[rdk-b][common][bsp][Refactor and sync kernel/wifi from Openwrt]

[Description]
Refactor and sync kernel/wifi from Openwrt

[Release-log]
N/A

diff --git a/recipes-connectivity/hostapd/files/patches/921-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch b/recipes-connectivity/hostapd/files/patches/921-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch
new file mode 100644
index 0000000..a3d8837
--- /dev/null
+++ b/recipes-connectivity/hostapd/files/patches/921-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch
@@ -0,0 +1,239 @@
+From 1bd8935beffa0d94c34a2ba4f3400c65b8629250 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Fri, 2 Sep 2022 01:03:23 +0800
+Subject: [PATCH] Add three wire PTA ctrl hostapd vendor command
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/config_file.c             |  4 ++++
+ src/ap/ap_config.c                |  1 +
+ src/ap/ap_config.h                | 13 ++++++++++++
+ src/ap/ap_drv_ops.c               | 11 +++++++++++
+ src/ap/ap_drv_ops.h               |  1 +
+ src/ap/hostapd.c                  |  2 ++
+ src/common/mtk_vendor.h           | 16 +++++++++++++++
+ src/drivers/driver.h              |  1 +
+ src/drivers/driver_nl80211.c      | 33 +++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h      |  1 +
+ src/drivers/driver_nl80211_capa.c |  3 +++
+ 11 files changed, 86 insertions(+)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index 85d58cd..ee5decb 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4770,6 +4770,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ 			return 1;
+ 		}
+ 		conf->edcca_compensation = (s8) val;
++	} else if (os_strcmp(buf, "three_wire_enable") == 0) {
++		u8 en = atoi(pos);
++
++		conf->three_wire_enable = en;
+ 	} else {
+ 		wpa_printf(MSG_ERROR,
+ 			   "Line %d: unknown configuration item '%s'",
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 79e215f..34e4fb1 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -297,6 +297,7 @@ struct hostapd_config * hostapd_config_defaults(void)
+ 
+ 	conf->edcca_enable = EDCCA_MODE_AUTO;
+ 	conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
++	conf->three_wire_enable = THREE_WIRE_MODE_DISABLE;
+ 
+ 	return conf;
+ }
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 7528430..99edb49 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1153,6 +1153,19 @@ struct hostapd_config {
+ 	unsigned int ch_switch_eht_config;
+ 	u8 edcca_enable;
+ 	s8 edcca_compensation;
++	u8 three_wire_enable;
++};
++
++enum three_wire_mode {
++	THREE_WIRE_MODE_DISABLE,
++	THREE_WIRE_MODE_EXT0_ENABLE,
++	THREE_WIRE_MODE_EXT1_ENABLE,
++	THREE_WIRE_MODE_ALL_ENABLE,
++
++	/* keep last */
++	NUM_THREE_WIRE_MODE,
++	THREE_WIRE_MODE_MAX =
++		NUM_THREE_WIRE_MODE - 1
+ };
+ 
+ enum edcca_mode {
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 5545232..77d5f89 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1038,3 +1038,14 @@ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff)
+ 		return 0;
+ 	return hapd->driver->hemu_dump(hapd->drv_priv, hemu_onoff);
+ }
++
++int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd)
++{
++	if (!hapd->driver || !hapd->driver->three_wire_ctrl)
++		return 0;
++	if (hapd->iconf->three_wire_enable > THREE_WIRE_MODE_MAX) {
++		wpa_printf(MSG_INFO, "Invalid value for three wire enable\n");
++		return 0;
++	}
++	return hapd->driver->three_wire_ctrl(hapd->drv_priv, hapd->iconf->three_wire_enable);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index 5bcb225..0a8bf0c 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -141,6 +141,7 @@ int hostapd_drv_dpp_listen(struct hostapd_data *hapd, bool enable);
+ int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd);
+ int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd);
+ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
++int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd);
+ 
+ #include "drivers/driver.h"
+ 
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index 0f3691b..32b75dc 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2299,6 +2299,8 @@ dfs_offload:
+ 		goto fail;
+ 	if (hostapd_drv_hemu_ctrl(hapd) < 0)
+ 		goto fail;
++	if (hostapd_drv_three_wire_ctrl(hapd) < 0)
++		goto fail;
+ 
+ 	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ 		   iface->bss[0]->conf->iface);
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 5c8f179..99a4d7f 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -13,6 +13,7 @@ enum mtk_nl80211_vendor_subcmds {
+ 	MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
+ 	MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL= 0xc6,
+ 	MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
++	MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8
+ };
+ 
+ enum mtk_vendor_attr_edcca_ctrl {
+@@ -48,6 +49,21 @@ static struct nla_policy edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
+ 	[MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE] = { .type = NLA_U8 },
+ };
+ 
++enum mtk_vendor_attr_3wire_ctrl {
++	MTK_VENDOR_ATTR_3WIRE_CTRL_UNSPEC,
++
++	MTK_VENDOR_ATTR_3WIRE_CTRL_MODE,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL,
++	MTK_VENDOR_ATTR_3WIRE_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL - 1
++};
++
++static struct nla_policy three_wire_ctrl_policy[NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL] = {
++	[MTK_VENDOR_ATTR_3WIRE_CTRL_MODE] = {.type = NLA_U8 },
++};
++
+ enum mtk_vendor_attr_csi_ctrl {
+ 	MTK_VENDOR_ATTR_CSI_CTRL_UNSPEC,
+ 
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 0f12feb..79e80b6 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4689,6 +4689,7 @@ struct wpa_driver_ops {
+ 	 */
+ 	 int (*hemu_ctrl)(void *priv, u8 hemu_onoff);
+ 	 int (*hemu_dump)(void *priv, u8 *hemu_onoff);
++	 int (*three_wire_ctrl)(void *priv, u8 three_wire_enable);
+ };
+ 
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index b2c3a2e..02f4b95 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12505,6 +12505,38 @@ static int nl80211_configure_edcca_threshold(void *priv,
+ 	return ret;
+ }
+ 
++static int nl80211_enable_three_wire(void *priv, const u8 three_wire_enable)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	/* Prepare nl80211 cmd */
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	if (!drv->mtk_3wire_vendor_cmd_avail) {
++		wpa_printf(MSG_INFO,
++			   "nl80211: Driver does not support setting three wire control");
++		return 0;
++	}
++
++	if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++	    nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++	    nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++			MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL) ||
++	    !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++	    nla_put_u8(msg, MTK_VENDOR_ATTR_3WIRE_CTRL_MODE, three_wire_enable)) {
++		nlmsg_free(msg);
++		return -ENOBUFS;
++	}
++	nla_nest_end(msg, data);
++	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++	if (ret) {
++		wpa_printf(MSG_ERROR, "Failed to enable three wire. ret=%d (%s) ",
++			   ret, strerror(-ret));
++	}
++	return ret;
++}
+ 
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.name = "nl80211",
+@@ -12655,4 +12687,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ #endif /* CONFIG_TESTING_OPTIONS */
+ /* Need ifdef CONFIG_DRIVER_NL80211_MTK */
+ 	.configure_edcca_threshold = nl80211_configure_edcca_threshold,
++	.three_wire_ctrl = nl80211_enable_three_wire,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 62d9696..196d24f 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -182,6 +182,7 @@ struct wpa_driver_nl80211_data {
+ 	unsigned int brcm_do_acs:1;
+ 	unsigned int mtk_edcca_vendor_cmd_avail:1;
+ 	unsigned int mtk_hemu_vendor_cmd_avail:1;
++	unsigned int mtk_3wire_vendor_cmd_avail:1;
+ 
+ 	u64 vendor_scan_cookie;
+ 	u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index b5cd2c5..f0397f5 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1053,6 +1053,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ 				case MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL :
+ 					drv->mtk_hemu_vendor_cmd_avail = 1;
+ 					break;
++				case MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL :
++					drv->mtk_3wire_vendor_cmd_avail = 1;
++					break;
+ 				}
+ 			}
+ 
+-- 
+2.18.0
+
diff --git a/recipes-connectivity/hostapd/files/patches/patches.inc b/recipes-connectivity/hostapd/files/patches/patches.inc
index 2ba3ff5..9a11077 100644
--- a/recipes-connectivity/hostapd/files/patches/patches.inc
+++ b/recipes-connectivity/hostapd/files/patches/patches.inc
@@ -65,6 +65,7 @@
     file://915-Support-new-hostapd-configuration-edcca_enable-and-e.patch \
     file://916-Add-hostapd-command-handler-for-SET_EDCCA-GET_EDCCA-.patch \
     file://920-Add-hostapd-HEMU-SET-GET-control.patch \
+    file://921-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch \
     file://990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch \
     file://991-fix-compile.patch \
     file://992-openssl-include-rsa.patch \
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/921-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch b/recipes-connectivity/wpa-supplicant/files/patches/921-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch
new file mode 100644
index 0000000..a3d8837
--- /dev/null
+++ b/recipes-connectivity/wpa-supplicant/files/patches/921-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch
@@ -0,0 +1,239 @@
+From 1bd8935beffa0d94c34a2ba4f3400c65b8629250 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Fri, 2 Sep 2022 01:03:23 +0800
+Subject: [PATCH] Add three wire PTA ctrl hostapd vendor command
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/config_file.c             |  4 ++++
+ src/ap/ap_config.c                |  1 +
+ src/ap/ap_config.h                | 13 ++++++++++++
+ src/ap/ap_drv_ops.c               | 11 +++++++++++
+ src/ap/ap_drv_ops.h               |  1 +
+ src/ap/hostapd.c                  |  2 ++
+ src/common/mtk_vendor.h           | 16 +++++++++++++++
+ src/drivers/driver.h              |  1 +
+ src/drivers/driver_nl80211.c      | 33 +++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h      |  1 +
+ src/drivers/driver_nl80211_capa.c |  3 +++
+ 11 files changed, 86 insertions(+)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index 85d58cd..ee5decb 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4770,6 +4770,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ 			return 1;
+ 		}
+ 		conf->edcca_compensation = (s8) val;
++	} else if (os_strcmp(buf, "three_wire_enable") == 0) {
++		u8 en = atoi(pos);
++
++		conf->three_wire_enable = en;
+ 	} else {
+ 		wpa_printf(MSG_ERROR,
+ 			   "Line %d: unknown configuration item '%s'",
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 79e215f..34e4fb1 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -297,6 +297,7 @@ struct hostapd_config * hostapd_config_defaults(void)
+ 
+ 	conf->edcca_enable = EDCCA_MODE_AUTO;
+ 	conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
++	conf->three_wire_enable = THREE_WIRE_MODE_DISABLE;
+ 
+ 	return conf;
+ }
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 7528430..99edb49 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1153,6 +1153,19 @@ struct hostapd_config {
+ 	unsigned int ch_switch_eht_config;
+ 	u8 edcca_enable;
+ 	s8 edcca_compensation;
++	u8 three_wire_enable;
++};
++
++enum three_wire_mode {
++	THREE_WIRE_MODE_DISABLE,
++	THREE_WIRE_MODE_EXT0_ENABLE,
++	THREE_WIRE_MODE_EXT1_ENABLE,
++	THREE_WIRE_MODE_ALL_ENABLE,
++
++	/* keep last */
++	NUM_THREE_WIRE_MODE,
++	THREE_WIRE_MODE_MAX =
++		NUM_THREE_WIRE_MODE - 1
+ };
+ 
+ enum edcca_mode {
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 5545232..77d5f89 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1038,3 +1038,14 @@ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff)
+ 		return 0;
+ 	return hapd->driver->hemu_dump(hapd->drv_priv, hemu_onoff);
+ }
++
++int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd)
++{
++	if (!hapd->driver || !hapd->driver->three_wire_ctrl)
++		return 0;
++	if (hapd->iconf->three_wire_enable > THREE_WIRE_MODE_MAX) {
++		wpa_printf(MSG_INFO, "Invalid value for three wire enable\n");
++		return 0;
++	}
++	return hapd->driver->three_wire_ctrl(hapd->drv_priv, hapd->iconf->three_wire_enable);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index 5bcb225..0a8bf0c 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -141,6 +141,7 @@ int hostapd_drv_dpp_listen(struct hostapd_data *hapd, bool enable);
+ int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd);
+ int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd);
+ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
++int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd);
+ 
+ #include "drivers/driver.h"
+ 
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index 0f3691b..32b75dc 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2299,6 +2299,8 @@ dfs_offload:
+ 		goto fail;
+ 	if (hostapd_drv_hemu_ctrl(hapd) < 0)
+ 		goto fail;
++	if (hostapd_drv_three_wire_ctrl(hapd) < 0)
++		goto fail;
+ 
+ 	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ 		   iface->bss[0]->conf->iface);
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 5c8f179..99a4d7f 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -13,6 +13,7 @@ enum mtk_nl80211_vendor_subcmds {
+ 	MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
+ 	MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL= 0xc6,
+ 	MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
++	MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8
+ };
+ 
+ enum mtk_vendor_attr_edcca_ctrl {
+@@ -48,6 +49,21 @@ static struct nla_policy edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
+ 	[MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE] = { .type = NLA_U8 },
+ };
+ 
++enum mtk_vendor_attr_3wire_ctrl {
++	MTK_VENDOR_ATTR_3WIRE_CTRL_UNSPEC,
++
++	MTK_VENDOR_ATTR_3WIRE_CTRL_MODE,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL,
++	MTK_VENDOR_ATTR_3WIRE_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL - 1
++};
++
++static struct nla_policy three_wire_ctrl_policy[NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL] = {
++	[MTK_VENDOR_ATTR_3WIRE_CTRL_MODE] = {.type = NLA_U8 },
++};
++
+ enum mtk_vendor_attr_csi_ctrl {
+ 	MTK_VENDOR_ATTR_CSI_CTRL_UNSPEC,
+ 
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 0f12feb..79e80b6 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4689,6 +4689,7 @@ struct wpa_driver_ops {
+ 	 */
+ 	 int (*hemu_ctrl)(void *priv, u8 hemu_onoff);
+ 	 int (*hemu_dump)(void *priv, u8 *hemu_onoff);
++	 int (*three_wire_ctrl)(void *priv, u8 three_wire_enable);
+ };
+ 
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index b2c3a2e..02f4b95 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12505,6 +12505,38 @@ static int nl80211_configure_edcca_threshold(void *priv,
+ 	return ret;
+ }
+ 
++static int nl80211_enable_three_wire(void *priv, const u8 three_wire_enable)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	/* Prepare nl80211 cmd */
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	if (!drv->mtk_3wire_vendor_cmd_avail) {
++		wpa_printf(MSG_INFO,
++			   "nl80211: Driver does not support setting three wire control");
++		return 0;
++	}
++
++	if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++	    nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++	    nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
++			MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL) ||
++	    !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++	    nla_put_u8(msg, MTK_VENDOR_ATTR_3WIRE_CTRL_MODE, three_wire_enable)) {
++		nlmsg_free(msg);
++		return -ENOBUFS;
++	}
++	nla_nest_end(msg, data);
++	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++	if (ret) {
++		wpa_printf(MSG_ERROR, "Failed to enable three wire. ret=%d (%s) ",
++			   ret, strerror(-ret));
++	}
++	return ret;
++}
+ 
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.name = "nl80211",
+@@ -12655,4 +12687,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ #endif /* CONFIG_TESTING_OPTIONS */
+ /* Need ifdef CONFIG_DRIVER_NL80211_MTK */
+ 	.configure_edcca_threshold = nl80211_configure_edcca_threshold,
++	.three_wire_ctrl = nl80211_enable_three_wire,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 62d9696..196d24f 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -182,6 +182,7 @@ struct wpa_driver_nl80211_data {
+ 	unsigned int brcm_do_acs:1;
+ 	unsigned int mtk_edcca_vendor_cmd_avail:1;
+ 	unsigned int mtk_hemu_vendor_cmd_avail:1;
++	unsigned int mtk_3wire_vendor_cmd_avail:1;
+ 
+ 	u64 vendor_scan_cookie;
+ 	u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index b5cd2c5..f0397f5 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1053,6 +1053,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ 				case MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL :
+ 					drv->mtk_hemu_vendor_cmd_avail = 1;
+ 					break;
++				case MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL :
++					drv->mtk_3wire_vendor_cmd_avail = 1;
++					break;
+ 				}
+ 			}
+ 
+-- 
+2.18.0
+
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/patches.inc b/recipes-connectivity/wpa-supplicant/files/patches/patches.inc
index 2ba3ff5..9a11077 100644
--- a/recipes-connectivity/wpa-supplicant/files/patches/patches.inc
+++ b/recipes-connectivity/wpa-supplicant/files/patches/patches.inc
@@ -65,6 +65,7 @@
     file://915-Support-new-hostapd-configuration-edcca_enable-and-e.patch \
     file://916-Add-hostapd-command-handler-for-SET_EDCCA-GET_EDCCA-.patch \
     file://920-Add-hostapd-HEMU-SET-GET-control.patch \
+    file://921-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch \
     file://990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch \
     file://991-fix-compile.patch \
     file://992-openssl-include-rsa.patch \
diff --git a/recipes-kernel/linux-mt76/files/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch b/recipes-kernel/linux-mt76/files/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch
index d069a4a..6036d7c 100644
--- a/recipes-kernel/linux-mt76/files/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch
+++ b/recipes-kernel/linux-mt76/files/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch
@@ -1,7 +1,7 @@
-From 2692efbe9806361dd71197bdbe3f30ccfcffdb70 Mon Sep 17 00:00:00 2001
+From 8b72691afc0ab523e98a9737e56c7aeebd830b3f Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 6 Jun 2022 19:46:26 +0800
-Subject: [PATCH 01/12] mt76: mt7915: rework testmode init registers
+Subject: [PATCH 1/8] mt76: mt7915: rework testmode init registers
 
 ---
  mt7915/mmio.c     |  2 ++
@@ -10,7 +10,7 @@
  3 files changed, 54 insertions(+), 16 deletions(-)
 
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index c2646d2..a8e3810 100644
+index c1256de..c81fa09 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -59,6 +59,7 @@ static const u32 mt7986_reg[] = {
@@ -30,10 +30,10 @@
  	[TMAC_ODTR]		= 0x0cc,
  	[TMAC_ATCR]		= 0x00c,
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 77fd448..c7c9e41 100644
+index 53061aa..1687568 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -36,6 +36,7 @@ enum reg_rev {
+@@ -30,6 +30,7 @@ enum reg_rev {
  };
  
  enum offs_rev {
@@ -41,7 +41,7 @@
  	TMAC_CDTR,
  	TMAC_ODTR,
  	TMAC_ATCR,
-@@ -185,6 +186,12 @@ enum offs_rev {
+@@ -179,6 +180,12 @@ enum offs_rev {
  #define MT_TRB_RXPSR0_RX_WTBL_PTR	GENMASK(25, 16)
  #define MT_TRB_RXPSR0_RX_RMAC_PTR	GENMASK(9, 0)
  
@@ -54,7 +54,7 @@
  /* TMAC: band 0(0x820e4000), band 1(0x820f4000) */
  #define MT_WF_TMAC_BASE(_band)		((_band) ? 0x820f4000 : 0x820e4000)
  #define MT_WF_TMAC(_band, ofs)		(MT_WF_TMAC_BASE(_band) + (ofs))
-@@ -193,6 +200,9 @@ enum offs_rev {
+@@ -187,6 +194,9 @@ enum offs_rev {
  #define MT_TMAC_TCR0_TX_BLINK		GENMASK(7, 6)
  #define MT_TMAC_TCR0_TBTT_STOP_CTRL	BIT(25)
  
@@ -64,7 +64,7 @@
  #define MT_TMAC_CDTR(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_CDTR))
   #define MT_TMAC_ODTR(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_ODTR))
  #define MT_TIMEOUT_VAL_PLCP		GENMASK(15, 0)
-@@ -464,8 +474,10 @@ enum offs_rev {
+@@ -458,8 +468,10 @@ enum offs_rev {
  #define MT_AGG_PCR0_VHT_PROT		BIT(13)
  #define MT_AGG_PCR0_PTA_WIN_DIS		BIT(15)
  
@@ -78,7 +78,7 @@
  #define MT_AGG_ACR0(_band)		MT_WF_AGG(_band, __OFFS(AGG_ACR0))
  #define MT_AGG_ACR_CFEND_RATE		GENMASK(13, 0)
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 0f5c1e5..20c593d 100644
+index efb9bb8..0186602 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -30,7 +30,7 @@ struct reg_band {
diff --git a/recipes-kernel/linux-mt76/files/patches/0002-mt76-testmode-rework-tx-antenna-setting.patch b/recipes-kernel/linux-mt76/files/patches/0002-mt76-testmode-rework-tx-antenna-setting.patch
index 5ec911f..acc323f 100644
--- a/recipes-kernel/linux-mt76/files/patches/0002-mt76-testmode-rework-tx-antenna-setting.patch
+++ b/recipes-kernel/linux-mt76/files/patches/0002-mt76-testmode-rework-tx-antenna-setting.patch
@@ -1,19 +1,19 @@
-From e9dd6f5f862331f44f81d95a786f04bbea6f08f2 Mon Sep 17 00:00:00 2001
+From 879e20ba9e16a41db88087dd73e4ebbfecb1388b Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 25 Feb 2022 09:36:01 +0800
-Subject: [PATCH 02/12] mt76: testmode: rework tx antenna setting
+Subject: [PATCH 2/8] mt76: testmode: rework tx antenna setting
 
 ---
- mt7915/mcu.c      | 7 +------
- mt7915/testmode.c | 9 +--------
- testmode.c        | 4 ++--
- 3 files changed, 4 insertions(+), 16 deletions(-)
+ mt7915/mcu.c      |  7 +------
+ mt7915/testmode.c | 13 ++++++-------
+ testmode.c        |  3 +--
+ 3 files changed, 8 insertions(+), 15 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 552352d..f513005 100644
+index 7767bfe..e3123f2 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2637,14 +2637,9 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
+@@ -2640,14 +2640,9 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
  
  #ifdef CONFIG_NL80211_TESTMODE
  	if (phy->mt76->test.tx_antenna_mask &&
@@ -30,7 +30,7 @@
  #endif
  
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 20c593d..b8c1da1 100644
+index 0186602..41b9949 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -474,11 +474,7 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
@@ -46,28 +46,39 @@
  		}
  	}
  
-@@ -729,9 +725,6 @@ mt7915_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
+@@ -720,8 +716,10 @@ mt7915_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
+ {
+ 	struct mt76_testmode_data *td = &mphy->test;
+ 	struct mt7915_phy *phy = mphy->priv;
+-	u32 changed = 0;
++	struct mt7915_dev *dev = phy->dev;
++	u32 chainmask = mphy->chainmask, changed = 0;
+ 	int i;
++	bool ext_phy = phy != &dev->phy;
+ 
+ 	BUILD_BUG_ON(NUM_TM_CHANGED >= 32);
+ 
+@@ -729,7 +727,8 @@ mt7915_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
  	    td->state == MT76_TM_STATE_OFF)
  		return 0;
  
 -	if (td->tx_antenna_mask & ~mphy->chainmask)
--		return -EINVAL;
--
++	chainmask = ext_phy ? chainmask >> dev->chainshift : chainmask;
++	if (td->tx_antenna_mask > chainmask)
+ 		return -EINVAL;
+ 
  	for (i = 0; i < ARRAY_SIZE(tm_change_map); i++) {
- 		if (tb[tm_change_map[i]])
- 			changed |= BIT(i);
 diff --git a/testmode.c b/testmode.c
-index 382b456..7cd0079 100644
+index 71fd3fb..74a46e9 100644
 --- a/testmode.c
 +++ b/testmode.c
-@@ -446,8 +446,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -443,8 +443,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_LDPC], &td->tx_rate_ldpc, 0, 1) ||
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_STBC], &td->tx_rate_stbc, 0, 1) ||
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_LTF], &td->tx_ltf, 0, 2) ||
 -	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_ANTENNA],
 -			   &td->tx_antenna_mask, 0, 0xff) ||
-+	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_ANTENNA], &td->tx_antenna_mask,
-+			   1, phy->antenna_mask) ||
++	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_ANTENNA], &td->tx_antenna_mask, 1, 0xff) ||
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_SPE_IDX], &td->tx_spe_idx, 0, 27) ||
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_DUTY_CYCLE],
  			   &td->tx_duty_cycle, 0, 99) ||
diff --git a/recipes-kernel/linux-mt76/files/patches/0003-mt76-mt7915-rework-rx-testmode-stats.patch b/recipes-kernel/linux-mt76/files/patches/0003-mt76-mt7915-rework-rx-testmode-stats.patch
index 3e00f4f..d6f694c 100644
--- a/recipes-kernel/linux-mt76/files/patches/0003-mt76-mt7915-rework-rx-testmode-stats.patch
+++ b/recipes-kernel/linux-mt76/files/patches/0003-mt76-mt7915-rework-rx-testmode-stats.patch
@@ -1,7 +1,7 @@
-From 5719f0432f1df81f1834096fb0e6a0439d01bf57 Mon Sep 17 00:00:00 2001
+From f8b12d3930f7c463bb0981904e648030461c1a82 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 3 Jan 2022 17:09:53 +0800
-Subject: [PATCH] mt76: mt7915: rework rx testmode stats
+Subject: [PATCH 3/8] mt76: mt7915: rework rx testmode stats
 
 ---
  mac80211.c        |  3 +-
@@ -15,7 +15,7 @@
  8 files changed, 109 insertions(+), 17 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index a46884d6..d74300f3 100644
+index a46884d..d74300f 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -751,7 +751,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
@@ -29,7 +29,7 @@
  		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
  			phy->test.rx_stats.fcs_error[q]++;
 diff --git a/mt76.h b/mt76.h
-index 4da77d47..94541cd7 100644
+index 4da77d4..94541cd 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -612,6 +612,8 @@ struct mt76_testmode_ops {
@@ -59,7 +59,7 @@
  };
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index f1d7c05b..e94d6706 100644
+index f1d7c05..e94d670 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1130,6 +1130,7 @@ enum {
@@ -71,7 +71,7 @@
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index cd1edf55..110e4f36 100644
+index cd1edf5..110e4f3 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -9,6 +9,7 @@
@@ -83,7 +83,7 @@
  	MCU_ATE_CLEAN_TXQUEUE = 0x1c,
  };
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 71793a83..94b24e42 100644
+index 41b9949..6c05dfa 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -133,6 +133,21 @@ mt7915_tm_clean_hwq(struct mt7915_phy *phy, u8 wcid)
@@ -184,7 +184,7 @@
  		mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
  	}
  }
-@@ -739,12 +801,8 @@ static int
+@@ -745,12 +807,8 @@ static int
  mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  {
  	struct mt7915_phy *phy = mphy->priv;
@@ -197,7 +197,7 @@
  
  	rx = nla_nest_start(msg, MT76_TM_STATS_ATTR_LAST_RX);
  	if (!rx)
-@@ -788,15 +846,7 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+@@ -794,15 +852,7 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  
  	nla_nest_end(msg, rx);
  
@@ -215,7 +215,7 @@
  
  const struct mt76_testmode_ops mt7915_testmode_ops = {
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index 5573ac30..a1c54c89 100644
+index 5573ac3..a1c54c8 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -33,6 +33,12 @@ struct mt7915_tm_clean_txq {
@@ -266,10 +266,10 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index b6ceddcb..70fe79a4 100644
+index 74a46e9..ba9ac2d 100644
 --- a/testmode.c
 +++ b/testmode.c
-@@ -556,6 +556,9 @@ mt76_testmode_dump_stats(struct mt76_phy *phy, struct sk_buff *msg)
+@@ -555,6 +555,9 @@ mt76_testmode_dump_stats(struct mt76_phy *phy, struct sk_buff *msg)
  	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_PACKETS, rx_packets,
  			      MT76_TM_STATS_ATTR_PAD) ||
  	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_FCS_ERROR, rx_fcs_error,
@@ -280,7 +280,7 @@
  		return -EMSGSIZE;
  
 diff --git a/testmode.h b/testmode.h
-index 5e2792d8..89613266 100644
+index 5e2792d..8961326 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -101,6 +101,8 @@ enum mt76_testmode_attr {
diff --git a/recipes-kernel/linux-mt76/files/patches/0005-mt76-mt7915-drop-undefined-action-frame.patch b/recipes-kernel/linux-mt76/files/patches/0004-mt76-mt7915-drop-undefined-action-frame.patch
similarity index 77%
rename from recipes-kernel/linux-mt76/files/patches/0005-mt76-mt7915-drop-undefined-action-frame.patch
rename to recipes-kernel/linux-mt76/files/patches/0004-mt76-mt7915-drop-undefined-action-frame.patch
index c6af0f3..f8627aa 100644
--- a/recipes-kernel/linux-mt76/files/patches/0005-mt76-mt7915-drop-undefined-action-frame.patch
+++ b/recipes-kernel/linux-mt76/files/patches/0004-mt76-mt7915-drop-undefined-action-frame.patch
@@ -1,17 +1,17 @@
-From d5aa55dd78e4b047bbf462a65ac47b30409ad8f0 Mon Sep 17 00:00:00 2001
+From ca98c2d93f1d1b9c4702d3199e371972c15dcbed Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 14 Apr 2022 15:18:02 +0800
-Subject: [PATCH 05/12] mt76: mt7915: drop undefined action frame
+Subject: [PATCH 4/8] mt76: mt7915: drop undefined action frame
 
 ---
  mt7915/mac.c | 6 ++++++
  1 file changed, 6 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 9092b40..6a4da8e 100644
+index 1b660c9..31d1138 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -683,6 +683,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -684,6 +684,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  			  struct mt76_tx_info *tx_info)
  {
  	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx_info->skb->data;
@@ -20,7 +20,7 @@
  	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
  	struct ieee80211_key_conf *key = info->control.hw_key;
-@@ -713,6 +715,10 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -714,6 +716,10 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size);
  	t->skb = tx_info->skb;
  
diff --git a/recipes-kernel/linux-mt76/files/patches/0008-mt76-common-RF-CR-idx-require-8-bits.patch b/recipes-kernel/linux-mt76/files/patches/0005-mt76-common-RF-CR-idx-require-8-bits.patch
similarity index 76%
rename from recipes-kernel/linux-mt76/files/patches/0008-mt76-common-RF-CR-idx-require-8-bits.patch
rename to recipes-kernel/linux-mt76/files/patches/0005-mt76-common-RF-CR-idx-require-8-bits.patch
index c5df034..5997f90 100644
--- a/recipes-kernel/linux-mt76/files/patches/0008-mt76-common-RF-CR-idx-require-8-bits.patch
+++ b/recipes-kernel/linux-mt76/files/patches/0005-mt76-common-RF-CR-idx-require-8-bits.patch
@@ -1,7 +1,7 @@
-From d41eeb3c3d0223368644b8e9f01273ba64422038 Mon Sep 17 00:00:00 2001
+From dfd7bee7503ff97ba433d40c08c1b45a1a36ddff Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Mon, 13 Jun 2022 23:10:26 +0800
-Subject: [PATCH 08/12] mt76: common: RF CR idx require 8 bits
+Subject: [PATCH 5/8] mt76: common: RF CR idx require 8 bits
 
 Change-Id: I95af9cca36052be090be776868822d0a74377c9d
 ---
@@ -9,10 +9,10 @@
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 3a88638..1b7a630 100644
+index e3123f2..9ba930a 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3444,8 +3444,8 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
+@@ -3440,8 +3440,8 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  		__le32 ofs;
  		__le32 data;
  	} __packed req = {
diff --git a/recipes-kernel/linux-mt76/files/patches/0011-mt76-testmode-use-random-payload-for-tx-packets.patch b/recipes-kernel/linux-mt76/files/patches/0006-mt76-testmode-use-random-payload-for-tx-packets.patch
similarity index 81%
rename from recipes-kernel/linux-mt76/files/patches/0011-mt76-testmode-use-random-payload-for-tx-packets.patch
rename to recipes-kernel/linux-mt76/files/patches/0006-mt76-testmode-use-random-payload-for-tx-packets.patch
index dc04e36..0c413a1 100644
--- a/recipes-kernel/linux-mt76/files/patches/0011-mt76-testmode-use-random-payload-for-tx-packets.patch
+++ b/recipes-kernel/linux-mt76/files/patches/0006-mt76-testmode-use-random-payload-for-tx-packets.patch
@@ -1,7 +1,7 @@
-From 5b712b2ec82bb9e88346b379b5c6645b1fa7d7fe Mon Sep 17 00:00:00 2001
+From d5720c59e760004712e6bcdbdf112f82521fa72b Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 6 Jul 2022 21:52:45 +0800
-Subject: [PATCH] mt76: testmode: use random payload for tx packets
+Subject: [PATCH 6/8] mt76: testmode: use random payload for tx packets
 
 Compared to fixed payload packets, random payload packets have better
 measured EVM under the same txpower. Our tests show EVM becomes at least
@@ -11,11 +11,11 @@
 Suggested-by: Jm Chen <jm.chen@mediatek.com>
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
- drivers/net/wireless/mediatek/mt76/testmode.c | 8 ++++++--
+ testmode.c | 8 ++++++--
  1 file changed, 6 insertions(+), 2 deletions(-)
 
 diff --git a/testmode.c b/testmode.c
-index 4a24f6c9..31439b39 100644
+index ba9ac2d..1d0d5d3 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -1,5 +1,7 @@
@@ -26,7 +26,7 @@
  #include "mt76.h"
  
  const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
-@@ -124,12 +126,14 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
+@@ -123,12 +125,14 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
  	if (!head)
  		return -ENOMEM;
  
@@ -42,7 +42,7 @@
  
  	info = IEEE80211_SKB_CB(head);
  	info->flags = IEEE80211_TX_CTL_INJECTED |
-@@ -157,7 +161,7 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
+@@ -154,7 +158,7 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
  			return -ENOMEM;
  		}
  
@@ -52,5 +52,5 @@
  		head->data_len += frag->len;
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/0012-mt76-mt7915-add-spatial-extension-index-support.patch b/recipes-kernel/linux-mt76/files/patches/0007-mt76-mt7915-add-spatial-extension-index-support.patch
similarity index 93%
rename from recipes-kernel/linux-mt76/files/patches/0012-mt76-mt7915-add-spatial-extension-index-support.patch
rename to recipes-kernel/linux-mt76/files/patches/0007-mt76-mt7915-add-spatial-extension-index-support.patch
index 3d0e6f2..23083b2 100644
--- a/recipes-kernel/linux-mt76/files/patches/0012-mt76-mt7915-add-spatial-extension-index-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/0007-mt76-mt7915-add-spatial-extension-index-support.patch
@@ -1,7 +1,7 @@
-From 32812cb4898d84772ec5cf7e79b8dcbd0552bd24 Mon Sep 17 00:00:00 2001
+From 66e3f9c0cefaabcb7747f9ac52a92e8912332da9 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 13 Jul 2022 10:43:16 +0800
-Subject: [PATCH] mt76: mt7915: add spatial extension index support
+Subject: [PATCH 7/8] mt76: mt7915: add spatial extension index support
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
@@ -15,7 +15,7 @@
  7 files changed, 43 insertions(+), 14 deletions(-)
 
 diff --git a/mt76_connac.h b/mt76_connac.h
-index d0336553..7b6b3aa6 100644
+index d033655..7b6b3aa 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -261,6 +261,17 @@ mt76_connac_txwi_to_txp(struct mt76_dev *dev, struct mt76_txwi_cache *t)
@@ -37,7 +37,7 @@
  void mt76_connac_power_save_sched(struct mt76_phy *phy,
  				  struct mt76_connac_pm *pm);
 diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index 18dea8e1..a9e58cfa 100644
+index 18dea8e..a9e58cf 100644
 --- a/mt76_connac_mac.c
 +++ b/mt76_connac_mac.c
 @@ -417,9 +417,6 @@ mt76_connac2_mac_write_txwi_80211(struct mt76_dev *dev, __le32 *txwi,
@@ -66,7 +66,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_connac2_mac_write_txwi);
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index e94d6706..17e5213c 100644
+index e94d670..17e5213 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -572,7 +572,7 @@ struct sta_rec_ra_fixed {
@@ -79,7 +79,7 @@
  	u8 is_5g;
  	u8 mmps_mode;
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 36faefb3..1ba164a4 100644
+index 36faefb..1ba164a 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -957,9 +957,6 @@ mt7915_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
@@ -93,7 +93,7 @@
  
  	phy->mt76->antenna_mask = tx_ant;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 9ba930a2..5fc7a242 100644
+index 9ba930a..5fc7a24 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -1306,6 +1306,9 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
@@ -145,7 +145,7 @@
  	    dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
  		req.switch_reason = CH_SWITCH_NORMAL;
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 110e4f36..ed949802 100644
+index 110e4f3..ed94980 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -395,6 +395,7 @@ enum {
@@ -157,7 +157,7 @@
  
  #define RATE_CFG_MCS			GENMASK(3, 0)
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 123ceaf9..b2eee3f2 100644
+index 6c05dfa..35345d3 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -473,8 +473,6 @@ mt7915_tm_update_channel(struct mt7915_phy *phy)
diff --git a/recipes-kernel/linux-mt76/files/patches/0013-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch b/recipes-kernel/linux-mt76/files/patches/0008-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch
similarity index 74%
rename from recipes-kernel/linux-mt76/files/patches/0013-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch
rename to recipes-kernel/linux-mt76/files/patches/0008-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch
index 5703de3..35595d0 100644
--- a/recipes-kernel/linux-mt76/files/patches/0013-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch
+++ b/recipes-kernel/linux-mt76/files/patches/0008-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch
@@ -1,7 +1,7 @@
-From 0fb081d0cbaeaf0c2ff537d44680818185942590 Mon Sep 17 00:00:00 2001
+From ebe0cc8b9878e72143f0e24fea00ba2b474cdd6b Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 26 Jul 2022 16:04:53 +0800
-Subject: [PATCH] mt76: mt7915: set the first antenna to detect radar for
+Subject: [PATCH 8/8] mt76: mt7915: set the first antenna to detect radar for
  MT7915
 
 The default value of listening antenna set by FW might be different in
@@ -10,15 +10,15 @@
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
- drivers/net/wireless/mediatek/mt76/mt7915/mac.c   | 15 +++++++++++++++
- .../net/wireless/mediatek/mt76/mt7915/mt7915.h    |  1 +
+ mt7915/mac.c    | 15 +++++++++++++++
+ mt7915/mt7915.h |  1 +
  2 files changed, 16 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 1f8e1230..a31ac2df 100644
+index 31d1138..a1d5c15 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -2149,6 +2149,13 @@ static int mt7915_dfs_start_rdd(struct mt7915_dev *dev, int chain)
+@@ -1817,6 +1817,13 @@ static int mt7915_dfs_start_rdd(struct mt7915_dev *dev, int chain)
  	if (err < 0)
  		return err;
  
@@ -32,7 +32,7 @@
  	return mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_DET_MODE, chain,
  				       MT_RX_SEL0, 1);
  }
-@@ -2269,6 +2276,14 @@ stop:
+@@ -1937,6 +1944,14 @@ stop:
  	if (err < 0)
  		return err;
  
@@ -48,10 +48,10 @@
  	phy->mt76->dfs_state = MT_DFS_STATE_DISABLED;
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 22399cc7..2eaada50 100644
+index 54ef2a1..836a7f1 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -468,6 +468,7 @@ enum mt7915_rdd_cmd {
+@@ -359,6 +359,7 @@ enum mt7915_rdd_cmd {
  	RDD_DET_MODE,
  	RDD_RADAR_EMULATE,
  	RDD_START_TXQ = 20,
@@ -60,5 +60,5 @@
  	RDD_CAC_END,
  	RDD_NORMAL_START,
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch b/recipes-kernel/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
index 7f9e16e..990fbfb 100644
--- a/recipes-kernel/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
@@ -1,28 +1,28 @@
-From c81efc602c7c074f20f3a463b851f85eb30082e2 Mon Sep 17 00:00:00 2001
+From 6e089768a68a8cc86526d61d34730043fee724af Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 22 Jun 2022 10:39:47 +0800
-Subject: [PATCH 1001/1008] mt76: mt7915: add mtk internal debug tools for mt76
+Subject: [PATCH 1001/1009] mt76: mt7915: add mtk internal debug tools for mt76
 
 ---
- .../wireless/mediatek/mt76/mt76_connac_mcu.h  |    6 +
- .../wireless/mediatek/mt76/mt7915/Makefile    |    2 +-
- .../wireless/mediatek/mt76/mt7915/debugfs.c   |   73 +-
- .../net/wireless/mediatek/mt76/mt7915/mac.c   |   14 +
- .../net/wireless/mediatek/mt76/mt7915/main.c  |    4 +
- .../net/wireless/mediatek/mt76/mt7915/mcu.c   |   44 +
- .../net/wireless/mediatek/mt76/mt7915/mcu.h   |    4 +
- .../wireless/mediatek/mt76/mt7915/mt7915.h    |   43 +
- .../mediatek/mt76/mt7915/mt7915_debug.h       | 1350 ++++++++
- .../mediatek/mt76/mt7915/mtk_debugfs.c        | 2923 +++++++++++++++++
- .../wireless/mediatek/mt76/mt7915/mtk_mcu.c   |   51 +
- .../net/wireless/mediatek/mt76/tools/fwlog.c  |   44 +-
+ mt76_connac_mcu.h     |    6 +
+ mt7915/Makefile       |    2 +-
+ mt7915/debugfs.c      |   73 +-
+ mt7915/mac.c          |   14 +
+ mt7915/main.c         |    4 +
+ mt7915/mcu.c          |   44 +
+ mt7915/mcu.h          |    4 +
+ mt7915/mt7915.h       |   43 +
+ mt7915/mt7915_debug.h | 1350 +++++++++++++++++++
+ mt7915/mtk_debugfs.c  | 2923 +++++++++++++++++++++++++++++++++++++++++
+ mt7915/mtk_mcu.c      |   51 +
+ tools/fwlog.c         |   44 +-
  12 files changed, 4545 insertions(+), 13 deletions(-)
- create mode 100644 drivers/net/wireless/mediatek/mt76/mt7915/mt7915_debug.h
- create mode 100644 drivers/net/wireless/mediatek/mt76/mt7915/mtk_debugfs.c
- create mode 100644 drivers/net/wireless/mediatek/mt76/mt7915/mtk_mcu.c
+ create mode 100644 mt7915/mt7915_debug.h
+ create mode 100644 mt7915/mtk_debugfs.c
+ create mode 100644 mt7915/mtk_mcu.c
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 17e5213c..c7aeae57 100644
+index 17e5213..c7aeae5 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1119,6 +1119,12 @@ enum {
@@ -39,7 +39,7 @@
  	MCU_EXT_CMD_CAL_CACHE = 0x67,
  	MCU_EXT_CMD_SET_RADAR_TH = 0x7c,
 diff --git a/mt7915/Makefile b/mt7915/Makefile
-index b794ceb7..a3474e2f 100644
+index b794ceb..a3474e2 100644
 --- a/mt7915/Makefile
 +++ b/mt7915/Makefile
 @@ -3,7 +3,7 @@
@@ -53,7 +53,7 @@
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 \ No newline at end of file
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 9f21d978..0cfb6068 100644
+index 9f21d97..0cfb606 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -8,6 +8,9 @@
@@ -197,7 +197,7 @@
  
  	if (dev->relay_fwlog)
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 13648927..a50c555d 100644
+index a1d5c15..6b0a527 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -239,6 +239,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -236,7 +236,7 @@
  }
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 080e935c..b63d5e14 100644
+index 1ba164a..14ba84f 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -62,7 +62,11 @@ static int mt7915_start(struct ieee80211_hw *hw)
@@ -252,7 +252,7 @@
  		goto out;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 03a3c252..0003bbb6 100644
+index 5fc7a24..b080340 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -195,6 +195,11 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -267,7 +267,7 @@
  	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
  }
  
-@@ -3183,6 +3188,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+@@ -3176,6 +3181,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
  		.sku_enable = enable,
  	};
  
@@ -276,7 +276,7 @@
  	return mt76_mcu_send_msg(&dev->mt76,
  				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
  				 sizeof(req), true);
-@@ -3458,6 +3465,43 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3451,6 +3458,43 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -321,7 +321,7 @@
  {
  	struct {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index ed949802..bfb822fa 100644
+index ed94980..bfb822f 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -259,6 +259,10 @@ enum {
@@ -336,7 +336,7 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index db63012e..82781879 100644
+index 836a7f1..60d489d 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -9,6 +9,7 @@
@@ -377,7 +377,7 @@
  };
  
  enum {
-@@ -593,4 +617,23 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -594,4 +618,23 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			    struct ieee80211_sta *sta, struct dentry *dir);
  #endif
  
@@ -403,7 +403,7 @@
  #endif
 diff --git a/mt7915/mt7915_debug.h b/mt7915/mt7915_debug.h
 new file mode 100644
-index 00000000..58ba2cdf
+index 0000000..58ba2cd
 --- /dev/null
 +++ b/mt7915/mt7915_debug.h
 @@ -0,0 +1,1350 @@
@@ -1759,7 +1759,7 @@
 +#endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
 new file mode 100644
-index 00000000..f18c8b6c
+index 0000000..f18c8b6
 --- /dev/null
 +++ b/mt7915/mtk_debugfs.c
 @@ -0,0 +1,2923 @@
@@ -4688,7 +4688,7 @@
 +#endif
 diff --git a/mt7915/mtk_mcu.c b/mt7915/mtk_mcu.c
 new file mode 100644
-index 00000000..145fe785
+index 0000000..145fe78
 --- /dev/null
 +++ b/mt7915/mtk_mcu.c
 @@ -0,0 +1,51 @@
@@ -4744,7 +4744,7 @@
 +				 sizeof(req), true);
 +}
 diff --git a/tools/fwlog.c b/tools/fwlog.c
-index e5d4a105..3d51d9ec 100644
+index e5d4a10..3d51d9e 100644
 --- a/tools/fwlog.c
 +++ b/tools/fwlog.c
 @@ -26,7 +26,7 @@ static const char *debugfs_path(const char *phyname, const char *file)
@@ -4858,5 +4858,5 @@
  	return ret;
  }
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch b/recipes-kernel/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
index 82908c6..2e3abe4 100644
--- a/recipes-kernel/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
@@ -1,23 +1,23 @@
-From b4f1309073f6578374e30f4578a8c7e982e45e19 Mon Sep 17 00:00:00 2001
+From 254614674ffe5c96ae73e0079b8dbb3105b115fb Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Jun 2022 20:13:02 +0800
-Subject: [PATCH 1002/1008] mt76: mt7915: csi: implement csi support
+Subject: [PATCH 1002/1009] mt76: mt7915: csi: implement csi support
 
 ---
- .../wireless/mediatek/mt76/mt76_connac_mcu.h  |   2 +
- .../wireless/mediatek/mt76/mt7915/Makefile    |   4 +-
- .../net/wireless/mediatek/mt76/mt7915/init.c  |  39 ++
- .../net/wireless/mediatek/mt76/mt7915/mcu.c   | 111 +++++
- .../net/wireless/mediatek/mt76/mt7915/mcu.h   |  76 +++
- .../wireless/mediatek/mt76/mt7915/mt7915.h    |  20 +
- .../wireless/mediatek/mt76/mt7915/vendor.c    | 452 ++++++++++++++++++
- .../wireless/mediatek/mt76/mt7915/vendor.h    |  60 +++
+ mt76_connac_mcu.h |   2 +
+ mt7915/Makefile   |   4 +-
+ mt7915/init.c     |  39 ++++
+ mt7915/mcu.c      | 111 ++++++++++++
+ mt7915/mcu.h      |  76 ++++++++
+ mt7915/mt7915.h   |  20 ++
+ mt7915/vendor.c   | 452 ++++++++++++++++++++++++++++++++++++++++++++++
+ mt7915/vendor.h   |  60 ++++++
  8 files changed, 762 insertions(+), 2 deletions(-)
- create mode 100644 drivers/net/wireless/mediatek/mt76/mt7915/vendor.c
- create mode 100644 drivers/net/wireless/mediatek/mt76/mt7915/vendor.h
+ create mode 100644 mt7915/vendor.c
+ create mode 100644 mt7915/vendor.h
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index c7aeae57..ede59231 100644
+index c7aeae5..ede5923 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -971,6 +971,7 @@ enum {
@@ -37,7 +37,7 @@
  
  enum {
 diff --git a/mt7915/Makefile b/mt7915/Makefile
-index a3474e2f..e272c826 100644
+index a3474e2..e272c82 100644
 --- a/mt7915/Makefile
 +++ b/mt7915/Makefile
 @@ -1,9 +1,9 @@
@@ -54,10 +54,10 @@
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 \ No newline at end of file
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 8554c9dc..fa9568ca 100644
+index 489f6e7..6efa28f 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -542,6 +542,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
+@@ -547,6 +547,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
  	/* init wiphy according to mphy and phy */
  	mt7915_init_wiphy(mphy->hw);
  
@@ -70,7 +70,7 @@
  	ret = mt76_register_phy(mphy, true, mt76_rates,
  				ARRAY_SIZE(mt76_rates));
  	if (ret)
-@@ -1032,6 +1038,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
+@@ -1037,6 +1043,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
  	}
  }
  
@@ -96,7 +96,7 @@
  static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  {
  	struct mt7915_phy *phy = mt7915_ext_phy(dev);
-@@ -1040,6 +1065,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
+@@ -1045,6 +1070,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  	if (!phy)
  		return;
  
@@ -107,7 +107,7 @@
  	mt7915_unregister_thermal(phy);
  	mt76_unregister_phy(mphy);
  	ieee80211_free_hw(mphy->hw);
-@@ -1052,6 +1081,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
+@@ -1057,6 +1086,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
  	mt7915_dma_cleanup(dev);
  	tasklet_disable(&dev->irq_tasklet);
  
@@ -118,7 +118,7 @@
  	if (is_mt7986(&dev->mt76))
  		mt7986_wmac_disable(dev);
  }
-@@ -1092,6 +1125,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
+@@ -1097,6 +1130,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
  	dev->mt76.test_ops = &mt7915_testmode_ops;
  #endif
  
@@ -132,7 +132,7 @@
  	if (IS_ENABLED(CONFIG_MT76_LEDS)) {
  		dev->mt76.led_cdev.brightness_set = mt7915_led_set_brightness;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 0003bbb6..be1dd6b9 100644
+index b080340..9d2c813 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -32,6 +32,10 @@
@@ -158,7 +158,7 @@
  	case MCU_EXT_EVENT_BCC_NOTIFY:
  		mt7915_mcu_rx_bcc_notify(dev, skb);
  		break;
-@@ -3465,6 +3474,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3458,6 +3467,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -268,7 +268,7 @@
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index bfb822fa..a27129c2 100644
+index bfb822f..a27129c 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -480,4 +480,80 @@ enum {
@@ -353,7 +353,7 @@
 +
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 82781879..33d14d6d 100644
+index 60d489d..fda264f 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -276,6 +276,20 @@ struct mt7915_phy {
@@ -377,7 +377,7 @@
  };
  
  struct mt7915_dev {
-@@ -617,6 +631,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -618,6 +632,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			    struct ieee80211_sta *sta, struct dentry *dir);
  #endif
  
@@ -392,7 +392,7 @@
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
 new file mode 100644
-index 00000000..98fd9c2d
+index 0000000..98fd9c2
 --- /dev/null
 +++ b/mt7915/vendor.c
 @@ -0,0 +1,452 @@
@@ -850,7 +850,7 @@
 +}
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
 new file mode 100644
-index 00000000..9d3db2a7
+index 0000000..9d3db2a
 --- /dev/null
 +++ b/mt7915/vendor.h
 @@ -0,0 +1,60 @@
@@ -915,5 +915,5 @@
 +
 +#endif
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch b/recipes-kernel/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
index 86cea4b..160bb81 100644
--- a/recipes-kernel/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
@@ -1,19 +1,19 @@
-From 4c0c9fa9de451d898a5118009065d3c4ff38eba5 Mon Sep 17 00:00:00 2001
+From 3199502dabfb1a31cc6741668ce6219fa8d1f1e9 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Tue, 11 Jan 2022 12:03:23 +0800
-Subject: [PATCH 1003/1008] mt76: mt7915: air monitor support
+Subject: [PATCH 1003/1009] mt76: mt7915: air monitor support
 
 ---
- .../wireless/mediatek/mt76/mt76_connac_mcu.h  |   2 +
- .../net/wireless/mediatek/mt76/mt7915/mac.c   |   4 +
- .../net/wireless/mediatek/mt76/mt7915/main.c  |   3 +
- .../wireless/mediatek/mt76/mt7915/mt7915.h    |  34 ++
- .../wireless/mediatek/mt76/mt7915/vendor.c    | 359 ++++++++++++++++++
- .../wireless/mediatek/mt76/mt7915/vendor.h    |  38 ++
+ mt76_connac_mcu.h |   2 +
+ mt7915/mac.c      |   4 +
+ mt7915/main.c     |   3 +
+ mt7915/mt7915.h   |  34 +++++
+ mt7915/vendor.c   | 359 ++++++++++++++++++++++++++++++++++++++++++++++
+ mt7915/vendor.h   |  38 +++++
  6 files changed, 440 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index ede59231..865bbf3d 100644
+index ede5923..865bbf3 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1142,6 +1142,8 @@ enum {
@@ -26,7 +26,7 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index a50c555d..8aa5350a 100644
+index 6b0a527..75e2036 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -486,6 +486,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -41,7 +41,7 @@
  		status->flag |= RX_FLAG_8023;
  	}
 diff --git a/mt7915/main.c b/mt7915/main.c
-index b63d5e14..cd7314c9 100644
+index 14ba84f..43daa17 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -675,6 +675,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -55,7 +55,7 @@
  }
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 33d14d6d..2af06d35 100644
+index fda264f..5551d77 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -231,6 +231,35 @@ struct mt7915_hif {
@@ -103,7 +103,7 @@
  #endif
  };
  
-@@ -635,6 +666,9 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -636,6 +667,9 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
@@ -114,7 +114,7 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 98fd9c2d..b94d787e 100644
+index 98fd9c2..b94d787 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -430,6 +430,353 @@ out:
@@ -491,7 +491,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 9d3db2a7..976817f3 100644
+index 9d3db2a..976817f 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -4,6 +4,7 @@
@@ -545,5 +545,5 @@
 +
  #endif
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch b/recipes-kernel/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
index 6143c06..286ae5d 100644
--- a/recipes-kernel/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
@@ -1,21 +1,21 @@
-From b57983fb1ed631af2b6230aaf010826cd05c9ddf Mon Sep 17 00:00:00 2001
+From cb7c232f28e31db392ffec836c4af9160e13dca1 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:45:53 +0800
-Subject: [PATCH 1004/1008] mt76: mt7915: add support for muru_onoff via
+Subject: [PATCH 1004/1009] mt76: mt7915: add support for muru_onoff via
  debugfs
 
 ---
- .../net/wireless/mediatek/mt76/mt7915/init.c  |  1 +
- .../net/wireless/mediatek/mt76/mt7915/mcu.c   |  9 +++--
- .../net/wireless/mediatek/mt76/mt7915/mcu.h   |  6 ++++
- .../mediatek/mt76/mt7915/mtk_debugfs.c        | 33 +++++++++++++++++++
+ mt7915/init.c        |  1 +
+ mt7915/mcu.c         |  9 +++++++--
+ mt7915/mcu.h         |  6 ++++++
+ mt7915/mtk_debugfs.c | 33 +++++++++++++++++++++++++++++++++
  4 files changed, 47 insertions(+), 2 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index fa9568ca..6e2a1c13 100644
+index 6efa28f..37b7b54 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -577,6 +577,7 @@ static void mt7915_init_work(struct work_struct *work)
+@@ -582,6 +582,7 @@ static void mt7915_init_work(struct work_struct *work)
  	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
  	mt7915_init_txpower(dev, &dev->mphy.sband_6g.sband);
  	mt7915_txbf_init(dev);
@@ -24,7 +24,7 @@
  
  void mt7915_wfsys_reset(struct mt7915_dev *dev)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index be1dd6b9..a6b5d213 100644
+index 9d2c813..f7a3eb1 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -856,13 +856,18 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
@@ -49,7 +49,7 @@
  		muru->mimo_dl.vht_mu_bfee =
  			!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index a27129c2..d3cc8283 100644
+index a27129c..d3cc828 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -556,4 +556,10 @@ struct csi_data {
@@ -64,7 +64,7 @@
 +
  #endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index f18c8b6c..e239df95 100644
+index f18c8b6..e239df9 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2480,6 +2480,38 @@ static int mt7915_token_txd_read(struct seq_file *s, void *data)
@@ -115,5 +115,5 @@
  			    &fops_fw_debug_module);
  	debugfs_create_file("fw_debug_level", 0600, dir, dev,
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1005-mt76-certification-patches.patch b/recipes-kernel/linux-mt76/files/patches/1005-mt76-certification-patches.patch
index 05ed88d..2a22b2a 100644
--- a/recipes-kernel/linux-mt76/files/patches/1005-mt76-certification-patches.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1005-mt76-certification-patches.patch
@@ -1,7 +1,7 @@
-From e69061ef6ea44ada9215dbfb444eb90795b4e20c Mon Sep 17 00:00:00 2001
+From 076da9e2a0dd1bce87dac8a88cd26cbb77046076 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 6 Jun 2022 20:15:51 +0800
-Subject: [PATCH 1005/1006] mt76: certification patches
+Subject: [PATCH 1005/1009] mt76: certification patches
 
 ---
  mt76_connac_mcu.h    |   1 +
@@ -16,7 +16,7 @@
  9 files changed, 956 insertions(+), 5 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 865bbf3d..25aeedc2 100644
+index 865bbf3..25aeedc 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1144,6 +1144,7 @@ enum {
@@ -28,7 +28,7 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 75e2036b..6b3fa4ce 100644
+index 75e2036..6b3fa4c 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -7,6 +7,7 @@
@@ -76,7 +76,7 @@
  			       IEEE80211_RC_NSS_CHANGED |
  			       IEEE80211_RC_BW_CHANGED))
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 43daa17c..4e82904f 100644
+index 43daa17..4e82904 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -653,6 +653,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -109,7 +109,7 @@
  
  void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index f7a3eb19..f692e520 100644
+index f7a3eb1..f692e52 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -3572,6 +3572,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -586,7 +586,7 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index d3cc8283..aab1a6a3 100644
+index d3cc828..aab1a6a 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -396,10 +396,14 @@ enum {
@@ -820,7 +820,7 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 5551d77a..267fa7eb 100644
+index 5551d77..267fa7e 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -664,6 +664,19 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -844,7 +844,7 @@
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index e239df95..222268fc 100644
+index e239df9..222268f 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2486,7 +2486,8 @@ static int mt7915_muru_onoff_get(void *data, u64 *val)
@@ -869,7 +869,7 @@
         }
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index b94d787e..7456c577 100644
+index b94d787..7456c57 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -22,6 +22,29 @@ csi_ctrl_policy[NUM_MTK_VENDOR_ATTRS_CSI_CTRL] = {
@@ -1081,7 +1081,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 976817f3..1b08321c 100644
+index 976817f..1b08321 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -6,6 +6,48 @@
diff --git a/recipes-kernel/linux-mt76/files/patches/1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch b/recipes-kernel/linux-mt76/files/patches/1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch
index 777dfbe..652c4e4 100644
--- a/recipes-kernel/linux-mt76/files/patches/1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch
@@ -1,7 +1,8 @@
-From a9856ee394084946e0fb59c6b56dfd66108761ba Mon Sep 17 00:00:00 2001
+From c98da6a8443de7aeb6104de3ddc200253f0ee116 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Wed, 22 Jun 2022 10:51:59 +0800
-Subject: [PATCH] mt76: mt7915: add L0.5 system error recovery support
+Subject: [PATCH 1006/1009] mt76: mt7915: add L0.5 system error recovery
+ support
 
 ---
  mt7915/debugfs.c |  88 ++++++++++++---
@@ -17,7 +18,7 @@
  10 files changed, 492 insertions(+), 99 deletions(-)
 
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 0cfb6068..07de2eef 100644
+index 0cfb606..07de2ee 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -52,12 +52,17 @@ static ssize_t
@@ -141,7 +142,7 @@
  	kfree(buff);
  	return ret;
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index f7e6bb10..4b594a53 100644
+index f7e6bb1..4b594a5 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -479,6 +479,54 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -200,7 +201,7 @@
  {
  	mt7915_dma_disable(dev, true);
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 37b7b54a..141c5ad8 100644
+index 37b7b54..141c5ad 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -262,7 +262,7 @@ static void mt7915_led_set_brightness(struct led_classdev *led_cdev,
@@ -240,7 +241,7 @@
  
  unreg_thermal:
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 6b3fa4ce..e5409413 100644
+index 6b3fa4c..e540941 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -3,6 +3,7 @@
@@ -581,7 +582,7 @@
  {
  	struct mt7915_dev *dev = phy->dev;
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 4e82904f..7a7ff86a 100644
+index 4e82904..7a7ff86 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -20,17 +20,13 @@ static bool mt7915_dev_running(struct mt7915_dev *dev)
@@ -631,7 +632,7 @@
  	mutex_lock(&dev->mt76.mutex);
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index f692e520..5eac6ed6 100644
+index f692e52..5eac6ed 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -150,19 +150,90 @@ mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
@@ -767,7 +768,7 @@
  {
  	__mt76_mcu_restart(&dev->mt76);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index aab1a6a3..c4850644 100644
+index aab1a6a..c485064 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -453,8 +453,9 @@ enum {
@@ -782,7 +783,7 @@
  	SER_SET_RECOVER_L3_RX_ABORT,
  	SER_SET_RECOVER_L3_TX_ABORT,
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index c81fa091..8469d8fb 100644
+index c81fa09..8469d8f 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -24,6 +24,7 @@ static const u32 mt7915_reg[] = {
@@ -823,7 +824,7 @@
  	}
  }
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 267fa7eb..d214b181 100644
+index 267fa7e..d214b18 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -352,6 +352,15 @@ struct mt7915_dev {
@@ -871,7 +872,7 @@
  int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  			       struct mt7915_vif *mvif,
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 16875680..3d2c15be 100644
+index 1687568..3d2c15b 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -26,6 +26,7 @@ enum reg_rev {
diff --git a/recipes-kernel/linux-mt76/files/patches/1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch b/recipes-kernel/linux-mt76/files/patches/1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
index 169778d..04f104d 100644
--- a/recipes-kernel/linux-mt76/files/patches/1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
@@ -1,19 +1,19 @@
-From ffcd515b57f44839fc0988a6726c58e0d4e378c9 Mon Sep 17 00:00:00 2001
+From 55e3010fdad6c8ad6e24d6502874e6a54bc3e084 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Fri, 27 May 2022 15:51:48 +0800
-Subject: [PATCH 1007/1008] mt76: mt7915:add support for runtime set in-band
+Subject: [PATCH 1007/1009] mt76: mt7915:add support for runtime set in-band
  discovery
 
 Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
 ---
- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 5 ++---
+ mt7915/mcu.c | 5 ++---
  1 file changed, 2 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 62412c23..224f3ab2 100644
+index 5eac6ed..09a130d 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2024,8 +2024,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+@@ -2020,8 +2020,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
  	u8 *buf, interval;
  	int len;
  
@@ -23,7 +23,7 @@
  		interval = vif->bss_conf.fils_discovery.max_interval;
  		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
  	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
-@@ -2061,7 +2060,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+@@ -2056,7 +2055,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
  	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
  	discov->tx_interval = interval;
  	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
@@ -33,5 +33,5 @@
  	buf = (u8 *)tlv + sizeof(*discov);
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch b/recipes-kernel/linux-mt76/files/patches/1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
index e1b7cdb..bdcb876 100644
--- a/recipes-kernel/linux-mt76/files/patches/1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
@@ -1,20 +1,20 @@
-From 771112746f82ed8fc6f1ad6078c615f62da5745c Mon Sep 17 00:00:00 2001
+From 96aa5b1fd4b17bc3aadeff2d04fb9818aa549639 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:53:43 +0800
-Subject: [PATCH 1008/1008] mt76: mt7915: add mt76 vendor muru onoff command
+Subject: [PATCH 1008/1009] mt76: mt7915: add mt76 vendor muru onoff command
 
 ---
- .../net/wireless/mediatek/mt76/mt7915/mcu.c   |  7 +++
- .../net/wireless/mediatek/mt76/mt7915/mcu.h   |  1 +
- .../wireless/mediatek/mt76/mt7915/vendor.c    | 43 +++++++++++++++++++
- .../wireless/mediatek/mt76/mt7915/vendor.h    | 12 ++++++
+ mt7915/mcu.c    |  7 +++++++
+ mt7915/mcu.h    |  1 +
+ mt7915/vendor.c | 43 +++++++++++++++++++++++++++++++++++++++++++
+ mt7915/vendor.h | 12 ++++++++++++
  4 files changed, 63 insertions(+)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 224f3ab2..0f71356b 100644
+index 09a130d..9a7c9d3 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3675,6 +3675,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -3668,6 +3668,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  		if (val == 0)
  			dev->dbg.muru_onoff = MUMIMO_DL_CERT | MUMIMO_DL;
  		break;
@@ -29,7 +29,7 @@
  }
  
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index c4850644..0a77ad0d 100644
+index c485064..0a77ad0 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -403,6 +403,7 @@ enum {
@@ -41,7 +41,7 @@
  };
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 7456c577..c7551848 100644
+index 7456c57..c755184 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -34,6 +34,11 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -109,7 +109,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 1b08321c..a8e4ebf9 100644
+index 1b08321..a8e4ebf 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -8,6 +8,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -139,5 +139,5 @@
  	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1009-mt76-mt7915-add-fw_version-dump.patch b/recipes-kernel/linux-mt76/files/patches/1009-mt76-mt7915-add-fw_version-dump.patch
index af4f56d..17a7013 100644
--- a/recipes-kernel/linux-mt76/files/patches/1009-mt76-mt7915-add-fw_version-dump.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1009-mt76-mt7915-add-fw_version-dump.patch
@@ -1,7 +1,7 @@
-From 611d781ff9e39b474e71a59ec0ea7761a4274456 Mon Sep 17 00:00:00 2001
+From 958bb5b8c333641344dd61cd84ee5402c4d11b32 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 17 Aug 2022 13:40:24 +0800
-Subject: [PATCH] mt76: mt7915: add fw_version dump
+Subject: [PATCH 1009/1009] mt76: mt7915: add fw_version dump
 
 ---
  mt76.h               |  4 ++++
@@ -10,10 +10,10 @@
  3 files changed, 32 insertions(+)
 
 diff --git a/mt76.h b/mt76.h
-index 8325409a..9a0f0708 100644
+index 94541cd..8e81f40 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -803,6 +803,10 @@ struct mt76_dev {
+@@ -811,6 +811,10 @@ struct mt76_dev {
  		struct mt76_usb usb;
  		struct mt76_sdio sdio;
  	};
@@ -25,7 +25,7 @@
  
  struct mt76_power_limits {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 261181dc..47b2bce6 100644
+index 261181d..47b2bce 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -2883,6 +2883,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
@@ -59,7 +59,7 @@
  		struct mt76_connac2_patch_sec *sec;
  		u32 len, addr, mode;
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 222268fc..cfd0b303 100644
+index 222268f..cfd0b30 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2721,6 +2721,22 @@ static int mt7915_agginfo_read_band1(struct seq_file *s, void *data)
@@ -96,5 +96,5 @@
  }
  #endif
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1111-mt76-testmode-additional-supports.patch b/recipes-kernel/linux-mt76/files/patches/1111-mt76-testmode-additional-supports.patch
index 3972345..23b457c 100644
--- a/recipes-kernel/linux-mt76/files/patches/1111-mt76-testmode-additional-supports.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1111-mt76-testmode-additional-supports.patch
@@ -1,7 +1,7 @@
-From da1c7ada0eb6dbe66297ab71acd31395afd3bf30 Mon Sep 17 00:00:00 2001
+From b3560ff20a0c83b70bf4e60cf98747fb5115cbe3 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Apr 2022 15:43:19 +0800
-Subject: [PATCH] mt76: testmode: additional supports
+Subject: [PATCH 1111/1121] mt76: testmode: additional supports
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
@@ -27,7 +27,7 @@
  19 files changed, 1961 insertions(+), 146 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 40cb9109..8ea09e6e 100644
+index 40cb910..8ea09e6 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -426,8 +426,7 @@ free:
@@ -41,7 +41,7 @@
  #endif
  
 diff --git a/mac80211.c b/mac80211.c
-index d74300f3..e1c33324 100644
+index d74300f..e1c3332 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -55,6 +55,13 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
@@ -71,7 +71,7 @@
  
  static const struct ieee80211_channel mt76_channels_6ghz[] = {
 diff --git a/mt76.h b/mt76.h
-index 8e81f406..d03f312e 100644
+index 8e81f40..d03f312 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -610,6 +610,21 @@ struct mt76_testmode_ops {
@@ -233,7 +233,7 @@
  static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
  {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 47b2bce6..e701db8a 100644
+index 47b2bce..e701db8 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -391,6 +391,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
@@ -255,7 +255,7 @@
  		return;
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 25aeedc2..cb1e94a3 100644
+index 25aeedc..cb1e94a 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -967,6 +967,7 @@ enum {
@@ -275,7 +275,7 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  };
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 141c5ad8..538ff5c3 100644
+index 141c5ad..538ff5c 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -576,7 +576,7 @@ static void mt7915_init_work(struct work_struct *work)
@@ -288,7 +288,7 @@
  	mt7915_init_txpower(dev, &dev->mphy.sband_2g.sband);
  	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index e5409413..f0eefc6d 100644
+index e540941..f0eefc6 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -565,16 +565,38 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
@@ -352,7 +352,7 @@
  }
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 7a7ff86a..b5c3c14e 100644
+index 7a7ff86..b5c3c14 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -224,7 +224,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
@@ -365,7 +365,7 @@
  		mvif->mt76.wmm_idx += 2;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 9a7c9d3d..ecdc4fb3 100644
+index 9a7c9d3..ecdc4fb 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -434,6 +434,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -406,7 +406,7 @@
  
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 0a77ad0d..ad85e56c 100644
+index 0a77ad0..ad85e56 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -8,10 +8,15 @@
@@ -463,7 +463,7 @@
  
  enum {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 8469d8fb..8d966eff 100644
+index 8469d8f..8d966ef 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -76,6 +76,7 @@ static const u32 mt7915_offs[] = {
@@ -483,7 +483,7 @@
  	[AGG_PCR0]		= 0x040,
  	[AGG_ACR0]		= 0x054,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index d214b181..99f364c0 100644
+index d214b18..99f364c 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -303,6 +303,9 @@ struct mt7915_phy {
@@ -529,7 +529,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 3d2c15be..05ab6d9b 100644
+index 3d2c15b..05ab6d9 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -45,6 +45,7 @@ enum offs_rev {
@@ -550,7 +550,7 @@
  							  (_n) * 4))
  #define MT_AGG_PCR0(_band, _n)		MT_WF_AGG(_band, (__OFFS(AGG_PCR0) +	\
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 331d8b9d..de6e63e1 100644
+index 35345d3..bc4cd80 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -9,6 +9,9 @@
@@ -1803,7 +1803,7 @@
  }
  
  static int
-@@ -798,6 +1761,7 @@ static int
+@@ -804,6 +1767,7 @@ static int
  mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  {
  	struct mt7915_phy *phy = mphy->priv;
@@ -1811,7 +1811,7 @@
  	void *rx, *rssi;
  	int i;
  
-@@ -843,11 +1807,68 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+@@ -849,11 +1813,68 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  
  	nla_nest_end(msg, rx);
  
@@ -1881,7 +1881,7 @@
 +	.set_eeprom = mt7915_tm_set_eeprom,
  };
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index a1c54c89..01b08e9e 100644
+index a1c54c8..01b08e9 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -4,6 +4,8 @@
@@ -2196,7 +2196,7 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index d7eb1f03..2653182a 100644
+index 1d0d5d3..7a9ed54 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -27,28 +27,16 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
@@ -2536,7 +2536,7 @@
  	if (tb[MT76_TM_ATTR_RESET]) {
  		mt76_testmode_set_state(phy, MT76_TM_STATE_OFF);
  		memset(td, 0, sizeof(*td));
-@@ -453,7 +585,10 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -452,7 +584,10 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_DUTY_CYCLE],
  			   &td->tx_duty_cycle, 0, 99) ||
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_POWER_CONTROL],
@@ -2548,7 +2548,7 @@
  		goto out;
  
  	if (tb[MT76_TM_ATTR_TX_LENGTH]) {
-@@ -485,8 +620,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -484,8 +619,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  
  	if (tb[MT76_TM_ATTR_TX_POWER]) {
  		struct nlattr *cur;
@@ -2558,7 +2558,7 @@
  
  		nla_for_each_nested(cur, tb[MT76_TM_ATTR_TX_POWER], rem) {
  			if (nla_len(cur) != 1 ||
-@@ -506,11 +640,45 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -505,11 +639,45 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			if (nla_len(cur) != ETH_ALEN || idx >= 3)
  				goto out;
  
@@ -2605,7 +2605,7 @@
  	if (dev->test_ops->set_params) {
  		err = dev->test_ops->set_params(phy, tb, state);
  		if (err)
-@@ -575,6 +743,7 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+@@ -574,6 +742,7 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
  	struct mt76_phy *phy = hw->priv;
  	struct mt76_dev *dev = phy->dev;
  	struct mt76_testmode_data *td = &phy->test;
@@ -2613,7 +2613,7 @@
  	struct nlattr *tb[NUM_MT76_TM_ATTRS] = {};
  	int err = 0;
  	void *a;
-@@ -607,6 +776,19 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+@@ -606,6 +775,19 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
  		goto out;
  	}
  
@@ -2633,7 +2633,7 @@
  	mt76_testmode_init_defaults(phy);
  
  	err = -EMSGSIZE;
-@@ -619,12 +801,8 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+@@ -618,12 +800,8 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
  		goto out;
  
  	if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
@@ -2646,7 +2646,7 @@
  	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_STBC, td->tx_rate_stbc) ||
  	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_LTF) &&
  	     nla_put_u8(msg, MT76_TM_ATTR_TX_LTF, td->tx_ltf)) ||
-@@ -644,6 +822,15 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+@@ -643,6 +821,15 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
  	     nla_put_u8(msg, MT76_TM_ATTR_FREQ_OFFSET, td->freq_offset)))
  		goto out;
  
@@ -2663,7 +2663,7 @@
  		a = nla_nest_start(msg, MT76_TM_ATTR_TX_POWER);
  		if (!a)
 diff --git a/testmode.h b/testmode.h
-index 89613266..57949f2b 100644
+index 8961326..57949f2 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -6,6 +6,8 @@
@@ -2768,7 +2768,7 @@
 +
  #endif
 diff --git a/tools/fields.c b/tools/fields.c
-index e3f69089..6e36ab27 100644
+index e3f6908..6e36ab2 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -10,6 +10,7 @@ static const char * const testmode_state[] = {
@@ -2894,7 +2894,7 @@
  };
  
 diff --git a/tx.c b/tx.c
-index 65e2b7c1..8b33186b 100644
+index 65e2b7c..8b33186 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -245,8 +245,7 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
diff --git a/recipes-kernel/linux-mt76/files/patches/1112-mt76-testmode-add-pre-cal-support.patch b/recipes-kernel/linux-mt76/files/patches/1112-mt76-testmode-add-pre-cal-support.patch
new file mode 100644
index 0000000..7ecdd8b
--- /dev/null
+++ b/recipes-kernel/linux-mt76/files/patches/1112-mt76-testmode-add-pre-cal-support.patch
@@ -0,0 +1,846 @@
+From 3e0328c381fcaaa6e5fcf50494934c770d9ade49 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Wed, 31 Aug 2022 20:06:52 +0800
+Subject: [PATCH 1112/1121] mt76: testmode: add pre-cal support
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Change-Id: Ibfbbc3443de994eeb4daa5e364b0a90f5d7d3bcd
+---
+ eeprom.c          |   6 +-
+ mt76.h            |   1 +
+ mt76_connac_mcu.h |   1 +
+ mt7915/eeprom.h   |  34 +++-
+ mt7915/mcu.c      |  27 ++-
+ mt7915/mt7915.h   |   5 +
+ mt7915/testmode.c | 425 +++++++++++++++++++++++++++++++++++++++++++++-
+ mt7915/testmode.h |  36 ++++
+ testmode.c        |  15 +-
+ testmode.h        |  17 ++
+ tools/fields.c    |   8 +
+ 11 files changed, 562 insertions(+), 13 deletions(-)
+
+diff --git a/eeprom.c b/eeprom.c
+index 1e41b94..e083964 100644
+--- a/eeprom.c
++++ b/eeprom.c
+@@ -89,8 +89,10 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len)
+ 	}
+ 
+ #ifdef CONFIG_NL80211_TESTMODE
+-	dev->test_mtd.name = devm_kstrdup(dev->dev, part, GFP_KERNEL);
+-	dev->test_mtd.offset = offset;
++	if (len == dev->eeprom.size) {
++		dev->test_mtd.name = devm_kstrdup(dev->dev, part, GFP_KERNEL);
++		dev->test_mtd.offset = offset;
++	}
+ #endif
+ 
+ out_put_node:
+diff --git a/mt76.h b/mt76.h
+index d03f312..0ed4188 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -611,6 +611,7 @@ struct mt76_testmode_ops {
+ 			  enum mt76_testmode_state new_state);
+ 	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
+ 	int (*set_eeprom)(struct mt76_phy *phy, u32 offset, u8 *val, u8 action);
++	int (*dump_precal)(struct mt76_phy *phy, struct sk_buff *msg, int flag, int type);
+ };
+ 
+ struct mt76_testmode_entry_data {
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index cb1e94a..9789380 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -963,6 +963,7 @@ enum {
+ 
+ /* ext event table */
+ enum {
++	MCU_EXT_EVENT_RF_TEST = 0x4,
+ 	MCU_EXT_EVENT_PS_SYNC = 0x5,
+ 	MCU_EXT_EVENT_FW_LOG_2_HOST = 0x13,
+ 	MCU_EXT_EVENT_THERMAL_PROTECT = 0x22,
+diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
+index 7578ac6..b980342 100644
+--- a/mt7915/eeprom.h
++++ b/mt7915/eeprom.h
+@@ -39,10 +39,18 @@ enum mt7915_eeprom_field {
+ };
+ 
+ #define MT_EE_WIFI_CAL_GROUP			BIT(0)
+-#define MT_EE_WIFI_CAL_DPD			GENMASK(2, 1)
++#define MT_EE_WIFI_CAL_DPD_2G			BIT(2)
++#define MT_EE_WIFI_CAL_DPD_5G			BIT(1)
++#define MT_EE_WIFI_CAL_DPD_6G			BIT(3)
++#define MT_EE_WIFI_CAL_DPD			GENMASK(3, 1)
+ #define MT_EE_CAL_UNIT				1024
+-#define MT_EE_CAL_GROUP_SIZE			(49 * MT_EE_CAL_UNIT + 16)
+-#define MT_EE_CAL_DPD_SIZE			(54 * MT_EE_CAL_UNIT)
++#define MT_EE_CAL_GROUP_SIZE_7915		(49 * MT_EE_CAL_UNIT + 16)
++#define MT_EE_CAL_GROUP_SIZE_7916		(54 * MT_EE_CAL_UNIT + 16)
++#define MT_EE_CAL_GROUP_SIZE_7975		(54 * MT_EE_CAL_UNIT + 16)
++#define MT_EE_CAL_GROUP_SIZE_7976		(94 * MT_EE_CAL_UNIT + 16)
++#define MT_EE_CAL_GROUP_SIZE_7916_6G		(94 * MT_EE_CAL_UNIT + 16)
++#define MT_EE_CAL_DPD_SIZE_V1			(54 * MT_EE_CAL_UNIT)
++#define MT_EE_CAL_DPD_SIZE_V2			(300 * MT_EE_CAL_UNIT)
+ 
+ #define MT_EE_WIFI_CONF0_TX_PATH		GENMASK(2, 0)
+ #define MT_EE_WIFI_CONF0_BAND_SEL		GENMASK(7, 6)
+@@ -160,6 +168,26 @@ mt7915_tssi_enabled(struct mt7915_dev *dev, enum nl80211_band band)
+ 		return val & MT_EE_WIFI_CONF7_TSSI0_5G;
+ }
+ 
++static inline u32
++mt7915_get_cal_group_size(struct mt7915_dev *dev)
++{
++	u8 *eep = dev->mt76.eeprom.data;
++	u32 val;
++
++	if (is_mt7915(&dev->mt76)) {
++		return MT_EE_CAL_GROUP_SIZE_7915;
++	} else if (is_mt7916(&dev->mt76)) {
++		val = eep[MT_EE_WIFI_CONF + 1];
++		val = FIELD_GET(MT_EE_WIFI_CONF0_BAND_SEL, val);
++		return (val == MT_EE_V2_BAND_SEL_6GHZ) ? MT_EE_CAL_GROUP_SIZE_7916_6G :
++							 MT_EE_CAL_GROUP_SIZE_7916;
++	} else if (mt7915_check_adie(dev, false)) {
++		return MT_EE_CAL_GROUP_SIZE_7976;
++	} else {
++		return MT_EE_CAL_GROUP_SIZE_7975;
++	}
++}
++
+ extern const u8 mt7915_sku_group_len[MAX_SKU_RATE_GROUP_NUM];
+ 
+ #endif
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index ecdc4fb..42b1abc 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -438,6 +438,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+ 	case MCU_EXT_EVENT_BF_STATUS_READ:
+ 		mt7915_tm_txbf_status_read(dev, skb);
+ 		break;
++	case MCU_EXT_EVENT_RF_TEST:
++		mt7915_tm_rf_test_event(dev, skb);
++		break;
+ #endif
+ 	default:
+ 		break;
+@@ -2925,7 +2928,7 @@ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
+ 	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
+ 	u32 total = MT_EE_CAL_GROUP_SIZE;
+ 
+-	if (1 || !(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_GROUP))
++	if (!(eep[offs] & MT_EE_WIFI_CAL_GROUP))
+ 		return 0;
+ 
+ 	/*
+@@ -3005,11 +3008,29 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+ {
+ 	struct mt7915_dev *dev = phy->dev;
+ 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
+-	u16 total = 2, center_freq = chandef->center_freq1;
++	enum nl80211_band band = chandef->chan->band;
++	u32 offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
++	u16 center_freq = chandef->center_freq1;
+ 	u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
++	u8 dpd_mask, cal_num = is_mt7915(&dev->mt76) ? 2 : 3;
+ 	int idx;
+ 
+-	if (1 || !(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_DPD))
++	switch (band) {
++	case NL80211_BAND_2GHZ:
++		dpd_mask = MT_EE_WIFI_CAL_DPD_2G;
++		break;
++	case NL80211_BAND_5GHZ:
++		dpd_mask = MT_EE_WIFI_CAL_DPD_5G;
++		break;
++	case NL80211_BAND_6GHZ:
++		dpd_mask = MT_EE_WIFI_CAL_DPD_6G;
++		break;
++	default:
++		dpd_mask = 0;
++		break;
++	}
++
++	if (!(eep[offs] & dpd_mask))
+ 		return 0;
+ 
+ 	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 99f364c..fc0621e 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -381,6 +381,10 @@ struct mt7915_dev {
+ 	struct rchan *relay_fwlog;
+ 
+ 	void *cal;
++	u32 cur_prek_offset;
++	u8 dpd_chan_num_2g;
++	u8 dpd_chan_num_5g;
++	u8 dpd_chan_num_6g;
+ 
+ 	struct {
+ 		u8 debug_wm;
+@@ -617,6 +621,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
+ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
+ void mt7915_mcu_exit(struct mt7915_dev *dev);
+ int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
++void mt7915_tm_rf_test_event(struct mt7915_dev *dev, struct sk_buff *skb);
+ 
+ static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
+ {
+diff --git a/mt7915/testmode.c b/mt7915/testmode.c
+index bc4cd80..7a49608 100644
+--- a/mt7915/testmode.c
++++ b/mt7915/testmode.c
+@@ -5,6 +5,7 @@
+ #include "mac.h"
+ #include "mcu.h"
+ #include "testmode.h"
++#include "eeprom.h"
+ 
+ enum {
+ 	TM_CHANGED_TXPOWER,
+@@ -1578,17 +1579,15 @@ mt7915_tm_rf_switch_mode(struct mt7915_dev *dev, u32 oper)
+ static int
+ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
+ {
+-#define TX_CONT_START	0x05
+-#define TX_CONT_STOP	0x06
+ 	struct mt7915_dev *dev = phy->dev;
+ 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
+ 	int freq1 = ieee80211_frequency_to_channel(chandef->center_freq1);
+ 	struct mt76_testmode_data *td = &phy->mt76->test;
+-	u32 func_idx = en ? TX_CONT_START : TX_CONT_STOP;
++	u32 func_idx = en ? RF_TEST_TX_CONT_START : RF_TEST_TX_CONT_STOP;
+ 	u8 rate_idx = td->tx_rate_idx, mode;
+ 	u16 rateval;
+ 	struct mt7915_tm_rf_test req = {
+-		.action = 1,
++		.action = RF_ACT_IN_RFTEST,
+ 		.icap_len = 120,
+ 		.op.rf.func_idx = cpu_to_le32(func_idx),
+ 	};
+@@ -1672,6 +1671,316 @@ out:
+ 				 sizeof(req), true);
+ }
+ 
++static int
++mt7915_tm_group_prek(struct mt7915_phy *phy, enum mt76_testmode_state state)
++{
++	u8 *eeprom;
++	u32 i, group_size, dpd_size, size, offs, *pre_cal;
++	int ret = 0;
++	struct mt7915_dev *dev = phy->dev;
++	struct mt76_dev *mdev = &dev->mt76;
++	struct mt7915_tm_rf_test req = {
++		.action = RF_ACT_IN_RFTEST,
++		.icap_len = 8,
++		.op.rf.func_idx = cpu_to_le32(RF_TEST_RE_CAL),
++	};
++
++	if (!dev->flash_mode && !dev->bin_file_mode) {
++		dev_err(dev->mt76.dev, "Currently not in FLASH or BIN MODE,return!\n");
++		return 1;
++	}
++
++	eeprom = mdev->eeprom.data;
++	dev->cur_prek_offset = 0;
++	group_size = mt7915_get_cal_group_size(dev);
++	dpd_size = is_mt7915(&dev->mt76) ? MT_EE_CAL_DPD_SIZE_V1 : MT_EE_CAL_DPD_SIZE_V2;
++	size = group_size + dpd_size;
++	offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
++
++	switch (state) {
++	case MT76_TM_STATE_GROUP_PREK:
++		req.op.rf.param.cal_param.func_data = cpu_to_le32(RF_PRE_CAL);
++
++		if (!dev->cal) {
++			dev->cal = devm_kzalloc(mdev->dev, size, GFP_KERNEL);
++			if (!dev->cal)
++				return -ENOMEM;
++		}
++
++		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_TEST), &req,
++					sizeof(req), true);
++
++		if (!ret)
++			eeprom[offs] |= MT_EE_WIFI_CAL_GROUP;
++		break;
++	case MT76_TM_STATE_GROUP_PREK_DUMP:
++		pre_cal = (u32 *)dev->cal;
++		if (!pre_cal) {
++			dev_info(dev->mt76.dev, "Not group pre-cal yet!\n");
++			return ret;
++		}
++		dev_info(dev->mt76.dev, "Group Pre-Cal:\n");
++		for (i = 0; i < (group_size / sizeof(u32)); i += 4) {
++			dev_info(dev->mt76.dev, "[0x%08x] 0x%8x 0x%8x 0x%8x 0x%8x\n",
++				 i * sizeof(u32), pre_cal[i], pre_cal[i + 1],
++				 pre_cal[i + 2], pre_cal[i + 3]);
++		}
++		break;
++	case MT76_TM_STATE_GROUP_PREK_CLEAN:
++		pre_cal = (u32 *)dev->cal;
++		if (!pre_cal)
++			return ret;
++		memset(pre_cal, 0, group_size);
++		eeprom[offs] &= ~MT_EE_WIFI_CAL_GROUP;
++		break;
++	default:
++		return -EINVAL;
++	}
++	return ret;
++}
++
++static int
++mt7915_tm_dpd_prek(struct mt7915_phy *phy, enum mt76_testmode_state state)
++{
++#define DPD_2G_CH_BW20_BITMAP_0         0x444
++#define DPD_5G_CH_BW20_BITMAP_0         0xffffc0ff
++#define DPD_5G_CH_BW20_BITMAP_1         0x3
++#define DPD_5G_CH_BW20_BITMAP_7915_0    0x7dffc0ff
++#define DPD_6G_CH_BW20_BITMAP_0         0xffffffff
++#define DPD_6G_CH_BW20_BITMAP_1         0x07ffffff
++	bool is_set = false;
++	u8 band, do_precal, *eeprom;
++	u16 bw20_size, bw160_size;
++	u32 i, j, *bw160_freq, bw160_5g_freq[] = {5250, 5570, 5815};
++	u32 bw160_6g_freq[] = {6025, 6185, 6345, 6505, 6665, 6825, 6985};
++	u32 shift, freq, group_size, dpd_size, size, offs, *pre_cal, dpd_ch_bw20_bitmap[2] = {0};
++	__le32 func_data = 0;
++	int ret = 0;
++	struct mt7915_dev *dev = phy->dev;
++	struct mt76_dev *mdev = &dev->mt76;
++	struct mt76_phy *mphy = phy->mt76;
++	struct cfg80211_chan_def chandef_backup, *chandef = &mphy->chandef;
++	struct ieee80211_channel chan_backup, chan, *bw20_ch;
++	struct mt7915_tm_rf_test req = {
++		.action = RF_ACT_IN_RFTEST,
++		.icap_len = 8,
++		.op.rf.func_idx = cpu_to_le32(RF_TEST_RE_CAL),
++	};
++
++	if (!dev->flash_mode && !dev->bin_file_mode) {
++		dev_err(dev->mt76.dev, "Currently not in FLASH or BIN MODE,return!\n");
++		return -EOPNOTSUPP;
++	}
++
++	eeprom = mdev->eeprom.data;
++	dev->cur_prek_offset = 0;
++	group_size = mt7915_get_cal_group_size(dev);
++	dev->dpd_chan_num_2g = hweight32(DPD_2G_CH_BW20_BITMAP_0);
++	if (is_mt7915(&dev->mt76)) {
++		dev->dpd_chan_num_5g = hweight32(DPD_5G_CH_BW20_BITMAP_7915_0);
++		dev->dpd_chan_num_6g = 0;
++		dpd_size = MT_EE_CAL_DPD_SIZE_V1;
++		offs = MT_EE_DO_PRE_CAL;
++	} else {
++		dev->dpd_chan_num_5g = hweight32(DPD_5G_CH_BW20_BITMAP_0) +
++				       hweight32(DPD_5G_CH_BW20_BITMAP_1) +
++				       ARRAY_SIZE(bw160_5g_freq);
++		dev->dpd_chan_num_6g = hweight32(DPD_6G_CH_BW20_BITMAP_0) +
++				       hweight32(DPD_6G_CH_BW20_BITMAP_1) +
++				       ARRAY_SIZE(bw160_6g_freq);
++		dpd_size = MT_EE_CAL_DPD_SIZE_V2;
++		offs = MT_EE_DO_PRE_CAL_V2;
++	}
++	size = group_size + dpd_size;
++
++	switch (state) {
++	case MT76_TM_STATE_DPD_2G:
++		if (!is_set) {
++			func_data = cpu_to_le32(RF_DPD_FLAT_CAL);
++			dpd_ch_bw20_bitmap[0] = DPD_2G_CH_BW20_BITMAP_0;
++			bw20_ch = mphy->sband_2g.sband.channels;
++			bw160_freq = NULL;
++			bw160_size = 0;
++			band = NL80211_BAND_2GHZ;
++			do_precal = MT_EE_WIFI_CAL_DPD_2G;
++			is_set = true;
++		}
++		fallthrough;
++	case MT76_TM_STATE_DPD_5G:
++		if (!is_set) {
++			if (is_mt7915(&dev->mt76)) {
++				func_data = cpu_to_le32(RF_DPD_FLAT_CAL);
++				dpd_ch_bw20_bitmap[0] = DPD_5G_CH_BW20_BITMAP_7915_0;
++				bw160_size = 0;
++				dev->cur_prek_offset -= dev->dpd_chan_num_5g * MT_EE_CAL_UNIT * 2;
++			} else {
++				func_data = cpu_to_le32(RF_DPD_FLAT_5G_CAL);
++				dpd_ch_bw20_bitmap[0] = DPD_5G_CH_BW20_BITMAP_0;
++				dpd_ch_bw20_bitmap[1] = DPD_5G_CH_BW20_BITMAP_1;
++				bw160_size = ARRAY_SIZE(bw160_5g_freq);
++			}
++			bw20_ch = mphy->sband_5g.sband.channels;
++			bw160_freq = bw160_5g_freq;
++			band = NL80211_BAND_5GHZ;
++			do_precal = MT_EE_WIFI_CAL_DPD_5G;
++			is_set = true;
++		}
++		fallthrough;
++	case MT76_TM_STATE_DPD_6G:
++		if (!is_set) {
++			func_data = cpu_to_le32(RF_DPD_FLAT_6G_CAL);
++			dpd_ch_bw20_bitmap[0] = DPD_6G_CH_BW20_BITMAP_0;
++			dpd_ch_bw20_bitmap[1] = DPD_6G_CH_BW20_BITMAP_1;
++			bw20_ch = mphy->sband_6g.sband.channels;
++			bw160_freq = bw160_6g_freq;
++			bw160_size = ARRAY_SIZE(bw160_6g_freq);
++			band = NL80211_BAND_6GHZ;
++			do_precal = MT_EE_WIFI_CAL_DPD_6G;
++			is_set = true;
++		}
++
++		if (!bw20_ch)
++			return -EOPNOTSUPP;
++		if (!dev->cal) {
++			dev->cal = devm_kzalloc(mdev->dev, size, GFP_KERNEL);
++			if (!dev->cal)
++				return -ENOMEM;
++		}
++
++		req.op.rf.param.cal_param.func_data = func_data;
++		req.op.rf.param.cal_param.band_idx = phy->band_idx;
++
++		memcpy(&chan_backup, chandef->chan, sizeof(struct ieee80211_channel));
++		memcpy(&chandef_backup, chandef, sizeof(struct cfg80211_chan_def));
++
++		bw20_size = hweight32(dpd_ch_bw20_bitmap[0]) + hweight32(dpd_ch_bw20_bitmap[1]);
++		for (i = 0, j = 0; i < bw20_size + bw160_size; i++) {
++			if (i < bw20_size) {
++				freq = dpd_ch_bw20_bitmap[0] ? 0 : 1;
++				shift = ffs(dpd_ch_bw20_bitmap[freq]);
++				j += shift;
++				memcpy(&chan, &bw20_ch[j - 1], sizeof(struct ieee80211_channel));
++				chandef->width = NL80211_CHAN_WIDTH_20;
++				dpd_ch_bw20_bitmap[0] >>= shift;
++			} else {
++				freq = bw160_freq[i - bw20_size];
++				chan.center_freq = freq;
++				chan.hw_value = ieee80211_frequency_to_channel(freq);
++				chan.band = band;
++				chandef->width = NL80211_CHAN_WIDTH_160;
++			}
++
++			memcpy(chandef->chan, &chan, sizeof(struct ieee80211_channel));
++			if (is_mt7915(&dev->mt76))
++				mphy->hw->conf.flags &= ~IEEE80211_CONF_OFFCHANNEL;
++			else
++				mphy->hw->conf.flags |= IEEE80211_CONF_OFFCHANNEL;
++
++			mt7915_mcu_set_chan_info(phy, MCU_EXT_CMD(CHANNEL_SWITCH));
++
++			ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_TEST), &req,
++						sizeof(req), true);
++			if (ret) {
++				dev_err(dev->mt76.dev, "DPD Pre-cal: mcu send msg failed!\n");
++				break;
++			}
++		}
++		memcpy(chandef, &chandef_backup, sizeof(struct cfg80211_chan_def));
++		memcpy(chandef->chan, &chan_backup, sizeof(struct ieee80211_channel));
++		mt7915_mcu_set_chan_info(phy, MCU_EXT_CMD(CHANNEL_SWITCH));
++
++		if (!ret)
++			eeprom[offs] |= do_precal;
++
++		break;
++	case MT76_TM_STATE_DPD_DUMP:
++		pre_cal = (u32 *)dev->cal;
++		if (!dev->cal) {
++			dev_info(dev->mt76.dev, "Not DPD pre-cal yet!\n");
++			return ret;
++		}
++		dev_info(dev->mt76.dev, "DPD Pre-Cal:\n");
++		for (i = 0; i < dpd_size / sizeof(u32); i += 4) {
++			j = i + (group_size / sizeof(u32));
++			dev_info(dev->mt76.dev, "[0x%08x] 0x%8x 0x%8x 0x%8x 0x%8x\n",
++				 j * sizeof(u32), pre_cal[j], pre_cal[j + 1],
++				 pre_cal[j + 2], pre_cal[j + 3]);
++		}
++		break;
++	case MT76_TM_STATE_DPD_CLEAN:
++		pre_cal = (u32 *)dev->cal;
++		if (!pre_cal)
++			return ret;
++		memset(pre_cal + (group_size / sizeof(u32)), 0, dpd_size);
++		do_precal = MT_EE_WIFI_CAL_DPD;
++		eeprom[offs] &= ~do_precal;
++		break;
++	default:
++		return -EINVAL;
++	}
++	return ret;
++}
++
++void mt7915_tm_re_cal_event(struct mt7915_dev *dev, struct mt7915_tm_rf_test_result *result,
++			    struct mt7915_tm_rf_test_data *data)
++{
++#define DPD_PER_CHAN_SIZE_7915	2
++#define DPD_PER_CHAN_SIZE_7986	3
++	u32 base, dpd_offest_2g, dpd_offest_5g, cal_idx = 0, cal_type = 0, len = 0;
++	u8 *pre_cal;
++
++	pre_cal = dev->cal;
++	dpd_offest_5g = dev->dpd_chan_num_6g * DPD_PER_CHAN_SIZE_7986 * MT_EE_CAL_UNIT;
++	dpd_offest_2g = dpd_offest_5g + dev->dpd_chan_num_5g * MT_EE_CAL_UNIT *
++			(is_mt7915(&dev->mt76) ? DPD_PER_CHAN_SIZE_7915 : DPD_PER_CHAN_SIZE_7986);
++	cal_idx = le32_to_cpu(data->cal_idx);
++	cal_type = le32_to_cpu(data->cal_type);
++	len = le32_to_cpu(result->payload_len);
++	len = len - sizeof(struct mt7915_tm_rf_test_data);
++
++	switch (cal_type) {
++	case RF_PRE_CAL:
++		base = 0;
++		break;
++	case RF_DPD_FLAT_CAL:
++		base = mt7915_get_cal_group_size(dev) + dpd_offest_2g;
++		break;
++	case RF_DPD_FLAT_5G_CAL:
++		base = mt7915_get_cal_group_size(dev) + dpd_offest_5g;
++		break;
++	case RF_DPD_FLAT_6G_CAL:
++		base = mt7915_get_cal_group_size(dev);
++		break;
++	default:
++		dev_info(dev->mt76.dev, "Unknown calibration type!\n");
++		return;
++	}
++	pre_cal += (base + dev->cur_prek_offset);
++
++	memcpy(pre_cal, data->data, len);
++	dev->cur_prek_offset += len;
++}
++
++void mt7915_tm_rf_test_event(struct mt7915_dev *dev, struct sk_buff *skb)
++{
++	struct mt7915_tm_rf_test_result *result;
++	struct mt7915_tm_rf_test_data *data;
++	static u32 event_type;
++
++	result = (struct mt7915_tm_rf_test_result *)skb->data;
++	data = (struct mt7915_tm_rf_test_data *)result->event;
++
++	event_type = le32_to_cpu(result->func_idx);
++
++	switch (event_type) {
++	case RF_TEST_RE_CAL:
++		mt7915_tm_re_cal_event(dev, result, data);
++		break;
++	default:
++		break;
++	}
++}
++
+ static void
+ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
+ {
+@@ -1711,6 +2020,10 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
+ 	else if (prev_state == MT76_TM_STATE_OFF ||
+ 		 state == MT76_TM_STATE_OFF)
+ 		mt7915_tm_init(phy, !(state == MT76_TM_STATE_OFF));
++	else if (state >= MT76_TM_STATE_GROUP_PREK && state <= MT76_TM_STATE_GROUP_PREK_CLEAN)
++		return mt7915_tm_group_prek(phy, state);
++	else if (state >= MT76_TM_STATE_DPD_2G && state <= MT76_TM_STATE_DPD_CLEAN)
++		return mt7915_tm_dpd_prek(phy, state);
+ 
+ 	if ((state == MT76_TM_STATE_IDLE &&
+ 	     prev_state == MT76_TM_STATE_OFF) ||
+@@ -1872,9 +2185,113 @@ mt7915_tm_set_eeprom(struct mt76_phy *mphy, u32 offset, u8 *val, u8 action)
+ 	return ret;
+ }
+ 
++static int
++mt7915_tm_dump_precal(struct mt76_phy *mphy, struct sk_buff *msg, int flag, int type)
++{
++#define DPD_PER_CHAN_SIZE_MASK		GENMASK(31, 24)
++#define DPD_CHAN_NUM_2G_MASK		GENMASK(23, 16)
++#define DPD_CHAN_NUM_5G_MASK		GENMASK(15, 8)
++#define DPD_CHAN_NUM_6G_MASK		GENMASK(7, 0)
++	struct mt7915_phy *phy = mphy->priv;
++	struct mt7915_dev *dev = phy->dev;
++	u32 i, group_size, dpd_size, total_size, dpd_per_chan_size, dpd_info = 0;
++	u32 base, size, total_chan_num, offs, transmit_size = 1000;
++	u8 *pre_cal, *eeprom;
++	void *precal;
++	enum prek_ops {
++		PREK_GET_INFO,
++		PREK_SYNC_ALL,
++		PREK_SYNC_GROUP,
++		PREK_SYNC_DPD_2G,
++		PREK_SYNC_DPD_5G,
++		PREK_SYNC_DPD_6G,
++		PREK_CLEAN_GROUP,
++		PREK_CLEAN_DPD,
++	};
++
++	if (!dev->cal) {
++		dev_info(dev->mt76.dev, "Not pre-cal yet!\n");
++		return 0;
++	}
++
++	group_size = mt7915_get_cal_group_size(dev);
++	dpd_size = is_mt7915(&dev->mt76) ? MT_EE_CAL_DPD_SIZE_V1 : MT_EE_CAL_DPD_SIZE_V2;
++	dpd_per_chan_size = is_mt7915(&dev->mt76) ? 2 : 3;
++	total_size = group_size + dpd_size;
++	pre_cal = dev->cal;
++	eeprom = dev->mt76.eeprom.data;
++	offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
++
++	total_chan_num = dev->dpd_chan_num_2g + dev->dpd_chan_num_5g + dev->dpd_chan_num_6g;
++
++	switch (type) {
++	case PREK_SYNC_ALL:
++		base = 0;
++		size = total_size;
++		break;
++	case PREK_SYNC_GROUP:
++		base = 0;
++		size = group_size;
++		break;
++	case PREK_SYNC_DPD_6G:
++		base = group_size;
++		size = dpd_size * dev->dpd_chan_num_6g / total_chan_num;
++		break;
++	case PREK_SYNC_DPD_5G:
++		base = group_size + dev->dpd_chan_num_6g * dpd_per_chan_size * MT_EE_CAL_UNIT;
++		size = dpd_size * dev->dpd_chan_num_5g / total_chan_num;
++		break;
++	case PREK_SYNC_DPD_2G:
++		base = group_size + (dev->dpd_chan_num_6g + dev->dpd_chan_num_5g) *
++			   dpd_per_chan_size * MT_EE_CAL_UNIT;
++		size = dpd_size * dev->dpd_chan_num_2g / total_chan_num;
++		break;
++	case PREK_GET_INFO:
++		break;
++	default:
++		return 0;
++	}
++
++	if (!flag) {
++		if (eeprom[offs] & MT_EE_WIFI_CAL_DPD) {
++			dpd_info |= u32_encode_bits(dpd_per_chan_size, DPD_PER_CHAN_SIZE_MASK) |
++				    u32_encode_bits(dev->dpd_chan_num_2g, DPD_CHAN_NUM_2G_MASK) |
++				    u32_encode_bits(dev->dpd_chan_num_5g, DPD_CHAN_NUM_5G_MASK) |
++				    u32_encode_bits(dev->dpd_chan_num_6g, DPD_CHAN_NUM_6G_MASK);
++		}
++		dev->cur_prek_offset = 0;
++		precal = nla_nest_start(msg, MT76_TM_ATTR_PRECAL_INFO);
++		if (!precal)
++			return -ENOMEM;
++		nla_put_u32(msg, 0, group_size);
++		nla_put_u32(msg, 1, dpd_size);
++		nla_put_u32(msg, 2, dpd_info);
++		nla_put_u32(msg, 3, transmit_size);
++		nla_put_u32(msg, 4, eeprom[offs]);
++		nla_nest_end(msg, precal);
++	} else {
++		precal = nla_nest_start(msg, MT76_TM_ATTR_PRECAL);
++		if (!precal)
++			return -ENOMEM;
++
++		transmit_size = (dev->cur_prek_offset + transmit_size < size) ?
++				transmit_size : (size - dev->cur_prek_offset);
++		for (i = 0; i < transmit_size; i++) {
++			if (nla_put_u8(msg, i, pre_cal[base + dev->cur_prek_offset + i]))
++				return -ENOMEM;
++		}
++		dev->cur_prek_offset += transmit_size;
++
++		nla_nest_end(msg, precal);
++	}
++
++	return 0;
++}
++
+ const struct mt76_testmode_ops mt7915_testmode_ops = {
+ 	.set_state = mt7915_tm_set_state,
+ 	.set_params = mt7915_tm_set_params,
+ 	.dump_stats = mt7915_tm_dump_stats,
+ 	.set_eeprom = mt7915_tm_set_eeprom,
++	.dump_precal = mt7915_tm_dump_precal,
+ };
+diff --git a/mt7915/testmode.h b/mt7915/testmode.h
+index 01b08e9..d500987 100644
+--- a/mt7915/testmode.h
++++ b/mt7915/testmode.h
+@@ -81,6 +81,11 @@ struct tm_tx_cont {
+ 	u8 txfd_mode;
+ };
+ 
++struct tm_cal_param {
++	__le32 func_data;
++	u8 band_idx;
++};
++
+ struct mt7915_tm_rf_test {
+ 	u8 action;
+ 	u8 icap_len;
+@@ -96,6 +101,7 @@ struct mt7915_tm_rf_test {
+ 				__le32 cal_dump;
+ 
+ 				struct tm_tx_cont tx_cont;
++				struct tm_cal_param cal_param;
+ 
+ 				u8 _pad[80];
+ 			} param;
+@@ -103,6 +109,20 @@ struct mt7915_tm_rf_test {
+ 	} op;
+ } __packed;
+ 
++struct mt7915_tm_rf_test_result {
++	struct mt76_connac2_mcu_rxd rxd;
++
++	u32 func_idx;
++	u32 payload_len;
++	u8 event[0];
++} __packed;
++
++struct mt7915_tm_rf_test_data {
++	u32 cal_idx;
++	u32 cal_type;
++	u8 data[0];
++} __packed;
++
+ enum {
+ 	RF_OPER_NORMAL,
+ 	RF_OPER_RF_TEST,
+@@ -111,6 +131,22 @@ enum {
+ 	RF_OPER_WIFI_SPECTRUM,
+ };
+ 
++enum {
++	RF_ACT_SWITCH_MODE,
++	RF_ACT_IN_RFTEST,
++};
++
++enum {
++	RF_TEST_RE_CAL = 0x01,
++	RF_TEST_TX_CONT_START = 0x05,
++	RF_TEST_TX_CONT_STOP = 0x06,
++};
++
++#define RF_DPD_FLAT_CAL		BIT(28)
++#define RF_PRE_CAL		BIT(29)
++#define RF_DPD_FLAT_5G_CAL	GENMASK(29, 28)
++#define RF_DPD_FLAT_6G_CAL	(BIT(30) | BIT(28))
++
+ enum {
+ 	TAM_ARB_OP_MODE_NORMAL = 1,
+ 	TAM_ARB_OP_MODE_TEST,
+diff --git a/testmode.c b/testmode.c
+index 7a9ed54..82b8e98 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -763,6 +763,18 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+ 
+ 	mutex_lock(&dev->mutex);
+ 
++	if (tb[MT76_TM_ATTR_PRECAL] || tb[MT76_TM_ATTR_PRECAL_INFO]) {
++		int flag, type;
++
++		err = -EINVAL;
++		flag = tb[MT76_TM_ATTR_PRECAL] ? 1 : 0;
++		type = flag ? nla_get_u8(tb[MT76_TM_ATTR_PRECAL_INFO]) : 0;
++		if (dev->test_ops->dump_precal)
++			err = dev->test_ops->dump_precal(phy, msg, flag, type);
++
++		goto out;
++	}
++
+ 	if (tb[MT76_TM_ATTR_STATS]) {
+ 		err = -EINVAL;
+ 
+@@ -796,7 +808,8 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+ 
+ 	if (dev->test_mtd.name &&
+ 	    (nla_put_string(msg, MT76_TM_ATTR_MTD_PART, dev->test_mtd.name) ||
+-	     nla_put_u32(msg, MT76_TM_ATTR_MTD_OFFSET, dev->test_mtd.offset)))
++	     nla_put_u32(msg, MT76_TM_ATTR_MTD_OFFSET, dev->test_mtd.offset) ||
++	     nla_put_u8(msg, MT76_TM_ATTR_IS_MAIN_PHY, phy == &dev->phy)))
+ 		goto out;
+ 
+ 	if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
+diff --git a/testmode.h b/testmode.h
+index 57949f2..e2190e7 100644
+--- a/testmode.h
++++ b/testmode.h
+@@ -19,6 +19,7 @@
+  *
+  * @MT76_TM_ATTR_MTD_PART: mtd partition used for eeprom data (string)
+  * @MT76_TM_ATTR_MTD_OFFSET: offset of eeprom data within the partition (u32)
++ * @MT76_TM_ATTR_IS_MAIN_PHY: Is current phy index the main phy or the ext phy (u8)
+  *
+  * @MT76_TM_ATTR_TX_COUNT: configured number of frames to send when setting
+  *	state to MT76_TM_STATE_TX_FRAMES (u32)
+@@ -40,6 +41,11 @@
+  *
+  * @MT76_TM_ATTR_STATS: statistics (nested, see &enum mt76_testmode_stats_attr)
+  *
++ * @MT76_TM_ATTR_PRECAL: Pre-cal data (u8)
++ * @MT76_TM_ATTR_PRECAL_INFO: group size, dpd size, dpd_info, transmit size,
++ *                            eeprom cal indicator (u32),
++ *                            dpd_info = [dpd_per_chan_size, chan_num_2g,
++ *                                        chan_num_5g, chan_num_6g]
+  * @MT76_TM_ATTR_TX_SPE_IDX: tx spatial extension index (u8)
+  *
+  * @MT76_TM_ATTR_TX_DUTY_CYCLE: packet tx duty cycle (u8)
+@@ -67,6 +73,7 @@ enum mt76_testmode_attr {
+ 
+ 	MT76_TM_ATTR_MTD_PART,
+ 	MT76_TM_ATTR_MTD_OFFSET,
++	MT76_TM_ATTR_IS_MAIN_PHY,
+ 
+ 	MT76_TM_ATTR_TX_COUNT,
+ 	MT76_TM_ATTR_TX_LENGTH,
+@@ -85,6 +92,8 @@ enum mt76_testmode_attr {
+ 	MT76_TM_ATTR_FREQ_OFFSET,
+ 
+ 	MT76_TM_ATTR_STATS,
++	MT76_TM_ATTR_PRECAL,
++	MT76_TM_ATTR_PRECAL_INFO,
+ 
+ 	MT76_TM_ATTR_TX_SPE_IDX,
+ 
+@@ -184,6 +193,14 @@ enum mt76_testmode_state {
+ 	MT76_TM_STATE_TX_FRAMES,
+ 	MT76_TM_STATE_RX_FRAMES,
+ 	MT76_TM_STATE_TX_CONT,
++	MT76_TM_STATE_GROUP_PREK,
++	MT76_TM_STATE_GROUP_PREK_DUMP,
++	MT76_TM_STATE_GROUP_PREK_CLEAN,
++	MT76_TM_STATE_DPD_2G,
++	MT76_TM_STATE_DPD_5G,
++	MT76_TM_STATE_DPD_6G,
++	MT76_TM_STATE_DPD_DUMP,
++	MT76_TM_STATE_DPD_CLEAN,
+ 	MT76_TM_STATE_ON,
+ 
+ 	/* keep last */
+diff --git a/tools/fields.c b/tools/fields.c
+index 6e36ab2..1be1ffd 100644
+--- a/tools/fields.c
++++ b/tools/fields.c
+@@ -11,6 +11,14 @@ static const char * const testmode_state[] = {
+ 	[MT76_TM_STATE_TX_FRAMES] = "tx_frames",
+ 	[MT76_TM_STATE_RX_FRAMES] = "rx_frames",
+ 	[MT76_TM_STATE_TX_CONT] = "tx_cont",
++	[MT76_TM_STATE_GROUP_PREK] = "group_prek",
++	[MT76_TM_STATE_GROUP_PREK_DUMP] = "group_prek_dump",
++	[MT76_TM_STATE_GROUP_PREK_CLEAN] = "group_prek_clean",
++	[MT76_TM_STATE_DPD_2G] = "dpd_2g",
++	[MT76_TM_STATE_DPD_5G] = "dpd_5g",
++	[MT76_TM_STATE_DPD_6G] = "dpd_6g",
++	[MT76_TM_STATE_DPD_DUMP] = "dpd_dump",
++	[MT76_TM_STATE_DPD_CLEAN] = "dpd_clean",
+ };
+ 
+ static const char * const testmode_tx_mode[] = {
+-- 
+2.18.0
+
diff --git a/recipes-kernel/linux-mt76/files/patches/1112-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch b/recipes-kernel/linux-mt76/files/patches/1113-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
similarity index 77%
rename from recipes-kernel/linux-mt76/files/patches/1112-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
rename to recipes-kernel/linux-mt76/files/patches/1113-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
index a95ff2b..52e5e75 100644
--- a/recipes-kernel/linux-mt76/files/patches/1112-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1113-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
@@ -1,14 +1,14 @@
-From 378d2227566d0f3d60cd9b59d91e5b13153653e5 Mon Sep 17 00:00:00 2001
+From f5924783a8130cf8f53613ffaec44a1e116dae3f Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Sun, 24 Apr 2022 10:07:00 +0800
-Subject: [PATCH 1112/1119] mt76: mt7915: init rssi in WTBL when add station
+Subject: [PATCH 1113/1121] mt76: mt7915: init rssi in WTBL when add station
 
 ---
- drivers/net/wireless/mediatek/mt76/mt7915/main.c | 4 ++++
+ mt7915/main.c | 4 ++++
  1 file changed, 4 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index dd0b3cc2..06658aed 100644
+index b5c3c14..551e909 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -666,6 +666,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -30,5 +30,5 @@
  	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
  #endif
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1113-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch b/recipes-kernel/linux-mt76/files/patches/1114-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
similarity index 74%
rename from recipes-kernel/linux-mt76/files/patches/1113-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
rename to recipes-kernel/linux-mt76/files/patches/1114-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
index 4d28ad7..a4b9ab2 100644
--- a/recipes-kernel/linux-mt76/files/patches/1113-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1114-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
@@ -1,7 +1,7 @@
-From af6a70a816d5a98d22b5bb1012e21cc2ecb4d5db Mon Sep 17 00:00:00 2001
+From 6d7bba2a1a4d4757db3348df9486b8c55a8a5ecf Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 4 Aug 2022 14:08:11 +0800
-Subject: [PATCH] mt76: mt7915: reduce TWT SP sent to FW for cert
+Subject: [PATCH 1114/1121] mt76: mt7915: reduce TWT SP sent to FW for cert
 
 Set TWT SP duration to 88 percent to prevent HW sends PPDU over TWT SP.
 
@@ -11,10 +11,10 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d7e717f4..2bd67f7c 100644
+index 42b1abc..eb53095 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3538,7 +3538,7 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3556,7 +3556,7 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  		.own_mac_idx = mvif->mt76.omac_idx,
  		.flowid = flow->id,
  		.peer_id = cpu_to_le16(flow->wcid),
diff --git a/recipes-kernel/linux-mt76/files/patches/1114-mt76-airtime-fairness-feature-off-in-mac80211.patch b/recipes-kernel/linux-mt76/files/patches/1115-mt76-airtime-fairness-feature-off-in-mac80211.patch
similarity index 64%
rename from recipes-kernel/linux-mt76/files/patches/1114-mt76-airtime-fairness-feature-off-in-mac80211.patch
rename to recipes-kernel/linux-mt76/files/patches/1115-mt76-airtime-fairness-feature-off-in-mac80211.patch
index d6d76d7..b343205 100644
--- a/recipes-kernel/linux-mt76/files/patches/1114-mt76-airtime-fairness-feature-off-in-mac80211.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1115-mt76-airtime-fairness-feature-off-in-mac80211.patch
@@ -1,17 +1,17 @@
-From 270b493736a3f552b9fc2da8d6741c7e0168b470 Mon Sep 17 00:00:00 2001
+From 7ddf213d8c16bdea7827905e3e6c43f80beb26fd Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 6 May 2022 15:58:42 +0800
-Subject: [PATCH 1114/1119] mt76: airtime fairness feature off in mac80211
+Subject: [PATCH 1115/1121] mt76: airtime fairness feature off in mac80211
 
 ---
- drivers/net/wireless/mediatek/mt76/mac80211.c | 1 -
+ mac80211.c | 1 -
  1 file changed, 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 9984def5..af2c09ad 100644
+index e1c3332..2f0605d 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -427,7 +427,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
+@@ -428,7 +428,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
  			WIPHY_FLAG_AP_UAPSD;
  
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
@@ -20,5 +20,5 @@
  
  	wiphy->available_antennas_tx = phy->antenna_mask;
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1115-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch b/recipes-kernel/linux-mt76/files/patches/1116-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
similarity index 64%
rename from recipes-kernel/linux-mt76/files/patches/1115-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
rename to recipes-kernel/linux-mt76/files/patches/1116-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
index b1540ba..1f5c089 100644
--- a/recipes-kernel/linux-mt76/files/patches/1115-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1116-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
@@ -1,7 +1,7 @@
-From a4033091ec1a76b05364ea714f2abea7addbebb9 Mon Sep 17 00:00:00 2001
+From 45b37195f796ce6f2d7ef6969e47447007aa50de Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 20 May 2022 19:19:25 +0800
-Subject: [PATCH 1115/1119] mt76: mt7915: add mt7986 and mt7916 pre-calibration
+Subject: [PATCH 1116/1121] mt76: mt7915: add mt7986 and mt7916 pre-calibration
 
 Add pre-calibration for mt7986 and mt7916. It has different data size
 with mt7915. Group cal needs 54k and 94k for 2G + 5G and 2G + 6G,
@@ -9,13 +9,13 @@
 
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
- .../wireless/mediatek/mt76/mt7915/eeprom.c    | 15 ++--
- .../wireless/mediatek/mt76/mt7915/eeprom.h    | 27 ++++++-
- .../net/wireless/mediatek/mt76/mt7915/mcu.c   | 80 ++++++++++++++-----
- 3 files changed, 90 insertions(+), 32 deletions(-)
+ mt7915/eeprom.c | 15 +++++------
+ mt7915/eeprom.h |  1 +
+ mt7915/mcu.c    | 72 ++++++++++++++++++++++++++++++++++++-------------
+ 3 files changed, 62 insertions(+), 26 deletions(-)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 4b1a9811..ee3049e5 100644
+index 4b1a981..ee3049e 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -9,23 +9,22 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
@@ -50,7 +50,7 @@
  
  static int mt7915_check_eeprom(struct mt7915_dev *dev)
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index 7578ac6d..e924baef 100644
+index b980342..fb9fbfe 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
 @@ -19,6 +19,7 @@ enum mt7915_eeprom_field {
@@ -61,52 +61,11 @@
  	MT_EE_RATE_DELTA_2G =	0x252,
  	MT_EE_RATE_DELTA_5G =	0x29d,
  	MT_EE_TX0_POWER_2G =	0x2fc,
-@@ -39,10 +40,14 @@ enum mt7915_eeprom_field {
- };
- 
- #define MT_EE_WIFI_CAL_GROUP			BIT(0)
--#define MT_EE_WIFI_CAL_DPD			GENMASK(2, 1)
-+#define MT_EE_WIFI_CAL_DPD			GENMASK(3, 1)
- #define MT_EE_CAL_UNIT				1024
--#define MT_EE_CAL_GROUP_SIZE			(49 * MT_EE_CAL_UNIT + 16)
--#define MT_EE_CAL_DPD_SIZE			(54 * MT_EE_CAL_UNIT)
-+#define MT_EE_CAL_GROUP_SIZE_7915		(49 * MT_EE_CAL_UNIT + 16)
-+#define MT_EE_CAL_GROUP_SIZE_7916		(54 * MT_EE_CAL_UNIT + 16)
-+#define MT_EE_CAL_GROUP_SIZE_7975		(54 * MT_EE_CAL_UNIT + 16)
-+#define MT_EE_CAL_GROUP_SIZE_7976		(94 * MT_EE_CAL_UNIT + 16)
-+#define MT_EE_CAL_DPD_SIZE_V1			(54 * MT_EE_CAL_UNIT)
-+#define MT_EE_CAL_DPD_SIZE_V2			(300 * MT_EE_CAL_UNIT)
- 
- #define MT_EE_WIFI_CONF0_TX_PATH		GENMASK(2, 0)
- #define MT_EE_WIFI_CONF0_BAND_SEL		GENMASK(7, 6)
-@@ -160,6 +165,22 @@ mt7915_tssi_enabled(struct mt7915_dev *dev, enum nl80211_band band)
- 		return val & MT_EE_WIFI_CONF7_TSSI0_5G;
- }
- 
-+static inline u32
-+mt7915_get_cal_group_size(struct mt7915_dev *dev)
-+{
-+	switch (mt76_chip(&dev->mt76)) {
-+	case 0x7915:
-+		return MT_EE_CAL_GROUP_SIZE_7915;
-+	case 0x7916:
-+		return MT_EE_CAL_GROUP_SIZE_7916;
-+	default:
-+		if (mt7915_check_adie(dev, false))
-+			return MT_EE_CAL_GROUP_SIZE_7976;
-+
-+		return MT_EE_CAL_GROUP_SIZE_7975;
-+	}
-+}
-+
- extern const u8 mt7915_sku_group_len[MAX_SKU_RATE_GROUP_NUM];
- 
- #endif
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index c65fee98..29422f55 100644
+index eb53095..9d1dea2 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2930,9 +2930,10 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
+@@ -2926,7 +2926,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
  int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
  {
  	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
@@ -114,12 +73,9 @@
 +	u32 total = mt7915_get_cal_group_size(dev);
 +	u32 offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
  
--	if (1 || !(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_GROUP))
-+	if (1 || !(eep[offs] & MT_EE_WIFI_CAL_GROUP))
+ 	if (!(eep[offs] & MT_EE_WIFI_CAL_GROUP))
  		return 0;
- 
- 	/*
-@@ -2968,9 +2969,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
+@@ -2964,9 +2965,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
  	return -1;
  }
  
@@ -127,16 +83,16 @@
 +static int mt7915_dpd_freq_idx(struct mt7915_dev *dev, u16 freq, u8 bw)
  {
 -	static const u16 freq_list[] = {
-+	static const u16 freq_list_v1[] = {
++	const u16 freq_list_v1[] = {
  		5180, 5200, 5220, 5240,
  		5260, 5280, 5300, 5320,
  		5500, 5520, 5540, 5560,
-@@ -2978,65 +2979,102 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
+@@ -2974,34 +2975,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
  		5660, 5680, 5700, 5745,
  		5765, 5785, 5805, 5825
  	};
 -	int offset_2g = ARRAY_SIZE(freq_list);
-+	static const u16 freq_list_v2[] = {
++	const u16 freq_list_v2[] = {
 +		/* 6G BW20*/
 +		5955, 5975, 5995, 6015,
 +		6035, 6055, 6075, 6095,
@@ -167,7 +123,7 @@
 +		/* 5G BW160 */
 +		5250, 5570, 5815
 +	};
-+	static const u16 *freq_list = freq_list_v1;
++	const u16 *freq_list = freq_list_v1;
 +	int n_freqs = ARRAY_SIZE(freq_list_v1);
  	int idx;
  
@@ -211,18 +167,8 @@
  }
  
  int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
- {
- 	struct mt7915_dev *dev = phy->dev;
- 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
--	u16 total = 2, center_freq = chandef->center_freq1;
-+	u32 offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
-+	u16 center_freq = chandef->center_freq1;
- 	u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
-+	u8 cal_num = is_mt7915(&dev->mt76) ? 2 : 3;
- 	int idx;
- 
--	if (1 || !(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_DPD))
-+	if (1 || !(eep[offs] & MT_EE_WIFI_CAL_DPD))
+@@ -3033,24 +3069,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+ 	if (!(eep[offs] & dpd_mask))
  		return 0;
  
 -	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
@@ -252,5 +198,5 @@
  
  	return 0;
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1116-mt76-mt7915-add-phy-capability-vendor-command.patch b/recipes-kernel/linux-mt76/files/patches/1117-mt76-mt7915-add-phy-capability-vendor-command.patch
similarity index 90%
rename from recipes-kernel/linux-mt76/files/patches/1116-mt76-mt7915-add-phy-capability-vendor-command.patch
rename to recipes-kernel/linux-mt76/files/patches/1117-mt76-mt7915-add-phy-capability-vendor-command.patch
index 2341225..89c8ebf 100644
--- a/recipes-kernel/linux-mt76/files/patches/1116-mt76-mt7915-add-phy-capability-vendor-command.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1117-mt76-mt7915-add-phy-capability-vendor-command.patch
@@ -1,16 +1,16 @@
-From e6188ac3afe4e1027704f87409f4147215f32821 Mon Sep 17 00:00:00 2001
+From ee5d960cf8e4d524eb5ceb5ae8a65a8bfd58b28e Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
 Date: Tue, 12 Jul 2022 10:04:35 -0700
-Subject: [PATCH 1116/1119] mt76: mt7915: add phy capability vendor command
+Subject: [PATCH 1117/1121] mt76: mt7915: add phy capability vendor command
 
 ---
- .../wireless/mediatek/mt76/mt7915/mt7915.h    |  1 +
- .../wireless/mediatek/mt76/mt7915/vendor.c    | 52 +++++++++++++++++++
- .../wireless/mediatek/mt76/mt7915/vendor.h    | 25 +++++++++
+ mt7915/mt7915.h |  1 +
+ mt7915/vendor.c | 52 +++++++++++++++++++++++++++++++++++++++++++++++++
+ mt7915/vendor.h | 25 ++++++++++++++++++++++++
  3 files changed, 78 insertions(+)
 
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 5f11b3fb..fb8bd877 100644
+index fc0621e..99796d7 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -11,6 +11,7 @@
@@ -22,7 +22,7 @@
  #define MT7916_WTBL_SIZE		544
  #define MT7915_WTBL_RESERVED		(mt7915_wtbl_size(dev) - 1)
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index c7551848..77d71e48 100644
+index c755184..77d71e4 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -50,6 +50,18 @@ rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
@@ -99,7 +99,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index a8e4ebf9..719b851f 100644
+index a8e4ebf..719b851 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -9,6 +9,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -140,5 +140,5 @@
 +
  #endif
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1117-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch b/recipes-kernel/linux-mt76/files/patches/1118-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
similarity index 87%
rename from recipes-kernel/linux-mt76/files/patches/1117-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
rename to recipes-kernel/linux-mt76/files/patches/1118-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
index defd698..2495a1b 100644
--- a/recipes-kernel/linux-mt76/files/patches/1117-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1118-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
@@ -1,24 +1,24 @@
-From 49eb731e0ede35ae2deb4e248f704b1c27afeeed Mon Sep 17 00:00:00 2001
+From 7e582ea905e034e2d834d415a1889c66d2269d0b Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 24 Jun 2022 11:15:45 +0800
-Subject: [PATCH 1117/1119] mt76: mt7915: add vendor subcmd EDCCA ctrl
+Subject: [PATCH 1118/1121] mt76: mt7915: add vendor subcmd EDCCA ctrl
 
 Change-Id: I92dabf8be9c5a7ecec78f35325bc5645af8d15ab
 ---
- .../wireless/mediatek/mt76/mt76_connac_mcu.h  |  1 +
- .../net/wireless/mediatek/mt76/mt7915/main.c  |  3 +
- .../net/wireless/mediatek/mt76/mt7915/mcu.c   | 38 +++++++++++
- .../net/wireless/mediatek/mt76/mt7915/mcu.h   | 12 ++++
- .../wireless/mediatek/mt76/mt7915/mt7915.h    |  2 +
- .../wireless/mediatek/mt76/mt7915/vendor.c    | 63 +++++++++++++++++++
- .../wireless/mediatek/mt76/mt7915/vendor.h    | 19 ++++++
+ mt76_connac_mcu.h |  1 +
+ mt7915/main.c     |  3 +++
+ mt7915/mcu.c      | 38 ++++++++++++++++++++++++++++
+ mt7915/mcu.h      | 12 +++++++++
+ mt7915/mt7915.h   |  2 ++
+ mt7915/vendor.c   | 63 +++++++++++++++++++++++++++++++++++++++++++++++
+ mt7915/vendor.h   | 19 ++++++++++++++
  7 files changed, 138 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index cb1e94a3..ca68172d 100644
+index 9789380..2162a4a 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1147,6 +1147,7 @@ enum {
+@@ -1148,6 +1148,7 @@ enum {
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
  	MCU_EXT_CMD_CERT_CFG = 0xb7,
@@ -27,7 +27,7 @@
  };
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 06658aed..6085e124 100644
+index 551e909..c287de3 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -456,6 +456,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
@@ -41,10 +41,10 @@
  		ret = mt7915_set_channel(phy);
  		if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 29422f55..681a2a7c 100644
+index 9d1dea2..1f45d1a 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4239,3 +4239,41 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
+@@ -4251,3 +4251,41 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  
  	return 0;
  }
@@ -87,7 +87,7 @@
 +	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCCA), &req, sizeof(req), true);
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index ad85e56c..b8a433e5 100644
+index ad85e56..b8a433e 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -789,4 +789,16 @@ enum {
@@ -108,10 +108,10 @@
 +};
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index fb8bd877..6462d502 100644
+index 99796d7..730b91b 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -721,6 +721,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
+@@ -725,6 +725,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
  int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
@@ -121,7 +121,7 @@
  #ifdef MTK_DEBUG
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 77d71e48..5a28a554 100644
+index 77d71e4..5a28a55 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -62,6 +62,17 @@ phy_capa_dump_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP] = {
@@ -209,7 +209,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 719b851f..83c41bc1 100644
+index 719b851..83c41bc 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -10,8 +10,27 @@ enum mtk_nl80211_vendor_subcmds {
@@ -241,5 +241,5 @@
  	CAPI_RFEATURE_CHANGED		= BIT(16),
  	CAPI_WIRELESS_CHANGED		= BIT(17),
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1118-mt76-mt7915-implement-bin-file-mode.patch b/recipes-kernel/linux-mt76/files/patches/1119-mt76-mt7915-implement-bin-file-mode.patch
similarity index 88%
rename from recipes-kernel/linux-mt76/files/patches/1118-mt76-mt7915-implement-bin-file-mode.patch
rename to recipes-kernel/linux-mt76/files/patches/1119-mt76-mt7915-implement-bin-file-mode.patch
index 8597721..6233dad 100644
--- a/recipes-kernel/linux-mt76/files/patches/1118-mt76-mt7915-implement-bin-file-mode.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1119-mt76-mt7915-implement-bin-file-mode.patch
@@ -1,22 +1,22 @@
-From 8a072ddf45b67a379a2fb63dd45e0f5024101403 Mon Sep 17 00:00:00 2001
+From dbd3c04007801a0ea439218e7850a42a06d9f2a3 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 7 Jul 2022 11:09:59 +0800
-Subject: [PATCH 1118/1119] mt76: mt7915: implement bin file mode
+Subject: [PATCH 1119/1121] mt76: mt7915: implement bin file mode
 
 Change-Id: I2a726341541a11cbecdb210b33a8e79aefbd6cf3
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
- drivers/net/wireless/mediatek/mt76/eeprom.c   | 18 +++++++
- drivers/net/wireless/mediatek/mt76/mt76.h     |  1 +
- .../wireless/mediatek/mt76/mt7915/eeprom.c    | 53 +++++++++++++++----
- .../wireless/mediatek/mt76/mt7915/mt7915.h    | 10 ++++
+ eeprom.c        | 18 +++++++++++++++++
+ mt76.h          |  1 +
+ mt7915/eeprom.c | 53 +++++++++++++++++++++++++++++++++++++++----------
+ mt7915/mt7915.h | 10 ++++++++++
  4 files changed, 71 insertions(+), 11 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index d7ee123b..f2d0a65b 100644
+index e083964..5b9faf7 100644
 --- a/eeprom.c
 +++ b/eeprom.c
-@@ -102,6 +102,24 @@ out_put_node:
+@@ -104,6 +104,24 @@ out_put_node:
  }
  EXPORT_SYMBOL_GPL(mt76_get_of_eeprom);
  
@@ -42,10 +42,10 @@
  mt76_eeprom_override(struct mt76_phy *phy)
  {
 diff --git a/mt76.h b/mt76.h
-index 4c8a671f..49314895 100644
+index 0ed4188..4a41949 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1005,6 +1005,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
+@@ -1009,6 +1009,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
  int mt76_eeprom_init(struct mt76_dev *dev, int len);
  void mt76_eeprom_override(struct mt76_phy *phy);
  int mt76_get_of_eeprom(struct mt76_dev *dev, void *data, int offset, int len);
@@ -54,7 +54,7 @@
  struct mt76_queue *
  mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index ee3049e5..e5cfa5b0 100644
+index ee3049e..e5cfa5b 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -46,26 +46,36 @@ static char *mt7915_eeprom_name(struct mt7915_dev *dev)
@@ -148,7 +148,7 @@
  		if (ret)
  			return ret;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 6462d502..491566e9 100644
+index 730b91b..78f0b18 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -51,6 +51,15 @@
@@ -167,7 +167,7 @@
  #define MT7915_EEPROM_SIZE		3584
  #define MT7916_EEPROM_SIZE		4096
  
-@@ -377,6 +386,7 @@ struct mt7915_dev {
+@@ -375,6 +384,7 @@ struct mt7915_dev {
  
  	bool dbdc_support;
  	bool flash_mode;
@@ -176,5 +176,5 @@
  	bool ibf;
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1119-mt76-mt7915-initialize-wcid.patch b/recipes-kernel/linux-mt76/files/patches/1120-mt76-mt7915-initialize-wcid.patch
similarity index 71%
rename from recipes-kernel/linux-mt76/files/patches/1119-mt76-mt7915-initialize-wcid.patch
rename to recipes-kernel/linux-mt76/files/patches/1120-mt76-mt7915-initialize-wcid.patch
index d26e59c..2172868 100644
--- a/recipes-kernel/linux-mt76/files/patches/1119-mt76-mt7915-initialize-wcid.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1120-mt76-mt7915-initialize-wcid.patch
@@ -1,7 +1,7 @@
-From 1c4ec7f43f20ebbbe0c30100e6798ace079c3714 Mon Sep 17 00:00:00 2001
+From 7f7b35a036ad9b53f5a53a0728eb8a095eef5c8c Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 12 Jul 2022 13:56:07 +0800
-Subject: [PATCH] mt76 mt7915 initialize wcid
+Subject: [PATCH 1120/1121] mt76 mt7915 initialize wcid
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -9,10 +9,10 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 5e5df23d..9674015d 100644
+index f0eefc6..7c11e28 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -963,7 +963,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -965,7 +965,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  		 */
  		if (info & MT_TX_FREE_PAIR) {
  			struct mt7915_sta *msta;
diff --git a/recipes-kernel/linux-mt76/files/patches/1120-mt76-HEMU-Add-dump-support.patch b/recipes-kernel/linux-mt76/files/patches/1121-mt76-HEMU-Add-dump-support.patch
similarity index 94%
rename from recipes-kernel/linux-mt76/files/patches/1120-mt76-HEMU-Add-dump-support.patch
rename to recipes-kernel/linux-mt76/files/patches/1121-mt76-HEMU-Add-dump-support.patch
index e333271..2733e03 100644
--- a/recipes-kernel/linux-mt76/files/patches/1120-mt76-HEMU-Add-dump-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1121-mt76-HEMU-Add-dump-support.patch
@@ -1,7 +1,7 @@
-From 2bfc2727beaeebe4c475f27e65a22522a47e5ec0 Mon Sep 17 00:00:00 2001
+From 40e89a6e3147b39899aeecc6c14c8b5046bc1b26 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Thu, 11 Aug 2022 18:09:45 -0700
-Subject: [PATCH] mt76: HEMU: Add dump support
+Subject: [PATCH 1121/1121] mt76: HEMU: Add dump support
 
 Change-Id: I521214f3feb6f0d528a9f550255050ffd1ec96d2
 ---
@@ -73,5 +73,5 @@
  	/* keep last */
  	NUM_MTK_VENDOR_ATTRS_HEMU_CTRL,
 -- 
-2.32.0
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1122-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch b/recipes-kernel/linux-mt76/files/patches/1122-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
new file mode 100644
index 0000000..9a786d7
--- /dev/null
+++ b/recipes-kernel/linux-mt76/files/patches/1122-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
@@ -0,0 +1,254 @@
+From 516fcbdf41f48d71d814caaffb9e50b88778cd17 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Tue, 30 Aug 2022 15:29:38 +0800
+Subject: [PATCH] mt76: mt7915: add vendor subcmd three wire (PTA) ctrl
+
+Change-Id: Ie092d63af9a1e06bef36fc5a5bac40fdab73dba5
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt76_connac_mcu.h |  2 +-
+ mt7915/mcu.c      | 51 ++++++++++++++++++++++-------------------------
+ mt7915/mcu.h      | 29 +++++++++++++++++++++++++++
+ mt7915/mt7915.h   |  1 +
+ mt7915/vendor.c   | 42 +++++++++++++++++++++++++++++++++++++-
+ mt7915/vendor.h   | 12 +++++++++++
+ 6 files changed, 108 insertions(+), 29 deletions(-)
+
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 2162a4a..b777d95 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1147,7 +1147,7 @@ enum {
+ 	/* for vendor csi and air monitor */
+ 	MCU_EXT_CMD_SMESH_CTRL = 0xae,
+ 	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
+-	MCU_EXT_CMD_CERT_CFG = 0xb7,
++	MCU_EXT_CMD_SET_CFG = 0xb7,
+ 	MCU_EXT_CMD_EDCCA = 0xba,
+ 	MCU_EXT_CMD_CSI_CTRL = 0xc2,
+ };
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 1f45d1a..6931f2a 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -4017,37 +4017,34 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
+ 			&req, sizeof(req), false);
+ }
+ 
+-void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type)
++int mt7915_mcu_set_cfg(struct mt7915_phy *phy, u8 cfg_info, u8 type)
+ {
+-#define CFGINFO_CERT_CFG 4
+ 	struct mt7915_dev *dev = phy->dev;
+-	struct {
+-		struct basic_info{
+-			u8 dbdc_idx;
+-			u8 rsv[3];
+-			__le32 tlv_num;
+-			u8 tlv_buf[0];
+-		} hdr;
+-		struct cert_cfg{
+-			__le16 tag;
+-			__le16 length;
+-			u8 cert_program;
+-			u8 rsv[3];
+-		} tlv;
+-	} req = {
+-		.hdr = {
+-			.dbdc_idx = phy != &dev->phy,
+-			.tlv_num = cpu_to_le32(1),
+-		},
+-		.tlv = {
+-			.tag = cpu_to_le16(CFGINFO_CERT_CFG),
+-			.length = cpu_to_le16(sizeof(struct cert_cfg)),
+-			.cert_program = type, /* 1: CAPI Enable */
+-		}
++	struct cfg_basic_info req = {
++		.dbdc_idx = phy != &dev->phy,
++		.tlv_num = cpu_to_le32(1),
+ 	};
++	struct sk_buff *skb;
++	int tlv_len;
++
++	switch (cfg_info) {
++	case CFGINFO_CERT_CFG:
++		tlv_len = sizeof(struct cert_cfg);
++		req.cert.tag = cpu_to_le16(cfg_info);
++		req.cert.length = cpu_to_le16(tlv_len);
++		req.cert.cert_program = type;
++		break;
++	case CFGINFO_3WIRE_EN_CFG:
++		tlv_len = sizeof(struct three_wire_cfg);
++		req.three_wire.tag = cpu_to_le16(cfg_info);
++		req.three_wire.length = cpu_to_le16(tlv_len);
++		req.three_wire.three_wire_en = type;
++		break;
++	default:
++		return -EOPNOTSUPP;
++	}
+ 
+-	mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(CERT_CFG),
+-			  &req, sizeof(req), false);
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_CFG), &req, sizeof(req), false);
+ }
+ 
+ void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val)
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index b8a433e..9d0fac4 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -576,6 +576,35 @@ struct csi_data {
+ };
+ #endif
+ 
++struct cert_cfg {
++	__le16 tag;
++	__le16 length;
++	u8 cert_program;
++	u8 rsv[3];
++} __packed;
++
++struct three_wire_cfg {
++	__le16 tag;
++	__le16 length;
++	u8 three_wire_en;
++	u8 rsv[3];
++} __packed;
++
++struct cfg_basic_info {
++	u8 dbdc_idx;
++	u8 rsv[3];
++	__le32 tlv_num;
++	union {
++		struct cert_cfg cert;
++		struct three_wire_cfg three_wire;
++	};
++} __packed;
++
++enum {
++	CFGINFO_CERT_CFG = 4,
++	CFGINFO_3WIRE_EN_CFG = 10,
++};
++
+ /* MURU */
+ #define OFDMA_DL                       BIT(0)
+ #define OFDMA_UL                       BIT(1)
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 78f0b18..e8ac75e 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -727,6 +727,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
+ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable);
+ int mt7915_mcu_set_mu_edca(struct mt7915_phy *phy, u8 val);
+ void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type);
++int mt7915_mcu_set_cfg(struct mt7915_phy *phy, u8 cfg_info, u8 type);
+ void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val);
+ void mt7915_vendor_register(struct mt7915_phy *phy);
+ int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
+diff --git a/mt7915/vendor.c b/mt7915/vendor.c
+index 7acb330..7f67c0d 100644
+--- a/mt7915/vendor.c
++++ b/mt7915/vendor.c
+@@ -40,6 +40,11 @@ hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL] = {
+ 	[MTK_VENDOR_ATTR_HEMU_CTRL_DUMP] = {.type = NLA_U8 },
+ };
+ 
++static const struct nla_policy
++three_wire_ctrl_policy[NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL] = {
++	[MTK_VENDOR_ATTR_3WIRE_CTRL_MODE] = {.type = NLA_U8 },
++};
++
+ static const struct nla_policy
+ rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
+ 	[MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI] = {.type = NLA_U8 },
+@@ -964,7 +969,7 @@ static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
+ 			mt7915_set_wireless_vif, &val32);
+ 	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT]) {
+ 		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT]);
+-		mt7915_mcu_set_cert(phy, val8); /* Cert Enable for OMI */
++		mt7915_mcu_set_cfg(phy, CFGINFO_CERT_CFG, val8); /* Cert Enable for OMI */
+ 		mt7915_mcu_set_bypass_smthint(phy, val8); /* Cert bypass smooth interpolation */
+ 	}
+ 
+@@ -1091,6 +1096,30 @@ static int mt7915_vendor_edcca_ctrl(struct wiphy *wiphy,
+ 	return 0;
+ }
+ 
++static int mt7915_vendor_3wire_ctrl(struct wiphy *wiphy,
++				    struct wireless_dev *wdev,
++				    const void *data,
++				    int data_len)
++{
++	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++	struct mt7915_phy *phy = mt7915_hw_phy(hw);
++	struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL];
++	int err;
++	u8 three_wire_mode;
++
++	err = nla_parse(tb, MTK_VENDOR_ATTR_3WIRE_CTRL_MAX, data, data_len,
++			three_wire_ctrl_policy, NULL);
++	if (err)
++		return err;
++
++	if (!tb[MTK_VENDOR_ATTR_3WIRE_CTRL_MODE])
++		return -EINVAL;
++
++	three_wire_mode = nla_get_u8(tb[MTK_VENDOR_ATTR_3WIRE_CTRL_MODE]);
++
++	return mt7915_mcu_set_cfg(phy, CFGINFO_3WIRE_EN_CFG, three_wire_mode);
++}
++
+ 
+ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ 	{
+@@ -1172,6 +1201,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ 		.doit = mt7915_vendor_edcca_ctrl,
+ 		.policy = edcca_ctrl_policy,
+ 		.maxattr = MTK_VENDOR_ATTR_EDCCA_CTRL_MAX,
++	},
++	{
++		.info = {
++			.vendor_id = MTK_NL80211_VENDOR_ID,
++			.subcmd = MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL,
++		},
++		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
++			 WIPHY_VENDOR_CMD_NEED_RUNNING,
++		.doit = mt7915_vendor_3wire_ctrl,
++		.policy = three_wire_ctrl_policy,
++		.maxattr = MTK_VENDOR_ATTR_3WIRE_CTRL_MAX,
+ 	}
+ };
+ 
+diff --git a/mt7915/vendor.h b/mt7915/vendor.h
+index 57f52f3..e0c5fd9 100644
+--- a/mt7915/vendor.h
++++ b/mt7915/vendor.h
+@@ -11,6 +11,7 @@ enum mtk_nl80211_vendor_subcmds {
+ 	MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
+ 	MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL = 0xc6,
+ 	MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
++	MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8
+ };
+ 
+ 
+@@ -30,6 +31,17 @@ enum mtk_vendor_attr_edcca_ctrl {
+                 NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL - 1
+ };
+ 
++enum mtk_vendor_attr_3wire_ctrl {
++	MTK_VENDOR_ATTR_3WIRE_CTRL_UNSPEC,
++
++	MTK_VENDOR_ATTR_3WIRE_CTRL_MODE,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL,
++	MTK_VENDOR_ATTR_3WIRE_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL - 1
++};
++
+ 
+ enum mtk_capi_control_changed {
+ 	CAPI_RFEATURE_CHANGED		= BIT(16),
+-- 
+2.18.0
+
diff --git a/recipes-kernel/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch b/recipes-kernel/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch
index ed4e187..c7843f1 100644
--- a/recipes-kernel/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch
@@ -1,7 +1,7 @@
-From 47fc67f6071081280625a5cb34c5612429787f77 Mon Sep 17 00:00:00 2001
+From 3049935f79f524aa6984ccfa97075df4b1aadb41 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Sun, 12 Jun 2022 16:38:45 +0800
-Subject: [PATCH 3001/3002] mt76 add wed tx support
+Subject: [PATCH 3001/3006] mt76 add wed tx support
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -18,7 +18,7 @@
  10 files changed, 193 insertions(+), 97 deletions(-)
 
 diff --git a/mt76_connac.h b/mt76_connac.h
-index 7b6b3aa6..f71ded84 100644
+index 7b6b3aa..f71ded8 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -116,6 +116,7 @@ struct mt76_connac_sta_key_conf {
@@ -30,7 +30,7 @@
  struct mt76_connac_fw_txp {
  	__le16 flags;
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 8905018c..248a67f2 100644
+index 4b594a5..ac30698 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -11,7 +11,10 @@ mt7915_init_tx_queues(struct mt7915_phy *phy, int idx, int n_desc, int ring_base
@@ -144,7 +144,7 @@
  			return ret;
  	}
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 2f154518..39a115ed 100644
+index 7c11e28..0a13b7d 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -826,9 +826,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
@@ -160,7 +160,7 @@
  
  static void
 diff --git a/mt7915/main.c b/mt7915/main.c
-index c287de36..b77b3be7 100644
+index c287de3..b77b3be 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -1439,14 +1439,19 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
@@ -186,10 +186,10 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 65f91c1f..dd46762d 100644
+index 6931f2a..a041bb2 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2374,7 +2374,7 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
+@@ -2377,7 +2377,7 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -199,7 +199,7 @@
  
  	ret = mt7915_mcu_set_mwds(dev, 1);
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 8d966eff..b0d8a616 100644
+index 8d966ef..b0d8a61 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -10,6 +10,9 @@
@@ -341,10 +341,10 @@
  				     void __iomem *mem_base, u32 device_id)
  {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 87be6002..a3ffbc63 100644
+index e8ac75e..e329f74 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -532,6 +532,8 @@ static inline void mt7986_wmac_disable(struct mt7915_dev *dev)
+@@ -536,6 +536,8 @@ static inline void mt7986_wmac_disable(struct mt7915_dev *dev)
  {
  }
  #endif
@@ -354,7 +354,7 @@
  				     void __iomem *mem_base, u32 device_id);
  void mt7915_wfsys_reset(struct mt7915_dev *dev);
 diff --git a/mt7915/pci.c b/mt7915/pci.c
-index d74f6097..c5da01a9 100644
+index d74f609..c5da01a 100644
 --- a/mt7915/pci.c
 +++ b/mt7915/pci.c
 @@ -12,9 +12,6 @@
@@ -451,7 +451,7 @@
  		goto free_wed_or_irq_vector;
  
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 05ab6d9b..432ed303 100644
+index 05ab6d9..432ed30 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -617,6 +617,7 @@ enum offs_rev {
@@ -498,7 +498,7 @@
  #define MT_INT_TX_DONE_MCU		(MT_INT_TX_MCU(MT_MCUQ_WA) |	\
  					 MT_INT_TX_MCU(MT_MCUQ_WM) |	\
 diff --git a/mt7915/soc.c b/mt7915/soc.c
-index 3618718d..8d0b2068 100644
+index 3618718..8d0b206 100644
 --- a/mt7915/soc.c
 +++ b/mt7915/soc.c
 @@ -1171,10 +1171,6 @@ static int mt7986_wmac_probe(struct platform_device *pdev)
diff --git a/recipes-kernel/linux-mt76/files/patches/3002-mt76-add-wed-rx-support.patch b/recipes-kernel/linux-mt76/files/patches/3002-mt76-add-wed-rx-support.patch
index 49c1573..499e4c6 100644
--- a/recipes-kernel/linux-mt76/files/patches/3002-mt76-add-wed-rx-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3002-mt76-add-wed-rx-support.patch
@@ -1,7 +1,7 @@
-From 7051d8491ee276345001a75ee240d45eca8e5aca Mon Sep 17 00:00:00 2001
+From 3516b23f9acad60c44a13119e42636f92ca9d9a2 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 5 Jul 2022 19:42:55 +0800
-Subject: [PATCH] mt76 add wed rx support
+Subject: [PATCH 3002/3006] mt76 add wed rx support
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -32,7 +32,7 @@
  24 files changed, 505 insertions(+), 81 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 8ea09e6e..3317d2b9 100644
+index 8ea09e6..3317d2b 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -98,6 +98,63 @@ mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t)
@@ -483,7 +483,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_dma_cleanup);
 diff --git a/dma.h b/dma.h
-index fdf786f9..90370d12 100644
+index fdf786f..90370d1 100644
 --- a/dma.h
 +++ b/dma.h
 @@ -16,6 +16,16 @@
@@ -504,7 +504,7 @@
  #define MT_RX_INFO_LEN			4
  #define MT_FCE_INFO_LEN			4
 diff --git a/mac80211.c b/mac80211.c
-index 2f0605d5..a2bd8caa 100644
+index 2f0605d..a2bd8ca 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -598,11 +598,14 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
@@ -535,7 +535,7 @@
  
  	mt76_rx_complete(dev, &frames, napi);
 diff --git a/mt76.h b/mt76.h
-index 701bee95..2903b625 100644
+index 4a41949..fb3ae86 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -20,6 +20,8 @@
@@ -584,7 +584,7 @@
  
  	void (*rx_poll_complete)(struct mt76_dev *dev, enum mt76_rxq_id q);
  
-@@ -755,6 +762,7 @@ struct mt76_dev {
+@@ -756,6 +763,7 @@ struct mt76_dev {
  	struct ieee80211_hw *hw;
  
  	spinlock_t lock;
@@ -592,7 +592,7 @@
  	spinlock_t cc_lock;
  
  	u32 cur_cc_bss_rx;
-@@ -780,6 +788,7 @@ struct mt76_dev {
+@@ -781,6 +789,7 @@ struct mt76_dev {
  	struct sk_buff_head rx_skb[__MT_RXQ_MAX];
  
  	struct list_head txwi_cache;
@@ -600,7 +600,7 @@
  	struct mt76_queue *q_mcu[__MT_MCUQ_MAX];
  	struct mt76_queue q_rx[__MT_RXQ_MAX];
  	const struct mt76_queue_ops *queue_ops;
-@@ -793,12 +802,16 @@ struct mt76_dev {
+@@ -794,12 +803,16 @@ struct mt76_dev {
  	u16 wed_token_count;
  	u16 token_count;
  	u16 token_size;
@@ -617,7 +617,7 @@
  	u32 wcid_phy_mask[DIV_ROUND_UP(MT76_N_WCIDS, 32)];
  
  	u64 vif_mask;
-@@ -1356,6 +1369,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1357,6 +1370,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  }
  
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
@@ -626,7 +626,7 @@
  void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
  		      struct napi_struct *napi);
  void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
-@@ -1500,6 +1515,12 @@ struct mt76_txwi_cache *
+@@ -1501,6 +1516,12 @@ struct mt76_txwi_cache *
  mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
  int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
  void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
@@ -640,7 +640,7 @@
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
 diff --git a/mt7603/dma.c b/mt7603/dma.c
-index 590cff9d..2ff71c53 100644
+index 590cff9..2ff71c5 100644
 --- a/mt7603/dma.c
 +++ b/mt7603/dma.c
 @@ -69,7 +69,7 @@ free:
@@ -653,7 +653,7 @@
  	struct mt7603_dev *dev = container_of(mdev, struct mt7603_dev, mt76);
  	__le32 *rxd = (__le32 *)skb->data;
 diff --git a/mt7603/mt7603.h b/mt7603/mt7603.h
-index 0fd46d90..f2ce22ae 100644
+index 0fd46d9..f2ce22a 100644
 --- a/mt7603/mt7603.h
 +++ b/mt7603/mt7603.h
 @@ -244,7 +244,7 @@ int mt7603_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
@@ -666,7 +666,7 @@
  void mt7603_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
  int mt7603_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7615/mac.c b/mt7615/mac.c
-index d6aae60c..4774eaab 100644
+index d6aae60..4774eaa 100644
 --- a/mt7615/mac.c
 +++ b/mt7615/mac.c
 @@ -1651,7 +1651,7 @@ bool mt7615_rx_check(struct mt76_dev *mdev, void *data, int len)
@@ -679,7 +679,7 @@
  	struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
  	__le32 *rxd = (__le32 *)skb->data;
 diff --git a/mt7615/mt7615.h b/mt7615/mt7615.h
-index 060d52c8..232b0f29 100644
+index 060d52c..232b0f2 100644
 --- a/mt7615/mt7615.h
 +++ b/mt7615/mt7615.h
 @@ -511,7 +511,7 @@ void mt7615_tx_worker(struct mt76_worker *w);
@@ -692,7 +692,7 @@
  int mt7615_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  		       struct ieee80211_sta *sta);
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index e701db8a..6ae1159e 100644
+index e701db8..6ae1159 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -1190,6 +1190,7 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
@@ -740,7 +740,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_connac_mcu_add_key);
 diff --git a/mt76x02.h b/mt76x02.h
-index f76fd22e..0b872af1 100644
+index f76fd22..0b872af 100644
 --- a/mt76x02.h
 +++ b/mt76x02.h
 @@ -173,7 +173,7 @@ int mt76x02_set_rts_threshold(struct ieee80211_hw *hw, u32 val);
@@ -753,7 +753,7 @@
  irqreturn_t mt76x02_irq_handler(int irq, void *dev_instance);
  void mt76x02_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
 diff --git a/mt76x02_txrx.c b/mt76x02_txrx.c
-index 96fdf423..bf24d3e0 100644
+index 96fdf42..bf24d3e 100644
 --- a/mt76x02_txrx.c
 +++ b/mt76x02_txrx.c
 @@ -33,7 +33,7 @@ void mt76x02_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
@@ -766,7 +766,7 @@
  	struct mt76x02_dev *dev = container_of(mdev, struct mt76x02_dev, mt76);
  	void *rxwi = skb->data;
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index ac30698f..197a0169 100644
+index ac30698..197a016 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -349,6 +349,7 @@ static int mt7915_dma_enable(struct mt7915_dev *dev)
@@ -837,7 +837,7 @@
  		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_BAND1],
  				       MT_RXQ_ID(MT_RXQ_BAND1),
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 538ff5c3..cd9d846d 100644
+index 538ff5c..cd9d846 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -695,6 +695,15 @@ mt7915_init_hardware(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -857,7 +857,7 @@
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
  	if (idx)
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 39a115ed..1a2cadc5 100644
+index 0a13b7d..4e1dfc9 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -217,7 +217,7 @@ static void mt7915_mac_sta_poll(struct mt7915_dev *dev)
@@ -1006,7 +1006,7 @@
  			return;
  		}
 diff --git a/mt7915/main.c b/mt7915/main.c
-index b77b3be7..29ee7007 100644
+index b77b3be..29ee700 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -670,8 +670,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -1058,10 +1058,10 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index dd46762d..d83b3dcb 100644
+index a041bb2..3d50b78 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -1719,6 +1719,7 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1722,6 +1722,7 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  		       struct ieee80211_sta *sta, bool enable)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
@@ -1069,7 +1069,7 @@
  	struct mt7915_sta *msta;
  	struct sk_buff *skb;
  	int ret;
-@@ -1771,6 +1772,8 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1774,6 +1775,8 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  		return ret;
  	}
  out:
@@ -1078,7 +1078,7 @@
  	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
  				     MCU_EXT_CMD(STA_REC_UPDATE), true);
  }
-@@ -2345,6 +2348,7 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
+@@ -2348,6 +2351,7 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
  int mt7915_run_firmware(struct mt7915_dev *dev)
  {
  	int ret;
@@ -1086,7 +1086,7 @@
  
  	/* force firmware operation mode into normal state,
  	 * which should be set before firmware download stage.
-@@ -2374,8 +2378,14 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
+@@ -2377,8 +2381,14 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -1104,7 +1104,7 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index b8a433e5..ce50e606 100644
+index 9d0fac4..1f56db6 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -268,6 +268,7 @@ enum {
@@ -1116,7 +1116,7 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index b0d8a616..111444d7 100644
+index b0d8a61..111444d 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -28,6 +28,9 @@ static const u32 mt7915_reg[] = {
@@ -1197,7 +1197,7 @@
  	dev->mt76.dma_dev = wed->dev;
  	mdev->token_size = wed->wlan.token_start;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index a3ffbc63..d23416ca 100644
+index e329f74..b10b90a 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -18,6 +18,9 @@
@@ -1218,7 +1218,7 @@
  
  struct mt7915_vif;
  struct mt7915_sta;
-@@ -540,7 +544,9 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
+@@ -544,7 +548,9 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
  irqreturn_t mt7915_irq_handler(int irq, void *dev_instance);
  u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif);
  u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
@@ -1229,7 +1229,7 @@
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
  int mt7915_eeprom_init(struct mt7915_dev *dev);
-@@ -692,7 +698,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -697,7 +703,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  			  struct mt76_tx_info *tx_info);
  void mt7915_tx_token_put(struct mt7915_dev *dev);
  void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
@@ -1239,7 +1239,7 @@
  void mt7915_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
  void mt7915_stats_work(struct work_struct *work);
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 432ed303..36ef8a9c 100644
+index 432ed30..36ef8a9 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -27,6 +27,9 @@ enum reg_rev {
@@ -1285,7 +1285,7 @@
  #define MT_INT_SOURCE_CSR		__REG(INT_SOURCE_CSR)
  #define MT_INT_MASK_CSR			__REG(INT_MASK_CSR)
 diff --git a/mt7921/mac.c b/mt7921/mac.c
-index 1374c154..275f3679 100644
+index 1374c15..275f367 100644
 --- a/mt7921/mac.c
 +++ b/mt7921/mac.c
 @@ -555,7 +555,7 @@ out:
@@ -1298,7 +1298,7 @@
  	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
  	__le32 *rxd = (__le32 *)skb->data;
 diff --git a/mt7921/mt7921.h b/mt7921/mt7921.h
-index c161031a..0a1f0357 100644
+index c161031..0a1f035 100644
 --- a/mt7921/mt7921.h
 +++ b/mt7921/mt7921.h
 @@ -381,7 +381,7 @@ int mt7921e_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
@@ -1320,7 +1320,7 @@
  int mt7921e_mac_reset(struct mt7921_dev *dev);
  int mt7921e_mcu_init(struct mt7921_dev *dev);
 diff --git a/mt7921/pci_mac.c b/mt7921/pci_mac.c
-index e1800674..ca982eb5 100644
+index e180067..ca982eb 100644
 --- a/mt7921/pci_mac.c
 +++ b/mt7921/pci_mac.c
 @@ -182,7 +182,7 @@ bool mt7921e_rx_check(struct mt76_dev *mdev, void *data, int len)
@@ -1342,7 +1342,7 @@
  	}
  }
 diff --git a/tx.c b/tx.c
-index 8b33186b..b812d067 100644
+index 8b33186..b812d06 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -778,3 +778,37 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
diff --git a/recipes-kernel/linux-mt76/files/patches/3003-mt76-add-fill-receive-path-to-report-wed-idx.patch b/recipes-kernel/linux-mt76/files/patches/3003-mt76-add-fill-receive-path-to-report-wed-idx.patch
index 37ebdd1..7f0674a 100644
--- a/recipes-kernel/linux-mt76/files/patches/3003-mt76-add-fill-receive-path-to-report-wed-idx.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3003-mt76-add-fill-receive-path-to-report-wed-idx.patch
@@ -1,7 +1,7 @@
-From 552c7b193e72472b522153449f195fbb46f2b6ed Mon Sep 17 00:00:00 2001
+From 2edbd3a1fc221674535ecd5addad6342adb4c73e Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 19 May 2022 13:44:42 +0800
-Subject: [PATCH 3003/3003] mt76: add fill receive path to report wed idx
+Subject: [PATCH 3003/3006] mt76: add fill receive path to report wed idx
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -9,10 +9,10 @@
  1 file changed, 19 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 9c808ff..74c6f7c 100644
+index 29ee700..0f872f5 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1475,6 +1475,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1476,6 +1476,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  
  	return 0;
  }
@@ -37,7 +37,7 @@
  #endif
  
  const struct ieee80211_ops mt7915_ops = {
-@@ -1526,5 +1544,6 @@ const struct ieee80211_ops mt7915_ops = {
+@@ -1527,5 +1545,6 @@ const struct ieee80211_ops mt7915_ops = {
  	.set_radar_background = mt7915_set_radar_background,
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
  	.net_fill_forward_path = mt7915_net_fill_forward_path,
diff --git a/recipes-kernel/linux-mt76/files/patches/3004-mt76-add-ser-spport-when-wed-on.patch b/recipes-kernel/linux-mt76/files/patches/3004-mt76-add-ser-spport-when-wed-on.patch
old mode 100755
new mode 100644
index 3984947..11f84cc
--- a/recipes-kernel/linux-mt76/files/patches/3004-mt76-add-ser-spport-when-wed-on.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3004-mt76-add-ser-spport-when-wed-on.patch
@@ -1,7 +1,7 @@
-From 4bae67631956c6878e1f055e1cb0e3dd2154f7b7 Mon Sep 17 00:00:00 2001
+From f7539f063a354671a7e8b9d769c77fd936e09f96 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 28 Jul 2022 11:16:15 +0800
-Subject: [PATCH] mt76 add ser spport when wed on
+Subject: [PATCH 3004/3006] mt76 add ser spport when wed on
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -15,7 +15,7 @@
  7 files changed, 76 insertions(+), 15 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 3317d2b9..fa56ccfb 100644
+index 3317d2b..fa56ccf 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -169,7 +169,7 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
@@ -109,7 +109,7 @@
  	if (!q->rx_head)
  		return;
 diff --git a/dma.h b/dma.h
-index 90370d12..083cbca4 100644
+index 90370d1..083cbca 100644
 --- a/dma.h
 +++ b/dma.h
 @@ -58,5 +58,5 @@ enum mt76_mcu_evt_type {
@@ -120,10 +120,10 @@
 +int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset);
  #endif
 diff --git a/mt76.h b/mt76.h
-index 2903b625..831a47a9 100644
+index fb3ae86..2ad3900 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1371,6 +1371,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1372,6 +1372,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  void mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  struct mt76_txwi_cache *mt76_get_rxwi(struct mt76_dev *dev);
@@ -132,7 +132,7 @@
  		      struct napi_struct *napi);
  void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 197a0169..e0a51316 100644
+index 197a016..e0a5131 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -522,6 +522,7 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -203,7 +203,7 @@
  }
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 1a2cadc5..11b73c8f 100644
+index 4e1dfc9..5b68492 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -916,6 +916,8 @@ void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed)
@@ -248,7 +248,7 @@
  	if (ext_phy)
  		ieee80211_stop_queues(ext_phy->hw);
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 111444d7..1ccec14f 100644
+index 111444d..1ccec14 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -757,6 +757,8 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
@@ -261,10 +261,10 @@
  	if (mtk_wed_device_attach(wed) != 0)
  		return 0;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index d23416ca..01b2f681 100644
+index b10b90a..b4c8cdf 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -547,6 +547,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
+@@ -551,6 +551,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
  u32 mt7915_wed_init_rx_buf(struct mtk_wed_device *wed,
  				int pkt_num);
  void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed);
diff --git a/recipes-kernel/linux-mt76/files/patches/3005-mt76-mt7915-add-statistic-for-HW-Tx-Path.patch b/recipes-kernel/linux-mt76/files/patches/3005-mt76-mt7915-add-statistic-for-HW-Tx-Path.patch
index 0b48205..b13a5e4 100644
--- a/recipes-kernel/linux-mt76/files/patches/3005-mt76-mt7915-add-statistic-for-HW-Tx-Path.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3005-mt76-mt7915-add-statistic-for-HW-Tx-Path.patch
@@ -1,7 +1,7 @@
-From 7b9c6ae23f07ac5514492fff192fa927de1d5d17 Mon Sep 17 00:00:00 2001
+From 369397e8762832dc633ade7407852acb235fd4aa Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
 Date: Thu, 21 Jul 2022 10:56:09 -0700
-Subject: [PATCH] mt76: mt7915: add statistic for H/W Tx Path
+Subject: [PATCH 3005/3006] mt76: mt7915: add statistic for H/W Tx Path
 
 Set PPDU_TXS2H_EN_B0/B1 to get PPDU txs.
 Add MT_PACKET_ID_WED for PPDU txs, and change MT_PACKET_ID_FIRST to 3
@@ -21,7 +21,7 @@
  10 files changed, 141 insertions(+), 61 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 831a47a9..364b1119 100644
+index 2ad3900..c6f3ef7 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -275,6 +275,30 @@ DECLARE_EWMA(signal, 10, 8);
@@ -74,7 +74,7 @@
  #define MT_PACKET_ID_HAS_RATE		BIT(7)
  /* This is timer for when to give up when waiting for TXS callback,
   * with starting time being the time at which the DMA_DONE callback
-@@ -874,26 +901,6 @@ struct mt76_power_limits {
+@@ -875,26 +902,6 @@ struct mt76_power_limits {
  	s8 ru[7][12];
  };
  
@@ -102,7 +102,7 @@
  	u64 *data;
  	int idx;
 diff --git a/mt76_connac.h b/mt76_connac.h
-index f71ded84..4a43838b 100644
+index f71ded8..4a43838 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -366,9 +366,10 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
@@ -119,7 +119,7 @@
  					 struct sk_buff *skb,
  					 __le32 *rxv, u32 mode);
 diff --git a/mt76_connac2_mac.h b/mt76_connac2_mac.h
-index 67ce216f..c7064ba2 100644
+index 67ce216..c7064ba 100644
 --- a/mt76_connac2_mac.h
 +++ b/mt76_connac2_mac.h
 @@ -123,6 +123,12 @@ enum {
@@ -151,7 +151,7 @@
  #define MT_RXD1_NORMAL_WLAN_IDX		GENMASK(9, 0)
  #define MT_RXD1_NORMAL_GROUP_1		BIT(11)
 diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index a9e58cfa..af265d99 100644
+index a9e58cf..af265d9 100644
 --- a/mt76_connac_mac.c
 +++ b/mt76_connac_mac.c
 @@ -487,6 +487,9 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
@@ -289,7 +289,7 @@
  
  	return !!skb;
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 5b684926..63c702e0 100644
+index 5b68492..63c702e 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -1153,13 +1153,10 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
@@ -322,7 +322,7 @@
  		goto out;
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 0f872f5d..b7c6cf6a 100644
+index 0f872f5..b7c6cf6 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -1049,6 +1049,20 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
@@ -356,7 +356,7 @@
  
  static
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 1ccec14f..bb2d1c45 100644
+index 1ccec14..bb2d1c4 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -92,6 +92,7 @@ static const u32 mt7915_offs[] = {
@@ -425,7 +425,7 @@
  #endif
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 01b2f681..f1b9c0d6 100644
+index b4c8cdf..a1ce516 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -142,8 +142,6 @@ struct mt7915_sta {
@@ -438,7 +438,7 @@
  
  	struct {
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 36ef8a9c..dcb40181 100644
+index 36ef8a9..dcb4018 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -52,6 +52,7 @@ enum offs_rev {
@@ -460,7 +460,7 @@
  #define MT_AGG_MRCR_BAR_CNT_LIMIT		GENMASK(15, 12)
  #define MT_AGG_MRCR_LAST_RTS_CTS_RN		BIT(6)
 diff --git a/mt7921/mt7921.h b/mt7921/mt7921.h
-index 0a1f0357..96267d5b 100644
+index 0a1f035..96267d5 100644
 --- a/mt7921/mt7921.h
 +++ b/mt7921/mt7921.h
 @@ -100,7 +100,6 @@ struct mt7921_sta {
diff --git a/recipes-kernel/linux-mt76/files/patches/3006-mt76-mt7915-add-statistic-for-HW-Rx-Path.patch b/recipes-kernel/linux-mt76/files/patches/3006-mt76-mt7915-add-statistic-for-HW-Rx-Path.patch
index e91955f..1d5c092 100644
--- a/recipes-kernel/linux-mt76/files/patches/3006-mt76-mt7915-add-statistic-for-HW-Rx-Path.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3006-mt76-mt7915-add-statistic-for-HW-Rx-Path.patch
@@ -1,7 +1,7 @@
-From 12b7c7a035359298fc7d14ae3a6dbc16ec0b70ad Mon Sep 17 00:00:00 2001
+From f7138db4f2f9742c57bfc9dcf41c9ed7c0b9bd8f Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
 Date: Fri, 5 Aug 2022 13:58:11 -0700
-Subject: [PATCH] mt76: mt7915: add statistic for H/W Rx Path
+Subject: [PATCH 3006/3006] mt76: mt7915: add statistic for H/W Rx Path
 
 Change-Id: Id94d663f08e91c83d296bd57e5e9b65a505ae1c7
 ---
@@ -16,10 +16,10 @@
  8 files changed, 108 insertions(+), 1 deletion(-)
 
 diff --git a/mt76.h b/mt76.h
-index a65e7a3..e56fd58 100644
+index c6f3ef7..d29bcdf 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -289,6 +289,10 @@ struct mt76_sta_stats {
+@@ -297,6 +297,10 @@ struct mt76_sta_stats {
  	u32 tx_packets;
  	u32 tx_retries;
  	u32 tx_failed;
@@ -31,10 +31,10 @@
  
  struct mt76_wcid {
 diff --git a/mt76_connac.h b/mt76_connac.h
-index 8f78d12..41d6525 100644
+index 4a43838..e324c79 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
-@@ -218,6 +218,11 @@ static inline bool is_mt76_fw_txp(struct mt76_dev *dev)
+@@ -224,6 +224,11 @@ static inline bool is_mt76_fw_txp(struct mt76_dev *dev)
  	}
  }
  
@@ -47,10 +47,10 @@
  {
  	static const u8 width_to_bw[] = {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index ca68172..722e859 100644
+index b777d95..40de521 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1200,6 +1200,41 @@ enum {
+@@ -1201,6 +1201,41 @@ enum {
  	MCU_CE_CMD_GET_TXPWR = 0xd0,
  };
  
@@ -93,10 +93,10 @@
  	PATCH_SEM_RELEASE,
  	PATCH_SEM_GET
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 5ee9bb2..9ce5a60 100644
+index 63c702e..516717c 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -938,6 +938,31 @@ void mt7915_wed_trigger_ser(struct mtk_wed_device *wed)
+@@ -940,6 +940,31 @@ void mt7915_wed_trigger_ser(struct mtk_wed_device *wed)
  	return;
  }
  
@@ -128,7 +128,7 @@
  static void
  mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  {
-@@ -1173,6 +1198,7 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
+@@ -1175,6 +1200,7 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
  					  &msta->wcid.stats);
  	else
  		mt76_connac2_mac_add_txs_skb(&dev->mt76, wcid, pid, txs_data);
@@ -137,7 +137,7 @@
  		goto out;
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 7935774..a73c488 100644
+index b7c6cf6..f8da685 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -1028,7 +1028,8 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
@@ -164,7 +164,7 @@
  }
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 1272bee..8536b1e 100644
+index 3d50b78..fda1ff2 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -293,6 +293,27 @@ int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
@@ -196,7 +196,7 @@
  mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index f8dd553..bd80315 100644
+index bb2d1c4..c4bdf7f 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -9,6 +9,7 @@
@@ -227,10 +227,10 @@
  #else
  	return 0;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index b4d6b55..c02cc87 100644
+index a1ce516..7c20235 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -546,6 +546,8 @@ u32 mt7915_wed_init_rx_buf(struct mtk_wed_device *wed,
+@@ -550,6 +550,8 @@ u32 mt7915_wed_init_rx_buf(struct mtk_wed_device *wed,
  				int pkt_num);
  void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed);
  void mt7915_wed_trigger_ser(struct mtk_wed_device *wed);
@@ -239,7 +239,7 @@
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
  int mt7915_eeprom_init(struct mt7915_dev *dev);
-@@ -630,6 +632,7 @@ int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
+@@ -634,6 +636,7 @@ int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
  				     struct cfg80211_chan_def *chandef);
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set);
  int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3);
@@ -248,5 +248,5 @@
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
 -- 
-2.32.0
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/patches.inc b/recipes-kernel/linux-mt76/files/patches/patches.inc
index 40f4da7..2250c90 100644
--- a/recipes-kernel/linux-mt76/files/patches/patches.inc
+++ b/recipes-kernel/linux-mt76/files/patches/patches.inc
@@ -3,11 +3,11 @@
     file://0001-mt76-mt7915-rework-testmode-init-registers.patch \
     file://0002-mt76-testmode-rework-tx-antenna-setting.patch \
     file://0003-mt76-mt7915-rework-rx-testmode-stats.patch \
-    file://0005-mt76-mt7915-drop-undefined-action-frame.patch \
-    file://0008-mt76-common-RF-CR-idx-require-8-bits.patch \
-    file://0011-mt76-testmode-use-random-payload-for-tx-packets.patch \
-    file://0012-mt76-mt7915-add-spatial-extension-index-support.patch \
-    file://0013-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch \
+    file://0004-mt76-mt7915-drop-undefined-action-frame.patch \
+    file://0005-mt76-common-RF-CR-idx-require-8-bits.patch \
+    file://0006-mt76-testmode-use-random-payload-for-tx-packets.patch \
+    file://0007-mt76-mt7915-add-spatial-extension-index-support.patch \
+    file://0008-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch \
     file://100-Revert-of-net-pass-the-dst-buffer-to-of_get_mac_addr.patch \
     file://1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch \
     file://1002-mt76-mt7915-csi-implement-csi-support.patch \
@@ -19,15 +19,17 @@
     file://1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch \
     file://1009-mt76-mt7915-add-fw_version-dump.patch \
     file://1111-mt76-testmode-additional-supports.patch \
-    file://1112-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch \
-    file://1113-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch \
-    file://1114-mt76-airtime-fairness-feature-off-in-mac80211.patch \
-    file://1115-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch \
-    file://1116-mt76-mt7915-add-phy-capability-vendor-command.patch \
-    file://1117-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch \
-    file://1118-mt76-mt7915-implement-bin-file-mode.patch \
-    file://1119-mt76-mt7915-initialize-wcid.patch \
-    file://1120-mt76-HEMU-Add-dump-support.patch \
+    file://1112-mt76-testmode-add-pre-cal-support.patch \
+    file://1113-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch \
+    file://1114-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch \
+    file://1115-mt76-airtime-fairness-feature-off-in-mac80211.patch \
+    file://1116-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch \
+    file://1117-mt76-mt7915-add-phy-capability-vendor-command.patch \
+    file://1118-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch \
+    file://1119-mt76-mt7915-implement-bin-file-mode.patch \
+    file://1120-mt76-mt7915-initialize-wcid.patch \
+    file://1121-mt76-HEMU-Add-dump-support.patch \
+    file://1122-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch \
     file://3001-mt76-add-wed-tx-support.patch \
     file://3002-mt76-add-wed-rx-support.patch \
     file://3003-mt76-add-fill-receive-path-to-report-wed-idx.patch \
diff --git a/recipes-kernel/linux-mt76/files/src/firmware/mt7986_rom_patch.bin b/recipes-kernel/linux-mt76/files/src/firmware/mt7986_rom_patch.bin
index 4074aa0..37c1106 100644
--- a/recipes-kernel/linux-mt76/files/src/firmware/mt7986_rom_patch.bin
+++ b/recipes-kernel/linux-mt76/files/src/firmware/mt7986_rom_patch.bin
Binary files differ
diff --git a/recipes-kernel/linux-mt76/files/src/firmware/mt7986_rom_patch_mt7975.bin b/recipes-kernel/linux-mt76/files/src/firmware/mt7986_rom_patch_mt7975.bin
index 58975ad..6e9aa8d 100644
--- a/recipes-kernel/linux-mt76/files/src/firmware/mt7986_rom_patch_mt7975.bin
+++ b/recipes-kernel/linux-mt76/files/src/firmware/mt7986_rom_patch_mt7975.bin
Binary files differ
diff --git a/recipes-kernel/linux-mt76/files/src/firmware/mt7986_wa.bin b/recipes-kernel/linux-mt76/files/src/firmware/mt7986_wa.bin
index 0554c0e..3e0f5f8 100644
--- a/recipes-kernel/linux-mt76/files/src/firmware/mt7986_wa.bin
+++ b/recipes-kernel/linux-mt76/files/src/firmware/mt7986_wa.bin
Binary files differ
diff --git a/recipes-kernel/linux-mt76/files/src/firmware/mt7986_wm.bin b/recipes-kernel/linux-mt76/files/src/firmware/mt7986_wm.bin
index 87a7e3f..67e905f 100644
--- a/recipes-kernel/linux-mt76/files/src/firmware/mt7986_wm.bin
+++ b/recipes-kernel/linux-mt76/files/src/firmware/mt7986_wm.bin
Binary files differ
diff --git a/recipes-kernel/linux-mt76/files/src/firmware/mt7986_wm_mt7975.bin b/recipes-kernel/linux-mt76/files/src/firmware/mt7986_wm_mt7975.bin
index 783429b..f2911f9 100644
--- a/recipes-kernel/linux-mt76/files/src/firmware/mt7986_wm_mt7975.bin
+++ b/recipes-kernel/linux-mt76/files/src/firmware/mt7986_wm_mt7975.bin
Binary files differ
diff --git a/recipes-kernel/linux-mt76/files/src/firmware/mt7986_wo_0.bin b/recipes-kernel/linux-mt76/files/src/firmware/mt7986_wo_0.bin
index e567237..12c4cf3 100644
--- a/recipes-kernel/linux-mt76/files/src/firmware/mt7986_wo_0.bin
+++ b/recipes-kernel/linux-mt76/files/src/firmware/mt7986_wo_0.bin
Binary files differ
diff --git a/recipes-kernel/linux-mt76/files/src/firmware/mt7986_wo_1.bin b/recipes-kernel/linux-mt76/files/src/firmware/mt7986_wo_1.bin
index 1708121..c5f4fb7 100644
--- a/recipes-kernel/linux-mt76/files/src/firmware/mt7986_wo_1.bin
+++ b/recipes-kernel/linux-mt76/files/src/firmware/mt7986_wo_1.bin
Binary files differ
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/080-wireguard-0005-crypto-arm64-chacha-depend-on-generic-chacha-library.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/080-wireguard-0005-crypto-arm64-chacha-depend-on-generic-chacha-library.patch
index 10e49c1..e12e9d1 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/080-wireguard-0005-crypto-arm64-chacha-depend-on-generic-chacha-library.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/080-wireguard-0005-crypto-arm64-chacha-depend-on-generic-chacha-library.patch
@@ -26,7 +26,7 @@
 
 --- a/arch/arm64/crypto/Kconfig
 +++ b/arch/arm64/crypto/Kconfig
-@@ -103,7 +103,7 @@ config CRYPTO_CHACHA20_NEON
+@@ -104,7 +104,7 @@ config CRYPTO_CHACHA20_NEON
  	tristate "ChaCha20, XChaCha20, and XChaCha12 stream ciphers using NEON instructions"
  	depends on KERNEL_MODE_NEON
  	select CRYPTO_BLKCIPHER
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/080-wireguard-0006-crypto-arm64-chacha-expose-arm64-ChaCha-routine-as-l.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/080-wireguard-0006-crypto-arm64-chacha-expose-arm64-ChaCha-routine-as-l.patch
index 71665e8..e4f3324 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/080-wireguard-0006-crypto-arm64-chacha-expose-arm64-ChaCha-routine-as-l.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/080-wireguard-0006-crypto-arm64-chacha-expose-arm64-ChaCha-routine-as-l.patch
@@ -25,7 +25,7 @@
 
 --- a/arch/arm64/crypto/Kconfig
 +++ b/arch/arm64/crypto/Kconfig
-@@ -104,6 +104,7 @@ config CRYPTO_CHACHA20_NEON
+@@ -105,6 +105,7 @@ config CRYPTO_CHACHA20_NEON
  	depends on KERNEL_MODE_NEON
  	select CRYPTO_BLKCIPHER
  	select CRYPTO_LIB_CHACHA_GENERIC
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/080-wireguard-0018-crypto-arm64-poly1305-incorporate-OpenSSL-CRYPTOGAMS.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/080-wireguard-0018-crypto-arm64-poly1305-incorporate-OpenSSL-CRYPTOGAMS.patch
index 464c656..35091ac 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/080-wireguard-0018-crypto-arm64-poly1305-incorporate-OpenSSL-CRYPTOGAMS.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/080-wireguard-0018-crypto-arm64-poly1305-incorporate-OpenSSL-CRYPTOGAMS.patch
@@ -34,7 +34,7 @@
 
 --- a/arch/arm64/crypto/Kconfig
 +++ b/arch/arm64/crypto/Kconfig
-@@ -106,6 +106,12 @@ config CRYPTO_CHACHA20_NEON
+@@ -107,6 +107,12 @@ config CRYPTO_CHACHA20_NEON
  	select CRYPTO_LIB_CHACHA_GENERIC
  	select CRYPTO_ARCH_HAVE_LIB_CHACHA
  
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/800-v5.20-0001-dt-bindings-leds-add-Broadcom-s-BCM63138-controller.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/845-v6.0-0001-dt-bindings-leds-add-Broadcom-s-BCM63138-controller.patch
similarity index 100%
rename from recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/800-v5.20-0001-dt-bindings-leds-add-Broadcom-s-BCM63138-controller.patch
rename to recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/845-v6.0-0001-dt-bindings-leds-add-Broadcom-s-BCM63138-controller.patch
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/800-v5.20-0002-leds-bcm63138-add-support-for-BCM63138-controller.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/845-v6.0-0002-leds-bcm63138-add-support-for-BCM63138-controller.patch
similarity index 100%
rename from recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/800-v5.20-0002-leds-bcm63138-add-support-for-BCM63138-controller.patch
rename to recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/845-v6.0-0002-leds-bcm63138-add-support-for-BCM63138-controller.patch
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/846-v5.20-0001-dt-bindings-leds-leds-bcm63138-unify-full-stops-in-d.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/846-v6.0-0001-dt-bindings-leds-leds-bcm63138-unify-full-stops-in-d.patch
similarity index 100%
rename from recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/846-v5.20-0001-dt-bindings-leds-leds-bcm63138-unify-full-stops-in-d.patch
rename to recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/846-v6.0-0001-dt-bindings-leds-leds-bcm63138-unify-full-stops-in-d.patch
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/846-v5.20-0002-leds-add-help-info-about-BCM63138-module-name.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/846-v6.0-0002-leds-add-help-info-about-BCM63138-module-name.patch
similarity index 100%
rename from recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/846-v5.20-0002-leds-add-help-info-about-BCM63138-module-name.patch
rename to recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/846-v6.0-0002-leds-add-help-info-about-BCM63138-module-name.patch
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/846-v5.20-0003-leds-leds-bcm63138-get-rid-of-LED_OFF.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/846-v6.0-0003-leds-leds-bcm63138-get-rid-of-LED_OFF.patch
similarity index 100%
rename from recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/846-v5.20-0003-leds-leds-bcm63138-get-rid-of-LED_OFF.patch
rename to recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/846-v6.0-0003-leds-leds-bcm63138-get-rid-of-LED_OFF.patch
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/backport-5.4.inc b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/backport-5.4.inc
index 4f141ed..7f9a97a 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/backport-5.4.inc
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/backport-5.4.inc
@@ -238,8 +238,6 @@
     file://780-net-dsa-mt7530-setup-core-clock-even-in-TRGMII-mode.patch \
     file://781-v5.18-1-net-dsa-Move-VLAN-filtering-syncing-out-of-dsa_switc.patch \
     file://781-v5.18-2-net-dsa-Avoid-cross-chip-syncing-of-VLAN-filtering.patch \
-    file://800-v5.20-0001-dt-bindings-leds-add-Broadcom-s-BCM63138-controller.patch \
-    file://800-v5.20-0002-leds-bcm63138-add-support-for-BCM63138-controller.patch \
     file://800-v5.5-iio-imu-Add-support-for-the-FXOS8700-IMU.patch \
     file://800-v5.5-scsi-core-Add-sysfs-attributes-for-VPD-pages-0h-and-.patch \
     file://801-v5.5-hwmon-Driver-for-disk-and-solid-state-drives-with-te.patch \
@@ -269,9 +267,11 @@
     file://831-v5.13-0003-firmware-bcm47xx_nvram-extract-code-copying-NVRAM.patch \
     file://831-v5.13-0004-firmware-bcm47xx_nvram-look-for-NVRAM-with-for-inste.patch \
     file://831-v5.13-0005-firmware-bcm47xx_nvram-inline-code-checking-NVRAM-si.patch \
-    file://846-v5.20-0001-dt-bindings-leds-leds-bcm63138-unify-full-stops-in-d.patch \
-    file://846-v5.20-0002-leds-add-help-info-about-BCM63138-module-name.patch \
-    file://846-v5.20-0003-leds-leds-bcm63138-get-rid-of-LED_OFF.patch \
+    file://845-v6.0-0001-dt-bindings-leds-add-Broadcom-s-BCM63138-controller.patch \
+    file://845-v6.0-0002-leds-bcm63138-add-support-for-BCM63138-controller.patch \
+    file://846-v6.0-0001-dt-bindings-leds-leds-bcm63138-unify-full-stops-in-d.patch \
+    file://846-v6.0-0002-leds-add-help-info-about-BCM63138-module-name.patch \
+    file://846-v6.0-0003-leds-leds-bcm63138-get-rid-of-LED_OFF.patch \
     file://852-v5.10-0001-net-sfp-VSOL-V2801F-CarlitoxxPro-CPGOS03-0490-v2.0-w.patch \
     file://852-v5.10-0002-net-sfp-add-workaround-for-Realtek-RTL8672-and-RTL96.patch \
     file://900-v5.9-0001-dt-bindings-Add-multicolor-class-dt-bindings-documen.patch \
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/hack-5.4/321-powerpc_crtsavres_prereq.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/hack-5.4/321-powerpc_crtsavres_prereq.patch
index 8591705..005c46a 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/hack-5.4/321-powerpc_crtsavres_prereq.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/hack-5.4/321-powerpc_crtsavres_prereq.patch
@@ -16,7 +16,7 @@
 
 --- a/arch/powerpc/Makefile
 +++ b/arch/powerpc/Makefile
-@@ -61,20 +61,6 @@ machine-$(CONFIG_PPC64) += 64
+@@ -44,20 +44,6 @@ machine-$(CONFIG_PPC64) += 64
  machine-$(CONFIG_CPU_LITTLE_ENDIAN) += le
  UTS_MACHINE := $(subst $(space),,$(machine-y))
  
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/419-mtd-redboot-add-of_match_table-with-DT-binding.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/419-mtd-redboot-add-of_match_table-with-DT-binding.patch
index 7692f48..3ea5f4a 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/419-mtd-redboot-add-of_match_table-with-DT-binding.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/419-mtd-redboot-add-of_match_table-with-DT-binding.patch
@@ -12,7 +12,7 @@
 
 --- a/drivers/mtd/parsers/redboot.c
 +++ b/drivers/mtd/parsers/redboot.c
-@@ -305,6 +305,7 @@ static int parse_redboot_partitions(stru
+@@ -306,6 +306,7 @@ static int parse_redboot_partitions(stru
  
  static const struct of_device_id mtd_parser_redboot_of_match_table[] = {
  	{ .compatible = "redboot-fis" },
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/420-mtd-redboot_space.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/420-mtd-redboot_space.patch
index a3cd4ec..5be2a22 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/420-mtd-redboot_space.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/420-mtd-redboot_space.patch
@@ -11,7 +11,7 @@
 
 --- a/drivers/mtd/parsers/redboot.c
 +++ b/drivers/mtd/parsers/redboot.c
-@@ -279,14 +279,21 @@ static int parse_redboot_partitions(stru
+@@ -280,14 +280,21 @@ static int parse_redboot_partitions(stru
  #endif
  		names += strlen(names)+1;
  
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
index 82c1e26..28901d7 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
@@ -175,7 +175,7 @@
  /*
   *	Allocate a dst for local (unicast / anycast) address.
   */
-@@ -4933,7 +4963,8 @@ static int rtm_to_fib6_config(struct sk_
+@@ -4940,7 +4970,8 @@ static int rtm_to_fib6_config(struct sk_
  	if (rtm->rtm_type == RTN_UNREACHABLE ||
  	    rtm->rtm_type == RTN_BLACKHOLE ||
  	    rtm->rtm_type == RTN_PROHIBIT ||
@@ -185,7 +185,7 @@
  		cfg->fc_flags |= RTF_REJECT;
  
  	if (rtm->rtm_type == RTN_LOCAL)
-@@ -6084,6 +6115,8 @@ static int ip6_route_dev_notify(struct n
+@@ -6091,6 +6122,8 @@ static int ip6_route_dev_notify(struct n
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  		net->ipv6.ip6_prohibit_entry->dst.dev = dev;
  		net->ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(dev);
@@ -194,7 +194,7 @@
  		net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
  		net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
  #endif
-@@ -6095,6 +6128,7 @@ static int ip6_route_dev_notify(struct n
+@@ -6102,6 +6135,7 @@ static int ip6_route_dev_notify(struct n
  		in6_dev_put_clear(&net->ipv6.ip6_null_entry->rt6i_idev);
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  		in6_dev_put_clear(&net->ipv6.ip6_prohibit_entry->rt6i_idev);
@@ -202,7 +202,7 @@
  		in6_dev_put_clear(&net->ipv6.ip6_blk_hole_entry->rt6i_idev);
  #endif
  	}
-@@ -6287,6 +6321,8 @@ static int __net_init ip6_route_net_init
+@@ -6294,6 +6328,8 @@ static int __net_init ip6_route_net_init
  
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  	net->ipv6.fib6_has_custom_rules = false;
@@ -211,7 +211,7 @@
  	net->ipv6.ip6_prohibit_entry = kmemdup(&ip6_prohibit_entry_template,
  					       sizeof(*net->ipv6.ip6_prohibit_entry),
  					       GFP_KERNEL);
-@@ -6297,11 +6333,21 @@ static int __net_init ip6_route_net_init
+@@ -6304,11 +6340,21 @@ static int __net_init ip6_route_net_init
  			 ip6_template_metrics, true);
  	INIT_LIST_HEAD(&net->ipv6.ip6_prohibit_entry->rt6i_uncached);
  
@@ -234,7 +234,7 @@
  	net->ipv6.ip6_blk_hole_entry->dst.ops = &net->ipv6.ip6_dst_ops;
  	dst_init_metrics(&net->ipv6.ip6_blk_hole_entry->dst,
  			 ip6_template_metrics, true);
-@@ -6325,6 +6371,8 @@ out:
+@@ -6332,6 +6378,8 @@ out:
  	return ret;
  
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
@@ -243,7 +243,7 @@
  out_ip6_prohibit_entry:
  	kfree(net->ipv6.ip6_prohibit_entry);
  out_ip6_null_entry:
-@@ -6344,6 +6392,7 @@ static void __net_exit ip6_route_net_exi
+@@ -6351,6 +6399,7 @@ static void __net_exit ip6_route_net_exi
  	kfree(net->ipv6.ip6_null_entry);
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  	kfree(net->ipv6.ip6_prohibit_entry);
@@ -251,7 +251,7 @@
  	kfree(net->ipv6.ip6_blk_hole_entry);
  #endif
  	dst_entries_destroy(&net->ipv6.ip6_dst_ops);
-@@ -6421,6 +6470,9 @@ void __init ip6_route_init_special_entri
+@@ -6428,6 +6477,9 @@ void __init ip6_route_init_special_entri
  	init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
  	init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
  	init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/811-pci_disable_usb_common_quirks.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/811-pci_disable_usb_common_quirks.patch
index 86f8a41..d70ac55 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/811-pci_disable_usb_common_quirks.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/811-pci_disable_usb_common_quirks.patch
@@ -98,7 +98,7 @@
  #endif  /*  __LINUX_USB_PCI_QUIRKS_H  */
 --- a/include/linux/usb/hcd.h
 +++ b/include/linux/usb/hcd.h
-@@ -485,7 +485,14 @@ extern int usb_hcd_pci_probe(struct pci_
+@@ -486,7 +486,14 @@ extern int usb_hcd_pci_probe(struct pci_
  extern void usb_hcd_pci_remove(struct pci_dev *dev);
  extern void usb_hcd_pci_shutdown(struct pci_dev *dev);
  
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/mt7986.cfg b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/mt7986.cfg
index eb9070e..a028c93 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/mt7986.cfg
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/mt7986.cfg
@@ -1,5 +1,6 @@
 CONFIG_64BIT=y
 CONFIG_AHCI_MTK=y
+# CONFIG_AIROHA_EN8801SC_PHY is not set
 CONFIG_AIROHA_EN8801S_PHY=y
 CONFIG_ARCH_CLOCKSOURCE_DATA=y
 CONFIG_ARCH_DMA_ADDR_T_64BIT=y
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/patches-5.4/0500-v5.6-crypto-backport-inside-secure.patch b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/patches-5.4/0500-v5.6-crypto-backport-inside-secure.patch
index 2fae90e..7cd172b 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/patches-5.4/0500-v5.6-crypto-backport-inside-secure.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/patches-5.4/0500-v5.6-crypto-backport-inside-secure.patch
@@ -590,7 +590,7 @@
  	clk_disable_unprepare(priv->clk);
  
  	for (i = 0; i < priv->config.rings; i++)
-@@ -1666,9 +1795,7 @@ static struct platform_driver  crypto_sa
+@@ -1668,9 +1797,7 @@ static struct platform_driver  crypto_sa
  		.of_match_table = safexcel_of_match_table,
  	},
  };
@@ -600,7 +600,7 @@
  /* PCIE devices - i.e. Inside Secure development boards */
  
  static int safexcel_pci_probe(struct pci_dev *pdev,
-@@ -1759,7 +1886,7 @@ static int safexcel_pci_probe(struct pci
+@@ -1761,7 +1888,7 @@ static int safexcel_pci_probe(struct pci
  	return rc;
  }
  
@@ -609,7 +609,7 @@
  {
  	struct safexcel_crypto_priv *priv = pci_get_drvdata(pdev);
  	int i;
-@@ -1789,54 +1916,32 @@ static struct pci_driver safexcel_pci_dr
+@@ -1791,54 +1918,32 @@ static struct pci_driver safexcel_pci_dr
  	.probe         = safexcel_pci_probe,
  	.remove        = safexcel_pci_remove,
  };
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/patches-5.4/0601-net-dsa-propagate-resolved-link-config-via-mac_link_.patch b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/patches-5.4/0601-net-dsa-propagate-resolved-link-config-via-mac_link_.patch
index 3505231..888d5cb 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/patches-5.4/0601-net-dsa-propagate-resolved-link-config-via-mac_link_.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/patches-5.4/0601-net-dsa-propagate-resolved-link-config-via-mac_link_.patch
@@ -38,7 +38,7 @@
  		     const struct switchdev_obj_port_vlan *vlan);
 --- a/drivers/net/dsa/bcm_sf2.c
 +++ b/drivers/net/dsa/bcm_sf2.c
-@@ -636,7 +636,9 @@ static void bcm_sf2_sw_mac_link_down(str
+@@ -641,7 +641,9 @@ static void bcm_sf2_sw_mac_link_down(str
  static void bcm_sf2_sw_mac_link_up(struct dsa_switch *ds, int port,
  				   unsigned int mode,
  				   phy_interface_t interface,
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/patches-5.4/1021-ubnt-ledbar-driver.patch b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/patches-5.4/1021-ubnt-ledbar-driver.patch
index 41ab094..d1c73d9 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/patches-5.4/1021-ubnt-ledbar-driver.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/patches-5.4/1021-ubnt-ledbar-driver.patch
@@ -1,8 +1,8 @@
 --- a/drivers/leds/Kconfig
 +++ b/drivers/leds/Kconfig
-@@ -824,6 +824,16 @@ config LEDS_LM36274
- 	  Say Y to enable the LM36274 LED driver for TI LMU devices.
- 	  This supports the LED device LM36274.
+@@ -826,6 +826,16 @@ config LEDS_LM36274
+ 
+ source "drivers/leds/blink/Kconfig"
  
 +config LEDS_UBNT_LEDBAR
 +	tristate "LED support for Ubiquiti UniFi 6 LR"
diff --git a/recipes-kernel/linux/linux-mediatek_5.4.bb b/recipes-kernel/linux/linux-mediatek_5.4.bb
index d943866..db34df0 100644
--- a/recipes-kernel/linux/linux-mediatek_5.4.bb
+++ b/recipes-kernel/linux/linux-mediatek_5.4.bb
@@ -7,8 +7,8 @@
 
 KBRANCH ?= "linux-5.4.y"
 
-LINUX_VERSION ?= "5.4.203"
-SRCREV_machine ?= "871cbc208bf0aded1946cd1e3eebec75799d31e8"
+LINUX_VERSION ?= "5.4.211"
+SRCREV_machine ?= "684cc17be897de3b0fd2e5a021a702f68046d9fe"
 KMETA = "kernel-meta"
 SRCREV_meta ?= "feeb59687bc0f054af837a5061f8d413ec7c93e9"
 
diff --git a/recipes-kernel/wireless-regdb/files/patches/999-add-country-vv.patch b/recipes-kernel/wireless-regdb/files/patches/999-add-country-vv.patch
new file mode 100644
index 0000000..cdfef90
--- /dev/null
+++ b/recipes-kernel/wireless-regdb/files/patches/999-add-country-vv.patch
@@ -0,0 +1,18 @@
+diff --git a/db.txt b/db.txt
+index 3e442ba4..75642b04 100644
+--- a/db.txt
++++ b/db.txt
+@@ -1698,3 +1698,13 @@ country ZW: DFS-ETSI
+ 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
+ 	(5490 - 5710 @ 160), (27), DFS
+ 
++country VV:
++	# Channel 1 - 14.
++	(2402 - 2494 @ 40), (30)
++	# Channel 184 - 196
++	(4910 - 4990 @ 80), (30)
++	# Channel 36 - 175
++	(5150 - 5875 @ 160), (30)
++	(5030 - 5090 @ 20), (30)
++	# WiFi 6E
++	(5925 - 7125 @ 320), (200 mW), NO-OUTDOOR
diff --git a/recipes-kernel/wireless-regdb/files/patches/patches.inc b/recipes-kernel/wireless-regdb/files/patches/patches.inc
index 5e2fb3a..e79ef32 100644
--- a/recipes-kernel/wireless-regdb/files/patches/patches.inc
+++ b/recipes-kernel/wireless-regdb/files/patches/patches.inc
@@ -2,4 +2,5 @@
 SRC_URI_append = " \
     file://500-world-regd-5GHz.patch \
     file://600-world-regd-6GHz.patch \
+    file://999-add-country-vv.patch \
     "