[rdk-b][common][bsp][Refactor and sync kernel/wifi from Openwrt]

[Description]
Refactor and sync kernel/wifi from Openwrt

[Release-log]
N/A

diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/701-v5.7-net-dsa-Implement-flow-dissection-for-tag_brcm.c.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/701-v5.7-net-dsa-Implement-flow-dissection-for-tag_brcm.c.patch
new file mode 100644
index 0000000..5d7b90f
--- /dev/null
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/701-v5.7-net-dsa-Implement-flow-dissection-for-tag_brcm.c.patch
@@ -0,0 +1,62 @@
+From 52015366e361a88c569550a285c71f72bb095661 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Sun, 22 Mar 2020 14:09:57 -0700
+Subject: [PATCH] net: dsa: Implement flow dissection for tag_brcm.c
+
+Provide a flow_dissect callback which returns the network offset and
+where to find the skb protocol, given the tags structure a common
+function works for both tagging formats that are supported.
+
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Vivien Didelot <vivien.didelot@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/dsa/tag_brcm.c | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+--- a/net/dsa/tag_brcm.c
++++ b/net/dsa/tag_brcm.c
+@@ -144,6 +144,27 @@ static struct sk_buff *brcm_tag_rcv_ll(s
+ 
+ 	return skb;
+ }
++
++static int brcm_tag_flow_dissect(const struct sk_buff *skb, __be16 *proto,
++				 int *offset)
++{
++	/* We have been called on the DSA master network device after
++	 * eth_type_trans() which pulled the Ethernet header already.
++	 * Frames have one of these two layouts:
++	 * -----------------------------------
++	 * | MAC DA | MAC SA | 4b tag | Type | DSA_TAG_PROTO_BRCM
++	 * -----------------------------------
++	 * -----------------------------------
++	 * | 4b tag | MAC DA | MAC SA | Type | DSA_TAG_PROTO_BRCM_PREPEND
++	 * -----------------------------------
++	 * skb->data points 2 bytes before the actual Ethernet type field and
++	 * we have an offset of 4bytes between where skb->data and where the
++	 * payload starts.
++	 */
++	*offset = BRCM_TAG_LEN;
++	*proto = ((__be16 *)skb->data)[1];
++	return 0;
++}
+ #endif
+ 
+ #if IS_ENABLED(CONFIG_NET_DSA_TAG_BRCM)
+@@ -179,6 +200,7 @@ static const struct dsa_device_ops brcm_
+ 	.xmit	= brcm_tag_xmit,
+ 	.rcv	= brcm_tag_rcv,
+ 	.overhead = BRCM_TAG_LEN,
++	.flow_dissect = brcm_tag_flow_dissect,
+ };
+ 
+ DSA_TAG_DRIVER(brcm_netdev_ops);
+@@ -207,6 +229,7 @@ static const struct dsa_device_ops brcm_
+ 	.xmit	= brcm_tag_xmit_prepend,
+ 	.rcv	= brcm_tag_rcv_prepend,
+ 	.overhead = BRCM_TAG_LEN,
++	.flow_dissect = brcm_tag_flow_dissect,
+ };
+ 
+ DSA_TAG_DRIVER(brcm_prepend_netdev_ops);
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/backport-5.4.inc b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/backport-5.4.inc
index 0ea2cb3..8147d61 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/backport-5.4.inc
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/backport-5.4.inc
@@ -198,6 +198,7 @@
     file://610-v5.18-netfilter-flowtable-add-check_dst-in-packet-path.patch \
     file://610-v5.9-net-bridge-clear-bridge-s-private-skb-space-on-xmit.patch \
     file://700-v5.5-net-core-allow-fast-GRO-for-skbs-with-Ethernet-heade.patch \
+    file://701-v5.7-net-dsa-Implement-flow-dissection-for-tag_brcm.c.patch \
     file://716-v5.5-net-sfp-move-fwnode-parsing-into-sfp-bus-layer.patch \
     file://717-v5.5-net-sfp-rework-upstream-interface.patch \
     file://718-v5.5-net-sfp-fix-sfp_bus_put-kernel-documentation.patch \
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/defconfig b/recipes-kernel/linux/linux-mediatek-5.4/generic/defconfig
index d793e06..73faf71 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/defconfig
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/defconfig
@@ -1028,6 +1028,7 @@
 # CONFIG_CRYPTO_DEV_HISI_ZIP is not set
 # CONFIG_CRYPTO_DEV_IMGTEC_HASH is not set
 # CONFIG_CRYPTO_DEV_MARVELL_CESA is not set
+# CONFIG_CRYPTO_DEV_MEDIATEK is not set
 # CONFIG_CRYPTO_DEV_MV_CESA is not set
 # CONFIG_CRYPTO_DEV_MXC_SCC is not set
 # CONFIG_CRYPTO_DEV_MXS_DCP is not set
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/hack-5.4/221-module_exports.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/hack-5.4/221-module_exports.patch
index 47f40ac..446bf53 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/hack-5.4/221-module_exports.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/hack-5.4/221-module_exports.patch
@@ -30,7 +30,7 @@
  /* Align . to a 8 byte boundary equals to maximum function alignment. */
  #define ALIGN_FUNCTION()  . = ALIGN(8)
  
-@@ -407,14 +417,14 @@
+@@ -408,14 +418,14 @@
  	/* Kernel symbol table: Normal symbols */			\
  	__ksymtab         : AT(ADDR(__ksymtab) - LOAD_OFFSET) {		\
  		__start___ksymtab = .;					\
@@ -47,7 +47,7 @@
  		__stop___ksymtab_gpl = .;				\
  	}								\
  									\
-@@ -476,7 +486,7 @@
+@@ -477,7 +487,7 @@
  									\
  	/* Kernel symbol table: strings */				\
          __ksymtab_strings : AT(ADDR(__ksymtab_strings) - LOAD_OFFSET) {	\
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/arch/arm64/boot/dts/mediatek/mt7988-clkitg.dtsi b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/arch/arm64/boot/dts/mediatek/mt7988-clkitg.dtsi
index 1e020d8..14739ac 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/arch/arm64/boot/dts/mediatek/mt7988-clkitg.dtsi
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/arch/arm64/boot/dts/mediatek/mt7988-clkitg.dtsi
@@ -76,8 +76,8 @@
 			<&topckgen CK_TOP_EMMC_400M>,
 			<&topckgen CK_TOP_SPI>,
 			<&topckgen CK_TOP_SPIM_MST>,
-			<&topckgen CK_TOP_NFI1X>,
-			<&topckgen CK_TOP_SPINFI_BCK>,
+			<&system_clk>,
+			<&system_clk>,
 			<&topckgen CK_TOP_I2C_BCK>,
 			<&topckgen CK_TOP_USB_SYS>,
 			<&topckgen CK_TOP_USB_SYS_P1>,
@@ -108,8 +108,8 @@
 			<&topckgen CK_TOP_EMMC_400M_SEL>,
 			<&topckgen CK_TOP_SPI_SEL>,
 			<&topckgen CK_TOP_SPIM_MST_SEL>,
-			<&topckgen CK_TOP_NFI1X_SEL>,
-			<&topckgen CK_TOP_SPINFI_SEL>,
+			<&system_clk>,
+			<&system_clk>,
 			<&system_clk>,
 			<&topckgen CK_TOP_I2C_SEL>,
 			<&topckgen CK_TOP_PCIE_MBIST_250M_SEL>,
@@ -179,8 +179,8 @@
 			<&infracfg CK_INFRA_UART_O0>,
 			<&infracfg CK_INFRA_UART_O1>,
 			<&infracfg CK_INFRA_UART_O2>,
-			<&infracfg CK_INFRA_NFI_O>,
-			<&infracfg CK_INFRA_SPINFI_O>,
+			<&system_clk>,
+			<&system_clk>,
 			<&infracfg CK_INFRA_SPI0_O>,
 			<&infracfg CK_INFRA_SPI1_O>,
 			<&infracfg CK_INFRA_LB_MUX_FRTC>,
@@ -231,17 +231,13 @@
 			<&infracfg_ao CK_INFRA_66M_AP_DMA_BCK>,
 			<&infracfg_ao CK_INFRA_66M_SEJ_BCK>,
 			<&infracfg_ao CK_INFRA_PRE_CK_SEJ_F13M>,
-			<&infracfg_ao CK_INFRA_66M_TRNG>,
 			<&system_clk>,
 			<&infracfg_ao CK_INFRA_I2C_BCK>,
-			<&infracfg_ao CK_INFRA_66M_UART0_PCK>,
-			<&infracfg_ao CK_INFRA_66M_UART1_PCK>,
-			<&infracfg_ao CK_INFRA_66M_UART2_PCK>,
 			<&infracfg_ao CK_INFRA_52M_UART0_CK>,
 			<&infracfg_ao CK_INFRA_52M_UART1_CK>,
 			<&infracfg_ao CK_INFRA_52M_UART2_CK>,
-			<&infracfg_ao CK_INFRA_NFI>,
-			<&infracfg_ao CK_INFRA_SPINFI>,
+			<&system_clk>,
+			<&system_clk>,
 			<&infracfg_ao CK_INFRA_66M_NFI_HCK>,
 			<&infracfg_ao CK_INFRA_104M_SPI0>,
 			<&infracfg_ao CK_INFRA_104M_SPI1>,
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/arch/arm64/boot/dts/mediatek/mt7988.dtsi b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/arch/arm64/boot/dts/mediatek/mt7988.dtsi
index a93f9c2..28e3002 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/arch/arm64/boot/dts/mediatek/mt7988.dtsi
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/arch/arm64/boot/dts/mediatek/mt7988.dtsi
@@ -870,15 +870,17 @@
 	};
 
 	snand: snfi@11001000 {
-		compatible = "mediatek,mt7986-snand";
+		compatible = "mediatek,mt7988-snand";
 		reg = <0 0x11001000 0 0x1000>, <0 0x11002000 0 0x1000>;
 		reg-names = "nfi", "ecc";
 		interrupts = <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>;
-		clocks = <&system_clk>,
-			 <&system_clk>,
-			 <&system_clk>,
-			 <&system_clk>;
-		clock-names = "nfi_clk", "pad_clk", "ecc_clk", "nfi_hclk";
+		clocks = <&infracfg_ao CK_INFRA_SPINFI>,
+			 <&infracfg_ao CK_INFRA_NFI>;
+		clock-names = "pad_clk", "nfi_clk";
+		assigned-clocks = <&topckgen CK_TOP_SPINFI_SEL>,
+				  <&topckgen CK_TOP_NFI1X_SEL>;
+		assigned-clock-parents = <&topckgen CK_TOP_CB_M_D8>,
+					 <&topckgen CK_TOP_CB_M_D8>;
 		#address-cells = <1>;
 		#size-cells = <0>;
 		status = "disabled";
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/clk/mediatek/clk-mt7988.c b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/clk/mediatek/clk-mt7988.c
index 6ccd92f..04a680b 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/clk/mediatek/clk-mt7988.c
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/clk/mediatek/clk-mt7988.c
@@ -728,18 +728,10 @@
 		    "infra_66m_mck", 29),
 	GATE_INFRA1(CK_INFRA_PRE_CK_SEJ_F13M, "infra_pre_ck_sej_f13m",
 		    "infra_ck_f26m", 30),
-	GATE_INFRA1(CK_INFRA_66M_TRNG, "infra_hf_66m_trng", "infra_peri_66m_o",
-		    31),
 	/* INFRA2 */
 	GATE_INFRA2(CK_INFRA_26M_THERM_SYSTEM, "infra_hf_26m_therm_system",
 		    "infra_ck_f26m", 0),
 	GATE_INFRA2(CK_INFRA_I2C_BCK, "infra_i2c_bck", "infra_i2c_o", 1),
-	GATE_INFRA2(CK_INFRA_66M_UART0_PCK, "infra_hf_66m_uart0_pck",
-		    "infra_66m_mck", 3),
-	GATE_INFRA2(CK_INFRA_66M_UART1_PCK, "infra_hf_66m_uart1_pck",
-		    "infra_66m_mck", 4),
-	GATE_INFRA2(CK_INFRA_66M_UART2_PCK, "infra_hf_66m_uart2_pck",
-		    "infra_66m_mck", 5),
 	GATE_INFRA2(CK_INFRA_52M_UART0_CK, "infra_f_52m_uart0",
 		    "infra_mux_uart0_sel", 3),
 	GATE_INFRA2(CK_INFRA_52M_UART1_CK, "infra_f_52m_uart1",
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/mtd/mtk-snand/mtk-snand-ecc.c b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/mtd/mtk-snand/mtk-snand-ecc.c
index 885dec3..450e662 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/mtd/mtk-snand/mtk-snand-ecc.c
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/mtd/mtk-snand/mtk-snand-ecc.c
@@ -99,6 +99,14 @@
 		.errnum_bits = 5,
 		.errnum_shift = 8,
 	},
+	[SNAND_SOC_MT7988] = {
+		.ecc_caps = mt7986_ecc_caps,
+		.num_ecc_cap = ARRAY_SIZE(mt7986_ecc_caps),
+		.regs = mt7986_ecc_regs,
+		.mode_shift = 5,
+		.errnum_bits = 5,
+		.errnum_shift = 8,
+	},
 };
 
 static inline uint32_t ecc_read32(struct mtk_snand *snf, uint32_t reg)
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/mtd/mtk-snand/mtk-snand-mtd.c b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/mtd/mtk-snand/mtk-snand-mtd.c
index e1e0317..09dc34d 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/mtd/mtk-snand/mtk-snand-mtd.c
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/mtd/mtk-snand/mtk-snand-mtd.c
@@ -494,10 +494,17 @@
 	.en_nfi_hclk = true
 };
 
+static struct mtk_snand_of_id mt7988_soc_id = {
+	.soc = SNAND_SOC_MT7988,
+	.en_ecc_clk = false,
+	.en_nfi_hclk = false
+};
+
 static const struct of_device_id mtk_snand_ids[] = {
 	{ .compatible = "mediatek,mt7622-snand", .data = &mt7622_soc_id },
 	{ .compatible = "mediatek,mt7629-snand", .data = &mt7629_soc_id },
 	{ .compatible = "mediatek,mt7986-snand", .data = &mt7986_soc_id },
+	{ .compatible = "mediatek,mt7988-snand", .data = &mt7988_soc_id },
 	{ },
 };
 
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/mtd/mtk-snand/mtk-snand.c b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/mtd/mtk-snand/mtk-snand.c
index a0a50f7..341e8c8 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/mtd/mtk-snand/mtk-snand.c
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/mtd/mtk-snand/mtk-snand.c
@@ -215,6 +215,20 @@
 		.latch_lat = 0,
 		.sample_delay = 40
 	},
+	[SNAND_SOC_MT7988] = {
+		.sector_size = 1024,
+		.max_sectors = 16,
+		.fdm_size = 8,
+		.fdm_ecc_size = 1,
+		.fifo_size = 64,
+		.bbm_swap = true,
+		.empty_page_check = true,
+		.mastersta_mask = NFI_MASTERSTA_MASK_7986,
+		.spare_sizes = mt7986_spare_sizes,
+		.num_spare_size = ARRAY_SIZE(mt7986_spare_sizes),
+		.latch_lat = 0,
+		.sample_delay = 40
+	},
 };
 
 static inline uint32_t nfi_read32(struct mtk_snand *snf, uint32_t reg)
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/mtd/mtk-snand/mtk-snand.h b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/mtd/mtk-snand/mtk-snand.h
index 37bb6e6..a508ea5 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/mtd/mtk-snand/mtk-snand.h
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/mtd/mtk-snand/mtk-snand.h
@@ -19,6 +19,7 @@
 	SNAND_SOC_MT7629,
 	SNAND_SOC_MT7981,
 	SNAND_SOC_MT7986,
+	SNAND_SOC_MT7988,
 
 	__SNAND_SOC_MAX
 };
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_dbg.c b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_dbg.c
index 5ad8645..69e92db 100755
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_dbg.c
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_dbg.c
@@ -265,7 +265,7 @@
 {
 	struct mtk_eth *eth = file->private_data;
 	char buf[32], *token, *p = buf;
-	u32 reg, value, phy;
+	unsigned long reg, value, phy;
 	int ret;
 
 	if (!mt7530_exist(eth))
@@ -314,7 +314,7 @@
 {
 	struct mtk_eth *eth = file->private_data;
 	char buf[32], *token, *p = buf;
-	u32 reg, value, phy;
+	unsigned long reg, value, phy;
 	int ret;
 
 	if (*off != 0)
@@ -766,7 +766,8 @@
 	seq_printf(seq, "cpu next free: %d\n", (int)(ring->next_free - ring->dma));
 	seq_printf(seq, "cpu last free: %d\n", (int)(ring->last_free - ring->dma));
 	for (i = 0; i < MTK_DMA_SIZE; i++) {
-		dma_addr_t tmp = ring->phys + i * eth->soc->txrx.txd_size;
+		dma_addr_t tmp = ring->phys +
+				 i * (dma_addr_t)eth->soc->txrx.txd_size;
 
 		tx_ring = ring->dma + i * eth->soc->txrx.txd_size;
 
@@ -807,7 +808,8 @@
 	int i = 0;
 
 	for (i = 0; i < MTK_DMA_SIZE; i++) {
-		dma_addr_t addr = eth->phy_scratch_ring + i * eth->soc->txrx.txd_size;
+		dma_addr_t addr = eth->phy_scratch_ring +
+				  i * (dma_addr_t)eth->soc->txrx.txd_size;
 
 		hwtx_ring = eth->scratch_ring + i * eth->soc->txrx.txd_size;
 
@@ -1062,6 +1064,9 @@
 		agg_cnt = RX_DMA_GET_AGG_CNT(rxd->rxd2);
 	}
 
+	if (idx >= MTK_HW_LRO_RING_NUM)
+		return;
+
 	agg_size = RX_DMA_GET_PLEN0(rxd->rxd2);
 
 	hw_lro_agg_size_cnt[idx][agg_size / 5000]++;
@@ -1084,6 +1089,9 @@
 		flush_reason = RX_DMA_GET_REV(rxd->rxd2);
 	}
 
+	if (idx >= MTK_HW_LRO_RING_NUM)
+		return;
+
 	if ((flush_reason & 0x7) == MTK_HW_LRO_AGG_FLUSH)
 		hw_lro_agg_flush_cnt[idx]++;
 	else if ((flush_reason & 0x7) == MTK_HW_LRO_AGE_FLUSH)
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_path.c b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_path.c
index 04f3f26..c9b1a43 100755
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_path.c
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_path.c
@@ -204,8 +204,10 @@
 		regmap_read(eth->ethsys, ETHSYS_SYSCFG0, &val);
 		val &= SYSCFG0_SGMII_MASK;
 
-		if ((path == MTK_GMAC1_RGMII && val == SYSCFG0_SGMII_GMAC1) ||
-		    (path == MTK_GMAC2_RGMII && val == SYSCFG0_SGMII_GMAC2))
+		if ((path == MTK_ETH_PATH_GMAC1_RGMII &&
+		     val == SYSCFG0_SGMII_GMAC1) ||
+		    (path == MTK_ETH_PATH_GMAC2_RGMII &&
+		     val == SYSCFG0_SGMII_GMAC2))
 			val = 0;
 		else
 			updated = false;
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index ee9cd47..2d2797d 100755
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -1143,7 +1143,8 @@
 	if (unlikely(dma_mapping_error(eth->dev, dma_addr)))
 		return -ENOMEM;
 
-	phy_ring_tail = eth->phy_scratch_ring + soc->txrx.txd_size * (cnt - 1);
+	phy_ring_tail = eth->phy_scratch_ring +
+			(dma_addr_t)soc->txrx.txd_size * (cnt - 1);
 
 	for (i = 0; i < cnt; i++) {
 		struct mtk_tx_dma_v2 *txd;
@@ -1738,7 +1739,7 @@
 	while (done < budget) {
 		struct net_device *netdev = NULL;
 		unsigned int pktlen;
-		dma_addr_t dma_addr;
+		dma_addr_t dma_addr = 0;
 		int mac = 0;
 
 		if (eth->hwlro)
@@ -2126,7 +2127,8 @@
 					       &ring->phys, GFP_KERNEL);
 	else {
 		ring->dma =  eth->scratch_ring + MTK_DMA_SIZE * sz;
-		ring->phys = eth->phy_scratch_ring + MTK_DMA_SIZE * sz;
+		ring->phys = eth->phy_scratch_ring +
+			     MTK_DMA_SIZE * (dma_addr_t)sz;
 	}
 
 	if (!ring->dma)
@@ -3068,6 +3070,15 @@
 	}
 }
 
+void mtk_set_pse_drop(u32 config)
+{
+	struct mtk_eth *eth = g_eth;
+
+	if (eth)
+		mtk_w32(eth, config, PSE_PPE0_DROP);
+}
+EXPORT_SYMBOL(mtk_set_pse_drop);
+
 static int mtk_open(struct net_device *dev)
 {
 	struct mtk_mac *mac = netdev_priv(dev);
@@ -3396,16 +3407,15 @@
 		MTK_FE_INT_RFIFO_OV | MTK_FE_INT_RFIFO_UF, MTK_FE_INT_ENABLE);
 
 	if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V3)) {
-		/* PSE dummy page mechanism */
-		mtk_w32(eth, PSE_DUMMY_WORK_GDM(1) | PSE_DUMMY_WORK_GDM(2) |
-			PSE_DUMMY_WORK_GDM(3) | DUMMY_PAGE_THR, PSE_DUMY_REQ);
-
 		/* PSE should not drop port1, port8 and port9 packets */
 		mtk_w32(eth, 0x00000302, PSE_NO_DROP_CFG);
 
 		/* PSE should drop p8 and p9 packets when WDMA Rx ring full*/
 		mtk_w32(eth, 0x00000300, PSE_PPE0_DROP);
 
+		/* PSE free buffer drop threshold */
+		mtk_w32(eth, 0x00600009, PSE_IQ_REV(8));
+
 		/* GDM and CDM Threshold */
 		mtk_w32(eth, 0x00000707, MTK_CDMW0_THRES);
 		mtk_w32(eth, 0x00000077, MTK_CDMW1_THRES);
@@ -4027,8 +4037,13 @@
 					         "ethernet:fixed link", mac);
 			}
 
-			if (!of_property_read_string(to_of_node(fixed_node), "label", &label))
-				strcpy(phylink_priv->label, label);
+			if (!of_property_read_string(to_of_node(fixed_node),
+						     "label", &label)) {
+				if (strlen(label) < 16)
+					strcpy(phylink_priv->label, label);
+				else
+					dev_err(eth->dev, "insufficient space for label!\n");
+			}
 
 			phy_np = of_parse_phandle(to_of_node(fixed_node), "phy-handle", 0);
 			if (phy_np) {
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_soc.h b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_soc.h
index 1a11af6..00eec80 100755
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_soc.h
@@ -1601,6 +1601,7 @@
 };
 
 /* the struct describing the SoC. these are declared in the soc_xyz.c files */
+extern struct mtk_eth *g_eth;
 extern const struct of_device_id of_mtk_match[];
 extern u32 mtk_hwlro_stats_ebl;
 
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat.c b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat.c
index b1ecae9..5312a0b 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat.c
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat.c
@@ -408,7 +408,7 @@
 {
 	u32 foe_table_sz;
 	u32 foe_mib_tb_sz;
-	u32 etry_num_cfg;
+	int etry_num_cfg;
 
 	if (ppe_id >= CFG_PPE_NUM)
 		return -EINVAL;
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_debugfs.c b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_debugfs.c
index 32711b3..dd31560 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_debugfs.c
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_debugfs.c
@@ -43,6 +43,7 @@
 static uint8_t *show_cpu_reason(struct sk_buff *skb)
 {
 	static u8 buf[32];
+	int ret;
 
 	switch (skb_hnat_reason(skb)) {
 	case TTL_0:
@@ -91,8 +92,12 @@
 		return "Pre bind\n";
 	}
 
-	sprintf(buf, "CPU Reason Error - %X\n", skb_hnat_entry(skb));
-	return buf;
+	ret = snprintf(buf, sizeof(buf), "CPU Reason Error - %X\n",
+		       skb_hnat_entry(skb));
+	if (ret == strlen(buf))
+		return buf;
+	else
+		return "CPU Reason Error\n";
 }
 
 uint32_t foe_dump_pkt(struct sk_buff *skb)
@@ -829,7 +834,8 @@
 		*packets = cnt_r2 + ((u64)cnt_r3 << 32);
 	} else {
 		*bytes = cnt_r0 + ((u64)(cnt_r1 & 0xffff) << 32);
-		*packets = ((cnt_r1 & 0xffff0000) >> 16) + ((cnt_r2 & 0xffffff) << 16);
+		*packets = ((cnt_r1 & 0xffff0000) >> 16) +
+			   ((u64)(cnt_r2 & 0xffffff) << 16);
 	}
 
 	return 0;
@@ -845,6 +851,9 @@
 	if (ppe_id >= CFG_PPE_NUM)
 		return NULL;
 
+	if (index >= hnat_priv->foe_etry_num)
+		return NULL;
+
 	if (!hnat_priv->data->per_flow_accounting)
 		return NULL;
 
@@ -853,7 +862,7 @@
 
 	h->acct[ppe_id][index].bytes += bytes;
 	h->acct[ppe_id][index].packets += packets;
-	
+
 	if (diff) {
 		diff->bytes = bytes;
 		diff->packets = packets;
@@ -2159,6 +2168,15 @@
 
 	line[length] = '\0';
 
+#if defined(CONFIG_MEDIATEK_NETSYS_V3)
+	if (max_rate > 100000000 || max_rate < 0 ||
+	    min_rate > 100000000 || min_rate < 0)
+#else
+	if (max_rate > 10000000 || max_rate < 0 ||
+	    min_rate > 10000000 || min_rate < 0)
+#endif
+		return -EINVAL;
+
 	while (max_rate > 127) {
 		max_rate /= 10;
 		max_exp++;
@@ -2477,7 +2495,7 @@
 static ssize_t hnat_qos_toggle_write(struct file *file, const char __user *buffer,
 				     size_t count, loff_t *data)
 {
-	char buf[32], tmp[32];
+	char buf[32] = {0}, tmp[32];
 	int len = count;
 	char *p_buf = NULL, *p_token = NULL;
 
@@ -2670,25 +2688,26 @@
 
 	buf[len] = '\0';
 #if defined(CONFIG_MEDIATEK_NETSYS_V3)
-	sscanf(buf, "%d %x %x %x %hx %hx %x %x %x %hx %hx %s %s %x %x %x",
-	       &hash,
-	       &entry.ipv4_hnapt.info_blk1,
-	       &entry.ipv4_hnapt.sip,
-	       &entry.ipv4_hnapt.dip,
-	       &entry.ipv4_hnapt.sport,
-	       &entry.ipv4_hnapt.dport,
-	       &entry.ipv4_hnapt.info_blk2,
-	       &entry.ipv4_hnapt.new_sip,
-	       &entry.ipv4_hnapt.new_dip,
-	       &entry.ipv4_hnapt.new_sport,
-	       &entry.ipv4_hnapt.new_dport,
-	       dmac_str, smac_str, &tport_id, &tops_entry, &cdrt_id);
+	if (sscanf(buf, "%d %x %x %x %hx %hx %x %x %x %hx %hx %s %s %x %x %x",
+		   &hash,
+		   &entry.ipv4_hnapt.info_blk1,
+		   &entry.ipv4_hnapt.sip,
+		   &entry.ipv4_hnapt.dip,
+		   &entry.ipv4_hnapt.sport,
+		   &entry.ipv4_hnapt.dport,
+		   &entry.ipv4_hnapt.info_blk2,
+		   &entry.ipv4_hnapt.new_sip,
+		   &entry.ipv4_hnapt.new_dip,
+		   &entry.ipv4_hnapt.new_sport,
+		   &entry.ipv4_hnapt.new_dport,
+		   dmac_str, smac_str, &tport_id, &tops_entry, &cdrt_id) != 16)
+		return -EFAULT;
 
 	entry.ipv4_hnapt.tport_id = tport_id;
 	entry.ipv4_hnapt.tops_entry = tops_entry;
 	entry.ipv4_hnapt.cdrt_id = cdrt_id;
 
-	if ((hash > 8192) || (hash < -1) || (hash % 4 != 0) ||
+	if ((hash >= hnat_priv->foe_etry_num) || (hash < -1) ||
 	    (tport_id > 16) || (tport_id < 0) ||
 	    (tops_entry > 64) || (tops_entry < 0) ||
 	    (cdrt_id > 255) || (cdrt_id < 0) ||
@@ -2701,24 +2720,25 @@
 	    (entry.ipv4_hnapt.new_dport > 65535) ||
 	    (entry.ipv4_hnapt.new_dport < 0)) {
 		hnat_static_entry_help();
-		return -EINVAL;
+		return -EFAULT;
 	}
 #else
-	sscanf(buf, "%d %x %x %x %hx %hx %x %x %x %hx %hx %s %s",
-	       &hash,
-	       &entry.ipv4_hnapt.info_blk1,
-	       &entry.ipv4_hnapt.sip,
-	       &entry.ipv4_hnapt.dip,
-	       &entry.ipv4_hnapt.sport,
-	       &entry.ipv4_hnapt.dport,
-	       &entry.ipv4_hnapt.info_blk2,
-	       &entry.ipv4_hnapt.new_sip,
-	       &entry.ipv4_hnapt.new_dip,
-	       &entry.ipv4_hnapt.new_sport,
-	       &entry.ipv4_hnapt.new_dport,
-	       dmac_str, smac_str);
+	if (sscanf(buf, "%d %x %x %x %hx %hx %x %x %x %hx %hx %s %s",
+		   &hash,
+		   &entry.ipv4_hnapt.info_blk1,
+		   &entry.ipv4_hnapt.sip,
+		   &entry.ipv4_hnapt.dip,
+		   &entry.ipv4_hnapt.sport,
+		   &entry.ipv4_hnapt.dport,
+		   &entry.ipv4_hnapt.info_blk2,
+		   &entry.ipv4_hnapt.new_sip,
+		   &entry.ipv4_hnapt.new_dip,
+		   &entry.ipv4_hnapt.new_sport,
+		   &entry.ipv4_hnapt.new_dport,
+		   dmac_str, smac_str) != 13)
+		return -EFAULT;
 
-	if ((hash > 8192) || (hash < -1) || (hash % 4 != 0) ||
+	if ((hash >= hnat_priv->foe_etry_num) || (hash < -1) ||
 	    (entry.ipv4_hnapt.sport > 65535) ||
 	    (entry.ipv4_hnapt.sport < 0) ||
 	    (entry.ipv4_hnapt.dport > 65535) ||
@@ -2728,7 +2748,7 @@
 	    (entry.ipv4_hnapt.new_dport > 65535) ||
 	    (entry.ipv4_hnapt.new_dport < 0)) {
 		hnat_static_entry_help();
-		return -EINVAL;
+		return -EFAULT;
 	}
 #endif
 
@@ -2884,7 +2904,11 @@
 		h->regset[i]->nregs = ARRAY_SIZE(hnat_regs);
 		h->regset[i]->base = h->ppe_base[i];
 
-		snprintf(name, sizeof(name), "regdump%ld", i);
+		ret = snprintf(name, sizeof(name), "regdump%ld", i);
+		if (ret != strlen(name)) {
+			ret = -ENOMEM;
+			goto err1;
+		}
 		file = debugfs_create_regset32(name, 0444,
 					       root, h->regset[i]);
 		if (!file) {
@@ -2921,13 +2945,21 @@
 			    &hnat_static_fops);
 
 	for (i = 0; i < hnat_priv->data->num_of_sch; i++) {
-		snprintf(name, sizeof(name), "qdma_sch%ld", i);
+		ret = snprintf(name, sizeof(name), "qdma_sch%ld", i);
+		if (ret != strlen(name)) {
+			ret = -ENOMEM;
+			goto err1;
+		}
 		debugfs_create_file(name, 0444, root, (void *)i,
 				    &hnat_sched_fops);
 	}
 
 	for (i = 0; i < MTK_QDMA_TX_NUM; i++) {
-		snprintf(name, sizeof(name), "qdma_txq%ld", i);
+		ret = snprintf(name, sizeof(name), "qdma_txq%ld", i);
+		if (ret != strlen(name)) {
+			ret = -ENOMEM;
+			goto err1;
+		}
 		debugfs_create_file(name, 0444, root, (void *)i,
 				    &hnat_queue_fops);
 	}
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_mcast.c b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_mcast.c
index 512c845..210b191 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_mcast.c
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_mcast.c
@@ -297,11 +297,11 @@
 	INIT_WORK(&pmcast->work, hnat_mcast_nlmsg_handler);
 	pmcast->queue = create_singlethread_workqueue("ppe_mcast");
 	if (!pmcast->queue)
-		goto err;
+		goto err1;
 
 	pmcast->msock = hnat_mcast_netlink_open(&init_net);
 	if (!pmcast->msock)
-		goto err;
+		goto err2;
 
 	hnat_priv->pmcast = pmcast;
 
@@ -325,11 +325,10 @@
 	cr_set_field(hnat_priv->ppe_base[ppe_id] + PPE_MCAST_PPSE, MC_P3_PPSE, 5);
 
 	return 0;
-err:
+err2:
 	if (pmcast->queue)
 		destroy_workqueue(pmcast->queue);
-	if (pmcast->msock)
-		sock_release(pmcast->msock);
+err1:
 	kfree(pmcast);
 
 	return -1;
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_nf_hook.c b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_nf_hook.c
index ddc8bb5..24350c9 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_nf_hook.c
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_hnat/hnat_nf_hook.c
@@ -421,6 +421,10 @@
 	trace_printk("%s: vlan_prot=0x%x, vlan_tci=%x\n", __func__,
 		     ntohs(skb->vlan_proto), skb->vlan_tci);
 
+	if (skb_hnat_entry(skb) >= hnat_priv->foe_etry_num ||
+	    skb_hnat_ppe(skb) >= CFG_PPE_NUM)
+		return -1;
+
 	dev = get_dev_from_index(skb->vlan_tci & VLAN_VID_MASK);
 
 	if (dev) {
@@ -479,6 +483,10 @@
 	struct foe_entry *entry;
 	struct net_device *dev;
 
+	if (skb_hnat_entry(skb) >= hnat_priv->foe_etry_num ||
+	    skb_hnat_ppe(skb) >= CFG_PPE_NUM)
+		return -1;
+
 	entry = &hnat_priv->foe_table_cpu[skb_hnat_ppe(skb)][skb_hnat_entry(skb)];
 
 	if (IS_IPV4_GRP(entry))
@@ -730,6 +738,9 @@
 mtk_hnat_ipv6_nf_pre_routing(void *priv, struct sk_buff *skb,
 			     const struct nf_hook_state *state)
 {
+	if (!skb)
+		goto drop;
+
 	if (!is_ppe_support_type(skb)) {
 		hnat_set_head_frags(state, skb, 1, hnat_set_alg);
 		return NF_ACCEPT;
@@ -743,8 +754,6 @@
 	if (do_ext2ge_fast_try(state->in, skb)) {
 		if (!do_hnat_ext_to_ge(skb, state->in, __func__))
 			return NF_STOLEN;
-		if (!skb)
-			goto drop;
 		return NF_ACCEPT;
 	}
 
@@ -772,12 +781,14 @@
 #endif
 	return NF_ACCEPT;
 drop:
-	printk_ratelimited(KERN_WARNING
-				"%s:drop (in_dev=%s, iif=0x%x, CB2=0x%x, ppe_hash=0x%x, sport=0x%x, reason=0x%x, alg=0x%x)\n",
-				__func__, state->in->name, skb_hnat_iface(skb),
-				HNAT_SKB_CB2(skb)->magic, skb_hnat_entry(skb),
-				skb_hnat_sport(skb), skb_hnat_reason(skb),
-				skb_hnat_alg(skb));
+	if (skb)
+		printk_ratelimited(KERN_WARNING
+			"%s:drop (in_dev=%s, iif=0x%x, CB2=0x%x, ppe_hash=0x%x,\n"
+			"sport=0x%x, reason=0x%x, alg=0x%x)\n",
+			__func__, state->in->name, skb_hnat_iface(skb),
+			HNAT_SKB_CB2(skb)->magic, skb_hnat_entry(skb),
+			skb_hnat_sport(skb), skb_hnat_reason(skb),
+			skb_hnat_alg(skb));
 
 	return NF_DROP;
 }
@@ -786,6 +797,9 @@
 mtk_hnat_ipv4_nf_pre_routing(void *priv, struct sk_buff *skb,
 			     const struct nf_hook_state *state)
 {
+	if (!skb)
+		goto drop;
+
 	if (!is_ppe_support_type(skb)) {
 		hnat_set_head_frags(state, skb, 1, hnat_set_alg);
 		return NF_ACCEPT;
@@ -799,8 +813,6 @@
 	if (do_ext2ge_fast_try(state->in, skb)) {
 		if (!do_hnat_ext_to_ge(skb, state->in, __func__))
 			return NF_STOLEN;
-		if (!skb)
-			goto drop;
 		return NF_ACCEPT;
 	}
 
@@ -815,12 +827,14 @@
 
 	return NF_ACCEPT;
 drop:
-	printk_ratelimited(KERN_WARNING
-				"%s:drop (in_dev=%s, iif=0x%x, CB2=0x%x, ppe_hash=0x%x, sport=0x%x, reason=0x%x, alg=0x%x)\n",
-				__func__, state->in->name, skb_hnat_iface(skb),
-				HNAT_SKB_CB2(skb)->magic, skb_hnat_entry(skb),
-				skb_hnat_sport(skb), skb_hnat_reason(skb),
-				skb_hnat_alg(skb));
+	if (skb)
+		printk_ratelimited(KERN_WARNING
+			"%s:drop (in_dev=%s, iif=0x%x, CB2=0x%x, ppe_hash=0x%x,\n"
+			"sport=0x%x, reason=0x%x, alg=0x%x)\n",
+			__func__, state->in->name, skb_hnat_iface(skb),
+			HNAT_SKB_CB2(skb)->magic, skb_hnat_entry(skb),
+			skb_hnat_sport(skb), skb_hnat_reason(skb),
+			skb_hnat_alg(skb));
 
 	return NF_DROP;
 }
@@ -831,6 +845,9 @@
 {
 	struct vlan_ethhdr *veth;
 
+	if (!skb)
+		goto drop;
+
 	if (IS_HQOS_MODE && hnat_priv->data->whnat) {
 		veth = (struct vlan_ethhdr *)skb_mac_header(skb);
 
@@ -863,8 +880,6 @@
 
 		if (!do_hnat_ext_to_ge(skb, state->in, __func__))
 			return NF_STOLEN;
-		if (!skb)
-			goto drop;
 		return NF_ACCEPT;
 	}
 
@@ -899,12 +914,14 @@
 #endif
 	return NF_ACCEPT;
 drop:
-	printk_ratelimited(KERN_WARNING
-				"%s:drop (in_dev=%s, iif=0x%x, CB2=0x%x, ppe_hash=0x%x, sport=0x%x, reason=0x%x, alg=0x%x)\n",
-				__func__, state->in->name, skb_hnat_iface(skb),
-				HNAT_SKB_CB2(skb)->magic, skb_hnat_entry(skb),
-				skb_hnat_sport(skb), skb_hnat_reason(skb),
-				skb_hnat_alg(skb));
+	if (skb)
+		printk_ratelimited(KERN_WARNING
+			"%s:drop (in_dev=%s, iif=0x%x, CB2=0x%x, ppe_hash=0x%x,\n"
+			"sport=0x%x, reason=0x%x, alg=0x%x)\n",
+			__func__, state->in->name, skb_hnat_iface(skb),
+			HNAT_SKB_CB2(skb)->magic, skb_hnat_entry(skb),
+			skb_hnat_sport(skb), skb_hnat_reason(skb),
+			skb_hnat_alg(skb));
 
 	return NF_DROP;
 }
@@ -1686,7 +1703,9 @@
 	wmb();
 	memcpy(foe, &entry, sizeof(entry));
 	/*reset statistic for this entry*/
-	if (hnat_priv->data->per_flow_accounting)
+	if (hnat_priv->data->per_flow_accounting &&
+	    skb_hnat_entry(skb) < hnat_priv->foe_etry_num &&
+	    skb_hnat_ppe(skb) < CFG_PPE_NUM)
 		memset(&hnat_priv->acct[skb_hnat_ppe(skb)][skb_hnat_entry(skb)],
 		       0, sizeof(struct mib_entry));
 
@@ -2105,6 +2124,10 @@
 	trace_printk("[%s] case hit, %x-->%s, reason=%x\n", __func__,
 		     skb_hnat_iface(skb), out->name, skb_hnat_reason(skb));
 
+	if (skb_hnat_entry(skb) >= hnat_priv->foe_etry_num ||
+	    skb_hnat_ppe(skb) >= CFG_PPE_NUM)
+		return -1;
+
 	entry = &hnat_priv->foe_table_cpu[skb_hnat_ppe(skb)][skb_hnat_entry(skb)];
 
 	switch (skb_hnat_reason(skb)) {
@@ -2168,6 +2191,10 @@
 	if (unlikely(!skb_hnat_is_hashed(skb)))
 		return NF_ACCEPT;
 
+	if (skb_hnat_entry(skb) >= hnat_priv->foe_etry_num ||
+	    skb_hnat_ppe(skb) >= CFG_PPE_NUM)
+		return NF_ACCEPT;
+
 	entry = &hnat_priv->foe_table_cpu[skb_hnat_ppe(skb)][skb_hnat_entry(skb)];
 	if (skb_hnat_reason(skb) == HIT_UNBIND_RATE_REACH) {
 		ip6h = ipv6_hdr(skb);
@@ -2223,17 +2250,24 @@
 mtk_hnat_ipv6_nf_post_routing(void *priv, struct sk_buff *skb,
 			      const struct nf_hook_state *state)
 {
+	if (!skb)
+		goto drop;
+
 	post_routing_print(skb, state->in, state->out, __func__);
 
 	if (!mtk_hnat_nf_post_routing(skb, state->out, hnat_ipv6_get_nexthop,
 				      __func__))
 		return NF_ACCEPT;
 
-	trace_printk(
-		"%s:drop (iif=0x%x, out_dev=%s, CB2=0x%x, ppe_hash=0x%x, sport=0x%x, reason=0x%x, alg=0x%x)\n",
-		__func__, skb_hnat_iface(skb), state->out->name, HNAT_SKB_CB2(skb)->magic,
-		skb_hnat_entry(skb), skb_hnat_sport(skb), skb_hnat_reason(skb),
-		skb_hnat_alg(skb));
+drop:
+	if (skb)
+		trace_printk(
+			"%s:drop (iif=0x%x, out_dev=%s, CB2=0x%x, ppe_hash=0x%x,\n"
+			"sport=0x%x, reason=0x%x, alg=0x%x)\n",
+			__func__, skb_hnat_iface(skb), state->out->name,
+			HNAT_SKB_CB2(skb)->magic, skb_hnat_entry(skb),
+			skb_hnat_sport(skb), skb_hnat_reason(skb),
+			skb_hnat_alg(skb));
 
 	return NF_DROP;
 }
@@ -2242,17 +2276,24 @@
 mtk_hnat_ipv4_nf_post_routing(void *priv, struct sk_buff *skb,
 			      const struct nf_hook_state *state)
 {
+	if (!skb)
+		goto drop;
+
 	post_routing_print(skb, state->in, state->out, __func__);
 
 	if (!mtk_hnat_nf_post_routing(skb, state->out, hnat_ipv4_get_nexthop,
 				      __func__))
 		return NF_ACCEPT;
 
-	trace_printk(
-		"%s:drop (iif=0x%x, out_dev=%s, CB2=0x%x, ppe_hash=0x%x, sport=0x%x, reason=0x%x, alg=0x%x)\n",
-		__func__, skb_hnat_iface(skb), state->out->name, HNAT_SKB_CB2(skb)->magic,
-		skb_hnat_entry(skb), skb_hnat_sport(skb), skb_hnat_reason(skb),
-		skb_hnat_alg(skb));
+drop:
+	if (skb)
+		trace_printk(
+			"%s:drop (iif=0x%x, out_dev=%s, CB2=0x%x, ppe_hash=0x%x,\n"
+			"sport=0x%x, reason=0x%x, alg=0x%x)\n",
+			__func__, skb_hnat_iface(skb), state->out->name,
+			HNAT_SKB_CB2(skb)->magic, skb_hnat_entry(skb),
+			skb_hnat_sport(skb), skb_hnat_reason(skb),
+			skb_hnat_alg(skb));
 
 	return NF_DROP;
 }
@@ -2287,13 +2328,16 @@
 	}
 
 	return NF_ACCEPT;
+
 drop:
-	printk_ratelimited(KERN_WARNING
-				"%s:drop (in_dev=%s, iif=0x%x, CB2=0x%x, ppe_hash=0x%x, sport=0x%x, reason=0x%x, alg=0x%x)\n",
-				__func__, state->in->name, skb_hnat_iface(skb),
-				HNAT_SKB_CB2(skb)->magic, skb_hnat_entry(skb),
-				skb_hnat_sport(skb), skb_hnat_reason(skb),
-				skb_hnat_alg(skb));
+	if (skb)
+		printk_ratelimited(KERN_WARNING
+			"%s:drop (in_dev=%s, iif=0x%x, CB2=0x%x, ppe_hash=0x%x,\n"
+			"sport=0x%x, reason=0x%x, alg=0x%x)\n",
+			__func__, state->in->name, skb_hnat_iface(skb),
+			HNAT_SKB_CB2(skb)->magic, skb_hnat_entry(skb),
+			skb_hnat_sport(skb), skb_hnat_reason(skb),
+			skb_hnat_alg(skb));
 
 	return NF_DROP;
 }
@@ -2302,16 +2346,23 @@
 mtk_hnat_br_nf_local_out(void *priv, struct sk_buff *skb,
 			 const struct nf_hook_state *state)
 {
+	if (!skb)
+		goto drop;
+
 	post_routing_print(skb, state->in, state->out, __func__);
 
 	if (!mtk_hnat_nf_post_routing(skb, state->out, 0, __func__))
 		return NF_ACCEPT;
 
-	trace_printk(
-		"%s:drop (iif=0x%x, out_dev=%s, CB2=0x%x, ppe_hash=0x%x, sport=0x%x, reason=0x%x, alg=0x%x)\n",
-		__func__, skb_hnat_iface(skb), state->out->name, HNAT_SKB_CB2(skb)->magic,
-		skb_hnat_entry(skb), skb_hnat_sport(skb), skb_hnat_reason(skb),
-		skb_hnat_alg(skb));
+drop:
+	if (skb)
+		trace_printk(
+			"%s:drop (iif=0x%x, out_dev=%s, CB2=0x%x, ppe_hash=0x%x,\n"
+			"sport=0x%x, reason=0x%x, alg=0x%x)\n",
+			__func__, skb_hnat_iface(skb), state->out->name,
+			HNAT_SKB_CB2(skb)->magic, skb_hnat_entry(skb),
+			skb_hnat_sport(skb), skb_hnat_reason(skb),
+			skb_hnat_alg(skb));
 
 	return NF_DROP;
 }
@@ -2327,6 +2378,10 @@
 	if (!skb_hnat_is_hashed(skb))
 		return NF_ACCEPT;
 
+	if (skb_hnat_entry(skb) >= hnat_priv->foe_etry_num ||
+	    skb_hnat_ppe(skb) >= CFG_PPE_NUM)
+		return NF_ACCEPT;
+
 	entry = &hnat_priv->foe_table_cpu[skb_hnat_ppe(skb)][skb_hnat_entry(skb)];
 
 	if (unlikely(skb_headroom(skb) < FOE_INFO_LEN)) {
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_sgmii.c b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_sgmii.c
index d200b16..872c27e 100755
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_sgmii.c
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_sgmii.c
@@ -102,7 +102,7 @@
 {
 	u32 id = mtk_mac2xgmii_id(ss->eth, mac_id);
 
-	if (id < 0 || id >= MTK_MAX_DEVS ||
+	if (id >= MTK_MAX_DEVS ||
 	    !ss->regmap_sgmii[id] || !ss->regmap_pextp[id])
 		return;
 
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_usxgmii.c b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_usxgmii.c
index 7d4a3ed..bdd5231 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_usxgmii.c
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_usxgmii.c
@@ -118,7 +118,7 @@
 {
 	u32 id = mtk_mac2xgmii_id(ss->eth, mac_id);
 
-	if (id < 0 || id >= MTK_MAX_DEVS ||
+	if (id >= MTK_MAX_DEVS ||
 	    !ss->regmap_usxgmii[id] || !ss->regmap_pextp[id])
 		return;
 
@@ -189,7 +189,7 @@
 	unsigned int val;
 	u32 id = mtk_mac2xgmii_id(ss->eth, mac_id);
 
-	if (id < 0 || id >= MTK_MAX_DEVS ||
+	if (id >= MTK_MAX_DEVS ||
 	    !ss->regmap_usxgmii[id] || !ss->regmap_pextp[id])
 		return;
 
@@ -292,7 +292,7 @@
 	struct mtk_eth *eth = ss->eth;
 	u32 id = mtk_mac2xgmii_id(eth, mac_id);
 
-	if (id < 0 || id >= MTK_MAX_DEVS || !eth->toprgu)
+	if (id >= MTK_MAX_DEVS || !eth->toprgu)
 		return;
 
 	switch (mac_id) {
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/include/dt-bindings/clock/mt7988-clk.h b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/include/dt-bindings/clock/mt7988-clk.h
index fb97122..3ba1f16 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/include/dt-bindings/clock/mt7988-clk.h
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/include/dt-bindings/clock/mt7988-clk.h
@@ -109,69 +109,65 @@
 #define CK_INFRA_66M_AP_DMA_BCK		38
 #define CK_INFRA_66M_SEJ_BCK		39
 #define CK_INFRA_PRE_CK_SEJ_F13M	40
-#define CK_INFRA_66M_TRNG		41
-#define CK_INFRA_26M_THERM_SYSTEM	42
-#define CK_INFRA_I2C_BCK		43
-#define CK_INFRA_66M_UART0_PCK		44
-#define CK_INFRA_66M_UART1_PCK		45
-#define CK_INFRA_66M_UART2_PCK		46
-#define CK_INFRA_52M_UART0_CK		47
-#define CK_INFRA_52M_UART1_CK		48
-#define CK_INFRA_52M_UART2_CK		49
-#define CK_INFRA_NFI			50
-#define CK_INFRA_SPINFI			51
-#define CK_INFRA_66M_NFI_HCK		52
-#define CK_INFRA_104M_SPI0		53
-#define CK_INFRA_104M_SPI1		54
-#define CK_INFRA_104M_SPI2_BCK		55
-#define CK_INFRA_66M_SPI0_HCK		56
-#define CK_INFRA_66M_SPI1_HCK		57
-#define CK_INFRA_66M_SPI2_HCK		58
-#define CK_INFRA_66M_FLASHIF_AXI	59
-#define CK_INFRA_RTC			60
-#define CK_INFRA_26M_ADC_BCK		61
-#define CK_INFRA_RC_ADC			62
-#define CK_INFRA_MSDC400		63
-#define CK_INFRA_MSDC2_HCK		64
-#define CK_INFRA_133M_MSDC_0_HCK	65
-#define CK_INFRA_66M_MSDC_0_HCK		66
-#define CK_INFRA_133M_CPUM_BCK		67
-#define CK_INFRA_BIST2FPC		68
-#define CK_INFRA_I2C_X16W_MCK_CK_P1	69
-#define CK_INFRA_I2C_X16W_PCK_CK_P1	70
-#define CK_INFRA_133M_USB_HCK		71
-#define CK_INFRA_133M_USB_HCK_CK_P1	72
-#define CK_INFRA_66M_USB_HCK		73
-#define CK_INFRA_66M_USB_HCK_CK_P1	74
-#define CK_INFRA_USB_SYS		75
-#define CK_INFRA_USB_SYS_CK_P1		76
-#define CK_INFRA_USB_REF		77
-#define CK_INFRA_USB_CK_P1		78
-#define CK_INFRA_USB_FRMCNT		79
-#define CK_INFRA_USB_FRMCNT_CK_P1	80
-#define CK_INFRA_USB_PIPE		81
-#define CK_INFRA_USB_PIPE_CK_P1		82
-#define CK_INFRA_USB_UTMI		83
-#define CK_INFRA_USB_UTMI_CK_P1		84
-#define CK_INFRA_USB_XHCI		85
-#define CK_INFRA_USB_XHCI_CK_P1		86
-#define CK_INFRA_PCIE_GFMUX_TL_P0	87
-#define CK_INFRA_PCIE_GFMUX_TL_P1	88
-#define CK_INFRA_PCIE_GFMUX_TL_P2	89
-#define CK_INFRA_PCIE_GFMUX_TL_P3	90
-#define CK_INFRA_PCIE_PIPE_P0		91
-#define CK_INFRA_PCIE_PIPE_P1		92
-#define CK_INFRA_PCIE_PIPE_P2		93
-#define CK_INFRA_PCIE_PIPE_P3		94
-#define CK_INFRA_133M_PCIE_CK_P0	95
-#define CK_INFRA_133M_PCIE_CK_P1	96
-#define CK_INFRA_133M_PCIE_CK_P2	97
-#define CK_INFRA_133M_PCIE_CK_P3	98
-#define CK_INFRA_PCIE_PERI_26M_CK_P0	99
-#define CK_INFRA_PCIE_PERI_26M_CK_P1	100
-#define CK_INFRA_PCIE_PERI_26M_CK_P2	101
-#define CK_INFRA_PCIE_PERI_26M_CK_P3	102
-#define CLK_INFRA_AO_NR_CLK		103
+#define CK_INFRA_26M_THERM_SYSTEM	41
+#define CK_INFRA_I2C_BCK		42
+#define CK_INFRA_52M_UART0_CK		43
+#define CK_INFRA_52M_UART1_CK		44
+#define CK_INFRA_52M_UART2_CK		45
+#define CK_INFRA_NFI			46
+#define CK_INFRA_SPINFI			47
+#define CK_INFRA_66M_NFI_HCK		48
+#define CK_INFRA_104M_SPI0		49
+#define CK_INFRA_104M_SPI1		50
+#define CK_INFRA_104M_SPI2_BCK		51
+#define CK_INFRA_66M_SPI0_HCK		52
+#define CK_INFRA_66M_SPI1_HCK		53
+#define CK_INFRA_66M_SPI2_HCK		54
+#define CK_INFRA_66M_FLASHIF_AXI	55
+#define CK_INFRA_RTC			56
+#define CK_INFRA_26M_ADC_BCK		57
+#define CK_INFRA_RC_ADC			58
+#define CK_INFRA_MSDC400		59
+#define CK_INFRA_MSDC2_HCK		60
+#define CK_INFRA_133M_MSDC_0_HCK	61
+#define CK_INFRA_66M_MSDC_0_HCK		62
+#define CK_INFRA_133M_CPUM_BCK		63
+#define CK_INFRA_BIST2FPC		64
+#define CK_INFRA_I2C_X16W_MCK_CK_P1	65
+#define CK_INFRA_I2C_X16W_PCK_CK_P1	66
+#define CK_INFRA_133M_USB_HCK		67
+#define CK_INFRA_133M_USB_HCK_CK_P1	68
+#define CK_INFRA_66M_USB_HCK		69
+#define CK_INFRA_66M_USB_HCK_CK_P1	70
+#define CK_INFRA_USB_SYS		71
+#define CK_INFRA_USB_SYS_CK_P1		72
+#define CK_INFRA_USB_REF		73
+#define CK_INFRA_USB_CK_P1		74
+#define CK_INFRA_USB_FRMCNT		75
+#define CK_INFRA_USB_FRMCNT_CK_P1	76
+#define CK_INFRA_USB_PIPE		77
+#define CK_INFRA_USB_PIPE_CK_P1		78
+#define CK_INFRA_USB_UTMI		79
+#define CK_INFRA_USB_UTMI_CK_P1		80
+#define CK_INFRA_USB_XHCI		81
+#define CK_INFRA_USB_XHCI_CK_P1		82
+#define CK_INFRA_PCIE_GFMUX_TL_P0	83
+#define CK_INFRA_PCIE_GFMUX_TL_P1	84
+#define CK_INFRA_PCIE_GFMUX_TL_P2	85
+#define CK_INFRA_PCIE_GFMUX_TL_P3	86
+#define CK_INFRA_PCIE_PIPE_P0		87
+#define CK_INFRA_PCIE_PIPE_P1		88
+#define CK_INFRA_PCIE_PIPE_P2		89
+#define CK_INFRA_PCIE_PIPE_P3		90
+#define CK_INFRA_133M_PCIE_CK_P0	91
+#define CK_INFRA_133M_PCIE_CK_P1	92
+#define CK_INFRA_133M_PCIE_CK_P2	93
+#define CK_INFRA_133M_PCIE_CK_P3	94
+#define CK_INFRA_PCIE_PERI_26M_CK_P0	95
+#define CK_INFRA_PCIE_PERI_26M_CK_P1	96
+#define CK_INFRA_PCIE_PERI_26M_CK_P2	97
+#define CK_INFRA_PCIE_PERI_26M_CK_P3	98
+#define CLK_INFRA_AO_NR_CLK		99
 
 /* TOPCKGEN */
 
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9993-add-wed.patch b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9993-add-wed.patch
index b3ecebe..2d27d90 100755
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9993-add-wed.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9993-add-wed.patch
@@ -243,7 +243,7 @@
 @@ -1384,6 +1387,7 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
  		struct net_device *netdev;
  		unsigned int pktlen;
- 		dma_addr_t dma_addr;
+ 		dma_addr_t dma_addr = 0;
 +		u32 hash, reason;
  		int mac = 0;
  
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9997-add-wed-rx-support-for-mt7896.patch b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9997-add-wed-rx-support-for-mt7896.patch
index b05f862..053a4da 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9997-add-wed-rx-support-for-mt7896.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9997-add-wed-rx-support-for-mt7896.patch
@@ -8,7 +8,7 @@
  arch/arm64/boot/dts/mediatek/mt7986a.dtsi     |  42 +-
  arch/arm64/boot/dts/mediatek/mt7986b.dtsi     |  42 +-
  drivers/net/ethernet/mediatek/Makefile        |   2 +-
- drivers/net/ethernet/mediatek/mtk_wed.c       | 625 ++++++++++++++++--
+ drivers/net/ethernet/mediatek/mtk_wed.c       | 639 ++++++++++++++++--
  drivers/net/ethernet/mediatek/mtk_wed.h       |  51 ++
  drivers/net/ethernet/mediatek/mtk_wed_ccif.c  | 133 ++++
  drivers/net/ethernet/mediatek/mtk_wed_ccif.h  |  45 ++
@@ -18,7 +18,7 @@
  drivers/net/ethernet/mediatek/mtk_wed_regs.h  | 144 +++-
  drivers/net/ethernet/mediatek/mtk_wed_wo.c    | 564 ++++++++++++++++
  drivers/net/ethernet/mediatek/mtk_wed_wo.h    | 324 +++++++++
- include/linux/soc/mediatek/mtk_wed.h          | 101 ++-
+ include/linux/soc/mediatek/mtk_wed.h          | 126 +++-
  14 files changed, 2796 insertions(+), 75 deletions(-)
  create mode 100644 drivers/net/ethernet/mediatek/mtk_wed_ccif.c
  create mode 100644 drivers/net/ethernet/mediatek/mtk_wed_ccif.h
@@ -280,7 +280,7 @@
 +
 +	mtk_wed_reset(dev, MTK_WED_RESET_WED);
 +
-+	mtk_wed_mcu_send_msg(wo, MODULE_ID_WO, WED_WO_CHANGE_STATE,
++	mtk_wed_mcu_send_msg(wo, MODULE_ID_WO, MTK_WED_WO_CMD_CHANGE_STATE,
 +			     &state, sizeof(state), false);
 +
 +	do {
@@ -369,7 +369,7 @@
 +	dev->rx_buf_ring.desc = desc;
 +	dev->rx_buf_ring.desc_phys = desc_phys;
 +
-+	dev->wlan.init_rx_buf(dev, dev->wlan.rx_pkt);
++	dev->wlan.init_rx_buf(dev, dev->wlan.rx_npkt);
 +	return 0;
 +}
 +
@@ -588,7 +588,7 @@
  	wed_w32(dev, MTK_WED_WPDMA_INT_TRIGGER, 0);
  	wed_w32(dev, MTK_WED_WDMA_INT_TRIGGER, 0);
  	wdma_w32(dev, MTK_WDMA_INT_MASK, 0);
-@@ -417,8 +641,19 @@ mtk_wed_detach(struct mtk_wed_device *dev)
+@@ -417,10 +641,21 @@ mtk_wed_detach(struct mtk_wed_device *dev)
  
  	mtk_wed_reset(dev, MTK_WED_RESET_WED);
  
@@ -606,8 +606,20 @@
 +
 +	mtk_wdma_rx_reset(dev);
  
- 	if (dev->wlan.bus_type == MTK_BUS_TYPE_PCIE) {
+-	if (dev->wlan.bus_type == MTK_BUS_TYPE_PCIE) {
++	if (dev->wlan.bus_type == MTK_WED_BUS_PCIE) {
  		wlan_node = dev->wlan.pci_dev->dev.of_node;
+ 		if (of_dma_is_coherent(wlan_node))
+ 			regmap_update_bits(hw->hifsys, HIFSYS_DMA_AG_MAP,
+@@ -443,7 +678,7 @@ mtk_wed_bus_init(struct mtk_wed_device *dev)
+ {
+ #define PCIE_BASE_ADDR0 0x11280000
+ 
+-	if (dev->wlan.bus_type == MTK_BUS_TYPE_PCIE) {
++	if (dev->wlan.bus_type == MTK_WED_BUS_PCIE) {
+ 		struct device_node *node;
+ 		void __iomem * base_addr;
+ 		u32 value = 0;
 @@ -477,7 +712,6 @@ mtk_wed_bus_init(struct mtk_wed_device *dev)
  		value = wed_r32(dev, MTK_WED_PCIE_CFG_INTM);
  		value = wed_r32(dev, MTK_WED_PCIE_CFG_BASE);
@@ -616,6 +628,15 @@
  		wed_w32(dev, MTK_WED_PCIE_INT_TRIGGER, BIT(24));
  		wed_r32(dev, MTK_WED_PCIE_INT_TRIGGER);
  
+@@ -485,7 +719,7 @@ mtk_wed_bus_init(struct mtk_wed_device *dev)
+ 		value = wed_r32(dev, MTK_WED_PCIE_INT_CTRL);
+ 		wed_set(dev, MTK_WED_PCIE_INT_CTRL,
+ 			MTK_WED_PCIE_INT_CTRL_MSK_EN_POLA);
+-	} else if (dev->wlan.bus_type == MTK_BUS_TYPE_AXI) {
++	} else if (dev->wlan.bus_type == MTK_WED_BUS_AXI) {
+ 		wed_set(dev, MTK_WED_WPDMA_INT_CTRL,
+ 			MTK_WED_WPDMA_INT_CTRL_SIG_SRC |
+ 			FIELD_PREP(MTK_WED_WPDMA_INT_CTRL_SRC_SEL, 0));
 @@ -501,6 +735,9 @@ mtk_wed_set_wpdma(struct mtk_wed_device *dev)
  		wed_w32(dev, MTK_WED_WPDMA_CFG_INT_MASK,  dev->wlan.wpdma_mask);
  		wed_w32(dev, MTK_WED_WPDMA_CFG_TX,  dev->wlan.wpdma_tx);
@@ -636,12 +657,12 @@
 +mtk_wed_rx_bm_hw_init(struct mtk_wed_device *dev)
 +{
 +	wed_w32(dev, MTK_WED_RX_BM_RX_DMAD,
-+		FIELD_PREP(MTK_WED_RX_BM_RX_DMAD_SDL0,  dev->wlan.rx_pkt_size));
++		FIELD_PREP(MTK_WED_RX_BM_RX_DMAD_SDL0,  dev->wlan.rx_size));
 +
 +	wed_w32(dev, MTK_WED_RX_BM_BASE, dev->rx_buf_ring.desc_phys);
 +
 +	wed_w32(dev, MTK_WED_RX_BM_INIT_PTR, MTK_WED_RX_BM_INIT_SW_TAIL |
-+		FIELD_PREP(MTK_WED_RX_BM_SW_TAIL, dev->wlan.rx_pkt));
++		FIELD_PREP(MTK_WED_RX_BM_SW_TAIL, dev->wlan.rx_npkt));
 +
 +	wed_w32(dev, MTK_WED_RX_BM_DYN_ALLOC_TH,
 +		FIELD_PREP(MTK_WED_RX_BM_DYN_ALLOC_TH_H, 0xffff));
@@ -733,7 +754,7 @@
  static void
 -mtk_wed_ring_reset(struct mtk_wdma_desc *desc, int size, int scale)
 +mtk_wed_rx_hw_init(struct mtk_wed_device *dev)
-+{
+ {
 +	wed_w32(dev, MTK_WED_WPDMA_RX_D_RST_IDX,
 +		MTK_WED_WPDMA_RX_D_RST_CRX_IDX |
 +		MTK_WED_WPDMA_RX_D_RST_DRV_IDX);
@@ -760,7 +781,7 @@
 +
 +static void
 +mtk_wed_ring_reset(struct mtk_wdma_desc *desc, int size, int scale, bool tx)
- {
++{
 +	__le32 ctrl;
  	int i;
  
@@ -937,7 +958,7 @@
 +		.wed = 0,
 +	};
 +
-+	return mtk_wed_mcu_send_msg(wo, MODULE_ID_WO, WED_WO_CFG,
++	return mtk_wed_mcu_send_msg(wo, MODULE_ID_WO, MTK_WED_WO_CMD_WED_CFG,
 +				    &req, sizeof(req), true);
 +}
 +
@@ -1014,7 +1035,28 @@
  
  	mtk_wed_dma_enable(dev);
  	dev->running = true;
-@@ -847,9 +1336,17 @@ mtk_wed_attach(struct mtk_wed_device *dev)
+@@ -809,6 +1298,7 @@ mtk_wed_attach(struct mtk_wed_device *dev)
+ 	__releases(RCU)
+ {
+ 	struct mtk_wed_hw *hw;
++	struct device *device;
+ 	u16 ver;
+ 	int ret = 0;
+ 
+@@ -829,6 +1319,12 @@ mtk_wed_attach(struct mtk_wed_device *dev)
+ 		goto out;
+ 	}
+ 
++	device = dev->wlan.bus_type == MTK_WED_BUS_PCIE
++	? &dev->wlan.pci_dev->dev
++	: &dev->wlan.platform_dev->dev;
++	dev_info(device, "attaching wed device %d version %d\n",
++		 hw->index, hw->ver);
++
+ 	dev->hw = hw;
+ 	dev->dev = hw->dev;
+ 	dev->irq = hw->irq;
+@@ -847,9 +1343,17 @@ mtk_wed_attach(struct mtk_wed_device *dev)
  	dev->rev_id = ((dev->ver << 28) | ver << 16);
  
  	ret = mtk_wed_buffer_alloc(dev);
@@ -1035,7 +1077,7 @@
  	}
  
  	mtk_wed_hw_init_early(dev);
-@@ -857,7 +1354,12 @@ mtk_wed_attach(struct mtk_wed_device *dev)
+@@ -857,7 +1361,12 @@ mtk_wed_attach(struct mtk_wed_device *dev)
  	if (dev->ver == MTK_WED_V1)
  		regmap_update_bits(hw->hifsys, HIFSYS_DMA_AG_MAP,
  				   BIT(hw->index), 0);
@@ -1048,7 +1090,7 @@
  out:
  	mutex_unlock(&hw_lock);
  
-@@ -883,10 +1385,10 @@ mtk_wed_tx_ring_setup(struct mtk_wed_device *dev, int idx, void __iomem *regs)
+@@ -883,10 +1392,10 @@ mtk_wed_tx_ring_setup(struct mtk_wed_device *dev, int idx, void __iomem *regs)
  
  	BUG_ON(idx > ARRAY_SIZE(dev->tx_ring));
  
@@ -1061,7 +1103,7 @@
  		return -ENOMEM;
  
  	ring->reg_base = MTK_WED_RING_TX(idx);
-@@ -933,6 +1435,35 @@ mtk_wed_txfree_ring_setup(struct mtk_wed_device *dev, void __iomem *regs)
+@@ -933,6 +1442,35 @@ mtk_wed_txfree_ring_setup(struct mtk_wed_device *dev, void __iomem *regs)
  	return 0;
  }
  
@@ -1097,7 +1139,7 @@
  static u32
  mtk_wed_irq_get(struct mtk_wed_device *dev, u32 mask)
  {
-@@ -1020,6 +1551,8 @@ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth,
+@@ -1020,6 +1558,8 @@ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth,
  		.attach = mtk_wed_attach,
  		.tx_ring_setup = mtk_wed_tx_ring_setup,
  		.txfree_ring_setup = mtk_wed_txfree_ring_setup,
@@ -1106,7 +1148,7 @@
  		.start = mtk_wed_start,
  		.stop = mtk_wed_stop,
  		.reset_dma = mtk_wed_reset_dma,
-@@ -1028,6 +1561,7 @@ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth,
+@@ -1028,6 +1568,7 @@ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth,
  		.irq_get = mtk_wed_irq_get,
  		.irq_set_mask = mtk_wed_irq_set_mask,
  		.detach = mtk_wed_detach,
@@ -1114,7 +1156,15 @@
  	};
  	struct device_node *eth_np = eth->dev->of_node;
  	struct platform_device *pdev;
-@@ -1083,6 +1617,7 @@ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth,
+@@ -1067,6 +1608,7 @@ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth,
+ 	hw->wdma_phy = wdma_phy;
+ 	hw->index = index;
+ 	hw->irq = irq;
++	hw->ver = MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2) ? 2 : 1;
+ 
+ 	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
+ 		hw->mirror = syscon_regmap_lookup_by_phandle(eth_np,
+@@ -1083,6 +1625,7 @@ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth,
  			regmap_write(hw->mirror, 0, 0);
  			regmap_write(hw->mirror, 4, 0);
  		}
@@ -1227,7 +1277,7 @@
  #endif
 diff --git a/drivers/net/ethernet/mediatek/mtk_wed_ccif.c b/drivers/net/ethernet/mediatek/mtk_wed_ccif.c
 new file mode 100644
-index 0000000..22ef337
+index 0000000..951278b
 --- /dev/null
 +++ b/drivers/net/ethernet/mediatek/mtk_wed_ccif.c
 @@ -0,0 +1,133 @@
@@ -1558,7 +1608,7 @@
  }
 diff --git a/drivers/net/ethernet/mediatek/mtk_wed_mcu.c b/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
 new file mode 100644
-index 0000000..723bdfd
+index 0000000..96e30a3
 --- /dev/null
 +++ b/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
 @@ -0,0 +1,586 @@
@@ -1711,7 +1761,7 @@
 +	req.arg0 = (u32)exp->phys;
 +	req.arg1 = (u32)exp->log_size;
 +
-+	return mtk_wed_mcu_send_msg(wo, MODULE_ID_WO, WED_WO_EXCEPTION_INIT,
++	return mtk_wed_mcu_send_msg(wo, MODULE_ID_WO, MTK_WED_WO_CMD_EXCEPTION_INIT,
 +				    &req, sizeof(req), false);
 +
 +free:
@@ -1742,7 +1792,7 @@
 +	struct mtk_wed_device *wed = wo->hw->wed_dev;
 +	struct wed_cmd_hdr *hdr = (struct wed_cmd_hdr *)skb->data;
 +	struct wed_wo_log *record;
-+	struct wo_cmd_rxcnt_t *rxcnt;
++	struct mtk_wed_wo_rx_stats *rxcnt;
 +	char *msg = (char *)(skb->data + sizeof(struct wed_cmd_hdr));
 +	u16 msg_len = skb->len - sizeof(struct wed_cmd_hdr);
 +	u32 i, cnt = 0;
@@ -1770,11 +1820,11 @@
 +		break;
 +	case WO_EVT_RXCNT_INFO:
 +		cnt = *(u32 *)msg;
-+		rxcnt = (struct wo_cmd_rxcnt_t *)((u32 *)msg+1);
++		rxcnt = (struct mtk_wed_wo_rx_stats *)((u32 *)msg+1);
 +
 +		for (i = 0; i < cnt; i++)
-+			if (wed->wlan.update_wo_rxcnt)
-+				wed->wlan.update_wo_rxcnt(wed, &rxcnt[i]);
++			if (wed->wlan.update_wo_rx_stats)
++				wed->wlan.update_wo_rx_stats(wed, &rxcnt[i]);
 +		break;
 +	default:
 +		break;
@@ -1948,7 +1998,7 @@
 +{
 +	struct mtk_wed_device *wed = wo->hw->wed_dev;
 +	struct wed_cmd_hdr  *hdr;
-+	struct wo_cmd_rxcnt_t *rxcnt = NULL;
++	struct mtk_wed_wo_rx_stats *rxcnt = NULL;
 +	u32 i, cnt = 0;
 +
 +	if (!skb) {
@@ -1967,13 +2017,13 @@
 +	skb_pull(skb, sizeof(struct wed_cmd_hdr));
 +
 +	switch (cmd) {
-+	case WED_WO_RXCNT_INFO:
++	case MTK_WED_WO_CMD_RXCNT_INFO:
 +		cnt = *(u32 *)skb->data;
-+		rxcnt = (struct wo_cmd_rxcnt_t *)((u32 *)skb->data+1);
++		rxcnt = (struct mtk_wed_wo_rx_stats *)((u32 *)skb->data+1);
 +
 +		for (i = 0; i < cnt; i++)
-+			if (wed->wlan.update_wo_rxcnt)
-+				wed->wlan.update_wo_rxcnt(wed, &rxcnt[i]);
++			if (wed->wlan.update_wo_rx_stats)
++				wed->wlan.update_wo_rx_stats(wed, &rxcnt[i]);
 +		break;
 +	default:
 +		break;
@@ -2057,22 +2107,22 @@
 +	cmd = input[0];
 +	if (input_total == 1 && cmd) {
 +		if (strncmp(cmd, "bainfo", strlen(cmd)) == 0) {
-+			cmd_id = WED_WO_BA_INFO_DUMP;
++			cmd_id = MTK_WED_WO_CMD_BA_INFO_DUMP;
 +		} else if (strncmp(cmd, "bactrl", strlen(cmd)) == 0) {
-+			cmd_id = WED_WO_BA_CTRL_DUMP;
++			cmd_id = MTK_WED_WO_CMD_BA_CTRL_DUMP;
 +		} else if (strncmp(cmd, "fbcmdq", strlen(cmd)) == 0) {
-+			cmd_id = WED_WO_FBCMD_Q_DUMP;
++			cmd_id = MTK_WED_WO_CMD_FBCMD_Q_DUMP;
 +		} else if (strncmp(cmd, "logflush", strlen(cmd)) == 0) {
-+			cmd_id = WED_WO_LOG_FLUSH;
++			cmd_id = MTK_WED_WO_CMD_LOG_FLUSH;
 +		} else if (strncmp(cmd, "cpustat.dump", strlen(cmd)) == 0) {
-+			cmd_id = WED_WO_CPU_STATS_DUMP;
++			cmd_id = MTK_WED_WO_CMD_CPU_STATS_DUMP;
 +		} else if (strncmp(cmd, "state", strlen(cmd)) == 0) {
-+			cmd_id = WED_WO_RX_STAT;
++			cmd_id = MTK_WED_WO_CMD_WED_RX_STAT;
 +		} else if (strncmp(cmd, "prof_hit_dump", strlen(cmd)) == 0) {
 +			//wo_profiling_report();
 +			return count;
 +		} else if (strncmp(cmd, "rxcnt_info", strlen(cmd)) == 0) {
-+			cmd_id = WED_WO_RXCNT_INFO;
++			cmd_id = MTK_WED_WO_CMD_RXCNT_INFO;
 +			wait = true;
 +		} else {
 +			pr_info("(%s) unknown comand string(%s)!\n", __func__, cmd);
@@ -2088,23 +2138,23 @@
 +			}
 +		}
 +		if(strncmp(cmd, "devinfo", strlen(cmd)) == 0) {
-+			cmd_id = WED_WO_DEV_INFO_DUMP;
++			cmd_id = MTK_WED_WO_CMD_DEV_INFO_DUMP;
 +		} else if (strncmp(cmd, "bssinfo", strlen(cmd)) == 0) {
-+			cmd_id = WED_WO_BSS_INFO_DUMP;
++			cmd_id = MTK_WED_WO_CMD_BSS_INFO_DUMP;
 +		} else if (strncmp(cmd, "starec", strlen(cmd)) == 0) {
-+			cmd_id = WED_WO_STA_REC_DUMP;
++			cmd_id = MTK_WED_WO_CMD_STA_REC_DUMP;
 +		} else if (strncmp(cmd, "starec_ba", strlen(cmd)) == 0) {
-+			cmd_id = WED_WO_STA_BA_DUMP;
++			cmd_id = MTK_WED_WO_CMD_STA_BA_DUMP;
 +		} else if (strncmp(cmd, "logctrl", strlen(cmd)) == 0) {
-+			cmd_id = WED_WO_FW_LOG_CTRL;
++			cmd_id = MTK_WED_WO_CMD_FW_LOG_CTRL;
 +		} else if (strncmp(cmd, "cpustat.en", strlen(cmd)) == 0) {
-+			cmd_id = WED_WO_CPU_STATS_ENABLE;
++			cmd_id = MTK_WED_WO_CMD_CPU_STATS_ENABLE;
 +		} else if (strncmp(cmd, "prof_conf", strlen(cmd)) == 0) {
-+			cmd_id = WED_WO_PROF_CTRL;
++			cmd_id = MTK_WED_WO_CMD_PROF_CTRL;
 +		} else if (strncmp(cmd, "rxcnt_ctrl", strlen(cmd)) == 0) {
-+			cmd_id = WED_WO_RXCNT_CTRL;
++			cmd_id = MTK_WED_WO_CMD_RXCNT_CTRL;
 +		} else if (strncmp(cmd, "dbg_set", strlen(cmd)) == 0) {
-+			cmd_id = WED_WO_DBG_INFO;
++			cmd_id = MTK_WED_WO_CMD_DBG_INFO;
 +		}
 +	} else {
 +		dev_info(hw->dev, "usage: echo cmd='cmd_str' > wo_write\n");
@@ -2150,7 +2200,7 @@
 +
 diff --git a/drivers/net/ethernet/mediatek/mtk_wed_mcu.h b/drivers/net/ethernet/mediatek/mtk_wed_mcu.h
 new file mode 100644
-index 0000000..6a5ac76
+index 0000000..19e1199
 --- /dev/null
 +++ b/drivers/net/ethernet/mediatek/mtk_wed_mcu.h
 @@ -0,0 +1,96 @@
@@ -2507,7 +2557,7 @@
  #endif
 diff --git a/drivers/net/ethernet/mediatek/mtk_wed_wo.c b/drivers/net/ethernet/mediatek/mtk_wed_wo.c
 new file mode 100644
-index 0000000..8434272
+index 0000000..54b7787
 --- /dev/null
 +++ b/drivers/net/ethernet/mediatek/mtk_wed_wo.c
 @@ -0,0 +1,564 @@
@@ -3077,7 +3127,7 @@
 +}
 diff --git a/drivers/net/ethernet/mediatek/mtk_wed_wo.h b/drivers/net/ethernet/mediatek/mtk_wed_wo.h
 new file mode 100644
-index 0000000..5824f39
+index 0000000..548b38e
 --- /dev/null
 +++ b/drivers/net/ethernet/mediatek/mtk_wed_wo.h
 @@ -0,0 +1,324 @@
@@ -3406,47 +3456,64 @@
 +#endif
 +
 diff --git a/include/linux/soc/mediatek/mtk_wed.h b/include/linux/soc/mediatek/mtk_wed.h
-index e914cb4..cfa1120 100644
+index e914cb4..e8fca31 100644
 --- a/include/linux/soc/mediatek/mtk_wed.h
 +++ b/include/linux/soc/mediatek/mtk_wed.h
-@@ -7,6 +7,36 @@
+@@ -6,7 +6,39 @@
+ #include <linux/regmap.h>
  #include <linux/pci.h>
  
++#define WED_WO_STA_REC			0x6
++
  #define MTK_WED_TX_QUEUES		2
 +#define MTK_WED_RX_QUEUES		2
 +
-+enum wo_cmd_id {
-+	WED_WO_CFG = 0,
-+	WED_WO_RX_STAT,
-+	WED_WO_RRO_SER,
-+	WED_WO_DBG_INFO,
-+	WED_WO_DEV_INFO,
-+	WED_WO_BSS_INFO,
-+	WED_WO_STA_REC,
-+	WED_WO_DEV_INFO_DUMP,
-+	WED_WO_BSS_INFO_DUMP,
-+	WED_WO_STA_REC_DUMP,
-+	WED_WO_BA_INFO_DUMP,
-+	WED_WO_FBCMD_Q_DUMP,
-+	WED_WO_FW_LOG_CTRL,
-+	WED_WO_LOG_FLUSH,
-+	WED_WO_CHANGE_STATE,
-+	WED_WO_CPU_STATS_ENABLE,
-+	WED_WO_CPU_STATS_DUMP,
-+	WED_WO_EXCEPTION_INIT,
-+	WED_WO_PROF_CTRL,
-+	WED_WO_STA_BA_DUMP,
-+	WED_WO_BA_CTRL_DUMP,
-+	WED_WO_RXCNT_CTRL,
-+	WED_WO_RXCNT_INFO,
-+	WED_WO_SET_CAP,
-+	WED_WO_CCIF_RING_DUMP,
-+	WED_WO_WED_END
++enum mtk_wed_wo_cmd {
++	MTK_WED_WO_CMD_WED_CFG,
++	MTK_WED_WO_CMD_WED_RX_STAT,
++	MTK_WED_WO_CMD_RRO_SER,
++	MTK_WED_WO_CMD_DBG_INFO,
++	MTK_WED_WO_CMD_DEV_INFO,
++	MTK_WED_WO_CMD_BSS_INFO,
++	MTK_WED_WO_CMD_STA_REC,
++	MTK_WED_WO_CMD_DEV_INFO_DUMP,
++	MTK_WED_WO_CMD_BSS_INFO_DUMP,
++	MTK_WED_WO_CMD_STA_REC_DUMP,
++	MTK_WED_WO_CMD_BA_INFO_DUMP,
++	MTK_WED_WO_CMD_FBCMD_Q_DUMP,
++	MTK_WED_WO_CMD_FW_LOG_CTRL,
++	MTK_WED_WO_CMD_LOG_FLUSH,
++	MTK_WED_WO_CMD_CHANGE_STATE,
++	MTK_WED_WO_CMD_CPU_STATS_ENABLE,
++	MTK_WED_WO_CMD_CPU_STATS_DUMP,
++	MTK_WED_WO_CMD_EXCEPTION_INIT,
++	MTK_WED_WO_CMD_PROF_CTRL,
++	MTK_WED_WO_CMD_STA_BA_DUMP,
++	MTK_WED_WO_CMD_BA_CTRL_DUMP,
++	MTK_WED_WO_CMD_RXCNT_CTRL,
++	MTK_WED_WO_CMD_RXCNT_INFO,
++	MTK_WED_WO_CMD_SET_CAP,
++	MTK_WED_WO_CMD_CCIF_RING_DUMP,
++	MTK_WED_WO_CMD_WED_END
 +};
  
  enum {
  	MTK_NO_WED,
-@@ -33,6 +63,33 @@ struct mtk_wed_ring {
+@@ -15,10 +47,9 @@ enum {
+ 	MTK_WED_VMAX
+ };
+ 
+-enum {
+-	MTK_BUS_TYPE_PCIE,
+-	MTK_BUS_TYPE_AXI,
+-	MTK_BUS_TYPE_MAX
++enum mtk_wed_bus_tye {
++	MTK_WED_BUS_PCIE,
++	MTK_WED_BUS_AXI,
+ };
+ 
+ struct mtk_wed_hw;
+@@ -33,6 +64,33 @@ struct mtk_wed_ring {
  	void __iomem *wpdma;
  };
  
@@ -3468,19 +3535,19 @@
 +	dma_addr_t desc_phys;
 +};
 +
-+struct wo_cmd_rxcnt_t {
-+	u16 wlan_idx;
-+	u16 tid;
-+	u32 rx_pkt_cnt;
-+	u32 rx_byte_cnt;
-+	u32 rx_err_cnt;
-+	u32 rx_drop_cnt;
++struct mtk_wed_wo_rx_stats {
++	__le16 wlan_idx;
++	__le16 tid;
++	__le32 rx_pkt_cnt;
++	__le32 rx_byte_cnt;
++	__le32 rx_err_cnt;
++	__le32 rx_drop_cnt;
 +};
 +
  struct mtk_wed_device {
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
  	const struct mtk_wed_ops *ops;
-@@ -47,37 +104,56 @@ struct mtk_wed_device {
+@@ -47,37 +105,64 @@ struct mtk_wed_device {
  	struct mtk_wed_ring tx_ring[MTK_WED_TX_QUEUES];
  	struct mtk_wed_ring txfree_ring;
  	struct mtk_wed_ring tx_wdma[MTK_WED_TX_QUEUES];
@@ -3488,15 +3555,18 @@
 +	struct mtk_wed_ring rx_wdma[MTK_WED_RX_QUEUES];
 +
 +	struct dma_buf buf_ring;
-+	struct dma_entry rx_buf_ring;
-+	struct page_frag_cache rx_page;
  
  	struct {
--		int size;
+ 		int size;
 -		void **pages;
 -		struct mtk_wdma_desc *desc;
--		dma_addr_t desc_phys;
++		struct page_frag_cache rx_page;
++		struct mtk_rxbm_desc *desc;
+ 		dma_addr_t desc_phys;
 -	} buf_ring;
++	} rx_buf_ring;
++
++	struct {
 +		struct mtk_wed_ring rro_ring;
 +		void __iomem *rro_desc;
 +		dma_addr_t miod_desc_phys;
@@ -3506,7 +3576,11 @@
  
  	/* filled by driver: */
  	struct {
- 		struct pci_dev *pci_dev;
+-		struct pci_dev *pci_dev;
++		union {
++			struct platform_device *platform_dev;
++			struct pci_dev *pci_dev;
++		};
  		void __iomem *base;
  		u32 bus_type;
 +		u32 phy_base;
@@ -3526,8 +3600,8 @@
  		u16 token_start;
  		unsigned int nbuf;
 +		unsigned int rx_nbuf;
-+		unsigned int rx_pkt;
-+		unsigned int rx_pkt_size;
++		unsigned int rx_npkt;
++		unsigned int rx_size;
  
  		bool wcid_512;
  
@@ -3537,12 +3611,12 @@
 +		u32 (*init_rx_buf)(struct mtk_wed_device *wed,
 +				   int pkt_num);
 +		void (*release_rx_buf)(struct mtk_wed_device *wed);
-+		void (*update_wo_rxcnt)(struct  mtk_wed_device *wed,
-+				struct wo_cmd_rxcnt_t *rxcnt);
++		void (*update_wo_rx_stats)(struct mtk_wed_device *wed,
++					   struct mtk_wed_wo_rx_stats *stats);
  	} wlan;
  #endif
  };
-@@ -88,6 +164,10 @@ struct mtk_wed_ops {
+@@ -88,6 +173,10 @@ struct mtk_wed_ops {
  			     void __iomem *regs);
  	int (*txfree_ring_setup)(struct mtk_wed_device *dev,
  				 void __iomem *regs);
@@ -3553,7 +3627,7 @@
  	void (*detach)(struct mtk_wed_device *dev);
  
  	void (*stop)(struct mtk_wed_device *dev);
-@@ -99,6 +179,8 @@ struct mtk_wed_ops {
+@@ -99,6 +188,8 @@ struct mtk_wed_ops {
  
  	u32 (*irq_get)(struct mtk_wed_device *dev, u32 mask);
  	void (*irq_set_mask)(struct mtk_wed_device *dev, u32 mask);
@@ -3562,7 +3636,24 @@
  };
  
  extern const struct mtk_wed_ops __rcu *mtk_soc_wed_ops;
-@@ -131,6 +213,10 @@ mtk_wed_device_attach(struct mtk_wed_device *dev)
+@@ -123,6 +214,16 @@ mtk_wed_device_attach(struct mtk_wed_device *dev)
+ 	return ret;
+ }
+ 
++static inline bool
++mtk_wed_get_rx_capa(struct mtk_wed_device *dev)
++{
++#ifdef CONFIG_NET_MEDIATEK_SOC_WED
++	return dev->ver != 1;
++#else
++	return false;
++#endif
++}
++
+ #ifdef CONFIG_NET_MEDIATEK_SOC_WED
+ #define mtk_wed_device_active(_dev) !!(_dev)->ops
+ #define mtk_wed_device_detach(_dev) (_dev)->ops->detach(_dev)
+@@ -131,6 +232,10 @@ mtk_wed_device_attach(struct mtk_wed_device *dev)
  	(_dev)->ops->tx_ring_setup(_dev, _ring, _regs)
  #define mtk_wed_device_txfree_ring_setup(_dev, _regs) \
  	(_dev)->ops->txfree_ring_setup(_dev, _regs)
@@ -3573,7 +3664,7 @@
  #define mtk_wed_device_reg_read(_dev, _reg) \
  	(_dev)->ops->reg_read(_dev, _reg)
  #define mtk_wed_device_reg_write(_dev, _reg, _val) \
-@@ -139,6 +225,8 @@ mtk_wed_device_attach(struct mtk_wed_device *dev)
+@@ -139,6 +244,8 @@ mtk_wed_device_attach(struct mtk_wed_device *dev)
  	(_dev)->ops->irq_get(_dev, _mask)
  #define mtk_wed_device_irq_set_mask(_dev, _mask) \
  	(_dev)->ops->irq_set_mask(_dev, _mask)
@@ -3582,7 +3673,7 @@
  #else
  static inline bool mtk_wed_device_active(struct mtk_wed_device *dev)
  {
-@@ -148,10 +236,13 @@ static inline bool mtk_wed_device_active(struct mtk_wed_device *dev)
+@@ -148,10 +255,13 @@ static inline bool mtk_wed_device_active(struct mtk_wed_device *dev)
  #define mtk_wed_device_start(_dev, _mask) do {} while (0)
  #define mtk_wed_device_tx_ring_setup(_dev, _ring, _regs) -ENODEV
  #define mtk_wed_device_txfree_ring_setup(_dev, _ring, _regs) -ENODEV
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9999-add-wed-ser-support.patch b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9999-add-wed-ser-support.patch
index d97d4c1..df34806 100755
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9999-add-wed-ser-support.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9999-add-wed-ser-support.patch
@@ -201,7 +201,7 @@
  
 -	mtk_wdma_rx_reset(dev);
 -
- 	if (dev->wlan.bus_type == MTK_BUS_TYPE_PCIE) {
+ 	if (dev->wlan.bus_type == MTK_WED_BUS_PCIE) {
  		wlan_node = dev->wlan.pci_dev->dev.of_node;
  		if (of_dma_is_coherent(wlan_node))
 @@ -748,7 +754,7 @@ mtk_wed_hw_init_early(struct mtk_wed_device *dev)
@@ -268,7 +268,7 @@
 +	bool busy = false;
 +	int i;
 +
-+	mtk_wed_mcu_send_msg(wo, MODULE_ID_WO, WED_WO_CHANGE_STATE,
++	mtk_wed_mcu_send_msg(wo, MODULE_ID_WO, MTK_WED_WO_CMD_CHANGE_STATE,
 +			     &state, sizeof(state), true);
 +
 +	wed_clr(dev, MTK_WED_WPDMA_RX_D_GLO_CFG, MTK_WED_WPDMA_RX_D_RX_DRV_EN);
@@ -345,7 +345,7 @@
 +
 +	/* wo change to enable state */
 +	state = WO_STATE_ENABLE;
-+	mtk_wed_mcu_send_msg(wo, MODULE_ID_WO, WED_WO_CHANGE_STATE,
++	mtk_wed_mcu_send_msg(wo, MODULE_ID_WO, MTK_WED_WO_CMD_CHANGE_STATE,
 +			     &state, sizeof(state), true);
 +
 +	/* wed_rx_ring_reset */
@@ -702,12 +702,10 @@
 index 9a9cc1b..31f4a26 100644
 --- a/include/linux/soc/mediatek/mtk_wed.h
 +++ b/include/linux/soc/mediatek/mtk_wed.h
-@@ -114,25 +114,29 @@ struct mtk_wed_device {
- 		u32 (*init_rx_buf)(struct mtk_wed_device *wed,
- 				   int pkt_num);
+@@ -161,23 +161,27 @@ struct mtk_wed_device {
  		void (*release_rx_buf)(struct mtk_wed_device *wed);
- 		void (*update_wo_rxcnt)(struct  mtk_wed_device *wed,
- 				struct wo_cmd_rxcnt_t *rxcnt);
+ 		void (*update_wo_rx_stats)(struct mtk_wed_device *wed,
+ 					   struct mtk_wed_wo_rx_stats *stats);
 +		void (*ser_trigger)(struct mtk_wed_device *wed);
  	} wlan;
 +	struct completion fe_reset_done;
@@ -735,7 +733,7 @@
  	void (*start)(struct mtk_wed_device *dev, u32 irq_mask);
  	void (*reset_dma)(struct mtk_wed_device *dev);
  
-@@ -169,12 +173,13 @@ mtk_wed_device_attach(struct mtk_wed_device *dev)
+@@ -226,12 +230,13 @@ mtk_wed_get_rx_capa(struct mtk_wed_device *dev)
  #define mtk_wed_device_active(_dev) !!(_dev)->ops
  #define mtk_wed_device_detach(_dev) (_dev)->ops->detach(_dev)
  #define mtk_wed_device_start(_dev, _mask) (_dev)->ops->start(_dev, _mask)
@@ -753,7 +751,7 @@
  #define mtk_wed_device_update_msg(_dev, _id, _msg, _len) \
  	(_dev)->ops->msg_update(_dev, _id, _msg, _len)
  #define mtk_wed_device_reg_read(_dev, _reg) \
-@@ -185,6 +190,8 @@ mtk_wed_device_attach(struct mtk_wed_device *dev)
+@@ -242,6 +247,8 @@ mtk_wed_get_rx_capa(struct mtk_wed_device *dev)
  	(_dev)->ops->irq_get(_dev, _mask)
  #define mtk_wed_device_irq_set_mask(_dev, _mask) \
  	(_dev)->ops->irq_set_mask(_dev, _mask)
@@ -762,7 +760,7 @@
  #define mtk_wed_device_ppe_check(_dev, _skb, _reason, _hash) \
  	(_dev)->ops->ppe_check(_dev, _skb, _reason, _hash)
  #else
-@@ -194,14 +201,15 @@ static inline bool mtk_wed_device_active(struct mtk_wed_device *dev)
+@@ -251,14 +258,15 @@ static inline bool mtk_wed_device_active(struct mtk_wed_device *dev)
  }
  #define mtk_wed_device_detach(_dev) do {} while (0)
  #define mtk_wed_device_start(_dev, _mask) do {} while (0)
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/mt7988.cfg b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/mt7988.cfg
index 94fd3d1..c78b0b7 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/mt7988.cfg
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/mt7988.cfg
@@ -3,6 +3,7 @@
 # CONFIG_AIROHA_EN8801SC_PHY is not set
 # CONFIG_AIROHA_EN8801S_PHY is not set
 CONFIG_AQUANTIA_PHY=y
+# CONFIG_AQUANTIA_PHY_MDI_SWAP is not set
 CONFIG_AQUANTIA_PHY_FW_DOWNLOAD=y
 CONFIG_AQUANTIA_PHY_FW_DOWNLOAD_GANG=y
 # CONFIG_AQUANTIA_PHY_FW_DOWNLOAD_SINGLE is not set
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/patches-5.4/0900-bt-mtk-serial-fix.patch b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/patches-5.4/0900-bt-mtk-serial-fix.patch
index 64b5560..a25c845 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/patches-5.4/0900-bt-mtk-serial-fix.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/patches-5.4/0900-bt-mtk-serial-fix.patch
@@ -19,7 +19,7 @@
  	},
  	[PORT_NPCM] = {
  		.name		= "Nuvoton 16550",
-@@ -2612,6 +2612,11 @@ serial8250_do_set_termios(struct uart_po
+@@ -2615,6 +2615,11 @@ serial8250_do_set_termios(struct uart_po
  	unsigned long flags;
  	unsigned int baud, quot, frac = 0;
  
diff --git a/recipes-kernel/linux/linux-mediatek_5.4.bb b/recipes-kernel/linux/linux-mediatek_5.4.bb
index 9a51c17..583f5d5 100644
--- a/recipes-kernel/linux/linux-mediatek_5.4.bb
+++ b/recipes-kernel/linux/linux-mediatek_5.4.bb
@@ -7,8 +7,8 @@
 
 KBRANCH ?= "linux-5.4.y"
 
-LINUX_VERSION ?= "5.4.224"
-SRCREV_machine ?= "771a8acbb84145b943bd608ba376e104ebfa9664"
+LINUX_VERSION ?= "5.4.225"
+SRCREV_machine ?= "4d2a309b5c28a2edc0900542d22fec3a5a22243b"
 KMETA = "kernel-meta"
 SRCREV_meta ?= "feeb59687bc0f054af837a5061f8d413ec7c93e9"
 
diff --git a/recipes-wifi/hostapd/files/patches/99900-hostapd-mtk-Add-hostapd_neighbor_count-and-hostapd_neighbor_ins.patch b/recipes-wifi/hostapd/files/patches/99900-hostapd-mtk-Add-hostapd_neighbor_count-and-hostapd_neighbor_ins.patch
deleted file mode 100644
index e8e8b8c..0000000
--- a/recipes-wifi/hostapd/files/patches/99900-hostapd-mtk-Add-hostapd_neighbor_count-and-hostapd_neighbor_ins.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-From 194a2405c98852358de25d96cb9d1c7c56ea4bdc Mon Sep 17 00:00:00 2001
-From: "howard.hsu" <howard-yh.hsu@mediatek.com>
-Date: Wed, 19 Jan 2022 19:18:07 +0800
-Subject: [PATCH 99900/99917] Add hostapd_neighbor_count() and
- hostapd_neighbor_insert_buffer ()
-
-The first function can count the number of neighbor report in neighbore report
-database. The second can iterate neighbor report database to build up neighbor
-report data.
----
- src/ap/neighbor_db.c | 32 ++++++++++++++++++++++++++++++++
- src/ap/neighbor_db.h |  3 +++
- 2 files changed, 35 insertions(+)
-
-diff --git a/src/ap/neighbor_db.c b/src/ap/neighbor_db.c
-index 52f25eb..c121390 100644
---- a/src/ap/neighbor_db.c
-+++ b/src/ap/neighbor_db.c
-@@ -89,6 +89,38 @@ int hostapd_neighbor_show(struct hostapd_data *hapd, char *buf, size_t buflen)
- }
- 
- 
-+int hostapd_neighbor_count(struct hostapd_data *hapd)
-+{
-+	struct hostapd_neighbor_entry *nr;
-+	int count = 0;
-+
-+	dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
-+			 list) {
-+		count++;
-+	}
-+	return count;
-+}
-+
-+
-+int hostapd_neighbor_insert_buffer(struct hostapd_data *hapd, char *buf,
-+        size_t buflen)
-+{
-+	struct hostapd_neighbor_entry *nr;
-+	char *pos = buf;
-+
-+	dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
-+			 list) {
-+		/* For neighbor report IE, we only need bssid and nr*/
-+		*pos++ = WLAN_EID_NEIGHBOR_REPORT;
-+		*pos++ = wpabuf_len(nr->nr);
-+		os_memcpy(pos, wpabuf_head(nr->nr), wpabuf_len(nr->nr));
-+		pos += wpabuf_len(nr->nr);
-+	}
-+
-+	return pos - buf;
-+}
-+
-+
- static void hostapd_neighbor_clear_entry(struct hostapd_neighbor_entry *nr)
- {
- 	wpabuf_free(nr->nr);
-diff --git a/src/ap/neighbor_db.h b/src/ap/neighbor_db.h
-index 992671b..1ae194d 100644
---- a/src/ap/neighbor_db.h
-+++ b/src/ap/neighbor_db.h
-@@ -24,4 +24,7 @@ int hostapd_neighbor_remove(struct hostapd_data *hapd, const u8 *bssid,
- 			    const struct wpa_ssid_value *ssid);
- void hostapd_free_neighbor_db(struct hostapd_data *hapd);
- 
-+int hostapd_neighbor_count(struct hostapd_data *hapd);
-+int hostapd_neighbor_insert_buffer(struct hostapd_data *hapd, char *buf,
-+        size_t buflen);
- #endif /* NEIGHBOR_DB_H */
--- 
-2.36.1
-
diff --git a/recipes-wifi/hostapd/files/patches/99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch b/recipes-wifi/hostapd/files/patches/99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch
new file mode 100644
index 0000000..28af8ef
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches/99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch
@@ -0,0 +1,475 @@
+From af1bd5256cc764fb222f9809996851ff3d879699 Mon Sep 17 00:00:00 2001
+From: "howard.hsu" <howard-yh.hsu@mediatek.com>
+Date: Wed, 19 Jan 2022 19:18:07 +0800
+Subject: [PATCH 99900/99909] hostapd: mtk: Add neighbor report and BSS
+ Termination for MBO certification
+
+1. Add hostapd_neighbor_count() and hostapd_neighbor_insert_buffer ()
+The first function can count the number of neighbor report in neighbore report
+database. The second can iterate neighbor report database to build up neighbor
+report data.
+
+2. Support including neighbor report elements in ANQP response
+3. Support including neignbor report elements in BTM response
+4. Support configuring BSS Termination TSF by using hostapd_cli command
+5. Disable interface if BSS Termination TSF is set
+6. Add set_send_disassoc_frame_timer() to send disassociate frame
+Function set_disassoc_timer() may fail if key was deleted first. This new
+function will not ask to delete key as set_disassoc_timer() did.
+7. Support including neighbor report elements in BTM request
+8. Add hostapd_neighbor_set_own_report_pref()
+9. Add hostapd_neighbor_set_pref_by_non_pref_chan()
+---
+ hostapd/ctrl_iface.c   |   5 ++
+ src/ap/ap_config.c     |   1 +
+ src/ap/ap_config.h     |   1 +
+ src/ap/ctrl_iface_ap.c |  19 ++++++-
+ src/ap/gas_serv.c      |  29 ++++++++++
+ src/ap/gas_serv.h      |   2 +
+ src/ap/neighbor_db.c   | 119 +++++++++++++++++++++++++++++++++++++++++
+ src/ap/neighbor_db.h   |   9 ++++
+ src/ap/wnm_ap.c        |  72 +++++++++++++++++++++++--
+ 9 files changed, 252 insertions(+), 5 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index a258492..c2a2822 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -1338,6 +1338,11 @@ static int hostapd_ctrl_iface_set(struct hostapd_data *hapd, char *cmd)
+ #endif /* CONFIG_DPP */
+ 	} else if (os_strcasecmp(cmd, "setband") == 0) {
+ 		ret = hostapd_ctrl_iface_set_band(hapd, value);
++	} else if (os_strcasecmp(cmd, "bss_termination_tsf") == 0) {
++		int termination_sec = atoi(value);
++		hapd->conf->bss_termination_tsf = termination_sec;
++		wpa_printf(MSG_DEBUG, "BSS Termination TSF: value = %d",
++                termination_sec);
+ 	} else {
+ 		ret = hostapd_set_iface(hapd->iconf, hapd->conf, cmd, value);
+ 		if (ret)
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index d7a0c7c..4a20eb4 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -170,6 +170,7 @@ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss)
+ 	/* comeback after 10 TUs */
+ 	bss->pasn_comeback_after = 10;
+ #endif /* CONFIG_PASN */
++	bss->bss_termination_tsf = 0;
+ }
+ 
+ 
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index ed3bec7..3f68e76 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -557,6 +557,7 @@ struct hostapd_bss_config {
+ 	int wnm_sleep_mode;
+ 	int wnm_sleep_mode_no_keys;
+ 	int bss_transition;
++	unsigned int bss_termination_tsf;
+ 
+ 	/* IEEE 802.11u - Interworking */
+ 	int interworking;
+diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
+index 96209ce..18bae5c 100644
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -1203,6 +1203,10 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+ 			wpa_printf(MSG_DEBUG, "Invalid bss_term data");
+ 			return -1;
+ 		}
++		if (hapd->conf->bss_termination_tsf) {
++			WPA_PUT_LE64(&bss_term_dur[2], hapd->conf->bss_termination_tsf);
++		}
++
+ 		end++;
+ 		WPA_PUT_LE16(&bss_term_dur[10], atoi(end));
+ 	}
+@@ -1229,14 +1233,25 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+ 		req_mode |= WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT;
+ 	}
+ 
+-	if (os_strstr(cmd, " pref=1"))
++	if (os_strstr(cmd, " pref=1")) {
+ 		req_mode |= WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED;
++		if (nei_len == 0) {
++			// Add neigibor report from neighbor report db to nei_rep buffer
++			nei_len = hostapd_neighbor_insert_buffer (hapd, nei_rep, 1000);
++		}
++	}
+ 	if (os_strstr(cmd, " abridged=1"))
+ 		req_mode |= WNM_BSS_TM_REQ_ABRIDGED;
+-	if (os_strstr(cmd, " disassoc_imminent=1"))
++	if (os_strstr(cmd, " disassoc_imminent=1")) {
+ 		req_mode |= WNM_BSS_TM_REQ_DISASSOC_IMMINENT;
++		/* Set own BSS neighbor report preference value as 0 */
++		hostapd_neighbor_set_own_report_pref(hapd, nei_rep, nei_len, 0);
++	}
++
+ 
+ #ifdef CONFIG_MBO
++	hostapd_neighbor_set_pref_by_non_pref_chan(hapd, sta, nei_rep, nei_len);
++
+ 	pos = os_strstr(cmd, "mbo=");
+ 	if (pos) {
+ 		unsigned int mbo_reason, cell_pref, reassoc_delay;
+diff --git a/src/ap/gas_serv.c b/src/ap/gas_serv.c
+index 90f1577..5845ff8 100644
+--- a/src/ap/gas_serv.c
++++ b/src/ap/gas_serv.c
+@@ -19,6 +19,7 @@
+ #include "dpp_hostapd.h"
+ #include "sta_info.h"
+ #include "gas_serv.h"
++#include "neighbor_db.h"
+ 
+ 
+ #ifdef CONFIG_DPP
+@@ -369,6 +370,24 @@ static void anqp_add_network_auth_type(struct hostapd_data *hapd,
+ 	}
+ }
+ 
++static void anqp_add_neighbor_report(struct hostapd_data *hapd,
++				       struct wpabuf *buf)
++{
++	struct hostapd_neighbor_entry *nr;
++	u8 *len_pos = gas_anqp_add_element(buf, ANQP_NEIGHBOR_REPORT);
++	if (dl_list_empty(&hapd->nr_db)) {
++		wpabuf_put_le16(buf, 0);
++	}
++	else {
++		dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry, list ) {
++			wpabuf_put_u8(buf, WLAN_EID_NEIGHBOR_REPORT);
++			wpabuf_put_u8(buf, wpabuf_len(nr->nr));
++			wpabuf_put_buf(buf, nr->nr);
++		}
++	}
++	gas_anqp_set_element_len(buf, len_pos);
++}
++
+ 
+ static void anqp_add_roaming_consortium(struct hostapd_data *hapd,
+ 					struct wpabuf *buf)
+@@ -986,6 +1005,9 @@ gas_serv_build_gas_resp_payload(struct hostapd_data *hapd,
+ 		len += 1000;
+ 	if (request & ANQP_REQ_ICON_REQUEST)
+ 		len += 65536;
++    if (request & ANQP_REQ_NEIGHBOR_REPORT) {
++        len += (40 * hostapd_neighbor_count(hapd));
++    }
+ #ifdef CONFIG_FILS
+ 	if (request & ANQP_FILS_REALM_INFO)
+ 		len += 2 * dl_list_len(&hapd->conf->fils_realms);
+@@ -1028,6 +1050,8 @@ gas_serv_build_gas_resp_payload(struct hostapd_data *hapd,
+ 		anqp_add_elem(hapd, buf, ANQP_TDLS_CAPABILITY);
+ 	if (request & ANQP_REQ_EMERGENCY_NAI)
+ 		anqp_add_elem(hapd, buf, ANQP_EMERGENCY_NAI);
++	if (request & ANQP_REQ_NEIGHBOR_REPORT)
++		anqp_add_neighbor_report(hapd, buf);
+ 
+ 	for (i = 0; i < num_extra_req; i++) {
+ #ifdef CONFIG_FILS
+@@ -1172,6 +1196,11 @@ static void rx_anqp_query_list_id(struct hostapd_data *hapd, u16 info_id,
+ 			     "Emergency NAI",
+ 			     get_anqp_elem(hapd, info_id) != NULL, qi);
+ 		break;
++	case ANQP_NEIGHBOR_REPORT:
++		set_anqp_req(ANQP_REQ_NEIGHBOR_REPORT,
++			     "Neighbor Report",
++			     get_anqp_elem(hapd, info_id) != NULL, qi);
++		break;
+ 	default:
+ #ifdef CONFIG_FILS
+ 		if (info_id == ANQP_FILS_REALM_INFO &&
+diff --git a/src/ap/gas_serv.h b/src/ap/gas_serv.h
+index 1528af4..d0241f2 100644
+--- a/src/ap/gas_serv.h
++++ b/src/ap/gas_serv.h
+@@ -40,6 +40,8 @@
+ 	(1 << (ANQP_TDLS_CAPABILITY - ANQP_QUERY_LIST))
+ #define ANQP_REQ_EMERGENCY_NAI \
+ 	(1 << (ANQP_EMERGENCY_NAI - ANQP_QUERY_LIST))
++#define ANQP_REQ_NEIGHBOR_REPORT \
++	(1 << (ANQP_NEIGHBOR_REPORT - ANQP_QUERY_LIST))
+ /*
+  * First 15 Hotspot 2.0 vendor specific ANQP-elements can be included in the
+  * optimized bitmap.
+diff --git a/src/ap/neighbor_db.c b/src/ap/neighbor_db.c
+index 52f25eb..9254d09 100644
+--- a/src/ap/neighbor_db.c
++++ b/src/ap/neighbor_db.c
+@@ -89,6 +89,38 @@ int hostapd_neighbor_show(struct hostapd_data *hapd, char *buf, size_t buflen)
+ }
+ 
+ 
++int hostapd_neighbor_count(struct hostapd_data *hapd)
++{
++	struct hostapd_neighbor_entry *nr;
++	int count = 0;
++
++	dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++			 list) {
++		count++;
++	}
++	return count;
++}
++
++
++int hostapd_neighbor_insert_buffer(struct hostapd_data *hapd, char *buf,
++        size_t buflen)
++{
++	struct hostapd_neighbor_entry *nr;
++	char *pos = buf;
++
++	dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++			 list) {
++		/* For neighbor report IE, we only need bssid and nr*/
++		*pos++ = WLAN_EID_NEIGHBOR_REPORT;
++		*pos++ = wpabuf_len(nr->nr);
++		os_memcpy(pos, wpabuf_head(nr->nr), wpabuf_len(nr->nr));
++		pos += wpabuf_len(nr->nr);
++	}
++
++	return pos - buf;
++}
++
++
+ static void hostapd_neighbor_clear_entry(struct hostapd_neighbor_entry *nr)
+ {
+ 	wpabuf_free(nr->nr);
+@@ -325,3 +357,90 @@ void hostapd_neighbor_set_own_report(struct hostapd_data *hapd)
+ 	wpabuf_free(nr);
+ #endif /* NEED_AP_MLME */
+ }
++
++
++void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_buf,
++			 size_t buflen, const int pref)
++{
++	struct hostapd_neighbor_entry *nr;
++	char *pos, *next_nr;
++
++	pos = nei_buf;
++	next_nr = nei_buf;
++
++	dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++			 list) {
++		pos = next_nr;
++		next_nr = pos + 2 + wpabuf_len(nr->nr);
++		/* Shift 2 bytes for Element ID and Neighbor report length */
++		pos = pos + 2;
++		if(os_memcmp(pos, hapd->own_addr, ETH_ALEN) == 0) {
++			/* Shift for BSSID + BSSID info + Op_class + channel num + PHY type */
++			pos = pos + 6 + 4 + 1 + 1 + 1;
++
++			/* Iterate Subelement */
++			while (next_nr - pos > 0) {
++				if (*pos == 3) {
++					pos = pos + 2;
++					*pos = pref;
++					return;
++				} else {
++					pos++;
++					int shift_len = *pos++;
++					pos = pos + shift_len;
++				}
++			}
++		}
++	}
++}
++
++#ifdef CONFIG_MBO
++void hostapd_neighbor_set_pref_by_non_pref_chan(struct hostapd_data *hapd,
++			 struct sta_info* sta, char *nei_buf, size_t buflen)
++{
++	struct hostapd_neighbor_entry *nr;
++	struct mbo_non_pref_chan_info *info;
++	u8 i;
++
++	for(info = sta->non_pref_chan; info; info = info->next) {
++		/* Check OP_Class and Channel num */
++		for(i = 0; i < info->num_channels; i++) {
++			char *pos, *next_nr;
++
++			pos = nei_buf;
++			next_nr = nei_buf;
++
++			/* Iterate Neighbor report database */
++			dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++					 list) {
++				pos = next_nr;
++				next_nr = pos + 2 + wpabuf_len(nr->nr);
++				/**
++				 * Shift 12 bytes for Element ID, Neighbor report length,
++				 * BSSID and BSSID info.
++				 */
++				pos = pos + 12;
++				int nr_op_class = *pos++;
++				int nr_channel = *pos;
++				if(info->op_class == nr_op_class && info->channels[i] == nr_channel) {
++					/* Shift for Channel Num + PHY type */
++					pos = pos + 1 + 1;
++
++					// Iterate Subelement
++					while(next_nr - pos > 0) {
++						if(*pos == 3) {
++							pos = pos + 2;
++							*pos = info->pref;
++							break;
++						}else {
++							pos++;
++							int shift_len = *pos++;
++							pos = pos + shift_len;
++						}
++					}
++				}
++			}
++		}
++	}
++}
++#endif
+diff --git a/src/ap/neighbor_db.h b/src/ap/neighbor_db.h
+index 992671b..a1ddc07 100644
+--- a/src/ap/neighbor_db.h
++++ b/src/ap/neighbor_db.h
+@@ -24,4 +24,13 @@ int hostapd_neighbor_remove(struct hostapd_data *hapd, const u8 *bssid,
+ 			    const struct wpa_ssid_value *ssid);
+ void hostapd_free_neighbor_db(struct hostapd_data *hapd);
+ 
++int hostapd_neighbor_count(struct hostapd_data *hapd);
++int hostapd_neighbor_insert_buffer(struct hostapd_data *hapd, char *buf,
++        size_t buflen);
++void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_buf,
++			 size_t buflen, const int pref);
++#ifdef CONFIG_MBO
++void hostapd_neighbor_set_pref_by_non_pref_chan(struct hostapd_data *hapd,
++			 struct sta_info* sta, char *nei_buf, size_t buflen);
++#endif
+ #endif /* NEIGHBOR_DB_H */
+diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
+index 3ea92af..4349e1d 100644
+--- a/src/ap/wnm_ap.c
++++ b/src/ap/wnm_ap.c
+@@ -20,6 +20,7 @@
+ #include "ap/wpa_auth.h"
+ #include "mbo_ap.h"
+ #include "wnm_ap.h"
++#include "ap/neighbor_db.h"
+ 
+ #define MAX_TFS_IE_LEN  1024
+ 
+@@ -370,9 +371,21 @@ static int ieee802_11_send_bss_trans_mgmt_request(struct hostapd_data *hapd,
+ 	u8 *pos;
+ 	int res;
+ 
+-	mgmt = os_zalloc(sizeof(*mgmt));
+-	if (mgmt == NULL)
++	int nr_num = hostapd_neighbor_count(hapd);
++	int nr_size = ETH_ALEN + 4 + 1 + 1 + 1 + 5;
++	int total_nr_size = nr_num * nr_size;
++	u8 *nr_data = os_malloc(total_nr_size);
++	int nr_data_len = 0;
++	if(nr_data == NULL) {
++		wpa_printf (MSG_ERROR, "Failed to allocate memory");
++	} else {
++	    nr_data_len = hostapd_neighbor_insert_buffer(hapd, nr_data, total_nr_size);
++	}
++	mgmt = os_zalloc(sizeof(*mgmt) + nr_data_len);
++	if (mgmt == NULL) {
++		wpa_printf (MSG_ERROR, "Failed to allocate memory for mgmt frame");
+ 		return -1;
++	}
+ 	os_memcpy(mgmt->da, addr, ETH_ALEN);
+ 	os_memcpy(mgmt->sa, hapd->own_addr, ETH_ALEN);
+ 	os_memcpy(mgmt->bssid, hapd->own_addr, ETH_ALEN);
+@@ -382,10 +395,18 @@ static int ieee802_11_send_bss_trans_mgmt_request(struct hostapd_data *hapd,
+ 	mgmt->u.action.u.bss_tm_req.action = WNM_BSS_TRANS_MGMT_REQ;
+ 	mgmt->u.action.u.bss_tm_req.dialog_token = dialog_token;
+ 	mgmt->u.action.u.bss_tm_req.req_mode = 0;
++	if(nr_num) {
++		mgmt->u.action.u.bss_tm_req.req_mode |= WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED;
++	}
+ 	mgmt->u.action.u.bss_tm_req.disassoc_timer = host_to_le16(0);
+ 	mgmt->u.action.u.bss_tm_req.validity_interval = 1;
+ 	pos = mgmt->u.action.u.bss_tm_req.variable;
+ 
++	if(nr_num) {
++		os_memcpy(pos, nr_data, nr_data_len);
++		pos += nr_data_len;
++	}
++
+ 	hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ 	wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Request to "
+ 		   MACSTR " dialog_token=%u req_mode=0x%x disassoc_timer=%u "
+@@ -759,6 +780,50 @@ static void set_disassoc_timer(struct hostapd_data *hapd, struct sta_info *sta,
+ }
+ 
+ 
++static void set_send_disassoc_frame_timer(struct hostapd_data *hapd, struct sta_info *sta,
++			       int disassoc_timer)
++{
++	int timeout, beacon_int;
++
++	/*
++	 * Prevent STA from reconnecting using cached PMKSA to force
++	 * full authentication with the authentication server (which may
++	 * decide to reject the connection),
++	 */
++	wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr);
++
++	beacon_int = hapd->iconf->beacon_int;
++	if (beacon_int < 1)
++		beacon_int = 100; /* best guess */
++	/* Calculate timeout in ms based on beacon_int in TU */
++	timeout = disassoc_timer * beacon_int * 128 / 125;
++	wpa_printf(MSG_DEBUG, "Disassociation timer for " MACSTR
++		   " set to %d ms", MAC2STR(sta->addr), timeout);
++
++	u16 reason = WLAN_REASON_PREV_AUTH_NOT_VALID;
++
++	hostapd_drv_sta_disassoc(hapd, sta->addr, reason);
++	if (sta)
++		ap_sta_disassociate(hapd, sta, reason);
++}
++
++
++void bss_termination_disable_iface(void *eloop_ctx, void *timeout_ctx)
++{
++	struct hostapd_data *hapd = eloop_ctx;
++	hostapd_disable_iface(hapd->iface);
++}
++
++
++static void set_disable_iface_timer(struct hostapd_data *hapd, struct sta_info *sta,
++			       int disable_iface_timer)
++{
++	wpa_printf(MSG_DEBUG, "Disable interface timer set to %d secs", disable_iface_timer);
++	eloop_register_timeout(disable_iface_timer, 0,
++			       bss_termination_disable_iface, hapd, NULL);
++}
++
++
+ int wnm_send_ess_disassoc_imminent(struct hostapd_data *hapd,
+ 				   struct sta_info *sta, const char *url,
+ 				   int disassoc_timer)
+@@ -848,6 +913,7 @@ int wnm_send_bss_tm_req(struct hostapd_data *hapd, struct sta_info *sta,
+ 	    bss_term_dur) {
+ 		os_memcpy(pos, bss_term_dur, 12);
+ 		pos += 12;
++		set_disable_iface_timer(hapd, sta, hapd->conf->bss_termination_tsf);
+ 	}
+ 
+ 	if (url) {
+@@ -884,7 +950,7 @@ int wnm_send_bss_tm_req(struct hostapd_data *hapd, struct sta_info *sta,
+ 	hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ 	if (disassoc_timer) {
+ 		/* send disassociation frame after time-out */
+-		set_disassoc_timer(hapd, sta, disassoc_timer);
++		set_send_disassoc_frame_timer(hapd, sta, disassoc_timer);
+ 	}
+ 
+ 	return 0;
+-- 
+2.36.1
+
diff --git a/recipes-wifi/hostapd/files/patches/99901-hostapd-mtk-Support-including-neighbor-report-elements-in-ANQP-.patch b/recipes-wifi/hostapd/files/patches/99901-hostapd-mtk-Support-including-neighbor-report-elements-in-ANQP-.patch
deleted file mode 100644
index 752584b..0000000
--- a/recipes-wifi/hostapd/files/patches/99901-hostapd-mtk-Support-including-neighbor-report-elements-in-ANQP-.patch
+++ /dev/null
@@ -1,95 +0,0 @@
-From 0a4f464da1089e59eb5155b5479ceff785697881 Mon Sep 17 00:00:00 2001
-From: "howard.hsu" <howard-yh.hsu@mediatek.com>
-Date: Wed, 19 Jan 2022 19:25:05 +0800
-Subject: [PATCH 99901/99917] Support including neighbor report elements in
- ANQP response
-
----
- src/ap/gas_serv.c | 29 +++++++++++++++++++++++++++++
- src/ap/gas_serv.h |  2 ++
- 2 files changed, 31 insertions(+)
-
-diff --git a/src/ap/gas_serv.c b/src/ap/gas_serv.c
-index 90f1577..5845ff8 100644
---- a/src/ap/gas_serv.c
-+++ b/src/ap/gas_serv.c
-@@ -19,6 +19,7 @@
- #include "dpp_hostapd.h"
- #include "sta_info.h"
- #include "gas_serv.h"
-+#include "neighbor_db.h"
- 
- 
- #ifdef CONFIG_DPP
-@@ -369,6 +370,24 @@ static void anqp_add_network_auth_type(struct hostapd_data *hapd,
- 	}
- }
- 
-+static void anqp_add_neighbor_report(struct hostapd_data *hapd,
-+				       struct wpabuf *buf)
-+{
-+	struct hostapd_neighbor_entry *nr;
-+	u8 *len_pos = gas_anqp_add_element(buf, ANQP_NEIGHBOR_REPORT);
-+	if (dl_list_empty(&hapd->nr_db)) {
-+		wpabuf_put_le16(buf, 0);
-+	}
-+	else {
-+		dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry, list ) {
-+			wpabuf_put_u8(buf, WLAN_EID_NEIGHBOR_REPORT);
-+			wpabuf_put_u8(buf, wpabuf_len(nr->nr));
-+			wpabuf_put_buf(buf, nr->nr);
-+		}
-+	}
-+	gas_anqp_set_element_len(buf, len_pos);
-+}
-+
- 
- static void anqp_add_roaming_consortium(struct hostapd_data *hapd,
- 					struct wpabuf *buf)
-@@ -986,6 +1005,9 @@ gas_serv_build_gas_resp_payload(struct hostapd_data *hapd,
- 		len += 1000;
- 	if (request & ANQP_REQ_ICON_REQUEST)
- 		len += 65536;
-+    if (request & ANQP_REQ_NEIGHBOR_REPORT) {
-+        len += (40 * hostapd_neighbor_count(hapd));
-+    }
- #ifdef CONFIG_FILS
- 	if (request & ANQP_FILS_REALM_INFO)
- 		len += 2 * dl_list_len(&hapd->conf->fils_realms);
-@@ -1028,6 +1050,8 @@ gas_serv_build_gas_resp_payload(struct hostapd_data *hapd,
- 		anqp_add_elem(hapd, buf, ANQP_TDLS_CAPABILITY);
- 	if (request & ANQP_REQ_EMERGENCY_NAI)
- 		anqp_add_elem(hapd, buf, ANQP_EMERGENCY_NAI);
-+	if (request & ANQP_REQ_NEIGHBOR_REPORT)
-+		anqp_add_neighbor_report(hapd, buf);
- 
- 	for (i = 0; i < num_extra_req; i++) {
- #ifdef CONFIG_FILS
-@@ -1172,6 +1196,11 @@ static void rx_anqp_query_list_id(struct hostapd_data *hapd, u16 info_id,
- 			     "Emergency NAI",
- 			     get_anqp_elem(hapd, info_id) != NULL, qi);
- 		break;
-+	case ANQP_NEIGHBOR_REPORT:
-+		set_anqp_req(ANQP_REQ_NEIGHBOR_REPORT,
-+			     "Neighbor Report",
-+			     get_anqp_elem(hapd, info_id) != NULL, qi);
-+		break;
- 	default:
- #ifdef CONFIG_FILS
- 		if (info_id == ANQP_FILS_REALM_INFO &&
-diff --git a/src/ap/gas_serv.h b/src/ap/gas_serv.h
-index 1528af4..d0241f2 100644
---- a/src/ap/gas_serv.h
-+++ b/src/ap/gas_serv.h
-@@ -40,6 +40,8 @@
- 	(1 << (ANQP_TDLS_CAPABILITY - ANQP_QUERY_LIST))
- #define ANQP_REQ_EMERGENCY_NAI \
- 	(1 << (ANQP_EMERGENCY_NAI - ANQP_QUERY_LIST))
-+#define ANQP_REQ_NEIGHBOR_REPORT \
-+	(1 << (ANQP_NEIGHBOR_REPORT - ANQP_QUERY_LIST))
- /*
-  * First 15 Hotspot 2.0 vendor specific ANQP-elements can be included in the
-  * optimized bitmap.
--- 
-2.36.1
-
diff --git a/recipes-wifi/hostapd/files/patches/99909-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch b/recipes-wifi/hostapd/files/patches/99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
similarity index 86%
rename from recipes-wifi/hostapd/files/patches/99909-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
rename to recipes-wifi/hostapd/files/patches/99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
index 12e0e36..054dfb0 100644
--- a/recipes-wifi/hostapd/files/patches/99909-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
+++ b/recipes-wifi/hostapd/files/patches/99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
@@ -1,7 +1,7 @@
-From b7a74dbae4ff2bdbc5c84d0299bc18020fe86d13 Mon Sep 17 00:00:00 2001
+From f5c37c459c33bb8e228a88ba8efdea68bb75abd3 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 20 Sep 2022 19:33:45 +0800
-Subject: [PATCH 99909/99917] print sae groups by hostapd ctrl
+Subject: [PATCH 99901/99909] hostapd: mtk: print sae groups by hostapd ctrl
 
 ---
  hostapd/ctrl_iface.c | 13 +++++++++++++
diff --git a/recipes-wifi/hostapd/files/patches/99902-hostapd-mtk-Support-including-neignbor-report-elements-in-BTM-r.patch b/recipes-wifi/hostapd/files/patches/99902-hostapd-mtk-Support-including-neignbor-report-elements-in-BTM-r.patch
deleted file mode 100644
index 99bea80..0000000
--- a/recipes-wifi/hostapd/files/patches/99902-hostapd-mtk-Support-including-neignbor-report-elements-in-BTM-r.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From d283e4c84ece2f6b6dc21889b6b326ea3de11545 Mon Sep 17 00:00:00 2001
-From: "howard.hsu" <howard-yh.hsu@mediatek.com>
-Date: Wed, 19 Jan 2022 19:49:09 +0800
-Subject: [PATCH 99902/99917] Support including neignbor report elements in BTM
- response
-
----
- src/ap/wnm_ap.c | 25 +++++++++++++++++++++++--
- 1 file changed, 23 insertions(+), 2 deletions(-)
-
-diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
-index 3ea92af..532d9db 100644
---- a/src/ap/wnm_ap.c
-+++ b/src/ap/wnm_ap.c
-@@ -20,6 +20,7 @@
- #include "ap/wpa_auth.h"
- #include "mbo_ap.h"
- #include "wnm_ap.h"
-+#include "ap/neighbor_db.h"
- 
- #define MAX_TFS_IE_LEN  1024
- 
-@@ -370,9 +371,21 @@ static int ieee802_11_send_bss_trans_mgmt_request(struct hostapd_data *hapd,
- 	u8 *pos;
- 	int res;
- 
--	mgmt = os_zalloc(sizeof(*mgmt));
--	if (mgmt == NULL)
-+	int nr_num = hostapd_neighbor_count(hapd);
-+	int nr_size = ETH_ALEN + 4 + 1 + 1 + 1 + 5;
-+	int total_nr_size = nr_num * nr_size;
-+	u8 *nr_data = os_malloc(total_nr_size);
-+	int nr_data_len = 0;
-+	if(nr_data == NULL) {
-+		wpa_printf (MSG_ERROR, "Failed to allocate memory");
-+	} else {
-+	    nr_data_len = hostapd_neighbor_insert_buffer(hapd, nr_data, total_nr_size);
-+	}
-+	mgmt = os_zalloc(sizeof(*mgmt) + nr_data_len);
-+	if (mgmt == NULL) {
-+		wpa_printf (MSG_ERROR, "Failed to allocate memory for mgmt frame");
- 		return -1;
-+	}
- 	os_memcpy(mgmt->da, addr, ETH_ALEN);
- 	os_memcpy(mgmt->sa, hapd->own_addr, ETH_ALEN);
- 	os_memcpy(mgmt->bssid, hapd->own_addr, ETH_ALEN);
-@@ -382,10 +395,18 @@ static int ieee802_11_send_bss_trans_mgmt_request(struct hostapd_data *hapd,
- 	mgmt->u.action.u.bss_tm_req.action = WNM_BSS_TRANS_MGMT_REQ;
- 	mgmt->u.action.u.bss_tm_req.dialog_token = dialog_token;
- 	mgmt->u.action.u.bss_tm_req.req_mode = 0;
-+	if(nr_num) {
-+		mgmt->u.action.u.bss_tm_req.req_mode |= WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED;
-+	}
- 	mgmt->u.action.u.bss_tm_req.disassoc_timer = host_to_le16(0);
- 	mgmt->u.action.u.bss_tm_req.validity_interval = 1;
- 	pos = mgmt->u.action.u.bss_tm_req.variable;
- 
-+	if(nr_num) {
-+		os_memcpy(pos, nr_data, nr_data_len);
-+		pos += nr_data_len;
-+	}
-+
- 	hapd->openwrt_stats.wnm.bss_transition_request_tx++;
- 	wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Request to "
- 		   MACSTR " dialog_token=%u req_mode=0x%x disassoc_timer=%u "
--- 
-2.36.1
-
diff --git a/recipes-wifi/hostapd/files/patches/99910-hostapd-mtk-hostapd-add-support-for-runtime-set-in-band-discove.patch b/recipes-wifi/hostapd/files/patches/99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch
similarity index 97%
rename from recipes-wifi/hostapd/files/patches/99910-hostapd-mtk-hostapd-add-support-for-runtime-set-in-band-discove.patch
rename to recipes-wifi/hostapd/files/patches/99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch
index 2af1d8e..6fa23c0 100644
--- a/recipes-wifi/hostapd/files/patches/99910-hostapd-mtk-hostapd-add-support-for-runtime-set-in-band-discove.patch
+++ b/recipes-wifi/hostapd/files/patches/99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch
@@ -1,7 +1,7 @@
-From 7a7b2284ad75cd20c788dad6e253bc2940203ff9 Mon Sep 17 00:00:00 2001
+From ce684a1adac0b5b699482924eb86f8f1b8205e57 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 31 May 2022 21:15:54 +0800
-Subject: [PATCH 99910/99917] hostapd: add support for runtime set in-band
+Subject: [PATCH 99902/99909] hostapd: mtk: add support for runtime set in-band
  discovery
 
 Usage:
diff --git a/recipes-wifi/hostapd/files/patches/99911-hostapd-mtk-Add-mtk_vendor.h.patch b/recipes-wifi/hostapd/files/patches/99903-hostapd-mtk-Add-mtk_vendor.h.patch
similarity index 97%
rename from recipes-wifi/hostapd/files/patches/99911-hostapd-mtk-Add-mtk_vendor.h.patch
rename to recipes-wifi/hostapd/files/patches/99903-hostapd-mtk-Add-mtk_vendor.h.patch
index ff4d232..a15287e 100644
--- a/recipes-wifi/hostapd/files/patches/99911-hostapd-mtk-Add-mtk_vendor.h.patch
+++ b/recipes-wifi/hostapd/files/patches/99903-hostapd-mtk-Add-mtk_vendor.h.patch
@@ -1,7 +1,7 @@
-From f5ba1e7e33d0736602957f8131540202cec1c7ad Mon Sep 17 00:00:00 2001
+From e4b9b5847090d25009a4cf104052ba0490e95ffe Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 30 May 2022 15:04:57 +0800
-Subject: [PATCH 99911/99917] Add mtk_vendor.h
+Subject: [PATCH 99903/99909] hostapd: mtk: Add mtk_vendor.h
 
 ---
  src/common/mtk_vendor.h | 195 ++++++++++++++++++++++++++++++++++++++++
diff --git a/recipes-wifi/hostapd/files/patches/99903-hostapd-mtk-Support-configuring-BSS-Termination-TSF-by-using-ho.patch b/recipes-wifi/hostapd/files/patches/99903-hostapd-mtk-Support-configuring-BSS-Termination-TSF-by-using-ho.patch
deleted file mode 100644
index cac4092..0000000
--- a/recipes-wifi/hostapd/files/patches/99903-hostapd-mtk-Support-configuring-BSS-Termination-TSF-by-using-ho.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From de13e08cb3e1210bfed2de824c6a19e8dbed057e Mon Sep 17 00:00:00 2001
-From: Howard Hsu <howard-yh.hsu@mediatek.com>
-Date: Thu, 9 Jun 2022 19:56:18 +0800
-Subject: [PATCH 99903/99917] Support configuring BSS Termination TSF by using
- hostapd_cli command
-
----
- hostapd/ctrl_iface.c   | 5 +++++
- src/ap/ap_config.c     | 1 +
- src/ap/ap_config.h     | 1 +
- src/ap/ctrl_iface_ap.c | 4 ++++
- 4 files changed, 11 insertions(+)
-
-diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index a258492..c2a2822 100644
---- a/hostapd/ctrl_iface.c
-+++ b/hostapd/ctrl_iface.c
-@@ -1338,6 +1338,11 @@ static int hostapd_ctrl_iface_set(struct hostapd_data *hapd, char *cmd)
- #endif /* CONFIG_DPP */
- 	} else if (os_strcasecmp(cmd, "setband") == 0) {
- 		ret = hostapd_ctrl_iface_set_band(hapd, value);
-+	} else if (os_strcasecmp(cmd, "bss_termination_tsf") == 0) {
-+		int termination_sec = atoi(value);
-+		hapd->conf->bss_termination_tsf = termination_sec;
-+		wpa_printf(MSG_DEBUG, "BSS Termination TSF: value = %d",
-+                termination_sec);
- 	} else {
- 		ret = hostapd_set_iface(hapd->iconf, hapd->conf, cmd, value);
- 		if (ret)
-diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index d7a0c7c..4a20eb4 100644
---- a/src/ap/ap_config.c
-+++ b/src/ap/ap_config.c
-@@ -170,6 +170,7 @@ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss)
- 	/* comeback after 10 TUs */
- 	bss->pasn_comeback_after = 10;
- #endif /* CONFIG_PASN */
-+	bss->bss_termination_tsf = 0;
- }
- 
- 
-diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index ed3bec7..3f68e76 100644
---- a/src/ap/ap_config.h
-+++ b/src/ap/ap_config.h
-@@ -557,6 +557,7 @@ struct hostapd_bss_config {
- 	int wnm_sleep_mode;
- 	int wnm_sleep_mode_no_keys;
- 	int bss_transition;
-+	unsigned int bss_termination_tsf;
- 
- 	/* IEEE 802.11u - Interworking */
- 	int interworking;
-diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
-index 96209ce..46a8609 100644
---- a/src/ap/ctrl_iface_ap.c
-+++ b/src/ap/ctrl_iface_ap.c
-@@ -1203,6 +1203,10 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
- 			wpa_printf(MSG_DEBUG, "Invalid bss_term data");
- 			return -1;
- 		}
-+		if (hapd->conf->bss_termination_tsf) {
-+			WPA_PUT_LE64(&bss_term_dur[2], hapd->conf->bss_termination_tsf);
-+		}
-+
- 		end++;
- 		WPA_PUT_LE16(&bss_term_dur[10], atoi(end));
- 	}
--- 
-2.36.1
-
diff --git a/recipes-wifi/hostapd/files/patches/99904-hostapd-mtk-Disable-interface-if-BSS-Termination-TSF-is-set.patch b/recipes-wifi/hostapd/files/patches/99904-hostapd-mtk-Disable-interface-if-BSS-Termination-TSF-is-set.patch
deleted file mode 100644
index 7334217..0000000
--- a/recipes-wifi/hostapd/files/patches/99904-hostapd-mtk-Disable-interface-if-BSS-Termination-TSF-is-set.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From cdd0a088a13000d67a5bd821a609546f8b79c7e0 Mon Sep 17 00:00:00 2001
-From: "howard.hsu" <howard-yh.hsu@mediatek.com>
-Date: Wed, 19 Jan 2022 21:03:38 +0800
-Subject: [PATCH 99904/99917] Disable interface if BSS Termination TSF is set
-
----
- src/ap/wnm_ap.c | 17 +++++++++++++++++
- 1 file changed, 17 insertions(+)
-
-diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
-index 532d9db..f6761ab 100644
---- a/src/ap/wnm_ap.c
-+++ b/src/ap/wnm_ap.c
-@@ -780,6 +780,22 @@ static void set_disassoc_timer(struct hostapd_data *hapd, struct sta_info *sta,
- }
- 
- 
-+void bss_termination_disable_iface(void *eloop_ctx, void *timeout_ctx)
-+{
-+	struct hostapd_data *hapd = eloop_ctx;
-+	hostapd_disable_iface(hapd->iface);
-+}
-+
-+
-+static void set_disable_iface_timer(struct hostapd_data *hapd, struct sta_info *sta,
-+			       int disable_iface_timer)
-+{
-+	wpa_printf(MSG_DEBUG, "Disable interface timer set to %d secs", disable_iface_timer);
-+	eloop_register_timeout(disable_iface_timer, 0,
-+			       bss_termination_disable_iface, hapd, NULL);
-+}
-+
-+
- int wnm_send_ess_disassoc_imminent(struct hostapd_data *hapd,
- 				   struct sta_info *sta, const char *url,
- 				   int disassoc_timer)
-@@ -869,6 +885,7 @@ int wnm_send_bss_tm_req(struct hostapd_data *hapd, struct sta_info *sta,
- 	    bss_term_dur) {
- 		os_memcpy(pos, bss_term_dur, 12);
- 		pos += 12;
-+		set_disable_iface_timer(hapd, sta, hapd->conf->bss_termination_tsf);
- 	}
- 
- 	if (url) {
--- 
-2.36.1
-
diff --git a/recipes-wifi/hostapd/files/patches/99912-hostapd-mtk-Support-new-hostapd-configuration-edcca_enable-and-.patch b/recipes-wifi/hostapd/files/patches/99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
similarity index 98%
rename from recipes-wifi/hostapd/files/patches/99912-hostapd-mtk-Support-new-hostapd-configuration-edcca_enable-and-.patch
rename to recipes-wifi/hostapd/files/patches/99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
index e1161f8..40dded6 100644
--- a/recipes-wifi/hostapd/files/patches/99912-hostapd-mtk-Support-new-hostapd-configuration-edcca_enable-and-.patch
+++ b/recipes-wifi/hostapd/files/patches/99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
@@ -1,9 +1,9 @@
-From 27645d8206ad1a0276f05faa175f2ed4ffb8202e Mon Sep 17 00:00:00 2001
+From cef7f515eafeeaa99933cc9e66c79b705e3ab065 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 30 May 2022 16:31:34 +0800
-Subject: [PATCH 99912/99917] Support new hostapd configuration, edcca_enable
- and edcca_compensation and implement edcca related handlers.
+Subject: [PATCH 99904/99909] hostapd: mtk: Support EDCCA hostapd configuration
 
+edcca_enable and edcca_compensation and implement edcca related handlers.
 ---
  hostapd/config_file.c             |  32 ++++++
  hostapd/ctrl_iface.c              | 125 ++++++++++++++++++++++
diff --git a/recipes-wifi/hostapd/files/patches/99913-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch b/recipes-wifi/hostapd/files/patches/99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
similarity index 98%
rename from recipes-wifi/hostapd/files/patches/99913-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
rename to recipes-wifi/hostapd/files/patches/99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
index 572cdd1..18617be 100644
--- a/recipes-wifi/hostapd/files/patches/99913-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
+++ b/recipes-wifi/hostapd/files/patches/99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
@@ -1,7 +1,7 @@
-From fe664c759cb79e130d35f6dd0236e9cb33320f70 Mon Sep 17 00:00:00 2001
+From a288f97e708bc579e285b509f7c0655c2f27a76c Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Tue, 9 Aug 2022 10:23:44 -0700
-Subject: [PATCH 99913/99917] Add hostapd HEMU SET/GET control
+Subject: [PATCH 99905/99909] hostapd: mtk: Add hostapd HEMU SET/GET control
 
 ---
  hostapd/config_file.c             |   9 +++
diff --git a/recipes-wifi/hostapd/files/patches/99905-hostapd-mtk-Add-set_send_disassoc_frame_timer-to-send-disassoci.patch b/recipes-wifi/hostapd/files/patches/99905-hostapd-mtk-Add-set_send_disassoc_frame_timer-to-send-disassoci.patch
deleted file mode 100644
index 83d9814..0000000
--- a/recipes-wifi/hostapd/files/patches/99905-hostapd-mtk-Add-set_send_disassoc_frame_timer-to-send-disassoci.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From bd1816cb396a071cc5ae2fe13992362fcbf45fe9 Mon Sep 17 00:00:00 2001
-From: "howard.hsu" <howard-yh.hsu@mediatek.com>
-Date: Wed, 19 Jan 2022 21:15:07 +0800
-Subject: [PATCH 99905/99917] Add set_send_disassoc_frame_timer() to send
- disassociate frame
-
-Function set_disassoc_timer() may fail if key was deleted first. This new
-function will not ask to delete key as set_disassoc_timer() did.
----
- src/ap/wnm_ap.c | 30 +++++++++++++++++++++++++++++-
- 1 file changed, 29 insertions(+), 1 deletion(-)
-
-diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
-index f6761ab..4349e1d 100644
---- a/src/ap/wnm_ap.c
-+++ b/src/ap/wnm_ap.c
-@@ -780,6 +780,34 @@ static void set_disassoc_timer(struct hostapd_data *hapd, struct sta_info *sta,
- }
- 
- 
-+static void set_send_disassoc_frame_timer(struct hostapd_data *hapd, struct sta_info *sta,
-+			       int disassoc_timer)
-+{
-+	int timeout, beacon_int;
-+
-+	/*
-+	 * Prevent STA from reconnecting using cached PMKSA to force
-+	 * full authentication with the authentication server (which may
-+	 * decide to reject the connection),
-+	 */
-+	wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr);
-+
-+	beacon_int = hapd->iconf->beacon_int;
-+	if (beacon_int < 1)
-+		beacon_int = 100; /* best guess */
-+	/* Calculate timeout in ms based on beacon_int in TU */
-+	timeout = disassoc_timer * beacon_int * 128 / 125;
-+	wpa_printf(MSG_DEBUG, "Disassociation timer for " MACSTR
-+		   " set to %d ms", MAC2STR(sta->addr), timeout);
-+
-+	u16 reason = WLAN_REASON_PREV_AUTH_NOT_VALID;
-+
-+	hostapd_drv_sta_disassoc(hapd, sta->addr, reason);
-+	if (sta)
-+		ap_sta_disassociate(hapd, sta, reason);
-+}
-+
-+
- void bss_termination_disable_iface(void *eloop_ctx, void *timeout_ctx)
- {
- 	struct hostapd_data *hapd = eloop_ctx;
-@@ -922,7 +950,7 @@ int wnm_send_bss_tm_req(struct hostapd_data *hapd, struct sta_info *sta,
- 	hapd->openwrt_stats.wnm.bss_transition_request_tx++;
- 	if (disassoc_timer) {
- 		/* send disassociation frame after time-out */
--		set_disassoc_timer(hapd, sta, disassoc_timer);
-+		set_send_disassoc_frame_timer(hapd, sta, disassoc_timer);
- 	}
- 
- 	return 0;
--- 
-2.36.1
-
diff --git a/recipes-wifi/hostapd/files/patches/99914-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch b/recipes-wifi/hostapd/files/patches/99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch
similarity index 97%
rename from recipes-wifi/hostapd/files/patches/99914-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch
rename to recipes-wifi/hostapd/files/patches/99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch
index ca64eb8..fc81ed1 100644
--- a/recipes-wifi/hostapd/files/patches/99914-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch
+++ b/recipes-wifi/hostapd/files/patches/99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch
@@ -1,7 +1,8 @@
-From 4707ed85884be2ffe7860e28de80df5a6e479824 Mon Sep 17 00:00:00 2001
+From 26c6be11e7597490ccc4d7704542c78dec6c4cd1 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 2 Sep 2022 01:03:23 +0800
-Subject: [PATCH 99914/99917] Add three wire PTA ctrl hostapd vendor command
+Subject: [PATCH 99906/99909] hostapd: mtk: Add three wire PTA ctrl hostapd
+ vendor command
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
diff --git a/recipes-wifi/hostapd/files/patches/99906-hostapd-mtk-Support-including-neighbor-report-elements-in-BTM-r.patch b/recipes-wifi/hostapd/files/patches/99906-hostapd-mtk-Support-including-neighbor-report-elements-in-BTM-r.patch
deleted file mode 100644
index 174d8a9..0000000
--- a/recipes-wifi/hostapd/files/patches/99906-hostapd-mtk-Support-including-neighbor-report-elements-in-BTM-r.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 99665874b76ccacd85e56ea8767ebb0b8d4b3b1e Mon Sep 17 00:00:00 2001
-From: Howard Hsu <howard-yh.hsu@mediatek.com>
-Date: Thu, 9 Jun 2022 19:58:57 +0800
-Subject: [PATCH 99906/99917] Support including neighbor report elements in BTM
- request
-
----
- src/ap/ctrl_iface_ap.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
-index 46a8609..1cbec53 100644
---- a/src/ap/ctrl_iface_ap.c
-+++ b/src/ap/ctrl_iface_ap.c
-@@ -1233,8 +1233,13 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
- 		req_mode |= WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT;
- 	}
- 
--	if (os_strstr(cmd, " pref=1"))
-+	if (os_strstr(cmd, " pref=1")) {
- 		req_mode |= WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED;
-+		if (nei_len == 0) {
-+			// Add neigibor report from neighbor report db to nei_rep buffer
-+			nei_len = hostapd_neighbor_insert_buffer (hapd, nei_rep, 1000);
-+		}
-+	}
- 	if (os_strstr(cmd, " abridged=1"))
- 		req_mode |= WNM_BSS_TM_REQ_ABRIDGED;
- 	if (os_strstr(cmd, " disassoc_imminent=1"))
--- 
-2.36.1
-
diff --git a/recipes-wifi/hostapd/files/patches/99915-hostapd-mtk-Add-hostapd-iBF-control.patch b/recipes-wifi/hostapd/files/patches/99907-hostapd-mtk-Add-hostapd-iBF-control.patch
similarity index 98%
rename from recipes-wifi/hostapd/files/patches/99915-hostapd-mtk-Add-hostapd-iBF-control.patch
rename to recipes-wifi/hostapd/files/patches/99907-hostapd-mtk-Add-hostapd-iBF-control.patch
index a50cb9e..50a08ba 100644
--- a/recipes-wifi/hostapd/files/patches/99915-hostapd-mtk-Add-hostapd-iBF-control.patch
+++ b/recipes-wifi/hostapd/files/patches/99907-hostapd-mtk-Add-hostapd-iBF-control.patch
@@ -1,7 +1,7 @@
-From e177f5069ff7e8f024676cf9d0e4af135cfea95b Mon Sep 17 00:00:00 2001
+From 1f60afd21c6dd7dfe3d504dee7507654a981033b Mon Sep 17 00:00:00 2001
 From: mtk27835 <shurong.wen@mediatek.com>
 Date: Wed, 7 Sep 2022 14:41:51 -0700
-Subject: [PATCH 99915/99917] Add hostapd iBF control
+Subject: [PATCH 99907/99909] hostapd: mtk: Add hostapd iBF control
 
 Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
 ---
diff --git a/recipes-wifi/hostapd/files/patches/99907-hostapd-mtk-Add-hostapd_neighbor_set_own_report_pref.patch b/recipes-wifi/hostapd/files/patches/99907-hostapd-mtk-Add-hostapd_neighbor_set_own_report_pref.patch
deleted file mode 100644
index 63658c9..0000000
--- a/recipes-wifi/hostapd/files/patches/99907-hostapd-mtk-Add-hostapd_neighbor_set_own_report_pref.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From bc2244e766d863c35369cc1641b058d062681abe Mon Sep 17 00:00:00 2001
-From: Howard Hsu <howard-yh.hsu@mediatek.com>
-Date: Thu, 9 Jun 2022 20:00:49 +0800
-Subject: [PATCH 99907/99917] Add hostapd_neighbor_set_own_report_pref()
-
----
- src/ap/ctrl_iface_ap.c |  6 +++++-
- src/ap/neighbor_db.c   | 36 ++++++++++++++++++++++++++++++++++++
- src/ap/neighbor_db.h   |  2 ++
- 3 files changed, 43 insertions(+), 1 deletion(-)
-
-diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
-index 1cbec53..274b435 100644
---- a/src/ap/ctrl_iface_ap.c
-+++ b/src/ap/ctrl_iface_ap.c
-@@ -1242,8 +1242,12 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
- 	}
- 	if (os_strstr(cmd, " abridged=1"))
- 		req_mode |= WNM_BSS_TM_REQ_ABRIDGED;
--	if (os_strstr(cmd, " disassoc_imminent=1"))
-+	if (os_strstr(cmd, " disassoc_imminent=1")) {
- 		req_mode |= WNM_BSS_TM_REQ_DISASSOC_IMMINENT;
-+		/* Set own BSS neighbor report preference value as 0 */
-+		hostapd_neighbor_set_own_report_pref(hapd, nei_rep, nei_len, 0);
-+	}
-+
- 
- #ifdef CONFIG_MBO
- 	pos = os_strstr(cmd, "mbo=");
-diff --git a/src/ap/neighbor_db.c b/src/ap/neighbor_db.c
-index c121390..134ed4a 100644
---- a/src/ap/neighbor_db.c
-+++ b/src/ap/neighbor_db.c
-@@ -357,3 +357,39 @@ void hostapd_neighbor_set_own_report(struct hostapd_data *hapd)
- 	wpabuf_free(nr);
- #endif /* NEED_AP_MLME */
- }
-+
-+
-+void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_buf,
-+			 size_t buflen, const int pref)
-+{
-+	struct hostapd_neighbor_entry *nr;
-+	char *pos, *next_nr;
-+
-+	pos = nei_buf;
-+	next_nr = nei_buf;
-+
-+	dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
-+			 list) {
-+		pos = next_nr;
-+		next_nr = pos + 2 + wpabuf_len(nr->nr);
-+		/* Shift 2 bytes for Element ID and Neighbor report length */
-+		pos = pos + 2;
-+		if(os_memcmp(pos, hapd->own_addr, ETH_ALEN) == 0) {
-+			/* Shift for BSSID + BSSID info + Op_class + channel num + PHY type */
-+			pos = pos + 6 + 4 + 1 + 1 + 1;
-+
-+			/* Iterate Subelement */
-+			while (next_nr - pos > 0) {
-+				if (*pos == 3) {
-+					pos = pos + 2;
-+					*pos = pref;
-+					return;
-+				} else {
-+					pos++;
-+					int shift_len = *pos++;
-+					pos = pos + shift_len;
-+				}
-+			}
-+		}
-+	}
-+}
-diff --git a/src/ap/neighbor_db.h b/src/ap/neighbor_db.h
-index 1ae194d..2e16f72 100644
---- a/src/ap/neighbor_db.h
-+++ b/src/ap/neighbor_db.h
-@@ -27,4 +27,6 @@ void hostapd_free_neighbor_db(struct hostapd_data *hapd);
- int hostapd_neighbor_count(struct hostapd_data *hapd);
- int hostapd_neighbor_insert_buffer(struct hostapd_data *hapd, char *buf,
-         size_t buflen);
-+void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_buf,
-+			 size_t buflen, const int pref);
- #endif /* NEIGHBOR_DB_H */
--- 
-2.36.1
-
diff --git a/recipes-wifi/hostapd/files/patches/99908-hostapd-mtk-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch b/recipes-wifi/hostapd/files/patches/99908-hostapd-mtk-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch
deleted file mode 100644
index 8d23b84..0000000
--- a/recipes-wifi/hostapd/files/patches/99908-hostapd-mtk-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch
+++ /dev/null
@@ -1,99 +0,0 @@
-From 952404e8327c98817a2d975b5595ca5d9a15e739 Mon Sep 17 00:00:00 2001
-From: Howard Hsu <howard-yh.hsu@mediatek.com>
-Date: Thu, 9 Jun 2022 20:02:06 +0800
-Subject: [PATCH 99908/99917] Add hostapd_neighbor_set_pref_by_non_pref_chan()
-
----
- src/ap/ctrl_iface_ap.c |  2 ++
- src/ap/neighbor_db.c   | 51 ++++++++++++++++++++++++++++++++++++++++++
- src/ap/neighbor_db.h   |  4 ++++
- 3 files changed, 57 insertions(+)
-
-diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
-index 274b435..18bae5c 100644
---- a/src/ap/ctrl_iface_ap.c
-+++ b/src/ap/ctrl_iface_ap.c
-@@ -1250,6 +1250,8 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
- 
- 
- #ifdef CONFIG_MBO
-+	hostapd_neighbor_set_pref_by_non_pref_chan(hapd, sta, nei_rep, nei_len);
-+
- 	pos = os_strstr(cmd, "mbo=");
- 	if (pos) {
- 		unsigned int mbo_reason, cell_pref, reassoc_delay;
-diff --git a/src/ap/neighbor_db.c b/src/ap/neighbor_db.c
-index 134ed4a..9254d09 100644
---- a/src/ap/neighbor_db.c
-+++ b/src/ap/neighbor_db.c
-@@ -393,3 +393,54 @@ void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_b
- 		}
- 	}
- }
-+
-+#ifdef CONFIG_MBO
-+void hostapd_neighbor_set_pref_by_non_pref_chan(struct hostapd_data *hapd,
-+			 struct sta_info* sta, char *nei_buf, size_t buflen)
-+{
-+	struct hostapd_neighbor_entry *nr;
-+	struct mbo_non_pref_chan_info *info;
-+	u8 i;
-+
-+	for(info = sta->non_pref_chan; info; info = info->next) {
-+		/* Check OP_Class and Channel num */
-+		for(i = 0; i < info->num_channels; i++) {
-+			char *pos, *next_nr;
-+
-+			pos = nei_buf;
-+			next_nr = nei_buf;
-+
-+			/* Iterate Neighbor report database */
-+			dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
-+					 list) {
-+				pos = next_nr;
-+				next_nr = pos + 2 + wpabuf_len(nr->nr);
-+				/**
-+				 * Shift 12 bytes for Element ID, Neighbor report length,
-+				 * BSSID and BSSID info.
-+				 */
-+				pos = pos + 12;
-+				int nr_op_class = *pos++;
-+				int nr_channel = *pos;
-+				if(info->op_class == nr_op_class && info->channels[i] == nr_channel) {
-+					/* Shift for Channel Num + PHY type */
-+					pos = pos + 1 + 1;
-+
-+					// Iterate Subelement
-+					while(next_nr - pos > 0) {
-+						if(*pos == 3) {
-+							pos = pos + 2;
-+							*pos = info->pref;
-+							break;
-+						}else {
-+							pos++;
-+							int shift_len = *pos++;
-+							pos = pos + shift_len;
-+						}
-+					}
-+				}
-+			}
-+		}
-+	}
-+}
-+#endif
-diff --git a/src/ap/neighbor_db.h b/src/ap/neighbor_db.h
-index 2e16f72..a1ddc07 100644
---- a/src/ap/neighbor_db.h
-+++ b/src/ap/neighbor_db.h
-@@ -29,4 +29,8 @@ int hostapd_neighbor_insert_buffer(struct hostapd_data *hapd, char *buf,
-         size_t buflen);
- void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_buf,
- 			 size_t buflen, const int pref);
-+#ifdef CONFIG_MBO
-+void hostapd_neighbor_set_pref_by_non_pref_chan(struct hostapd_data *hapd,
-+			 struct sta_info* sta, char *nei_buf, size_t buflen);
-+#endif
- #endif /* NEIGHBOR_DB_H */
--- 
-2.36.1
-
diff --git a/recipes-wifi/hostapd/files/patches/99916-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated-sta-s-HE-c.patch b/recipes-wifi/hostapd/files/patches/99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch
similarity index 81%
rename from recipes-wifi/hostapd/files/patches/99916-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated-sta-s-HE-c.patch
rename to recipes-wifi/hostapd/files/patches/99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch
index b1769a1..9b96d98 100644
--- a/recipes-wifi/hostapd/files/patches/99916-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated-sta-s-HE-c.patch
+++ b/recipes-wifi/hostapd/files/patches/99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch
@@ -1,8 +1,8 @@
-From dbd8120e47621784647deb776bf4b4d0a97fb49e Mon Sep 17 00:00:00 2001
+From 28228a96980512f30c8c8aac0f819c36f7241b68 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 22 Sep 2022 16:08:09 +0800
-Subject: [PATCH 99916/99917] Do not include HE capab IE if associated sta's HE
- capab IE is invalid
+Subject: [PATCH 99908/99909] hostapd: mtk: Do not include HE capab IE if
+ associated sta's HE capab IE is invalid
 
 ---
  src/ap/ieee802_11.c | 3 ++-
diff --git a/recipes-wifi/hostapd/files/patches/99917-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch b/recipes-wifi/hostapd/files/patches/99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
similarity index 98%
rename from recipes-wifi/hostapd/files/patches/99917-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
rename to recipes-wifi/hostapd/files/patches/99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
index 83eac6e..8da9b5f 100644
--- a/recipes-wifi/hostapd/files/patches/99917-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
+++ b/recipes-wifi/hostapd/files/patches/99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
@@ -1,7 +1,7 @@
-From 80ecd3e0398aa668e683ff582a0594f88b290f44 Mon Sep 17 00:00:00 2001
+From 737d21c64ab0ac49e9cce7185f1f79bb0b71f50e Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 7 Oct 2022 10:46:29 +0800
-Subject: [PATCH 99917/99917] Add DFS and ZWDFS support
+Subject: [PATCH 99909/99909] hostapd: mtk: Add DFS and ZWDFS support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
diff --git a/recipes-wifi/hostapd/files/patches/patches.inc b/recipes-wifi/hostapd/files/patches/patches.inc
index 309cd4f..388c3d7 100644
--- a/recipes-wifi/hostapd/files/patches/patches.inc
+++ b/recipes-wifi/hostapd/files/patches/patches.inc
@@ -53,22 +53,14 @@
     file://800-acs-don-t-select-indoor-channel-on-outdoor-operation.patch \
     file://990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch \
     file://992-openssl-include-rsa.patch \
-    file://99900-hostapd-mtk-Add-hostapd_neighbor_count-and-hostapd_neighbor_ins.patch \
-    file://99901-hostapd-mtk-Support-including-neighbor-report-elements-in-ANQP-.patch \
-    file://99902-hostapd-mtk-Support-including-neignbor-report-elements-in-BTM-r.patch \
-    file://99903-hostapd-mtk-Support-configuring-BSS-Termination-TSF-by-using-ho.patch \
-    file://99904-hostapd-mtk-Disable-interface-if-BSS-Termination-TSF-is-set.patch \
-    file://99905-hostapd-mtk-Add-set_send_disassoc_frame_timer-to-send-disassoci.patch \
-    file://99906-hostapd-mtk-Support-including-neighbor-report-elements-in-BTM-r.patch \
-    file://99907-hostapd-mtk-Add-hostapd_neighbor_set_own_report_pref.patch \
-    file://99908-hostapd-mtk-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch \
-    file://99909-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch \
-    file://99910-hostapd-mtk-hostapd-add-support-for-runtime-set-in-band-discove.patch \
-    file://99911-hostapd-mtk-Add-mtk_vendor.h.patch \
-    file://99912-hostapd-mtk-Support-new-hostapd-configuration-edcca_enable-and-.patch \
-    file://99913-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch \
-    file://99914-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch \
-    file://99915-hostapd-mtk-Add-hostapd-iBF-control.patch \
-    file://99916-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated-sta-s-HE-c.patch \
-    file://99917-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch \
+    file://99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch \
+    file://99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch \
+    file://99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch \
+    file://99903-hostapd-mtk-Add-mtk_vendor.h.patch \
+    file://99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch \
+    file://99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch \
+    file://99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch \
+    file://99907-hostapd-mtk-Add-hostapd-iBF-control.patch \
+    file://99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch \
+    file://99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch \
     "
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
index 5307fd3..397026b 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
@@ -1,4 +1,11 @@
-Used for AP+STA support in OpenWrt - preserve AP mode keys across STA reconnects
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 27 Oct 2014 00:00:00 +0100
+Subject: [PATCH] mac80211: preseve AP mode keys across STA reconnect
+
+Used for AP+STA support in OpenWrt - preserve AP mode keys across STA reconnect
+---
+ net/mac80211/cfg.c | 1 -
+ 1 file changed, 1 deletion(-)
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/120-cfg80211_allow_perm_addr_change.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/120-cfg80211_allow_perm_addr_change.patch
index ffd8807..f315ae5 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/120-cfg80211_allow_perm_addr_change.patch
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/120-cfg80211_allow_perm_addr_change.patch
@@ -1,3 +1,12 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 11 Dec 2014 00:00:00 +0100
+Subject: [PATCH] cfg80211: add support for changing the device mac address via
+ sysfs
+
+---
+ net/wireless/sysfs.c | 27 ++++++++++++++++++++++-----
+ 1 file changed, 22 insertions(+), 5 deletions(-)
+
 --- a/net/wireless/sysfs.c
 +++ b/net/wireless/sysfs.c
 @@ -24,18 +24,35 @@ static inline struct cfg80211_registered
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/150-disable_addr_notifier.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/150-disable_addr_notifier.patch
index 2dc6ab3..7631282 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/150-disable_addr_notifier.patch
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/150-disable_addr_notifier.patch
@@ -1,3 +1,11 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 24 Feb 2013 00:00:00 +0100
+Subject: [PATCH] mac80211: disable ipv4/ipv6 address notifiers
+
+---
+ net/mac80211/main.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
 @@ -337,7 +337,7 @@ void ieee80211_restart_hw(struct ieee802
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/210-ap_scan.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/210-ap_scan.patch
index 0c06829..9b8e084 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/210-ap_scan.patch
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/210-ap_scan.patch
@@ -1,3 +1,11 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 3 Oct 2012 00:00:00 +0200
+Subject: [PATCH] mac80211: allow scans in access point mode (for site survey)
+
+---
+ net/mac80211/cfg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
 @@ -2497,7 +2497,7 @@ static int ieee80211_scan(struct wiphy *
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/400-allow-ibss-mixed.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/400-allow-ibss-mixed.patch
index f2ed528..f0f850d 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/400-allow-ibss-mixed.patch
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/400-allow-ibss-mixed.patch
@@ -1,7 +1,18 @@
-ath10k-ct starting with version 5.2 allows the combination of 
-NL80211_IFTYPE_ADHOC and beacon_int_min_gcd in ath10k_10x_ct_if_comb 
-which triggers this warning. Ben told me that this is not a big problem 
+From: Hauke Mehrtens <hauke@hauke-m.de>
+Date: Mon, 24 Feb 2020 00:00:00 +0100
+Subject: [PATCH] mac80211: Allow IBSS mode and different beacon intervals
+
+ath10k-ct supports the combination to select IBSS (ADHOC) mode and
+different beacon intervals together. mac80211 does not like this
+combination, but Ben says this is ok, so remove this check.
+
+ath10k-ct starting with version 5.2 allows the combination of
+NL80211_IFTYPE_ADHOC and beacon_int_min_gcd in ath10k_10x_ct_if_comb
+which triggers this warning. Ben told me that this is not a big problem
 and we should ignore this.
+---
+ net/wireless/core.c | 15 ---------------
+ 1 file changed, 15 deletions(-)
 
 --- a/net/wireless/core.c
 +++ b/net/wireless/core.c
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/901-mac80211-mtk-check-twt-responder-when-setu-twt.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/900-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch
similarity index 65%
rename from recipes-wifi/linux-mac80211/files/patches/subsys/901-mac80211-mtk-check-twt-responder-when-setu-twt.patch
rename to recipes-wifi/linux-mac80211/files/patches/subsys/900-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch
index 92e853f..19bc6e0 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/901-mac80211-mtk-check-twt-responder-when-setu-twt.patch
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/900-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch
@@ -1,7 +1,7 @@
-From 0f0d127d843c67f076af380d49e42bb2c3ea3f15 Mon Sep 17 00:00:00 2001
+From 38260391d30fee3500566e931a093089a223b552 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Tue, 18 Jan 2022 20:29:44 +0800
-Subject: [PATCH 901/914] mac80211: do not setup twt when twt responder is
+Subject: [PATCH 900/913] mac80211: mtk: do not setup twt when twt responder is
  false
 
 ---
@@ -9,10 +9,10 @@
  1 file changed, 3 insertions(+)
 
 diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
-index 873daea..a92bd1a 100644
+index b991151..eb16838 100644
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -3281,6 +3281,9 @@ ieee80211_process_rx_twt_action(struct ieee80211_rx_data *rx)
+@@ -3283,6 +3283,9 @@ ieee80211_process_rx_twt_action(struct ieee80211_rx_data *rx)
  	if (sdata->vif.type != NL80211_IFTYPE_AP)
  		return false;
  
@@ -23,5 +23,5 @@
  		return false;
  
 -- 
-2.18.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/902-nl80211-mtk-internal-extend-CAC-time-for-weather-radar-c.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/901-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch
similarity index 87%
rename from recipes-wifi/linux-mac80211/files/patches/subsys/902-nl80211-mtk-internal-extend-CAC-time-for-weather-radar-c.patch
rename to recipes-wifi/linux-mac80211/files/patches/subsys/901-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch
index 7a5c812..faf709a 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/902-nl80211-mtk-internal-extend-CAC-time-for-weather-radar-c.patch
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/901-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch
@@ -1,7 +1,7 @@
-From 16266ba15b8f0de668d45f9b15cc379d38d09b0f Mon Sep 17 00:00:00 2001
+From f840d129394d1d563f14f3802f4591242794c56c Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 29 Mar 2022 16:06:30 +0800
-Subject: [PATCH 902/914] nl80211: internal: extend CAC time for weather radar
+Subject: [PATCH 901/913] nl80211: mtk: extend CAC time for weather radar
  channels
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
@@ -28,5 +28,5 @@
  	if (!err) {
  		wdev->chandef = chandef;
 -- 
-2.18.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/903-mac80211-mtk-it-s-invalid-case-when-frag_threshold-is-gr.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/902-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch
old mode 100755
new mode 100644
similarity index 78%
rename from recipes-wifi/linux-mac80211/files/patches/subsys/903-mac80211-mtk-it-s-invalid-case-when-frag_threshold-is-gr.patch
rename to recipes-wifi/linux-mac80211/files/patches/subsys/902-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch
index 86c46d6..148adaa
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/903-mac80211-mtk-it-s-invalid-case-when-frag_threshold-is-gr.patch
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/902-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch
@@ -1,8 +1,8 @@
-From 44c44546d83d2711a84dc5456f4cb0c34bf544dc Mon Sep 17 00:00:00 2001
+From f778353f05e1d333c5b88b0e006b4737a0069bfb Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Fri, 1 Apr 2022 09:15:21 +0800
-Subject: [PATCH 903/914] mac80211: it's invalid case when frag_threshold is
- greater than 2346
+Subject: [PATCH 902/913] mac80211: mtk: it's invalid case when frag_threshold
+ is greater than 2346
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
@@ -24,5 +24,5 @@
  			/*
  			 * Fragments (apart from the last one) are required to
 -- 
-2.18.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/904-mac80211-mtk-correct-legacy-rates-check-in-ieee80211_cal.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/903-mac80211-mtk-correct-legacy-rates-check-in-ieee80211.patch
similarity index 86%
rename from recipes-wifi/linux-mac80211/files/patches/subsys/904-mac80211-mtk-correct-legacy-rates-check-in-ieee80211_cal.patch
rename to recipes-wifi/linux-mac80211/files/patches/subsys/903-mac80211-mtk-correct-legacy-rates-check-in-ieee80211.patch
index 7981d52..f5d8954 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/904-mac80211-mtk-correct-legacy-rates-check-in-ieee80211_cal.patch
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/903-mac80211-mtk-correct-legacy-rates-check-in-ieee80211.patch
@@ -1,7 +1,7 @@
-From c837634171320f2cb39f43153208538683ac5fdb Mon Sep 17 00:00:00 2001
+From 43a6f5ea706ca390d094c2e6e2c69483d329d794 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
 Date: Mon, 7 Mar 2022 15:18:00 +0800
-Subject: [PATCH 904/914] mac80211: correct legacy rates check in
+Subject: [PATCH 903/913] mac80211: mtk: correct legacy rates check in
  ieee80211_calc_rx_airtime
 
 There are no legacy rates on 60GHz or sub-1Ghz band, so modify the check.
@@ -28,5 +28,5 @@
  
  		sband = hw->wiphy->bands[status->band];
 -- 
-2.18.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/905-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FEATUR.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/904-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch
similarity index 86%
rename from recipes-wifi/linux-mac80211/files/patches/subsys/905-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FEATUR.patch
rename to recipes-wifi/linux-mac80211/files/patches/subsys/904-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch
index ea2fa77..ffb994d 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/905-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FEATUR.patch
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/904-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch
@@ -1,7 +1,7 @@
-From f85db6e56ba3b559d3affffc3baad9f21d60c5f6 Mon Sep 17 00:00:00 2001
+From 7f64e9daee959b3ffd219ced0b3899fba4b3d6c9 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 19 Oct 2022 13:42:43 +0800
-Subject: [PATCH 905/914] mac80211: airtime_flags depends on
+Subject: [PATCH 904/913] mac80211: mtk: airtime_flags depends on
  NL80211_EXT_FEATURE
 
 Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
@@ -26,5 +26,5 @@
  	atomic_set(&local->aql_total_pending_airtime, 0);
  
 -- 
-2.18.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/906-mac80211-mtk-add-support-for-runtime-set-inband-discovery.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/905-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch
similarity index 95%
rename from recipes-wifi/linux-mac80211/files/patches/subsys/906-mac80211-mtk-add-support-for-runtime-set-inband-discovery.patch
rename to recipes-wifi/linux-mac80211/files/patches/subsys/905-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch
index 86f3931..4283cd9 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/906-mac80211-mtk-add-support-for-runtime-set-inband-discovery.patch
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/905-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch
@@ -1,7 +1,7 @@
-From b4551b622d6a57b6613200bee2f83729e64ba64e Mon Sep 17 00:00:00 2001
+From d354d01045b432d2dcb26c3aba26b3f6864dc796 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 19 Oct 2022 13:45:42 +0800
-Subject: [PATCH 906/914] mac80211: add support for runtime set inband
+Subject: [PATCH 905/913] mac80211: mtk: add support for runtime set inband
  discovery
 
 Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
@@ -14,7 +14,7 @@
  5 files changed, 61 insertions(+), 5 deletions(-)
 
 diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
-index ab83553..f594914 100644
+index 8e05f55..ae2af09 100644
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
 @@ -1158,6 +1158,7 @@ struct cfg80211_fils_discovery {
@@ -26,7 +26,7 @@
  
  /**
 diff --git a/include/net/mac80211.h b/include/net/mac80211.h
-index edcad3b..bde3495 100644
+index 4d3cfb1..66fedf6 100644
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
 @@ -505,6 +505,7 @@ struct ieee80211_ftm_responder_params {
@@ -50,7 +50,7 @@
  	/* keep last */
  	__NL80211_FILS_DISCOVERY_ATTR_LAST,
 diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
-index b582730..1328827 100644
+index abe7318..bf71594 100644
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
 @@ -906,6 +906,7 @@ static int ieee80211_set_fils_discovery(struct ieee80211_sub_if_data *sdata,
@@ -177,5 +177,5 @@
  }
  
 -- 
-2.18.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/907-mac80211-mtk-add-s1g-category-to-_ieee80211_is_robust_mg.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/906-mac80211-mtk-add-s1g-category-to-_ieee80211_is_robus.patch
similarity index 73%
rename from recipes-wifi/linux-mac80211/files/patches/subsys/907-mac80211-mtk-add-s1g-category-to-_ieee80211_is_robust_mg.patch
rename to recipes-wifi/linux-mac80211/files/patches/subsys/906-mac80211-mtk-add-s1g-category-to-_ieee80211_is_robus.patch
index 541f25e..8c1a106 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/907-mac80211-mtk-add-s1g-category-to-_ieee80211_is_robust_mg.patch
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/906-mac80211-mtk-add-s1g-category-to-_ieee80211_is_robus.patch
@@ -1,7 +1,7 @@
-From de6defeb50a0b5eab25eedffd6f54f495c6ecf78 Mon Sep 17 00:00:00 2001
+From 943e7ae7d48101a676f7804b1962fb8c9ff43b68 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Wed, 8 Jun 2022 10:26:39 +0800
-Subject: [PATCH 907/914] mac80211: add s1g category to
+Subject: [PATCH 906/913] mac80211: mtk: add s1g category to
  _ieee80211_is_robust_mgmt_frame
 
 Unprotected S1G with code 22 is not robust mgmt frame.
@@ -10,10 +10,10 @@
  1 file changed, 1 insertion(+)
 
 diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
-index 6942645..195835f 100644
+index 00ed7c1..59de3dc 100644
 --- a/include/linux/ieee80211.h
 +++ b/include/linux/ieee80211.h
-@@ -3696,6 +3696,7 @@ static inline bool _ieee80211_is_robust_mgmt_frame(struct ieee80211_hdr *hdr)
+@@ -3700,6 +3700,7 @@ static inline bool _ieee80211_is_robust_mgmt_frame(struct ieee80211_hdr *hdr)
  			*category != WLAN_CATEGORY_SELF_PROTECTED &&
  			*category != WLAN_CATEGORY_UNPROT_DMG &&
  			*category != WLAN_CATEGORY_VHT &&
@@ -22,5 +22,5 @@
  	}
  
 -- 
-2.18.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/908-mac80211-mtk-mask-kernel-version-limitation-and-fill-for.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/907-mac80211-mtk-mask-kernel-version-limitation-and-fill.patch
similarity index 90%
rename from recipes-wifi/linux-mac80211/files/patches/subsys/908-mac80211-mtk-mask-kernel-version-limitation-and-fill-for.patch
rename to recipes-wifi/linux-mac80211/files/patches/subsys/907-mac80211-mtk-mask-kernel-version-limitation-and-fill.patch
index 5ac1559..709d9df 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/908-mac80211-mtk-mask-kernel-version-limitation-and-fill-for.patch
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/907-mac80211-mtk-mask-kernel-version-limitation-and-fill.patch
@@ -1,8 +1,8 @@
-From bb2d81974833d5ee908efc2a2cb033304cff1f51 Mon Sep 17 00:00:00 2001
+From 80f2272f822c0df59885ec78fbec78ee99c086c9 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 11 Mar 2022 11:34:11 +0800
-Subject: [PATCH 908/914] mac80211: mask kernel version limitation and fill
- forward path in kernel 5.4
+Subject: [PATCH 907/913] mac80211: mtk: mask kernel version limitation and
+ fill forward path in kernel 5.4
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -13,10 +13,10 @@
  4 files changed, 10 deletions(-)
 
 diff --git a/include/net/mac80211.h b/include/net/mac80211.h
-index bde3495..35dbf62 100644
+index 66fedf6..95e5e66 100644
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -4294,13 +4294,11 @@ struct ieee80211_ops {
+@@ -4292,13 +4292,11 @@ struct ieee80211_ops {
  				     struct ieee80211_sta *sta, u8 flowid);
  	int (*set_radar_background)(struct ieee80211_hw *hw,
  				    struct cfg80211_chan_def *chandef);
@@ -50,7 +50,7 @@
  
  #endif /* __MAC80211_DRIVER_OPS */
 diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
-index b777921..e7c85ce 100644
+index 717dfda..455791f 100644
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
 @@ -852,7 +852,6 @@ static const struct net_device_ops ieee80211_monitorif_ops = {
@@ -99,5 +99,5 @@
  #endif /* !__MAC80211_DRIVER_TRACE || TRACE_HEADER_MULTI_READ */
  
 -- 
-2.18.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/909-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-idx.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/908-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch
similarity index 90%
rename from recipes-wifi/linux-mac80211/files/patches/subsys/909-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-idx.patch
rename to recipes-wifi/linux-mac80211/files/patches/subsys/908-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch
index 7129a3f..a775793 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/909-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-idx.patch
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/908-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch
@@ -1,7 +1,8 @@
-From 670b284d0098d142aa5144dfdc8fa57ac4a6c23f Mon Sep 17 00:00:00 2001
+From b3588468a5db1cad433658a7d9be76f91bb56f51 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Wed, 18 May 2022 15:10:22 +0800
-Subject: [PATCH 909/914] mac80211: add fill receive path ops to get wed idx
+Subject: [PATCH 908/913] mac80211: mtk: add fill receive path ops to get wed
+ idx
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -16,10 +17,10 @@
 diff --git a/include/net/mac80211.h b/include/net/mac80211.h
 old mode 100644
 new mode 100755
-index 35dbf62..43a4ddb
+index 95e5e66..9a38b9f
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1791,6 +1791,13 @@ struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev);
+@@ -1796,6 +1796,13 @@ struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev);
   */
  struct wireless_dev *ieee80211_vif_to_wdev(struct ieee80211_vif *vif);
  
@@ -33,7 +34,7 @@
  /**
   * enum ieee80211_key_flags - key flags
   *
-@@ -3964,6 +3971,8 @@ struct ieee80211_prep_tx_info {
+@@ -3962,6 +3969,8 @@ struct ieee80211_prep_tx_info {
   *	disable background CAC/radar detection.
   * @net_fill_forward_path: Called from .ndo_fill_forward_path in order to
   *	resolve a path for hardware flow offloading
@@ -42,7 +43,7 @@
   */
  struct ieee80211_ops {
  	void (*tx)(struct ieee80211_hw *hw,
-@@ -4299,6 +4308,9 @@ struct ieee80211_ops {
+@@ -4297,6 +4306,9 @@ struct ieee80211_ops {
  				     struct ieee80211_sta *sta,
  				     struct net_device_path_ctx *ctx,
  				     struct net_device_path *path);
@@ -75,7 +76,7 @@
 +
  #endif /* __MAC80211_DRIVER_OPS */
 diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
-index e7c85ce..c222348 100644
+index 455791f..98b2369 100644
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
 @@ -910,6 +910,29 @@ out:
@@ -119,7 +120,7 @@
 diff --git a/net/mac80211/util.c b/net/mac80211/util.c
 old mode 100644
 new mode 100755
-index fb9d0a0..f799e63
+index 8d36b05..d26a2b8
 --- a/net/mac80211/util.c
 +++ b/net/mac80211/util.c
 @@ -898,6 +898,15 @@ struct wireless_dev *ieee80211_vif_to_wdev(struct ieee80211_vif *vif)
@@ -139,5 +140,5 @@
   * Nothing should have been stuffed into the workqueue during
   * the suspend->resume cycle. Since we can't check each caller
 -- 
-2.18.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/910-mac80211-mtk-make-4addr-null-frames-using-min_rate-.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/909-mac80211-mtk-make-4addr-null-frames-using-min_rate-f.patch
similarity index 81%
rename from recipes-wifi/linux-mac80211/files/patches/subsys/910-mac80211-mtk-make-4addr-null-frames-using-min_rate-.patch
rename to recipes-wifi/linux-mac80211/files/patches/subsys/909-mac80211-mtk-make-4addr-null-frames-using-min_rate-f.patch
index ec81394..81e7f9e 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/910-mac80211-mtk-make-4addr-null-frames-using-min_rate-.patch
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/909-mac80211-mtk-make-4addr-null-frames-using-min_rate-f.patch
@@ -1,7 +1,7 @@
-From e7f4d518cdecfce077b4cf7a68678e1781dfe974 Mon Sep 17 00:00:00 2001
+From bd1494ce4b7b37130b989839a0f516346c237ae4 Mon Sep 17 00:00:00 2001
 From: Lian Chen <lian.chen@mediatek.com>
 Date: Thu, 14 Jul 2022 16:33:58 +0800
-Subject: [PATCH 910/914] wifi: mac80211: make 4addr null frames using min_rate
+Subject: [PATCH 909/913] mac80211: mtk: make 4addr null frames using min_rate
  for WDS
 
 WDS needs 4addr packets to trigger AP for wlan0.sta creation.
@@ -15,7 +15,7 @@
  1 file changed, 1 insertion(+)
 
 diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
-index 1548f53..4d6d469 100644
+index cc6d38a..f97bf2b 100644
 --- a/net/mac80211/mlme.c
 +++ b/net/mac80211/mlme.c
 @@ -1133,6 +1133,7 @@ void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
@@ -27,5 +27,5 @@
  }
  
 -- 
-2.18.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/911-mac80211-mtk-remove-timerout-handle-for-ax210-iot-issue.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/910-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch
similarity index 85%
rename from recipes-wifi/linux-mac80211/files/patches/subsys/911-mac80211-mtk-remove-timerout-handle-for-ax210-iot-issue.patch
rename to recipes-wifi/linux-mac80211/files/patches/subsys/910-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch
index acbd4c8..a48b09f 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/911-mac80211-mtk-remove-timerout-handle-for-ax210-iot-issue.patch
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/910-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch
@@ -1,7 +1,8 @@
-From 1219001aaad2726e02f4b23e33cad3ae51806cd1 Mon Sep 17 00:00:00 2001
+From d92235daff095ce30d865d1b809059b5fa02a28d Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 19 Oct 2022 13:49:21 +0800
-Subject: [PATCH 911/914] mac80211: remove timerout handle for ax210 iot issue
+Subject: [PATCH 910/913] mac80211: mtk: remove timerout handle for ax210 iot
+ issue
 
 Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
 ---
@@ -30,5 +31,5 @@
  	ht_dbg(sta->sdata, "tx session timer expired on %pM tid %d\n",
  	       sta->sta.addr, tid);
 -- 
-2.18.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/912-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-skip-.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/911-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch
similarity index 96%
rename from recipes-wifi/linux-mac80211/files/patches/subsys/912-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-skip-.patch
rename to recipes-wifi/linux-mac80211/files/patches/subsys/911-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch
index d60e8d8..56b0d63 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/912-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-skip-.patch
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/911-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch
@@ -1,8 +1,8 @@
-From 3ff7c67f8b03762e096ed9ac6eaa5d9d6c80bb65 Mon Sep 17 00:00:00 2001
+From 1f7f93c72eb98c299f6ac000a9add3fe04087ef3 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 22 Sep 2022 14:27:41 +0800
-Subject: [PATCH 912/914] cfg80211: implement DFS status show, cac and nop skip
- command via debugfs
+Subject: [PATCH 911/913] cfg80211: mtk: implement DFS status show, cac and nop
+ skip command via debugfs
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -16,7 +16,7 @@
  7 files changed, 318 insertions(+), 7 deletions(-)
 
 diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
-index f594914..7d20b98 100644
+index ae2af09..b97ddbd 100644
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
 @@ -4401,6 +4401,7 @@ struct cfg80211_ops {
@@ -28,10 +28,10 @@
  
  /*
 diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
-index 1328827..d1fc54d 100644
+index bf71594..97c5e5d 100644
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -4517,6 +4517,24 @@ ieee80211_set_radar_background(struct wiphy *wiphy,
+@@ -4504,6 +4504,24 @@ ieee80211_set_radar_background(struct wiphy *wiphy,
  	return local->ops->set_radar_background(&local->hw, chandef);
  }
  
@@ -56,7 +56,7 @@
  const struct cfg80211_ops mac80211_config_ops = {
  	.add_virtual_intf = ieee80211_add_iface,
  	.del_virtual_intf = ieee80211_del_iface,
-@@ -4623,4 +4641,5 @@ const struct cfg80211_ops mac80211_config_ops = {
+@@ -4610,4 +4628,5 @@ const struct cfg80211_ops mac80211_config_ops = {
  	.set_sar_specs = ieee80211_set_sar_specs,
  	.color_change = ieee80211_color_change,
  	.set_radar_background = ieee80211_set_radar_background,
@@ -77,7 +77,7 @@
  	struct work_struct background_cac_abort_wk;
  
 diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c
-index aab4346..517e09f 100644
+index 0878b16..ea50cc7 100644
 --- a/net/wireless/debugfs.c
 +++ b/net/wireless/debugfs.c
 @@ -9,6 +9,7 @@
@@ -88,7 +88,7 @@
  
  #define DEBUGFS_READONLY_FILE(name, buflen, fmt, value...)		\
  static ssize_t name## _read(struct file *file, char __user *userbuf,	\
-@@ -95,16 +96,271 @@ static const struct file_operations ht40allow_map_ops = {
+@@ -96,16 +97,271 @@ static const struct file_operations ht40allow_map_ops = {
  	.llseek = default_llseek,
  };
  
@@ -454,5 +454,5 @@
  
  #undef TRACE_INCLUDE_PATH
 -- 
-2.18.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/913-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-as-1.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/912-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch
similarity index 72%
rename from recipes-wifi/linux-mac80211/files/patches/subsys/913-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-as-1.patch
rename to recipes-wifi/linux-mac80211/files/patches/subsys/912-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch
index a5d1de6..6d2768c 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/913-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-as-1.patch
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/912-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch
@@ -1,10 +1,10 @@
-From 4b13f8c000233eaca0dfb184724ff787148fc2bc Mon Sep 17 00:00:00 2001
+From 2ab83ae18c82ad410bc9eab8c49d8f1718c9f7b2 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 4 Oct 2022 10:47:05 +0800
-Subject: [PATCH 913/914] mac80211: Set TWT Information Frame Disabled bit as
- 1. This modification means that current implementation do not support twt
- information frame.
+Subject: [PATCH 912/913] mac80211: mtk: Set TWT Information Frame Disabled bit
+ as 1.
 
+This modification means that current implementation do not support twt information frame.
 ---
  net/mac80211/s1g.c | 1 +
  1 file changed, 1 insertion(+)
@@ -22,5 +22,5 @@
  	/* broadcast TWT not supported yet */
  	if (twt->control & IEEE80211_TWT_CONTROL_NEG_TYPE_BROADCAST) {
 -- 
-2.18.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/914-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on-DFS.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/913-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on.patch
similarity index 95%
rename from recipes-wifi/linux-mac80211/files/patches/subsys/914-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on-DFS.patch
rename to recipes-wifi/linux-mac80211/files/patches/subsys/913-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on.patch
index 8022163..9cacdfb 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/914-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on-DFS.patch
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/913-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on.patch
@@ -1,8 +1,8 @@
-From 4cd2b159ef1f560721a830d6c0e0ae69169521b4 Mon Sep 17 00:00:00 2001
+From af85a4c0624897cb92ba6f543b322bb1fcbe9845 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 5 Oct 2022 19:13:43 +0800
-Subject: [PATCH 914/914] mac80211: fix the issue of AP and STA starting on DFS
- channel concurrently
+Subject: [PATCH 913/913] mac80211: mtk: fix the issue of AP and STA starting
+ on DFS channel concurrently
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -17,7 +17,7 @@
  8 files changed, 109 insertions(+), 5 deletions(-)
 
 diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
-index 7d20b98..defce1e 100644
+index b97ddbd..c4c0926 100644
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
 @@ -800,6 +800,24 @@ cfg80211_chandef_identical(const struct cfg80211_chan_def *chandef1,
@@ -76,10 +76,10 @@
  	NUM_NL80211_ATTR = __NL80211_ATTR_AFTER_LAST,
  	NL80211_ATTR_MAX = __NL80211_ATTR_AFTER_LAST - 1
 diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
-index d1fc54d..c40256d 100644
+index 97c5e5d..d726410 100644
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -4535,6 +4535,49 @@ ieee80211_skip_cac(struct wireless_dev *wdev)
+@@ -4522,6 +4522,49 @@ ieee80211_skip_cac(struct wireless_dev *wdev)
  	}
  }
  
@@ -129,7 +129,7 @@
  const struct cfg80211_ops mac80211_config_ops = {
  	.add_virtual_intf = ieee80211_add_iface,
  	.del_virtual_intf = ieee80211_del_iface,
-@@ -4642,4 +4685,5 @@ const struct cfg80211_ops mac80211_config_ops = {
+@@ -4629,4 +4672,5 @@ const struct cfg80211_ops mac80211_config_ops = {
  	.color_change = ieee80211_color_change,
  	.set_radar_background = ieee80211_set_radar_background,
  	.skip_cac = ieee80211_skip_cac,
@@ -254,5 +254,5 @@
  
  #undef TRACE_INCLUDE_PATH
 -- 
-2.18.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc b/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc
index 557d22c..7415c72 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc
@@ -49,18 +49,18 @@
     file://782-net-next-1-of-net-pass-the-dst-buffer-to-of_get_mac_address.patch \
     file://783-sync-nl80211.patch \
     file://800-mac80211-mask-nested-A-MSDU-support-for-mesh.patch \
-    file://901-mac80211-mtk-check-twt-responder-when-setu-twt.patch \
-    file://902-nl80211-mtk-internal-extend-CAC-time-for-weather-radar-c.patch \
-    file://903-mac80211-mtk-it-s-invalid-case-when-frag_threshold-is-gr.patch \
-    file://904-mac80211-mtk-correct-legacy-rates-check-in-ieee80211_cal.patch \
-    file://905-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FEATUR.patch \
-    file://906-mac80211-mtk-add-support-for-runtime-set-inband-discovery.patch \
-    file://907-mac80211-mtk-add-s1g-category-to-_ieee80211_is_robust_mg.patch \
-    file://908-mac80211-mtk-mask-kernel-version-limitation-and-fill-for.patch \
-    file://909-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-idx.patch \
-    file://910-mac80211-mtk-make-4addr-null-frames-using-min_rate-.patch \
-    file://911-mac80211-mtk-remove-timerout-handle-for-ax210-iot-issue.patch \
-    file://912-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-skip-.patch \
-    file://913-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-as-1.patch \
-    file://914-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on-DFS.patch \
+    file://900-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch \
+    file://901-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch \
+    file://902-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch \
+    file://903-mac80211-mtk-correct-legacy-rates-check-in-ieee80211.patch \
+    file://904-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch \
+    file://905-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch \
+    file://906-mac80211-mtk-add-s1g-category-to-_ieee80211_is_robus.patch \
+    file://907-mac80211-mtk-mask-kernel-version-limitation-and-fill.patch \
+    file://908-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch \
+    file://909-mac80211-mtk-make-4addr-null-frames-using-min_rate-f.patch \
+    file://910-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch \
+    file://911-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch \
+    file://912-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch \
+    file://913-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on.patch \
     "
diff --git a/recipes-wifi/linux-mt76/files/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch b/recipes-wifi/linux-mt76/files/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch
index 113b411..2486ace 100644
--- a/recipes-wifi/linux-mt76/files/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch
@@ -1,4 +1,4 @@
-From 09ef6b695a93055d885869222614a936ed309dc2 Mon Sep 17 00:00:00 2001
+From 479f0201a71ac4d3d7fac187fe7b0eeb4bf490ae Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 6 Jun 2022 19:46:26 +0800
 Subject: [PATCH 1/3] mt76: mt7915: rework testmode init registers
@@ -11,10 +11,10 @@
  4 files changed, 55 insertions(+), 18 deletions(-)
 
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 3c840853..813d6f40 100644
+index 3b4ede3b..19518cb5 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -113,6 +113,7 @@ static const u32 mt7986_reg[] = {
+@@ -118,6 +118,7 @@ static const u32 mt7986_reg[] = {
  };
  
  static const u32 mt7915_offs[] = {
@@ -22,7 +22,7 @@
  	[TMAC_CDTR]		= 0x090,
  	[TMAC_ODTR]		= 0x094,
  	[TMAC_ATCR]		= 0x098,
-@@ -187,6 +188,7 @@ static const u32 mt7915_offs[] = {
+@@ -192,6 +193,7 @@ static const u32 mt7915_offs[] = {
  };
  
  static const u32 mt7916_offs[] = {
@@ -31,10 +31,10 @@
  	[TMAC_ODTR]		= 0x0cc,
  	[TMAC_ATCR]		= 0x00c,
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 0c61f125..947f02f2 100644
+index aca1b2f1..688f7dee 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -47,6 +47,7 @@ enum reg_rev {
+@@ -48,6 +48,7 @@ enum reg_rev {
  };
  
  enum offs_rev {
@@ -42,7 +42,7 @@
  	TMAC_CDTR,
  	TMAC_ODTR,
  	TMAC_ATCR,
-@@ -197,6 +198,12 @@ enum offs_rev {
+@@ -198,6 +199,12 @@ enum offs_rev {
  #define MT_TRB_RXPSR0_RX_WTBL_PTR	GENMASK(25, 16)
  #define MT_TRB_RXPSR0_RX_RMAC_PTR	GENMASK(9, 0)
  
@@ -55,7 +55,7 @@
  /* TMAC: band 0(0x820e4000), band 1(0x820f4000) */
  #define MT_WF_TMAC_BASE(_band)		((_band) ? 0x820f4000 : 0x820e4000)
  #define MT_WF_TMAC(_band, ofs)		(MT_WF_TMAC_BASE(_band) + (ofs))
-@@ -205,6 +212,9 @@ enum offs_rev {
+@@ -206,6 +213,9 @@ enum offs_rev {
  #define MT_TMAC_TCR0_TX_BLINK		GENMASK(7, 6)
  #define MT_TMAC_TCR0_TBTT_STOP_CTRL	BIT(25)
  
@@ -65,7 +65,7 @@
  #define MT_TMAC_CDTR(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_CDTR))
   #define MT_TMAC_ODTR(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_ODTR))
  #define MT_TIMEOUT_VAL_PLCP		GENMASK(15, 0)
-@@ -484,8 +494,10 @@ enum offs_rev {
+@@ -485,8 +495,10 @@ enum offs_rev {
  #define MT_AGG_PCR0_VHT_PROT		BIT(13)
  #define MT_AGG_PCR0_PTA_WIN_DIS		BIT(15)
  
@@ -79,7 +79,7 @@
  #define MT_AGG_ACR0(_band)		MT_WF_AGG(_band, __OFFS(AGG_ACR0))
  #define MT_AGG_ACR_CFEND_RATE		GENMASK(13, 0)
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index a979460f..819fafe4 100644
+index 7ace05e0..f7aacea7 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -30,7 +30,7 @@ struct reg_band {
diff --git a/recipes-wifi/linux-mt76/files/patches/0002-mt76-mt7915-rework-rx-testmode-stats.patch b/recipes-wifi/linux-mt76/files/patches/0002-mt76-mt7915-rework-rx-testmode-stats.patch
index 080285a..3195054 100644
--- a/recipes-wifi/linux-mt76/files/patches/0002-mt76-mt7915-rework-rx-testmode-stats.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0002-mt76-mt7915-rework-rx-testmode-stats.patch
@@ -1,4 +1,4 @@
-From 2e3e45da59fc715a8d6b4771d3773536944cb480 Mon Sep 17 00:00:00 2001
+From 3de6b1807318a65e6f586c01a30c9b50d5fe7594 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 3 Jan 2022 17:09:53 +0800
 Subject: [PATCH 2/3] mt76: mt7915: rework rx testmode stats
@@ -15,10 +15,10 @@
  8 files changed, 109 insertions(+), 17 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 30c1bc56..e5d8f45b 100644
+index acac04ef..9a908c9a 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -756,7 +756,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
+@@ -761,7 +761,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
  	}
  
  #ifdef CONFIG_NL80211_TESTMODE
@@ -29,10 +29,10 @@
  		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
  			phy->test.rx_stats.fcs_error[q]++;
 diff --git a/mt76.h b/mt76.h
-index a2bccf6b..1b468ccc 100644
+index 33f87e51..66059d2e 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -626,6 +626,8 @@ struct mt76_testmode_ops {
+@@ -637,6 +637,8 @@ struct mt76_testmode_ops {
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
  };
  
@@ -41,7 +41,7 @@
  struct mt76_testmode_data {
  	enum mt76_testmode_state state;
  
-@@ -657,6 +659,8 @@ struct mt76_testmode_data {
+@@ -668,6 +670,8 @@ struct mt76_testmode_data {
  
  	u8 addr[3][ETH_ALEN];
  
@@ -50,7 +50,7 @@
  	u32 tx_pending;
  	u32 tx_queued;
  	u16 tx_queued_limit;
-@@ -664,6 +668,7 @@ struct mt76_testmode_data {
+@@ -675,6 +679,7 @@ struct mt76_testmode_data {
  	struct {
  		u64 packets[__MT_RXQ_MAX];
  		u64 fcs_error[__MT_RXQ_MAX];
@@ -59,10 +59,10 @@
  };
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 87c65d25..b27a62aa 100644
+index 72d235a1..46584e6f 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1143,6 +1143,7 @@ enum {
+@@ -1169,6 +1169,7 @@ enum {
  	MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
  	MCU_EXT_CMD_SET_RDD_TH = 0x9d,
  	MCU_EXT_CMD_MURU_CTRL = 0x9f,
@@ -71,7 +71,7 @@
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index c19b5d66..a788277c 100644
+index 46c517e5..ff3eedab 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -9,6 +9,7 @@
@@ -83,7 +83,7 @@
  	MCU_ATE_CLEAN_TXQUEUE = 0x1c,
  };
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 819fafe4..8d99edcb 100644
+index f7aacea7..931d1db2 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -133,6 +133,21 @@ mt7915_tm_clean_hwq(struct mt7915_phy *phy, u8 wcid)
@@ -174,7 +174,7 @@
  		mt7915_tm_update_channel(phy);
  
  		/* read-clear */
--		mt76_rr(dev, MT_MIB_SDR3(phy != &dev->phy));
+-		mt76_rr(dev, MT_MIB_SDR3(phy->band_idx));
 +		mt7915_tm_get_rx_stats(phy, true);
 +
 +		/* clear fw count */
diff --git a/recipes-wifi/linux-mt76/files/patches/0003-mt76-mt7915-drop-undefined-action-frame.patch b/recipes-wifi/linux-mt76/files/patches/0003-mt76-mt7915-drop-undefined-action-frame.patch
index 6e9b9cf..eee92c7 100644
--- a/recipes-wifi/linux-mt76/files/patches/0003-mt76-mt7915-drop-undefined-action-frame.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0003-mt76-mt7915-drop-undefined-action-frame.patch
@@ -1,4 +1,4 @@
-From 6a6b3db016a9279fed1a0bf82ca22c8da4372f36 Mon Sep 17 00:00:00 2001
+From 7b6cdc212a271ba909f8ff569db4da70280606ee Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 14 Apr 2022 15:18:02 +0800
 Subject: [PATCH 3/3] mt76: mt7915: drop undefined action frame
@@ -8,10 +8,10 @@
  1 file changed, 6 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 99123e77..3e4033e7 100644
+index 97a19bdb..30b44b53 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -717,6 +717,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -749,6 +749,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  			  struct mt76_tx_info *tx_info)
  {
  	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx_info->skb->data;
@@ -20,7 +20,7 @@
  	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
  	struct ieee80211_key_conf *key = info->control.hw_key;
-@@ -747,6 +749,10 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -779,6 +781,10 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size);
  	t->skb = tx_info->skb;
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch b/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
index 4b47ac2..9cb4900 100644
--- a/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
@@ -1,7 +1,7 @@
-From 28fa372d1081e899eb59f776a3fbb27ed7105682 Mon Sep 17 00:00:00 2001
+From a1e88291d8d20a423b9975359d2196491e58b500 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 22 Jun 2022 10:39:47 +0800
-Subject: [PATCH] mt76: mt7915: add mtk internal debug tools for mt76
+Subject: [PATCH 1001/1008] mt76: mt7915: add mtk internal debug tools for mt76
 
 ---
  mt76_connac_mcu.h     |    7 +
@@ -22,10 +22,10 @@
  create mode 100644 mt7915/mtk_mcu.c
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index b27a62aa..f7d00726 100644
+index 46584e6f..c0fa2334 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1109,6 +1109,7 @@ enum {
+@@ -1135,6 +1135,7 @@ enum {
  	MCU_EXT_CMD_SET_TX_POWER_CTRL = 0x11,
  	MCU_EXT_CMD_FW_LOG_2_HOST = 0x13,
  	MCU_EXT_CMD_TXBF_ACTION = 0x1e,
@@ -33,7 +33,7 @@
  	MCU_EXT_CMD_EFUSE_BUFFER_MODE = 0x21,
  	MCU_EXT_CMD_THERMAL_PROT = 0x23,
  	MCU_EXT_CMD_STA_REC_UPDATE = 0x25,
-@@ -1132,6 +1133,12 @@ enum {
+@@ -1158,6 +1159,12 @@ enum {
  	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
  	MCU_EXT_CMD_RXDCOC_CAL = 0x59,
  	MCU_EXT_CMD_GET_MIB_INFO = 0x5a,
@@ -60,7 +60,7 @@
  mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 766e6208..21407030 100644
+index 30f8f18b..092d8434 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -8,6 +8,9 @@
@@ -137,7 +137,7 @@
  	return mt7915_fw_debug_wm_set(dev, dev->fw.debug_wm);
  }
  
-@@ -1090,6 +1120,11 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+@@ -1103,6 +1133,11 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
  	if (!ext_phy)
  		dev->debugfs_dir = dir;
  
@@ -149,7 +149,7 @@
  	return 0;
  }
  
-@@ -1130,17 +1165,53 @@ void mt7915_debugfs_rx_fw_monitor(struct mt7915_dev *dev, const void *data, int
+@@ -1143,17 +1178,53 @@ void mt7915_debugfs_rx_fw_monitor(struct mt7915_dev *dev, const void *data, int
  		.msg_type = cpu_to_le16(PKT_TYPE_RX_FW_MONITOR),
  	};
  
@@ -204,10 +204,10 @@
  
  	if (dev->relay_fwlog)
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 3e4033e7..931a3a14 100644
+index 30b44b53..609f10d4 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -271,6 +271,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -301,6 +301,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
  	__le16 fc = 0;
  	int idx;
  
@@ -218,7 +218,7 @@
  	memset(status, 0, sizeof(*status));
  
  	if ((rxd1 & MT_RXD1_NORMAL_BAND_IDX) && !phy->band_idx) {
-@@ -454,6 +458,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -484,6 +488,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
  	}
  
  	hdr_gap = (u8 *)rxd - skb->data + 2 * remove_pad;
@@ -229,7 +229,7 @@
  	if (hdr_trans && ieee80211_has_morefrags(fc)) {
  		struct ieee80211_vif *vif;
  		int err;
-@@ -795,6 +803,12 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -827,6 +835,12 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	tx_info->buf[1].skip_unmap = true;
  	tx_info->nbuf = MT_CT_DMA_BUF_NUM;
  
@@ -243,7 +243,7 @@
  }
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index fe5ec166..16ae61e5 100644
+index 2505fa7e..b6e5f97c 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -58,7 +58,11 @@ int mt7915_run(struct ieee80211_hw *hw)
@@ -259,10 +259,10 @@
  		goto out;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 09e3dd8e..9cd06a0c 100644
+index 36c21596..5af6de5d 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -195,6 +195,11 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
+@@ -199,6 +199,11 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
  	else
  		qid = MT_MCUQ_WM;
  
@@ -274,7 +274,7 @@
  	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
  }
  
-@@ -3199,6 +3204,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+@@ -3307,6 +3312,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
  		.sku_enable = enable,
  	};
  
@@ -283,7 +283,7 @@
  	return mt76_mcu_send_msg(&dev->mt76,
  				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
  				 sizeof(req), true);
-@@ -3474,6 +3481,43 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3744,6 +3751,43 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -327,7 +327,7 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  {
  	struct {
-@@ -3502,3 +3546,22 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
+@@ -3772,3 +3816,22 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  
  	return 0;
  }
@@ -351,10 +351,10 @@
 +}
 +#endif
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index a788277c..7f1216fe 100644
+index ff3eedab..2d057279 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -261,6 +261,10 @@ enum {
+@@ -272,6 +272,10 @@ enum {
  	MCU_WA_PARAM_PDMA_RX = 0x04,
  	MCU_WA_PARAM_CPU_UTIL = 0x0b,
  	MCU_WA_PARAM_RED = 0x0e,
@@ -366,7 +366,7 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 9cb680e7..25bec88f 100644
+index 42f21343..2f91020c 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -9,6 +9,7 @@
@@ -377,7 +377,7 @@
  #define MT7915_MAX_INTERFACES		19
  #define MT7915_WTBL_SIZE		288
  #define MT7916_WTBL_SIZE		544
-@@ -366,6 +367,29 @@ struct mt7915_dev {
+@@ -368,6 +369,29 @@ struct mt7915_dev {
  	struct reset_control *rstc;
  	void __iomem *dcm;
  	void __iomem *sku;
@@ -407,7 +407,7 @@
  };
  
  enum {
-@@ -638,4 +662,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -645,4 +669,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch b/recipes-wifi/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
index 654af4f..8af2b3a 100644
--- a/recipes-wifi/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
@@ -17,18 +17,18 @@
  create mode 100644 mt7915/vendor.h
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index f7d00726..dc1a2ef7 100644
+index c0fa2334..3ad59e53 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -984,6 +984,7 @@ enum {
+@@ -987,6 +987,7 @@ enum {
  	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
  	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
  	MCU_EXT_EVENT_MURU_CTRL = 0x9f,
 +	MCU_EXT_EVENT_CSI_REPORT = 0xc2,
  };
  
- enum {
-@@ -1155,6 +1156,7 @@ enum {
+ /* unified event table */
+@@ -1181,6 +1182,7 @@ enum {
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
@@ -37,7 +37,7 @@
  
  enum {
 diff --git a/mt7915/Makefile b/mt7915/Makefile
-index c663ceb1..830589d0 100644
+index a42866e9..14ce98a6 100644
 --- a/mt7915/Makefile
 +++ b/mt7915/Makefile
 @@ -1,9 +1,9 @@
@@ -52,12 +52,11 @@
  
  mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
- mt7915e-$(CONFIG_DEV_COREDUMP) += coredump.o
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 0a5f7d85..c3c4b97e 100644
+index 9e69ab82..34ace7c9 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -571,6 +571,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
+@@ -574,6 +574,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
  	/* init wiphy according to mphy and phy */
  	mt7915_init_wiphy(mphy->hw);
  
@@ -70,7 +69,7 @@
  	ret = mt76_register_phy(mphy, true, mt76_rates,
  				ARRAY_SIZE(mt76_rates));
  	if (ret)
-@@ -1076,6 +1082,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
+@@ -1079,6 +1085,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
  	}
  }
  
@@ -96,7 +95,7 @@
  static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  {
  	struct mt7915_phy *phy = mt7915_ext_phy(dev);
-@@ -1084,6 +1109,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
+@@ -1087,6 +1112,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  	if (!phy)
  		return;
  
@@ -107,7 +106,7 @@
  	mt7915_unregister_thermal(phy);
  	mt76_unregister_phy(mphy);
  	ieee80211_free_hw(mphy->hw);
-@@ -1096,6 +1125,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
+@@ -1099,6 +1128,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
  	mt7915_dma_cleanup(dev);
  	tasklet_disable(&dev->irq_tasklet);
  
@@ -118,7 +117,7 @@
  	if (is_mt7986(&dev->mt76))
  		mt7986_wmac_disable(dev);
  }
-@@ -1138,6 +1171,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
+@@ -1141,6 +1174,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
  	dev->mt76.test_ops = &mt7915_testmode_ops;
  #endif
  
@@ -132,12 +131,12 @@
  	if (IS_ENABLED(CONFIG_MT76_LEDS)) {
  		dev->mt76.led_cdev.brightness_set = mt7915_led_set_brightness;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 9cd06a0c..f49f9fa5 100644
+index 5af6de5d..e6cd1e2c 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -32,6 +32,10 @@
- #define HE_PHY(p, c)			u8_get_bits(c, IEEE80211_HE_PHY_##p)
- #define HE_MAC(m, c)			u8_get_bits(c, IEEE80211_HE_MAC_##m)
+@@ -36,6 +36,10 @@ static bool sr_scene_detect = true;
+ module_param(sr_scene_detect, bool, 0644);
+ MODULE_PARM_DESC(sr_scene_detect, "Enable firmware scene detection algorithm");
  
 +#ifdef CONFIG_MTK_VENDOR
 +static int mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb);
@@ -146,7 +145,7 @@
  static u8
  mt7915_mcu_get_sta_nss(u16 mcs_map)
  {
-@@ -351,6 +355,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -355,6 +359,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	case MCU_EXT_EVENT_FW_LOG_2_HOST:
  		mt7915_mcu_rx_log_message(dev, skb);
  		break;
@@ -158,7 +157,7 @@
  	case MCU_EXT_EVENT_BCC_NOTIFY:
  		mt7915_mcu_rx_bcc_notify(dev, skb);
  		break;
-@@ -3481,6 +3490,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3751,6 +3760,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -268,10 +267,10 @@
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 7f1216fe..974cd13c 100644
+index 2d057279..8ec15c22 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -484,4 +484,80 @@ enum {
+@@ -514,4 +514,80 @@ enum {
  					 sizeof(struct bss_info_bcn_cont) + \
  					 sizeof(struct bss_info_inband_discovery))
  
@@ -353,10 +352,10 @@
 +
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 25bec88f..46704b39 100644
+index 2f91020c..8b6c95ef 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -287,6 +287,20 @@ struct mt7915_phy {
+@@ -289,6 +289,20 @@ struct mt7915_phy {
  		u8 spe_idx;
  	} test;
  #endif
@@ -377,7 +376,7 @@
  };
  
  struct mt7915_dev {
-@@ -662,6 +676,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -669,6 +683,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch b/recipes-wifi/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
index f438876..cae715d 100644
--- a/recipes-wifi/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
@@ -1,4 +1,4 @@
-From 626ab5ee837d42274bea8476d9c59b7c9f736084 Mon Sep 17 00:00:00 2001
+From c8b66728e0b61207699caff87ab24b2be004297c Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Tue, 11 Jan 2022 12:03:23 +0800
 Subject: [PATCH 1003/1008] mt76: mt7915: air monitor support
@@ -13,10 +13,10 @@
  6 files changed, 440 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index dc1a2ef7..e4a3d9dd 100644
+index 3ad59e53..7b76e7b2 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1156,6 +1156,8 @@ enum {
+@@ -1182,6 +1182,8 @@ enum {
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
@@ -26,10 +26,10 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 931a3a14..45c71c85 100644
+index 609f10d4..ea834d6c 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -519,6 +519,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -549,6 +549,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
  			seq_ctrl = le16_to_cpu(hdr->seq_ctrl);
  			qos_ctl = *ieee80211_get_qos_ctl(hdr);
  		}
@@ -39,12 +39,12 @@
 +#endif
  	} else {
  		status->flag |= RX_FLAG_8023;
- 	}
+ 		mt7915_wed_check_ppe(dev, &dev->mt76.q_rx[q], msta, skb,
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 16ae61e5..8068cab2 100644
+index b6e5f97c..11efcadc 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -688,6 +688,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -686,6 +686,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (ret)
  		return ret;
  
@@ -55,10 +55,10 @@
  }
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 46704b39..f13263c7 100644
+index 8b6c95ef..bb21433a 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -242,6 +242,35 @@ struct mt7915_hif {
+@@ -244,6 +244,35 @@ struct mt7915_hif {
  	int irq;
  };
  
@@ -94,7 +94,7 @@
  struct mt7915_phy {
  	struct mt76_phy *mt76;
  	struct mt7915_dev *dev;
-@@ -300,6 +329,8 @@ struct mt7915_phy {
+@@ -302,6 +331,8 @@ struct mt7915_phy {
  		u32 interval;
  		u32 last_record;
  	} csi;
@@ -103,7 +103,7 @@
  #endif
  };
  
-@@ -680,6 +711,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -687,6 +718,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
diff --git a/recipes-wifi/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch b/recipes-wifi/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
index c3a3e7a..cc05970 100644
--- a/recipes-wifi/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
@@ -1,4 +1,4 @@
-From e607646c35843a60f23bf5c05e385899feaf24ff Mon Sep 17 00:00:00 2001
+From 1fc0f6e115502d8b3c779349d9420108e0aadae0 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:45:53 +0800
 Subject: [PATCH 1004/1008] mt76: mt7915: add support for muru_onoff via
@@ -12,10 +12,10 @@
  4 files changed, 47 insertions(+), 2 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index c3c4b97e..442e19e8 100644
+index 34ace7c9..d4105835 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -606,6 +606,7 @@ static void mt7915_init_work(struct work_struct *work)
+@@ -609,6 +609,7 @@ static void mt7915_init_work(struct work_struct *work)
  	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
  	mt7915_init_txpower(dev, &dev->mphy.sband_6g.sband);
  	mt7915_txbf_init(dev);
@@ -24,10 +24,10 @@
  
  void mt7915_wfsys_reset(struct mt7915_dev *dev)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index f49f9fa5..59fadcd4 100644
+index e6cd1e2c..2ee4afe9 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -856,13 +856,18 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -860,13 +860,18 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  
  	muru = (struct sta_rec_muru *)tlv;
  
@@ -49,10 +49,10 @@
  		muru->mimo_dl.vht_mu_bfee =
  			!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 974cd13c..c514cd6a 100644
+index 8ec15c22..e655438f 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -560,4 +560,10 @@ struct csi_data {
+@@ -590,4 +590,10 @@ struct csi_data {
  };
  #endif
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1005-mt76-certification-patches.patch b/recipes-wifi/linux-mt76/files/patches/1005-mt76-certification-patches.patch
index 218edee..17d5d5b 100644
--- a/recipes-wifi/linux-mt76/files/patches/1005-mt76-certification-patches.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1005-mt76-certification-patches.patch
@@ -16,10 +16,10 @@
  9 files changed, 956 insertions(+), 5 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index e4a3d9dd..c4262f39 100644
+index 7b76e7b2..172a926a 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1158,6 +1158,7 @@ enum {
+@@ -1184,6 +1184,7 @@ enum {
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
@@ -28,7 +28,7 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 45c71c85..d0aa305a 100644
+index ea834d6c..28c6ab35 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -8,6 +8,7 @@
@@ -39,7 +39,7 @@
  
  #define to_rssi(field, rcpi)	((FIELD_GET(field, rcpi) - 220) / 2)
  
-@@ -1996,6 +1997,21 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
+@@ -2026,6 +2027,21 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
  	phy->trb_ts = trb;
  }
  
@@ -61,7 +61,7 @@
  void mt7915_mac_sta_rc_work(struct work_struct *work)
  {
  	struct mt7915_dev *dev = container_of(work, struct mt7915_dev, rc_work);
-@@ -2018,6 +2034,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
+@@ -2048,6 +2064,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
  		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
  		vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
  
@@ -76,10 +76,10 @@
  			       IEEE80211_RC_NSS_CHANGED |
  			       IEEE80211_RC_BW_CHANGED))
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 8068cab2..97bf5117 100644
+index 11efcadc..75073363 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -664,6 +664,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -662,6 +662,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	bool ext_phy = mvif->phy != &dev->phy;
@@ -89,7 +89,7 @@
  	int ret, idx;
  
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
-@@ -691,7 +694,17 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -689,7 +692,17 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  #ifdef CONFIG_MTK_VENDOR
  	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
  #endif
@@ -109,10 +109,10 @@
  
  void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 59fadcd4..1bd46cc4 100644
+index 2ee4afe9..fe314bf2 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3595,6 +3595,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -3865,6 +3865,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
  
  	return 0;
  }
@@ -586,10 +586,10 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index c514cd6a..c45486fd 100644
+index e655438f..14481725 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -398,10 +398,14 @@ enum {
+@@ -409,10 +409,14 @@ enum {
  	RATE_PARAM_FIXED = 3,
  	RATE_PARAM_MMPS_UPDATE = 5,
  	RATE_PARAM_FIXED_HE_LTF = 7,
@@ -605,7 +605,7 @@
  };
  
  #define RATE_CFG_MCS			GENMASK(3, 0)
-@@ -413,6 +417,9 @@ enum {
+@@ -424,6 +428,9 @@ enum {
  #define RATE_CFG_PHY_TYPE		GENMASK(27, 24)
  #define RATE_CFG_HE_LTF			GENMASK(31, 28)
  
@@ -613,9 +613,9 @@
 +#define RATE_CFG_VAL			GENMASK(7, 0)
 +
  enum {
- 	THERMAL_PROTECT_PARAMETER_CTRL,
- 	THERMAL_PROTECT_BASIC_INFO,
-@@ -565,5 +572,203 @@ struct csi_data {
+ 	TX_POWER_LIMIT_ENABLE,
+ 	TX_POWER_LIMIT_TABLE = 0x4,
+@@ -595,5 +602,203 @@ struct csi_data {
  #define OFDMA_UL                       BIT(1)
  #define MUMIMO_DL                      BIT(2)
  #define MUMIMO_UL                      BIT(3)
@@ -820,10 +820,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index f13263c7..6458e356 100644
+index bb21433a..e6c000a7 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -708,6 +708,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -715,6 +715,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
  #ifdef CONFIG_MTK_VENDOR
diff --git a/recipes-wifi/linux-mt76/files/patches/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch b/recipes-wifi/linux-mt76/files/patches/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
index 68d31f7..c11c130 100644
--- a/recipes-wifi/linux-mt76/files/patches/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
@@ -1,4 +1,4 @@
-From 310c3bf59cf9eea521ee8d75bb4603af0e97a9d9 Mon Sep 17 00:00:00 2001
+From 8db2e922135d4c217bdf6279f19f65e2b849c7e1 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Fri, 27 May 2022 15:51:48 +0800
 Subject: [PATCH 1006/1008] mt76: mt7915:add support for runtime set in-band
@@ -10,10 +10,10 @@
  1 file changed, 2 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 1bd46cc4..9117c9e2 100644
+index fe314bf2..cb6195f6 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -1951,8 +1951,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+@@ -1977,8 +1977,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
  	u8 *buf, interval;
  	int len;
  
@@ -23,7 +23,7 @@
  		interval = vif->bss_conf.fils_discovery.max_interval;
  		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
  	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
-@@ -1987,7 +1986,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+@@ -2013,7 +2012,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
  	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
  	discov->tx_interval = interval;
  	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
diff --git a/recipes-wifi/linux-mt76/files/patches/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch b/recipes-wifi/linux-mt76/files/patches/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
index f6045cf..af41769 100644
--- a/recipes-wifi/linux-mt76/files/patches/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
@@ -1,4 +1,4 @@
-From 3258b1f670c506b036cab0d06d87708933f7cd83 Mon Sep 17 00:00:00 2001
+From a998c8e0ec699a4465a5ba77f00fa799b2f8d99e Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:53:43 +0800
 Subject: [PATCH 1007/1008] mt76: mt7915: add mt76 vendor muru onoff command
@@ -11,10 +11,10 @@
  4 files changed, 63 insertions(+)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 9117c9e2..2a18dd53 100644
+index cb6195f6..696ca11b 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3614,6 +3614,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -3884,6 +3884,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  		if (val == 0)
  			dev->dbg.muru_onoff = MUMIMO_DL_CERT | MUMIMO_DL;
  		break;
@@ -29,10 +29,10 @@
  }
  
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index c45486fd..8eaf984a 100644
+index 14481725..6a145aef 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -405,6 +405,7 @@ enum {
+@@ -416,6 +416,7 @@ enum {
  #ifdef CONFIG_MTK_VENDOR
  	RATE_PARAM_FIXED_MIMO = 30,
  	RATE_PARAM_FIXED_OFDMA = 31,
diff --git a/recipes-wifi/linux-mt76/files/patches/1008-mt76-mt7915-add-fw_version-dump.patch b/recipes-wifi/linux-mt76/files/patches/1008-mt76-mt7915-add-fw_version-dump.patch
index 145822e..25f8139 100644
--- a/recipes-wifi/linux-mt76/files/patches/1008-mt76-mt7915-add-fw_version-dump.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1008-mt76-mt7915-add-fw_version-dump.patch
@@ -1,4 +1,4 @@
-From 05dd4dcaf63a2026f920cd4936c0a12c8b6303ae Mon Sep 17 00:00:00 2001
+From 0c600cffb7f89ad45e0f631623632f36cbe8bf81 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 17 Aug 2022 13:40:24 +0800
 Subject: [PATCH 1008/1008] mt76: mt7915: add fw_version dump
@@ -10,10 +10,10 @@
  3 files changed, 32 insertions(+)
 
 diff --git a/mt76.h b/mt76.h
-index 1b468ccc..3a177fff 100644
+index 66059d2e..0d87f135 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -823,6 +823,10 @@ struct mt76_dev {
+@@ -840,6 +840,10 @@ struct mt76_dev {
  		struct mt76_usb usb;
  		struct mt76_sdio sdio;
  	};
@@ -25,10 +25,10 @@
  
  struct mt76_power_limits {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index dfec416e..7ab491d6 100644
+index c65267b4..a48903ca 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -2904,6 +2904,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
+@@ -2927,6 +2927,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
  		 sizeof(dev->hw->wiphy->fw_version),
  		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
  
@@ -38,7 +38,7 @@
  	release_firmware(fw);
  
  	if (!fw_wa)
-@@ -2929,6 +2932,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
+@@ -2952,6 +2955,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
  		goto out;
  	}
  
@@ -48,7 +48,7 @@
  	snprintf(dev->hw->wiphy->fw_version,
  		 sizeof(dev->hw->wiphy->fw_version),
  		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
-@@ -2999,6 +3005,9 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
+@@ -3022,6 +3028,9 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
  	dev_info(dev->dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
  		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1111-mt76-testmode-additional-supports.patch b/recipes-wifi/linux-mt76/files/patches/1111-mt76-testmode-additional-supports.patch
index 3ca4b85..78ab5ee 100644
--- a/recipes-wifi/linux-mt76/files/patches/1111-mt76-testmode-additional-supports.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1111-mt76-testmode-additional-supports.patch
@@ -1,7 +1,7 @@
-From 8758539453946b5e3941f2e46d7ae4f933823dd2 Mon Sep 17 00:00:00 2001
+From b30eb7fc2770ee278bfcf775dc8eca0710cf9d65 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Apr 2022 15:43:19 +0800
-Subject: [PATCH 1111/1128] mt76: testmode: additional supports
+Subject: [PATCH 1111/1127] mt76: testmode: additional supports
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
@@ -18,19 +18,19 @@
  mt7915/mmio.c     |    2 +
  mt7915/mt7915.h   |   14 +-
  mt7915/regs.h     |    3 +
- mt7915/testmode.c | 1171 ++++++++++++++++++++++++++++++++++++++++++---
+ mt7915/testmode.c | 1170 ++++++++++++++++++++++++++++++++++++++++++---
  mt7915/testmode.h |  278 +++++++++++
  testmode.c        |  275 +++++++++--
  testmode.h        |   75 +++
  tools/fields.c    |   80 ++++
  tx.c              |    3 +-
- 19 files changed, 1962 insertions(+), 147 deletions(-)
+ 19 files changed, 1962 insertions(+), 146 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 4b181305..82b4da26 100644
+index ae22b959..d2891c64 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -426,8 +426,7 @@ free:
+@@ -535,8 +535,7 @@ free:
  	if (mt76_is_testmode_skb(dev, skb, &hw)) {
  		struct mt76_phy *phy = hw->priv;
  
@@ -41,7 +41,7 @@
  #endif
  
 diff --git a/mac80211.c b/mac80211.c
-index e5d8f45b..4b63ec69 100644
+index 9a908c9a..f8ca7ba1 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -55,6 +55,13 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
@@ -71,10 +71,10 @@
  
  static const struct ieee80211_channel mt76_channels_6ghz[] = {
 diff --git a/mt76.h b/mt76.h
-index 3a177fff..e79d74a4 100644
+index 0d87f135..32e2dea0 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -624,6 +624,21 @@ struct mt76_testmode_ops {
+@@ -635,6 +635,21 @@ struct mt76_testmode_ops {
  	int (*set_params)(struct mt76_phy *phy, struct nlattr **tb,
  			  enum mt76_testmode_state new_state);
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
@@ -96,7 +96,7 @@
  };
  
  #define MT_TM_FW_RX_COUNT	BIT(0)
-@@ -632,16 +647,11 @@ struct mt76_testmode_data {
+@@ -643,16 +658,11 @@ struct mt76_testmode_data {
  	enum mt76_testmode_state state;
  
  	u32 param_set[DIV_ROUND_UP(NUM_MT76_TM_ATTRS, 32)];
@@ -113,7 +113,7 @@
  	u8 tx_rate_stbc;
  	u8 tx_ltf;
  
-@@ -657,10 +667,37 @@ struct mt76_testmode_data {
+@@ -668,10 +678,37 @@ struct mt76_testmode_data {
  	u8 tx_power[4];
  	u8 tx_power_control;
  
@@ -152,7 +152,7 @@
  	u32 tx_pending;
  	u32 tx_queued;
  	u16 tx_queued_limit;
-@@ -1115,6 +1152,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
+@@ -1132,6 +1169,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
  #endif
  }
  
@@ -212,7 +212,7 @@
  static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
  					struct sk_buff *skb,
  					struct ieee80211_hw **hw)
-@@ -1125,7 +1215,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
+@@ -1142,7 +1232,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
  	for (i = 0; i < ARRAY_SIZE(dev->phys); i++) {
  		struct mt76_phy *phy = dev->phys[i];
  
@@ -222,7 +222,7 @@
  			*hw = dev->phys[i]->hw;
  			return true;
  		}
-@@ -1227,7 +1318,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1244,7 +1335,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
  		       struct netlink_callback *cb, void *data, int len);
  int mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state);
@@ -233,10 +233,10 @@
  static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
  {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 7ab491d6..afdd42ff 100644
+index a48903ca..4f17954e 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -393,6 +393,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
+@@ -394,6 +394,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
  	switch (vif->type) {
  	case NL80211_IFTYPE_MESH_POINT:
  	case NL80211_IFTYPE_AP:
@@ -244,7 +244,7 @@
  		if (vif->p2p)
  			conn_type = CONNECTION_P2P_GC;
  		else
-@@ -574,6 +575,9 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
+@@ -575,6 +576,9 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
  	rx->rca2 = 1;
  	rx->rv = 1;
  
@@ -255,10 +255,10 @@
  		return;
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index c4262f39..858a2676 100644
+index 172a926a..e10e92b6 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -980,6 +980,7 @@ enum {
+@@ -983,6 +983,7 @@ enum {
  	MCU_EXT_EVENT_FW_LOG_2_HOST = 0x13,
  	MCU_EXT_EVENT_THERMAL_PROTECT = 0x22,
  	MCU_EXT_EVENT_ASSERT_DUMP = 0x23,
@@ -266,7 +266,7 @@
  	MCU_EXT_EVENT_RDD_REPORT = 0x3a,
  	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
  	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
-@@ -1158,6 +1159,7 @@ enum {
+@@ -1184,6 +1185,7 @@ enum {
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
@@ -275,10 +275,10 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  };
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 442e19e8..69465dd0 100644
+index d4105835..2f3453b0 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -600,7 +600,7 @@ static void mt7915_init_work(struct work_struct *work)
+@@ -603,7 +603,7 @@ static void mt7915_init_work(struct work_struct *work)
  	struct mt7915_dev *dev = container_of(work, struct mt7915_dev,
  				 init_work);
  
@@ -288,10 +288,10 @@
  	mt7915_init_txpower(dev, &dev->mphy.sband_2g.sband);
  	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index d0aa305a..9af86163 100644
+index 28c6ab35..3b144ad0 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -597,16 +597,38 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+@@ -629,16 +629,38 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
  {
  #ifdef CONFIG_NL80211_TESTMODE
  	struct mt76_testmode_data *td = &phy->mt76->test;
@@ -333,7 +333,7 @@
  
  	switch (td->tx_rate_mode) {
  	case MT76_TM_TX_MODE_HT:
-@@ -696,13 +718,14 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+@@ -728,13 +750,14 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
  	if (mode >= MT_PHY_TYPE_HE_SU)
  		val |= FIELD_PREP(MT_TXD6_HELTF, td->tx_ltf);
  
@@ -351,7 +351,7 @@
  #endif
  }
  
-@@ -1452,7 +1475,7 @@ mt7915_mac_restart(struct mt7915_dev *dev)
+@@ -1483,7 +1506,7 @@ mt7915_mac_restart(struct mt7915_dev *dev)
  		goto out;
  
  	/* set the necessary init items */
@@ -361,7 +361,7 @@
  		goto out;
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 97bf5117..b4564e33 100644
+index 75073363..e84d6132 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -223,7 +223,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
@@ -374,10 +374,10 @@
  		mvif->mt76.wmm_idx += 2;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 2a18dd53..adc14d53 100644
+index 696ca11b..5687e136 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -363,6 +363,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -367,6 +367,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	case MCU_EXT_EVENT_BCC_NOTIFY:
  		mt7915_mcu_rx_bcc_notify(dev, skb);
  		break;
@@ -389,7 +389,7 @@
  	default:
  		break;
  	}
-@@ -394,6 +399,7 @@ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -398,6 +403,7 @@ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
  	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
  	    rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
@@ -397,7 +397,7 @@
  	    !rxd->seq)
  		mt7915_mcu_rx_unsolicited_event(dev, skb);
  	else
-@@ -2755,14 +2761,14 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
+@@ -2781,14 +2787,14 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
  	return 0;
  }
  
@@ -415,7 +415,7 @@
  
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 8eaf984a..1388eda0 100644
+index 6a145aef..4bc58c98 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -8,10 +8,15 @@
@@ -434,7 +434,7 @@
  };
  
  struct mt7915_mcu_thermal_ctrl {
-@@ -434,6 +439,12 @@ enum {
+@@ -464,6 +469,12 @@ enum {
  
  enum {
  	MT_BF_SOUNDING_ON = 1,
@@ -447,7 +447,7 @@
  	MT_BF_TYPE_UPDATE = 20,
  	MT_BF_MODULE_UPDATE = 25
  };
-@@ -668,10 +679,19 @@ struct mt7915_muru {
+@@ -698,10 +709,19 @@ struct mt7915_muru {
  #define MURU_OFDMA_SCH_TYPE_UL          BIT(1)
  
  /* Common Config */
@@ -472,10 +472,10 @@
  
  enum {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 813d6f40..63b66e40 100644
+index 19518cb5..fef4b126 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -127,6 +127,7 @@ static const u32 mt7915_offs[] = {
+@@ -132,6 +132,7 @@ static const u32 mt7915_offs[] = {
  	[ARB_DRNGR0]		= 0x194,
  	[ARB_SCR]		= 0x080,
  	[RMAC_MIB_AIRTIME14]	= 0x3b8,
@@ -483,7 +483,7 @@
  	[AGG_AWSCR0]		= 0x05c,
  	[AGG_PCR0]		= 0x06c,
  	[AGG_ACR0]		= 0x084,
-@@ -202,6 +203,7 @@ static const u32 mt7916_offs[] = {
+@@ -207,6 +208,7 @@ static const u32 mt7916_offs[] = {
  	[ARB_DRNGR0]		= 0x1e0,
  	[ARB_SCR]		= 0x000,
  	[RMAC_MIB_AIRTIME14]	= 0x0398,
@@ -492,10 +492,10 @@
  	[AGG_PCR0]		= 0x040,
  	[AGG_ACR0]		= 0x054,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 6458e356..0217c6c3 100644
+index e6c000a7..cf7fcdfc 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -314,6 +314,9 @@ struct mt7915_phy {
+@@ -316,6 +316,9 @@ struct mt7915_phy {
  		u8 last_snr;
  
  		u8 spe_idx;
@@ -505,7 +505,7 @@
  	} test;
  #endif
  
-@@ -413,6 +416,14 @@ struct mt7915_dev {
+@@ -415,6 +418,14 @@ struct mt7915_dev {
  	void __iomem *dcm;
  	void __iomem *sku;
  
@@ -520,7 +520,7 @@
  #ifdef MTK_DEBUG
  	u16 wlan_idx;
  	struct {
-@@ -584,7 +595,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -586,7 +597,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  				   struct ieee80211_vif *vif,
  				   struct ieee80211_sta *sta,
  				   void *data, u32 field);
@@ -529,7 +529,7 @@
  int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset);
  int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num);
  int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
-@@ -617,6 +628,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+@@ -623,6 +634,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
@@ -538,10 +538,10 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 947f02f2..3bf9e150 100644
+index 688f7dee..ae4695ae 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -61,6 +61,7 @@ enum offs_rev {
+@@ -62,6 +62,7 @@ enum offs_rev {
  	ARB_DRNGR0,
  	ARB_SCR,
  	RMAC_MIB_AIRTIME14,
@@ -549,7 +549,7 @@
  	AGG_AWSCR0,
  	AGG_PCR0,
  	AGG_ACR0,
-@@ -481,6 +482,8 @@ enum offs_rev {
+@@ -482,6 +483,8 @@ enum offs_rev {
  #define MT_WF_AGG_BASE(_band)		((_band) ? 0x820f2000 : 0x820e2000)
  #define MT_WF_AGG(_band, ofs)		(MT_WF_AGG_BASE(_band) + (ofs))
  
@@ -559,7 +559,7 @@
  							  (_n) * 4))
  #define MT_AGG_PCR0(_band, _n)		MT_WF_AGG(_band, (__OFFS(AGG_PCR0) +	\
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 8d99edcb..8f250db1 100644
+index 931d1db2..d9d43cb7 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -9,6 +9,9 @@
@@ -635,7 +635,7 @@
  		.testmode_en = 1,
  		.param_idx = MCU_ATE_CLEAN_TXQUEUE,
 -		.param.clean.wcid = wcid,
- 		.param.clean.band = phy != &dev->phy,
+ 		.param.clean.band = phy->band_idx,
  	};
  
 -	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
@@ -1762,11 +1762,10 @@
  }
  
  static int
-@@ -613,35 +1598,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
- 	tx_cont->center_ch = freq1;
+@@ -614,34 +1599,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
  	tx_cont->tx_ant = td->tx_antenna_mask;
- 	tx_cont->band = phy != &dev->phy;
--
+ 	tx_cont->band = phy->band_idx;
+ 
 -	switch (chandef->width) {
 -	case NL80211_CHAN_WIDTH_40:
 -		tx_cont->bw = CMD_CBW_40MHZ;
@@ -1798,8 +1797,8 @@
 +	tx_cont->bw = mt7915_tm_chan_bw(chandef->width);
  
  	if (!en) {
- 		req.op.rf.param.func_data = cpu_to_le32(phy != &dev->phy);
-@@ -725,6 +1682,12 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
+ 		req.op.rf.param.func_data = cpu_to_le32(phy->band_idx);
+@@ -725,6 +1683,12 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
  		mt7915_tm_set_freq_offset(phy, en, en ? td->freq_offset : 0);
  	if (changed & BIT(TM_CHANGED_TXPOWER))
  		mt7915_tm_set_tx_power(phy);
@@ -1812,7 +1811,7 @@
  }
  
  static int
-@@ -804,6 +1767,7 @@ static int
+@@ -804,6 +1768,7 @@ static int
  mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  {
  	struct mt7915_phy *phy = mphy->priv;
@@ -1820,7 +1819,7 @@
  	void *rx, *rssi;
  	int i;
  
-@@ -849,11 +1813,68 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+@@ -849,11 +1814,68 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  
  	nla_nest_end(msg, rx);
  
@@ -2903,7 +2902,7 @@
  };
  
 diff --git a/tx.c b/tx.c
-index 65e2b7c1..8b33186b 100644
+index c8d78b0a..c7cd842c 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -245,8 +245,7 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
diff --git a/recipes-wifi/linux-mt76/files/patches/1112-mt76-testmode-add-pre-cal-support.patch b/recipes-wifi/linux-mt76/files/patches/1112-mt76-testmode-add-pre-cal-support.patch
index bde5241..7a81afe 100644
--- a/recipes-wifi/linux-mt76/files/patches/1112-mt76-testmode-add-pre-cal-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1112-mt76-testmode-add-pre-cal-support.patch
@@ -1,7 +1,7 @@
-From cefbd5d7c2c8c2986ed7344e71e6d949d4744da9 Mon Sep 17 00:00:00 2001
+From de6933ebbc092c3fb1902afb5de74db4fb6cdfa4 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 31 Aug 2022 20:06:52 +0800
-Subject: [PATCH 1112/1128] mt76: testmode: add pre-cal support
+Subject: [PATCH 1112/1127] mt76: testmode: add pre-cal support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Change-Id: Ibfbbc3443de994eeb4daa5e364b0a90f5d7d3bcd
@@ -20,7 +20,7 @@
  11 files changed, 562 insertions(+), 13 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 25f67760..4c50bfe6 100644
+index 1e41b94d..e083964b 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -89,8 +89,10 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len)
@@ -37,10 +37,10 @@
  
  out_put_node:
 diff --git a/mt76.h b/mt76.h
-index e79d74a4..c08b8a47 100644
+index 32e2dea0..2beb1056 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -625,6 +625,7 @@ struct mt76_testmode_ops {
+@@ -636,6 +636,7 @@ struct mt76_testmode_ops {
  			  enum mt76_testmode_state new_state);
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
  	int (*set_eeprom)(struct mt76_phy *phy, u32 offset, u8 *val, u8 action);
@@ -49,10 +49,10 @@
  
  struct mt76_testmode_entry_data {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 858a2676..c510b5d4 100644
+index e10e92b6..4e489244 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -976,6 +976,7 @@ enum {
+@@ -979,6 +979,7 @@ enum {
  
  /* ext event table */
  enum {
@@ -114,10 +114,10 @@
  
  #endif
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index adc14d53..f4285994 100644
+index 5687e136..d1ff73a9 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -367,6 +367,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -371,6 +371,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	case MCU_EXT_EVENT_BF_STATUS_READ:
  		mt7915_tm_txbf_status_read(dev, skb);
  		break;
@@ -127,7 +127,7 @@
  #endif
  	default:
  		break;
-@@ -2856,7 +2859,7 @@ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
+@@ -2882,7 +2885,7 @@ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
  	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
  	u32 total = MT_EE_CAL_GROUP_SIZE;
  
@@ -136,7 +136,7 @@
  		return 0;
  
  	/*
-@@ -2936,11 +2939,29 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+@@ -2962,11 +2965,29 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
  {
  	struct mt7915_dev *dev = phy->dev;
  	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
@@ -169,10 +169,10 @@
  
  	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 0217c6c3..e801fa30 100644
+index cf7fcdfc..cafd4389 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -400,6 +400,10 @@ struct mt7915_dev {
+@@ -402,6 +402,10 @@ struct mt7915_dev {
  	struct rchan *relay_fwlog;
  
  	void *cal;
@@ -183,7 +183,7 @@
  
  	struct {
  		u8 debug_wm;
-@@ -629,6 +633,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
+@@ -635,6 +639,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
  int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
@@ -192,7 +192,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 8f250db1..b1ce2991 100644
+index d9d43cb7..c6a5837e 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -5,6 +5,7 @@
@@ -223,7 +223,7 @@
  		.icap_len = 120,
  		.op.rf.func_idx = cpu_to_le32(func_idx),
  	};
-@@ -1672,6 +1671,316 @@ out:
+@@ -1673,6 +1672,316 @@ out:
  				 sizeof(req), true);
  }
  
@@ -540,7 +540,7 @@
  static void
  mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
  {
-@@ -1711,6 +2020,10 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
+@@ -1712,6 +2021,10 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
  	else if (prev_state == MT76_TM_STATE_OFF ||
  		 state == MT76_TM_STATE_OFF)
  		mt7915_tm_init(phy, !(state == MT76_TM_STATE_OFF));
@@ -551,7 +551,7 @@
  
  	if ((state == MT76_TM_STATE_IDLE &&
  	     prev_state == MT76_TM_STATE_OFF) ||
-@@ -1872,9 +2185,113 @@ mt7915_tm_set_eeprom(struct mt76_phy *mphy, u32 offset, u8 *val, u8 action)
+@@ -1873,9 +2186,113 @@ mt7915_tm_set_eeprom(struct mt76_phy *mphy, u32 offset, u8 *val, u8 action)
  	return ret;
  }
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1113-mt76-testmode-add-iBF-command-mode-support.patch b/recipes-wifi/linux-mt76/files/patches/1113-mt76-testmode-add-iBF-command-mode-support.patch
index 7adbf9a..c019c31 100644
--- a/recipes-wifi/linux-mt76/files/patches/1113-mt76-testmode-add-iBF-command-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1113-mt76-testmode-add-iBF-command-mode-support.patch
@@ -1,7 +1,7 @@
-From 9e9c62bb30cbfb1c5d65cbe7a7a29b4ddbefcfca Mon Sep 17 00:00:00 2001
+From 7a1f91e3def399d726726a0623e9f9caa6a9cd8c Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 12 Sep 2022 18:16:54 +0800
-Subject: [PATCH 1113/1128] mt76: testmode: add iBF command mode support
+Subject: [PATCH 1113/1127] mt76: testmode: add iBF command mode support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Change-Id: I7eea1d6412563f889e5774e787e58ce9eba001bd
@@ -13,7 +13,7 @@
  4 files changed, 85 insertions(+), 7 deletions(-)
 
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index b1ce2991..f735ed69 100644
+index c6a5837e..9de11e98 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -701,6 +701,7 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
diff --git a/recipes-wifi/linux-mt76/files/patches/1114-mt76-testmode-add-ZWDFS-test-mode-support.patch b/recipes-wifi/linux-mt76/files/patches/1114-mt76-testmode-add-ZWDFS-test-mode-support.patch
index a06ebcd..08a404e 100644
--- a/recipes-wifi/linux-mt76/files/patches/1114-mt76-testmode-add-ZWDFS-test-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1114-mt76-testmode-add-ZWDFS-test-mode-support.patch
@@ -1,7 +1,7 @@
-From d4325a391a9e7ce10af23810f138c982e4e387ec Mon Sep 17 00:00:00 2001
+From f2a6f16bb0a584a0fb7e7dab8cb47e2870b040e9 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 27 Oct 2022 17:42:07 +0800
-Subject: [PATCH 1114/1128] mt76: testmode: add ZWDFS test mode support
+Subject: [PATCH 1114/1127] mt76: testmode: add ZWDFS test mode support
 
 Change-Id: I14d104b7158a35acf6b0595357d07fb87f5a9d94
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -19,10 +19,10 @@
  10 files changed, 452 insertions(+), 1 deletion(-)
 
 diff --git a/mt76.h b/mt76.h
-index c08b8a47..0a9552b5 100644
+index 2beb1056..8139b4ad 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -708,6 +708,15 @@ struct mt76_testmode_data {
+@@ -719,6 +719,15 @@ struct mt76_testmode_data {
  		u64 fcs_error[__MT_RXQ_MAX];
  		u64 len_mismatch;
  	} rx_stats;
@@ -39,10 +39,10 @@
  
  struct mt76_vif {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index c510b5d4..a31b85f0 100644
+index 4e489244..c353341e 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1153,6 +1153,7 @@ enum {
+@@ -1179,6 +1179,7 @@ enum {
  	MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
  	MCU_EXT_CMD_SET_RDD_TH = 0x9d,
  	MCU_EXT_CMD_MURU_CTRL = 0x9f,
@@ -50,7 +50,7 @@
  	MCU_EXT_CMD_RX_STAT = 0xa4,
  	MCU_EXT_CMD_SET_SPR = 0xa8,
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
-@@ -1163,6 +1164,7 @@ enum {
+@@ -1189,6 +1190,7 @@ enum {
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
  	MCU_EXT_CMD_CERT_CFG = 0xb7,
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
@@ -59,18 +59,18 @@
  
  enum {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index f4285994..0e66291d 100644
+index d1ff73a9..51ec151b 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2594,6 +2594,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
+@@ -2620,6 +2620,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
  		req.monitor_chan = chandef->chan->hw_value;
  		req.monitor_central_chan =
  			ieee80211_frequency_to_channel(chandef->center_freq1);
 +		req.monitor_bw = mt76_connac_chan_bw(chandef);
- 		req.band_idx = phy != &dev->phy;
+ 		req.band_idx = phy->band_idx;
  		req.scan_mode = 2;
  		break;
-@@ -4180,3 +4181,68 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
+@@ -4450,3 +4451,68 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MEC_CTRL), &req, sizeof(req), true);
  }
  #endif
@@ -140,10 +140,10 @@
 +	return 0;
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 1388eda0..0a79fe04 100644
+index 4bc58c98..300b7834 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -579,6 +579,52 @@ struct csi_data {
+@@ -609,6 +609,52 @@ struct csi_data {
  };
  #endif
  
@@ -197,10 +197,10 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e801fa30..dcf64bff 100644
+index cafd4389..0cbd02e2 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -302,6 +302,7 @@ struct mt7915_phy {
+@@ -304,6 +304,7 @@ struct mt7915_phy {
  
  	struct mib_stats mib;
  	struct mt76_channel_state state_ts;
@@ -208,7 +208,7 @@
  
  #ifdef CONFIG_NL80211_TESTMODE
  	struct {
-@@ -746,6 +747,9 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+@@ -753,6 +754,9 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
  
@@ -219,10 +219,10 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 3bf9e150..9b6266c1 100644
+index ae4695ae..6aa98812 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -1180,6 +1180,8 @@ enum offs_rev {
+@@ -1187,6 +1187,8 @@ enum offs_rev {
  #define MT_WF_IRPI_NSS(phy, nss)	MT_WF_IRPI(0x6000 + ((phy) << 20) + ((nss) << 16))
  #define MT_WF_IRPI_NSS_MT7916(phy, nss)	MT_WF_IRPI(0x1000 + ((phy) << 20) + ((nss) << 16))
  
@@ -232,7 +232,7 @@
  #define MT_WF_PHY_BASE			0x83080000
  #define MT_WF_PHY(ofs)			(MT_WF_PHY_BASE + (ofs))
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index f735ed69..b3462bcc 100644
+index 9de11e98..6ce2c0e6 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -13,6 +13,12 @@ enum {
@@ -487,7 +487,7 @@
  	}
  }
  
-@@ -2004,6 +2228,14 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
+@@ -2005,6 +2229,14 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
  		mt7915_tm_set_cfg(phy);
  	if (changed & BIT(TM_CHANGED_TXBF_ACT))
  		mt7915_tm_set_txbf(phy);
diff --git a/recipes-wifi/linux-mt76/files/patches/1115-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch b/recipes-wifi/linux-mt76/files/patches/1115-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
index 5143732..96aaf15 100644
--- a/recipes-wifi/linux-mt76/files/patches/1115-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1115-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
@@ -1,17 +1,17 @@
-From 2d9d53d38c1228b6daed13ab3bccd2fcbe6b6d63 Mon Sep 17 00:00:00 2001
+From 7b4d2270752e46865585471b89c1ddad40ac46ea Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Sun, 24 Apr 2022 10:07:00 +0800
-Subject: [PATCH 1115/1128] mt76: mt7915: init rssi in WTBL when add station
+Subject: [PATCH 1115/1127] mt76: mt7915: init rssi in WTBL when add station
 
 ---
  mt7915/main.c | 4 ++++
  1 file changed, 4 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index b4564e33..1864f241 100644
+index e84d6132..9180689e 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -668,6 +668,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -666,6 +666,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_phy *phy;
  #endif
  	int ret, idx;
@@ -19,7 +19,7 @@
  
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
  	if (idx < 0)
-@@ -691,6 +692,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -689,6 +690,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (ret)
  		return ret;
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1116-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch b/recipes-wifi/linux-mt76/files/patches/1116-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
index 4d39539..18b5c06 100644
--- a/recipes-wifi/linux-mt76/files/patches/1116-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1116-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
@@ -1,7 +1,7 @@
-From ebdd3b7cd18ab5f28072f7ff625654097737dc8c Mon Sep 17 00:00:00 2001
+From a13dbc3ffa989467b9c9618153aef11b3a7203ba Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 4 Aug 2022 14:08:11 +0800
-Subject: [PATCH 1116/1128] mt76: mt7915: reduce TWT SP sent to FW for cert
+Subject: [PATCH 1116/1127] mt76: mt7915: reduce TWT SP sent to FW for cert
 
 Set TWT SP duration to 88 percent to prevent HW sends PPDU over TWT SP.
 
@@ -11,10 +11,10 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 0e66291d..042b6c18 100644
+index 51ec151b..8ebe38f0 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3503,7 +3503,7 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3773,7 +3773,7 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  		.own_mac_idx = mvif->mt76.omac_idx,
  		.flowid = flow->id,
  		.peer_id = cpu_to_le16(flow->wcid),
diff --git a/recipes-wifi/linux-mt76/files/patches/1117-mt76-airtime-fairness-feature-off-in-mac80211.patch b/recipes-wifi/linux-mt76/files/patches/1117-mt76-airtime-fairness-feature-off-in-mac80211.patch
index 02a1d63..9bf3d19 100644
--- a/recipes-wifi/linux-mt76/files/patches/1117-mt76-airtime-fairness-feature-off-in-mac80211.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1117-mt76-airtime-fairness-feature-off-in-mac80211.patch
@@ -1,14 +1,14 @@
-From 5d3268e0d55b6bfaa88397d19ded51c13ebd8fac Mon Sep 17 00:00:00 2001
+From dbe1f9d95163ed0651bb404946f2fabf8de62923 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 6 May 2022 15:58:42 +0800
-Subject: [PATCH 1117/1128] mt76: airtime fairness feature off in mac80211
+Subject: [PATCH 1117/1127] mt76: airtime fairness feature off in mac80211
 
 ---
  mac80211.c | 1 -
  1 file changed, 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 4b63ec69..b378231c 100644
+index f8ca7ba1..7e0f0e0e 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -429,7 +429,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
diff --git a/recipes-wifi/linux-mt76/files/patches/1118-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch b/recipes-wifi/linux-mt76/files/patches/1118-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
index 58fb0fd..4538369 100644
--- a/recipes-wifi/linux-mt76/files/patches/1118-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1118-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
@@ -1,7 +1,7 @@
-From 91e341ee0145c32a0ee05feb45bb45162622e17f Mon Sep 17 00:00:00 2001
+From 369a0d926e282d38bb98a62ac97d474a856b7a36 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 20 May 2022 19:19:25 +0800
-Subject: [PATCH 1118/1128] mt76: mt7915: add mt7986 and mt7916 pre-calibration
+Subject: [PATCH 1118/1127] mt76: mt7915: add mt7986 and mt7916 pre-calibration
 
 Add pre-calibration for mt7986 and mt7916. It has different data size
 with mt7915. Group cal needs 54k and 94k for 2G + 5G and 2G + 6G,
@@ -62,10 +62,10 @@
  	MT_EE_RATE_DELTA_5G =	0x29d,
  	MT_EE_TX0_POWER_2G =	0x2fc,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 042b6c18..e03ec9e3 100644
+index 8ebe38f0..97b1cf3b 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2858,7 +2858,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
+@@ -2884,7 +2884,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
  int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
  {
  	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
@@ -75,7 +75,7 @@
  
  	if (!(eep[offs] & MT_EE_WIFI_CAL_GROUP))
  		return 0;
-@@ -2896,9 +2897,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
+@@ -2922,9 +2923,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
  	return -1;
  }
  
@@ -87,7 +87,7 @@
  		5180, 5200, 5220, 5240,
  		5260, 5280, 5300, 5320,
  		5500, 5520, 5540, 5560,
-@@ -2906,34 +2907,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
+@@ -2932,34 +2933,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
  		5660, 5680, 5700, 5745,
  		5765, 5785, 5805, 5825
  	};
@@ -167,7 +167,7 @@
  }
  
  int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
-@@ -2965,24 +3001,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+@@ -2991,24 +3027,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
  	if (!(eep[offs] & dpd_mask))
  		return 0;
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1119-mt76-mt7915-add-phy-capability-vendor-command.patch b/recipes-wifi/linux-mt76/files/patches/1119-mt76-mt7915-add-phy-capability-vendor-command.patch
index f2e7a99..ab053c9 100644
--- a/recipes-wifi/linux-mt76/files/patches/1119-mt76-mt7915-add-phy-capability-vendor-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1119-mt76-mt7915-add-phy-capability-vendor-command.patch
@@ -1,7 +1,7 @@
-From 75cc0d6bfdbb54291917044fb0c778d2729758f6 Mon Sep 17 00:00:00 2001
+From 0aa90f5e1c0adb58c603fde51a2da51943a5fd25 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
 Date: Tue, 12 Jul 2022 10:04:35 -0700
-Subject: [PATCH 1119/1128] mt76: mt7915: add phy capability vendor command
+Subject: [PATCH 1119/1127] mt76: mt7915: add phy capability vendor command
 
 ---
  mt7915/mt7915.h |  1 +
@@ -10,7 +10,7 @@
  3 files changed, 78 insertions(+)
 
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index dcf64bff..5023cfcb 100644
+index 0cbd02e2..69f1b6b4 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -11,6 +11,7 @@
diff --git a/recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch b/recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
index d1c487a..abbc2c5 100644
--- a/recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
@@ -1,7 +1,7 @@
-From a7682d61851c686f78273df7a9926203c8e17ee9 Mon Sep 17 00:00:00 2001
+From 022be7646ae36e7cb6c12ac55e0eae88e738de06 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 24 Jun 2022 11:15:45 +0800
-Subject: [PATCH] mt76: mt7915: add vendor subcmd EDCCA ctrl
+Subject: [PATCH 1120/1127] mt76: mt7915: add vendor subcmd EDCCA ctrl
  enable/threshold/compensation
 
 Change-Id: I06a3f94d5e444be894200e2b6588d76ed38d09d0
@@ -16,10 +16,10 @@
  7 files changed, 266 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index a31b85f0..bceb6799 100644
+index c353341e..9339b711 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1163,6 +1163,7 @@ enum {
+@@ -1189,6 +1189,7 @@ enum {
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
  	MCU_EXT_CMD_CERT_CFG = 0xb7,
@@ -28,10 +28,10 @@
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
  };
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 1864f241..2b4e122b 100644
+index 9180689e..83b97d23 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -455,6 +455,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
+@@ -454,6 +454,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
  			mutex_unlock(&dev->mt76.mutex);
  		}
  #endif
@@ -42,10 +42,10 @@
  		ret = mt7915_set_channel(phy);
  		if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index e03ec9e3..67304c84 100644
+index 97b1cf3b..cd6f3292 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4282,3 +4282,75 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
+@@ -4552,3 +4552,75 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
  
  	return 0;
  }
@@ -122,10 +122,10 @@
 +	return 0;
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 0a79fe04..b608cb6a 100644
+index 300b7834..de265d15 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -836,6 +836,27 @@ enum {
+@@ -866,6 +866,27 @@ enum {
     MURU_DL_INIT,
     MURU_UL_INIT,
  };
@@ -154,10 +154,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 5023cfcb..2b56692d 100644
+index 69f1b6b4..aaab5f7a 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -747,7 +747,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
+@@ -754,7 +754,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
  int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
diff --git a/recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-implement-bin-file-mode.patch b/recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-implement-bin-file-mode.patch
index 5dc8a54..1260c1e 100644
--- a/recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-implement-bin-file-mode.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-implement-bin-file-mode.patch
@@ -1,7 +1,7 @@
-From ee7302c84173d00af165f8aa2330e8f11607e5d7 Mon Sep 17 00:00:00 2001
+From 8f789d7adea84ad0ed06b1b593841037fd059fb1 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 7 Jul 2022 11:09:59 +0800
-Subject: [PATCH] mt76: mt7915: implement bin file mode
+Subject: [PATCH 1121/1127] mt76: mt7915: implement bin file mode
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -14,7 +14,7 @@
  6 files changed, 141 insertions(+), 32 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index e083964..5b9faf7 100644
+index e083964b..5b9faf7e 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -104,6 +104,24 @@ out_put_node:
@@ -43,10 +43,10 @@
  mt76_eeprom_override(struct mt76_phy *phy)
  {
 diff --git a/mt76.h b/mt76.h
-index 0a9552b..e29f490 100644
+index 8139b4ad..db2075c3 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1010,6 +1010,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
+@@ -1027,6 +1027,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
  int mt76_eeprom_init(struct mt76_dev *dev, int len);
  void mt76_eeprom_override(struct mt76_phy *phy);
  int mt76_get_of_eeprom(struct mt76_dev *dev, void *data, int offset, int len);
@@ -55,7 +55,7 @@
  struct mt76_queue *
  mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 0f5862e..4d2d9ca 100644
+index 0f5862e3..4d2d9ca2 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -42,33 +42,6 @@ static int mt7915_check_eeprom(struct mt7915_dev *dev)
@@ -151,7 +151,7 @@
  		if (ret)
  			return ret;
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index fdae347..f228926 100644
+index fdae347e..f228926b 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
 @@ -108,6 +108,13 @@ enum mt7915_sku_rate_group {
@@ -213,7 +213,7 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 1cfa6f0..9b72f41 100644
+index aaab5f7a..5a206f7a 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -42,15 +42,24 @@
@@ -244,7 +244,7 @@
  #define MT7915_EEPROM_SIZE		3584
  #define MT7916_EEPROM_SIZE		4096
  
-@@ -395,6 +404,8 @@ struct mt7915_dev {
+@@ -397,6 +406,8 @@ struct mt7915_dev {
  
  	bool dbdc_support;
  	bool flash_mode;
@@ -254,7 +254,7 @@
  	bool ibf;
  
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 9de5b0f..e14b52c 100644
+index 9de5b0f6..e14b52c1 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -3,6 +3,7 @@
diff --git a/recipes-wifi/linux-mt76/files/patches/1122-mt76-mt7915-initialize-wcid.patch b/recipes-wifi/linux-mt76/files/patches/1122-mt76-mt7915-initialize-wcid.patch
index f0e0d3c..f4100fd 100644
--- a/recipes-wifi/linux-mt76/files/patches/1122-mt76-mt7915-initialize-wcid.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1122-mt76-mt7915-initialize-wcid.patch
@@ -1,7 +1,7 @@
-From 202e4428abd4d55ee3bb1b3e692a257269ec68c3 Mon Sep 17 00:00:00 2001
+From 3a3aee4807250c8364a97ab167ea092df6fea720 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 12 Jul 2022 13:56:07 +0800
-Subject: [PATCH 1122/1128] mt76 mt7915 initialize wcid
+Subject: [PATCH 1122/1127] mt76 mt7915 initialize wcid
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -9,10 +9,10 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 9af8616..acc9871 100644
+index 3b144ad0..dc4c6eb3 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -999,7 +999,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1031,7 +1031,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  		info = le32_to_cpu(*cur_info);
  		if (info & MT_TX_FREE_PAIR) {
  			struct mt7915_sta *msta;
diff --git a/recipes-wifi/linux-mt76/files/patches/1123-mt76-HEMU-Add-dump-support.patch b/recipes-wifi/linux-mt76/files/patches/1123-mt76-HEMU-Add-dump-support.patch
index dd3830e..92cd0a7 100644
--- a/recipes-wifi/linux-mt76/files/patches/1123-mt76-HEMU-Add-dump-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1123-mt76-HEMU-Add-dump-support.patch
@@ -1,7 +1,7 @@
-From 32c6671d000c26212b3c6894467392a7b2061f92 Mon Sep 17 00:00:00 2001
+From cf6ba9d0fb09e2c7975b15ede8a5389b700e1f1a Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Thu, 11 Aug 2022 18:09:45 -0700
-Subject: [PATCH 1123/1128] mt76: HEMU: Add dump support
+Subject: [PATCH 1123/1127] mt76: HEMU: Add dump support
 
 Change-Id: I521214f3feb6f0d528a9f550255050ffd1ec96d2
 ---
@@ -10,7 +10,7 @@
  2 files changed, 27 insertions(+)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 5a28a55..7acb330 100644
+index cd5c3b83..5e34b852 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -37,6 +37,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -21,7 +21,7 @@
  };
  
  static const struct nla_policy
-@@ -997,6 +998,30 @@ static int mt7915_vendor_hemu_ctrl(struct wiphy *wiphy,
+@@ -1004,6 +1005,30 @@ static int mt7915_vendor_hemu_ctrl(struct wiphy *wiphy,
  	return 0;
  }
  
@@ -52,7 +52,7 @@
  static int
  mt7915_vendor_phy_capa_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  			     struct sk_buff *skb, const void *data, int data_len,
-@@ -1122,6 +1147,7 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1192,6 +1217,7 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
  			WIPHY_VENDOR_CMD_NEED_RUNNING,
  		.doit = mt7915_vendor_hemu_ctrl,
@@ -61,10 +61,10 @@
  		.maxattr = MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
  	},
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 83c41bc..57f52f3 100644
+index 72319717..c19ffe72 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
-@@ -58,6 +58,7 @@ enum mtk_vendor_attr_hemu_ctrl {
+@@ -72,6 +72,7 @@ enum mtk_vendor_attr_hemu_ctrl {
  	MTK_VENDOR_ATTR_HEMU_CTRL_UNSPEC,
  
  	MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF,
diff --git a/recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch b/recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
index 7d42880..e030a1c 100644
--- a/recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
@@ -1,7 +1,8 @@
-From 5f2097d8515e59239f365b2a9f73e7f6e580149d Mon Sep 17 00:00:00 2001
+From 7393d279dc1edb9e807cfc3e8d4dca25500102e3 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 28 Oct 2022 10:15:56 +0800
-Subject: [PATCH] mt76: mt7915: add vendor subcmd three wire (PTA) ctrl
+Subject: [PATCH 1124/1127] mt76: mt7915: add vendor subcmd three wire (PTA)
+ ctrl
 
 Change-Id: Ic1044698f294455594a0c6254f55326fdab90580
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -15,10 +16,10 @@
  6 files changed, 111 insertions(+), 29 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index bceb6799..86a8688e 100644
+index 9339b711..131257c7 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1162,7 +1162,7 @@ enum {
+@@ -1188,7 +1188,7 @@ enum {
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
@@ -28,10 +29,10 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index a6c84c2f..3caa5996 100644
+index cd6f3292..4e7bc982 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3964,37 +3964,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
+@@ -4234,37 +4234,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
  			&req, sizeof(req), false);
  }
  
@@ -93,10 +94,10 @@
  
  void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index b608cb6a..2172d491 100644
+index de265d15..9780f128 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -625,6 +625,35 @@ struct mt7915_mcu_rdd_ipi_scan {
+@@ -655,6 +655,35 @@ struct mt7915_mcu_rdd_ipi_scan {
  	u8 tx_assert_time;						/* unit: us */
  } __packed;
  
@@ -133,10 +134,10 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index d979950f..28a2f684 100644
+index 5a206f7a..626b2634 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -749,6 +749,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
+@@ -757,6 +757,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
  void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable);
  int mt7915_mcu_set_mu_edca(struct mt7915_phy *phy, u8 val);
  void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type);
@@ -145,7 +146,7 @@
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index b95a1582..84e088c9 100644
+index 5e34b852..6b86b77a 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -40,6 +40,11 @@ hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL] = {
@@ -177,7 +178,7 @@
  static int
  mt7915_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  			     struct sk_buff *skb, const void *data, int data_len,
-@@ -1164,6 +1170,31 @@ mt7915_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
+@@ -1162,6 +1168,31 @@ mt7915_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  	return len;
  }
  
@@ -209,7 +210,7 @@
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
  		.info = {
-@@ -1245,6 +1276,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1243,6 +1274,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.dumpit = mt7915_vendor_edcca_ctrl_dump,
  		.policy = edcca_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_EDCCA_CTRL_MAX,
diff --git a/recipes-wifi/linux-mt76/files/patches/1125-mt76-add-ibf-control-vendor-cmd.patch b/recipes-wifi/linux-mt76/files/patches/1125-mt76-add-ibf-control-vendor-cmd.patch
index b5be350..4a19217 100644
--- a/recipes-wifi/linux-mt76/files/patches/1125-mt76-add-ibf-control-vendor-cmd.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1125-mt76-add-ibf-control-vendor-cmd.patch
@@ -1,7 +1,7 @@
-From 6de06b0f652673f2db19060161dcc94d47ff4ce3 Mon Sep 17 00:00:00 2001
+From fb4a764b80826bd6ba3afd0d015168a460124d9e Mon Sep 17 00:00:00 2001
 From: mtk27835 <shurong.wen@mediatek.com>
 Date: Wed, 7 Sep 2022 14:01:29 -0700
-Subject: [PATCH] mt76: add ibf control vendor cmd
+Subject: [PATCH 1125/1127] mt76: add ibf control vendor cmd
 
 Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
 ---
@@ -10,7 +10,7 @@
  2 files changed, 95 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 84e088c9..648d2dfb 100644
+index 6b86b77a..e4915623 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -86,6 +86,17 @@ edcca_dump_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP] = {
@@ -31,7 +31,7 @@
  struct csi_null_tone {
  	u8 start;
  	u8 end;
-@@ -1194,6 +1205,54 @@ static int mt7915_vendor_3wire_ctrl(struct wiphy *wiphy,
+@@ -1192,6 +1203,54 @@ static int mt7915_vendor_3wire_ctrl(struct wiphy *wiphy,
  	return mt7915_mcu_set_cfg(phy, CFGINFO_3WIRE_EN_CFG, three_wire_mode);
  }
  
@@ -86,7 +86,7 @@
  
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
-@@ -1287,6 +1346,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1285,6 +1344,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.doit = mt7915_vendor_3wire_ctrl,
  		.policy = three_wire_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_3WIRE_CTRL_MAX,
diff --git a/recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch b/recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
index 9780db3..b1337a3 100644
--- a/recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
@@ -1,7 +1,7 @@
-From ba976379e903eb0a26276037718d5679ae95051a Mon Sep 17 00:00:00 2001
+From 33ed87389f2f190aaf298a617d2bdc737b216485 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 13 Oct 2022 13:22:05 +0800
-Subject: [PATCH 1127/1128] mt76: mt7915: add E3 re-bonding for low yield rate
+Subject: [PATCH 1126/1127] mt76: mt7915: add E3 re-bonding for low yield rate
  issue
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -12,7 +12,7 @@
  3 files changed, 38 insertions(+), 5 deletions(-)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 4d2d9ca..b3d2bbc 100644
+index 4d2d9ca2..b3d2bbc5 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -97,7 +97,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
@@ -64,10 +64,10 @@
  	if (ret)
  		return ret;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 39c8e2c..fad3559 100644
+index 4e7bc982..dfb1ee69 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2779,7 +2779,7 @@ int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode)
+@@ -2805,7 +2805,7 @@ int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode)
  				 &req, sizeof(req), true);
  }
  
@@ -76,7 +76,7 @@
  {
  	struct mt7915_mcu_eeprom_info req = {
  		.addr = cpu_to_le32(round_down(offset,
-@@ -2796,8 +2796,15 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
+@@ -2822,8 +2822,15 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
  		return ret;
  
  	res = (struct mt7915_mcu_eeprom_info *)skb->data;
@@ -95,10 +95,10 @@
  
  	return 0;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 4cdcb63..dbd634a 100644
+index 626b2634..701e5c86 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -560,6 +560,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
+@@ -562,6 +562,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
  
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
@@ -106,7 +106,7 @@
  int mt7915_eeprom_init(struct mt7915_dev *dev);
  void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
  				struct mt7915_phy *phy);
-@@ -613,7 +614,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -615,7 +616,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  				   struct ieee80211_sta *sta,
  				   void *data, u32 field);
  int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode);
diff --git a/recipes-wifi/linux-mt76/files/patches/1127-mt76-support-on-off-SW-ACI-through-debugfs.patch b/recipes-wifi/linux-mt76/files/patches/1127-mt76-support-on-off-SW-ACI-through-debugfs.patch
index 94cf85c..e853cb4 100644
--- a/recipes-wifi/linux-mt76/files/patches/1127-mt76-support-on-off-SW-ACI-through-debugfs.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1127-mt76-support-on-off-SW-ACI-through-debugfs.patch
@@ -1,7 +1,7 @@
-From 03db7df14e4b8fcf9cf69725ee3baf74656293dc Mon Sep 17 00:00:00 2001
+From 29102c6d02cdd6699881a7daa1be345719810c59 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 14 Oct 2022 11:15:13 +0800
-Subject: [PATCH 1128/1128] mt76: support on off SW ACI through debugfs
+Subject: [PATCH 1127/1127] mt76: support on off SW ACI through debugfs
 
 Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Change-Id: I8a9c277c41d1ba76f9737d8af6f42e5e8f00ba64
@@ -11,10 +11,10 @@
  2 files changed, 22 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 86a8688..a368b65 100644
+index 131257c7..3b789d75 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1164,6 +1164,7 @@ enum {
+@@ -1190,6 +1190,7 @@ enum {
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
  	MCU_EXT_CMD_SET_CFG = 0xb7,
  	MCU_EXT_CMD_EDCCA = 0xba,
@@ -23,10 +23,10 @@
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
  };
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 36cb6f0..facdd69 100644
+index e14b52c1..8c8a3ca5 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2927,6 +2927,25 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
+@@ -2932,6 +2932,25 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -52,7 +52,7 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  {
  	struct mt7915_dev *dev = phy->dev;
-@@ -3009,6 +3028,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3014,6 +3033,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  
  	debugfs_create_devm_seqfile(dev->mt76.dev, "eeprom_mode", dir,
  				    mt7915_show_eeprom_mode);
diff --git a/recipes-wifi/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch b/recipes-wifi/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch
index 5f853a4..3f85428 100644
--- a/recipes-wifi/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch
@@ -1,18 +1,18 @@
-From 457a54d92f80cb1a24cbde87e7bf2b49a65d4321 Mon Sep 17 00:00:00 2001
+From fd87002de206b299e0962d2935c5f3ab0813cfa0 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Sun, 12 Jun 2022 16:38:45 +0800
-Subject: [PATCH 3001/3011] mt76 add wed tx support
+Date: Fri, 25 Nov 2022 10:38:53 +0800
+Subject: [PATCH 3001/3010] mt76 add wed tx support
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
  mt76_connac.h |  1 +
  mt7915/mac.c  | 11 +++++++----
  mt7915/main.c |  4 ++--
- mt7915/mmio.c | 12 ++++++++++--
- 4 files changed, 20 insertions(+), 8 deletions(-)
+ mt7915/mmio.c |  5 +++--
+ 4 files changed, 13 insertions(+), 8 deletions(-)
 
 diff --git a/mt76_connac.h b/mt76_connac.h
-index 0915eb5..9a46887 100644
+index 8ba883b0..f70987dd 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -116,6 +116,7 @@ struct mt76_connac_sta_key_conf {
@@ -24,10 +24,10 @@
  struct mt76_connac_fw_txp {
  	__le16 flags;
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 5a809c2..20e5b70 100644
+index dc4c6eb3..d07bf790 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -858,9 +858,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
+@@ -890,9 +890,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
  
  	txp->token = cpu_to_le16(token_id);
  	txp->nbuf = 1;
@@ -39,7 +39,7 @@
  }
  
  static void
-@@ -976,6 +976,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1008,6 +1008,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  	LIST_HEAD(free_list);
  	void *end = data + len;
  	bool v3, wake = false;
@@ -47,7 +47,7 @@
  	u16 total, count = 0;
  	u32 txd = le32_to_cpu(free->txd);
  	__le32 *cur_info;
-@@ -1031,12 +1032,14 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1063,12 +1064,14 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  			txwi = mt76_token_release(mdev, msdu, &wake);
  			if (!txwi)
  				continue;
@@ -65,10 +65,10 @@
  
  static void
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 2b4e122..f9b2c1e 100644
+index 83b97d23..2d237abf 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1466,14 +1466,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1505,14 +1505,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	if (!mtk_wed_device_active(wed))
  		return -ENODEV;
  
@@ -86,19 +86,19 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 63b66e4..f76f896 100644
+index fef4b126..7a50aa11 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -10,7 +10,7 @@
- #include "mac.h"
+@@ -11,7 +11,7 @@
  #include "../trace.h"
+ #include "../dma.h"
  
 -static bool wed_enable;
 +static bool wed_enable = true;
  module_param(wed_enable, bool, 0644);
+ MODULE_PARM_DESC(wed_enable, "Enable Wireless Ethernet Dispatch support");
  
- static const u32 mt7915_reg[] = {
-@@ -575,7 +575,7 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
+@@ -580,7 +580,7 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
  	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
  
  	spin_lock_bh(&dev->mt76.token_lock);
@@ -107,39 +107,7 @@
  	spin_unlock_bh(&dev->mt76.token_lock);
  
  	/* MT_TXD5_TX_STATUS_HOST (MPDU format) has higher priority than
-@@ -606,6 +606,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 
- 		wed->wlan.pci_dev = pci_dev;
- 		wed->wlan.bus_type = MTK_WED_BUS_PCIE;
-+		wed->wlan.base = (void __iomem *)ioremap(
-+				 pci_resource_start(pci_dev, 0),
-+				 pci_resource_len(pci_dev, 0));
- 		wed->wlan.wpdma_int = pci_resource_start(pci_dev, 0) +
- 				      MT_INT_WED_SOURCE_CSR;
- 		wed->wlan.wpdma_mask = pci_resource_start(pci_dev, 0) +
-@@ -616,6 +619,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 				     MT_TXQ_WED_RING_BASE;
- 		wed->wlan.wpdma_txfree = pci_resource_start(pci_dev, 0) +
- 					 MT_RXQ_WED_RING_BASE;
-+		wed->wlan.phy_base = pci_resource_start(pci_dev, 0);
- 	} else {
- 		struct platform_device *plat_dev = pdev_ptr;
- 		struct resource *res;
-@@ -626,10 +630,13 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 
- 		wed->wlan.platform_dev = plat_dev;
- 		wed->wlan.bus_type = MTK_WED_BUS_AXI;
-+		wed->wlan.base = (void __iomem *)ioremap(res->start,
-+				 resource_size(res));
- 		wed->wlan.wpdma_int = res->start + MT_INT_SOURCE_CSR;
- 		wed->wlan.wpdma_mask = res->start + MT_INT_MASK_CSR;
- 		wed->wlan.wpdma_tx = res->start + MT_TXQ_WED_RING_BASE;
- 		wed->wlan.wpdma_txfree = res->start + MT_RXQ_WED_RING_BASE;
-+		wed->wlan.phy_base = res->start;
- 	}
- 	wed->wlan.nbuf = 4096;
- 	wed->wlan.tx_tbit[0] = is_mt7915(&dev->mt76) ? 4 : 30;
-@@ -645,6 +652,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -783,6 +783,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  
  	*irq = wed->irq;
  	dev->mt76.dma_dev = wed->dev;
diff --git a/recipes-wifi/linux-mt76/files/patches/3002-mt76-mt7915-add-wed-tx-wds-support-on-mt7986.patch b/recipes-wifi/linux-mt76/files/patches/3002-mt76-mt7915-add-wed-tx-wds-support-on-mt7986.patch
index 2443604..062e883 100644
--- a/recipes-wifi/linux-mt76/files/patches/3002-mt76-mt7915-add-wed-tx-wds-support-on-mt7986.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3002-mt76-mt7915-add-wed-tx-wds-support-on-mt7986.patch
@@ -1,7 +1,7 @@
-From ad8a906f3ee37375a9f2ad9b57d0eeaff90c8f14 Mon Sep 17 00:00:00 2001
+From fceca885342128a2c335e05c0517b1357bf2dc05 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Sat, 10 Sep 2022 17:09:21 +0800
-Subject: [PATCH 3002/3011] mt76: mt7915: add-wed-tx-wds-support-on-mt7986
+Subject: [PATCH 3002/3010] mt76: mt7915: add-wed-tx-wds-support-on-mt7986
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -11,15 +11,15 @@
  mt7915/main.c   | 45 +++++++++++++++++++++++++++++++++++++++++++--
  mt7915/mcu.c    | 12 ++++++++++--
  mt7915/mcu.h    |  1 +
- mt7915/mmio.c   |  3 +++
+ mt7915/mmio.c   |  1 +
  mt7915/mt7915.h |  4 ++++
- 8 files changed, 76 insertions(+), 5 deletions(-)
+ 8 files changed, 74 insertions(+), 5 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index b378231..c84c9ef 100644
+index 7e0f0e0e..f0ffbd0c 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -1363,7 +1363,10 @@ void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,
+@@ -1371,7 +1371,10 @@ void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,
  
  	mt76_packet_id_flush(dev, wcid);
  
@@ -32,10 +32,10 @@
  }
  EXPORT_SYMBOL_GPL(__mt76_sta_remove);
 diff --git a/mt76.h b/mt76.h
-index e29f490..b86c835 100644
+index db2075c3..bb0433b2 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -454,6 +454,7 @@ struct mt76_driver_ops {
+@@ -465,6 +465,7 @@ struct mt76_driver_ops {
  
  	void (*sta_remove)(struct mt76_dev *dev, struct ieee80211_vif *vif,
  			   struct ieee80211_sta *sta);
@@ -43,7 +43,7 @@
  };
  
  struct mt76_channel_state {
-@@ -825,6 +826,7 @@ struct mt76_dev {
+@@ -842,6 +843,7 @@ struct mt76_dev {
  	spinlock_t status_lock;
  
  	u32 wcid_mask[DIV_ROUND_UP(MT76_N_WCIDS, 32)];
@@ -52,10 +52,10 @@
  
  	u64 vif_mask;
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 69465dd..039a5b0 100644
+index 2f3453b0..8f32b6a8 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -719,6 +719,15 @@ mt7915_init_hardware(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+@@ -722,6 +722,15 @@ mt7915_init_hardware(struct mt7915_dev *dev, struct mt7915_phy *phy2)
  			return ret;
  	}
  
@@ -72,10 +72,10 @@
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
  	if (idx)
 diff --git a/mt7915/main.c b/mt7915/main.c
-index f9b2c1e..c061786 100644
+index 2d237abf..8813e3c5 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -660,6 +660,24 @@ mt7915_channel_switch_beacon(struct ieee80211_hw *hw,
+@@ -658,6 +658,24 @@ mt7915_channel_switch_beacon(struct ieee80211_hw *hw,
  	mutex_unlock(&dev->mt76.mutex);
  }
  
@@ -100,7 +100,7 @@
  int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  		       struct ieee80211_sta *sta)
  {
-@@ -672,8 +690,18 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -670,8 +688,18 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  #endif
  	int ret, idx;
  	u32 addr;
@@ -120,7 +120,7 @@
  	if (idx < 0)
  		return -ENOSPC;
  
-@@ -1135,6 +1163,15 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
+@@ -1141,6 +1169,15 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
  	else
  		clear_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
  
@@ -136,7 +136,7 @@
  	mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
  }
  
-@@ -1473,7 +1510,11 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1512,7 +1549,11 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	path->dev = ctx->dev;
  	path->mtk_wdma.wdma_idx = wed->wdma_idx;
  	path->mtk_wdma.bss = mvif->mt76.idx;
@@ -150,10 +150,10 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index fad3559..eb9343c 100644
+index dfb1ee69..03fd8c50 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2279,6 +2279,7 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
+@@ -2305,6 +2305,7 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
  int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  {
  	int ret;
@@ -161,7 +161,7 @@
  
  	/* force firmware operation mode into normal state,
  	 * which should be set before firmware download stage.
-@@ -2308,8 +2309,15 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2334,8 +2335,15 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -180,10 +180,10 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index b2e4032..42d5e39 100644
+index 9780f128..5fcac90f 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -270,6 +270,7 @@ enum {
+@@ -281,6 +281,7 @@ enum {
  	MCU_WA_PARAM_RED_SHOW_STA = 0xf,
  	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
  #endif
@@ -192,19 +192,10 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index f76f896..e45cd2d 100644
+index 7a50aa11..f348a779 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -646,6 +646,8 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 	wed->wlan.init_buf = mt7915_wed_init_buf;
- 	wed->wlan.offload_enable = mt7915_mmio_wed_offload_enable;
- 	wed->wlan.offload_disable = mt7915_mmio_wed_offload_disable;
-+	if (!is_mt7915(mdev))
-+		wed->wlan.wcid_512 = true;
- 
- 	if (mtk_wed_device_attach(wed))
- 		return 0;
-@@ -860,6 +862,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
+@@ -991,6 +991,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
  		.sta_add = mt7915_mac_sta_add,
  		.sta_remove = mt7915_mac_sta_remove,
  		.update_survey = mt7915_update_channel,
@@ -213,7 +204,7 @@
  	struct mt7915_dev *dev;
  	struct mt76_dev *mdev;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index dbd634a..06b98b7 100644
+index 701e5c86..6bc33f21 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -18,6 +18,9 @@
@@ -226,9 +217,9 @@
  #define MT7915_WATCHDOG_TIME		(HZ / 10)
  #define MT7915_RESET_TIMEOUT		(30 * HZ)
  
-@@ -719,6 +722,7 @@ void mt7915_tx_token_put(struct mt7915_dev *dev);
+@@ -725,6 +728,7 @@ void mt7915_tx_token_put(struct mt7915_dev *dev);
  void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
- 			 struct sk_buff *skb);
+ 			 struct sk_buff *skb, u32 *info);
  bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len);
 +bool mt7915_wed_wds_check(struct mt76_dev *mdev, struct ieee80211_sta *sta);
  void mt7915_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
diff --git a/recipes-wifi/linux-mt76/files/patches/3003-mt76-add-wed-rx-copy-skb.patch b/recipes-wifi/linux-mt76/files/patches/3003-mt76-add-wed-rx-copy-skb.patch
new file mode 100644
index 0000000..cee1e63
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/3003-mt76-add-wed-rx-copy-skb.patch
@@ -0,0 +1,70 @@
+From bcd2e7f4520fa16b90fb7e4d98e0590d3e70fe11 Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Fri, 25 Nov 2022 12:05:06 +0800
+Subject: [PATCH 32/39] mt76: add wed rx copy skb
+
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+---
+ dma.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/dma.c b/dma.c
+index d2891c64..929816b7 100644
+--- a/dma.c
++++ b/dma.c
+@@ -382,9 +382,12 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+ 				 SKB_WITH_OVERHEAD(q->buf_size),
+ 				 DMA_FROM_DEVICE);
+ 
+-		buf = t->ptr;
++		buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
++		if (!buf)
++			return NULL;
++
++		memcpy(buf, t->ptr, SKB_WITH_OVERHEAD(q->buf_size));
+ 		t->dma_addr = 0;
+-		t->ptr = NULL;
+ 
+ 		mt76_put_rxwi(dev, t);
+ 
+@@ -578,6 +581,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+ 	while (q->queued < q->ndesc - 1) {
+ 		struct mt76_txwi_cache *t = NULL;
+ 		struct mt76_queue_buf qbuf;
++		bool skip_alloc = false;
+ 		void *buf = NULL;
+ 
+ 		if ((q->flags & MT_QFLAG_WED) &&
+@@ -585,11 +589,18 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+ 			t = mt76_get_rxwi(dev);
+ 			if (!t)
+ 				break;
++
++			if (t->ptr) {
++				skip_alloc = true;
++				buf = t->ptr;
++			}
+ 		}
+ 
+-		buf = page_frag_alloc(rx_page, q->buf_size, GFP_ATOMIC);
+-		if (!buf)
+-			break;
++		if (!skip_alloc) {
++			buf = page_frag_alloc(rx_page, q->buf_size, GFP_ATOMIC);
++			if (!buf)
++				break;
++		}
+ 
+ 		addr = dma_map_single(dev->dma_dev, buf, len, DMA_FROM_DEVICE);
+ 		if (unlikely(dma_mapping_error(dev->dma_dev, addr))) {
+@@ -954,5 +965,7 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
+ 
+ 	if (mtk_wed_device_active(&dev->mmio.wed))
+ 		mtk_wed_device_detach(&dev->mmio.wed);
++
++	mt76_free_pending_rxwi(dev);
+ }
+ EXPORT_SYMBOL_GPL(mt76_dma_cleanup);
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/3003-mt76-add-wed-rx-support.patch b/recipes-wifi/linux-mt76/files/patches/3003-mt76-add-wed-rx-support.patch
deleted file mode 100644
index 0cb1c16..0000000
--- a/recipes-wifi/linux-mt76/files/patches/3003-mt76-add-wed-rx-support.patch
+++ /dev/null
@@ -1,1202 +0,0 @@
-From bc9cac100bb95aa89b6ded079f1065fbb739c90c Mon Sep 17 00:00:00 2001
-From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Tue, 5 Jul 2022 19:42:55 +0800
-Subject: [PATCH 3003/3011] mt76 add wed rx support
-
-Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
----
- dma.c             | 250 ++++++++++++++++++++++++++++++++++++++--------
- dma.h             |  10 ++
- mac80211.c        |   8 +-
- mt76.h            |  24 ++++-
- mt7603/dma.c      |   2 +-
- mt7603/mt7603.h   |   2 +-
- mt7615/mac.c      |   2 +-
- mt7615/mt7615.h   |   2 +-
- mt76_connac_mcu.c |   9 ++
- mt76x02.h         |   2 +-
- mt76x02_txrx.c    |   2 +-
- mt7915/dma.c      |  17 +++-
- mt7915/mac.c      | 101 ++++++++++++++++++-
- mt7915/mcu.c      |   3 +
- mt7915/mmio.c     |  30 ++++--
- mt7915/mt7915.h   |   7 +-
- mt7915/regs.h     |   6 ++
- mt7921/mac.c      |   2 +-
- mt7921/mt7921.h   |   2 +-
- tx.c              |  34 +++++++
- 20 files changed, 448 insertions(+), 67 deletions(-)
-
-diff --git a/dma.c b/dma.c
-index 82b4da2..a8739eb 100644
---- a/dma.c
-+++ b/dma.c
-@@ -98,6 +98,63 @@ mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t)
- }
- EXPORT_SYMBOL_GPL(mt76_put_txwi);
- 
-+static struct mt76_txwi_cache *
-+mt76_alloc_rxwi(struct mt76_dev *dev)
-+{
-+	struct mt76_txwi_cache *r;
-+	int size;
-+
-+	size = L1_CACHE_ALIGN(sizeof(*r));
-+	r = kzalloc(size, GFP_ATOMIC);
-+	if (!r)
-+		return NULL;
-+
-+	r->buf = NULL;
-+
-+	return r;
-+}
-+
-+static struct mt76_txwi_cache *
-+__mt76_get_rxwi(struct mt76_dev *dev)
-+{
-+	struct mt76_txwi_cache *r = NULL;
-+
-+	spin_lock(&dev->wed_lock);
-+	if (!list_empty(&dev->rxwi_cache)) {
-+		r = list_first_entry(&dev->rxwi_cache, struct mt76_txwi_cache,
-+				     list);
-+		if(r)
-+			list_del(&r->list);
-+	}
-+	spin_unlock(&dev->wed_lock);
-+
-+	return r;
-+}
-+
-+struct mt76_txwi_cache *
-+mt76_get_rxwi(struct mt76_dev *dev)
-+{
-+	struct mt76_txwi_cache *r = __mt76_get_rxwi(dev);
-+
-+	if (r)
-+		return r;
-+
-+	return mt76_alloc_rxwi(dev);
-+}
-+EXPORT_SYMBOL_GPL(mt76_get_rxwi);
-+
-+void
-+mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *r)
-+{
-+	if (!r)
-+		return;
-+
-+	spin_lock(&dev->wed_lock);
-+	list_add(&r->list, &dev->rxwi_cache);
-+	spin_unlock(&dev->wed_lock);
-+}
-+EXPORT_SYMBOL_GPL(mt76_put_rxwi);
-+
- static void
- mt76_free_pending_txwi(struct mt76_dev *dev)
- {
-@@ -112,6 +169,21 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
- 	local_bh_enable();
- }
- 
-+static void
-+mt76_free_pending_rxwi(struct mt76_dev *dev)
-+{
-+	struct mt76_txwi_cache *r;
-+
-+	local_bh_disable();
-+	while ((r = __mt76_get_rxwi(dev)) != NULL) {
-+		if (r->buf)
-+			skb_free_frag(r->buf);
-+
-+		kfree(r);
-+	}
-+	local_bh_enable();
-+}
-+
- static void
- mt76_dma_sync_idx(struct mt76_dev *dev, struct mt76_queue *q)
- {
-@@ -141,12 +213,15 @@ mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q)
- static int
- mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
- 		 struct mt76_queue_buf *buf, int nbufs, u32 info,
--		 struct sk_buff *skb, void *txwi)
-+		 struct sk_buff *skb, void *txwi, void *rxwi)
- {
-+	struct mtk_wed_device *wed = &dev->mmio.wed;
-+
- 	struct mt76_queue_entry *entry;
- 	struct mt76_desc *desc;
- 	u32 ctrl;
- 	int i, idx = -1;
-+	int type;
- 
- 	if (txwi) {
- 		q->entry[q->head].txwi = DMA_DUMMY_DATA;
-@@ -162,28 +237,42 @@ mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
- 		desc = &q->desc[idx];
- 		entry = &q->entry[idx];
- 
--		if (buf[0].skip_unmap)
--			entry->skip_buf0 = true;
--		entry->skip_buf1 = i == nbufs - 1;
--
--		entry->dma_addr[0] = buf[0].addr;
--		entry->dma_len[0] = buf[0].len;
--
--		ctrl = FIELD_PREP(MT_DMA_CTL_SD_LEN0, buf[0].len);
--		if (i < nbufs - 1) {
--			entry->dma_addr[1] = buf[1].addr;
--			entry->dma_len[1] = buf[1].len;
--			buf1 = buf[1].addr;
--			ctrl |= FIELD_PREP(MT_DMA_CTL_SD_LEN1, buf[1].len);
--			if (buf[1].skip_unmap)
--				entry->skip_buf1 = true;
-+		type = FIELD_GET(MT_QFLAG_WED_TYPE, q->flags);
-+		if (mtk_wed_device_active(wed) && type == MT76_WED_Q_RX) {
-+			struct mt76_txwi_cache *r = rxwi;
-+			int rx_token;
-+
-+			if (!r)
-+				return -ENOMEM;
-+
-+			rx_token = mt76_rx_token_consume(dev, (void *)skb, r, buf[0].addr);
-+
-+			buf1 |= FIELD_PREP(MT_DMA_CTL_TOKEN, rx_token);
-+			ctrl = FIELD_PREP(MT_DMA_CTL_SD_LEN0, MTK_WED_RX_PKT_SIZE);
-+			ctrl |= MT_DMA_CTL_TO_HOST;
-+		} else {
-+			if (buf[0].skip_unmap)
-+				entry->skip_buf0 = true;
-+			entry->skip_buf1 = i == nbufs - 1;
-+
-+			entry->dma_addr[0] = buf[0].addr;
-+			entry->dma_len[0] = buf[0].len;
-+
-+			ctrl = FIELD_PREP(MT_DMA_CTL_SD_LEN0, buf[0].len);
-+			if (i < nbufs - 1) {
-+				entry->dma_addr[1] = buf[1].addr;
-+				entry->dma_len[1] = buf[1].len;
-+				buf1 = buf[1].addr;
-+				ctrl |= FIELD_PREP(MT_DMA_CTL_SD_LEN1, buf[1].len);
-+				if (buf[1].skip_unmap)
-+					entry->skip_buf1 = true;
-+			}
-+			if (i == nbufs - 1)
-+				ctrl |= MT_DMA_CTL_LAST_SEC0;
-+			else if (i == nbufs - 2)
-+				ctrl |= MT_DMA_CTL_LAST_SEC1;
- 		}
- 
--		if (i == nbufs - 1)
--			ctrl |= MT_DMA_CTL_LAST_SEC0;
--		else if (i == nbufs - 2)
--			ctrl |= MT_DMA_CTL_LAST_SEC1;
--
- 		WRITE_ONCE(desc->buf0, cpu_to_le32(buf0));
- 		WRITE_ONCE(desc->buf1, cpu_to_le32(buf1));
- 		WRITE_ONCE(desc->info, cpu_to_le32(info));
-@@ -272,33 +361,65 @@ mt76_dma_tx_cleanup(struct mt76_dev *dev, struct mt76_queue *q, bool flush)
- 
- static void *
- mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
--		 int *len, u32 *info, bool *more)
-+		 int *len, u32 *info, bool *more, bool *drop)
- {
- 	struct mt76_queue_entry *e = &q->entry[idx];
- 	struct mt76_desc *desc = &q->desc[idx];
- 	dma_addr_t buf_addr;
--	void *buf = e->buf;
-+	void *buf = e->buf, *copy = NULL;
- 	int buf_len = SKB_WITH_OVERHEAD(q->buf_size);
-+	struct mtk_wed_device *wed = &dev->mmio.wed;
-+	int type;
- 
--	buf_addr = e->dma_addr[0];
- 	if (len) {
- 		u32 ctl = le32_to_cpu(READ_ONCE(desc->ctrl));
- 		*len = FIELD_GET(MT_DMA_CTL_SD_LEN0, ctl);
- 		*more = !(ctl & MT_DMA_CTL_LAST_SEC0);
- 	}
- 
--	if (info)
--		*info = le32_to_cpu(desc->info);
-+	type = FIELD_GET(MT_QFLAG_WED_TYPE, q->flags);
-+	if (mtk_wed_device_active(wed) && type == MT76_WED_Q_RX) {
-+		u32 token;
-+		struct mt76_txwi_cache *r;
-+
-+		token = FIELD_GET(MT_DMA_CTL_TOKEN, desc->buf1);
-+
-+		r = mt76_rx_token_release(dev, token);
-+		if (!r)
-+			return NULL;
-+
-+		buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
-+		if (!buf)
-+			return NULL;
-+
-+		copy = r->buf;
-+		buf_addr = r->dma_addr;
-+		buf_len = MTK_WED_RX_PKT_SIZE;
-+		r->dma_addr = 0;
-+
-+		mt76_put_rxwi(dev, r);
-+
-+		if (desc->ctrl & (MT_DMA_CTL_TO_HOST_A | MT_DMA_CTL_DROP))
-+			*drop = true;
-+	} else {
-+		buf_addr = e->dma_addr[0];
-+		e->buf = NULL;
-+	}
- 
- 	dma_unmap_single(dev->dma_dev, buf_addr, buf_len, DMA_FROM_DEVICE);
--	e->buf = NULL;
-+
-+	if (copy)
-+		memcpy(buf, copy, MTK_WED_RX_PKT_SIZE);
-+
-+	if (info)
-+		*info = le32_to_cpu(desc->info);
- 
- 	return buf;
- }
- 
- static void *
- mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
--		 int *len, u32 *info, bool *more)
-+		 int *len, u32 *info, bool *more, bool *drop)
- {
- 	int idx = q->tail;
- 
-@@ -314,7 +435,7 @@ mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
- 	q->tail = (q->tail + 1) % q->ndesc;
- 	q->queued--;
- 
--	return mt76_dma_get_buf(dev, q, idx, len, info, more);
-+	return mt76_dma_get_buf(dev, q, idx, len, info, more, drop);
- }
- 
- static int
-@@ -336,7 +457,7 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
- 	buf.len = skb->len;
- 
- 	spin_lock_bh(&q->lock);
--	mt76_dma_add_buf(dev, q, &buf, 1, tx_info, skb, NULL);
-+	mt76_dma_add_buf(dev, q, &buf, 1, tx_info, skb, NULL, NULL);
- 	mt76_dma_kick_queue(dev, q);
- 	spin_unlock_bh(&q->lock);
- 
-@@ -413,7 +534,7 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q,
- 		goto unmap;
- 
- 	return mt76_dma_add_buf(dev, q, tx_info.buf, tx_info.nbuf,
--				tx_info.info, tx_info.skb, t);
-+				tx_info.info, tx_info.skb, t, NULL);
- 
- unmap:
- 	for (n--; n > 0; n--)
-@@ -448,6 +569,8 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- 	int frames = 0;
- 	int len = SKB_WITH_OVERHEAD(q->buf_size);
- 	int offset = q->buf_offset;
-+	struct mtk_wed_device *wed = &dev->mmio.wed;
-+	struct page_frag_cache *rx_page;
- 
- 	if (!q->ndesc)
- 		return 0;
-@@ -456,10 +579,29 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- 
- 	while (q->queued < q->ndesc - 1) {
- 		struct mt76_queue_buf qbuf;
-+		int type = FIELD_GET(MT_QFLAG_WED_TYPE, q->flags);
-+		bool skip_alloc = false;
-+		struct mt76_txwi_cache *r = NULL;
-+
-+		rx_page = &q->rx_page;
-+		if (mtk_wed_device_active(wed) && type == MT76_WED_Q_RX) {
-+			rx_page = &wed->rx_page;
-+			r = mt76_get_rxwi(dev);
-+			if (!r)
-+				return -ENOMEM;
-+
-+			if (r->buf) {
-+				skip_alloc = true;
-+				len = MTK_WED_RX_PKT_SIZE;
-+				buf = r->buf;
-+			}
-+		}
- 
--		buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
--		if (!buf)
--			break;
-+		if (!skip_alloc) {
-+			buf = page_frag_alloc(rx_page, q->buf_size, GFP_ATOMIC);
-+			if (!buf)
-+				break;
-+		}
- 
- 		addr = dma_map_single(dev->dma_dev, buf, len, DMA_FROM_DEVICE);
- 		if (unlikely(dma_mapping_error(dev->dma_dev, addr))) {
-@@ -470,7 +612,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- 		qbuf.addr = addr + offset;
- 		qbuf.len = len - offset;
- 		qbuf.skip_unmap = false;
--		mt76_dma_add_buf(dev, q, &qbuf, 1, 0, buf, NULL);
-+		mt76_dma_add_buf(dev, q, &qbuf, 1, 0, buf, NULL, r);
- 		frames++;
- 	}
- 
-@@ -516,6 +658,11 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
- 		if (!ret)
- 			q->wed_regs = wed->txfree_ring.reg_base;
- 		break;
-+	case MT76_WED_Q_RX:
-+		ret = mtk_wed_device_rx_ring_setup(wed, ring, q->regs);
-+		if (!ret)
-+			q->wed_regs = wed->rx_ring[ring].reg_base;
-+		break;
- 	default:
- 		ret = -EINVAL;
- 	}
-@@ -531,7 +678,8 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
- 		     int idx, int n_desc, int bufsize,
- 		     u32 ring_base)
- {
--	int ret, size;
-+	int ret, size, type;
-+	struct mtk_wed_device *wed = &dev->mmio.wed;
- 
- 	spin_lock_init(&q->lock);
- 	spin_lock_init(&q->cleanup_lock);
-@@ -541,6 +689,11 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
- 	q->buf_size = bufsize;
- 	q->hw_idx = idx;
- 
-+	type = FIELD_GET(MT_QFLAG_WED_TYPE, q->flags);
-+	if (mtk_wed_device_active(wed) && type == MT76_WED_Q_RX)
-+		q->buf_size = SKB_DATA_ALIGN(NET_SKB_PAD + MTK_WED_RX_PKT_SIZE) +
-+					     SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
-+
- 	size = q->ndesc * sizeof(struct mt76_desc);
- 	q->desc = dmam_alloc_coherent(dev->dma_dev, size, &q->desc_dma, GFP_KERNEL);
- 	if (!q->desc)
-@@ -573,7 +726,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
- 
- 	spin_lock_bh(&q->lock);
- 	do {
--		buf = mt76_dma_dequeue(dev, q, true, NULL, NULL, &more);
-+		buf = mt76_dma_dequeue(dev, q, true, NULL, NULL, &more, NULL);
- 		if (!buf)
- 			break;
- 
-@@ -614,7 +767,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
- 
- static void
- mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
--		  int len, bool more)
-+		  int len, bool more, u32 info)
- {
- 	struct sk_buff *skb = q->rx_head;
- 	struct skb_shared_info *shinfo = skb_shinfo(skb);
-@@ -634,7 +787,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
- 
- 	q->rx_head = NULL;
- 	if (nr_frags < ARRAY_SIZE(shinfo->frags))
--		dev->drv->rx_skb(dev, q - dev->q_rx, skb);
-+		dev->drv->rx_skb(dev, q - dev->q_rx, skb, info);
- 	else
- 		dev_kfree_skb(skb);
- }
-@@ -655,6 +808,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
- 	}
- 
- 	while (done < budget) {
-+		bool drop = false;
- 		u32 info;
- 
- 		if (check_ddone) {
-@@ -665,10 +819,13 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
- 				break;
- 		}
- 
--		data = mt76_dma_dequeue(dev, q, false, &len, &info, &more);
-+		data = mt76_dma_dequeue(dev, q, false, &len, &info, &more, &drop);
- 		if (!data)
- 			break;
- 
-+		if (drop)
-+			goto free_frag;
-+
- 		if (q->rx_head)
- 			data_len = q->buf_size;
- 		else
-@@ -681,7 +838,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
- 		}
- 
- 		if (q->rx_head) {
--			mt76_add_fragment(dev, q, data, len, more);
-+			mt76_add_fragment(dev, q, data, len, more, info);
- 			continue;
- 		}
- 
-@@ -705,7 +862,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
- 			continue;
- 		}
- 
--		dev->drv->rx_skb(dev, q - dev->q_rx, skb);
-+		dev->drv->rx_skb(dev, q - dev->q_rx, skb, info);
- 		continue;
- 
- free_frag:
-@@ -782,7 +939,7 @@ EXPORT_SYMBOL_GPL(mt76_dma_attach);
- 
- void mt76_dma_cleanup(struct mt76_dev *dev)
- {
--	int i;
-+	int i, type;
- 
- 	mt76_worker_disable(&dev->tx_worker);
- 	netif_napi_del(&dev->tx_napi);
-@@ -803,12 +960,17 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
- 
- 	mt76_for_each_q_rx(dev, i) {
- 		netif_napi_del(&dev->napi[i]);
--		mt76_dma_rx_cleanup(dev, &dev->q_rx[i]);
-+		type = FIELD_GET(MT_QFLAG_WED_TYPE, dev->q_rx[i].flags);
-+		if (type != MT76_WED_Q_RX)
-+			mt76_dma_rx_cleanup(dev, &dev->q_rx[i]);
- 	}
- 
- 	mt76_free_pending_txwi(dev);
-+	mt76_free_pending_rxwi(dev);
- 
- 	if (mtk_wed_device_active(&dev->mmio.wed))
- 		mtk_wed_device_detach(&dev->mmio.wed);
-+
-+	mt76_free_pending_rxwi(dev);
- }
- EXPORT_SYMBOL_GPL(mt76_dma_cleanup);
-diff --git a/dma.h b/dma.h
-index fdf786f..90370d1 100644
---- a/dma.h
-+++ b/dma.h
-@@ -16,6 +16,16 @@
- #define MT_DMA_CTL_LAST_SEC0		BIT(30)
- #define MT_DMA_CTL_DMA_DONE		BIT(31)
- 
-+#define MT_DMA_CTL_TO_HOST		BIT(8)
-+#define MT_DMA_CTL_TO_HOST_A		BIT(12)
-+#define MT_DMA_CTL_DROP			BIT(14)
-+
-+#define MT_DMA_CTL_TOKEN		GENMASK(31, 16)
-+
-+#define MT_DMA_PPE_CPU_REASON		GENMASK(15, 11)
-+#define MT_DMA_PPE_ENTRY		GENMASK(30, 16)
-+#define MT_DMA_INFO_PPE_VLD 		BIT(31)
-+
- #define MT_DMA_HDR_LEN			4
- #define MT_RX_INFO_LEN			4
- #define MT_FCE_INFO_LEN			4
-diff --git a/mac80211.c b/mac80211.c
-index c84c9ef..32961b6 100644
---- a/mac80211.c
-+++ b/mac80211.c
-@@ -603,11 +603,14 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
- 		BIT(NL80211_IFTYPE_ADHOC);
- 
- 	spin_lock_init(&dev->token_lock);
-+	spin_lock_init(&dev->rx_token_lock);
- 	idr_init(&dev->token);
-+	idr_init(&dev->rx_token);
- 
- 	INIT_LIST_HEAD(&dev->wcid_list);
- 
- 	INIT_LIST_HEAD(&dev->txwi_cache);
-+	INIT_LIST_HEAD(&dev->rxwi_cache);
- 	dev->token_size = dev->drv->token_size;
- 
- 	for (i = 0; i < ARRAY_SIZE(dev->q_rx); i++)
-@@ -1304,7 +1307,10 @@ void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
- 
- 	while ((skb = __skb_dequeue(&dev->rx_skb[q])) != NULL) {
- 		mt76_check_sta(dev, skb);
--		mt76_rx_aggr_reorder(skb, &frames);
-+		if (mtk_wed_device_active(&dev->mmio.wed))
-+			__skb_queue_tail(&frames, skb);
-+		else
-+			mt76_rx_aggr_reorder(skb, &frames);
- 	}
- 
- 	mt76_rx_complete(dev, &frames, napi);
-diff --git a/mt76.h b/mt76.h
-index b86c835..627bcbf 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -20,6 +20,8 @@
- 
- #define MT_MCU_RING_SIZE	32
- #define MT_RX_BUF_SIZE		2048
-+#define MTK_WED_RX_PKT_SIZE	1700
-+
- #define MT_SKB_HEAD_LEN		256
- 
- #define MT_MAX_NON_AQL_PKT	16
-@@ -35,6 +37,7 @@
- 				 FIELD_PREP(MT_QFLAG_WED_TYPE, _type) | \
- 				 FIELD_PREP(MT_QFLAG_WED_RING, _n))
- #define MT_WED_Q_TX(_n)		__MT_WED_Q(MT76_WED_Q_TX, _n)
-+#define MT_WED_Q_RX(_n)		__MT_WED_Q(MT76_WED_Q_RX, _n)
- #define MT_WED_Q_TXFREE		__MT_WED_Q(MT76_WED_Q_TXFREE, 0)
- 
- struct mt76_dev;
-@@ -56,6 +59,7 @@ enum mt76_bus_type {
- enum mt76_wed_type {
- 	MT76_WED_Q_TX,
- 	MT76_WED_Q_TXFREE,
-+	MT76_WED_Q_RX,
- };
- 
- struct mt76_bus_ops {
-@@ -339,7 +343,10 @@ struct mt76_txwi_cache {
- 	struct list_head list;
- 	dma_addr_t dma_addr;
- 
--	struct sk_buff *skb;
-+	union {
-+		void *buf;
-+		struct sk_buff *skb;
-+	};
- };
- 
- struct mt76_rx_tid {
-@@ -439,7 +446,7 @@ struct mt76_driver_ops {
- 	bool (*rx_check)(struct mt76_dev *dev, void *data, int len);
- 
- 	void (*rx_skb)(struct mt76_dev *dev, enum mt76_rxq_id q,
--		       struct sk_buff *skb);
-+		       struct sk_buff *skb, u32 info);
- 
- 	void (*rx_poll_complete)(struct mt76_dev *dev, enum mt76_rxq_id q);
- 
-@@ -782,6 +789,7 @@ struct mt76_dev {
- 	struct ieee80211_hw *hw;
- 
- 	spinlock_t lock;
-+	spinlock_t wed_lock;
- 	spinlock_t cc_lock;
- 
- 	u32 cur_cc_bss_rx;
-@@ -807,6 +815,7 @@ struct mt76_dev {
- 	struct sk_buff_head rx_skb[__MT_RXQ_MAX];
- 
- 	struct list_head txwi_cache;
-+	struct list_head rxwi_cache;
- 	struct mt76_queue *q_mcu[__MT_MCUQ_MAX];
- 	struct mt76_queue q_rx[__MT_RXQ_MAX];
- 	const struct mt76_queue_ops *queue_ops;
-@@ -820,6 +829,9 @@ struct mt76_dev {
- 	u16 wed_token_count;
- 	u16 token_count;
- 	u16 token_size;
-+	u16 rx_token_size;
-+	spinlock_t rx_token_lock;
-+	struct idr rx_token;
- 
- 	wait_queue_head_t tx_wait;
- 	/* spinclock used to protect wcid pktid linked list */
-@@ -1361,6 +1373,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
- }
- 
- void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
-+void mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
-+struct mt76_txwi_cache *mt76_get_rxwi(struct mt76_dev *dev);
- void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
- 		      struct napi_struct *napi);
- void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
-@@ -1505,6 +1519,12 @@ struct mt76_txwi_cache *
- mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
- int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
- void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
-+int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
-+			struct mt76_txwi_cache *r, dma_addr_t phys);
-+void skb_trace(const struct sk_buff *skb, bool full_pkt);
-+
-+struct mt76_txwi_cache *
-+mt76_rx_token_release(struct mt76_dev *dev, int token);
- 
- static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
- {
-diff --git a/mt7603/dma.c b/mt7603/dma.c
-index 590cff9..2ff71c5 100644
---- a/mt7603/dma.c
-+++ b/mt7603/dma.c
-@@ -69,7 +69,7 @@ free:
- }
- 
- void mt7603_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb)
-+			 struct sk_buff *skb, u32 info)
- {
- 	struct mt7603_dev *dev = container_of(mdev, struct mt7603_dev, mt76);
- 	__le32 *rxd = (__le32 *)skb->data;
-diff --git a/mt7603/mt7603.h b/mt7603/mt7603.h
-index 0fd46d9..f2ce22a 100644
---- a/mt7603/mt7603.h
-+++ b/mt7603/mt7603.h
-@@ -244,7 +244,7 @@ int mt7603_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
- void mt7603_tx_complete_skb(struct mt76_dev *mdev, struct mt76_queue_entry *e);
- 
- void mt7603_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb);
-+			 struct sk_buff *skb, u32 info);
- void mt7603_rx_poll_complete(struct mt76_dev *mdev, enum mt76_rxq_id q);
- void mt7603_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
- int mt7603_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
-diff --git a/mt7615/mac.c b/mt7615/mac.c
-index 305bf18..4aed123 100644
---- a/mt7615/mac.c
-+++ b/mt7615/mac.c
-@@ -1666,7 +1666,7 @@ bool mt7615_rx_check(struct mt76_dev *mdev, void *data, int len)
- EXPORT_SYMBOL_GPL(mt7615_rx_check);
- 
- void mt7615_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb)
-+			 struct sk_buff *skb, u32 info)
- {
- 	struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
- 	__le32 *rxd = (__le32 *)skb->data;
-diff --git a/mt7615/mt7615.h b/mt7615/mt7615.h
-index 1080d20..91b3037 100644
---- a/mt7615/mt7615.h
-+++ b/mt7615/mt7615.h
-@@ -514,7 +514,7 @@ void mt7615_tx_worker(struct mt76_worker *w);
- void mt7615_tx_token_put(struct mt7615_dev *dev);
- bool mt7615_rx_check(struct mt76_dev *mdev, void *data, int len);
- void mt7615_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb);
-+			 struct sk_buff *skb, u32 info);
- void mt7615_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
- int mt7615_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 		       struct ieee80211_sta *sta);
-diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index afdd42f..1b01ef2 100644
---- a/mt76_connac_mcu.c
-+++ b/mt76_connac_mcu.c
-@@ -1192,6 +1192,7 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
- 			   int cmd, bool enable, bool tx)
- {
- 	struct mt76_wcid *wcid = (struct mt76_wcid *)params->sta->drv_priv;
-+	struct mtk_wed_device *wed = &dev->mmio.wed;
- 	struct wtbl_req_hdr *wtbl_hdr;
- 	struct tlv *sta_wtbl;
- 	struct sk_buff *skb;
-@@ -1212,6 +1213,8 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
- 	mt76_connac_mcu_wtbl_ba_tlv(dev, skb, params, enable, tx, sta_wtbl,
- 				    wtbl_hdr);
- 
-+	if (mtk_wed_device_active(wed) && wed->ver > MTK_WED_V1)
-+		mtk_wed_device_update_msg(wed, WED_WO_STA_REC, skb->data, skb->len);
- 	ret = mt76_mcu_skb_send_msg(dev, skb, cmd, true);
- 	if (ret)
- 		return ret;
-@@ -1222,6 +1225,8 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
- 
- 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, tx);
- 
-+	if (mtk_wed_device_active(wed) && wed->ver > MTK_WED_V1)
-+		mtk_wed_device_update_msg(wed, WED_WO_STA_REC, skb->data, skb->len);
- 	return mt76_mcu_skb_send_msg(dev, skb, cmd, true);
- }
- EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_ba);
-@@ -2651,6 +2656,7 @@ int mt76_connac_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
- 			    struct mt76_wcid *wcid, enum set_key_cmd cmd)
- {
- 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
-+	struct mtk_wed_device *wed = &dev->mmio.wed;
- 	struct sk_buff *skb;
- 	int ret;
- 
-@@ -2662,6 +2668,9 @@ int mt76_connac_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
- 	if (ret)
- 		return ret;
- 
-+	if (mtk_wed_device_active(wed) && wed->ver > MTK_WED_V1)
-+		mtk_wed_device_update_msg(wed, WED_WO_STA_REC, skb->data, skb->len);
-+
- 	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
- }
- EXPORT_SYMBOL_GPL(mt76_connac_mcu_add_key);
-diff --git a/mt76x02.h b/mt76x02.h
-index 849c264..49112ab 100644
---- a/mt76x02.h
-+++ b/mt76x02.h
-@@ -187,7 +187,7 @@ int mt76x02_set_rts_threshold(struct ieee80211_hw *hw, u32 val);
- void mt76x02_remove_hdr_pad(struct sk_buff *skb, int len);
- bool mt76x02_tx_status_data(struct mt76_dev *mdev, u8 *update);
- void mt76x02_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			  struct sk_buff *skb);
-+			  struct sk_buff *skb, u32 info);
- void mt76x02_rx_poll_complete(struct mt76_dev *mdev, enum mt76_rxq_id q);
- irqreturn_t mt76x02_irq_handler(int irq, void *dev_instance);
- void mt76x02_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
-diff --git a/mt76x02_txrx.c b/mt76x02_txrx.c
-index 3a31307..5d6c8f7 100644
---- a/mt76x02_txrx.c
-+++ b/mt76x02_txrx.c
-@@ -33,7 +33,7 @@ void mt76x02_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
- EXPORT_SYMBOL_GPL(mt76x02_tx);
- 
- void mt76x02_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			  struct sk_buff *skb)
-+			  struct sk_buff *skb, u32 info)
- {
- 	struct mt76x02_dev *dev = container_of(mdev, struct mt76x02_dev, mt76);
- 	void *rxwi = skb->data;
-diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 9a57ad8..6f6550f 100644
---- a/mt7915/dma.c
-+++ b/mt7915/dma.c
-@@ -365,7 +365,8 @@ static int mt7915_dma_enable(struct mt7915_dev *dev)
- 		wed_irq_mask |= MT_INT_TX_DONE_BAND0 | MT_INT_TX_DONE_BAND1;
- 		if (!is_mt7986(&dev->mt76))
- 			mt76_wr(dev, MT_INT_WED_MASK_CSR, wed_irq_mask);
--		mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask);
-+		else
-+			mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask);
- 		mtk_wed_device_start(&dev->mt76.mmio.wed, wed_irq_mask);
- 	}
- 
-@@ -377,6 +378,7 @@ static int mt7915_dma_enable(struct mt7915_dev *dev)
- int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- {
- 	struct mt76_dev *mdev = &dev->mt76;
-+	struct mtk_wed_device *wed = &mdev->mmio.wed;
- 	u32 wa_rx_base, wa_rx_idx;
- 	u32 hif1_ofs = 0;
- 	int ret;
-@@ -401,6 +403,9 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 				FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_TX1, 19) |
- 				FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_RX1,
- 					   wed_control_rx1));
-+			if(is_mt7915(mdev))
-+				mt76_rmw(dev, MT_WFDMA0_EXT0_CFG, MT_WFDMA0_EXT0_RXWB_KEEP,
-+					   MT_WFDMA0_EXT0_RXWB_KEEP);
- 		}
- 	} else {
- 		mt76_clear(dev, MT_WFDMA_HOST_CONFIG, MT_WFDMA_HOST_CONFIG_WED);
-@@ -473,6 +478,11 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 
- 	/* rx data queue for band0 */
- 	if (!dev->phy.band_idx) {
-+		if (mtk_wed_device_active(wed) && wed->ver > MTK_WED_V1) {
-+			dev->mt76.q_rx[MT_RXQ_MAIN].flags = MT_WED_Q_RX(MT7915_RXQ_BAND0);
-+			dev->mt76.rx_token_size += MT7915_RX_RING_SIZE;
-+		}
-+
- 		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_MAIN],
- 				       MT_RXQ_ID(MT_RXQ_MAIN),
- 				       MT7915_RX_RING_SIZE,
-@@ -503,6 +513,11 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 	}
- 
- 	if (dev->dbdc_support || dev->phy.band_idx) {
-+		if (mtk_wed_device_active(wed) && wed->ver > MTK_WED_V1) {
-+			dev->mt76.q_rx[MT_RXQ_BAND1].flags = MT_WED_Q_RX(MT7915_RXQ_BAND1);
-+			dev->mt76.rx_token_size += MT7915_RX_RING_SIZE;
-+		}
-+
- 		/* rx data queue for band1 */
- 		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_BAND1],
- 				       MT_RXQ_ID(MT_RXQ_BAND1),
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 20e5b70..eac4946 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -247,7 +247,7 @@ void mt7915_mac_enable_rtscts(struct mt7915_dev *dev,
- }
- 
- static int
--mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
-+mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb, enum mt76_rxq_id q, u32 info)
- {
- 	struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
- 	struct mt76_phy *mphy = &dev->mt76.phy;
-@@ -526,6 +526,27 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
- #endif
- 	} else {
- 		status->flag |= RX_FLAG_8023;
-+		if (msta && msta->vif) {
-+			struct mtk_wed_device *wed;
-+			int type;
-+
-+			wed = &dev->mt76.mmio.wed;
-+			type = FIELD_GET(MT_QFLAG_WED_TYPE, dev->mt76.q_rx[q].flags);
-+			if ((mtk_wed_device_active(wed) && type == MT76_WED_Q_RX) &&
-+			    (info & MT_DMA_INFO_PPE_VLD)) {
-+				struct ieee80211_vif *vif;
-+				u32 hash, reason;
-+
-+				vif = container_of((void *)msta->vif, struct ieee80211_vif,
-+						   drv_priv);
-+
-+				skb->dev = ieee80211_vif_to_netdev(vif);
-+				reason = FIELD_GET(MT_DMA_PPE_CPU_REASON, info);
-+				hash = FIELD_GET(MT_DMA_PPE_ENTRY, info);
-+
-+				mtk_wed_device_ppe_check(wed, skb, reason, hash);
-+			}
-+		}
- 	}
- 
- 	if (rxv && mode >= MT_PHY_TYPE_HE_SU && !(status->flag & RX_FLAG_8023))
-@@ -863,6 +884,80 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
- 	return MT_TXD_TXP_BUF_SIZE;
- }
- 
-+u32
-+mt7915_wed_init_rx_buf(struct mtk_wed_device *wed, int pkt_num)
-+{
-+	struct mtk_rxbm_desc *desc = wed->rx_buf_ring.desc;
-+	struct mt7915_dev *dev;
-+	dma_addr_t buf_phys;
-+	void *buf;
-+	int i, token, buf_size;
-+
-+	buf_size = SKB_DATA_ALIGN(NET_SKB_PAD + wed->wlan.rx_pkt_size) +
-+				  SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
-+
-+	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
-+	for (i = 0; i < pkt_num; i++) {
-+		struct mt76_txwi_cache *r = mt76_get_rxwi(&dev->mt76);
-+
-+		buf = page_frag_alloc(&wed->rx_page, buf_size, GFP_ATOMIC);
-+		if (!buf)
-+			return -ENOMEM;
-+
-+		buf_phys = dma_map_single(dev->mt76.dma_dev, buf, wed->wlan.rx_pkt_size,
-+					  DMA_TO_DEVICE);
-+
-+		if (unlikely(dma_mapping_error(dev->mt76.dev, buf_phys))) {
-+			skb_free_frag(buf);
-+			break;
-+		}
-+
-+		desc->buf0 = buf_phys;
-+
-+		token = mt76_rx_token_consume(&dev->mt76, buf, r, buf_phys);
-+
-+		desc->token |= FIELD_PREP(MT_DMA_CTL_TOKEN, token);
-+		desc++;
-+	}
-+
-+	return 0;
-+}
-+
-+void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed)
-+{
-+	struct mt76_txwi_cache *rxwi;
-+	struct mt7915_dev *dev;
-+	struct page *page;
-+	int token;
-+
-+	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
-+
-+	for(token = 0; token < dev->mt76.rx_token_size; token++) {
-+		rxwi = mt76_rx_token_release(&dev->mt76, token);
-+		if(!rxwi)
-+			continue;
-+
-+		if(!rxwi->buf)
-+			continue;
-+
-+		dma_unmap_single(dev->mt76.dma_dev, rxwi->dma_addr,
-+			 wed->wlan.rx_pkt_size, DMA_FROM_DEVICE);
-+		skb_free_frag(rxwi->buf);
-+		rxwi->buf = NULL;
-+
-+		mt76_put_rxwi(&dev->mt76, rxwi);
-+	}
-+
-+	if (wed->rx_page.va)
-+		return;
-+
-+	page = virt_to_page(wed->rx_page.va);
-+	__page_frag_cache_drain(page, wed->rx_page.pagecnt_bias);
-+	memset(&wed->rx_page, 0, sizeof(wed->rx_page));
-+
-+	return;
-+}
-+
- static void
- mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
- {
-@@ -1147,7 +1242,7 @@ bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len)
- }
- 
- void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb)
-+			 struct sk_buff *skb, u32 info)
- {
- 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
- 	__le32 *rxd = (__le32 *)skb->data;
-@@ -1181,7 +1276,7 @@ void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
- 		dev_kfree_skb(skb);
- 		break;
- 	case PKT_TYPE_NORMAL:
--		if (!mt7915_mac_fill_rx(dev, skb)) {
-+		if (!mt7915_mac_fill_rx(dev, skb, q, info)) {
- 			mt76_rx(&dev->mt76, q, skb);
- 			return;
- 		}
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index eb9343c..c11e575 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -1653,6 +1653,7 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
- 		       struct ieee80211_sta *sta, bool enable)
- {
- 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
-+	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
- 	struct mt7915_sta *msta;
- 	struct sk_buff *skb;
- 	int ret;
-@@ -1705,6 +1706,8 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
- 		return ret;
- 	}
- out:
-+	if (mtk_wed_device_active(wed) && wed->ver > MTK_WED_V1)
-+		mtk_wed_device_update_msg(wed, WED_WO_STA_REC, skb->data, skb->len);
- 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
- 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
- }
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index e45cd2d..1e22ec9 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -44,6 +44,7 @@ static const u32 mt7915_reg[] = {
- 	[SWDEF_BASE_ADDR]	= 0x41f200,
- 	[TXQ_WED_RING_BASE]	= 0xd7300,
- 	[RXQ_WED_RING_BASE]	= 0xd7410,
-+	[WED_RX_DATA_RING]	= 0xd4500,
- };
- 
- static const u32 mt7916_reg[] = {
-@@ -77,6 +78,7 @@ static const u32 mt7916_reg[] = {
- 	[SWDEF_BASE_ADDR]	= 0x411400,
- 	[TXQ_WED_RING_BASE]	= 0xd7300,
- 	[RXQ_WED_RING_BASE]	= 0xd7410,
-+	[WED_RX_DATA_RING]	= 0xd4540,
- };
- 
- static const u32 mt7986_reg[] = {
-@@ -110,6 +112,7 @@ static const u32 mt7986_reg[] = {
- 	[SWDEF_BASE_ADDR]	= 0x411400,
- 	[TXQ_WED_RING_BASE]	= 0x24420,
- 	[RXQ_WED_RING_BASE]	= 0x24520,
-+	[WED_RX_DATA_RING]	= 0x24540,
- };
- 
- static const u32 mt7915_offs[] = {
-@@ -605,7 +608,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 		struct pci_dev *pci_dev = pdev_ptr;
- 
- 		wed->wlan.pci_dev = pci_dev;
--		wed->wlan.bus_type = MTK_WED_BUS_PCIE;
-+		wed->wlan.bus_type = MTK_BUS_TYPE_PCIE;
- 		wed->wlan.base = (void __iomem *)ioremap(
- 				 pci_resource_start(pci_dev, 0),
- 				 pci_resource_len(pci_dev, 0));
-@@ -619,6 +622,10 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 				     MT_TXQ_WED_RING_BASE;
- 		wed->wlan.wpdma_txfree = pci_resource_start(pci_dev, 0) +
- 					 MT_RXQ_WED_RING_BASE;
-+		wed->wlan.wpdma_rx_glo = pci_resource_start(pci_dev, 0) +
-+					 MT_WPDMA_GLO_CFG;
-+		wed->wlan.wpdma_rx = pci_resource_start(pci_dev, 0) +
-+					 MT_RXQ_WED_DATA_RING_BASE;
- 		wed->wlan.phy_base = pci_resource_start(pci_dev, 0);
- 	} else {
- 		struct platform_device *plat_dev = pdev_ptr;
-@@ -628,27 +635,38 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 		if (!res)
- 			return -ENOMEM;
- 
--		wed->wlan.platform_dev = plat_dev;
--		wed->wlan.bus_type = MTK_WED_BUS_AXI;
-+		//wed->wlan.platform_dev = plat_dev;
-+		wed->wlan.bus_type = MTK_BUS_TYPE_AXI;
- 		wed->wlan.base = (void __iomem *)ioremap(res->start,
- 				 resource_size(res));
- 		wed->wlan.wpdma_int = res->start + MT_INT_SOURCE_CSR;
- 		wed->wlan.wpdma_mask = res->start + MT_INT_MASK_CSR;
- 		wed->wlan.wpdma_tx = res->start + MT_TXQ_WED_RING_BASE;
- 		wed->wlan.wpdma_txfree = res->start + MT_RXQ_WED_RING_BASE;
-+		wed->wlan.wpdma_rx_glo = res->start + MT_WPDMA_GLO_CFG;
-+		wed->wlan.wpdma_rx = res->start + MT_RXQ_WED_DATA_RING_BASE;
- 		wed->wlan.phy_base = res->start;
- 	}
--	wed->wlan.nbuf = 4096;
-+	wed->wlan.rx_pkt = MT7915_WED_RX_TOKEN_SIZE;
-+	wed->wlan.nbuf = 7168;
- 	wed->wlan.tx_tbit[0] = is_mt7915(&dev->mt76) ? 4 : 30;
- 	wed->wlan.tx_tbit[1] = is_mt7915(&dev->mt76) ? 5 : 31;
--	wed->wlan.txfree_tbit = is_mt7915(&dev->mt76) ? 1 : 2;
-+	wed->wlan.txfree_tbit = (is_mt7986(&dev->mt76) ? 2 : 1);
-+	wed->wlan.rx_tbit[0] = (is_mt7915(&dev->mt76) ? 16 : (is_mt7986(&dev->mt76) ? 22 : 18));
-+	wed->wlan.rx_tbit[1] = (is_mt7915(&dev->mt76) ? 17 : (is_mt7986(&dev->mt76) ? 23 : 19));
- 	wed->wlan.token_start = MT7915_TOKEN_SIZE - wed->wlan.nbuf;
- 	wed->wlan.init_buf = mt7915_wed_init_buf;
- 	wed->wlan.offload_enable = mt7915_mmio_wed_offload_enable;
- 	wed->wlan.offload_disable = mt7915_mmio_wed_offload_disable;
--	if (!is_mt7915(mdev))
-+	if (!is_mt7915(&dev->mt76))
- 		wed->wlan.wcid_512 = true;
- 
-+	wed->wlan.rx_nbuf = 65536;
-+	wed->wlan.rx_pkt_size = MTK_WED_RX_PKT_SIZE;
-+	wed->wlan.init_rx_buf = mt7915_wed_init_rx_buf;
-+	wed->wlan.release_rx_buf = mt7915_wed_release_rx_buf;
-+
-+	dev->mt76.rx_token_size = wed->wlan.rx_pkt;
- 	if (mtk_wed_device_attach(wed))
- 		return 0;
- 
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 06b98b7..6952825 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -81,6 +81,7 @@
- #define MT7915_MAX_STA_TWT_AGRT		8
- #define MT7915_MIN_TWT_DUR 64
- #define MT7915_MAX_QUEUE		(MT_RXQ_BAND2 + __MT_MCUQ_MAX + 2)
-+#define MT7915_WED_RX_TOKEN_SIZE	12288
- 
- struct mt7915_vif;
- struct mt7915_sta;
-@@ -560,7 +561,9 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
- irqreturn_t mt7915_irq_handler(int irq, void *dev_instance);
- u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif);
- u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
--
-+u32 mt7915_wed_init_rx_buf(struct mtk_wed_device *wed,
-+				int pkt_num);
-+void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed);
- int mt7915_register_device(struct mt7915_dev *dev);
- void mt7915_unregister_device(struct mt7915_dev *dev);
- void mt7915_eeprom_rebonding(struct mt7915_dev *dev);
-@@ -720,7 +723,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
- 			  struct mt76_tx_info *tx_info);
- void mt7915_tx_token_put(struct mt7915_dev *dev);
- void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb);
-+			 struct sk_buff *skb, u32 info);
- bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len);
- bool mt7915_wed_wds_check(struct mt76_dev *mdev, struct ieee80211_sta *sta);
- void mt7915_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
-diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 9b6266c..faaac08 100644
---- a/mt7915/regs.h
-+++ b/mt7915/regs.h
-@@ -43,6 +43,7 @@ enum reg_rev {
- 	SWDEF_BASE_ADDR,
- 	TXQ_WED_RING_BASE,
- 	RXQ_WED_RING_BASE,
-+	WED_RX_DATA_RING,
- 	__MT_REG_MAX,
- };
- 
-@@ -603,9 +604,13 @@ enum offs_rev {
- #define MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2	BIT(21)
- 
- #define MT_WFDMA0_RST_DTX_PTR		MT_WFDMA0(0x20c)
-+#define MT_WFDMA0_EXT0_CFG		MT_WFDMA0(0x2b0)
-+#define MT_WFDMA0_EXT0_RXWB_KEEP	BIT(10)
-+
- #define MT_WFDMA0_PRI_DLY_INT_CFG0	MT_WFDMA0(0x2f0)
- #define MT_WFDMA0_PRI_DLY_INT_CFG1	MT_WFDMA0(0x2f4)
- #define MT_WFDMA0_PRI_DLY_INT_CFG2	MT_WFDMA0(0x2f8)
-+#define MT_WPDMA_GLO_CFG		MT_WFDMA0(0x208)
- 
- /* WFDMA1 */
- #define MT_WFDMA1_BASE			0xd5000
-@@ -701,6 +706,7 @@ enum offs_rev {
- 
- #define MT_TXQ_WED_RING_BASE		__REG(TXQ_WED_RING_BASE)
- #define MT_RXQ_WED_RING_BASE		__REG(RXQ_WED_RING_BASE)
-+#define MT_RXQ_WED_DATA_RING_BASE	__REG(WED_RX_DATA_RING)
- 
- #define MT_INT_SOURCE_CSR		__REG(INT_SOURCE_CSR)
- #define MT_INT_MASK_CSR			__REG(INT_MASK_CSR)
-diff --git a/mt7921/mac.c b/mt7921/mac.c
-index 7b15193..ea6dd95 100644
---- a/mt7921/mac.c
-+++ b/mt7921/mac.c
-@@ -692,7 +692,7 @@ bool mt7921_rx_check(struct mt76_dev *mdev, void *data, int len)
- EXPORT_SYMBOL_GPL(mt7921_rx_check);
- 
- void mt7921_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb)
-+			 struct sk_buff *skb, u32 info)
- {
- 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
- 	__le32 *rxd = (__le32 *)skb->data;
-diff --git a/mt7921/mt7921.h b/mt7921/mt7921.h
-index d9d78f6..0c9924a 100644
---- a/mt7921/mt7921.h
-+++ b/mt7921/mt7921.h
-@@ -422,7 +422,7 @@ void mt7921_tx_worker(struct mt76_worker *w);
- void mt7921_tx_token_put(struct mt7921_dev *dev);
- bool mt7921_rx_check(struct mt76_dev *mdev, void *data, int len);
- void mt7921_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb);
-+			 struct sk_buff *skb, u32 info);
- void mt7921_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
- void mt7921_stats_work(struct work_struct *work);
- void mt7921_set_stream_he_caps(struct mt7921_phy *phy);
-diff --git a/tx.c b/tx.c
-index 8b33186..b812d06 100644
---- a/tx.c
-+++ b/tx.c
-@@ -778,3 +778,37 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
- 	return txwi;
- }
- EXPORT_SYMBOL_GPL(mt76_token_release);
-+
-+int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
-+			struct mt76_txwi_cache *r, dma_addr_t phys)
-+{
-+	int token;
-+
-+	spin_lock_bh(&dev->rx_token_lock);
-+
-+	token = idr_alloc(&dev->rx_token, r, 0, dev->rx_token_size, GFP_ATOMIC);
-+
-+	spin_unlock_bh(&dev->rx_token_lock);
-+
-+	r->buf = ptr;
-+	r->dma_addr = phys;
-+
-+	return token;
-+}
-+EXPORT_SYMBOL_GPL(mt76_rx_token_consume);
-+
-+struct mt76_txwi_cache *
-+mt76_rx_token_release(struct mt76_dev *dev, int token)
-+{
-+
-+	struct mt76_txwi_cache *rxwi;
-+
-+	spin_lock_bh(&dev->rx_token_lock);
-+
-+	rxwi = idr_remove(&dev->rx_token, token);
-+
-+	spin_unlock_bh(&dev->rx_token_lock);
-+
-+	return rxwi;
-+}
-+EXPORT_SYMBOL_GPL(mt76_rx_token_release);
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/3004-mt76-add-fill-receive-path-to-report-wed-idx.patch b/recipes-wifi/linux-mt76/files/patches/3004-mt76-add-fill-receive-path-to-report-wed-idx.patch
index 8b29384..9ac5937 100644
--- a/recipes-wifi/linux-mt76/files/patches/3004-mt76-add-fill-receive-path-to-report-wed-idx.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3004-mt76-add-fill-receive-path-to-report-wed-idx.patch
@@ -1,7 +1,7 @@
-From 5adc8023e3287208bb2ea04a20d0724b6264842d Mon Sep 17 00:00:00 2001
+From a48066bee44c4be864a2ec08724e6b5cd70e6d6c Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 19 May 2022 13:44:42 +0800
-Subject: [PATCH 3004/3011] mt76: add fill receive path to report wed idx
+Subject: [PATCH 3004/3010] mt76: add fill receive path to report wed idx
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -9,10 +9,10 @@
  1 file changed, 19 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index c061786..84b9001 100644
+index 8813e3c5..52aab3d1 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1521,6 +1521,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1560,6 +1560,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  
  	return 0;
  }
@@ -37,7 +37,7 @@
  #endif
  
  const struct ieee80211_ops mt7915_ops = {
-@@ -1572,5 +1590,6 @@ const struct ieee80211_ops mt7915_ops = {
+@@ -1612,5 +1630,6 @@ const struct ieee80211_ops mt7915_ops = {
  	.set_radar_background = mt7915_set_radar_background,
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
  	.net_fill_forward_path = mt7915_net_fill_forward_path,
diff --git a/recipes-wifi/linux-mt76/files/patches/3005-mt76-add-ser-spport-when-wed-on.patch b/recipes-wifi/linux-mt76/files/patches/3005-mt76-mt7915-add-ser-support-when-wed-on.patch
similarity index 74%
rename from recipes-wifi/linux-mt76/files/patches/3005-mt76-add-ser-spport-when-wed-on.patch
rename to recipes-wifi/linux-mt76/files/patches/3005-mt76-mt7915-add-ser-support-when-wed-on.patch
index 62ee299..4e29ecb 100644
--- a/recipes-wifi/linux-mt76/files/patches/3005-mt76-add-ser-spport-when-wed-on.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3005-mt76-mt7915-add-ser-support-when-wed-on.patch
@@ -1,24 +1,24 @@
-From 5362658103f2059a16ad626ab2f075b9279877e5 Mon Sep 17 00:00:00 2001
+From 4808621f5b154d3972f59ab2ee3a40d328a84ce0 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Thu, 28 Jul 2022 11:16:15 +0800
-Subject: [PATCH 3005/3011] mt76 add ser spport when wed on
+Date: Fri, 25 Nov 2022 14:07:46 +0800
+Subject: [PATCH 3005/3010] mt76: mt7915: add ser support when wed on
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
  dma.c           | 29 ++++++++++++++++++++---------
- dma.h           |  2 +-
+ dma.h           |  1 +
  mt76.h          |  1 +
  mt7915/dma.c    | 36 +++++++++++++++++++++++++++++++-----
- mt7915/mac.c    | 20 ++++++++++++++++++++
- mt7915/mmio.c   |  2 ++
+ mt7915/mac.c    | 18 ++++++++++++++++++
+ mt7915/mmio.c   |  3 +++
  mt7915/mt7915.h |  1 +
- 7 files changed, 76 insertions(+), 15 deletions(-)
+ 7 files changed, 75 insertions(+), 14 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index a8739eb..d63b02f 100644
+index 929816b7..8987c35f 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -169,7 +169,7 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
+@@ -165,7 +165,7 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
  	local_bh_enable();
  }
  
@@ -26,8 +26,8 @@
 +void
  mt76_free_pending_rxwi(struct mt76_dev *dev)
  {
- 	struct mt76_txwi_cache *r;
-@@ -183,6 +183,7 @@ mt76_free_pending_rxwi(struct mt76_dev *dev)
+ 	struct mt76_txwi_cache *t;
+@@ -178,6 +178,7 @@ mt76_free_pending_rxwi(struct mt76_dev *dev)
  	}
  	local_bh_enable();
  }
@@ -35,7 +35,7 @@
  
  static void
  mt76_dma_sync_idx(struct mt76_dev *dev, struct mt76_queue *q)
-@@ -624,14 +625,18 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -623,14 +624,18 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  	return frames;
  }
  
@@ -57,7 +57,7 @@
  	if (!mtk_wed_device_active(wed))
  		q->flags &= ~MT_QFLAG_WED;
  
-@@ -643,7 +648,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -642,7 +647,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
  
  	switch (type) {
  	case MT76_WED_Q_TX:
@@ -66,7 +66,7 @@
  		if (!ret)
  			q->wed_regs = wed->tx_ring[ring].reg_base;
  		break;
-@@ -659,7 +664,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -658,7 +663,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
  			q->wed_regs = wed->txfree_ring.reg_base;
  		break;
  	case MT76_WED_Q_RX:
@@ -75,7 +75,7 @@
  		if (!ret)
  			q->wed_regs = wed->rx_ring[ring].reg_base;
  		break;
-@@ -672,6 +677,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -671,6 +676,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
  	return 0;
  #endif
  }
@@ -83,7 +83,7 @@
  
  static int
  mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
-@@ -704,7 +710,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -697,7 +703,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  	if (!q->entry)
  		return -ENOMEM;
  
@@ -92,7 +92,7 @@
  	if (ret)
  		return ret;
  
-@@ -755,8 +761,13 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
+@@ -748,8 +754,13 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
  		q->desc[i].ctrl = cpu_to_le32(MT_DMA_CTL_DMA_DONE);
  
  	mt76_dma_rx_cleanup(dev, q);
@@ -109,21 +109,21 @@
  	if (!q->rx_head)
  		return;
 diff --git a/dma.h b/dma.h
-index 90370d1..083cbca 100644
+index 53c6ce25..4b9bc7f4 100644
 --- a/dma.h
 +++ b/dma.h
-@@ -58,5 +58,5 @@ enum mt76_mcu_evt_type {
+@@ -56,5 +56,6 @@ enum mt76_mcu_evt_type {
  int mt76_dma_rx_poll(struct napi_struct *napi, int budget);
  void mt76_dma_attach(struct mt76_dev *dev);
  void mt76_dma_cleanup(struct mt76_dev *dev);
--
 +int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset);
+ 
  #endif
 diff --git a/mt76.h b/mt76.h
-index 627bcbf..f22e96e 100644
+index bb0433b2..cca8986f 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1375,6 +1375,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1380,6 +1380,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  void mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  struct mt76_txwi_cache *mt76_get_rxwi(struct mt76_dev *dev);
@@ -132,10 +132,10 @@
  		      struct napi_struct *napi);
  void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 6f6550f..8edfa46 100644
+index 27b67800..03563919 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
-@@ -553,6 +553,7 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+@@ -562,6 +562,7 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
  int mt7915_dma_reset(struct mt7915_dev *dev, bool force)
  {
  	struct mt76_phy *mphy_ext = dev->mt76.phys[MT_BAND1];
@@ -143,7 +143,7 @@
  	int i;
  
  	/* clean up hw queues */
-@@ -572,28 +573,53 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force)
+@@ -581,28 +582,53 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force)
  	if (force)
  		mt7915_wfsys_reset(dev);
  
@@ -203,20 +203,11 @@
  }
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index eac4946..cbdabea 100644
+index d07bf790..f72e2bc2 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -948,6 +948,8 @@ void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed)
- 		mt76_put_rxwi(&dev->mt76, rxwi);
- 	}
- 
-+	mt76_free_pending_rxwi(&dev->mt76);
-+
- 	if (wed->rx_page.va)
- 		return;
- 
-@@ -958,6 +960,18 @@ void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed)
- 	return;
+@@ -895,6 +895,18 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
+ 	return MT_TXD_TXP_BUF_SIZE;
  }
  
 +void mt7915_wed_trigger_ser(struct mtk_wed_device *wed)
@@ -234,7 +225,7 @@
  static void
  mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  {
-@@ -1697,6 +1711,12 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1633,6 +1645,12 @@ void mt7915_mac_reset_work(struct work_struct *work)
  	if (!(READ_ONCE(dev->recovery.state) & MT_MCU_CMD_STOP_DMA))
  		return;
  
@@ -248,30 +239,38 @@
  	if (ext_phy)
  		ieee80211_stop_queues(ext_phy->hw);
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 1e22ec9..60b7886 100644
+index f348a779..f5dfee37 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -666,6 +666,8 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -617,6 +617,8 @@ static void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed)
+ 		mt76_put_rxwi(&dev->mt76, t);
+ 	}
+ 
++	mt76_free_pending_rxwi(&dev->mt76);
++
+ 	if (!wed->rx_buf_ring.rx_page.va)
+ 		return;
+ 
+@@ -775,6 +777,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  	wed->wlan.init_rx_buf = mt7915_wed_init_rx_buf;
  	wed->wlan.release_rx_buf = mt7915_wed_release_rx_buf;
- 
+ 	wed->wlan.update_wo_rx_stats = mt7915_mmio_wed_update_rx_stats;
 +	wed->wlan.ser_trigger = mt7915_wed_trigger_ser;
-+
- 	dev->mt76.rx_token_size = wed->wlan.rx_pkt;
- 	if (mtk_wed_device_attach(wed))
- 		return 0;
+ 
+ 	dev->mt76.rx_token_size = wed->wlan.rx_npkt;
+ 
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 6952825..36d1d86 100644
+index 6bc33f21..ec61941e 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -564,6 +564,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
- u32 mt7915_wed_init_rx_buf(struct mtk_wed_device *wed,
- 				int pkt_num);
- void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed);
+@@ -562,6 +562,7 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
+ irqreturn_t mt7915_irq_handler(int irq, void *dev_instance);
+ u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif);
+ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
 +void mt7915_wed_trigger_ser(struct mtk_wed_device *wed);
+ 
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
- void mt7915_eeprom_rebonding(struct mt7915_dev *dev);
 -- 
 2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-add-statistic-for-H-W-Rx-Path.patch b/recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-add-statistic-for-H-W-Rx-Path.patch
deleted file mode 100644
index f80fc8c..0000000
--- a/recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-add-statistic-for-H-W-Rx-Path.patch
+++ /dev/null
@@ -1,150 +0,0 @@
-From ca3fdfbb27f8d7c4c57164276e0220a7825fa61c Mon Sep 17 00:00:00 2001
-From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
-Date: Fri, 5 Aug 2022 13:58:11 -0700
-Subject: [PATCH 3006/3011] mt76: mt7915: add statistic for H/W Rx Path
-
-Change-Id: Id94d663f08e91c83d296bd57e5e9b65a505ae1c7
----
- mt76.h          |  4 ++++
- mt7915/mac.c    | 25 +++++++++++++++++++++++++
- mt7915/main.c   |  9 ++++++++-
- mt7915/mmio.c   | 17 +++++++++++++++++
- mt7915/mt7915.h |  2 ++
- 5 files changed, 56 insertions(+), 1 deletion(-)
-
-diff --git a/mt76.h b/mt76.h
-index f22e96e..8011d4c 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -278,6 +278,10 @@ struct mt76_sta_stats {
- 	u32 tx_packets;
- 	u32 tx_retries;
- 	u32 tx_failed;
-+	u64 rx_bytes;
-+	u32 rx_packets;
-+	u32 rx_error;
-+	u32 rx_drop;
- };
- 
- enum mt76_wcid_flags {
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index cbdabea..f1d15d8 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -972,6 +972,31 @@ void mt7915_wed_trigger_ser(struct mtk_wed_device *wed)
- 	return;
- }
- 
-+void mt7915_wed_update_wo_rxcnt(struct mtk_wed_device *wed,
-+				    struct wo_cmd_rxcnt_t *rxcnt)
-+{
-+	struct mt7915_dev *dev;
-+	struct mt76_wcid *wcid;
-+
-+	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
-+	if (rxcnt->wlan_idx >= mt7915_wtbl_size(dev))
-+		return;
-+
-+	rcu_read_lock();
-+
-+	wcid = rcu_dereference(dev->mt76.wcid[rxcnt->wlan_idx]);
-+	if (!wcid)
-+		goto out;
-+
-+	wcid->stats.rx_bytes += rxcnt->rx_byte_cnt;
-+	wcid->stats.rx_packets += rxcnt->rx_pkt_cnt;
-+	wcid->stats.rx_error += rxcnt->rx_err_cnt;
-+	wcid->stats.rx_drop += rxcnt->rx_drop_cnt;
-+
-+out:
-+	rcu_read_unlock();
-+}
-+
- static void
- mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
- {
-diff --git a/mt7915/main.c b/mt7915/main.c
-index 84b9001..4ac5259 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -1054,7 +1054,8 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
- 	struct rate_info *txrate = &msta->wcid.rate;
- 	struct rate_info rxrate = {};
- 
--	if (is_mt7915(&phy->dev->mt76) &&
-+	if ((is_mt7915(&phy->dev->mt76) ||
-+	    mtk_wed_device_active(&phy->dev->mt76.mmio.wed)) &&
- 	    !mt7915_mcu_get_rx_rate(phy, vif, sta, &rxrate)) {
- 		sinfo->rxrate = rxrate;
- 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
-@@ -1091,6 +1092,12 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
- 
- 		sinfo->tx_retries = msta->wcid.stats.tx_retries;
- 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
-+
-+		sinfo->rx_bytes = msta->wcid.stats.rx_bytes;
-+		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES64);
-+
-+		sinfo->rx_packets = msta->wcid.stats.rx_packets;
-+		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS);
- 	}
- 
- 	sinfo->ack_signal = (s8)msta->ack_signal;
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 60b7886..f3144d1 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -9,6 +9,7 @@
- #include "mt7915.h"
- #include "mac.h"
- #include "../trace.h"
-+#include "../mt76_connac_mcu.h"
- 
- static bool wed_enable = true;
- module_param(wed_enable, bool, 0644);
-@@ -668,6 +669,8 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 
- 	wed->wlan.ser_trigger = mt7915_wed_trigger_ser;
- 
-+	wed->wlan.update_wo_rxcnt = mt7915_wed_update_wo_rxcnt;
-+
- 	dev->mt76.rx_token_size = wed->wlan.rx_pkt;
- 	if (mtk_wed_device_attach(wed))
- 		return 0;
-@@ -680,6 +683,20 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 	if (ret)
- 		return ret;
- 
-+	if (wed->ver != 1) {
-+		struct {
-+		__le32 args[2];
-+		} req = {
-+			.args = {
-+				cpu_to_le32(1),
-+				cpu_to_le32(6),
-+			},
-+		};
-+
-+		mtk_wed_device_update_msg(wed, WED_WO_RXCNT_CTRL,
-+					  (void *)&req, sizeof(req));
-+	}
-+
- 	return 1;
- #else
- 	return 0;
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 36d1d86..7165273 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -565,6 +565,8 @@ u32 mt7915_wed_init_rx_buf(struct mtk_wed_device *wed,
- 				int pkt_num);
- void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed);
- void mt7915_wed_trigger_ser(struct mtk_wed_device *wed);
-+void mt7915_wed_update_wo_rxcnt(struct mtk_wed_device *wed,
-+				struct wo_cmd_rxcnt_t *rxcnt);
- int mt7915_register_device(struct mt7915_dev *dev);
- void mt7915_unregister_device(struct mt7915_dev *dev);
- void mt7915_eeprom_rebonding(struct mt7915_dev *dev);
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch b/recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch
similarity index 86%
rename from recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch
rename to recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch
index 16d9e8f..1d7c14b 100644
--- a/recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch
@@ -1,7 +1,8 @@
-From 8a932d446bb0da8b7aa4cc7ea8ed541e002cf015 Mon Sep 17 00:00:00 2001
+From f5eebefad9ec570614e439a2398049c307851c6f Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 2 Sep 2022 14:40:40 +0800
-Subject: [PATCH] mt76: mt7915: enable red per-band token drop for HW Path
+Subject: [PATCH 3006/3010] mt76: mt7915: enable red per-band token drop for HW
+ Path
 
 Limit the number of token used by each band. If a band uses too many token,
 it may hurt the throughput of the other band. The SW path can solve this
@@ -15,10 +16,10 @@
  3 files changed, 46 insertions(+), 11 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 16349c58..2ef353b2 100644
+index 03fd8c50..e6826c60 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2320,8 +2320,13 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2343,8 +2343,13 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  			mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
  					  MCU_WA_PARAM_WED_VERSION,
  					  wed->rev_id, 0);
@@ -32,7 +33,7 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
  		return ret;
-@@ -2331,12 +2336,7 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2354,12 +2359,7 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -46,7 +47,7 @@
  }
  
  int mt7915_mcu_init(struct mt7915_dev *dev)
-@@ -4162,6 +4162,35 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
+@@ -4429,6 +4429,35 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
  
  	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), wait_resp);
  }
@@ -82,7 +83,7 @@
  
  int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
  {
-@@ -4172,17 +4201,21 @@ int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
+@@ -4439,17 +4468,21 @@ int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
  	u32 red_type = enabled > 0 ? RED_BY_WA_ENABLE : RED_DISABLE;
  	__le32 req = cpu_to_le32(red_type);
  
@@ -109,10 +110,10 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 4ae8d532..14a0972b 100644
+index 5fcac90f..f9fb4137 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -271,6 +271,7 @@ enum {
+@@ -282,6 +282,7 @@ enum {
  	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
  #endif
  	MCU_WA_PARAM_WED_VERSION = 0x32,
@@ -121,10 +122,10 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 46670de4..d8765041 100644
+index ec61941e..3930c441 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -773,13 +773,14 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+@@ -774,13 +774,14 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  #endif
  int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value, s8 compensation);
  int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
diff --git a/recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch b/recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch
similarity index 95%
rename from recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch
rename to recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch
index 52f3e79..d8e90e4 100644
--- a/recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch
@@ -1,7 +1,7 @@
-From 2723beedc39c16ab67c7008779ebed4cf210e7ef Mon Sep 17 00:00:00 2001
+From 9f56f839a050fc71b8fd9a7b8eb0ed62615948db Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 22 Sep 2022 09:54:53 +0800
-Subject: [PATCH 3008/3011] mt76: mt7915: update mt7916 trinfo when hw path
+Subject: [PATCH 3007/3010] mt76: mt7915: update mt7916 trinfo when hw path
  enable
 
 ---
@@ -10,7 +10,7 @@
  2 files changed, 23 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mt7915_debug.h b/mt7915/mt7915_debug.h
-index ecdc02a..0a1ee80 100644
+index ecdc02ab..0a1ee808 100644
 --- a/mt7915/mt7915_debug.h
 +++ b/mt7915/mt7915_debug.h
 @@ -133,6 +133,8 @@ enum dbg_reg_rev {
@@ -57,7 +57,7 @@
  #define MT_DBG_INT_SOURCE_CSR			__DBG_REG(dev, DBG_INT_SOURCE_CSR)
  #define MT_DBG_INT_MASK_CSR			__DBG_REG(dev, DBG_INT_MASK_CSR)
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index facdd69..f25f9c6 100644
+index 8c8a3ca5..a75e6d1a 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -856,12 +856,22 @@ mt7986_show_host_dma_info(struct seq_file *s, struct mt7915_dev *dev)
diff --git a/recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-find-rx-token-by-physical-address.patch b/recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-find-rx-token-by-physical-address.patch
new file mode 100644
index 0000000..ff4656b
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-find-rx-token-by-physical-address.patch
@@ -0,0 +1,51 @@
+From b563403b2ca597970fda5a912433108b3b364349 Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Fri, 25 Nov 2022 14:32:35 +0800
+Subject: [PATCH 3008/3010] mt76: mt7915: find rx token by physical address
+
+The token id in RxDMAD may be incorrect when it is not the last frame due to
+WED HW bug. Lookup correct token id by physical address in sdp0.
+
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+---
+ dma.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/dma.c b/dma.c
+index 8987c35f..c3adec5f 100644
+--- a/dma.c
++++ b/dma.c
+@@ -372,10 +372,29 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+ 
+ 	if ((q->flags & MT_QFLAG_WED) &&
+ 	    FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
++		u32 id, find = 0;
+ 		u32 token = FIELD_GET(MT_DMA_CTL_TOKEN,
+ 				      le32_to_cpu(desc->buf1));
+-		struct mt76_txwi_cache *t = mt76_rx_token_release(dev, token);
++		struct mt76_txwi_cache *t;
++
++		if (*more) {
++			spin_lock_bh(&dev->rx_token_lock);
++
++			idr_for_each_entry(&dev->rx_token, t, id) {
++				if (t->dma_addr == le32_to_cpu(desc->buf0)) {
++					find = 1;
++					desc->buf1 = FIELD_PREP(MT_DMA_CTL_TOKEN, id);
++					token = id;
++					break;
++				}
++			}
++
++			spin_unlock_bh(&dev->rx_token_lock);
++			if (!find)
++				return NULL;
++		}
+ 
++		t = mt76_rx_token_release(dev, token);
+ 		if (!t)
+ 			return NULL;
+ 
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-drop-scatter-and-gather-frame.patch b/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-drop-scatter-and-gather-frame.patch
new file mode 100644
index 0000000..33f1251
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-drop-scatter-and-gather-frame.patch
@@ -0,0 +1,58 @@
+From 11e42a1e092b3eefd941813e96ec28df370fa1c7 Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Fri, 25 Nov 2022 14:37:58 +0800
+Subject: [PATCH 3009/3010] mt76: mt7915: drop scatter and gather frame
+
+The scatter and gather frame may be incorrect because WED and WO may
+send frames to host driver interleaved.
+
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+---
+ dma.c  | 5 +++++
+ dma.h  | 1 +
+ mt76.h | 1 +
+ 3 files changed, 7 insertions(+)
+
+diff --git a/dma.c b/dma.c
+index c3adec5f..bba64aef 100644
+--- a/dma.c
++++ b/dma.c
+@@ -416,6 +416,11 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+ 
+ 			*drop = !!(ctrl & (MT_DMA_CTL_TO_HOST_A |
+ 					   MT_DMA_CTL_DROP));
++
++			if (!(*more) && FIELD_GET(MT_DMA_CTL_WO, desc->buf1))
++				q->flags &= ~MT_QFLAG_WED_FRAG;
++			else
++				q->flags |= MT_QFLAG_WED_FRAG;
+ 		}
+ 	} else {
+ 		buf = e->buf;
+diff --git a/dma.h b/dma.h
+index 4b9bc7f4..ce8ac426 100644
+--- a/dma.h
++++ b/dma.h
+@@ -19,6 +19,7 @@
+ #define MT_DMA_CTL_TO_HOST_A		BIT(12)
+ #define MT_DMA_CTL_DROP			BIT(14)
+ #define MT_DMA_CTL_TOKEN		GENMASK(31, 16)
++#define MT_DMA_CTL_WO			BIT(8)
+ 
+ #define MT_DMA_PPE_CPU_REASON		GENMASK(15, 11)
+ #define MT_DMA_PPE_ENTRY		GENMASK(30, 16)
+diff --git a/mt76.h b/mt76.h
+index cca8986f..43594102 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -30,6 +30,7 @@
+ #define MT_QFLAG_WED_RING	GENMASK(1, 0)
+ #define MT_QFLAG_WED_TYPE	GENMASK(3, 2)
+ #define MT_QFLAG_WED		BIT(4)
++#define MT_QFLAG_WED_FRAG	BIT(5)
+ 
+ #define __MT_WED_Q(_type, _n)	(MT_QFLAG_WED | \
+ 				 FIELD_PREP(MT_QFLAG_WED_TYPE, _type) | \
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-find-rx-token-by-physical-address.patch b/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-find-rx-token-by-physical-address.patch
deleted file mode 100644
index 872c4bc..0000000
--- a/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-find-rx-token-by-physical-address.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 3a759e4352a6aebba5c39993c9042d37e25677e8 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Tue, 27 Sep 2022 16:34:26 +0800
-Subject: [PATCH 3009/3011] mt76: mt7915: find rx token by physical address
-
-The token id in RxDMAD may be incorrect when it is not the last frame due to
-WED HW bug. Lookup correct token id by physical address in sdp0.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- dma.c | 19 ++++++++++++++++++-
- 1 file changed, 18 insertions(+), 1 deletion(-)
-
-diff --git a/dma.c b/dma.c
-index d63b02f..a7a4538 100644
---- a/dma.c
-+++ b/dma.c
-@@ -380,11 +380,28 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
- 
- 	type = FIELD_GET(MT_QFLAG_WED_TYPE, q->flags);
- 	if (mtk_wed_device_active(wed) && type == MT76_WED_Q_RX) {
--		u32 token;
-+		u32 token, id, find = 0;
- 		struct mt76_txwi_cache *r;
- 
- 		token = FIELD_GET(MT_DMA_CTL_TOKEN, desc->buf1);
- 
-+		if (*more) {
-+			spin_lock_bh(&dev->rx_token_lock);
-+
-+			idr_for_each_entry(&dev->rx_token, r, id) {
-+				if (r->dma_addr == le32_to_cpu(desc->buf0)) {
-+					find = 1;
-+					desc->buf1 = FIELD_PREP(MT_DMA_CTL_TOKEN, id);
-+					token = id;
-+					break;
-+				}
-+			}
-+
-+			spin_unlock_bh(&dev->rx_token_lock);
-+			if (!find)
-+				return NULL;
-+
-+		}
- 		r = mt76_rx_token_release(dev, token);
- 		if (!r)
- 			return NULL;
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/3011-mt76-HW-ATF-support-for-mt7986.patch b/recipes-wifi/linux-mt76/files/patches/3010-mt76-HW-ATF-support-for-mt7986.patch
similarity index 96%
rename from recipes-wifi/linux-mt76/files/patches/3011-mt76-HW-ATF-support-for-mt7986.patch
rename to recipes-wifi/linux-mt76/files/patches/3010-mt76-HW-ATF-support-for-mt7986.patch
index 86b01bb..2386682 100644
--- a/recipes-wifi/linux-mt76/files/patches/3011-mt76-HW-ATF-support-for-mt7986.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3010-mt76-HW-ATF-support-for-mt7986.patch
@@ -1,7 +1,7 @@
-From 49dd3f3791d2b28bc28225d09c6455722d96489d Mon Sep 17 00:00:00 2001
+From 2f63aedb6f87a4f46a5af6a98093c7c87f6f8cd1 Mon Sep 17 00:00:00 2001
 From: Lian Chen <lian.chen@mediatek.com>
 Date: Mon, 7 Nov 2022 14:47:44 +0800
-Subject: [PATCH 3011/3011] mt76: HW ATF support for mt7986
+Subject: [PATCH 3010/3010] mt76: HW ATF support for mt7986
 
 Signed-off-by: Lian Chen <lian.chen@mediatek.com>
 ---
@@ -16,10 +16,10 @@
  mode change 100644 => 100755 mt7915/init.c
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index a368b65..2cb498f 100644
+index 3b789d75..eb17a015 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1122,6 +1122,7 @@ enum {
+@@ -1148,6 +1148,7 @@ enum {
  	MCU_EXT_CMD_THERMAL_CTRL = 0x2c,
  	MCU_EXT_CMD_WTBL_UPDATE = 0x32,
  	MCU_EXT_CMD_SET_DRR_CTRL = 0x36,
@@ -27,7 +27,7 @@
  	MCU_EXT_CMD_SET_RDD_CTRL = 0x3a,
  	MCU_EXT_CMD_ATE_CTRL = 0x3d,
  	MCU_EXT_CMD_PROTECT_CTRL = 0x3e,
-@@ -1131,6 +1132,7 @@ enum {
+@@ -1157,6 +1158,7 @@ enum {
  	MCU_EXT_CMD_MUAR_UPDATE = 0x48,
  	MCU_EXT_CMD_BCN_OFFLOAD = 0x49,
  	MCU_EXT_CMD_RX_AIRTIME_CTRL = 0x4a,
@@ -36,7 +36,7 @@
  	MCU_EXT_CMD_EFUSE_FREE_BLOCK = 0x4f,
  	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 2140703..85468cd 100644
+index 092d8434..79a29ee8 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -12,6 +12,10 @@
@@ -457,7 +457,7 @@
  static int
  mt7915_radar_trigger(void *data, u64 val)
  {
-@@ -1107,6 +1511,7 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+@@ -1120,6 +1524,7 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
  	debugfs_create_devm_seqfile(dev->mt76.dev, "twt_stats", dir,
  				    mt7915_twt_stats);
  	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
@@ -468,10 +468,10 @@
 diff --git a/mt7915/init.c b/mt7915/init.c
 old mode 100644
 new mode 100755
-index 039a5b0..5a7fdb5
+index 8f32b6a8..f62a9dae
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -473,10 +473,46 @@ mt7915_mac_init_band(struct mt7915_dev *dev, u8 band)
+@@ -476,10 +476,46 @@ mt7915_mac_init_band(struct mt7915_dev *dev, u8 band)
  	mt76_rmw(dev, MT_WTBLOFF_TOP_RSCR(band), mask, set);
  }
  
@@ -518,7 +518,7 @@
  
  	/* config pse qid6 wfdma port selection */
  	if (!is_mt7915(&dev->mt76) && dev->hif2)
-@@ -501,6 +537,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
+@@ -504,6 +540,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
  		i = dev->mt76.led_pin ? MT_LED_GPIO_MUX3 : MT_LED_GPIO_MUX2;
  		mt76_rmw_field(dev, i, MT_LED_GPIO_SEL_MASK, 4);
  	}
@@ -529,7 +529,7 @@
  
  int mt7915_txbf_init(struct mt7915_dev *dev)
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 4ac5259..6c910cf 100644
+index 52aab3d1..ece28aa0 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -195,6 +195,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
@@ -551,7 +551,7 @@
  out:
  	mutex_unlock(&dev->mt76.mutex);
  
-@@ -685,6 +690,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -683,6 +688,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	bool ext_phy = mvif->phy != &dev->phy;
@@ -559,7 +559,7 @@
  #ifdef CONFIG_MTK_VENDOR
  	struct mt7915_phy *phy;
  #endif
-@@ -739,6 +745,16 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -737,6 +743,16 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  		mt7915_mcu_set_mimo(phy, 0);
  	}
  #endif
@@ -577,10 +577,10 @@
  }
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index ad2d6a3..4728d84 100644
+index e6826c60..4d3def95 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3323,6 +3323,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
+@@ -3428,6 +3428,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
  				 &req, sizeof(req), false);
  }
  
@@ -753,10 +753,10 @@
  {
  	struct {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 8567415..872b0e7 100644
+index 3930c441..890e329e 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -131,6 +131,58 @@ struct mt7915_twt_flow {
+@@ -132,6 +132,58 @@ struct mt7915_twt_flow {
  
  DECLARE_EWMA(avg_signal, 10, 8)
  
@@ -815,7 +815,7 @@
  struct mt7915_sta {
  	struct mt76_wcid wcid; /* must be first */
  
-@@ -152,6 +204,7 @@ struct mt7915_sta {
+@@ -153,6 +205,7 @@ struct mt7915_sta {
  		u8 flowid_mask;
  		struct mt7915_twt_flow flow[MT7915_MAX_STA_TWT_AGRT];
  	} twt;
@@ -823,7 +823,7 @@
  };
  
  struct mt7915_vif_cap {
-@@ -467,6 +520,8 @@ struct mt7915_dev {
+@@ -468,6 +521,8 @@ struct mt7915_dev {
  	} dbg;
  	const struct mt7915_dbg_reg_desc *dbg_reg;
  #endif
@@ -832,7 +832,7 @@
  };
  
  enum {
-@@ -499,6 +554,15 @@ enum mt7915_rdd_cmd {
+@@ -500,6 +555,15 @@ enum mt7915_rdd_cmd {
  	RDD_IRQ_OFF,
  };
  
@@ -848,7 +848,7 @@
  static inline struct mt7915_phy *
  mt7915_hw_phy(struct ieee80211_hw *hw)
  {
-@@ -630,6 +694,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
+@@ -627,6 +691,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
  int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
  			      u8 en);
  int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
@@ -860,7 +860,7 @@
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
  int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index f25f9c6..c638d29 100644
+index a75e6d1a..900b6b57 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -1301,7 +1301,6 @@ static EMPTY_QUEUE_INFO_T ple_txcmd_queue_empty_info[] = {
diff --git a/recipes-wifi/linux-mt76/files/patches/3010-mt76-mt7915-drop-scatter-and-gather-frame.patch b/recipes-wifi/linux-mt76/files/patches/3010-mt76-mt7915-drop-scatter-and-gather-frame.patch
deleted file mode 100644
index ef6e990..0000000
--- a/recipes-wifi/linux-mt76/files/patches/3010-mt76-mt7915-drop-scatter-and-gather-frame.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From 50d41085e1f54e1cb308bd615052aaf5e317c8c5 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Wed, 28 Sep 2022 18:52:54 +0800
-Subject: [PATCH 3010/3011] mt76: mt7915: drop scatter and gather frame
-
-The scatter and gather frame may be incorrect because WED and WO may
-send frames to host driver interleaved.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- dma.c  | 9 +++++++++
- dma.h  | 1 +
- mt76.h | 1 +
- 3 files changed, 11 insertions(+)
-
-diff --git a/dma.c b/dma.c
-index a7a4538..c106ae4 100644
---- a/dma.c
-+++ b/dma.c
-@@ -419,6 +419,15 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
- 
- 		if (desc->ctrl & (MT_DMA_CTL_TO_HOST_A | MT_DMA_CTL_DROP))
- 			*drop = true;
-+
-+		if (*more || (q->flags & MT_QFLAG_WED_FRAG)) {
-+			*drop = true;
-+
-+			if (!(*more) && FIELD_GET(MT_DMA_CTL_WO, desc->buf1))
-+				q->flags &= ~MT_QFLAG_WED_FRAG;
-+			else
-+				q->flags |= MT_QFLAG_WED_FRAG;
-+		}
- 	} else {
- 		buf_addr = e->dma_addr[0];
- 		e->buf = NULL;
-diff --git a/dma.h b/dma.h
-index 083cbca..221fcc8 100644
---- a/dma.h
-+++ b/dma.h
-@@ -21,6 +21,7 @@
- #define MT_DMA_CTL_DROP			BIT(14)
- 
- #define MT_DMA_CTL_TOKEN		GENMASK(31, 16)
-+#define MT_DMA_CTL_WO			BIT(8)
- 
- #define MT_DMA_PPE_CPU_REASON		GENMASK(15, 11)
- #define MT_DMA_PPE_ENTRY		GENMASK(30, 16)
-diff --git a/mt76.h b/mt76.h
-index 8011d4c..9b22551 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -32,6 +32,7 @@
- #define MT_QFLAG_WED_RING	GENMASK(1, 0)
- #define MT_QFLAG_WED_TYPE	GENMASK(3, 2)
- #define MT_QFLAG_WED		BIT(4)
-+#define MT_QFLAG_WED_FRAG	BIT(5)
- 
- #define __MT_WED_Q(_type, _n)	(MT_QFLAG_WED | \
- 				 FIELD_PREP(MT_QFLAG_WED_TYPE, _type) | \
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/patches.inc b/recipes-wifi/linux-mt76/files/patches/patches.inc
index fcc6800..cf04d5e 100644
--- a/recipes-wifi/linux-mt76/files/patches/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches/patches.inc
@@ -31,13 +31,12 @@
     file://1127-mt76-support-on-off-SW-ACI-through-debugfs.patch \
     file://3001-mt76-add-wed-tx-support.patch \
     file://3002-mt76-mt7915-add-wed-tx-wds-support-on-mt7986.patch \
-    file://3003-mt76-add-wed-rx-support.patch \
+    file://3003-mt76-add-wed-rx-copy-skb.patch \
     file://3004-mt76-add-fill-receive-path-to-report-wed-idx.patch \
-    file://3005-mt76-add-ser-spport-when-wed-on.patch \
-    file://3006-mt76-mt7915-add-statistic-for-H-W-Rx-Path.patch \
-    file://3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch \
-    file://3008-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch \
-    file://3009-mt76-mt7915-find-rx-token-by-physical-address.patch \
-    file://3010-mt76-mt7915-drop-scatter-and-gather-frame.patch \
-    file://3011-mt76-HW-ATF-support-for-mt7986.patch \
+    file://3005-mt76-mt7915-add-ser-support-when-wed-on.patch \
+    file://3006-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch \
+    file://3007-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch \
+    file://3008-mt76-mt7915-find-rx-token-by-physical-address.patch \
+    file://3009-mt76-mt7915-drop-scatter-and-gather-frame.patch \
+    file://3010-mt76-HW-ATF-support-for-mt7986.patch \
     "
diff --git a/recipes-wifi/linux-mt76/mt76.inc b/recipes-wifi/linux-mt76/mt76.inc
index e15be16..1f7156c 100644
--- a/recipes-wifi/linux-mt76/mt76.inc
+++ b/recipes-wifi/linux-mt76/mt76.inc
@@ -1 +1 @@
-SRCREV ?= "4bf2607362fc64fc4cb7d662feb736b7536c0811"
\ No newline at end of file
+SRCREV ?= "daae6ca5d81fceed2dbbfcfca49be3f0727386e3"
diff --git a/recipes-wifi/wpa-supplicant/files/patches/99900-hostapd-mtk-Add-hostapd_neighbor_count-and-hostapd_neighbor_ins.patch b/recipes-wifi/wpa-supplicant/files/patches/99900-hostapd-mtk-Add-hostapd_neighbor_count-and-hostapd_neighbor_ins.patch
deleted file mode 100644
index e8e8b8c..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches/99900-hostapd-mtk-Add-hostapd_neighbor_count-and-hostapd_neighbor_ins.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-From 194a2405c98852358de25d96cb9d1c7c56ea4bdc Mon Sep 17 00:00:00 2001
-From: "howard.hsu" <howard-yh.hsu@mediatek.com>
-Date: Wed, 19 Jan 2022 19:18:07 +0800
-Subject: [PATCH 99900/99917] Add hostapd_neighbor_count() and
- hostapd_neighbor_insert_buffer ()
-
-The first function can count the number of neighbor report in neighbore report
-database. The second can iterate neighbor report database to build up neighbor
-report data.
----
- src/ap/neighbor_db.c | 32 ++++++++++++++++++++++++++++++++
- src/ap/neighbor_db.h |  3 +++
- 2 files changed, 35 insertions(+)
-
-diff --git a/src/ap/neighbor_db.c b/src/ap/neighbor_db.c
-index 52f25eb..c121390 100644
---- a/src/ap/neighbor_db.c
-+++ b/src/ap/neighbor_db.c
-@@ -89,6 +89,38 @@ int hostapd_neighbor_show(struct hostapd_data *hapd, char *buf, size_t buflen)
- }
- 
- 
-+int hostapd_neighbor_count(struct hostapd_data *hapd)
-+{
-+	struct hostapd_neighbor_entry *nr;
-+	int count = 0;
-+
-+	dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
-+			 list) {
-+		count++;
-+	}
-+	return count;
-+}
-+
-+
-+int hostapd_neighbor_insert_buffer(struct hostapd_data *hapd, char *buf,
-+        size_t buflen)
-+{
-+	struct hostapd_neighbor_entry *nr;
-+	char *pos = buf;
-+
-+	dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
-+			 list) {
-+		/* For neighbor report IE, we only need bssid and nr*/
-+		*pos++ = WLAN_EID_NEIGHBOR_REPORT;
-+		*pos++ = wpabuf_len(nr->nr);
-+		os_memcpy(pos, wpabuf_head(nr->nr), wpabuf_len(nr->nr));
-+		pos += wpabuf_len(nr->nr);
-+	}
-+
-+	return pos - buf;
-+}
-+
-+
- static void hostapd_neighbor_clear_entry(struct hostapd_neighbor_entry *nr)
- {
- 	wpabuf_free(nr->nr);
-diff --git a/src/ap/neighbor_db.h b/src/ap/neighbor_db.h
-index 992671b..1ae194d 100644
---- a/src/ap/neighbor_db.h
-+++ b/src/ap/neighbor_db.h
-@@ -24,4 +24,7 @@ int hostapd_neighbor_remove(struct hostapd_data *hapd, const u8 *bssid,
- 			    const struct wpa_ssid_value *ssid);
- void hostapd_free_neighbor_db(struct hostapd_data *hapd);
- 
-+int hostapd_neighbor_count(struct hostapd_data *hapd);
-+int hostapd_neighbor_insert_buffer(struct hostapd_data *hapd, char *buf,
-+        size_t buflen);
- #endif /* NEIGHBOR_DB_H */
--- 
-2.36.1
-
diff --git a/recipes-wifi/wpa-supplicant/files/patches/99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch b/recipes-wifi/wpa-supplicant/files/patches/99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch
new file mode 100644
index 0000000..28af8ef
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches/99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch
@@ -0,0 +1,475 @@
+From af1bd5256cc764fb222f9809996851ff3d879699 Mon Sep 17 00:00:00 2001
+From: "howard.hsu" <howard-yh.hsu@mediatek.com>
+Date: Wed, 19 Jan 2022 19:18:07 +0800
+Subject: [PATCH 99900/99909] hostapd: mtk: Add neighbor report and BSS
+ Termination for MBO certification
+
+1. Add hostapd_neighbor_count() and hostapd_neighbor_insert_buffer ()
+The first function can count the number of neighbor report in neighbore report
+database. The second can iterate neighbor report database to build up neighbor
+report data.
+
+2. Support including neighbor report elements in ANQP response
+3. Support including neignbor report elements in BTM response
+4. Support configuring BSS Termination TSF by using hostapd_cli command
+5. Disable interface if BSS Termination TSF is set
+6. Add set_send_disassoc_frame_timer() to send disassociate frame
+Function set_disassoc_timer() may fail if key was deleted first. This new
+function will not ask to delete key as set_disassoc_timer() did.
+7. Support including neighbor report elements in BTM request
+8. Add hostapd_neighbor_set_own_report_pref()
+9. Add hostapd_neighbor_set_pref_by_non_pref_chan()
+---
+ hostapd/ctrl_iface.c   |   5 ++
+ src/ap/ap_config.c     |   1 +
+ src/ap/ap_config.h     |   1 +
+ src/ap/ctrl_iface_ap.c |  19 ++++++-
+ src/ap/gas_serv.c      |  29 ++++++++++
+ src/ap/gas_serv.h      |   2 +
+ src/ap/neighbor_db.c   | 119 +++++++++++++++++++++++++++++++++++++++++
+ src/ap/neighbor_db.h   |   9 ++++
+ src/ap/wnm_ap.c        |  72 +++++++++++++++++++++++--
+ 9 files changed, 252 insertions(+), 5 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index a258492..c2a2822 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -1338,6 +1338,11 @@ static int hostapd_ctrl_iface_set(struct hostapd_data *hapd, char *cmd)
+ #endif /* CONFIG_DPP */
+ 	} else if (os_strcasecmp(cmd, "setband") == 0) {
+ 		ret = hostapd_ctrl_iface_set_band(hapd, value);
++	} else if (os_strcasecmp(cmd, "bss_termination_tsf") == 0) {
++		int termination_sec = atoi(value);
++		hapd->conf->bss_termination_tsf = termination_sec;
++		wpa_printf(MSG_DEBUG, "BSS Termination TSF: value = %d",
++                termination_sec);
+ 	} else {
+ 		ret = hostapd_set_iface(hapd->iconf, hapd->conf, cmd, value);
+ 		if (ret)
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index d7a0c7c..4a20eb4 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -170,6 +170,7 @@ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss)
+ 	/* comeback after 10 TUs */
+ 	bss->pasn_comeback_after = 10;
+ #endif /* CONFIG_PASN */
++	bss->bss_termination_tsf = 0;
+ }
+ 
+ 
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index ed3bec7..3f68e76 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -557,6 +557,7 @@ struct hostapd_bss_config {
+ 	int wnm_sleep_mode;
+ 	int wnm_sleep_mode_no_keys;
+ 	int bss_transition;
++	unsigned int bss_termination_tsf;
+ 
+ 	/* IEEE 802.11u - Interworking */
+ 	int interworking;
+diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
+index 96209ce..18bae5c 100644
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -1203,6 +1203,10 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+ 			wpa_printf(MSG_DEBUG, "Invalid bss_term data");
+ 			return -1;
+ 		}
++		if (hapd->conf->bss_termination_tsf) {
++			WPA_PUT_LE64(&bss_term_dur[2], hapd->conf->bss_termination_tsf);
++		}
++
+ 		end++;
+ 		WPA_PUT_LE16(&bss_term_dur[10], atoi(end));
+ 	}
+@@ -1229,14 +1233,25 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+ 		req_mode |= WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT;
+ 	}
+ 
+-	if (os_strstr(cmd, " pref=1"))
++	if (os_strstr(cmd, " pref=1")) {
+ 		req_mode |= WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED;
++		if (nei_len == 0) {
++			// Add neigibor report from neighbor report db to nei_rep buffer
++			nei_len = hostapd_neighbor_insert_buffer (hapd, nei_rep, 1000);
++		}
++	}
+ 	if (os_strstr(cmd, " abridged=1"))
+ 		req_mode |= WNM_BSS_TM_REQ_ABRIDGED;
+-	if (os_strstr(cmd, " disassoc_imminent=1"))
++	if (os_strstr(cmd, " disassoc_imminent=1")) {
+ 		req_mode |= WNM_BSS_TM_REQ_DISASSOC_IMMINENT;
++		/* Set own BSS neighbor report preference value as 0 */
++		hostapd_neighbor_set_own_report_pref(hapd, nei_rep, nei_len, 0);
++	}
++
+ 
+ #ifdef CONFIG_MBO
++	hostapd_neighbor_set_pref_by_non_pref_chan(hapd, sta, nei_rep, nei_len);
++
+ 	pos = os_strstr(cmd, "mbo=");
+ 	if (pos) {
+ 		unsigned int mbo_reason, cell_pref, reassoc_delay;
+diff --git a/src/ap/gas_serv.c b/src/ap/gas_serv.c
+index 90f1577..5845ff8 100644
+--- a/src/ap/gas_serv.c
++++ b/src/ap/gas_serv.c
+@@ -19,6 +19,7 @@
+ #include "dpp_hostapd.h"
+ #include "sta_info.h"
+ #include "gas_serv.h"
++#include "neighbor_db.h"
+ 
+ 
+ #ifdef CONFIG_DPP
+@@ -369,6 +370,24 @@ static void anqp_add_network_auth_type(struct hostapd_data *hapd,
+ 	}
+ }
+ 
++static void anqp_add_neighbor_report(struct hostapd_data *hapd,
++				       struct wpabuf *buf)
++{
++	struct hostapd_neighbor_entry *nr;
++	u8 *len_pos = gas_anqp_add_element(buf, ANQP_NEIGHBOR_REPORT);
++	if (dl_list_empty(&hapd->nr_db)) {
++		wpabuf_put_le16(buf, 0);
++	}
++	else {
++		dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry, list ) {
++			wpabuf_put_u8(buf, WLAN_EID_NEIGHBOR_REPORT);
++			wpabuf_put_u8(buf, wpabuf_len(nr->nr));
++			wpabuf_put_buf(buf, nr->nr);
++		}
++	}
++	gas_anqp_set_element_len(buf, len_pos);
++}
++
+ 
+ static void anqp_add_roaming_consortium(struct hostapd_data *hapd,
+ 					struct wpabuf *buf)
+@@ -986,6 +1005,9 @@ gas_serv_build_gas_resp_payload(struct hostapd_data *hapd,
+ 		len += 1000;
+ 	if (request & ANQP_REQ_ICON_REQUEST)
+ 		len += 65536;
++    if (request & ANQP_REQ_NEIGHBOR_REPORT) {
++        len += (40 * hostapd_neighbor_count(hapd));
++    }
+ #ifdef CONFIG_FILS
+ 	if (request & ANQP_FILS_REALM_INFO)
+ 		len += 2 * dl_list_len(&hapd->conf->fils_realms);
+@@ -1028,6 +1050,8 @@ gas_serv_build_gas_resp_payload(struct hostapd_data *hapd,
+ 		anqp_add_elem(hapd, buf, ANQP_TDLS_CAPABILITY);
+ 	if (request & ANQP_REQ_EMERGENCY_NAI)
+ 		anqp_add_elem(hapd, buf, ANQP_EMERGENCY_NAI);
++	if (request & ANQP_REQ_NEIGHBOR_REPORT)
++		anqp_add_neighbor_report(hapd, buf);
+ 
+ 	for (i = 0; i < num_extra_req; i++) {
+ #ifdef CONFIG_FILS
+@@ -1172,6 +1196,11 @@ static void rx_anqp_query_list_id(struct hostapd_data *hapd, u16 info_id,
+ 			     "Emergency NAI",
+ 			     get_anqp_elem(hapd, info_id) != NULL, qi);
+ 		break;
++	case ANQP_NEIGHBOR_REPORT:
++		set_anqp_req(ANQP_REQ_NEIGHBOR_REPORT,
++			     "Neighbor Report",
++			     get_anqp_elem(hapd, info_id) != NULL, qi);
++		break;
+ 	default:
+ #ifdef CONFIG_FILS
+ 		if (info_id == ANQP_FILS_REALM_INFO &&
+diff --git a/src/ap/gas_serv.h b/src/ap/gas_serv.h
+index 1528af4..d0241f2 100644
+--- a/src/ap/gas_serv.h
++++ b/src/ap/gas_serv.h
+@@ -40,6 +40,8 @@
+ 	(1 << (ANQP_TDLS_CAPABILITY - ANQP_QUERY_LIST))
+ #define ANQP_REQ_EMERGENCY_NAI \
+ 	(1 << (ANQP_EMERGENCY_NAI - ANQP_QUERY_LIST))
++#define ANQP_REQ_NEIGHBOR_REPORT \
++	(1 << (ANQP_NEIGHBOR_REPORT - ANQP_QUERY_LIST))
+ /*
+  * First 15 Hotspot 2.0 vendor specific ANQP-elements can be included in the
+  * optimized bitmap.
+diff --git a/src/ap/neighbor_db.c b/src/ap/neighbor_db.c
+index 52f25eb..9254d09 100644
+--- a/src/ap/neighbor_db.c
++++ b/src/ap/neighbor_db.c
+@@ -89,6 +89,38 @@ int hostapd_neighbor_show(struct hostapd_data *hapd, char *buf, size_t buflen)
+ }
+ 
+ 
++int hostapd_neighbor_count(struct hostapd_data *hapd)
++{
++	struct hostapd_neighbor_entry *nr;
++	int count = 0;
++
++	dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++			 list) {
++		count++;
++	}
++	return count;
++}
++
++
++int hostapd_neighbor_insert_buffer(struct hostapd_data *hapd, char *buf,
++        size_t buflen)
++{
++	struct hostapd_neighbor_entry *nr;
++	char *pos = buf;
++
++	dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++			 list) {
++		/* For neighbor report IE, we only need bssid and nr*/
++		*pos++ = WLAN_EID_NEIGHBOR_REPORT;
++		*pos++ = wpabuf_len(nr->nr);
++		os_memcpy(pos, wpabuf_head(nr->nr), wpabuf_len(nr->nr));
++		pos += wpabuf_len(nr->nr);
++	}
++
++	return pos - buf;
++}
++
++
+ static void hostapd_neighbor_clear_entry(struct hostapd_neighbor_entry *nr)
+ {
+ 	wpabuf_free(nr->nr);
+@@ -325,3 +357,90 @@ void hostapd_neighbor_set_own_report(struct hostapd_data *hapd)
+ 	wpabuf_free(nr);
+ #endif /* NEED_AP_MLME */
+ }
++
++
++void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_buf,
++			 size_t buflen, const int pref)
++{
++	struct hostapd_neighbor_entry *nr;
++	char *pos, *next_nr;
++
++	pos = nei_buf;
++	next_nr = nei_buf;
++
++	dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++			 list) {
++		pos = next_nr;
++		next_nr = pos + 2 + wpabuf_len(nr->nr);
++		/* Shift 2 bytes for Element ID and Neighbor report length */
++		pos = pos + 2;
++		if(os_memcmp(pos, hapd->own_addr, ETH_ALEN) == 0) {
++			/* Shift for BSSID + BSSID info + Op_class + channel num + PHY type */
++			pos = pos + 6 + 4 + 1 + 1 + 1;
++
++			/* Iterate Subelement */
++			while (next_nr - pos > 0) {
++				if (*pos == 3) {
++					pos = pos + 2;
++					*pos = pref;
++					return;
++				} else {
++					pos++;
++					int shift_len = *pos++;
++					pos = pos + shift_len;
++				}
++			}
++		}
++	}
++}
++
++#ifdef CONFIG_MBO
++void hostapd_neighbor_set_pref_by_non_pref_chan(struct hostapd_data *hapd,
++			 struct sta_info* sta, char *nei_buf, size_t buflen)
++{
++	struct hostapd_neighbor_entry *nr;
++	struct mbo_non_pref_chan_info *info;
++	u8 i;
++
++	for(info = sta->non_pref_chan; info; info = info->next) {
++		/* Check OP_Class and Channel num */
++		for(i = 0; i < info->num_channels; i++) {
++			char *pos, *next_nr;
++
++			pos = nei_buf;
++			next_nr = nei_buf;
++
++			/* Iterate Neighbor report database */
++			dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
++					 list) {
++				pos = next_nr;
++				next_nr = pos + 2 + wpabuf_len(nr->nr);
++				/**
++				 * Shift 12 bytes for Element ID, Neighbor report length,
++				 * BSSID and BSSID info.
++				 */
++				pos = pos + 12;
++				int nr_op_class = *pos++;
++				int nr_channel = *pos;
++				if(info->op_class == nr_op_class && info->channels[i] == nr_channel) {
++					/* Shift for Channel Num + PHY type */
++					pos = pos + 1 + 1;
++
++					// Iterate Subelement
++					while(next_nr - pos > 0) {
++						if(*pos == 3) {
++							pos = pos + 2;
++							*pos = info->pref;
++							break;
++						}else {
++							pos++;
++							int shift_len = *pos++;
++							pos = pos + shift_len;
++						}
++					}
++				}
++			}
++		}
++	}
++}
++#endif
+diff --git a/src/ap/neighbor_db.h b/src/ap/neighbor_db.h
+index 992671b..a1ddc07 100644
+--- a/src/ap/neighbor_db.h
++++ b/src/ap/neighbor_db.h
+@@ -24,4 +24,13 @@ int hostapd_neighbor_remove(struct hostapd_data *hapd, const u8 *bssid,
+ 			    const struct wpa_ssid_value *ssid);
+ void hostapd_free_neighbor_db(struct hostapd_data *hapd);
+ 
++int hostapd_neighbor_count(struct hostapd_data *hapd);
++int hostapd_neighbor_insert_buffer(struct hostapd_data *hapd, char *buf,
++        size_t buflen);
++void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_buf,
++			 size_t buflen, const int pref);
++#ifdef CONFIG_MBO
++void hostapd_neighbor_set_pref_by_non_pref_chan(struct hostapd_data *hapd,
++			 struct sta_info* sta, char *nei_buf, size_t buflen);
++#endif
+ #endif /* NEIGHBOR_DB_H */
+diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
+index 3ea92af..4349e1d 100644
+--- a/src/ap/wnm_ap.c
++++ b/src/ap/wnm_ap.c
+@@ -20,6 +20,7 @@
+ #include "ap/wpa_auth.h"
+ #include "mbo_ap.h"
+ #include "wnm_ap.h"
++#include "ap/neighbor_db.h"
+ 
+ #define MAX_TFS_IE_LEN  1024
+ 
+@@ -370,9 +371,21 @@ static int ieee802_11_send_bss_trans_mgmt_request(struct hostapd_data *hapd,
+ 	u8 *pos;
+ 	int res;
+ 
+-	mgmt = os_zalloc(sizeof(*mgmt));
+-	if (mgmt == NULL)
++	int nr_num = hostapd_neighbor_count(hapd);
++	int nr_size = ETH_ALEN + 4 + 1 + 1 + 1 + 5;
++	int total_nr_size = nr_num * nr_size;
++	u8 *nr_data = os_malloc(total_nr_size);
++	int nr_data_len = 0;
++	if(nr_data == NULL) {
++		wpa_printf (MSG_ERROR, "Failed to allocate memory");
++	} else {
++	    nr_data_len = hostapd_neighbor_insert_buffer(hapd, nr_data, total_nr_size);
++	}
++	mgmt = os_zalloc(sizeof(*mgmt) + nr_data_len);
++	if (mgmt == NULL) {
++		wpa_printf (MSG_ERROR, "Failed to allocate memory for mgmt frame");
+ 		return -1;
++	}
+ 	os_memcpy(mgmt->da, addr, ETH_ALEN);
+ 	os_memcpy(mgmt->sa, hapd->own_addr, ETH_ALEN);
+ 	os_memcpy(mgmt->bssid, hapd->own_addr, ETH_ALEN);
+@@ -382,10 +395,18 @@ static int ieee802_11_send_bss_trans_mgmt_request(struct hostapd_data *hapd,
+ 	mgmt->u.action.u.bss_tm_req.action = WNM_BSS_TRANS_MGMT_REQ;
+ 	mgmt->u.action.u.bss_tm_req.dialog_token = dialog_token;
+ 	mgmt->u.action.u.bss_tm_req.req_mode = 0;
++	if(nr_num) {
++		mgmt->u.action.u.bss_tm_req.req_mode |= WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED;
++	}
+ 	mgmt->u.action.u.bss_tm_req.disassoc_timer = host_to_le16(0);
+ 	mgmt->u.action.u.bss_tm_req.validity_interval = 1;
+ 	pos = mgmt->u.action.u.bss_tm_req.variable;
+ 
++	if(nr_num) {
++		os_memcpy(pos, nr_data, nr_data_len);
++		pos += nr_data_len;
++	}
++
+ 	hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ 	wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Request to "
+ 		   MACSTR " dialog_token=%u req_mode=0x%x disassoc_timer=%u "
+@@ -759,6 +780,50 @@ static void set_disassoc_timer(struct hostapd_data *hapd, struct sta_info *sta,
+ }
+ 
+ 
++static void set_send_disassoc_frame_timer(struct hostapd_data *hapd, struct sta_info *sta,
++			       int disassoc_timer)
++{
++	int timeout, beacon_int;
++
++	/*
++	 * Prevent STA from reconnecting using cached PMKSA to force
++	 * full authentication with the authentication server (which may
++	 * decide to reject the connection),
++	 */
++	wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr);
++
++	beacon_int = hapd->iconf->beacon_int;
++	if (beacon_int < 1)
++		beacon_int = 100; /* best guess */
++	/* Calculate timeout in ms based on beacon_int in TU */
++	timeout = disassoc_timer * beacon_int * 128 / 125;
++	wpa_printf(MSG_DEBUG, "Disassociation timer for " MACSTR
++		   " set to %d ms", MAC2STR(sta->addr), timeout);
++
++	u16 reason = WLAN_REASON_PREV_AUTH_NOT_VALID;
++
++	hostapd_drv_sta_disassoc(hapd, sta->addr, reason);
++	if (sta)
++		ap_sta_disassociate(hapd, sta, reason);
++}
++
++
++void bss_termination_disable_iface(void *eloop_ctx, void *timeout_ctx)
++{
++	struct hostapd_data *hapd = eloop_ctx;
++	hostapd_disable_iface(hapd->iface);
++}
++
++
++static void set_disable_iface_timer(struct hostapd_data *hapd, struct sta_info *sta,
++			       int disable_iface_timer)
++{
++	wpa_printf(MSG_DEBUG, "Disable interface timer set to %d secs", disable_iface_timer);
++	eloop_register_timeout(disable_iface_timer, 0,
++			       bss_termination_disable_iface, hapd, NULL);
++}
++
++
+ int wnm_send_ess_disassoc_imminent(struct hostapd_data *hapd,
+ 				   struct sta_info *sta, const char *url,
+ 				   int disassoc_timer)
+@@ -848,6 +913,7 @@ int wnm_send_bss_tm_req(struct hostapd_data *hapd, struct sta_info *sta,
+ 	    bss_term_dur) {
+ 		os_memcpy(pos, bss_term_dur, 12);
+ 		pos += 12;
++		set_disable_iface_timer(hapd, sta, hapd->conf->bss_termination_tsf);
+ 	}
+ 
+ 	if (url) {
+@@ -884,7 +950,7 @@ int wnm_send_bss_tm_req(struct hostapd_data *hapd, struct sta_info *sta,
+ 	hapd->openwrt_stats.wnm.bss_transition_request_tx++;
+ 	if (disassoc_timer) {
+ 		/* send disassociation frame after time-out */
+-		set_disassoc_timer(hapd, sta, disassoc_timer);
++		set_send_disassoc_frame_timer(hapd, sta, disassoc_timer);
+ 	}
+ 
+ 	return 0;
+-- 
+2.36.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches/99901-hostapd-mtk-Support-including-neighbor-report-elements-in-ANQP-.patch b/recipes-wifi/wpa-supplicant/files/patches/99901-hostapd-mtk-Support-including-neighbor-report-elements-in-ANQP-.patch
deleted file mode 100644
index 752584b..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches/99901-hostapd-mtk-Support-including-neighbor-report-elements-in-ANQP-.patch
+++ /dev/null
@@ -1,95 +0,0 @@
-From 0a4f464da1089e59eb5155b5479ceff785697881 Mon Sep 17 00:00:00 2001
-From: "howard.hsu" <howard-yh.hsu@mediatek.com>
-Date: Wed, 19 Jan 2022 19:25:05 +0800
-Subject: [PATCH 99901/99917] Support including neighbor report elements in
- ANQP response
-
----
- src/ap/gas_serv.c | 29 +++++++++++++++++++++++++++++
- src/ap/gas_serv.h |  2 ++
- 2 files changed, 31 insertions(+)
-
-diff --git a/src/ap/gas_serv.c b/src/ap/gas_serv.c
-index 90f1577..5845ff8 100644
---- a/src/ap/gas_serv.c
-+++ b/src/ap/gas_serv.c
-@@ -19,6 +19,7 @@
- #include "dpp_hostapd.h"
- #include "sta_info.h"
- #include "gas_serv.h"
-+#include "neighbor_db.h"
- 
- 
- #ifdef CONFIG_DPP
-@@ -369,6 +370,24 @@ static void anqp_add_network_auth_type(struct hostapd_data *hapd,
- 	}
- }
- 
-+static void anqp_add_neighbor_report(struct hostapd_data *hapd,
-+				       struct wpabuf *buf)
-+{
-+	struct hostapd_neighbor_entry *nr;
-+	u8 *len_pos = gas_anqp_add_element(buf, ANQP_NEIGHBOR_REPORT);
-+	if (dl_list_empty(&hapd->nr_db)) {
-+		wpabuf_put_le16(buf, 0);
-+	}
-+	else {
-+		dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry, list ) {
-+			wpabuf_put_u8(buf, WLAN_EID_NEIGHBOR_REPORT);
-+			wpabuf_put_u8(buf, wpabuf_len(nr->nr));
-+			wpabuf_put_buf(buf, nr->nr);
-+		}
-+	}
-+	gas_anqp_set_element_len(buf, len_pos);
-+}
-+
- 
- static void anqp_add_roaming_consortium(struct hostapd_data *hapd,
- 					struct wpabuf *buf)
-@@ -986,6 +1005,9 @@ gas_serv_build_gas_resp_payload(struct hostapd_data *hapd,
- 		len += 1000;
- 	if (request & ANQP_REQ_ICON_REQUEST)
- 		len += 65536;
-+    if (request & ANQP_REQ_NEIGHBOR_REPORT) {
-+        len += (40 * hostapd_neighbor_count(hapd));
-+    }
- #ifdef CONFIG_FILS
- 	if (request & ANQP_FILS_REALM_INFO)
- 		len += 2 * dl_list_len(&hapd->conf->fils_realms);
-@@ -1028,6 +1050,8 @@ gas_serv_build_gas_resp_payload(struct hostapd_data *hapd,
- 		anqp_add_elem(hapd, buf, ANQP_TDLS_CAPABILITY);
- 	if (request & ANQP_REQ_EMERGENCY_NAI)
- 		anqp_add_elem(hapd, buf, ANQP_EMERGENCY_NAI);
-+	if (request & ANQP_REQ_NEIGHBOR_REPORT)
-+		anqp_add_neighbor_report(hapd, buf);
- 
- 	for (i = 0; i < num_extra_req; i++) {
- #ifdef CONFIG_FILS
-@@ -1172,6 +1196,11 @@ static void rx_anqp_query_list_id(struct hostapd_data *hapd, u16 info_id,
- 			     "Emergency NAI",
- 			     get_anqp_elem(hapd, info_id) != NULL, qi);
- 		break;
-+	case ANQP_NEIGHBOR_REPORT:
-+		set_anqp_req(ANQP_REQ_NEIGHBOR_REPORT,
-+			     "Neighbor Report",
-+			     get_anqp_elem(hapd, info_id) != NULL, qi);
-+		break;
- 	default:
- #ifdef CONFIG_FILS
- 		if (info_id == ANQP_FILS_REALM_INFO &&
-diff --git a/src/ap/gas_serv.h b/src/ap/gas_serv.h
-index 1528af4..d0241f2 100644
---- a/src/ap/gas_serv.h
-+++ b/src/ap/gas_serv.h
-@@ -40,6 +40,8 @@
- 	(1 << (ANQP_TDLS_CAPABILITY - ANQP_QUERY_LIST))
- #define ANQP_REQ_EMERGENCY_NAI \
- 	(1 << (ANQP_EMERGENCY_NAI - ANQP_QUERY_LIST))
-+#define ANQP_REQ_NEIGHBOR_REPORT \
-+	(1 << (ANQP_NEIGHBOR_REPORT - ANQP_QUERY_LIST))
- /*
-  * First 15 Hotspot 2.0 vendor specific ANQP-elements can be included in the
-  * optimized bitmap.
--- 
-2.36.1
-
diff --git a/recipes-wifi/hostapd/files/patches/99909-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch b/recipes-wifi/wpa-supplicant/files/patches/99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
similarity index 86%
copy from recipes-wifi/hostapd/files/patches/99909-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
copy to recipes-wifi/wpa-supplicant/files/patches/99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
index 12e0e36..054dfb0 100644
--- a/recipes-wifi/hostapd/files/patches/99909-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
@@ -1,7 +1,7 @@
-From b7a74dbae4ff2bdbc5c84d0299bc18020fe86d13 Mon Sep 17 00:00:00 2001
+From f5c37c459c33bb8e228a88ba8efdea68bb75abd3 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 20 Sep 2022 19:33:45 +0800
-Subject: [PATCH 99909/99917] print sae groups by hostapd ctrl
+Subject: [PATCH 99901/99909] hostapd: mtk: print sae groups by hostapd ctrl
 
 ---
  hostapd/ctrl_iface.c | 13 +++++++++++++
diff --git a/recipes-wifi/wpa-supplicant/files/patches/99902-hostapd-mtk-Support-including-neignbor-report-elements-in-BTM-r.patch b/recipes-wifi/wpa-supplicant/files/patches/99902-hostapd-mtk-Support-including-neignbor-report-elements-in-BTM-r.patch
deleted file mode 100644
index 99bea80..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches/99902-hostapd-mtk-Support-including-neignbor-report-elements-in-BTM-r.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From d283e4c84ece2f6b6dc21889b6b326ea3de11545 Mon Sep 17 00:00:00 2001
-From: "howard.hsu" <howard-yh.hsu@mediatek.com>
-Date: Wed, 19 Jan 2022 19:49:09 +0800
-Subject: [PATCH 99902/99917] Support including neignbor report elements in BTM
- response
-
----
- src/ap/wnm_ap.c | 25 +++++++++++++++++++++++--
- 1 file changed, 23 insertions(+), 2 deletions(-)
-
-diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
-index 3ea92af..532d9db 100644
---- a/src/ap/wnm_ap.c
-+++ b/src/ap/wnm_ap.c
-@@ -20,6 +20,7 @@
- #include "ap/wpa_auth.h"
- #include "mbo_ap.h"
- #include "wnm_ap.h"
-+#include "ap/neighbor_db.h"
- 
- #define MAX_TFS_IE_LEN  1024
- 
-@@ -370,9 +371,21 @@ static int ieee802_11_send_bss_trans_mgmt_request(struct hostapd_data *hapd,
- 	u8 *pos;
- 	int res;
- 
--	mgmt = os_zalloc(sizeof(*mgmt));
--	if (mgmt == NULL)
-+	int nr_num = hostapd_neighbor_count(hapd);
-+	int nr_size = ETH_ALEN + 4 + 1 + 1 + 1 + 5;
-+	int total_nr_size = nr_num * nr_size;
-+	u8 *nr_data = os_malloc(total_nr_size);
-+	int nr_data_len = 0;
-+	if(nr_data == NULL) {
-+		wpa_printf (MSG_ERROR, "Failed to allocate memory");
-+	} else {
-+	    nr_data_len = hostapd_neighbor_insert_buffer(hapd, nr_data, total_nr_size);
-+	}
-+	mgmt = os_zalloc(sizeof(*mgmt) + nr_data_len);
-+	if (mgmt == NULL) {
-+		wpa_printf (MSG_ERROR, "Failed to allocate memory for mgmt frame");
- 		return -1;
-+	}
- 	os_memcpy(mgmt->da, addr, ETH_ALEN);
- 	os_memcpy(mgmt->sa, hapd->own_addr, ETH_ALEN);
- 	os_memcpy(mgmt->bssid, hapd->own_addr, ETH_ALEN);
-@@ -382,10 +395,18 @@ static int ieee802_11_send_bss_trans_mgmt_request(struct hostapd_data *hapd,
- 	mgmt->u.action.u.bss_tm_req.action = WNM_BSS_TRANS_MGMT_REQ;
- 	mgmt->u.action.u.bss_tm_req.dialog_token = dialog_token;
- 	mgmt->u.action.u.bss_tm_req.req_mode = 0;
-+	if(nr_num) {
-+		mgmt->u.action.u.bss_tm_req.req_mode |= WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED;
-+	}
- 	mgmt->u.action.u.bss_tm_req.disassoc_timer = host_to_le16(0);
- 	mgmt->u.action.u.bss_tm_req.validity_interval = 1;
- 	pos = mgmt->u.action.u.bss_tm_req.variable;
- 
-+	if(nr_num) {
-+		os_memcpy(pos, nr_data, nr_data_len);
-+		pos += nr_data_len;
-+	}
-+
- 	hapd->openwrt_stats.wnm.bss_transition_request_tx++;
- 	wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Request to "
- 		   MACSTR " dialog_token=%u req_mode=0x%x disassoc_timer=%u "
--- 
-2.36.1
-
diff --git a/recipes-wifi/hostapd/files/patches/99910-hostapd-mtk-hostapd-add-support-for-runtime-set-in-band-discove.patch b/recipes-wifi/wpa-supplicant/files/patches/99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch
similarity index 97%
copy from recipes-wifi/hostapd/files/patches/99910-hostapd-mtk-hostapd-add-support-for-runtime-set-in-band-discove.patch
copy to recipes-wifi/wpa-supplicant/files/patches/99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch
index 2af1d8e..6fa23c0 100644
--- a/recipes-wifi/hostapd/files/patches/99910-hostapd-mtk-hostapd-add-support-for-runtime-set-in-band-discove.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch
@@ -1,7 +1,7 @@
-From 7a7b2284ad75cd20c788dad6e253bc2940203ff9 Mon Sep 17 00:00:00 2001
+From ce684a1adac0b5b699482924eb86f8f1b8205e57 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 31 May 2022 21:15:54 +0800
-Subject: [PATCH 99910/99917] hostapd: add support for runtime set in-band
+Subject: [PATCH 99902/99909] hostapd: mtk: add support for runtime set in-band
  discovery
 
 Usage:
diff --git a/recipes-wifi/hostapd/files/patches/99911-hostapd-mtk-Add-mtk_vendor.h.patch b/recipes-wifi/wpa-supplicant/files/patches/99903-hostapd-mtk-Add-mtk_vendor.h.patch
similarity index 97%
copy from recipes-wifi/hostapd/files/patches/99911-hostapd-mtk-Add-mtk_vendor.h.patch
copy to recipes-wifi/wpa-supplicant/files/patches/99903-hostapd-mtk-Add-mtk_vendor.h.patch
index ff4d232..a15287e 100644
--- a/recipes-wifi/hostapd/files/patches/99911-hostapd-mtk-Add-mtk_vendor.h.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/99903-hostapd-mtk-Add-mtk_vendor.h.patch
@@ -1,7 +1,7 @@
-From f5ba1e7e33d0736602957f8131540202cec1c7ad Mon Sep 17 00:00:00 2001
+From e4b9b5847090d25009a4cf104052ba0490e95ffe Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 30 May 2022 15:04:57 +0800
-Subject: [PATCH 99911/99917] Add mtk_vendor.h
+Subject: [PATCH 99903/99909] hostapd: mtk: Add mtk_vendor.h
 
 ---
  src/common/mtk_vendor.h | 195 ++++++++++++++++++++++++++++++++++++++++
diff --git a/recipes-wifi/wpa-supplicant/files/patches/99903-hostapd-mtk-Support-configuring-BSS-Termination-TSF-by-using-ho.patch b/recipes-wifi/wpa-supplicant/files/patches/99903-hostapd-mtk-Support-configuring-BSS-Termination-TSF-by-using-ho.patch
deleted file mode 100644
index cac4092..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches/99903-hostapd-mtk-Support-configuring-BSS-Termination-TSF-by-using-ho.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From de13e08cb3e1210bfed2de824c6a19e8dbed057e Mon Sep 17 00:00:00 2001
-From: Howard Hsu <howard-yh.hsu@mediatek.com>
-Date: Thu, 9 Jun 2022 19:56:18 +0800
-Subject: [PATCH 99903/99917] Support configuring BSS Termination TSF by using
- hostapd_cli command
-
----
- hostapd/ctrl_iface.c   | 5 +++++
- src/ap/ap_config.c     | 1 +
- src/ap/ap_config.h     | 1 +
- src/ap/ctrl_iface_ap.c | 4 ++++
- 4 files changed, 11 insertions(+)
-
-diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index a258492..c2a2822 100644
---- a/hostapd/ctrl_iface.c
-+++ b/hostapd/ctrl_iface.c
-@@ -1338,6 +1338,11 @@ static int hostapd_ctrl_iface_set(struct hostapd_data *hapd, char *cmd)
- #endif /* CONFIG_DPP */
- 	} else if (os_strcasecmp(cmd, "setband") == 0) {
- 		ret = hostapd_ctrl_iface_set_band(hapd, value);
-+	} else if (os_strcasecmp(cmd, "bss_termination_tsf") == 0) {
-+		int termination_sec = atoi(value);
-+		hapd->conf->bss_termination_tsf = termination_sec;
-+		wpa_printf(MSG_DEBUG, "BSS Termination TSF: value = %d",
-+                termination_sec);
- 	} else {
- 		ret = hostapd_set_iface(hapd->iconf, hapd->conf, cmd, value);
- 		if (ret)
-diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index d7a0c7c..4a20eb4 100644
---- a/src/ap/ap_config.c
-+++ b/src/ap/ap_config.c
-@@ -170,6 +170,7 @@ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss)
- 	/* comeback after 10 TUs */
- 	bss->pasn_comeback_after = 10;
- #endif /* CONFIG_PASN */
-+	bss->bss_termination_tsf = 0;
- }
- 
- 
-diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index ed3bec7..3f68e76 100644
---- a/src/ap/ap_config.h
-+++ b/src/ap/ap_config.h
-@@ -557,6 +557,7 @@ struct hostapd_bss_config {
- 	int wnm_sleep_mode;
- 	int wnm_sleep_mode_no_keys;
- 	int bss_transition;
-+	unsigned int bss_termination_tsf;
- 
- 	/* IEEE 802.11u - Interworking */
- 	int interworking;
-diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
-index 96209ce..46a8609 100644
---- a/src/ap/ctrl_iface_ap.c
-+++ b/src/ap/ctrl_iface_ap.c
-@@ -1203,6 +1203,10 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
- 			wpa_printf(MSG_DEBUG, "Invalid bss_term data");
- 			return -1;
- 		}
-+		if (hapd->conf->bss_termination_tsf) {
-+			WPA_PUT_LE64(&bss_term_dur[2], hapd->conf->bss_termination_tsf);
-+		}
-+
- 		end++;
- 		WPA_PUT_LE16(&bss_term_dur[10], atoi(end));
- 	}
--- 
-2.36.1
-
diff --git a/recipes-wifi/wpa-supplicant/files/patches/99904-hostapd-mtk-Disable-interface-if-BSS-Termination-TSF-is-set.patch b/recipes-wifi/wpa-supplicant/files/patches/99904-hostapd-mtk-Disable-interface-if-BSS-Termination-TSF-is-set.patch
deleted file mode 100644
index 7334217..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches/99904-hostapd-mtk-Disable-interface-if-BSS-Termination-TSF-is-set.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From cdd0a088a13000d67a5bd821a609546f8b79c7e0 Mon Sep 17 00:00:00 2001
-From: "howard.hsu" <howard-yh.hsu@mediatek.com>
-Date: Wed, 19 Jan 2022 21:03:38 +0800
-Subject: [PATCH 99904/99917] Disable interface if BSS Termination TSF is set
-
----
- src/ap/wnm_ap.c | 17 +++++++++++++++++
- 1 file changed, 17 insertions(+)
-
-diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
-index 532d9db..f6761ab 100644
---- a/src/ap/wnm_ap.c
-+++ b/src/ap/wnm_ap.c
-@@ -780,6 +780,22 @@ static void set_disassoc_timer(struct hostapd_data *hapd, struct sta_info *sta,
- }
- 
- 
-+void bss_termination_disable_iface(void *eloop_ctx, void *timeout_ctx)
-+{
-+	struct hostapd_data *hapd = eloop_ctx;
-+	hostapd_disable_iface(hapd->iface);
-+}
-+
-+
-+static void set_disable_iface_timer(struct hostapd_data *hapd, struct sta_info *sta,
-+			       int disable_iface_timer)
-+{
-+	wpa_printf(MSG_DEBUG, "Disable interface timer set to %d secs", disable_iface_timer);
-+	eloop_register_timeout(disable_iface_timer, 0,
-+			       bss_termination_disable_iface, hapd, NULL);
-+}
-+
-+
- int wnm_send_ess_disassoc_imminent(struct hostapd_data *hapd,
- 				   struct sta_info *sta, const char *url,
- 				   int disassoc_timer)
-@@ -869,6 +885,7 @@ int wnm_send_bss_tm_req(struct hostapd_data *hapd, struct sta_info *sta,
- 	    bss_term_dur) {
- 		os_memcpy(pos, bss_term_dur, 12);
- 		pos += 12;
-+		set_disable_iface_timer(hapd, sta, hapd->conf->bss_termination_tsf);
- 	}
- 
- 	if (url) {
--- 
-2.36.1
-
diff --git a/recipes-wifi/hostapd/files/patches/99912-hostapd-mtk-Support-new-hostapd-configuration-edcca_enable-and-.patch b/recipes-wifi/wpa-supplicant/files/patches/99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
similarity index 98%
copy from recipes-wifi/hostapd/files/patches/99912-hostapd-mtk-Support-new-hostapd-configuration-edcca_enable-and-.patch
copy to recipes-wifi/wpa-supplicant/files/patches/99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
index e1161f8..40dded6 100644
--- a/recipes-wifi/hostapd/files/patches/99912-hostapd-mtk-Support-new-hostapd-configuration-edcca_enable-and-.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
@@ -1,9 +1,9 @@
-From 27645d8206ad1a0276f05faa175f2ed4ffb8202e Mon Sep 17 00:00:00 2001
+From cef7f515eafeeaa99933cc9e66c79b705e3ab065 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 30 May 2022 16:31:34 +0800
-Subject: [PATCH 99912/99917] Support new hostapd configuration, edcca_enable
- and edcca_compensation and implement edcca related handlers.
+Subject: [PATCH 99904/99909] hostapd: mtk: Support EDCCA hostapd configuration
 
+edcca_enable and edcca_compensation and implement edcca related handlers.
 ---
  hostapd/config_file.c             |  32 ++++++
  hostapd/ctrl_iface.c              | 125 ++++++++++++++++++++++
diff --git a/recipes-wifi/hostapd/files/patches/99913-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch b/recipes-wifi/wpa-supplicant/files/patches/99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
similarity index 98%
copy from recipes-wifi/hostapd/files/patches/99913-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
copy to recipes-wifi/wpa-supplicant/files/patches/99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
index 572cdd1..18617be 100644
--- a/recipes-wifi/hostapd/files/patches/99913-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
@@ -1,7 +1,7 @@
-From fe664c759cb79e130d35f6dd0236e9cb33320f70 Mon Sep 17 00:00:00 2001
+From a288f97e708bc579e285b509f7c0655c2f27a76c Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Tue, 9 Aug 2022 10:23:44 -0700
-Subject: [PATCH 99913/99917] Add hostapd HEMU SET/GET control
+Subject: [PATCH 99905/99909] hostapd: mtk: Add hostapd HEMU SET/GET control
 
 ---
  hostapd/config_file.c             |   9 +++
diff --git a/recipes-wifi/wpa-supplicant/files/patches/99905-hostapd-mtk-Add-set_send_disassoc_frame_timer-to-send-disassoci.patch b/recipes-wifi/wpa-supplicant/files/patches/99905-hostapd-mtk-Add-set_send_disassoc_frame_timer-to-send-disassoci.patch
deleted file mode 100644
index 83d9814..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches/99905-hostapd-mtk-Add-set_send_disassoc_frame_timer-to-send-disassoci.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From bd1816cb396a071cc5ae2fe13992362fcbf45fe9 Mon Sep 17 00:00:00 2001
-From: "howard.hsu" <howard-yh.hsu@mediatek.com>
-Date: Wed, 19 Jan 2022 21:15:07 +0800
-Subject: [PATCH 99905/99917] Add set_send_disassoc_frame_timer() to send
- disassociate frame
-
-Function set_disassoc_timer() may fail if key was deleted first. This new
-function will not ask to delete key as set_disassoc_timer() did.
----
- src/ap/wnm_ap.c | 30 +++++++++++++++++++++++++++++-
- 1 file changed, 29 insertions(+), 1 deletion(-)
-
-diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
-index f6761ab..4349e1d 100644
---- a/src/ap/wnm_ap.c
-+++ b/src/ap/wnm_ap.c
-@@ -780,6 +780,34 @@ static void set_disassoc_timer(struct hostapd_data *hapd, struct sta_info *sta,
- }
- 
- 
-+static void set_send_disassoc_frame_timer(struct hostapd_data *hapd, struct sta_info *sta,
-+			       int disassoc_timer)
-+{
-+	int timeout, beacon_int;
-+
-+	/*
-+	 * Prevent STA from reconnecting using cached PMKSA to force
-+	 * full authentication with the authentication server (which may
-+	 * decide to reject the connection),
-+	 */
-+	wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr);
-+
-+	beacon_int = hapd->iconf->beacon_int;
-+	if (beacon_int < 1)
-+		beacon_int = 100; /* best guess */
-+	/* Calculate timeout in ms based on beacon_int in TU */
-+	timeout = disassoc_timer * beacon_int * 128 / 125;
-+	wpa_printf(MSG_DEBUG, "Disassociation timer for " MACSTR
-+		   " set to %d ms", MAC2STR(sta->addr), timeout);
-+
-+	u16 reason = WLAN_REASON_PREV_AUTH_NOT_VALID;
-+
-+	hostapd_drv_sta_disassoc(hapd, sta->addr, reason);
-+	if (sta)
-+		ap_sta_disassociate(hapd, sta, reason);
-+}
-+
-+
- void bss_termination_disable_iface(void *eloop_ctx, void *timeout_ctx)
- {
- 	struct hostapd_data *hapd = eloop_ctx;
-@@ -922,7 +950,7 @@ int wnm_send_bss_tm_req(struct hostapd_data *hapd, struct sta_info *sta,
- 	hapd->openwrt_stats.wnm.bss_transition_request_tx++;
- 	if (disassoc_timer) {
- 		/* send disassociation frame after time-out */
--		set_disassoc_timer(hapd, sta, disassoc_timer);
-+		set_send_disassoc_frame_timer(hapd, sta, disassoc_timer);
- 	}
- 
- 	return 0;
--- 
-2.36.1
-
diff --git a/recipes-wifi/hostapd/files/patches/99914-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch b/recipes-wifi/wpa-supplicant/files/patches/99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch
similarity index 97%
copy from recipes-wifi/hostapd/files/patches/99914-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch
copy to recipes-wifi/wpa-supplicant/files/patches/99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch
index ca64eb8..fc81ed1 100644
--- a/recipes-wifi/hostapd/files/patches/99914-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch
@@ -1,7 +1,8 @@
-From 4707ed85884be2ffe7860e28de80df5a6e479824 Mon Sep 17 00:00:00 2001
+From 26c6be11e7597490ccc4d7704542c78dec6c4cd1 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 2 Sep 2022 01:03:23 +0800
-Subject: [PATCH 99914/99917] Add three wire PTA ctrl hostapd vendor command
+Subject: [PATCH 99906/99909] hostapd: mtk: Add three wire PTA ctrl hostapd
+ vendor command
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
diff --git a/recipes-wifi/wpa-supplicant/files/patches/99906-hostapd-mtk-Support-including-neighbor-report-elements-in-BTM-r.patch b/recipes-wifi/wpa-supplicant/files/patches/99906-hostapd-mtk-Support-including-neighbor-report-elements-in-BTM-r.patch
deleted file mode 100644
index 174d8a9..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches/99906-hostapd-mtk-Support-including-neighbor-report-elements-in-BTM-r.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 99665874b76ccacd85e56ea8767ebb0b8d4b3b1e Mon Sep 17 00:00:00 2001
-From: Howard Hsu <howard-yh.hsu@mediatek.com>
-Date: Thu, 9 Jun 2022 19:58:57 +0800
-Subject: [PATCH 99906/99917] Support including neighbor report elements in BTM
- request
-
----
- src/ap/ctrl_iface_ap.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
-index 46a8609..1cbec53 100644
---- a/src/ap/ctrl_iface_ap.c
-+++ b/src/ap/ctrl_iface_ap.c
-@@ -1233,8 +1233,13 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
- 		req_mode |= WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT;
- 	}
- 
--	if (os_strstr(cmd, " pref=1"))
-+	if (os_strstr(cmd, " pref=1")) {
- 		req_mode |= WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED;
-+		if (nei_len == 0) {
-+			// Add neigibor report from neighbor report db to nei_rep buffer
-+			nei_len = hostapd_neighbor_insert_buffer (hapd, nei_rep, 1000);
-+		}
-+	}
- 	if (os_strstr(cmd, " abridged=1"))
- 		req_mode |= WNM_BSS_TM_REQ_ABRIDGED;
- 	if (os_strstr(cmd, " disassoc_imminent=1"))
--- 
-2.36.1
-
diff --git a/recipes-wifi/hostapd/files/patches/99915-hostapd-mtk-Add-hostapd-iBF-control.patch b/recipes-wifi/wpa-supplicant/files/patches/99907-hostapd-mtk-Add-hostapd-iBF-control.patch
similarity index 98%
copy from recipes-wifi/hostapd/files/patches/99915-hostapd-mtk-Add-hostapd-iBF-control.patch
copy to recipes-wifi/wpa-supplicant/files/patches/99907-hostapd-mtk-Add-hostapd-iBF-control.patch
index a50cb9e..50a08ba 100644
--- a/recipes-wifi/hostapd/files/patches/99915-hostapd-mtk-Add-hostapd-iBF-control.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/99907-hostapd-mtk-Add-hostapd-iBF-control.patch
@@ -1,7 +1,7 @@
-From e177f5069ff7e8f024676cf9d0e4af135cfea95b Mon Sep 17 00:00:00 2001
+From 1f60afd21c6dd7dfe3d504dee7507654a981033b Mon Sep 17 00:00:00 2001
 From: mtk27835 <shurong.wen@mediatek.com>
 Date: Wed, 7 Sep 2022 14:41:51 -0700
-Subject: [PATCH 99915/99917] Add hostapd iBF control
+Subject: [PATCH 99907/99909] hostapd: mtk: Add hostapd iBF control
 
 Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
 ---
diff --git a/recipes-wifi/wpa-supplicant/files/patches/99907-hostapd-mtk-Add-hostapd_neighbor_set_own_report_pref.patch b/recipes-wifi/wpa-supplicant/files/patches/99907-hostapd-mtk-Add-hostapd_neighbor_set_own_report_pref.patch
deleted file mode 100644
index 63658c9..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches/99907-hostapd-mtk-Add-hostapd_neighbor_set_own_report_pref.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From bc2244e766d863c35369cc1641b058d062681abe Mon Sep 17 00:00:00 2001
-From: Howard Hsu <howard-yh.hsu@mediatek.com>
-Date: Thu, 9 Jun 2022 20:00:49 +0800
-Subject: [PATCH 99907/99917] Add hostapd_neighbor_set_own_report_pref()
-
----
- src/ap/ctrl_iface_ap.c |  6 +++++-
- src/ap/neighbor_db.c   | 36 ++++++++++++++++++++++++++++++++++++
- src/ap/neighbor_db.h   |  2 ++
- 3 files changed, 43 insertions(+), 1 deletion(-)
-
-diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
-index 1cbec53..274b435 100644
---- a/src/ap/ctrl_iface_ap.c
-+++ b/src/ap/ctrl_iface_ap.c
-@@ -1242,8 +1242,12 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
- 	}
- 	if (os_strstr(cmd, " abridged=1"))
- 		req_mode |= WNM_BSS_TM_REQ_ABRIDGED;
--	if (os_strstr(cmd, " disassoc_imminent=1"))
-+	if (os_strstr(cmd, " disassoc_imminent=1")) {
- 		req_mode |= WNM_BSS_TM_REQ_DISASSOC_IMMINENT;
-+		/* Set own BSS neighbor report preference value as 0 */
-+		hostapd_neighbor_set_own_report_pref(hapd, nei_rep, nei_len, 0);
-+	}
-+
- 
- #ifdef CONFIG_MBO
- 	pos = os_strstr(cmd, "mbo=");
-diff --git a/src/ap/neighbor_db.c b/src/ap/neighbor_db.c
-index c121390..134ed4a 100644
---- a/src/ap/neighbor_db.c
-+++ b/src/ap/neighbor_db.c
-@@ -357,3 +357,39 @@ void hostapd_neighbor_set_own_report(struct hostapd_data *hapd)
- 	wpabuf_free(nr);
- #endif /* NEED_AP_MLME */
- }
-+
-+
-+void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_buf,
-+			 size_t buflen, const int pref)
-+{
-+	struct hostapd_neighbor_entry *nr;
-+	char *pos, *next_nr;
-+
-+	pos = nei_buf;
-+	next_nr = nei_buf;
-+
-+	dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
-+			 list) {
-+		pos = next_nr;
-+		next_nr = pos + 2 + wpabuf_len(nr->nr);
-+		/* Shift 2 bytes for Element ID and Neighbor report length */
-+		pos = pos + 2;
-+		if(os_memcmp(pos, hapd->own_addr, ETH_ALEN) == 0) {
-+			/* Shift for BSSID + BSSID info + Op_class + channel num + PHY type */
-+			pos = pos + 6 + 4 + 1 + 1 + 1;
-+
-+			/* Iterate Subelement */
-+			while (next_nr - pos > 0) {
-+				if (*pos == 3) {
-+					pos = pos + 2;
-+					*pos = pref;
-+					return;
-+				} else {
-+					pos++;
-+					int shift_len = *pos++;
-+					pos = pos + shift_len;
-+				}
-+			}
-+		}
-+	}
-+}
-diff --git a/src/ap/neighbor_db.h b/src/ap/neighbor_db.h
-index 1ae194d..2e16f72 100644
---- a/src/ap/neighbor_db.h
-+++ b/src/ap/neighbor_db.h
-@@ -27,4 +27,6 @@ void hostapd_free_neighbor_db(struct hostapd_data *hapd);
- int hostapd_neighbor_count(struct hostapd_data *hapd);
- int hostapd_neighbor_insert_buffer(struct hostapd_data *hapd, char *buf,
-         size_t buflen);
-+void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_buf,
-+			 size_t buflen, const int pref);
- #endif /* NEIGHBOR_DB_H */
--- 
-2.36.1
-
diff --git a/recipes-wifi/wpa-supplicant/files/patches/99908-hostapd-mtk-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch b/recipes-wifi/wpa-supplicant/files/patches/99908-hostapd-mtk-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch
deleted file mode 100644
index 8d23b84..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches/99908-hostapd-mtk-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch
+++ /dev/null
@@ -1,99 +0,0 @@
-From 952404e8327c98817a2d975b5595ca5d9a15e739 Mon Sep 17 00:00:00 2001
-From: Howard Hsu <howard-yh.hsu@mediatek.com>
-Date: Thu, 9 Jun 2022 20:02:06 +0800
-Subject: [PATCH 99908/99917] Add hostapd_neighbor_set_pref_by_non_pref_chan()
-
----
- src/ap/ctrl_iface_ap.c |  2 ++
- src/ap/neighbor_db.c   | 51 ++++++++++++++++++++++++++++++++++++++++++
- src/ap/neighbor_db.h   |  4 ++++
- 3 files changed, 57 insertions(+)
-
-diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
-index 274b435..18bae5c 100644
---- a/src/ap/ctrl_iface_ap.c
-+++ b/src/ap/ctrl_iface_ap.c
-@@ -1250,6 +1250,8 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
- 
- 
- #ifdef CONFIG_MBO
-+	hostapd_neighbor_set_pref_by_non_pref_chan(hapd, sta, nei_rep, nei_len);
-+
- 	pos = os_strstr(cmd, "mbo=");
- 	if (pos) {
- 		unsigned int mbo_reason, cell_pref, reassoc_delay;
-diff --git a/src/ap/neighbor_db.c b/src/ap/neighbor_db.c
-index 134ed4a..9254d09 100644
---- a/src/ap/neighbor_db.c
-+++ b/src/ap/neighbor_db.c
-@@ -393,3 +393,54 @@ void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_b
- 		}
- 	}
- }
-+
-+#ifdef CONFIG_MBO
-+void hostapd_neighbor_set_pref_by_non_pref_chan(struct hostapd_data *hapd,
-+			 struct sta_info* sta, char *nei_buf, size_t buflen)
-+{
-+	struct hostapd_neighbor_entry *nr;
-+	struct mbo_non_pref_chan_info *info;
-+	u8 i;
-+
-+	for(info = sta->non_pref_chan; info; info = info->next) {
-+		/* Check OP_Class and Channel num */
-+		for(i = 0; i < info->num_channels; i++) {
-+			char *pos, *next_nr;
-+
-+			pos = nei_buf;
-+			next_nr = nei_buf;
-+
-+			/* Iterate Neighbor report database */
-+			dl_list_for_each(nr, &hapd->nr_db, struct hostapd_neighbor_entry,
-+					 list) {
-+				pos = next_nr;
-+				next_nr = pos + 2 + wpabuf_len(nr->nr);
-+				/**
-+				 * Shift 12 bytes for Element ID, Neighbor report length,
-+				 * BSSID and BSSID info.
-+				 */
-+				pos = pos + 12;
-+				int nr_op_class = *pos++;
-+				int nr_channel = *pos;
-+				if(info->op_class == nr_op_class && info->channels[i] == nr_channel) {
-+					/* Shift for Channel Num + PHY type */
-+					pos = pos + 1 + 1;
-+
-+					// Iterate Subelement
-+					while(next_nr - pos > 0) {
-+						if(*pos == 3) {
-+							pos = pos + 2;
-+							*pos = info->pref;
-+							break;
-+						}else {
-+							pos++;
-+							int shift_len = *pos++;
-+							pos = pos + shift_len;
-+						}
-+					}
-+				}
-+			}
-+		}
-+	}
-+}
-+#endif
-diff --git a/src/ap/neighbor_db.h b/src/ap/neighbor_db.h
-index 2e16f72..a1ddc07 100644
---- a/src/ap/neighbor_db.h
-+++ b/src/ap/neighbor_db.h
-@@ -29,4 +29,8 @@ int hostapd_neighbor_insert_buffer(struct hostapd_data *hapd, char *buf,
-         size_t buflen);
- void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_buf,
- 			 size_t buflen, const int pref);
-+#ifdef CONFIG_MBO
-+void hostapd_neighbor_set_pref_by_non_pref_chan(struct hostapd_data *hapd,
-+			 struct sta_info* sta, char *nei_buf, size_t buflen);
-+#endif
- #endif /* NEIGHBOR_DB_H */
--- 
-2.36.1
-
diff --git a/recipes-wifi/wpa-supplicant/files/patches/99916-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated-sta-s-HE-c.patch b/recipes-wifi/wpa-supplicant/files/patches/99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch
similarity index 81%
rename from recipes-wifi/wpa-supplicant/files/patches/99916-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated-sta-s-HE-c.patch
rename to recipes-wifi/wpa-supplicant/files/patches/99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch
index b1769a1..9b96d98 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/99916-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated-sta-s-HE-c.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch
@@ -1,8 +1,8 @@
-From dbd8120e47621784647deb776bf4b4d0a97fb49e Mon Sep 17 00:00:00 2001
+From 28228a96980512f30c8c8aac0f819c36f7241b68 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 22 Sep 2022 16:08:09 +0800
-Subject: [PATCH 99916/99917] Do not include HE capab IE if associated sta's HE
- capab IE is invalid
+Subject: [PATCH 99908/99909] hostapd: mtk: Do not include HE capab IE if
+ associated sta's HE capab IE is invalid
 
 ---
  src/ap/ieee802_11.c | 3 ++-
diff --git a/recipes-wifi/hostapd/files/patches/99917-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch b/recipes-wifi/wpa-supplicant/files/patches/99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
similarity index 98%
copy from recipes-wifi/hostapd/files/patches/99917-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
copy to recipes-wifi/wpa-supplicant/files/patches/99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
index 83eac6e..8da9b5f 100644
--- a/recipes-wifi/hostapd/files/patches/99917-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
@@ -1,7 +1,7 @@
-From 80ecd3e0398aa668e683ff582a0594f88b290f44 Mon Sep 17 00:00:00 2001
+From 737d21c64ab0ac49e9cce7185f1f79bb0b71f50e Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 7 Oct 2022 10:46:29 +0800
-Subject: [PATCH 99917/99917] Add DFS and ZWDFS support
+Subject: [PATCH 99909/99909] hostapd: mtk: Add DFS and ZWDFS support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
diff --git a/recipes-wifi/wpa-supplicant/files/patches/99909-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch b/recipes-wifi/wpa-supplicant/files/patches/99909-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
deleted file mode 100644
index 12e0e36..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches/99909-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From b7a74dbae4ff2bdbc5c84d0299bc18020fe86d13 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Tue, 20 Sep 2022 19:33:45 +0800
-Subject: [PATCH 99909/99917] print sae groups by hostapd ctrl
-
----
- hostapd/ctrl_iface.c | 13 +++++++++++++
- 1 file changed, 13 insertions(+)
-
-diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index c2a2822..bc690c5 100644
---- a/hostapd/ctrl_iface.c
-+++ b/hostapd/ctrl_iface.c
-@@ -1412,6 +1412,19 @@ static int hostapd_ctrl_iface_get(struct hostapd_data *hapd, char *cmd,
- 		if (os_snprintf_error(buflen, res))
- 			return -1;
- 		return res;
-+	} else if (os_strcmp(cmd, "sae_group_capability") == 0) {
-+#ifdef CONFIG_SAE
-+		/* see sae_set_group() */
-+		res = os_snprintf(buf, buflen, "%s%s%s%s19 20 21",
-+				  dh_groups_get(15) ? "15 ": "",
-+				  dh_groups_get(16) ? "16 ": "",
-+				  dh_groups_get(17) ? "17 ": "",
-+				  dh_groups_get(18) ? "18 ": "");
-+
-+		if (os_snprintf_error(buflen, res))
-+			return -1;
-+		return res;
-+#endif /* CONFIG_SAE */
- 	}
- 
- 	return -1;
--- 
-2.36.1
-
diff --git a/recipes-wifi/wpa-supplicant/files/patches/99910-hostapd-mtk-hostapd-add-support-for-runtime-set-in-band-discove.patch b/recipes-wifi/wpa-supplicant/files/patches/99910-hostapd-mtk-hostapd-add-support-for-runtime-set-in-band-discove.patch
deleted file mode 100644
index 2af1d8e..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches/99910-hostapd-mtk-hostapd-add-support-for-runtime-set-in-band-discove.patch
+++ /dev/null
@@ -1,211 +0,0 @@
-From 7a7b2284ad75cd20c788dad6e253bc2940203ff9 Mon Sep 17 00:00:00 2001
-From: MeiChia Chiu <meichia.chiu@mediatek.com>
-Date: Tue, 31 May 2022 21:15:54 +0800
-Subject: [PATCH 99910/99917] hostapd: add support for runtime set in-band
- discovery
-
-Usage:
-hostapd_cli unsolic_probe_resp [tx_type] [interval]
-
-0: disable all in-band discovery
-1: enable unsolicited probe response
-2: enable FILS discovery
-
-Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
----
- hostapd/ctrl_iface.c         | 66 ++++++++++++++++++++++++++++++++++++
- hostapd/hostapd_cli.c        | 20 +++++++++++
- src/ap/beacon.c              |  5 ++-
- src/drivers/driver_nl80211.c | 10 ++++--
- src/drivers/nl80211_copy.h   |  1 +
- 5 files changed, 98 insertions(+), 4 deletions(-)
-
-diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index bc690c5..bb8c74f 100644
---- a/hostapd/ctrl_iface.c
-+++ b/hostapd/ctrl_iface.c
-@@ -826,6 +826,69 @@ static int hostapd_ctrl_iface_send_qos_map_conf(struct hostapd_data *hapd,
- 
- #endif /* CONFIG_INTERWORKING */
- 
-+static int hostapd_ctrl_iface_inband_discovery(struct hostapd_data *hapd,
-+					       const char *cmd)
-+{
-+	struct hostapd_bss_config *conf = hapd->conf;
-+	const char *pos = cmd;
-+	int tx_type, interval, ret;
-+
-+	tx_type = atoi(pos);
-+	if (tx_type < 0 || tx_type > 2) {
-+		wpa_printf(MSG_ERROR, "Invalid tx type\n");
-+		return -1;
-+	}
-+
-+	pos = os_strchr(pos, ' ');
-+	if(!pos)
-+		return -1;
-+	pos++;
-+	interval = atoi(pos);
-+	if (interval < 0 || interval > 20) {
-+		wpa_printf(MSG_ERROR, "Invalid interval value\n");
-+		return -1;
-+	}
-+
-+	wpa_printf(MSG_ERROR, "Set inband discovery type:%d, interval:%d\n",
-+			      tx_type, interval);
-+
-+#define DISABLE_INBAND_DISC 0
-+#define UNSOL_PROBE_RESP 1
-+#define FILS_DISCOVERY 2
-+
-+#ifdef CONFIG_FILS
-+	conf->fils_discovery_max_int = 0;
-+	conf->fils_discovery_min_int = 0;
-+#endif /* CONFIG_FILS */
-+	conf->unsol_bcast_probe_resp_interval = 0;
-+
-+	switch (tx_type) {
-+	case DISABLE_INBAND_DISC:
-+	default:
-+		/* Disable both Unsolicited probe response and FILS discovery*/
-+		break;
-+	case UNSOL_PROBE_RESP:
-+		/* Enable Unsolicited probe response */
-+		conf->unsol_bcast_probe_resp_interval = interval;
-+		break;
-+#ifdef CONFIG_FILS
-+	case FILS_DISCOVERY:
-+		/* Enable FILS discovery */
-+		conf->fils_discovery_min_int = interval;
-+		conf->fils_discovery_max_int = interval;
-+		break;
-+#endif /* CONFIG_FILS */
-+	}
-+
-+	ret = ieee802_11_update_beacons(hapd->iface);
-+	if(ret) {
-+		wpa_printf(MSG_DEBUG,
-+			"Failed to update with inband discovery parameters\n");
-+		return -1;
-+	}
-+
-+	return 0;
-+}
- 
- #ifdef CONFIG_WNM_AP
- 
-@@ -3434,6 +3497,9 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
- 		if (hostapd_ctrl_iface_coloc_intf_req(hapd, buf + 15))
- 			reply_len = -1;
- #endif /* CONFIG_WNM_AP */
-+	} else if (os_strncmp(buf, "INBAND_DISCOVERY ", 17) == 0) {
-+		if (hostapd_ctrl_iface_inband_discovery(hapd, buf + 17))
-+			reply_len = -1;
- 	} else if (os_strcmp(buf, "GET_CONFIG") == 0) {
- 		reply_len = hostapd_ctrl_iface_get_config(hapd, reply,
- 							  reply_size);
-diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index 85c41d0..db21258 100644
---- a/hostapd/hostapd_cli.c
-+++ b/hostapd/hostapd_cli.c
-@@ -642,6 +642,24 @@ static int hostapd_cli_cmd_wps_config(struct wpa_ctrl *ctrl, int argc,
- 	return wpa_ctrl_command(ctrl, buf);
- }
- 
-+static int hostapd_cli_cmd_inband_discovery(struct wpa_ctrl *ctrl, int argc,
-+					    char *argv[])
-+{
-+	char buf[300];
-+	int res;
-+
-+	if (argc < 2) {
-+		printf("Invalid 'inband_discovery' command - two arguments"
-+		       "tx_type interval\n");
-+		return -1;
-+	}
-+
-+	res = os_snprintf(buf, sizeof(buf), "INBAND_DISCOVERY %s %s",
-+			  argv[0], argv[1]);
-+	if (os_snprintf_error(sizeof(buf), res))
-+		return -1;
-+	return wpa_ctrl_command(ctrl, buf);
-+}
- 
- static int hostapd_cli_cmd_disassoc_imminent(struct wpa_ctrl *ctrl, int argc,
- 					     char *argv[])
-@@ -1749,6 +1767,8 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
- 	{ "driver", hostapd_cli_cmd_driver, NULL,
- 	  "<driver sub command> [<hex formatted data>] = send driver command data" },
- #endif /* ANDROID */
-+	{ "inband_discovery", hostapd_cli_cmd_inband_discovery, NULL,
-+          "<tx type(0/1/2)> <interval> = runtime set inband discovery" },
- 	{ NULL, NULL, NULL, NULL }
- };
- 
-diff --git a/src/ap/beacon.c b/src/ap/beacon.c
-index 814e86e..1a26f11 100644
---- a/src/ap/beacon.c
-+++ b/src/ap/beacon.c
-@@ -1497,6 +1497,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
- 				   struct wpa_driver_ap_params *params)
- {
- 	params->fd_max_int = hapd->conf->fils_discovery_max_int;
-+	params->unsol_bcast_probe_resp_interval =
-+		hapd->conf->unsol_bcast_probe_resp_interval;
- 	if (is_6ghz_op_class(hapd->iconf->op_class) &&
- 	    params->fd_max_int > FD_MAX_INTERVAL_6GHZ)
- 		params->fd_max_int = FD_MAX_INTERVAL_6GHZ;
-@@ -1505,7 +1507,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
- 	if (params->fd_min_int > params->fd_max_int)
- 		params->fd_min_int = params->fd_max_int;
- 
--	if (params->fd_max_int)
-+	if (params->fd_max_int || (is_6ghz_op_class(hapd->iconf->op_class) &&
-+	    !params->unsol_bcast_probe_resp_interval))
- 		return hostapd_gen_fils_discovery(hapd,
- 						  &params->fd_frame_tmpl_len);
- 
-diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 53f2503..5eba0ea 100644
---- a/src/drivers/driver_nl80211.c
-+++ b/src/drivers/driver_nl80211.c
-@@ -4498,9 +4498,10 @@ static int nl80211_fils_discovery(struct i802_bss *bss, struct nl_msg *msg,
- 			params->fd_max_int) ||
- 	    (params->fd_frame_tmpl &&
- 	     nla_put(msg, NL80211_FILS_DISCOVERY_ATTR_TMPL,
--		     params->fd_frame_tmpl_len, params->fd_frame_tmpl)))
-+		     params->fd_frame_tmpl_len, params->fd_frame_tmpl)) ||
-+	    nla_put_u32(msg, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INTE,
-+			params->unsol_bcast_probe_resp_interval))
- 		return -1;
--
- 	nla_nest_end(msg, attr);
- 	return 0;
- }
-@@ -4844,7 +4845,10 @@ static int wpa_driver_nl80211_set_ap(void *priv,
- #endif /* CONFIG_SAE */
- 
- #ifdef CONFIG_FILS
--	if (params->fd_max_int && nl80211_fils_discovery(bss, msg, params) < 0)
-+	if ((params->fd_max_int ||
-+	    ((params->freq->freq > 5950 && params->freq->freq <= 7115) &&
-+	      !(params->unsol_bcast_probe_resp_interval))) &&
-+	     nl80211_fils_discovery(bss, msg, params) < 0)
- 		goto fail;
- #endif /* CONFIG_FILS */
- 
-diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
-index 0568a79..c4bf3ad 100644
---- a/src/drivers/nl80211_copy.h
-+++ b/src/drivers/nl80211_copy.h
-@@ -7379,6 +7379,7 @@ enum nl80211_fils_discovery_attributes {
- 	NL80211_FILS_DISCOVERY_ATTR_INT_MIN,
- 	NL80211_FILS_DISCOVERY_ATTR_INT_MAX,
- 	NL80211_FILS_DISCOVERY_ATTR_TMPL,
-+	NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INTE,
- 
- 	/* keep last */
- 	__NL80211_FILS_DISCOVERY_ATTR_LAST,
--- 
-2.36.1
-
diff --git a/recipes-wifi/wpa-supplicant/files/patches/99911-hostapd-mtk-Add-mtk_vendor.h.patch b/recipes-wifi/wpa-supplicant/files/patches/99911-hostapd-mtk-Add-mtk_vendor.h.patch
deleted file mode 100644
index ff4d232..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches/99911-hostapd-mtk-Add-mtk_vendor.h.patch
+++ /dev/null
@@ -1,214 +0,0 @@
-From f5ba1e7e33d0736602957f8131540202cec1c7ad Mon Sep 17 00:00:00 2001
-From: Howard Hsu <howard-yh.hsu@mediatek.com>
-Date: Mon, 30 May 2022 15:04:57 +0800
-Subject: [PATCH 99911/99917] Add mtk_vendor.h
-
----
- src/common/mtk_vendor.h | 195 ++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 195 insertions(+)
- create mode 100644 src/common/mtk_vendor.h
-
-diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-new file mode 100644
-index 0000000..528387f
---- /dev/null
-+++ b/src/common/mtk_vendor.h
-@@ -0,0 +1,195 @@
-+// SPDX-License-Identifier: ISC
-+/* Copyright (C) 2020 Felix Fietkau <nbd@nbd.name> */
-+#ifndef MTK_VENDOR_H
-+#define MTK_VENDOR_H
-+
-+#define OUI_MTK    0x000ce7
-+
-+enum mtk_nl80211_vendor_subcmds {
-+	MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL = 0xae,
-+	MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
-+	MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
-+	MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
-+	MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
-+};
-+
-+enum mtk_vendor_attr_edcca_ctrl {
-+	MTK_VENDOR_ATTR_EDCCA_THRESHOLD_INVALID = 0,
-+
-+	MTK_VENDOR_ATTR_EDCCA_CTRL_MODE,
-+	MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL,
-+	MTK_VENDOR_ATTR_EDCCA_CTRL_SEC20_VAL,
-+	MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL,
-+	MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL,
-+	MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL,
-+	MTK_VENDOR_ATTR_EDCCA_CTRL_MAX =
-+		NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL - 1
-+};
-+
-+enum mtk_vendor_attr_edcca_ctrl_mode {
-+	EDCCA_CTRL_SET_EN = 0,
-+	EDCCA_CTRL_SET_THERS,
-+	EDCCA_CTRL_GET_EN,
-+	EDCCA_CTRL_GET_THERS,
-+	EDCCA_CTRL_NUM,
-+};
-+
-+static struct nla_policy edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
-+	[MTK_VENDOR_ATTR_EDCCA_CTRL_MODE] = { .type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] = { .type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC20_VAL] = { .type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL] = { .type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL] = { .type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE] = { .type = NLA_U8 },
-+};
-+
-+enum mtk_vendor_attr_csi_ctrl {
-+	MTK_VENDOR_ATTR_CSI_CTRL_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_CSI_CTRL_CFG,
-+	MTK_VENDOR_ATTR_CSI_CTRL_CFG_MODE,
-+	MTK_VENDOR_ATTR_CSI_CTRL_CFG_TYPE,
-+	MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL1,
-+	MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL2,
-+	MTK_VENDOR_ATTR_CSI_CTRL_MAC_ADDR,
-+	MTK_VENDOR_ATTR_CSI_CTRL_INTERVAL,
-+
-+	MTK_VENDOR_ATTR_CSI_CTRL_DUMP_NUM,
-+
-+	MTK_VENDOR_ATTR_CSI_CTRL_DATA,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_CSI_CTRL,
-+	MTK_VENDOR_ATTR_CSI_CTRL_MAX =
-+		NUM_MTK_VENDOR_ATTRS_CSI_CTRL - 1
-+};
-+
-+enum mtk_vendor_attr_csi_data {
-+	MTK_VENDOR_ATTR_CSI_DATA_UNSPEC,
-+	MTK_VENDOR_ATTR_CSI_DATA_PAD,
-+
-+	MTK_VENDOR_ATTR_CSI_DATA_VER,
-+	MTK_VENDOR_ATTR_CSI_DATA_TS,
-+	MTK_VENDOR_ATTR_CSI_DATA_RSSI,
-+	MTK_VENDOR_ATTR_CSI_DATA_SNR,
-+	MTK_VENDOR_ATTR_CSI_DATA_BW,
-+	MTK_VENDOR_ATTR_CSI_DATA_CH_IDX,
-+	MTK_VENDOR_ATTR_CSI_DATA_TA,
-+	MTK_VENDOR_ATTR_CSI_DATA_I,
-+	MTK_VENDOR_ATTR_CSI_DATA_Q,
-+	MTK_VENDOR_ATTR_CSI_DATA_INFO,
-+	MTK_VENDOR_ATTR_CSI_DATA_RSVD1,
-+	MTK_VENDOR_ATTR_CSI_DATA_RSVD2,
-+	MTK_VENDOR_ATTR_CSI_DATA_RSVD3,
-+	MTK_VENDOR_ATTR_CSI_DATA_RSVD4,
-+	MTK_VENDOR_ATTR_CSI_DATA_TX_ANT,
-+	MTK_VENDOR_ATTR_CSI_DATA_RX_ANT,
-+	MTK_VENDOR_ATTR_CSI_DATA_MODE,
-+	MTK_VENDOR_ATTR_CSI_DATA_H_IDX,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_CSI_DATA,
-+	MTK_VENDOR_ATTR_CSI_DATA_MAX =
-+		NUM_MTK_VENDOR_ATTRS_CSI_DATA - 1
-+};
-+
-+enum mtk_vendor_attr_mnt_ctrl {
-+	MTK_VENDOR_ATTR_AMNT_CTRL_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_AMNT_CTRL_SET,
-+	MTK_VENDOR_ATTR_AMNT_CTRL_DUMP,
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_AMNT_CTRL,
-+	MTK_VENDOR_ATTR_AMNT_CTRL_MAX =
-+		NUM_MTK_VENDOR_ATTRS_AMNT_CTRL - 1
-+};
-+
-+enum mtk_vendor_attr_mnt_set {
-+	MTK_VENDOR_ATTR_AMNT_SET_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_AMNT_SET_INDEX,
-+	MTK_VENDOR_ATTR_AMNT_SET_MACADDR,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_AMNT_SET,
-+	MTK_VENDOR_ATTR_AMNT_SET_MAX =
-+		NUM_MTK_VENDOR_ATTRS_AMNT_SET - 1
-+};
-+
-+enum mtk_vendor_attr_mnt_dump {
-+	MTK_VENDOR_ATTR_AMNT_DUMP_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_AMNT_DUMP_INDEX,
-+	MTK_VENDOR_ATTR_AMNT_DUMP_LEN,
-+	MTK_VENDOR_ATTR_AMNT_DUMP_RESULT,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_AMNT_DUMP,
-+	MTK_VENDOR_ATTR_AMNT_DUMP_MAX =
-+		NUM_MTK_VENDOR_ATTRS_AMNT_DUMP - 1
-+};
-+
-+enum mtk_vendor_attr_wireless_ctrl {
-+	MTK_VENDOR_ATTR_WIRELESS_CTRL_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_WIRELESS_CTRL_FIXED_MCS,
-+	MTK_VENDOR_ATTR_WIRELESS_CTRL_FIXED_OFDMA,
-+	MTK_VENDOR_ATTR_WIRELESS_CTRL_PPDU_TX_TYPE,
-+	MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA,
-+	MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE,
-+	MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO,
-+	MTK_VENDOR_ATTR_WIRELESS_CTRL_AMPDU,
-+	MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU,
-+	MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL,
-+	MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX =
-+		NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL - 1
-+};
-+
-+enum mtk_vendor_attr_rfeature_ctrl {
-+	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI,
-+	MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_LTF,
-+	MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_CFG,
-+	MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_EN,
-+	MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE,
-+	MTK_VENDOR_ATTR_RFEATURE_CTRL_ACK_PLCY,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL,
-+	MTK_VENDOR_ATTR_RFEATURE_CTRL_MAX =
-+		NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL - 1
-+};
-+
-+#define CSI_MAX_COUNT 256
-+#define ETH_ALEN 6
-+
-+struct csi_data {
-+	s16 data_i[CSI_MAX_COUNT];
-+	s16 data_q[CSI_MAX_COUNT];
-+	s8 rssi;
-+	u8 snr;
-+	u32 ts;
-+	u8 data_bw;
-+	u8 pri_ch_idx;
-+	u8 ta[ETH_ALEN];
-+	u32 info;
-+	u8 rx_mode;
-+	u32 h_idx;
-+	u16 tx_idx;
-+	u16 rx_idx;
-+};
-+
-+struct amnt_data {
-+	u8 idx;
-+	u8 addr[ETH_ALEN];
-+	s8 rssi[4];
-+	u32 last_seen;
-+};
-+#endif /* MTK_VENDOR_H */
--- 
-2.36.1
-
diff --git a/recipes-wifi/wpa-supplicant/files/patches/99912-hostapd-mtk-Support-new-hostapd-configuration-edcca_enable-and-.patch b/recipes-wifi/wpa-supplicant/files/patches/99912-hostapd-mtk-Support-new-hostapd-configuration-edcca_enable-and-.patch
deleted file mode 100644
index e1161f8..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches/99912-hostapd-mtk-Support-new-hostapd-configuration-edcca_enable-and-.patch
+++ /dev/null
@@ -1,619 +0,0 @@
-From 27645d8206ad1a0276f05faa175f2ed4ffb8202e Mon Sep 17 00:00:00 2001
-From: Howard Hsu <howard-yh.hsu@mediatek.com>
-Date: Mon, 30 May 2022 16:31:34 +0800
-Subject: [PATCH 99912/99917] Support new hostapd configuration, edcca_enable
- and edcca_compensation and implement edcca related handlers.
-
----
- hostapd/config_file.c             |  32 ++++++
- hostapd/ctrl_iface.c              | 125 ++++++++++++++++++++++
- src/ap/ap_config.c                |   4 +
- src/ap/ap_config.h                |  29 ++++++
- src/ap/ap_drv_ops.c               |  24 +++++
- src/ap/ap_drv_ops.h               |   5 +-
- src/ap/hostapd.c                  |   7 ++
- src/common/mtk_vendor.h           |  19 ++--
- src/drivers/driver.h              |   4 +
- src/drivers/driver_nl80211.c      | 165 ++++++++++++++++++++++++++++++
- src/drivers/driver_nl80211.h      |   1 +
- src/drivers/driver_nl80211_capa.c |   7 ++
- 12 files changed, 415 insertions(+), 7 deletions(-)
-
-diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index eda9db0..0ee8952 100644
---- a/hostapd/config_file.c
-+++ b/hostapd/config_file.c
-@@ -4753,6 +4753,38 @@ static int hostapd_config_fill(struct hostapd_config *conf,
- 	} else if (os_strcmp(buf, "eht_mu_beamformer") == 0) {
- 		conf->eht_phy_capab.mu_beamformer = atoi(pos);
- #endif /* CONFIG_IEEE80211BE */
-+	} else if (os_strcmp(buf, "edcca_threshold") == 0) {
-+		if (hostapd_parse_intlist(&conf->edcca_threshold, pos) ||
-+		    conf->edcca_threshold[0] < EDCCA_MIN_CONFIG_THRES ||
-+		    conf->edcca_threshold[0] > EDCCA_MAX_CONFIG_THRES ||
-+		    conf->edcca_threshold[1] < EDCCA_MIN_CONFIG_THRES ||
-+		    conf->edcca_threshold[1] > EDCCA_MAX_CONFIG_THRES ||
-+		    conf->edcca_threshold[2] < EDCCA_MIN_CONFIG_THRES ||
-+		    conf->edcca_threshold[2] > EDCCA_MAX_CONFIG_THRES) {
-+			wpa_printf(MSG_ERROR, "Line %d: invalid edcca threshold",
-+				   line);
-+			return 1;
-+		}
-+	} else if (os_strcmp(buf, "edcca_enable") == 0) {
-+		int mode = atoi(pos);
-+		if (mode < EDCCA_MODE_FORCE_DISABLE || mode > EDCCA_MODE_AUTO) {
-+			wpa_printf(MSG_ERROR, "Line %d: Invalid edcca_enable %d;"
-+				  " allowed value 0 (Force Disable) or 1(Auto) ",
-+				   line, mode);
-+			return 1;
-+		}
-+		conf->edcca_enable = (u8) mode;
-+	} else if (os_strcmp(buf, "edcca_compensation") == 0) {
-+		int val = atoi(pos);
-+		if (val < EDCCA_MIN_COMPENSATION ||
-+		    val > EDCCA_MAX_COMPENSATION) {
-+			wpa_printf(MSG_ERROR, "Line %d: Invalid compensation"
-+				   " value %d; allowed value %d ~ %d.",
-+				   line, val, EDCCA_MIN_COMPENSATION,
-+				   EDCCA_MAX_COMPENSATION);
-+			return 1;
-+		}
-+		conf->edcca_compensation = (s8) val;
- 	} else {
- 		wpa_printf(MSG_ERROR,
- 			   "Line %d: unknown configuration item '%s'",
-diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index bb8c74f..9c70d54 100644
---- a/hostapd/ctrl_iface.c
-+++ b/hostapd/ctrl_iface.c
-@@ -598,6 +598,19 @@ static const char * pbc_status_str(enum pbc_status status)
- }
- 
- 
-+static const char * edcca_mode_str(enum edcca_mode status)
-+{
-+	switch (status) {
-+		case EDCCA_MODE_FORCE_DISABLE:
-+			return "Force Disable";
-+		case EDCCA_MODE_AUTO:
-+			return "Auto";
-+		default:
-+			return "Unknown";
-+	}
-+}
-+
-+
- static int hostapd_ctrl_iface_wps_get_status(struct hostapd_data *hapd,
- 					     char *buf, size_t buflen)
- {
-@@ -3322,6 +3335,112 @@ static int hostapd_ctrl_iface_driver_cmd(struct hostapd_data *hapd, char *cmd,
- #endif /* ANDROID */
- 
- 
-+static int
-+hostapd_ctrl_iface_set_edcca(struct hostapd_data *hapd, char *cmd,
-+					 char *buf, size_t buflen)
-+{
-+	char *pos, *config, *value;
-+	config = cmd;
-+	pos = os_strchr(config, ' ');
-+	if (pos == NULL)
-+		return -1;
-+	*pos++ = '\0';
-+
-+	if(pos == NULL)
-+		return -1;
-+	value = pos;
-+
-+	if (os_strcmp(config, "enable") == 0) {
-+		int mode = atoi(value);
-+		if (mode < EDCCA_MODE_FORCE_DISABLE || mode > EDCCA_MODE_AUTO) {
-+			wpa_printf(MSG_ERROR, "Invalid value for edcca enable");
-+			return -1;
-+		}
-+		hapd->iconf->edcca_enable = (u8) mode;
-+		if (hostapd_drv_configure_edcca_enable(hapd) != 0)
-+			return -1;
-+	} else if (os_strcmp(config, "compensation") == 0) {
-+		int compensation = atoi(value);
-+		if (compensation < EDCCA_MIN_COMPENSATION ||
-+		    compensation > EDCCA_MAX_COMPENSATION) {
-+			wpa_printf(MSG_ERROR, "Invalid value for edcca compensation");
-+			return -1;
-+		}
-+		hapd->iconf->edcca_compensation = (s8) compensation;
-+		if (hostapd_drv_configure_edcca_enable(hapd) != 0)
-+			return -1;
-+	} else if (os_strcmp(config, "threshold") == 0) {
-+		char *thres_value;
-+		thres_value = os_strchr(value, ':');
-+		if (thres_value == NULL)
-+			return -1;
-+		*thres_value++ = '\0';
-+
-+		if(thres_value == NULL)
-+			return -1;
-+		int bw_idx= atoi(value);
-+		int threshold = atoi(thres_value);
-+
-+		if (bw_idx < EDCCA_BW_20 || bw_idx > EDCCA_BW_80) {
-+			wpa_printf(MSG_ERROR,
-+				   "Unsupported Bandwidth idx %d for SET_EDCCA",
-+				   bw_idx);
-+			return -1;
-+		}
-+		if (threshold < EDCCA_MIN_CONFIG_THRES ||
-+		    threshold > EDCCA_MAX_CONFIG_THRES) {
-+			wpa_printf(MSG_ERROR,
-+				   "Unsupported threshold %d for SET_EDCCA",
-+				   threshold);
-+			return -1;
-+		}
-+
-+		int threshold_arr[EDCCA_MAX_BW_NUM];
-+		/* 0x7f means keep the origival value in firmware */
-+		os_memset(threshold_arr, 0x7f, sizeof(threshold_arr));
-+		threshold_arr[bw_idx] = threshold;
-+
-+		if (hostapd_drv_configure_edcca_threshold(hapd, threshold_arr) != 0)
-+			return -1;
-+	} else {
-+		wpa_printf(MSG_ERROR,
-+			"Unsupported parameter %s for SET_EDCCA", config);
-+		return -1;
-+	}
-+	return os_snprintf(buf, buflen, "OK\n");
-+}
-+
-+
-+static int
-+hostapd_ctrl_iface_get_edcca(struct hostapd_data *hapd, char *cmd, char *buf,
-+			     size_t buflen)
-+{
-+	char *pos, *end;
-+
-+	pos = buf;
-+	end = buf + buflen;
-+	u8 value[EDCCA_MAX_BW_NUM] = {0};
-+
-+	if (os_strcmp(cmd, "enable") == 0) {
-+		return os_snprintf(pos, end - pos, "Enable: %s\n",
-+				   edcca_mode_str(hapd->iconf->edcca_enable));
-+	} else if (os_strcmp(cmd, "compensation") == 0) {
-+		return os_snprintf(pos, end - pos, "Compensation: %d\n",
-+				  hapd->iconf->edcca_compensation);
-+	} else if (os_strcmp(cmd, "threshold") == 0) {
-+		if (hostapd_drv_get_edcca(hapd, EDCCA_CTRL_GET_THRES, &value) != 0)
-+			return -1;
-+		return os_snprintf(pos, end - pos,
-+				   "Threshold BW20: 0x%x, BW40: 0x%x, BW80: 0x%x\n",
-+				   value[0], value[1], value[2]);
-+	} else {
-+		wpa_printf(MSG_ERROR,
-+			"Unsupported parameter %s for GET_EDCCA", cmd);
-+		return -1;
-+	}
-+}
-+
-+
- static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
- 					      char *buf, char *reply,
- 					      int reply_size,
-@@ -3868,6 +3987,12 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
- 		reply_len = hostapd_ctrl_iface_driver_cmd(hapd, buf + 7, reply,
- 							  reply_size);
- #endif /* ANDROID */
-+	} else if (os_strncmp(buf, "SET_EDCCA ", 10) == 0) {
-+		reply_len = hostapd_ctrl_iface_set_edcca(hapd, buf+10, reply,
-+							  reply_size);
-+	} else if (os_strncmp(buf, "GET_EDCCA ", 10) == 0) {
-+		reply_len = hostapd_ctrl_iface_get_edcca(hapd, buf+10, reply,
-+							  reply_size);
- 	} else {
- 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
- 		reply_len = 16;
-diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 4a20eb4..344585a 100644
---- a/src/ap/ap_config.c
-+++ b/src/ap/ap_config.c
-@@ -294,6 +294,9 @@ struct hostapd_config * hostapd_config_defaults(void)
- 	conf->airtime_update_interval = AIRTIME_DEFAULT_UPDATE_INTERVAL;
- #endif /* CONFIG_AIRTIME_POLICY */
- 
-+	conf->edcca_enable = EDCCA_MODE_AUTO;
-+	conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
-+
- 	return conf;
- }
- 
-@@ -1007,6 +1010,7 @@ void hostapd_config_free(struct hostapd_config *conf)
- #ifdef CONFIG_ACS
- 	os_free(conf->acs_chan_bias);
- #endif /* CONFIG_ACS */
-+	os_free(conf->edcca_threshold);
- 	wpabuf_free(conf->lci);
- 	wpabuf_free(conf->civic);
- 
-diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 3f68e76..775c567 100644
---- a/src/ap/ap_config.h
-+++ b/src/ap/ap_config.h
-@@ -1153,8 +1153,37 @@ struct hostapd_config {
- #define CH_SWITCH_EHT_ENABLED BIT(0)
- #define CH_SWITCH_EHT_DISABLED BIT(1)
- 	unsigned int ch_switch_eht_config;
-+	u8 edcca_enable;
-+	s8 edcca_compensation;
-+	int *edcca_threshold;
- };
- 
-+enum edcca_mode {
-+	EDCCA_MODE_FORCE_DISABLE = 0,
-+	EDCCA_MODE_AUTO = 1,
-+};
-+
-+enum edcca_bw_id {
-+	EDCCA_BW_20 = 0,
-+	EDCCA_BW_40,
-+	EDCCA_BW_80,
-+	EDCCA_MAX_BW_NUM,
-+};
-+
-+enum mtk_vendor_attr_edcca_ctrl_mode {
-+	EDCCA_CTRL_SET_EN = 0,
-+	EDCCA_CTRL_SET_THRES,
-+	EDCCA_CTRL_GET_EN,
-+	EDCCA_CTRL_GET_THRES,
-+	EDCCA_CTRL_NUM,
-+};
-+
-+#define EDCCA_DEFAULT_COMPENSATION -6
-+#define EDCCA_MIN_COMPENSATION -126
-+#define EDCCA_MAX_COMPENSATION 126
-+#define EDCCA_MIN_CONFIG_THRES -126
-+#define EDCCA_MAX_CONFIG_THRES 0
-+
- 
- static inline enum oper_chan_width
- hostapd_get_oper_chwidth(struct hostapd_config *conf)
-diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 0c7aee2..25e967d 100644
---- a/src/ap/ap_drv_ops.c
-+++ b/src/ap/ap_drv_ops.c
-@@ -1015,3 +1015,27 @@ int hostapd_drv_dpp_listen(struct hostapd_data *hapd, bool enable)
- 		return 0;
- 	return hapd->driver->dpp_listen(hapd->drv_priv, enable);
- }
-+
-+int hostapd_drv_configure_edcca_enable(struct hostapd_data *hapd)
-+{
-+	if (!hapd->driver || !hapd->driver->configure_edcca_enable)
-+		return 0;
-+	return hapd->driver->configure_edcca_enable(hapd->drv_priv,
-+				hapd->iconf->edcca_enable,
-+				hapd->iconf->edcca_compensation);
-+}
-+
-+int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
-+					  const int *threshold)
-+{
-+	if (!hapd->driver || !hapd->driver->configure_edcca_threshold)
-+		return 0;
-+	return hapd->driver->configure_edcca_threshold(hapd->drv_priv, threshold);
-+}
-+
-+int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value)
-+{
-+	if (!hapd->driver || !hapd->driver->get_edcca)
-+		return 0;
-+	return hapd->driver->get_edcca(hapd->drv_priv, mode, value);
-+}
-diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index b4fb766..70a99f4 100644
---- a/src/ap/ap_drv_ops.h
-+++ b/src/ap/ap_drv_ops.h
-@@ -138,7 +138,10 @@ int hostapd_drv_do_acs(struct hostapd_data *hapd);
- int hostapd_drv_update_dh_ie(struct hostapd_data *hapd, const u8 *peer,
- 			     u16 reason_code, const u8 *ie, size_t ielen);
- int hostapd_drv_dpp_listen(struct hostapd_data *hapd, bool enable);
--
-+int hostapd_drv_configure_edcca_enable(struct hostapd_data *hapd);
-+int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
-+					  const int *threshold);
-+int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
- 
- #include "drivers/driver.h"
- 
-diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index 0dd8c13..d05f948 100644
---- a/src/ap/hostapd.c
-+++ b/src/ap/hostapd.c
-@@ -2295,6 +2295,13 @@ dfs_offload:
- 	}
- #endif /* CONFIG_MESH */
- 
-+	if (hostapd_drv_configure_edcca_enable(hapd) < 0)
-+		goto fail;
-+
-+	if (hostapd_drv_configure_edcca_threshold(hapd,
-+						  hapd->iconf->edcca_threshold) < 0)
-+		goto fail;
-+
- 	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
- 		   iface->bss[0]->conf->iface);
- 	if (iface->interfaces && iface->interfaces->terminate_on_error > 0)
-diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 528387f..7056126 100644
---- a/src/common/mtk_vendor.h
-+++ b/src/common/mtk_vendor.h
-@@ -29,14 +29,21 @@ enum mtk_vendor_attr_edcca_ctrl {
- 		NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL - 1
- };
- 
--enum mtk_vendor_attr_edcca_ctrl_mode {
--	EDCCA_CTRL_SET_EN = 0,
--	EDCCA_CTRL_SET_THERS,
--	EDCCA_CTRL_GET_EN,
--	EDCCA_CTRL_GET_THERS,
--	EDCCA_CTRL_NUM,
-+enum mtk_vendor_attr_edcca_dump {
-+	MTK_VENDOR_ATTR_EDCCA_DUMP_UNSPEC = 0,
-+
-+	MTK_VENDOR_ATTR_EDCCA_DUMP_MODE,
-+	MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL,
-+	MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL,
-+	MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP,
-+	MTK_VENDOR_ATTR_EDCCA_DUMP_MAX =
-+		NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP - 1
- };
- 
-+
- static struct nla_policy edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
- 	[MTK_VENDOR_ATTR_EDCCA_CTRL_MODE] = { .type = NLA_U8 },
- 	[MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] = { .type = NLA_U8 },
-diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 1d2b1b2..3559974 100644
---- a/src/drivers/driver.h
-+++ b/src/drivers/driver.h
-@@ -4676,6 +4676,10 @@ struct wpa_driver_ops {
- 			      const u8 *match, size_t match_len,
- 			      bool multicast);
- #endif /* CONFIG_TESTING_OPTIONS */
-+	int (*configure_edcca_enable)(void *priv, const u8 edcca_enable,
-+				  const s8 edcca_compensation);
-+	int (*configure_edcca_threshold)(void *priv, const int *threshold);
-+	int (*get_edcca)(void *priv, const u8 mode, u8 *value);
- };
- 
- /**
-diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 5eba0ea..9c2782c 100644
---- a/src/drivers/driver_nl80211.c
-+++ b/src/drivers/driver_nl80211.c
-@@ -35,6 +35,8 @@
- #include "radiotap_iter.h"
- #include "rfkill.h"
- #include "driver_nl80211.h"
-+#include "common/mtk_vendor.h"
-+#include "ap/ap_config.h"
- 
- 
- #ifndef NETLINK_CAP_ACK
-@@ -12368,6 +12370,165 @@ static int testing_nl80211_radio_disable(void *priv, int disabled)
- 
- #endif /* CONFIG_TESTING_OPTIONS */
- 
-+static int nl80211_configure_edcca_enable(void *priv,
-+					  const u8 edcca_enable,
-+					  const s8 edcca_compensation)
-+{
-+	struct i802_bss *bss = priv;
-+	struct wpa_driver_nl80211_data *drv = bss->drv;
-+	struct nl_msg *msg;
-+	struct nlattr *data;
-+	int ret;
-+
-+	if (!drv->mtk_edcca_vendor_cmd_avail) {
-+		wpa_printf(MSG_INFO,
-+			   "nl80211: Driver does not support setting EDCCA enable");
-+		return 0;
-+	}
-+
-+	if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
-+	    nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
-+	    nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
-+			MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL) ||
-+	    !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
-+	    nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_MODE, EDCCA_CTRL_SET_EN) ||
-+	    nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL, edcca_enable) ||
-+	    nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE,
-+		edcca_compensation)) {
-+		wpa_printf (MSG_ERROR, "Prepare nl80211 msg fail");
-+		nlmsg_free(msg);
-+		return -ENOBUFS;
-+	}
-+	nla_nest_end(msg, data);
-+	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
-+	if (ret) {
-+		wpa_printf(MSG_ERROR, "Failed to configure EDCCA enable. ret=%d (%s) ",
-+			   ret, strerror(-ret));
-+	}
-+	return ret;
-+}
-+
-+static int nl80211_configure_edcca_threshold(void *priv, const int *threshold)
-+{
-+	struct i802_bss *bss = priv;
-+	struct wpa_driver_nl80211_data *drv = bss->drv;
-+	struct nl_msg *msg;
-+	struct nlattr *data;
-+	int ret;
-+
-+	if (!drv->mtk_edcca_vendor_cmd_avail) {
-+		wpa_printf(MSG_INFO,
-+			   "nl80211: Driver does not support setting EDCCA threshold");
-+		return 0;
-+	}
-+
-+	if (!threshold) {
-+		wpa_printf(MSG_INFO,
-+			   "nl80211: Input EDCCA threshold is empty!");
-+		return 0;
-+	}
-+
-+	if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
-+	    nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
-+	    nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
-+			MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL) ||
-+	    !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
-+	    nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_MODE, EDCCA_CTRL_SET_THRES) ||
-+	    nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL, threshold[0] & 0xff) ||
-+	    nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL, threshold[1] & 0xff) ||
-+	    nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL, threshold[2] & 0xff)) {
-+		wpa_printf (MSG_ERROR, "Prepare nl80211 msg fail");
-+		nlmsg_free(msg);
-+		return -ENOBUFS;
-+	}
-+	nla_nest_end(msg, data);
-+	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
-+	if (ret) {
-+		wpa_printf(MSG_ERROR, "Failed to configure EDCCA threshold. ret=%d (%s) ",
-+			   ret, strerror(-ret));
-+	}
-+	return ret;
-+}
-+
-+
-+static int edcca_info_handler(struct nl_msg *msg, void *arg)
-+{
-+	u8 *info = (u8*) arg;
-+	struct nlattr *tb[NL80211_ATTR_MAX + 1];
-+	struct nlattr *tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_MAX + 1];
-+	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
-+	struct nlattr *nl_vend, *attr;
-+
-+	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
-+		  genlmsg_attrlen(gnlh, 0), NULL);
-+
-+	nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
-+	if (!nl_vend)
-+		return NL_SKIP;
-+
-+	nla_parse(tb_vendor, MTK_VENDOR_ATTR_EDCCA_DUMP_MAX,
-+		  nla_data(nl_vend), nla_len(nl_vend), NULL);
-+
-+	attr = tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL];
-+	if (!attr) {
-+		wpa_printf(MSG_ERROR, "nl80211: MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL");
-+		return NL_SKIP;
-+	}
-+
-+	*info++ = nla_get_u8(attr);
-+
-+	attr = tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL];
-+	if (!attr) {
-+		wpa_printf(MSG_ERROR, "nl80211: MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL");
-+		return NL_SKIP;
-+	}
-+
-+	*info++ = nla_get_u8(attr);
-+
-+	attr = tb_vendor[MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL];
-+	if (!attr) {
-+		wpa_printf(MSG_ERROR, "nl80211: MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL");
-+		return NL_SKIP;
-+	}
-+
-+	*info = nla_get_u8(attr);
-+	return NL_SKIP;
-+}
-+
-+
-+static int nl80211_get_edcca(void *priv, const u8 mode, u8 *value)
-+{
-+	struct i802_bss *bss = priv;
-+	struct wpa_driver_nl80211_data *drv = bss->drv;
-+	struct nl_msg *msg;
-+	struct nlattr *data;
-+	int ret;
-+
-+	if (!drv->mtk_edcca_vendor_cmd_avail) {
-+		wpa_printf(MSG_INFO,
-+			   "nl80211: Driver does not support setting EDCCA threshold");
-+		return 0;
-+	}
-+
-+	if (!(msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR)) ||
-+	    nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
-+	    nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
-+			MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL) ||
-+	    !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA | NLA_F_NESTED)) ||
-+	    nla_put_u8(msg, MTK_VENDOR_ATTR_EDCCA_CTRL_MODE, mode)) {
-+		wpa_printf (MSG_ERROR, "Prepare nl80211 msg fail");
-+		nlmsg_free(msg);
-+		return -ENOBUFS;
-+	}
-+	nla_nest_end(msg, data);
-+	ret = send_and_recv_msgs(drv, msg, edcca_info_handler, value, NULL, NULL);
-+	if (ret) {
-+		wpa_printf(MSG_ERROR, "Failed to get EDCCA configuration. ret=%d (%s)",
-+			   ret, strerror(-ret));
-+	}
-+	return ret;
-+}
-+
- 
- const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.name = "nl80211",
-@@ -12514,4 +12675,8 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.register_frame = testing_nl80211_register_frame,
- 	.radio_disable = testing_nl80211_radio_disable,
- #endif /* CONFIG_TESTING_OPTIONS */
-+/* Need ifdef CONFIG_DRIVER_NL80211_MTK */
-+	.configure_edcca_enable = nl80211_configure_edcca_enable,
-+	.configure_edcca_threshold = nl80211_configure_edcca_threshold,
-+	.get_edcca = nl80211_get_edcca,
- };
-diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 6e40d55..13e5d24 100644
---- a/src/drivers/driver_nl80211.h
-+++ b/src/drivers/driver_nl80211.h
-@@ -181,6 +181,7 @@ struct wpa_driver_nl80211_data {
- 	unsigned int qca_do_acs:1;
- 	unsigned int brcm_do_acs:1;
- 	unsigned int uses_6ghz:1;
-+	unsigned int mtk_edcca_vendor_cmd_avail:1;
- 
- 	u64 vendor_scan_cookie;
- 	u64 remain_on_chan_cookie;
-diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index 7ede0d0..732ae29 100644
---- a/src/drivers/driver_nl80211_capa.c
-+++ b/src/drivers/driver_nl80211_capa.c
-@@ -18,6 +18,7 @@
- #include "common/qca-vendor-attr.h"
- #include "common/brcm_vendor.h"
- #include "driver_nl80211.h"
-+#include "common/mtk_vendor.h"
- 
- 
- static int protocol_feature_handler(struct nl_msg *msg, void *arg)
-@@ -1050,6 +1051,12 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
- 					break;
- 				}
- #endif /* CONFIG_DRIVER_NL80211_BRCM */
-+			} else if (vinfo->vendor_id == OUI_MTK) {
-+				switch (vinfo->subcmd) {
-+				case MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL :
-+					drv->mtk_edcca_vendor_cmd_avail = 1;
-+					break;
-+				}
- 			}
- 
- 			wpa_printf(MSG_DEBUG, "nl80211: Supported vendor command: vendor_id=0x%x subcmd=%u",
--- 
-2.36.1
-
diff --git a/recipes-wifi/wpa-supplicant/files/patches/99913-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch b/recipes-wifi/wpa-supplicant/files/patches/99913-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
deleted file mode 100644
index 572cdd1..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches/99913-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
+++ /dev/null
@@ -1,450 +0,0 @@
-From fe664c759cb79e130d35f6dd0236e9cb33320f70 Mon Sep 17 00:00:00 2001
-From: TomLiu <tomml.liu@mediatek.com>
-Date: Tue, 9 Aug 2022 10:23:44 -0700
-Subject: [PATCH 99913/99917] Add hostapd HEMU SET/GET control
-
----
- hostapd/config_file.c             |   9 +++
- hostapd/ctrl_iface.c              |  62 +++++++++++++++++
- hostapd/hostapd_cli.c             |  18 +++++
- src/ap/ap_config.c                |   1 +
- src/ap/ap_config.h                |   1 +
- src/ap/ap_drv_ops.c               |  14 ++++
- src/ap/ap_drv_ops.h               |   2 +
- src/ap/hostapd.c                  |   2 +
- src/common/mtk_vendor.h           |  15 ++++
- src/drivers/driver.h              |  13 ++++
- src/drivers/driver_nl80211.c      | 110 ++++++++++++++++++++++++++++++
- src/drivers/driver_nl80211.h      |   1 +
- src/drivers/driver_nl80211_capa.c |   3 +
- 13 files changed, 251 insertions(+)
-
-diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 0ee8952..b22d10b 100644
---- a/hostapd/config_file.c
-+++ b/hostapd/config_file.c
-@@ -3659,6 +3659,15 @@ static int hostapd_config_fill(struct hostapd_config *conf,
- 			return 1;
- 		}
- 		bss->unsol_bcast_probe_resp_interval = val;
-+	} else if (os_strcmp(buf, "hemu_onoff") == 0) {
-+		int val = atoi(pos);
-+		if (val < 0 || val > 15) {
-+			wpa_printf(MSG_ERROR,
-+				   "Line %d: invalid hemu_onoff value",
-+				   line);
-+			return 1;
-+		}
-+		conf->hemu_onoff = val;
- #endif /* CONFIG_IEEE80211AX */
- 	} else if (os_strcmp(buf, "max_listen_interval") == 0) {
- 		bss->max_listen_interval = atoi(pos);
-diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 9c70d54..5f71aee 100644
---- a/hostapd/ctrl_iface.c
-+++ b/hostapd/ctrl_iface.c
-@@ -3441,6 +3441,63 @@ hostapd_ctrl_iface_get_edcca(struct hostapd_data *hapd, char *cmd, char *buf,
- }
- 
- 
-+static int
-+hostapd_ctrl_iface_set_hemu(struct hostapd_data *hapd, char *cmd,
-+					 char *buf, size_t buflen)
-+{
-+	char *pos, *config, *value;
-+	config = cmd;
-+	pos = os_strchr(config, ' ');
-+	if (pos == NULL)
-+		return -1;
-+	*pos++ = '\0';
-+
-+	if(pos == NULL)
-+		return -1;
-+	value = pos;
-+
-+	if (os_strcmp(config, "onoff") == 0) {
-+		int hemu = atoi(value);
-+		if (hemu < 0 || hemu > 15) {
-+			wpa_printf(MSG_ERROR, "Invalid value for hemu");
-+			return -1;
-+		}
-+		hapd->iconf->hemu_onoff = (u8) hemu;
-+	} else {
-+		wpa_printf(MSG_ERROR,
-+			"Unsupported parameter %s for SET_HEMU", config);
-+		return -1;
-+	}
-+
-+	if(hostapd_drv_hemu_ctrl(hapd) == 0) {
-+		return os_snprintf(buf, buflen, "OK\n");
-+	} else {
-+		return -1;
-+	}
-+}
-+
-+
-+static int
-+hostapd_ctrl_iface_get_hemu(struct hostapd_data *hapd, char *buf,
-+					 size_t buflen)
-+{
-+	u8 hemu_onoff;
-+	char *pos, *end;
-+
-+	pos = buf;
-+	end = buf + buflen;
-+
-+	if (hostapd_drv_hemu_dump(hapd, &hemu_onoff) == 0) {
-+		hapd->iconf->hemu_onoff = hemu_onoff;
-+		return os_snprintf(pos, end - pos, "[hostapd_cli] = UL MU-MIMO: %d, DL MU-MIMO: %d, UL OFDMA: %d, DL OFDMA: %d\n",
-+			!!(hemu_onoff&BIT(3)), !!(hemu_onoff&BIT(2)), !!(hemu_onoff&BIT(1)), !!(hemu_onoff&BIT(0)));
-+	} else {
-+		wpa_printf(MSG_INFO, "ctrl iface failed to call");
-+		return -1;
-+	}
-+}
-+
-+
- static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
- 					      char *buf, char *reply,
- 					      int reply_size,
-@@ -3993,6 +4050,11 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
- 	} else if (os_strncmp(buf, "GET_EDCCA ", 10) == 0) {
- 		reply_len = hostapd_ctrl_iface_get_edcca(hapd, buf+10, reply,
- 							  reply_size);
-+	} else if (os_strncmp(buf, "SET_HEMU ", 9) == 0) {
-+		reply_len = hostapd_ctrl_iface_set_hemu(hapd, buf+9, reply,
-+							  reply_size);
-+	} else if (os_strncmp(buf, "GET_HEMU", 8) == 0) {
-+		reply_len = hostapd_ctrl_iface_get_hemu(hapd, reply, reply_size);
- 	} else {
- 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
- 		reply_len = 16;
-diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index db21258..0d36477 100644
---- a/hostapd/hostapd_cli.c
-+++ b/hostapd/hostapd_cli.c
-@@ -1380,6 +1380,20 @@ static int hostapd_cli_cmd_driver_flags(struct wpa_ctrl *ctrl, int argc,
- }
- 
- 
-+static int hostapd_cli_cmd_set_hemu(struct wpa_ctrl *ctrl, int argc,
-+					   char *argv[])
-+{
-+	return hostapd_cli_cmd(ctrl, "SET_HEMU", 1, argc, argv);
-+}
-+
-+
-+static int hostapd_cli_cmd_get_hemu(struct wpa_ctrl *ctrl, int argc,
-+					   char *argv[])
-+{
-+	return hostapd_cli_cmd(ctrl, "GET_HEMU", 0, NULL, NULL);
-+}
-+
-+
- #ifdef CONFIG_DPP
- 
- static int hostapd_cli_cmd_dpp_qr_code(struct wpa_ctrl *ctrl, int argc,
-@@ -1705,6 +1719,10 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
- 	  " = send FTM range request"},
- 	{ "driver_flags", hostapd_cli_cmd_driver_flags, NULL,
- 	  " = show supported driver flags"},
-+	{ "set_hemu", hostapd_cli_cmd_set_hemu, NULL,
-+		"<value> [0-15] bitmap- UL MU-MIMO(bit3), DL MU-MIMO(bit2), UL OFDMA(bit1), DL OFDMA(bit0)"},
-+	{ "get_hemu", hostapd_cli_cmd_get_hemu, NULL,
-+		" = show hemu onoff value in 0-15 bitmap"},
- #ifdef CONFIG_DPP
- 	{ "dpp_qr_code", hostapd_cli_cmd_dpp_qr_code, NULL,
- 	  "report a scanned DPP URI from a QR Code" },
-diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 344585a..0e1f192 100644
---- a/src/ap/ap_config.c
-+++ b/src/ap/ap_config.c
-@@ -280,6 +280,7 @@ struct hostapd_config * hostapd_config_defaults(void)
- 	conf->he_6ghz_max_ampdu_len_exp = 7;
- 	conf->he_6ghz_rx_ant_pat = 1;
- 	conf->he_6ghz_tx_ant_pat = 1;
-+	conf->hemu_onoff = 13;
- #endif /* CONFIG_IEEE80211AX */
- 
- 	/* The third octet of the country string uses an ASCII space character
-diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 775c567..41b8c68 100644
---- a/src/ap/ap_config.h
-+++ b/src/ap/ap_config.h
-@@ -1114,6 +1114,7 @@ struct hostapd_config {
- 	u8 he_6ghz_rx_ant_pat;
- 	u8 he_6ghz_tx_ant_pat;
- 	u8 he_6ghz_reg_pwr_type;
-+	u8 hemu_onoff;
- #endif /* CONFIG_IEEE80211AX */
- 
- 	/* VHT enable/disable config from CHAN_SWITCH */
-diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 25e967d..4598737 100644
---- a/src/ap/ap_drv_ops.c
-+++ b/src/ap/ap_drv_ops.c
-@@ -1039,3 +1039,17 @@ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value)
- 		return 0;
- 	return hapd->driver->get_edcca(hapd->drv_priv, mode, value);
- }
-+
-+int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd)
-+{
-+	if (!hapd->driver || !hapd->driver->hemu_ctrl)
-+		return 0;
-+	return hapd->driver->hemu_ctrl(hapd->drv_priv, hapd->iconf->hemu_onoff);
-+}
-+
-+int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff)
-+{
-+	if (!hapd->driver || !hapd->driver->hemu_dump)
-+		return 0;
-+	return hapd->driver->hemu_dump(hapd->drv_priv, hemu_onoff);
-+}
-diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index 70a99f4..bca39c5 100644
---- a/src/ap/ap_drv_ops.h
-+++ b/src/ap/ap_drv_ops.h
-@@ -142,6 +142,8 @@ int hostapd_drv_configure_edcca_enable(struct hostapd_data *hapd);
- int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
- 					  const int *threshold);
- int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
-+int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd);
-+int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
- 
- #include "drivers/driver.h"
- 
-diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index d05f948..921769d 100644
---- a/src/ap/hostapd.c
-+++ b/src/ap/hostapd.c
-@@ -2301,6 +2301,8 @@ dfs_offload:
- 	if (hostapd_drv_configure_edcca_threshold(hapd,
- 						  hapd->iconf->edcca_threshold) < 0)
- 		goto fail;
-+	if (hostapd_drv_hemu_ctrl(hapd) < 0)
-+		goto fail;
- 
- 	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
- 		   iface->bss[0]->conf->iface);
-diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 7056126..69a46df 100644
---- a/src/common/mtk_vendor.h
-+++ b/src/common/mtk_vendor.h
-@@ -10,6 +10,8 @@ enum mtk_nl80211_vendor_subcmds {
- 	MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
- 	MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
- 	MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
-+	MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
-+	MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL= 0xc6,
- 	MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
- };
- 
-@@ -174,6 +176,19 @@ enum mtk_vendor_attr_rfeature_ctrl {
- 		NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL - 1
- };
- 
-+enum mtk_vendor_attr_hemu_ctrl {
-+	MTK_VENDOR_ATTR_HEMU_CTRL_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF,
-+	MTK_VENDOR_ATTR_HEMU_CTRL_DUMP,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_HEMU_CTRL,
-+	MTK_VENDOR_ATTR_HEMU_CTRL_MAX =
-+		NUM_MTK_VENDOR_ATTRS_HEMU_CTRL - 1
-+};
-+
-+
- #define CSI_MAX_COUNT 256
- #define ETH_ALEN 6
- 
-diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 3559974..4cd7505 100644
---- a/src/drivers/driver.h
-+++ b/src/drivers/driver.h
-@@ -1623,6 +1623,11 @@ struct wpa_driver_ap_params {
- 	 * Unsolicited broadcast Probe Response template length
- 	 */
- 	size_t unsol_bcast_probe_resp_tmpl_len;
-+
-+	/**
-+	 * hemu onoff=<val> (bitmap- UL MU-MIMO(bit3), DL MU-MIMO(bit2), UL OFDMA(bit1), DL OFDMA(bit0))
-+	 */
-+	u8 hemu_onoff;
- };
- 
- struct wpa_driver_mesh_bss_params {
-@@ -4680,6 +4685,14 @@ struct wpa_driver_ops {
- 				  const s8 edcca_compensation);
- 	int (*configure_edcca_threshold)(void *priv, const int *threshold);
- 	int (*get_edcca)(void *priv, const u8 mode, u8 *value);
-+
-+	/**
-+	 * hemu_ctrl - ctrl on off for UL/DL MURU
-+	 * @priv: Private driver interface data
-+	 *
-+	 */
-+	 int (*hemu_ctrl)(void *priv, u8 hemu_onoff);
-+	 int (*hemu_dump)(void *priv, u8 *hemu_onoff);
- };
- 
- /**
-diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 9c2782c..73dee2e 100644
---- a/src/drivers/driver_nl80211.c
-+++ b/src/drivers/driver_nl80211.c
-@@ -12304,6 +12304,114 @@ fail:
- }
- 
- 
-+#ifdef CONFIG_IEEE80211AX
-+static int nl80211_hemu_muruonoff(void *priv, u8 hemu_onoff)
-+{
-+	struct i802_bss *bss = priv;
-+	struct wpa_driver_nl80211_data *drv = bss->drv;
-+	struct nl_msg *msg;
-+	struct nlattr *data;
-+	int ret;
-+
-+	if (!drv->mtk_hemu_vendor_cmd_avail) {
-+		wpa_printf(MSG_INFO,
-+			   "nl80211: Driver does not support setting hemu control");
-+		return 0;
-+	}
-+
-+	if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
-+		nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
-+		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL) ||
-+		!(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
-+		nla_put_u8(msg, MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF, hemu_onoff)) {
-+		nlmsg_free(msg);
-+		return -ENOBUFS;
-+	}
-+	nla_nest_end(msg, data);
-+	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
-+	if(ret){
-+		wpa_printf(MSG_ERROR, "Failed to set hemu_onoff. ret=%d (%s)", ret, strerror(-ret));
-+	}
-+	return ret;
-+}
-+
-+
-+static int hemu_dump_handler(struct nl_msg *msg, void *arg)
-+{
-+	u8 *hemu_onoff = (u8 *) arg;
-+	struct nlattr *tb[NL80211_ATTR_MAX + 1];
-+	struct nlattr *tb_vendor[MTK_VENDOR_ATTR_HEMU_CTRL_MAX + 1];
-+	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
-+	struct nlattr *nl_vend, *attr;
-+
-+	static const struct nla_policy
-+	hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL + 1] = {
-+		[MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF] = {.type = NLA_U8 },
-+		[MTK_VENDOR_ATTR_HEMU_CTRL_DUMP] = {.type = NLA_U8 },
-+	};
-+
-+	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
-+			genlmsg_attrlen(gnlh, 0), NULL);
-+
-+	nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
-+	if (!nl_vend)
-+		return NL_SKIP;
-+
-+	nla_parse(tb_vendor, MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
-+		  nla_data(nl_vend), nla_len(nl_vend), NULL);
-+
-+	attr = tb_vendor[MTK_VENDOR_ATTR_HEMU_CTRL_DUMP];
-+	if (!attr) {
-+		wpa_printf(MSG_ERROR, "nl80211: cannot find MTK_VENDOR_ATTR_HEMU_CTRL_DUMP");
-+		return NL_SKIP;
-+	}
-+
-+	*hemu_onoff = nla_get_u8(attr);
-+	wpa_printf(MSG_DEBUG, "nla_get hemu_onoff: %d\n", *hemu_onoff);
-+
-+	return 0;
-+}
-+
-+static int nl80211_hemu_dump(void *priv, u8 *hemu_onoff)
-+{
-+	struct i802_bss *bss = priv;
-+	struct wpa_driver_nl80211_data *drv = bss->drv;
-+	struct nl_msg *msg;
-+	struct nlattr *attr;
-+	int ret;
-+
-+	if (!drv->mtk_hemu_vendor_cmd_avail) {
-+		wpa_printf(MSG_INFO,
-+			   "nl80211: Driver does not support setting hemu control");
-+		return 0;
-+	}
-+
-+	if (!(msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR)) ||
-+		nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
-+		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL)) {
-+		nlmsg_free(msg);
-+		return -ENOBUFS;
-+	}
-+
-+  attr = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
-+	if (!attr) {
-+		nlmsg_free(msg);
-+		return -1;
-+	}
-+
-+	nla_nest_end(msg, attr);
-+
-+	ret = send_and_recv_msgs(drv, msg, hemu_dump_handler, hemu_onoff, NULL, NULL);
-+
-+	if(ret){
-+		wpa_printf(MSG_ERROR, "Failed to get hemu_onoff. ret=%d (%s)", ret, strerror(-ret));
-+	}
-+
-+	return ret;
-+}
-+#endif /* CONFIG_IEEE80211AX */
-+
-+
- #ifdef CONFIG_DPP
- static int nl80211_dpp_listen(void *priv, bool enable)
- {
-@@ -12668,6 +12776,8 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.update_connect_params = nl80211_update_connection_params,
- 	.send_external_auth_status = nl80211_send_external_auth_status,
- 	.set_4addr_mode = nl80211_set_4addr_mode,
-+	.hemu_ctrl = nl80211_hemu_muruonoff,
-+	.hemu_dump = nl80211_hemu_dump,
- #ifdef CONFIG_DPP
- 	.dpp_listen = nl80211_dpp_listen,
- #endif /* CONFIG_DPP */
-diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 13e5d24..57f0249 100644
---- a/src/drivers/driver_nl80211.h
-+++ b/src/drivers/driver_nl80211.h
-@@ -182,6 +182,7 @@ struct wpa_driver_nl80211_data {
- 	unsigned int brcm_do_acs:1;
- 	unsigned int uses_6ghz:1;
- 	unsigned int mtk_edcca_vendor_cmd_avail:1;
-+	unsigned int mtk_hemu_vendor_cmd_avail:1;
- 
- 	u64 vendor_scan_cookie;
- 	u64 remain_on_chan_cookie;
-diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index 732ae29..cc146d9 100644
---- a/src/drivers/driver_nl80211_capa.c
-+++ b/src/drivers/driver_nl80211_capa.c
-@@ -1056,6 +1056,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
- 				case MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL :
- 					drv->mtk_edcca_vendor_cmd_avail = 1;
- 					break;
-+				case MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL :
-+					drv->mtk_hemu_vendor_cmd_avail = 1;
-+					break;
- 				}
- 			}
- 
--- 
-2.36.1
-
diff --git a/recipes-wifi/wpa-supplicant/files/patches/99914-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch b/recipes-wifi/wpa-supplicant/files/patches/99914-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch
deleted file mode 100644
index ca64eb8..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches/99914-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch
+++ /dev/null
@@ -1,246 +0,0 @@
-From 4707ed85884be2ffe7860e28de80df5a6e479824 Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Fri, 2 Sep 2022 01:03:23 +0800
-Subject: [PATCH 99914/99917] Add three wire PTA ctrl hostapd vendor command
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- hostapd/config_file.c             |  4 ++++
- src/ap/ap_config.c                |  1 +
- src/ap/ap_config.h                | 13 ++++++++++++
- src/ap/ap_drv_ops.c               | 11 +++++++++++
- src/ap/ap_drv_ops.h               |  1 +
- src/ap/hostapd.c                  |  2 ++
- src/common/mtk_vendor.h           | 16 +++++++++++++++
- src/drivers/driver.h              |  8 ++++++++
- src/drivers/driver_nl80211.c      | 33 +++++++++++++++++++++++++++++++
- src/drivers/driver_nl80211.h      |  1 +
- src/drivers/driver_nl80211_capa.c |  3 +++
- 11 files changed, 93 insertions(+)
-
-diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index b22d10b..18b372a 100644
---- a/hostapd/config_file.c
-+++ b/hostapd/config_file.c
-@@ -4794,6 +4794,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
- 			return 1;
- 		}
- 		conf->edcca_compensation = (s8) val;
-+	} else if (os_strcmp(buf, "three_wire_enable") == 0) {
-+		u8 en = atoi(pos);
-+
-+		conf->three_wire_enable = en;
- 	} else {
- 		wpa_printf(MSG_ERROR,
- 			   "Line %d: unknown configuration item '%s'",
-diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 0e1f192..9249a6b 100644
---- a/src/ap/ap_config.c
-+++ b/src/ap/ap_config.c
-@@ -297,6 +297,7 @@ struct hostapd_config * hostapd_config_defaults(void)
- 
- 	conf->edcca_enable = EDCCA_MODE_AUTO;
- 	conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
-+	conf->three_wire_enable = THREE_WIRE_MODE_DISABLE;
- 
- 	return conf;
- }
-diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 41b8c68..71cf515 100644
---- a/src/ap/ap_config.h
-+++ b/src/ap/ap_config.h
-@@ -1157,6 +1157,19 @@ struct hostapd_config {
- 	u8 edcca_enable;
- 	s8 edcca_compensation;
- 	int *edcca_threshold;
-+	u8 three_wire_enable;
-+};
-+
-+enum three_wire_mode {
-+	THREE_WIRE_MODE_DISABLE,
-+	THREE_WIRE_MODE_EXT0_ENABLE,
-+	THREE_WIRE_MODE_EXT1_ENABLE,
-+	THREE_WIRE_MODE_ALL_ENABLE,
-+
-+	/* keep last */
-+	NUM_THREE_WIRE_MODE,
-+	THREE_WIRE_MODE_MAX =
-+		NUM_THREE_WIRE_MODE - 1
- };
- 
- enum edcca_mode {
-diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 4598737..a1d83e4 100644
---- a/src/ap/ap_drv_ops.c
-+++ b/src/ap/ap_drv_ops.c
-@@ -1053,3 +1053,14 @@ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff)
- 		return 0;
- 	return hapd->driver->hemu_dump(hapd->drv_priv, hemu_onoff);
- }
-+
-+int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd)
-+{
-+	if (!hapd->driver || !hapd->driver->three_wire_ctrl)
-+		return 0;
-+	if (hapd->iconf->three_wire_enable > THREE_WIRE_MODE_MAX) {
-+		wpa_printf(MSG_INFO, "Invalid value for three wire enable\n");
-+		return 0;
-+	}
-+	return hapd->driver->three_wire_ctrl(hapd->drv_priv, hapd->iconf->three_wire_enable);
-+}
-diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index bca39c5..5ba6297 100644
---- a/src/ap/ap_drv_ops.h
-+++ b/src/ap/ap_drv_ops.h
-@@ -144,6 +144,7 @@ int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
- int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
- int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd);
- int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
-+int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd);
- 
- #include "drivers/driver.h"
- 
-diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index 921769d..f9dabdf 100644
---- a/src/ap/hostapd.c
-+++ b/src/ap/hostapd.c
-@@ -2303,6 +2303,8 @@ dfs_offload:
- 		goto fail;
- 	if (hostapd_drv_hemu_ctrl(hapd) < 0)
- 		goto fail;
-+	if (hostapd_drv_three_wire_ctrl(hapd) < 0)
-+		goto fail;
- 
- 	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
- 		   iface->bss[0]->conf->iface);
-diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 69a46df..ee5a4f4 100644
---- a/src/common/mtk_vendor.h
-+++ b/src/common/mtk_vendor.h
-@@ -13,6 +13,7 @@ enum mtk_nl80211_vendor_subcmds {
- 	MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
- 	MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL= 0xc6,
- 	MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
-+	MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8
- };
- 
- enum mtk_vendor_attr_edcca_ctrl {
-@@ -55,6 +56,21 @@ static struct nla_policy edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
- 	[MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE] = { .type = NLA_U8 },
- };
- 
-+enum mtk_vendor_attr_3wire_ctrl {
-+	MTK_VENDOR_ATTR_3WIRE_CTRL_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_3WIRE_CTRL_MODE,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL,
-+	MTK_VENDOR_ATTR_3WIRE_CTRL_MAX =
-+		NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL - 1
-+};
-+
-+static struct nla_policy three_wire_ctrl_policy[NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL] = {
-+	[MTK_VENDOR_ATTR_3WIRE_CTRL_MODE] = {.type = NLA_U8 },
-+};
-+
- enum mtk_vendor_attr_csi_ctrl {
- 	MTK_VENDOR_ATTR_CSI_CTRL_UNSPEC,
- 
-diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 4cd7505..9ca19af 100644
---- a/src/drivers/driver.h
-+++ b/src/drivers/driver.h
-@@ -4693,6 +4693,14 @@ struct wpa_driver_ops {
- 	 */
- 	 int (*hemu_ctrl)(void *priv, u8 hemu_onoff);
- 	 int (*hemu_dump)(void *priv, u8 *hemu_onoff);
-+
-+	/**
-+	 * three_wire_ctrl - set three_wire_ctrl mode
-+	 * @priv: Private driver interface data
-+	 * @three_wire_enable: three_wire_ctrl mode
-+	 *
-+	 */
-+	 int (*three_wire_ctrl)(void *priv, u8 three_wire_enable);
- };
- 
- /**
-diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 73dee2e..2bb8cc2 100644
---- a/src/drivers/driver_nl80211.c
-+++ b/src/drivers/driver_nl80211.c
-@@ -12637,6 +12637,38 @@ static int nl80211_get_edcca(void *priv, const u8 mode, u8 *value)
- 	return ret;
- }
- 
-+static int nl80211_enable_three_wire(void *priv, const u8 three_wire_enable)
-+{
-+	struct i802_bss *bss = priv;
-+	struct wpa_driver_nl80211_data *drv = bss->drv;
-+	/* Prepare nl80211 cmd */
-+	struct nl_msg *msg;
-+	struct nlattr *data;
-+	int ret;
-+
-+	if (!drv->mtk_3wire_vendor_cmd_avail) {
-+		wpa_printf(MSG_INFO,
-+			   "nl80211: Driver does not support setting three wire control");
-+		return 0;
-+	}
-+
-+	if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
-+	    nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
-+	    nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
-+			MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL) ||
-+	    !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
-+	    nla_put_u8(msg, MTK_VENDOR_ATTR_3WIRE_CTRL_MODE, three_wire_enable)) {
-+		nlmsg_free(msg);
-+		return -ENOBUFS;
-+	}
-+	nla_nest_end(msg, data);
-+	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
-+	if (ret) {
-+		wpa_printf(MSG_ERROR, "Failed to enable three wire. ret=%d (%s) ",
-+			   ret, strerror(-ret));
-+	}
-+	return ret;
-+}
- 
- const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.name = "nl80211",
-@@ -12789,4 +12821,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.configure_edcca_enable = nl80211_configure_edcca_enable,
- 	.configure_edcca_threshold = nl80211_configure_edcca_threshold,
- 	.get_edcca = nl80211_get_edcca,
-+	.three_wire_ctrl = nl80211_enable_three_wire,
- };
-diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 57f0249..9fe7811 100644
---- a/src/drivers/driver_nl80211.h
-+++ b/src/drivers/driver_nl80211.h
-@@ -183,6 +183,7 @@ struct wpa_driver_nl80211_data {
- 	unsigned int uses_6ghz:1;
- 	unsigned int mtk_edcca_vendor_cmd_avail:1;
- 	unsigned int mtk_hemu_vendor_cmd_avail:1;
-+	unsigned int mtk_3wire_vendor_cmd_avail:1;
- 
- 	u64 vendor_scan_cookie;
- 	u64 remain_on_chan_cookie;
-diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index cc146d9..04bc54e 100644
---- a/src/drivers/driver_nl80211_capa.c
-+++ b/src/drivers/driver_nl80211_capa.c
-@@ -1059,6 +1059,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
- 				case MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL :
- 					drv->mtk_hemu_vendor_cmd_avail = 1;
- 					break;
-+				case MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL :
-+					drv->mtk_3wire_vendor_cmd_avail = 1;
-+					break;
- 				}
- 			}
- 
--- 
-2.36.1
-
diff --git a/recipes-wifi/wpa-supplicant/files/patches/99915-hostapd-mtk-Add-hostapd-iBF-control.patch b/recipes-wifi/wpa-supplicant/files/patches/99915-hostapd-mtk-Add-hostapd-iBF-control.patch
deleted file mode 100644
index a50cb9e..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches/99915-hostapd-mtk-Add-hostapd-iBF-control.patch
+++ /dev/null
@@ -1,431 +0,0 @@
-From e177f5069ff7e8f024676cf9d0e4af135cfea95b Mon Sep 17 00:00:00 2001
-From: mtk27835 <shurong.wen@mediatek.com>
-Date: Wed, 7 Sep 2022 14:41:51 -0700
-Subject: [PATCH 99915/99917] Add hostapd iBF control
-
-Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
----
- hostapd/config_file.c             |   3 +
- hostapd/ctrl_iface.c              |  26 +++++++
- hostapd/hostapd_cli.c             |   9 +++
- src/ap/ap_config.c                |   1 +
- src/ap/ap_config.h                |   2 +
- src/ap/ap_drv_ops.c               |  14 ++++
- src/ap/ap_drv_ops.h               |   2 +
- src/ap/hostapd.c                  |   2 +
- src/common/mtk_vendor.h           |  35 +++++++++-
- src/drivers/driver.h              |  19 ++++++
- src/drivers/driver_nl80211.c      | 108 ++++++++++++++++++++++++++++++
- src/drivers/driver_nl80211.h      |   1 +
- src/drivers/driver_nl80211_capa.c |   3 +
- 13 files changed, 224 insertions(+), 1 deletion(-)
-
-diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 18b372a..d9d882c 100644
---- a/hostapd/config_file.c
-+++ b/hostapd/config_file.c
-@@ -4798,6 +4798,9 @@ static int hostapd_config_fill(struct hostapd_config *conf,
- 		u8 en = atoi(pos);
- 
- 		conf->three_wire_enable = en;
-+	} else if (os_strcmp(buf, "ibf_enable") == 0) { /*ibf setting is per device*/
-+		int val = atoi(pos);
-+		conf->ibf_enable = !!val;
- 	} else {
- 		wpa_printf(MSG_ERROR,
- 			   "Line %d: unknown configuration item '%s'",
-diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 5f71aee..c881d37 100644
---- a/hostapd/ctrl_iface.c
-+++ b/hostapd/ctrl_iface.c
-@@ -3498,6 +3498,30 @@ hostapd_ctrl_iface_get_hemu(struct hostapd_data *hapd, char *buf,
- }
- 
- 
-+static int
-+hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
-+					 size_t buflen)
-+{
-+	u8 ibf_enable;
-+	int ret;
-+	char *pos, *end;
-+
-+	pos = buf;
-+	end = buf + buflen;
-+
-+	if (hostapd_drv_ibf_dump(hapd, &ibf_enable) == 0) {
-+		hapd->iconf->ibf_enable = ibf_enable;
-+		ret = os_snprintf(pos, end - pos, "ibf_enable: %u\n",
-+			  ibf_enable);
-+	}
-+
-+	if (os_snprintf_error(end - pos, ret))
-+		return 0;
-+
-+	return ret;
-+}
-+
-+
- static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
- 					      char *buf, char *reply,
- 					      int reply_size,
-@@ -4055,6 +4079,8 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
- 							  reply_size);
- 	} else if (os_strncmp(buf, "GET_HEMU", 8) == 0) {
- 		reply_len = hostapd_ctrl_iface_get_hemu(hapd, reply, reply_size);
-+	} else if (os_strncmp(buf, "GET_IBF", 7) == 0) {
-+		reply_len = hostapd_ctrl_iface_get_ibf(hapd, reply, reply_size);
- 	} else {
- 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
- 		reply_len = 16;
-diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index 0d36477..c2a123a 100644
---- a/hostapd/hostapd_cli.c
-+++ b/hostapd/hostapd_cli.c
-@@ -1586,6 +1586,13 @@ static int hostapd_cli_cmd_driver(struct wpa_ctrl *ctrl, int argc, char *argv[])
- #endif /* ANDROID */
- 
- 
-+static int hostapd_cli_cmd_get_ibf(struct wpa_ctrl *ctrl, int argc,
-+					   char *argv[])
-+{
-+	return hostapd_cli_cmd(ctrl, "GET_IBF", 0, NULL, NULL);
-+}
-+
-+
- struct hostapd_cli_cmd {
- 	const char *cmd;
- 	int (*handler)(struct wpa_ctrl *ctrl, int argc, char *argv[]);
-@@ -1787,6 +1794,8 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
- #endif /* ANDROID */
- 	{ "inband_discovery", hostapd_cli_cmd_inband_discovery, NULL,
-           "<tx type(0/1/2)> <interval> = runtime set inband discovery" },
-+	{ "get_ibf", hostapd_cli_cmd_get_ibf, NULL,
-+	  " = show iBF state (enabled/disabled)"},
- 	{ NULL, NULL, NULL, NULL }
- };
- 
-diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 9249a6b..7a96cb8 100644
---- a/src/ap/ap_config.c
-+++ b/src/ap/ap_config.c
-@@ -298,6 +298,7 @@ struct hostapd_config * hostapd_config_defaults(void)
- 	conf->edcca_enable = EDCCA_MODE_AUTO;
- 	conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
- 	conf->three_wire_enable = THREE_WIRE_MODE_DISABLE;
-+	conf->ibf_enable = IBF_DEFAULT_ENABLE;
- 
- 	return conf;
- }
-diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 71cf515..44a0e7e 100644
---- a/src/ap/ap_config.h
-+++ b/src/ap/ap_config.h
-@@ -1158,6 +1158,7 @@ struct hostapd_config {
- 	s8 edcca_compensation;
- 	int *edcca_threshold;
- 	u8 three_wire_enable;
-+	u8 ibf_enable;
- };
- 
- enum three_wire_mode {
-@@ -1198,6 +1199,7 @@ enum mtk_vendor_attr_edcca_ctrl_mode {
- #define EDCCA_MIN_CONFIG_THRES -126
- #define EDCCA_MAX_CONFIG_THRES 0
- 
-+#define IBF_DEFAULT_ENABLE 0
- 
- static inline enum oper_chan_width
- hostapd_get_oper_chwidth(struct hostapd_config *conf)
-diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index a1d83e4..60ae825 100644
---- a/src/ap/ap_drv_ops.c
-+++ b/src/ap/ap_drv_ops.c
-@@ -1064,3 +1064,17 @@ int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd)
- 	}
- 	return hapd->driver->three_wire_ctrl(hapd->drv_priv, hapd->iconf->three_wire_enable);
- }
-+
-+int hostapd_drv_ibf_ctrl(struct hostapd_data *hapd)
-+{
-+	if (!hapd->driver || !hapd->driver->ibf_ctrl)
-+		return 0;
-+	return hapd->driver->ibf_ctrl(hapd->drv_priv, hapd->iconf->ibf_enable);
-+}
-+
-+int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable)
-+{
-+	if (!hapd->driver || !hapd->driver->ibf_dump)
-+		return 0;
-+	return hapd->driver->ibf_dump(hapd->drv_priv, ibf_enable);
-+}
-\ No newline at end of file
-diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index 5ba6297..ab9aedc 100644
---- a/src/ap/ap_drv_ops.h
-+++ b/src/ap/ap_drv_ops.h
-@@ -145,6 +145,8 @@ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
- int hostapd_drv_hemu_ctrl(struct hostapd_data *hapd);
- int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
- int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd);
-+int hostapd_drv_ibf_ctrl(struct hostapd_data *hapd);
-+int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable);
- 
- #include "drivers/driver.h"
- 
-diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index f9dabdf..e44b73d 100644
---- a/src/ap/hostapd.c
-+++ b/src/ap/hostapd.c
-@@ -2305,6 +2305,8 @@ dfs_offload:
- 		goto fail;
- 	if (hostapd_drv_three_wire_ctrl(hapd) < 0)
- 		goto fail;
-+	if (hostapd_drv_ibf_ctrl(hapd) < 0)
-+		goto fail;
- 
- 	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
- 		   iface->bss[0]->conf->iface);
-diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index ee5a4f4..4050cf8 100644
---- a/src/common/mtk_vendor.h
-+++ b/src/common/mtk_vendor.h
-@@ -13,7 +13,8 @@ enum mtk_nl80211_vendor_subcmds {
- 	MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
- 	MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL= 0xc6,
- 	MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
--	MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8
-+	MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8,
-+	MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL = 0xc9,
- };
- 
- enum mtk_vendor_attr_edcca_ctrl {
-@@ -204,6 +205,38 @@ enum mtk_vendor_attr_hemu_ctrl {
- 		NUM_MTK_VENDOR_ATTRS_HEMU_CTRL - 1
- };
- 
-+enum mtk_vendor_attr_ibf_ctrl {
-+	MTK_VENDOR_ATTR_IBF_CTRL_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_IBF_CTRL_ENABLE,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_IBF_CTRL,
-+	MTK_VENDOR_ATTR_IBF_CTRL_MAX =
-+		NUM_MTK_VENDOR_ATTRS_IBF_CTRL - 1
-+};
-+
-+enum mtk_vendor_attr_ibf_dump {
-+	MTK_VENDOR_ATTR_IBF_DUMP_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_IBF_DUMP_ENABLE,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_IBF_DUMP,
-+	MTK_VENDOR_ATTR_IBF_DUMP_MAX =
-+		NUM_MTK_VENDOR_ATTRS_IBF_DUMP - 1
-+};
-+
-+static struct nla_policy
-+ibf_ctrl_policy[NUM_MTK_VENDOR_ATTRS_IBF_CTRL] = {
-+	[MTK_VENDOR_ATTR_IBF_CTRL_ENABLE] = { .type = NLA_U8 },
-+};
-+
-+static struct nla_policy
-+ibf_dump_policy[NUM_MTK_VENDOR_ATTRS_IBF_DUMP] = {
-+	[MTK_VENDOR_ATTR_IBF_DUMP_ENABLE] = { .type = NLA_U8 },
-+};
-+
- 
- #define CSI_MAX_COUNT 256
- #define ETH_ALEN 6
-diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 9ca19af..71ded61 100644
---- a/src/drivers/driver.h
-+++ b/src/drivers/driver.h
-@@ -1628,6 +1628,11 @@ struct wpa_driver_ap_params {
- 	 * hemu onoff=<val> (bitmap- UL MU-MIMO(bit3), DL MU-MIMO(bit2), UL OFDMA(bit1), DL OFDMA(bit0))
- 	 */
- 	u8 hemu_onoff;
-+
-+	/**
-+	 * ibf_enable=<val>
-+	 */
-+	u8 ibf_enable;
- };
- 
- struct wpa_driver_mesh_bss_params {
-@@ -4701,6 +4706,20 @@ struct wpa_driver_ops {
- 	 *
- 	 */
- 	 int (*three_wire_ctrl)(void *priv, u8 three_wire_enable);
-+
-+	/**
-+	 * ibf_ctrl - ctrl disable/enable for ibf
-+	 * @priv: Private driver interface data
-+	 *
-+	 */
-+	int (*ibf_ctrl)(void *priv, u8 ibf_enable);
-+
-+	/**
-+	 * ibf_dump - dump ibf
-+	 * @priv: Private driver interface data
-+	 *
-+	 */
-+	int (*ibf_dump)(void *priv, u8 *ibf_enable);
- };
- 
- /**
-diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 2bb8cc2..e974f85 100644
---- a/src/drivers/driver_nl80211.c
-+++ b/src/drivers/driver_nl80211.c
-@@ -12670,6 +12670,112 @@ static int nl80211_enable_three_wire(void *priv, const u8 three_wire_enable)
- 	return ret;
- }
- 
-+static int nl80211_ibf_enable(void *priv, u8 ibf_enable)
-+{
-+	struct i802_bss *bss = priv;
-+	struct wpa_driver_nl80211_data *drv = bss->drv;
-+	struct nl_msg *msg;
-+	struct nlattr *data;
-+	int ret;
-+
-+	if (!drv->mtk_ibf_vendor_cmd_avail) {
-+		wpa_printf(MSG_INFO,
-+			   "nl80211: Driver does not support setting ibf control");
-+		return 0;
-+	}
-+
-+	msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
-+	if (!msg)
-+		goto fail;
-+
-+	if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
-+		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL))
-+		goto fail;
-+
-+	data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
-+	if (!data)
-+		goto fail;
-+
-+	nla_put_u8(msg, MTK_VENDOR_ATTR_IBF_CTRL_ENABLE, ibf_enable);
-+
-+	nla_nest_end(msg, data);
-+	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
-+	if (ret) {
-+		wpa_printf(MSG_ERROR, "Failed to set ibf_enable. ret=%d (%s)", ret, strerror(-ret));
-+	}
-+
-+	return ret;
-+
-+fail:
-+	nlmsg_free(msg);
-+	return -ENOBUFS;
-+}
-+
-+static int ibf_dump_handler(struct nl_msg *msg, void *arg)
-+{
-+	u8 *ibf_enable = (u8 *) arg;
-+	struct nlattr *tb[NL80211_ATTR_MAX + 1];
-+	struct nlattr *tb_vendor[MTK_VENDOR_ATTR_IBF_DUMP_MAX + 1];
-+	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
-+	struct nlattr *nl_vend, *attr;
-+
-+	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
-+			genlmsg_attrlen(gnlh, 0), NULL);
-+
-+	nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
-+	if (!nl_vend)
-+		return NL_SKIP;
-+
-+	nla_parse(tb_vendor, MTK_VENDOR_ATTR_IBF_DUMP_MAX,
-+			nla_data(nl_vend), nla_len(nl_vend), NULL);
-+
-+	attr = tb_vendor[MTK_VENDOR_ATTR_IBF_DUMP_ENABLE];
-+	if (!attr) {
-+		wpa_printf(MSG_ERROR, "nl80211: cannot find MTK_VENDOR_ATTR_IBF_DUMP_ENABLE");
-+		return NL_SKIP;
-+	}
-+
-+	*ibf_enable = nla_get_u8(attr);
-+
-+	return NL_SKIP;
-+}
-+
-+static int
-+nl80211_ibf_dump(void *priv, u8 *ibf_enable)
-+{
-+	struct i802_bss *bss = priv;
-+	struct wpa_driver_nl80211_data *drv = bss->drv;
-+	struct nl_msg *msg;
-+	struct nlattr *data;
-+	int ret;
-+
-+	msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR);
-+	if (!msg)
-+		goto fail;
-+
-+	if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
-+		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL))
-+		goto fail;
-+
-+	data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA | NLA_F_NESTED);
-+	if (!data)
-+		goto fail;
-+
-+	nla_nest_end(msg, data);
-+
-+	ret = send_and_recv_msgs(drv, msg, ibf_dump_handler, ibf_enable, NULL, NULL);
-+
-+	if (ret) {
-+		wpa_printf(MSG_ERROR, "Failed to dump ibf_enable. ret=%d (%s)", ret, strerror(-ret));
-+	}
-+
-+	return ret;
-+
-+fail:
-+	nlmsg_free(msg);
-+	return -ENOBUFS;
-+}
-+
- const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.name = "nl80211",
- 	.desc = "Linux nl80211/cfg80211",
-@@ -12822,4 +12928,6 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.configure_edcca_threshold = nl80211_configure_edcca_threshold,
- 	.get_edcca = nl80211_get_edcca,
- 	.three_wire_ctrl = nl80211_enable_three_wire,
-+	.ibf_ctrl = nl80211_ibf_enable,
-+	.ibf_dump = nl80211_ibf_dump,
- };
-diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 9fe7811..607592c 100644
---- a/src/drivers/driver_nl80211.h
-+++ b/src/drivers/driver_nl80211.h
-@@ -184,6 +184,7 @@ struct wpa_driver_nl80211_data {
- 	unsigned int mtk_edcca_vendor_cmd_avail:1;
- 	unsigned int mtk_hemu_vendor_cmd_avail:1;
- 	unsigned int mtk_3wire_vendor_cmd_avail:1;
-+	unsigned int mtk_ibf_vendor_cmd_avail:1;
- 
- 	u64 vendor_scan_cookie;
- 	u64 remain_on_chan_cookie;
-diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index 04bc54e..9ecc0ff 100644
---- a/src/drivers/driver_nl80211_capa.c
-+++ b/src/drivers/driver_nl80211_capa.c
-@@ -1062,6 +1062,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
- 				case MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL :
- 					drv->mtk_3wire_vendor_cmd_avail = 1;
- 					break;
-+				case MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL:
-+					drv->mtk_ibf_vendor_cmd_avail = 1;
-+					break;
- 				}
- 			}
- 
--- 
-2.36.1
-
diff --git a/recipes-wifi/wpa-supplicant/files/patches/99917-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch b/recipes-wifi/wpa-supplicant/files/patches/99917-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
deleted file mode 100644
index 83eac6e..0000000
--- a/recipes-wifi/wpa-supplicant/files/patches/99917-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch
+++ /dev/null
@@ -1,376 +0,0 @@
-From 80ecd3e0398aa668e683ff582a0594f88b290f44 Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Fri, 7 Oct 2022 10:46:29 +0800
-Subject: [PATCH 99917/99917] Add DFS and ZWDFS support
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- hostapd/config_file.c        |  4 ++
- hostapd/ctrl_iface.c         | 95 ++++++++++++++++++++++++++++++++++++
- src/ap/ap_config.h           | 13 +++++
- src/ap/dfs.c                 | 35 +++++++------
- src/ap/dfs.h                 | 15 ++++++
- src/ap/hostapd.c             |  4 +-
- src/drivers/driver.h         |  7 +++
- src/drivers/driver_nl80211.c | 29 +++++++++++
- src/drivers/nl80211_copy.h   |  1 +
- 9 files changed, 186 insertions(+), 17 deletions(-)
-
-diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index d9d882c..fd61448 100644
---- a/hostapd/config_file.c
-+++ b/hostapd/config_file.c
-@@ -4801,6 +4801,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
- 	} else if (os_strcmp(buf, "ibf_enable") == 0) { /*ibf setting is per device*/
- 		int val = atoi(pos);
- 		conf->ibf_enable = !!val;
-+	} else if (os_strcmp(buf, "dfs_detect_mode") == 0) { /*bypass channel switch*/
-+		u8 en = strtol(pos, NULL, 10);
-+
-+		conf->dfs_detect_mode = en;
- 	} else {
- 		wpa_printf(MSG_ERROR,
- 			   "Line %d: unknown configuration item '%s'",
-diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index c881d37..6ea1573 100644
---- a/hostapd/ctrl_iface.c
-+++ b/hostapd/ctrl_iface.c
-@@ -3522,6 +3522,96 @@ hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
- }
- 
- 
-+static int
-+hostapd_ctrl_iface_set_dfs_detect_mode(struct hostapd_data *hapd, char *value,
-+				       char *buf, size_t buflen)
-+{
-+	u8 dfs_detect_mode;
-+
-+	if (!value)
-+		return -1;
-+
-+	dfs_detect_mode = strtol(value, NULL, 10);
-+	if (dfs_detect_mode > DFS_DETECT_MODE_MAX) {
-+		wpa_printf(MSG_ERROR, "Invalid value for dfs detect mode");
-+		return -1;
-+	}
-+	hapd->iconf->dfs_detect_mode = dfs_detect_mode;
-+
-+	return os_snprintf(buf, buflen, "OK\n");
-+}
-+
-+
-+static int
-+hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
-+				    char *buf, size_t buflen)
-+{
-+	struct hostapd_iface *iface = hapd->iface;
-+	char *pos, *param;
-+	enum hostapd_hw_mode hw_mode;
-+	bool chan_found = false;
-+	int i, num_available_chandefs, channel, chan_width, sec = 0;
-+	int sec_chan_idx_80p80 = -1;
-+	u8 oper_centr_freq_seg0_idx, oper_centr_freq_seg1_idx;
-+	struct hostapd_channel_data *chan;
-+	enum dfs_channel_type type = DFS_NO_CAC_YET;
-+
-+	param = os_strchr(cmd, ' ');
-+	if (!param)
-+		return -1;
-+	*param++ = '\0';
-+
-+	pos = os_strstr(param, "chan=");
-+	if (pos)
-+		channel = strtol(pos + 5, NULL, 10);
-+	else
-+		return -1;
-+
-+	num_available_chandefs = dfs_find_channel(iface, NULL, 0, type);
-+	for (i = 0; i < num_available_chandefs; i++) {
-+		dfs_find_channel(iface, &chan, i, type);
-+		if (chan->chan == channel) {
-+			chan_found = true;
-+			break;
-+		}
-+	}
-+
-+	if (!chan_found)
-+		return -1;
-+
-+	if (iface->conf->secondary_channel)
-+		sec = 1;
-+
-+	dfs_adjust_center_freq(iface, chan,
-+			       sec,
-+			       sec_chan_idx_80p80,
-+			       &oper_centr_freq_seg0_idx,
-+			       &oper_centr_freq_seg1_idx);
-+
-+	if (hostapd_start_dfs_cac(iface, iface->conf->hw_mode,
-+				  chan->freq, chan->chan,
-+				  iface->conf->ieee80211n,
-+				  iface->conf->ieee80211ac,
-+				  iface->conf->ieee80211ax,
-+				  iface->conf->ieee80211be,
-+				  sec, hostapd_get_oper_chwidth(iface->conf),
-+				  oper_centr_freq_seg0_idx,
-+				  oper_centr_freq_seg1_idx, true)) {
-+		wpa_printf(MSG_ERROR, "DFS failed to start CAC offchannel");
-+		iface->radar_background.channel = -1;
-+		return -1;
-+	}
-+
-+	iface->radar_background.channel = chan->chan;
-+	iface->radar_background.freq = chan->freq;
-+	iface->radar_background.secondary_channel = sec;
-+	iface->radar_background.centr_freq_seg0_idx = oper_centr_freq_seg0_idx;
-+	iface->radar_background.centr_freq_seg1_idx = oper_centr_freq_seg1_idx;
-+
-+	return os_snprintf(buf, buflen, "OK\n");
-+}
-+
-+
- static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
- 					      char *buf, char *reply,
- 					      int reply_size,
-@@ -4081,6 +4171,11 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
- 		reply_len = hostapd_ctrl_iface_get_hemu(hapd, reply, reply_size);
- 	} else if (os_strncmp(buf, "GET_IBF", 7) == 0) {
- 		reply_len = hostapd_ctrl_iface_get_ibf(hapd, reply, reply_size);
-+	} else if (os_strncmp(buf, "DFS_DETECT_MODE ", 16) == 0) {
-+		reply_len = hostapd_ctrl_iface_set_dfs_detect_mode(hapd, buf + 16,
-+								   reply, reply_size);
-+	} else if (os_strncmp(buf, "SET_OFFCHAN_CTRL", 16) == 0) {
-+		reply_len = hostapd_ctrl_iface_set_offchan_ctrl(hapd, buf + 16, reply, reply_size);
- 	} else {
- 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
- 		reply_len = 16;
-diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 44a0e7e..3f5afdf 100644
---- a/src/ap/ap_config.h
-+++ b/src/ap/ap_config.h
-@@ -1159,6 +1159,7 @@ struct hostapd_config {
- 	int *edcca_threshold;
- 	u8 three_wire_enable;
- 	u8 ibf_enable;
-+	u8 dfs_detect_mode;
- };
- 
- enum three_wire_mode {
-@@ -1173,6 +1174,18 @@ enum three_wire_mode {
- 		NUM_THREE_WIRE_MODE - 1
- };
- 
-+enum dfs_mode {
-+	DFS_DETECT_MODE_DISABLE,
-+	DFS_DETECT_MODE_AP_ENABLE,
-+	DFS_DETECT_MODE_BACKGROUND_ENABLE,
-+	DFS_DETECT_MODE_ALL_ENABLE,
-+
-+	/* keep last */
-+	NUM_DFS_DETECT_MODE,
-+	DFS_DETECT_MODE_MAX =
-+		NUM_DFS_DETECT_MODE - 1
-+};
-+
- enum edcca_mode {
- 	EDCCA_MODE_FORCE_DISABLE = 0,
- 	EDCCA_MODE_AUTO = 1,
-diff --git a/src/ap/dfs.c b/src/ap/dfs.c
-index b5d105d..1c3f678 100644
---- a/src/ap/dfs.c
-+++ b/src/ap/dfs.c
-@@ -19,13 +19,6 @@
- #include "dfs.h"
- #include "crypto/crypto.h"
- 
--
--enum dfs_channel_type {
--	DFS_ANY_CHANNEL,
--	DFS_AVAILABLE, /* non-radar or radar-available */
--	DFS_NO_CAC_YET, /* radar-not-yet-available */
--};
--
- static struct hostapd_channel_data *
- dfs_downgrade_bandwidth(struct hostapd_iface *iface, int *secondary_channel,
- 			u8 *oper_centr_freq_seg0_idx,
-@@ -238,9 +231,9 @@ static int is_in_chanlist(struct hostapd_iface *iface,
-  *  - hapd->vht/he_oper_centr_freq_seg0_idx
-  *  - hapd->vht/he_oper_centr_freq_seg1_idx
-  */
--static int dfs_find_channel(struct hostapd_iface *iface,
--			    struct hostapd_channel_data **ret_chan,
--			    int idx, enum dfs_channel_type type)
-+int dfs_find_channel(struct hostapd_iface *iface,
-+		     struct hostapd_channel_data **ret_chan,
-+		     int idx, enum dfs_channel_type type)
- {
- 	struct hostapd_hw_modes *mode;
- 	struct hostapd_channel_data *chan;
-@@ -299,12 +292,12 @@ static int dfs_find_channel(struct hostapd_iface *iface,
- }
- 
- 
--static void dfs_adjust_center_freq(struct hostapd_iface *iface,
--				   struct hostapd_channel_data *chan,
--				   int secondary_channel,
--				   int sec_chan_idx_80p80,
--				   u8 *oper_centr_freq_seg0_idx,
--				   u8 *oper_centr_freq_seg1_idx)
-+void dfs_adjust_center_freq(struct hostapd_iface *iface,
-+			    struct hostapd_channel_data *chan,
-+			    int secondary_channel,
-+			    int sec_chan_idx_80p80,
-+			    u8 *oper_centr_freq_seg0_idx,
-+			    u8 *oper_centr_freq_seg1_idx)
- {
- 	if (!iface->conf->ieee80211ac && !iface->conf->ieee80211ax)
- 		return;
-@@ -1317,6 +1310,11 @@ hostapd_dfs_background_start_channel_switch(struct hostapd_iface *iface,
- 		   __func__, iface->radar_background.cac_started ? "yes" : "no",
- 		   hostapd_csa_in_progress(iface) ? "yes" : "no");
- 
-+	/* Skip channel switch when background dfs detect mode is on */
-+	if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_BACKGROUND_ENABLE ||
-+	    iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
-+		return 0;
-+
- 	/* Check if CSA in progress */
- 	if (hostapd_csa_in_progress(iface))
- 		return 0;
-@@ -1365,6 +1363,11 @@ static int hostapd_dfs_start_channel_switch(struct hostapd_iface *iface)
- 		   __func__, iface->cac_started ? "yes" : "no",
- 		   hostapd_csa_in_progress(iface) ? "yes" : "no");
- 
-+	/* Skip channel switch when dfs detect mode is on */
-+	if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_AP_ENABLE ||
-+	    iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
-+		return 0;
-+
- 	/* Check if CSA in progress */
- 	if (hostapd_csa_in_progress(iface))
- 		return 0;
-diff --git a/src/ap/dfs.h b/src/ap/dfs.h
-index 606c1b3..c2556d2 100644
---- a/src/ap/dfs.h
-+++ b/src/ap/dfs.h
-@@ -9,6 +9,12 @@
- #ifndef DFS_H
- #define DFS_H
- 
-+enum dfs_channel_type {
-+	DFS_ANY_CHANNEL,
-+	DFS_AVAILABLE, /* non-radar or radar-available */
-+	DFS_NO_CAC_YET, /* radar-not-yet-available */
-+};
-+
- int hostapd_handle_dfs(struct hostapd_iface *iface);
- 
- int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
-@@ -32,5 +38,14 @@ int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq,
- int hostapd_handle_dfs_offload(struct hostapd_iface *iface);
- int hostapd_is_dfs_overlap(struct hostapd_iface *iface, enum chan_width width,
- 			   int center_freq);
-+int dfs_find_channel(struct hostapd_iface *iface,
-+		     struct hostapd_channel_data **ret_chan,
-+		     int idx, enum dfs_channel_type type);
-+void dfs_adjust_center_freq(struct hostapd_iface *iface,
-+			    struct hostapd_channel_data *chan,
-+			    int secondary_channel,
-+			    int sec_chan_idx_80p80,
-+			    u8 *oper_centr_freq_seg0_idx,
-+			    u8 *oper_centr_freq_seg1_idx);
- 
- #endif /* DFS_H */
-diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index e44b73d..793ce2f 100644
---- a/src/ap/hostapd.c
-+++ b/src/ap/hostapd.c
-@@ -1463,7 +1463,9 @@ static int hostapd_setup_bss(struct hostapd_data *hapd, int first)
- 		return -1;
- 	}
- 
--	if (!conf->start_disabled && ieee802_11_set_beacon(hapd) < 0)
-+	if (conf->start_disabled)
-+		hapd->driver->start_disabled(hapd->drv_priv);
-+	else if (ieee802_11_set_beacon(hapd) < 0)
- 		return -1;
- 
- 	if (flush_old_stations && !conf->start_disabled &&
-diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 71ded61..aa23fbd 100644
---- a/src/drivers/driver.h
-+++ b/src/drivers/driver.h
-@@ -4720,6 +4720,13 @@ struct wpa_driver_ops {
- 	 *
- 	 */
- 	int (*ibf_dump)(void *priv, u8 *ibf_enable);
-+
-+	/**
-+	 * start_disabled - set start_disabled to cfg80211
-+	 * @priv: Private driver interface data
-+	 *
-+	 */
-+	int (*start_disabled)(void *priv);
- };
- 
- /**
-diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index e974f85..003adc4 100644
---- a/src/drivers/driver_nl80211.c
-+++ b/src/drivers/driver_nl80211.c
-@@ -12776,6 +12776,34 @@ fail:
- 	return -ENOBUFS;
- }
- 
-+static int nl80211_start_disabled(void *priv)
-+{
-+	struct i802_bss *bss = priv;
-+	struct wpa_driver_nl80211_data *drv = bss->drv;
-+	struct nl_msg *msg;
-+	struct nlattr *data;
-+	int ret;
-+
-+	msg = nl80211_bss_msg(bss, 0, NL80211_CMD_NEW_BEACON);
-+	if (!msg)
-+		goto fail;
-+
-+	if (nla_put_flag(msg, NL80211_ATTR_START_DISABLED))
-+		goto fail;
-+
-+	ret = send_and_recv_msgs_connect_handle(drv, msg, bss, 1);
-+
-+	if (ret)
-+		wpa_printf(MSG_ERROR, "Failed to set start_disabled. ret=%d (%s)",
-+			   ret, strerror(-ret));
-+
-+	return ret;
-+
-+fail:
-+	nlmsg_free(msg);
-+	return ret;
-+}
-+
- const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.name = "nl80211",
- 	.desc = "Linux nl80211/cfg80211",
-@@ -12930,4 +12958,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.three_wire_ctrl = nl80211_enable_three_wire,
- 	.ibf_ctrl = nl80211_ibf_enable,
- 	.ibf_dump = nl80211_ibf_dump,
-+	.start_disabled = nl80211_start_disabled,
- };
-diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
-index c4bf3ad..79bc76c 100644
---- a/src/drivers/nl80211_copy.h
-+++ b/src/drivers/nl80211_copy.h
-@@ -3176,6 +3176,7 @@ enum nl80211_attrs {
- 	NL80211_ATTR_EHT_CAPABILITY,
- 
- 	/* add attributes here, update the policy in nl80211.c */
-+	NL80211_ATTR_START_DISABLED = 999,
- 
- 	__NL80211_ATTR_AFTER_LAST,
- 	NUM_NL80211_ATTR = __NL80211_ATTR_AFTER_LAST,
--- 
-2.36.1
-
diff --git a/recipes-wifi/wpa-supplicant/files/patches/patches.inc b/recipes-wifi/wpa-supplicant/files/patches/patches.inc
index 309cd4f..388c3d7 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/patches.inc
+++ b/recipes-wifi/wpa-supplicant/files/patches/patches.inc
@@ -53,22 +53,14 @@
     file://800-acs-don-t-select-indoor-channel-on-outdoor-operation.patch \
     file://990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch \
     file://992-openssl-include-rsa.patch \
-    file://99900-hostapd-mtk-Add-hostapd_neighbor_count-and-hostapd_neighbor_ins.patch \
-    file://99901-hostapd-mtk-Support-including-neighbor-report-elements-in-ANQP-.patch \
-    file://99902-hostapd-mtk-Support-including-neignbor-report-elements-in-BTM-r.patch \
-    file://99903-hostapd-mtk-Support-configuring-BSS-Termination-TSF-by-using-ho.patch \
-    file://99904-hostapd-mtk-Disable-interface-if-BSS-Termination-TSF-is-set.patch \
-    file://99905-hostapd-mtk-Add-set_send_disassoc_frame_timer-to-send-disassoci.patch \
-    file://99906-hostapd-mtk-Support-including-neighbor-report-elements-in-BTM-r.patch \
-    file://99907-hostapd-mtk-Add-hostapd_neighbor_set_own_report_pref.patch \
-    file://99908-hostapd-mtk-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch \
-    file://99909-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch \
-    file://99910-hostapd-mtk-hostapd-add-support-for-runtime-set-in-band-discove.patch \
-    file://99911-hostapd-mtk-Add-mtk_vendor.h.patch \
-    file://99912-hostapd-mtk-Support-new-hostapd-configuration-edcca_enable-and-.patch \
-    file://99913-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch \
-    file://99914-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch \
-    file://99915-hostapd-mtk-Add-hostapd-iBF-control.patch \
-    file://99916-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated-sta-s-HE-c.patch \
-    file://99917-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch \
+    file://99900-hostapd-mtk-Add-neighbor-report-and-BSS-Termination.patch \
+    file://99901-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch \
+    file://99902-hostapd-mtk-add-support-for-runtime-set-in-band-dis.patch \
+    file://99903-hostapd-mtk-Add-mtk_vendor.h.patch \
+    file://99904-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch \
+    file://99905-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch \
+    file://99906-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-.patch \
+    file://99907-hostapd-mtk-Add-hostapd-iBF-control.patch \
+    file://99908-hostapd-mtk-Do-not-include-HE-capab-IE-if-associate.patch \
+    file://99909-hostapd-mtk-Add-DFS-and-ZWDFS-support.patch \
     "