From 232b194aeca0375ee8b59bc4c074f91fdefa5491 Mon Sep 17 00:00:00 2001
From: Narayana Reddy P <narayanr@nvidia.com>
Date: Wed, 10 Sep 2025 14:20:56 +0000
Subject: [PATCH] rtl8852ce: realtek driver update to v126-16

----------------------------------
rtl8852ce release notes for Nvidia
----------------------------------

v1.19.16_nv-126-16-gbf1934e39.20250910_Certified_Module_beta
* fix scan issue in roaming test

==================================================================
v1.19.16_nv-126-15-ge5204803f.20250827_Certified_Module_beta
* Fix bug of 802.11d CC scan mechanism
[Description]
The 11d CC scan result may sometimes be overwritten by other scans.

==================================================================
v1.19.16_nv-126-14-g196875f8d.20250821_Certified_Module_beta
* fix 6G MBSSID disconnect problem
[Description]
Fix the issue where RSSI was not updated in non-transmitted BSSID, which could
cause disconnection due to incorrect RSSI values.

==================================================================

v1.19.16_nv-126-13-g7a2b96406.20250813_Certified_Module_beta
* fix 6G Enhanced open mode not work
[Description]
(1) Parse capabilities in MBSSID
    e.g. Vendor Specific OUI WMM IE
         Non-Inheritance IE
(2) Handle MBSSID sets
(3) Adjust MAX IE size from 768 to 1840 defined in WIFI Alliance

Bug 5422314
Bug 5226667

Change-Id: I63802c34fdc6e189566843d11992ff64b8e404fa
Signed-off-by: Narayana Reddy P <narayanr@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nv-oot/+/3450784
Reviewed-by: Shobek Attupurath <sattupurath@nvidia.com>
GVS: buildbot_gerritrpt <buildbot_gerritrpt@nvidia.com>
Reviewed-by: Bitan Biswas <bbiswas@nvidia.com>
---
 .../net/wireless/realtek/rtl8852ce/Makefile   |  42 +-
 .../net/wireless/realtek/rtl8852ce/common.mk  |   2 +-
 .../realtek/rtl8852ce/core/rtw_chplan.c       | 133 +++---
 .../realtek/rtl8852ce/core/rtw_ieee80211.c    |   2 +-
 .../realtek/rtl8852ce/core/rtw_mlme.c         |   4 +-
 .../realtek/rtl8852ce/core/rtw_mlme_ext.c     |  23 +-
 .../wireless/realtek/rtl8852ce/core/rtw_mp.c  |  43 +-
 .../realtek/rtl8852ce/core/rtw_scan.c         | 414 +++++++++++++-----
 .../realtek/rtl8852ce/core/rtw_wlan_util.c    |  11 +-
 .../realtek/rtl8852ce/include/drv_types.h     |   6 +
 .../realtek/rtl8852ce/include/rtw_version.h   |   2 +-
 .../wireless/realtek/rtl8852ce/include/wifi.h |   1 +
 .../realtek/rtl8852ce/include/wlan_bssdef.h   |   2 +-
 .../rtl8852ce/os_dep/linux/ioctl_cfg80211.c   |  27 +-
 .../realtek/rtl8852ce/phl/hal_g6/btc/btc.mk   |   4 +-
 .../realtek/rtl8852ce/phl/hal_g6/hal.mk       |   4 +-
 .../realtek/rtl8852ce/phl/hal_g6/mac/mac.mk   |   4 +-
 .../realtek/rtl8852ce/phl/hal_g6/phy/bb/bb.mk |   4 +-
 .../realtek/rtl8852ce/phl/hal_g6/phy/rf/rf.mk |   4 +-
 .../net/wireless/realtek/rtl8852ce/phl/phl.mk |   4 +-
 .../realtek/rtl8852ce/phl/phl_cmd_scan.c      |   4 +-
 .../realtek/rtl8852ce/phl/phl_git_info.h      |   4 +-
 22 files changed, 487 insertions(+), 257 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtl8852ce/Makefile b/drivers/net/wireless/realtek/rtl8852ce/Makefile
index 42c00833..3aab93ba 100644
--- a/drivers/net/wireless/realtek/rtl8852ce/Makefile
+++ b/drivers/net/wireless/realtek/rtl8852ce/Makefile
@@ -14,9 +14,6 @@ EXTRA_CFLAGS += -Wno-unused-label
 #EXTRA_CFLAGS += -Wno-unused-function
 EXTRA_CFLAGS += -Wno-unused
 #EXTRA_CFLAGS += -Wno-uninitialized
-EXTRA_CFLAGS += -Wno-missing-prototypes
-EXTRA_CFLAGS += -Wno-missing-declarations
-EXTRA_CFLAGS += -Wno-enum-conversion
 
 ############ ANDROID COMMON KERNEL ############
 # clang
@@ -38,8 +35,7 @@ ifeq ($(GCC_VER_49),1)
 EXTRA_CFLAGS += -Wno-date-time	# Fix compile error && warning on gcc 4.9 and later
 endif
 
-SOURCETREE = $(srctree.nvidia-oot)/drivers/net/wireless/realtek/rtl8852ce
-EXTRA_CFLAGS += -I$(SOURCETREE)/include
+EXTRA_CFLAGS += -I$(src)/include
 
 EXTRA_LDFLAGS += --strip-debug
 
@@ -165,8 +161,8 @@ endif
 CONFIG_RTW_DEBUG = y
 # default log level is _DRV_INFO_ = 4,
 # please refer to "How_to_set_driver_debug_log_level.doc" to set the available level.
-CONFIG_RTW_LOG_LEVEL = 0
-CONFIG_RTW_PHL_LOG_LEVEL = 0
+CONFIG_RTW_LOG_LEVEL = 4
+CONFIG_RTW_PHL_LOG_LEVEL = 3
 
 # CONFIG_RTW_APPEND_LOGLEVEL decide if append kernel log level to each messages.
 # default "n" for don't append.
@@ -242,8 +238,7 @@ CONFIG_ROAMING_FLAG = 0x3f
 CONFIG_ROAM_SCAN_ORDER = 526
 
 ###################### Platform Related #######################
-CONFIG_PLATFORM_TEGRA = y
-CONFIG_PLATFORM_I386_PC = n
+CONFIG_PLATFORM_I386_PC = y
 CONFIG_PLATFORM_RTL8198D = n
 CONFIG_PLATFORM_ANDROID_X86 = n
 CONFIG_PLATFORM_ANDROID_INTEL_X86 = n
@@ -773,16 +768,6 @@ ifeq ($(CONFIG_DBG_AX_CAM), y)
 EXTRA_CFLAGS += -DCONFIG_DBG_AX_CAM
 endif
 
-ifeq ($(CONFIG_PLATFORM_TEGRA), y)
-ARCH = arm64
-KVER := $(shell uname -r)
-KSRC := /lib/modules/$(KVER)/build
-EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
-EXTRA_CFLAGS += -DCONFIG_IOCTL_CFG80211 -DRTW_USE_CFG80211_STA_EVENT
-EXTRA_CFLAGS += -Wno-error=date-time
-MODULE_NAME = rtl8852ce
-endif
-
 ifeq ($(CONFIG_I386_BUILD_VERIFY), y)
 EXTRA_CFLAGS += -DCONFIG_I386_BUILD_VERIFY
 endif
@@ -799,18 +784,8 @@ endif
 include $(wildcard $(DRV_PATH)/platform/*.mk)
 
 # Import platform specific compile options
-EXTRA_CFLAGS += -I$(SOURCETREE)/platform
+EXTRA_CFLAGS += -I$(src)/platform
 #_PLATFORM_FILES := platform/platform_ops.o
-ifeq ($(CONFIG_PCI_HCI), y)
-EXTRA_CFLAGS += -DCONFIG_PLATFORM_OPS
-_PLATFORM_FILES := platform/platform_linux_pc_pci.o
-OBJS += $(_PLATFORM_FILES)
-# Core Config
-CONFIG_MSG_NUM = 128
-EXTRA_CFLAGS += -DCONFIG_MSG_NUM=$(CONFIG_MSG_NUM)
-#EXTRA_CFLAGS += -DCONFIG_TX_SKB_ORPHAN
-endif
-_PLATFORM_FILES += platform/platform_ops.o
 OBJS += $(_PLATFORM_FILES)
 
 ########### CUSTOMER ################################
@@ -830,7 +805,7 @@ endif
 
 ifneq ($(KERNELRELEASE),)
 ########### COMMON #################################
-include $(SOURCETREE)/common.mk
+include $(src)/common.mk
 
 EXTRA_CFLAGS += -DPHL_PLATFORM_LINUX
 EXTRA_CFLAGS += -DCONFIG_PHL_ARCH
@@ -851,10 +826,11 @@ ifeq ($(DIRTY_FOR_WORK), y)
 EXTRA_CFLAGS += -DDIRTY_FOR_WORK
 endif
 
-include $(SOURCETREE)/phl/phl.mk
+include $(src)/phl/phl.mk
 
-obj-m := $(MODULE_NAME).o
 
+obj-$(CONFIG_RTL8852CE) := $(MODULE_NAME).o
+obj-$(CONFIG_RTL8852CE) := $(MODULE_NAME).o
 $(MODULE_NAME)-y = $(OBJS)
 
 ############# MEMORY MANAGMENT #############
diff --git a/drivers/net/wireless/realtek/rtl8852ce/common.mk b/drivers/net/wireless/realtek/rtl8852ce/common.mk
index f6eb419e..b5cf5649 100644
--- a/drivers/net/wireless/realtek/rtl8852ce/common.mk
+++ b/drivers/net/wireless/realtek/rtl8852ce/common.mk
@@ -99,7 +99,7 @@ _CORE_FILES :=	core/rtw_fsm.o \
 _CORE_FILES +=	core/rtw_phl.o \
 		core/rtw_phl_cmd.o
 
-EXTRA_CFLAGS += -I$(SOURCETREE)/core/crypto
+EXTRA_CFLAGS += -I$(src)/core/crypto
 _CORE_FILES += core/crypto/aes-internal.o \
 		core/crypto/aes-internal-enc.o \
 		core/crypto/aes-gcm.o \
diff --git a/drivers/net/wireless/realtek/rtl8852ce/core/rtw_chplan.c b/drivers/net/wireless/realtek/rtl8852ce/core/rtw_chplan.c
index 29aeaac3..30fd7e84 100644
--- a/drivers/net/wireless/realtek/rtl8852ce/core/rtw_chplan.c
+++ b/drivers/net/wireless/realtek/rtl8852ce/core/rtw_chplan.c
@@ -1487,12 +1487,13 @@ static const enum rtw_env_t _reg_info_to_env[] = {
 #define reg_info_to_env(reg_info) (((reg_info) >= CIS_6G_REG_NUM) ? _reg_info_to_env[CIS_6G_REG_NUM] : _reg_info_to_env[(reg_info)])
 #endif
 
-static void cis_scan_stat_clr(struct cis_scan_stat_t *stat)
+static void cis_scan_stat_clr(struct cis_scan_stat_t *stat, bool lock)
 {
 	_list *list, *head;
 	struct cis_scan_stat_ent *ent;
 
-	_rtw_mutex_lock(&stat->lock);
+	if (lock)
+		_rtw_mutex_lock(&stat->lock);
 
 	head = &stat->ent;
 	list = get_next(head);
@@ -1506,7 +1507,8 @@ static void cis_scan_stat_clr(struct cis_scan_stat_t *stat)
 	stat->ent_num = 0;
 	CIS_SCAN_STAT_SET_MAJORITY(stat, NULL);
 
-	_rtw_mutex_unlock(&stat->lock);
+	if (lock)
+		_rtw_mutex_unlock(&stat->lock);
 }
 
 static void cis_scan_stat_add(struct cis_scan_stat_t *stat, const struct country_ie_slave_record *cisr)
@@ -1559,12 +1561,12 @@ check_order:
 }
 
 #if CONFIG_80211D_ENV_BSS_MAJORITY
-static struct cis_scan_stat_ent *cis_scan_stat_update_majority(struct cis_scan_stat_t *stat, bool disable)
+static void cis_scan_stat_update_majority(struct cis_scan_stat_t *stat)
 {
 	_list *list, *head;
 	struct cis_scan_stat_ent *ent, *m = NULL;
 
-	if (stat->ent_num == 0 || disable)
+	if (stat->ent_num == 0)
 		goto update;
 
 	head = &stat->ent;
@@ -1581,7 +1583,6 @@ static struct cis_scan_stat_ent *cis_scan_stat_update_majority(struct cis_scan_s
 
 update:
 	CIS_SCAN_STAT_SET_MAJORITY(stat, m);
-	return CIS_SCAN_STAT_GET_MAJORITY(stat);
 }
 #endif
 
@@ -1595,15 +1596,19 @@ static void cis_scan_stat_init(struct cis_scan_stat_t *stat)
 
 static void cis_scan_stat_deinit(struct cis_scan_stat_t *stat)
 {
-	cis_scan_stat_clr(stat);
+	cis_scan_stat_clr(stat, true);
 	_rtw_mutex_free(&stat->lock);
 }
 
-static void dump_cis_scan_stat(void *sel, struct cis_scan_stat_t *stat)
+static void dump_cis_scan_stat(void *sel, struct rf_ctl_t *rfctl)
 {
+	struct cis_scan_stat_t *stat = &rfctl->cis_scan_stat;
 	_list *list, *head;
 	struct cis_scan_stat_ent *ent;
 
+	RTW_PRINT_SEL(sel, "ENV_BSS (updated %u sec ago)\n"
+		, rtw_get_passing_time_ms(rfctl->cis_scan_last_complete_time) / 1000);
+
 	_rtw_mutex_lock(&stat->lock);
 
 	head = &stat->ent;
@@ -1612,7 +1617,7 @@ static void dump_cis_scan_stat(void *sel, struct cis_scan_stat_t *stat)
 		ent = LIST_CONTAINOR(list, struct cis_scan_stat_ent, list);
 		list = get_next(list);
 		RTW_PRINT_SEL(sel, "%c"ALPHA2_FMT" %u\n"
-			, stat->majority == ent ? '*' : ' '
+			, RFCTL_GET_CIS_MAJORITY(rfctl) == ent ? '*' : ' '
 			, ALPHA2_ARG(ent->cisr.alpha2), ent->count);
 	}
 
@@ -1682,8 +1687,8 @@ void dump_country_ie_slave_records(void *sel, struct rf_ctl_t *rfctl, bool skip_
 #endif
 
 	if (rfctl->cis_flags & CISF_ENV_BSS) {
-		RTW_PRINT_SEL(sel, "\nENV_BSS\n");
-		dump_cis_scan_stat(sel, &rfctl->cis_scan_stat);
+		RTW_PRINT_SEL(sel, "\n");
+		dump_cis_scan_stat(sel, rfctl);
 	}
 }
 
@@ -2511,7 +2516,7 @@ static bool rtw_rfctl_update_extra_alpha2_req(struct rf_ctl_t *rfctl, const char
 
 static bool rtw_rfctl_extra_alpha2_req_needed(struct rf_ctl_t *rfctl)
 {
-	if (CIS_SCAN_STAT_GET_MAJORITY(&rfctl->cis_scan_stat))
+	if (RFCTL_GET_CIS_MAJORITY(rfctl))
 		return false;
 
 	if (rfctl->regd_src == REGD_SRC_RTK_PRIV) {
@@ -3368,60 +3373,28 @@ static bool rtw_regd_req_list_add_country_ie_req_from_per_link_cisr(struct rf_ct
 	return effected;
 }
 
-static bool rtw_regd_req_list_add_country_ie_req_from_scanned_network_cisr(_adapter *adapter)
+static bool rtw_regd_req_list_add_country_ie_req_from_scan_stat_cisr(struct rf_ctl_t *rfctl)
 {
-	struct rf_ctl_t *rfctl = adapter_to_rfctl(adapter);
-	struct mlme_priv *mlme = &adapter->mlmepriv;
-	_queue *queue = &mlme->scanned_queue;
-	_list *list, *head;
-	struct wlan_network *scanned;
-	bool effected = false;
 	struct cis_scan_stat_t *stat = &rfctl->cis_scan_stat;
-#if CONFIG_80211D_ENV_BSS_MAJORITY
-	struct cis_scan_stat_ent *majority;
-#endif
+	_list *list, *head;
+	struct cis_scan_stat_ent *ent;
+	bool effected = false;
 
 	_rtw_mutex_lock(&stat->lock);
 
-	_rtw_spinlock_bh(&queue->lock);
-
-	/* loop scan queue for stat */
-	head = get_list_head(queue);
+	/* follow all ENV BSS */
+	head = &stat->ent;
 	list = get_next(head);
 	while (!rtw_end_of_queue_search(head, list)) {
-		scanned = LIST_CONTAINOR(list, struct wlan_network, list);
+		ent = LIST_CONTAINOR(list, struct cis_scan_stat_ent, list);
 		list = get_next(list);
 
-		if (scanned->cisr.status == COUNTRY_IE_SLAVE_NOCOUNTRY
-			|| scanned->cisr.status == COUNTRY_IE_SLAVE_UNKNOWN)
+		if (ent->cisr.status == COUNTRY_IE_SLAVE_NOCOUNTRY
+			|| ent->cisr.status == COUNTRY_IE_SLAVE_UNKNOWN)
 			continue;
 
-		cis_scan_stat_add(stat, &scanned->cisr);
+		effected |= rtw_regd_req_list_add_country_ie_req(rfctl, &ent->cisr, false);
 	}
-#if CONFIG_80211D_ENV_BSS_MAJORITY
-	majority = cis_scan_stat_update_majority(stat, !(rfctl->cis_flags & CISF_ENV_BSS_MAJ));
-	if (majority) {
-		/* single majority exist, follow */
-		effected |= rtw_regd_req_list_add_country_ie_req(rfctl, &majority->cisr, false);
-	} else
-#endif
-	{
-		/* follow all ENV BSS */
-		head = get_list_head(queue);
-		list = get_next(head);
-		while (!rtw_end_of_queue_search(head, list)) {
-			scanned = LIST_CONTAINOR(list, struct wlan_network, list);
-			list = get_next(list);
-
-			if (scanned->cisr.status == COUNTRY_IE_SLAVE_NOCOUNTRY
-				|| scanned->cisr.status == COUNTRY_IE_SLAVE_UNKNOWN)
-				continue;
-
-			effected |= rtw_regd_req_list_add_country_ie_req(rfctl, &scanned->cisr, false);
-		}
-	}
-
-	_rtw_spinunlock_bh(&queue->lock);
 
 	_rtw_mutex_unlock(&stat->lock);
 
@@ -3500,15 +3473,16 @@ static bool rtw_chplan_rtk_priv_req_prehdl_country_ie(_adapter *adapter, struct
 	}
 
 	if (rfctl->regd_src == REGD_SRC_RTK_PRIV) {
-		cis_scan_stat_clr(&rfctl->cis_scan_stat);
-
 		rtw_regd_req_list_clear_ref_cnt_by_inr(rfctl, RTW_REGD_SET_BY_COUNTRY_IE);
 
 		if (rfctl->cis_enabled) {
-			if (rfctl->cis_flags & CISF_ENV_BSS)
-				effected |= rtw_regd_req_list_add_country_ie_req_from_scanned_network_cisr(adapter);
-			if (!CIS_SCAN_STAT_GET_MAJORITY(&rfctl->cis_scan_stat))
+			if (RFCTL_GET_CIS_MAJORITY(rfctl))
+				effected |= rtw_regd_req_list_add_country_ie_req(rfctl, &RFCTL_GET_CIS_MAJORITY(rfctl)->cisr, false);
+			else {
 				effected |= rtw_regd_req_list_add_country_ie_req_from_per_link_cisr(rfctl);
+				if (rfctl->cis_flags & CISF_ENV_BSS)
+					effected |= rtw_regd_req_list_add_country_ie_req_from_scan_stat_cisr(rfctl);
+			}
 		}
 
 		effected |= rtw_regd_req_list_clear_zero_ref_req_by_inr(rfctl, RTW_REGD_SET_BY_COUNTRY_IE);
@@ -5010,11 +4984,52 @@ void rtw_cis_scan_idle_check(struct rf_ctl_t *rfctl)
 	}
 }
 
+static bool rtw_cis_scan_stat_update(_adapter *adapter)
+{
+	struct rf_ctl_t *rfctl = adapter_to_rfctl(adapter);
+	struct mlme_priv *mlme = &adapter->mlmepriv;
+	_queue *queue = &mlme->scanned_queue;
+	_list *list, *head;
+	struct wlan_network *scanned;
+	bool effected = false;
+	struct cis_scan_stat_t *stat = &rfctl->cis_scan_stat;
+
+	_rtw_mutex_lock(&stat->lock);
+
+	cis_scan_stat_clr(stat, false);
+
+	_rtw_spinlock_bh(&queue->lock);
+
+	/* loop scan queue for stat */
+	head = get_list_head(queue);
+	list = get_next(head);
+	while (!rtw_end_of_queue_search(head, list)) {
+		scanned = LIST_CONTAINOR(list, struct wlan_network, list);
+		list = get_next(list);
+
+		if (scanned->cisr.status == COUNTRY_IE_SLAVE_NOCOUNTRY
+			|| scanned->cisr.status == COUNTRY_IE_SLAVE_UNKNOWN)
+			continue;
+
+		cis_scan_stat_add(stat, &scanned->cisr);
+	}
+#if CONFIG_80211D_ENV_BSS_MAJORITY
+	cis_scan_stat_update_majority(stat);
+#endif
+
+	_rtw_spinunlock_bh(&queue->lock);
+
+	_rtw_mutex_unlock(&stat->lock);
+
+	return effected;
+}
+
 void rtw_cis_scan_complete_hdl(_adapter *adapter)
 {
 	struct rf_ctl_t *rfctl = adapter_to_rfctl(adapter);
 
 	if (rfctl->cis_enabled && (rfctl->cis_flags & CISF_ENV_BSS)) {
+		rtw_cis_scan_stat_update(adapter);
 		rfctl->cis_scan_last_complete_time = rtw_get_current_time();
 
 		/* 802.11d scan has done complete, trigger regulation selection */
diff --git a/drivers/net/wireless/realtek/rtl8852ce/core/rtw_ieee80211.c b/drivers/net/wireless/realtek/rtl8852ce/core/rtw_ieee80211.c
index 513992eb..3f1b2774 100644
--- a/drivers/net/wireless/realtek/rtl8852ce/core/rtw_ieee80211.c
+++ b/drivers/net/wireless/realtek/rtl8852ce/core/rtw_ieee80211.c
@@ -502,7 +502,7 @@ u8 rtw_ies_update_ie(u8 *ies, uint *ies_len, uint ies_offset, u8 eid, const u8 *
 	search_len = *ies_len - ies_offset;
 
 	target_ie = rtw_get_ie(start, eid, &target_ielen, search_len);
-	if (target_ie && target_ielen) {
+	if (target_ie) {
 		if (target_ielen != content_len) {
 			remain_ies = target_ie + 2 + target_ielen;
 			remain_len = search_len - (remain_ies - start);
diff --git a/drivers/net/wireless/realtek/rtl8852ce/core/rtw_mlme.c b/drivers/net/wireless/realtek/rtl8852ce/core/rtw_mlme.c
index 07ceae31..dc224097 100644
--- a/drivers/net/wireless/realtek/rtl8852ce/core/rtw_mlme.c
+++ b/drivers/net/wireless/realtek/rtl8852ce/core/rtw_mlme.c
@@ -177,8 +177,8 @@ sint	_rtw_init_mlme_priv(_adapter *padapter)
 #else
 #define RTW_ROAM_SCAN_RESULT_EXP_MS (10*1000)
 #endif
-#define RTW_ROAM_SCAN_INTERVAL (2)    /* 5*(2 second)*/
-#define RTW_ROAM_RSSI_THRESHOLD 45
+#define RTW_ROAM_SCAN_INTERVAL (5)    /* 5*(2 second)*/
+#define RTW_ROAM_RSSI_THRESHOLD 30
 
 #define RTW_ROAM_RSSI_IDLE_TH RTW_ROAM_RSSI_THRESHOLD
 #define RTW_ROAM_RSSI_BUSY_TH RTW_ROAM_RSSI_THRESHOLD + 5
diff --git a/drivers/net/wireless/realtek/rtl8852ce/core/rtw_mlme_ext.c b/drivers/net/wireless/realtek/rtl8852ce/core/rtw_mlme_ext.c
index ae3b2df3..b27ad194 100644
--- a/drivers/net/wireless/realtek/rtl8852ce/core/rtw_mlme_ext.c
+++ b/drivers/net/wireless/realtek/rtl8852ce/core/rtw_mlme_ext.c
@@ -5797,9 +5797,16 @@ u8 *rtw_build_probersp_ies(_adapter *padapter, struct _ADAPTER_LINK *padapter_li
 			u8 *ssid_ie;
 			sint ssid_ielen;
 			sint ssid_ielen_diff;
-			u8 buf[MAX_IE_SZ];
+			u8 *buf;
 			u8 *ies = pframe_start;
 
+			buf = rtw_zmalloc(MAX_IE_SZ);
+			if(!buf) {
+				RTW_ERR(FUNC_ADPT_FMT" buffer alloc fail\n",
+					FUNC_ADPT_ARG(padapter));
+				return NULL;
+			}
+
 			ssid_ie = rtw_get_ie(ies + _FIXED_IE_LENGTH_, _SSID_IE_, &ssid_ielen,
 				     (pframe - ies) - _FIXED_IE_LENGTH_);
 
@@ -5824,6 +5831,7 @@ u8 *rtw_build_probersp_ies(_adapter *padapter, struct _ADAPTER_LINK *padapter_li
 				pframe += ssid_ielen_diff;
 				pattrib->pktlen += ssid_ielen_diff;
 			}
+			rtw_mfree((void *)buf, MAX_IE_SZ);
 		}
 
 #ifdef CONFIG_APPEND_VENDOR_IE_ENABLE
@@ -9738,7 +9746,7 @@ void report_survey_event(_adapter *padapter, union recv_frame *precv_frame)
 	struct cmd_priv *pcmdpriv;
 	struct survey_event *psurvey_evt;
 #else
-	struct survey_event psurvey_evt;
+	struct survey_event *psurvey_evt;
 #endif
 	WLAN_BSSID_EX *bssid;
 	struct mlme_ext_priv *pmlmeext;
@@ -9790,13 +9798,21 @@ void report_survey_event(_adapter *padapter, union recv_frame *precv_frame)
 	psurvey_evt = (struct survey_event *)(pevtcmd + sizeof(struct rtw_evt_header));
 	bssid = (WLAN_BSSID_EX *)&psurvey_evt->bss;
 #else
-	bssid = (WLAN_BSSID_EX *)&psurvey_evt.bss;
+	psurvey_evt = (struct survey_event *)rtw_zmalloc(sizeof(struct survey_event));
+	if (!psurvey_evt) {
+		RTW_ERR(FUNC_ADPT_FMT" buffer alloc fail\n", FUNC_ADPT_ARG(padapter));
+		return;
+	}
+
+	bssid = (WLAN_BSSID_EX *)&psurvey_evt->bss;
 #endif
 
 	if (collect_bss_info(padapter, precv_frame, bssid) == _FAIL) {
 #ifdef CONFIG_SCAN_REPORT_ENQUEUE
 		rtw_mfree((u8 *)pcmd_obj, sizeof(struct cmd_obj));
 		rtw_mfree((u8 *)pevtcmd, cmdsz);
+#else
+		rtw_mfree((void *)psurvey_evt, sizeof(struct survey_event));
 #endif
 		return;
 	}
@@ -9839,6 +9855,7 @@ void report_survey_event(_adapter *padapter, union recv_frame *precv_frame)
 	rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
 #else
 	rtw_survey_event_callback(padapter, (u8 *)bssid);
+	rtw_mfree((void *)psurvey_evt, sizeof(struct survey_event));
 #endif
 
 	pmlmeext->sitesurvey_res.bss_cnt++;
diff --git a/drivers/net/wireless/realtek/rtl8852ce/core/rtw_mp.c b/drivers/net/wireless/realtek/rtl8852ce/core/rtw_mp.c
index 235197ed..3a0335cf 100644
--- a/drivers/net/wireless/realtek/rtl8852ce/core/rtw_mp.c
+++ b/drivers/net/wireless/realtek/rtl8852ce/core/rtw_mp.c
@@ -559,7 +559,7 @@ static void init_mp_data(_adapter *padapter)
 
 u32 mp_join(_adapter *padapter, u8 mode)
 {
-	WLAN_BSSID_EX bssid;
+	WLAN_BSSID_EX *bssid;
 	struct sta_info *psta;
 	u32 length;
 	s32 res = _SUCCESS;
@@ -577,31 +577,37 @@ u32 mp_join(_adapter *padapter, u8 mode)
 	void *phl = GET_PHL_INFO(adapter_to_dvobj(padapter));
 
 	/* 1. initialize a new WLAN_BSSID_EX */
-	_rtw_memset(&bssid, 0, sizeof(WLAN_BSSID_EX));
+	bssid = (WLAN_BSSID_EX *)rtw_zmalloc(sizeof(WLAN_BSSID_EX));
+	if (!bssid) {
+		RTW_ERR(FUNC_ADPT_FMT" buffer alloc fail\n", FUNC_ADPT_ARG(padapter));
+		res = _FAIL;
+		return res;
+	}
+
 	RTW_INFO("%s ,pmppriv->network_macaddr=%x %x %x %x %x %x\n", __func__,
 		pmppriv->network_macaddr[0], pmppriv->network_macaddr[1], pmppriv->network_macaddr[2], pmppriv->network_macaddr[3], pmppriv->network_macaddr[4],
 		 pmppriv->network_macaddr[5]);
-	_rtw_memcpy(bssid.MacAddress, pmppriv->network_macaddr, ETH_ALEN);
+	_rtw_memcpy(bssid->MacAddress, pmppriv->network_macaddr, ETH_ALEN);
 
 	if (mode == WIFI_FW_ADHOC_STATE) {
-		bssid.Ssid.SsidLength = strlen("mp_pseudo_adhoc");
-		_rtw_memcpy(bssid.Ssid.Ssid, (u8 *)"mp_pseudo_adhoc", bssid.Ssid.SsidLength);
-		bssid.InfrastructureMode = Ndis802_11IBSS;
-		bssid.IELength = 0;
-		bssid.Configuration.DSConfig = pmppriv->channel;
+		bssid->Ssid.SsidLength = strlen("mp_pseudo_adhoc");
+		_rtw_memcpy(bssid->Ssid.Ssid, (u8 *)"mp_pseudo_adhoc", bssid->Ssid.SsidLength);
+		bssid->InfrastructureMode = Ndis802_11IBSS;
+		bssid->IELength = 0;
+		bssid->Configuration.DSConfig = pmppriv->channel;
 
 	} else if (mode == WIFI_FW_STATION_STATE) {
-		bssid.Ssid.SsidLength = strlen("mp_pseudo_STATION");
-		_rtw_memcpy(bssid.Ssid.Ssid, (u8 *)"mp_pseudo_STATION", bssid.Ssid.SsidLength);
-		bssid.InfrastructureMode = Ndis802_11Infrastructure;
-		bssid.IELength = 0;
+		bssid->Ssid.SsidLength = strlen("mp_pseudo_STATION");
+		_rtw_memcpy(bssid->Ssid.Ssid, (u8 *)"mp_pseudo_STATION", bssid->Ssid.SsidLength);
+		bssid->InfrastructureMode = Ndis802_11Infrastructure;
+		bssid->IELength = 0;
 	}
 
-	length = get_WLAN_BSSID_EX_sz(&bssid);
+	length = get_WLAN_BSSID_EX_sz(bssid);
 	if (length % 4)
-		bssid.Length = ((length >> 2) + 1) << 2; /* round up to multiple of 4 bytes. */
+		bssid->Length = ((length >> 2) + 1) << 2; /* round up to multiple of 4 bytes. */
 	else
-		bssid.Length = length;
+		bssid->Length = length;
 
 	_rtw_spinlock_bh(&pmlmepriv->lock);
 
@@ -642,14 +648,14 @@ u32 mp_join(_adapter *padapter, u8 mode)
 	if (psta)
 		rtw_free_mld_stainfo(padapter, psta->phl_sta->mld);
 	/* ToDo CONFIG_RTW_MLD: MLD MAC Address */
-	pmld = rtw_phl_alloc_mld(GET_PHL_INFO(adapter_to_dvobj(padapter)), padapter->phl_role, bssid.MacAddress, DTYPE);
+	pmld = rtw_phl_alloc_mld(GET_PHL_INFO(adapter_to_dvobj(padapter)), padapter->phl_role, bssid->MacAddress, DTYPE);
 	if (pmld == NULL) {
 		init_fwstate(pmlmepriv, pmppriv->prev_fw_state);
 		res = _FAIL;
 		goto end_of_mp_start_test;
 	}
 	/* main_id is don't care for self */
-	psta = rtw_alloc_stainfo(&padapter->stapriv, bssid.MacAddress, DTYPE, 0, padapter_link->wrlink->id, PHL_CMD_DIRECTLY);
+	psta = rtw_alloc_stainfo(&padapter->stapriv, bssid->MacAddress, DTYPE, 0, padapter_link->wrlink->id, PHL_CMD_DIRECTLY);
 	if (psta == NULL) {
 		/*pmlmepriv->fw_state = pmppriv->prev_fw_state;*/
 		init_fwstate(pmlmepriv, pmppriv->prev_fw_state);
@@ -664,7 +670,7 @@ u32 mp_join(_adapter *padapter, u8 mode)
 	tgt_network->join_res = 1;
 	tgt_network->aid = psta->phl_sta->aid = 1;
 
-	_rtw_memcpy(&padapter->registrypriv.dev_network, &bssid, length);
+	_rtw_memcpy(&padapter->registrypriv.dev_network, bssid, length);
 	rtw_update_registrypriv_dev_network(padapter);
 	_rtw_memcpy(&tgt_network->network, &padapter->registrypriv.dev_network, padapter->registrypriv.dev_network.Length);
 	_rtw_memcpy(pnetwork, &padapter->registrypriv.dev_network, padapter->registrypriv.dev_network.Length);
@@ -693,6 +699,7 @@ end_of_mp_start_test:
 		}
 	}
 
+	rtw_mfree((void *)bssid, sizeof(WLAN_BSSID_EX));
 	return res;
 }
 /* This function initializes the DUT to the MP test mode */
diff --git a/drivers/net/wireless/realtek/rtl8852ce/core/rtw_scan.c b/drivers/net/wireless/realtek/rtl8852ce/core/rtw_scan.c
index 298cb060..2c5732ed 100644
--- a/drivers/net/wireless/realtek/rtl8852ce/core/rtw_scan.c
+++ b/drivers/net/wireless/realtek/rtl8852ce/core/rtw_scan.c
@@ -1258,126 +1258,316 @@ static inline void rtw_gen_new_bssid(const u8 *bssid, u8 max_bssid_ind,
 	/*RTW_INFO("%s, %02x,%02x,%02x,%02x,%02x,%02x \n", __func__, new_bssid[0], new_bssid[1], new_bssid[2], new_bssid[3], new_bssid[4], new_bssid[5]);*/
 }
 
-void add_mbssid_network(_adapter *padapter, WLAN_BSSID_EX *ref_bss)
+static inline u8 rtw_find_nt_bssid(WLAN_BSSID_EX *ref_bss, u16 *mbssid_addr,
+				   u16 *mbssid_len, u16 *mbssid_total_len)
+{
+	u16 shift = 0;
+	u8 mbssid_count = 0;
+	sint mbssid_len_tmp = 0;
+	u8 *mbssid_ie;
+
+	while (1) {
+		mbssid_ie = rtw_get_ie(ref_bss->IEs + _BEACON_IE_OFFSET_ + shift,
+				       WLAN_EID_MULTIPLE_BSSID,
+				       &mbssid_len_tmp,
+				       (ref_bss->IELength - _BEACON_IE_OFFSET_ - shift));
+		RTW_DBG("%s, mbssid_len_tmp=%d\n", __func__, mbssid_len_tmp);
+		if (!mbssid_ie || mbssid_count >= MBSSID_MAX_CNT) {
+			RTW_DBG("%s, mbssid_ie is NULL or mbssid_count exceeds \n", __func__);
+			break;
+		} else {
+			/*RTW_DBG("%s, ref_bss->IEs = %llx \n", __func__, ref_bss->IEs);*/
+			/*RTW_DBG("%s, mbssid_ie = %llx \n", __func__, mbssid_ie);*/
+			mbssid_addr[mbssid_count] = mbssid_ie - ref_bss->IEs;
+			RTW_DBG("%s, mbssid_addr=%d\n", __func__, mbssid_addr[mbssid_count]);
+			shift = mbssid_ie - ref_bss->IEs - _BEACON_IE_OFFSET_ + mbssid_len_tmp + 2;
+			RTW_DBG("%s, shift=%d\n", __func__, shift);
+			mbssid_len[mbssid_count] = mbssid_len_tmp;
+			mbssid_count++;
+			*mbssid_total_len = *mbssid_total_len + mbssid_len_tmp + 2;
+		}
+	}
+	return mbssid_count;
+}
+
+static inline void rtw_gen_pure_ref_bss(WLAN_BSSID_EX *prbss, WLAN_BSSID_EX *ref_bss,
+					u16 *mbssid_addr, u16 mbssid_total_len)
+{
+	_rtw_memcpy(prbss, ref_bss, sizeof(WLAN_BSSID_EX));
+	_rtw_memset(prbss->IEs, 0, MAX_IE_SZ);
+
+	/* cpy the remaining ie before mbssid */
+	_rtw_memcpy(prbss->IEs, ref_bss->IEs, mbssid_addr[0]);
+
+	/* cpy the remaining ie */
+	_rtw_memcpy(prbss->IEs + mbssid_addr[0],
+		    ref_bss->IEs + mbssid_addr[0] + mbssid_total_len,
+		    ref_bss->IELength - mbssid_total_len - mbssid_addr[0]);
+
+	prbss->IELength = ref_bss->IELength - mbssid_total_len;
+	RTW_DBG_DUMP("A ref_bss->IEs: ", (const u8 *)ref_bss->IEs, ref_bss->IELength);
+	RTW_DBG_DUMP("B prbss->IEs: ", (const u8 *)prbss->IEs, prbss->IELength);
+}
+
+static inline void rtw_update_ntbss_ie(WLAN_BSSID_EX *ntbss, PNDIS_802_11_VARIABLE_IEs sub_pie)
+{
+	RTW_DBG("%s, sub_pie->Length=%d\n", __func__, sub_pie->Length);
+	RTW_DBG_DUMP("WLAN_EID: ", (const u8 *)sub_pie->data, sub_pie->Length);
+	RTW_DBG_DUMP("B ntbss->IEs: ", (const u8 *)ntbss->IEs, ntbss->IELength);
+
+	/* update ie in ntbss, or append to the end */
+	if (!rtw_ies_update_ie(ntbss->IEs, &ntbss->IELength,
+			       _BEACON_IE_OFFSET_, sub_pie->ElementID,
+			       sub_pie->data, sub_pie->Length)) {
+
+		_rtw_memcpy(ntbss->IEs + ntbss->IELength,
+			    &sub_pie->ElementID, sub_pie->Length + 2);
+		ntbss->IELength = ntbss->IELength + sub_pie->Length + 2;
+
+	}
+	RTW_DBG_DUMP("C ntbss->IEs: ", (const u8 *)ntbss->IEs, ntbss->IELength);
+}
+
+static inline void rtw_update_ntbss_ext_ie(WLAN_BSSID_EX *ntbss, PNDIS_802_11_VARIABLE_IEs sub_pie)
+{
+	u8 i, j;
+
+	RTW_DBG_DUMP("WLAN_EID_EXTENSION: ", (const u8 *)sub_pie->data, sub_pie->Length);
+	RTW_DBG_DUMP("B ntbss->IEs: ", (const u8 *)ntbss->IEs, ntbss->IELength);
+
+	/**
+	 * remove non inheritance ie
+	 * | Element ID extension | Ext. tag length | Ext. tag number: Non-Inherence|
+	 * | Element ID List (Length, Element ID 1~n)|
+	 * | Element ID Extension List (Length, Element ID Extension 1~n)|
+	 * Note: The minimum Ext. tag length is 3 (Length, 0, 0)
+	 */
+	if (sub_pie->data[0] == WLAN_EID_EXT_NON_INHERITANCE && sub_pie->Length > 3) {
+
+		for (i = 1; i <= sub_pie->data[1]; i++)
+			rtw_ies_remove_ie(ntbss->IEs, &ntbss->IELength, _BEACON_IE_OFFSET_,
+					  sub_pie->data[1 + i], NULL, 0);
+		for (j = 1; j <= sub_pie->data[1 + i]; j++)
+			rtw_ies_remove_ie(ntbss->IEs, &ntbss->IELength, _BEACON_IE_OFFSET_,
+					  WLAN_EID_EXTENSION, &sub_pie->data[1 + i + j], 1);
+
+	/* update ext ie in ntbss, or append to the end */
+	} else if (!rtw_ies_update_ie_ex(ntbss->IEs, &ntbss->IELength,
+					 _BEACON_IE_OFFSET_, sub_pie->data[0],
+					 &sub_pie->ElementID, sub_pie->Length + 2)) {
+
+		_rtw_memcpy(ntbss->IEs + ntbss->IELength,
+			    &sub_pie->ElementID, sub_pie->Length + 2);
+		ntbss->IELength = ntbss->IELength + sub_pie->Length + 2;
+
+	}
+	RTW_DBG_DUMP("C ntbss->IEs: ", (const u8 *)ntbss->IEs, ntbss->IELength);
+}
+
+static inline void rtw_update_ntbss_vendor_ie(WLAN_BSSID_EX *ntbss, PNDIS_802_11_VARIABLE_IEs sub_pie)
+{
+	RTW_DBG_DUMP("WLAN_EID_VENDOR_SPECIFIC: ", (const u8 *)sub_pie->data, sub_pie->Length);
+	RTW_DBG_DUMP("B ntbss->IEs: ", (const u8 *)ntbss->IEs, ntbss->IELength);
+
+	/* update wmm ie and oui ie in ntbss */
+	if (RTW_GET_BE24(sub_pie->data) == OUI_MICROSOFT)
+		rtw_ies_remove_ie(ntbss->IEs, &ntbss->IELength, _BEACON_IE_OFFSET_,
+				  WLAN_EID_VENDOR_SPECIFIC, sub_pie->data, 4);
+	else
+		rtw_ies_remove_ie(ntbss->IEs, &ntbss->IELength, _BEACON_IE_OFFSET_,
+				  WLAN_EID_VENDOR_SPECIFIC, sub_pie->data, sub_pie->Length);
+
+	_rtw_memcpy(ntbss->IEs + ntbss->IELength, &sub_pie->ElementID, sub_pie->Length + 2);
+	ntbss->IELength = ntbss->IELength + sub_pie->Length + 2;
+	RTW_DBG_DUMP("C ntbss->IEs: ", (const u8 *)ntbss->IEs, ntbss->IELength);
+}
+
+static inline u8 __rtw_gen_ntbss(_adapter *padapter, WLAN_BSSID_EX *prbss, WLAN_BSSID_EX *ref_bss,
+				 WLAN_BSSID_EX **ntbss, PNDIS_802_11_VARIABLE_IEs pIE, u8 max_bssid_indicator)
 {
-	WLAN_BSSID_EX *pbss;
 	u32 sub_ies_len;
-	u8 *mbssid_ie_ptr = NULL;
-	PNDIS_802_11_VARIABLE_IEs pIE, sub_pie;
-	u8 max_bssid_indicator;
-	int i,j;
-	u8* mbssid_ie;
-	sint mbssid_len;
-	u8 mbssid_index;
-	u8 copy_ie_offset;
+	int j;
+	PNDIS_802_11_VARIABLE_IEs sub_pie;
 	u32 copy_ie_len = 0;
+	u8 copy_ie_offset;
+	u8 mbssid_index;
 	struct wlan_network *pnetwork = NULL;
 	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
 
-	mbssid_ie = rtw_get_ie(ref_bss->IEs + _BEACON_IE_OFFSET_
-		                              , WLAN_EID_MULTIPLE_BSSID
-		                              , &mbssid_len
-		                              , (ref_bss->IELength- _BEACON_IE_OFFSET_));
-	if (!mbssid_ie)
-		return;
-#if 0
-	else
-		RTW_PRINT_DUMP("mbssid_ie: ", (const u8 *)mbssid_ie, mbssid_len);
+	sub_ies_len = pIE->Length;
+
+	RTW_DBG("%s, sub_ies_len=%d\n", __func__, sub_ies_len);
+	for (j = 0; j + 1 < sub_ies_len;) {
+		sub_pie = (PNDIS_802_11_VARIABLE_IEs)(pIE->data + j);
+		RTW_DBG("%s, sub_pie->ElementID=%d\n", __func__, sub_pie->ElementID);
+		switch (sub_pie->ElementID) {
+		case WLAN_EID_NON_TX_BSSID_CAP:
+			/* with mbssid and need to add_network */
+			*ntbss = (WLAN_BSSID_EX *)rtw_zmalloc(sizeof(WLAN_BSSID_EX));
+			if (!*ntbss)
+				return _FALSE;
+
+			_rtw_memcpy(*ntbss, prbss, sizeof(WLAN_BSSID_EX));
+			_rtw_memset((*ntbss)->IEs, 0, MAX_IE_SZ);
+			copy_ie_len =  _TIMESTAMP_ + _BEACON_ITERVAL_;
+			_rtw_memcpy((*ntbss)->IEs, prbss->IEs, copy_ie_len);
+			(*ntbss)->is_mbssid = _TRUE;
+
+			RTW_DBG_DUMP("B ntbss->IEs: ", (const u8 *)(*ntbss)->IEs, (*ntbss)->IELength);
+			RTW_DBG("%s, sub_pie->Length=%d\n", __func__, sub_pie->Length);
+			RTW_DBG_DUMP("WLAN_EID_NON_TX_BSSID_CAP: ", (const u8 *)sub_pie->data, sub_pie->Length);
+			copy_ie_offset =  _TIMESTAMP_ + _BEACON_ITERVAL_;
+			_rtw_memcpy((*ntbss)->IEs + copy_ie_offset, sub_pie->data, sub_pie->Length);
+			copy_ie_offset =  copy_ie_offset + _CAPABILITY_;
+			_rtw_memcpy((*ntbss)->IEs + copy_ie_offset, prbss->IEs + copy_ie_offset, prbss->IELength - copy_ie_offset);
+			RTW_DBG_DUMP("C ntbss->IEs: ", (const u8 *)(*ntbss)->IEs, (*ntbss)->IELength);
+			break;
+		case WLAN_EID_SSID:
+			RTW_DBG_DUMP("WLAN_EID_SSID: ", (const u8 *)sub_pie->data, sub_pie->Length);
+			RTW_DBG("%s, ref_bss->IELength=%d\n", __func__, ref_bss->IELength);
+			RTW_DBG_DUMP("A ref_bss->IEs: ", (const u8 *)ref_bss->IEs, ref_bss->IELength);
+			rtw_ies_update_ie((*ntbss)->IEs, &(*ntbss)->IELength,
+					  _BEACON_IE_OFFSET_, WLAN_EID_SSID,
+					  sub_pie->data, sub_pie->Length);
+			RTW_DBG_DUMP("B ntbss->IEs: ", (const u8 *)(*ntbss)->IEs, (*ntbss)->IELength);
+			_rtw_memset((*ntbss)->Ssid.Ssid, 0, (*ntbss)->Ssid.SsidLength);
+			_rtw_memcpy((*ntbss)->Ssid.Ssid, sub_pie->data, sub_pie->Length);
+			(*ntbss)->Ssid.SsidLength = sub_pie->Length;
+			break;
+		case WLAN_EID_MULTI_BSSID_IDX:
+			RTW_DBG("%s, sub_pie->Length=%d\n", __func__, sub_pie->Length);
+			RTW_DBG_DUMP("WLAN_EID_MULTI_BSSID_IDX: ", (const u8 *)sub_pie->data, sub_pie->Length);
+			mbssid_index = GET_MULTIPLE_BSSID_IDX_INDEX((u8 *)sub_pie);
+			RTW_DBG("%s,mbssid_index=%d\n", __func__, mbssid_index);
+			rtw_gen_new_bssid(ref_bss->MacAddress, max_bssid_indicator,
+					  mbssid_index, (*ntbss)->MacAddress);
+			(*ntbss)->mbssid_index = mbssid_index;
+			_rtw_memcpy((*ntbss)->mbsMacAddress, ref_bss->MacAddress, ETH_ALEN);
+			break;
+		case WLAN_EID_EXTENSION:
+			rtw_update_ntbss_ext_ie(*ntbss, sub_pie);
+			break;
+		case WLAN_EID_VENDOR_SPECIFIC:
+			rtw_update_ntbss_vendor_ie(*ntbss, sub_pie);
+			break;
+		default:
+			rtw_update_ntbss_ie(*ntbss, sub_pie);
+			break;
+		}
+
+		j += (sub_pie->Length + WLAN_IE_ID_LEN + WLAN_IE_LEN_LEN);
+		RTW_DBG("%s(%d), j=%d\n", __func__, __LINE__, j);
+	}
+
+	/* detects that there are no more ie for the current or last mbssid, so add network */
+	RTW_DBG_DUMP("pIE->data: ", (const u8 *)(pIE->data + j), 6);
+	if (*(pIE->data + j) == WLAN_EID_MULTIPLE_BSSID &&
+	    *(pIE->data + j + 3) == MBSSID_NONTRANSMITTED_BSSID_PROFILE_ID &&
+	    *(pIE->data + j + 5) != WLAN_EID_NON_TX_BSSID_CAP)
+		goto exit;
+
+	if (*(pIE->data + j) == MBSSID_NONTRANSMITTED_BSSID_PROFILE_ID &&
+	    *(pIE->data + j + 2) != WLAN_EID_NON_TX_BSSID_CAP)
+		goto exit;
+
+	if ((*ntbss)->is_mbssid == _TRUE) {
+		RTW_DBG_DUMP("Add ntbss->IEs: ", (const u8 *)(*ntbss)->IEs, (*ntbss)->IELength);
+		pnetwork = add_network(padapter, (*ntbss));
+#ifdef CONFIG_RTW_FSM_BTM
+		if (padapter->fsmpriv.btmpriv.btm && pnetwork) {
+			/* check SSID */
+			if (((*ntbss)->Ssid.SsidLength == pmlmepriv->dev_cur_network.network.Ssid.SsidLength) &&
+				_rtw_memcmp((*ntbss)->Ssid.Ssid, pmlmepriv->dev_cur_network.network.Ssid.Ssid,
+				(*ntbss)->Ssid.SsidLength))
+				rtw_btm_notify_scan_found_candidate(padapter->fsmpriv.btmpriv.btm, pnetwork);
+		}
 #endif
+		rtw_mfree((void *)*ntbss, sizeof(WLAN_BSSID_EX));
+	}
 
-	mbssid_ie_ptr = mbssid_ie;
-	max_bssid_indicator = GET_MBSSID_MAX_BSSID_INDOCATOR(mbssid_ie_ptr);
-	/*RTW_INFO("%s, max_bssid_indicator=%d\n", __func__, max_bssid_indicator);*/
-	mbssid_ie_ptr = mbssid_ie_ptr + MBSSID_MAX_BSSID_INDICATOR_OFFSET;
+exit:
+	return _SUCCESS;
+}
 
-	for (i = 0; i + 1 < mbssid_len;) {
-		pIE = (PNDIS_802_11_VARIABLE_IEs)(mbssid_ie_ptr + i);
+static inline u8 _rtw_gen_ntbss(_adapter *padapter, WLAN_BSSID_EX *prbss, WLAN_BSSID_EX *ref_bss,
+				WLAN_BSSID_EX **ntbss, u16 *mbssid_addr, u16 *mbssid_len, int idx)
+{
+	int i;
+	bool ret = _SUCCESS;
+	PNDIS_802_11_VARIABLE_IEs pIE;
+	u8 max_bssid_indicator;
+
+	for (i = 0; i + 1 < mbssid_len[idx];) {
+		max_bssid_indicator = GET_MBSSID_MAX_BSSID_INDOCATOR(ref_bss->IEs + mbssid_addr[idx]);
+		pIE = (PNDIS_802_11_VARIABLE_IEs)(ref_bss->IEs + mbssid_addr[idx] + i + MBSSID_MAX_BSSID_INDICATOR_OFFSET);
 
 		switch (pIE->ElementID) {
 		case MBSSID_NONTRANSMITTED_BSSID_PROFILE_ID:
-			sub_ies_len = pIE->Length;
-			pbss = (WLAN_BSSID_EX *)rtw_zmalloc(sizeof(WLAN_BSSID_EX));
-			if (pbss) {
-				_rtw_memcpy(pbss, ref_bss, sizeof(WLAN_BSSID_EX));
-				_rtw_memset(pbss->IEs, 0, MAX_IE_SZ);
-				copy_ie_len =  _TIMESTAMP_ + _BEACON_ITERVAL_;
-				_rtw_memcpy(pbss->IEs, ref_bss->IEs, copy_ie_len);
-			} else {
-				return;
-			}
-
-			for (j = 0; j + 1 < sub_ies_len;) {
-				sub_pie = (PNDIS_802_11_VARIABLE_IEs)(pIE->data + j);
-				switch (sub_pie->ElementID) {
-				case WLAN_EID_NON_TX_BSSID_CAP:
-					/*RTW_INFO("%s, sub_pie->Length=%d\n", __func__, sub_pie->Length);*/
-					/*RTW_PRINT_DUMP("WLAN_EID_NON_TX_BSSID_CAP: ", (const u8 *)sub_pie->data, sub_pie->Length);*/
-					copy_ie_offset =  _TIMESTAMP_ + _BEACON_ITERVAL_;
-					_rtw_memcpy(pbss->IEs + copy_ie_offset, sub_pie->data, sub_pie->Length);
-					break;
-				case WLAN_EID_SSID:
-					/*RTW_PRINT_DUMP("WLAN_EID_SSID: ", (const u8 *)sub_pie->data, sub_pie->Length);*/
-					/*RTW_INFO("%s, ref_bss->IELength=%d\n", __func__, ref_bss->IELength);*/
-					/*RTW_PRINT_DUMP("A ref_bss->IEs: ", (const u8 *)ref_bss->IEs, ref_bss->IELength);*/
-					copy_ie_offset =  _TIMESTAMP_ + _BEACON_ITERVAL_ + _CAPABILITY_;
-					copy_ie_len =  WLAN_IE_ID_LEN + WLAN_IE_LEN_LEN;
-					_rtw_memcpy(pbss->IEs + copy_ie_offset, sub_pie, copy_ie_len);
-
-					copy_ie_offset = copy_ie_offset + WLAN_IE_ID_LEN + WLAN_IE_LEN_LEN;
-					_rtw_memcpy(pbss->IEs + copy_ie_offset, sub_pie->data, sub_pie->Length);
-					_rtw_memcpy(pbss->IEs + copy_ie_offset + sub_pie->Length
-						                , ref_bss->IEs + copy_ie_offset + ref_bss->Ssid.SsidLength
-						                , ref_bss->IELength - (copy_ie_offset + ref_bss->Ssid.SsidLength));
-
-					pbss->IELength = ref_bss->IELength + (sub_pie->Length - ref_bss->Ssid.SsidLength);
-					/*RTW_INFO("%s, ref_bss->Ssid.SsidLength=%d\n", __func__, ref_bss->Ssid.SsidLength);*/
-					/*RTW_INFO("%s, sub_pie->Length=%d\n", __func__, sub_pie->Length);*/
-					/*RTW_INFO("%s, pbss->IELength=%d\n", __func__, pbss->IELength);*/
-					/*RTW_PRINT_DUMP("B pbss->IEs: ", (const u8 *)pbss->IEs, pbss->IELength);*/
-
-					_rtw_memset(pbss->Ssid.Ssid, 0, pbss->Ssid.SsidLength);
-					_rtw_memcpy(pbss->Ssid.Ssid, sub_pie->data, sub_pie->Length);
-					pbss->Ssid.SsidLength = sub_pie->Length;
-					break;
-				case WLAN_EID_MULTI_BSSID_IDX:
-					/*RTW_INFO("%s, sub_pie->Length=%d\n", __func__, sub_pie->Length);*/
-					/*RTW_PRINT_DUMP("WLAN_EID_MULTI_BSSID_IDX: ", (const u8 *)sub_pie->data, sub_pie->Length);*/
-					mbssid_index = GET_MULTIPLE_BSSID_IDX_INDEX((u8 *)sub_pie);
-					/*RTW_INFO("%s,mbssid_index=%d\n", __func__, mbssid_index);*/
-					rtw_gen_new_bssid(ref_bss->MacAddress, max_bssid_indicator
-						                          , mbssid_index, pbss->MacAddress);
-					pbss->mbssid_index = mbssid_index;
-					_rtw_memcpy(pbss->mbsMacAddress, ref_bss->MacAddress, ETH_ALEN);
-					break;
-				default:
-					break;
-				}
-
-				j += (sub_pie->Length + WLAN_IE_ID_LEN + WLAN_IE_LEN_LEN);
-				/*RTW_INFO("%s, j=%d\n", __func__, j);*/
-			}
-			pbss->is_mbssid = _TRUE;
-			pnetwork = add_network(padapter, pbss);
-#ifdef CONFIG_RTW_FSM_BTM
-			if (padapter->fsmpriv.btmpriv.btm && pnetwork) {
-				/* check SSID */
-				if ((pbss->Ssid.SsidLength == pmlmepriv->dev_cur_network.network.Ssid.SsidLength) &&
-					_rtw_memcmp(pbss->Ssid.Ssid, pmlmepriv->dev_cur_network.network.Ssid.Ssid,
-					pbss->Ssid.SsidLength))
-					rtw_btm_notify_scan_found_candidate(padapter->fsmpriv.btmpriv.btm, pnetwork);
-			}
-#endif
-			rtw_mfree((u8 *)pbss, sizeof(WLAN_BSSID_EX));
-			break;
-		case MBSSID_VENDOR_SPECIFIC_ID:
+			ret = __rtw_gen_ntbss(padapter, prbss, ref_bss, ntbss, pIE, max_bssid_indicator);
 			break;
 		default:
 			break;
 		}
+		if (!ret)
+			return ret;
 
+		RTW_DBG("%s, pIE->ElementID=%d\n", __func__, pIE->ElementID);
 		i += (pIE->Length + WLAN_IE_ID_LEN + WLAN_IE_LEN_LEN);
-		/*RTW_INFO("%s, i=%d\n", __func__, i);*/
+		RTW_DBG("%s(%d), i=%d\n", __func__, __LINE__, i);
 	}
+	return ret;
+}
+
+static inline u8 rtw_gen_ntbss(_adapter *padapter, WLAN_BSSID_EX *prbss, WLAN_BSSID_EX *ref_bss,
+			       u8 mbssid_count, u16 *mbssid_addr, u16 *mbssid_len)
+{
+	int idx;
+	bool ret = _SUCCESS;
+	WLAN_BSSID_EX *ntbss = NULL;
+
+	for (idx = 0; idx < mbssid_count; idx++) {
+
+		RTW_DBG("%s, Multiple BSSID IDX=%d\n", __func__, idx);
+		ret = _rtw_gen_ntbss(padapter, prbss, ref_bss, &ntbss, mbssid_addr, mbssid_len, idx);
+		if (!ret)
+			return ret;
+	}
+	return ret;
+}
+
+u8 add_mbssid_network(_adapter *padapter, WLAN_BSSID_EX *ref_bss)
+{
+	WLAN_BSSID_EX *prbss;
+	u8 mbssid_count = 0;
+	u16 mbssid_addr[MBSSID_MAX_CNT];
+	u16 mbssid_len[MBSSID_MAX_CNT];
+	bool ret = _FALSE;
+	u16 mbssid_total_len = 0;
+
+	/* find all nontransmitted bssids */
+	mbssid_count = rtw_find_nt_bssid(ref_bss, mbssid_addr, mbssid_len,
+					 &mbssid_total_len);
+	RTW_DBG("%s, Multiple BSSID total length=%d\n", __func__, mbssid_total_len);
+
+	if (!mbssid_count)
+		return _FALSE;
+
+	/* generate a pure reference bss and add network */
+	prbss = (WLAN_BSSID_EX *)rtw_zmalloc(sizeof(WLAN_BSSID_EX));
+	if(!prbss)
+		return _FALSE;
+
+	rtw_gen_pure_ref_bss(prbss, ref_bss, mbssid_addr, mbssid_total_len);
+	add_network(padapter, prbss);
+
+
+	/* parsing nontransmitted bssid in mbssid set */
+	ret = rtw_gen_ntbss(padapter, prbss, ref_bss, mbssid_count, mbssid_addr, mbssid_len);
+	if (!ret)
+		return _FALSE;
+	RTW_DBG("%s, ret=%d\n", __func__, ret);
+	rtw_mfree((void *)prbss, sizeof(WLAN_BSSID_EX));
+	return _TRUE;
 }
 #endif
 
@@ -1428,20 +1618,22 @@ void rtw_survey_event_callback(_adapter	*adapter, u8 *pbuf)
 	if ((check_fwstate(pmlmepriv, WIFI_UNDER_LINKING)) == _FALSE) {
 		struct wlan_network *pnetwork;
 
-		if (bss->Ssid.Ssid[0] == 0)
-			bss->Ssid.SsidLength = 0;
+#ifdef CONFIG_STA_MULTIPLE_BSSID
+		if (add_mbssid_network(adapter, bss) == _FALSE)
+#endif
+		{
+			if (bss->Ssid.Ssid[0] == 0)
+				bss->Ssid.SsidLength = 0;
 
-		pnetwork = add_network(adapter, bss);
-		if (pnetwork && bss->InfrastructureMode == Ndis802_11Infrastructure) {
-			if (MLME_IS_SCAN(adapter)) {
-				adapter->mlmeextpriv.sitesurvey_res.activate_ch_cnt
-					+= rtw_process_beacon_hint(adapter_to_rfctl(adapter), pnetwork);
+			pnetwork = add_network(adapter, bss);
+			if (pnetwork && bss->InfrastructureMode == Ndis802_11Infrastructure) {
+				if (MLME_IS_SCAN(adapter)) {
+					adapter->mlmeextpriv.sitesurvey_res.activate_ch_cnt
+						+= rtw_process_beacon_hint(adapter_to_rfctl(adapter), pnetwork);
+				}
 			}
 		}
 
-#ifdef CONFIG_STA_MULTIPLE_BSSID
-		add_mbssid_network(adapter, bss);
-#endif
 #ifdef CONFIG_RTW_FSM_BTM
 		if (adapter->fsmpriv.btmpriv.btm) {
 			/* check SSID */
diff --git a/drivers/net/wireless/realtek/rtl8852ce/core/rtw_wlan_util.c b/drivers/net/wireless/realtek/rtl8852ce/core/rtw_wlan_util.c
index 9972c3cf..9246bd97 100644
--- a/drivers/net/wireless/realtek/rtl8852ce/core/rtw_wlan_util.c
+++ b/drivers/net/wireless/realtek/rtl8852ce/core/rtw_wlan_util.c
@@ -1519,9 +1519,15 @@ void rtw_absorb_ssid_ifneed(_adapter *padapter, WLAN_BSSID_EX *bssid, u8 *pframe
 	u8 *mac;
 	sint ssid_len_ori;
 	u32 remain_len = 0;
-	u8 backupIE[MAX_IE_SZ];
+	u8 *backupIE;
 	u16 subtype;
 
+	backupIE = rtw_zmalloc(MAX_IE_SZ);
+	if(!backupIE) {
+		RTW_ERR(FUNC_ADPT_FMT" buffer alloc fail\n", FUNC_ADPT_ARG(padapter));
+		return;
+	}
+
 	mac = get_addr2_ptr(pframe);
 	subtype = get_frame_sub_type(pframe);
 
@@ -1545,6 +1551,7 @@ void rtw_absorb_ssid_ifneed(_adapter *padapter, WLAN_BSSID_EX *bssid, u8 *pframe
 	_rtw_spinlock_bh(&padapter->mlmepriv.scanned_queue.lock);
 	scanned = _rtw_find_network(&padapter->mlmepriv.scanned_queue, mac);
 	if (!scanned) {
+		rtw_mfree((void *)backupIE, MAX_IE_SZ);
 		_rtw_spinunlock_bh(&padapter->mlmepriv.scanned_queue.lock);
 		return;
 	}
@@ -1554,6 +1561,7 @@ void rtw_absorb_ssid_ifneed(_adapter *padapter, WLAN_BSSID_EX *bssid, u8 *pframe
 	if (hidden_ssid_ap(snetwork) && !hidden_ssid_ap(bssid)) {
 		p = rtw_get_ie(snetwork->IEs+ie_offset, _SSID_IE_, &ssid_len_ori, snetwork->IELength-ie_offset);
 		if (!p) {
+			rtw_mfree((void *)backupIE, MAX_IE_SZ);
 			_rtw_spinunlock_bh(&padapter->mlmepriv.scanned_queue.lock);
 			return;
 		}
@@ -1569,6 +1577,7 @@ void rtw_absorb_ssid_ifneed(_adapter *padapter, WLAN_BSSID_EX *bssid, u8 *pframe
 		_rtw_memcpy(p+2+bssid->Ssid.SsidLength, backupIE, remain_len);
 		snetwork->IELength += bssid->Ssid.SsidLength;
 	}
+	rtw_mfree((void *)backupIE, MAX_IE_SZ);
 	_rtw_spinunlock_bh(&padapter->mlmepriv.scanned_queue.lock);
 }
 
diff --git a/drivers/net/wireless/realtek/rtl8852ce/include/drv_types.h b/drivers/net/wireless/realtek/rtl8852ce/include/drv_types.h
index 82478b97..5acf4c63 100644
--- a/drivers/net/wireless/realtek/rtl8852ce/include/drv_types.h
+++ b/drivers/net/wireless/realtek/rtl8852ce/include/drv_types.h
@@ -1146,6 +1146,12 @@ struct rf_ctl_t {
 #define RFCTL_REG_EN_11BE(rfctl) false
 #endif
 
+#ifdef CONFIG_80211D
+#define RFCTL_GET_CIS_MAJORITY(rfctl) (((rfctl)->cis_flags & CISF_ENV_BSS_MAJ) ? CIS_SCAN_STAT_GET_MAJORITY(&(rfctl)->cis_scan_stat) : NULL)
+#else
+#define RFCTL_GET_CIS_MAJORITY(rfctl) NULL
+#endif
+
 #if defined(CONFIG_80211D) && CONFIG_IEEE80211_BAND_6GHZ
 #define RFCTL_RECV_6G_REG_INFO(rfctl, iface_id, alink_id) ((rfctl)->recv_6g_reg_info[iface_id][alink_id])
 #else
diff --git a/drivers/net/wireless/realtek/rtl8852ce/include/rtw_version.h b/drivers/net/wireless/realtek/rtl8852ce/include/rtw_version.h
index 90176369..fa7df311 100644
--- a/drivers/net/wireless/realtek/rtl8852ce/include/rtw_version.h
+++ b/drivers/net/wireless/realtek/rtl8852ce/include/rtw_version.h
@@ -1 +1 @@
-#define DRIVERVERSION	"v1.19.16_nv-126-10-g6784793e9.20250808_Certified_Module_beta"
+#define DRIVERVERSION	"v1.19.16_nv-126-16-gbf1934e39.20250910_Certified_Module_beta"
diff --git a/drivers/net/wireless/realtek/rtl8852ce/include/wifi.h b/drivers/net/wireless/realtek/rtl8852ce/include/wifi.h
index 23a3798a..8da7c6ab 100644
--- a/drivers/net/wireless/realtek/rtl8852ce/include/wifi.h
+++ b/drivers/net/wireless/realtek/rtl8852ce/include/wifi.h
@@ -1304,6 +1304,7 @@ struct rtw_regulatory {
 	LE_BITS_TO_1BYTE((_pEleStart) + 2, 0, 8)
 
 #define MBSSID_MAX_BSSID_INDICATOR_OFFSET 3
+#define MBSSID_MAX_CNT 10
 
 #define GET_MULTIPLE_BSSID_IDX_INDEX(_pEleStart) \
 	LE_BITS_TO_1BYTE((_pEleStart) + 2, 0, 8)
diff --git a/drivers/net/wireless/realtek/rtl8852ce/include/wlan_bssdef.h b/drivers/net/wireless/realtek/rtl8852ce/include/wlan_bssdef.h
index 6564008b..c4a809ec 100644
--- a/drivers/net/wireless/realtek/rtl8852ce/include/wlan_bssdef.h
+++ b/drivers/net/wireless/realtek/rtl8852ce/include/wlan_bssdef.h
@@ -16,7 +16,7 @@
 #define __WLAN_BSSDEF_H__
 
 
-#define MAX_IE_SZ	768
+#define MAX_IE_SZ	1840 /* mbssid in beacon defined in WIFI Alliance */
 
 
 #ifdef PLATFORM_LINUX
diff --git a/drivers/net/wireless/realtek/rtl8852ce/os_dep/linux/ioctl_cfg80211.c b/drivers/net/wireless/realtek/rtl8852ce/os_dep/linux/ioctl_cfg80211.c
index e0b13f48..b9867e56 100644
--- a/drivers/net/wireless/realtek/rtl8852ce/os_dep/linux/ioctl_cfg80211.c
+++ b/drivers/net/wireless/realtek/rtl8852ce/os_dep/linux/ioctl_cfg80211.c
@@ -688,7 +688,7 @@ exit:
 	return ret;
 }
 
-#define MAX_BSSINFO_LEN 1000
+#define MAX_BSSINFO_LEN 2072 /* MAX_IE_SZ + 232 */
 struct cfg80211_bss *rtw_cfg80211_inform_bss(_adapter *padapter, struct wlan_network *pnetwork)
 {
 	struct ieee80211_channel *notify_channel;
@@ -2898,22 +2898,22 @@ void rtw_cfg80211_unlink_bss(_adapter *padapter, struct wlan_network *pnetwork)
 	struct wireless_dev *pwdev = padapter->rtw_wdev;
 	struct wiphy *wiphy = pwdev->wiphy;
 	struct cfg80211_bss *bss = NULL;
-	WLAN_BSSID_EX select_network = pnetwork->network;
+	WLAN_BSSID_EX *select_network = &pnetwork->network;
 
 	bss = cfg80211_get_bss(wiphy, NULL/*notify_channel*/,
-		select_network.MacAddress, select_network.Ssid.Ssid,
-		select_network.Ssid.SsidLength,
+		select_network->MacAddress, select_network->Ssid.Ssid,
+		select_network->Ssid.SsidLength,
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
-		select_network.InfrastructureMode == Ndis802_11Infrastructure?IEEE80211_BSS_TYPE_ESS:IEEE80211_BSS_TYPE_IBSS,
-		IEEE80211_PRIVACY(select_network.Privacy));
+		select_network->InfrastructureMode == Ndis802_11Infrastructure?IEEE80211_BSS_TYPE_ESS:IEEE80211_BSS_TYPE_IBSS,
+		IEEE80211_PRIVACY(select_network->Privacy));
 #else
-		select_network.InfrastructureMode == Ndis802_11Infrastructure?WLAN_CAPABILITY_ESS:WLAN_CAPABILITY_IBSS,
-		select_network.InfrastructureMode == Ndis802_11Infrastructure?WLAN_CAPABILITY_ESS:WLAN_CAPABILITY_IBSS);
+		select_network->InfrastructureMode == Ndis802_11Infrastructure?WLAN_CAPABILITY_ESS:WLAN_CAPABILITY_IBSS,
+		select_network->InfrastructureMode == Ndis802_11Infrastructure?WLAN_CAPABILITY_ESS:WLAN_CAPABILITY_IBSS);
 #endif
 
 	if (bss) {
 		cfg80211_unlink_bss(wiphy, bss);
-		RTW_INFO("%s(): cfg80211_unlink %s!!\n", __func__, select_network.Ssid.Ssid);
+		RTW_INFO("%s(): cfg80211_unlink %s!!\n", __func__, select_network->Ssid.Ssid);
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0)
 		cfg80211_put_bss(padapter->rtw_wdev->wiphy, bss);
 #else
@@ -3503,8 +3503,15 @@ bypass_p2p_chk:
 			ret = -EBUSY;
 			goto check_need_indicate_scan_done;
 
-		case SS_DENY_SELF_AP_UNDER_SURVEY:
 		case SS_DENY_SELF_STA_UNDER_SURVEY:
+#ifdef CONFIG_RTW_FSM_BTM
+			if (padapter->fsmpriv.btmpriv.btm) {
+				ret = -EBUSY;
+				goto exit;
+			}
+			fallthrough;
+#endif
+		case SS_DENY_SELF_AP_UNDER_SURVEY:
 			if (rtw_cfg80211_scan_via_auto_scan(padapter, request) == _FALSE)
 				need_indicate_scan_done = _TRUE;
 			goto check_need_indicate_scan_done;
diff --git a/drivers/net/wireless/realtek/rtl8852ce/phl/hal_g6/btc/btc.mk b/drivers/net/wireless/realtek/rtl8852ce/phl/hal_g6/btc/btc.mk
index cd107811..918b129f 100644
--- a/drivers/net/wireless/realtek/rtl8852ce/phl/hal_g6/btc/btc.mk
+++ b/drivers/net/wireless/realtek/rtl8852ce/phl/hal_g6/btc/btc.mk
@@ -7,10 +7,10 @@
 
 ifeq ($(CONFIG_PHL_ARCH), y)
 phl_path := phl/$(HAL)
-phl_path_d1 := $(SOURCETREE)/phl/$(HAL)
+phl_path_d1 := $(src)/phl/$(HAL)
 else
 phl_path := $(HAL)
-phl_path_d1 := $(SOURCETREE)/$(HAL)
+phl_path_d1 := $(src)/$(HAL)
 endif
 
 # Base directory
diff --git a/drivers/net/wireless/realtek/rtl8852ce/phl/hal_g6/hal.mk b/drivers/net/wireless/realtek/rtl8852ce/phl/hal_g6/hal.mk
index 073d84e0..8660c88d 100644
--- a/drivers/net/wireless/realtek/rtl8852ce/phl/hal_g6/hal.mk
+++ b/drivers/net/wireless/realtek/rtl8852ce/phl/hal_g6/hal.mk
@@ -2,10 +2,10 @@
 
 ifeq ($(CONFIG_PHL_ARCH), y)
 phl_path := phl/
-phl_path_d1 := $(SOURCETREE)/phl/$(HAL)
+phl_path_d1 := $(src)/phl/$(HAL)
 else
 phl_path :=
-phl_path_d1 := $(SOURCETREE)/$(HAL)
+phl_path_d1 := $(src)/$(HAL)
 endif
 
 _HAL_FILES :=	$(phl_path)$(HAL)/hal_api_mac.o \
diff --git a/drivers/net/wireless/realtek/rtl8852ce/phl/hal_g6/mac/mac.mk b/drivers/net/wireless/realtek/rtl8852ce/phl/hal_g6/mac/mac.mk
index ad635a48..6342c487 100644
--- a/drivers/net/wireless/realtek/rtl8852ce/phl/hal_g6/mac/mac.mk
+++ b/drivers/net/wireless/realtek/rtl8852ce/phl/hal_g6/mac/mac.mk
@@ -7,10 +7,10 @@ HAL = hal_g6
 
 ifeq ($(CONFIG_PHL_ARCH), y)
 phl_path := phl/hal_g6
-phl_path_d1 := $(SOURCETREE)/phl/$(HAL)
+phl_path_d1 := $(src)/phl/$(HAL)
 else
 phl_path := hal_g6
-phl_path_d1 := $(SOURCETREE)/$(HAL)
+phl_path_d1 := $(src)/$(HAL)
 endif
 
 # Base directory
diff --git a/drivers/net/wireless/realtek/rtl8852ce/phl/hal_g6/phy/bb/bb.mk b/drivers/net/wireless/realtek/rtl8852ce/phl/hal_g6/phy/bb/bb.mk
index 02785e87..a1273e96 100644
--- a/drivers/net/wireless/realtek/rtl8852ce/phl/hal_g6/phy/bb/bb.mk
+++ b/drivers/net/wireless/realtek/rtl8852ce/phl/hal_g6/phy/bb/bb.mk
@@ -7,10 +7,10 @@
 
 ifeq ($(CONFIG_PHL_ARCH), y)
 phl_path := phl/$(HAL)
-phl_path_d1 := $(SOURCETREE)/phl/$(HAL)
+phl_path_d1 := $(src)/phl/$(HAL)
 else
 phl_path := $(HAL)
-phl_path_d1 := $(SOURCETREE)/$(HAL)
+phl_path_d1 := $(src)/$(HAL)
 endif
 
 # Base directory
diff --git a/drivers/net/wireless/realtek/rtl8852ce/phl/hal_g6/phy/rf/rf.mk b/drivers/net/wireless/realtek/rtl8852ce/phl/hal_g6/phy/rf/rf.mk
index 21dd2569..717e176e 100644
--- a/drivers/net/wireless/realtek/rtl8852ce/phl/hal_g6/phy/rf/rf.mk
+++ b/drivers/net/wireless/realtek/rtl8852ce/phl/hal_g6/phy/rf/rf.mk
@@ -7,10 +7,10 @@
 
 ifeq ($(CONFIG_PHL_ARCH), y)
 phl_path := phl/$(HAL)
-phl_path_d1 := $(SOURCETREE)/phl/$(HAL)
+phl_path_d1 := $(src)/phl/$(HAL)
 else
 phl_path := $(HAL)
-phl_path_d1 := $(SOURCETREE)/$(HAL)
+phl_path_d1 := $(src)/$(HAL)
 endif
 
 # Base directory
diff --git a/drivers/net/wireless/realtek/rtl8852ce/phl/phl.mk b/drivers/net/wireless/realtek/rtl8852ce/phl/phl.mk
index aa31e68d..20c1368c 100644
--- a/drivers/net/wireless/realtek/rtl8852ce/phl/phl.mk
+++ b/drivers/net/wireless/realtek/rtl8852ce/phl/phl.mk
@@ -11,10 +11,10 @@ endif
 
 ifeq ($(CONFIG_PHL_ARCH), y)
 phl_path := phl/
-phl_path_d1 := $(SOURCETREE)/phl/$(HAL)
+phl_path_d1 := $(src)/phl/$(HAL)
 else
 phl_path :=
-phl_path_d1 := $(SOURCETREE)/$(HAL)
+phl_path_d1 := $(src)/$(HAL)
 endif
 
 _PHL_FILES := $(phl_path)phl_init.o \
diff --git a/drivers/net/wireless/realtek/rtl8852ce/phl/phl_cmd_scan.c b/drivers/net/wireless/realtek/rtl8852ce/phl/phl_cmd_scan.c
index 22004d5d..33c54617 100644
--- a/drivers/net/wireless/realtek/rtl8852ce/phl/phl_cmd_scan.c
+++ b/drivers/net/wireless/realtek/rtl8852ce/phl/phl_cmd_scan.c
@@ -343,12 +343,12 @@ next_ch:
 		goto next_ch;
 	}
 	else {
-		PHL_INFO("%s: scan done\n", __func__);
+		printk("%s: scan done\n", __func__);
 		return NULL;
 	}
 
 	param->done_num = param->ch_num - sctrl->chlist.cnt;
-	PHL_INFO("%s:[%d] idx=%d, r=%d, ch=%d, p=%d\n", __func__,
+	printk("%s:[%d] idx=%d, r=%d, ch=%d, p=%d\n", __func__,
 		band_idx, sctrl->ch_idx, sctrl->chlist.cnt, sctrl->scan_ch->channel,
 		phl_get_passing_time_ms(param->start_time));
 
diff --git a/drivers/net/wireless/realtek/rtl8852ce/phl/phl_git_info.h b/drivers/net/wireless/realtek/rtl8852ce/phl/phl_git_info.h
index 43974824..d66e8d14 100644
--- a/drivers/net/wireless/realtek/rtl8852ce/phl/phl_git_info.h
+++ b/drivers/net/wireless/realtek/rtl8852ce/phl/phl_git_info.h
@@ -26,14 +26,14 @@
 #define __PHL_GIT_INFO_H__
  /*@--------------------------[Define] ---------------------------------------*/
 
-#define RTK_CORE_SHA1   "6784793e97c8520c94a2fb213397e109827325ec"
+#define RTK_CORE_SHA1   "bf1934e39d7842ed35fa61ef726cc2d4b7b2029e"
 #define RTK_PHL_SHA1    "981191b0a91d583e48282299b55d86f768f4b98b"
 #define RTK_HALMAC_SHA1 "a8003e258e7ceec767c2e329732e7e3b63934473"
 #define RTK_HALBB_SHA1  "8f07cd65ef4ef6867255f3a95706e417c8d31bf3"
 #define RTK_HALRF_SHA1  "01c1864e02ade0c1d1482c85d6bb0fa0f4799651"
 #define RTK_BTC_SHA1    "33bcdb9f10f24aa8b92ee86a7076f89faf6ccbed"
 
-#define RTK_CORE_TAGINFO     "v1.19.16_nv-126-10-g6784793e9"
+#define RTK_CORE_TAGINFO     "v1.19.16_nv-126-16-gbf1934e39"
 #define RTK_PHL_TAGINFO      "PHL_1_19_111_0100-94-g981191b0a"
 #define RTK_HALMAC_TAGINFO   "HALMAC_0_29_95_0-1-ga8003e258e"
 #define RTK_HALBB_TAGINFO    "HALBB_029_167_15-2-g8f07cd65"