ast entry %pM of peer %pM from wmi list\n",
++					    __func__, ast_entry->addr, addr);
++				list_del_init(&ast_entry->wmi_list);
+ 			}
++		}
+ #endif
+-		ath11k_peer_rhash_delete(ar->ab, peer);
+-	}
+ 	spin_unlock_bh(&ar->ab->base_lock);
+ 	mutex_unlock(&ar->ab->tbl_mtx_lock);
+ #ifdef CPTCFG_ATH11K_NSS_SUPPORT
+ 	mutex_unlock(&ar->ab->base_ast_lock);
+ #endif
++	reinit_completion(&ar->peer_delete_done);
++
+ 	ret = ath11k_wmi_send_peer_delete_cmd(ar, addr, vdev_id);
+ 	if (ret) {
+ 		ath11k_warn(ar->ab,
+@@ -866,14 +891,20 @@ int ath11k_peer_create(struct ath11k *ar
+ 			    "failed to create peer due to insufficient peer entry resource in firmware\n");
+ 		return -ENOBUFS;
+ 	}
+-
++	mutex_lock(&ar->ab->tbl_mtx_lock);
+ 	spin_lock_bh(&ar->ab->base_lock);
+ 	peer = ath11k_peer_find_by_addr(ar->ab, param->peer_addr);
+ 	if (peer) {
+-		spin_unlock_bh(&ar->ab->base_lock);
+-		return -EINVAL;
++		if (peer->vdev_id == param->vdev_id) {
++			spin_unlock_bh(&ar->ab->base_lock);
++			mutex_unlock(&ar->ab->tbl_mtx_lock);
++			return -EINVAL;
++		}
++		ath11k_peer_rhash_delete(ar->ab, peer);
+ 	}
++
+ 	spin_unlock_bh(&ar->ab->base_lock);
++	mutex_unlock(&ar->ab->tbl_mtx_lock);
+ 
+ 	ret = ath11k_wmi_send_peer_create_cmd(ar, param);
+ 	if (ret) {

feeds/qca-wifi-7/ath12k-firmware/Makefile

@@ -60,8 +60,11 @@ endef
 
 define Package/ath12k-firmware-ipq5332-peb/install
 	$(INSTALL_DIR) $(1)/lib/firmware/IPQ5332/
-	$(INSTALL_DATA) ./files/IPQ5332_peb/* \
+	$(INSTALL_DIR) $(1)/lib/firmware/qcn6432/
+	$(INSTALL_DATA) ./files/IPQ5332_peb/*.* \
 		$(1)/lib/firmware/IPQ5332/
+	$(INSTALL_DATA) ./files/IPQ5332_peb/qcn6432/* \
+		$(1)/lib/firmware/qcn6432/
 endef
 
 $(eval $(call BuildPackage,ath12k-firmware-qcn92xx))

feeds/qca-wifi-7/ath12k-firmware/files/IPQ5332_peb/qcn6432/fw_ini_cfg.bin

@@ -0,0 +1,16 @@
+//Number of VAPs
+{"Mode": 0,"num vap":17}    // Max VAP support is 17 per MAC
+{"Mode": 1,"num vap":17}    // Max VAP support is 17 per MAC
+{"Mode": 2,"num vap":17}    // Max VAP support is 17 per MAC
+
+//Number of clients
+{"Mode":0, "num clients":256}   // Max client support is 256 for both single MAC and dual MAC
+{"Mode":1, "num clients":256}   // Max client support is 256 per MAC
+{"Mode":2, "num clients":256}   // Max client support is 256 per MAC
+
+// Please do not reduce the default configuration while working in QWRAP Mode.
+
+//AFC Proxy ,Deployment type ,Power mode mask INI configuration
+{"afc_local_rsvd":0,"Deployment_Type":1,"Power_mode_mask":7}
+2<EFBFBD>=R<02>[I<>
+<EFBFBD>;<3B>b|G%<25><><19><05>ъ[<5B>nT

feeds/qca-wifi-7/ath12k-firmware/files/IPQ5332_peb/qcn6432/iu_fw.flist

@@ -0,0 +1,3 @@
+build/ms/bin/5332.wlan_fw2.mia_peb_eval/PIL_IMAGES/qcn6432/iu_fw.b00
+build/ms/bin/5332.wlan_fw2.mia_peb_eval/PIL_IMAGES/qcn6432/iu_fw.b01
+build/ms/bin/5332.wlan_fw2.mia_peb_eval/PIL_IMAGES/qcn6432/iu_fw.b02

feeds/qca-wifi-7/ath12k-firmware/files/IPQ5332_peb/qcn6432/qdss_trace_config.bin

@@ -0,0 +1,181 @@
+seq_start;
+seq_type:mem_req;
+sink:etr_ddr,0x1,0x400;
+seq_end;
+seq_start;
+seq_type:mac_event_trace;
+subsys_cfg_start:umac;
+cxc_eb0:0x2,0x42AAA8B3,0x64BFA3C0,0x00008000,0x0001C0FC;
+reo_eb0:0x4,0x61C81F4,0x0,0x0,0x0;
+tqm_eb0:0x5,0xCDB3C6C6,0x803007E0,0x0,0x0;
+tcl_eb0:0x6,0x25030034,0x3000,0x0,0x0;
+wbm_eb0:0x7,0x880004,0x380000,0x0,0x0;
+cxc_eb1:0x8,0x42AAA8B3,0x64BFA3C0,0x00008000,0x0001C0FC;
+tcl_eb1:0x9,0x25030034,0x3000,0x0,0x0;
+reo_eb1:0xA,0x61C81F4,0x0,0x0,0x0;
+tqm_eb1:0xB,0xCDB3C6C6,0x803007E0,0x0,0x0;
+wbm_eb1:0xC,0x880004,0x380000,0x0,0x0;
+mxi:0xD,0x122234,0x0,0x0,0x0;
+wsib:0xE,0x0,0x0,0x0,0x0;
+memw:0x0;
+subsys_cfg_end:umac;
+subsys_cfg_start:dmac;
+swevt:0x0,0xFFFFFFFF,0xFFFFFFFF,0x00000000,0x00000000;
+txdma_eb0:0x1,0x200,0x0,0x0,0x0;
+txdma_eb1:0x2,0xD9220,0xAF0,0x0,0x0;
+txdma_eb2:0x3,0xD9220,0xAF0,0x0,0x0;
+rxdma_eb0:0x4,0x93297E3F,0xC00000,0x0,0x0;
+rxdma_eb1:0x5,0x707F,0x0,0x0,0x0;
+txole_eb0:0x6,0xFFFFFFFF,0x0,0x0,0x0;
+txole_eb1:0x7,0x781F0734,0x6,0x0,0x0;
+txole_eb2:0x8,0x781F0734,0x6,0x0,0x0;
+rxole_eb0:0x9,0xF,0x0,0x0,0x0;
+rxole_eb1:0xA,0x7F,0x0,0x0,0x0;
+rxole_eb2:0xB,0x7F,0x0,0x0,0x0;
+crypto:0xC,0xFF3FFF,0x0,0x0,0x0;
+mxi:0xD,0x122234,0x0,0x0,0x0;
+sfm_eb0:0xE,0x40000003,0x7F8,0x0,0x0;
+rxmon_eb0:0x14,0x22800010,0x40A00,0x0,0x0;
+rxmon_eb1:0x15,0x18005000,0x18,0x0,0x0;
+txmon_eb0:0x12,0x22800010,0x40A00,0x0,0x0;
+txmon_eb1:0x13,0x98005000,0x199,0x0,0x0;
+memw:0x0;
+subsys_cfg_end:dmac;
+subsys_cfg_start:pmac0;
+swevt:0x0,0xFFFFFFFF,0xFFFFFFFF,0x00000000,0x00000000;
+hwsch:0x1,0x803FFFF7,0x30003,0x0,0x0;
+pdg:0x2,0xE430F87,0x622856E,0x0,0x0;
+txpcu_eb0:0x8,0xE87A047,0x132,0x0,0x0;
+rxpcu_eb0:0x9,0x10060217,0x1F24500,0x0,0x0;
+rri:0xa,0x0,0x0,0x0,0x0;
+ampi:0xb,0x69C07,0x0,0x0,0x0;
+mxi:0xd,0x122234,0x0,0x0,0x0;
+txpcu_eb1:0x10,0x0,0x0,0x0,0x0;
+sfm_eb1:0x12,0x40000003,0x7F8,0x0,0x0;
+rxpcu_eb1:0x13,0x0,0x0,0x0,0x0;
+hwmlo:0x1c,0x1C100004,0x7800,0x0,0x0;
+memw:0x0;
+subsys_cfg_end:pmac0;
+subsys_cfg_start:pmac1;
+swevt:0x0,0xFFFFFFFF,0xFFFFFFFF,0x00000000,0x00000000;
+hwsch:0x1,0x803FFFF7,0x30003,0x0,0x0;
+pdg:0x2,0xE430F87,0x622856E,0x0,0x0;
+txpcu_eb0:0x8,0xE87A047,0x132,0x0,0x0;
+rxpcu_eb0:0x9,0x10060217,0x1F24500,0x0,0x0;
+rri:0xa,0x0,0x0,0x0,0x0;
+ampi:0xb,0x69C07,0x0,0x0,0x0;
+mxi:0xd,0x122234,0x0,0x0,0x0;
+txpcu_eb1:0x10,0x0,0x0,0x0,0x0;
+sfm_eb1:0x12,0x40000003,0x7F8,0x0,0x0;
+rxpcu_eb1:0x13,0x0,0x0,0x0,0x0;
+hwmlo:0x1c,0x1C100004,0x7800,0x0,0x0;
+memw:0x0;
+subsys_cfg_end:pmac1;
+seq_end;
+seq_start;
+seq_type:phy_event_trace;
+subsys_cfg_start:phya0;
+data_tlv:0;
+wsi:0x0,0x00000000,0x00000000;
+rfcntl:0x0,0x00000000,0x00000000;
+tpc:0x0,0x00000000,0x00000000;
+cal:0x0,0x00000000,0x00000000;
+impcorr:0x0,0x00000000,0x00000000;
+mpi:0x6,0x00000006,0x00000000;
+fft:0x0,0x00000000,0x00000000;
+txtd:0x0,0x00000000,0x00000000;
+pmi:0x9,0x0000000A,0x00000000;
+rxtd:0xa,0x0000000A,0x00000000;
+demfront:0x0,0x00000000,0x00000000;
+pcss:0xc,0x0000003E,0x00000000;
+txfd:0x0,0x00000000,0x00000000;
+robe:0x0,0x00000000,0x00000000;
+dmac_0_1:0x0,0x00000000,0x00000000;
+dmac_2_3:0x0,0x00000000,0x00000000;
+dmac_4_5:0x0,0x00000000,0x00000000;
+dmac_6:0x0,0x00000000,0x00000000;
+eos:0x0,0x00000000,0x00000000;
+subsys_cfg_end:phya0;
+//subsys_cfg_start:phya1;
+//data_tlv:1;
+//wsi:0x0,0x00000000,0x00000000;
+//rfcntl:0x0,0x00000000,0x00000000;
+//tpc:0x0,0x00000000,0x00000000;
+//cal:0x0,0x00000000,0x00000000;
+//impcorr:0x0,0x00000000,0x00000000;
+//mpi:0x6,0x00000006,0x00000000;
+//fft:0x0,0x00000000,0x00000000;
+//txtd:0x0,0x00000000,0x00000000;
+//pmi:0x9,0x0000000A,0x00000000;
+//rxtd:0xa,0x0000000A,0x00000000;
+//demfront:0x0,0x00000000,0x00000000;
+//pcss:0xc,0x0000003E,0x00000000;
+//txfd:0x0,0x00000000,0x00000000;
+//robe:0x0,0x00000000,0x00000000;
+//dmac_0_1:0x0,0x00000000,0x00000000;
+//dmac_2_3:0x0,0x00000000,0x00000000;
+//dmac_4_5:0x0,0x00000000,0x00000000;
+//dmac_6:0x0,0x00000000,0x00000000;
+//eos:0x0,0x00000000,0x00000000;
+//subsys_cfg_end:phya1;
+seq_end;
+//seq_start;
+//seq_type:noc_trace;
+//noc_id:umacnoc;
+//syncoutperiod:0x1F;
+//probe_id:0x0;
+//probe_type:0x2;
+//probe_andinv:0x0;
+//probe_portsel:0x1;
+//filter0_path:0x0;
+//filter0_path_mask:0x0;
+//filter0_addr_min_lo:0x0;
+//filter0_addr_min_hi:0x0;
+//filter0_addr_max_lo:0xFFFFFFFF;
+//filter0_addr_max_hi:0xF;
+//filter0_opcode:0x3;
+//filter0_status:0x3;
+//filter0_trtype:0x0;
+//filter0_extid:0x0;
+//filter0_extid_mask:0x0;
+//filter1_path:0x0;
+//filter1_path_mask:0x0;
+//filter1_addr_min_lo:0x0;
+//filter1_addr_min_hi:0x0;
+//filter1_addr_max_lo:0xFFFFFFFF;
+//filter1_addr_max_hi:0xF;
+//filter1_opcode:0x3;
+//filter1_status:0x3;
+//filter1_trtype:0x0;
+//filter1_extid:0x0;
+//filter1_extid_mask:0x0;
+//seq_end;
+//seq_start;
+//seq_type:mac_tlv_trace;
+//subsys_cfg_start:pmac0;
+//tlv_port:tqm_hwsch_tlv;
+//tlv_config:tlv_type,other_tlv,specific_tlv,data_tlv;
+//tlv_config:1,3,3,3;
+//memw:0x2,0x10220A0,0xFFFFFDFF,0x10220B0,0x7FFFFFFF;
+//subsys_cfg_end:pmac0;
+//seq_end;
+//seq_start;
+//seq_start;
+//seq_type:mac_tlv_trace;
+//subsys_cfg_start:pmac1;
+//tlv_port:tqm_hwsch_tlv;
+//tlv_config:tlv_type,other_tlv,specific_tlv,data_tlv;
+//tlv_config:1,3,3,3;
+//memw:0x2,0x10220A0,0xFFFFFDFF,0x10220B0,0x7FFFFFFF;
+//subsys_cfg_end:pmac1;
+//seq_end;
+//seq_start;
+//seq_type:mac_obo_trace;
+//subsys_cfg_start:pmac0;
+//tbus_port:pdg_testbus, 0x7;
+//memw:0x0;
+//subsys_cfg_end:pmac0;
+//seq_end;
+//seq_start;
+//seq_type:irq_trace;
+//seq_end;

feeds/qca-wifi-7/ath12k-wifi/Makefile

@@ -76,7 +76,11 @@ endef
 
 define Package/ath12k-wifi-sonicfi-rap750w-311a/install
 	$(INSTALL_DIR) $(1)/lib/firmware/ath12k/IPQ5332/hw1.0/
-	$(INSTALL_DATA) ./ board-2.bin.rap750w_311a.IPQ5332$(1)/lib/firmware/ath12k/IPQ5332/hw1.0/board-2.bin
+	$(INSTALL_DIR) $(1)/lib/firmware/ath12k/QCN6432/hw1.0/
+	$(INSTALL_DATA) ./board-2.bin.rap750w_311a.IPQ5332 $(1)/lib/firmware/ath12k/IPQ5332/hw1.0/board-2.bin
+	$(INSTALL_DATA) ./board-2.bin.rap750w_311a.QCN6432 $(1)/lib/firmware/ath12k/QCN6432/hw1.0/board-2.bin
+#	$(INSTALL_DATA) ./ipq5332_qcn6432.regdb $(1)/lib/firmware/ath12k/IPQ5332/hw1.0/regdb.bin
+	$(INSTALL_DATA) ./ipq5332_qcn6432.regdb $(1)/lib/firmware/ath12k/QCN6432/hw1.0/regdb.bin
 endef
 
 $(eval $(call BuildPackage,ath12k-wifi-cig-wf189))

feeds/qca-wifi-7/ipq53xx/base-files/etc/board.d/02_network

@@ -46,7 +46,8 @@ qcom_setup_macs()
                 wan_mac=$(cat /sys/class/net/eth0/address)
                 lan_mac=$(macaddr_add "$wan_mac" 1)
 		;;
-        sonicfi,rap7110c-341x)
+        sonicfi,rap7110c-341x|\
+        sonicfi,rap750w-311a)
                 wan_mac=$(cat /sys/class/net/eth0/address)
                 ucidef_set_wireless_macaddr_base 2g $(macaddr_add "$wan_mac" 1)
                 ucidef_set_wireless_macaddr_base 5g $(macaddr_add "$wan_mac" 2)

feeds/qca-wifi-7/ipq53xx/base-files/etc/hotplug.d/firmware/10-ath12k-caldata

@@ -29,13 +29,15 @@ ath12k/IPQ5332/hw1.0/caldata.bin)
 	case "$board" in
 	cig,wf189|\
 	edgecore,eap105|\
-	sonicfi,rap750w-311a|\
 	sercomm,ap72tip)
 		caldata_extract "0:ART" 0x1000 0x20000 
 		;;
 	sonicfi,rap7110c-341x)
 		caldata_extract_mmc "0:ART" 0x1000 0xF800
 		;;
+	sonicfi,rap750w-311a)
+		caldata_extract "0:ART" 0x1000 0xf800 
+		;;
 	esac
 	;;
 ath12k/QCN92XX/hw1.0/cal-pci-0001:01:00.0.bin)
@@ -50,6 +52,13 @@ ath12k/QCN92XX/hw1.0/cal-pci-0001:01:00.0.bin)
 		;;
 	esac
 	;;
+ath12k/QCN6432/hw1.0/caldata_1.bin)
+	case "$board" in
+	sonicfi,rap750w-311a)
+		caldata_extract "0:ART" 0x26800 0x18800
+		;;
+	esac
+	;;
 *)
 	exit 1
 	;;

feeds/qca-wifi-7/ipq53xx/base-files/etc/init.d/smp-affinity

@@ -0,0 +1,21 @@
+#!/bin/sh /etc/rc.common
+
+START=99
+
+boot() {
+	for j in 68 69 70 71 75 88 92 96; do
+		echo 8 > /proc/irq/$j/smp_affinity
+	done
+
+	for j in 67 74 91 87; do
+		echo 4 > /proc/irq/$j/smp_affinity
+	done
+
+	for j in 66 73 86 90 93; do
+		echo 2 > /proc/irq/$j/smp_affinity
+	done
+
+	for j in 65 72 85 89; do
+		echo 1 > /proc/irq/$j/smp_affinity
+	done
+}

feeds/qca-wifi-7/ipq53xx/base-files/lib/upgrade/platform.sh

@@ -35,35 +35,33 @@ do_flash_emmc() {
 	tar Oxf $tar_file ${board_dir}/$part | dd of=${emmcblock}
 }
 
+sonicfi_dualimage_check() {
+	local boot_part=""
+	boot_part=$(fw_printenv | grep bootfrom | awk -F'=' '{printf $2}')
+	[ -n "$boot_part" ] || boot_part="0"
+	echo "boot_part=$boot_part" > /dev/console
+
+	if [ "$boot_part" = "0" ]; then
+		block_kernel="0:HLOS_1"
+		block_rootfs="rootfs_1"
+		CI_UBIPART="rootfs_1"
+		fw_setenv bootfrom 1
+	elif [ "$boot_part" = "1" ]; then
+		block_kernel="0:HLOS"
+		block_rootfs="rootfs"
+		CI_UBIPART="rootfs"
+		fw_setenv bootfrom 0
+	else
+		echo "Invalid boot partition $boot_part! Skip upgrade....."
+		return
+	fi
+}
+
 emmc_do_upgrade() {
 	local tar_file="$1"
-	local block_kernel="0:HLOS"
-	local block_rootfs="rootfs"
 	local board_dir=$(tar tf $tar_file | grep -m 1 '^sysupgrade-.*/$')
 	board_dir=${board_dir%/}
-
-	board=$(board_name)
-	case $board in
-	sonicfi,rap7110c-341x)
-		local boot_part=""
-		boot_part=$(fw_printenv | grep bootfrom | awk -F'=' '{printf $2}')
-		[ -n "$boot_part" ] || boot_part="0"
-		echo "**** boot_part=$boot_part" > /dev/console
-
-		if [ "$boot_part" = "0" ]; then
-			block_kernel="0:HLOS_1"
-			block_rootfs="rootfs_1"
-			fw_setenv bootfrom 1
-		elif [ "$boot_part" = "1" ]; then
-			block_kernel="0:HLOS"
-			block_rootfs="rootfs"
-			fw_setenv bootfrom 0
-		else
-			echo "Invalid boot partition $boot_part! Skip upgrade....."
-			return
-		fi
-		;;
-	esac
+	echo "block_kernel=$block_kernel, block_rootfs=$block_rootfs" > /dev/console
 	do_flash_emmc $tar_file $block_kernel $board_dir kernel
 	do_flash_emmc $tar_file $block_rootfs $board_dir root
 
@@ -83,6 +81,8 @@ platform_do_upgrade() {
 	CI_UBIPART="rootfs"
 	CI_ROOTPART="ubi_rootfs"
 	CI_IPQ807X=1
+	block_kernel="0:HLOS"
+	block_rootfs="rootfs"
 
 	board=$(board_name)
 	case $board in
@@ -111,7 +111,12 @@ platform_do_upgrade() {
 		nand_upgrade_tar "$1"
 		;;
 	sonicfi,rap7110c-341x)
+		sonicfi_dualimage_check
 		emmc_do_upgrade $1 $1
-	;;
+		;;
+	sonicfi,rap750w-311a)
+		sonicfi_dualimage_check
+		nand_upgrade_tar "$1"
+		;;
 	esac
 }

feeds/qca-wifi-7/ipq53xx/dts/ipq5332-cig-wf189.dts

@@ -39,6 +39,7 @@
 			phyaddr_fixup = <0xC90F018>;
 			uniphyaddr_fixup = <0xC90F014>;
 			mdio_clk_fixup; /* MDIO clock sequence fix up flag */
+			tip,clk_div = <0xff>; /* MDIO Frequency reduction*/
 
 			phy0: ethernet-phy@0 {
 				reg = <8>;

feeds/qca-wifi-7/ipq53xx/dts/ipq5332-sonicfi-rap750w-311a.dts

@@ -16,7 +16,7 @@
 
 / {
 	model = "SONICFI RAP750W-311A";
-	compatible = "sonicfi,rap750w-311a","qcom,ipq5332-ap-mi01.6", "qcom,ipq5332";
+	compatible = "sonicfi,rap750w-311a","qcom,ipq5332-ap-mi01.3-c2", "qcom,ipq5332";
 
 #ifdef __IPQ_MEM_PROFILE_512_MB__
        /*	512M Memory Layout for IPQ5332 + QCN6432
@@ -541,7 +541,7 @@
 			num_chip = <2>;
 			status = "okay";
 			chip_info = <0 1 1>,
-                                    <1 1 0>;
+				<1 1 0>;
 		};
 
 		q6v5_wcss: remoteproc@d100000 {

feeds/qca-wifi-7/ipq53xx/image/ipq53xx.mk

@@ -53,10 +53,10 @@ TARGET_DEVICES += sonicfi_rap7110c_341x
 
 define Device/sonicfi_rap750w_311a
   DEVICE_TITLE := SONICFI RAP750W-311A
-  DEVICE_DTS := ipq5332-rap750w-311a
+  DEVICE_DTS := ipq5332-sonicfi-rap750w-311a
   DEVICE_DTS_DIR := ../dts
   DEVICE_DTS_CONFIG := config@mi01.3-c2
-  SUPPORTED_DEVICES := sonicfi,rap7110c-341x
+  SUPPORTED_DEVICES := sonicfi,rap750w-311a
   IMAGES := sysupgrade.tar nand-factory.bin nand-factory.ubi
   IMAGE/sysupgrade.tar := sysupgrade-tar | append-metadata
   IMAGE/nand-factory.bin := append-ubi | qsdk-ipq-factory-nand

feeds/qca-wifi-7/ipq53xx/patches-6.1/0659-Reduce-mdc-frequency.patch

@@ -0,0 +1,21 @@
+From 2bd43f099b44fb5a6f79f71051c58f900c54f6f9 Mon Sep 17 00:00:00 2001
+From: luozhan <luozhan@cigtech.com>
+Date: Thu, 3 Apr 2025 17:45:50 +0800
+Subject: [PATCH] Reduce mdc frequency
+
+---
+ drivers/net/mdio/mdio-ipq4019.c | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/mdio/mdio-ipq4019.c
++++ b/drivers/net/mdio/mdio-ipq4019.c
+@@ -919,6 +919,9 @@ static int ipq4019_mdio_probe(struct pla
+ 
+ 	/* MDIO default frequency is 6.25MHz */
+ 	priv->clk_div = 0xf;
++	if (!of_property_read_u32(pdev->dev.of_node, "tip,clk_div", &priv->clk_div))
++		dev_info(&pdev->dev, "overriding clk_div = %x\n", priv->clk_div);
++
+ 	priv->force_c22 = of_property_read_bool(pdev->dev.of_node, "force_clause22");
+ 
+ 	priv->preinit = ipq_mii_preinit;

patches/0088-feed.conf.default-use-the-github.com-based-trees.patch

@@ -0,0 +1,26 @@
+From 642f9c9340bfeaba24939bd01d9beca862183f0f Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Mon, 7 Apr 2025 18:09:27 +0200
+Subject: [PATCH] feed.conf.default: use the github.com based trees
+
+Signed-off-by: John Crispin <john@phrozen.org>
+---
+ feeds.conf.default | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/feeds.conf.default b/feeds.conf.default
+index d467db5627..6a1dcf1999 100644
+--- a/feeds.conf.default
++++ b/feeds.conf.default
+@@ -1,4 +1,4 @@
+-src-git packages https://git.openwrt.org/feed/packages.git;openwrt-23.05
+-src-git luci https://git.openwrt.org/project/luci.git;openwrt-23.05
+-src-git routing https://git.openwrt.org/feed/routing.git;openwrt-23.05
+-src-git telephony https://git.openwrt.org/feed/telephony.git;openwrt-23.05
++src-git packages https://github.com/openwrt/packages.git;openwrt-23.05
++src-git luci https://github.com/openwrt/luci.git;openwrt-23.05
++src-git routing https://github.com/openwrt/routing.git;openwrt-23.05
++src-git telephony https://github.com/openwrt/telephony.git;openwrt-23.05
+-- 
+2.34.1
+

profiles/sonicfi_rap750w-311a.yml

@@ -0,0 +1,16 @@
+---
+profile: sonicfi_rap750w_311a
+target: ipq53xx
+subtarget: generic
+description: Build image for the SONICFI RAP750W-311A
+image: bin/targets/ipq53xx/generic/openwrt-ipq53xx-sonicfi_rap750w_311a-squashfs-sysupgrade.tar
+feeds:
+  - name: qca
+    path: ../../feeds/qca-wifi-7
+include:
+  - ucentral-ap
+packages:
+  - ipq53xx
+  - qca-ssdk-shell
+diffconfig: |
+  CONFIG_KERNEL_IPQ_MEM_PROFILE=512