diff --git a/.github/workflows/w1700k.yaml b/.github/workflows/w1700k.yaml
index 464c0cefdc..7ee3d74634 100644
--- a/.github/workflows/w1700k.yaml
+++ b/.github/workflows/w1700k.yaml
@@ -6,7 +6,7 @@ on:
 
 env:
   REMOTE_REPOSITORY: danpawlik/openwrt
-  REMOTE_BRANCH: w1700k
+  REMOTE_BRANCH: w1700k-npu
   RELEASE_PREFIX: airoha
 
 jobs:
@@ -53,14 +53,23 @@ jobs:
           ./scripts/feeds update -a
           ./scripts/feeds install -a
 
+      # NOTE: something seems to be not right after
+      # https://github.com/openwrt/openwrt/compare/4d653973de0eb6254d7c343de58de9b632b26ebe..37ebcb6c22ea8ef410d1dd9604ae8a77340fe32c
+      # Include removed packages.
+      # NOTE: Since https://github.com/openwrt/openwrt/pull/22151, we changed
+      # way to run the system. Now it would be using chainload.
+      # To bootstrap the router, see: https://github.com/hurrian/w1700k-ubi-installer
+      # then in the system, push the firmware and just do: sysupgrade --force firmware.bin
       - name: Configure firmware image
         run: |
-          curl -SL https://raw.githubusercontent.com/danpawlik/openwrt-builder/master/configs/airoha/an7581/gemtek_w1700k > .config ;
+          curl -SL https://raw.githubusercontent.com/danpawlik/openwrt-builder/master/configs/airoha/an7581/gemtek_w1700k_chainload > .config ;
           curl -SL https://raw.githubusercontent.com/danpawlik/openwrt-builder/master/configs/common/dumb_ap >> .config ;
           curl -SL https://raw.githubusercontent.com/danpawlik/openwrt-builder/master/configs/common/snapshot >> .config ;
           curl -SL https://raw.githubusercontent.com/danpawlik/openwrt-builder/master/configs/common/mlo >> .config;
           curl -SL https://raw.githubusercontent.com/danpawlik/openwrt-builder/master/configs/common/optimize >> .config ;
           echo "CONFIG_PACKAGE_librespeed-go=y" >> .config
+          echo "CONFIG_PACKAGE_kmod-phy-realtek=y" >> .config
+          echo "CONFIG_PACKAGE_rtl8261n-firmware=y" >> .config
 
       - name: Run defconfig
         run:
@@ -103,10 +112,12 @@ jobs:
         with:
           files: bin/targets/airoha/an7581/*
           tag_name: ${{ env.RELEASE_PREFIX }}-${{ env.REMOTE_BRANCH }}-${{ env.RELEASE_DATE }}
-          name: OpenWrt Quantum Fiber W1700k - vanila - ${{ env.REMOTE_BRANCH }} - ${{ env.RELEASE_DATE }}
+          name: OpenWrt Quantum Fiber W1700k - vanilla with bl chainload - ${{ env.REMOTE_BRANCH }} - ${{ env.RELEASE_DATE }}
           body: |
             Updated prebuilt images for ${{ env.RELEASE_DATE }}
             Build Commit: ${{ needs.check_commits.outputs.latest_commit_sha }}
+            Uses also chainload proposed in https://github.com/openwrt/openwrt/pull/22151.
+            To bootstrap the device, use: https://github.com/hurrian/w1700k-ubi-installer
 
       - name: Clean up old releases
         uses: dev-drprasad/delete-older-releases@master
diff --git a/Dockerfile b/Dockerfile
index d2b767c216..ee374409b4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM fedora:42
+FROM fedora:43
 
 RUN yum update -y && dnf -y group install development-tools
 
diff --git a/configs/airoha/an7581/gemtek_w1700k_chainload b/configs/airoha/an7581/gemtek_w1700k_chainload
new file mode 100644
index 0000000000..689b1e7cea
--- /dev/null
+++ b/configs/airoha/an7581/gemtek_w1700k_chainload
@@ -0,0 +1,11 @@
+#
+# curl -SL https://raw.githubusercontent.com/danpawlik/openwrt-builder/master/configs/airoha/an7581/gemtek_w1700k_chainload > .config
+#
+
+CONFIG_TARGET_airoha=y
+CONFIG_TARGET_airoha_an7581=y
+CONFIG_TARGET_airoha_an7581_DEVICE_gemtek_w1700k-ubi=y
+CONFIG_PACKAGE_u-boot-an7581_chainload=y
+
+# enable HW crypto acceleration
+CONFIG_PACKAGE_kmod-crypto-hw-eip93=y
diff --git a/configs/common/dumb_ap b/configs/common/dumb_ap
index a94d1818e9..6bfa34792a 100644
--- a/configs/common/dumb_ap
+++ b/configs/common/dumb_ap
@@ -29,6 +29,7 @@ CONFIG_PACKAGE_irqbalance=y
 CONFIG_PACKAGE_luci-app-irqbalance=y
 # CONFIG_PACKAGE_fping=y
 # CONFIG_PACKAGE_coreutils=y
+CONFIG_PACKAGE_tmux=y
 
 # attendedsysupgrade / owut
 CONFIG_PACKAGE_owut=y
diff --git a/configs/common/main-router b/configs/common/main-router
index 809e2cd4f2..7f0943894e 100644
--- a/configs/common/main-router
+++ b/configs/common/main-router
@@ -32,6 +32,7 @@ CONFIG_PACKAGE_ethtool-full=y
 CONFIG_PACKAGE_tc-full=y
 # CONFIG_PACKAGE_fping=y
 # CONFIG_PACKAGE_coreutils=y
+CONFIG_PACKAGE_tmux=y
 
 # attendedsysupgrade / owut
 CONFIG_PACKAGE_owut=y
@@ -87,22 +88,22 @@ CONFIG_PACKAGE_collectd-mod-ping=y
 CONFIG_PACKAGE_irqbalance=y
 CONFIG_PACKAGE_luci-app-irqbalance=y
 
-# SQM
+# SQM - remove one or all via rc.local
 CONFIG_PACKAGE_luci-app-sqm=y
 CONFIG_PACKAGE_sqm-scripts=y
 CONFIG_PACKAGE_ip6tables-nft=y
 
+# just additional kmods for sqm-scripts - just in case
+CONFIG_PACKAGE_kmod-ipt-core=y
+CONFIG_PACKAGE_kmod-nft-compat=y
+CONFIG_PACKAGE_kmod-ipt-ipopt=y
+
 # Qosify
 CONFIG_PACKAGE_qosify=y
 CONFIG_PACKAGE_kmod-ifb=y
 CONFIG_PACKAGE_kmod-sched-bpf=y
 CONFIG_PACKAGE_kmod-sched-cake=y
 
-# just additional kmods for sqm-scripts - just in case
-CONFIG_PACKAGE_kmod-ipt-core=y
-CONFIG_PACKAGE_kmod-nft-compat=y
-CONFIG_PACKAGE_kmod-ipt-ipopt=y
-
 # just additional kmods for qosmate - just in case
 CONFIG_PACKAGE_ip-full=y
 CONFIG_PACKAGE_kmod-sched=y
@@ -120,6 +121,11 @@ CONFIG_PACKAGE_ddns-scripts=y
 # do not disable firewall on dumb ap's.
 CONFIG_PACKAGE_bridger=y
 
+# IGMPv3 and MLDv2 multicast proxy
+CONFIG_PACKAGE_omcproxy=y
+CONFIG_PACKAGE_luci-app-omcproxy=y
+
+
 # language
 CONFIG_LUCI_LANG_pl=y
 
diff --git a/configs/common/openssl b/configs/common/openssl
index af168ad678..adafc4b147 100644
--- a/configs/common/openssl
+++ b/configs/common/openssl
@@ -27,7 +27,8 @@ CONFIG_PACKAGE_libopenssl-devcrypto=y
 # CONFIG_PACKAGE_libopenssl-afalg_sync is not set
 
 ### Force add /dev/crypto into libcrypto
-# CONFIG_OPENSSL_ENGINE_BUILTIN=y
-# CONFIG_OPENSSL_ENGINE_BUILTIN_DEVCRYPTO=y
+CONFIG_OPENSSL_ENGINE_BUILTIN=y
+CONFIG_OPENSSL_ENGINE_BUILTIN_DEVCRYPTO=y
+CONFIG_OPENSSL_ENGINE_BUILTIN_AFALG=y
 
 #### replace mbedtls with openssl - remember to leave commented "is not set" or remove it!
diff --git a/configs/common/sfp b/configs/common/sfp
index c63e9fdb56..ee9a11b30c 100644
--- a/configs/common/sfp
+++ b/configs/common/sfp
@@ -5,3 +5,6 @@ CONFIG_PACKAGE_dtc=y
 CONFIG_PACKAGE_kmod-phy-realtek=y
 CONFIG_PACKAGE_kmod-phy-rtl8261n=y
 CONFIG_PACKAGE_kmod-phy-aquantia=y
+CONFIG_PACKAGE_kmod-phy-motorcomm=y
+
+CONFIG_PACKAGE_rtl8261n-firmware=y
diff --git a/settings-configs/BPI-R4/wireless-mlo-openwrt b/settings-configs/BPI-R4/wireless-mlo-openwrt
index 11c1f78d73..4f7b18b47f 100644
--- a/settings-configs/BPI-R4/wireless-mlo-openwrt
+++ b/settings-configs/BPI-R4/wireless-mlo-openwrt
@@ -10,16 +10,6 @@ config wifi-device 'radio0'
 	option country 'DE'
 	option cell_density '0'
 
-config wifi-iface 'default_radio0'
-	option device 'radio0'
-	option network 'lan'
-	option mode 'ap'
-	option ssid 'Test_2G'
-	option encryption 'psk2+ccmp'
-	option key 'test1234test'
-	option wnm_sleep_mode_no_keys '1'
-	option bss_transition '1'
-
 config wifi-device 'radio1'
 	option type 'mac80211'
 	option path 'soc/11300000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
@@ -42,7 +32,6 @@ config wifi-device 'radio2'
 	option country 'DE'
 	option cell_density '0'
 
-
 config wifi-iface 'wifinet0'
 	list device 'radio0'
 	list device 'radio1'
diff --git a/settings-configs/w1700k-dumb-ap/attendedsysupgrade b/settings-configs/w1700k-dumb-ap/attendedsysupgrade
new file mode 100644
index 0000000000..cdb186bd24
--- /dev/null
+++ b/settings-configs/w1700k-dumb-ap/attendedsysupgrade
@@ -0,0 +1,24 @@
+
+config server 'server'
+	option url 'https://sysupgrade.openwrt.org'
+
+config client 'client'
+	option upgrade_packages '1'
+	option auto_search '0'
+	option advanced_mode '0'
+
+# Example configuration for 'owut'.  The option names are the same
+# as those used on the command line, with all '-' dashes replaced by
+# '_' underscores.  Use 'owut --help' to see more.
+
+config owut 'owut'
+#	option verbosity         0
+#	option keep              true
+#	option init_script      '/root/data/my-init-script.sh'
+#	option image            '/tmp/my-firmware-img.bin'
+#	option rootfs_size       256
+#	option pre_install      '/etc/owut.d/pre-install.sh'
+#	option poll_interval     10000  # In milliseconds
+#	list   ignored_defaults 'kmod-drm-i915'
+#	list   ignored_defaults 'kmod-dwmac-intel'
+
diff --git a/settings-configs/w1700k-dumb-ap/bridger b/settings-configs/w1700k-dumb-ap/bridger
new file mode 100644
index 0000000000..bad8508f14
--- /dev/null
+++ b/settings-configs/w1700k-dumb-ap/bridger
@@ -0,0 +1,7 @@
+config defaults
+	# handle bridge local rx/tx
+	option bridge_local_tx 1
+	option bridge_local_rx 0
+
+	# example for blacklisting individual devices or bridges
+	# list blacklist eth0
diff --git a/settings-configs/w1700k-dumb-ap/collectd b/settings-configs/w1700k-dumb-ap/collectd
new file mode 100644
index 0000000000..b7db1a2f17
--- /dev/null
+++ b/settings-configs/w1700k-dumb-ap/collectd
@@ -0,0 +1,238 @@
+config globals 'globals'
+	option alt_config_file "/etc/collectd.conf"
+#	option BaseDir '/var/run/collectd'
+#	option Include '/tmp/collectd.d'
+#	option PIDFile '/var/run/collectd.pid'
+#	option PluginDir '/usr/lib/collectd'
+#	option TypesDB '/usr/share/collectd/types.db'
+#	option Interval '30'
+#	option ReadThreads '2'
+#	option WriteThreads '2'
+#	option WriteQueueLimitLow '0'
+#	option WriteQueueLimitHigh '0'
+#	option CollectInternalStats '0'
+
+#config plugin 'apcups'
+#	option enable '0'
+#	option Host 'localhost'
+#	option Port '3551'
+
+#config plugin 'conntrack'
+#	option enable '0'
+
+#config plugin 'contextswitch'
+#	option enable '0'
+
+#config plugin 'cpu'
+#	option enable '0'
+
+#config plugin 'cpufreq'
+#	option enable '0'
+
+#config plugin 'csv'
+#	option enable '0'
+#	option StoreRates '0'
+#	option DataDir '/tmp'
+
+#config plugin 'curl'
+#	option enable '0'
+
+#config curl_page
+#	option name 'test'
+#	option url 'http://finance.google.com/finance?q=NYSE%3AAMD%22'
+
+#config plugin 'df'
+#	option enable '0'
+#	list Device '/dev/mtdblock/4'
+#	list MountPoint '/jffs'
+#	list FSType 'tmpfs'
+#	option IgnoreSelected '0'
+
+#config plugin 'disk'
+#	option enable '0'
+#	list Disk 'hda1'
+#	list Disk 'hdb'
+#	option IgnoreSelected '0'
+
+#config plugin 'dns'
+#	option enable '0'
+#	list Interface 'br-lan'
+#	list IgnoreSource '127.0.0.1'
+
+#config plugin 'email'
+#	option enable '0'
+#	option SocketFile '/var/run/collectd/email.sock'
+#	option SocketGroup 'nogroup'
+
+#config plugin 'entropy'
+#	option enable '0'
+
+#config plugin 'exec'
+#	option enable '0'
+
+#config exec_input
+#	option cmdline '/usr/bin/stat-dhcpusers'
+#	option cmduser 'nobody'
+#	option cmdgroup 'nogroup'
+
+#config exec_notify
+#	option cmdline '/usr/bin/stat-dhcpusers'
+#	option cmduser 'nobody'
+#	option cmdgroup 'nogroup'
+
+#config plugin 'interface'
+#	option enable '1'
+#	list Interface 'br-lan'
+#	option IgnoreSelected '0'
+
+#config plugin 'iptables'
+#	option enable '1'
+
+#config iptables_match
+#	option table 'nat'
+#	option chain 'zone_wan_postrouting'
+#	option index '1'
+#	option name 'WLAN-Clients traffic'
+
+#config plugin 'irq'
+#	option enable '0'
+#	list Irq '2'
+#	list Irq '3'
+#	list Irq '4'
+#	list Irq '7'
+
+#config plugin 'iwinfo'
+#	option enable '0'
+
+#config plugin 'load'
+#	option enable '0'
+
+#config plugin 'lua'
+#	option BasePath '/usr/share/collectd-mod-lua'
+#	list Script 'script1.lua'
+#	list Script 'script2.lua
+
+#config plugin 'memory'
+#	option enable '0'
+
+#config plugin 'netlink'
+#	option enable '0'
+#	option IgnoreSelected '0'
+#	list VerboseInterface 'br-lan'
+#	list QDisc 'br-lan'
+
+#config plugin 'network'
+#	option enable '1'
+#	option TimeToLive '128'
+#	option Forward '1'
+#	option CacheFlush '86400'
+
+#config network_listen
+#	option host '0.0.0.0'
+#	option port '25826'
+
+#config network_server
+#	option host '1.1.1.1'
+#	option port '25826'
+
+#config plugin 'nut'
+#	option enable '0'
+#	option UPS 'myupsname'
+
+#config plugin 'olsrd'
+#	option enable '0'
+#	option Port '2006'
+#	option Host '127.0.0.1'
+
+#config plugin 'openvpn'
+#	option enable '0'
+#	option StatusFile '/var/run/openvpn/openvpn.status'
+#	option CollectIndividualUsers '1'
+#	optoin CollectUserCount '1'
+#	optoin CollectCompression '1'
+#	option ImprovedNamingSchema '0'
+
+#config plugin 'ping'
+#	option enable '0'
+#	option TTL '127'
+#	option Interval '30'
+#	list Host '127.0.0.1'
+
+#config plugin 'processes'
+#	option enable '0'
+#	list Process 'uhttpd'
+#	list Process 'dnsmasq'
+#	list Process 'dropbear'
+
+#config plugin 'rrdtool'
+#	option enable '0'
+#	option DataDir '/tmp/rrd'
+#	option RRARows '100'
+#	option RRASingle '1'
+#	list RRATimespan '3600'
+#	list RRATimespan '86400'
+#	list RRATimespan '604800'
+#	list RRATimespan '2678400'
+#	list RRATimespan '31622400'
+
+#config plugin 'sensors'
+#	option enable '0'
+
+#config plugin 'swap'
+#	option enable '0'
+#	option ReportByDevice '1'
+#	option ValuesAbsolute '1'
+#	option ValuesPercentage '0'
+#	option ReportIO '1'
+#	option ReportBytes '1'
+
+#config plugin 'tcpconns'
+#	option enable '0'
+#	option ListeningPorts '0'
+#	option AllPortsSummary '0'
+#	list LocalPort '22'
+#	list LocalPort '80'
+
+#config plugin 'thermal'
+#	option enable '0'
+#	option IgnoreSelected '0'
+#	list Device ''
+
+#config plugin 'ubi'
+#	option enable '0'
+#	list  Device 'ubi0'
+#	option IgnoreSelected '0'
+
+#config plugin 'unixsock'
+#	option enable '0'
+#	option SocketFile '/var/run/collectd/query.sock'
+#	option SocketGroup 'nogroup'
+
+#config plugin 'uptime'
+#	option enable '0'
+
+#config plugin 'vmem'
+#	option enable '0'
+#	option Verbose '0'
+#
+#config plugin 'write_http'
+#	option enable '0'
+#
+#config write_http_node
+#	option name 'foo'
+#	option URL 'http://example.org/post-collectd'
+#
+#config plugin 'mqtt'
+#	option enable '1'
+#
+#config mqtt_block
+#	option name 'foo'
+#	option blocktype 'Subscribe'
+#	option Host 'localhost'
+#	option Topic 'collectd/#'
+
+#config plugin 'write_prometheus'
+#	option enable '0'
+#	option Host '0.0.0.0'
+#	option Port '9103'
+#	option StalenessDelta '300'
diff --git a/settings-configs/w1700k-dumb-ap/dhcp b/settings-configs/w1700k-dumb-ap/dhcp
new file mode 100644
index 0000000000..83a5d3e573
--- /dev/null
+++ b/settings-configs/w1700k-dumb-ap/dhcp
@@ -0,0 +1,43 @@
+
+config dnsmasq
+	option domainneeded '1'
+	option boguspriv '1'
+	option filterwin2k '0'
+	option localise_queries '1'
+	option rebind_protection '1'
+	option rebind_localhost '1'
+	option local '/lan/'
+	option domain 'lan'
+	option expandhosts '1'
+	option nonegcache '0'
+	option cachesize '1000'
+	option authoritative '1'
+	option readethers '1'
+	option leasefile '/tmp/dhcp.leases'
+	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
+	option nonwildcard '1'
+	option localservice '1'
+	option ednspacket_max '1232'
+	option filter_aaaa '0'
+	option filter_a '0'
+
+config dhcp 'lan'
+	option interface 'lan'
+	option start '100'
+	option limit '150'
+	option leasetime '12h'
+	option dhcpv4 'server'
+	option ignore '1'
+
+config dhcp 'wan'
+	option interface 'wan'
+	option ignore '1'
+
+config odhcpd 'odhcpd'
+	option maindhcp '0'
+	option leasefile '/tmp/odhcpd.leases'
+	option leasetrigger '/usr/sbin/odhcpd-update'
+	option loglevel '4'
+	option hostsdir '/tmp/hosts'
+	option piodir '/tmp/odhcpd-piodir'
+
diff --git a/settings-configs/w1700k-dumb-ap/firewall b/settings-configs/w1700k-dumb-ap/firewall
new file mode 100644
index 0000000000..ea2ca7a562
--- /dev/null
+++ b/settings-configs/w1700k-dumb-ap/firewall
@@ -0,0 +1,123 @@
+
+config defaults
+	option input 'REJECT'
+	option output 'ACCEPT'
+	option forward 'REJECT'
+	option synflood_protect '1'
+	option flow_offloading '1'
+	option flow_offloading_hw '1'
+
+config zone
+	option name 'lan'
+	list network 'lan'
+	option input 'ACCEPT'
+	option output 'ACCEPT'
+	option forward 'ACCEPT'
+
+config zone
+	option name 'wan'
+	list network 'wan'
+	list network 'wan6'
+	option input 'REJECT'
+	option output 'ACCEPT'
+	option forward 'DROP'
+	option masq '1'
+	option mtu_fix '1'
+
+config forwarding
+	option src 'lan'
+	option dest 'wan'
+
+config rule
+	option name 'Allow-DHCP-Renew'
+	option src 'wan'
+	option proto 'udp'
+	option dest_port '68'
+	option target 'ACCEPT'
+	option family 'ipv4'
+
+config rule
+	option name 'Allow-Ping'
+	option src 'wan'
+	option proto 'icmp'
+	option icmp_type 'echo-request'
+	option family 'ipv4'
+	option target 'ACCEPT'
+
+config rule
+	option name 'Allow-IGMP'
+	option src 'wan'
+	option proto 'igmp'
+	option family 'ipv4'
+	option target 'ACCEPT'
+
+config rule
+	option name 'Allow-DHCPv6'
+	option src 'wan'
+	option proto 'udp'
+	option dest_port '546'
+	option family 'ipv6'
+	option target 'ACCEPT'
+
+config rule
+	option name 'Allow-MLD'
+	option src 'wan'
+	option proto 'icmp'
+	option src_ip 'fe80::/10'
+	list icmp_type '130/0'
+	list icmp_type '131/0'
+	list icmp_type '132/0'
+	list icmp_type '143/0'
+	option family 'ipv6'
+	option target 'ACCEPT'
+
+config rule
+	option name 'Allow-ICMPv6-Input'
+	option src 'wan'
+	option proto 'icmp'
+	list icmp_type 'echo-request'
+	list icmp_type 'echo-reply'
+	list icmp_type 'destination-unreachable'
+	list icmp_type 'packet-too-big'
+	list icmp_type 'time-exceeded'
+	list icmp_type 'bad-header'
+	list icmp_type 'unknown-header-type'
+	list icmp_type 'router-solicitation'
+	list icmp_type 'neighbour-solicitation'
+	list icmp_type 'router-advertisement'
+	list icmp_type 'neighbour-advertisement'
+	option limit '1000/sec'
+	option family 'ipv6'
+	option target 'ACCEPT'
+
+config rule
+	option name 'Allow-ICMPv6-Forward'
+	option src 'wan'
+	option dest '*'
+	option proto 'icmp'
+	list icmp_type 'echo-request'
+	list icmp_type 'echo-reply'
+	list icmp_type 'destination-unreachable'
+	list icmp_type 'packet-too-big'
+	list icmp_type 'time-exceeded'
+	list icmp_type 'bad-header'
+	list icmp_type 'unknown-header-type'
+	option limit '1000/sec'
+	option family 'ipv6'
+	option target 'ACCEPT'
+
+config rule
+	option name 'Allow-IPSec-ESP'
+	option src 'wan'
+	option dest 'lan'
+	option proto 'esp'
+	option target 'ACCEPT'
+
+config rule
+	option name 'Allow-ISAKMP'
+	option src 'wan'
+	option dest 'lan'
+	option dest_port '500'
+	option proto 'udp'
+	option target 'ACCEPT'
+
diff --git a/settings-configs/w1700k-dumb-ap/irqbalance b/settings-configs/w1700k-dumb-ap/irqbalance
new file mode 100644
index 0000000000..75a4f2b471
--- /dev/null
+++ b/settings-configs/w1700k-dumb-ap/irqbalance
@@ -0,0 +1,4 @@
+
+config irqbalance 'irqbalance'
+	option enabled '1'
+
diff --git a/settings-configs/w1700k-dumb-ap/librespeed-go b/settings-configs/w1700k-dumb-ap/librespeed-go
new file mode 100644
index 0000000000..116dc2316a
--- /dev/null
+++ b/settings-configs/w1700k-dumb-ap/librespeed-go
@@ -0,0 +1,47 @@
+
+config librespeed-go 'config'
+	option enabled '1'
+
+	# bind address, use empty string to bind to all interfaces
+	option bind_address ''
+	# backend listen port
+	option listen_port '8989'
+
+	# change the base URL
+	# option url_base '/librespeed'
+	# proxy protocol port, use 0 to disable
+	option proxyprotocol_port '0'
+	# Server location, use zeroes to fetch from API automatically
+	option server_lat '0'
+	option server_lng '0'
+	# ipinfo.io API key, if applicable
+	option ipinfo_api_key ''
+
+	# assets directory path, defaults to `assets` in the same directory
+	# if the path cannot be found, embedded default assets will be used
+	option assets_path ''
+
+	# password for logging into statistics page, change this to enable stats page
+	# option statistics_password 'PASSWORD'
+	# redact IP addresses (boolean)
+	option redact_ip_addresses '0'
+
+	# database type for statistics data, currently supports: none, memory, bolt, mysql, postgresql
+	# if none is specified, no telemetry/stats will be recorded, and no result PNG will be generated
+	option database_type 'none'
+	# option database_hostname ''
+	# option database_name ''
+	# option database_username ''
+	# option database_password ''
+
+	# if you use `bolt` as database, set database_file to database file location
+	# option database_file '/etc/librespeed-go/speedtest.db'
+
+	# TLS and HTTP/2 settings. TLS is required for HTTP/2 (boolean)
+	option enable_tls '0'
+	option enable_http2 '0'
+
+	# if you use HTTP/2 or TLS, you need to prepare certificates and private keys
+	# option tls_cert_file '/etc/librespeed-go/cert.pem'
+	# option tls_key_file '/etc/librespeed-go/privkey.pem'
+
diff --git a/settings-configs/w1700k-dumb-ap/luci b/settings-configs/w1700k-dumb-ap/luci
new file mode 100644
index 0000000000..a4e2261cef
--- /dev/null
+++ b/settings-configs/w1700k-dumb-ap/luci
@@ -0,0 +1,42 @@
+
+config core 'main'
+	option lang 'auto'
+	option mediaurlbase '/luci-static/bootstrap'
+	option resourcebase '/luci-static/resources'
+	option ubuspath '/ubus/'
+
+config extern 'flash_keep'
+	option uci '/etc/config/'
+	option dropbear '/etc/dropbear/'
+	option openvpn '/etc/openvpn/'
+	option passwd '/etc/passwd'
+	option opkg '/etc/opkg.conf'
+	option firewall '/etc/firewall.user'
+	option uploads '/lib/uci/upload/'
+
+config internal 'languages'
+	option pl 'Polski (Polish)'
+
+config internal 'sauth'
+	option sessionpath '/tmp/luci-sessions'
+	option sessiontime '3600'
+
+config internal 'ccache'
+	option enable '1'
+
+config internal 'themes'
+	option Bootstrap '/luci-static/bootstrap'
+	option BootstrapDark '/luci-static/bootstrap-dark'
+	option BootstrapLight '/luci-static/bootstrap-light'
+
+config internal 'apply'
+	option rollback '90'
+	option holdoff '4'
+	option timeout '5'
+	option display '1.5'
+
+config internal 'diag'
+	option dns 'openwrt.org'
+	option ping 'openwrt.org'
+	option route 'openwrt.org'
+
diff --git a/settings-configs/w1700k-dumb-ap/luci_statistics b/settings-configs/w1700k-dumb-ap/luci_statistics
new file mode 100644
index 0000000000..1303601988
--- /dev/null
+++ b/settings-configs/w1700k-dumb-ap/luci_statistics
@@ -0,0 +1,214 @@
+
+config statistics 'collectd'
+	option BaseDir '/var/run/collectd'
+	option PIDFile '/var/run/collectd.pid'
+	option PluginDir '/usr/lib/collectd'
+	option TypesDB '/usr/share/collectd/types.db'
+	option Interval '30'
+	option ReadThreads '2'
+	option Include '/etc/collectd/conf.d/*.conf'
+
+config statistics 'rrdtool'
+	option default_timespan '2hour'
+	option image_width '600'
+	option image_height '150'
+	option image_path '/tmp/rrdimg'
+
+config statistics 'collectd_rrdtool'
+	option enable '1'
+	option DataDir '/tmp/rrd'
+	option RRARows '288'
+	option RRASingle '1'
+	option backup '1'
+	list RRATimespans '2hour'
+	list RRATimespans '1day'
+	list RRATimespans '1week'
+	list RRATimespans '1month'
+	list RRATimespans '1year'
+
+config statistics 'collectd_csv'
+	option enable '0'
+	option StoreRates '0'
+	option DataDir '/tmp'
+
+config statistics 'collectd_email'
+	option enable '0'
+	option SocketFile '/var/run/collectd/email.sock'
+	option SocketGroup 'nogroup'
+
+config statistics 'collectd_logfile'
+	option enable '0'
+	option LogLevel 'notice'
+	option File '/var/log/collectd.log'
+	option Timestamp '1'
+
+config statistics 'collectd_network'
+
+config statistics 'collectd_syslog'
+	option enable '0'
+	option LogLevel 'warning'
+	option NotifyLevel 'WARNING'
+
+config statistics 'collectd_unixsock'
+	option enable '0'
+	option SocketFile '/var/run/collectd/query.sock'
+	option SocketGroup 'nogroup'
+
+config statistics 'collectd_apcups'
+	option enable '0'
+	option Host 'localhost'
+	option Port '3551'
+
+config statistics 'collectd_chrony'
+	option enable '0'
+	option Host '127.0.0.1'
+	option Port '323'
+	option Timeout '2'
+
+config statistics 'collectd_conntrack'
+	option enable '0'
+
+config statistics 'collectd_contextswitch'
+	option enable '0'
+
+config statistics 'collectd_cpu'
+	option enable '1'
+	option ReportByCpu '1'
+	option ReportByState '1'
+	option ShowIdle '0'
+	option ValuesPercentage '1'
+
+config statistics 'collectd_cpufreq'
+	option enable '0'
+
+config statistics 'collectd_curl'
+	option enable '0'
+
+config statistics 'collectd_df'
+	option enable '0'
+	option Devices '/dev/mtdblock/4'
+	option MountPoints '/overlay'
+	option FSTypes 'tmpfs'
+	option IgnoreSelected '0'
+	option ValuesPercentage '0'
+
+config statistics 'collectd_dhcpleases'
+	option enable '0'
+	option Path '/tmp/dhcp.leases'
+
+config statistics 'collectd_disk'
+	option enable '0'
+	option Disks 'hda1 hdb'
+	option IgnoreSelected '0'
+
+config statistics 'collectd_dns'
+	option enable '0'
+	option Interfaces 'br-lan'
+	option IgnoreSources '127.0.0.1'
+
+config statistics 'collectd_entropy'
+	option enable '0'
+
+config statistics 'collectd_exec'
+	option enable '0'
+
+config statistics 'collectd_interface'
+	option enable '1'
+	option Interfaces 'br-lan'
+	option IgnoreSelected '0'
+
+config statistics 'collectd_ipstatistics'
+	option enable '0'
+
+config statistics 'collectd_iptables'
+	option enable '0'
+
+config collectd_iptables_match
+	option table 'nat'
+	option chain 'luci_fw_postrouting'
+	option target 'MASQUERADE'
+	option source '192.168.1.0/24'
+	option outputif 'br-ff'
+	option name 'LAN-Clients traffic'
+
+config collectd_iptables_match
+	option chain 'luci_fw_postrouting'
+	option table 'nat'
+	option target 'MASQUERADE'
+	option source '10.61.230.0/24'
+	option outputif 'br-ff'
+	option name 'WLAN-Clients traffic'
+
+config statistics 'collectd_irq'
+	option enable '0'
+	option Irqs '2 3 4 7'
+
+config statistics 'collectd_iwinfo'
+	option enable '1'
+
+config statistics 'collectd_load'
+	option enable '1'
+
+config statistics 'collectd_memory'
+	option enable '1'
+	option HideFree '0'
+	option ValuesAbsolute '1'
+	option ValuesPercentage '0'
+
+config statistics 'collectd_netlink'
+	option enable '0'
+	option IgnoreSelected '0'
+	option VerboseInterfaces 'br-lan'
+	option QDiscs 'br-lan'
+
+config statistics 'collectd_nut'
+	option enable '0'
+	list UPS 'myupsname'
+
+config statistics 'collectd_olsrd'
+	option enable '0'
+	option Port '2006'
+	option Host '127.0.0.1'
+
+config statistics 'collectd_openvpn'
+	option enable '0'
+
+config statistics 'collectd_ping'
+	option enable '1'
+	option TTL '127'
+	option Interval '5'
+	list Hosts '9.9.9.10'
+	list Hosts '1.1.1.1'
+	option AddressFamily 'any'
+
+config statistics 'collectd_processes'
+	option enable '0'
+	option Processes 'uhttpd dnsmasq dropbear'
+
+config statistics 'collectd_sensors'
+	option enable '1'
+	option IgnoreSelected '1'
+
+config statistics 'collectd_snmp6'
+	option enable '0'
+	option Interfaces 'br-lan'
+	option IgnoreSelected '0'
+
+config statistics 'collectd_splash_leases'
+	option enable '0'
+
+config statistics 'collectd_tcpconns'
+	option enable '0'
+	option ListeningPorts '0'
+	list LocalPorts '22'
+	option AllPortsSummary '0'
+
+config statistics 'collectd_thermal'
+	option enable '0'
+	option IgnoreSelected '0'
+
+config statistics 'collectd_uptime'
+	option enable '0'
+
+config statistics 'collectd_mqtt'
+
diff --git a/settings-configs/w1700k-dumb-ap/network b/settings-configs/w1700k-dumb-ap/network
new file mode 100644
index 0000000000..bd08e58275
--- /dev/null
+++ b/settings-configs/w1700k-dumb-ap/network
@@ -0,0 +1,40 @@
+config interface 'loopback'
+	option device 'lo'
+	option proto 'static'
+	list ipaddr '127.0.0.1/8'
+
+config globals 'globals'
+	option dhcp_default_duid '00047a23e014xxxc93e2809'
+	option ula_prefix 'fd26:66cd:xxx::/48'
+	option packet_steering '1'
+	option steering_flows '256'
+
+config device
+	option name 'br-lan'
+	option type 'bridge'
+	list ports 'lan3'
+	list ports 'lan4'
+	list ports 'lan2'
+	option igmp_snooping '1'
+
+config interface 'lan'
+	option device 'br-lan'
+	option proto 'static'
+	option ip6assign '60'
+	list ipaddr '192.168.88.2/24'
+	list ipaddr '192.168.1.2/24'
+	list dns '192.168.88.1'
+	option gateway '192.168.88.1'
+
+config interface 'wan'
+	option device 'wan'
+	option proto 'dhcp'
+	option auto '0'
+
+config interface 'wan6'
+	option device 'wan'
+	option proto 'dhcpv6'
+	option auto '0'
+	option reqaddress 'try'
+	option reqprefix 'auto'
+	option norelease '1'
diff --git a/settings-configs/w1700k-dumb-ap/openssl b/settings-configs/w1700k-dumb-ap/openssl
new file mode 100644
index 0000000000..d146129b85
--- /dev/null
+++ b/settings-configs/w1700k-dumb-ap/openssl
@@ -0,0 +1,3 @@
+
+config provider 'legacy'
+	option enabled '1'
diff --git a/settings-configs/w1700k-dumb-ap/system b/settings-configs/w1700k-dumb-ap/system
new file mode 100644
index 0000000000..9fd823a287
--- /dev/null
+++ b/settings-configs/w1700k-dumb-ap/system
@@ -0,0 +1,45 @@
+
+config system
+	option hostname 'W1700K'
+	option timezone 'CET-1CEST,M3.5.0,M10.5.0/3'
+	option zonename 'Europe/Warsaw'
+	option ttylogin '0'
+	option log_size '128'
+	option urandom_seed '0'
+
+config timeserver 'ntp'
+	option enabled '1'
+	option enable_server '0'
+	list server '194.177.4.1'
+	list server '213.222.217.11'
+	list server '80.50.102.114'
+	list server '193.219.28.60'
+
+config led 'led_lan3_yellow'
+	option name 'lan3'
+	option sysfs 'yellow:lan-3'
+	option trigger 'netdev'
+	option mode 'link_10 link_100'
+	option dev 'lan3'
+
+config led 'led_lan3_green'
+	option name 'lan3'
+	option sysfs 'green:lan-3'
+	option trigger 'netdev'
+	option mode 'link_1000 tx rx'
+	option dev 'lan3'
+
+config led 'led_lan4_yellow'
+	option name 'lan4'
+	option sysfs 'yellow:lan-4'
+	option trigger 'netdev'
+	option mode 'link_10 link_100'
+	option dev 'lan4'
+
+config led 'led_lan4_green'
+	option name 'lan4'
+	option sysfs 'green:lan-4'
+	option trigger 'netdev'
+	option mode 'link_1000 tx rx'
+	option dev 'lan4'
+
diff --git a/settings-configs/w1700k-dumb-ap/ubihealthd b/settings-configs/w1700k-dumb-ap/ubihealthd
new file mode 100644
index 0000000000..230b27a0ed
--- /dev/null
+++ b/settings-configs/w1700k-dumb-ap/ubihealthd
@@ -0,0 +1,5 @@
+
+config ubi-device 'ubi0'
+	option device '/dev/ubi0'
+	option enable '1'
+
diff --git a/settings-configs/w1700k-dumb-ap/ubootenv b/settings-configs/w1700k-dumb-ap/ubootenv
new file mode 100644
index 0000000000..850abfe259
--- /dev/null
+++ b/settings-configs/w1700k-dumb-ap/ubootenv
@@ -0,0 +1,6 @@
+
+config ubootenv
+	option dev '/dev/mtd1'
+	option offset '0x0'
+	option envsize '0x4000'
+
diff --git a/settings-configs/w1700k-dumb-ap/wireless b/settings-configs/w1700k-dumb-ap/wireless
new file mode 100644
index 0000000000..e8febd135e
--- /dev/null
+++ b/settings-configs/w1700k-dumb-ap/wireless
@@ -0,0 +1,62 @@
+
+config wifi-device 'radio0'
+	option type 'mac80211'
+	option path 'soc/1fc00000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
+	option radio '0'
+	option band '2g'
+	option channel '8'
+	option htmode 'EHT20'
+	option txpower '20'
+	option country 'GB'
+	option cell_density '0'
+
+config wifi-iface 'default_radio0'
+	option device 'radio0'
+	option network 'lan'
+	option mode 'ap'
+	option ssid 'Test_2G'
+	option encryption 'psk2+ccmp'
+	option key 'test1234test'
+
+config wifi-device 'radio1'
+	option type 'mac80211'
+	option path 'soc/1fc00000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
+	option radio '1'
+	option band '5g'
+	option channel '100'
+	option htmode 'EHT160'
+	option txpower '20'
+	option country 'GB'
+	option cell_density '0'
+
+config wifi-iface 'default_radio1'
+	option device 'radio1'
+	option network 'lan'
+	option mode 'ap'
+	option ssid 'Test'
+	option encryption 'sae'
+	option key 'test1234test'
+	option ocv '0'
+	option ieee80211w '2'
+
+config wifi-device 'radio2'
+	option type 'mac80211'
+	option path 'soc/1fc00000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
+	option radio '2'
+	option band '6g'
+	option channel '53'
+	option htmode 'EHT320'
+	option txpower '20'
+	option country 'GB'
+	option cell_density '0'
+
+config wifi-iface 'default_radio2'
+	option device 'radio2'
+	option network 'lan'
+	option mode 'ap'
+	option ssid 'Test_6G'
+	option encryption 'sae'
+	option key 'test1234test'
+	option ocv '0'
+	option ieee80211w '2'
+
diff --git a/settings-configs/w1700k-dumb-ap/wireless-mlo b/settings-configs/w1700k-dumb-ap/wireless-mlo
new file mode 100644
index 0000000000..56ae0c52dc
--- /dev/null
+++ b/settings-configs/w1700k-dumb-ap/wireless-mlo
@@ -0,0 +1,46 @@
+
+config wifi-device 'radio0'
+	option type 'mac80211'
+	option path 'soc/1fc00000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
+	option radio '0'
+	option band '2g'
+	option channel '8'
+	option htmode 'EHT20'
+	option txpower '20'
+	option country 'GB'
+	option cell_density '0'
+
+config wifi-device 'radio1'
+	option type 'mac80211'
+	option path 'soc/1fc00000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
+	option radio '1'
+	option band '5g'
+	option channel '100'
+	option htmode 'EHT160'
+	option txpower '25'
+	option country 'GB'
+	option cell_density '0'
+
+config wifi-device 'radio2'
+	option type 'mac80211'
+	option path 'soc/1fc00000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
+	option radio '2'
+	option band '6g'
+	option channel '53'
+	option htmode 'EHT160'
+	option txpower '20'
+	option country 'GB'
+	option cell_density '0'
+
+config wifi-iface 'wifinet0'
+        list device 'radio0'
+        list device 'radio1'
+        list device 'radio2'
+        option mlo '1'
+        option network 'lan'
+        option mode 'ap'
+        option ssid 'Test'
+        option encryption 'sae'
+        option key 'test1234test'
+        option ieee80211w '2'
+        option log_level '1'
diff --git a/wireless-scripts-example/mtk-feed/common.uc b/wireless-scripts-example/mtk-feed/common.uc
new file mode 100644
index 0000000000..ce0d298de7
--- /dev/null
+++ b/wireless-scripts-example/mtk-feed/common.uc
@@ -0,0 +1,462 @@
+import * as nl80211 from "nl80211";
+import * as rtnl from "rtnl";
+import { readfile, glob, basename, readlink, open } from "fs";
+
+const iftypes = {
+	ap: nl80211.const.NL80211_IFTYPE_AP,
+	mesh: nl80211.const.NL80211_IFTYPE_MESH_POINT,
+	sta: nl80211.const.NL80211_IFTYPE_STATION,
+	adhoc: nl80211.const.NL80211_IFTYPE_ADHOC,
+	monitor: nl80211.const.NL80211_IFTYPE_MONITOR,
+};
+
+const mesh_params = {
+	mesh_retry_timeout: "retry_timeout",
+	mesh_confirm_timeout: "confirm_timeout",
+	mesh_holding_timeout: "holding_timeout",
+	mesh_max_peer_links: "max_peer_links",
+	mesh_max_retries: "max_retries",
+	mesh_ttl: "ttl",
+	mesh_element_ttl: "element_ttl",
+	mesh_auto_open_plinks: "auto_open_plinks",
+	mesh_hwmp_max_preq_retries: "hwmp_max_preq_retries",
+	mesh_path_refresh_time: "path_refresh_time",
+	mesh_min_discovery_timeout: "min_discovery_timeout",
+	mesh_hwmp_active_path_timeout: "hwmp_active_path_timeout",
+	mesh_hwmp_preq_min_interval: "hwmp_preq_min_interval",
+	mesh_hwmp_net_diameter_traversal_time: "hwmp_net_diam_trvs_time",
+	mesh_hwmp_rootmode: "hwmp_rootmode",
+	mesh_hwmp_rann_interval: "hwmp_rann_interval",
+	mesh_gate_announcements: "gate_announcements",
+	mesh_sync_offset_max_neighor: "sync_offset_max_neighbor",
+	mesh_rssi_threshold: "rssi_threshold",
+	mesh_hwmp_active_path_to_root_timeout: "hwmp_path_to_root_timeout",
+	mesh_hwmp_root_interval: "hwmp_root_interval",
+	mesh_hwmp_confirmation_interval: "hwmp_confirmation_interval",
+	mesh_awake_window: "awake_window",
+	mesh_plink_timeout: "plink_timeout",
+	mesh_fwding: "forwarding",
+	mesh_power_mode: "power_mode",
+	mesh_nolearn: "nolearn"
+};
+
+function wdev_remove(name)
+{
+	nl80211.request(nl80211.const.NL80211_CMD_DEL_INTERFACE, 0, { dev: name });
+}
+
+function __phy_is_fullmac(phyidx)
+{
+	let data = nl80211.request(nl80211.const.NL80211_CMD_GET_WIPHY, 0, { wiphy: phyidx });
+
+	return !data.software_iftypes.monitor;
+}
+
+function phy_is_fullmac(phy)
+{
+	let phyidx = int(trim(readfile(`/sys/class/ieee80211/${phy}/index`)));
+
+	return __phy_is_fullmac(phyidx);
+}
+
+function find_reusable_wdev(phyidx)
+{
+	if (!__phy_is_fullmac(phyidx))
+		return null;
+
+	let data = nl80211.request(
+		nl80211.const.NL80211_CMD_GET_INTERFACE,
+		nl80211.const.NLM_F_DUMP,
+		{ wiphy: phyidx });
+	for (let res in data)
+		if (trim(readfile(`/sys/class/net/${res.ifname}/operstate`)) == "down")
+			return res.ifname;
+	return null;
+}
+
+function wdev_set_radio_mask(name, mask)
+{
+	nl80211.request(nl80211.const.NL80211_CMD_SET_INTERFACE, 0, {
+		dev: name,
+		vif_radio_mask: mask
+	});
+}
+
+function wdev_create(phy, name, data)
+{
+	let phyidx = int(readfile(`/sys/class/ieee80211/${phy}/index`));
+
+	wdev_remove(name);
+
+	if (!iftypes[data.mode])
+		return `Invalid mode: ${data.mode}`;
+
+	let req = {
+		wiphy: phyidx,
+		ifname: name,
+		iftype: iftypes[data.mode],
+	};
+
+	if (data["4addr"])
+		req["4addr"] = data["4addr"];
+	if (data.macaddr)
+		req.mac = data.macaddr;
+	if (data.radio_mask > 0)
+		req.vif_radio_mask = data.radio_mask;
+	else if (data.radio != null && data.radio >= 0)
+		req.vif_radio_mask = 1 << data.radio;
+	else if (data.mld_radio_mask != null && data.mld_radio_mask > 0)
+		req.vif_radio_mask = data.mld_radio_mask;
+
+	nl80211.error();
+
+	let reuse_ifname = find_reusable_wdev(phyidx);
+	if (reuse_ifname &&
+	    (reuse_ifname == name ||
+	     rtnl.request(rtnl.const.RTM_SETLINK, 0, { dev: reuse_ifname, ifname: name}) != false)) {
+		req.dev = req.ifname;
+		delete req.ifname;
+		nl80211.request(nl80211.const.NL80211_CMD_SET_INTERFACE, 0, req);
+	} else {
+		nl80211.request(
+			nl80211.const.NL80211_CMD_NEW_INTERFACE,
+			nl80211.const.NLM_F_CREATE,
+			req);
+	}
+
+	let error = nl80211.error();
+	if (error)
+		return error;
+
+	if (data.powersave != null) {
+		nl80211.request(nl80211.const.NL80211_CMD_SET_POWER_SAVE, 0,
+			{ dev: name, ps_state: data.powersave ? 1 : 0});
+	}
+
+	return null;
+}
+
+function wdev_set_mesh_params(name, data)
+{
+	let mesh_cfg = {};
+
+	for (let key in mesh_params) {
+		let val = data[key];
+		if (val == null)
+			continue;
+		mesh_cfg[mesh_params[key]] = int(val);
+	}
+
+	if (!length(mesh_cfg))
+		return null;
+
+	nl80211.request(nl80211.const.NL80211_CMD_SET_MESH_CONFIG, 0,
+		{ dev: name, mesh_params: mesh_cfg });
+
+	return nl80211.error();
+}
+
+function wdev_set_up(name, up)
+{
+	rtnl.request(rtnl.const.RTM_SETLINK, 0, { dev: name, change: 1, flags: up ? 1 : 0 });
+}
+
+function phy_sysfs_file(phy, name)
+{
+	return trim(readfile(`/sys/class/ieee80211/${phy}/${name}`));
+}
+
+function macaddr_split(str)
+{
+	return map(split(str, ":"), (val) => hex(val));
+}
+
+function macaddr_join(addr)
+{
+	return join(":", map(addr, (val) => sprintf("%02x", val)));
+}
+
+function wdev_macaddr(wdev)
+{
+	return trim(readfile(`/sys/class/net/${wdev}/address`));
+}
+
+const phy_proto = {
+	macaddr_init: function(used, options) {
+		this.macaddr_options = options ?? {};
+		this.macaddr_list = {};
+		this.mbssid_list = [];
+
+		if (type(used) == "object")
+			for (let addr in used)
+				this.macaddr_list[addr] = used[addr];
+		else
+			for (let addr in used)
+				this.macaddr_list[addr] = -1;
+
+		this.for_each_wdev((wdev) => {
+			let macaddr = wdev_macaddr(wdev);
+			this.macaddr_list[macaddr] ??= -1;
+		});
+
+		return this.macaddr_list;
+	},
+
+	macaddr_generate: function(data) {
+		let phy = this.phy;
+		let radio_idx = this.radio;
+		let idx = int(data.id ?? 0);
+		let mbssid = int(data.mbssid ?? 0) > 0;
+		let num_global = int(data.num_global ?? 1);
+
+		let base_addr = phy_sysfs_file(phy, "macaddress");
+		if (!base_addr)
+			return null;
+
+		let base_mask = phy_sysfs_file(phy, "address_mask");
+		if (!base_mask)
+			return null;
+
+		if (base_mask == "00:00:00:00:00:00")
+			base_mask = "ff:ff:ff:ff:ff:ff";
+
+		if (data.macaddr_base)
+			base_addr = data.macaddr_base;
+		else if (base_mask == "ff:ff:ff:ff:ff:ff" &&
+		    (radio_idx > 0 || idx >= num_global)) {
+			let addrs = split(phy_sysfs_file(phy, "addresses"), "\n");
+
+			if (radio_idx != null) {
+				if (radio_idx && radio_idx < length(addrs))
+					base_addr = addrs[radio_idx];
+				else
+					idx += radio_idx * 32;
+			} else {
+				if (idx < length(addrs))
+					return addrs[idx];
+			}
+		}
+
+		if (!idx && !mbssid)
+			return base_addr;
+
+		let use_global = !mbssid && idx < num_global;
+		let addr = macaddr_split(base_addr);
+		let mask = macaddr_split(base_mask);
+		let type;
+
+		if (use_global)
+			type = "add";
+		else if (mask[0] > 0)
+			type = "b1";
+		else if (mask[5] < 0xff)
+			type = "b5";
+		else
+			type = "add";
+
+		switch (type) {
+		case "b5":
+			if (mbssid)
+				addr[0] |= 2;
+			addr[5] ^= idx;
+			break;
+		case "b1":
+			addr[0] |= 2;
+			addr[0] ^= (radio_idx ?? 0) << 2;
+			// fallthrough
+		default:
+			for (let i = 4; i > 0; i--) {
+				addr[i] += idx;
+				if (addr[i] < 256)
+					break;
+				idx = addr[i] / 256;
+				addr[i] %= 256;
+			}
+			break;
+		}
+
+		return macaddr_join(addr);
+	},
+
+	mbssid_macaddr_generate: function(data) {
+		/* check if we can keep MAC addresses for non-TX BSSes */
+		let base_addr = macaddr_split(this.mbssid_list[0]);
+		let num_bss = 1 << data.mbssid_indicator;
+		let b5 = base_addr[5] % num_bss;
+		let list = this.macaddr_list;
+		let mbssid_list = this.mbssid_list;
+
+		for (let i = 1; i < num_bss; i++) {
+			let addr = [...base_addr];
+			addr[5] = base_addr[5] - b5 + ((b5 + i) % num_bss);
+
+			let addr_str = macaddr_join(addr);
+			if (list[addr_str] != null)
+				return -1;
+
+			list[addr_str] = -1;
+			mbssid_list[i] = addr_str;
+		}
+
+		return 0;
+	},
+
+	set_mbssid_macaddr: function(tx_addr) {
+		let data = this.macaddr_options ?? {};
+
+		this.mbssid_list[0] = tx_addr;
+		return this.mbssid_macaddr_generate(data)
+	},
+
+	macaddr_next: function(val) {
+		let data = this.macaddr_options ?? {};
+		let list = this.macaddr_list;
+
+		if (data.mbssid && val > 0 && val < length(this.mbssid_list))
+			return this.mbssid_list[val];
+
+		for (let i = 0; i < 32; i++) {
+			data.id = i;
+
+			let mac = this.macaddr_generate(data);
+			if (!mac)
+				return null;
+
+			if (list[mac] != null)
+				continue;
+
+			if (data.mbssid && val == 0) {
+				this.mbssid_list[0] = mac;
+				if (this.mbssid_macaddr_generate(data))
+					continue;
+			}
+
+			list[mac] = val != null ? val : -1;
+			return mac;
+		}
+	},
+
+	wdev_add: function(name, data) {
+		let phydev = this;
+		wdev_create(this.phy, name, {
+			...data,
+			radio: this.radio,
+		});
+	},
+
+	for_each_wdev: function(cb) {
+		let wdevs = nl80211.request(
+			nl80211.const.NL80211_CMD_GET_INTERFACE,
+			nl80211.const.NLM_F_DUMP,
+			{ wiphy: this.idx }
+		);
+
+		let mac_wdev = {};
+		for (let wdev in wdevs) {
+			if (wdev.iftype == nl80211.const.NL80211_IFTYPE_AP_VLAN)
+				continue;
+			if (this.radio != null && wdev.vif_radio_mask != null &&
+			    wdev.vif_radio_mask != (1 << this.radio))
+				continue;
+			mac_wdev[wdev.mac] = wdev;
+		}
+
+		for (let wdev in wdevs) {
+			if (!mac_wdev[wdev.mac])
+				continue;
+
+			cb(wdev.ifname);
+		}
+	}
+};
+
+function phy_open(phy, radio)
+{
+	let phyidx = readfile(`/sys/class/ieee80211/${phy}/index`);
+	if (!phyidx)
+		return null;
+
+	let name = phy;
+	if (radio === "" || radio < 0)
+		radio = null;
+	if (radio != null)
+		name += "." + radio;
+
+	return proto({
+		phy, name, radio,
+		idx: int(phyidx),
+	}, phy_proto);
+}
+
+const vlist_proto = {
+	update: function(values, arg) {
+		let data = this.data;
+		let cb = this.cb;
+		let seq = { };
+		let new_data = {};
+		let old_data = {};
+
+		this.data = new_data;
+
+		if (type(values) == "object") {
+			for (let key in values) {
+				old_data[key] = data[key];
+				new_data[key] = values[key];
+				delete data[key];
+			}
+		} else {
+			for (let val in values) {
+				let cur_key = val[0];
+				let cur_obj = val[1];
+
+				old_data[cur_key] = data[cur_key];
+				new_data[cur_key] = val[1];
+				delete data[cur_key];
+			}
+		}
+
+		for (let key in data) {
+			cb(null, data[key], arg);
+			delete data[key];
+		}
+		for (let key in new_data)
+			cb(new_data[key], old_data[key], arg);
+	}
+};
+
+function is_equal(val1, val2) {
+	let t1 = type(val1);
+
+	if (t1 != type(val2))
+		return false;
+
+	if (t1 == "array") {
+		if (length(val1) != length(val2))
+			return false;
+
+		for (let i = 0; i < length(val1); i++)
+			if (!is_equal(val1[i], val2[i]))
+				return false;
+
+		return true;
+	} else if (t1 == "object") {
+		for (let key in val1)
+			if (!is_equal(val1[key], val2[key]))
+				return false;
+		for (let key in val2)
+			if (val1[key] == null)
+				return false;
+		return true;
+	} else {
+		return val1 == val2;
+	}
+}
+
+function vlist_new(cb) {
+	return proto({
+		cb: cb,
+		data: {}
+	}, vlist_proto);
+}
+
+export { wdev_remove, wdev_create, wdev_set_mesh_params, wdev_set_radio_mask, wdev_set_up, is_equal, vlist_new, phy_is_fullmac, phy_open };
diff --git a/wireless-scripts-example/mtk-feed/hostapd.sh b/wireless-scripts-example/mtk-feed/hostapd.sh
new file mode 100644
index 0000000000..b9bb07751e
--- /dev/null
+++ b/wireless-scripts-example/mtk-feed/hostapd.sh
@@ -0,0 +1,1639 @@
+. /lib/functions/network.sh
+. /lib/functions.sh
+
+wpa_supplicant_add_rate() {
+	local var="$1"
+	local val="$(($2 / 1000))"
+	local sub="$((($2 / 100) % 10))"
+	append $var "$val" ","
+	[ $sub -gt 0 ] && append $var "."
+}
+
+hostapd_add_rate() {
+	local var="$1"
+	local val="$(($2 / 100))"
+	append $var "$val" " "
+}
+
+hostapd_append_wep_key() {
+	local var="$1"
+
+	wep_keyidx=0
+	set_default key 1
+	case "$key" in
+		[1234])
+			for idx in 1 2 3 4; do
+				local zidx
+				zidx="$(($idx - 1))"
+				json_get_var ckey "key${idx}"
+				[ -n "$ckey" ] && \
+					append $var "wep_key${zidx}=$(prepare_key_wep "$ckey")" "$N$T"
+			done
+			wep_keyidx="$((key - 1))"
+		;;
+		*)
+			append $var "wep_key0=$(prepare_key_wep "$key")" "$N$T"
+		;;
+	esac
+}
+
+hostapd_append_wpa_key_mgmt() {
+	local auth_type_l="$(echo $auth_type | tr 'a-z' 'A-Z')"
+
+	case "$auth_type" in
+		psk|eap)
+			append wpa_key_mgmt "WPA-$auth_type_l"
+			[ "${wpa:-2}" -ge 2 ] && [ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-${auth_type_l}"
+			[ "${ieee80211w:-0}" -gt 0 ] && append wpa_key_mgmt "WPA-${auth_type_l}-SHA256"
+		;;
+		eap192)
+			append wpa_key_mgmt "WPA-EAP-SUITE-B-192"
+			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-EAP-SHA384"
+		;;
+		eap-eap2)
+			append wpa_key_mgmt "WPA-EAP-SHA256"
+			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-EAP"
+			[ "$rsn_override" -gt 0 ] && rsn_override_key_mgmt="$wpa_key_mgmt"
+			append wpa_key_mgmt "WPA-EAP"
+		;;
+		eap2)
+			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-EAP"
+			append wpa_key_mgmt "WPA-EAP-SHA256"
+		;;
+		sae)
+			append wpa_key_mgmt "SAE"
+			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-SAE"
+		;;
+		psk-sae)
+			append wpa_key_mgmt "SAE"
+			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-SAE"
+			[ "$rsn_override" -gt 0 ] && rsn_override_key_mgmt="$wpa_key_mgmt"
+			[ "$rsn_override" -gt 1 ] && wpa_key_mgmt=
+			[ "$band" = "6g" ] || {
+				append wpa_key_mgmt "WPA-PSK"
+				[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-PSK"
+				[ "${ieee80211w:-0}" -gt 0 ] && append wpa_key_mgmt "WPA-PSK-SHA256"
+			}
+		;;
+		owe)
+			append wpa_key_mgmt "OWE"
+		;;
+	esac
+
+	[ "$fils" -gt 0 ] && {
+		case "$auth_type" in
+			eap192)
+				append wpa_key_mgmt FILS-SHA384
+				[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt FT-FILS-SHA384
+			;;
+			eap*)
+				append wpa_key_mgmt FILS-SHA256
+				[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt FT-FILS-SHA256
+
+				[ "$rsn_override" -gt 0 ] && {
+					append rsn_override_key_mgmt FILS-SHA256
+					[ "${ieee80211r:-0}" -gt 0 ] && append rsn_override_key_mgmt FT-FILS-SHA256
+				}
+			;;
+		esac
+	}
+}
+
+hostapd_add_log_config() {
+	config_add_boolean \
+		log_80211 \
+		log_8021x \
+		log_radius \
+		log_wpa \
+		log_driver \
+		log_iapp \
+		log_mlme
+
+	config_add_int log_level
+}
+
+hostapd_common_add_device_config() {
+	config_add_array basic_rate
+	config_add_array supported_rates
+	config_add_string beacon_rate
+
+	config_add_string country country3
+	config_add_boolean country_ie doth
+	config_add_boolean spectrum_mgmt_required
+	config_add_int local_pwr_constraint
+	config_add_string require_mode
+	config_add_boolean legacy_rates
+	config_add_int cell_density
+	config_add_int rts_threshold
+	config_add_int rssi_reject_assoc_rssi
+	config_add_int rssi_reject_assoc_timeout
+	config_add_int rssi_ignore_probe_request
+	config_add_int maxassoc
+	config_add_int reg_power_type
+	config_add_boolean stationary_ap
+
+	config_add_string acs_chan_bias
+	config_add_array hostapd_options
+
+	config_add_int airtime_mode
+	config_add_int mbssid
+
+	hostapd_add_log_config
+}
+
+hostapd_prepare_device_config() {
+	local config="$1"
+	local driver="$2"
+
+	local base_cfg=
+
+	json_get_vars country country3 country_ie beacon_int:100 doth require_mode legacy_rates \
+		acs_chan_bias local_pwr_constraint spectrum_mgmt_required airtime_mode cell_density \
+		rts_threshold beacon_rate rssi_reject_assoc_rssi rssi_reject_assoc_timeout rssi_ignore_probe_request \
+		maxassoc mbssid:0 band reg_power_type stationary_ap
+
+	hostapd_set_log_options base_cfg
+
+	set_default country_ie 1
+	set_default spectrum_mgmt_required 0
+	set_default doth 1
+	set_default legacy_rates 0
+	set_default airtime_mode 0
+	set_default cell_density 0
+
+	[ -n "$country" ] && {
+		append base_cfg "country_code=$country" "$N"
+		[ -n "$country3" ] && append base_cfg "country3=$country3" "$N"
+
+		[ "$country_ie" -gt 0 ] && {
+			append base_cfg "ieee80211d=1" "$N"
+			[ -n "$local_pwr_constraint" ] && append base_cfg "local_pwr_constraint=$local_pwr_constraint" "$N"
+			[ "$spectrum_mgmt_required" -gt 0 ] && append base_cfg "spectrum_mgmt_required=$spectrum_mgmt_required" "$N"
+		}
+		[ "$hwmode" = "a" -a "$doth" -gt 0 ] && append base_cfg "ieee80211h=1" "$N"
+	}
+
+	[ -n "$acs_chan_bias" ] && append base_cfg "acs_chan_bias=$acs_chan_bias" "$N"
+
+	local brlist= br
+	json_get_values basic_rate_list basic_rate
+	local rlist= r
+	json_get_values rate_list supported_rates
+
+	[ -n "$hwmode" ] && append base_cfg "hw_mode=$hwmode" "$N"
+	if [ "$hwmode" = "g" ] || [ "$hwmode" = "a" ]; then
+		[ -n "$require_mode" ] && legacy_rates=0
+		case "$require_mode" in
+			n) append base_cfg "require_ht=1" "$N";;
+			ac) append base_cfg "require_vht=1" "$N";;
+		esac
+	fi
+	case "$hwmode" in
+		b)
+			if [ "$cell_density" -eq 1 ]; then
+				set_default rate_list "5500 11000"
+				set_default basic_rate_list "5500 11000"
+			elif [ "$cell_density" -ge 2 ]; then
+				set_default rate_list "11000"
+				set_default basic_rate_list "11000"
+			fi
+		;;
+		g)
+			if [ "$cell_density" -eq 0 ] || [ "$cell_density" -eq 1 ]; then
+				if [ "$legacy_rates" -eq 0 ]; then
+					set_default rate_list "6000 9000 12000 18000 24000 36000 48000 54000"
+					set_default basic_rate_list "6000 12000 24000"
+				elif [ "$cell_density" -eq 1 ]; then
+					set_default rate_list "5500 6000 9000 11000 12000 18000 24000 36000 48000 54000"
+					set_default basic_rate_list "5500 11000"
+				fi
+			elif [ "$cell_density" -ge 3 ] && [ "$legacy_rates" -ne 0 ] || [ "$cell_density" -eq 2 ]; then
+				if [ "$legacy_rates" -eq 0 ]; then
+					set_default rate_list "12000 18000 24000 36000 48000 54000"
+					set_default basic_rate_list "12000 24000"
+				else
+					set_default rate_list "11000 12000 18000 24000 36000 48000 54000"
+					set_default basic_rate_list "11000"
+				fi
+			elif [ "$cell_density" -ge 3 ]; then
+				set_default rate_list "24000 36000 48000 54000"
+				set_default basic_rate_list "24000"
+			fi
+		;;
+		a)
+			if [ "$cell_density" -eq 1 ]; then
+				set_default rate_list "6000 9000 12000 18000 24000 36000 48000 54000"
+				set_default basic_rate_list "6000 12000 24000"
+			elif [ "$cell_density" -eq 2 ]; then
+				set_default rate_list "12000 18000 24000 36000 48000 54000"
+				set_default basic_rate_list "12000 24000"
+			elif [ "$cell_density" -ge 3 ]; then
+				set_default rate_list "24000 36000 48000 54000"
+				set_default basic_rate_list "24000"
+			fi
+		;;
+	esac
+
+	for r in $rate_list; do
+		hostapd_add_rate rlist "$r"
+	done
+
+	for br in $basic_rate_list; do
+		hostapd_add_rate brlist "$br"
+	done
+
+	[ -n "$rssi_reject_assoc_rssi" ] && append base_cfg "rssi_reject_assoc_rssi=$rssi_reject_assoc_rssi" "$N"
+	[ -n "$rssi_reject_assoc_timeout" ] && append base_cfg "rssi_reject_assoc_timeout=$rssi_reject_assoc_timeout" "$N"
+	[ -n "$rssi_ignore_probe_request" ] && append base_cfg "rssi_ignore_probe_request=$rssi_ignore_probe_request" "$N"
+	[ -n "$beacon_rate" ] && append base_cfg "beacon_rate=$beacon_rate" "$N"
+	[ -n "$rlist" ] && append base_cfg "supported_rates=$rlist" "$N"
+	[ -n "$brlist" ] && append base_cfg "basic_rates=$brlist" "$N"
+	append base_cfg "beacon_int=$beacon_int" "$N"
+	[ -n "$rts_threshold" ] && append base_cfg "rts_threshold=$rts_threshold" "$N"
+	[ "$airtime_mode" -gt 0 ] && append base_cfg "airtime_mode=$airtime_mode" "$N"
+	[ -n "$maxassoc" ] && append base_cfg "iface_max_num_sta=$maxassoc" "$N"
+	[ "$mbssid" -gt 0 ] && [ "$mbssid" -le 2 ] && append base_cfg "mbssid=$mbssid" "$N"
+
+	[ "$band" = "6g" ] && {
+		set_default reg_power_type 0
+		append base_cfg "he_6ghz_reg_pwr_type=$reg_power_type" "$N"
+	}
+
+	set_default stationary_ap 1
+	append base_cfg "stationary_ap=$stationary_ap" "$N"
+
+	json_get_values opts hostapd_options
+	for val in $opts; do
+		append base_cfg "$val" "$N"
+	done
+
+	cat > "$config" <<EOF
+driver=$driver
+$base_cfg
+EOF
+}
+
+hostapd_common_add_bss_config() {
+	config_add_string 'bssid:macaddr' 'ssid:string'
+	config_add_boolean wds uapsd hidden utf8_ssid ppsk
+
+	config_add_int maxassoc max_inactivity
+	config_add_boolean disassoc_low_ack isolate short_preamble skip_inactivity_poll
+
+	config_add_int \
+		wep_rekey eap_reauth_period \
+		wpa_group_rekey wpa_pair_rekey wpa_master_rekey
+	config_add_boolean wpa_strict_rekey
+	config_add_boolean wpa_disable_eapol_key_retries
+
+	config_add_boolean tdls_prohibit
+
+	config_add_boolean rsn_preauth auth_cache
+	config_add_int ieee80211w
+	config_add_int eapol_version
+
+	config_add_array auth_server acct_server
+	config_add_string 'server:host'
+	config_add_string auth_secret key
+	config_add_int 'auth_port:port' 'port:port'
+
+	config_add_string acct_secret
+	config_add_int acct_port
+	config_add_int acct_interval
+
+	config_add_int bss_load_update_period chan_util_avg_period
+
+	config_add_string dae_client
+	config_add_string dae_secret
+	config_add_int dae_port
+
+	config_add_string nasid
+	config_add_string ownip
+	config_add_string radius_client_addr
+	config_add_string iapp_interface
+	config_add_string eap_type ca_cert client_cert identity anonymous_identity auth priv_key priv_key_pwd
+	config_add_boolean ca_cert_usesystem ca_cert2_usesystem
+	config_add_string subject_match subject_match2
+	config_add_array altsubject_match altsubject_match2
+	config_add_array domain_match domain_match2 domain_suffix_match domain_suffix_match2
+	config_add_string ieee80211w_mgmt_cipher
+
+	config_add_int dynamic_vlan vlan_naming vlan_no_bridge
+	config_add_string vlan_tagged_interface vlan_bridge
+	config_add_string vlan_file
+
+	config_add_string 'key1:wepkey' 'key2:wepkey' 'key3:wepkey' 'key4:wepkey' 'password:wpakey'
+
+	config_add_string wpa_psk_file sae_password_file
+
+	config_add_int multi_ap
+
+	config_add_boolean wps_pushbutton wps_label ext_registrar wps_pbc_in_m1
+	config_add_int wps_ap_setup_locked wps_independent
+	config_add_string wps_device_type wps_device_name wps_manufacturer wps_pin
+	config_add_string multi_ap_backhaul_ssid multi_ap_backhaul_key
+
+	config_add_boolean wnm_sleep_mode wnm_sleep_mode_no_keys bss_transition mbo
+	config_add_int time_advertisement
+	config_add_string time_zone
+	config_add_string vendor_elements
+
+	config_add_boolean ieee80211k rrm_neighbor_report rrm_beacon_report
+
+	config_add_boolean ftm_responder stationary_ap
+	config_add_string lci civic
+
+	config_add_boolean ieee80211r pmk_r1_push ft_psk_generate_local ft_over_ds
+	config_add_int r0_key_lifetime reassociation_deadline
+	config_add_string mobility_domain r1_key_holder rxkh_file
+	config_add_array r0kh r1kh
+
+	config_add_int ieee80211w_max_timeout ieee80211w_retry_timeout
+	config_add_int rsn_override
+
+	config_add_string macfilter 'macfile:file'
+	config_add_array 'maclist:list(macaddr)'
+
+	config_add_array bssid_blacklist
+	config_add_array bssid_whitelist
+
+	config_add_int mcast_rate
+	config_add_array basic_rate
+	config_add_array supported_rates
+
+	config_add_boolean sae_require_mfp
+	config_add_int sae_pwe sae_track_password
+
+	config_add_string 'owe_transition_bssid:macaddr' 'owe_transition_ssid:string'
+	config_add_string owe_transition_ifname
+
+	config_add_boolean iw_enabled iw_internet iw_asra iw_esr iw_uesa
+	config_add_int iw_access_network_type iw_venue_group iw_venue_type
+	config_add_int iw_ipaddr_type_availability iw_gas_address3
+	config_add_string iw_hessid iw_network_auth_type iw_qos_map_set
+	config_add_array iw_roaming_consortium iw_domain_name iw_anqp_3gpp_cell_net iw_nai_realm
+	config_add_array iw_anqp_elem iw_venue_name iw_venue_url
+
+	config_add_boolean hs20 disable_dgaf
+	config_add_int anqp_domain_id
+	config_add_int hs20_deauth_req_timeout
+	config_add_array hs20_conn_capab
+	config_add_string hs20_wan_metrics hs20_operating_class hs20_t_c_filename hs20_t_c_timestamp
+
+	config_add_string hs20_t_c_server_url
+
+	config_add_array airtime_sta_weight
+	config_add_int airtime_bss_weight airtime_bss_limit
+
+	config_add_boolean multicast_to_unicast multicast_to_unicast_all proxy_arp per_sta_vif na_mcast_to_ucast
+
+	config_add_array hostapd_bss_options
+	config_add_boolean default_disabled
+
+	config_add_boolean request_cui
+	config_add_array radius_auth_req_attr
+	config_add_array radius_acct_req_attr
+
+	config_add_int eap_server radius_server_auth_port
+	config_add_string eap_user_file ca_cert server_cert private_key private_key_passwd server_id radius_server_clients
+
+	config_add_boolean fils
+	config_add_string fils_dhcp
+
+	config_add_int ocv
+
+	config_add_boolean apup
+	config_add_string apup_peer_ifname_prefix
+}
+
+hostapd_set_vlan_file() {
+	local ifname="$1"
+	local vlan="$2"
+	json_get_vars name vid
+	echo "${vid} ${ifname}-${name}" >> /var/run/hostapd-${ifname}.vlan
+	wireless_add_vlan "${vlan}" "${ifname}-${name}"
+}
+
+hostapd_set_vlan() {
+	local ifname="$1"
+
+	rm -f /var/run/hostapd-${ifname}.vlan
+	for_each_vlan hostapd_set_vlan_file ${ifname}
+}
+
+hostapd_set_psk_file() {
+	local ifname="$1"
+	local vlan="$2"
+	local vlan_id=""
+
+	json_get_vars mac vid key
+	set_default mac "00:00:00:00:00:00"
+	[ -n "$vid" ] && vlan_id="vlanid=$vid "
+	echo "${vlan_id} ${mac} ${key}" >> /var/run/hostapd-${ifname}.psk
+}
+
+hostapd_set_psk() {
+	local ifname="$1"
+
+	rm -f /var/run/hostapd-${ifname}.psk
+	case "$auth_type" in
+		psk|psk-sae) ;;
+		*) return ;;
+	esac
+	for_each_station hostapd_set_psk_file ${ifname}
+}
+
+hostapd_set_sae_file() {
+	local ifname="$1"
+	local vlan="$2"
+	local vlan_id=""
+
+	json_get_vars mac vid key
+	set_default mac "ff:ff:ff:ff:ff:ff"
+	[ -n "$mac" ] && mac="|mac=$mac"
+	[ -n "$vid" ] && vlan_id="|vlanid=$vid"
+	printf '%s%s%s\n' "${key}" "${mac}" "${vlan_id}" >> /var/run/hostapd-${ifname}.sae
+}
+
+hostapd_set_sae() {
+	local ifname="$1"
+
+	rm -f /var/run/hostapd-${ifname}.sae
+	case "$auth_type" in
+		sae|psk-sae) ;;
+		*) return ;;
+	esac
+	for_each_station hostapd_set_sae_file ${ifname}
+}
+
+append_iw_roaming_consortium() {
+	[ -n "$1" ] && append bss_conf "roaming_consortium=$1" "$N"
+}
+
+append_iw_domain_name() {
+	if [ -z "$iw_domain_name_conf" ]; then
+		iw_domain_name_conf="$1"
+	else
+		iw_domain_name_conf="$iw_domain_name_conf,$1"
+	fi
+}
+
+append_iw_anqp_3gpp_cell_net() {
+	if [ -z "$iw_anqp_3gpp_cell_net_conf" ]; then
+		iw_anqp_3gpp_cell_net_conf="$1"
+	else
+		iw_anqp_3gpp_cell_net_conf="$iw_anqp_3gpp_cell_net_conf;$1"
+	fi
+}
+
+append_iw_anqp_elem() {
+	[ -n "$1" ] && append bss_conf "anqp_elem=$1" "$N"
+}
+
+append_iw_nai_realm() {
+	[ -n "$1" ] && append bss_conf "nai_realm=$1" "$N"
+}
+
+append_iw_venue_name() {
+	append bss_conf "venue_name=$1" "$N"
+}
+
+append_iw_venue_url() {
+	append bss_conf "venue_url=$1" "$N"
+}
+
+append_hs20_conn_capab() {
+	[ -n "$1" ] && append bss_conf "hs20_conn_capab=$1" "$N"
+}
+
+append_radius_acct_req_attr() {
+	[ -n "$1" ] && append bss_conf "radius_acct_req_attr=$1" "$N"
+}
+
+append_radius_auth_req_attr() {
+	[ -n "$1" ] && append bss_conf "radius_auth_req_attr=$1" "$N"
+}
+
+append_airtime_sta_weight() {
+	[ -n "$1" ] && append bss_conf "airtime_sta_weight=$1" "$N"
+}
+
+append_auth_server() {
+	[ -n "$1" ] || return
+	append bss_conf "auth_server_addr=$1" "$N"
+	append bss_conf "auth_server_port=$auth_port" "$N"
+	[ -n "$auth_secret" ] && append bss_conf "auth_server_shared_secret=$auth_secret" "$N"
+}
+
+append_acct_server() {
+	[ -n "$1" ] || return
+	append bss_conf "acct_server_addr=$1" "$N"
+	append bss_conf "acct_server_port=$acct_port" "$N"
+	[ -n "$acct_secret" ] && append bss_conf "acct_server_shared_secret=$acct_secret" "$N"
+}
+
+hostapd_set_bss_options() {
+	local var="$1"
+	local phy="$2"
+	local vif="$3"
+
+	wireless_vif_parse_encryption
+
+	local bss_conf bss_md5sum ft_key rxkhs
+	local wep_rekey wpa_group_rekey wpa_pair_rekey wpa_master_rekey wpa_key_mgmt
+
+	json_get_vars \
+		wep_rekey wpa_group_rekey wpa_pair_rekey wpa_master_rekey wpa_strict_rekey \
+		wpa_disable_eapol_key_retries tdls_prohibit \
+		maxassoc max_inactivity disassoc_low_ack isolate auth_cache \
+		wps_pushbutton wps_label ext_registrar wps_pbc_in_m1 wps_ap_setup_locked \
+		wps_independent wps_device_type wps_device_name wps_manufacturer wps_pin \
+		macfilter ssid utf8_ssid uapsd hidden short_preamble rsn_preauth \
+		iapp_interface eapol_version dynamic_vlan ieee80211w nasid \
+		acct_secret acct_port acct_interval \
+		bss_load_update_period chan_util_avg_period sae_require_mfp sae_pwe sae_track_password \
+		multi_ap multi_ap_backhaul_ssid multi_ap_backhaul_key skip_inactivity_poll \
+		ppsk airtime_bss_weight airtime_bss_limit airtime_sta_weight \
+		multicast_to_unicast_all proxy_arp per_sta_vif na_mcast_to_ucast \
+		eap_server eap_user_file ca_cert server_cert private_key private_key_passwd server_id radius_server_clients radius_server_auth_port \
+		vendor_elements fils ocv apup rsn_override
+
+	set_default rsn_override 1
+	set_default fils 0
+	set_default isolate 0
+	set_default maxassoc 0
+	set_default max_inactivity 0
+	set_default short_preamble 1
+	set_default disassoc_low_ack 1
+	set_default skip_inactivity_poll 0
+	set_default hidden 0
+	set_default uapsd 1
+	set_default wpa_disable_eapol_key_retries 0
+	set_default tdls_prohibit 0
+	set_default eapol_version $((wpa & 1))
+	set_default acct_port 1813
+	set_default bss_load_update_period 60
+	set_default chan_util_avg_period 600
+	set_default utf8_ssid 1
+	set_default multi_ap 0
+	set_default ppsk 0
+	set_default airtime_bss_weight 0
+	set_default airtime_bss_limit 0
+	set_default eap_server 0
+	set_default apup 0
+
+	/usr/sbin/hostapd -vfils || fils=0
+
+	append bss_conf "ctrl_interface=/var/run/hostapd"
+	if [ "$isolate" -gt 0 ]; then
+		append bss_conf "ap_isolate=$isolate" "$N"
+	fi
+	if [ "$maxassoc" -gt 0 ]; then
+		append bss_conf "max_num_sta=$maxassoc" "$N"
+	fi
+	if [ "$max_inactivity" -gt 0 ]; then
+		append bss_conf "ap_max_inactivity=$max_inactivity" "$N"
+	fi
+
+	[ "$airtime_bss_weight" -gt 0 ] && append bss_conf "airtime_bss_weight=$airtime_bss_weight" "$N"
+	[ "$airtime_bss_limit" -gt 0 ] && append bss_conf "airtime_bss_limit=$airtime_bss_limit" "$N"
+	json_for_each_item append_airtime_sta_weight airtime_sta_weight
+
+	append bss_conf "bss_load_update_period=$bss_load_update_period" "$N"
+	append bss_conf "chan_util_avg_period=$chan_util_avg_period" "$N"
+	append bss_conf "disassoc_low_ack=$disassoc_low_ack" "$N"
+	append bss_conf "skip_inactivity_poll=$skip_inactivity_poll" "$N"
+	append bss_conf "preamble=$short_preamble" "$N"
+	append bss_conf "wmm_enabled=1" "$N"
+	append bss_conf "ignore_broadcast_ssid=$hidden" "$N"
+	append bss_conf "uapsd_advertisement_enabled=$uapsd" "$N"
+	append bss_conf "utf8_ssid=$utf8_ssid" "$N"
+	append bss_conf "multi_ap=$multi_ap" "$N"
+	[ -n "$vendor_elements" ] && append bss_conf "vendor_elements=$vendor_elements" "$N"
+
+	[ "$tdls_prohibit" -gt 0 ] && append bss_conf "tdls_prohibit=$tdls_prohibit" "$N"
+
+	[ "$wpa" -gt 0 ] && {
+		[ -n "$wpa_group_rekey"  ] && append bss_conf "wpa_group_rekey=$wpa_group_rekey" "$N"
+		[ -n "$wpa_pair_rekey"   ] && append bss_conf "wpa_ptk_rekey=$wpa_pair_rekey"    "$N"
+		[ -n "$wpa_master_rekey" ] && append bss_conf "wpa_gmk_rekey=$wpa_master_rekey"  "$N"
+		[ -n "$wpa_strict_rekey" ] && append bss_conf "wpa_strict_rekey=$wpa_strict_rekey" "$N"
+	}
+
+	[ -n "$nasid" ] && append bss_conf "nas_identifier=$nasid" "$N"
+
+	[ -n "$acct_interval" ] && \
+		append bss_conf "radius_acct_interim_interval=$acct_interval" "$N"
+	json_for_each_item append_acct_server acct_server
+	json_for_each_item append_radius_acct_req_attr radius_acct_req_attr
+
+	[ -n "$ocv" ] && append bss_conf "ocv=$ocv" "$N"
+
+	case "$auth_type" in
+		sae|owe|eap2|eap192)
+			set_default ieee80211w 2
+			set_default sae_require_mfp 1
+			[ "$ppsk" -eq 0 ] && set_default sae_pwe 2
+		;;
+		psk-sae|eap-eap2)
+			if [ "$band" = 6g ]; then
+				set_default ieee80211w 2
+			else
+				set_default ieee80211w 1
+			fi
+			set_default sae_require_mfp 1
+			[ "$ppsk" -eq 0 ] && set_default sae_pwe 2
+		;;
+	esac
+	[ -n "$sae_require_mfp" ] && append bss_conf "sae_require_mfp=$sae_require_mfp" "$N"
+	[ -n "$sae_pwe" ] && append bss_conf "sae_pwe=$sae_pwe" "$N"
+	[ -n "$sae_track_password" ] && append bss_conf "sae_track_password=$sae_track_password" "$N"
+
+	local vlan_possible=""
+
+	case "$auth_type" in
+		none|owe)
+			json_get_vars owe_transition_bssid owe_transition_ssid owe_transition_ifname
+
+			[ -n "$owe_transition_ssid" ] && append bss_conf "owe_transition_ssid=\"$owe_transition_ssid\"" "$N"
+			[ -n "$owe_transition_bssid" ] && append bss_conf "owe_transition_bssid=$owe_transition_bssid" "$N"
+			[ -n "$owe_transition_ifname" ] && append bss_conf "owe_transition_ifname=$owe_transition_ifname" "$N"
+
+			wps_possible=1
+			# Here we make the assumption that if we're in open mode
+			# with WPS enabled, we got to be in unconfigured state.
+			wps_not_configured=1
+		;;
+		psk|sae|psk-sae)
+			json_get_vars key wpa_psk_file sae_password_file
+			if [ "$ppsk" -ne 0 ]; then
+				json_get_vars auth_secret auth_port
+				set_default auth_port 1812
+				json_for_each_item append_auth_server auth_server
+				append bss_conf "macaddr_acl=2" "$N"
+				append bss_conf "wpa_psk_radius=2" "$N"
+			elif [ ${#key} -eq 64 ]; then
+				append bss_conf "wpa_psk=$key" "$N"
+			elif [ ${#key} -ge 8 ] && [ ${#key} -le 63 ]; then
+				append bss_conf "wpa_passphrase=$key" "$N"
+			elif [ -n "$key" ]; then
+				wireless_setup_vif_failed INVALID_WPA_PSK
+				return 1
+			fi
+			[ -z "$wpa_psk_file" ] && set_default wpa_psk_file /var/run/hostapd-$ifname.psk
+			[ -n "$wpa_psk_file" ] && [ "$auth_type" = "psk" -o "$auth_type" = "psk-sae" ] && {
+				[ -e "$wpa_psk_file" ] || touch "$wpa_psk_file"
+				append bss_conf "wpa_psk_file=$wpa_psk_file" "$N"
+			}
+			[ -z "$sae_password_file" ] && set_default sae_password_file /var/run/hostapd-$ifname.sae
+			[ -n "$sae_password_file" ] && [ "$auth_type" = "sae" -o "$auth_type" = "psk-sae" ] && {
+				[ -e "$sae_password_file" ] || touch "$sae_password_file"
+				append bss_conf "sae_password_file=$sae_password_file" "$N"
+			}
+			[ "$eapol_version" -ge "1" -a "$eapol_version" -le "2" ] && append bss_conf "eapol_version=$eapol_version" "$N"
+
+			set_default dynamic_vlan 0
+			vlan_possible=1
+			wps_possible=1
+		;;
+		eap|eap2|eap-eap2|eap192)
+			json_get_vars \
+				auth_server auth_secret auth_port \
+				dae_client dae_secret dae_port \
+				dynamic_ownip ownip radius_client_addr \
+				eap_reauth_period request_cui \
+				erp_domain mobility_domain \
+				fils_realm fils_dhcp
+
+			# radius can provide VLAN ID for clients
+			vlan_possible=1
+
+			set_default dynamic_ownip 1
+
+			# legacy compatibility
+			[ -n "$auth_server" ] || json_get_var auth_server server
+			[ -n "$auth_port" ] || json_get_var auth_port port
+			[ -n "$auth_secret" ] || json_get_var auth_secret key
+
+			[ "$fils" -gt 0 ] && {
+				set_default erp_domain "$mobility_domain"
+				set_default erp_domain "$(echo "$ssid" | md5sum | head -c 8)"
+				set_default fils_realm "$erp_domain"
+
+				append bss_conf "erp_send_reauth_start=1" "$N"
+				append bss_conf "erp_domain=$erp_domain" "$N"
+				append bss_conf "fils_realm=$fils_realm" "$N"
+				append bss_conf "fils_cache_id=$(echo "$fils_realm" | md5sum | head -c 4)" "$N"
+
+				[ "$fils_dhcp" = "*" ] && {
+					json_get_values network network
+					fils_dhcp=
+					for net in $network; do
+						fils_dhcp="$(ifstatus "$net" | jsonfilter -e '@.data.dhcpserver')"
+						[ -n "$fils_dhcp" ] && break
+					done
+
+					[ -z "$fils_dhcp" -a -n "$network_bridge" -a -n "$network_ifname" ] && \
+						fils_dhcp="$(udhcpc -B -n -q -s /lib/netifd/dhcp-get-server.sh -t 1 -i "$network_ifname" 2>/dev/null)"
+				}
+				[ -n "$fils_dhcp" ] && append bss_conf "dhcp_server=$fils_dhcp" "$N"
+			}
+
+			set_default auth_port 1812
+			set_default dae_port 3799
+			set_default request_cui 0
+
+			[ "$eap_server" -eq 0 ] && json_for_each_item append_auth_server auth_server
+			[ "$request_cui" -gt 0 ] && append bss_conf "radius_request_cui=$request_cui" "$N"
+			[ -n "$eap_reauth_period" ] && append bss_conf "eap_reauth_period=$eap_reauth_period" "$N"
+
+			[ -n "$dae_client" -a -n "$dae_secret" ] && {
+				append bss_conf "radius_das_port=$dae_port" "$N"
+				append bss_conf "radius_das_client=$dae_client $dae_secret" "$N"
+			}
+			json_for_each_item append_radius_auth_req_attr radius_auth_req_attr
+
+			if [ -n "$ownip" ]; then
+				append bss_conf "own_ip_addr=$ownip" "$N"
+			elif [ "$dynamic_ownip" -gt 0 ]; then
+				append bss_conf "dynamic_own_ip_addr=$dynamic_ownip" "$N"
+			fi
+
+			[ -n "$radius_client_addr" ] && append bss_conf "radius_client_addr=$radius_client_addr" "$N"
+			append bss_conf "eapol_key_index_workaround=1" "$N"
+			append bss_conf "ieee8021x=1" "$N"
+
+			[ "$eapol_version" -ge "1" -a "$eapol_version" -le "2" ] && append bss_conf "eapol_version=$eapol_version" "$N"
+		;;
+		wep)
+			local wep_keyidx=0
+			json_get_vars key
+			hostapd_append_wep_key bss_conf
+			append bss_conf "wep_default_key=$wep_keyidx" "$N"
+			[ -n "$wep_rekey" ] && append bss_conf "wep_rekey_period=$wep_rekey" "$N"
+		;;
+	esac
+
+	case "$auth_type" in
+		none|owe|psk|sae|psk-sae|wep)
+			json_get_vars \
+			auth_server auth_port auth_secret \
+			ownip radius_client_addr
+
+			[ -n "$auth_server" ] &&  {
+				set_default auth_port 1812
+
+				json_for_each_item append_auth_server auth_server
+				[ -n "$ownip" ] && append bss_conf "own_ip_addr=$ownip" "$N"
+				[ -n "$radius_client_addr" ] && append bss_conf "radius_client_addr=$radius_client_addr" "$N"
+				append bss_conf "macaddr_acl=2" "$N"
+			}
+		;;
+	esac
+
+	local auth_algs="$((($auth_mode_shared << 1) | $auth_mode_open))"
+	append bss_conf "auth_algs=${auth_algs:-1}" "$N"
+	append bss_conf "wpa=$wpa" "$N"
+	[ -n "$wpa_pairwise" ] && append bss_conf "wpa_pairwise=$wpa_pairwise" "$N"
+
+	set_default wps_pushbutton 0
+	set_default wps_label 0
+	set_default wps_pbc_in_m1 0
+
+	config_methods=
+	[ "$wps_pushbutton" -gt 0 ] && append config_methods push_button
+	[ "$wps_label" -gt 0 ] && append config_methods label
+
+	# WPS not possible on Multi-AP backhaul-only SSID
+	[ "$multi_ap" = 1 ] && wps_possible=
+
+	[ -n "$wps_possible" -a -n "$config_methods" ] && {
+		set_default ext_registrar 0
+		set_default wps_device_type "6-0050F204-1"
+		set_default wps_device_name "OpenWrt AP"
+		set_default wps_manufacturer "www.openwrt.org"
+		set_default wps_independent 1
+
+		wps_state=2
+		[ -n "$wps_not_configured" ] && wps_state=1
+
+		[ "$ext_registrar" -gt 0 -a -n "$network_bridge" ] && append bss_conf "upnp_iface=$network_bridge" "$N"
+
+		append bss_conf "eap_server=1" "$N"
+		[ -n "$wps_pin" ] && append bss_conf "ap_pin=$wps_pin" "$N"
+		append bss_conf "wps_state=$wps_state" "$N"
+		append bss_conf "device_type=$wps_device_type" "$N"
+		append bss_conf "device_name=$wps_device_name" "$N"
+		append bss_conf "manufacturer=$wps_manufacturer" "$N"
+		append bss_conf "config_methods=$config_methods" "$N"
+		append bss_conf "wps_independent=$wps_independent" "$N"
+		[ -n "$wps_ap_setup_locked" ] && append bss_conf "ap_setup_locked=$wps_ap_setup_locked" "$N"
+		[ "$wps_pbc_in_m1" -gt 0 ] && append bss_conf "pbc_in_m1=$wps_pbc_in_m1" "$N"
+		[ "$multi_ap" -gt 0 ] && [ -n "$multi_ap_backhaul_ssid" ] && {
+			append bss_conf "multi_ap_backhaul_ssid=\"$multi_ap_backhaul_ssid\"" "$N"
+			if [ -z "$multi_ap_backhaul_key" ]; then
+				:
+			elif [ ${#multi_ap_backhaul_key} -lt 8 ]; then
+				wireless_setup_vif_failed INVALID_WPA_PSK
+				return 1
+			elif [ ${#multi_ap_backhaul_key} -eq 64 ]; then
+				append bss_conf "multi_ap_backhaul_wpa_psk=$multi_ap_backhaul_key" "$N"
+			else
+				append bss_conf "multi_ap_backhaul_wpa_passphrase=$multi_ap_backhaul_key" "$N"
+			fi
+		}
+	}
+
+	append bss_conf "ssid=$ssid" "$N"
+	[ -n "$network_bridge" ] && append bss_conf "bridge=$network_bridge${N}wds_bridge=" "$N"
+	[ -n "$network_ifname" ] && append bss_conf "snoop_iface=$network_ifname" "$N"
+	[ -n "$iapp_interface" ] && {
+		local ifname
+		network_get_device ifname "$iapp_interface" || ifname="$iapp_interface"
+		append bss_conf "iapp_interface=$ifname" "$N"
+	}
+
+	json_get_vars time_advertisement time_zone wnm_sleep_mode wnm_sleep_mode_no_keys bss_transition mbo
+	set_default bss_transition 0
+	set_default wnm_sleep_mode 0
+	set_default wnm_sleep_mode_no_keys 0
+	set_default mbo 0
+
+	[ -n "$time_advertisement" ] && append bss_conf "time_advertisement=$time_advertisement" "$N"
+	[ -n "$time_zone" ] && append bss_conf "time_zone=$time_zone" "$N"
+	if [ "$wnm_sleep_mode" -eq "1" ]; then
+		append bss_conf "wnm_sleep_mode=1" "$N"
+		[ "$wnm_sleep_mode_no_keys" -eq "1" ] && append bss_conf "wnm_sleep_mode_no_keys=1" "$N"
+	fi
+	[ "$bss_transition" -eq "1" ] && append bss_conf "bss_transition=1" "$N"
+	[ "$mbo" -eq 1 ] && append bss_conf "mbo=1" "$N"
+
+	json_get_vars ieee80211k rrm_neighbor_report rrm_beacon_report rnr
+	set_default ieee80211k 0
+	set_default rnr 0
+	if [ "$ieee80211k" -eq "1" ]; then
+		set_default rrm_neighbor_report 1
+		set_default rrm_beacon_report 1
+	else
+		set_default rrm_neighbor_report 0
+		set_default rrm_beacon_report 0
+	fi
+
+	[ "$rrm_neighbor_report" -eq "1" ] && append bss_conf "rrm_neighbor_report=1" "$N"
+	[ "$rrm_beacon_report" -eq "1" ] && append bss_conf "rrm_beacon_report=1" "$N"
+	[ "$rnr" -eq "1" ] && append bss_conf "rnr=1" "$N"
+
+	json_get_vars ftm_responder stationary_ap lci civic
+	set_default ftm_responder 0
+	if [ "$ftm_responder" -eq "1" ]; then
+		set_default stationary_ap 0
+		iw phy "$phy" info | grep -q "ENABLE_FTM_RESPONDER" && {
+			append bss_conf "ftm_responder=1" "$N"
+			[ "$stationary_ap" -eq "1" ] && append bss_conf "stationary_ap=1" "$N"
+			[ -n "$lci" ] && append bss_conf "lci=$lci" "$N"
+			[ -n "$civic" ] && append bss_conf "civic=$civic" "$N"
+		}
+	fi
+
+	json_get_vars ieee80211r
+	set_default ieee80211r 0
+	if [ "$wpa" -ge "1" ]; then
+		if [ "$fils" -gt 0 ]; then
+			json_get_vars fils_realm
+			set_default fils_realm "$(echo "$ssid" | md5sum | head -c 8)"
+		fi
+
+		append bss_conf "wpa_disable_eapol_key_retries=$wpa_disable_eapol_key_retries" "$N"
+
+		hostapd_append_wpa_key_mgmt
+		[ -n "$wpa_key_mgmt" ] && append bss_conf "wpa_key_mgmt=$wpa_key_mgmt" "$N"
+		[ -n "$rsn_override_key_mgmt" -o -n "$rsn_override_pairwise" ] && {
+			append bss_conf "rsn_override_key_mgmt=${rsn_override_key_mgmt:-$wpa_key_mgmt}" "$N"
+			append bss_conf "rsn_override_pairwise=${rsn_override_pairwise:-$wpa_pairwise}" "$N"
+			append bss_conf "rsn_override_mfp=$ieee80211w" "$N"
+		}
+	fi
+
+	if [ "$wpa" -ge "2" ]; then
+		if [ "$ieee80211r" -gt "0" ]; then
+			json_get_vars mobility_domain ft_psk_generate_local ft_over_ds reassociation_deadline
+
+			set_default mobility_domain "$(echo "$ssid" | md5sum | head -c 4)"
+			set_default ft_over_ds 0
+			set_default reassociation_deadline 20000
+
+			case "$auth_type" in
+				psk)
+					set_default ft_psk_generate_local 1
+				;;
+				*)
+					set_default ft_psk_generate_local 0
+				;;
+			esac
+
+			[ -n "$network_ifname" ] && append bss_conf "ft_iface=$network_ifname" "$N"
+			append bss_conf "mobility_domain=$mobility_domain" "$N"
+			append bss_conf "ft_psk_generate_local=$ft_psk_generate_local" "$N"
+			append bss_conf "ft_over_ds=$ft_over_ds" "$N"
+			append bss_conf "reassociation_deadline=$reassociation_deadline" "$N"
+
+			if [ "$ft_psk_generate_local" -eq "0" ]; then
+				json_get_vars r0_key_lifetime r1_key_holder pmk_r1_push rxkh_file
+				json_get_values r0kh r0kh
+				json_get_values r1kh r1kh
+
+				set_default r0_key_lifetime 10000
+				set_default pmk_r1_push 0
+
+				[ -n "$r0kh" -a -n "$r1kh" ] || {
+					if [ -z "$auth_secret" -a -z "$key" ]; then
+						wireless_setup_vif_failed FT_KEY_CANT_BE_DERIVED
+						return 1
+					fi
+					ft_key=`echo -n "$mobility_domain/${auth_secret:-${key}}" | md5sum | awk '{print $1}'`
+
+					set_default r0kh "ff:ff:ff:ff:ff:ff,*,$ft_key"
+					set_default r1kh "00:00:00:00:00:00,00:00:00:00:00:00,$ft_key"
+				}
+
+				[ -n "$r1_key_holder" ] && append bss_conf "r1_key_holder=$r1_key_holder" "$N"
+				append bss_conf "r0_key_lifetime=$r0_key_lifetime" "$N"
+				append bss_conf "pmk_r1_push=$pmk_r1_push" "$N"
+
+				if [ -z "$rxkh_file" ]; then
+					set_default rxkh_file /var/run/hostapd-$ifname.rxkh
+					[ -e "$rxkh_file" ] && rm -f "$rxkh_file"
+					touch "$rxkh_file"
+
+					for kh in $r0kh; do
+						append rxkhs "r0kh=${kh//,/ }" "$N"
+					done
+					for kh in $r1kh; do
+						append rxkhs "r1kh=${kh//,/ }" "$N"
+					done
+					echo "$rxkhs" > "$rxkh_file"
+				fi
+				append bss_conf "rxkh_file=$rxkh_file" "$N"
+			fi
+		fi
+
+		if [ -n "$network_bridge" -a "$rsn_preauth" = 1 ]; then
+			set_default auth_cache 1
+			append bss_conf "rsn_preauth=1" "$N"
+			append bss_conf "rsn_preauth_interfaces=$network_bridge" "$N"
+		else
+			case "$auth_type" in
+			sae|psk-sae|owe)
+				set_default auth_cache 1
+			;;
+			*)
+				set_default auth_cache 0
+			;;
+			esac
+		fi
+
+		append bss_conf "okc=$auth_cache" "$N"
+		[ "$auth_cache" = 0 -a "$fils" = 0 ] && append bss_conf "disable_pmksa_caching=1" "$N"
+
+		# RSN -> allow management frame protection
+		case "$ieee80211w" in
+			[012])
+				json_get_vars ieee80211w_mgmt_cipher ieee80211w_max_timeout ieee80211w_retry_timeout
+				append bss_conf "ieee80211w=$ieee80211w" "$N"
+				[ "$ieee80211w" -gt "0" ] && {
+					if [ "$auth_type" = "eap192" ]; then
+						append bss_conf "group_mgmt_cipher=BIP-GMAC-256" "$N"
+					else
+						append bss_conf "group_mgmt_cipher=${ieee80211w_mgmt_cipher:-AES-128-CMAC}" "$N"
+					fi
+					[ -n "$ieee80211w_max_timeout" ] && \
+						append bss_conf "assoc_sa_query_max_timeout=$ieee80211w_max_timeout" "$N"
+					[ -n "$ieee80211w_retry_timeout" ] && \
+						append bss_conf "assoc_sa_query_retry_timeout=$ieee80211w_retry_timeout" "$N"
+				}
+			;;
+		esac
+	fi
+
+	_macfile="/var/run/hostapd-$ifname.maclist"
+	case "$macfilter" in
+		allow)
+			append bss_conf "macaddr_acl=1" "$N"
+			append bss_conf "accept_mac_file=$_macfile" "$N"
+			# accept_mac_file can be used to set MAC to VLAN ID mapping
+			vlan_possible=1
+		;;
+		deny)
+			append bss_conf "macaddr_acl=0" "$N"
+			append bss_conf "deny_mac_file=$_macfile" "$N"
+		;;
+		*)
+			_macfile=""
+		;;
+	esac
+
+	[ -n "$_macfile" ] && {
+		json_get_vars macfile
+		json_get_values maclist maclist
+
+		rm -f "$_macfile"
+		(
+			for mac in $maclist; do
+				echo "$mac"
+			done
+			[ -n "$macfile" -a -f "$macfile" ] && cat "$macfile"
+		) > "$_macfile"
+	}
+
+	[ -n "$vlan_possible" -a -n "$dynamic_vlan" ] && {
+		json_get_vars vlan_naming vlan_tagged_interface vlan_bridge vlan_file vlan_no_bridge
+		set_default vlan_naming 1
+		[ -z "$vlan_file" ] && set_default vlan_file /var/run/hostapd-$ifname.vlan
+		append bss_conf "dynamic_vlan=$dynamic_vlan" "$N"
+		append bss_conf "vlan_naming=$vlan_naming" "$N"
+		if [ -n "$vlan_bridge" ]; then
+			append bss_conf "vlan_bridge=$vlan_bridge" "$N"
+		else
+			set_default vlan_no_bridge 1
+		fi
+		append bss_conf "vlan_no_bridge=$vlan_no_bridge" "$N"
+		[ -n "$vlan_tagged_interface" ] && \
+			append bss_conf "vlan_tagged_interface=$vlan_tagged_interface" "$N"
+		[ -n "$vlan_file" ] && {
+			[ -e "$vlan_file" ] || touch "$vlan_file"
+			append bss_conf "vlan_file=$vlan_file" "$N"
+		}
+	}
+
+	json_get_vars iw_enabled iw_internet iw_asra iw_esr iw_uesa iw_access_network_type
+	json_get_vars iw_hessid iw_venue_group iw_venue_type iw_network_auth_type
+	json_get_vars iw_roaming_consortium iw_domain_name iw_anqp_3gpp_cell_net iw_nai_realm
+	json_get_vars iw_anqp_elem iw_qos_map_set iw_ipaddr_type_availability iw_gas_address3
+	json_get_vars iw_venue_name iw_venue_url
+
+	set_default iw_enabled 0
+	if [ "$iw_enabled" = "1" ]; then
+		append bss_conf "interworking=1" "$N"
+		set_default iw_internet 1
+		set_default iw_asra 0
+		set_default iw_esr 0
+		set_default iw_uesa 0
+
+		append bss_conf "internet=$iw_internet" "$N"
+		append bss_conf "asra=$iw_asra" "$N"
+		append bss_conf "esr=$iw_esr" "$N"
+		append bss_conf "uesa=$iw_uesa" "$N"
+
+		[ -n "$iw_access_network_type" ] && \
+			append bss_conf "access_network_type=$iw_access_network_type" "$N"
+		[ -n "$iw_hessid" ] && append bss_conf "hessid=$iw_hessid" "$N"
+		[ -n "$iw_venue_group" ] && \
+			append bss_conf "venue_group=$iw_venue_group" "$N"
+		[ -n "$iw_venue_type" ] && append bss_conf "venue_type=$iw_venue_type" "$N"
+		[ -n "$iw_network_auth_type" ] && \
+			append bss_conf "network_auth_type=$iw_network_auth_type" "$N"
+		[ -n "$iw_gas_address3" ] && append bss_conf "gas_address3=$iw_gas_address3" "$N"
+
+		json_for_each_item append_iw_roaming_consortium iw_roaming_consortium
+		json_for_each_item append_iw_anqp_elem iw_anqp_elem
+		json_for_each_item append_iw_nai_realm iw_nai_realm
+		json_for_each_item append_iw_venue_name iw_venue_name
+		json_for_each_item append_iw_venue_url iw_venue_url
+
+		iw_domain_name_conf=
+		json_for_each_item append_iw_domain_name iw_domain_name
+		[ -n "$iw_domain_name_conf" ] && \
+			append bss_conf "domain_name=$iw_domain_name_conf" "$N"
+
+		iw_anqp_3gpp_cell_net_conf=
+		json_for_each_item append_iw_anqp_3gpp_cell_net iw_anqp_3gpp_cell_net
+		[ -n "$iw_anqp_3gpp_cell_net_conf" ] && \
+			append bss_conf "anqp_3gpp_cell_net=$iw_anqp_3gpp_cell_net_conf" "$N"
+	fi
+
+	set_default iw_qos_map_set 0,0,2,16,1,1,255,255,18,22,24,38,40,40,44,46,48,56
+	case "$iw_qos_map_set" in
+		*,*);;
+		*) iw_qos_map_set="";;
+	esac
+	[ -n "$iw_qos_map_set" ] && append bss_conf "qos_map_set=$iw_qos_map_set" "$N"
+
+	local hs20 disable_dgaf anqp_domain_id hs20_deauth_req_timeout \
+		hs20_wan_metrics hs20_operating_class hs20_t_c_filename hs20_t_c_timestamp \
+		hs20_t_c_server_url
+	json_get_vars hs20 disable_dgaf anqp_domain_id hs20_deauth_req_timeout \
+		hs20_wan_metrics hs20_operating_class hs20_t_c_filename hs20_t_c_timestamp \
+		hs20_t_c_server_url
+
+	set_default hs20 0
+	set_default disable_dgaf $hs20
+	set_default anqp_domain_id 0
+	set_default hs20_deauth_req_timeout 60
+	if [ "$hs20" = "1" ]; then
+		append bss_conf "hs20=1" "$N"
+		append bss_conf "disable_dgaf=$disable_dgaf" "$N"
+		append bss_conf "anqp_domain_id=$anqp_domain_id" "$N"
+		append bss_conf "hs20_deauth_req_timeout=$hs20_deauth_req_timeout" "$N"
+		[ -n "$hs20_wan_metrics" ] && append bss_conf "hs20_wan_metrics=$hs20_wan_metrics" "$N"
+		[ -n "$hs20_operating_class" ] && append bss_conf "hs20_operating_class=$hs20_operating_class" "$N"
+		[ -n "$hs20_t_c_filename" ] && append bss_conf "hs20_t_c_filename=$hs20_t_c_filename" "$N"
+		[ -n "$hs20_t_c_timestamp" ] && append bss_conf "hs20_t_c_timestamp=$hs20_t_c_timestamp" "$N"
+		[ -n "$hs20_t_c_server_url" ] && append bss_conf "hs20_t_c_server_url=$hs20_t_c_server_url" "$N"
+		json_for_each_item append_hs20_conn_capab hs20_conn_capab
+	fi
+
+	if [ "$eap_server" = "1" ]; then
+		append bss_conf "eap_server=1" "$N"
+		append bss_conf "eap_server_erp=1" "$N"
+		[ -n "$eap_user_file" ] && append bss_conf "eap_user_file=$eap_user_file" "$N"
+		[ -n "$ca_cert" ] && append bss_conf "ca_cert=$ca_cert" "$N"
+		[ -n "$server_cert" ] && append bss_conf "server_cert=$server_cert" "$N"
+		[ -n "$private_key" ] && append bss_conf "private_key=$private_key" "$N"
+		[ -n "$private_key_passwd" ] && append bss_conf "private_key_passwd=$private_key_passwd" "$N"
+		[ -n "$server_id" ] && append bss_conf "server_id=$server_id" "$N"
+		[ -n "$radius_server_clients" ] && append bss_conf "radius_server_clients=$radius_server_clients" "$N"
+		[ -n "$radius_server_auth_port" ] && append bss_conf "radius_server_auth_port=$radius_server_auth_port" "$N"
+	fi
+
+	set_default multicast_to_unicast_all 0
+	if [ "$multicast_to_unicast_all" -gt 0 ]; then
+		append bss_conf "multicast_to_unicast=$multicast_to_unicast_all" "$N"
+	fi
+	set_default proxy_arp 0
+	set_default na_mcast_to_ucast "$proxy_arp"
+	if [ "$proxy_arp" -gt 0 ]; then
+		append bss_conf "proxy_arp=$proxy_arp" "$N"
+	fi
+	if [ "$na_mcast_to_ucast" -gt 0 ]; then
+		append bss_conf "na_mcast_to_ucast=$na_mcast_to_ucast" "$N"
+	fi
+
+	set_default per_sta_vif 0
+	if [ "$per_sta_vif" -gt 0 ]; then
+		append bss_conf "per_sta_vif=$per_sta_vif" "$N"
+	fi
+
+	if [ "$apup" -gt 0 ]; then
+		append bss_conf "apup=$apup" "$N"
+
+		local apup_peer_ifname_prefix
+		json_get_vars apup_peer_ifname_prefix
+		if [ -n "$apup_peer_ifname_prefix" ] ; then
+			append bss_conf "apup_peer_ifname_prefix=$apup_peer_ifname_prefix" "$N"
+		fi
+	fi
+
+	json_get_values opts hostapd_bss_options
+	for val in $opts; do
+		append bss_conf "$val" "$N"
+	done
+
+	append "$var" "$bss_conf" "$N"
+	return 0
+}
+
+hostapd_set_log_options() {
+	local var="$1"
+
+	local log_level log_80211 log_8021x log_radius log_wpa log_driver log_iapp log_mlme
+	json_get_vars log_level log_80211 log_8021x log_radius log_wpa log_driver log_iapp log_mlme
+
+	set_default log_level 2
+	set_default log_80211  1
+	set_default log_8021x  1
+	set_default log_radius 1
+	set_default log_wpa    1
+	set_default log_driver 1
+	set_default log_iapp   1
+	set_default log_mlme   1
+
+	local log_mask="$(( \
+		($log_80211  << 0) | \
+		($log_8021x  << 1) | \
+		($log_radius << 2) | \
+		($log_wpa    << 3) | \
+		($log_driver << 4) | \
+		($log_iapp   << 5) | \
+		($log_mlme   << 6)   \
+	))"
+
+	append "$var" "logger_syslog=$log_mask" "$N"
+	append "$var" "logger_syslog_level=$log_level" "$N"
+	append "$var" "logger_stdout=$log_mask" "$N"
+	append "$var" "logger_stdout_level=$log_level" "$N"
+
+	return 0
+}
+
+_wpa_supplicant_common() {
+	local ifname="$1"
+
+	_rpath="/var/run/wpa_supplicant"
+	_config="${_rpath}-$ifname.conf"
+}
+
+wpa_supplicant_teardown_interface() {
+	_wpa_supplicant_common "$1"
+	rm -rf "$_rpath/$1" "$_config"
+}
+
+wpa_supplicant_prepare_interface() {
+	local ifname="$1"
+	_w_driver="$2"
+
+	_wpa_supplicant_common "$1"
+
+	json_get_vars mode wds multi_ap
+
+	[ -n "$network_bridge" ] && {
+		fail=
+		case "$mode" in
+			adhoc)
+				fail=1
+			;;
+			sta)
+				[ "$wds" = 1 -o "$multi_ap" = 1 ] || fail=1
+			;;
+		esac
+
+		[ -n "$fail" ] && {
+			wireless_setup_vif_failed BRIDGE_NOT_ALLOWED
+			return 1
+		}
+	}
+
+	local ap_scan=
+
+	_w_mode="$mode"
+
+	[ "$mode" = adhoc ] && {
+		ap_scan="ap_scan=2"
+	}
+
+	local country_str=
+	[ -n "$country" ] && {
+		country_str="country=$country"
+	}
+
+	multiap_flag_file="${_config}.is_multiap"
+	if [ "$multi_ap" = "1" ]; then
+		touch "$multiap_flag_file"
+	else
+		[ -e "$multiap_flag_file" ] && rm "$multiap_flag_file"
+	fi
+	wpa_supplicant_teardown_interface "$ifname"
+	cat > "$_config" <<EOF
+${scan_list:+freq_list=$scan_list}
+$ap_scan
+$country_str
+EOF
+	return 0
+}
+
+wpa_supplicant_set_fixed_freq() {
+	local freq="$1"
+	local htmode="$2"
+
+	append network_data "fixed_freq=1" "$N$T"
+	append network_data "frequency=$freq" "$N$T"
+	case "$htmode" in
+		NOHT) append network_data "disable_ht=1" "$N$T";;
+		HE20|HT20|VHT20) append network_data "disable_ht40=1" "$N$T";;
+		HT40*|VHT40|VHT80|VHT160|HE40|HE80|HE160) append network_data "ht40=1" "$N$T";;
+	esac
+	case "$htmode" in
+		VHT*) append network_data "vht=1" "$N$T";;
+	esac
+	case "$htmode" in
+		HE80|VHT80) append network_data "max_oper_chwidth=1" "$N$T";;
+		HE160|VHT160) append network_data "max_oper_chwidth=2" "$N$T";;
+		HE20|HE40|VHT20|VHT40) append network_data "max_oper_chwidth=0" "$N$T";;
+		*) append network_data "disable_vht=1" "$N$T";;
+	esac
+}
+
+wpa_supplicant_add_network() {
+	local ifname="$1"
+	local freq="$2"
+	local htmode="$3"
+	local noscan="$4"
+
+	_wpa_supplicant_common "$1"
+	wireless_vif_parse_encryption
+
+	json_get_vars \
+		ssid bssid key rsn_override \
+		mcast_rate \
+		ieee80211w ieee80211r fils ocv \
+		multi_ap \
+		default_disabled
+
+	json_get_values basic_rate_list basic_rate
+
+	set_default rsn_override 1
+
+	case "$auth_type" in
+		sae|owe|eap2|eap192)
+			set_default ieee80211w 2
+		;;
+		psk-sae)
+			set_default ieee80211w 1
+		;;
+	esac
+
+	set_default ieee80211r 0
+	set_default multi_ap 0
+	set_default sae_pwe 2
+	set_default default_disabled 0
+
+	local key_mgmt='NONE'
+	local network_data=
+	local T="	"
+
+	local scan_ssid="scan_ssid=1"
+	local freq wpa_key_mgmt
+
+	[ "$_w_mode" = "adhoc" ] && {
+		append network_data "mode=1" "$N$T"
+		[ -n "$freq" ] && wpa_supplicant_set_fixed_freq "$freq" "$htmode"
+		[ "$noscan" = "1" ] && append network_data "noscan=1" "$N$T"
+
+		scan_ssid="scan_ssid=0"
+
+		[ "$_w_driver" = "nl80211" ] ||	append wpa_key_mgmt "WPA-NONE"
+	}
+
+	[ "$_w_mode" = "mesh" ] && {
+		json_get_vars mesh_id mesh_fwding mesh_rssi_threshold encryption
+		[ -n "$mesh_id" ] && ssid="${mesh_id}"
+
+		append network_data "mode=5" "$N$T"
+		[ -n "$mesh_fwding" ] && append network_data "mesh_fwding=${mesh_fwding}" "$N$T"
+		[ -n "$mesh_rssi_threshold" ] && append network_data "mesh_rssi_threshold=${mesh_rssi_threshold}" "$N$T"
+		[ -n "$freq" ] && wpa_supplicant_set_fixed_freq "$freq" "$htmode"
+		[ "$noscan" = "1" ] && append network_data "noscan=1" "$N$T"
+		[ "$encryption" = "none" -o -z "$encryption" ] || append wpa_key_mgmt "SAE"
+		scan_ssid=""
+	}
+
+	[ "$_w_mode" = "sta" ] && {
+		[ "$multi_ap" = 1 ] && append network_data "multi_ap_backhaul_sta=1" "$N$T"
+		[ "$default_disabled" = 1 ] && append network_data "disabled=1" "$N$T"
+	}
+
+	[ -n "$ocv" ] && append network_data "ocv=$ocv" "$N$T"
+
+	rsn_overriding=0
+	case "$htmode" in
+	EHT*|HE*) [ "$rsn_override" -gt 0 ] && rsn_overriding=1;;
+	esac
+	append network_data "rsn_overriding=$rsn_overriding" "$N$T"
+
+	case "$auth_type" in
+		none) ;;
+		owe)
+			hostapd_append_wpa_key_mgmt
+			key_mgmt="$wpa_key_mgmt"
+		;;
+		wep)
+			local wep_keyidx=0
+			hostapd_append_wep_key network_data
+			append network_data "wep_tx_keyidx=$wep_keyidx" "$N$T"
+		;;
+		wps)
+			key_mgmt='WPS'
+		;;
+		psk|sae|psk-sae)
+			local passphrase
+
+			if [ "$_w_mode" != "mesh" ]; then
+				hostapd_append_wpa_key_mgmt
+			fi
+
+			key_mgmt="$wpa_key_mgmt"
+
+			if [ "$_w_mode" = "mesh" ] || [ "$auth_type" = "sae" ]; then
+				passphrase="sae_password=\"${key}\""
+			else
+				if [ ${#key} -eq 64 ]; then
+					passphrase="psk=${key}"
+				else
+					passphrase="psk=\"${key}\""
+				fi
+			fi
+			append network_data "$passphrase" "$N$T"
+		;;
+		eap|eap2|eap192)
+			hostapd_append_wpa_key_mgmt
+			key_mgmt="$wpa_key_mgmt"
+
+			json_get_vars eap_type identity anonymous_identity ca_cert ca_cert_usesystem
+
+			[ "$fils" -gt 0 ] && append network_data "erp=1" "$N$T"
+			if [ "$ca_cert_usesystem" -eq "1" -a -f "/etc/ssl/certs/ca-certificates.crt" ]; then
+				append network_data "ca_cert=\"/etc/ssl/certs/ca-certificates.crt\"" "$N$T"
+			else
+				[ -n "$ca_cert" ] && append network_data "ca_cert=\"$ca_cert\"" "$N$T"
+			fi
+			[ -n "$identity" ] && append network_data "identity=\"$identity\"" "$N$T"
+			[ -n "$anonymous_identity" ] && append network_data "anonymous_identity=\"$anonymous_identity\"" "$N$T"
+			case "$eap_type" in
+				tls)
+					json_get_vars client_cert priv_key priv_key_pwd
+					append network_data "client_cert=\"$client_cert\"" "$N$T"
+					append network_data "private_key=\"$priv_key\"" "$N$T"
+					append network_data "private_key_passwd=\"$priv_key_pwd\"" "$N$T"
+
+					json_get_vars subject_match
+					[ -n "$subject_match" ] && append network_data "subject_match=\"$subject_match\"" "$N$T"
+
+					json_get_values altsubject_match altsubject_match
+					if [ -n "$altsubject_match" ]; then
+						local list=
+						for x in $altsubject_match; do
+							append list "$x" ";"
+						done
+						append network_data "altsubject_match=\"$list\"" "$N$T"
+					fi
+
+					json_get_values domain_match domain_match
+					if [ -n "$domain_match" ]; then
+						local list=
+						for x in $domain_match; do
+							append list "$x" ";"
+						done
+						append network_data "domain_match=\"$list\"" "$N$T"
+					fi
+
+					json_get_values domain_suffix_match domain_suffix_match
+					if [ -n "$domain_suffix_match" ]; then
+						local list=
+						for x in $domain_suffix_match; do
+							append list "$x" ";"
+						done
+						append network_data "domain_suffix_match=\"$list\"" "$N$T"
+					fi
+				;;
+				fast|peap|ttls)
+					json_get_vars auth password ca_cert2 ca_cert2_usesystem client_cert2 priv_key2 priv_key2_pwd
+					set_default auth MSCHAPV2
+
+					if [ "$auth" = "EAP-TLS" ]; then
+						if [ "$ca_cert2_usesystem" -eq "1" -a -f "/etc/ssl/certs/ca-certificates.crt" ]; then
+							append network_data "ca_cert2=\"/etc/ssl/certs/ca-certificates.crt\"" "$N$T"
+						else
+							[ -n "$ca_cert2" ] && append network_data "ca_cert2=\"$ca_cert2\"" "$N$T"
+						fi
+						append network_data "client_cert2=\"$client_cert2\"" "$N$T"
+						append network_data "private_key2=\"$priv_key2\"" "$N$T"
+						append network_data "private_key2_passwd=\"$priv_key2_pwd\"" "$N$T"
+					else
+						append network_data "password=\"$password\"" "$N$T"
+					fi
+
+					json_get_vars subject_match
+					[ -n "$subject_match" ] && append network_data "subject_match=\"$subject_match\"" "$N$T"
+
+					json_get_values altsubject_match altsubject_match
+					if [ -n "$altsubject_match" ]; then
+						local list=
+						for x in $altsubject_match; do
+							append list "$x" ";"
+						done
+						append network_data "altsubject_match=\"$list\"" "$N$T"
+					fi
+
+					json_get_values domain_match domain_match
+					if [ -n "$domain_match" ]; then
+						local list=
+						for x in $domain_match; do
+							append list "$x" ";"
+						done
+						append network_data "domain_match=\"$list\"" "$N$T"
+					fi
+
+					json_get_values domain_suffix_match domain_suffix_match
+					if [ -n "$domain_suffix_match" ]; then
+						local list=
+						for x in $domain_suffix_match; do
+							append list "$x" ";"
+						done
+						append network_data "domain_suffix_match=\"$list\"" "$N$T"
+					fi
+
+					phase2proto="auth="
+					case "$auth" in
+						"auth"*)
+							phase2proto=""
+						;;
+						"EAP-"*)
+							auth="$(echo $auth | cut -b 5- )"
+							[ "$eap_type" = "ttls" ] &&
+								phase2proto="autheap="
+							json_get_vars subject_match2
+							[ -n "$subject_match2" ] && append network_data "subject_match2=\"$subject_match2\"" "$N$T"
+
+							json_get_values altsubject_match2 altsubject_match2
+							if [ -n "$altsubject_match2" ]; then
+								local list=
+								for x in $altsubject_match2; do
+									append list "$x" ";"
+								done
+								append network_data "altsubject_match2=\"$list\"" "$N$T"
+							fi
+
+							json_get_values domain_match2 domain_match2
+							if [ -n "$domain_match2" ]; then
+								local list=
+								for x in $domain_match2; do
+									append list "$x" ";"
+								done
+								append network_data "domain_match2=\"$list\"" "$N$T"
+							fi
+
+							json_get_values domain_suffix_match2 domain_suffix_match2
+							if [ -n "$domain_suffix_match2" ]; then
+								local list=
+								for x in $domain_suffix_match2; do
+									append list "$x" ";"
+								done
+								append network_data "domain_suffix_match2=\"$list\"" "$N$T"
+							fi
+						;;
+					esac
+					append network_data "phase2=\"$phase2proto$auth\"" "$N$T"
+				;;
+			esac
+			append network_data "eap=$(echo $eap_type | tr 'a-z' 'A-Z')" "$N$T"
+		;;
+	esac
+
+	[ "$wpa_cipher" = GCMP ] && {
+		append network_data "pairwise=GCMP" "$N$T"
+		append network_data "group=GCMP" "$N$T"
+	}
+
+	[ "$mode" = mesh ] || {
+		case "$wpa" in
+			1)
+				append network_data "proto=WPA" "$N$T"
+			;;
+			2)
+				append network_data "proto=RSN" "$N$T"
+			;;
+		esac
+
+		case "$ieee80211w" in
+			[012])
+				[ "$wpa" -ge 2 ] && append network_data "ieee80211w=$ieee80211w" "$N$T"
+			;;
+		esac
+	}
+	[ -n "$bssid" ] && append network_data "bssid=$bssid" "$N$T"
+	[ -n "$beacon_int" ] && append network_data "beacon_int=$beacon_int" "$N$T"
+
+	local bssid_blacklist bssid_whitelist
+	json_get_values bssid_blacklist bssid_blacklist
+	json_get_values bssid_whitelist bssid_whitelist
+
+	[ -n "$bssid_blacklist" ] && append network_data "bssid_blacklist=$bssid_blacklist" "$N$T"
+	[ -n "$bssid_whitelist" ] && append network_data "bssid_whitelist=$bssid_whitelist" "$N$T"
+
+	[ -n "$basic_rate_list" ] && {
+		local br rate rate_list=
+
+		if [ "$mode" = mesh ]; then
+			for br in $basic_rate_list; do
+				rate="$(($br / 100))"
+				append rate_list "$rate" " "
+			done
+			[ -n "$rate_list" ] && append network_data "mesh_basic_rates=$rate_list" "$N$T"
+		else
+			for br in $basic_rate_list; do
+				wpa_supplicant_add_rate rate_list "$br"
+			done
+			[ -n "$rate_list" ] && append network_data "rates=$rate_list" "$N$T"
+		fi
+	}
+
+	[ -n "$mcast_rate" ] && {
+		local mc_rate=
+		wpa_supplicant_add_rate mc_rate "$mcast_rate"
+		append network_data "mcast_rate=$mc_rate" "$N$T"
+	}
+
+	if [ "$key_mgmt" = "WPS" ]; then
+		echo "wps_cred_processing=1" >> "$_config"
+	else
+		cat >> "$_config" <<EOF
+network={
+	$scan_ssid
+	ssid="$ssid"
+	key_mgmt=$key_mgmt
+	sae_pwe=$sae_pwe
+	$network_data
+}
+EOF
+	fi
+	return 0
+}
diff --git a/wireless-scripts-example/mtk-feed/hostapd.uc b/wireless-scripts-example/mtk-feed/hostapd.uc
new file mode 100644
index 0000000000..8e522de382
--- /dev/null
+++ b/wireless-scripts-example/mtk-feed/hostapd.uc
@@ -0,0 +1,1492 @@
+let libubus = require("ubus");
+import { open, readfile, access } from "fs";
+import { wdev_remove, is_equal, vlist_new, phy_is_fullmac, phy_open, wdev_set_radio_mask, wdev_set_up } from "common";
+
+let ubus = libubus.connect(null, 60);
+
+function ex_handler(e)
+{
+	e = split(`${e}\n${e.stacktrace[0].context}`, '\n');
+	for (let line in e)
+		hostapd.printf(line);
+	return libubus.STATUS_UNKNOWN_ERROR;
+}
+libubus.guard(ex_handler);
+
+hostapd.data.config = {};
+hostapd.data.pending_config = {};
+
+hostapd.data.file_fields = {
+	vlan_file: true,
+	wpa_psk_file: true,
+	sae_password_file: true,
+	rxkh_file: true,
+	accept_mac_file: true,
+	deny_mac_file: true,
+	eap_user_file: true,
+	ca_cert: true,
+	server_cert: true,
+	server_cert2: true,
+	private_key: true,
+	private_key2: true,
+	dh_file: true,
+	eap_sim_db: true,
+};
+
+hostapd.data.iface_fields = {
+	ft_iface: true,
+	upnp_iface: true,
+	snoop_iface: true,
+	bridge: true,
+	iapp_interface: true,
+};
+
+hostapd.data.bss_info_fields = {
+	// radio
+	hw_mode: true,
+	channel: true,
+	ieee80211ac: true,
+	ieee80211ax: true,
+
+	// bss
+	bssid: true,
+	ssid: true,
+	wpa: true,
+	wpa_key_mgmt: true,
+	wpa_pairwise: true,
+	auth_algs: true,
+	ieee80211w: true,
+	owe_transition_ifname: true,
+};
+
+hostapd.data.mld = {};
+
+function iface_remove(cfg)
+{
+	if (!cfg || !cfg.bss || !cfg.bss[0] || !cfg.bss[0].ifname)
+		return;
+
+	for (let bss in cfg.bss)
+		if (!bss.mld_ap)
+			wdev_remove(bss.ifname);
+}
+
+function iface_gen_config(config, start_disabled)
+{
+	let str = `data:
+${join("\n", config.radio.data)}
+channel=${config.radio.channel}
+`;
+
+	for (let i = 0; i < length(config.bss); i++) {
+		let bss = config.bss[i];
+		let type = i > 0 ? "bss" : "interface";
+		let nasid = bss.nasid ?? replace(bss.bssid, ":", "");
+		let bssid = bss.bssid;
+		if (bss.mld_ap)
+			bssid += "\nmld_addr=" + bss.mld_bssid;
+		str += `
+${type}=${bss.ifname}
+bssid=${bssid}
+${join("\n", bss.data)}
+nas_identifier=${nasid}
+`;
+		if (start_disabled)
+			str += `
+start_disabled=1
+`;
+	}
+
+	return str;
+}
+
+function iface_freq_info(iface, config, params)
+{
+	let freq = params.frequency;
+	let bw320_offset = params.bw320_offset;
+	let punct_bitmap = params.punct_bitmap;
+	if (!freq)
+		return null;
+
+	let sec_offset = params.sec_chan_offset;
+	if (sec_offset != -1 && sec_offset != 1)
+		sec_offset = 0;
+
+	let width = 0;
+	if (params.oper_chwidth >= 0){
+		width = params.oper_chwidth;
+	} else {
+		for (let line in config.radio.data) {
+			if (!sec_offset && match(line, /^ht_capab=.*HT40/)) {
+				sec_offset = null; // auto-detect
+				continue;
+			}
+
+			let val = match(line, /^(vht_oper_chwidth|he_oper_chwidth|eht_oper_chwidth)=(\d+)/);
+			if (!val)
+				continue;
+
+			val = int(val[2]);
+			if (val > width)
+				width = val;
+		}
+	}
+
+	if (freq < 4000)
+		width = 0;
+
+	return hostapd.freq_info(freq, sec_offset, width, bw320_offset, punct_bitmap);
+}
+
+function iface_add(phy, config, phy_status)
+{
+	let config_inline = iface_gen_config(config, !!phy_status);
+
+	let bss = config.bss[0];
+	let ret = hostapd.add_iface(`bss_config=${phy}:${config_inline}`);
+	if (ret < 0)
+		return false;
+
+	if (!phy_status)
+		return true;
+
+	let iface = hostapd.interfaces[phy];
+	if (!iface)
+		return false;
+
+	let freq_info = iface_freq_info(iface, config, phy_status);
+
+	return iface.start(freq_info) >= 0;
+}
+
+function iface_config_macaddr_list(config)
+{
+	let macaddr_list = {};
+	for (let name, mld in hostapd.data.mld)
+		if (mld.macaddr)
+			macaddr_list[mld.macaddr] = -1;
+	for (let i = 0; i < length(config.bss); i++) {
+		let bss = config.bss[i];
+		if (!bss.default_macaddr)
+			macaddr_list[bss.bssid] = i;
+	}
+
+	return macaddr_list;
+}
+
+function iface_update_supplicant_macaddr(phydev, config)
+{
+	let macaddr_list = [];
+	for (let name, mld in hostapd.data.mld)
+		if (mld.macaddr)
+			push(macaddr_list, mld.macaddr);
+	for (let bss in config.bss)
+		push(macaddr_list, bss.bssid);
+	ubus.defer("wpa_supplicant", "phy_set_macaddr_list", {
+		phy: phydev.phy,
+		radio: phydev.radio ?? -1,
+		macaddr: macaddr_list
+	});
+}
+
+function __iface_pending_next(pending, state, ret, data)
+{
+	let config = pending.config;
+	let phydev = pending.phydev;
+	let phy = pending.phy;
+	let bss = config.bss[0];
+
+	if (pending.defer)
+		pending.defer.abort();
+	delete pending.defer;
+	switch (state) {
+	case "init":
+		iface_update_supplicant_macaddr(phydev, config);
+		return "create_bss";
+	case "create_bss":
+		if (!bss.mld_ap) {
+			let err = phydev.wdev_add(bss.ifname, {
+				mode: "ap",
+				radio: phydev.radio,
+			});
+			if (err) {
+				hostapd.printf(`Failed to create ${bss.ifname} on phy ${phy}: ${err}`);
+				return null;
+			}
+		}
+
+		pending.call("wpa_supplicant", "phy_status", {
+			phy: phydev.phy,
+			radio: phydev.radio ?? -1,
+		});
+		return "check_phy";
+	case "check_phy":
+		let phy_status = data;
+		if (phy_status && phy_status.state == "COMPLETED") {
+			if (iface_add(phy, config, phy_status))
+				return "done";
+
+			hostapd.printf(`Failed to bring up phy ${phy} ifname=${bss.ifname} with supplicant provided frequency`);
+		}
+		pending.call("wpa_supplicant", "phy_set_state", {
+			phy: phydev.phy,
+			radio: phydev.radio ?? -1,
+			stop: true
+		});
+		return "wpas_stopped";
+	case "wpas_stopped":
+		if (!iface_add(phy, config))
+			hostapd.printf(`hostapd.add_iface failed for phy ${phy} ifname=${bss.ifname}`);
+		pending.call("wpa_supplicant", "phy_set_state", {
+			phy: phydev.phy,
+			radio: phydev.radio ?? -1,
+			stop: false
+		});
+		return null;
+	case "done":
+	default:
+		delete hostapd.data.pending_config[phy];
+		break;
+	}
+}
+
+function iface_pending_next(ret, data)
+{
+	let pending = true;
+	let cfg = this;
+
+	while (pending) {
+		try {
+			this.next_state = __iface_pending_next(cfg, this.next_state, ret, data);
+			if (!this.next_state) {
+				__iface_pending_next(cfg, "done");
+				return;
+			}
+		} catch(e) {
+			hostapd.printf(`Exception: ${e}\n${e.stacktrace[0].context}`);
+			return;
+		}
+		pending = !this.defer;
+	}
+}
+
+function iface_pending_abort()
+{
+	this.next_state = "done";
+	this.next();
+}
+
+function iface_pending_ubus_call(obj, method, arg)
+{
+	let ubus = hostapd.data.ubus;
+	let pending = this;
+	this.defer = ubus.defer(obj, method, arg, (ret, data) => { delete pending.defer; pending.next(ret, data) });
+}
+
+const iface_pending_proto = {
+	next: iface_pending_next,
+	call: iface_pending_ubus_call,
+	abort: iface_pending_abort,
+};
+
+function iface_pending_init(phydev, config)
+{
+	let phy = phydev.name;
+
+	let pending = proto({
+		next_state: "init",
+		phydev: phydev,
+		phy: phy,
+		config: config,
+		next: iface_pending_next,
+	}, iface_pending_proto);
+
+	hostapd.data.pending_config[phy] = pending;
+	pending.next();
+}
+
+function iface_macaddr_init(phydev, config, macaddr_list)
+{
+	let macaddr_data = {
+		num_global: config.num_global_macaddr ?? 1,
+		macaddr_base: config.macaddr_base,
+		mbssid: config.mbssid ?? 0,
+		mbssid_indicator: 0,
+	};
+
+	if (config.mbssid) {
+		let num_bss = length(config.bss) - 1;
+
+		while (num_bss) {
+			num_bss /= 2;
+			macaddr_data.mbssid_indicator++;
+		}
+	}
+
+	return phydev.macaddr_init(macaddr_list, macaddr_data);
+}
+
+function iface_restart(phydev, config, old_config)
+{
+	let phy = phydev.name;
+	let pending = hostapd.data.pending_config[phy];
+
+	if (pending)
+		pending.abort();
+
+	hostapd.remove_iface(phy);
+	iface_remove(old_config);
+	iface_remove(config);
+
+	if (!config.bss || !config.bss[0]) {
+		hostapd.printf(`No bss for phy ${phy}`);
+		return;
+	}
+
+	iface_macaddr_init(phydev, config, iface_config_macaddr_list(config));
+
+	if (config.mbssid && length(config.bss) > 1 &&
+	    !config.bss[0].default_macaddr &&
+	    phydev.set_mbssid_macaddr(config.bss[0].bssid))
+		config.bss[0].default_macaddr = true;
+
+	for (let i = 0; i < length(config.bss); i++) {
+		let bss = config.bss[i];
+		if (bss.default_macaddr || (config.mbssid && i > 0))
+			bss.bssid = phydev.macaddr_next(i);
+	}
+
+	iface_pending_init(phydev, config);
+}
+
+function array_to_obj(arr, key, start)
+{
+	let obj = {};
+
+	start ??= 0;
+	for (let i = start; i < length(arr); i++) {
+		let cur = arr[i];
+		obj[cur[key]] = cur;
+	}
+
+	return obj;
+}
+
+function find_array_idx(arr, key, val)
+{
+	for (let i = 0; i < length(arr); i++)
+		if (arr[i][key] == val)
+			return i;
+
+	return -1;
+}
+
+function bss_reload_psk(bss, config, old_config)
+{
+	if (is_equal(old_config.hash.wpa_psk_file, config.hash.wpa_psk_file))
+		return;
+
+	old_config.hash.wpa_psk_file = config.hash.wpa_psk_file;
+	if (!is_equal(old_config, config))
+		return;
+
+	let ret = bss.ctrl("RELOAD_WPA_PSK");
+	ret ??= "failed";
+
+	hostapd.printf(`Reload WPA PSK file for bss ${config.ifname}: ${ret}`);
+}
+
+function normalize_rxkhs(txt)
+{
+	const pat = {
+		sep: "\x20",
+		mac: "([[:xdigit:]]{2}:?){5}[[:xdigit:]]{2}",
+		r0kh_id: "[\x21-\x7e]{1,48}",
+		r1kh_id: "([[:xdigit:]]{2}:?){5}[[:xdigit:]]{2}",
+		key: "[[:xdigit:]]{32,}",
+		r0kh: function() {
+			return "r0kh=" + this.mac + this.sep + this.r0kh_id;
+		},
+		r1kh: function() {
+			return "r1kh=" + this.mac + this.sep + this.r1kh_id;
+		},
+		rxkh: function() {
+			return "(" + this.r0kh() + "|" + this.r1kh() + ")" + this.sep + this.key;
+		},
+	};
+
+	let rxkhs = filter(
+		split(txt, "\n"), (line) => match(line, regexp("^" + pat.rxkh() + "$"))
+	) ?? [];
+
+	rxkhs = map(rxkhs, function(k) {
+		k = split(k, " ", 3);
+		k[0] = lc(k[0]);
+		if(match(k[0], /^r1kh/)) {
+			k[1] = lc(k[1]);
+		}
+		if(!k[2] = hostapd.rkh_derive_key(k[2])) {
+			return;
+		}
+		return join(" ", k);
+	});
+
+	return join("\n", sort(filter(rxkhs, length)));
+}
+
+function bss_reload_rxkhs(bss, config, old_config)
+{
+	let bss_rxkhs = join("\n", sort(split(bss.ctrl("GET_RXKHS"), "\n")));
+	let bss_rxkhs_hash = hostapd.sha1(bss_rxkhs);
+
+	if (is_equal(config.hash.rxkh_file, bss_rxkhs_hash)) {
+		if (is_equal(old_config.hash.rxkh_file, config.hash.rxkh_file))
+			return;
+	}
+
+	old_config.hash.rxkh_file = config.hash.rxkh_file;
+	if (!is_equal(old_config, config))
+		return;
+
+	let ret = bss.ctrl("RELOAD_RXKHS");
+	ret ??= "failed";
+
+	hostapd.printf(`Reload RxKH file for bss ${config.ifname}: ${ret}`);
+}
+
+function remove_file_fields(config)
+{
+	return filter(config, (line) =>
+		!match(line, /^\s*$/) &&
+		!match(line, /^\s*#/) &&
+		!hostapd.data.file_fields[split(line, "=")[0]]
+	);
+}
+
+function bss_remove_file_fields(config)
+{
+	let new_cfg = {};
+
+	for (let key in config)
+		new_cfg[key] = config[key];
+	new_cfg.data = remove_file_fields(new_cfg.data);
+	new_cfg.hash = {};
+	for (let key in config.hash)
+		new_cfg.hash[key] = config.hash[key];
+	delete new_cfg.hash.wpa_psk_file;
+	delete new_cfg.hash.sae_password_file;
+	delete new_cfg.hash.vlan_file;
+
+	return new_cfg;
+}
+
+function bss_ifindex_list(config)
+{
+	config = filter(config, (line) => !!hostapd.data.iface_fields[split(line, "=")[0]]);
+
+	return join(",", map(config, (line) => {
+		try {
+			let file = "/sys/class/net/" + split(line, "=")[1] + "/ifindex";
+			let val = trim(readfile(file));
+			return val;
+		} catch (e) {
+			return "";
+		}
+	}));
+}
+
+function bss_config_hash(config)
+{
+	return hostapd.sha1(remove_file_fields(config) + bss_ifindex_list(config));
+}
+
+function bss_find_existing(config, prev_config, prev_hash)
+{
+	let hash = bss_config_hash(config.data);
+
+	for (let i = 0; i < length(prev_config.bss); i++) {
+		if (!prev_hash[i] || hash != prev_hash[i])
+			continue;
+
+		prev_hash[i] = null;
+		return i;
+	}
+
+	return -1;
+}
+
+function get_config_bss(name, config, idx)
+{
+	if (!config.bss[idx]) {
+		hostapd.printf(`Invalid bss index ${idx}`);
+		return;
+	}
+
+	let ifname = config.bss[idx].ifname;
+	if (!ifname) {
+		hostapd.printf(`Could not find bss ${config.bss[idx].ifname}`);
+		return;
+	}
+
+	let if_bss = hostapd.bss[name];
+	if (!if_bss) {
+		hostapd.printf(`Could not find interface ${name} bss list`);
+		return;
+	}
+
+	return if_bss[ifname];
+}
+
+function iface_reload_config(name, phydev, config, old_config)
+{
+	let phy = phydev.name;
+
+	if (!old_config || !is_equal(old_config.radio, config.radio))
+		return false;
+
+	if (is_equal(old_config.bss, config.bss))
+		return true;
+
+	if (hostapd.data.pending_config[name])
+		return false;
+
+	if (!old_config.bss || !old_config.bss[0])
+		return false;
+
+	let iface = hostapd.interfaces[name];
+	let iface_name = old_config.bss[0].ifname;
+	if (!iface) {
+		hostapd.printf(`Could not find previous interface ${iface_name}`);
+		return false;
+	}
+
+	if (iface.state() != "ENABLED") {
+		hostapd.printf(`Interface ${iface_name} is not fully configured`);
+		return false;
+	}
+
+	let first_bss = get_config_bss(name, old_config, 0);
+	if (!first_bss) {
+		hostapd.printf(`Could not find bss of previous interface ${iface_name}`);
+		return false;
+	}
+
+	let macaddr_list = iface_config_macaddr_list(config);
+	let bss_list = [];
+	let bss_list_cfg = [];
+	let prev_bss_hash = [];
+
+	for (let bss in old_config.bss) {
+		let hash = bss_config_hash(bss.data);
+		push(prev_bss_hash, bss_config_hash(bss.data));
+	}
+
+	// Step 1: find (possibly renamed) interfaces with the same config
+	// and store them in the new order (with gaps)
+	for (let i = 0; i < length(config.bss); i++) {
+		let prev;
+
+		// For fullmac devices, the first interface needs to be preserved,
+		// since it's treated as the master
+		if (!i && phy_is_fullmac(phy)) {
+			prev = 0;
+			prev_bss_hash[0] = null;
+		} else {
+			prev = bss_find_existing(config.bss[i], old_config, prev_bss_hash);
+		}
+		if (prev < 0)
+			continue;
+
+		let cur_config = config.bss[i];
+		let prev_config = old_config.bss[prev];
+		if (prev_config.force_reload) {
+			delete prev_config.force_reload;
+			continue;
+		}
+
+		let prev_bss = get_config_bss(name, old_config, prev);
+		if (!prev_bss)
+			return false;
+
+		// try to preserve MAC address of this BSS by reassigning another
+		// BSS if necessary
+		if ((cur_config.default_macaddr || cur_config.random_macaddr) &&
+		    cur_config.random_macaddr == prev_config.random_macaddr &&
+		    cur_config.default_macaddr == prev_config.default_macaddr &&
+		    !macaddr_list[prev_config.bssid]) {
+			macaddr_list[prev_config.bssid] = i;
+			cur_config.bssid = prev_config.bssid;
+		}
+
+		bss_list[i] = prev_bss;
+		bss_list_cfg[i] = old_config.bss[prev];
+	}
+
+	if (config.mbssid && !bss_list_cfg[0]) {
+		hostapd.printf("First BSS changed with MBSSID enabled");
+		return false;
+	}
+
+	// Step 2: if none were found, rename and preserve the first one
+	if (length(bss_list) == 0) {
+		// can't change the bssid of the first bss
+		if (config.bss[0].bssid != old_config.bss[0].bssid) {
+			if (!config.bss[0].default_macaddr) {
+				hostapd.printf(`BSSID of first interface changed: ${lc(old_config.bss[0].bssid)} -> ${lc(config.bss[0].bssid)}`);
+				return false;
+			}
+
+			config.bss[0].bssid = old_config.bss[0].bssid;
+		}
+
+		let prev_bss = get_config_bss(name, old_config, 0);
+		if (!prev_bss)
+			return false;
+
+		macaddr_list[config.bss[0].bssid] = 0;
+		bss_list[0] = prev_bss;
+		bss_list_cfg[0] = old_config.bss[0];
+		prev_bss_hash[0] = null;
+	}
+
+	// Step 3: delete all unused old interfaces
+	for (let i = 0; i < length(prev_bss_hash); i++) {
+		if (!prev_bss_hash[i])
+			continue;
+
+		let prev_bss = get_config_bss(name, old_config, i);
+		if (!prev_bss)
+			return false;
+
+		let ifname = old_config.bss[i].ifname;
+		hostapd.printf(`Remove bss '${ifname}' on phy '${name}'`);
+		prev_bss.delete();
+		if (!old_config.bss[i].mld_ap)
+			wdev_remove(ifname);
+	}
+
+	// Step 4: rename preserved interfaces, use temporary name on duplicates
+	let rename_list = [];
+	for (let i = 0; i < length(bss_list); i++) {
+		if (!bss_list[i])
+			continue;
+
+		let old_ifname = bss_list_cfg[i].ifname;
+		let new_ifname = config.bss[i].ifname;
+		if (old_ifname == new_ifname)
+			continue;
+
+		if (hostapd.bss[name][new_ifname]) {
+			new_ifname = "tmp_" + substr(hostapd.sha1(new_ifname), 0, 8);
+			push(rename_list, i);
+		}
+
+		hostapd.printf(`Rename bss ${old_ifname} to ${new_ifname}`);
+		if (!bss_list[i].rename(new_ifname)) {
+			hostapd.printf(`Failed to rename bss ${old_ifname} to ${new_ifname}`);
+			return false;
+		}
+
+		bss_list_cfg[i].ifname = new_ifname;
+	}
+
+	// Step 5: rename interfaces with temporary names
+	for (let i in rename_list) {
+		let new_ifname = config.bss[i].ifname;
+		if (!bss_list[i].rename(new_ifname)) {
+			hostapd.printf(`Failed to rename bss to ${new_ifname}`);
+			return false;
+		}
+		bss_list_cfg[i].ifname = new_ifname;
+	}
+
+	// Step 6: assign BSSID for newly created interfaces
+	macaddr_list = iface_macaddr_init(phydev, config, macaddr_list);
+	for (let i = 0; i < length(config.bss); i++) {
+		if (bss_list[i])
+			continue;
+		let bsscfg = config.bss[i];
+
+		let mac_idx = macaddr_list[bsscfg.bssid];
+		if (mac_idx < 0)
+			macaddr_list[bsscfg.bssid] = i;
+		if (mac_idx == i)
+			continue;
+
+		// statically assigned bssid of the new interface is in conflict
+		// with the bssid of a reused interface. reassign the reused interface
+		if (!bsscfg.default_macaddr) {
+			// can't update bssid of the first BSS, need to restart
+			if (!mac_idx < 0)
+				return false;
+
+			bsscfg = config.bss[mac_idx];
+		}
+
+		let addr = phydev.macaddr_next(i);
+		if (!addr) {
+			hostapd.printf(`Failed to generate mac address for phy ${name}`);
+			return false;
+		}
+		bsscfg.bssid = addr;
+	}
+
+	let config_inline = iface_gen_config(config);
+
+	// Step 7: fill in the gaps with new interfaces
+	for (let i = 0; i < length(config.bss); i++) {
+		let ifname = config.bss[i].ifname;
+		let bss = bss_list[i];
+
+		if (bss)
+			continue;
+
+		hostapd.printf(`Add bss ${ifname} on phy ${name}`);
+		bss_list[i] = iface.add_bss(config_inline, i);
+		if (!bss_list[i]) {
+			hostapd.printf(`Failed to add new bss ${ifname} on phy ${name}`);
+			return false;
+		}
+	}
+
+	// Step 8: update interface bss order
+	if (!iface.set_bss_order(bss_list)) {
+		hostapd.printf(`Failed to update BSS order on phy '${name}'`);
+		return false;
+	}
+
+	// Step 9: update config
+	for (let i = 0; i < length(config.bss); i++) {
+		if (!bss_list_cfg[i])
+			continue;
+
+		let ifname = config.bss[i].ifname;
+		let bss = bss_list[i];
+
+		if (is_equal(config.bss[i], bss_list_cfg[i]))
+			continue;
+
+		if (is_equal(bss_remove_file_fields(config.bss[i]),
+		             bss_remove_file_fields(bss_list_cfg[i]))) {
+			hostapd.printf(`Update config data files for bss ${ifname}`);
+			if (bss.set_config(config_inline, i, true) < 0) {
+				hostapd.printf(`Could not update config data files for bss ${ifname}`);
+				return false;
+			} else {
+				bss.ctrl("RELOAD_WPA_PSK");
+				continue;
+			}
+		}
+
+		bss_reload_psk(bss, config.bss[i], bss_list_cfg[i]);
+		bss_reload_rxkhs(bss, config.bss[i], bss_list_cfg[i]);
+		if (is_equal(config.bss[i], bss_list_cfg[i]))
+			continue;
+
+		hostapd.printf(`Reload config for bss '${config.bss[0].ifname}' on phy '${name}'`);
+		if (bss.set_config(config_inline, i) < 0) {
+			hostapd.printf(`Failed to set config for bss ${ifname}`);
+			return false;
+		}
+	}
+
+	return true;
+}
+
+function bss_check_mld(phydev, iface_name, bss)
+{
+	if (!bss.ifname)
+		return;
+
+	let mld_data = hostapd.data.mld[bss.ifname];
+	if (!mld_data || !mld_data.ifname || !mld_data.macaddr)
+		return;
+
+	bss.mld_bssid = mld_data.macaddr;
+	mld_data.iface[iface_name] = true;
+
+	if (!access('/sys/class/net/' + bss.ifname, 'x'))
+		mld_data.has_wdev = false;
+
+	if (mld_data.has_wdev)
+		return true;
+
+	hostapd.printf(`Create MLD interface ${bss.ifname} on phy ${phydev.name}, radio mask: ${mld_data.radio_mask}`);
+	let err = phydev.wdev_add(bss.ifname, {
+		mode: "ap",
+		macaddr: mld_data.macaddr,
+		radio_mask: mld_data.radio_mask,
+	});
+	wdev_set_up(bss.ifname, true);
+	if (err) {
+		hostapd.printf(`Failed to create MLD ${bss.ifname} on phy ${phydev.name}: ${err}`);
+		delete mld_data.iface[iface_name];
+		return;
+	}
+
+	mld_data.has_wdev = true;
+
+	return true;
+}
+
+function iface_check_mld(phydev, name, config)
+{
+	phydev = phy_open(phydev.phy);
+
+	for (let mld_name, mld_data in hostapd.data.mld)
+		delete mld_data.iface[name];
+
+	for (let i = 0; i < length(config.bss); i++) {
+		let bss = config.bss[i];
+		if (!bss.mld_ap)
+			continue;
+
+		if (!bss_check_mld(phydev, name, bss)) {
+			hostapd.printf(`Skip MLD interface ${name} on phy ${phydev.name}`);
+			splice(config.bss, i--, 1);
+		}
+	}
+
+	for (let mld_name, mld_data in hostapd.data.mld) {
+		if (length(mld_data.iface) > 0)
+			continue;
+
+		hostapd.printf(`Remove MLD interface ${mld_name}`);
+		wdev_remove(mld_name);
+		delete mld_data.has_wdev;
+	}
+}
+
+function iface_config_remove(name, old_config)
+{
+	hostapd.remove_iface(name);
+	return iface_remove(old_config);
+}
+
+function iface_set_config(name, config)
+{
+	let old_config = hostapd.data.config[name];
+
+	hostapd.data.config[name] = config;
+
+	let phy = config.phy;
+	let phydev = phy_open(phy, config.radio_idx);
+	if (!phydev) {
+		hostapd.printf(`Failed to open phy ${phy}`);
+		return false;
+	}
+
+	config.orig_bss = [ ...config.bss ];
+	iface_check_mld(phydev, name, config);
+	if (!length(config.bss))
+		return iface_config_remove(name, old_config);
+
+	try {
+		let ret = iface_reload_config(name, phydev, config, old_config);
+		if (ret) {
+			iface_update_supplicant_macaddr(phydev, config);
+			hostapd.printf(`Reloaded settings for phy ${name}`);
+			return 0;
+		}
+	} catch (e) {
+		hostapd.printf(`Error reloading config: ${e}\n${e.stacktrace[0].context}`);
+	}
+
+	hostapd.printf(`Restart interface for phy ${name}`);
+	let ret = iface_restart(phydev, config, old_config);
+
+	return ret;
+}
+
+function config_add_bss(config, name)
+{
+	let bss = {
+		ifname: name,
+		data: [],
+		hash: {}
+	};
+
+	push(config.bss, bss);
+
+	return bss;
+}
+
+function iface_load_config(phy, radio, filename)
+{
+	if (radio < 0)
+		radio = null;
+
+	let config = {
+		phy,
+		radio_idx: radio,
+		radio: {
+			data: []
+		},
+		bss: [],
+		orig_file: filename,
+	};
+
+	let f = open(filename, "r");
+	if (!f)
+		return config;
+
+	let bss;
+	let line;
+	while ((line = rtrim(f.read("line"), "\n")) != null) {
+		let val = split(line, "=", 2);
+		if (!val[0])
+			continue;
+
+		if (val[0] == "interface") {
+			bss = config_add_bss(config, val[1]);
+			break;
+		}
+
+		if (val[0] == "channel") {
+			config.radio.channel = val[1];
+			continue;
+		}
+
+		if (val[0] == "#num_global_macaddr")
+			config[substr(val[0], 1)] = int(val[1]);
+		else if (val[0] == "#macaddr_base")
+			config[substr(val[0], 1)] = val[1];
+		else if (val[0] == "mbssid")
+			config[val[0]] = int(val[1]);
+
+		push(config.radio.data, line);
+	}
+
+	while ((line = rtrim(f.read("line"), "\n")) != null) {
+		if (line == "#default_macaddr")
+			bss.default_macaddr = true;
+		if (line == "#random_macaddr")
+			bss.random_macaddr = true;
+
+		let val = split(line, "=", 2);
+		if (!val[0])
+			continue;
+
+		if (val[0] == "bssid") {
+			bss.bssid = lc(val[1]);
+			continue;
+		}
+
+		if (val[0] == "#mld_radio_mask" && int(val[1]))
+			bss.mld_radio_mask = int(val[1]);
+
+		if (val[0] == "nas_identifier")
+			bss.nasid = val[1];
+
+		if (val[0] == "mld_ap")
+			bss[val[0]] = int(val[1]);
+
+		if (val[0] == "bss") {
+			bss = config_add_bss(config, val[1]);
+			continue;
+		}
+
+		if (hostapd.data.file_fields[val[0]]) {
+			if (val[0] == "rxkh_file") {
+				bss.hash[val[0]] = hostapd.sha1(normalize_rxkhs(readfile(val[1])));
+			} else {
+				bss.hash[val[0]] = hostapd.sha1(readfile(val[1]));
+			}
+		}
+
+		push(bss.data, line);
+	}
+	f.close();
+
+	let first_mld_bss = 0;
+	for (first_mld_bss = 0; first_mld_bss < length(config.bss); first_mld_bss++) {
+		if (config.bss[first_mld_bss].mld_ap == 1)
+			break;
+	}
+
+	if (length(config.bss) > 1 && config.bss[0].mld_ap != 1 &&
+	    first_mld_bss != length(config.bss)) {
+		let tmp_bss = config.bss[0];
+		config.bss[0] = config.bss[first_mld_bss];
+		config.bss[first_mld_bss] = tmp_bss;
+
+		if (config.mbssid) {
+			let tmp_bssid = config.bss[0].bssid;
+			config.bss[0].bssid = config.bss[first_mld_bss].bssid;
+			config.bss[first_mld_bss].bssid = tmp_bssid;
+		}
+
+		hostapd.printf(`mtk: ucode: switch bss[${first_mld_bss}] to first`);
+	}
+
+	return config;
+}
+
+function phy_name(phy, radio)
+{
+	if (!phy)
+		return null;
+
+	if (radio != null && radio >= 0)
+		phy += "." + radio;
+
+	return phy;
+}
+
+function bss_config(bss_name) {
+	for (let phy, config in hostapd.data.config) {
+		if (!config)
+			continue;
+
+		for (let bss in config.bss)
+			if (bss.ifname == bss_name)
+				return [ config, bss ];
+	}
+}
+
+function mld_rename_bss(data, name)
+{
+	if (data.ifname == name)
+		return true;
+
+	// TODO: handle rename gracefully
+	return false;
+}
+
+function mld_add_bss(name, data, phy_list, i)
+{
+	let config = data.config;
+	if (!config.phy)
+		return;
+
+	hostapd.printf(`Add MLD interface ${name}`);
+	wdev_remove(name);
+	let phydev = phy_list[config.phy];
+	if (!phydev) {
+		phydev = phy_open(config.phy, 0);
+		if (!phydev)
+			return;
+
+		let macaddr_list = {};
+		let phy_config = hostapd.data.config[phy_name(config.phy, 0)];
+		if (phy_config)
+			macaddr_list = iface_config_macaddr_list(phy_config);
+		iface_macaddr_init(phydev, data.config, macaddr_list);
+
+		phy_list[config.phy] = phydev;
+	}
+
+	data.macaddr = config.macaddr;
+	if (config.mld_addr)
+		data.macaddr = config.mld_addr;
+
+	if (!data.macaddr) {
+		data.macaddr = phydev.macaddr_next();
+		data.default_macaddr = true;
+	}
+
+	let radio_mask = 0;
+	for (let r in config.radios)
+		if (r != null)
+			radio_mask |= 1 << r;
+
+	data.radio_mask = radio_mask;
+	data.ifname = name;
+}
+
+function mld_find_matching_config(list, config)
+{
+	for (let name, data in list)
+		if (is_equal(data.config, config))
+			return name;
+}
+
+function mld_reload_interface(name)
+{
+	let config = hostapd.data.config[name];
+	if (!config)
+		return;
+
+	config = { ...config };
+	config.bss = config.orig_bss;
+
+	iface_set_config(name, config);
+}
+
+function mld_set_config(config)
+{
+	let prev_mld = { ...hostapd.data.mld };
+	let new_mld = {};
+	let phy_list = {};
+	let new_config = !length(prev_mld);
+
+	hostapd.printf(`Set MLD config: ${keys(config)}`);
+
+	// find renamed/new interfaces
+	for (let name, data in config) {
+		let prev = mld_find_matching_config(prev_mld, data);
+		if (prev) {
+			let data = prev_mld[prev];
+			if (mld_rename_bss(data, name)) {
+				new_mld[name] = data;
+				delete prev_mld[prev];
+				continue;
+			}
+		}
+
+		new_mld[name] = {
+			config: data,
+			iface: {},
+		};
+	}
+
+	let reload_iface = {};
+	for (let name, data in prev_mld) {
+		delete hostapd.data.mld[name];
+
+		if (!data.ifname)
+			continue;
+
+		for (let iface, bss_list in hostapd.bss) {
+			if (!bss_list[name])
+				continue;
+			reload_iface[iface] = true;
+		}
+	}
+
+	for (let name in reload_iface)
+		mld_reload_interface(name);
+
+	for (let name, data in prev_mld) {
+		if (data.ifname)
+			hostapd.printf(`Remove MLD interface ${name}`);
+		wdev_remove(name);
+	}
+
+	// add new interfaces
+	hostapd.data.mld = new_mld;
+	for (let name, data in new_mld)
+		if (!data.ifname)
+			mld_add_bss(name, data, phy_list);
+
+	if (!new_config)
+		return;
+
+	hostapd.printf(`Reload all interfaces`);
+	for (let name in hostapd.data.config)
+		mld_reload_interface(name);
+}
+
+let main_obj = {
+	reload: {
+		args: {
+			phy: "",
+			radio: 0,
+		},
+		call: function(req) {
+			let phy_list = req.args.phy ? [ phy_name(req.args.phy, req.args.radio) ] : keys(hostapd.data.config);
+			for (let phy_name in phy_list) {
+				let phy = hostapd.data.config[phy_name];
+				let config = iface_load_config(phy.phy, phy.radio_idx, phy.orig_file);
+				iface_set_config(phy_name, config);
+			}
+
+			return 0;
+		}
+	},
+	apsta_state: {
+		args: {
+			phy: "",
+			radio: 0,
+			up: true,
+			frequency: 0,
+			sec_chan_offset: 0,
+			oper_chwidth: -1,
+			bw320_offset: 1,
+			csa: true,
+			csa_count: 0,
+			punct_bitmap: 0,
+		},
+		call: function(req) {
+			let phy = phy_name(req.args.phy, req.args.radio);
+			if (req.args.up == null || !phy)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			hostapd.printf(`ucode: mtk: apsta state update`);
+			hostapd.printf(`    * phy: ${req.args.phy}`);
+			hostapd.printf(`    * radio: ${req.args.radio}`);
+			hostapd.printf(`    * up: ${req.args.up}`);
+			hostapd.printf(`    * freqeuncy: ${req.args.frequency}`);
+			hostapd.printf(`    * sec_chan_offset: ${req.args.sec_chan_offset}`);
+			hostapd.printf(`    * oepr_chwidth: ${req.args.oper_chwidth}`);
+			hostapd.printf(`    * bw320_offset: ${req.args.bw320_offset}`);
+			hostapd.printf(`    * csa: ${req.args.csa}`);
+			hostapd.printf(`    * csa_count: ${req.args.csa_count}`);
+			hostapd.printf(`    * punct_bitmap: ${req.args.punct_bitmap}`);
+
+			let config = hostapd.data.config[phy];
+			if (!config || !config.bss || !config.bss[0] || !config.bss[0].ifname)
+				return 0;
+
+			let iface = hostapd.interfaces[phy];
+			if (!iface)
+				return 0;
+
+			if (!req.args.up) {
+				iface.stop();
+				return 0;
+			}
+
+			let freq_info;
+			if (req.args.frequency) {
+				freq_info = iface_freq_info(iface, config, req.args);
+				if (!freq_info)
+					return libubus.STATUS_UNKNOWN_ERROR;
+
+				if (req.args.csa) {
+					freq_info.csa_count = req.args.csa_count ?? 10;
+					let ret = iface.switch_channel(freq_info);
+					if (!ret)
+						return libubus.STATUS_UNKNOWN_ERROR;
+					return 0;
+				}
+			}
+
+			let ret = iface.start(freq_info);
+			if (!ret)
+				return libubus.STATUS_UNKNOWN_ERROR;
+
+			return 0;
+		}
+	},
+	config_get_macaddr_list: {
+		args: {
+			phy: "",
+			radio: 0,
+		},
+		call: function(req) {
+			let phy = phy_name(req.args.phy, req.args.radio);
+			if (!phy)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			let ret = {
+				macaddr: [],
+			};
+
+			let config = hostapd.data.config[phy];
+			if (!config)
+				return ret;
+
+			ret.macaddr = map(config.bss, (bss) => bss.bssid);
+			return ret;
+		}
+	},
+	switch_channel: {
+		args: {
+			phy: "",
+			radio: 0,
+			csa_count: 0,
+			sec_channel: 0,
+			oper_chwidth: 0,
+			frequency: 0,
+			center_freq1: 0,
+			center_freq2: 0,
+		},
+		call: function(req) {
+			let phy = phy_name(req.args.phy, req.args.radio);
+			if (!req.args.frequency || !phy)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			let iface = hostapd.interfaces[phy];
+			if (!iface)
+				return libubus.STATUS_NOT_FOUND;
+
+			req.args.csa_count ??= 10;
+			let ret = iface.switch_channel(req.args);
+			if (!ret)
+				return libubus.STATUS_UNKNOWN_ERROR;
+
+			return 0;
+		},
+	},
+	mld_set: {
+		args: {
+			config: {}
+		},
+		call: function(req) {
+			if (!req.args.config)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			mld_set_config(req.args.config);
+
+			return {
+				pid: hostapd.getpid()
+			};
+		}
+	},
+	config_reset: {
+		args: {
+		},
+		call: function(req) {
+			for (let name in hostapd.data.config)
+				iface_set_config(name);
+			mld_set_config({});
+			return 0;
+		}
+	},
+	config_set: {
+		args: {
+			phy: "",
+			radio: 0,
+			config: "",
+			prev_config: "",
+		},
+		call: function(req) {
+			let phy = req.args.phy;
+			let radio = req.args.radio;
+			let name = phy_name(phy, radio);
+			let file = req.args.config;
+			let prev_file = req.args.prev_config;
+
+			if (!phy)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			if (prev_file && !hostapd.data.config[name]) {
+				let config = iface_load_config(phy, radio, prev_file);
+				if (config)
+					config.radio.data = [];
+				hostapd.data.config[name] = config;
+			}
+
+			let config = iface_load_config(phy, radio, file);
+
+			hostapd.printf(`Set new config for phy ${name}: ${file}`);
+			iface_set_config(name, config);
+
+			if (hostapd.data.auth_obj)
+				hostapd.data.auth_obj.notify("reload", { phy, radio });
+
+			return {
+				pid: hostapd.getpid()
+			};
+		}
+	},
+	config_add: {
+		args: {
+			iface: "",
+			config: "",
+		},
+		call: function(req) {
+			if (!req.args.iface || !req.args.config)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			if (hostapd.add_iface(`bss_config=${req.args.iface}:${req.args.config}`) < 0)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			return {
+				pid: hostapd.getpid()
+			};
+		}
+	},
+	config_remove: {
+		args: {
+			iface: ""
+		},
+		call: function(req) {
+			if (!req.args.iface)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			hostapd.remove_iface(req.args.iface);
+			return 0;
+		}
+	},
+	bss_info: {
+		args: {
+			iface: ""
+		},
+		call: function(req) {
+			if (!req.args.iface)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			let config = bss_config(req.args.iface);
+			if (!config)
+				return libubus.STATUS_NOT_FOUND;
+
+			let bss = config[1];
+			config = config[0];
+			let ret = {};
+
+			for (let line in [ ...config.radio.data, ...bss.data ]) {
+				let fields = split(line, "=", 2);
+				let name = fields[0];
+				if (hostapd.data.bss_info_fields[name])
+					ret[name] = fields[1];
+			}
+
+			return ret;
+		}
+	},
+};
+
+hostapd.data.ubus = ubus;
+hostapd.data.obj = ubus.publish("hostapd", main_obj);
+
+
+let auth_obj = {};
+hostapd.data.auth_obj = ubus.publish("hostapd-auth", auth_obj);
+hostapd.udebug_set("hostapd", hostapd.data.ubus);
+
+function bss_event(type, name, data) {
+	let ubus = hostapd.data.ubus;
+
+	data ??= {};
+	data.name = name;
+	hostapd.data.obj.notify(`bss.${type}`, data, null, null, null, -1);
+	ubus.call("service", "event", { type: `hostapd.${name}.${type}`, data: {} });
+}
+
+return {
+	shutdown: function() {
+		for (let phy in hostapd.data.config)
+			iface_set_config(phy);
+		hostapd.udebug_set(null);
+		hostapd.ubus.disconnect();
+	},
+	bss_create: function(phy, name, obj) {
+		phy = hostapd.data.config[phy];
+		if (!phy)
+			return;
+
+		if (phy.radio_idx != null && phy.radio_idx >= 0)
+			wdev_set_radio_mask(name, 1 << phy.radio_idx);
+	},
+	bss_add: function(phy, name, obj) {
+		bss_event("add", name);
+	},
+	bss_reload: function(phy, name, obj, reconf) {
+		bss_event("reload", name, { reconf: reconf != 0 });
+	},
+	bss_remove: function(phy, name, obj) {
+		bss_event("remove", name);
+	},
+	sta_auth: function(iface, sta) {
+		let msg = { iface, sta };
+		let ret = {};
+		let data_cb = (type, data) => {
+			ret = { ...ret, ...data };
+		};
+		if (hostapd.data.auth_obj)
+			hostapd.data.auth_obj.notify("sta_auth", msg, data_cb, null, null, 1000);
+		return ret;
+	},
+	sta_connected: function(iface, sta, data) {
+		let msg = { iface, sta, ...data };
+		let ret = {};
+		let data_cb = (type, data) => {
+			ret = { ...ret, ...data };
+		};
+		if (hostapd.data.auth_obj)
+			hostapd.data.auth_obj.notify("sta_connected", msg, data_cb, null, null, 1000);
+		return ret;
+	},
+};
diff --git a/wireless-scripts-example/mtk-feed/mac80211.sh b/wireless-scripts-example/mtk-feed/mac80211.sh
new file mode 100755
index 0000000000..a89b086a68
--- /dev/null
+++ b/wireless-scripts-example/mtk-feed/mac80211.sh
@@ -0,0 +1,350 @@
+#!/usr/bin/ucode
+
+'use strict';
+
+import { set_default, log } from 'wifi.common';
+import { validate, dump_options } from 'wifi.validate';
+import * as supplicant from 'wifi.supplicant';
+import * as hostapd from 'wifi.hostapd';
+import * as netifd from 'wifi.netifd';
+import * as iface from 'wifi.iface';
+import { find_phy } from 'wifi.utils';
+import * as nl80211 from 'nl80211';
+import * as fs from 'fs';
+
+global.radio = ARGV[2];
+
+const mesh_param_list = [
+	"mesh_retry_timeout", "mesh_confirm_timeout", "mesh_holding_timeout", "mesh_max_peer_links",
+	"mesh_max_retries", "mesh_ttl", "mesh_element_ttl", "mesh_hwmp_max_preq_retries",
+	"mesh_path_refresh_time", "mesh_min_discovery_timeout", "mesh_hwmp_active_path_timeout",
+	"mesh_hwmp_preq_min_interval", "mesh_hwmp_net_diameter_traversal_time", "mesh_hwmp_rootmode",
+	"mesh_hwmp_rann_interval", "mesh_gate_announcements", "mesh_sync_offset_max_neighor",
+	"mesh_rssi_threshold", "mesh_hwmp_active_path_to_root_timeout", "mesh_hwmp_root_interval",
+	"mesh_hwmp_confirmation_interval", "mesh_awake_window", "mesh_plink_timeout",
+	"mesh_auto_open_plinks", "mesh_fwding", "mesh_nolearn", "mesh_power_mode"
+];
+
+function phy_suffix(radio, sep) {
+	if (radio == null || radio < 0)
+		return "";
+	return sep + radio;
+}
+
+function reset_config(phy, radio) {
+	let name = phy + phy_suffix(radio, ".");
+	let prev_config = `/var/run/hostapd-${name}.conf`;
+
+	global.ubus.call('hostapd', 'config_set', { phy, radio, config: '', prev_config });
+	global.ubus.call('wpa_supplicant', 'config_set', { phy, radio, config: []});
+
+	name = phy + phy_suffix(radio, ":");
+	system(`ucode /usr/share/hostap/wdev.uc ${name} set_config '{}'`);
+}
+
+function get_channel_frequency(band, channel) {
+	if (channel < 1)
+		return null;
+
+	switch (band) {
+	case '2g':
+		if (channel == 14)
+			return 2484;
+		return 2407 + channel * 5;
+	case '5g':
+		if (channel >= 182 && channel <= 196)
+			return 4000 + channel * 5;
+		return 5000 + channel * 5;
+	case '6g':
+		if (channel == 2)
+			return 5935;
+		return 5950 + channel * 5;
+	case '60g':
+		return 56160 + channel * 2160;
+	}
+}
+
+function setup_phy(phy, config, data) {
+	if (config.channel == "auto")
+		config.channel = 0;
+	config.channel = +config.channel;
+	config.frequency = get_channel_frequency(config.band, config.channel);
+
+	if (config.country) {
+		log(`Setting country code to ${config.country}`);
+		system(`iw reg set ${config.country}`);
+	}
+
+	set_default(config, 'rxantenna', 0xffffffff);
+	set_default(config, 'txantenna', 0xffffffff);
+
+	if (config.txantenna == 'all')
+		config.txantenna = 0xffffffff;
+	if (config.rxantenna == 'all')
+		config.rxantenna = 0xffffffff;
+
+	if (config.txantenna != data?.txantenna || config.rxantenna != data?.rxantenna)
+		reset_config(phy, config.radio);
+
+	netifd.set_data({
+		phy,
+		radio: config.radio,
+		txantenna: config.txantenna,
+		rxantenna: config.rxantenna
+	});
+
+	log(`Configuring '${phy}' txantenna: ${config.txantenna}, rxantenna: ${config.rxantenna} distance: ${config.distance}`);
+	system(`iw phy ${phy} set antenna ${config.txantenna} ${config.rxantenna} radio ${config.radio}`);
+	system(`iw phy ${phy} set distance ${config.distance}`);
+	system(`iw phy ${phy} set txpower auto radio ${config.radio}`);
+
+	if (config.frag)
+		system(`iw phy ${phy} set frag ${config.frag}`);
+	if (config.rts)
+		system(`iw phy ${phy} set rts ${config.rts} radio ${config.radio}`);
+}
+
+function iw_htmode(config) {
+	let suffix = substr(config.htmode, 3);
+	if (suffix == "40+" || suffix == "40-")
+		return "HT" + suffix;
+
+	switch (config.htmode ?? "NONE") {
+	case "HT20":
+	case "VHT20":
+	case "HE20":
+	case "EHT20":
+		return "HT20";
+	case "VHT80":
+	case "HE80":
+	case "EHT80":
+	case "HE160":
+	case "EHT160":
+	case "EHT320":
+		return "80MHZ";
+	case "NONE":
+	case "NOHT":
+		return "NOHT";
+	}
+
+	if (substr(config.htmode, 2) == "40") {
+		switch (config.band) {
+		case "2g":
+			if (+config.channel < 7)
+				return "HT40+";
+			else
+				return "HT40-";
+		default:
+			return ((+config.channel / 4) % 2) ? "HT40+" : "HT40-";
+		}
+	}
+
+	return null;
+}
+
+function config_add(config, name, val) {
+	if (val != null)
+		config[name] = val;
+}
+
+function config_add_mesh_params(config, data) {
+	for (let param in mesh_param_list)
+		config_add(config, param, data[param]);
+}
+
+function setup() {
+	let data = json(ARGV[3]);
+
+	data.phy = find_phy(data.config, true);
+	if (!data.phy) {
+		log('Bug: PHY is undefined for device');
+		netifd.set_retry(false);
+		return 1;
+	}
+	data.phy_suffix = phy_suffix(data.config.radio, ":");
+	data.vif_phy_suffix = phy_suffix(data.config.radio, ".");
+	data.ifname_prefix = data.config.ifname_prefix;
+	if (!data.ifname_prefix)
+		data.ifname_prefix = data.phy + data.vif_phy_suffix + "-";
+	let active_ifnames = [];
+
+	log('Starting');
+
+	let config = data.config;
+
+	if (!config.band) {
+		switch (config.hwmode) {
+		case 'a':
+		case '11a':
+			config.band = '5g';
+			break;
+		case 'ad':
+		case '11ad':
+			config.band = '60g';
+			break;
+		case 'b':
+		case 'g':
+		case '11b':
+		case '11g':
+		default:
+			config.band = '2g';
+			break;
+		}
+	}
+	delete config.hwmode;
+
+	validate('device', config);
+	setup_phy(data.phy, data.config, data.data);
+
+	let supplicant_mesh;
+	let has_ap = false;
+	let idx = {};
+	let supplicant_data = [];
+	let wdev_data = {};
+
+	for (let k, v in data.interfaces) {
+		let mode = v.config.mode;
+		idx[mode] ??= 0;
+		let mode_idx = idx[mode]++;
+
+		if (!v.config.ifname) 
+			v.config.ifname = data.ifname_prefix + mode + mode_idx;
+		push(active_ifnames, v.config.ifname);
+
+		if (v.config.encryption == 'owe' && v.config.owe_transition) {
+			mode_idx = idx[mode]++;
+			v.config.owe_transition_ifname = data.ifname_prefix + mode + mode_idx;
+			push(active_ifnames, v.config.ifname);
+		}
+
+		switch (mode) {
+		case 'ap':
+			has_ap = true;
+			for (let _, sta in v.stas)
+				validate('station', sta.config);
+			// fallthrough
+		case 'sta':
+		case 'adhoc':
+		case 'mesh':
+			if (mode != "ap")
+				data.config.noscan = true;
+			validate('iface', v.config);
+			iface.prepare(v.config, data.phy + data.phy_suffix, data.config.num_global_macaddr, data.config.macaddr_base);
+			netifd.set_vif(k, v.config.ifname);
+			break;
+		}
+
+		switch (mode) {
+		case 'adhoc':
+			if (config.frequency && !v.config.wpa)
+				break;
+			// fallthrough
+		case 'mesh':
+			supplicant_mesh ??= !system("wpa_supplicant -vmesh");
+			if (mode == "mesh" && !supplicant_mesh)
+				break;
+			// fallthrough
+		case 'sta':
+			data.ap_start_disabled = true;
+			let config = supplicant.generate(supplicant_data, data, v);
+			if (mode == "mesh")
+				config_add_mesh_params(config, v.config);
+			continue;
+		case 'monitor':
+			break;
+		default:
+			continue;
+		}
+
+		// fallback to wdev setup
+		let config = {
+			mode,
+			ssid: v.config.ssid,
+		};
+
+		if (!v.config.default_macaddr)
+			config.macaddr = v.config.macaddr;
+
+		config_add(config, "freq", data.config.frequency);
+		config_add(config, "htmode", iw_htmode(data.config));
+		if (mode != "monitor") {
+			let basic_rate_list = v.config.basic_rate ?? data.config.basic_rate;
+			config_add(config, "basic-rates", supplicant.ratelist(basic_rate_list));
+			config_add(config, "mcast-rate", supplicant.ratestr(v.config.mcast_rate));
+			config_add(config, "beacon-interval", data.config.beacon_int);
+			if (mode == "adhoc")
+				config_add(config, "bssid", v.config.bssid);
+			if (mode == "mesh") {
+				config_add(config, "ssid", v.config.mesh_id);
+				config_add_mesh_params(config, v.config);
+			}
+		}
+
+		wdev_data[v.config.ifname] = config;
+	}
+
+	if (fs.access('/usr/sbin/wpa_supplicant', 'x'))
+		supplicant.setup(supplicant_data, data);
+
+	if (fs.access('/usr/sbin/hostapd', 'x'))
+		hostapd.setup(data);
+
+	system(`ucode /usr/share/hostap/wdev.uc ${data.phy}${data.phy_suffix} set_config '${printf("%J", wdev_data)}' ${join(' ', active_ifnames)}`);
+
+	if (length(supplicant_data) > 0)
+		supplicant.start(data);
+
+	netifd.set_up();
+
+	system(`echo "${data.config.sr_enable}" > /sys/kernel/debug/ieee80211/phy0/mt76/band${data.config.radio}/sr_enable`);
+	system(`echo "${data.config.sr_enhanced}" > /sys/kernel/debug/ieee80211/phy0/mt76/band${data.config.radio}/sr_enhanced_enable`);
+
+	if (data.config.txpower)
+		data.config.txpower = 'fixed ' + data.config.txpower + '00';
+	else
+		data.config.txpower = 'auto';
+
+	system(`iw phy ${data.phy} set txpower ${data.config.txpower} radio ${data.config.radio}`);
+
+	log(`Setup SMP Affinity`);
+	system(`/sbin/smp-mt76.sh`);
+	system(`echo /tmp/%e.core > /proc/sys/kernel/core_pattern`);
+
+	return 0;
+}
+
+function teardown() {
+	let data = json(ARGV[3]);
+
+	if (ARGV[2] == "#mlo")
+		return 0;
+
+	if (!data.data?.phy) {
+		log('Bug: PHY is undefined for device');
+		return 1;
+	}
+
+	log(`Tearing down ${data.data.phy}`);
+
+	reset_config(data.data.phy, data.data.radio);
+
+	return 0;
+}
+
+let ret = 1;
+
+switch(ARGV[1]) {
+case 'dump':
+	ret = dump_options();
+	break;
+
+case 'setup':
+	ret = setup();
+	break;
+
+case 'teardown':
+	ret = teardown();
+	break;
+}
+
+exit(ret);
diff --git a/wireless-scripts-example/mtk-feed/netifd-proto.sh b/wireless-scripts-example/mtk-feed/netifd-proto.sh
new file mode 100644
index 0000000000..0093c6aa3a
--- /dev/null
+++ b/wireless-scripts-example/mtk-feed/netifd-proto.sh
@@ -0,0 +1,484 @@
+NETIFD_MAIN_DIR="${NETIFD_MAIN_DIR:-/lib/netifd}"
+PROTO_DEFAULT_OPTIONS="defaultroute peerdns metric"
+if [ -f /usr/share/libubox/jshn.sh ]; then
+	. /usr/share/libubox/jshn.sh
+else
+	. /usr/local/share/libubox/jshn.sh
+fi
+. $NETIFD_MAIN_DIR/utils.sh
+
+proto_config_add_int() {
+	config_add_int "$@"
+}
+
+proto_config_add_string() {
+	config_add_string "$@"
+}
+
+proto_config_add_boolean() {
+	config_add_boolean "$@"
+}
+
+proto_config_add_array() {
+	config_add_array "$@"
+}
+
+proto_config_add_defaults() {
+	proto_config_add_boolean "defaultroute"
+	proto_config_add_boolean "peerdns"
+	proto_config_add_boolean "renew"
+	proto_config_add_int "metric"
+}
+
+proto_add_dynamic_defaults() {
+	[ -n "$defaultroute" ] && json_add_boolean defaultroute "$defaultroute"
+	[ -n "$peerdns" ] && json_add_boolean peerdns "$peerdns"
+	[ -n "$metric" ] && json_add_int metric "$metric"
+}
+
+_proto_do_teardown() {
+	json_load "$data"
+	eval "proto_$1_teardown \"$interface\" \"$ifname\""
+}
+
+_proto_do_renew() {
+	json_load "$data"
+	eval "proto_$1_renew \"$interface\" \"$ifname\""
+}
+
+_proto_do_setup() {
+	json_load "$data"
+	_EXPORT_VAR=0
+	_EXPORT_VARS=
+	eval "proto_$1_setup \"$interface\" \"$ifname\""
+}
+
+proto_init_update() {
+	local ifname="$1"
+	local up="$2"
+	local external="$3"
+
+	PROTO_KEEP=0
+	PROTO_INIT=1
+	PROTO_TUNNEL_OPEN=
+	PROTO_IPADDR=
+	PROTO_IP6ADDR=
+	PROTO_ROUTE=
+	PROTO_ROUTE6=
+	PROTO_PREFIX6=
+	PROTO_DNS=
+	PROTO_DNS_SEARCH=
+	PROTO_NEIGHBOR=
+	PROTO_NEIGHBOR6=
+	json_init
+	json_add_int action 0
+	[ -n "$ifname" -a "*" != "$ifname" ] && json_add_string "ifname" "$ifname"
+	json_add_boolean "link-up" "$up"
+	[ -n "$3" ] && json_add_boolean "address-external" "$external"
+}
+
+proto_set_keep() {
+	PROTO_KEEP="$1"
+}
+
+proto_close_nested() {
+	[ -n "$PROTO_NESTED_OPEN" ] && json_close_object
+	PROTO_NESTED_OPEN=
+}
+
+proto_add_nested() {
+	PROTO_NESTED_OPEN=1
+	json_add_object "$1"
+}
+
+proto_add_tunnel() {
+	proto_add_nested "tunnel"
+}
+
+proto_close_tunnel() {
+	proto_close_nested
+}
+
+proto_add_data() {
+	proto_add_nested "data"
+}
+
+proto_close_data() {
+	proto_close_nested
+}
+
+proto_add_dns_server() {
+	local address="$1"
+
+	append PROTO_DNS "$address"
+}
+
+proto_add_dns_search() {
+	local address="$1"
+
+	append PROTO_DNS_SEARCH "$address"
+}
+
+proto_add_ipv4_address() {
+	local address="$1"
+	local mask="$2"
+	local broadcast="$3"
+	local ptp="$4"
+
+	append PROTO_IPADDR "$address/$mask/$broadcast/$ptp"
+}
+
+proto_add_ipv6_address() {
+	local address="$1"
+	local mask="$2"
+	local preferred="$3"
+	local valid="$4"
+	local offlink="$5"
+	local class="$6"
+
+	append PROTO_IP6ADDR "$address/$mask/$preferred/$valid/$offlink/$class"
+}
+
+proto_add_ipv4_neighbor(){
+	local address="$1"
+	local mac="$2"
+	local proxy="$3"
+
+	append PROTO_NEIGHBOR "$address/$mac/$proxy"
+}
+
+proto_add_ipv6_neighbor(){
+	local address="$1"
+	local mac="$2"
+	local proxy="$3"
+	local router="$4"
+
+	append PROTO_NEIGHBOR6 "$address/$mac/$proxy/$router"
+}
+
+proto_add_ipv4_route() {
+	local target="$1"
+	local mask="$2"
+	local gw="$3"
+	local source="$4"
+	local metric="$5"
+
+	append PROTO_ROUTE "$target/$mask/$gw/$metric///$source"
+}
+
+proto_add_ipv6_route() {
+	local target="$1"
+	local mask="$2"
+	local gw="$3"
+	local metric="$4"
+	local valid="$5"
+	local source="$6"
+	local table="$7"
+
+	append PROTO_ROUTE6 "$target/$mask/$gw/$metric/$valid/$table/$source"
+}
+
+proto_add_ipv6_prefix() {
+	local prefix="$1"
+	local valid="$2"
+	local preferred="$3"
+
+	if [ -z "$valid" ]; then
+		append PROTO_PREFIX6 "$prefix"
+	else
+		[ -z "$preferred" ] && preferred="$valid"
+		append PROTO_PREFIX6 "$prefix,$valid,$preferred"
+	fi
+}
+
+_proto_push_ipv4_addr() {
+	local str="$1"
+	local address mask broadcast ptp
+
+	address="${str%%/*}"
+	str="${str#*/}"
+	mask="${str%%/*}"
+	str="${str#*/}"
+	broadcast="${str%%/*}"
+	str="${str#*/}"
+	ptp="$str"
+
+	json_add_object ""
+	json_add_string ipaddr "$address"
+	[ -n "$mask" ] && json_add_string mask "$mask"
+	[ -n "$broadcast" ] && json_add_string broadcast "$broadcast"
+	[ -n "$ptp" ] && json_add_string ptp "$ptp"
+	json_close_object
+}
+
+_proto_push_ipv6_addr() {
+	local str="$1"
+	local address mask preferred valid offlink
+
+	address="${str%%/*}"
+	str="${str#*/}"
+	mask="${str%%/*}"
+	str="${str#*/}"
+	preferred="${str%%/*}"
+	str="${str#*/}"
+	valid="${str%%/*}"
+	str="${str#*/}"
+	offlink="${str%%/*}"
+	str="${str#*/}"
+	class="${str%%/*}"
+
+	json_add_object ""
+	json_add_string ipaddr "$address"
+	[ -n "$mask" ] && json_add_string mask "$mask"
+	[ -n "$preferred" ] && json_add_int preferred "$preferred"
+	[ -n "$valid" ] && json_add_int valid "$valid"
+	[ -n "$offlink" ] && json_add_boolean offlink "$offlink"
+	[ -n "$class" ] && json_add_string class "$class"
+	json_close_object
+}
+
+_proto_push_string() {
+	json_add_string "" "$1"
+}
+
+_proto_push_ipv4_neighbor(){
+	local str="$1"
+	local address mac proxy
+
+	address="${str%%/*}"
+	str="${str#*/}"
+	mac="${str%%/*}"
+	str="${str#*/}"
+	proxy="${str%%/*}"
+
+	json_add_object ""
+	json_add_string ipaddr "$address"
+	[ -n "$mac" ] && json_add_string mac "$mac"
+	[ -n "$proxy" ] && json_add_boolean proxy "$proxy"
+	json_close_object
+}
+
+_proto_push_ipv6_neighbor(){
+	local str="$1"
+	local address mac proxy router
+
+	address="${str%%/*}"
+	str="${str#*/}"
+	mac="${str%%/*}"
+	str="${str#*/}"
+	proxy="${str%%/*}"
+	str="${str#*/}"
+	router="${str%%/*}"
+
+	json_add_object ""
+	json_add_string ipaddr "$address"
+	[ -n "$mac" ] && json_add_string mac "$mac"
+	[ -n "$proxy" ] && json_add_boolean proxy "$proxy"
+	[ -n "$router" ] && json_add_boolean router "$router"
+	json_close_object
+}
+
+_proto_push_route() {
+	local str="$1";
+	local target="${str%%/*}"
+	str="${str#*/}"
+	local mask="${str%%/*}"
+	str="${str#*/}"
+	local gw="${str%%/*}"
+	str="${str#*/}"
+	local metric="${str%%/*}"
+	str="${str#*/}"
+	local valid="${str%%/*}"
+	str="${str#*/}"
+	local table="${str%%/*}"
+	str="${str#*/}"
+	local source="${str}"
+
+	json_add_object ""
+	json_add_string target "$target"
+	json_add_string netmask "$mask"
+	[ -n "$gw" ] && json_add_string gateway "$gw"
+	[ -n "$metric" ] && json_add_int metric "$metric"
+	[ -n "$valid" ] && json_add_int valid "$valid"
+	[ -n "$source" ] && json_add_string source "$source"
+	[ -n "$table" ] && json_add_string table "$table"
+	json_close_object
+}
+
+_proto_push_array() {
+	local name="$1"
+	local val="$2"
+	local cb="$3"
+
+	[ -n "$val" ] || return 0
+	json_add_array "$name"
+	for item in $val; do
+		eval "$cb \"\$item\""
+	done
+	json_close_array
+}
+
+_proto_notify() {
+	local interface="$1"
+	local options="$2"
+	json_add_string "interface" "$interface"
+	ubus $options call network.interface notify_proto "$(json_dump)"
+}
+
+proto_send_update() {
+	local interface="$1"
+
+	proto_close_nested
+	json_add_boolean keep "$PROTO_KEEP"
+	_proto_push_array "ipaddr" "$PROTO_IPADDR" _proto_push_ipv4_addr
+	_proto_push_array "ip6addr" "$PROTO_IP6ADDR" _proto_push_ipv6_addr
+	_proto_push_array "routes" "$PROTO_ROUTE" _proto_push_route
+	_proto_push_array "routes6" "$PROTO_ROUTE6" _proto_push_route
+	_proto_push_array "ip6prefix" "$PROTO_PREFIX6" _proto_push_string
+	_proto_push_array "dns" "$PROTO_DNS" _proto_push_string
+	_proto_push_array "dns_search" "$PROTO_DNS_SEARCH" _proto_push_string
+	_proto_push_array "neighbor" "$PROTO_NEIGHBOR" _proto_push_ipv4_neighbor
+	_proto_push_array "neighbor6" "$PROTO_NEIGHBOR6" _proto_push_ipv6_neighbor
+	_proto_notify "$interface"
+}
+
+proto_export() {
+	local var="VAR${_EXPORT_VAR}"
+	_EXPORT_VAR="$(($_EXPORT_VAR + 1))"
+	export -- "$var=$1"
+	append _EXPORT_VARS "$var"
+}
+
+proto_run_command() {
+	local interface="$1"; shift
+
+	json_init
+	json_add_int action 1
+	json_add_array command
+	while [ $# -gt 0 ]; do
+		json_add_string "" "$1"
+		shift
+	done
+	json_close_array
+	[ -n "$_EXPORT_VARS" ] && {
+		json_add_array env
+		for var in $_EXPORT_VARS; do
+			eval "json_add_string \"\" \"\${$var}\""
+		done
+		json_close_array
+	}
+	_proto_notify "$interface"
+}
+
+proto_kill_command() {
+	local interface="$1"; shift
+
+	json_init
+	json_add_int action 2
+	[ -n "$1" ] && json_add_int signal "$1"
+	_proto_notify "$interface"
+}
+
+proto_notify_error() {
+	local interface="$1"; shift
+
+	json_init
+	json_add_int action 3
+	json_add_array error
+	while [ $# -gt 0 ]; do
+		json_add_string "" "$1"
+		shift
+	done
+	json_close_array
+	_proto_notify "$interface"
+}
+
+proto_block_restart() {
+	local interface="$1"; shift
+
+	json_init
+	json_add_int action 4
+	_proto_notify "$interface"
+}
+
+proto_set_available() {
+	local interface="$1"
+	local state="$2"
+	json_init
+	json_add_int action 5
+	json_add_boolean available "$state"
+	_proto_notify "$interface"
+}
+
+proto_add_host_dependency() {
+	local interface="$1"
+	local host="$2"
+	local ifname="$3"
+
+	# execute in subshell to not taint callers env
+	# see tickets #11046, #11545, #11570
+	(
+		json_init
+		json_add_int action 6
+		json_add_string host "$host"
+		[ -n "$ifname" ] && json_add_string ifname "$ifname"
+		_proto_notify "$interface" -S
+	)
+}
+
+proto_setup_failed() {
+	local interface="$1"
+	json_init
+	json_add_int action 7
+	_proto_notify "$interface"
+}
+
+init_proto() {
+	proto="$1"; shift
+	cmd="$1"; shift
+
+	case "$cmd" in
+		dump)
+			add_protocol() {
+				no_device=0
+				no_device_config=0
+				no_proto_task=0
+				available=0
+				renew_handler=0
+				teardown_on_l3_link_down=0
+
+				add_default_handler "proto_$1_init_config"
+
+				json_init
+				json_add_string "name" "$1"
+				json_add_array "config"
+				eval "proto_$1_init_config"
+				json_close_array
+				json_add_boolean no-device "$no_device"
+				json_add_boolean no-device-config "$no_device_config"
+				json_add_boolean no-proto-task "$no_proto_task"
+				json_add_boolean available "$available"
+				json_add_boolean renew-handler "$renew_handler"
+				json_add_boolean lasterror "$lasterror"
+				json_add_boolean teardown-on-l3-link-down "$teardown_on_l3_link_down"
+				json_dump
+			}
+		;;
+		setup|teardown|renew)
+			interface="$1"; shift
+			data="$1"; shift
+			ifname="$1"; shift
+
+			add_protocol() {
+				[[ "$proto" == "$1" ]] || return 0
+
+				case "$cmd" in
+					setup) _proto_do_setup "$1";;
+					teardown) _proto_do_teardown "$1" ;;
+					renew) _proto_do_renew "$1" ;;
+					*) return 1 ;;
+				esac
+			}
+		;;
+	esac
+}
diff --git a/wireless-scripts-example/mtk-feed/netifd-wireless.sh b/wireless-scripts-example/mtk-feed/netifd-wireless.sh
new file mode 100644
index 0000000000..873787360c
--- /dev/null
+++ b/wireless-scripts-example/mtk-feed/netifd-wireless.sh
@@ -0,0 +1,451 @@
+NETIFD_MAIN_DIR="${NETIFD_MAIN_DIR:-/lib/netifd}"
+
+. /usr/share/libubox/jshn.sh
+. $NETIFD_MAIN_DIR/utils.sh
+
+CMD_UP=0
+CMD_SET_DATA=1
+CMD_PROCESS_ADD=2
+CMD_PROCESS_KILL_ALL=3
+CMD_SET_RETRY=4
+
+add_driver() {
+	return
+}
+
+wireless_setup_vif_failed() {
+	local error="$1"
+	echo "Interface $_w_iface setup failed: $error"
+}
+
+wireless_setup_failed() {
+	local error="$1"
+
+	echo "Device setup failed: $error"
+	wireless_set_retry 0
+}
+
+prepare_key_wep() {
+	local key="$1"
+	local hex=1
+
+	echo -n "$key" | grep -qE "[^a-fA-F0-9]" && hex=0
+	[ "${#key}" -eq 10 -a $hex -eq 1 ] || \
+	[ "${#key}" -eq 26 -a $hex -eq 1 ] || {
+		[ "${key:0:2}" = "s:" ] && key="${key#s:}"
+		key="$(echo -n "$key" | hexdump -ve '1/1 "%02x" ""')"
+	}
+	echo "$key"
+}
+
+_wdev_prepare_channel() {
+	json_get_vars channel band hwmode htmode
+
+	auto_channel=0
+	enable_ht=0
+	hwmode="${hwmode##11}"
+
+	case "$channel" in
+		""|0|auto)
+			channel=0
+			auto_channel=1
+		;;
+		[0-9]*) ;;
+		*)
+			wireless_setup_failed "INVALID_CHANNEL"
+		;;
+	esac
+
+	case "$hwmode" in
+		a|b|g|ad) ;;
+		*)
+			if [ "$channel" -gt 14 ]; then
+				hwmode=a
+			else
+				hwmode=g
+			fi
+		;;
+	esac
+
+	case "$band" in
+		2g) hwmode=g;;
+		5g|6g) hwmode=a;;
+		60g) hwmode=ad;;
+		*)
+			case "$hwmode" in
+				*a) band=5g;;
+				*ad) band=60g;;
+				*b|*g) band=2g;;
+			esac
+		;;
+	esac
+
+	case "$htmode" in
+		HE*|EHT*) wpa3_cipher="GCMP-256 ";;
+		*) wpa3_cipher="";;
+	esac
+}
+
+_wdev_handler() {
+	json_load "$data"
+
+	json_select config
+	_wdev_prepare_channel
+	json_select ..
+
+	eval "drv_$1_$2 \"$interface\""
+}
+
+_wdev_msg_call() {
+	local old_cb
+
+	json_set_namespace wdev old_cb
+	"$@"
+	json_set_namespace $old_cb
+}
+
+_wdev_wrapper() {
+	while [ -n "$1" ]; do
+		eval "$1() { _wdev_msg_call _$1 \"\$@\"; }"
+		shift
+	done
+}
+
+_wdev_notify_init() {
+	local command="$1"; shift;
+
+	json_init
+	json_add_int "command" "$command"
+	json_add_string "device" "$__netifd_device"
+	while [ -n "$1" ]; do
+		local name="$1"; shift
+		local value="$1"; shift
+		json_add_string "$name" "$value"
+	done
+	json_add_object "data"
+}
+
+_wdev_notify() {
+	local options="$1"
+
+	json_close_object
+	ubus $options call network.wireless notify "$(json_dump)"
+}
+
+_wdev_add_variables() {
+	while [ -n "$1" ]; do
+		local var="${1%%=*}"
+		local val="$1"
+		shift
+		[[ "$var" = "$val" ]] && continue
+		val="${val#*=}"
+		json_add_string "$var" "$val"
+	done
+}
+
+_wireless_add_vif() {
+	local name="$1"; shift
+	local ifname="$1"; shift
+
+	_wdev_notify_init $CMD_SET_DATA "interface" "$name"
+	json_add_string "ifname" "$ifname"
+	_wdev_add_variables "$@"
+	_wdev_notify
+}
+
+_wireless_add_vlan() {
+	local name="$1"; shift
+	local ifname="$1"; shift
+
+	_wdev_notify_init $CMD_SET_DATA interface "$__cur_interface" "vlan" "$name"
+	json_add_string "ifname" "$ifname"
+	_wdev_add_variables "$@"
+	_wdev_notify
+}
+
+_wireless_set_up() {
+	_wdev_notify_init $CMD_UP
+	_wdev_notify
+}
+
+_wireless_set_data() {
+	_wdev_notify_init $CMD_SET_DATA
+	_wdev_add_variables "$@"
+	_wdev_notify
+}
+
+_wireless_add_process() {
+	_wdev_notify_init $CMD_PROCESS_ADD
+	local exe="$2"
+	[ -L "$exe" ] && exe="$(readlink -f "$exe")"
+	json_add_int pid "$1"
+	json_add_string exe "$exe"
+	[ -n "$3" ] && json_add_boolean required 1
+	[ -n "$4" ] && json_add_boolean keep 1
+	exe2="$(readlink -f /proc/$1/exe)"
+	[ "$exe" != "$exe2" ] && echo "WARNING (wireless_add_process): executable path $exe does not match process $1 path ($exe2)"
+	_wdev_notify
+}
+
+_wireless_process_kill_all() {
+	_wdev_notify_init $CMD_PROCESS_KILL_ALL
+	[ -n "$1" ] && json_add_int signal "$1"
+	_wdev_notify
+}
+
+_wireless_set_retry() {
+	_wdev_notify_init $CMD_SET_RETRY
+	json_add_int retry "$1"
+	_wdev_notify
+}
+
+_wdev_wrapper \
+	wireless_add_vif \
+	wireless_add_vlan \
+	wireless_set_up \
+	wireless_set_data \
+	wireless_add_process \
+	wireless_process_kill_all \
+	wireless_set_retry \
+
+wireless_vif_parse_encryption() {
+	json_get_vars encryption rsn_override
+	set_default encryption none
+
+	set_default rsn_override 1
+	auth_mode_open=1
+	auth_mode_shared=0
+	auth_type=none
+	wpa_override_cipher=
+	rsn_override_pairwise=
+
+	if [ "$hwmode" = "ad" ]; then
+		wpa_cipher="GCMP"
+	else
+		wpa_cipher="CCMP"
+		case "$encryption" in
+			sae*|wpa3*|psk3*|owe)
+				if [ "$rsn_override" -gt 0 ]; then
+					wpa_override_cipher="${wpa3_cipher}$wpa_cipher"
+				else
+					wpa_cipher="${wpa3_cipher}$wpa_cipher"
+				fi
+			;;
+		esac
+	fi
+
+	case "$encryption" in
+		*tkip+aes|*tkip+ccmp|*aes+tkip|*ccmp+tkip) wpa_cipher="CCMP TKIP";;
+		*ccmp256) wpa_cipher="CCMP-256";;
+		*aes|*ccmp) wpa_cipher="CCMP";;
+		*tkip) wpa_cipher="TKIP";;
+		*gcmp256) wpa_cipher="GCMP-256";;
+		*gcmp) wpa_cipher="GCMP";;
+		wpa3-192*) wpa_cipher="GCMP-256";;
+		*) rsn_override_pairwise="$wpa_override_cipher";;
+	esac
+
+	# 802.11n requires CCMP for WPA
+	[ "$enable_ht:$wpa_cipher" = "1:TKIP" ] && wpa_cipher="CCMP TKIP"
+
+	# Examples:
+	# psk-mixed/tkip    => WPA1+2 PSK, TKIP
+	# wpa-psk2/tkip+aes => WPA2 PSK, CCMP+TKIP
+	# wpa2/tkip+aes     => WPA2 RADIUS, CCMP+TKIP
+
+	case "$encryption" in
+		wpa2*|wpa3*|*psk2*|psk3*|sae*|owe*)
+			wpa=2
+		;;
+		wpa*mixed*|*psk*mixed*)
+			wpa=3
+		;;
+		wpa*|*psk*)
+			wpa=1
+		;;
+		*)
+			wpa=0
+			wpa_cipher=
+		;;
+	esac
+	wpa_pairwise="$wpa_cipher"
+
+	case "$encryption" in
+		owe*)
+			auth_type=owe
+		;;
+		wpa3-192*)
+			auth_type=eap192
+		;;
+		wpa3-mixed*)
+			auth_type=eap-eap2
+		;;
+		wpa3*)
+			auth_type=eap2
+		;;
+		psk3-mixed*|sae-mixed*)
+			auth_type=psk-sae
+		;;
+		psk3*|sae*)
+			auth_type=sae
+		;;
+		*psk*)
+			auth_type=psk
+		;;
+		*wpa*|*8021x*)
+			auth_type=eap
+		;;
+		*wep*)
+			auth_type=wep
+			case "$encryption" in
+				*shared*)
+					auth_mode_open=0
+					auth_mode_shared=1
+				;;
+				*mixed*)
+					auth_mode_shared=1
+				;;
+			esac
+		;;
+	esac
+}
+
+_wireless_set_brsnoop_isolation() {
+	local multicast_to_unicast="$1"
+	local isolate
+
+	json_get_vars isolate proxy_arp
+
+	[ ${isolate:-0} -gt 0 -o -z "$network_bridge" ] && return
+	[ ${multicast_to_unicast:-1} -gt 0 -o ${proxy_arp:-0} -gt 0 ] && json_add_boolean isolate 1
+}
+
+for_each_interface() {
+	local _w_types="$1"; shift
+	local _w_ifaces _w_iface
+	local _w_type
+	local _w_found
+
+	local multicast_to_unicast
+
+	json_get_keys _w_ifaces interfaces
+	json_select interfaces
+	for _w_iface in $_w_ifaces; do
+		json_select "$_w_iface"
+		if [ -n "$_w_types" ]; then
+			json_get_var network_bridge bridge
+			json_get_var network_ifname bridge-ifname
+			json_get_var multicast_to_unicast multicast_to_unicast
+			json_select config
+			_wireless_set_brsnoop_isolation "$multicast_to_unicast"
+			json_get_var _w_type mode
+			json_select ..
+			_w_types=" $_w_types "
+			[[ "${_w_types%$_w_type*}" = "$_w_types" ]] && {
+				json_select ..
+				continue
+			}
+		fi
+		__cur_interface="$_w_iface"
+		"$@" "$_w_iface"
+		json_select ..
+	done
+	json_select ..
+}
+
+for_each_vlan() {
+	local _w_vlans _w_vlan
+
+	json_get_keys _w_vlans vlans
+	json_select vlans
+	for _w_vlan in $_w_vlans; do
+		json_select "$_w_vlan"
+		json_select config
+		"$@" "$_w_vlan"
+		json_select ..
+		json_select ..
+	done
+	json_select ..
+}
+
+for_each_station() {
+	local _w_stas _w_sta
+
+	json_get_keys _w_stas stas
+	json_select stas
+	for _w_sta in $_w_stas; do
+		json_select "$_w_sta"
+		json_select config
+		"$@" "$_w_sta"
+		json_select ..
+		json_select ..
+	done
+	json_select ..
+}
+
+_wdev_common_device_config() {
+	config_add_string channel hwmode band htmode noscan
+}
+
+_wdev_common_iface_config() {
+	config_add_string mode ssid encryption 'key:wpakey'
+	config_add_boolean bridge_isolate
+	config_add_array tags
+}
+
+_wdev_common_vlan_config() {
+	config_add_string name vid iface
+	config_add_boolean bridge_isolate
+}
+
+_wdev_common_station_config() {
+	config_add_string mac key vid iface
+}
+
+init_wireless_driver() {
+	name="$1"; shift
+	cmd="$1"; shift
+
+	case "$cmd" in
+		dump)
+			add_driver() {
+				eval "drv_$1_cleanup"
+
+				json_init
+				json_add_string name "$1"
+
+				json_add_array device
+				_wdev_common_device_config
+				eval "drv_$1_init_device_config"
+				json_close_array
+
+				json_add_array iface
+				_wdev_common_iface_config
+				eval "drv_$1_init_iface_config"
+				json_close_array
+
+				json_add_array vlan
+				_wdev_common_vlan_config
+				eval "drv_$1_init_vlan_config"
+				json_close_array
+
+				json_add_array station
+				_wdev_common_station_config
+				eval "drv_$1_init_station_config"
+				json_close_array
+
+				json_dump
+			}
+		;;
+		setup|teardown)
+			interface="$1"; shift
+			data="$1"; shift
+			export __netifd_device="$interface"
+
+			add_driver() {
+				[[ "$name" == "$1" ]] || return 0
+				_wdev_handler "$1" "$cmd"
+			}
+		;;
+	esac
+}
diff --git a/wireless-scripts-example/mtk-feed/wdev.uc b/wireless-scripts-example/mtk-feed/wdev.uc
new file mode 100644
index 0000000000..166e9403df
--- /dev/null
+++ b/wireless-scripts-example/mtk-feed/wdev.uc
@@ -0,0 +1,183 @@
+#!/usr/bin/env ucode
+'use strict';
+import { vlist_new, is_equal, wdev_set_mesh_params, wdev_remove, wdev_set_up, phy_open } from "/usr/share/hostap/common.uc";
+import { readfile, writefile, basename, readlink, glob } from "fs";
+let libubus = require("ubus");
+
+let keep_devices = {};
+let phy_name = shift(ARGV);
+let command = shift(ARGV);
+let phy, phydev;
+
+function iface_stop(wdev)
+{
+	if (keep_devices[wdev.ifname])
+		return;
+
+	wdev_remove(wdev.ifname);
+}
+
+function iface_start(wdev)
+{
+	let ifname = wdev.ifname;
+
+	if (readfile(`/sys/class/net/${ifname}/ifindex`)) {
+		wdev_set_up(ifname, false);
+		wdev_remove(ifname);
+	}
+	let wdev_config = {};
+	for (let key in wdev)
+		wdev_config[key] = wdev[key];
+	if (!wdev_config.macaddr && wdev.mode != "monitor")
+		wdev_config.macaddr = phydev.macaddr_next();
+	phydev.wdev_add(ifname, wdev_config);
+	wdev_set_up(ifname, true);
+	let htmode = wdev.htmode || "NOHT";
+	if (wdev.freq)
+		system(`iw dev ${ifname} set freq ${wdev.freq} ${htmode}`);
+	if (wdev.mode == "adhoc") {
+		let cmd = ["iw", "dev", ifname, "ibss", "join", wdev.ssid, wdev.freq, htmode, "fixed-freq" ];
+		if (wdev.bssid)
+			push(cmd, wdev.bssid);
+		for (let key in [ "beacon-interval", "basic-rates", "mcast-rate", "keys" ])
+			if (wdev[key])
+				push(cmd, key, wdev[key]);
+		system(cmd);
+	} else if (wdev.mode == "mesh") {
+		let cmd = [ "iw", "dev", ifname, "mesh", "join", wdev.ssid, "freq", wdev.freq, htmode ];
+		for (let key in [ "basic-rates", "mcast-rate", "beacon-interval" ])
+			if (wdev[key])
+				push(cmd, key, wdev[key]);
+		system(cmd);
+
+		wdev_set_mesh_params(ifname, wdev);
+	}
+}
+
+function iface_cb(new_if, old_if)
+{
+	if (old_if && new_if && is_equal(old_if, new_if))
+		return;
+
+	if (old_if)
+		iface_stop(old_if);
+	if (new_if)
+		iface_start(new_if);
+}
+
+function drop_inactive(config)
+{
+	for (let key in config) {
+		if (!readfile(`/sys/class/net/${key}/ifindex`))
+			delete config[key];
+	}
+}
+
+function add_ifname(config)
+{
+	for (let key in config)
+		config[key].ifname = key;
+}
+
+function delete_ifname(config)
+{
+	for (let key in config)
+		delete config[key].ifname;
+}
+
+function add_existing(phydev, config)
+{
+	phydev.for_each_wdev((wdev) => {
+		if (config[wdev])
+			return;
+
+		if (trim(readfile(`/sys/class/net/${wdev}/operstate`)) == "down")
+			config[wdev] = {};
+	});
+}
+
+function usage()
+{
+	warn(`Usage: ${basename(sourcepath())} <phy> <command> [<arguments>]
+
+Commands:
+	set_config <config> [<device]...] - set phy configuration
+	get_macaddr <id>		  - get phy MAC address for vif index <id>
+`);
+	exit(1);
+}
+
+const commands = {
+	set_config: function(args) {
+		let statefile = `/var/run/wdev-${phy_name}.json`;
+
+		let new_config = shift(args);
+		for (let dev in ARGV)
+			keep_devices[dev] = true;
+
+		if (!new_config)
+			usage();
+
+		new_config = json(new_config);
+		if (!new_config) {
+			warn("Invalid configuration\n");
+			exit(1);
+		}
+
+		let old_config = readfile(statefile);
+		if (old_config)
+			old_config = json(old_config);
+
+		let config = vlist_new(iface_cb);
+		if (type(old_config) == "object")
+			config.data = old_config;
+
+		add_existing(phydev, config.data);
+		add_ifname(config.data);
+		drop_inactive(config.data);
+
+		let ubus = libubus.connect();
+		let data = ubus.call("hostapd", "config_get_macaddr_list", { phy: phydev.name, radio: phydev.radio ?? -1 });
+		let macaddr_list = [];
+		if (type(data) == "object" && data.macaddr)
+			macaddr_list = data.macaddr;
+		ubus.disconnect();
+		phydev.macaddr_init(macaddr_list);
+
+		add_ifname(new_config);
+		config.update(new_config);
+
+		drop_inactive(config.data);
+		delete_ifname(config.data);
+		writefile(statefile, sprintf("%J", config.data));
+	},
+	get_macaddr: function(args) {
+		let data = {};
+
+		for (let arg in args) {
+			arg = split(arg, "=", 2);
+			data[arg[0]] = arg[1];
+		}
+
+		let macaddr = phydev.macaddr_generate(data);
+		if (!macaddr) {
+			warn(`Could not get MAC address for phy ${phy_name}\n`);
+			exit(1);
+		}
+
+		print(macaddr + "\n");
+	},
+};
+
+if (!phy_name || !command | !commands[command])
+	usage();
+
+let phy_split = split(phy_name, ":");
+phydev = phy_open(phy_split[0], phy_split[1]);
+phy = phydev.phy;
+if (!phydev) {
+	warn(`PHY ${phy_name} does not exist\n`);
+	exit(1);
+}
+
+commands[command](ARGV);
diff --git a/wireless-scripts-example/mtk-feed/wifi-detect.uc b/wireless-scripts-example/mtk-feed/wifi-detect.uc
new file mode 100644
index 0000000000..cebbc88dd8
--- /dev/null
+++ b/wireless-scripts-example/mtk-feed/wifi-detect.uc
@@ -0,0 +1,262 @@
+#!/usr/bin/env ucode
+'use strict';
+import { readfile, writefile, realpath, glob, basename, unlink, open, rename } from "fs";
+import { is_equal } from "/usr/share/hostap/common.uc";
+let nl = require("nl80211");
+
+let board_file = "/etc/board.json";
+let prev_board_data = json(readfile(board_file));
+let board_data = json(readfile(board_file));
+
+function phy_idx(name) {
+	return +rtrim(readfile(`/sys/class/ieee80211/${name}/index`));
+}
+
+function phy_path(name) {
+	let devpath = realpath(`/sys/class/ieee80211/${name}/device`);
+
+	devpath = replace(devpath, /^\/sys\/devices\//, "");
+	if (match(devpath, /^platform\/.*\/pci/))
+		devpath = replace(devpath, /^platform\//, "");
+	let dev_phys = map(glob(`/sys/class/ieee80211/${name}/device/ieee80211/*`), basename);
+	sort(dev_phys, (a, b) => phy_idx(a) - phy_idx(b));
+
+	let ofs = index(dev_phys, name);
+	if (ofs > 0)
+		devpath += `+${ofs}`;
+
+	return devpath;
+}
+
+function cleanup() {
+	let wlan = board_data.wlan;
+
+	for (let name in wlan)
+		if (substr(name, 0, 3) == "phy")
+			delete wlan[name];
+		else
+			delete wlan[name].info;
+}
+
+function wiphy_get_entry(phy, path) {
+	board_data.wlan ??= {};
+
+	let wlan = board_data.wlan;
+	for (let name in wlan)
+		if (wlan[name].path == path)
+			return wlan[name];
+
+	wlan[phy] = {
+		path: path
+	};
+
+	return wlan[phy];
+}
+
+function freq_to_channel(freq) {
+	if (freq < 1000)
+		return 0;
+	if (freq == 2484)
+		return 14;
+	if (freq == 5935)
+		return 2;
+	if (freq < 2484)
+		return (freq - 2407) / 5;
+	if (freq >= 4910 && freq <= 4980)
+		return (freq - 4000) / 5;
+	if (freq < 5950)
+		return (freq - 5000) / 5;
+	if (freq <= 45000)
+		return (freq - 5950) / 5;
+	if (freq >= 58320 && freq <= 70200)
+		return (freq - 56160) / 2160;
+	return 0;
+}
+
+function freq_range_match(ranges, freq) {
+	freq *= 1000;
+	for (let range in ranges) {
+		if (freq >= range[0] && freq <= range[1])
+			return true;
+	}
+	return false;
+}
+
+function wiphy_detect() {
+	let phys = nl.request(nl.const.NL80211_CMD_GET_WIPHY, nl.const.NLM_F_DUMP, { split_wiphy_dump: true });
+	if (!phys)
+		return;
+
+	for (let phy in phys) {
+		if (!phy)
+			continue;
+
+		let name = phy.wiphy_name;
+		let path = phy_path(name);
+		let info = {
+			antenna_rx: phy.wiphy_antenna_avail_rx,
+			antenna_tx: phy.wiphy_antenna_avail_tx,
+			bands: {},
+			radios: []
+		};
+
+		for (let radio in phy.radios) {
+			// S1G is not supported yet
+			radio.freq_ranges = filter(radio.freq_ranges,
+				(range) => range.end > 2000000
+			);
+
+			if (!length(radio.freq_ranges))
+				continue;
+
+			push(info.radios, {
+				index: radio.index,
+				freq_ranges: map(radio.freq_ranges,
+					(range) => [ range.start, range.end ]
+				),
+				bands: {}
+			});
+		}
+
+		let bands = info.bands;
+		for (let band in phy.wiphy_bands) {
+			if (!band || !band.freqs)
+				continue;
+			let freq = band.freqs[0].freq;
+			let band_info = {};
+			let band_name;
+			if (freq > 50000)
+				band_name = "60G";
+			else if (freq > 5900)
+				band_name = "6G";
+			else if (freq > 4000)
+				band_name = "5G";
+			else if (freq > 2000)
+				band_name = "2G";
+			else
+				continue;
+			bands[band_name] = band_info;
+			if (band.ht_capa > 0)
+				band_info.ht = true;
+			if (band.vht_capa > 0)
+				band_info.vht = true;
+			let he_phy_cap = 0;
+			let eht_phy_cap = 0;
+
+			for (let ift in band.iftype_data) {
+				if (!ift.he_cap_phy)
+					continue;
+
+				band_info.he = true;
+				he_phy_cap |= ift.he_cap_phy[0];
+
+				if (!ift.eht_cap_phy)
+					continue;
+
+				band_info.eht = true;
+				eht_phy_cap |= ift.eht_cap_phy[0];
+			}
+
+			if (band_name == "6G" && band_info.eht)
+				band_info.max_width = 320;
+			else if (band_name != "2G" &&
+			    (he_phy_cap & 0x18) || ((band.vht_capa >> 2) & 0x3))
+				band_info.max_width = 160;
+			else if (band_name != "2G" &&
+			         (he_phy_cap & 4) || band.vht_capa > 0)
+				band_info.max_width = 80;
+			else if ((band.ht_capa & 0x2) || (he_phy_cap & 0x2))
+				band_info.max_width = 40;
+			else
+				band_info.max_width = 20;
+
+			let modes = band_info.modes = [ "NOHT" ];
+			if (band_info.ht)
+				push(modes, "HT20");
+			if (band_info.vht)
+				push(modes, "VHT20");
+			if (band_info.he)
+				push(modes, "HE20");
+			if (band_info.eht)
+				push(modes, "EHT20");
+			if (band.ht_capa & 0x2) {
+				push(modes, "HT40");
+				if (band_info.vht)
+					push(modes, "VHT40")
+			}
+			if (he_phy_cap & 2)
+				push(modes, "HE40");
+
+			if (eht_phy_cap && he_phy_cap & 2)
+				push(modes, "EHT40");
+
+			for (let radio in info.radios) {
+				let freq_match = filter(band.freqs,
+					(freq) => freq_range_match(radio.freq_ranges, freq.freq)
+				);
+				if (!length(freq_match))
+					continue;
+
+				let radio_band = {};
+				radio.bands[band_name] = radio_band;
+
+				freq_match = filter(freq_match,
+					(freq) => !freq.disabled
+				);
+
+				let freq = freq_match[0];
+				if (freq)
+					radio_band.default_channel = freq_to_channel(freq.freq);
+			}
+
+			for (let freq in band.freqs) {
+				if (freq.disabled)
+					continue;
+				let chan = freq_to_channel(freq.freq);
+				if (!chan)
+					continue;
+				band_info.default_channel = chan;
+				break;
+			}
+
+			if (band_name == "2G")
+				continue;
+
+			if (he_phy_cap & 4)
+				push(modes, "HE40");
+			if (eht_phy_cap && he_phy_cap & 4)
+				push(modes, "EHT40");
+			if (band_info.vht)
+				push(modes, "VHT80");
+			if (he_phy_cap & 4)
+				push(modes, "HE80");
+			if (eht_phy_cap && he_phy_cap & 4)
+				push(modes, "EHT80");
+			if ((band.vht_capa >> 2) & 0x3)
+				push(modes, "VHT160");
+			if (he_phy_cap & 0x18)
+				push(modes, "HE160");
+			if (eht_phy_cap && he_phy_cap & 0x18)
+				push(modes, "EHT160");
+
+			if (eht_phy_cap & 2)
+				push(modes, "EHT320");
+		}
+
+		let entry = wiphy_get_entry(name, path);
+		entry.info = info;
+	}
+}
+
+cleanup();
+wiphy_detect();
+if (!is_equal(prev_board_data, board_data)) {
+	let new_file = board_file + ".new";
+	unlink(new_file);
+	let f = open(new_file, "wx");
+	if (!f)
+		exit(1);
+	f.write(sprintf("%.J\n", board_data));
+	f.close();
+	rename(new_file, board_file);
+}
diff --git a/wireless-scripts-example/mtk-feed/wireless.uc b/wireless-scripts-example/mtk-feed/wireless.uc
new file mode 100644
index 0000000000..b7b4e146a6
--- /dev/null
+++ b/wireless-scripts-example/mtk-feed/wireless.uc
@@ -0,0 +1,572 @@
+'use strict';
+
+import * as ubus from "ubus";
+import { realpath } from "fs";
+import {
+	handler_load, handler_attributes,
+	parse_attribute_list, parse_bool, parse_array,
+	TYPE_ARRAY, TYPE_STRING, TYPE_INT, TYPE_BOOL
+} from "./utils.uc";
+import { find_phy } from "wifi.utils";
+import * as wdev from "./wireless-device.uc";
+
+let wireless = netifd.wireless = {
+	handlers: {},
+	devices: {},
+	mlo: {},
+	path: realpath(netifd.main_path + "/wireless"),
+};
+
+function wpad_update_mlo(service, mode)
+{
+	let config = {};
+
+	for (let ifname, data in wireless.mlo) {
+		if (data.mode != mode)
+			continue;
+
+		data.phy = find_phy(data.radio_config[0], true);
+		if (!data.phy)
+			continue;
+
+		config[ifname] = data;
+	}
+
+	ubus.call({
+		object: service,
+		method: "mld_set",
+		return: "ignore",
+		data: { config },
+	});
+}
+
+function hostapd_update_mlo()
+{
+	wpad_update_mlo("hostapd", "ap");
+}
+
+function supplicant_update_mlo()
+{
+	wpad_update_mlo("wpa_supplicant", "sta");
+}
+
+function update_config(new_devices, mlo_vifs)
+{
+	wireless.mlo = mlo_vifs;
+	hostapd_update_mlo();
+	supplicant_update_mlo();
+
+	for (let name, dev in wireless.devices)
+		if (!new_devices[name])
+			dev.destroy();
+
+	for (let name, dev in new_devices) {
+		let cur_dev = wireless.devices[name];
+		if (cur_dev) {
+			cur_dev.update(dev);
+			continue;
+		}
+
+		let handler = wireless.handlers[dev.config.type];
+		cur_dev = wdev.new(dev, handler.script);
+		if (!cur_dev)
+			continue;
+
+		wireless.devices[name] = cur_dev;
+	}
+}
+
+function config_init(uci)
+{
+	let config = uci.get_all("wireless");
+
+	let handlers = {};
+	let devices = {};
+	let vifs = {};
+	let mlo_vifs = {};
+
+	let sections = {
+		device: {},
+		iface: {},
+		vlan: {},
+		station: {},
+	};
+	let radio_idx = {};
+	let vif_idx = {};
+
+	for (let name, data in config) {
+		let type = data[".type"];
+		if (parse_bool(data.disabled) && type != "wifi-device")
+			continue;
+
+		if (substr(type, 0, 5) != "wifi-")
+			continue;
+
+		let list = sections[substr(type, 5)];
+		if (list)
+			list[name] = data;
+	}
+
+	for (let name, data in sections.device) {
+		if (!data.type)
+			continue;
+
+		let handler = wireless.handlers[data.type];
+		if (!handler)
+			continue;
+
+		if (data.radio != null)
+			radio_idx[name] = +data.radio;
+
+		let config = parse_attribute_list(data, handler.device);
+		devices[name] = {
+			name,
+			config,
+
+			vif: [],
+		};
+		handlers[name] = handler;
+	}
+
+	for (let name, data in sections.iface) {
+		let dev_names = parse_array(data.device);
+		let mlo_vif = parse_bool(data.mlo);
+		let ifname;
+
+		if (mlo_vif) {
+			/* Disallow disabled device or AP using non-EHT device */
+			let tmp_dev_names = [];
+			for (let dev_name in dev_names) {
+				let dev = devices[dev_name];
+				if (dev && !dev.config.disabled &&
+				    (wildcard(dev.config.htmode, 'EHT*') ||
+				     data.mode == 'sta'))
+					push(tmp_dev_names, dev_name);
+			}
+
+			dev_names = [...tmp_dev_names];
+		}
+
+		let radios = map(dev_names, (v) => radio_idx[v]);
+		radios = filter(radios, (v) => v != null);
+		let radio_config = map(dev_names, (v) => devices[v].config);
+		let mlo_created = false;
+
+		for (let dev_name in dev_names) {
+			let dev = devices[dev_name];
+			if (!dev || dev.config.disabled)
+				continue;
+
+			let handler = handlers[dev_name];
+			if (!handler)
+				continue;
+
+			let config = parse_attribute_list(data, handler.iface);
+			config.radios = radios;
+
+			if (mlo_vif && !mlo_created) {
+				let mlo_config = { ...config };
+
+				if (config.wds)
+					mlo_config['4addr'] = config.wds;
+				mlo_config.radio_config = radio_config;
+				ifname = config.ifname;
+				if (!ifname) {
+					let idx = vif_idx[config.mode] ?? 0;
+					vif_idx[config.mode] = idx + 1;
+					ifname = config.mode + "-mld" + idx;
+				}
+
+				mlo_config["4addr"] = !!mlo_config.wds;
+				mlo_vifs[ifname] = mlo_config;
+				mlo_created = true;
+			}
+
+			if (ifname)
+				config.ifname = ifname;
+			if (dev_name != dev_names[0])
+				delete config.macaddr;
+			if (config.radio_macaddr) {
+				let idx = index(dev_names, dev_name);
+				let macaddr = idx >= 0 ? config.radio_macaddr[idx] : null;
+				if (macaddr)
+					config.macaddr = macaddr;
+			}
+
+			let vif = {
+				name, config,
+				device: dev_name,
+
+				vlan: [],
+				sta: [],
+			};
+			push(dev.vif, vif);
+
+			vifs[name] ??= [];
+			push(vifs[name], vif);
+		}
+	}
+
+	for (let name, data in sections.vlan) {
+		for (let iface, iface_vifs in vifs) {
+			if (data.iface && data.iface != iface)
+				continue;
+
+			for (let vif in iface_vifs) {
+				let dev = devices[vif.device];
+				let handler = handlers[vif.device];
+				if (!dev || !handler)
+					continue;
+
+				let config = parse_attribute_list(data, handler.vlan);
+
+				let vlan = {
+					name,
+					config
+				};
+				push(vif.vlan, vlan);
+			}
+		}
+	}
+
+	for (let name, data in sections.station) {
+		for (let iface, iface_vifs in vifs) {
+			if (data.iface && data.iface != iface)
+				continue;
+
+			for (let vif in iface_vifs) {
+				let dev = devices[vif.device];
+				let handler = handlers[vif.device];
+				if (!dev || !handler)
+					continue;
+
+				let config = parse_attribute_list(data, handler.station);
+
+				let sta = {
+					name,
+					config
+				};
+				push(vif.sta, sta);
+			}
+		}
+	}
+
+	let udata = ubus.call({
+		object: "service",
+		method: "get_data",
+		data: {
+			type: "wifi-device"
+		},
+	});
+	for (let svcname, svc in udata) {
+		for (let insname, ins in svc) {
+			for (let typename, data in ins) {
+				for (let radio, config in data) {
+					if (type(config) != "object")
+						continue;
+
+					let dev = devices[radio];
+					if (dev) {
+						dev.config = { ...dev.config, ...config };
+						continue;
+					}
+
+					let handler = wireless.handlers[config.type];
+					if (!handler)
+						continue;
+
+					dev = devices[radio] = {
+						name,
+						config,
+
+						vif: [],
+					};
+					handlers[radio] = handler;
+				}
+			}
+		}
+	}
+
+
+	udata = ubus.call({
+		object: "service",
+		method: "get_data",
+		data: {
+			type: "wifi-iface"
+		},
+	});
+
+	for (let svcname, svc in udata) {
+		for (let insname, ins in svc) {
+			for (let typename, data in ins) {
+				for (let radio, vifs in data) {
+					if (type(vifs) != "object")
+						continue;
+
+					for (let name, vif in vifs) {
+						let devs = vif.device;
+						if (type(devs) != "array")
+							devs = [ devs ];
+						let config = vif.config;
+						if (!config)
+							continue;
+						for (let device in devs) {
+							let dev = devices[device];
+							if (!dev)
+								continue;
+
+							let vif_data = {
+								name, device, config,
+								vlan: [],
+								sta: []
+							};
+							if (vif.vlans)
+								vif_data.vlans = vif.vlans;
+							if (vif.stations)
+								vif_data.sta = vif.stations;
+							vifs[name] ??= [];
+							push(vifs[name], vif_data);
+							push(dev.vif, vif_data);
+						}
+					}
+				}
+			}
+		}
+	}
+
+	update_config(devices, mlo_vifs);
+}
+
+function config_start()
+{
+	for (let name, dev in wireless.devices)
+		if (dev.autostart)
+			dev.start();
+
+}
+
+function check_interfaces()
+{
+	for (let name, dev in wireless.devices)
+		if (dev.autostart)
+			dev.check();
+}
+
+function hotplug(ifname, add)
+{
+	for (let name, dev in wireless.devices)
+		if (dev.autostart)
+			dev.hotplug(ifname, add);
+}
+
+const network_config_attr = {
+	network: TYPE_ARRAY,
+	network_vlan: TYPE_ARRAY,
+	bridge_isolate: TYPE_BOOL,
+	isolate: TYPE_BOOL,
+	proxy_arp: TYPE_BOOL,
+	multicast_to_unicast: TYPE_BOOL,
+};
+
+const default_config_attr = {
+	device: {
+		disabled: TYPE_BOOL,
+		type: TYPE_STRING,
+	},
+	iface: {
+		...network_config_attr,
+		device: TYPE_STRING,
+		mode: TYPE_STRING,
+		radio_macaddr: TYPE_ARRAY,
+	},
+	station: {
+		iface: TYPE_STRING,
+
+		mac: TYPE_STRING,
+		key: TYPE_STRING,
+		vid: TYPE_STRING,
+	},
+	vlan: {
+		...network_config_attr,
+		iface: TYPE_STRING,
+		name: TYPE_STRING,
+		vid: TYPE_STRING,
+	},
+};
+
+const wdev_args = {
+	device: ""
+};
+
+function wdev_call(req, cb)
+{
+	let dev = req.args.device;
+	if (dev) {
+		dev = wireless.devices[dev];
+		if (!dev)
+			return ubus.STATUS_NOT_FOUND;
+
+		return cb(dev);
+	}
+
+	for (let name, dev in wireless.devices)
+		cb(dev);
+
+	return 0;
+}
+
+function attr_validate(attr_type, validate)
+{
+	if (validate)
+		return validate;
+	switch (attr_type) {
+	case TYPE_STRING:
+		return "string";
+	case TYPE_ARRAY:
+		return "list(string)";
+	case TYPE_INT:
+		return "uinteger";
+	case TYPE_BOOL:
+		return "bool";
+	}
+}
+
+function get_validate_info(ret, handler)
+{
+	for (let kind in default_config_attr) {
+		let cur = ret[kind == "iface" ? "interface" : kind] = {};
+		let validate = handler[kind + "_validate"];
+
+		for (let attr, attr_type in handler[kind]) {
+			let val = attr_validate(attr_type, validate[attr]);
+			if (val != null)
+				cur[attr] = val;
+		}
+	}
+
+	return ret;
+}
+
+const ubus_obj = {
+	up: {
+		args: wdev_args,
+		call: function(req) {
+			hostapd_update_mlo();
+
+			return wdev_call(req, (dev) => {
+				dev.start();
+				return 0;
+			});
+		}
+	},
+	down: {
+		args: wdev_args,
+		call: function(req) {
+			return wdev_call(req, (dev) => {
+				dev.stop();
+				return 0;
+			});
+		}
+	},
+	retry: {
+		args: wdev_args,
+		call: function(req) {
+			hostapd_update_mlo();
+
+			return wdev_call(req, (dev) => {
+				dev.retry_setup();
+				return 0;
+			});
+		}
+	},
+	reconf: {
+		args: wdev_args,
+		call: function(req) {
+			hostapd_update_mlo();
+
+			return wdev_call(req, (dev) => {
+				dev.update();
+				return 0;
+			});
+		}
+	},
+	status: {
+		args: wdev_args,
+		call: function(req) {
+			let ret = {};
+			let err = wdev_call(req, (dev) => {
+				ret[dev.data.name] = dev.status();
+				return 0;
+			});
+			if (err != 0)
+				return err;
+
+			return ret;
+		}
+	},
+	notify: {
+		args: {
+			...wdev_args,
+			command: 0,
+			interface: "",
+			vlan: "",
+			data: {},
+		},
+		call: function(req) {
+			let dev = req.args.device;
+			if (!dev)
+				return ubus.STATUS_INVALID_ARGUMENT;
+
+			dev = wireless.devices[dev];
+			if (!dev)
+				return ubus.STATUS_NOT_FOUND;
+
+			return dev.notify(req);
+		}
+	},
+	get_validate: {
+		args: wdev_args,
+		call: function(req) {
+			let ret = {};
+			let err = wdev_call(req, (dev) => {
+				let dev_type = dev.data.config.type;
+				let cur = ret[dev.data.name] = {};
+				get_validate_info(cur, wireless.handlers[dev_type]);
+				return 0;
+			});
+			if (err != 0)
+				return err;
+
+			return ret;
+		}
+	},
+};
+
+
+handler_load(wireless.path, (script, data) => {
+	if (!data.name)
+		return;
+
+	let handler = wireless.handlers[data.name] = {
+		script,
+	};
+	for (let kind, attr in default_config_attr) {
+		let validate = handler[kind + "_validate"] = {};
+		handler[kind] = handler_attributes(data[kind], attr, validate);
+	}
+});
+
+wireless.obj = ubus.publish("network.wireless", ubus_obj);
+wireless.listener = ubus.listener("ubus.object.add", (event, msg) => {
+	if (msg.path == "hostapd")
+		hostapd_update_mlo();
+	else if (msg.path == "wpa_supplicant")
+		supplicant_update_mlo();
+});
+
+return {
+	hotplug,
+	config_init,
+	config_start,
+	check_interfaces,
+};
diff --git a/wireless-scripts-example/mtk-feed/wpa_supplicant.uc b/wireless-scripts-example/mtk-feed/wpa_supplicant.uc
new file mode 100644
index 0000000000..9ee9f72bfc
--- /dev/null
+++ b/wireless-scripts-example/mtk-feed/wpa_supplicant.uc
@@ -0,0 +1,892 @@
+let libubus = require("ubus");
+import * as uloop from "uloop";
+import { open, readfile } from "fs";
+import { wdev_create, wdev_set_mesh_params, wdev_remove, is_equal, wdev_set_up, vlist_new, phy_open } from "common";
+
+let ubus = libubus.connect();
+
+function ex_handler(e)
+{
+	e = split(`${e}\n${e.stacktrace[0].context}`, '\n');
+	for (let line in e)
+		wpas.printf(line);
+	return libubus.STATUS_UNKNOWN_ERROR;
+}
+libubus.guard(ex_handler);
+
+wpas.data.mld = {};
+wpas.data.config = {};
+wpas.data.iface_phy = {};
+wpas.data.iface_ubus = {};
+wpas.data.macaddr_list = {};
+
+function iface_stop(iface)
+{
+	let ifname = iface.config.iface;
+
+	if (!iface.running)
+		return;
+
+	delete wpas.data.iface_phy[ifname];
+	wpas.remove_iface(ifname);
+	wdev_remove(ifname);
+	iface.running = false;
+}
+
+function iface_start(phydev, iface, macaddr_list)
+{
+	let phy = phydev.name;
+
+	if (iface.running)
+		return;
+
+	let ifname = iface.config.iface;
+	let wdev_config = {};
+	for (let field in iface.config)
+		wdev_config[field] = iface.config[field];
+	if (!wdev_config.macaddr)
+		wdev_config.macaddr = phydev.macaddr_next();
+	if (wdev_config.mld_allowed_phy_bitmap)
+		wdev_config.mld_radio_mask = wdev_config.mld_allowed_phy_bitmap;
+
+	wpas.data.iface_phy[ifname] = phy;
+	wdev_remove(ifname);
+	let ret = phydev.wdev_add(ifname, wdev_config);
+	if (ret)
+		wpas.printf(`Failed to create device ${ifname}: ${ret}`);
+	wdev_set_up(ifname, true);
+	wpas.add_iface(iface.config);
+	iface.running = true;
+}
+
+function iface_cb(new_if, old_if)
+{
+	if (old_if && new_if && is_equal(old_if.config, new_if.config)) {
+		new_if.running = old_if.running;
+		return;
+	}
+
+	if (new_if && old_if)
+		wpas.printf(`Update configuration for interface ${old_if.config.iface}`);
+	else if (old_if)
+		wpas.printf(`Remove interface ${old_if.config.iface}`);
+
+	if (old_if)
+		iface_stop(old_if);
+}
+
+function prepare_config(config, radio)
+{
+	config.config_data = readfile(config.config);
+
+	return { config };
+}
+
+function phy_dev_open(phy_name)
+{
+	let phy = wpas.data.config[phy_name];
+	if (!phy) {
+		warn(`Missing phy config for ${phy_name}\n`);
+		return;
+	}
+
+	let phydev = phy_open(phy.name, phy.radio);
+	if (!phydev)
+		return;
+
+	let macaddr_list = wpas.data.macaddr_list[phy_name];
+	phydev.macaddr_init(macaddr_list, {
+		num_global: phy.num_global_macaddr,
+		macaddr_base: phy.macaddr_base,
+	});
+
+	return phydev;
+}
+
+function start_pending(phy_name)
+{
+	let phy = wpas.data.config[phy_name];
+	if (!phy || !phy.data)
+		return;
+
+	let phydev = phy_dev_open(phy_name);
+	if (!phydev) {
+		wpas.printf(`Could not open phy ${phy_name}`);
+		return;
+	}
+
+	for (let ifname in phy.data)
+		iface_start(phydev, phy.data[ifname]);
+}
+
+function phy_name(phy, radio)
+{
+	if (!phy)
+		return null;
+
+	if (radio != null && radio >= 0)
+		phy += "." + radio;
+
+	return phy;
+}
+
+function mld_remove(data)
+{
+	if (!data.radio_mask_up)
+		return;
+
+	let name = data.name;
+	wpas.printf(`Remove MLD interface ${name}`);
+	wpas.remove_iface(name);
+	wdev_remove(name);
+	data.radio_mask_up = 0;
+}
+
+function mld_first_phy(data)
+{
+	let mask = data.radio_mask_present;
+
+	for (let i = 0; mask; i++, mask >>= 1)
+		if (mask & 1)
+			return i;
+}
+
+function mld_radio_index(data, freq)
+{
+	let phys = data.phy_config;
+	for (let i = 0; i < length(phys); i++)
+		if (phys[i] && index(phys[i].freq_list, freq) >= 0)
+			return i;
+}
+
+function mld_add(data, phy_list)
+{
+	let name = data.name;
+	phy_list ??= [];
+
+	wpas.printf(`Add MLD interface ${name}`);
+
+	let radio = mld_first_phy(data);
+	if (radio == null)
+		return;
+
+	let phy_name = data.phy + '.' + radio;
+	let phydev = phy_list[phy_name];
+	if (!phydev) {
+		phydev = phy_dev_open(phy_name);
+		if (!phydev)
+			return;
+
+		phy_list[phy_name] = phydev;
+	}
+
+
+	if (!data.config.macaddr)
+		data.config.macaddr = phydev.macaddr_next();
+
+	let wdev_config = { ...data.config, radio_mask: data.radio_mask };
+	if (!wdev_config.macaddr)
+		wdev_config.macaddr = phydev.macaddr_next();
+	let ret = phydev.wdev_add(name, wdev_config);
+	if (ret)
+		wpas.printf(`Failed to create device ${name}: ${ret}`);
+
+	let first_config = data.phy_config[radio];
+
+	wdev_set_up(name, true);
+	wpas.add_iface(first_config);
+
+	let iface = wpas.interfaces[name];
+	if (!iface) {
+		wpas.printf(`Interface ${name} not found after adding\n`);
+		wpas.remove_iface(name);
+		wdev_remove(name);
+		return;
+	}
+
+	if (length(data.freq_list) > 0)
+		iface.config('freq_list', data.freq_list);
+
+	if (data.mld_assoc_band)
+		iface.config('mld_assoc_band', data.mld_assoc_band);
+
+	data.radio_mask_up = data.radio_mask_present;
+}
+
+function mld_remove_links(data)
+{
+	// TODO
+	mld_remove(data);
+}
+
+function mld_add_links(data)
+{
+	// TODO: incremental update
+	mld_remove(data);
+	mld_add(data);
+}
+
+function mld_set_config(config)
+{
+	let prev_mld = { ...wpas.data.mld };
+	let new_mld = {};
+	let phy_list = {};
+	let new_config = !length(prev_mld);
+
+	wpas.printf(`Set MLD config: ${keys(config)}`);
+
+	for (let name, data in config) {
+		let prev = prev_mld[name];
+		if (prev && is_equal(prev.config, data)) {
+			new_mld[name] = prev;
+			delete prev_mld[name];
+			continue;
+		}
+
+		let radio_mask = 0;
+		for (let r in data.radios)
+			if (r != null)
+				radio_mask |= 1 << r;
+
+		new_mld[name] = {
+			name,
+			config: data,
+			phy: data.phy,
+			phy_config: [],
+			radio_mask,
+			radio_mask_up: 0,
+			radio_mask_present: 0,
+		};
+	}
+
+	for (let name, data in prev_mld)
+		mld_remove(data);
+
+	wpas.data.mld = new_mld;
+
+}
+
+function mld_set_iface_config(name, data, radio, config)
+{
+	wpas.printf(`Set MLD interface ${name} radio ${radio} config: ${keys(config)}`);
+
+	data.phy_config[radio] = config;
+	if (config) {
+		data.radio_mask_present |= 1 << radio;
+		data.mld_assoc_band = config.mld_assoc_band;
+	} else {
+		data.radio_mask_present &= ~(1 << radio);
+		data.mld_assoc_band = null;
+	}
+
+	let freq_list;
+	for (let config in data.phy_config) {
+		if (!config || !config.freq_list)
+			continue;
+		if (!freq_list)
+			freq_list = [ ...config.freq_list ];
+		else
+			push(freq_list, ...config.freq_list);
+	}
+
+	data.freq_list = freq_list;
+}
+
+function mld_update_iface(name, data) {
+	if (!data.radio_mask_up)
+		return;
+
+	if (!data.radio_mask_present) {
+		mld_remove(data);
+		return;
+	}
+
+	let mask = data.radio_mask_up & ~data.radio_mask_present;
+	if (!mask)
+		return;
+
+	mld_remove_links(data);
+}
+
+function mld_update_phy(phy, ifaces) {
+	for (let name, data in wpas.data.mld) {
+		if (data.phy != phy.name)
+			continue;
+
+		mld_set_iface_config(name, data, phy.radio, ifaces[name]);
+		mld_update_iface(name, data);
+	}
+}
+
+function mld_start() {
+	if (wpas.data.mld_pending)
+		return;
+
+	wpas.printf(`Start pending MLD interfaces\n`);
+
+	let phy_list = {};
+	for (let name, data in wpas.data.mld) {
+		wpas.printf(`MLD interface ${name} present=${data.radio_mask_present} up=${data.radio_mask_up}`);
+		let add_mask = data.radio_mask_present & ~data.radio_mask_up;
+		if (!add_mask)
+			continue;
+
+		if (!data.radio_mask_up)
+			mld_add(data, phy_list);
+		else
+			mld_add_links(data);
+	}
+}
+
+function mld_bss_allowed(data, bss) {
+	if (!data.freq_list)
+		return true;
+
+	return index(data.freq_list, bss.freq) >= 0;
+}
+
+function set_config(config_name, phy_name, radio, num_global_macaddr, macaddr_base, config_list)
+{
+	let phy = wpas.data.config[config_name];
+
+	if (radio < 0)
+		radio = null;
+
+	if (!phy) {
+		phy = vlist_new(iface_cb, false);
+		phy.name = phy_name;
+		wpas.data.config[config_name] = phy;
+	}
+
+	phy.radio = radio;
+	phy.num_global_macaddr = num_global_macaddr;
+	phy.macaddr_base = macaddr_base;
+
+	let values = [];
+	let mlo_ifaces = {};
+	for (let config in config_list)
+		if (config.mlo)
+			mlo_ifaces[config.iface] = config;
+		else
+			push(values, [ config.iface, prepare_config(config) ]);
+
+	mld_update_phy(phy, mlo_ifaces);
+	phy.update(values);
+}
+
+function iface_status_fill_radio_link(mld, radio, msg, link)
+{
+	let config = mld.phy_config[radio];
+	if (!config)
+		return;
+
+	let freq_list = config.freq_list;
+	if (!freq_list)
+		return;
+
+	if (!link || index(freq_list, link.frequency) < 0)
+		return;
+
+	msg.frequency = link.frequency;
+	msg.sec_chan_offset = link.sec_chan_offset;
+	msg.oper_chwidth = link.oper_chwidth;
+	msg.bw320_offset = link.bw320_offset;
+	msg.punct_bitmap = link.punct_bitmap;
+}
+
+function iface_status_fill_radio(mld, radio, msg, status)
+{
+	if (status.links)
+		for (let link in status.links)
+			iface_status_fill_radio_link(mld, radio, msg, link);
+	else
+		iface_status_fill_radio_link(mld, radio, msg, status);
+}
+
+let main_obj = {
+	phy_set_state: {
+		args: {
+			phy: "",
+			radio: 0,
+			stop: true,
+		},
+		call: function(req) {
+			let name = phy_name(req.args.phy, req.args.radio);
+			if (!name || req.args.stop == null)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			let phy = wpas.data.config[name];
+			if (!phy)
+				return libubus.STATUS_NOT_FOUND;
+
+			let radio_mask = phy.radio != null ? (1 << phy.radio) : 0;
+			if (req.args.stop) {
+				for (let ifname in phy.data)
+					iface_stop(phy.data[ifname]);
+				for (let name, data in wpas.data.mld) {
+					data.radio_mask_present &= ~radio_mask;
+					if (data.radio_mask_up & radio_mask)
+						mld_update_iface(name, data);
+				}
+			} else {
+				start_pending(name);
+
+				let found;
+				for (let name, data in wpas.data.mld) {
+					if (!(data.radio_mask & radio_mask))
+						continue;
+					data.radio_mask_present |= radio_mask;
+					found = true;
+				}
+				if (found)
+					mld_start();
+			}
+
+			return 0;
+		}
+	},
+	phy_set_macaddr_list: {
+		args: {
+			phy: "",
+			radio: 0,
+			macaddr: [],
+		},
+		call: function(req) {
+			let phy = phy_name(req.args.phy, req.args.radio);
+			if (!phy)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			wpas.data.macaddr_list[phy] = req.args.macaddr;
+			return 0;
+		}
+	},
+	phy_status: {
+		args: {
+			phy: "",
+			radio: 0,
+		},
+		call: function(req) {
+			let phy = phy_name(req.args.phy, req.args.radio);
+			if (!phy)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			phy = wpas.data.config[phy];
+			if (!phy)
+				return libubus.STATUS_NOT_FOUND;
+
+			let ifnames = keys(phy.data);
+			let radio_mask = phy.radio != null ? (1 << phy.radio) : 0;
+			for (let name, data in wpas.data.mld)
+				if (data.radio_mask_up & radio_mask)
+					push(ifnames, name);
+
+			for (let ifname in ifnames) {
+				try {
+					let iface = wpas.interfaces[ifname];
+					if (!iface)
+						continue;
+
+					let status = iface.status();
+					if (!status)
+						continue;
+
+					if (status.state == "INTERFACE_DISABLED")
+						continue;
+
+					if (phy.data[ifname]) {
+						status.ifname = ifname;
+						return status;
+					}
+
+					let ret = {
+						ifname,
+						state: status.state,
+					};
+
+					let mld = wpas.data.mld[ifname];
+					iface_status_fill_radio(mld, phy.radio, ret, status);
+					return ret;
+				} catch (e) {
+					ex_handler(e);
+					continue;
+				}
+			}
+
+			return libubus.STATUS_NOT_FOUND;
+		}
+	},
+	iface_status: {
+		args: {
+			name: ""
+		},
+		call: function(req) {
+			let iface = wpas.interfaces[req.args.name];
+			if (!iface)
+				return libubus.STATUS_NOT_FOUND;
+
+			return iface.status();
+		},
+	},
+	mld_set: {
+		args: {
+			config: {}
+		},
+		call: function(req) {
+			if (!req.args.config)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			wpas.data.mld_pending = true;
+			mld_set_config(req.args.config);
+			return 0;
+		}
+	},
+	mld_start: {
+		args: {},
+		call: function(req) {
+			wpas.data.mld_pending = false;
+			mld_start();
+			return 0;
+		}
+	},
+	config_set: {
+		args: {
+			phy: "",
+			radio: 0,
+			num_global_macaddr: 0,
+			macaddr_base: "",
+			config: [],
+			defer: true,
+		},
+		call: function(req) {
+			let phy = phy_name(req.args.phy, req.args.radio);
+			if (!phy)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			wpas.printf(`Set new config for phy ${phy}`);
+			if (req.args.config)
+				set_config(phy, req.args.phy, req.args.radio, req.args.num_global_macaddr, req.args.macaddr_base, req.args.config);
+
+			if (!req.args.defer)
+				uloop.timer(100, () => start_pending(phy));
+
+			return {
+				pid: wpas.getpid()
+			};
+		}
+	},
+	config_add: {
+		args: {
+			driver: "",
+			iface: "",
+			bridge: "",
+			hostapd_ctrl: "",
+			ctrl: "",
+			config: "",
+		},
+		call: function(req) {
+			if (!req.args.iface || !req.args.config)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			if (wpas.add_iface(req.args) < 0)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			return {
+				pid: wpas.getpid()
+			};
+		}
+	},
+	config_remove: {
+		args: {
+			iface: ""
+		},
+		call: function(req) {
+			if (!req.args.iface)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			wpas.remove_iface(req.args.iface);
+			return 0;
+		}
+	},
+	bss_info: {
+		args: {
+			iface: "",
+		},
+		call: function(req) {
+			let ifname = req.args.iface;
+			if (!ifname)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			let iface = wpas.interfaces[ifname];
+			if (!iface)
+				return libubus.STATUS_NOT_FOUND;
+
+			let status = iface.ctrl("STATUS");
+			if (!status)
+				return libubus.STATUS_NOT_FOUND;
+
+			let ret = {};
+			status = split(status, "\n");
+			for (let line in status) {
+				line = split(line, "=", 2);
+				ret[line[0]] = line[1];
+			}
+
+			return ret;
+		}
+	},
+};
+
+wpas.data.ubus = ubus;
+wpas.data.obj = ubus.publish("wpa_supplicant", main_obj);
+wpas.udebug_set("wpa_supplicant", wpas.data.ubus);
+
+function iface_event(type, name, data) {
+	let ubus = wpas.data.ubus;
+
+	data ??= {};
+	data.name = name;
+	let req = wpas.data.obj.notify(`iface.${type}`, data, null, null, null, -1);
+	if (req)
+		req.abort();
+
+	ubus.call("service", "event", { type: `wpa_supplicant.${name}.${type}`, data: {} });
+}
+
+function iface_hostapd_notify(ifname, iface, state)
+{
+	let status = iface.status();
+	let ubus = wpas.data.ubus;
+	let msg = {};
+
+	let mld = wpas.data.mld[ifname];
+
+	wpas.printf(`ucode: mtk: wpa_s in state ${state} notifies hostapd`);
+	switch (state) {
+	case "DISCONNECTED":
+	case "AUTHENTICATING":
+	case "SCANNING":
+		msg.up = false;
+		break;
+	case "INTERFACE_DISABLED":
+	case "INACTIVE":
+		msg.up = true;
+		break;
+	case "COMPLETED":
+		msg.up = true;
+		if (!mld) {
+			msg.frequency = status.frequency;
+			msg.sec_chan_offset = status.sec_chan_offset;
+			msg.oper_chwidth = status.oper_chwidth;
+			msg.bw320_offset = status.bw320_offset;
+			msg.punct_bitmap = status.punct_bitmap;
+		}
+		break;
+	default:
+		return;
+	}
+
+	if (!mld) {
+		msg.phy = wpas.data.iface_phy[ifname];
+		if (!msg.phy) {
+			wpas.printf(`no PHY for ifname ${ifname}`);
+			return;
+		}
+		ubus.call("hostapd", "apsta_state", msg);
+		return;
+	}
+
+	let radio_mask = mld.radio_mask;
+	for (let i = 0; radio_mask; i++, radio_mask >>= 1) {
+		if (!(radio_mask & 1)) {
+			wpas.printf(`skip radio ${i}`);
+			continue;
+		}
+
+		let radio_msg = {
+			...msg,
+			phy: mld.phy,
+			radio: i,
+		};
+
+		if (state == "COMPLETED")
+			iface_status_fill_radio(mld, i, radio_msg, status);
+
+		ubus.call("hostapd", "apsta_state", radio_msg);
+	}
+}
+
+function iface_channel_switch(ifname, iface, info)
+{
+	let msg = {
+		up: true,
+		csa: true,
+		csa_count: info.csa_count ? info.csa_count - 1 : 0,
+		frequency: info.frequency,
+		oper_chwidth: info.oper_chwidth,
+		bw320_offset: info.bw320_offset,
+		sec_chan_offset: info.sec_chan_offset,
+		punct_bitmap: info.punct_bitmap,
+	};
+
+	let mld = wpas.data.mld[ifname];
+	if (mld) {
+		msg.phy = mld.phy;
+		msg.radio = mld_radio_index(mld, info.frequency);
+		if (msg.radio == null) {
+			wpas.printf(`PHY ${mld.phy} radio for frequency ${info.frequency} not found`);
+			return;
+		}
+	} else {
+		msg.phy = wpas.data.iface_phy[ifname];
+		if (!msg.phy) {
+			wpas.printf(`no PHY for ifname ${ifname}`);
+			return;
+		}
+	}
+
+	ubus.call("hostapd", "apsta_state", msg);
+}
+
+function iface_ubus_remove(ifname)
+{
+	let obj = wpas.data.iface_ubus[ifname];
+	if (!obj)
+		return;
+
+	obj.remove();
+	delete wpas.data.iface_ubus[ifname];
+}
+
+function iface_ubus_notify(ifname, event)
+{
+	let obj = wpas.data.iface_ubus[ifname];
+	if (!obj)
+		return;
+
+	obj.notify('ctrl-event', { event }, null, null, null, -1);
+}
+
+function iface_ubus_add(ifname)
+{
+	let ubus = wpas.data.ubus;
+
+	iface_ubus_remove(ifname);
+
+	let obj = ubus.publish(`wpa_supplicant.${ifname}`, {
+		reload: {
+			args: {},
+			call: (req) => {
+				let iface = wpas.interfaces[ifname];
+				if (!iface)
+					return libubus.STATUS_NOT_FOUND;
+
+				iface.ctrl("RECONFIGURE");
+				return 0;
+			},
+		},
+		wps_start: {
+			args: {
+				multi_ap: true
+			},
+			call: (req) => {
+				let iface = wpas.interfaces[ifname];
+				if (!iface)
+					return libubus.STATUS_NOT_FOUND;
+
+				iface.ctrl(`WPS_PBC multi_ap=${+req.args.multi_ap}`);
+				return 0;
+			},
+		},
+		wps_cancel: {
+			args: {},
+			call: (req) => {
+				let iface = wpas.interfaces[ifname];
+				if (!iface)
+					return libubus.STATUS_NOT_FOUND;
+
+				iface.ctrl("WPS_CANCEL");
+				return 0;
+			},
+		},
+		control: {
+			args: {
+				command: ""
+			},
+			call: (req) => {
+				let iface = wpas.interfaces[ifname];
+				if (!iface)
+					return libubus.STATUS_NOT_FOUND;
+
+				return {
+					result: iface.ctrl(req.args.command)
+				};
+			},
+		},
+	});
+	wpas.data.iface_ubus[ifname] = obj;
+}
+
+return {
+	shutdown: function() {
+		for (let phy in wpas.data.config)
+			set_config(phy, []);
+		wpas.ubus.disconnect();
+	},
+	bss_allowed: function(ifname, bss) {
+		let mld = wpas.data.mld[ifname];
+		if (!mld)
+			return true;
+
+		return mld_bss_allowed(mld, bss);
+	},
+	iface_add: function(name, obj) {
+		iface_ubus_add(name);
+		iface_event("add", name);
+	},
+	iface_remove: function(name, obj) {
+		iface_event("remove", name);
+		iface_ubus_remove(name);
+	},
+	ctrl_event: function(name, iface, ev) {
+		iface_ubus_notify(name, ev);
+	},
+	state: function(ifname, iface, state) {
+		let event_data = iface.status();
+		event_data.name = ifname;
+		iface_event("state", ifname, event_data);
+		try {
+			iface_hostapd_notify(ifname, iface, state);
+
+			if (state != "COMPLETED")
+				return;
+
+			let phy = wpas.data.iface_phy[ifname];
+			if (!phy)
+				return;
+
+			let phy_data = wpas.data.config[phy];
+			if (!phy_data)
+				return;
+
+			let iface_data = phy_data.data[ifname];
+			if (!iface_data)
+				return;
+
+			let wdev_config = iface_data.config;
+			if (!wdev_config || wdev_config.mode != "mesh")
+				return;
+
+			wdev_set_mesh_params(ifname, wdev_config);
+		} catch (e) {
+			ex_handler(e);
+		}
+	},
+	event: function(ifname, iface, ev, info) {
+		if (ev == "CH_SWITCH_STARTED" || ev == "LINK_CH_SWITCH_STARTED")
+			iface_channel_switch(ifname, iface, info);
+	},
+	wps_credentials: function(ifname, iface, cred) {
+		cred.ifname = ifname;
+		ubus.event("wps_credentials", cred);
+	}
+};
diff --git a/wireless-scripts-example/old/common-default.uc b/wireless-scripts-example/old/common-default.uc
new file mode 100644
index 0000000000..31b526b6ae
--- /dev/null
+++ b/wireless-scripts-example/old/common-default.uc
@@ -0,0 +1,421 @@
+import * as nl80211 from "nl80211";
+import * as rtnl from "rtnl";
+import { readfile, glob, basename, readlink, open } from "fs";
+
+const iftypes = {
+	ap: nl80211.const.NL80211_IFTYPE_AP,
+	mesh: nl80211.const.NL80211_IFTYPE_MESH_POINT,
+	sta: nl80211.const.NL80211_IFTYPE_STATION,
+	adhoc: nl80211.const.NL80211_IFTYPE_ADHOC,
+	monitor: nl80211.const.NL80211_IFTYPE_MONITOR,
+};
+
+const mesh_params = {
+	mesh_retry_timeout: "retry_timeout",
+	mesh_confirm_timeout: "confirm_timeout",
+	mesh_holding_timeout: "holding_timeout",
+	mesh_max_peer_links: "max_peer_links",
+	mesh_max_retries: "max_retries",
+	mesh_ttl: "ttl",
+	mesh_element_ttl: "element_ttl",
+	mesh_auto_open_plinks: "auto_open_plinks",
+	mesh_hwmp_max_preq_retries: "hwmp_max_preq_retries",
+	mesh_path_refresh_time: "path_refresh_time",
+	mesh_min_discovery_timeout: "min_discovery_timeout",
+	mesh_hwmp_active_path_timeout: "hwmp_active_path_timeout",
+	mesh_hwmp_preq_min_interval: "hwmp_preq_min_interval",
+	mesh_hwmp_net_diameter_traversal_time: "hwmp_net_diam_trvs_time",
+	mesh_hwmp_rootmode: "hwmp_rootmode",
+	mesh_hwmp_rann_interval: "hwmp_rann_interval",
+	mesh_gate_announcements: "gate_announcements",
+	mesh_sync_offset_max_neighor: "sync_offset_max_neighbor",
+	mesh_rssi_threshold: "rssi_threshold",
+	mesh_hwmp_active_path_to_root_timeout: "hwmp_path_to_root_timeout",
+	mesh_hwmp_root_interval: "hwmp_root_interval",
+	mesh_hwmp_confirmation_interval: "hwmp_confirmation_interval",
+	mesh_awake_window: "awake_window",
+	mesh_plink_timeout: "plink_timeout",
+	mesh_fwding: "forwarding",
+	mesh_power_mode: "power_mode",
+	mesh_nolearn: "nolearn"
+};
+
+function wdev_remove(name)
+{
+	nl80211.request(nl80211.const.NL80211_CMD_DEL_INTERFACE, 0, { dev: name });
+}
+
+function __phy_is_fullmac(phyidx)
+{
+	let data = nl80211.request(nl80211.const.NL80211_CMD_GET_WIPHY, 0, { wiphy: phyidx });
+
+	return !data.software_iftypes.monitor;
+}
+
+function phy_is_fullmac(phy)
+{
+	let phyidx = int(trim(readfile(`/sys/class/ieee80211/${phy}/index`)));
+
+	return __phy_is_fullmac(phyidx);
+}
+
+function find_reusable_wdev(phyidx)
+{
+	if (!__phy_is_fullmac(phyidx))
+		return null;
+
+	let data = nl80211.request(
+		nl80211.const.NL80211_CMD_GET_INTERFACE,
+		nl80211.const.NLM_F_DUMP,
+		{ wiphy: phyidx });
+	for (let res in data)
+		if (trim(readfile(`/sys/class/net/${res.ifname}/operstate`)) == "down")
+			return res.ifname;
+	return null;
+}
+
+function wdev_set_radio_mask(name, mask)
+{
+	nl80211.request(nl80211.const.NL80211_CMD_SET_INTERFACE, 0, {
+		dev: name,
+		vif_radio_mask: mask
+	});
+}
+
+function wdev_create(phy, name, data)
+{
+	let phyidx = int(readfile(`/sys/class/ieee80211/${phy}/index`));
+
+	wdev_remove(name);
+
+	if (!iftypes[data.mode])
+		return `Invalid mode: ${data.mode}`;
+
+	let req = {
+		wiphy: phyidx,
+		ifname: name,
+		iftype: iftypes[data.mode],
+	};
+
+	if (data["4addr"])
+		req["4addr"] = data["4addr"];
+	if (data.macaddr)
+		req.mac = data.macaddr;
+	if (data.radio != null && data.radio >= 0)
+		req.vif_radio_mask = 1 << data.radio;
+
+	nl80211.error();
+
+	let reuse_ifname = find_reusable_wdev(phyidx);
+	if (reuse_ifname &&
+	    (reuse_ifname == name ||
+	     rtnl.request(rtnl.const.RTM_SETLINK, 0, { dev: reuse_ifname, ifname: name}) != false)) {
+		req.dev = req.ifname;
+		delete req.ifname;
+		nl80211.request(nl80211.const.NL80211_CMD_SET_INTERFACE, 0, req);
+	} else {
+		nl80211.request(
+			nl80211.const.NL80211_CMD_NEW_INTERFACE,
+			nl80211.const.NLM_F_CREATE,
+			req);
+	}
+
+	let error = nl80211.error();
+	if (error)
+		return error;
+
+	if (data.powersave != null) {
+		nl80211.request(nl80211.const.NL80211_CMD_SET_POWER_SAVE, 0,
+			{ dev: name, ps_state: data.powersave ? 1 : 0});
+	}
+
+	return null;
+}
+
+function wdev_set_mesh_params(name, data)
+{
+	let mesh_cfg = {};
+
+	for (let key in mesh_params) {
+		let val = data[key];
+		if (val == null)
+			continue;
+		mesh_cfg[mesh_params[key]] = int(val);
+	}
+
+	if (!length(mesh_cfg))
+		return null;
+
+	nl80211.request(nl80211.const.NL80211_CMD_SET_MESH_CONFIG, 0,
+		{ dev: name, mesh_params: mesh_cfg });
+
+	return nl80211.error();
+}
+
+function wdev_set_up(name, up)
+{
+	rtnl.request(rtnl.const.RTM_SETLINK, 0, { dev: name, change: 1, flags: up ? 1 : 0 });
+}
+
+function phy_sysfs_file(phy, name)
+{
+	return trim(readfile(`/sys/class/ieee80211/${phy}/${name}`));
+}
+
+function macaddr_split(str)
+{
+	return map(split(str, ":"), (val) => hex(val));
+}
+
+function macaddr_join(addr)
+{
+	return join(":", map(addr, (val) => sprintf("%02x", val)));
+}
+
+function wdev_macaddr(wdev)
+{
+	return trim(readfile(`/sys/class/net/${wdev}/address`));
+}
+
+const phy_proto = {
+	macaddr_init: function(used, options) {
+		this.macaddr_options = options ?? {};
+		this.macaddr_list = {};
+
+		if (type(used) == "object")
+			for (let addr in used)
+				this.macaddr_list[addr] = used[addr];
+		else
+			for (let addr in used)
+				this.macaddr_list[addr] = -1;
+
+		this.for_each_wdev((wdev) => {
+			let macaddr = wdev_macaddr(wdev);
+			this.macaddr_list[macaddr] ??= -1;
+		});
+
+		return this.macaddr_list;
+	},
+
+	macaddr_generate: function(data) {
+		let phy = this.phy;
+		let radio_idx = this.radio;
+		let idx = int(data.id ?? 0);
+		let mbssid = int(data.mbssid ?? 0) > 0;
+		let num_global = int(data.num_global ?? 1);
+		let use_global = !mbssid && idx < num_global;
+
+		let base_addr = phy_sysfs_file(phy, "macaddress");
+		if (!base_addr)
+			return null;
+
+		let base_mask = phy_sysfs_file(phy, "address_mask");
+		if (!base_mask)
+			return null;
+
+		if (base_mask == "00:00:00:00:00:00")
+			base_mask = "ff:ff:ff:ff:ff:ff";
+
+		if (data.macaddr_base)
+			base_addr = data.macaddr_base;
+		else if (base_mask == "ff:ff:ff:ff:ff:ff" &&
+		    (radio_idx > 0 || idx >= num_global)) {
+			let addrs = split(phy_sysfs_file(phy, "addresses"), "\n");
+
+			if (radio_idx != null) {
+				if (radio_idx && radio_idx < length(addrs))
+					base_addr = addrs[radio_idx];
+				else
+					idx += radio_idx * 16;
+			} else {
+				if (idx < length(addrs))
+					return addrs[idx];
+			}
+		}
+
+		if (!idx && !mbssid)
+			return base_addr;
+
+		let addr = macaddr_split(base_addr);
+		let mask = macaddr_split(base_mask);
+		let type;
+
+		if (mbssid)
+			type = "b5";
+		else if (use_global)
+			type = "add";
+		else if (mask[0] > 0)
+			type = "b1";
+		else if (mask[5] < 0xff)
+			type = "b5";
+		else
+			type = "add";
+
+		switch (type) {
+		case "b1":
+			if (!(addr[0] & 2))
+				idx--;
+			addr[0] |= 2;
+			addr[0] ^= idx << 2;
+			break;
+		case "b5":
+			if (mbssid)
+				addr[0] |= 2;
+			addr[5] ^= idx;
+			break;
+		default:
+			for (let i = 5; i > 0; i--) {
+				addr[i] += idx;
+				if (addr[i] < 256)
+					break;
+				addr[i] %= 256;
+			}
+			break;
+		}
+
+		return macaddr_join(addr);
+	},
+
+	macaddr_next: function(val) {
+		let data = this.macaddr_options ?? {};
+		let list = this.macaddr_list;
+
+		for (let i = 0; i < 32; i++) {
+			data.id = i;
+
+			let mac = this.macaddr_generate(data);
+			if (!mac)
+				return null;
+
+			if (list[mac] != null)
+				continue;
+
+			list[mac] = val != null ? val : -1;
+			return mac;
+		}
+	},
+
+	wdev_add: function(name, data) {
+		let phydev = this;
+		wdev_create(this.phy, name, {
+			...data,
+			radio: this.radio,
+		});
+	},
+
+	for_each_wdev: function(cb) {
+		let wdevs = nl80211.request(
+			nl80211.const.NL80211_CMD_GET_INTERFACE,
+			nl80211.const.NLM_F_DUMP,
+			{ wiphy: this.idx }
+		);
+
+		let mac_wdev = {};
+		for (let wdev in wdevs) {
+			if (wdev.iftype == nl80211.const.NL80211_IFTYPE_AP_VLAN)
+				continue;
+			if (this.radio != null && wdev.vif_radio_mask != null &&
+			    !(wdev.vif_radio_mask & (1 << this.radio)))
+				continue;
+			mac_wdev[wdev.mac] = wdev;
+		}
+
+		for (let wdev in wdevs) {
+			if (!mac_wdev[wdev.mac])
+				continue;
+
+			cb(wdev.ifname);
+		}
+	}
+};
+
+function phy_open(phy, radio)
+{
+	let phyidx = readfile(`/sys/class/ieee80211/${phy}/index`);
+	if (!phyidx)
+		return null;
+
+	let name = phy;
+	if (radio === "" || radio < 0)
+		radio = null;
+	if (radio != null)
+		name += "." + radio;
+
+	return proto({
+		phy, name, radio,
+		idx: int(phyidx),
+	}, phy_proto);
+}
+
+const vlist_proto = {
+	update: function(values, arg) {
+		let data = this.data;
+		let cb = this.cb;
+		let seq = { };
+		let new_data = {};
+		let old_data = {};
+
+		this.data = new_data;
+
+		if (type(values) == "object") {
+			for (let key in values) {
+				old_data[key] = data[key];
+				new_data[key] = values[key];
+				delete data[key];
+			}
+		} else {
+			for (let val in values) {
+				let cur_key = val[0];
+				let cur_obj = val[1];
+
+				old_data[cur_key] = data[cur_key];
+				new_data[cur_key] = val[1];
+				delete data[cur_key];
+			}
+		}
+
+		for (let key in data) {
+			cb(null, data[key], arg);
+			delete data[key];
+		}
+		for (let key in new_data)
+			cb(new_data[key], old_data[key], arg);
+	}
+};
+
+function is_equal(val1, val2) {
+	let t1 = type(val1);
+
+	if (t1 != type(val2))
+		return false;
+
+	if (t1 == "array") {
+		if (length(val1) != length(val2))
+			return false;
+
+		for (let i = 0; i < length(val1); i++)
+			if (!is_equal(val1[i], val2[i]))
+				return false;
+
+		return true;
+	} else if (t1 == "object") {
+		for (let key in val1)
+			if (!is_equal(val1[key], val2[key]))
+				return false;
+		for (let key in val2)
+			if (val1[key] == null)
+				return false;
+		return true;
+	} else {
+		return val1 == val2;
+	}
+}
+
+function vlist_new(cb) {
+	return proto({
+		cb: cb,
+		data: {}
+	}, vlist_proto);
+}
+
+export { wdev_remove, wdev_create, wdev_set_mesh_params, wdev_set_radio_mask, wdev_set_up, is_equal, vlist_new, phy_is_fullmac, phy_open };
diff --git a/wireless-scripts-example/old/hostapd-WiFi7.conf b/wireless-scripts-example/old/hostapd-WiFi7.conf
new file mode 100644
index 0000000000..37a121ac1a
--- /dev/null
+++ b/wireless-scripts-example/old/hostapd-WiFi7.conf
@@ -0,0 +1,62 @@
+
+
+ssid=myPI-WiFi7
+wpa_passphrase=myPW1234
+hw_mode=a
+channel=37
+chanlist=37
+op_class=134
+country_code=US
+ieee80211d=1
+
+bridge=br0
+interface=wlan0
+
+driver=nl80211
+
+logger_syslog=1
+logger_syslog_level=2
+
+ctrl_interface=/var/run/hostapd
+ctrl_interface_group=0
+
+tx_queue_data2_burst=2.0
+
+auth_algs=3
+macaddr_acl=0
+ignore_broadcast_ssid=0
+okc=1
+wpa=2
+wpa_pairwise=CCMP CCMP-256
+rsn_pairwise=CCMP CCMP-256
+wpa_key_mgmt=SAE
+ieee80211w=2
+
+ieee80211n=1
+wmm_enabled=1
+ht_coex=0
+ht_capab=[LDPC][HT40+][HT40-][GF][SHORT-GI-20][SHORT-GI-40][TX-STBC][RX-STBC1][MAX-AMSDU-7935]
+
+ieee80211ac=1
+vht_oper_chwidth=1
+vht_oper_centr_freq_seg0_idx=39
+vht_capab=[VHT160-80PLUS80][RXLDPC][SHORT-GI-80][SHORT-GI-160][TX-STBC-2BY1][SU-BEAMFORMEE][MU-BEAMFORMEE][RX-ANTENNA-PATTERN][TX-ANTENNA-PATTERN][RX-STBC-1][BF-ANTENNA-4][MAX-MPDU-11454][MAX-A-MPDU-LEN-EXP7]
+
+ieee80211ax=1
+he_oper_chwidth=2
+he_oper_centr_freq_seg0_idx=39
+he_default_pe_duration=4
+he_rts_threshold=1023
+he_mu_edca_qos_info_param_count=0
+he_mu_edca_qos_info_q_ack=0
+he_mu_edca_qos_info_queue_request=0
+he_mu_edca_qos_info_txop_request=0
+he_mu_edca_ac_be_aifsn=8
+he_mu_edca_ac_be_aci=0
+he_mu_edca_ac_vo_ecwmin=9
+he_mu_edca_ac_vo_ecwmax=10
+
+ieee80211be=1
+eht_oper_chwidth=2
+eht_oper_centr_freq_seg0_idx=39
+
diff --git a/wireless-scripts-example/old/hostapd-default.sh b/wireless-scripts-example/old/hostapd-default.sh
new file mode 100644
index 0000000000..f15e7f1b43
--- /dev/null
+++ b/wireless-scripts-example/old/hostapd-default.sh
@@ -0,0 +1,1670 @@
+. /lib/functions/network.sh
+. /lib/functions.sh
+
+wpa_supplicant_add_rate() {
+	local var="$1"
+	local val="$(($2 / 1000))"
+	local sub="$((($2 / 100) % 10))"
+	append $var "$val" ","
+	[ $sub -gt 0 ] && append $var "."
+}
+
+hostapd_add_rate() {
+	local var="$1"
+	local val="$(($2 / 100))"
+	append $var "$val" " "
+}
+
+hostapd_append_wep_key() {
+	local var="$1"
+
+	wep_keyidx=0
+	set_default key 1
+	case "$key" in
+		[1234])
+			for idx in 1 2 3 4; do
+				local zidx
+				zidx="$(($idx - 1))"
+				json_get_var ckey "key${idx}"
+				[ -n "$ckey" ] && \
+					append $var "wep_key${zidx}=$(prepare_key_wep "$ckey")" "$N$T"
+			done
+			wep_keyidx="$((key - 1))"
+		;;
+		*)
+			append $var "wep_key0=$(prepare_key_wep "$key")" "$N$T"
+		;;
+	esac
+}
+
+hostapd_append_wpa_key_mgmt() {
+	local auth_type_l="$(echo $auth_type | tr 'a-z' 'A-Z')"
+
+	case "$auth_type" in
+		psk|eap)
+			append wpa_key_mgmt "WPA-$auth_type_l"
+			[ "${wpa:-2}" -ge 2 ] && [ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-${auth_type_l}"
+			[ "${ieee80211w:-0}" -gt 0 ] && append wpa_key_mgmt "WPA-${auth_type_l}-SHA256"
+		;;
+		eap192)
+			append wpa_key_mgmt "WPA-EAP-SUITE-B-192"
+			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-EAP-SHA384"
+		;;
+		eap-eap2)
+			append wpa_key_mgmt "WPA-EAP"
+			append wpa_key_mgmt "WPA-EAP-SHA256"
+			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-EAP"
+		;;
+		eap2)
+			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-EAP"
+			append wpa_key_mgmt "WPA-EAP-SHA256"
+		;;
+		sae)
+			append wpa_key_mgmt "SAE"
+			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-SAE"
+		;;
+		psk-sae)
+			[ "$band" = "6g" ] || {
+				append wpa_key_mgmt "WPA-PSK"
+				[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-PSK"
+				[ "${ieee80211w:-0}" -gt 0 ] && append wpa_key_mgmt "WPA-PSK-SHA256"
+			}
+			append wpa_key_mgmt "SAE"
+			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-SAE"
+		;;
+		owe)
+			append wpa_key_mgmt "OWE"
+		;;
+	esac
+
+	[ "$fils" -gt 0 ] && {
+		case "$auth_type" in
+			eap192)
+				append wpa_key_mgmt FILS-SHA384
+				[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt FT-FILS-SHA384
+			;;
+			eap*)
+				append wpa_key_mgmt FILS-SHA256
+				[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt FT-FILS-SHA256
+			;;
+		esac
+	}
+
+	[ "$auth_osen" = "1" ] && append wpa_key_mgmt "OSEN"
+}
+
+hostapd_add_log_config() {
+	config_add_boolean \
+		log_80211 \
+		log_8021x \
+		log_radius \
+		log_wpa \
+		log_driver \
+		log_iapp \
+		log_mlme
+
+	config_add_int log_level
+}
+
+hostapd_common_add_device_config() {
+	config_add_array basic_rate
+	config_add_array supported_rates
+	config_add_string beacon_rate
+
+	config_add_string country country3
+	config_add_boolean country_ie doth
+	config_add_boolean spectrum_mgmt_required
+	config_add_int local_pwr_constraint
+	config_add_string require_mode
+	config_add_boolean legacy_rates
+	config_add_int cell_density
+	config_add_int rts_threshold
+	config_add_int rssi_reject_assoc_rssi
+	config_add_int rssi_ignore_probe_request
+	config_add_int maxassoc
+	config_add_int reg_power_type
+	config_add_boolean stationary_ap
+
+	config_add_string acs_chan_bias
+	config_add_array hostapd_options
+
+	config_add_int airtime_mode
+	config_add_int mbssid
+
+	hostapd_add_log_config
+}
+
+hostapd_prepare_device_config() {
+	local config="$1"
+	local driver="$2"
+
+	local base_cfg=
+
+	json_get_vars country country3 country_ie beacon_int:100 doth require_mode legacy_rates \
+		acs_chan_bias local_pwr_constraint spectrum_mgmt_required airtime_mode cell_density \
+		rts_threshold beacon_rate rssi_reject_assoc_rssi rssi_ignore_probe_request maxassoc \
+		mbssid:0 band reg_power_type stationary_ap
+
+	hostapd_set_log_options base_cfg
+
+	set_default country_ie 1
+	set_default spectrum_mgmt_required 0
+	set_default doth 1
+	set_default legacy_rates 0
+	set_default airtime_mode 0
+	set_default cell_density 0
+
+	[ -n "$country" ] && {
+		append base_cfg "country_code=$country" "$N"
+		[ -n "$country3" ] && append base_cfg "country3=$country3" "$N"
+
+		[ "$country_ie" -gt 0 ] && {
+			append base_cfg "ieee80211d=1" "$N"
+			[ -n "$local_pwr_constraint" ] && append base_cfg "local_pwr_constraint=$local_pwr_constraint" "$N"
+			[ "$spectrum_mgmt_required" -gt 0 ] && append base_cfg "spectrum_mgmt_required=$spectrum_mgmt_required" "$N"
+		}
+		[ "$hwmode" = "a" -a "$doth" -gt 0 ] && append base_cfg "ieee80211h=1" "$N"
+	}
+
+	[ -n "$acs_chan_bias" ] && append base_cfg "acs_chan_bias=$acs_chan_bias" "$N"
+
+	local brlist= br
+	json_get_values basic_rate_list basic_rate
+	local rlist= r
+	json_get_values rate_list supported_rates
+
+	[ -n "$hwmode" ] && append base_cfg "hw_mode=$hwmode" "$N"
+	if [ "$hwmode" = "g" ] || [ "$hwmode" = "a" ]; then
+		[ -n "$require_mode" ] && legacy_rates=0
+		case "$require_mode" in
+			n) append base_cfg "require_ht=1" "$N";;
+			ac) append base_cfg "require_vht=1" "$N";;
+		esac
+	fi
+	case "$hwmode" in
+		b)
+			if [ "$cell_density" -eq 1 ]; then
+				set_default rate_list "5500 11000"
+				set_default basic_rate_list "5500 11000"
+			elif [ "$cell_density" -ge 2 ]; then
+				set_default rate_list "11000"
+				set_default basic_rate_list "11000"
+			fi
+		;;
+		g)
+			if [ "$cell_density" -eq 0 ] || [ "$cell_density" -eq 1 ]; then
+				if [ "$legacy_rates" -eq 0 ]; then
+					set_default rate_list "6000 9000 12000 18000 24000 36000 48000 54000"
+					set_default basic_rate_list "6000 12000 24000"
+				elif [ "$cell_density" -eq 1 ]; then
+					set_default rate_list "5500 6000 9000 11000 12000 18000 24000 36000 48000 54000"
+					set_default basic_rate_list "5500 11000"
+				fi
+			elif [ "$cell_density" -ge 3 ] && [ "$legacy_rates" -ne 0 ] || [ "$cell_density" -eq 2 ]; then
+				if [ "$legacy_rates" -eq 0 ]; then
+					set_default rate_list "12000 18000 24000 36000 48000 54000"
+					set_default basic_rate_list "12000 24000"
+				else
+					set_default rate_list "11000 12000 18000 24000 36000 48000 54000"
+					set_default basic_rate_list "11000"
+				fi
+			elif [ "$cell_density" -ge 3 ]; then
+				set_default rate_list "24000 36000 48000 54000"
+				set_default basic_rate_list "24000"
+			fi
+		;;
+		a)
+			if [ "$cell_density" -eq 1 ]; then
+				set_default rate_list "6000 9000 12000 18000 24000 36000 48000 54000"
+				set_default basic_rate_list "6000 12000 24000"
+			elif [ "$cell_density" -eq 2 ]; then
+				set_default rate_list "12000 18000 24000 36000 48000 54000"
+				set_default basic_rate_list "12000 24000"
+			elif [ "$cell_density" -ge 3 ]; then
+				set_default rate_list "24000 36000 48000 54000"
+				set_default basic_rate_list "24000"
+			fi
+		;;
+	esac
+
+	for r in $rate_list; do
+		hostapd_add_rate rlist "$r"
+	done
+
+	for br in $basic_rate_list; do
+		hostapd_add_rate brlist "$br"
+	done
+
+	[ -n "$rssi_reject_assoc_rssi" ] && append base_cfg "rssi_reject_assoc_rssi=$rssi_reject_assoc_rssi" "$N"
+	[ -n "$rssi_ignore_probe_request" ] && append base_cfg "rssi_ignore_probe_request=$rssi_ignore_probe_request" "$N"
+	[ -n "$beacon_rate" ] && append base_cfg "beacon_rate=$beacon_rate" "$N"
+	[ -n "$rlist" ] && append base_cfg "supported_rates=$rlist" "$N"
+	[ -n "$brlist" ] && append base_cfg "basic_rates=$brlist" "$N"
+	append base_cfg "beacon_int=$beacon_int" "$N"
+	[ -n "$rts_threshold" ] && append base_cfg "rts_threshold=$rts_threshold" "$N"
+	[ "$airtime_mode" -gt 0 ] && append base_cfg "airtime_mode=$airtime_mode" "$N"
+	[ -n "$maxassoc" ] && append base_cfg "iface_max_num_sta=$maxassoc" "$N"
+	[ "$mbssid" -gt 0 ] && [ "$mbssid" -le 2 ] && append base_cfg "mbssid=$mbssid" "$N"
+
+	[ "$band" = "6g" ] && {
+		set_default reg_power_type 0
+		append base_cfg "he_6ghz_reg_pwr_type=$reg_power_type" "$N"
+	}
+
+	set_default stationary_ap 1
+	append base_cfg "stationary_ap=$stationary_ap" "$N"
+
+	json_get_values opts hostapd_options
+	for val in $opts; do
+		append base_cfg "$val" "$N"
+	done
+
+	cat > "$config" <<EOF
+driver=$driver
+$base_cfg
+EOF
+}
+
+hostapd_common_add_bss_config() {
+	config_add_string 'bssid:macaddr' 'ssid:string'
+	config_add_boolean wds wmm uapsd hidden utf8_ssid ppsk
+
+	config_add_int maxassoc max_inactivity
+	config_add_boolean disassoc_low_ack isolate short_preamble skip_inactivity_poll
+
+	config_add_int \
+		wep_rekey eap_reauth_period \
+		wpa_group_rekey wpa_pair_rekey wpa_master_rekey
+	config_add_boolean wpa_strict_rekey
+	config_add_boolean wpa_disable_eapol_key_retries
+
+	config_add_boolean tdls_prohibit
+
+	config_add_boolean rsn_preauth auth_cache
+	config_add_int ieee80211w
+	config_add_int eapol_version
+
+	config_add_array auth_server acct_server
+	config_add_string 'server:host'
+	config_add_string auth_secret key
+	config_add_int 'auth_port:port' 'port:port'
+
+	config_add_string acct_secret
+	config_add_int acct_port
+	config_add_int acct_interval
+
+	config_add_int bss_load_update_period chan_util_avg_period
+
+	config_add_string dae_client
+	config_add_string dae_secret
+	config_add_int dae_port
+
+	config_add_string nasid
+	config_add_string ownip
+	config_add_string radius_client_addr
+	config_add_string iapp_interface
+	config_add_string eap_type ca_cert client_cert identity anonymous_identity auth priv_key priv_key_pwd
+	config_add_boolean ca_cert_usesystem ca_cert2_usesystem
+	config_add_string subject_match subject_match2
+	config_add_array altsubject_match altsubject_match2
+	config_add_array domain_match domain_match2 domain_suffix_match domain_suffix_match2
+	config_add_string ieee80211w_mgmt_cipher
+
+	config_add_int dynamic_vlan vlan_naming vlan_no_bridge
+	config_add_string vlan_tagged_interface vlan_bridge
+	config_add_string vlan_file
+
+	config_add_string 'key1:wepkey' 'key2:wepkey' 'key3:wepkey' 'key4:wepkey' 'password:wpakey'
+
+	config_add_string wpa_psk_file
+
+	config_add_int multi_ap
+
+	config_add_boolean wps_pushbutton wps_label ext_registrar wps_pbc_in_m1
+	config_add_int wps_ap_setup_locked wps_independent
+	config_add_string wps_device_type wps_device_name wps_manufacturer wps_pin
+	config_add_string multi_ap_backhaul_ssid multi_ap_backhaul_key
+
+	config_add_boolean wnm_sleep_mode wnm_sleep_mode_no_keys bss_transition mbo
+	config_add_int time_advertisement
+	config_add_string time_zone
+	config_add_string vendor_elements
+
+	config_add_boolean ieee80211k rrm_neighbor_report rrm_beacon_report
+
+	config_add_boolean ftm_responder stationary_ap
+	config_add_string lci civic
+
+	config_add_boolean ieee80211r pmk_r1_push ft_psk_generate_local ft_over_ds
+	config_add_int r0_key_lifetime reassociation_deadline
+	config_add_string mobility_domain r1_key_holder rxkh_file
+	config_add_array r0kh r1kh
+
+	config_add_int ieee80211w_max_timeout ieee80211w_retry_timeout
+
+	config_add_string macfilter 'macfile:file'
+	config_add_array 'maclist:list(macaddr)'
+
+	config_add_array bssid_blacklist
+	config_add_array bssid_whitelist
+
+	config_add_int mcast_rate
+	config_add_array basic_rate
+	config_add_array supported_rates
+
+	config_add_boolean sae_require_mfp
+	config_add_int sae_pwe
+
+	config_add_string 'owe_transition_bssid:macaddr' 'owe_transition_ssid:string'
+	config_add_string owe_transition_ifname
+
+	config_add_boolean iw_enabled iw_internet iw_asra iw_esr iw_uesa
+	config_add_int iw_access_network_type iw_venue_group iw_venue_type
+	config_add_int iw_ipaddr_type_availability iw_gas_address3
+	config_add_string iw_hessid iw_network_auth_type iw_qos_map_set
+	config_add_array iw_roaming_consortium iw_domain_name iw_anqp_3gpp_cell_net iw_nai_realm
+	config_add_array iw_anqp_elem iw_venue_name iw_venue_url
+
+	config_add_boolean hs20 disable_dgaf osen
+	config_add_int anqp_domain_id
+	config_add_int hs20_deauth_req_timeout
+	config_add_array hs20_oper_friendly_name
+	config_add_array osu_provider
+	config_add_array operator_icon
+	config_add_array hs20_conn_capab
+	config_add_string osu_ssid hs20_wan_metrics hs20_operating_class hs20_t_c_filename hs20_t_c_timestamp
+
+	config_add_string hs20_t_c_server_url
+
+	config_add_array airtime_sta_weight
+	config_add_int airtime_bss_weight airtime_bss_limit
+
+	config_add_boolean multicast_to_unicast multicast_to_unicast_all proxy_arp per_sta_vif
+
+	config_add_array hostapd_bss_options
+	config_add_boolean default_disabled
+
+	config_add_boolean request_cui
+	config_add_array radius_auth_req_attr
+	config_add_array radius_acct_req_attr
+
+	config_add_int eap_server radius_server_auth_port
+	config_add_string eap_user_file ca_cert server_cert private_key private_key_passwd server_id radius_server_clients
+
+	config_add_boolean fils
+	config_add_string fils_dhcp
+
+	config_add_int ocv
+
+	config_add_boolean apup
+	config_add_string apup_peer_ifname_prefix
+}
+
+hostapd_set_vlan_file() {
+	local ifname="$1"
+	local vlan="$2"
+	json_get_vars name vid
+	echo "${vid} ${ifname}-${name}" >> /var/run/hostapd-${ifname}.vlan
+	wireless_add_vlan "${vlan}" "${ifname}-${name}"
+}
+
+hostapd_set_vlan() {
+	local ifname="$1"
+
+	rm -f /var/run/hostapd-${ifname}.vlan
+	for_each_vlan hostapd_set_vlan_file ${ifname}
+}
+
+hostapd_set_psk_file() {
+	local ifname="$1"
+	local vlan="$2"
+	local vlan_id=""
+
+	json_get_vars mac vid key
+	set_default mac "00:00:00:00:00:00"
+	[ -n "$vid" ] && vlan_id="vlanid=$vid "
+	echo "${vlan_id} ${mac} ${key}" >> /var/run/hostapd-${ifname}.psk
+}
+
+hostapd_set_psk() {
+	local ifname="$1"
+
+	rm -f /var/run/hostapd-${ifname}.psk
+	case "$auth_type" in
+		psk|psk-sae) ;;
+		*) return ;;
+	esac
+	for_each_station hostapd_set_psk_file ${ifname}
+}
+
+hostapd_set_sae_file() {
+	local ifname="$1"
+	local vlan="$2"
+	local vlan_id=""
+
+	json_get_vars mac vid key
+	set_default mac "ff:ff:ff:ff:ff:ff"
+	[ -n "$mac" ] && mac="|mac=$mac"
+	[ -n "$vid" ] && vlan_id="|vlanid=$vid"
+	printf '%s%s%s\n' "${key}" "${mac}" "${vlan_id}" >> /var/run/hostapd-${ifname}.sae
+}
+
+hostapd_set_sae() {
+	local ifname="$1"
+
+	rm -f /var/run/hostapd-${ifname}.sae
+	case "$auth_type" in
+		sae|psk-sae) ;;
+		*) return ;;
+	esac
+	for_each_station hostapd_set_sae_file ${ifname}
+}
+
+append_iw_roaming_consortium() {
+	[ -n "$1" ] && append bss_conf "roaming_consortium=$1" "$N"
+}
+
+append_iw_domain_name() {
+	if [ -z "$iw_domain_name_conf" ]; then
+		iw_domain_name_conf="$1"
+	else
+		iw_domain_name_conf="$iw_domain_name_conf,$1"
+	fi
+}
+
+append_iw_anqp_3gpp_cell_net() {
+	if [ -z "$iw_anqp_3gpp_cell_net_conf" ]; then
+		iw_anqp_3gpp_cell_net_conf="$1"
+	else
+		iw_anqp_3gpp_cell_net_conf="$iw_anqp_3gpp_cell_net_conf;$1"
+	fi
+}
+
+append_iw_anqp_elem() {
+	[ -n "$1" ] && append bss_conf "anqp_elem=$1" "$N"
+}
+
+append_iw_nai_realm() {
+	[ -n "$1" ] && append bss_conf "nai_realm=$1" "$N"
+}
+
+append_iw_venue_name() {
+	append bss_conf "venue_name=$1" "$N"
+}
+
+append_iw_venue_url() {
+	append bss_conf "venue_url=$1" "$N"
+}
+
+append_hs20_oper_friendly_name() {
+	append bss_conf "hs20_oper_friendly_name=$1" "$N"
+}
+
+append_osu_provider_friendly_name() {
+	append bss_conf "osu_friendly_name=$1" "$N"
+}
+
+append_osu_provider_service_desc() {
+	append bss_conf "osu_service_desc=$1" "$N"
+}
+
+append_hs20_icon() {
+	local width height lang type path
+	config_get width "$1" width
+	config_get height "$1" height
+	config_get lang "$1" lang
+	config_get type "$1" type
+	config_get path "$1" path
+
+	append bss_conf "hs20_icon=$width:$height:$lang:$type:$1:$path" "$N"
+}
+
+append_hs20_icons() {
+	config_load wireless
+	config_foreach append_hs20_icon hs20-icon
+}
+
+append_operator_icon() {
+	append bss_conf "operator_icon=$1" "$N"
+}
+
+append_osu_icon() {
+	append bss_conf "osu_icon=$1" "$N"
+}
+
+append_osu_provider() {
+	local cfgtype osu_server_uri osu_friendly_name osu_nai osu_nai2 osu_method_list
+
+	config_load wireless
+	config_get cfgtype "$1" TYPE
+	[ "$cfgtype" != "osu-provider" ] && return
+
+	append bss_conf "# provider $1" "$N"
+	config_get osu_server_uri "$1" osu_server_uri
+	config_get osu_nai "$1" osu_nai
+	config_get osu_nai2 "$1" osu_nai2
+	config_get osu_method_list "$1" osu_method
+
+	append bss_conf "osu_server_uri=$osu_server_uri" "$N"
+	append bss_conf "osu_nai=$osu_nai" "$N"
+	append bss_conf "osu_nai2=$osu_nai2" "$N"
+	append bss_conf "osu_method_list=$osu_method_list" "$N"
+
+	config_list_foreach "$1" osu_service_desc append_osu_provider_service_desc
+	config_list_foreach "$1" osu_friendly_name append_osu_friendly_name
+	config_list_foreach "$1" osu_icon append_osu_icon
+
+	append bss_conf "$N"
+}
+
+append_hs20_conn_capab() {
+	[ -n "$1" ] && append bss_conf "hs20_conn_capab=$1" "$N"
+}
+
+append_radius_acct_req_attr() {
+	[ -n "$1" ] && append bss_conf "radius_acct_req_attr=$1" "$N"
+}
+
+append_radius_auth_req_attr() {
+	[ -n "$1" ] && append bss_conf "radius_auth_req_attr=$1" "$N"
+}
+
+append_airtime_sta_weight() {
+	[ -n "$1" ] && append bss_conf "airtime_sta_weight=$1" "$N"
+}
+
+append_auth_server() {
+	[ -n "$1" ] || return
+	append bss_conf "auth_server_addr=$1" "$N"
+	append bss_conf "auth_server_port=$auth_port" "$N"
+	[ -n "$auth_secret" ] && append bss_conf "auth_server_shared_secret=$auth_secret" "$N"
+}
+
+append_acct_server() {
+	[ -n "$1" ] || return
+	append bss_conf "acct_server_addr=$1" "$N"
+	append bss_conf "acct_server_port=$acct_port" "$N"
+	[ -n "$acct_secret" ] && append bss_conf "acct_server_shared_secret=$acct_secret" "$N"
+}
+
+hostapd_set_bss_options() {
+	local var="$1"
+	local phy="$2"
+	local vif="$3"
+
+	wireless_vif_parse_encryption
+
+	local bss_conf bss_md5sum ft_key rxkhs
+	local wep_rekey wpa_group_rekey wpa_pair_rekey wpa_master_rekey wpa_key_mgmt
+
+	json_get_vars \
+		wep_rekey wpa_group_rekey wpa_pair_rekey wpa_master_rekey wpa_strict_rekey \
+		wpa_disable_eapol_key_retries tdls_prohibit \
+		maxassoc max_inactivity disassoc_low_ack isolate auth_cache \
+		wps_pushbutton wps_label ext_registrar wps_pbc_in_m1 wps_ap_setup_locked \
+		wps_independent wps_device_type wps_device_name wps_manufacturer wps_pin \
+		macfilter ssid utf8_ssid wmm uapsd hidden short_preamble rsn_preauth \
+		iapp_interface eapol_version dynamic_vlan ieee80211w nasid \
+		acct_secret acct_port acct_interval \
+		bss_load_update_period chan_util_avg_period sae_require_mfp sae_pwe \
+		multi_ap multi_ap_backhaul_ssid multi_ap_backhaul_key skip_inactivity_poll \
+		ppsk airtime_bss_weight airtime_bss_limit airtime_sta_weight \
+		multicast_to_unicast_all proxy_arp per_sta_vif \
+		eap_server eap_user_file ca_cert server_cert private_key private_key_passwd server_id radius_server_clients radius_server_auth_port \
+		vendor_elements fils ocv apup
+
+	set_default fils 0
+	set_default isolate 0
+	set_default maxassoc 0
+	set_default max_inactivity 0
+	set_default short_preamble 1
+	set_default disassoc_low_ack 1
+	set_default skip_inactivity_poll 0
+	set_default hidden 0
+	set_default wmm 1
+	set_default uapsd 1
+	set_default wpa_disable_eapol_key_retries 0
+	set_default tdls_prohibit 0
+	set_default eapol_version $((wpa & 1))
+	set_default acct_port 1813
+	set_default bss_load_update_period 60
+	set_default chan_util_avg_period 600
+	set_default utf8_ssid 1
+	set_default multi_ap 0
+	set_default ppsk 0
+	set_default airtime_bss_weight 0
+	set_default airtime_bss_limit 0
+	set_default eap_server 0
+	set_default apup 0
+
+	/usr/sbin/hostapd -vfils || fils=0
+
+	append bss_conf "ctrl_interface=/var/run/hostapd"
+	if [ "$isolate" -gt 0 ]; then
+		append bss_conf "ap_isolate=$isolate" "$N"
+	fi
+	if [ "$maxassoc" -gt 0 ]; then
+		append bss_conf "max_num_sta=$maxassoc" "$N"
+	fi
+	if [ "$max_inactivity" -gt 0 ]; then
+		append bss_conf "ap_max_inactivity=$max_inactivity" "$N"
+	fi
+
+	[ "$airtime_bss_weight" -gt 0 ] && append bss_conf "airtime_bss_weight=$airtime_bss_weight" "$N"
+	[ "$airtime_bss_limit" -gt 0 ] && append bss_conf "airtime_bss_limit=$airtime_bss_limit" "$N"
+	json_for_each_item append_airtime_sta_weight airtime_sta_weight
+
+	append bss_conf "bss_load_update_period=$bss_load_update_period" "$N"
+	append bss_conf "chan_util_avg_period=$chan_util_avg_period" "$N"
+	append bss_conf "disassoc_low_ack=$disassoc_low_ack" "$N"
+	append bss_conf "skip_inactivity_poll=$skip_inactivity_poll" "$N"
+	append bss_conf "preamble=$short_preamble" "$N"
+	append bss_conf "wmm_enabled=$wmm" "$N"
+	append bss_conf "ignore_broadcast_ssid=$hidden" "$N"
+	append bss_conf "uapsd_advertisement_enabled=$uapsd" "$N"
+	append bss_conf "utf8_ssid=$utf8_ssid" "$N"
+	append bss_conf "multi_ap=$multi_ap" "$N"
+	[ -n "$vendor_elements" ] && append bss_conf "vendor_elements=$vendor_elements" "$N"
+
+	[ "$tdls_prohibit" -gt 0 ] && append bss_conf "tdls_prohibit=$tdls_prohibit" "$N"
+
+	[ "$wpa" -gt 0 ] && {
+		[ -n "$wpa_group_rekey"  ] && append bss_conf "wpa_group_rekey=$wpa_group_rekey" "$N"
+		[ -n "$wpa_pair_rekey"   ] && append bss_conf "wpa_ptk_rekey=$wpa_pair_rekey"    "$N"
+		[ -n "$wpa_master_rekey" ] && append bss_conf "wpa_gmk_rekey=$wpa_master_rekey"  "$N"
+		[ -n "$wpa_strict_rekey" ] && append bss_conf "wpa_strict_rekey=$wpa_strict_rekey" "$N"
+	}
+
+	[ -n "$nasid" ] && append bss_conf "nas_identifier=$nasid" "$N"
+
+	[ -n "$acct_interval" ] && \
+		append bss_conf "radius_acct_interim_interval=$acct_interval" "$N"
+	json_for_each_item append_acct_server acct_server
+	json_for_each_item append_radius_acct_req_attr radius_acct_req_attr
+
+	[ -n "$ocv" ] && append bss_conf "ocv=$ocv" "$N"
+
+	case "$auth_type" in
+		sae|owe|eap2|eap192)
+			set_default ieee80211w 2
+			set_default sae_require_mfp 1
+			[ "$ppsk" -eq 0 ] && set_default sae_pwe 2
+		;;
+		psk-sae|eap-eap2)
+			if [ "$band" = 6g ]; then
+				set_default ieee80211w 2
+			else
+				set_default ieee80211w 1
+			fi
+			set_default sae_require_mfp 1
+			[ "$ppsk" -eq 0 ] && set_default sae_pwe 2
+		;;
+	esac
+	[ -n "$sae_require_mfp" ] && append bss_conf "sae_require_mfp=$sae_require_mfp" "$N"
+	[ -n "$sae_pwe" ] && append bss_conf "sae_pwe=$sae_pwe" "$N"
+
+	local vlan_possible=""
+
+	case "$auth_type" in
+		none|owe)
+			json_get_vars owe_transition_bssid owe_transition_ssid owe_transition_ifname
+
+			[ -n "$owe_transition_ssid" ] && append bss_conf "owe_transition_ssid=\"$owe_transition_ssid\"" "$N"
+			[ -n "$owe_transition_bssid" ] && append bss_conf "owe_transition_bssid=$owe_transition_bssid" "$N"
+			[ -n "$owe_transition_ifname" ] && append bss_conf "owe_transition_ifname=$owe_transition_ifname" "$N"
+
+			wps_possible=1
+			# Here we make the assumption that if we're in open mode
+			# with WPS enabled, we got to be in unconfigured state.
+			wps_not_configured=1
+		;;
+		psk|sae|psk-sae)
+			json_get_vars key wpa_psk_file sae_password_file
+			if [ "$ppsk" -ne 0 ]; then
+				json_get_vars auth_secret auth_port
+				set_default auth_port 1812
+				json_for_each_item append_auth_server auth_server
+				append bss_conf "macaddr_acl=2" "$N"
+				append bss_conf "wpa_psk_radius=2" "$N"
+			elif [ ${#key} -eq 64 ]; then
+				append bss_conf "wpa_psk=$key" "$N"
+			elif [ ${#key} -ge 8 ] && [ ${#key} -le 63 ]; then
+				append bss_conf "wpa_passphrase=$key" "$N"
+			elif [ -n "$key" ]; then
+				wireless_setup_vif_failed INVALID_WPA_PSK
+				return 1
+			fi
+			[ -z "$wpa_psk_file" ] && set_default wpa_psk_file /var/run/hostapd-$ifname.psk
+			[ -n "$wpa_psk_file" ] && [ "$auth_type" = "psk" -o "$auth_type" = "psk-sae" ] && {
+				[ -e "$wpa_psk_file" ] || touch "$wpa_psk_file"
+				append bss_conf "wpa_psk_file=$wpa_psk_file" "$N"
+			}
+			[ -z "$sae_password_file" ] && set_default sae_password_file /var/run/hostapd-$ifname.sae
+			[ -n "$sae_password_file" ] && [ "$auth_type" = "sae" -o "$auth_type" = "psk-sae" ] && {
+				[ -e "$sae_password_file" ] || touch "$sae_password_file"
+				append bss_conf "sae_password_file=$sae_password_file" "$N"
+			}
+			[ "$eapol_version" -ge "1" -a "$eapol_version" -le "2" ] && append bss_conf "eapol_version=$eapol_version" "$N"
+
+			set_default dynamic_vlan 0
+			vlan_possible=1
+			wps_possible=1
+		;;
+		eap|eap2|eap-eap2|eap192)
+			json_get_vars \
+				auth_server auth_secret auth_port \
+				dae_client dae_secret dae_port \
+				dynamic_ownip ownip radius_client_addr \
+				eap_reauth_period request_cui \
+				erp_domain mobility_domain \
+				fils_realm fils_dhcp
+
+			# radius can provide VLAN ID for clients
+			vlan_possible=1
+
+			set_default dynamic_ownip 1
+
+			# legacy compatibility
+			[ -n "$auth_server" ] || json_get_var auth_server server
+			[ -n "$auth_port" ] || json_get_var auth_port port
+			[ -n "$auth_secret" ] || json_get_var auth_secret key
+
+			[ "$fils" -gt 0 ] && {
+				set_default erp_domain "$mobility_domain"
+				set_default erp_domain "$(echo "$ssid" | md5sum | head -c 8)"
+				set_default fils_realm "$erp_domain"
+
+				append bss_conf "erp_send_reauth_start=1" "$N"
+				append bss_conf "erp_domain=$erp_domain" "$N"
+				append bss_conf "fils_realm=$fils_realm" "$N"
+				append bss_conf "fils_cache_id=$(echo "$fils_realm" | md5sum | head -c 4)" "$N"
+
+				[ "$fils_dhcp" = "*" ] && {
+					json_get_values network network
+					fils_dhcp=
+					for net in $network; do
+						fils_dhcp="$(ifstatus "$net" | jsonfilter -e '@.data.dhcpserver')"
+						[ -n "$fils_dhcp" ] && break
+					done
+
+					[ -z "$fils_dhcp" -a -n "$network_bridge" -a -n "$network_ifname" ] && \
+						fils_dhcp="$(udhcpc -B -n -q -s /lib/netifd/dhcp-get-server.sh -t 1 -i "$network_ifname" 2>/dev/null)"
+				}
+				[ -n "$fils_dhcp" ] && append bss_conf "dhcp_server=$fils_dhcp" "$N"
+			}
+
+			set_default auth_port 1812
+			set_default dae_port 3799
+			set_default request_cui 0
+
+			[ "$eap_server" -eq 0 ] && json_for_each_item append_auth_server auth_server
+			[ "$request_cui" -gt 0 ] && append bss_conf "radius_request_cui=$request_cui" "$N"
+			[ -n "$eap_reauth_period" ] && append bss_conf "eap_reauth_period=$eap_reauth_period" "$N"
+
+			[ -n "$dae_client" -a -n "$dae_secret" ] && {
+				append bss_conf "radius_das_port=$dae_port" "$N"
+				append bss_conf "radius_das_client=$dae_client $dae_secret" "$N"
+			}
+			json_for_each_item append_radius_auth_req_attr radius_auth_req_attr
+
+			if [ -n "$ownip" ]; then
+				append bss_conf "own_ip_addr=$ownip" "$N"
+			elif [ "$dynamic_ownip" -gt 0 ]; then
+				append bss_conf "dynamic_own_ip_addr=$dynamic_ownip" "$N"
+			fi
+
+			[ -n "$radius_client_addr" ] && append bss_conf "radius_client_addr=$radius_client_addr" "$N"
+			append bss_conf "eapol_key_index_workaround=1" "$N"
+			append bss_conf "ieee8021x=1" "$N"
+
+			[ "$eapol_version" -ge "1" -a "$eapol_version" -le "2" ] && append bss_conf "eapol_version=$eapol_version" "$N"
+		;;
+		wep)
+			local wep_keyidx=0
+			json_get_vars key
+			hostapd_append_wep_key bss_conf
+			append bss_conf "wep_default_key=$wep_keyidx" "$N"
+			[ -n "$wep_rekey" ] && append bss_conf "wep_rekey_period=$wep_rekey" "$N"
+		;;
+	esac
+
+	case "$auth_type" in
+		none|owe|psk|sae|psk-sae|wep)
+			json_get_vars \
+			auth_server auth_port auth_secret \
+			ownip radius_client_addr
+
+			[ -n "$auth_server" ] &&  {
+				set_default auth_port 1812
+
+				json_for_each_item append_auth_server auth_server
+				[ -n "$ownip" ] && append bss_conf "own_ip_addr=$ownip" "$N"
+				[ -n "$radius_client_addr" ] && append bss_conf "radius_client_addr=$radius_client_addr" "$N"
+				append bss_conf "macaddr_acl=2" "$N"
+			}
+		;;
+	esac
+
+	local auth_algs="$((($auth_mode_shared << 1) | $auth_mode_open))"
+	append bss_conf "auth_algs=${auth_algs:-1}" "$N"
+	append bss_conf "wpa=$wpa" "$N"
+	[ -n "$wpa_pairwise" ] && append bss_conf "wpa_pairwise=$wpa_pairwise" "$N"
+
+	set_default wps_pushbutton 0
+	set_default wps_label 0
+	set_default wps_pbc_in_m1 0
+
+	config_methods=
+	[ "$wps_pushbutton" -gt 0 ] && append config_methods push_button
+	[ "$wps_label" -gt 0 ] && append config_methods label
+
+	# WPS not possible on Multi-AP backhaul-only SSID
+	[ "$multi_ap" = 1 ] && wps_possible=
+
+	[ -n "$wps_possible" -a -n "$config_methods" ] && {
+		set_default ext_registrar 0
+		set_default wps_device_type "6-0050F204-1"
+		set_default wps_device_name "OpenWrt AP"
+		set_default wps_manufacturer "www.openwrt.org"
+		set_default wps_independent 1
+
+		wps_state=2
+		[ -n "$wps_not_configured" ] && wps_state=1
+
+		[ "$ext_registrar" -gt 0 -a -n "$network_bridge" ] && append bss_conf "upnp_iface=$network_bridge" "$N"
+
+		append bss_conf "eap_server=1" "$N"
+		[ -n "$wps_pin" ] && append bss_conf "ap_pin=$wps_pin" "$N"
+		append bss_conf "wps_state=$wps_state" "$N"
+		append bss_conf "device_type=$wps_device_type" "$N"
+		append bss_conf "device_name=$wps_device_name" "$N"
+		append bss_conf "manufacturer=$wps_manufacturer" "$N"
+		append bss_conf "config_methods=$config_methods" "$N"
+		append bss_conf "wps_independent=$wps_independent" "$N"
+		[ -n "$wps_ap_setup_locked" ] && append bss_conf "ap_setup_locked=$wps_ap_setup_locked" "$N"
+		[ "$wps_pbc_in_m1" -gt 0 ] && append bss_conf "pbc_in_m1=$wps_pbc_in_m1" "$N"
+		[ "$multi_ap" -gt 0 ] && [ -n "$multi_ap_backhaul_ssid" ] && {
+			append bss_conf "multi_ap_backhaul_ssid=\"$multi_ap_backhaul_ssid\"" "$N"
+			if [ -z "$multi_ap_backhaul_key" ]; then
+				:
+			elif [ ${#multi_ap_backhaul_key} -lt 8 ]; then
+				wireless_setup_vif_failed INVALID_WPA_PSK
+				return 1
+			elif [ ${#multi_ap_backhaul_key} -eq 64 ]; then
+				append bss_conf "multi_ap_backhaul_wpa_psk=$multi_ap_backhaul_key" "$N"
+			else
+				append bss_conf "multi_ap_backhaul_wpa_passphrase=$multi_ap_backhaul_key" "$N"
+			fi
+		}
+	}
+
+	append bss_conf "ssid=$ssid" "$N"
+	[ -n "$network_bridge" ] && append bss_conf "bridge=$network_bridge${N}wds_bridge=" "$N"
+	[ -n "$network_ifname" ] && append bss_conf "snoop_iface=$network_ifname" "$N"
+	[ -n "$iapp_interface" ] && {
+		local ifname
+		network_get_device ifname "$iapp_interface" || ifname="$iapp_interface"
+		append bss_conf "iapp_interface=$ifname" "$N"
+	}
+
+	json_get_vars time_advertisement time_zone wnm_sleep_mode wnm_sleep_mode_no_keys bss_transition mbo
+	set_default bss_transition 0
+	set_default wnm_sleep_mode 0
+	set_default wnm_sleep_mode_no_keys 0
+	set_default mbo 0
+
+	[ -n "$time_advertisement" ] && append bss_conf "time_advertisement=$time_advertisement" "$N"
+	[ -n "$time_zone" ] && append bss_conf "time_zone=$time_zone" "$N"
+	if [ "$wnm_sleep_mode" -eq "1" ]; then
+		append bss_conf "wnm_sleep_mode=1" "$N"
+		[ "$wnm_sleep_mode_no_keys" -eq "1" ] && append bss_conf "wnm_sleep_mode_no_keys=1" "$N"
+	fi
+	[ "$bss_transition" -eq "1" ] && append bss_conf "bss_transition=1" "$N"
+	[ "$mbo" -eq 1 ] && append bss_conf "mbo=1" "$N"
+
+	json_get_vars ieee80211k rrm_neighbor_report rrm_beacon_report rnr
+	set_default ieee80211k 0
+	set_default rnr 0
+	if [ "$ieee80211k" -eq "1" ]; then
+		set_default rrm_neighbor_report 1
+		set_default rrm_beacon_report 1
+	else
+		set_default rrm_neighbor_report 0
+		set_default rrm_beacon_report 0
+	fi
+
+	[ "$rrm_neighbor_report" -eq "1" ] && append bss_conf "rrm_neighbor_report=1" "$N"
+	[ "$rrm_beacon_report" -eq "1" ] && append bss_conf "rrm_beacon_report=1" "$N"
+	[ "$rnr" -eq "1" ] && append bss_conf "rnr=1" "$N"
+
+	json_get_vars ftm_responder stationary_ap lci civic
+	set_default ftm_responder 0
+	if [ "$ftm_responder" -eq "1" ]; then
+		set_default stationary_ap 0
+		iw phy "$phy" info | grep -q "ENABLE_FTM_RESPONDER" && {
+			append bss_conf "ftm_responder=1" "$N"
+			[ "$stationary_ap" -eq "1" ] && append bss_conf "stationary_ap=1" "$N"
+			[ -n "$lci" ] && append bss_conf "lci=$lci" "$N"
+			[ -n "$civic" ] && append bss_conf "civic=$civic" "$N"
+		}
+	fi
+
+	json_get_vars ieee80211r
+	set_default ieee80211r 0
+	if [ "$wpa" -ge "1" ]; then
+		if [ "$fils" -gt 0 ]; then
+			json_get_vars fils_realm
+			set_default fils_realm "$(echo "$ssid" | md5sum | head -c 8)"
+		fi
+
+		append bss_conf "wpa_disable_eapol_key_retries=$wpa_disable_eapol_key_retries" "$N"
+
+		hostapd_append_wpa_key_mgmt
+		[ -n "$wpa_key_mgmt" ] && append bss_conf "wpa_key_mgmt=$wpa_key_mgmt" "$N"
+	fi
+
+	if [ "$wpa" -ge "2" ]; then
+		if [ "$ieee80211r" -gt "0" ]; then
+			json_get_vars mobility_domain ft_psk_generate_local ft_over_ds reassociation_deadline
+
+			set_default mobility_domain "$(echo "$ssid" | md5sum | head -c 4)"
+			set_default ft_over_ds 0
+			set_default reassociation_deadline 1000
+
+			case "$auth_type" in
+				psk)
+					set_default ft_psk_generate_local 1
+				;;
+				*)
+					set_default ft_psk_generate_local 0
+				;;
+			esac
+
+			[ -n "$network_ifname" ] && append bss_conf "ft_iface=$network_ifname" "$N"
+			append bss_conf "mobility_domain=$mobility_domain" "$N"
+			append bss_conf "ft_psk_generate_local=$ft_psk_generate_local" "$N"
+			append bss_conf "ft_over_ds=$ft_over_ds" "$N"
+			append bss_conf "reassociation_deadline=$reassociation_deadline" "$N"
+
+			if [ "$ft_psk_generate_local" -eq "0" ]; then
+				json_get_vars r0_key_lifetime r1_key_holder pmk_r1_push rxkh_file
+				json_get_values r0kh r0kh
+				json_get_values r1kh r1kh
+
+				set_default r0_key_lifetime 10000
+				set_default pmk_r1_push 0
+
+				[ -n "$r0kh" -a -n "$r1kh" ] || {
+					if [ -z "$auth_secret" -a -z "$key" ]; then
+						wireless_setup_vif_failed FT_KEY_CANT_BE_DERIVED
+						return 1
+					fi
+					ft_key=`echo -n "$mobility_domain/${auth_secret:-${key}}" | md5sum | awk '{print $1}'`
+
+					set_default r0kh "ff:ff:ff:ff:ff:ff,*,$ft_key"
+					set_default r1kh "00:00:00:00:00:00,00:00:00:00:00:00,$ft_key"
+				}
+
+				[ -n "$r1_key_holder" ] && append bss_conf "r1_key_holder=$r1_key_holder" "$N"
+				append bss_conf "r0_key_lifetime=$r0_key_lifetime" "$N"
+				append bss_conf "pmk_r1_push=$pmk_r1_push" "$N"
+
+				if [ -z "$rxkh_file" ]; then
+					set_default rxkh_file /var/run/hostapd-$ifname.rxkh
+					[ -e "$rxkh_file" ] && rm -f "$rxkh_file"
+					touch "$rxkh_file"
+
+					for kh in $r0kh; do
+						append rxkhs "r0kh=${kh//,/ }" "$N"
+					done
+					for kh in $r1kh; do
+						append rxkhs "r1kh=${kh//,/ }" "$N"
+					done
+					echo "$rxkhs" > "$rxkh_file"
+				fi
+				append bss_conf "rxkh_file=$rxkh_file" "$N"
+			fi
+		fi
+
+		if [ -n "$network_bridge" -a "$rsn_preauth" = 1 ]; then
+			set_default auth_cache 1
+			append bss_conf "rsn_preauth=1" "$N"
+			append bss_conf "rsn_preauth_interfaces=$network_bridge" "$N"
+		else
+			case "$auth_type" in
+			sae|psk-sae|owe)
+				set_default auth_cache 1
+			;;
+			*)
+				set_default auth_cache 0
+			;;
+			esac
+		fi
+
+		append bss_conf "okc=$auth_cache" "$N"
+		[ "$auth_cache" = 0 -a "$fils" = 0 ] && append bss_conf "disable_pmksa_caching=1" "$N"
+
+		# RSN -> allow management frame protection
+		case "$ieee80211w" in
+			[012])
+				json_get_vars ieee80211w_mgmt_cipher ieee80211w_max_timeout ieee80211w_retry_timeout
+				append bss_conf "ieee80211w=$ieee80211w" "$N"
+				[ "$ieee80211w" -gt "0" ] && {
+					if [ "$auth_type" = "eap192" ]; then
+						append bss_conf "group_mgmt_cipher=BIP-GMAC-256" "$N"
+					else
+						append bss_conf "group_mgmt_cipher=${ieee80211w_mgmt_cipher:-AES-128-CMAC}" "$N"
+					fi
+					[ -n "$ieee80211w_max_timeout" ] && \
+						append bss_conf "assoc_sa_query_max_timeout=$ieee80211w_max_timeout" "$N"
+					[ -n "$ieee80211w_retry_timeout" ] && \
+						append bss_conf "assoc_sa_query_retry_timeout=$ieee80211w_retry_timeout" "$N"
+				}
+			;;
+		esac
+	fi
+
+	_macfile="/var/run/hostapd-$ifname.maclist"
+	case "$macfilter" in
+		allow)
+			append bss_conf "macaddr_acl=1" "$N"
+			append bss_conf "accept_mac_file=$_macfile" "$N"
+			# accept_mac_file can be used to set MAC to VLAN ID mapping
+			vlan_possible=1
+		;;
+		deny)
+			append bss_conf "macaddr_acl=0" "$N"
+			append bss_conf "deny_mac_file=$_macfile" "$N"
+		;;
+		*)
+			_macfile=""
+		;;
+	esac
+
+	[ -n "$_macfile" ] && {
+		json_get_vars macfile
+		json_get_values maclist maclist
+
+		rm -f "$_macfile"
+		(
+			for mac in $maclist; do
+				echo "$mac"
+			done
+			[ -n "$macfile" -a -f "$macfile" ] && cat "$macfile"
+		) > "$_macfile"
+	}
+
+	[ -n "$vlan_possible" -a -n "$dynamic_vlan" ] && {
+		json_get_vars vlan_naming vlan_tagged_interface vlan_bridge vlan_file vlan_no_bridge
+		set_default vlan_naming 1
+		[ -z "$vlan_file" ] && set_default vlan_file /var/run/hostapd-$ifname.vlan
+		append bss_conf "dynamic_vlan=$dynamic_vlan" "$N"
+		append bss_conf "vlan_naming=$vlan_naming" "$N"
+		if [ -n "$vlan_bridge" ]; then
+			append bss_conf "vlan_bridge=$vlan_bridge" "$N"
+		else
+			set_default vlan_no_bridge 1
+		fi
+		append bss_conf "vlan_no_bridge=$vlan_no_bridge" "$N"
+		[ -n "$vlan_tagged_interface" ] && \
+			append bss_conf "vlan_tagged_interface=$vlan_tagged_interface" "$N"
+		[ -n "$vlan_file" ] && {
+			[ -e "$vlan_file" ] || touch "$vlan_file"
+			append bss_conf "vlan_file=$vlan_file" "$N"
+		}
+	}
+
+	json_get_vars iw_enabled iw_internet iw_asra iw_esr iw_uesa iw_access_network_type
+	json_get_vars iw_hessid iw_venue_group iw_venue_type iw_network_auth_type
+	json_get_vars iw_roaming_consortium iw_domain_name iw_anqp_3gpp_cell_net iw_nai_realm
+	json_get_vars iw_anqp_elem iw_qos_map_set iw_ipaddr_type_availability iw_gas_address3
+	json_get_vars iw_venue_name iw_venue_url
+
+	set_default iw_enabled 0
+	if [ "$iw_enabled" = "1" ]; then
+		append bss_conf "interworking=1" "$N"
+		set_default iw_internet 1
+		set_default iw_asra 0
+		set_default iw_esr 0
+		set_default iw_uesa 0
+
+		append bss_conf "internet=$iw_internet" "$N"
+		append bss_conf "asra=$iw_asra" "$N"
+		append bss_conf "esr=$iw_esr" "$N"
+		append bss_conf "uesa=$iw_uesa" "$N"
+
+		[ -n "$iw_access_network_type" ] && \
+			append bss_conf "access_network_type=$iw_access_network_type" "$N"
+		[ -n "$iw_hessid" ] && append bss_conf "hessid=$iw_hessid" "$N"
+		[ -n "$iw_venue_group" ] && \
+			append bss_conf "venue_group=$iw_venue_group" "$N"
+		[ -n "$iw_venue_type" ] && append bss_conf "venue_type=$iw_venue_type" "$N"
+		[ -n "$iw_network_auth_type" ] && \
+			append bss_conf "network_auth_type=$iw_network_auth_type" "$N"
+		[ -n "$iw_gas_address3" ] && append bss_conf "gas_address3=$iw_gas_address3" "$N"
+
+		json_for_each_item append_iw_roaming_consortium iw_roaming_consortium
+		json_for_each_item append_iw_anqp_elem iw_anqp_elem
+		json_for_each_item append_iw_nai_realm iw_nai_realm
+		json_for_each_item append_iw_venue_name iw_venue_name
+		json_for_each_item append_iw_venue_url iw_venue_url
+
+		iw_domain_name_conf=
+		json_for_each_item append_iw_domain_name iw_domain_name
+		[ -n "$iw_domain_name_conf" ] && \
+			append bss_conf "domain_name=$iw_domain_name_conf" "$N"
+
+		iw_anqp_3gpp_cell_net_conf=
+		json_for_each_item append_iw_anqp_3gpp_cell_net iw_anqp_3gpp_cell_net
+		[ -n "$iw_anqp_3gpp_cell_net_conf" ] && \
+			append bss_conf "anqp_3gpp_cell_net=$iw_anqp_3gpp_cell_net_conf" "$N"
+	fi
+
+	set_default iw_qos_map_set 0,0,2,16,1,1,255,255,18,22,24,38,40,40,44,46,48,56
+	case "$iw_qos_map_set" in
+		*,*);;
+		*) iw_qos_map_set="";;
+	esac
+	[ -n "$iw_qos_map_set" ] && append bss_conf "qos_map_set=$iw_qos_map_set" "$N"
+
+	local hs20 disable_dgaf osen anqp_domain_id hs20_deauth_req_timeout \
+		osu_ssid hs20_wan_metrics hs20_operating_class hs20_t_c_filename hs20_t_c_timestamp \
+		hs20_t_c_server_url
+	json_get_vars hs20 disable_dgaf osen anqp_domain_id hs20_deauth_req_timeout \
+		osu_ssid hs20_wan_metrics hs20_operating_class hs20_t_c_filename hs20_t_c_timestamp \
+		hs20_t_c_server_url
+
+	set_default hs20 0
+	set_default disable_dgaf $hs20
+	set_default osen 0
+	set_default anqp_domain_id 0
+	set_default hs20_deauth_req_timeout 60
+	if [ "$hs20" = "1" ]; then
+		append bss_conf "hs20=1" "$N"
+		append_hs20_icons
+		append bss_conf "disable_dgaf=$disable_dgaf" "$N"
+		append bss_conf "osen=$osen" "$N"
+		append bss_conf "anqp_domain_id=$anqp_domain_id" "$N"
+		append bss_conf "hs20_deauth_req_timeout=$hs20_deauth_req_timeout" "$N"
+		[ -n "$osu_ssid" ] && append bss_conf "osu_ssid=$osu_ssid" "$N"
+		[ -n "$hs20_wan_metrics" ] && append bss_conf "hs20_wan_metrics=$hs20_wan_metrics" "$N"
+		[ -n "$hs20_operating_class" ] && append bss_conf "hs20_operating_class=$hs20_operating_class" "$N"
+		[ -n "$hs20_t_c_filename" ] && append bss_conf "hs20_t_c_filename=$hs20_t_c_filename" "$N"
+		[ -n "$hs20_t_c_timestamp" ] && append bss_conf "hs20_t_c_timestamp=$hs20_t_c_timestamp" "$N"
+		[ -n "$hs20_t_c_server_url" ] && append bss_conf "hs20_t_c_server_url=$hs20_t_c_server_url" "$N"
+		json_for_each_item append_hs20_oper_friendly_name hs20_oper_friendly_name
+		json_for_each_item append_hs20_conn_capab hs20_conn_capab
+		json_for_each_item append_osu_provider osu_provider
+		json_for_each_item append_operator_icon operator_icon
+	fi
+
+	if [ "$eap_server" = "1" ]; then
+		append bss_conf "eap_server=1" "$N"
+		append bss_conf "eap_server_erp=1" "$N"
+		[ -n "$eap_user_file" ] && append bss_conf "eap_user_file=$eap_user_file" "$N"
+		[ -n "$ca_cert" ] && append bss_conf "ca_cert=$ca_cert" "$N"
+		[ -n "$server_cert" ] && append bss_conf "server_cert=$server_cert" "$N"
+		[ -n "$private_key" ] && append bss_conf "private_key=$private_key" "$N"
+		[ -n "$private_key_passwd" ] && append bss_conf "private_key_passwd=$private_key_passwd" "$N"
+		[ -n "$server_id" ] && append bss_conf "server_id=$server_id" "$N"
+		[ -n "$radius_server_clients" ] && append bss_conf "radius_server_clients=$radius_server_clients" "$N"
+		[ -n "$radius_server_auth_port" ] && append bss_conf "radius_server_auth_port=$radius_server_auth_port" "$N"
+	fi
+
+	set_default multicast_to_unicast_all 0
+	if [ "$multicast_to_unicast_all" -gt 0 ]; then
+		append bss_conf "multicast_to_unicast=$multicast_to_unicast_all" "$N"
+	fi
+	set_default proxy_arp 0
+	if [ "$proxy_arp" -gt 0 ]; then
+		append bss_conf "proxy_arp=$proxy_arp" "$N"
+	fi
+
+	set_default per_sta_vif 0
+	if [ "$per_sta_vif" -gt 0 ]; then
+		append bss_conf "per_sta_vif=$per_sta_vif" "$N"
+	fi
+
+	if [ "$apup" -gt 0 ]; then
+		append bss_conf "apup=$apup" "$N"
+
+		local apup_peer_ifname_prefix
+		json_get_vars apup_peer_ifname_prefix
+		if [ -n "$apup_peer_ifname_prefix" ] ; then
+			append bss_conf "apup_peer_ifname_prefix=$apup_peer_ifname_prefix" "$N"
+		fi
+	fi
+
+	json_get_values opts hostapd_bss_options
+	for val in $opts; do
+		append bss_conf "$val" "$N"
+	done
+
+	append "$var" "$bss_conf" "$N"
+	return 0
+}
+
+hostapd_set_log_options() {
+	local var="$1"
+
+	local log_level log_80211 log_8021x log_radius log_wpa log_driver log_iapp log_mlme
+	json_get_vars log_level log_80211 log_8021x log_radius log_wpa log_driver log_iapp log_mlme
+
+	set_default log_level 2
+	set_default log_80211  1
+	set_default log_8021x  1
+	set_default log_radius 1
+	set_default log_wpa    1
+	set_default log_driver 1
+	set_default log_iapp   1
+	set_default log_mlme   1
+
+	local log_mask="$(( \
+		($log_80211  << 0) | \
+		($log_8021x  << 1) | \
+		($log_radius << 2) | \
+		($log_wpa    << 3) | \
+		($log_driver << 4) | \
+		($log_iapp   << 5) | \
+		($log_mlme   << 6)   \
+	))"
+
+	append "$var" "logger_syslog=$log_mask" "$N"
+	append "$var" "logger_syslog_level=$log_level" "$N"
+	append "$var" "logger_stdout=$log_mask" "$N"
+	append "$var" "logger_stdout_level=$log_level" "$N"
+
+	return 0
+}
+
+_wpa_supplicant_common() {
+	local ifname="$1"
+
+	_rpath="/var/run/wpa_supplicant"
+	_config="${_rpath}-$ifname.conf"
+}
+
+wpa_supplicant_teardown_interface() {
+	_wpa_supplicant_common "$1"
+	rm -rf "$_rpath/$1" "$_config"
+}
+
+wpa_supplicant_prepare_interface() {
+	local ifname="$1"
+	_w_driver="$2"
+
+	_wpa_supplicant_common "$1"
+
+	json_get_vars mode wds multi_ap
+
+	[ -n "$network_bridge" ] && {
+		fail=
+		case "$mode" in
+			adhoc)
+				fail=1
+			;;
+			sta)
+				[ "$wds" = 1 -o "$multi_ap" = 1 ] || fail=1
+			;;
+		esac
+
+		[ -n "$fail" ] && {
+			wireless_setup_vif_failed BRIDGE_NOT_ALLOWED
+			return 1
+		}
+	}
+
+	local ap_scan=
+
+	_w_mode="$mode"
+
+	[ "$mode" = adhoc ] && {
+		ap_scan="ap_scan=2"
+	}
+
+	local country_str=
+	[ -n "$country" ] && {
+		country_str="country=$country"
+	}
+
+	multiap_flag_file="${_config}.is_multiap"
+	if [ "$multi_ap" = "1" ]; then
+		touch "$multiap_flag_file"
+	else
+		[ -e "$multiap_flag_file" ] && rm "$multiap_flag_file"
+	fi
+	wpa_supplicant_teardown_interface "$ifname"
+	cat > "$_config" <<EOF
+${scan_list:+freq_list=$scan_list}
+$ap_scan
+$country_str
+EOF
+	return 0
+}
+
+wpa_supplicant_set_fixed_freq() {
+	local freq="$1"
+	local htmode="$2"
+
+	append network_data "fixed_freq=1" "$N$T"
+	append network_data "frequency=$freq" "$N$T"
+	case "$htmode" in
+		NOHT) append network_data "disable_ht=1" "$N$T";;
+		HE20|HT20|VHT20) append network_data "disable_ht40=1" "$N$T";;
+		HT40*|VHT40|VHT80|VHT160|HE40|HE80|HE160) append network_data "ht40=1" "$N$T";;
+	esac
+	case "$htmode" in
+		VHT*) append network_data "vht=1" "$N$T";;
+	esac
+	case "$htmode" in
+		HE80|VHT80) append network_data "max_oper_chwidth=1" "$N$T";;
+		HE160|VHT160) append network_data "max_oper_chwidth=2" "$N$T";;
+		HE20|HE40|VHT20|VHT40) append network_data "max_oper_chwidth=0" "$N$T";;
+		*) append network_data "disable_vht=1" "$N$T";;
+	esac
+}
+
+wpa_supplicant_add_network() {
+	local ifname="$1"
+	local freq="$2"
+	local htmode="$3"
+	local noscan="$4"
+
+	_wpa_supplicant_common "$1"
+	wireless_vif_parse_encryption
+
+	json_get_vars \
+		ssid bssid key \
+		basic_rate mcast_rate \
+		ieee80211w ieee80211r fils ocv \
+		multi_ap \
+		default_disabled
+
+	case "$auth_type" in
+		sae|owe|eap2|eap192)
+			set_default ieee80211w 2
+		;;
+		psk-sae)
+			set_default ieee80211w 1
+		;;
+	esac
+
+	set_default ieee80211r 0
+	set_default multi_ap 0
+	set_default default_disabled 0
+
+	local key_mgmt='NONE'
+	local network_data=
+	local T="	"
+
+	local scan_ssid="scan_ssid=1"
+	local freq wpa_key_mgmt
+
+	[ "$_w_mode" = "adhoc" ] && {
+		append network_data "mode=1" "$N$T"
+		[ -n "$freq" ] && wpa_supplicant_set_fixed_freq "$freq" "$htmode"
+		[ "$noscan" = "1" ] && append network_data "noscan=1" "$N$T"
+
+		scan_ssid="scan_ssid=0"
+
+		[ "$_w_driver" = "nl80211" ] ||	append wpa_key_mgmt "WPA-NONE"
+	}
+
+	[ "$_w_mode" = "mesh" ] && {
+		json_get_vars mesh_id mesh_fwding mesh_rssi_threshold encryption
+		[ -n "$mesh_id" ] && ssid="${mesh_id}"
+
+		append network_data "mode=5" "$N$T"
+		[ -n "$mesh_fwding" ] && append network_data "mesh_fwding=${mesh_fwding}" "$N$T"
+		[ -n "$mesh_rssi_threshold" ] && append network_data "mesh_rssi_threshold=${mesh_rssi_threshold}" "$N$T"
+		[ -n "$freq" ] && wpa_supplicant_set_fixed_freq "$freq" "$htmode"
+		[ "$noscan" = "1" ] && append network_data "noscan=1" "$N$T"
+		[ "$encryption" = "none" -o -z "$encryption" ] || append wpa_key_mgmt "SAE"
+		scan_ssid=""
+	}
+
+	[ "$_w_mode" = "sta" ] && {
+		[ "$multi_ap" = 1 ] && append network_data "multi_ap_backhaul_sta=1" "$N$T"
+		[ "$default_disabled" = 1 ] && append network_data "disabled=1" "$N$T"
+	}
+
+	[ -n "$ocv" ] && append network_data "ocv=$ocv" "$N$T"
+
+	case "$auth_type" in
+		none) ;;
+		owe)
+			hostapd_append_wpa_key_mgmt
+			key_mgmt="$wpa_key_mgmt"
+		;;
+		wep)
+			local wep_keyidx=0
+			hostapd_append_wep_key network_data
+			append network_data "wep_tx_keyidx=$wep_keyidx" "$N$T"
+		;;
+		wps)
+			key_mgmt='WPS'
+		;;
+		psk|sae|psk-sae)
+			local passphrase
+
+			if [ "$_w_mode" != "mesh" ]; then
+				hostapd_append_wpa_key_mgmt
+			fi
+
+			key_mgmt="$wpa_key_mgmt"
+
+			if [ "$_w_mode" = "mesh" ] || [ "$auth_type" = "sae" ]; then
+				passphrase="sae_password=\"${key}\""
+			else
+				if [ ${#key} -eq 64 ]; then
+					passphrase="psk=${key}"
+				else
+					passphrase="psk=\"${key}\""
+				fi
+			fi
+			append network_data "$passphrase" "$N$T"
+		;;
+		eap|eap2|eap192)
+			hostapd_append_wpa_key_mgmt
+			key_mgmt="$wpa_key_mgmt"
+
+			json_get_vars eap_type identity anonymous_identity ca_cert ca_cert_usesystem
+
+			[ "$fils" -gt 0 ] && append network_data "erp=1" "$N$T"
+			if [ "$ca_cert_usesystem" -eq "1" -a -f "/etc/ssl/certs/ca-certificates.crt" ]; then
+				append network_data "ca_cert=\"/etc/ssl/certs/ca-certificates.crt\"" "$N$T"
+			else
+				[ -n "$ca_cert" ] && append network_data "ca_cert=\"$ca_cert\"" "$N$T"
+			fi
+			[ -n "$identity" ] && append network_data "identity=\"$identity\"" "$N$T"
+			[ -n "$anonymous_identity" ] && append network_data "anonymous_identity=\"$anonymous_identity\"" "$N$T"
+			case "$eap_type" in
+				tls)
+					json_get_vars client_cert priv_key priv_key_pwd
+					append network_data "client_cert=\"$client_cert\"" "$N$T"
+					append network_data "private_key=\"$priv_key\"" "$N$T"
+					append network_data "private_key_passwd=\"$priv_key_pwd\"" "$N$T"
+
+					json_get_vars subject_match
+					[ -n "$subject_match" ] && append network_data "subject_match=\"$subject_match\"" "$N$T"
+
+					json_get_values altsubject_match altsubject_match
+					if [ -n "$altsubject_match" ]; then
+						local list=
+						for x in $altsubject_match; do
+							append list "$x" ";"
+						done
+						append network_data "altsubject_match=\"$list\"" "$N$T"
+					fi
+
+					json_get_values domain_match domain_match
+					if [ -n "$domain_match" ]; then
+						local list=
+						for x in $domain_match; do
+							append list "$x" ";"
+						done
+						append network_data "domain_match=\"$list\"" "$N$T"
+					fi
+
+					json_get_values domain_suffix_match domain_suffix_match
+					if [ -n "$domain_suffix_match" ]; then
+						local list=
+						for x in $domain_suffix_match; do
+							append list "$x" ";"
+						done
+						append network_data "domain_suffix_match=\"$list\"" "$N$T"
+					fi
+				;;
+				fast|peap|ttls)
+					json_get_vars auth password ca_cert2 ca_cert2_usesystem client_cert2 priv_key2 priv_key2_pwd
+					set_default auth MSCHAPV2
+
+					if [ "$auth" = "EAP-TLS" ]; then
+						if [ "$ca_cert2_usesystem" -eq "1" -a -f "/etc/ssl/certs/ca-certificates.crt" ]; then
+							append network_data "ca_cert2=\"/etc/ssl/certs/ca-certificates.crt\"" "$N$T"
+						else
+							[ -n "$ca_cert2" ] && append network_data "ca_cert2=\"$ca_cert2\"" "$N$T"
+						fi
+						append network_data "client_cert2=\"$client_cert2\"" "$N$T"
+						append network_data "private_key2=\"$priv_key2\"" "$N$T"
+						append network_data "private_key2_passwd=\"$priv_key2_pwd\"" "$N$T"
+					else
+						append network_data "password=\"$password\"" "$N$T"
+					fi
+
+					json_get_vars subject_match
+					[ -n "$subject_match" ] && append network_data "subject_match=\"$subject_match\"" "$N$T"
+
+					json_get_values altsubject_match altsubject_match
+					if [ -n "$altsubject_match" ]; then
+						local list=
+						for x in $altsubject_match; do
+							append list "$x" ";"
+						done
+						append network_data "altsubject_match=\"$list\"" "$N$T"
+					fi
+
+					json_get_values domain_match domain_match
+					if [ -n "$domain_match" ]; then
+						local list=
+						for x in $domain_match; do
+							append list "$x" ";"
+						done
+						append network_data "domain_match=\"$list\"" "$N$T"
+					fi
+
+					json_get_values domain_suffix_match domain_suffix_match
+					if [ -n "$domain_suffix_match" ]; then
+						local list=
+						for x in $domain_suffix_match; do
+							append list "$x" ";"
+						done
+						append network_data "domain_suffix_match=\"$list\"" "$N$T"
+					fi
+
+					phase2proto="auth="
+					case "$auth" in
+						"auth"*)
+							phase2proto=""
+						;;
+						"EAP-"*)
+							auth="$(echo $auth | cut -b 5- )"
+							[ "$eap_type" = "ttls" ] &&
+								phase2proto="autheap="
+							json_get_vars subject_match2
+							[ -n "$subject_match2" ] && append network_data "subject_match2=\"$subject_match2\"" "$N$T"
+
+							json_get_values altsubject_match2 altsubject_match2
+							if [ -n "$altsubject_match2" ]; then
+								local list=
+								for x in $altsubject_match2; do
+									append list "$x" ";"
+								done
+								append network_data "altsubject_match2=\"$list\"" "$N$T"
+							fi
+
+							json_get_values domain_match2 domain_match2
+							if [ -n "$domain_match2" ]; then
+								local list=
+								for x in $domain_match2; do
+									append list "$x" ";"
+								done
+								append network_data "domain_match2=\"$list\"" "$N$T"
+							fi
+
+							json_get_values domain_suffix_match2 domain_suffix_match2
+							if [ -n "$domain_suffix_match2" ]; then
+								local list=
+								for x in $domain_suffix_match2; do
+									append list "$x" ";"
+								done
+								append network_data "domain_suffix_match2=\"$list\"" "$N$T"
+							fi
+						;;
+					esac
+					append network_data "phase2=\"$phase2proto$auth\"" "$N$T"
+				;;
+			esac
+			append network_data "eap=$(echo $eap_type | tr 'a-z' 'A-Z')" "$N$T"
+		;;
+	esac
+
+	[ "$wpa_cipher" = GCMP ] && {
+		append network_data "pairwise=GCMP" "$N$T"
+		append network_data "group=GCMP" "$N$T"
+	}
+
+	[ "$mode" = mesh ] || {
+		case "$wpa" in
+			1)
+				append network_data "proto=WPA" "$N$T"
+			;;
+			2)
+				append network_data "proto=RSN" "$N$T"
+			;;
+		esac
+
+		case "$ieee80211w" in
+			[012])
+				[ "$wpa" -ge 2 ] && append network_data "ieee80211w=$ieee80211w" "$N$T"
+			;;
+		esac
+	}
+	[ -n "$bssid" ] && append network_data "bssid=$bssid" "$N$T"
+	[ -n "$beacon_int" ] && append network_data "beacon_int=$beacon_int" "$N$T"
+
+	local bssid_blacklist bssid_whitelist
+	json_get_values bssid_blacklist bssid_blacklist
+	json_get_values bssid_whitelist bssid_whitelist
+
+	[ -n "$bssid_blacklist" ] && append network_data "bssid_blacklist=$bssid_blacklist" "$N$T"
+	[ -n "$bssid_whitelist" ] && append network_data "bssid_whitelist=$bssid_whitelist" "$N$T"
+
+	[ -n "$basic_rate" ] && {
+		local br rate_list=
+		for br in $basic_rate; do
+			wpa_supplicant_add_rate rate_list "$br"
+		done
+		[ -n "$rate_list" ] && append network_data "rates=$rate_list" "$N$T"
+	}
+
+	[ -n "$mcast_rate" ] && {
+		local mc_rate=
+		wpa_supplicant_add_rate mc_rate "$mcast_rate"
+		append network_data "mcast_rate=$mc_rate" "$N$T"
+	}
+
+	if [ "$key_mgmt" = "WPS" ]; then
+		echo "wps_cred_processing=1" >> "$_config"
+	else
+		cat >> "$_config" <<EOF
+network={
+	$scan_ssid
+	ssid="$ssid"
+	key_mgmt=$key_mgmt
+	$network_data
+}
+EOF
+	fi
+	return 0
+}
diff --git a/wireless-scripts-example/old/hostapd-default.uc b/wireless-scripts-example/old/hostapd-default.uc
new file mode 100644
index 0000000000..33eaa0ee15
--- /dev/null
+++ b/wireless-scripts-example/old/hostapd-default.uc
@@ -0,0 +1,584 @@
+'use strict';
+
+import {
+	append, append_raw, append_vars, dump_config, flush_config, set_default,
+	wiphy_info, wiphy_band
+} from 'wifi.common';
+import { validate } from 'wifi.validate';
+import * as netifd from 'wifi.netifd';
+import * as iface from 'wifi.iface';
+import * as nl80211 from 'nl80211';
+import * as ap from 'wifi.ap';
+import * as fs from 'fs';
+
+const NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER = 33;
+const NL80211_EXT_FEATURE_RADAR_BACKGROUND = 61;
+
+let phy_features = {};
+let phy_capabilities = {};
+
+/* make sure old style UCI and hwmode and newer band properties are correctly resolved */
+function set_device_defaults(config) {
+	/* validate the hw mode */
+	if (config.hw_mode in [ '11a', '11b', '11g', '11ad' ])
+		config.hw_mode = substr(config.hw_mode, 2);
+	else if (config.channel > 14)
+		config.hw_mode = 'a';
+	else
+		config.hw_mode = 'g';
+
+	/* validate band */
+	if (config.band == '2g')
+		config.hw_mode = 'g';
+	else if (config.band in [ '5g', '6g', '60g' ])
+		config.hw_mode = 'a';
+	else
+		switch (config.hw_mode) {
+		case 'a':
+			config.band = '5g';
+			break;
+
+		case 'ad':
+			config.band = '60g';
+			break;
+
+		default:
+			config.band = '2g';
+			break;
+		}
+}
+
+/* setup sylog / stdout */
+function device_log_append(config) {
+	let log_mask = 0;
+
+	for (let k in [ 'log_mlme', 'log_iapp', 'log_driver', 'log_wpa', 'log_radius', 'log_8021x', 'log_80211' ]) {
+		log_mask <<= 1;
+		log_mask |= config[k] ? 1 : 0;
+	}
+
+	append('logger_syslog', log_mask);
+	append('logger_syslog_level', config.log_level);
+	append('logger_stdout', log_mask);
+	append('logger_stdout_level', config.log_level);
+}
+
+/* setup country code */
+function device_country_code(config) {
+	let status = global.ubus.call('network.wireless', 'status');
+	for (let name, radio in status) {
+		if (!radio.config.country)
+			continue;
+		config.country_code = radio.config.country;
+	}
+
+	if (!exists(config, 'country_code'))
+		return;
+
+	if (config.hw_mode != 'a')
+		delete config.ieee80211h;
+	append_vars(config, [ 'country_code', 'country3', 'ieee80211h' ]);
+	if (config.ieee80211d)
+		append_vars(config, [ 'ieee80211d', 'local_pwr_constraint', 'spectrum_mgmt_required' ]);
+}
+
+
+/* setup cell density */
+function device_cell_density_append(config) {
+	switch (config.hw_mode) {
+	case 'b':
+		if (config.cell_density == 1) {
+			config.supported_rates ??= [ 5500, 11000 ];
+			config.basic_rates ??= [ 5500, 11000 ];
+		} else if (config.cell_density > 2) {
+			config.supported_rates ??= [ 11000 ];
+			config.basic_rates ??= [ 11000 ];
+		}
+		;;
+	case 'g':
+		if (config.cell_density in [ 0, 1 ]) {
+			if (!config.legacy_rates) {
+				config.supported_rates ??= [ 6000, 9000, 12000, 18000, 24000, 36000, 48000, 54000 ];
+				config.basic_rates ??= [ 6000, 12000, 24000 ];
+			} else if (config.cell_density == 1) {
+				config.supported_rates ??= [ 5500, 6000, 9000, 11000, 12000, 18000, 24000, 36000, 48000, 54000 ];
+				config.basic_rates ??= [ 5500, 11000 ];
+			}
+		} else if (config.cell_density == 2 || (config.cell_density > 3 && config.legacy_rates)) {
+			if (!config.legacy_rates) {
+				config.supported_rates ??= [ 12000, 18000, 24000, 36000, 48000, 54000 ];
+				config.basic_rates ??= [ 12000, 24000 ];
+			} else {
+				config.supported_rates ??= [ 11000, 12000, 18000, 24000, 36000, 48000, 54000 ];
+				config.basic_rates ??= [ 11000 ];
+			}
+		} else if (config.cell_density > 2) {
+			 config.supported_rates ??= [ 24000, 36000, 48000, 54000 ];
+			 config.basic_rates ??= [ 24000 ];
+		}
+		;;
+	case 'a':
+		switch (config.cell_density) {
+		case 1:
+			config.supported_rates ??= [ 6000, 9000, 12000, 18000, 24000, 36000, 48000, 54000 ];
+			config.basic_rates ??= [ 6000, 12000, 24000 ];
+			break;
+
+		case 2:
+			config.supported_rates ??= [ 12000, 18000, 24000, 36000, 48000, 54000 ];
+			config.basic_rates ??= [ 12000, 24000 ];
+			break;
+
+		case 3:
+			config.supported_rates ??= [ 24000, 36000, 48000, 54000 ];
+			config.basic_rates ??= [ 24000 ];
+			break;
+		}
+	}
+}
+
+function device_rates(config) {
+	for (let key in [ 'supported_rates', 'basic_rates' ])
+		config[key] = map(config[key], x => x / 100);
+
+	append_vars(config, [ 'beacon_rate', 'supported_rates', 'basic_rates' ]);
+}
+
+function device_htmode_append(config) {
+	config.channel_offset = config.band == '6g' ? 1 : 0;
+
+	/* 802.11n */
+	config.ieee80211n = 0;
+	if (config.band != '6g') {
+		if (config.htmode in [ 'VHT20', 'HT20', 'HE20', 'EHT20' ]) {
+			config.ieee80211n = 1;
+			config.ht_capab = '';
+		}
+		if (config.htmode in [ 'HT40', 'HT40+', 'HT40-', 'VHT40', 'VHT80', 'VHT160', 'HE40', 'HE80', 'HE160', 'EHT40', 'EHT80', 'EHT160' ]) {
+			config.ieee80211n = 1;
+			if (!config.channel)
+				config.ht_capab = '[HT40+]';
+			else
+				switch (config.hw_mode) {
+				case 'a':
+					switch (((config.channel / 4) + config.channel_offset) % 2) {
+					case 0:
+						config.ht_capab = '[HT40-]';
+						break;
+
+					case 1:
+						config.ht_capab = '[HT40+]';
+						break;
+					}
+					break;
+
+				default:
+					switch (config.htmode) {
+					case 'HT40+':
+					case 'HT40-':
+						config.ht_capab = '[' + config.htmode + ']';
+						break;
+
+					default:
+						if (config.channel < 7)
+							config.ht_capab = '[HT40+]';
+						else
+							config.ht_capab = '[HT40-]';
+						break;
+					}
+				}
+		}
+
+		if (config.ieee80211n) {
+			let ht_capab = phy_capabilities.ht_capa;
+
+			if (ht_capab & 0x1 && config.ldpc)
+				config.ht_capab += '[LDPC]';
+			if (ht_capab & 0x10 && config.greenfield)
+				config.ht_capab += '[GF]';
+			if (ht_capab & 0x20 && config.short_gi_20)
+				config.ht_capab += '[SHORT-GI-20]';
+			if (ht_capab & 0x40 && config.short_gi_40)
+				config.ht_capab += '[SHORT-GI-40]';
+			if (ht_capab & 0x80 && config.tx_stbc)
+				config.ht_capab += '[TX-STBC]';
+			if (ht_capab & 0x800 && config.max_amsdu)
+				config.ht_capab += '[MAX-AMSDU-7935]';
+			if (ht_capab & 0x1000 && config.dsss_cck_40)
+				config.ht_capab += '[DSSS_CCK-40]';
+			let rx_stbc = [ '', '[RX-STBC1]', '[RX-STBC12]', '[RX-STBC123]' ];
+			config.ht_capab += rx_stbc[min(config.rx_stbc, (ht_capab >> 8) & 3)];
+
+			append_vars(config, [ 'ieee80211n', 'ht_coex', 'ht_capab' ]);
+		}
+	}
+
+	/* 802.11ac */
+	config.ieee80211ac = 1;
+	config.vht_oper_centr_freq_seg0_idx = 0;
+	config.vht_oper_chwidth = 0;
+
+	switch (config.htmode) {
+	case 'VHT20':
+	case 'HE20':
+	case 'EHT20':
+		break;
+
+	case 'VHT40':
+	case 'HE40':
+	case 'EHT40':
+		config.vht_oper_centr_freq_seg0_idx = config.channel + (((config.channel / 4) + config.channel_offset) % 2 ? 2 : -2);
+		break;
+
+	case 'VHT80':
+	case 'HE80':
+	case 'EHT80':
+		let delta = [ -6, 6, 2, -2 ];
+		config.vht_oper_centr_freq_seg0_idx = config.channel + delta[((config.channel / 4) + config.channel_offset) % 4];
+		config.vht_oper_chwidth = 1;
+		break;
+
+	case 'VHT160':
+	case 'HE160':
+	case 'EHT160':
+		let vht_oper_centr_freq_seg0_idx_map = [[ 64, 50 ], [ 128, 114 ], [ 177, 163 ]];
+		if (config.band == '6g')
+			vht_oper_centr_freq_seg0_idx_map = [
+				[ 29, 15 ], [ 61, 47 ], [ 93, 79 ], [ 125, 111 ],
+				[ 157, 143 ], [ 189, 175 ], [ 221, 207 ]];
+		for (let k, v in vht_oper_centr_freq_seg0_idx_map)
+			if (config.channel >= (v[0] - 28) && config.channel <= v[0]) {
+				config.vht_oper_centr_freq_seg0_idx = v[1];
+				break;
+			}
+		config.vht_oper_chwidth = 2;
+		break;
+
+	default:
+		config.ieee80211ac = 0;
+		break;
+	}
+
+	config.eht_oper_chwidth = config.vht_oper_chwidth;
+	config.eht_oper_centr_freq_seg0_idx = config.vht_oper_centr_freq_seg0_idx;
+
+	if (config.band == '6g') {
+		config.ieee80211ac = 0;
+
+		switch(config.htmode) {
+		case 'HE20':
+		case 'EHT20':
+			config.op_class = 131;
+			break;
+
+		case 'EHT320':
+			let eht_center_seg0_map = [
+				[ 61, 31 ], [ 125, 95 ], [ 189, 159 ], [ 221, 191 ]
+			];
+
+			for (let k, v in eht_center_seg0_map)
+				if (config.channel <= v[0]) {
+					config.eht_oper_centr_freq_seg0_idx = v[1];
+					break;
+				}
+			config.op_class = 137;
+			config.eht_oper_chwidth = 7;
+			break;
+
+		case 'HE40':
+		case 'HE80':
+		case 'HE160':
+		case 'EHT40':
+		case 'EHT80':
+		case 'EHT160':
+			config.op_class = 132 + config.eht_oper_chwidth;
+			break;
+		}
+
+		append_vars(config, [ 'op_class' ]);
+	}
+
+	if (config.ieee80211ac && config.hw_mode == 'a') {
+		/* VHT capab */
+		if (config.vht_oper_chwidth < 2) {
+			config.vht160 = 0;
+			config.short_gi_160 = 0;
+		}
+
+		set_default(config, 'tx_queue_data2_burst', '2.0');
+
+		let vht_capab = phy_capabilities.vht_capa;
+		
+		config.vht_capab = '';
+		if (vht_capab & 0x10 && config.rxldpc)
+			config.vht_capab += '[RXLDPC]';
+		if (vht_capab & 0x20 && config.short_gi_80)
+			config.vht_capab += '[SHORT-GI-80]';
+		if (vht_capab & 0x40 && config.short_gi_160)
+			config.vht_capab += '[SHORT-GI-160]';
+		if (vht_capab & 0x80 && config.tx_stbc_2by1)
+			config.vht_capab += '[TX-STBC-2BY1]';
+		if (vht_capab & 0x800 && config.su_beamformer)
+			config.vht_capab += '[SU-BEAMFORMER]';
+		if (vht_capab & 0x1000 && config.su_beamformee)
+			config.vht_capab += '[SU-BEAMFORMEE]';
+		if (vht_capab & 0x80000 && config.mu_beamformer)
+			config.vht_capab += '[MU-BEAMFORMER]';
+		if (vht_capab & 0x100000 && config.mu_beamformee)
+			config.vht_capab += '[MU-BEAMFORMEE]';
+		if (vht_capab & 0x200000 && config.vht_txop_ps)
+			config.vht_capab += '[VHT-TXOP-PS]';
+		if (vht_capab & 0x400000 && config.htc_vht)
+			config.vht_capab += '[HTC-VHT]';
+		if (vht_capab & 0x10000000 && config.rx_antenna_pattern)
+			config.vht_capab += '[RX-ANTENNA-PATTERN]';
+		if (vht_capab & 0x20000000 && config.tx_antenna_pattern)
+			config.vht_capab += '[TX-ANTENNA-PATTERN]';
+		let rx_stbc = [ '', '[RX-STBC-1]', '[RX-STBC-12]', '[RX-STBC-123]', '[RX-STBC-1234]' ];
+		config.vht_capab += rx_stbc[min(config.rx_stbc, (vht_capab >> 8) & 7)];
+
+		if (vht_capab & 0x800 && config.su_beamformer)
+			config.vht_capab += '[SOUNDING-DIMENSION-' + min(((vht_capab >> 16) & 3) + 1, config.beamformer_antennas) + ']';
+		if (vht_capab & 0x1000 && config.su_beamformee)
+			config.vht_capab += '[BF-ANTENNA-' + min(((vht_capab >> 13) & 3) + 1, config.beamformer_antennas) + ']';
+
+		/* supported Channel widths */
+		if ((vht_capab & 0xc) == 8 && config.vht160 <= 2)
+			config.vht_capab += '[VHT160-80PLUS80]';
+		else if ((vht_capab & 0xc) == 4 && config.vht160 <= 2)
+			config.vht_capab += '[VHT160]';
+
+		/* maximum MPDU length */
+		if ((vht_capab & 3) > 1 && config.vht_max_mpdu >= 11454)
+			config.vht_capab += '[MAX-MPDU-11454]';
+		else if ((vht_capab & 3) && config.vht_max_mpdu >= 7991)
+			config.vht_capab += '[MAX-MPDU-7991]';
+
+		/* maximum A-MPDU length exponent */
+		let max_a_mpdu_len_exp = (vht_capab >> 20) & 0x38;
+		for (let exp = 7; exp; exp--)
+			if (max_a_mpdu_len_exp >= (0x8 * exp) && exp <= config.vht_max_a_mpdu_len_exp) {
+				config.vht_capab += '[MAX-A-MPDU-LEN-EXP' + exp + ']';
+				break;
+			}
+
+		/* whether or not the STA supports link adaptation using VHT variant */
+		let vht_link_adapt = vht_capab & 0xC000000;
+		if (vht_link_adapt >= 0xC000000 && config.vht_link_adapt > 3)
+			config.vht_capab += '[VHT-LINK-ADAPT-3]';
+		if (vht_link_adapt >= 0x8000000 && config.vht_link_adapt > 2)
+			config.vht_capab += '[VHT-LINK-ADAPT-2]';
+
+		append_vars(config, [
+			'ieee80211ac', 'vht_oper_chwidth', 'vht_oper_centr_freq_seg0_idx',
+			'vht_capab'
+		]);
+	}
+
+	/* 802.11ax */
+	if (wildcard(config.htmode, 'HE*') || wildcard(config.htmode, 'EHT*')) {
+		let he_phy_cap = phy_capabilities.he_phy_cap;
+		let he_mac_cap = phy_capabilities.he_mac_cap;
+
+		config.ieee80211ax = true;
+
+		if (config.hw_mode == 'a') {
+			config.he_oper_chwidth = config.vht_oper_chwidth;
+			config.he_oper_centr_freq_seg0_idx = config.vht_oper_centr_freq_seg0_idx;
+		}
+
+		if (config.band == "6g") {
+			config.stationary_ap = true;
+			append_vars(config, [ 'he_6ghz_reg_pwr_type', ]);
+		}
+
+		if (config.he_bss_color_enabled) {
+			if (config.he_spr_non_srg_obss_pd_max_offset)
+				config.he_spr_sr_control |= 1 << 2;
+			if (!config.he_spr_psr_enabled)
+				config.he_spr_sr_control |= 1;
+			append_vars(config, [ 'he_bss_color', 'he_spr_non_srg_obss_pd_max_offset', 'he_spr_sr_control' ]);
+		}
+
+		if (!(he_phy_cap[3] & 0x80))
+			config.he_su_beamformer = false;
+		if (!(he_phy_cap[4] & 0x1))
+			config.he_su_beamformee = false;
+		if (!(he_phy_cap[4] & 0x2))
+			config.he_mu_beamformer = false;
+		if (!(he_phy_cap[7] & 0x1))
+			config.he_spr_psr_enabled = false;
+		if (!(he_mac_cap[0] & 0x1))
+			config.he_twt_required= false;
+
+		append_vars(config, [
+			'ieee80211ax', 'he_oper_chwidth', 'he_oper_centr_freq_seg0_idx',
+			'he_su_beamformer', 'he_su_beamformee', 'he_mu_beamformer', 'he_twt_required',
+			'he_default_pe_duration', 'he_rts_threshold', 'he_mu_edca_qos_info_param_count',
+			'he_mu_edca_qos_info_q_ack', 'he_mu_edca_qos_info_queue_request', 'he_mu_edca_qos_info_txop_request',
+			'he_mu_edca_ac_be_aifsn', 'he_mu_edca_ac_be_aci', 'he_mu_edca_ac_be_ecwmin',
+			'he_mu_edca_ac_be_ecwmax', 'he_mu_edca_ac_be_timer', 'he_mu_edca_ac_bk_aifsn',
+			'he_mu_edca_ac_bk_aci', 'he_mu_edca_ac_bk_ecwmin', 'he_mu_edca_ac_bk_ecwmax',
+			'he_mu_edca_ac_bk_timer', 'he_mu_edca_ac_vi_ecwmin', 'he_mu_edca_ac_vi_ecwmax',
+			'he_mu_edca_ac_vi_aifsn', 'he_mu_edca_ac_vi_aci', 'he_mu_edca_ac_vi_timer',
+			'he_mu_edca_ac_vo_aifsn', 'he_mu_edca_ac_vo_aci', 'he_mu_edca_ac_vo_ecwmin',
+			'he_mu_edca_ac_vo_ecwmax', 'he_mu_edca_ac_vo_timer',
+		]);
+	}
+
+	if (wildcard(config.htmode, 'EHT*')) {
+		config.ieee80211be = true;
+		append_vars(config, [ 'ieee80211be' ]);
+
+		if (config.hw_mode == 'a')
+			append_vars(config, [ 'eht_oper_chwidth', 'eht_oper_centr_freq_seg0_idx' ]);
+	}
+
+	append_vars(config, [ 'tx_queue_data2_burst', 'stationary_ap' ]);
+}
+
+function device_extended_features(data, flag) {
+	return !!(data[flag / 8] | (1 << (flag % 8)));
+}
+
+function device_capabilities(config) {
+	let phy = config.phy;
+
+	phy = wiphy_info(phy);
+	let band = wiphy_band(phy, config.band);
+
+	phy_capabilities.ht_capa = band.ht_capa ?? 0;
+	phy_capabilities.vht_capa = band.vht_capa ?? 0;
+	for (let iftype in band.iftype_data) {
+		if (!iftype.iftypes.ap)
+			continue;
+		phy_capabilities.he_mac_cap = iftype.he_cap_mac;
+		phy_capabilities.he_phy_cap = iftype.he_cap_phy;
+	}
+
+	phy_features.ftm_responder = device_extended_features(phy.extended_features, NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER);
+	phy_features.radar_background = device_extended_features(phy.extended_features, NL80211_EXT_FEATURE_RADAR_BACKGROUND);
+}
+
+function generate(config) {
+	if (!config)
+		die(`${config.path} is an unknown phy`);
+
+	device_capabilities(config);
+
+	append('driver', 'nl80211');
+
+	set_device_defaults(config);
+
+	device_log_append(config);
+
+	device_country_code(config);
+
+	device_cell_density_append(config);
+
+	device_rates(config);
+
+	/* beacon */
+	append_vars(config, [ 'beacon_int', 'beacon_rate', 'rnr_beacon' ]);
+
+	/* wpa_supplicant co-exist */
+	append_vars(config, [ 'noscan' ]);
+
+	/* airtime */
+	if (config.airtime_mode)
+		append_vars(config, [ 'airtime_mode' ]);
+
+	/* assoc/thresholds */
+	append_vars(config, [ 'rssi_reject_assoc_rssi', 'rssi_reject_assoc_timeout', 'rssi_ignore_probe_request', 'iface_max_num_sta' ]);
+
+	/* ACS / Radar*/
+	if (!phy_features.radar_background || config.band != '5g')
+		delete config.enable_background_radar;
+	else
+		set_default(config, 'enable_background_radar', false);
+
+	append_vars(config, [ 'acs_chan_bias', 'acs_exclude_dfs', 'enable_background_radar' ]);
+
+	/* TX Power */
+	append_vars(config, [ 'min_tx_power' ]);
+
+	/* hwmode, channel, op_class, ... */
+	append_vars(config, [ 'hw_mode', 'channel', 'rts_threshold', 'chanlist' ]);
+	if (config.hw_mode in [ 'a', 'g' ] && config.require_mode in [ 'n', 'ac', 'ax' ]) {
+		let require_mode = { n: 'require_ht', ac: 'require_vht', ax: 'require_he' };
+
+		config.legacy_rates = false;
+		append(require_mode[config.require_mode], 1);
+	}
+	device_htmode_append(config);
+
+	if (config.ieee80211ax || config.ieee80211be)
+		append_vars(config, [ 'mbssid' ]);
+
+	/* 6G power mode */
+	if (config.band != '6g')
+		append_vars(config, [ 'reg_power_type' ]);
+
+	/* raw options */
+	for (let raw in config.hostapd_options)
+		append_raw(raw);
+}
+
+let iface_idx = 0;
+function setup_interface(interface, data, config, vlans, stas, phy_features, fixup) {
+	config = { ...config, fixup };
+
+	config.idx = iface_idx++;
+	ap.generate(interface, data, config, vlans, stas, phy_features);
+}
+
+export function setup(data) {
+	let file_name = `/var/run/hostapd-${data.phy}${data.vif_phy_suffix}.conf`;
+
+	flush_config();
+
+	if (fs.stat(file_name))
+		fs.rename(file_name, file_name + '.prev');
+
+	data.config.phy = data.phy;
+
+	generate(data.config);
+
+	if (data.config.num_global_macaddr)
+		append('\n#num_global_macaddr', data.config.num_global_macaddr);
+	if (data.config.macaddr_base)
+		append('\n#macaddr_base', data.config.macaddr_base);
+
+	let has_ap;
+	for (let k, interface in data.interfaces) {
+		if (interface.config.mode != 'ap')
+			continue;
+
+		interface.config.network_bridge = interface.bridge;
+		interface.config.network_ifname = interface['bridge-ifname'];
+
+		let owe = interface.config.encryption == 'owe' && interface.config.owe_transition;
+
+		setup_interface(k, data, interface.config, interface.vlans, interface.stas, phy_features, owe ? 'owe' : null );
+		if (owe)
+			setup_interface(k, data, interface.config, interface.vlans, interface.stas, phy_features, 'owe-transition');
+		has_ap = true;
+	}
+
+	let config = dump_config(file_name);
+
+	let msg = {
+		phy: data.phy,
+		radio: data.config.radio,
+		config: has_ap ? file_name : "",
+		prev_config: file_name + '.prev'
+	};
+	if (!global.ubus.list('hostapd'))
+		system('ubus wait_for hostapd');
+	let ret = global.ubus.call('hostapd', 'config_set', msg);
+
+	if (ret)
+		netifd.add_process('/usr/sbin/hostapd', ret.pid, true, true);
+	else
+		netifd.setup_failed('HOSTAPD_START_FAILED');
+};
diff --git a/wireless-scripts-example/old/hostapd-mtk-feed.sh b/wireless-scripts-example/old/hostapd-mtk-feed.sh
new file mode 100644
index 0000000000..149ba4c70d
--- /dev/null
+++ b/wireless-scripts-example/old/hostapd-mtk-feed.sh
@@ -0,0 +1,1957 @@
+. /lib/functions/network.sh
+. /lib/functions.sh
+
+wpa_supplicant_add_rate() {
+	local var="$1"
+	local val="$(($2 / 1000))"
+	local sub="$((($2 / 100) % 10))"
+	append $var "$val" ","
+	[ $sub -gt 0 ] && append $var "."
+}
+
+hostapd_add_rate() {
+	local var="$1"
+	local val="$(($2 / 100))"
+	append $var "$val" " "
+}
+
+hostapd_append_wep_key() {
+	local var="$1"
+
+	wep_keyidx=0
+	set_default key 1
+	case "$key" in
+		[1234])
+			for idx in 1 2 3 4; do
+				local zidx
+				zidx="$(($idx - 1))"
+				json_get_var ckey "key${idx}"
+				[ -n "$ckey" ] && \
+					append $var "wep_key${zidx}=$(prepare_key_wep "$ckey")" "$N$T"
+			done
+			wep_keyidx="$((key - 1))"
+		;;
+		*)
+			append $var "wep_key0=$(prepare_key_wep "$key")" "$N$T"
+		;;
+	esac
+}
+
+hostapd_append_wpa_key_mgmt() {
+	local auth_type_l="$(echo $auth_type | tr 'a-z' 'A-Z')"
+
+	case "$auth_type" in
+		psk|eap)
+			append wpa_key_mgmt "WPA-$auth_type_l"
+			[ "${wpa:-2}" -ge 2 ] && [ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-${auth_type_l}"
+			[ "${ieee80211w:-0}" -gt 0 ] && [ "$nosha256" != "1" ] && append wpa_key_mgmt "WPA-${auth_type_l}-SHA256"
+		;;
+		eap192)
+			append wpa_key_mgmt "WPA-EAP-SUITE-B-192"
+			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-EAP-SHA384"
+		;;
+		eap-eap2)
+			append wpa_key_mgmt "WPA-EAP"
+			append wpa_key_mgmt "WPA-EAP-SHA256"
+			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-EAP"
+		;;
+		eap2)
+			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-EAP"
+			append wpa_key_mgmt "WPA-EAP-SHA256"
+		;;
+		sae)
+			case "$encryption" in
+			*sae-ext*)
+				append wpa_key_mgmt "SAE-EXT-KEY"
+			;;
+			*)
+				append wpa_key_mgmt "SAE"
+			;;
+			esac
+			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-SAE"
+		;;
+		psk-sae)
+			append wpa_key_mgmt "WPA-PSK"
+			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-PSK"
+			[ "${ieee80211w:-0}" -gt 0 ] && append wpa_key_mgmt "WPA-PSK-SHA256"
+			append wpa_key_mgmt "SAE"
+			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-SAE"
+		;;
+		owe)
+			append wpa_key_mgmt "OWE"
+		;;
+	esac
+
+	[ "$fils" -gt 0 ] && {
+		case "$auth_type" in
+			eap192)
+				append wpa_key_mgmt FILS-SHA384
+				[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt FT-FILS-SHA384
+			;;
+			eap*)
+				append wpa_key_mgmt FILS-SHA256
+				[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt FT-FILS-SHA256
+			;;
+		esac
+	}
+
+	case "$rsno_auth_type" in
+		sae)
+			case "$encryption_rsno" in
+			*sae-ext*)
+				rsn_override_key_mgmt="SAE-EXT-KEY"
+			;;
+			*)
+				rsn_override_key_mgmt="SAE"
+			;;
+			esac
+			set_default sae_pwe 2
+		;;
+	esac
+
+	case "$rsno_auth_type_2" in
+		sae)
+			case "$encryption_rsno_2" in
+			*sae-ext*)
+				rsn_override_key_mgmt_2="SAE-EXT-KEY"
+			;;
+			*)
+				rsn_override_key_mgmt_2="SAE"
+			;;
+			esac
+			set_default sae_pwe 2
+		;;
+	esac
+
+	[ "$auth_osen" = "1" ] && append wpa_key_mgmt "OSEN"
+}
+
+hostapd_add_log_config() {
+	config_add_boolean \
+		log_80211 \
+		log_8021x \
+		log_radius \
+		log_wpa \
+		log_driver \
+		log_iapp \
+		log_mlme
+
+	config_add_int log_level
+}
+
+hostapd_common_add_device_config() {
+	config_add_array basic_rate
+	config_add_array supported_rates
+	config_add_string beacon_rate
+
+	config_add_string country country3
+	config_add_boolean country_ie doth
+	config_add_boolean spectrum_mgmt_required
+	config_add_int local_pwr_constraint
+	config_add_string require_mode
+	config_add_boolean legacy_rates
+	config_add_int cell_density
+	config_add_int rts_threshold
+	config_add_int rssi_reject_assoc_rssi
+	config_add_int rssi_ignore_probe_request
+	config_add_int rssi_reject_assoc_timeout
+	config_add_int maxassoc
+	config_add_int reg_power_type
+	config_add_boolean stationary_ap
+
+	config_add_string acs_chan_bias
+	config_add_array hostapd_options
+
+	config_add_int airtime_mode
+	config_add_int mbssid
+
+	hostapd_add_log_config
+}
+
+hostapd_prepare_device_config() {
+	local config="$1"
+	local driver="$2"
+
+	local base_cfg=
+
+	json_get_vars country country3 country_ie beacon_int:100 doth require_mode legacy_rates \
+		acs_chan_bias local_pwr_constraint spectrum_mgmt_required airtime_mode cell_density \
+		rts_threshold beacon_rate rssi_reject_assoc_rssi rssi_ignore_probe_request maxassoc \
+		mbssid:0 band reg_power_type stationary_ap
+
+	hostapd_set_log_options base_cfg
+
+	set_default country_ie 1
+	set_default spectrum_mgmt_required 0
+	set_default doth 1
+	set_default legacy_rates 0
+	set_default airtime_mode 0
+	set_default cell_density 0
+
+	[ -n "$country" ] && {
+		append base_cfg "country_code=$country" "$N"
+		[ -n "$country3" ] && append base_cfg "country3=$country3" "$N"
+
+		[ "$country_ie" -gt 0 ] && {
+			append base_cfg "ieee80211d=1" "$N"
+			[ -n "$local_pwr_constraint" ] && append base_cfg "local_pwr_constraint=$local_pwr_constraint" "$N"
+			[ "$spectrum_mgmt_required" -gt 0 ] && append base_cfg "spectrum_mgmt_required=$spectrum_mgmt_required" "$N"
+		}
+		[ "$hwmode" = "a" -a "$doth" -gt 0 ] && append base_cfg "ieee80211h=1" "$N"
+	}
+
+	[ -n "$acs_chan_bias" ] && append base_cfg "acs_chan_bias=$acs_chan_bias" "$N"
+
+	local brlist= br
+	json_get_values basic_rate_list basic_rate
+	local rlist= r
+	json_get_values rate_list supported_rates
+
+	[ -n "$hwmode" ] && append base_cfg "hw_mode=$hwmode" "$N"
+	if [ "$hwmode" = "g" ] || [ "$hwmode" = "a" ]; then
+		[ -n "$require_mode" ] && legacy_rates=0
+		case "$require_mode" in
+			n) append base_cfg "require_ht=1" "$N";;
+			ac) append base_cfg "require_vht=1" "$N";;
+		esac
+	fi
+	case "$hwmode" in
+		b)
+			if [ "$cell_density" -eq 1 ]; then
+				set_default rate_list "5500 11000"
+				set_default basic_rate_list "5500 11000"
+			elif [ "$cell_density" -ge 2 ]; then
+				set_default rate_list "11000"
+				set_default basic_rate_list "11000"
+			fi
+		;;
+		g)
+			if [ "$cell_density" -eq 0 ] || [ "$cell_density" -eq 1 ]; then
+				if [ "$legacy_rates" -eq 0 ]; then
+					set_default rate_list "6000 9000 12000 18000 24000 36000 48000 54000"
+					set_default basic_rate_list "6000 12000 24000"
+				elif [ "$cell_density" -eq 1 ]; then
+					set_default rate_list "5500 6000 9000 11000 12000 18000 24000 36000 48000 54000"
+					set_default basic_rate_list "5500 11000"
+				fi
+			elif [ "$cell_density" -ge 3 ] && [ "$legacy_rates" -ne 0 ] || [ "$cell_density" -eq 2 ]; then
+				if [ "$legacy_rates" -eq 0 ]; then
+					set_default rate_list "12000 18000 24000 36000 48000 54000"
+					set_default basic_rate_list "12000 24000"
+				else
+					set_default rate_list "11000 12000 18000 24000 36000 48000 54000"
+					set_default basic_rate_list "11000"
+				fi
+			elif [ "$cell_density" -ge 3 ]; then
+				set_default rate_list "24000 36000 48000 54000"
+				set_default basic_rate_list "24000"
+			fi
+		;;
+		a)
+			if [ "$cell_density" -eq 1 ]; then
+				set_default rate_list "6000 9000 12000 18000 24000 36000 48000 54000"
+				set_default basic_rate_list "6000 12000 24000"
+			elif [ "$cell_density" -eq 2 ]; then
+				set_default rate_list "12000 18000 24000 36000 48000 54000"
+				set_default basic_rate_list "12000 24000"
+			elif [ "$cell_density" -ge 3 ]; then
+				set_default rate_list "24000 36000 48000 54000"
+				set_default basic_rate_list "24000"
+			fi
+		;;
+	esac
+
+	for r in $rate_list; do
+		hostapd_add_rate rlist "$r"
+	done
+
+	for br in $basic_rate_list; do
+		hostapd_add_rate brlist "$br"
+	done
+
+	json_get_vars rssi_reject_assoc_timeout
+	[ -n "$rssi_reject_assoc_rssi" ] && append base_cfg "rssi_reject_assoc_rssi=$rssi_reject_assoc_rssi" "$N"
+	[ -n "$rssi_ignore_probe_request" ] && append base_cfg "rssi_ignore_probe_request=$rssi_ignore_probe_request" "$N"
+	[ -n "$rssi_reject_assoc_timeout" ] && append base_cfg "rssi_reject_assoc_timeout=$rssi_reject_assoc_timeout" "$N"
+	[ -n "$beacon_rate" ] && append base_cfg "beacon_rate=$beacon_rate" "$N"
+	[ -n "$rlist" ] && append base_cfg "supported_rates=$rlist" "$N"
+	[ -n "$brlist" ] && append base_cfg "basic_rates=$brlist" "$N"
+	append base_cfg "beacon_int=$beacon_int" "$N"
+	[ -n "$rts_threshold" ] && append base_cfg "rts_threshold=$rts_threshold" "$N"
+	[ "$airtime_mode" -gt 0 ] && append base_cfg "airtime_mode=$airtime_mode" "$N"
+	[ -n "$maxassoc" ] && append base_cfg "iface_max_num_sta=$maxassoc" "$N"
+	[ "$mbssid" -gt 0 ] && [ "$mbssid" -le 2 ] && append base_cfg "mbssid=$mbssid" "$N"
+
+	[ "$band" = "6g" ] && {
+		set_default reg_power_type 0
+		append base_cfg "he_6ghz_reg_pwr_type=$reg_power_type" "$N"
+	}
+
+	set_default stationary_ap 1
+	append base_cfg "stationary_ap=$stationary_ap" "$N"
+
+	json_get_values opts hostapd_options
+	for val in $opts; do
+		append base_cfg "$val" "$N"
+	done
+
+	cat > "$config" <<EOF
+driver=$driver
+$base_cfg
+EOF
+}
+
+hostapd_common_add_bss_config() {
+	config_add_string 'bssid:macaddr' 'ssid:string'
+	config_add_boolean wds wmm uapsd hidden utf8_ssid ppsk
+
+	config_add_int maxassoc max_inactivity
+	config_add_boolean disassoc_low_ack isolate short_preamble skip_inactivity_poll
+
+	config_add_int \
+		wep_rekey eap_reauth_period \
+		wpa_group_rekey wpa_pair_rekey wpa_master_rekey
+	config_add_boolean wpa_strict_rekey
+	config_add_boolean wpa_disable_eapol_key_retries
+
+	config_add_boolean tdls_prohibit
+
+	config_add_boolean rsn_preauth auth_cache
+	config_add_int ieee80211w
+	config_add_int eapol_version
+
+	config_add_array auth_server acct_server
+	config_add_string 'server:host'
+	config_add_string auth_secret key
+	config_add_int 'auth_port:port' 'port:port'
+
+	config_add_string acct_secret
+	config_add_int acct_port
+	config_add_int acct_interval
+
+	config_add_int bss_load_update_period chan_util_avg_period
+
+	config_add_string dae_client
+	config_add_string dae_secret
+	config_add_int dae_port
+
+	config_add_string nasid
+	config_add_string ownip
+	config_add_string radius_client_addr
+	config_add_string iapp_interface
+	config_add_string eap_type ca_cert client_cert identity anonymous_identity auth priv_key priv_key_pwd
+	config_add_boolean ca_cert_usesystem ca_cert2_usesystem
+	config_add_string subject_match subject_match2
+	config_add_array altsubject_match altsubject_match2
+	config_add_array domain_match domain_match2 domain_suffix_match domain_suffix_match2
+	config_add_string ieee80211w_mgmt_cipher
+
+	config_add_int dynamic_vlan vlan_naming vlan_no_bridge
+	config_add_string vlan_tagged_interface vlan_bridge
+	config_add_string vlan_file
+
+	config_add_string 'key1:wepkey' 'key2:wepkey' 'key3:wepkey' 'key4:wepkey' 'password:wpakey'
+
+	config_add_string wpa_psk_file
+
+	config_add_int multi_ap
+
+	config_add_boolean wps_pushbutton wps_label ext_registrar wps_pbc_in_m1
+	config_add_int wps_ap_setup_locked wps_independent
+	config_add_string wps_device_type wps_device_name wps_manufacturer wps_pin
+	config_add_string multi_ap_backhaul_ssid multi_ap_backhaul_key
+
+	config_add_boolean wnm_sleep_mode wnm_sleep_mode_no_keys bss_transition mbo
+	config_add_int time_advertisement
+	config_add_string time_zone
+	config_add_string vendor_elements
+
+	config_add_boolean ieee80211k rrm_neighbor_report rrm_beacon_report
+
+	config_add_boolean ftm_responder stationary_ap
+	config_add_string lci civic
+
+	config_add_boolean ieee80211r pmk_r1_push ft_psk_generate_local ft_over_ds
+	config_add_int r0_key_lifetime reassociation_deadline
+	config_add_string mobility_domain r1_key_holder
+	config_add_array r0kh r1kh
+
+	config_add_int ieee80211w_max_timeout ieee80211w_retry_timeout
+
+	config_add_string macfilter 'macfile:file'
+	config_add_array 'maclist:list(macaddr)'
+
+	config_add_array bssid_blacklist
+	config_add_array bssid_whitelist
+
+	config_add_int mcast_rate
+	config_add_array basic_rate
+	config_add_array supported_rates
+
+	config_add_boolean sae_require_mfp
+	config_add_int sae_pwe
+
+	config_add_string 'owe_transition_bssid:macaddr' 'owe_transition_ssid:string'
+	config_add_string owe_transition_ifname
+
+	config_add_boolean iw_enabled iw_internet iw_asra iw_esr iw_uesa
+	config_add_int iw_access_network_type iw_venue_group iw_venue_type
+	config_add_int iw_ipaddr_type_availability iw_gas_address3
+	config_add_string iw_hessid iw_network_auth_type iw_qos_map_set
+	config_add_array iw_roaming_consortium iw_domain_name iw_anqp_3gpp_cell_net iw_nai_realm
+	config_add_array iw_anqp_elem iw_venue_name iw_venue_url
+
+	config_add_boolean hs20 disable_dgaf osen
+	config_add_int anqp_domain_id
+	config_add_int hs20_deauth_req_timeout
+	config_add_array hs20_oper_friendly_name
+	config_add_array osu_provider
+	config_add_array operator_icon
+	config_add_array hs20_conn_capab
+	config_add_string osu_ssid hs20_wan_metrics hs20_operating_class hs20_t_c_filename hs20_t_c_timestamp
+
+	config_add_string hs20_t_c_server_url
+
+	config_add_array airtime_sta_weight
+	config_add_int airtime_bss_weight airtime_bss_limit
+
+	config_add_boolean multicast_to_unicast multicast_to_unicast_all proxy_arp per_sta_vif
+
+	config_add_array hostapd_bss_options
+	config_add_boolean default_disabled
+
+	config_add_boolean request_cui
+	config_add_array radius_auth_req_attr
+	config_add_array radius_acct_req_attr
+
+	config_add_int eap_server radius_server_auth_port
+	config_add_string eap_user_file ca_cert server_cert private_key private_key_passwd server_id radius_server_clients
+
+	config_add_boolean fils
+	config_add_string fils_dhcp
+
+	config_add_int ocv
+
+	config_add_boolean apup
+	config_add_string apup_peer_ifname_prefix
+
+	config_add_int disable_eht
+	config_add_int disable_he
+	config_add_int disable_vht
+	config_add_int disable_ht
+
+	config_add_boolean beacon_prot interworking
+
+	config_add_int unsol_bcast_probe_resp_interval
+	config_add_int fils_discovery_min_interval
+	config_add_int fils_discovery_max_interval
+	config_add_boolean rnr
+
+	config_add_array sae_groups
+	config_add_array owe_groups
+	config_add_array pairwise
+	config_add_string group_cipher
+	config_add_string group_mgmt_cipher
+
+	config_add_int assoc_phy
+	config_add_int mld_id mld_link_id mld_assoc_phy mld_allowed_phy_bitmap mld_allowed_links mld_radio_mask rsn_overriding
+	config_add_boolean mld_primary mld_single_link
+	config_add_string mld_addr
+	config_add_int eml_disable
+	config_add_int eml_resp
+}
+
+hostapd_set_vlan_file() {
+	local ifname="$1"
+	local vlan="$2"
+	json_get_vars name vid
+	echo "${vid} ${ifname}-${name}" >> /var/run/hostapd-${ifname}.vlan
+	wireless_add_vlan "${vlan}" "${ifname}-${name}"
+}
+
+hostapd_set_vlan() {
+	local ifname="$1"
+
+	rm -f /var/run/hostapd-${ifname}.vlan
+	for_each_vlan hostapd_set_vlan_file ${ifname}
+}
+
+hostapd_set_psk_file() {
+	local ifname="$1"
+	local vlan="$2"
+	local vlan_id=""
+
+	json_get_vars mac vid key
+	set_default mac "00:00:00:00:00:00"
+	[ -n "$vid" ] && vlan_id="vlanid=$vid "
+	echo "${vlan_id} ${mac} ${key}" >> /var/run/hostapd-${ifname}.psk
+}
+
+hostapd_set_psk() {
+	local ifname="$1"
+
+	rm -f /var/run/hostapd-${ifname}.psk
+	for_each_station hostapd_set_psk_file ${ifname}
+}
+
+append_iw_roaming_consortium() {
+	[ -n "$1" ] && append bss_conf "roaming_consortium=$1" "$N"
+}
+
+append_iw_domain_name() {
+	if [ -z "$iw_domain_name_conf" ]; then
+		iw_domain_name_conf="$1"
+	else
+		iw_domain_name_conf="$iw_domain_name_conf,$1"
+	fi
+}
+
+append_iw_anqp_3gpp_cell_net() {
+	if [ -z "$iw_anqp_3gpp_cell_net_conf" ]; then
+		iw_anqp_3gpp_cell_net_conf="$1"
+	else
+		iw_anqp_3gpp_cell_net_conf="$iw_anqp_3gpp_cell_net_conf;$1"
+	fi
+}
+
+append_iw_anqp_elem() {
+	[ -n "$1" ] && append bss_conf "anqp_elem=$1" "$N"
+}
+
+append_iw_nai_realm() {
+	[ -n "$1" ] && append bss_conf "nai_realm=$1" "$N"
+}
+
+append_iw_venue_name() {
+	[ -n "$1" ] && append bss_conf "venue_name=$1" "$N"
+}
+
+append_iw_venue_url() {
+	[ -n "$1" ] && append bss_conf "venue_url=$1" "$N"
+}
+
+append_hs20_oper_friendly_name() {
+	append bss_conf "hs20_oper_friendly_name=$1" "$N"
+}
+
+append_osu_provider_friendly_name() {
+	append bss_conf "osu_friendly_name=$1" "$N"
+}
+
+append_osu_provider_service_desc() {
+	append bss_conf "osu_service_desc=$1" "$N"
+}
+
+append_hs20_icon() {
+	local width height lang type path
+	config_get width "$1" width
+	config_get height "$1" height
+	config_get lang "$1" lang
+	config_get type "$1" type
+	config_get path "$1" path
+
+	append bss_conf "hs20_icon=$width:$height:$lang:$type:$1:$path" "$N"
+}
+
+append_hs20_icons() {
+	config_load wireless
+	config_foreach append_hs20_icon hs20-icon
+}
+
+append_operator_icon() {
+	append bss_conf "operator_icon=$1" "$N"
+}
+
+append_osu_icon() {
+	append bss_conf "osu_icon=$1" "$N"
+}
+
+append_osu_provider() {
+	local cfgtype osu_server_uri osu_friendly_name osu_nai osu_nai2 osu_method_list
+
+	config_load wireless
+	config_get cfgtype "$1" TYPE
+	[ "$cfgtype" != "osu-provider" ] && return
+
+	append bss_conf "# provider $1" "$N"
+	config_get osu_server_uri "$1" osu_server_uri
+	config_get osu_nai "$1" osu_nai
+	config_get osu_nai2 "$1" osu_nai2
+	config_get osu_method_list "$1" osu_method
+
+	append bss_conf "osu_server_uri=$osu_server_uri" "$N"
+	append bss_conf "osu_nai=$osu_nai" "$N"
+	append bss_conf "osu_nai2=$osu_nai2" "$N"
+	append bss_conf "osu_method_list=$osu_method_list" "$N"
+
+	config_list_foreach "$1" osu_service_desc append_osu_provider_service_desc
+	config_list_foreach "$1" osu_friendly_name append_osu_friendly_name
+	config_list_foreach "$1" osu_icon append_osu_icon
+
+	append bss_conf "$N"
+}
+
+append_hs20_conn_capab() {
+	[ -n "$1" ] && append bss_conf "hs20_conn_capab=$1" "$N"
+}
+
+append_radius_acct_req_attr() {
+	[ -n "$1" ] && append bss_conf "radius_acct_req_attr=$1" "$N"
+}
+
+append_radius_auth_req_attr() {
+	[ -n "$1" ] && append bss_conf "radius_auth_req_attr=$1" "$N"
+}
+
+append_airtime_sta_weight() {
+	[ -n "$1" ] && append bss_conf "airtime_sta_weight=$1" "$N"
+}
+
+append_auth_server() {
+	[ -n "$1" ] || return
+	append bss_conf "auth_server_addr=$1" "$N"
+	append bss_conf "auth_server_port=$auth_port" "$N"
+	[ -n "$auth_secret" ] && append bss_conf "auth_server_shared_secret=$auth_secret" "$N"
+}
+
+append_acct_server() {
+	[ -n "$1" ] || return
+	append bss_conf "acct_server_addr=$1" "$N"
+	append bss_conf "acct_server_port=$acct_port" "$N"
+	[ -n "$acct_secret" ] && append bss_conf "acct_server_shared_secret=$acct_secret" "$N"
+}
+
+hostapd_set_bss_options() {
+	local var="$1"
+	local phy="$2"
+	local vif="$3"
+
+	wireless_vif_parse_encryption
+	wireless_vif_parse_encryption_rsno
+
+	local bss_conf bss_md5sum ft_key
+	local wep_rekey wpa_group_rekey wpa_pair_rekey wpa_master_rekey wpa_key_mgmt
+
+	json_get_vars \
+		wep_rekey wpa_group_rekey wpa_pair_rekey wpa_master_rekey wpa_strict_rekey \
+		wpa_disable_eapol_key_retries tdls_prohibit \
+		maxassoc max_inactivity disassoc_low_ack isolate auth_cache \
+		wps_pushbutton wps_label ext_registrar wps_pbc_in_m1 wps_ap_setup_locked \
+		wps_independent wps_device_type wps_device_name wps_manufacturer wps_pin \
+		macfilter ssid utf8_ssid wmm uapsd hidden short_preamble rsn_preauth \
+		iapp_interface eapol_version dynamic_vlan ieee80211w nasid \
+		acct_secret acct_port acct_interval \
+		bss_load_update_period chan_util_avg_period sae_require_mfp sae_pwe \
+		multi_ap multi_ap_backhaul_ssid multi_ap_backhaul_key skip_inactivity_poll \
+		ppsk airtime_bss_weight airtime_bss_limit airtime_sta_weight \
+		multicast_to_unicast_all proxy_arp per_sta_vif \
+		eap_server eap_user_file ca_cert server_cert private_key private_key_passwd server_id radius_server_clients radius_server_auth_port \
+		vendor_elements fils ocv apup unsol_bcast_probe_resp_interval fils_discovery_min_interval \
+		fils_discovery_max_interval rnr group_cipher group_mgmt_cipher \
+		mld_id mld_link_id mld_primary mld_addr mld_allowed_links mld_radio_mask eml_disable eml_resp
+
+	set_default fils 0
+	set_default isolate 0
+	set_default maxassoc 0
+	set_default max_inactivity 0
+	set_default short_preamble 1
+	set_default disassoc_low_ack 1
+	set_default skip_inactivity_poll 0
+	set_default hidden 0
+	set_default wmm 1
+	set_default uapsd 1
+	set_default wpa_disable_eapol_key_retries 0
+	set_default tdls_prohibit 0
+	set_default eapol_version $((wpa & 1))
+	set_default acct_port 1813
+	set_default bss_load_update_period 60
+	set_default chan_util_avg_period 600
+	set_default utf8_ssid 1
+	set_default multi_ap 0
+	set_default ppsk 0
+	set_default airtime_bss_weight 0
+	set_default airtime_bss_limit 0
+	set_default eap_server 0
+	set_default apup 0
+
+	/usr/sbin/hostapd -vfils || fils=0
+
+	append bss_conf "ctrl_interface=/var/run/hostapd"
+	if [ "$isolate" -gt 0 ]; then
+		append bss_conf "ap_isolate=$isolate" "$N"
+	fi
+	if [ "$maxassoc" -gt 0 ]; then
+		append bss_conf "max_num_sta=$maxassoc" "$N"
+	fi
+	if [ "$max_inactivity" -gt 0 ]; then
+		append bss_conf "ap_max_inactivity=$max_inactivity" "$N"
+	fi
+
+	[ "$airtime_bss_weight" -gt 0 ] && append bss_conf "airtime_bss_weight=$airtime_bss_weight" "$N"
+	[ "$airtime_bss_limit" -gt 0 ] && append bss_conf "airtime_bss_limit=$airtime_bss_limit" "$N"
+	json_for_each_item append_airtime_sta_weight airtime_sta_weight
+
+	append bss_conf "bss_load_update_period=$bss_load_update_period" "$N"
+	append bss_conf "chan_util_avg_period=$chan_util_avg_period" "$N"
+	append bss_conf "disassoc_low_ack=$disassoc_low_ack" "$N"
+	append bss_conf "skip_inactivity_poll=$skip_inactivity_poll" "$N"
+	append bss_conf "preamble=$short_preamble" "$N"
+	append bss_conf "wmm_enabled=$wmm" "$N"
+	append bss_conf "ignore_broadcast_ssid=$hidden" "$N"
+	append bss_conf "uapsd_advertisement_enabled=$uapsd" "$N"
+	append bss_conf "utf8_ssid=$utf8_ssid" "$N"
+	append bss_conf "multi_ap=$multi_ap" "$N"
+	[ -n "$vendor_elements" ] && append bss_conf "vendor_elements=$vendor_elements" "$N"
+
+	[ "$tdls_prohibit" -gt 0 ] && append bss_conf "tdls_prohibit=$tdls_prohibit" "$N"
+
+	[ "$wpa" -gt 0 ] && {
+		[ -n "$wpa_group_rekey"  ] && append bss_conf "wpa_group_rekey=$wpa_group_rekey" "$N"
+		[ -n "$wpa_pair_rekey"   ] && append bss_conf "wpa_ptk_rekey=$wpa_pair_rekey"    "$N"
+		[ -n "$wpa_master_rekey" ] && append bss_conf "wpa_gmk_rekey=$wpa_master_rekey"  "$N"
+		[ -n "$wpa_strict_rekey" ] && append bss_conf "wpa_strict_rekey=$wpa_strict_rekey" "$N"
+	}
+
+	[ -n "$nasid" ] && append bss_conf "nas_identifier=$nasid" "$N"
+
+	[ -n "$acct_interval" ] && \
+		append bss_conf "radius_acct_interim_interval=$acct_interval" "$N"
+	json_for_each_item append_acct_server acct_server
+	json_for_each_item append_radius_acct_req_attr radius_acct_req_attr
+
+	[ -n "$ocv" ] && append bss_conf "ocv=$ocv" "$N"
+
+	case "$auth_type" in
+		sae|owe|eap2|eap192)
+			set_default ieee80211w 2
+			set_default sae_require_mfp 1
+			[ "$ppsk" -eq 0 ] && set_default sae_pwe 2
+		;;
+		psk-sae|eap-eap2)
+			set_default ieee80211w 1
+			set_default sae_require_mfp 1
+			[ "$ppsk" -eq 0 ] && set_default sae_pwe 2
+		;;
+	esac
+	[ -n "$sae_require_mfp" ] && append bss_conf "sae_require_mfp=$sae_require_mfp" "$N"
+
+	local vlan_possible=""
+
+	case "$auth_type" in
+		none|owe)
+			json_get_vars owe_transition_bssid owe_transition_ssid owe_transition_ifname
+
+			[ -n "$owe_transition_ssid" ] && append bss_conf "owe_transition_ssid=\"$owe_transition_ssid\"" "$N"
+			[ -n "$owe_transition_bssid" ] && append bss_conf "owe_transition_bssid=$owe_transition_bssid" "$N"
+			[ -n "$owe_transition_ifname" ] && append bss_conf "owe_transition_ifname=$owe_transition_ifname" "$N"
+
+			wps_possible=1
+			# Here we make the assumption that if we're in open mode
+			# with WPS enabled, we got to be in unconfigured state.
+			wps_not_configured=1
+		;;
+		psk|sae|psk-sae)
+			json_get_vars key wpa_psk_file
+			if [ "$ppsk" -ne 0 ]; then
+				json_get_vars auth_secret auth_port
+				set_default auth_port 1812
+				json_for_each_item append_auth_server auth_server
+				append bss_conf "macaddr_acl=2" "$N"
+				append bss_conf "wpa_psk_radius=2" "$N"
+			elif [ ${#key} -eq 64 ] && [ $auth_type != "psk-sae" ]; then
+				# QT verifies that password length should not
+				# be greater than 63 characters in
+				# WPA3-Personal transition mode.
+				append bss_conf "wpa_psk=$key" "$N"
+			elif [ ${#key} -ge 8 ] && [ ${#key} -le 63 ]; then
+				append bss_conf "wpa_passphrase=$key" "$N"
+			elif [ -n "$key" ] || [ -z "$wpa_psk_file" ]; then
+				wireless_setup_vif_failed INVALID_WPA_PSK
+				return 1
+			fi
+			[ -z "$wpa_psk_file" ] && set_default wpa_psk_file /var/run/hostapd-$ifname.psk
+			[ -n "$wpa_psk_file" ] && {
+				[ -e "$wpa_psk_file" ] || touch "$wpa_psk_file"
+				append bss_conf "wpa_psk_file=$wpa_psk_file" "$N"
+			}
+			[ "$eapol_version" -ge "1" -a "$eapol_version" -le "2" ] && append bss_conf "eapol_version=$eapol_version" "$N"
+
+			set_default dynamic_vlan 0
+			vlan_possible=1
+			wps_possible=1
+		;;
+		eap|eap2|eap-eap2|eap192)
+			json_get_vars \
+				auth_server auth_secret auth_port \
+				dae_client dae_secret dae_port \
+				dynamic_ownip ownip radius_client_addr \
+				eap_reauth_period request_cui \
+				erp_domain mobility_domain \
+				fils_realm fils_dhcp
+
+			# radius can provide VLAN ID for clients
+			vlan_possible=1
+
+			set_default dynamic_ownip 1
+
+			# legacy compatibility
+			[ -n "$auth_server" ] || json_get_var auth_server server
+			[ -n "$auth_port" ] || json_get_var auth_port port
+			[ -n "$auth_secret" ] || json_get_var auth_secret key
+
+			[ "$fils" -gt 0 ] && {
+				set_default erp_domain "$mobility_domain"
+				set_default erp_domain "$(echo "$ssid" | md5sum | head -c 8)"
+				set_default fils_realm "$erp_domain"
+
+				append bss_conf "erp_send_reauth_start=1" "$N"
+				append bss_conf "erp_domain=$erp_domain" "$N"
+				append bss_conf "fils_realm=$fils_realm" "$N"
+				append bss_conf "fils_cache_id=$(echo "$fils_realm" | md5sum | head -c 4)" "$N"
+
+				[ "$fils_dhcp" = "*" ] && {
+					json_get_values network network
+					fils_dhcp=
+					for net in $network; do
+						fils_dhcp="$(ifstatus "$net" | jsonfilter -e '@.data.dhcpserver')"
+						[ -n "$fils_dhcp" ] && break
+					done
+
+					[ -z "$fils_dhcp" -a -n "$network_bridge" -a -n "$network_ifname" ] && \
+						fils_dhcp="$(udhcpc -B -n -q -s /lib/netifd/dhcp-get-server.sh -t 1 -i "$network_ifname" 2>/dev/null)"
+				}
+				[ -n "$fils_dhcp" ] && append bss_conf "dhcp_server=$fils_dhcp" "$N"
+			}
+
+			set_default auth_port 1812
+			set_default dae_port 3799
+			set_default request_cui 0
+
+			[ "$eap_server" -eq 0 ] && json_for_each_item append_auth_server auth_server
+			[ "$request_cui" -gt 0 ] && append bss_conf "radius_request_cui=$request_cui" "$N"
+			[ -n "$eap_reauth_period" ] && append bss_conf "eap_reauth_period=$eap_reauth_period" "$N"
+
+			[ -n "$dae_client" -a -n "$dae_secret" ] && {
+				append bss_conf "radius_das_port=$dae_port" "$N"
+				append bss_conf "radius_das_client=$dae_client $dae_secret" "$N"
+			}
+			json_for_each_item append_radius_auth_req_attr radius_auth_req_attr
+
+			if [ -n "$ownip" ]; then
+				append bss_conf "own_ip_addr=$ownip" "$N"
+			elif [ "$dynamic_ownip" -gt 0 ]; then
+				append bss_conf "dynamic_own_ip_addr=$dynamic_ownip" "$N"
+			fi
+
+			[ -n "$radius_client_addr" ] && append bss_conf "radius_client_addr=$radius_client_addr" "$N"
+			append bss_conf "eapol_key_index_workaround=1" "$N"
+			append bss_conf "ieee8021x=1" "$N"
+
+			[ "$eapol_version" -ge "1" -a "$eapol_version" -le "2" ] && append bss_conf "eapol_version=$eapol_version" "$N"
+		;;
+		wep)
+			local wep_keyidx=0
+			json_get_vars key
+			hostapd_append_wep_key bss_conf
+			append bss_conf "wep_default_key=$wep_keyidx" "$N"
+			[ -n "$wep_rekey" ] && append bss_conf "wep_rekey_period=$wep_rekey" "$N"
+		;;
+	esac
+
+	case "$auth_type" in
+		none|owe|psk|sae|psk-sae|wep)
+			json_get_vars \
+			auth_server auth_port auth_secret \
+			ownip radius_client_addr
+
+			[ -n "$auth_server" ] &&  {
+				set_default auth_port 1812
+
+				json_for_each_item append_auth_server auth_server
+				[ -n "$ownip" ] && append bss_conf "own_ip_addr=$ownip" "$N"
+				[ -n "$radius_client_addr" ] && append bss_conf "radius_client_addr=$radius_client_addr" "$N"
+				append bss_conf "macaddr_acl=2" "$N"
+			}
+		;;
+	esac
+
+	local auth_algs="$((($auth_mode_shared << 1) | $auth_mode_open))"
+	append bss_conf "auth_algs=${auth_algs:-1}" "$N"
+	append bss_conf "wpa=$wpa" "$N"
+
+	json_get_values pairwise pairwise
+	json_get_vars group_cipher
+	if [ -n "$pairwise" ]; then
+		case "$pairwise" in
+			*tkip+aes|*tkip+ccmp|*aes+tkip|*ccmp+tkip)
+				wpa_cipher="CCMP TKIP"
+			;;
+			*ccmp256)
+				wpa_cipher="CCMP-256"
+			;;
+			*aes|*ccmp)
+				wpa_cipher="CCMP"
+			;;
+			*tkip)
+				wpa_cipher="TKIP"
+			;;
+			*gcmp256)
+				wpa_cipher="GCMP-256"
+			;;
+			*gcmp)
+				wpa_cipher="GCMP"
+			;;
+			*)
+				wpa_cipher=""
+			;;
+		esac
+	fi
+	[ -n "$wpa_cipher" ] && wpa_pairwise="$wpa_cipher"
+
+	[ -n "$wpa_pairwise" ] && append bss_conf "wpa_pairwise=$wpa_pairwise" "$N"
+
+	set_default wps_pushbutton 0
+	set_default wps_label 0
+	set_default wps_pbc_in_m1 0
+
+	config_methods=
+	[ "$wps_pushbutton" -gt 0 ] && {
+		append config_methods push_button
+		append bss_conf "wps_cred_add_sae=1" "$N"
+	}
+	[ "$wps_label" -gt 0 ] && append config_methods label
+
+	# WPS not possible on Multi-AP backhaul-only SSID
+	[ "$multi_ap" = 1 ] && wps_possible=
+
+	[ -n "$wps_possible" -a -n "$config_methods" ] && {
+		set_default ext_registrar 0
+		set_default wps_device_type "6-0050F204-1"
+		set_default wps_device_name "OpenWrt AP"
+		set_default wps_manufacturer "www.openwrt.org"
+		set_default wps_independent 1
+
+		wps_state=2
+		[ -n "$wps_not_configured" ] && wps_state=1
+
+		[ "$ext_registrar" -gt 0 -a -n "$network_bridge" ] && append bss_conf "upnp_iface=$network_bridge" "$N"
+
+		append bss_conf "eap_server=1" "$N"
+		[ -n "$wps_pin" ] && append bss_conf "ap_pin=$wps_pin" "$N"
+		append bss_conf "wps_state=$wps_state" "$N"
+		append bss_conf "device_type=$wps_device_type" "$N"
+		append bss_conf "device_name=$wps_device_name" "$N"
+		append bss_conf "manufacturer=$wps_manufacturer" "$N"
+		append bss_conf "config_methods=$config_methods" "$N"
+		append bss_conf "wps_independent=$wps_independent" "$N"
+		[ -n "$wps_ap_setup_locked" ] && append bss_conf "ap_setup_locked=$wps_ap_setup_locked" "$N"
+		[ "$wps_pbc_in_m1" -gt 0 ] && append bss_conf "pbc_in_m1=$wps_pbc_in_m1" "$N"
+		[ "$multi_ap" -gt 0 ] && [ -n "$multi_ap_backhaul_ssid" ] && {
+			append bss_conf "multi_ap_backhaul_ssid=\"$multi_ap_backhaul_ssid\"" "$N"
+			if [ -z "$multi_ap_backhaul_key" ]; then
+				:
+			elif [ ${#multi_ap_backhaul_key} -lt 8 ]; then
+				wireless_setup_vif_failed INVALID_WPA_PSK
+				return 1
+			elif [ ${#multi_ap_backhaul_key} -eq 64 ]; then
+				append bss_conf "multi_ap_backhaul_wpa_psk=$multi_ap_backhaul_key" "$N"
+			else
+				append bss_conf "multi_ap_backhaul_wpa_passphrase=$multi_ap_backhaul_key" "$N"
+			fi
+		}
+	}
+
+	append bss_conf "ssid=$ssid" "$N"
+	[ -n "$network_bridge" ] && append bss_conf "bridge=$network_bridge${N}wds_bridge=$network_bridge" "$N"
+	[ -n "$network_ifname" ] && append bss_conf "snoop_iface=$network_ifname" "$N"
+	[ -n "$iapp_interface" ] && {
+		local ifname
+		network_get_device ifname "$iapp_interface" || ifname="$iapp_interface"
+		append bss_conf "iapp_interface=$ifname" "$N"
+	}
+
+	json_get_vars time_advertisement time_zone wnm_sleep_mode wnm_sleep_mode_no_keys bss_transition mbo
+	set_default bss_transition 0
+	set_default wnm_sleep_mode 0
+	set_default wnm_sleep_mode_no_keys 0
+	set_default mbo 0
+
+	[ -n "$time_advertisement" ] && append bss_conf "time_advertisement=$time_advertisement" "$N"
+	[ -n "$time_zone" ] && append bss_conf "time_zone=$time_zone" "$N"
+	if [ "$wnm_sleep_mode" -eq "1" ]; then
+		append bss_conf "wnm_sleep_mode=1" "$N"
+		[ "$wnm_sleep_mode_no_keys" -eq "1" ] && append bss_conf "wnm_sleep_mode_no_keys=1" "$N"
+	fi
+	[ "$bss_transition" -eq "1" ] && append bss_conf "bss_transition=1" "$N"
+	[ "$mbo" -eq 1 ] && append bss_conf "mbo=1" "$N"
+
+	json_get_vars ieee80211k rrm_neighbor_report rrm_beacon_report rnr
+	set_default ieee80211k 0
+	set_default rnr 0
+	if [ "$ieee80211k" -eq "1" ]; then
+		set_default rrm_neighbor_report 1
+		set_default rrm_beacon_report 1
+	else
+		set_default rrm_neighbor_report 0
+		set_default rrm_beacon_report 0
+	fi
+
+	[ "$rrm_neighbor_report" -eq "1" ] && append bss_conf "rrm_neighbor_report=1" "$N"
+	[ "$rrm_beacon_report" -eq "1" ] && append bss_conf "rrm_beacon_report=1" "$N"
+	[ "$rnr" -eq "1" ] && append bss_conf "rnr=1" "$N"
+
+	json_get_vars ftm_responder stationary_ap lci civic
+	set_default ftm_responder 0
+	if [ "$ftm_responder" -eq "1" ]; then
+		set_default stationary_ap 0
+		iw phy "$phy" info | grep -q "ENABLE_FTM_RESPONDER" && {
+			append bss_conf "ftm_responder=1" "$N"
+			[ "$stationary_ap" -eq "1" ] && append bss_conf "stationary_ap=1" "$N"
+			[ -n "$lci" ] && append bss_conf "lci=$lci" "$N"
+			[ -n "$civic" ] && append bss_conf "civic=$civic" "$N"
+		}
+	fi
+
+	json_get_vars ieee80211r
+	set_default ieee80211r 0
+	if [ "$wpa" -ge "1" ]; then
+		if [ "$fils" -gt 0 ]; then
+			json_get_vars fils_realm
+			set_default fils_realm "$(echo "$ssid" | md5sum | head -c 8)"
+		fi
+
+		append bss_conf "wpa_disable_eapol_key_retries=$wpa_disable_eapol_key_retries" "$N"
+
+		hostapd_append_wpa_key_mgmt
+		[ -n "$wpa_key_mgmt" ] && append bss_conf "wpa_key_mgmt=$wpa_key_mgmt" "$N"
+
+		if [ -n "$rsn_override_key_mgmt" ]; then
+			append bss_conf "rsn_override_key_mgmt=$rsn_override_key_mgmt" "$N"
+			append bss_conf "rsn_override_pairwise=$rsno_wpa_cipher" "$N"
+			append bss_conf "rsn_override_mfp=2" "$N"
+		fi
+
+		if [ -n "$rsn_override_key_mgmt_2" ]; then
+			append bss_conf "rsn_override_key_mgmt_2=$rsn_override_key_mgmt_2" "$N"
+			append bss_conf "rsn_override_pairwise_2=$rsno_wpa_cipher_2" "$N"
+			append bss_conf "rsn_override_mfp_2=2" "$N"
+		fi
+	fi
+
+	[ -n "$sae_pwe" ] && append bss_conf "sae_pwe=$sae_pwe" "$N"
+
+	if [ "$wpa" -ge "2" ]; then
+		json_get_values sae_groups sae_groups
+		json_get_values owe_groups owe_groups
+		if [ "$ieee80211r" -gt "0" ]; then
+			json_get_vars mobility_domain ft_psk_generate_local ft_over_ds reassociation_deadline
+
+			set_default mobility_domain "$(echo "$ssid" | md5sum | head -c 4)"
+			set_default ft_over_ds 0
+			set_default reassociation_deadline 1000
+
+			case "$auth_type" in
+				psk)
+					set_default ft_psk_generate_local 1
+				;;
+				*)
+					set_default ft_psk_generate_local 0
+				;;
+			esac
+
+			[ -n "$network_ifname" ] && append bss_conf "ft_iface=$network_ifname" "$N"
+			append bss_conf "mobility_domain=$mobility_domain" "$N"
+			append bss_conf "ft_psk_generate_local=$ft_psk_generate_local" "$N"
+			append bss_conf "ft_over_ds=$ft_over_ds" "$N"
+			append bss_conf "reassociation_deadline=$reassociation_deadline" "$N"
+
+			if [ "$ft_psk_generate_local" -eq "0" ]; then
+				json_get_vars r0_key_lifetime r1_key_holder pmk_r1_push
+				json_get_values r0kh r0kh
+				json_get_values r1kh r1kh
+
+				set_default r0_key_lifetime 10000
+				set_default pmk_r1_push 0
+
+				[ -n "$r0kh" -a -n "$r1kh" ] || {
+					if [ -z "$auth_secret" -a -z "$key" ]; then
+						wireless_setup_vif_failed FT_KEY_CANT_BE_DERIVED
+						return 1
+					fi
+					ft_key=`echo -n "$mobility_domain/${auth_secret:-${key}}" | md5sum | awk '{print $1}'`
+
+					set_default r0kh "ff:ff:ff:ff:ff:ff,*,$ft_key"
+					set_default r1kh "00:00:00:00:00:00,00:00:00:00:00:00,$ft_key"
+				}
+
+				[ -n "$r1_key_holder" ] && append bss_conf "r1_key_holder=$r1_key_holder" "$N"
+				append bss_conf "r0_key_lifetime=$r0_key_lifetime" "$N"
+				append bss_conf "pmk_r1_push=$pmk_r1_push" "$N"
+
+				for kh in $r0kh; do
+					append bss_conf "r0kh=${kh//,/ }" "$N"
+				done
+				for kh in $r1kh; do
+					append bss_conf "r1kh=${kh//,/ }" "$N"
+				done
+			fi
+		fi
+
+		if [ -n "$network_bridge" -a "$rsn_preauth" = 1 ]; then
+			set_default auth_cache 1
+			append bss_conf "rsn_preauth=1" "$N"
+			append bss_conf "rsn_preauth_interfaces=$network_bridge" "$N"
+		else
+			case "$auth_type" in
+			sae|psk-sae|owe)
+				set_default auth_cache 1
+			;;
+			*)
+				set_default auth_cache 0
+			;;
+			esac
+		fi
+
+		append bss_conf "okc=$auth_cache" "$N"
+		[ "$auth_cache" = 0 -a "$fils" = 0 ] && append bss_conf "disable_pmksa_caching=1" "$N"
+
+		[ -z "$group_cipher" ] && group_cipher="$wpa_cipher"
+		[ -n "$group_cipher" ] && append bss_conf "group_cipher=$group_cipher" "$N"
+
+		if [ -n "$sae_groups" -o -n "$owe_groups" ]; then
+			case "$auth_type" in
+			sae*)
+				append bss_conf "sae_groups=$sae_groups" "$N"
+			;;
+			owe)
+				append bss_conf "owe_groups=$owe_groups" "$N"
+			;;
+			esac
+		fi
+
+		# RSN -> allow management frame protection
+		case "$ieee80211w" in
+			[012])
+				json_get_vars ieee80211w_mgmt_cipher ieee80211w_max_timeout ieee80211w_retry_timeout beacon_prot
+				append bss_conf "ieee80211w=$ieee80211w" "$N"
+				[ "$ieee80211w" -gt "0" ] && {
+					if [ -z "$group_mgmt_cipher" ]; then
+						case "$group_cipher" in
+						CCMP-256)
+							ieee80211w_mgmt_cipher="BIP-CMAC-256"
+						;;
+						CCMP)
+							ieee80211w_mgmt_cipher="AES-128-CMAC"
+						;;
+						GCMP-256)
+							ieee80211w_mgmt_cipher="BIP-GMAC-256"
+						;;
+						GCMP)
+							ieee80211w_mgmt_cipher="BIP-GMAC-128"
+						;;
+						esac
+					else
+						ieee80211w_mgmt_cipher="$group_mgmt_cipher"
+					fi
+					if [ "$auth_type" = "eap192" ]; then
+						append bss_conf "group_mgmt_cipher=BIP-GMAC-256" "$N"
+					else
+						append bss_conf "group_mgmt_cipher=${ieee80211w_mgmt_cipher:-AES-128-CMAC}" "$N"
+					fi
+					[ -n "$beacon_prot" ] && \
+						append bss_conf "beacon_prot=$beacon_prot" "$N"
+					[ -n "$ieee80211w_max_timeout" ] && \
+						append bss_conf "assoc_sa_query_max_timeout=$ieee80211w_max_timeout" "$N"
+					[ -n "$ieee80211w_retry_timeout" ] && \
+						append bss_conf "assoc_sa_query_retry_timeout=$ieee80211w_retry_timeout" "$N"
+				}
+			;;
+		esac
+	fi
+
+	_macfile="/var/run/hostapd-$ifname.maclist"
+	case "$macfilter" in
+		allow)
+			append bss_conf "macaddr_acl=1" "$N"
+			append bss_conf "accept_mac_file=$_macfile" "$N"
+			# accept_mac_file can be used to set MAC to VLAN ID mapping
+			vlan_possible=1
+		;;
+		deny)
+			append bss_conf "macaddr_acl=0" "$N"
+			append bss_conf "deny_mac_file=$_macfile" "$N"
+		;;
+		*)
+			_macfile=""
+		;;
+	esac
+
+	[ -n "$_macfile" ] && {
+		json_get_vars macfile
+		json_get_values maclist maclist
+
+		rm -f "$_macfile"
+		(
+			for mac in $maclist; do
+				echo "$mac"
+			done
+			[ -n "$macfile" -a -f "$macfile" ] && cat "$macfile"
+		) > "$_macfile"
+	}
+
+	[ -n "$vlan_possible" -a -n "$dynamic_vlan" ] && {
+		json_get_vars vlan_naming vlan_tagged_interface vlan_bridge vlan_file vlan_no_bridge
+		set_default vlan_naming 1
+		[ -z "$vlan_file" ] && set_default vlan_file /var/run/hostapd-$ifname.vlan
+		append bss_conf "dynamic_vlan=$dynamic_vlan" "$N"
+		append bss_conf "vlan_naming=$vlan_naming" "$N"
+		if [ -n "$vlan_bridge" ]; then
+			append bss_conf "vlan_bridge=$vlan_bridge" "$N"
+		else
+			set_default vlan_no_bridge 1
+		fi
+		append bss_conf "vlan_no_bridge=$vlan_no_bridge" "$N"
+		[ -n "$vlan_tagged_interface" ] && \
+			append bss_conf "vlan_tagged_interface=$vlan_tagged_interface" "$N"
+		[ -n "$vlan_file" ] && {
+			[ -e "$vlan_file" ] || touch "$vlan_file"
+			append bss_conf "vlan_file=$vlan_file" "$N"
+		}
+	}
+
+	json_get_vars iw_enabled iw_internet iw_asra iw_esr iw_uesa iw_access_network_type
+	json_get_vars iw_hessid iw_venue_group iw_venue_type iw_network_auth_type
+	json_get_vars iw_roaming_consortium iw_domain_name iw_anqp_3gpp_cell_net iw_nai_realm
+	json_get_vars iw_anqp_elem iw_qos_map_set iw_ipaddr_type_availability iw_gas_address3
+	json_get_vars iw_venue_name iw_venue_url
+	json_get_vars interworking
+
+	set_default iw_enabled 0
+	if [ "$iw_enabled" = "1" ] || [ "$interworking" = "1" ]; then
+		append bss_conf "interworking=1" "$N"
+		set_default iw_internet 1
+		set_default iw_asra 0
+		set_default iw_esr 0
+		set_default iw_uesa 0
+
+		append bss_conf "internet=$iw_internet" "$N"
+		append bss_conf "asra=$iw_asra" "$N"
+		append bss_conf "esr=$iw_esr" "$N"
+		append bss_conf "uesa=$iw_uesa" "$N"
+
+		[ -n "$iw_access_network_type" ] && \
+			append bss_conf "access_network_type=$iw_access_network_type" "$N"
+		[ -n "$iw_hessid" ] && append bss_conf "hessid=$iw_hessid" "$N"
+		[ -n "$iw_venue_group" ] && \
+			append bss_conf "venue_group=$iw_venue_group" "$N"
+		[ -n "$iw_venue_type" ] && append bss_conf "venue_type=$iw_venue_type" "$N"
+		[ -n "$iw_network_auth_type" ] && \
+			append bss_conf "network_auth_type=$iw_network_auth_type" "$N"
+		[ -n "$iw_gas_address3" ] && append bss_conf "gas_address3=$iw_gas_address3" "$N"
+
+		json_for_each_item append_iw_roaming_consortium iw_roaming_consortium
+		json_for_each_item append_iw_anqp_elem iw_anqp_elem
+		json_for_each_item append_iw_nai_realm iw_nai_realm
+		json_for_each_item append_iw_venue_name iw_venue_name
+		json_for_each_item append_iw_venue_url iw_venue_url
+
+		iw_domain_name_conf=
+		json_for_each_item append_iw_domain_name iw_domain_name
+		[ -n "$iw_domain_name_conf" ] && \
+			append bss_conf "domain_name=$iw_domain_name_conf" "$N"
+
+		iw_anqp_3gpp_cell_net_conf=
+		json_for_each_item append_iw_anqp_3gpp_cell_net iw_anqp_3gpp_cell_net
+		[ -n "$iw_anqp_3gpp_cell_net_conf" ] && \
+			append bss_conf "anqp_3gpp_cell_net=$iw_anqp_3gpp_cell_net_conf" "$N"
+	fi
+
+	set_default iw_qos_map_set 0,0,2,16,1,1,255,255,18,22,24,38,40,40,44,46,48,56
+	case "$iw_qos_map_set" in
+		*,*);;
+		*) iw_qos_map_set="";;
+	esac
+	[ -n "$iw_qos_map_set" ] && append bss_conf "qos_map_set=$iw_qos_map_set" "$N"
+
+	local hs20 disable_dgaf osen anqp_domain_id hs20_deauth_req_timeout \
+		osu_ssid hs20_wan_metrics hs20_operating_class hs20_t_c_filename hs20_t_c_timestamp \
+		hs20_t_c_server_url
+	json_get_vars hs20 disable_dgaf osen anqp_domain_id hs20_deauth_req_timeout \
+		osu_ssid hs20_wan_metrics hs20_operating_class hs20_t_c_filename hs20_t_c_timestamp \
+		hs20_t_c_server_url
+
+	set_default hs20 0
+	set_default disable_dgaf $hs20
+	set_default osen 0
+	set_default anqp_domain_id 0
+	set_default hs20_deauth_req_timeout 60
+	if [ "$hs20" = "1" ]; then
+		append bss_conf "hs20=1" "$N"
+		append_hs20_icons
+		append bss_conf "disable_dgaf=$disable_dgaf" "$N"
+		append bss_conf "osen=$osen" "$N"
+		append bss_conf "anqp_domain_id=$anqp_domain_id" "$N"
+		append bss_conf "hs20_deauth_req_timeout=$hs20_deauth_req_timeout" "$N"
+		[ -n "$osu_ssid" ] && append bss_conf "osu_ssid=$osu_ssid" "$N"
+		[ -n "$hs20_wan_metrics" ] && append bss_conf "hs20_wan_metrics=$hs20_wan_metrics" "$N"
+		[ -n "$hs20_operating_class" ] && append bss_conf "hs20_operating_class=$hs20_operating_class" "$N"
+		[ -n "$hs20_t_c_filename" ] && append bss_conf "hs20_t_c_filename=$hs20_t_c_filename" "$N"
+		[ -n "$hs20_t_c_timestamp" ] && append bss_conf "hs20_t_c_timestamp=$hs20_t_c_timestamp" "$N"
+		[ -n "$hs20_t_c_server_url" ] && append bss_conf "hs20_t_c_server_url=$hs20_t_c_server_url" "$N"
+		json_for_each_item append_hs20_oper_friendly_name hs20_oper_friendly_name
+		json_for_each_item append_hs20_conn_capab hs20_conn_capab
+		json_for_each_item append_osu_provider osu_provider
+		json_for_each_item append_operator_icon operator_icon
+	fi
+
+	if [ "$eap_server" = "1" ]; then
+		append bss_conf "eap_server=1" "$N"
+		append bss_conf "eap_server_erp=1" "$N"
+		[ -n "$eap_user_file" ] && append bss_conf "eap_user_file=$eap_user_file" "$N"
+		[ -n "$ca_cert" ] && append bss_conf "ca_cert=$ca_cert" "$N"
+		[ -n "$server_cert" ] && append bss_conf "server_cert=$server_cert" "$N"
+		[ -n "$private_key" ] && append bss_conf "private_key=$private_key" "$N"
+		[ -n "$private_key_passwd" ] && append bss_conf "private_key_passwd=$private_key_passwd" "$N"
+		[ -n "$server_id" ] && append bss_conf "server_id=$server_id" "$N"
+		[ -n "$radius_server_clients" ] && append bss_conf "radius_server_clients=$radius_server_clients" "$N"
+		[ -n "$radius_server_auth_port" ] && append bss_conf "radius_server_auth_port=$radius_server_auth_port" "$N"
+	fi
+
+	set_default multicast_to_unicast_all 0
+	if [ "$multicast_to_unicast_all" -gt 0 ]; then
+		append bss_conf "multicast_to_unicast=$multicast_to_unicast_all" "$N"
+	fi
+	set_default proxy_arp 0
+	if [ "$proxy_arp" -gt 0 ]; then
+		append bss_conf "proxy_arp=$proxy_arp" "$N"
+	fi
+
+	set_default per_sta_vif 0
+	if [ "$per_sta_vif" -gt 0 ]; then
+		append bss_conf "per_sta_vif=$per_sta_vif" "$N"
+	fi
+
+	if [ "$apup" -gt 0 ]; then
+		append bss_conf "apup=$apup" "$N"
+
+		local apup_peer_ifname_prefix
+		json_get_vars apup_peer_ifname_prefix
+		if [ -n "$apup_peer_ifname_prefix" ] ; then
+			append bss_conf "apup_peer_ifname_prefix=$apup_peer_ifname_prefix" "$N"
+		fi
+	fi
+
+	json_get_values opts hostapd_bss_options
+	for val in $opts; do
+		append bss_conf "$val" "$N"
+	done
+
+	if [ "$unsol_bcast_probe_resp_interval" -gt 0 ]; then
+		append bss_conf "unsol_bcast_probe_resp_interval=$unsol_bcast_probe_resp_interval" "$N"
+	fi
+
+	if [ -n "$fils_discovery_min_interval" ]; then
+		append bss_conf "fils_discovery_min_interval=$fils_discovery_min_interval" "$N"
+	fi
+
+	if [ -n "$fils_discovery_max_interval" ]; then
+		append bss_conf "fils_discovery_max_interval=$fils_discovery_max_interval" "$N"
+	fi
+
+	if [ -n "$rnr" ]; then
+		append bss_conf "rnr=$rnr" "$N"
+	fi
+
+	if [ -n "$mld_id" ]; then
+		if !([ "$mld_id" -ge 0 ] && [ "$mld_id" -le 255 ]); then
+			echo "Invalid mld_id: ${mld_id}"
+			return 1
+		fi
+		append bss_conf "mld_ap=1" "$N"
+		if [ -n "$mld_addr" ]; then
+			append bss_conf "mld_addr=$mld_addr" "$N"
+		fi
+	fi
+
+	if [ "$mld_primary" -gt 0 ]; then
+		append bss_conf "mld_primary=${mld_primary}" "$N"
+	fi
+
+	[ -n "$mld_link_id" ] && append bss_conf "mld_link_id=${mld_link_id}" "$N"
+
+	if [ "$mld_allowed_links" -gt 0 ]; then
+		append bss_conf "mld_allowed_links=${mld_allowed_links}" "$N"
+	fi
+
+	if [ "$mld_radio_mask" -gt 0 ]; then
+		append bss_conf "mld_radio_mask=${mld_radio_mask}" "$N"
+	fi
+
+	if [ -n "$eml_disable" ]; then
+		append bss_conf "eml_disable=$eml_disable" "$N"
+	fi
+
+	if [ -n "$eml_resp" ]; then
+		append bss_conf "eml_resp=$eml_resp" "$N"
+	fi
+
+	append "$var" "$bss_conf" "$N"
+	return 0
+}
+
+hostapd_set_log_options() {
+	local var="$1"
+
+	local log_level log_80211 log_8021x log_radius log_wpa log_driver log_iapp log_mlme
+	json_get_vars log_level log_80211 log_8021x log_radius log_wpa log_driver log_iapp log_mlme
+
+	set_default log_level 2
+	set_default log_80211  1
+	set_default log_8021x  1
+	set_default log_radius 1
+	set_default log_wpa    1
+	set_default log_driver 1
+	set_default log_iapp   1
+	set_default log_mlme   1
+
+	local log_mask="$(( \
+		($log_80211  << 0) | \
+		($log_8021x  << 1) | \
+		($log_radius << 2) | \
+		($log_wpa    << 3) | \
+		($log_driver << 4) | \
+		($log_iapp   << 5) | \
+		($log_mlme   << 6)   \
+	))"
+
+	append "$var" "logger_syslog=$log_mask" "$N"
+	append "$var" "logger_syslog_level=$log_level" "$N"
+	append "$var" "logger_stdout=$log_mask" "$N"
+	append "$var" "logger_stdout_level=$log_level" "$N"
+
+	return 0
+}
+
+_wpa_supplicant_common() {
+	local ifname="$1"
+
+	_rpath="/var/run/wpa_supplicant"
+	_config="${_rpath}-$ifname.conf"
+}
+
+wpa_supplicant_teardown_interface() {
+	_wpa_supplicant_common "$1"
+	rm -rf "$_rpath/$1" "$_config"
+}
+
+wpa_supplicant_prepare_interface() {
+	local ifname="$1"
+	_w_driver="$2"
+
+	_wpa_supplicant_common "$1"
+
+	json_get_vars mode wds multi_ap assoc_phy mld_single_link mld_assoc_phy mld_allowed_phy_bitmap rsn_overriding
+	set_default mld_allowed_phy_bitmap 0
+	set_default rsn_overriding 2
+
+	[ -n "$network_bridge" ] && {
+		fail=
+		case "$mode" in
+			adhoc)
+				fail=1
+			;;
+			sta)
+				[ "$wds" = 1 -o "$multi_ap" = 1 ] || fail=1
+			;;
+		esac
+
+		[ -n "$fail" ] && {
+			wireless_setup_vif_failed BRIDGE_NOT_ALLOWED
+			return 1
+		}
+	}
+
+	local ap_scan=
+
+	_w_mode="$mode"
+
+	[ "$mode" = adhoc ] && {
+		ap_scan="ap_scan=2"
+	}
+
+	local country_str=
+	[ -n "$country" ] && {
+		country_str="country=$country"
+	}
+
+	local rsn_overriding_str=
+	[ -n "$rsn_overriding" ] && {
+		rsn_overriding_str="rsn_overriding=$rsn_overriding"
+	}
+
+	local mld_force_single_link=
+	[ -n "$mld_single_link" ] && {
+		mld_force_single_link=$mld_single_link
+	}
+
+	if !([ "$mld_allowed_phy_bitmap" -ge 0 ] && [ "$mld_allowed_phy_bitmap" -le 7 ]); then
+		echo "Error: Invalid MLD allowed phy: ${mld_allowed_phy_bitmap}"
+		return 1
+	fi
+
+	[ -n "$assoc_phy" ] && mld_assoc_phy=$assoc_phy
+
+	local mld_connect_band_pref=
+	if [ -n "$mld_assoc_phy" ]; then
+		if [ $(($mld_allowed_phy_bitmap & $((1<<$mld_assoc_phy)))) -eq 0 ]; then
+			echo "Error: Conflict between preferred association phy and allowed phy"
+			return 1
+		fi
+
+		mld_connect_band_pref=$(($mld_assoc_phy+1))
+	fi
+
+	local radio0_scan_list="2412 2417 2422 2427 2432 2437 2442 2447 2452 2457 2462 2467 2472"
+	local radio1_scan_list="5180 5200 5220 5240 5260 5280 5300 5320 5500 5520 5540 5560 5580 5600 5620 5640 5660 5680 5700 5720 5745 5765 5785 5805 5825 5845 5865 5885"
+	local radio2_scan_list="5955 5975 5995 6015 6035 6055 6075 6095 6115 6135 6155 6175 6195 6215 6235 6255 6275 6295 6315 6335 6355 6375 6395 6415 6435 6455 6475 6495 6515 6535 6555 6575 6595 6615 6635 6655 6675 6695 6715 6735 6755 6775 6795 6815 6835 6855 6875 6895 6915 6935 6955 6975 6995 7015 7035 7055 7075 7095 7115"
+	local scan_list=
+	if [ $mld_allowed_phy_bitmap -gt 0 ]; then
+		if [ "$mld_assoc_phy" = "0" ]; then
+			scan_list="$radio0_scan_list"
+		elif [ "$mld_assoc_phy" = "1" ]; then
+			scan_list="$radio1_scan_list"
+		elif [ "$mld_assoc_phy" = "2" ]; then
+			scan_list="$radio2_scan_list"
+		fi
+	else
+		# For Legacy STA
+		if [ "$radio" = "0" ]; then
+			scan_list="$radio0_scan_list"
+		elif [ "$radio" = "1" ]; then
+			scan_list="$radio1_scan_list"
+		elif [ "$radio" = "2" ]; then
+			scan_list="$radio2_scan_list"
+		fi
+	fi
+
+	local tx_queue_data2_burst="tx_queue_data2_burst=0"
+	multiap_flag_file="${_config}.is_multiap"
+	if [ "$multi_ap" = "1" ]; then
+		touch "$multiap_flag_file"
+	else
+		[ -e "$multiap_flag_file" ] && rm "$multiap_flag_file"
+	fi
+	wpa_supplicant_teardown_interface "$ifname"
+	cat > "$_config" <<EOF
+${scan_list:+freq_list=$scan_list}
+$ap_scan
+$country_str
+$tx_queue_data2_burst
+${mld_connect_band_pref:+mld_connect_band_pref=$mld_connect_band_pref}
+${mld_force_single_link:+mld_force_single_link=$mld_force_single_link}
+${mld_allowed_phy_bitmap:+mld_allowed_phy=$mld_allowed_phy_bitmap}
+$rsn_overriding_str
+wps_cred_add_sae=1
+EOF
+	return 0
+}
+
+wpa_supplicant_set_fixed_freq() {
+	local freq="$1"
+	local htmode="$2"
+
+	append network_data "fixed_freq=1" "$N$T"
+	append network_data "frequency=$freq" "$N$T"
+	case "$htmode" in
+		NOHT) append network_data "disable_ht=1" "$N$T";;
+		HE20|HT20|VHT20) append network_data "disable_ht40=1" "$N$T";;
+		HT40*|VHT40|VHT80|VHT160|HE40|HE80|HE160) append network_data "ht40=1" "$N$T";;
+	esac
+	case "$htmode" in
+		VHT*) append network_data "vht=1" "$N$T";;
+	esac
+	case "$htmode" in
+		HE80|VHT80) append network_data "max_oper_chwidth=1" "$N$T";;
+		HE160|VHT160) append network_data "max_oper_chwidth=2" "$N$T";;
+		HE20|HE40|VHT20|VHT40) append network_data "max_oper_chwidth=0" "$N$T";;
+		*) append network_data "disable_vht=1" "$N$T";;
+	esac
+}
+
+wpa_supplicant_add_network() {
+	local ifname="$1"
+	local freq="$2"
+	local htmode="$3"
+	local noscan="$4"
+
+	_wpa_supplicant_common "$1"
+	wireless_vif_parse_encryption
+
+	json_get_vars \
+		ssid bssid key \
+		basic_rate mcast_rate \
+		ieee80211w ieee80211r fils ocv \
+		multi_ap \
+		default_disabled
+
+	case "$auth_type" in
+		sae|owe|eap2|eap192)
+			set_default ieee80211w 2
+		;;
+		psk-sae)
+			set_default ieee80211w 1
+		;;
+	esac
+
+	set_default ieee80211r 0
+	set_default multi_ap 0
+	set_default default_disabled 0
+
+	local key_mgmt='NONE'
+	local network_data=
+	local T="	"
+
+	local scan_ssid="scan_ssid=1"
+	local freq wpa_key_mgmt
+
+	[ "$_w_mode" = "adhoc" ] && {
+		append network_data "mode=1" "$N$T"
+		[ -n "$freq" ] && wpa_supplicant_set_fixed_freq "$freq" "$htmode"
+		[ "$noscan" = "1" ] && append network_data "noscan=1" "$N$T"
+
+		scan_ssid="scan_ssid=0"
+
+		[ "$_w_driver" = "nl80211" ] ||	append wpa_key_mgmt "WPA-NONE"
+	}
+
+	[ "$_w_mode" = "mesh" ] && {
+		json_get_vars mesh_id mesh_fwding mesh_rssi_threshold encryption
+		[ -n "$mesh_id" ] && ssid="${mesh_id}"
+
+		append network_data "mode=5" "$N$T"
+		[ -n "$mesh_fwding" ] && append network_data "mesh_fwding=${mesh_fwding}" "$N$T"
+		[ -n "$mesh_rssi_threshold" ] && append network_data "mesh_rssi_threshold=${mesh_rssi_threshold}" "$N$T"
+		[ -n "$freq" ] && wpa_supplicant_set_fixed_freq "$freq" "$htmode"
+		[ "$noscan" = "1" ] && append network_data "noscan=1" "$N$T"
+		[ "$encryption" = "none" -o -z "$encryption" ] || append wpa_key_mgmt "SAE"
+		scan_ssid=""
+	}
+
+	[ "$_w_mode" = "sta" ] && {
+		[ "$multi_ap" = 1 ] && append network_data "multi_ap_backhaul_sta=1" "$N$T"
+		[ "$default_disabled" = 1 ] && append network_data "disabled=1" "$N$T"
+	}
+
+	[ -n "$ocv" ] && append network_data "ocv=$ocv" "$N$T"
+
+	case "$auth_type" in
+		none) ;;
+		owe)
+			hostapd_append_wpa_key_mgmt
+			key_mgmt="$wpa_key_mgmt"
+		;;
+		wep)
+			local wep_keyidx=0
+			hostapd_append_wep_key network_data
+			append network_data "wep_tx_keyidx=$wep_keyidx" "$N$T"
+		;;
+		wps)
+			key_mgmt='WPS'
+		;;
+		psk|sae|psk-sae)
+			local passphrase
+
+			if [ "$_w_mode" != "mesh" ]; then
+				hostapd_append_wpa_key_mgmt
+			fi
+
+			key_mgmt="$wpa_key_mgmt"
+
+			if [ "$_w_mode" = "mesh" ] || [ "$auth_type" = "sae" ]; then
+				passphrase="sae_password=\"${key}\""
+			else
+				if [ ${#key} -eq 64 ]; then
+					passphrase="psk=${key}"
+				else
+					passphrase="psk=\"${key}\""
+				fi
+			fi
+			append network_data "$passphrase" "$N$T"
+		;;
+		eap|eap2|eap192)
+			hostapd_append_wpa_key_mgmt
+			key_mgmt="$wpa_key_mgmt"
+
+			json_get_vars eap_type identity anonymous_identity ca_cert ca_cert_usesystem
+
+			[ "$fils" -gt 0 ] && append network_data "erp=1" "$N$T"
+			if [ "$ca_cert_usesystem" -eq "1" -a -f "/etc/ssl/certs/ca-certificates.crt" ]; then
+				append network_data "ca_cert=\"/etc/ssl/certs/ca-certificates.crt\"" "$N$T"
+			else
+				[ -n "$ca_cert" ] && append network_data "ca_cert=\"$ca_cert\"" "$N$T"
+			fi
+			[ -n "$identity" ] && append network_data "identity=\"$identity\"" "$N$T"
+			[ -n "$anonymous_identity" ] && append network_data "anonymous_identity=\"$anonymous_identity\"" "$N$T"
+			case "$eap_type" in
+				tls)
+					json_get_vars client_cert priv_key priv_key_pwd
+					append network_data "client_cert=\"$client_cert\"" "$N$T"
+					append network_data "private_key=\"$priv_key\"" "$N$T"
+					append network_data "private_key_passwd=\"$priv_key_pwd\"" "$N$T"
+
+					json_get_vars subject_match
+					[ -n "$subject_match" ] && append network_data "subject_match=\"$subject_match\"" "$N$T"
+
+					json_get_values altsubject_match altsubject_match
+					if [ -n "$altsubject_match" ]; then
+						local list=
+						for x in $altsubject_match; do
+							append list "$x" ";"
+						done
+						append network_data "altsubject_match=\"$list\"" "$N$T"
+					fi
+
+					json_get_values domain_match domain_match
+					if [ -n "$domain_match" ]; then
+						local list=
+						for x in $domain_match; do
+							append list "$x" ";"
+						done
+						append network_data "domain_match=\"$list\"" "$N$T"
+					fi
+
+					json_get_values domain_suffix_match domain_suffix_match
+					if [ -n "$domain_suffix_match" ]; then
+						local list=
+						for x in $domain_suffix_match; do
+							append list "$x" ";"
+						done
+						append network_data "domain_suffix_match=\"$list\"" "$N$T"
+					fi
+				;;
+				fast|peap|ttls)
+					json_get_vars auth password ca_cert2 ca_cert2_usesystem client_cert2 priv_key2 priv_key2_pwd
+					set_default auth MSCHAPV2
+
+					if [ "$auth" = "EAP-TLS" ]; then
+						if [ "$ca_cert2_usesystem" -eq "1" -a -f "/etc/ssl/certs/ca-certificates.crt" ]; then
+							append network_data "ca_cert2=\"/etc/ssl/certs/ca-certificates.crt\"" "$N$T"
+						else
+							[ -n "$ca_cert2" ] && append network_data "ca_cert2=\"$ca_cert2\"" "$N$T"
+						fi
+						append network_data "client_cert2=\"$client_cert2\"" "$N$T"
+						append network_data "private_key2=\"$priv_key2\"" "$N$T"
+						append network_data "private_key2_passwd=\"$priv_key2_pwd\"" "$N$T"
+					else
+						append network_data "password=\"$password\"" "$N$T"
+					fi
+
+					json_get_vars subject_match
+					[ -n "$subject_match" ] && append network_data "subject_match=\"$subject_match\"" "$N$T"
+
+					json_get_values altsubject_match altsubject_match
+					if [ -n "$altsubject_match" ]; then
+						local list=
+						for x in $altsubject_match; do
+							append list "$x" ";"
+						done
+						append network_data "altsubject_match=\"$list\"" "$N$T"
+					fi
+
+					json_get_values domain_match domain_match
+					if [ -n "$domain_match" ]; then
+						local list=
+						for x in $domain_match; do
+							append list "$x" ";"
+						done
+						append network_data "domain_match=\"$list\"" "$N$T"
+					fi
+
+					json_get_values domain_suffix_match domain_suffix_match
+					if [ -n "$domain_suffix_match" ]; then
+						local list=
+						for x in $domain_suffix_match; do
+							append list "$x" ";"
+						done
+						append network_data "domain_suffix_match=\"$list\"" "$N$T"
+					fi
+
+					phase2proto="auth="
+					case "$auth" in
+						"auth"*)
+							phase2proto=""
+						;;
+						"EAP-"*)
+							auth="$(echo $auth | cut -b 5- )"
+							[ "$eap_type" = "ttls" ] &&
+								phase2proto="autheap="
+							json_get_vars subject_match2
+							[ -n "$subject_match2" ] && append network_data "subject_match2=\"$subject_match2\"" "$N$T"
+
+							json_get_values altsubject_match2 altsubject_match2
+							if [ -n "$altsubject_match2" ]; then
+								local list=
+								for x in $altsubject_match2; do
+									append list "$x" ";"
+								done
+								append network_data "altsubject_match2=\"$list\"" "$N$T"
+							fi
+
+							json_get_values domain_match2 domain_match2
+							if [ -n "$domain_match2" ]; then
+								local list=
+								for x in $domain_match2; do
+									append list "$x" ";"
+								done
+								append network_data "domain_match2=\"$list\"" "$N$T"
+							fi
+
+							json_get_values domain_suffix_match2 domain_suffix_match2
+							if [ -n "$domain_suffix_match2" ]; then
+								local list=
+								for x in $domain_suffix_match2; do
+									append list "$x" ";"
+								done
+								append network_data "domain_suffix_match2=\"$list\"" "$N$T"
+							fi
+						;;
+					esac
+					append network_data "phase2=\"$phase2proto$auth\"" "$N$T"
+				;;
+			esac
+			append network_data "eap=$(echo $eap_type | tr 'a-z' 'A-Z')" "$N$T"
+		;;
+	esac
+
+	json_get_values pairwise pairwise
+	json_get_vars group_cipher group_mgmt_cipher
+	if [ -n "$pairwise" ]; then
+		case "$pairwise" in
+			*tkip+aes|*tkip+ccmp|*aes+tkip|*ccmp+tkip)
+				wpa_cipher="CCMP TKIP"
+			;;
+			*ccmp256)
+				wpa_cipher="CCMP-256"
+			;;
+			*aes|*ccmp)
+				wpa_cipher="CCMP"
+			;;
+			*tkip)
+				wpa_cipher="TKIP"
+			;;
+			*gcmp256)
+				wpa_cipher="GCMP-256"
+			;;
+			*gcmp)
+				wpa_cipher="GCMP"
+			;;
+			*)
+				wpa_cipher=""
+			;;
+		esac
+	fi
+	[ -n "$wpa_cipher" ] && wpa_pairwise="$wpa_cipher"
+
+	[ "$mode" = mesh ] || {
+		json_get_values sae_groups sae_groups
+		json_get_values owe_groups owe_groups
+
+		case "$wpa" in
+			1)
+				append network_data "proto=WPA" "$N$T"
+			;;
+			2)
+				append network_data "proto=RSN" "$N$T"
+			;;
+		esac
+
+		[ -n "$wpa_pairwise" ] && append network_data "pairwise=$wpa_pairwise" "$N$T"
+		[ -z "$group_cipher" ] && group_cipher="CCMP TKIP CCMP-256 GCMP GCMP-256"
+		[ -n "$group_cipher" ] && append network_data "group=$group_cipher" "$N$T"
+
+		if [ -n "$sae_groups" -o -n "$owe_groups" ]; then
+			case "$auth_type" in
+			sae*)
+				echo "sae_groups=$sae_groups" >> "$_config"
+			;;
+			owe)
+				append network_data "owe_group=$owe_groups" "$N$T"
+			;;
+			esac
+		fi
+
+		# RSN -> allow management frame protection
+		case "$ieee80211w" in
+			[012])
+				json_get_vars ieee80211w_max_timeout ieee80211w_retry_timeout beacon_prot
+				append network_data "ieee80211w=$ieee80211w" "$N$T"
+				[ "$ieee80211w" -gt "0" ] && {
+					if [ "$auth_type" = "eap192" ]; then
+						append network_data "group_mgmt=BIP-GMAC-256" "$N$T"
+					elif [ -n "$group_mgmt_cipher" ]; then
+						append network_data "group_mgmt=$group_mgmt_cipher" "$N$T"
+					fi
+					[ -n "$beacon_prot" ] && \
+						append network_data "beacon_prot=$beacon_prot" "$N$T"
+				}
+			;;
+		esac
+	}
+
+	[ -n "$bssid" ] && append network_data "bssid=$bssid" "$N$T"
+	[ -n "$beacon_int" ] && append network_data "beacon_int=$beacon_int" "$N$T"
+
+	local bssid_blacklist bssid_whitelist
+	json_get_values bssid_blacklist bssid_blacklist
+	json_get_values bssid_whitelist bssid_whitelist
+
+	[ -n "$bssid_blacklist" ] && append network_data "bssid_blacklist=$bssid_blacklist" "$N$T"
+	[ -n "$bssid_whitelist" ] && append network_data "bssid_whitelist=$bssid_whitelist" "$N$T"
+
+        local disable_eht
+        local disable_he
+        local disable_vht
+        local disable_ht
+        json_get_vars disable_eht
+        json_get_vars disable_he
+        json_get_vars disable_vht
+        json_get_vars disable_ht
+
+        [ -n "$disable_eht" ] && append network_data "disable_eht=$disable_eht" "$N$T"
+        [ -n "$disable_he" ] && append network_data "disable_he=$disable_he" "$N$T"
+        [ -n "$disable_vht" ] && append network_data "disable_vht=$disable_vht" "$N$T"
+        [ -n "$disable_ht" ] && append network_data "disable_ht=$disable_ht" "$N$T"
+
+	[ -n "$basic_rate" ] && {
+		local br rate_list=
+		for br in $basic_rate; do
+			wpa_supplicant_add_rate rate_list "$br"
+		done
+		[ -n "$rate_list" ] && append network_data "rates=$rate_list" "$N$T"
+	}
+
+	[ -n "$mcast_rate" ] && {
+		local mc_rate=
+		wpa_supplicant_add_rate mc_rate "$mcast_rate"
+		append network_data "mcast_rate=$mc_rate" "$N$T"
+	}
+
+	if [ "$auth_type" = "sae" ]; then
+		json_get_vars sae_pwe sae_pwe
+		[ -n "$sae_pwe" ] && echo "sae_pwe=$sae_pwe" >> "$_config"
+	fi
+
+	if [ "$key_mgmt" = "WPS" ]; then
+		echo "wps_cred_processing=1" >> "$_config"
+	else
+		cat >> "$_config" <<EOF
+network={
+	$scan_ssid
+	ssid="$ssid"
+	key_mgmt=$key_mgmt
+	$network_data
+}
+EOF
+	fi
+	return 0
+}
diff --git a/wireless-scripts-example/old/hostapd-mtk-feed.uc b/wireless-scripts-example/old/hostapd-mtk-feed.uc
new file mode 100644
index 0000000000..59f8e1b657
--- /dev/null
+++ b/wireless-scripts-example/old/hostapd-mtk-feed.uc
@@ -0,0 +1,674 @@
+'use strict';
+
+import {
+	append, append_raw, append_vars, dump_config, flush_config, set_default,
+	wiphy_info, wiphy_band
+} from 'wifi.common';
+import { validate } from 'wifi.validate';
+import * as netifd from 'wifi.netifd';
+import * as iface from 'wifi.iface';
+import * as nl80211 from 'nl80211';
+import * as ap from 'wifi.ap';
+import * as fs from 'fs';
+
+const NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER = 33;
+const NL80211_EXT_FEATURE_RADAR_BACKGROUND = 61;
+
+let phy_features = {};
+let phy_capabilities = {};
+
+/* make sure old style UCI and hwmode and newer band properties are correctly resolved */
+function set_device_defaults(config) {
+	/* validate the hw mode */
+	if (config.hw_mode in [ '11a', '11b', '11g', '11ad' ])
+		config.hw_mode = substr(config.hw_mode, 2);
+	else if (config.channel > 14)
+		config.hw_mode = 'a';
+	else
+		config.hw_mode = 'g';
+
+	/* validate band */
+	if (config.band == '2g')
+		config.hw_mode = 'g';
+	else if (config.band in [ '5g', '6g', '60g' ])
+		config.hw_mode = 'a';
+	else
+		switch (config.hw_mode) {
+		case 'a':
+			config.band = '5g';
+			break;
+
+		case 'ad':
+			config.band = '60g';
+			break;
+
+		default:
+			config.band = '2g';
+			break;
+		}
+}
+
+/* setup sylog / stdout */
+function device_log_append(config) {
+	let log_mask = 0;
+
+	for (let k in [ 'log_mlme', 'log_iapp', 'log_driver', 'log_wpa', 'log_radius', 'log_8021x', 'log_80211' ]) {
+		log_mask <<= 1;
+		log_mask |= config[k] ? 1 : 0;
+	}
+
+	append('logger_syslog', log_mask);
+	append('logger_syslog_level', config.log_level);
+	append('logger_stdout', log_mask);
+	append('logger_stdout_level', config.log_level);
+}
+
+/* setup country code */
+function device_country_code(config) {
+	let status = global.ubus.call('network.wireless', 'status');
+	for (let name, radio in status) {
+		if (!radio.config.country)
+			continue;
+		config.country_code = radio.config.country;
+	}
+
+	if (!exists(config, 'country_code'))
+		return;
+
+	if (config.hw_mode != 'a' || config.band != '5g')
+		delete config.ieee80211h;
+	append_vars(config, [ 'country_code', 'country3', 'ieee80211h' ]);
+	if (config.ieee80211d)
+		append_vars(config, [ 'ieee80211d', 'local_pwr_constraint', 'spectrum_mgmt_required' ]);
+}
+
+
+/* setup cell density */
+function device_cell_density_append(config) {
+	switch (config.hw_mode) {
+	case 'b':
+		if (config.cell_density == 1) {
+			config.supported_rates ??= [ 5500, 11000 ];
+			config.basic_rates ??= [ 5500, 11000 ];
+		} else if (config.cell_density > 2) {
+			config.supported_rates ??= [ 11000 ];
+			config.basic_rates ??= [ 11000 ];
+		}
+		;;
+	case 'g':
+		if (config.cell_density in [ 0, 1 ]) {
+			if (!config.legacy_rates) {
+				config.supported_rates ??= [ 6000, 9000, 12000, 18000, 24000, 36000, 48000, 54000 ];
+				config.basic_rates ??= [ 6000, 12000, 24000 ];
+			} else if (config.cell_density == 1) {
+				config.supported_rates ??= [ 5500, 6000, 9000, 11000, 12000, 18000, 24000, 36000, 48000, 54000 ];
+				config.basic_rates ??= [ 5500, 11000 ];
+			}
+		} else if (config.cell_density == 2 || (config.cell_density > 3 && config.legacy_rates)) {
+			if (!config.legacy_rates) {
+				config.supported_rates ??= [ 12000, 18000, 24000, 36000, 48000, 54000 ];
+				config.basic_rates ??= [ 12000, 24000 ];
+			} else {
+				config.supported_rates ??= [ 11000, 12000, 18000, 24000, 36000, 48000, 54000 ];
+				config.basic_rates ??= [ 11000 ];
+			}
+		} else if (config.cell_density > 2) {
+			 config.supported_rates ??= [ 24000, 36000, 48000, 54000 ];
+			 config.basic_rates ??= [ 24000 ];
+		}
+		;;
+	case 'a':
+		switch (config.cell_density) {
+		case 1:
+			config.supported_rates ??= [ 6000, 9000, 12000, 18000, 24000, 36000, 48000, 54000 ];
+			config.basic_rates ??= [ 6000, 12000, 24000 ];
+			break;
+
+		case 2:
+			config.supported_rates ??= [ 12000, 18000, 24000, 36000, 48000, 54000 ];
+			config.basic_rates ??= [ 12000, 24000 ];
+			break;
+
+		case 3:
+			config.supported_rates ??= [ 24000, 36000, 48000, 54000 ];
+			config.basic_rates ??= [ 24000 ];
+			break;
+		}
+	}
+}
+
+function device_rates(config) {
+	for (let key in [ 'supported_rates', 'basic_rates' ])
+		config[key] = map(config[key], x => x / 100);
+
+	append_vars(config, [ 'beacon_rate', 'supported_rates', 'basic_rates' ]);
+}
+
+function he_bss_color_random() {
+	let f = fs.open("/dev/urandom", "r");
+
+	if (!f)
+		return -1;
+
+	let color = (ord(f.read(1)) % 63) + 1;
+	f.close();
+
+	return color;
+}
+
+function device_htmode_append(config) {
+	config.channel_offset = config.band == '6g' ? 1 : 0;
+
+	/* 802.11n */
+	config.ieee80211n = 0;
+	if (config.band != '6g') {
+		if (config.htmode in [ 'VHT20', 'HT20', 'HE20', 'EHT20' ]) {
+			config.ieee80211n = 1;
+			config.ht_capab = '';
+		}
+		if (config.htmode in [ 'HT40', 'HT40+', 'HT40-', 'VHT40', 'VHT40+', 'VHT40-', 'VHT80', 'VHT160', 'HE40', 'HE40+', 'HE40-', 'HE80', 'HE160', 'EHT40', 'EHT40+', 'EHT40-', 'EHT80', 'EHT160' ]) {
+			config.ieee80211n = 1;
+			if (!config.channel)
+				config.ht_capab = '[HT40+]';
+			else
+				switch (config.hw_mode) {
+				case 'a':
+					switch (((config.channel / 4) + config.channel_offset) % 2) {
+					case 0:
+						config.ht_capab = '[HT40-]';
+						break;
+
+					case 1:
+						config.ht_capab = '[HT40+]';
+						break;
+					}
+					break;
+
+				default:
+					switch (config.htmode) {
+					case 'HT40+':
+					case 'VHT40+':
+					case 'HE40+':
+					case 'EHT40+':
+						config.ht_capab = '[HT40+]';
+						break;
+
+					case 'HT40-':
+					case 'VHT40-':
+					case 'HE40-':
+					case 'EHT40-':
+						config.ht_capab = '[HT40-]';
+						break;
+
+					default:
+						if (config.channel < 7)
+							config.ht_capab = '[HT40+]';
+						else
+							config.ht_capab = '[HT40-]';
+						break;
+					}
+				}
+		}
+
+		if (config.ieee80211n) {
+			let ht_capab = phy_capabilities.ht_capa;
+
+			if (ht_capab & 0x1 && config.ldpc)
+				config.ht_capab += '[LDPC]';
+			if (ht_capab & 0x10 && config.greenfield)
+				config.ht_capab += '[GF]';
+			if (ht_capab & 0x20 && config.short_gi_20)
+				config.ht_capab += '[SHORT-GI-20]';
+			if (ht_capab & 0x40 && config.short_gi_40)
+				config.ht_capab += '[SHORT-GI-40]';
+			if (ht_capab & 0x80 && config.tx_stbc)
+				config.ht_capab += '[TX-STBC]';
+			if (ht_capab & 0x800 && config.max_amsdu)
+				config.ht_capab += '[MAX-AMSDU-7935]';
+			if (ht_capab & 0x1000 && config.dsss_cck_40)
+				config.ht_capab += '[DSSS_CCK-40]';
+			let rx_stbc = [ '', '[RX-STBC1]', '[RX-STBC12]', '[RX-STBC123]' ];
+			config.ht_capab += rx_stbc[min(config.rx_stbc, (ht_capab >> 8) & 3)];
+
+			append_vars(config, [ 'ieee80211n', 'ht_coex', 'ht_capab' ]);
+		}
+	}
+
+	/* 802.11ac */
+	config.ieee80211ac = 1;
+	config.vht_oper_centr_freq_seg0_idx = 0;
+	config.vht_oper_chwidth = 0;
+
+	switch (config.htmode) {
+	case 'VHT20':
+	case 'HE20':
+	case 'EHT20':
+		break;
+
+	case 'VHT40':
+	case 'HE40':
+	case 'EHT40':
+		config.vht_oper_centr_freq_seg0_idx = config.channel + (((config.channel / 4) + config.channel_offset) % 2 ? 2 : -2);
+		break;
+
+	case 'VHT80':
+	case 'HE80':
+	case 'EHT80':
+		let delta = [ -6, 6, 2, -2 ];
+		config.vht_oper_centr_freq_seg0_idx = config.channel + delta[((config.channel / 4) + config.channel_offset) % 4];
+		config.vht_oper_chwidth = 1;
+		break;
+
+	case 'VHT160':
+	case 'HE160':
+	case 'EHT160':
+		let vht_oper_centr_freq_seg0_idx_map = [[ 64, 50 ], [ 128, 114 ], [ 177, 163 ]];
+		if (config.band == '6g')
+			vht_oper_centr_freq_seg0_idx_map = [
+				[ 29, 15 ], [ 61, 47 ], [ 93, 79 ], [ 125, 111 ],
+				[ 157, 143 ], [ 189, 175 ], [ 221, 207 ]];
+		for (let k, v in vht_oper_centr_freq_seg0_idx_map)
+			if (config.channel >= (v[0] - 28) && config.channel <= v[0]) {
+				config.vht_oper_centr_freq_seg0_idx = v[1];
+				break;
+			}
+		config.vht_oper_chwidth = 2;
+		break;
+
+	default:
+		config.ieee80211ac = 0;
+		break;
+	}
+
+	config.eht_oper_chwidth = config.vht_oper_chwidth;
+	config.eht_oper_centr_freq_seg0_idx = config.vht_oper_centr_freq_seg0_idx;
+
+	if (config.band == '6g') {
+		config.ieee80211ac = 0;
+
+		switch(config.htmode) {
+		case 'HE20':
+		case 'EHT20':
+			config.op_class = 131;
+			break;
+
+		case 'EHT320':
+		case 'EHT320-1':
+		case 'EHT320-2':
+			let eht_center_seg0_map = [
+				[ 61, 31 ], [ 125, 95 ], [ 189, 159 ]
+			];
+
+			if (config.htmode == 'EHT320-2' || (config.htmode == 'EHT320' && config.channel > 189)) {
+				eht_center_seg0_map = [
+					[ 93, 63 ], [ 157, 127 ], [ 221, 191 ]
+				];
+			}
+
+			for (let k, v in eht_center_seg0_map)
+				if (config.channel <= v[0]) {
+					config.eht_oper_centr_freq_seg0_idx = v[1];
+					break;
+				}
+			config.op_class = 137;
+			config.eht_oper_chwidth = 9;
+
+			switch(config.htmode) {
+				case 'EHT320':
+					config.eht_bw320_offset = 0;
+					break;
+
+				case 'EHT320-1':
+					config.eht_bw320_offset = 1;
+					break;
+
+				case 'EHT320-2':
+					config.eht_bw320_offset = 1;
+					break;
+
+			}
+			break;
+
+		case 'HE40':
+		case 'HE80':
+		case 'HE160':
+		case 'EHT40':
+		case 'EHT80':
+		case 'EHT160':
+			config.op_class = 132 + config.eht_oper_chwidth;
+			break;
+		}
+
+		append_vars(config, [ 'op_class' ]);
+	}
+
+	if (config.ieee80211ac && config.hw_mode == 'a') {
+		/* VHT capab */
+		if (config.vht_oper_chwidth < 2) {
+			config.vht160 = 0;
+			config.short_gi_160 = 0;
+		}
+
+		let vht_capab = phy_capabilities.vht_capa;
+
+		if (!config.etxbfen) {
+			config.su_beamformer = false;
+			config.su_beamformee = false;
+			config.mu_beamformer = false;
+			config.mu_beamformee = false;
+		}
+		
+		config.vht_capab = '';
+		if (vht_capab & 0x10 && config.rxldpc)
+			config.vht_capab += '[RXLDPC]';
+		if (vht_capab & 0x20 && config.short_gi_80)
+			config.vht_capab += '[SHORT-GI-80]';
+		if (vht_capab & 0x40 && config.short_gi_160)
+			config.vht_capab += '[SHORT-GI-160]';
+		if (vht_capab & 0x80 && config.tx_stbc_2by1)
+			config.vht_capab += '[TX-STBC-2BY1]';
+		if (vht_capab & 0x800 && config.su_beamformer)
+			config.vht_capab += '[SU-BEAMFORMER]';
+		if (vht_capab & 0x1000 && config.su_beamformee)
+			config.vht_capab += '[SU-BEAMFORMEE]';
+		if (vht_capab & 0x80000 && config.mu_beamformer)
+			config.vht_capab += '[MU-BEAMFORMER]';
+		if (vht_capab & 0x100000 && config.mu_beamformee)
+			config.vht_capab += '[MU-BEAMFORMEE]';
+		if (vht_capab & 0x200000 && config.vht_txop_ps)
+			config.vht_capab += '[VHT-TXOP-PS]';
+		if (vht_capab & 0x400000 && config.htc_vht)
+			config.vht_capab += '[HTC-VHT]';
+		if (vht_capab & 0x10000000 && config.rx_antenna_pattern)
+			config.vht_capab += '[RX-ANTENNA-PATTERN]';
+		if (vht_capab & 0x20000000 && config.tx_antenna_pattern)
+			config.vht_capab += '[TX-ANTENNA-PATTERN]';
+		let rx_stbc = [ '', '[RX-STBC-1]', '[RX-STBC-12]', '[RX-STBC-123]', '[RX-STBC-1234]' ];
+		config.vht_capab += rx_stbc[min(config.rx_stbc, (vht_capab >> 8) & 7)];
+
+		if (vht_capab & 0x800 && config.su_beamformer)
+			config.vht_capab += '[SOUNDING-DIMENSION-' + min(((vht_capab >> 16) & 3) + 1, config.beamformer_antennas) + ']';
+		if (vht_capab & 0x1000 && config.su_beamformee)
+			config.vht_capab += '[BF-ANTENNA-' + min(((vht_capab >> 13) & 3) + 1, config.beamformer_antennas) + ']';
+
+		/* supported Channel widths */
+		if ((vht_capab & 0xc) == 8 && config.vht160 <= 2)
+			config.vht_capab += '[VHT160-80PLUS80]';
+		else if ((vht_capab & 0xc) == 4 && config.vht160 <= 2)
+			config.vht_capab += '[VHT160]';
+
+		/* maximum MPDU length */
+		if ((vht_capab & 3) > 1 && config.vht_max_mpdu >= 11454)
+			config.vht_capab += '[MAX-MPDU-11454]';
+		else if ((vht_capab & 3) && config.vht_max_mpdu >= 7991)
+			config.vht_capab += '[MAX-MPDU-7991]';
+
+		/* maximum A-MPDU length exponent */
+		let max_a_mpdu_len_exp = (vht_capab >> 20) & 0x38;
+		for (let exp = 7; exp; exp--)
+			if (max_a_mpdu_len_exp >= (0x8 * exp) && exp <= config.vht_max_a_mpdu_len_exp) {
+				config.vht_capab += '[MAX-A-MPDU-LEN-EXP' + exp + ']';
+				break;
+			}
+
+		/* whether or not the STA supports link adaptation using VHT variant */
+		let vht_link_adapt = vht_capab & 0xC000000;
+		if (vht_link_adapt >= 0xC000000 && config.vht_link_adapt > 3)
+			config.vht_capab += '[VHT-LINK-ADAPT-3]';
+		if (vht_link_adapt >= 0x8000000 && config.vht_link_adapt > 2)
+			config.vht_capab += '[VHT-LINK-ADAPT-2]';
+
+		append_vars(config, [
+			'ieee80211ac', 'vht_oper_chwidth', 'vht_oper_centr_freq_seg0_idx',
+			'vht_capab'
+		]);
+	}
+
+	/* 802.11ax */
+	if (wildcard(config.htmode, 'HE*') || wildcard(config.htmode, 'EHT*')) {
+		let he_phy_cap = phy_capabilities.he_phy_cap;
+		let he_mac_cap = phy_capabilities.he_mac_cap;
+
+		config.ieee80211ax = true;
+
+		if (config.hw_mode == 'a') {
+			config.he_oper_chwidth = config.vht_oper_chwidth;
+			config.he_oper_centr_freq_seg0_idx = config.vht_oper_centr_freq_seg0_idx;
+		}
+
+		if (config.band == "6g") {
+			config.stationary_ap = true;
+			append_vars(config, [ 'he_6ghz_reg_pwr_type', ]);
+		}
+
+		if (config.he_bss_color_enabled) {
+			if (config.he_spr_non_srg_obss_pd_max_offset)
+				config.he_spr_sr_control |= 1 << 2;
+			if (!config.he_spr_psr_enabled)
+				config.he_spr_sr_control |= 1;
+			if (!config.he_bss_color)
+				config.he_bss_color = he_bss_color_random();
+
+			if (config.he_bss_coolor == -1)
+				delete config.he_bss_color;
+
+			append_vars(config, [ 'he_bss_color', 'he_spr_non_srg_obss_pd_max_offset', 'he_spr_sr_control' ]);
+		}
+
+		if (!(he_phy_cap[3] & 0x80))
+			config.he_su_beamformer = false;
+		if (!(he_phy_cap[4] & 0x1))
+			config.he_su_beamformee = false;
+		if (!(he_phy_cap[4] & 0x2))
+			config.he_mu_beamformer = false;
+		if (!(he_phy_cap[7] & 0x1))
+			config.he_spr_psr_enabled = false;
+		if (!(he_mac_cap[0] & 0x1))
+			config.he_twt_required= false;
+
+		if (!config.etxbfen) {
+			config.he_su_beamformer = false;
+			config.he_su_beamformee = false;
+			config.he_mu_beamformer = false;
+		}
+
+		append_vars(config, [
+			'ieee80211ax', 'he_oper_chwidth', 'he_oper_centr_freq_seg0_idx',
+			'he_su_beamformer', 'he_su_beamformee', 'he_mu_beamformer', 'he_twt_required',
+			'he_default_pe_duration', 'he_rts_threshold', 'he_mu_edca_qos_info_param_count',
+			'he_mu_edca_qos_info_q_ack', 'he_mu_edca_qos_info_queue_request', 'he_mu_edca_qos_info_txop_request',
+			'he_mu_edca_ac_be_aifsn', 'he_mu_edca_ac_be_aci', 'he_mu_edca_ac_be_ecwmin',
+			'he_mu_edca_ac_be_ecwmax', 'he_mu_edca_ac_be_timer', 'he_mu_edca_ac_bk_aifsn',
+			'he_mu_edca_ac_bk_aci', 'he_mu_edca_ac_bk_ecwmin', 'he_mu_edca_ac_bk_ecwmax',
+			'he_mu_edca_ac_bk_timer', 'he_mu_edca_ac_vi_ecwmin', 'he_mu_edca_ac_vi_ecwmax',
+			'he_mu_edca_ac_vi_aifsn', 'he_mu_edca_ac_vi_aci', 'he_mu_edca_ac_vi_timer',
+			'he_mu_edca_ac_vo_aifsn', 'he_mu_edca_ac_vo_aci', 'he_mu_edca_ac_vo_ecwmin',
+			'he_mu_edca_ac_vo_ecwmax', 'he_mu_edca_ac_vo_timer',
+		]);
+	}
+
+	if (wildcard(config.htmode, 'EHT*')) {
+		config.ieee80211be = true;
+		append_vars(config, [ 'ieee80211be' ]);
+
+		if (!config.etxbfen) {
+			config.eht_su_beamformer = false;
+			config.eht_su_beamformee = false;
+			config.eht_mu_beamformer = false;
+		}
+
+		append_vars(config, [ 'eht_su_beamformer', 'eht_su_beamformee', 'eht_mu_beamformer' ]);
+		if (config.hw_mode == 'a')
+			append_vars(config, [ 'eht_oper_chwidth', 'eht_oper_centr_freq_seg0_idx' ]);
+
+		if (config.band == "6g") {
+			config.stationary_ap = true;
+			append_vars(config, [ 'he_6ghz_reg_pwr_type', 'eht_bw320_offset']);
+		}
+	}
+
+	append_vars(config, [ 'tx_queue_data2_burst', 'stationary_ap' ]);
+}
+
+function device_extended_features(data, flag) {
+	return !!(data[flag / 8] | (1 << (flag % 8)));
+}
+
+function device_capabilities(config) {
+	let phy = config.phy;
+
+	phy = wiphy_info(phy);
+	let band = wiphy_band(phy, config.band);
+
+	phy_capabilities.ht_capa = band.ht_capa ?? 0;
+	phy_capabilities.vht_capa = band.vht_capa ?? 0;
+	for (let iftype in band.iftype_data) {
+		if (!iftype.iftypes.ap)
+			continue;
+		phy_capabilities.he_mac_cap = iftype.he_cap_mac;
+		phy_capabilities.he_phy_cap = iftype.he_cap_phy;
+	}
+
+	phy_features.ftm_responder = device_extended_features(phy.extended_features, NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER);
+	phy_features.radar_background = device_extended_features(phy.extended_features, NL80211_EXT_FEATURE_RADAR_BACKGROUND);
+}
+
+function device_mtk_options(config) {
+	append_vars(config, [ 'pp_mode', 'mu_onoff',
+			      'background_cert_mode', 'he_twt_responder', 'lpi_psd',
+			      'lpi_bcn_enhance', 'sku_idx', 'lpi_sku_idx' ]);
+
+	append('ibf_enable', config.itxbfen);
+
+	if (config.pp_mode == 2)
+		append('punct_bitmap', config.pp_bitmap);
+
+	if (config.ht_coex)
+		append_vars(config, [ 'obss_interval' ]);
+}
+
+function generate(config) {
+	if (!config)
+		die(`${config.path} is an unknown phy`);
+
+	device_capabilities(config);
+
+	append('driver', 'nl80211');
+
+	set_device_defaults(config);
+
+	device_log_append(config);
+
+	device_country_code(config);
+
+	device_cell_density_append(config);
+
+	device_rates(config);
+
+	/* beacon */
+	append_vars(config, [ 'beacon_int', 'beacon_rate', 'rnr_beacon' ]);
+
+	/* wpa_supplicant co-exist */
+	append_vars(config, [ 'noscan' ]);
+
+	/* airtime */
+	if (config.airtime_mode)
+		append_vars(config, [ 'airtime_mode' ]);
+
+	/* assoc/thresholds */
+	append_vars(config, [ 'rssi_reject_assoc_rssi', 'rssi_reject_assoc_timeout', 'rssi_ignore_probe_request', 'iface_max_num_sta', 'no_probe_resp_if_max_sta' ]);
+
+	/* ACS / Radar*/
+	if (!phy_features.radar_background || config.band != '5g')
+		delete config.enable_background_radar;
+	else
+		set_default(config, 'enable_background_radar', false);
+
+	append_vars(config, [ 'acs_chan_bias', 'acs_exclude_dfs', 'enable_background_radar' ]);
+
+	/* TX Power */
+	append_vars(config, [ 'min_tx_power' ]);
+
+	/* hwmode, channel, op_class, ... */
+	append_vars(config, [ 'hw_mode', 'channel', 'rts_threshold', 'chanlist' ]);
+	if (config.hw_mode in [ 'a', 'g' ] && config.require_mode in [ 'n', 'ac', 'ax' ]) {
+		let require_mode = { n: 'require_ht', ac: 'require_vht', ax: 'require_he' };
+
+		config.legacy_rates = false;
+		append(require_mode[config.require_mode], 1);
+	}
+	device_htmode_append(config);
+
+	if (config.ieee80211ax || config.ieee80211be)
+		append_vars(config, [ 'mbssid' ]);
+
+	/* 6G power mode */
+	if (config.band != '6g')
+		append_vars(config, [ 'reg_power_type' ]);
+
+	/* raw options */
+	for (let raw in config.hostapd_options)
+		append_raw(raw);
+
+	/* MTK internal options */
+	device_mtk_options(config);
+}
+
+let iface_idx = 0;
+function setup_interface(interface, data, config, vlans, stas, phy_features, fixup) {
+	config = { ...config, fixup };
+
+	config.idx = iface_idx++;
+	ap.generate(interface, data, config, vlans, stas, phy_features);
+}
+
+export function setup(data) {
+	let file_name = `/var/run/hostapd-${data.phy}${data.vif_phy_suffix}.conf`;
+
+	flush_config();
+
+	if (fs.stat(file_name))
+		fs.rename(file_name, file_name + '.prev');
+
+	data.config.phy = data.phy;
+
+	generate(data.config);
+
+	if (data.config.num_global_macaddr)
+		append('\n#num_global_macaddr', data.config.num_global_macaddr);
+	if (data.config.macaddr_base)
+		append('\n#macaddr_base', data.config.macaddr_base);
+
+	let has_ap;
+	for (let k, interface in data.interfaces) {
+		if (interface.config.mode != 'ap')
+			continue;
+
+		interface.config.network_bridge = interface.bridge;
+		interface.config.network_ifname = interface['bridge-ifname'];
+
+		let owe = interface.config.encryption == 'owe' && interface.config.owe_transition;
+
+		setup_interface(k, data, interface.config, interface.vlans, interface.stas, phy_features, owe ? 'owe' : null );
+		if (owe)
+			setup_interface(k, data, interface.config, interface.vlans, interface.stas, phy_features, 'owe-transition');
+		has_ap = true;
+	}
+
+	let config = dump_config(file_name);
+
+	let msg = {
+		phy: data.phy,
+		radio: data.config.radio,
+		config: has_ap ? file_name : "",
+		prev_config: file_name + '.prev'
+	};
+	if (!global.ubus.list('hostapd'))
+		system('ubus wait_for hostapd');
+	let ret = global.ubus.call('hostapd', 'config_set', msg);
+
+	if (ret)
+		netifd.add_process('/usr/sbin/hostapd', ret.pid, true, true);
+	else
+		netifd.setup_failed('HOSTAPD_START_FAILED');
+};
diff --git a/wireless-scripts-example/old/mac80211-default-tuned.sh b/wireless-scripts-example/old/mac80211-default-tuned.sh
new file mode 100755
index 0000000000..384d1f58a1
--- /dev/null
+++ b/wireless-scripts-example/old/mac80211-default-tuned.sh
@@ -0,0 +1,1323 @@
+#!/bin/sh
+. /lib/netifd/netifd-wireless.sh
+. /lib/netifd/hostapd.sh
+. /lib/functions/system.sh
+
+init_wireless_driver "$@"
+
+MP_CONFIG_INT="mesh_retry_timeout mesh_confirm_timeout mesh_holding_timeout mesh_max_peer_links
+	       mesh_max_retries mesh_ttl mesh_element_ttl mesh_hwmp_max_preq_retries
+	       mesh_path_refresh_time mesh_min_discovery_timeout mesh_hwmp_active_path_timeout
+	       mesh_hwmp_preq_min_interval mesh_hwmp_net_diameter_traversal_time mesh_hwmp_rootmode
+	       mesh_hwmp_rann_interval mesh_gate_announcements mesh_sync_offset_max_neighor
+	       mesh_rssi_threshold mesh_hwmp_active_path_to_root_timeout mesh_hwmp_root_interval
+	       mesh_hwmp_confirmation_interval mesh_awake_window mesh_plink_timeout"
+MP_CONFIG_BOOL="mesh_auto_open_plinks mesh_fwding"
+MP_CONFIG_STRING="mesh_power_mode"
+
+wdev_tool() {
+	ucode /usr/share/hostap/wdev.uc "$@"
+}
+
+ubus_call() {
+	flock /var/run/hostapd.lock ubus call "$@"
+}
+
+drv_mac80211_init_device_config() {
+	hostapd_common_add_device_config
+
+	config_add_string path phy 'macaddr:macaddr'
+	config_add_string tx_burst
+	config_add_string distance
+	config_add_string ifname_prefix
+	config_add_string macaddr_base
+	config_add_int radio beacon_int chanbw frag rts
+	config_add_int rxantenna txantenna txpower min_tx_power
+	config_add_int num_global_macaddr multiple_bssid
+	config_add_boolean noscan ht_coex acs_exclude_dfs background_radar
+	config_add_array ht_capab
+	config_add_array channels
+	config_add_array scan_list
+	config_add_boolean \
+		rxldpc \
+		short_gi_80 \
+		short_gi_160 \
+		tx_stbc_2by1 \
+		su_beamformer \
+		su_beamformee \
+		mu_beamformer \
+		mu_beamformee \
+		he_su_beamformer \
+		he_su_beamformee \
+		he_mu_beamformer \
+		vht_txop_ps \
+		htc_vht \
+		rx_antenna_pattern \
+		tx_antenna_pattern \
+		he_spr_sr_control \
+		he_spr_psr_enabled \
+		he_bss_color_enabled \
+		he_twt_required \
+		he_twt_responder \
+		etxbfen \
+		itxbfen \
+		lpi_psd \
+		lpi_bcn_enhance
+	config_add_int \
+		beamformer_antennas \
+		beamformee_antennas \
+		vht_max_a_mpdu_len_exp \
+		vht_max_mpdu \
+		vht_link_adapt \
+		vht160 \
+		rx_stbc \
+		tx_stbc \
+		he_bss_color \
+		he_spr_non_srg_obss_pd_max_offset \
+		pp_bitmap \
+		pp_mode \
+		eml_disable \
+		eml_resp \
+		sku_idx \
+		lpi_sku_idx
+	config_add_boolean \
+		ldpc \
+		greenfield \
+		short_gi_20 \
+		short_gi_40 \
+		max_amsdu \
+		dsss_cck_40
+}
+
+drv_mac80211_init_iface_config() {
+	hostapd_common_add_bss_config
+
+	config_add_string 'macaddr:macaddr' ifname
+
+	config_add_boolean wds powersave enable
+	config_add_string wds_bridge
+	config_add_int maxassoc
+	config_add_int max_listen_int
+	config_add_int dtim_period
+	config_add_int start_disabled
+
+	# mesh
+	config_add_string mesh_id
+	config_add_int $MP_CONFIG_INT
+	config_add_boolean $MP_CONFIG_BOOL
+	config_add_string $MP_CONFIG_STRING
+}
+
+mac80211_add_capabilities() {
+	local __var="$1"; shift
+	local __mask="$1"; shift
+	local __out= oifs
+
+	oifs="$IFS"
+	IFS=:
+	for capab in "$@"; do
+		set -- $capab
+
+		[ "$(($4))" -gt 0 ] || continue
+		[ "$(($__mask & $2))" -eq "$((${3:-$2}))" ] || continue
+		__out="$__out[$1]"
+	done
+	IFS="$oifs"
+
+	export -n -- "$__var=$__out"
+}
+
+mac80211_add_he_capabilities() {
+	local __out= oifs
+
+	oifs="$IFS"
+	IFS=:
+	for capab in "$@"; do
+		set -- $capab
+		[ "$(($4))" -gt 0 ] || continue
+		[ "$(((0x$2) & $3))" -gt 0 ] || {
+			eval "$1=0"
+			continue
+		}
+		append base_cfg "$1=1" "$N"
+	done
+	IFS="$oifs"
+}
+
+mac80211_hostapd_setup_base() {
+	local phy="$1"
+
+	json_select config
+
+	[ "$auto_channel" -gt 0 ] && channel=acs_survey
+
+	[ "$auto_channel" -gt 0 ] && json_get_vars acs_exclude_dfs
+	[ -n "$acs_exclude_dfs" ] && [ "$acs_exclude_dfs" -gt 0 ] &&
+		append base_cfg "acs_exclude_dfs=1" "$N"
+
+	json_get_vars noscan ht_coex min_tx_power:0 tx_burst
+	json_get_vars etxbfen:1 itxbfen:0 eml_disable eml_resp lpi_psd sku_idx lpi_sku_idx lpi_bcn_enhance
+	json_get_values ht_capab_list ht_capab
+	json_get_values channel_list channels
+
+	[ "$auto_channel" = 0 ] && [ -z "$channel_list" ] && \
+		channel_list="$channel"
+
+	[ "$min_tx_power" -gt 0 ] && append base_cfg "min_tx_power=$min_tx_power" "$N"
+
+	set_default noscan 0
+
+	[ "$noscan" -gt 0 ] && hostapd_noscan=1
+	[ "$tx_burst" = 0 ] && tx_burst=
+
+	chan_ofs=0
+	[ "$band" = "6g" ] && chan_ofs=1
+
+	if [ "$band" != "6g" ]; then
+		ieee80211n=1
+		ht_capab=
+		case "$htmode" in
+			VHT20|HT20|HE20|EHT20) ;;
+			HT40*|VHT40|VHT80|VHT160|HE40|HE80|HE160|EHT40|EHT80|EHT160)
+				case "$hwmode" in
+					a)
+						case "$(( (($channel / 4) + $chan_ofs) % 2 ))" in
+							1) ht_capab="[HT40+]";;
+							0) ht_capab="[HT40-]";;
+						esac
+					;;
+					*)
+						case "$htmode" in
+							HT40+) ht_capab="[HT40+]";;
+							HT40-) ht_capab="[HT40-]";;
+							*)
+								if [ "$channel" -lt 7 ]; then
+									ht_capab="[HT40+]"
+								else
+									ht_capab="[HT40-]"
+								fi
+							;;
+						esac
+					;;
+				esac
+				[ "$auto_channel" -gt 0 ] && ht_capab="[HT40+]"
+			;;
+			*) ieee80211n= ;;
+		esac
+
+		[ -n "$ieee80211n" ] && {
+			append base_cfg "ieee80211n=1" "$N"
+
+			set_default ht_coex 0
+			append base_cfg "ht_coex=$ht_coex" "$N"
+
+			json_get_vars \
+				ldpc:1 \
+				greenfield:0 \
+				short_gi_20:1 \
+				short_gi_40:1 \
+				tx_stbc:1 \
+				rx_stbc:3 \
+				max_amsdu:1 \
+				dsss_cck_40:1
+
+			ht_cap_mask=0
+			for cap in $(iw phy "$phy" info | grep -E '^\s*Capabilities:' | cut -d: -f2); do
+				ht_cap_mask="$(($ht_cap_mask | $cap))"
+			done
+
+			cap_rx_stbc=$((($ht_cap_mask >> 8) & 3))
+			[ "$rx_stbc" -lt "$cap_rx_stbc" ] && cap_rx_stbc="$rx_stbc"
+			ht_cap_mask="$(( ($ht_cap_mask & ~(0x300)) | ($cap_rx_stbc << 8) ))"
+
+			mac80211_add_capabilities ht_capab_flags $ht_cap_mask \
+				LDPC:0x1::$ldpc \
+				GF:0x10::$greenfield \
+				SHORT-GI-20:0x20::$short_gi_20 \
+				SHORT-GI-40:0x40::$short_gi_40 \
+				TX-STBC:0x80::$tx_stbc \
+				RX-STBC1:0x300:0x100:1 \
+				RX-STBC12:0x300:0x200:1 \
+				RX-STBC123:0x300:0x300:1 \
+				MAX-AMSDU-7935:0x800::$max_amsdu \
+				DSSS_CCK-40:0x1000::$dsss_cck_40
+
+			ht_capab="$ht_capab$ht_capab_flags"
+			[ -n "$ht_capab" ] && append base_cfg "ht_capab=$ht_capab" "$N"
+		}
+	fi
+
+	# 802.11ac
+	enable_ac=0
+	vht_oper_chwidth=0
+	vht_center_seg0=
+
+	idx="$channel"
+	case "$htmode" in
+		VHT20|HE20|EHT20) enable_ac=1;;
+		VHT40|HE40|EHT40)
+			case "$(( (($channel / 4) + $chan_ofs) % 2 ))" in
+				1) idx=$(($channel + 2));;
+				0) idx=$(($channel - 2));;
+			esac
+			enable_ac=1
+			vht_center_seg0=$idx
+		;;
+		VHT80|HE80|EHT80)
+			case "$(( (($channel / 4) + $chan_ofs) % 4 ))" in
+				1) idx=$(($channel + 6));;
+				2) idx=$(($channel + 2));;
+				3) idx=$(($channel - 2));;
+				0) idx=$(($channel - 6));;
+			esac
+			enable_ac=1
+			vht_oper_chwidth=1
+			vht_center_seg0=$idx
+		;;
+		VHT160|HE160|EHT160|EHT320)
+			if [ "$band" = "6g" ]; then
+				case "$channel" in
+					1|5|9|13|17|21|25|29) idx=15;;
+					33|37|41|45|49|53|57|61) idx=47;;
+					65|69|73|77|81|85|89|93) idx=79;;
+					97|101|105|109|113|117|121|125) idx=111;;
+					129|133|137|141|145|149|153|157) idx=143;;
+					161|165|169|173|177|181|185|189) idx=175;;
+					193|197|201|205|209|213|217|221) idx=207;;
+				esac
+			else
+				case "$channel" in
+					36|40|44|48|52|56|60|64) idx=50;;
+					100|104|108|112|116|120|124|128) idx=114;;
+					149|153|157|161|165|169|173|177) idx=163;;
+				esac
+			fi
+			enable_ac=1
+			vht_oper_chwidth=2
+			vht_center_seg0=$idx
+		;;
+	esac
+	[ "$band" = "5g" ] && {
+		json_get_vars background_radar:0
+
+		[ "$background_radar" -eq 1 ] && append base_cfg "enable_background_radar=1" "$N"
+	}
+
+	eht_oper_chwidth=$vht_oper_chwidth
+	eht_center_seg0=$vht_center_seg0
+
+	[ "$band" = "6g" ] && {
+		op_class=
+		case "$htmode" in
+			HE20|EHT20) op_class=131;;
+			EHT320)
+				case "$channel" in
+					1|5|9|13|17|21|25|29|33|37|41|45|49|53|57|61) idx=31;;
+					65|69|73|77|81|85|89|93|97|101|105|109|113|117|121|125) idx=95;;
+					129|133|137|141|145|149|153|157|161|165|169|173|177|181|185|189) idx=159;;
+					193|197|201|205|209|213|217|221) idx=191;;
+				esac
+
+				op_class=137
+				eht_center_seg0=$idx
+				eht_oper_chwidth=9
+			;;
+			HE*|EHT*) op_class=$((132 + $vht_oper_chwidth));;
+		esac
+		[ -n "$op_class" ] && append base_cfg "op_class=$op_class" "$N"
+	}
+	[ "$hwmode" = "a" ] || enable_ac=0
+	[ "$band" = "6g" ] && enable_ac=0
+
+	if [ "$enable_ac" != "0" ]; then
+		json_get_vars \
+			rxldpc:1 \
+			short_gi_80:1 \
+			short_gi_160:1 \
+			tx_stbc_2by1:1 \
+			su_beamformer:1 \
+			su_beamformee:1 \
+			mu_beamformer:1 \
+			mu_beamformee:1 \
+			vht_txop_ps:1 \
+			htc_vht:1 \
+			beamformee_antennas:4 \
+			beamformer_antennas:4 \
+			rx_antenna_pattern:1 \
+			tx_antenna_pattern:1 \
+			vht_max_a_mpdu_len_exp:7 \
+			vht_max_mpdu:11454 \
+			rx_stbc:4 \
+			vht_link_adapt:3 \
+			vht160:2
+
+		set_default tx_burst 2.0
+		append base_cfg "ieee80211ac=1" "$N"
+		vht_cap=0
+		for cap in $(iw phy "$phy" info | awk -F "[()]" '/VHT Capabilities/ { print $2 }'); do
+			vht_cap="$(($vht_cap | $cap))"
+		done
+
+		append base_cfg "vht_oper_chwidth=$vht_oper_chwidth" "$N"
+		append base_cfg "vht_oper_centr_freq_seg0_idx=$vht_center_seg0" "$N"
+
+		cap_rx_stbc=$((($vht_cap >> 8) & 7))
+		[ "$rx_stbc" -lt "$cap_rx_stbc" ] && cap_rx_stbc="$rx_stbc"
+		vht_cap="$(( ($vht_cap & ~(0x700)) | ($cap_rx_stbc << 8) ))"
+
+		[ "$vht_oper_chwidth" -lt 2 ] && {
+			short_gi_160=0
+		}
+
+		[ "$etxbfen" -eq 0 ] && {
+			su_beamformer=0
+			su_beamformee=0
+			mu_beamformer=0
+		}
+		mac80211_add_capabilities vht_capab $vht_cap \
+			RXLDPC:0x10::$rxldpc \
+			SHORT-GI-80:0x20::$short_gi_80 \
+			SHORT-GI-160:0x40::$short_gi_160 \
+			TX-STBC-2BY1:0x80::$tx_stbc_2by1 \
+			SU-BEAMFORMER:0x800::$su_beamformer \
+			SU-BEAMFORMEE:0x1000::$su_beamformee \
+			MU-BEAMFORMER:0x80000::$mu_beamformer \
+			MU-BEAMFORMEE:0x100000::$mu_beamformee \
+			VHT-TXOP-PS:0x200000::$vht_txop_ps \
+			HTC-VHT:0x400000::$htc_vht \
+			RX-ANTENNA-PATTERN:0x10000000::$rx_antenna_pattern \
+			TX-ANTENNA-PATTERN:0x20000000::$tx_antenna_pattern \
+			RX-STBC-1:0x700:0x100:1 \
+			RX-STBC-12:0x700:0x200:1 \
+			RX-STBC-123:0x700:0x300:1 \
+			RX-STBC-1234:0x700:0x400:1 \
+
+		[ "$(($vht_cap & 0x800))" -gt 0 -a "$su_beamformer" -gt 0 ] && {
+			cap_ant="$(( ( ($vht_cap >> 16) & 3 ) + 1 ))"
+			[ "$cap_ant" -gt "$beamformer_antennas" ] && cap_ant="$beamformer_antennas"
+			[ "$cap_ant" -gt 1 ] && vht_capab="$vht_capab[SOUNDING-DIMENSION-$cap_ant]"
+		}
+
+		[ "$(($vht_cap & 0x1000))" -gt 0 -a "$su_beamformee" -gt 0 ] && {
+			cap_ant="$(( ( ($vht_cap >> 13) & 3 ) + 1 ))"
+			[ "$cap_ant" -gt "$beamformee_antennas" ] && cap_ant="$beamformee_antennas"
+			[ "$cap_ant" -gt 1 ] && vht_capab="$vht_capab[BF-ANTENNA-$cap_ant]"
+		}
+
+		# supported Channel widths
+		vht160_hw=0
+		[ "$(($vht_cap & 12))" -eq 4 -a 1 -le "$vht160" ] && \
+			vht160_hw=1
+		[ "$(($vht_cap & 12))" -eq 8 -a 2 -le "$vht160" ] && \
+			vht160_hw=2
+		[ "$vht160_hw" = 1 ] && vht_capab="$vht_capab[VHT160]"
+		[ "$vht160_hw" = 2 ] && vht_capab="$vht_capab[VHT160-80PLUS80]"
+
+		# maximum MPDU length
+		vht_max_mpdu_hw=3895
+		[ "$(($vht_cap & 3))" -ge 1 -a 7991 -le "$vht_max_mpdu" ] && \
+			vht_max_mpdu_hw=7991
+		[ "$(($vht_cap & 3))" -ge 2 -a 11454 -le "$vht_max_mpdu" ] && \
+			vht_max_mpdu_hw=11454
+		[ "$vht_max_mpdu_hw" != 3895 ] && \
+			vht_capab="$vht_capab[MAX-MPDU-$vht_max_mpdu_hw]"
+
+		# maximum A-MPDU length exponent
+		vht_max_a_mpdu_len_exp_hw=0
+		[ "$(($vht_cap & 58720256))" -ge 8388608 -a 1 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=1
+		[ "$(($vht_cap & 58720256))" -ge 16777216 -a 2 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=2
+		[ "$(($vht_cap & 58720256))" -ge 25165824 -a 3 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=3
+		[ "$(($vht_cap & 58720256))" -ge 33554432 -a 4 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=4
+		[ "$(($vht_cap & 58720256))" -ge 41943040 -a 5 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=5
+		[ "$(($vht_cap & 58720256))" -ge 50331648 -a 6 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=6
+		[ "$(($vht_cap & 58720256))" -ge 58720256 -a 7 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=7
+		vht_capab="$vht_capab[MAX-A-MPDU-LEN-EXP$vht_max_a_mpdu_len_exp_hw]"
+
+		# whether or not the STA supports link adaptation using VHT variant
+		vht_link_adapt_hw=0
+		[ "$(($vht_cap & 201326592))" -ge 134217728 -a 2 -le "$vht_link_adapt" ] && \
+			vht_link_adapt_hw=2
+		[ "$(($vht_cap & 201326592))" -ge 201326592 -a 3 -le "$vht_link_adapt" ] && \
+			vht_link_adapt_hw=3
+		[ "$vht_link_adapt_hw" != 0 ] && \
+			vht_capab="$vht_capab[VHT-LINK-ADAPT-$vht_link_adapt_hw]"
+
+		[ -n "$vht_capab" ] && append base_cfg "vht_capab=$vht_capab" "$N"
+	fi
+
+	# 802.11ax
+	enable_ax=0
+	enable_be=0
+	case "$htmode" in
+		HE*) enable_ax=1 ;;
+		EHT*) enable_ax=1; enable_be=1 ;;
+	esac
+
+	if [ "$enable_ax" != "0" ]; then
+		json_get_vars \
+			he_su_beamformer:1 \
+			he_su_beamformee:1 \
+			he_mu_beamformer:1 \
+			he_twt_required:0 \
+			he_twt_responder \
+			he_spr_sr_control:3 \
+			he_spr_psr_enabled:0 \
+			he_spr_non_srg_obss_pd_max_offset:0 \
+			he_bss_color:128 \
+			he_bss_color_enabled:1
+
+		he_phy_cap=$(iw phy "$phy" info | sed -n '/HE Iftypes: .*AP/,$p' | awk -F "[()]" '/HE PHY Capabilities/ { print $2 }' | head -1)
+		he_phy_cap=${he_phy_cap:2}
+		he_mac_cap=$(iw phy "$phy" info | sed -n '/HE Iftypes: .*AP/,$p' | awk -F "[()]" '/HE MAC Capabilities/ { print $2 }' | head -1)
+		he_mac_cap=${he_mac_cap:2}
+
+		append base_cfg "ieee80211ax=1" "$N"
+		[ "$hwmode" = "a" ] && {
+			append base_cfg "he_oper_chwidth=$vht_oper_chwidth" "$N"
+			append base_cfg "he_oper_centr_freq_seg0_idx=$vht_center_seg0" "$N"
+		}
+
+		[ "$etxbfen" -eq 0 ] && {
+			he_su_beamformer=0
+			he_mu_beamformer=0
+		}
+		mac80211_add_he_capabilities \
+			he_su_beamformer:${he_phy_cap:6:2}:0x80:$he_su_beamformer \
+			he_su_beamformee:${he_phy_cap:8:2}:0x1:$he_su_beamformee \
+			he_mu_beamformer:${he_phy_cap:8:2}:0x2:$he_mu_beamformer \
+			[ "$he_spr_psr_enabled" -gt 0 ] && he_spr_psr_enabled=$((0x${he_phy_cap:14:2} & 0x1))
+			he_twt_required:${he_mac_cap:0:2}:0x6:$he_twt_required
+
+		if [ -n "$he_twt_responder" ]; then
+			append base_cfg "he_twt_responder=$he_twt_responder" "$N"
+		fi
+		if [ "$he_bss_color_enabled" -gt 0 ]; then
+			append base_cfg "he_bss_color=$he_bss_color" "$N"
+			[ "$he_spr_non_srg_obss_pd_max_offset" -gt 0 ] && { \
+				append base_cfg "he_spr_non_srg_obss_pd_max_offset=$he_spr_non_srg_obss_pd_max_offset" "$N"
+				he_spr_sr_control=$((he_spr_sr_control | (1 << 2)))
+			}
+			[ "$he_spr_psr_enabled" -gt 0 ] || he_spr_sr_control=$((he_spr_sr_control | (1 << 0)))
+			append base_cfg "he_spr_sr_control=$he_spr_sr_control" "$N"
+		else
+			append base_cfg "he_bss_color_disabled=1" "$N"
+		fi
+
+
+		append base_cfg "he_default_pe_duration=4" "$N"
+		append base_cfg "he_rts_threshold=1023" "$N"
+		append base_cfg "he_mu_edca_qos_info_param_count=0" "$N"
+		append base_cfg "he_mu_edca_qos_info_q_ack=0" "$N"
+		append base_cfg "he_mu_edca_qos_info_queue_request=0" "$N"
+		append base_cfg "he_mu_edca_qos_info_txop_request=0" "$N"
+		append base_cfg "he_mu_edca_ac_be_aifsn=8" "$N"
+		append base_cfg "he_mu_edca_ac_be_aci=0" "$N"
+		append base_cfg "he_mu_edca_ac_be_ecwmin=9" "$N"
+		append base_cfg "he_mu_edca_ac_be_ecwmax=10" "$N"
+		append base_cfg "he_mu_edca_ac_be_timer=255" "$N"
+		append base_cfg "he_mu_edca_ac_bk_aifsn=15" "$N"
+		append base_cfg "he_mu_edca_ac_bk_aci=1" "$N"
+		append base_cfg "he_mu_edca_ac_bk_ecwmin=9" "$N"
+		append base_cfg "he_mu_edca_ac_bk_ecwmax=10" "$N"
+		append base_cfg "he_mu_edca_ac_bk_timer=255" "$N"
+		append base_cfg "he_mu_edca_ac_vi_ecwmin=5" "$N"
+		append base_cfg "he_mu_edca_ac_vi_ecwmax=7" "$N"
+		append base_cfg "he_mu_edca_ac_vi_aifsn=5" "$N"
+		append base_cfg "he_mu_edca_ac_vi_aci=2" "$N"
+		append base_cfg "he_mu_edca_ac_vi_timer=255" "$N"
+		append base_cfg "he_mu_edca_ac_vo_aifsn=5" "$N"
+		append base_cfg "he_mu_edca_ac_vo_aci=3" "$N"
+		append base_cfg "he_mu_edca_ac_vo_ecwmin=9" "$N"
+		append base_cfg "he_mu_edca_ac_vo_ecwmax=10" "$N"
+		append base_cfg "he_mu_edca_ac_vo_timer=255" "$N"
+	fi
+
+	if [ "$enable_be" != "0" ]; then
+		json_get_vars \
+			pp_bitmap \
+			pp_mode
+		append base_cfg "ieee80211be=1" "$N"
+		if [ "$etxbfen" -eq 0 ]; then
+			append base_cfg "eht_su_beamformee=1" "$N"
+		else
+			append base_cfg "eht_su_beamformer=1" "$N"
+			append base_cfg "eht_su_beamformee=1" "$N"
+			append base_cfg "eht_mu_beamformer=1" "$N"
+		fi
+		[ "$hwmode" = "a" ] && {
+			append base_cfg "eht_oper_chwidth=$eht_oper_chwidth" "$N"
+			append base_cfg "eht_oper_centr_freq_seg0_idx=$eht_center_seg0" "$N"
+		}
+		if [ -n "$pp_bitmap" ]; then
+			append base_cfg "punct_bitmap=$pp_bitmap" "$N"
+		fi
+
+		if [ -n "$pp_mode" ]; then
+			append base_cfg "pp_mode=$pp_mode" "$N"
+		fi
+	fi
+
+# dpawlik: why it raises: unknown configuration item 'ibf_enable'
+# where ibf_enabled=0
+# ${itxbfen:+ibf_enable=$itxbfen}
+	hostapd_prepare_device_config "$hostapd_conf_file" nl80211
+	cat >> "$hostapd_conf_file" <<EOF
+${channel:+channel=$channel}
+${channel_list:+chanlist=$channel_list}
+${hostapd_noscan:+noscan=1}
+${tx_burst:+tx_queue_data2_burst=$tx_burst}
+${multiple_bssid:+mbssid=$multiple_bssid}
+${eml_disable:+eml_disable=$eml_disable}
+${eml_resp:+eml_resp=$eml_resp}
+${lpi_psd:+lpi_psd=$lpi_psd}
+${lpi_bcn_enhance:+lpi_bcn_enhance=$lpi_bcn_enhance}
+${sku_idx:+sku_idx=$sku_idx}
+${lpi_sku_idx:+lpi_sku_idx=$lpi_sku_idx}
+#num_global_macaddr=$num_global_macaddr
+#macaddr_base=$macaddr_base
+$base_cfg
+
+EOF
+	json_select ..
+}
+
+mac80211_hostapd_setup_bss() {
+	local phy="$1"
+	local ifname="$2"
+	local macaddr="$3"
+	local type="$4"
+
+	hostapd_cfg=
+	append hostapd_cfg "$type=$ifname" "$N"
+
+	hostapd_set_bss_options hostapd_cfg "$phy" "$vif" || return 1
+	json_get_vars wds wds_bridge dtim_period max_listen_int start_disabled
+
+	set_default wds 0
+	set_default start_disabled 0
+
+	[ "$wds" -gt 0 ] && {
+		append hostapd_cfg "wds_sta=1" "$N"
+		[ -n "$wds_bridge" ] && append hostapd_cfg "wds_bridge=$wds_bridge" "$N"
+	}
+	[ "$staidx" -gt 0 -o "$start_disabled" -eq 1 ] && append hostapd_cfg "start_disabled=1" "$N"
+
+	cat >> /var/run/hostapd-$phy$vif_phy_suffix.conf <<EOF
+$hostapd_cfg
+bssid=$macaddr
+${default_macaddr:+#default_macaddr}
+${dtim_period:+dtim_period=$dtim_period}
+${max_listen_int:+max_listen_interval=$max_listen_int}
+EOF
+}
+
+mac80211_get_addr() {
+	local phy="$1"
+	local idx="$(($2 + 1))"
+
+	head -n $idx /sys/class/ieee80211/${phy}/addresses | tail -n1
+}
+
+mac80211_generate_mac() {
+	local phy="$1"
+	local id="${macidx:-0}"
+
+	wdev_tool "$phy$phy_suffix" get_macaddr id=$id num_global=$num_global_macaddr mbssid=${multiple_bssid:-0} macaddr_base=${macaddr_base}
+}
+
+get_board_phy_name() (
+	local path="$1"
+	local fallback_phy=""
+
+	__check_phy() {
+		local val="$1"
+		local key="$2"
+		local ref_path="$3"
+
+		json_select "$key"
+		json_get_vars path
+		json_select ..
+
+		[ "${ref_path%+*}" = "$path" ] && fallback_phy=$key
+		[ "$ref_path" = "$path" ] || return 0
+
+		echo "$key"
+		exit
+	}
+
+	json_load_file /etc/board.json
+	json_for_each_item __check_phy wlan "$path"
+	[ -n "$fallback_phy" ] && echo "${fallback_phy}.${path##*+}"
+)
+
+rename_board_phy_by_path() {
+	local path="$1"
+
+	local new_phy="$(get_board_phy_name "$path")"
+	[ -z "$new_phy" -o "$new_phy" = "$phy" ] && return
+
+	iw "$phy" set name "$new_phy" && phy="$new_phy"
+}
+
+rename_board_phy_by_name() (
+	local phy="$1"
+	local suffix="${phy##*.}"
+	[ "$suffix" = "$phy" ] && suffix=
+
+	json_load_file /etc/board.json
+	json_select wlan
+	json_select "${phy%.*}" || return 0
+	json_get_vars path
+
+	prev_phy="$(iwinfo nl80211 phyname "path=$path${suffix:++$suffix}")"
+	[ -n "$prev_phy" ] || return 0
+
+	[ "$prev_phy" = "$phy" ] && return 0
+
+	iw "$prev_phy" set name "$phy"
+)
+
+find_phy() {
+	[ -n "$phy" ] && {
+		rename_board_phy_by_name "$phy"
+		[ -d /sys/class/ieee80211/$phy ] && return 0
+	}
+	[ -n "$path" ] && {
+		phy="$(iwinfo nl80211 phyname "path=$path")"
+		[ -n "$phy" ] && {
+			rename_board_phy_by_path "$path"
+			return 0
+		}
+	}
+	[ -n "$macaddr" ] && {
+		for phy in $(ls /sys/class/ieee80211 2>/dev/null); do
+			grep -i -q "$macaddr" "/sys/class/ieee80211/${phy}/macaddress" && {
+				path="$(iwinfo nl80211 path "$phy")"
+				rename_board_phy_by_path "$path"
+				return 0
+			}
+		done
+	}
+	return 1
+}
+
+mac80211_check_ap() {
+	has_ap=1
+}
+
+mac80211_set_ifname() {
+	local prefix="$1"
+	local type="$2"
+	eval "ifname=\"$prefix$type\${idx_$type:-0}\"; idx_$type=\$((\${idx_$type:-0 } + 1))"
+}
+
+mac80211_prepare_vif() {
+	json_select config
+
+	json_get_vars ifname mode ssid wds powersave macaddr enable wpa_psk_file sae_password_file vlan_file
+
+	[ -n "$ifname" ] || {
+		local prefix;
+
+		case "$mode" in
+		ap|sta|mesh) prefix=$mode;;
+		adhoc) prefix=ibss;;
+		monitor) prefix=mon;;
+		esac
+
+		mac80211_set_ifname "$ifname_prefix" "$prefix"
+	}
+
+	append active_ifnames "$ifname"
+	set_default wds 0
+	set_default powersave 0
+	json_add_string _ifname "$ifname"
+
+	default_macaddr=
+	if [ -z "$macaddr" ]; then
+		macaddr="$(mac80211_generate_mac $phy)"
+		macidx="$(($macidx + 1))"
+		default_macaddr=1
+	elif [ "$macaddr" = 'random' ]; then
+		macaddr="$(macaddr_random)"
+	fi
+	json_add_string _macaddr "$macaddr"
+	json_add_string _default_macaddr "$default_macaddr"
+	json_select ..
+
+
+	[ "$mode" == "ap" ] && {
+		json_select config
+		wireless_vif_parse_encryption
+		json_select ..
+
+		[ -z "$wpa_psk_file" ] && hostapd_set_psk "$ifname"
+		[ -z "$sae_password_file" ] && hostapd_set_sae "$ifname"
+		[ -z "$vlan_file" ] && hostapd_set_vlan "$ifname"
+	}
+
+	json_select config
+
+	# It is far easier to delete and create the desired interface
+	case "$mode" in
+		ap)
+			# Hostapd will handle recreating the interface and
+			# subsequent virtual APs belonging to the same PHY
+			if [ -n "$hostapd_ctrl" ]; then
+				type=bss
+			else
+				type=interface
+			fi
+
+			mac80211_hostapd_setup_bss "$phy" "$ifname" "$macaddr" "$type" || return
+
+			[ -n "$hostapd_ctrl" ] || {
+				ap_ifname="${ifname}"
+				hostapd_ctrl="${hostapd_ctrl:-/var/run/hostapd/$ifname}"
+			}
+		;;
+	esac
+
+	json_select ..
+}
+
+mac80211_prepare_iw_htmode() {
+	case "$htmode" in
+		HT20|VHT20|HE20|EHT20)
+			iw_htmode=HT20
+		;;
+		HT40*|VHT40|HE40|EHT40)
+			case "$band" in
+				2g)
+					case "$htmode" in
+						HT40+) iw_htmode="HT40+";;
+						HT40-) iw_htmode="HT40-";;
+						*)
+							if [ "$channel" -lt 7 ]; then
+								iw_htmode="HT40+"
+							else
+								iw_htmode="HT40-"
+							fi
+						;;
+					esac
+				;;
+				*)
+					case "$(( ($channel / 4) % 2 ))" in
+						1) iw_htmode="HT40+" ;;
+						0) iw_htmode="HT40-";;
+					esac
+				;;
+			esac
+			[ "$auto_channel" -gt 0 ] && iw_htmode="HT40+"
+		;;
+		VHT80|HE80|EHT80)
+			iw_htmode="80MHz"
+		;;
+		VHT160|HE160|EHT160)
+			iw_htmode="160MHz"
+		;;
+		NONE|NOHT)
+			iw_htmode="NOHT"
+		;;
+		*) iw_htmode="" ;;
+	esac
+}
+
+mac80211_add_mesh_params() {
+	for var in $MP_CONFIG_INT $MP_CONFIG_BOOL $MP_CONFIG_STRING; do
+		eval "mp_val=\"\$$var\""
+		[ -n "$mp_val" ] && json_add_string "$var" "$mp_val"
+	done
+}
+
+mac80211_setup_adhoc() {
+	local enable=$1
+	json_get_vars bssid ssid key mcast_rate
+
+	NEWUMLIST="${NEWUMLIST}$ifname "
+
+	[ "$enable" = 0 ] && {
+		ip link set dev "$ifname" down
+		return 0
+	}
+
+	keyspec=
+	[ "$auth_type" = "wep" ] && {
+		set_default key 1
+		case "$key" in
+			[1234])
+				local idx
+				for idx in 1 2 3 4; do
+					json_get_var ikey "key$idx"
+
+					[ -n "$ikey" ] && {
+						ikey="$(($idx - 1)):$(prepare_key_wep "$ikey")"
+						[ $idx -eq $key ] && ikey="d:$ikey"
+						append keyspec "$ikey"
+					}
+				done
+			;;
+			*)
+				append keyspec "d:0:$(prepare_key_wep "$key")"
+			;;
+		esac
+	}
+
+	brstr=
+	for br in $basic_rate_list; do
+		wpa_supplicant_add_rate brstr "$br"
+	done
+
+	mcval=
+	[ -n "$mcast_rate" ] && wpa_supplicant_add_rate mcval "$mcast_rate"
+
+	local prev
+	json_set_namespace wdev_uc prev
+
+	json_add_object "$ifname"
+	json_add_string mode adhoc
+	[ -n "$default_macaddr" ] || json_add_string macaddr "$macaddr"
+	json_add_string ssid "$ssid"
+	json_add_string freq "$freq"
+	json_add_string htmode "$iw_htmode"
+	[ -n "$bssid" ] && json_add_string bssid "$bssid"
+	json_add_int beacon-interval "$beacon_int"
+	[ -n "$brstr" ] && json_add_string basic-rates "$brstr"
+	[ -n "$mcval" ] && json_add_string mcast-rate "$mcval"
+	[ -n "$keyspec" ] && json_add_string keys "$keyspec"
+	json_close_object
+
+	json_set_namespace "$prev"
+}
+
+mac80211_setup_mesh() {
+	json_get_vars ssid mesh_id mcast_rate
+	json_get_values iface_basic_rate_list basic_rate
+
+	mcval=
+	[ -n "$mcast_rate" ] && wpa_supplicant_add_rate mcval "$mcast_rate"
+	[ -n "$mesh_id" ] && ssid="$mesh_id"
+
+	br_list="$basic_rate_list"
+	if [ -n "$iface_basic_rate_list" ]; then
+		br_list="$iface_basic_rate_list"
+	fi
+
+	brstr=
+	for br in $br_list; do
+		wpa_supplicant_add_rate brstr "$br"
+	done
+
+	local prev
+	json_set_namespace wdev_uc prev
+
+	json_add_object "$ifname"
+	json_add_string mode mesh
+	[ -n "$default_macaddr" ] || json_add_string macaddr "$macaddr"
+	json_add_string ssid "$ssid"
+	json_add_string freq "$freq"
+	json_add_string htmode "$iw_htmode"
+	[ -n "$mcval" ] && json_add_string mcast-rate "$mcval"
+	[ -n "$brstr" ] && json_add_string basic-rates "$brstr"
+	json_add_int beacon-interval "$beacon_int"
+	mac80211_add_mesh_params
+
+	json_close_object
+
+	json_set_namespace "$prev"
+}
+
+mac80211_setup_monitor() {
+	local prev
+	json_set_namespace wdev_uc prev
+
+	json_add_object "$ifname"
+	json_add_string mode monitor
+	[ -n "$freq" ] && json_add_string freq "$freq"
+	json_add_string htmode "$iw_htmode"
+	json_close_object
+
+	json_set_namespace "$prev"
+}
+
+mac80211_set_vif_txpower() {
+	local name="$1"
+
+	json_select config
+	json_get_var ifname _ifname
+	json_get_vars vif_txpower
+	json_select ..
+
+	set_default vif_txpower "$txpower"
+	if [ -n "$vif_txpower" ]; then
+		iw dev "$ifname" set txpower fixed "${vif_txpower%%.*}00"
+	else
+		iw dev "$ifname" set txpower auto
+	fi
+}
+
+wpa_supplicant_init_config() {
+	json_set_namespace wpa_supp prev
+
+	json_init
+	json_add_array config
+
+	json_set_namespace "$prev"
+}
+
+wpa_supplicant_add_interface() {
+	local ifname="$1"
+	local mode="$2"
+	local prev
+
+	_wpa_supplicant_common "$ifname"
+
+	json_set_namespace wpa_supp prev
+
+	json_add_object
+	json_add_string ctrl "$_rpath"
+	json_add_string iface "$ifname"
+	json_add_string mode "$mode"
+	json_add_string config "$_config"
+	[ -n "$default_macaddr" ] || json_add_string macaddr "$macaddr"
+	[ -n "$network_bridge" ] && json_add_string bridge "$network_bridge"
+	[ -n "$wds" ] && json_add_boolean 4addr "$wds"
+	json_add_boolean powersave "$powersave"
+	[ "$mode" = "mesh" ] && mac80211_add_mesh_params
+	json_close_object
+
+	json_set_namespace "$prev"
+
+	wpa_supp_init=1
+}
+
+wpa_supplicant_set_config() {
+	local phy="$1"
+	local radio="$2"
+	local prev
+
+	json_set_namespace wpa_supp prev
+	json_close_array
+	json_add_string phy "$phy"
+	json_add_int radio "$radio"
+	json_add_int num_global_macaddr "$num_global_macaddr"
+	json_add_string macaddr_base "$macaddr_base"
+	json_add_boolean defer 1
+	local data="$(json_dump)"
+
+	json_cleanup
+	json_set_namespace "$prev"
+
+	ubus -S -t 0 wait_for wpa_supplicant || {
+		[ -n "$wpa_supp_init" ] || return 0
+
+		ubus wait_for wpa_supplicant
+	}
+
+	local supplicant_res="$(ubus_call wpa_supplicant config_set "$data")"
+	ret="$?"
+	[ "$ret" != 0 -o -z "$supplicant_res" ] && wireless_setup_vif_failed WPA_SUPPLICANT_FAILED
+
+	wireless_add_process "$(jsonfilter -s "$supplicant_res" -l 1 -e @.pid)" "/usr/sbin/wpa_supplicant" 1 1
+
+}
+
+hostapd_set_config() {
+	local phy="$1"
+	local radio="$2"
+
+	[ -n "$hostapd_ctrl" ] || {
+		ubus_call hostapd config_set '{ "phy": "'"$phy"'", "radio": '"$radio"', "config": "", "prev_config": "'"${hostapd_conf_file}.prev"'" }' > /dev/null
+		return 0;
+	}
+
+	ubus wait_for hostapd
+	local hostapd_res="$(ubus_call hostapd config_set "{ \"phy\": \"$phy\", \"radio\": $radio, \"config\":\"${hostapd_conf_file}\", \"prev_config\": \"${hostapd_conf_file}.prev\"}")"
+	ret="$?"
+	[ "$ret" != 0 -o -z "$hostapd_res" ] && {
+		wireless_setup_failed HOSTAPD_START_FAILED
+		return
+	}
+	wireless_add_process "$(jsonfilter -s "$hostapd_res" -l 1 -e @.pid)" "/usr/sbin/hostapd" 1 1
+}
+
+
+wpa_supplicant_start() {
+	local phy="$1"
+	local radio="$2"
+
+	[ -n "$wpa_supp_init" ] || return 0
+
+	ubus_call wpa_supplicant config_set '{ "phy": "'"$phy"'", "radio": '"$radio"', "num_global_macaddr": '"$num_global_macaddr"', "macaddr_base": "'"$macaddr_base"'" }' > /dev/null
+}
+
+mac80211_setup_supplicant() {
+	local enable=$1
+	local add_sp=0
+
+	wpa_supplicant_prepare_interface "$ifname" nl80211 || return 1
+
+	if [ "$mode" = "sta" ]; then
+		wpa_supplicant_add_network "$ifname"
+	else
+		wpa_supplicant_add_network "$ifname" "$freq" "$htmode" "$hostapd_noscan"
+	fi
+
+	wpa_supplicant_add_interface "$ifname" "$mode"
+
+	return 0
+}
+
+mac80211_setup_vif() {
+	local name="$1"
+	local failed
+
+	json_select config
+	json_get_var ifname _ifname
+	json_get_var macaddr _macaddr
+	json_get_var default_macaddr _default_macaddr
+	json_get_vars mode wds powersave
+
+	set_default powersave 0
+	set_default wds 0
+
+	case "$mode" in
+		mesh)
+			json_get_vars $MP_CONFIG_INT $MP_CONFIG_BOOL $MP_CONFIG_STRING
+			wireless_vif_parse_encryption
+			[ -z "$htmode" ] && htmode="NOHT";
+			if [ -x /usr/sbin/wpa_supplicant ] && wpa_supplicant -vmesh; then
+				mac80211_setup_supplicant || failed=1
+			else
+				mac80211_setup_mesh
+			fi
+		;;
+		adhoc)
+			wireless_vif_parse_encryption
+			if [ "$wpa" -gt 0 -o "$auto_channel" -gt 0 ]; then
+				mac80211_setup_supplicant || failed=1
+			else
+				mac80211_setup_adhoc
+			fi
+		;;
+		sta)
+			mac80211_setup_supplicant || failed=1
+		;;
+		monitor)
+			mac80211_setup_monitor
+		;;
+	esac
+
+	json_select ..
+	[ -n "$failed" ] || wireless_add_vif "$name" "$ifname"
+}
+
+get_freq() {
+	local phy="$1"
+	local channel="$2"
+	local band="$3"
+
+	case "$band" in
+		2g) band="1:";;
+		5g) band="2:";;
+		60g) band="3:";;
+		6g) band="4:";;
+	esac
+
+	iw "$phy" info | awk -v band="$band" -v channel="[$channel]" '
+
+$1 ~ /Band/ {
+	band_match = band == $2
+}
+
+band_match && $3 == "MHz" && $4 == channel {
+	print int($2)
+	exit
+}
+'
+}
+
+chan_is_dfs() {
+	local phy="$1"
+	local chan="$2"
+	iw "$phy" info | grep -E -m1 "(\* ${chan:-....} MHz${chan:+|\\[$chan\\]})" | grep -q "MHz.*radar detection"
+	return $!
+}
+
+mac80211_set_noscan() {
+	hostapd_noscan=1
+}
+
+drv_mac80211_cleanup() {
+	:
+}
+
+mac80211_reset_config() {
+	hostapd_conf_file="/var/run/hostapd-$phy$vif_phy_suffix.conf"
+	ubus_call hostapd config_set '{ "phy": "'"$phy"'", "radio": '"$radio"', "config": "", "prev_config": "'"$hostapd_conf_file"'" }' > /dev/null
+	ubus_call wpa_supplicant config_set '{ "phy": "'"$phy"'", "radio": '"$radio"', "config": [] }' > /dev/null
+	wdev_tool "$phy$phy_suffix" set_config '{}'
+}
+
+mac80211_set_suffix() {
+	[ "$radio" = "-1" ] && radio=
+	phy_suffix="${radio:+:$radio}"
+	vif_phy_suffix="${radio:+.$radio}"
+	set_default radio -1
+}
+
+drv_mac80211_setup() {
+	json_select config
+	json_get_vars \
+		radio phy macaddr path \
+		country chanbw distance \
+		txpower \
+		rxantenna txantenna \
+		frag rts beacon_int:100 htmode \
+		num_global_macaddr:1 multiple_bssid \
+		ifname_prefix macaddr_base
+	json_get_values basic_rate_list basic_rate
+	json_get_values scan_list scan_list
+	json_select ..
+
+	mac80211_set_suffix
+
+	json_select data && {
+		json_get_var prev_rxantenna rxantenna
+		json_get_var prev_txantenna txantenna
+		json_select ..
+	}
+
+	find_phy || {
+		echo "Could not find PHY for device '$1'"
+		wireless_set_retry 0
+		return 1
+	}
+
+	set_default ifname_prefix "$phy$vif_phy_suffix-"
+
+	local wdev
+	local cwdev
+	local found
+
+	# convert channel to frequency
+	[ "$auto_channel" -gt 0 ] || freq="$(get_freq "$phy" "$channel" "$band")"
+
+	[ -n "$country" ] && {
+		iw reg get | grep -q "^country $country:" || {
+			iw reg set "$country"
+			sleep 1
+		}
+	}
+
+	hostapd_conf_file="/var/run/hostapd-$phy$vif_phy_suffix.conf"
+
+	macidx=0
+	staidx=0
+
+	[ -n "$chanbw" ] && {
+		for file in /sys/kernel/debug/ieee80211/$phy/ath9k*/chanbw /sys/kernel/debug/ieee80211/$phy/ath5k/bwmode; do
+			[ -f "$file" ] && echo "$chanbw" > "$file"
+		done
+	}
+
+	set_default rxantenna 0xffffffff
+	set_default txantenna 0xffffffff
+	set_default distance 0
+
+	[ "$txantenna" = "all" ] && txantenna=0xffffffff
+	[ "$rxantenna" = "all" ] && rxantenna=0xffffffff
+
+	[ "$rxantenna" = "$prev_rxantenna" -a "$txantenna" = "$prev_txantenna" ] || mac80211_reset_config "$phy"
+	wireless_set_data phy="$phy" radio="$radio" txantenna="$txantenna" rxantenna="$rxantenna"
+
+	iw phy "$phy" set antenna $txantenna $rxantenna >/dev/null 2>&1
+	iw phy "$phy" set distance "$distance" >/dev/null 2>&1
+
+	[ -n "$frag" ] && iw phy "$phy" set frag "${frag%%.*}"
+	[ -n "$rts" ] && iw phy "$phy" set rts "${rts%%.*}"
+
+	has_ap=
+	hostapd_ctrl=
+	ap_ifname=
+	hostapd_noscan=
+	wpa_supp_init=
+	for_each_interface "ap" mac80211_check_ap
+
+	[ -f "$hostapd_conf_file" ] && mv "$hostapd_conf_file" "$hostapd_conf_file.prev"
+
+	for_each_interface "sta adhoc mesh" mac80211_set_noscan
+	[ -n "$has_ap" ] && mac80211_hostapd_setup_base "$phy"
+
+	local prev
+	json_set_namespace wdev_uc prev
+	json_init
+	json_set_namespace "$prev"
+
+	wpa_supplicant_init_config
+
+	mac80211_prepare_iw_htmode
+	active_ifnames=
+	for_each_interface "ap sta adhoc mesh monitor" mac80211_prepare_vif
+	for_each_interface "ap sta adhoc mesh monitor" mac80211_setup_vif
+
+	[ -x /usr/sbin/wpa_supplicant ] && wpa_supplicant_set_config "$phy" "$radio"
+	[ -x /usr/sbin/hostapd ] && hostapd_set_config "$phy" "$radio"
+
+	[ -x /usr/sbin/wpa_supplicant ] && wpa_supplicant_start "$phy" "$radio"
+
+	json_set_namespace wdev_uc prev
+	wdev_tool "$phy$phy_suffix" set_config "$(json_dump)" $active_ifnames
+	json_set_namespace "$prev"
+
+	[ -z "$phy_suffix" ] && {
+		if [ -n "$txpower" ]; then
+			iw phy "$phy" set txpower fixed "${txpower%%.*}00"
+		else
+			iw phy "$phy" set txpower auto
+		fi
+	}
+
+	for_each_interface "ap sta adhoc mesh monitor" mac80211_set_vif_txpower
+	wireless_set_up
+}
+
+_list_phy_interfaces() {
+	local phy="$1"
+	if [ -d "/sys/class/ieee80211/${phy}/device/net" ]; then
+		ls "/sys/class/ieee80211/${phy}/device/net" 2>/dev/null;
+	else
+		ls "/sys/class/ieee80211/${phy}/device" 2>/dev/null | grep net: | sed -e 's,net:,,g'
+	fi
+}
+
+list_phy_interfaces() {
+	local phy="$1"
+
+	for dev in $(_list_phy_interfaces "$phy"); do
+		readlink "/sys/class/net/${dev}/phy80211" | grep -q "/${phy}\$" || continue
+		echo "$dev"
+	done
+}
+
+drv_mac80211_teardown() {
+	json_select data
+	json_get_vars phy radio
+	json_select ..
+	[ -n "$phy" ] || {
+		echo "Bug: PHY is undefined for device '$1'"
+		return 1
+	}
+
+	mac80211_set_suffix
+	mac80211_reset_config "$phy"
+}
+
+add_driver mac80211
diff --git a/wireless-scripts-example/old/mac80211-default.sh b/wireless-scripts-example/old/mac80211-default.sh
new file mode 100755
index 0000000000..c9fa2b5fa0
--- /dev/null
+++ b/wireless-scripts-example/old/mac80211-default.sh
@@ -0,0 +1,1273 @@
+#!/bin/sh
+. /lib/netifd/netifd-wireless.sh
+. /lib/netifd/hostapd.sh
+. /lib/functions/system.sh
+
+init_wireless_driver "$@"
+
+MP_CONFIG_INT="mesh_retry_timeout mesh_confirm_timeout mesh_holding_timeout mesh_max_peer_links
+	       mesh_max_retries mesh_ttl mesh_element_ttl mesh_hwmp_max_preq_retries
+	       mesh_path_refresh_time mesh_min_discovery_timeout mesh_hwmp_active_path_timeout
+	       mesh_hwmp_preq_min_interval mesh_hwmp_net_diameter_traversal_time mesh_hwmp_rootmode
+	       mesh_hwmp_rann_interval mesh_gate_announcements mesh_sync_offset_max_neighor
+	       mesh_rssi_threshold mesh_hwmp_active_path_to_root_timeout mesh_hwmp_root_interval
+	       mesh_hwmp_confirmation_interval mesh_awake_window mesh_plink_timeout"
+MP_CONFIG_BOOL="mesh_auto_open_plinks mesh_fwding"
+MP_CONFIG_STRING="mesh_power_mode"
+
+wdev_tool() {
+	ucode /usr/share/hostap/wdev.uc "$@"
+}
+
+ubus_call() {
+	flock /var/run/hostapd.lock ubus call "$@"
+}
+
+drv_mac80211_init_device_config() {
+	hostapd_common_add_device_config
+
+	config_add_string path phy 'macaddr:macaddr'
+	config_add_string tx_burst
+	config_add_string distance
+	config_add_string ifname_prefix
+	config_add_string macaddr_base
+	config_add_int radio beacon_int chanbw frag rts
+	config_add_int rxantenna txantenna txpower min_tx_power
+	config_add_int num_global_macaddr multiple_bssid
+	config_add_boolean noscan ht_coex acs_exclude_dfs background_radar
+	config_add_array ht_capab
+	config_add_array channels
+	config_add_array scan_list
+	config_add_boolean \
+		rxldpc \
+		short_gi_80 \
+		short_gi_160 \
+		tx_stbc_2by1 \
+		su_beamformer \
+		su_beamformee \
+		mu_beamformer \
+		mu_beamformee \
+		he_su_beamformer \
+		he_su_beamformee \
+		he_mu_beamformer \
+		vht_txop_ps \
+		htc_vht \
+		rx_antenna_pattern \
+		tx_antenna_pattern \
+		he_spr_sr_control \
+		he_spr_psr_enabled \
+		he_bss_color_enabled \
+		he_twt_required
+	config_add_int \
+		beamformer_antennas \
+		beamformee_antennas \
+		vht_max_a_mpdu_len_exp \
+		vht_max_mpdu \
+		vht_link_adapt \
+		vht160 \
+		rx_stbc \
+		tx_stbc \
+		he_bss_color \
+		he_spr_non_srg_obss_pd_max_offset
+	config_add_boolean \
+		ldpc \
+		greenfield \
+		short_gi_20 \
+		short_gi_40 \
+		max_amsdu \
+		dsss_cck_40
+}
+
+drv_mac80211_init_iface_config() {
+	hostapd_common_add_bss_config
+
+	config_add_string 'macaddr:macaddr' ifname
+
+	config_add_boolean wds powersave enable
+	config_add_string wds_bridge
+	config_add_int maxassoc
+	config_add_int max_listen_int
+	config_add_int dtim_period
+	config_add_int start_disabled
+
+	# mesh
+	config_add_string mesh_id
+	config_add_int $MP_CONFIG_INT
+	config_add_boolean $MP_CONFIG_BOOL
+	config_add_string $MP_CONFIG_STRING
+}
+
+mac80211_add_capabilities() {
+	local __var="$1"; shift
+	local __mask="$1"; shift
+	local __out= oifs
+
+	oifs="$IFS"
+	IFS=:
+	for capab in "$@"; do
+		set -- $capab
+
+		[ "$(($4))" -gt 0 ] || continue
+		[ "$(($__mask & $2))" -eq "$((${3:-$2}))" ] || continue
+		__out="$__out[$1]"
+	done
+	IFS="$oifs"
+
+	export -n -- "$__var=$__out"
+}
+
+mac80211_add_he_capabilities() {
+	local __out= oifs
+
+	oifs="$IFS"
+	IFS=:
+	for capab in "$@"; do
+		set -- $capab
+		[ "$(($4))" -gt 0 ] || continue
+		[ "$(((0x$2) & $3))" -gt 0 ] || {
+			eval "$1=0"
+			continue
+		}
+		append base_cfg "$1=1" "$N"
+	done
+	IFS="$oifs"
+}
+
+mac80211_hostapd_setup_base() {
+	local phy="$1"
+
+	json_select config
+
+	[ "$auto_channel" -gt 0 ] && channel=acs_survey
+
+	[ "$auto_channel" -gt 0 ] && json_get_vars acs_exclude_dfs
+	[ -n "$acs_exclude_dfs" ] && [ "$acs_exclude_dfs" -gt 0 ] &&
+		append base_cfg "acs_exclude_dfs=1" "$N"
+
+	json_get_vars noscan ht_coex min_tx_power:0 tx_burst
+	json_get_values ht_capab_list ht_capab
+	json_get_values channel_list channels
+
+	[ "$auto_channel" = 0 ] && [ -z "$channel_list" ] && \
+		channel_list="$channel"
+
+	[ "$min_tx_power" -gt 0 ] && append base_cfg "min_tx_power=$min_tx_power" "$N"
+
+	set_default noscan 0
+
+	[ "$noscan" -gt 0 ] && hostapd_noscan=1
+	[ "$tx_burst" = 0 ] && tx_burst=
+
+	chan_ofs=0
+	[ "$band" = "6g" ] && chan_ofs=1
+
+	if [ "$band" != "6g" ]; then
+		ieee80211n=1
+		ht_capab=
+		case "$htmode" in
+			VHT20|HT20|HE20|EHT20) ;;
+			HT40*|VHT40|VHT80|VHT160|HE40|HE80|HE160|EHT40|EHT80|EHT160)
+				case "$hwmode" in
+					a)
+						case "$(( (($channel / 4) + $chan_ofs) % 2 ))" in
+							1) ht_capab="[HT40+]";;
+							0) ht_capab="[HT40-]";;
+						esac
+					;;
+					*)
+						case "$htmode" in
+							HT40+) ht_capab="[HT40+]";;
+							HT40-) ht_capab="[HT40-]";;
+							*)
+								if [ "$channel" -lt 7 ]; then
+									ht_capab="[HT40+]"
+								else
+									ht_capab="[HT40-]"
+								fi
+							;;
+						esac
+					;;
+				esac
+				[ "$auto_channel" -gt 0 ] && ht_capab="[HT40+]"
+			;;
+			*) ieee80211n= ;;
+		esac
+
+		[ -n "$ieee80211n" ] && {
+			append base_cfg "ieee80211n=1" "$N"
+
+			set_default ht_coex 0
+			append base_cfg "ht_coex=$ht_coex" "$N"
+
+			json_get_vars \
+				ldpc:1 \
+				greenfield:0 \
+				short_gi_20:1 \
+				short_gi_40:1 \
+				tx_stbc:1 \
+				rx_stbc:3 \
+				max_amsdu:1 \
+				dsss_cck_40:1
+
+			ht_cap_mask=0
+			for cap in $(iw phy "$phy" info | grep -E '^\s*Capabilities:' | cut -d: -f2); do
+				ht_cap_mask="$(($ht_cap_mask | $cap))"
+			done
+
+			cap_rx_stbc=$((($ht_cap_mask >> 8) & 3))
+			[ "$rx_stbc" -lt "$cap_rx_stbc" ] && cap_rx_stbc="$rx_stbc"
+			ht_cap_mask="$(( ($ht_cap_mask & ~(0x300)) | ($cap_rx_stbc << 8) ))"
+
+			mac80211_add_capabilities ht_capab_flags $ht_cap_mask \
+				LDPC:0x1::$ldpc \
+				GF:0x10::$greenfield \
+				SHORT-GI-20:0x20::$short_gi_20 \
+				SHORT-GI-40:0x40::$short_gi_40 \
+				TX-STBC:0x80::$tx_stbc \
+				RX-STBC1:0x300:0x100:1 \
+				RX-STBC12:0x300:0x200:1 \
+				RX-STBC123:0x300:0x300:1 \
+				MAX-AMSDU-7935:0x800::$max_amsdu \
+				DSSS_CCK-40:0x1000::$dsss_cck_40
+
+			ht_capab="$ht_capab$ht_capab_flags"
+			[ -n "$ht_capab" ] && append base_cfg "ht_capab=$ht_capab" "$N"
+		}
+	fi
+
+	# 802.11ac
+	enable_ac=0
+	vht_oper_chwidth=0
+	vht_center_seg0=
+
+	idx="$channel"
+	case "$htmode" in
+		VHT20|HE20|EHT20) enable_ac=1;;
+		VHT40|HE40|EHT40)
+			case "$(( (($channel / 4) + $chan_ofs) % 2 ))" in
+				1) idx=$(($channel + 2));;
+				0) idx=$(($channel - 2));;
+			esac
+			enable_ac=1
+			vht_center_seg0=$idx
+		;;
+		VHT80|HE80|EHT80)
+			case "$(( (($channel / 4) + $chan_ofs) % 4 ))" in
+				1) idx=$(($channel + 6));;
+				2) idx=$(($channel + 2));;
+				3) idx=$(($channel - 2));;
+				0) idx=$(($channel - 6));;
+			esac
+			enable_ac=1
+			vht_oper_chwidth=1
+			vht_center_seg0=$idx
+		;;
+		VHT160|HE160|EHT160|EHT320)
+			if [ "$band" = "6g" ]; then
+				case "$channel" in
+					1|5|9|13|17|21|25|29) idx=15;;
+					33|37|41|45|49|53|57|61) idx=47;;
+					65|69|73|77|81|85|89|93) idx=79;;
+					97|101|105|109|113|117|121|125) idx=111;;
+					129|133|137|141|145|149|153|157) idx=143;;
+					161|165|169|173|177|181|185|189) idx=175;;
+					193|197|201|205|209|213|217|221) idx=207;;
+				esac
+			else
+				case "$channel" in
+					36|40|44|48|52|56|60|64) idx=50;;
+					100|104|108|112|116|120|124|128) idx=114;;
+					149|153|157|161|165|169|173|177) idx=163;;
+				esac
+			fi
+			enable_ac=1
+			vht_oper_chwidth=2
+			vht_center_seg0=$idx
+		;;
+	esac
+	[ "$band" = "5g" ] && {
+		json_get_vars background_radar:0
+
+		[ "$background_radar" -eq 1 ] && append base_cfg "enable_background_radar=1" "$N"
+	}
+
+	eht_oper_chwidth=$vht_oper_chwidth
+	eht_center_seg0=$vht_center_seg0
+
+	[ "$band" = "6g" ] && {
+		op_class=
+		case "$htmode" in
+			HE20|EHT20) op_class=131;;
+			EHT320)
+				case "$channel" in
+					1|5|9|13|17|21|25|29|33|37|41|45|49|53|57|61) idx=31;;
+					65|69|73|77|81|85|89|93|97|101|105|109|113|117|121|125) idx=95;;
+					129|133|137|141|145|149|153|157|161|165|169|173|177|181|185|189) idx=159;;
+					193|197|201|205|209|213|217|221) idx=191;;
+				esac
+
+				op_class=137
+				eht_center_seg0=$idx
+				eht_oper_chwidth=9
+			;;
+			HE*|EHT*) op_class=$((132 + $vht_oper_chwidth));;
+		esac
+		[ -n "$op_class" ] && append base_cfg "op_class=$op_class" "$N"
+	}
+	[ "$hwmode" = "a" ] || enable_ac=0
+	[ "$band" = "6g" ] && enable_ac=0
+
+	if [ "$enable_ac" != "0" ]; then
+		json_get_vars \
+			rxldpc:1 \
+			short_gi_80:1 \
+			short_gi_160:1 \
+			tx_stbc_2by1:1 \
+			su_beamformer:1 \
+			su_beamformee:1 \
+			mu_beamformer:1 \
+			mu_beamformee:1 \
+			vht_txop_ps:1 \
+			htc_vht:1 \
+			beamformee_antennas:4 \
+			beamformer_antennas:4 \
+			rx_antenna_pattern:1 \
+			tx_antenna_pattern:1 \
+			vht_max_a_mpdu_len_exp:7 \
+			vht_max_mpdu:11454 \
+			rx_stbc:4 \
+			vht_link_adapt:3 \
+			vht160:2
+
+		set_default tx_burst 2.0
+		append base_cfg "ieee80211ac=1" "$N"
+		vht_cap=0
+		for cap in $(iw phy "$phy" info | awk -F "[()]" '/VHT Capabilities/ { print $2 }'); do
+			vht_cap="$(($vht_cap | $cap))"
+		done
+
+		append base_cfg "vht_oper_chwidth=$vht_oper_chwidth" "$N"
+		append base_cfg "vht_oper_centr_freq_seg0_idx=$vht_center_seg0" "$N"
+
+		cap_rx_stbc=$((($vht_cap >> 8) & 7))
+		[ "$rx_stbc" -lt "$cap_rx_stbc" ] && cap_rx_stbc="$rx_stbc"
+		vht_cap="$(( ($vht_cap & ~(0x700)) | ($cap_rx_stbc << 8) ))"
+
+		[ "$vht_oper_chwidth" -lt 2 ] && {
+			vht160=0
+			short_gi_160=0
+		}
+
+		mac80211_add_capabilities vht_capab $vht_cap \
+			RXLDPC:0x10::$rxldpc \
+			SHORT-GI-80:0x20::$short_gi_80 \
+			SHORT-GI-160:0x40::$short_gi_160 \
+			TX-STBC-2BY1:0x80::$tx_stbc_2by1 \
+			SU-BEAMFORMER:0x800::$su_beamformer \
+			SU-BEAMFORMEE:0x1000::$su_beamformee \
+			MU-BEAMFORMER:0x80000::$mu_beamformer \
+			MU-BEAMFORMEE:0x100000::$mu_beamformee \
+			VHT-TXOP-PS:0x200000::$vht_txop_ps \
+			HTC-VHT:0x400000::$htc_vht \
+			RX-ANTENNA-PATTERN:0x10000000::$rx_antenna_pattern \
+			TX-ANTENNA-PATTERN:0x20000000::$tx_antenna_pattern \
+			RX-STBC-1:0x700:0x100:1 \
+			RX-STBC-12:0x700:0x200:1 \
+			RX-STBC-123:0x700:0x300:1 \
+			RX-STBC-1234:0x700:0x400:1 \
+
+		[ "$(($vht_cap & 0x800))" -gt 0 -a "$su_beamformer" -gt 0 ] && {
+			cap_ant="$(( ( ($vht_cap >> 16) & 3 ) + 1 ))"
+			[ "$cap_ant" -gt "$beamformer_antennas" ] && cap_ant="$beamformer_antennas"
+			[ "$cap_ant" -gt 1 ] && vht_capab="$vht_capab[SOUNDING-DIMENSION-$cap_ant]"
+		}
+
+		[ "$(($vht_cap & 0x1000))" -gt 0 -a "$su_beamformee" -gt 0 ] && {
+			cap_ant="$(( ( ($vht_cap >> 13) & 3 ) + 1 ))"
+			[ "$cap_ant" -gt "$beamformee_antennas" ] && cap_ant="$beamformee_antennas"
+			[ "$cap_ant" -gt 1 ] && vht_capab="$vht_capab[BF-ANTENNA-$cap_ant]"
+		}
+
+		# supported Channel widths
+		vht160_hw=0
+		[ "$(($vht_cap & 12))" -eq 4 -a 1 -le "$vht160" ] && \
+			vht160_hw=1
+		[ "$(($vht_cap & 12))" -eq 8 -a 2 -le "$vht160" ] && \
+			vht160_hw=2
+		[ "$vht160_hw" = 1 ] && vht_capab="$vht_capab[VHT160]"
+		[ "$vht160_hw" = 2 ] && vht_capab="$vht_capab[VHT160-80PLUS80]"
+
+		# maximum MPDU length
+		vht_max_mpdu_hw=3895
+		[ "$(($vht_cap & 3))" -ge 1 -a 7991 -le "$vht_max_mpdu" ] && \
+			vht_max_mpdu_hw=7991
+		[ "$(($vht_cap & 3))" -ge 2 -a 11454 -le "$vht_max_mpdu" ] && \
+			vht_max_mpdu_hw=11454
+		[ "$vht_max_mpdu_hw" != 3895 ] && \
+			vht_capab="$vht_capab[MAX-MPDU-$vht_max_mpdu_hw]"
+
+		# maximum A-MPDU length exponent
+		vht_max_a_mpdu_len_exp_hw=0
+		[ "$(($vht_cap & 58720256))" -ge 8388608 -a 1 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=1
+		[ "$(($vht_cap & 58720256))" -ge 16777216 -a 2 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=2
+		[ "$(($vht_cap & 58720256))" -ge 25165824 -a 3 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=3
+		[ "$(($vht_cap & 58720256))" -ge 33554432 -a 4 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=4
+		[ "$(($vht_cap & 58720256))" -ge 41943040 -a 5 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=5
+		[ "$(($vht_cap & 58720256))" -ge 50331648 -a 6 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=6
+		[ "$(($vht_cap & 58720256))" -ge 58720256 -a 7 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=7
+		vht_capab="$vht_capab[MAX-A-MPDU-LEN-EXP$vht_max_a_mpdu_len_exp_hw]"
+
+		# whether or not the STA supports link adaptation using VHT variant
+		vht_link_adapt_hw=0
+		[ "$(($vht_cap & 201326592))" -ge 134217728 -a 2 -le "$vht_link_adapt" ] && \
+			vht_link_adapt_hw=2
+		[ "$(($vht_cap & 201326592))" -ge 201326592 -a 3 -le "$vht_link_adapt" ] && \
+			vht_link_adapt_hw=3
+		[ "$vht_link_adapt_hw" != 0 ] && \
+			vht_capab="$vht_capab[VHT-LINK-ADAPT-$vht_link_adapt_hw]"
+
+		[ -n "$vht_capab" ] && append base_cfg "vht_capab=$vht_capab" "$N"
+	fi
+
+	# 802.11ax
+	enable_ax=0
+	enable_be=0
+	case "$htmode" in
+		HE*) enable_ax=1 ;;
+		EHT*) enable_ax=1; enable_be=1 ;;
+	esac
+
+	if [ "$enable_ax" != "0" ]; then
+		json_get_vars \
+			he_su_beamformer:1 \
+			he_su_beamformee:1 \
+			he_mu_beamformer:1 \
+			he_twt_required:0 \
+			he_spr_sr_control:3 \
+			he_spr_psr_enabled:0 \
+			he_spr_non_srg_obss_pd_max_offset:0 \
+			he_bss_color:128 \
+			he_bss_color_enabled:1
+
+		he_phy_cap=$(iw phy "$phy" info | sed -n '/HE Iftypes: .*AP/,$p' | awk -F "[()]" '/HE PHY Capabilities/ { print $2 }' | head -1)
+		he_phy_cap=${he_phy_cap:2}
+		he_mac_cap=$(iw phy "$phy" info | sed -n '/HE Iftypes: .*AP/,$p' | awk -F "[()]" '/HE MAC Capabilities/ { print $2 }' | head -1)
+		he_mac_cap=${he_mac_cap:2}
+
+		append base_cfg "ieee80211ax=1" "$N"
+		[ "$hwmode" = "a" ] && {
+			append base_cfg "he_oper_chwidth=$vht_oper_chwidth" "$N"
+			append base_cfg "he_oper_centr_freq_seg0_idx=$vht_center_seg0" "$N"
+		}
+
+		mac80211_add_he_capabilities \
+			he_su_beamformer:${he_phy_cap:6:2}:0x80:$he_su_beamformer \
+			he_su_beamformee:${he_phy_cap:8:2}:0x1:$he_su_beamformee \
+			he_mu_beamformer:${he_phy_cap:8:2}:0x2:$he_mu_beamformer \
+			he_twt_required:${he_mac_cap:0:2}:0x6:$he_twt_required
+
+		if [ "$he_bss_color_enabled" -gt 0 ]; then
+			append base_cfg "he_bss_color=$he_bss_color" "$N"
+			[ "$he_spr_non_srg_obss_pd_max_offset" -gt 0 ] && { \
+				append base_cfg "he_spr_non_srg_obss_pd_max_offset=$he_spr_non_srg_obss_pd_max_offset" "$N"
+				he_spr_sr_control=$((he_spr_sr_control | (1 << 2)))
+			}
+			[ "$he_spr_psr_enabled" -gt 0 ] && he_spr_psr_enabled=$((0x${he_phy_cap:14:2} & 0x1))
+			[ "$he_spr_psr_enabled" -gt 0 ] || he_spr_sr_control=$((he_spr_sr_control | (1 << 0)))
+			append base_cfg "he_spr_sr_control=$he_spr_sr_control" "$N"
+		else
+			append base_cfg "he_bss_color_disabled=1" "$N"
+		fi
+
+
+		append base_cfg "he_default_pe_duration=4" "$N"
+		append base_cfg "he_rts_threshold=1023" "$N"
+		append base_cfg "he_mu_edca_qos_info_param_count=0" "$N"
+		append base_cfg "he_mu_edca_qos_info_q_ack=0" "$N"
+		append base_cfg "he_mu_edca_qos_info_queue_request=0" "$N"
+		append base_cfg "he_mu_edca_qos_info_txop_request=0" "$N"
+		append base_cfg "he_mu_edca_ac_be_aifsn=8" "$N"
+		append base_cfg "he_mu_edca_ac_be_aci=0" "$N"
+		append base_cfg "he_mu_edca_ac_be_ecwmin=9" "$N"
+		append base_cfg "he_mu_edca_ac_be_ecwmax=10" "$N"
+		append base_cfg "he_mu_edca_ac_be_timer=255" "$N"
+		append base_cfg "he_mu_edca_ac_bk_aifsn=15" "$N"
+		append base_cfg "he_mu_edca_ac_bk_aci=1" "$N"
+		append base_cfg "he_mu_edca_ac_bk_ecwmin=9" "$N"
+		append base_cfg "he_mu_edca_ac_bk_ecwmax=10" "$N"
+		append base_cfg "he_mu_edca_ac_bk_timer=255" "$N"
+		append base_cfg "he_mu_edca_ac_vi_ecwmin=5" "$N"
+		append base_cfg "he_mu_edca_ac_vi_ecwmax=7" "$N"
+		append base_cfg "he_mu_edca_ac_vi_aifsn=5" "$N"
+		append base_cfg "he_mu_edca_ac_vi_aci=2" "$N"
+		append base_cfg "he_mu_edca_ac_vi_timer=255" "$N"
+		append base_cfg "he_mu_edca_ac_vo_aifsn=5" "$N"
+		append base_cfg "he_mu_edca_ac_vo_aci=3" "$N"
+		append base_cfg "he_mu_edca_ac_vo_ecwmin=5" "$N"
+		append base_cfg "he_mu_edca_ac_vo_ecwmax=7" "$N"
+		append base_cfg "he_mu_edca_ac_vo_timer=255" "$N"
+	fi
+
+	if [ "$enable_be" != "0" ]; then
+		append base_cfg "ieee80211be=1" "$N"
+		[ "$hwmode" = "a" ] && {
+			append base_cfg "eht_oper_chwidth=$eht_oper_chwidth" "$N"
+			append base_cfg "eht_oper_centr_freq_seg0_idx=$eht_center_seg0" "$N"
+		}
+	fi
+
+	hostapd_prepare_device_config "$hostapd_conf_file" nl80211
+	cat >> "$hostapd_conf_file" <<EOF
+${channel:+channel=$channel}
+${channel_list:+chanlist=$channel_list}
+${hostapd_noscan:+noscan=1}
+${tx_burst:+tx_queue_data2_burst=$tx_burst}
+${multiple_bssid:+mbssid=$multiple_bssid}
+#num_global_macaddr=$num_global_macaddr
+#macaddr_base=$macaddr_base
+$base_cfg
+
+EOF
+	json_select ..
+}
+
+mac80211_hostapd_setup_bss() {
+	local phy="$1"
+	local ifname="$2"
+	local macaddr="$3"
+	local type="$4"
+
+	hostapd_cfg=
+	append hostapd_cfg "$type=$ifname" "$N"
+
+	hostapd_set_bss_options hostapd_cfg "$phy" "$vif" || return 1
+	json_get_vars wds wds_bridge dtim_period max_listen_int start_disabled
+
+	set_default wds 0
+	set_default start_disabled 0
+
+	[ "$wds" -gt 0 ] && {
+		append hostapd_cfg "wds_sta=1" "$N"
+		[ -n "$wds_bridge" ] && append hostapd_cfg "wds_bridge=$wds_bridge" "$N"
+	}
+	[ "$staidx" -gt 0 -o "$start_disabled" -eq 1 ] && append hostapd_cfg "start_disabled=1" "$N"
+
+	cat >> /var/run/hostapd-$phy$vif_phy_suffix.conf <<EOF
+$hostapd_cfg
+bssid=$macaddr
+${default_macaddr:+#default_macaddr}
+${dtim_period:+dtim_period=$dtim_period}
+${max_listen_int:+max_listen_interval=$max_listen_int}
+EOF
+}
+
+mac80211_get_addr() {
+	local phy="$1"
+	local idx="$(($2 + 1))"
+
+	head -n $idx /sys/class/ieee80211/${phy}/addresses | tail -n1
+}
+
+mac80211_generate_mac() {
+	local phy="$1"
+	local id="${macidx:-0}"
+
+	wdev_tool "$phy$phy_suffix" get_macaddr id=$id num_global=$num_global_macaddr mbssid=${multiple_bssid:-0} macaddr_base=${macaddr_base}
+}
+
+get_board_phy_name() (
+	local path="$1"
+	local fallback_phy=""
+
+	__check_phy() {
+		local val="$1"
+		local key="$2"
+		local ref_path="$3"
+
+		json_select "$key"
+		json_get_vars path
+		json_select ..
+
+		[ "${ref_path%+*}" = "$path" ] && fallback_phy=$key
+		[ "$ref_path" = "$path" ] || return 0
+
+		echo "$key"
+		exit
+	}
+
+	json_load_file /etc/board.json
+	json_for_each_item __check_phy wlan "$path"
+	[ -n "$fallback_phy" ] && echo "${fallback_phy}.${path##*+}"
+)
+
+rename_board_phy_by_path() {
+	local path="$1"
+
+	local new_phy="$(get_board_phy_name "$path")"
+	[ -z "$new_phy" -o "$new_phy" = "$phy" ] && return
+
+	iw "$phy" set name "$new_phy" && phy="$new_phy"
+}
+
+rename_board_phy_by_name() (
+	local phy="$1"
+	local suffix="${phy##*.}"
+	[ "$suffix" = "$phy" ] && suffix=
+
+	json_load_file /etc/board.json
+	json_select wlan
+	json_select "${phy%.*}" || return 0
+	json_get_vars path
+
+	prev_phy="$(iwinfo nl80211 phyname "path=$path${suffix:++$suffix}")"
+	[ -n "$prev_phy" ] || return 0
+
+	[ "$prev_phy" = "$phy" ] && return 0
+
+	iw "$prev_phy" set name "$phy"
+)
+
+find_phy() {
+	[ -n "$phy" ] && {
+		rename_board_phy_by_name "$phy"
+		[ -d /sys/class/ieee80211/$phy ] && return 0
+	}
+	[ -n "$path" ] && {
+		phy="$(iwinfo nl80211 phyname "path=$path")"
+		[ -n "$phy" ] && {
+			rename_board_phy_by_path "$path"
+			return 0
+		}
+	}
+	[ -n "$macaddr" ] && {
+		for phy in $(ls /sys/class/ieee80211 2>/dev/null); do
+			grep -i -q "$macaddr" "/sys/class/ieee80211/${phy}/macaddress" && {
+				path="$(iwinfo nl80211 path "$phy")"
+				rename_board_phy_by_path "$path"
+				return 0
+			}
+		done
+	}
+	return 1
+}
+
+mac80211_check_ap() {
+	has_ap=1
+}
+
+mac80211_set_ifname() {
+	local prefix="$1"
+	local type="$2"
+	eval "ifname=\"$prefix$type\${idx_$type:-0}\"; idx_$type=\$((\${idx_$type:-0 } + 1))"
+}
+
+mac80211_prepare_vif() {
+	json_select config
+
+	json_get_vars ifname mode ssid wds powersave macaddr enable wpa_psk_file sae_password_file vlan_file
+
+	[ -n "$ifname" ] || {
+		local prefix;
+
+		case "$mode" in
+		ap|sta|mesh) prefix=$mode;;
+		adhoc) prefix=ibss;;
+		monitor) prefix=mon;;
+		esac
+
+		mac80211_set_ifname "$ifname_prefix" "$prefix"
+	}
+
+	append active_ifnames "$ifname"
+	set_default wds 0
+	set_default powersave 0
+	json_add_string _ifname "$ifname"
+
+	default_macaddr=
+	if [ -z "$macaddr" ]; then
+		macaddr="$(mac80211_generate_mac $phy)"
+		macidx="$(($macidx + 1))"
+		default_macaddr=1
+	elif [ "$macaddr" = 'random' ]; then
+		macaddr="$(macaddr_random)"
+	fi
+	json_add_string _macaddr "$macaddr"
+	json_add_string _default_macaddr "$default_macaddr"
+	json_select ..
+
+
+	[ "$mode" == "ap" ] && {
+		json_select config
+		wireless_vif_parse_encryption
+		json_select ..
+
+		[ -z "$wpa_psk_file" ] && hostapd_set_psk "$ifname"
+		[ -z "$sae_password_file" ] && hostapd_set_sae "$ifname"
+		[ -z "$vlan_file" ] && hostapd_set_vlan "$ifname"
+	}
+
+	json_select config
+
+	# It is far easier to delete and create the desired interface
+	case "$mode" in
+		ap)
+			# Hostapd will handle recreating the interface and
+			# subsequent virtual APs belonging to the same PHY
+			if [ -n "$hostapd_ctrl" ]; then
+				type=bss
+			else
+				type=interface
+			fi
+
+			mac80211_hostapd_setup_bss "$phy" "$ifname" "$macaddr" "$type" || return
+
+			[ -n "$hostapd_ctrl" ] || {
+				ap_ifname="${ifname}"
+				hostapd_ctrl="${hostapd_ctrl:-/var/run/hostapd/$ifname}"
+			}
+		;;
+	esac
+
+	json_select ..
+}
+
+mac80211_prepare_iw_htmode() {
+	case "$htmode" in
+		HT20|VHT20|HE20|EHT20)
+			iw_htmode=HT20
+		;;
+		HT40*|VHT40|HE40|EHT40)
+			case "$band" in
+				2g)
+					case "$htmode" in
+						HT40+) iw_htmode="HT40+";;
+						HT40-) iw_htmode="HT40-";;
+						*)
+							if [ "$channel" -lt 7 ]; then
+								iw_htmode="HT40+"
+							else
+								iw_htmode="HT40-"
+							fi
+						;;
+					esac
+				;;
+				*)
+					case "$(( ($channel / 4) % 2 ))" in
+						1) iw_htmode="HT40+" ;;
+						0) iw_htmode="HT40-";;
+					esac
+				;;
+			esac
+			[ "$auto_channel" -gt 0 ] && iw_htmode="HT40+"
+		;;
+		VHT80|HE80|EHT80)
+			iw_htmode="80MHz"
+		;;
+		VHT160|HE160|EHT160)
+			iw_htmode="160MHz"
+		;;
+		NONE|NOHT)
+			iw_htmode="NOHT"
+		;;
+		*) iw_htmode="" ;;
+	esac
+}
+
+mac80211_add_mesh_params() {
+	for var in $MP_CONFIG_INT $MP_CONFIG_BOOL $MP_CONFIG_STRING; do
+		eval "mp_val=\"\$$var\""
+		[ -n "$mp_val" ] && json_add_string "$var" "$mp_val"
+	done
+}
+
+mac80211_setup_adhoc() {
+	local enable=$1
+	json_get_vars bssid ssid key mcast_rate
+
+	NEWUMLIST="${NEWUMLIST}$ifname "
+
+	[ "$enable" = 0 ] && {
+		ip link set dev "$ifname" down
+		return 0
+	}
+
+	keyspec=
+	[ "$auth_type" = "wep" ] && {
+		set_default key 1
+		case "$key" in
+			[1234])
+				local idx
+				for idx in 1 2 3 4; do
+					json_get_var ikey "key$idx"
+
+					[ -n "$ikey" ] && {
+						ikey="$(($idx - 1)):$(prepare_key_wep "$ikey")"
+						[ $idx -eq $key ] && ikey="d:$ikey"
+						append keyspec "$ikey"
+					}
+				done
+			;;
+			*)
+				append keyspec "d:0:$(prepare_key_wep "$key")"
+			;;
+		esac
+	}
+
+	brstr=
+	for br in $basic_rate_list; do
+		wpa_supplicant_add_rate brstr "$br"
+	done
+
+	mcval=
+	[ -n "$mcast_rate" ] && wpa_supplicant_add_rate mcval "$mcast_rate"
+
+	local prev
+	json_set_namespace wdev_uc prev
+
+	json_add_object "$ifname"
+	json_add_string mode adhoc
+	[ -n "$default_macaddr" ] || json_add_string macaddr "$macaddr"
+	json_add_string ssid "$ssid"
+	json_add_string freq "$freq"
+	json_add_string htmode "$iw_htmode"
+	[ -n "$bssid" ] && json_add_string bssid "$bssid"
+	json_add_int beacon-interval "$beacon_int"
+	[ -n "$brstr" ] && json_add_string basic-rates "$brstr"
+	[ -n "$mcval" ] && json_add_string mcast-rate "$mcval"
+	[ -n "$keyspec" ] && json_add_string keys "$keyspec"
+	json_close_object
+
+	json_set_namespace "$prev"
+}
+
+mac80211_setup_mesh() {
+	json_get_vars ssid mesh_id mcast_rate
+	json_get_values iface_basic_rate_list basic_rate
+
+	mcval=
+	[ -n "$mcast_rate" ] && wpa_supplicant_add_rate mcval "$mcast_rate"
+	[ -n "$mesh_id" ] && ssid="$mesh_id"
+
+	br_list="$basic_rate_list"
+	if [ -n "$iface_basic_rate_list" ]; then
+		br_list="$iface_basic_rate_list"
+	fi
+
+	brstr=
+	for br in $br_list; do
+		wpa_supplicant_add_rate brstr "$br"
+	done
+
+	local prev
+	json_set_namespace wdev_uc prev
+
+	json_add_object "$ifname"
+	json_add_string mode mesh
+	[ -n "$default_macaddr" ] || json_add_string macaddr "$macaddr"
+	json_add_string ssid "$ssid"
+	json_add_string freq "$freq"
+	json_add_string htmode "$iw_htmode"
+	[ -n "$mcval" ] && json_add_string mcast-rate "$mcval"
+	[ -n "$brstr" ] && json_add_string basic-rates "$brstr"
+	json_add_int beacon-interval "$beacon_int"
+	mac80211_add_mesh_params
+
+	json_close_object
+
+	json_set_namespace "$prev"
+}
+
+mac80211_setup_monitor() {
+	local prev
+	json_set_namespace wdev_uc prev
+
+	json_add_object "$ifname"
+	json_add_string mode monitor
+	[ -n "$freq" ] && json_add_string freq "$freq"
+	json_add_string htmode "$iw_htmode"
+	json_close_object
+
+	json_set_namespace "$prev"
+}
+
+mac80211_set_vif_txpower() {
+	local name="$1"
+
+	json_select config
+	json_get_var ifname _ifname
+	json_get_vars vif_txpower
+	json_select ..
+
+	set_default vif_txpower "$txpower"
+	if [ -n "$vif_txpower" ]; then
+		iw dev "$ifname" set txpower fixed "${vif_txpower%%.*}00"
+	else
+		iw dev "$ifname" set txpower auto
+	fi
+}
+
+wpa_supplicant_init_config() {
+	json_set_namespace wpa_supp prev
+
+	json_init
+	json_add_array config
+
+	json_set_namespace "$prev"
+}
+
+wpa_supplicant_add_interface() {
+	local ifname="$1"
+	local mode="$2"
+	local prev
+
+	_wpa_supplicant_common "$ifname"
+
+	json_set_namespace wpa_supp prev
+
+	json_add_object
+	json_add_string ctrl "$_rpath"
+	json_add_string iface "$ifname"
+	json_add_string mode "$mode"
+	json_add_string config "$_config"
+	[ -n "$default_macaddr" ] || json_add_string macaddr "$macaddr"
+	[ -n "$network_bridge" ] && json_add_string bridge "$network_bridge"
+	[ -n "$wds" ] && json_add_boolean 4addr "$wds"
+	json_add_boolean powersave "$powersave"
+	[ "$mode" = "mesh" ] && mac80211_add_mesh_params
+	json_close_object
+
+	json_set_namespace "$prev"
+
+	wpa_supp_init=1
+}
+
+wpa_supplicant_set_config() {
+	local phy="$1"
+	local radio="$2"
+	local prev
+
+	json_set_namespace wpa_supp prev
+	json_close_array
+	json_add_string phy "$phy"
+	json_add_int radio "$radio"
+	json_add_int num_global_macaddr "$num_global_macaddr"
+	json_add_string macaddr_base "$macaddr_base"
+	json_add_boolean defer 1
+	local data="$(json_dump)"
+
+	json_cleanup
+	json_set_namespace "$prev"
+
+	ubus -S -t 0 wait_for wpa_supplicant || {
+		[ -n "$wpa_supp_init" ] || return 0
+
+		ubus wait_for wpa_supplicant
+	}
+
+	local supplicant_res="$(ubus_call wpa_supplicant config_set "$data")"
+	ret="$?"
+	[ "$ret" != 0 -o -z "$supplicant_res" ] && wireless_setup_vif_failed WPA_SUPPLICANT_FAILED
+
+	wireless_add_process "$(jsonfilter -s "$supplicant_res" -l 1 -e @.pid)" "/usr/sbin/wpa_supplicant" 1 1
+
+}
+
+hostapd_set_config() {
+	local phy="$1"
+	local radio="$2"
+
+	[ -n "$hostapd_ctrl" ] || {
+		ubus_call hostapd config_set '{ "phy": "'"$phy"'", "radio": '"$radio"', "config": "", "prev_config": "'"${hostapd_conf_file}.prev"'" }' > /dev/null
+		return 0;
+	}
+
+	ubus wait_for hostapd
+	local hostapd_res="$(ubus_call hostapd config_set "{ \"phy\": \"$phy\", \"radio\": $radio, \"config\":\"${hostapd_conf_file}\", \"prev_config\": \"${hostapd_conf_file}.prev\"}")"
+	ret="$?"
+	[ "$ret" != 0 -o -z "$hostapd_res" ] && {
+		wireless_setup_failed HOSTAPD_START_FAILED
+		return
+	}
+	wireless_add_process "$(jsonfilter -s "$hostapd_res" -l 1 -e @.pid)" "/usr/sbin/hostapd" 1 1
+}
+
+
+wpa_supplicant_start() {
+	local phy="$1"
+	local radio="$2"
+
+	[ -n "$wpa_supp_init" ] || return 0
+
+	ubus_call wpa_supplicant config_set '{ "phy": "'"$phy"'", "radio": '"$radio"', "num_global_macaddr": '"$num_global_macaddr"', "macaddr_base": "'"$macaddr_base"'" }' > /dev/null
+}
+
+mac80211_setup_supplicant() {
+	local enable=$1
+	local add_sp=0
+
+	wpa_supplicant_prepare_interface "$ifname" nl80211 || return 1
+
+	if [ "$mode" = "sta" ]; then
+		wpa_supplicant_add_network "$ifname"
+	else
+		wpa_supplicant_add_network "$ifname" "$freq" "$htmode" "$hostapd_noscan"
+	fi
+
+	wpa_supplicant_add_interface "$ifname" "$mode"
+
+	return 0
+}
+
+mac80211_setup_vif() {
+	local name="$1"
+	local failed
+
+	json_select config
+	json_get_var ifname _ifname
+	json_get_var macaddr _macaddr
+	json_get_var default_macaddr _default_macaddr
+	json_get_vars mode wds powersave
+
+	set_default powersave 0
+	set_default wds 0
+
+	case "$mode" in
+		mesh)
+			json_get_vars $MP_CONFIG_INT $MP_CONFIG_BOOL $MP_CONFIG_STRING
+			wireless_vif_parse_encryption
+			[ -z "$htmode" ] && htmode="NOHT";
+			if [ -x /usr/sbin/wpa_supplicant ] && wpa_supplicant -vmesh; then
+				mac80211_setup_supplicant || failed=1
+			else
+				mac80211_setup_mesh
+			fi
+		;;
+		adhoc)
+			wireless_vif_parse_encryption
+			if [ "$wpa" -gt 0 -o "$auto_channel" -gt 0 ]; then
+				mac80211_setup_supplicant || failed=1
+			else
+				mac80211_setup_adhoc
+			fi
+		;;
+		sta)
+			mac80211_setup_supplicant || failed=1
+		;;
+		monitor)
+			mac80211_setup_monitor
+		;;
+	esac
+
+	json_select ..
+	[ -n "$failed" ] || wireless_add_vif "$name" "$ifname"
+}
+
+get_freq() {
+	local phy="$1"
+	local channel="$2"
+	local band="$3"
+
+	case "$band" in
+		2g) band="1:";;
+		5g) band="2:";;
+		60g) band="3:";;
+		6g) band="4:";;
+	esac
+
+	iw "$phy" info | awk -v band="$band" -v channel="[$channel]" '
+
+$1 ~ /Band/ {
+	band_match = band == $2
+}
+
+band_match && $3 == "MHz" && $4 == channel {
+	print int($2)
+	exit
+}
+'
+}
+
+chan_is_dfs() {
+	local phy="$1"
+	local chan="$2"
+	iw "$phy" info | grep -E -m1 "(\* ${chan:-....} MHz${chan:+|\\[$chan\\]})" | grep -q "MHz.*radar detection"
+	return $!
+}
+
+mac80211_set_noscan() {
+	hostapd_noscan=1
+}
+
+drv_mac80211_cleanup() {
+	:
+}
+
+mac80211_reset_config() {
+	hostapd_conf_file="/var/run/hostapd-$phy$vif_phy_suffix.conf"
+	ubus_call hostapd config_set '{ "phy": "'"$phy"'", "radio": '"$radio"', "config": "", "prev_config": "'"$hostapd_conf_file"'" }' > /dev/null
+	ubus_call wpa_supplicant config_set '{ "phy": "'"$phy"'", "radio": '"$radio"', "config": [] }' > /dev/null
+	wdev_tool "$phy$phy_suffix" set_config '{}'
+}
+
+mac80211_set_suffix() {
+	[ "$radio" = "-1" ] && radio=
+	phy_suffix="${radio:+:$radio}"
+	vif_phy_suffix="${radio:+.$radio}"
+	set_default radio -1
+}
+
+drv_mac80211_setup() {
+	json_select config
+	json_get_vars \
+		radio phy macaddr path \
+		country chanbw distance \
+		txpower \
+		rxantenna txantenna \
+		frag rts beacon_int:100 htmode \
+		num_global_macaddr:1 multiple_bssid \
+		ifname_prefix macaddr_base
+	json_get_values basic_rate_list basic_rate
+	json_get_values scan_list scan_list
+	json_select ..
+
+	mac80211_set_suffix
+
+	json_select data && {
+		json_get_var prev_rxantenna rxantenna
+		json_get_var prev_txantenna txantenna
+		json_select ..
+	}
+
+	find_phy || {
+		echo "Could not find PHY for device '$1'"
+		wireless_set_retry 0
+		return 1
+	}
+
+	set_default ifname_prefix "$phy$vif_phy_suffix-"
+
+	local wdev
+	local cwdev
+	local found
+
+	# convert channel to frequency
+	[ "$auto_channel" -gt 0 ] || freq="$(get_freq "$phy" "$channel" "$band")"
+
+	[ -n "$country" ] && {
+		iw reg get | grep -q "^country $country:" || {
+			iw reg set "$country"
+			sleep 1
+		}
+	}
+
+	hostapd_conf_file="/var/run/hostapd-$phy$vif_phy_suffix.conf"
+
+	macidx=0
+	staidx=0
+
+	[ -n "$chanbw" ] && {
+		for file in /sys/kernel/debug/ieee80211/$phy/ath9k*/chanbw /sys/kernel/debug/ieee80211/$phy/ath5k/bwmode; do
+			[ -f "$file" ] && echo "$chanbw" > "$file"
+		done
+	}
+
+	set_default rxantenna 0xffffffff
+	set_default txantenna 0xffffffff
+	set_default distance 0
+
+	[ "$txantenna" = "all" ] && txantenna=0xffffffff
+	[ "$rxantenna" = "all" ] && rxantenna=0xffffffff
+
+	[ "$rxantenna" = "$prev_rxantenna" -a "$txantenna" = "$prev_txantenna" ] || mac80211_reset_config "$phy"
+	wireless_set_data phy="$phy" radio="$radio" txantenna="$txantenna" rxantenna="$rxantenna"
+
+	iw phy "$phy" set antenna $txantenna $rxantenna >/dev/null 2>&1
+	iw phy "$phy" set distance "$distance" >/dev/null 2>&1
+
+	[ -n "$frag" ] && iw phy "$phy" set frag "${frag%%.*}"
+	[ -n "$rts" ] && iw phy "$phy" set rts "${rts%%.*}"
+
+	has_ap=
+	hostapd_ctrl=
+	ap_ifname=
+	hostapd_noscan=
+	wpa_supp_init=
+	for_each_interface "ap" mac80211_check_ap
+
+	[ -f "$hostapd_conf_file" ] && mv "$hostapd_conf_file" "$hostapd_conf_file.prev"
+
+	for_each_interface "sta adhoc mesh" mac80211_set_noscan
+	[ -n "$has_ap" ] && mac80211_hostapd_setup_base "$phy"
+
+	local prev
+	json_set_namespace wdev_uc prev
+	json_init
+	json_set_namespace "$prev"
+
+	wpa_supplicant_init_config
+
+	mac80211_prepare_iw_htmode
+	active_ifnames=
+	for_each_interface "ap sta adhoc mesh monitor" mac80211_prepare_vif
+	for_each_interface "ap sta adhoc mesh monitor" mac80211_setup_vif
+
+	[ -x /usr/sbin/wpa_supplicant ] && wpa_supplicant_set_config "$phy" "$radio"
+	[ -x /usr/sbin/hostapd ] && hostapd_set_config "$phy" "$radio"
+
+	[ -x /usr/sbin/wpa_supplicant ] && wpa_supplicant_start "$phy" "$radio"
+
+	json_set_namespace wdev_uc prev
+	wdev_tool "$phy$phy_suffix" set_config "$(json_dump)" $active_ifnames
+	json_set_namespace "$prev"
+
+	[ -z "$phy_suffix" ] && {
+		if [ -n "$txpower" ]; then
+			iw phy "$phy" set txpower fixed "${txpower%%.*}00"
+		else
+			iw phy "$phy" set txpower auto
+		fi
+	}
+
+	for_each_interface "ap sta adhoc mesh monitor" mac80211_set_vif_txpower
+	wireless_set_up
+}
+
+_list_phy_interfaces() {
+	local phy="$1"
+	if [ -d "/sys/class/ieee80211/${phy}/device/net" ]; then
+		ls "/sys/class/ieee80211/${phy}/device/net" 2>/dev/null;
+	else
+		ls "/sys/class/ieee80211/${phy}/device" 2>/dev/null | grep net: | sed -e 's,net:,,g'
+	fi
+}
+
+list_phy_interfaces() {
+	local phy="$1"
+
+	for dev in $(_list_phy_interfaces "$phy"); do
+		readlink "/sys/class/net/${dev}/phy80211" | grep -q "/${phy}\$" || continue
+		echo "$dev"
+	done
+}
+
+drv_mac80211_teardown() {
+	json_select data
+	json_get_vars phy radio
+	json_select ..
+	[ -n "$phy" ] || {
+		echo "Bug: PHY is undefined for device '$1'"
+		return 1
+	}
+
+	mac80211_set_suffix
+	mac80211_reset_config "$phy"
+}
+
+add_driver mac80211
diff --git a/wireless-scripts-example/old/mac80211-default.uc b/wireless-scripts-example/old/mac80211-default.uc
new file mode 100644
index 0000000000..5b202b4742
--- /dev/null
+++ b/wireless-scripts-example/old/mac80211-default.uc
@@ -0,0 +1,124 @@
+#!/usr/bin/env ucode
+import { readfile } from "fs";
+import * as uci from 'uci';
+
+const bands_order = [ "6G", "5G", "2G" ];
+const htmode_order = [ "EHT", "HE", "VHT", "HT" ];
+
+let board = json(readfile("/etc/board.json"));
+if (!board.wlan)
+	exit(0);
+
+let idx = 0;
+let commit;
+
+let config = uci.cursor().get_all("wireless") ?? {};
+
+function radio_exists(path, macaddr, phy, radio) {
+	for (let name, s in config) {
+		if (s[".type"] != "wifi-device")
+			continue;
+		if (radio != null && int(s.radio) != radio)
+			continue;
+		if (s.macaddr && lc(s.macaddr) == lc(macaddr))
+			return true;
+		if (s.phy == phy)
+			return true;
+		if (!s.path || !path)
+			continue;
+		if (substr(s.path, -length(path)) == path)
+			return true;
+	}
+}
+
+for (let phy_name, phy in board.wlan) {
+	let info = phy.info;
+	if (!info || !length(info.bands))
+		continue;
+
+	let radios = length(info.radios) > 0 ? info.radios : [{ bands: info.bands }];
+	for (let radio in radios) {
+		while (config[`radio${idx}`])
+			idx++;
+		let name = "radio" + idx;
+
+		let s = "wireless." + name;
+		let si = "wireless.default_" + name;
+
+		let band_name = filter(bands_order, (b) => radio.bands[b])[0];
+		if (!band_name)
+			continue;
+
+		let band = info.bands[band_name];
+		let rband = radio.bands[band_name];
+		let channel = rband.default_channel ?? "auto";
+
+		let width = band.max_width;
+		if (band_name == "2G")
+			width = 20;
+		else if (width > 80)
+			width = 80;
+
+		let htmode = filter(htmode_order, (m) => band[lc(m)])[0];
+		if (htmode)
+			htmode += width;
+		else
+			htmode = "NOHT";
+
+		if (!phy.path)
+			continue;
+
+		let macaddr = trim(readfile(`/sys/class/ieee80211/${phy_name}/macaddress`));
+		if (radio_exists(phy.path, macaddr, phy_name, radio.index))
+			continue;
+
+		let id = `phy='${phy_name}'`;
+		if (match(phy_name, /^phy[0-9]/))
+			id = `path='${phy.path}'`;
+
+		band_name = lc(band_name);
+
+		let country, encryption, defaults, num_global_macaddr;
+		if (band_name == '6g') {
+			country = '00';
+			encryption = 'owe';
+		} else {
+			encryption = 'open';
+		}
+		if (board.wlan.defaults) {
+			defaults = board.wlan.defaults.ssids?.[band_name]?.ssid ? board.wlan.defaults.ssids?.[band_name] : board.wlan.defaults.ssids?.all;
+			country = board.wlan.defaults.country;
+			if (!country && band_name != '2g')
+				defaults = null;
+			num_global_macaddr = board.wlan.defaults.ssids?.[band_name]?.mac_count;
+		}
+
+		if (length(info.radios) > 0)
+			id += `\nset ${s}.radio='${radio.index}'`;
+
+		print(`set ${s}=wifi-device
+set ${s}.type='mac80211'
+set ${s}.${id}
+set ${s}.band='${band_name}'
+set ${s}.channel='${channel}'
+set ${s}.htmode='${htmode}'
+set ${s}.country='${country || ''}'
+set ${s}.num_global_macaddr='${num_global_macaddr || ''}'
+
+set ${si}=wifi-iface
+set ${si}.device='${name}'
+set ${si}.network='lan'
+set ${si}.mode='ap'
+set ${si}.ssid='${defaults?.ssid || "OpenWrt"}'
+set ${si}.encryption='${defaults?.encryption || encryption}'
+set ${si}.key='${defaults?.key || ""}'
+set ${si}.disabled='${defaults ? 0 : 1}'
+
+`);
+		config[name] = {};
+		commit = true;
+	}
+}
+
+if (commit)
+	print("commit wireless\n");
diff --git a/wireless-scripts-example/old/mac80211-mtk-feed.sh b/wireless-scripts-example/old/mac80211-mtk-feed.sh
new file mode 100755
index 0000000000..27ff822c45
--- /dev/null
+++ b/wireless-scripts-example/old/mac80211-mtk-feed.sh
@@ -0,0 +1,1671 @@
+#!/bin/sh
+. /lib/netifd/netifd-wireless.sh
+. /lib/netifd/hostapd.sh
+. /lib/functions/system.sh
+
+init_wireless_driver "$@"
+
+MP_CONFIG_INT="mesh_retry_timeout mesh_confirm_timeout mesh_holding_timeout mesh_max_peer_links
+	       mesh_max_retries mesh_ttl mesh_element_ttl mesh_hwmp_max_preq_retries
+	       mesh_path_refresh_time mesh_min_discovery_timeout mesh_hwmp_active_path_timeout
+	       mesh_hwmp_preq_min_interval mesh_hwmp_net_diameter_traversal_time mesh_hwmp_rootmode
+	       mesh_hwmp_rann_interval mesh_gate_announcements mesh_sync_offset_max_neighor
+	       mesh_rssi_threshold mesh_hwmp_active_path_to_root_timeout mesh_hwmp_root_interval
+	       mesh_hwmp_confirmation_interval mesh_awake_window mesh_plink_timeout"
+MP_CONFIG_BOOL="mesh_auto_open_plinks mesh_fwding"
+MP_CONFIG_STRING="mesh_power_mode"
+
+wdev_tool() {
+	ucode /usr/share/hostap/wdev.uc "$@"
+}
+
+ubus_call() {
+	flock /var/run/hostapd.lock ubus call "$@"
+}
+
+drv_mac80211_init_device_config() {
+	hostapd_common_add_device_config
+
+	config_add_string path phy 'macaddr:macaddr'
+	config_add_string tx_burst
+	config_add_string distance
+	config_add_int radio beacon_int chanbw frag rts
+	config_add_int mbssid mu_onoff sr_enable sr_enhanced rnr obss_interval
+	config_add_int rxantenna txantenna txpower min_tx_power
+	config_add_int num_global_macaddr multiple_bssid
+	config_add_boolean noscan ht_coex acs_exclude_dfs background_radar
+	config_add_boolean noscan ht_coex acs_exclude_dfs background_radar background_cert_mode
+	config_add_array ht_capab
+	config_add_array channels
+	config_add_array scan_list
+	config_add_boolean \
+		rxldpc \
+		short_gi_80 \
+		short_gi_160 \
+		tx_stbc_2by1 \
+		su_beamformer \
+		su_beamformee \
+		mu_beamformer \
+		mu_beamformee \
+		he_su_beamformer \
+		he_su_beamformee \
+		he_mu_beamformer \
+		vht_txop_ps \
+		htc_vht \
+		rx_antenna_pattern \
+		tx_antenna_pattern \
+		he_spr_sr_control \
+		he_spr_psr_enabled \
+		he_bss_color_enabled \
+		he_twt_required \
+		he_twt_responder \
+		etxbfen \
+		itxbfen \
+		lpi_psd \
+		lpi_bcn_enhance
+	config_add_int \
+		beamformer_antennas \
+		beamformee_antennas \
+		vht_max_a_mpdu_len_exp \
+		vht_max_mpdu \
+		vht_link_adapt \
+		vht160 \
+		rx_stbc \
+		tx_stbc \
+		he_bss_color \
+		he_spr_non_srg_obss_pd_max_offset \
+		pp_bitmap \
+		pp_mode \
+		eml_disable \
+		eml_resp \
+		sku_idx \
+		lpi_sku_idx
+	config_add_boolean \
+		ldpc \
+		greenfield \
+		short_gi_20 \
+		short_gi_40 \
+		max_amsdu \
+		dsss_cck_40
+}
+
+drv_mac80211_init_iface_config() {
+	hostapd_common_add_bss_config
+
+	config_add_string 'macaddr:macaddr' ifname
+
+	config_add_boolean wds powersave enable
+	config_add_string wds_bridge
+	config_add_int maxassoc
+	config_add_int max_listen_int
+	config_add_int dtim_period
+	config_add_int start_disabled
+	config_add_int vif_txpower
+
+	# mesh
+	config_add_string mesh_id
+	config_add_int $MP_CONFIG_INT
+	config_add_boolean $MP_CONFIG_BOOL
+	config_add_string $MP_CONFIG_STRING
+}
+
+mac80211_add_capabilities() {
+	local __var="$1"; shift
+	local __mask="$1"; shift
+	local __out= oifs
+
+	oifs="$IFS"
+	IFS=:
+	for capab in "$@"; do
+		set -- $capab
+
+		[ "$(($4))" -gt 0 ] || continue
+		[ "$(($__mask & $2))" -eq "$((${3:-$2}))" ] || continue
+		__out="$__out[$1]"
+	done
+	IFS="$oifs"
+
+	export -n -- "$__var=$__out"
+}
+
+mac80211_add_he_capabilities() {
+	local __out= oifs
+
+	oifs="$IFS"
+	IFS=:
+	for capab in "$@"; do
+		set -- $capab
+		[ "$(($4))" -gt 0 ] || continue
+		[ "$(((0x$2) & $3))" -gt 0 ] || {
+			eval "$1=0"
+			continue
+		}
+		append base_cfg "$1=1" "$N"
+	done
+	IFS="$oifs"
+}
+
+mac80211_hostapd_setup_base() {
+	local phy="$1"
+
+	json_select config
+
+	[ "$auto_channel" -gt 0 ] && channel=acs_survey
+
+	[ "$auto_channel" -gt 0 ] && json_get_vars acs_exclude_dfs
+	[ -n "$acs_exclude_dfs" ] && [ "$acs_exclude_dfs" -gt 0 ] &&
+		append base_cfg "acs_exclude_dfs=1" "$N"
+
+	json_get_vars noscan ht_coex min_tx_power:0 tx_burst mbssid mu_onoff rnr obss_interval
+	json_get_vars etxbfen:1 itxbfen:0 eml_disable eml_resp lpi_psd sku_idx lpi_sku_idx lpi_bcn_enhance
+	json_get_values ht_capab_list ht_capab
+	json_get_values channel_list channels
+
+	[ "$min_tx_power" -gt 0 ] && append base_cfg "min_tx_power=$min_tx_power" "$N"
+
+	set_default noscan 0
+
+	[ "$noscan" -gt 0 ] && hostapd_noscan=1
+	[ "$tx_burst" = 0 ] && tx_burst=
+
+	chan_ofs=0
+	[ "$band" = "6g" ] && chan_ofs=1
+
+	if [ "$band" = "6g" ]; then
+		nl_band=4
+	elif [ "$band" = "5g" ]; then
+		nl_band=2
+	else
+		nl_band=1
+	fi
+
+	if [ "$band" != "6g" ]; then
+		ieee80211n=1
+		ht_capab=
+		case "$htmode" in
+			VHT20|HT20|HE20|EHT20) ;;
+			HT40*|VHT40|VHT80|VHT160|HE40*|HE80|HE160|EHT40*|EHT80|EHT160)
+				case "$hwmode" in
+					a)
+						case "$(( (($channel / 4) + $chan_ofs) % 2 ))" in
+							1) ht_capab="[HT40+]";;
+							0) ht_capab="[HT40-]";;
+						esac
+						case "$htmode" in
+							HT40-|HE40-|EHT40-)
+								if [ "$auto_channel" -gt 0 ]; then
+									ht_capab="[HT40-]"
+								fi
+								;;
+						esac
+						;;
+					*)
+						case "$htmode" in
+							HT40+|HE40+|EHT40+)
+								if [ "$channel" -gt 9 ]; then
+									echo "Could not set the center freq with this HT mode setting"
+									return 1
+								else
+									ht_capab="[HT40+]"
+								fi
+								;;
+							HT40-|HE40-|EHT40-)
+								if [ "$channel" -lt 5 -a "$auto_channel" -eq 0 ]; then
+									echo "Could not set the center freq with this HT mode setting"
+									return 1
+								else
+									ht_capab="[HT40-]"
+								fi
+								;;
+							*)
+								if [ "$channel" -lt 7 -o "$auto_channel" -gt 0 ]; then
+									ht_capab="[HT40+]"
+								else
+									ht_capab="[HT40-]"
+								fi
+								;;
+						esac
+						;;
+				esac
+				;;
+			*) ieee80211n= ;;
+		esac
+
+		[ -n "$ieee80211n" ] && {
+			append base_cfg "ieee80211n=1" "$N"
+
+			set_default ht_coex 0
+			append base_cfg "ht_coex=$ht_coex" "$N"
+
+			json_get_vars \
+				ldpc:1 \
+				greenfield:0 \
+				short_gi_20:1 \
+				short_gi_40:1 \
+				tx_stbc:1 \
+				rx_stbc:3 \
+				max_amsdu:1 \
+				dsss_cck_40:1
+
+			[ "$ht_coex" -eq 1 ] && {
+				set_default obss_interval 300
+				append base_cfg "obss_interval=$obss_interval" "$N"
+			}
+
+			ht_cap_mask=0
+			ht_cap_mask=$(iw phy "$phy" info | grep "Band ${nl_band}:" -A 1 | grep 'Capabilities: ' | cut -d: -f2)
+
+			cap_rx_stbc=$((($ht_cap_mask >> 8) & 3))
+			[ "$rx_stbc" -lt "$cap_rx_stbc" ] && cap_rx_stbc="$rx_stbc"
+			ht_cap_mask="$(( ($ht_cap_mask & ~(0x300)) | ($cap_rx_stbc << 8) ))"
+
+			mac80211_add_capabilities ht_capab_flags $ht_cap_mask \
+				LDPC:0x1::$ldpc \
+				GF:0x10::$greenfield \
+				SHORT-GI-20:0x20::$short_gi_20 \
+				SHORT-GI-40:0x40::$short_gi_40 \
+				TX-STBC:0x80::$tx_stbc \
+				RX-STBC1:0x300:0x100:1 \
+				RX-STBC12:0x300:0x200:1 \
+				RX-STBC123:0x300:0x300:1 \
+				MAX-AMSDU-7935:0x800::$max_amsdu \
+				DSSS_CCK-40:0x1000::$dsss_cck_40
+
+			ht_capab="$ht_capab$ht_capab_flags"
+			[ -n "$ht_capab" ] && append base_cfg "ht_capab=$ht_capab" "$N"
+		}
+	fi
+
+	# 802.11ac
+	enable_ac=0
+	vht_oper_chwidth=0
+	vht_center_seg0=
+
+	idx="$channel"
+	case "$htmode" in
+		VHT20|HE20|EHT20) enable_ac=1;;
+		VHT40|HE40|EHT40)
+			case "$(( (($channel / 4) + $chan_ofs) % 2 ))" in
+				1) idx=$(($channel + 2));;
+				0) idx=$(($channel - 2));;
+			esac
+			enable_ac=1
+			vht_center_seg0=$idx
+		;;
+		VHT80|HE80|EHT80)
+			case "$(( (($channel / 4) + $chan_ofs) % 4 ))" in
+				1) idx=$(($channel + 6));;
+				2) idx=$(($channel + 2));;
+				3) idx=$(($channel - 2));;
+				0) idx=$(($channel - 6));;
+			esac
+			enable_ac=1
+			vht_oper_chwidth=1
+			vht_center_seg0=$idx
+		;;
+		VHT160|HE160|EHT160|EHT320)
+			if [ "$band" = "6g" ]; then
+				case "$channel" in
+					1|5|9|13|17|21|25|29) idx=15;;
+					33|37|41|45|49|53|57|61) idx=47;;
+					65|69|73|77|81|85|89|93) idx=79;;
+					97|101|105|109|113|117|121|125) idx=111;;
+					129|133|137|141|145|149|153|157) idx=143;;
+					161|165|169|173|177|181|185|189) idx=175;;
+					193|197|201|205|209|213|217|221) idx=207;;
+				esac
+			else
+				case "$channel" in
+					36|40|44|48|52|56|60|64) idx=50;;
+					100|104|108|112|116|120|124|128) idx=114;;
+					149|153|157|161|165|169|173|177) idx=163;;
+				esac
+			fi
+			enable_ac=1
+			vht_oper_chwidth=2
+			vht_center_seg0=$idx
+		;;
+	esac
+	[ "$band" = "5g" ] && {
+		json_get_vars \
+			background_radar:0 \
+			background_cert_mode:0 \
+
+		[ "$background_radar" -eq 1 ] && append base_cfg "enable_background_radar=1" "$N"
+		[ "$background_cert_mode" -eq 1 ] && append base_cfg "background_radar_mode=1" "$N"
+	}
+
+	[ "$band" = "6g" ] && {
+		op_class=
+		case "$htmode" in
+			HE20|EHT20) op_class=131;;
+			EHT320*)
+				case "$channel" in
+					1|5|9|13|17|21|25|29| \
+					33|37|41|45|49|53|57|61) idx=31;;
+					65|69|73|77|81|85|89|93 |\
+					97|101|105|109|113|117|121|125) idx=95;;
+					129|133|137|141|145|149|153|157| \
+					161|165|169|173|177|181|185|189) idx=159;;
+					193|197|201|205|209|213|217|221) idx=191;;
+				esac
+				if [[ "$htmode" = "EHT320-1" && "$channel" -ge "193" ]] ||
+				   [[ "$htmode" = "EHT320-2" && "$channel" -le "29" ]]; then
+					echo "Could not set the center freq with this EHT setting"
+					return 1
+				elif [[ "$htmode" = "EHT320-2" && "$channel" -le "189" ]]; then
+					if [ "$channel" -gt $idx ]; then
+						idx=$(($idx + 32))
+					else
+						idx=$(($idx - 32))
+					fi
+				fi
+				vht_oper_chwidth=2
+				if [ "$channel" -gt $idx ]; then
+					vht_center_seg0=$(($idx + 16))
+				else
+					vht_center_seg0=$(($idx - 16))
+				fi
+				eht_oper_chwidth=9
+				eht_oper_centr_freq_seg0_idx=$idx
+
+				case $htmode in
+					EHT320-1) eht_bw320_offset=1;;
+					EHT320-2) eht_bw320_offset=2;;
+					EHT320) eht_bw320_offset=0;;
+				esac
+
+				op_class=137
+			;;
+			HE*|EHT*) op_class=$((132 + $vht_oper_chwidth))
+		esac
+		[ -n "$op_class" ] && append base_cfg "op_class=$op_class" "$N"
+	}
+
+	[ "$hwmode" = "a" ] || enable_ac=0
+	[ "$band" = "6g" ] && enable_ac=0
+
+	if [ "$enable_ac" != "0" ]; then
+		json_get_vars \
+			rxldpc:1 \
+			short_gi_80:1 \
+			short_gi_160:1 \
+			tx_stbc_2by1:1 \
+			su_beamformer:1 \
+			su_beamformee:1 \
+			mu_beamformer:1 \
+			mu_beamformee:1 \
+			vht_txop_ps:1 \
+			htc_vht:1 \
+			beamformee_antennas:5 \
+			beamformer_antennas:4 \
+			rx_antenna_pattern:1 \
+			tx_antenna_pattern:1 \
+			vht_max_a_mpdu_len_exp:7 \
+			vht_max_mpdu:11454 \
+			rx_stbc:4 \
+			vht_link_adapt:3 \
+			vht160:2
+
+		append base_cfg "ieee80211ac=1" "$N"
+		vht_cap=0
+		for cap in $(iw phy "$phy" info | awk -F "[()]" '/VHT Capabilities/ { print $2 }'); do
+			vht_cap="$(($vht_cap | $cap))"
+		done
+
+		append base_cfg "vht_oper_chwidth=$vht_oper_chwidth" "$N"
+		append base_cfg "vht_oper_centr_freq_seg0_idx=$vht_center_seg0" "$N"
+
+		cap_rx_stbc=$((($vht_cap >> 8) & 7))
+		[ "$rx_stbc" -lt "$cap_rx_stbc" ] && cap_rx_stbc="$rx_stbc"
+		vht_cap="$(( ($vht_cap & ~(0x700)) | ($cap_rx_stbc << 8) ))"
+
+		[ "$vht_oper_chwidth" -lt 2 ] && {
+			short_gi_160=0
+		}
+
+		[ "$etxbfen" -eq 0 ] && {
+			su_beamformer=0
+			su_beamformee=0
+			mu_beamformer=0
+		}
+
+		mac80211_add_capabilities vht_capab $vht_cap \
+			RXLDPC:0x10::$rxldpc \
+			SHORT-GI-80:0x20::$short_gi_80 \
+			SHORT-GI-160:0x40::$short_gi_160 \
+			TX-STBC-2BY1:0x80::$tx_stbc_2by1 \
+			SU-BEAMFORMER:0x800::$su_beamformer \
+			SU-BEAMFORMEE:0x1000::$su_beamformee \
+			MU-BEAMFORMER:0x80000::$mu_beamformer \
+			MU-BEAMFORMEE:0x100000::$mu_beamformee \
+			VHT-TXOP-PS:0x200000::$vht_txop_ps \
+			HTC-VHT:0x400000::$htc_vht \
+			RX-ANTENNA-PATTERN:0x10000000::$rx_antenna_pattern \
+			TX-ANTENNA-PATTERN:0x20000000::$tx_antenna_pattern \
+			RX-STBC-1:0x700:0x100:1 \
+			RX-STBC-12:0x700:0x200:1 \
+			RX-STBC-123:0x700:0x300:1 \
+			RX-STBC-1234:0x700:0x400:1 \
+
+		[ "$(($vht_cap & 0x800))" -gt 0 -a "$su_beamformer" -gt 0 ] && {
+			cap_ant="$(( ( ($vht_cap >> 16) & 3 ) + 1 ))"
+			[ "$cap_ant" -gt "$beamformer_antennas" ] && cap_ant="$beamformer_antennas"
+			[ "$cap_ant" -gt 1 ] && vht_capab="$vht_capab[SOUNDING-DIMENSION-$cap_ant]"
+		}
+
+		[ "$(($vht_cap & 0x1000))" -gt 0 -a "$su_beamformee" -gt 0 ] && {
+			cap_ant="$(( ( ($vht_cap >> 13) & 7 ) + 1 ))"
+			[ "$cap_ant" -gt "$beamformee_antennas" ] && cap_ant="$beamformee_antennas"
+			[ "$cap_ant" -gt 1 ] && vht_capab="$vht_capab[BF-ANTENNA-$cap_ant]"
+		}
+
+		# supported Channel widths
+		vht160_hw=0
+		[ "$(($vht_cap & 12))" -eq 4 -a 1 -le "$vht160" ] && \
+			vht160_hw=1
+		[ "$(($vht_cap & 12))" -eq 8 -a 2 -le "$vht160" ] && \
+			vht160_hw=2
+		[ "$vht160_hw" = 1 ] && vht_capab="$vht_capab[VHT160]"
+		[ "$vht160_hw" = 2 ] && vht_capab="$vht_capab[VHT160-80PLUS80]"
+
+		# maximum MPDU length
+		vht_max_mpdu_hw=3895
+		[ "$(($vht_cap & 3))" -ge 1 -a 7991 -le "$vht_max_mpdu" ] && \
+			vht_max_mpdu_hw=7991
+		[ "$(($vht_cap & 3))" -ge 2 -a 11454 -le "$vht_max_mpdu" ] && \
+			vht_max_mpdu_hw=11454
+		[ "$vht_max_mpdu_hw" != 3895 ] && \
+			vht_capab="$vht_capab[MAX-MPDU-$vht_max_mpdu_hw]"
+
+		# maximum A-MPDU length exponent
+		vht_max_a_mpdu_len_exp_hw=0
+		[ "$(($vht_cap & 58720256))" -ge 8388608 -a 1 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=1
+		[ "$(($vht_cap & 58720256))" -ge 16777216 -a 2 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=2
+		[ "$(($vht_cap & 58720256))" -ge 25165824 -a 3 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=3
+		[ "$(($vht_cap & 58720256))" -ge 33554432 -a 4 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=4
+		[ "$(($vht_cap & 58720256))" -ge 41943040 -a 5 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=5
+		[ "$(($vht_cap & 58720256))" -ge 50331648 -a 6 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=6
+		[ "$(($vht_cap & 58720256))" -ge 58720256 -a 7 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=7
+		vht_capab="$vht_capab[MAX-A-MPDU-LEN-EXP$vht_max_a_mpdu_len_exp_hw]"
+
+		# whether or not the STA supports link adaptation using VHT variant
+		vht_link_adapt_hw=0
+		[ "$(($vht_cap & 201326592))" -ge 134217728 -a 2 -le "$vht_link_adapt" ] && \
+			vht_link_adapt_hw=2
+		[ "$(($vht_cap & 201326592))" -ge 201326592 -a 3 -le "$vht_link_adapt" ] && \
+			vht_link_adapt_hw=3
+		[ "$vht_link_adapt_hw" != 0 ] && \
+			vht_capab="$vht_capab[VHT-LINK-ADAPT-$vht_link_adapt_hw]"
+
+		[ -n "$vht_capab" ] && append base_cfg "vht_capab=$vht_capab" "$N"
+	fi
+
+	# 802.11ax
+	enable_ax=0
+	enable_be=0
+	case "$htmode" in
+		HE*) enable_ax=1 ;;
+		EHT*) enable_ax=1; enable_be=1 ;;
+	esac
+
+	if [ "$enable_ax" != "0" ]; then
+		json_get_vars \
+			he_su_beamformer:1 \
+			he_su_beamformee:1 \
+			he_mu_beamformer:1 \
+			he_twt_required:0 \
+			he_twt_responder \
+			he_spr_sr_control:3 \
+			he_spr_psr_enabled:0 \
+			he_spr_non_srg_obss_pd_max_offset:0 \
+			he_bss_color \
+			he_bss_color_enabled:1
+
+		he_phy_cap=$(iw phy "$phy" info | sed -n '/Band '"${nl_band}"'/,$p' | sed -n '/HE Iftypes: .*AP/,$p' | awk -F "[()]" '/HE PHY Capabilities/ { print $2 }' | head -1)
+		he_phy_cap=${he_phy_cap:2}
+		he_mac_cap=$(iw phy "$phy" info | sed -n '/Band '"${nl_band}"'/,$p' | sed -n '/HE Iftypes: .*AP/,$p' | awk -F "[()]" '/HE MAC Capabilities/ { print $2 }' | head -1)
+		he_mac_cap=${he_mac_cap:2}
+
+		append base_cfg "ieee80211ax=1" "$N"
+		[ "$hwmode" = "a" ] && {
+			append base_cfg "he_oper_chwidth=$vht_oper_chwidth" "$N"
+			append base_cfg "he_oper_centr_freq_seg0_idx=$vht_center_seg0" "$N"
+		}
+
+		[ "$etxbfen" -eq 0 ] && {
+			he_su_beamformer=0
+			he_mu_beamformer=0
+		}
+
+		mac80211_add_he_capabilities \
+			he_su_beamformer:${he_phy_cap:6:2}:0x80:$he_su_beamformer \
+			he_su_beamformee:${he_phy_cap:8:2}:0x1:$he_su_beamformee \
+			he_mu_beamformer:${he_phy_cap:8:2}:0x2:$he_mu_beamformer \
+			he_spr_psr_enabled:${he_phy_cap:14:2}:0x1:$he_spr_psr_enabled \
+			he_twt_required:${he_mac_cap:0:2}:0x6:$he_twt_required
+
+		if [ -n "$he_twt_responder" ]; then
+			append base_cfg "he_twt_responder=$he_twt_responder" "$N"
+		fi
+		if [ "$he_bss_color_enabled" -gt 0 ]; then
+			if !([ "$he_bss_color" -gt 0 ] && [ "$he_bss_color" -le 64 ]); then
+				rand=$(head -n 1 /dev/urandom | tr -dc 0-9 | head -c 2 | sed 's/^0*//')
+				he_bss_color=$((rand % 63 + 1))
+			fi
+			append base_cfg "he_bss_color=$he_bss_color" "$N"
+			[ "$he_spr_non_srg_obss_pd_max_offset" -gt 0 ] && { \
+				append base_cfg "he_spr_non_srg_obss_pd_max_offset=$he_spr_non_srg_obss_pd_max_offset" "$N"
+				he_spr_sr_control=$((he_spr_sr_control | (1 << 2)))
+			}
+			[ "$he_spr_psr_enabled" -gt 0 ] || he_spr_sr_control=$((he_spr_sr_control | (1 << 0)))
+			append base_cfg "he_spr_sr_control=$he_spr_sr_control" "$N"
+		else
+			append base_cfg "he_bss_color_disabled=1" "$N"
+		fi
+
+
+		append base_cfg "he_default_pe_duration=4" "$N"
+		append base_cfg "he_rts_threshold=1023" "$N"
+		append base_cfg "he_mu_edca_qos_info_param_count=0" "$N"
+		append base_cfg "he_mu_edca_qos_info_q_ack=0" "$N"
+		append base_cfg "he_mu_edca_qos_info_queue_request=0" "$N"
+		append base_cfg "he_mu_edca_qos_info_txop_request=0" "$N"
+		append base_cfg "he_mu_edca_ac_be_aifsn=0" "$N"
+		append base_cfg "he_mu_edca_ac_be_aci=0" "$N"
+		append base_cfg "he_mu_edca_ac_be_ecwmin=9" "$N"
+		append base_cfg "he_mu_edca_ac_be_ecwmax=10" "$N"
+		append base_cfg "he_mu_edca_ac_be_timer=3" "$N"
+		append base_cfg "he_mu_edca_ac_bk_aifsn=0" "$N"
+		append base_cfg "he_mu_edca_ac_bk_aci=1" "$N"
+		append base_cfg "he_mu_edca_ac_bk_ecwmin=9" "$N"
+		append base_cfg "he_mu_edca_ac_bk_ecwmax=10" "$N"
+		append base_cfg "he_mu_edca_ac_bk_timer=3" "$N"
+		append base_cfg "he_mu_edca_ac_vi_ecwmin=5" "$N"
+		append base_cfg "he_mu_edca_ac_vi_ecwmax=7" "$N"
+		append base_cfg "he_mu_edca_ac_vi_aifsn=0" "$N"
+		append base_cfg "he_mu_edca_ac_vi_aci=2" "$N"
+		append base_cfg "he_mu_edca_ac_vi_timer=3" "$N"
+		append base_cfg "he_mu_edca_ac_vo_aifsn=0" "$N"
+		append base_cfg "he_mu_edca_ac_vo_aci=3" "$N"
+		append base_cfg "he_mu_edca_ac_vo_ecwmin=5" "$N"
+		append base_cfg "he_mu_edca_ac_vo_ecwmax=7" "$N"
+		append base_cfg "he_mu_edca_ac_vo_timer=3" "$N"
+	fi
+
+	set_default tx_burst 2
+
+	# 802.11be
+	enable_be=0
+	case "$htmode" in
+		EHT*) enable_be=1 ;;
+	esac
+
+	if [ "$enable_be" != "0" ]; then
+
+		json_get_vars \
+			pp_bitmap \
+			pp_mode
+
+		append base_cfg "ieee80211be=1" "$N"
+		if [ "$etxbfen" -eq 0 ]; then
+			append base_cfg "eht_su_beamformee=1" "$N"
+		else
+			append base_cfg "eht_su_beamformer=1" "$N"
+			append base_cfg "eht_su_beamformee=1" "$N"
+			append base_cfg "eht_mu_beamformer=1" "$N"
+		fi
+		[ "$hwmode" = "a" ] && {
+			case $htmode in
+				EHT320*)
+					append base_cfg "eht_oper_chwidth=$eht_oper_chwidth" "$N"
+					append base_cfg "eht_oper_centr_freq_seg0_idx=$eht_oper_centr_freq_seg0_idx" "$N"
+					append base_cfg "eht_bw320_offset=$eht_bw320_offset" "$N"
+				;;
+				*)
+					append base_cfg "eht_oper_chwidth=$vht_oper_chwidth" "$N"
+					append base_cfg "eht_oper_centr_freq_seg0_idx=$vht_center_seg0" "$N"
+				;;
+			esac
+		}
+
+		if [ -n "$pp_bitmap" ]; then
+			append base_cfg "punct_bitmap=$pp_bitmap" "$N"
+		fi
+
+		if [ -n "$pp_mode" ]; then
+			append base_cfg "pp_mode=$pp_mode" "$N"
+		fi
+	fi
+
+	hostapd_prepare_device_config "$hostapd_conf_file" nl80211
+	cat >> "$hostapd_conf_file" <<EOF
+${channel:+channel=$channel}
+${channel_list:+chanlist=$channel_list}
+${hostapd_noscan:+noscan=1}
+${tx_burst:+tx_queue_data2_burst=$tx_burst}
+${mbssid:+mbssid=$mbssid}
+${mu_onoff:+mu_onoff=$mu_onoff}
+${itxbfen:+ibf_enable=$itxbfen}
+${rnr:+rnr=$rnr}
+${multiple_bssid:+mbssid=$multiple_bssid}
+${eml_disable:+eml_disable=$eml_disable}
+${eml_resp:+eml_resp=$eml_resp}
+${lpi_psd:+lpi_psd=$lpi_psd}
+${lpi_bcn_enhance:+lpi_bcn_enhance=$lpi_bcn_enhance}
+${sku_idx:+sku_idx=$sku_idx}
+${lpi_sku_idx:+lpi_sku_idx=$lpi_sku_idx}
+#num_global_macaddr=$num_global_macaddr
+$base_cfg
+
+EOF
+	json_select ..
+}
+
+mac80211_hostapd_setup_bss() {
+	local phy="$1"
+	local ifname="$2"
+	local macaddr="$3"
+	local type="$4"
+
+	hostapd_cfg=
+	append hostapd_cfg "$type=$ifname" "$N"
+
+	hostapd_set_bss_options hostapd_cfg "$phy" "$vif" || return 1
+	json_get_vars wds wds_bridge dtim_period max_listen_int start_disabled
+
+	set_default wds 0
+	set_default start_disabled 0
+
+	[ "$wds" -gt 0 ] && {
+		append hostapd_cfg "wds_sta=1" "$N"
+		[ -n "$wds_bridge" ] && append hostapd_cfg "wds_bridge=$wds_bridge" "$N"
+	}
+	[ "$start_disabled" -eq 1 ] && append hostapd_cfg "start_disabled=1" "$N"
+
+	cat >> /var/run/hostapd-$phy$vif_phy_suffix.conf <<EOF
+$hostapd_cfg
+bssid=$macaddr
+${dtim_period:+dtim_period=$dtim_period}
+${max_listen_int:+max_listen_interval=$max_listen_int}
+EOF
+}
+
+mac80211_generate_mbssid_mac() {
+	local phy="$1"
+	local transmitted_bssid="$2"
+	local id="${mbssidx:-0}"
+
+	local ref="$(cat /sys/class/ieee80211/${phy}/macaddress)"
+
+	if [ -z "$transmitted_bssid" ]; then
+		transmitted_bssid=$ref
+	fi
+
+	if [ $id -eq 0 ]; then
+		echo "$transmitted_bssid"
+		return
+	fi
+
+	local oIFS="$IFS"; IFS=":"; set -- $transmitted_bssid; IFS="$oIFS"
+
+	# Calculate nontransmitted bssid
+	b6="0x$6"
+	ref_b6=$(($b6 % $max_mbssid))
+	b6=$(($b6 - $ref_b6 + ($ref_b6 + $id) % $max_mbssid))
+	printf "%s:%s:%s:%s:%s:%02x" $1 $2 $3 $4 $5 $b6
+}
+
+mac80211_get_addr() {
+	local phy="$1"
+	local idx="$(($2 + 1))"
+
+	head -n $idx /sys/class/ieee80211/${phy}/addresses | tail -n1
+}
+
+mac80211_generate_mac() {
+	local phy="$1"
+	local id="${macidx:-0}"
+
+	if [ "$phy" = "mld" ]; then
+		id=60;
+		phy=phy0;
+	fi
+	wdev_tool "$phy$phy_suffix" get_macaddr id=$id num_global=$num_global_macaddr mbssid=${multiple_bssid:-0}
+}
+
+get_board_phy_name() (
+	local path="$1"
+	local fallback_phy=""
+
+	__check_phy() {
+		local val="$1"
+		local key="$2"
+		local ref_path="$3"
+
+		json_select "$key"
+		json_get_vars path
+		json_select ..
+
+		[ "${ref_path%+*}" = "$path" ] && fallback_phy=$key
+		[ "$ref_path" = "$path" ] || return 0
+
+		echo "$key"
+		exit
+	}
+
+	json_load_file /etc/board.json
+	json_for_each_item __check_phy wlan "$path"
+	[ -n "$fallback_phy" ] && echo "${fallback_phy}.${path##*+}"
+)
+
+rename_board_phy_by_path() {
+	local path="$1"
+
+	local new_phy="$(get_board_phy_name "$path")"
+	[ -z "$new_phy" -o "$new_phy" = "$phy" ] && return
+
+	iw "$phy" set name "$new_phy" && phy="$new_phy"
+}
+
+rename_board_phy_by_name() (
+	local phy="$1"
+	local suffix="${phy##*.}"
+	[ "$suffix" = "$phy" ] && suffix=
+
+	json_load_file /etc/board.json
+	json_select wlan
+	json_select "${phy%.*}" || return 0
+	json_get_vars path
+
+	prev_phy="$(iwinfo nl80211 phyname "path=$path${suffix:++$suffix}")"
+	[ -n "$prev_phy" ] || return 0
+
+	[ "$prev_phy" = "$phy" ] && return 0
+
+	iw "$prev_phy" set name "$phy"
+)
+
+find_phy() {
+	[ -n "$phy" ] && {
+		rename_board_phy_by_name "$phy"
+		[ -d /sys/class/ieee80211/$phy ] && return 0
+	}
+	[ -n "$path" ] && {
+		phy="$(iwinfo nl80211 phyname "path=$path")"
+		[ -n "$phy" ] && {
+			rename_board_phy_by_path "$path"
+			return 0
+		}
+	}
+	[ -n "$macaddr" ] && {
+		for phy in $(ls /sys/class/ieee80211 2>/dev/null); do
+			grep -i -q "$macaddr" "/sys/class/ieee80211/${phy}/macaddress" && {
+				path="$(iwinfo nl80211 path "$phy")"
+				rename_board_phy_by_path "$path"
+				return 0
+			}
+		done
+	}
+	return 1
+}
+
+mac80211_check_ap() {
+	has_ap=1
+}
+
+mac80211_set_ifname() {
+	local phy="$1"
+	local prefix="$2"
+	eval "ifname=\"$phy-$prefix\${idx_$prefix:-0}\"; idx_$prefix=\$((\${idx_$prefix:-0 } + 1))"
+}
+
+find_colocated_sta() {
+	local own_radio_idx=$1
+
+	iface_list="$(cat /etc/config/wireless | grep wifi-iface | cut -d ' ' -f3 | tr -s "'\n" ' ')"
+	for iface in $iface_list
+	do
+		local mode="$(uci show wireless.$iface.mode | cut -d '=' -f2 | tr -d "'")"
+		local ifname="$(uci show wireless.$iface | grep ifname | cut -d '=' -f2 | tr -d "'")"
+		[ -n "$ifname" ] && [ "$mode" == "sta" ] && {
+			local mld_allowed_phy_bitmap="$(uci show wireless.$iface | grep mld_allowed_phy_bitmap | cut -d '=' -f2 | tr -d "'")"
+			[ -n "$mld_allowed_phy_bitmap" ] && [ $(($mld_allowed_phy_bitmap & $((1<<$own_radio_idx)))) ] && append active_ifnames "$ifname"
+		}
+	done
+}
+
+fill_mld_params() {
+	local target_mld_id=$1
+	local own_phy_idx=$(echo $2 | tr -d "phy")
+	local own_radio_idx=$3
+	local found_mld=0
+	local is_mld_link_id_set=0
+	local is_primary=1
+	local mld_allowed_links=0
+	local mld_radio_mask=0
+
+	iface_list="$(cat /etc/config/wireless | grep wifi-iface | cut -d ' ' -f3 | tr -s "'\n" ' ')"
+	for iface in $iface_list
+	do
+		local mld_id="$(uci show wireless.$iface | grep "mld_id" | cut -d '=' -f2 | tr -d "'")"
+		local mld_link_id="$(uci show wireless.$iface | grep "mld_link_id" | cut -d '=' -f2 | tr -d "'")"
+		local device="$(uci show wireless.$iface.device | cut -d '=' -f2 | tr -d "'")"
+		local iface_disabled="$(uci show wireless.$iface | grep "disabled" | cut -d '=' -f2 | tr -d "'")"
+		local ht_mode="$(uci show wireless.$device.htmode | cut -d '=' -f2 | tr -d "'")"
+		local partner_radio_idx="$(uci show wireless.$device.radio | cut -d '=' -f2 | tr -d "'")"
+
+		if [ "$iface_disabled" != "1" ] && [ "$mld_id" = "$target_mld_id" ] && [[ "$ht_mode" == "EHT"* ]]; then
+			if [ -n "$mld_link_id" ]; then
+				is_mld_link_id_set=1
+				mld_allowed_links=$(($mld_allowed_links + 2**$mld_link_id))
+			elif [ "$is_mld_link_id_set" -eq 1 ]; then
+				echo "MLD link id should be set on every link"
+				return 1
+			else
+				mld_allowed_links=$(($mld_allowed_links * 2 + 1))
+			fi
+
+			[ $partner_radio_idx -lt $own_radio_idx ] && is_primary=0
+			mld_radio_mask=$(($mld_radio_mask + 2**$partner_radio_idx))
+		fi
+	done
+
+	json_add_string "mld_primary" $is_primary
+	json_add_string "mld_allowed_links" $mld_allowed_links
+	json_add_string "mld_radio_mask" $mld_radio_mask
+
+        mld_list="$(cat /etc/config/wireless | grep wifi-mld | cut -d ' ' -f3 | tr -s "'\n" ' ')"
+        for m in $mld_list
+        do
+		local mld_id="$(uci show wireless.$m | grep "mld_id" | cut -d '=' -f2 | tr -d "'")"
+		[ $mld_id = $target_mld_id ] || continue
+		found_mld=1
+
+                option_list="$(uci show wireless.$m | tr -s "\n" ' ')"
+                for option in $option_list
+                do
+                        local key="$(echo $option | cut -d '=' -f1 | cut -d '.' -f3)"
+                        local val="$(echo $option | cut -d '=' -f2 | tr -d "'")"
+			[ -n "$key" ] && json_add_string $key $val
+                done
+        done
+
+	if [ $found_mld -eq 0 ]; then
+		echo "mld_id $target_mld_id is not found"
+		return 1
+	fi
+
+	if [ $target_mld_id -lt 1 ] || [ $target_mld_id -gt 16 ]; then
+		echo "mld_id is out of range (1, 16)"
+		return 1
+	fi
+
+	return 0
+}
+
+mac80211_prepare_vif() {
+	json_select config
+	json_get_vars mld_id
+
+	if [ -n "$mld_id" ] && [[ "$htmode" != "EHT"* ]]; then
+		json_select config
+		json_select ..
+		return
+	fi
+
+	if [ -n "$mld_id" ]; then
+		fill_mld_params $mld_id $phy $radio || return
+
+		json_get_vars mld_addr
+		if [ -z "$mld_addr" ]; then
+			generated_mac=$(mac80211_generate_mac mld)
+			# Split the MAC address to get the first byte
+			b1="${generated_mac%%:*}"
+
+			# Convert the first byte to a decimal for arithmetic operations
+			b1_dec=$((0x$b1))
+
+			# Get the upper 5 bits (first digit in hexadecimal representation)
+			upper_nibble=$(($b1_dec & 0xF8))
+
+			# Rotate the upper 5 bits based on mld_id
+			# Modulus by 32 ensures that the rotation stays within the bounds of a nibble (5 bits)
+			rotated=$(( (upper_nibble + ($mld_id << 3)) & 0xF8 ))
+
+			# Combine the lower 3 bits with the rotated upper 5 bits
+			b1_rotated=$(($b1_dec & 0x07 | rotated))
+
+			# Reassemble the MAC address
+			result_mac="$(printf '%02X' $b1_rotated):${generated_mac#*:}"
+
+			# Add the MAC address to the JSON object
+			json_add_string mld_addr "$result_mac"
+		fi
+	fi
+
+	json_get_vars ifname mode ssid wds powersave macaddr enable wpa_psk_file sae_password_file vlan_file mld_primary
+
+	[ -n "$ifname" ] || {
+		local prefix;
+
+		case "$mode" in
+		ap|sta|mesh) prefix=$mode;;
+		adhoc) prefix=ibss;;
+		monitor) prefix=mon;;
+		esac
+
+		mac80211_set_ifname "$phy$vif_phy_suffix" "$prefix"
+	}
+
+	append active_ifnames "$ifname"
+	set_default wds 0
+	set_default powersave 0
+	json_add_string _ifname "$ifname"
+
+	if [ "$mbssid" -gt 0 ] && [ "$mode" == "ap" ]; then
+		[ "$mbssidx" -eq 0 ] && {
+			if [ -z $macaddr ]; then
+				transmitted_bssid="$(mac80211_generate_mac $phy)"
+			else
+				# uci set mac address
+				transmitted_bssid=$macaddr
+			fi
+			macidx="$(($macidx + 1))"
+		}
+		macaddr="$(mac80211_generate_mbssid_mac $phy $transmitted_bssid)"
+		mbssidx="$(($mbssidx + 1))"
+	elif [ -z "$macaddr" ]; then
+		macaddr="$(mac80211_generate_mac $phy)"
+		macidx="$(($macidx + 1))"
+	elif [ "$macaddr" = 'random' ]; then
+		macaddr="$(macaddr_random)"
+	fi
+	json_add_string _macaddr "$macaddr"
+	json_select ..
+
+
+	[ "$mode" == "ap" ] && [ "$mld_primary" != "0" ] && {
+		json_select config
+		wireless_vif_parse_encryption
+		json_select ..
+
+		[ -z "$wpa_psk_file" ] && hostapd_set_psk "$ifname"
+		[ -z "$sae_password_file" ] && hostapd_set_sae "$ifname"
+		[ -z "$vlan_file" ] && hostapd_set_vlan "$ifname"
+	}
+
+	json_select config
+
+	# It is far easier to delete and create the desired interface
+	case "$mode" in
+		ap)
+			# Hostapd will handle recreating the interface and
+			# subsequent virtual APs belonging to the same PHY
+			if [ -n "$hostapd_ctrl" ]; then
+				type=bss
+			else
+				type=interface
+			fi
+
+			local retry=5
+			local ifname_folder="/sys/class/ieee80211/$phy/device/net/$ifname"
+			while [ "$retry" -gt 0 ] && [ "$mld_primary" -eq 0 ] && [ ! -d $ifname_folder ]
+			do
+				echo "$phy:$ifname is not mld primary and does not exist, sleep 1s"
+				retry=$((retry - 1))
+				sleep 1
+			done
+
+			[ "$retry" -eq 0 ] && [ ! -d $ifname_folder ] && retrun
+
+			mac80211_hostapd_setup_bss "$phy" "$ifname" "$macaddr" "$type" || return
+
+			[ -n "$hostapd_ctrl" ] || {
+				ap_ifname="${ifname}"
+				hostapd_ctrl="${hostapd_ctrl:-/var/run/hostapd/$ifname}"
+			}
+		;;
+	esac
+
+	json_select ..
+}
+
+mac80211_prepare_iw_htmode() {
+	case "$htmode" in
+		VHT20|HT20|HE20) iw_htmode=HT20;;
+		HT40*|VHT40|VHT160|HE40)
+			case "$band" in
+				2g)
+					case "$htmode" in
+						HT40+) iw_htmode="HT40+";;
+						HT40-) iw_htmode="HT40-";;
+						*)
+							if [ "$channel" -lt 7 ]; then
+								iw_htmode="HT40+"
+							else
+								iw_htmode="HT40-"
+							fi
+						;;
+					esac
+				;;
+				*)
+					case "$(( ($channel / 4) % 2 ))" in
+						1) iw_htmode="HT40+" ;;
+						0) iw_htmode="HT40-";;
+					esac
+				;;
+			esac
+			[ "$auto_channel" -gt 0 ] && iw_htmode="HT40+"
+		;;
+		VHT80|HE80)
+			iw_htmode="80MHZ"
+		;;
+		NONE|NOHT)
+			iw_htmode="NOHT"
+		;;
+		*) iw_htmode="" ;;
+	esac
+}
+
+mac80211_add_mesh_params() {
+	for var in $MP_CONFIG_INT $MP_CONFIG_BOOL $MP_CONFIG_STRING; do
+		eval "mp_val=\"\$$var\""
+		[ -n "$mp_val" ] && json_add_string "$var" "$mp_val"
+	done
+}
+
+mac80211_setup_adhoc() {
+	local enable=$1
+	json_get_vars bssid ssid key mcast_rate
+
+	NEWUMLIST="${NEWUMLIST}$ifname "
+
+	[ "$enable" = 0 ] && {
+		ip link set dev "$ifname" down
+		return 0
+	}
+
+	keyspec=
+	[ "$auth_type" = "wep" ] && {
+		set_default key 1
+		case "$key" in
+			[1234])
+				local idx
+				for idx in 1 2 3 4; do
+					json_get_var ikey "key$idx"
+
+					[ -n "$ikey" ] && {
+						ikey="$(($idx - 1)):$(prepare_key_wep "$ikey")"
+						[ $idx -eq $key ] && ikey="d:$ikey"
+						append keyspec "$ikey"
+					}
+				done
+			;;
+			*)
+				append keyspec "d:0:$(prepare_key_wep "$key")"
+			;;
+		esac
+	}
+
+	brstr=
+	for br in $basic_rate_list; do
+		wpa_supplicant_add_rate brstr "$br"
+	done
+
+	mcval=
+	[ -n "$mcast_rate" ] && wpa_supplicant_add_rate mcval "$mcast_rate"
+
+	local prev
+	json_set_namespace wdev_uc prev
+
+	json_add_object "$ifname"
+	json_add_string mode adhoc
+	json_add_string macaddr "$macaddr"
+	json_add_string ssid "$ssid"
+	json_add_string freq "$freq"
+	json_add_string htmode "$iw_htmode"
+	[ -n "$bssid" ] && json_add_string bssid "$bssid"
+	json_add_int beacon-interval "$beacon_int"
+	[ -n "$brstr" ] && json_add_string basic-rates "$brstr"
+	[ -n "$mcval" ] && json_add_string mcast-rate "$mcval"
+	[ -n "$keyspec" ] && json_add_string keys "$keyspec"
+	json_close_object
+
+	json_set_namespace "$prev"
+}
+
+mac80211_setup_mesh() {
+	json_get_vars ssid mesh_id mcast_rate
+
+	mcval=
+	[ -n "$mcast_rate" ] && wpa_supplicant_add_rate mcval "$mcast_rate"
+	[ -n "$mesh_id" ] && ssid="$mesh_id"
+
+	brstr=
+	for br in $basic_rate_list; do
+		wpa_supplicant_add_rate brstr "$br"
+	done
+
+	local prev
+	json_set_namespace wdev_uc prev
+
+	json_add_object "$ifname"
+	json_add_string mode mesh
+	json_add_string macaddr "$macaddr"
+	json_add_string ssid "$ssid"
+	json_add_string freq "$freq"
+	json_add_string htmode "$iw_htmode"
+	[ -n "$mcval" ] && json_add_string mcast-rate "$mcval"
+	[ -n "$brstr" ] && json_add_string basic-rates "$brstr"
+	json_add_int beacon-interval "$beacon_int"
+	mac80211_add_mesh_params
+
+	json_close_object
+
+	json_set_namespace "$prev"
+}
+
+mac80211_setup_monitor() {
+	local prev
+	json_set_namespace wdev_uc prev
+
+	json_add_object "$ifname"
+	json_add_string mode monitor
+	[ -n "$freq" ] && json_add_string freq "$freq"
+	json_add_string htmode "$iw_htmode"
+	json_close_object
+
+	json_set_namespace "$prev"
+}
+
+mac80211_set_vif_txpower() {
+	local name="$1"
+
+	json_select config
+	json_get_var ifname _ifname
+	json_get_vars vif_txpower
+	json_select ..
+
+	set_default vif_txpower "$txpower"
+	if [ -n "$vif_txpower" ]; then
+		iw dev "$ifname" set txpower fixed "${vif_txpower%%.*}00"
+	else
+		iw dev "$ifname" set txpower auto
+	fi
+}
+
+wpa_supplicant_init_config() {
+	json_set_namespace wpa_supp prev
+
+	json_init
+	json_add_array config
+
+	json_set_namespace "$prev"
+}
+
+wpa_supplicant_add_interface() {
+	local ifname="$1"
+	local mode="$2"
+	local prev
+
+	_wpa_supplicant_common "$ifname"
+
+	json_set_namespace wpa_supp prev
+
+	json_add_object
+	json_add_string ctrl "$_rpath"
+	json_add_string iface "$ifname"
+	json_add_string mode "$mode"
+	json_add_string config "$_config"
+	json_add_string macaddr "$macaddr"
+	json_add_string mld_allowed_phy_bitmap "$mld_allowed_phy_bitmap"
+	[ -n "$network_bridge" ] && json_add_string bridge "$network_bridge"
+	[ -n "$wds" ] && json_add_boolean 4addr "$wds"
+	json_add_boolean powersave "$powersave"
+	[ "$mode" = "mesh" ] && mac80211_add_mesh_params
+	json_close_object
+
+	json_set_namespace "$prev"
+
+	wpa_supp_init=1
+}
+
+wpa_supplicant_set_config() {
+	local phy="$1"
+	local radio="$2"
+	local prev
+
+	json_set_namespace wpa_supp prev
+	json_close_array
+	json_add_string phy "$phy"
+	json_add_int radio "$radio"
+	json_add_int num_global_macaddr "$num_global_macaddr"
+	json_add_boolean defer 1
+	local data="$(json_dump)"
+
+	json_cleanup
+	json_set_namespace "$prev"
+
+	ubus -S -t 0 wait_for wpa_supplicant || {
+		[ -n "$wpa_supp_init" ] || return 0
+
+		ubus wait_for wpa_supplicant
+	}
+
+	local supplicant_res="$(ubus_call wpa_supplicant config_set "$data")"
+	ret="$?"
+	[ "$ret" != 0 -o -z "$supplicant_res" ] && wireless_setup_vif_failed WPA_SUPPLICANT_FAILED
+
+	wireless_add_process "$(jsonfilter -s "$supplicant_res" -l 1 -e @.pid)" "/usr/sbin/wpa_supplicant" 1 1
+
+}
+
+hostapd_set_config() {
+	local phy="$1"
+	local radio="$2"
+
+	if [ "$inconsistent_country" -eq 1 ]; then
+		echo "ERROR: Please use the same country for all the radios."
+		wireless_setup_failed HOSTAPD_START_FAILED
+		drv_mac80211_teardown
+		return
+	fi
+
+	[ -n "$hostapd_ctrl" ] || {
+		ubus_call hostapd config_set '{ "phy": "'"$phy"'", "radio": '"$radio"', "config": "", "prev_config": "'"${hostapd_conf_file}.prev"'" }' > /dev/null
+		return 0;
+	}
+
+	ubus wait_for hostapd
+	local hostapd_res="$(ubus_call hostapd config_set "{ \"phy\": \"$phy\", \"radio\": $radio, \"config\":\"${hostapd_conf_file}\", \"prev_config\": \"${hostapd_conf_file}.prev\"}")"
+	ret="$?"
+	[ "$ret" != 0 -o -z "$hostapd_res" ] && {
+		wireless_setup_failed HOSTAPD_START_FAILED
+		return
+	}
+	wireless_add_process "$(jsonfilter -s "$hostapd_res" -l 1 -e @.pid)" "/usr/sbin/hostapd" 1 1
+}
+
+
+wpa_supplicant_start() {
+	local phy="$1"
+	local radio="$2"
+
+	[ -n "$wpa_supp_init" ] || return 0
+
+	ubus_call wpa_supplicant config_set '{ "phy": "'"$phy"'", "radio": '"$radio"', "num_global_macaddr": '"$num_global_macaddr"' }' > /dev/null
+}
+
+mac80211_setup_supplicant() {
+	local enable=$1
+	local add_sp=0
+
+	wpa_supplicant_prepare_interface "$ifname" nl80211 || return 1
+
+	if [ "$mode" = "sta" ]; then
+		wpa_supplicant_add_network "$ifname"
+	else
+		wpa_supplicant_add_network "$ifname" "$freq" "$htmode" "$hostapd_noscan"
+	fi
+
+	wpa_supplicant_add_interface "$ifname" "$mode"
+
+	return 0
+}
+
+mac80211_setup_vif() {
+	local name="$1"
+	local failed
+
+	json_select config
+	json_get_var ifname _ifname
+	json_get_var macaddr _macaddr
+	json_get_vars mode wds powersave
+
+	set_default powersave 0
+	set_default wds 0
+
+	case "$mode" in
+		mesh)
+			json_get_vars $MP_CONFIG_INT $MP_CONFIG_BOOL $MP_CONFIG_STRING
+			wireless_vif_parse_encryption
+			[ -z "$htmode" ] && htmode="NOHT";
+			if [ -x /usr/sbin/wpa_supplicant ] && wpa_supplicant -vmesh; then
+				mac80211_setup_supplicant || failed=1
+			else
+				mac80211_setup_mesh
+			fi
+		;;
+		adhoc)
+			wireless_vif_parse_encryption
+			if [ "$wpa" -gt 0 -o "$auto_channel" -gt 0 ]; then
+				mac80211_setup_supplicant || failed=1
+			else
+				mac80211_setup_adhoc
+			fi
+		;;
+		sta)
+			mac80211_setup_supplicant || failed=1
+		;;
+		monitor)
+			mac80211_setup_monitor
+		;;
+	esac
+
+	json_select ..
+	[ -n "$failed" ] || wireless_add_vif "$name" "$ifname"
+
+	echo "Setup SMP Affinity"
+	/sbin/smp-mt76.sh
+}
+
+get_freq() {
+	local phy="$1"
+	local channel="$2"
+	local band="$3"
+
+	case "$band" in
+		2g) band="1:";;
+		5g) band="2:";;
+		60g) band="3:";;
+		6g) band="4:";;
+	esac
+
+	iw "$phy" info | awk -v band="$band" -v channel="[$channel]" '
+
+$1 ~ /Band/ {
+	band_match = band == $2
+}
+
+band_match && $3 == "MHz" && $4 == channel {
+	print int($2)
+	exit
+}
+'
+}
+
+chan_is_dfs() {
+	local phy="$1"
+	local chan="$2"
+	iw "$phy" info | grep -E -m1 "(\* ${chan:-....} MHz${chan:+|\\[$chan\\]})" | grep -q "MHz.*radar detection"
+	return $!
+}
+
+mac80211_set_noscan() {
+	hostapd_noscan=1
+}
+
+drv_mac80211_cleanup() {
+	:
+}
+
+mac80211_reset_config() {
+	hostapd_conf_file="/var/run/hostapd-$phy$vif_phy_suffix.conf"
+	ubus_call hostapd config_set '{ "phy": "'"$phy"'", "radio": '"$radio"', "config": "", "prev_config": "'"$hostapd_conf_file"'" }' > /dev/null
+	ubus_call wpa_supplicant config_set '{ "phy": "'"$phy"'", "radio": '"$radio"', "config": [] }' > /dev/null
+	wdev_tool "$phy$phy_suffix" set_config '{}'
+	mv "$hostapd_conf_file" "$hostapd_conf_file.bk"
+}
+
+mac80211_set_suffix() {
+	[ "$radio" = "-1" ] && radio=
+	phy_suffix="${radio:+:$radio}"
+	vif_phy_suffix="${radio:+.$radio}"
+	set_default radio -1
+}
+
+mac80211_count_ap() {
+	total_num_ap=$(($total_num_ap + 1))
+}
+
+country_consistent_check() {
+	local i
+	inconsistent_country=0
+	country_list="$(cat /etc/config/wireless | grep country | cut -d ' ' -f3 | tr -s "'\n" ' ')"
+	for i in $country_list
+	do
+		ret="$(echo $country_list | awk '{print ($2 == "" || $1 == $2)}')"
+		[ $ret = '0' ] && {
+			inconsistent_country=1
+			return
+		}
+		country_list="$(echo $country_list | sed -r 's/[A-Z]{2}( )*//')"
+	done
+}
+
+set_antenna() {
+	local phy=$1
+	local radio_list="$(uci show wireless | grep wifi-device | cut -d '=' -f 1 | cut -d '.' -f 2)"
+	local radio
+	local radio_idx
+	local is_disabled
+	local antenna_mask
+	local offset
+	local radio_tx_antenna
+	local radio_rx_antenna
+	local wiphy_tx_antenna=0
+	local wiphy_rx_antenna=0
+
+	for radio in $radio_list
+	do
+		is_disabled="$(uci show wireless.${radio} | grep "disabled" | cut -d '=' -f 2 | tr -d "'")"
+		radio_idx="$(uci show wireless.${radio}.radio | cut -d '=' -f 2 | tr -d "'")"
+		radio_tx_antenna="$(uci show wireless.${radio} | grep txantenna | cut -d '=' -f 2 | tr -d "'")"
+		radio_rx_antenna="$(uci show wireless.${radio} | grep rxantenna | cut -d '=' -f 2 | tr -d "'")"
+		antenna_mask="$(iw phy ${phy} info | grep "wiphy radio" -A 21 | grep "Idx $radio_idx" -A 2 | grep "antenna_mask" | cut -d ' ' -f 2 | cut -d 'x' -f 2)"
+		antenna_mask=$((0x$antenna_mask))
+
+		offset=0
+		while [ $(($antenna_mask & 1)) -eq 0 ]
+		do
+			antenna_mask=$(($antenna_mask >> 1))
+			offset=$(($offset + 1))
+		done
+
+		if [ "$is_disabled" -ne "1" ] && [ -n "$radio_tx_antenna" ]; then
+			radio_tx_antenna=$(($radio_tx_antenna & $antenna_mask))
+		else
+			radio_tx_antenna=$antenna_mask
+		fi
+
+		wiphy_tx_antenna=$(($wiphy_tx_antenna+$(($radio_tx_antenna << $offset))))
+
+		if [ "$is_disabled" -ne "1" ] && [ -n "$radio_rx_antenna" ]; then
+			radio_rx_antenna=$(($radio_rx_antenna & $antenna_mask))
+		else
+			radio_rx_antenna=$antenna_mask
+		fi
+
+		wiphy_rx_antenna=$(($wiphy_rx_antenna+$(($radio_rx_antenna << $offset))))
+	done
+
+	iw phy $phy set antenna $wiphy_tx_antenna $wiphy_rx_antenna >/dev/null 2>&1
+}
+
+drv_mac80211_setup() {
+	json_select config
+	json_get_vars \
+		radio phy macaddr path \
+		country chanbw distance \
+		txpower \
+		rxantenna txantenna \
+		frag rts beacon_int:100 htmode \
+		num_global_macaddr:1 multiple_bssid \
+		sr_enable sr_enhanced
+	json_get_values basic_rate_list basic_rate
+	json_get_values scan_list scan_list
+	json_select ..
+
+	mac80211_set_suffix
+
+	json_select data && {
+		json_get_var prev_rxantenna rxantenna
+		json_get_var prev_txantenna txantenna
+		json_select ..
+	}
+
+	find_phy || {
+		echo "Could not find PHY for device '$1'"
+		wireless_set_retry 0
+		return 1
+	}
+
+	local wdev
+	local cwdev
+	local found
+
+	# convert channel to frequency
+	[ "$auto_channel" -gt 0 ] || freq="$(get_freq "$phy" "$channel" "$band")"
+
+	[ -n "$country" ] && {
+		iw reg get | grep -q "^country $country:" || {
+			iw reg set "$country"
+			sleep 1
+		}
+	}
+
+	hostapd_conf_file="/var/run/hostapd-$phy$vif_phy_suffix.conf"
+
+	macidx=0
+	staidx=0
+	mbssidx=0
+
+	if [ "$phy" = "phy1" ]; then
+		macidx=20;
+	elif [ "$phy" = "phy2" ]; then
+		macidx=40;
+	fi
+
+	[ -n "$chanbw" ] && {
+		for file in /sys/kernel/debug/ieee80211/$phy/ath9k*/chanbw /sys/kernel/debug/ieee80211/$phy/ath5k/bwmode; do
+			[ -f "$file" ] && echo "$chanbw" > "$file"
+		done
+	}
+
+	set_default rxantenna 0xffffffff
+	set_default txantenna 0xffffffff
+	set_default distance 0
+
+	[ "$txantenna" = "all" ] && txantenna=0xffffffff
+	[ "$rxantenna" = "all" ] && rxantenna=0xffffffff
+
+	[ "$rxantenna" = "$prev_rxantenna" -a "$txantenna" = "$prev_txantenna" ] || mac80211_reset_config "$phy"
+	wireless_set_data phy="$phy" radio="$radio" txantenna="$txantenna" rxantenna="$rxantenna"
+
+	# each phy sleeps different times to prevent for ubus race condition.
+	if [ "$phy" = "phy1" ] || [ "$radio" = "1" ]; then
+		sleep 3;
+	elif [ "$phy" = "phy2" ] || [ "$radio" = "2" ]; then
+		sleep 6;
+	fi
+
+	set_antenna $phy
+	iw phy "$phy" set distance "$distance" >/dev/null 2>&1
+
+	[ -n "$frag" ] && iw phy "$phy" set frag "${frag%%.*}"
+	[ -n "$rts" ] && iw phy "$phy" set rts "${rts%%.*}"
+
+	has_ap=
+	hostapd_ctrl=
+	ap_ifname=
+	hostapd_noscan=
+	wpa_supp_init=
+	for_each_interface "ap" mac80211_check_ap
+
+	[ -f "$hostapd_conf_file" ] && mv "$hostapd_conf_file" "$hostapd_conf_file.prev"
+
+	for_each_interface "sta adhoc mesh" mac80211_set_noscan
+	[ -n "$has_ap" ] && mac80211_hostapd_setup_base "$phy"
+
+	local prev
+	json_set_namespace wdev_uc prev
+	json_init
+	json_set_namespace "$prev"
+
+	wpa_supplicant_init_config
+
+	total_num_ap=0
+	max_mbssid=1
+	for_each_interface "ap" mac80211_count_ap
+	total_num_ap=$(($total_num_ap - 1))
+	while [ $total_num_ap -gt 0 ]
+	do
+		total_num_ap=$(($total_num_ap >> 1))
+		max_mbssid=$(($max_mbssid << 1))
+	done
+
+	mac80211_prepare_iw_htmode
+	active_ifnames=
+	for_each_interface "ap sta adhoc mesh monitor" mac80211_prepare_vif
+	for_each_interface "ap sta adhoc mesh monitor" mac80211_setup_vif
+
+	find_colocated_sta "$radio"
+
+	country_consistent_check
+	phy_idx=$(echo "$phy" | sed 's/phy//')
+	[ -n "$sr_enable" ] && echo "$sr_enable" > /sys/kernel/debug/ieee80211/phy0/mt76/band$phy_idx/sr_enable
+	[ -n "$sr_enhanced" ] && echo "$sr_enhanced" > /sys/kernel/debug/ieee80211/phy0/mt76/band$phy_idx/sr_enhanced_enable
+
+	[ -x /usr/sbin/wpa_supplicant ] && wpa_supplicant_set_config "$phy" "$radio"
+	[ -x /usr/sbin/hostapd ] && hostapd_set_config "$phy" "$radio"
+
+	[ -x /usr/sbin/wpa_supplicant ] && [ -z "$hostapd_ctrl" ] && wpa_supplicant_start "$phy" "$radio"
+
+	json_set_namespace wdev_uc prev
+	wdev_tool "$phy$phy_suffix" set_config "$(json_dump)" $active_ifnames
+	json_set_namespace "$prev"
+
+	[ -z "$phy_suffix" ] && {
+		if [ -n "$txpower" ]; then
+			iw phy "$phy" set txpower fixed "${txpower%%.*}00"
+		else
+			iw phy "$phy" set txpower auto
+		fi
+	}
+
+	for_each_interface "ap sta adhoc mesh monitor" mac80211_set_vif_txpower
+	wireless_set_up
+
+	echo /tmp/%e.core > /proc/sys/kernel/core_pattern
+}
+
+_list_phy_interfaces() {
+	local phy="$1"
+	if [ -d "/sys/class/ieee80211/${phy}/device/net" ]; then
+		ls "/sys/class/ieee80211/${phy}/device/net" 2>/dev/null;
+	else
+		ls "/sys/class/ieee80211/${phy}/device" 2>/dev/null | grep net: | sed -e 's,net:,,g'
+	fi
+}
+
+list_phy_interfaces() {
+	local phy="$1"
+
+	for dev in $(_list_phy_interfaces "$phy"); do
+		readlink "/sys/class/net/${dev}/phy80211" | grep -q "/${phy}\$" || continue
+		echo "$dev"
+	done
+}
+
+drv_mac80211_teardown() {
+	json_select data
+	json_get_vars phy radio
+	json_select ..
+	[ -n "$phy" ] || {
+		echo "Bug: PHY is undefined for device '$1'"
+		return 1
+	}
+
+	mac80211_set_suffix
+	mac80211_reset_config "$phy"
+}
+
+add_driver mac80211
diff --git a/wireless-scripts-example/old/mac80211-mtk-feed.uc b/wireless-scripts-example/old/mac80211-mtk-feed.uc
new file mode 100644
index 0000000000..7e700522d3
--- /dev/null
+++ b/wireless-scripts-example/old/mac80211-mtk-feed.uc
@@ -0,0 +1,227 @@
+#!/usr/bin/env ucode
+import { readfile } from "fs";
+import * as uci from 'uci';
+
+const bands_order = [ "6G", "5G", "2G" ];
+const htmode_order = [ "EHT", "HE", "VHT", "HT" ];
+
+let board = json(readfile("/etc/board.json"));
+if (!board.wlan)
+	exit(0);
+
+let idx = 0;
+let commit;
+
+let has_mlo = 1;
+let random_mac_bytes = getenv("MT76_ENV_RANDOM_MAC_BYTES");
+
+let config = uci.cursor().get_all("wireless") ?? {};
+
+function radio_exists(path, macaddr, phy, radio) {
+	for (let name, s in config) {
+		if (s[".type"] != "wifi-device")
+			continue;
+		if (radio != null && int(s.radio) != radio)
+			continue;
+		if (s.macaddr & lc(s.macaddr) == lc(macaddr))
+			return true;
+		if (s.phy == phy)
+			return true;
+		if (!s.path || !path)
+			continue;
+		if (substr(s.path, -length(path)) == path)
+			return true;
+	}
+}
+
+for (let phy_name, phy in board.wlan) {
+	let init_mld;
+	let info = phy.info;
+	if (!info || !length(info.bands))
+		continue;
+
+	/* TODO Remove this for multiple wiphy device */
+	if (phy_name != "phy0")
+		continue;
+
+	let radios = [];
+	let device_list = [];
+	if (length(info.radios) > 0) {
+		radios = info.radios;
+	} else {
+		let i = 0;
+		for (let band_name, band in info.bands) {
+			let r = {"bands": {}};
+			r["bands"][band_name] = band;
+			radios[i] = r;
+			i++;
+		}
+	}
+
+	for (let radio in radios) {
+		while (config[`radio${idx}`])
+			idx++;
+		let name = "radio" + idx;
+
+		let s = "wireless." + name;
+		let si = "wireless.default_" + name;
+
+		let band_name = filter(bands_order, (b) => radio.bands[b])[0];
+		if (!band_name)
+			continue;
+
+		let band = info.bands[band_name];
+		let rband = radio.bands[band_name];
+		let channel = rband.default_channel ?? "auto";
+		if (band_name == "6G")
+			channel = 37;
+
+		let width = band.max_width;
+
+		let htmode = filter(htmode_order, (m) => band[lc(m)])[0];
+		if (htmode)
+			htmode += width;
+		else
+			htmode = "NOHT";
+
+		if (!phy.path)
+			continue;
+
+		if (length(info.radios) == 0) {
+			/* FIXME: hardcode */
+			if (band_name == "5G")
+				phy.path = board.wlan["phy1"]["path"];
+			else if (band_name == "6G")
+				phy.path = board.wlan["phy2"]["path"];
+		}
+
+		let macaddr = trim(readfile(`/sys/class/ieee80211/${phy_name}/macaddress`));
+		if (radio_exists(phy.path, macaddr, phy_name, radio.index))
+			continue;
+
+		let id = `phy='${phy_name}'`;
+		if (match(phy_name, /^phy[0-9]/))
+			id = `path='${phy.path}'`;
+
+		band_name = lc(band_name);
+		let country, defaults, num_global_macaddr;
+		if (board.wlan.defaults) {
+			defaults = board.wlan.defaults.ssids?.[band_name]?.ssid ? board.wlan.defaults.ssids?.[band_name] : board.wlan.defaults.ssids?.all;
+			country = board.wlan.defaults.country;
+			if (!country && band_name != '2g')
+				defaults = null;
+			num_global_macaddr = board.wlan.defaults.ssids?.[band_name]?.mac_count;
+		}
+
+		if (length(info.radios) > 0)
+			id += `\nset ${s}.radio='${radio.index}'`;
+
+		if (has_mlo)
+			init_mld = true;
+
+		let disabled = getenv("MT76_ENV_WM_TM") ? 1 : 0;
+		let noscan = 0;
+		let mbssid = 0;
+		let rnr = 0;
+		let background_radar = 0;
+		let encryption = "none";
+		let mbo = 0;
+		let ssid = "";
+		let assocresp_elements="dd07000ce700000000";
+
+		if (band_name == "6g") {
+			encryption = "sae";
+			mbo = 1;
+			ssid = "OpenWrt-6g";
+			mbssid = 1;
+		} else if (band_name == "5g") {
+			noscan = 1;
+			rnr = 1;
+			background_radar = 1;
+			ssid = "OpenWrt-5g";
+		} else {
+			noscan = 1;
+			rnr = 1;
+			ssid = "OpenWrt-2g";
+		}
+
+		print(`set ${s}=wifi-device
+set ${s}.type='mac80211'
+set ${s}.${id}
+set ${s}.band='${band_name}'
+set ${s}.channel='${channel}'
+set ${s}.htmode='${htmode}'
+set ${s}.country='${country || 'US'}'
+set ${s}.num_global_macaddr='${num_global_macaddr || ''}'
+set ${s}.disabled='${defaults ? 0 : disabled}'
+set ${s}.noscan=${noscan}
+`);
+
+		print(`set ${si}=wifi-iface
+set ${si}.device='${name}'
+set ${si}.network='lan'
+set ${si}.mode='ap'
+set ${si}.ssid='${defaults?.ssid || ssid}'
+set ${si}.encryption='${defaults?.encryption || encryption}'
+set ${si}.key='${defaults?.key || ""}'
+set ${si}.mbo=${mbo}
+set ${si}.assocresp_elements='${assocresp_elements}'
+`);
+
+		if (mbssid)
+			print(`set ${s}.mbssid=${mbssid}
+`);
+		if (rnr)
+			print(`set ${s}.rnr=${rnr}
+`);
+		if (background_radar)
+			print(`set ${s}.background_radar=${background_radar}
+`);
+		print(`set ${s}.tx_burst=0.0
+`);
+		if (encryption == "sae")
+			print(`set ${si}.key=12345678
+set ${si}.sae_pwe=2
+set ${si}.ieee80211w=2
+`);
+		if (random_mac_bytes) {
+			print(`set ${si}.macaddr=00:0${idx}:55:66${random_mac_bytes}
+`);
+			if (has_mlo)
+				print(`set ${si_mld}.macaddr=00:1${idx}:55:66${random_mac_bytes}
+`);
+		}
+
+		config[name] = {};
+		push(device_list, name);
+		commit = true;
+	}
+
+	if (init_mld) {
+		let mld_sec = "wireless.ap_mld_1";
+
+		print(`set ${mld_sec}=wifi-iface
+`);
+		for (let device_name in device_list)
+			print(`add_list ${mld_sec}.device=${device_name}
+`);
+
+		print(`set ${mld_sec}.ifname=ap-mld-1
+set ${mld_sec}.network='lan'
+set ${mld_sec}.mode='ap'
+set ${mld_sec}.mlo=1
+set ${mld_sec}.ssid='MT76_AP_MLD'
+set ${mld_sec}.encryption='sae-mixed'
+set ${mld_sec}.key=12345678
+set ${mld_sec}.sae_pwe=2
+`);
+		if (random_mac_bytes)
+			print(`set ${mld_sec}.mld_addr=00:22:55:66${random_mac_bytes}
+`);
+	}
+
+	commit = true;
+}
+
+if (commit)
+	print("commit wireless\n");
diff --git a/wireless-scripts-example/old/mac80211-my-v3-qualcomm.sh b/wireless-scripts-example/old/mac80211-my-v3-qualcomm.sh
new file mode 100755
index 0000000000..81f577fef6
--- /dev/null
+++ b/wireless-scripts-example/old/mac80211-my-v3-qualcomm.sh
@@ -0,0 +1,1409 @@
+#!/bin/sh
+. /lib/netifd/netifd-wireless.sh
+. /lib/netifd/hostapd.sh
+. /lib/functions/system.sh
+
+init_wireless_driver "$@"
+
+MP_CONFIG_INT="mesh_retry_timeout mesh_confirm_timeout mesh_holding_timeout mesh_max_peer_links
+	       mesh_max_retries mesh_ttl mesh_element_ttl mesh_hwmp_max_preq_retries
+	       mesh_path_refresh_time mesh_min_discovery_timeout mesh_hwmp_active_path_timeout
+	       mesh_hwmp_preq_min_interval mesh_hwmp_net_diameter_traversal_time mesh_hwmp_rootmode
+	       mesh_hwmp_rann_interval mesh_gate_announcements mesh_sync_offset_max_neighor
+	       mesh_rssi_threshold mesh_hwmp_active_path_to_root_timeout mesh_hwmp_root_interval
+	       mesh_hwmp_confirmation_interval mesh_awake_window mesh_plink_timeout"
+MP_CONFIG_BOOL="mesh_auto_open_plinks mesh_fwding"
+MP_CONFIG_STRING="mesh_power_mode"
+
+wdev_tool() {
+	ucode /usr/share/hostap/wdev.uc "$@"
+}
+
+ubus_call() {
+	flock /var/run/hostapd.lock ubus call "$@"
+}
+
+drv_mac80211_init_device_config() {
+	hostapd_common_add_device_config
+
+	config_add_string path phy 'macaddr:macaddr'
+	config_add_string tx_burst
+	config_add_string distance
+	config_add_string ifname_prefix
+	config_add_string macaddr_base
+	config_add_int radio beacon_int chanbw frag rts
+	config_add_int mbssid mu_onoff sr_enable sr_enhanced rnr obss_interval
+	config_add_int rxantenna txantenna txpower min_tx_power
+	config_add_int num_global_macaddr multiple_bssid
+	config_add_boolean noscan ht_coex acs_exclude_dfs background_radar
+	config_add_boolean noscan ht_coex acs_exclude_dfs background_radar background_cert_mode
+	config_add_array ht_capab
+	config_add_array channels
+	config_add_array scan_list
+	config_add_boolean \
+		rxldpc \
+		short_gi_80 \
+		short_gi_160 \
+		tx_stbc_2by1 \
+		su_beamformer \
+		su_beamformee \
+		mu_beamformer \
+		mu_beamformee \
+		he_su_beamformer \
+		he_su_beamformee \
+		he_mu_beamformer \
+		vht_txop_ps \
+		htc_vht \
+		rx_antenna_pattern \
+		tx_antenna_pattern \
+		he_spr_sr_control \
+		he_spr_psr_enabled \
+		he_bss_color_enabled \
+		he_twt_required \
+		he_twt_responder \
+		etxbfen \
+		itxbfen \
+		lpi_psd \
+		lpi_bcn_enhance
+	config_add_int \
+		beamformer_antennas \
+		beamformee_antennas \
+		vht_max_a_mpdu_len_exp \
+		vht_max_mpdu \
+		vht_link_adapt \
+		vht160 \
+		rx_stbc \
+		tx_stbc \
+		he_bss_color \
+		he_spr_non_srg_obss_pd_max_offset \
+		pp_bitmap \
+		pp_mode \
+		eml_disable \
+		eml_resp \
+		sku_idx \
+		lpi_sku_idx
+	config_add_boolean \
+		ldpc \
+		greenfield \
+		short_gi_20 \
+		short_gi_40 \
+		max_amsdu \
+		dsss_cck_40
+}
+
+drv_mac80211_init_iface_config() {
+	hostapd_common_add_bss_config
+
+	config_add_string 'macaddr:macaddr' ifname
+
+	config_add_boolean wds powersave enable
+	config_add_string wds_bridge
+	config_add_int maxassoc
+	config_add_int max_listen_int
+	config_add_int dtim_period
+	config_add_int start_disabled
+
+	# mesh
+	config_add_string mesh_id
+	config_add_int $MP_CONFIG_INT
+	config_add_boolean $MP_CONFIG_BOOL
+	config_add_string $MP_CONFIG_STRING
+}
+
+mac80211_add_capabilities() {
+	local __var="$1"; shift
+	local __mask="$1"; shift
+	local __out= oifs
+
+	oifs="$IFS"
+	IFS=:
+	for capab in "$@"; do
+		set -- $capab
+
+		[ "$(($4))" -gt 0 ] || continue
+		[ "$(($__mask & $2))" -eq "$((${3:-$2}))" ] || continue
+		__out="$__out[$1]"
+	done
+	IFS="$oifs"
+
+	export -n -- "$__var=$__out"
+}
+
+mac80211_add_he_capabilities() {
+	local __out= oifs
+
+	oifs="$IFS"
+	IFS=:
+	for capab in "$@"; do
+		set -- $capab
+		[ "$(($4))" -gt 0 ] || continue
+		[ "$(((0x$2) & $3))" -gt 0 ] || {
+			eval "$1=0"
+			continue
+		}
+		append base_cfg "$1=1" "$N"
+	done
+	IFS="$oifs"
+}
+
+mac80211_hostapd_setup_base() {
+	local phy="$1"
+
+	json_select config
+
+	[ "$auto_channel" -gt 0 ] && channel=acs_survey
+
+	[ "$auto_channel" -gt 0 ] && json_get_vars acs_exclude_dfs
+	[ -n "$acs_exclude_dfs" ] && [ "$acs_exclude_dfs" -gt 0 ] &&
+		append base_cfg "acs_exclude_dfs=1" "$N"
+
+	json_get_vars noscan ht_coex min_tx_power:0 tx_burst
+	json_get_vars etxbfen:1 itxbfen:0 eml_disable eml_resp lpi_psd sku_idx lpi_sku_idx lpi_bcn_enhance
+	json_get_values ht_capab_list ht_capab
+	json_get_values channel_list channels
+
+	[ "$auto_channel" = 0 ] && [ -z "$channel_list" ] && \
+		channel_list="$channel"
+
+	[ "$min_tx_power" -gt 0 ] && append base_cfg "min_tx_power=$min_tx_power" "$N"
+
+	set_default noscan 0
+
+	[ "$noscan" -gt 0 ] && hostapd_noscan=1
+	[ "$tx_burst" = 0 ] && tx_burst=
+
+	chan_ofs=0
+	[ "$band" = "6g" ] && chan_ofs=1
+
+	if [ "$band" = "6g" ]; then
+		nl_band=4
+	elif [ "$band" = "5g" ]; then
+		nl_band=2
+	else
+		nl_band=1
+	fi
+
+	if [ "$band" != "6g" ]; then
+		ieee80211n=1
+		ht_capab=
+		case "$htmode" in
+			VHT20|HT20|HE20|EHT20) ;;
+			HT40*|VHT40|VHT80|VHT160|HE40*|HE80|HE160|EHT40*|EHT80|EHT160)
+				case "$hwmode" in
+					a)
+						case "$(( (($channel / 4) + $chan_ofs) % 2 ))" in
+							1) ht_capab="[HT40+]";;
+							0) ht_capab="[HT40-]";;
+						esac
+						case "$htmode" in
+							HT40-|HE40-|EHT40-)
+								if [ "$auto_channel" -gt 0 ]; then
+									ht_capab="[HT40-]"
+								fi
+								;;
+						esac
+						;;
+					*)
+						case "$htmode" in
+							HT40+|HE40+|EHT40+)
+								if [ "$channel" -gt 9 ]; then
+									echo "Could not set the center freq with this HT mode setting"
+									return 1
+								else
+									ht_capab="[HT40+]"
+								fi
+								;;
+							HT40-|HE40-|EHT40-)
+								if [ "$channel" -lt 5 -a "$auto_channel" -eq 0 ]; then
+									echo "Could not set the center freq with this HT mode setting"
+									return 1
+								else
+									ht_capab="[HT40-]"
+								fi
+								;;
+							*)
+								if [ "$channel" -lt 7 -o "$auto_channel" -gt 0 ]; then
+									ht_capab="[HT40+]"
+								else
+									ht_capab="[HT40-]"
+								fi
+								;;
+						esac
+						;;
+				esac
+				;;
+			*) ieee80211n= ;;
+		esac
+
+		[ -n "$ieee80211n" ] && {
+			append base_cfg "ieee80211n=1" "$N"
+
+			set_default ht_coex 0
+			append base_cfg "ht_coex=$ht_coex" "$N"
+
+			json_get_vars \
+				ldpc:1 \
+				greenfield:0 \
+				short_gi_20:1 \
+				short_gi_40:1 \
+				tx_stbc:1 \
+				rx_stbc:3 \
+				max_amsdu:1 \
+				dsss_cck_40:1
+
+			[ "$ht_coex" -eq 1 ] && {
+				set_default obss_interval 300
+				append base_cfg "obss_interval=$obss_interval" "$N"
+			}
+
+			ht_cap_mask=0
+			ht_cap_mask=$(iw phy "$phy" info | grep "Band ${nl_band}:" -A 1 | grep 'Capabilities: ' | cut -d: -f2)
+
+			cap_rx_stbc=$((($ht_cap_mask >> 8) & 3))
+			[ "$rx_stbc" -lt "$cap_rx_stbc" ] && cap_rx_stbc="$rx_stbc"
+			ht_cap_mask="$(( ($ht_cap_mask & ~(0x300)) | ($cap_rx_stbc << 8) ))"
+
+			mac80211_add_capabilities ht_capab_flags $ht_cap_mask \
+				LDPC:0x1::$ldpc \
+				GF:0x10::$greenfield \
+				SHORT-GI-20:0x20::$short_gi_20 \
+				SHORT-GI-40:0x40::$short_gi_40 \
+				TX-STBC:0x80::$tx_stbc \
+				RX-STBC1:0x300:0x100:1 \
+				RX-STBC12:0x300:0x200:1 \
+				RX-STBC123:0x300:0x300:1 \
+				MAX-AMSDU-7935:0x800::$max_amsdu \
+				DSSS_CCK-40:0x1000::$dsss_cck_40
+
+			ht_capab="$ht_capab$ht_capab_flags"
+			[ -n "$ht_capab" ] && append base_cfg "ht_capab=$ht_capab" "$N"
+		}
+	fi
+
+	# 802.11ac
+	enable_ac=0
+	vht_oper_chwidth=0
+	vht_center_seg0=
+
+	idx="$channel"
+	case "$htmode" in
+		VHT20|HE20|EHT20) enable_ac=1;;
+		VHT40|HE40|EHT40)
+			case "$(( (($channel / 4) + $chan_ofs) % 2 ))" in
+				1) idx=$(($channel + 2));;
+				0) idx=$(($channel - 2));;
+			esac
+			enable_ac=1
+			vht_center_seg0=$idx
+		;;
+		VHT80|HE80|EHT80)
+			case "$(( (($channel / 4) + $chan_ofs) % 4 ))" in
+				1) idx=$(($channel + 6));;
+				2) idx=$(($channel + 2));;
+				3) idx=$(($channel - 2));;
+				0) idx=$(($channel - 6));;
+			esac
+			enable_ac=1
+			vht_oper_chwidth=1
+			vht_center_seg0=$idx
+		;;
+		VHT160|HE160|EHT160|EHT320)
+			if [ "$band" = "6g" ]; then
+				case "$channel" in
+					1|5|9|13|17|21|25|29) idx=15;;
+					33|37|41|45|49|53|57|61) idx=47;;
+					65|69|73|77|81|85|89|93) idx=79;;
+					97|101|105|109|113|117|121|125) idx=111;;
+					129|133|137|141|145|149|153|157) idx=143;;
+					161|165|169|173|177|181|185|189) idx=175;;
+					193|197|201|205|209|213|217|221) idx=207;;
+				esac
+			else
+				case "$channel" in
+					36|40|44|48|52|56|60|64) idx=50;;
+					100|104|108|112|116|120|124|128) idx=114;;
+					149|153|157|161|165|169|173|177) idx=163;;
+				esac
+			fi
+			enable_ac=1
+			vht_oper_chwidth=2
+			vht_center_seg0=$idx
+		;;
+	esac
+	[ "$band" = "5g" ] && {
+		json_get_vars background_radar:0
+
+		[ "$background_radar" -eq 1 ] && append base_cfg "enable_background_radar=1" "$N"
+	}
+
+	[ "$band" = "6g" ] && {
+		op_class=
+		case "$htmode" in
+			HE20|EHT20) op_class=131;;
+			EHT320*)
+				case "$channel" in
+					1|5|9|13|17|21|25|29|33|37|41|45|49|53|57|61) idx=31;;
+					65|69|73|77|81|85|89|93|97|101|105|109|113|117|121|125) idx=95;;
+					129|133|137|141|145|149|153|157|161|165|169|173|177|181|185|189) idx=159;;
+					193|197|201|205|209|213|217|221) idx=191;;
+				esac
+				if [[ "$htmode" = "EHT320-1" && "$channel" -ge "193" ]] ||
+				   [[ "$htmode" = "EHT320-2" && "$channel" -le "29" ]]; then
+					echo "Could not set the center freq with this EHT setting"
+					return 1
+				elif [[ "$htmode" = "EHT320-2" && "$channel" -le "189" ]]; then
+					if [ "$channel" -gt $idx ]; then
+						idx=$(($idx + 32))
+					else
+						idx=$(($idx - 32))
+					fi
+				fi
+				vht_oper_chwidth=2
+				if [ "$channel" -gt $idx ]; then
+					vht_center_seg0=$(($idx + 16))
+				else
+					vht_center_seg0=$(($idx - 16))
+				fi
+				eht_oper_chwidth=9
+				eht_oper_centr_freq_seg0_idx=$idx
+
+				case $htmode in
+					EHT320-1) eht_bw320_offset=1;;
+					EHT320-2) eht_bw320_offset=2;;
+					EHT320) eht_bw320_offset=0;;
+				esac
+
+				op_class=137
+			;;
+			HE*|EHT*) op_class=$((132 + $vht_oper_chwidth))
+		esac
+		[ -n "$op_class" ] && append base_cfg "op_class=$op_class" "$N"
+	}
+
+	[ "$hwmode" = "a" ] || enable_ac=0
+	[ "$band" = "6g" ] && enable_ac=0
+
+	if [ "$enable_ac" != "0" ]; then
+		json_get_vars \
+			rxldpc:1 \
+			short_gi_80:1 \
+			short_gi_160:1 \
+			tx_stbc_2by1:1 \
+			su_beamformer:1 \
+			su_beamformee:1 \
+			mu_beamformer:1 \
+			mu_beamformee:1 \
+			vht_txop_ps:1 \
+			htc_vht:1 \
+			beamformee_antennas:5 \
+			beamformer_antennas:4 \
+			rx_antenna_pattern:1 \
+			tx_antenna_pattern:1 \
+			vht_max_a_mpdu_len_exp:7 \
+			vht_max_mpdu:11454 \
+			rx_stbc:4 \
+			vht_link_adapt:3 \
+			vht160:2
+
+		append base_cfg "ieee80211ac=1" "$N"
+		vht_cap=0
+		for cap in $(iw phy "$phy" info | awk -F "[()]" '/VHT Capabilities/ { print $2 }'); do
+			vht_cap="$(($vht_cap | $cap))"
+		done
+
+		append base_cfg "vht_oper_chwidth=$vht_oper_chwidth" "$N"
+		append base_cfg "vht_oper_centr_freq_seg0_idx=$vht_center_seg0" "$N"
+
+		cap_rx_stbc=$((($vht_cap >> 8) & 7))
+		[ "$rx_stbc" -lt "$cap_rx_stbc" ] && cap_rx_stbc="$rx_stbc"
+		vht_cap="$(( ($vht_cap & ~(0x700)) | ($cap_rx_stbc << 8) ))"
+
+		[ "$vht_oper_chwidth" -lt 2 ] && {
+			vht160=0
+			short_gi_160=0
+		}
+
+		[ "$etxbfen" -eq 0 ] && {
+			su_beamformer=0
+			su_beamformee=0
+			mu_beamformer=0
+		}
+
+		mac80211_add_capabilities vht_capab $vht_cap \
+			RXLDPC:0x10::$rxldpc \
+			SHORT-GI-80:0x20::$short_gi_80 \
+			SHORT-GI-160:0x40::$short_gi_160 \
+			TX-STBC-2BY1:0x80::$tx_stbc_2by1 \
+			SU-BEAMFORMER:0x800::$su_beamformer \
+			SU-BEAMFORMEE:0x1000::$su_beamformee \
+			MU-BEAMFORMER:0x80000::$mu_beamformer \
+			MU-BEAMFORMEE:0x100000::$mu_beamformee \
+			VHT-TXOP-PS:0x200000::$vht_txop_ps \
+			HTC-VHT:0x400000::$htc_vht \
+			RX-ANTENNA-PATTERN:0x10000000::$rx_antenna_pattern \
+			TX-ANTENNA-PATTERN:0x20000000::$tx_antenna_pattern \
+			RX-STBC-1:0x700:0x100:1 \
+			RX-STBC-12:0x700:0x200:1 \
+			RX-STBC-123:0x700:0x300:1 \
+			RX-STBC-1234:0x700:0x400:1 \
+
+		[ "$(($vht_cap & 0x800))" -gt 0 -a "$su_beamformer" -gt 0 ] && {
+			cap_ant="$(( ( ($vht_cap >> 16) & 3 ) + 1 ))"
+			[ "$cap_ant" -gt "$beamformer_antennas" ] && cap_ant="$beamformer_antennas"
+			[ "$cap_ant" -gt 1 ] && vht_capab="$vht_capab[SOUNDING-DIMENSION-$cap_ant]"
+		}
+
+		[ "$(($vht_cap & 0x1000))" -gt 0 -a "$su_beamformee" -gt 0 ] && {
+			cap_ant="$(( ( ($vht_cap >> 13) & 7 ) + 1 ))"
+			[ "$cap_ant" -gt "$beamformee_antennas" ] && cap_ant="$beamformee_antennas"
+			[ "$cap_ant" -gt 1 ] && vht_capab="$vht_capab[BF-ANTENNA-$cap_ant]"
+		}
+
+		# supported Channel widths
+		vht160_hw=0
+		[ "$(($vht_cap & 12))" -eq 4 -a 1 -le "$vht160" ] && \
+			vht160_hw=1
+		[ "$(($vht_cap & 12))" -eq 8 -a 2 -le "$vht160" ] && \
+			vht160_hw=2
+		[ "$vht160_hw" = 1 ] && vht_capab="$vht_capab[VHT160]"
+		[ "$vht160_hw" = 2 ] && vht_capab="$vht_capab[VHT160-80PLUS80]"
+
+		# maximum MPDU length
+		vht_max_mpdu_hw=3895
+		[ "$(($vht_cap & 3))" -ge 1 -a 7991 -le "$vht_max_mpdu" ] && \
+			vht_max_mpdu_hw=7991
+		[ "$(($vht_cap & 3))" -ge 2 -a 11454 -le "$vht_max_mpdu" ] && \
+			vht_max_mpdu_hw=11454
+		[ "$vht_max_mpdu_hw" != 3895 ] && \
+			vht_capab="$vht_capab[MAX-MPDU-$vht_max_mpdu_hw]"
+
+		# maximum A-MPDU length exponent
+		vht_max_a_mpdu_len_exp_hw=0
+		[ "$(($vht_cap & 58720256))" -ge 8388608 -a 1 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=1
+		[ "$(($vht_cap & 58720256))" -ge 16777216 -a 2 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=2
+		[ "$(($vht_cap & 58720256))" -ge 25165824 -a 3 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=3
+		[ "$(($vht_cap & 58720256))" -ge 33554432 -a 4 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=4
+		[ "$(($vht_cap & 58720256))" -ge 41943040 -a 5 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=5
+		[ "$(($vht_cap & 58720256))" -ge 50331648 -a 6 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=6
+		[ "$(($vht_cap & 58720256))" -ge 58720256 -a 7 -le "$vht_max_a_mpdu_len_exp" ] && \
+			vht_max_a_mpdu_len_exp_hw=7
+		vht_capab="$vht_capab[MAX-A-MPDU-LEN-EXP$vht_max_a_mpdu_len_exp_hw]"
+
+		# whether or not the STA supports link adaptation using VHT variant
+		vht_link_adapt_hw=0
+		[ "$(($vht_cap & 201326592))" -ge 134217728 -a 2 -le "$vht_link_adapt" ] && \
+			vht_link_adapt_hw=2
+		[ "$(($vht_cap & 201326592))" -ge 201326592 -a 3 -le "$vht_link_adapt" ] && \
+			vht_link_adapt_hw=3
+		[ "$vht_link_adapt_hw" != 0 ] && \
+			vht_capab="$vht_capab[VHT-LINK-ADAPT-$vht_link_adapt_hw]"
+
+		[ -n "$vht_capab" ] && append base_cfg "vht_capab=$vht_capab" "$N"
+	fi
+
+	# 802.11ax
+	enable_ax=0
+	enable_be=0
+	case "$htmode" in
+		HE*) enable_ax=1 ;;
+		EHT*) enable_ax=1; enable_be=1 ;;
+	esac
+
+	if [ "$enable_ax" != "0" ]; then
+		json_get_vars \
+			he_su_beamformer:1 \
+			he_su_beamformee:1 \
+			he_mu_beamformer:1 \
+			he_twt_required:0 \
+			he_twt_responder \
+			he_spr_sr_control:3 \
+			he_spr_psr_enabled:0 \
+			he_spr_non_srg_obss_pd_max_offset:0 \
+			he_bss_color \
+			he_bss_color_enabled:1
+
+		he_phy_cap=$(iw phy "$phy" info | sed -n '/Band '"${nl_band}"'/,$p' | sed -n '/HE Iftypes: .*AP/,$p' | awk -F "[()]" '/HE PHY Capabilities/ { print $2 }' | head -1)
+		he_phy_cap=${he_phy_cap:2}
+		he_mac_cap=$(iw phy "$phy" info | sed -n '/Band '"${nl_band}"'/,$p' | sed -n '/HE Iftypes: .*AP/,$p' | awk -F "[()]" '/HE MAC Capabilities/ { print $2 }' | head -1)
+		he_mac_cap=${he_mac_cap:2}
+
+		append base_cfg "ieee80211ax=1" "$N"
+		[ "$hwmode" = "a" ] && {
+			append base_cfg "he_oper_chwidth=$vht_oper_chwidth" "$N"
+			append base_cfg "he_oper_centr_freq_seg0_idx=$vht_center_seg0" "$N"
+		}
+
+		[ "$etxbfen" -eq 0 ] && {
+			he_su_beamformer=0
+			he_mu_beamformer=0
+		}
+
+		mac80211_add_he_capabilities \
+			he_su_beamformer:${he_phy_cap:6:2}:0x80:$he_su_beamformer \
+			he_su_beamformee:${he_phy_cap:8:2}:0x1:$he_su_beamformee \
+			he_mu_beamformer:${he_phy_cap:8:2}:0x2:$he_mu_beamformer \
+			he_spr_psr_enabled:${he_phy_cap:14:2}:0x1:$he_spr_psr_enabled \
+			he_twt_required:${he_mac_cap:0:2}:0x6:$he_twt_required
+
+		if [ -n "$he_twt_responder" ]; then
+			append base_cfg "he_twt_responder=$he_twt_responder" "$N"
+		fi
+		if [ "$he_bss_color_enabled" -gt 0 ]; then
+			if !([ "$he_bss_color" -gt 0 ] && [ "$he_bss_color" -le 64 ]); then
+				rand=$(head -n 1 /dev/urandom | tr -dc 0-9 | head -c 2 | sed 's/^0*//')
+				he_bss_color=$((rand % 63 + 1))
+			fi
+			append base_cfg "he_bss_color=$he_bss_color" "$N"
+			[ "$he_spr_non_srg_obss_pd_max_offset" -gt 0 ] && { \
+				append base_cfg "he_spr_non_srg_obss_pd_max_offset=$he_spr_non_srg_obss_pd_max_offset" "$N"
+				he_spr_sr_control=$((he_spr_sr_control | (1 << 2)))
+			}
+			[ "$he_spr_psr_enabled" -gt 0 ] || he_spr_sr_control=$((he_spr_sr_control | (1 << 0)))
+			append base_cfg "he_spr_sr_control=$he_spr_sr_control" "$N"
+		else
+			append base_cfg "he_bss_color_disabled=1" "$N"
+		fi
+
+
+		append base_cfg "he_default_pe_duration=4" "$N"
+		append base_cfg "he_rts_threshold=1023" "$N"
+		append base_cfg "he_mu_edca_qos_info_param_count=0" "$N"
+		append base_cfg "he_mu_edca_qos_info_q_ack=0" "$N"
+		append base_cfg "he_mu_edca_qos_info_queue_request=0" "$N"
+		append base_cfg "he_mu_edca_qos_info_txop_request=0" "$N"
+		append base_cfg "he_mu_edca_ac_be_aifsn=8" "$N"
+		append base_cfg "he_mu_edca_ac_be_aci=0" "$N"
+		append base_cfg "he_mu_edca_ac_be_ecwmin=9" "$N"
+		append base_cfg "he_mu_edca_ac_be_ecwmax=10" "$N"
+		append base_cfg "he_mu_edca_ac_be_timer=255" "$N"
+		append base_cfg "he_mu_edca_ac_bk_aifsn=15" "$N"
+		append base_cfg "he_mu_edca_ac_bk_aci=1" "$N"
+		append base_cfg "he_mu_edca_ac_bk_ecwmin=9" "$N"
+		append base_cfg "he_mu_edca_ac_bk_ecwmax=10" "$N"
+		append base_cfg "he_mu_edca_ac_bk_timer=255" "$N"
+		append base_cfg "he_mu_edca_ac_vi_ecwmin=5" "$N"
+		append base_cfg "he_mu_edca_ac_vi_ecwmax=7" "$N"
+		append base_cfg "he_mu_edca_ac_vi_aifsn=5" "$N"
+		append base_cfg "he_mu_edca_ac_vi_aci=2" "$N"
+		append base_cfg "he_mu_edca_ac_vi_timer=255" "$N"
+		append base_cfg "he_mu_edca_ac_vo_aifsn=5" "$N"
+		append base_cfg "he_mu_edca_ac_vo_aci=3" "$N"
+		append base_cfg "he_mu_edca_ac_vo_ecwmin=9" "$N"
+		append base_cfg "he_mu_edca_ac_vo_ecwmax=10" "$N"
+		append base_cfg "he_mu_edca_ac_vo_timer=3" "$N"
+	fi
+
+	set_default tx_burst 2
+	# 802.11be
+	enable_be=0
+	case "$htmode" in
+		EHT*) enable_be=1 ;;
+	esac
+
+	if [ "$enable_be" != "0" ]; then
+
+		json_get_vars \
+			pp_bitmap \
+			pp_mode
+
+		append base_cfg "ieee80211be=1" "$N"
+		if [ "$etxbfen" -eq 0 ]; then
+			append base_cfg "eht_su_beamformee=1" "$N"
+		else
+			append base_cfg "eht_su_beamformer=1" "$N"
+			append base_cfg "eht_su_beamformee=1" "$N"
+			append base_cfg "eht_mu_beamformer=1" "$N"
+		fi
+		[ "$hwmode" = "a" ] && {
+			case $htmode in
+				EHT320*)
+					append base_cfg "eht_oper_chwidth=$eht_oper_chwidth" "$N"
+					append base_cfg "eht_oper_centr_freq_seg0_idx=$eht_oper_centr_freq_seg0_idx" "$N"
+					append base_cfg "eht_bw320_offset=$eht_bw320_offset" "$N"
+				;;
+				*)
+					append base_cfg "eht_oper_chwidth=$vht_oper_chwidth" "$N"
+					append base_cfg "eht_oper_centr_freq_seg0_idx=$vht_center_seg0" "$N"
+				;;
+			esac
+		}
+
+		if [ -n "$pp_bitmap" ]; then
+			append base_cfg "punct_bitmap=$pp_bitmap" "$N"
+		fi
+
+		if [ -n "$pp_mode" ]; then
+			append base_cfg "pp_mode=$pp_mode" "$N"
+		fi
+	fi
+
+# dpawlik: why it raises: unknown configuration item 'ibf_enable'
+# where ibf_enabled=0
+# ${itxbfen:+ibf_enable=$itxbfen}
+# ${tx_burst:+tx_queue_data2_burst=$tx_burst}
+
+	hostapd_prepare_device_config "$hostapd_conf_file" nl80211
+	cat >> "$hostapd_conf_file" <<EOF
+${channel:+channel=$channel}
+${channel_list:+chanlist=$channel_list}
+${hostapd_noscan:+noscan=1}
+${tx_burst:+tx_queue_data2_burst=$tx_burst}
+${mbssid:+mbssid=$mbssid}
+${mu_onoff:+mu_onoff=$mu_onoff}
+${rnr:+rnr=$rnr}
+${multiple_bssid:+mbssid=$multiple_bssid}
+${eml_disable:+eml_disable=$eml_disable}
+${eml_resp:+eml_resp=$eml_resp}
+${lpi_psd:+lpi_psd=$lpi_psd}
+${lpi_bcn_enhance:+lpi_bcn_enhance=$lpi_bcn_enhance}
+${sku_idx:+sku_idx=$sku_idx}
+${lpi_sku_idx:+lpi_sku_idx=$lpi_sku_idx}
+#num_global_macaddr=$num_global_macaddr
+#macaddr_base=$macaddr_base
+$base_cfg
+
+EOF
+	json_select ..
+}
+
+mac80211_hostapd_setup_bss() {
+	local phy="$1"
+	local ifname="$2"
+	local macaddr="$3"
+	local type="$4"
+
+	hostapd_cfg=
+	append hostapd_cfg "$type=$ifname" "$N"
+
+	hostapd_set_bss_options hostapd_cfg "$phy" "$vif" || return 1
+	json_get_vars wds wds_bridge dtim_period max_listen_int start_disabled
+
+	set_default wds 0
+	set_default start_disabled 0
+
+	[ "$wds" -gt 0 ] && {
+		append hostapd_cfg "wds_sta=1" "$N"
+		[ -n "$wds_bridge" ] && append hostapd_cfg "wds_bridge=$wds_bridge" "$N"
+	}
+	[ "$staidx" -gt 0 -o "$start_disabled" -eq 1 ] && append hostapd_cfg "start_disabled=1" "$N"
+
+	cat >> /var/run/hostapd-$phy$vif_phy_suffix.conf <<EOF
+$hostapd_cfg
+bssid=$macaddr
+${default_macaddr:+#default_macaddr}
+${dtim_period:+dtim_period=$dtim_period}
+${max_listen_int:+max_listen_interval=$max_listen_int}
+EOF
+}
+
+mac80211_get_addr() {
+	local phy="$1"
+	local idx="$(($2 + 1))"
+
+	head -n $idx /sys/class/ieee80211/${phy}/addresses | tail -n1
+}
+
+mac80211_generate_mac() {
+	local phy="$1"
+	local id="${macidx:-0}"
+
+	wdev_tool "$phy$phy_suffix" get_macaddr id=$id num_global=$num_global_macaddr mbssid=${multiple_bssid:-0} macaddr_base=${macaddr_base}
+}
+
+get_board_phy_name() (
+	local path="$1"
+	local fallback_phy=""
+
+	__check_phy() {
+		local val="$1"
+		local key="$2"
+		local ref_path="$3"
+
+		json_select "$key"
+		json_get_vars path
+		json_select ..
+
+		[ "${ref_path%+*}" = "$path" ] && fallback_phy=$key
+		[ "$ref_path" = "$path" ] || return 0
+
+		echo "$key"
+		exit
+	}
+
+	json_load_file /etc/board.json
+	json_for_each_item __check_phy wlan "$path"
+	[ -n "$fallback_phy" ] && echo "${fallback_phy}.${path##*+}"
+)
+
+rename_board_phy_by_path() {
+	local path="$1"
+
+	local new_phy="$(get_board_phy_name "$path")"
+	[ -z "$new_phy" -o "$new_phy" = "$phy" ] && return
+
+	iw "$phy" set name "$new_phy" && phy="$new_phy"
+}
+
+rename_board_phy_by_name() (
+	local phy="$1"
+	local suffix="${phy##*.}"
+	[ "$suffix" = "$phy" ] && suffix=
+
+	json_load_file /etc/board.json
+	json_select wlan
+	json_select "${phy%.*}" || return 0
+	json_get_vars path
+
+	prev_phy="$(iwinfo nl80211 phyname "path=$path${suffix:++$suffix}")"
+	[ -n "$prev_phy" ] || return 0
+
+	[ "$prev_phy" = "$phy" ] && return 0
+
+	iw "$prev_phy" set name "$phy"
+)
+
+find_phy() {
+	[ -n "$phy" ] && {
+		rename_board_phy_by_name "$phy"
+		[ -d /sys/class/ieee80211/$phy ] && return 0
+	}
+	[ -n "$path" ] && {
+		phy="$(iwinfo nl80211 phyname "path=$path")"
+		[ -n "$phy" ] && {
+			rename_board_phy_by_path "$path"
+			return 0
+		}
+	}
+	[ -n "$macaddr" ] && {
+		for phy in $(ls /sys/class/ieee80211 2>/dev/null); do
+			grep -i -q "$macaddr" "/sys/class/ieee80211/${phy}/macaddress" && {
+				path="$(iwinfo nl80211 path "$phy")"
+				rename_board_phy_by_path "$path"
+				return 0
+			}
+		done
+	}
+	return 1
+}
+
+mac80211_check_ap() {
+	has_ap=1
+}
+
+mac80211_set_ifname() {
+	local prefix="$1"
+	local type="$2"
+	eval "ifname=\"$prefix$type\${idx_$type:-0}\"; idx_$type=\$((\${idx_$type:-0 } + 1))"
+}
+
+mac80211_prepare_vif() {
+	json_select config
+
+	json_get_vars ifname mode ssid wds powersave macaddr enable wpa_psk_file sae_password_file vlan_file
+
+	[ -n "$ifname" ] || {
+		local prefix;
+
+		case "$mode" in
+		ap|sta|mesh) prefix=$mode;;
+		adhoc) prefix=ibss;;
+		monitor) prefix=mon;;
+		esac
+
+		mac80211_set_ifname "$ifname_prefix" "$prefix"
+	}
+
+	append active_ifnames "$ifname"
+	set_default wds 0
+	set_default powersave 0
+	json_add_string _ifname "$ifname"
+
+	default_macaddr=
+	if [ -z "$macaddr" ]; then
+		macaddr="$(mac80211_generate_mac $phy)"
+		macidx="$(($macidx + 1))"
+		default_macaddr=1
+	elif [ "$macaddr" = 'random' ]; then
+		macaddr="$(macaddr_random)"
+	fi
+	json_add_string _macaddr "$macaddr"
+	json_add_string _default_macaddr "$default_macaddr"
+	json_select ..
+
+
+	[ "$mode" == "ap" ] && {
+		json_select config
+		wireless_vif_parse_encryption
+		json_select ..
+
+		[ -z "$wpa_psk_file" ] && hostapd_set_psk "$ifname"
+		[ -z "$sae_password_file" ] && hostapd_set_sae "$ifname"
+		[ -z "$vlan_file" ] && hostapd_set_vlan "$ifname"
+	}
+
+	json_select config
+
+	# It is far easier to delete and create the desired interface
+	case "$mode" in
+		ap)
+			# Hostapd will handle recreating the interface and
+			# subsequent virtual APs belonging to the same PHY
+			if [ -n "$hostapd_ctrl" ]; then
+				type=bss
+			else
+				type=interface
+			fi
+
+			mac80211_hostapd_setup_bss "$phy" "$ifname" "$macaddr" "$type" || return
+
+			[ -n "$hostapd_ctrl" ] || {
+				ap_ifname="${ifname}"
+				hostapd_ctrl="${hostapd_ctrl:-/var/run/hostapd/$ifname}"
+			}
+		;;
+	esac
+
+	json_select ..
+}
+
+mac80211_prepare_iw_htmode() {
+	case "$htmode" in
+		VHT20|HT20|HE20) iw_htmode=HT20;;
+		HT40*|VHT40|VHT160|HE40)
+			case "$band" in
+				2g)
+					case "$htmode" in
+						HT40+) iw_htmode="HT40+";;
+						HT40-) iw_htmode="HT40-";;
+						*)
+							if [ "$channel" -lt 7 ]; then
+								iw_htmode="HT40+"
+							else
+								iw_htmode="HT40-"
+							fi
+						;;
+					esac
+				;;
+				*)
+					case "$(( ($channel / 4) % 2 ))" in
+						1) iw_htmode="HT40+" ;;
+						0) iw_htmode="HT40-";;
+					esac
+				;;
+			esac
+			[ "$auto_channel" -gt 0 ] && iw_htmode="HT40+"
+		;;
+		VHT80|HE80)
+			iw_htmode="80MHZ"
+		;;
+		NONE|NOHT)
+			iw_htmode="NOHT"
+		;;
+		*) iw_htmode="" ;;
+	esac
+}
+
+mac80211_add_mesh_params() {
+	for var in $MP_CONFIG_INT $MP_CONFIG_BOOL $MP_CONFIG_STRING; do
+		eval "mp_val=\"\$$var\""
+		[ -n "$mp_val" ] && json_add_string "$var" "$mp_val"
+	done
+}
+
+mac80211_setup_adhoc() {
+	local enable=$1
+	json_get_vars bssid ssid key mcast_rate
+
+	NEWUMLIST="${NEWUMLIST}$ifname "
+
+	[ "$enable" = 0 ] && {
+		ip link set dev "$ifname" down
+		return 0
+	}
+
+	keyspec=
+	[ "$auth_type" = "wep" ] && {
+		set_default key 1
+		case "$key" in
+			[1234])
+				local idx
+				for idx in 1 2 3 4; do
+					json_get_var ikey "key$idx"
+
+					[ -n "$ikey" ] && {
+						ikey="$(($idx - 1)):$(prepare_key_wep "$ikey")"
+						[ $idx -eq $key ] && ikey="d:$ikey"
+						append keyspec "$ikey"
+					}
+				done
+			;;
+			*)
+				append keyspec "d:0:$(prepare_key_wep "$key")"
+			;;
+		esac
+	}
+
+	brstr=
+	for br in $basic_rate_list; do
+		wpa_supplicant_add_rate brstr "$br"
+	done
+
+	mcval=
+	[ -n "$mcast_rate" ] && wpa_supplicant_add_rate mcval "$mcast_rate"
+
+	local prev
+	json_set_namespace wdev_uc prev
+
+	json_add_object "$ifname"
+	json_add_string mode adhoc
+	[ -n "$default_macaddr" ] || json_add_string macaddr "$macaddr"
+	json_add_string ssid "$ssid"
+	json_add_string freq "$freq"
+	json_add_string htmode "$iw_htmode"
+	[ -n "$bssid" ] && json_add_string bssid "$bssid"
+	json_add_int beacon-interval "$beacon_int"
+	[ -n "$brstr" ] && json_add_string basic-rates "$brstr"
+	[ -n "$mcval" ] && json_add_string mcast-rate "$mcval"
+	[ -n "$keyspec" ] && json_add_string keys "$keyspec"
+	json_close_object
+
+	json_set_namespace "$prev"
+}
+
+mac80211_setup_mesh() {
+	json_get_vars ssid mesh_id mcast_rate
+	json_get_values iface_basic_rate_list basic_rate
+
+	mcval=
+	[ -n "$mcast_rate" ] && wpa_supplicant_add_rate mcval "$mcast_rate"
+	[ -n "$mesh_id" ] && ssid="$mesh_id"
+
+	br_list="$basic_rate_list"
+	if [ -n "$iface_basic_rate_list" ]; then
+		br_list="$iface_basic_rate_list"
+	fi
+
+	brstr=
+	for br in $br_list; do
+		wpa_supplicant_add_rate brstr "$br"
+	done
+
+	local prev
+	json_set_namespace wdev_uc prev
+
+	json_add_object "$ifname"
+	json_add_string mode mesh
+	[ -n "$default_macaddr" ] || json_add_string macaddr "$macaddr"
+	json_add_string ssid "$ssid"
+	json_add_string freq "$freq"
+	json_add_string htmode "$iw_htmode"
+	[ -n "$mcval" ] && json_add_string mcast-rate "$mcval"
+	[ -n "$brstr" ] && json_add_string basic-rates "$brstr"
+	json_add_int beacon-interval "$beacon_int"
+	mac80211_add_mesh_params
+
+	json_close_object
+
+	json_set_namespace "$prev"
+}
+
+mac80211_setup_monitor() {
+	local prev
+	json_set_namespace wdev_uc prev
+
+	json_add_object "$ifname"
+	json_add_string mode monitor
+	[ -n "$freq" ] && json_add_string freq "$freq"
+	json_add_string htmode "$iw_htmode"
+	json_close_object
+
+	json_set_namespace "$prev"
+}
+
+mac80211_set_vif_txpower() {
+	local name="$1"
+
+	json_select config
+	json_get_var ifname _ifname
+	json_get_vars vif_txpower
+	json_select ..
+
+	set_default vif_txpower "$txpower"
+	if [ -n "$vif_txpower" ]; then
+		iw dev "$ifname" set txpower fixed "${vif_txpower%%.*}00"
+	else
+		iw dev "$ifname" set txpower auto
+	fi
+}
+
+wpa_supplicant_init_config() {
+	json_set_namespace wpa_supp prev
+
+	json_init
+	json_add_array config
+
+	json_set_namespace "$prev"
+}
+
+wpa_supplicant_add_interface() {
+	local ifname="$1"
+	local mode="$2"
+	local prev
+
+	_wpa_supplicant_common "$ifname"
+
+	json_set_namespace wpa_supp prev
+
+	json_add_object
+	json_add_string ctrl "$_rpath"
+	json_add_string iface "$ifname"
+	json_add_string mode "$mode"
+	json_add_string config "$_config"
+	[ -n "$default_macaddr" ] || json_add_string macaddr "$macaddr"
+	[ -n "$network_bridge" ] && json_add_string bridge "$network_bridge"
+	[ -n "$wds" ] && json_add_boolean 4addr "$wds"
+	json_add_boolean powersave "$powersave"
+	[ "$mode" = "mesh" ] && mac80211_add_mesh_params
+	json_close_object
+
+	json_set_namespace "$prev"
+
+	wpa_supp_init=1
+}
+
+wpa_supplicant_set_config() {
+	local phy="$1"
+	local radio="$2"
+	local prev
+
+	json_set_namespace wpa_supp prev
+	json_close_array
+	json_add_string phy "$phy"
+	json_add_int radio "$radio"
+	json_add_int num_global_macaddr "$num_global_macaddr"
+	json_add_string macaddr_base "$macaddr_base"
+	json_add_boolean defer 1
+	local data="$(json_dump)"
+
+	json_cleanup
+	json_set_namespace "$prev"
+
+	ubus -S -t 0 wait_for wpa_supplicant || {
+		[ -n "$wpa_supp_init" ] || return 0
+
+		ubus wait_for wpa_supplicant
+	}
+
+	local supplicant_res="$(ubus_call wpa_supplicant config_set "$data")"
+	ret="$?"
+	[ "$ret" != 0 -o -z "$supplicant_res" ] && wireless_setup_vif_failed WPA_SUPPLICANT_FAILED
+
+	wireless_add_process "$(jsonfilter -s "$supplicant_res" -l 1 -e @.pid)" "/usr/sbin/wpa_supplicant" 1 1
+
+}
+
+hostapd_set_config() {
+	local phy="$1"
+	local radio="$2"
+
+	[ -n "$hostapd_ctrl" ] || {
+		ubus_call hostapd config_set '{ "phy": "'"$phy"'", "radio": '"$radio"', "config": "", "prev_config": "'"${hostapd_conf_file}.prev"'" }' > /dev/null
+		return 0;
+	}
+
+	ubus wait_for hostapd
+	local hostapd_res="$(ubus_call hostapd config_set "{ \"phy\": \"$phy\", \"radio\": $radio, \"config\":\"${hostapd_conf_file}\", \"prev_config\": \"${hostapd_conf_file}.prev\"}")"
+	ret="$?"
+	[ "$ret" != 0 -o -z "$hostapd_res" ] && {
+		wireless_setup_failed HOSTAPD_START_FAILED
+		return
+	}
+	wireless_add_process "$(jsonfilter -s "$hostapd_res" -l 1 -e @.pid)" "/usr/sbin/hostapd" 1 1
+}
+
+
+wpa_supplicant_start() {
+	local phy="$1"
+	local radio="$2"
+
+	[ -n "$wpa_supp_init" ] || return 0
+
+	ubus_call wpa_supplicant config_set '{ "phy": "'"$phy"'", "radio": '"$radio"', "num_global_macaddr": '"$num_global_macaddr"', "macaddr_base": "'"$macaddr_base"'" }' > /dev/null
+}
+
+mac80211_setup_supplicant() {
+	local enable=$1
+	local add_sp=0
+
+	wpa_supplicant_prepare_interface "$ifname" nl80211 || return 1
+
+	if [ "$mode" = "sta" ]; then
+		wpa_supplicant_add_network "$ifname"
+	else
+		wpa_supplicant_add_network "$ifname" "$freq" "$htmode" "$hostapd_noscan"
+	fi
+
+	wpa_supplicant_add_interface "$ifname" "$mode"
+
+	return 0
+}
+
+mac80211_setup_vif() {
+	local name="$1"
+	local failed
+
+	json_select config
+	json_get_var ifname _ifname
+	json_get_var macaddr _macaddr
+	json_get_var default_macaddr _default_macaddr
+	json_get_vars mode wds powersave
+
+	set_default powersave 0
+	set_default wds 0
+
+	case "$mode" in
+		mesh)
+			json_get_vars $MP_CONFIG_INT $MP_CONFIG_BOOL $MP_CONFIG_STRING
+			wireless_vif_parse_encryption
+			[ -z "$htmode" ] && htmode="NOHT";
+			if [ -x /usr/sbin/wpa_supplicant ] && wpa_supplicant -vmesh; then
+				mac80211_setup_supplicant || failed=1
+			else
+				mac80211_setup_mesh
+			fi
+		;;
+		adhoc)
+			wireless_vif_parse_encryption
+			if [ "$wpa" -gt 0 -o "$auto_channel" -gt 0 ]; then
+				mac80211_setup_supplicant || failed=1
+			else
+				mac80211_setup_adhoc
+			fi
+		;;
+		sta)
+			mac80211_setup_supplicant || failed=1
+		;;
+		monitor)
+			mac80211_setup_monitor
+		;;
+	esac
+
+	json_select ..
+	[ -n "$failed" ] || wireless_add_vif "$name" "$ifname"
+}
+
+get_freq() {
+	local phy="$1"
+	local channel="$2"
+	local band="$3"
+
+	case "$band" in
+		2g) band="1:";;
+		5g) band="2:";;
+		60g) band="3:";;
+		6g) band="4:";;
+	esac
+
+	iw "$phy" info | awk -v band="$band" -v channel="[$channel]" '
+
+$1 ~ /Band/ {
+	band_match = band == $2
+}
+
+band_match && $3 == "MHz" && $4 == channel {
+	print int($2)
+	exit
+}
+'
+}
+
+chan_is_dfs() {
+	local phy="$1"
+	local chan="$2"
+	iw "$phy" info | grep -E -m1 "(\* ${chan:-....} MHz${chan:+|\\[$chan\\]})" | grep -q "MHz.*radar detection"
+	return $!
+}
+
+mac80211_set_noscan() {
+	hostapd_noscan=1
+}
+
+drv_mac80211_cleanup() {
+	:
+}
+
+mac80211_reset_config() {
+	hostapd_conf_file="/var/run/hostapd-$phy$vif_phy_suffix.conf"
+	ubus_call hostapd config_set '{ "phy": "'"$phy"'", "radio": '"$radio"', "config": "", "prev_config": "'"$hostapd_conf_file"'" }' > /dev/null
+	ubus_call wpa_supplicant config_set '{ "phy": "'"$phy"'", "radio": '"$radio"', "config": [] }' > /dev/null
+	wdev_tool "$phy$phy_suffix" set_config '{}'
+}
+
+mac80211_set_suffix() {
+	[ "$radio" = "-1" ] && radio=
+	phy_suffix="${radio:+:$radio}"
+	vif_phy_suffix="${radio:+.$radio}"
+	set_default radio -1
+}
+
+drv_mac80211_setup() {
+	json_select config
+	json_get_vars \
+		radio phy macaddr path \
+		country chanbw distance \
+		txpower \
+		rxantenna txantenna \
+		frag rts beacon_int:100 htmode \
+		num_global_macaddr:1 multiple_bssid \
+		ifname_prefix macaddr_base
+	json_get_values basic_rate_list basic_rate
+	json_get_values scan_list scan_list
+	json_select ..
+
+	mac80211_set_suffix
+
+	json_select data && {
+		json_get_var prev_rxantenna rxantenna
+		json_get_var prev_txantenna txantenna
+		json_select ..
+	}
+
+	find_phy || {
+		echo "Could not find PHY for device '$1'"
+		wireless_set_retry 0
+		return 1
+	}
+
+	set_default ifname_prefix "$phy$vif_phy_suffix-"
+
+	local wdev
+	local cwdev
+	local found
+
+	# convert channel to frequency
+	[ "$auto_channel" -gt 0 ] || freq="$(get_freq "$phy" "$channel" "$band")"
+
+	[ -n "$country" ] && {
+		iw reg get | grep -q "^country $country:" || {
+			iw reg set "$country"
+			sleep 1
+		}
+	}
+
+	hostapd_conf_file="/var/run/hostapd-$phy$vif_phy_suffix.conf"
+
+	macidx=0
+	staidx=0
+
+	[ -n "$chanbw" ] && {
+		for file in /sys/kernel/debug/ieee80211/$phy/ath9k*/chanbw /sys/kernel/debug/ieee80211/$phy/ath5k/bwmode; do
+			[ -f "$file" ] && echo "$chanbw" > "$file"
+		done
+	}
+
+	set_default rxantenna 0xffffffff
+	set_default txantenna 0xffffffff
+	set_default distance 0
+
+	[ "$txantenna" = "all" ] && txantenna=0xffffffff
+	[ "$rxantenna" = "all" ] && rxantenna=0xffffffff
+
+	[ "$rxantenna" = "$prev_rxantenna" -a "$txantenna" = "$prev_txantenna" ] || mac80211_reset_config "$phy"
+	wireless_set_data phy="$phy" radio="$radio" txantenna="$txantenna" rxantenna="$rxantenna"
+
+	# each phy sleeps different times to prevent for ubus race condition.
+	if [ "$phy" = "phy1" ] || [ "$radio" = "1" ]; then
+		sleep 3;
+	elif [ "$phy" = "phy2" ] || [ "$radio" = "2" ]; then
+		sleep 6;
+	fi
+
+	iw phy "$phy" set antenna $txantenna $rxantenna >/dev/null 2>&1
+	iw phy "$phy" set distance "$distance" >/dev/null 2>&1
+
+	[ -n "$frag" ] && iw phy "$phy" set frag "${frag%%.*}"
+	[ -n "$rts" ] && iw phy "$phy" set rts "${rts%%.*}"
+
+	has_ap=
+	hostapd_ctrl=
+	ap_ifname=
+	hostapd_noscan=
+	wpa_supp_init=
+	for_each_interface "ap" mac80211_check_ap
+
+	[ -f "$hostapd_conf_file" ] && mv "$hostapd_conf_file" "$hostapd_conf_file.prev"
+
+	for_each_interface "sta adhoc mesh" mac80211_set_noscan
+	[ -n "$has_ap" ] && mac80211_hostapd_setup_base "$phy"
+
+	local prev
+	json_set_namespace wdev_uc prev
+	json_init
+	json_set_namespace "$prev"
+
+	wpa_supplicant_init_config
+
+	mac80211_prepare_iw_htmode
+	active_ifnames=
+	for_each_interface "ap sta adhoc mesh monitor" mac80211_prepare_vif
+	for_each_interface "ap sta adhoc mesh monitor" mac80211_setup_vif
+
+	[ -x /usr/sbin/wpa_supplicant ] && wpa_supplicant_set_config "$phy" "$radio"
+	[ -x /usr/sbin/hostapd ] && hostapd_set_config "$phy" "$radio"
+
+	[ -x /usr/sbin/wpa_supplicant ] && wpa_supplicant_start "$phy" "$radio"
+
+	json_set_namespace wdev_uc prev
+	wdev_tool "$phy$phy_suffix" set_config "$(json_dump)" $active_ifnames
+	json_set_namespace "$prev"
+
+	[ -z "$phy_suffix" ] && {
+		if [ -n "$txpower" ]; then
+			iw phy "$phy" set txpower fixed "${txpower%%.*}00"
+		else
+			iw phy "$phy" set txpower auto
+		fi
+	}
+
+	for_each_interface "ap sta adhoc mesh monitor" mac80211_set_vif_txpower
+	wireless_set_up
+}
+
+_list_phy_interfaces() {
+	local phy="$1"
+	if [ -d "/sys/class/ieee80211/${phy}/device/net" ]; then
+		ls "/sys/class/ieee80211/${phy}/device/net" 2>/dev/null;
+	else
+		ls "/sys/class/ieee80211/${phy}/device" 2>/dev/null | grep net: | sed -e 's,net:,,g'
+	fi
+}
+
+list_phy_interfaces() {
+	local phy="$1"
+
+	for dev in $(_list_phy_interfaces "$phy"); do
+		readlink "/sys/class/net/${dev}/phy80211" | grep -q "/${phy}\$" || continue
+		echo "$dev"
+	done
+}
+
+drv_mac80211_teardown() {
+	json_select data
+	json_get_vars phy radio
+	json_select ..
+	[ -n "$phy" ] || {
+		echo "Bug: PHY is undefined for device '$1'"
+		return 1
+	}
+
+	mac80211_set_suffix
+	mac80211_reset_config "$phy"
+}
+
+add_driver mac80211
diff --git a/wireless-scripts-example/old/wireless b/wireless-scripts-example/old/wireless
new file mode 100644
index 0000000000..1a28113df7
--- /dev/null
+++ b/wireless-scripts-example/old/wireless
@@ -0,0 +1,102 @@
+
+config wifi-device 'radio0'
+	option type 'mac80211'
+	option path 'soc/11300000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
+	option radio '0'
+	option band '2g'
+	option channel '1'
+	option htmode 'EHT40'
+	option country 'US'
+	option disabled '0'
+	option noscan '1'
+	option rnr '1'
+	option tx_burst '0.0'
+
+config wifi-iface 'default_radio0_mld'
+	option device 'radio0'
+	option network 'lan'
+	option mode 'ap'
+	option mld_id '1'
+	option ieee80211w '1'
+	option encryption 'psk2'
+	option encryption_rsno 'sae'
+
+config wifi-iface 'default_radio0'
+	option device 'radio0'
+	option network 'lan'
+	option mode 'ap'
+	option ssid 'OpenWrt-2g'
+	option encryption 'none'
+	option mbo '0'
+
+config wifi-device 'radio1'
+	option type 'mac80211'
+	option path 'soc/11300000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
+	option radio '1'
+	option band '5g'
+	option channel '36'
+	option htmode 'EHT160'
+	option country 'US'
+	option disabled '0'
+	option noscan '1'
+	option rnr '1'
+	option background_radar '1'
+	option tx_burst '0.0'
+
+config wifi-iface 'default_radio1_mld'
+	option device 'radio1'
+	option network 'lan'
+	option mode 'ap'
+	option mld_id '1'
+	option ieee80211w '1'
+	option encryption 'psk2'
+	option encryption_rsno 'sae'
+
+config wifi-iface 'default_radio1'
+	option device 'radio1'
+	option network 'lan'
+	option mode 'ap'
+	option ssid 'OpenWrt-5g'
+	option encryption 'none'
+	option mbo '0'
+
+config wifi-device 'radio2'
+	option type 'mac80211'
+	option path 'soc/11300000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
+	option radio '2'
+	option band '6g'
+	option channel '37'
+	option htmode 'EHT320'
+	option country 'US'
+	option disabled '0'
+	option noscan '0'
+	option mbssid '1'
+	option tx_burst '0.0'
+
+config wifi-iface 'default_radio2_mld'
+	option device 'radio2'
+	option network 'lan'
+	option mode 'ap'
+	option mld_id '1'
+	option ieee80211w '2'
+	option encryption 'sae'
+
+config wifi-iface 'default_radio2'
+	option device 'radio2'
+	option network 'lan'
+	option mode 'ap'
+	option ssid 'OpenWrt-6g'
+	option encryption 'sae'
+	option mbo '1'
+	option key '12345678'
+	option sae_pwe '2'
+	option ieee80211w '2'
+
+config wifi-mld 'ap_mld_1'
+	option ifname 'ap-mld-1'
+	option mld_id '1'
+	option ssid 'MT76_AP_MLD'
+	option encryption_rsno_2 'sae-ext'
+	option key '12345678'
+	option sae_pwe '2'
+
diff --git a/wireless-scripts-example/old/wpa_supplicant.uc b/wireless-scripts-example/old/wpa_supplicant.uc
new file mode 100644
index 0000000000..81d6903629
--- /dev/null
+++ b/wireless-scripts-example/old/wpa_supplicant.uc
@@ -0,0 +1,425 @@
+let libubus = require("ubus");
+import { open, readfile } from "fs";
+import { wdev_create, wdev_set_mesh_params, wdev_remove, is_equal, wdev_set_up, vlist_new, phy_open } from "common";
+
+let ubus = libubus.connect();
+
+wpas.data.config = {};
+wpas.data.iface_phy = {};
+wpas.data.macaddr_list = {};
+
+function iface_stop(iface)
+{
+	let ifname = iface.config.iface;
+
+	if (!iface.running)
+		return;
+
+	delete wpas.data.iface_phy[ifname];
+	wpas.remove_iface(ifname);
+	wdev_remove(ifname);
+	iface.running = false;
+}
+
+function iface_start(phydev, iface, macaddr_list)
+{
+	let phy = phydev.name;
+
+	if (iface.running)
+		return;
+
+	let ifname = iface.config.iface;
+	let wdev_config = {};
+	for (let field in iface.config)
+		wdev_config[field] = iface.config[field];
+	if (!wdev_config.macaddr)
+		wdev_config.macaddr = phydev.macaddr_next();
+	if (wdev_config.mld_allowed_phy_bitmap)
+		wdev_config.mld_radio_mask = wdev_config.mld_allowed_phy_bitmap;
+
+	wpas.data.iface_phy[ifname] = phy;
+	wdev_remove(ifname);
+	let ret = phydev.wdev_add(ifname, wdev_config);
+	if (ret)
+		wpas.printf(`Failed to create device ${ifname}: ${ret}`);
+	wdev_set_up(ifname, true);
+	wpas.add_iface(iface.config);
+	iface.running = true;
+}
+
+function iface_cb(new_if, old_if)
+{
+	if (old_if && new_if && is_equal(old_if.config, new_if.config)) {
+		new_if.running = old_if.running;
+		return;
+	}
+
+	if (new_if && old_if)
+		wpas.printf(`Update configuration for interface ${old_if.config.iface}`);
+	else if (old_if)
+		wpas.printf(`Remove interface ${old_if.config.iface}`);
+
+	if (old_if)
+		iface_stop(old_if);
+}
+
+function prepare_config(config, radio)
+{
+	config.config_data = readfile(config.config);
+
+	return { config };
+}
+
+function set_config(config_name, phy_name, radio, num_global_macaddr, config_list)
+{
+	let phy = wpas.data.config[config_name];
+
+	if (radio < 0)
+		radio = null;
+
+	if (!phy) {
+		phy = vlist_new(iface_cb, false);
+		phy.name = phy_name;
+		wpas.data.config[config_name] = phy;
+	}
+
+	phy.radio = radio;
+	phy.num_global_macaddr = num_global_macaddr;
+
+	let values = [];
+	for (let config in config_list)
+		push(values, [ config.iface, prepare_config(config) ]);
+
+	phy.update(values);
+}
+
+function start_pending(phy_name)
+{
+	let phy = wpas.data.config[phy_name];
+	let ubus = wpas.data.ubus;
+
+	if (!phy || !phy.data)
+		return;
+
+	let phydev = phy_open(phy.name, phy.radio);
+	if (!phydev) {
+		wpas.printf(`Could not open phy ${phy_name}`);
+		return;
+	}
+
+	let macaddr_list = wpas.data.macaddr_list[phy_name];
+	phydev.macaddr_init(macaddr_list, { num_global: phy.num_global_macaddr });
+
+	for (let ifname in phy.data)
+		iface_start(phydev, phy.data[ifname]);
+}
+
+function phy_name(phy, radio)
+{
+	if (!phy)
+		return null;
+
+	if (radio != null && radio >= 0)
+		phy += "." + radio;
+
+	return phy;
+}
+
+let main_obj = {
+	phy_set_state: {
+		args: {
+			phy: "",
+			radio: 0,
+			stop: true,
+		},
+		call: function(req) {
+			let name = phy_name(req.args.phy, req.args.radio);
+			if (!name || req.args.stop == null)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			let phy = wpas.data.config[name];
+			if (!phy)
+				return libubus.STATUS_NOT_FOUND;
+
+			try {
+				if (req.args.stop) {
+					for (let ifname in phy.data)
+						iface_stop(phy.data[ifname]);
+				} else {
+					start_pending(name);
+				}
+			} catch (e) {
+				wpas.printf(`Error chaging state: ${e}\n${e.stacktrace[0].context}`);
+				return libubus.STATUS_INVALID_ARGUMENT;
+			}
+			return 0;
+		}
+	},
+	phy_set_macaddr_list: {
+		args: {
+			phy: "",
+			radio: 0,
+			macaddr: [],
+		},
+		call: function(req) {
+			let phy = phy_name(req.args.phy, req.args.radio);
+			if (!phy)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			wpas.data.macaddr_list[phy] = req.args.macaddr;
+			return 0;
+		}
+	},
+	phy_status: {
+		args: {
+			phy: "",
+			radio: 0,
+		},
+		call: function(req) {
+			let phy = phy_name(req.args.phy, req.args.radio);
+			if (!phy)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			phy = wpas.data.config[phy];
+			if (!phy)
+				return libubus.STATUS_NOT_FOUND;
+
+			for (let ifname in phy.data) {
+				try {
+					let iface = wpas.interfaces[ifname];
+					if (!iface)
+						continue;
+
+					let status = iface.status();
+					if (!status)
+						continue;
+
+					if (status.state == "INTERFACE_DISABLED")
+						continue;
+
+					status.ifname = ifname;
+					return status;
+				} catch (e) {
+					continue;
+				}
+			}
+
+			return libubus.STATUS_NOT_FOUND;
+		}
+	},
+	config_set: {
+		args: {
+			phy: "",
+			radio: 0,
+			num_global_macaddr: 0,
+			config: [],
+			defer: true,
+		},
+		call: function(req) {
+			let phy = phy_name(req.args.phy, req.args.radio);
+			if (!phy)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			wpas.printf(`Set new config for phy ${phy}`);
+			try {
+				if (req.args.config)
+					set_config(phy, req.args.phy, req.args.radio, req.args.num_global_macaddr, req.args.config);
+
+				if (!req.args.defer)
+					start_pending(phy);
+			} catch (e) {
+				wpas.printf(`Error loading config: ${e}\n${e.stacktrace[0].context}`);
+				return libubus.STATUS_INVALID_ARGUMENT;
+			}
+
+			return {
+				pid: wpas.getpid()
+			};
+		}
+	},
+	config_add: {
+		args: {
+			driver: "",
+			iface: "",
+			bridge: "",
+			hostapd_ctrl: "",
+			ctrl: "",
+			config: "",
+		},
+		call: function(req) {
+			if (!req.args.iface || !req.args.config)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			if (wpas.add_iface(req.args) < 0)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			return {
+				pid: wpas.getpid()
+			};
+		}
+	},
+	config_remove: {
+		args: {
+			iface: ""
+		},
+		call: function(req) {
+			if (!req.args.iface)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			wpas.remove_iface(req.args.iface);
+			return 0;
+		}
+	},
+	bss_info: {
+		args: {
+			iface: "",
+		},
+		call: function(req) {
+			let ifname = req.args.iface;
+			if (!ifname)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			let iface = wpas.interfaces[ifname];
+			if (!iface)
+				return libubus.STATUS_NOT_FOUND;
+
+			let status = iface.ctrl("STATUS");
+			if (!status)
+				return libubus.STATUS_NOT_FOUND;
+
+			let ret = {};
+			status = split(status, "\n");
+			for (let line in status) {
+				line = split(line, "=", 2);
+				ret[line[0]] = line[1];
+			}
+
+			return ret;
+		}
+	},
+};
+
+wpas.data.ubus = ubus;
+wpas.data.obj = ubus.publish("wpa_supplicant", main_obj);
+wpas.udebug_set("wpa_supplicant", wpas.data.ubus);
+
+function iface_event(type, name, data) {
+	let ubus = wpas.data.ubus;
+
+	data ??= {};
+	data.name = name;
+	wpas.data.obj.notify(`iface.${type}`, data, null, null, null, -1);
+	ubus.call("service", "event", { type: `wpa_supplicant.${name}.${type}`, data: {} });
+}
+
+function iface_hostapd_notify(phy, ifname, iface, state, link_id)
+{
+	let ubus = wpas.data.ubus;
+	let msg = { phy: phy };
+
+	wpas.printf(`ucode: mtk: wpa_s in state ${state} notifies hostapd`);
+	switch (state) {
+	case "DISCONNECTED":
+	case "AUTHENTICATING":
+	case "SCANNING":
+		msg.up = false;
+		break;
+	case "INTERFACE_DISABLED":
+	case "INACTIVE":
+		msg.up = true;
+		break;
+	case "COMPLETED":
+		let status = iface.status(link_id);
+		msg.up = true;
+		msg.frequency = status.frequency;
+		msg.sec_chan_offset = status.sec_chan_offset;
+		msg.ch_width = status.ch_width;
+		msg.bw320_offset = status.bw320_offset;
+		msg.radio_idx = status.radio_idx;
+		msg.punct_bitmap = status.punct_bitmap;
+		break;
+	default:
+		return;
+	}
+
+	ubus.call("hostapd", "apsta_state", msg);
+}
+
+function iface_channel_switch(phy, ifname, iface, info)
+{
+	let msg = {
+		phy: phy,
+		up: true,
+		csa: true,
+		csa_count: info.csa_count ? info.csa_count - 1 : 0,
+		frequency: info.frequency,
+		ch_width: info.ch_width,
+		bw320_offset: info.bw320_offset,
+		radio_idx: info.radio_idx,
+		sec_chan_offset: info.sec_chan_offset,
+		punct_bitmap: info.punct_bitmap,
+	};
+	ubus.call("hostapd", "apsta_state", msg);
+}
+
+return {
+	shutdown: function() {
+		for (let phy in wpas.data.config)
+			set_config(phy, []);
+		wpas.ubus.disconnect();
+	},
+	iface_add: function(name, obj) {
+		iface_event("add", name);
+	},
+	iface_remove: function(name, obj) {
+		iface_event("remove", name);
+	},
+	state: function(ifname, iface, state) {
+		let phy = wpas.data.iface_phy[ifname];
+		let ret = iface.get_valid_links();
+		let link_id = 0, valid_links = ret.valid_links;
+		if (!phy) {
+			wpas.printf(`no PHY for ifname ${ifname}`);
+			return;
+		}
+
+		if (valid_links) {
+			while (valid_links) {
+				if (valid_links & 1)
+					iface_hostapd_notify(phy, ifname, iface, state, link_id);
+
+				link_id++;
+				valid_links >>= 1;
+			}
+		} else {
+			iface_hostapd_notify(phy, ifname, iface, state, -1);
+		}
+
+		if (state != "COMPLETED")
+			return;
+
+		let phy_data = wpas.data.config[phy];
+		if (!phy_data)
+			return;
+
+		let iface_data = phy_data.data[ifname];
+		if (!iface_data)
+			return;
+
+		let wdev_config = iface_data.config;
+		if (!wdev_config || wdev_config.mode != "mesh")
+			return;
+
+		wdev_set_mesh_params(ifname, wdev_config);
+	},
+	event: function(ifname, iface, ev, info) {
+		let phy = wpas.data.iface_phy[ifname];
+		if (!phy) {
+			wpas.printf(`no PHY for ifname ${ifname}`);
+			return;
+		}
+
+		if (ev == "CH_SWITCH_STARTED" || ev == "LINK_CH_SWITCH_STARTED")
+			iface_channel_switch(phy, ifname, iface, info);
+	}
+};
diff --git a/wireless-scripts-example/vanila/common.uc b/wireless-scripts-example/vanila/common.uc
new file mode 100644
index 0000000000..f801c4940c
--- /dev/null
+++ b/wireless-scripts-example/vanila/common.uc
@@ -0,0 +1,423 @@
+import * as nl80211 from "nl80211";
+import * as rtnl from "rtnl";
+import { readfile, glob, basename, readlink, open } from "fs";
+
+const iftypes = {
+	ap: nl80211.const.NL80211_IFTYPE_AP,
+	mesh: nl80211.const.NL80211_IFTYPE_MESH_POINT,
+	sta: nl80211.const.NL80211_IFTYPE_STATION,
+	adhoc: nl80211.const.NL80211_IFTYPE_ADHOC,
+	monitor: nl80211.const.NL80211_IFTYPE_MONITOR,
+};
+
+const mesh_params = {
+	mesh_retry_timeout: "retry_timeout",
+	mesh_confirm_timeout: "confirm_timeout",
+	mesh_holding_timeout: "holding_timeout",
+	mesh_max_peer_links: "max_peer_links",
+	mesh_max_retries: "max_retries",
+	mesh_ttl: "ttl",
+	mesh_element_ttl: "element_ttl",
+	mesh_auto_open_plinks: "auto_open_plinks",
+	mesh_hwmp_max_preq_retries: "hwmp_max_preq_retries",
+	mesh_path_refresh_time: "path_refresh_time",
+	mesh_min_discovery_timeout: "min_discovery_timeout",
+	mesh_hwmp_active_path_timeout: "hwmp_active_path_timeout",
+	mesh_hwmp_preq_min_interval: "hwmp_preq_min_interval",
+	mesh_hwmp_net_diameter_traversal_time: "hwmp_net_diam_trvs_time",
+	mesh_hwmp_rootmode: "hwmp_rootmode",
+	mesh_hwmp_rann_interval: "hwmp_rann_interval",
+	mesh_gate_announcements: "gate_announcements",
+	mesh_sync_offset_max_neighor: "sync_offset_max_neighbor",
+	mesh_rssi_threshold: "rssi_threshold",
+	mesh_hwmp_active_path_to_root_timeout: "hwmp_path_to_root_timeout",
+	mesh_hwmp_root_interval: "hwmp_root_interval",
+	mesh_hwmp_confirmation_interval: "hwmp_confirmation_interval",
+	mesh_awake_window: "awake_window",
+	mesh_plink_timeout: "plink_timeout",
+	mesh_fwding: "forwarding",
+	mesh_power_mode: "power_mode",
+	mesh_nolearn: "nolearn"
+};
+
+function wdev_remove(name)
+{
+	nl80211.request(nl80211.const.NL80211_CMD_DEL_INTERFACE, 0, { dev: name });
+}
+
+function __phy_is_fullmac(phyidx)
+{
+	let data = nl80211.request(nl80211.const.NL80211_CMD_GET_WIPHY, 0, { wiphy: phyidx });
+
+	return !data.software_iftypes.monitor;
+}
+
+function phy_is_fullmac(phy)
+{
+	let phyidx = int(trim(readfile(`/sys/class/ieee80211/${phy}/index`)));
+
+	return __phy_is_fullmac(phyidx);
+}
+
+function find_reusable_wdev(phyidx)
+{
+	if (!__phy_is_fullmac(phyidx))
+		return null;
+
+	let data = nl80211.request(
+		nl80211.const.NL80211_CMD_GET_INTERFACE,
+		nl80211.const.NLM_F_DUMP,
+		{ wiphy: phyidx });
+	for (let res in data)
+		if (trim(readfile(`/sys/class/net/${res.ifname}/operstate`)) == "down")
+			return res.ifname;
+	return null;
+}
+
+function wdev_set_radio_mask(name, mask)
+{
+	nl80211.request(nl80211.const.NL80211_CMD_SET_INTERFACE, 0, {
+		dev: name,
+		vif_radio_mask: mask
+	});
+}
+
+function wdev_create(phy, name, data)
+{
+	let phyidx = int(readfile(`/sys/class/ieee80211/${phy}/index`));
+
+	wdev_remove(name);
+
+	if (!iftypes[data.mode])
+		return `Invalid mode: ${data.mode}`;
+
+	let req = {
+		wiphy: phyidx,
+		ifname: name,
+		iftype: iftypes[data.mode],
+	};
+
+	if (data["4addr"])
+		req["4addr"] = data["4addr"];
+	if (data.macaddr)
+		req.mac = data.macaddr;
+	if (data.radio_mask > 0)
+		req.vif_radio_mask = data.radio_mask;
+	else if (data.radio != null && data.radio >= 0)
+		req.vif_radio_mask = 1 << data.radio;
+
+	nl80211.error();
+
+	let reuse_ifname = find_reusable_wdev(phyidx);
+	if (reuse_ifname &&
+	    (reuse_ifname == name ||
+	     rtnl.request(rtnl.const.RTM_SETLINK, 0, { dev: reuse_ifname, ifname: name}) != false)) {
+		req.dev = req.ifname;
+		delete req.ifname;
+		nl80211.request(nl80211.const.NL80211_CMD_SET_INTERFACE, 0, req);
+	} else {
+		nl80211.request(
+			nl80211.const.NL80211_CMD_NEW_INTERFACE,
+			nl80211.const.NLM_F_CREATE,
+			req);
+	}
+
+	let error = nl80211.error();
+	if (error)
+		return error;
+
+	if (data.powersave != null) {
+		nl80211.request(nl80211.const.NL80211_CMD_SET_POWER_SAVE, 0,
+			{ dev: name, ps_state: data.powersave ? 1 : 0});
+	}
+
+	return null;
+}
+
+function wdev_set_mesh_params(name, data)
+{
+	let mesh_cfg = {};
+
+	for (let key in mesh_params) {
+		let val = data[key];
+		if (val == null)
+			continue;
+		mesh_cfg[mesh_params[key]] = int(val);
+	}
+
+	if (!length(mesh_cfg))
+		return null;
+
+	nl80211.request(nl80211.const.NL80211_CMD_SET_MESH_CONFIG, 0,
+		{ dev: name, mesh_params: mesh_cfg });
+
+	return nl80211.error();
+}
+
+function wdev_set_up(name, up)
+{
+	rtnl.request(rtnl.const.RTM_SETLINK, 0, { dev: name, change: 1, flags: up ? 1 : 0 });
+}
+
+function phy_sysfs_file(phy, name)
+{
+	return trim(readfile(`/sys/class/ieee80211/${phy}/${name}`));
+}
+
+function macaddr_split(str)
+{
+	return map(split(str, ":"), (val) => hex(val));
+}
+
+function macaddr_join(addr)
+{
+	return join(":", map(addr, (val) => sprintf("%02x", val)));
+}
+
+function wdev_macaddr(wdev)
+{
+	return trim(readfile(`/sys/class/net/${wdev}/address`));
+}
+
+const phy_proto = {
+	macaddr_init: function(used, options) {
+		this.macaddr_options = options ?? {};
+		this.macaddr_list = {};
+
+		if (type(used) == "object")
+			for (let addr in used)
+				this.macaddr_list[addr] = used[addr];
+		else
+			for (let addr in used)
+				this.macaddr_list[addr] = -1;
+
+		this.for_each_wdev((wdev) => {
+			let macaddr = wdev_macaddr(wdev);
+			this.macaddr_list[macaddr] ??= -1;
+		});
+
+		return this.macaddr_list;
+	},
+
+	macaddr_generate: function(data) {
+		let phy = this.phy;
+		let radio_idx = this.radio;
+		let idx = int(data.id ?? 0);
+		let mbssid = int(data.mbssid ?? 0) > 0;
+		let num_global = int(data.num_global ?? 1);
+		let use_global = !mbssid && idx < num_global;
+
+		let base_addr = phy_sysfs_file(phy, "macaddress");
+		if (!base_addr)
+			return null;
+
+		let base_mask = phy_sysfs_file(phy, "address_mask");
+		if (!base_mask)
+			return null;
+
+		if (base_mask == "00:00:00:00:00:00")
+			base_mask = "ff:ff:ff:ff:ff:ff";
+
+		if (data.macaddr_base)
+			base_addr = data.macaddr_base;
+		else if (base_mask == "ff:ff:ff:ff:ff:ff" &&
+		    (radio_idx > 0 || idx >= num_global)) {
+			let addrs = split(phy_sysfs_file(phy, "addresses"), "\n");
+
+			if (radio_idx != null) {
+				if (radio_idx && radio_idx < length(addrs))
+					base_addr = addrs[radio_idx];
+				else
+					idx += radio_idx * 16;
+			} else {
+				if (idx < length(addrs))
+					return addrs[idx];
+			}
+		}
+
+		if (!idx && !mbssid)
+			return base_addr;
+
+		let addr = macaddr_split(base_addr);
+		let mask = macaddr_split(base_mask);
+		let type;
+
+		if (mbssid)
+			type = "b5";
+		else if (use_global)
+			type = "add";
+		else if (mask[0] > 0)
+			type = "b1";
+		else if (mask[5] < 0xff)
+			type = "b5";
+		else
+			type = "add";
+
+		switch (type) {
+		case "b1":
+			if (!(addr[0] & 2))
+				idx--;
+			addr[0] |= 2;
+			addr[0] ^= idx << 2;
+			break;
+		case "b5":
+			if (mbssid)
+				addr[0] |= 2;
+			addr[5] ^= idx;
+			break;
+		default:
+			for (let i = 5; i > 0; i--) {
+				addr[i] += idx;
+				if (addr[i] < 256)
+					break;
+				addr[i] %= 256;
+			}
+			break;
+		}
+
+		return macaddr_join(addr);
+	},
+
+	macaddr_next: function(val) {
+		let data = this.macaddr_options ?? {};
+		let list = this.macaddr_list;
+
+		for (let i = 0; i < 32; i++) {
+			data.id = i;
+
+			let mac = this.macaddr_generate(data);
+			if (!mac)
+				return null;
+
+			if (list[mac] != null)
+				continue;
+
+			list[mac] = val != null ? val : -1;
+			return mac;
+		}
+	},
+
+	wdev_add: function(name, data) {
+		let phydev = this;
+		wdev_create(this.phy, name, {
+			...data,
+			radio: this.radio,
+		});
+	},
+
+	for_each_wdev: function(cb) {
+		let wdevs = nl80211.request(
+			nl80211.const.NL80211_CMD_GET_INTERFACE,
+			nl80211.const.NLM_F_DUMP,
+			{ wiphy: this.idx }
+		);
+
+		let mac_wdev = {};
+		for (let wdev in wdevs) {
+			if (wdev.iftype == nl80211.const.NL80211_IFTYPE_AP_VLAN)
+				continue;
+			if (this.radio != null && wdev.vif_radio_mask != null &&
+			    wdev.vif_radio_mask != (1 << this.radio))
+				continue;
+			mac_wdev[wdev.mac] = wdev;
+		}
+
+		for (let wdev in wdevs) {
+			if (!mac_wdev[wdev.mac])
+				continue;
+
+			cb(wdev.ifname);
+		}
+	}
+};
+
+function phy_open(phy, radio)
+{
+	let phyidx = readfile(`/sys/class/ieee80211/${phy}/index`);
+	if (!phyidx)
+		return null;
+
+	let name = phy;
+	if (radio === "" || radio < 0)
+		radio = null;
+	if (radio != null)
+		name += "." + radio;
+
+	return proto({
+		phy, name, radio,
+		idx: int(phyidx),
+	}, phy_proto);
+}
+
+const vlist_proto = {
+	update: function(values, arg) {
+		let data = this.data;
+		let cb = this.cb;
+		let seq = { };
+		let new_data = {};
+		let old_data = {};
+
+		this.data = new_data;
+
+		if (type(values) == "object") {
+			for (let key in values) {
+				old_data[key] = data[key];
+				new_data[key] = values[key];
+				delete data[key];
+			}
+		} else {
+			for (let val in values) {
+				let cur_key = val[0];
+				let cur_obj = val[1];
+
+				old_data[cur_key] = data[cur_key];
+				new_data[cur_key] = val[1];
+				delete data[cur_key];
+			}
+		}
+
+		for (let key in data) {
+			cb(null, data[key], arg);
+			delete data[key];
+		}
+		for (let key in new_data)
+			cb(new_data[key], old_data[key], arg);
+	}
+};
+
+function is_equal(val1, val2) {
+	let t1 = type(val1);
+
+	if (t1 != type(val2))
+		return false;
+
+	if (t1 == "array") {
+		if (length(val1) != length(val2))
+			return false;
+
+		for (let i = 0; i < length(val1); i++)
+			if (!is_equal(val1[i], val2[i]))
+				return false;
+
+		return true;
+	} else if (t1 == "object") {
+		for (let key in val1)
+			if (!is_equal(val1[key], val2[key]))
+				return false;
+		for (let key in val2)
+			if (val1[key] == null)
+				return false;
+		return true;
+	} else {
+		return val1 == val2;
+	}
+}
+
+function vlist_new(cb) {
+	return proto({
+		cb: cb,
+		data: {}
+	}, vlist_proto);
+}
+
+export { wdev_remove, wdev_create, wdev_set_mesh_params, wdev_set_radio_mask, wdev_set_up, is_equal, vlist_new, phy_is_fullmac, phy_open };
diff --git a/wireless-scripts-example/vanila/hostapd.sh b/wireless-scripts-example/vanila/hostapd.sh
new file mode 100644
index 0000000000..21e980b86a
--- /dev/null
+++ b/wireless-scripts-example/vanila/hostapd.sh
@@ -0,0 +1,1687 @@
+. /lib/functions/network.sh
+. /lib/functions.sh
+
+wpa_supplicant_add_rate() {
+	local var="$1"
+	local val="$(($2 / 1000))"
+	local sub="$((($2 / 100) % 10))"
+	append $var "$val" ","
+	[ $sub -gt 0 ] && append $var "."
+}
+
+hostapd_add_rate() {
+	local var="$1"
+	local val="$(($2 / 100))"
+	append $var "$val" " "
+}
+
+hostapd_append_wep_key() {
+	local var="$1"
+
+	wep_keyidx=0
+	set_default key 1
+	case "$key" in
+		[1234])
+			for idx in 1 2 3 4; do
+				local zidx
+				zidx="$(($idx - 1))"
+				json_get_var ckey "key${idx}"
+				[ -n "$ckey" ] && \
+					append $var "wep_key${zidx}=$(prepare_key_wep "$ckey")" "$N$T"
+			done
+			wep_keyidx="$((key - 1))"
+		;;
+		*)
+			append $var "wep_key0=$(prepare_key_wep "$key")" "$N$T"
+		;;
+	esac
+}
+
+hostapd_append_wpa_key_mgmt() {
+	local auth_type_l="$(echo $auth_type | tr 'a-z' 'A-Z')"
+
+	case "$auth_type" in
+		psk|eap)
+			append wpa_key_mgmt "WPA-$auth_type_l"
+			[ "${wpa:-2}" -ge 2 ] && [ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-${auth_type_l}"
+			[ "${ieee80211w:-0}" -gt 0 ] && append wpa_key_mgmt "WPA-${auth_type_l}-SHA256"
+		;;
+		eap192)
+			append wpa_key_mgmt "WPA-EAP-SUITE-B-192"
+			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-EAP-SHA384"
+		;;
+		eap-eap2)
+			append wpa_key_mgmt "WPA-EAP-SHA256"
+			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-EAP"
+			[ "$rsn_override" -gt 0 ] && rsn_override_key_mgmt="$wpa_key_mgmt"
+			append wpa_key_mgmt "WPA-EAP"
+		;;
+		eap2)
+			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-EAP"
+			append wpa_key_mgmt "WPA-EAP-SHA256"
+		;;
+		sae)
+			append wpa_key_mgmt "SAE"
+			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-SAE"
+		;;
+		psk-sae)
+			append wpa_key_mgmt "SAE"
+			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-SAE"
+			[ "$rsn_override" -gt 0 ] && rsn_override_key_mgmt="$wpa_key_mgmt"
+			[ "$rsn_override" -gt 1 ] && wpa_key_mgmt=
+			[ "$band" = "6g" ] || {
+				append wpa_key_mgmt "WPA-PSK"
+				[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-PSK"
+				[ "${ieee80211w:-0}" -gt 0 ] && append wpa_key_mgmt "WPA-PSK-SHA256"
+			}
+		;;
+		owe)
+			append wpa_key_mgmt "OWE"
+		;;
+		dpp)
+			append wpa_key_mgmt "DPP"
+		;;
+	esac
+
+	[ "$dpp" -gt 0 ] && [ "$auth_type" != "dpp" ] && append wpa_key_mgmt "DPP"
+
+	[ "$fils" -gt 0 ] && {
+		case "$auth_type" in
+			eap192)
+				append wpa_key_mgmt FILS-SHA384
+				[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt FT-FILS-SHA384
+			;;
+			eap*)
+				append wpa_key_mgmt FILS-SHA256
+				[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt FT-FILS-SHA256
+
+				[ "$rsn_override" -gt 0 ] && {
+					append rsn_override_key_mgmt FILS-SHA256
+					[ "${ieee80211r:-0}" -gt 0 ] && append rsn_override_key_mgmt FT-FILS-SHA256
+				}
+			;;
+		esac
+	}
+
+}
+
+hostapd_add_log_config() {
+	config_add_boolean \
+		log_80211 \
+		log_8021x \
+		log_radius \
+		log_wpa \
+		log_driver \
+		log_iapp \
+		log_mlme
+
+	config_add_int log_level
+}
+
+hostapd_common_add_device_config() {
+	config_add_array basic_rate
+	config_add_array supported_rates
+	config_add_string beacon_rate
+
+	config_add_string country country3
+	config_add_boolean country_ie doth
+	config_add_boolean spectrum_mgmt_required
+	config_add_int local_pwr_constraint
+	config_add_string require_mode
+	config_add_boolean legacy_rates
+	config_add_int cell_density
+	config_add_int rts_threshold
+	config_add_int rssi_reject_assoc_rssi
+	config_add_int rssi_reject_assoc_timeout
+	config_add_int rssi_ignore_probe_request
+	config_add_int maxassoc
+	config_add_int reg_power_type
+	config_add_boolean stationary_ap
+
+	config_add_string acs_chan_bias
+	config_add_array hostapd_options
+
+	config_add_int airtime_mode
+	config_add_int mbssid
+
+	hostapd_add_log_config
+}
+
+hostapd_prepare_device_config() {
+	local config="$1"
+	local driver="$2"
+
+	local base_cfg=
+
+	json_get_vars country country3 country_ie beacon_int:100 doth require_mode legacy_rates \
+		acs_chan_bias local_pwr_constraint spectrum_mgmt_required airtime_mode cell_density \
+		rts_threshold beacon_rate rssi_reject_assoc_rssi rssi_reject_assoc_timeout rssi_ignore_probe_request \
+		maxassoc mbssid:0 band reg_power_type stationary_ap
+
+	hostapd_set_log_options base_cfg
+
+	set_default country_ie 1
+	set_default spectrum_mgmt_required 0
+	set_default doth 1
+	set_default legacy_rates 0
+	set_default airtime_mode 0
+	set_default cell_density 0
+
+	[ -n "$country" ] && {
+		append base_cfg "country_code=$country" "$N"
+		[ -n "$country3" ] && append base_cfg "country3=$country3" "$N"
+
+		[ "$country_ie" -gt 0 ] && {
+			append base_cfg "ieee80211d=1" "$N"
+			[ -n "$local_pwr_constraint" ] && append base_cfg "local_pwr_constraint=$local_pwr_constraint" "$N"
+			[ "$spectrum_mgmt_required" -gt 0 ] && append base_cfg "spectrum_mgmt_required=$spectrum_mgmt_required" "$N"
+		}
+		[ "$hwmode" = "a" -a "$doth" -gt 0 ] && append base_cfg "ieee80211h=1" "$N"
+	}
+
+	[ -n "$acs_chan_bias" ] && append base_cfg "acs_chan_bias=$acs_chan_bias" "$N"
+
+	local brlist= br
+	json_get_values basic_rate_list basic_rate
+	local rlist= r
+	json_get_values rate_list supported_rates
+
+	[ -n "$hwmode" ] && append base_cfg "hw_mode=$hwmode" "$N"
+	if [ "$hwmode" = "g" ] || [ "$hwmode" = "a" ]; then
+		[ -n "$require_mode" ] && legacy_rates=0
+		case "$require_mode" in
+			n) append base_cfg "require_ht=1" "$N";;
+			ac) append base_cfg "require_vht=1" "$N";;
+		esac
+	fi
+	case "$hwmode" in
+		b)
+			if [ "$cell_density" -eq 1 ]; then
+				set_default rate_list "5500 11000"
+				set_default basic_rate_list "5500 11000"
+			elif [ "$cell_density" -ge 2 ]; then
+				set_default rate_list "11000"
+				set_default basic_rate_list "11000"
+			fi
+		;;
+		g)
+			if [ "$cell_density" -eq 0 ] || [ "$cell_density" -eq 1 ]; then
+				if [ "$legacy_rates" -eq 0 ]; then
+					set_default rate_list "6000 9000 12000 18000 24000 36000 48000 54000"
+					set_default basic_rate_list "6000 12000 24000"
+				elif [ "$cell_density" -eq 1 ]; then
+					set_default rate_list "5500 6000 9000 11000 12000 18000 24000 36000 48000 54000"
+					set_default basic_rate_list "5500 11000"
+				fi
+			elif [ "$cell_density" -ge 3 ] && [ "$legacy_rates" -ne 0 ] || [ "$cell_density" -eq 2 ]; then
+				if [ "$legacy_rates" -eq 0 ]; then
+					set_default rate_list "12000 18000 24000 36000 48000 54000"
+					set_default basic_rate_list "12000 24000"
+				else
+					set_default rate_list "11000 12000 18000 24000 36000 48000 54000"
+					set_default basic_rate_list "11000"
+				fi
+			elif [ "$cell_density" -ge 3 ]; then
+				set_default rate_list "24000 36000 48000 54000"
+				set_default basic_rate_list "24000"
+			fi
+		;;
+		a)
+			if [ "$cell_density" -eq 1 ]; then
+				set_default rate_list "6000 9000 12000 18000 24000 36000 48000 54000"
+				set_default basic_rate_list "6000 12000 24000"
+			elif [ "$cell_density" -eq 2 ]; then
+				set_default rate_list "12000 18000 24000 36000 48000 54000"
+				set_default basic_rate_list "12000 24000"
+			elif [ "$cell_density" -ge 3 ]; then
+				set_default rate_list "24000 36000 48000 54000"
+				set_default basic_rate_list "24000"
+			fi
+		;;
+	esac
+
+	for r in $rate_list; do
+		hostapd_add_rate rlist "$r"
+	done
+
+	for br in $basic_rate_list; do
+		hostapd_add_rate brlist "$br"
+	done
+
+	[ -n "$rssi_reject_assoc_rssi" ] && append base_cfg "rssi_reject_assoc_rssi=$rssi_reject_assoc_rssi" "$N"
+	[ -n "$rssi_reject_assoc_timeout" ] && append base_cfg "rssi_reject_assoc_timeout=$rssi_reject_assoc_timeout" "$N"
+	[ -n "$rssi_ignore_probe_request" ] && append base_cfg "rssi_ignore_probe_request=$rssi_ignore_probe_request" "$N"
+	[ -n "$beacon_rate" ] && append base_cfg "beacon_rate=$beacon_rate" "$N"
+	[ -n "$rlist" ] && append base_cfg "supported_rates=$rlist" "$N"
+	[ -n "$brlist" ] && append base_cfg "basic_rates=$brlist" "$N"
+	append base_cfg "beacon_int=$beacon_int" "$N"
+	[ -n "$rts_threshold" ] && append base_cfg "rts_threshold=$rts_threshold" "$N"
+	[ "$airtime_mode" -gt 0 ] && append base_cfg "airtime_mode=$airtime_mode" "$N"
+	[ -n "$maxassoc" ] && append base_cfg "iface_max_num_sta=$maxassoc" "$N"
+	[ "$mbssid" -gt 0 ] && [ "$mbssid" -le 2 ] && append base_cfg "mbssid=$mbssid" "$N"
+
+	[ "$band" = "6g" ] && {
+		set_default reg_power_type 0
+		append base_cfg "he_6ghz_reg_pwr_type=$reg_power_type" "$N"
+	}
+
+	set_default stationary_ap 1
+	append base_cfg "stationary_ap=$stationary_ap" "$N"
+
+	json_get_values opts hostapd_options
+	for val in $opts; do
+		append base_cfg "$val" "$N"
+	done
+
+	cat > "$config" <<EOF
+driver=$driver
+$base_cfg
+EOF
+}
+
+hostapd_common_add_bss_config() {
+	config_add_string 'bssid:macaddr' 'ssid:string'
+	config_add_boolean wds uapsd hidden utf8_ssid ppsk
+
+	config_add_int maxassoc max_inactivity
+	config_add_boolean disassoc_low_ack isolate short_preamble skip_inactivity_poll
+
+	config_add_int \
+		wep_rekey eap_reauth_period \
+		wpa_group_rekey wpa_pair_rekey wpa_master_rekey
+	config_add_boolean wpa_strict_rekey
+	config_add_boolean wpa_disable_eapol_key_retries
+
+	config_add_boolean tdls_prohibit
+
+	config_add_boolean rsn_preauth auth_cache
+	config_add_int ieee80211w
+	config_add_int eapol_version
+
+	config_add_array auth_server acct_server
+	config_add_string 'server:host'
+	config_add_string auth_secret key
+	config_add_int 'auth_port:port' 'port:port'
+
+	config_add_string acct_secret
+	config_add_int acct_port
+	config_add_int acct_interval
+
+	config_add_int bss_load_update_period chan_util_avg_period
+
+	config_add_string dae_client
+	config_add_string dae_secret
+	config_add_int dae_port
+
+	config_add_string nasid
+	config_add_string ownip
+	config_add_string radius_client_addr
+	config_add_string iapp_interface
+	config_add_string eap_type ca_cert client_cert identity anonymous_identity auth priv_key priv_key_pwd
+	config_add_boolean ca_cert_usesystem ca_cert2_usesystem
+	config_add_string subject_match subject_match2
+	config_add_array altsubject_match altsubject_match2
+	config_add_array domain_match domain_match2 domain_suffix_match domain_suffix_match2
+	config_add_string ieee80211w_mgmt_cipher
+
+	config_add_int dynamic_vlan vlan_naming vlan_no_bridge
+	config_add_string vlan_tagged_interface vlan_bridge
+	config_add_string vlan_file
+
+	config_add_string 'key1:wepkey' 'key2:wepkey' 'key3:wepkey' 'key4:wepkey' 'password:wpakey'
+
+	config_add_string wpa_psk_file sae_password_file
+
+	config_add_int multi_ap
+
+	config_add_boolean wps_pushbutton wps_label ext_registrar wps_pbc_in_m1
+	config_add_int wps_ap_setup_locked wps_independent
+	config_add_string wps_device_type wps_device_name wps_manufacturer wps_pin
+	config_add_string multi_ap_backhaul_ssid multi_ap_backhaul_key
+
+	config_add_boolean wnm_sleep_mode wnm_sleep_mode_no_keys bss_transition mbo
+	config_add_int time_advertisement
+	config_add_string time_zone
+	config_add_string vendor_elements
+
+	config_add_boolean ieee80211k rrm_neighbor_report rrm_beacon_report
+
+	config_add_boolean ftm_responder stationary_ap
+	config_add_string lci civic
+
+	config_add_boolean ieee80211r pmk_r1_push ft_psk_generate_local ft_over_ds
+	config_add_int r0_key_lifetime reassociation_deadline
+	config_add_string mobility_domain r1_key_holder rxkh_file ft_iface
+	config_add_array r0kh r1kh
+
+	config_add_int ieee80211w_max_timeout ieee80211w_retry_timeout
+	config_add_int rsn_override
+
+	config_add_string macfilter 'macfile:file'
+	config_add_array 'maclist:list(macaddr)'
+
+	config_add_array bssid_blacklist
+	config_add_array bssid_whitelist
+
+	config_add_int mcast_rate
+	config_add_array basic_rate
+	config_add_array supported_rates
+
+	config_add_boolean sae_require_mfp
+	config_add_int sae_pwe sae_track_password
+
+	config_add_string 'owe_transition_bssid:macaddr' 'owe_transition_ssid:string'
+	config_add_string owe_transition_ifname
+
+	config_add_boolean iw_enabled iw_internet iw_asra iw_esr iw_uesa
+	config_add_int iw_access_network_type iw_venue_group iw_venue_type
+	config_add_int iw_ipaddr_type_availability iw_gas_address3
+	config_add_string iw_hessid iw_network_auth_type iw_qos_map_set
+	config_add_array iw_roaming_consortium iw_domain_name iw_anqp_3gpp_cell_net iw_nai_realm
+	config_add_array iw_anqp_elem iw_venue_name iw_venue_url
+
+	config_add_boolean hs20 disable_dgaf
+	config_add_int anqp_domain_id
+	config_add_int hs20_deauth_req_timeout
+	config_add_array hs20_conn_capab
+	config_add_string hs20_wan_metrics hs20_operating_class hs20_t_c_filename hs20_t_c_timestamp
+
+	config_add_string hs20_t_c_server_url
+
+	config_add_array airtime_sta_weight
+	config_add_int airtime_bss_weight airtime_bss_limit
+
+	config_add_boolean multicast_to_unicast multicast_to_unicast_all proxy_arp per_sta_vif na_mcast_to_ucast
+
+	config_add_array hostapd_bss_options
+	config_add_boolean default_disabled
+
+	config_add_boolean request_cui
+	config_add_array radius_auth_req_attr
+	config_add_array radius_acct_req_attr
+
+	config_add_int eap_server radius_server_auth_port
+	config_add_string eap_user_file ca_cert server_cert private_key private_key_passwd server_id radius_server_clients
+
+	config_add_boolean fils
+	config_add_string fils_dhcp
+
+	config_add_boolean dpp
+	config_add_string dpp_connector dpp_csign dpp_netaccesskey
+
+	config_add_int ocv
+	config_add_boolean beacon_prot spp_amsdu
+
+	config_add_boolean apup
+	config_add_string apup_peer_ifname_prefix
+}
+
+hostapd_set_vlan_file() {
+	local ifname="$1"
+	local vlan="$2"
+	json_get_vars name vid
+	echo "${vid} ${ifname}-${name}" >> /var/run/hostapd-${ifname}.vlan
+	wireless_add_vlan "${vlan}" "${ifname}-${name}"
+}
+
+hostapd_set_vlan() {
+	local ifname="$1"
+
+	rm -f /var/run/hostapd-${ifname}.vlan
+	for_each_vlan hostapd_set_vlan_file ${ifname}
+}
+
+hostapd_set_psk_file() {
+	local ifname="$1"
+	local vlan="$2"
+	local vlan_id=""
+
+	json_get_vars vid key
+	json_get_values mac_list mac
+	set_default mac_list "00:00:00:00:00:00"
+	[ -n "$vid" ] && vlan_id="vlanid=$vid "
+	for mac in $mac_list; do
+		echo "${vlan_id} ${mac} ${key}" >> /var/run/hostapd-${ifname}.psk
+	done
+}
+
+hostapd_set_psk() {
+	local ifname="$1"
+
+	rm -f /var/run/hostapd-${ifname}.psk
+	case "$auth_type" in
+		psk|psk-sae) ;;
+		*) return ;;
+	esac
+	for_each_station hostapd_set_psk_file ${ifname}
+}
+
+hostapd_set_sae_file() {
+	local ifname="$1"
+	local vlan="$2"
+	local vlan_id=""
+
+	json_get_vars vid key
+	json_get_values mac_list mac
+	set_default mac_list "ff:ff:ff:ff:ff:ff"
+	[ -n "$vid" ] && vlan_id="|vlanid=$vid"
+	for mac in $mac_list; do
+		mac="|mac=$mac"
+		printf '%s%s%s\n' "${key}" "${mac}" "${vlan_id}" >> /var/run/hostapd-${ifname}.sae
+	done
+}
+
+hostapd_set_sae() {
+	local ifname="$1"
+
+	rm -f /var/run/hostapd-${ifname}.sae
+	case "$auth_type" in
+		sae|psk-sae) ;;
+		*) return ;;
+	esac
+	for_each_station hostapd_set_sae_file ${ifname}
+}
+
+append_iw_roaming_consortium() {
+	[ -n "$1" ] && append bss_conf "roaming_consortium=$1" "$N"
+}
+
+append_iw_domain_name() {
+	if [ -z "$iw_domain_name_conf" ]; then
+		iw_domain_name_conf="$1"
+	else
+		iw_domain_name_conf="$iw_domain_name_conf,$1"
+	fi
+}
+
+append_iw_anqp_3gpp_cell_net() {
+	if [ -z "$iw_anqp_3gpp_cell_net_conf" ]; then
+		iw_anqp_3gpp_cell_net_conf="$1"
+	else
+		iw_anqp_3gpp_cell_net_conf="$iw_anqp_3gpp_cell_net_conf;$1"
+	fi
+}
+
+append_iw_anqp_elem() {
+	[ -n "$1" ] && append bss_conf "anqp_elem=$1" "$N"
+}
+
+append_iw_nai_realm() {
+	[ -n "$1" ] && append bss_conf "nai_realm=$1" "$N"
+}
+
+append_iw_venue_name() {
+	append bss_conf "venue_name=$1" "$N"
+}
+
+append_iw_venue_url() {
+	append bss_conf "venue_url=$1" "$N"
+}
+
+append_hs20_conn_capab() {
+	[ -n "$1" ] && append bss_conf "hs20_conn_capab=$1" "$N"
+}
+
+append_radius_acct_req_attr() {
+	[ -n "$1" ] && append bss_conf "radius_acct_req_attr=$1" "$N"
+}
+
+append_radius_auth_req_attr() {
+	[ -n "$1" ] && append bss_conf "radius_auth_req_attr=$1" "$N"
+}
+
+append_airtime_sta_weight() {
+	[ -n "$1" ] && append bss_conf "airtime_sta_weight=$1" "$N"
+}
+
+append_auth_server() {
+	[ -n "$1" ] || return
+	append bss_conf "auth_server_addr=$1" "$N"
+	append bss_conf "auth_server_port=$auth_port" "$N"
+	[ -n "$auth_secret" ] && append bss_conf "auth_server_shared_secret=$auth_secret" "$N"
+}
+
+append_acct_server() {
+	[ -n "$1" ] || return
+	append bss_conf "acct_server_addr=$1" "$N"
+	append bss_conf "acct_server_port=$acct_port" "$N"
+	[ -n "$acct_secret" ] && append bss_conf "acct_server_shared_secret=$acct_secret" "$N"
+}
+
+hostapd_set_bss_options() {
+	local var="$1"
+	local phy="$2"
+	local vif="$3"
+
+	wireless_vif_parse_encryption
+
+	local bss_conf bss_md5sum ft_key rxkhs
+	local wep_rekey wpa_group_rekey wpa_pair_rekey wpa_master_rekey wpa_key_mgmt
+
+	json_get_vars \
+		wep_rekey wpa_group_rekey wpa_pair_rekey wpa_master_rekey wpa_strict_rekey \
+		wpa_disable_eapol_key_retries tdls_prohibit \
+		maxassoc max_inactivity disassoc_low_ack isolate auth_cache \
+		wps_pushbutton wps_label ext_registrar wps_pbc_in_m1 wps_ap_setup_locked \
+		wps_independent wps_device_type wps_device_name wps_manufacturer wps_pin \
+		macfilter ssid utf8_ssid uapsd hidden short_preamble rsn_preauth \
+		iapp_interface eapol_version dynamic_vlan ieee80211w nasid \
+		acct_secret acct_port acct_interval \
+		bss_load_update_period chan_util_avg_period sae_require_mfp sae_pwe sae_track_password \
+		multi_ap multi_ap_backhaul_ssid multi_ap_backhaul_key skip_inactivity_poll \
+		ppsk airtime_bss_weight airtime_bss_limit airtime_sta_weight \
+		multicast_to_unicast_all proxy_arp per_sta_vif na_mcast_to_ucast \
+		eap_server eap_user_file ca_cert server_cert private_key private_key_passwd server_id radius_server_clients radius_server_auth_port \
+		vendor_elements fils ocv beacon_prot spp_amsdu apup rsn_override dpp
+
+	set_default rsn_override 1
+	set_default dpp 0
+	set_default fils 0
+	set_default isolate 0
+	set_default maxassoc 0
+	set_default max_inactivity 0
+	set_default short_preamble 1
+	set_default disassoc_low_ack 1
+	set_default skip_inactivity_poll 0
+	set_default hidden 0
+	set_default uapsd 1
+	set_default wpa_disable_eapol_key_retries 0
+	set_default tdls_prohibit 0
+	set_default eapol_version $((wpa & 1))
+	set_default acct_port 1813
+	set_default bss_load_update_period 60
+	set_default chan_util_avg_period 600
+	set_default utf8_ssid 1
+	set_default multi_ap 0
+	set_default ppsk 0
+	set_default airtime_bss_weight 0
+	set_default airtime_bss_limit 0
+	set_default eap_server 0
+	set_default apup 0
+
+	/usr/sbin/hostapd -vfils || fils=0
+
+	append bss_conf "ctrl_interface=/var/run/hostapd"
+	if [ "$isolate" -gt 0 ]; then
+		append bss_conf "ap_isolate=$isolate" "$N"
+	fi
+	if [ "$maxassoc" -gt 0 ]; then
+		append bss_conf "max_num_sta=$maxassoc" "$N"
+	fi
+	if [ "$max_inactivity" -gt 0 ]; then
+		append bss_conf "ap_max_inactivity=$max_inactivity" "$N"
+	fi
+
+	[ "$airtime_bss_weight" -gt 0 ] && append bss_conf "airtime_bss_weight=$airtime_bss_weight" "$N"
+	[ "$airtime_bss_limit" -gt 0 ] && append bss_conf "airtime_bss_limit=$airtime_bss_limit" "$N"
+	json_for_each_item append_airtime_sta_weight airtime_sta_weight
+
+	append bss_conf "bss_load_update_period=$bss_load_update_period" "$N"
+	append bss_conf "chan_util_avg_period=$chan_util_avg_period" "$N"
+	append bss_conf "disassoc_low_ack=$disassoc_low_ack" "$N"
+	append bss_conf "skip_inactivity_poll=$skip_inactivity_poll" "$N"
+	append bss_conf "preamble=$short_preamble" "$N"
+	append bss_conf "wmm_enabled=1" "$N"
+	append bss_conf "ignore_broadcast_ssid=$hidden" "$N"
+	append bss_conf "uapsd_advertisement_enabled=$uapsd" "$N"
+	append bss_conf "utf8_ssid=$utf8_ssid" "$N"
+	append bss_conf "multi_ap=$multi_ap" "$N"
+	[ -n "$vendor_elements" ] && append bss_conf "vendor_elements=$vendor_elements" "$N"
+
+	[ "$tdls_prohibit" -gt 0 ] && append bss_conf "tdls_prohibit=$tdls_prohibit" "$N"
+
+	[ "$wpa" -gt 0 ] && {
+		[ -n "$wpa_group_rekey"  ] && append bss_conf "wpa_group_rekey=$wpa_group_rekey" "$N"
+		[ -n "$wpa_pair_rekey"   ] && append bss_conf "wpa_ptk_rekey=$wpa_pair_rekey"    "$N"
+		[ -n "$wpa_master_rekey" ] && append bss_conf "wpa_gmk_rekey=$wpa_master_rekey"  "$N"
+		[ -n "$wpa_strict_rekey" ] && append bss_conf "wpa_strict_rekey=$wpa_strict_rekey" "$N"
+	}
+
+	[ -n "$nasid" ] && append bss_conf "nas_identifier=$nasid" "$N"
+
+	[ -n "$acct_interval" ] && \
+		append bss_conf "radius_acct_interim_interval=$acct_interval" "$N"
+	json_for_each_item append_acct_server acct_server
+	json_for_each_item append_radius_acct_req_attr radius_acct_req_attr
+
+	[ -n "$ocv" ] && append bss_conf "ocv=$ocv" "$N"
+	[ -n "$beacon_prot" ] && append bss_conf "beacon_prot=$beacon_prot" "$N"
+	[ -n "$spp_amsdu" ] && append bss_conf "spp_amsdu=$spp_amsdu" "$N"
+
+	case "$auth_type" in
+		sae|owe|eap2|eap192|dpp)
+			set_default ieee80211w 2
+			set_default sae_require_mfp 1
+			[ "$ppsk" -eq 0 ] && set_default sae_pwe 2
+		;;
+		psk-sae|eap-eap2)
+			if [ "$band" = 6g ]; then
+				set_default ieee80211w 2
+			else
+				set_default ieee80211w 1
+			fi
+			set_default sae_require_mfp 1
+			[ "$ppsk" -eq 0 ] && set_default sae_pwe 2
+		;;
+	esac
+	[ -n "$sae_require_mfp" ] && append bss_conf "sae_require_mfp=$sae_require_mfp" "$N"
+	[ -n "$sae_pwe" ] && append bss_conf "sae_pwe=$sae_pwe" "$N"
+	[ -n "$sae_track_password" ] && append bss_conf "sae_track_password=$sae_track_password" "$N"
+
+	local vlan_possible=""
+
+	case "$auth_type" in
+		none|owe)
+			json_get_vars owe_transition_bssid owe_transition_ssid owe_transition_ifname
+
+			[ -n "$owe_transition_ssid" ] && append bss_conf "owe_transition_ssid=\"$owe_transition_ssid\"" "$N"
+			[ -n "$owe_transition_bssid" ] && append bss_conf "owe_transition_bssid=$owe_transition_bssid" "$N"
+			[ -n "$owe_transition_ifname" ] && append bss_conf "owe_transition_ifname=$owe_transition_ifname" "$N"
+
+			wps_possible=1
+			# Here we make the assumption that if we're in open mode
+			# with WPS enabled, we got to be in unconfigured state.
+			wps_not_configured=1
+		;;
+		dpp)
+			json_get_vars dpp_connector dpp_csign dpp_netaccesskey
+
+			[ -n "$dpp_connector" ] && append bss_conf "dpp_connector=$dpp_connector" "$N"
+			[ -n "$dpp_csign" ] && append bss_conf "dpp_csign=$dpp_csign" "$N"
+			[ -n "$dpp_netaccesskey" ] && append bss_conf "dpp_netaccesskey=$dpp_netaccesskey" "$N"
+		;;
+		psk|sae|psk-sae)
+			json_get_vars key wpa_psk_file sae_password_file
+			if [ "$ppsk" -ne 0 ]; then
+				json_get_vars auth_secret auth_port
+				set_default auth_port 1812
+				json_for_each_item append_auth_server auth_server
+				append bss_conf "macaddr_acl=2" "$N"
+				append bss_conf "wpa_psk_radius=2" "$N"
+			elif [ ${#key} -eq 64 ]; then
+				append bss_conf "wpa_psk=$key" "$N"
+			elif [ ${#key} -ge 8 ] && [ ${#key} -le 63 ]; then
+				append bss_conf "wpa_passphrase=$key" "$N"
+			elif [ -n "$key" ]; then
+				wireless_setup_vif_failed INVALID_WPA_PSK
+				return 1
+			fi
+			[ -z "$wpa_psk_file" ] && set_default wpa_psk_file /var/run/hostapd-$ifname.psk
+			[ -n "$wpa_psk_file" ] && [ "$auth_type" = "psk" -o "$auth_type" = "psk-sae" ] && {
+				[ -e "$wpa_psk_file" ] || touch "$wpa_psk_file"
+				append bss_conf "wpa_psk_file=$wpa_psk_file" "$N"
+			}
+			[ -z "$sae_password_file" ] && set_default sae_password_file /var/run/hostapd-$ifname.sae
+			[ -n "$sae_password_file" ] && [ "$auth_type" = "sae" -o "$auth_type" = "psk-sae" ] && {
+				[ -e "$sae_password_file" ] || touch "$sae_password_file"
+				append bss_conf "sae_password_file=$sae_password_file" "$N"
+			}
+			[ "$eapol_version" -ge "1" -a "$eapol_version" -le "2" ] && append bss_conf "eapol_version=$eapol_version" "$N"
+
+			set_default dynamic_vlan 0
+			vlan_possible=1
+			wps_possible=1
+		;;
+		eap|eap2|eap-eap2|eap192)
+			json_get_vars \
+				auth_server auth_secret auth_port \
+				dae_client dae_secret dae_port \
+				dynamic_ownip ownip radius_client_addr \
+				eap_reauth_period request_cui \
+				erp_domain mobility_domain \
+				fils_realm fils_dhcp
+
+			# radius can provide VLAN ID for clients
+			vlan_possible=1
+
+			set_default dynamic_ownip 1
+
+			# legacy compatibility
+			[ -n "$auth_server" ] || json_get_var auth_server server
+			[ -n "$auth_port" ] || json_get_var auth_port port
+			[ -n "$auth_secret" ] || json_get_var auth_secret key
+
+			[ "$fils" -gt 0 ] && {
+				set_default erp_domain "$mobility_domain"
+				set_default erp_domain "$(echo "$ssid" | md5sum | head -c 8)"
+				set_default fils_realm "$erp_domain"
+
+				append bss_conf "erp_send_reauth_start=1" "$N"
+				append bss_conf "erp_domain=$erp_domain" "$N"
+				append bss_conf "fils_realm=$fils_realm" "$N"
+				append bss_conf "fils_cache_id=$(echo "$fils_realm" | md5sum | head -c 4)" "$N"
+
+				[ "$fils_dhcp" = "*" ] && {
+					json_get_values network network
+					fils_dhcp=
+					for net in $network; do
+						fils_dhcp="$(ifstatus "$net" | jsonfilter -e '@.data.dhcpserver')"
+						[ -n "$fils_dhcp" ] && break
+					done
+
+					[ -z "$fils_dhcp" -a -n "$network_bridge" -a -n "$network_ifname" ] && \
+						fils_dhcp="$(udhcpc -B -n -q -s /lib/netifd/dhcp-get-server.sh -t 1 -i "$network_ifname" 2>/dev/null)"
+				}
+				[ -n "$fils_dhcp" ] && append bss_conf "dhcp_server=$fils_dhcp" "$N"
+			}
+
+			set_default auth_port 1812
+			set_default dae_port 3799
+			set_default request_cui 0
+
+			[ "$eap_server" -eq 0 ] && json_for_each_item append_auth_server auth_server
+			[ "$request_cui" -gt 0 ] && append bss_conf "radius_request_cui=$request_cui" "$N"
+			[ -n "$eap_reauth_period" ] && append bss_conf "eap_reauth_period=$eap_reauth_period" "$N"
+
+			[ -n "$dae_client" -a -n "$dae_secret" ] && {
+				append bss_conf "radius_das_port=$dae_port" "$N"
+				append bss_conf "radius_das_client=$dae_client $dae_secret" "$N"
+			}
+			json_for_each_item append_radius_auth_req_attr radius_auth_req_attr
+
+			if [ -n "$ownip" ]; then
+				append bss_conf "own_ip_addr=$ownip" "$N"
+			elif [ "$dynamic_ownip" -gt 0 ]; then
+				append bss_conf "dynamic_own_ip_addr=$dynamic_ownip" "$N"
+			fi
+
+			[ -n "$radius_client_addr" ] && append bss_conf "radius_client_addr=$radius_client_addr" "$N"
+			append bss_conf "eapol_key_index_workaround=1" "$N"
+			append bss_conf "ieee8021x=1" "$N"
+
+			[ "$eapol_version" -ge "1" -a "$eapol_version" -le "2" ] && append bss_conf "eapol_version=$eapol_version" "$N"
+		;;
+		wep)
+			local wep_keyidx=0
+			json_get_vars key
+			hostapd_append_wep_key bss_conf
+			append bss_conf "wep_default_key=$wep_keyidx" "$N"
+			[ -n "$wep_rekey" ] && append bss_conf "wep_rekey_period=$wep_rekey" "$N"
+		;;
+	esac
+
+	case "$auth_type" in
+		none|owe|psk|sae|psk-sae|wep)
+			json_get_vars \
+			auth_server auth_port auth_secret \
+			ownip radius_client_addr
+
+			[ -n "$auth_server" ] &&  {
+				set_default auth_port 1812
+
+				json_for_each_item append_auth_server auth_server
+				[ -n "$ownip" ] && append bss_conf "own_ip_addr=$ownip" "$N"
+				[ -n "$radius_client_addr" ] && append bss_conf "radius_client_addr=$radius_client_addr" "$N"
+				append bss_conf "macaddr_acl=2" "$N"
+			}
+		;;
+	esac
+
+	local auth_algs="$((($auth_mode_shared << 1) | $auth_mode_open))"
+	append bss_conf "auth_algs=${auth_algs:-1}" "$N"
+	append bss_conf "wpa=$wpa" "$N"
+	[ -n "$wpa_pairwise" ] && append bss_conf "wpa_pairwise=$wpa_pairwise" "$N"
+
+	set_default wps_pushbutton 0
+	set_default wps_label 0
+	set_default wps_pbc_in_m1 0
+
+	config_methods=
+	[ "$wps_pushbutton" -gt 0 ] && append config_methods push_button
+	[ "$wps_label" -gt 0 ] && append config_methods label
+
+	# WPS not possible on Multi-AP backhaul-only SSID
+	[ "$multi_ap" = 1 ] && wps_possible=
+
+	[ -n "$wps_possible" -a -n "$config_methods" ] && {
+		set_default ext_registrar 0
+		set_default wps_device_type "6-0050F204-1"
+		set_default wps_device_name "OpenWrt AP"
+		set_default wps_manufacturer "www.openwrt.org"
+		set_default wps_independent 1
+
+		wps_state=2
+		[ -n "$wps_not_configured" ] && wps_state=1
+
+		[ "$ext_registrar" -gt 0 -a -n "$network_bridge" ] && append bss_conf "upnp_iface=$network_bridge" "$N"
+
+		append bss_conf "eap_server=1" "$N"
+		[ -n "$wps_pin" ] && append bss_conf "ap_pin=$wps_pin" "$N"
+		append bss_conf "wps_state=$wps_state" "$N"
+		append bss_conf "device_type=$wps_device_type" "$N"
+		append bss_conf "device_name=$wps_device_name" "$N"
+		append bss_conf "manufacturer=$wps_manufacturer" "$N"
+		append bss_conf "config_methods=$config_methods" "$N"
+		append bss_conf "wps_independent=$wps_independent" "$N"
+		[ -n "$wps_ap_setup_locked" ] && append bss_conf "ap_setup_locked=$wps_ap_setup_locked" "$N"
+		[ "$wps_pbc_in_m1" -gt 0 ] && append bss_conf "pbc_in_m1=$wps_pbc_in_m1" "$N"
+		[ "$multi_ap" -gt 0 ] && [ -n "$multi_ap_backhaul_ssid" ] && {
+			append bss_conf "multi_ap_backhaul_ssid=\"$multi_ap_backhaul_ssid\"" "$N"
+			if [ -z "$multi_ap_backhaul_key" ]; then
+				:
+			elif [ ${#multi_ap_backhaul_key} -lt 8 ]; then
+				wireless_setup_vif_failed INVALID_WPA_PSK
+				return 1
+			elif [ ${#multi_ap_backhaul_key} -eq 64 ]; then
+				append bss_conf "multi_ap_backhaul_wpa_psk=$multi_ap_backhaul_key" "$N"
+			else
+				append bss_conf "multi_ap_backhaul_wpa_passphrase=$multi_ap_backhaul_key" "$N"
+			fi
+		}
+	}
+
+	append bss_conf "ssid=$ssid" "$N"
+	[ -n "$network_bridge" ] && append bss_conf "bridge=$network_bridge${N}wds_bridge=" "$N"
+	[ -n "$network_ifname" ] && append bss_conf "snoop_iface=$network_ifname" "$N"
+	[ -n "$iapp_interface" ] && {
+		local ifname
+		network_get_device ifname "$iapp_interface" || ifname="$iapp_interface"
+		append bss_conf "iapp_interface=$ifname" "$N"
+	}
+
+	json_get_vars time_advertisement time_zone wnm_sleep_mode wnm_sleep_mode_no_keys bss_transition mbo
+	set_default bss_transition 0
+	set_default wnm_sleep_mode 0
+	set_default wnm_sleep_mode_no_keys 0
+	set_default mbo 0
+
+	[ -n "$time_advertisement" ] && append bss_conf "time_advertisement=$time_advertisement" "$N"
+	[ -n "$time_zone" ] && append bss_conf "time_zone=$time_zone" "$N"
+	if [ "$wnm_sleep_mode" -eq "1" ]; then
+		append bss_conf "wnm_sleep_mode=1" "$N"
+		[ "$wnm_sleep_mode_no_keys" -eq "1" ] && append bss_conf "wnm_sleep_mode_no_keys=1" "$N"
+	fi
+	[ "$bss_transition" -eq "1" ] && append bss_conf "bss_transition=1" "$N"
+	[ "$mbo" -eq 1 ] && append bss_conf "mbo=1" "$N"
+
+	json_get_vars ieee80211k rrm_neighbor_report rrm_beacon_report rnr
+	set_default ieee80211k 0
+	set_default rnr 0
+	if [ "$ieee80211k" -eq "1" ]; then
+		set_default rrm_neighbor_report 1
+		set_default rrm_beacon_report 1
+	else
+		set_default rrm_neighbor_report 0
+		set_default rrm_beacon_report 0
+	fi
+
+	[ "$rrm_neighbor_report" -eq "1" ] && append bss_conf "rrm_neighbor_report=1" "$N"
+	[ "$rrm_beacon_report" -eq "1" ] && append bss_conf "rrm_beacon_report=1" "$N"
+	[ "$rnr" -eq "1" ] && append bss_conf "rnr=1" "$N"
+
+	json_get_vars ftm_responder stationary_ap lci civic
+	set_default ftm_responder 0
+	if [ "$ftm_responder" -eq "1" ]; then
+		set_default stationary_ap 0
+		iw phy "$phy" info | grep -q "ENABLE_FTM_RESPONDER" && {
+			append bss_conf "ftm_responder=1" "$N"
+			[ "$stationary_ap" -eq "1" ] && append bss_conf "stationary_ap=1" "$N"
+			[ -n "$lci" ] && append bss_conf "lci=$lci" "$N"
+			[ -n "$civic" ] && append bss_conf "civic=$civic" "$N"
+		}
+	fi
+
+	json_get_vars ieee80211r
+	set_default ieee80211r 0
+	if [ "$wpa" -ge "1" ]; then
+		if [ "$fils" -gt 0 ]; then
+			json_get_vars fils_realm
+			set_default fils_realm "$(echo "$ssid" | md5sum | head -c 8)"
+		fi
+
+		append bss_conf "wpa_disable_eapol_key_retries=$wpa_disable_eapol_key_retries" "$N"
+
+		hostapd_append_wpa_key_mgmt
+		[ -n "$wpa_key_mgmt" ] && append bss_conf "wpa_key_mgmt=$wpa_key_mgmt" "$N"
+		[ -n "$rsn_override_key_mgmt" -o -n "$rsn_override_pairwise" ] && {
+			append bss_conf "rsn_override_key_mgmt=${rsn_override_key_mgmt:-$wpa_key_mgmt}" "$N"
+			append bss_conf "rsn_override_pairwise=${rsn_override_pairwise:-$wpa_pairwise}" "$N"
+			append bss_conf "rsn_override_mfp=$ieee80211w" "$N"
+		}
+	fi
+
+	if [ "$wpa" -ge "2" ]; then
+		if [ "$ieee80211r" -gt "0" ]; then
+			json_get_vars mobility_domain ft_psk_generate_local ft_over_ds reassociation_deadline ft_iface
+
+			set_default mobility_domain "$(echo "$ssid" | md5sum | head -c 4)"
+			set_default ft_over_ds 0
+			set_default reassociation_deadline 20000
+			[ -n "$network_ifname" ] && set_default ft_iface "$network_ifname"
+
+			case "$auth_type" in
+				psk)
+					set_default ft_psk_generate_local 1
+				;;
+				*)
+					set_default ft_psk_generate_local 0
+				;;
+			esac
+
+			[ -n "$ft_iface" ] && append bss_conf "ft_iface=$ft_iface" "$N"
+			append bss_conf "mobility_domain=$mobility_domain" "$N"
+			append bss_conf "ft_psk_generate_local=$ft_psk_generate_local" "$N"
+			append bss_conf "ft_over_ds=$ft_over_ds" "$N"
+			append bss_conf "reassociation_deadline=$reassociation_deadline" "$N"
+
+			if [ "$ft_psk_generate_local" -eq "0" ]; then
+				json_get_vars r0_key_lifetime r1_key_holder pmk_r1_push rxkh_file
+				json_get_values r0kh r0kh
+				json_get_values r1kh r1kh
+
+				set_default r0_key_lifetime 10000
+				set_default pmk_r1_push 0
+
+				[ -n "$r0kh" -a -n "$r1kh" ] || {
+					if [ -z "$auth_secret" -a -z "$key" ]; then
+						wireless_setup_vif_failed FT_KEY_CANT_BE_DERIVED
+						return 1
+					fi
+					ft_key=`echo -n "$mobility_domain/${auth_secret:-${key}}" | md5sum | awk '{print $1}'`
+
+					set_default r0kh "ff:ff:ff:ff:ff:ff,*,$ft_key"
+					set_default r1kh "00:00:00:00:00:00,00:00:00:00:00:00,$ft_key"
+				}
+
+				[ -n "$r1_key_holder" ] && append bss_conf "r1_key_holder=$r1_key_holder" "$N"
+				append bss_conf "r0_key_lifetime=$r0_key_lifetime" "$N"
+				append bss_conf "pmk_r1_push=$pmk_r1_push" "$N"
+
+				if [ -z "$rxkh_file" ]; then
+					set_default rxkh_file /var/run/hostapd-$ifname.rxkh
+					[ -e "$rxkh_file" ] && rm -f "$rxkh_file"
+					touch "$rxkh_file"
+
+					for kh in $r0kh; do
+						append rxkhs "r0kh=${kh//,/ }" "$N"
+					done
+					for kh in $r1kh; do
+						append rxkhs "r1kh=${kh//,/ }" "$N"
+					done
+					echo "$rxkhs" > "$rxkh_file"
+				fi
+				append bss_conf "rxkh_file=$rxkh_file" "$N"
+			fi
+		fi
+
+		if [ -n "$network_bridge" -a "$rsn_preauth" = 1 ]; then
+			set_default auth_cache 1
+			append bss_conf "rsn_preauth=1" "$N"
+			append bss_conf "rsn_preauth_interfaces=$network_bridge" "$N"
+		else
+			case "$auth_type" in
+			sae|psk-sae|owe)
+				set_default auth_cache 1
+			;;
+			*)
+				set_default auth_cache 0
+			;;
+			esac
+		fi
+
+		append bss_conf "okc=$auth_cache" "$N"
+		[ "$auth_cache" = 0 -a "$fils" = 0 ] && append bss_conf "disable_pmksa_caching=1" "$N"
+
+		# RSN -> allow management frame protection
+		case "$ieee80211w" in
+			[012])
+				json_get_vars ieee80211w_mgmt_cipher ieee80211w_max_timeout ieee80211w_retry_timeout
+				append bss_conf "ieee80211w=$ieee80211w" "$N"
+				[ "$ieee80211w" -gt "0" ] && {
+					if [ "$auth_type" = "eap192" ]; then
+						append bss_conf "group_mgmt_cipher=BIP-GMAC-256" "$N"
+					else
+						append bss_conf "group_mgmt_cipher=${ieee80211w_mgmt_cipher:-AES-128-CMAC}" "$N"
+					fi
+					[ -n "$ieee80211w_max_timeout" ] && \
+						append bss_conf "assoc_sa_query_max_timeout=$ieee80211w_max_timeout" "$N"
+					[ -n "$ieee80211w_retry_timeout" ] && \
+						append bss_conf "assoc_sa_query_retry_timeout=$ieee80211w_retry_timeout" "$N"
+				}
+			;;
+		esac
+	fi
+
+	_macfile="/var/run/hostapd-$ifname.maclist"
+	case "$macfilter" in
+		allow)
+			append bss_conf "macaddr_acl=1" "$N"
+			append bss_conf "accept_mac_file=$_macfile" "$N"
+			# accept_mac_file can be used to set MAC to VLAN ID mapping
+			vlan_possible=1
+		;;
+		deny)
+			append bss_conf "macaddr_acl=0" "$N"
+			append bss_conf "deny_mac_file=$_macfile" "$N"
+		;;
+		*)
+			_macfile=""
+		;;
+	esac
+
+	[ -n "$_macfile" ] && {
+		json_get_vars macfile
+		json_get_values maclist maclist
+
+		rm -f "$_macfile"
+		(
+			for mac in $maclist; do
+				echo "$mac"
+			done
+			[ -n "$macfile" -a -f "$macfile" ] && cat "$macfile"
+		) > "$_macfile"
+	}
+
+	[ -n "$vlan_possible" -a -n "$dynamic_vlan" ] && {
+		json_get_vars vlan_naming vlan_tagged_interface vlan_bridge vlan_file vlan_no_bridge
+		set_default vlan_naming 1
+		[ -z "$vlan_file" ] && set_default vlan_file /var/run/hostapd-$ifname.vlan
+		append bss_conf "dynamic_vlan=$dynamic_vlan" "$N"
+		append bss_conf "vlan_naming=$vlan_naming" "$N"
+		if [ -n "$vlan_bridge" ]; then
+			append bss_conf "vlan_bridge=$vlan_bridge" "$N"
+		else
+			set_default vlan_no_bridge 1
+		fi
+		append bss_conf "vlan_no_bridge=$vlan_no_bridge" "$N"
+		[ -n "$vlan_tagged_interface" ] && \
+			append bss_conf "vlan_tagged_interface=$vlan_tagged_interface" "$N"
+		[ -n "$vlan_file" ] && {
+			[ -e "$vlan_file" ] || touch "$vlan_file"
+			append bss_conf "vlan_file=$vlan_file" "$N"
+		}
+	}
+
+	json_get_vars iw_enabled iw_internet iw_asra iw_esr iw_uesa iw_access_network_type
+	json_get_vars iw_hessid iw_venue_group iw_venue_type iw_network_auth_type
+	json_get_vars iw_roaming_consortium iw_domain_name iw_anqp_3gpp_cell_net iw_nai_realm
+	json_get_vars iw_anqp_elem iw_qos_map_set iw_ipaddr_type_availability iw_gas_address3
+	json_get_vars iw_venue_name iw_venue_url
+
+	set_default iw_enabled 0
+	if [ "$iw_enabled" = "1" ]; then
+		append bss_conf "interworking=1" "$N"
+		set_default iw_internet 1
+		set_default iw_asra 0
+		set_default iw_esr 0
+		set_default iw_uesa 0
+
+		append bss_conf "internet=$iw_internet" "$N"
+		append bss_conf "asra=$iw_asra" "$N"
+		append bss_conf "esr=$iw_esr" "$N"
+		append bss_conf "uesa=$iw_uesa" "$N"
+
+		[ -n "$iw_access_network_type" ] && \
+			append bss_conf "access_network_type=$iw_access_network_type" "$N"
+		[ -n "$iw_hessid" ] && append bss_conf "hessid=$iw_hessid" "$N"
+		[ -n "$iw_venue_group" ] && \
+			append bss_conf "venue_group=$iw_venue_group" "$N"
+		[ -n "$iw_venue_type" ] && append bss_conf "venue_type=$iw_venue_type" "$N"
+		[ -n "$iw_network_auth_type" ] && \
+			append bss_conf "network_auth_type=$iw_network_auth_type" "$N"
+		[ -n "$iw_gas_address3" ] && append bss_conf "gas_address3=$iw_gas_address3" "$N"
+
+		json_for_each_item append_iw_roaming_consortium iw_roaming_consortium
+		json_for_each_item append_iw_anqp_elem iw_anqp_elem
+		json_for_each_item append_iw_nai_realm iw_nai_realm
+		json_for_each_item append_iw_venue_name iw_venue_name
+		json_for_each_item append_iw_venue_url iw_venue_url
+
+		iw_domain_name_conf=
+		json_for_each_item append_iw_domain_name iw_domain_name
+		[ -n "$iw_domain_name_conf" ] && \
+			append bss_conf "domain_name=$iw_domain_name_conf" "$N"
+
+		iw_anqp_3gpp_cell_net_conf=
+		json_for_each_item append_iw_anqp_3gpp_cell_net iw_anqp_3gpp_cell_net
+		[ -n "$iw_anqp_3gpp_cell_net_conf" ] && \
+			append bss_conf "anqp_3gpp_cell_net=$iw_anqp_3gpp_cell_net_conf" "$N"
+	fi
+
+	set_default iw_qos_map_set 0,0,2,16,1,1,255,255,18,22,24,38,40,40,44,46,48,56
+	case "$iw_qos_map_set" in
+		*,*);;
+		*) iw_qos_map_set="";;
+	esac
+	[ -n "$iw_qos_map_set" ] && append bss_conf "qos_map_set=$iw_qos_map_set" "$N"
+
+	local hs20 disable_dgaf anqp_domain_id hs20_deauth_req_timeout \
+		hs20_wan_metrics hs20_operating_class hs20_t_c_filename hs20_t_c_timestamp \
+		hs20_t_c_server_url
+	json_get_vars hs20 disable_dgaf anqp_domain_id hs20_deauth_req_timeout \
+		hs20_wan_metrics hs20_operating_class hs20_t_c_filename hs20_t_c_timestamp \
+		hs20_t_c_server_url
+
+	set_default hs20 0
+	set_default disable_dgaf $hs20
+	set_default anqp_domain_id 0
+	set_default hs20_deauth_req_timeout 60
+	if [ "$hs20" = "1" ]; then
+		append bss_conf "hs20=1" "$N"
+		append bss_conf "disable_dgaf=$disable_dgaf" "$N"
+		append bss_conf "anqp_domain_id=$anqp_domain_id" "$N"
+		append bss_conf "hs20_deauth_req_timeout=$hs20_deauth_req_timeout" "$N"
+		[ -n "$hs20_wan_metrics" ] && append bss_conf "hs20_wan_metrics=$hs20_wan_metrics" "$N"
+		[ -n "$hs20_operating_class" ] && append bss_conf "hs20_operating_class=$hs20_operating_class" "$N"
+		[ -n "$hs20_t_c_filename" ] && append bss_conf "hs20_t_c_filename=$hs20_t_c_filename" "$N"
+		[ -n "$hs20_t_c_timestamp" ] && append bss_conf "hs20_t_c_timestamp=$hs20_t_c_timestamp" "$N"
+		[ -n "$hs20_t_c_server_url" ] && append bss_conf "hs20_t_c_server_url=$hs20_t_c_server_url" "$N"
+		json_for_each_item append_hs20_conn_capab hs20_conn_capab
+	fi
+
+	if [ "$eap_server" = "1" ]; then
+		append bss_conf "eap_server=1" "$N"
+		append bss_conf "eap_server_erp=1" "$N"
+		[ -n "$eap_user_file" ] && append bss_conf "eap_user_file=$eap_user_file" "$N"
+		[ -n "$ca_cert" ] && append bss_conf "ca_cert=$ca_cert" "$N"
+		[ -n "$server_cert" ] && append bss_conf "server_cert=$server_cert" "$N"
+		[ -n "$private_key" ] && append bss_conf "private_key=$private_key" "$N"
+		[ -n "$private_key_passwd" ] && append bss_conf "private_key_passwd=$private_key_passwd" "$N"
+		[ -n "$server_id" ] && append bss_conf "server_id=$server_id" "$N"
+		[ -n "$radius_server_clients" ] && append bss_conf "radius_server_clients=$radius_server_clients" "$N"
+		[ -n "$radius_server_auth_port" ] && append bss_conf "radius_server_auth_port=$radius_server_auth_port" "$N"
+	fi
+
+	set_default multicast_to_unicast_all 0
+	if [ "$multicast_to_unicast_all" -gt 0 ]; then
+		append bss_conf "multicast_to_unicast=$multicast_to_unicast_all" "$N"
+	fi
+	set_default proxy_arp 0
+	set_default na_mcast_to_ucast "$proxy_arp"
+	if [ "$proxy_arp" -gt 0 ]; then
+		append bss_conf "proxy_arp=$proxy_arp" "$N"
+	fi
+	if [ "$na_mcast_to_ucast" -gt 0 ]; then
+		append bss_conf "na_mcast_to_ucast=$na_mcast_to_ucast" "$N"
+	fi
+
+	set_default per_sta_vif 0
+	if [ "$per_sta_vif" -gt 0 ]; then
+		append bss_conf "per_sta_vif=$per_sta_vif" "$N"
+	fi
+
+	if [ "$apup" -gt 0 ]; then
+		append bss_conf "apup=$apup" "$N"
+
+		local apup_peer_ifname_prefix
+		json_get_vars apup_peer_ifname_prefix
+		if [ -n "$apup_peer_ifname_prefix" ] ; then
+			append bss_conf "apup_peer_ifname_prefix=$apup_peer_ifname_prefix" "$N"
+		fi
+	fi
+
+	[ "$dpp" -gt 0 ] && [ "$auth_type" != "dpp" ] && {
+		json_get_vars dpp_connector dpp_csign dpp_netaccesskey
+
+		[ -n "$dpp_connector" ] && append bss_conf "dpp_connector=$dpp_connector" "$N"
+		[ -n "$dpp_csign" ] && append bss_conf "dpp_csign=$dpp_csign" "$N"
+		[ -n "$dpp_netaccesskey" ] && append bss_conf "dpp_netaccesskey=$dpp_netaccesskey" "$N"
+	}
+
+	json_get_values opts hostapd_bss_options
+	for val in $opts; do
+		append bss_conf "$val" "$N"
+	done
+
+	append "$var" "$bss_conf" "$N"
+	return 0
+}
+
+hostapd_set_log_options() {
+	local var="$1"
+
+	local log_level log_80211 log_8021x log_radius log_wpa log_driver log_iapp log_mlme
+	json_get_vars log_level log_80211 log_8021x log_radius log_wpa log_driver log_iapp log_mlme
+
+	set_default log_level 2
+	set_default log_80211  1
+	set_default log_8021x  1
+	set_default log_radius 1
+	set_default log_wpa    1
+	set_default log_driver 1
+	set_default log_iapp   1
+	set_default log_mlme   1
+
+	local log_mask="$(( \
+		($log_80211  << 0) | \
+		($log_8021x  << 1) | \
+		($log_radius << 2) | \
+		($log_wpa    << 3) | \
+		($log_driver << 4) | \
+		($log_iapp   << 5) | \
+		($log_mlme   << 6)   \
+	))"
+
+	append "$var" "logger_syslog=$log_mask" "$N"
+	append "$var" "logger_syslog_level=$log_level" "$N"
+	append "$var" "logger_stdout=$log_mask" "$N"
+	append "$var" "logger_stdout_level=$log_level" "$N"
+
+	return 0
+}
+
+_wpa_supplicant_common() {
+	local ifname="$1"
+
+	_rpath="/var/run/wpa_supplicant"
+	_config="${_rpath}-$ifname.conf"
+}
+
+wpa_supplicant_teardown_interface() {
+	_wpa_supplicant_common "$1"
+	rm -rf "$_rpath/$1" "$_config"
+}
+
+wpa_supplicant_prepare_interface() {
+	local ifname="$1"
+	_w_driver="$2"
+
+	_wpa_supplicant_common "$1"
+
+	json_get_vars mode wds multi_ap
+
+	[ -n "$network_bridge" ] && {
+		fail=
+		case "$mode" in
+			adhoc)
+				fail=1
+			;;
+			sta)
+				[ "$wds" = 1 -o "$multi_ap" = 1 ] || fail=1
+			;;
+		esac
+
+		[ -n "$fail" ] && {
+			wireless_setup_vif_failed BRIDGE_NOT_ALLOWED
+			return 1
+		}
+	}
+
+	local ap_scan=
+
+	_w_mode="$mode"
+
+	[ "$mode" = adhoc ] && {
+		ap_scan="ap_scan=2"
+	}
+
+	local country_str=
+	[ -n "$country" ] && {
+		country_str="country=$country"
+	}
+
+	multiap_flag_file="${_config}.is_multiap"
+	if [ "$multi_ap" = "1" ]; then
+		touch "$multiap_flag_file"
+	else
+		[ -e "$multiap_flag_file" ] && rm "$multiap_flag_file"
+	fi
+	wpa_supplicant_teardown_interface "$ifname"
+	cat > "$_config" <<EOF
+${scan_list:+freq_list=$scan_list}
+$ap_scan
+$country_str
+EOF
+	return 0
+}
+
+wpa_supplicant_set_fixed_freq() {
+	local freq="$1"
+	local htmode="$2"
+
+	append network_data "fixed_freq=1" "$N$T"
+	append network_data "frequency=$freq" "$N$T"
+	case "$htmode" in
+		NOHT) append network_data "disable_ht=1" "$N$T";;
+		HE20|HT20|VHT20) append network_data "disable_ht40=1" "$N$T";;
+		HT40*|VHT40|VHT80|VHT160|HE40|HE80|HE160) append network_data "ht40=1" "$N$T";;
+	esac
+	case "$htmode" in
+		VHT*) append network_data "vht=1" "$N$T";;
+	esac
+	case "$htmode" in
+		HE80|VHT80) append network_data "max_oper_chwidth=1" "$N$T";;
+		HE160|VHT160) append network_data "max_oper_chwidth=2" "$N$T";;
+		HE20|HE40|VHT20|VHT40) append network_data "max_oper_chwidth=0" "$N$T";;
+		*) append network_data "disable_vht=1" "$N$T";;
+	esac
+}
+
+wpa_supplicant_add_network() {
+	local ifname="$1"
+	local freq="$2"
+	local htmode="$3"
+	local noscan="$4"
+
+	_wpa_supplicant_common "$1"
+	wireless_vif_parse_encryption
+
+	json_get_vars \
+		ssid bssid key rsn_override \
+		mcast_rate \
+		ieee80211w ieee80211r fils ocv beacon_prot \
+		multi_ap \
+		default_disabled
+
+	json_get_values basic_rate_list basic_rate
+
+	set_default rsn_override 1
+
+	case "$auth_type" in
+		sae|owe|eap2|eap192|dpp)
+			set_default ieee80211w 2
+		;;
+		psk-sae)
+			set_default ieee80211w 1
+		;;
+	esac
+
+	set_default ieee80211r 0
+	set_default multi_ap 0
+	set_default sae_pwe 2
+	set_default default_disabled 0
+
+	local key_mgmt='NONE'
+	local network_data=
+	local T="	"
+
+	local scan_ssid="scan_ssid=1"
+	local freq wpa_key_mgmt
+
+	[ "$_w_mode" = "adhoc" ] && {
+		append network_data "mode=1" "$N$T"
+		[ -n "$freq" ] && wpa_supplicant_set_fixed_freq "$freq" "$htmode"
+		[ "$noscan" = "1" ] && append network_data "noscan=1" "$N$T"
+
+		scan_ssid="scan_ssid=0"
+
+		[ "$_w_driver" = "nl80211" ] ||	append wpa_key_mgmt "WPA-NONE"
+	}
+
+	[ "$_w_mode" = "mesh" ] && {
+		json_get_vars mesh_id mesh_fwding mesh_rssi_threshold encryption
+		[ -n "$mesh_id" ] && ssid="${mesh_id}"
+
+		append network_data "mode=5" "$N$T"
+		[ -n "$mesh_fwding" ] && append network_data "mesh_fwding=${mesh_fwding}" "$N$T"
+		[ -n "$mesh_rssi_threshold" ] && append network_data "mesh_rssi_threshold=${mesh_rssi_threshold}" "$N$T"
+		[ -n "$freq" ] && wpa_supplicant_set_fixed_freq "$freq" "$htmode"
+		[ "$noscan" = "1" ] && append network_data "noscan=1" "$N$T"
+		[ "$encryption" = "none" -o -z "$encryption" ] || append wpa_key_mgmt "SAE"
+		scan_ssid=""
+	}
+
+	[ "$_w_mode" = "sta" ] && {
+		[ "$multi_ap" = 1 ] && append network_data "multi_ap_backhaul_sta=1" "$N$T"
+		[ "$default_disabled" = 1 ] && append network_data "disabled=1" "$N$T"
+	}
+
+	[ -n "$ocv" ] && append network_data "ocv=$ocv" "$N$T"
+	[ -n "$beacon_prot" ] && append network_data "beacon_prot=$beacon_prot" "$N$T"
+
+	rsn_overriding=0
+	case "$htmode" in
+	EHT*|HE*) [ "$rsn_override" -gt 0 ] && rsn_overriding=1;;
+	esac
+	append network_data "rsn_overriding=$rsn_overriding" "$N$T"
+
+	case "$auth_type" in
+		none) ;;
+		owe)
+			hostapd_append_wpa_key_mgmt
+			key_mgmt="$wpa_key_mgmt"
+		;;
+		dpp)
+			hostapd_append_wpa_key_mgmt
+			key_mgmt="$wpa_key_mgmt"
+		;;
+		wep)
+			local wep_keyidx=0
+			hostapd_append_wep_key network_data
+			append network_data "wep_tx_keyidx=$wep_keyidx" "$N$T"
+		;;
+		wps)
+			key_mgmt='WPS'
+		;;
+		psk|sae|psk-sae)
+			local passphrase
+
+			if [ "$_w_mode" != "mesh" ]; then
+				hostapd_append_wpa_key_mgmt
+			fi
+
+			key_mgmt="$wpa_key_mgmt"
+
+			if [ "$_w_mode" = "mesh" ] || [ "$auth_type" = "sae" ]; then
+				passphrase="sae_password=\"${key}\""
+			else
+				if [ ${#key} -eq 64 ]; then
+					passphrase="psk=${key}"
+				else
+					passphrase="psk=\"${key}\""
+				fi
+			fi
+			append network_data "$passphrase" "$N$T"
+		;;
+		eap|eap2|eap192)
+			hostapd_append_wpa_key_mgmt
+			key_mgmt="$wpa_key_mgmt"
+
+			json_get_vars eap_type identity anonymous_identity ca_cert ca_cert_usesystem
+
+			[ "$fils" -gt 0 ] && append network_data "erp=1" "$N$T"
+			if [ "$ca_cert_usesystem" -eq "1" -a -f "/etc/ssl/certs/ca-certificates.crt" ]; then
+				append network_data "ca_cert=\"/etc/ssl/certs/ca-certificates.crt\"" "$N$T"
+			else
+				[ -n "$ca_cert" ] && append network_data "ca_cert=\"$ca_cert\"" "$N$T"
+			fi
+			[ -n "$identity" ] && append network_data "identity=\"$identity\"" "$N$T"
+			[ -n "$anonymous_identity" ] && append network_data "anonymous_identity=\"$anonymous_identity\"" "$N$T"
+			case "$eap_type" in
+				tls)
+					json_get_vars client_cert priv_key priv_key_pwd
+					append network_data "client_cert=\"$client_cert\"" "$N$T"
+					append network_data "private_key=\"$priv_key\"" "$N$T"
+					append network_data "private_key_passwd=\"$priv_key_pwd\"" "$N$T"
+
+					json_get_vars subject_match
+					[ -n "$subject_match" ] && append network_data "subject_match=\"$subject_match\"" "$N$T"
+
+					json_get_values altsubject_match altsubject_match
+					if [ -n "$altsubject_match" ]; then
+						local list=
+						for x in $altsubject_match; do
+							append list "$x" ";"
+						done
+						append network_data "altsubject_match=\"$list\"" "$N$T"
+					fi
+
+					json_get_values domain_match domain_match
+					if [ -n "$domain_match" ]; then
+						local list=
+						for x in $domain_match; do
+							append list "$x" ";"
+						done
+						append network_data "domain_match=\"$list\"" "$N$T"
+					fi
+
+					json_get_values domain_suffix_match domain_suffix_match
+					if [ -n "$domain_suffix_match" ]; then
+						local list=
+						for x in $domain_suffix_match; do
+							append list "$x" ";"
+						done
+						append network_data "domain_suffix_match=\"$list\"" "$N$T"
+					fi
+				;;
+				fast|peap|ttls)
+					json_get_vars auth password ca_cert2 ca_cert2_usesystem client_cert2 priv_key2 priv_key2_pwd
+					set_default auth MSCHAPV2
+
+					if [ "$auth" = "EAP-TLS" ]; then
+						if [ "$ca_cert2_usesystem" -eq "1" -a -f "/etc/ssl/certs/ca-certificates.crt" ]; then
+							append network_data "ca_cert2=\"/etc/ssl/certs/ca-certificates.crt\"" "$N$T"
+						else
+							[ -n "$ca_cert2" ] && append network_data "ca_cert2=\"$ca_cert2\"" "$N$T"
+						fi
+						append network_data "client_cert2=\"$client_cert2\"" "$N$T"
+						append network_data "private_key2=\"$priv_key2\"" "$N$T"
+						append network_data "private_key2_passwd=\"$priv_key2_pwd\"" "$N$T"
+					else
+						append network_data "password=\"$password\"" "$N$T"
+					fi
+
+					json_get_vars subject_match
+					[ -n "$subject_match" ] && append network_data "subject_match=\"$subject_match\"" "$N$T"
+
+					json_get_values altsubject_match altsubject_match
+					if [ -n "$altsubject_match" ]; then
+						local list=
+						for x in $altsubject_match; do
+							append list "$x" ";"
+						done
+						append network_data "altsubject_match=\"$list\"" "$N$T"
+					fi
+
+					json_get_values domain_match domain_match
+					if [ -n "$domain_match" ]; then
+						local list=
+						for x in $domain_match; do
+							append list "$x" ";"
+						done
+						append network_data "domain_match=\"$list\"" "$N$T"
+					fi
+
+					json_get_values domain_suffix_match domain_suffix_match
+					if [ -n "$domain_suffix_match" ]; then
+						local list=
+						for x in $domain_suffix_match; do
+							append list "$x" ";"
+						done
+						append network_data "domain_suffix_match=\"$list\"" "$N$T"
+					fi
+
+					phase2proto="auth="
+					case "$auth" in
+						"auth"*)
+							phase2proto=""
+						;;
+						"EAP-"*)
+							auth="$(echo $auth | cut -b 5- )"
+							[ "$eap_type" = "ttls" ] &&
+								phase2proto="autheap="
+							json_get_vars subject_match2
+							[ -n "$subject_match2" ] && append network_data "subject_match2=\"$subject_match2\"" "$N$T"
+
+							json_get_values altsubject_match2 altsubject_match2
+							if [ -n "$altsubject_match2" ]; then
+								local list=
+								for x in $altsubject_match2; do
+									append list "$x" ";"
+								done
+								append network_data "altsubject_match2=\"$list\"" "$N$T"
+							fi
+
+							json_get_values domain_match2 domain_match2
+							if [ -n "$domain_match2" ]; then
+								local list=
+								for x in $domain_match2; do
+									append list "$x" ";"
+								done
+								append network_data "domain_match2=\"$list\"" "$N$T"
+							fi
+
+							json_get_values domain_suffix_match2 domain_suffix_match2
+							if [ -n "$domain_suffix_match2" ]; then
+								local list=
+								for x in $domain_suffix_match2; do
+									append list "$x" ";"
+								done
+								append network_data "domain_suffix_match2=\"$list\"" "$N$T"
+							fi
+						;;
+					esac
+					append network_data "phase2=\"$phase2proto$auth\"" "$N$T"
+				;;
+			esac
+			append network_data "eap=$(echo $eap_type | tr 'a-z' 'A-Z')" "$N$T"
+		;;
+	esac
+
+	[ "$wpa_cipher" = GCMP ] && {
+		append network_data "pairwise=GCMP" "$N$T"
+		append network_data "group=GCMP" "$N$T"
+	}
+
+	[ "$mode" = mesh ] || {
+		case "$wpa" in
+			1)
+				append network_data "proto=WPA" "$N$T"
+			;;
+			2)
+				append network_data "proto=RSN" "$N$T"
+			;;
+		esac
+
+		case "$ieee80211w" in
+			[012])
+				[ "$wpa" -ge 2 ] && append network_data "ieee80211w=$ieee80211w" "$N$T"
+			;;
+		esac
+	}
+	[ -n "$bssid" ] && append network_data "bssid=$bssid" "$N$T"
+	[ -n "$beacon_int" ] && append network_data "beacon_int=$beacon_int" "$N$T"
+
+	local bssid_blacklist bssid_whitelist
+	json_get_values bssid_blacklist bssid_blacklist
+	json_get_values bssid_whitelist bssid_whitelist
+
+	[ -n "$bssid_blacklist" ] && append network_data "bssid_blacklist=$bssid_blacklist" "$N$T"
+	[ -n "$bssid_whitelist" ] && append network_data "bssid_whitelist=$bssid_whitelist" "$N$T"
+
+	[ -n "$basic_rate_list" ] && {
+		local br rate rate_list=
+
+		if [ "$mode" = mesh ]; then
+			for br in $basic_rate_list; do
+				rate="$(($br / 100))"
+				append rate_list "$rate" " "
+			done
+			[ -n "$rate_list" ] && append network_data "mesh_basic_rates=$rate_list" "$N$T"
+		else
+			for br in $basic_rate_list; do
+				wpa_supplicant_add_rate rate_list "$br"
+			done
+			[ -n "$rate_list" ] && append network_data "rates=$rate_list" "$N$T"
+		fi
+	}
+
+	[ -n "$mcast_rate" ] && {
+		local mc_rate=
+		wpa_supplicant_add_rate mc_rate "$mcast_rate"
+		append network_data "mcast_rate=$mc_rate" "$N$T"
+	}
+
+	[ "$auth_type" = "dpp" ] && {
+		json_get_vars dpp_connector dpp_csign dpp_netaccesskey
+
+		[ -n "$dpp_connector" ] && append network_data "dpp_connector=$dpp_connector" "$N$T"
+		[ -n "$dpp_csign" ] && append network_data "dpp_csign=$dpp_csign" "$N$T"
+		[ -n "$dpp_netaccesskey" ] && append network_data "dpp_netaccesskey=$dpp_netaccesskey" "$N$T"
+	}
+
+	if [ "$key_mgmt" = "WPS" ]; then
+		echo "wps_cred_processing=1" >> "$_config"
+	else
+		cat >> "$_config" <<EOF
+network={
+	$scan_ssid
+	ssid="$ssid"
+	key_mgmt=$key_mgmt
+	sae_pwe=$sae_pwe
+	$network_data
+}
+EOF
+	fi
+	return 0
+}
diff --git a/wireless-scripts-example/vanila/hostapd.uc b/wireless-scripts-example/vanila/hostapd.uc
new file mode 100644
index 0000000000..6558b55b0a
--- /dev/null
+++ b/wireless-scripts-example/vanila/hostapd.uc
@@ -0,0 +1,1614 @@
+let libubus = require("ubus");
+import { open, readfile, access } from "fs";
+import { wdev_remove, is_equal, vlist_new, phy_is_fullmac, phy_open, wdev_set_radio_mask, wdev_set_up } from "common";
+
+let ubus = libubus.connect(null, 60);
+
+function ex_handler(e)
+{
+	e = split(`${e}\n${e.stacktrace[0].context}`, '\n');
+	for (let line in e)
+		hostapd.printf(line);
+	return libubus.STATUS_UNKNOWN_ERROR;
+}
+libubus.guard(ex_handler);
+
+hostapd.data.config = {};
+hostapd.data.pending_config = {};
+
+hostapd.data.file_fields = {
+	vlan_file: true,
+	wpa_psk_file: true,
+	sae_password_file: true,
+	rxkh_file: true,
+	accept_mac_file: true,
+	deny_mac_file: true,
+	eap_user_file: true,
+	ca_cert: true,
+	server_cert: true,
+	server_cert2: true,
+	private_key: true,
+	private_key2: true,
+	dh_file: true,
+	eap_sim_db: true,
+};
+
+hostapd.data.iface_fields = {
+	ft_iface: true,
+	upnp_iface: true,
+	snoop_iface: true,
+	bridge: true,
+	iapp_interface: true,
+};
+
+hostapd.data.bss_info_fields = {
+	// radio
+	hw_mode: true,
+	channel: true,
+	ieee80211ac: true,
+	ieee80211ax: true,
+
+	// bss
+	bssid: true,
+	ssid: true,
+	wpa: true,
+	wpa_key_mgmt: true,
+	wpa_pairwise: true,
+	auth_algs: true,
+	ieee80211w: true,
+	owe_transition_ifname: true,
+};
+
+hostapd.data.mld = {};
+hostapd.data.dpp_hooks = {};
+
+function iface_remove(cfg)
+{
+	if (!cfg || !cfg.bss || !cfg.bss[0] || !cfg.bss[0].ifname)
+		return;
+
+	for (let bss in cfg.bss)
+		if (!bss.mld_ap)
+			wdev_remove(bss.ifname);
+}
+
+function iface_gen_config(config, start_disabled)
+{
+	let str = `data:
+${join("\n", config.radio.data)}
+channel=${config.radio.channel}
+`;
+
+	for (let i = 0; i < length(config.bss); i++) {
+		let bss = config.bss[i];
+		let type = i > 0 ? "bss" : "interface";
+		let nasid = bss.nasid ?? replace(bss.bssid, ":", "");
+		let bssid = bss.bssid;
+		if (bss.mld_ap)
+			bssid += "\nmld_addr=" + bss.mld_bssid;
+		str += `
+${type}=${bss.ifname}
+bssid=${bssid}
+${join("\n", bss.data)}
+nas_identifier=${nasid}
+`;
+		if (start_disabled)
+			str += `
+start_disabled=1
+`;
+	}
+
+	return str;
+}
+
+function iface_freq_info(iface, config, params)
+{
+	let freq = params.frequency;
+	if (!freq)
+		return null;
+
+	let sec_offset = params.sec_chan_offset;
+	if (sec_offset != -1 && sec_offset != 1)
+		sec_offset = 0;
+
+	let width = 0;
+	for (let line in config.radio.data) {
+		if (!sec_offset && match(line, /^ht_capab=.*HT40/)) {
+			sec_offset = null; // auto-detect
+			continue;
+		}
+
+		let val = match(line, /^(vht_oper_chwidth|he_oper_chwidth)=(\d+)/);
+		if (!val)
+			continue;
+
+		val = int(val[2]);
+		if (val > width)
+			width = val;
+	}
+
+	if (freq < 4000)
+		width = 0;
+
+	return hostapd.freq_info(freq, sec_offset, width);
+}
+
+function iface_add(phy, config, phy_status)
+{
+	let config_inline = iface_gen_config(config, !!phy_status);
+
+	let bss = config.bss[0];
+	let ret = hostapd.add_iface(`bss_config=${phy}:${config_inline}`);
+	if (ret < 0)
+		return false;
+
+	if (!phy_status)
+		return true;
+
+	let iface = hostapd.interfaces[phy];
+	if (!iface)
+		return false;
+
+	let freq_info = iface_freq_info(iface, config, phy_status);
+
+	return iface.start(freq_info) >= 0;
+}
+
+function iface_config_macaddr_list(config)
+{
+	let macaddr_list = {};
+	for (let name, mld in hostapd.data.mld)
+		if (mld.macaddr)
+			macaddr_list[mld.macaddr] = -1;
+	for (let i = 0; i < length(config.bss); i++) {
+		let bss = config.bss[i];
+		if (!bss.default_macaddr)
+			macaddr_list[bss.bssid] = i;
+	}
+
+	return macaddr_list;
+}
+
+function iface_update_supplicant_macaddr(phydev, config)
+{
+	let macaddr_list = [];
+	for (let name, mld in hostapd.data.mld)
+		if (mld.macaddr)
+			push(macaddr_list, mld.macaddr);
+	for (let bss in config.bss)
+		push(macaddr_list, bss.bssid);
+	ubus.defer("wpa_supplicant", "phy_set_macaddr_list", {
+		phy: phydev.phy,
+		radio: phydev.radio ?? -1,
+		macaddr: macaddr_list
+	});
+}
+
+function __iface_pending_next(pending, state, ret, data)
+{
+	let config = pending.config;
+	let phydev = pending.phydev;
+	let phy = pending.phy;
+	let bss = config.bss[0];
+
+	if (pending.defer)
+		pending.defer.abort();
+	delete pending.defer;
+	switch (state) {
+	case "init":
+		iface_update_supplicant_macaddr(phydev, config);
+		return "create_bss";
+	case "create_bss":
+		if (!bss.mld_ap) {
+			let err = phydev.wdev_add(bss.ifname, {
+				mode: "ap",
+				radio: phydev.radio,
+			});
+			if (err) {
+				hostapd.printf(`Failed to create ${bss.ifname} on phy ${phy}: ${err}`);
+				return null;
+			}
+		}
+
+		pending.call("wpa_supplicant", "phy_status", {
+			phy: phydev.phy,
+			radio: phydev.radio ?? -1,
+		});
+		return "check_phy";
+	case "check_phy":
+		let phy_status = data;
+		if (phy_status && phy_status.state == "COMPLETED") {
+			if (iface_add(phy, config, phy_status))
+				return "done";
+
+			hostapd.printf(`Failed to bring up phy ${phy} ifname=${bss.ifname} with supplicant provided frequency`);
+		}
+		pending.call("wpa_supplicant", "phy_set_state", {
+			phy: phydev.phy,
+			radio: phydev.radio ?? -1,
+			stop: true
+		});
+		return "wpas_stopped";
+	case "wpas_stopped":
+		if (!iface_add(phy, config))
+			hostapd.printf(`hostapd.add_iface failed for phy ${phy} ifname=${bss.ifname}`);
+		pending.call("wpa_supplicant", "phy_set_state", {
+			phy: phydev.phy,
+			radio: phydev.radio ?? -1,
+			stop: false
+		});
+		return null;
+	case "done":
+	default:
+		delete hostapd.data.pending_config[phy];
+		break;
+	}
+}
+
+function iface_pending_next(ret, data)
+{
+	let pending = true;
+	let cfg = this;
+
+	while (pending) {
+		try {
+			this.next_state = __iface_pending_next(cfg, this.next_state, ret, data);
+			if (!this.next_state) {
+				__iface_pending_next(cfg, "done");
+				return;
+			}
+		} catch(e) {
+			hostapd.printf(`Exception: ${e}\n${e.stacktrace[0].context}`);
+			return;
+		}
+		pending = !this.defer;
+	}
+}
+
+function iface_pending_abort()
+{
+	this.next_state = "done";
+	this.next();
+}
+
+function iface_pending_ubus_call(obj, method, arg)
+{
+	let ubus = hostapd.data.ubus;
+	let pending = this;
+	this.defer = ubus.defer(obj, method, arg, (ret, data) => { delete pending.defer; pending.next(ret, data) });
+}
+
+const iface_pending_proto = {
+	next: iface_pending_next,
+	call: iface_pending_ubus_call,
+	abort: iface_pending_abort,
+};
+
+function iface_pending_init(phydev, config)
+{
+	let phy = phydev.name;
+
+	let pending = proto({
+		next_state: "init",
+		phydev: phydev,
+		phy: phy,
+		config: config,
+		next: iface_pending_next,
+	}, iface_pending_proto);
+
+	hostapd.data.pending_config[phy] = pending;
+	pending.next();
+}
+
+function iface_macaddr_init(phydev, config, macaddr_list)
+{
+	let macaddr_data = {
+		num_global: config.num_global_macaddr ?? 1,
+		macaddr_base: config.macaddr_base,
+		mbssid: config.mbssid ?? 0,
+	};
+
+	return phydev.macaddr_init(macaddr_list, macaddr_data);
+}
+
+function iface_restart(phydev, config, old_config)
+{
+	let phy = phydev.name;
+	let pending = hostapd.data.pending_config[phy];
+
+	if (pending)
+		pending.abort();
+
+	hostapd.remove_iface(phy);
+	iface_remove(old_config);
+	iface_remove(config);
+
+	if (!config.bss || !config.bss[0]) {
+		hostapd.printf(`No bss for phy ${phy}`);
+		return;
+	}
+
+	iface_macaddr_init(phydev, config, iface_config_macaddr_list(config));
+	for (let i = 0; i < length(config.bss); i++) {
+		let bss = config.bss[i];
+		if (bss.default_macaddr)
+			bss.bssid = phydev.macaddr_next();
+	}
+
+	iface_pending_init(phydev, config);
+}
+
+function array_to_obj(arr, key, start)
+{
+	let obj = {};
+
+	start ??= 0;
+	for (let i = start; i < length(arr); i++) {
+		let cur = arr[i];
+		obj[cur[key]] = cur;
+	}
+
+	return obj;
+}
+
+function find_array_idx(arr, key, val)
+{
+	for (let i = 0; i < length(arr); i++)
+		if (arr[i][key] == val)
+			return i;
+
+	return -1;
+}
+
+function bss_reload_psk(bss, config, old_config)
+{
+	if (is_equal(old_config.hash.wpa_psk_file, config.hash.wpa_psk_file))
+		return;
+
+	old_config.hash.wpa_psk_file = config.hash.wpa_psk_file;
+	if (!is_equal(old_config, config))
+		return;
+
+	let ret = bss.ctrl("RELOAD_WPA_PSK");
+	ret ??= "failed";
+
+	hostapd.printf(`Reload WPA PSK file for bss ${config.ifname}: ${ret}`);
+}
+
+function normalize_rxkhs(txt)
+{
+	const pat = {
+		sep: "\x20",
+		mac: "([[:xdigit:]]{2}:?){5}[[:xdigit:]]{2}",
+		r0kh_id: "[\x21-\x7e]{1,48}",
+		r1kh_id: "([[:xdigit:]]{2}:?){5}[[:xdigit:]]{2}",
+		key: "[[:xdigit:]]{32,}",
+		r0kh: function() {
+			return "r0kh=" + this.mac + this.sep + this.r0kh_id;
+		},
+		r1kh: function() {
+			return "r1kh=" + this.mac + this.sep + this.r1kh_id;
+		},
+		rxkh: function() {
+			return "(" + this.r0kh() + "|" + this.r1kh() + ")" + this.sep + this.key;
+		},
+	};
+
+	let rxkhs = filter(
+		split(txt, "\n"), (line) => match(line, regexp("^" + pat.rxkh() + "$"))
+	) ?? [];
+
+	rxkhs = map(rxkhs, function(k) {
+		k = split(k, " ", 3);
+		k[0] = lc(k[0]);
+		if(match(k[0], /^r1kh/)) {
+			k[1] = lc(k[1]);
+		}
+		if(!k[2] = hostapd.rkh_derive_key(k[2])) {
+			return;
+		}
+		return join(" ", k);
+	});
+
+	return join("\n", sort(filter(rxkhs, length)));
+}
+
+function bss_reload_rxkhs(bss, config, old_config)
+{
+	let bss_rxkhs = join("\n", sort(split(bss.ctrl("GET_RXKHS"), "\n")));
+	let bss_rxkhs_hash = hostapd.sha1(bss_rxkhs);
+
+	if (is_equal(config.hash.rxkh_file, bss_rxkhs_hash)) {
+		if (is_equal(old_config.hash.rxkh_file, config.hash.rxkh_file))
+			return;
+	}
+
+	old_config.hash.rxkh_file = config.hash.rxkh_file;
+	if (!is_equal(old_config, config))
+		return;
+
+	let ret = bss.ctrl("RELOAD_RXKHS");
+	ret ??= "failed";
+
+	hostapd.printf(`Reload RxKH file for bss ${config.ifname}: ${ret}`);
+}
+
+function remove_file_fields(config)
+{
+	return filter(config, (line) =>
+		!match(line, /^\s*$/) &&
+		!match(line, /^\s*#/) &&
+		!hostapd.data.file_fields[split(line, "=")[0]]
+	);
+}
+
+function bss_remove_file_fields(config)
+{
+	let new_cfg = {};
+
+	for (let key in config)
+		new_cfg[key] = config[key];
+	new_cfg.data = remove_file_fields(new_cfg.data);
+	new_cfg.hash = {};
+	for (let key in config.hash)
+		new_cfg.hash[key] = config.hash[key];
+	delete new_cfg.hash.wpa_psk_file;
+	delete new_cfg.hash.sae_password_file;
+	delete new_cfg.hash.vlan_file;
+
+	return new_cfg;
+}
+
+function bss_ifindex_list(config)
+{
+	config = filter(config, (line) => !!hostapd.data.iface_fields[split(line, "=")[0]]);
+
+	return join(",", map(config, (line) => {
+		try {
+			let file = "/sys/class/net/" + split(line, "=")[1] + "/ifindex";
+			let val = trim(readfile(file));
+			return val;
+		} catch (e) {
+			return "";
+		}
+	}));
+}
+
+function bss_config_hash(config)
+{
+	return hostapd.sha1(remove_file_fields(config) + bss_ifindex_list(config));
+}
+
+function bss_find_existing(config, prev_config, prev_hash)
+{
+	let hash = bss_config_hash(config.data);
+
+	for (let i = 0; i < length(prev_config.bss); i++) {
+		if (!prev_hash[i] || hash != prev_hash[i])
+			continue;
+
+		prev_hash[i] = null;
+		return i;
+	}
+
+	return -1;
+}
+
+function get_config_bss(name, config, idx)
+{
+	if (!config.bss[idx]) {
+		hostapd.printf(`Invalid bss index ${idx}`);
+		return;
+	}
+
+	let ifname = config.bss[idx].ifname;
+	if (!ifname) {
+		hostapd.printf(`Could not find bss ${config.bss[idx].ifname}`);
+		return;
+	}
+
+	let if_bss = hostapd.bss[name];
+	if (!if_bss) {
+		hostapd.printf(`Could not find interface ${name} bss list`);
+		return;
+	}
+
+	return if_bss[ifname];
+}
+
+function iface_reload_config(name, phydev, config, old_config)
+{
+	let phy = phydev.name;
+
+	if (!old_config || !is_equal(old_config.radio, config.radio))
+		return false;
+
+	if (is_equal(old_config.bss, config.bss))
+		return true;
+
+	if (hostapd.data.pending_config[name])
+		return false;
+
+	if (!old_config.bss || !old_config.bss[0])
+		return false;
+
+	let iface = hostapd.interfaces[name];
+	let iface_name = old_config.bss[0].ifname;
+	if (!iface) {
+		hostapd.printf(`Could not find previous interface ${iface_name}`);
+		return false;
+	}
+
+	if (iface.state() != "ENABLED") {
+		hostapd.printf(`Interface ${iface_name} is not fully configured`);
+		return false;
+	}
+
+	let first_bss = get_config_bss(name, old_config, 0);
+	if (!first_bss) {
+		hostapd.printf(`Could not find bss of previous interface ${iface_name}`);
+		return false;
+	}
+
+	let macaddr_list = iface_config_macaddr_list(config);
+	let bss_list = [];
+	let bss_list_cfg = [];
+	let prev_bss_hash = [];
+
+	for (let bss in old_config.bss) {
+		let hash = bss_config_hash(bss.data);
+		push(prev_bss_hash, bss_config_hash(bss.data));
+	}
+
+	// Step 1: find (possibly renamed) interfaces with the same config
+	// and store them in the new order (with gaps)
+	for (let i = 0; i < length(config.bss); i++) {
+		let prev;
+
+		// For fullmac devices, the first interface needs to be preserved,
+		// since it's treated as the master
+		if (!i && phy_is_fullmac(phy)) {
+			prev = 0;
+			prev_bss_hash[0] = null;
+		} else {
+			prev = bss_find_existing(config.bss[i], old_config, prev_bss_hash);
+		}
+		if (prev < 0)
+			continue;
+
+		let cur_config = config.bss[i];
+		let prev_config = old_config.bss[prev];
+		if (prev_config.force_reload) {
+			delete prev_config.force_reload;
+			continue;
+		}
+
+		let prev_bss = get_config_bss(name, old_config, prev);
+		if (!prev_bss)
+			return false;
+
+		// try to preserve MAC address of this BSS by reassigning another
+		// BSS if necessary
+		if ((cur_config.default_macaddr || cur_config.random_macaddr) &&
+		    cur_config.random_macaddr == prev_config.random_macaddr &&
+		    cur_config.default_macaddr == prev_config.default_macaddr &&
+		    !macaddr_list[prev_config.bssid]) {
+			macaddr_list[prev_config.bssid] = i;
+			cur_config.bssid = prev_config.bssid;
+		}
+
+		bss_list[i] = prev_bss;
+		bss_list_cfg[i] = old_config.bss[prev];
+	}
+
+	if (config.mbssid && !bss_list_cfg[0]) {
+		hostapd.printf("First BSS changed with MBSSID enabled");
+		return false;
+	}
+
+	// Step 2: if none were found, rename and preserve the first one
+	if (length(bss_list) == 0) {
+		// can't change the bssid of the first bss
+		if (config.bss[0].bssid != old_config.bss[0].bssid) {
+			if (!config.bss[0].default_macaddr) {
+				hostapd.printf(`BSSID of first interface changed: ${lc(old_config.bss[0].bssid)} -> ${lc(config.bss[0].bssid)}`);
+				return false;
+			}
+
+			config.bss[0].bssid = old_config.bss[0].bssid;
+		}
+
+		let prev_bss = get_config_bss(name, old_config, 0);
+		if (!prev_bss)
+			return false;
+
+		macaddr_list[config.bss[0].bssid] = 0;
+		bss_list[0] = prev_bss;
+		bss_list_cfg[0] = old_config.bss[0];
+		prev_bss_hash[0] = null;
+	}
+
+	// Step 3: delete all unused old interfaces
+	for (let i = 0; i < length(prev_bss_hash); i++) {
+		if (!prev_bss_hash[i])
+			continue;
+
+		let prev_bss = get_config_bss(name, old_config, i);
+		if (!prev_bss)
+			return false;
+
+		let ifname = old_config.bss[i].ifname;
+		hostapd.printf(`Remove bss '${ifname}' on phy '${name}'`);
+		prev_bss.delete();
+		if (!old_config.bss[i].mld_ap)
+			wdev_remove(ifname);
+	}
+
+	// Step 4: rename preserved interfaces, use temporary name on duplicates
+	let rename_list = [];
+	for (let i = 0; i < length(bss_list); i++) {
+		if (!bss_list[i])
+			continue;
+
+		let old_ifname = bss_list_cfg[i].ifname;
+		let new_ifname = config.bss[i].ifname;
+		if (old_ifname == new_ifname)
+			continue;
+
+		if (hostapd.bss[name][new_ifname]) {
+			new_ifname = "tmp_" + substr(hostapd.sha1(new_ifname), 0, 8);
+			push(rename_list, i);
+		}
+
+		hostapd.printf(`Rename bss ${old_ifname} to ${new_ifname}`);
+		if (!bss_list[i].rename(new_ifname)) {
+			hostapd.printf(`Failed to rename bss ${old_ifname} to ${new_ifname}`);
+			return false;
+		}
+
+		bss_list_cfg[i].ifname = new_ifname;
+	}
+
+	// Step 5: rename interfaces with temporary names
+	for (let i in rename_list) {
+		let new_ifname = config.bss[i].ifname;
+		if (!bss_list[i].rename(new_ifname)) {
+			hostapd.printf(`Failed to rename bss to ${new_ifname}`);
+			return false;
+		}
+		bss_list_cfg[i].ifname = new_ifname;
+	}
+
+	// Step 6: assign BSSID for newly created interfaces
+	macaddr_list = iface_macaddr_init(phydev, config, macaddr_list);
+	for (let i = 0; i < length(config.bss); i++) {
+		if (bss_list[i])
+			continue;
+		let bsscfg = config.bss[i];
+
+		let mac_idx = macaddr_list[bsscfg.bssid];
+		if (mac_idx < 0)
+			macaddr_list[bsscfg.bssid] = i;
+		if (mac_idx == i)
+			continue;
+
+		// statically assigned bssid of the new interface is in conflict
+		// with the bssid of a reused interface. reassign the reused interface
+		if (!bsscfg.default_macaddr) {
+			// can't update bssid of the first BSS, need to restart
+			if (!mac_idx < 0)
+				return false;
+
+			bsscfg = config.bss[mac_idx];
+		}
+
+		let addr = phydev.macaddr_next(i);
+		if (!addr) {
+			hostapd.printf(`Failed to generate mac address for phy ${name}`);
+			return false;
+		}
+		bsscfg.bssid = addr;
+	}
+
+	let config_inline = iface_gen_config(config);
+
+	// Step 7: fill in the gaps with new interfaces
+	for (let i = 0; i < length(config.bss); i++) {
+		let ifname = config.bss[i].ifname;
+		let bss = bss_list[i];
+
+		if (bss)
+			continue;
+
+		hostapd.printf(`Add bss ${ifname} on phy ${name}`);
+		bss_list[i] = iface.add_bss(config_inline, i);
+		if (!bss_list[i]) {
+			hostapd.printf(`Failed to add new bss ${ifname} on phy ${name}`);
+			return false;
+		}
+	}
+
+	// Step 8: update interface bss order
+	if (!iface.set_bss_order(bss_list)) {
+		hostapd.printf(`Failed to update BSS order on phy '${name}'`);
+		return false;
+	}
+
+	// Step 9: update config
+	for (let i = 0; i < length(config.bss); i++) {
+		if (!bss_list_cfg[i])
+			continue;
+
+		let ifname = config.bss[i].ifname;
+		let bss = bss_list[i];
+
+		if (is_equal(config.bss[i], bss_list_cfg[i]))
+			continue;
+
+		if (is_equal(bss_remove_file_fields(config.bss[i]),
+		             bss_remove_file_fields(bss_list_cfg[i]))) {
+			hostapd.printf(`Update config data files for bss ${ifname}`);
+			if (bss.set_config(config_inline, i, true) < 0) {
+				hostapd.printf(`Could not update config data files for bss ${ifname}`);
+				return false;
+			} else {
+				bss.ctrl("RELOAD_WPA_PSK");
+				continue;
+			}
+		}
+
+		bss_reload_psk(bss, config.bss[i], bss_list_cfg[i]);
+		bss_reload_rxkhs(bss, config.bss[i], bss_list_cfg[i]);
+		if (is_equal(config.bss[i], bss_list_cfg[i]))
+			continue;
+
+		hostapd.printf(`Reload config for bss '${config.bss[0].ifname}' on phy '${name}'`);
+		if (bss.set_config(config_inline, i) < 0) {
+			hostapd.printf(`Failed to set config for bss ${ifname}`);
+			return false;
+		}
+	}
+
+	return true;
+}
+
+function bss_check_mld(phydev, iface_name, bss)
+{
+	if (!bss.ifname)
+		return;
+
+	let mld_data = hostapd.data.mld[bss.ifname];
+	if (!mld_data || !mld_data.ifname || !mld_data.macaddr)
+		return;
+
+	bss.mld_bssid = mld_data.macaddr;
+	mld_data.iface[iface_name] = true;
+
+	if (!access('/sys/class/net/' + bss.ifname, 'x'))
+		mld_data.has_wdev = false;
+
+	if (mld_data.has_wdev)
+		return true;
+
+	hostapd.printf(`Create MLD interface ${bss.ifname} on phy ${phydev.name}, radio mask: ${mld_data.radio_mask}`);
+	let err = phydev.wdev_add(bss.ifname, {
+		mode: "ap",
+		macaddr: mld_data.macaddr,
+		radio_mask: mld_data.radio_mask,
+	});
+	wdev_set_up(bss.ifname, true);
+	if (err) {
+		hostapd.printf(`Failed to create MLD ${bss.ifname} on phy ${phydev.name}: ${err}`);
+		delete mld_data.iface[iface_name];
+		return;
+	}
+
+	mld_data.has_wdev = true;
+
+	return true;
+}
+
+function iface_check_mld(phydev, name, config)
+{
+	phydev = phy_open(phydev.phy);
+
+	for (let mld_name, mld_data in hostapd.data.mld)
+		delete mld_data.iface[name];
+
+	for (let i = 0; i < length(config.bss); i++) {
+		let bss = config.bss[i];
+		if (!bss.mld_ap)
+			continue;
+
+		if (!bss_check_mld(phydev, name, bss)) {
+			hostapd.printf(`Skip MLD interface ${name} on phy ${phydev.name}`);
+			splice(config.bss, i--, 1);
+		}
+	}
+
+	for (let mld_name, mld_data in hostapd.data.mld) {
+		if (length(mld_data.iface) > 0)
+			continue;
+
+		hostapd.printf(`Remove MLD interface ${mld_name}`);
+		wdev_remove(mld_name);
+		delete mld_data.has_wdev;
+	}
+}
+
+function iface_config_remove(name, old_config)
+{
+	hostapd.remove_iface(name);
+	return iface_remove(old_config);
+}
+
+function iface_set_config(name, config)
+{
+	let old_config = hostapd.data.config[name];
+
+	hostapd.data.config[name] = config;
+
+	let phy = config.phy;
+	let phydev = phy_open(phy, config.radio_idx);
+	if (!phydev) {
+		hostapd.printf(`Failed to open phy ${phy}`);
+		return false;
+	}
+
+	config.orig_bss = [ ...config.bss ];
+	iface_check_mld(phydev, name, config);
+	if (!length(config.bss))
+		return iface_config_remove(name, old_config);
+
+	try {
+		let ret = iface_reload_config(name, phydev, config, old_config);
+		if (ret) {
+			iface_update_supplicant_macaddr(phydev, config);
+			hostapd.printf(`Reloaded settings for phy ${name}`);
+			return 0;
+		}
+	} catch (e) {
+		hostapd.printf(`Error reloading config: ${e}\n${e.stacktrace[0].context}`);
+	}
+
+	hostapd.printf(`Restart interface for phy ${name}`);
+	let ret = iface_restart(phydev, config, old_config);
+
+	return ret;
+}
+
+function config_add_bss(config, name)
+{
+	let bss = {
+		ifname: name,
+		data: [],
+		hash: {}
+	};
+
+	push(config.bss, bss);
+
+	return bss;
+}
+
+function iface_load_config(phy, radio, filename)
+{
+	if (radio < 0)
+		radio = null;
+
+	let config = {
+		phy,
+		radio_idx: radio,
+		radio: {
+			data: []
+		},
+		bss: [],
+		orig_file: filename,
+	};
+
+	let f = open(filename, "r");
+	if (!f)
+		return config;
+
+	let bss;
+	let line;
+	while ((line = rtrim(f.read("line"), "\n")) != null) {
+		let val = split(line, "=", 2);
+		if (!val[0])
+			continue;
+
+		if (val[0] == "interface") {
+			bss = config_add_bss(config, val[1]);
+			break;
+		}
+
+		if (val[0] == "channel") {
+			config.radio.channel = val[1];
+			continue;
+		}
+
+		if (val[0] == "#num_global_macaddr")
+			config[substr(val[0], 1)] = int(val[1]);
+		else if (val[0] == "#macaddr_base")
+			config[substr(val[0], 1)] = val[1];
+		else if (val[0] == "mbssid")
+			config[val[0]] = int(val[1]);
+
+		push(config.radio.data, line);
+	}
+
+	while ((line = rtrim(f.read("line"), "\n")) != null) {
+		if (line == "#default_macaddr")
+			bss.default_macaddr = true;
+		if (line == "#random_macaddr")
+			bss.random_macaddr = true;
+
+		let val = split(line, "=", 2);
+		if (!val[0])
+			continue;
+
+		if (val[0] == "bssid") {
+			bss.bssid = lc(val[1]);
+			continue;
+		}
+
+		if (val[0] == "nas_identifier")
+			bss.nasid = val[1];
+
+		if (val[0] == "mld_ap")
+			bss[val[0]] = int(val[1]);
+
+		if (val[0] == "bss") {
+			bss = config_add_bss(config, val[1]);
+			continue;
+		}
+
+		if (hostapd.data.file_fields[val[0]]) {
+			if (val[0] == "rxkh_file") {
+				bss.hash[val[0]] = hostapd.sha1(normalize_rxkhs(readfile(val[1])));
+			} else {
+				bss.hash[val[0]] = hostapd.sha1(readfile(val[1]));
+			}
+		}
+
+		push(bss.data, line);
+	}
+	f.close();
+
+	return config;
+}
+
+function phy_name(phy, radio)
+{
+	if (!phy)
+		return null;
+
+	if (radio != null && radio >= 0)
+		phy += "." + radio;
+
+	return phy;
+}
+
+function bss_config(bss_name) {
+	for (let phy, config in hostapd.data.config) {
+		if (!config)
+			continue;
+
+		for (let bss in config.bss)
+			if (bss.ifname == bss_name)
+				return [ config, bss ];
+	}
+}
+
+function mld_rename_bss(data, name)
+{
+	if (data.ifname == name)
+		return true;
+
+	// TODO: handle rename gracefully
+	return false;
+}
+
+function mld_add_bss(name, data, phy_list, i)
+{
+	let config = data.config;
+	if (!config.phy)
+		return;
+
+	hostapd.printf(`Add MLD interface ${name}`);
+	wdev_remove(name);
+	let phydev = phy_list[config.phy];
+	if (!phydev) {
+		phydev = phy_open(config.phy, 0);
+		if (!phydev)
+			return;
+
+		let macaddr_list = {};
+		let phy_config = hostapd.data.config[phy_name(config.phy, 0)];
+		if (phy_config)
+			macaddr_list = iface_config_macaddr_list(phy_config);
+		iface_macaddr_init(phydev, data.config, macaddr_list);
+
+		phy_list[config.phy] = phydev;
+	}
+
+	data.macaddr = config.macaddr;
+	if (!data.macaddr) {
+		data.macaddr = phydev.macaddr_next();
+		data.default_macaddr = true;
+	}
+
+	let radio_mask = 0;
+	for (let r in config.radios)
+		if (r != null)
+			radio_mask |= 1 << r;
+
+	data.radio_mask = radio_mask;
+	data.ifname = name;
+}
+
+function mld_find_matching_config(list, config)
+{
+	for (let name, data in list)
+		if (is_equal(data.config, config))
+			return name;
+}
+
+function mld_reload_interface(name)
+{
+	let config = hostapd.data.config[name];
+	if (!config)
+		return;
+
+	config = { ...config };
+	config.bss = config.orig_bss;
+
+	iface_set_config(name, config);
+}
+
+function mld_set_config(config)
+{
+	let prev_mld = { ...hostapd.data.mld };
+	let new_mld = {};
+	let phy_list = {};
+	let new_config = !length(prev_mld);
+
+	hostapd.printf(`Set MLD config: ${keys(config)}`);
+
+	// find renamed/new interfaces
+	for (let name, data in config) {
+		let prev = mld_find_matching_config(prev_mld, data);
+		if (prev) {
+			let data = prev_mld[prev];
+			if (mld_rename_bss(data, name)) {
+				new_mld[name] = data;
+				delete prev_mld[prev];
+				continue;
+			}
+		}
+
+		new_mld[name] = {
+			config: data,
+			iface: {},
+		};
+	}
+
+	let reload_iface = {};
+	for (let name, data in prev_mld) {
+		delete hostapd.data.mld[name];
+
+		if (!data.ifname)
+			continue;
+
+		for (let iface, bss_list in hostapd.bss) {
+			if (!bss_list[name])
+				continue;
+			reload_iface[iface] = true;
+		}
+	}
+
+	for (let name in reload_iface)
+		mld_reload_interface(name);
+
+	for (let name, data in prev_mld) {
+		if (data.ifname)
+			hostapd.printf(`Remove MLD interface ${name}`);
+		wdev_remove(name);
+	}
+
+	// add new interfaces
+	hostapd.data.mld = new_mld;
+	for (let name, data in new_mld)
+		if (!data.ifname)
+			mld_add_bss(name, data, phy_list);
+
+	if (!new_config)
+		return;
+
+	hostapd.printf(`Reload all interfaces`);
+	for (let name in hostapd.data.config)
+		mld_reload_interface(name);
+}
+
+function dpp_find_bss(ifname)
+{
+	for (let phy, bss_list in hostapd.bss) {
+		if (bss_list[ifname])
+			return bss_list[ifname];
+	}
+	return null;
+}
+
+function dpp_channel_handle_request(channel, req)
+{
+	let data = req.args ?? {};
+	let bss;
+
+	switch (req.type) {
+	case "start":
+		if (!data.ifname)
+			return libubus.STATUS_INVALID_ARGUMENT;
+		let old_hook = hostapd.data.dpp_hooks[data.ifname];
+		if (old_hook && old_hook.channel != channel)
+			old_hook.channel.disconnect();
+		hostapd.data.dpp_hooks[data.ifname] = {
+			channel: channel,
+			timeout_count: 0,
+		};
+		return 0;
+
+	case "stop":
+		if (!data.ifname)
+			return libubus.STATUS_INVALID_ARGUMENT;
+		let hook = hostapd.data.dpp_hooks[data.ifname];
+		if (hook && hook.channel == channel)
+			delete hostapd.data.dpp_hooks[data.ifname];
+		return 0;
+
+	case "tx_action":
+		bss = dpp_find_bss(data.ifname);
+		if (!bss)
+			return libubus.STATUS_NOT_FOUND;
+		if (!bss.dpp_send_action(data.dst, data.freq ?? 0, data.frame))
+			return libubus.STATUS_UNKNOWN_ERROR;
+		return 0;
+
+	case "tx_gas_resp":
+		bss = dpp_find_bss(data.ifname);
+		if (!bss)
+			return libubus.STATUS_NOT_FOUND;
+		if (!bss.dpp_send_gas_resp(data.dst, data.dialog_token, data.data, data.freq ?? 0))
+			return libubus.STATUS_UNKNOWN_ERROR;
+		return 0;
+
+	case "set_cce":
+		bss = dpp_find_bss(data.ifname);
+		if (!bss)
+			return libubus.STATUS_NOT_FOUND;
+		let val = data.enable ? "dd04506f9a1e" : "";
+		bss.ctrl("SET vendor_elements " + val);
+		bss.ctrl("UPDATE_BEACON");
+		return 0;
+
+	default:
+		return libubus.STATUS_METHOD_NOT_FOUND;
+	}
+}
+
+function dpp_channel_handle_disconnect(channel)
+{
+	for (let ifname, hook in hostapd.data.dpp_hooks) {
+		if (hook.channel == channel)
+			delete hostapd.data.dpp_hooks[ifname];
+	}
+}
+
+function dpp_rx_via_channel(ifname, method, data)
+{
+	let hook = hostapd.data.dpp_hooks[ifname];
+	if (!hook)
+		return null;
+
+	let response = hook.channel.request({
+		method: method,
+		data: data,
+	});
+	if (hook.channel.error(true) == libubus.STATUS_TIMEOUT) {
+		hook.timeout_count++;
+		if (hook.timeout_count >= 3) {
+			hostapd.printf(`DPP channel timeout for ${ifname}, disconnecting`);
+			hook.channel.disconnect();
+			delete hostapd.data.dpp_hooks[ifname];
+		}
+		return null;
+	}
+
+	hook.timeout_count = 0;
+	return response;
+}
+
+let main_obj = {
+	reload: {
+		args: {
+			phy: "",
+			radio: 0,
+		},
+		call: function(req) {
+			let phy_list = req.args.phy ? [ phy_name(req.args.phy, req.args.radio) ] : keys(hostapd.data.config);
+			for (let phy_name in phy_list) {
+				let phy = hostapd.data.config[phy_name];
+				let config = iface_load_config(phy.phy, phy.radio_idx, phy.orig_file);
+				iface_set_config(phy_name, config);
+			}
+
+			return 0;
+		}
+	},
+	apsta_state: {
+		args: {
+			phy: "",
+			radio: 0,
+			up: true,
+			frequency: 0,
+			sec_chan_offset: 0,
+			csa: true,
+			csa_count: 0,
+		},
+		call: function(req) {
+			let phy = phy_name(req.args.phy, req.args.radio);
+			if (req.args.up == null || !phy)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			let config = hostapd.data.config[phy];
+			if (!config || !config.bss || !config.bss[0] || !config.bss[0].ifname)
+				return 0;
+
+			let iface = hostapd.interfaces[phy];
+			if (!iface)
+				return 0;
+
+			if (!req.args.up) {
+				iface.stop();
+				return 0;
+			}
+
+			let freq_info;
+			if (req.args.frequency) {
+				freq_info = iface_freq_info(iface, config, req.args);
+				if (!freq_info)
+					return libubus.STATUS_UNKNOWN_ERROR;
+
+				if (req.args.csa) {
+					freq_info.csa_count = req.args.csa_count ?? 10;
+					let ret = iface.switch_channel(freq_info);
+					if (!ret)
+						return libubus.STATUS_UNKNOWN_ERROR;
+					return 0;
+				}
+			}
+
+			let ret = iface.start(freq_info);
+			if (!ret)
+				return libubus.STATUS_UNKNOWN_ERROR;
+
+			return 0;
+		}
+	},
+	config_get_macaddr_list: {
+		args: {
+			phy: "",
+			radio: 0,
+		},
+		call: function(req) {
+			let phy = phy_name(req.args.phy, req.args.radio);
+			if (!phy)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			let ret = {
+				macaddr: [],
+			};
+
+			let config = hostapd.data.config[phy];
+			if (!config)
+				return ret;
+
+			ret.macaddr = map(config.bss, (bss) => bss.bssid);
+			return ret;
+		}
+	},
+	switch_channel: {
+		args: {
+			phy: "",
+			radio: 0,
+			csa_count: 0,
+			sec_channel: 0,
+			oper_chwidth: 0,
+			frequency: 0,
+			center_freq1: 0,
+			center_freq2: 0,
+		},
+		call: function(req) {
+			let phy = phy_name(req.args.phy, req.args.radio);
+			if (!req.args.frequency || !phy)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			let iface = hostapd.interfaces[phy];
+			if (!iface)
+				return libubus.STATUS_NOT_FOUND;
+
+			req.args.csa_count ??= 10;
+			let ret = iface.switch_channel(req.args);
+			if (!ret)
+				return libubus.STATUS_UNKNOWN_ERROR;
+
+			return 0;
+		},
+	},
+	mld_set: {
+		args: {
+			config: {}
+		},
+		call: function(req) {
+			if (!req.args.config)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			mld_set_config(req.args.config);
+
+			return {
+				pid: hostapd.getpid()
+			};
+		}
+	},
+	config_reset: {
+		args: {
+		},
+		call: function(req) {
+			for (let name in hostapd.data.config)
+				iface_set_config(name);
+			mld_set_config({});
+			return 0;
+		}
+	},
+	config_set: {
+		args: {
+			phy: "",
+			radio: 0,
+			config: "",
+			prev_config: "",
+		},
+		call: function(req) {
+			let phy = req.args.phy;
+			let radio = req.args.radio;
+			let name = phy_name(phy, radio);
+			let file = req.args.config;
+			let prev_file = req.args.prev_config;
+
+			if (!phy)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			if (prev_file && !hostapd.data.config[name]) {
+				let config = iface_load_config(phy, radio, prev_file);
+				if (config)
+					config.radio.data = [];
+				hostapd.data.config[name] = config;
+			}
+
+			let config = iface_load_config(phy, radio, file);
+
+			hostapd.printf(`Set new config for phy ${name}: ${file}`);
+			iface_set_config(name, config);
+
+			if (hostapd.data.auth_obj)
+				hostapd.data.auth_obj.notify("reload", { phy, radio });
+
+			return {
+				pid: hostapd.getpid()
+			};
+		}
+	},
+	config_add: {
+		args: {
+			iface: "",
+			config: "",
+		},
+		call: function(req) {
+			if (!req.args.iface || !req.args.config)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			if (hostapd.add_iface(`bss_config=${req.args.iface}:${req.args.config}`) < 0)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			return {
+				pid: hostapd.getpid()
+			};
+		}
+	},
+	config_remove: {
+		args: {
+			iface: ""
+		},
+		call: function(req) {
+			if (!req.args.iface)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			hostapd.remove_iface(req.args.iface);
+			return 0;
+		}
+	},
+	bss_info: {
+		args: {
+			iface: ""
+		},
+		call: function(req) {
+			if (!req.args.iface)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			let config = bss_config(req.args.iface);
+			if (!config)
+				return libubus.STATUS_NOT_FOUND;
+
+			let bss = config[1];
+			config = config[0];
+			let ret = {};
+
+			for (let line in [ ...config.radio.data, ...bss.data ]) {
+				let fields = split(line, "=", 2);
+				let name = fields[0];
+				if (hostapd.data.bss_info_fields[name])
+					ret[name] = fields[1];
+			}
+
+			return ret;
+		}
+	},
+	status: {
+		args: {},
+		call: function(req) {
+			let interfaces = {};
+
+			for (let phy_name, config in hostapd.data.config) {
+				if (!config || !config.bss)
+					continue;
+
+				let is_pending = !!hostapd.data.pending_config[phy_name];
+				let iface = hostapd.interfaces[phy_name];
+				let is_running = iface && iface.state() == "ENABLED" && !is_pending;
+
+				for (let bss in config.bss) {
+					let ifname = bss.ifname;
+					let entry = interfaces[ifname];
+
+					if (bss.mld_ap) {
+						if (!entry) {
+							let mld = hostapd.data.mld[ifname];
+							entry = interfaces[ifname] = {
+								wiphy: config.phy,
+								macaddr: mld ? mld.macaddr : bss.mld_bssid,
+								links: {},
+							};
+						}
+						entry.links[config.radio_idx ?? 0] = {
+							radio: config.radio_idx ?? 0,
+							macaddr: bss.bssid,
+							running: is_running,
+							pending: is_pending,
+						};
+					} else {
+						entry = {
+							wiphy: config.phy,
+							macaddr: bss.bssid,
+							running: is_running,
+							pending: is_pending,
+						};
+						if (config.radio_idx != null && config.radio_idx >= 0)
+							entry.radio = config.radio_idx;
+						interfaces[ifname] = entry;
+					}
+				}
+			}
+
+			return { interfaces };
+		}
+	},
+	dpp_channel: {
+		args: {},
+		call: function(req) {
+			let channel;
+			let on_request = (chan_req) => dpp_channel_handle_request(channel, chan_req);
+			let on_disconnect = () => dpp_channel_handle_disconnect(channel);
+
+			channel = req.new_channel(on_request, on_disconnect, 1);
+			if (!channel)
+				return libubus.STATUS_UNKNOWN_ERROR;
+
+			return 0;
+		}
+	},
+};
+
+hostapd.data.ubus = ubus;
+hostapd.data.obj = ubus.publish("hostapd", main_obj);
+
+
+let auth_obj = {};
+hostapd.data.auth_obj = ubus.publish("hostapd-auth", auth_obj);
+hostapd.udebug_set("hostapd", hostapd.data.ubus);
+
+function bss_event(type, name, data) {
+	let ubus = hostapd.data.ubus;
+
+	data ??= {};
+	data.name = name;
+	hostapd.data.obj.notify(`bss.${type}`, data, null, null, null, -1);
+	ubus.call("service", "event", { type: `hostapd.${name}.${type}`, data: {} });
+}
+
+return {
+	shutdown: function() {
+		for (let phy in hostapd.data.config)
+			iface_set_config(phy);
+		hostapd.udebug_set(null);
+		hostapd.ubus.disconnect();
+	},
+	bss_create: function(phy, name, obj) {
+		phy = hostapd.data.config[phy];
+		if (!phy)
+			return;
+
+		if (phy.radio_idx != null && phy.radio_idx >= 0)
+			wdev_set_radio_mask(name, 1 << phy.radio_idx);
+	},
+	bss_add: function(phy, name, obj) {
+		bss_event("add", name);
+	},
+	bss_reload: function(phy, name, obj, reconf) {
+		bss_event("reload", name, { reconf: reconf != 0 });
+	},
+	bss_remove: function(phy, name, obj) {
+		delete hostapd.data.dpp_hooks[name];
+		bss_event("remove", name);
+	},
+	sta_auth: function(iface, sta) {
+		let msg = { iface, sta };
+		let ret = {};
+		let data_cb = (type, data) => {
+			ret = { ...ret, ...data };
+		};
+		if (hostapd.data.auth_obj)
+			hostapd.data.auth_obj.notify("sta_auth", msg, data_cb, null, null, 1000);
+		return ret;
+	},
+	sta_connected: function(iface, sta, data) {
+		let msg = { iface, sta, ...data };
+		let ret = {};
+		let data_cb = (type, data) => {
+			ret = { ...ret, ...data };
+		};
+		if (hostapd.data.auth_obj)
+			hostapd.data.auth_obj.notify("sta_connected", msg, data_cb, null, null, 1000);
+		return ret;
+	},
+	dpp_rx_action: function(iface, src, frame_type, freq, frame) {
+		let response = dpp_rx_via_channel(iface, "rx_action", {
+			ifname: iface, src, frame_type, freq, frame,
+		});
+		if (response && response.handled)
+			return true;
+		return false;
+	},
+	dpp_rx_gas: function(iface, src, dialog_token, query, freq) {
+		let response = dpp_rx_via_channel(iface, "rx_gas", {
+			ifname: iface, src, dialog_token, query, freq,
+		});
+		if (response && response.response)
+			return response.response;
+		return null;
+	},
+	wps_m7_rx: function(ifname, addr, data) {
+		let response = dpp_rx_via_channel(ifname, "wps_m7_rx", {
+			ifname, addr, data,
+		});
+		if (!response)
+			return null;
+		return response;
+	},
+};
diff --git a/wireless-scripts-example/vanila/mac80211.sh b/wireless-scripts-example/vanila/mac80211.sh
new file mode 100755
index 0000000000..6230f90287
--- /dev/null
+++ b/wireless-scripts-example/vanila/mac80211.sh
@@ -0,0 +1,349 @@
+#!/usr/bin/ucode
+
+'use strict';
+
+import { set_default, log } from 'wifi.common';
+import { validate, dump_options } from 'wifi.validate';
+import * as supplicant from 'wifi.supplicant';
+import * as hostapd from 'wifi.hostapd';
+import * as netifd from 'wifi.netifd';
+import * as iface from 'wifi.iface';
+import { find_phy } from 'wifi.utils';
+import * as nl80211 from 'nl80211';
+import * as fs from 'fs';
+
+global.radio = ARGV[2];
+
+const mesh_param_list = [
+	"mesh_retry_timeout", "mesh_confirm_timeout", "mesh_holding_timeout", "mesh_max_peer_links",
+	"mesh_max_retries", "mesh_ttl", "mesh_element_ttl", "mesh_hwmp_max_preq_retries",
+	"mesh_path_refresh_time", "mesh_min_discovery_timeout", "mesh_hwmp_active_path_timeout",
+	"mesh_hwmp_preq_min_interval", "mesh_hwmp_net_diameter_traversal_time", "mesh_hwmp_rootmode",
+	"mesh_hwmp_rann_interval", "mesh_gate_announcements", "mesh_sync_offset_max_neighor",
+	"mesh_rssi_threshold", "mesh_hwmp_active_path_to_root_timeout", "mesh_hwmp_root_interval",
+	"mesh_hwmp_confirmation_interval", "mesh_awake_window", "mesh_plink_timeout",
+	"mesh_auto_open_plinks", "mesh_fwding", "mesh_nolearn", "mesh_power_mode"
+];
+
+function phy_suffix(radio, sep) {
+	if (radio == null || radio < 0)
+		return "";
+	return sep + radio;
+}
+
+function reset_config(phy, radio) {
+	let name = phy + phy_suffix(radio, ".");
+	let prev_config = `/var/run/hostapd-${name}.conf`;
+
+	global.ubus.call('hostapd', 'config_set', { phy, radio, config: '', prev_config });
+	global.ubus.call('wpa_supplicant', 'config_set', { phy, radio, config: []});
+
+	name = phy + phy_suffix(radio, ":");
+	system(`ucode /usr/share/hostap/wdev.uc ${name} set_config '{}'`);
+}
+
+function get_channel_frequency(band, channel) {
+	if (channel < 1)
+		return null;
+
+	switch (band) {
+	case '2g':
+		if (channel == 14)
+			return 2484;
+		return 2407 + channel * 5;
+	case '5g':
+		if (channel >= 182 && channel <= 196)
+			return 4000 + channel * 5;
+		return 5000 + channel * 5;
+	case '6g':
+		if (channel == 2)
+			return 5935;
+		return 5950 + channel * 5;
+	case '60g':
+		return 56160 + channel * 2160;
+	}
+}
+
+function setup_phy(phy, config, data) {
+	if (config.channel == "auto")
+		config.channel = 0;
+	config.channel = +config.channel;
+	config.frequency = get_channel_frequency(config.band, config.channel);
+
+	if (config.country) {
+		log(`Setting country code to ${config.country}`);
+		system(`iw reg set ${config.country}`);
+	}
+
+	set_default(config, 'rxantenna', 0xffffffff);
+	set_default(config, 'txantenna', 0xffffffff);
+
+	if (config.txantenna == 'all')
+		config.txantenna = 0xffffffff;
+	if (config.rxantenna == 'all')
+		config.rxantenna = 0xffffffff;
+
+	if (config.txantenna != data?.txantenna || config.rxantenna != data?.rxantenna)
+		reset_config(phy, config.radio);
+
+	netifd.set_data({
+		phy,
+		radio: config.radio,
+		txantenna: config.txantenna,
+		rxantenna: config.rxantenna
+	});
+
+	if (config.txpower)
+		config.txpower = 'fixed ' + config.txpower + '00';
+	else
+		config.txpower = 'auto';
+
+	log(`Configuring '${phy}' txantenna: ${config.txantenna}, rxantenna: ${config.rxantenna} distance: ${config.distance}`);
+	system(`iw phy ${phy} set antenna ${config.txantenna} ${config.rxantenna}`);
+	system(`iw phy ${phy} set distance ${config.distance}`);
+	system(`iw phy ${phy} set txpower ${config.txpower}`);
+
+	if (config.frag)
+		system(`iw phy ${phy} set frag ${config.frag}`);
+	if (config.rts)
+		system(`iw phy ${phy} set rts ${config.rts}`);
+}
+
+function iw_htmode(config) {
+	let suffix = substr(config.htmode, 3);
+	if (suffix == "40+" || suffix == "40-")
+		return "HT" + suffix;
+
+	switch (config.htmode ?? "NONE") {
+	case "HT20":
+	case "VHT20":
+	case "HE20":
+	case "EHT20":
+		return "HT20";
+	case "VHT80":
+	case "HE80":
+	case "EHT80":
+	case "HE160":
+	case "EHT160":
+	case "EHT320":
+		return "80MHZ";
+	case "NONE":
+	case "NOHT":
+		return "NOHT";
+	}
+
+	if (substr(config.htmode, 2) == "40") {
+		switch (config.band) {
+		case "2g":
+			if (+config.channel < 7)
+				return "HT40+";
+			else
+				return "HT40-";
+		default:
+			return ((+config.channel / 4) % 2) ? "HT40+" : "HT40-";
+		}
+	}
+
+	return null;
+}
+
+function config_add(config, name, val) {
+	if (val != null)
+		config[name] = val;
+}
+
+function config_add_mesh_params(config, data) {
+	for (let param in mesh_param_list)
+		config_add(config, param, data[param]);
+}
+
+function setup() {
+	let data = json(ARGV[3]);
+
+	data.phy = find_phy(data.config, true);
+	if (!data.phy) {
+		log('Bug: PHY is undefined for device');
+		netifd.set_retry(false);
+		return 1;
+	}
+	data.phy_suffix = phy_suffix(data.config.radio, ":");
+	data.vif_phy_suffix = phy_suffix(data.config.radio, ".");
+	data.ifname_prefix = data.config.ifname_prefix;
+	if (!data.ifname_prefix)
+		data.ifname_prefix = data.phy + data.vif_phy_suffix + "-";
+	let active_ifnames = [];
+
+	log('Starting');
+
+	let config = data.config;
+
+	if (!config.band) {
+		switch (config.hwmode) {
+		case 'a':
+		case '11a':
+			config.band = '5g';
+			break;
+		case 'ad':
+		case '11ad':
+			config.band = '60g';
+			break;
+		case 'b':
+		case 'g':
+		case '11b':
+		case '11g':
+		default:
+			config.band = '2g';
+			break;
+		}
+	}
+	delete config.hwmode;
+
+	validate('device', config);
+	setup_phy(data.phy, data.config, data.data);
+
+	let supplicant_mesh;
+	let has_ap = false;
+	let idx = {};
+	let supplicant_data = [];
+	let wdev_data = {};
+
+	for (let k, v in data.interfaces) {
+		let mode = v.config.mode;
+		idx[mode] ??= 0;
+		let mode_idx = idx[mode]++;
+
+		if (!v.config.ifname) 
+			v.config.ifname = data.ifname_prefix + mode + mode_idx;
+		push(active_ifnames, v.config.ifname);
+
+		if (v.config.encryption == 'owe' && v.config.owe_transition) {
+			mode_idx = idx[mode]++;
+			v.config.owe_transition_ifname = data.ifname_prefix + mode + mode_idx;
+			push(active_ifnames, v.config.ifname);
+		}
+
+		switch (mode) {
+		case 'ap':
+			has_ap = true;
+			for (let _, sta in v.stas)
+				validate('station', sta.config);
+			// fallthrough
+		case 'sta':
+		case 'adhoc':
+		case 'mesh':
+			if (mode != "ap")
+				data.config.noscan = true;
+			validate('iface', v.config);
+			iface.prepare(v.config, data.phy + data.phy_suffix, data.config.num_global_macaddr, data.config.macaddr_base);
+			netifd.set_vif(k, v.config.ifname);
+			break;
+		}
+
+		switch (mode) {
+		case 'adhoc':
+			if (config.frequency && !v.config.wpa)
+				break;
+			// fallthrough
+		case 'mesh':
+			supplicant_mesh ??= !system("wpa_supplicant -vmesh");
+			if (mode == "mesh" && !supplicant_mesh)
+				break;
+			// fallthrough
+		case 'sta':
+			data.ap_start_disabled = true;
+			let config = supplicant.generate(supplicant_data, data, v);
+			if (mode == "mesh")
+				config_add_mesh_params(config, v.config);
+			continue;
+		case 'monitor':
+			break;
+		default:
+			continue;
+		}
+
+		// fallback to wdev setup
+		let config = {
+			mode,
+			ssid: v.config.ssid,
+		};
+
+		if (!v.config.default_macaddr)
+			config.macaddr = v.config.macaddr;
+
+		config_add(config, "freq", data.config.frequency);
+		config_add(config, "htmode", iw_htmode(data.config));
+		if (mode != "monitor") {
+			let basic_rate_list = v.config.basic_rate ?? data.config.basic_rate;
+			config_add(config, "basic-rates", supplicant.ratelist(basic_rate_list));
+			config_add(config, "mcast-rate", supplicant.ratestr(v.config.mcast_rate));
+			config_add(config, "beacon-interval", data.config.beacon_int);
+			if (mode == "adhoc")
+				config_add(config, "bssid", v.config.bssid);
+			if (mode == "mesh") {
+				config_add(config, "ssid", v.config.mesh_id);
+				config_add_mesh_params(config, v.config);
+			}
+		}
+
+		wdev_data[v.config.ifname] = config;
+	}
+
+	for (let ifname in active_ifnames) {
+		if (!wdev_data[ifname])
+			continue;
+
+		let if_config = {
+			[ifname]: wdev_data[ifname]
+		};
+		system(`ucode /usr/share/hostap/wdev.uc ${data.phy}${data.phy_suffix} set_config '${if_config}'`);
+	}
+
+	if (fs.access('/usr/sbin/wpa_supplicant', 'x'))
+		supplicant.setup(supplicant_data, data);
+
+	if (fs.access('/usr/sbin/hostapd', 'x'))
+		hostapd.setup(data);
+
+	if (length(supplicant_data) > 0)
+		supplicant.start(data);
+
+	netifd.set_up();
+
+	return 0
+}
+
+function teardown() {
+	let data = json(ARGV[3]);
+
+	if (ARGV[2] == "#mlo")
+		return 0;
+
+	if (!data.data?.phy) {
+		log('Bug: PHY is undefined for device');
+		return 1;
+	}
+
+	log(`Tearing down ${data.data.phy}`);
+
+	reset_config(data.data.phy, data.data.radio);
+
+	return 0;
+}
+
+let ret = 1;
+
+switch(ARGV[1]) {
+case 'dump':
+	ret = dump_options();
+	break;
+
+case 'setup':
+	ret = setup();
+	break;
+
+case 'teardown':
+	ret = teardown();
+	break;
+}
+
+exit(ret);
diff --git a/wireless-scripts-example/vanila/netifd-wireless.sh b/wireless-scripts-example/vanila/netifd-wireless.sh
new file mode 100644
index 0000000000..328fede2a9
--- /dev/null
+++ b/wireless-scripts-example/vanila/netifd-wireless.sh
@@ -0,0 +1,455 @@
+NETIFD_MAIN_DIR="${NETIFD_MAIN_DIR:-/lib/netifd}"
+
+. /usr/share/libubox/jshn.sh
+. $NETIFD_MAIN_DIR/utils.sh
+
+CMD_UP=0
+CMD_SET_DATA=1
+CMD_PROCESS_ADD=2
+CMD_PROCESS_KILL_ALL=3
+CMD_SET_RETRY=4
+
+add_driver() {
+	return
+}
+
+wireless_setup_vif_failed() {
+	local error="$1"
+	echo "Interface $_w_iface setup failed: $error"
+}
+
+wireless_setup_failed() {
+	local error="$1"
+
+	echo "Device setup failed: $error"
+	wireless_set_retry 0
+}
+
+prepare_key_wep() {
+	local key="$1"
+	local hex=1
+
+	echo -n "$key" | grep -qE "[^a-fA-F0-9]" && hex=0
+	[ "${#key}" -eq 10 -a $hex -eq 1 ] || \
+	[ "${#key}" -eq 26 -a $hex -eq 1 ] || {
+		[ "${key:0:2}" = "s:" ] && key="${key#s:}"
+		key="$(echo -n "$key" | hexdump -ve '1/1 "%02x" ""')"
+	}
+	echo "$key"
+}
+
+_wdev_prepare_channel() {
+	json_get_vars channel band hwmode htmode
+
+	auto_channel=0
+	enable_ht=0
+	hwmode="${hwmode##11}"
+
+	case "$channel" in
+		""|0|auto)
+			channel=0
+			auto_channel=1
+		;;
+		[0-9]*) ;;
+		*)
+			wireless_setup_failed "INVALID_CHANNEL"
+		;;
+	esac
+
+	case "$hwmode" in
+		a|b|g|ad) ;;
+		*)
+			if [ "$channel" -gt 14 ]; then
+				hwmode=a
+			else
+				hwmode=g
+			fi
+		;;
+	esac
+
+	case "$band" in
+		2g) hwmode=g;;
+		5g|6g) hwmode=a;;
+		60g) hwmode=ad;;
+		*)
+			case "$hwmode" in
+				*a) band=5g;;
+				*ad) band=60g;;
+				*b|*g) band=2g;;
+			esac
+		;;
+	esac
+
+	case "$htmode" in
+		HE*|EHT*) wpa3_cipher="GCMP-256 ";;
+		*) wpa3_cipher="";;
+	esac
+}
+
+_wdev_handler() {
+	json_load "$data"
+
+	json_select config
+	_wdev_prepare_channel
+	json_select ..
+
+	eval "drv_$1_$2 \"$interface\""
+}
+
+_wdev_msg_call() {
+	local old_cb
+
+	json_set_namespace wdev old_cb
+	"$@"
+	json_set_namespace $old_cb
+}
+
+_wdev_wrapper() {
+	while [ -n "$1" ]; do
+		eval "$1() { _wdev_msg_call _$1 \"\$@\"; }"
+		shift
+	done
+}
+
+_wdev_notify_init() {
+	local command="$1"; shift;
+
+	json_init
+	json_add_int "command" "$command"
+	json_add_string "device" "$__netifd_device"
+	while [ -n "$1" ]; do
+		local name="$1"; shift
+		local value="$1"; shift
+		json_add_string "$name" "$value"
+	done
+	json_add_object "data"
+}
+
+_wdev_notify() {
+	local options="$1"
+
+	json_close_object
+	ubus $options call network.wireless notify "$(json_dump)"
+}
+
+_wdev_add_variables() {
+	while [ -n "$1" ]; do
+		local var="${1%%=*}"
+		local val="$1"
+		shift
+		[[ "$var" = "$val" ]] && continue
+		val="${val#*=}"
+		json_add_string "$var" "$val"
+	done
+}
+
+_wireless_add_vif() {
+	local name="$1"; shift
+	local ifname="$1"; shift
+
+	_wdev_notify_init $CMD_SET_DATA "interface" "$name"
+	json_add_string "ifname" "$ifname"
+	_wdev_add_variables "$@"
+	_wdev_notify
+}
+
+_wireless_add_vlan() {
+	local name="$1"; shift
+	local ifname="$1"; shift
+
+	_wdev_notify_init $CMD_SET_DATA interface "$__cur_interface" "vlan" "$name"
+	json_add_string "ifname" "$ifname"
+	_wdev_add_variables "$@"
+	_wdev_notify
+}
+
+_wireless_set_up() {
+	_wdev_notify_init $CMD_UP
+	_wdev_notify
+}
+
+_wireless_set_data() {
+	_wdev_notify_init $CMD_SET_DATA
+	_wdev_add_variables "$@"
+	_wdev_notify
+}
+
+_wireless_add_process() {
+	_wdev_notify_init $CMD_PROCESS_ADD
+	local exe="$2"
+	[ -L "$exe" ] && exe="$(readlink -f "$exe")"
+	json_add_int pid "$1"
+	json_add_string exe "$exe"
+	[ -n "$3" ] && json_add_boolean required 1
+	[ -n "$4" ] && json_add_boolean keep 1
+	exe2="$(readlink -f /proc/$1/exe)"
+	[ "$exe" != "$exe2" ] && echo "WARNING (wireless_add_process): executable path $exe does not match process $1 path ($exe2)"
+	_wdev_notify
+}
+
+_wireless_process_kill_all() {
+	_wdev_notify_init $CMD_PROCESS_KILL_ALL
+	[ -n "$1" ] && json_add_int signal "$1"
+	_wdev_notify
+}
+
+_wireless_set_retry() {
+	_wdev_notify_init $CMD_SET_RETRY
+	json_add_int retry "$1"
+	_wdev_notify
+}
+
+_wdev_wrapper \
+	wireless_add_vif \
+	wireless_add_vlan \
+	wireless_set_up \
+	wireless_set_data \
+	wireless_add_process \
+	wireless_process_kill_all \
+	wireless_set_retry \
+
+wireless_vif_parse_encryption() {
+	json_get_vars encryption rsn_override
+	set_default encryption none
+
+	set_default rsn_override 1
+	auth_mode_open=1
+	auth_mode_shared=0
+	auth_type=none
+	wpa_override_cipher=
+	rsn_override_pairwise=
+
+	if [ "$hwmode" = "ad" ]; then
+		wpa_cipher="GCMP"
+	else
+		wpa_cipher="CCMP"
+		case "$encryption" in
+			sae*|wpa3*|psk3*|owe)
+				if [ "$rsn_override" -gt 0 ]; then
+					wpa_override_cipher="${wpa3_cipher}$wpa_cipher"
+				else
+					wpa_cipher="${wpa3_cipher}$wpa_cipher"
+				fi
+			;;
+		esac
+	fi
+
+	case "$encryption" in
+		*tkip+aes|*tkip+ccmp|*aes+tkip|*ccmp+tkip) wpa_cipher="CCMP TKIP";;
+		*ccmp256) wpa_cipher="CCMP-256";;
+		*aes|*ccmp) wpa_cipher="CCMP";;
+		*tkip) wpa_cipher="TKIP";;
+		*gcmp256) wpa_cipher="GCMP-256";;
+		*gcmp) wpa_cipher="GCMP";;
+		wpa3-192*) wpa_cipher="GCMP-256";;
+		*) rsn_override_pairwise="$wpa_override_cipher";;
+	esac
+
+	# 802.11n requires CCMP for WPA
+	[ "$enable_ht:$wpa_cipher" = "1:TKIP" ] && wpa_cipher="CCMP TKIP"
+
+	# Examples:
+	# psk-mixed/tkip    => WPA1+2 PSK, TKIP
+	# wpa-psk2/tkip+aes => WPA2 PSK, CCMP+TKIP
+	# wpa2/tkip+aes     => WPA2 RADIUS, CCMP+TKIP
+
+	case "$encryption" in
+		wpa2*|wpa3*|*psk2*|psk3*|sae*|owe*|dpp)
+			wpa=2
+		;;
+		wpa*mixed*|*psk*mixed*)
+			wpa=3
+		;;
+		wpa*|*psk*)
+			wpa=1
+		;;
+		*)
+			wpa=0
+			wpa_cipher=
+		;;
+	esac
+	wpa_pairwise="$wpa_cipher"
+
+	case "$encryption" in
+		owe*)
+			auth_type=owe
+		;;
+		dpp)
+			auth_type=dpp
+		;;
+		wpa3-192*)
+			auth_type=eap192
+		;;
+		wpa3-mixed*)
+			auth_type=eap-eap2
+		;;
+		wpa3*)
+			auth_type=eap2
+		;;
+		psk3-mixed*|sae-mixed*)
+			auth_type=psk-sae
+		;;
+		psk3*|sae*)
+			auth_type=sae
+		;;
+		*psk*)
+			auth_type=psk
+		;;
+		*wpa*|*8021x*)
+			auth_type=eap
+		;;
+		*wep*)
+			auth_type=wep
+			case "$encryption" in
+				*shared*)
+					auth_mode_open=0
+					auth_mode_shared=1
+				;;
+				*mixed*)
+					auth_mode_shared=1
+				;;
+			esac
+		;;
+	esac
+}
+
+_wireless_set_brsnoop_isolation() {
+	local multicast_to_unicast="$1"
+	local isolate
+
+	json_get_vars isolate proxy_arp
+
+	[ ${isolate:-0} -gt 0 -o -z "$network_bridge" ] && return
+	[ ${multicast_to_unicast:-1} -gt 0 -o ${proxy_arp:-0} -gt 0 ] && json_add_boolean isolate 1
+}
+
+for_each_interface() {
+	local _w_types="$1"; shift
+	local _w_ifaces _w_iface
+	local _w_type
+	local _w_found
+
+	local multicast_to_unicast
+
+	json_get_keys _w_ifaces interfaces
+	json_select interfaces
+	for _w_iface in $_w_ifaces; do
+		json_select "$_w_iface"
+		if [ -n "$_w_types" ]; then
+			json_get_var network_bridge bridge
+			json_get_var network_ifname bridge-ifname
+			json_get_var multicast_to_unicast multicast_to_unicast
+			json_select config
+			_wireless_set_brsnoop_isolation "$multicast_to_unicast"
+			json_get_var _w_type mode
+			json_select ..
+			_w_types=" $_w_types "
+			[[ "${_w_types%$_w_type*}" = "$_w_types" ]] && {
+				json_select ..
+				continue
+			}
+		fi
+		__cur_interface="$_w_iface"
+		"$@" "$_w_iface"
+		json_select ..
+	done
+	json_select ..
+}
+
+for_each_vlan() {
+	local _w_vlans _w_vlan
+
+	json_get_keys _w_vlans vlans
+	json_select vlans
+	for _w_vlan in $_w_vlans; do
+		json_select "$_w_vlan"
+		json_select config
+		"$@" "$_w_vlan"
+		json_select ..
+		json_select ..
+	done
+	json_select ..
+}
+
+for_each_station() {
+	local _w_stas _w_sta
+
+	json_get_keys _w_stas stas
+	json_select stas
+	for _w_sta in $_w_stas; do
+		json_select "$_w_sta"
+		json_select config
+		"$@" "$_w_sta"
+		json_select ..
+		json_select ..
+	done
+	json_select ..
+}
+
+_wdev_common_device_config() {
+	config_add_string channel hwmode band htmode noscan
+}
+
+_wdev_common_iface_config() {
+	config_add_string mode ssid encryption 'key:wpakey'
+	config_add_boolean bridge_isolate
+	config_add_array tags
+}
+
+_wdev_common_vlan_config() {
+	config_add_string name vid iface
+	config_add_boolean bridge_isolate
+}
+
+_wdev_common_station_config() {
+	config_add_string key vid iface
+	config_add_array mac
+}
+
+init_wireless_driver() {
+	name="$1"; shift
+	cmd="$1"; shift
+
+	case "$cmd" in
+		dump)
+			add_driver() {
+				eval "drv_$1_cleanup"
+
+				json_init
+				json_add_string name "$1"
+
+				json_add_array device
+				_wdev_common_device_config
+				eval "drv_$1_init_device_config"
+				json_close_array
+
+				json_add_array iface
+				_wdev_common_iface_config
+				eval "drv_$1_init_iface_config"
+				json_close_array
+
+				json_add_array vlan
+				_wdev_common_vlan_config
+				eval "drv_$1_init_vlan_config"
+				json_close_array
+
+				json_add_array station
+				_wdev_common_station_config
+				eval "drv_$1_init_station_config"
+				json_close_array
+
+				json_dump
+			}
+		;;
+		setup|teardown)
+			interface="$1"; shift
+			data="$1"; shift
+			export __netifd_device="$interface"
+
+			add_driver() {
+				[[ "$name" == "$1" ]] || return 0
+				_wdev_handler "$1" "$cmd"
+			}
+		;;
+	esac
+}
diff --git a/wireless-scripts-example/vanila/wdev.uc b/wireless-scripts-example/vanila/wdev.uc
new file mode 100644
index 0000000000..a4f9bf7b84
--- /dev/null
+++ b/wireless-scripts-example/vanila/wdev.uc
@@ -0,0 +1,188 @@
+#!/usr/bin/env ucode
+'use strict';
+import { vlist_new, is_equal, wdev_set_mesh_params, wdev_remove, wdev_set_up, phy_open } from "/usr/share/hostap/common.uc";
+import { readfile, writefile, basename, readlink, glob } from "fs";
+let libubus = require("ubus");
+
+let keep_devices = {};
+let phy_name = shift(ARGV);
+let command = shift(ARGV);
+let phy, phydev;
+
+function iface_stop(wdev)
+{
+	if (keep_devices[wdev.ifname])
+		return;
+
+	wdev_remove(wdev.ifname);
+}
+
+function iface_start(wdev)
+{
+	let ifname = wdev.ifname;
+
+	if (readfile(`/sys/class/net/${ifname}/ifindex`)) {
+		wdev_set_up(ifname, false);
+		wdev_remove(ifname);
+	}
+	let wdev_config = {};
+	for (let key in wdev)
+		wdev_config[key] = wdev[key];
+	if (!wdev_config.macaddr && wdev.mode != "monitor")
+		wdev_config.macaddr = phydev.macaddr_next();
+	phydev.wdev_add(ifname, wdev_config);
+	wdev_set_up(ifname, true);
+	let htmode = wdev.htmode || "NOHT";
+	if (wdev.freq)
+		system(`iw dev ${ifname} set freq ${wdev.freq} ${htmode}`);
+	if (wdev.mode == "adhoc") {
+		let cmd = ["iw", "dev", ifname, "ibss", "join", wdev.ssid, wdev.freq, htmode, "fixed-freq" ];
+		if (wdev.bssid)
+			push(cmd, wdev.bssid);
+		for (let key in [ "beacon-interval", "basic-rates", "mcast-rate", "keys" ])
+			if (wdev[key])
+				push(cmd, key, wdev[key]);
+		system(cmd);
+	} else if (wdev.mode == "mesh") {
+		let cmd = [ "iw", "dev", ifname, "mesh", "join", wdev.ssid ];
+		if (wdev.freq) {
+			push(cmd, "freq", wdev.freq);
+			if (htmode && htmode != "NOHT")
+				push(cmd, htmode);
+		}
+		for (let key in [ "basic-rates", "mcast-rate", "beacon-interval" ])
+			if (wdev[key])
+				push(cmd, key, wdev[key]);
+		system(cmd);
+
+		wdev_set_mesh_params(ifname, wdev);
+	}
+}
+
+function iface_cb(new_if, old_if)
+{
+	if (old_if && new_if && is_equal(old_if, new_if))
+		return;
+
+	if (old_if)
+		iface_stop(old_if);
+	if (new_if)
+		iface_start(new_if);
+}
+
+function drop_inactive(config)
+{
+	for (let key in config) {
+		if (!readfile(`/sys/class/net/${key}/ifindex`))
+			delete config[key];
+	}
+}
+
+function add_ifname(config)
+{
+	for (let key in config)
+		config[key].ifname = key;
+}
+
+function delete_ifname(config)
+{
+	for (let key in config)
+		delete config[key].ifname;
+}
+
+function add_existing(phydev, config)
+{
+	phydev.for_each_wdev((wdev) => {
+		if (config[wdev])
+			return;
+
+		if (trim(readfile(`/sys/class/net/${wdev}/operstate`)) == "down")
+			config[wdev] = {};
+	});
+}
+
+function usage()
+{
+	warn(`Usage: ${basename(sourcepath())} <phy> <command> [<arguments>]
+
+Commands:
+	set_config <config> [<device]...] - set phy configuration
+	get_macaddr <id>		  - get phy MAC address for vif index <id>
+`);
+	exit(1);
+}
+
+const commands = {
+	set_config: function(args) {
+		let statefile = `/var/run/wdev-${phy_name}.json`;
+
+		let new_config = shift(args);
+		for (let dev in ARGV)
+			keep_devices[dev] = true;
+
+		if (!new_config)
+			usage();
+
+		new_config = json(new_config);
+		if (!new_config) {
+			warn("Invalid configuration\n");
+			exit(1);
+		}
+
+		let old_config = readfile(statefile);
+		if (old_config)
+			old_config = json(old_config);
+
+		let config = vlist_new(iface_cb);
+		if (type(old_config) == "object")
+			config.data = old_config;
+
+		add_existing(phydev, config.data);
+		add_ifname(config.data);
+		drop_inactive(config.data);
+
+		let ubus = libubus.connect();
+		let data = ubus.call("hostapd", "config_get_macaddr_list", { phy: phydev.name, radio: phydev.radio ?? -1 });
+		let macaddr_list = [];
+		if (type(data) == "object" && data.macaddr)
+			macaddr_list = data.macaddr;
+		ubus.disconnect();
+		phydev.macaddr_init(macaddr_list);
+
+		add_ifname(new_config);
+		config.update(new_config);
+
+		drop_inactive(config.data);
+		delete_ifname(config.data);
+		writefile(statefile, sprintf("%J", config.data));
+	},
+	get_macaddr: function(args) {
+		let data = {};
+
+		for (let arg in args) {
+			arg = split(arg, "=", 2);
+			data[arg[0]] = arg[1];
+		}
+
+		let macaddr = phydev.macaddr_generate(data);
+		if (!macaddr) {
+			warn(`Could not get MAC address for phy ${phy_name}\n`);
+			exit(1);
+		}
+
+		print(macaddr + "\n");
+	},
+};
+
+if (!phy_name || !command | !commands[command])
+	usage();
+
+let phy_split = split(phy_name, ":");
+phydev = phy_open(phy_split[0], phy_split[1]);
+phy = phydev.phy;
+if (!phydev) {
+	warn(`PHY ${phy_name} does not exist\n`);
+	exit(1);
+}
+
+commands[command](ARGV);
diff --git a/wireless-scripts-example/vanila/wifi-detect.uc b/wireless-scripts-example/vanila/wifi-detect.uc
new file mode 100644
index 0000000000..db862d40c2
--- /dev/null
+++ b/wireless-scripts-example/vanila/wifi-detect.uc
@@ -0,0 +1,260 @@
+#!/usr/bin/env ucode
+'use strict';
+import { readfile, writefile, realpath, glob, basename, unlink, open, rename } from "fs";
+import { is_equal } from "/usr/share/hostap/common.uc";
+let nl = require("nl80211");
+
+let board_file = "/etc/board.json";
+let prev_board_data = json(readfile(board_file));
+let board_data = json(readfile(board_file));
+
+function phy_idx(name) {
+	return +rtrim(readfile(`/sys/class/ieee80211/${name}/index`));
+}
+
+function phy_path(name) {
+	let devpath = realpath(`/sys/class/ieee80211/${name}/device`);
+
+	devpath = replace(devpath, /^\/sys\/devices\//, "");
+	if (match(devpath, /^platform\/.*\/pci/))
+		devpath = replace(devpath, /^platform\//, "");
+	let dev_phys = map(glob(`/sys/class/ieee80211/${name}/device/ieee80211/*`), basename);
+	sort(dev_phys, (a, b) => phy_idx(a) - phy_idx(b));
+
+	let ofs = index(dev_phys, name);
+	if (ofs > 0)
+		devpath += `+${ofs}`;
+
+	return devpath;
+}
+
+function cleanup() {
+	let wlan = board_data.wlan;
+
+	for (let name in wlan)
+		if (substr(name, 0, 3) == "phy")
+			delete wlan[name];
+		else
+			delete wlan[name].info;
+}
+
+function wiphy_get_entry(phy, path) {
+	board_data.wlan ??= {};
+
+	let wlan = board_data.wlan;
+	for (let name in wlan)
+		if (wlan[name].path == path)
+			return wlan[name];
+
+	wlan[phy] = {
+		path: path
+	};
+
+	return wlan[phy];
+}
+
+function freq_to_channel(freq) {
+	if (freq < 1000)
+		return 0;
+	if (freq == 2484)
+		return 14;
+	if (freq == 5935)
+		return 2;
+	if (freq < 2484)
+		return (freq - 2407) / 5;
+	if (freq >= 4910 && freq <= 4980)
+		return (freq - 4000) / 5;
+	if (freq < 5950)
+		return (freq - 5000) / 5;
+	if (freq <= 45000)
+		return (freq - 5950) / 5;
+	if (freq >= 58320 && freq <= 70200)
+		return (freq - 56160) / 2160;
+	return 0;
+}
+
+function freq_range_match(ranges, freq) {
+	freq *= 1000;
+	for (let range in ranges) {
+		if (freq >= range[0] && freq <= range[1])
+			return true;
+	}
+	return false;
+}
+
+function wiphy_detect() {
+	let phys = nl.request(nl.const.NL80211_CMD_GET_WIPHY, nl.const.NLM_F_DUMP, { split_wiphy_dump: true });
+	if (!phys)
+		return;
+
+	for (let phy in phys) {
+		if (!phy)
+			continue;
+
+		let name = phy.wiphy_name;
+		let path = phy_path(name);
+		let info = {
+			antenna_rx: phy.wiphy_antenna_avail_rx,
+			antenna_tx: phy.wiphy_antenna_avail_tx,
+			bands: {},
+			radios: []
+		};
+
+		for (let radio in phy.radios) {
+			// S1G is not supported yet
+			radio.freq_ranges = filter(radio.freq_ranges,
+				(range) => range.end > 2000000
+			);
+
+			if (!length(radio.freq_ranges))
+				continue;
+
+			push(info.radios, {
+				index: radio.index,
+				freq_ranges: map(radio.freq_ranges,
+					(range) => [ range.start, range.end ]
+				),
+				bands: {}
+			});
+		}
+
+		let bands = info.bands;
+		for (let band in phy.wiphy_bands) {
+			if (!band || !band.freqs)
+				continue;
+			let freq = band.freqs[0].freq;
+			let band_info = {};
+			let band_name;
+			if (freq > 50000)
+				band_name = "60G";
+			else if (freq > 5900)
+				band_name = "6G";
+			else if (freq > 4000)
+				band_name = "5G";
+			else if (freq > 2000)
+				band_name = "2G";
+			else
+				continue;
+			bands[band_name] = band_info;
+			if (band.ht_capa > 0)
+				band_info.ht = true;
+			if (band.vht_capa > 0)
+				band_info.vht = true;
+			let he_phy_cap = 0;
+			let eht_phy_cap = 0;
+
+			for (let ift in band.iftype_data) {
+				if (!ift.he_cap_phy)
+					continue;
+
+				band_info.he = true;
+				he_phy_cap |= ift.he_cap_phy[0];
+
+				if (!ift.eht_cap_phy)
+					continue;
+
+				band_info.eht = true;
+				eht_phy_cap |= ift.eht_cap_phy[0];
+			}
+
+			if (band_name != "2G" &&
+			    (he_phy_cap & 0x18) || ((band.vht_capa >> 2) & 0x3))
+				band_info.max_width = 160;
+			else if (band_name != "2G" &&
+			         (he_phy_cap & 4) || band.vht_capa > 0)
+				band_info.max_width = 80;
+			else if ((band.ht_capa & 0x2) || (he_phy_cap & 0x2))
+				band_info.max_width = 40;
+			else
+				band_info.max_width = 20;
+
+			let modes = band_info.modes = [ "NOHT" ];
+			if (band_info.ht)
+				push(modes, "HT20");
+			if (band_info.vht)
+				push(modes, "VHT20");
+			if (band_info.he)
+				push(modes, "HE20");
+			if (band_info.eht)
+				push(modes, "EHT20");
+			if (band.ht_capa & 0x2) {
+				push(modes, "HT40");
+				if (band_info.vht)
+					push(modes, "VHT40")
+			}
+			if (he_phy_cap & 2)
+				push(modes, "HE40");
+
+			if (eht_phy_cap && he_phy_cap & 2)
+				push(modes, "EHT40");
+
+			for (let radio in info.radios) {
+				let freq_match = filter(band.freqs,
+					(freq) => freq_range_match(radio.freq_ranges, freq.freq)
+				);
+				if (!length(freq_match))
+					continue;
+
+				let radio_band = {};
+				radio.bands[band_name] = radio_band;
+
+				freq_match = filter(freq_match,
+					(freq) => !freq.disabled
+				);
+
+				let freq = freq_match[0];
+				if (freq)
+					radio_band.default_channel = freq_to_channel(freq.freq);
+			}
+
+			for (let freq in band.freqs) {
+				if (freq.disabled)
+					continue;
+				let chan = freq_to_channel(freq.freq);
+				if (!chan)
+					continue;
+				band_info.default_channel = chan;
+				break;
+			}
+
+			if (band_name == "2G")
+				continue;
+
+			if (he_phy_cap & 4)
+				push(modes, "HE40");
+			if (eht_phy_cap && he_phy_cap & 4)
+				push(modes, "EHT40");
+			if (band_info.vht)
+				push(modes, "VHT80");
+			if (he_phy_cap & 4)
+				push(modes, "HE80");
+			if (eht_phy_cap && he_phy_cap & 4)
+				push(modes, "EHT80");
+			if ((band.vht_capa >> 2) & 0x3)
+				push(modes, "VHT160");
+			if (he_phy_cap & 0x18)
+				push(modes, "HE160");
+			if (eht_phy_cap && he_phy_cap & 0x18)
+				push(modes, "EHT160");
+
+			if (eht_phy_cap & 2)
+				push(modes, "EHT320");
+		}
+
+		let entry = wiphy_get_entry(name, path);
+		entry.info = info;
+	}
+}
+
+cleanup();
+wiphy_detect();
+if (!is_equal(prev_board_data, board_data)) {
+	let new_file = board_file + ".new";
+	unlink(new_file);
+	let f = open(new_file, "wx");
+	if (!f)
+		exit(1);
+	f.write(sprintf("%.J\n", board_data));
+	f.close();
+	rename(new_file, board_file);
+}
diff --git a/wireless-scripts-example/vanila/wireless-device.uc b/wireless-scripts-example/vanila/wireless-device.uc
new file mode 100644
index 0000000000..768a421480
--- /dev/null
+++ b/wireless-scripts-example/vanila/wireless-device.uc
@@ -0,0 +1,657 @@
+'use strict';
+import * as ubus from "ubus";
+import * as uloop from "uloop";
+import { is_equal } from "./utils.uc";
+import { access } from "fs";
+
+const NOTIFY_CMD_UP = 0;
+const NOTIFY_CMD_SET_DATA = 1;
+const NOTIFY_CMD_PROCESS_ADD = 2;
+const NOTIFY_CMD_SET_RETRY = 4;
+
+const DEFAULT_RETRY = 3;
+const DEFAULT_SCRIPT_TIMEOUT = 30 * 1000;
+
+let wdev_cur;
+let wdev_handler = {};
+let wdev_script_task, wdev_script_timeout;
+let handler_timer;
+
+function wireless_config_done()
+{
+	ubus.call({
+		object: "wpa_supplicant",
+		method: "mld_start",
+		return: "ignore",
+		data: { },
+	});
+
+	ubus.call({
+		object: "service",
+		method: "event",
+		return: "ignore",
+		data: {
+			type: "netifd.wireless.done",
+			data: {},
+		},
+	});
+}
+
+function delete_wdev(name)
+{
+	delete netifd.wireless.devices[name];
+	gc();
+}
+
+function handle_link(dev, data, up)
+{
+	let config = data.config;
+	let bridge_isolate;
+	let ap = false;
+	if (dev == data.ifname)
+		ap = data.type == "vlan" ||
+		     (data.type == "vif" && config.mode == "ap");
+
+	let dev_data = {
+		external: 2,
+		check_vlan: false,
+		isolate: !!config.bridge_isolate,
+		wireless: true,
+		wireless_ap: ap,
+	};
+
+	if (ap && config.multicast_to_unicast != null)
+		dev_data.multicast_to_unicast = config.multicast_to_unicast;
+
+	if (data.type == "vif" && config.mode == "ap") {
+		dev_data.wireless_proxyarp = !!config.proxy_arp;
+		dev_data.wireless_isolate = !!config.isolate;
+	}
+
+	if (up)
+		netifd.device_set(dev, dev_data);
+
+	for (let net in config.network)
+		netifd.interface_handle_link({
+			name: net,
+			ifname: dev,
+			vlan: config.network_vlan,
+			link_ext: true,
+			up,
+		});
+}
+
+function wdev_config_init(wdev)
+{
+	let data = wdev.data;
+	let config = data.config;
+	let interfaces = {};
+
+	let vif_idx = 0;
+	for (let vif in data.vif) {
+		let vlan_idx = 0, sta_idx = 0;
+		let vlans = {}, stas = {};
+
+		if (wdev.disabled_vifs[vif.name])
+			continue;
+		for (let vlan in vif.vlan) {
+			let vlan_name = sprintf("%02d", ++vlan_idx);
+			let cur_vlan = vlans[vlan_name] = {
+				name: vlan.name,
+				config: vlan.config,
+			};
+
+			if (wdev.disabled_vifs[vif.name])
+				continue;
+			for (let net in vlan.config.network)
+				if (netifd.interface_get_bridge(net, cur_vlan))
+					break;
+		}
+
+		for (let sta in vif.sta) {
+			let sta_name = sprintf("%02d", ++sta_idx);
+			stas[sta_name] = {
+				name: sta.name,
+				config: sta.config,
+			};
+		}
+
+		let vif_name = sprintf("%02d", ++vif_idx);
+		let iface = interfaces[vif_name] = {
+			name: vif.name,
+			config: vif.config,
+			vlans, stas,
+		};
+
+		for (let net in vif.config.network)
+			if (netifd.interface_get_bridge(net, iface))
+				break;
+	}
+
+	wdev.handler_config = {
+		config,
+		interfaces,
+	};
+
+	let prev = wdev.handler_data;
+	wdev.handler_data = {};
+
+	if (prev && prev[wdev.name])
+		wdev.handler_data[wdev.name] = prev[wdev.name];
+}
+
+function wdev_setup_cb(wdev)
+{
+	if (wdev.state != "setup") {
+		if (wdev.state == "up" && wdev.config_change) {
+			wdev_config_init(wdev);
+			wdev.setup();
+		}
+		return;
+	}
+
+	if (wdev.retry > 0)
+		wdev.retry--;
+	else
+		wdev.retry_setup_failed = true;
+
+	wdev.teardown();
+}
+
+function wdev_teardown_cb(wdev)
+{
+	for (let section, data in wdev.handler_data) {
+		if (data.ifname)
+			handle_link(data.ifname, data, false);
+	}
+
+	wdev.handler_data = {};
+	wdev.state = "down";
+
+	if (wdev.delete) {
+		delete_wdev(wdev.data.name);
+		return;
+	}
+
+	wdev.setup();
+}
+
+function run_handler_cb(wdev, cb)
+{
+	if (wdev != wdev_cur.wdev)
+		return;
+
+	wdev.dbg("complete " + wdev_cur.op);
+	if (wdev_script_timeout)
+		wdev_script_timeout.cancel();
+	wdev_script_timeout = null;
+	wdev_script_task = null;
+	wdev_cur = null;
+	handler_timer.set(1);
+	cb(wdev);
+}
+
+function run_handler_timeout(wdev, cb)
+{
+	wdev_script_task.cancel();
+	run_handler_cb(wdev, cb);
+}
+
+function handler_sort_fn(a, b)
+{
+	return wdev_handler[a].time - wdev_handler[b].time
+}
+
+function __run_next_handler_name()
+{
+	return sort(keys(wdev_handler), handler_sort_fn)[0];
+}
+
+function __run_next_handler()
+{
+	let name = __run_next_handler_name();
+	if (!name)
+		return;
+
+	wdev_cur = wdev_handler[name];
+	delete wdev_handler[name];
+
+	let wdev = wdev_cur.wdev;
+	let op = wdev_cur.op;
+	let cb = wdev_cur.cb;
+
+	wdev.dbg("run " + op);
+	wdev.handler_config.data = wdev.handler_data[wdev.name] ?? {};
+	wdev_script_task = netifd.process({
+		cb: () => run_handler_cb(wdev, cb),
+		dir: netifd.wireless.path,
+		argv: [ './' + wdev.script, wdev.data.config.type, op, wdev.name, "" + wdev.handler_config ],
+		log_prefix: wdev.name,
+	});
+
+	if (!wdev_script_task)
+		return run_handler_cb(wdev, cb);
+
+	wdev_script_timeout = uloop.timer(DEFAULT_SCRIPT_TIMEOUT,
+		() => run_handler_timeout(wdev, cb)
+	);
+}
+
+function run_next_handler()
+{
+	while (!wdev_cur && length(wdev_handler) > 0)
+		__run_next_handler();
+
+	if (!wdev_cur && !length(wdev_handler))
+		wireless_config_done();
+}
+
+function run_handler(wdev, op, cb)
+{
+	wdev.dbg("queue " + op);
+	wdev_handler[wdev.name] = {
+		op, wdev, cb,
+		time: time()
+	};
+
+	run_next_handler();
+}
+
+function wdev_proc_reset(wdev)
+{
+	if (wdev.proc_timer) {
+		wdev.proc_timer.cancel();
+		delete wdev.proc_timer;
+	}
+
+	wdev.procs = [];
+}
+
+function __wdev_proc_check(wdev, proc)
+{
+	if (netifd.process_check(proc.pid, proc.exe))
+		return;
+
+	wdev.dbg(`process ${proc.exe}(${proc.pid}) no longer active`);
+	wdev.teardown();
+	return true;
+}
+
+function wdev_proc_check(wdev)
+{
+	for (let proc in wdev.procs)
+		if (__wdev_proc_check(wdev, proc))
+			break;
+}
+
+function wdev_proc_add(wdev, data)
+{
+	if (!data.pid || !data.exe)
+		return;
+
+	push(wdev.procs, data);
+
+	if (!wdev.proc_timer)
+		wdev.proc_timer = uloop.interval(1000, () => wdev_proc_check(wdev));
+}
+
+
+function setup()
+{
+	if (this.state != "up" && this.state != "down")
+		return;
+
+	this.dbg("setup, state=" + this.state);
+	if (!this.autostart || this.retry_setup_failed)
+		return;
+
+	wdev_proc_reset(this);
+	delete this.config_change;
+	this.state = "setup";
+	run_handler(this, "setup", wdev_setup_cb);
+}
+
+function teardown()
+{
+	delete this.cancel_setup;
+
+	this.dbg("teardown, state=" + this.state);
+	if (this.state == "teardown" || this.state == "down")
+		return;
+
+	wdev_proc_reset(this);
+	this.state = "teardown";
+	run_handler(this, "teardown", wdev_teardown_cb);
+}
+
+function wdev_update_disabled_vifs(wdev)
+{
+	let cache = wdev.ifindex_cache;
+	let prev_disabled = wdev.disabled_vifs;
+	let disabled = wdev.disabled_vifs = {};
+	let changed;
+
+	let vifs = [];
+	for (let vif in wdev.data.vif)
+		push(vifs, vif, ...vif.vlan);
+
+	for (let vif in vifs) {
+		let enabled, ifindex;
+
+		for (let net in vif.config.network) {
+			let state = netifd.interface_get_enabled(net);
+			if (!state)
+				continue;
+
+			if (state.enabled)
+				enabled = true;
+			else if (enabled == null)
+				enabled = false;
+			if (state.ifindex)
+				ifindex = state.ifindex;
+		}
+
+		let name = vif.name;
+		if (enabled == false)
+			disabled[wdev] = true;
+		else if (ifindex != cache[name])
+			changed = true;
+
+		if (ifindex)
+			cache[name] = ifindex;
+		else
+			delete cache[name];
+	}
+
+	if (changed || !is_equal(prev_disabled, disabled))
+		wdev.config_change = true;
+
+	return wdev.config_change;
+}
+
+function wdev_reset(wdev)
+{
+	wdev.retry = DEFAULT_RETRY;
+	delete wdev.retry_setup_failed;
+}
+
+function update(data)
+{
+	if (is_equal(this.data, data))
+		return;
+
+	if (data) {
+		this.data = data;
+		this.ifindex_cache = {};
+		delete this.retry_setup_failed;
+		delete this.delete;
+	}
+
+	wdev_reset(this);
+	this.config_change = true;
+	this.check();
+}
+
+function start()
+{
+	if (this.delete)
+		return;
+
+	this.dbg("start, state=" + this.state);
+	this.autostart = true;
+
+	wdev_reset(this);
+
+	if (this.state != "down")
+		return;
+
+	if (wdev_update_disabled_vifs(this))
+		wdev_config_init(this);
+	this.setup();
+}
+
+
+function retry_setup()
+{
+	if (this.delete)
+		return;
+
+	if (this.state != "down" || !this.autostart)
+		return;
+
+	this.start();
+}
+
+
+function stop()
+{
+	this.dbg("stop, state=" + this.state);
+	this.autostart = false;
+
+	switch (this.state) {
+	case "setup":
+		this.cancel_setup = true;
+		break;
+	case "up":
+		this.teardown();
+		break;
+	}
+}
+
+function check()
+{
+	if (!wdev_update_disabled_vifs(this))
+		return;
+
+	wdev_config_init(this);
+	this.setup();
+}
+
+function wdev_mark_up(wdev)
+{
+	wdev.dbg("mark up, state=" + wdev.state);
+	if (wdev.state != "setup")
+		return;
+
+	for (let section, data in wdev.handler_data) {
+		if (data.ifname)
+			handle_link(data.ifname, data, true);
+	}
+	wdev.state = "up";
+
+	return 0;
+}
+
+function wdev_set_data(wdev, vif, vlan, data)
+{
+	let config = wdev.handler_config;
+	let cur = { name: wdev.name };
+	let cur_type = "device";
+	if (!config)
+		return ubus.STATUS_INVALID_ARGUMENT;
+
+	if (vif) {
+		cur = vif = config.interfaces[vif];
+		if (!vif)
+			return ubus.STATUS_NOT_FOUND;
+		cur_type = "vif";
+	}
+
+	if (vlan) {
+		if (!vif)
+			return ubus.STATUS_INVALID_ARGUMENT;
+
+		cur = vlan = vif.vlans[vlan];
+		if (!vlan)
+			return ubus.STATUS_NOT_FOUND;
+
+		cur_type = "vlan";
+	}
+
+	let key = cur.name;
+	if (cur_type == "vlan")
+		key = vif.name + "/" + vlan.name;
+
+	wdev.handler_data[key] = {
+		...cur,
+		...data,
+		type: cur_type,
+		config: cur.config,
+	};
+
+	return 0;
+}
+
+function notify(req)
+{
+	let vif = req.args.interface;
+	let vlan = req.args.vlan;
+	let data = req.args.data;
+
+	switch (req.args.command) {
+	case NOTIFY_CMD_UP:
+		if (vif || vlan || this.state != "setup")
+			return ubus.STATUS_INVALID_ARGUMENT;
+
+		return wdev_mark_up(this);
+	case NOTIFY_CMD_SET_DATA:
+		return wdev_set_data(this, vif, vlan, data);
+	case NOTIFY_CMD_PROCESS_ADD:
+		if (this.state != "setup" && this.state != "up")
+			return 0;
+
+		wdev_proc_add(this, data);
+		return 0;
+	case NOTIFY_CMD_SET_RETRY:
+		if (data.retry != null)
+			this.retry = data.retry;
+		else
+			this.retry = DEFAULT_RETRY;
+		return 0;
+	default:
+		return ubus.STATUS_INVALID_ARGUMENT;
+	}
+}
+
+function hotplug(name, add)
+{
+	let dev = name;
+	let m = match(name, /(.+)\.sta.+/);
+	if (m)
+		name = m[1];
+
+	for (let section, data in this.handler_data) {
+		if (data.ifname != name ||
+		    data.type != "vif" && data.type != "vlan")
+			continue;
+
+		handle_link(dev, data, add);
+	}
+}
+
+function get_status_data(wdev, vif, parent_vif)
+{
+	let key = vif.name;
+	if (parent_vif)
+		key = parent_vif.name + "/" + vif.name;
+
+	let hdata = wdev.handler_data[key];
+	let data = {
+		section: vif.name,
+		config: vif.config
+	};
+	if (hdata && hdata.ifname)
+		data.ifname = hdata.ifname;
+	return data;
+}
+
+function get_status_vlans(wdev, vif)
+{
+	let vlans = [];
+	for (let vlan in vif.vlan)
+		push(vlans, get_status_data(wdev, vlan, vif));
+	return vlans;
+}
+
+function get_status_stations(wdev, vif)
+{
+	let vlans = [];
+	for (let vlan in vif.sta)
+		push(vlans, get_status_data(wdev, vlan));
+	return vlans;
+}
+
+function status()
+{
+	let interfaces = [];
+	for (let vif in this.data.vif) {
+		let vlans = get_status_vlans(this, vif);
+		let stations = get_status_stations(this, vif);
+		let data = get_status_data(this, vif);
+		push(interfaces, {
+			...data,
+			vlans, stations
+		});
+	}
+	return {
+		up: this.state == "up",
+		pending: this.state == "setup" || this.state == "teardown",
+		autostart: this.autostart,
+		disabled: !!this.data.config.disabled,
+		retry_setup_failed: !!this.retry_setup_failed,
+		config: this.data.config,
+		interfaces
+	};
+}
+
+function destroy()
+{
+	this.dbg("destroy");
+	this.autostart = false;
+	this.delete = true;
+	if (this.state != "down") {
+		this.stop();
+		return;
+	}
+
+	delete_wdev(this.data.name);
+}
+
+function dbg(msg)
+{
+	netifd.log(netifd.L_DEBUG, `wireless: ${this.name}: ${msg}\n`);
+}
+
+const wdev_proto = {
+	update,
+	destroy,
+	retry_setup,
+	start,
+	stop,
+	setup,
+	status,
+	teardown,
+	check,
+	notify,
+	hotplug,
+	dbg,
+};
+
+export function new(data, script, driver)
+{
+	let wdev = {
+		name: data.name,
+		script, data,
+		procs: [],
+		vifs: {},
+		disabled_vifs: {},
+		ifindex_cache: {},
+
+		autostart: true,
+		state: "down",
+	};
+	wdev_update_disabled_vifs(wdev);
+	wdev_config_init(wdev);
+	handler_timer = uloop.timer(1, run_next_handler);
+	return proto(wdev, wdev_proto);
+};
diff --git a/wireless-scripts-example/vanila/wireless.uc b/wireless-scripts-example/vanila/wireless.uc
new file mode 100644
index 0000000000..fa2edbee12
--- /dev/null
+++ b/wireless-scripts-example/vanila/wireless.uc
@@ -0,0 +1,586 @@
+'use strict';
+
+import * as ubus from "ubus";
+import { realpath } from "fs";
+import {
+	handler_load, handler_attributes,
+	parse_attribute_list, parse_bool, parse_array,
+	TYPE_ARRAY, TYPE_STRING, TYPE_INT, TYPE_BOOL
+} from "./utils.uc";
+import { find_phy } from "wifi.utils";
+import * as wdev from "./wireless-device.uc";
+
+let wireless = netifd.wireless = {
+	handlers: {},
+	devices: {},
+	mlo: {},
+	path: realpath(netifd.main_path + "/wireless"),
+};
+
+function wpad_update_mlo(service, mode)
+{
+	let config = {};
+
+	for (let ifname, data in wireless.mlo) {
+		if (data.mode != mode)
+			continue;
+
+		data.phy = find_phy(data.radio_config[0], true);
+		if (!data.phy)
+			continue;
+
+		config[ifname] = data;
+	}
+
+	ubus.call({
+		object: service,
+		method: "mld_set",
+		return: "ignore",
+		data: { config },
+	});
+}
+
+function hostapd_update_mlo()
+{
+	wpad_update_mlo("hostapd", "ap");
+}
+
+function supplicant_update_mlo()
+{
+	wpad_update_mlo("wpa_supplicant", "sta");
+}
+
+function mlo_vif_create(config, radio_config, vif_idx, mlo_vifs)
+{
+	let mlo_config = { ...config };
+
+	if (config.wds)
+		mlo_config['4addr'] = config.wds;
+	mlo_config.radio_config = radio_config;
+
+	let ifname = config.ifname;
+	if (!ifname) {
+		let idx = vif_idx[config.mode] ?? 0;
+		vif_idx[config.mode] = idx + 1;
+		ifname = config.mode + "-mld" + idx;
+	}
+
+	mlo_vifs[ifname] = mlo_config;
+	return ifname;
+}
+
+function mlo_vif_macaddr(config, dev_names, dev_name)
+{
+	if (dev_name != dev_names[0])
+		delete config.macaddr;
+	if (!config.radio_macaddr)
+		return;
+
+	let idx = index(dev_names, dev_name);
+	let macaddr = idx >= 0 ? config.radio_macaddr[idx] : null;
+	if (macaddr)
+		config.macaddr = macaddr;
+}
+
+function update_config(new_devices, mlo_vifs)
+{
+	wireless.mlo = mlo_vifs;
+	hostapd_update_mlo();
+	supplicant_update_mlo();
+
+	for (let name, dev in wireless.devices)
+		if (!new_devices[name])
+			dev.destroy();
+
+	for (let name, dev in new_devices) {
+		let cur_dev = wireless.devices[name];
+		if (cur_dev) {
+			cur_dev.update(dev);
+			continue;
+		}
+
+		let handler = wireless.handlers[dev.config.type];
+		cur_dev = wdev.new(dev, handler.script);
+		if (!cur_dev)
+			continue;
+
+		wireless.devices[name] = cur_dev;
+	}
+}
+
+function config_init(uci)
+{
+	let config = uci.get_all("wireless");
+
+	let handlers = {};
+	let devices = {};
+	let vifs = {};
+	let mlo_vifs = {};
+
+	let sections = {
+		device: {},
+		iface: {},
+		vlan: {},
+		station: {},
+	};
+	let radio_idx = {};
+	let vif_idx = {};
+
+	for (let name, data in config) {
+		let type = data[".type"];
+		if (parse_bool(data.disabled) && type != "wifi-device")
+			continue;
+
+		if (substr(type, 0, 5) != "wifi-")
+			continue;
+
+		let list = sections[substr(type, 5)];
+		if (list)
+			list[name] = data;
+	}
+
+	for (let name, data in sections.device) {
+		if (!data.type)
+			continue;
+
+		let handler = wireless.handlers[data.type];
+		if (!handler)
+			continue;
+
+		if (data.radio != null)
+			radio_idx[name] = +data.radio;
+
+		let config = parse_attribute_list(data, handler.device);
+		devices[name] = {
+			name,
+			config,
+
+			vif: [],
+		};
+		handlers[name] = handler;
+	}
+
+	for (let name, data in sections.iface) {
+		let dev_names = parse_array(data.device);
+		let mlo_vif = parse_bool(data.mlo);
+		let radios = map(dev_names, (v) => radio_idx[v]);
+		radios = filter(radios, (v) => v != null);
+		let radio_config = map(dev_names, (v) => devices[v]?.config);
+		let ifname;
+		let mlo_created = false;
+
+		for (let dev_name in dev_names) {
+			let dev = devices[dev_name];
+			if (!dev || dev.config.disabled)
+				continue;
+
+			let handler = handlers[dev_name];
+			if (!handler)
+				continue;
+
+			let config = parse_attribute_list(data, handler.iface);
+			config.radios = radios;
+
+			if (mlo_vif && !mlo_created) {
+				ifname = mlo_vif_create(config, radio_config, vif_idx, mlo_vifs);
+				mlo_created = true;
+			}
+
+			if (ifname)
+				config.ifname = ifname;
+			mlo_vif_macaddr(config, dev_names, dev_name);
+
+			let vif = {
+				name, config,
+				device: dev_name,
+
+				vlan: [],
+				sta: [],
+			};
+			push(dev.vif, vif);
+
+			vifs[name] ??= [];
+			push(vifs[name], vif);
+		}
+	}
+
+	for (let name, data in sections.vlan) {
+		let ifaces = parse_array(data.iface);
+		for (let iface, iface_vifs in vifs) {
+			if (length(ifaces) && index(ifaces, iface) < 0)
+				continue;
+
+			for (let vif in iface_vifs) {
+				let dev = devices[vif.device];
+				let handler = handlers[vif.device];
+				if (!dev || !handler)
+					continue;
+
+				let config = parse_attribute_list(data, handler.vlan);
+
+				let vlan = {
+					name,
+					config
+				};
+				push(vif.vlan, vlan);
+			}
+		}
+	}
+
+	for (let name, data in sections.station) {
+		let ifaces = parse_array(data.iface);
+		for (let iface, iface_vifs in vifs) {
+			if (length(ifaces) && index(ifaces, iface) < 0)
+				continue;
+
+			for (let vif in iface_vifs) {
+				let dev = devices[vif.device];
+				let handler = handlers[vif.device];
+				if (!dev || !handler)
+					continue;
+
+				let config = parse_attribute_list(data, handler.station);
+
+				let sta = {
+					name,
+					config
+				};
+				push(vif.sta, sta);
+			}
+		}
+	}
+
+	let udata = ubus.call({
+		object: "service",
+		method: "get_data",
+		data: {
+			type: "wifi-device"
+		},
+	});
+	for (let svcname, svc in udata) {
+		for (let insname, ins in svc) {
+			for (let typename, data in ins) {
+				for (let radio, config in data) {
+					if (type(config) != "object")
+						continue;
+
+					let dev = devices[radio];
+					if (dev) {
+						dev.config = { ...dev.config, ...config };
+						continue;
+					}
+
+					let handler = wireless.handlers[config.type];
+					if (!handler)
+						continue;
+
+					dev = devices[radio] = {
+						name,
+						config,
+
+						vif: [],
+					};
+					handlers[radio] = handler;
+				}
+			}
+		}
+	}
+
+
+	udata = ubus.call({
+		object: "service",
+		method: "get_data",
+		data: {
+			type: "wifi-iface"
+		},
+	});
+
+	for (let svcname, svc in udata) {
+		for (let insname, ins in svc) {
+			for (let typename, data in ins) {
+				for (let radio, vifs in data) {
+					if (type(vifs) != "object")
+						continue;
+
+					for (let name, vif in vifs) {
+						let devs = vif.device;
+						if (type(devs) != "array")
+							devs = [ devs ];
+						let config = vif.config;
+						if (!config)
+							continue;
+
+						let mlo_vif = parse_bool(config.mlo);
+						let radios = map(devs, (v) => radio_idx[v]);
+						radios = filter(radios, (v) => v != null);
+						let radio_config = map(devs, (v) => devices[v]?.config);
+						radio_config = filter(radio_config, (v) => v != null);
+						let ifname;
+
+						if (mlo_vif) {
+							ifname = mlo_vif_create(config, radio_config, vif_idx, mlo_vifs);
+							mlo_vifs[ifname].radios = radios;
+						}
+
+						for (let device in devs) {
+							let dev = devices[device];
+							if (!dev)
+								continue;
+
+							let vif_config = ifname ? { ...config, ifname, radios } : config;
+							if (ifname)
+								mlo_vif_macaddr(vif_config, devs, device);
+
+							let vif_data = {
+								name, device, config: vif_config,
+								vlan: [],
+								sta: []
+							};
+							if (vif.vlans)
+								vif_data.vlans = vif.vlans;
+							if (vif.stations)
+								vif_data.sta = vif.stations;
+							push(dev.vif, vif_data);
+						}
+					}
+				}
+			}
+		}
+	}
+
+	update_config(devices, mlo_vifs);
+}
+
+function config_start()
+{
+	for (let name, dev in wireless.devices)
+		if (dev.autostart)
+			dev.start();
+
+}
+
+function check_interfaces()
+{
+	for (let name, dev in wireless.devices)
+		if (dev.autostart)
+			dev.check();
+}
+
+function hotplug(ifname, add)
+{
+	for (let name, dev in wireless.devices)
+		if (dev.autostart)
+			dev.hotplug(ifname, add);
+}
+
+const network_config_attr = {
+	network: TYPE_ARRAY,
+	network_vlan: TYPE_ARRAY,
+	bridge_isolate: TYPE_BOOL,
+	isolate: TYPE_BOOL,
+	proxy_arp: TYPE_BOOL,
+	multicast_to_unicast: TYPE_BOOL,
+};
+
+const default_config_attr = {
+	device: {
+		disabled: TYPE_BOOL,
+		type: TYPE_STRING,
+	},
+	iface: {
+		...network_config_attr,
+		device: TYPE_STRING,
+		mode: TYPE_STRING,
+		radio_macaddr: TYPE_ARRAY,
+	},
+	station: {
+		iface: TYPE_STRING,
+
+		mac: TYPE_STRING,
+		key: TYPE_STRING,
+		vid: TYPE_STRING,
+	},
+	vlan: {
+		...network_config_attr,
+		iface: TYPE_STRING,
+		name: TYPE_STRING,
+		vid: TYPE_STRING,
+	},
+};
+
+const wdev_args = {
+	device: ""
+};
+
+function wdev_call(req, cb)
+{
+	let dev = req.args.device;
+	if (dev) {
+		dev = wireless.devices[dev];
+		if (!dev)
+			return ubus.STATUS_NOT_FOUND;
+
+		return cb(dev);
+	}
+
+	for (let name, dev in wireless.devices)
+		cb(dev);
+
+	return 0;
+}
+
+function attr_validate(attr_type, validate)
+{
+	if (validate)
+		return validate;
+	switch (attr_type) {
+	case TYPE_STRING:
+		return "string";
+	case TYPE_ARRAY:
+		return "list(string)";
+	case TYPE_INT:
+		return "uinteger";
+	case TYPE_BOOL:
+		return "bool";
+	}
+}
+
+function get_validate_info(ret, handler)
+{
+	for (let kind in default_config_attr) {
+		let cur = ret[kind == "iface" ? "interface" : kind] = {};
+		let validate = handler[kind + "_validate"];
+
+		for (let attr, attr_type in handler[kind]) {
+			let val = attr_validate(attr_type, validate[attr]);
+			if (val != null)
+				cur[attr] = val;
+		}
+	}
+
+	return ret;
+}
+
+const ubus_obj = {
+	up: {
+		args: wdev_args,
+		call: function(req) {
+			hostapd_update_mlo();
+
+			return wdev_call(req, (dev) => {
+				dev.start();
+				return 0;
+			});
+		}
+	},
+	down: {
+		args: wdev_args,
+		call: function(req) {
+			return wdev_call(req, (dev) => {
+				dev.stop();
+				return 0;
+			});
+		}
+	},
+	retry: {
+		args: wdev_args,
+		call: function(req) {
+			hostapd_update_mlo();
+
+			return wdev_call(req, (dev) => {
+				dev.retry_setup();
+				return 0;
+			});
+		}
+	},
+	reconf: {
+		args: wdev_args,
+		call: function(req) {
+			hostapd_update_mlo();
+
+			return wdev_call(req, (dev) => {
+				dev.update();
+				return 0;
+			});
+		}
+	},
+	status: {
+		args: wdev_args,
+		call: function(req) {
+			let ret = {};
+			let err = wdev_call(req, (dev) => {
+				ret[dev.data.name] = dev.status();
+				return 0;
+			});
+			if (err != 0)
+				return err;
+
+			return ret;
+		}
+	},
+	notify: {
+		args: {
+			...wdev_args,
+			command: 0,
+			interface: "",
+			vlan: "",
+			data: {},
+		},
+		call: function(req) {
+			let dev = req.args.device;
+			if (!dev)
+				return ubus.STATUS_INVALID_ARGUMENT;
+
+			dev = wireless.devices[dev];
+			if (!dev)
+				return ubus.STATUS_NOT_FOUND;
+
+			return dev.notify(req);
+		}
+	},
+	get_validate: {
+		args: wdev_args,
+		call: function(req) {
+			let ret = {};
+			let err = wdev_call(req, (dev) => {
+				let dev_type = dev.data.config.type;
+				let cur = ret[dev.data.name] = {};
+				get_validate_info(cur, wireless.handlers[dev_type]);
+				return 0;
+			});
+			if (err != 0)
+				return err;
+
+			return ret;
+		}
+	},
+};
+
+
+handler_load(wireless.path, (script, data) => {
+	if (!data.name)
+		return;
+
+	let handler = wireless.handlers[data.name] = {
+		script,
+	};
+	for (let kind, attr in default_config_attr) {
+		let validate = handler[kind + "_validate"] = {};
+		handler[kind] = handler_attributes(data[kind], attr, validate);
+	}
+});
+
+wireless.obj = ubus.publish("network.wireless", ubus_obj);
+wireless.listener = ubus.listener("ubus.object.add", (event, msg) => {
+	if (msg.path == "hostapd")
+		hostapd_update_mlo();
+	else if (msg.path == "wpa_supplicant")
+		supplicant_update_mlo();
+});
+
+return {
+	hotplug,
+	config_init,
+	config_start,
+	check_interfaces,
+};
diff --git a/wireless-scripts-example/vanila/wpa_supplicant.uc b/wireless-scripts-example/vanila/wpa_supplicant.uc
new file mode 100644
index 0000000000..a0ecdde5cd
--- /dev/null
+++ b/wireless-scripts-example/vanila/wpa_supplicant.uc
@@ -0,0 +1,1097 @@
+let libubus = require("ubus");
+import * as uloop from "uloop";
+import { open, readfile } from "fs";
+import { wdev_create, wdev_set_mesh_params, wdev_remove, is_equal, wdev_set_up, vlist_new, phy_open } from "common";
+
+let ubus = libubus.connect();
+
+function ex_handler(e)
+{
+	e = split(`${e}\n${e.stacktrace[0].context}`, '\n');
+	for (let line in e)
+		wpas.printf(line);
+	return libubus.STATUS_UNKNOWN_ERROR;
+}
+libubus.guard(ex_handler);
+
+wpas.data.mld = {};
+wpas.data.config = {};
+wpas.data.iface_phy = {};
+wpas.data.iface_ubus = {};
+wpas.data.macaddr_list = {};
+wpas.data.dpp_hooks = {};
+
+function iface_stop(iface)
+{
+	let ifname = iface.config.iface;
+
+	if (!iface.running)
+		return;
+
+	delete wpas.data.iface_phy[ifname];
+	wpas.remove_iface(ifname);
+	wdev_remove(ifname);
+	iface.running = false;
+}
+
+function iface_start(phydev, iface, macaddr_list)
+{
+	let phy = phydev.name;
+
+	if (iface.running)
+		return;
+
+	let ifname = iface.config.iface;
+	let wdev_config = {};
+	for (let field in iface.config)
+		wdev_config[field] = iface.config[field];
+	if (!wdev_config.macaddr)
+		wdev_config.macaddr = phydev.macaddr_next();
+
+	wpas.data.iface_phy[ifname] = phy;
+	wdev_remove(ifname);
+	let ret = phydev.wdev_add(ifname, wdev_config);
+	if (ret)
+		wpas.printf(`Failed to create device ${ifname}: ${ret}`);
+	wdev_set_up(ifname, true);
+	wpas.add_iface(iface.config);
+	iface.running = true;
+}
+
+function iface_cb(new_if, old_if)
+{
+	if (old_if && new_if && is_equal(old_if.config, new_if.config)) {
+		new_if.running = old_if.running;
+		return;
+	}
+
+	if (new_if && old_if)
+		wpas.printf(`Update configuration for interface ${old_if.config.iface}`);
+	else if (old_if)
+		wpas.printf(`Remove interface ${old_if.config.iface}`);
+
+	if (old_if)
+		iface_stop(old_if);
+}
+
+function prepare_config(config, radio)
+{
+	config.config_data = readfile(config.config);
+
+	return { config };
+}
+
+function phy_dev_open(phy_name)
+{
+	let phy = wpas.data.config[phy_name];
+	if (!phy) {
+		warn(`Missing phy config for ${phy_name}\n`);
+		return;
+	}
+
+	let phydev = phy_open(phy.name, phy.radio);
+	if (!phydev)
+		return;
+
+	let macaddr_list = wpas.data.macaddr_list[phy_name];
+	phydev.macaddr_init(macaddr_list, {
+		num_global: phy.num_global_macaddr,
+		macaddr_base: phy.macaddr_base,
+	});
+
+	return phydev;
+}
+
+function start_pending(phy_name)
+{
+	let phy = wpas.data.config[phy_name];
+	if (!phy || !phy.data)
+		return;
+
+	let phydev = phy_dev_open(phy_name);
+	if (!phydev) {
+		wpas.printf(`Could not open phy ${phy_name}`);
+		return;
+	}
+
+	for (let ifname in phy.data)
+		iface_start(phydev, phy.data[ifname]);
+}
+
+function phy_name(phy, radio)
+{
+	if (!phy)
+		return null;
+
+	if (radio != null && radio >= 0)
+		phy += "." + radio;
+
+	return phy;
+}
+
+function mld_remove(data)
+{
+	if (!data.radio_mask_up)
+		return;
+
+	let name = data.name;
+	wpas.printf(`Remove MLD interface ${name}`);
+	wpas.remove_iface(name);
+	wdev_remove(name);
+	data.radio_mask_up = 0;
+}
+
+function mld_first_phy(data)
+{
+	let mask = data.radio_mask_present;
+
+	for (let i = 0; mask; i++, mask >>= 1)
+		if (mask & 1)
+			return i;
+}
+
+function mld_radio_index(data, freq)
+{
+	let phys = data.phy_config;
+	for (let i = 0; i < length(phys); i++)
+		if (phys[i] && index(phys[i].freq_list, freq) >= 0)
+			return i;
+}
+
+function mld_add(data, phy_list)
+{
+	let name = data.name;
+	phy_list ??= [];
+
+	wpas.printf(`Add MLD interface ${name}`);
+
+	let radio = mld_first_phy(data);
+	if (radio == null)
+		return;
+
+	let phy_name = data.phy + '.' + radio;
+	let phydev = phy_list[phy_name];
+	if (!phydev) {
+		phydev = phy_dev_open(phy_name);
+		if (!phydev)
+			return;
+
+		phy_list[phy_name] = phydev;
+	}
+
+	let wdev_config = { ...data.config, radio_mask: data.radio_mask };
+	if (!wdev_config.macaddr)
+		wdev_config.macaddr = phydev.macaddr_next();
+	let ret = phydev.wdev_add(name, wdev_config);
+	if (ret)
+		wpas.printf(`Failed to create device ${name}: ${ret}`);
+
+	let first_config = data.phy_config[radio];
+
+	wdev_set_up(name, true);
+	wpas.add_iface(first_config);
+
+	let iface = wpas.interfaces[name];
+	if (!iface) {
+		wpas.printf(`Interface ${name} not found after adding\n`);
+		wpas.remove_iface(name);
+		wdev_remove(name);
+		return;
+	}
+
+	if (length(data.freq_list) > 0)
+		iface.config('freq_list', data.freq_list);
+
+	data.radio_mask_up = data.radio_mask_present;
+}
+
+function mld_remove_links(data)
+{
+	// TODO
+	mld_remove(data);
+}
+
+function mld_add_links(data)
+{
+	// TODO: incremental update
+	mld_remove(data);
+	mld_add(data);
+}
+
+function mld_set_config(config)
+{
+	let prev_mld = { ...wpas.data.mld };
+	let new_mld = {};
+	let phy_list = {};
+	let new_config = !length(prev_mld);
+
+	wpas.printf(`Set MLD config: ${keys(config)}`);
+
+	for (let name, data in config) {
+		let prev = prev_mld[name];
+		if (prev && is_equal(prev.config, data)) {
+			new_mld[name] = prev;
+			delete prev_mld[name];
+			continue;
+		}
+
+		let radio_mask = 0;
+		for (let r in data.radios)
+			if (r != null)
+				radio_mask |= 1 << r;
+
+		new_mld[name] = {
+			name,
+			config: data,
+			phy: data.phy,
+			phy_config: [],
+			radio_mask,
+			radio_mask_up: 0,
+			radio_mask_present: 0,
+		};
+	}
+
+	for (let name, data in prev_mld)
+		mld_remove(data);
+
+	wpas.data.mld = new_mld;
+
+}
+
+function mld_set_iface_config(name, data, radio, config)
+{
+	wpas.printf(`Set MLD interface ${name} radio ${radio} config: ${keys(config)}`);
+
+	data.phy_config[radio] = config;
+	if (config)
+		data.radio_mask_present |= 1 << radio;
+	else
+		data.radio_mask_present &= ~(1 << radio);
+
+	let freq_list;
+	for (let config in data.phy_config) {
+		if (!config || !config.freq_list)
+			continue;
+		if (!freq_list)
+			freq_list = [ ...config.freq_list ];
+		else
+			push(freq_list, ...config.freq_list);
+	}
+
+	data.freq_list = freq_list;
+}
+
+function mld_update_iface(name, data) {
+	if (!data.radio_mask_up)
+		return;
+
+	if (!data.radio_mask_present) {
+		mld_remove(data);
+		return;
+	}
+
+	let mask = data.radio_mask_up & ~data.radio_mask_present;
+	if (!mask)
+		return;
+
+	mld_remove_links(data);
+}
+
+function mld_update_phy(phy, ifaces) {
+	for (let name, data in wpas.data.mld) {
+		if (data.phy != phy.name)
+			continue;
+
+		mld_set_iface_config(name, data, phy.radio, ifaces[name]);
+		mld_update_iface(name, data);
+	}
+}
+
+function mld_start() {
+	if (wpas.data.mld_pending)
+		return;
+
+	wpas.printf(`Start pending MLD interfaces\n`);
+
+	let phy_list = {};
+	for (let name, data in wpas.data.mld) {
+		wpas.printf(`MLD interface ${name} present=${data.radio_mask_present} up=${data.radio_mask_up}`);
+		let add_mask = data.radio_mask_present & ~data.radio_mask_up;
+		if (!add_mask)
+			continue;
+
+		if (!data.radio_mask_up)
+			mld_add(data, phy_list);
+		else
+			mld_add_links(data);
+	}
+}
+
+function mld_bss_allowed(data, bss) {
+	if (!data.freq_list)
+		return true;
+
+	return index(data.freq_list, bss.freq) >= 0;
+}
+
+function set_config(config_name, phy_name, radio, num_global_macaddr, macaddr_base, config_list)
+{
+	let phy = wpas.data.config[config_name];
+
+	if (radio < 0)
+		radio = null;
+
+	if (!phy) {
+		phy = vlist_new(iface_cb, false);
+		phy.name = phy_name;
+		wpas.data.config[config_name] = phy;
+	}
+
+	phy.radio = radio;
+	phy.num_global_macaddr = num_global_macaddr;
+	phy.macaddr_base = macaddr_base;
+
+	let values = [];
+	let mlo_ifaces = {};
+	for (let config in config_list)
+		if (config.mlo)
+			mlo_ifaces[config.iface] = config;
+		else
+			push(values, [ config.iface, prepare_config(config) ]);
+
+	mld_update_phy(phy, mlo_ifaces);
+	phy.update(values);
+}
+
+function iface_status_fill_radio_link(mld, radio, msg, link)
+{
+	let config = mld.phy_config[radio];
+	if (!config)
+		return;
+
+	let freq_list = config.freq_list;
+	if (!freq_list)
+		return;
+
+	if (!link || index(freq_list, link.frequency) < 0)
+		return;
+
+	msg.frequency = link.frequency;
+	msg.sec_chan_offset = link.sec_chan_offset;
+}
+
+function iface_status_fill_radio(mld, radio, msg, status)
+{
+	if (status.links)
+		for (let link in status.links)
+			iface_status_fill_radio_link(mld, radio, msg, link);
+	else
+		iface_status_fill_radio_link(mld, radio, msg, status);
+}
+
+function dpp_find_iface(ifname)
+{
+	return wpas.interfaces[ifname];
+}
+
+function dpp_channel_handle_request(channel, req)
+{
+	let data = req.args ?? {};
+	let iface;
+
+	switch (req.type) {
+	case "start":
+		if (!data.ifname)
+			return libubus.STATUS_INVALID_ARGUMENT;
+		if (!wpas.interfaces[data.ifname])
+			return libubus.STATUS_NOT_FOUND;
+		let old_hook = wpas.data.dpp_hooks[data.ifname];
+		if (old_hook && old_hook.channel != channel)
+			old_hook.channel.disconnect();
+		wpas.data.dpp_hooks[data.ifname] = {
+			channel: channel,
+			timeout_count: 0,
+		};
+		return 0;
+
+	case "stop":
+		if (!data.ifname)
+			return libubus.STATUS_INVALID_ARGUMENT;
+		let hook = wpas.data.dpp_hooks[data.ifname];
+		if (hook && hook.channel == channel)
+			delete wpas.data.dpp_hooks[data.ifname];
+		return 0;
+
+	case "tx_action":
+		iface = dpp_find_iface(data.ifname);
+		if (!iface)
+			return libubus.STATUS_NOT_FOUND;
+		if (!iface.dpp_send_action(data.dst, data.freq ?? 0, data.frame))
+			return libubus.STATUS_UNKNOWN_ERROR;
+		return 0;
+
+	case "tx_gas_req":
+		iface = dpp_find_iface(data.ifname);
+		if (!iface)
+			return libubus.STATUS_NOT_FOUND;
+		if (!iface.dpp_send_gas_req(data.dst, data.freq ?? 0, data.data, data.dialog_token ?? 0))
+			return libubus.STATUS_UNKNOWN_ERROR;
+		return 0;
+
+	case "dpp_bootstrap_gen":
+		iface = dpp_find_iface(data.ifname);
+		if (!iface)
+			return libubus.STATUS_NOT_FOUND;
+		let gen_cmd = "DPP_BOOTSTRAP_GEN type=qrcode";
+		if (data.key)
+			gen_cmd += " key=" + data.key;
+		if (data.curve)
+			gen_cmd += " curve=" + data.curve;
+		let gen_result = iface.ctrl(gen_cmd);
+		if (!gen_result || gen_result == "FAIL")
+			return libubus.STATUS_UNKNOWN_ERROR;
+		return { id: +gen_result };
+
+	case "dpp_bootstrap_remove":
+		iface = dpp_find_iface(data.ifname);
+		if (!iface)
+			return libubus.STATUS_NOT_FOUND;
+		let remove_result = iface.ctrl("DPP_BOOTSTRAP_REMOVE " + (data.id ?? "*"));
+		return (remove_result == "OK") ? 0 : libubus.STATUS_UNKNOWN_ERROR;
+
+	case "dpp_chirp":
+		iface = dpp_find_iface(data.ifname);
+		if (!iface)
+			return libubus.STATUS_NOT_FOUND;
+		let chirp_cmd = "DPP_CHIRP own=" + data.id;
+		if (data.iter)
+			chirp_cmd += " iter=" + data.iter;
+		if (data.scan_interval)
+			chirp_cmd += " listen=" + data.scan_interval;
+		let chirp_result = iface.ctrl(chirp_cmd);
+		return (chirp_result == "OK") ? 0 : libubus.STATUS_UNKNOWN_ERROR;
+
+	case "dpp_stop_chirp":
+		iface = dpp_find_iface(data.ifname);
+		if (!iface)
+			return libubus.STATUS_NOT_FOUND;
+		iface.ctrl("DPP_STOP_CHIRP");
+		return 0;
+
+	case "wps_set_m7":
+		iface = dpp_find_iface(data.ifname);
+		if (!iface)
+			return libubus.STATUS_NOT_FOUND;
+		if (!iface.wps_set_m7(data.data))
+			return libubus.STATUS_UNKNOWN_ERROR;
+		return 0;
+
+	default:
+		return libubus.STATUS_METHOD_NOT_FOUND;
+	}
+}
+
+function dpp_channel_handle_disconnect(channel)
+{
+	for (let ifname, hook in wpas.data.dpp_hooks) {
+		if (hook.channel == channel)
+			delete wpas.data.dpp_hooks[ifname];
+	}
+}
+
+function dpp_rx_via_channel(ifname, method, data)
+{
+	let hook = wpas.data.dpp_hooks[ifname];
+	if (!hook)
+		return null;
+
+	let response = hook.channel.request({
+		method: method,
+		data: data,
+	});
+	if (hook.channel.error(true) == libubus.STATUS_TIMEOUT) {
+		hook.timeout_count++;
+		if (hook.timeout_count >= 3) {
+			wpas.printf(`DPP channel timeout for ${ifname}, disconnecting`);
+			hook.channel.disconnect();
+			delete wpas.data.dpp_hooks[ifname];
+		}
+		return null;
+	}
+
+	hook.timeout_count = 0;
+	return response;
+}
+
+let main_obj = {
+	phy_set_state: {
+		args: {
+			phy: "",
+			radio: 0,
+			stop: true,
+		},
+		call: function(req) {
+			let name = phy_name(req.args.phy, req.args.radio);
+			if (!name || req.args.stop == null)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			let phy = wpas.data.config[name];
+			if (!phy)
+				return libubus.STATUS_NOT_FOUND;
+
+			let radio_mask = phy.radio != null ? (1 << phy.radio) : 0;
+			if (req.args.stop) {
+				for (let ifname in phy.data)
+					iface_stop(phy.data[ifname]);
+				for (let name, data in wpas.data.mld) {
+					data.radio_mask_present &= ~radio_mask;
+					if (data.radio_mask_up & radio_mask)
+						mld_update_iface(name, data);
+				}
+			} else {
+				start_pending(name);
+
+				let found;
+				for (let name, data in wpas.data.mld) {
+					if (!(data.radio_mask & radio_mask))
+						continue;
+					data.radio_mask_present |= radio_mask;
+					found = true;
+				}
+				if (found)
+					mld_start();
+			}
+
+			return 0;
+		}
+	},
+	phy_set_macaddr_list: {
+		args: {
+			phy: "",
+			radio: 0,
+			macaddr: [],
+		},
+		call: function(req) {
+			let phy = phy_name(req.args.phy, req.args.radio);
+			if (!phy)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			wpas.data.macaddr_list[phy] = req.args.macaddr;
+			return 0;
+		}
+	},
+	phy_status: {
+		args: {
+			phy: "",
+			radio: 0,
+		},
+		call: function(req) {
+			let phy = phy_name(req.args.phy, req.args.radio);
+			if (!phy)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			phy = wpas.data.config[phy];
+			if (!phy)
+				return libubus.STATUS_NOT_FOUND;
+
+			let ifnames = keys(phy.data);
+			let radio_mask = phy.radio != null ? (1 << phy.radio) : 0;
+			for (let name, data in wpas.data.mld)
+				if (data.radio_mask_up & radio_mask)
+					push(ifnames, name);
+
+			for (let ifname in ifnames) {
+				try {
+					let iface = wpas.interfaces[ifname];
+					if (!iface)
+						continue;
+
+					let status = iface.status();
+					if (!status)
+						continue;
+
+					if (status.state == "INTERFACE_DISABLED")
+						continue;
+
+					if (phy.data[ifname]) {
+						status.ifname = ifname;
+						return status;
+					}
+
+					let ret = {
+						ifname,
+						state: status.state,
+					};
+
+					let mld = wpas.data.mld[ifname];
+					iface_status_fill_radio(mld, phy.radio, ret, status);
+					return ret;
+				} catch (e) {
+					ex_handler(e);
+					continue;
+				}
+			}
+
+			return libubus.STATUS_NOT_FOUND;
+		}
+	},
+	iface_status: {
+		args: {
+			name: ""
+		},
+		call: function(req) {
+			let iface = wpas.interfaces[req.args.name];
+			if (!iface)
+				return libubus.STATUS_NOT_FOUND;
+
+			return iface.status();
+		},
+	},
+	mld_set: {
+		args: {
+			config: {}
+		},
+		call: function(req) {
+			if (!req.args.config)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			wpas.data.mld_pending = true;
+			mld_set_config(req.args.config);
+			return 0;
+		}
+	},
+	mld_start: {
+		args: {},
+		call: function(req) {
+			wpas.data.mld_pending = false;
+			mld_start();
+			return 0;
+		}
+	},
+	config_set: {
+		args: {
+			phy: "",
+			radio: 0,
+			num_global_macaddr: 0,
+			macaddr_base: "",
+			config: [],
+			defer: true,
+		},
+		call: function(req) {
+			let phy = phy_name(req.args.phy, req.args.radio);
+			if (!phy)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			wpas.printf(`Set new config for phy ${phy}`);
+			if (req.args.config)
+				set_config(phy, req.args.phy, req.args.radio, req.args.num_global_macaddr, req.args.macaddr_base, req.args.config);
+
+			if (!req.args.defer)
+				uloop.timer(100, () => start_pending(phy));
+
+			return {
+				pid: wpas.getpid()
+			};
+		}
+	},
+	config_add: {
+		args: {
+			driver: "",
+			iface: "",
+			bridge: "",
+			hostapd_ctrl: "",
+			ctrl: "",
+			config: "",
+		},
+		call: function(req) {
+			if (!req.args.iface || !req.args.config)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			if (wpas.add_iface(req.args) < 0)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			return {
+				pid: wpas.getpid()
+			};
+		}
+	},
+	config_remove: {
+		args: {
+			iface: ""
+		},
+		call: function(req) {
+			if (!req.args.iface)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			wpas.remove_iface(req.args.iface);
+			return 0;
+		}
+	},
+	bss_info: {
+		args: {
+			iface: "",
+		},
+		call: function(req) {
+			let ifname = req.args.iface;
+			if (!ifname)
+				return libubus.STATUS_INVALID_ARGUMENT;
+
+			let iface = wpas.interfaces[ifname];
+			if (!iface)
+				return libubus.STATUS_NOT_FOUND;
+
+			let status = iface.ctrl("STATUS");
+			if (!status)
+				return libubus.STATUS_NOT_FOUND;
+
+			let ret = {};
+			status = split(status, "\n");
+			for (let line in status) {
+				line = split(line, "=", 2);
+				ret[line[0]] = line[1];
+			}
+
+			return ret;
+		}
+	},
+	status: {
+		args: {},
+		call: function(req) {
+			let interfaces = {};
+
+			for (let phy_name, phy in wpas.data.config) {
+				if (!phy || !phy.data)
+					continue;
+
+				for (let ifname, iface_data in phy.data) {
+					let config = iface_data.config;
+
+					let entry = {
+						wiphy: phy.name,
+						macaddr: config.macaddr,
+						running: !!iface_data.running,
+						pending: !iface_data.running,
+					};
+
+					if (phy.radio != null && phy.radio >= 0)
+						entry.radio = phy.radio;
+
+					interfaces[config.iface] = entry;
+				}
+			}
+
+			for (let name, mld in wpas.data.mld) {
+				let entry = {
+					wiphy: mld.phy,
+					links: {},
+				};
+
+				if (mld.config && mld.config.macaddr)
+					entry.macaddr = mld.config.macaddr;
+
+				let mask = mld.radio_mask;
+				for (let radio = 0; mask; radio++, mask >>= 1) {
+					if (!(mask & 1))
+						continue;
+
+					entry.links[radio] = {
+						radio,
+						running: !!(mld.radio_mask_up & (1 << radio)),
+						pending: !!(mld.radio_mask_present & (1 << radio)) &&
+						         !(mld.radio_mask_up & (1 << radio)),
+					};
+				}
+
+				interfaces[mld.name] = entry;
+			}
+
+			return { interfaces };
+		}
+	},
+	dpp_channel: {
+		args: {},
+		call: function(req) {
+			let channel;
+			let on_request = (chan_req) => dpp_channel_handle_request(channel, chan_req);
+			let on_disconnect = () => dpp_channel_handle_disconnect(channel);
+
+			channel = req.new_channel(on_request, on_disconnect, 1);
+			if (!channel)
+				return libubus.STATUS_UNKNOWN_ERROR;
+
+			return 0;
+		}
+	},
+};
+
+wpas.data.ubus = ubus;
+wpas.data.obj = ubus.publish("wpa_supplicant", main_obj);
+wpas.udebug_set("wpa_supplicant", wpas.data.ubus);
+
+function iface_event(type, name, data) {
+	let ubus = wpas.data.ubus;
+
+	data ??= {};
+	data.name = name;
+	let req = wpas.data.obj.notify(`iface.${type}`, data, null, null, null, -1);
+	if (req)
+		req.abort();
+
+	ubus.call("service", "event", { type: `wpa_supplicant.${name}.${type}`, data: {} });
+}
+
+function iface_hostapd_notify(ifname, iface, state)
+{
+	let status = iface.status();
+	let ubus = wpas.data.ubus;
+	let msg = {};
+
+	let mld = wpas.data.mld[ifname];
+	switch (state) {
+	case "DISCONNECTED":
+	case "AUTHENTICATING":
+	case "SCANNING":
+		msg.up = false;
+		break;
+	case "INTERFACE_DISABLED":
+	case "INACTIVE":
+		msg.up = true;
+		break;
+	case "COMPLETED":
+		msg.up = true;
+		if (!mld) {
+			msg.frequency = status.frequency;
+			msg.sec_chan_offset = status.sec_chan_offset;
+		}
+		break;
+	default:
+		return;
+	}
+
+	if (!mld) {
+		msg.phy = wpas.data.iface_phy[ifname];
+		if (!msg.phy) {
+			wpas.printf(`no PHY for ifname ${ifname}`);
+			return;
+		}
+		ubus.call("hostapd", "apsta_state", msg);
+		return;
+	}
+
+	let radio_mask = mld.radio_mask;
+	for (let i = 0; radio_mask; i++, radio_mask >>= 1) {
+		if (!(radio_mask & 1)) {
+			wpas.printf(`skip radio ${i}`);
+			continue;
+		}
+
+		let radio_msg = {
+			...msg,
+			phy: mld.phy,
+			radio: i,
+		};
+
+		if (state == "COMPLETED")
+			iface_status_fill_radio(mld, i, radio_msg, status);
+
+		ubus.call("hostapd", "apsta_state", radio_msg);
+	}
+}
+
+function iface_channel_switch(ifname, iface, info)
+{
+	let msg = {
+		up: true,
+		csa: true,
+		csa_count: info.csa_count ? info.csa_count - 1 : 0,
+		frequency: info.frequency,
+		sec_chan_offset: info.sec_chan_offset,
+	};
+
+	let mld = wpas.data.mld[ifname];
+	if (mld) {
+		msg.phy = mld.phy;
+		msg.radio = mld_radio_index(mld, info.frequency);
+		if (msg.radio == null) {
+			wpas.printf(`PHY ${mld.phy} radio for frequency ${info.frequency} not found`);
+			return;
+		}
+	} else {
+		msg.phy = wpas.data.iface_phy[ifname];
+		if (!msg.phy) {
+			wpas.printf(`no PHY for ifname ${ifname}`);
+			return;
+		}
+	}
+
+	ubus.call("hostapd", "apsta_state", msg);
+}
+
+function iface_ubus_remove(ifname)
+{
+	let obj = wpas.data.iface_ubus[ifname];
+	if (!obj)
+		return;
+
+	obj.remove();
+	delete wpas.data.iface_ubus[ifname];
+}
+
+function iface_ubus_notify(ifname, event)
+{
+	let obj = wpas.data.iface_ubus[ifname];
+	if (!obj)
+		return;
+
+	obj.notify('ctrl-event', { event }, null, null, null, -1);
+}
+
+function iface_ubus_add(ifname)
+{
+	let ubus = wpas.data.ubus;
+
+	iface_ubus_remove(ifname);
+
+	let obj = ubus.publish(`wpa_supplicant.${ifname}`, {
+		reload: {
+			args: {},
+			call: (req) => {
+				let iface = wpas.interfaces[ifname];
+				if (!iface)
+					return libubus.STATUS_NOT_FOUND;
+
+				iface.ctrl("RECONFIGURE");
+				return 0;
+			},
+		},
+		wps_start: {
+			args: {
+				multi_ap: true
+			},
+			call: (req) => {
+				let iface = wpas.interfaces[ifname];
+				if (!iface)
+					return libubus.STATUS_NOT_FOUND;
+
+				iface.ctrl(`WPS_PBC multi_ap=${+req.args.multi_ap}`);
+				return 0;
+			},
+		},
+		wps_cancel: {
+			args: {},
+			call: (req) => {
+				let iface = wpas.interfaces[ifname];
+				if (!iface)
+					return libubus.STATUS_NOT_FOUND;
+
+				iface.ctrl("WPS_CANCEL");
+				return 0;
+			},
+		},
+		control: {
+			args: {
+				command: ""
+			},
+			call: (req) => {
+				let iface = wpas.interfaces[ifname];
+				if (!iface)
+					return libubus.STATUS_NOT_FOUND;
+
+				return {
+					result: iface.ctrl(req.args.command)
+				};
+			},
+		},
+	});
+	wpas.data.iface_ubus[ifname] = obj;
+}
+
+return {
+	shutdown: function() {
+		for (let phy in wpas.data.config)
+			set_config(phy, []);
+		wpas.ubus.disconnect();
+	},
+	bss_allowed: function(ifname, bss) {
+		let mld = wpas.data.mld[ifname];
+		if (!mld)
+			return true;
+
+		return mld_bss_allowed(mld, bss);
+	},
+	iface_add: function(name, obj) {
+		iface_ubus_add(name);
+		iface_event("add", name);
+	},
+	iface_remove: function(name, obj) {
+		iface_event("remove", name);
+		iface_ubus_remove(name);
+		delete wpas.data.dpp_hooks[name];
+	},
+	ctrl_event: function(name, iface, ev) {
+		iface_ubus_notify(name, ev);
+	},
+	state: function(ifname, iface, state) {
+		let event_data = iface.status();
+		event_data.name = ifname;
+		iface_event("state", ifname, event_data);
+		try {
+			iface_hostapd_notify(ifname, iface, state);
+
+			if (state != "COMPLETED")
+				return;
+
+			let phy = wpas.data.iface_phy[ifname];
+			if (!phy)
+				return;
+
+			let phy_data = wpas.data.config[phy];
+			if (!phy_data)
+				return;
+
+			let iface_data = phy_data.data[ifname];
+			if (!iface_data)
+				return;
+
+			let wdev_config = iface_data.config;
+			if (!wdev_config || wdev_config.mode != "mesh")
+				return;
+
+			wdev_set_mesh_params(ifname, wdev_config);
+		} catch (e) {
+			ex_handler(e);
+		}
+	},
+	event: function(ifname, iface, ev, info) {
+		if (ev == "CH_SWITCH_STARTED")
+			iface_channel_switch(ifname, iface, info);
+	},
+	wps_credentials: function(ifname, iface, cred) {
+		cred.ifname = ifname;
+		ubus.event("wps_credentials", cred);
+	},
+	dpp_rx_action: function(iface, src, frame_type, freq, frame) {
+		let response = dpp_rx_via_channel(iface, "rx_action", {
+			ifname: iface, src, frame_type, freq, frame,
+		});
+		if (response && response.handled)
+			return true;
+		return false;
+	},
+	dpp_rx_gas: function(iface, src, freq, gas_frame) {
+		let response = dpp_rx_via_channel(iface, "rx_gas", {
+			ifname: iface, src, freq, gas_frame,
+		});
+		if (response && response.handled)
+			return true;
+		return false;
+	},
+	wps_m8_rx: function(ifname, iface, data) {
+		let response = dpp_rx_via_channel(ifname, "wps_m8_rx", {
+			ifname, data,
+		});
+		if (response && response.handled)
+			return true;
+		return false;
+	},
+};