diff --git a/recipes-wifi/hostapd/files/patches/350-nl80211_del_beacon_bss.patch b/recipes-wifi/hostapd/files/patches/350-nl80211_del_beacon_bss.patch
index 85298df..a88b63e 100644
--- a/recipes-wifi/hostapd/files/patches/350-nl80211_del_beacon_bss.patch
+++ b/recipes-wifi/hostapd/files/patches/350-nl80211_del_beacon_bss.patch
@@ -10,7 +10,7 @@
  	bss->freq = 0;
  	nl80211_put_wiphy_data_ap(bss);
 -	msg = nl80211_drv_msg(drv, 0, NL80211_CMD_DEL_BEACON);
-+	msg = nl80211_bss_msg(drv, 0, NL80211_CMD_DEL_BEACON);
++	msg = nl80211_bss_msg(bss, 0, NL80211_CMD_DEL_BEACON);
  	return send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
  }
  
diff --git a/recipes-wifi/hostapd/files/src/src/ap/ubus.c b/recipes-wifi/hostapd/files/src/src/ap/ubus.c
index b7b8343..5001225 100644
--- a/recipes-wifi/hostapd/files/src/src/ap/ubus.c
+++ b/recipes-wifi/hostapd/files/src/src/ap/ubus.c
@@ -390,32 +390,6 @@
 	return 0;
 }
 
-/* Imported from iw/util.c
- *  https://git.kernel.org/pub/scm/linux/kernel/git/jberg/iw.git/tree/util.c?id=4b25ae3537af48dbf9d0abf94132e5ba01b32c18#n200
- */
-int ieee80211_frequency_to_channel(int freq)
-{
-	/* see 802.11-2007 17.3.8.3.2 and Annex J */
-	if (freq == 2484)
-		return 14;
-	/* see 802.11ax D6.1 27.3.23.2 and Annex E */
-	else if (freq == 5935)
-		return 2;
-	else if (freq < 2484)
-		return (freq - 2407) / 5;
-	else if (freq >= 4910 && freq <= 4980)
-		return (freq - 4000) / 5;
-	else if (freq < 5950)
-		return (freq - 5000) / 5;
-	else if (freq <= 45000) /* DMG band lower limit */
-		/* see 802.11ax D6.1 27.3.23.2 */
-		return (freq - 5950) / 5;
-	else if (freq >= 58320 && freq <= 70200)
-		return (freq - 56160) / 2160;
-	else
-		return 0;
-}
-
 static int
 hostapd_bss_get_status(struct ubus_context *ctx, struct ubus_object *obj,
 		       struct ubus_request_data *req, const char *method,
diff --git a/recipes-wifi/hostapd/files/src/src/utils/build_features.h b/recipes-wifi/hostapd/files/src/src/utils/build_features.h
index 138a799..553769e 100644
--- a/recipes-wifi/hostapd/files/src/src/utils/build_features.h
+++ b/recipes-wifi/hostapd/files/src/src/utils/build_features.h
@@ -7,10 +7,6 @@
 	if (!strcmp(feat, "eap"))
 		return 1;
 #endif
-#ifdef CONFIG_IEEE80211N
-	if (!strcmp(feat, "11n"))
-		return 1;
-#endif
 #ifdef CONFIG_IEEE80211AC
 	if (!strcmp(feat, "11ac"))
 		return 1;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/307-wifi-mac80211-fix-initialization-of-rx-link-and-rx-l.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/307-wifi-mac80211-fix-initialization-of-rx-link-and-rx-l.patch
new file mode 100644
index 0000000..5652c14
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/307-wifi-mac80211-fix-initialization-of-rx-link-and-rx-l.patch
@@ -0,0 +1,413 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Tue, 13 Dec 2022 21:03:19 +0100
+Subject: [PATCH] wifi: mac80211: fix initialization of rx->link and
+ rx->link_sta
+
+There are some codepaths that do not initialize rx->link_sta properly. This
+causes a crash in places which assume that rx->link_sta is valid if rx->sta
+is valid.
+One known instance is triggered by __ieee80211_rx_h_amsdu being called from
+fast-rx.
+
+Since the initialization of rx->link and rx->link_sta is rather convoluted
+and duplicated in many places, clean it up by using a helper function to
+set it.
+
+Fixes: ccdde7c74ffd ("wifi: mac80211: properly implement MLO key handling")
+Fixes: b320d6c456ff ("wifi: mac80211: use correct rx link_sta instead of default")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -4067,6 +4067,55 @@ static void ieee80211_invoke_rx_handlers
+ #undef CALL_RXH
+ }
+ 
++static bool
++ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta *sta, u8 link_id)
++{
++	if (!sta->mlo)
++		return false;
++
++	return !!(sta->valid_links & BIT(link_id));
++}
++
++static bool ieee80211_rx_data_set_link(struct ieee80211_rx_data *rx,
++				       u8 link_id)
++{
++	if (!ieee80211_rx_is_valid_sta_link_id(&rx->sta->sta, link_id))
++		return false;
++
++	rx->link_id = link_id;
++	rx->link = rcu_dereference(rx->sdata->link[link_id]);
++	rx->link_sta = rcu_dereference(rx->sta->link[link_id]);
++
++	return rx->link && rx->link_sta;
++}
++
++static bool ieee80211_rx_data_set_sta(struct ieee80211_rx_data *rx,
++				      struct ieee80211_sta *pubsta,
++				      int link_id)
++{
++	struct sta_info *sta;
++
++	sta = container_of(pubsta, struct sta_info, sta);
++
++	rx->link_id = link_id;
++	rx->sta = sta;
++
++	if (sta) {
++		rx->local = sta->sdata->local;
++		rx->sdata = sta->sdata;
++		rx->link_sta = &sta->deflink;
++
++		if (link_id >= 0 &&
++		    !ieee80211_rx_data_set_link(rx, link_id))
++			return false;
++	}
++
++	if (link_id < 0)
++		rx->link = &rx->sdata->deflink;
++
++	return true;
++}
++
+ /*
+  * This function makes calls into the RX path, therefore
+  * it has to be invoked under RCU read lock.
+@@ -4075,16 +4124,19 @@ void ieee80211_release_reorder_timeout(s
+ {
+ 	struct sk_buff_head frames;
+ 	struct ieee80211_rx_data rx = {
+-		.sta = sta,
+-		.sdata = sta->sdata,
+-		.local = sta->local,
+ 		/* This is OK -- must be QoS data frame */
+ 		.security_idx = tid,
+ 		.seqno_idx = tid,
+-		.link_id = -1,
+ 	};
+ 	struct tid_ampdu_rx *tid_agg_rx;
+-	u8 link_id;
++	int link_id = -1;
++
++	/* FIXME: statistics won't be right with this */
++	if (sta->sta.valid_links)
++		link_id = ffs(sta->sta.valid_links) - 1;
++
++	if (!ieee80211_rx_data_set_sta(&rx, &sta->sta, link_id))
++		return;
+ 
+ 	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
+ 	if (!tid_agg_rx)
+@@ -4104,10 +4156,6 @@ void ieee80211_release_reorder_timeout(s
+ 		};
+ 		drv_event_callback(rx.local, rx.sdata, &event);
+ 	}
+-	/* FIXME: statistics won't be right with this */
+-	link_id = sta->sta.valid_links ? ffs(sta->sta.valid_links) - 1 : 0;
+-	rx.link = rcu_dereference(sta->sdata->link[link_id]);
+-	rx.link_sta = rcu_dereference(sta->link[link_id]);
+ 
+ 	ieee80211_rx_handlers(&rx, &frames);
+ }
+@@ -4123,7 +4171,6 @@ void ieee80211_mark_rx_ba_filtered_frame
+ 		/* This is OK -- must be QoS data frame */
+ 		.security_idx = tid,
+ 		.seqno_idx = tid,
+-		.link_id = -1,
+ 	};
+ 	int i, diff;
+ 
+@@ -4134,10 +4181,8 @@ void ieee80211_mark_rx_ba_filtered_frame
+ 
+ 	sta = container_of(pubsta, struct sta_info, sta);
+ 
+-	rx.sta = sta;
+-	rx.sdata = sta->sdata;
+-	rx.link = &rx.sdata->deflink;
+-	rx.local = sta->local;
++	if (!ieee80211_rx_data_set_sta(&rx, pubsta, -1))
++		return;
+ 
+ 	rcu_read_lock();
+ 	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
+@@ -4524,15 +4569,6 @@ void ieee80211_check_fast_rx_iface(struc
+ 	mutex_unlock(&local->sta_mtx);
+ }
+ 
+-static bool
+-ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta *sta, u8 link_id)
+-{
+-	if (!sta->mlo)
+-		return false;
+-
+-	return !!(sta->valid_links & BIT(link_id));
+-}
+-
+ static void ieee80211_rx_8023(struct ieee80211_rx_data *rx,
+ 			      struct ieee80211_fast_rx *fast_rx,
+ 			      int orig_len)
+@@ -4643,7 +4679,6 @@ static bool ieee80211_invoke_fast_rx(str
+ 	struct sk_buff *skb = rx->skb;
+ 	struct ieee80211_hdr *hdr = (void *)skb->data;
+ 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+-	struct sta_info *sta = rx->sta;
+ 	int orig_len = skb->len;
+ 	int hdrlen = ieee80211_hdrlen(hdr->frame_control);
+ 	int snap_offs = hdrlen;
+@@ -4655,7 +4690,6 @@ static bool ieee80211_invoke_fast_rx(str
+ 		u8 da[ETH_ALEN];
+ 		u8 sa[ETH_ALEN];
+ 	} addrs __aligned(2);
+-	struct link_sta_info *link_sta;
+ 	struct ieee80211_sta_rx_stats *stats;
+ 
+ 	/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
+@@ -4758,18 +4792,10 @@ static bool ieee80211_invoke_fast_rx(str
+  drop:
+ 	dev_kfree_skb(skb);
+ 
+-	if (rx->link_id >= 0) {
+-		link_sta = rcu_dereference(sta->link[rx->link_id]);
+-		if (!link_sta)
+-			return true;
+-	} else {
+-		link_sta = &sta->deflink;
+-	}
+-
+ 	if (fast_rx->uses_rss)
+-		stats = this_cpu_ptr(link_sta->pcpu_rx_stats);
++		stats = this_cpu_ptr(rx->link_sta->pcpu_rx_stats);
+ 	else
+-		stats = &link_sta->rx_stats;
++		stats = &rx->link_sta->rx_stats;
+ 
+ 	stats->dropped++;
+ 	return true;
+@@ -4787,7 +4813,6 @@ static bool ieee80211_prepare_and_rx_han
+ 	struct ieee80211_local *local = rx->local;
+ 	struct ieee80211_sub_if_data *sdata = rx->sdata;
+ 	struct ieee80211_hdr *hdr = (void *)skb->data;
+-	struct link_sta_info *link_sta = NULL;
+ 	struct ieee80211_link_data *link;
+ 
+ 	rx->skb = skb;
+@@ -4810,35 +4835,6 @@ static bool ieee80211_prepare_and_rx_han
+ 	if (!ieee80211_accept_frame(rx))
+ 		return false;
+ 
+-	if (rx->link_id >= 0) {
+-		link = rcu_dereference(rx->sdata->link[rx->link_id]);
+-
+-		/* we might race link removal */
+-		if (!link)
+-			return true;
+-		rx->link = link;
+-
+-		if (rx->sta) {
+-			rx->link_sta =
+-				rcu_dereference(rx->sta->link[rx->link_id]);
+-			if (!rx->link_sta)
+-				return true;
+-		}
+-	} else {
+-		if (rx->sta)
+-			rx->link_sta = &rx->sta->deflink;
+-
+-		rx->link = &sdata->deflink;
+-	}
+-
+-	if (unlikely(!is_multicast_ether_addr(hdr->addr1) &&
+-		     rx->link_id >= 0 && rx->sta && rx->sta->sta.mlo)) {
+-		link_sta = rcu_dereference(rx->sta->link[rx->link_id]);
+-
+-		if (WARN_ON_ONCE(!link_sta))
+-			return true;
+-	}
+-
+ 	if (!consume) {
+ 		struct skb_shared_hwtstamps *shwt;
+ 
+@@ -4858,16 +4854,16 @@ static bool ieee80211_prepare_and_rx_han
+ 		shwt->hwtstamp = skb_hwtstamps(skb)->hwtstamp;
+ 	}
+ 
+-	if (unlikely(link_sta)) {
++	if (unlikely(rx->sta && rx->sta->sta.mlo)) {
+ 		/* translate to MLD addresses */
+ 		if (ether_addr_equal(link->conf->addr, hdr->addr1))
+ 			ether_addr_copy(hdr->addr1, rx->sdata->vif.addr);
+-		if (ether_addr_equal(link_sta->addr, hdr->addr2))
++		if (ether_addr_equal(rx->link_sta->addr, hdr->addr2))
+ 			ether_addr_copy(hdr->addr2, rx->sta->addr);
+ 		/* translate A3 only if it's the BSSID */
+ 		if (!ieee80211_has_tods(hdr->frame_control) &&
+ 		    !ieee80211_has_fromds(hdr->frame_control)) {
+-			if (ether_addr_equal(link_sta->addr, hdr->addr3))
++			if (ether_addr_equal(rx->link_sta->addr, hdr->addr3))
+ 				ether_addr_copy(hdr->addr3, rx->sta->addr);
+ 			else if (ether_addr_equal(link->conf->addr, hdr->addr3))
+ 				ether_addr_copy(hdr->addr3, rx->sdata->vif.addr);
+@@ -4888,6 +4884,7 @@ static void __ieee80211_rx_handle_8023(s
+ 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+ 	struct ieee80211_fast_rx *fast_rx;
+ 	struct ieee80211_rx_data rx;
++	int link_id = -1;
+ 
+ 	memset(&rx, 0, sizeof(rx));
+ 	rx.skb = skb;
+@@ -4904,12 +4901,8 @@ static void __ieee80211_rx_handle_8023(s
+ 	if (!pubsta)
+ 		goto drop;
+ 
+-	rx.sta = container_of(pubsta, struct sta_info, sta);
+-	rx.sdata = rx.sta->sdata;
+-
+-	if (status->link_valid &&
+-	    !ieee80211_rx_is_valid_sta_link_id(pubsta, status->link_id))
+-		goto drop;
++	if (status->link_valid)
++		link_id = status->link_id;
+ 
+ 	/*
+ 	 * TODO: Should the frame be dropped if the right link_id is not
+@@ -4918,19 +4911,8 @@ static void __ieee80211_rx_handle_8023(s
+ 	 * link_id is used only for stats purpose and updating the stats on
+ 	 * the deflink is fine?
+ 	 */
+-	if (status->link_valid)
+-		rx.link_id = status->link_id;
+-
+-	if (rx.link_id >= 0) {
+-		struct ieee80211_link_data *link;
+-
+-		link =  rcu_dereference(rx.sdata->link[rx.link_id]);
+-		if (!link)
+-			goto drop;
+-		rx.link = link;
+-	} else {
+-		rx.link = &rx.sdata->deflink;
+-	}
++	if (!ieee80211_rx_data_set_sta(&rx, pubsta, link_id))
++		goto drop;
+ 
+ 	fast_rx = rcu_dereference(rx.sta->fast_rx);
+ 	if (!fast_rx)
+@@ -4948,6 +4930,8 @@ static bool ieee80211_rx_for_interface(s
+ {
+ 	struct link_sta_info *link_sta;
+ 	struct ieee80211_hdr *hdr = (void *)skb->data;
++	struct sta_info *sta;
++	int link_id = -1;
+ 
+ 	/*
+ 	 * Look up link station first, in case there's a
+@@ -4957,24 +4941,19 @@ static bool ieee80211_rx_for_interface(s
+ 	 */
+ 	link_sta = link_sta_info_get_bss(rx->sdata, hdr->addr2);
+ 	if (link_sta) {
+-		rx->sta = link_sta->sta;
+-		rx->link_id = link_sta->link_id;
++		sta = link_sta->sta;
++		link_id = link_sta->link_id;
+ 	} else {
+ 		struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+ 
+-		rx->sta = sta_info_get_bss(rx->sdata, hdr->addr2);
+-		if (rx->sta) {
+-			if (status->link_valid &&
+-			    !ieee80211_rx_is_valid_sta_link_id(&rx->sta->sta,
+-							       status->link_id))
+-				return false;
+-
+-			rx->link_id = status->link_valid ? status->link_id : -1;
+-		} else {
+-			rx->link_id = -1;
+-		}
++		sta = sta_info_get_bss(rx->sdata, hdr->addr2);
++		if (status->link_valid)
++			link_id = status->link_id;
+ 	}
+ 
++	if (!ieee80211_rx_data_set_sta(rx, &sta->sta, link_id))
++		return false;
++
+ 	return ieee80211_prepare_and_rx_handle(rx, skb, consume);
+ }
+ 
+@@ -5033,19 +5012,15 @@ static void __ieee80211_rx_handle_packet
+ 
+ 	if (ieee80211_is_data(fc)) {
+ 		struct sta_info *sta, *prev_sta;
+-		u8 link_id = status->link_id;
++		int link_id = -1;
+ 
+-		if (pubsta) {
+-			rx.sta = container_of(pubsta, struct sta_info, sta);
+-			rx.sdata = rx.sta->sdata;
++		if (status->link_valid)
++			link_id = status->link_id;
+ 
+-			if (status->link_valid &&
+-			    !ieee80211_rx_is_valid_sta_link_id(pubsta, link_id))
++		if (pubsta) {
++			if (!ieee80211_rx_data_set_sta(&rx, pubsta, link_id))
+ 				goto out;
+ 
+-			if (status->link_valid)
+-				rx.link_id = status->link_id;
+-
+ 			/*
+ 			 * In MLO connection, fetch the link_id using addr2
+ 			 * when the driver does not pass link_id in status.
+@@ -5063,7 +5038,7 @@ static void __ieee80211_rx_handle_packet
+ 				if (!link_sta)
+ 					goto out;
+ 
+-				rx.link_id = link_sta->link_id;
++				ieee80211_rx_data_set_link(&rx, link_sta->link_id);
+ 			}
+ 
+ 			if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
+@@ -5079,30 +5054,25 @@ static void __ieee80211_rx_handle_packet
+ 				continue;
+ 			}
+ 
+-			if ((status->link_valid &&
+-			     !ieee80211_rx_is_valid_sta_link_id(&prev_sta->sta,
+-								link_id)) ||
+-			    (!status->link_valid && prev_sta->sta.mlo))
++			if (!ieee80211_rx_data_set_sta(&rx, &prev_sta->sta,
++						       link_id))
++				goto out;
++
++			if (!status->link_valid && prev_sta->sta.mlo)
+ 				continue;
+ 
+-			rx.link_id = status->link_valid ? link_id : -1;
+-			rx.sta = prev_sta;
+-			rx.sdata = prev_sta->sdata;
+ 			ieee80211_prepare_and_rx_handle(&rx, skb, false);
+ 
+ 			prev_sta = sta;
+ 		}
+ 
+ 		if (prev_sta) {
+-			if ((status->link_valid &&
+-			     !ieee80211_rx_is_valid_sta_link_id(&prev_sta->sta,
+-								link_id)) ||
+-			    (!status->link_valid && prev_sta->sta.mlo))
++			if (!ieee80211_rx_data_set_sta(&rx, &prev_sta->sta,
++						       link_id))
+ 				goto out;
+ 
+-			rx.link_id = status->link_valid ? link_id : -1;
+-			rx.sta = prev_sta;
+-			rx.sdata = prev_sta->sdata;
++			if (!status->link_valid && prev_sta->sta.mlo)
++				goto out;
+ 
+ 			if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
+ 				return;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
index ba3c731..8e73985 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
@@ -12,6 +12,7 @@
     file://306-02-wifi-mac80211-add-wake_tx_queue-callback-to-drivers.patch \
     file://306-03-wifi-mac80211-Drop-support-for-TX-push-path.patch \
     file://306-04-wifi-realtek-remove-duplicated-wake_tx_queue.patch \
+    file://307-wifi-mac80211-fix-initialization-of-rx-link-and-rx-l.patch \
     file://310-mac80211-add-support-for-restricting-netdev-features.patch \
     file://400-allow-ibss-mixed.patch \
     file://500-mac80211_configure_antenna_gain.patch \
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
index e194f7d..c9e83a4 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
@@ -1,4 +1,4 @@
-From b9974cb5e246a0b7f999e16c1e6dc48bb65737f2 Mon Sep 17 00:00:00 2001
+From 33d41ea84a29d895fc07019aa5c6f79811e59b14 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 22 Jun 2022 10:39:47 +0800
 Subject: [PATCH 1001/1009] mt76: mt7915: add mtk internal debug tools for mt76
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1002-mt76-mt7915-csi-implement-csi-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1002-mt76-mt7915-csi-implement-csi-support.patch
index 5f2a8e3..7bc8f15 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1002-mt76-mt7915-csi-implement-csi-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1002-mt76-mt7915-csi-implement-csi-support.patch
@@ -1,4 +1,4 @@
-From 60ac6480474b349c21c256f4d720baa2c6622b2f Mon Sep 17 00:00:00 2001
+From d5e0407913c33119fd697d626cb3fd87b44f9689 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Jun 2022 20:13:02 +0800
 Subject: [PATCH 1002/1009] mt76: mt7915: csi: implement csi support
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1003-mt76-mt7915-air-monitor-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1003-mt76-mt7915-air-monitor-support.patch
index 1e6158a..1078874 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1003-mt76-mt7915-air-monitor-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1003-mt76-mt7915-air-monitor-support.patch
@@ -1,4 +1,4 @@
-From 088b6c6f35ed5213deae1b4515375632457ec90f Mon Sep 17 00:00:00 2001
+From 0a7547997d9a2f44574b4562b9b77dfda62cc342 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Tue, 11 Jan 2022 12:03:23 +0800
 Subject: [PATCH 1003/1009] mt76: mt7915: air monitor support
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
index 378e0a3..242cfec 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
@@ -1,4 +1,4 @@
-From f942dbe1374ccf688477a532226dc55caa2ac72d Mon Sep 17 00:00:00 2001
+From 9252e4a6fbacaef7a3310d7d6773a6ad903e07c2 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:45:53 +0800
 Subject: [PATCH 1004/1009] mt76: mt7915: add support for muru_onoff via
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1005-mt76-mt7915-certification-patches.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1005-mt76-mt7915-certification-patches.patch
index 1ead9ba..823536c 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1005-mt76-mt7915-certification-patches.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1005-mt76-mt7915-certification-patches.patch
@@ -1,4 +1,4 @@
-From 2da7ca62781e48d7775df06318bc975182ec11e6 Mon Sep 17 00:00:00 2001
+From ce4f3cb268d50b49fbde125fc00b8bcac938f45d Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 6 Jun 2022 20:15:51 +0800
 Subject: [PATCH 1005/1009] mt76: mt7915: certification patches
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
index 2c4fbe8..407133d 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
@@ -1,4 +1,4 @@
-From f481ab038d6087eef48f89e097b0d821d4640d1b Mon Sep 17 00:00:00 2001
+From 3443cd5ba3c9678a1bb644cdcf40d3554abfbfb3 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Fri, 27 May 2022 15:51:48 +0800
 Subject: [PATCH 1006/1009] mt76: mt7915:add support for runtime set in-band
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
index 18262bf..2e6b0f5 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
@@ -1,4 +1,4 @@
-From 18accd0fdefb61e9edd2d425b7ca8a363402f0df Mon Sep 17 00:00:00 2001
+From 82128a5100d8760dcb5a0b66011345a279ca55fb Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:53:43 +0800
 Subject: [PATCH 1007/1009] mt76: mt7915: add mt76 vendor muru onoff command
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1008-mt76-mt7915-drop-undefined-action-frame.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1008-mt76-mt7915-drop-undefined-action-frame.patch
index 6eff0ae..3538edb 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1008-mt76-mt7915-drop-undefined-action-frame.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1008-mt76-mt7915-drop-undefined-action-frame.patch
@@ -1,4 +1,4 @@
-From 8c5a000a492457202b6fe8518f42a2515238b528 Mon Sep 17 00:00:00 2001
+From 0d3ed509726d42b595448135272a18e72d32ea85 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 14 Apr 2022 15:18:02 +0800
 Subject: [PATCH 1008/1009] mt76: mt7915: drop undefined action frame
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1009-mt76-mt7915-add-fw_version-dump.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1009-mt76-mt7915-add-fw_version-dump.patch
index 4af0e5b..c0a81f3 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1009-mt76-mt7915-add-fw_version-dump.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1009-mt76-mt7915-add-fw_version-dump.patch
@@ -1,4 +1,4 @@
-From eba9059676a9a0012aed63fbc800e1f6b2a2a381 Mon Sep 17 00:00:00 2001
+From 2c612e7daf9f26ee8f1a77bb5d52858ae033923e Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 17 Aug 2022 13:40:24 +0800
 Subject: [PATCH 1009/1009] mt76: mt7915: add fw_version dump
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1111-mt76-mt7915-rework-testmode-init-registers.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1111-mt76-mt7915-rework-testmode-init-registers.patch
index 4b36dae..70aac7a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1111-mt76-mt7915-rework-testmode-init-registers.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1111-mt76-mt7915-rework-testmode-init-registers.patch
@@ -1,7 +1,7 @@
-From 41e8c107e1e3e4ecc5b99d9066702b9b560abf6e Mon Sep 17 00:00:00 2001
+From 4f5ff04c48922ddbbffa73965f086b1b0c2a2e68 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 6 Jun 2022 19:46:26 +0800
-Subject: [PATCH 1111/1128] mt76: mt7915: rework testmode init registers
+Subject: [PATCH 1111/1129] mt76: mt7915: rework testmode init registers
 
 ---
  mac80211.c        |   3 +-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1112-mt76-testmode-additional-supports.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1112-mt76-testmode-additional-supports.patch
index bc80d3f..6f358d1 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1112-mt76-testmode-additional-supports.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1112-mt76-testmode-additional-supports.patch
@@ -1,7 +1,7 @@
-From 26061a276c620654542fb96064f6537070e3f278 Mon Sep 17 00:00:00 2001
+From 54cc888e7dcd2b5855dc7c0a0f7a19a2703b1735 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Apr 2022 15:43:19 +0800
-Subject: [PATCH 1112/1128] mt76: testmode: additional supports
+Subject: [PATCH 1112/1129] mt76: testmode: additional supports
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1113-mt76-testmode-add-pre-cal-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1113-mt76-testmode-add-pre-cal-support.patch
index 676491e..68bc681 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1113-mt76-testmode-add-pre-cal-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1113-mt76-testmode-add-pre-cal-support.patch
@@ -1,7 +1,7 @@
-From 0efb01a98e1abbe39c141df4f7ab6aa2bbb55ad8 Mon Sep 17 00:00:00 2001
+From 42421ff7f8ef7bbc45a050c6f7590981862d91bd Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 31 Aug 2022 20:06:52 +0800
-Subject: [PATCH 1113/1128] mt76: testmode: add pre-cal support
+Subject: [PATCH 1113/1129] mt76: testmode: add pre-cal support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Change-Id: Ibfbbc3443de994eeb4daa5e364b0a90f5d7d3bcd
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1114-mt76-testmode-add-iBF-command-mode-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1114-mt76-testmode-add-iBF-command-mode-support.patch
index 87c53f9..c388f49 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1114-mt76-testmode-add-iBF-command-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1114-mt76-testmode-add-iBF-command-mode-support.patch
@@ -1,7 +1,7 @@
-From 2a26fd854c3b09d271571505cb22075fef30ae36 Mon Sep 17 00:00:00 2001
+From 1853a51568f7d4523d623941689df571fd9aeee1 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 12 Sep 2022 18:16:54 +0800
-Subject: [PATCH 1114/1128] mt76: testmode: add iBF command mode support
+Subject: [PATCH 1114/1129] mt76: testmode: add iBF command mode support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Change-Id: I7eea1d6412563f889e5774e787e58ce9eba001bd
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
index 9d0b040..8c03a50 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
@@ -1,7 +1,7 @@
-From 98bf3fe9efb60744e0de0cdbc16b6954d4586d2c Mon Sep 17 00:00:00 2001
+From e57d8aba69628acfc9ed8ba2d5c67f5faaa31d4e Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 27 Oct 2022 17:42:07 +0800
-Subject: [PATCH 1115/1128] mt76: testmode: add ZWDFS test mode support
+Subject: [PATCH 1115/1129] mt76: testmode: add ZWDFS test mode support
 
 Change-Id: I14d104b7158a35acf6b0595357d07fb87f5a9d94
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
index 18a49c0..c49d31d 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
@@ -1,7 +1,7 @@
-From 3a0e0ac5413c0705e0cb997c276f75360875b584 Mon Sep 17 00:00:00 2001
+From a0e8ed2e87607c70f76eed181a921ba9cf7d66c0 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Sun, 24 Apr 2022 10:07:00 +0800
-Subject: [PATCH 1116/1128] mt76: mt7915: init rssi in WTBL when add station
+Subject: [PATCH 1116/1129] mt76: mt7915: init rssi in WTBL when add station
 
 ---
  mt7915/main.c | 4 ++++
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
index 3a727dc..5e49ca7 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
@@ -1,7 +1,7 @@
-From 34332523e19b7689147f83936bac106934f935e0 Mon Sep 17 00:00:00 2001
+From 107c786501f44f62a41c8e01b2a4662fbaaa2926 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 4 Aug 2022 14:08:11 +0800
-Subject: [PATCH 1117/1128] mt76: mt7915: reduce TWT SP sent to FW for cert
+Subject: [PATCH 1117/1129] mt76: mt7915: reduce TWT SP sent to FW for cert
 
 Set TWT SP duration to 88 percent to prevent HW sends PPDU over TWT SP.
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
index 113fd2e..f144c24 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
@@ -1,7 +1,7 @@
-From b456d43fa8c053eb10dd20f29b61f0cdb25550a1 Mon Sep 17 00:00:00 2001
+From 676531d63f5206049fea3ee2301fab7a70a18d76 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 6 May 2022 15:58:42 +0800
-Subject: [PATCH 1118/1128] mt76: connac: airtime fairness feature off in
+Subject: [PATCH 1118/1129] mt76: connac: airtime fairness feature off in
  mac80211
 
 ---
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
index df9eb33..f7686bf 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
@@ -1,7 +1,7 @@
-From 6e7838964db8b046363f479ce898b18e09ed30fc Mon Sep 17 00:00:00 2001
+From 6ba6a1fa68f9ef87d3357e94b688e534210baa0d Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 20 May 2022 19:19:25 +0800
-Subject: [PATCH 1119/1128] mt76: mt7915: add mt7986 and mt7916 pre-calibration
+Subject: [PATCH 1119/1129] mt76: mt7915: add mt7986 and mt7916 pre-calibration
 
 Add pre-calibration for mt7986 and mt7916. It has different data size
 with mt7915. Group cal needs 54k and 94k for 2G + 5G and 2G + 6G,
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1120-mt76-mt7915-add-phy-capability-vendor-command.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1120-mt76-mt7915-add-phy-capability-vendor-command.patch
index d7cd7f4..4f555c1 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1120-mt76-mt7915-add-phy-capability-vendor-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1120-mt76-mt7915-add-phy-capability-vendor-command.patch
@@ -1,7 +1,7 @@
-From f93d67b6ae1b70d4fcf95db93951627362d174c8 Mon Sep 17 00:00:00 2001
+From 5955454208b5eb059911bc1c559d05e33d5d8e7c Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
 Date: Tue, 12 Jul 2022 10:04:35 -0700
-Subject: [PATCH 1120/1128] mt76: mt7915: add phy capability vendor command
+Subject: [PATCH 1120/1129] mt76: mt7915: add phy capability vendor command
 
 ---
  mt7915/mt7915.h |  1 +
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
index 7edac8d..e45911f 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
@@ -1,7 +1,7 @@
-From b36a1933047e93c0d3a048c53dfdd5a395a833cd Mon Sep 17 00:00:00 2001
+From 5a91524be285d368d1616a47df541a1c14314846 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 24 Jun 2022 11:15:45 +0800
-Subject: [PATCH 1121/1128] mt76: mt7915: add vendor subcmd EDCCA ctrl
+Subject: [PATCH 1121/1129] mt76: mt7915: add vendor subcmd EDCCA ctrl
  enable/threshold/compensation
 
 Change-Id: I06a3f94d5e444be894200e2b6588d76ed38d09d0
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1122-mt76-mt7915-implement-bin-file-mode.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1122-mt76-mt7915-implement-bin-file-mode.patch
index 01962a8..24c978f 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1122-mt76-mt7915-implement-bin-file-mode.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1122-mt76-mt7915-implement-bin-file-mode.patch
@@ -1,7 +1,7 @@
-From 117480121b8833507a563ecd319bcf57c270b977 Mon Sep 17 00:00:00 2001
+From 42cce8dd635255ae8652b6ed34d598d95ef599be Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 7 Jul 2022 11:09:59 +0800
-Subject: [PATCH 1122/1128] mt76: mt7915: implement bin file mode
+Subject: [PATCH 1122/1129] mt76: mt7915: implement bin file mode
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1123-mt76-mt7915-initialize-wcid.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1123-mt76-mt7915-initialize-wcid.patch
index 49d45f1..0231a99 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1123-mt76-mt7915-initialize-wcid.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1123-mt76-mt7915-initialize-wcid.patch
@@ -1,7 +1,7 @@
-From 409f3949513cb8bf94d696401be9864d0363b22f Mon Sep 17 00:00:00 2001
+From 9dc6af1c44883efd578f9a081264c43210e8e5b8 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 12 Jul 2022 13:56:07 +0800
-Subject: [PATCH 1123/1128] mt76: mt7915: initialize wcid
+Subject: [PATCH 1123/1129] mt76: mt7915: initialize wcid
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1124-mt76-mt7915-Add-hemu-dump-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1124-mt76-mt7915-Add-hemu-dump-support.patch
index 75e864d..ca5b014 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1124-mt76-mt7915-Add-hemu-dump-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1124-mt76-mt7915-Add-hemu-dump-support.patch
@@ -1,7 +1,7 @@
-From c977d69ea6fd5a6db3e889ef6d3baaae19d2aee7 Mon Sep 17 00:00:00 2001
+From eb8e083501dbca6db418cb2538cd1e50c51abde9 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Thu, 11 Aug 2022 18:09:45 -0700
-Subject: [PATCH 1124/1128] mt76: mt7915: Add hemu dump support
+Subject: [PATCH 1124/1129] mt76: mt7915: Add hemu dump support
 
 Change-Id: I521214f3feb6f0d528a9f550255050ffd1ec96d2
 ---
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
index 5a73958..1f2fe5b 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
@@ -1,7 +1,7 @@
-From f865459f3adbb780091ef0346f93ce65130412d4 Mon Sep 17 00:00:00 2001
+From e58fab916807bd40d8f3e7169e7a3e8df306878e Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 28 Oct 2022 10:15:56 +0800
-Subject: [PATCH 1125/1128] mt76: mt7915: add vendor subcmd three wire (PTA)
+Subject: [PATCH 1125/1129] mt76: mt7915: add vendor subcmd three wire (PTA)
  ctrl
 
 Change-Id: Ic1044698f294455594a0c6254f55326fdab90580
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch
index 5cf8574..0b8f9b8 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch
@@ -1,7 +1,7 @@
-From 191b449eb978f73b95143e8cf3ec1765b73eb609 Mon Sep 17 00:00:00 2001
+From 0a8c65105444a20637c868e376a322924b2429f2 Mon Sep 17 00:00:00 2001
 From: mtk27835 <shurong.wen@mediatek.com>
 Date: Wed, 7 Sep 2022 14:01:29 -0700
-Subject: [PATCH 1126/1128] mt76: mt7915: add ibf control vendor cmd
+Subject: [PATCH 1126/1129] mt76: mt7915: add ibf control vendor cmd
 
 Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
 ---
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
index b7ae10e..526fda5 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
@@ -1,7 +1,7 @@
-From 5a4f3c3d504087725ef9f47191b4a8edbf27b70e Mon Sep 17 00:00:00 2001
+From 1116673d44b71df37e01407ee6ebca0b6cc9f338 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 13 Oct 2022 13:22:05 +0800
-Subject: [PATCH 1127/1128] mt76: mt7915: add E3 re-bonding for low yield rate
+Subject: [PATCH 1127/1129] mt76: mt7915: add E3 re-bonding for low yield rate
  issue
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
index 00543cf..8d969ee 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
@@ -1,7 +1,7 @@
-From 3fb208eb0a314a489cd0f0c74d22cc01e6d99822 Mon Sep 17 00:00:00 2001
+From d0c879de4b067613307926ec75f0dd99081a3ef6 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 14 Oct 2022 11:15:13 +0800
-Subject: [PATCH 1128/1128] mt76: mt7915: support on off SW ACI through debugfs
+Subject: [PATCH 1128/1129] mt76: mt7915: support on off SW ACI through debugfs
 
 Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Change-Id: I8a9c277c41d1ba76f9737d8af6f42e5e8f00ba64
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1129-mt76-mt7915-add-bf-backoff-limit-table-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1129-mt76-mt7915-add-bf-backoff-limit-table-support.patch
new file mode 100644
index 0000000..4bf0dc1
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1129-mt76-mt7915-add-bf-backoff-limit-table-support.patch
@@ -0,0 +1,425 @@
+From c213af98be4f1ebe14930ce180a0c33b9180a339 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Mon, 5 Dec 2022 18:21:51 +0800
+Subject: [PATCH 1129/1129] mt76: mt7915: add bf backoff limit table support
+
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ eeprom.c         |  25 +++++++++-
+ mt76.h           |   8 +++
+ mt7915/debugfs.c |  73 ++++++++++++++++++++++++++--
+ mt7915/mcu.c     | 124 +++++++++++++++++++++++++++++++++++------------
+ mt7915/mcu.h     |   6 +++
+ mt7915/mt7915.h  |   4 +-
+ 6 files changed, 203 insertions(+), 37 deletions(-)
+
+diff --git a/eeprom.c b/eeprom.c
+index aac70efb..6290156f 100644
+--- a/eeprom.c
++++ b/eeprom.c
+@@ -308,7 +308,8 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
+ 	if (!mcs_rates)
+ 		mcs_rates = 10;
+ 
+-	memset(dest, target_power, sizeof(*dest));
++	memset(dest, target_power, sizeof(*dest) - sizeof(dest->path));
++	memset(&dest->path, 0, sizeof(dest->path));
+ 
+ 	if (!IS_ENABLED(CONFIG_OF))
+ 		return target_power;
+@@ -361,6 +362,28 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
+ 				     ARRAY_SIZE(dest->ru), val, len,
+ 				     target_power, txs_delta, &max_power);
+ 
++	val = mt76_get_of_array(np, "paths-cck", &len, ARRAY_SIZE(dest->path.cck));
++	mt76_apply_array_limit(dest->path.cck, ARRAY_SIZE(dest->path.cck), val,
++			       target_power, txs_delta, &max_power);
++
++	val = mt76_get_of_array(np, "paths-ofdm", &len, ARRAY_SIZE(dest->path.ofdm));
++	mt76_apply_array_limit(dest->path.ofdm, ARRAY_SIZE(dest->path.ofdm), val,
++			       target_power, txs_delta, &max_power);
++
++	val = mt76_get_of_array(np, "paths-ofdm-bf", &len, ARRAY_SIZE(dest->path.ofdm_bf));
++	mt76_apply_array_limit(dest->path.ofdm_bf, ARRAY_SIZE(dest->path.ofdm_bf), val,
++			       target_power, txs_delta, &max_power);
++
++	val = mt76_get_of_array(np, "paths-ru", &len, ARRAY_SIZE(dest->path.ru[0]) + 1);
++	mt76_apply_multi_array_limit(dest->path.ru[0], ARRAY_SIZE(dest->path.ru[0]),
++				     ARRAY_SIZE(dest->path.ru), val, len,
++				     target_power, txs_delta, &max_power);
++
++	val = mt76_get_of_array(np, "paths-ru-bf", &len, ARRAY_SIZE(dest->path.ru_bf[0]) + 1);
++	mt76_apply_multi_array_limit(dest->path.ru_bf[0], ARRAY_SIZE(dest->path.ru_bf[0]),
++				     ARRAY_SIZE(dest->path.ru_bf), val, len,
++				     target_power, txs_delta, &max_power);
++
+ 	return max_power;
+ }
+ EXPORT_SYMBOL_GPL(mt76_get_rate_power_limits);
+diff --git a/mt76.h b/mt76.h
+index d102333b..01baceaf 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -900,6 +900,14 @@ struct mt76_power_limits {
+ 	s8 ofdm[8];
+ 	s8 mcs[4][10];
+ 	s8 ru[7][12];
++
++	struct {
++		s8 cck[4];
++		s8 ofdm[4];
++		s8 ofdm_bf[4];
++		s8 ru[7][10];
++		s8 ru_bf[7][10];
++	} path;
+ };
+ 
+ struct mt76_ethtool_worker_info {
+diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
+index f1f3f2f3..3ef2148b 100644
+--- a/mt7915/debugfs.c
++++ b/mt7915/debugfs.c
+@@ -1024,7 +1024,7 @@ mt7915_rate_txpower_get(struct file *file, char __user *user_buf,
+ 	if (!buf)
+ 		return -ENOMEM;
+ 
+-	ret = mt7915_mcu_get_txpower_sku(phy, txpwr, sizeof(txpwr));
++	ret = mt7915_mcu_get_txpower_sku(phy, txpwr, sizeof(txpwr), TX_POWER_INFO_RATE);
+ 	if (ret)
+ 		goto out;
+ 
+@@ -1134,7 +1134,7 @@ mt7915_rate_txpower_set(struct file *file, const char __user *user_buf,
+ 
+ 	mutex_lock(&dev->mt76.mutex);
+ 	ret = mt7915_mcu_get_txpower_sku(phy, req.txpower_sku,
+-					 sizeof(req.txpower_sku));
++					 sizeof(req.txpower_sku), TX_POWER_INFO_RATE);
+ 	if (ret)
+ 		goto out;
+ 
+@@ -1176,7 +1176,7 @@ out:
+ 	return ret ? ret : count;
+ }
+ 
+-static const struct file_operations mt7915_rate_txpower_fops = {
++static const struct file_operations mt7915_txpower_fops = {
+ 	.write = mt7915_rate_txpower_set,
+ 	.read = mt7915_rate_txpower_get,
+ 	.open = simple_open,
+@@ -1184,6 +1184,69 @@ static const struct file_operations mt7915_rate_txpower_fops = {
+ 	.llseek = default_llseek,
+ };
+ 
++static int
++mt7915_path_txpower_show(struct seq_file *file)
++{
++	struct mt7915_phy *phy = file->private;
++	s8 txpower[MT7915_SKU_PATH_NUM], *buf = txpower;
++	int ret;
++
++#define PATH_POWER_SHOW(_name, _len, _skip) do {				\
++		if (_skip) {						\
++			buf -= 1;					\
++			*buf = 0;					\
++		}							\
++		mt76_seq_puts_array(file, _name, buf, _len);		\
++		buf += _len;						\
++	} while(0)
++
++	seq_printf(file, "\n%*c", 11, ' ');
++	seq_printf(file, "1T1S/2T1S/3T1S/4T1S/2T2S/3T2S/4T2S/3T3S/4T3S/4T4S\n");
++	ret = mt7915_mcu_get_txpower_sku(phy, txpower, sizeof(txpower),
++					 TX_POWER_INFO_PATH);
++	if (ret)
++		return ret;
++
++	PATH_POWER_SHOW("CCK", 4, 0);
++	PATH_POWER_SHOW("OFDM", 4, 0);
++	PATH_POWER_SHOW("BF-OFDM", 4, 1);
++
++	PATH_POWER_SHOW("HT20", 10, 0);
++	PATH_POWER_SHOW("BF-HT20", 10, 1);
++	PATH_POWER_SHOW("HT40", 10, 0);
++	PATH_POWER_SHOW("BF-HT40", 10, 1);
++
++	PATH_POWER_SHOW("RU242", 10, 0);
++	PATH_POWER_SHOW("BF-RU242", 10, 1);
++	PATH_POWER_SHOW("RU484", 10, 0);
++	PATH_POWER_SHOW("BF-RU484", 10, 1);
++	PATH_POWER_SHOW("RU996", 10, 0);
++	PATH_POWER_SHOW("BF-RU996", 10, 1);
++	PATH_POWER_SHOW("RU2x996", 10, 0);
++	PATH_POWER_SHOW("BF-RU2x996", 10, 1);
++	PATH_POWER_SHOW("RU26", 10, 0);
++	PATH_POWER_SHOW("BF-RU26", 10, 0);
++	PATH_POWER_SHOW("RU52", 10, 0);
++	PATH_POWER_SHOW("BF-RU52", 10, 0);
++	PATH_POWER_SHOW("RU106", 10, 0);
++	PATH_POWER_SHOW("BF-RU106", 10, 0);
++#undef PATH_POWER_SHOW
++
++	return 0;
++}
++
++static int
++mt7915_txpower_path_show(struct seq_file *file, void *data)
++{
++	struct mt7915_phy *phy = file->private;
++
++	seq_printf(file, "\nBand %d\n", phy != &phy->dev->phy);
++
++	return mt7915_path_txpower_show(file);
++}
++
++DEFINE_SHOW_ATTRIBUTE(mt7915_txpower_path);
++
+ static int
+ mt7915_twt_stats(struct seq_file *s, void *data)
+ {
+@@ -1270,7 +1333,9 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+ 	debugfs_create_file("implicit_txbf", 0600, dir, dev,
+ 			    &fops_implicit_txbf);
+ 	debugfs_create_file("txpower_sku", 0400, dir, phy,
+-			    &mt7915_rate_txpower_fops);
++			    &mt7915_txpower_fops);
++	debugfs_create_file("txpower_path", 0400, dir, phy,
++			    &mt7915_txpower_path_fops);
+ 	debugfs_create_devm_seqfile(dev->mt76.dev, "twt_stats", dir,
+ 				    mt7915_twt_stats);
+ 	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 785c3c10..4b7ad450 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -3259,7 +3259,8 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+ 	int ret;
+ 	s8 txpower_sku[MT7915_SKU_RATE_NUM];
+ 
+-	ret = mt7915_mcu_get_txpower_sku(phy, txpower_sku, sizeof(txpower_sku));
++	ret = mt7915_mcu_get_txpower_sku(phy, txpower_sku, sizeof(txpower_sku),
++					 TX_POWER_INFO_RATE);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -3301,51 +3302,98 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+ 
+ int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
+ {
++#define TX_POWER_LIMIT_TABLE_RATE	0
++#define TX_POWER_LIMIT_TABLE_PATH	1
+ 	struct mt7915_dev *dev = phy->dev;
+ 	struct mt76_phy *mphy = phy->mt76;
+ 	struct ieee80211_hw *hw = mphy->hw;
+-	struct mt7915_mcu_txpower_sku req = {
++	struct mt7915_sku_val {
++		u8 format_id;
++		u8 limit_type;
++		u8 band_idx;
++	} __packed hdr = {
+ 		.format_id = TX_POWER_LIMIT_TABLE,
++		.limit_type = TX_POWER_LIMIT_TABLE_RATE,
+ 		.band_idx = phy->mt76->band_idx,
+ 	};
+-	struct mt76_power_limits limits_array;
+-	s8 *la = (s8 *)&limits_array;
+-	int i, idx;
+-	int tx_power;
++	int i, ret, tx_power;
++	const u8 *len = mt7915_sku_group_len;
++	struct mt76_power_limits la = {};
++	struct sk_buff *skb;
+ 
+ 	tx_power = mt7915_get_power_bound(phy, hw->conf.power_level);
+ 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
+-					      &limits_array, tx_power);
++					      &la, tx_power);
+ 	mphy->txpower_cur = tx_power;
+ 
+-	for (i = 0, idx = 0; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
+-		u8 mcs_num, len = mt7915_sku_group_len[i];
+-		int j;
++	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
++				 sizeof(hdr) + MT7915_SKU_RATE_NUM);
++	if (!skb)
++		return -ENOMEM;
+ 
+-		if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
+-			mcs_num = 10;
++	skb_put_data(skb, &hdr, sizeof(hdr));
++	skb_put_data(skb, &la.cck, len[SKU_CCK] + len[SKU_OFDM]);
++	skb_put_data(skb, &la.mcs[0], len[SKU_HT_BW20]);
++	skb_put_data(skb, &la.mcs[1], len[SKU_HT_BW40]);
+ 
+-			if (i == SKU_HT_BW20 || i == SKU_VHT_BW20)
+-				la = (s8 *)&limits_array + 12;
+-		} else {
+-			mcs_num = len;
+-		}
++	/* vht */
++	for (i = 0; i < 4; i++) {
++		skb_put_data(skb, &la.mcs[i], sizeof(la.mcs[i]));
++		skb_put_zero(skb, 2);  /* padding */
++	}
++
++	/* he */
++	skb_put_data(skb, &la.ru[0], sizeof(la.ru));
++
++	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
++				    MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), true);
++	if (ret)
++		return ret;
++
++	/* only set per-path power table when it's configured */
++	if (!la.path.ofdm[0])
++		return 0;
+ 
+-		for (j = 0; j < min_t(u8, mcs_num, len); j++)
+-			req.txpower_sku[idx + j] = la[j];
++	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
++				 sizeof(hdr) + MT7915_SKU_PATH_NUM);
++	if (!skb)
++		return -ENOMEM;
+ 
+-		la += mcs_num;
+-		idx += len;
++	hdr.limit_type = TX_POWER_LIMIT_TABLE_PATH;
++	skb_put_data(skb, &hdr, sizeof(hdr));
++	skb_put_data(skb, &la.path.cck, sizeof(la.path.cck));
++	skb_put_data(skb, &la.path.ofdm, sizeof(la.path.ofdm));
++	skb_put_data(skb, &la.path.ofdm_bf[1], sizeof(la.path.ofdm_bf) - 1);
++
++	/* HT20 and HT40 */
++	skb_put_data(skb, &la.path.ru[0], sizeof(la.path.ru[0]));
++	skb_put_data(skb, &la.path.ru_bf[0][1], sizeof(la.path.ru_bf[0]) - 1);
++	skb_put_data(skb, &la.path.ru[1], sizeof(la.path.ru[1]));
++	skb_put_data(skb, &la.path.ru_bf[1][1], sizeof(la.path.ru_bf[1]) - 1);
++
++	/* start from non-bf and bf fields of
++	 * BW20/RU242, BW40/RU484, BW80/RU996, BW160/RU2x996,
++	 * RU26, RU52, and RU106
++	 */
++	for (i = 7; i < 21; i++) {
++		bool bf = !(i % 2);
++		u8 idx = (i - 7) / 2;
++		s8 *buf = bf ? la.path.ru_bf[idx] : la.path.ru[idx];
++
++		/* The non-bf fields of RU26 to RU106 are special cases */
++		if (bf && i < 15)
++			skb_put_data(skb, buf + 1, 9);
++		else
++			skb_put_data(skb, buf, 10);
+ 	}
+ 
+-	return mt76_mcu_send_msg(&dev->mt76,
+-				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
+-				 sizeof(req), true);
++	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
++ 				     MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), true);
+ }
+ 
+-int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
++int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
++			       u8 category)
+ {
+-#define RATE_POWER_INFO	2
+ 	struct mt7915_dev *dev = phy->dev;
+ 	struct {
+ 		u8 format_id;
+@@ -3354,10 +3402,9 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
+ 		u8 _rsv;
+ 	} __packed req = {
+ 		.format_id = TX_POWER_LIMIT_INFO,
+-		.category = RATE_POWER_INFO,
++		.category = category,
+ 		.band_idx = phy->mt76->band_idx,
+ 	};
+-	s8 txpower_sku[MT7915_SKU_RATE_NUM][2];
+ 	struct sk_buff *skb;
+ 	int ret, i;
+ 
+@@ -3367,9 +3414,15 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
+ 	if (ret)
+ 		return ret;
+ 
+-	memcpy(txpower_sku, skb->data + 4, sizeof(txpower_sku));
+-	for (i = 0; i < len; i++)
+-		txpower[i] = txpower_sku[i][req.band_idx];
++	if (category == TX_POWER_INFO_RATE) {
++		s8 res[MT7915_SKU_RATE_NUM][2];
++
++		memcpy(res, skb->data + 4, sizeof(res));
++		for (i = 0; i < len; i++)
++			txpower[i] = res[i][req.band_idx];
++	} else if (category == TX_POWER_INFO_PATH) {
++		memcpy(txpower, skb->data + 4, len);
++	}
+ 
+ 	dev_kfree_skb(skb);
+ 
+@@ -3411,9 +3464,18 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+ 		.band_idx = phy->mt76->band_idx,
+ 		.sku_enable = enable,
+ 	};
++	int ret;
++
++	ret = mt76_mcu_send_msg(&dev->mt76,
++				MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
++				sizeof(req), true);
++	if (ret)
++		return ret;
+ 
+ 	pr_info("%s: enable = %d\n", __func__, enable);
+ 
++	req.format_id = TX_POWER_LIMIT_PATH_ENABLE;
++ 
+ 	return mt76_mcu_send_msg(&dev->mt76,
+ 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
+ 				 sizeof(req), true);
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index 08476eb6..d110e210 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -446,12 +446,18 @@ enum {
+ 
+ enum {
+ 	TX_POWER_LIMIT_ENABLE,
++	TX_POWER_LIMIT_PATH_ENABLE = 0x3,
+ 	TX_POWER_LIMIT_TABLE = 0x4,
+ 	TX_POWER_LIMIT_INFO = 0x7,
+ 	TX_POWER_LIMIT_FRAME = 0x11,
+ 	TX_POWER_LIMIT_FRAME_MIN = 0x12,
+ };
+ 
++enum {
++	TX_POWER_INFO_PATH = 1,
++	TX_POWER_INFO_RATE,
++};
++
+ enum {
+ 	SPR_ENABLE = 0x1,
+ 	SPR_ENABLE_SD = 0x3,
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 2d3769c6..2e6519e7 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -73,6 +73,7 @@
+ #define MT7915_CDEV_THROTTLE_MAX	99
+ 
+ #define MT7915_SKU_RATE_NUM		161
++#define MT7915_SKU_PATH_NUM		185
+ 
+ #define MT7915_MAX_TWT_AGRT		16
+ #define MT7915_MAX_STA_TWT_AGRT		8
+@@ -624,7 +625,8 @@ int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
+ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
+ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable);
+ int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
+-int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len);
++int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
++			       u8 category);
+ int mt7915_mcu_set_txpower_frame_min(struct mt7915_phy *phy, s8 txpower);
+ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+ 				 struct ieee80211_vif *vif,
+-- 
+2.25.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3001-mt76-mt7915-wed-add-wed-tx-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3001-mt76-mt7915-wed-add-wed-tx-support.patch
index 84aeced..3086d77 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3001-mt76-mt7915-wed-add-wed-tx-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3001-mt76-mt7915-wed-add-wed-tx-support.patch
@@ -1,4 +1,4 @@
-From 30ce8783532bc157e2639b4a91aecb3c050d1bf6 Mon Sep 17 00:00:00 2001
+From aa48497ccb0236e8724d8434be06055e31297e93 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 10:38:53 +0800
 Subject: [PATCH 3001/3011] mt76: mt7915: wed: add wed tx support
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3002-mt76-mt7915-wed-add-wed-tx-wds-support-on-mt7986.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3002-mt76-mt7915-wed-add-wed-tx-wds-support-on-mt7986.patch
index a9f6d89..829a48a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3002-mt76-mt7915-wed-add-wed-tx-wds-support-on-mt7986.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3002-mt76-mt7915-wed-add-wed-tx-wds-support-on-mt7986.patch
@@ -1,4 +1,4 @@
-From a92a1c7b40b57f5d6594ae8170d7d9e3cd993aef Mon Sep 17 00:00:00 2001
+From 8c5f91270dc8d3a1b8d36a00130bbe0450dbfe61 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Sat, 10 Sep 2022 17:09:21 +0800
 Subject: [PATCH 3002/3011] mt76: mt7915: wed: add-wed-tx-wds-support-on-mt7986
@@ -32,7 +32,7 @@
  }
  EXPORT_SYMBOL_GPL(__mt76_sta_remove);
 diff --git a/mt76.h b/mt76.h
-index d102333b..74818a59 100644
+index 01baceaf..fb8c15eb 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -465,6 +465,7 @@ struct mt76_driver_ops {
@@ -150,7 +150,7 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 785c3c10..0ad110ff 100644
+index 4b7ad450..3b16a7fb 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -2321,6 +2321,7 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
@@ -180,7 +180,7 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 08476eb6..cf1d7d7a 100644
+index d110e210..b30cc820 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -288,6 +288,7 @@ enum {
@@ -204,7 +204,7 @@
  	struct mt7915_dev *dev;
  	struct mt76_dev *mdev;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 2d3769c6..51453058 100644
+index 2e6519e7..836d485f 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -18,6 +18,9 @@
@@ -217,7 +217,7 @@
  #define MT7915_WATCHDOG_TIME		(HZ / 10)
  #define MT7915_RESET_TIMEOUT		(30 * HZ)
  
-@@ -724,6 +727,7 @@ void mt7915_tx_token_put(struct mt7915_dev *dev);
+@@ -726,6 +729,7 @@ void mt7915_tx_token_put(struct mt7915_dev *dev);
  void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  			 struct sk_buff *skb, u32 *info);
  bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
index 86404b0..ee14206 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
@@ -1,4 +1,4 @@
-From bd9310d73f9c7396d06e60fc10ff554a8e02817f Mon Sep 17 00:00:00 2001
+From ca14459b70818a138fa83ec38bfc91bce44b645c Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 12:05:06 +0800
 Subject: [PATCH 3003/3011] mt76: connac: wed: add wed rx copy skb
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
index 86dff09..0835b2c 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
@@ -1,4 +1,4 @@
-From 705e520c10a4f08bf5b24b56b5ddb015e27c7b99 Mon Sep 17 00:00:00 2001
+From 9c13748447e65404ad43c95b11479b71557851d8 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 19 May 2022 13:44:42 +0800
 Subject: [PATCH 3004/3011] mt76: mt7915: wed: add fill receive path to report
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
index 4b36261..895588a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
@@ -1,4 +1,4 @@
-From 47cfa806f1e2945d1d63f3642207cbdb205e9a12 Mon Sep 17 00:00:00 2001
+From e199b3a9a4dcf01c00fd367e7dea297b0c0e308b Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 14:07:46 +0800
 Subject: [PATCH 3005/3011] mt76: mt7915: wed: add ser support when wed on
@@ -120,10 +120,10 @@
  
  #endif
 diff --git a/mt76.h b/mt76.h
-index 74818a59..b7fa1724 100644
+index fb8c15eb..b107516d 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1383,6 +1383,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1391,6 +1391,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  void mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  struct mt76_txwi_cache *mt76_get_rxwi(struct mt76_dev *dev);
@@ -268,10 +268,10 @@
  	dev->mt76.rx_token_size = wed->wlan.rx_npkt;
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 51453058..c39be358 100644
+index 836d485f..8ea75fb9 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -561,6 +561,7 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
+@@ -562,6 +562,7 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
  irqreturn_t mt7915_irq_handler(int irq, void *dev_instance);
  u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif);
  u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
index 254e6f0..ed5376a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
@@ -1,4 +1,4 @@
-From 10e8cbecc7872f0ad0d18ef37713362da3f9600d Mon Sep 17 00:00:00 2001
+From 07b444485d3b25b459d5e2a9a9b84ccb0613a1db Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 2 Sep 2022 14:40:40 +0800
 Subject: [PATCH 3006/3011] mt76: mt7915: wed: enable red per-band token drop
@@ -16,7 +16,7 @@
  3 files changed, 46 insertions(+), 11 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 0ad110ff..fcb15fb5 100644
+index 3b16a7fb..2cfd5f4a 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -2359,8 +2359,13 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
@@ -47,7 +47,7 @@
  }
  
  int mt7915_mcu_init(struct mt7915_dev *dev)
-@@ -4445,6 +4445,35 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
+@@ -4507,6 +4507,35 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
  
  	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), wait_resp);
  }
@@ -83,7 +83,7 @@
  
  int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
  {
-@@ -4455,17 +4484,21 @@ int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
+@@ -4517,17 +4546,21 @@ int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
  	u32 red_type = enabled > 0 ? RED_BY_WA_ENABLE : RED_DISABLE;
  	__le32 req = cpu_to_le32(red_type);
  
@@ -110,7 +110,7 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index cf1d7d7a..49728514 100644
+index b30cc820..9f882042 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -289,6 +289,7 @@ enum {
@@ -122,10 +122,10 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index c39be358..2c0aee1e 100644
+index 8ea75fb9..def78c67 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -773,13 +773,14 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+@@ -775,13 +775,14 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  #endif
  int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value, s8 compensation);
  int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch
index 29f1072..c4af9df 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch
@@ -1,4 +1,4 @@
-From 1f69487aed883d7ea07b50a10f87b30db329043c Mon Sep 17 00:00:00 2001
+From f30bc7032eeb4a32393bdec69e719e3a1c9ceeae Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 22 Sep 2022 09:54:53 +0800
 Subject: [PATCH 3007/3011] mt76: mt7915: wed: update mt7916 trinfo when hw
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
index 9d9765b..afafd01 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
@@ -1,4 +1,4 @@
-From 7f80dae506d79a41a7357ec14bd6dabdeeb9cd4f Mon Sep 17 00:00:00 2001
+From 82ba992b09e55d1291387351cc9dc0da0c6cb66b Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 14:32:35 +0800
 Subject: [PATCH 3008/3011] mt76: mt7915: wed: find rx token by physical
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
index 8720477..dc1c019 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
@@ -1,4 +1,4 @@
-From c37cd3ad8c8ed0ddcf18858263edeee80c9e40b6 Mon Sep 17 00:00:00 2001
+From 7b8d03a4a4996e29c178a870c29b8ba7bd45c6d6 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 25 Nov 2022 14:37:58 +0800
 Subject: [PATCH 3009/3011] mt76: mt7915: wed: drop scatter and gather frame
@@ -46,7 +46,7 @@
  #define MT_DMA_PPE_CPU_REASON		GENMASK(15, 11)
  #define MT_DMA_PPE_ENTRY		GENMASK(30, 16)
 diff --git a/mt76.h b/mt76.h
-index b7fa1724..7a5b0b61 100644
+index b107516d..5bdf03f2 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -30,6 +30,7 @@
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
index 796cd51..e4ed9eb 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
@@ -1,4 +1,4 @@
-From 78409553ecdb43e9b22bb951f3d993d42f120e7c Mon Sep 17 00:00:00 2001
+From 1312c8e16c778c9c42f993466caf6fee4b7d2f3f Mon Sep 17 00:00:00 2001
 From: Lian Chen <lian.chen@mediatek.com>
 Date: Mon, 7 Nov 2022 14:47:44 +0800
 Subject: [PATCH 3010/3011] mt76: mt7915: wed: HW ATF support for mt7986
@@ -36,7 +36,7 @@
  	MCU_EXT_CMD_EFUSE_FREE_BLOCK = 0x4f,
  	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index f1f3f2f3..f3b039ff 100644
+index 3ef2148b..b178036c 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -12,6 +12,10 @@
@@ -457,7 +457,7 @@
  static int
  mt7915_radar_trigger(void *data, u64 val)
  {
-@@ -1274,6 +1678,7 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+@@ -1339,6 +1743,7 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
  	debugfs_create_devm_seqfile(dev->mt76.dev, "twt_stats", dir,
  				    mt7915_twt_stats);
  	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
@@ -577,10 +577,10 @@
  }
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index fcb15fb5..ff207f70 100644
+index 2cfd5f4a..4acca9d9 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3444,6 +3444,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
+@@ -3506,6 +3506,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
  				 &req, sizeof(req), false);
  }
  
@@ -753,10 +753,10 @@
  {
  	struct {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 2c0aee1e..afd99498 100644
+index def78c67..0fb1de3e 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -132,6 +132,58 @@ struct mt7915_twt_flow {
+@@ -133,6 +133,58 @@ struct mt7915_twt_flow {
  
  DECLARE_EWMA(avg_signal, 10, 8)
  
@@ -815,7 +815,7 @@
  struct mt7915_sta {
  	struct mt76_wcid wcid; /* must be first */
  
-@@ -153,6 +205,7 @@ struct mt7915_sta {
+@@ -154,6 +206,7 @@ struct mt7915_sta {
  		u8 flowid_mask;
  		struct mt7915_twt_flow flow[MT7915_MAX_STA_TWT_AGRT];
  	} twt;
@@ -823,7 +823,7 @@
  };
  
  struct mt7915_vif_cap {
-@@ -467,6 +520,8 @@ struct mt7915_dev {
+@@ -468,6 +521,8 @@ struct mt7915_dev {
  	} dbg;
  	const struct mt7915_dbg_reg_desc *dbg_reg;
  #endif
@@ -832,7 +832,7 @@
  };
  
  enum {
-@@ -499,6 +554,15 @@ enum mt7915_rdd_cmd {
+@@ -500,6 +555,15 @@ enum mt7915_rdd_cmd {
  	RDD_IRQ_OFF,
  };
  
@@ -848,7 +848,7 @@
  static inline struct mt7915_phy *
  mt7915_hw_phy(struct ieee80211_hw *hw)
  {
-@@ -626,6 +690,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
+@@ -627,6 +691,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
  int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
  			      u8 en);
  int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
@@ -858,7 +858,7 @@
 +int mt7915_mcu_set_vow_band(struct mt7915_dev *dev, struct mt7915_vif *mvif);
  int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable);
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
- int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len);
+ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
 index 3365f3f3..a8ffefd4 100644
 --- a/mt7915/mtk_debugfs.c
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
index c7f7081..0a00aef 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
@@ -1,4 +1,4 @@
-From 0431d98e1a656f59c4fab110897e7e9bc092cc5a Mon Sep 17 00:00:00 2001
+From b9cfe422dcdce6badd19d45b23affb51e6820300 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 2 Dec 2022 17:17:06 +0800
 Subject: [PATCH 3011/3011] mt76: mt7915: wed: add mt7916 2 pcie support when
@@ -34,7 +34,7 @@
  				   MT7916_RXQ_MCU_WA_MAIN);
  			TXQ_CONFIG(0, WFDMA0, MT_INT_WED_TX_DONE_BAND0,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index ff207f70..737a714f 100644
+index 4acca9d9..1cdb9d45 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -2352,7 +2352,7 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/4000-mt76-revert-get_of_mac_addr.patch b/recipes-wifi/linux-mt76/files/patches-3.x/4000-mt76-revert-get_of_mac_addr.patch
index dc83560..6e61567 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/4000-mt76-revert-get_of_mac_addr.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/4000-mt76-revert-get_of_mac_addr.patch
@@ -1,4 +1,4 @@
-From dbc09e842e33cecb9e6237ed0664c9fc1f12a412 Mon Sep 17 00:00:00 2001
+From e362fcbdcdf2e01840aaa03bf432535c5485463c Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 13 Dec 2022 10:51:46 +0800
 Subject: [PATCH 4000/4002] mt76: revert get_of_mac_addr
@@ -8,7 +8,7 @@
  1 file changed, 7 insertions(+), 1 deletion(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index aac70efb..bb9265cc 100644
+index 6290156f..306c6412 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -126,9 +126,15 @@ void
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-include-header-files-for-module-param.patch b/recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-include-header-files-for-module-param.patch
index cc3a10d..941caaa 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-include-header-files-for-module-param.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-include-header-files-for-module-param.patch
@@ -1,4 +1,4 @@
-From 51c0737433ea318d6897585366de4af124c0bb4a Mon Sep 17 00:00:00 2001
+From ee4fac966742080be4cdcfa9fdb258752d90671a Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 13 Dec 2022 10:38:13 +0800
 Subject: [PATCH 4001/4002] mt76: include header files for module param
@@ -47,7 +47,7 @@
  int mt76_connac_mcu_start_firmware(struct mt76_dev *dev, u32 addr, u32 option)
  {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 737a714f..e08a96d9 100644
+index 1cdb9d45..69f1a0d4 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -6,6 +6,7 @@
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc b/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
index 6985ba6..edd01f5 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
@@ -27,6 +27,7 @@
     file://1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch \
     file://1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch \
     file://1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch \
+    file://1129-mt76-mt7915-add-bf-backoff-limit-table-support.patch \
     file://3001-mt76-mt7915-wed-add-wed-tx-support.patch \
     file://3002-mt76-mt7915-wed-add-wed-tx-wds-support-on-mt7986.patch \
     file://3003-mt76-connac-wed-add-wed-rx-copy-skb.patch \
diff --git a/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch b/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
index e194f7d..c9e83a4 100644
--- a/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
@@ -1,4 +1,4 @@
-From b9974cb5e246a0b7f999e16c1e6dc48bb65737f2 Mon Sep 17 00:00:00 2001
+From 33d41ea84a29d895fc07019aa5c6f79811e59b14 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 22 Jun 2022 10:39:47 +0800
 Subject: [PATCH 1001/1009] mt76: mt7915: add mtk internal debug tools for mt76
diff --git a/recipes-wifi/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch b/recipes-wifi/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
index 5f2a8e3..7bc8f15 100644
--- a/recipes-wifi/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
@@ -1,4 +1,4 @@
-From 60ac6480474b349c21c256f4d720baa2c6622b2f Mon Sep 17 00:00:00 2001
+From d5e0407913c33119fd697d626cb3fd87b44f9689 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Jun 2022 20:13:02 +0800
 Subject: [PATCH 1002/1009] mt76: mt7915: csi: implement csi support
diff --git a/recipes-wifi/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch b/recipes-wifi/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
index 1e6158a..1078874 100644
--- a/recipes-wifi/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
@@ -1,4 +1,4 @@
-From 088b6c6f35ed5213deae1b4515375632457ec90f Mon Sep 17 00:00:00 2001
+From 0a7547997d9a2f44574b4562b9b77dfda62cc342 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Tue, 11 Jan 2022 12:03:23 +0800
 Subject: [PATCH 1003/1009] mt76: mt7915: air monitor support
diff --git a/recipes-wifi/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch b/recipes-wifi/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
index 378e0a3..242cfec 100644
--- a/recipes-wifi/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
@@ -1,4 +1,4 @@
-From f942dbe1374ccf688477a532226dc55caa2ac72d Mon Sep 17 00:00:00 2001
+From 9252e4a6fbacaef7a3310d7d6773a6ad903e07c2 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:45:53 +0800
 Subject: [PATCH 1004/1009] mt76: mt7915: add support for muru_onoff via
diff --git a/recipes-wifi/linux-mt76/files/patches/1005-mt76-mt7915-certification-patches.patch b/recipes-wifi/linux-mt76/files/patches/1005-mt76-mt7915-certification-patches.patch
index 1ead9ba..823536c 100644
--- a/recipes-wifi/linux-mt76/files/patches/1005-mt76-mt7915-certification-patches.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1005-mt76-mt7915-certification-patches.patch
@@ -1,4 +1,4 @@
-From 2da7ca62781e48d7775df06318bc975182ec11e6 Mon Sep 17 00:00:00 2001
+From ce4f3cb268d50b49fbde125fc00b8bcac938f45d Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 6 Jun 2022 20:15:51 +0800
 Subject: [PATCH 1005/1009] mt76: mt7915: certification patches
diff --git a/recipes-wifi/linux-mt76/files/patches/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch b/recipes-wifi/linux-mt76/files/patches/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
index 2c4fbe8..407133d 100644
--- a/recipes-wifi/linux-mt76/files/patches/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
@@ -1,4 +1,4 @@
-From f481ab038d6087eef48f89e097b0d821d4640d1b Mon Sep 17 00:00:00 2001
+From 3443cd5ba3c9678a1bb644cdcf40d3554abfbfb3 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Fri, 27 May 2022 15:51:48 +0800
 Subject: [PATCH 1006/1009] mt76: mt7915:add support for runtime set in-band
diff --git a/recipes-wifi/linux-mt76/files/patches/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch b/recipes-wifi/linux-mt76/files/patches/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
index 18262bf..2e6b0f5 100644
--- a/recipes-wifi/linux-mt76/files/patches/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
@@ -1,4 +1,4 @@
-From 18accd0fdefb61e9edd2d425b7ca8a363402f0df Mon Sep 17 00:00:00 2001
+From 82128a5100d8760dcb5a0b66011345a279ca55fb Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:53:43 +0800
 Subject: [PATCH 1007/1009] mt76: mt7915: add mt76 vendor muru onoff command
diff --git a/recipes-wifi/linux-mt76/files/patches/1008-mt76-mt7915-drop-undefined-action-frame.patch b/recipes-wifi/linux-mt76/files/patches/1008-mt76-mt7915-drop-undefined-action-frame.patch
index 6eff0ae..3538edb 100644
--- a/recipes-wifi/linux-mt76/files/patches/1008-mt76-mt7915-drop-undefined-action-frame.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1008-mt76-mt7915-drop-undefined-action-frame.patch
@@ -1,4 +1,4 @@
-From 8c5a000a492457202b6fe8518f42a2515238b528 Mon Sep 17 00:00:00 2001
+From 0d3ed509726d42b595448135272a18e72d32ea85 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 14 Apr 2022 15:18:02 +0800
 Subject: [PATCH 1008/1009] mt76: mt7915: drop undefined action frame
diff --git a/recipes-wifi/linux-mt76/files/patches/1009-mt76-mt7915-add-fw_version-dump.patch b/recipes-wifi/linux-mt76/files/patches/1009-mt76-mt7915-add-fw_version-dump.patch
index 4af0e5b..c0a81f3 100644
--- a/recipes-wifi/linux-mt76/files/patches/1009-mt76-mt7915-add-fw_version-dump.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1009-mt76-mt7915-add-fw_version-dump.patch
@@ -1,4 +1,4 @@
-From eba9059676a9a0012aed63fbc800e1f6b2a2a381 Mon Sep 17 00:00:00 2001
+From 2c612e7daf9f26ee8f1a77bb5d52858ae033923e Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 17 Aug 2022 13:40:24 +0800
 Subject: [PATCH 1009/1009] mt76: mt7915: add fw_version dump
diff --git a/recipes-wifi/linux-mt76/files/patches/1111-mt76-mt7915-rework-testmode-init-registers.patch b/recipes-wifi/linux-mt76/files/patches/1111-mt76-mt7915-rework-testmode-init-registers.patch
index 4b36dae..70aac7a 100644
--- a/recipes-wifi/linux-mt76/files/patches/1111-mt76-mt7915-rework-testmode-init-registers.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1111-mt76-mt7915-rework-testmode-init-registers.patch
@@ -1,7 +1,7 @@
-From 41e8c107e1e3e4ecc5b99d9066702b9b560abf6e Mon Sep 17 00:00:00 2001
+From 4f5ff04c48922ddbbffa73965f086b1b0c2a2e68 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 6 Jun 2022 19:46:26 +0800
-Subject: [PATCH 1111/1128] mt76: mt7915: rework testmode init registers
+Subject: [PATCH 1111/1129] mt76: mt7915: rework testmode init registers
 
 ---
  mac80211.c        |   3 +-
diff --git a/recipes-wifi/linux-mt76/files/patches/1112-mt76-testmode-additional-supports.patch b/recipes-wifi/linux-mt76/files/patches/1112-mt76-testmode-additional-supports.patch
index bc80d3f..6f358d1 100644
--- a/recipes-wifi/linux-mt76/files/patches/1112-mt76-testmode-additional-supports.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1112-mt76-testmode-additional-supports.patch
@@ -1,7 +1,7 @@
-From 26061a276c620654542fb96064f6537070e3f278 Mon Sep 17 00:00:00 2001
+From 54cc888e7dcd2b5855dc7c0a0f7a19a2703b1735 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Apr 2022 15:43:19 +0800
-Subject: [PATCH 1112/1128] mt76: testmode: additional supports
+Subject: [PATCH 1112/1129] mt76: testmode: additional supports
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
diff --git a/recipes-wifi/linux-mt76/files/patches/1113-mt76-testmode-add-pre-cal-support.patch b/recipes-wifi/linux-mt76/files/patches/1113-mt76-testmode-add-pre-cal-support.patch
index 676491e..68bc681 100644
--- a/recipes-wifi/linux-mt76/files/patches/1113-mt76-testmode-add-pre-cal-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1113-mt76-testmode-add-pre-cal-support.patch
@@ -1,7 +1,7 @@
-From 0efb01a98e1abbe39c141df4f7ab6aa2bbb55ad8 Mon Sep 17 00:00:00 2001
+From 42421ff7f8ef7bbc45a050c6f7590981862d91bd Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 31 Aug 2022 20:06:52 +0800
-Subject: [PATCH 1113/1128] mt76: testmode: add pre-cal support
+Subject: [PATCH 1113/1129] mt76: testmode: add pre-cal support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Change-Id: Ibfbbc3443de994eeb4daa5e364b0a90f5d7d3bcd
diff --git a/recipes-wifi/linux-mt76/files/patches/1114-mt76-testmode-add-iBF-command-mode-support.patch b/recipes-wifi/linux-mt76/files/patches/1114-mt76-testmode-add-iBF-command-mode-support.patch
index 87c53f9..c388f49 100644
--- a/recipes-wifi/linux-mt76/files/patches/1114-mt76-testmode-add-iBF-command-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1114-mt76-testmode-add-iBF-command-mode-support.patch
@@ -1,7 +1,7 @@
-From 2a26fd854c3b09d271571505cb22075fef30ae36 Mon Sep 17 00:00:00 2001
+From 1853a51568f7d4523d623941689df571fd9aeee1 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 12 Sep 2022 18:16:54 +0800
-Subject: [PATCH 1114/1128] mt76: testmode: add iBF command mode support
+Subject: [PATCH 1114/1129] mt76: testmode: add iBF command mode support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Change-Id: I7eea1d6412563f889e5774e787e58ce9eba001bd
diff --git a/recipes-wifi/linux-mt76/files/patches/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch b/recipes-wifi/linux-mt76/files/patches/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
index 9d0b040..8c03a50 100644
--- a/recipes-wifi/linux-mt76/files/patches/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
@@ -1,7 +1,7 @@
-From 98bf3fe9efb60744e0de0cdbc16b6954d4586d2c Mon Sep 17 00:00:00 2001
+From e57d8aba69628acfc9ed8ba2d5c67f5faaa31d4e Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 27 Oct 2022 17:42:07 +0800
-Subject: [PATCH 1115/1128] mt76: testmode: add ZWDFS test mode support
+Subject: [PATCH 1115/1129] mt76: testmode: add ZWDFS test mode support
 
 Change-Id: I14d104b7158a35acf6b0595357d07fb87f5a9d94
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
diff --git a/recipes-wifi/linux-mt76/files/patches/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch b/recipes-wifi/linux-mt76/files/patches/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
index 18a49c0..c49d31d 100644
--- a/recipes-wifi/linux-mt76/files/patches/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
@@ -1,7 +1,7 @@
-From 3a0e0ac5413c0705e0cb997c276f75360875b584 Mon Sep 17 00:00:00 2001
+From a0e8ed2e87607c70f76eed181a921ba9cf7d66c0 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Sun, 24 Apr 2022 10:07:00 +0800
-Subject: [PATCH 1116/1128] mt76: mt7915: init rssi in WTBL when add station
+Subject: [PATCH 1116/1129] mt76: mt7915: init rssi in WTBL when add station
 
 ---
  mt7915/main.c | 4 ++++
diff --git a/recipes-wifi/linux-mt76/files/patches/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch b/recipes-wifi/linux-mt76/files/patches/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
index 3a727dc..5e49ca7 100644
--- a/recipes-wifi/linux-mt76/files/patches/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
@@ -1,7 +1,7 @@
-From 34332523e19b7689147f83936bac106934f935e0 Mon Sep 17 00:00:00 2001
+From 107c786501f44f62a41c8e01b2a4662fbaaa2926 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 4 Aug 2022 14:08:11 +0800
-Subject: [PATCH 1117/1128] mt76: mt7915: reduce TWT SP sent to FW for cert
+Subject: [PATCH 1117/1129] mt76: mt7915: reduce TWT SP sent to FW for cert
 
 Set TWT SP duration to 88 percent to prevent HW sends PPDU over TWT SP.
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch b/recipes-wifi/linux-mt76/files/patches/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
index 113fd2e..f144c24 100644
--- a/recipes-wifi/linux-mt76/files/patches/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
@@ -1,7 +1,7 @@
-From b456d43fa8c053eb10dd20f29b61f0cdb25550a1 Mon Sep 17 00:00:00 2001
+From 676531d63f5206049fea3ee2301fab7a70a18d76 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 6 May 2022 15:58:42 +0800
-Subject: [PATCH 1118/1128] mt76: connac: airtime fairness feature off in
+Subject: [PATCH 1118/1129] mt76: connac: airtime fairness feature off in
  mac80211
 
 ---
diff --git a/recipes-wifi/linux-mt76/files/patches/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch b/recipes-wifi/linux-mt76/files/patches/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
index df9eb33..f7686bf 100644
--- a/recipes-wifi/linux-mt76/files/patches/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
@@ -1,7 +1,7 @@
-From 6e7838964db8b046363f479ce898b18e09ed30fc Mon Sep 17 00:00:00 2001
+From 6ba6a1fa68f9ef87d3357e94b688e534210baa0d Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 20 May 2022 19:19:25 +0800
-Subject: [PATCH 1119/1128] mt76: mt7915: add mt7986 and mt7916 pre-calibration
+Subject: [PATCH 1119/1129] mt76: mt7915: add mt7986 and mt7916 pre-calibration
 
 Add pre-calibration for mt7986 and mt7916. It has different data size
 with mt7915. Group cal needs 54k and 94k for 2G + 5G and 2G + 6G,
diff --git a/recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-add-phy-capability-vendor-command.patch b/recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-add-phy-capability-vendor-command.patch
index d7cd7f4..4f555c1 100644
--- a/recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-add-phy-capability-vendor-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-add-phy-capability-vendor-command.patch
@@ -1,7 +1,7 @@
-From f93d67b6ae1b70d4fcf95db93951627362d174c8 Mon Sep 17 00:00:00 2001
+From 5955454208b5eb059911bc1c559d05e33d5d8e7c Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
 Date: Tue, 12 Jul 2022 10:04:35 -0700
-Subject: [PATCH 1120/1128] mt76: mt7915: add phy capability vendor command
+Subject: [PATCH 1120/1129] mt76: mt7915: add phy capability vendor command
 
 ---
  mt7915/mt7915.h |  1 +
diff --git a/recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch b/recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
index 7edac8d..e45911f 100644
--- a/recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
@@ -1,7 +1,7 @@
-From b36a1933047e93c0d3a048c53dfdd5a395a833cd Mon Sep 17 00:00:00 2001
+From 5a91524be285d368d1616a47df541a1c14314846 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 24 Jun 2022 11:15:45 +0800
-Subject: [PATCH 1121/1128] mt76: mt7915: add vendor subcmd EDCCA ctrl
+Subject: [PATCH 1121/1129] mt76: mt7915: add vendor subcmd EDCCA ctrl
  enable/threshold/compensation
 
 Change-Id: I06a3f94d5e444be894200e2b6588d76ed38d09d0
diff --git a/recipes-wifi/linux-mt76/files/patches/1122-mt76-mt7915-implement-bin-file-mode.patch b/recipes-wifi/linux-mt76/files/patches/1122-mt76-mt7915-implement-bin-file-mode.patch
index 01962a8..24c978f 100644
--- a/recipes-wifi/linux-mt76/files/patches/1122-mt76-mt7915-implement-bin-file-mode.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1122-mt76-mt7915-implement-bin-file-mode.patch
@@ -1,7 +1,7 @@
-From 117480121b8833507a563ecd319bcf57c270b977 Mon Sep 17 00:00:00 2001
+From 42cce8dd635255ae8652b6ed34d598d95ef599be Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 7 Jul 2022 11:09:59 +0800
-Subject: [PATCH 1122/1128] mt76: mt7915: implement bin file mode
+Subject: [PATCH 1122/1129] mt76: mt7915: implement bin file mode
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
diff --git a/recipes-wifi/linux-mt76/files/patches/1123-mt76-mt7915-initialize-wcid.patch b/recipes-wifi/linux-mt76/files/patches/1123-mt76-mt7915-initialize-wcid.patch
index 49d45f1..0231a99 100644
--- a/recipes-wifi/linux-mt76/files/patches/1123-mt76-mt7915-initialize-wcid.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1123-mt76-mt7915-initialize-wcid.patch
@@ -1,7 +1,7 @@
-From 409f3949513cb8bf94d696401be9864d0363b22f Mon Sep 17 00:00:00 2001
+From 9dc6af1c44883efd578f9a081264c43210e8e5b8 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 12 Jul 2022 13:56:07 +0800
-Subject: [PATCH 1123/1128] mt76: mt7915: initialize wcid
+Subject: [PATCH 1123/1129] mt76: mt7915: initialize wcid
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
diff --git a/recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-Add-hemu-dump-support.patch b/recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-Add-hemu-dump-support.patch
index 75e864d..ca5b014 100644
--- a/recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-Add-hemu-dump-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-Add-hemu-dump-support.patch
@@ -1,7 +1,7 @@
-From c977d69ea6fd5a6db3e889ef6d3baaae19d2aee7 Mon Sep 17 00:00:00 2001
+From eb8e083501dbca6db418cb2538cd1e50c51abde9 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Thu, 11 Aug 2022 18:09:45 -0700
-Subject: [PATCH 1124/1128] mt76: mt7915: Add hemu dump support
+Subject: [PATCH 1124/1129] mt76: mt7915: Add hemu dump support
 
 Change-Id: I521214f3feb6f0d528a9f550255050ffd1ec96d2
 ---
diff --git a/recipes-wifi/linux-mt76/files/patches/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch b/recipes-wifi/linux-mt76/files/patches/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
index 5a73958..1f2fe5b 100644
--- a/recipes-wifi/linux-mt76/files/patches/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
@@ -1,7 +1,7 @@
-From f865459f3adbb780091ef0346f93ce65130412d4 Mon Sep 17 00:00:00 2001
+From e58fab916807bd40d8f3e7169e7a3e8df306878e Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 28 Oct 2022 10:15:56 +0800
-Subject: [PATCH 1125/1128] mt76: mt7915: add vendor subcmd three wire (PTA)
+Subject: [PATCH 1125/1129] mt76: mt7915: add vendor subcmd three wire (PTA)
  ctrl
 
 Change-Id: Ic1044698f294455594a0c6254f55326fdab90580
diff --git a/recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch b/recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch
index 5cf8574..0b8f9b8 100644
--- a/recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch
@@ -1,7 +1,7 @@
-From 191b449eb978f73b95143e8cf3ec1765b73eb609 Mon Sep 17 00:00:00 2001
+From 0a8c65105444a20637c868e376a322924b2429f2 Mon Sep 17 00:00:00 2001
 From: mtk27835 <shurong.wen@mediatek.com>
 Date: Wed, 7 Sep 2022 14:01:29 -0700
-Subject: [PATCH 1126/1128] mt76: mt7915: add ibf control vendor cmd
+Subject: [PATCH 1126/1129] mt76: mt7915: add ibf control vendor cmd
 
 Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
 ---
diff --git a/recipes-wifi/linux-mt76/files/patches/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch b/recipes-wifi/linux-mt76/files/patches/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
index b7ae10e..526fda5 100644
--- a/recipes-wifi/linux-mt76/files/patches/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
@@ -1,7 +1,7 @@
-From 5a4f3c3d504087725ef9f47191b4a8edbf27b70e Mon Sep 17 00:00:00 2001
+From 1116673d44b71df37e01407ee6ebca0b6cc9f338 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 13 Oct 2022 13:22:05 +0800
-Subject: [PATCH 1127/1128] mt76: mt7915: add E3 re-bonding for low yield rate
+Subject: [PATCH 1127/1129] mt76: mt7915: add E3 re-bonding for low yield rate
  issue
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
diff --git a/recipes-wifi/linux-mt76/files/patches/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch b/recipes-wifi/linux-mt76/files/patches/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
index 00543cf..8d969ee 100644
--- a/recipes-wifi/linux-mt76/files/patches/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
@@ -1,7 +1,7 @@
-From 3fb208eb0a314a489cd0f0c74d22cc01e6d99822 Mon Sep 17 00:00:00 2001
+From d0c879de4b067613307926ec75f0dd99081a3ef6 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 14 Oct 2022 11:15:13 +0800
-Subject: [PATCH 1128/1128] mt76: mt7915: support on off SW ACI through debugfs
+Subject: [PATCH 1128/1129] mt76: mt7915: support on off SW ACI through debugfs
 
 Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Change-Id: I8a9c277c41d1ba76f9737d8af6f42e5e8f00ba64
diff --git a/recipes-wifi/linux-mt76/files/patches/1129-mt76-mt7915-add-bf-backoff-limit-table-support.patch b/recipes-wifi/linux-mt76/files/patches/1129-mt76-mt7915-add-bf-backoff-limit-table-support.patch
new file mode 100644
index 0000000..4bf0dc1
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/1129-mt76-mt7915-add-bf-backoff-limit-table-support.patch
@@ -0,0 +1,425 @@
+From c213af98be4f1ebe14930ce180a0c33b9180a339 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Mon, 5 Dec 2022 18:21:51 +0800
+Subject: [PATCH 1129/1129] mt76: mt7915: add bf backoff limit table support
+
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ eeprom.c         |  25 +++++++++-
+ mt76.h           |   8 +++
+ mt7915/debugfs.c |  73 ++++++++++++++++++++++++++--
+ mt7915/mcu.c     | 124 +++++++++++++++++++++++++++++++++++------------
+ mt7915/mcu.h     |   6 +++
+ mt7915/mt7915.h  |   4 +-
+ 6 files changed, 203 insertions(+), 37 deletions(-)
+
+diff --git a/eeprom.c b/eeprom.c
+index aac70efb..6290156f 100644
+--- a/eeprom.c
++++ b/eeprom.c
+@@ -308,7 +308,8 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
+ 	if (!mcs_rates)
+ 		mcs_rates = 10;
+ 
+-	memset(dest, target_power, sizeof(*dest));
++	memset(dest, target_power, sizeof(*dest) - sizeof(dest->path));
++	memset(&dest->path, 0, sizeof(dest->path));
+ 
+ 	if (!IS_ENABLED(CONFIG_OF))
+ 		return target_power;
+@@ -361,6 +362,28 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
+ 				     ARRAY_SIZE(dest->ru), val, len,
+ 				     target_power, txs_delta, &max_power);
+ 
++	val = mt76_get_of_array(np, "paths-cck", &len, ARRAY_SIZE(dest->path.cck));
++	mt76_apply_array_limit(dest->path.cck, ARRAY_SIZE(dest->path.cck), val,
++			       target_power, txs_delta, &max_power);
++
++	val = mt76_get_of_array(np, "paths-ofdm", &len, ARRAY_SIZE(dest->path.ofdm));
++	mt76_apply_array_limit(dest->path.ofdm, ARRAY_SIZE(dest->path.ofdm), val,
++			       target_power, txs_delta, &max_power);
++
++	val = mt76_get_of_array(np, "paths-ofdm-bf", &len, ARRAY_SIZE(dest->path.ofdm_bf));
++	mt76_apply_array_limit(dest->path.ofdm_bf, ARRAY_SIZE(dest->path.ofdm_bf), val,
++			       target_power, txs_delta, &max_power);
++
++	val = mt76_get_of_array(np, "paths-ru", &len, ARRAY_SIZE(dest->path.ru[0]) + 1);
++	mt76_apply_multi_array_limit(dest->path.ru[0], ARRAY_SIZE(dest->path.ru[0]),
++				     ARRAY_SIZE(dest->path.ru), val, len,
++				     target_power, txs_delta, &max_power);
++
++	val = mt76_get_of_array(np, "paths-ru-bf", &len, ARRAY_SIZE(dest->path.ru_bf[0]) + 1);
++	mt76_apply_multi_array_limit(dest->path.ru_bf[0], ARRAY_SIZE(dest->path.ru_bf[0]),
++				     ARRAY_SIZE(dest->path.ru_bf), val, len,
++				     target_power, txs_delta, &max_power);
++
+ 	return max_power;
+ }
+ EXPORT_SYMBOL_GPL(mt76_get_rate_power_limits);
+diff --git a/mt76.h b/mt76.h
+index d102333b..01baceaf 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -900,6 +900,14 @@ struct mt76_power_limits {
+ 	s8 ofdm[8];
+ 	s8 mcs[4][10];
+ 	s8 ru[7][12];
++
++	struct {
++		s8 cck[4];
++		s8 ofdm[4];
++		s8 ofdm_bf[4];
++		s8 ru[7][10];
++		s8 ru_bf[7][10];
++	} path;
+ };
+ 
+ struct mt76_ethtool_worker_info {
+diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
+index f1f3f2f3..3ef2148b 100644
+--- a/mt7915/debugfs.c
++++ b/mt7915/debugfs.c
+@@ -1024,7 +1024,7 @@ mt7915_rate_txpower_get(struct file *file, char __user *user_buf,
+ 	if (!buf)
+ 		return -ENOMEM;
+ 
+-	ret = mt7915_mcu_get_txpower_sku(phy, txpwr, sizeof(txpwr));
++	ret = mt7915_mcu_get_txpower_sku(phy, txpwr, sizeof(txpwr), TX_POWER_INFO_RATE);
+ 	if (ret)
+ 		goto out;
+ 
+@@ -1134,7 +1134,7 @@ mt7915_rate_txpower_set(struct file *file, const char __user *user_buf,
+ 
+ 	mutex_lock(&dev->mt76.mutex);
+ 	ret = mt7915_mcu_get_txpower_sku(phy, req.txpower_sku,
+-					 sizeof(req.txpower_sku));
++					 sizeof(req.txpower_sku), TX_POWER_INFO_RATE);
+ 	if (ret)
+ 		goto out;
+ 
+@@ -1176,7 +1176,7 @@ out:
+ 	return ret ? ret : count;
+ }
+ 
+-static const struct file_operations mt7915_rate_txpower_fops = {
++static const struct file_operations mt7915_txpower_fops = {
+ 	.write = mt7915_rate_txpower_set,
+ 	.read = mt7915_rate_txpower_get,
+ 	.open = simple_open,
+@@ -1184,6 +1184,69 @@ static const struct file_operations mt7915_rate_txpower_fops = {
+ 	.llseek = default_llseek,
+ };
+ 
++static int
++mt7915_path_txpower_show(struct seq_file *file)
++{
++	struct mt7915_phy *phy = file->private;
++	s8 txpower[MT7915_SKU_PATH_NUM], *buf = txpower;
++	int ret;
++
++#define PATH_POWER_SHOW(_name, _len, _skip) do {				\
++		if (_skip) {						\
++			buf -= 1;					\
++			*buf = 0;					\
++		}							\
++		mt76_seq_puts_array(file, _name, buf, _len);		\
++		buf += _len;						\
++	} while(0)
++
++	seq_printf(file, "\n%*c", 11, ' ');
++	seq_printf(file, "1T1S/2T1S/3T1S/4T1S/2T2S/3T2S/4T2S/3T3S/4T3S/4T4S\n");
++	ret = mt7915_mcu_get_txpower_sku(phy, txpower, sizeof(txpower),
++					 TX_POWER_INFO_PATH);
++	if (ret)
++		return ret;
++
++	PATH_POWER_SHOW("CCK", 4, 0);
++	PATH_POWER_SHOW("OFDM", 4, 0);
++	PATH_POWER_SHOW("BF-OFDM", 4, 1);
++
++	PATH_POWER_SHOW("HT20", 10, 0);
++	PATH_POWER_SHOW("BF-HT20", 10, 1);
++	PATH_POWER_SHOW("HT40", 10, 0);
++	PATH_POWER_SHOW("BF-HT40", 10, 1);
++
++	PATH_POWER_SHOW("RU242", 10, 0);
++	PATH_POWER_SHOW("BF-RU242", 10, 1);
++	PATH_POWER_SHOW("RU484", 10, 0);
++	PATH_POWER_SHOW("BF-RU484", 10, 1);
++	PATH_POWER_SHOW("RU996", 10, 0);
++	PATH_POWER_SHOW("BF-RU996", 10, 1);
++	PATH_POWER_SHOW("RU2x996", 10, 0);
++	PATH_POWER_SHOW("BF-RU2x996", 10, 1);
++	PATH_POWER_SHOW("RU26", 10, 0);
++	PATH_POWER_SHOW("BF-RU26", 10, 0);
++	PATH_POWER_SHOW("RU52", 10, 0);
++	PATH_POWER_SHOW("BF-RU52", 10, 0);
++	PATH_POWER_SHOW("RU106", 10, 0);
++	PATH_POWER_SHOW("BF-RU106", 10, 0);
++#undef PATH_POWER_SHOW
++
++	return 0;
++}
++
++static int
++mt7915_txpower_path_show(struct seq_file *file, void *data)
++{
++	struct mt7915_phy *phy = file->private;
++
++	seq_printf(file, "\nBand %d\n", phy != &phy->dev->phy);
++
++	return mt7915_path_txpower_show(file);
++}
++
++DEFINE_SHOW_ATTRIBUTE(mt7915_txpower_path);
++
+ static int
+ mt7915_twt_stats(struct seq_file *s, void *data)
+ {
+@@ -1270,7 +1333,9 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+ 	debugfs_create_file("implicit_txbf", 0600, dir, dev,
+ 			    &fops_implicit_txbf);
+ 	debugfs_create_file("txpower_sku", 0400, dir, phy,
+-			    &mt7915_rate_txpower_fops);
++			    &mt7915_txpower_fops);
++	debugfs_create_file("txpower_path", 0400, dir, phy,
++			    &mt7915_txpower_path_fops);
+ 	debugfs_create_devm_seqfile(dev->mt76.dev, "twt_stats", dir,
+ 				    mt7915_twt_stats);
+ 	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 785c3c10..4b7ad450 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -3259,7 +3259,8 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+ 	int ret;
+ 	s8 txpower_sku[MT7915_SKU_RATE_NUM];
+ 
+-	ret = mt7915_mcu_get_txpower_sku(phy, txpower_sku, sizeof(txpower_sku));
++	ret = mt7915_mcu_get_txpower_sku(phy, txpower_sku, sizeof(txpower_sku),
++					 TX_POWER_INFO_RATE);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -3301,51 +3302,98 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+ 
+ int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
+ {
++#define TX_POWER_LIMIT_TABLE_RATE	0
++#define TX_POWER_LIMIT_TABLE_PATH	1
+ 	struct mt7915_dev *dev = phy->dev;
+ 	struct mt76_phy *mphy = phy->mt76;
+ 	struct ieee80211_hw *hw = mphy->hw;
+-	struct mt7915_mcu_txpower_sku req = {
++	struct mt7915_sku_val {
++		u8 format_id;
++		u8 limit_type;
++		u8 band_idx;
++	} __packed hdr = {
+ 		.format_id = TX_POWER_LIMIT_TABLE,
++		.limit_type = TX_POWER_LIMIT_TABLE_RATE,
+ 		.band_idx = phy->mt76->band_idx,
+ 	};
+-	struct mt76_power_limits limits_array;
+-	s8 *la = (s8 *)&limits_array;
+-	int i, idx;
+-	int tx_power;
++	int i, ret, tx_power;
++	const u8 *len = mt7915_sku_group_len;
++	struct mt76_power_limits la = {};
++	struct sk_buff *skb;
+ 
+ 	tx_power = mt7915_get_power_bound(phy, hw->conf.power_level);
+ 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
+-					      &limits_array, tx_power);
++					      &la, tx_power);
+ 	mphy->txpower_cur = tx_power;
+ 
+-	for (i = 0, idx = 0; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
+-		u8 mcs_num, len = mt7915_sku_group_len[i];
+-		int j;
++	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
++				 sizeof(hdr) + MT7915_SKU_RATE_NUM);
++	if (!skb)
++		return -ENOMEM;
+ 
+-		if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
+-			mcs_num = 10;
++	skb_put_data(skb, &hdr, sizeof(hdr));
++	skb_put_data(skb, &la.cck, len[SKU_CCK] + len[SKU_OFDM]);
++	skb_put_data(skb, &la.mcs[0], len[SKU_HT_BW20]);
++	skb_put_data(skb, &la.mcs[1], len[SKU_HT_BW40]);
+ 
+-			if (i == SKU_HT_BW20 || i == SKU_VHT_BW20)
+-				la = (s8 *)&limits_array + 12;
+-		} else {
+-			mcs_num = len;
+-		}
++	/* vht */
++	for (i = 0; i < 4; i++) {
++		skb_put_data(skb, &la.mcs[i], sizeof(la.mcs[i]));
++		skb_put_zero(skb, 2);  /* padding */
++	}
++
++	/* he */
++	skb_put_data(skb, &la.ru[0], sizeof(la.ru));
++
++	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
++				    MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), true);
++	if (ret)
++		return ret;
++
++	/* only set per-path power table when it's configured */
++	if (!la.path.ofdm[0])
++		return 0;
+ 
+-		for (j = 0; j < min_t(u8, mcs_num, len); j++)
+-			req.txpower_sku[idx + j] = la[j];
++	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
++				 sizeof(hdr) + MT7915_SKU_PATH_NUM);
++	if (!skb)
++		return -ENOMEM;
+ 
+-		la += mcs_num;
+-		idx += len;
++	hdr.limit_type = TX_POWER_LIMIT_TABLE_PATH;
++	skb_put_data(skb, &hdr, sizeof(hdr));
++	skb_put_data(skb, &la.path.cck, sizeof(la.path.cck));
++	skb_put_data(skb, &la.path.ofdm, sizeof(la.path.ofdm));
++	skb_put_data(skb, &la.path.ofdm_bf[1], sizeof(la.path.ofdm_bf) - 1);
++
++	/* HT20 and HT40 */
++	skb_put_data(skb, &la.path.ru[0], sizeof(la.path.ru[0]));
++	skb_put_data(skb, &la.path.ru_bf[0][1], sizeof(la.path.ru_bf[0]) - 1);
++	skb_put_data(skb, &la.path.ru[1], sizeof(la.path.ru[1]));
++	skb_put_data(skb, &la.path.ru_bf[1][1], sizeof(la.path.ru_bf[1]) - 1);
++
++	/* start from non-bf and bf fields of
++	 * BW20/RU242, BW40/RU484, BW80/RU996, BW160/RU2x996,
++	 * RU26, RU52, and RU106
++	 */
++	for (i = 7; i < 21; i++) {
++		bool bf = !(i % 2);
++		u8 idx = (i - 7) / 2;
++		s8 *buf = bf ? la.path.ru_bf[idx] : la.path.ru[idx];
++
++		/* The non-bf fields of RU26 to RU106 are special cases */
++		if (bf && i < 15)
++			skb_put_data(skb, buf + 1, 9);
++		else
++			skb_put_data(skb, buf, 10);
+ 	}
+ 
+-	return mt76_mcu_send_msg(&dev->mt76,
+-				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
+-				 sizeof(req), true);
++	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
++ 				     MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), true);
+ }
+ 
+-int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
++int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
++			       u8 category)
+ {
+-#define RATE_POWER_INFO	2
+ 	struct mt7915_dev *dev = phy->dev;
+ 	struct {
+ 		u8 format_id;
+@@ -3354,10 +3402,9 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
+ 		u8 _rsv;
+ 	} __packed req = {
+ 		.format_id = TX_POWER_LIMIT_INFO,
+-		.category = RATE_POWER_INFO,
++		.category = category,
+ 		.band_idx = phy->mt76->band_idx,
+ 	};
+-	s8 txpower_sku[MT7915_SKU_RATE_NUM][2];
+ 	struct sk_buff *skb;
+ 	int ret, i;
+ 
+@@ -3367,9 +3414,15 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
+ 	if (ret)
+ 		return ret;
+ 
+-	memcpy(txpower_sku, skb->data + 4, sizeof(txpower_sku));
+-	for (i = 0; i < len; i++)
+-		txpower[i] = txpower_sku[i][req.band_idx];
++	if (category == TX_POWER_INFO_RATE) {
++		s8 res[MT7915_SKU_RATE_NUM][2];
++
++		memcpy(res, skb->data + 4, sizeof(res));
++		for (i = 0; i < len; i++)
++			txpower[i] = res[i][req.band_idx];
++	} else if (category == TX_POWER_INFO_PATH) {
++		memcpy(txpower, skb->data + 4, len);
++	}
+ 
+ 	dev_kfree_skb(skb);
+ 
+@@ -3411,9 +3464,18 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+ 		.band_idx = phy->mt76->band_idx,
+ 		.sku_enable = enable,
+ 	};
++	int ret;
++
++	ret = mt76_mcu_send_msg(&dev->mt76,
++				MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
++				sizeof(req), true);
++	if (ret)
++		return ret;
+ 
+ 	pr_info("%s: enable = %d\n", __func__, enable);
+ 
++	req.format_id = TX_POWER_LIMIT_PATH_ENABLE;
++ 
+ 	return mt76_mcu_send_msg(&dev->mt76,
+ 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
+ 				 sizeof(req), true);
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index 08476eb6..d110e210 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -446,12 +446,18 @@ enum {
+ 
+ enum {
+ 	TX_POWER_LIMIT_ENABLE,
++	TX_POWER_LIMIT_PATH_ENABLE = 0x3,
+ 	TX_POWER_LIMIT_TABLE = 0x4,
+ 	TX_POWER_LIMIT_INFO = 0x7,
+ 	TX_POWER_LIMIT_FRAME = 0x11,
+ 	TX_POWER_LIMIT_FRAME_MIN = 0x12,
+ };
+ 
++enum {
++	TX_POWER_INFO_PATH = 1,
++	TX_POWER_INFO_RATE,
++};
++
+ enum {
+ 	SPR_ENABLE = 0x1,
+ 	SPR_ENABLE_SD = 0x3,
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 2d3769c6..2e6519e7 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -73,6 +73,7 @@
+ #define MT7915_CDEV_THROTTLE_MAX	99
+ 
+ #define MT7915_SKU_RATE_NUM		161
++#define MT7915_SKU_PATH_NUM		185
+ 
+ #define MT7915_MAX_TWT_AGRT		16
+ #define MT7915_MAX_STA_TWT_AGRT		8
+@@ -624,7 +625,8 @@ int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
+ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
+ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable);
+ int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
+-int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len);
++int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
++			       u8 category);
+ int mt7915_mcu_set_txpower_frame_min(struct mt7915_phy *phy, s8 txpower);
+ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+ 				 struct ieee80211_vif *vif,
+-- 
+2.25.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches/3001-mt76-mt7915-wed-add-wed-tx-support.patch b/recipes-wifi/linux-mt76/files/patches/3001-mt76-mt7915-wed-add-wed-tx-support.patch
index 84aeced..3086d77 100644
--- a/recipes-wifi/linux-mt76/files/patches/3001-mt76-mt7915-wed-add-wed-tx-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3001-mt76-mt7915-wed-add-wed-tx-support.patch
@@ -1,4 +1,4 @@
-From 30ce8783532bc157e2639b4a91aecb3c050d1bf6 Mon Sep 17 00:00:00 2001
+From aa48497ccb0236e8724d8434be06055e31297e93 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 10:38:53 +0800
 Subject: [PATCH 3001/3011] mt76: mt7915: wed: add wed tx support
diff --git a/recipes-wifi/linux-mt76/files/patches/3002-mt76-mt7915-wed-add-wed-tx-wds-support-on-mt7986.patch b/recipes-wifi/linux-mt76/files/patches/3002-mt76-mt7915-wed-add-wed-tx-wds-support-on-mt7986.patch
index a9f6d89..829a48a 100644
--- a/recipes-wifi/linux-mt76/files/patches/3002-mt76-mt7915-wed-add-wed-tx-wds-support-on-mt7986.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3002-mt76-mt7915-wed-add-wed-tx-wds-support-on-mt7986.patch
@@ -1,4 +1,4 @@
-From a92a1c7b40b57f5d6594ae8170d7d9e3cd993aef Mon Sep 17 00:00:00 2001
+From 8c5f91270dc8d3a1b8d36a00130bbe0450dbfe61 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Sat, 10 Sep 2022 17:09:21 +0800
 Subject: [PATCH 3002/3011] mt76: mt7915: wed: add-wed-tx-wds-support-on-mt7986
@@ -32,7 +32,7 @@
  }
  EXPORT_SYMBOL_GPL(__mt76_sta_remove);
 diff --git a/mt76.h b/mt76.h
-index d102333b..74818a59 100644
+index 01baceaf..fb8c15eb 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -465,6 +465,7 @@ struct mt76_driver_ops {
@@ -150,7 +150,7 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 785c3c10..0ad110ff 100644
+index 4b7ad450..3b16a7fb 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -2321,6 +2321,7 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
@@ -180,7 +180,7 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 08476eb6..cf1d7d7a 100644
+index d110e210..b30cc820 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -288,6 +288,7 @@ enum {
@@ -204,7 +204,7 @@
  	struct mt7915_dev *dev;
  	struct mt76_dev *mdev;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 2d3769c6..51453058 100644
+index 2e6519e7..836d485f 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -18,6 +18,9 @@
@@ -217,7 +217,7 @@
  #define MT7915_WATCHDOG_TIME		(HZ / 10)
  #define MT7915_RESET_TIMEOUT		(30 * HZ)
  
-@@ -724,6 +727,7 @@ void mt7915_tx_token_put(struct mt7915_dev *dev);
+@@ -726,6 +729,7 @@ void mt7915_tx_token_put(struct mt7915_dev *dev);
  void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  			 struct sk_buff *skb, u32 *info);
  bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len);
diff --git a/recipes-wifi/linux-mt76/files/patches/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch b/recipes-wifi/linux-mt76/files/patches/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
index 86404b0..ee14206 100644
--- a/recipes-wifi/linux-mt76/files/patches/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
@@ -1,4 +1,4 @@
-From bd9310d73f9c7396d06e60fc10ff554a8e02817f Mon Sep 17 00:00:00 2001
+From ca14459b70818a138fa83ec38bfc91bce44b645c Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 12:05:06 +0800
 Subject: [PATCH 3003/3011] mt76: connac: wed: add wed rx copy skb
diff --git a/recipes-wifi/linux-mt76/files/patches/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch b/recipes-wifi/linux-mt76/files/patches/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
index 86dff09..0835b2c 100644
--- a/recipes-wifi/linux-mt76/files/patches/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
@@ -1,4 +1,4 @@
-From 705e520c10a4f08bf5b24b56b5ddb015e27c7b99 Mon Sep 17 00:00:00 2001
+From 9c13748447e65404ad43c95b11479b71557851d8 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 19 May 2022 13:44:42 +0800
 Subject: [PATCH 3004/3011] mt76: mt7915: wed: add fill receive path to report
diff --git a/recipes-wifi/linux-mt76/files/patches/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch b/recipes-wifi/linux-mt76/files/patches/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
index 4b36261..895588a 100644
--- a/recipes-wifi/linux-mt76/files/patches/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
@@ -1,4 +1,4 @@
-From 47cfa806f1e2945d1d63f3642207cbdb205e9a12 Mon Sep 17 00:00:00 2001
+From e199b3a9a4dcf01c00fd367e7dea297b0c0e308b Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 14:07:46 +0800
 Subject: [PATCH 3005/3011] mt76: mt7915: wed: add ser support when wed on
@@ -120,10 +120,10 @@
  
  #endif
 diff --git a/mt76.h b/mt76.h
-index 74818a59..b7fa1724 100644
+index fb8c15eb..b107516d 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1383,6 +1383,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1391,6 +1391,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  void mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  struct mt76_txwi_cache *mt76_get_rxwi(struct mt76_dev *dev);
@@ -268,10 +268,10 @@
  	dev->mt76.rx_token_size = wed->wlan.rx_npkt;
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 51453058..c39be358 100644
+index 836d485f..8ea75fb9 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -561,6 +561,7 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
+@@ -562,6 +562,7 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
  irqreturn_t mt7915_irq_handler(int irq, void *dev_instance);
  u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif);
  u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
diff --git a/recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch b/recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
index 254e6f0..ed5376a 100644
--- a/recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
@@ -1,4 +1,4 @@
-From 10e8cbecc7872f0ad0d18ef37713362da3f9600d Mon Sep 17 00:00:00 2001
+From 07b444485d3b25b459d5e2a9a9b84ccb0613a1db Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 2 Sep 2022 14:40:40 +0800
 Subject: [PATCH 3006/3011] mt76: mt7915: wed: enable red per-band token drop
@@ -16,7 +16,7 @@
  3 files changed, 46 insertions(+), 11 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 0ad110ff..fcb15fb5 100644
+index 3b16a7fb..2cfd5f4a 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -2359,8 +2359,13 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
@@ -47,7 +47,7 @@
  }
  
  int mt7915_mcu_init(struct mt7915_dev *dev)
-@@ -4445,6 +4445,35 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
+@@ -4507,6 +4507,35 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
  
  	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), wait_resp);
  }
@@ -83,7 +83,7 @@
  
  int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
  {
-@@ -4455,17 +4484,21 @@ int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
+@@ -4517,17 +4546,21 @@ int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
  	u32 red_type = enabled > 0 ? RED_BY_WA_ENABLE : RED_DISABLE;
  	__le32 req = cpu_to_le32(red_type);
  
@@ -110,7 +110,7 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index cf1d7d7a..49728514 100644
+index b30cc820..9f882042 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -289,6 +289,7 @@ enum {
@@ -122,10 +122,10 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index c39be358..2c0aee1e 100644
+index 8ea75fb9..def78c67 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -773,13 +773,14 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+@@ -775,13 +775,14 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  #endif
  int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value, s8 compensation);
  int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
diff --git a/recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch b/recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch
index 29f1072..c4af9df 100644
--- a/recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch
@@ -1,4 +1,4 @@
-From 1f69487aed883d7ea07b50a10f87b30db329043c Mon Sep 17 00:00:00 2001
+From f30bc7032eeb4a32393bdec69e719e3a1c9ceeae Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 22 Sep 2022 09:54:53 +0800
 Subject: [PATCH 3007/3011] mt76: mt7915: wed: update mt7916 trinfo when hw
diff --git a/recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch b/recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
index 9d9765b..afafd01 100644
--- a/recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
@@ -1,4 +1,4 @@
-From 7f80dae506d79a41a7357ec14bd6dabdeeb9cd4f Mon Sep 17 00:00:00 2001
+From 82ba992b09e55d1291387351cc9dc0da0c6cb66b Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 14:32:35 +0800
 Subject: [PATCH 3008/3011] mt76: mt7915: wed: find rx token by physical
diff --git a/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch b/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
index 8720477..dc1c019 100644
--- a/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
@@ -1,4 +1,4 @@
-From c37cd3ad8c8ed0ddcf18858263edeee80c9e40b6 Mon Sep 17 00:00:00 2001
+From 7b8d03a4a4996e29c178a870c29b8ba7bd45c6d6 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 25 Nov 2022 14:37:58 +0800
 Subject: [PATCH 3009/3011] mt76: mt7915: wed: drop scatter and gather frame
@@ -46,7 +46,7 @@
  #define MT_DMA_PPE_CPU_REASON		GENMASK(15, 11)
  #define MT_DMA_PPE_ENTRY		GENMASK(30, 16)
 diff --git a/mt76.h b/mt76.h
-index b7fa1724..7a5b0b61 100644
+index b107516d..5bdf03f2 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -30,6 +30,7 @@
diff --git a/recipes-wifi/linux-mt76/files/patches/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch b/recipes-wifi/linux-mt76/files/patches/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
index 796cd51..e4ed9eb 100644
--- a/recipes-wifi/linux-mt76/files/patches/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
@@ -1,4 +1,4 @@
-From 78409553ecdb43e9b22bb951f3d993d42f120e7c Mon Sep 17 00:00:00 2001
+From 1312c8e16c778c9c42f993466caf6fee4b7d2f3f Mon Sep 17 00:00:00 2001
 From: Lian Chen <lian.chen@mediatek.com>
 Date: Mon, 7 Nov 2022 14:47:44 +0800
 Subject: [PATCH 3010/3011] mt76: mt7915: wed: HW ATF support for mt7986
@@ -36,7 +36,7 @@
  	MCU_EXT_CMD_EFUSE_FREE_BLOCK = 0x4f,
  	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index f1f3f2f3..f3b039ff 100644
+index 3ef2148b..b178036c 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -12,6 +12,10 @@
@@ -457,7 +457,7 @@
  static int
  mt7915_radar_trigger(void *data, u64 val)
  {
-@@ -1274,6 +1678,7 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+@@ -1339,6 +1743,7 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
  	debugfs_create_devm_seqfile(dev->mt76.dev, "twt_stats", dir,
  				    mt7915_twt_stats);
  	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
@@ -577,10 +577,10 @@
  }
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index fcb15fb5..ff207f70 100644
+index 2cfd5f4a..4acca9d9 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3444,6 +3444,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
+@@ -3506,6 +3506,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
  				 &req, sizeof(req), false);
  }
  
@@ -753,10 +753,10 @@
  {
  	struct {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 2c0aee1e..afd99498 100644
+index def78c67..0fb1de3e 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -132,6 +132,58 @@ struct mt7915_twt_flow {
+@@ -133,6 +133,58 @@ struct mt7915_twt_flow {
  
  DECLARE_EWMA(avg_signal, 10, 8)
  
@@ -815,7 +815,7 @@
  struct mt7915_sta {
  	struct mt76_wcid wcid; /* must be first */
  
-@@ -153,6 +205,7 @@ struct mt7915_sta {
+@@ -154,6 +206,7 @@ struct mt7915_sta {
  		u8 flowid_mask;
  		struct mt7915_twt_flow flow[MT7915_MAX_STA_TWT_AGRT];
  	} twt;
@@ -823,7 +823,7 @@
  };
  
  struct mt7915_vif_cap {
-@@ -467,6 +520,8 @@ struct mt7915_dev {
+@@ -468,6 +521,8 @@ struct mt7915_dev {
  	} dbg;
  	const struct mt7915_dbg_reg_desc *dbg_reg;
  #endif
@@ -832,7 +832,7 @@
  };
  
  enum {
-@@ -499,6 +554,15 @@ enum mt7915_rdd_cmd {
+@@ -500,6 +555,15 @@ enum mt7915_rdd_cmd {
  	RDD_IRQ_OFF,
  };
  
@@ -848,7 +848,7 @@
  static inline struct mt7915_phy *
  mt7915_hw_phy(struct ieee80211_hw *hw)
  {
-@@ -626,6 +690,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
+@@ -627,6 +691,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
  int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
  			      u8 en);
  int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
@@ -858,7 +858,7 @@
 +int mt7915_mcu_set_vow_band(struct mt7915_dev *dev, struct mt7915_vif *mvif);
  int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable);
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
- int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len);
+ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
 index 3365f3f3..a8ffefd4 100644
 --- a/mt7915/mtk_debugfs.c
diff --git a/recipes-wifi/linux-mt76/files/patches/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch b/recipes-wifi/linux-mt76/files/patches/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
index c7f7081..0a00aef 100644
--- a/recipes-wifi/linux-mt76/files/patches/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
@@ -1,4 +1,4 @@
-From 0431d98e1a656f59c4fab110897e7e9bc092cc5a Mon Sep 17 00:00:00 2001
+From b9cfe422dcdce6badd19d45b23affb51e6820300 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 2 Dec 2022 17:17:06 +0800
 Subject: [PATCH 3011/3011] mt76: mt7915: wed: add mt7916 2 pcie support when
@@ -34,7 +34,7 @@
  				   MT7916_RXQ_MCU_WA_MAIN);
  			TXQ_CONFIG(0, WFDMA0, MT_INT_WED_TX_DONE_BAND0,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index ff207f70..737a714f 100644
+index 4acca9d9..1cdb9d45 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -2352,7 +2352,7 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
diff --git a/recipes-wifi/linux-mt76/files/patches/4000-mt76-revert-get_of_mac_addr.patch b/recipes-wifi/linux-mt76/files/patches/4000-mt76-revert-get_of_mac_addr.patch
index dc83560..6e61567 100644
--- a/recipes-wifi/linux-mt76/files/patches/4000-mt76-revert-get_of_mac_addr.patch
+++ b/recipes-wifi/linux-mt76/files/patches/4000-mt76-revert-get_of_mac_addr.patch
@@ -1,4 +1,4 @@
-From dbc09e842e33cecb9e6237ed0664c9fc1f12a412 Mon Sep 17 00:00:00 2001
+From e362fcbdcdf2e01840aaa03bf432535c5485463c Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 13 Dec 2022 10:51:46 +0800
 Subject: [PATCH 4000/4002] mt76: revert get_of_mac_addr
@@ -8,7 +8,7 @@
  1 file changed, 7 insertions(+), 1 deletion(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index aac70efb..bb9265cc 100644
+index 6290156f..306c6412 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -126,9 +126,15 @@ void
diff --git a/recipes-wifi/linux-mt76/files/patches/4001-mt76-include-header-files-for-module-param.patch b/recipes-wifi/linux-mt76/files/patches/4001-mt76-include-header-files-for-module-param.patch
index cc3a10d..941caaa 100644
--- a/recipes-wifi/linux-mt76/files/patches/4001-mt76-include-header-files-for-module-param.patch
+++ b/recipes-wifi/linux-mt76/files/patches/4001-mt76-include-header-files-for-module-param.patch
@@ -1,4 +1,4 @@
-From 51c0737433ea318d6897585366de4af124c0bb4a Mon Sep 17 00:00:00 2001
+From ee4fac966742080be4cdcfa9fdb258752d90671a Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 13 Dec 2022 10:38:13 +0800
 Subject: [PATCH 4001/4002] mt76: include header files for module param
@@ -47,7 +47,7 @@
  int mt76_connac_mcu_start_firmware(struct mt76_dev *dev, u32 addr, u32 option)
  {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 737a714f..e08a96d9 100644
+index 1cdb9d45..69f1a0d4 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -6,6 +6,7 @@
diff --git a/recipes-wifi/linux-mt76/files/patches/4002-mt76-revert-for-backports-5.15-wireless-stack.patch b/recipes-wifi/linux-mt76/files/patches/4002-mt76-revert-for-backports-5.15-wireless-stack.patch
index 0a0ede2..7a09927 100644
--- a/recipes-wifi/linux-mt76/files/patches/4002-mt76-revert-for-backports-5.15-wireless-stack.patch
+++ b/recipes-wifi/linux-mt76/files/patches/4002-mt76-revert-for-backports-5.15-wireless-stack.patch
@@ -1,12 +1,29 @@
-From a4a4b918aa6c2895840226fc4816c265c6461131 Mon Sep 17 00:00:00 2001
+From a1465a9ff44b461a0aa335ad657067e04066204c Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 12 Dec 2022 18:17:12 +0800
-Subject: [PATCH 4002/4002] mt76: revert for backports-5.15 wireless stack
+Subject: [PATCH] mt76: revert for backports-5.15 wireless stack
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ debugfs.c         |   2 +
+ dma.c             |   2 +-
+ mac80211.c        |   4 +-
+ mt7615/main.c     |   6 +-
+ mt7615/mcu.c      |   8 +--
+ mt76_connac_mcu.c | 108 +++++++++++++++---------------
+ mt76x02_mac.c     |   6 +-
+ mt7915/debugfs.c  |   4 +-
+ mt7915/dma.c      |   4 +-
+ mt7915/init.c     |   3 +-
+ mt7915/mac.c      |   2 +-
+ mt7915/main.c     |  10 +--
+ mt7915/mcu.c      | 166 +++++++++++++++++++++++-----------------------
+ mt7915/testmode.c |   8 +--
+ tx.c              |  11 +--
+ 15 files changed, 168 insertions(+), 176 deletions(-)
 
 diff --git a/debugfs.c b/debugfs.c
-index 79064a4..4a8e186 100644
+index 79064a4d..4a8e1864 100644
 --- a/debugfs.c
 +++ b/debugfs.c
 @@ -33,8 +33,10 @@ mt76_napi_threaded_set(void *data, u64 val)
@@ -21,7 +38,7 @@
  	return 0;
  }
 diff --git a/dma.c b/dma.c
-index 0914266..21e88a2 100644
+index 0914266a..21e88a2d 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -939,7 +939,7 @@ mt76_dma_init(struct mt76_dev *dev,
@@ -33,29 +50,8 @@
  		mt76_dma_rx_fill(dev, &dev->q_rx[i]);
  		napi_enable(&dev->napi[i]);
  	}
-diff --git a/eeprom.c b/eeprom.c
-index aac70ef..bb9265c 100644
---- a/eeprom.c
-+++ b/eeprom.c
-@@ -126,9 +126,15 @@ void
- mt76_eeprom_override(struct mt76_phy *phy)
- {
- 	struct mt76_dev *dev = phy->dev;
-+#ifdef CONFIG_OF
- 	struct device_node *np = dev->dev->of_node;
-+	const u8 *mac = NULL;
- 
--	of_get_mac_address(np, phy->macaddr);
-+	if (np)
-+		mac = of_get_mac_address(np);
-+	if (!IS_ERR_OR_NULL(mac))
-+		ether_addr_copy(phy->macaddr, mac);
-+#endif
- 
- 	if (!is_valid_ether_addr(phy->macaddr)) {
- 		eth_random_addr(phy->macaddr);
 diff --git a/mac80211.c b/mac80211.c
-index 15d300a..be4a140 100644
+index 15d300a9..be4a1408 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -1511,7 +1511,7 @@ EXPORT_SYMBOL_GPL(mt76_get_sar_power);
@@ -77,7 +73,7 @@
  
  	dev->csa_complete |= ieee80211_beacon_cntdwn_is_complete(vif);
 diff --git a/mt7615/main.c b/mt7615/main.c
-index ab4c1b4..8fb5b25 100644
+index ab4c1b44..8fb5b256 100644
 --- a/mt7615/main.c
 +++ b/mt7615/main.c
 @@ -474,7 +474,7 @@ static int mt7615_config(struct ieee80211_hw *hw, u32 changed)
@@ -108,10 +104,10 @@
  	mt7615_mutex_release(dev);
  }
 diff --git a/mt7615/mcu.c b/mt7615/mcu.c
-index 83f3030..81579a1 100644
+index e917d025..b2e1f388 100644
 --- a/mt7615/mcu.c
 +++ b/mt7615/mcu.c
-@@ -352,7 +352,7 @@ out:
+@@ -353,7 +353,7 @@ out:
  static void
  mt7615_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -120,7 +116,7 @@
  		ieee80211_csa_finish(vif);
  }
  
-@@ -698,7 +698,7 @@ mt7615_mcu_add_beacon_offload(struct mt7615_dev *dev,
+@@ -699,7 +699,7 @@ mt7615_mcu_add_beacon_offload(struct mt7615_dev *dev,
  	if (!enable)
  		goto out;
  
@@ -129,7 +125,7 @@
  	if (!skb)
  		return -EINVAL;
  
-@@ -1073,7 +1073,7 @@ mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
+@@ -1074,7 +1074,7 @@ mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
  	if (!enable)
  		goto out;
  
@@ -138,7 +134,7 @@
  	if (!skb)
  		return -EINVAL;
  
-@@ -2525,7 +2525,7 @@ int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
+@@ -2526,7 +2526,7 @@ int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
  		u8 pad;
  	} req = {
  		.bss_idx = mvif->mt76.idx,
@@ -148,10 +144,10 @@
  		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
  	};
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 291a7c1..d5254f9 100644
+index 56493774..99851dc0 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -196,7 +196,7 @@ int mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif)
+@@ -197,7 +197,7 @@ int mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif)
  			      */
  	} req = {
  		.bss_idx = mvif->idx,
@@ -160,7 +156,7 @@
  	};
  
  	if (vif->type != NL80211_IFTYPE_STATION)
-@@ -408,7 +408,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
+@@ -409,7 +409,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
  		else
  			conn_type = CONNECTION_INFRA_AP;
  		basic->conn_type = cpu_to_le32(conn_type);
@@ -169,7 +165,7 @@
  		break;
  	case NL80211_IFTYPE_ADHOC:
  		basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
-@@ -552,7 +552,7 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
+@@ -553,7 +553,7 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
  
  	if (sta) {
  		if (vif->type == NL80211_IFTYPE_STATION)
@@ -178,7 +174,7 @@
  		else
  			generic->partial_aid = cpu_to_le16(sta->aid);
  		memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
-@@ -601,14 +601,14 @@ mt76_connac_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -602,14 +602,14 @@ mt76_connac_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  	    vif->type != NL80211_IFTYPE_STATION)
  		return;
  
@@ -195,7 +191,7 @@
  			       IEEE80211_MAX_MPDU_LEN_VHT_7991;
  
  	wcid->amsdu = true;
-@@ -619,7 +619,7 @@ mt76_connac_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -620,7 +620,7 @@ mt76_connac_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  static void
  mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  {
@@ -204,7 +200,7 @@
  	struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
  	struct sta_rec_he *he;
  	struct tlv *tlv;
-@@ -707,7 +707,7 @@ mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -708,7 +708,7 @@ mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  
  	he->he_cap = cpu_to_le32(cap);
  
@@ -213,7 +209,7 @@
  	case IEEE80211_STA_RX_BW_160:
  		if (elem->phy_cap_info[0] &
  		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
-@@ -752,7 +752,7 @@ mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -753,7 +753,7 @@ mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  static void
  mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
  {
@@ -222,7 +218,7 @@
  	struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
  	struct sta_rec_he_v2 *he;
  	struct tlv *tlv;
-@@ -763,7 +763,7 @@ mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -764,7 +764,7 @@ mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
  	memcpy(he->he_phy_cap, elem->phy_cap_info, sizeof(he->he_phy_cap));
  	memcpy(he->he_mac_cap, elem->mac_cap_info, sizeof(he->he_mac_cap));
  
@@ -231,7 +227,7 @@
  	case IEEE80211_STA_RX_BW_160:
  		if (elem->phy_cap_info[0] &
  		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
-@@ -779,7 +779,7 @@ mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -780,7 +780,7 @@ mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
  		break;
  	}
  
@@ -240,7 +236,7 @@
  }
  
  static u8
-@@ -792,9 +792,9 @@ mt76_connac_get_phy_mode_v2(struct mt76_phy *mphy, struct ieee80211_vif *vif,
+@@ -793,9 +793,9 @@ mt76_connac_get_phy_mode_v2(struct mt76_phy *mphy, struct ieee80211_vif *vif,
  	u8 mode = 0;
  
  	if (sta) {
@@ -253,7 +249,7 @@
  	} else {
  		struct ieee80211_supported_band *sband;
  
-@@ -843,25 +843,25 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -844,25 +844,25 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  	u16 supp_rates;
  
  	/* starec ht */
@@ -285,7 +281,7 @@
  	}
  
  	/* starec uapsd */
-@@ -870,11 +870,11 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -871,11 +871,11 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  	if (!is_mt7921(dev))
  		return;
  
@@ -299,7 +295,7 @@
  		mt76_connac_mcu_sta_he_tlv(skb, sta);
  		mt76_connac_mcu_sta_he_tlv_v2(skb, sta);
  		if (band == NL80211_BAND_6GHZ &&
-@@ -884,7 +884,7 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -885,7 +885,7 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  			tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G,
  						      sizeof(*he_6g_capa));
  			he_6g_capa = (struct sta_rec_he_6g_capa *)tlv;
@@ -308,7 +304,7 @@
  		}
  	}
  
-@@ -894,14 +894,14 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -895,14 +895,14 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  	phy->basic_rate = cpu_to_le16((u16)vif->bss_conf.basic_rates);
  	phy->rcpi = rcpi;
  	phy->ampdu = FIELD_PREP(IEEE80211_HT_AMPDU_PARM_FACTOR,
@@ -326,7 +322,7 @@
  	if (band == NL80211_BAND_2GHZ)
  		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates >> 4) |
  			     FIELD_PREP(RA_LEGACY_CCK, supp_rates & 0xf);
-@@ -910,18 +910,18 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -911,18 +911,18 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  
  	ra_info->legacy = cpu_to_le16(supp_rates);
  
@@ -350,7 +346,7 @@
  			IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
  	}
  }
-@@ -937,7 +937,7 @@ void mt76_connac_mcu_wtbl_smps_tlv(struct sk_buff *skb,
+@@ -938,7 +938,7 @@ void mt76_connac_mcu_wtbl_smps_tlv(struct sk_buff *skb,
  	tlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
  					     wtbl_tlv, sta_wtbl);
  	smps = (struct wtbl_smps *)tlv;
@@ -359,7 +355,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_connac_mcu_wtbl_smps_tlv);
  
-@@ -949,27 +949,27 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -950,27 +950,27 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  	struct tlv *tlv;
  	u32 flags = 0;
  
@@ -395,7 +391,7 @@
  		struct wtbl_vht *vht;
  		u8 af;
  
-@@ -978,18 +978,18 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -979,18 +979,18 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  						     sta_wtbl);
  		vht = (struct wtbl_vht *)tlv;
  		vht->ldpc = vht_ldpc &&
@@ -417,7 +413,7 @@
  		/* sgi */
  		u32 msk = MT_WTBL_W5_SHORT_GI_20 | MT_WTBL_W5_SHORT_GI_40 |
  			  MT_WTBL_W5_SHORT_GI_80 | MT_WTBL_W5_SHORT_GI_160;
-@@ -999,15 +999,15 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -1000,15 +1000,15 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  						     sizeof(*raw), wtbl_tlv,
  						     sta_wtbl);
  
@@ -438,7 +434,7 @@
  				flags |= MT_WTBL_W5_SHORT_GI_160;
  		}
  		raw = (struct wtbl_raw *)tlv;
-@@ -1293,9 +1293,9 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
+@@ -1294,9 +1294,9 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
  		return 0x38;
  
  	if (sta) {
@@ -451,7 +447,7 @@
  	} else {
  		struct ieee80211_supported_band *sband;
  
-@@ -1615,7 +1615,6 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
+@@ -1616,7 +1616,6 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
  	for (i = 0; i < sreq->n_ssids; i++) {
  		if (!sreq->ssids[i].ssid_len)
  			continue;
@@ -459,7 +455,7 @@
  		req->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
  		memcpy(req->ssids[i].ssid, sreq->ssids[i].ssid,
  		       sreq->ssids[i].ssid_len);
-@@ -1748,7 +1747,6 @@ int mt76_connac_mcu_sched_scan_req(struct mt76_phy *phy,
+@@ -1749,7 +1748,6 @@ int mt76_connac_mcu_sched_scan_req(struct mt76_phy *phy,
  		memcpy(req->ssids[i].ssid, ssid->ssid, ssid->ssid_len);
  		req->ssids[i].ssid_len = cpu_to_le32(ssid->ssid_len);
  	}
@@ -467,7 +463,7 @@
  	req->match_num = sreq->n_match_sets;
  	for (i = 0; i < req->match_num; i++) {
  		match = &sreq->match_sets[i];
-@@ -2235,10 +2233,8 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
+@@ -2236,10 +2234,8 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
  				      struct mt76_vif *vif,
  				      struct ieee80211_bss_conf *info)
  {
@@ -479,7 +475,7 @@
  			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
  	struct {
  		struct {
-@@ -2266,7 +2262,7 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
+@@ -2267,7 +2263,7 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
  
  	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
  	for (i = 0; i < len; i++)
@@ -489,7 +485,7 @@
  	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(OFFLOAD), true);
  }
 diff --git a/mt76x02_mac.c b/mt76x02_mac.c
-index d3f7447..87ea3db 100644
+index d3f74473..87ea3db1 100644
 --- a/mt76x02_mac.c
 +++ b/mt76x02_mac.c
 @@ -404,7 +404,7 @@ void mt76x02_mac_write_txwi(struct mt76x02_dev *dev, struct mt76x02_txwi *txwi,
@@ -514,10 +510,10 @@
  		if (info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)
  			ba_size = 0;
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index f3b039f..47c9dfd 100644
+index b178036c..cecc3ef5 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
-@@ -1840,8 +1840,8 @@ static ssize_t mt7915_sta_fixed_rate_set(struct file *file,
+@@ -1905,8 +1905,8 @@ static ssize_t mt7915_sta_fixed_rate_set(struct file *file,
  
  	phy.ldpc = (phy.bw || phy.ldpc) * GENMASK(2, 0);
  	for (i = 0; i <= phy.bw; i++) {
@@ -529,10 +525,10 @@
  	field = RATE_PARAM_FIXED;
  
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 50b7ed5..1dde068 100644
+index 36260085..e3d4ebc4 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
-@@ -554,8 +554,8 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+@@ -555,8 +555,8 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
  	if (ret < 0)
  		return ret;
  
@@ -544,7 +540,7 @@
  
  	mt7915_dma_enable(dev);
 diff --git a/mt7915/init.c b/mt7915/init.c
-index c347509..e643c0e 100755
+index c347509b..e643c0e4 100755
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -1148,8 +1148,7 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
@@ -558,7 +554,7 @@
  
  		if (band == NL80211_BAND_6GHZ) {
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index d5df73d..3bbe757 100644
+index d5df73db..3bbe757c 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -913,7 +913,7 @@ mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
@@ -571,7 +567,7 @@
  
  	tid = le32_get_bits(txwi[1], MT_TXD1_TID);
 diff --git a/mt7915/main.c b/mt7915/main.c
-index dcf1583..5d678df 100644
+index dcf1583d..5d678df8 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -503,7 +503,7 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
@@ -615,10 +611,10 @@
  
  	mutex_lock(&dev->mt76.mutex);
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 737a714..5bd1881 100644
+index 69f1a0d4..87c28224 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -63,7 +63,7 @@ mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
+@@ -64,7 +64,7 @@ mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
  	struct mt7915_dev *dev = msta->vif->phy->dev;
  	enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
  	const u16 *mask = msta->vif->bitrate_mask.control[band].he_mcs;
@@ -627,7 +623,7 @@
  
  	for (nss = 0; nss < max_nss; nss++) {
  		int mcs;
-@@ -103,7 +103,7 @@ mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
+@@ -104,7 +104,7 @@ mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
  
  		/* only support 2ss on 160MHz for mt7915 */
  		if (is_mt7915(&dev->mt76) && nss > 1 &&
@@ -636,7 +632,7 @@
  			break;
  	}
  
-@@ -116,8 +116,8 @@ mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
+@@ -117,8 +117,8 @@ mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
  {
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_dev *dev = msta->vif->phy->dev;
@@ -647,7 +643,7 @@
  	u16 mcs;
  
  	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
-@@ -139,7 +139,7 @@ mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
+@@ -140,7 +140,7 @@ mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
  
  		/* only support 2ss on 160MHz for mt7915 */
  		if (is_mt7915(&dev->mt76) && nss > 1 &&
@@ -656,7 +652,7 @@
  			break;
  	}
  }
-@@ -148,10 +148,10 @@ static void
+@@ -149,10 +149,10 @@ static void
  mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
  			  const u8 *mask)
  {
@@ -669,7 +665,7 @@
  }
  
  static int
-@@ -229,7 +229,7 @@ int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
+@@ -230,7 +230,7 @@ int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
  static void
  mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -678,7 +674,7 @@
  		ieee80211_csa_finish(vif);
  }
  
-@@ -330,7 +330,7 @@ mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -331,7 +331,7 @@ mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
  static void
  mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -687,7 +683,7 @@
  		return;
  
  	ieee80211_color_change_finish(vif);
-@@ -730,13 +730,13 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -731,13 +731,13 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  		      struct ieee80211_vif *vif)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
@@ -703,7 +699,7 @@
  		return;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
-@@ -822,8 +822,8 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -823,8 +823,8 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  
  	he->he_cap = cpu_to_le32(cap);
  
@@ -714,7 +710,7 @@
  	case IEEE80211_STA_RX_BW_160:
  		if (elem->phy_cap_info[0] &
  		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
-@@ -873,7 +873,7 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -874,7 +874,7 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  			struct ieee80211_sta *sta, struct ieee80211_vif *vif)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
@@ -723,7 +719,7 @@
  	struct sta_rec_muru *muru;
  	struct tlv *tlv;
  
-@@ -897,11 +897,11 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -898,11 +898,11 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	muru->cfg.ofdma_dl_en = !!(dev->dbg.muru_onoff & OFDMA_DL);
  	muru->cfg.ofdma_ul_en = !!(dev->dbg.muru_onoff & OFDMA_UL);
  
@@ -738,7 +734,7 @@
  		return;
  
  	muru->mimo_dl.partial_bw_dl_mimo =
-@@ -935,13 +935,13 @@ mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -936,13 +936,13 @@ mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	struct sta_rec_ht *ht;
  	struct tlv *tlv;
  
@@ -754,7 +750,7 @@
  }
  
  static void
-@@ -950,15 +950,15 @@ mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -951,15 +951,15 @@ mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	struct sta_rec_vht *vht;
  	struct tlv *tlv;
  
@@ -774,7 +770,7 @@
  }
  
  static void
-@@ -973,7 +973,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -974,7 +974,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	    vif->type != NL80211_IFTYPE_AP)
  		return;
  
@@ -783,7 +779,7 @@
  	    return;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
-@@ -982,7 +982,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -983,7 +983,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	amsdu->amsdu_en = true;
  	msta->wcid.amsdu = true;
  
@@ -792,7 +788,7 @@
  	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
  		if (!is_mt7915(&dev->mt76)) {
  			amsdu->max_mpdu_size =
-@@ -1045,8 +1045,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -1046,8 +1046,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  	if (!bfee && tx_ant < 2)
  		return false;
  
@@ -803,7 +799,7 @@
  
  		if (bfee)
  			return mvif->cap.he_su_ebfee &&
-@@ -1056,8 +1056,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -1057,8 +1057,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
  	}
  
@@ -814,7 +810,7 @@
  
  		if (bfee)
  			return mvif->cap.vht_su_ebfee &&
-@@ -1083,7 +1083,7 @@ static void
+@@ -1084,7 +1084,7 @@ static void
  mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
  		       struct sta_rec_bf *bf)
  {
@@ -823,7 +819,7 @@
  	u8 n = 0;
  
  	bf->tx_mode = MT_PHY_TYPE_HT;
-@@ -1108,7 +1108,7 @@ static void
+@@ -1109,7 +1109,7 @@ static void
  mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
  			struct sta_rec_bf *bf, bool explicit)
  {
@@ -832,7 +828,7 @@
  	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
  	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
  	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
-@@ -1129,14 +1129,14 @@ mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
+@@ -1130,14 +1130,14 @@ mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
  		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
  		bf->ibf_ncol = bf->ncol;
  
@@ -849,7 +845,7 @@
  			bf->ibf_nrow = 1;
  	}
  }
-@@ -1145,7 +1145,7 @@ static void
+@@ -1146,7 +1146,7 @@ static void
  mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
  {
@@ -858,7 +854,7 @@
  	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
  	const struct ieee80211_sta_he_cap *vc =
  		mt76_connac_get_he_phy_cap(phy->mt76, vif);
-@@ -1170,7 +1170,7 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+@@ -1171,7 +1171,7 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
  	bf->ibf_ncol = bf->ncol;
  
@@ -867,7 +863,7 @@
  		return;
  
  	/* go over for 160MHz and 80p80 */
-@@ -1218,7 +1218,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1219,7 +1219,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	};
  	bool ebf;
  
@@ -876,7 +872,7 @@
  		return;
  
  	ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
-@@ -1232,21 +1232,21 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1233,21 +1233,21 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	 * vht: support eBF and iBF
  	 * ht: iBF only, since mac80211 lacks of eBF support
  	 */
@@ -904,7 +900,7 @@
  		bf->ibf_timeout = 0x48;
  	else
  		bf->ibf_timeout = 0x18;
-@@ -1256,7 +1256,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1257,7 +1257,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	else
  		bf->mem_20m = matrix[bf->nrow][bf->ncol];
  
@@ -913,7 +909,7 @@
  	case IEEE80211_STA_RX_BW_160:
  	case IEEE80211_STA_RX_BW_80:
  		bf->mem_total = bf->mem_20m * 2;
-@@ -1281,7 +1281,7 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1282,7 +1282,7 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	struct tlv *tlv;
  	u8 nrow = 0;
  
@@ -922,7 +918,7 @@
  		return;
  
  	if (!mt7915_is_ebf_supported(phy, vif, sta, true))
-@@ -1290,13 +1290,13 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1291,13 +1291,13 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
  	bfee = (struct sta_rec_bfee *)tlv;
  
@@ -940,7 +936,7 @@
  
  		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
  				 pc->cap);
-@@ -1352,7 +1352,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -1353,7 +1353,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  			ra->phy = *phy;
  		break;
  	case RATE_PARAM_MMPS_UPDATE:
@@ -949,7 +945,7 @@
  		break;
  	case RATE_PARAM_SPE_UPDATE:
  		ra->spe_idx = *(u8 *)data;
-@@ -1427,7 +1427,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1428,7 +1428,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  	do {									\
  		u8 i, gi = mask->control[band]._gi;				\
  		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
@@ -958,7 +954,7 @@
  			phy.sgi |= gi << (i << (_he));				\
  			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
  		}								\
-@@ -1441,11 +1441,11 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1442,11 +1442,11 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  		}								\
  	} while (0)
  
@@ -973,7 +969,7 @@
  		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
  	} else {
  		nrates = hweight32(mask->control[band].legacy);
-@@ -1479,7 +1479,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1480,7 +1480,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  		 * actual txrate hardware sends out.
  		 */
  		addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
@@ -982,7 +978,7 @@
  			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
  		else
  			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
-@@ -1512,7 +1512,7 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1513,7 +1513,7 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  	enum nl80211_band band = chandef->chan->band;
  	struct sta_rec_ra *ra;
  	struct tlv *tlv;
@@ -991,7 +987,7 @@
  	u32 cap = sta->wme ? STA_CAP_WMM : 0;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
-@@ -1522,9 +1522,9 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1523,9 +1523,9 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  	ra->auto_rate = true;
  	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
  	ra->channel = chandef->chan->hw_value;
@@ -1004,7 +1000,7 @@
  
  	if (supp_rate) {
  		supp_rate &= mask->control[band].legacy;
-@@ -1544,22 +1544,22 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1545,22 +1545,22 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  		}
  	}
  
@@ -1035,7 +1031,7 @@
  			cap |= STA_CAP_LDPC;
  
  		mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
-@@ -1567,37 +1567,37 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1568,37 +1568,37 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
  	}
  
@@ -1083,7 +1079,7 @@
  					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
  	}
  
-@@ -1806,7 +1806,7 @@ mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
+@@ -1807,7 +1807,7 @@ mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
  	if (!offs->cntdwn_counter_offs[0])
  		return;
  
@@ -1092,7 +1088,7 @@
  	tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
  					   &bcn->sub_ntlv, &bcn->len);
  	info = (struct bss_info_bcn_cntdwn *)tlv;
-@@ -1891,9 +1891,9 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1892,9 +1892,9 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  	if (offs->cntdwn_counter_offs[0]) {
  		u16 offset = offs->cntdwn_counter_offs[0];
  
@@ -1104,7 +1100,7 @@
  			cont->bcc_ofs = cpu_to_le16(offset - 3);
  	}
  
-@@ -2077,7 +2077,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2078,7 +2078,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	if (!en)
  		goto out;
  
@@ -1113,7 +1109,7 @@
  	if (!skb)
  		return -EINVAL;
  
-@@ -3278,17 +3278,17 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3280,17 +3280,17 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  	if (txpower) {
  		u32 offs, len, i;
  
@@ -1134,8 +1130,29 @@
  					offs += len + sku_len[SKU_HE_RU26] * 3;
  					len = sku_len[SKU_HE_RU242] * 4;
  				}
+diff --git a/mt7915/testmode.c b/mt7915/testmode.c
+index 2ae6c07f..75be1ed9 100644
+--- a/mt7915/testmode.c
++++ b/mt7915/testmode.c
+@@ -360,12 +360,12 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
+ 	}
+ 
+ 	if (td->tx_rate_mode >= MT76_TM_TX_MODE_HT)
+-		memcpy(&sta->deflink.ht_cap, &sband->ht_cap, sizeof(sta->deflink.ht_cap));
++		memcpy(&sta->ht_cap, &sband->ht_cap, sizeof(sta->ht_cap));
+ 	if (td->tx_rate_mode >= MT76_TM_TX_MODE_VHT)
+-		memcpy(&sta->deflink.vht_cap, &sband->vht_cap, sizeof(sta->deflink.vht_cap));
++		memcpy(&sta->vht_cap, &sband->vht_cap, sizeof(sta->vht_cap));
+ 	if (td->tx_rate_mode >= MT76_TM_TX_MODE_HE_SU)
+-		memcpy(&sta->deflink.he_cap, &sdata[NL80211_IFTYPE_STATION].he_cap,
+-		       sizeof(sta->deflink.he_cap));
++		memcpy(&sta->he_cap, &sdata[NL80211_IFTYPE_STATION].he_cap,
++		       sizeof(sta->he_cap));
+ 	sta->aid = aid;
+ 	sta->wme = 1;
+ 
 diff --git a/tx.c b/tx.c
-index 6d55566..91c8dd8 100644
+index 6d55566f..91c8dd8d 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -60,20 +60,15 @@ mt76_tx_status_unlock(struct mt76_dev *dev, struct sk_buff_head *list)
@@ -1163,5 +1180,5 @@
  
  		hw = mt76_tx_status_get_hw(dev, skb);
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/patches.inc b/recipes-wifi/linux-mt76/files/patches/patches.inc
index 6985ba6..edd01f5 100644
--- a/recipes-wifi/linux-mt76/files/patches/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches/patches.inc
@@ -27,6 +27,7 @@
     file://1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch \
     file://1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch \
     file://1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch \
+    file://1129-mt76-mt7915-add-bf-backoff-limit-table-support.patch \
     file://3001-mt76-mt7915-wed-add-wed-tx-support.patch \
     file://3002-mt76-mt7915-wed-add-wed-tx-wds-support-on-mt7986.patch \
     file://3003-mt76-connac-wed-add-wed-rx-copy-skb.patch \
diff --git a/recipes-wifi/wpa-supplicant/files/patches/350-nl80211_del_beacon_bss.patch b/recipes-wifi/wpa-supplicant/files/patches/350-nl80211_del_beacon_bss.patch
index 85298df..a88b63e 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/350-nl80211_del_beacon_bss.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/350-nl80211_del_beacon_bss.patch
@@ -10,7 +10,7 @@
  	bss->freq = 0;
  	nl80211_put_wiphy_data_ap(bss);
 -	msg = nl80211_drv_msg(drv, 0, NL80211_CMD_DEL_BEACON);
-+	msg = nl80211_bss_msg(drv, 0, NL80211_CMD_DEL_BEACON);
++	msg = nl80211_bss_msg(bss, 0, NL80211_CMD_DEL_BEACON);
  	return send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
  }
  
diff --git a/recipes-wifi/wpa-supplicant/files/src/src/ap/ubus.c b/recipes-wifi/wpa-supplicant/files/src/src/ap/ubus.c
index b7b8343..5001225 100644
--- a/recipes-wifi/wpa-supplicant/files/src/src/ap/ubus.c
+++ b/recipes-wifi/wpa-supplicant/files/src/src/ap/ubus.c
@@ -390,32 +390,6 @@
 	return 0;
 }
 
-/* Imported from iw/util.c
- *  https://git.kernel.org/pub/scm/linux/kernel/git/jberg/iw.git/tree/util.c?id=4b25ae3537af48dbf9d0abf94132e5ba01b32c18#n200
- */
-int ieee80211_frequency_to_channel(int freq)
-{
-	/* see 802.11-2007 17.3.8.3.2 and Annex J */
-	if (freq == 2484)
-		return 14;
-	/* see 802.11ax D6.1 27.3.23.2 and Annex E */
-	else if (freq == 5935)
-		return 2;
-	else if (freq < 2484)
-		return (freq - 2407) / 5;
-	else if (freq >= 4910 && freq <= 4980)
-		return (freq - 4000) / 5;
-	else if (freq < 5950)
-		return (freq - 5000) / 5;
-	else if (freq <= 45000) /* DMG band lower limit */
-		/* see 802.11ax D6.1 27.3.23.2 */
-		return (freq - 5950) / 5;
-	else if (freq >= 58320 && freq <= 70200)
-		return (freq - 56160) / 2160;
-	else
-		return 0;
-}
-
 static int
 hostapd_bss_get_status(struct ubus_context *ctx, struct ubus_object *obj,
 		       struct ubus_request_data *req, const char *method,
diff --git a/recipes-wifi/wpa-supplicant/files/src/src/utils/build_features.h b/recipes-wifi/wpa-supplicant/files/src/src/utils/build_features.h
index 138a799..553769e 100644
--- a/recipes-wifi/wpa-supplicant/files/src/src/utils/build_features.h
+++ b/recipes-wifi/wpa-supplicant/files/src/src/utils/build_features.h
@@ -7,10 +7,6 @@
 	if (!strcmp(feat, "eap"))
 		return 1;
 #endif
-#ifdef CONFIG_IEEE80211N
-	if (!strcmp(feat, "11n"))
-		return 1;
-#endif
 #ifdef CONFIG_IEEE80211AC
 	if (!strcmp(feat, "11ac"))
 		return 1;