docs: document OpenWrt cfg80211 backport builds

27af5ad added the CFG80211_VERSION make variable for OpenWrt builds that use a newer mac80211 backport than the target kernel, but it is only described in a Makefile comment. Document how to pass it from an OpenWrt package Makefile, link the notes from the installation steps, and add the build script and the kernel/backports combinations verified for issue #94. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
fix: use monotonic snapshot versions for the Bazzite package
2026-09-26 17:44:16 +00:00 · 2026-09-24 14:59:53 +08:00 · 2026-09-24 14:03:17 +08:00 · 2026-09-24 13:42:37 +08:00 · 2026-09-24 13:38:13 +08:00 · 2026-09-24 13:25:15 +08:00
62 changed files with 999 additions and 1212 deletions
@@ -1,3 +1,7 @@
+fw/aic8800D80/*.txt text eol=lf
+fw/aic8800D80/*.bin binary
+fw/aic8800DC/*.txt text eol=lf
+fw/aic8800DC/*.bin binary
 /.gitattributes text eol=lf
 drivers/aic8800/aic_zlp_quirk/*.c text eol=lf
 drivers/aic8800/aic_zlp_quirk/Makefile text eol=lf
@@ -0,0 +1,67 @@
+# Building with OpenWrt backports
+
+OpenWrt's target kernel and wireless stack can have different versions.
+For example, [issue #94](https://github.com/shenmintao/aic8800d80/issues/94)
+uses Linux **6.12.94** with **backports 6.18.26** on OpenWrt 25.12.5.
+The Ubuntu build host's kernel version is not used to select these APIs.
+
+## Package Makefile
+
+Pass `CFG80211_VERSION=6.18.26` to the kernel make invocation for that
+combination. Use the `PKG_VERSION` from your OpenWrt
+`package/kernel/mac80211/Makefile`, in `major.minor.patch` format. Keep the
+backports include paths and symbol versions from the same build:
+
+```make
+NOSTDINC_FLAGS := \
+	$(KERNEL_NOSTDINC_FLAGS) \
+	-I$(STAGING_DIR)/usr/include/mac80211-backport/uapi \
+	-I$(STAGING_DIR)/usr/include/mac80211-backport \
+	-I$(STAGING_DIR)/usr/include/mac80211/uapi \
+	-I$(STAGING_DIR)/usr/include/mac80211 \
+	-include backport/backport.h
+
+define Build/Compile
+	+$(KERNEL_MAKE) $(PKG_JOBS) \
+		M="$(PKG_BUILD_DIR)/drivers/aic8800" \
+		KBUILD_EXTRA_SYMBOLS="$(LINUX_DIR)/../symvers/mac80211.symvers" \
+		NOSTDINC_FLAGS="$(NOSTDINC_FLAGS)" \
+		CFG80211_VERSION=6.18.26 \
+		modules
+endef
+```
+
+The package must depend on `kmod-cfg80211` so its headers and symbol versions
+are staged before this driver is built. Keep any additional dependencies,
+firmware installation rules and module packaging rules your device needs.
+Update the package's pinned source revision to one containing this fix, or
+apply the fix as an OpenWrt package patch, then clean and rebuild the package:
+
+```sh
+make package/kernel/aic8800d80/clean
+make package/kernel/aic8800d80/compile V=sc -j1
+```
+
+Changing `CFG80211_VERSION` alone does not update the driver source or the
+wireless headers. The value must match the actual wireless stack; do not set
+it to the host kernel version or redefine `LINUX_VERSION_CODE`.
+
+## Compatibility scope
+
+The override selects the wireless API changes since Linux 6.12, including
+monitor-channel callbacks, radio/link arguments, radar notifications and
+newer cfg80211 callbacks. Timer, USB, memory-management and module namespace
+checks continue to use the target kernel version. Older target kernels with
+newer backports may need additional wireless API adaptations.
+
+Leave `CFG80211_VERSION` unset when building against the kernel's own wireless
+stack, as on a regular Ubuntu/Debian installation. The driver then uses the
+kernel version as before. Hardware revision still determines whether to use
+`main` or `legacy-mcu1`; a wireless API mismatch does not change that choice.
+
+The feeds/Kconfig duplicate definitions and recursive dependencies also
+reported in issue #94 belong to the OpenWrt build configuration and require
+separate investigation.
+
+See the [build regression recipe](tests/openwrt-backports/README.md) for
+the tested kernel/backports combinations and a script to repeat the build.
@@ -1,34 +1,26 @@
 # AIC8800 Linux Wi-Fi and Bluetooth Driver
-This driver is for the AIC8800D80 chipset, supported by devices such as the Tenda U11 and AX913B.
+This driver supports AIC8800-family chipsets used by devices such as the Tenda U11, AX913B, and TP-Link Archer TX1U Nano.

-> [!IMPORTANT]
-> **Choose the branch for your hardware revision before installing.** If the
-> driver log reports `chip_id=7, chip_mcu_id=1` on an AIC8800D80 or
-> AIC8800DC/DW device, use the
-> [`legacy-mcu1`](https://github.com/shenmintao/aic8800d80/tree/legacy-mcu1)
-> branch. It contains the matched legacy firmware and loader profile required
-> to avoid the deterministic firmware upload timeout at `0x170400`. Use
-> `main` when `chip_mcu_id=0` or when the MCU revision is unknown.
+> **Legacy MCU revision 1 branch:** You are viewing `legacy-mcu1`. This branch
+> is only for AIC8800D80 or AIC8800DC/DW devices that report
+> `chip_id=7, chip_mcu_id=1`. It provides complete matched V3 firmware and
+> loader profiles for the D80 upload-limit failure validated in
+> [issue #58](https://github.com/shenmintao/aic8800d80/issues/58) and the DC/DW
+> V5 main-application timeout validated in
+> [issue #71](https://github.com/shenmintao/aic8800d80/issues/71). Use
+> [`main`](https://github.com/shenmintao/aic8800d80/tree/main) for newer
+> `chip_mcu_id=0` hardware or when the MCU revision is unknown. See the
+> [D80](tests/issue58-mcu1-legacy-fw/README.md) and
+> [DC/DW](tests/issue71-mcu1-v3-profile/README.md) support notes before installing.
 >
-> Hardware revision determines the firmware branch. MCU1 devices should use
-> `legacy-mcu1`, which also initializes Bluetooth for the
-> kernel's standard `btusb` driver. After switching branches, rerun
-> `sudo ./install.sh` and reboot; switching the Git branch alone does not
-> replace the firmware already installed under `/lib/firmware`.
+> After switching branches, rerun `sudo ./install.sh` and reboot; switching the
+> Git branch alone does not replace firmware already installed under
+> `/lib/firmware`.

 Added support for devices with Vendor ID 368B (tested).

 Tested on Linux kernel 6.16 with Ubuntu 25.04 and 6.1.0.27 with Debian 12.

-> [!NOTE]
-> **Bluetooth branch retirement:** The separate
-> [`bluetooth`](https://github.com/shenmintao/aic8800d80/tree/bluetooth) branch
-> is deprecated and is being kept only during the migration period. This
-> branch is the unified candidate for promotion to `main` in
-> [PR #73](https://github.com/shenmintao/aic8800d80/pull/73). After hardware
-> validation and promotion, the separate `bluetooth` branch will be removed.
-> MCU1 hardware must use `legacy-mcu1`.
-
 The same driver supports Wi-Fi-only adapters and Wi-Fi/Bluetooth combo
 adapters. On combo devices, `aic_load_fw` uploads the AIC firmware and the
 standard Linux `btusb` driver handles the Bluetooth HCI interface. The obsolete
@@ -41,14 +33,46 @@ the distribution's original `btusb.ko` installed and bound to the device. The
 quirk is filtered to that VID:PID and fails closed when the required kernel
 probe support is unavailable.

+> [!NOTE]
+> **Maintained branches:** This repository now maintains only `main` and
+> `legacy-mcu1`. You are viewing the branch for `chip_mcu_id=1`; do not switch
+> this hardware to the former separate `bluetooth` branch, which is retired.
+> Wi-Fi, the kernel's standard `btusb` Bluetooth path, and the device-scoped
+> `368b:8d81` ZLP support are integrated here. The ZLP module remains inactive
+> on other VID:PID combinations.
+
 ### Disclaimer
 I did not develop this software, The code is sourced from the Tenda U11 driver. I only made some modifications to the code to adapt it to newer kernel versions. Apart from compilation issues, I am unable to address other problems.

 ### Attention
 Before installing the driver, delete all aic8800-related folders under /lib/firmware. Using an incorrect firmware version may cause the system to freeze.

+#### Pandora 88M80 mode switching
+
+Pandora 88M80 adapters that initially appear as USB device `1111:1111` are
+automatically switched to `a69c:8d80` by sending the required `F3` then `F2`
+commands. Existing users must rerun `sudo ./install.sh` to replace the installed
+usb_modeswitch configuration, then unplug the adapter completely and plug it
+back in.
+
+If automatic switching does not occur, try the same sequence manually:
+
+```bash
+sudo usb_modeswitch -v 1111 -p 1111 \
+  -M "555342438765432100000000000010fd0000000000000000000000000000f3" \
+  -2 "555342438765432100000000000010fd0000000000000000000000000000f2"
+```
+
+This only addresses switching from `1111:1111` to `a69c:8d80`. If the device
+has reached `a69c:8d80` but firmware startup still fails, see
+[issue #79](https://github.com/shenmintao/aic8800d80/issues/79).
+
 ### Installation Steps

+For OpenWrt SDK/buildroot builds, see [OpenWrt build notes](OPENWRT.md).
+OpenWrt can use a newer cfg80211 backport than its target kernel; these builds
+must pass the wireless stack version separately.
+
 #### Method 1: [Quick Installation](INSTALL_SCRIPT.md) (Recommended)

 #### Method 2: Manual Installation
@@ -1,5 +1,6 @@
 # AIC8800 USB mass-storage mode switch rules
 KERNEL=="sd*", ATTRS{idVendor}=="a69c", ATTRS{idProduct}=="5721",  SYMLINK+="aicudisk", RUN+="/usr/bin/eject /dev/%k"
+KERNEL=="sd*", ATTRS{idVendor}=="a69c", ATTRS{idProduct}=="5722",  SYMLINK+="aicudisk", RUN+="/usr/bin/eject /dev/%k"
 KERNEL=="sd*", ATTRS{idVendor}=="a69c", ATTRS{idProduct}=="5723",  SYMLINK+="tendaudisk", RUN+="/usr/bin/eject /dev/%k"
 KERNEL=="sd*", ATTRS{idVendor}=="a69c", ATTRS{idProduct}=="5724",  SYMLINK+="ugreenax900", RUN+="/usr/bin/eject /dev/%k"
 KERNEL=="sd*", ATTRS{idVendor}=="a69c", ATTRS{idProduct}=="5725",  SYMLINK+="tendaudiskv2", RUN+="/usr/bin/eject /dev/%k"
@@ -1,9 +1,14 @@
-%global commit 13baa9b0b1692f94233bcf6e752060b408062026
+%global commit c8327eab5be246d4b517afdba034775f00afa988
 %global shortcommit %(echo %{commit} | cut -c1-7)
+%global snapdate 20260924
+%global debug_package %{nil}
 %{!?kver:%global kver %(uname -r)}

 Name:           aic8800d80
-Version:        %{shortcommit}
+# Versions before 2026-09-24 were bare commit hashes, which rpm does not
+# order by commit history. Epoch 1 sorts every snapshot version after them.
+Epoch:          1
+Version:        1.0.0^%{snapdate}git%{shortcommit}
 Release:        1%{?dist}
 Summary:        AIC8800 USB Wi-Fi, Bluetooth firmware, and ZLP quirk driver

@@ -17,7 +22,7 @@ BuildRequires:  kernel-devel-uname-r = %{kver}

 Requires:       kernel-uname-r = %{kver}
 Requires:       /usr/bin/eject
-Requires:       /usr/sbin/usb_modeswitch
+Requires:       usb_modeswitch
 Requires(post): /usr/sbin/depmod
 Requires(postun): /usr/sbin/depmod

@@ -77,6 +82,25 @@ cp -a fw/aic8800* %{buildroot}/usr/lib/firmware/
 /usr/lib/firmware/aic8800*

 %changelog
+* Thu Sep 24 2026 Shen Mintao <shenmintao@gmail.com> - 1:1.0.0^20260924gitc8327ea-1
+- Version snapshots as 1.0.0^<date>git<commit> with Epoch 1. The previous
+  commit-hash versions do not sort in commit order, so rpm could treat a
+  newer snapshot as an older package.
+
+* Thu Sep 24 2026 Shen Mintao <shenmintao@gmail.com> - c8327ea-1
+- Build the current legacy-mcu1 branch, which carries the Linux 7.2
+  cfg80211 and strncpy() fixes needed to compile on Bazzite 44.
+- Include the monitor packet injection path and the 6.12 stable
+  set_monitor_channel() fix synchronized from main.
+
+* Wed Jul 29 2026 Shen Mintao <shenmintao@gmail.com> - 51b7b6e-2
+- Disable automatic debug package generation for Bazzite builds.
+- Require usb_modeswitch by package name for rpm-ostree dependency resolution.
+
+* Sat Jul 25 2026 Shen Mintao <shenmintao@gmail.com> - 51b7b6e-1
+- Package the unified installer and ZLP quirk with the legacy MCU1 profiles.
+- Preserve the matched D80 and DC/DW firmware and loader combinations.
+
 * Sat Jul 25 2026 Shen Mintao <shenmintao@gmail.com> - 13baa9b-1
 - Unify Wi-Fi and standard-btusb Bluetooth support in one package.
 - Add the device-scoped 368b:8d81 ACL bulk TX ZLP companion module.
@@ -61,8 +61,6 @@ endif

 ###########################################

-MAKEFLAGS +=-j$(shell nproc)
-
 KERNEL_AUTOCONF := $(KDIR)/include/config/auto.conf
 KERNEL_CONFIG := $(KDIR)/.config
 KERNEL_CC_IS_CLANG := $(shell if [ -r "$(KERNEL_AUTOCONF)" ] && grep -q '^CONFIG_CC_IS_CLANG=y' "$(KERNEL_AUTOCONF)"; then echo y; elif [ -r "$(KERNEL_CONFIG)" ] && grep -q '^CONFIG_CC_IS_CLANG=y' "$(KERNEL_CONFIG)"; then echo y; fi)
@@ -2,6 +2,16 @@ EXTRA_CFLAGS += $(USER_EXTRA_CFLAGS)
 EXTRA_CFLAGS += -Wno-implicit-fallthrough
 #EXTRA_CFLAGS += -Wno-unused-variable

+# OpenWrt may build a newer cfg80211 backport on an older kernel.
+# Set this to the wireless stack's version, e.g. CFG80211_VERSION=6.18.26.
+ifneq ($(strip $(CFG80211_VERSION)),)
+aicwf_cfg80211_version := $(subst ., ,$(CFG80211_VERSION))
+ifneq ($(words $(aicwf_cfg80211_version)),3)
+$(error CFG80211_VERSION must have the form major.minor.patch)
+endif
+ccflags-y += '-DAICWF_CFG80211_VERSION_CODE=KERNEL_VERSION($(word 1,$(aicwf_cfg80211_version)),$(word 2,$(aicwf_cfg80211_version)),$(word 3,$(aicwf_cfg80211_version)))'
+endif
+
 RWNX_VERS_NUM := 6.4.3.0

 CONFIG_AIC8800_WLAN_SUPPORT = m
@@ -74,7 +84,11 @@ CONFIG_VHT_FOR_OLD_KERNEL = n
 CONFIG_COEX = y
 CONFIG_ALIGN_8BYTES = y
 CONFIG_TXRX_THREAD_PRIO = y
+ifdef CONFIG_ARCH_SUN60IW2P1
+CONFIG_USB_ALIGN_DATA = n
+else
 CONFIG_USB_ALIGN_DATA = y
+endif
 CONFIG_RX_TASKLET = n
 CONFIG_TX_TASKLET = n
 CONFIG_RX_NETIF_RECV_SKB = y
@@ -88,7 +102,11 @@ CONFIG_WOWLAN ?= n
 CONFIG_USB_RX_AGGR = n
 CONFIG_USB_TX_AGGR = n

+ifdef CONFIG_ARCH_SUN60IW2P1
+CONFIG_USB_NO_TRANS_DMA_MAP = y
+else
 CONFIG_USB_NO_TRANS_DMA_MAP = n
+endif
 CONFIG_GPIO_WAKEUP = n
 CONFIG_CREATE_TRACE_POINTS = n
 CONFIG_SUPPORT_REALTIME_CHANGE_MAC = y
@@ -154,7 +172,7 @@ CONFIG_RWNX_BCMC ?= y

 # Enable Monitor+Data interface support (need FW support)
 CONFIG_RWNX_MON_DATA =n
-CONFIG_RWNX_MON_XMIT ?= n
+CONFIG_RWNX_MON_XMIT ?= y
 CONFIG_RWNX_MON_RXFILTER ?= n

 CONFIG_FILTER_TCP_ACK =y
@@ -349,8 +367,6 @@ ccflags-$(CONFIG_TEMP_CONTROL) += -DCONFIG_TEMP_CONTROL
 ccflags-$(CONFIG_POWER_LIMIT) += -DCONFIG_POWER_LIMIT
 ccflags-$(CONFIG_EXT_FEM_8800DCDW) += -DCONFIG_EXT_FEM_8800DCDW
 ccflags-$(CONFIG_WOWLAN) += -DCONFIG_WOWLAN
-MAKEFLAGS +=-j$(shell nproc)
-
 # Platform support list
 CONFIG_PLATFORM_ROCKCHIP ?= n
 CONFIG_PLATFORM_ALLWINNER ?= n
@@ -1832,7 +1832,7 @@ void set_vendor_extension_ie(char *command){

 }
 #endif//CONFIG_SET_VENDOR_EXTENSION_IE
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 13, 0))
+#ifdef AICWF_CFG80211_SET_MONITOR_CHANNEL_HAS_DEV
 int rwnx_cfg80211_set_monitor_channel_(struct wiphy *wiphy, struct net_device *dev,
                                             struct cfg80211_chan_def *chandef);
 #else
@@ -1840,7 +1840,7 @@ int rwnx_cfg80211_set_monitor_channel_(struct wiphy *wiphy,
                                             struct cfg80211_chan_def *chandef);
 #endif
 int rwnx_atoi2(char *value, int c_len);
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 13, 0))
+#ifdef AICWF_CFG80211_SET_MONITOR_CHANNEL_HAS_DEV
 void set_mon_chan(struct rwnx_vif *vif, struct net_device *dev, char *parameter)
 #else
 void set_mon_chan(struct rwnx_vif *vif, char *parameter)
@@ -1867,7 +1867,7 @@ void set_mon_chan(struct rwnx_vif *vif, char *parameter)
    chandef->center_freq1 = chandef->chan->center_freq;
    chandef->center_freq2 = 0;

-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 13, 0))
+#ifdef AICWF_CFG80211_SET_MONITOR_CHANNEL_HAS_DEV
    rwnx_cfg80211_set_monitor_channel_(vif->rwnx_hw->wiphy, dev, chandef);
 #else
    rwnx_cfg80211_set_monitor_channel_(vif->rwnx_hw->wiphy, chandef);
@@ -2136,7 +2136,7 @@ int android_priv_cmd(struct net_device *net, struct ifreq *ifr, int cmd)
 	    char *set_parameter;
        skip = strlen(CMD_SET_MON_FREQ) + 1;
 		set_parameter = command + skip;
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 13, 0))
+#ifdef AICWF_CFG80211_SET_MONITOR_CHANNEL_HAS_DEV
 	    set_mon_chan(vif, net, set_parameter);
 #else
 	    set_mon_chan(vif, set_parameter);
@@ -62,7 +62,7 @@ int get_cs_info(struct rwnx_vif *vif, u8 *mac_addr, u8 *val);
 unsigned int command_strtoul(const char *cp, char **endp, unsigned int base);
 int str_starts(const char *str, const char *start);
 int handle_private_cmd(struct net_device *net, char *command, u32 cmd_len);
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 13, 0))
+#ifdef AICWF_CFG80211_SET_MONITOR_CHANNEL_HAS_DEV
 void set_mon_chan(struct rwnx_vif *vif, struct net_device *dev, char *parameter);
 #else
 void set_mon_chan(struct rwnx_vif *vif, char *parameter);
@@ -40,7 +40,8 @@ int	rwnx_plat_userconfig_load_8800d80(struct rwnx_hw *rwnx_hw){
    char *filename = FW_USERCONFIG_NAME_8800D80;

 #ifndef ANDROID_PLATFORM
-            sprintf(aic_fw_path, "%s/%s", aic_fw_path, "aic8800D80");
+            if (strlcat(aic_fw_path, "/aic8800D80", sizeof(aic_fw_path)) >= sizeof(aic_fw_path))
+                return -ENAMETOOLONG;
 #endif

    AICWFDBG(LOGINFO, "userconfig file path:%s \r\n", filename);
@@ -41,7 +41,8 @@ int	rwnx_plat_userconfig_load_8800d80x2(struct rwnx_hw *rwnx_hw){
    char *filename = FW_USERCONFIG_NAME_8800D80X2;

 #ifndef ANDROID_PLATFORM
-    sprintf(aic_fw_path, "%s/%s", aic_fw_path, "aic8800D80X2");
+    if (strlcat(aic_fw_path, "/aic8800D80X2", sizeof(aic_fw_path)) >= sizeof(aic_fw_path))
+        return -ENAMETOOLONG;
 #endif

    AICWFDBG(LOGINFO, "userconfig file path:%s \r\n", filename);
@@ -45,6 +45,8 @@
 #define FW_USERCONFIG_NAME_8800DW         "aic_userconfig_8800dw.txt"
 #define FW_POWERLIMIT_NAME_8800DC         "aic_powerlimit_8800dc.txt"
 #define FW_POWERLIMIT_NAME_8800DW         "aic_powerlimit_8800dw.txt"
+#define FW_USERCONFIG_NAME_8800DW_W311    "aic_userconfig_8800dw_w311.txt"
+#define FW_USERCONFIG_NAME_8800DW_U2      "aic_userconfig_8800dw_u2.txt"

 #ifdef CONFIG_LOAD_BT_PATCH_IN_FDRV
 enum aicbt_patch_table_type {
@@ -167,7 +169,6 @@ u32 syscfg_tbl_masked_8800dc[][3] = {
    {0x700010A0, (0x1 << 11), (0x1 << 11)},
    {0x70001034, ((0x1 << 20) | (0x7 << 26)), ((0x0 << 20) | (0x2 << 26))},
    {0x70001038, (0x1 << 8), (0x1 << 8)},
-    {0x70001084, (0x3 << 13), (0x0 << 13)},
    {0x70001094, (0x3 << 2), (0x0 << 2)},
    {0x700021D0, ((0x1 << 5) | (0x1 << 6)), ((0x1 << 5) | (0x1 << 6))},
    {0x70001000, ((0x1 << 0) | (0x1 << 20) | (0x1 << 22)),
@@ -185,7 +186,6 @@ u32 syscfg_tbl_masked_8800dc[][3] = {
    {0x700010A0, (0x1 << 11), (0x1 << 11)},
    {0x70001034, ((0x1 << 20) | (0x7 << 26)), ((0x0 << 20) | (0x2 << 26))},
    {0x70001038, (0x1 << 8), (0x1 << 8)},
-    {0x70001084, (0x3 << 13), (0x0 << 13)},
    {0x70001094, (0x3 << 2), (0x0 << 2)},
    {0x700021D0, ((0x1 << 5) | (0x1 << 6)), ((0x1 << 5) | (0x1 << 6))},
    {0x70001000, ((0x1 << 0) | (0x1 << 20) | (0x1 << 22)),
@@ -211,7 +211,6 @@ u32 syscfg_tbl_masked_8800dc_h[][3] = {
    {0x700010A0, (0x1 << 11), (0x1 << 11)},
    //{0x70001034, ((0x1 << 20) | (0x7 << 26)), ((0x0 << 20) | (0x2 << 26))},
    {0x70001038, (0x1 << 8), (0x1 << 8)},
-    {0x70001084, (0x3 << 13), (0x0 << 13)},
    {0x70001094, (0x3 << 2), (0x0 << 2)},
    {0x700021D0, ((0x1 << 5) | (0x1 << 6)), ((0x1 << 5) | (0x1 << 6))},
    #if defined(CONFIG_VRF_DCDC_MODE)
@@ -243,6 +242,7 @@ u32 syscfg_tbl_8800dc[][2] = {

 u32 patch_tbl_wifisetting[][2] =
 {
+    {0x0004, 0x00020010}, //wdt_reboot_type, wdt_period_sec
    #if !defined(CONFIG_FPGA_VERIFICATION)
    {0x0090, 0x0013FC00}, //rx_ringbuf_start2
    #endif
@@ -251,9 +251,10 @@ u32 patch_tbl_wifisetting[][2] =
    {0x0120, 0x140A0100}, //usb agg tx params(total cnt, aggr cnt, out en, global out nak)
 #endif //CONFIG_USB_TX_AGGR
    {0x00b0, 0xAD180100},
-#ifdef CONFIG_PRBREQ_REPORT
+#ifdef CONFIG_BAND_STEERING
    {0x0138, 0x00010a00}, //apm probe resp offload en
 #endif
+    {0x0084, 0x00000040},
 };

 u32 jump_tbl[][2] =
@@ -1871,104 +1872,104 @@ const uint32_t txgain_map_femkct[96] =
 const uint32_t txgain_map_femkct_h[96] =
 {
    //11b
-    0x00ffd86c,//15
-    0x00ffd879,//16
-    0x00ffd96c,//17
-    0x00ffd979,//18
-    0x00ffd988,//19
-    0x00ffda6c,//20
-    0x00ffda79,//21
-    0x00ffdb6c,//22
-    0x00ffdb79,//23
-    0x00ffdc6c,//24
-    0x00ffdc79,//25
-    0x00ffdd6c,//26
-    0x00ffdd79,//27
-    0x00ffde6c,//28
-    0x00ffde79,//29
-    0x00ffdf6c,//30
-    0x00ffd06c,//-1
-    0x00ffd06c,//0
-    0x00ffd079,//1
-    0x00ffd16c,//2
-    0x00ffd179,//3
-    0x00ffd26c,//4
-    0x00ffd279,//5
-    0x00ffd372,//6
-    0x00ffd467,//7
-    0x00ffd472,//8
-    0x00ffd56c,//9
-    0x00ffd579,//10
-    0x00ffd66c,//11
-    0x00ffd679,//12
-    0x00ffd76c,//13
-    0x00ffd779,//14
+    0x00ffd872,//15
+    0x00ffd880,//16
+    0x00ffd972,//17
+    0x00ffd980,//18
+    0x00ffd990,//19
+    0x00ffda72,//20
+    0x00ffda80,//21
+    0x00ffdb72,//22
+    0x00ffdb80,//23
+    0x00ffdc72,//24
+    0x00ffdc80,//25
+    0x00ffdd72,//26
+    0x00ffdd80,//27
+    0x00ffde72,//28
+    0x00ffde80,//29
+    0x00ffdf72,//30
+    0x00ffd072,//-1
+    0x00ffd072,//0
+    0x00ffd080,//1
+    0x00ffd172,//2
+    0x00ffd180,//3
+    0x00ffd272,//4
+    0x00ffd280,//5
+    0x00ffd379,//6
+    0x00ffd46d,//7
+    0x00ffd479,//8
+    0x00ffd572,//9
+    0x00ffd580,//10
+    0x00ffd672,//11
+    0x00ffd680,//12
+    0x00ffd772,//13
+    0x00ffd780,//14
    //high
-    0x00ffc879,//11
-    0x00ffc96c,//12
-    0x00ffc979,//13
-    0x00ffca6c,//14
-    0x00ffca79,//15
-    0x00ffcb6c,//16
-    0x00ffcb79,//17
-    0x00ffcc6c,//18
-    0x00ffcc79,//19
-    0x00ffcc88,//20
-    0x00ffcd6c,//21
-    0x00ffcd79,//22
-    0x00ffce6c,//23
-    0x00ffce79,//24
-    0x00ffcf6c,//25
-    0x00ffcf79,//26
-    0x00ffc079,//-5
-    0x00ffc16c,//-4
-    0x00ffc179,//-3
-    0x00ffc26c,//-2
-    0x00ffc279,//-1
-    0x00ffc36c,//0
-    0x00ffc379,//1
-    0x00ffc46c,//2
-    0x00ffc479,//3
-    0x00ffc56c,//4
-    0x00ffc579,//5
-    0x00ffc66c,//6
-    0x00ffc679,//7
-    0x00ffc76c,//8
-    0x00ffc779,//9
-    0x00ffc86c,//10
+    0x00ffc880,//11
+    0x00ffc972,//12
+    0x00ffc980,//13
+    0x00ffca72,//14
+    0x00ffca80,//15
+    0x00ffcb72,//16
+    0x00ffcb80,//17
+    0x00ffcc72,//18
+    0x00ffcc80,//19
+    0x00ffcc90,//20
+    0x00ffcd72,//21
+    0x00ffcd80,//22
+    0x00ffce72,//23
+    0x00ffce80,//24
+    0x00ffcf72,//25
+    0x00ffcf80,//26
+    0x00ffc080,//-5
+    0x00ffc172,//-4
+    0x00ffc180,//-3
+    0x00ffc272,//-2
+    0x00ffc280,//-1
+    0x00ffc372,//0
+    0x00ffc380,//1
+    0x00ffc472,//2
+    0x00ffc480,//3
+    0x00ffc572,//4
+    0x00ffc580,//5
+    0x00ffc672,//6
+    0x00ffc680,//7
+    0x00ffc772,//8
+    0x00ffc780,//9
+    0x00ffc872,//10
    //low
-    0x00ffc879,//11
-    0x00ffc96c,//12
-    0x00ffc979,//13
-    0x00ffca6c,//14
-    0x00ffca79,//15
-    0x00ffcb6c,//16
-    0x00ffcb79,//17
-    0x00ffcc6c,//18
-    0x00ffcc79,//19
-    0x00ffcc88,//20
-    0x00ffcd6c,//21
-    0x00ffcd79,//22
-    0x00ffce6c,//23
-    0x00ffce79,//24
-    0x00ffcf6c,//25
-    0x00ffcf79,//26
-    0x00ffc079,//-5
-    0x00ffc16c,//-4
-    0x00ffc179,//-3
-    0x00ffc26c,//-2
-    0x00ffc279,//-1
-    0x00ffc36c,//0
-    0x00ffc379,//1
-    0x00ffc46c,//2
-    0x00ffc479,//3
-    0x00ffc56c,//4
-    0x00ffc579,//5
-    0x00ffc66c,//6
-    0x00ffc679,//7
-    0x00ffc76c,//8
-    0x00ffc779,//9
-    0x00ffc86c,//10
+    0x00ffc880,//11
+    0x00ffc972,//12
+    0x00ffc980,//13
+    0x00ffca72,//14
+    0x00ffca80,//15
+    0x00ffcb72,//16
+    0x00ffcb80,//17
+    0x00ffcc72,//18
+    0x00ffcc80,//19
+    0x00ffcc90,//20
+    0x00ffcd72,//21
+    0x00ffcd80,//22
+    0x00ffce72,//23
+    0x00ffce80,//24
+    0x00ffcf72,//25
+    0x00ffcf80,//26
+    0x00ffc080,//-5
+    0x00ffc172,//-4
+    0x00ffc180,//-3
+    0x00ffc272,//-2
+    0x00ffc280,//-1
+    0x00ffc372,//0
+    0x00ffc380,//1
+    0x00ffc472,//2
+    0x00ffc480,//3
+    0x00ffc572,//4
+    0x00ffc580,//5
+    0x00ffc672,//6
+    0x00ffc680,//7
+    0x00ffc772,//8
+    0x00ffc780,//9
+    0x00ffc872,//10
 };
 #endif

@@ -2204,141 +2205,6 @@ uint32_t wifi_txgain_table_24g_1_8800dcdw_femkct[32] = {
 };
 #endif

-#ifdef CONFIG_5M10M
-u32 wifi_rxgain_table_24g_dcdw_5m[64] = {
-    0x82f282d1,//index 0
-    0x9591a200,
-    0x80808419,
-    0x000000f0,
-    0x42f282d1,//index 1
-    0x95923400,
-    0x80808419,
-    0x000000f0,
-    0x22f282d1,//index 2
-    0x9592c600,
-    0x80808419,
-    0x000000f0,
-    0x02f282d1,//index 3
-    0x9591a200,
-    0x80808419,
-    0x000000f0,
-    0x06f282d1,//index 4
-    0x9591a200,
-    0x80808419,
-    0x000000f0,
-    0x0ef282d1,//index 5
-    0x9591a200,
-    0x80808419,
-    0x000000f0,
-    0x0ef282d3,//index 6
-    0x95923400,
-    0x80808419,
-    0x000000f0,
-    0x0ef282d7,//index 7
-    0x9595a200,
-    0x80808419,
-    0x000000f0,
-    0x02f282d2,//index 8
-    0x95951000,
-    0x80808419,
-    0x000000f0,
-    0x02f282f4,//index 9
-    0x95951000,
-    0x80808419,
-    0x000000f0,
-    0x02f282e6,//index 10
-    0x9595a200,
-    0x80808419,
-    0x000000f0,
-    0x02f282e6,//index 11
-    0x9599a200,
-    0x80808419,
-    0x000000f0,
-    0x02f282e6,//index 12
-    0x959da200,
-    0x80808419,
-    0x000000f0,
-    0x02f282e6,//index 13
-    0x959f5800,
-    0x80808419,
-    0x000000f0,
-    0x06f282e6,//index 14
-    0x959f5800,
-    0x80808419,
-    0x000000f0,
-    0x0ef282e6,//index 15
-    0x959f5800,
-    0x80808419,
-    0x000000f0
-};
-
-u32 wifi_rxgain_table_24g_dcdw_10m[64] = {
-    0x82f282d1,//index 0
-    0x9591a320,
-    0x80808419,
-    0x000000f0,
-    0x42f282d1,//index 1
-    0x95923520,
-    0x80808419,
-    0x000000f0,
-    0x22f282d1,//index 2
-    0x9592c720,
-    0x80808419,
-    0x000000f0,
-    0x02f282d1,//index 3
-    0x9591a320,
-    0x80808419,
-    0x000000f0,
-    0x06f282d1,//index 4
-    0x9591a320,
-    0x80808419,
-    0x000000f0,
-    0x0ef282d1,//index 5
-    0x9591a320,
-    0x80808419,
-    0x000000f0,
-    0x0ef282d3,//index 6
-    0x95923520,
-    0x80808419,
-    0x000000f0,
-    0x0ef282d7,//index 7
-    0x9595a320,
-    0x80808419,
-    0x000000f0,
-    0x02f282d2,//index 8
-    0x95951120,
-    0x80808419,
-    0x000000f0,
-    0x02f282f4,//index 9
-    0x95951120,
-    0x80808419,
-    0x000000f0,
-    0x02f282e6,//index 10
-    0x9595a320,
-    0x80808419,
-    0x000000f0,
-    0x02f282e6,//index 11
-    0x9599a320,
-    0x80808419,
-    0x000000f0,
-    0x02f282e6,//index 12
-    0x959da320,
-    0x80808419,
-    0x000000f0,
-    0x02f282e6,//index 13
-    0x959f5920,
-    0x80808419,
-    0x000000f0,
-    0x06f282e6,//index 14
-    0x959f5920,
-    0x80808419,
-    0x000000f0,
-    0x0ef282e6,//index 15
-    0x959f5920,
-    0x80808419,
-    0x000000f0
-};
-#endif
 u32 wifi_rxgain_table_24g_20m_8800dcdw[64] = {
    0x82f282d1,//index 0
    0x9591a324,
@@ -3057,13 +2923,7 @@ int aicwf_set_rf_config_8800dc(struct rwnx_hw *rwnx_hw, struct mm_set_rf_calib_c

 		if ((ret = rwnx_send_rf_config_req(rwnx_hw, 32,  0, (u8_l *)wifi_rxgain_table_24g_40m_8800dcdw, 256)))
 			return -1;
-#ifdef CONFIG_5M10M
-		if ((ret = rwnx_send_rf_config_req(rwnx_hw, 16, 0, (u8_l *)wifi_rxgain_table_24g_dcdw_5m, 256)))
-			return -1;

-		if ((ret = rwnx_send_rf_config_req(rwnx_hw, 48, 0, (u8_l *)wifi_rxgain_table_24g_dcdw_10m, 256)))
-			return -1;
-#endif
 		if ((ret = rwnx_send_rf_calib_req(rwnx_hw, cfm))) {
 			return -1;
 		}
@@ -3178,35 +3038,61 @@ int aicwf_misc_ram_valid_check_8800dc(struct rwnx_hw *rwnx_hw, int *valid_out)
    uint32_t misc_ram_addr;
    uint32_t ram_base_addr, ram_word_cnt;
    uint32_t bit_mask[4];
+    uint32_t dpd_info_read_addr = 0xfe004;
+    uint32_t boot_argc_read_addr = 0x1220f0;
+    uint32_t flash_size_mem_addr = 0x40038030;
+    uint8_t flash_size = 0;
    int i;
    if (valid_out) {
        *valid_out = 0;
    }
+
+    AICWFDBG(LOGINFO, "issue71: checking legacy V3 DPD result\n");
+    ret = rwnx_send_dbg_mem_read_req(rwnx_hw, boot_argc_read_addr, &cfm);
+    if (ret) {
+        AICWFDBG(LOGERROR, "boot argc [0x%x] rd fail: %d\n", boot_argc_read_addr, ret);
+            return ret;
+    }
+    AICWFDBG(LOGINFO, "issue71: boot argc=0x%x\n", cfm.memdata);
+    if (cfm.memdata & 0x10) {
+        if (valid_out) {
+            *valid_out = 1;
+        }
+        AICWFDBG(LOGINFO, "issue71: boot arguments mark DPD result valid\n");
+        return ret;
+    }
+    if (chip_mcu_id) {
+        ret = rwnx_send_dbg_mem_read_req(rwnx_hw, flash_size_mem_addr, &cfm);
+        if (ret) {
+            AICWFDBG(LOGERROR, "flash size[0x%x] rd fail: %d\n", flash_size_mem_addr, ret);
+            return ret;
+        }
+        flash_size = cfm.memdata & 0xff;
+        if (flash_size == 0x16) {
+            dpd_info_read_addr += 0x4300000;
+        } else if (flash_size == 0x15) {
+            dpd_info_read_addr += 0x4100000;
+        } else if (flash_size == 0x18) {
+            dpd_info_read_addr += 0x4700000;
+        } else {
+            dpd_info_read_addr += 0x4100000;
+        }
+        ret = rwnx_send_dbg_mem_read_req(rwnx_hw, dpd_info_read_addr, &cfm);
+        if (ret) {
+            AICWFDBG(LOGERROR, "dpd info [0x%x] rd fail: %d\n", dpd_info_read_addr, ret);
+            return ret;
+        }
+        AICWFDBG(LOGINFO,
+            "issue71: flash size=0x%x, DPD info [0x%x]=0x%x\n",
+            flash_size, dpd_info_read_addr, cfm.memdata);
+        if (cfm.memdata & (1<<7)) {
+             if (valid_out) {
+                *valid_out = 1;
+            }
+            AICWFDBG(LOGINFO, "issue71: legacy V3 flash DPD result is valid\n");
+        }
+    } else {
        if (testmode == FW_RFTEST_MODE) {
-	    uint32_t vect1 = 0;
-	    uint32_t vect2 = 0;
-	    cfg_base = RAM_LMAC_FW_ADDR + 0x0004;
-	    ret = rwnx_send_dbg_mem_read_req(rwnx_hw, cfg_base, &cfm);
-	    if (ret) {
-		    AICWFDBG(LOGERROR, "cfg_base:%x vcet1 rd fail: %d\n", cfg_base, ret);
-		    return ret;
-	    }
-	    vect1 = cfm.memdata;
-	    if ((vect1 & 0xFFFF0000) != (RAM_LMAC_FW_ADDR & 0xFFFF0000)) {
-		    AICWFDBG(LOGERROR, "vect1 invalid: %x\n", vect1);
-		    return ret;
-	    }
-	    cfg_base = RAM_LMAC_FW_ADDR + 0x0008;
-	    ret = rwnx_send_dbg_mem_read_req(rwnx_hw, cfg_base, &cfm);
-	    if (ret) {
-		    AICWFDBG(LOGERROR, "cfg_base:%x vcet2 rd fail: %d\n", cfg_base, ret);
-		    return ret;
-	    }
-	    vect2 = cfm.memdata;
-	    if ((vect2 & 0xFFFF0000) != (RAM_LMAC_FW_ADDR & 0xFFFF0000)) {
-		    AICWFDBG(LOGERROR, "vect2 invalid: %x\n", vect2);
-		    return ret;
-	    }
            cfg_base = RAM_LMAC_FW_ADDR + 0x0164;
        }
        // init misc ram
@@ -3235,6 +3121,7 @@ int aicwf_misc_ram_valid_check_8800dc(struct rwnx_hw *rwnx_hw, int *valid_out)
                *valid_out = 1;
            }
        }
+    }
    return ret;
 }

@@ -3630,7 +3517,19 @@ int	rwnx_plat_userconfig_load_8800dc(struct rwnx_hw *rwnx_hw){
 int	rwnx_plat_userconfig_load_8800dw(struct rwnx_hw *rwnx_hw){
    int size;
    u32 *dst=NULL;
+    u16 pid = le16_to_cpu(rwnx_hw->usbdev->udev->descriptor.idProduct);
    char *filename = FW_USERCONFIG_NAME_8800DW;
+    if (pid == USB_PRODUCT_ID_TENDA
+        || pid == USB_PRODUCT_ID_AIC8800FC_CUS3
+        || pid == USB_PRODUCT_ID_AIC8800FC_CUS5
+        || pid == USB_PRODUCT_ID_AIC8800FC_CUS6) {
+        filename = FW_USERCONFIG_NAME_8800DW_W311;
+    } else if (pid == USB_PRODUCT_ID_TENDA_U2
+        || pid == USB_PRODUCT_ID_AIC8800FC_CUS1
+        || pid == USB_PRODUCT_ID_AIC8800FC_CUS2
+        || pid == USB_PRODUCT_ID_AIC8800FC_CUS4) {
+        filename = FW_USERCONFIG_NAME_8800DW_U2;
+    }

    AICWFDBG(LOGINFO, "userconfig file path:%s \r\n", filename);

@@ -3684,7 +3583,7 @@ int rwnx_plat_powerlimit_load_8800dcdw(struct rwnx_hw *rwnx_hw, uint16_t chip_id
    /* Copy the file on the Embedded side */
    AICWFDBG(LOGINFO, "### Load file done: %s, size=%d\n", filename, size);

-    rwnx_plat_powerlimit_parsing((char *)dst, size);
+    rwnx_plat_powerlimit_parsing((char *)dst, size, country_code);

    rwnx_release_firmware_common(&dst);

@@ -3739,6 +3638,7 @@ void system_config_8800dc(struct rwnx_hw *rwnx_hw){
    array3_tbl_t p_syscfg_msk_tbl;
    int ret, cnt;
    const u32 mem_addr = 0x40500000;
+    const u32 cache_mem_addr = 0x40100020;
    struct dbg_mem_read_cfm rd_mem_addr_cfm;

    ret = rwnx_send_dbg_mem_read_req(rwnx_hw, mem_addr, &rd_mem_addr_cfm);
@@ -3752,6 +3652,21 @@ void system_config_8800dc(struct rwnx_hw *rwnx_hw){
        chip_mcu_id = 1;
    }

+    if (chip_mcu_id) {
+        ret = rwnx_send_dbg_mem_read_req(rwnx_hw, cache_mem_addr, &rd_mem_addr_cfm);
+        if (ret) {
+            AICWFDBG(LOGERROR, "%x rd fail: %d\n", mem_addr, ret);
+            return;
+        }
+        rd_mem_addr_cfm.memdata |= 0x01;
+        ret = rwnx_send_dbg_mem_write_req(rwnx_hw, cache_mem_addr, rd_mem_addr_cfm.memdata);
+
+        if (ret) {
+            AICWFDBG(LOGERROR, "%x write fail: %d\n", cache_mem_addr, ret);
+            return;
+        }
+    }
+
    ret = rwnx_send_dbg_mem_read_req(rwnx_hw, 0x00000020, &rd_mem_addr_cfm);
    if (ret) {
 		AICWFDBG(LOGERROR, "[0x00000020] rd fail: %d\n", ret);
@@ -3759,7 +3674,10 @@ void system_config_8800dc(struct rwnx_hw *rwnx_hw){
    }
    chip_sub_id = (u8)(rd_mem_addr_cfm.memdata);
    //printk("%x=%x\n", rd_mem_addr_cfm.memaddr, rd_mem_addr_cfm.memdata);
-	AICWFDBG(LOGINFO, "chip_id=%x, chip_sub_id=%x\n", chip_id, chip_sub_id);
+    AICWFDBG(LOGINFO, "chip_id=%x, chip_mcu_id=%x, chip_sub_id=%x\n",
+        chip_id, chip_mcu_id, chip_sub_id);
+    AICWFDBG(LOGINFO,
+        "issue71: using complete pre-SDK-V5/V3 DC/DW firmware and loader profile\n");


 	//Crystal provided by CPU (start)
@@ -297,18 +297,6 @@ static void aicwf_usb_rx_complete(struct urb *urb)
        aicwf_usb_rx_buf_put(usb_dev, usb_buf);
        if(urb->status < 0){
            AICWFDBG(LOGDEBUG, "%s urb->status:%d \r\n", __func__, urb->status);
-
-            if(g_rwnx_plat->wait_disconnect_cb == false){
-                g_rwnx_plat->wait_disconnect_cb = true;
-                if(atomic_read(&aicwf_deinit_atomic) > 0){
-                    atomic_set(&aicwf_deinit_atomic, 0);
-                    down(&aicwf_deinit_sem);
-                    AICWFDBG(LOGINFO, "%s need to wait for disconnect callback \r\n", __func__);
-                }else{
-                    g_rwnx_plat->wait_disconnect_cb = false;
-                }
-            }
-
            return;
        }else{
            //schedule_work(&usb_dev->rx_urb_work);
@@ -385,18 +373,6 @@ static void aicwf_usb_rx_complete(struct urb *urb)
        aicwf_usb_rx_buf_put(usb_dev, usb_buf);
 		if(urb->status < 0){
 			AICWFDBG(LOGDEBUG, "%s urb->status:%d \r\n", __func__, urb->status);
-
-			if(g_rwnx_plat->wait_disconnect_cb == false){
-				g_rwnx_plat->wait_disconnect_cb = true;
-				if(atomic_read(&aicwf_deinit_atomic) > 0){
-					atomic_set(&aicwf_deinit_atomic, 0);
-					down(&aicwf_deinit_sem);
-					AICWFDBG(LOGINFO, "%s need to wait for disconnect callback \r\n", __func__);
-				}else{
-					g_rwnx_plat->wait_disconnect_cb = false;
-				}
-			}
-
 			return;
 		}else{
 			//schedule_work(&usb_dev->rx_urb_work);
@@ -1979,10 +1955,6 @@ static void aicwf_usb_bus_stop(struct device *dev)
    if (usb_dev->state == USB_DOWN_ST)
        return;

-    if(g_rwnx_plat && g_rwnx_plat->wait_disconnect_cb == true){
-        atomic_set(&aicwf_deinit_atomic, 1);
-        up(&aicwf_deinit_sem);
-    }
    aicwf_usb_state_change(usb_dev, USB_DOWN_ST);
    //aicwf_usb_cancel_all_urbs(usb_dev);//AIDEN
 }
@@ -2341,7 +2313,8 @@ static int aicwf_usb_chipmatch(struct aic_usb_dev *usb_dev, u16_l vid, u16_l pid
 		usb_dev->chipid = PRODUCT_ID_AIC8801;
 		AICWFDBG(LOGINFO, "%s USE AIC8801\r\n", __func__);
 		return 0;
-	}else if(pid == USB_PRODUCT_ID_AIC8800DC || pid == USB_PRODUCT_ID_TENDA
+	}else if(pid == USB_PRODUCT_ID_AIC8800DC || pid == USB_PRODUCT_ID_AIC8800DE
+		|| pid == USB_PRODUCT_ID_TENDA
 		|| pid == USB_PRODUCT_ID_TENDA_U2  || pid == USB_PRODUCT_ID_AIC8800FC_CUS1
 		|| pid == USB_PRODUCT_ID_AIC8800FC_CUS2 || pid == USB_PRODUCT_ID_AIC8800FC_CUS3
 		|| pid == USB_PRODUCT_ID_AIC8800FC_CUS4 || pid == USB_PRODUCT_ID_AIC8800FC_CUS5
@@ -2360,7 +2333,8 @@ static int aicwf_usb_chipmatch(struct aic_usb_dev *usb_dev, u16_l vid, u16_l pid
 		|| pid == USB_PRODUCT_ID_AIC8800M80_CUS3 || pid == USB_PRODUCT_ID_AIC8800M80_CUS4
 		|| pid == USB_PRODUCT_ID_AIC8800M80_CUS5 || pid == USB_PRODUCT_ID_AIC8800M80_CUS6
 		|| pid == USB_PRODUCT_ID_AIC8800M80_CUS7 || pid == USB_PRODUCT_ID_AIC8800M80_CUS8
-        || pid == USB_PRODUCT_ID_AIC8800D80_UGREEN || pid == USB_PRODUCT_ID_MERCURY){
+        || pid == USB_PRODUCT_ID_AIC8800D80_UGREEN || pid == USB_PRODUCT_ID_MERCURY
+        || pid == USB_PRODUCT_ID_TP){
        usb_dev->chipid = PRODUCT_ID_AIC8800D81;
        aicwf_usb_rx_aggr = true;
        AICWFDBG(LOGINFO, "%s USE AIC8800D81\r\n", __func__);
@@ -2670,6 +2644,7 @@ static struct usb_device_id aicwf_usb_id_table[] = {
    {USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_ID_AIC, USB_PRODUCT_ID_AIC8800D81, 0xff, 0xff, 0xff)},
    {USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_ID_AIC, USB_PRODUCT_ID_AIC8800D41, 0xff, 0xff, 0xff)},
    {USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_ID_AIC, USB_PRODUCT_ID_AIC8800DC, 0xff, 0xff, 0xff)},
+    {USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_ID_AIC, USB_PRODUCT_ID_AIC8800DE, 0xff, 0xff, 0xff)},
    {USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_ID_TENDA_V2, USB_PRODUCT_ID_TENDA_TX1U_NANO, 0xff, 0xff, 0xff)},
    {USB_DEVICE(USB_VENDOR_ID_AIC, USB_PRODUCT_ID_AIC8800DW)},
    {USB_DEVICE(USB_VENDOR_ID_AIC, USB_PRODUCT_ID_AIC8800M80_CUS1)},
@@ -2705,6 +2680,7 @@ static struct usb_device_id aicwf_usb_id_table[] = {
    {USB_DEVICE(USB_VENDOR_ID_AIC_V2, USB_PRODUCT_ID_AIC8800M80_CUS8)},
    {USB_DEVICE(USB_VENDOR_ID_AIC_V2, USB_PRODUCT_ID_AIC8800D80_UGREEN)},
    {USB_DEVICE(USB_VENDOR_ID_TP, USB_PRODUCT_ID_MERCURY)},
+    {USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_ID_TP, USB_PRODUCT_ID_TP, 0xff, 0xff, 0xff)},
 #endif
    {}
 };
@@ -38,6 +38,7 @@
 #else
 #define USB_PRODUCT_ID_AIC8801          0x8801
 #define USB_PRODUCT_ID_AIC8800DC        0x88dc
+#define USB_PRODUCT_ID_AIC8800DE        0x88de
 #define USB_PRODUCT_ID_AIC8800DW        0x88dd
 #define USB_PRODUCT_ID_AIC8800D81       0x8d81
 #define USB_PRODUCT_ID_AIC8800D41       0x8d41
@@ -23,6 +23,33 @@
 #define _RWNX_COMPAT_H_
 #include <linux/version.h>

+/* Keep wireless API checks separate from timer, USB and other kernel APIs. */
+#ifndef AICWF_CFG80211_VERSION_CODE
+#define AICWF_CFG80211_VERSION_CODE LINUX_VERSION_CODE
+#endif
+
+/*
+ * cfg80211_ops.set_monitor_channel() gained a "struct net_device *dev"
+ * parameter. The change went into mainline 6.13, but it was also
+ * backported to the 6.12 stable series starting with 6.12.101, so a
+ * plain ">= 6.13.0" test misses 6.12.101 and later. Those kernels then
+ * compile against the old prototype, which is fatal with
+ * -Wincompatible-pointer-types:
+ *
+ *   rwnx_main.c: error: initialization of
+ *     'int (*)(struct wiphy *, struct net_device *, struct cfg80211_chan_def *)'
+ *     from incompatible pointer type
+ *     'int (*)(struct wiphy *, struct cfg80211_chan_def *)'
+ *
+ * Debian 13 (6.12.107) is one such kernel. The 6.12.101 threshold
+ * covers both the backport and mainline, and leaves 6.11 and earlier
+ * 6.12.x on the old prototype. Keep the check in one place so every
+ * consumer stays in sync.
+ */
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 12, 101)
+#define AICWF_CFG80211_SET_MONITOR_CHANNEL_HAS_DEV
+#endif
+
 #if LINUX_VERSION_CODE < KERNEL_VERSION(3, 10, 0)
 #error "Minimum kernel version supported is 3.10"
 #endif
@@ -2942,7 +2942,7 @@ bool key_flag = false;
 *	when adding a group key.
 */
 static int rwnx_cfg80211_add_key(struct wiphy *wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
                                 struct wireless_dev *wdev,
 #else
                                 struct net_device *netdev,
@@ -2954,7 +2954,7 @@ static int rwnx_cfg80211_add_key(struct wiphy *wiphy,
                                 struct key_params *params)
 {
    struct rwnx_hw *rwnx_hw = wiphy_priv(wiphy);
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
    struct rwnx_vif *vif = netdev_priv(wdev->netdev);
 #else
    struct rwnx_vif *vif = netdev_priv(netdev);
@@ -3066,7 +3066,7 @@ static int rwnx_cfg80211_add_key(struct wiphy *wiphy,
 *
 */
 static int rwnx_cfg80211_get_key(struct wiphy *wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
                                 struct wireless_dev *wdev,
 #else
                                 struct net_device *netdev,
@@ -3090,7 +3090,7 @@ static int rwnx_cfg80211_get_key(struct wiphy *wiphy,
 *	and @key_index, return -ENOENT if the key doesn't exist.
 */
 static int rwnx_cfg80211_del_key(struct wiphy *wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
                                 struct wireless_dev *wdev,
 #else
                                 struct net_device *netdev,
@@ -3102,7 +3102,7 @@ static int rwnx_cfg80211_del_key(struct wiphy *wiphy,
                                 u8 key_index, bool pairwise, const u8 *mac_addr)
 {
    struct rwnx_hw *rwnx_hw = wiphy_priv(wiphy);
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
    struct rwnx_vif *vif = netdev_priv(wdev->netdev);
 #else
    struct rwnx_vif *vif = netdev_priv(netdev);
@@ -3154,7 +3154,7 @@ static int rwnx_cfg80211_set_default_key(struct wiphy *wiphy,
 * @set_default_mgmt_key: set the default management frame key on an interface
 */
 static int rwnx_cfg80211_set_default_mgmt_key(struct wiphy *wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
                                              struct wireless_dev *wdev,
 #else
                                              struct net_device *netdev,
@@ -3249,7 +3249,7 @@ static int rwnx_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
        key_params.seq_len = 0;
        key_params.cipher = sme->crypto.cipher_group;
        rwnx_cfg80211_add_key(wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
                              &rwnx_vif->wdev,
 #else
                              dev,
@@ -3480,7 +3480,7 @@ static int rwnx_cfg80211_external_auth(struct wiphy *wiphy, struct net_device *d
 * @add_station: Add a new station.
 */
 static int rwnx_cfg80211_add_station(struct wiphy *wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
    struct wireless_dev *wdev,
 #else
 	struct net_device *dev,
@@ -3493,7 +3493,7 @@ static int rwnx_cfg80211_add_station(struct wiphy *wiphy,
 	struct station_parameters *params)
 {
    struct rwnx_hw *rwnx_hw = wiphy_priv(wiphy);
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
    struct rwnx_vif *rwnx_vif = netdev_priv(wdev->netdev);
 #else
    struct rwnx_vif *rwnx_vif = netdev_priv(dev);
@@ -3589,7 +3589,7 @@ static int rwnx_cfg80211_add_station(struct wiphy *wiphy,
                sinfo.filled |= STATION_INFO_ASSOC_REQ_IES;
                #endif
 		        cfg80211_new_sta(
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
                        &rwnx_vif->wdev,
 #else
                        rwnx_vif->ndev,
@@ -3620,7 +3620,7 @@ static int rwnx_cfg80211_add_station(struct wiphy *wiphy,
                (params->sta_flags_set & BIT(NL80211_STA_FLAG_##f) ? "["#f"]" : "")

            netdev_info(
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
                        wdev->netdev,
 #else
                        dev,
@@ -3651,7 +3651,7 @@ static int rwnx_cfg80211_add_station(struct wiphy *wiphy,
 * @del_station: Remove a station
 */
 static int rwnx_cfg80211_del_station_compat(struct wiphy *wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
                                            struct wireless_dev *wdev,
 #else
                                            struct net_device *dev,
@@ -3666,7 +3666,7 @@ static int rwnx_cfg80211_del_station_compat(struct wiphy *wiphy,
 )
 {
    struct rwnx_hw *rwnx_hw = wiphy_priv(wiphy);
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
    struct rwnx_vif *rwnx_vif = netdev_priv(wdev->netdev);
 #else
    struct rwnx_vif *rwnx_vif = netdev_priv(dev);
@@ -3711,7 +3711,7 @@ static int rwnx_cfg80211_del_station_compat(struct wiphy *wiphy,

 		if(found) {
 			netdev_info(
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
                    wdev->netdev,
 #else
                    dev,
@@ -3731,7 +3731,7 @@ static int rwnx_cfg80211_del_station_compat(struct wiphy *wiphy,
 			}
 			if (rwnx_vif->wdev.iftype == NL80211_IFTYPE_AP || rwnx_vif->wdev.iftype == NL80211_IFTYPE_P2P_GO) {
 				cfg80211_del_sta(
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
 						&rwnx_vif->wdev,
 #else
 						rwnx_vif->ndev,
@@ -3962,7 +3962,7 @@ void apm_probe_sta_work_process(struct work_struct *work)
 *	cfg80211_check_station_change() to validate the information.
 */
 static int rwnx_cfg80211_change_station(struct wiphy *wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
                                        struct wireless_dev *wdev,
 #else
                                        struct net_device *dev,
@@ -3975,7 +3975,7 @@ static int rwnx_cfg80211_change_station(struct wiphy *wiphy,
 	struct station_parameters *params)
 {
    struct rwnx_hw *rwnx_hw = wiphy_priv(wiphy);
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
    struct rwnx_vif *vif = netdev_priv(wdev->netdev);
 #else
    struct rwnx_vif *vif = netdev_priv(dev);
@@ -3988,7 +3988,7 @@ static int rwnx_cfg80211_change_station(struct wiphy *wiphy,
        /* Add the TDLS station */
        if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
        {
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
            struct rwnx_vif *rwnx_vif = netdev_priv(wdev->netdev);
 #else
            struct rwnx_vif *rwnx_vif = netdev_priv(dev);
@@ -4064,7 +4064,7 @@ static int rwnx_cfg80211_change_station(struct wiphy *wiphy,
                        (params->sta_flags_set & BIT(NL80211_STA_FLAG_##f) ? "["#f"]" : "")

                    netdev_info(
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
                                wdev->netdev,
 #else
                                dev,
@@ -4353,7 +4353,7 @@ static int rwnx_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
    /* delete any remaining STA*/
    while (!list_empty(&rwnx_vif->ap.sta_list)) {
        rwnx_cfg80211_del_station_compat(wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
                                         &rwnx_vif->wdev,
 #else
                                         dev,
@@ -4420,7 +4420,7 @@ cfg80211_chandef_identical(const struct cfg80211_chan_def *chandef1,
 }
 #endif

-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 13, 0))
+#ifdef AICWF_CFG80211_SET_MONITOR_CHANNEL_HAS_DEV
 static int rwnx_cfg80211_set_monitor_channel(struct wiphy *wiphy, struct net_device *dev,
                                             struct cfg80211_chan_def *chandef)
 #else
@@ -4480,7 +4480,7 @@ static int rwnx_cfg80211_set_monitor_channel(struct wiphy *wiphy,
 }


-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 13, 0))
+#ifdef AICWF_CFG80211_SET_MONITOR_CHANNEL_HAS_DEV
 int rwnx_cfg80211_set_monitor_channel_(struct wiphy *wiphy,
                                             struct net_device *dev,
                                             struct cfg80211_chan_def *chandef)
@@ -4553,7 +4553,7 @@ void rwnx_cfg80211_mgmt_frame_register(struct wiphy *wiphy,
 *	have changed. The actual parameter values are available in
 *	struct wiphy. If returning an error, no value should be changed.
 */
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
 static int rwnx_cfg80211_set_wiphy_params(struct wiphy *wiphy, int radio_idx, u32 changed)
 #else
 static int rwnx_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
@@ -4574,7 +4574,7 @@ static int rwnx_cfg80211_set_tx_power(struct wiphy *wiphy,
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 struct wireless_dev *wdev,
 #endif
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
 int radio_idx,
 #endif
                                      enum nl80211_tx_power_setting type, int mbm)
@@ -4611,10 +4611,10 @@ static int rwnx_cfg80211_get_tx_power(struct wiphy *wiphy,
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
 struct wireless_dev *wdev,
 #endif
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
 int radio_idx,
 #endif
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 14, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 14, 0)
 unsigned int link_id,
 #endif
 	int *mbm)
@@ -4857,7 +4857,17 @@ rwnx_cfg80211_remain_on_channel(struct wiphy *wiphy,
                            #if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
                                enum nl80211_channel_type channel_type,
                            #endif
-                                unsigned int duration, u64 *cookie)
+                                unsigned int duration, u64 *cookie
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 2, 0)
+                                /*
+                                 * 7.2 added an optional receive address filter for the off-channel
+                                 * period. cfg80211 refuses a non-NULL one unless the driver sets
+                                 * NL80211_EXT_FEATURE_ROC_ADDR_FILTER, which this one does not, so it
+                                 * is always NULL here. mac80211 ignores it in the same way.
+                                 */
+                                , const u8 *rx_addr
+#endif
+                                )
 {
 	return rwnx_cfg80211_remain_on_channel_(wiphy,
                            #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0)
@@ -4999,7 +5009,7 @@ static int rwnx_cfg80211_get_channel(struct wiphy *wiphy,
    if (rwnx_vif->vif_index == rwnx_hw->monitor_vif)
    {
        //retrieve channel from firmware
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 13, 0))
+#ifdef AICWF_CFG80211_SET_MONITOR_CHANNEL_HAS_DEV
        rwnx_cfg80211_set_monitor_channel(wiphy, wdev->netdev, NULL);
 #else
        rwnx_cfg80211_set_monitor_channel(wiphy, NULL);
@@ -5197,7 +5207,7 @@ int rwnx_cfg80211_start_radar_detection(struct wiphy *wiphy,
                                    #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0))
                                        , u32 cac_time_ms
                                    #endif
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 12, 0))
+#if (AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 12, 0))
                                        , int link_id
 #endif
                                        )
@@ -5981,7 +5991,7 @@ int rwnx_fill_station_info(struct rwnx_sta *sta, struct rwnx_vif *vif,
 * @get_station: get station information for the station identified by @mac
 */
 static int rwnx_cfg80211_get_station(struct wiphy *wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
    struct wireless_dev *wdev,
 #else
 	struct net_device *dev,
@@ -5993,7 +6003,7 @@ static int rwnx_cfg80211_get_station(struct wiphy *wiphy,
 #endif
 	struct station_info *sinfo)
 {
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
    struct rwnx_vif *vif = netdev_priv(wdev->netdev);
 #else
    struct rwnx_vif *vif = netdev_priv(dev);
@@ -6031,14 +6041,14 @@ static int rwnx_cfg80211_get_station(struct wiphy *wiphy,
 * @dump_station: dump station callback -- resume dump at index @idx
 */
 static int rwnx_cfg80211_dump_station(struct wiphy *wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
                                      struct wireless_dev *wdev,
 #else
                                      struct net_device *dev,
 #endif
                                      int idx, u8 *mac, struct station_info *sinfo)
 {
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
    struct rwnx_vif *rwnx_vif = netdev_priv(wdev->netdev);
 #else
    struct rwnx_vif *rwnx_vif = netdev_priv(dev);
@@ -91,7 +91,7 @@ void aicwf_p2p_alive_timeout(struct timer_list *t);
 int rwnx_send_check_p2p(struct cfg80211_scan_request *param);
 void apm_staloss_work_process(struct work_struct *work);
 void apm_probe_sta_work_process(struct work_struct *work);
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 13, 0))
+#ifdef AICWF_CFG80211_SET_MONITOR_CHANNEL_HAS_DEV
 int rwnx_cfg80211_set_monitor_channel_(struct wiphy *wiphy,
                                             struct net_device *dev,
                                             struct cfg80211_chan_def *chandef);
@@ -825,7 +825,9 @@ static inline int rwnx_rx_scanu_result_ind(struct rwnx_hw *rwnx_hw,
 #endif

    }
+#ifdef CONFIG_USE_WIRELESS_EXT
 putbss:
+#endif
    if (bss != NULL)
 #if LINUX_VERSION_CODE < KERNEL_VERSION(3, 9, 0)
 	cfg80211_put_bss(bss);
@@ -4849,7 +4849,13 @@ int rwnx_send_dbg_trigger_req(struct rwnx_hw *rwnx_hw, char *msg)
        return -ENOMEM;

    /* Set parameters for the MM_DBG_TRIGGER_REQ message */
-    strncpy(req->error, msg, sizeof(req->error));
+    /*
+     * strncpy() is gone in 7.2. req->error is a fixed 64-byte field of a
+     * firmware message that is not NUL-terminated, and the message came
+     * from kzalloc(), so copying at most the field size is all strncpy()
+     * did here.
+     */
+    memcpy(req->error, msg, strnlen(msg, sizeof(req->error)));

    /* Send the MM_DBG_TRIGGER_REQ message to LMAC FW */
    return rwnx_send_msg(rwnx_hw, req, 0, -1, NULL);
@@ -1669,7 +1669,8 @@ static int rwnx_plat_patch_load(struct rwnx_hw *rwnx_hw)
    if(rwnx_hw->usbdev->chipid == PRODUCT_ID_AIC8800DC ||
        rwnx_hw->usbdev->chipid == PRODUCT_ID_AIC8800DW){
 #ifndef ANDROID_PLATFORM
-        sprintf(aic_fw_path, "%s/%s", aic_fw_path, "aic8800DC");
+        if (strlcat(aic_fw_path, "/aic8800DC", sizeof(aic_fw_path)) >= sizeof(aic_fw_path))
+            return -ENAMETOOLONG;
 #endif
        AICWFDBG(LOGINFO, "testmode=%d\n", testmode);
        if (chip_sub_id == 0) {
@@ -1808,7 +1809,8 @@ static int rwnx_plat_patch_load(struct rwnx_hw *rwnx_hw)
        }
    } else if(rwnx_hw->usbdev->chipid == PRODUCT_ID_AIC8800D80N) {
 #ifndef ANDROID_PLATFORM
-        sprintf(aic_fw_path, "%s/%s", aic_fw_path, "aic8800D80N");
+        if (strlcat(aic_fw_path, "/aic8800D80N", sizeof(aic_fw_path)) >= sizeof(aic_fw_path))
+            return -ENAMETOOLONG;
 #endif
        if (testmode == FW_NORMAL_MODE) {
            ret = aicwf_plat_patch_load_8800d80n(rwnx_hw);
@@ -1838,7 +1840,8 @@ static int rwnx_plat_patch_load(struct rwnx_hw *rwnx_hw)
    }
    else if(rwnx_hw->usbdev->chipid == PRODUCT_ID_AIC8800DLN) {
 #ifndef ANDROID_PLATFORM
-        sprintf(aic_fw_path, "%s/%s", aic_fw_path, "aic8800DLN");
+        if (strlcat(aic_fw_path, "/aic8800DLN", sizeof(aic_fw_path)) >= sizeof(aic_fw_path))
+            return -ENAMETOOLONG;
 #endif
        if (testmode == FW_NORMAL_MODE) {
            aicwf_patch_config_8800dln(rwnx_hw);
@@ -1475,7 +1475,7 @@ static void rwnx_radar_cac_work(struct work_struct *ws)
                    #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
                       &ctxt->chan_def,
                    #endif
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 12, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 12, 0)
                       NL80211_RADAR_CAC_FINISHED, GFP_KERNEL, 0);
 #else
                       NL80211_RADAR_CAC_FINISHED, GFP_KERNEL);
@@ -1617,7 +1617,7 @@ void rwnx_radar_cancel_cac(struct rwnx_radar *radar)
                        #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
                           &ctxt->chan_def,
                        #endif
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 12, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 12, 0)
                           NL80211_RADAR_CAC_FINISHED, GFP_KERNEL, 0);
 #else
                           NL80211_RADAR_CAC_ABORTED, GFP_KERNEL);
@@ -2283,6 +2283,11 @@ u8 rwnx_rxdataind_aicwf(struct rwnx_hw *rwnx_hw, void *hostid, void *rx_priv)
    if(hw_rxhdr->flags_upload)
        status |= RX_STAT_FORWARD;

+#ifndef CONFIG_RWNX_MON_DATA
+    if (status & RX_STAT_MONITOR)
+        status &= ~RX_STAT_FORWARD;
+#endif
+
    /* Check if we need to delete the buffer */
    if (status & RX_STAT_DELETE) {
        /* Remove the SK buffer from the rxbuf_elems table */
@@ -2345,13 +2350,24 @@ u8 rwnx_rxdataind_aicwf(struct rwnx_hw *rwnx_hw, void *hostid, void *rx_priv)
        } else {
        #ifdef CONFIG_RWNX_MON_DATA
        skb_monitor = skb_copy_expand(skb, rtap_len, 0, GFP_ATOMIC);
+        if (skb_monitor) {
            skb_monitor->data += (msdu_offset + 2); //sdio/usb word allign

            //Save frame length
            frm_len = le32_to_cpu(hw_rxhdr->hwvect.len);
+        }
        #endif
        }

+        if (!skb_monitor) {
+            if (status == RX_STAT_MONITOR) {
+                dev_kfree_skb(skb);
+                goto end;
+            }
+
+            goto check_len_update;
+        }
+
        //skb_reset_tail_pointer(skb);
        //skb->len = 0;
        skb_reset_tail_pointer(skb_monitor);
@@ -2394,7 +2410,7 @@ check_len_update:
        hdr = (struct ieee80211_hdr *)(skb->data + msdu_offset);
        rwnx_vif = rwnx_rx_get_vif(rwnx_hw, hw_rxhdr->flags_vif_idx);
        if (rwnx_vif) {
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
            cfg80211_rx_spurious_frame(rwnx_vif->ndev, hdr->addr2, -1, GFP_ATOMIC);
 #else
            cfg80211_rx_spurious_frame(rwnx_vif->ndev, hdr->addr2, GFP_ATOMIC);
@@ -2741,7 +2757,7 @@ check_len_update:

                if (hw_rxhdr->flags_is_4addr && !rwnx_vif->use_4addr) {
 					printk("aicwf: 4addr flag error\n");
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
                    cfg80211_rx_unexpected_4addr_frame(rwnx_vif->ndev,
                                                       sta->mac_addr, -1, GFP_ATOMIC);
 #else
@@ -115,8 +115,8 @@ rwnx_prep_tdls_direct(struct rwnx_hw *rwnx_hw, struct rwnx_vif *rwnx_vif,

    switch (action_code) {
    case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
-        skb_put(skb, 1 + sizeof(mgmt->u.action.tdls_discover_resp));
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+        skb_put(skb, 2 + sizeof(mgmt->u.action.tdls_discover_resp));
        mgmt->u.action.category = WLAN_CATEGORY_PUBLIC;
        mgmt->u.action.action_code = WLAN_PUB_ACTION_TDLS_DISCOVER_RES;
        mgmt->u.action.tdls_discover_resp.dialog_token = dialog_token;
@@ -1991,7 +1991,7 @@ free_use:

 netdev_tx_t rwnx_start_monitor_if_xmit(struct sk_buff *skb, struct net_device *dev)
 {
-    int rtap_len, ret, idx, tmp_len;
+    int rtap_len, ret, idx;
    struct ieee80211_radiotap_header *rtap_hdr; // net/ieee80211_radiotap.h
    struct ieee80211_radiotap_iterator iterator; // net/cfg80211.h
    u8_l *rtap_buf = (u8_l *)skb->data;
@@ -2012,34 +2012,37 @@ netdev_tx_t rwnx_start_monitor_if_xmit(struct sk_buff *skb, struct net_device *d
    bool offchan = false;
    int nx_off_chan_txq_idx = NX_OFF_CHAN_TXQ_IDX;

-    rtap_hdr = (struct ieee80211_radiotap_header*)(rtap_buf);
-    rtap_len = ieee80211_get_radiotap_len(rtap_buf);//max_length
    frame_len = skb->len;

-    AICWFDBG(LOGINFO, "rwnx_start_monitor_if_xmit, skb_len=%d, rtap_len=%d\n", skb->len, rtap_len);
-//rwnx_data_dump((char*)__func__, skb->data, skb->len);
-    if((g_rwnx_plat->usbdev->chipid == PRODUCT_ID_AIC8801) ||
-        ((g_rwnx_plat->usbdev->chipid == PRODUCT_ID_AIC8800DC ||
-        g_rwnx_plat->usbdev->chipid == PRODUCT_ID_AIC8800DW) && chip_id < 3)){
-            nx_off_chan_txq_idx = NX_OFF_CHAN_TXQ_IDX_FOR_OLD_IC;
+    if (unlikely(skb->len < sizeof(*rtap_hdr))) {
+        AICWFDBG(LOGERROR, "%s radiotap header is truncated\n", __func__);
+        goto free_tag;
    }

-
+    rtap_hdr = (struct ieee80211_radiotap_header*)(rtap_buf);
    if (unlikely(rtap_hdr->it_version)) {
        AICWFDBG(LOGERROR, "%s itv \r\n", __func__);
        goto free_tag;
    }

+    rtap_len = ieee80211_get_radiotap_len(rtap_buf);//max_length
+    if (unlikely(rtap_len < sizeof(*rtap_hdr))) {
+        AICWFDBG(LOGERROR, "%s rtap_len < sizeof(struct ieee80211_radiotap_header) \r\n", __func__);
+        goto free_tag;
+    }
+
    if (unlikely(skb->len < rtap_len)) {
        AICWFDBG(LOGERROR, "%s skb->len < rtap_len \r\n", __func__);
        goto free_tag;
    }

-    if (unlikely(rtap_len < sizeof(struct ieee80211_radiotap_header))){
-        AICWFDBG(LOGERROR, "%s rtap_len < sizeof(struct ieee80211_radiotap_header) \r\n", __func__);
-        goto free_tag;
+    AICWFDBG(LOGINFO, "rwnx_start_monitor_if_xmit, skb_len=%d, rtap_len=%d\n", skb->len, rtap_len);
+//rwnx_data_dump((char*)__func__, skb->data, skb->len);
+    if((g_rwnx_plat->usbdev->chipid == PRODUCT_ID_AIC8801) ||
+        ((g_rwnx_plat->usbdev->chipid == PRODUCT_ID_AIC8800DC ||
+        g_rwnx_plat->usbdev->chipid == PRODUCT_ID_AIC8800DW) && chip_id < 3)){
+            nx_off_chan_txq_idx = NX_OFF_CHAN_TXQ_IDX_FOR_OLD_IC;
    }
-
    frame_len -= rtap_len;
    pframe = rtap_buf + rtap_len;

@@ -172,7 +172,8 @@ int rwnx_start_mgmt_xmit(struct rwnx_vif *vif, struct rwnx_sta *sta,
                         u64 *cookie);
 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0) */
 #ifdef CONFIG_RWNX_MON_XMIT
-int rwnx_start_monitor_if_xmit(struct sk_buff *skb, struct net_device *dev);
+netdev_tx_t rwnx_start_monitor_if_xmit(struct sk_buff *skb,
+                                       struct net_device *dev);
 #endif
 int rwnx_txdatacfm(void *pthis, void *host_id);

@@ -39,36 +39,14 @@ typedef struct {
 #define AIC_PATCH_OFST(mem) ((size_t) &((aic_patch_t *)0)->mem)
 #define AIC_PATCH_ADDR(mem) ((u32) (aic_patch_str_base + AIC_PATCH_OFST(mem)))

-#define USER_PWROFST_COVER_CALIB_FLAG   (0x01U << 0)
-#define USER_CHAN_MAX_TXPWR_EN_FLAG     (0x01U << 1)
-#define USER_TX_USE_ANA_F_FLAG          (0x01U << 2)
-#define USER_APM_PRBRSP_OFFLOAD_DISABLE_FLAG    (0x01U << 3)
-#define USER_HE_MU_EDCA_UPDATE_DISABLE_FLAG     (0x01U << 4)
-#define USER_LOFT_CALIB_DISABLE_FLAG    (0x01U << 6)
-#define USER_CAPA_CALIB_DISABLE_FLAG    (0x01U << 7)
-#define USER_PWR_CALIB_DISABLE_FLAG     (0x01U << 8)
-#define USER_IPA_CALIB_DISABLE_FLAG     (0x01U << 13)
-
-#define USER_EXT_FLAGS_DEFAULT_D80      (USER_PWROFST_COVER_CALIB_FLAG)
-
-#define CFG_USER_PWROFST_COVER_CALIB_EN     (1)
-#if (defined(CONFIG_POWER_LIMIT))
-#define CFG_USER_CHAN_MAX_TXPWR_EN          (1)
-#else
-#define CFG_USER_CHAN_MAX_TXPWR_EN          (0)
-#endif
-#define CFG_USER_TX_USE_ANA_F_EN            (0)
-#if (defined(CONFIG_PRBREQ_REPORT))
-#define CFG_USER_APM_PRBRSP_OFFLOAD_DISABLE (1)
-#else
-#define CFG_USER_APM_PRBRSP_OFFLOAD_DISABLE (0)
-#endif
-#define CFG_USER_HE_MU_EDCA_UPDATE_DISABLE  (0)
-#define CFG_USER_LOFT_CALIB_DISABLE_DISABLE (0)
-#define CFG_USER_CAPA_CALIB_DISABLE_DISABLE (0)
-#define CFG_USER_PWR_CALIB_DISABLE_DISABLE  (0)
-#define CFG_USER_IPA_CALIB_DISABLE_DISABLE  (0)
-
+/*
+ * Issue #58 legacy-loader test.
+ *
+ * Keep this table aligned with the SDK V3 D80 firmware imported from Radxa
+ * commit 254d47e6a131dbed5ba32131972f4719f3e1c7fe.  Newer loader patches use
+ * different RX aggregation settings and a user_ext_flags field that is not
+ * part of this firmware generation.
+ */
 u32 patch_tbl_d80[][2] =
 {
    #ifdef USE_5G
@@ -76,54 +54,7 @@ u32 patch_tbl_d80[][2] =
    #else
    {0x00b4, 0xf3010000},
    #endif
-#ifdef CONFIG_PLATFORM_HI
-    {0x0170, 0x00010001},//rx aggr counter
-#else
-    {0x0170, 0x0001000A},//rx aggr counter
-#endif
-
-    {0x0188,
-        (USER_EXT_FLAGS_DEFAULT_D80 |
-            #if CFG_USER_CHAN_MAX_TXPWR_EN
-            USER_CHAN_MAX_TXPWR_EN_FLAG |
-            #endif
-            #if CFG_USER_TX_USE_ANA_F_EN
-            USER_TX_USE_ANA_F_FLAG |
-            #endif
-            #if CFG_USER_APM_PRBRSP_OFFLOAD_DISABLE
-            USER_APM_PRBRSP_OFFLOAD_DISABLE_FLAG |
-            #endif
-            #if CFG_USER_HE_MU_EDCA_UPDATE_DISABLE
-            USER_HE_MU_EDCA_UPDATE_DISABLE_FLAG |
-            #endif
-            #if CFG_USER_LOFT_CALIB_DISABLE_DISABLE
-            USER_LOFT_CALIB_DISABLE_FLAG |
-            #endif
-            #if CFG_USER_CAPA_CALIB_DISABLE_DISABLE
-            USER_CAPA_CALIB_DISABLE_FLAG |
-            #endif
-            #if CFG_USER_PWR_CALIB_DISABLE_DISABLE
-            USER_PWR_CALIB_DISABLE_FLAG |
-            #endif
-            #if CFG_USER_IPA_CALIB_DISABLE_DISABLE
-            USER_IPA_CALIB_DISABLE_FLAG |
-            #endif
-        0) & ~(
-            #if !CFG_USER_PWROFST_COVER_CALIB_EN
-            USER_PWROFST_COVER_CALIB_FLAG |
-            #endif
-        0)
-    }, // user_ext_flags
-
-#ifdef CONFIG_RADAR_OR_IR_DETECT
-	{0x0019c,0x00000900},
-#endif
-#ifdef CONFIG_WOWLAN
-    {0x019c,0x01000000},
-#ifdef ANDROID_PLATFORM
-    {0x01A0, 0x01000001},
-#endif
-#endif
+    {0x0170, 0x00000002},//rx aggr counter
 };

 //adap test
@@ -144,16 +75,11 @@ u32 syscfg_tbl_8800d80[][2] = {

 extern int adap_test;

-#define NEW_PATCH_BUFFER_MAP    1
-
 int aicwf_patch_config_8800d80(struct aic_usb_dev *usb_dev)
 {
    u32 rd_patch_addr;
    u32 aic_patch_addr;
    u32 config_base, aic_patch_str_base;
-    #if (NEW_PATCH_BUFFER_MAP)
-    u32 patch_buff_addr, patch_buff_base, rd_version_addr, rd_version_val;
-    #endif
    uint32_t start_addr = 0x001D7000;
    u32 patch_addr = start_addr;
    u32 patch_cnt = sizeof(patch_tbl_d80) / 4 / 2;
@@ -190,32 +116,6 @@ int aicwf_patch_config_8800d80(struct aic_usb_dev *usb_dev)
    AICWFDBG(LOGERROR, "%x=%x\n", rd_patch_addr_cfm.memaddr, rd_patch_addr_cfm.memdata);
    aic_patch_str_base = rd_patch_addr_cfm.memdata;

-    #if (NEW_PATCH_BUFFER_MAP)
-    if (chip_id == CHIP_REV_U01) {
-        rd_version_addr = RAM_FMAC_FW_ADDR_8800D80 + 0x01C;
-    } else {
-        rd_version_addr = RAM_FMAC_FW_ADDR_8800D80_U02 + 0x01C;
-    }
-    if ((ret = rwnx_send_dbg_mem_read_req(usb_dev, rd_version_addr, &rd_patch_addr_cfm))) {
-        AICWFDBG(LOGERROR, "version val[0x%x] rd fail: %d\n", rd_version_addr, ret);
-        return ret;
-    }
-    rd_version_val = rd_patch_addr_cfm.memdata;
-    AICWFDBG(LOGINFO, "rd_version_val=%08X\n", rd_version_val);
-    usb_dev->fw_version_uint = rd_version_val;
-    if (rd_version_val > 0x06090100) {
-        patch_buff_addr = rd_patch_addr + 12;
-        ret = rwnx_send_dbg_mem_read_req(usb_dev, patch_buff_addr, &rd_patch_addr_cfm);
-        if (ret) {
-            AICWFDBG(LOGERROR, "patch buf rd fail\n");
-            return ret;
-        }
-        AICWFDBG(LOGINFO, "%x=%x\n", rd_patch_addr_cfm.memaddr, rd_patch_addr_cfm.memdata);
-        patch_buff_base = rd_patch_addr_cfm.memdata;
-        patch_addr = start_addr = patch_buff_base;
-    }
-    #endif
-
    if ((ret = rwnx_send_dbg_mem_write_req(usb_dev, AIC_PATCH_ADDR(magic_num), AIC_PATCH_MAGIG_NUM))) {
        AICWFDBG(LOGERROR, "maigic_num[0x%x] write fail: %d\n", AIC_PATCH_ADDR(magic_num), ret);
        return ret;
@@ -346,10 +246,11 @@ int system_config_8800d80(struct aic_usb_dev *usb_dev){
        }
 		chip_id = (u8)(rd_mem_addr_cfm.memdata >> 16);
 		printk("chip_id=%x, chip_mcu_id = %d\n", chip_id, chip_mcu_id);
-		if (chip_mcu_id) {
+		printk("AIC8800D80 legacy: using Radxa SDK V3 loader profile\n");
+		if (chip_mcu_id == 1) {
 			ret = rwnx_send_dbg_mem_read_req(usb_dev, cache_mem_addr, &rd_mem_addr_cfm);
 			if (ret) {
-				printk("%x rd fail: %d\n", mem_addr, ret);
+				printk("%x rd fail: %d\n", cache_mem_addr, ret);
 				return ret;
 			}
 			rd_mem_addr_cfm.memdata |= 0x01;
@@ -358,6 +259,7 @@ int system_config_8800d80(struct aic_usb_dev *usb_dev){
 				printk("%x write fail: %d\n", cache_mem_addr, ret);
 				return ret;
 			}
+			printk("AIC8800D80 MCU1: enabled Bluetooth cache fix\n");
 		}
    #if 1
 		syscfg_num = sizeof(syscfg_tbl_8800d80) / sizeof(u32) / 2;
@@ -149,7 +149,11 @@ static int usb_submit_urb_pre_handler(struct kprobe *p, struct pt_regs *regs)

 	(void)p;

+#if defined(CONFIG_ARM)
+	urb = (struct urb *)regs->ARM_r0;
+#else
 	urb = (struct urb *)regs_get_kernel_argument(regs, 0);
+#endif
 	if (is_bluetooth_acl_endpoint(urb))
 		enable_zlp(urb);

@@ -1,117 +0,0 @@
-# AIC POWERLIMIT 2025/0623/1700
-# Max tx power reference: Linux wireless regulatory database for CRDA
-# https://git.kernel.org/pub/scm/linux/kernel/git/sforshee/wireless-regdb.git/tree/db.txt
-# If loss_value in aic_userconfig.txt is enabled, the power value in this document will be subtracted from loss_value in actual judgment
-
-# Table 1:
-##    2.4G, 20M,#6#
-##	START
-##        SRRC  FCC  ETSI  JP  KCC   UNSET
-CH01      16    14   14    16  16    15
-CH02      16    14   14    16  16    16
-CH03      16    14   14    16  16    16
-CH04      16    14   14    16  16    16
-CH05      16    14   14    16  16    16
-CH06      16    14   14    16  16    16
-CH07      16    14   14    16  16    16
-CH08      16    14   14    16  16    16
-CH09      16    14   14    16  16    16
-CH10      16    14   14    16  16    16
-CH11      16    14   14    16  16    16
-CH12      15    14   14    16  16    12
-CH13      13    14   14    16  16    12
-CH14      NA    NA   NA    16  NA    12
-##	END
-
-# Table 2:
-##	2.4G, 40M,#6#
-##	START
-##        SRRC  FCC  ETSI  JP  KCC  UNSET
-CH01      NA    NA   NA    NA  NA   NA
-CH02      NA    NA   NA    NA  NA   NA
-CH03      16    13   14    16  16   16
-CH04      16    13   14    16  16   16
-CH05      16    13   14    16  16   16
-CH06      16    13   14    16  16   16
-CH07      16    13   14    16  16   16
-CH08      16    13   14    16  16   16
-CH09      16    11   14    16  16   16
-CH10      16    11   14    16  16   16
-CH11      16    11   14    16  16   16
-CH12      NA    NA   NA    NA  NA   NA
-CH13      NA    NA   NA    NA  NA   NA
-CH14      NA    NA   NA    NA  NA   NA
-##	END
-
-# Table 3:
-##	5G, 20M,#6#
-##	START
-##        SRRC  FCC  ETSI  JP  KCC  UNSET
-# 5G Band 1
-CH36      15    16    16   16  16   15
-CH40      15    16    16   16  16   15
-CH44      15    16    16   16  16   15
-CH48      15    16    16   16  16   15
-# 5G Band 2
-CH52      15    16    16   16  16   15
-CH56      15    16    16   16  16   15
-CH60      15    16    16   16  16   15
-CH64      15    16    16   16  16   15
-# 5G Band 3
-CH100     NA    16    16   16  16   15
-CH104     NA    16    16   16  16   15
-CH108     NA    16    16   16  16   15
-CH112     NA    16    16   16  16   15
-CH116     NA    16    16   16  16   15
-CH120     NA    16    16   16  16   15
-CH124     NA    16    16   16  16   15
-CH128     NA    16    16   16  16   15
-CH132     NA    16    16   16  16   15
-CH136     NA    16    16   16  16   15
-CH140     NA    16    16   16  16   15
-CH144     NA    NA    16   16  16   15
-# 5G Band 4
-CH149     20    16    8    NA  20   11
-CH153     20    16    8    NA  20   11
-CH157     20    16    8    NA  20   11
-CH161     20    16    8    NA  20   11
-CH165     20    16    8    NA  20   11
-##	END
-
-# Table 4:
-##	5G, 40M,#6#
-##	START
-##        SRRC  FCC  ETSI  JP  KCC  UNSET
-# 5G Band 1
-CH38      15    16    16   16  20   15
-CH46      15    16    16   16  20   15
-# 5G Band 2
-CH54      15    16    16   16  20   15
-CH62      15    16    16   16  20   15
-# 5G Band 3
-CH102     NA    16    16   16  20   15
-CH110     NA    16    16   16  20   15
-CH118     NA    16    16   16  20   15
-CH126     NA    16    16   16  20   15
-CH134     NA    16    16   16  20   15
-CH142     NA    16    NA   16  20   15
-# 5G Band 4
-CH151     16    15    8    NA  18   11
-CH159     17    16    8    NA  17   11
-##	END
-
-# Table 5:
-##	5G, 80M,#6#
-##	START
-##        SRRC  FCC  ETSI  JP  KCC  UNSET
-# 5G Band 1
-CH42      15    16    16   16  20   15
-# 5G Band 2
-CH58      15    16    16   16  20   15
-# 5G Band 3
-CH106     NA    16    16   16  20   15
-CH122     NA    16    16   16  20   15
-CH138     NA    16    NA   NA  20   15
-# 5G Band 4
-CH155     15    14    8    NA  16   11
-##	END
@@ -67,23 +67,9 @@ lvl_11ax_mcs9_5g=13
 lvl_11ax_mcs10_5g=12
 lvl_11ax_mcs11_5g=12

-# txpwr_lvl_adj
-lvl_adj_enable=0
-lvl_adj_2g4_chan_1_4=0
-lvl_adj_2g4_chan_5_9=0
-lvl_adj_2g4_chan_10_13=0
-lvl_adj_5g_chan_42=0
-lvl_adj_5g_chan_58=0
-lvl_adj_5g_chan_106=0
-lvl_adj_5g_chan_122=0
-lvl_adj_5g_chan_138=0
-lvl_adj_5g_chan_155=0
-
 # txpwr_loss
-loss_enable_2g4=0
-loss_value_2g4=2
-loss_enable_5g=0
-loss_value_5g=5
+loss_enable=0
+loss_value=2

 # txpwr_ofst
 ofst_enable=0
@@ -1,124 +0,0 @@
-# AIC USERCONFIG 2022/0803/1707
-
-# txpwr_lvl
-enable=1
-lvl_11b_11ag_1m_2g4=20
-lvl_11b_11ag_2m_2g4=20
-lvl_11b_11ag_5m5_2g4=20
-lvl_11b_11ag_11m_2g4=20
-lvl_11b_11ag_6m_2g4=20
-lvl_11b_11ag_9m_2g4=20
-lvl_11b_11ag_12m_2g4=20
-lvl_11b_11ag_18m_2g4=20
-lvl_11b_11ag_24m_2g4=20
-lvl_11b_11ag_36m_2g4=19
-lvl_11b_11ag_48m_2g4=18
-lvl_11b_11ag_54m_2g4=17
-lvl_11n_11ac_mcs0_2g4=20
-lvl_11n_11ac_mcs1_2g4=20
-lvl_11n_11ac_mcs2_2g4=20
-lvl_11n_11ac_mcs3_2g4=20
-lvl_11n_11ac_mcs4_2g4=20
-lvl_11n_11ac_mcs5_2g4=19
-lvl_11n_11ac_mcs6_2g4=18
-lvl_11n_11ac_mcs7_2g4=17
-lvl_11n_11ac_mcs8_2g4=17
-lvl_11n_11ac_mcs9_2g4=16
-lvl_11ax_mcs0_2g4=20
-lvl_11ax_mcs1_2g4=20
-lvl_11ax_mcs2_2g4=20
-lvl_11ax_mcs3_2g4=20
-lvl_11ax_mcs4_2g4=20
-lvl_11ax_mcs5_2g4=19
-lvl_11ax_mcs6_2g4=18
-lvl_11ax_mcs7_2g4=17
-lvl_11ax_mcs8_2g4=17
-lvl_11ax_mcs9_2g4=16
-lvl_11ax_mcs10_2g4=15
-lvl_11ax_mcs11_2g4=15
-lvl_11a_6m_5g=19
-lvl_11a_9m_5g=19
-lvl_11a_12m_5g=19
-lvl_11a_18m_5g=18
-lvl_11a_24m_5g=18
-lvl_11a_36m_5g=18
-lvl_11a_48m_5g=18
-lvl_11a_54m_5g=18
-lvl_11n_11ac_mcs0_5g=19
-lvl_11n_11ac_mcs1_5g=19
-lvl_11n_11ac_mcs2_5g=19
-lvl_11n_11ac_mcs3_5g=18
-lvl_11n_11ac_mcs4_5g=18
-lvl_11n_11ac_mcs5_5g=18
-lvl_11n_11ac_mcs6_5g=18
-lvl_11n_11ac_mcs7_5g=17
-lvl_11n_11ac_mcs8_5g=15
-lvl_11n_11ac_mcs9_5g=15
-lvl_11ax_mcs0_5g=19
-lvl_11ax_mcs1_5g=19
-lvl_11ax_mcs2_5g=19
-lvl_11ax_mcs3_5g=18
-lvl_11ax_mcs4_5g=18
-lvl_11ax_mcs5_5g=18
-lvl_11ax_mcs6_5g=18
-lvl_11ax_mcs7_5g=17
-lvl_11ax_mcs8_5g=15
-lvl_11ax_mcs9_5g=15
-lvl_11ax_mcs10_5g=13
-lvl_11ax_mcs11_5g=13
-
-# txpwr_lvl_adj
-lvl_adj_enable=0
-lvl_adj_2g4_chan_1_4=0
-lvl_adj_2g4_chan_5_9=0
-lvl_adj_2g4_chan_10_13=0
-lvl_adj_5g_chan_42=0
-lvl_adj_5g_chan_58=0
-lvl_adj_5g_chan_106=0
-lvl_adj_5g_chan_122=0
-lvl_adj_5g_chan_138=0
-lvl_adj_5g_chan_155=0
-
-# txpwr_loss
-loss_enable_2g4=0
-loss_value_2g4=2
-loss_enable_5g=0
-loss_value_5g=5
-
-# txpwr_ofst
-ofst_enable=0
-ofst_2g4_11b_chan_1_4=0
-ofst_2g4_11b_chan_5_9=0
-ofst_2g4_11b_chan_10_13=0
-ofst_2g4_ofdm_highrate_chan_1_4=0
-ofst_2g4_ofdm_highrate_chan_5_9=0
-ofst_2g4_ofdm_highrate_chan_10_13=0
-ofst_2g4_ofdm_lowrate_chan_1_4=0
-ofst_2g4_ofdm_lowrate_chan_5_9=0
-ofst_2g4_ofdm_lowrate_chan_10_13=0
-ofst_5g_ofdm_lowrate_chan_42=0
-ofst_5g_ofdm_lowrate_chan_58=0
-ofst_5g_ofdm_lowrate_chan_106=0
-ofst_5g_ofdm_lowrate_chan_122=0
-ofst_5g_ofdm_lowrate_chan_138=0
-ofst_5g_ofdm_lowrate_chan_155=0
-ofst_5g_ofdm_highrate_chan_42=0
-ofst_5g_ofdm_highrate_chan_58=0
-ofst_5g_ofdm_highrate_chan_106=0
-ofst_5g_ofdm_highrate_chan_122=0
-ofst_5g_ofdm_highrate_chan_138=0
-ofst_5g_ofdm_highrate_chan_155=0
-ofst_5g_ofdm_midrate_chan_42=0
-ofst_5g_ofdm_midrate_chan_58=0
-ofst_5g_ofdm_midrate_chan_106=0
-ofst_5g_ofdm_midrate_chan_122=0
-ofst_5g_ofdm_midrate_chan_138=0
-ofst_5g_ofdm_midrate_chan_155=0
-
-# xtal cap
-xtal_enable=0
-xtal_cap=24
-xtal_cap_fine=31
-
-
-
@@ -1,124 +0,0 @@
-# AIC USERCONFIG 2022/0803/1707
-
-# txpwr_lvl
-enable=1
-lvl_11b_11ag_1m_2g4=18
-lvl_11b_11ag_2m_2g4=18
-lvl_11b_11ag_5m5_2g4=18
-lvl_11b_11ag_11m_2g4=18
-lvl_11b_11ag_6m_2g4=18
-lvl_11b_11ag_9m_2g4=18
-lvl_11b_11ag_12m_2g4=18
-lvl_11b_11ag_18m_2g4=18
-lvl_11b_11ag_24m_2g4=18
-lvl_11b_11ag_36m_2g4=18
-lvl_11b_11ag_48m_2g4=18
-lvl_11b_11ag_54m_2g4=17
-lvl_11n_11ac_mcs0_2g4=20
-lvl_11n_11ac_mcs1_2g4=20
-lvl_11n_11ac_mcs2_2g4=20
-lvl_11n_11ac_mcs3_2g4=20
-lvl_11n_11ac_mcs4_2g4=20
-lvl_11n_11ac_mcs5_2g4=19
-lvl_11n_11ac_mcs6_2g4=18
-lvl_11n_11ac_mcs7_2g4=18
-lvl_11n_11ac_mcs8_2g4=17
-lvl_11n_11ac_mcs9_2g4=16
-lvl_11ax_mcs0_2g4=20
-lvl_11ax_mcs1_2g4=20
-lvl_11ax_mcs2_2g4=20
-lvl_11ax_mcs3_2g4=20
-lvl_11ax_mcs4_2g4=20
-lvl_11ax_mcs5_2g4=19
-lvl_11ax_mcs6_2g4=18
-lvl_11ax_mcs7_2g4=18
-lvl_11ax_mcs8_2g4=17
-lvl_11ax_mcs9_2g4=17
-lvl_11ax_mcs10_2g4=16
-lvl_11ax_mcs11_2g4=16
-lvl_11a_6m_5g=18
-lvl_11a_9m_5g=18
-lvl_11a_12m_5g=18
-lvl_11a_18m_5g=18
-lvl_11a_24m_5g=18
-lvl_11a_36m_5g=18
-lvl_11a_48m_5g=18
-lvl_11a_54m_5g=18
-lvl_11n_11ac_mcs0_5g=20
-lvl_11n_11ac_mcs1_5g=19
-lvl_11n_11ac_mcs2_5g=19
-lvl_11n_11ac_mcs3_5g=18
-lvl_11n_11ac_mcs4_5g=18
-lvl_11n_11ac_mcs5_5g=18
-lvl_11n_11ac_mcs6_5g=18
-lvl_11n_11ac_mcs7_5g=17
-lvl_11n_11ac_mcs8_5g=16
-lvl_11n_11ac_mcs9_5g=16
-lvl_11ax_mcs0_5g=20
-lvl_11ax_mcs1_5g=19
-lvl_11ax_mcs2_5g=19
-lvl_11ax_mcs3_5g=18
-lvl_11ax_mcs4_5g=18
-lvl_11ax_mcs5_5g=18
-lvl_11ax_mcs6_5g=18
-lvl_11ax_mcs7_5g=17
-lvl_11ax_mcs8_5g=16
-lvl_11ax_mcs9_5g=16
-lvl_11ax_mcs10_5g=15
-lvl_11ax_mcs11_5g=15
-
-# txpwr_lvl_adj
-lvl_adj_enable=0
-lvl_adj_2g4_chan_1_4=0
-lvl_adj_2g4_chan_5_9=0
-lvl_adj_2g4_chan_10_13=0
-lvl_adj_5g_chan_42=0
-lvl_adj_5g_chan_58=0
-lvl_adj_5g_chan_106=0
-lvl_adj_5g_chan_122=0
-lvl_adj_5g_chan_138=0
-lvl_adj_5g_chan_155=0
-
-# txpwr_loss
-loss_enable_2g4=0
-loss_value_2g4=2
-loss_enable_5g=0
-loss_value_5g=5
-
-# txpwr_ofst
-ofst_enable=0
-ofst_2g4_11b_chan_1_4=0
-ofst_2g4_11b_chan_5_9=0
-ofst_2g4_11b_chan_10_13=0
-ofst_2g4_ofdm_highrate_chan_1_4=0
-ofst_2g4_ofdm_highrate_chan_5_9=0
-ofst_2g4_ofdm_highrate_chan_10_13=0
-ofst_2g4_ofdm_lowrate_chan_1_4=0
-ofst_2g4_ofdm_lowrate_chan_5_9=0
-ofst_2g4_ofdm_lowrate_chan_10_13=0
-ofst_5g_ofdm_lowrate_chan_42=0
-ofst_5g_ofdm_lowrate_chan_58=0
-ofst_5g_ofdm_lowrate_chan_106=0
-ofst_5g_ofdm_lowrate_chan_122=0
-ofst_5g_ofdm_lowrate_chan_138=0
-ofst_5g_ofdm_lowrate_chan_155=0
-ofst_5g_ofdm_highrate_chan_42=0
-ofst_5g_ofdm_highrate_chan_58=0
-ofst_5g_ofdm_highrate_chan_106=0
-ofst_5g_ofdm_highrate_chan_122=0
-ofst_5g_ofdm_highrate_chan_138=0
-ofst_5g_ofdm_highrate_chan_155=0
-ofst_5g_ofdm_midrate_chan_42=0
-ofst_5g_ofdm_midrate_chan_58=0
-ofst_5g_ofdm_midrate_chan_106=0
-ofst_5g_ofdm_midrate_chan_122=0
-ofst_5g_ofdm_midrate_chan_138=0
-ofst_5g_ofdm_midrate_chan_155=0
-
-# xtal cap
-xtal_enable=0
-xtal_cap=24
-xtal_cap_fine=31
-
-
-
@@ -1,124 +0,0 @@
-# AIC USERCONFIG 2022/0803/1707
-
-# txpwr_lvl
-enable=1
-lvl_11b_11ag_1m_2g4=20
-lvl_11b_11ag_2m_2g4=20
-lvl_11b_11ag_5m5_2g4=20
-lvl_11b_11ag_11m_2g4=20
-lvl_11b_11ag_6m_2g4=20
-lvl_11b_11ag_9m_2g4=20
-lvl_11b_11ag_12m_2g4=20
-lvl_11b_11ag_18m_2g4=20
-lvl_11b_11ag_24m_2g4=20
-lvl_11b_11ag_36m_2g4=19
-lvl_11b_11ag_48m_2g4=18
-lvl_11b_11ag_54m_2g4=17
-lvl_11n_11ac_mcs0_2g4=20
-lvl_11n_11ac_mcs1_2g4=20
-lvl_11n_11ac_mcs2_2g4=20
-lvl_11n_11ac_mcs3_2g4=20
-lvl_11n_11ac_mcs4_2g4=20
-lvl_11n_11ac_mcs5_2g4=19
-lvl_11n_11ac_mcs6_2g4=18
-lvl_11n_11ac_mcs7_2g4=17
-lvl_11n_11ac_mcs8_2g4=17
-lvl_11n_11ac_mcs9_2g4=16
-lvl_11ax_mcs0_2g4=20
-lvl_11ax_mcs1_2g4=20
-lvl_11ax_mcs2_2g4=20
-lvl_11ax_mcs3_2g4=20
-lvl_11ax_mcs4_2g4=20
-lvl_11ax_mcs5_2g4=19
-lvl_11ax_mcs6_2g4=18
-lvl_11ax_mcs7_2g4=17
-lvl_11ax_mcs8_2g4=17
-lvl_11ax_mcs9_2g4=16
-lvl_11ax_mcs10_2g4=15
-lvl_11ax_mcs11_2g4=15
-lvl_11a_6m_5g=19
-lvl_11a_9m_5g=19
-lvl_11a_12m_5g=19
-lvl_11a_18m_5g=18
-lvl_11a_24m_5g=18
-lvl_11a_36m_5g=18
-lvl_11a_48m_5g=18
-lvl_11a_54m_5g=18
-lvl_11n_11ac_mcs0_5g=19
-lvl_11n_11ac_mcs1_5g=19
-lvl_11n_11ac_mcs2_5g=19
-lvl_11n_11ac_mcs3_5g=18
-lvl_11n_11ac_mcs4_5g=18
-lvl_11n_11ac_mcs5_5g=18
-lvl_11n_11ac_mcs6_5g=18
-lvl_11n_11ac_mcs7_5g=17
-lvl_11n_11ac_mcs8_5g=15
-lvl_11n_11ac_mcs9_5g=15
-lvl_11ax_mcs0_5g=19
-lvl_11ax_mcs1_5g=19
-lvl_11ax_mcs2_5g=19
-lvl_11ax_mcs3_5g=18
-lvl_11ax_mcs4_5g=18
-lvl_11ax_mcs5_5g=18
-lvl_11ax_mcs6_5g=18
-lvl_11ax_mcs7_5g=17
-lvl_11ax_mcs8_5g=15
-lvl_11ax_mcs9_5g=15
-lvl_11ax_mcs10_5g=14
-lvl_11ax_mcs11_5g=14
-
-# txpwr_lvl_adj
-lvl_adj_enable=0
-lvl_adj_2g4_chan_1_4=0
-lvl_adj_2g4_chan_5_9=0
-lvl_adj_2g4_chan_10_13=0
-lvl_adj_5g_chan_42=0
-lvl_adj_5g_chan_58=0
-lvl_adj_5g_chan_106=0
-lvl_adj_5g_chan_122=0
-lvl_adj_5g_chan_138=0
-lvl_adj_5g_chan_155=0
-
-# txpwr_loss
-loss_enable_2g4=0
-loss_value_2g4=2
-loss_enable_5g=0
-loss_value_5g=5
-
-# txpwr_ofst
-ofst_enable=0
-ofst_2g4_11b_chan_1_4=0
-ofst_2g4_11b_chan_5_9=0
-ofst_2g4_11b_chan_10_13=0
-ofst_2g4_ofdm_highrate_chan_1_4=0
-ofst_2g4_ofdm_highrate_chan_5_9=0
-ofst_2g4_ofdm_highrate_chan_10_13=0
-ofst_2g4_ofdm_lowrate_chan_1_4=0
-ofst_2g4_ofdm_lowrate_chan_5_9=0
-ofst_2g4_ofdm_lowrate_chan_10_13=0
-ofst_5g_ofdm_lowrate_chan_42=0
-ofst_5g_ofdm_lowrate_chan_58=0
-ofst_5g_ofdm_lowrate_chan_106=0
-ofst_5g_ofdm_lowrate_chan_122=0
-ofst_5g_ofdm_lowrate_chan_138=0
-ofst_5g_ofdm_lowrate_chan_155=0
-ofst_5g_ofdm_highrate_chan_42=0
-ofst_5g_ofdm_highrate_chan_58=0
-ofst_5g_ofdm_highrate_chan_106=0
-ofst_5g_ofdm_highrate_chan_122=0
-ofst_5g_ofdm_highrate_chan_138=0
-ofst_5g_ofdm_highrate_chan_155=0
-ofst_5g_ofdm_midrate_chan_42=0
-ofst_5g_ofdm_midrate_chan_58=0
-ofst_5g_ofdm_midrate_chan_106=0
-ofst_5g_ofdm_midrate_chan_122=0
-ofst_5g_ofdm_midrate_chan_138=0
-ofst_5g_ofdm_midrate_chan_155=0
-
-# xtal cap
-xtal_enable=0
-xtal_cap=24
-xtal_cap_fine=31
-
-
-
@@ -1,117 +1,117 @@
-# AIC POWERLIMIT 2025/0623/1700
+# AIC POWERLIMIT 2024/1108/1900
 # Max tx power reference: Linux wireless regulatory database for CRDA
 # https://git.kernel.org/pub/scm/linux/kernel/git/sforshee/wireless-regdb.git/tree/db.txt
-# If loss_value in aic_userconfig.txt is enabled, the power value in this document will be subtracted from loss_value in actual judgment
+# If loss_value in aic_userconfig_8800d80.txt is enabled, the power value in this document will be subtracted from loss_value in actual judgment

 # Table 1:
-##    2.4G, 20M,#6#
+##    2.4G, 20M,#5#
 ##	START
-##        SRRC  FCC  ETSI  JP  KCC   UNSET
-CH01      16    14   14    16  16    15
-CH02      16    14   14    16  16    16
-CH03      16    14   14    16  16    16
-CH04      16    14   14    16  16    16
-CH05      16    14   14    16  16    16
-CH06      16    14   14    16  16    16
-CH07      16    14   14    16  16    16
-CH08      16    14   14    16  16    16
-CH09      16    14   14    16  16    16
-CH10      16    14   14    16  16    16
-CH11      16    14   14    16  16    16
-CH12      15    14   14    16  16    12
-CH13      13    14   14    16  16    12
-CH14      NA    NA   NA    16  NA    12
+##        SRRC  FCC  ETSI  JP  UNSET
+CH01      15    15   15    15  15
+CH02      16    16   16    16  16
+CH03      16    16   16    16  16
+CH04      16    16   16    16  16
+CH05      16    16   16    16  16
+CH06      16    16   16    16  16
+CH07      16    16   16    16  16
+CH08      16    16   16    16  16
+CH09      16    16   16    16  16
+CH10      16    16   16    16  16
+CH11      16    16   16    16  16
+CH12      12    12   12    12  12
+CH13      12    12   12    12  12
+CH14      NA    NA   NA    12  12
 ##	END

 # Table 2:
-##	2.4G, 40M,#6#
+##	2.4G, 40M,#5#
 ##	START
-##        SRRC  FCC  ETSI  JP  KCC  UNSET
-CH01      NA    NA   NA    NA  NA   NA
-CH02      NA    NA   NA    NA  NA   NA
-CH03      16    13   14    16  16   16
-CH04      16    13   14    16  16   16
-CH05      16    13   14    16  16   16
-CH06      16    13   14    16  16   16
-CH07      16    13   14    16  16   16
-CH08      16    13   14    16  16   16
-CH09      16    11   14    16  16   16
-CH10      16    11   14    16  16   16
-CH11      16    11   14    16  16   16
-CH12      NA    NA   NA    NA  NA   NA
-CH13      NA    NA   NA    NA  NA   NA
-CH14      NA    NA   NA    NA  NA   NA
+##        SRRC  FCC  ETSI  JP  UNSET
+CH01      NA    NA   NA    NA  NA
+CH02      NA    NA   NA    NA  NA
+CH03      16    16   16    16  16
+CH04      16    16   16    16  16
+CH05      16    16   16    16  16
+CH06      16    16   16    16  16
+CH07      16    16   16    16  16
+CH08      16    16   16    16  16
+CH09      16    16   16    16  16
+CH10      16    16   16    16  16
+CH11      16    16   16    16  16
+CH12      NA    NA   NA    NA  NA
+CH13      NA    NA   NA    NA  NA
+CH14      NA    NA   NA    NA  NA
 ##	END

 # Table 3:
-##	5G, 20M,#6#
+##	5G, 20M,#5#
 ##	START
-##        SRRC  FCC  ETSI  JP  KCC  UNSET
+##        SRRC  FCC  ETSI  JP  UNSET
 # 5G Band 1
-CH36      15    16    16   16  16   15
-CH40      15    16    16   16  16   15
-CH44      15    16    16   16  16   15
-CH48      15    16    16   16  16   15
+CH36      15    16    16   16  15
+CH40      15    16    16   16  15
+CH44      15    16    16   16  15
+CH48      15    16    16   16  15
 # 5G Band 2
-CH52      15    16    16   16  16   15
-CH56      15    16    16   16  16   15
-CH60      15    16    16   16  16   15
-CH64      15    16    16   16  16   15
+CH52      15    16    16   16  15
+CH56      15    16    16   16  15
+CH60      15    16    16   16  15
+CH64      15    16    16   16  15
 # 5G Band 3
-CH100     NA    16    16   16  16   15
-CH104     NA    16    16   16  16   15
-CH108     NA    16    16   16  16   15
-CH112     NA    16    16   16  16   15
-CH116     NA    16    16   16  16   15
-CH120     NA    16    16   16  16   15
-CH124     NA    16    16   16  16   15
-CH128     NA    16    16   16  16   15
-CH132     NA    16    16   16  16   15
-CH136     NA    16    16   16  16   15
-CH140     NA    16    16   16  16   15
-CH144     NA    NA    16   16  16   15
+CH100     NA    16    16   16  15
+CH104     NA    16    16   16  15
+CH108     NA    16    16   16  15
+CH112     NA    16    16   16  15
+CH116     NA    16    16   16  15
+CH120     NA    16    16   16  15
+CH124     NA    16    16   16  15
+CH128     NA    16    16   16  15
+CH132     NA    16    16   16  15
+CH136     NA    16    16   16  15
+CH140     NA    16    16   16  15
+CH144     NA    NA    16   16  15
 # 5G Band 4
-CH149     20    16    8    NA  20   11
-CH153     20    16    8    NA  20   11
-CH157     20    16    8    NA  20   11
-CH161     20    16    8    NA  20   11
-CH165     20    16    8    NA  20   11
+CH149     16    16    11   NA  11
+CH153     16    16    11   NA  11
+CH157     16    16    11   NA  11
+CH161     16    16    11   NA  11
+CH165     16    16    11   NA  11
 ##	END

 # Table 4:
-##	5G, 40M,#6#
+##	5G, 40M,#5#
 ##	START
-##        SRRC  FCC  ETSI  JP  KCC  UNSET
+##        SRRC  FCC  ETSI  JP  UNSET
 # 5G Band 1
-CH38      15    16    16   16  20   15
-CH46      15    16    16   16  20   15
+CH38      15    16    16   16  15
+CH46      15    16    16   16  15
 # 5G Band 2
-CH54      15    16    16   16  20   15
-CH62      15    16    16   16  20   15
+CH54      15    16    16   16  15
+CH62      15    16    16   16  15
 # 5G Band 3
-CH102     NA    16    16   16  20   15
-CH110     NA    16    16   16  20   15
-CH118     NA    16    16   16  20   15
-CH126     NA    16    16   16  20   15
-CH134     NA    16    16   16  20   15
-CH142     NA    16    NA   16  20   15
+CH102     NA    16    16   16  15
+CH110     NA    16    16   16  15
+CH118     NA    16    16   16  15
+CH126     NA    16    16   16  15
+CH134     NA    16    16   16  15
+CH142     NA    16    NA   16  15
 # 5G Band 4
-CH151     16    15    8    NA  18   11
-CH159     17    16    8    NA  17   11
+CH151     16    16    11   NA  11
+CH159     16    16    11   NA  11
 ##	END

 # Table 5:
-##	5G, 80M,#6#
+##	5G, 80M,#5#
 ##	START
-##        SRRC  FCC  ETSI  JP  KCC  UNSET
+##        SRRC  FCC  ETSI  JP  UNSET
 # 5G Band 1
-CH42      15    16    16   16  20   15
+CH42      15    16    16   16  15
 # 5G Band 2
-CH58      15    16    16   16  20   15
+CH58      15    16    16   16  15
 # 5G Band 3
-CH106     NA    16    16   16  20   15
-CH122     NA    16    16   16  20   15
-CH138     NA    16    NA   NA  20   15
+CH106     NA    16    16   16  15
+CH122     NA    16    16   16  15
+CH138     NA    16    NA   NA  15
 # 5G Band 4
-CH155     15    14    8    NA  16   11
+CH155     16    16    11   NA  11
 ##	END
@@ -1,117 +1,117 @@
-# AIC POWERLIMIT 2025/0623/1700
+# AIC POWERLIMIT 2024/1108/1900
 # Max tx power reference: Linux wireless regulatory database for CRDA
 # https://git.kernel.org/pub/scm/linux/kernel/git/sforshee/wireless-regdb.git/tree/db.txt
-# If loss_value in aic_userconfig.txt is enabled, the power value in this document will be subtracted from loss_value in actual judgment
+# If loss_value in aic_userconfig_8800d80.txt is enabled, the power value in this document will be subtracted from loss_value in actual judgment

 # Table 1:
-##    2.4G, 20M,#6#
+##    2.4G, 20M,#5#
 ##	START
-##        SRRC  FCC  ETSI  JP  KCC   UNSET
-CH01      16    14   14    16  16    15
-CH02      16    14   14    16  16    16
-CH03      16    14   14    16  16    16
-CH04      16    14   14    16  16    16
-CH05      16    14   14    16  16    16
-CH06      16    14   14    16  16    16
-CH07      16    14   14    16  16    16
-CH08      16    14   14    16  16    16
-CH09      16    14   14    16  16    16
-CH10      16    14   14    16  16    16
-CH11      16    14   14    16  16    16
-CH12      15    14   14    16  16    12
-CH13      13    14   14    16  16    12
-CH14      NA    NA   NA    16  NA    12
+##        SRRC  FCC  ETSI  JP  UNSET
+CH01      15    15   15    15  15
+CH02      16    16   16    16  16
+CH03      16    16   16    16  16
+CH04      16    16   16    16  16
+CH05      16    16   16    16  16
+CH06      16    16   16    16  16
+CH07      16    16   16    16  16
+CH08      16    16   16    16  16
+CH09      16    16   16    16  16
+CH10      16    16   16    16  16
+CH11      16    16   16    16  16
+CH12      12    12   12    12  12
+CH13      12    12   12    12  12
+CH14      NA    NA   NA    12  12
 ##	END

 # Table 2:
-##	2.4G, 40M,#6#
+##	2.4G, 40M,#5#
 ##	START
-##        SRRC  FCC  ETSI  JP  KCC  UNSET
-CH01      NA    NA   NA    NA  NA   NA
-CH02      NA    NA   NA    NA  NA   NA
-CH03      16    13   14    16  16   16
-CH04      16    13   14    16  16   16
-CH05      16    13   14    16  16   16
-CH06      16    13   14    16  16   16
-CH07      16    13   14    16  16   16
-CH08      16    13   14    16  16   16
-CH09      16    11   14    16  16   16
-CH10      16    11   14    16  16   16
-CH11      16    11   14    16  16   16
-CH12      NA    NA   NA    NA  NA   NA
-CH13      NA    NA   NA    NA  NA   NA
-CH14      NA    NA   NA    NA  NA   NA
+##        SRRC  FCC  ETSI  JP  UNSET
+CH01      NA    NA   NA    NA  NA
+CH02      NA    NA   NA    NA  NA
+CH03      16    16   16    16  16
+CH04      16    16   16    16  16
+CH05      16    16   16    16  16
+CH06      16    16   16    16  16
+CH07      16    16   16    16  16
+CH08      16    16   16    16  16
+CH09      16    16   16    16  16
+CH10      16    16   16    16  16
+CH11      16    16   16    16  16
+CH12      NA    NA   NA    NA  NA
+CH13      NA    NA   NA    NA  NA
+CH14      NA    NA   NA    NA  NA
 ##	END

 # Table 3:
-##	5G, 20M,#6#
+##	5G, 20M,#5#
 ##	START
-##        SRRC  FCC  ETSI  JP  KCC  UNSET
+##        SRRC  FCC  ETSI  JP  UNSET
 # 5G Band 1
-CH36      15    16    16   16  16   15
-CH40      15    16    16   16  16   15
-CH44      15    16    16   16  16   15
-CH48      15    16    16   16  16   15
+CH36      15    16    16   16  15
+CH40      15    16    16   16  15
+CH44      15    16    16   16  15
+CH48      15    16    16   16  15
 # 5G Band 2
-CH52      15    16    16   16  16   15
-CH56      15    16    16   16  16   15
-CH60      15    16    16   16  16   15
-CH64      15    16    16   16  16   15
+CH52      15    16    16   16  15
+CH56      15    16    16   16  15
+CH60      15    16    16   16  15
+CH64      15    16    16   16  15
 # 5G Band 3
-CH100     NA    16    16   16  16   15
-CH104     NA    16    16   16  16   15
-CH108     NA    16    16   16  16   15
-CH112     NA    16    16   16  16   15
-CH116     NA    16    16   16  16   15
-CH120     NA    16    16   16  16   15
-CH124     NA    16    16   16  16   15
-CH128     NA    16    16   16  16   15
-CH132     NA    16    16   16  16   15
-CH136     NA    16    16   16  16   15
-CH140     NA    16    16   16  16   15
-CH144     NA    NA    16   16  16   15
+CH100     NA    16    16   16  15
+CH104     NA    16    16   16  15
+CH108     NA    16    16   16  15
+CH112     NA    16    16   16  15
+CH116     NA    16    16   16  15
+CH120     NA    16    16   16  15
+CH124     NA    16    16   16  15
+CH128     NA    16    16   16  15
+CH132     NA    16    16   16  15
+CH136     NA    16    16   16  15
+CH140     NA    16    16   16  15
+CH144     NA    NA    16   16  15
 # 5G Band 4
-CH149     20    16    8    NA  20   11
-CH153     20    16    8    NA  20   11
-CH157     20    16    8    NA  20   11
-CH161     20    16    8    NA  20   11
-CH165     20    16    8    NA  20   11
+CH149     16    16    11   NA  11
+CH153     16    16    11   NA  11
+CH157     16    16    11   NA  11
+CH161     16    16    11   NA  11
+CH165     16    16    11   NA  11
 ##	END

 # Table 4:
-##	5G, 40M,#6#
+##	5G, 40M,#5#
 ##	START
-##        SRRC  FCC  ETSI  JP  KCC  UNSET
+##        SRRC  FCC  ETSI  JP  UNSET
 # 5G Band 1
-CH38      15    16    16   16  20   15
-CH46      15    16    16   16  20   15
+CH38      15    16    16   16  15
+CH46      15    16    16   16  15
 # 5G Band 2
-CH54      15    16    16   16  20   15
-CH62      15    16    16   16  20   15
+CH54      15    16    16   16  15
+CH62      15    16    16   16  15
 # 5G Band 3
-CH102     NA    16    16   16  20   15
-CH110     NA    16    16   16  20   15
-CH118     NA    16    16   16  20   15
-CH126     NA    16    16   16  20   15
-CH134     NA    16    16   16  20   15
-CH142     NA    16    NA   16  20   15
+CH102     NA    16    16   16  15
+CH110     NA    16    16   16  15
+CH118     NA    16    16   16  15
+CH126     NA    16    16   16  15
+CH134     NA    16    16   16  15
+CH142     NA    16    NA   16  15
 # 5G Band 4
-CH151     16    15    8    NA  18   11
-CH159     17    16    8    NA  17   11
+CH151     16    16    11   NA  11
+CH159     16    16    11   NA  11
 ##	END

 # Table 5:
-##	5G, 80M,#6#
+##	5G, 80M,#5#
 ##	START
-##        SRRC  FCC  ETSI  JP  KCC  UNSET
+##        SRRC  FCC  ETSI  JP  UNSET
 # 5G Band 1
-CH42      15    16    16   16  20   15
+CH42      15    16    16   16  15
 # 5G Band 2
-CH58      15    16    16   16  20   15
+CH58      15    16    16   16  15
 # 5G Band 3
-CH106     NA    16    16   16  20   15
-CH122     NA    16    16   16  20   15
-CH138     NA    16    NA   NA  20   15
+CH106     NA    16    16   16  15
+CH122     NA    16    16   16  15
+CH138     NA    16    NA   NA  15
 # 5G Band 4
-CH155     15    14    8    NA  16   11
+CH155     16    16    11   NA  11
 ##	END
@@ -0,0 +1,121 @@
+# AIC8800D80 legacy MCU revision 1 support
+
+The `legacy-mcu1` branch is the maintained compatibility profile for the older
+AIC8800D80 MCU revision tracked in
+[issue #58](https://github.com/shenmintao/aic8800d80/issues/58), with related
+reports in issues #14, #64, and #65. It is intended only for devices that log:
+
+```text
+chip_id=7, chip_mcu_id=1
+```
+
+Affected adapters have been observed entering through `a69c:572f` or a similar
+mass-storage ID, changing to `a69c:8d80` for firmware loading, and failing when
+the SDK V5 FMAC upload reaches address `0x170400`.
+
+## Root cause
+
+The affected MCU revision cannot accept the complete SDK V5 FMAC image in its
+available upload window. With an upload base of `0x120000`, the deterministic
+failure at `0x170400` gives a limit of about `0x50400` (328,704) bytes.
+
+| Firmware | Size | End address (exclusive) | Relative to `0x170400` |
+| --- | ---: | ---: | ---: |
+| SDK V5 FMAC on `main` | 358,072 bytes | `0x1776B8` | 29,368 bytes over |
+| SDK V3 FMAC on this branch | 327,037 bytes | `0x16FD7D` | 1,667 bytes free |
+
+Replacing only the FMAC image is not sufficient. Earlier mixed-firmware tests
+could enumerate but failed to provide a usable radio. This branch therefore
+uses the complete matching AIC8800D80 firmware set from Radxa SDK V3, fixed at
+upstream commit
+[`254d47e6a131dbed5ba32131972f4719f3e1c7fe`](https://github.com/radxa-pkg/aic8800/commit/254d47e6a131dbed5ba32131972f4719f3e1c7fe),
+together with its matching FMAC patch table and fixed patch-buffer layout.
+
+For `chip_mcu_id=1`, the loader also reads register `0x40100020`, sets bit 0,
+and writes it back before firmware upload. This is the MCU1 Bluetooth cache fix
+identified in [PR #35](https://github.com/shenmintao/aic8800d80/pull/35).
+Bluetooth continues to use the kernel's standard `btusb` driver; this branch
+does not contain or install `aic_btusb`.
+
+Firmware and loader paths for D80N, D80X2, and other variants are unchanged.
+The same branch now also carries the separately validated legacy DC/DW profile
+documented in the [issue #71 support notes](../issue71-mcu1-v3-profile/README.md).
+
+## Hardware validation
+
+The final profile was validated on a Steren COM-8231+ reporting
+`chip_id=7, chip_mcu_id=1`. Test commit
+[`027a7a8`](https://github.com/shenmintao/aic8800d80/commit/027a7a8)
+demonstrated all of the following:
+
+- the 327,037-byte FMAC uploads completely without `cmd timed-out` or
+  `bin upload fail: 170400`;
+- the adapter completes `a69c:572f -> a69c:8d80 -> a69c:8d81` enumeration;
+- 2.4 GHz and 5 GHz Wi-Fi scan, association, DHCP, and traffic work;
+- USB interfaces 0 and 1 bind to system `btusb`, while interface 2 binds to
+  `aic8800_fdrv`;
+- the earlier HCI Reset timeout `Opcode 0x0c03 failed: -110` is gone;
+- Bluetooth scan and a real connection both succeed.
+
+## Install
+
+From an existing clone:
+
+```bash
+git fetch origin
+git switch legacy-mcu1
+git pull --ff-only
+sudo ./install.sh
+sudo reboot
+```
+
+The installer replaces the installed AIC firmware. Switching Git branches
+without rerunning `install.sh` does not change the active firmware.
+
+The expected V3 FMAC can be confirmed with:
+
+```bash
+stat -c '%s bytes' /lib/firmware/aic8800D80/fmacfw_8800d80_u02.bin
+sha256sum /lib/firmware/aic8800D80/fmacfw_8800d80_u02.bin
+```
+
+Expected output:
+
+```text
+327037 bytes
+1ec680c2b63dcaa0e5d33c5fb6d1857d030f8145c05c385e243760388a61a0da
+```
+
+## Verify
+
+After reboot or a physical disconnect/reconnect, check the complete device:
+
+```bash
+sudo dmesg | grep -iE 'AIC8800D80|chip_id|chip_mcu_id|fmacfw|bin upload|cmd timed-out|Bluetooth|0x0c03|error -110'
+lsusb -t
+iw dev
+bluetoothctl list
+```
+
+The initialization log should contain:
+
+```text
+AIC8800D80 legacy: using Radxa SDK V3 loader profile
+AIC8800D80 MCU1: enabled Bluetooth cache fix
+```
+
+`lsusb -t` should show Bluetooth interfaces using `btusb` and the Wi-Fi
+interface using `aic8800_fdrv`. Verify traffic through the AIC network interface
+rather than an onboard Wi-Fi adapter or phone/RNDIS connection.
+
+## Return to current firmware
+
+Newer `chip_mcu_id=0` hardware should use `main`. Reinstall after switching so
+that the V5 firmware is restored under `/lib/firmware`:
+
+```bash
+git switch main
+git pull --ff-only
+sudo ./install.sh
+sudo reboot
+```
@@ -0,0 +1,77 @@
+# AIC8800DC/DW legacy MCU revision 1 support
+
+The `legacy-mcu1` branch is the maintained compatibility profile for older
+AIC8800DC/DW devices tracked in
+[issue #71](https://github.com/shenmintao/aic8800d80/issues/71). It follows the
+same method as the successful issue #58 D80 profile: use a complete, matched
+legacy firmware and loader rather than mixing firmware generations.
+
+The branch keeps the current USB transport, cfg80211 integration, device IDs,
+DKMS installer, and modern-kernel compatibility. For AIC8800DC/DW it restores
+the complete firmware directory and matching loader from immediately before
+SDK V5 commit `d66e5cb`. That loader includes the MCU1 cache fix and flash DPD
+validation used by the reporter's previously working driver.
+
+The first issue #71 test proved that the DPD result stored in flash was valid,
+but the V5 main application still timed out at `DBG_START_APP_REQ`. Test commit
+[`dbfbfa0`](https://github.com/shenmintao/aic8800d80/commit/dbfbfa0) restored the
+complete profile matching the reporter's known-good firmware hashes, after
+which the reporter confirmed that the TX1U Nano worked.
+
+## Install
+
+```bash
+git fetch origin
+git switch legacy-mcu1
+git pull --ff-only
+sudo ./install.sh
+sudo poweroff
+```
+
+After shutdown, unplug the TX1U Nano or remove host power for at least 10
+seconds before reconnecting and booting.
+
+## Verify
+
+```bash
+git rev-parse --short HEAD
+md5sum /lib/firmware/aic8800DC/fmacfw_patch_8800dc_u02.bin
+md5sum /lib/firmware/aic8800DC/fmacfw_patch_tbl_8800dc_u02.bin
+lsusb
+lsusb -t
+iw dev
+sudo journalctl -k -b --no-pager | tee issue71-v3-profile.log
+sudo journalctl -k -b --no-pager | grep -iE 'issue71|chip_id|chip_mcu_id|chip_sub_id|DPD|calib|patch.*tbl|start app|firmware version|interface|wlan|timed-out|err_lmac'
+```
+
+Expected firmware values and log markers include:
+
+```text
+bfd8ea1d174242e7ec823813b6c5d849  fmacfw_patch_8800dc_u02.bin
+7b5fde609392c2e6c2c5874838dda718  fmacfw_patch_tbl_8800dc_u02.bin
+chip_id=7, chip_mcu_id=1, chip_sub_id=1
+issue71: using complete pre-SDK-V5/V3 DC/DW firmware and loader profile
+issue71: legacy V3 flash DPD result is valid
+misc ram valid, skip calib process
+FMACFW_PATCH_TBL_8800DC_U02_DESCRIBE_BASE = 187c00
+Start app: 00150000, 5
+Firmware Version: ...
+New interface create wlan0
+```
+
+There should be no command timeout, `err_lmac_reqs`, or failed USB probe after
+the main application starts.
+
+Confirm scanning, association, DHCP, gateway and Internet reachability, real
+traffic, and clean initialization after a USB unplug/replug cycle.
+
+## Roll back
+
+```bash
+git switch main
+git pull --ff-only
+sudo ./install.sh
+sudo poweroff
+```
+
+Cold-power-cycle the adapter again before booting the rollback result.
@@ -0,0 +1,44 @@
+# OpenWrt backports build regression
+
+This checks complete module compilation and MODPOST against real kernel and
+wireless-stack headers. It requires an already prepared SDK/buildroot with
+cfg80211/mac80211 headers and `mac80211.symvers` staged. It does not install
+packages or load modules.
+
+For the x86_64 SDK used in issue #94:
+
+```sh
+sdk=/path/to/openwrt-sdk
+kernel="$sdk/build_dir/target-x86_64_musl/linux-x86_64/linux-6.12.94"
+export STAGING_DIR="$sdk/staging_dir/target-x86_64_musl"
+export PATH="$sdk/staging_dir/toolchain-x86_64_gcc-14.3.0_musl/bin:$PATH"
+
+bash tests/openwrt-backports/build.sh \
+    "$kernel" "$STAGING_DIR/usr/include" \
+    "$kernel/../symvers/mac80211.symvers" 6.18.26 \
+    ARCH=x86_64 CROSS_COMPILE=x86_64-openwrt-linux-musl-
+```
+
+The script copies the current driver into a fresh temporary directory and
+checks that all three `.ko` files are produced. Additional make arguments
+can select a compiler or architecture. Use matching headers, configuration
+and symbol versions throughout; changing only the version argument is not
+a substitute for the matching wireless stack.
+
+## Verified on 2026-09-17
+
+- OpenWrt 25.12.5 x86_64 SDK: Linux 6.12.94, GCC 14.3.0, backports 6.18.26
+  with the mac80211 patches from OpenWrt revision `f5dae5ece4` applied:
+  all three modules compile and pass MODPOST with the kernel's `-Werror`.
+- Original driver revision `9594c5c`, on the same kernel/backports combination:
+  reproduces both RX argument-count errors and the four incompatible
+  `set_monitor_channel`, `set_wiphy_params`, `set_tx_power`, `get_tx_power`
+  callbacks. This comparison uses `-Wno-error=unused-label`, as the issue's
+  log does, to reach those failures. The fixed build needs no such override.
+- Native kernel headers 6.11.0-17, 6.17.0-14 and 7.2.0-070200, with
+  `CFG80211_VERSION` unset: all three modules compile and pass MODPOST.
+  The 7.2 check uses GCC 14 and reports compiler/attribute warnings because
+  those headers were built with GCC 15.
+
+These are build checks. They do not validate an installable OpenWrt package,
+firmware loading, Wi-Fi connectivity or Bluetooth operation on hardware.
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Compile a source copy against a prepared kernel and staged wireless backport.
+# Leaves the build directory for inspection; does not install or load modules.
+set -euo pipefail
+
+if [ "$#" -lt 4 ]; then
+    echo "Usage: $0 KERNEL_BUILD_DIR STAGED_INCLUDE_DIR MAC80211_SYMVERS CFG80211_VERSION [make arguments...]" >&2
+    exit 2
+fi
+
+kernel_dir=$(realpath "$1")
+include_dir=$(realpath "$2")
+symvers=$(realpath "$3")
+wireless_version=$4
+shift 4
+
+for required in "$kernel_dir/Makefile" "$kernel_dir/Module.symvers" \
+    "$include_dir/mac80211/net/cfg80211.h" \
+    "$include_dir/mac80211-backport/backport/autoconf.h" "$symvers"; do
+    if [ ! -f "$required" ]; then
+        echo "Missing build input: $required" >&2
+        exit 2
+    fi
+done
+
+repo_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
+build_dir=$(mktemp -d "${TMPDIR:-/tmp}/aic8800-backports.XXXXXX")
+cp -a "$repo_dir/drivers/aic8800/." "$build_dir/"
+echo "Build directory: $build_dir"
+
+make -C "$kernel_dir" M="$build_dir" \
+    NOSTDINC_FLAGS="-I$include_dir/mac80211-backport/uapi -I$include_dir/mac80211-backport -I$include_dir/mac80211/uapi -I$include_dir/mac80211 -include backport/backport.h" \
+    KBUILD_EXTRA_SYMBOLS="$symvers" \
+    CFG80211_VERSION="$wireless_version" \
+    -j"${JOBS:-2}" "$@" modules
+
+for module in aic_load_fw/aic_load_fw.ko aic8800_fdrv/aic8800_fdrv.ko \
+    aic_zlp_quirk/aic_zlp_quirk.ko; do
+    test -s "$build_dir/$module"
+done
+echo "All three modules built successfully in $build_dir"
@@ -2,8 +2,8 @@
 # Sends vendor-specific SCSI CDB to trigger mode switch from
 # USB Mass Storage to WiFi+BT mode.
 #
-# The 16-byte CDB is: FD 00 00 00 00 00 00 00 00 00 00 00 00 00 00 F2
-# Wrapped in a standard 31-byte SCSI CBW (Command Block Wrapper).
+# The two 16-byte CDBs end in F3 and F2 respectively. Each is wrapped in a
+# standard 31-byte SCSI CBW (Command Block Wrapper), and must be sent in order.
 #
 # Install as: /etc/usb_modeswitch.d/1111:1111
 # (The filename must contain a colon on Linux; this file is named
@@ -13,4 +13,6 @@ DefaultVendor=0x1111
 DefaultProduct=0x1111
 TargetVendor=0xa69c
 TargetProduct=0x8d80
-MessageContent="555342438765432100000000000010fd0000000000000000000000000000f2"
+MessageContent="555342438765432100000000000010fd0000000000000000000000000000f3"
+MessageContent2="555342438765432100000000000010fd0000000000000000000000000000f2"
+NeedResponse=1
Author	SHA1	Message	Date
Shen MintaoandClaude Opus 5.5	332677e771	docs: document OpenWrt cfg80211 backport builds `27af5ad` added the CFG80211_VERSION make variable for OpenWrt builds that use a newer mac80211 backport than the target kernel, but it is only described in a Makefile comment. Document how to pass it from an OpenWrt package Makefile, link the notes from the installation steps, and add the build script and the kernel/backports combinations verified for issue #94. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-09-24 14:59:53 +08:00
Shen MintaoandClaude Opus 5.5	a86affa3c6	fix: use monotonic snapshot versions for the Bazzite package The spec used the pinned commit hash as Version, and rpm does not order hashes by commit history: `51b7b6e` sorts after `c8327ea`, and `13baa9b` after `e93a7d2`, so a newer snapshot could be treated as an older package. Version snapshots as 1.0.0^<date>git<commit>, where 1.0.0 is the DKMS PACKAGE_VERSION, and add Epoch 1 so every snapshot sorts after all of the earlier hash versions. Checked with rpm 4.18: the spec parses and the new EVR compares newer than every previous Version. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-09-24 14:03:17 +08:00
Shen MintaoandClaude Opus 5.5	6229bf3c7e	fix: build the legacy Bazzite package on Linux 7.2 The legacy spec still pins `51b7b6e`, which predates `44748e1` ("fix: support Linux 7.2 cfg80211 API"). Against Linux 7.2 headers that snapshot fails with an implicit declaration of strncpy() and an incompatible cfg80211_ops::remain_on_channel initializer, the same failure `dd74ae6` fixed for the main package. Pin `c8327ea`, which also carries the fixes synchronized from main, and reset Release for the new snapshot. The pinned tree builds all three modules against 7.2.6 headers. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-09-24 13:42:37 +08:00
Shen Mintao	c8327eab5b	feat: enable monitor packet injection Build the existing monitor transmit path by default. Validate the radiotap header before parsing it and align the transmit prototype with netdev_tx_t. Hardware-tested-by: jkroepke (GitHub)	2026-09-24 13:38:13 +08:00
Lucas Kawatoko	b0ef216ed8	fix: handle set_monitor_channel dev parameter on 6.12 stable cfg80211_ops.set_monitor_channel() gained a "struct net_device dev" parameter in mainline 6.13, and the change was backported to the 6.12 stable series starting with 6.12.101. Debian 13 ships 6.12.107, so the existing ">= 6.13.0" guards select the old prototype there and the build fails with -Wincompatible-pointer-types: rwnx_main.c: error: initialization of 'int ()(struct wiphy , struct net_device , struct cfg80211_chan_def )' from incompatible pointer type 'int ()(struct wiphy , struct cfg80211_chan_def )' [-Wincompatible-pointer-types] This is the failure reported in #96 for Debian 13 trixie. Introduce AICWF_CFG80211_SET_MONITOR_CHANNEL_HAS_DEV in rwnx_compat.h, defined at AICWF_CFG80211_VERSION_CODE >= 6.12.101, and gate the nine set_monitor_channel call sites on it instead of comparing against 6.13.0. The threshold covers both the 6.12 backport and mainline 6.13, while kernels 6.11 and earlier 6.12.x keep the old prototype. The check now lives in one place and follows the existing AICWF_CFG80211_VERSION_CODE convention, so OpenWrt builds can override it with CFG80211_VERSION. The MODULE_IMPORT_NS guard at rwnx_main.c that also checks 6.13.0 is unrelated and is left untouched. Verified with clean builds against linux-headers 5.15.0-191, 6.1.0-53, 6.8.0-139, 6.11.0-8 and 6.12.107+deb13.	2026-09-24 13:25:15 +08:00
Shen Mintao	0dfe7588fc	fix: support OpenWrt cfg80211 backport versions Allow CFG80211_VERSION to select wireless API signatures independently of the target kernel. Keep native kernel builds on their existing version checks. Also guard the WEXT-only label and replace overlapping firmware path formatting with bounded appends so OpenWrt builds pass with Werror. Validated all three modules against OpenWrt Linux 6.12.94 with backports 6.18.26, plus native 6.11, 6.17 and 7.2 headers. Refs #94.	2026-09-24 13:25:15 +08:00
Shen Mintao	40f1d081e9	fix: sync upstream SUN60IW2P1 USB transfer settings Disable CONFIG_USB_ALIGN_DATA and enable CONFIG_USB_NO_TRANS_DMA_MAP when CONFIG_ARCH_SUN60IW2P1 is set, following the upstream USB controller workaround. Preserve the current defaults on other platforms. Source: radxa-pkg/aic8800 commit 33f19ba, fix-usbc1-controller-wifi-rate-of-sun60iw2p1.patch. Validation: GNU make resolves the expected settings for both platform branches; Linux 6.14, 6.17 and 7.2 module builds succeeded. No SUN60IW2P1 hardware was available for runtime validation.	2026-09-24 13:25:15 +08:00
Shen Mintao	966de5e878	fix: correct TDLS discovery response length on Linux 7.1+ Linux 7.1 moved action_code outside tdls_discover_resp. Reserve both category and action_code bytes before the response body so appending an IE does not overwrite the capability field. Sync the USB hunk from radxa-pkg/aic8800 commit bd01abe95bc83c4708dd1d117e27424ee41cc747. Validation: Linux 6.14, 6.17 and 7.2 module builds succeeded. A focused frame construction check detects the original one-byte overwrite and passes with this change. Hardware TDLS operation remains untested.	2026-09-24 13:25:15 +08:00
Shen Mintao	4b717f4048	docs: document Pandora mode switching	2026-08-17 01:21:09 +08:00
Shen Mintao	0e56f1a1f8	fix: use two-stage Pandora mode switch	2026-08-17 01:21:09 +08:00
Shen Mintao	8378d2ce34	fix: scope TP-Link AX900 match to Wi-Fi interface	2026-08-11 17:43:14 +08:00
YaQia	2384dbe450	feat: add USB ID for TP-Link AX900 (2357:014e) This adapter uses the AIC8800D80 chipset and was previously not matched by the fdrv probe. Add vendor/product IDs so the driver binds and both Wi-Fi and Bluetooth (via standard btusb) work. Tested on Linux 7.1.6 with TP-Link AX900 TL-XDN7000H.	2026-08-11 17:43:14 +08:00
Shen Mintao	8cbefea252	feat: add mode switch rule for AIC8800DE	2026-08-09 17:05:11 +08:00
Shen Mintao	655c14f9f3	feat: support AIC8800DE USB variant	2026-08-09 17:05:11 +08:00
Shen Mintao	44748e193a	fix: support Linux 7.2 cfg80211 API	2026-08-08 12:22:08 +08:00
Shen Mintao	35f32c238c	fix: avoid USB reboot hang after suspend	2026-08-08 12:22:08 +08:00
Shen Mintao	1b7c44ddd4	fix: respect caller build parallelism	2026-08-08 12:22:08 +08:00
Shen Mintao	5ea5196eea	fix: prevent monitor RX null dereference Do not send monitor frames through the normal data path when simultaneous monitor/data support is disabled. Handle monitor skb allocation failures without dereferencing NULL or dropping the original combined-mode frame. Fixes #83 (cherry picked from commit `531d16c4d6`)	2026-08-07 16:15:55 +08:00
Shen Mintao	fffad12a26	fix: support ARM32 ZLP kprobe arguments Read the first kernel argument from ARM_r0 on 32-bit ARM, where regs_get_kernel_argument() is unavailable. Fixes #82 (cherry picked from commit `40f00e69af`)	2026-08-06 16:34:32 +08:00
Shen Mintao	95d889d961	fix: update legacy Bazzite packaging	2026-07-29 09:36:05 +08:00
Shen Mintao	4bae903599	docs: finalize two-branch maintenance model	2026-07-25 19:42:46 +08:00
MinQ	51b8ab8062	Merge pull request #74 from shenmintao/test/legacy-mcu1-unified-bt-zlp feat: unify legacy Wi-Fi Bluetooth and ZLP support	2026-07-25 19:40:47 +08:00
Shen Mintao	ded6920d06	merge: sync validated Bluetooth diagnostics	2026-07-25 19:15:26 +08:00
Shen Mintao	bbc1a04e59	docs: deduplicate legacy retirement notice	2026-07-25 16:07:28 +08:00
Shen Mintao	e7b7599ad9	merge: sync unified Bluetooth retirement notice	2026-07-25 16:06:45 +08:00
Shen Mintao	b100e7a7ec	merge: sync legacy Bluetooth retirement notice	2026-07-25 16:06:35 +08:00
Shen Mintao	957b5f5a82	docs: clarify Bluetooth retirement on legacy branch	2026-07-25 16:05:16 +08:00
Shen Mintao	1358e55a0e	fix: refresh Bazzite package for unified legacy branch	2026-07-25 15:54:52 +08:00
Shen Mintao	51b7b6e729	test: unify legacy Wi-Fi Bluetooth and ZLP support # Conflicts: # .gitattributes # README.md	2026-07-25 15:54:23 +08:00
Shen Mintao	1f0c3e28ac	docs: point issue 71 to maintained legacy commit	2026-07-24 14:28:47 +08:00
Shen Mintao	59e6b00abe	docs: add DC/DW support to legacy MCU1 profile	2026-07-24 14:26:48 +08:00
Shen Mintao	dbfbfa0c64	test: use complete V3 DC/DW profile for issue 71	2026-07-24 14:24:30 +08:00
Shen Mintao	cc2a888d22	docs: promote MCU1 legacy firmware profile	2026-07-24 09:14:27 +08:00
Shen Mintao	027a7a8662	test: restore MCU1 cache fix for V3 firmware	2026-07-23 09:10:43 +08:00
Shen Mintao	7b2541e5c0	test: match D80 loader to legacy firmware	2026-07-22 16:55:44 +08:00
Shen Mintao	bff42860ff	test: add legacy D80 firmware for issue 58	2026-07-21 19:59:51 +08:00