Merge "[Refactor and sync wifi from Openwrt]"
diff --git a/recipes-connectivity/hostapd/files/patches/812-DFS-Rdd0-fail-to-rollback-non-DFS-channel-when-DFS-channels-under-NOP.patch b/recipes-connectivity/hostapd/files/patches/812-DFS-Rdd0-fail-to-rollback-non-DFS-channel-when-DFS-channels-under-NOP.patch
deleted file mode 100644
index 68935df..0000000
--- a/recipes-connectivity/hostapd/files/patches/812-DFS-Rdd0-fail-to-rollback-non-DFS-channel-when-DFS-channels-under-NOP.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-diff --git a/src/ap/dfs.c b/src/ap/dfs.c
-index 55b7188..6af0ef2 100644
---- a/src/ap/dfs.c
-+++ b/src/ap/dfs.c
-@@ -1048,7 +1048,7 @@ static int hostapd_dfs_request_channel_switch(struct hostapd_iface *iface,
- }
- 
- 
--static void hostpad_dfs_update_background_chain(struct hostapd_iface *iface)
-+static int hostpad_dfs_update_background_chain(struct hostapd_iface *iface)
- {
- 	int sec = 0;
- 	enum dfs_channel_type channel_type = DFS_NO_CAC_YET;
-@@ -1084,7 +1084,7 @@ static void hostpad_dfs_update_background_chain(struct hostapd_iface *iface)
- 				  oper_centr_freq_seg1_idx, true)) {
- 		wpa_printf(MSG_ERROR, "DFS failed to start CAC offchannel");
- 		iface->radar_background.channel = -1;
--		return;
-+		return -1;
- 	}
- 
- 	iface->radar_background.channel = channel->chan;
-@@ -1096,6 +1096,8 @@ static void hostpad_dfs_update_background_chain(struct hostapd_iface *iface)
- 	wpa_printf(MSG_ERROR,
- 		   "%s: setting background chain to chan %d (%d MHz)",
- 		   __func__, channel->chan, channel->freq);
-+
-+	return 0;
- }
- 
- 
-@@ -1320,8 +1322,7 @@ hostapd_dfs_background_start_channel_switch(struct hostapd_iface *iface,
- 		 * Just select a new random channel according to the
- 		 * regulations for monitoring.
- 		 */
--		hostpad_dfs_update_background_chain(iface);
--		return 0;
-+		return hostpad_dfs_update_background_chain(iface);
- 	}
- 
- 	/*
--- 
-2.29.2
-
diff --git a/recipes-connectivity/hostapd/files/patches/915-Support-new-hostapd-configuration-edcca_enable-and-e.patch b/recipes-connectivity/hostapd/files/patches/915-Support-new-hostapd-configuration-edcca_enable-and-e.patch
index 36092dd..fbf45a4 100644
--- a/recipes-connectivity/hostapd/files/patches/915-Support-new-hostapd-configuration-edcca_enable-and-e.patch
+++ b/recipes-connectivity/hostapd/files/patches/915-Support-new-hostapd-configuration-edcca_enable-and-e.patch
@@ -170,9 +170,9 @@
 +	int ret;
 +
 +	if (!drv->mtk_edcca_vendor_cmd_avail) {
-+		wpa_printf(MSG_ERROR,
++		wpa_printf(MSG_INFO,
 +			   "nl80211: Driver does not support setting EDCCA threshold");
-+		return -1;
++		return 0;
 +	}
 +
 +	if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
diff --git a/recipes-connectivity/hostapd/files/patches/patches.inc b/recipes-connectivity/hostapd/files/patches/patches.inc
index 1cb4185..043a81f 100644
--- a/recipes-connectivity/hostapd/files/patches/patches.inc
+++ b/recipes-connectivity/hostapd/files/patches/patches.inc
@@ -50,7 +50,6 @@
     file://740-snoop_iface.patch \
     file://750-qos_map_set_without_interworking.patch \
     file://751-qos_map_ignore_when_unsupported.patch \
-    file://812-DFS-Rdd0-fail-to-rollback-non-DFS-channel-when-DFS-channels-under-NOP.patch \
     file://902-master-Add-hostapd_neighbor_count-and-hostapd_neighbor_inse.patch \
     file://903-master-Support-including-neighbor-report-elements-in-ANQP-r.patch \
     file://904-master-Support-including-neignbor-report-elements-in-BTM-re.patch \
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/812-DFS-Rdd0-fail-to-rollback-non-DFS-channel-when-DFS-channels-under-NOP.patch b/recipes-connectivity/wpa-supplicant/files/patches/812-DFS-Rdd0-fail-to-rollback-non-DFS-channel-when-DFS-channels-under-NOP.patch
deleted file mode 100644
index 68935df..0000000
--- a/recipes-connectivity/wpa-supplicant/files/patches/812-DFS-Rdd0-fail-to-rollback-non-DFS-channel-when-DFS-channels-under-NOP.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-diff --git a/src/ap/dfs.c b/src/ap/dfs.c
-index 55b7188..6af0ef2 100644
---- a/src/ap/dfs.c
-+++ b/src/ap/dfs.c
-@@ -1048,7 +1048,7 @@ static int hostapd_dfs_request_channel_switch(struct hostapd_iface *iface,
- }
- 
- 
--static void hostpad_dfs_update_background_chain(struct hostapd_iface *iface)
-+static int hostpad_dfs_update_background_chain(struct hostapd_iface *iface)
- {
- 	int sec = 0;
- 	enum dfs_channel_type channel_type = DFS_NO_CAC_YET;
-@@ -1084,7 +1084,7 @@ static void hostpad_dfs_update_background_chain(struct hostapd_iface *iface)
- 				  oper_centr_freq_seg1_idx, true)) {
- 		wpa_printf(MSG_ERROR, "DFS failed to start CAC offchannel");
- 		iface->radar_background.channel = -1;
--		return;
-+		return -1;
- 	}
- 
- 	iface->radar_background.channel = channel->chan;
-@@ -1096,6 +1096,8 @@ static void hostpad_dfs_update_background_chain(struct hostapd_iface *iface)
- 	wpa_printf(MSG_ERROR,
- 		   "%s: setting background chain to chan %d (%d MHz)",
- 		   __func__, channel->chan, channel->freq);
-+
-+	return 0;
- }
- 
- 
-@@ -1320,8 +1322,7 @@ hostapd_dfs_background_start_channel_switch(struct hostapd_iface *iface,
- 		 * Just select a new random channel according to the
- 		 * regulations for monitoring.
- 		 */
--		hostpad_dfs_update_background_chain(iface);
--		return 0;
-+		return hostpad_dfs_update_background_chain(iface);
- 	}
- 
- 	/*
--- 
-2.29.2
-
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/915-Support-new-hostapd-configuration-edcca_enable-and-e.patch b/recipes-connectivity/wpa-supplicant/files/patches/915-Support-new-hostapd-configuration-edcca_enable-and-e.patch
index 36092dd..fbf45a4 100644
--- a/recipes-connectivity/wpa-supplicant/files/patches/915-Support-new-hostapd-configuration-edcca_enable-and-e.patch
+++ b/recipes-connectivity/wpa-supplicant/files/patches/915-Support-new-hostapd-configuration-edcca_enable-and-e.patch
@@ -170,9 +170,9 @@
 +	int ret;
 +
 +	if (!drv->mtk_edcca_vendor_cmd_avail) {
-+		wpa_printf(MSG_ERROR,
++		wpa_printf(MSG_INFO,
 +			   "nl80211: Driver does not support setting EDCCA threshold");
-+		return -1;
++		return 0;
 +	}
 +
 +	if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/patches.inc b/recipes-connectivity/wpa-supplicant/files/patches/patches.inc
index 1cb4185..043a81f 100644
--- a/recipes-connectivity/wpa-supplicant/files/patches/patches.inc
+++ b/recipes-connectivity/wpa-supplicant/files/patches/patches.inc
@@ -50,7 +50,6 @@
     file://740-snoop_iface.patch \
     file://750-qos_map_set_without_interworking.patch \
     file://751-qos_map_ignore_when_unsupported.patch \
-    file://812-DFS-Rdd0-fail-to-rollback-non-DFS-channel-when-DFS-channels-under-NOP.patch \
     file://902-master-Add-hostapd_neighbor_count-and-hostapd_neighbor_inse.patch \
     file://903-master-Support-including-neighbor-report-elements-in-ANQP-r.patch \
     file://904-master-Support-including-neignbor-report-elements-in-BTM-re.patch \
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/339-mac80211-exclude-multicast-packets-from-AQL-pending-.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/339-mac80211-exclude-multicast-packets-from-AQL-pending-.patch
new file mode 100644
index 0000000..43c3e75
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/339-mac80211-exclude-multicast-packets-from-AQL-pending-.patch
@@ -0,0 +1,30 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 13 Jul 2022 07:32:26 +0200
+Subject: [PATCH] mac80211: exclude multicast packets from AQL pending airtime
+
+In AP mode, multicast traffic is handled very differently from normal traffic,
+especially if at least one client is in powersave mode.
+This means that multicast packets can be buffered a lot longer than normal
+unicast packets, and can eat up the AQL budget very quickly because of the low
+data rate.
+Along with the recent change to maintain a global PHY AQL limit, this can lead
+to significant latency spikes for unicast traffic.
+
+Since queueing multicast to hardware is currently not constrained by AQL limits
+anyway, let's just exclude it from the AQL pending airtime calculation entirely.
+
+Fixes: 8e4bac067105 ("wifi: mac80211: add a per-PHY AQL limit to improve fairness")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3792,7 +3792,7 @@ begin:
+ encap_out:
+ 	IEEE80211_SKB_CB(skb)->control.vif = vif;
+ 
+-	if (vif &&
++	if (tx.sta &&
+ 	    wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL)) {
+ 		bool ampdu = txq->ac != IEEE80211_AC_VO;
+ 		u32 airtime;
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/subsys.inc b/recipes-kernel/linux-mac80211/files/patches/subsys/subsys.inc
index da37b05..6c6692d 100644
--- a/recipes-kernel/linux-mac80211/files/patches/subsys/subsys.inc
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/subsys.inc
@@ -36,6 +36,7 @@
     file://336-mac80211-only-accumulate-airtime-deficit-for-active-.patch \
     file://337-mac80211-increase-quantum-for-airtime-scheduler.patch \
     file://338-mac80211-fix-queue-selection-for-mesh-OCB-interfaces.patch \
+    file://339-mac80211-exclude-multicast-packets-from-AQL-pending-.patch \
     file://350-bss-color-collision.patch \
     file://400-allow-ibss-mixed.patch \
     file://500-mac80211_configure_antenna_gain.patch \
diff --git a/recipes-kernel/linux-mt76/files/patches/0012-mt76-mt7915-add-spatial-extension-index-support.patch b/recipes-kernel/linux-mt76/files/patches/0012-mt76-mt7915-add-spatial-extension-index-support.patch
new file mode 100644
index 0000000..45bdef4
--- /dev/null
+++ b/recipes-kernel/linux-mt76/files/patches/0012-mt76-mt7915-add-spatial-extension-index-support.patch
@@ -0,0 +1,202 @@
+From ab47a5638c81b4e79bce84ea0c67cf5e89820e3b Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Wed, 13 Jul 2022 10:43:16 +0800
+Subject: [PATCH] mt76: mt7915: add spatial extension index support
+
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ .../net/wireless/mediatek/mt76/mt76_connac.h  | 11 ++++++++
+ .../wireless/mediatek/mt76/mt76_connac_mac.c  | 11 +++++---
+ .../wireless/mediatek/mt76/mt76_connac_mcu.h  |  2 +-
+ .../net/wireless/mediatek/mt76/mt7915/main.c  |  3 ---
+ .../net/wireless/mediatek/mt76/mt7915/mcu.c   | 26 +++++++++++++++++--
+ .../net/wireless/mediatek/mt76/mt7915/mcu.h   |  1 +
+ .../wireless/mediatek/mt76/mt7915/testmode.c  |  9 +++----
+ 7 files changed, 48 insertions(+), 15 deletions(-)
+
+diff --git a/mt76_connac.h b/mt76_connac.h
+index 9070162c..5a9c1c97 100644
+--- a/mt76_connac.h
++++ b/mt76_connac.h
+@@ -255,6 +255,17 @@ mt76_connac_txwi_to_txp(struct mt76_dev *dev, struct mt76_txwi_cache *t)
+ 	return (void *)(txwi + MT_TXD_SIZE);
+ }
+ 
++static inline u8 mt76_connac_spe_idx(u8 antenna_mask)
++{
++	static const u8 ant_to_spe[] = {0, 0, 1, 0, 3, 2, 4, 0,
++					9, 8, 6, 10, 16, 12, 18, 0};
++
++	if (antenna_mask >= sizeof(ant_to_spe))
++		return 0;
++
++	return ant_to_spe[antenna_mask];
++}
++
+ int mt76_connac_pm_wake(struct mt76_phy *phy, struct mt76_connac_pm *pm);
+ void mt76_connac_power_save_sched(struct mt76_phy *phy,
+ 				  struct mt76_connac_pm *pm);
+diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
+index d83ed593..33abe5d6 100644
+--- a/mt76_connac_mac.c
++++ b/mt76_connac_mac.c
+@@ -402,9 +402,6 @@ mt76_connac2_mac_write_txwi_80211(struct mt76_dev *dev, __le32 *txwi,
+ 	if (ieee80211_is_beacon(fc)) {
+ 		txwi[3] &= ~cpu_to_le32(MT_TXD3_SW_POWER_MGMT);
+ 		txwi[3] |= cpu_to_le32(MT_TXD3_REM_TX_COUNT);
+-		if (!is_mt7921(dev))
+-			txwi[7] |= cpu_to_le32(FIELD_PREP(MT_TXD7_SPE_IDX,
+-							  0x18));
+ 	}
+ 
+ 	if (info->flags & IEEE80211_TX_CTL_INJECTED) {
+@@ -531,6 +528,14 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
+ 		val |= FIELD_PREP(MT_TXD6_TX_RATE, rate);
+ 		txwi[6] |= cpu_to_le32(val);
+ 		txwi[3] |= cpu_to_le32(MT_TXD3_BA_DISABLE);
++
++		if (!is_mt7921(dev)) {
++			u8 spe_idx = mt76_connac_spe_idx(mphy->antenna_mask);
++
++			if (!spe_idx)
++				spe_idx = 24 + ext_phy;
++			txwi[7] |= cpu_to_le32(FIELD_PREP(MT_TXD7_SPE_IDX, spe_idx));
++		}
+ 	}
+ }
+ EXPORT_SYMBOL_GPL(mt76_connac2_mac_write_txwi);
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index e94d6706..17e5213c 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -572,7 +572,7 @@ struct sta_rec_ra_fixed {
+ 
+ 	struct sta_phy phy;
+ 
+-	u8 spe_en;
++	u8 spe_idx;
+ 	u8 short_preamble;
+ 	u8 is_5g;
+ 	u8 mmps_mode;
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 39587992..080e935c 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -957,9 +957,6 @@ mt7915_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
+ 	if (!tx_ant || tx_ant != rx_ant || ffs(tx_ant) > max_nss)
+ 		return -EINVAL;
+ 
+-	if ((BIT(hweight8(tx_ant)) - 1) != tx_ant)
+-		tx_ant = BIT(ffs(tx_ant) - 1) - 1;
+-
+ 	mutex_lock(&dev->mt76.mutex);
+ 
+ 	phy->mt76->antenna_mask = tx_ant;
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 6587be2f..03a3c252 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -1306,6 +1306,9 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+ 	case RATE_PARAM_MMPS_UPDATE:
+ 		ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->smps_mode);
+ 		break;
++	case RATE_PARAM_SPE_UPDATE:
++		ra->spe_idx = *(u8 *)data;
++		break;
+ 	default:
+ 		break;
+ 	}
+@@ -1348,6 +1351,22 @@ int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+ 					      RATE_PARAM_MMPS_UPDATE);
+ }
+ 
++static int
++mt7915_mcu_set_spe_idx(struct mt7915_dev *dev, struct ieee80211_vif *vif,
++		       struct ieee80211_sta *sta, bool fixed_rate)
++{
++	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
++	struct mt76_phy *mphy = mvif->phy->mt76;
++	u8 spe_idx = mt76_connac_spe_idx(mphy->antenna_mask);
++
++	if (!spe_idx && !fixed_rate &&
++	    mphy->antenna_mask == mphy->hw->wiphy->available_antennas_tx)
++		spe_idx = 24 + mvif->mt76.band_idx;
++
++	return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &spe_idx,
++					      RATE_PARAM_SPE_UPDATE);
++}
++
+ static int
+ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+ 			       struct ieee80211_vif *vif,
+@@ -1393,7 +1412,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+ 	    mask->control[band].he_gi == GENMASK(7, 0) &&
+ 	    mask->control[band].he_ltf == GENMASK(7, 0) &&
+ 	    nrates != 1)
+-		return 0;
++		return mt7915_mcu_set_spe_idx(dev, vif, sta, false);
+ 
+ 	/* fixed single rate */
+ 	if (nrates == 1) {
+@@ -1433,7 +1452,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+ 			return ret;
+ 	}
+ 
+-	return 0;
++	return mt7915_mcu_set_spe_idx(dev, vif, sta, true);
+ }
+ 
+ static void
+@@ -2649,6 +2668,9 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
+ 	}
+ #endif
+ 
++	if (mt76_connac_spe_idx(phy->mt76->antenna_mask))
++		req.tx_streams_num = fls(phy->mt76->antenna_mask);
++
+ 	if (cmd == MCU_EXT_CMD(SET_RX_PATH) ||
+ 	    dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
+ 		req.switch_reason = CH_SWITCH_NORMAL;
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index 110e4f36..ed949802 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -395,6 +395,7 @@ enum {
+ 	RATE_PARAM_FIXED_MCS,
+ 	RATE_PARAM_FIXED_GI = 11,
+ 	RATE_PARAM_AUTO = 20,
++	RATE_PARAM_SPE_UPDATE = 22,
+ };
+ 
+ #define RATE_CFG_MCS			GENMASK(3, 0)
+diff --git a/mt7915/testmode.c b/mt7915/testmode.c
+index 123ceaf9..b2eee3f2 100644
+--- a/mt7915/testmode.c
++++ b/mt7915/testmode.c
+@@ -473,8 +473,6 @@ mt7915_tm_update_channel(struct mt7915_phy *phy)
+ static void
+ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+ {
+-	static const u8 spe_idx_map[] = {0, 0, 1, 0, 3, 2, 4, 0,
+-					 9, 8, 6, 10, 16, 12, 18, 0};
+ 	struct mt76_testmode_data *td = &phy->mt76->test;
+ 	struct mt7915_dev *dev = phy->dev;
+ 	struct ieee80211_tx_info *info;
+@@ -488,11 +486,10 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+ 	if (en) {
+ 		mt7915_tm_update_channel(phy);
+ 
+-		if (td->tx_spe_idx) {
++		if (td->tx_spe_idx)
+ 			phy->test.spe_idx = td->tx_spe_idx;
+-		} else {
+-			phy->test.spe_idx = spe_idx_map[td->tx_antenna_mask];
+-		}
++		else
++			phy->test.spe_idx = mt76_connac_spe_idx(td->tx_antenna_mask);
+ 	}
+ 
+ 	mt7915_tm_set_tam_arb(phy, en,
+-- 
+2.25.1
+
diff --git a/recipes-kernel/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch b/recipes-kernel/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
index 5fe3710..7f9e16e 100644
--- a/recipes-kernel/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
@@ -1,29 +1,28 @@
-From 4c1658312392db894fd36bbdc98476d6e6b1e32f Mon Sep 17 00:00:00 2001
+From c81efc602c7c074f20f3a463b851f85eb30082e2 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 22 Jun 2022 10:39:47 +0800
 Subject: [PATCH 1001/1008] mt76: mt7915: add mtk internal debug tools for mt76
 
 ---
- mt76_connac_mcu.h     |    6 +
- mt7915/Makefile       |    2 +-
- mt7915/debugfs.c      |   73 +-
- mt7915/mac.c          |   14 +
- mt7915/main.c         |    4 +
- mt7915/mcu.c          |   44 +
- mt7915/mcu.h          |    4 +
- mt7915/mt7915.h       |   43 +
- mt7915/mt7915_debug.h | 1350 +++++++++++++++++++
- mt7915/mtk_debugfs.c  | 2923 +++++++++++++++++++++++++++++++++++++++++
- mt7915/mtk_mcu.c      |   51 +
- tools/fwlog.c         |   44 +-
+ .../wireless/mediatek/mt76/mt76_connac_mcu.h  |    6 +
+ .../wireless/mediatek/mt76/mt7915/Makefile    |    2 +-
+ .../wireless/mediatek/mt76/mt7915/debugfs.c   |   73 +-
+ .../net/wireless/mediatek/mt76/mt7915/mac.c   |   14 +
+ .../net/wireless/mediatek/mt76/mt7915/main.c  |    4 +
+ .../net/wireless/mediatek/mt76/mt7915/mcu.c   |   44 +
+ .../net/wireless/mediatek/mt76/mt7915/mcu.h   |    4 +
+ .../wireless/mediatek/mt76/mt7915/mt7915.h    |   43 +
+ .../mediatek/mt76/mt7915/mt7915_debug.h       | 1350 ++++++++
+ .../mediatek/mt76/mt7915/mtk_debugfs.c        | 2923 +++++++++++++++++
+ .../wireless/mediatek/mt76/mt7915/mtk_mcu.c   |   51 +
+ .../net/wireless/mediatek/mt76/tools/fwlog.c  |   44 +-
  12 files changed, 4545 insertions(+), 13 deletions(-)
- mode change 100644 => 100755 mt7915/mcu.c
- create mode 100644 mt7915/mt7915_debug.h
- create mode 100644 mt7915/mtk_debugfs.c
- create mode 100644 mt7915/mtk_mcu.c
+ create mode 100644 drivers/net/wireless/mediatek/mt76/mt7915/mt7915_debug.h
+ create mode 100644 drivers/net/wireless/mediatek/mt76/mt7915/mtk_debugfs.c
+ create mode 100644 drivers/net/wireless/mediatek/mt76/mt7915/mtk_mcu.c
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index e94d670..333d3a0 100644
+index 17e5213c..c7aeae57 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1119,6 +1119,12 @@ enum {
@@ -40,7 +39,7 @@
  	MCU_EXT_CMD_CAL_CACHE = 0x67,
  	MCU_EXT_CMD_SET_RADAR_TH = 0x7c,
 diff --git a/mt7915/Makefile b/mt7915/Makefile
-index b794ceb..a3474e2 100644
+index b794ceb7..a3474e2f 100644
 --- a/mt7915/Makefile
 +++ b/mt7915/Makefile
 @@ -3,7 +3,7 @@
@@ -54,7 +53,7 @@
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 \ No newline at end of file
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 9f21d97..0cfb606 100644
+index 9f21d978..0cfb6068 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -8,6 +8,9 @@
@@ -198,7 +197,7 @@
  
  	if (dev->relay_fwlog)
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 6a4da8e..c332e0a 100644
+index 13648927..a50c555d 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -239,6 +239,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -223,7 +222,7 @@
  	if (hdr_trans && ieee80211_has_morefrags(fc)) {
  		struct ieee80211_vif *vif;
  		int err;
-@@ -760,6 +768,12 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -762,6 +770,12 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	tx_info->buf[1].skip_unmap = true;
  	tx_info->nbuf = MT_CT_DMA_BUF_NUM;
  
@@ -237,7 +236,7 @@
  }
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 3958799..929c726 100644
+index 080e935c..b63d5e14 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -62,7 +62,11 @@ static int mt7915_start(struct ieee80211_hw *hw)
@@ -253,9 +252,7 @@
  		goto out;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-old mode 100644
-new mode 100755
-index a726021..4ff13c7
+index 03a3c252..0003bbb6 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -195,6 +195,11 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -270,7 +267,7 @@
  	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
  }
  
-@@ -3164,6 +3169,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+@@ -3183,6 +3188,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
  		.sku_enable = enable,
  	};
  
@@ -279,7 +276,7 @@
  	return mt76_mcu_send_msg(&dev->mt76,
  				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
  				 sizeof(req), true);
-@@ -3439,6 +3446,43 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3458,6 +3465,43 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -324,7 +321,7 @@
  {
  	struct {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index b82f258..b2c51bf 100644
+index ed949802..bfb822fa 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -259,6 +259,10 @@ enum {
@@ -339,7 +336,7 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index b6a6aa7..594f2fb 100644
+index db63012e..82781879 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -9,6 +9,7 @@
@@ -380,7 +377,7 @@
  };
  
  enum {
-@@ -592,4 +616,23 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -593,4 +617,23 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			    struct ieee80211_sta *sta, struct dentry *dir);
  #endif
  
@@ -406,7 +403,7 @@
  #endif
 diff --git a/mt7915/mt7915_debug.h b/mt7915/mt7915_debug.h
 new file mode 100644
-index 0000000..58ba2cd
+index 00000000..58ba2cdf
 --- /dev/null
 +++ b/mt7915/mt7915_debug.h
 @@ -0,0 +1,1350 @@
@@ -1762,7 +1759,7 @@
 +#endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
 new file mode 100644
-index 0000000..f18c8b6
+index 00000000..f18c8b6c
 --- /dev/null
 +++ b/mt7915/mtk_debugfs.c
 @@ -0,0 +1,2923 @@
@@ -4691,7 +4688,7 @@
 +#endif
 diff --git a/mt7915/mtk_mcu.c b/mt7915/mtk_mcu.c
 new file mode 100644
-index 0000000..145fe78
+index 00000000..145fe785
 --- /dev/null
 +++ b/mt7915/mtk_mcu.c
 @@ -0,0 +1,51 @@
@@ -4747,7 +4744,7 @@
 +				 sizeof(req), true);
 +}
 diff --git a/tools/fwlog.c b/tools/fwlog.c
-index e5d4a10..3d51d9e 100644
+index e5d4a105..3d51d9ec 100644
 --- a/tools/fwlog.c
 +++ b/tools/fwlog.c
 @@ -26,7 +26,7 @@ static const char *debugfs_path(const char *phyname, const char *file)
@@ -4861,5 +4858,5 @@
  	return ret;
  }
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch b/recipes-kernel/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
index 0f2ca39..82908c6 100644
--- a/recipes-kernel/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
@@ -1,24 +1,23 @@
-From c2e0f6df51b9b2e681285523b1c4471c7f613c83 Mon Sep 17 00:00:00 2001
+From b4f1309073f6578374e30f4578a8c7e982e45e19 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Jun 2022 20:13:02 +0800
 Subject: [PATCH 1002/1008] mt76: mt7915: csi: implement csi support
 
 ---
- mt76_connac_mcu.h |   2 +
- mt7915/Makefile   |   4 +-
- mt7915/init.c     |  39 ++++
- mt7915/mcu.c      | 111 ++++++++++++
- mt7915/mcu.h      |  76 ++++++++
- mt7915/mt7915.h   |  20 ++
- mt7915/vendor.c   | 452 ++++++++++++++++++++++++++++++++++++++++++++++
- mt7915/vendor.h   |  60 ++++++
+ .../wireless/mediatek/mt76/mt76_connac_mcu.h  |   2 +
+ .../wireless/mediatek/mt76/mt7915/Makefile    |   4 +-
+ .../net/wireless/mediatek/mt76/mt7915/init.c  |  39 ++
+ .../net/wireless/mediatek/mt76/mt7915/mcu.c   | 111 +++++
+ .../net/wireless/mediatek/mt76/mt7915/mcu.h   |  76 +++
+ .../wireless/mediatek/mt76/mt7915/mt7915.h    |  20 +
+ .../wireless/mediatek/mt76/mt7915/vendor.c    | 452 ++++++++++++++++++
+ .../wireless/mediatek/mt76/mt7915/vendor.h    |  60 +++
  8 files changed, 762 insertions(+), 2 deletions(-)
- mode change 100755 => 100644 mt7915/mcu.c
- create mode 100644 mt7915/vendor.c
- create mode 100644 mt7915/vendor.h
+ create mode 100644 drivers/net/wireless/mediatek/mt76/mt7915/vendor.c
+ create mode 100644 drivers/net/wireless/mediatek/mt76/mt7915/vendor.h
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 333d3a0..b25807a 100644
+index c7aeae57..ede59231 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -971,6 +971,7 @@ enum {
@@ -38,7 +37,7 @@
  
  enum {
 diff --git a/mt7915/Makefile b/mt7915/Makefile
-index a3474e2..e272c82 100644
+index a3474e2f..e272c826 100644
 --- a/mt7915/Makefile
 +++ b/mt7915/Makefile
 @@ -1,9 +1,9 @@
@@ -55,7 +54,7 @@
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 \ No newline at end of file
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 8554c9d..fa9568c 100644
+index 8554c9dc..fa9568ca 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -542,6 +542,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
@@ -133,9 +132,7 @@
  	if (IS_ENABLED(CONFIG_MT76_LEDS)) {
  		dev->mt76.led_cdev.brightness_set = mt7915_led_set_brightness;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-old mode 100755
-new mode 100644
-index 4ff13c7..0941bf3
+index 0003bbb6..be1dd6b9 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -32,6 +32,10 @@
@@ -161,7 +158,7 @@
  	case MCU_EXT_EVENT_BCC_NOTIFY:
  		mt7915_mcu_rx_bcc_notify(dev, skb);
  		break;
-@@ -3446,6 +3455,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3465,6 +3474,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -271,10 +268,10 @@
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index b2c51bf..ec8887b 100644
+index bfb822fa..a27129c2 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -476,4 +476,80 @@ enum {
+@@ -480,4 +480,80 @@ enum {
  					 sizeof(struct bss_info_bcn_cont) + \
  					 sizeof(struct bss_info_inband_discovery))
  
@@ -356,7 +353,7 @@
 +
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 594f2fb..5a6224b 100644
+index 82781879..33d14d6d 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -276,6 +276,20 @@ struct mt7915_phy {
@@ -380,7 +377,7 @@
  };
  
  struct mt7915_dev {
-@@ -616,6 +630,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -617,6 +631,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			    struct ieee80211_sta *sta, struct dentry *dir);
  #endif
  
@@ -395,7 +392,7 @@
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
 new file mode 100644
-index 0000000..98fd9c2
+index 00000000..98fd9c2d
 --- /dev/null
 +++ b/mt7915/vendor.c
 @@ -0,0 +1,452 @@
@@ -853,7 +850,7 @@
 +}
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
 new file mode 100644
-index 0000000..9d3db2a
+index 00000000..9d3db2a7
 --- /dev/null
 +++ b/mt7915/vendor.h
 @@ -0,0 +1,60 @@
@@ -918,5 +915,5 @@
 +
 +#endif
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch b/recipes-kernel/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
index bff59ad..86cea4b 100644
--- a/recipes-kernel/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
@@ -1,19 +1,19 @@
-From f6e5e119c427050f926fd42c1bc271f53dc8cafb Mon Sep 17 00:00:00 2001
+From 4c0c9fa9de451d898a5118009065d3c4ff38eba5 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Tue, 11 Jan 2022 12:03:23 +0800
 Subject: [PATCH 1003/1008] mt76: mt7915: air monitor support
 
 ---
- mt76_connac_mcu.h |   2 +
- mt7915/mac.c      |   4 +
- mt7915/main.c     |   3 +
- mt7915/mt7915.h   |  34 +++++
- mt7915/vendor.c   | 359 ++++++++++++++++++++++++++++++++++++++++++++++
- mt7915/vendor.h   |  38 +++++
+ .../wireless/mediatek/mt76/mt76_connac_mcu.h  |   2 +
+ .../net/wireless/mediatek/mt76/mt7915/mac.c   |   4 +
+ .../net/wireless/mediatek/mt76/mt7915/main.c  |   3 +
+ .../wireless/mediatek/mt76/mt7915/mt7915.h    |  34 ++
+ .../wireless/mediatek/mt76/mt7915/vendor.c    | 359 ++++++++++++++++++
+ .../wireless/mediatek/mt76/mt7915/vendor.h    |  38 ++
  6 files changed, 440 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index b25807a..42425f7 100644
+index ede59231..865bbf3d 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1142,6 +1142,8 @@ enum {
@@ -26,7 +26,7 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index c332e0a..69c226f 100644
+index a50c555d..8aa5350a 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -486,6 +486,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -41,7 +41,7 @@
  		status->flag |= RX_FLAG_8023;
  	}
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 929c726..e461e0f 100644
+index b63d5e14..cd7314c9 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -675,6 +675,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -55,7 +55,7 @@
  }
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 5a6224b..d702532 100644
+index 33d14d6d..2af06d35 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -231,6 +231,35 @@ struct mt7915_hif {
@@ -103,7 +103,7 @@
  #endif
  };
  
-@@ -634,6 +665,9 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -635,6 +666,9 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
@@ -114,7 +114,7 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 98fd9c2..b94d787 100644
+index 98fd9c2d..b94d787e 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -430,6 +430,353 @@ out:
@@ -491,7 +491,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 9d3db2a..976817f 100644
+index 9d3db2a7..976817f3 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -4,6 +4,7 @@
@@ -545,5 +545,5 @@
 +
  #endif
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch b/recipes-kernel/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
index 44f9801..6143c06 100644
--- a/recipes-kernel/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
@@ -1,18 +1,18 @@
-From 7bcfae1d261805e54b6e27091dffd4706c4dc046 Mon Sep 17 00:00:00 2001
+From b57983fb1ed631af2b6230aaf010826cd05c9ddf Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:45:53 +0800
 Subject: [PATCH 1004/1008] mt76: mt7915: add support for muru_onoff via
  debugfs
 
 ---
- mt7915/init.c        |  1 +
- mt7915/mcu.c         |  9 +++++++--
- mt7915/mcu.h         |  6 ++++++
- mt7915/mtk_debugfs.c | 33 +++++++++++++++++++++++++++++++++
+ .../net/wireless/mediatek/mt76/mt7915/init.c  |  1 +
+ .../net/wireless/mediatek/mt76/mt7915/mcu.c   |  9 +++--
+ .../net/wireless/mediatek/mt76/mt7915/mcu.h   |  6 ++++
+ .../mediatek/mt76/mt7915/mtk_debugfs.c        | 33 +++++++++++++++++++
  4 files changed, 47 insertions(+), 2 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index fa9568c..6e2a1c1 100644
+index fa9568ca..6e2a1c13 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -577,6 +577,7 @@ static void mt7915_init_work(struct work_struct *work)
@@ -24,7 +24,7 @@
  
  void mt7915_wfsys_reset(struct mt7915_dev *dev)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 0941bf3..34cf3e6 100644
+index be1dd6b9..a6b5d213 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -856,13 +856,18 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
@@ -49,10 +49,10 @@
  		muru->mimo_dl.vht_mu_bfee =
  			!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index ec8887b..07c1f2b 100644
+index a27129c2..d3cc8283 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -552,4 +552,10 @@ struct csi_data {
+@@ -556,4 +556,10 @@ struct csi_data {
  };
  #endif
  
@@ -64,7 +64,7 @@
 +
  #endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index f18c8b6..e239df9 100644
+index f18c8b6c..e239df95 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2480,6 +2480,38 @@ static int mt7915_token_txd_read(struct seq_file *s, void *data)
@@ -115,5 +115,5 @@
  			    &fops_fw_debug_module);
  	debugfs_create_file("fw_debug_level", 0600, dir, dev,
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1005-mt76-certification-patches.patch b/recipes-kernel/linux-mt76/files/patches/1005-mt76-certification-patches.patch
index e73014d..64bc9e5 100644
--- a/recipes-kernel/linux-mt76/files/patches/1005-mt76-certification-patches.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1005-mt76-certification-patches.patch
@@ -1,23 +1,23 @@
-From a050a241c404f9a56ff84a972b80f744750731ca Mon Sep 17 00:00:00 2001
+From 851129617f31e9c802b01eab480f9f8041cfde4f Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 6 Jun 2022 20:15:51 +0800
 Subject: [PATCH 1005/1008] mt76: certification patches
 
 ---
- mt76_connac_mcu.h    |   1 +
- mt7915/init.c        |   7 +-
- mt7915/mac.c         |  23 +++
- mt7915/main.c        |  15 +-
- mt7915/mcu.c         | 466 +++++++++++++++++++++++++++++++++++++++++++
- mt7915/mcu.h         | 207 ++++++++++++++++++-
- mt7915/mt7915.h      |  13 ++
- mt7915/mtk_debugfs.c |   7 +-
- mt7915/vendor.c      | 187 +++++++++++++++++
- mt7915/vendor.h      |  42 ++++
+ .../wireless/mediatek/mt76/mt76_connac_mcu.h  |   1 +
+ .../net/wireless/mediatek/mt76/mt7915/init.c  |   7 +-
+ .../net/wireless/mediatek/mt76/mt7915/mac.c   |  23 +
+ .../net/wireless/mediatek/mt76/mt7915/main.c  |  15 +-
+ .../net/wireless/mediatek/mt76/mt7915/mcu.c   | 466 ++++++++++++++++++
+ .../net/wireless/mediatek/mt76/mt7915/mcu.h   | 207 +++++++-
+ .../wireless/mediatek/mt76/mt7915/mt7915.h    |  13 +
+ .../mediatek/mt76/mt7915/mtk_debugfs.c        |   7 +-
+ .../wireless/mediatek/mt76/mt7915/vendor.c    | 187 +++++++
+ .../wireless/mediatek/mt76/mt7915/vendor.h    |  42 ++
  10 files changed, 962 insertions(+), 6 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 42425f7..32e540c 100644
+index 865bbf3d..25aeedc2 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1144,6 +1144,7 @@ enum {
@@ -29,7 +29,7 @@
  };
  
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 6e2a1c1..02d1b6d 100644
+index 6e2a1c13..02d1b6d8 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -372,12 +372,17 @@ mt7915_init_wiphy(struct ieee80211_hw *hw)
@@ -52,7 +52,7 @@
  			IEEE80211_HT_CAP_LDPC_CODING |
  			IEEE80211_HT_CAP_MAX_AMSDU;
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 69c226f..9058c75 100644
+index 8aa5350a..24052f47 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -7,6 +7,7 @@
@@ -63,7 +63,7 @@
  
  #define to_rssi(field, rxv)	((FIELD_GET(field, rxv) - 220) / 2)
  
-@@ -1734,6 +1735,21 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
+@@ -1736,6 +1737,21 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
  	phy->trb_ts = trb;
  }
  
@@ -85,7 +85,7 @@
  void mt7915_mac_sta_rc_work(struct work_struct *work)
  {
  	struct mt7915_dev *dev = container_of(work, struct mt7915_dev, rc_work);
-@@ -1756,6 +1772,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
+@@ -1758,6 +1774,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
  		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
  		vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
  
@@ -100,7 +100,7 @@
  			       IEEE80211_RC_NSS_CHANGED |
  			       IEEE80211_RC_BW_CHANGED))
 diff --git a/mt7915/main.c b/mt7915/main.c
-index e461e0f..c2304db 100644
+index cd7314c9..d5fb947a 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -653,6 +653,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -133,10 +133,10 @@
  
  void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 34cf3e6..759d615 100644
+index a6b5d213..53d4cd44 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3560,6 +3560,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -3579,6 +3579,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
  
  	return 0;
  }
@@ -610,10 +610,10 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 07c1f2b..7b1a521 100644
+index d3cc8283..aab1a6a3 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -396,9 +396,13 @@ enum {
+@@ -396,10 +396,14 @@ enum {
  	RATE_PARAM_FIXED = 3,
  	RATE_PARAM_MMPS_UPDATE = 5,
  	RATE_PARAM_FIXED_HE_LTF = 7,
@@ -621,6 +621,7 @@
 +	RATE_PARAM_FIXED_MCS = 8,
  	RATE_PARAM_FIXED_GI = 11,
  	RATE_PARAM_AUTO = 20,
+ 	RATE_PARAM_SPE_UPDATE = 22,
 +#ifdef CONFIG_MTK_VENDOR
 +	RATE_PARAM_FIXED_MIMO = 30,
 +	RATE_PARAM_FIXED_OFDMA = 31,
@@ -628,7 +629,7 @@
  };
  
  #define RATE_CFG_MCS			GENMASK(3, 0)
-@@ -410,6 +414,9 @@ enum {
+@@ -411,6 +415,9 @@ enum {
  #define RATE_CFG_PHY_TYPE		GENMASK(27, 24)
  #define RATE_CFG_HE_LTF			GENMASK(31, 28)
  
@@ -638,7 +639,7 @@
  enum {
  	THERMAL_PROTECT_PARAMETER_CTRL,
  	THERMAL_PROTECT_BASIC_INFO,
-@@ -557,5 +564,203 @@ struct csi_data {
+@@ -561,5 +568,203 @@ struct csi_data {
  #define OFDMA_UL                       BIT(1)
  #define MUMIMO_DL                      BIT(2)
  #define MUMIMO_UL                      BIT(3)
@@ -843,10 +844,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index d702532..11e92fe 100644
+index 2af06d35..5aafaac0 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -662,6 +662,19 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -663,6 +663,19 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  #endif
  
  #ifdef CONFIG_MTK_VENDOR
@@ -867,7 +868,7 @@
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index e239df9..222268f 100644
+index e239df95..222268fc 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2486,7 +2486,8 @@ static int mt7915_muru_onoff_get(void *data, u64 *val)
@@ -892,7 +893,7 @@
         }
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index b94d787..7456c57 100644
+index b94d787e..7456c577 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -22,6 +22,29 @@ csi_ctrl_policy[NUM_MTK_VENDOR_ATTRS_CSI_CTRL] = {
@@ -1104,7 +1105,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 976817f..1b08321 100644
+index 976817f3..1b08321c 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -6,6 +6,48 @@
@@ -1157,5 +1158,5 @@
  
  enum mtk_vendor_attr_csi_ctrl {
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch b/recipes-kernel/linux-mt76/files/patches/1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch
index 45c4f47..aed5db0 100644
--- a/recipes-kernel/linux-mt76/files/patches/1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch
@@ -1,24 +1,24 @@
-From e67f8f36aeefd28730ea21dc82b946c7fba4dc09 Mon Sep 17 00:00:00 2001
+From ae9d492fc2d9e15e6625187bc0fcbc154fb58e02 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Wed, 22 Jun 2022 10:51:59 +0800
 Subject: [PATCH 1006/1008] mt76: mt7915: add L0.5 system error recovery
  support
 
 ---
- mt7915/debugfs.c |  88 ++++++++++++---
- mt7915/dma.c     |  48 ++++++++
- mt7915/init.c    |   8 +-
- mt7915/mac.c     | 284 +++++++++++++++++++++++++++++++++++++----------
- mt7915/main.c    |  19 +++-
- mt7915/mcu.c     |  95 ++++++++++++++--
- mt7915/mcu.h     |   3 +-
- mt7915/mmio.c    |   8 +-
- mt7915/mt7915.h  |  23 ++++
- mt7915/regs.h    |  16 +++
+ .../wireless/mediatek/mt76/mt7915/debugfs.c   |  88 ++++--
+ .../net/wireless/mediatek/mt76/mt7915/dma.c   |  48 +++
+ .../net/wireless/mediatek/mt76/mt7915/init.c  |   8 +-
+ .../net/wireless/mediatek/mt76/mt7915/mac.c   | 284 ++++++++++++++----
+ .../net/wireless/mediatek/mt76/mt7915/main.c  |  19 +-
+ .../net/wireless/mediatek/mt76/mt7915/mcu.c   |  95 +++++-
+ .../net/wireless/mediatek/mt76/mt7915/mcu.h   |   3 +-
+ .../net/wireless/mediatek/mt76/mt7915/mmio.c  |   8 +-
+ .../wireless/mediatek/mt76/mt7915/mt7915.h    |  23 ++
+ .../net/wireless/mediatek/mt76/mt7915/regs.h  |  16 +
  10 files changed, 493 insertions(+), 99 deletions(-)
 
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 0cfb606..07de2ee 100644
+index 0cfb6068..07de2eef 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -52,12 +52,17 @@ static ssize_t
@@ -142,7 +142,7 @@
  	kfree(buff);
  	return ret;
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index c2d655c..9e3d14d 100644
+index c2d655cd..9e3d14db 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -486,6 +486,54 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -201,7 +201,7 @@
  {
  	mt7915_dma_disable(dev, true);
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 02d1b6d..0d5109a 100644
+index 02d1b6d8..0d5109a3 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -262,7 +262,7 @@ static void mt7915_led_set_brightness(struct led_classdev *led_cdev,
@@ -241,7 +241,7 @@
  
  unreg_thermal:
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 9058c75..0593270 100644
+index 24052f47..f13456bf 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -3,6 +3,7 @@
@@ -252,7 +252,7 @@
  #include "mt7915.h"
  #include "../dma.h"
  #include "mac.h"
-@@ -1311,85 +1312,188 @@ mt7915_update_beacons(struct mt7915_dev *dev)
+@@ -1313,85 +1314,188 @@ mt7915_update_beacons(struct mt7915_dev *dev)
  		mt7915_update_vif_beacon, dev->mt76.phy2->hw);
  }
  
@@ -501,7 +501,7 @@
  }
  
  /* system error recovery */
-@@ -1404,6 +1508,36 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1406,6 +1510,36 @@ void mt7915_mac_reset_work(struct work_struct *work)
  	ext_phy = dev->mt76.phy2;
  	phy2 = ext_phy ? ext_phy->priv : NULL;
  
@@ -538,7 +538,7 @@
  	if (!(READ_ONCE(dev->reset_state) & MT_MCU_CMD_STOP_DMA))
  		return;
  
-@@ -1429,7 +1563,7 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1431,7 +1565,7 @@ void mt7915_mac_reset_work(struct work_struct *work)
  	mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_DMA_STOPPED);
  
  	if (mt7915_wait_reset_state(dev, MT_MCU_CMD_RESET_DONE)) {
@@ -547,7 +547,7 @@
  
  		mt7915_tx_token_put(dev);
  		idr_init(&dev->mt76.token);
-@@ -1478,6 +1612,34 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1480,6 +1614,34 @@ void mt7915_mac_reset_work(struct work_struct *work)
  					     MT7915_WATCHDOG_TIME);
  }
  
@@ -583,7 +583,7 @@
  {
  	struct mt7915_dev *dev = phy->dev;
 diff --git a/mt7915/main.c b/mt7915/main.c
-index c2304db..dc5e4b0 100644
+index d5fb947a..60d990f3 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -20,17 +20,13 @@ static bool mt7915_dev_running(struct mt7915_dev *dev)
@@ -633,7 +633,7 @@
  	mutex_lock(&dev->mt76.mutex);
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 759d615..65d21ee 100644
+index 53d4cd44..62412c23 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -150,19 +150,90 @@ mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
@@ -727,7 +727,7 @@
  	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
  	if (seq != rxd->seq)
  		return -EAGAIN;
-@@ -2257,18 +2328,10 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
+@@ -2273,18 +2344,10 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
  				 sizeof(req), true);
  }
  
@@ -747,7 +747,7 @@
  	/* force firmware operation mode into normal state,
  	 * which should be set before firmware download stage.
  	 */
-@@ -2317,6 +2380,20 @@ int mt7915_mcu_init(struct mt7915_dev *dev)
+@@ -2333,6 +2396,20 @@ int mt7915_mcu_init(struct mt7915_dev *dev)
  				 MCU_WA_PARAM_RED, 0, 0);
  }
  
@@ -769,10 +769,10 @@
  {
  	__mt76_mcu_restart(&dev->mt76);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 7b1a521..464e771 100644
+index aab1a6a3..c4850644 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -452,8 +452,9 @@ enum {
+@@ -453,8 +453,9 @@ enum {
  
  enum {
  	SER_QUERY,
@@ -784,7 +784,7 @@
  	SER_SET_RECOVER_L3_RX_ABORT,
  	SER_SET_RECOVER_L3_TX_ABORT,
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index a8e3810..bccb108 100644
+index d0e792f8..6e140e2d 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -24,6 +24,7 @@ static const u32 mt7915_reg[] = {
@@ -825,7 +825,7 @@
  	}
  }
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 11e92fe..9f5da64 100644
+index 5aafaac0..07a1c9ce 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -352,6 +352,15 @@ struct mt7915_dev {
@@ -873,7 +873,7 @@
  int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  			       struct mt7915_vif *mvif,
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index c7c9e41..47bae86 100644
+index c7c9e411..47bae86e 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -32,6 +32,7 @@ enum reg_rev {
@@ -928,5 +928,5 @@
  #define MT_LED_TOP_BASE			0x18013000
  #define MT_LED_PHYS(_n)			(MT_LED_TOP_BASE + (_n))
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch b/recipes-kernel/linux-mt76/files/patches/1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
index 6b9eb74..169778d 100644
--- a/recipes-kernel/linux-mt76/files/patches/1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
@@ -1,4 +1,4 @@
-From 274c1a2fe580cc2f1948b7f53df228eee8a20ba3 Mon Sep 17 00:00:00 2001
+From ffcd515b57f44839fc0988a6726c58e0d4e378c9 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Fri, 27 May 2022 15:51:48 +0800
 Subject: [PATCH 1007/1008] mt76: mt7915:add support for runtime set in-band
@@ -6,14 +6,14 @@
 
 Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
 ---
- mt7915/mcu.c | 5 ++---
+ drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 5 ++---
  1 file changed, 2 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 65d21ee..7f2161f 100644
+index 62412c23..224f3ab2 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2006,8 +2006,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+@@ -2024,8 +2024,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
  	u8 *buf, interval;
  	int len;
  
@@ -23,7 +23,7 @@
  		interval = vif->bss_conf.fils_discovery.max_interval;
  		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
  	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
-@@ -2044,7 +2043,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+@@ -2061,7 +2060,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
  	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
  	discov->tx_interval = interval;
  	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
@@ -33,5 +33,5 @@
  	buf = (u8 *)tlv + sizeof(*discov);
  
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch b/recipes-kernel/linux-mt76/files/patches/1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
index 7d7ce6b..e1b7cdb 100644
--- a/recipes-kernel/linux-mt76/files/patches/1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
@@ -1,20 +1,20 @@
-From 969161a225dd7a1b4c3ecdd0b6d1376566f32f27 Mon Sep 17 00:00:00 2001
+From 771112746f82ed8fc6f1ad6078c615f62da5745c Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:53:43 +0800
 Subject: [PATCH 1008/1008] mt76: mt7915: add mt76 vendor muru onoff command
 
 ---
- mt7915/mcu.c    |  7 +++++++
- mt7915/mcu.h    |  1 +
- mt7915/vendor.c | 43 +++++++++++++++++++++++++++++++++++++++++++
- mt7915/vendor.h | 12 ++++++++++++
+ .../net/wireless/mediatek/mt76/mt7915/mcu.c   |  7 +++
+ .../net/wireless/mediatek/mt76/mt7915/mcu.h   |  1 +
+ .../wireless/mediatek/mt76/mt7915/vendor.c    | 43 +++++++++++++++++++
+ .../wireless/mediatek/mt76/mt7915/vendor.h    | 12 ++++++
  4 files changed, 63 insertions(+)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 7f2161f..aee3a8c 100644
+index 224f3ab2..0f71356b 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3656,6 +3656,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -3675,6 +3675,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  		if (val == 0)
  			dev->dbg.muru_onoff = MUMIMO_DL_CERT | MUMIMO_DL;
  		break;
@@ -29,10 +29,10 @@
  }
  
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 464e771..75442ba 100644
+index c4850644..0a77ad0d 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -402,6 +402,7 @@ enum {
+@@ -403,6 +403,7 @@ enum {
  #ifdef CONFIG_MTK_VENDOR
  	RATE_PARAM_FIXED_MIMO = 30,
  	RATE_PARAM_FIXED_OFDMA = 31,
@@ -41,7 +41,7 @@
  };
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 7456c57..c755184 100644
+index 7456c577..c7551848 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -34,6 +34,11 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -109,7 +109,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 1b08321..a8e4ebf 100644
+index 1b08321c..a8e4ebf9 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -8,6 +8,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -139,5 +139,5 @@
  	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
  
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1111-mt76-testmode-additional-supports.patch b/recipes-kernel/linux-mt76/files/patches/1111-mt76-testmode-additional-supports.patch
index d39e83d..0353dfb 100644
--- a/recipes-kernel/linux-mt76/files/patches/1111-mt76-testmode-additional-supports.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1111-mt76-testmode-additional-supports.patch
@@ -1,29 +1,29 @@
-From 9c76671cd831d28e5b270baa23c71dfc4aaf8410 Mon Sep 17 00:00:00 2001
+From 969b99141e451f7af21a2e8f5ec051be6deaa026 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Apr 2022 15:43:19 +0800
-Subject: [PATCH] mt76: testmode: additional supports
+Subject: [PATCH 1111/1119] mt76: testmode: additional supports
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
- dma.c             |    3 +-
- mac80211.c        |   12 +
- mt76.h            |  111 ++++-
- mt76_connac_mcu.c |    4 +
- mt76_connac_mcu.h |    2 +
- mt7915/init.c     |    2 +-
- mt7915/mac.c      |   37 +-
- mt7915/main.c     |    2 +-
- mt7915/mcu.c      |   10 +-
- mt7915/mcu.h      |   28 +-
- mt7915/mmio.c     |    2 +
- mt7915/mt7915.h   |   14 +-
- mt7915/regs.h     |    3 +
- mt7915/testmode.c | 1171 ++++++++++++++++++++++++++++++++++++++++++---
- mt7915/testmode.h |  278 +++++++++++
- testmode.c        |  275 +++++++++--
- testmode.h        |   75 +++
- tools/fields.c    |   80 ++++
- tx.c              |    3 +-
+ drivers/net/wireless/mediatek/mt76/dma.c      |    3 +-
+ drivers/net/wireless/mediatek/mt76/mac80211.c |   12 +
+ drivers/net/wireless/mediatek/mt76/mt76.h     |  111 +-
+ .../wireless/mediatek/mt76/mt76_connac_mcu.c  |    4 +
+ .../wireless/mediatek/mt76/mt76_connac_mcu.h  |    2 +
+ .../net/wireless/mediatek/mt76/mt7915/init.c  |    2 +-
+ .../net/wireless/mediatek/mt76/mt7915/mac.c   |   37 +-
+ .../net/wireless/mediatek/mt76/mt7915/main.c  |    2 +-
+ .../net/wireless/mediatek/mt76/mt7915/mcu.c   |   10 +-
+ .../net/wireless/mediatek/mt76/mt7915/mcu.h   |   28 +-
+ .../net/wireless/mediatek/mt76/mt7915/mmio.c  |    2 +
+ .../wireless/mediatek/mt76/mt7915/mt7915.h    |   14 +-
+ .../net/wireless/mediatek/mt76/mt7915/regs.h  |    3 +
+ .../wireless/mediatek/mt76/mt7915/testmode.c  | 1171 +++++++++++++++--
+ .../wireless/mediatek/mt76/mt7915/testmode.h  |  278 ++++
+ drivers/net/wireless/mediatek/mt76/testmode.c |  275 +++-
+ drivers/net/wireless/mediatek/mt76/testmode.h |   75 ++
+ .../net/wireless/mediatek/mt76/tools/fields.c |   80 ++
+ drivers/net/wireless/mediatek/mt76/tx.c       |    3 +-
  19 files changed, 1963 insertions(+), 149 deletions(-)
 
 diff --git a/dma.c b/dma.c
@@ -257,7 +257,7 @@
  		return;
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 32e540cc..a0e6fa6e 100644
+index 25aeedc2..cb1e94a3 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -967,6 +967,7 @@ enum {
@@ -356,7 +356,7 @@
  }
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index dc5e4b0f..e4b20766 100644
+index 60d990f3..dd0b3cc2 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -224,7 +224,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
@@ -369,7 +369,7 @@
  		mvif->mt76.wmm_idx += 2;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index fa8f51da..41a8e7e2 100644
+index 0f71356b..c65fee98 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -434,6 +434,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -392,7 +392,7 @@
  	    !rxd->seq)
  		mt7915_mcu_rx_unsolicited_event(dev, skb);
  	else
-@@ -2809,14 +2815,14 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
+@@ -2831,14 +2837,14 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
  	return 0;
  }
  
@@ -410,7 +410,7 @@
  
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 15b74732..1b147421 100644
+index 0a77ad0d..ad85e56c 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -8,10 +8,15 @@
@@ -429,7 +429,7 @@
  };
  
  struct mt7915_mcu_thermal_ctrl {
-@@ -431,6 +436,12 @@ enum {
+@@ -432,6 +437,12 @@ enum {
  
  enum {
  	MT_BF_SOUNDING_ON = 1,
@@ -442,7 +442,7 @@
  	MT_BF_TYPE_UPDATE = 20,
  	MT_BF_MODULE_UPDATE = 25
  };
-@@ -664,10 +675,19 @@ struct mt7915_muru {
+@@ -665,10 +676,19 @@ struct mt7915_muru {
  #define MURU_OFDMA_SCH_TYPE_UL          BIT(1)
  
  /* Common Config */
@@ -554,7 +554,7 @@
  							  (_n) * 4))
  #define MT_AGG_PCR0(_band, _n)		MT_WF_AGG(_band, (__OFFS(AGG_PCR0) +	\
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 123ceaf9..a0a9f7be 100644
+index b2eee3f2..3efd1ff0 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -9,6 +9,9 @@
@@ -1409,7 +1409,7 @@
  	if (ret)
  		return ret;
  
-@@ -456,18 +1231,180 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
+@@ -456,64 +1231,227 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
  
  	phy->mt76->test.flag |= MT_TM_FW_RX_COUNT;
  
@@ -1596,9 +1596,8 @@
  }
  
  static void
-@@ -476,47 +1413,48 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
- 	static const u8 spe_idx_map[] = {0, 0, 1, 0, 3, 2, 4, 0,
- 					 9, 8, 6, 10, 16, 12, 18, 0};
+ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+ {
  	struct mt76_testmode_data *td = &phy->mt76->test;
 -	struct mt7915_dev *dev = phy->dev;
 -	struct ieee80211_tx_info *info;
@@ -1618,11 +1617,10 @@
 +		if (!phy->test.bf_en)
 +			mt7915_tm_update_channel(phy);
  
- 		if (td->tx_spe_idx) {
+ 		if (td->tx_spe_idx)
  			phy->test.spe_idx = td->tx_spe_idx;
- 		} else {
- 			phy->test.spe_idx = spe_idx_map[td->tx_antenna_mask];
- 		}
+ 		else
+ 			phy->test.spe_idx = mt76_connac_spe_idx(td->tx_antenna_mask);
 -	}
  
 -	mt7915_tm_set_tam_arb(phy, en,
@@ -1670,7 +1668,7 @@
  
  	mt7915_tm_set_trx(phy, TM_MAC_TX, en);
  }
-@@ -545,10 +1483,6 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
+@@ -542,10 +1480,6 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
  		return ret;
  
  	rs_band = (struct mt7915_tm_rx_stat_band *)skb->data;
@@ -1681,7 +1679,7 @@
  
  	if (!clear) {
  		enum mt76_rxq_id q = req.band ? MT_RXQ_EXT : MT_RXQ_MAIN;
-@@ -563,13 +1497,61 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
+@@ -560,13 +1494,61 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
  	return 0;
  }
  
@@ -1744,7 +1742,7 @@
  
  		/* read-clear */
  		mt7915_tm_get_rx_stats(phy, true);
-@@ -577,9 +1559,12 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
+@@ -574,9 +1556,12 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
  		/* clear fw count */
  		mt7915_tm_set_phy_count(phy, 0);
  		mt7915_tm_set_phy_count(phy, 1);
@@ -1759,7 +1757,7 @@
  }
  
  static int
-@@ -616,35 +1601,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
+@@ -613,35 +1598,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
  	tx_cont->center_ch = freq1;
  	tx_cont->tx_ant = td->tx_antenna_mask;
  	tx_cont->band = phy != &dev->phy;
@@ -1796,7 +1794,7 @@
  
  	if (!en) {
  		req.op.rf.param.func_data = cpu_to_le32(phy != &dev->phy);
-@@ -728,6 +1685,12 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
+@@ -725,6 +1682,12 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
  		mt7915_tm_set_freq_offset(phy, en, en ? td->freq_offset : 0);
  	if (changed & BIT(TM_CHANGED_TXPOWER))
  		mt7915_tm_set_tx_power(phy);
@@ -1809,7 +1807,7 @@
  }
  
  static int
-@@ -801,6 +1764,7 @@ static int
+@@ -798,6 +1761,7 @@ static int
  mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  {
  	struct mt7915_phy *phy = mphy->priv;
@@ -1817,7 +1815,7 @@
  	void *rx, *rssi;
  	int i;
  
-@@ -846,11 +1810,68 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+@@ -843,11 +1807,68 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  
  	nla_nest_end(msg, rx);
  
@@ -2202,10 +2200,10 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index 4a24f6c9..690e9a7d 100644
+index 31439b39..86323f64 100644
 --- a/testmode.c
 +++ b/testmode.c
-@@ -25,28 +25,16 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
+@@ -27,28 +27,16 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
  };
  EXPORT_SYMBOL_GPL(mt76_tm_policy);
  
@@ -2240,7 +2238,7 @@
  	       q->queued < q->ndesc / 2) {
  		int ret;
  
-@@ -55,13 +43,65 @@ void mt76_testmode_tx_pending(struct mt76_phy *phy)
+@@ -57,13 +45,65 @@ void mt76_testmode_tx_pending(struct mt76_phy *phy)
  		if (ret < 0)
  			break;
  
@@ -2306,7 +2304,7 @@
  }
  
  static u32
-@@ -87,15 +127,31 @@ mt76_testmode_max_mpdu_len(struct mt76_phy *phy, u8 tx_rate_mode)
+@@ -89,15 +129,31 @@ mt76_testmode_max_mpdu_len(struct mt76_phy *phy, u8 tx_rate_mode)
  }
  
  static void
@@ -2342,7 +2340,7 @@
  {
  #define MT_TXP_MAX_LEN	4095
  	u16 fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA |
-@@ -117,7 +173,8 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
+@@ -119,7 +175,8 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
  	nfrags = len / MT_TXP_MAX_LEN;
  	head_len = nfrags ? MT_TXP_MAX_LEN : len;
  
@@ -2352,9 +2350,9 @@
  		fc |= IEEE80211_STYPE_QOS_DATA;
  
  	head = alloc_skb(head_len, GFP_KERNEL);
-@@ -126,9 +183,9 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
+@@ -128,9 +185,9 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
  
- 	hdr = __skb_put_zero(head, head_len);
+ 	hdr = __skb_put_zero(head, sizeof(*hdr));
  	hdr->frame_control = cpu_to_le16(fc);
 -	memcpy(hdr->addr1, td->addr[0], ETH_ALEN);
 -	memcpy(hdr->addr2, td->addr[1], ETH_ALEN);
@@ -2363,9 +2361,9 @@
 +	memcpy(hdr->addr2, addr[1], ETH_ALEN);
 +	memcpy(hdr->addr3, addr[2], ETH_ALEN);
  	skb_set_queue_mapping(head, IEEE80211_AC_BE);
- 
- 	info = IEEE80211_SKB_CB(head);
-@@ -152,7 +209,7 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
+ 	get_random_bytes(__skb_put(head, head_len - sizeof(*hdr)),
+ 			 head_len - sizeof(*hdr));
+@@ -156,7 +213,7 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
  
  		frag = alloc_skb(frag_len, GFP_KERNEL);
  		if (!frag) {
@@ -2374,7 +2372,7 @@
  			dev_kfree_skb(head);
  			return -ENOMEM;
  		}
-@@ -165,15 +222,14 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
+@@ -169,15 +226,14 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
  		frag_tail = &(*frag_tail)->next;
  	}
  
@@ -2394,7 +2392,7 @@
  {
  	struct mt76_testmode_data *td = &phy->test;
  	struct ieee80211_tx_info *info;
-@@ -181,7 +237,7 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
+@@ -185,7 +241,7 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
  	u8 max_nss = hweight8(phy->antenna_mask);
  	int ret;
  
@@ -2403,7 +2401,7 @@
  	if (ret)
  		return ret;
  
-@@ -191,7 +247,7 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
+@@ -195,7 +251,7 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
  	if (td->tx_antenna_mask)
  		max_nss = min_t(u8, max_nss, hweight8(td->tx_antenna_mask));
  
@@ -2412,7 +2410,7 @@
  	rate = &info->control.rates[0];
  	rate->count = 1;
  	rate->idx = td->tx_rate_idx;
-@@ -263,6 +319,25 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
+@@ -267,6 +323,25 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
  out:
  	return 0;
  }
@@ -2438,7 +2436,7 @@
  
  static void
  mt76_testmode_tx_start(struct mt76_phy *phy)
-@@ -273,6 +348,14 @@ mt76_testmode_tx_start(struct mt76_phy *phy)
+@@ -277,6 +352,14 @@ mt76_testmode_tx_start(struct mt76_phy *phy)
  	td->tx_queued = 0;
  	td->tx_done = 0;
  	td->tx_pending = td->tx_count;
@@ -2453,7 +2451,7 @@
  	mt76_worker_schedule(&dev->tx_worker);
  }
  
-@@ -291,7 +374,7 @@ mt76_testmode_tx_stop(struct mt76_phy *phy)
+@@ -295,7 +378,7 @@ mt76_testmode_tx_stop(struct mt76_phy *phy)
  	wait_event_timeout(dev->tx_wait, td->tx_done == td->tx_queued,
  			   MT76_TM_TIMEOUT * HZ);
  
@@ -2462,7 +2460,7 @@
  }
  
  static inline void
-@@ -322,6 +405,8 @@ mt76_testmode_init_defaults(struct mt76_phy *phy)
+@@ -326,6 +409,8 @@ mt76_testmode_init_defaults(struct mt76_phy *phy)
  	memcpy(td->addr[0], phy->macaddr, ETH_ALEN);
  	memcpy(td->addr[1], phy->macaddr, ETH_ALEN);
  	memcpy(td->addr[2], phy->macaddr, ETH_ALEN);
@@ -2471,7 +2469,7 @@
  }
  
  static int
-@@ -331,8 +416,12 @@ __mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state)
+@@ -335,8 +420,12 @@ __mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state)
  	struct mt76_dev *dev = phy->dev;
  	int err;
  
@@ -2485,7 +2483,7 @@
  
  	if (state == MT76_TM_STATE_TX_FRAMES) {
  		err = mt76_testmode_tx_init(phy);
-@@ -402,6 +491,44 @@ mt76_tm_get_u8(struct nlattr *attr, u8 *dest, u8 min, u8 max)
+@@ -406,6 +495,44 @@ mt76_tm_get_u8(struct nlattr *attr, u8 *dest, u8 min, u8 max)
  	return 0;
  }
  
@@ -2530,7 +2528,7 @@
  int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  		      void *data, int len)
  {
-@@ -425,6 +552,11 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -429,6 +556,11 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  
  	mutex_lock(&dev->mutex);
  
@@ -2542,7 +2540,7 @@
  	if (tb[MT76_TM_ATTR_RESET]) {
  		mt76_testmode_set_state(phy, MT76_TM_STATE_OFF);
  		memset(td, 0, sizeof(*td));
-@@ -452,7 +584,10 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -456,7 +588,10 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_DUTY_CYCLE],
  			   &td->tx_duty_cycle, 0, 99) ||
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_POWER_CONTROL],
@@ -2554,7 +2552,7 @@
  		goto out;
  
  	if (tb[MT76_TM_ATTR_TX_LENGTH]) {
-@@ -484,8 +619,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -488,8 +623,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  
  	if (tb[MT76_TM_ATTR_TX_POWER]) {
  		struct nlattr *cur;
@@ -2564,7 +2562,7 @@
  
  		nla_for_each_nested(cur, tb[MT76_TM_ATTR_TX_POWER], rem) {
  			if (nla_len(cur) != 1 ||
-@@ -505,11 +639,45 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -509,11 +643,45 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			if (nla_len(cur) != ETH_ALEN || idx >= 3)
  				goto out;
  
@@ -2611,7 +2609,7 @@
  	if (dev->test_ops->set_params) {
  		err = dev->test_ops->set_params(phy, tb, state);
  		if (err)
-@@ -574,6 +742,7 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+@@ -578,6 +746,7 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
  	struct mt76_phy *phy = hw->priv;
  	struct mt76_dev *dev = phy->dev;
  	struct mt76_testmode_data *td = &phy->test;
@@ -2619,7 +2617,7 @@
  	struct nlattr *tb[NUM_MT76_TM_ATTRS] = {};
  	int err = 0;
  	void *a;
-@@ -606,6 +775,19 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+@@ -610,6 +779,19 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
  		goto out;
  	}
  
@@ -2639,7 +2637,7 @@
  	mt76_testmode_init_defaults(phy);
  
  	err = -EMSGSIZE;
-@@ -618,12 +800,8 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+@@ -622,12 +804,8 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
  		goto out;
  
  	if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
@@ -2652,7 +2650,7 @@
  	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_STBC, td->tx_rate_stbc) ||
  	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_LTF) &&
  	     nla_put_u8(msg, MT76_TM_ATTR_TX_LTF, td->tx_ltf)) ||
-@@ -643,6 +821,15 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+@@ -647,6 +825,15 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
  	     nla_put_u8(msg, MT76_TM_ATTR_FREQ_OFFSET, td->freq_offset)))
  		goto out;
  
@@ -2914,5 +2912,5 @@
  			wake_up(&dev->tx_wait);
  
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1112-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch b/recipes-kernel/linux-mt76/files/patches/1112-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
index 3bcc928..a95ff2b 100644
--- a/recipes-kernel/linux-mt76/files/patches/1112-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1112-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
@@ -1,14 +1,14 @@
-From 40ba703e0b33d0c1ca7532d556ea9fcf9111f5b8 Mon Sep 17 00:00:00 2001
+From 378d2227566d0f3d60cd9b59d91e5b13153653e5 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Sun, 24 Apr 2022 10:07:00 +0800
-Subject: [PATCH 1112/1115] mt76: mt7915: init rssi in WTBL when add station
+Subject: [PATCH 1112/1119] mt76: mt7915: init rssi in WTBL when add station
 
 ---
- mt7915/main.c | 4 ++++
+ drivers/net/wireless/mediatek/mt76/mt7915/main.c | 4 ++++
  1 file changed, 4 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index e4b2076..ebff255 100644
+index dd0b3cc2..06658aed 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -666,6 +666,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -30,5 +30,5 @@
  	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
  #endif
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1113-mt76-mt7915-drop-packets-when-TWT-stations-use-more-.patch b/recipes-kernel/linux-mt76/files/patches/1113-mt76-mt7915-drop-packets-when-TWT-stations-use.patch
old mode 100755
new mode 100644
similarity index 89%
rename from recipes-kernel/linux-mt76/files/patches/1113-mt76-mt7915-drop-packets-when-TWT-stations-use-more-.patch
rename to recipes-kernel/linux-mt76/files/patches/1113-mt76-mt7915-drop-packets-when-TWT-stations-use.patch
index bb06dff..c7e2e09
--- a/recipes-kernel/linux-mt76/files/patches/1113-mt76-mt7915-drop-packets-when-TWT-stations-use-more-.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1113-mt76-mt7915-drop-packets-when-TWT-stations-use.patch
@@ -1,18 +1,15 @@
-From 9bc707077df60aa6423c89b1d17fd8a5f4e2d36b Mon Sep 17 00:00:00 2001
+From ac7abe57fec7283da9c50d4f513c1b6171e0e912 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 4 Jul 2022 19:24:34 +0800
-Subject: [PATCH] mt76: mt7915: drop packets when TWT stations use
+Subject: [PATCH 1113/1119] mt76: mt7915: drop packets when TWT stations use
 
 ---
- mt7915/mac.c    | 21 ++++++++++++++++++---
- mt7915/mt7915.h |  2 ++
+ .../net/wireless/mediatek/mt76/mt7915/mac.c   | 21 ++++++++++++++++---
+ .../wireless/mediatek/mt76/mt7915/mt7915.h    |  2 ++
  2 files changed, 20 insertions(+), 3 deletions(-)
- mode change 100644 => 100755 mt7915/mac.c
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-old mode 100644
-new mode 100755
-index 5e5df23d..55b38d16
+index 5e5df23d..55b38d16 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -725,6 +725,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
@@ -96,5 +93,5 @@
  
  struct mt7915_vif_cap {
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1114-mt76-airtime-fairness-feature-off-in-mac80211.patch b/recipes-kernel/linux-mt76/files/patches/1114-mt76-airtime-fairness-feature-off-in-mac80211.patch
index 391933b..d6d76d7 100644
--- a/recipes-kernel/linux-mt76/files/patches/1114-mt76-airtime-fairness-feature-off-in-mac80211.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1114-mt76-airtime-fairness-feature-off-in-mac80211.patch
@@ -1,14 +1,14 @@
-From 3cbacf679f9fba714955123374dd59fbe33d7a32 Mon Sep 17 00:00:00 2001
+From 270b493736a3f552b9fc2da8d6741c7e0168b470 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 6 May 2022 15:58:42 +0800
-Subject: [PATCH 1114/1115] mt76: airtime fairness feature off in mac80211
+Subject: [PATCH 1114/1119] mt76: airtime fairness feature off in mac80211
 
 ---
- mac80211.c | 1 -
+ drivers/net/wireless/mediatek/mt76/mac80211.c | 1 -
  1 file changed, 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index dc3c63e..5600a09 100644
+index 9984def5..af2c09ad 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -427,7 +427,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
@@ -20,5 +20,5 @@
  
  	wiphy->available_antennas_tx = phy->antenna_mask;
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1115-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch b/recipes-kernel/linux-mt76/files/patches/1115-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
index 0e446a8..b1540ba 100644
--- a/recipes-kernel/linux-mt76/files/patches/1115-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1115-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
@@ -1,7 +1,7 @@
-From c07c8c699e63f32f431a7439145ecf1844690ca3 Mon Sep 17 00:00:00 2001
+From a4033091ec1a76b05364ea714f2abea7addbebb9 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 20 May 2022 19:19:25 +0800
-Subject: [PATCH 1115/1115] mt76: mt7915: add mt7986 and mt7916 pre-calibration
+Subject: [PATCH 1115/1119] mt76: mt7915: add mt7986 and mt7916 pre-calibration
 
 Add pre-calibration for mt7986 and mt7916. It has different data size
 with mt7915. Group cal needs 54k and 94k for 2G + 5G and 2G + 6G,
@@ -9,13 +9,13 @@
 
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
- mt7915/eeprom.c | 15 +++++-----
- mt7915/eeprom.h | 27 +++++++++++++++--
- mt7915/mcu.c    | 80 ++++++++++++++++++++++++++++++++++++-------------
+ .../wireless/mediatek/mt76/mt7915/eeprom.c    | 15 ++--
+ .../wireless/mediatek/mt76/mt7915/eeprom.h    | 27 ++++++-
+ .../net/wireless/mediatek/mt76/mt7915/mcu.c   | 80 ++++++++++++++-----
  3 files changed, 90 insertions(+), 32 deletions(-)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 4b1a981..ee3049e 100644
+index 4b1a9811..ee3049e5 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -9,23 +9,22 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
@@ -50,7 +50,7 @@
  
  static int mt7915_check_eeprom(struct mt7915_dev *dev)
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index 7578ac6..e924bae 100644
+index 7578ac6d..e924baef 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
 @@ -19,6 +19,7 @@ enum mt7915_eeprom_field {
@@ -103,10 +103,10 @@
  
  #endif
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 810d72e..a16081d 100644
+index c65fee98..29422f55 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2911,9 +2911,10 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
+@@ -2930,9 +2930,10 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
  int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
  {
  	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
@@ -119,7 +119,7 @@
  		return 0;
  
  	/*
-@@ -2949,9 +2950,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
+@@ -2968,9 +2969,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
  	return -1;
  }
  
@@ -131,7 +131,7 @@
  		5180, 5200, 5220, 5240,
  		5260, 5280, 5300, 5320,
  		5500, 5520, 5540, 5560,
-@@ -2959,65 +2960,102 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
+@@ -2978,65 +2979,102 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
  		5660, 5680, 5700, 5745,
  		5765, 5785, 5805, 5825
  	};
@@ -252,5 +252,5 @@
  
  	return 0;
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1116-mt76-mt7915-add-vendor-dump-phy-capa.patch b/recipes-kernel/linux-mt76/files/patches/1116-mt76-mt7915-add-phy-capability-vendor-command.patch
similarity index 74%
rename from recipes-kernel/linux-mt76/files/patches/1116-mt76-mt7915-add-vendor-dump-phy-capa.patch
rename to recipes-kernel/linux-mt76/files/patches/1116-mt76-mt7915-add-phy-capability-vendor-command.patch
index df0838e..2341225 100644
--- a/recipes-kernel/linux-mt76/files/patches/1116-mt76-mt7915-add-vendor-dump-phy-capa.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1116-mt76-mt7915-add-phy-capability-vendor-command.patch
@@ -1,8 +1,31 @@
-Index: mt76-2022-06-24-b6e865e2/mt7915/vendor.c
-===================================================================
---- mt76-2022-06-24-b6e865e2.orig/mt7915/vendor.c
-+++ mt76-2022-06-24-b6e865e2/mt7915/vendor.c
-@@ -50,6 +50,18 @@ rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTR
+From e6188ac3afe4e1027704f87409f4147215f32821 Mon Sep 17 00:00:00 2001
+From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
+Date: Tue, 12 Jul 2022 10:04:35 -0700
+Subject: [PATCH 1116/1119] mt76: mt7915: add phy capability vendor command
+
+---
+ .../wireless/mediatek/mt76/mt7915/mt7915.h    |  1 +
+ .../wireless/mediatek/mt76/mt7915/vendor.c    | 52 +++++++++++++++++++
+ .../wireless/mediatek/mt76/mt7915/vendor.h    | 25 +++++++++
+ 3 files changed, 78 insertions(+)
+
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 5f11b3fb..fb8bd877 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -11,6 +11,7 @@
+ 
+ #define MTK_DEBUG 1
+ #define MT7915_MAX_INTERFACES		19
++#define MT7915_MAX_BSS			16
+ #define MT7915_WTBL_SIZE		288
+ #define MT7916_WTBL_SIZE		544
+ #define MT7915_WTBL_RESERVED		(mt7915_wtbl_size(dev) - 1)
+diff --git a/mt7915/vendor.c b/mt7915/vendor.c
+index c7551848..77d71e48 100644
+--- a/mt7915/vendor.c
++++ b/mt7915/vendor.c
+@@ -50,6 +50,18 @@ rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
  	[MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TXBF] = { .type = NLA_U8 },
  };
  
@@ -21,7 +44,7 @@
  struct csi_null_tone {
  	u8 start;
  	u8 end;
-@@ -974,6 +986,35 @@ static int mt7915_vendor_hemu_ctrl(struc
+@@ -974,6 +986,35 @@ static int mt7915_vendor_hemu_ctrl(struct wiphy *wiphy,
  	return 0;
  }
  
@@ -57,7 +80,7 @@
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
  		.info = {
-@@ -1031,6 +1072,17 @@ static const struct wiphy_vendor_command
+@@ -1031,6 +1072,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.doit = mt7915_vendor_hemu_ctrl,
  		.policy = hemu_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
@@ -75,10 +98,10 @@
  	}
  };
  
-Index: mt76-2022-06-24-b6e865e2/mt7915/vendor.h
-===================================================================
---- mt76-2022-06-24-b6e865e2.orig/mt7915/vendor.h
-+++ mt76-2022-06-24-b6e865e2/mt7915/vendor.h
+diff --git a/mt7915/vendor.h b/mt7915/vendor.h
+index a8e4ebf9..719b851f 100644
+--- a/mt7915/vendor.h
++++ b/mt7915/vendor.h
 @@ -9,6 +9,7 @@ enum mtk_nl80211_vendor_subcmds {
  	MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
  	MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
@@ -116,15 +139,6 @@
 +};
 +
  #endif
-Index: mt76-2022-06-24-b6e865e2/mt7915/mt7915.h
-===================================================================
---- mt76-2022-06-24-b6e865e2.orig/mt7915/mt7915.h
-+++ mt76-2022-06-24-b6e865e2/mt7915/mt7915.h
-@@ -11,6 +11,7 @@
- 
- #define MTK_DEBUG 1
- #define MT7915_MAX_INTERFACES		19
-+#define MT7915_MAX_BSS			16
- #define MT7915_WTBL_SIZE		288
- #define MT7916_WTBL_SIZE		544
- #define MT7915_WTBL_RESERVED		(mt7915_wtbl_size(dev) - 1)
+-- 
+2.25.1
+
diff --git a/recipes-kernel/linux-mt76/files/patches/1117-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch b/recipes-kernel/linux-mt76/files/patches/1117-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
index c25f9b2..defd698 100644
--- a/recipes-kernel/linux-mt76/files/patches/1117-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1117-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
@@ -1,21 +1,21 @@
-From c1e72950b8f7df7c36c64e27613637f88e3c1ba3 Mon Sep 17 00:00:00 2001
+From 49eb731e0ede35ae2deb4e248f704b1c27afeeed Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 24 Jun 2022 11:15:45 +0800
-Subject: [PATCH 1117/1117] mt76: mt7915: add vendor subcmd EDCCA ctrl
+Subject: [PATCH 1117/1119] mt76: mt7915: add vendor subcmd EDCCA ctrl
 
 Change-Id: I92dabf8be9c5a7ecec78f35325bc5645af8d15ab
 ---
- mt76_connac_mcu.h |  1 +
- mt7915/main.c     |  3 +++
- mt7915/mcu.c      | 38 ++++++++++++++++++++++++++++
- mt7915/mcu.h      | 12 +++++++++
- mt7915/mt7915.h   |  2 ++
- mt7915/vendor.c   | 63 +++++++++++++++++++++++++++++++++++++++++++++++
- mt7915/vendor.h   | 19 ++++++++++++++
+ .../wireless/mediatek/mt76/mt76_connac_mcu.h  |  1 +
+ .../net/wireless/mediatek/mt76/mt7915/main.c  |  3 +
+ .../net/wireless/mediatek/mt76/mt7915/mcu.c   | 38 +++++++++++
+ .../net/wireless/mediatek/mt76/mt7915/mcu.h   | 12 ++++
+ .../wireless/mediatek/mt76/mt7915/mt7915.h    |  2 +
+ .../wireless/mediatek/mt76/mt7915/vendor.c    | 63 +++++++++++++++++++
+ .../wireless/mediatek/mt76/mt7915/vendor.h    | 19 ++++++
  7 files changed, 138 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index a0e6fa6e..1747e06d 100644
+index cb1e94a3..ca68172d 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1147,6 +1147,7 @@ enum {
@@ -27,7 +27,7 @@
  };
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 6c97ce78..1dc41ab6 100644
+index 06658aed..6085e124 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -456,6 +456,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
@@ -41,10 +41,10 @@
  		ret = mt7915_set_channel(phy);
  		if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 46eef36a..205ecbab 100644
+index 29422f55..681a2a7c 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4217,3 +4217,41 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
+@@ -4239,3 +4239,41 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  
  	return 0;
  }
@@ -87,10 +87,10 @@
 +	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCCA), &req, sizeof(req), true);
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 873a8055..72c2cfc6 100644
+index ad85e56c..b8a433e5 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -785,4 +785,16 @@ enum {
+@@ -789,4 +789,16 @@ enum {
  };
  #endif
  
@@ -108,10 +108,10 @@
 +};
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 0b7f73b3..5c58a29c 100644
+index fb8bd877..6462d502 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -718,6 +718,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
+@@ -721,6 +721,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
  int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
@@ -241,5 +241,5 @@
  	CAPI_RFEATURE_CHANGED		= BIT(16),
  	CAPI_WIRELESS_CHANGED		= BIT(17),
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1118-mt76-mt7915-implement-bin-file-mode.patch b/recipes-kernel/linux-mt76/files/patches/1118-mt76-mt7915-implement-bin-file-mode.patch
new file mode 100644
index 0000000..8597721
--- /dev/null
+++ b/recipes-kernel/linux-mt76/files/patches/1118-mt76-mt7915-implement-bin-file-mode.patch
@@ -0,0 +1,180 @@
+From 8a072ddf45b67a379a2fb63dd45e0f5024101403 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Thu, 7 Jul 2022 11:09:59 +0800
+Subject: [PATCH 1118/1119] mt76: mt7915: implement bin file mode
+
+Change-Id: I2a726341541a11cbecdb210b33a8e79aefbd6cf3
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ drivers/net/wireless/mediatek/mt76/eeprom.c   | 18 +++++++
+ drivers/net/wireless/mediatek/mt76/mt76.h     |  1 +
+ .../wireless/mediatek/mt76/mt7915/eeprom.c    | 53 +++++++++++++++----
+ .../wireless/mediatek/mt76/mt7915/mt7915.h    | 10 ++++
+ 4 files changed, 71 insertions(+), 11 deletions(-)
+
+diff --git a/eeprom.c b/eeprom.c
+index d7ee123b..f2d0a65b 100644
+--- a/eeprom.c
++++ b/eeprom.c
+@@ -102,6 +102,24 @@ out_put_node:
+ }
+ EXPORT_SYMBOL_GPL(mt76_get_of_eeprom);
+ 
++bool mt76_check_bin_file_mode(struct mt76_dev *dev)
++{
++	struct device_node *np = dev->dev->of_node;
++	const __be32 *bin_file_mode;
++	bool ret = false;
++
++	if (!np)
++		return false;
++
++	bin_file_mode = of_get_property(np, "bin_file_mode", NULL);
++	if (bin_file_mode && be32_to_cpu(*bin_file_mode))
++		ret = true;
++
++	of_node_put(np);
++	return ret;
++}
++EXPORT_SYMBOL_GPL(mt76_check_bin_file_mode);
++
+ void
+ mt76_eeprom_override(struct mt76_phy *phy)
+ {
+diff --git a/mt76.h b/mt76.h
+index 4c8a671f..49314895 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -1005,6 +1005,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
+ int mt76_eeprom_init(struct mt76_dev *dev, int len);
+ void mt76_eeprom_override(struct mt76_phy *phy);
+ int mt76_get_of_eeprom(struct mt76_dev *dev, void *data, int offset, int len);
++bool mt76_check_bin_file_mode(struct mt76_dev *dev);
+ 
+ struct mt76_queue *
+ mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
+diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
+index ee3049e5..e5cfa5b0 100644
+--- a/mt7915/eeprom.c
++++ b/mt7915/eeprom.c
+@@ -46,26 +46,36 @@ static char *mt7915_eeprom_name(struct mt7915_dev *dev)
+ {
+ 	switch (mt76_chip(&dev->mt76)) {
+ 	case 0x7915:
+-		return dev->dbdc_support ?
+-		       MT7915_EEPROM_DEFAULT_DBDC : MT7915_EEPROM_DEFAULT;
++		if (dev->bin_file_mode)
++			return dev->dbdc_support ?
++				MT7915_BIN_FILE_DBDC : MT7915_BIN_FILE;
++		else
++			return dev->dbdc_support ?
++				MT7915_EEPROM_DEFAULT_DBDC : MT7915_EEPROM_DEFAULT;
+ 	case 0x7986:
+ 		switch (mt7915_check_adie(dev, true)) {
+ 		case MT7976_ONE_ADIE_DBDC:
+-			return MT7986_EEPROM_MT7976_DEFAULT_DBDC;
++			return dev->bin_file_mode ?
++			MT7986_BIN_FILE_MT7976_DBDC : MT7986_EEPROM_MT7976_DEFAULT_DBDC;
+ 		case MT7975_ONE_ADIE:
+-			return MT7986_EEPROM_MT7975_DEFAULT;
++			return dev->bin_file_mode ?
++			MT7986_BIN_FILE_MT7975 : MT7986_EEPROM_MT7975_DEFAULT;
+ 		case MT7976_ONE_ADIE:
+-			return MT7986_EEPROM_MT7976_DEFAULT;
++			return dev->bin_file_mode ?
++			MT7986_BIN_FILE_MT7976 : MT7986_EEPROM_MT7976_DEFAULT;
+ 		case MT7975_DUAL_ADIE:
+-			return MT7986_EEPROM_MT7975_DUAL_DEFAULT;
++			return dev->bin_file_mode ?
++			MT7986_BIN_FILE_MT7975_DUAL : MT7986_EEPROM_MT7975_DUAL_DEFAULT;
+ 		case MT7976_DUAL_ADIE:
+-			return MT7986_EEPROM_MT7976_DUAL_DEFAULT;
++			return dev->bin_file_mode ?
++			MT7986_BIN_FILE_MT7976_DUAL : MT7986_EEPROM_MT7976_DUAL_DEFAULT;
+ 		default:
+ 			break;
+ 		}
+ 		return NULL;
+ 	default:
+-		return MT7916_EEPROM_DEFAULT;
++		return dev->bin_file_mode ?
++			MT7916_BIN_FILE : MT7916_EEPROM_DEFAULT;
+ 	}
+ }
+ 
+@@ -81,7 +91,10 @@ mt7915_eeprom_load_default(struct mt7915_dev *dev)
+ 		return ret;
+ 
+ 	if (!fw || !fw->data) {
+-		dev_err(dev->mt76.dev, "Invalid default bin\n");
++		if (dev->bin_file_mode)
++			dev_err(dev->mt76.dev, "Invalid bin (bin file mode)\n");
++		else
++			dev_err(dev->mt76.dev, "Invalid default bin\n");
+ 		ret = -EINVAL;
+ 		goto out;
+ 	}
+@@ -234,12 +247,30 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
+ {
+ 	int ret;
+ 
+-	ret = mt7915_eeprom_load(dev);
++	dev->bin_file_mode = mt76_check_bin_file_mode(&dev->mt76);
++
++	if (dev->bin_file_mode) {
++		dev->mt76.eeprom.size = mt7915_eeprom_size(dev);
++		dev->mt76.eeprom.data = devm_kzalloc(dev->mt76.dev, dev->mt76.eeprom.size,
++						      GFP_KERNEL);
++		if (!dev->mt76.eeprom.data)
++			return -ENOMEM;
++		ret = mt7915_eeprom_load_default(dev);
++	} else {
++		ret = mt7915_eeprom_load(dev);
++	}
++
+ 	if (ret < 0) {
+ 		if (ret != -EINVAL)
+ 			return ret;
+ 
+-		dev_warn(dev->mt76.dev, "eeprom load fail, use default bin\n");
++		if (dev->bin_file_mode) {
++			dev_warn(dev->mt76.dev, "bin file load fail, use default bin\n");
++			dev->bin_file_mode = false;
++		} else {
++			dev_warn(dev->mt76.dev, "eeprom load fail, use default bin\n");
++		}
++
+ 		ret = mt7915_eeprom_load_default(dev);
+ 		if (ret)
+ 			return ret;
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 6462d502..491566e9 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -51,6 +51,15 @@
+ #define MT7986_EEPROM_MT7976_DEFAULT_DBDC	"mediatek/mt7986_eeprom_mt7976_dbdc.bin"
+ #define MT7986_EEPROM_MT7976_DUAL_DEFAULT	"mediatek/mt7986_eeprom_mt7976_dual.bin"
+ 
++#define MT7915_BIN_FILE			"mediatek/mt7915_binfile.bin"
++#define MT7915_BIN_FILE_DBDC	 	        "mediatek/mt7915_binfile_dbdc.bin"
++#define MT7916_BIN_FILE		        "mediatek/mt7916_binfile.bin"
++#define MT7986_BIN_FILE_MT7975			"mediatek/mt7986_binfile_mt7975.bin"
++#define MT7986_BIN_FILE_MT7975_DUAL		"mediatek/mt7986_binfile_mt7975_dual.bin"
++#define MT7986_BIN_FILE_MT7976			"mediatek/mt7986_binfile_mt7976.bin"
++#define MT7986_BIN_FILE_MT7976_DBDC		"mediatek/mt7986_binfile_mt7976_dbdc.bin"
++#define MT7986_BIN_FILE_MT7976_DUAL		"mediatek/mt7986_binfile_mt7976_dual.bin"
++
+ #define MT7915_EEPROM_SIZE		3584
+ #define MT7916_EEPROM_SIZE		4096
+ 
+@@ -377,6 +386,7 @@ struct mt7915_dev {
+ 
+ 	bool dbdc_support;
+ 	bool flash_mode;
++	bool bin_file_mode;
+ 	bool muru_debug;
+ 	bool ibf;
+ 
+-- 
+2.25.1
+
diff --git a/recipes-kernel/linux-mt76/files/patches/1119-mt76-mt7915-initialize-wcid.patch b/recipes-kernel/linux-mt76/files/patches/1119-mt76-mt7915-initialize-wcid.patch
new file mode 100644
index 0000000..ed572cc
--- /dev/null
+++ b/recipes-kernel/linux-mt76/files/patches/1119-mt76-mt7915-initialize-wcid.patch
@@ -0,0 +1,26 @@
+From ce1b7634efbf75007f431dd770ebd70e47771029 Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Tue, 12 Jul 2022 13:56:07 +0800
+Subject: [PATCH 1119/1119] mt76 mt7915 initialize wcid
+
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index 55b38d16..0310ca74 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -974,7 +974,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+ 		 * 1'b0: msdu_id with the same 'wcid pair' as above.
+ 		 */
+ 		if (info & MT_TX_FREE_PAIR) {
+-			struct mt76_wcid *wcid;
++			struct mt76_wcid *wcid = NULL;
+ 			u16 idx;
+ 
+ 			idx = FIELD_GET(MT_TX_FREE_WLAN_ID, info);
+-- 
+2.25.1
+
diff --git a/recipes-kernel/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch b/recipes-kernel/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch
old mode 100755
new mode 100644
index e83baf5..737c694
--- a/recipes-kernel/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch
@@ -1,30 +1,24 @@
-From c5d0d7fb936620a3737fe5b71c1f59170ba42674 Mon Sep 17 00:00:00 2001
+From bac4df557d1674c557297e80b852867a650aa490 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Sun, 12 Jun 2022 16:38:45 +0800
-Subject: [PATCH 1/3] mt76 add wed tx support
+Subject: [PATCH 3001/3003] mt76 add wed tx support
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
- mt76_connac.h   |   1 +
- mt7915/dma.c    |  59 +++++++++++++++++++-------
- mt7915/mac.c    |   4 +-
- mt7915/mac.h    |   0
- mt7915/main.c   |   9 +++-
- mt7915/mcu.c    |   2 +-
- mt7915/mmio.c   | 110 +++++++++++++++++++++++++++++++++++++++++++++++-
- mt7915/mt7915.h |   2 +
- mt7915/pci.c    |  72 +------------------------------
- mt7915/regs.h   |  15 +++++++
- mt7915/soc.c    |  16 +++++--
- 11 files changed, 193 insertions(+), 97 deletions(-)
- mode change 100644 => 100755 mt76_connac.h
- mode change 100644 => 100755 mt7915/mac.h
- mode change 100644 => 100755 mt7915/mmio.c
+ .../net/wireless/mediatek/mt76/mt76_connac.h  |   1 +
+ .../net/wireless/mediatek/mt76/mt7915/dma.c   |  59 +++++++---
+ .../net/wireless/mediatek/mt76/mt7915/mac.c   |   4 +-
+ .../net/wireless/mediatek/mt76/mt7915/main.c  |   9 +-
+ .../net/wireless/mediatek/mt76/mt7915/mcu.c   |   2 +-
+ .../net/wireless/mediatek/mt76/mt7915/mmio.c  | 110 +++++++++++++++++-
+ .../wireless/mediatek/mt76/mt7915/mt7915.h    |   2 +
+ .../net/wireless/mediatek/mt76/mt7915/pci.c   |  72 +-----------
+ .../net/wireless/mediatek/mt76/mt7915/regs.h  |  15 +++
+ .../net/wireless/mediatek/mt76/mt7915/soc.c   |  16 ++-
+ 10 files changed, 193 insertions(+), 97 deletions(-)
 
 diff --git a/mt76_connac.h b/mt76_connac.h
-old mode 100644
-new mode 100755
-index 1d32d55b..3c493014
+index 5a9c1c97..c8d86800 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -110,6 +110,7 @@ struct mt76_connac_sta_key_conf {
@@ -150,10 +144,10 @@
  			return ret;
  	}
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index fd0dd509..3f059bed 100644
+index 0310ca74..db21d83e 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -833,9 +833,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
+@@ -835,9 +835,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
  
  	txp->token = cpu_to_le16(token_id);
  	txp->nbuf = 1;
@@ -165,11 +159,8 @@
  }
  
  static void
-diff --git a/mt7915/mac.h b/mt7915/mac.h
-old mode 100644
-new mode 100755
 diff --git a/mt7915/main.c b/mt7915/main.c
-index ebff255f..f1396eed 100644
+index 6085e124..2e721cd0 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -1439,14 +1439,19 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
@@ -195,10 +186,10 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 3344e122..9d2a7059 100644
+index 681a2a7c..674cbc4e 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2362,7 +2362,7 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
+@@ -2381,7 +2381,7 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -208,9 +199,7 @@
  
  	ret = mt7915_mcu_set_mwds(dev, 1);
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-old mode 100644
-new mode 100755
-index 6d1dbdbd..b4a3120d
+index 6d1dbdbd..b4a3120d 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -10,6 +10,9 @@
@@ -352,10 +341,10 @@
  				     void __iomem *mem_base, u32 device_id)
  {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 62350141..d7a2e594 100644
+index 491566e9..39127922 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -522,6 +522,8 @@ static inline void mt7986_wmac_disable(struct mt7915_dev *dev)
+@@ -533,6 +533,8 @@ static inline void mt7986_wmac_disable(struct mt7915_dev *dev)
  {
  }
  #endif
@@ -550,5 +539,5 @@
  
  	return ret;
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/3002-mt76-add-wed-rx-support.patch b/recipes-kernel/linux-mt76/files/patches/3002-mt76-add-wed-rx-support.patch
old mode 100755
new mode 100644
index 7040ca6..3ef5f63
--- a/recipes-kernel/linux-mt76/files/patches/3002-mt76-add-wed-rx-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3002-mt76-add-wed-rx-support.patch
@@ -1,35 +1,35 @@
-From 1abac441c94f3f32bd074b8b01c439263129102d Mon Sep 17 00:00:00 2001
+From a6bbc51840c63e5992c2d0cee9fbbb795312da0c Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 5 Jul 2022 19:42:55 +0800
-Subject: [PATCH 2/3] mt76 add wed rx support
+Subject: [PATCH 3002/3003] mt76 add wed rx support
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
- dma.c             | 248 +++++++++++++++++++++++++++++++++--------
- dma.h             |  10 ++
- mac80211.c        |   8 +-
- mt76.h            |  24 +++-
- mt7603/dma.c      |   2 +-
- mt7603/mt7603.h   |   2 +-
- mt7615/mac.c      |   2 +-
- mt7615/mt7615.h   |   2 +-
- mt76_connac_mcu.c |   9 ++
- mt76x02.h         |   2 +-
- mt76x02_txrx.c    |   2 +-
- mt7915/dma.c      |  10 ++
- mt7915/mac.c      | 101 ++++++++++++++++-
- mt7915/mcu.c      |   3 +
- mt7915/mmio.c     |  26 ++++-
- mt7915/mt7915.h   |   7 +-
- mt7915/regs.h     |  14 ++-
- mt7921/mac.c      |   2 +-
- mt7921/mt7921.h   |   4 +-
- mt7921/pci_mac.c  |   4 +-
- tx.c              |  34 ++++++
+ drivers/net/wireless/mediatek/mt76/dma.c      | 246 +++++++++++++++---
+ drivers/net/wireless/mediatek/mt76/dma.h      |  10 +
+ drivers/net/wireless/mediatek/mt76/mac80211.c |   8 +-
+ drivers/net/wireless/mediatek/mt76/mt76.h     |  24 +-
+ .../net/wireless/mediatek/mt76/mt7603/dma.c   |   2 +-
+ .../wireless/mediatek/mt76/mt7603/mt7603.h    |   2 +-
+ .../net/wireless/mediatek/mt76/mt7615/mac.c   |   2 +-
+ .../wireless/mediatek/mt76/mt7615/mt7615.h    |   2 +-
+ .../wireless/mediatek/mt76/mt76_connac_mcu.c  |   9 +
+ drivers/net/wireless/mediatek/mt76/mt76x02.h  |   2 +-
+ .../net/wireless/mediatek/mt76/mt76x02_txrx.c |   2 +-
+ .../net/wireless/mediatek/mt76/mt7915/dma.c   |  10 +
+ .../net/wireless/mediatek/mt76/mt7915/mac.c   | 103 +++++++-
+ .../net/wireless/mediatek/mt76/mt7915/mcu.c   |   3 +
+ .../net/wireless/mediatek/mt76/mt7915/mmio.c  |  26 +-
+ .../wireless/mediatek/mt76/mt7915/mt7915.h    |   7 +-
+ .../net/wireless/mediatek/mt76/mt7915/regs.h  |  14 +-
+ .../net/wireless/mediatek/mt76/mt7921/mac.c   |   2 +-
+ .../wireless/mediatek/mt76/mt7921/mt7921.h    |   4 +-
+ .../wireless/mediatek/mt76/mt7921/pci_mac.c   |   4 +-
+ drivers/net/wireless/mediatek/mt76/tx.c       |  34 +++
  21 files changed, 448 insertions(+), 68 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 03ee910..e46dbed 100644
+index 03ee9109..3acba9a3 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -98,6 +98,63 @@ mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t)
@@ -448,17 +448,15 @@
  		continue;
  
  free_frag:
-@@ -785,8 +940,8 @@ EXPORT_SYMBOL_GPL(mt76_dma_attach);
+@@ -785,7 +940,7 @@ EXPORT_SYMBOL_GPL(mt76_dma_attach);
  
  void mt76_dma_cleanup(struct mt76_dev *dev)
  {
 -	int i;
--
 +	int i, type;
-+
+ 
  	mt76_worker_disable(&dev->tx_worker);
  	netif_napi_del(&dev->tx_napi);
- 
 @@ -801,12 +956,17 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
  
  	mt76_for_each_q_rx(dev, i) {
@@ -479,7 +477,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_dma_cleanup);
 diff --git a/dma.h b/dma.h
-index fdf786f..90370d1 100644
+index fdf786f9..90370d12 100644
 --- a/dma.h
 +++ b/dma.h
 @@ -16,6 +16,16 @@
@@ -500,7 +498,7 @@
  #define MT_RX_INFO_LEN			4
  #define MT_FCE_INFO_LEN			4
 diff --git a/mac80211.c b/mac80211.c
-index af2c09a..fa5ce6e 100644
+index af2c09ad..fa5ce6ec 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -594,11 +594,14 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
@@ -531,7 +529,7 @@
  
  	mt76_rx_complete(dev, &frames, napi);
 diff --git a/mt76.h b/mt76.h
-index 4c8a671..24e4741 100644
+index 49314895..9162213a 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -20,6 +20,8 @@
@@ -606,7 +604,7 @@
  
  	wait_queue_head_t tx_wait;
  	/* spinclock used to protect wcid pktid linked list */
-@@ -1351,6 +1363,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1352,6 +1364,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  }
  
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
@@ -615,7 +613,7 @@
  void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
  		      struct napi_struct *napi);
  void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
-@@ -1495,6 +1509,12 @@ struct mt76_txwi_cache *
+@@ -1496,6 +1510,12 @@ struct mt76_txwi_cache *
  mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
  int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
  void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
@@ -629,7 +627,7 @@
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
 diff --git a/mt7603/dma.c b/mt7603/dma.c
-index 590cff9..2ff71c5 100644
+index 590cff9d..2ff71c53 100644
 --- a/mt7603/dma.c
 +++ b/mt7603/dma.c
 @@ -69,7 +69,7 @@ free:
@@ -642,7 +640,7 @@
  	struct mt7603_dev *dev = container_of(mdev, struct mt7603_dev, mt76);
  	__le32 *rxd = (__le32 *)skb->data;
 diff --git a/mt7603/mt7603.h b/mt7603/mt7603.h
-index 0fd46d9..f2ce22a 100644
+index 0fd46d90..f2ce22ae 100644
 --- a/mt7603/mt7603.h
 +++ b/mt7603/mt7603.h
 @@ -244,7 +244,7 @@ int mt7603_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
@@ -655,7 +653,7 @@
  void mt7603_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
  int mt7603_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7615/mac.c b/mt7615/mac.c
-index 3728627..14cdd9a 100644
+index 37286276..14cdd9a2 100644
 --- a/mt7615/mac.c
 +++ b/mt7615/mac.c
 @@ -1648,7 +1648,7 @@ bool mt7615_rx_check(struct mt76_dev *mdev, void *data, int len)
@@ -668,7 +666,7 @@
  	struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
  	__le32 *rxd = (__le32 *)skb->data;
 diff --git a/mt7615/mt7615.h b/mt7615/mt7615.h
-index 25880d1..983469c 100644
+index 25880d1a..983469c7 100644
 --- a/mt7615/mt7615.h
 +++ b/mt7615/mt7615.h
 @@ -511,7 +511,7 @@ void mt7615_tx_worker(struct mt76_worker *w);
@@ -681,7 +679,7 @@
  int mt7615_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  		       struct ieee80211_sta *sta);
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index cd35068..2454846 100644
+index cd350689..24548469 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -1190,6 +1190,7 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
@@ -729,7 +727,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_connac_mcu_add_key);
 diff --git a/mt76x02.h b/mt76x02.h
-index f76fd22..0b872af 100644
+index f76fd22e..0b872af1 100644
 --- a/mt76x02.h
 +++ b/mt76x02.h
 @@ -173,7 +173,7 @@ int mt76x02_set_rts_threshold(struct ieee80211_hw *hw, u32 val);
@@ -742,7 +740,7 @@
  irqreturn_t mt76x02_irq_handler(int irq, void *dev_instance);
  void mt76x02_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
 diff --git a/mt76x02_txrx.c b/mt76x02_txrx.c
-index 96fdf42..bf24d3e 100644
+index 96fdf423..bf24d3e0 100644
 --- a/mt76x02_txrx.c
 +++ b/mt76x02_txrx.c
 @@ -33,7 +33,7 @@ void mt76x02_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
@@ -755,7 +753,7 @@
  	struct mt76x02_dev *dev = container_of(mdev, struct mt76x02_dev, mt76);
  	void *rxwi = skb->data;
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 7122322..ac98e01 100644
+index 71223221..ac98e01b 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -376,6 +376,8 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -790,7 +788,7 @@
  				       MT_RXQ_ID(MT_RXQ_EXT),
  				       MT7915_RX_RING_SIZE,
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index bc8da4d..dd87a40 100644
+index db21d83e..1f8e1230 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -217,7 +217,7 @@ static void mt7915_mac_sta_poll(struct mt7915_dev *dev)
@@ -939,10 +937,10 @@
  			return;
  		}
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 1468c3c..5eace9e 100644
+index 674cbc4e..0ae6daf3 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -1704,6 +1704,7 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1723,6 +1723,7 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  		       struct ieee80211_sta *sta, bool enable)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
@@ -950,7 +948,7 @@
  	struct mt7915_sta *msta;
  	struct sk_buff *skb;
  	int ret;
-@@ -1756,6 +1757,8 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1775,6 +1776,8 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  		return ret;
  	}
  out:
@@ -960,7 +958,7 @@
  				     MCU_EXT_CMD(STA_REC_UPDATE), true);
  }
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index b4a3120..08ff556 100644
+index b4a3120d..08ff556e 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -28,6 +28,9 @@ static const u32 mt7915_reg[] = {
@@ -1041,10 +1039,10 @@
  	dev->mt76.dma_dev = wed->dev;
  	mdev->token_size = wed->wlan.token_start;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index fe407c5..e2f0d41 100644
+index 39127922..22399cc7 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -69,6 +69,7 @@
+@@ -78,6 +78,7 @@
  #define MT7915_MAX_STA_TWT_AGRT		8
  #define MT7915_MIN_TWT_DUR 64
  #define MT7915_MAX_QUEUE		(__MT_RXQ_MAX + __MT_MCUQ_MAX + 2)
@@ -1052,7 +1050,7 @@
  
  struct mt7915_vif;
  struct mt7915_sta;
-@@ -531,7 +532,9 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
+@@ -541,7 +542,9 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
  irqreturn_t mt7915_irq_handler(int irq, void *dev_instance);
  u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif);
  u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
@@ -1063,7 +1061,7 @@
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
  int mt7915_eeprom_init(struct mt7915_dev *dev);
-@@ -683,7 +686,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -693,7 +696,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  			  struct mt76_tx_info *tx_info);
  void mt7915_tx_token_put(struct mt7915_dev *dev);
  void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
@@ -1073,7 +1071,7 @@
  void mt7915_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
  void mt7915_stats_work(struct work_struct *work);
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index ffda5f6..08bf84c 100644
+index ffda5f6b..08bf84ce 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -33,6 +33,9 @@ enum reg_rev {
@@ -1119,7 +1117,7 @@
  #define MT_INT_SOURCE_CSR		__REG(INT_SOURCE_CSR)
  #define MT_INT_MASK_CSR			__REG(INT_MASK_CSR)
 diff --git a/mt7921/mac.c b/mt7921/mac.c
-index 4fcadf8..4897940 100644
+index 4fcadf86..4897940b 100644
 --- a/mt7921/mac.c
 +++ b/mt7921/mac.c
 @@ -555,7 +555,7 @@ out:
@@ -1132,7 +1130,7 @@
  	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
  	__le32 *rxd = (__le32 *)skb->data;
 diff --git a/mt7921/mt7921.h b/mt7921/mt7921.h
-index efeb82c..4b2e974 100644
+index efeb82cb..4b2e974b 100644
 --- a/mt7921/mt7921.h
 +++ b/mt7921/mt7921.h
 @@ -388,7 +388,7 @@ int mt7921e_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
@@ -1154,7 +1152,7 @@
  int mt7921e_mac_reset(struct mt7921_dev *dev);
  int mt7921e_mcu_init(struct mt7921_dev *dev);
 diff --git a/mt7921/pci_mac.c b/mt7921/pci_mac.c
-index e180067..ca982eb 100644
+index e1800674..ca982eb5 100644
 --- a/mt7921/pci_mac.c
 +++ b/mt7921/pci_mac.c
 @@ -182,7 +182,7 @@ bool mt7921e_rx_check(struct mt76_dev *mdev, void *data, int len)
@@ -1176,7 +1174,7 @@
  	}
  }
 diff --git a/tx.c b/tx.c
-index ae44afe..bccd206 100644
+index ae44afe0..bccd206e 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -767,3 +767,37 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
@@ -1218,5 +1216,5 @@
 +}
 +EXPORT_SYMBOL_GPL(mt76_rx_token_release);
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/3003-mt76-add-fill-receive-path-to-report-wed-idx.patch b/recipes-kernel/linux-mt76/files/patches/3003-mt76-add-fill-receive-path-to-report-wed-idx.patch
old mode 100755
new mode 100644
index 3e3d8be..19e0e99
--- a/recipes-kernel/linux-mt76/files/patches/3003-mt76-add-fill-receive-path-to-report-wed-idx.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3003-mt76-add-fill-receive-path-to-report-wed-idx.patch
@@ -1,15 +1,15 @@
-From bad890a89e289efc57091c0c08bbfad701147e4e Mon Sep 17 00:00:00 2001
+From 4206557087f5b77b3993818b70885e21d7dcffbb Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 19 May 2022 13:44:42 +0800
-Subject: [PATCH 3/3] add fill receive path to report wed idx
+Subject: [PATCH 3003/3003] mt76: add fill receive path to report wed idx
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
- mt7915/main.c | 19 +++++++++++++++++++
+ .../net/wireless/mediatek/mt76/mt7915/main.c  | 19 +++++++++++++++++++
  1 file changed, 19 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index f1396eed..a0798d46 100644
+index 2e721cd0..cfc522f7 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -1458,6 +1458,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
@@ -45,5 +45,5 @@
  #endif
  };
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/patches.inc b/recipes-kernel/linux-mt76/files/patches/patches.inc
index 5297bc1..5fc8240 100644
--- a/recipes-kernel/linux-mt76/files/patches/patches.inc
+++ b/recipes-kernel/linux-mt76/files/patches/patches.inc
@@ -8,6 +8,7 @@
     file://0008-mt76-common-RF-CR-idx-require-8-bits.patch \
     file://0010-mt76-mt7915-4addr-null-frame-using-fixed-rate-to-suc.patch \
     file://0011-mt76-testmode-use-random-payload-for-tx-packets.patch \
+    file://0012-mt76-mt7915-add-spatial-extension-index-support.patch \
     file://100-Revert-of-net-pass-the-dst-buffer-to-of_get_mac_addr.patch \
     file://1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch \
     file://1002-mt76-mt7915-csi-implement-csi-support.patch \
@@ -19,11 +20,13 @@
     file://1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch \
     file://1111-mt76-testmode-additional-supports.patch \
     file://1112-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch \
-    file://1113-mt76-mt7915-drop-packets-when-TWT-stations-use-more-.patch \
+    file://1113-mt76-mt7915-drop-packets-when-TWT-stations-use.patch \
     file://1114-mt76-airtime-fairness-feature-off-in-mac80211.patch \
     file://1115-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch \
-    file://1116-mt76-mt7915-add-vendor-dump-phy-capa.patch \
+    file://1116-mt76-mt7915-add-phy-capability-vendor-command.patch \
     file://1117-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch \
+    file://1118-mt76-mt7915-implement-bin-file-mode.patch \
+    file://1119-mt76-mt7915-initialize-wcid.patch \
     file://3001-mt76-add-wed-tx-support.patch \
     file://3002-mt76-add-wed-rx-support.patch \
     file://3003-mt76-add-fill-receive-path-to-report-wed-idx.patch \