Adding Support for Verizon CR1000A

I think I saw the 320mhz support in OEM firmware...

@lytr

phy0-ap0  ESSID: "OpenWrt5"
          Access Point: ...
          Mode: Master  Channel: 36 (5.180 GHz)  HT Mode: HE160
          Center Channel 1: 50 2: unknown
          Tx-Power: 26 dBm  Link Quality: unknown/70
          Signal: unknown  Noise: -109 dBm
          Bit Rate: unknown
          Encryption: WPA2 PSK (CCMP)
          Type: nl80211  HW Mode(s): 802.11ac/ax/n
          Hardware: embedded [Qualcomm Atheros IPQ8074]
          TX power offset: none
          Frequency offset: none
          Supports VAPs: yes  PHY name: phy0

phy1-ap0  ESSID: "OpenWrt2"
          Access Point: ...
          Mode: Master  Channel: 1 (2.412 GHz)  HT Mode: HE40
          Center Channel 1: 3 2: unknown
          Tx-Power: 24 dBm  Link Quality: unknown/70
          Signal: unknown  Noise: -96 dBm
          Bit Rate: unknown
          Encryption: WPA2 PSK (CCMP)
          Type: nl80211  HW Mode(s): 802.11ax/b/g/n
          Hardware: embedded [Qualcomm Atheros IPQ8074]
          TX power offset: none
          Frequency offset: none
          Supports VAPs: yes  PHY name: phy1

phy2-ap0  ESSID: "OpenWrt6"
          Access Point: ...
          Mode: Master  Channel: 33 (6.115 GHz)  HT Mode: HE160
          Center Channel 1: 47 2: unknown
          Tx-Power: 22 dBm  Link Quality: unknown/70
          Signal: unknown  Noise: -106 dBm
          Bit Rate: unknown
          Encryption: WPA3 SAE (CCMP)
          Type: nl80211  HW Mode(s): 802.11ax
          Hardware: 17CB:1104 17CB:1104 [Qualcomm Atheros QCN6024/9024/9074]
          TX power offset: none
          Frequency offset: none
          Supports VAPs: yes  PHY name: phy2

Thanks, my stuck on 10dBm...

Did you compile it yourself? You need new BDF from 'files' repo

Are you using this generic BDF: https://git.codelinaro.org/clo/qsdk/oss/ath11k-bdf/-/tree/NHSS.QSDK.12.4.5/QCN9074/hw1.0/WLAN.HK.2.9.0.1/WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1 ?

No, not generic. One from my files repo. Its a fixed version from OEM firmware.

The BDF file appears to be heavily modified.

Ask @Ansuel about the actual changes. I found no public tools to do anything meaningful with BDFs. Tried to add regdb section with recent regdb data but it gets ignored it seems.

CR1000A firmware download links I found.

Google drive links for people not using Fios

3.2.0.14
https://cpe-ems34.verizon.com/firmware/CHRA/chr2fa_fw_3.2.0.14_loader.bin

3.2.0.9
https://cpe-ems34.verizon.com/firmware/chr2fa_fw_3.2.0.9.bin

3.2.0.7
https://cpe-ems34.verizon.com/firmware/chr2fa_fw_3.2.0.7.bin

3.2.0.11
https://cdn3.vzwdm.com/hdm/chr2fa_fw_3.2.0.11_oldsig_1685136655890.bin

If you want to update to 3.2.0.14, update to 3.2.0.11 first.

1 Like

Did you find a way to downgrade by any chance?

1 Like

@robimarko trying to recompile with new 6.6 kernel.
Had to do a small fix for led driver and it seem to work properly.
Everything else seems to work too however I'm getting this in the boot logs

[    0.636590] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[    0.643377] sysfs: cannot create duplicate filename '/devices/platform/soc@0/20000000.pci/pci0000:00/0000:00:00.0/0000:01:00.0/resource0'
[    0.650387] cpr4_ipq807x_apss_read_fuse_data: apc_corner: speed bin = 0
[    0.654985] CPU: 2 PID: 53 Comm: kworker/u8:2 Not tainted 6.6.23 #0
[    0.654996] Hardware name: Verizon CR1000A (DT)
[    0.660900] cpr4_ipq807x_apss_read_fuse_data: apc_corner: CPR fusing revision = 1
[    0.668182] Workqueue: events_unbound async_run_entry_fn
[    0.675913] cpr4_ipq807x_apss_read_fuse_data: apc_corner: CPR misc fuse value = 0
[    0.683628] 
[    0.689827] cpr4_ipq807x_apss_read_fuse_data: apc_corner: Voltage boost fuse config = 0 boost = disable
[    0.693697] Call trace:
[    0.699065] cpr3_mem_acc_init: apc: not using memory accelerator regulator
[    0.706109]  dump_backtrace+0xa0/0xe0
[    0.711667] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused      SVS: open-loop= 704000 uV
[    0.717217]  show_stack+0x18/0x24
[    0.720779] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused      NOM: open-loop= 824000 uV
[    0.726249]  dump_stack_lvl+0x48/0x60
[    0.731717] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused    TURBO: open-loop= 888000 uV
[    0.736662]  dump_stack+0x18/0x24
[    0.736669]  sysfs_warn_dup+0x64/0x80
[    0.741006] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused   STURBO: open-loop= 992000 uV
[    0.746994]  sysfs_add_bin_file_mode_ns+0xd4/0xec
[    0.751736] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused      SVS: quot[ 7]= 720, quot_offset[ 7]=   0
[    0.759328]  sysfs_create_bin_file+0x68/0x78
[    0.767752] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused      NOM: quot[ 7]= 950, quot_offset[ 7]= 230
[    0.775559]  pci_create_attr+0xa0/0x188
[    0.783290] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused    TURBO: quot[ 7]=1058, quot_offset[ 7]= 105
[    0.790486]  pci_create_resource_files+0x5c/0xc0
[    0.797091] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused   STURBO: quot[ 7]=1243, quot_offset[ 7]= 185
[    0.803942]  pci_create_sysfs_dev_files+0x1c/0x30
[    0.811186] cpr3_regulator_init_ctrl: apc: Default CPR mode = closed-loop
[    0.816696]  pci_bus_add_device+0x30/0xb4
[    0.816706]  pci_bus_add_devices+0x3c/0x88
[    0.823783] cpufreq: cpufreq_online: CPU0: Running at unlisted initial frequency: 800000 KHz, changing to: 1017600 KHz
[    0.826942]  pci_bus_add_devices+0x68/0x88
[    0.826949]  pci_host_probe+0x44/0xc0
[    0.826957]  dw_pcie_host_init+0x250/0x5f8
[    0.826968]  qcom_pcie_probe+0x1cc/0x2e4
[    0.834360] remoteproc remoteproc0: cd00000.q6v5_wcss is available
[    0.842311]  platform_probe+0x68/0xc4
[    0.842318]  really_probe+0x148/0x2b0
[    0.842322]  __driver_probe_device+0x78/0x128
[    0.842324]  driver_probe_device+0x40/0x118
[    0.842327]  __driver_attach_async_helper+0x4c/0xb4
[    0.842330]  async_run_entry_fn+0x30/0xfc
[    0.851267] clk: Disabling unused clocks
[    0.858718]  process_one_work+0x16c/0x2cc
[    0.858724]  worker_thread+0x2ac/0x48c
[    0.858727]  kthread+0xdc/0xe0
[    0.858730]  ret_from_fork+0x10/0x20
[    0.908720] mmc0: new HS400 MMC card at address 0001
[    1.405591] qcom-pcie 10000000.pci: Phy link never came up
[    1.416910] mmcblk0: mmc0:0001 004GA0 3.69 GiB

any hints? Looks like some driver(s) try to register twice?

Now this is super weird as it looks like the same PCI slot is getting probed twice, but like how?

Could be related to dts somehow?

It shouldn't, let me try on AX9000 and see whats going on as I have not seen this so far

1 Like

It looks like a race condition between 2 threads? One fails to register and dies?

It also doesn't happen all the time. More like 1 out of 4 reboots

I tried the webpage for upgrades and it doesn't accept older version firmware.

BTW Is there any updates after 3.2.0.14?

@robimarko Rebased to the latest: now 6E can't start from LuCI. Seems like it tries to set hw_mode to g ??

daemon.notice wpa_supplicant[2143]: Set new config for phy phy2
Sun Apr  7 14:28:20 2024 daemon.notice hostapd: Set new config for phy phy2: /var/run/hostapd-phy2.conf
Sun Apr  7 14:28:20 2024 daemon.notice hostapd: Restart interface for phy phy2
Sun Apr  7 14:28:21 2024 daemon.notice hostapd: Configuration file: data: driver=nl80211 logger_syslog=127 logger_syslog_level=2 logger_stdout=127 logger_stdout_level=2 hw_mode=g supported_rates=60 90 120 180 240 360 480 540 basic_rates=60 120 240 beacon_int=100 #num_global_macaddr=1 channel=acs_survey  interface=phy2-ap0 bssid=78:67:0e:a2:00:45 ctrl_interface=/var/run/hostapd ap_isolate=1 bss_load_update_period=60 chan_util_avg_period=600 disassoc_low_ack=1 skip_inactivity_poll=0 preamble=1 wmm_enabled=1 ignore_broadcast_ssid=0 uapsd_advertisement_enabled=1 utf8_ssid=1 multi_ap=0 sae_require_mfp=1 sae_pwe=2 auth_algs=1 wpa=2 wpa_pairwise=CCMP ssid=OpenWrt6 bridge=br-lan wds_bridge= snoop_iface=br-lan wpa_disable_eapol_key_retries=0 wpa_key_mgmt=OWE okc=1 ieee80211w=2 group_mgmt_cipher=AES-128-CMAC qos_map_set=0,0,2,16,1,1,255,255,18,22,24,38,40,40,44,46,48,56 #default_macaddr nas_identifier=78670ea20045  (phy phy2) --> new PHY
Sun Apr  7 14:28:21 2024 kern.info kernel: [ 1532.783994] br-lan: port 4(phy2-ap0) entered blocking state
Sun Apr  7 14:28:21 2024 kern.info kernel: [ 1532.784038] br-lan: port 4(phy2-ap0) entered disabled state
Sun Apr  7 14:28:21 2024 kern.info kernel: [ 1532.788479] ath11k_pci 0000:01:00.0 phy2-ap0: entered allmulticast mode
Sun Apr  7 14:28:21 2024 kern.info kernel: [ 1532.794176] ath11k_pci 0000:01:00.0 phy2-ap0: entered promiscuous mode
Sun Apr  7 14:28:21 2024 daemon.err hostapd: Hardware does not support configured mode
Sun Apr  7 14:28:21 2024 daemon.warn hostapd: phy2-ap0: IEEE 802.11 Hardware does not support configured mode (1) (hw_mode in hostapd.conf)
Sun Apr  7 14:28:21 2024 daemon.err hostapd: Could not select hw_mode and channel. (-2)
Sun Apr  7 14:28:21 2024 daemon.notice hostapd: phy2-ap0: interface state UNINITIALIZED->DISABLED
Sun Apr  7 14:28:21 2024 daemon.notice hostapd: phy2-ap0: AP-DISABLED
Sun Apr  7 14:28:21 2024 daemon.err hostapd: phy2-ap0: Unable to setup interface.
Sun Apr  7 14:28:21 2024 daemon.notice hostapd: nl80211: deinit ifname=phy2-ap0 disabled_11b_rates=0
Sun Apr  7 14:28:21 2024 kern.info kernel: [ 1532.802134] ath11k_pci 0000:01:00.0 phy2-ap0: left allmulticast mode
Sun Apr  7 14:28:21 2024 kern.info kernel: [ 1532.807226] ath11k_pci 0000:01:00.0 phy2-ap0: left promiscuous mode
Sun Apr  7 14:28:21 2024 kern.info kernel: [ 1532.813731] br-lan: port 4(phy2-ap0) entered disabled state
Sun Apr  7 14:28:21 2024 daemon.err hostapd: rmdir[ctrl_interface=/var/run/hostapd]: Permission denied
Sun Apr  7 14:28:21 2024 daemon.notice hostapd: phy2-ap0: CTRL-EVENT-TERMINATING
Sun Apr  7 14:28:21 2024 daemon.err hostapd: hostapd_free_hapd_data: Interface phy2-ap0 wasn't started
Sun Apr  7 14:28:21 2024 daemon.notice hostapd: hostapd.add_iface failed for phy phy2 ifname=phy2-ap0
Sun Apr  7 14:28:21 2024 daemon.notice netifd: Wireless device 'radio2' is now up

the hostapd.conf is

root@OpenWrt:/# cat /var/run/hostapd-phy2.conf
driver=nl80211
logger_syslog=127
logger_syslog_level=2
logger_stdout=127
logger_stdout_level=2
hw_mode=g
supported_rates=60 90 120 180 240 360 480 540
basic_rates=60 120 240
beacon_int=100
channel=acs_survey




#num_global_macaddr=1


interface=phy2-ap0
ctrl_interface=/var/run/hostapd
ap_isolate=1
bss_load_update_period=60
chan_util_avg_period=600
disassoc_low_ack=1
skip_inactivity_poll=0
preamble=1
wmm_enabled=1
ignore_broadcast_ssid=0
uapsd_advertisement_enabled=1
utf8_ssid=1
multi_ap=0
sae_require_mfp=1
sae_pwe=2
auth_algs=1
wpa=2
wpa_pairwise=CCMP
ssid=OpenWrt6
bridge=br-lan
wds_bridge=
snoop_iface=br-lan
wpa_disable_eapol_key_retries=0
wpa_key_mgmt=OWE
okc=1
ieee80211w=2
group_mgmt_cipher=AES-128-CMAC
qos_map_set=0,0,2,16,1,1,255,255,18,22,24,38,40,40,44,46,48,56
bssid=...
#default_macaddr
```

Well, that is obviously incorrect, for 6E it needs to be hw_mode=a.
You are going to need to hunt whether its hostapd shell script, iwinfo or something 3rd causing this

1 Like

I haven't noticed this problem on recent sources on the MX8500 for the 6GHz radio.

Can you show the output of the command iwinfo phy2 freqlist?

here is is:


root@OpenWrt:/# iwinfo phy2 freqlist
  6.115 GHz (Band: 6 GHz, Channel 33) [NO_HT40-, INDOOR_ONLY]
  6.135 GHz (Band: 6 GHz, Channel 37) [INDOOR_ONLY]
  6.155 GHz (Band: 6 GHz, Channel 41) [INDOOR_ONLY]
  6.175 GHz (Band: 6 GHz, Channel 45) [INDOOR_ONLY]
  6.195 GHz (Band: 6 GHz, Channel 49) [INDOOR_ONLY]
  6.215 GHz (Band: 6 GHz, Channel 53) [INDOOR_ONLY]
  6.235 GHz (Band: 6 GHz, Channel 57) [INDOOR_ONLY]
  6.255 GHz (Band: 6 GHz, Channel 61) [INDOOR_ONLY]
  6.275 GHz (Band: 6 GHz, Channel 65) [INDOOR_ONLY]
  6.295 GHz (Band: 6 GHz, Channel 69) [INDOOR_ONLY]
  6.315 GHz (Band: 6 GHz, Channel 73) [INDOOR_ONLY]
  6.335 GHz (Band: 6 GHz, Channel 77) [INDOOR_ONLY]
  6.355 GHz (Band: 6 GHz, Channel 81) [INDOOR_ONLY]
  6.375 GHz (Band: 6 GHz, Channel 85) [INDOOR_ONLY]
  6.395 GHz (Band: 6 GHz, Channel 89) [INDOOR_ONLY]
  6.415 GHz (Band: 6 GHz, Channel 93) [INDOOR_ONLY]
  6.435 GHz (Band: 6 GHz, Channel 97) [INDOOR_ONLY]
  6.455 GHz (Band: 6 GHz, Channel 101) [INDOOR_ONLY]
  6.475 GHz (Band: 6 GHz, Channel 105) [INDOOR_ONLY]
  6.495 GHz (Band: 6 GHz, Channel 109) [INDOOR_ONLY]
  6.515 GHz (Band: 6 GHz, Channel 113) [INDOOR_ONLY]
  6.535 GHz (Band: 6 GHz, Channel 117) [INDOOR_ONLY]
  6.555 GHz (Band: 6 GHz, Channel 121) [INDOOR_ONLY]
  6.575 GHz (Band: 6 GHz, Channel 125) [INDOOR_ONLY]
  6.595 GHz (Band: 6 GHz, Channel 129) [INDOOR_ONLY]
  6.615 GHz (Band: 6 GHz, Channel 133) [INDOOR_ONLY]
  6.635 GHz (Band: 6 GHz, Channel 137) [INDOOR_ONLY]
  6.655 GHz (Band: 6 GHz, Channel 141) [INDOOR_ONLY]
  6.675 GHz (Band: 6 GHz, Channel 145) [INDOOR_ONLY]
  6.695 GHz (Band: 6 GHz, Channel 149) [INDOOR_ONLY]
  6.715 GHz (Band: 6 GHz, Channel 153) [INDOOR_ONLY]
  6.735 GHz (Band: 6 GHz, Channel 157) [INDOOR_ONLY]
  6.755 GHz (Band: 6 GHz, Channel 161) [INDOOR_ONLY]
  6.775 GHz (Band: 6 GHz, Channel 165) [INDOOR_ONLY]
  6.795 GHz (Band: 6 GHz, Channel 169) [INDOOR_ONLY]
  6.815 GHz (Band: 6 GHz, Channel 173) [INDOOR_ONLY]
  6.835 GHz (Band: 6 GHz, Channel 177) [INDOOR_ONLY]
  6.855 GHz (Band: 6 GHz, Channel 181) [INDOOR_ONLY]
  6.875 GHz (Band: 6 GHz, Channel 185) [INDOOR_ONLY]
  6.895 GHz (Band: 6 GHz, Channel 189) [INDOOR_ONLY]
  6.915 GHz (Band: 6 GHz, Channel 193) [INDOOR_ONLY]
  6.935 GHz (Band: 6 GHz, Channel 197) [INDOOR_ONLY]
  6.955 GHz (Band: 6 GHz, Channel 201) [INDOOR_ONLY]
  6.975 GHz (Band: 6 GHz, Channel 205) [INDOOR_ONLY]
  6.995 GHz (Band: 6 GHz, Channel 209) [INDOOR_ONLY]
  7.015 GHz (Band: 6 GHz, Channel 213) [INDOOR_ONLY]
  7.035 GHz (Band: 6 GHz, Channel 217) [INDOOR_ONLY]
  7.055 GHz (Band: 6 GHz, Channel 221) [INDOOR_ONLY]
  7.075 GHz (Band: 6 GHz, Channel 225) [INDOOR_ONLY]
  7.095 GHz (Band: 6 GHz, Channel 229) [INDOOR_ONLY]
  7.115 GHz (Band: 6 GHz, Channel 233) [NO_HT40+, INDOOR_ONLY]

other details

root@OpenWrt:/# iwinfo phy2 htmodelist
HE20 HE40 HE80 HE80+80 HE160
root@OpenWrt:/# iwinfo phy2 txpowerlist
 255 dBm (2147483647 mW)
root@OpenWrt:/# iwinfo phy2 info
phy2      ESSID: unknown
          Access Point: ...
          Mode: Master  Channel: unknown (unknown)  HT Mode: NOHT
          Center Channel 1: unknown 2: unknown
          Tx-Power: 0 dBm  Link Quality: unknown/70
          Signal: unknown  Noise: unknown
          Bit Rate: unknown
          Encryption: unknown
          Type: nl80211  HW Mode(s): 802.11ax
          Hardware: 17CB:1104 17CB:1104 [Qualcomm Atheros QCN6024/9024/9074]
          TX power offset: none
          Frequency offset: none
          Supports VAPs: yes  PHY name: phy2

In my case hw_mode=a is set correctly:

Thu Jan  1 00:09:34 1970 daemon.notice netifd: radio2 (2947): WARNING: Variable 'data' does not exist or is not an array/object
Thu Jan  1 00:09:34 1970 daemon.notice hostapd: Set new config for phy phy2:
Thu Jan  1 00:09:34 1970 daemon.notice wpa_supplicant[2179]: Set new config for phy phy2
Thu Jan  1 00:09:34 1970 daemon.notice wpa_supplicant[2179]: Set new config for phy phy2
Thu Jan  1 00:09:34 1970 daemon.notice hostapd: Set new config for phy phy2: /var/run/hostapd-phy2.conf
Thu Jan  1 00:09:34 1970 daemon.notice hostapd: Restart interface for phy phy2
Thu Jan  1 00:09:34 1970 daemon.notice hostapd: Configuration file: data: driver=nl80211 logger_syslog=127 logger_syslog_level=2 logger_stdout=127 logger_stdout_level=2 country_code=US ieee80211d=1 ieee80211h=1 hw_mode=a beacon_int=100 chanlist=33 tx_queue_data2_burst=2.0 #num_global_macaddr=1 ieee80211n=1 ht_coex=0 ht_capab=[HT40+] op_class=134 ieee80211ac=1 vht_oper_chwidth=2 vht_oper_centr_freq_seg0_idx=47 vht_capab=[MAX-A-MPDU-LEN-EXP0] ieee80211ax=1 he_oper_chwidth=2 he_oper_centr_freq_seg0_idx=47 he_su_beamformer=1 he_su_beamformee=1 he_mu_beamformer=1 he_bss_color=128 he_spr_sr_control=3 he_default_pe_duration=4 he_rts_threshold=1023 he_mu_edca_qos_info_param_count=0 he_mu_edca_qos_info_q_ack=0 he_mu_edca_qos_info_queue_request=0 he_mu_edca_qos_info_txop_request=0 he_mu_edca_ac_be_aifsn=8 he_mu_edca_ac_be_aci=0 he_mu_edca_ac_be_ecwmin=9 he_mu_edca_ac_be_ecwmax=10 he_mu_edca_ac_be_timer=255 he_mu_edca_ac_bk_aifsn=15 he_mu_edca_ac_bk_aci=1 he_mu_edca_ac_bk_ecwmin=9 he_mu_edca_ac_bk_ecwmax=10 he_mu_edca_ac_bk_timer=255 he_
Thu Jan  1 00:09:34 1970 kern.info kernel: [  574.876730] br-lan: port 5(phy2-ap0) entered blocking state
Thu Jan  1 00:09:34 1970 kern.info kernel: [  574.876774] br-lan: port 5(phy2-ap0) entered disabled state
Thu Jan  1 00:09:34 1970 kern.info kernel: [  574.881159] ath11k_pci 0000:01:00.0 phy2-ap0: entered allmulticast mode
Thu Jan  1 00:09:34 1970 kern.info kernel: [  574.886983] ath11k_pci 0000:01:00.0 phy2-ap0: entered promiscuous mode
Thu Jan  1 00:09:34 1970 daemon.notice hostapd: phy2-ap0: interface state UNINITIALIZED->COUNTRY_UPDATE
Thu Jan  1 00:09:35 1970 daemon.notice netifd: Network device 'phy2-ap0' link is up
Thu Jan  1 00:09:35 1970 daemon.notice netifd: bridge 'br-lan' link is up
Thu Jan  1 00:09:35 1970 daemon.notice netifd: Interface 'lan' has link connectivity
Thu Jan  1 00:09:35 1970 kern.info kernel: [  575.423644] br-lan: port 5(phy2-ap0) entered blocking state
Thu Jan  1 00:09:35 1970 kern.info kernel: [  575.423696] br-lan: port 5(phy2-ap0) entered forwarding state
Thu Jan  1 00:09:35 1970 daemon.notice hostapd: phy2-ap0: interface state COUNTRY_UPDATE->ENABLED
Thu Jan  1 00:09:35 1970 daemon.notice hostapd: phy2-ap0: AP-ENABLED
Thu Jan  1 00:09:35 1970 daemon.notice netifd: Wireless device 'radio2' is now up

iw phy2 info output:

Wiphy phy2
	wiphy index: 2
	max # scan SSIDs: 16
	max scan IEs length: 184 bytes
	max # sched scan SSIDs: 0
	max # match sets: 0
	Retry short limit: 7
	Retry long limit: 4
	Coverage class: 0 (up to 0m)
	Device supports AP-side u-APSD.
	Available Antennas: TX 0xf RX 0xf
	Configured Antennas: TX 0xf RX 0xf
	Supported interface modes:
		 * managed
		 * AP
		 * monitor
		 * mesh point
	Band 4:
		HE Iftypes: managed
			HE MAC Capabilities (0x000b9a181040):
				+HTC HE Supported
				TWT Requester
				Dynamic BA Fragementation Level: 1
				BSR
				Broadcast TWT
				OM Control
				Maximum A-MPDU Length Exponent: 3
				RX Control Frame to MultiBSS
				A-MSDU in A-MPDU
				OM Control UL MU Data Disable RX
			HE PHY Capabilities: (0x1c604c89ffdb839c110c00):
				HE40/HE80/5GHz
				HE160/5GHz
				HE160/HE80+80/5GHz
				LDPC Coding in Payload
				HE SU PPDU with 1x HE-LTF and 0.8us GI
				STBC Tx <= 80MHz
				STBC Rx <= 80MHz
				Full Bandwidth UL MU-MIMO
				DCM Max Constellation: 1
				DCM Max Constellation Rx: 1
				SU Beamformer
				SU Beamformee
				MU Beamformer
				Beamformee STS <= 80Mhz: 7
				Beamformee STS > 80Mhz: 7
				Sounding Dimensions <= 80Mhz: 3
				Sounding Dimensions > 80Mhz: 3
				Ng = 16 SU Feedback
				Ng = 16 MU Feedback
				Codebook Size SU Feedback
				Codebook Size MU Feedback
				PPE Threshold Present
				HE SU PPDU & HE PPDU 4x HE-LTF 0.8us GI
				Max NC: 3
				STBC Rx > 80MHz
				HE ER SU PPDU 4x HE-LTF 0.8us GI
				HE ER SU PPDU 1x HE-LTF 0.8us GI
				TX 1024-QAM
				RX 1024-QAM
			HE RX MCS and NSS set <= 80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE TX MCS and NSS set <= 80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE RX MCS and NSS set 160 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE TX MCS and NSS set 160 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
		EHT Iftypes: managed
			EHT MAC Capabilities (0x0000):
			EHT PHY Capabilities: (0x0000000000000000):
			EHT MCS/NSS: (0x):
			EHT bw <= 80 MHz, max NSS for MCS 8-9: Rx=0, Tx=0
			EHT bw <= 80 MHz, max NSS for MCS 10-11: Rx=0, Tx=0
			EHT bw <= 80 MHz, max NSS for MCS 12-13: Rx=0, Tx=0
			EHT bw=160 MHz, max NSS for MCS 8-9: Rx=0, Tx=0
			EHT bw=160 MHz, max NSS for MCS 10-11: Rx=0, Tx=0
			EHT bw=160 MHz, max NSS for MCS 12-13: Rx=0, Tx=0
		HE Iftypes: AP
			HE MAC Capabilities (0x000d9a181040):
				+HTC HE Supported
				TWT Responder
				Dynamic BA Fragementation Level: 1
				BSR
				Broadcast TWT
				OM Control
				Maximum A-MPDU Length Exponent: 3
				RX Control Frame to MultiBSS
				A-MSDU in A-MPDU
				OM Control UL MU Data Disable RX
			HE PHY Capabilities: (0x1c604c88ffdb839c110c00):
				HE40/HE80/5GHz
				HE160/5GHz
				HE160/HE80+80/5GHz
				LDPC Coding in Payload
				HE SU PPDU with 1x HE-LTF and 0.8us GI
				STBC Tx <= 80MHz
				STBC Rx <= 80MHz
				Full Bandwidth UL MU-MIMO
				DCM Max Constellation Rx: 1
				SU Beamformer
				SU Beamformee
				MU Beamformer
				Beamformee STS <= 80Mhz: 7
				Beamformee STS > 80Mhz: 7
				Sounding Dimensions <= 80Mhz: 3
				Sounding Dimensions > 80Mhz: 3
				Ng = 16 SU Feedback
				Ng = 16 MU Feedback
				Codebook Size SU Feedback
				Codebook Size MU Feedback
				PPE Threshold Present
				HE SU PPDU & HE PPDU 4x HE-LTF 0.8us GI
				Max NC: 3
				STBC Rx > 80MHz
				HE ER SU PPDU 4x HE-LTF 0.8us GI
				HE ER SU PPDU 1x HE-LTF 0.8us GI
				TX 1024-QAM
				RX 1024-QAM
			HE RX MCS and NSS set <= 80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE TX MCS and NSS set <= 80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE RX MCS and NSS set 160 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE TX MCS and NSS set 160 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
		EHT Iftypes: AP
			EHT MAC Capabilities (0x0000):
			EHT PHY Capabilities: (0x0000000000000000):
			EHT MCS/NSS: (0x):
			EHT bw <= 80 MHz, max NSS for MCS 8-9: Rx=0, Tx=0
			EHT bw <= 80 MHz, max NSS for MCS 10-11: Rx=0, Tx=0
			EHT bw <= 80 MHz, max NSS for MCS 12-13: Rx=0, Tx=0
			EHT bw=160 MHz, max NSS for MCS 8-9: Rx=0, Tx=0
			EHT bw=160 MHz, max NSS for MCS 10-11: Rx=0, Tx=0
			EHT bw=160 MHz, max NSS for MCS 12-13: Rx=0, Tx=0
		HE Iftypes: mesh point
			HE MAC Capabilities (0x00098a081040):
				+HTC HE Supported
				Dynamic BA Fragementation Level: 1
				BSR
				OM Control
				Maximum A-MPDU Length Exponent: 1
				RX Control Frame to MultiBSS
				A-MSDU in A-MPDU
				OM Control UL MU Data Disable RX
			HE PHY Capabilities: (0x1c600c80fd5b811c100000):
				HE40/HE80/5GHz
				HE160/5GHz
				HE160/HE80+80/5GHz
				LDPC Coding in Payload
				HE SU PPDU with 1x HE-LTF and 0.8us GI
				STBC Tx <= 80MHz
				STBC Rx <= 80MHz
				SU Beamformer
				SU Beamformee
				Beamformee STS <= 80Mhz: 7
				Beamformee STS > 80Mhz: 7
				Sounding Dimensions <= 80Mhz: 3
				Sounding Dimensions > 80Mhz: 3
				Ng = 16 SU Feedback
				Codebook Size SU Feedback
				PPE Threshold Present
				HE SU PPDU & HE PPDU 4x HE-LTF 0.8us GI
				Max NC: 3
				HE ER SU PPDU 1x HE-LTF 0.8us GI
			HE RX MCS and NSS set <= 80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE TX MCS and NSS set <= 80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE RX MCS and NSS set 160 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE TX MCS and NSS set 160 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
		EHT Iftypes: mesh point
			EHT MAC Capabilities (0x0000):
			EHT PHY Capabilities: (0x0000000000000000):
			EHT MCS/NSS: (0x):
			EHT bw <= 80 MHz, max NSS for MCS 8-9: Rx=0, Tx=0
			EHT bw <= 80 MHz, max NSS for MCS 10-11: Rx=0, Tx=0
			EHT bw <= 80 MHz, max NSS for MCS 12-13: Rx=0, Tx=0
			EHT bw=160 MHz, max NSS for MCS 8-9: Rx=0, Tx=0
			EHT bw=160 MHz, max NSS for MCS 10-11: Rx=0, Tx=0
			EHT bw=160 MHz, max NSS for MCS 12-13: Rx=0, Tx=0
		Frequencies:
			* 5955 MHz [1] (disabled)
			* 5975 MHz [5] (disabled)
			* 5995 MHz [9] (disabled)
			* 6015 MHz [13] (disabled)
			* 6035 MHz [17] (disabled)
			* 6055 MHz [21] (disabled)
			* 6075 MHz [25] (disabled)
			* 6095 MHz [29] (disabled)
			* 6115 MHz [33] (30.0 dBm)
			* 6135 MHz [37] (30.0 dBm)
			* 6155 MHz [41] (30.0 dBm)
			* 6175 MHz [45] (30.0 dBm)
			* 6195 MHz [49] (30.0 dBm)
			* 6215 MHz [53] (30.0 dBm)
			* 6235 MHz [57] (30.0 dBm)
			* 6255 MHz [61] (30.0 dBm)
			* 6275 MHz [65] (30.0 dBm)
			* 6295 MHz [69] (30.0 dBm)
			* 6315 MHz [73] (30.0 dBm)
			* 6335 MHz [77] (30.0 dBm)
			* 6355 MHz [81] (30.0 dBm)
			* 6375 MHz [85] (30.0 dBm)
			* 6395 MHz [89] (30.0 dBm)
			* 6415 MHz [93] (30.0 dBm)
			* 6435 MHz [97] (30.0 dBm)
			* 6455 MHz [101] (30.0 dBm)
			* 6475 MHz [105] (30.0 dBm)
			* 6495 MHz [109] (30.0 dBm)
			* 6515 MHz [113] (30.0 dBm)
			* 6535 MHz [117] (30.0 dBm)
			* 6555 MHz [121] (30.0 dBm)
			* 6575 MHz [125] (30.0 dBm)
			* 6595 MHz [129] (30.0 dBm)
			* 6615 MHz [133] (30.0 dBm)
			* 6635 MHz [137] (30.0 dBm)
			* 6655 MHz [141] (30.0 dBm)
			* 6675 MHz [145] (30.0 dBm)
			* 6695 MHz [149] (30.0 dBm)
			* 6715 MHz [153] (30.0 dBm)
			* 6735 MHz [157] (30.0 dBm)
			* 6755 MHz [161] (30.0 dBm)
			* 6775 MHz [165] (30.0 dBm)
			* 6795 MHz [169] (30.0 dBm)
			* 6815 MHz [173] (30.0 dBm)
			* 6835 MHz [177] (30.0 dBm)
			* 6855 MHz [181] (30.0 dBm)
			* 6875 MHz [185] (30.0 dBm)
			* 6895 MHz [189] (30.0 dBm)
			* 6915 MHz [193] (30.0 dBm)
			* 6935 MHz [197] (30.0 dBm)
			* 6955 MHz [201] (30.0 dBm)
			* 6975 MHz [205] (30.0 dBm)
			* 6995 MHz [209] (30.0 dBm)
			* 7015 MHz [213] (30.0 dBm)
			* 7035 MHz [217] (30.0 dBm)
			* 7055 MHz [221] (30.0 dBm)
			* 7075 MHz [225] (30.0 dBm)
			* 7095 MHz [229] (30.0 dBm)
			* 7115 MHz [233] (30.0 dBm)
			* 5935 MHz [2] (disabled)
	valid interface combinations:
		 * #{ managed } <= 1, #{ AP, mesh point } <= 16,
		   total <= 16, #channels <= 1, STA/AP BI must match, radar detect widths: { 20 MHz (no HT), 20 MHz, 40 MHz, 80 MHz, 80+80 MHz, 160 MHz }

	HT Capability overrides:
		 * MCS: ff ff ff ff ff ff ff ff ff ff
		 * maximum A-MSDU length
		 * supported channel width
		 * short GI for 40 MHz
		 * max A-MPDU length exponent
		 * min MPDU start spacing
	max # scan plans: 1
	max scan plan interval: -1
	max scan plan iterations: 0
	Maximum associated stations in AP mode: 128
	Supported extended features:
		* [ RRM ]: RRM
		* [ SET_SCAN_DWELL ]: scan dwell setting
		* [ FILS_STA ]: STA FILS (Fast Initial Link Setup)
		* [ CQM_RSSI_LIST ]: multiple CQM_RSSI_THOLD records
		* [ CONTROL_PORT_OVER_NL80211 ]: control port over nl80211
		* [ ACK_SIGNAL_SUPPORT ]: ack signal level support
		* [ TXQS ]: FQ-CoDel-enabled intermediate TXQs
		* [ ENABLE_FTM_RESPONDER ]: enable FTM (Fine Time Measurement) responder
		* [ STA_TX_PWR ]: TX power control per station
		* [ CONTROL_PORT_NO_PREAUTH ]: disable pre-auth over nl80211 control port support
		* [ SCAN_FREQ_KHZ ]: scan on kHz frequency support
		* [ CONTROL_PORT_OVER_NL80211_TX_STATUS ]: tx status for nl80211 control port support
		* [ FILS_DISCOVERY ]: FILS discovery frame transmission support
		* [ UNSOL_BCAST_PROBE_RESP ]: unsolicated broadcast probe response transmission support
		* [ BSS_COLOR ]: BSS coloring support