diff --git a/recipes-kernel/linux-mt76/files/patches/1123-mt76-add-ibf-control-vendor-cmd.patch b/recipes-kernel/linux-mt76/files/patches/1123-mt76-add-ibf-control-vendor-cmd.patch
new file mode 100755
index 0000000..6473cb6
--- /dev/null
+++ b/recipes-kernel/linux-mt76/files/patches/1123-mt76-add-ibf-control-vendor-cmd.patch
@@ -0,0 +1,150 @@
+From bb8f76430a25f016c63a62f8b1ae5995398911ef Mon Sep 17 00:00:00 2001
+From: mtk27835 <shurong.wen@mediatek.com>
+Date: Wed, 7 Sep 2022 14:01:29 -0700
+Subject: [PATCH] [PATCH 1123] mt76: add ibf control vendor cmd
+
+Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
+---
+ mt7915/vendor.c | 70 +++++++++++++++++++++++++++++++++++++++++++++++++
+ mt7915/vendor.h | 25 +++++++++++++++++-
+ 2 files changed, 94 insertions(+), 1 deletion(-)
+
+diff --git a/mt7915/vendor.c b/mt7915/vendor.c
+index 7f67c0d..cbbb084 100644
+--- a/mt7915/vendor.c
++++ b/mt7915/vendor.c
+@@ -78,6 +78,16 @@ edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
+        [MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE] = { .type = NLA_S8 },
+ };
+ 
++static const struct nla_policy
++ibf_ctrl_policy[NUM_MTK_VENDOR_ATTRS_IBF_CTRL] = {
++	[MTK_VENDOR_ATTR_IBF_CTRL_ENABLE] = { .type = NLA_U8 },
++};
++
++static struct nla_policy
++ibf_dump_policy[NUM_MTK_VENDOR_ATTRS_IBF_DUMP] = {
++	[MTK_VENDOR_ATTR_IBF_DUMP_ENABLE] = { .type = NLA_U8 },
++};
++
+ 
+ struct csi_null_tone {
+ 	u8 start;
+@@ -1120,6 +1130,54 @@ static int mt7915_vendor_3wire_ctrl(struct wiphy *wiphy,
+ 	return mt7915_mcu_set_cfg(phy, CFGINFO_3WIRE_EN_CFG, three_wire_mode);
+ }
+ 
++static int mt7915_vendor_ibf_ctrl(struct wiphy *wiphy,
++				  struct wireless_dev *wdev,
++				  const void *data,
++				  int data_len)
++{
++	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++	struct mt7915_phy *phy = mt7915_hw_phy(hw);
++	struct mt7915_dev *dev = phy->dev;
++	struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_IBF_CTRL];
++	int err;
++	u8 val;
++
++	err = nla_parse(tb, MTK_VENDOR_ATTR_IBF_CTRL_MAX, data, data_len,
++			ibf_ctrl_policy, NULL);
++	if (err)
++		return err;
++
++	if (tb[MTK_VENDOR_ATTR_IBF_CTRL_ENABLE]) {
++		val = nla_get_u8(tb[MTK_VENDOR_ATTR_IBF_CTRL_ENABLE]);
++
++		dev->ibf = !!val;
++
++		err = mt7915_mcu_set_txbf(dev, MT_BF_TYPE_UPDATE);
++		if (err)
++			return err;
++	}
++	return 0;
++}
++
++static int
++mt7915_vendor_ibf_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
++			     struct sk_buff *skb, const void *data, int data_len,
++			     unsigned long *storage)
++{
++	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++	struct mt7915_phy *phy = mt7915_hw_phy(hw);
++	struct mt7915_dev *dev = phy->dev;
++
++	if (*storage == 1)
++		return -ENOENT;
++	*storage = 1;
++
++	if (nla_put_u8(skb, MTK_VENDOR_ATTR_IBF_DUMP_ENABLE, dev->ibf))
++		return -ENOMEM;
++
++	return 1;
++}
++
+ 
+ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ 	{
+@@ -1212,6 +1270,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ 		.doit = mt7915_vendor_3wire_ctrl,
+ 		.policy = three_wire_ctrl_policy,
+ 		.maxattr = MTK_VENDOR_ATTR_3WIRE_CTRL_MAX,
++	},
++	{
++		.info = {
++			.vendor_id = MTK_NL80211_VENDOR_ID,
++			.subcmd = MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL,
++		},
++		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
++			 WIPHY_VENDOR_CMD_NEED_RUNNING,
++		.doit = mt7915_vendor_ibf_ctrl,
++		.dumpit = mt7915_vendor_ibf_ctrl_dump,
++		.policy = ibf_ctrl_policy,
++		.maxattr = MTK_VENDOR_ATTR_IBF_CTRL_MAX,
+ 	}
+ };
+ 
+diff --git a/mt7915/vendor.h b/mt7915/vendor.h
+index e0c5fd9..5aac559 100644
+--- a/mt7915/vendor.h
++++ b/mt7915/vendor.h
+@@ -11,7 +11,8 @@ enum mtk_nl80211_vendor_subcmds {
+ 	MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
+ 	MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL = 0xc6,
+ 	MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
+-	MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8
++	MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8,
++	MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL = 0xc9,
+ };
+ 
+ 
+@@ -206,4 +207,26 @@ enum mtk_vendor_attr_phy_capa_dump {
+ 		NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP - 1
+ };
+ 
++enum mtk_vendor_attr_ibf_ctrl {
++	MTK_VENDOR_ATTR_IBF_CTRL_UNSPEC,
++
++	MTK_VENDOR_ATTR_IBF_CTRL_ENABLE,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_IBF_CTRL,
++	MTK_VENDOR_ATTR_IBF_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_IBF_CTRL - 1
++};
++
++enum mtk_vendor_attr_ibf_dump {
++	MTK_VENDOR_ATTR_IBF_DUMP_UNSPEC,
++
++	MTK_VENDOR_ATTR_IBF_DUMP_ENABLE,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_IBF_DUMP,
++	MTK_VENDOR_ATTR_IBF_DUMP_MAX =
++		NUM_MTK_VENDOR_ATTRS_IBF_DUMP - 1
++};
++
+ #endif
+-- 
+2.32.0
+
diff --git a/recipes-kernel/linux-mt76/files/patches/3001-mt76-add-wed-tx-wds-support.patch b/recipes-kernel/linux-mt76/files/patches/3001-mt76-add-wed-tx-wds-support.patch
new file mode 100755
index 0000000..aa7f160
--- /dev/null
+++ b/recipes-kernel/linux-mt76/files/patches/3001-mt76-add-wed-tx-wds-support.patch
@@ -0,0 +1,232 @@
+From f9508e4fbb8e78c849d27394c99295319ccf8a28 Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Sat, 10 Sep 2022 17:09:21 +0800
+Subject: [PATCH] 3001-add-wed-tx-wds-support-on-mt7986
+
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+---
+ mac80211.c      |  5 ++++-
+ mt76.h          |  2 ++
+ mt7915/init.c   |  9 +++++++++
+ mt7915/main.c   | 47 +++++++++++++++++++++++++++++++++++++++++++----
+ mt7915/mcu.c    | 12 ++++++++++--
+ mt7915/mcu.h    |  1 +
+ mt7915/mmio.c   |  1 +
+ mt7915/mt7915.h |  4 ++++
+ 8 files changed, 74 insertions(+), 7 deletions(-)
+
+diff --git a/mac80211.c b/mac80211.c
+index 4eaf317..c477d62 100644
+--- a/mac80211.c
++++ b/mac80211.c
+@@ -1360,7 +1360,10 @@ void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,
+ 
+ 	mt76_packet_id_flush(dev, wcid);
+ 
+-	mt76_wcid_mask_clear(dev->wcid_mask, idx);
++	if (dev->drv->wed_wds_check(dev, sta))
++		mt76_wcid_mask_clear(dev->wcid_wds_mask, idx);
++	else
++		mt76_wcid_mask_clear(dev->wcid_mask, idx);
+ 	mt76_wcid_mask_clear(dev->wcid_phy_mask, idx);
+ }
+ EXPORT_SYMBOL_GPL(__mt76_sta_remove);
+diff --git a/mt76.h b/mt76.h
+index 4a41949..b7da992 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -426,6 +426,7 @@ struct mt76_driver_ops {
+ 
+ 	void (*sta_remove)(struct mt76_dev *dev, struct ieee80211_vif *vif,
+ 			   struct ieee80211_sta *sta);
++	bool (*wed_wds_check)(struct mt76_dev *dev, struct ieee80211_sta *sta);
+ };
+ 
+ struct mt76_channel_state {
+@@ -800,6 +801,7 @@ struct mt76_dev {
+ 	spinlock_t status_lock;
+ 
+ 	u32 wcid_mask[DIV_ROUND_UP(MT76_N_WCIDS, 32)];
++	u32 wcid_wds_mask[DIV_ROUND_UP(MT76_N_WCIDS, 32)];
+ 	u32 wcid_phy_mask[DIV_ROUND_UP(MT76_N_WCIDS, 32)];
+ 
+ 	u64 vif_mask;
+diff --git a/mt7915/init.c b/mt7915/init.c
+index 538ff5c..cd9d846 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -695,6 +695,15 @@ mt7915_init_hardware(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+ 			return ret;
+ 	}
+ 
++	/* wds workaround for mt7986 */
++	if (mtk_wed_device_active(&dev->mt76.mmio.wed) && is_mt7986(&dev->mt76)) {
++		for(idx = MT7915_WTBL_WDS_START; idx < MT7915_WTBL_WDS_END; idx++)
++			mt76_wcid_mask_set(dev->mt76.wcid_mask, idx);
++
++		for (idx = 0; idx < DIV_ROUND_UP(MT7915_WTBL_STA, 32); idx++)
++			dev->mt76.wcid_wds_mask[idx] = ~dev->mt76.wcid_mask[idx];
++	}
++
+ 	/* Beacon and mgmt frames should occupy wcid 0 */
+ 	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
+ 	if (idx)
+diff --git a/mt7915/main.c b/mt7915/main.c
+index b77b3be..144718e 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -658,6 +658,24 @@ mt7915_channel_switch_beacon(struct ieee80211_hw *hw,
+ 	mutex_unlock(&dev->mt76.mutex);
+ }
+ 
++bool
++mt7915_wed_wds_check(struct mt76_dev *mdev, struct ieee80211_sta *sta)
++{
++	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
++
++	if (!mtk_wed_device_active(&mdev->mmio.wed))
++		return false;
++
++	if(!is_mt7986(mdev))
++		return false;
++
++	if((msta->wcid.idx < MT7915_WTBL_WDS_START ||
++	     msta->wcid.idx > MT7915_WTBL_WDS_END))
++	     return false;
++
++	return true;
++}
++
+ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ 		       struct ieee80211_sta *sta)
+ {
+@@ -670,8 +688,18 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ #endif
+ 	int ret, idx;
+ 	u32 addr;
++	bool wed_wds = false;
+ 
+-	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
++	if (mtk_wed_device_active(&mdev->mmio.wed) && is_mt7986(mdev))
++		wed_wds = !!test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
++
++	if (wed_wds)
++		idx = mt76_wcid_alloc(mdev->wcid_wds_mask, MT7915_WTBL_STA);
++	else {
++		idx = mt76_wcid_alloc(mdev->wcid_mask, MT7915_WTBL_STA);
++		if (idx < 0)
++			idx = mt76_wcid_alloc(mdev->wcid_wds_mask, MT7915_WTBL_STA);
++	}
+ 	if (idx < 0)
+ 		return -ENOSPC;
+ 
+@@ -1107,6 +1135,14 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
+ 	else
+ 		clear_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
+ 
++	if (mtk_wed_device_active(&dev->mt76.mmio.wed) &&
++	    is_mt7986(&dev->mt76) &&
++	    (msta->wcid.idx < MT7915_WTBL_WDS_START ||
++	     msta->wcid.idx > MT7915_WTBL_WDS_END)) {
++		mt7915_sta_remove(hw, vif, sta);
++		mt7915_sta_add(hw, vif, sta);
++	 }
++
+ 	mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
+ }
+ 
+@@ -1449,9 +1485,12 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+ 	/* fw will find the wcid by dest addr */
+ 	if(is_mt7915(&dev->mt76))
+ 		path->mtk_wdma.wcid = 0xff;
+-	else
+-		path->mtk_wdma.wcid = 0x3ff;
+-
++	else {
++		if (test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags))
++			path->mtk_wdma.wcid = msta->wcid.idx;
++		else
++			path->mtk_wdma.wcid = 0x3ff;
++	}
+ 	path->mtk_wdma.queue = phy != &dev->phy;
+ 
+ 	ctx->dev = NULL;
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index a041bb2..73efa55 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -2348,6 +2348,7 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
+ int mt7915_run_firmware(struct mt7915_dev *dev)
+ {
+ 	int ret;
++	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
+ 
+ 	/* force firmware operation mode into normal state,
+ 	 * which should be set before firmware download stage.
+@@ -2377,8 +2378,15 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
+ 	if (ret)
+ 		return ret;
+ 
+-	if (mtk_wed_device_active(&dev->mt76.mmio.wed) && is_mt7915(&dev->mt76))
+-		mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY), 0, 0, 0);
++	if (mtk_wed_device_active(wed)) {
++		if (is_mt7915(&dev->mt76))
++			mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY),
++					  0, 0, 0);
++		else
++			mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
++					  MCU_WA_PARAM_WED_VERSION,
++					  wed->rev_id, 0);
++	}
+ 
+ 	ret = mt7915_mcu_set_mwds(dev, 1);
+ 	if (ret)
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index 9d0fac4..1f56db6 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -268,6 +268,7 @@ enum {
+ 	MCU_WA_PARAM_RED_SHOW_STA = 0xf,
+ 	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
+ #endif
++	MCU_WA_PARAM_WED_VERSION = 0x32,
+ };
+ 
+ enum mcu_mmps_mode {
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index b0d8a61..de797fd 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -774,6 +774,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
+ 		.sta_add = mt7915_mac_sta_add,
+ 		.sta_remove = mt7915_mac_sta_remove,
+ 		.update_survey = mt7915_update_channel,
++		.wed_wds_check = mt7915_wed_wds_check,
+ 	};
+ 	struct mt7915_dev *dev;
+ 	struct mt76_dev *mdev;
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index e329f74..33c00af 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -18,6 +18,9 @@
+ #define MT7915_WTBL_STA			(MT7915_WTBL_RESERVED - \
+ 					 MT7915_MAX_INTERFACES)
+ 
++#define MT7915_WTBL_WDS_START		256
++#define MT7915_WTBL_WDS_END		271
++
+ #define MT7915_WATCHDOG_TIME		(HZ / 10)
+ #define MT7915_RESET_TIMEOUT		(30 * HZ)
+ 
+@@ -699,6 +702,7 @@ void mt7915_tx_token_put(struct mt7915_dev *dev);
+ void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+ 			 struct sk_buff *skb);
+ bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len);
++bool mt7915_wed_wds_check(struct mt76_dev *mdev, struct ieee80211_sta *sta);
+ void mt7915_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
+ void mt7915_stats_work(struct work_struct *work);
+ int mt76_dfs_start_rdd(struct mt7915_dev *dev, bool force);
+-- 
+2.18.0
+
diff --git a/recipes-kernel/linux-mt76/files/patches/3002-mt76-add-wed-rx-support.patch b/recipes-kernel/linux-mt76/files/patches/3002-mt76-add-wed-rx-support.patch
index 499e4c6..4b7c349 100644
--- a/recipes-kernel/linux-mt76/files/patches/3002-mt76-add-wed-rx-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3002-mt76-add-wed-rx-support.patch
@@ -8,7 +8,7 @@
  dma.c             | 250 ++++++++++++++++++++++++++++++++++++++--------
  dma.h             |  10 ++
  mac80211.c        |   8 +-
- mt76.h            |  25 ++++-
+ mt76.h            |  24 ++++-
  mt7603/dma.c      |   2 +-
  mt7603/mt7603.h   |   2 +-
  mt7615/mac.c      |   2 +-
@@ -17,19 +17,16 @@
  mt76x02.h         |   2 +-
  mt76x02_txrx.c    |   2 +-
  mt7915/dma.c      |  25 +++--
- mt7915/init.c     |   9 ++
  mt7915/mac.c      | 103 ++++++++++++++++++-
- mt7915/main.c     |  26 ++++-
- mt7915/mcu.c      |  14 ++-
- mt7915/mcu.h      |   1 +
+ mt7915/mcu.c      |   3 +
  mt7915/mmio.c     |  26 ++++-
- mt7915/mt7915.h   |  10 +-
+ mt7915/mt7915.h   |   7 +-
  mt7915/regs.h     |  14 ++-
  mt7921/mac.c      |   2 +-
  mt7921/mt7921.h   |   4 +-
  mt7921/pci_mac.c  |   4 +-
  tx.c              |  34 +++++++
- 24 files changed, 505 insertions(+), 81 deletions(-)
+ 21 files changed, 460 insertions(+), 75 deletions(-)
 
 diff --git a/dma.c b/dma.c
 index 8ea09e6..3317d2b 100644
@@ -504,10 +501,10 @@
  #define MT_RX_INFO_LEN			4
  #define MT_FCE_INFO_LEN			4
 diff --git a/mac80211.c b/mac80211.c
-index 2f0605d..a2bd8ca 100644
+index 4eaf317..731b78f 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -598,11 +598,14 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
+@@ -599,11 +599,14 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
  		BIT(NL80211_IFTYPE_ADHOC);
  
  	spin_lock_init(&dev->token_lock);
@@ -522,7 +519,7 @@
  	dev->token_size = dev->drv->token_size;
  
  	for (i = 0; i < ARRAY_SIZE(dev->q_rx); i++)
-@@ -1300,7 +1303,10 @@ void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
+@@ -1301,7 +1304,10 @@ void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
  
  	while ((skb = __skb_dequeue(&dev->rx_skb[q])) != NULL) {
  		mt76_check_sta(dev, skb);
@@ -535,7 +532,7 @@
  
  	mt76_rx_complete(dev, &frames, napi);
 diff --git a/mt76.h b/mt76.h
-index 4a41949..fb3ae86 100644
+index b7da992..20fd0ec 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -20,6 +20,8 @@
@@ -584,7 +581,7 @@
  
  	void (*rx_poll_complete)(struct mt76_dev *dev, enum mt76_rxq_id q);
  
-@@ -756,6 +763,7 @@ struct mt76_dev {
+@@ -757,6 +764,7 @@ struct mt76_dev {
  	struct ieee80211_hw *hw;
  
  	spinlock_t lock;
@@ -592,7 +589,7 @@
  	spinlock_t cc_lock;
  
  	u32 cur_cc_bss_rx;
-@@ -781,6 +789,7 @@ struct mt76_dev {
+@@ -782,6 +790,7 @@ struct mt76_dev {
  	struct sk_buff_head rx_skb[__MT_RXQ_MAX];
  
  	struct list_head txwi_cache;
@@ -600,7 +597,7 @@
  	struct mt76_queue *q_mcu[__MT_MCUQ_MAX];
  	struct mt76_queue q_rx[__MT_RXQ_MAX];
  	const struct mt76_queue_ops *queue_ops;
-@@ -794,12 +803,16 @@ struct mt76_dev {
+@@ -795,6 +804,9 @@ struct mt76_dev {
  	u16 wed_token_count;
  	u16 token_count;
  	u16 token_size;
@@ -610,14 +607,7 @@
  
  	wait_queue_head_t tx_wait;
  	/* spinclock used to protect wcid pktid linked list */
- 	spinlock_t status_lock;
- 
- 	u32 wcid_mask[DIV_ROUND_UP(MT76_N_WCIDS, 32)];
-+	u32 wcid_wds_mask[DIV_ROUND_UP(MT76_N_WCIDS, 32)];
- 	u32 wcid_phy_mask[DIV_ROUND_UP(MT76_N_WCIDS, 32)];
- 
- 	u64 vif_mask;
-@@ -1357,6 +1370,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1359,6 +1371,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  }
  
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
@@ -626,7 +616,7 @@
  void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
  		      struct napi_struct *napi);
  void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
-@@ -1501,6 +1516,12 @@ struct mt76_txwi_cache *
+@@ -1503,6 +1517,12 @@ struct mt76_txwi_cache *
  mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
  int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
  void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
@@ -836,26 +826,6 @@
  		/* rx data queue for band1 */
  		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_BAND1],
  				       MT_RXQ_ID(MT_RXQ_BAND1),
-diff --git a/mt7915/init.c b/mt7915/init.c
-index 538ff5c..cd9d846 100644
---- a/mt7915/init.c
-+++ b/mt7915/init.c
-@@ -695,6 +695,15 @@ mt7915_init_hardware(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 			return ret;
- 	}
- 
-+	/* wds workaround for mt7986 */
-+	if (mtk_wed_device_active(&dev->mt76.mmio.wed) && is_mt7986(&dev->mt76)) {
-+		for(idx = MT7915_WTBL_WDS_START; idx < MT7915_WTBL_WDS_END; idx++)
-+			mt76_wcid_mask_set(dev->mt76.wcid_mask, idx);
-+
-+		for (idx = 0; idx < DIV_ROUND_UP(MT7915_WTBL_STA, 32); idx++)
-+			dev->mt76.wcid_wds_mask[idx] = ~dev->mt76.wcid_mask[idx];
-+	}
-+
- 	/* Beacon and mgmt frames should occupy wcid 0 */
- 	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
- 	if (idx)
 diff --git a/mt7915/mac.c b/mt7915/mac.c
 index 0a13b7d..4e1dfc9 100644
 --- a/mt7915/mac.c
@@ -1005,60 +975,8 @@
  			mt76_rx(&dev->mt76, q, skb);
  			return;
  		}
-diff --git a/mt7915/main.c b/mt7915/main.c
-index b77b3be..29ee700 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -670,8 +670,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- #endif
- 	int ret, idx;
- 	u32 addr;
-+	bool wed_wds = false;
- 
--	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
-+	if (mtk_wed_device_active(&mdev->mmio.wed) && is_mt7986(mdev))
-+		wed_wds = !!test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
-+
-+	if (wed_wds)
-+		idx = mt76_wcid_alloc(mdev->wcid_wds_mask, MT7915_WTBL_STA);
-+	else
-+	        idx = mt76_wcid_alloc(mdev->wcid_mask, MT7915_WTBL_STA);
- 	if (idx < 0)
- 		return -ENOSPC;
- 
-@@ -1107,6 +1114,14 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
- 	else
- 		clear_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
- 
-+	if (mtk_wed_device_active(&dev->mt76.mmio.wed) &&
-+	    is_mt7986(&dev->mt76) &&
-+	    (msta->wcid.idx < MT7915_WTBL_WDS_START ||
-+	     msta->wcid.idx > MT7915_WTBL_WDS_END)) {
-+		mt7915_sta_remove(hw, vif, sta);
-+		mt7915_sta_add(hw, vif, sta);
-+	 }
-+
- 	mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
- }
- 
-@@ -1449,9 +1464,12 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
- 	/* fw will find the wcid by dest addr */
- 	if(is_mt7915(&dev->mt76))
- 		path->mtk_wdma.wcid = 0xff;
--	else
--		path->mtk_wdma.wcid = 0x3ff;
--
-+	else {
-+		if (test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags))
-+			path->mtk_wdma.wcid = msta->wcid.idx;
-+		else
-+			path->mtk_wdma.wcid = 0x3ff;
-+	}
- 	path->mtk_wdma.queue = phy != &dev->phy;
- 
- 	ctx->dev = NULL;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index a041bb2..3d50b78 100644
+index 73efa55..22f68da 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -1722,6 +1722,7 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
@@ -1078,43 +996,6 @@
  	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
  				     MCU_EXT_CMD(STA_REC_UPDATE), true);
  }
-@@ -2348,6 +2351,7 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
- int mt7915_run_firmware(struct mt7915_dev *dev)
- {
- 	int ret;
-+	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
- 
- 	/* force firmware operation mode into normal state,
- 	 * which should be set before firmware download stage.
-@@ -2377,8 +2381,14 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
- 	if (ret)
- 		return ret;
- 
--	if (mtk_wed_device_active(&dev->mt76.mmio.wed) && is_mt7915(&dev->mt76))
--		mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY), 0, 0, 0);
-+	if (mtk_wed_device_active(wed)) {
-+		if (is_mt7915(&dev->mt76))
-+			mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY),
-+					  0, 0, 0);
-+		mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
-+				  MCU_WA_PARAM_WED_VERSION,
-+				  wed->rev_id, 0);
-+	}
- 
- 	ret = mt7915_mcu_set_mwds(dev, 1);
- 	if (ret)
-diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 9d0fac4..1f56db6 100644
---- a/mt7915/mcu.h
-+++ b/mt7915/mcu.h
-@@ -268,6 +268,7 @@ enum {
- 	MCU_WA_PARAM_RED_SHOW_STA = 0xf,
- 	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
- #endif
-+	MCU_WA_PARAM_WED_VERSION = 0x32,
- };
- 
- enum mcu_mmps_mode {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
 index b0d8a61..111444d 100644
 --- a/mt7915/mmio.c
@@ -1197,20 +1078,10 @@
  	dev->mt76.dma_dev = wed->dev;
  	mdev->token_size = wed->wlan.token_start;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e329f74..b10b90a 100644
+index 33c00af..b805aae 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -18,6 +18,9 @@
- #define MT7915_WTBL_STA			(MT7915_WTBL_RESERVED - \
- 					 MT7915_MAX_INTERFACES)
- 
-+#define MT7915_WTBL_WDS_START		256
-+#define MT7915_WTBL_WDS_END		274
-+
- #define MT7915_WATCHDOG_TIME		(HZ / 10)
- #define MT7915_RESET_TIMEOUT		(30 * HZ)
- 
-@@ -78,6 +81,7 @@
+@@ -81,6 +81,7 @@
  #define MT7915_MAX_STA_TWT_AGRT		8
  #define MT7915_MIN_TWT_DUR 64
  #define MT7915_MAX_QUEUE		(MT_RXQ_BAND2 + __MT_MCUQ_MAX + 2)
@@ -1218,7 +1089,7 @@
  
  struct mt7915_vif;
  struct mt7915_sta;
-@@ -544,7 +548,9 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
+@@ -547,7 +548,9 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
  irqreturn_t mt7915_irq_handler(int irq, void *dev_instance);
  u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif);
  u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
@@ -1229,15 +1100,15 @@
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
  int mt7915_eeprom_init(struct mt7915_dev *dev);
-@@ -697,7 +703,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -700,7 +703,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  			  struct mt76_tx_info *tx_info);
  void mt7915_tx_token_put(struct mt7915_dev *dev);
  void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
 -			 struct sk_buff *skb);
 +			 struct sk_buff *skb, u32 info);
  bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len);
+ bool mt7915_wed_wds_check(struct mt76_dev *mdev, struct ieee80211_sta *sta);
  void mt7915_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
- void mt7915_stats_work(struct work_struct *work);
 diff --git a/mt7915/regs.h b/mt7915/regs.h
 index 432ed30..36ef8a9 100644
 --- a/mt7915/regs.h
diff --git a/recipes-kernel/linux-mt76/files/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch b/recipes-kernel/linux-mt76/files/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch
new file mode 100644
index 0000000..e6dc07a
--- /dev/null
+++ b/recipes-kernel/linux-mt76/files/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch
@@ -0,0 +1,142 @@
+From 17753f183bce83f2b2f03e9f15312f84b67558e9 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Fri, 2 Sep 2022 14:40:40 +0800
+Subject: [PATCH] mt76: mt7915: enable red per-band token drop for HW Path
+
+Limit the number of token used by each band. If a band uses too many token,
+it may hurt the throughput of the other band. The SW path can solve this
+problem by AQL.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+---
+ mt7915/mcu.c    | 53 +++++++++++++++++++++++++++++++++++++++----------
+ mt7915/mcu.h    |  1 +
+ mt7915/mt7915.h |  2 +-
+ 3 files changed, 45 insertions(+), 11 deletions(-)
+
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 1cbdf0cf..c29eb80a 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -2410,8 +2410,13 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
+ 			mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
+ 					  MCU_WA_PARAM_WED_VERSION,
+ 					  wed->rev_id, 0);
++
++		mt7915_mcu_set_red(dev, true);
++	} else {
++		mt7915_mcu_set_red(dev, false);
+ 	}
+ 
++
+ 	ret = mt7915_mcu_set_mwds(dev, 1);
+ 	if (ret)
+ 		return ret;
+@@ -2421,12 +2426,7 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = mt7915_mcu_init_rx_airtime(dev);
+-	if (ret)
+-		return ret;
+-
+-	return mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
+-				 MCU_WA_PARAM_RED, 0, 0);
++	return mt7915_mcu_init_rx_airtime(dev);
+ }
+ 
+ int mt7915_mcu_init(struct mt7915_dev *dev)
+@@ -4230,6 +4230,35 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
+ 
+ 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), wait_resp);
+ }
++#endif
++
++static int mt7915_red_set_watermark(struct mt7915_dev *dev)
++{
++#define RED_GLOBAL_TOKEN_WATERMARK 2
++#define TOTAL_HW_TOKEN_SIZE 8192
++	struct {
++		__le32 args[3];
++
++		u8 cmd;
++		u8 version;
++		u8 __rsv1[4];
++		u16 len;
++
++		__le16 high_mark;
++		__le16 low_mark;
++		u8 __rsv2[12];
++	} req = {
++		.args[0] = cpu_to_le32(MCU_WA_PARAM_RED_SETTING),
++		.cmd = RED_GLOBAL_TOKEN_WATERMARK,
++		.len = cpu_to_le16(sizeof(req) - 12),
++
++		.high_mark = cpu_to_le16(TOTAL_HW_TOKEN_SIZE - 256),
++		.low_mark = cpu_to_le16(TOTAL_HW_TOKEN_SIZE - 256 - 1536),
++	};
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_PARAM_CMD(SET), &req,
++				 sizeof(req), false);
++}
+ 
+ int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
+ {
+@@ -4240,17 +4269,21 @@ int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
+ 	u32 red_type = enabled > 0 ? RED_BY_WA_ENABLE : RED_DISABLE;
+ 	__le32 req = cpu_to_le32(red_type);
+ 
++	if (enabled) {
++		ret = mt7915_red_set_watermark(dev);
++		if (ret < 0)
++			return ret;
++	}
++
+ 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RED_ENABLE), &req,
+ 				 sizeof(req), false);
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	mt7915_dbg_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
+-			  MCU_WA_PARAM_RED, enabled, 0, true);
++	return mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
++				 MCU_WA_PARAM_RED, enabled, 0);
+ 
+-	return 0;
+ }
+-#endif
+ 
+ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
+ {
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index ce50e606..230ad9db 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -269,6 +269,7 @@ enum {
+ 	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
+ #endif
+ 	MCU_WA_PARAM_WED_VERSION = 0x32,
++	MCU_WA_PARAM_RED_SETTING = 0x40,
+ };
+ 
+ enum mcu_mmps_mode {
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index f2081640..f2a1e615 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -749,11 +749,11 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+ #endif
+ int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value,
+ 			 s8 compensation);
++int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled);
+ 
+ #ifdef MTK_DEBUG
+ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
+ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
+-int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled);
+ void mt7915_dump_tmac_info(u8 *tmac_info);
+ int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level);
+ void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len);
+-- 
+2.18.0
+
diff --git a/recipes-kernel/linux-mt76/files/patches/patches.inc b/recipes-kernel/linux-mt76/files/patches/patches.inc
index 2250c90..86258ac 100644
--- a/recipes-kernel/linux-mt76/files/patches/patches.inc
+++ b/recipes-kernel/linux-mt76/files/patches/patches.inc
@@ -30,10 +30,13 @@
     file://1120-mt76-mt7915-initialize-wcid.patch \
     file://1121-mt76-HEMU-Add-dump-support.patch \
     file://1122-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch \
+    file://1123-mt76-add-ibf-control-vendor-cmd.patch \
     file://3001-mt76-add-wed-tx-support.patch \
+    file://3001-mt76-add-wed-tx-wds-support.patch \
     file://3002-mt76-add-wed-rx-support.patch \
     file://3003-mt76-add-fill-receive-path-to-report-wed-idx.patch \
     file://3004-mt76-add-ser-spport-when-wed-on.patch \
     file://3005-mt76-mt7915-add-statistic-for-HW-Tx-Path.patch \
     file://3006-mt76-mt7915-add-statistic-for-HW-Rx-Path.patch \
+    file://3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch \
     "