Fix ssid ratelimiting in wifi6 AP

This patch backports some fixes in netfilter ratelimiting kernel module for wifi6 (linux v4.4.60). These fixes are ported from until following commit id 6e323887565fe8a23c6c85faf9e395a24affd05c in the mainline kernel. Also, fix bugs in client ratelimiting. Per Client Ratelimiting will be used henceforth instead of Per ssid Ratelimiting. Signed-off-by: Chaitanya Godavarthi <chaitanya.kiran@netexperience.com>
Add ESMT Nand support and ubi imgs
2025-10-30 18:07:52 +00:00 · 2021-04-08 09:49:42 -04:00 · 2021-04-06 09:09:26 -04:00 · 2021-04-06 09:00:31 -04:00 · 2021-03-30 16:09:42 +02:00 · 2021-03-29 17:03:47 +02:00
59 changed files with 2686 additions and 464 deletions
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -3,6 +3,8 @@ name: Build OpenWrt with OpenSync
 on:
  push:
    branches: [ trunk ]
+    tags:
+      - '*'

 jobs:
  build-ea8300:
@@ -19,6 +21,8 @@ jobs:
          GH_BUILD_PASSWORD: ${{ secrets.GH_BUILD_PASSWORD }}
      run: |
        TAG=$(date +%Y-%m-%d)-$(git rev-parse --short HEAD)
+        [[ "${{ github.ref }}" == "refs/tags/"* ]] && TAG=$(echo "${{ github.ref }}" | sed 's/refs\/tags\/[v]//')
+
        echo "ea8300-$TAG" > feeds/wlan-ap/opensync/src/vendor/tip/.pkgname
        make TARGET=IPQ40XX
        TAR_NAME="ea8300-artifacts-$TAG.tar.gz"
@@ -42,6 +46,8 @@ jobs:
          GH_BUILD_PASSWORD: ${{ secrets.GH_BUILD_PASSWORD }}
      run: |
        TAG=$(date +%Y-%m-%d)-$(git rev-parse --short HEAD)
+        [[ "${{ github.ref }}" == "refs/tags/"* ]] && TAG=$(echo "${{ github.ref }}" | sed 's/refs\/tags\/[v]//')
+
        echo "ecw5410-$TAG" > feeds/wlan-ap/opensync/src/vendor/tip/.pkgname
        make TARGET=ECW5410
        TAR_NAME="ecw5410-artifacts-$TAG.tar.gz"
@@ -65,6 +71,8 @@ jobs:
          GH_BUILD_PASSWORD: ${{ secrets.GH_BUILD_PASSWORD }}
      run: |
        TAG=$(date +%Y-%m-%d)-$(git rev-parse --short HEAD)
+        [[ "${{ github.ref }}" == "refs/tags/"* ]] && TAG=$(echo "${{ github.ref }}" | sed 's/refs\/tags\/[v]//')
+
        echo "ap2220-$TAG" > feeds/wlan-ap/opensync/src/vendor/tip/.pkgname
        make TARGET=AP2220
        TAR_NAME="ap2220-artifacts-$TAG.tar.gz"
@@ -88,6 +96,8 @@ jobs:
          GH_BUILD_PASSWORD: ${{ secrets.GH_BUILD_PASSWORD }}
      run: |
        TAG=$(date +%Y-%m-%d)-$(git rev-parse --short HEAD)
+        [[ "${{ github.ref }}" == "refs/tags/"* ]] && TAG=$(echo "${{ github.ref }}" | sed 's/refs\/tags\/[v]//')
+
        echo "ecw5211-$TAG" > feeds/wlan-ap/opensync/src/vendor/tip/.pkgname
        make TARGET=ECW5211
        TAR_NAME="ecw5211-artifacts-$TAG.tar.gz"
@@ -111,6 +121,8 @@ jobs:
          GH_BUILD_PASSWORD: ${{ secrets.GH_BUILD_PASSWORD }}
      run: |
        TAG=$(date +%Y-%m-%d)-$(git rev-parse --short HEAD)
+        [[ "${{ github.ref }}" == "refs/tags/"* ]] && TAG=$(echo "${{ github.ref }}" | sed 's/refs\/tags\/[v]//')
+
        echo "ec420-$TAG" > feeds/wlan-ap/opensync/src/vendor/tip/.pkgname
        make TARGET=EC420
        TAR_NAME="ec420-artifacts-$TAG.tar.gz"
@@ -134,6 +146,8 @@ jobs:
          GH_BUILD_PASSWORD: ${{ secrets.GH_BUILD_PASSWORD }}
      run: |
        TAG=$(date +%Y-%m-%d)-$(git rev-parse --short HEAD)
+        [[ "${{ github.ref }}" == "refs/tags/"* ]] && TAG=$(echo "${{ github.ref }}" | sed 's/refs\/tags\/[v]//')
+
        echo "eap101-$TAG" > feeds/wlan-ap/opensync/src/vendor/tip/.pkgname
        make TARGET=EAP101
        TAR_NAME="eap101-artifacts-$TAG.tar.gz"
@@ -157,6 +171,8 @@ jobs:
          GH_BUILD_PASSWORD: ${{ secrets.GH_BUILD_PASSWORD }}
      run: |
        TAG=$(date +%Y-%m-%d)-$(git rev-parse --short HEAD)
+        [[ "${{ github.ref }}" == "refs/tags/"* ]] && TAG=$(echo "${{ github.ref }}" | sed 's/refs\/tags\/[v]//')
+
        echo "eap102-$TAG" > feeds/wlan-ap/opensync/src/vendor/tip/.pkgname
        make TARGET=EAP102
        TAR_NAME="eap102-artifacts-$TAG.tar.gz"
@@ -180,6 +196,8 @@ jobs:
          GH_BUILD_PASSWORD: ${{ secrets.GH_BUILD_PASSWORD }}
      run: |
        TAG=$(date +%Y-%m-%d)-$(git rev-parse --short HEAD)
+        [[ "${{ github.ref }}" == "refs/tags/"* ]] && TAG=$(echo "${{ github.ref }}" | sed 's/refs\/tags\/[v]//')
+
        echo "wf188n-$TAG" > feeds/wlan-ap/opensync/src/vendor/tip/.pkgname
        make TARGET=WF188N
        TAR_NAME="wf188n-artifacts-$TAG.tar.gz"
@@ -203,6 +221,8 @@ jobs:
          GH_BUILD_PASSWORD: ${{ secrets.GH_BUILD_PASSWORD }}
      run: |
        TAG=$(date +%Y-%m-%d)-$(git rev-parse --short HEAD)
+        [[ "${{ github.ref }}" == "refs/tags/"* ]] && TAG=$(echo "${{ github.ref }}" | sed 's/refs\/tags\/[v]//')
+
        echo "wf194c-$TAG" > feeds/wlan-ap/opensync/src/vendor/tip/.pkgname
        make TARGET=WF194C
        TAR_NAME="wf194c-artifacts-$TAG.tar.gz"
@@ -226,6 +246,8 @@ jobs:
          GH_BUILD_PASSWORD: ${{ secrets.GH_BUILD_PASSWORD }}
      run: |
        TAG=$(date +%Y-%m-%d)-$(git rev-parse --short HEAD)
+        [[ "${{ github.ref }}" == "refs/tags/"* ]] && TAG=$(echo "${{ github.ref }}" | sed 's/refs\/tags\/[v]//')
+
        echo "wf610d-$TAG" > feeds/wlan-ap/opensync/src/vendor/tip/.pkgname
        make TARGET=WF610D
        TAR_NAME="wf610d-artifacts-$TAG.tar.gz"
@@ -249,6 +271,8 @@ jobs:
          GH_BUILD_PASSWORD: ${{ secrets.GH_BUILD_PASSWORD }}
      run: |
        TAG=$(date +%Y-%m-%d)-$(git rev-parse --short HEAD)
+        [[ "${{ github.ref }}" == "refs/tags/"* ]] && TAG=$(echo "${{ github.ref }}" | sed 's/refs\/tags\/[v]//')
+
        echo "ex227-$TAG" > feeds/wlan-ap/opensync/src/vendor/tip/.pkgname
        make TARGET=EX227
        TAR_NAME="ex227-artifacts-$TAG.tar.gz"
@@ -272,6 +296,8 @@ jobs:
          GH_BUILD_PASSWORD: ${{ secrets.GH_BUILD_PASSWORD }}
      run: |
        TAG=$(date +%Y-%m-%d)-$(git rev-parse --short HEAD)
+        [[ "${{ github.ref }}" == "refs/tags/"* ]] && TAG=$(echo "${{ github.ref }}" | sed 's/refs\/tags\/[v]//')
+
        echo "ex447-$TAG" > feeds/wlan-ap/opensync/src/vendor/tip/.pkgname
        make TARGET=EX447
        TAR_NAME="ex447-artifacts-$TAG.tar.gz"
@@ -280,5 +306,3 @@ jobs:
        UPGRADE_TAR_NAME="ex447-$TAG.tar.gz"
        tar cfz "$UPGRADE_TAR_NAME" -C openwrt/bin/targets/ipq807x/ipq807x $(find openwrt/bin/targets/ipq807x/ipq807x -type f \( -name '*sysupgrade*' -o -name 'sha256sums' \) -printf "%f\n")
        curl -u "$GH_BUILD_USERNAME":"$GH_BUILD_PASSWORD" -T "$UPGRADE_TAR_NAME" "https://tip.jfrog.io/artifactory/tip-wlan-ap-firmware/ex447/trunk/"$UPGRADE_TAR_NAME""
-
-
--- a/feeds/wifi-ax/hostapd/Makefile
+++ b/feeds/wifi-ax/hostapd/Makefile
@@ -99,6 +99,7 @@ ifneq ($(LOCAL_VARIANT),mini)
 endif

 ifeq ($(LOCAL_VARIANT),full)
+  DRIVER_MAKEOPTS += CONFIG_HS20=y CONFIG_INTERWORKING=y
  ifeq ($(SSL_VARIANT),openssl)
    DRIVER_MAKEOPTS += CONFIG_TLS=openssl CONFIG_SAE=y CONFIG_OWE=y CONFIG_SUITEB192=y CONFIG_AP=y CONFIG_MESH=y
    TARGET_LDFLAGS += -lcrypto -lssl
--- a/feeds/wifi-ax/hostapd/files/hostapd.sh
+++ b/feeds/wifi-ax/hostapd/files/hostapd.sh
@@ -932,14 +932,23 @@ hostapd_set_bss_options() {
 	set_default hs20 0
 	set_default disable_dgaf $hs20
 	set_default osen 0
+	set_default internet 0
+	set_default asra 0
+	set_default esr 0
+	set_default uesa  0
 	set_default anqp_domain_id 0
+	set_default access_network_type 0
+	set_default venue_group 0
+	set_default venue_type 0
+	set_default ipaddr_type_availability 0
+	set_default gas_address3 0
 	set_default hs20_deauth_req_timeout 60
 	if [ "$hs20" = "1" ]; then
 		append bss_conf "hs20=1" "$N"
 		append_hs20_icons
 		[ -n "$disable_dgaf"] && append bss_conf "disable_dgaf=$disable_dgaf" "$N"
 		[ -n "$osen"] && append bss_conf "osen=$osen" "$N"
-		[ -n "$anqp_domain_id"] && append bss_conf "anqp_domain_id=$anqp_domain_id" "$N"
+		[ "$anqp_domain_id" -gt 0 ] && append bss_conf "anqp_domain_id=$anqp_domain_id" "$N"
 		[ -n "$hs20_deauth_req_timeout"] && append bss_conf "hs20_deauth_req_timeout=$hs20_deauth_req_timeout" "$N"
 		[ -n "$osu_ssid" ] && append bss_conf "osu_ssid=$osu_ssid" "$N"
 		[ -n "$hs20_wan_metrics" ] && append bss_conf "hs20_wan_metrics=$hs20_wan_metrics" "$N"
@@ -956,15 +965,15 @@ hostapd_set_bss_options() {
 		json_for_each_item append_osu_provider osu_provider
 		json_for_each_item append_operator_icon operator_icon
 		[ -n "$interworking" ] && append bss_conf "interworking=$interworking" "$N"
-		[ -n "$internet" ] && append bss_conf "internet=$internet" "$N"
-		[ -n "$access_network_type" ] && append bss_conf "access_network_type=$access_network_type" "$N"
-		[ -n "$asra" ] && append bss_conf "asra=$asra" "$N"
-		[ -n "$esr" ] && append bss_conf "esr=$esr" "$N"
-		[ -n "$uesa" ] && append bss_conf "uesa=$uesa" "$N"
-		[ -n "$venue_group" ] && append bss_conf "venue_group=$venue_group" "$N"
-		[ -n "$venue_type" ] && append bss_conf "venue_type=$venue_type" "$N"
-		[ -n "$ipaddr_type_availability" ] && append bss_conf "ipaddr_type_availability=$ipaddr_type_availability" "$N"
-		[ -n "$gas_address3" ] && append bss_conf "gas_address3=$gas_address3" "$N"
+		[ "$internet" -gt 0 ] && append bss_conf "internet=$internet" "$N"
+		[ "$access_network_type" -gt 0 ] && append bss_conf "access_network_type=$access_network_type" "$N"
+		[ "$asra" -gt 0 ] && append bss_conf "asra=$asra" "$N"
+		[ "$esr" -gt 0 ] && append bss_conf "esr=$esr" "$N"
+		[ "$uesa" -gt 0 ] && append bss_conf "uesa=$uesa" "$N"
+		[ "$venue_group" -gt 0 ] && append bss_conf "venue_group=$venue_group" "$N"
+		[ "$venue_type" -gt 0 ] && append bss_conf "venue_type=$venue_type" "$N"
+		[ "$ipaddr_type_availability" -gt 0 ] && append bss_conf "ipaddr_type_availability=$ipaddr_type_availability" "$N"
+		[ "$gas_address3" -gt 0 ] && append bss_conf "gas_address3=$gas_address3" "$N"
 		[ -n "$hessid" ] && append bss_conf "hessid=$hessid" "$N"
 		[ -n "$network_auth_type" ] && append bss_conf "network_auth_type=$network_auth_type" "$N"
 		[ -n "$anqp_3gpp_cell_net" ] && append bss_conf "anqp_3gpp_cell_net=$anqp_3gpp_cell_net" "$N"
--- a/feeds/wifi-ax/hostapd/patches/900-hapd-netlink-ubus-bridge.patch
+++ b/feeds/wifi-ax/hostapd/patches/900-hapd-netlink-ubus-bridge.patch
@@ -0,0 +1,881 @@
+--- a/hostapd/main.c
+++ b/hostapd/main.c
+@@ -41,7 +41,7 @@ struct hapd_global {
+ static struct hapd_global global;
+ static int daemonize = 0;
+ static char *pid_file = NULL;
+-
+uint32_t cached_events_nr = 0;
+ 
+ #ifndef CONFIG_NO_HOSTAPD_LOGGER
+ static void hostapd_logger_cb(void *ctx, const u8 *addr, unsigned int module,
+--- a/src/ap/hostapd.h
+++ b/src/ap/hostapd.h
+@@ -97,6 +97,10 @@ struct hostapd_probereq_cb {
+ };
+ 
+ #define HOSTAPD_RATE_BASIC 0x00000001
+/* max number of cached events */
+#define HOSTAPD_MAX_CACHED_EVENTS 500
+/* event counter */
+uint32_t cached_events_nr;
+ 
+ struct hostapd_rate_data {
+ 	int rate; /* rate in 100 kbps */
+--- a/src/ap/ieee802_11.c
+++ b/src/ap/ieee802_11.c
+@@ -4908,6 +4908,7 @@ int ieee802_11_mgmt(struct hostapd_data
+ 	int ret = 0;
+ 	unsigned int freq;
+ 	int ssi_signal = fi ? fi->ssi_signal : 0;
+	int ubus_resp;
+ 
+ 	if (len < 24)
+ 		return 0;
+@@ -4977,25 +4978,52 @@ int ieee802_11_mgmt(struct hostapd_data
+ 	if (hapd->iconf->track_sta_max_num)
+ 		sta_track_add(hapd->iface, mgmt->sa, ssi_signal);
+ 
+	/* ubus request */
+	struct hostapd_ubus_request req = {
+		.type = HOSTAPD_UBUS_TYPE_MAX,
+		.mgmt_frame = mgmt,
+		.ssi_signal = ssi_signal
+	};
+
+ 	switch (stype) {
+ 	case WLAN_FC_STYPE_AUTH:
+ 		wpa_printf(MSG_DEBUG, "mgmt::auth");
+ 		handle_auth(hapd, mgmt, len, ssi_signal, 0);
+		hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211,
+			       HOSTAPD_LEVEL_DEBUG, "mgmt: [%d] [%s]",
+				   stype,
+			       "AUTH");
+		req.type = HOSTAPD_UBUS_AUTH_REQ;
+ 		ret = 1;
+ 		break;
+ 	case WLAN_FC_STYPE_ASSOC_REQ:
+ 		wpa_printf(MSG_DEBUG, "mgmt::assoc_req");
+ 		handle_assoc(hapd, mgmt, len, 0, ssi_signal);
+		hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211,
+			       HOSTAPD_LEVEL_DEBUG, "mgmt: [%d] [%s]",
+				   stype,
+			       "ASSOC");
+		req.type = HOSTAPD_UBUS_ASSOC_REQ;
+ 		ret = 1;
+ 		break;
+ 	case WLAN_FC_STYPE_REASSOC_REQ:
+ 		wpa_printf(MSG_DEBUG, "mgmt::reassoc_req");
+ 		handle_assoc(hapd, mgmt, len, 1, ssi_signal);
+		hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211,
+			       HOSTAPD_LEVEL_DEBUG, "mgmt: [%d] [%s]",
+				   stype,
+			       "RE-ASSOC");
+		req.type = HOSTAPD_UBUS_REASSOC_REQ;
+ 		ret = 1;
+ 		break;
+ 	case WLAN_FC_STYPE_DISASSOC:
+ 		wpa_printf(MSG_DEBUG, "mgmt::disassoc");
+ 		handle_disassoc(hapd, mgmt, len);
+		hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211,
+			       HOSTAPD_LEVEL_DEBUG, "mgmt: [%d] [%s]",
+				   stype,
+			       "DISASSOC");
+		req.type = HOSTAPD_UBUS_DISASSOC_REQ;
+ 		ret = 1;
+ 		break;
+ 	case WLAN_FC_STYPE_DEAUTH:
+@@ -5014,6 +5042,15 @@ int ieee802_11_mgmt(struct hostapd_data
+ 		break;
+ 	}
+ 
+	/* ubus send */
+	if (req.type != HOSTAPD_UBUS_TYPE_MAX) {
+		ubus_resp = hostapd_ubus_handle_rt_event(hapd, &req);
+		if (ubus_resp) {
+			hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211,
+				       HOSTAPD_LEVEL_INFO,
+				       "hostapd_ubus_handle_rt_event: ERROR");
+		}
+	}
+ 	return ret;
+ }
+ 
+--- a/src/ap/sta_info.c
+++ b/src/ap/sta_info.c
+@@ -423,8 +423,14 @@ void ap_handle_timer(void *eloop_ctx, vo
+ 		hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
+ 			       HOSTAPD_LEVEL_INFO, "deauthenticated due to "
+ 			       "local deauth request");
+-		ap_free_sta(hapd, sta);
+ 		hostapd_ubus_notify(hapd, "local-deauth", sta->addr);
+		struct hostapd_ubus_request req = {
+			.type = HOSTAPD_UBUS_DISASSOC_REQ,
+			.sta = sta,
+			.reason = sta->deauth_reason
+		};
+		hostapd_ubus_handle_rt_event(hapd, &req);
+		ap_free_sta(hapd, sta);
+ 		return;
+ 	}
+ 
+@@ -530,6 +536,14 @@ skip_poll:
+ 				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY :
+ 				WLAN_REASON_PREV_AUTH_NOT_VALID;
+ 
+			/* sessions */
+			struct hostapd_ubus_request req = {
+				.type = HOSTAPD_UBUS_DISASSOC_REQ,
+				.sta = sta,
+				.reason = reason
+			};
+			hostapd_ubus_handle_rt_event(hapd, &req);
+
+ 			hostapd_drv_sta_disassoc(hapd, sta->addr, reason);
+ 		}
+ 	}
+@@ -566,6 +580,15 @@ skip_poll:
+ 			   __func__, MAC2STR(sta->addr), AP_DEAUTH_DELAY);
+ 		eloop_register_timeout(AP_DEAUTH_DELAY, 0, ap_handle_timer,
+ 				       hapd, sta);
+
+		/* sessions */
+		struct hostapd_ubus_request req = {
+			.type = HOSTAPD_UBUS_DISASSOC_REQ,
+			.sta = sta,
+			.reason = reason
+		};
+		hostapd_ubus_handle_rt_event(hapd, &req);
+
+ 		mlme_disassociate_indication(hapd, sta, reason);
+ 		break;
+ 	case STA_DEAUTH:
+--- a/src/ap/sta_info.h
+++ b/src/ap/sta_info.h
+@@ -77,6 +77,9 @@ struct sta_info {
+ 	u8 supported_rates[WLAN_SUPP_RATES_MAX];
+ 	int supported_rates_len;
+ 	u8 qosinfo; /* Valid when WLAN_STA_WMM is set */
+	u64 cl_session_id; /* client fnv1a 64bit session id */
+	u8 fdata; /* client first data flag */
+	u8 first_ip; /* client first ip flag */
+ 
+ #ifdef CONFIG_MESH
+ 	enum mesh_plink_state plink_state;
+--- a/src/ap/ubus.c
+++ b/src/ap/ubus.c
+@@ -24,7 +24,10 @@
+ 
+ static struct ubus_context *ctx;
+ static struct blob_buf b;
+static struct blob_buf b_ev;
+ static int ctx_ref;
+static char** bss_lst = NULL;
+static size_t bss_nr = 0;
+ 
+ static inline struct hapd_interfaces *get_hapd_interfaces_from_object(struct ubus_object *obj)
+ {
+@@ -63,6 +66,21 @@ static void hostapd_ubus_connection_lost
+ 	eloop_register_timeout(1, 0, ubus_reconnect_timeout, ctx, NULL);
+ }
+ 
+static int avl_compare_sess_id(const void *k1, const void *k2, void *ptr)
+{
+	const uint32_t *id1 = k1, *id2 = k2;
+
+	if (*id1 < *id2)
+		return -1;
+	else
+		return *id1 > *id2;
+}
+
+uint64_t get_time_in_ms(struct timespec *ts)
+{
+    return (uint64_t) ts->tv_sec * 1000 + ts->tv_nsec / 1000000;
+}
+
+ static bool hostapd_ubus_init(void)
+ {
+ 	if (ctx)
+@@ -525,6 +543,177 @@ static const struct blobmsg_policy csa_p
+ };
+ 
+ #ifdef NEED_AP_MLME
+enum { CSESS_REQ_SESS_ID,
+       __CSESS_REQ_MAX,
+};
+
+static const struct blobmsg_policy client_session_del_policy[__CSESS_REQ_MAX] = {
+	[CSESS_REQ_SESS_ID] = { .name = "session_id", .type = BLOBMSG_TYPE_INT64 },
+};
+
+static int hostapd_clear_session(struct ubus_context *ctx,
+				 struct ubus_object *obj,
+				 struct ubus_request_data *req,
+				 const char *method,
+				 struct blob_attr *msg)
+{
+	struct blob_attr *tb[__CSESS_REQ_MAX];
+	struct hostapd_data *hapd = container_of(obj, struct hostapd_data, ubus.obj);
+	struct hostapd_event_avl_rec *rec = NULL;
+	struct hostapd_event_avl_rec *rec_next = NULL;
+	uint64_t session_id = 0;
+
+	blobmsg_parse(client_session_del_policy, __CSESS_REQ_MAX, tb,
+		      blob_data(msg), blob_len(msg));
+
+	if (!tb[CSESS_REQ_SESS_ID])
+		return UBUS_STATUS_INVALID_ARGUMENT;
+
+	session_id = blobmsg_get_u64(tb[CSESS_REQ_SESS_ID]);
+	/* remove from AVL and ubus session object) */
+	avl_for_each_element_safe(&hapd->ubus.rt_events, rec, avl, rec_next)
+	{
+		if (session_id == rec->session_id) {
+			/* dec counter and delete */
+			cached_events_nr -= rec->rec_nr;
+			avl_delete(&hapd->ubus.rt_events, &rec->avl);
+			os_free(rec->records);
+			os_free(rec);
+		}
+	}
+	return 0;
+}
+
+static int hostapd_clear_sessions(struct ubus_context *ctx,
+				  struct ubus_object *obj,
+				  struct ubus_request_data *req,
+				  const char *method,
+				  struct blob_attr *msg)
+{
+	struct hostapd_data *hapd = container_of(obj, struct hostapd_data, ubus.obj);
+	struct hostapd_event_avl_rec *rec = NULL;
+	struct hostapd_event_avl_rec *rec_n = NULL;
+
+	avl_remove_all_elements(&hapd->ubus.rt_events, rec, avl, rec_n)
+	{
+		/* free events array */
+		os_free(rec->records);
+		os_free(rec);
+	}
+	/* reset counter */
+	cached_events_nr = 0;
+	return 0;
+}
+
+static int hostapd_sessions(struct ubus_context *ctx,
+			struct ubus_object *obj,
+		        struct ubus_request_data *req,
+			const char *method,
+                        struct blob_attr *msg)
+{
+	struct hostapd_data *hapd = container_of(obj, struct hostapd_data, ubus.obj);
+	void *a = NULL;
+	void *t = NULL;
+	void *t_msg = NULL;
+	struct hostapd_event_avl_rec *rec = NULL;
+	struct client_session_record *c_rec = NULL;
+
+	blob_buf_init(&b_ev, 0);
+	a = blobmsg_open_table(&b_ev, "sessions");
+	avl_for_each_element(&hapd->ubus.rt_events, rec, avl)
+	{
+		/* open session */
+		t = blobmsg_open_table(&b_ev, "ClientSession");
+		blobmsg_add_u64(&b_ev, "session_id", rec->session_id);
+		/* messages for current session */
+		for (size_t i = 0; i < rec->rec_nr; i++) {
+			c_rec = &rec->records[i];
+			/* check message type */
+			switch (c_rec->type) {
+			/* ClientAuthEvent */
+			case CST_AUTH: {
+				struct client_auth_event *p = &c_rec->u.auth;
+				t_msg = blobmsg_open_table(&b_ev, "ClientAuthEvent");
+				blobmsg_add_u64(&b_ev, "session_id", rec->session_id);
+				blobmsg_add_u64(&b_ev, "timestamp", c_rec->timestamp);
+				blobmsg_add_string(&b_ev, "sta_mac", p->sta_mac);
+				blobmsg_add_u32(&b_ev, "band", p->band);
+				blobmsg_add_u32(&b_ev, "auth_status", p->auth_status);
+				blobmsg_add_string(&b_ev, "ssid", p->ssid);
+				blobmsg_close_table(&b_ev, t_msg);
+				break;
+			}
+
+			/* ClientAssocEvent */
+			case CST_ASSOC: {
+				struct client_assoc_event *p = &c_rec->u.assoc;
+				t_msg = blobmsg_open_table(&b_ev, "ClientAssocEvent");
+				blobmsg_add_u64(&b_ev, "session_id", rec->session_id);
+				blobmsg_add_u64(&b_ev, "timestamp", c_rec->timestamp);
+				blobmsg_add_string(&b_ev, "sta_mac", p->sta_mac);
+				blobmsg_add_u32(&b_ev, "band", p->band);
+				blobmsg_add_u32(&b_ev, "assoc_type", 0);
+				blobmsg_add_u32(&b_ev, "rssi", p->rssi);
+				blobmsg_add_u32(&b_ev, "internal_sc", 0);
+				blobmsg_add_u8(&b_ev, "using11k", p->using11k);
+				blobmsg_add_u8(&b_ev, "using11r", p->using11r);
+				blobmsg_add_u8(&b_ev, "using11v", p->using11v);
+				blobmsg_add_string(&b_ev, "ssid", p->ssid);
+				blobmsg_close_table(&b_ev, t_msg);
+				break;
+			}
+
+			/* ClientDisconnectEvent */
+			case CST_DISASSOC: {
+				struct client_disassoc_event *p = &c_rec->u.disassoc;
+				t_msg = blobmsg_open_table(&b_ev, "ClientDisconnectEvent");
+				blobmsg_add_u64(&b_ev, "session_id", rec->session_id);
+				blobmsg_add_u64(&b_ev, "timestamp", c_rec->timestamp);
+				blobmsg_add_string(&b_ev, "sta_mac", p->sta_mac);
+				blobmsg_add_u32(&b_ev, "band", p->band);
+				blobmsg_add_u32(&b_ev, "rssi", p->rssi);
+				blobmsg_add_u32(&b_ev, "internal_rc", p->internal_rc);
+				blobmsg_add_string(&b_ev, "ssid", p->ssid);
+				blobmsg_close_table(&b_ev, t_msg);
+				break;
+			}
+
+			/* ClientFirstDataEvent */
+			case CST_FDATA: {
+				struct client_fdata_event *p = &c_rec->u.fdata;
+				t_msg = blobmsg_open_table(&b_ev, "ClientFirstDataEvent");
+				blobmsg_add_u64(&b_ev, "session_id", rec->session_id);
+				blobmsg_add_u64(&b_ev, "timestamp", c_rec->timestamp);
+				blobmsg_add_string(&b_ev, "sta_mac", p->sta_mac);
+				blobmsg_add_u64(&b_ev, "fdata_tx_up_ts_in_us", p->tx_ts.tv_sec * (uint64_t)1000000);
+				blobmsg_add_u64(&b_ev, "fdata_rx_up_ts_in_us", p->rx_ts.tv_sec * (uint64_t)1000000);
+				blobmsg_close_table(&b_ev, t_msg);
+				break;
+			}
+
+			/* ClientIpEvent */
+			case CST_IP: {
+				struct client_ip_event *p = &c_rec->u.ip;
+				t_msg = blobmsg_open_table(&b_ev, "ClientIpEvent");
+				blobmsg_add_u64(&b_ev, "session_id", rec->session_id);
+				blobmsg_add_u64(&b_ev, "timestamp", c_rec->timestamp);
+				blobmsg_add_string(&b_ev, "sta_mac", p->sta_mac);
+				blobmsg_add_string(&b_ev, "ip_address", p->ip_addr);
+				blobmsg_close_table(&b_ev, t_msg);
+				break;
+			}
+
+			default:
+				break;
+			}
+		}
+		blobmsg_close_table(&b_ev, t);
+	}
+	blobmsg_close_table(&b_ev, a);
+	ubus_send_reply(ctx, req, b_ev.head);
+	return 0;
+}
+
+ static int
+ hostapd_switch_chan(struct ubus_context *ctx, struct ubus_object *obj,
+ 		    struct ubus_request_data *req, const char *method,
+@@ -1148,6 +1337,9 @@ static const struct ubus_method bss_meth
+ 	UBUS_METHOD_NOARG("get_features", hostapd_bss_get_features),
+ #ifdef NEED_AP_MLME
+ 	UBUS_METHOD("switch_chan", hostapd_switch_chan, csa_policy),
+	UBUS_METHOD_NOARG("get_sessions", hostapd_sessions),
+	UBUS_METHOD_NOARG("clear_sessions", hostapd_clear_sessions),
+	UBUS_METHOD("clear_session", hostapd_clear_session, client_session_del_policy),
+ #endif
+ 	UBUS_METHOD("set_vendor_elements", hostapd_vendor_elements, ve_policy),
+ 	UBUS_METHOD("notify_response", hostapd_notify_response, notify_policy),
+@@ -1187,6 +1379,7 @@ void hostapd_ubus_add_bss(struct hostapd
+ 	if (asprintf(&name, "hostapd.%s", hapd->conf->iface) < 0)
+ 		return;
+ 
+	avl_init(&hapd->ubus.rt_events, avl_compare_sess_id, false, NULL);
+ 	avl_init(&hapd->ubus.banned, avl_compare_macaddr, false, NULL);
+ 	obj->name = name;
+ 	obj->type = &bss_object_type;
+@@ -1194,6 +1387,9 @@ void hostapd_ubus_add_bss(struct hostapd
+ 	obj->n_methods = bss_object_type.n_methods;
+ 	ret = ubus_add_object(ctx, obj);
+ 	hostapd_ubus_ref_inc();
+	bss_nr++;
+	bss_lst = os_realloc(bss_lst, sizeof(char *) * bss_nr);
+	bss_lst[bss_nr - 1] = strdup(name);
+ 	if (hapd->conf->signal_stay_min > -128)
+ 		eloop_register_timeout(3, 0, hostapd_bss_signal_check, NULL, hapd);  /* Start up the poll timer. */
+ }
+@@ -1212,11 +1408,42 @@ void hostapd_ubus_free_bss(struct hostap
+ 	}
+ 
+ 	free(name);
+	for (size_t i = 0; i < bss_nr; i++)
+		os_free(bss_lst[i]);
+	free(bss_lst);
+	bss_lst = NULL;
+}
+
+static int hostapd_get_bss_list(struct ubus_context *ctx,
+				struct ubus_object *obj,
+				struct ubus_request_data *req,
+				const char *method,
+				struct blob_attr *msg)
+{
+	if (!bss_lst)
+		return 0;
+
+	void *a = NULL;
+	void *b = NULL;
+
+	/* create reply */
+	blob_buf_init(&b_ev, 0);
+	a = blobmsg_open_array(&b_ev, "bss_list");
+	/* check bss list from hapd */
+	for (size_t i = 0; i < bss_nr; i++) {
+		b = blobmsg_open_table(&b_ev, NULL);
+		blobmsg_add_string(&b_ev, "name", bss_lst[i]);
+		blobmsg_close_table(&b_ev, b);
+	}
+	blobmsg_close_array(&b_ev, a);
+	ubus_send_reply(ctx, req, b_ev.head);
+	return 0;
+ }
+ 
+ static const struct ubus_method daemon_methods[] = {
+ 	UBUS_METHOD("config_add", hostapd_config_add, config_add_policy),
+ 	UBUS_METHOD("config_remove", hostapd_config_remove, config_remove_policy),
+	UBUS_METHOD_NOARG("get_bss_list", hostapd_get_bss_list),
+ };
+ 
+ static struct ubus_object_type daemon_object_type =
+@@ -1260,6 +1487,18 @@ struct ubus_event_req {
+ 	int resp;
+ };
+ 
+static uint64_t hash_fnv1a_64bit(const void *key, int len)
+{
+	if (key == NULL)
+		return 0;
+	unsigned char *p = (unsigned char *)key;
+	uint64_t h = 14695981039346656037UL;
+	int i;
+	for (i = 0; i < len; i++)
+		h = (h ^ p[i]) * 1099511628211UL;
+	return h;
+}
+
+ static void
+ ubus_event_cb(struct ubus_notify_request *req, int idx, int ret)
+ {
+@@ -1268,6 +1507,224 @@ ubus_event_cb(struct ubus_notify_request
+ 	ureq->resp = ret;
+ }
+ 
+int hostapd_ubus_handle_rt_event(struct hostapd_data *hapd,
+				 struct hostapd_ubus_request *req)
+{
+	/* check event counter */
+	if (cached_events_nr > HOSTAPD_MAX_CACHED_EVENTS) {
+		hostapd_logger(
+			hapd, NULL, HOSTAPD_MODULE_IEEE80211,
+			HOSTAPD_LEVEL_WARNING,
+			"hostapd_ubus_handle_rt_event: HOSTAPD_MAX_CACHED_EVENTS [%d] exceeded",
+			HOSTAPD_MAX_CACHED_EVENTS);
+		return WLAN_STATUS_SUCCESS;
+	}
+	struct hostapd_event_avl_rec *rec = NULL;
+	struct timespec ts;
+	uint64_t timestamp = 0;
+	clock_gettime(CLOCK_REALTIME, &ts);
+	timestamp = get_time_in_ms(&ts);
+	uint64_t session_id = 0;
+	uint8_t new_rec = 0;
+	const struct ieee80211_mgmt *mgmt = req->mgmt_frame;
+	struct sta_info *sta = req->sta ? (void *)req->sta : ap_get_sta(hapd, mgmt->sa);
+	/* null pointer check */
+	if (!sta) return WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
+
+	struct hostapd_bss_config *bss_conf = hapd->conf;
+	session_id = sta->cl_session_id;
+
+	/* find by session id */
+	rec = avl_find_element(&hapd->ubus.rt_events, &session_id, rec, avl);
+
+	/* prepare rec if not found */
+	if (!rec) {
+		new_rec = 1;
+		rec = os_zalloc(sizeof(struct hostapd_event_avl_rec));
+		session_id = hash_fnv1a_64bit(&ts, sizeof(struct timespec));
+	}
+	hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211,
+		       HOSTAPD_LEVEL_DEBUG,
+		       "hostapd_ubus_handle_rt_event: REQ TYPE [%d]",
+		       req->type);
+
+	switch (req->type) {
+	case HOSTAPD_UBUS_AUTH_REQ: {
+		/* session id */
+		rec->session_id = session_id;
+		rec->rec_nr++;
+		rec->records = os_realloc(rec->records,
+					  sizeof(struct client_session_record) * rec->rec_nr);
+		struct client_session_record *rp = &rec->records[rec->rec_nr - 1];
+		rp->type = CST_AUTH;
+		rp->u.auth.session_id = rec->session_id;
+
+		/* timestamp */
+		rp->timestamp = timestamp;
+		/* frequency */
+		rp->u.auth.band = hapd->iface->freq;
+		/* STA MAC */
+		sprintf(rp->u.auth.sta_mac, MACSTR, MAC2STR(sta->addr));
+		/* ssid */
+		rp->u.auth.ssid[0] = 0;
+		printf_encode(rp->u.auth.ssid, sizeof(rp->u.auth.ssid),
+			      bss_conf->ssid.ssid, bss_conf->ssid.ssid_len);
+		/* auth status */
+		rp->u.auth.auth_status = le_to_host16(mgmt->u.auth.status_code);
+		hostapd_logger(
+			hapd, NULL, HOSTAPD_MODULE_IEEE80211,
+			HOSTAPD_LEVEL_DEBUG,
+			"hostapd_ubus_handle_rt_event:HOSTAPD_UBUS_AUTH_REQ");
+		/* inc counter */
+		cached_events_nr++;
+		break;
+	}
+	case HOSTAPD_UBUS_ASSOC_REQ: {
+		/* session id */
+		rec->session_id = session_id;
+		rec->rec_nr++;
+		rec->records = os_realloc(rec->records,
+					  sizeof(struct client_session_record) * rec->rec_nr);
+		struct client_session_record *rp = &rec->records[rec->rec_nr - 1];
+		rp->type = CST_ASSOC;
+		rp->u.assoc.session_id = rec->session_id;
+		/* timestamp */
+		rp->timestamp = timestamp;
+		/* frequency */
+		rp->u.assoc.band = hapd->iface->freq;
+		/* STA MAC */
+		sprintf(rp->u.assoc.sta_mac, MACSTR, MAC2STR(sta->addr));
+		/* ssid */
+		rp->u.assoc.ssid[0] = 0;
+		printf_encode(rp->u.assoc.ssid, sizeof(rp->u.assoc.ssid),
+			      bss_conf->ssid.ssid, bss_conf->ssid.ssid_len);
+		/* rssi */
+		rp->u.assoc.rssi = req->ssi_signal;
+		/* using 11r */
+		rp->u.assoc.using11r = (sta->auth_alg & WPA_AUTH_ALG_FT);
+		/* using 11k */
+		if (sta->rrm_enabled_capa[0] || sta->rrm_enabled_capa[1] ||
+		    sta->rrm_enabled_capa[2] || sta->rrm_enabled_capa[3] ||
+		    sta->rrm_enabled_capa[4])
+			rp->u.assoc.using11k = 1;
+		else
+			rp->u.assoc.using11k = 0;
+		/* using 11v */
+		if (bss_conf->time_advertisement || bss_conf->wnm_sleep_mode ||
+		    bss_conf->bss_transition)
+			rp->u.assoc.using11v = 1;
+		else
+			rp->u.assoc.using11v = 0;
+		hostapd_logger(
+			hapd, NULL, HOSTAPD_MODULE_IEEE80211,
+			HOSTAPD_LEVEL_DEBUG,
+			"hostapd_ubus_handle_rt_event:HOSTAPD_UBUS_ASSOC_REQ");
+		/* inc counter */
+		cached_events_nr++;
+		break;
+	}
+	case HOSTAPD_UBUS_DISASSOC_REQ: {
+		/* session id */
+		rec->session_id = session_id;
+		rec->rec_nr++;
+		rec->records = os_realloc(rec->records,
+					  sizeof(struct client_session_record) * rec->rec_nr);
+		struct client_session_record *rp = &rec->records[rec->rec_nr - 1];
+		rp->type = CST_DISASSOC;
+		rp->u.disassoc.session_id = rec->session_id;
+		/* timestamp */
+		rp->timestamp = timestamp;
+		/* frequency */
+		rp->u.disassoc.band = hapd->iface->freq;
+		/* STA MAC */
+		sprintf(rp->u.disassoc.sta_mac, MACSTR, MAC2STR(sta->addr));
+		/* ssid */
+		rp->u.disassoc.ssid[0] = 0;
+		printf_encode(rp->u.disassoc.ssid, sizeof(rp->u.disassoc.ssid),
+			      bss_conf->ssid.ssid, bss_conf->ssid.ssid_len);
+		/* rssi */
+		rp->u.disassoc.rssi = req->ssi_signal;
+		/* internal_rc */
+		rp->u.disassoc.internal_rc = req->reason;
+		hostapd_logger(
+			hapd, NULL, HOSTAPD_MODULE_IEEE80211,
+			HOSTAPD_LEVEL_DEBUG,
+			"hostapd_ubus_handle_rt_event:HOSTAPD_UBUS_DISASSOC_REQ");
+		/* inc counter */
+		cached_events_nr++;
+		break;
+	}
+	case HOSTAPD_UBUS_FDATA_REQ: {
+		/* session id */
+		rec->session_id = session_id;
+		rec->rec_nr++;
+		rec->records = os_realloc(rec->records,
+					  sizeof(struct client_session_record) * rec->rec_nr);
+		struct client_session_record *rp = &rec->records[rec->rec_nr - 1];
+		rp->type = CST_FDATA;
+		rp->u.fdata.session_id = rec->session_id;
+		/* timestamp */
+		rp->timestamp = timestamp;
+		/* STA MAC */
+		sprintf(rp->u.fdata.sta_mac, MACSTR, MAC2STR(sta->addr));
+		/* rx ts */
+		rp->u.fdata.rx_ts = ts;
+		/* tx ts */
+		rp->u.fdata.tx_ts = ts;
+		/* single event only */
+		sta->fdata = 1;
+		hostapd_logger(
+			hapd, NULL, HOSTAPD_MODULE_IEEE80211,
+			HOSTAPD_LEVEL_DEBUG,
+			"hostapd_ubus_handle_rt_event:HOSTAPD_UBUS_FDATA_REQ");
+		/* inc counter */
+		cached_events_nr++;
+		break;
+	}
+	case HOSTAPD_UBUS_IP_REQ: {
+		if(sta->first_ip) break;
+		/* session id */
+		rec->session_id = session_id;
+		rec->rec_nr++;
+		rec->records = os_realloc(rec->records,
+					  sizeof(struct client_session_record) * rec->rec_nr);
+		struct client_session_record *rp = &rec->records[rec->rec_nr - 1];
+		rp->type = CST_IP;
+		rp->u.ip.session_id = rec->session_id;
+		/* timestamp */
+		rp->timestamp = timestamp;
+		/* STA MAC */
+		sprintf(rp->u.ip.sta_mac, MACSTR, MAC2STR(sta->addr));
+		/* ip address */
+		snprintf(rp->u.ip.ip_addr, 20, "%u.%u.%u.%u",
+			 (req->ipaddr >> 24) & 0xFF,
+			 (req->ipaddr >> 16) & 0xFF,
+			 (req->ipaddr >> 8) & 0xFF,
+			 req->ipaddr & 0xFF);
+		/* single event only */
+		sta->first_ip = 1;
+		/* inc counter */
+		cached_events_nr++;
+		break;
+	}
+	default:
+		hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211,
+			       HOSTAPD_LEVEL_DEBUG,
+			       "hostapd_ubus_handle_rt_event:UNKNOWN");
+		new_rec = 0;
+		break;
+	}
+	if (new_rec) {
+		/* insert new client session */
+		rec->avl.key = &rec->session_id;
+		sta->cl_session_id = session_id;
+		if (avl_insert(&hapd->ubus.rt_events, &rec->avl))
+			return WLAN_STATUS_UNSPECIFIED_FAILURE;
+	}
+
+	return WLAN_STATUS_SUCCESS;
+}
+
+ int hostapd_ubus_handle_event(struct hostapd_data *hapd, struct hostapd_ubus_request *req)
+ {
+ 	struct ubus_banned_client *ban;
+--- a/src/ap/ubus.h
+++ b/src/ap/ubus.h
+@@ -12,6 +12,11 @@ enum hostapd_ubus_event_type {
+ 	HOSTAPD_UBUS_PROBE_REQ,
+ 	HOSTAPD_UBUS_AUTH_REQ,
+ 	HOSTAPD_UBUS_ASSOC_REQ,
+	HOSTAPD_UBUS_REASSOC_REQ,
+	HOSTAPD_UBUS_DISASSOC_REQ,
+	HOSTAPD_UBUS_DEAUTH_REQ,
+	HOSTAPD_UBUS_FDATA_REQ,
+	HOSTAPD_UBUS_IP_REQ,
+ 	HOSTAPD_UBUS_TYPE_MAX
+ };
+ 
+@@ -19,8 +24,11 @@ struct hostapd_ubus_request {
+ 	enum hostapd_ubus_event_type type;
+ 	const struct ieee80211_mgmt *mgmt_frame;
+ 	const struct ieee802_11_elems *elems;
+	const struct sta_info *sta;
+ 	int ssi_signal; /* dBm */
+	int reason;
+ 	const u8 *addr;
+	be32 ipaddr;
+ };
+ 
+ struct hostapd_iface;
+@@ -37,6 +45,80 @@ struct hostapd_ubus_bss {
+ 	struct ubus_object obj;
+ 	struct avl_tree banned;
+ 	int notify_response;
+	struct avl_tree rt_events;
+};
+
+enum client_sess_type {
+	CST_ASSOC,
+	CST_AUTH,
+	CST_DISASSOC,
+	CST_FDATA,
+	CST_IP
+};
+
+struct client_assoc_event {
+	unsigned char sta_mac[20];
+	uint64_t session_id;
+	char ssid[SSID_MAX_LEN];
+	int band;
+	int assoc_type;
+	int status;
+	int rssi;
+	int internal_sc;
+	uint8_t using11k;
+	uint8_t using11r;
+	uint8_t using11v;
+};
+
+struct client_disassoc_event {
+	unsigned char sta_mac[20];
+	uint64_t session_id;
+	char ssid[SSID_MAX_LEN];
+	int band;
+	int assoc_type;
+	int status;
+	int rssi;
+	int internal_rc;
+};
+
+struct client_auth_event {
+	unsigned char sta_mac[20];
+	uint64_t session_id;
+	char ssid[SSID_MAX_LEN];
+	int band;
+	uint32_t auth_status;
+};
+
+struct client_fdata_event {
+	unsigned char sta_mac[20];
+	uint64_t session_id;
+	struct timespec rx_ts;
+	struct timespec tx_ts;
+};
+
+struct client_ip_event {
+	unsigned char sta_mac[20];
+	uint64_t session_id;
+	unsigned char ip_addr[16];
+};
+
+struct client_session_record {
+	int type;
+	uint64_t timestamp;
+	union {
+		struct client_assoc_event assoc;
+		struct client_disassoc_event disassoc;
+		struct client_auth_event auth;
+		struct client_fdata_event fdata;
+		struct client_ip_event ip;
+	} u;
+};
+
+struct hostapd_event_avl_rec {
+	uint64_t session_id;
+	struct client_session_record *records;
+	size_t rec_nr;
+	struct avl_node avl;
+ };
+ 
+ void hostapd_ubus_add_iface(struct hostapd_iface *iface);
+@@ -45,6 +127,7 @@ void hostapd_ubus_add_bss(struct hostapd
+ void hostapd_ubus_free_bss(struct hostapd_data *hapd);
+ 
+ int hostapd_ubus_handle_event(struct hostapd_data *hapd, struct hostapd_ubus_request *req);
+int hostapd_ubus_handle_rt_event(struct hostapd_data *hapd, struct hostapd_ubus_request *req);
+ void hostapd_ubus_notify(struct hostapd_data *hapd, const char *type, const u8 *mac);
+ void hostapd_ubus_notify_beacon_report(struct hostapd_data *hapd,
+ 				       const u8 *addr, u8 token, u8 rep_mode,
+@@ -78,6 +161,11 @@ static inline int hostapd_ubus_handle_ev
+ {
+ 	return 0;
+ }
+
+static inline int hostapd_ubus_handle_rt_event(struct hostapd_data *hapd, struct hostapd_ubus_request *req)
+{
+	return 0;
+}
+ 
+ static inline void hostapd_ubus_notify(struct hostapd_data *hapd, const char *type, const u8 *mac)
+ {
+--- a/src/ap/hostapd.c
+++ b/src/ap/hostapd.c
+@@ -1406,19 +1406,22 @@ static int hostapd_setup_bss(struct host
+ 				   "Generic snooping infrastructure initialization failed");
+ 			return -1;
+ 		}
+-
+-		if (dhcp_snoop_init(hapd)) {
+-			wpa_printf(MSG_ERROR,
+-				   "DHCP snooping initialization failed");
+-			return -1;
+-		}
+-
+ 		if (ndisc_snoop_init(hapd)) {
+ 			wpa_printf(MSG_ERROR,
+ 				   "Neighbor Discovery snooping initialization failed");
+ 			return -1;
+ 		}
+ 	}
+	if (dhcp_snoop_init(hapd)) {
+		wpa_printf(MSG_ERROR,
+			   "DHCP snooping initialization failed");
+		hostapd_logger(
+			hapd, NULL, HOSTAPD_MODULE_IEEE80211,
+			HOSTAPD_LEVEL_DEBUG,
+			"dfranusic:DHCP snooping initialization failed");
+
+		return -1;
+	}
+ 
+ 	if (!hostapd_drv_none(hapd) && vlan_init(hapd)) {
+ 		wpa_printf(MSG_ERROR, "VLAN initialization failed.");
+--- a/src/ap/dhcp_snoop.c
+++ b/src/ap/dhcp_snoop.c
+@@ -40,6 +40,7 @@ static void handle_dhcp(void *ctx, const
+ 	int res, msgtype = 0, prefixlen = 32;
+ 	u32 subnet_mask = 0;
+ 	u16 ip_len;
+	int ubus_resp;
+ 
+ 	exten_len = len - ETH_HLEN - (sizeof(*b) - sizeof(b->exten));
+ 	if (exten_len < 4)
+@@ -112,6 +113,19 @@ static void handle_dhcp(void *ctx, const
+ 			   ipaddr_str(be_to_host32(b->your_ip)),
+ 			   prefixlen);
+ 
+			struct hostapd_ubus_request req = {
+				.type = HOSTAPD_UBUS_IP_REQ,
+				.sta = sta,
+				.ipaddr = be_to_host32(b->your_ip)
+			};
+			ubus_resp = hostapd_ubus_handle_rt_event(hapd, &req);
+			if (ubus_resp) {
+				hostapd_logger(
+					hapd, NULL, HOSTAPD_MODULE_IEEE80211,
+					HOSTAPD_LEVEL_DEBUG,
+					"hostapd_ubus_handle_rt_event: ERROR");
+			}
+
+ 		if (sta->ipaddr == b->your_ip)
+ 			return;
+ 
--- a/feeds/wifi-ax/mac80211/ath.mk
+++ b/feeds/wifi-ax/mac80211/ath.mk
@@ -54,9 +54,13 @@ config-$(CONFIG_ATH10K_THERMAL) += ATH10K_THERMAL

 config-$(call config_package,ath9k-htc) += ATH9K_HTC
 config-$(call config_package,ath10k) += ATH10K ATH10K_PCI
-config-$(call config_package,ath11k) += ATH11K ATH11K_AHB
+config-$(call config_package,ath11k) += ATH11K ATH11K_AHB ATH11K_SPECTRAL
 config-$(call config_package,ath11k-pci) += ATH11K_PCI

+ifeq ($(CONFIG_KERNEL_IPQ_MEM_PROFILE),512)
+config-y += ATH11K_MEM_PROFILE_512M
+endif
+
 config-$(call config_package,ath5k) += ATH5K
 ifdef CONFIG_TARGET_ath25
  config-y += ATH5K_AHB
--- a/feeds/wifi-ax/mac80211/files/lib/netifd/wireless/mac80211.sh
+++ b/feeds/wifi-ax/mac80211/files/lib/netifd/wireless/mac80211.sh
@@ -254,6 +254,11 @@ mac80211_hostapd_setup_base() {
 		[ "$rx_stbc" -lt "$cap_rx_stbc" ] && cap_rx_stbc="$rx_stbc"
 		ht_cap_mask="$(( ($ht_cap_mask & ~(0x300)) | ($cap_rx_stbc << 8) ))"

+		conf_tx_ant=$(iw phy "$phy" info | grep 'Configured Antennas:' | cut -d: -f2)
+		set -- $conf_tx_ant
+		if [ "$2" == "0x1" -o "$2" == "0x10" ]; then
+			tx_stbc=0
+		fi
 		mac80211_add_capabilities ht_capab_flags $ht_cap_mask \
 			LDPC:0x1::$ldpc \
 			GF:0x10::$greenfield \
@@ -343,6 +348,11 @@ mac80211_hostapd_setup_base() {
 		[ "$rx_stbc" -lt "$cap_rx_stbc" ] && cap_rx_stbc="$rx_stbc"
 		vht_cap="$(( ($vht_cap & ~(0x700)) | ($cap_rx_stbc << 8) ))"

+		conf_tx_ant=$(iw phy "$phy" info | grep 'Configured Antennas:' | cut -d: -f2)
+		set -- $conf_tx_ant
+		if [ "$2" == "0x1" -o "$2" == "0x10" ]; then
+			tx_stbc_2by1=0
+		fi
 		mac80211_add_capabilities vht_capab $vht_cap \
 			RXLDPC:0x10::$rxldpc \
 			SHORT-GI-80:0x20::$short_gi_80 \
--- a/feeds/wifi-ax/mac80211/patches/pending/210-memory-optimize.patch
+++ b/feeds/wifi-ax/mac80211/patches/pending/210-memory-optimize.patch
@@ -0,0 +1,26 @@
+Index: backports-20200902_001-4.4.60-931c337125/drivers/net/wireless/ath/ath11k/dp.h
+===================================================================
+--- backports-20200902_001-4.4.60-931c337125.orig/drivers/net/wireless/ath/ath11k/dp.h
+++ backports-20200902_001-4.4.60-931c337125/drivers/net/wireless/ath/ath11k/dp.h
+@@ -209,7 +209,7 @@ struct ath11k_pdev_dp {
+ 
+ #define DP_WBM_RELEASE_RING_SIZE	64
+ #define DP_TCL_DATA_RING_SIZE		512
+-#define DP_TX_COMP_RING_SIZE		32768
+#define DP_TX_COMP_RING_SIZE		4096
+ #define DP_TX_IDR_SIZE			DP_TX_COMP_RING_SIZE
+ #define DP_TCL_CMD_RING_SIZE		32
+ #define DP_TCL_STATUS_RING_SIZE		32
+@@ -224,9 +224,9 @@ struct ath11k_pdev_dp {
+ #define DP_RXDMA_REFILL_RING_SIZE	2048
+ #define DP_RXDMA_ERR_DST_RING_SIZE	1024
+ #define DP_RXDMA_MON_STATUS_RING_SIZE	1024
+-#define DP_RXDMA_MONITOR_BUF_RING_SIZE	4096
+-#define DP_RXDMA_MONITOR_DST_RING_SIZE	2048
+-#define DP_RXDMA_MONITOR_DESC_RING_SIZE	4096
+#define DP_RXDMA_MONITOR_BUF_RING_SIZE	512
+#define DP_RXDMA_MONITOR_DST_RING_SIZE	128
+#define DP_RXDMA_MONITOR_DESC_RING_SIZE	128
+ 
+ #define DP_RX_BUFFER_SIZE	2048
+ #define	DP_RX_BUFFER_SIZE_LITE  1024
--- a/feeds/wifi-ax/mac80211/patches/pending/211-coldboot.patch
+++ b/feeds/wifi-ax/mac80211/patches/pending/211-coldboot.patch
@@ -0,0 +1,13 @@
+Index: backports-20200902_001-4.4.60-931c337125/drivers/net/wireless/ath/ath11k/qmi.c
+===================================================================
+--- backports-20200902_001-4.4.60-931c337125.orig/drivers/net/wireless/ath/ath11k/qmi.c
+++ backports-20200902_001-4.4.60-931c337125/drivers/net/wireless/ath/ath11k/qmi.c
+@@ -16,7 +16,7 @@
+ #define HOST_CSTATE_BIT			0x04
+ 
+ /* set the default max assoc sta to max supported by driver */
+-bool enable_cold_boot_cal = 1;
+bool enable_cold_boot_cal = 0;
+ EXPORT_SYMBOL(enable_cold_boot_cal);
+ module_param(enable_cold_boot_cal, bool, 0644);
+ MODULE_PARM_DESC(enable_cold_boot_cal, "cold boot calibration enable:1 disable:0");
--- a/feeds/wifi-ax/mac80211/patches/qca/224-ath11k-update-HT-cap-to-disable-TX-STBC-with-single-antenna.patch
+++ b/feeds/wifi-ax/mac80211/patches/qca/224-ath11k-update-HT-cap-to-disable-TX-STBC-with-single-antenna.patch
@@ -0,0 +1,55 @@
+--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -4693,7 +4693,8 @@
+ }
+ 
+ static struct ieee80211_sta_ht_cap
+-ath11k_create_ht_cap(struct ath11k *ar, u32 ar_ht_cap, u32 rate_cap_rx_chainmask)
+ath11k_create_ht_cap(struct ath11k *ar, u32 ar_ht_cap,
+		     u32 rate_cap_tx_chainmask, u32 rate_cap_rx_chainmask)
+ {
+ 	int i;
+ 	struct ieee80211_sta_ht_cap ht_cap = {0};
+@@ -4724,7 +4725,7 @@
+ 		ht_cap.cap |= smps;
+ 	}
+ 
+-	if (ar_ht_cap & WMI_HT_CAP_TX_STBC)
+	if ((ar_ht_cap & WMI_HT_CAP_TX_STBC) && (rate_cap_tx_chainmask > 1))
+ 		ht_cap.cap |= IEEE80211_HT_CAP_TX_STBC;
+ 
+ 	if (ar_ht_cap & WMI_HT_CAP_RX_STBC) {
+@@ -4903,6 +4904,7 @@
+ 		if (ht_cap_info)
+ 			*ht_cap_info = ht_cap;
+ 		band->ht_cap = ath11k_create_ht_cap(ar, ht_cap,
+						    rate_cap_tx_chainmask,
+ 						    rate_cap_rx_chainmask);
+ 
+ 		band->vht_cap = ath11k_create_vht_cap(ar, rate_cap_tx_chainmask,
+@@ -4915,10 +4917,25 @@
+ 		if (ht_cap_info)
+ 			*ht_cap_info = ht_cap;
+ 		band->ht_cap = ath11k_create_ht_cap(ar, ht_cap,
+						    rate_cap_tx_chainmask,
+ 						    rate_cap_rx_chainmask);
+ 		band->vht_cap = ath11k_create_vht_cap(ar, rate_cap_tx_chainmask,
+ 						      rate_cap_rx_chainmask);
+ 	}
+
+	if (ar->hw->wiphy->bands[NL80211_BAND_5GHZ]) {
+		ar->hw->wiphy->bands[NL80211_BAND_5GHZ]->ht_cap.cap =
+			ar->mac.sbands[NL80211_BAND_5GHZ].ht_cap.cap;
+		ar->hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.cap =
+			ar->mac.sbands[NL80211_BAND_5GHZ].vht_cap.cap;
+	}
+	if (ar->hw->wiphy->bands[NL80211_BAND_2GHZ]) {
+		ar->hw->wiphy->bands[NL80211_BAND_2GHZ]->ht_cap.cap =
+			ar->mac.sbands[NL80211_BAND_2GHZ].ht_cap.cap;
+		ar->hw->wiphy->bands[NL80211_BAND_2GHZ]->vht_cap.cap =
+			ar->mac.sbands[NL80211_BAND_2GHZ].vht_cap.cap;
+	}
+
+ }
+ 
+ static int ath11k_check_chain_mask(struct ath11k *ar, u32 ant, bool is_tx_ant)
--- a/feeds/wifi-trunk/hostapd/files/hostapd.sh
+++ b/feeds/wifi-trunk/hostapd/files/hostapd.sh
@@ -863,14 +863,23 @@ hostapd_set_bss_options() {
 	set_default hs20 0
 	set_default disable_dgaf $hs20
 	set_default osen 0
+	set_default internet 0
+	set_default asra 0
+	set_default esr 0
+	set_default uesa 0
 	set_default anqp_domain_id 0
+	set_default access_network_type 0
+	set_default venue_group 0
+	set_default venue_type 0
+	set_default ipaddr_type_availability 0
+	set_default gas_address3 0
 	set_default hs20_deauth_req_timeout 60
 	if [ "$hs20" = "1" ]; then
 		append bss_conf "hs20=1" "$N"
 		append_hs20_icons
 		[ -n "$disable_dgaf"] && append bss_conf "disable_dgaf=$disable_dgaf" "$N"
 		[ -n "$osen"] && append bss_conf "osen=$osen" "$N"
-		[ -n "$anqp_domain_id"] && append bss_conf "anqp_domain_id=$anqp_domain_id" "$N"
+		[ "$anqp_domain_id" -gt 0 ] && append bss_conf "anqp_domain_id=$anqp_domain_id" "$N"
 		[ -n "$hs20_deauth_req_timeout"] && append bss_conf "hs20_deauth_req_timeout=$hs20_deauth_req_timeout" "$N"
 		[ -n "$osu_ssid" ] && append bss_conf "osu_ssid=$osu_ssid" "$N"
 		[ -n "$hs20_wan_metrics" ] && append bss_conf "hs20_wan_metrics=$hs20_wan_metrics" "$N"
@@ -887,15 +896,15 @@ hostapd_set_bss_options() {
 		json_for_each_item append_osu_provider osu_provider
 		json_for_each_item append_operator_icon operator_icon
 		[ -n "$interworking" ] && append bss_conf "interworking=$interworking" "$N"
-		[ -n "$internet" ] && append bss_conf "internet=$internet" "$N"
-		[ -n "$access_network_type" ] && append bss_conf "access_network_type=$access_network_type" "$N"
-		[ -n "$asra" ] && append bss_conf "asra=$asra" "$N"
-		[ -n "$esr" ] && append bss_conf "esr=$esr" "$N"
-		[ -n "$uesa" ] && append bss_conf "uesa=$uesa" "$N"
-		[ -n "$venue_group" ] && append bss_conf "venue_group=$venue_group" "$N"
-		[ -n "$venue_type" ] && append bss_conf "venue_type=$venue_type" "$N"
-		[ -n "$ipaddr_type_availability" ] && append bss_conf "ipaddr_type_availability=$ipaddr_type_availability" "$N"
-		[ -n "$gas_address3" ] && append bss_conf "gas_address3=$gas_address3" "$N"
+		[ "$internet" -gt 0 ] && append bss_conf "internet=$internet" "$N"
+		[ "$access_network_type" -gt 0 ] && append bss_conf "access_network_type=$access_network_type" "$N"
+		[ "$asra" -gt 0 ] && append bss_conf "asra=$asra" "$N"
+		[ "$esr" -gt 0 ] && append bss_conf "esr=$esr" "$N"
+		[ "$uesa" -gt 0 ] && append bss_conf "uesa=$uesa" "$N"
+		[ "$venue_group" -gt 0 ] && append bss_conf "venue_group=$venue_group" "$N"
+		[ "$venue_type" -gt 0 ] && append bss_conf "venue_type=$venue_type" "$N"
+		[ "$ipaddr_type_availability" -gt 0 ] && append bss_conf "ipaddr_type_availability=$ipaddr_type_availability" "$N"
+		[ "$gas_address3" -gt 0 ] && append bss_conf "gas_address3=$gas_address3" "$N"
 		[ -n "$hessid" ] && append bss_conf "hessid=$hessid" "$N"
 		[ -n "$network_auth_type" ] && append bss_conf "network_auth_type=$network_auth_type" "$N"
 		[ -n "$anqp_3gpp_cell_net" ] && append bss_conf "anqp_3gpp_cell_net=$anqp_3gpp_cell_net" "$N"
--- a/feeds/wifi-trunk/hostapd/patches/901-hapd-ubus-channel-switch.patch
+++ b/feeds/wifi-trunk/hostapd/patches/901-hapd-ubus-channel-switch.patch
@@ -140,8 +140,8 @@ Index: hostapd-2020-06-08-5a8b3662/src/ap/ubus.h
 };
 
 +enum hostapd_ubus_chan_event_reason {
-+	HOSTAPD_UBUS_HIGH_INTERFERENCE,
-+	HOSTAPD_UBUS_DFS_SWITCH
+	HOSTAPD_UBUS_DFS_SWITCH,
+	HOSTAPD_UBUS_HIGH_INTERFERENCE
 +};
 +
 struct hostapd_ubus_request {
--- a/feeds/wifi-trunk/mac80211/files/lib/netifd/wireless/mac80211.sh
+++ b/feeds/wifi-trunk/mac80211/files/lib/netifd/wireless/mac80211.sh
@@ -174,6 +174,11 @@ mac80211_hostapd_setup_base() {
 		[ "$rx_stbc" -lt "$cap_rx_stbc" ] && cap_rx_stbc="$rx_stbc"
 		ht_cap_mask="$(( ($ht_cap_mask & ~(0x300)) | ($cap_rx_stbc << 8) ))"

+		conf_tx_ant=$(iw phy "$phy" info | grep 'Configured Antennas:' | cut -d: -f2)
+		set -- $conf_tx_ant
+		if [ "$2" == "0x1" -o "$2" == "0x10" ]; then
+			tx_stbc=0
+		fi
 		mac80211_add_capabilities ht_capab_flags $ht_cap_mask \
 			LDPC:0x1::$ldpc \
 			GF:0x10::$greenfield \
@@ -263,6 +268,11 @@ mac80211_hostapd_setup_base() {
 		[ "$rx_stbc" -lt "$cap_rx_stbc" ] && cap_rx_stbc="$rx_stbc"
 		vht_cap="$(( ($vht_cap & ~(0x700)) | ($cap_rx_stbc << 8) ))"

+		conf_tx_ant=$(iw phy "$phy" info | grep 'Configured Antennas:' | cut -d: -f2)
+		set -- $conf_tx_ant
+		if [ "$2" == "0x1" -o "$2" == "0x10" ]; then
+			tx_stbc_2by1=0
+		fi
 		mac80211_add_capabilities vht_capab $vht_cap \
 			RXLDPC:0x10::$rxldpc \
 			SHORT-GI-80:0x20::$short_gi_80 \
--- a/feeds/wlan-ap/nft-qos/Makefile
+++ b/feeds/wlan-ap/nft-qos/Makefile
@@ -48,13 +48,8 @@ define Package/nft-qos/install
 	$(INSTALL_DIR) $(1)/lib/nft-qos
 	$(INSTALL_DATA) ./files/lib/* $(1)/lib/nft-qos/
 	chmod 0700 $(1)/lib/nft-qos/mac-rate.sh
-	$(INSTALL_DIR) $(1)/etc/config
-	$(INSTALL_CONF) ./files/nft-qos.config $(1)/etc/config/nft-qos
 	$(INSTALL_DIR) $(1)/etc/init.d
 	$(INSTALL_BIN) ./files/nft-qos.init $(1)/etc/init.d/nft-qos
-	$(INSTALL_DIR) $(1)/etc/hotplug.d/dhcp
-	$(INSTALL_BIN) ./files/nft-qos-monitor.hotplug $(1)/etc/hotplug.d/dhcp/00-nft-qos-monitor
-	$(INSTALL_BIN) ./files/nft-qos-dynamic.hotplug $(1)/etc/hotplug.d/dhcp/01-nft-qos-dynamic
 endef

 $(eval $(call BuildPackage,nft-qos))
--- a/feeds/wlan-ap/nft-qos/files/lib/mac-rate.sh
+++ b/feeds/wlan-ap/nft-qos/files/lib/mac-rate.sh
@@ -27,23 +27,31 @@ if [ -z "$1" -o -z "$2" -o -z "$3" ]; then
 	exit 1
 fi

-logger -t "$1 $2 $3"
+logger -t "mac-rate" "$1 $2 $3"
+
+bridge=`uci get wireless.$iface.network`
+if [ "$bridge" == "lan" ]; then
+	dlchain="download_nat"
+        ulchain="upload_nat"
+else
+        dlchain="download"
+        ulchain="upload"
+fi

 if [ "$1" == "add" ]; then
 	config_load wireless

 	config_foreach handle_interface wifi-iface download
-
-	exists=`nft list chain bridge nft-qos-ssid-lan-bridge download  -a | grep -ic $3`
+	exists=`nft list chain bridge nft-qos-ssid-lan-bridge $dlchain  -a | grep -ic $3`
 	logger -t "mac-rate" "exists = $exists"
 	if [ "$exists" -ne 0 ]; then
-		old_drate=`nft list chain bridge nft-qos-ssid-lan-bridge download -a | grep -i $3 |  awk -F'kbytes' '{print $1}' | awk '{print $NF}'`
+		old_drate=`nft list chain bridge nft-qos-ssid-lan-bridge $dlchain -a | grep -i $3 |  awk -F'kbytes' '{print $1}' | awk '{print $NF}'`
 		logger -t "mac-rate" "old_drate=$old_drate"
 		if [ "$old_drate" -ne "$rate" ]; then
 			changed=1
-			id=`nft list chain bridge nft-qos-ssid-lan-bridge download  -a | grep -i $3  | awk -F "handle " '{print $2;exit}'`
+			id=`nft list chain bridge nft-qos-ssid-lan-bridge $dlchain  -a | grep -i $3  | awk -F "handle " '{print $2;exit}'`
 			if [ -n "$id" ]; then
-				nft delete rule bridge nft-qos-ssid-lan-bridge download handle $id
+				nft delete rule bridge nft-qos-ssid-lan-bridge $dlchain handle $id
 			fi
 			logger -t "mac-rate" "changed DL $old_drate to $rate, del $3"
 		else
@@ -54,19 +62,19 @@ if [ "$1" == "add" ]; then

        if [ "$exists" == 0 -o "$changed" == 1 ]; then
 	        if [ "$rate" -ne 0 ]; then
-			dok=`nft add rule bridge nft-qos-ssid-lan-bridge download ether daddr $3 limit rate over $rate kbytes/second drop`
+			dok=`nft add rule bridge nft-qos-ssid-lan-bridge $dlchain ether daddr $3 limit rate over $rate kbytes/second drop`
 	        fi
        fi

 	config_foreach handle_interface wifi-iface upload
-	exists=`nft list chain bridge nft-qos-ssid-lan-bridge upload  -a | grep -ic $3`
+	exists=`nft list chain bridge nft-qos-ssid-lan-bridge $ulchain  -a | grep -ic $3`
 	if [ "$exists" -ne 0 ]; then
-		old_urate=`nft list chain bridge nft-qos-ssid-lan-bridge upload -a | grep -i $3 |  awk -F'kbytes' '{print $1}' | awk '{print $NF}'`
+		old_urate=`nft list chain bridge nft-qos-ssid-lan-bridge $ulchain -a | grep -i $3 |  awk -F'kbytes' '{print $1}' | awk '{print $NF}'`
 		if [ "$old_urate" -ne "$rate" ]; then
 			changed=1
-			id=`nft list chain bridge nft-qos-ssid-lan-bridge upload  -a | grep -i $3  | awk -F "handle " '{print $2;exit}'`
+			id=`nft list chain bridge nft-qos-ssid-lan-bridge $ulchain  -a | grep -i $3  | awk -F "handle " '{print $2;exit}'`
 			if [ -n "$id" ]; then
-				nft delete rule bridge nft-qos-ssid-lan-bridge upload handle $id
+				nft delete rule bridge nft-qos-ssid-lan-bridge $ulchain handle $id
 			fi

 			logger -t "mac-rate" "changed UL $old_urate to $rate del $3"
@@ -78,20 +86,20 @@ if [ "$1" == "add" ]; then

        if [ "$exists" == 0 -o "$changed" == 1 ]; then
        	if [ "$rate" -ne 0 ]; then
-			uok=`nft add rule bridge nft-qos-ssid-lan-bridge upload ether saddr $3 limit rate over $rate kbytes/second drop`
+			uok=`nft add rule bridge nft-qos-ssid-lan-bridge $ulchain ether saddr $3 limit rate over $rate kbytes/second drop`
 		fi
 	fi

 elif [ "$1" == "del" ]; then
-	id=`nft list chain bridge nft-qos-ssid-lan-bridge download  -a | grep -i $3  | awk -F "handle " '{print $2;exit}'`
+	id=`nft list chain bridge nft-qos-ssid-lan-bridge $dlchain  -a | grep -i $3  | awk -F "handle " '{print $2;exit}'`
 	logger -t "mac-rate" "$id $3"
 	if [ -n "$id" ]; then
-		nft delete rule bridge nft-qos-ssid-lan-bridge download handle $id
+		nft delete rule bridge nft-qos-ssid-lan-bridge $dlchain handle $id
 	fi

-	id=`nft list chain bridge nft-qos-ssid-lan-bridge upload  -a | grep -i $3  | awk -F "handle " '{print $2;exit}'`
+	id=`nft list chain bridge nft-qos-ssid-lan-bridge $ulchain  -a | grep -i $3  | awk -F "handle " '{print $2;exit}'`
 	if [ -n "$id" ]; then
-		nft delete rule bridge nft-qos-ssid-lan-bridge upload handle $id
+		nft delete rule bridge nft-qos-ssid-lan-bridge $ulchain handle $id
 	fi

 fi
--- a/feeds/wlan-ap/nft-qos/files/lib/ssid_ratelimit.sh
+++ b/feeds/wlan-ap/nft-qos/files/lib/ssid_ratelimit.sh
@@ -42,8 +42,20 @@ qosdef_append_rule_ssid() { # <section> <operator> <bridge>
 		rate=$((rate/8))
 	fi

-	if [ -z "$iface" -o -z "$rate" -o $rate == 0 ]; then
-		logger -t "nft-qos" "Error: No interface $iface or rate $rate present"
+	if [ -z "$iface" ]; then
+		logger -t "nft-qos" "Error: No interface $iface present"
+		return
+	fi
+
+	if [ -z "$rate" -o $rate == 0 ]; then
+		logger -t "nft-qos" "ssid-rate disabled $iface, configure client-rate"
+	        maclist=`iwinfo $iface assoclist | grep dBm | cut -f 1 -s -d" "`
+
+		for mac in $maclist
+		do
+			logger -t "nft-qos" "Add $mac"
+			/lib/nft-qos/mac-rate.sh add $iface $mac
+		done
 		return
 	fi

--- a/feeds/wlan-ap/nft-qos/files/nft-qos.init
+++ b/feeds/wlan-ap/nft-qos/files/nft-qos.init
@@ -4,49 +4,26 @@
 #

 . /lib/nft-qos/core.sh
-. /lib/nft-qos/monitor.sh
-. /lib/nft-qos/dynamic.sh
-. /lib/nft-qos/static.sh
-. /lib/nft-qos/priority.sh
 . /lib/nft-qos/ssid_ratelimit.sh

 START=99
 USE_PROCD=1

 service_triggers() {
-#	procd_add_reload_trigger nft-qos wireless
-#	procd_add_reload_trigger wireless

 	procd_open_validate
-#	qosdef_validate_dynamic
-#	qosdef_validate_static
-#	qosdef_validate_priority
 	procd_close_validate
 }

 start_service() {
 	config_load nft-qos
-
-#	qosdef_init_env
-#	qosdef_flush_static
-#	qosdef_flush_dynamic
 	qosdef_flush_ssid_ratelimit
-#	qosdef_remove_priority
-
-#	qosdef_init_header
-#	qosdef_init_monitor
-#	qosdef_validate_dynamic default qosdef_init_dynamic
-#	qosdef_validate_static default qosdef_init_static
-#	qosdef_validate_priority default qosdef_init_priority
 	qosdef_init_ssid_ratelimit
 	qosdef_init_done
 	qosdef_start
 }

 stop_service() {
-#	qosdef_flush_dynamic
-#	qosdef_flush_static
-#	qosdef_remove_priority
 	qosdef_flush_ssid_ratelimit
 	qosdef_clean_cache
 }
--- a/feeds/wlan-ap/opennds/files/lib/login.sh
+++ b/feeds/wlan-ap/opennds/files/lib/login.sh
@@ -242,7 +242,7 @@ header="<!DOCTYPE html>
 	<meta http-equiv=\"Expires\" content=\"0\">
 	<meta charset=\"utf-8\">
 	<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">
-	<link rel=\"shortcut icon\" href=\"/images/$client_zone/TipLogo.png\" type=\"image/x-icon\">
+	<link rel=\"shortcut icon\" href=\"/images/TipLogo.png\" type=\"image/x-icon\">
 	<link rel=\"stylesheet\" type=\"text/css\" href=\"/splash.css\">
 	<title>$gatewaynamehtml</title>
 	</head>
@@ -257,7 +257,7 @@ header="<!DOCTYPE html>
 version="$(ndsctl status | grep Version)"
 year="$(date | awk -F ' ' '{print $(6)}')"
 footer="
-	<img style=\"height:60px; width:100px; float:left;\" src=\"/images/$client_zone/TipLogo.png\" alt=\"Splash Page: For access to the Internet.\">
+	<img style=\"height:60px; width:100px; float:left;\" src=\"/images/TipLogo.png\" alt=\"Splash Page: For access to the Internet.\">

 	<copy-right>
 		<br><br>
--- a/feeds/wlan-ap/opennds/files/lib/radius.sh
+++ b/feeds/wlan-ap/opennds/files/lib/radius.sh
@@ -302,7 +302,7 @@ header="<!DOCTYPE html>
 	<meta http-equiv=\"Expires\" content=\"0\">
 	<meta charset=\"utf-8\">
 	<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">
-	<link rel=\"shortcut icon\" href=\"/images/$client_zone/TipLogo.png\" type=\"image/x-icon\">
+	<link rel=\"shortcut icon\" href=\"/images/TipLogo.png\" type=\"image/x-icon\">
 	<link rel=\"stylesheet\" type=\"text/css\" href=\"/splash.css\">
 	<title>$gatewaynamehtml</title>
 	</head>
@@ -317,7 +317,7 @@ header="<!DOCTYPE html>
 version="$(ndsctl status | grep Version)"
 year="$(date | awk -F ' ' '{print $(6)}')"
 footer="
-	<img style=\"height:60px; width:60px; float:left;\" src=\"/images/$client_zone/TipLogo.png\" alt=\"Splash Page: For access to the Internet.\">
+	<img style=\"height:60px; width:60px; float:left;\" src=\"/images/TipLogo.png\" alt=\"Splash Page: For access to the Internet.\">
 	<copy-right>
 		<br><br>
 		openNDS $version.
--- a/feeds/wlan-ap/opennds/files/lib/splash.css
+++ b/feeds/wlan-ap/opennds/files/lib/splash.css
@@ -1,5 +1,5 @@
 body{
-        background-image:url('/images/wlan1/TipBackLogo.png');
+        background-image:url('/images/TipBackLogo.png');
        background-attachment:fixed;
        background-repeat: no-repeat;
        background-size: contain;
--- a/feeds/wlan-ap/opennds/files/lib/userpassword.sh
+++ b/feeds/wlan-ap/opennds/files/lib/userpassword.sh
@@ -48,7 +48,7 @@ validate_client() {
 	# $username, $phone, $emailaddr, $addr, $code
 	#
 	# Return either 0 if validation successful or 1 if not
-	userlist="/etc/opennds/htdocs/images/$client_zone/userpass.dat"
+	userlist="/etc/opennds/htdocs/images/userpass.dat"
 	varlist="username password firstname lastname"

 	while read user; do
@@ -282,7 +282,7 @@ header="<!DOCTYPE html>
 	<meta http-equiv=\"Expires\" content=\"0\">
 	<meta charset=\"utf-8\">
 	<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">
-	<link rel=\"shortcut icon\" href=\"/images/$client_zone/TipLogo.png\" type=\"image/x-icon\">
+	<link rel=\"shortcut icon\" href=\"/images/TipLogo.png\" type=\"image/x-icon\">
 	<link rel=\"stylesheet\" type=\"text/css\" href=\"/splash.css\">
 	<title>$gatewaynamehtml</title>
 	</head>
@@ -297,7 +297,7 @@ header="<!DOCTYPE html>
 version="$(ndsctl status | grep Version)"
 year="$(date | awk -F ' ' '{print $(6)}')"
 footer="
-	<img style=\"height:60px; width:60px; float:left;\" src=\"/images/$client_zone/TipLogo.png\" alt=\"Splash Page: For access to the Internet.\">
+	<img style=\"height:60px; width:60px; float:left;\" src=\"/images/TipLogo.png\" alt=\"Splash Page: For access to the Internet.\">
 	<copy-right>
 		<br><br>
 		openNDS $version.
--- a/feeds/wlan-ap/opensync/files/bin/wlan_ap_redirector.sh
+++ b/feeds/wlan-ap/opensync/files/bin/wlan_ap_redirector.sh
@@ -8,4 +8,5 @@ fi
 redirector_addr=$1

 uci set system.tip.redirector="${redirector_addr}"
+uci commit system
 /etc/init.d/opensync restart
--- a/feeds/wlan-ap/opensync/patches/19-passpoint-ovsschema
+++ b/feeds/wlan-ap/opensync/patches/19-passpoint-ovsschema
@@ -1,6 +1,6 @@
 --- a/interfaces/opensync.ovsschema
 +++ b/interfaces/opensync.ovsschema
-@@ -8828,6 +8828,442 @@
+@@ -8831,6 +8831,451 @@
             }
         },
         "isRoot": true
@@ -269,6 +269,15 @@
 +                    }
 +                }
 +              },
+            "access_network_type": {
+              "type": {
+                "key": {
+                  "type": "integer"
+                },
+                "min": 0,
+                "max": 1
+              }
+            },
 +            "internet": {
 +              "type": {
 +                "key": {
--- a/feeds/wlan-ap/opensync/patches/26-channel-switch-events.patch
+++ b/feeds/wlan-ap/opensync/patches/26-channel-switch-events.patch
@@ -117,7 +117,7 @@ Index: opensync-2.0.5.0/src/lib/datapipeline/src/dppline.c
 +		assert(channel_switch);
 +		sts__event_report__channel_switch_event__init(channel_switch);
 +
-+		channel_switch->band = channel_switch_rec->band;
+		channel_switch->band = dppline_to_proto_radio(channel_switch_rec->band);
 +		channel_switch->reason = channel_switch_rec->reason;
 +		channel_switch->channel = channel_switch_rec->freq;
 +		channel_switch->timestamp_ms = channel_switch_rec->timestamp;
--- a/feeds/wlan-ap/opensync/patches/29-add-max-clients.patch
+++ b/feeds/wlan-ap/opensync/patches/29-add-max-clients.patch
@@ -0,0 +1,11 @@
+--- a/src/lib/schema/inc/schema_consts.h
+++ b/src/lib/schema/inc/schema_consts.h
+@@ -176,4 +176,8 @@ typedef enum {
+ #define SCHEMA_CONSTS_MESH_HOP_PENALTY     "hop_penalty"
+ #define SCHEMA_CONSTS_MESH_MCAST_RATE      "mcast_rate"
+ #define SCHEMA_CONSTS_MESH_MTU             "mtu"
+
+/* Max clients per radio */
+#define SCHEMA_CONSTS_MAX_CLIENTS	"max_clients"
+
+ #endif /* SCHEMA_CONSTS_H_INCLUDED */
--- a/feeds/wlan-ap/opensync/patches/30-fix-ipv4-string-to-bytes-conversion
+++ b/feeds/wlan-ap/opensync/patches/30-fix-ipv4-string-to-bytes-conversion
@@ -0,0 +1,33 @@
+--- a/src/lib/datapipeline/src/dppline.c
+++ b/src/lib/datapipeline/src/dppline.c
+@@ -2147,9 +2147,11 @@ static void dppline_add_stat_events(Sts_
+ 			ipe->timestamp_ms = cs_rec->ip_event->timestamp;
+ 
+ 			if (cs_rec->ip_event->ip_addr) {
+-				ipe->ip_addr.data = malloc(16);
+-				memcpy(ipe->ip_addr.data, cs_rec->ip_event->ip_addr,16);
+-				ipe->ip_addr.len = 16;
+				uint8_t ip[IPV4_BYTES_LEN] = {0};
+				sscanf(cs_rec->ip_event->ip_addr, "%hhu.%hhu.%hhu.%hhu", &ip[0], &ip[1], &ip[2], &ip[3]);
+				ipe->ip_addr.data = malloc(IPV4_BYTES_LEN);
+				memcpy(ipe->ip_addr.data, ip, IPV4_BYTES_LEN);
+				ipe->ip_addr.len = IPV4_BYTES_LEN;
+ 				ipe->has_ip_addr = true;
+ 			}
+ 		}
+@@ -2224,10 +2226,11 @@ static void dppline_add_stat_events(Sts_
+ 			}
+ 
+ 			if (cs_rec->connect_event->ip_addr) {
+-				coe->ip_addr.data = malloc(16);
+-				memcpy(coe->ip_addr.data, cs_rec->connect_event->ip_addr,
+-				       16);
+-				coe->ip_addr.len = 16;
+				uint8_t ip[IPV4_BYTES_LEN] = {0};
+				sscanf(cs_rec->connect_event->ip_addr, "%hhu.%hhu.%hhu.%hhu", &ip[0], &ip[1], &ip[2], &ip[3]);
+				coe->ip_addr.data = malloc(IPV4_BYTES_LEN);
+				memcpy(coe->ip_addr.data, ip, IPV4_BYTES_LEN);
+				coe->ip_addr.len = IPV4_BYTES_LEN;
+ 				coe->has_ip_addr = true;
+ 			}
+ 
--- a/feeds/wlan-ap/opensync/patches/30-power-constraint-schema-consts.patch
+++ b/feeds/wlan-ap/opensync/patches/30-power-constraint-schema-consts.patch
@@ -0,0 +1,24 @@
+Index: opensync-2.0.5.0/src/lib/schema/inc/schema_consts.h
+===================================================================
+--- opensync-2.0.5.0.orig/src/lib/schema/inc/schema_consts.h
+++ opensync-2.0.5.0/src/lib/schema/inc/schema_consts.h
+@@ -142,7 +142,7 @@ typedef enum {
+ #define SCHEMA_CONSTS_INET_DHCP_LEASE_TIME  "lease_time"
+ #define SCHEMA_CONSTS_INET_DHCP_FORCE       "force"
+ 
+-/* Custom options */
+/* vif Custom options */
+ #define SCHEMA_CONSTS_RATE_LIMIT    "rate_limit_en"
+ #define SCHEMA_CONSTS_RATE_DL       "ssid_dl_limit"
+ #define SCHEMA_CONSTS_RATE_UL       "ssid_ul_limit"
+@@ -154,6 +154,10 @@ typedef enum {
+ #define SCHEMA_CONSTS_DISABLE_B_RATES	"disable_b_rates"
+ #define SCHEMA_CONSTS_IEEE80211k	"ieee80211k"
+ #define SCHEMA_CONSTS_DYNAMIC_VLAN	"dynamic_vlan"
+
+/* radio Custom options */
+#define SCHEMA_CONSTS_LOCAL_PWR_CONSTRAINT "local_pwr_constraint"
+
+ /* Captive Portal */
+ #define SCHEMA_CONSTS_SESSION_TIMEOUT              "session_timeout"
+ #define SCHEMA_CONSTS_BROWSER_TITLE                "browser_title"
--- a/feeds/wlan-ap/opensync/patches/31-adjust-log-levels.patch
+++ b/feeds/wlan-ap/opensync/patches/31-adjust-log-levels.patch
@@ -0,0 +1,89 @@
+--- a/src/lib/ovsdb/src/ovsdb_sync_api.c
+++ b/src/lib/ovsdb/src/ovsdb_sync_api.c
+@@ -492,7 +492,7 @@ int ovsdb_sync_mutate_uuid_set(const cha
+     json_t * js;
+     json_t * js_mutations;
+ 
+-    LOG(INFO, "Mutate: %s %s %d %s", table, column, op, uuid);
+    LOG(DEBUG, "Mutate: %s %s %d %s", table, column, op, uuid);
+ 
+     js = ovsdb_mutation(column,
+             ovsdb_tran_operation(op),
+--- a/src/sm/src/sm_scan_schedule.c
+++ b/src/sm/src/sm_scan_schedule.c
+@@ -230,7 +230,7 @@ bool sm_scan_schedule_process(
+                 sm_scan_schedule_cb,
+                 scan_ctx);
+     if (true != rc) {
+-        LOG(ERR,
+        LOG(DEBUG,
+             "Scheduling %s %s %d scan",
+             radio_get_name_from_type(request_ctx->radio_cfg->type),
+             radio_get_scan_name_from_type(request_ctx->scan_type),
+--- a/src/sm/src/sm_survey_report.c
+++ b/src/sm/src/sm_survey_report.c
+@@ -1004,7 +1004,7 @@ bool sm_survey_threshold_util_cb (
+ 
+     rc = sm_scan_schedule(&scan_request);
+     if (true != rc) {
+-        LOGE("Processing %s %s %d survey (Failed to schedule scan)",
+        LOGD("Processing %s %s %d survey (Failed to schedule scan)",
+              radio_get_name_from_cfg(radio_cfg_ctx),
+              radio_get_scan_name_from_type(scan_type),
+              *scan_chan);
+@@ -1153,7 +1153,7 @@ bool sm_survey_stats_update (
+ 
+     rc = sm_scan_schedule(&scan_request);
+     if (true != rc) {
+-        LOG(ERR,
+        LOG(DEBUG,
+             "Processing %s %s %d survey ",
+             radio_get_name_from_cfg(radio_cfg_ctx),
+             radio_get_scan_name_from_type(scan_type),
+--- a/src/wm2/src/wm2_radio.c
+++ b/src/wm2/src/wm2_radio.c
+@@ -517,7 +517,7 @@ wm2_radio_update_port_state_set_inactive
+ 
+ #define CMP(cmp, name) \
+     (changed |= (changedf->name = ((cmp(conf, state, name, changedf->_uuid)) && \
+-                                   (LOGI("%s: '%s' changed", conf->if_name, #name), 1))))
+                                   (LOGT("%s: '%s' changed", conf->if_name, #name), 1))))
+ 
+ static bool
+ wm2_vconf_changed(const struct schema_Wifi_VIF_Config *conf,
+@@ -559,7 +559,7 @@ wm2_vconf_changed(const struct schema_Wi
+     CMP(CHANGED_SET_CASE, captive_allowlist);
+ 
+     if (changed)
+-        LOGD("%s: changed (forced=%d)", conf->if_name, changedf->_uuid);
+        LOGT("%s: changed (forced=%d)", conf->if_name, changedf->_uuid);
+ 
+     return changed;
+ }
+@@ -597,7 +597,7 @@ wm2_rconf_changed(const struct schema_Wi
+     CMP(CHANGED_MAP_STRSTR, custom_options);
+ 
+     if (changed)
+-        LOGD("%s: changed (forced=%d)", conf->if_name, changedf->_uuid);
+        LOGT("%s: changed (forced=%d)", conf->if_name, changedf->_uuid);
+ 
+     return changed;
+ }
+@@ -1351,7 +1351,7 @@ wm2_op_vstate(const struct schema_Wifi_V
+                                   SCHEMA_COLUMN(Wifi_VIF_State, if_name),
+                                   state.if_name);
+     }
+-    LOGI("%s: updated vif state", state.if_name);
+    LOGD("%s: updated vif state", state.if_name);
+ recalc:
+     /* Reconnect workaround is for CAES-771 */
+     if (wm2_sta_has_reconnected(&oldstate, &state))
+@@ -1392,7 +1392,7 @@ wm2_op_rstate(const struct schema_Wifi_R
+     }
+ 
+     REQUIRE(state.if_name, 1 == ovsdb_table_upsert_f(&table_Wifi_Radio_State, &state, false, NULL));
+-    LOGI("%s: updated radio state", state.if_name);
+    LOGD("%s: updated radio state", state.if_name);
+     wm2_delayed_recalc(wm2_rconf_recalc, state.if_name);
+ }
+ 
--- a/feeds/wlan-ap/opensync/patches/32-noisy-logs-clean
+++ b/feeds/wlan-ap/opensync/patches/32-noisy-logs-clean
@@ -0,0 +1,349 @@
+--- a/src/sm/src/sm_client_report.c
+++ b/src/sm/src/sm_client_report.c
+@@ -792,7 +792,7 @@ bool sm_client_report_send(
+         ds_dlist_insert_tail(report_list, report_entry);
+     }
+ 
+-    LOG(INFO,
+    LOG(DEBUG,
+         "Sending %s client report at '%s'",
+         radio_get_name_from_cfg(radio_cfg_ctx),
+         sm_timestamp_ms_to_date(report_ctx->timestamp_ms));
+--- a/src/sm/src/sm_neighbor_report.c
+++ b/src/sm/src/sm_neighbor_report.c
+@@ -390,7 +390,7 @@ bool sm_neighbor_report_send_diff(
+         }
+     }
+ 
+-    LOGI("Sending %s %s neighbor report at '%s'",
+    LOGD("Sending %s %s neighbor report at '%s'",
+          radio_get_name_from_cfg(radio_cfg_ctx),
+          radio_get_scan_name_from_type(scan_type),
+          sm_timestamp_ms_to_date(report_diff.timestamp_ms));
+@@ -503,7 +503,7 @@ bool sm_neighbor_report_send_raw(
+              neighbor_entry->chan);
+     }
+ 
+-    LOGI("Sending %s %s neighbor report at '%s'",
+    LOGD("Sending %s %s neighbor report at '%s'",
+          radio_get_name_from_cfg(radio_cfg_ctx),
+          radio_get_scan_name_from_type(scan_type),
+          sm_timestamp_ms_to_date(report_ctx->timestamp_ms));
+--- a/src/sm/src/sm_capacity_report.c
+++ b/src/sm/src/sm_capacity_report.c
+@@ -288,7 +288,7 @@ bool sm_capacity_report_send(
+         }
+     }
+ 
+-    LOG(INFO,
+    LOG(DEBUG,
+         "Sending %s capacity report at '%s'",
+         radio_get_name_from_cfg(radio_cfg_ctx),
+         sm_timestamp_ms_to_date(report_ctx->timestamp_ms));
+--- a/src/sm/src/sm_device_report.c
+++ b/src/sm/src/sm_device_report.c
+@@ -219,14 +219,14 @@ void sm_device_report (EV_P_ ev_timer *w
+         request_ctx->reporting_timestamp - device_ctx->report_ts +
+         get_timestamp();
+ 
+-    LOG(INFO,
+    LOG(DEBUG,
+         "uptime=%u, mem=%u/%u, cpu=%u",
+         report_ctx->record.uptime,
+         report_ctx->record.mem_util.mem_used,
+         report_ctx->record.mem_util.mem_total,
+         report_ctx->record.cpu_util.cpu_util);
+ 
+-    LOG(INFO,
+    LOG(DEBUG,
+         "Sending device report at '%s'",
+         sm_timestamp_ms_to_date(report_ctx->timestamp_ms));
+ 
+@@ -345,7 +345,7 @@ bool sm_device_report_request(
+         memset(request_ctx, 0, sizeof(*request_ctx));
+         memset(report_ctx, 0, sizeof(*report_ctx));
+ 
+-        LOG(INFO,
+        LOG(DEBUG,
+             "Initializing device reporting");
+ 
+         /* Initialize report device temp list */
+--- a/src/sm/src/sm_network_probe_report.c
+++ b/src/sm/src/sm_network_probe_report.c
+@@ -188,7 +188,7 @@ void sm_network_probe_report (EV_P_ ev_t
+         request_ctx->reporting_timestamp - network_probe_ctx->report_ts +
+         get_timestamp();
+ 
+-    LOG(INFO,
+    LOG(DEBUG,
+         "Sending network probe report at '%s' , latency : '%d'",
+         sm_timestamp_ms_to_date(report_ctx->timestamp_ms), report_ctx->record.dns_probe.latency);
+ 
+--- a/src/sm/src/sm_rssi_report.c
+++ b/src/sm/src/sm_rssi_report.c
+@@ -514,7 +514,7 @@ bool sm_rssi_report_send(
+         }
+     }
+ 
+-    LOGI("Sending %s rssi report at '%s'",
+    LOGD("Sending %s rssi report at '%s'",
+          radio_get_name_from_cfg(radio_cfg_ctx),
+          sm_timestamp_ms_to_date(report_ctx->timestamp_ms));
+ 
+--- a/src/sm/src/sm_survey_report.c
+++ b/src/sm/src/sm_survey_report.c
+@@ -592,7 +592,7 @@ bool sm_survey_report_send(
+             goto exit;
+     }
+ 
+-    LOGI("Sending %s %s survey report at '%s'",
+    LOGD("Sending %s %s survey report at '%s'",
+          radio_get_name_from_cfg(radio_cfg_ctx),
+          radio_get_scan_name_from_type(scan_type),
+          sm_timestamp_ms_to_date(report_ctx->timestamp_ms));
+@@ -979,7 +979,7 @@ bool sm_survey_threshold_util_cb (
+          survey_ctx->threshold_count, request_ctx->radio_chan_list.chan_num);
+ 
+     if (threshold_util >= request_ctx->threshold_util) {
+-        LOGI("Skip processing %s %s survey (threshold util exceeded %d >= %d)",
+        LOGD("Skip processing %s %s survey (threshold util exceeded %d >= %d)",
+              radio_get_name_from_cfg(radio_cfg_ctx),
+              radio_get_scan_name_from_type(scan_type),
+              threshold_util,
+@@ -1103,7 +1103,7 @@ bool sm_survey_stats_update (
+             scan_interval = SURVEY_MIN_SCAN_INTERVAL;
+ 
+             // always scan if max_delay exceeded
+-            LOGI("Force processing %s %s survey delay: %ld/%d count: %d/%d",
+            LOGD("Force processing %s %s survey delay: %ld/%d count: %d/%d",
+                  radio_get_name_from_cfg(radio_cfg_ctx),
+                  radio_get_scan_name_from_type(scan_type),
+                  survey_ctx->threshold_time_delta, request_ctx->threshold_max_delay,
+@@ -1771,7 +1771,7 @@ bool sm_survey_stats_process (
+                     request_ctx->threshold_pod_num * request_ctx->sampling_interval;
+             }
+ 
+-            LOGI("Updated %s %s survey threshold_max_delay (%d + %d) * %d) -> %ds) ",
+            LOGD("Updated %s %s survey threshold_max_delay (%d + %d) * %d) -> %ds) ",
+                  radio_get_name_from_cfg(radio_cfg_ctx),
+                  radio_get_scan_name_from_type(scan_type),
+                  request_ctx->threshold_pod_num,
+@@ -1790,7 +1790,7 @@ bool sm_survey_stats_process (
+                 request_ctx->sampling_interval -
+                 (uint32_t)((request_ctx->reporting_timestamp / 1000) % request_ctx->sampling_interval);
+ 
+-            LOGI("Updated %s %s survey synchronization_delay %d - %d -> %"PRIu64"s) ",
+            LOGD("Updated %s %s survey synchronization_delay %d - %d -> %"PRIu64"s) ",
+                  radio_get_name_from_cfg(radio_cfg_ctx),
+                  radio_get_scan_name_from_type(scan_type),
+                  request_ctx->sampling_interval,
+--- a/src/wm2/src/wm2_radio.c
+++ b/src/wm2/src/wm2_radio.c
+@@ -137,7 +137,7 @@ wm2_delayed(void (*fn)(const char *ifnam
+     ev_timer_init(&i->timer, wm2_delayed_cb, seconds, 0);
+     ev_timer_start(EV_DEFAULT, &i->timer);
+     ds_dlist_insert_tail(&delayed_list, i);
+-    LOGI("%s: scheduling delayed (%us) work %s", ifname, seconds, workname);
+    LOGD("%s: scheduling delayed (%us) work %s", ifname, seconds, workname);
+ }
+ 
+ #define wm2_delayed_recalc(fn, ifname) (wm2_delayed((fn), (ifname), WM2_RECALC_DELAY_SECONDS, #fn))
+@@ -267,7 +267,7 @@ wm2_parent_change(void)
+ static void
+ wm2_dfs_disconnect_check(const char *ifname, bool force)
+ {
+-    LOGN("%s %s called", ifname, __func__);
+    LOGD("%s %s called", ifname, __func__);
+     wm2_parent_change();
+ }
+ 
+@@ -286,7 +286,7 @@ wm2_sta_has_dfs_channel(const struct sch
+         if (rstate->channel != atoi(rstate->channels_keys[i]))
+             continue;
+ 
+-        LOGI("%s: check channel %d (%d) %s", vstate->if_name, rstate->channel, vstate->channel, rstate->channels[i]);
+        LOGD("%s: check channel %d (%d) %s", vstate->if_name, rstate->channel, vstate->channel, rstate->channels[i]);
+         if (!strstr(rstate->channels[i], "allowed"))
+             status = true;
+ 
+@@ -319,7 +319,7 @@ wm2_sta_handle_dfs_link_change(const str
+ 
+     if (wm2_sta_has_disconnected(oldstate, newstate) &&
+         wm2_sta_has_dfs_channel(rstate, oldstate)) {
+-            LOGN("%s: sta: dfs: disconnected from %s - arm fallback parents timer", oldstate->if_name, oldstate->parent);
+            LOGD("%s: sta: dfs: disconnected from %s - arm fallback parents timer", oldstate->if_name, oldstate->parent);
+             wm2_timer(wm2_dfs_disconnect_check, oldstate->if_name, WM2_DFS_FALLBACK_GRACE_PERIOD_SECONDS);
+     }
+ }
+@@ -923,13 +923,13 @@ wm2_vconf_recalc(const char *ifname, boo
+ 
+     wm2_radio_update_port_state(vconf.if_name);
+ 
+-    LOGI("%s@%s: changed, configuring", ifname, rconf.if_name);
+    LOGD("%s@%s: changed, configuring", ifname, rconf.if_name);
+ 
+     if (vchanged.parent)
+-        LOGN("%s: topology change: parent '%s' -> '%s'", ifname, vstate.parent, vconf.parent);
+        LOGD("%s: topology change: parent '%s' -> '%s'", ifname, vstate.parent, vconf.parent);
+ 
+     if (vchanged.ssid && strlen(vconf.ssid) > 0 && !strcmp(vconf.mode, "sta"))
+-        LOGN("%s: topology change: ssid '%s' -> '%s'", ifname, vstate.ssid, vconf.ssid);
+        LOGD("%s: topology change: ssid '%s' -> '%s'", ifname, vstate.ssid, vconf.ssid);
+ 
+     if (!target_vif_config_set2(&vconf, &rconf, cconfs, &vchanged, num_cconfs)) {
+         LOGW("%s: failed to configure, will retry later", ifname);
+@@ -1047,7 +1047,7 @@ wm2_rconf_recalc_fixup_channel(struct sc
+      * i.e. when radio_config channel is more important than
+      * sta vif channel in cases of sta csa, sta (re)assoc.
+      */
+-    LOGN("%s: ignoring channel change %d -> %d because sta vif %s is connected on %d, see CAES-600",
+    LOGD("%s: ignoring channel change %d -> %d because sta vif %s is connected on %d, see CAES-600",
+             rconf->if_name, rstate->channel, rconf->channel,
+             vstate.if_name, vstate.channel);
+     rconf->channel = vstate.channel;
+@@ -1146,10 +1146,10 @@ wm2_rconf_recalc(const char *ifname, boo
+     if (!wm2_rconf_changed(&rconf, &rstate, &changed) && !force)
+         goto recalc;
+ 
+-    LOGI("%s: changed, configuring", ifname);
+    LOGD("%s: changed, configuring", ifname);
+ 
+     if ((changed.channel || changed.ht_mode) && rconf.channel) {
+-        LOGN("%s: topology change: channel %d @ %s -> %d @ %s",
+        LOGD("%s: topology change: channel %d @ %s -> %d @ %s",
+              ifname,
+              rstate.channel, rstate.ht_mode,
+              rconf.channel, rconf.ht_mode);
+@@ -1183,7 +1183,7 @@ wm2_op_vconf(const struct schema_Wifi_VI
+     memcpy(&tmp, vconf, sizeof(tmp));
+     memset(&rconf, 0, sizeof(rconf));
+ 
+-    LOGI("%s @ %s: updating vconf", vconf->if_name, phy);
+    LOGD("%s @ %s: updating vconf", vconf->if_name, phy);
+     REQUIRE(vconf->if_name, strlen(vconf->if_name) > 0);
+     REQUIRE(vconf->if_name, vconf->_partial_update);
+     if (!(where = ovsdb_where_simple(SCHEMA_COLUMN(Wifi_Radio_Config, if_name), phy)))
+@@ -1203,7 +1203,7 @@ wm2_op_vconf(const struct schema_Wifi_VI
+                                                            SCHEMA_TABLE(Wifi_Radio_Config),
+                                                            where,
+                                                            SCHEMA_COLUMN(Wifi_Radio_Config, vif_configs)));
+-    LOGI("%s @ %s: updated vconf", vconf->if_name, phy);
+    LOGD("%s @ %s: updated vconf", vconf->if_name, phy);
+     wm2_delayed_recalc(wm2_vconf_recalc, vconf->if_name);
+ }
+ 
+@@ -1212,14 +1212,14 @@ wm2_op_rconf(const struct schema_Wifi_Ra
+ {
+     struct schema_Wifi_Radio_Config tmp;
+     memcpy(&tmp, rconf, sizeof(tmp));
+-    LOGI("%s: updating rconf", rconf->if_name);
+    LOGD("%s: updating rconf", rconf->if_name);
+     REQUIRE(rconf->if_name, strlen(rconf->if_name) > 0);
+     REQUIRE(rconf->if_name, rconf->_partial_update);
+     OVERRIDE(rconf->if_name, tmp.vif_configs_present, false);
+     tmp.vif_configs_len = 0;
+     tmp.vif_configs_present = true;
+     REQUIRE(rconf->if_name, 1 == ovsdb_table_upsert_f(&table_Wifi_Radio_Config, &tmp, false, NULL));
+-    LOGI("%s: updated rconf", rconf->if_name);
+    LOGD("%s: updated rconf", rconf->if_name);
+     wm2_delayed_recalc(wm2_rconf_recalc, rconf->if_name);
+ }
+ 
+--- a/src/xm/src/xm_ovsdb.c
+++ b/src/xm/src/xm_ovsdb.c
+@@ -91,7 +91,7 @@ static bool xm_device_info_update(const
+ 
+     if (ovsdb_table_upsert_f(&table_AWLAN_Node, &node, false, NULL))
+     {
+-        LOGI("External: Updated device info");
+        LOGD("External: Updated device info");
+     }
+     else
+     {
+@@ -127,7 +127,7 @@ static bool xm_mode_update(const connect
+ 
+     if (ovsdb_table_upsert_f(&table_AWLAN_Node, &node, false, NULL))
+     {
+-        LOGI("External: Updated device mode");
+        LOGD("External: Updated device mode");
+     }
+     else
+     {
+@@ -150,7 +150,7 @@ static bool xm_address_update(const char
+     SCHEMA_SET_STR(node.redirector_addr, cloud_address);
+     if (ovsdb_table_upsert_f(&table_AWLAN_Node, &node, false, NULL))
+     {
+-        LOGI("External: Updated cloud address");
+        LOGD("External: Updated cloud address");
+     }
+     else
+     {
+@@ -165,11 +165,11 @@ static bool xm_radio_update(const struct
+     struct schema_Wifi_Radio_Config tmp;
+ 
+     memcpy(&tmp, rconf, sizeof(tmp));
+-    LOGI("External: Updating radio %s (partial %d)", tmp.if_name, rconf->_partial_update);
+    LOGD("External: Updating radio %s (partial %d)", tmp.if_name, rconf->_partial_update);
+     REQUIRE(rconf->if_name, strlen(rconf->if_name) > 0);
+     tmp.vif_configs_present = false;
+     REQUIRE(rconf->if_name, 1 == ovsdb_table_upsert_f(&table_Wifi_Radio_Config, &tmp, false, NULL));
+-    LOGI("External: Update radio %s", tmp.if_name);
+    LOGD("External: Update radio %s", tmp.if_name);
+ 
+     return true;
+ }
+@@ -181,10 +181,10 @@ static bool xm_vif_update(const struct s
+     json_t *where;
+ 
+     memcpy(&tmp, vconf, sizeof(tmp));
+-    LOGI("External: Updating vif %s @ %s (partial %d)", vconf->if_name, radio_ifname, vconf->_partial_update);
+    LOGD("External: Updating vif %s @ %s (partial %d)", vconf->if_name, radio_ifname, vconf->_partial_update);
+     REQUIRE(vconf->if_name, strlen(vconf->if_name) > 0);
+     if (!(where = ovsdb_where_simple(SCHEMA_COLUMN(Wifi_Radio_Config, if_name), radio_ifname))){
+-        LOGI("External: Updating vif %s @ %s (no radio found)", vconf->if_name, radio_ifname);
+        LOGD("External: Updating vif %s @ %s (no radio found)", vconf->if_name, radio_ifname);
+         return false;
+     }
+     REQUIRE(vconf->if_name,
+@@ -198,7 +198,7 @@ static bool xm_vif_update(const struct s
+                     where,
+                     SCHEMA_COLUMN(Wifi_Radio_Config, vif_configs))
+     );
+-    LOGI("External: Update vif %s @ %s", vconf->if_name, radio_ifname);
+    LOGD("External: Update vif %s @ %s", vconf->if_name, radio_ifname);
+ 
+     return true;
+ }
+@@ -208,10 +208,10 @@ static bool xm_inet_update(const struct
+     struct schema_Wifi_Inet_Config tmp;
+ 
+     memcpy(&tmp, iconf, sizeof(tmp));
+-    LOGI("External: Updating inet %s (partial %d)", tmp.if_name, iconf->_partial_update);
+    LOGD("External: Updating inet %s (partial %d)", tmp.if_name, iconf->_partial_update);
+     REQUIRE(iconf->if_name, strlen(iconf->if_name) > 0);
+     REQUIRE(iconf->if_name, 1 == ovsdb_table_upsert_f(&table_Wifi_Inet_Config, &tmp, false, NULL));
+-    LOGI("External: Update inet %s", tmp.if_name);
+    LOGD("External: Update inet %s", tmp.if_name);
+ 
+     return true;
+ }
+--- a/src/qm/src/qm_mqtt.c
+++ b/src/qm/src/qm_mqtt.c
+@@ -221,7 +221,7 @@ bool qm_mqtt_publish(mosqev_t *mqtt, qm_
+         mlen = len;
+         mbuf = buf;
+     }
+-    LOGI("MQTT: Publishing %ld bytes", mlen);
+    LOGD("MQTT: Publishing %ld bytes", mlen);
+     ret = mosqev_publish(mqtt, NULL, topic, mlen, mbuf, qos, false);
+ exit:
+     if (buf) free(buf);
+@@ -314,7 +314,7 @@ first:
+         void *buf = malloc(size);
+         if (!buf) goto out;
+         size = sts__report__pack(rpt, buf);
+-        LOGI("merged reports stats %zd + %zd = %d", rep->size, qi->size, size);
+        LOGD("merged reports stats %zd + %zd = %d", rep->size, qi->size, size);
+ 
+         // replace message
+         if(rep->buf) free(rep->buf);
--- a/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/inc/captive.h
+++ b/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/inc/captive.h
@@ -8,7 +8,7 @@ extern struct blob_buf c;
 extern struct schema_Wifi_VIF_State vstate;
 extern const struct schema_Wifi_VIF_Config *vconf;
 extern void vif_captive_portal_set (const struct schema_Wifi_VIF_Config *vconf, char *ifname);
-extern void vif_state_captive_portal_options_get(struct schema_Wifi_VIF_State *vstate, struct uci_section *s);
+extern void vif_state_captive_portal_options_get(struct schema_Wifi_VIF_State *vstate);
 extern void captive_portal_init();
 extern void splash_page_logo(char* dest_file,char* src_url);
 extern void vif_dhcp_opennds_allowlist_set(const struct schema_Wifi_VIF_Config *vconf, char *ifname);
--- a/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/inc/nl80211.h
+++ b/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/inc/nl80211.h
@@ -26,6 +26,7 @@ struct wifi_phy {
 	unsigned int chanpwr[IEEE80211_CHAN_MAX];
 	unsigned int freq[IEEE80211_CHAN_MAX];

+	int current_channel;
 	int tx_ant, rx_ant, tx_ant_avail, rx_ant_avail;
 	int band_2g, band_5gl, band_5gu;
 };
@@ -56,7 +57,6 @@ struct wifi_station {
 };

 extern int radio_nl80211_init(void);
-
 extern struct wifi_phy *phy_find(const char *name);
 extern struct wifi_iface *vif_find(const char *name);
 extern struct wifi_station *sta_find(const unsigned char *addr);
--- a/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/inc/phy.h
+++ b/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/inc/phy.h
@@ -12,11 +12,11 @@ extern int phy_get_tx_available_antenna(const char *name);
 extern int phy_get_rx_available_antenna(const char *name);
 extern int phy_get_max_tx_power(const char *name , int channel);
 extern int phy_get_channels(const char *name, int *channel);
-extern int phy_get_list_channels_dfs(const char *name, int *list);
 extern int phy_get_channels_state(const char *name,
 			struct schema_Wifi_Radio_State *rstate);
 extern int phy_get_band(const char *name, char *band);
 extern int phy_is_ready(const char *name);
 extern int phy_lookup(char *name);
+extern int get_current_channel(char *name);

 #endif
--- a/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/inc/rrm_config.h
+++ b/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/inc/rrm_config.h
@@ -33,6 +33,7 @@ extern ovsdb_table_t table_Wifi_RRM_Config;

 void rrm_config_vif(struct blob_buf *b, struct blob_buf *del, 
 		const char * freq_band, const char * if_name);
+int rrm_get_backup_channel(const char * freq_band);
 void callback_Wifi_RRM_Config(ovsdb_update_monitor_t *mon,
 		struct schema_Wifi_RRM_Config *old, struct schema_Wifi_RRM_Config *conf);

--- a/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/inc/vif.h
+++ b/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/inc/vif.h
@@ -29,6 +29,7 @@

 #define SCHEMA_CONSTS_RADIUS_NAS_ID         "radius_nas_id"
 #define SCHEMA_CONSTS_RADIUS_OPER_NAME      "radius_oper_name"
+#define SCHEMA_CONSTS_RADIUS_NAS_IP         "radius_nas_ip"

 bool vif_get_security(struct schema_Wifi_VIF_State *vstate, char *mode, char *encryption, char *radiusServerIP, char *password, char *port);
 extern bool vif_state_update(struct uci_section *s, struct schema_Wifi_VIF_Config *vconf);
--- a/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/src/captive.c
+++ b/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/src/captive.c
@@ -143,7 +143,7 @@ void vif_state_dhcp_allowlist_get(struct schema_Wifi_VIF_State *vstate)
 	uci_load(dns, "dhcp", &dhcp);
 	ip_section = uci_lookup_section(dns, dhcp,"dnsmasq");
 	if(!ip_section) {
-		LOGN("Section Not Found");
+		uci_unload(dns, dhcp);
 		return;
 	}
 	blob_buf_init(&dnsmas, 0);
@@ -158,7 +158,7 @@ void vif_state_dhcp_allowlist_get(struct schema_Wifi_VIF_State *vstate)
 			if (blobmsg_type(cur) != BLOBMSG_TYPE_STRING)
 				continue;
 			sscanf(blobmsg_get_string(cur), "/%[^/]/%[^_]_%s", fqdn, set, read_ifname);
-			if(!strcmp(vstate->if_name, read_ifname))
+			if(!strcmp("opennds", read_ifname))
 			{
 				strcpy(vstate->captive_allowlist[vstate->captive_allowlist_len], fqdn);
 				vstate->captive_allowlist_len++;
@@ -171,10 +171,8 @@ void vif_state_dhcp_allowlist_get(struct schema_Wifi_VIF_State *vstate)

 void ipset_flush(char *ifname)
 {
-	char com[24]="ipset flush set_wlan1";
-
-	if (!strcmp(ifname,"wlan1"))
-		system(com);
+	char com[32]="ipset flush set_opennds";
+	system(com);
 }

 void vif_dhcp_opennds_allowlist_set(const struct schema_Wifi_VIF_Config *vconf, char *ifname)
@@ -189,7 +187,7 @@ void vif_dhcp_opennds_allowlist_set(const struct schema_Wifi_VIF_Config *vconf,
 	for (i = 0; i < vconf->captive_allowlist_len; i++)
 	{
 		strcpy(buff,(char*)vconf->captive_allowlist[i]);
-		sprintf(ips,"/%s/set_%s", buff,ifname);
+		sprintf(ips,"/%s/set_%s", buff,"opennds");
 		blobmsg_add_string(&dnsmas, NULL,ips);
 	}
 	blobmsg_close_array(&dnsmas, e);
@@ -228,134 +226,133 @@ void set_captive_portal_state(struct schema_Wifi_VIF_State *vstate,
 	return;
 }

-void vif_state_captive_portal_options_get(struct schema_Wifi_VIF_State *vstate, struct uci_section *s)
+void vif_state_captive_portal_options_get(struct schema_Wifi_VIF_State *vstate)
 {
 	int i;
 	int index = 0;
 	const char *opt;
 	char *buf = NULL;
 	struct blob_attr *tc[__NDS_ATTR_MAX] = { };
-	struct uci_element *e = NULL;
+	struct uci_section *cp_section;

 	uci_load(cap_uci, "opennds", &opennds);
-	uci_foreach_element(&opennds->sections, e) {
-		struct uci_section *cp_section = uci_to_section(e);
-		if (!strcmp(s->e.name, cp_section->e.name)){
+	cp_section = uci_lookup_section(cap_uci, opennds,"opennds");
+	if(!cp_section) {
+		uci_unload(cap_uci, opennds);
+		return;
+	}
+	blob_buf_init(&cap, 0);
+	uci_to_blob(&cap, cp_section, &opennds_param);
+	blobmsg_parse(opennds_policy, __NDS_ATTR_MAX, tc, blob_data(cap.head), blob_len(cap.head));
+	for (i = 0; i < SCHEMA_CAPTIVE_PORTAL_OPTS_MAX; i++) {
+		opt = captive_portal_options_table[i];
+		if  (!strcmp(opt, "session_timeout"))
+		{
+			if (tc[NDS_ATTR_SESSIONTIMEOUT])
+			{
+				buf = blobmsg_get_string(tc[NDS_ATTR_SESSIONTIMEOUT]);
+				set_captive_portal_state(vstate, &index,
+						captive_portal_options_table[i],
+						buf);
+			}
+		} else if (!strcmp(opt, "authentication")) {
+			if(tc[NDS_ATTR_AUTHENTICATION]) {
+				buf = blobmsg_get_string(tc[NDS_ATTR_AUTHENTICATION]);
+				if (!strcmp(buf, "None")) {

-			blob_buf_init(&cap, 0);
-			uci_to_blob(&cap, cp_section, &opennds_param);
-			blobmsg_parse(opennds_policy, __NDS_ATTR_MAX, tc, blob_data(cap.head), blob_len(cap.head));
-			for (i = 0; i < SCHEMA_CAPTIVE_PORTAL_OPTS_MAX; i++) {
-				opt = captive_portal_options_table[i];
-				if  (!strcmp(opt, "session_timeout"))
-				{
-					if (tc[NDS_ATTR_SESSIONTIMEOUT])
-					{
-						buf = blobmsg_get_string(tc[NDS_ATTR_SESSIONTIMEOUT]);
-						set_captive_portal_state(vstate, &index,
-								captive_portal_options_table[i],
-								buf);
-					}
-				} else if (!strcmp(opt, "authentication")) {
-					if(tc[NDS_ATTR_AUTHENTICATION]) {
-						buf = blobmsg_get_string(tc[NDS_ATTR_AUTHENTICATION]);
-						if (!strcmp(buf, "None")) {
-
-							set_captive_portal_state(vstate, &index,
-									captive_portal_options_table[i],
-									buf);
-						} else if (!strcmp(buf,"username")) {
-							set_captive_portal_state(vstate, &index,
-									captive_portal_options_table[i],
-									buf);
-						}
-					}
-				} else if (strcmp(opt, "browser_title") == 0) {
-					if (tc[NDS_ATTR_GATEWAYNAME]) {
-						buf = blobmsg_get_string(tc[NDS_ATTR_GATEWAYNAME]);
-						set_captive_portal_state(vstate, &index,
-								captive_portal_options_table[i],
-								buf);
-					}
-				} else if (strcmp(opt, "splash_page_logo") == 0) {
-					if (tc[NDS_ATTR_SPLASH_PAGE_LOGO]) {
-						buf = blobmsg_get_string(tc[NDS_ATTR_SPLASH_PAGE_LOGO]);
-						set_captive_portal_state(vstate, &index,
-								captive_portal_options_table[i],
-								buf);
-					}
-				} else if (strcmp(opt, "splash_page_background_logo") == 0) {
-					if (tc[NDS_ATTR_PAGE_BACKGROUND_LOGO]) {
-						buf = blobmsg_get_string(tc[NDS_ATTR_PAGE_BACKGROUND_LOGO]);
-						set_captive_portal_state(vstate, &index,
-								captive_portal_options_table[i],
-								buf);
-					}
-				} else if (strcmp(opt, "splash_page_title") == 0) {
-					if (tc[NDS_ATTR_SPLASH_PAGE_TITLE]) {
-						buf = blobmsg_get_string(tc[NDS_ATTR_SPLASH_PAGE_TITLE]);
-						set_captive_portal_state(vstate, &index,
-								captive_portal_options_table[i],
-								buf);
-					}
-				} else if (strcmp(opt, "redirect_url") == 0) {
-					if (tc[NDS_ATTR_REDIRECT_URL]) {
-						buf = blobmsg_get_string(tc[NDS_ATTR_REDIRECT_URL]);
-						set_captive_portal_state(vstate, &index,
-								captive_portal_options_table[i],
-								buf);
-					}
-				} else if (strcmp(opt, "acceptance_policy") == 0) {
-					if (tc[NDS_ATTR_ACCEPTANCE_POLICY]) {
-						buf = blobmsg_get_string(tc[NDS_ATTR_ACCEPTANCE_POLICY]);
-						set_captive_portal_state(vstate, &index,
-								captive_portal_options_table[i],
-								buf);
-					}
-				} else if (strcmp(opt, "login_success_text") == 0) {
-					if (tc[NDS_ATTR_LOGIN_SUCCESS_TEXT]) {
-						buf = blobmsg_get_string(tc[NDS_ATTR_LOGIN_SUCCESS_TEXT]);
-						set_captive_portal_state(vstate, &index,
-								captive_portal_options_table[i],
-								buf);
-					}
-				} else if (strcmp(opt, "username_password_file") == 0) {
-					if (tc[NDS_ATTR_USERNAMEPASS_FILE]) {
-						buf = blobmsg_get_string(tc[NDS_ATTR_USERNAMEPASS_FILE]);
-						set_captive_portal_state(vstate, &index,
-								captive_portal_options_table[i],
-								buf);
-					}
-				} else if (strcmp(opt, "radius_server_ip") == 0) {
-					if (tc[NDS_ATTR_RADIUS_IP]) {
-						buf = blobmsg_get_string(tc[NDS_ATTR_RADIUS_IP]);
-						set_captive_portal_state(vstate, &index,
-								captive_portal_options_table[i],
-								buf);
-					}
-				} else if (strcmp(opt, "radius_server_port") == 0) {
-					if (tc[NDS_ATTR_RADIUS_PORT]) {
-						buf = blobmsg_get_string(tc[NDS_ATTR_RADIUS_PORT]);
-						set_captive_portal_state(vstate, &index,
-								captive_portal_options_table[i],
-								buf);
-					}
-				} else if (strcmp(opt, "radius_server_secret") == 0) {
-					if (tc[NDS_ATTR_RADIUS_SECRET]) {
-						buf = blobmsg_get_string(tc[NDS_ATTR_RADIUS_SECRET]);
-						set_captive_portal_state(vstate, &index,
-								captive_portal_options_table[i],
-								buf);
-					}
-				} else if (strcmp(opt, "radius_auth_type") == 0) {
-					if (tc[NDS_ATTR_RADIUS_AUTH_TYPE]) {
-						buf = blobmsg_get_string(tc[NDS_ATTR_RADIUS_AUTH_TYPE]);
-						set_captive_portal_state(vstate, &index,
-								captive_portal_options_table[i],
-								buf);
-					}
+					set_captive_portal_state(vstate, &index,
+							captive_portal_options_table[i],
+							buf);
+				} else if (!strcmp(buf,"username")) {
+					set_captive_portal_state(vstate, &index,
+							captive_portal_options_table[i],
+							buf);
 				}
 			}
+		} else if (strcmp(opt, "browser_title") == 0) {
+			if (tc[NDS_ATTR_GATEWAYNAME]) {
+				buf = blobmsg_get_string(tc[NDS_ATTR_GATEWAYNAME]);
+				set_captive_portal_state(vstate, &index,
+						captive_portal_options_table[i],
+						buf);
+			}
+		} else if (strcmp(opt, "splash_page_logo") == 0) {
+			if (tc[NDS_ATTR_SPLASH_PAGE_LOGO]) {
+				buf = blobmsg_get_string(tc[NDS_ATTR_SPLASH_PAGE_LOGO]);
+				set_captive_portal_state(vstate, &index,
+						captive_portal_options_table[i],
+						buf);
+			}
+		} else if (strcmp(opt, "splash_page_background_logo") == 0) {
+			if (tc[NDS_ATTR_PAGE_BACKGROUND_LOGO]) {
+				buf = blobmsg_get_string(tc[NDS_ATTR_PAGE_BACKGROUND_LOGO]);
+				set_captive_portal_state(vstate, &index,
+						captive_portal_options_table[i],
+						buf);
+			}
+		} else if (strcmp(opt, "splash_page_title") == 0) {
+			if (tc[NDS_ATTR_SPLASH_PAGE_TITLE]) {
+				buf = blobmsg_get_string(tc[NDS_ATTR_SPLASH_PAGE_TITLE]);
+				set_captive_portal_state(vstate, &index,
+						captive_portal_options_table[i],
+						buf);
+			}
+		} else if (strcmp(opt, "redirect_url") == 0) {
+			if (tc[NDS_ATTR_REDIRECT_URL]) {
+				buf = blobmsg_get_string(tc[NDS_ATTR_REDIRECT_URL]);
+				set_captive_portal_state(vstate, &index,
+						captive_portal_options_table[i],
+						buf);
+			}
+		} else if (strcmp(opt, "acceptance_policy") == 0) {
+			if (tc[NDS_ATTR_ACCEPTANCE_POLICY]) {
+				buf = blobmsg_get_string(tc[NDS_ATTR_ACCEPTANCE_POLICY]);
+				set_captive_portal_state(vstate, &index,
+						captive_portal_options_table[i],
+						buf);
+			}
+		} else if (strcmp(opt, "login_success_text") == 0) {
+			if (tc[NDS_ATTR_LOGIN_SUCCESS_TEXT]) {
+				buf = blobmsg_get_string(tc[NDS_ATTR_LOGIN_SUCCESS_TEXT]);
+				set_captive_portal_state(vstate, &index,
+						captive_portal_options_table[i],
+						buf);
+			}
+		} else if (strcmp(opt, "username_password_file") == 0) {
+			if (tc[NDS_ATTR_USERNAMEPASS_FILE]) {
+				buf = blobmsg_get_string(tc[NDS_ATTR_USERNAMEPASS_FILE]);
+				set_captive_portal_state(vstate, &index,
+						captive_portal_options_table[i],
+						buf);
+			}
+		} else if (strcmp(opt, "radius_server_ip") == 0) {
+			if (tc[NDS_ATTR_RADIUS_IP]) {
+				buf = blobmsg_get_string(tc[NDS_ATTR_RADIUS_IP]);
+				set_captive_portal_state(vstate, &index,
+						captive_portal_options_table[i],
+						buf);
+			}
+		} else if (strcmp(opt, "radius_server_port") == 0) {
+			if (tc[NDS_ATTR_RADIUS_PORT]) {
+				buf = blobmsg_get_string(tc[NDS_ATTR_RADIUS_PORT]);
+				set_captive_portal_state(vstate, &index,
+						captive_portal_options_table[i],
+						buf);
+			}
+		} else if (strcmp(opt, "radius_server_secret") == 0) {
+			if (tc[NDS_ATTR_RADIUS_SECRET]) {
+				buf = blobmsg_get_string(tc[NDS_ATTR_RADIUS_SECRET]);
+				set_captive_portal_state(vstate, &index,
+						captive_portal_options_table[i],
+						buf);
+			}
+		} else if (strcmp(opt, "radius_auth_type") == 0) {
+			if (tc[NDS_ATTR_RADIUS_AUTH_TYPE]) {
+				buf = blobmsg_get_string(tc[NDS_ATTR_RADIUS_AUTH_TYPE]);
+				set_captive_portal_state(vstate, &index,
+						captive_portal_options_table[i],
+						buf);
+			}
 		}
 	}
 uci_unload(cap_uci, opennds);
@@ -415,7 +412,6 @@ void splash_page_logo(char* dest_file, char* src_url)

 	res = curl_easy_perform(curl);
 	if (res != CURLE_OK){
-		LOGN("Image failed to Download: %s",errbuf);
 		clean_up(curl,imagefile,headerfile);
 		remove(dest_file);
 		return;
@@ -424,10 +420,10 @@ void splash_page_logo(char* dest_file, char* src_url)
 	return ;
 }

-int ipset_create(char *ifname)
+int ipset_create(char *ifnds)
 {
 	char command[64];
-	sprintf(command,"ipset create set_%s hash:ip", ifname);
+	sprintf(command,"ipset create set_%s hash:ip", ifnds);
 	return (system(command));
 }

@@ -435,69 +431,74 @@ void captive_portal_get_current_urls(char *ifname, char *splash_logo, char *back
 {
 	char *buf = NULL;
 	struct blob_attr *tc[__NDS_ATTR_MAX] = { };
-	struct uci_element *e = NULL;
+	struct blob_buf url_buf={ };
+	struct uci_section *cp_section;

 	uci_load(cap_uci, "opennds", &opennds);
-	uci_foreach_element(&opennds->sections, e) {
-		struct uci_section *cp_section = uci_to_section(e);
-		if (!strcmp(ifname, cp_section->e.name)){
+	cp_section = uci_lookup_section(cap_uci, opennds,"opennds");
+	if(!cp_section) {
+		uci_unload(cap_uci, opennds);
+		return;
+	}

-			blob_buf_init(&cap, 0);
-			uci_to_blob(&cap, cp_section, &opennds_param);
-			blobmsg_parse(opennds_policy, __NDS_ATTR_MAX, tc, blob_data(cap.head), blob_len(cap.head));
+	blob_buf_init(&url_buf, 0);
+	uci_to_blob(&url_buf, cp_section, &opennds_param);
+	blobmsg_parse(opennds_policy, __NDS_ATTR_MAX, tc, blob_data(url_buf.head), blob_len(url_buf.head));

-			if (tc[NDS_ATTR_SPLASH_PAGE_LOGO]) {
-				buf = blobmsg_get_string(tc[NDS_ATTR_SPLASH_PAGE_LOGO]);
-				strcpy(splash_logo, buf);
-			} else {
-				splash_logo[0]=0;
-			}
+	if (tc[NDS_ATTR_SPLASH_PAGE_LOGO]) {
+		buf = blobmsg_get_string(tc[NDS_ATTR_SPLASH_PAGE_LOGO]);
+		strcpy(splash_logo, buf);
+	} else {
+		splash_logo[0]=0;
+	}

-			if (tc[NDS_ATTR_PAGE_BACKGROUND_LOGO]) {
-				buf = blobmsg_get_string(tc[NDS_ATTR_PAGE_BACKGROUND_LOGO]);
-				strcpy(back_image, buf);
-			} else {
-				back_image[0]=0;
-			}
-			if (tc[NDS_ATTR_USERNAMEPASS_FILE]) {
-				buf = blobmsg_get_string(tc[NDS_ATTR_USERNAMEPASS_FILE]);
-				strcpy(user_file, buf);
-			} else {
-				user_file[0]=0;
-			}
-		}
+	if (tc[NDS_ATTR_PAGE_BACKGROUND_LOGO]) {
+		buf = blobmsg_get_string(tc[NDS_ATTR_PAGE_BACKGROUND_LOGO]);
+		strcpy(back_image, buf);
+	} else {
+		back_image[0]=0;
+	}
+	if (tc[NDS_ATTR_USERNAMEPASS_FILE]) {
+		buf = blobmsg_get_string(tc[NDS_ATTR_USERNAMEPASS_FILE]);
+		strcpy(user_file, buf);
+	} else {
+		user_file[0]=0;
 	}
 	uci_unload(cap_uci, opennds);
 	return;
 }
-void opennds_parameters()
+void opennds_parameters(char *ifname)
 {
 	int i;
 	char users_router[7][64] = { "allow tcp port 53","allow udp port 53",
 				"allow udp port 67","allow tcp port 22",
 				"allow tcp port 23", "allow tcp port 80", "allow tcp port 443"};
+	struct blob_buf cap_blob={ };
+	blob_buf_init(&cap_blob, 0);

-	blobmsg_add_string(&cap, "fwhook_enabled","1");
-	blobmsg_add_string(&cap, "use_outdated_mhd","1");
-	blobmsg_add_string(&cap, "unescape_callback_enabled","0");
-	blobmsg_add_string(&cap, "maxclients","250");
-	blobmsg_add_string(&cap, "preauthidletimeout","30");
-	blobmsg_add_string(&cap, "authidletimeout","120");
-	blobmsg_add_string(&cap, "checkinterval","60");
-	blobmsg_add_string(&cap, "uploadrate","0");
-	blobmsg_add_string(&cap, "downloadrate","0");
-	blobmsg_add_string(&cap, "ratecheckwindow","2");
-	blobmsg_add_string(&cap, "uploadquota","0");
-	blobmsg_add_string(&cap, "downloadquota","0");
-	d = blobmsg_open_array(&cap, "authenticated_users");
-	blobmsg_add_string(&cap, NULL, "allow all");
-	blobmsg_close_array(&cap, d);
-	d = blobmsg_open_array(&cap, "users_to_router");
+	blobmsg_add_string(&cap_blob, "fwhook_enabled","1");
+	blobmsg_add_string(&cap_blob, "use_outdated_mhd","1");
+	blobmsg_add_string(&cap_blob, "unescape_callback_enabled","0");
+	blobmsg_add_string(&cap_blob, "maxclients","250");
+	blobmsg_add_string(&cap_blob, "preauthidletimeout","30");
+	blobmsg_add_string(&cap_blob, "authidletimeout","120");
+	blobmsg_add_string(&cap_blob, "checkinterval","60");
+	blobmsg_add_string(&cap_blob, "uploadrate","0");
+	blobmsg_add_string(&cap_blob, "downloadrate","0");
+	blobmsg_add_string(&cap_blob, "ratecheckwindow","2");
+	blobmsg_add_string(&cap_blob, "uploadquota","0");
+	blobmsg_add_string(&cap_blob, "downloadquota","0");
+	d = blobmsg_open_array(&cap_blob, "authenticated_users");
+	blobmsg_add_string(&cap_blob, NULL, "allow all");
+	blobmsg_close_array(&cap_blob, d);
+	d = blobmsg_open_array(&cap_blob, "users_to_router");
 	for(i = 0; i < 7; i++)
 	{
-		blobmsg_add_string(&cap, NULL, users_router[i]);
+		blobmsg_add_string(&cap_blob, NULL, users_router[i]);
 	}
-	blobmsg_close_array(&cap, d);
+	blobmsg_close_array(&cap_blob, d);
+	blob_to_uci_section(cap_uci, "opennds", "opennds", "opennds", cap_blob.head, &opennds_param, NULL);
+	uci_commit_all(cap_uci);
 	return;
 }

@@ -541,10 +542,10 @@ void vif_captive_portal_set(const struct schema_Wifi_VIF_Config *vconf, char *if
 	char back_image[84];
 	char user_file[84];

-	sprintf(path,"/etc/opennds/htdocs/images/%s/",ifname);
+	sprintf(path,"/etc/opennds/htdocs/images/");
 	sprintf(webroot,"/etc/opennds/htdocs");
-	sprintf(ipset_tcp80,"allow tcp port 80 ipset set_%s", ifname);
-	sprintf(ipset_tcp443,"allow tcp port 443 ipset set_%s", ifname);
+	sprintf(ipset_tcp80,"allow tcp port 80 ipset set_opennds");
+	sprintf(ipset_tcp443,"allow tcp port 443 ipset set_opennds");
 	char file_path[128];
 	struct stat st = {0};
 	if (stat(path, &st) == -1)
@@ -564,12 +565,12 @@ void vif_captive_portal_set(const struct schema_Wifi_VIF_Config *vconf, char *if
 		if (!strcmp(opt, "authentication")) {
 			if (strcmp(value,"None")==0) {
 				blobmsg_add_string(&cap, "webroot",webroot);
-				opennds_parameters();
+				opennds_parameters(ifname);
 				blobmsg_add_string(&cap, "enabled", "1");
 				blobmsg_add_string(&cap, "gatewayinterface","br-lan");
 				blobmsg_add_string(&cap, "authentication", value);
 				blobmsg_add_string(&cap, "preauth","/usr/lib/opennds/login.sh");
-				ipset_create(ifname);
+				ipset_create("opennds");
 				d = blobmsg_open_array(&cap, "preauthenticated_users");
 				blobmsg_add_string(&cap, NULL, ipset_tcp80);
 				blobmsg_add_string(&cap, NULL, ipset_tcp443);
@@ -577,8 +578,8 @@ void vif_captive_portal_set(const struct schema_Wifi_VIF_Config *vconf, char *if

 			} else if (strcmp(value,"username")==0) {
 				blobmsg_add_string(&cap, "webroot",webroot);
-				opennds_parameters();
-				ipset_create(ifname);
+				opennds_parameters(ifname);
+				ipset_create("opennds");
 				blobmsg_add_string(&cap, "enabled", "1");
 				blobmsg_add_string(&cap, "gatewayinterface","br-lan");
 				blobmsg_add_string(&cap, "authentication", value);
@@ -590,7 +591,7 @@ void vif_captive_portal_set(const struct schema_Wifi_VIF_Config *vconf, char *if

 			} else if (strcmp(value,"radius")==0)  {
 				blobmsg_add_string(&cap, "webroot",webroot);
-				opennds_parameters();
+				opennds_parameters("opennds");
 				blobmsg_add_string(&cap, "authentication", value);
 				blobmsg_add_string(&cap, "enabled", "1");
 				blobmsg_add_string(&cap, "gatewayinterface","br-lan");
@@ -602,7 +603,7 @@ void vif_captive_portal_set(const struct schema_Wifi_VIF_Config *vconf, char *if
 				blobmsg_close_array(&cap, d);
 			}
 			else {
-				opennds_section_del(ifname);
+				opennds_section_del("opennds");
 				return;
 			}
 		}
@@ -626,8 +627,6 @@ void vif_captive_portal_set(const struct schema_Wifi_VIF_Config *vconf, char *if

 		else if (strcmp(opt, "splash_page_logo") == 0) {
 			blobmsg_add_string(&cap, "splash_page_logo", value);
-			sprintf(file_path,"%s%s",path,"TipLogo.png");
-			splash_page_logo(file_path,value);
 			if (strcmp(splash_logo,value) !=0) {
 				sprintf(file_path,"%s%s",path,"TipLogo.png");
 				splash_page_logo(file_path,value);
@@ -641,8 +640,9 @@ void vif_captive_portal_set(const struct schema_Wifi_VIF_Config *vconf, char *if
 			}
 		}

-		else if (strcmp(opt, "splash_page_title") == 0)
+		else if (strcmp(opt, "splash_page_title") == 0) {
 			blobmsg_add_string(&cap, "splash_page_title", value);
+		}

 		else if (strcmp(opt, "acceptance_policy") == 0)
 			blobmsg_add_string(&cap, "acceptance_policy", value);
@@ -655,15 +655,13 @@ void vif_captive_portal_set(const struct schema_Wifi_VIF_Config *vconf, char *if

 		else if (strcmp(opt, "username_password_file") == 0) {
 			blobmsg_add_string(&cap, "username_password_file", value);
-			sprintf(file_path,"%s%s",path,"userpass.dat");
-			splash_page_logo(file_path,value);
 			if (strcmp(user_file,value) !=0) {
 				sprintf(file_path,"%s%s",path,"userpass.dat");
 				splash_page_logo(file_path,value);
 			}
 		}
 	}
-	blob_to_uci_section(cap_uci, "opennds", ifname, "opennds", cap.head, &opennds_param, NULL);
+	blob_to_uci_section(cap_uci, "opennds", "opennds", "opennds", cap.head, &opennds_param, NULL);
 	uci_commit_all(cap_uci);
 	return;
 }
--- a/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/src/radio.c
+++ b/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/src/radio.c
@@ -53,6 +53,8 @@ enum {
 	WDEV_ATTR_FREQ_BAND,
 	WDEV_AATR_CHANNELS,
 	WDEV_ATTR_DISABLE_B_RATES,
+	WDEV_ATTR_MAXASSOC_CLIENTS,
+	WDEV_ATTR_LOCAL_PWR_CONSTRAINT,
 	__WDEV_ATTR_MAX,
 };

@@ -71,14 +73,18 @@ static const struct blobmsg_policy wifi_device_policy[__WDEV_ATTR_MAX] = {
 	[WDEV_ATTR_FREQ_BAND] = { .name = "freq_band", .type = BLOBMSG_TYPE_STRING },
 	[WDEV_AATR_CHANNELS] = {.name = "channels", .type = BLOBMSG_TYPE_ARRAY},
        [WDEV_ATTR_DISABLE_B_RATES] = { .name = "legacy_rates", .type = BLOBMSG_TYPE_BOOL },
+	[WDEV_ATTR_MAXASSOC_CLIENTS] = { .name = "maxassoc", .type = BLOBMSG_TYPE_INT32 },
+	[WDEV_ATTR_LOCAL_PWR_CONSTRAINT] = { .name = "local_pwr_constraint", .type = BLOBMSG_TYPE_INT32 },
 };

-#define SCHEMA_CUSTOM_OPT_SZ            20
-#define SCHEMA_CUSTOM_OPTS_MAX          1
+#define SCHEMA_CUSTOM_OPT_SZ            24
+#define SCHEMA_CUSTOM_OPTS_MAX          3

 static const char custom_options_table[SCHEMA_CUSTOM_OPTS_MAX][SCHEMA_CUSTOM_OPT_SZ] =
 {
 	SCHEMA_CONSTS_DISABLE_B_RATES,
+	SCHEMA_CONSTS_MAX_CLIENTS,
+	SCHEMA_CONSTS_LOCAL_PWR_CONSTRAINT,
 };

 static void radio_config_custom_opt_set(struct blob_buf *b, struct blob_buf *del,
@@ -103,6 +109,25 @@ static void radio_config_custom_opt_set(struct blob_buf *b, struct blob_buf *del
 				blobmsg_add_bool(b, "legacy_rates", 0);
 			else 
 				blobmsg_add_bool(del, "legacy_rates", 0);
+		} else if (strcmp(opt, SCHEMA_CONSTS_MAX_CLIENTS) == 0) {
+			int maxassoc;
+			maxassoc = strtol(value, NULL, 10);
+			if (maxassoc <= 0) {
+				blobmsg_add_u32(del, "maxassoc", maxassoc);
+			} else {
+				if (maxassoc > 100)
+					maxassoc = 100;
+				blobmsg_add_u32(b, "maxassoc", maxassoc);
+			}
+		} else if (strcmp(opt, SCHEMA_CONSTS_LOCAL_PWR_CONSTRAINT) == 0) {
+			int pwr = atoi(value);
+			if (!strcmp(rconf->freq_band, "2.4G")) {
+				blobmsg_add_u32(del, "local_pwr_constraint", pwr);
+			} else if (pwr >= 0 && pwr <=255) {
+				blobmsg_add_u32(b, "local_pwr_constraint", pwr);
+			} else {
+				blobmsg_add_u32(del, "local_pwr_constraint", pwr);
+			}
 		}
 	}
 }
@@ -123,6 +148,7 @@ static void radio_state_custom_options_get(struct schema_Wifi_Radio_State *rstat
 	int i;
 	int index = 0;
 	const char *opt;
+	char buf[5];

 	for (i = 0; i < SCHEMA_CUSTOM_OPTS_MAX; i++) {
 		opt = custom_options_table[i];
@@ -133,7 +159,19 @@ static void radio_state_custom_options_get(struct schema_Wifi_Radio_State *rstat
 			} else {
 				set_custom_option_state(rstate, &index, opt, "1");
 			}
-                }
+		} else if (strcmp(opt, SCHEMA_CONSTS_MAX_CLIENTS) == 0) {
+			if (tb[WDEV_ATTR_MAXASSOC_CLIENTS]) {
+				snprintf(buf, sizeof(buf), "%d", blobmsg_get_u32(tb[WDEV_ATTR_MAXASSOC_CLIENTS]));
+				set_custom_option_state(rstate, &index, opt, buf);
+			} else {
+                                set_custom_option_state(rstate, &index, opt, "0");
+			}
+		} else if (strcmp(opt, SCHEMA_CONSTS_LOCAL_PWR_CONSTRAINT) == 0) {
+			if (tb[WDEV_ATTR_LOCAL_PWR_CONSTRAINT]) {
+				snprintf(buf, sizeof(buf), "%d", blobmsg_get_u32(tb[WDEV_ATTR_LOCAL_PWR_CONSTRAINT]));
+				set_custom_option_state(rstate, &index, opt, buf);
+			}
+		}
 	}
 }

@@ -148,6 +186,7 @@ static bool radio_state_update(struct uci_section *s, struct schema_Wifi_Radio_C
 	struct schema_Wifi_Radio_State  rstate;
 	char phy[6];
 	int antenna;
+	int32_t chan;

 	LOGT("%s: get state", s->e.name);

@@ -171,8 +210,13 @@ static bool radio_state_update(struct uci_section *s, struct schema_Wifi_Radio_C
 		return false;
 	}

-	if (tb[WDEV_ATTR_CHANNEL])
-		SCHEMA_SET_INT(rstate.channel, blobmsg_get_u32(tb[WDEV_ATTR_CHANNEL]));
+	if (tb[WDEV_ATTR_CHANNEL]) {
+		chan = get_current_channel(phy);
+		if(chan)
+			SCHEMA_SET_INT(rstate.channel, chan);
+		else
+			SCHEMA_SET_INT(rstate.channel, blobmsg_get_u32(tb[WDEV_ATTR_CHANNEL]));
+	}

 	SCHEMA_SET_INT(rstate.enabled, 1);
 	if (!force && tb[WDEV_ATTR_DISABLED] && blobmsg_get_bool(tb[WDEV_ATTR_DISABLED]))
@@ -201,15 +245,22 @@ static bool radio_state_update(struct uci_section *s, struct schema_Wifi_Radio_C

 	if (tb[WDEV_ATTR_TX_ANTENNA]) {
 		antenna = blobmsg_get_u32(tb[WDEV_ATTR_TX_ANTENNA]);
-		if (!antenna)   antenna = phy_get_tx_available_antenna(phy);
+		if (!antenna)
+			antenna = phy_get_tx_available_antenna(phy);
+		if ((antenna & 0xf0) && !(antenna & 0x0f))
+			antenna= antenna >> 4;
 		SCHEMA_SET_INT(rstate.tx_chainmask, antenna);
 	}
 	else
 		SCHEMA_SET_INT(rstate.tx_chainmask, phy_get_tx_chainmask(phy));

 	if (tb[WDEV_ATTR_RX_ANTENNA]) {
+
 		antenna = blobmsg_get_u32(tb[WDEV_ATTR_RX_ANTENNA]);
-		if (!antenna)   antenna = phy_get_rx_available_antenna(phy);
+		if (!antenna)
+			antenna = phy_get_rx_available_antenna(phy);
+		if ((antenna & 0xf0) && !(antenna & 0x0f))
+			antenna= antenna >> 4;
 		SCHEMA_SET_INT(rstate.rx_chainmask, antenna);
 	}
 	else
@@ -281,7 +332,6 @@ bool target_radio_config_set2(const struct schema_Wifi_Radio_Config *rconf,

 	char phy[6];
 	char ifname[8];
-	int list_channels[IEEE80211_CHAN_MAX] , list_channels_len = 0;

 	strncpy(ifname, rconf->if_name, sizeof(ifname));
 	strncpy(phy, target_map_ifname(ifname), sizeof(phy));
@@ -304,28 +354,38 @@ bool target_radio_config_set2(const struct schema_Wifi_Radio_Config *rconf,
 	}

 	if (changed->tx_chainmask) {
-		int tx_ant_avail;
+		int tx_ant_avail,txchainmask;
 		tx_ant_avail=phy_get_tx_available_antenna(phy);

+		if ((tx_ant_avail & 0xf0) && !(tx_ant_avail & 0x0f)) {
+			txchainmask = rconf->tx_chainmask << 4;
+		} else {
+			txchainmask = rconf->tx_chainmask;
+		}
 		if (rconf->tx_chainmask == 0) {
 			blobmsg_add_u32(&b, "txantenna", tx_ant_avail);
-		} else if ((rconf->tx_chainmask & tx_ant_avail) != rconf->tx_chainmask) {
+		} else if ((txchainmask & tx_ant_avail) != txchainmask) {
 			blobmsg_add_u32(&b, "txantenna", tx_ant_avail);
 		} else {
-			blobmsg_add_u32(&b, "txantenna", rconf->tx_chainmask);
+			blobmsg_add_u32(&b, "txantenna", txchainmask);
 		}
 	}

 	if (changed->rx_chainmask) {
-		int rx_ant_avail;
+		int rx_ant_avail, rxchainmask;
 		rx_ant_avail=phy_get_rx_available_antenna(phy);

+		if ((rx_ant_avail & 0xf0) && !(rx_ant_avail & 0x0f)) {
+			rxchainmask = rconf->rx_chainmask << 4;
+		} else {
+			rxchainmask = rconf->rx_chainmask;
+		}
 		if (rconf->rx_chainmask == 0) {
 			blobmsg_add_u32(&b, "rxantenna", rx_ant_avail);
-		} else if ((rconf->rx_chainmask & rx_ant_avail) != rconf->rx_chainmask) {
+		} else if ((rxchainmask & rx_ant_avail) != rxchainmask) {
 			blobmsg_add_u32(&b, "rxantenna", rx_ant_avail);
 		} else {
-			blobmsg_add_u32(&b, "rxantenna", rconf->rx_chainmask);
+			blobmsg_add_u32(&b, "rxantenna", rxchainmask);
 		}
 	}

@@ -351,16 +411,18 @@ bool target_radio_config_set2(const struct schema_Wifi_Radio_Config *rconf,
 			 LOGE("%s: failed to set ht/hwmode", rconf->if_name);
 	}

-	list_channels_len = phy_get_list_channels_dfs(phy, list_channels);
-	if (list_channels_len) {
-		struct blob_attr *n;
+	struct blob_attr *n;
+	int backup_channel = 0;
+	backup_channel = rrm_get_backup_channel(rconf->freq_band);
+	if(backup_channel) {
 		n = blobmsg_open_array(&b, "channels");
-		for(int i = 0; i < list_channels_len; i++)
-		{
-			blobmsg_add_u32(&b, NULL, list_channels[i]);
-		}
+		blobmsg_add_u32(&b, NULL, backup_channel);
 		blobmsg_close_array(&b, n);
-	}
+	} else {
+		n = blobmsg_open_array(&del, "channels");
+		blobmsg_add_u32(&del, NULL, backup_channel);
+		blobmsg_close_array(&del, n);
+	}	

 	if (changed->custom_options)
 		radio_config_custom_opt_set(&b, &del, rconf);
--- a/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/src/radio_nl80211.c
+++ b/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/src/radio_nl80211.c
@@ -103,7 +103,7 @@ static void vif_add_sta_rate_rule(uint8_t *addr, char *ifname)
 	char *rule;
 	ssize_t rule_sz;

-	LOGI("Add mac rate rule: %s %02X:%02X:%02X:%02X:%02X:%02X",
+	LOGI("Add mac rate rule:%s: %02X:%02X:%02X:%02X:%02X:%02X",
 	     ifname, addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);

 	rule_sz = snprintf(NULL, 0, "/lib/nft-qos/mac-rate.sh add %s %02X:%02X:%02X:%02X:%02X:%02X",
@@ -123,7 +123,7 @@ static void vif_del_sta_rate_rule(uint8_t *addr, char *ifname)
 	char *rule;
 	ssize_t rule_sz;

-	LOGI("Del mac rate rule: %s %02X:%02X:%02X:%02X:%02X:%02X",
+	LOGI("Del mac rate rule:%s: %02X:%02X:%02X:%02X:%02X:%02X",
 	     ifname, addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);

 	rule_sz = snprintf(NULL, 0, "/lib/nft-qos/mac-rate.sh del %s %02X:%02X:%02X:%02X:%02X:%02X",
@@ -137,46 +137,6 @@ static void vif_del_sta_rate_rule(uint8_t *addr, char *ifname)
    free(rule);
 }

-static void vif_update_stats(struct wifi_station *sta, struct nlattr **tb)
-{
-	static struct nla_policy stats_policy[NL80211_STA_INFO_MAX + 1] = {
-		[NL80211_STA_INFO_INACTIVE_TIME] = { .type = NLA_U32    },
-		[NL80211_STA_INFO_RX_PACKETS]    = { .type = NLA_U32    },
-		[NL80211_STA_INFO_TX_PACKETS]    = { .type = NLA_U32    },
-		[NL80211_STA_INFO_RX_BITRATE]    = { .type = NLA_NESTED },
-		[NL80211_STA_INFO_TX_BITRATE]    = { .type = NLA_NESTED },
-		[NL80211_STA_INFO_SIGNAL]        = { .type = NLA_U8     },
-		[NL80211_STA_INFO_SIGNAL_AVG]    = { .type = NLA_U8     },
-		[NL80211_STA_INFO_RX_BYTES]      = { .type = NLA_U32    },
-		[NL80211_STA_INFO_TX_BYTES]      = { .type = NLA_U32    },
-		[NL80211_STA_INFO_TX_RETRIES]    = { .type = NLA_U32    },
-		[NL80211_STA_INFO_TX_FAILED]     = { .type = NLA_U32    },
-		[NL80211_STA_INFO_T_OFFSET]      = { .type = NLA_U64    },
-		[NL80211_STA_INFO_STA_FLAGS] =
-			{ .minlen = sizeof(struct nl80211_sta_flag_update) },
-	};
-
-	struct nlattr *sinfo[NL80211_STA_INFO_MAX + 1] = { };
-
-	if (!tb[NL80211_ATTR_STA_INFO])
-		return;
-	if (nla_parse_nested(sinfo, NL80211_STA_INFO_MAX,
-			     tb[NL80211_ATTR_STA_INFO], stats_policy))
-		return;
-	if (sinfo[NL80211_STA_INFO_SIGNAL_AVG])
-		sta->rssi = (int32_t) nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL_AVG]);
-	if (sinfo[NL80211_STA_INFO_RX_PACKETS])
-		sta->rx_packets = nla_get_u32(sinfo[NL80211_STA_INFO_RX_PACKETS]);
-	if (sinfo[NL80211_STA_INFO_TX_PACKETS])
-		sta->tx_packets = nla_get_u32(sinfo[NL80211_STA_INFO_TX_PACKETS]);
-	if (sinfo[NL80211_STA_INFO_RX_BYTES])
-		sta->rx_bytes = nla_get_u32(sinfo[NL80211_STA_INFO_RX_BYTES]);
-	if (sinfo[NL80211_STA_INFO_TX_BYTES])
-		sta->tx_bytes = nla_get_u32(sinfo[NL80211_STA_INFO_TX_BYTES]);
-
-	sta->last_update = time(NULL);
-}
-
 static void nl80211_add_station(struct nlattr **tb, char *ifname)
 {
 	struct wifi_station *sta;
@@ -187,12 +147,10 @@ static void nl80211_add_station(struct nlattr **tb, char *ifname)
 		return;

 	addr = nla_data(tb[NL80211_ATTR_MAC]);
+	vif_add_sta_rate_rule(addr, ifname);
 	sta = avl_find_element(&sta_tree, addr, sta, avl);
-	if (sta) {
-		vif_add_sta_rate_rule(addr, ifname);
-		vif_update_stats(sta, tb);
+	if (sta)
 		return;
-	}

 	wif = avl_find_element(&wif_tree, ifname, wif, avl);
 	if (!wif)
@@ -209,8 +167,6 @@ static void nl80211_add_station(struct nlattr **tb, char *ifname)
 	list_add(&sta->iface, &wif->stas);

 	vif_add_station(sta, ifname, 1);
-	vif_add_sta_rate_rule(addr, ifname);
-	vif_update_stats(sta, tb);
 }

 static void _nl80211_del_station(char *ifname, struct wifi_station *sta)
@@ -279,6 +235,8 @@ static void vif_sync_stations(char *ifname)
 		if (sta_tree.count > 0 && sta_tree.count == j)
 		{
 			LOGI("%s: remove stale client %s", ifname, ovs_clients[i].mac);
+			schema_Wifi_Associated_Clients_mark_all_present(ovs_clients + i);
+			ovs_clients[i]._partial_update = true;
 			radio_ops->op_client(ovs_clients + i, ifname, false);
 		}

@@ -305,24 +263,6 @@ free:
 	free(ovs_clients);
 }

-static void remove_stale_station(char *ifname)
-{
-	struct wifi_station *sta = NULL, *tmp = NULL;
-	char mac[ETH_ALEN * 3];
-	time_t timeout = 0, t = 0;
-
-	avl_for_each_element_safe(&sta_tree, sta, avl, tmp) {
-		timeout = sta->last_update + (EVSCHED_SEC(STA_POLL_INTERVAL*2));
-		t = time(NULL);
-		if (t > timeout) {
-			print_mac(mac, sta->addr);
-			LOGN("%s: Remove stale STA %s %ld %ld %ld", __func__, mac,
-					t, timeout, sta->last_update);
-			_nl80211_del_station(ifname, sta);
-		}
-	}
-}
-
 static void nl80211_add_iface(struct nlattr **tb, char *ifname, char *phyname, int ifidx)
 {
 	struct wifi_iface *wif;
@@ -442,18 +382,20 @@ static void nl80211_add_phy(struct nlattr **tb, char *name)
 					freq = nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_FREQ]);
 					chan = ieee80211_frequency_to_channel(freq);
 					if (chan >= IEEE80211_CHAN_MAX) {
-						LOGE("%s: found invalid channel %d", phy->name, chan);
+						LOG(DEBUG, "%s: found invalid channel %d", phy->name, chan);
 						continue;
 					}

 					if (tb_freq[NL80211_FREQUENCY_ATTR_DISABLED]) {
 						phy->chandisabled[chan] = 1;
+						phy->chandfs[chan] = 0;
 						continue;
 					}

 					if (tb_freq[NL80211_FREQUENCY_ATTR_RADAR]) {
 						phy->chandfs[chan] = 1;
-						LOGE("%s: found dfs channel %d", phy->name, chan);
+						phy->chandisabled[chan] = 0;
+						LOG(DEBUG, "%s: found dfs channel %d", phy->name, chan);
 						continue;
 					}
 					phy->freq[chan] = freq;
@@ -488,6 +430,17 @@ static void nl80211_del_phy(struct nlattr **tb, char *name)
 	free(phy);
 }

+static void nl80211_update_current_channel(struct nlattr **tb, char *name, int freq)
+{
+	struct wifi_phy *phy;
+
+	phy = avl_find_element(&phy_tree, name, phy, avl);
+	if (!phy)
+		return;
+
+	phy->current_channel = ieee80211_frequency_to_channel(freq);
+}
+
 static int nl80211_recv(struct nl_msg *msg, void *arg)
 {
 	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
@@ -496,7 +449,7 @@ static int nl80211_recv(struct nl_msg *msg, void *arg)
 	char *pif_name=NULL;
 	char phyname[IFNAMSIZ] = {};
 	int ifidx = -1, phy = -1;
-
+	int freq = 0;
 	memset(tb, 0, sizeof(tb));

 	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
@@ -518,6 +471,12 @@ static int nl80211_recv(struct nl_msg *msg, void *arg)
 			snprintf(phyname, sizeof(phyname), "phy%d", phy);
 	}

+	if(tb[NL80211_ATTR_WIPHY_FREQ]) {
+		freq = nla_get_u32(tb[NL80211_ATTR_WIPHY_FREQ]);
+		snprintf(phyname, sizeof(phyname), "phy%d", phy);
+		nl80211_update_current_channel(tb, phyname, freq);
+	}
+
 	switch (gnlh->cmd) {
 	case NL80211_CMD_NEW_STATION:
 		nl80211_add_station(tb, ifname);
@@ -542,7 +501,6 @@ static int nl80211_recv(struct nl_msg *msg, void *arg)
 		syslog(0, "%s:%s[%d]%d\n", __FILE__, __func__, __LINE__, gnlh->cmd);
 		break;
 	}
-
 	return NL_OK;
 }

@@ -576,16 +534,9 @@ static void nl80211_ev(struct ev_loop *ev, struct ev_io *io, int event)

 static void vif_poll_stations(void *arg)
 {
-	 struct wifi_iface *wif = NULL;
-
+	struct wifi_iface *wif = NULL;

 	avl_for_each_element(&wif_tree, wif, avl) {
-		struct nl_msg *msg;
-
-		msg = unl_genl_msg(&unl, NL80211_CMD_GET_STATION, true);
-		nla_put_u32(msg, NL80211_ATTR_IFINDEX, wif->ifidx);
-		unl_genl_request(&unl, msg, nl80211_recv, NULL);
-		remove_stale_station(wif->name);
 		vif_sync_stations(wif->name);
 	}
 	evsched_task_reschedule_ms(EVSCHED_SEC(STA_POLL_INTERVAL));
@@ -609,6 +560,9 @@ int radio_nl80211_init(void)
 	unl_genl_subscribe(&unl, "mlme");
 	unl_genl_subscribe(&unl, "vendor");

+	if (nl_socket_set_buffer_size(unl.sock, 262144, 0) < 0)
+		LOGE("radio_nl80211: Failed to set nl socket buffer size");
+
 	ev_io_init(&unl_io, nl80211_ev, unl.sock->s_fd, EV_READ);
        ev_io_start(wifihal_evloop, &unl_io);
 	evsched_task(&vif_poll_stations, NULL, EVSCHED_SEC(5));
--- a/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/src/rrm_config.c
+++ b/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/src/rrm_config.c
@@ -37,7 +37,7 @@ void rrm_config_vif(struct blob_buf *b, struct blob_buf *del, const char * freq_
 	if (false == ovsdb_table_select_one(&table_Wifi_RRM_Config,
 			SCHEMA_COLUMN(Wifi_RRM_Config, freq_band), freq_band, &conf))
 	{
-		LOG(INFO, "Wifi_VIF_Config: No RRM for band %s", freq_band );
+		LOG(DEBUG, "Wifi_VIF_Config: No RRM for band %s", freq_band );
 		blobmsg_add_u32(del, "rssi_ignore_probe_request", -90);
 		blobmsg_add_u32(del, "signal_connect", -90);
 		blobmsg_add_u32(del, "signal_stay", -90);
@@ -53,6 +53,22 @@ void rrm_config_vif(struct blob_buf *b, struct blob_buf *del, const char * freq_
 	return;
 }

+int rrm_get_backup_channel(const char * freq_band)
+{
+	struct schema_Wifi_RRM_Config conf;
+
+	memset(&conf, 0, sizeof(conf));
+	if (false == ovsdb_table_select_one(&table_Wifi_RRM_Config,
+			SCHEMA_COLUMN(Wifi_RRM_Config, freq_band), freq_band, &conf))
+	{
+		LOG(ERR, "Wifi_Radio_Config: No RRM for band %s", freq_band );
+		return 0;
+	}
+
+	return conf.backup_channel;
+
+}
+
 static bool rrm_config_update( struct schema_Wifi_RRM_Config *conf, bool addNotDelete)
 {
 	struct schema_Wifi_Radio_Config rconf;
@@ -76,7 +92,7 @@ static bool rrm_config_update( struct schema_Wifi_RRM_Config *conf, bool addNotD
 		memset(&vconf, 0, sizeof(vconf));
 		if (ovsdb_table_select_one_where(&table_Wifi_VIF_Config, where, &vconf))
 		{
-			LOG(INFO, "RRM band %s updates vif %s", conf->freq_band, vconf.if_name);
+			LOG(DEBUG, "RRM band %s updates vif %s", conf->freq_band, vconf.if_name);
 			target_vif_config_set2(&vconf, &rconf, NULL, &changed, 0);
 		}
 	}
@@ -96,12 +112,35 @@ static bool rrm_config_changed( struct schema_Wifi_RRM_Config *old,
 	return false;
 }

+static bool rrm_radio_config_update(struct schema_Wifi_RRM_Config *conf )
+{
+	struct schema_Wifi_Radio_Config_flags changed;
+	struct schema_Wifi_Radio_Config rconf;
+
+	if (false == ovsdb_table_select_one(&table_Wifi_Radio_Config,
+			SCHEMA_COLUMN(Wifi_Radio_Config, freq_band), conf->freq_band, &rconf))
+	{
+		LOG(WARN, "Wifi_RRM_Config: No radio for band %s", conf->freq_band );
+		return false;
+	}
+
+	memset(&changed, 0, sizeof(changed));
+	target_radio_config_set2(&rconf, &changed);
+
+	return true;
+}
+
 static bool rrm_config_set( struct schema_Wifi_RRM_Config *old,
 	struct schema_Wifi_RRM_Config *conf ) 
 {
 	if (rrm_config_changed(old, conf)) {
-		return( rrm_config_update(conf, true));
+		rrm_config_update(conf, true);
 	}
+
+	if(conf->backup_channel != old->backup_channel) {
+		rrm_radio_config_update(conf);
+	}
+
 	return true;
 }

--- a/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/src/stats.c
+++ b/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/src/stats.c
@@ -304,8 +304,7 @@ bool target_stats_scan_start(radio_entry_t *radio_cfg, uint32_t *chan_list, uint
 	LOGT("%s: scan trigger returned %d", radio_cfg->if_name, ret);

 	if (ret == false) {
-		LOG(ERR, "%s: failed to trigger scan, aborting", radio_cfg->if_name);
-		(*scan_cb)(scan_ctx, ret);
+		LOG(DEBUG, "%s: failed to trigger scan, aborting", radio_cfg->if_name);
 	}
 	return ret;
 }
@@ -384,7 +383,7 @@ bool target_stats_device_txchainmask_get(radio_entry_t *radio_cfg, dpp_device_tx
 	txchainmask_entry->type  = radio_cfg->type;
 	if (nl80211_get_tx_chainmask(target_map_ifname(radio_cfg->phy_name), &txchainmask_entry->value) < 0)
 		ret = false;
-	LOGT("%s: tx_chainmask %d", radio_cfg->phy_name, txchainmask_entry->value);
+	LOGD("%s: tx_chainmask %d", radio_cfg->phy_name, txchainmask_entry->value);

 	return ret;
 }
--- a/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/src/stats_nl80211.c
+++ b/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/src/stats_nl80211.c
@@ -356,7 +356,7 @@ struct nl80211_scan *nl80211_scan_find(const char *name)
 	struct nl80211_scan *nl80211_scan = avl_find_element(&nl80211_scan_tree, name, nl80211_scan, avl);

 	if (!nl80211_scan)
-		LOGN("%s: scan context does not exist", name);
+		LOGD("%s: scan context does not exist", name);

 	return nl80211_scan;
 }
@@ -373,7 +373,7 @@ static int nl80211_scan_add(char *name, target_scan_cb_t *scan_cb, void *scan_ct
 		strncpy(nl80211_scan->name, name, IF_NAMESIZE);
 		nl80211_scan->avl.key = nl80211_scan->name;
 		avl_insert(&nl80211_scan_tree, &nl80211_scan->avl);
-		LOGN("%s: added scan context", name);
+		LOGD("%s: added scan context", name);
 	}

 	nl80211_scan->scan_cb = scan_cb;
@@ -383,7 +383,7 @@ static int nl80211_scan_add(char *name, target_scan_cb_t *scan_cb, void *scan_ct

 static void nl80211_scan_del(struct nl80211_scan *nl80211_scan)
 {
-	LOGN("%s: delete scan context", nl80211_scan->name);
+	LOGD("%s: delete scan context", nl80211_scan->name);
 	ev_async_stop(EV_DEFAULT, &nl80211_scan->async);
 	avl_delete(&nl80211_scan_tree, &nl80211_scan->avl);
 	free(nl80211_scan);
@@ -394,7 +394,7 @@ static void nl80211_scan_finish(char *name, bool state)
 	struct nl80211_scan *nl80211_scan = nl80211_scan_find(name);

 	if (nl80211_scan) {
-		LOGN("%s: calling context cb", nl80211_scan->name);
+		LOGD("%s: calling context cb", nl80211_scan->name);
 		(*nl80211_scan->scan_cb)(nl80211_scan->scan_ctx, state);
 		nl80211_scan_del(nl80211_scan);
 	}
@@ -421,14 +421,14 @@ static int nl80211_recv(struct nl_msg *msg, void *arg)

 	switch (gnlh->cmd) {
 	case NL80211_CMD_TRIGGER_SCAN:
-		LOGN("%s: scan started\n", ifname);
+		LOGD("%s: scan started\n", ifname);
 		break;
 	case NL80211_CMD_SCAN_ABORTED:
-		LOGN("%s: scan aborted\n", ifname);
+		LOGD("%s: scan aborted\n", ifname);
 		nl80211_scan_finish(ifname, false);
 		break;
 	case NL80211_CMD_NEW_SCAN_RESULTS:
-		LOGN("%s: scan completed\n", ifname);
+		LOGD("%s: scan completed\n", ifname);
 		nl80211_scan_finish(ifname, true);
 		break;
 	default:
@@ -547,22 +547,33 @@ int nl80211_scan_trigger(struct nl_call_param *nl_call_param, uint32_t *chan_lis
 {
 	struct nl_msg *msg = nl80211_call_vif(nl_call_param, NL80211_CMD_TRIGGER_SCAN, false);
 	struct nlattr *freq;
-	unsigned int i;
+	unsigned int i, flags = 0;
+	int ret = 0;

 	if (!msg)
 		return -1;

-	LOGN("%s: not setting dwell time\n", nl_call_param->ifname);
+	LOGT("%s: not setting dwell time\n", nl_call_param->ifname);
 	//nla_put_u16(msg, NL80211_ATTR_MEASUREMENT_DURATION, dwell_time);
+
+	/* Add the ap-force flag, otherwise the scan fails on wifi6 APs */
+	flags |= NL80211_SCAN_FLAG_AP;
+	nla_put(msg, NL80211_ATTR_SCAN_FLAGS, sizeof(uint32_t), &flags);
+
 	freq = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
 	for (i = 0; i < chan_num; i ++)
 		nla_put_u32(msg, i, ieee80211_channel_to_frequency(chan_list[i]));
 	nla_nest_end(msg, freq);

-	if (nl80211_scan_add(nl_call_param->ifname, scan_cb, scan_ctx))
+	ret = nl80211_scan_add(nl_call_param->ifname, scan_cb, scan_ctx); 
+	if (ret ) {
+		LOG(DEBUG,"%s: scan add failed %d\n", nl_call_param->ifname, ret);
 		return -1;
+	}

-	return unl_genl_request(&unl, msg, nl80211_scan_trigger_recv, NULL);
+	ret = unl_genl_request(&unl, msg, nl80211_scan_trigger_recv, NULL);
+	if (ret)	LOG(DEBUG, "%s: scan request failed %d\n", nl_call_param->ifname, ret);
+	return ret;
 }

 int nl80211_scan_abort(struct nl_call_param *nl_call_param)
@@ -595,5 +606,9 @@ int stats_nl80211_init(void)
 		LOGE("failed to spawn nl80211");
 		return -1;
 	}
+
+	if (nl_socket_set_buffer_size(unl.sock, 262144, 0) < 0)
+		LOGE("stats_nl80211: Failed to set nl socket buffer size");
+
 	return 0;
 }
--- a/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/src/utils.c
+++ b/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/src/utils.c
@@ -283,7 +283,7 @@ int phy_get_channels_state(const char *name, struct schema_Wifi_Radio_State *rst
 	if (!phy)
 		return 0;

-	LOGN("phy name :%s", name);
+	LOGD("phy name :%s", name);

 	for (i = 0; (i < IEEE80211_CHAN_MAX); i++) {
 		if (phy->chandisabled[i]) {
@@ -310,27 +310,6 @@ int phy_get_channels_state(const char *name, struct schema_Wifi_Radio_State *rst
 	return ret;
 }

-int phy_get_list_channels_dfs(const char *name, int *list)
-{
-	struct wifi_phy *phy = phy_find(name);
-	int i = 0, len = 0;
-
-	if (!phy)
-		return 0;
-
-	for (i = 0; (i < IEEE80211_CHAN_MAX); i++) {
-		if (phy->chandfs[i]) {
-			list[len] = i;
-			len++;
-		} else if (phy->channel[i]) {
-			list[len] = i;
-			len++;
-		}
-	}
-
-	return len;
-}
-
 int phy_get_band(const char *name, char *band)
 {
 	struct wifi_phy *phy = phy_find(name);
@@ -611,6 +590,15 @@ int ieee80211_channel_to_frequency(int chan)
 		return 5000 + chan * 5;
 	return 0;
 }
+int get_current_channel(char *name)
+{
+	struct wifi_phy *phy = phy_find(name);
+
+	if(phy)
+		return phy->current_channel;
+
+	return 0;
+}

 bool vif_get_security(struct schema_Wifi_VIF_State *vstate,  char *mode,  char *encryption, char *radiusServerIP,  char *password, char *port)
 {
--- a/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/src/vif.c
+++ b/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/src/vif.c
@@ -98,7 +98,15 @@ enum {
 	WIF_ATTR_MCC_MNC,
 	WIF_ATTR_NAI_REALM,
 	WIF_ATTR_GAS_ADDR3,
+	WIF_ATTR_QOS_MAP_SET,
 	WIF_ATTR_OSEN,
+	WIF_ATTR_ACCESS_NETWORK_TYPE,
+	WIF_ATTR_INTERNET,
+	WIF_ATTR_ESR,
+	WIF_ATTR_ASRA,
+	WIF_ATTR_UESA,
+	WIF_ATTR_DISABLE_DGAF,
+	WIF_ATTR_WAN_METRICS,
 	WIF_ATTR_ANQP_DOMAIN_ID,
 	WIF_ATTR_DEAUTH_REQUEST_TIMEOUT,
 	WIF_ATTR_OPER_FRIENDLY_NAME,
@@ -110,6 +118,7 @@ enum {
 	WIF_ATTR_BEACON_RATE,
 	WIF_ATTR_MCAST_RATE,
 	WIF_ATTR_RADIUS_NAS_ID_ATTR,
+	WIF_ATTR_RADIUS_NAS_IP_ATTR,
 	WIF_ATTR_RADIUS_AUTH_REQ_ATTR,
 	WIF_ATTR_RADIUS_ACCT_REQ_ATTR,
 	WIF_ATTR_MESH_ID,
@@ -180,7 +189,15 @@ static const struct blobmsg_policy wifi_iface_policy[__WIF_ATTR_MAX] = {
 	[WIF_ATTR_MCC_MNC] = { .name = "anqp_3gpp_cell_net", BLOBMSG_TYPE_STRING },
 	[WIF_ATTR_NAI_REALM] = { .name = "nai_realm", BLOBMSG_TYPE_ARRAY },
 	[WIF_ATTR_GAS_ADDR3] = { .name = "gas_address3", BLOBMSG_TYPE_STRING },
+	[WIF_ATTR_QOS_MAP_SET] = { .name = "qos_map_set", BLOBMSG_TYPE_STRING },
 	[WIF_ATTR_OSEN] = { .name = "osen", BLOBMSG_TYPE_BOOL },
+	[WIF_ATTR_ACCESS_NETWORK_TYPE] = { .name = "access_network_type", BLOBMSG_TYPE_INT32 },
+	[WIF_ATTR_INTERNET] = { .name = "internet", BLOBMSG_TYPE_BOOL },
+	[WIF_ATTR_ESR] = { .name = "esr", BLOBMSG_TYPE_BOOL },
+	[WIF_ATTR_ASRA] = { .name = "asra", BLOBMSG_TYPE_BOOL },
+	[WIF_ATTR_UESA] = { .name = "uesa", BLOBMSG_TYPE_BOOL },
+	[WIF_ATTR_DISABLE_DGAF] = { .name = "disable_dgaf", BLOBMSG_TYPE_BOOL },
+	[WIF_ATTR_WAN_METRICS] = { .name = "hs20_wan_metrics", BLOBMSG_TYPE_STRING },
 	[WIF_ATTR_ANQP_DOMAIN_ID] = { .name = "anqp_domain_id", BLOBMSG_TYPE_INT32 },
 	[WIF_ATTR_DEAUTH_REQUEST_TIMEOUT] = { .name = "hs20_deauth_req_timeout", BLOBMSG_TYPE_INT32 },
 	[WIF_ATTR_OPER_FRIENDLY_NAME] = { .name = "hs20_oper_friendly_name", BLOBMSG_TYPE_ARRAY },
@@ -192,6 +209,7 @@ static const struct blobmsg_policy wifi_iface_policy[__WIF_ATTR_MAX] = {
 	[WIF_ATTR_BEACON_RATE] = { .name = "bcn_rate", .type = BLOBMSG_TYPE_INT32 },
 	[WIF_ATTR_MCAST_RATE] = { .name = "mcast_rate", .type = BLOBMSG_TYPE_INT32 },
 	[WIF_ATTR_RADIUS_NAS_ID_ATTR] = { .name = "nasid", BLOBMSG_TYPE_STRING },
+	[WIF_ATTR_RADIUS_NAS_IP_ATTR] = { .name = "ownip", BLOBMSG_TYPE_STRING },
 	[WIF_ATTR_RADIUS_AUTH_REQ_ATTR] = { .name = "radius_auth_req_attr", BLOBMSG_TYPE_ARRAY },
 	[WIF_ATTR_RADIUS_ACCT_REQ_ATTR] = { .name = "radius_acct_req_attr", BLOBMSG_TYPE_ARRAY },
 	[WIF_ATTR_MESH_ID] = { .name = "mesh_id", BLOBMSG_TYPE_STRING },
@@ -438,7 +456,7 @@ out_none:

 /* Custom options table */
 #define SCHEMA_CUSTOM_OPT_SZ            20
-#define SCHEMA_CUSTOM_OPTS_MAX          11
+#define SCHEMA_CUSTOM_OPTS_MAX          12

 const char custom_options_table[SCHEMA_CUSTOM_OPTS_MAX][SCHEMA_CUSTOM_OPT_SZ] =
 {
@@ -452,6 +470,7 @@ const char custom_options_table[SCHEMA_CUSTOM_OPTS_MAX][SCHEMA_CUSTOM_OPT_SZ] =
 	SCHEMA_CONSTS_DTIM_PERIOD,
 	SCHEMA_CONSTS_RADIUS_OPER_NAME,
 	SCHEMA_CONSTS_RADIUS_NAS_ID,
+	SCHEMA_CONSTS_RADIUS_NAS_IP,
 	SCHEMA_CONSTS_DYNAMIC_VLAN,
 };

@@ -500,6 +519,8 @@ static void vif_config_custom_opt_set(struct blob_buf *b, struct blob_buf *del,
 			blobmsg_add_string(b, "dtim_period", value);
 		else if (strcmp(opt, "radius_nas_id") == 0)
 			blobmsg_add_string(b, "nasid", value);
+		else if (strcmp(opt, "radius_nas_ip") == 0)
+			blobmsg_add_string(b, "ownip", value);
 		else if (strcmp(opt, "radius_oper_name") == 0 && strlen(value) > 0)
 		{
 			memset(operator_name, '\0', sizeof(operator_name));
@@ -629,6 +650,13 @@ static void vif_state_custom_options_get(struct schema_Wifi_VIF_State *vstate,
 						custom_options_table[i],
 						buf);
 			}
+		} else if (strcmp(opt, "radius_nas_ip") == 0) {
+			if (tb[WIF_ATTR_RADIUS_NAS_IP_ATTR]) {
+				buf = blobmsg_get_string(tb[WIF_ATTR_RADIUS_NAS_IP_ATTR]);
+				set_custom_option_state(vstate, &index,
+						custom_options_table[i],
+						buf);
+			}
 		} else if (strcmp(opt, "radius_oper_name") == 0) {
 			static struct blobmsg_policy policy[1] = {
 					{ .type = BLOBMSG_TYPE_STRING },
@@ -669,6 +697,7 @@ bool vif_state_update(struct uci_section *s, struct schema_Wifi_VIF_Config *vcon
 	char mac[ETH_ALEN * 3];
 	char *ifname, radio[IF_NAMESIZE];
 	bool vifIsActive = false;
+	char network_name[IF_NAMESIZE];

 	LOGT("%s: get state", s->e.name);

@@ -736,8 +765,10 @@ bool vif_state_update(struct uci_section *s, struct schema_Wifi_VIF_Config *vcon
 //	else
 //		SCHEMA_SET_INT(vstate.uapsd_enable, false);

-	if (tb[WIF_ATTR_NETWORK])
-		SCHEMA_SET_STR(vstate.bridge, blobmsg_get_string(tb[WIF_ATTR_NETWORK]));
+	if (tb[WIF_ATTR_NETWORK]) {
+		strncpy(network_name, blobmsg_get_string(tb[WIF_ATTR_NETWORK]), IF_NAMESIZE);
+		SCHEMA_SET_STR(vstate.bridge, network_name);
+	}
 	else
 		LOGW("%s: unknown bridge/network", s->e.name);

@@ -803,9 +834,10 @@ bool vif_state_update(struct uci_section *s, struct schema_Wifi_VIF_Config *vcon
 	}
 	vif_state_security_get(&vstate, tb);
 	vif_state_custom_options_get(&vstate, tb);
-	vif_state_captive_portal_options_get(&vstate, s);
-	vif_state_dhcp_allowlist_get(&vstate);
-
+	if(!strcmp(network_name,"lan")) {
+		vif_state_captive_portal_options_get(&vstate);
+		vif_state_dhcp_allowlist_get(&vstate);
+	}
 	if (vconf) {
 		LOGN("%s: updating vif config", radio);
 		vif_state_to_conf(&vstate, vconf);
@@ -971,6 +1003,9 @@ static void hs20_vif_config(struct blob_buf *b,
 	if (strlen(hs2conf->qos_map_set))
 		blobmsg_add_string(b, "qos_map_set", hs2conf->qos_map_set);

+	if (hs2conf->access_network_type > 0)
+		blobmsg_add_u32(b, "access_network_type", hs2conf->access_network_type);
+
 	if (hs2conf->osen)
 		blobmsg_add_bool(b, "osen", 1);
 	else
--- a/feeds/wlan-ap/opensync/src/platform/openwrt/src/netifd/inc/inet_conf.h
+++ b/feeds/wlan-ap/opensync/src/platform/openwrt/src/netifd/inc/inet_conf.h
@@ -6,7 +6,9 @@
 #include "netifd.h"
 #include "inet_iface.h"

-struct netifd_iface *netifd_add_inet_conf(struct schema_Wifi_Inet_Config *iconf);
+#define DHCP_SNIFF_MAX_VLAN 4
+
+void netifd_add_inet_conf(struct schema_Wifi_Inet_Config *iconf);
 void netifd_del_inet_conf(struct schema_Wifi_Inet_Config *old_rec);
 struct netifd_iface *netifd_modify_inet_conf(struct schema_Wifi_Inet_Config *iconf);
 bool netifd_inet_config_set(struct netifd_iface *piface);
--- a/feeds/wlan-ap/opensync/src/platform/openwrt/src/netifd/src/inet_conf.c
+++ b/feeds/wlan-ap/opensync/src/platform/openwrt/src/netifd/src/inet_conf.c
@@ -6,30 +6,43 @@

 #include "inet_conf.h"

-struct netifd_iface* netifd_add_inet_conf(struct schema_Wifi_Inet_Config *iconf)
-{
+static int vlan_count = 0;

+void netifd_add_inet_conf(struct schema_Wifi_Inet_Config *iconf)
+{
 	struct netifd_iface *piface = NULL;

-	piface = netifd_iface_get_by_name(iconf->if_name);
-	if (piface == NULL)
-	{
-		piface = netifd_iface_new(iconf->if_name, iconf->if_type);
-		if (piface == NULL)
-		{
-			LOG(ERR, "netifd_add_inet_conf: %s: Unable to create interface.", iconf->if_name);
-			return NULL;
-		}
+	if (strcmp(iconf->if_type, "bridge") && strcmp(iconf->if_type, "vlan")) {
+		return;
+	}

-		if (!strcmp(iconf->if_type, "bridge") || !strcmp(iconf->if_type, "vlan"))
-		{
-			LOGN("Setting up dhsnif for %s", piface->if_base->inet.in_ifname);
+	piface = netifd_iface_get_by_name(iconf->if_name);
+
+	if (piface)
+		return;
+
+	if (!strcmp(iconf->if_name, "wan") || !strcmp(iconf->if_name, "lan")) {
+		piface = netifd_iface_new(iconf->if_name, iconf->if_type);
+		if (!piface) {
+			LOG(ERR, "netifd_add_inet_conf: %s: Unable to create interface.", iconf->if_name);
+			return;
+		}
+		netifd_inet_config_set(piface);
+		netifd_inet_config_apply(piface);
+	} else if (iconf->vlan_id_exists && iconf->vlan_id > 2) {
+		if (vlan_count < DHCP_SNIFF_MAX_VLAN && !strstr(iconf->if_name,"lan_")) {
+			piface = netifd_iface_new(iconf->if_name, iconf->if_type);
+			if (!piface) {
+				LOG(ERR, "netifd_add_inet_conf: %s: Unable to create interface.", iconf->if_name);
+				return;
+			}
 			netifd_inet_config_set(piface);
 			netifd_inet_config_apply(piface);
+			vlan_count++;
 		}
 	}

-	return piface;
+	return;
 }

 void netifd_del_inet_conf(struct schema_Wifi_Inet_Config *old_rec)
@@ -37,14 +50,14 @@ void netifd_del_inet_conf(struct schema_Wifi_Inet_Config *old_rec)
 	struct netifd_iface *piface = NULL;

 	piface = netifd_iface_get_by_name(old_rec->if_name);
-	if (piface == NULL)
-	{
-		LOG(ERR, "netifd_del_inet_conf: Unable to delete non-existent interface %s.",
-				old_rec->if_name);
-	}

-	if (piface != NULL && !netifd_iface_del(piface))
-			{
+	if (!piface)
+		return;
+
+	if (netifd_iface_del(piface)) {
+		if (old_rec->vlan_id_exists && old_rec->vlan_id > 2)
+			vlan_count--;
+	} else {
 		LOG(ERR, "netifd_del_inet_conf: Error during destruction of interface %s.",
 				old_rec->if_name);
 	}
--- a/feeds/wlan-ap/opensync/src/platform/openwrt/src/netifd/src/inet_iface.c
+++ b/feeds/wlan-ap/opensync/src/platform/openwrt/src/netifd/src/inet_iface.c
@@ -24,8 +24,6 @@ struct netifd_iface *netifd_iface_get_by_name(char *_ifname)
 	if (piface != NULL)
 		return piface;

-	LOG(ERR, "netifd_iface_get_by_name: Couldn't find the interface(%s)", ifname);
-
 	return NULL;
 }

@@ -102,7 +100,7 @@ inet_base_t *netifd_iface_new_inet(const char *ifname, const char *iftype)
 		goto error;
 	}
 	memset(self, 0, sizeof(inet_base_t));
-	if((!strcmp(ifname, "wan") && !strcmp(iftype,"bridge")) || (!strcmp(ifname, "lan") && !strcmp(iftype,"bridge"))) {
+	if(!strcmp(iftype,"bridge")) {
 		snprintf(self->inet.in_ifname, sizeof(self->inet.in_ifname), "br-%s", ifname);
 	} else if (!strcmp(iftype,"vlan")) {
 		char name[15]= {};
--- a/feeds/wlan-ap/opensync/src/platform/openwrt/src/netifd/src/wifi_inet_config.c
+++ b/feeds/wlan-ap/opensync/src/platform/openwrt/src/netifd/src/wifi_inet_config.c
@@ -368,16 +368,14 @@ static void callback_Wifi_Inet_Config(ovsdb_update_monitor_t *mon,
 			       struct schema_Wifi_Inet_Config *old_rec,
 			       struct schema_Wifi_Inet_Config *iconf)
 {
-	struct netifd_iface *piface = NULL;
-
 	switch (mon->mon_type) {
 	case OVSDB_UPDATE_NEW:
 		wifi_inet_conf_add(iconf);
-		piface = netifd_add_inet_conf(iconf);
+		netifd_add_inet_conf(iconf);
 		break;
 	case OVSDB_UPDATE_MODIFY:
 		wifi_inet_conf_add(iconf);
-		piface = netifd_modify_inet_conf(iconf);
+		netifd_modify_inet_conf(iconf);
 		break;
 	case OVSDB_UPDATE_DEL:
 		wifi_inet_conf_del(old_rec);
@@ -387,12 +385,6 @@ static void callback_Wifi_Inet_Config(ovsdb_update_monitor_t *mon,
 		LOG(ERR, "Invalid Wifi_Inet_Config mon_type(%d)", mon->mon_type);
 	}

-	if(!piface) {
-		LOG(ERR, "callback_Wifi_Inet_Config: Couldn't get the netifd interface(%s)",
-				iconf->if_name);
-		return;
-	}
-
 	return;
 }

--- a/feeds/wlan-ap/opensync/src/platform/openwrt/src/rrm/src/rrm_channel.c
+++ b/feeds/wlan-ap/opensync/src/platform/openwrt/src/rrm/src/rrm_channel.c
@@ -131,7 +131,7 @@ void rrm_nf_timer_handler(struct ev_loop *loop, ev_timer *timer, int revents)
 		if (nf < rrm_config->rrm_data.noise_lwm )
 		{
 			rrm_config->rrm_data.noise_lwm = nf;
-			LOGN("[%s] noise_lwm set to %d", radio->config.if_name, nf);
+			LOGD("[%s] noise_lwm set to %d", radio->config.if_name, nf);
 			continue;
 		}

@@ -144,7 +144,7 @@ void rrm_nf_timer_handler(struct ev_loop *loop, ev_timer *timer, int revents)
 		nf_drop_threshold = ((int32_t)(100 - rrm_config->rrm_data.snr_percentage_drop) *
 				rrm_config->rrm_data.noise_lwm) / 100;

-		LOGN("[%s] backup=%d nf=%d nf_lwm=%d drop=%d thresh=%d",
+		LOGD("[%s] backup=%d nf=%d nf_lwm=%d drop=%d thresh=%d",
 				radio->config.if_name,
 				rrm_config->rrm_data.backup_channel,
 				nf,
@@ -154,7 +154,7 @@ void rrm_nf_timer_handler(struct ev_loop *loop, ev_timer *timer, int revents)

 		if (nf > nf_drop_threshold)
 		{
-			LOGN("[%s] backup=%d nf=%d nf_lwm=%d drop=%d thresh=%d",
+			LOGD("[%s] backup=%d nf=%d nf_lwm=%d drop=%d thresh=%d",
 					radio->config.if_name,
 					rrm_config->rrm_data.backup_channel,
 					nf,
--- a/feeds/wlan-ap/opensync/src/src/lib/datapipeline/inc/dpp_events.h
+++ b/feeds/wlan-ap/opensync/src/src/lib/datapipeline/inc/dpp_events.h
@@ -13,6 +13,7 @@
 #define DPP_CLT_ID_LEN 129
 #define MAC_ADDRESS_STRING_LEN 17
 #define IP_ADDRESS_STRING_LEN 15
+#define IPV4_BYTES_LEN 4

 /* proto: EventType */
 typedef enum {
@@ -101,7 +102,7 @@ typedef struct {
 	radio_essid_t ssid;
 	sec_type_t sec_type;
 	bool fbt_used;
-	uint8_t ip_addr[16];
+	char ip_addr[IP_ADDRESS_STRING_LEN + 1];
 	char clt_id[DPP_CLT_ID_LEN];
 	int64_t ev_time_bootup_in_us_auth;
 	int64_t ev_time_bootup_in_us_assoc;
@@ -152,7 +153,7 @@ typedef struct {
 	char sta_mac[MAC_ADDRESS_STRING_LEN + 1];
 	uint64_t session_id;
 	uint64_t timestamp;
-	uint8_t ip_addr[16];
+	char ip_addr[IP_ADDRESS_STRING_LEN + 1];
 } dpp_event_record_ip_t;

 /* proto: ClientTimeoutEvent */
--- a/feeds/wlan-ap/opensync/src/src/sm/src/sm_events_report.c
+++ b/feeds/wlan-ap/opensync/src/src/sm/src/sm_events_report.c
@@ -157,7 +157,7 @@ static void sm_events_report(EV_P_ ev_timer *w, int revents)
 		report_ctx->channel_switch_list = g_event_report.channel_switch_list;

 	if (!ds_dlist_is_empty(&report_ctx->client_event_list) || !ds_dlist_is_empty(&report_ctx->channel_switch_list)) {
-		LOG(INFO, "Sending events report...");
+		LOG(DEBUG, "Sending events report...");
 		dpp_put_events(report_ctx);
 	}

--- a/feeds/wlan-ap/opensync/src/src/sm/src/ubus_collector.c
+++ b/feeds/wlan-ap/opensync/src/src/sm/src/ubus_collector.c
@@ -126,13 +126,13 @@ static int frequency_to_channel(int freq)
 static radio_type_t frequency_to_band(int freq)
 {
 	int chan = frequency_to_channel(freq);
-
+	/*Need to add support for differentiating between 5G,5GU and 5GL*/
 	if (chan <= 16)
 		return RADIO_TYPE_2G;
 	else if (chan >= 32 && chan <= 68)
-		return RADIO_TYPE_5GL;
+		return RADIO_TYPE_5G;
 	else if (chan >= 96)
-		return RADIO_TYPE_5GU;
+		return RADIO_TYPE_5G;
 	else
 		return RADIO_TYPE_NONE;
 }
@@ -615,7 +615,7 @@ static void ubus_collector_chan_switch_events_cb(struct ubus_request *req, int t
 	if (!msg)
 		return;

-	LOG(INFO, "ubus_collector: received ubus collector chan event message");
+	LOG(DEBUG, "ubus_collector: received ubus collector chan event message");

 	error = blobmsg_parse(ubus_collector_chan_switch_event_policy,
 			      __CHANNEL_SWITCH_EVENT_MAX, tb_chan_event_lst,
--- a/patches/0027-ipq807x-add-the-Qualcomm-AX-target-support.patch
+++ b/patches/0027-ipq807x-add-the-Qualcomm-AX-target-support.patch
@@ -5666,7 +5666,7 @@ index 0000000000..858d7e1aee
 +# CONFIG_SW_SYNC is not set
 +# CONFIG_FSL_MC_BUS is not set
 +# CONFIG_ALLOC_BUFFERS_IN_4K_CHUNKS is not set
-+# CONFIG_ALLOC_SKB_PAGE_FRAG_DISABLE is not set
+CONFIG_ALLOC_SKB_PAGE_FRAG_DISABLE=y
 +# CONFIG_MMAP_ALLOW_UNINITIALIZED is not set
 +# CONFIG_MAILBOX is not set
 +# CONFIG_MAILBOX_TEST is not set
@@ -5718,7 +5718,7 @@ index 0000000000..858d7e1aee
 +CONFIG_BRIDGE_VLAN_FILTERING=y
 +CONFIG_LEDS_GPIO=y
 +# CONFIG_ARCH_IPQ256M is not set
-+# CONFIG_SKB_FIXED_SIZE_2K is not set
+CONFIG_SKB_FIXED_SIZE_2K=y
 +CONFIG_IPQ_MEM_PROFILE=0
 +# CONFIG_VIRTIO_NET is not set
 +# CONFIG_QCA_85XX_SWITCH is not set
--- a/patches/0044-ipq807x-add-512MB-profile.patch
+++ b/patches/0044-ipq807x-add-512MB-profile.patch
@@ -0,0 +1,57 @@
+From a2ed0a77926c6fdca45677ee7698ceb04ab00eba Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Wed, 3 Mar 2021 10:31:57 +0100
+Subject: [PATCH] ipq807x: add 512MB profile
+
+Signed-off-by: John Crispin <john@phrozen.org>
+---
+ config/Config-kernel.in | 8 ++++++++
+ include/image.mk        | 6 +++++-
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/config/Config-kernel.in b/config/Config-kernel.in
+index eb61db542f..9197186b87 100644
+--- a/config/Config-kernel.in
+++ b/config/Config-kernel.in
+@@ -4,6 +4,14 @@
+ # See /LICENSE for more information.
+ #
+ 
+config KERNEL_IPQ_MEM_PROFILE
+	int "Different memory profile "
+	range 0 1024
+	default 0
+	help
+	  This option select memory profile to be used,which defines
+	  the reserved memory configuration used in device tree.
+
+ config KERNEL_BUILD_USER
+ 	string "Custom Kernel Build User Name"
+ 	default "builder" if BUILDBOT
+diff --git a/include/image.mk b/include/image.mk
+index a13f37f886..1d11387ec7 100644
+--- a/include/image.mk
+++ b/include/image.mk
+@@ -178,6 +178,10 @@ ifeq ($(strip $(call kernel_patchver_ge,4.18.0)),1)
+ 	-Wno-unique_unit_address
+ endif
+ 
+ifeq ($(CONFIG_IPQ_MEM_PROFILE),512)
+DTC_CFLAGS = -D __IPQ_MEM_PROFILE_512_MB__
+endif
+
+ # $(1) source dts file
+ # $(2) target dtb file
+ # $(3) extra CPP flags
+@@ -187,7 +191,7 @@ define Image/BuildDTB
+ 		-I$(DTS_DIR) \
+ 		-I$(DTS_DIR)/include \
+ 		-I$(LINUX_DIR)/include/ \
+-		-undef -D__DTS__ $(3) \
+		-undef -D__DTS__ $(DTC_CFLAGS) $(3) \
+ 		-o $(2).tmp $(1)
+ 	$(LINUX_DIR)/scripts/dtc/dtc -O dtb \
+ 		-i$(dir $(1)) $(DTC_FLAGS) $(4) \
+-- 
+2.25.1
+
--- a/patches/0045-tp-link-ex447-ex227-factory-Nand-images.patch
+++ b/patches/0045-tp-link-ex447-ex227-factory-Nand-images.patch
@@ -0,0 +1,70 @@
+From 57a733a35f7727d2e1b786e4270de7d593d90614 Mon Sep 17 00:00:00 2001
+From: Chaitanya Godavarthi <chaitanya.kiran@netexperience.com>
+Date: Fri, 12 Mar 2021 15:39:20 -0500
+Subject: [PATCH] openwrt: Generate factory Nand images for tp-link EX447 and
+ EX227
+
+Generate factory nand images for tp-link ex447 and ex227.
+This image is used to flash for migrating from stock qsdk
+image to tip openwrt image using the nand flash.
+---
+ target/linux/ipq807x/base-files/lib/upgrade/platform.sh | 8 ++++----
+ target/linux/ipq807x/image/ipq807x.mk                   | 6 ++++--
+ 2 files changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/target/linux/ipq807x/base-files/lib/upgrade/platform.sh b/target/linux/ipq807x/base-files/lib/upgrade/platform.sh
+index 9a5538aee3..59d1578925 100755
+--- a/target/linux/ipq807x/base-files/lib/upgrade/platform.sh
+++ b/target/linux/ipq807x/base-files/lib/upgrade/platform.sh
+@@ -43,9 +43,7 @@ platform_do_upgrade() {
+ 
+ 	board=$(board_name)
+ 	case $board in
+-	cig,wf188|\
+-	tplink,ex227|\
+-	tplink,ex447)
+	cig,wf188)
+ 		qca_do_upgrade $1
+ 		;;
+ 	cig,wf188n|\
+@@ -53,7 +51,9 @@ platform_do_upgrade() {
+ 	edgecore,eap102|\
+ 	qcom,ipq6018-cp01|\
+ 	qcom,ipq807x-hk01|\
+-	sercomm,wallaby)
+	sercomm,wallaby|\
+	tplink,ex447|\
+	tplink,ex227)
+ 		nand_upgrade_tar "$1"
+ 		;;
+ 	edgecore,eap101)
+diff --git a/target/linux/ipq807x/image/ipq807x.mk b/target/linux/ipq807x/image/ipq807x.mk
+index 8f9cda14a3..a41097e08e 100644
+--- a/target/linux/ipq807x/image/ipq807x.mk
+++ b/target/linux/ipq807x/image/ipq807x.mk
+@@ -50,9 +50,10 @@ define Device/tplink_ex227
+   DEVICE_DTS_CONFIG=config@hk07
+   SUPPORTED_DEVICES := tplink,ex227
+   DEVICE_PACKAGES := ath11k-wifi-tplink-ex227
+-  IMAGES := sysupgrade.tar nor-factory.bin
+  IMAGES := sysupgrade.tar nor-factory.bin nand-factory.bin
+   IMAGE/sysupgrade.tar/squashfs := append-rootfs | pad-rootfs | sysupgrade-tar rootfs=$$$$@ | append-metadata
+   IMAGE/nor-factory.bin := qsdk-ipq-factory-nor
+  IMAGE/nand-factory.bin := append-ubi | qsdk-ipq-factory-nand
+ endef
+ TARGET_DEVICES += tplink_ex227
+ 
+@@ -62,8 +63,9 @@ define Device/tplink_ex447
+   DEVICE_DTS_CONFIG=config@hk09
+   SUPPORTED_DEVICES := tplink,ex447
+   DEVICE_PACKAGES := ath11k-wifi-tplink-ex447
+-  IMAGES := sysupgrade.tar nor-factory.bin
+  IMAGES := sysupgrade.tar nor-factory.bin nand-factory.bin
+   IMAGE/sysupgrade.tar/squashfs := append-rootfs | pad-rootfs | sysupgrade-tar rootfs=$$$$@ | append-metadata
+   IMAGE/nor-factory.bin := qsdk-ipq-factory-nor
+  IMAGE/nand-factory.bin := append-ubi | qsdk-ipq-factory-nand
+ endef
+ TARGET_DEVICES += tplink_ex447
+-- 
+2.25.1
+
--- a/patches/0046-Remove-NOR-factory-support-for-tplink-ex227.patch
+++ b/patches/0046-Remove-NOR-factory-support-for-tplink-ex227.patch
@@ -0,0 +1,41 @@
+From 2db87512962f81c6e6e9482136f0b17867ff0e6c Mon Sep 17 00:00:00 2001
+From: Chaitanya Godavarthi <chaitanya.kiran@netexperience.com>
+Date: Fri, 19 Mar 2021 10:37:11 -0400
+Subject: [PATCH] openwrt: Remove NOR factory support for tplink ex227/ex447
+
+Remove NOR factory support for tplink ex227/ex447
+as now its switched to nand based.
+
+Signed-off-by: Chaitanya Godavarthi <chaitanya.kiran@netexperience.com>
+---
+ target/linux/ipq807x/image/ipq807x.mk | 8 --------
+ 1 file changed, 8 deletions(-)
+
+diff --git a/target/linux/ipq807x/image/ipq807x.mk b/target/linux/ipq807x/image/ipq807x.mk
+index a41097e08e..65bf99dd9c 100644
+--- a/target/linux/ipq807x/image/ipq807x.mk
+++ b/target/linux/ipq807x/image/ipq807x.mk
+@@ -50,10 +50,6 @@ define Device/tplink_ex227
+   DEVICE_DTS_CONFIG=config@hk07
+   SUPPORTED_DEVICES := tplink,ex227
+   DEVICE_PACKAGES := ath11k-wifi-tplink-ex227
+-  IMAGES := sysupgrade.tar nor-factory.bin nand-factory.bin
+-  IMAGE/sysupgrade.tar/squashfs := append-rootfs | pad-rootfs | sysupgrade-tar rootfs=$$$$@ | append-metadata
+-  IMAGE/nor-factory.bin := qsdk-ipq-factory-nor
+-  IMAGE/nand-factory.bin := append-ubi | qsdk-ipq-factory-nand
+ endef
+ TARGET_DEVICES += tplink_ex227
+ 
+@@ -63,9 +59,5 @@ define Device/tplink_ex447
+   DEVICE_DTS_CONFIG=config@hk09
+   SUPPORTED_DEVICES := tplink,ex447
+   DEVICE_PACKAGES := ath11k-wifi-tplink-ex447
+-  IMAGES := sysupgrade.tar nor-factory.bin nand-factory.bin
+-  IMAGE/sysupgrade.tar/squashfs := append-rootfs | pad-rootfs | sysupgrade-tar rootfs=$$$$@ | append-metadata
+-  IMAGE/nor-factory.bin := qsdk-ipq-factory-nor
+-  IMAGE/nand-factory.bin := append-ubi | qsdk-ipq-factory-nand
+ endef
+ TARGET_DEVICES += tplink_ex447
+-- 
+2.25.1
+
--- a/patches/0047-openwrt-Revert-UBUS-pending-list-iteration-method.patch
+++ b/patches/0047-openwrt-Revert-UBUS-pending-list-iteration-method.patch
@@ -0,0 +1,47 @@
+From 23be9eda1f87b77a772d24510d7096c565021e16 Mon Sep 17 00:00:00 2001
+From: Chaitanya Godavarthi <chaitanya.kiran@netexperience.com>
+Date: Mon, 29 Mar 2021 19:22:55 -0400
+Subject: [PATCH] openwrt: Revert UBUS pending list iteration method
+
+This commit partially reverts the earlier patch:
+"workaround possibly false positive uses of memory after it is freed"
+
+This fixed the crash while freeing a list item in
+ubus_process_pending_msg due to a double free.
+
+Signed-off-by: Chaitanya Godavarthi <chaitanya.kiran@netexperience.com>
+---
+ ...revert-pending-list-iteration-method.patch | 21 +++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+ create mode 100644 package/system/ubus/patches/revert-pending-list-iteration-method.patch
+
+diff --git a/package/system/ubus/patches/revert-pending-list-iteration-method.patch b/package/system/ubus/patches/revert-pending-list-iteration-method.patch
+new file mode 100644
+index 0000000000..ccc13fd9f2
+--- /dev/null
+++ b/package/system/ubus/patches/revert-pending-list-iteration-method.patch
+@@ -0,0 +1,21 @@
+Index: ubus-2019-12-27-041c9d1c/libubus.c
+===================================================================
+--- ubus-2019-12-27-041c9d1c.orig/libubus.c
++++ ubus-2019-12-27-041c9d1c/libubus.c
+@@ -115,12 +115,11 @@ ubus_process_msg(struct ubus_context *ct
+ static void ubus_process_pending_msg(struct uloop_timeout *timeout)
+ {
+ 	struct ubus_context *ctx = container_of(timeout, struct ubus_context, pending_timer);
+-	struct ubus_pending_msg *pending, *tmp;
+-
+-	list_for_each_entry_safe(pending, tmp, &ctx->pending, list) {
+-		if (ctx->stack_depth)
+-			break;
++
++	struct ubus_pending_msg *pending;
+
++	while (!ctx->stack_depth && !list_empty(&ctx->pending)) {
++		pending = list_first_entry(&ctx->pending, struct ubus_pending_msg, list);
+ 		list_del(&pending->list);
+ 		ubus_process_msg(ctx, &pending->hdr, -1);
+ 		free(pending);
+--
+2.25.1
+
--- a/patches/0048-Add-ESMT-nand-support.patch
+++ b/patches/0048-Add-ESMT-nand-support.patch
@@ -0,0 +1,59 @@
+From 71f57ba133f983f059fc4daacb4bec67fb35cc09 Mon Sep 17 00:00:00 2001
+From: Chaitanya Godavarthi <chaitanya.kiran@netexperience.com>
+Date: Tue, 30 Mar 2021 08:59:14 -0400
+Subject: [PATCH] Add ESMT nand support
+
+Add ESMT nand support
+
+Signed-off-by: Chaitanya Godavarthi <chaitanya.kiran@netexperience.com>
+---
+ .../ipq807x/patches/110-add-esmt-nand.patch   | 37 +++++++++++++++++++
+ 1 file changed, 37 insertions(+)
+ create mode 100644 target/linux/ipq807x/patches/110-add-esmt-nand.patch
+
+diff --git a/target/linux/ipq807x/patches/110-add-esmt-nand.patch b/target/linux/ipq807x/patches/110-add-esmt-nand.patch
+new file mode 100644
+index 0000000000..d47a4d0d16
+--- /dev/null
+++ b/target/linux/ipq807x/patches/110-add-esmt-nand.patch
+@@ -0,0 +1,37 @@
+Index: linux-4.4.60-qsdk-10fd7d14853b7020b804acae690c8acec5d954ce/drivers/mtd/nand/nand_ids.c
+===================================================================
+--- linux-4.4.60-qsdk-10fd7d14853b7020b804acae690c8acec5d954ce.orig/drivers/mtd/nand/nand_ids.c
++++ linux-4.4.60-qsdk-10fd7d14853b7020b804acae690c8acec5d954ce/drivers/mtd/nand/nand_ids.c
+@@ -62,6 +62,12 @@ struct nand_flash_dev nand_flash_ids[] =
+ 	{"TH58NYG3S0H 8G 1.8V 8-bit",
+ 		{ .id = {0x98, 0xa3, 0x91, 0x26} },
+ 		  SZ_4K, SZ_1K, SZ_256K, 0, 4, 256, NAND_ECC_INFO(8, SZ_512) },
++
++	{"F59D2G81KA 2G 1.8V 8-bit",
++		{ .id = {0xc8, 0x5a, 0x90, 0x04} },
++		SZ_2K, SZ_256, SZ_128K, 0, 4, 128, NAND_ECC_INFO(8, SZ_512) },
++
++
+ 	LEGACY_ID_NAND("NAND 4MiB 5V 8-bit",   0x6B, 4, SZ_8K, SP_OPTIONS),
+ 	LEGACY_ID_NAND("NAND 4MiB 3,3V 8-bit", 0xE3, 4, SZ_8K, SP_OPTIONS),
+ 	LEGACY_ID_NAND("NAND 4MiB 3,3V 8-bit", 0xE5, 4, SZ_8K, SP_OPTIONS),
+@@ -190,6 +196,7 @@ struct nand_manufacturers nand_manuf_ids
+ 	{NAND_MFR_SANDISK, "SanDisk"},
+ 	{NAND_MFR_INTEL, "Intel"},
+ 	{NAND_MFR_ATO, "ATO"},
++	{NAND_MFR_ESMT, "ESMT"},
+ 	{NAND_MFR_GIGA, "GigaDevice"},
+ 	{NAND_MFR_ATO, "ATO"},
+ 	{NAND_MFR_WINBOND, "Winbond"},
+Index: linux-4.4.60-qsdk-10fd7d14853b7020b804acae690c8acec5d954ce/include/linux/mtd/nand.h
+===================================================================
+--- linux-4.4.60-qsdk-10fd7d14853b7020b804acae690c8acec5d954ce.orig/include/linux/mtd/nand.h
++++ linux-4.4.60-qsdk-10fd7d14853b7020b804acae690c8acec5d954ce/include/linux/mtd/nand.h
+@@ -778,6 +778,7 @@ static inline struct mtd_info *nand_to_m
+ #define NAND_MFR_ATO		0x9b
+ #define NAND_MFR_WINBOND	0xef
+ #define NAND_MFR_FIDELIX	0xe5
++#define NAND_MFR_ESMT		0xc8
+ 
+ /* The maximum expected count of bytes in the NAND ID sequence */
+ #define NAND_MAX_ID_LEN 8
+-- 
+2.25.1
+
--- a/patches/0048-Fix-ssid-ratelimiting-in-wifi6-AP.patch
+++ b/patches/0048-Fix-ssid-ratelimiting-in-wifi6-AP.patch
@@ -0,0 +1,258 @@
+From 22c8d560c380cb3b188d2177c96121b9cd1835bd Mon Sep 17 00:00:00 2001
+From: Chaitanya Godavarthi <chaitanya.kiran@netexperience.com>
+Date: Sun, 4 Apr 2021 15:11:22 -0400
+Subject: [PATCH] Fix ssid ratelimiting in wifi6 AP
+
+This patch backports some fixes in
+netfilter ratelimiting module for linux v4.4.60.
+These fixes are ported from until following commit id
+6e323887565fe8a23c6c85faf9e395a24affd05c in
+the mainline kernel.
+
+Signed-off-by: Chaitanya Godavarthi <chaitanya.kiran@netexperience.com>
+---
+ .../patches/110-nf-ratelimit-fix.patch        | 232 ++++++++++++++++++
+ 1 file changed, 232 insertions(+)
+ create mode 100644 target/linux/ipq807x/patches/110-nf-ratelimit-fix.patch
+
+diff --git a/target/linux/ipq807x/patches/110-nf-ratelimit-fix.patch b/target/linux/ipq807x/patches/110-nf-ratelimit-fix.patch
+new file mode 100644
+index 0000000000..d4506944b8
+--- /dev/null
+++ b/target/linux/ipq807x/patches/110-nf-ratelimit-fix.patch
+@@ -0,0 +1,232 @@
+Index: linux-4.4.60-qsdk-10fd7d14853b7020b804acae690c8acec5d954ce/include/uapi/linux/netfilter/nf_tables.h
+===================================================================
+--- linux-4.4.60-qsdk-10fd7d14853b7020b804acae690c8acec5d954ce.orig/include/uapi/linux/netfilter/nf_tables.h
++++ linux-4.4.60-qsdk-10fd7d14853b7020b804acae690c8acec5d954ce/include/uapi/linux/netfilter/nf_tables.h
+@@ -761,6 +761,10 @@ enum nft_limit_type {
+ 	NFT_LIMIT_PKT_BYTES
+ };
+ 
++enum nft_limit_flags {
++        NFT_LIMIT_F_INV = (1 << 0),
++};
++
+ /**
+  * enum nft_limit_attributes - nf_tables limit expression netlink attributes
+  *
+@@ -768,6 +772,7 @@ enum nft_limit_type {
+  * @NFTA_LIMIT_UNIT: refill unit (NLA_U64)
+  * @NFTA_LIMIT_BURST: burst (NLA_U32)
+  * @NFTA_LIMIT_TYPE: type of limit (NLA_U32: enum nft_limit_type)
++ * @NFTA_LIMIT_FLAGS: flags (NLA_U32: enum nft_limit_flags)
+  */
+ enum nft_limit_attributes {
+ 	NFTA_LIMIT_UNSPEC,
+@@ -775,6 +780,8 @@ enum nft_limit_attributes {
+ 	NFTA_LIMIT_UNIT,
+ 	NFTA_LIMIT_BURST,
+ 	NFTA_LIMIT_TYPE,
++	NFTA_LIMIT_FLAGS,
++	NFTA_LIMIT_PAD,
+ 	__NFTA_LIMIT_MAX
+ };
+ #define NFTA_LIMIT_MAX		(__NFTA_LIMIT_MAX - 1)
+Index: linux-4.4.60-qsdk-10fd7d14853b7020b804acae690c8acec5d954ce/net/netfilter/nft_limit.c
+===================================================================
+--- linux-4.4.60-qsdk-10fd7d14853b7020b804acae690c8acec5d954ce.orig/net/netfilter/nft_limit.c
++++ linux-4.4.60-qsdk-10fd7d14853b7020b804acae690c8acec5d954ce/net/netfilter/nft_limit.c
+@@ -17,15 +17,15 @@
+ #include <linux/netfilter/nf_tables.h>
+ #include <net/netfilter/nf_tables.h>
+ 
+-static DEFINE_SPINLOCK(limit_lock);
+-
+ struct nft_limit {
++	spinlock_t	lock;
+ 	u64		last;
+ 	u64		tokens;
+ 	u64		tokens_max;
+ 	u64		rate;
+ 	u64		nsecs;
+ 	u32		burst;
++	bool		invert;
+ };
+ 
+ static inline bool nft_limit_eval(struct nft_limit *limit, u64 cost)
+@@ -33,7 +33,7 @@ static inline bool nft_limit_eval(struct
+ 	u64 now, tokens;
+ 	s64 delta;
+ 
+-	spin_lock_bh(&limit_lock);
++	spin_lock_bh(&limit->lock);
+ 	now = ktime_get_ns();
+ 	tokens = limit->tokens + now - limit->last;
+ 	if (tokens > limit->tokens_max)
+@@ -43,12 +43,12 @@ static inline bool nft_limit_eval(struct
+ 	delta = tokens - cost;
+ 	if (delta >= 0) {
+ 		limit->tokens = delta;
+-		spin_unlock_bh(&limit_lock);
+-		return false;
++		spin_unlock_bh(&limit->lock);
++		return limit->invert;
+ 	}
+ 	limit->tokens = tokens;
+-	spin_unlock_bh(&limit_lock);
+-	return true;
++	spin_unlock_bh(&limit->lock);
++	return !limit->invert;
+ }
+ 
+ static int nft_limit_init(struct nft_limit *limit,
+@@ -65,20 +65,31 @@ static int nft_limit_init(struct nft_lim
+ 	limit->nsecs = unit * NSEC_PER_SEC;
+ 	if (limit->rate == 0 || limit->nsecs < unit)
+ 		return -EOVERFLOW;
+-	limit->tokens = limit->tokens_max = limit->nsecs;
+-
+-	if (tb[NFTA_LIMIT_BURST]) {
+-		u64 rate;
+ 
++	if (tb[NFTA_LIMIT_BURST])
+ 		limit->burst = ntohl(nla_get_be32(tb[NFTA_LIMIT_BURST]));
++	else
++		limit->burst = 0;
++
++	if (limit->rate + limit->burst < limit->rate)
++		return -EOVERFLOW;
++
++	/* The token bucket size limits the number of tokens can be
++	 * accumulated. tokens_max specifies the bucket size.
++	 * tokens_max = unit * (rate + burst) / rate.
++	 */
++	limit->tokens = div_u64(limit->nsecs * (limit->rate + limit->burst),
++				limit->rate);
++	limit->tokens_max = limit->tokens;
+ 
+-		rate = limit->rate + limit->burst;
+-		if (rate < limit->rate)
+-			return -EOVERFLOW;
++	if (tb[NFTA_LIMIT_FLAGS]) {
++		u32 flags = ntohl(nla_get_be32(tb[NFTA_LIMIT_FLAGS]));
+ 
+-		limit->rate = rate;
++		if (flags & NFT_LIMIT_F_INV)
++			limit->invert = true;
+ 	}
+ 	limit->last = ktime_get_ns();
++	spin_lock_init(&limit->lock);
+ 
+ 	return 0;
+ }
+@@ -86,13 +97,14 @@ static int nft_limit_init(struct nft_lim
+ static int nft_limit_dump(struct sk_buff *skb, const struct nft_limit *limit,
+ 			  enum nft_limit_type type)
+ {
++	u32 flags = limit->invert ? NFT_LIMIT_F_INV : 0;
+ 	u64 secs = div_u64(limit->nsecs, NSEC_PER_SEC);
+-	u64 rate = limit->rate - limit->burst;
+ 
+-	if (nla_put_be64(skb, NFTA_LIMIT_RATE, cpu_to_be64(rate)) ||
++	if (nla_put_be64(skb, NFTA_LIMIT_RATE, cpu_to_be64(limit->rate)) ||
+ 	    nla_put_be64(skb, NFTA_LIMIT_UNIT, cpu_to_be64(secs)) ||
+ 	    nla_put_be32(skb, NFTA_LIMIT_BURST, htonl(limit->burst)) ||
+-	    nla_put_be32(skb, NFTA_LIMIT_TYPE, htonl(type)))
++	    nla_put_be32(skb, NFTA_LIMIT_TYPE, htonl(type)) ||
++	    nla_put_be32(skb, NFTA_LIMIT_FLAGS, htonl(flags)))
+ 		goto nla_put_failure;
+ 	return 0;
+ 
+@@ -120,6 +132,7 @@ static const struct nla_policy nft_limit
+ 	[NFTA_LIMIT_UNIT]	= { .type = NLA_U64 },
+ 	[NFTA_LIMIT_BURST]	= { .type = NLA_U32 },
+ 	[NFTA_LIMIT_TYPE]	= { .type = NLA_U32 },
++	[NFTA_LIMIT_FLAGS]	= { .type = NLA_U32 },
+ };
+ 
+ static int nft_limit_pkts_init(const struct nft_ctx *ctx,
+@@ -133,7 +146,7 @@ static int nft_limit_pkts_init(const str
+ 	if (err < 0)
+ 		return err;
+ 
+-	priv->cost = div_u64(priv->limit.nsecs, priv->limit.rate);
++	priv->cost = div64_u64(priv->limit.nsecs, priv->limit.rate);
+ 	return 0;
+ }
+ 
+@@ -153,40 +166,40 @@ static const struct nft_expr_ops nft_lim
+ 	.dump		= nft_limit_pkts_dump,
+ };
+ 
+-static void nft_limit_pkt_bytes_eval(const struct nft_expr *expr,
+-				     struct nft_regs *regs,
+-				     const struct nft_pktinfo *pkt)
++static void nft_limit_bytes_eval(const struct nft_expr *expr,
++				 struct nft_regs *regs,
++				 const struct nft_pktinfo *pkt)
+ {
+ 	struct nft_limit *priv = nft_expr_priv(expr);
+-	u64 cost = div_u64(priv->nsecs * pkt->skb->len, priv->rate);
++	u64 cost = div64_u64(priv->nsecs * pkt->skb->len, priv->rate);
+ 
+ 	if (nft_limit_eval(priv, cost))
+ 		regs->verdict.code = NFT_BREAK;
+ }
+ 
+-static int nft_limit_pkt_bytes_init(const struct nft_ctx *ctx,
+-				    const struct nft_expr *expr,
+-				    const struct nlattr * const tb[])
++static int nft_limit_bytes_init(const struct nft_ctx *ctx,
++				const struct nft_expr *expr,
++				const struct nlattr * const tb[])
+ {
+ 	struct nft_limit *priv = nft_expr_priv(expr);
+ 
+ 	return nft_limit_init(priv, tb);
+ }
+ 
+-static int nft_limit_pkt_bytes_dump(struct sk_buff *skb,
+-				    const struct nft_expr *expr)
++static int nft_limit_bytes_dump(struct sk_buff *skb,
++				const struct nft_expr *expr)
+ {
+ 	const struct nft_limit *priv = nft_expr_priv(expr);
+ 
+ 	return nft_limit_dump(skb, priv, NFT_LIMIT_PKT_BYTES);
+ }
+ 
+-static const struct nft_expr_ops nft_limit_pkt_bytes_ops = {
++static const struct nft_expr_ops nft_limit_bytes_ops = {
+ 	.type		= &nft_limit_type,
+ 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_limit)),
+-	.eval		= nft_limit_pkt_bytes_eval,
+-	.init		= nft_limit_pkt_bytes_init,
+-	.dump		= nft_limit_pkt_bytes_dump,
++	.eval		= nft_limit_bytes_eval,
++	.init		= nft_limit_bytes_init,
++	.dump		= nft_limit_bytes_dump,
+ };
+ 
+ static const struct nft_expr_ops *
+@@ -200,7 +213,7 @@ nft_limit_select_ops(const struct nft_ct
+ 	case NFT_LIMIT_PKTS:
+ 		return &nft_limit_pkts_ops;
+ 	case NFT_LIMIT_PKT_BYTES:
+-		return &nft_limit_pkt_bytes_ops;
++		return &nft_limit_bytes_ops;
+ 	}
+ 	return ERR_PTR(-EOPNOTSUPP);
+ }
+Index: linux-4.4.60-qsdk-10fd7d14853b7020b804acae690c8acec5d954ce/net/bridge/br_private.h
+===================================================================
+--- linux-4.4.60-qsdk-10fd7d14853b7020b804acae690c8acec5d954ce.orig/net/bridge/br_private.h
++++ linux-4.4.60-qsdk-10fd7d14853b7020b804acae690c8acec5d954ce/net/bridge/br_private.h
+@@ -926,9 +926,6 @@ BR_HOOK(uint8_t pf, unsigned int hook, s
+ 	struct sk_buff *skb, struct net_device *in, struct net_device *out,
+ 	int (*okfn)(struct net *, struct sock *, struct sk_buff *))
+ {
+-	if (!br_netfilter_run_hooks())
+-		return okfn(net, sk, skb);
+-
+ 	return NF_HOOK(pf, hook, net, sk, skb, in, out, okfn);
+ }
+ 
+-- 
+2.25.1
+
--- a/patches/0049-openwrt-Add-ubi-images-for-ex227-ex447.patch
+++ b/patches/0049-openwrt-Add-ubi-images-for-ex227-ex447.patch
@@ -0,0 +1,38 @@
+From 2fa0a5779dbc4a614b19cc690a8fa14f1ca33b33 Mon Sep 17 00:00:00 2001
+From: Chaitanya Godavarthi <chaitanya.kiran@netexperience.com>
+Date: Thu, 1 Apr 2021 15:05:13 -0400
+Subject: [PATCH] openwrt: Add ubi images for ex227, ex447
+
+Add ubi images for ex227, ex447
+---
+ target/linux/ipq807x/image/ipq807x.mk | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/target/linux/ipq807x/image/ipq807x.mk b/target/linux/ipq807x/image/ipq807x.mk
+index 65bf99dd9c..7081769407 100644
+--- a/target/linux/ipq807x/image/ipq807x.mk
+++ b/target/linux/ipq807x/image/ipq807x.mk
+@@ -50,6 +50,10 @@ define Device/tplink_ex227
+   DEVICE_DTS_CONFIG=config@hk07
+   SUPPORTED_DEVICES := tplink,ex227
+   DEVICE_PACKAGES := ath11k-wifi-tplink-ex227
+  IMAGES := sysupgrade.tar nand-factory.bin nand-factory.ubi
+  IMAGE/sysupgrade.tar := sysupgrade-tar | append-metadata
+  IMAGE/nand-factory.bin := append-ubi | qsdk-ipq-factory-nand
+  IMAGE/nand-factory.ubi := append-ubi
+ endef
+ TARGET_DEVICES += tplink_ex227
+ 
+@@ -59,5 +63,9 @@ define Device/tplink_ex447
+   DEVICE_DTS_CONFIG=config@hk09
+   SUPPORTED_DEVICES := tplink,ex447
+   DEVICE_PACKAGES := ath11k-wifi-tplink-ex447
+  IMAGES := sysupgrade.tar nand-factory.bin nand-factory.ubi
+  IMAGE/sysupgrade.tar := sysupgrade-tar | append-metadata
+  IMAGE/nand-factory.bin := append-ubi | qsdk-ipq-factory-nand
+  IMAGE/nand-factory.ubi := append-ubi
+ endef
+ TARGET_DEVICES += tplink_ex447
+-- 
+2.25.1
+
--- a/profiles/wifi-ax.yml
+++ b/profiles/wifi-ax.yml
@@ -5,3 +5,6 @@ feeds:
    path: ../../feeds/wifi-ax
 packages:
  - wireless-regdb
+diffconfig: |
+  CONFIG_KERNEL_IPQ_MEM_PROFILE=512
+
--- a/profiles/wlan-ap.yml
+++ b/profiles/wlan-ap.yml
@@ -90,6 +90,7 @@ diffconfig: |
  CONFIG_OPENSSL_WITH_SRP=y
  CONFIG_OPENSSL_WITH_TLS13=y
  # CONFIG_PACKAGE_wpad-basic is not set
+  # CONFIG_PACKAGE_wpad is not set
  # CONFIG_PACKAGE_dnsmasq is not set 
  CONFIG_IMAGEOPT=y
  CONFIG_PREINITOPT=y
Author	SHA1	Message	Date
Chaitanya Godavarthi	077009a263	Fix ssid ratelimiting in wifi6 AP This patch backports some fixes in netfilter ratelimiting kernel module for wifi6 (linux v4.4.60). These fixes are ported from until following commit id 6e323887565fe8a23c6c85faf9e395a24affd05c in the mainline kernel. Also, fix bugs in client ratelimiting. Per Client Ratelimiting will be used henceforth instead of Per ssid Ratelimiting. Signed-off-by: Chaitanya Godavarthi <chaitanya.kiran@netexperience.com>	2021-04-08 09:49:42 -04:00
Chaitanya Godavarthi	5feaee3327	Add ESMT Nand support and ubi imgs Add ESMT Nand support, required for ex227/ex447 Add ubi images for ex227, ex447 Signed-off-by: Chaitanya Godavarthi <chaitanya.kiran@netexperience.com>	2021-04-06 09:09:26 -04:00
ravi vaishnav	077e1cda3c	Wifi-1720. Fix for the neighbor scan failure on wifi6 APs. Tested on WF188n (wifi6) and ECW5211 (wifi5) and EA8300 (wifi5) APs. Checked for the scan results in EquipmentScanDetails event on the cloud. Signed-off-by: ravi vaishnav <ravi.vaishnav@netexperience.com>	2021-04-06 09:00:31 -04:00
Chaitanya Godavarthi	9cb289b605	openwrt: Revert UBUS pending list iteration method This commit partially reverts the earlier patch: "workaround possibly false positive uses of memory after it is freed" This fixed the crash while freeing a list item in ubus_process_pending_msg due to a double free. Signed-off-by: Chaitanya Godavarthi <chaitanya.kiran@netexperience.com>	2021-03-30 16:09:42 +02:00
Yashvardhan	bc9f8ba1a7	opensync: Fix buffer overflow Fix for buffer overflow happening during VIF state update. Signed-off-by: Yashvardhan <yashvardhan@netexperience.com>	2021-03-29 17:03:47 +02:00
Yashvardhan	97632b83d6	wifi-1514 Fix IpEvent IP address reporting Added missing reporting of IP Address in protobuf Signed-off-by: Yashvardhan <yashvardhan@netexperience.com>	2021-03-25 08:56:01 -04:00
Yashvardhan	9d7beae903	wifi-1737: Restrict DHCP Sniffing to a max of 4 vlans Partial fix for wifi-1737: Use of current DHCP sniffing library from opensync increases memory footprint of nm with increased number of vlans. This patch restricts DHCP sniffing on a maximum of 4 vlans. This is a workaround and actual fix would be to use a better packet filter such as eBPF Signed-off-by: Yashvardhan <yashvardhan@netexperience.com>	2021-03-24 14:14:54 -04:00
Nagendrababu	ea470687cc	WIFI-1716-Noisy-Logs This Patch will clean up the moisy logs in the Opensync target layer software Signed-off-by: Nagendrababu <nagendrababu.bonkuri@connectus.ai>	2021-03-23 17:21:52 -04:00
Arif Alam	153e459040	WIFI-1860 fix wpa3 config on wifi6 APs Enable sae compile option for wifi6 hostapd. Signed-off-by: Arif Alam <arif.alam@netexperience.com>	2021-03-23 17:15:53 -04:00
Chaitanya Godavarthi	a9665a0d32	openwrt: Remove NOR factory image for tplink-ex447/ex227 Remove NOR factory image for tplink-ex447/ex227 as now its switched to nand based image. Signed-off-by: Chaitanya Godavarthi <chaitanya.kiran@netexperience.com>	2021-03-22 12:11:42 -04:00
Arif Alam	debb9aad7f	opensync: add radius nas ip config Add functionality to configure nas ip. Fixes: WIFI-1715 Signed-off-by: Arif Alam <arif.alam@netexperience.com>	2021-03-22 12:08:08 -04:00
Nagendrababu	58793d4349	uci file unload for captive portal This patch will improve the code for captive portal feature Signed-off-by: Nagendrababu <nagendrababu.bonkuri@connectus.ai>	2021-03-22 11:55:48 -04:00
Yashvardhan	c7157c7e9d	wifi-1857: Remove redundant nl request to fetch the current channel A netlink request to fetch the current channel was leading to a race condition. Since the current channel is already reported by nl events, the redundant code is removed. Signed-off-by: Yashvardhan <yashvardhan@netexperience.com>	2021-03-19 12:04:16 -04:00
Chaitanya Godavarthi	068a6b787a	opensync: Fix redirector update Fix redirector update issue, redirector occassionally doesnt update in the system file. Signed-off-by: Chaitanya Godavarthi <chaitanya.kiran@netexperience.com>	2021-03-18 19:38:04 -04:00
Arif Alam	a886575bce	WIFI-1808: Fix interworking related parameter config Fixes various config params for passpoint. Signed-off-by: Arif Alam <arif.alam@netexperience.com>	2021-03-18 17:06:00 -04:00
John Crispin	8dd73a8c1c	ipq807x: disable coldboot of q6 core This was causing sporadic issues where the q6 did not reboot into proper runstate post coldboot calibration. Signed-off-by: John Crispin <john@phrozen.org>	2021-03-18 09:00:17 +01:00
Chaitanya Godavarthi	2cc526b379	openwrt: Nand images for tp-link EX447 and EX227 Generate factory nand images for tp-link ex447 and ex227. This image is used to flash for migrating from stock qsdk image to tip openwrt image using the nand flash. Signed-off-by: Chaitanya Godavarthi <chaitanya.kiran@netexperience.com>	2021-03-16 10:49:34 -04:00
Nagendrababu	56f51c8055	WIFI-1629 Captive Portal Service Portal Halt This patch will add the support to enable captive portal on multiple ssid's with same captive portal profile Signed-off-by: Nagendrababu <nagendrababu.bonkuri@connectus.ai>	2021-03-16 09:26:17 -04:00
Max Brenner	9598e68a2b	CI: trigger release build on Git tag push Build firmware packages when pushing a Git tag. Version string will be extracted from the tag name. Signed-off-by: Max Brenner <xamrennerb@gmail.com>	2021-03-15 15:02:41 -04:00
Yashvardhan	8d395d868f	Wifi-1742 Wifi6 hostapd: Enable hotspot2.0 configuration Signed-off-by: Yashvardhan <yashvardhan@netexperience.com>	2021-03-12 14:19:37 -05:00
ravi vaishnav	d2eaffae16	wifi-1614 Disable-TX_STBC-when-configuring-1x1 Added support to update the TX-STBC capability if only single Tx-antenna is available Signed-off-by: ravi vaishnav <ravi.vaishnav@netexperience.com>	2021-03-12 13:05:17 -05:00
Yashvardhan	ca7b766171	wifi-1704: Wifi6 Add missing hostapd patch for client events Added missing client events support to wifi6-hostapd Signed-off-by: Yashvardhan <yashvardhan@netexperience.com>	2021-03-11 19:38:03 -05:00
John Crispin	9d13fc7330	ipq807x: add 512MB profile This greatly improves the memory issues that we were seeing on QCA/AX. Signed-off-by: John Crispin <john@phrozen.org>	2021-03-11 16:31:13 +01:00
Rick Sommerville	34b495c94c	WIFI-1549 Fix Wifi6 SM crash Signed-off-by: Rick Sommerville <rick.sommerville@netexperience.com>	2021-03-09 11:44:40 -05:00
Ammad Rehmat	623afeafd3	Wifi-1666 : Fix for reflecting the actual channel value in wifi radio state Signed-off-by: Ammad Rehmat <ammad.rehmat@connectus.ai>	2021-03-08 18:42:09 -05:00
Yashvardhan	799d5bfe9b	wifi-1514: Fix SM crash Fix for Memory corruption observed in SM. This was also the cause for missing SSID and band reporting inside client events. Signed-off-by: Yashvardhan <yashvardhan@netexperience.com>	2021-03-04 13:03:47 -05:00
Chaitanya Godavarthi	5a57c8e2b1	opensync: Add Local power constraint radio option Add local_power_constraint radio params Signed-off-by: Chaitanya Godavarthi <chaitanya.kiran@netexperience.com>	2021-02-26 09:31:27 -05:00
Yashvardhan	685c25424a	Wifi-1470 Fix missing ip string to bytes conversion IP event protobuf expects ip address to be in the form of bytes. Added the missing conversion. Signed-off-by: Yashvardhan <yashvardhan@netexperience.com>	2021-02-26 09:21:02 -05:00
Yashvardhan	c6ebc8bec7	Wifi-1572 Repair VIF_State to show the correct number of associated clients This patch primarily reverts `fdf5bb6e96` (opensync: add average STA RSSI tracking). Netlink request to track STA RSSI every 10 secs was leading to a race condition because the receive callback for the request was also used to receive rest of the nl80211 events. This was resulting in lost messages and hence VIF State was not getting populated correctly. Now, the code to poll for STA RSSI in opensync is redundant and is not used because STA RSSI is already tracked in hostapd. Removing it solves the redundancy and the race. Signed-off-by: Yashvardhan <yashvardhan@netexperience.com>	2021-02-25 09:07:41 -05:00
Ammad Rehmat	79a65c2985	Wifi-1623 : Any event coming from hostapd with 5G frequency will be treated as coming from 5G radio not 5gU/5gL Signed-off-by: Ammad Rehmat <ammad.rehmat@connectus.ai>	2021-02-24 19:17:33 -05:00
Yashvardhan	00d39a0835	Wifi-1572 Increase nl socket buffer size Partial fix for Wifi-1572 Signed-off-by: Yashvardhan <yashvardhan@netexperience.com>	2021-02-24 15:09:25 -05:00
Rick Sommerville	d2873b935e	Wifi-1637 Configure max associate clients per radio Signed-off-by: Rick Sommerville <rick.sommerville@netexperience.com>	2021-02-23 20:54:32 -05:00
Nagendrababu	9215aac0f9	WIFI-1531-captive-portal-parameters-update-error This patch will fix latest parameters update error from captive portal profile Signed-off-by: Nagendrababu <nagendrababu.bonkuri@connectus.ai>	2021-02-23 19:57:52 -05:00
Nagendrababu	63e48453c8	WIFI-1543-EX447 MIMO configuration This patch will add support to detect the offset of the bitmask before configuring MIMO mode on AP Signed-off-by: Nagendrababu <nagendrababu.bonkuri@connectus.ai>	2021-02-23 15:43:23 -05:00