Revert "[rdkb][common][bsp][Refactor and sync wif..."

Revert submission 8048803

Reason for revert: <wifi 7 not stable>

Reverted changes: /q/submissionid:8048803

Change-Id: Ic1b9f9d5e28fbbb92831ad9059dea73768200f17
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0001-Revert-wifi-mt76-mt7996-fill-txd-by-host-driver.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0001-Revert-wifi-mt76-mt7996-fill-txd-by-host-driver.patch
deleted file mode 100644
index fdaa90b..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0001-Revert-wifi-mt76-mt7996-fill-txd-by-host-driver.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From fd4524824058ee584f62e5762935f012679d85b8 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Tue, 19 Sep 2023 11:21:23 +0800
-Subject: [PATCH 01/22] Revert "wifi: mt76: mt7996: fill txd by host driver"
-
-This reverts commit 325a0c4931990d553487024c4f76c776492bdcc2.
----
- mt7996/mac.c | 13 +++++++++----
- 1 file changed, 9 insertions(+), 4 deletions(-)
-
-diff --git a/mt7996/mac.c b/mt7996/mac.c
-index c43839a20..1a1e21872 100644
---- a/mt7996/mac.c
-+++ b/mt7996/mac.c
-@@ -967,8 +967,11 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
- 		return id;
- 
- 	pid = mt76_tx_status_skb_add(mdev, wcid, tx_info->skb);
--	mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, key,
--			      pid, qid, 0);
-+	memset(txwi_ptr, 0, MT_TXD_SIZE);
-+	/* Transmit non qos data by 802.11 header and need to fill txd by host*/
-+	if (!is_8023 || pid >= MT_PACKET_ID_FIRST)
-+		mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, key,
-+				      pid, qid, 0);
- 
- 	txp = (struct mt76_connac_txp_common *)(txwi + MT_TXD_SIZE);
- 	for (i = 0; i < nbuf; i++) {
-@@ -977,8 +980,10 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
- 	}
- 	txp->fw.nbuf = nbuf;
- 
--	txp->fw.flags =
--		cpu_to_le16(MT_CT_INFO_FROM_HOST | MT_CT_INFO_APPLY_TXD);
-+	txp->fw.flags = cpu_to_le16(MT_CT_INFO_FROM_HOST);
-+
-+	if (!is_8023 || pid >= MT_PACKET_ID_FIRST)
-+		txp->fw.flags |= cpu_to_le16(MT_CT_INFO_APPLY_TXD);
- 
- 	if (!key)
- 		txp->fw.flags |= cpu_to_le16(MT_CT_INFO_NONE_CIPHER_FRAME);
--- 
-2.39.2
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0001-wifi-mt76-mt7996-add-eht-rx-rate-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0001-wifi-mt76-mt7996-add-eht-rx-rate-support.patch
new file mode 100644
index 0000000..91d65d7
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0001-wifi-mt76-mt7996-add-eht-rx-rate-support.patch
@@ -0,0 +1,92 @@
+From 15d734c77b25451efdf3bb1bcd5e687bc429a852 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Fri, 10 Feb 2023 17:39:23 +0800
+Subject: [PATCH 01/11] wifi: mt76: mt7996: add eht rx rate support
+
+Add support to report eht rx rate.
+
+Change-Id: Iee067d891bd634a918c942c2ba90ae72cd40c538
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ mac80211.c   | 11 ++++++++---
+ mt76.h       | 18 ++++++++++++++----
+ mt7996/mac.c |  9 +++++----
+ 3 files changed, 27 insertions(+), 11 deletions(-)
+
+diff --git a/mac80211.c b/mac80211.c
+index 2c4a5290..467afef9 100644
+--- a/mac80211.c
++++ b/mac80211.c
+@@ -1067,9 +1067,14 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb,
+ 	status->enc_flags = mstat.enc_flags;
+ 	status->encoding = mstat.encoding;
+ 	status->bw = mstat.bw;
+-	status->he_ru = mstat.he_ru;
+-	status->he_gi = mstat.he_gi;
+-	status->he_dcm = mstat.he_dcm;
++	if (status->encoding == RX_ENC_EHT) {
++		status->eht.ru = mstat.eht.ru;
++		status->eht.gi = mstat.eht.gi;
++	} else {
++		status->he_ru = mstat.he_ru;
++		status->he_gi = mstat.he_gi;
++		status->he_dcm = mstat.he_dcm;
++	}
+ 	status->rate_idx = mstat.rate_idx;
+ 	status->nss = mstat.nss;
+ 	status->band = mstat.band;
+diff --git a/mt76.h b/mt76.h
+index 8b4635e9..6b07b8fa 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -621,12 +621,22 @@ struct mt76_rx_status {
+ 	u16 freq;
+ 	u32 flag;
+ 	u8 enc_flags;
+-	u8 encoding:2, bw:3, he_ru:3;
+-	u8 he_gi:2, he_dcm:1;
++	u8 encoding:3, bw:4;
++	union {
++		struct {
++			u8 he_ru:3;
++			u8 he_gi:2;
++			u8 he_dcm:1;
++		};
++		struct {
++			u8 ru:4;
++			u8 gi:2;
++		} eht;
++	};
++
+ 	u8 amsdu:1, first_amsdu:1, last_amsdu:1;
+ 	u8 rate_idx;
+-	u8 nss;
+-	u8 band;
++	u8 nss:5, band:3;
+ 	s8 signal;
+ 	u8 chains;
+ 	s8 chain_signal[IEEE80211_MAX_CHAINS];
+diff --git a/mt7996/mac.c b/mt7996/mac.c
+index 0d51090d..23cbfdde 100644
+--- a/mt7996/mac.c
++++ b/mt7996/mac.c
+@@ -580,11 +580,12 @@ mt7996_mac_fill_rx_rate(struct mt7996_dev *dev,
+ 	case MT_PHY_TYPE_EHT_SU:
+ 	case MT_PHY_TYPE_EHT_TRIG:
+ 	case MT_PHY_TYPE_EHT_MU:
+-		/* TODO: currently report rx rate with HE rate */
+ 		status->nss = nss;
+-		status->encoding = RX_ENC_HE;
+-		bw = min_t(int, bw, IEEE80211_STA_RX_BW_160);
+-		i = min_t(int, i & 0xf, 11);
++		status->encoding = RX_ENC_EHT;
++		i &= GENMASK(3, 0);
++
++		if (gi <= NL80211_RATE_INFO_EHT_GI_3_2)
++			status->eht.gi = gi;
+ 		break;
+ 	default:
+ 		return -EINVAL;
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7996-move-radio-ctrl-commands-to-proper-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7996-move-radio-ctrl-commands-to-proper-.patch
new file mode 100644
index 0000000..8ab501f
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7996-move-radio-ctrl-commands-to-proper-.patch
@@ -0,0 +1,60 @@
+From 83d30a89d61ee914b23d77256e993e9521de5cbc Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Wed, 15 Feb 2023 18:38:04 +0800
+Subject: [PATCH 02/11] wifi: mt76: mt7996: move radio ctrl commands to proper
+ functions
+
+Move radio enable/disable commands into functions for configuring
+per-phy radio.
+
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ mt7996/main.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/mt7996/main.c b/mt7996/main.c
+index f306e9c5..e7c97d2f 100644
+--- a/mt7996/main.c
++++ b/mt7996/main.c
+@@ -43,6 +43,10 @@ int mt7996_run(struct ieee80211_hw *hw)
+ 	if (ret)
+ 		goto out;
+ 
++	ret = mt7996_mcu_set_radio_en(phy, true);
++	if (ret)
++		goto out;
++
+ 	ret = mt7996_mcu_set_chan_info(phy, UNI_CHANNEL_RX_PATH);
+ 	if (ret)
+ 		goto out;
+@@ -82,6 +86,8 @@ static void mt7996_stop(struct ieee80211_hw *hw)
+ 
+ 	mutex_lock(&dev->mt76.mutex);
+ 
++	mt7996_mcu_set_radio_en(phy, false);
++
+ 	clear_bit(MT76_STATE_RUNNING, &phy->mt76->state);
+ 
+ 	mutex_unlock(&dev->mt76.mutex);
+@@ -190,10 +196,6 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
+ 	if (ret)
+ 		goto out;
+ 
+-	ret = mt7996_mcu_set_radio_en(phy, true);
+-	if (ret)
+-		goto out;
+-
+ 	dev->mt76.vif_mask |= BIT_ULL(mvif->mt76.idx);
+ 	phy->omac_mask |= BIT_ULL(mvif->mt76.omac_idx);
+ 
+@@ -253,7 +255,6 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
+ 		phy->monitor_vif = NULL;
+ 
+ 	mt7996_mcu_add_dev_info(phy, vif, false);
+-	mt7996_mcu_set_radio_en(phy, false);
+ 
+ 	rcu_assign_pointer(dev->mt76.wcid[idx], NULL);
+ 
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-connac-add-support-for-dsp-firmware-downlo.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-connac-add-support-for-dsp-firmware-downlo.patch
new file mode 100644
index 0000000..4342d73
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-connac-add-support-for-dsp-firmware-downlo.patch
@@ -0,0 +1,198 @@
+From 20c8d7bfeb91be51129e7e98213db441a62d6d95 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Wed, 31 May 2023 18:31:41 +0800
+Subject: [PATCH 03/11] wifi: mt76: connac: add support for dsp firmware
+ download
+
+Add FW_START_WORKING_PDA_DSP for the indication of starting DSP
+firmware download, which is for phy-related control.
+The firmware is transparent to the driver, but it's necessary for the
+firmware download process.
+
+Reviewed-by: Shayne Chen <shayne.chen@mediatek.com>
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Change-Id: I35666504cfe7bf213c8f8f0c0223b3089372f2ab
+---
+v2:
+  - merge two commits
+  - move main load ram code to a regular function
+v3:
+  - remove all macros to directly call __mt7996_load_ram()
+  - add back missing code which records fw_version to wiphy
+---
+ mt76_connac_mcu.h |  1 +
+ mt7996/mcu.c      | 67 +++++++++++++++++++++++------------------------
+ mt7996/mt7996.h   |  7 +++++
+ mt7996/pci.c      |  1 +
+ 4 files changed, 42 insertions(+), 34 deletions(-)
+
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 91d98eff..d2a3d56b 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -22,6 +22,7 @@
+ 
+ #define FW_START_OVERRIDE		BIT(0)
+ #define FW_START_WORKING_PDA_CR4	BIT(2)
++#define FW_START_WORKING_PDA_DSP	BIT(3)
+ 
+ #define PATCH_SEC_NOT_SUPPORT		GENMASK(31, 0)
+ #define PATCH_SEC_TYPE_MASK		GENMASK(15, 0)
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index 88e2f9d0..545cc987 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -2155,7 +2155,7 @@ out:
+ static int
+ mt7996_mcu_send_ram_firmware(struct mt7996_dev *dev,
+ 			     const struct mt7996_fw_trailer *hdr,
+-			     const u8 *data, bool is_wa)
++			     const u8 *data, enum mt7996_ram_type type)
+ {
+ 	int i, offset = 0;
+ 	u32 override = 0, option = 0;
+@@ -2167,8 +2167,10 @@ mt7996_mcu_send_ram_firmware(struct mt7996_dev *dev,
+ 
+ 		region = (const struct mt7996_fw_region *)((const u8 *)hdr -
+ 			 (hdr->n_region - i) * sizeof(*region));
++		/* DSP and WA use same mode */
+ 		mode = mt76_connac_mcu_gen_dl_mode(&dev->mt76,
+-						   region->feature_set, is_wa);
++						   region->feature_set,
++						   type != MT7996_RAM_TYPE_WM);
+ 		len = le32_to_cpu(region->len);
+ 		addr = le32_to_cpu(region->addr);
+ 
+@@ -2195,19 +2197,22 @@ mt7996_mcu_send_ram_firmware(struct mt7996_dev *dev,
+ 	if (override)
+ 		option |= FW_START_OVERRIDE;
+ 
+-	if (is_wa)
++	if (type == MT7996_RAM_TYPE_WA)
+ 		option |= FW_START_WORKING_PDA_CR4;
++	else if (type == MT7996_RAM_TYPE_DSP)
++		option |= FW_START_WORKING_PDA_DSP;
+ 
+ 	return mt76_connac_mcu_start_firmware(&dev->mt76, override, option);
+ }
+ 
+-static int mt7996_load_ram(struct mt7996_dev *dev)
++static int __mt7996_load_ram(struct mt7996_dev *dev, const char *fw_type,
++			     const char *fw_file, enum mt7996_ram_type ram_type)
+ {
+ 	const struct mt7996_fw_trailer *hdr;
+ 	const struct firmware *fw;
+ 	int ret;
+ 
+-	ret = request_firmware(&fw, MT7996_FIRMWARE_WM, dev->mt76.dev);
++	ret = request_firmware(&fw, fw_file, dev->mt76.dev);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -2217,37 +2222,13 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
+ 		goto out;
+ 	}
+ 
+-	hdr = (const struct mt7996_fw_trailer *)(fw->data + fw->size - sizeof(*hdr));
+-
+-	dev_info(dev->mt76.dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
+-		 hdr->fw_ver, hdr->build_date);
++	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
++	dev_info(dev->mt76.dev, "%s Firmware Version: %.10s, Build Time: %.15s\n",
++		 fw_type, hdr->fw_ver, hdr->build_date);
+ 
+-	ret = mt7996_mcu_send_ram_firmware(dev, hdr, fw->data, false);
++	ret = mt7996_mcu_send_ram_firmware(dev, hdr, fw->data, ram_type);
+ 	if (ret) {
+-		dev_err(dev->mt76.dev, "Failed to start WM firmware\n");
+-		goto out;
+-	}
+-
+-	release_firmware(fw);
+-
+-	ret = request_firmware(&fw, MT7996_FIRMWARE_WA, dev->mt76.dev);
+-	if (ret)
+-		return ret;
+-
+-	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
+-		dev_err(dev->mt76.dev, "Invalid firmware\n");
+-		ret = -EINVAL;
+-		goto out;
+-	}
+-
+-	hdr = (const struct mt7996_fw_trailer *)(fw->data + fw->size - sizeof(*hdr));
+-
+-	dev_info(dev->mt76.dev, "WA Firmware Version: %.10s, Build Time: %.15s\n",
+-		 hdr->fw_ver, hdr->build_date);
+-
+-	ret = mt7996_mcu_send_ram_firmware(dev, hdr, fw->data, true);
+-	if (ret) {
+-		dev_err(dev->mt76.dev, "Failed to start WA firmware\n");
++		dev_err(dev->mt76.dev, "Failed to start %s firmware\n", fw_type);
+ 		goto out;
+ 	}
+ 
+@@ -2261,6 +2242,24 @@ out:
+ 	return ret;
+ }
+ 
++static int mt7996_load_ram(struct mt7996_dev *dev)
++{
++	int ret;
++
++	ret = __mt7996_load_ram(dev, "WM", MT7996_FIRMWARE_WM,
++				MT7996_RAM_TYPE_WM);
++	if (ret)
++		return ret;
++
++	ret = __mt7996_load_ram(dev, "DSP", MT7996_FIRMWARE_DSP,
++				MT7996_RAM_TYPE_DSP);
++	if (ret)
++		return ret;
++
++	return __mt7996_load_ram(dev, "WA", MT7996_FIRMWARE_WA,
++				 MT7996_RAM_TYPE_WA);
++}
++
+ static int
+ mt7996_firmware_state(struct mt7996_dev *dev, bool wa)
+ {
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index 4d7dcb95..7dfdc738 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -29,6 +29,7 @@
+ 
+ #define MT7996_FIRMWARE_WA		"mediatek/mt7996/mt7996_wa.bin"
+ #define MT7996_FIRMWARE_WM		"mediatek/mt7996/mt7996_wm.bin"
++#define MT7996_FIRMWARE_DSP		"mediatek/mt7996/mt7996_dsp.bin"
+ #define MT7996_ROM_PATCH		"mediatek/mt7996/mt7996_rom_patch.bin"
+ 
+ #define MT7996_EEPROM_DEFAULT		"mediatek/mt7996/mt7996_eeprom.bin"
+@@ -52,6 +53,12 @@ struct mt7996_sta;
+ struct mt7996_dfs_pulse;
+ struct mt7996_dfs_pattern;
+ 
++enum mt7996_ram_type {
++	MT7996_RAM_TYPE_WM,
++	MT7996_RAM_TYPE_WA,
++	MT7996_RAM_TYPE_DSP,
++};
++
+ enum mt7996_txq_id {
+ 	MT7996_TXQ_FWDL = 16,
+ 	MT7996_TXQ_MCU_WM,
+diff --git a/mt7996/pci.c b/mt7996/pci.c
+index 64aee3fb..c5301050 100644
+--- a/mt7996/pci.c
++++ b/mt7996/pci.c
+@@ -219,4 +219,5 @@ MODULE_DEVICE_TABLE(pci, mt7996_pci_device_table);
+ MODULE_DEVICE_TABLE(pci, mt7996_hif_device_table);
+ MODULE_FIRMWARE(MT7996_FIRMWARE_WA);
+ MODULE_FIRMWARE(MT7996_FIRMWARE_WM);
++MODULE_FIRMWARE(MT7996_FIRMWARE_DSP);
+ MODULE_FIRMWARE(MT7996_ROM_PATCH);
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-mt7996-fix-bss-wlan_idx-when-sending-bss_i.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-mt7996-fix-bss-wlan_idx-when-sending-bss_i.patch
new file mode 100644
index 0000000..a4e17a9
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-mt7996-fix-bss-wlan_idx-when-sending-bss_i.patch
@@ -0,0 +1,51 @@
+From 3c7a5592ea211f5ddb2f6bbd6ba8720c74faf459 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Thu, 2 Mar 2023 15:44:52 +0800
+Subject: [PATCH 04/11] wifi: mt76: mt7996: fix bss wlan_idx when sending
+ bss_info command
+
+The bmc_tx_wlan_idx should be the wlan_idx of the current bss rather
+than peer AP's wlan_idx, otherwise there will appear some frame
+decryption problems on station mode.
+
+Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Reviewed-by: Shayne Chen <shayne.chen@mediatek.com>
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ mt7996/mcu.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index 545cc987..6706d38c 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -712,6 +712,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+ 	struct cfg80211_chan_def *chandef = &phy->chandef;
+ 	struct mt76_connac_bss_basic_tlv *bss;
+ 	u32 type = CONNECTION_INFRA_AP;
++	u16 sta_wlan_idx = wlan_idx;
+ 	struct tlv *tlv;
+ 	int idx;
+ 
+@@ -731,7 +732,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+ 				struct mt76_wcid *wcid;
+ 
+ 				wcid = (struct mt76_wcid *)sta->drv_priv;
+-				wlan_idx = wcid->idx;
++				sta_wlan_idx = wcid->idx;
+ 			}
+ 			rcu_read_unlock();
+ 		}
+@@ -751,7 +752,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+ 	bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
+ 	bss->dtim_period = vif->bss_conf.dtim_period;
+ 	bss->bmc_tx_wlan_idx = cpu_to_le16(wlan_idx);
+-	bss->sta_idx = cpu_to_le16(wlan_idx);
++	bss->sta_idx = cpu_to_le16(sta_wlan_idx);
+ 	bss->conn_type = cpu_to_le32(type);
+ 	bss->omac_idx = mvif->omac_idx;
+ 	bss->band_idx = mvif->band_idx;
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0005-wifi-mt76-mt7996-init-he-and-eht-cap-for-AP_VLAN.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0005-wifi-mt76-mt7996-init-he-and-eht-cap-for-AP_VLAN.patch
new file mode 100644
index 0000000..d4968dd
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0005-wifi-mt76-mt7996-init-he-and-eht-cap-for-AP_VLAN.patch
@@ -0,0 +1,29 @@
+From 56d84272851f6c77cf68186bc8906de0558d2e5b Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Fri, 17 Mar 2023 11:08:04 +0800
+Subject: [PATCH 05/11] wifi: mt76: mt7996: init he and eht cap for AP_VLAN
+
+Init he and eht capabilities for AP_VLAN type. Without this patch, the
+BA response from AP_VLAN will not include the ADDBA extension tag.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ mt7996/init.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/mt7996/init.c b/mt7996/init.c
+index f1b48cdd..004575a0 100644
+--- a/mt7996/init.c
++++ b/mt7996/init.c
+@@ -808,6 +808,7 @@ __mt7996_set_stream_he_eht_caps(struct mt7996_phy *phy,
+ 		switch (i) {
+ 		case NL80211_IFTYPE_STATION:
+ 		case NL80211_IFTYPE_AP:
++		case NL80211_IFTYPE_AP_VLAN:
+ #ifdef CONFIG_MAC80211_MESH
+ 		case NL80211_IFTYPE_MESH_POINT:
+ #endif
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0006-wifi-mt76-mt7996-enable-VHT-extended-NSS-BW-feature.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0006-wifi-mt76-mt7996-enable-VHT-extended-NSS-BW-feature.patch
new file mode 100644
index 0000000..348a04a
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0006-wifi-mt76-mt7996-enable-VHT-extended-NSS-BW-feature.patch
@@ -0,0 +1,30 @@
+From 1e7bbf8c04d60eb6cd234990f94da73bccd73118 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Mon, 27 Mar 2023 14:30:25 +0800
+Subject: [PATCH 06/11] wifi: mt76: mt7996: enable VHT extended NSS BW feature
+
+Set SUPPORTS_VHT_EXT_NSS_BW to let the max BW capability correctly be
+parsed by different devices.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ mt7996/init.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/mt7996/init.c b/mt7996/init.c
+index 004575a0..8247153d 100644
+--- a/mt7996/init.c
++++ b/mt7996/init.c
+@@ -217,6 +217,8 @@ mt7996_init_wiphy(struct ieee80211_hw *hw)
+ 			IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
+ 		phy->mt76->sband_5g.sband.ht_cap.ampdu_density =
+ 			IEEE80211_HT_MPDU_DENSITY_1;
++
++		ieee80211_hw_set(hw, SUPPORTS_VHT_EXT_NSS_BW);
+ 	}
+ 
+ 	mt76_set_stream_caps(phy->mt76, true);
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0007-wifi-mt76-connac-add-support-to-set-ifs-time-by-mcu-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0007-wifi-mt76-connac-add-support-to-set-ifs-time-by-mcu-.patch
new file mode 100644
index 0000000..8021427
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0007-wifi-mt76-connac-add-support-to-set-ifs-time-by-mcu-.patch
@@ -0,0 +1,261 @@
+From edca876e34fc2696e8f855c2d05036fa79a05f8f Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Thu, 1 Jun 2023 12:01:10 +0800
+Subject: [PATCH 07/11] wifi: mt76: connac: add support to set ifs time by mcu
+ command
+
+There's a race between driver and fw on some tx/rx control registers
+when setting ifs, which will cause accidental hw queue pause problems.
+Avoid this by setting ifs time with bss_info mcu command.
+
+Reviewed-by: Shayne Chen <shayne.chen@mediatek.com>
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Change-Id: Ib6477462a35df84a89f113a4db0e6aef5154c6a8
+---
+v2:
+  - merge two commits
+  - change bool a_band to use is_2ghz
+---
+ mt76_connac_mcu.h |  1 +
+ mt7996/mac.c      | 27 ++-------------------------
+ mt7996/main.c     |  5 ++---
+ mt7996/mcu.c      | 46 ++++++++++++++++++++++++++++++++++++++++++++++
+ mt7996/mcu.h      | 17 +++++++++++++++++
+ mt7996/mt7996.h   |  3 ++-
+ 6 files changed, 70 insertions(+), 29 deletions(-)
+
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index d2a3d56b..b91262ee 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1288,6 +1288,7 @@ enum {
+ 	UNI_BSS_INFO_UAPSD = 19,
+ 	UNI_BSS_INFO_PS = 21,
+ 	UNI_BSS_INFO_BCNFT = 22,
++	UNI_BSS_INFO_IFS_TIME = 23,
+ 	UNI_BSS_INFO_OFFLOAD = 25,
+ 	UNI_BSS_INFO_MLD = 26,
+ };
+diff --git a/mt7996/mac.c b/mt7996/mac.c
+index 23cbfdde..2da61d2e 100644
+--- a/mt7996/mac.c
++++ b/mt7996/mac.c
+@@ -1612,20 +1612,19 @@ void mt7996_mac_reset_counters(struct mt7996_phy *phy)
+ 	mt7996_mcu_get_chan_mib_info(phy, true);
+ }
+ 
+-void mt7996_mac_set_timing(struct mt7996_phy *phy)
++void mt7996_mac_set_coverage_class(struct mt7996_phy *phy)
+ {
+ 	s16 coverage_class = phy->coverage_class;
+ 	struct mt7996_dev *dev = phy->dev;
+ 	struct mt7996_phy *phy2 = mt7996_phy2(dev);
+ 	struct mt7996_phy *phy3 = mt7996_phy3(dev);
+-	u32 val, reg_offset;
++	u32 reg_offset;
+ 	u32 cck = FIELD_PREP(MT_TIMEOUT_VAL_PLCP, 231) |
+ 		  FIELD_PREP(MT_TIMEOUT_VAL_CCA, 48);
+ 	u32 ofdm = FIELD_PREP(MT_TIMEOUT_VAL_PLCP, 60) |
+ 		   FIELD_PREP(MT_TIMEOUT_VAL_CCA, 28);
+ 	u8 band_idx = phy->mt76->band_idx;
+ 	int offset;
+-	bool a_band = !(phy->mt76->chandef.chan->band == NL80211_BAND_2GHZ);
+ 
+ 	if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
+ 		return;
+@@ -1638,34 +1637,12 @@ void mt7996_mac_set_timing(struct mt7996_phy *phy)
+ 		coverage_class = max_t(s16, coverage_class,
+ 				       phy3->coverage_class);
+ 
+-	mt76_set(dev, MT_ARB_SCR(band_idx),
+-		 MT_ARB_SCR_TX_DISABLE | MT_ARB_SCR_RX_DISABLE);
+-	udelay(1);
+-
+ 	offset = 3 * coverage_class;
+ 	reg_offset = FIELD_PREP(MT_TIMEOUT_VAL_PLCP, offset) |
+ 		     FIELD_PREP(MT_TIMEOUT_VAL_CCA, offset);
+ 
+ 	mt76_wr(dev, MT_TMAC_CDTR(band_idx), cck + reg_offset);
+ 	mt76_wr(dev, MT_TMAC_ODTR(band_idx), ofdm + reg_offset);
+-	mt76_wr(dev, MT_TMAC_ICR0(band_idx),
+-		FIELD_PREP(MT_IFS_EIFS_OFDM, a_band ? 84 : 78) |
+-		FIELD_PREP(MT_IFS_RIFS, 2) |
+-		FIELD_PREP(MT_IFS_SIFS, 10) |
+-		FIELD_PREP(MT_IFS_SLOT, phy->slottime));
+-
+-	if (!a_band)
+-		mt76_wr(dev, MT_TMAC_ICR1(band_idx),
+-			FIELD_PREP(MT_IFS_EIFS_CCK, 314));
+-
+-	if (phy->slottime < 20 || a_band)
+-		val = MT7996_CFEND_RATE_DEFAULT;
+-	else
+-		val = MT7996_CFEND_RATE_11B;
+-
+-	mt76_rmw_field(dev, MT_RATE_HRCR0(band_idx), MT_RATE_HRCR0_CFEND_RATE, val);
+-	mt76_clear(dev, MT_ARB_SCR(band_idx),
+-		   MT_ARB_SCR_TX_DISABLE | MT_ARB_SCR_RX_DISABLE);
+ }
+ 
+ void mt7996_mac_enable_nf(struct mt7996_dev *dev, u8 band)
+diff --git a/mt7996/main.c b/mt7996/main.c
+index e7c97d2f..786c3fbc 100644
+--- a/mt7996/main.c
++++ b/mt7996/main.c
+@@ -287,7 +287,6 @@ int mt7996_set_channel(struct mt7996_phy *phy)
+ 	if (ret)
+ 		goto out;
+ 
+-	mt7996_mac_set_timing(phy);
+ 	ret = mt7996_dfs_init_radar_detector(phy);
+ 	mt7996_mac_cca_stats_reset(phy);
+ 
+@@ -564,7 +563,7 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
+ 
+ 		if (slottime != phy->slottime) {
+ 			phy->slottime = slottime;
+-			mt7996_mac_set_timing(phy);
++			mt7996_mcu_set_timing(phy, vif);
+ 		}
+ 	}
+ 
+@@ -904,7 +903,7 @@ mt7996_set_coverage_class(struct ieee80211_hw *hw, s16 coverage_class)
+ 
+ 	mutex_lock(&dev->mt76.mutex);
+ 	phy->coverage_class = max_t(s16, coverage_class, 0);
+-	mt7996_mac_set_timing(phy);
++	mt7996_mac_set_coverage_class(phy);
+ 	mutex_unlock(&dev->mt76.mutex);
+ }
+ 
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index 6706d38c..0ede9769 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -701,6 +701,34 @@ mt7996_mcu_muar_config(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+ 				 sizeof(req), true);
+ }
+ 
++static void
++mt7996_mcu_bss_ifs_timing_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
++{
++	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++	struct mt7996_phy *phy = mvif->phy;
++	struct bss_ifs_time_tlv *ifs_time;
++	struct tlv *tlv;
++	bool is_2ghz = phy->mt76->chandef.chan->band == NL80211_BAND_2GHZ;
++
++	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_IFS_TIME, sizeof(*ifs_time));
++
++	ifs_time = (struct bss_ifs_time_tlv *)tlv;
++	ifs_time->slot_valid = true;
++	ifs_time->sifs_valid = true;
++	ifs_time->rifs_valid = true;
++	ifs_time->eifs_valid = true;
++
++	ifs_time->slot_time = cpu_to_le16(phy->slottime);
++	ifs_time->sifs_time = cpu_to_le16(10);
++	ifs_time->rifs_time = cpu_to_le16(2);
++	ifs_time->eifs_time = cpu_to_le16(is_2ghz ? 78 : 84);
++
++	if (is_2ghz) {
++		ifs_time->eifs_cck_valid = true;
++		ifs_time->eifs_cck_time = cpu_to_le16(314);
++	}
++}
++
+ static int
+ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+ 			 struct ieee80211_vif *vif,
+@@ -826,6 +854,7 @@ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
+ 		mt7996_mcu_bss_bmc_tlv(skb, vif, phy);
+ 		mt7996_mcu_bss_ra_tlv(skb, vif, phy);
+ 		mt7996_mcu_bss_txcmd_tlv(skb, true);
++		mt7996_mcu_bss_ifs_timing_tlv(skb, vif);
+ 
+ 		if (vif->bss_conf.he_support)
+ 			mt7996_mcu_bss_he_tlv(skb, vif, phy);
+@@ -838,6 +867,23 @@ out:
+ 				     MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), true);
+ }
+ 
++int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct ieee80211_vif *vif)
++{
++	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++	struct mt7996_dev *dev = phy->dev;
++	struct sk_buff *skb;
++
++	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76,
++					 MT7996_BSS_UPDATE_MAX_SIZE);
++	if (IS_ERR(skb))
++		return PTR_ERR(skb);
++
++	mt7996_mcu_bss_ifs_timing_tlv(skb, vif);
++
++	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
++				     MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), true);
++}
++
+ static int
+ mt7996_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
+ 		  struct ieee80211_ampdu_params *params,
+diff --git a/mt7996/mcu.h b/mt7996/mcu.h
+index d7075a4d..078f8285 100644
+--- a/mt7996/mcu.h
++++ b/mt7996/mcu.h
+@@ -317,6 +317,22 @@ struct bss_sec_tlv {
+ 	u8 __rsv2[1];
+ } __packed;
+ 
++struct bss_ifs_time_tlv {
++	__le16 tag;
++	__le16 len;
++	u8 slot_valid;
++	u8 sifs_valid;
++	u8 rifs_valid;
++	u8 eifs_valid;
++	__le16 slot_time;
++	__le16 sifs_time;
++	__le16 rifs_time;
++	__le16 eifs_time;
++	u8 eifs_cck_valid;
++	u8 rsv;
++	__le16 eifs_cck_time;
++} __packed;
++
+ struct bss_power_save {
+ 	__le16 tag;
+ 	__le16 len;
+@@ -552,6 +568,7 @@ enum {
+ 					 sizeof(struct bss_txcmd_tlv) +		\
+ 					 sizeof(struct bss_power_save) +	\
+ 					 sizeof(struct bss_sec_tlv) +		\
++					 sizeof(struct bss_ifs_time_tlv) +	\
+ 					 sizeof(struct bss_mld_tlv))
+ 
+ #define MT7996_STA_UPDATE_MAX_SIZE	(sizeof(struct sta_req_hdr) +		\
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index 7dfdc738..42892f06 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -463,6 +463,7 @@ int mt7996_mcu_set_radar_th(struct mt7996_dev *dev, int index,
+ 			    const struct mt7996_dfs_pattern *pattern);
+ int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable);
+ int mt7996_mcu_set_rts_thresh(struct mt7996_phy *phy, u32 val);
++int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct ieee80211_vif *vif);
+ int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch);
+ int mt7996_mcu_rdd_cmd(struct mt7996_dev *dev, int cmd, u8 index,
+ 		       u8 rx_sel, u8 val);
+@@ -526,7 +527,7 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
+ 			   struct sk_buff *skb, struct mt76_wcid *wcid,
+ 			   struct ieee80211_key_conf *key, int pid,
+ 			   enum mt76_txq_id qid, u32 changed);
+-void mt7996_mac_set_timing(struct mt7996_phy *phy);
++void mt7996_mac_set_coverage_class(struct mt7996_phy *phy);
+ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ 		       struct ieee80211_sta *sta);
+ void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0008-wifi-mt76-mt7996-use-correct-phy-for-background-rada.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0008-wifi-mt76-mt7996-use-correct-phy-for-background-rada.patch
new file mode 100644
index 0000000..24d2bfd
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0008-wifi-mt76-mt7996-use-correct-phy-for-background-rada.patch
@@ -0,0 +1,37 @@
+From 9cf96fa56a20d30f7e46e96d9c48c3568fbf11af Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Tue, 7 Mar 2023 17:05:01 +0800
+Subject: [PATCH 08/11] wifi: mt76: mt7996: use correct phy for background
+ radar event
+
+If driver directly uses the band_idx reported from the radar event to
+access mt76_phy array, it will get the wrong phy for background radar.
+Fix this by adjusting the statement.
+
+Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ mt7996/mcu.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index 0ede9769..20519bff 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -339,7 +339,11 @@ mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb)
+ 	if (r->band_idx >= ARRAY_SIZE(dev->mt76.phys))
+ 		return;
+ 
+-	mphy = dev->mt76.phys[r->band_idx];
++	if (dev->rdd2_phy && r->band_idx == MT_RX_SEL2)
++		mphy = dev->rdd2_phy->mt76;
++	else
++		mphy = dev->mt76.phys[r->band_idx];
++
+ 	if (!mphy)
+ 		return;
+ 
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0009-wifi-mt76-mt7996-fix-WA-event-ring-size.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0009-wifi-mt76-mt7996-fix-WA-event-ring-size.patch
new file mode 100644
index 0000000..6ffa018
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0009-wifi-mt76-mt7996-fix-WA-event-ring-size.patch
@@ -0,0 +1,44 @@
+From f9ac23ac488c0dafceab97c8d39a22904cf78f77 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Thu, 23 Mar 2023 15:16:14 +0800
+Subject: [PATCH 09/11] wifi: mt76: mt7996: fix WA event ring size
+
+Fix rx ring size of WA event to get rid of event loss and queue overflow
+problems.
+
+Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ mt7996/dma.c    | 2 +-
+ mt7996/mt7996.h | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/mt7996/dma.c b/mt7996/dma.c
+index 53414346..fbedaacf 100644
+--- a/mt7996/dma.c
++++ b/mt7996/dma.c
+@@ -293,7 +293,7 @@ int mt7996_dma_init(struct mt7996_dev *dev)
+ 	/* event from WA */
+ 	ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_MCU_WA],
+ 			       MT_RXQ_ID(MT_RXQ_MCU_WA),
+-			       MT7996_RX_MCU_RING_SIZE,
++			       MT7996_RX_MCU_RING_SIZE_WA,
+ 			       MT_RX_BUF_SIZE,
+ 			       MT_RXQ_RING_BASE(MT_RXQ_MCU_WA));
+ 	if (ret)
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index 42892f06..a3bd85d3 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -26,6 +26,7 @@
+ 
+ #define MT7996_RX_RING_SIZE		1536
+ #define MT7996_RX_MCU_RING_SIZE		512
++#define MT7996_RX_MCU_RING_SIZE_WA	1024
+ 
+ #define MT7996_FIRMWARE_WA		"mediatek/mt7996/mt7996_wa.bin"
+ #define MT7996_FIRMWARE_WM		"mediatek/mt7996/mt7996_wm.bin"
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0010-wifi-mt76-mt7996-add-muru-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0010-wifi-mt76-mt7996-add-muru-support.patch
new file mode 100644
index 0000000..c0f61b7
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0010-wifi-mt76-mt7996-add-muru-support.patch
@@ -0,0 +1,105 @@
+From 8a284ffc268754a8e941888ce6f1b506f3c7564c Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
+Date: Mon, 28 Nov 2022 14:36:09 +0800
+Subject: [PATCH 10/11] wifi: mt76: mt7996: add muru support
+
+Add sta_rec_muru() fw command to support MU-MIMO and OFDMA features.
+
+Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ mt76_connac_mcu.h |  3 ++-
+ mt7996/mcu.c      | 56 ++++++++++++++++++++++++++++++++++++++++++++++-
+ 2 files changed, 57 insertions(+), 2 deletions(-)
+
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index b91262ee..6249de57 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -519,7 +519,8 @@ struct sta_rec_muru {
+ 		u8 uo_ra;
+ 		u8 he_2x996_tone;
+ 		u8 rx_t_frame_11ac;
+-		u8 rsv[3];
++		u8 rx_ctrl_frame_to_mbss;
++		u8 rsv[2];
+ 	} ofdma_ul;
+ 
+ 	struct {
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index 20519bff..611f6450 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -1101,6 +1101,59 @@ mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+ 	}
+ }
+ 
++static void
++mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
++			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
++{
++	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
++	struct sta_rec_muru *muru;
++	struct tlv *tlv;
++
++	if (vif->type != NL80211_IFTYPE_STATION &&
++	    vif->type != NL80211_IFTYPE_AP)
++		return;
++
++	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
++
++	muru = (struct sta_rec_muru *)tlv;
++	muru->cfg.mimo_dl_en = vif->bss_conf.eht_mu_beamformer ||
++			       vif->bss_conf.he_mu_beamformer ||
++			       vif->bss_conf.vht_mu_beamformer ||
++			       vif->bss_conf.vht_mu_beamformee;
++	muru->cfg.ofdma_dl_en = true;
++
++	if (sta->deflink.vht_cap.vht_supported)
++		muru->mimo_dl.vht_mu_bfee =
++			!!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
++
++	if (!sta->deflink.he_cap.has_he)
++		return;
++
++	muru->mimo_dl.partial_bw_dl_mimo =
++		HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
++
++	muru->mimo_ul.full_ul_mimo =
++		HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
++	muru->mimo_ul.partial_ul_mimo =
++		HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
++
++	muru->ofdma_dl.punc_pream_rx =
++		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
++	muru->ofdma_dl.he_20m_in_40m_2g =
++		HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
++	muru->ofdma_dl.he_20m_in_160m =
++		HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
++	muru->ofdma_dl.he_80m_in_160m =
++		HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
++
++	muru->ofdma_ul.t_frame_dur =
++		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
++	muru->ofdma_ul.mu_cascading =
++		HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
++	muru->ofdma_ul.uo_ra =
++		HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
++}
++
+ static inline bool
+ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+ 			struct ieee80211_sta *sta, bool bfee)
+@@ -1778,7 +1831,8 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+ 		mt7996_mcu_sta_he_6g_tlv(skb, sta);
+ 		/* starec eht */
+ 		mt7996_mcu_sta_eht_tlv(skb, sta);
+-		/* TODO: starec muru */
++		/* starec muru */
++		mt7996_mcu_sta_muru_tlv(dev, skb, vif, sta);
+ 		/* starec bfee */
+ 		mt7996_mcu_sta_bfee_tlv(dev, skb, vif, sta);
+ 		/* starec hdr trans */
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0010-wifi-mt76-mt7996-fill-txd-bandwidth-filed-value-for-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0010-wifi-mt76-mt7996-fill-txd-bandwidth-filed-value-for-.patch
deleted file mode 100644
index 9f0aa6b..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0010-wifi-mt76-mt7996-fill-txd-bandwidth-filed-value-for-.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From db3aa2948cee6fce2c2cc17d4c5a4a0c31b6365d Mon Sep 17 00:00:00 2001
-From: Howard Hsu <howard-yh.hsu@mediatek.com>
-Date: Wed, 6 Sep 2023 14:51:00 +0800
-Subject: [PATCH 10/22] wifi: mt76: mt7996: fill txd bandwidth filed value for
- fixed rate frame
-
-Fill bw field value for fixed rate enabled frame to keep it be sent by bw20.
-Without this change, the bw of fixed rate enabled frame will be decided
-by hardware.
-
-Reported-by: Chank Chen <chank.chen@mediatek.com>
-Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
----
- mt76_connac3_mac.h | 1 +
- mt7996/mac.c       | 3 ++-
- 2 files changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/mt76_connac3_mac.h b/mt76_connac3_mac.h
-index 87bfa441a..df6b02af9 100644
---- a/mt76_connac3_mac.h
-+++ b/mt76_connac3_mac.h
-@@ -239,6 +239,7 @@ enum tx_mgnt_type {
- 
- #define MT_TXD6_TX_SRC			GENMASK(31, 30)
- #define MT_TXD6_VTA			BIT(28)
-+#define MT_TXD6_FIXED_BW		BIT(25)
- #define MT_TXD6_BW			GENMASK(25, 22)
- #define MT_TXD6_TX_RATE			GENMASK(21, 16)
- #define MT_TXD6_TIMESTAMP_OFS_EN	BIT(15)
-diff --git a/mt7996/mac.c b/mt7996/mac.c
-index c20a6affc..38822402b 100644
---- a/mt7996/mac.c
-+++ b/mt7996/mac.c
-@@ -912,7 +912,8 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
- 				idx = mvif->basic_rates_idx;
- 		}
- 
--		txwi[6] |= cpu_to_le32(FIELD_PREP(MT_TXD6_TX_RATE, idx));
-+		val = FIELD_PREP(MT_TXD6_TX_RATE, idx) | MT_TXD6_FIXED_BW;
-+		txwi[6] |= cpu_to_le32(val);
- 		txwi[3] |= cpu_to_le32(MT_TXD3_BA_DISABLE);
- 	}
- }
--- 
-2.39.2
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0011-wifi-mt76-mt7996-add-IEEE80211_RC_SMPS_CHANGED-handl.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0011-wifi-mt76-mt7996-add-IEEE80211_RC_SMPS_CHANGED-handl.patch
deleted file mode 100644
index 310479f..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0011-wifi-mt76-mt7996-add-IEEE80211_RC_SMPS_CHANGED-handl.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-From c308bd889a207eff9382126f697da59243b593e4 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Mon, 24 Jul 2023 16:32:03 +0800
-Subject: [PATCH 11/22] wifi: mt76: mt7996: add IEEE80211_RC_SMPS_CHANGED
- handler
-
-Send mcu command to firmware to handle smps mode.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7996/mac.c    | 4 +++-
- mt7996/mcu.c    | 8 +++++---
- mt7996/mt7996.h | 2 ++
- 3 files changed, 10 insertions(+), 4 deletions(-)
-
-diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 38822402b..fd1edf140 100644
---- a/mt7996/mac.c
-+++ b/mt7996/mac.c
-@@ -2162,7 +2162,9 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
- 			       IEEE80211_RC_BW_CHANGED))
- 			mt7996_mcu_add_rate_ctrl(dev, vif, sta, true);
- 
--		/* TODO: smps change */
-+		if (changed & IEEE80211_RC_SMPS_CHANGED)
-+			mt7996_mcu_set_fixed_field(dev, vif, sta, NULL,
-+						   RATE_PARAM_MMPS_UPDATE);
- 
- 		spin_lock_bh(&dev->mt76.sta_poll_lock);
- 	}
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 653c1d2b7..a5cfd40f9 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -1680,9 +1680,8 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
- 				     MCU_WM_UNI_CMD(RA), true);
- }
- 
--static int
--mt7996_mcu_set_fixed_field(struct mt7996_dev *dev, struct ieee80211_vif *vif,
--			   struct ieee80211_sta *sta, void *data, u32 field)
-+int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-+			       struct ieee80211_sta *sta, void *data, u32 field)
- {
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
-@@ -1710,6 +1709,9 @@ mt7996_mcu_set_fixed_field(struct mt7996_dev *dev, struct ieee80211_vif *vif,
- 		if (phy)
- 			ra->phy = *phy;
- 		break;
-+	case RATE_PARAM_MMPS_UPDATE:
-+		ra->mmps_mode = mt7996_mcu_get_mmps_mode(sta->deflink.smps_mode);
-+		break;
- 	default:
- 		break;
- 	}
-diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 56e2cef1a..890f522d9 100644
---- a/mt7996/mt7996.h
-+++ b/mt7996/mt7996.h
-@@ -397,6 +397,8 @@ int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy, struct ieee80211_vif *vif,
- int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
- 			     struct ieee80211_sta *sta, bool changed);
- int mt7996_set_channel(struct mt7996_phy *phy);
-+int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-+			       struct ieee80211_sta *sta, void *data, u32 field);
- int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag);
- int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif);
- int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
--- 
-2.39.2
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0011-wifi-mt76-mt7996-increase-tx-token-size.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0011-wifi-mt76-mt7996-increase-tx-token-size.patch
new file mode 100644
index 0000000..aa039ce
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0011-wifi-mt76-mt7996-increase-tx-token-size.patch
@@ -0,0 +1,30 @@
+From 0cc8d7827510e36978175d84d63cced5f842ff61 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Mon, 17 Apr 2023 09:49:53 +0800
+Subject: [PATCH 11/11] wifi: mt76: mt7996: increase tx token size
+
+Align tx token size to proprietary driver, which can improve peak
+throughput under MU performance tests.
+
+Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ mt7996/mt7996.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index a3bd85d3..651f53aa 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -36,7 +36,7 @@
+ #define MT7996_EEPROM_DEFAULT		"mediatek/mt7996/mt7996_eeprom.bin"
+ #define MT7996_EEPROM_SIZE		7680
+ #define MT7996_EEPROM_BLOCK_SIZE	16
+-#define MT7996_TOKEN_SIZE		8192
++#define MT7996_TOKEN_SIZE		16384
+ 
+ #define MT7996_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
+ #define MT7996_CFEND_RATE_11B		0x03	/* 11B LP, 11M */
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0012-wifi-mt76-mt7996-fix-mcu-command-format-to-align-fir.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0012-wifi-mt76-mt7996-fix-mcu-command-format-to-align-fir.patch
deleted file mode 100644
index 26f923e..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0012-wifi-mt76-mt7996-fix-mcu-command-format-to-align-fir.patch
+++ /dev/null
@@ -1,154 +0,0 @@
-From d1cc4c8da42cf8e3feef5a75611eefd8bf693823 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Fri, 7 Jul 2023 10:35:05 +0800
-Subject: [PATCH 12/22] wifi: mt76: mt7996: fix mcu command format to align
- firmware
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7996/mcu.c | 12 ++++-----
- mt7996/mcu.h | 71 ++++++++++++++++++++++++++++++++++++++++++++++++++--
- 2 files changed, 75 insertions(+), 8 deletions(-)
-
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index a5cfd40f9..9dfee8292 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -1685,8 +1685,8 @@ int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev, struct ieee80211_vif *vif
- {
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
--	struct sta_phy *phy = data;
--	struct sta_rec_ra_fixed *ra;
-+	struct sta_phy_uni *phy = data;
-+	struct sta_rec_ra_fixed_uni *ra;
- 	struct sk_buff *skb;
- 	struct tlv *tlv;
- 
-@@ -1697,7 +1697,7 @@ int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev, struct ieee80211_vif *vif
- 		return PTR_ERR(skb);
- 
- 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
--	ra = (struct sta_rec_ra_fixed *)tlv;
-+	ra = (struct sta_rec_ra_fixed_uni *)tlv;
- 
- 	switch (field) {
- 	case RATE_PARAM_AUTO:
-@@ -1729,7 +1729,7 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
- 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
- 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
- 	enum nl80211_band band = chandef->chan->band;
--	struct sta_phy phy = {};
-+	struct sta_phy_uni phy = {};
- 	int ret, nrates = 0;
- 
- #define __sta_phy_bitrate_mask_check(_mcs, _gi, _ht, _he)			\
-@@ -1817,13 +1817,13 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
- 	struct cfg80211_chan_def *chandef = &mphy->chandef;
- 	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
- 	enum nl80211_band band = chandef->chan->band;
--	struct sta_rec_ra *ra;
-+	struct sta_rec_ra_uni *ra;
- 	struct tlv *tlv;
- 	u32 supp_rate = sta->deflink.supp_rates[band];
- 	u32 cap = sta->wme ? STA_CAP_WMM : 0;
- 
- 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
--	ra = (struct sta_rec_ra *)tlv;
-+	ra = (struct sta_rec_ra_uni *)tlv;
- 
- 	ra->valid = true;
- 	ra->auto_rate = true;
-diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 78ecd757e..05785cb9f 100644
---- a/mt7996/mcu.h
-+++ b/mt7996/mcu.h
-@@ -433,6 +433,73 @@ struct sta_rec_sec_uni {
- 	struct sec_key_uni key[2];
- } __packed;
- 
-+struct sta_phy_uni {
-+	u8 type;
-+	u8 flag;
-+	u8 stbc;
-+	u8 sgi;
-+	u8 bw;
-+	u8 ldpc;
-+	u8 mcs;
-+	u8 nss;
-+	u8 he_ltf;
-+	u8 rsv[3];
-+};
-+
-+struct sta_rec_ra_uni {
-+	__le16 tag;
-+	__le16 len;
-+
-+	u8 valid;
-+	u8 auto_rate;
-+	u8 phy_mode;
-+	u8 channel;
-+	u8 bw;
-+	u8 disable_cck;
-+	u8 ht_mcs32;
-+	u8 ht_gf;
-+	u8 ht_mcs[4];
-+	u8 mmps_mode;
-+	u8 gband_256;
-+	u8 af;
-+	u8 auth_wapi_mode;
-+	u8 rate_len;
-+
-+	u8 supp_mode;
-+	u8 supp_cck_rate;
-+	u8 supp_ofdm_rate;
-+	__le32 supp_ht_mcs;
-+	__le16 supp_vht_mcs[4];
-+
-+	u8 op_mode;
-+	u8 op_vht_chan_width;
-+	u8 op_vht_rx_nss;
-+	u8 op_vht_rx_nss_type;
-+
-+	__le32 sta_cap;
-+
-+	struct sta_phy_uni phy;
-+	u8 rx_rcpi[4];
-+} __packed;
-+
-+struct sta_rec_ra_fixed_uni {
-+	__le16 tag;
-+	__le16 len;
-+
-+	__le32 field;
-+	u8 op_mode;
-+	u8 op_vht_chan_width;
-+	u8 op_vht_rx_nss;
-+	u8 op_vht_rx_nss_type;
-+
-+	struct sta_phy_uni phy;
-+
-+	u8 spe_idx;
-+	u8 short_preamble;
-+	u8 is_5g;
-+	u8 mmps_mode;
-+} __packed;
-+
- struct sta_rec_hdrt {
- 	__le16 tag;
- 	__le16 len;
-@@ -616,9 +683,9 @@ enum {
- 					 sizeof(struct sta_rec_amsdu) +		\
- 					 sizeof(struct sta_rec_bfee) +		\
- 					 sizeof(struct sta_rec_phy) +		\
--					 sizeof(struct sta_rec_ra) +		\
-+					 sizeof(struct sta_rec_ra_uni) +	\
- 					 sizeof(struct sta_rec_sec) +		\
--					 sizeof(struct sta_rec_ra_fixed) +	\
-+					 sizeof(struct sta_rec_ra_fixed_uni) +	\
- 					 sizeof(struct sta_rec_he_6g_capa) +	\
- 					 sizeof(struct sta_rec_eht) +		\
- 					 sizeof(struct sta_rec_hdrt) +		\
--- 
-2.39.2
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0013-wifi-mt76-mt7996-add-lock-for-indirect-register-acce.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0013-wifi-mt76-mt7996-add-lock-for-indirect-register-acce.patch
deleted file mode 100644
index f05595a..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0013-wifi-mt76-mt7996-add-lock-for-indirect-register-acce.patch
+++ /dev/null
@@ -1,170 +0,0 @@
-From 843b9adeef21e5e3e574baea8391a929bf48412a Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Mon, 3 Jul 2023 22:38:43 +0800
-Subject: [PATCH 13/22] wifi: mt76: mt7996: add lock for indirect register
- access
-
-Some races were observed during indirect register access, fix this
-by adding reg_lock and reworking l1/l2 remap flow.
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
-Change-Id: I0de2cd27df9ccb7f9a7d9ce265e869175b1ca7f1
----
- mt7996/mmio.c   | 68 +++++++++++++++++++++++++++++++++----------------
- mt7996/mt7996.h |  3 +--
- 2 files changed, 47 insertions(+), 24 deletions(-)
-
-diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index 3a591a7b4..d5eaa1bcf 100644
---- a/mt7996/mmio.c
-+++ b/mt7996/mmio.c
-@@ -82,7 +82,6 @@ static u32 mt7996_reg_map_l1(struct mt7996_dev *dev, u32 addr)
- 	u32 offset = FIELD_GET(MT_HIF_REMAP_L1_OFFSET, addr);
- 	u32 base = FIELD_GET(MT_HIF_REMAP_L1_BASE, addr);
- 
--	dev->reg_l1_backup = dev->bus_ops->rr(&dev->mt76, MT_HIF_REMAP_L1);
- 	dev->bus_ops->rmw(&dev->mt76, MT_HIF_REMAP_L1,
- 			  MT_HIF_REMAP_L1_MASK,
- 			  FIELD_PREP(MT_HIF_REMAP_L1_MASK, base));
-@@ -97,7 +96,6 @@ static u32 mt7996_reg_map_l2(struct mt7996_dev *dev, u32 addr)
- 	u32 offset = FIELD_GET(MT_HIF_REMAP_L2_OFFSET, addr);
- 	u32 base = FIELD_GET(MT_HIF_REMAP_L2_BASE, addr);
- 
--	dev->reg_l2_backup = dev->bus_ops->rr(&dev->mt76, MT_HIF_REMAP_L2);
- 	dev->bus_ops->rmw(&dev->mt76, MT_HIF_REMAP_L2,
- 			  MT_HIF_REMAP_L2_MASK,
- 			  FIELD_PREP(MT_HIF_REMAP_L2_MASK, base));
-@@ -107,26 +105,10 @@ static u32 mt7996_reg_map_l2(struct mt7996_dev *dev, u32 addr)
- 	return MT_HIF_REMAP_BASE_L2 + offset;
- }
- 
--static void mt7996_reg_remap_restore(struct mt7996_dev *dev)
--{
--	/* remap to ori status */
--	if (unlikely(dev->reg_l1_backup)) {
--		dev->bus_ops->wr(&dev->mt76, MT_HIF_REMAP_L1, dev->reg_l1_backup);
--		dev->reg_l1_backup = 0;
--	}
--
--	if (dev->reg_l2_backup) {
--		dev->bus_ops->wr(&dev->mt76, MT_HIF_REMAP_L2, dev->reg_l2_backup);
--		dev->reg_l2_backup = 0;
--	}
--}
--
- static u32 __mt7996_reg_addr(struct mt7996_dev *dev, u32 addr)
- {
- 	int i;
- 
--	mt7996_reg_remap_restore(dev);
--
- 	if (addr < 0x100000)
- 		return addr;
- 
-@@ -143,6 +125,11 @@ static u32 __mt7996_reg_addr(struct mt7996_dev *dev, u32 addr)
- 		return dev->reg.map[i].mapped + ofs;
- 	}
- 
-+	return 0;
-+}
-+
-+static u32 __mt7996_reg_remap_addr(struct mt7996_dev *dev, u32 addr)
-+{
- 	if ((addr >= MT_INFRA_BASE && addr < MT_WFSYS0_PHY_START) ||
- 	    (addr >= MT_WFSYS0_PHY_START && addr < MT_WFSYS1_PHY_START) ||
- 	    (addr >= MT_WFSYS1_PHY_START && addr <= MT_WFSYS1_PHY_END))
-@@ -166,29 +153,65 @@ void mt7996_memcpy_fromio(struct mt7996_dev *dev, void *buf, u32 offset,
- 			  size_t len)
- {
- 	u32 addr = __mt7996_reg_addr(dev, offset);
-+	unsigned long flags;
- 
--	memcpy_fromio(buf, dev->mt76.mmio.regs + addr, len);
-+	if (addr) {
-+		memcpy_fromio(buf, dev->mt76.mmio.regs + addr, len);
-+		return;
-+	}
-+
-+	spin_lock_irqsave(&dev->reg_lock, flags);
-+	memcpy_fromio(buf, dev->mt76.mmio.regs +
-+			   __mt7996_reg_remap_addr(dev, offset), len);
-+	spin_unlock_irqrestore(&dev->reg_lock, flags);
- }
- 
- static u32 mt7996_rr(struct mt76_dev *mdev, u32 offset)
- {
- 	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
-+	u32 addr = __mt7996_reg_addr(dev, offset), val;
-+	unsigned long flags;
-+
-+	if (addr)
-+		return dev->bus_ops->rr(mdev, addr);
- 
--	return dev->bus_ops->rr(mdev, __mt7996_reg_addr(dev, offset));
-+	spin_lock_irqsave(&dev->reg_lock, flags);
-+	val = dev->bus_ops->rr(mdev, __mt7996_reg_remap_addr(dev, offset));
-+	spin_unlock_irqrestore(&dev->reg_lock, flags);
-+
-+	return val;
- }
- 
- static void mt7996_wr(struct mt76_dev *mdev, u32 offset, u32 val)
- {
- 	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
-+	u32 addr = __mt7996_reg_addr(dev, offset);
-+	unsigned long flags;
- 
--	dev->bus_ops->wr(mdev, __mt7996_reg_addr(dev, offset), val);
-+	if (addr) {
-+		dev->bus_ops->wr(mdev, addr, val);
-+		return;
-+	}
-+
-+	spin_lock_irqsave(&dev->reg_lock, flags);
-+	dev->bus_ops->wr(mdev, __mt7996_reg_remap_addr(dev, offset), val);
-+	spin_unlock_irqrestore(&dev->reg_lock, flags);
- }
- 
- static u32 mt7996_rmw(struct mt76_dev *mdev, u32 offset, u32 mask, u32 val)
- {
- 	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
-+	u32 addr = __mt7996_reg_addr(dev, offset);
-+	unsigned long flags;
-+
-+	if (addr)
-+		return dev->bus_ops->rmw(mdev, addr, mask, val);
-+
-+	spin_lock_irqsave(&dev->reg_lock, flags);
-+	val = dev->bus_ops->rmw(mdev, __mt7996_reg_remap_addr(dev, offset), mask, val);
-+	spin_unlock_irqrestore(&dev->reg_lock, flags);
- 
--	return dev->bus_ops->rmw(mdev, __mt7996_reg_addr(dev, offset), mask, val);
-+	return val;
- }
- 
- static int mt7996_mmio_init(struct mt76_dev *mdev,
-@@ -200,6 +223,7 @@ static int mt7996_mmio_init(struct mt76_dev *mdev,
- 
- 	dev = container_of(mdev, struct mt7996_dev, mt76);
- 	mt76_mmio_init(&dev->mt76, mem_base);
-+	spin_lock_init(&dev->reg_lock);
- 
- 	switch (device_id) {
- 	case 0x7990:
-diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 890f522d9..ea1104845 100644
---- a/mt7996/mt7996.h
-+++ b/mt7996/mt7996.h
-@@ -257,8 +257,7 @@ struct mt7996_dev {
- 		u8 n_agrt;
- 	} twt;
- 
--	u32 reg_l1_backup;
--	u32 reg_l2_backup;
-+	spinlock_t reg_lock;
- 
- 	u8 wtbl_size_group;
- };
--- 
-2.39.2
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0014-wifi-mt76-mt7996-set-wcid-in-txp.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0014-wifi-mt76-mt7996-set-wcid-in-txp.patch
new file mode 100644
index 0000000..8103127
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0014-wifi-mt76-mt7996-set-wcid-in-txp.patch
@@ -0,0 +1,36 @@
+From 5e2177e77b9609185f748708332aa6a6fdf4d1f9 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Mon, 6 Mar 2023 15:52:26 +0800
+Subject: [PATCH 14/39] wifi: mt76: mt7996: set wcid in txp
+
+Set correct wcid in txp for SDO to get wtbl.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Change-Id: Ie715a659ff52f2d85332158f273d0ee4fe9f4051
+---
+ mt7996/mac.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/mt7996/mac.c b/mt7996/mac.c
+index 2da61d2..bddb84f 100644
+--- a/mt7996/mac.c
++++ b/mt7996/mac.c
+@@ -1166,10 +1166,12 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 	}
+ 
+ 	txp->fw.token = cpu_to_le16(id);
+-	if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags))
+-		txp->fw.rept_wds_wcid = cpu_to_le16(wcid->idx);
+-	else
++	if ((is_8023 && is_multicast_ether_addr(tx_info->skb->data)) ||
++	    (!is_8023 && is_multicast_ether_addr(hdr->addr1)))
+ 		txp->fw.rept_wds_wcid = cpu_to_le16(0xfff);
++	else
++		txp->fw.rept_wds_wcid = cpu_to_le16(wcid->idx);
++
+ 	tx_info->skb = DMA_DUMMY_DATA;
+ 
+ 	/* pass partial skb header to fw */
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0015-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0015-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch
new file mode 100644
index 0000000..ea01cf0
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0015-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch
@@ -0,0 +1,67 @@
+From 5580f05c864aadfad4092fc97a937869dc08eca8 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Thu, 16 Feb 2023 00:39:01 +0800
+Subject: [PATCH 15/39] wifi: mt76: mt7996: reduce repeated bss_info and
+ sta_rec commands
+
+Refine the flow of setting bss_info and sta_rec commands to prevent from
+sending duplicated commands, especially for station mode.
+
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Change-Id: Iffd2c81f9ec98284793e75f4b7d39e9618977024
+---
+ mt7996/main.c | 21 ++++++---------------
+ 1 file changed, 6 insertions(+), 15 deletions(-)
+
+diff --git a/mt7996/main.c b/mt7996/main.c
+index 786c3fb..02a33b8 100644
+--- a/mt7996/main.c
++++ b/mt7996/main.c
+@@ -248,8 +248,8 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
+ 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
+ 	int idx = msta->wcid.idx;
+ 
+-	mt7996_mcu_add_bss_info(phy, vif, false);
+ 	mt7996_mcu_add_sta(dev, vif, NULL, false);
++	mt7996_mcu_add_bss_info(phy, vif, false);
+ 
+ 	if (vif == phy->monitor_vif)
+ 		phy->monitor_vif = NULL;
+@@ -544,17 +544,13 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
+ 	/* station mode uses BSSID to map the wlan entry to a peer,
+ 	 * and then peer references bss_info_rfch to set bandwidth cap.
+ 	 */
+-	if (changed & BSS_CHANGED_BSSID &&
+-	    vif->type == NL80211_IFTYPE_STATION) {
+-		bool join = !is_zero_ether_addr(info->bssid);
+-
+-		mt7996_mcu_add_bss_info(phy, vif, join);
+-		mt7996_mcu_add_sta(dev, vif, NULL, join);
++	if ((changed & BSS_CHANGED_BSSID && !is_zero_ether_addr(info->bssid)) ||
++	    (changed & BSS_CHANGED_ASSOC && vif->cfg.assoc) ||
++	    (changed & BSS_CHANGED_BEACON_ENABLED && info->enable_beacon)) {
++		mt7996_mcu_add_bss_info(phy, vif, true);
++		mt7996_mcu_add_sta(dev, vif, NULL, true);
+ 	}
+ 
+-	if (changed & BSS_CHANGED_ASSOC)
+-		mt7996_mcu_add_bss_info(phy, vif, vif->cfg.assoc);
+-
+ 	if (changed & BSS_CHANGED_ERP_CTS_PROT)
+ 		mt7996_mac_enable_rtscts(dev, vif, info->use_cts_prot);
+ 
+@@ -575,11 +571,6 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
+ 		mvif->basic_rates_idx =
+ 			mt7996_get_rates_table(hw, vif, false, false);
+ 
+-	if (changed & BSS_CHANGED_BEACON_ENABLED && info->enable_beacon) {
+-		mt7996_mcu_add_bss_info(phy, vif, true);
+-		mt7996_mcu_add_sta(dev, vif, NULL, true);
+-	}
+-
+ 	/* ensure that enable txcmd_mode after bss_info */
+ 	if (changed & (BSS_CHANGED_QOS | BSS_CHANGED_BEACON_ENABLED))
+ 		mt7996_mcu_set_tx(dev, vif);
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0014-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0016-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch
similarity index 76%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0014-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0016-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch
index 6079c79..e6a4f75 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0014-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0016-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch
@@ -1,7 +1,7 @@
-From 8fecc721eb37961a4eb2238be62d83d70a368c59 Mon Sep 17 00:00:00 2001
+From eec83d4410d7c669d9a05bba1a69a742a6ccd490 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 16 Feb 2023 13:53:14 +0800
-Subject: [PATCH 14/22] wifi: mt76: connac: set correct muar_idx for connac3
+Subject: [PATCH 16/39] wifi: mt76: connac: set correct muar_idx for connac3
  chipset
 
 Set the muar_idx to 0xe for the hw bcast/mcast station entry of connac3
@@ -15,10 +15,10 @@
  2 files changed, 8 insertions(+)
 
 diff --git a/mt76_connac.h b/mt76_connac.h
-index 1f29d8cd9..fa742b9ae 100644
+index 77ca8f0..02acac6 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
-@@ -245,6 +245,11 @@ static inline bool is_connac_v1(struct mt76_dev *dev)
+@@ -240,6 +240,11 @@ static inline bool is_connac_v1(struct mt76_dev *dev)
  	return is_mt7615(dev) || is_mt7663(dev) || is_mt7622(dev);
  }
  
@@ -31,10 +31,10 @@
  {
  	switch (mt76_chip(dev)) {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index bcd6c20f3..68de52535 100644
+index 46f69aa..5fab677 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -282,6 +282,9 @@ __mt76_connac_mcu_alloc_sta_req(struct mt76_dev *dev, struct mt76_vif *mvif,
+@@ -281,6 +281,9 @@ __mt76_connac_mcu_alloc_sta_req(struct mt76_dev *dev, struct mt76_vif *mvif,
  	};
  	struct sk_buff *skb;
  
@@ -45,5 +45,5 @@
  				     &hdr.wlan_idx_hi);
  	skb = mt76_mcu_msg_alloc(dev, NULL, len);
 -- 
-2.39.2
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0016-wifi-mt76-mt7996-get-tx_retries-and-tx_failed-from-t.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0016-wifi-mt76-mt7996-get-tx_retries-and-tx_failed-from-t.patch
deleted file mode 100644
index c6e5cb6..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0016-wifi-mt76-mt7996-get-tx_retries-and-tx_failed-from-t.patch
+++ /dev/null
@@ -1,107 +0,0 @@
-From fd9cc614274b3bfbc1604c2a93cac2a1169e3518 Mon Sep 17 00:00:00 2001
-From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
-Date: Wed, 28 Jun 2023 07:51:38 +0800
-Subject: [PATCH 16/22] wifi: mt76: mt7996: get tx_retries and tx_failed from
- txfree for both wed on and wed off
-
----
- mt76_connac3_mac.h |  4 ++--
- mt7996/mac.c       | 21 ++++++++++++++++-----
- mt7996/main.c      |  6 ++++++
- 3 files changed, 24 insertions(+), 7 deletions(-)
-
-diff --git a/mt76_connac3_mac.h b/mt76_connac3_mac.h
-index df6b02af9..20a2fe931 100644
---- a/mt76_connac3_mac.h
-+++ b/mt76_connac3_mac.h
-@@ -272,11 +272,11 @@ enum tx_mgnt_type {
- #define MT_TXFREE0_MSDU_CNT		GENMASK(25, 16)
- #define MT_TXFREE0_RX_BYTE		GENMASK(15, 0)
- 
--#define MT_TXFREE1_VER			GENMASK(18, 16)
-+#define MT_TXFREE1_VER			GENMASK(19, 16)
- 
- #define MT_TXFREE_INFO_PAIR		BIT(31)
- #define MT_TXFREE_INFO_HEADER		BIT(30)
--#define MT_TXFREE_INFO_WLAN_ID		GENMASK(23, 12)
-+#define MT_TXFREE_INFO_MLD_ID		GENMASK(23, 12)
- #define MT_TXFREE_INFO_MSDU_ID		GENMASK(14, 0)
- #define MT_TXFREE_INFO_COUNT		GENMASK(27, 24)
- #define MT_TXFREE_INFO_STAT		GENMASK(29, 28)
-diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 0aabded63..8f3742c4e 100644
---- a/mt7996/mac.c
-+++ b/mt7996/mac.c
-@@ -1065,6 +1065,7 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
- 	struct mt76_phy *phy3 = mdev->phys[MT_BAND2];
- 	struct mt76_txwi_cache *txwi;
- 	struct ieee80211_sta *sta = NULL;
-+	struct mt76_wcid *wcid;
- 	LIST_HEAD(free_list);
- 	struct sk_buff *skb, *tmp;
- 	void *end = data + len;
-@@ -1083,7 +1084,7 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
- 		mt76_queue_tx_cleanup(dev, phy3->q_tx[MT_TXQ_BE], false);
- 	}
- 
--	if (WARN_ON_ONCE(le32_get_bits(tx_free[1], MT_TXFREE1_VER) < 4))
-+	if (WARN_ON_ONCE(le32_get_bits(tx_free[1], MT_TXFREE1_VER) < 5))
- 		return;
- 
- 	total = le32_get_bits(tx_free[0], MT_TXFREE0_MSDU_CNT);
-@@ -1099,10 +1100,9 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
- 		info = le32_to_cpu(*cur_info);
- 		if (info & MT_TXFREE_INFO_PAIR) {
- 			struct mt7996_sta *msta;
--			struct mt76_wcid *wcid;
- 			u16 idx;
- 
--			idx = FIELD_GET(MT_TXFREE_INFO_WLAN_ID, info);
-+			idx = FIELD_GET(MT_TXFREE_INFO_MLD_ID, info);
- 			wcid = rcu_dereference(dev->mt76.wcid[idx]);
- 			sta = wcid_to_sta(wcid);
- 			if (!sta)
-@@ -1115,10 +1115,21 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
- 					      &mdev->sta_poll_list);
- 			spin_unlock_bh(&mdev->sta_poll_lock);
- 			continue;
--		}
-+		} else if (info & MT_TXFREE_INFO_HEADER) {
-+			u32 tx_retries = 0, tx_failed = 0;
-+
-+			if (!wcid)
-+				continue;
-+
-+			tx_retries =
-+				FIELD_GET(MT_TXFREE_INFO_COUNT, info) - 1;
-+			tx_failed = tx_retries +
-+				!!FIELD_GET(MT_TXFREE_INFO_STAT, info);
- 
--		if (info & MT_TXFREE_INFO_HEADER)
-+			wcid->stats.tx_retries += tx_retries;
-+			wcid->stats.tx_failed += tx_failed;
- 			continue;
-+		}
- 
- 		for (i = 0; i < 2; i++) {
- 			msdu = (info >> (15 * i)) & MT_TXFREE_INFO_MSDU_ID;
-diff --git a/mt7996/main.c b/mt7996/main.c
-index d8fd8191c..32d975c63 100644
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -997,6 +997,12 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
- 	sinfo->txrate.flags = txrate->flags;
- 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
- 
-+	sinfo->tx_failed = msta->wcid.stats.tx_failed;
-+	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
-+
-+	sinfo->tx_retries = msta->wcid.stats.tx_retries;
-+	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
-+
- 	sinfo->ack_signal = (s8)msta->ack_signal;
- 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_ACK_SIGNAL);
- 
--- 
-2.39.2
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0017-wifi-mt76-mt7996-Add-mcu-commands-for-getting-sta-tx.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0017-wifi-mt76-mt7996-Add-mcu-commands-for-getting-sta-tx.patch
deleted file mode 100644
index d130143..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0017-wifi-mt76-mt7996-Add-mcu-commands-for-getting-sta-tx.patch
+++ /dev/null
@@ -1,245 +0,0 @@
-From 19082cf5d84a2c1a8e92d525a96de49b08d086fd Mon Sep 17 00:00:00 2001
-From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
-Date: Wed, 28 Jun 2023 08:10:25 +0800
-Subject: [PATCH 17/22] wifi: mt76: mt7996: Add mcu commands for getting sta tx
- statistic
-
-Add ALL_STA command to query station tx statistic from WM mcu.
-The commands are called periodically to query information from the WM mcu.
-The response events are sent as unsolicited event.
-
-We get tx bytes and rx bytes counts with tag UNI_ALL_STA_TXRX_ADM_STAT
-and get MSDU packet counts with tag UNI_ALL_STA_TRX_MSDU_COUNT.
-The MSDU packet counts are based on UWTBL DW10 and DW11.
-It's accumulative and not read-clear.
----
- mt76_connac_mcu.h | 15 +++++++++++
- mt7996/mac.c      |  3 +++
- mt7996/main.c     | 12 +++++++++
- mt7996/mcu.c      | 68 +++++++++++++++++++++++++++++++++++++++++++++++
- mt7996/mcu.h      | 29 ++++++++++++++++++++
- mt7996/mt7996.h   |  1 +
- 6 files changed, 128 insertions(+)
-
-diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 90c08d276..e9dd9aa64 100644
---- a/mt76_connac_mcu.h
-+++ b/mt76_connac_mcu.h
-@@ -1023,6 +1023,8 @@ enum {
- 	MCU_UNI_EVENT_TX_DONE = 0x2d,
- 	MCU_UNI_EVENT_THERMAL = 0x35,
- 	MCU_UNI_EVENT_NIC_CAPAB = 0x43,
-+	MCU_UNI_EVENT_PER_STA_INFO = 0x6d,
-+	MCU_UNI_EVENT_ALL_STA_INFO = 0x6e,
- };
- 
- #define MCU_UNI_CMD_EVENT			BIT(1)
-@@ -1242,6 +1244,8 @@ enum {
- 	MCU_UNI_CMD_FIXED_RATE_TABLE = 0x40,
- 	MCU_UNI_CMD_RRO = 0x57,
- 	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
-+	MCU_UNI_CMD_PER_STA_INFO = 0x6d,
-+	MCU_UNI_CMD_ALL_STA_INFO = 0x6e,
- 	MCU_UNI_CMD_ASSERT_DUMP = 0x6f,
- };
- 
-@@ -1322,6 +1326,17 @@ enum {
- 	UNI_OFFLOAD_OFFLOAD_BMC_RPY_DETECT,
- };
- 
-+enum UNI_ALL_STA_INFO_TAG {
-+	UNI_ALL_STA_TX_RATE,
-+	UNI_ALL_STA_TX_STAT,
-+	UNI_ALL_STA_TXRX_ADM_STAT,
-+	UNI_ALL_STA_TXRX_AIR_TIME,
-+	UNI_ALL_STA_DATA_TX_RETRY_COUNT,
-+	UNI_ALL_STA_GI_MODE,
-+	UNI_ALL_STA_TXRX_MSDU_COUNT,
-+	UNI_ALL_STA_MAX_NUM
-+};
-+
- enum {
- 	MT_NIC_CAP_TX_RESOURCE,
- 	MT_NIC_CAP_TX_EFUSE_ADDR,
-diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 8f3742c4e..8f75da695 100644
---- a/mt7996/mac.c
-+++ b/mt7996/mac.c
-@@ -2212,6 +2212,9 @@ void mt7996_mac_work(struct work_struct *work)
- 		mphy->mac_work_count = 0;
- 
- 		mt7996_mac_update_stats(phy);
-+
-+		mt7996_mcu_get_all_sta_info(phy, UNI_ALL_STA_TXRX_ADM_STAT);
-+		mt7996_mcu_get_all_sta_info(phy, UNI_ALL_STA_TXRX_MSDU_COUNT);
- 	}
- 
- 	mutex_unlock(&mphy->dev->mutex);
-diff --git a/mt7996/main.c b/mt7996/main.c
-index 32d975c63..284fb373b 100644
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -1008,6 +1008,18 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
- 
- 	sinfo->avg_ack_signal = -(s8)ewma_avg_signal_read(&msta->avg_ack_signal);
- 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_ACK_SIGNAL_AVG);
-+
-+	sinfo->tx_bytes = msta->wcid.stats.tx_bytes;
-+	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES64);
-+
-+	sinfo->rx_bytes = msta->wcid.stats.rx_bytes;
-+	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES64);
-+
-+	sinfo->tx_packets = msta->wcid.stats.tx_packets;
-+	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
-+
-+	sinfo->rx_packets = msta->wcid.stats.rx_packets;
-+	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS);
- }
- 
- static void mt7996_sta_rc_work(void *data, struct ieee80211_sta *sta)
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 56b2bbc69..146e284fc 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -477,6 +477,54 @@ mt7996_mcu_rx_thermal_notify(struct mt7996_dev *dev, struct sk_buff *skb)
- 	phy->throttle_state = n->duty_percent;
- }
- 
-+static void
-+mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
-+{
-+	struct mt7996_mcu_all_sta_info_event *res;
-+	u16 i;
-+
-+	skb_pull(skb, sizeof(struct mt7996_mcu_rxd));
-+
-+	res = (struct mt7996_mcu_all_sta_info_event *) skb->data;
-+
-+	for (i = 0; i < le16_to_cpu(res->sta_num); i++) {
-+		u8 ac;
-+		u16 wlan_idx;
-+		struct mt76_wcid *wcid;
-+
-+		switch (le16_to_cpu(res->tag)) {
-+		case UNI_ALL_STA_TXRX_ADM_STAT:
-+			wlan_idx = le16_to_cpu(res->adm_stat[i].wlan_idx);
-+			wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
-+
-+			if (!wcid)
-+				break;
-+
-+			for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
-+				wcid->stats.tx_bytes +=
-+					le32_to_cpu(res->adm_stat[i].tx_bytes[ac]);
-+				wcid->stats.rx_bytes +=
-+					le32_to_cpu(res->adm_stat[i].rx_bytes[ac]);
-+			}
-+			break;
-+		case UNI_ALL_STA_TXRX_MSDU_COUNT:
-+			wlan_idx = le16_to_cpu(res->msdu_cnt[i].wlan_idx);
-+			wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
-+
-+			if (!wcid)
-+				break;
-+
-+			wcid->stats.tx_packets +=
-+				le32_to_cpu(res->msdu_cnt[i].tx_msdu_cnt);
-+			wcid->stats.rx_packets +=
-+				le32_to_cpu(res->msdu_cnt[i].rx_msdu_cnt);
-+			break;
-+		default:
-+			break;
-+		}
-+	}
-+}
-+
- static void
- mt7996_mcu_rx_ext_event(struct mt7996_dev *dev, struct sk_buff *skb)
- {
-@@ -524,6 +572,9 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
- 	case MCU_UNI_EVENT_THERMAL:
- 		mt7996_mcu_rx_thermal_notify(dev, skb);
- 		break;
-+	case MCU_UNI_EVENT_ALL_STA_INFO:
-+		mt7996_mcu_rx_all_sta_info_event(dev, skb);
-+		break;
- 	default:
- 		break;
- 	}
-@@ -4194,3 +4245,20 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u8 val)
- 	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(RRO), &req,
- 				 sizeof(req), true);
- }
-+
-+int mt7996_mcu_get_all_sta_info(struct mt7996_phy *phy, u16 tag)
-+{
-+	struct mt7996_dev *dev = phy->dev;
-+	struct {
-+		u8 _rsv[4];
-+
-+		__le16 tag;
-+		__le16 len;
-+	} __packed req = {
-+		.tag = cpu_to_le16(tag),
-+		.len = cpu_to_le16(sizeof(req) - 4),
-+	};
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(ALL_STA_INFO),
-+				 &req, sizeof(req), false);
-+}
-diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 05785cb9f..66af7a90f 100644
---- a/mt7996/mcu.h
-+++ b/mt7996/mcu.h
-@@ -191,6 +191,35 @@ struct mt7996_mcu_thermal_notify {
- 	u8 __rsv2[4];
- } __packed;
- 
-+struct all_sta_trx_adm_stat {
-+	__le16 wlan_idx;
-+	u8 __rsv[2];
-+	__le32 tx_bytes[IEEE80211_NUM_ACS];
-+	__le32 rx_bytes[IEEE80211_NUM_ACS];
-+} __packed;
-+
-+struct all_sta_trx_msdu_cnt {
-+	__le16 wlan_idx;
-+	u8 __rsv[2];
-+	__le32 tx_msdu_cnt;
-+	__le32 rx_msdu_cnt;
-+} __packed;
-+
-+struct mt7996_mcu_all_sta_info_event {
-+	u8 __rsv[4];
-+	__le16 tag;
-+	__le16 len;
-+        u8 more;
-+        u8 __rsv2;
-+        __le16 sta_num;
-+        u8 __rsv3[2];
-+
-+	union {
-+		struct all_sta_trx_adm_stat adm_stat[0];
-+		struct all_sta_trx_msdu_cnt msdu_cnt[0];
-+	};
-+} __packed;
-+
- enum mt7996_chan_mib_offs {
- 	UNI_MIB_OBSS_AIRTIME = 26,
- 	UNI_MIB_NON_WIFI_TIME = 27,
-diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 3ac354b18..bf9960e30 100644
---- a/mt7996/mt7996.h
-+++ b/mt7996/mt7996.h
-@@ -423,6 +423,7 @@ int mt7996_mcu_set_rts_thresh(struct mt7996_phy *phy, u32 val);
- int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct ieee80211_vif *vif);
- int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch);
- int mt7996_mcu_get_temperature(struct mt7996_phy *phy);
-+int mt7996_mcu_get_all_sta_info(struct mt7996_phy *phy, u16 tag);
- int mt7996_mcu_set_thermal_throttling(struct mt7996_phy *phy, u8 state);
- int mt7996_mcu_set_thermal_protect(struct mt7996_phy *phy, bool enable);
- int mt7996_mcu_rdd_cmd(struct mt7996_dev *dev, int cmd, u8 index,
--- 
-2.39.2
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-mt7996-add-thermal-protection-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0017-wifi-mt76-mt7996-add-thermal-protection-support.patch
similarity index 89%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-mt7996-add-thermal-protection-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0017-wifi-mt76-mt7996-add-thermal-protection-support.patch
index 2f79dac..bcc5d51 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-mt7996-add-thermal-protection-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0017-wifi-mt76-mt7996-add-thermal-protection-support.patch
@@ -1,7 +1,7 @@
-From c348e633baeb810556505bfd98c09c8527e43ae8 Mon Sep 17 00:00:00 2001
+From 1fa1645ef7621981c7e87d27b9a7816f3485d3db Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 2 Feb 2023 21:20:31 +0800
-Subject: [PATCH 04/22] wifi: mt76: mt7996: add thermal protection support
+Subject: [PATCH 17/39] wifi: mt76: mt7996: add thermal protection support
 
 This commit includes the following changes:
 1. implement MTK thermal protection driver API
@@ -18,19 +18,19 @@
  6 files changed, 277 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 6064973f9..99077f1fc 100644
+index 6249de5..30c9a5d 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1021,6 +1021,7 @@ enum {
+@@ -1010,6 +1010,7 @@ enum {
+ 	MCU_UNI_EVENT_FW_LOG_2_HOST = 0x04,
+ 	MCU_UNI_EVENT_IE_COUNTDOWN = 0x09,
  	MCU_UNI_EVENT_RDD_REPORT = 0x11,
- 	MCU_UNI_EVENT_ROC = 0x27,
- 	MCU_UNI_EVENT_TX_DONE = 0x2d,
 +	MCU_UNI_EVENT_THERMAL = 0x35,
- 	MCU_UNI_EVENT_NIC_CAPAB = 0x43,
  };
  
+ #define MCU_UNI_CMD_EVENT			BIT(1)
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 12c251382..ccfa511ea 100644
+index 8247153..c072b09 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -42,6 +42,98 @@ static const struct ieee80211_iface_combination if_comb[] = {
@@ -132,7 +132,7 @@
  static void mt7996_led_set_config(struct led_classdev *led_cdev,
  				  u8 delay_on, u8 delay_off)
  {
-@@ -408,6 +500,10 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
+@@ -391,6 +483,10 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
  	if (ret)
  		goto error;
  
@@ -143,7 +143,7 @@
  	ret = mt7996_init_debugfs(phy);
  	if (ret)
  		goto error;
-@@ -428,6 +524,8 @@ mt7996_unregister_phy(struct mt7996_phy *phy, enum mt76_band_id band)
+@@ -411,6 +507,8 @@ mt7996_unregister_phy(struct mt7996_phy *phy, enum mt76_band_id band)
  	if (!phy)
  		return;
  
@@ -152,7 +152,7 @@
  	mphy = phy->dev->mt76.phys[band];
  	mt76_unregister_phy(mphy);
  	ieee80211_free_hw(mphy->hw);
-@@ -891,6 +989,10 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -882,6 +980,10 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
@@ -163,7 +163,7 @@
  	ieee80211_queue_work(mt76_hw(dev), &dev->init_work);
  
  	ret = mt7996_register_phy(dev, mt7996_phy2(dev), MT_BAND1);
-@@ -914,6 +1016,7 @@ void mt7996_unregister_device(struct mt7996_dev *dev)
+@@ -905,6 +1007,7 @@ void mt7996_unregister_device(struct mt7996_dev *dev)
  {
  	mt7996_unregister_phy(mt7996_phy3(dev), MT_BAND2);
  	mt7996_unregister_phy(mt7996_phy2(dev), MT_BAND1);
@@ -172,7 +172,7 @@
  	mt76_unregister_device(&dev->mt76);
  	mt7996_mcu_exit(dev);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index a2ab668a3..ec25351cc 100644
+index 02a33b8..9c80839 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -51,6 +51,14 @@ int mt7996_run(struct ieee80211_hw *hw)
@@ -183,7 +183,7 @@
 +	if (ret)
 +		goto out;
 +
-+	ret = mt7996_mcu_set_thermal_protect(phy, true);
++	ret = mt7996_mcu_set_thermal_protect(phy);
 +	if (ret)
 +		goto out;
 +
@@ -191,10 +191,10 @@
  
  	ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index d422214e2..ff6b82a9f 100644
+index c50dcce..c308d86 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -449,6 +449,34 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -447,6 +447,34 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb)
  	}
  }
  
@@ -229,7 +229,7 @@
  static void
  mt7996_mcu_rx_ext_event(struct mt7996_dev *dev, struct sk_buff *skb)
  {
-@@ -493,6 +521,9 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -491,6 +519,9 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
  	case MCU_UNI_EVENT_RDD_REPORT:
  		mt7996_mcu_rx_radar_detected(dev, skb);
  		break;
@@ -239,7 +239,7 @@
  	default:
  		break;
  	}
-@@ -3451,6 +3482,81 @@ out:
+@@ -3217,6 +3248,81 @@ out:
  	return 0;
  }
  
@@ -277,7 +277,7 @@
 +	return 0;
 +}
 +
-+int mt7996_mcu_set_thermal_protect(struct mt7996_phy *phy, bool enable)
++int mt7996_mcu_set_thermal_protect(struct mt7996_phy *phy)
 +{
 +#define SUSTAIN_PERIOD		10
 +	struct {
@@ -302,7 +302,7 @@
 +
 +	ret = mt76_mcu_send_msg(&phy->dev->mt76, MCU_WM_UNI_CMD(THERMAL),
 +				&req, sizeof(req) - sizeof(req.enable), false);
-+	if (ret || !enable)
++	if (ret)
 +		return ret;
 +
 +	/* set high-temperature trigger threshold */
@@ -322,7 +322,7 @@
  {
  	struct {
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index e4b31228b..f1528df82 100644
+index 078f828..f235175 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -30,6 +30,28 @@ struct mt7996_mcu_uni_event {
@@ -377,7 +377,7 @@
  enum mt7996_chan_mib_offs {
  	UNI_MIB_OBSS_AIRTIME = 26,
  	UNI_MIB_NON_WIFI_TIME = 27,
-@@ -656,6 +694,12 @@ enum{
+@@ -659,6 +697,12 @@ enum{
  	UNI_CMD_SR_SET_SIGA = 0xd0,
  };
  
@@ -391,7 +391,7 @@
  	UNI_CMD_ACCESS_REG_BASIC = 0x0,
  	UNI_CMD_ACCESS_RF_REG_BASIC,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 25a563f74..810a472ea 100644
+index 651f53a..071031b 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -49,6 +49,13 @@
@@ -408,7 +408,7 @@
  struct mt7996_vif;
  struct mt7996_sta;
  struct mt7996_dfs_pulse;
-@@ -155,6 +162,11 @@ struct mt7996_phy {
+@@ -217,6 +224,11 @@ struct mt7996_phy {
  
  	struct ieee80211_vif *monitor_vif;
  
@@ -420,16 +420,16 @@
  	u32 rxfilter;
  	u64 omac_mask;
  
-@@ -391,6 +403,9 @@ int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable);
+@@ -466,6 +478,9 @@ int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable);
  int mt7996_mcu_set_rts_thresh(struct mt7996_phy *phy, u32 val);
  int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct ieee80211_vif *vif);
  int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch);
 +int mt7996_mcu_get_temperature(struct mt7996_phy *phy);
 +int mt7996_mcu_set_thermal_throttling(struct mt7996_phy *phy, u8 state);
-+int mt7996_mcu_set_thermal_protect(struct mt7996_phy *phy, bool enable);
++int mt7996_mcu_set_thermal_protect(struct mt7996_phy *phy);
  int mt7996_mcu_rdd_cmd(struct mt7996_dev *dev, int cmd, u8 index,
  		       u8 rx_sel, u8 val);
  int mt7996_mcu_rdd_background_enable(struct mt7996_phy *phy,
 -- 
-2.39.2
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0005-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0018-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0005-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0018-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch
index e054827..effc63b 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0005-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0018-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch
@@ -1,7 +1,7 @@
-From 4df411cd61129d17fcaf39c8a588f8b64aaf147c Mon Sep 17 00:00:00 2001
+From db282c765c1d9cd2a5eec6a095069fd4bcf627b4 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 2 Feb 2023 20:53:42 +0800
-Subject: [PATCH 05/22] wifi: mt76: mt7996: add thermal sensor device support
+Subject: [PATCH 18/39] wifi: mt76: mt7996: add thermal sensor device support
 
 ---
  mt7996/init.c | 87 +++++++++++++++++++++++++++++++++++++++++++++++++++
@@ -9,7 +9,7 @@
  2 files changed, 128 insertions(+)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index ccfa511ea..5f10d87bb 100644
+index c072b09..0319e7f 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -4,6 +4,8 @@
@@ -79,7 +79,7 @@
 +	phy->throttle_temp[i - 1] = val;
 +	mutex_unlock(&phy->dev->mt76.mutex);
 +
-+	ret = mt7996_mcu_set_thermal_protect(phy, true);
++	ret = mt7996_mcu_set_thermal_protect(phy);
 +	if (ret)
 +		return ret;
 +
@@ -128,10 +128,10 @@
  }
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index ff6b82a9f..c3666c925 100644
+index c308d86..349c20e 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3482,6 +3482,47 @@ out:
+@@ -3248,6 +3248,47 @@ out:
  	return 0;
  }
  
@@ -180,5 +180,5 @@
  int mt7996_mcu_set_thermal_throttling(struct mt7996_phy *phy, u8 state)
  {
 -- 
-2.39.2
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0018-wifi-mt76-mt7996-enable-PPDU-TxS-to-host.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0018-wifi-mt76-mt7996-enable-PPDU-TxS-to-host.patch
deleted file mode 100644
index 301cefd..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0018-wifi-mt76-mt7996-enable-PPDU-TxS-to-host.patch
+++ /dev/null
@@ -1,182 +0,0 @@
-From 1edcdd6bd28fb6ea388e73fd665b5c58f47c15a7 Mon Sep 17 00:00:00 2001
-From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
-Date: Wed, 28 Jun 2023 08:34:21 +0800
-Subject: [PATCH 18/22] wifi: mt76: mt7996: enable PPDU-TxS to host
-
-Enable PPDU-TxS by default no matter WED on or WED off
-PPDU-TxS is also capable of getting tx_bytes and tx_retries,
-but we'll get that from mcu command and TxFree instead.
----
- mt76_connac3_mac.h | 22 +++++++++++++++++++++-
- mt7996/init.c      |  5 +++++
- mt7996/mac.c       | 45 +++++++++++++++++++++++++++------------------
- mt7996/regs.h      |  7 +++++++
- 4 files changed, 60 insertions(+), 19 deletions(-)
-
-diff --git a/mt76_connac3_mac.h b/mt76_connac3_mac.h
-index 20a2fe931..7402de245 100644
---- a/mt76_connac3_mac.h
-+++ b/mt76_connac3_mac.h
-@@ -281,6 +281,12 @@ enum tx_mgnt_type {
- #define MT_TXFREE_INFO_COUNT		GENMASK(27, 24)
- #define MT_TXFREE_INFO_STAT		GENMASK(29, 28)
- 
-+enum {
-+	MT_TXS_MPDU_FM0,
-+	MT_TXS_MPDU_FM1,
-+	MT_TXS_PPDU_FM
-+};
-+
- #define MT_TXS0_BW			GENMASK(31, 29)
- #define MT_TXS0_TID			GENMASK(28, 26)
- #define MT_TXS0_AMPDU			BIT(25)
-@@ -306,7 +312,7 @@ enum tx_mgnt_type {
- 
- #define MT_TXS2_BF_STATUS		GENMASK(31, 30)
- #define MT_TXS2_BAND			GENMASK(29, 28)
--#define MT_TXS2_WCID			GENMASK(27, 16)
-+#define MT_TXS2_MLD_ID			GENMASK(27, 16)
- #define MT_TXS2_TX_DELAY		GENMASK(15, 0)
- 
- #define MT_TXS3_PID			GENMASK(31, 24)
-@@ -318,6 +324,7 @@ enum tx_mgnt_type {
- 
- #define MT_TXS4_TIMESTAMP		GENMASK(31, 0)
- 
-+/* MPDU based TXS */
- #define MT_TXS5_F0_FINAL_MPDU		BIT(31)
- #define MT_TXS5_F0_QOS			BIT(30)
- #define MT_TXS5_F0_TX_COUNT		GENMASK(29, 25)
-@@ -339,4 +346,17 @@ enum tx_mgnt_type {
- #define MT_TXS7_F1_MPDU_RETRY_COUNT	GENMASK(31, 24)
- #define MT_TXS7_F1_MPDU_RETRY_BYTES	GENMASK(23, 0)
- 
-+/* PPDU based TXS */
-+#define MT_TXS5_MPDU_TX_CNT		GENMASK(30, 20)
-+#define MT_TXS5_MPDU_TX_BYTE_SCALE	BIT(15)
-+#define MT_TXS5_MPDU_TX_BYTE		GENMASK(14, 0)
-+
-+#define MT_TXS6_MPDU_FAIL_CNT		GENMASK(30, 20)
-+#define MT_TXS6_MPDU_FAIL_BYTE_SCALE	BIT(15)
-+#define MT_TXS6_MPDU_FAIL_BYTE		GENMASK(14, 0)
-+
-+#define MT_TXS7_MPDU_RETRY_CNT		GENMASK(30, 20)
-+#define MT_TXS7_MPDU_RETRY_BYTE_SCALE	BIT(15)
-+#define MT_TXS7_MPDU_RETRY_BYTE		GENMASK(14, 0)
-+
- #endif /* __MT76_CONNAC3_MAC_H */
-diff --git a/mt7996/init.c b/mt7996/init.c
-index a8a60a8c9..2fe3da475 100644
---- a/mt7996/init.c
-+++ b/mt7996/init.c
-@@ -453,6 +453,11 @@ mt7996_mac_init_band(struct mt7996_dev *dev, u8 band)
- 	set = FIELD_PREP(MT_WTBLOFF_RSCR_RCPI_MODE, 0) |
- 	      FIELD_PREP(MT_WTBLOFF_RSCR_RCPI_PARAM, 0x3);
- 	mt76_rmw(dev, MT_WTBLOFF_RSCR(band), mask, set);
-+
-+	/* MT_TXD5_TX_STATUS_HOST (MPDU format) has higher priority than
-+	 * MT_AGG_ACR_PPDU_TXS2H (PPDU format) even though ACR bit is set.
-+	 */
-+	mt76_set(dev, MT_AGG_ACR4(band), MT_AGG_ACR_PPDU_TXS2H);
- }
- 
- static void mt7996_mac_init_basic_rates(struct mt7996_dev *dev)
-diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 8f75da695..d4d3cf5b7 100644
---- a/mt7996/mac.c
-+++ b/mt7996/mac.c
-@@ -1173,22 +1173,35 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
- 	bool cck = false;
- 	u32 txrate, txs, mode, stbc;
- 
-+	txs = le32_to_cpu(txs_data[0]);
-+
- 	mt76_tx_status_lock(mdev, &list);
- 	skb = mt76_tx_status_skb_get(mdev, wcid, pid, &list);
--	if (!skb)
--		goto out_no_skb;
- 
--	txs = le32_to_cpu(txs_data[0]);
-+	if (skb) {
-+		info = IEEE80211_SKB_CB(skb);
-+		if (!(txs & MT_TXS0_ACK_ERROR_MASK))
-+			info->flags |= IEEE80211_TX_STAT_ACK;
- 
--	info = IEEE80211_SKB_CB(skb);
--	if (!(txs & MT_TXS0_ACK_ERROR_MASK))
--		info->flags |= IEEE80211_TX_STAT_ACK;
-+		info->status.ampdu_len = 1;
-+		info->status.ampdu_ack_len = !!(info->flags &
-+				IEEE80211_TX_STAT_ACK);
-+
-+		info->status.rates[0].idx = -1;
-+	}
- 
--	info->status.ampdu_len = 1;
--	info->status.ampdu_ack_len = !!(info->flags &
--					IEEE80211_TX_STAT_ACK);
-+	/* PPDU based reporting */
-+	if (FIELD_GET(MT_TXS0_TXS_FORMAT,txs) == MT_TXS_PPDU_FM) {
-+		if (wcid->sta) {
-+			struct ieee80211_sta *sta;
-+			u8 tid;
- 
--	info->status.rates[0].idx = -1;
-+			sta = container_of((void *)wcid, struct ieee80211_sta,
-+					drv_priv);
-+			tid = FIELD_GET(MT_TXS0_TID, txs);
-+			ieee80211_refresh_tx_agg_session_timer(sta, tid);
-+		}
-+	}
- 
- 	txrate = FIELD_GET(MT_TXS0_TX_RATE, txs);
- 
-@@ -1288,9 +1301,8 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
- 	wcid->rate = rate;
- 
- out:
--	mt76_tx_status_skb_done(mdev, skb, &list);
--
--out_no_skb:
-+	if (skb)
-+		mt76_tx_status_skb_done(mdev, skb, &list);
- 	mt76_tx_status_unlock(mdev, &list);
- 
- 	return !!skb;
-@@ -1304,13 +1316,10 @@ static void mt7996_mac_add_txs(struct mt7996_dev *dev, void *data)
- 	u16 wcidx;
- 	u8 pid;
- 
--	if (le32_get_bits(txs_data[0], MT_TXS0_TXS_FORMAT) > 1)
--		return;
--
--	wcidx = le32_get_bits(txs_data[2], MT_TXS2_WCID);
-+	wcidx = le32_get_bits(txs_data[2], MT_TXS2_MLD_ID);
- 	pid = le32_get_bits(txs_data[3], MT_TXS3_PID);
- 
--	if (pid < MT_PACKET_ID_FIRST)
-+	if (pid < MT_PACKET_ID_WED)
- 		return;
- 
- 	if (wcidx >= mt7996_wtbl_size(dev))
-diff --git a/mt7996/regs.h b/mt7996/regs.h
-index b5c363a6f..5b7b8babb 100644
---- a/mt7996/regs.h
-+++ b/mt7996/regs.h
-@@ -243,6 +243,13 @@ enum base_rev {
- 						 FIELD_PREP(MT_WTBL_LMAC_ID, _id) | \
- 						 FIELD_PREP(MT_WTBL_LMAC_DW, _dw))
- 
-+/* AGG: band 0(0x820e2000), band 1(0x820f2000), band 2(0x830e2000) */
-+#define MT_WF_AGG_BASE(_band)		__BASE(WF_AGG_BASE, (_band))
-+#define MT_WF_AGG(_band, ofs)		(MT_WF_AGG_BASE(_band) + (ofs))
-+
-+#define MT_AGG_ACR4(_band)		MT_WF_AGG(_band, 0x3c)
-+#define MT_AGG_ACR_PPDU_TXS2H		BIT(1)
-+
- /* ARB: band 0(0x820e3000), band 1(0x820f3000), band 2(0x830e3000) */
- #define MT_WF_ARB_BASE(_band)			__BASE(WF_ARB_BASE, (_band))
- #define MT_WF_ARB(_band, ofs)			(MT_WF_ARB_BASE(_band) + (ofs))
--- 
-2.39.2
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0019-wifi-mt76-mt7996-fix-beamform-mcu-cmd-configuration.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0019-wifi-mt76-mt7996-fix-beamform-mcu-cmd-configuration.patch
new file mode 100644
index 0000000..1fef46a
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0019-wifi-mt76-mt7996-fix-beamform-mcu-cmd-configuration.patch
@@ -0,0 +1,29 @@
+From 2fe477b8db9ab494a975a565a28e35fff76505d1 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Thu, 16 Mar 2023 16:09:51 +0800
+Subject: [PATCH 19/39] wifi: mt76: mt7996: fix beamform mcu cmd configuration
+
+bf_num means how many band can support beamform, so the value shall be 3.
+bf_bitmap represents which band can support beamform.
+---
+ mt7996/mcu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index 349c20e..62e4869 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -3444,8 +3444,8 @@ int mt7996_mcu_set_txbf(struct mt7996_dev *dev, u8 action)
+ 
+ 		tlv = mt7996_mcu_add_uni_tlv(skb, action, sizeof(*req_mod_en));
+ 		req_mod_en = (struct bf_mod_en_ctrl *)tlv;
+-		req_mod_en->bf_num = 2;
+-		req_mod_en->bf_bitmap = GENMASK(0, 0);
++		req_mod_en->bf_num = 3;
++		req_mod_en->bf_bitmap = GENMASK(2, 0);
+ 		break;
+ 	}
+ 	default:
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0019-wifi-mt76-mt7996-fix-incorrect-report-of-TX-GI.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0019-wifi-mt76-mt7996-fix-incorrect-report-of-TX-GI.patch
deleted file mode 100644
index 4a75641..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0019-wifi-mt76-mt7996-fix-incorrect-report-of-TX-GI.patch
+++ /dev/null
@@ -1,233 +0,0 @@
-From 8d63150a261b6c9f3f19004e8f09dd0bdddffe24 Mon Sep 17 00:00:00 2001
-From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
-Date: Fri, 14 Jul 2023 09:43:53 +0800
-Subject: [PATCH 19/22] wifi: mt76: mt7996: fix incorrect report of TX GI
-
----
- mt76_connac_mcu.h |  2 +-
- mt7996/mac.c      | 48 +++--------------------------------------------
- mt7996/main.c     |  1 +
- mt7996/mcu.c      | 47 ++++++++++++++++++++++++++++++++++++++++++++++
- mt7996/mcu.h      | 22 ++++++++++++++++++++++
- 5 files changed, 74 insertions(+), 46 deletions(-)
-
-diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index e9dd9aa64..8562ca42a 100644
---- a/mt76_connac_mcu.h
-+++ b/mt76_connac_mcu.h
-@@ -1327,7 +1327,7 @@ enum {
- };
- 
- enum UNI_ALL_STA_INFO_TAG {
--	UNI_ALL_STA_TX_RATE,
-+	UNI_ALL_STA_TXRX_RATE,
- 	UNI_ALL_STA_TX_STAT,
- 	UNI_ALL_STA_TXRX_ADM_STAT,
- 	UNI_ALL_STA_TXRX_AIR_TIME,
-diff --git a/mt7996/mac.c b/mt7996/mac.c
-index d4d3cf5b7..e999cce39 100644
---- a/mt7996/mac.c
-+++ b/mt7996/mac.c
-@@ -102,7 +102,6 @@ static void mt7996_mac_sta_poll(struct mt7996_dev *dev)
- 	};
- 	struct ieee80211_sta *sta;
- 	struct mt7996_sta *msta;
--	struct rate_info *rate;
- 	u32 tx_time[IEEE80211_NUM_ACS], rx_time[IEEE80211_NUM_ACS];
- 	LIST_HEAD(sta_poll_list);
- 	int i;
-@@ -118,7 +117,6 @@ static void mt7996_mac_sta_poll(struct mt7996_dev *dev)
- 		u32 addr, val;
- 		u16 idx;
- 		s8 rssi[4];
--		u8 bw;
- 
- 		spin_lock_bh(&dev->mt76.sta_poll_lock);
- 		if (list_empty(&sta_poll_list)) {
-@@ -174,49 +172,6 @@ static void mt7996_mac_sta_poll(struct mt7996_dev *dev)
- 			ieee80211_sta_register_airtime(sta, tid, tx_cur, rx_cur);
- 		}
- 
--		/* We don't support reading GI info from txs packets.
--		 * For accurate tx status reporting and AQL improvement,
--		 * we need to make sure that flags match so polling GI
--		 * from per-sta counters directly.
--		 */
--		rate = &msta->wcid.rate;
--
--		switch (rate->bw) {
--		case RATE_INFO_BW_320:
--			bw = IEEE80211_STA_RX_BW_320;
--			break;
--		case RATE_INFO_BW_160:
--			bw = IEEE80211_STA_RX_BW_160;
--			break;
--		case RATE_INFO_BW_80:
--			bw = IEEE80211_STA_RX_BW_80;
--			break;
--		case RATE_INFO_BW_40:
--			bw = IEEE80211_STA_RX_BW_40;
--			break;
--		default:
--			bw = IEEE80211_STA_RX_BW_20;
--			break;
--		}
--
--		addr = mt7996_mac_wtbl_lmac_addr(dev, idx, 6);
--		val = mt76_rr(dev, addr);
--		if (rate->flags & RATE_INFO_FLAGS_EHT_MCS) {
--			addr = mt7996_mac_wtbl_lmac_addr(dev, idx, 5);
--			val = mt76_rr(dev, addr);
--			rate->eht_gi = FIELD_GET(GENMASK(25, 24), val);
--		} else if (rate->flags & RATE_INFO_FLAGS_HE_MCS) {
--			u8 offs = 24 + 2 * bw;
--
--			rate->he_gi = (val & (0x3 << offs)) >> offs;
--		} else if (rate->flags &
--			   (RATE_INFO_FLAGS_VHT_MCS | RATE_INFO_FLAGS_MCS)) {
--			if (val & BIT(12 + bw))
--				rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
--			else
--				rate->flags &= ~RATE_INFO_FLAGS_SHORT_GI;
--		}
--
- 		/* get signal strength of resp frames (CTS/BA/ACK) */
- 		addr = mt7996_mac_wtbl_lmac_addr(dev, idx, 34);
- 		val = mt76_rr(dev, addr);
-@@ -1249,6 +1204,8 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
- 			goto out;
- 
- 		rate.flags = RATE_INFO_FLAGS_VHT_MCS;
-+		if (wcid->rate.flags & RATE_INFO_FLAGS_SHORT_GI)
-+			rate.flags |= RATE_INFO_FLAGS_SHORT_GI;
- 		break;
- 	case MT_PHY_TYPE_HE_SU:
- 	case MT_PHY_TYPE_HE_EXT_SU:
-@@ -2222,6 +2179,7 @@ void mt7996_mac_work(struct work_struct *work)
- 
- 		mt7996_mac_update_stats(phy);
- 
-+		mt7996_mcu_get_all_sta_info(phy, UNI_ALL_STA_TXRX_RATE);
- 		mt7996_mcu_get_all_sta_info(phy, UNI_ALL_STA_TXRX_ADM_STAT);
- 		mt7996_mcu_get_all_sta_info(phy, UNI_ALL_STA_TXRX_MSDU_COUNT);
- 	}
-diff --git a/mt7996/main.c b/mt7996/main.c
-index 284fb373b..fa4a37f20 100644
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -990,6 +990,7 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
- 			sinfo->txrate.he_gi = txrate->he_gi;
- 			sinfo->txrate.he_dcm = txrate->he_dcm;
- 			sinfo->txrate.he_ru_alloc = txrate->he_ru_alloc;
-+			sinfo->txrate.eht_gi = txrate->eht_gi;
- 		}
- 		sinfo->txrate.flags = txrate->flags;
- 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 146e284fc..dd28ae2de 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -477,6 +477,43 @@ mt7996_mcu_rx_thermal_notify(struct mt7996_dev *dev, struct sk_buff *skb)
- 	phy->throttle_state = n->duty_percent;
- }
- 
-+static int
-+mt7996_mcu_update_tx_gi(struct rate_info *rate, struct all_sta_trx_rate *mcu_rate)
-+{
-+	switch (mcu_rate->tx_mode) {
-+	case MT_PHY_TYPE_CCK:
-+	case MT_PHY_TYPE_OFDM:
-+		break;
-+	case MT_PHY_TYPE_HT:
-+	case MT_PHY_TYPE_HT_GF:
-+	case MT_PHY_TYPE_VHT:
-+		if (mcu_rate->tx_gi)
-+			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
-+		else
-+			rate->flags &= ~RATE_INFO_FLAGS_SHORT_GI;
-+		break;
-+	case MT_PHY_TYPE_HE_SU:
-+	case MT_PHY_TYPE_HE_EXT_SU:
-+	case MT_PHY_TYPE_HE_TB:
-+	case MT_PHY_TYPE_HE_MU:
-+		if (mcu_rate->tx_gi > NL80211_RATE_INFO_HE_GI_3_2)
-+			return -EINVAL;
-+		rate->he_gi = mcu_rate->tx_gi;
-+		break;
-+	case MT_PHY_TYPE_EHT_SU:
-+	case MT_PHY_TYPE_EHT_TRIG:
-+	case MT_PHY_TYPE_EHT_MU:
-+		if (mcu_rate->tx_gi > NL80211_RATE_INFO_EHT_GI_3_2)
-+			return -EINVAL;
-+		rate->eht_gi = mcu_rate->tx_gi;
-+		break;
-+	default:
-+		return -EINVAL;
-+	}
-+
-+	return 0;
-+}
-+
- static void
- mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
- {
-@@ -493,6 +530,16 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
- 		struct mt76_wcid *wcid;
- 
- 		switch (le16_to_cpu(res->tag)) {
-+		case UNI_ALL_STA_TXRX_RATE:
-+			wlan_idx = le16_to_cpu(res->rate[i].wlan_idx);
-+			wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
-+
-+			if (!wcid)
-+				break;
-+
-+			if (mt7996_mcu_update_tx_gi(&wcid->rate, &res->rate[i]))
-+				dev_err(dev->mt76.dev, "Failed to update TX GI\n");
-+			break;
- 		case UNI_ALL_STA_TXRX_ADM_STAT:
- 			wlan_idx = le16_to_cpu(res->adm_stat[i].wlan_idx);
- 			wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
-diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 66af7a90f..ccc260c83 100644
---- a/mt7996/mcu.h
-+++ b/mt7996/mcu.h
-@@ -191,6 +191,27 @@ struct mt7996_mcu_thermal_notify {
- 	u8 __rsv2[4];
- } __packed;
- 
-+struct all_sta_trx_rate {
-+	__le16 wlan_idx;
-+	u8 __rsv1[2];
-+	u8 tx_mode;
-+	u8 flags;
-+	u8 tx_stbc;
-+	u8 tx_gi;
-+	u8 tx_bw;
-+	u8 tx_ldpc;
-+	u8 tx_mcs;
-+	u8 tx_nss;
-+	u8 rx_rate;
-+	u8 rx_mode;
-+	u8 rx_nsts;
-+	u8 rx_gi;
-+	u8 rx_coding;
-+	u8 rx_stbc;
-+	u8 rx_bw;
-+	u8 __rsv2;
-+} __packed;
-+
- struct all_sta_trx_adm_stat {
- 	__le16 wlan_idx;
- 	u8 __rsv[2];
-@@ -215,6 +236,7 @@ struct mt7996_mcu_all_sta_info_event {
-         u8 __rsv3[2];
- 
- 	union {
-+		struct all_sta_trx_rate rate[0];
- 		struct all_sta_trx_adm_stat adm_stat[0];
- 		struct all_sta_trx_msdu_cnt msdu_cnt[0];
- 	};
--- 
-2.39.2
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0020-wifi-mt76-mt7996-remove-periodic-MPDU-TXS-request.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0020-wifi-mt76-mt7996-remove-periodic-MPDU-TXS-request.patch
deleted file mode 100644
index be0645d..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0020-wifi-mt76-mt7996-remove-periodic-MPDU-TXS-request.patch
+++ /dev/null
@@ -1,119 +0,0 @@
-From c1b3730e6c089fa9c22b94147373fdc7518a225c Mon Sep 17 00:00:00 2001
-From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
-Date: Thu, 27 Jul 2023 14:00:30 +0800
-Subject: [PATCH 20/22] wifi: mt76: mt7996: remove periodic MPDU TXS request
-
----
- mt7996/mac.c    | 39 ++++++++++++++++++++++-----------------
- mt7996/main.c   |  1 -
- mt7996/mt7996.h |  1 -
- 3 files changed, 22 insertions(+), 19 deletions(-)
-
-diff --git a/mt7996/mac.c b/mt7996/mac.c
-index e999cce39..d7751cf55 100644
---- a/mt7996/mac.c
-+++ b/mt7996/mac.c
-@@ -895,15 +895,6 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
- 	if (!wcid)
- 		wcid = &dev->mt76.global_wcid;
- 
--	if (sta) {
--		struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
--
--		if (time_after(jiffies, msta->jiffies + HZ / 4)) {
--			info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
--			msta->jiffies = jiffies;
--		}
--	}
--
- 	t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size);
- 	t->skb = tx_info->skb;
- 
-@@ -956,22 +947,36 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
- }
- 
- static void
--mt7996_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
-+mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb)
- {
- 	struct mt7996_sta *msta;
-+	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-+	bool is_8023 = info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP;
- 	u16 fc, tid;
--	u32 val;
- 
- 	if (!sta || !(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
- 		return;
- 
--	tid = le32_get_bits(txwi[1], MT_TXD1_TID);
-+	tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
- 	if (tid >= 6) /* skip VO queue */
- 		return;
- 
--	val = le32_to_cpu(txwi[2]);
--	fc = FIELD_GET(MT_TXD2_FRAME_TYPE, val) << 2 |
--	     FIELD_GET(MT_TXD2_SUB_TYPE, val) << 4;
-+	if (is_8023)
-+		fc = IEEE80211_FTYPE_DATA |
-+		     (sta->wme ? IEEE80211_STYPE_QOS_DATA
-+		               : IEEE80211_STYPE_DATA);
-+	else {
-+		/* No need to get precise TID for Action/Management Frame,
-+		 * since it will not meet the following Frame Control
-+		 * condition anyway.
-+		 */
-+
-+		struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-+
-+		fc = le16_to_cpu(hdr->frame_control) &
-+		     (IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE);
-+	}
-+
- 	if (unlikely(fc != (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_DATA)))
- 		return;
- 
-@@ -999,7 +1004,7 @@ mt7996_txwi_free(struct mt7996_dev *dev, struct mt76_txwi_cache *t,
- 		wcid_idx = wcid->idx;
- 
- 		if (likely(t->skb->protocol != cpu_to_be16(ETH_P_PAE)))
--			mt7996_tx_check_aggr(sta, txwi);
-+			mt7996_tx_check_aggr(sta, t->skb);
- 	} else {
- 		wcid_idx = le32_get_bits(txwi[9], MT_TXD9_WLAN_IDX);
- 	}
-@@ -1276,7 +1281,7 @@ static void mt7996_mac_add_txs(struct mt7996_dev *dev, void *data)
- 	wcidx = le32_get_bits(txs_data[2], MT_TXS2_MLD_ID);
- 	pid = le32_get_bits(txs_data[3], MT_TXS3_PID);
- 
--	if (pid < MT_PACKET_ID_WED)
-+	if (pid < MT_PACKET_ID_NO_SKB)
- 		return;
- 
- 	if (wcidx >= mt7996_wtbl_size(dev))
-diff --git a/mt7996/main.c b/mt7996/main.c
-index fa4a37f20..501ea2764 100644
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -666,7 +666,6 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 	msta->wcid.idx = idx;
- 	msta->wcid.phy_idx = band_idx;
- 	msta->wcid.tx_info |= MT_WCID_TX_INFO_SET;
--	msta->jiffies = jiffies;
- 
- 	ewma_avg_signal_init(&msta->avg_ack_signal);
- 
-diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index bf9960e30..4477b95d6 100644
---- a/mt7996/mt7996.h
-+++ b/mt7996/mt7996.h
-@@ -120,7 +120,6 @@ struct mt7996_sta {
- 	struct ewma_avg_signal avg_ack_signal;
- 
- 	unsigned long changed;
--	unsigned long jiffies;
- 
- 	struct mt76_connac_sta_key_conf bip;
- 
--- 
-2.39.2
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0020-wifi-mt76-mt7996-support-more-options-in-.set_bitrat.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0020-wifi-mt76-mt7996-support-more-options-in-.set_bitrat.patch
new file mode 100644
index 0000000..14855c7
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0020-wifi-mt76-mt7996-support-more-options-in-.set_bitrat.patch
@@ -0,0 +1,183 @@
+From bfb2498bbef4bcfd44658fad8acf82730c56ede6 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Tue, 20 Dec 2022 09:47:31 +0800
+Subject: [PATCH] wifi: mt76: mt7996: support more options in
+ .set_bitrate_mask()
+
+With this patch, driver can support runtime configuration for single
+rate, (HE)GI and HE_Ltf through .set_bitrate_mask(). Please noted that
+currently we do not support to fix any single parameter for EHT mode.
+
+Co-developed-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
+Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
+Co-developed-by: Howard Hsu <howard-yh.hsu@mediatek.com>
+Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
+---
+ mt7996/mcu.c | 137 ++++++++++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 135 insertions(+), 2 deletions(-)
+
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index 62e4869..b7f378a 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -1656,6 +1656,134 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
+ 				     MCU_WM_UNI_CMD(RA), true);
+ }
+ 
++static int
++mt7996_mcu_set_part_fixed_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
++				    struct ieee80211_sta *sta, void *data, u32 field)
++{
++	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++	struct sta_phy *phy = data;
++	struct sta_rec_ra_fixed *ra;
++	struct sk_buff *skb;
++	struct tlv *tlv;
++
++	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
++					      &msta->wcid,
++					      MT7996_STA_UPDATE_MAX_SIZE);
++
++	if (IS_ERR(skb))
++		return PTR_ERR(skb);
++
++	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
++	ra = (struct sta_rec_ra_fixed*)tlv;
++
++	switch (field) {
++	case RATE_PARAM_AUTO:
++		break;
++	case RATE_PARAM_FIXED:
++	case RATE_PARAM_FIXED_MCS:
++	case RATE_PARAM_FIXED_GI:
++	case RATE_PARAM_FIXED_HE_LTF:
++		if (phy)
++			ra->phy = *phy;
++		break;
++	default:
++		break;
++	}
++	ra->field = cpu_to_le32(field);
++
++	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
++				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
++}
++
++
++static int
++mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif,
++			       struct ieee80211_sta *sta)
++{
++	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
++	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
++	enum nl80211_band band = chandef->chan->band;
++	struct sta_phy phy = {};
++	int ret, nrates = 0;
++
++#define __sta_phy_bitrate_mask_check(_mcs, _gi, _ht, _he)			\
++	do {									\
++		u8 i, gi = mask->control[band]._gi;				\
++		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
++		phy.sgi = gi;							\
++		phy.he_ltf = mask->control[band].he_ltf;			\
++		for (i = 0; i < ARRAY_SIZE(mask->control[band]._mcs); i++) {	\
++			if (!mask->control[band]._mcs[i])			\
++				continue;					\
++			nrates += hweight16(mask->control[band]._mcs[i]);	\
++			phy.mcs = ffs(mask->control[band]._mcs[i]) - 1;		\
++			if (_ht)						\
++				phy.mcs += 8 * i;				\
++		}								\
++	} while (0)
++
++	if (sta->deflink.he_cap.has_he) {
++		__sta_phy_bitrate_mask_check(he_mcs, he_gi, 0, 1);
++	} else if (sta->deflink.vht_cap.vht_supported) {
++		__sta_phy_bitrate_mask_check(vht_mcs, gi, 0, 0);
++	} else if (sta->deflink.ht_cap.ht_supported) {
++		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
++	} else {
++		nrates = hweight32(mask->control[band].legacy);
++		phy.mcs = ffs(mask->control[band].legacy) - 1;
++	}
++#undef __sta_phy_bitrate_mask_check
++
++	/* fall back to auto rate control */
++	if (mask->control[band].gi == NL80211_TXRATE_DEFAULT_GI &&
++	    mask->control[band].he_gi == GENMASK(7, 0) &&
++	    mask->control[band].he_ltf == GENMASK(7, 0) &&
++	    nrates != 1)
++		return 0;
++
++	/* fixed single rate */
++	if (nrates == 1) {
++		ret = mt7996_mcu_set_part_fixed_rate_ctrl(dev, vif, sta, &phy,
++							  RATE_PARAM_FIXED_MCS);
++		if (ret)
++			return ret;
++	}
++
++	/* fixed GI */
++	if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
++	    mask->control[band].he_gi != GENMASK(7, 0)) {
++		struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++		u32 addr;
++
++		/* firmware updates only TXCMD but doesn't take WTBL into
++		 * account, so driver should update here to reflect the
++		 * actual txrate hardware sends out.
++		 */
++		addr = mt7996_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
++		if (sta->deflink.he_cap.has_he)
++			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
++		else
++			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
++
++		ret = mt7996_mcu_set_part_fixed_rate_ctrl(dev, vif, sta, &phy,
++							  RATE_PARAM_FIXED_GI);
++		if (ret)
++			return ret;
++	}
++
++	/* fixed HE_LTF */
++	if (mask->control[band].he_ltf != GENMASK(7, 0)) {
++		ret = mt7996_mcu_set_part_fixed_rate_ctrl(dev, vif, sta, &phy,
++							  RATE_PARAM_FIXED_HE_LTF);
++		if (ret)
++			return ret;
++	}
++
++	return 0;
++}
++
+ static void
+ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+ 			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
+@@ -1765,6 +1893,7 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+ 	struct sk_buff *skb;
++	int ret;
+ 
+ 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
+ 					      &msta->wcid,
+@@ -1784,8 +1913,12 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+ 	 */
+ 	mt7996_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
+ 
+-	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
+-				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
++	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
++				    MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
++	if (ret)
++		return ret;
++
++	return mt7996_mcu_add_rate_ctrl_fixed(dev, vif, sta);
+ }
+ 
+ static int
+-- 
+2.39.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0021-wifi-mt76-connac-use-peer-address-for-station-BMC-en.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0021-wifi-mt76-connac-use-peer-address-for-station-BMC-en.patch
deleted file mode 100644
index b613f37..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0021-wifi-mt76-connac-use-peer-address-for-station-BMC-en.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From 3b25bfe66c903b49e2143fd7c4fea68a48be9371 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Thu, 24 Aug 2023 18:38:11 +0800
-Subject: [PATCH 21/22] wifi: mt76: connac: use peer address for station BMC
- entry
-
-Set peer address and aid for the BMC wtbl of station interface. For some
-functions such as parsing MU_EDCA parameters from beacon, firmware will
-need peer address to do the correct mapping.
-
-Change-Id: I0e812312fe730f69f8e431215b8e591c5faec06a
-Reported-by: Howard Hsu <howard-yh.hsu@mediatek.com>
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- mt76_connac_mcu.c | 9 ++++++++-
- mt7996/main.c     | 3 +++
- 2 files changed, 11 insertions(+), 1 deletion(-)
-
-diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 68de52535..bb570f252 100644
---- a/mt76_connac_mcu.c
-+++ b/mt76_connac_mcu.c
-@@ -391,7 +391,14 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
- 
- 	if (!sta) {
- 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
--		eth_broadcast_addr(basic->peer_addr);
-+
-+		if (vif->type == NL80211_IFTYPE_STATION &&
-+		    !is_zero_ether_addr(vif->bss_conf.bssid)) {
-+			memcpy(basic->peer_addr, vif->bss_conf.bssid, ETH_ALEN);
-+			basic->aid = cpu_to_le16(vif->cfg.aid);
-+		} else {
-+			eth_broadcast_addr(basic->peer_addr);
-+		}
- 		return;
- 	}
- 
-diff --git a/mt7996/main.c b/mt7996/main.c
-index 501ea2764..04a2d07a8 100644
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -582,6 +582,9 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
- 	if ((changed & BSS_CHANGED_BSSID && !is_zero_ether_addr(info->bssid)) ||
- 	    (changed & BSS_CHANGED_ASSOC && vif->cfg.assoc) ||
- 	    (changed & BSS_CHANGED_BEACON_ENABLED && info->enable_beacon)) {
-+		/* reset bmc wtbl once BSSID changed */
-+		if (changed & BSS_CHANGED_BSSID)
-+			mt7996_mcu_add_sta(dev, vif, NULL, false);
- 		mt7996_mcu_add_bss_info(phy, vif, true);
- 		mt7996_mcu_add_sta(dev, vif, NULL, true);
- 	}
--- 
-2.39.2
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0021-wifi-mt76-mt7996-update-wmm-queue-mapping.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0021-wifi-mt76-mt7996-update-wmm-queue-mapping.patch
new file mode 100644
index 0000000..6b1d684
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0021-wifi-mt76-mt7996-update-wmm-queue-mapping.patch
@@ -0,0 +1,62 @@
+From 88577bcf928a15c2e8e78b7684ccb75dfc693eac Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Mon, 20 Mar 2023 19:09:59 +0800
+Subject: [PATCH 21/39] wifi: mt76: mt7996: update wmm queue mapping
+
+The mac80211 use mac80211 queue (MQ) and the firmware
+use access class index (ACI) so convert the MQ to ACI
+in mt7996_conf_tx.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+---
+ mt7996/main.c | 11 +++++++++--
+ mt7996/mcu.c  |  2 +-
+ 2 files changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/mt7996/main.c b/mt7996/main.c
+index 9c80839..8e38ebc 100644
+--- a/mt7996/main.c
++++ b/mt7996/main.c
+@@ -198,7 +198,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
+ 	mvif->mt76.omac_idx = idx;
+ 	mvif->phy = phy;
+ 	mvif->mt76.band_idx = band_idx;
+-	mvif->mt76.wmm_idx = band_idx;
++	mvif->mt76.wmm_idx = vif->type != NL80211_IFTYPE_AP;
+ 
+ 	ret = mt7996_mcu_add_dev_info(phy, vif, true);
+ 	if (ret)
+@@ -422,9 +422,16 @@ mt7996_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	       const struct ieee80211_tx_queue_params *params)
+ {
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++	const u8 MQ_to_ACI[IEEE80211_NUM_ACS] = {
++		[IEEE80211_AC_VO] = 3,
++		[IEEE80211_AC_VI] = 2,
++		[IEEE80211_AC_BE] = 0,
++		[IEEE80211_AC_BK] = 1,
++	};
+ 
+ 	/* no need to update right away, we'll get BSS_CHANGED_QOS */
+-	queue = mt76_connac_lmac_mapping(queue);
++	/* convert mac80211 queue to ACI */
++	queue = MQ_to_ACI[queue];
+ 	mvif->queue_params[queue] = *params;
+ 
+ 	return 0;
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index b27b88c..4359ede 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -2835,7 +2835,7 @@ int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif)
+ 
+ 		e = (struct edca *)tlv;
+ 		e->set = WMM_PARAM_SET;
+-		e->queue = ac + mvif->mt76.wmm_idx * MT7996_MAX_WMM_SETS;
++		e->queue = ac;
+ 		e->aifs = q->aifs;
+ 		e->txop = cpu_to_le16(q->txop);
+ 
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0022-wifi-mt76-mt7996-disable-rx-header-translation-for-B.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0022-wifi-mt76-mt7996-disable-rx-header-translation-for-B.patch
deleted file mode 100644
index ccaf2f1..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0022-wifi-mt76-mt7996-disable-rx-header-translation-for-B.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From d2e010af6649b263cad49b71fa8fe2b975e51aa1 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Tue, 5 Sep 2023 17:31:49 +0800
-Subject: [PATCH 22/22] wifi: mt76: mt7996: disable rx header translation for
- BMC entry
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
-Change-Id: Ia98bb775af528fe1002590fa25bb8855945cfc4b
----
- mt7996/mcu.c | 9 +++++----
- 1 file changed, 5 insertions(+), 4 deletions(-)
-
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index dd28ae2de..181be911b 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -1720,10 +1720,10 @@ mt7996_mcu_sta_hdr_trans_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
- 	else
- 		hdr_trans->from_ds = true;
- 
--	wcid = (struct mt76_wcid *)sta->drv_priv;
--	if (!wcid)
-+	if (!sta)
- 		return;
- 
-+	wcid = (struct mt76_wcid *)sta->drv_priv;
- 	hdr_trans->dis_rx_hdr_tran = !test_bit(MT_WCID_FLAG_HDR_TRANS, &wcid->flags);
- 	if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) {
- 		hdr_trans->to_ds = true;
-@@ -2096,6 +2096,9 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
- 	if (!enable)
- 		goto out;
- 
-+	/* starec hdr trans */
-+	mt7996_mcu_sta_hdr_trans_tlv(dev, skb, vif, sta);
-+
- 	/* tag order is in accordance with firmware dependency. */
- 	if (sta) {
- 		/* starec phy */
-@@ -2122,8 +2125,6 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
- 		mt7996_mcu_sta_muru_tlv(dev, skb, vif, sta);
- 		/* starec bfee */
- 		mt7996_mcu_sta_bfee_tlv(dev, skb, vif, sta);
--		/* starec hdr trans */
--		mt7996_mcu_sta_hdr_trans_tlv(dev, skb, vif, sta);
- 	}
- 
- 	ret = mt7996_mcu_add_group(dev, vif, sta);
--- 
-2.39.2
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0022-wifi-mt76-mt7996-enable-IDS-debug-log.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0022-wifi-mt76-mt7996-enable-IDS-debug-log.patch
new file mode 100644
index 0000000..659edd4
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0022-wifi-mt76-mt7996-enable-IDS-debug-log.patch
@@ -0,0 +1,40 @@
+From 7e3ab3b90fc75ff41a503f4632a669c8cba2ae90 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Tue, 21 Mar 2023 15:04:45 +0800
+Subject: [PATCH 22/39] wifi: mt76: mt7996: enable IDS debug log
+
+---
+ mt7996/debugfs.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
+index 513ab4b..0422018 100644
+--- a/mt7996/debugfs.c
++++ b/mt7996/debugfs.c
+@@ -290,6 +290,12 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
+ 		DEBUG_SPL,
+ 		DEBUG_RPT_RX,
+ 		DEBUG_RPT_RA = 68,
++		DEBUG_IDS_PP = 93,
++		DEBUG_IDS_RA = 94,
++		DEBUG_IDS_BF = 95,
++		DEBUG_IDS_SR = 96,
++		DEBUG_IDS_RU = 97,
++		DEBUG_IDS_MUMIMO = 98,
+ 	} debug;
+ 	bool tx, rx, en;
+ 	int ret;
+@@ -309,8 +315,8 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
+ 	if (ret)
+ 		return ret;
+ 
+-	for (debug = DEBUG_TXCMD; debug <= DEBUG_RPT_RA; debug++) {
+-		if (debug == 67)
++	for (debug = DEBUG_TXCMD; debug <= DEBUG_IDS_MUMIMO; debug++) {
++		if (debug == 67 || (debug > DEBUG_RPT_RA && debug < DEBUG_IDS_PP))
+ 			continue;
+ 
+ 		if (debug == DEBUG_RPT_RX)
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1002-wifi-mt76-testmode-add-atenl-support-in-mt7996.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0023-wifi-mt76-testmode-add-atenl-support-in-mt7996.patch
similarity index 82%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1002-wifi-mt76-testmode-add-atenl-support-in-mt7996.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0023-wifi-mt76-testmode-add-atenl-support-in-mt7996.patch
index 0969a87..686576d 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1002-wifi-mt76-testmode-add-atenl-support-in-mt7996.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0023-wifi-mt76-testmode-add-atenl-support-in-mt7996.patch
@@ -1,7 +1,7 @@
-From c8247563a1cdb0b28a1b834a14d258982255d50a Mon Sep 17 00:00:00 2001
+From 33211d380fbf3b0892e560db99ac8dbc5c4e8cd5 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 28 Dec 2022 22:24:25 +0800
-Subject: [PATCH 1002/1024] wifi: mt76: testmode: add atenl support in mt7996
+Subject: [PATCH 23/39] wifi: mt76: testmode: add atenl support in mt7996
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -10,10 +10,10 @@
  2 files changed, 4 insertions(+), 1 deletion(-)
 
 diff --git a/testmode.c b/testmode.c
-index 4644dace9..5c93aa6a8 100644
+index 0accc71..0d2bae9 100644
 --- a/testmode.c
 +++ b/testmode.c
-@@ -613,7 +613,8 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+@@ -612,7 +612,8 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
  
  	if (dev->test_mtd.name &&
  	    (nla_put_string(msg, MT76_TM_ATTR_MTD_PART, dev->test_mtd.name) ||
@@ -24,7 +24,7 @@
  
  	if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
 diff --git a/testmode.h b/testmode.h
-index 5e2792d81..a40cd74b4 100644
+index 5e2792d..a40cd74 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -17,6 +17,7 @@
@@ -44,5 +44,5 @@
  	MT76_TM_ATTR_TX_COUNT,
  	MT76_TM_ATTR_TX_LENGTH,
 -- 
-2.39.2
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1003-wifi-mt76-testmode-add-basic-testmode-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0024-wifi-mt76-testmode-add-basic-testmode-support.patch
similarity index 83%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1003-wifi-mt76-testmode-add-basic-testmode-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0024-wifi-mt76-testmode-add-basic-testmode-support.patch
index 9da4da4..6facdc3 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1003-wifi-mt76-testmode-add-basic-testmode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0024-wifi-mt76-testmode-add-basic-testmode-support.patch
@@ -1,37 +1,36 @@
-From 7faad00dd85cec867c133a7d48ccb3b500719f94 Mon Sep 17 00:00:00 2001
+From 826ab7312fa42110844329a333df76dec614e48f Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 1 Mar 2023 11:59:16 +0800
-Subject: [PATCH 1003/1024] wifi: mt76: testmode: add basic testmode support
+Subject: [PATCH] wifi: mt76: testmode: add basic testmode support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  eeprom.c          |   6 +-
  mac80211.c        |   3 +-
- mt76.h            |  35 +++
+ mt76.h            |  33 +++
  mt76_connac_mcu.h |   2 +
- mt7996/Makefile   |   1 +
+ mt7996/Makefile   |   2 +
  mt7996/eeprom.c   |  35 ++-
  mt7996/eeprom.h   |   1 +
  mt7996/init.c     |   7 +
- mt7996/mac.c      |   3 +-
  mt7996/main.c     |  16 ++
  mt7996/mcu.c      |  42 ++-
  mt7996/mcu.h      |  27 ++
- mt7996/mt7996.h   |  23 ++
- mt7996/testmode.c | 674 ++++++++++++++++++++++++++++++++++++++++++++++
- mt7996/testmode.h | 297 ++++++++++++++++++++
- testmode.c        |  78 ++++--
- testmode.h        |  64 +++++
- tools/fields.c    | 102 ++++++-
- 18 files changed, 1382 insertions(+), 34 deletions(-)
+ mt7996/mt7996.h   |  22 ++
+ mt7996/testmode.c | 658 ++++++++++++++++++++++++++++++++++++++++++++++
+ mt7996/testmode.h | 295 +++++++++++++++++++++
+ testmode.c        |  73 +++--
+ testmode.h        |  60 +++++
+ tools/fields.c    |  92 +++++++
+ 17 files changed, 1344 insertions(+), 30 deletions(-)
  create mode 100644 mt7996/testmode.c
  create mode 100644 mt7996/testmode.h
 
 diff --git a/eeprom.c b/eeprom.c
-index a07ca8440..437d8ca24 100644
+index ea54b7a..263e508 100644
 --- a/eeprom.c
 +++ b/eeprom.c
-@@ -94,8 +94,10 @@ static int mt76_get_of_epprom_from_mtd(struct mt76_dev *dev, void *eep, int offs
+@@ -89,8 +89,10 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len)
  	}
  
  #ifdef CONFIG_NL80211_TESTMODE
@@ -45,10 +44,10 @@
  
  out_put_node:
 diff --git a/mac80211.c b/mac80211.c
-index 12fcb2b01..5740ba061 100644
+index 467afef..d1cdaee 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -835,7 +835,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
+@@ -826,7 +826,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
  	}
  
  #ifdef CONFIG_NL80211_TESTMODE
@@ -59,10 +58,10 @@
  		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
  			phy->test.rx_stats.fcs_error[q]++;
 diff --git a/mt76.h b/mt76.h
-index a2382160d..ad1123c4a 100644
+index 6b07b8f..31d5dc3 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -658,14 +658,20 @@ struct mt76_testmode_ops {
+@@ -652,8 +652,12 @@ struct mt76_testmode_ops {
  	int (*set_params)(struct mt76_phy *phy, struct nlattr **tb,
  			  enum mt76_testmode_state new_state);
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
@@ -75,15 +74,7 @@
  struct mt76_testmode_data {
  	enum mt76_testmode_state state;
  
- 	u32 param_set[DIV_ROUND_UP(NUM_MT76_TM_ATTRS, 32)];
- 	struct sk_buff *tx_skb;
- 
-+	u8 sku_en;
-+
- 	u32 tx_count;
- 	u16 tx_mpdu_len;
- 
-@@ -675,6 +681,7 @@ struct mt76_testmode_data {
+@@ -669,6 +673,7 @@ struct mt76_testmode_data {
  	u8 tx_rate_sgi;
  	u8 tx_rate_ldpc;
  	u8 tx_rate_stbc;
@@ -91,7 +82,7 @@
  	u8 tx_ltf;
  
  	u8 tx_antenna_mask;
-@@ -684,6 +691,9 @@ struct mt76_testmode_data {
+@@ -678,6 +683,9 @@ struct mt76_testmode_data {
  	u32 tx_time;
  	u32 tx_ipg;
  
@@ -101,7 +92,7 @@
  	u32 freq_offset;
  
  	u8 tx_power[4];
-@@ -698,7 +708,16 @@ struct mt76_testmode_data {
+@@ -692,7 +700,16 @@ struct mt76_testmode_data {
  	struct {
  		u64 packets[__MT_RXQ_MAX];
  		u64 fcs_error[__MT_RXQ_MAX];
@@ -118,7 +109,7 @@
  };
  
  struct mt76_vif {
-@@ -1370,6 +1389,22 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
+@@ -1258,6 +1275,22 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
  int mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state);
  int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len);
  
@@ -142,10 +133,10 @@
  {
  #ifdef CONFIG_NL80211_TESTMODE
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 8562ca42a..7e859da65 100644
+index 30c9a5d..724a48a 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1237,11 +1237,13 @@ enum {
+@@ -1218,10 +1218,12 @@ enum {
  	MCU_UNI_CMD_EFUSE_CTRL = 0x2d,
  	MCU_UNI_CMD_RA = 0x2f,
  	MCU_UNI_CMD_MURU = 0x31,
@@ -154,24 +145,22 @@
  	MCU_UNI_CMD_CHANNEL_SWITCH = 0x34,
  	MCU_UNI_CMD_THERMAL = 0x35,
  	MCU_UNI_CMD_VOW = 0x37,
- 	MCU_UNI_CMD_FIXED_RATE_TABLE = 0x40,
 +	MCU_UNI_CMD_TESTMODE_CTRL = 0x46,
  	MCU_UNI_CMD_RRO = 0x57,
  	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
- 	MCU_UNI_CMD_PER_STA_INFO = 0x6d,
+ 	MCU_UNI_CMD_ASSERT_DUMP = 0x6f,
 diff --git a/mt7996/Makefile b/mt7996/Makefile
-index a056b40e0..7bb17f440 100644
+index 07c8b55..bed9efd 100644
 --- a/mt7996/Makefile
 +++ b/mt7996/Makefile
-@@ -8,5 +8,6 @@ mt7996e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \
+@@ -6,3 +6,5 @@ mt7996e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \
  	     debugfs.o mmio.o
  
  mt7996e-$(CONFIG_DEV_COREDUMP) += coredump.o
++
 +mt7996e-$(CONFIG_NL80211_TESTMODE) += testmode.o
- 
- mt7996e-y += mtk_debugfs.o mtk_mcu.o
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 1d98d99eb..b81ed64ce 100644
+index 544b6c6..f5e9546 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -6,6 +6,11 @@
@@ -241,7 +230,7 @@
  		if (ret < 0)
  			return ret;
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 412d6e2f8..9ea3667f1 100644
+index 0c74977..0f8f0cd 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -14,6 +14,7 @@ enum mt7996_eeprom_field {
@@ -253,10 +242,10 @@
  	MT_EE_RATE_DELTA_2G =	0x1400,
  	MT_EE_RATE_DELTA_5G =	0x147d,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 2fe3da475..f41e4e5eb 100644
+index 0319e7f..fecd0d3 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -663,6 +663,10 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
+@@ -641,6 +641,10 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
  
  	set_bit(MT76_STATE_INITIALIZED, &dev->mphy.state);
  
@@ -267,32 +256,18 @@
  	ret = mt7996_mcu_init(dev);
  	if (ret)
  		return ret;
-@@ -1076,6 +1080,9 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1056,6 +1060,9 @@ int mt7996_register_device(struct mt7996_dev *dev)
  
  	mt7996_init_wiphy(hw);
  
 +#ifdef CONFIG_NL80211_TESTMODE
 +	dev->mt76.test_ops = &mt7996_testmode_ops;
 +#endif
- 	ret = mt76_register_device(&dev->mt76, true, mt76_rates,
- 				   ARRAY_SIZE(mt76_rates));
- 	if (ret)
-diff --git a/mt7996/mac.c b/mt7996/mac.c
-index d7751cf55..f00133489 100644
---- a/mt7996/mac.c
-+++ b/mt7996/mac.c
-@@ -654,7 +654,8 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, struct sk_buff *skb)
- 		status->flag |= RX_FLAG_8023;
- 	}
- 
--	if (rxv && mode >= MT_PHY_TYPE_HE_SU && !(status->flag & RX_FLAG_8023))
-+	if (rxv && mode >= MT_PHY_TYPE_HE_SU && mode < MT_PHY_TYPE_EHT_SU &&
-+	    !(status->flag & RX_FLAG_8023))
- 		mt76_connac3_mac_decode_he_radiotap(skb, rxv, mode);
- 
- 	if (!status->wcid || !ieee80211_is_data_qos(fc))
+ 	/* init led callbacks */
+ 	if (IS_ENABLED(CONFIG_MT76_LEDS)) {
+ 		dev->mphy.leds.cdev.brightness_set = mt7996_led_set_brightness;
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 04a2d07a8..3336602f1 100644
+index 8e38ebc..6c38993 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -23,6 +23,18 @@ static bool mt7996_dev_running(struct mt7996_dev *dev)
@@ -323,7 +298,7 @@
  	mt7996_mac_enable_nf(dev, phy->mt76->band_idx);
  
  	ret = mt7996_mcu_set_rts_thresh(phy, 0x92b);
-@@ -1437,6 +1451,8 @@ const struct ieee80211_ops mt7996_ops = {
+@@ -1389,6 +1403,8 @@ const struct ieee80211_ops mt7996_ops = {
  	.sta_set_decap_offload = mt7996_sta_set_decap_offload,
  	.add_twt_setup = mt7996_mac_add_twt_setup,
  	.twt_teardown_request = mt7996_twt_teardown_request,
@@ -333,10 +308,10 @@
  	.sta_add_debugfs = mt7996_sta_add_debugfs,
  #endif
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 867818825..837cf1b30 100644
+index 665457a..0d2053c 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2718,8 +2718,12 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
+@@ -2515,8 +2515,12 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
  {
  	int ret;
  
@@ -351,9 +326,9 @@
  	if (ret)
  		return ret;
  
-@@ -4316,3 +4320,37 @@ int mt7996_mcu_get_all_sta_info(struct mt7996_phy *phy, u16 tag)
- 	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(ALL_STA_INFO),
- 				 &req, sizeof(req), false);
+@@ -4066,3 +4070,37 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u8 val)
+ 	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(RRO), &req,
+ 				 sizeof(req), true);
  }
 +
 +int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 data)
@@ -390,10 +365,10 @@
 +				 &req, sizeof(req), false);
 +}
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index ccc260c83..86701c3f6 100644
+index f235175..4ba06d9 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
-@@ -818,6 +818,33 @@ enum {
+@@ -703,6 +703,33 @@ enum {
  	UNI_CMD_THERMAL_PROTECT_DUTY_CONFIG,
  };
  
@@ -428,7 +403,7 @@
  	UNI_CMD_ACCESS_REG_BASIC = 0x0,
  	UNI_CMD_ACCESS_RF_REG_BASIC,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 8aa124a0c..18208388b 100644
+index 071031b..f7d6580 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -31,9 +31,11 @@
@@ -443,18 +418,18 @@
  #define MT7996_EEPROM_SIZE		7680
  #define MT7996_EEPROM_BLOCK_SIZE	16
  #define MT7996_TOKEN_SIZE		16384
-@@ -65,6 +67,7 @@ struct mt7996_dfs_pattern;
+@@ -63,6 +65,7 @@ struct mt7996_dfs_pattern;
  
  enum mt7996_ram_type {
  	MT7996_RAM_TYPE_WM,
 +	MT7996_RAM_TYPE_WM_TM = MT7996_RAM_TYPE_WM,
  	MT7996_RAM_TYPE_WA,
  	MT7996_RAM_TYPE_DSP,
- 	__MT7996_RAM_TYPE_MAX,
-@@ -188,6 +191,21 @@ struct mt7996_phy {
- 	struct mt76_channel_state state_ts;
+ };
+@@ -244,6 +247,20 @@ struct mt7996_phy {
  
- 	bool has_aux_rx;
+ 	struct mib_stats mib;
+ 	struct mt76_channel_state state_ts;
 +
 +#ifdef CONFIG_NL80211_TESTMODE
 +	struct {
@@ -462,7 +437,6 @@
 +
 +		s32 last_freq_offset;
 +		u8 last_rcpi[4];
-+		s8 last_rssi[4];
 +		s8 last_ib_rssi[4];
 +		s8 last_wb_rssi[4];
 +		u8 last_snr;
@@ -473,7 +447,7 @@
  };
  
  struct mt7996_dev {
-@@ -247,6 +265,8 @@ struct mt7996_dev {
+@@ -303,6 +320,8 @@ struct mt7996_dev {
  	bool flash_mode:1;
  	bool has_eht:1;
  
@@ -482,7 +456,7 @@
  	bool ibf;
  	u8 fw_debug_wm;
  	u8 fw_debug_wa;
-@@ -358,6 +378,7 @@ mt7996_band_valid(struct mt7996_dev *dev, u8 band)
+@@ -408,6 +427,7 @@ mt7996_phy3(struct mt7996_dev *dev)
  extern const struct ieee80211_ops mt7996_ops;
  extern struct pci_driver mt7996_pci_driver;
  extern struct pci_driver mt7996_hif_driver;
@@ -490,7 +464,7 @@
  
  struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
  				     void __iomem *mem_base, u32 device_id);
-@@ -367,6 +388,7 @@ u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif);
+@@ -417,6 +437,7 @@ u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif);
  int mt7996_register_device(struct mt7996_dev *dev);
  void mt7996_unregister_device(struct mt7996_dev *dev);
  int mt7996_eeprom_init(struct mt7996_dev *dev);
@@ -498,7 +472,7 @@
  int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy);
  int mt7996_eeprom_get_target_power(struct mt7996_dev *dev,
  				   struct ieee80211_channel *chan);
-@@ -450,6 +472,7 @@ int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level);
+@@ -494,6 +515,7 @@ int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level);
  int mt7996_mcu_trigger_assert(struct mt7996_dev *dev);
  void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
  void mt7996_mcu_exit(struct mt7996_dev *dev);
@@ -508,10 +482,10 @@
  {
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
 new file mode 100644
-index 000000000..fb041c336
+index 0000000..43eca4e
 --- /dev/null
 +++ b/mt7996/testmode.c
-@@ -0,0 +1,674 @@
+@@ -0,0 +1,658 @@
 +// SPDX-License-Identifier: ISC
 +/*
 + * Copyright (C) 2022 MediaTek Inc.
@@ -525,7 +499,6 @@
 +enum {
 +	TM_CHANGED_TXPOWER,
 +	TM_CHANGED_FREQ_OFFSET,
-+	TM_CHANGED_SKU_EN,
 +	TM_CHANGED_TX_LENGTH,
 +	TM_CHANGED_TX_TIME,
 +	TM_CHANGED_CFG,
@@ -537,7 +510,6 @@
 +static const u8 tm_change_map[] = {
 +	[TM_CHANGED_TXPOWER] = MT76_TM_ATTR_TX_POWER,
 +	[TM_CHANGED_FREQ_OFFSET] = MT76_TM_ATTR_FREQ_OFFSET,
-+	[TM_CHANGED_SKU_EN] = MT76_TM_ATTR_SKU_EN,
 +	[TM_CHANGED_TX_LENGTH] = MT76_TM_ATTR_TX_LENGTH,
 +	[TM_CHANGED_TX_TIME] = MT76_TM_ATTR_TX_TIME,
 +	[TM_CHANGED_CFG] = MT76_TM_ATTR_CFG,
@@ -709,6 +681,7 @@
 +static void
 +mt7996_tm_init(struct mt7996_phy *phy, bool en)
 +{
++#define POWER_CTRL(type)	UNI_TXPOWER_##type##_CTRL
 +	struct mt7996_dev *dev = phy->dev;
 +	u8 rf_test_mode = en ? RF_OPER_RF_TEST : RF_OPER_NORMAL;
 +
@@ -717,6 +690,8 @@
 +
 +	mt7996_mcu_set_tx_power_ctrl(phy, POWER_CTRL(ATE_MODE), en);
 +	mt7996_mcu_set_tx_power_ctrl(phy, POWER_CTRL(SKU_POWER_LIMIT), !en);
++	mt7996_mcu_set_tx_power_ctrl(phy, POWER_CTRL(PERCENTAGE_DROP), 100);
++	mt7996_mcu_set_tx_power_ctrl(phy, POWER_CTRL(PERCENTAGE), !en);
 +	mt7996_mcu_set_tx_power_ctrl(phy, POWER_CTRL(BACKOFF_POWER_LIMIT), !en);
 +
 +	mt7996_tm_rf_switch_mode(dev, rf_test_mode);
@@ -921,12 +896,6 @@
 +		mt7996_tm_set(dev, SET_ID(FREQ_OFFSET), en ? td->freq_offset : 0);
 +	if (changed & BIT(TM_CHANGED_TXPOWER))
 +		mt7996_tm_set(dev, SET_ID(POWER), td->tx_power[0]);
-+	if (changed & BIT(TM_CHANGED_SKU_EN)) {
-+		mt7996_tm_update_channel(phy);
-+		mt7996_mcu_set_tx_power_ctrl(phy, POWER_CTRL(SKU_POWER_LIMIT), td->sku_en);
-+		mt7996_mcu_set_tx_power_ctrl(phy, POWER_CTRL(BACKOFF_POWER_LIMIT), td->sku_en);
-+		mt7996_mcu_set_txpower_sku(phy);
-+	}
 +	if (changed & BIT(TM_CHANGED_TX_LENGTH)) {
 +		mt7996_tm_set(dev, SET_ID(TX_LEN), td->tx_mpdu_len);
 +		mt7996_tm_set(dev, SET_ID(TX_TIME), 0);
@@ -1059,7 +1028,6 @@
 +	phy->test.last_snr = le32_to_cpu(rx_stats_all->user_info[0].snr);
 +	for (i = 0; i < ARRAY_SIZE(phy->test.last_rcpi); i++) {
 +		phy->test.last_rcpi[i] = le16_to_cpu(rx_stats_all->rxv_info[i].rcpi);
-+		phy->test.last_rssi[i] = le16_to_cpu(rx_stats_all->rxv_info[i].rssi);
 +		phy->test.last_ib_rssi[i] = rx_stats_all->fagc[i].ib_rssi;
 +		phy->test.last_wb_rssi[i] = rx_stats_all->fagc[i].wb_rssi;
 +	}
@@ -1141,16 +1109,6 @@
 +
 +	nla_nest_end(msg, rssi);
 +
-+	rssi = nla_nest_start(msg, MT76_TM_RX_ATTR_RSSI);
-+	if (!rssi)
-+		return -ENOMEM;
-+
-+	for (i = 0; i < ARRAY_SIZE(phy->test.last_rssi); i++)
-+		if (nla_put_s8(msg, i, phy->test.last_rssi[i]))
-+			return -ENOMEM;
-+
-+	nla_nest_end(msg, rssi);
-+
 +	rssi = nla_nest_start(msg, MT76_TM_RX_ATTR_IB_RSSI);
 +	if (!rssi)
 +		return -ENOMEM;
@@ -1188,10 +1146,10 @@
 +};
 diff --git a/mt7996/testmode.h b/mt7996/testmode.h
 new file mode 100644
-index 000000000..e4d55a61a
+index 0000000..f00e51f
 --- /dev/null
 +++ b/mt7996/testmode.h
-@@ -0,0 +1,297 @@
+@@ -0,0 +1,295 @@
 +/* SPDX-License-Identifier: ISC */
 +/* Copyright (C) 2020 MediaTek Inc. */
 +
@@ -1349,8 +1307,6 @@
 +	RF_TEST_ID_SET_AID_OFFSET = 204,
 +};
 +
-+#define POWER_CTRL(type)	UNI_TXPOWER_##type##_CTRL
-+
 +struct mt7996_tm_rx_stat_user_ctrl {
 +	__le16 tag;
 +	__le16 len;
@@ -1490,10 +1446,10 @@
 +
 +#endif
 diff --git a/testmode.c b/testmode.c
-index 5c93aa6a8..bbe8230fd 100644
+index 0d2bae9..fc68c2a 100644
 --- a/testmode.c
 +++ b/testmode.c
-@@ -2,11 +2,13 @@
+@@ -2,6 +2,7 @@
  /* Copyright (C) 2020 Felix Fietkau <nbd@nbd.name> */
  
  #include <linux/random.h>
@@ -1501,13 +1457,7 @@
  #include "mt76.h"
  
  const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
- 	[MT76_TM_ATTR_RESET] = { .type = NLA_FLAG },
- 	[MT76_TM_ATTR_STATE] = { .type = NLA_U8 },
-+	[MT76_TM_ATTR_SKU_EN] = { .type = NLA_U8 },
- 	[MT76_TM_ATTR_TX_COUNT] = { .type = NLA_U32 },
- 	[MT76_TM_ATTR_TX_LENGTH] = { .type = NLA_U32 },
- 	[MT76_TM_ATTR_TX_RATE_MODE] = { .type = NLA_U8 },
-@@ -82,6 +84,11 @@ mt76_testmode_max_mpdu_len(struct mt76_phy *phy, u8 tx_rate_mode)
+@@ -81,6 +82,11 @@ mt76_testmode_max_mpdu_len(struct mt76_phy *phy, u8 tx_rate_mode)
  		    IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991)
  			return IEEE80211_MAX_MPDU_LEN_VHT_7991;
  		return IEEE80211_MAX_MPDU_LEN_VHT_11454;
@@ -1519,7 +1469,7 @@
  	case MT76_TM_TX_MODE_CCK:
  	case MT76_TM_TX_MODE_OFDM:
  	default:
-@@ -183,6 +190,9 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
+@@ -182,6 +188,9 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
  	u8 max_nss = hweight8(phy->antenna_mask);
  	int ret;
  
@@ -1529,7 +1479,7 @@
  	ret = mt76_testmode_alloc_skb(phy, td->tx_mpdu_len);
  	if (ret)
  		return ret;
-@@ -275,7 +285,9 @@ mt76_testmode_tx_start(struct mt76_phy *phy)
+@@ -274,7 +283,9 @@ mt76_testmode_tx_start(struct mt76_phy *phy)
  	td->tx_queued = 0;
  	td->tx_done = 0;
  	td->tx_pending = td->tx_count;
@@ -1540,7 +1490,7 @@
  }
  
  static void
-@@ -284,6 +296,11 @@ mt76_testmode_tx_stop(struct mt76_phy *phy)
+@@ -283,6 +294,11 @@ mt76_testmode_tx_stop(struct mt76_phy *phy)
  	struct mt76_testmode_data *td = &phy->test;
  	struct mt76_dev *dev = phy->dev;
  
@@ -1552,7 +1502,7 @@
  	mt76_worker_disable(&dev->tx_worker);
  
  	td->tx_pending = 0;
-@@ -296,22 +313,11 @@ mt76_testmode_tx_stop(struct mt76_phy *phy)
+@@ -295,22 +311,11 @@ mt76_testmode_tx_stop(struct mt76_phy *phy)
  	mt76_testmode_free_skb(phy);
  }
  
@@ -1576,7 +1526,7 @@
  
  	if (td->tx_mpdu_len > 0)
  		return;
-@@ -319,11 +325,18 @@ mt76_testmode_init_defaults(struct mt76_phy *phy)
+@@ -318,11 +323,18 @@ mt76_testmode_init_defaults(struct mt76_phy *phy)
  	td->tx_mpdu_len = 1024;
  	td->tx_count = 1;
  	td->tx_rate_mode = MT76_TM_TX_MODE_OFDM;
@@ -1585,20 +1535,20 @@
 +	/* 0xffff for OFDMA no puncture */
 +	td->tx_preamble_puncture = ~(td->tx_preamble_puncture & 0);
 +	td->tx_ipg = 50;
++
++	/* rx stat user config */
++	td->aid = 1;
  
 -	memcpy(td->addr[0], phy->macaddr, ETH_ALEN);
 -	memcpy(td->addr[1], phy->macaddr, ETH_ALEN);
 -	memcpy(td->addr[2], phy->macaddr, ETH_ALEN);
-+	/* rx stat user config */
-+	td->aid = 1;
-+
 +	memcpy(td->addr[0], addr, ETH_ALEN);
 +	memcpy(td->addr[1], addr, ETH_ALEN);
 +	memcpy(td->addr[2], addr, ETH_ALEN);
  }
  
  static int
-@@ -353,7 +366,7 @@ __mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state)
+@@ -352,7 +364,7 @@ __mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state)
  	if (state == MT76_TM_STATE_TX_FRAMES)
  		mt76_testmode_tx_start(phy);
  	else if (state == MT76_TM_STATE_RX_FRAMES) {
@@ -1607,17 +1557,7 @@
  	}
  
  	phy->test.state = state;
-@@ -434,6 +447,9 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 
- 	mt76_testmode_init_defaults(phy);
- 
-+	if (tb[MT76_TM_ATTR_SKU_EN])
-+		td->sku_en = nla_get_u8(tb[MT76_TM_ATTR_SKU_EN]);
-+
- 	if (tb[MT76_TM_ATTR_TX_COUNT])
- 		td->tx_count = nla_get_u32(tb[MT76_TM_ATTR_TX_COUNT]);
- 
-@@ -454,7 +470,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -453,7 +465,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_DUTY_CYCLE],
  			   &td->tx_duty_cycle, 0, 99) ||
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_POWER_CONTROL],
@@ -1627,7 +1567,7 @@
  		goto out;
  
  	if (tb[MT76_TM_ATTR_TX_LENGTH]) {
-@@ -494,7 +511,9 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -493,7 +506,9 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			    idx >= ARRAY_SIZE(td->tx_power))
  				goto out;
  
@@ -1638,7 +1578,7 @@
  		}
  	}
  
-@@ -512,6 +531,22 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -511,6 +526,22 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  		}
  	}
  
@@ -1661,7 +1601,7 @@
  	if (dev->test_ops->set_params) {
  		err = dev->test_ops->set_params(phy, tb, state);
  		if (err)
-@@ -561,6 +596,9 @@ mt76_testmode_dump_stats(struct mt76_phy *phy, struct sk_buff *msg)
+@@ -560,6 +591,9 @@ mt76_testmode_dump_stats(struct mt76_phy *phy, struct sk_buff *msg)
  	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_PACKETS, rx_packets,
  			      MT76_TM_STATS_ATTR_PAD) ||
  	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_FCS_ERROR, rx_fcs_error,
@@ -1671,28 +1611,19 @@
  			      MT76_TM_STATS_ATTR_PAD))
  		return -EMSGSIZE;
  
-@@ -625,6 +663,8 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+@@ -624,6 +658,7 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
  	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_SGI, td->tx_rate_sgi) ||
  	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_LDPC, td->tx_rate_ldpc) ||
  	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_STBC, td->tx_rate_stbc) ||
-+	    nla_put_u8(msg, MT76_TM_ATTR_SKU_EN, td->sku_en) ||
 +	    nla_put_u8(msg, MT76_TM_ATTR_AID, td->aid) ||
  	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_LTF) &&
  	     nla_put_u8(msg, MT76_TM_ATTR_TX_LTF, td->tx_ltf)) ||
  	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_ANTENNA) &&
 diff --git a/testmode.h b/testmode.h
-index a40cd74b4..141bb8625 100644
+index a40cd74..8d0b970 100644
 --- a/testmode.h
 +++ b/testmode.h
-@@ -19,6 +19,7 @@
-  * @MT76_TM_ATTR_MTD_OFFSET: offset of eeprom data within the partition (u32)
-  * @MT76_TM_ATTR_BAND_IDX: band idx of the chip (u8)
-  *
-+ * @MT76_TM_ATTR_SKU_EN: config txpower sku is enabled or disabled in testmode (u8)
-  * @MT76_TM_ATTR_TX_COUNT: configured number of frames to send when setting
-  *	state to MT76_TM_STATE_TX_FRAMES (u32)
-  * @MT76_TM_ATTR_TX_PENDING: pending frames during MT76_TM_STATE_TX_FRAMES (u32)
-@@ -39,6 +40,11 @@
+@@ -39,6 +39,11 @@
   *
   * @MT76_TM_ATTR_STATS: statistics (nested, see &enum mt76_testmode_stats_attr)
   *
@@ -1704,7 +1635,7 @@
   * @MT76_TM_ATTR_TX_SPE_IDX: tx spatial extension index (u8)
   *
   * @MT76_TM_ATTR_TX_DUTY_CYCLE: packet tx duty cycle (u8)
-@@ -48,6 +54,29 @@
+@@ -48,6 +53,29 @@
   * @MT76_TM_ATTR_DRV_DATA: driver specific netlink attrs (nested)
   *
   * @MT76_TM_ATTR_MAC_ADDRS: array of nested MAC addresses (nested)
@@ -1734,15 +1665,7 @@
   */
  enum mt76_testmode_attr {
  	MT76_TM_ATTR_UNSPEC,
-@@ -59,6 +88,7 @@ enum mt76_testmode_attr {
- 	MT76_TM_ATTR_MTD_OFFSET,
- 	MT76_TM_ATTR_BAND_IDX,
- 
-+	MT76_TM_ATTR_SKU_EN,
- 	MT76_TM_ATTR_TX_COUNT,
- 	MT76_TM_ATTR_TX_LENGTH,
- 	MT76_TM_ATTR_TX_RATE_MODE,
-@@ -76,6 +106,8 @@ enum mt76_testmode_attr {
+@@ -76,6 +104,8 @@ enum mt76_testmode_attr {
  	MT76_TM_ATTR_FREQ_OFFSET,
  
  	MT76_TM_ATTR_STATS,
@@ -1751,7 +1674,7 @@
  
  	MT76_TM_ATTR_TX_SPE_IDX,
  
-@@ -86,6 +118,27 @@ enum mt76_testmode_attr {
+@@ -86,6 +116,27 @@ enum mt76_testmode_attr {
  	MT76_TM_ATTR_DRV_DATA,
  
  	MT76_TM_ATTR_MAC_ADDRS,
@@ -1779,7 +1702,7 @@
  
  	/* keep last */
  	NUM_MT76_TM_ATTRS,
-@@ -103,6 +156,8 @@ enum mt76_testmode_attr {
+@@ -103,6 +154,8 @@ enum mt76_testmode_attr {
   * @MT76_TM_STATS_ATTR_RX_FCS_ERROR: number of rx packets with FCS error (u64)
   * @MT76_TM_STATS_ATTR_LAST_RX: information about the last received packet
   *	see &enum mt76_testmode_rx_attr
@@ -1788,7 +1711,7 @@
   */
  enum mt76_testmode_stats_attr {
  	MT76_TM_STATS_ATTR_UNSPEC,
-@@ -115,6 +170,7 @@ enum mt76_testmode_stats_attr {
+@@ -115,6 +168,7 @@ enum mt76_testmode_stats_attr {
  	MT76_TM_STATS_ATTR_RX_PACKETS,
  	MT76_TM_STATS_ATTR_RX_FCS_ERROR,
  	MT76_TM_STATS_ATTR_LAST_RX,
@@ -1796,23 +1719,7 @@
  
  	/* keep last */
  	NUM_MT76_TM_STATS_ATTRS,
-@@ -127,6 +183,7 @@ enum mt76_testmode_stats_attr {
-  *
-  * @MT76_TM_RX_ATTR_FREQ_OFFSET: frequency offset (s32)
-  * @MT76_TM_RX_ATTR_RCPI: received channel power indicator (array, u8)
-+ * @MT76_TM_RX_ATTR_RSSI: received signal strength indicator (array, s8)
-  * @MT76_TM_RX_ATTR_IB_RSSI: internal inband RSSI (array, s8)
-  * @MT76_TM_RX_ATTR_WB_RSSI: internal wideband RSSI (array, s8)
-  * @MT76_TM_RX_ATTR_SNR: signal-to-noise ratio (u8)
-@@ -136,6 +193,7 @@ enum mt76_testmode_rx_attr {
- 
- 	MT76_TM_RX_ATTR_FREQ_OFFSET,
- 	MT76_TM_RX_ATTR_RCPI,
-+	MT76_TM_RX_ATTR_RSSI,
- 	MT76_TM_RX_ATTR_IB_RSSI,
- 	MT76_TM_RX_ATTR_WB_RSSI,
- 	MT76_TM_RX_ATTR_SNR,
-@@ -179,6 +237,9 @@ enum mt76_testmode_state {
+@@ -179,6 +233,9 @@ enum mt76_testmode_state {
   * @MT76_TM_TX_MODE_HE_EXT_SU: 802.11ax extended-range SU
   * @MT76_TM_TX_MODE_HE_TB: 802.11ax trigger-based
   * @MT76_TM_TX_MODE_HE_MU: 802.11ax multi-user MIMO
@@ -1822,7 +1729,7 @@
   */
  enum mt76_testmode_tx_mode {
  	MT76_TM_TX_MODE_CCK,
-@@ -189,6 +250,9 @@ enum mt76_testmode_tx_mode {
+@@ -189,6 +246,9 @@ enum mt76_testmode_tx_mode {
  	MT76_TM_TX_MODE_HE_EXT_SU,
  	MT76_TM_TX_MODE_HE_TB,
  	MT76_TM_TX_MODE_HE_MU,
@@ -1833,7 +1740,7 @@
  	/* keep last */
  	NUM_MT76_TM_TX_MODES,
 diff --git a/tools/fields.c b/tools/fields.c
-index e3f690896..055f90f3c 100644
+index e3f6908..e5cf7c5 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -10,6 +10,7 @@ static const char * const testmode_state[] = {
@@ -1854,30 +1761,6 @@
  };
  
  static void print_enum(const struct tm_field *field, struct nlattr *attr)
-@@ -65,7 +69,7 @@ static bool parse_u8(const struct tm_field *field, int idx,
- 
- static void print_u8(const struct tm_field *field, struct nlattr *attr)
- {
--	printf("%d", nla_get_u8(attr));
-+	printf("%u", nla_get_u8(attr));
- }
- 
- static void print_s8(const struct tm_field *field, struct nlattr *attr)
-@@ -86,12 +90,12 @@ static void print_s32(const struct tm_field *field, struct nlattr *attr)
- 
- static void print_u32(const struct tm_field *field, struct nlattr *attr)
- {
--	printf("%d", nla_get_u32(attr));
-+	printf("%u", nla_get_u32(attr));
- }
- 
- static void print_u64(const struct tm_field *field, struct nlattr *attr)
- {
--	printf("%lld", (unsigned long long)nla_get_u64(attr));
-+	printf("%llu", (unsigned long long)nla_get_u64(attr));
- }
- 
- static bool parse_flag(const struct tm_field *field, int idx,
 @@ -201,6 +205,62 @@ static void print_extra_stats(const struct tm_field *field, struct nlattr **tb)
  	printf("%srx_per=%.02f%%\n", prefix, 100 * failed / total);
  }
@@ -1941,7 +1824,7 @@
  
  #define FIELD_GENERIC(_field, _name, ...)	\
  	[FIELD_NAME(_field)] = {			\
-@@ -250,10 +310,18 @@ static void print_extra_stats(const struct tm_field *field, struct nlattr **tb)
+@@ -250,6 +310,13 @@ static void print_extra_stats(const struct tm_field *field, struct nlattr **tb)
  		 ##__VA_ARGS__				\
  	)
  
@@ -1955,20 +1838,7 @@
  #define FIELD_NAME(_field) MT76_TM_RX_ATTR_##_field
  static const struct tm_field rx_fields[NUM_MT76_TM_RX_ATTRS] = {
  	FIELD_RO(s32, FREQ_OFFSET, "freq_offset"),
- 	FIELD_ARRAY_RO(u8, RCPI, "rcpi"),
-+	FIELD_ARRAY_RO(s8, RSSI, "rssi"),
- 	FIELD_ARRAY_RO(s8, IB_RSSI, "ib_rssi"),
- 	FIELD_ARRAY_RO(s8, WB_RSSI, "wb_rssi"),
- 	FIELD_RO(s8, SNR, "snr"),
-@@ -261,6 +329,7 @@ static const struct tm_field rx_fields[NUM_MT76_TM_RX_ATTRS] = {
- static struct nla_policy rx_policy[NUM_MT76_TM_RX_ATTRS] = {
- 	[MT76_TM_RX_ATTR_FREQ_OFFSET] = { .type = NLA_U32 },
- 	[MT76_TM_RX_ATTR_RCPI] = { .type = NLA_NESTED },
-+	[MT76_TM_RX_ATTR_RSSI] = { .type = NLA_NESTED },
- 	[MT76_TM_RX_ATTR_IB_RSSI] = { .type = NLA_NESTED },
- 	[MT76_TM_RX_ATTR_WB_RSSI] = { .type = NLA_NESTED },
- 	[MT76_TM_RX_ATTR_SNR] = { .type = NLA_U8 },
-@@ -274,6 +343,7 @@ static const struct tm_field stats_fields[NUM_MT76_TM_STATS_ATTRS] = {
+@@ -274,6 +341,7 @@ static const struct tm_field stats_fields[NUM_MT76_TM_STATS_ATTRS] = {
  	FIELD_RO(u32, TX_DONE, "tx_done"),
  	FIELD_RO(u64, RX_PACKETS, "rx_packets"),
  	FIELD_RO(u64, RX_FCS_ERROR, "rx_fcs_error"),
@@ -1976,7 +1846,7 @@
  	FIELD_NESTED_RO(LAST_RX, rx, "last_"),
  };
  static struct nla_policy stats_policy[NUM_MT76_TM_STATS_ATTRS] = {
-@@ -282,6 +352,7 @@ static struct nla_policy stats_policy[NUM_MT76_TM_STATS_ATTRS] = {
+@@ -282,6 +350,7 @@ static struct nla_policy stats_policy[NUM_MT76_TM_STATS_ATTRS] = {
  	[MT76_TM_STATS_ATTR_TX_DONE] = { .type = NLA_U32 },
  	[MT76_TM_STATS_ATTR_RX_PACKETS] = { .type = NLA_U64 },
  	[MT76_TM_STATS_ATTR_RX_FCS_ERROR] = { .type = NLA_U64 },
@@ -1984,15 +1854,7 @@
  };
  #undef FIELD_NAME
  
-@@ -291,6 +362,7 @@ static const struct tm_field testdata_fields[NUM_MT76_TM_ATTRS] = {
- 	FIELD_ENUM(STATE, "state", testmode_state),
- 	FIELD_RO(string, MTD_PART, "mtd_part"),
- 	FIELD_RO(u32, MTD_OFFSET, "mtd_offset"),
-+	FIELD(u8, SKU_EN, "sku_en"),
- 	FIELD(u32, TX_COUNT, "tx_count"),
- 	FIELD(u32, TX_LENGTH, "tx_length"),
- 	FIELD_ENUM(TX_RATE_MODE, "tx_rate_mode", testmode_tx_mode),
-@@ -300,12 +372,20 @@ static const struct tm_field testdata_fields[NUM_MT76_TM_ATTRS] = {
+@@ -300,12 +369,20 @@ static const struct tm_field testdata_fields[NUM_MT76_TM_ATTRS] = {
  	FIELD(u8, TX_RATE_LDPC, "tx_rate_ldpc"),
  	FIELD(u8, TX_RATE_STBC, "tx_rate_stbc"),
  	FIELD(u8, TX_LTF, "tx_ltf"),
@@ -2013,15 +1875,7 @@
  };
  #undef FIELD_NAME
  
-@@ -313,6 +393,7 @@ static struct nla_policy testdata_policy[NUM_MT76_TM_ATTRS] = {
- 	[MT76_TM_ATTR_STATE] = { .type = NLA_U8 },
- 	[MT76_TM_ATTR_MTD_PART] = { .type = NLA_STRING },
- 	[MT76_TM_ATTR_MTD_OFFSET] = { .type = NLA_U32 },
-+	[MT76_TM_ATTR_SKU_EN] = { .type = NLA_U8 },
- 	[MT76_TM_ATTR_TX_COUNT] = { .type = NLA_U32 },
- 	[MT76_TM_ATTR_TX_LENGTH] = { .type = NLA_U32 },
- 	[MT76_TM_ATTR_TX_RATE_MODE] = { .type = NLA_U8 },
-@@ -322,10 +403,25 @@ static struct nla_policy testdata_policy[NUM_MT76_TM_ATTRS] = {
+@@ -322,10 +399,25 @@ static struct nla_policy testdata_policy[NUM_MT76_TM_ATTRS] = {
  	[MT76_TM_ATTR_TX_RATE_LDPC] = { .type = NLA_U8 },
  	[MT76_TM_ATTR_TX_RATE_STBC] = { .type = NLA_U8 },
  	[MT76_TM_ATTR_TX_LTF] = { .type = NLA_U8 },
@@ -2048,5 +1902,5 @@
  
  const struct tm_field msg_field = {
 -- 
-2.39.2
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0026-wifi-mt76-mt7996-add-led-feature-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0026-wifi-mt76-mt7996-add-led-feature-support.patch
new file mode 100644
index 0000000..06e273a
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0026-wifi-mt76-mt7996-add-led-feature-support.patch
@@ -0,0 +1,105 @@
+From 030159528eff349db01b6b47b6fff8112b4282a4 Mon Sep 17 00:00:00 2001
+From: mtk25577 <jen-hao.cheng@mediatek.com>
+Date: Tue, 28 Mar 2023 18:23:00 +0800
+Subject: [PATCH 26/39] wifi: mt76: mt7996: add led feature support
+
+Signed-off-by: mtk25577 <jen-hao.cheng@mediatek.com>
+---
+ mt7996/Makefile |  1 +
+ mt7996/init.c   | 33 +++++++++++++++++++++------------
+ mt7996/regs.h   |  1 +
+ 3 files changed, 23 insertions(+), 12 deletions(-)
+
+diff --git a/mt7996/Makefile b/mt7996/Makefile
+index bed9efd..7c2514a 100644
+--- a/mt7996/Makefile
++++ b/mt7996/Makefile
+@@ -1,4 +1,5 @@
+ # SPDX-License-Identifier: ISC
++EXTRA_CFLAGS += -DCONFIG_MT76_LEDS
+ 
+ obj-$(CONFIG_MT7996E) += mt7996e.o
+ 
+diff --git a/mt7996/init.c b/mt7996/init.c
+index fecd0d3..192af3f 100644
+--- a/mt7996/init.c
++++ b/mt7996/init.c
+@@ -232,23 +232,31 @@ static void mt7996_led_set_config(struct led_classdev *led_cdev,
+ 	dev = container_of(mphy->dev, struct mt7996_dev, mt76);
+ 
+ 	/* select TX blink mode, 2: only data frames */
+-	mt76_rmw_field(dev, MT_TMAC_TCR0(0), MT_TMAC_TCR0_TX_BLINK, 2);
++	mt76_rmw_field(dev, MT_TMAC_TCR0(mphy->band_idx), MT_TMAC_TCR0_TX_BLINK, 2);
+ 
+ 	/* enable LED */
+-	mt76_wr(dev, MT_LED_EN(0), 1);
++	mt76_wr(dev, MT_LED_EN(mphy->band_idx), 1);
+ 
+ 	/* set LED Tx blink on/off time */
+ 	val = FIELD_PREP(MT_LED_TX_BLINK_ON_MASK, delay_on) |
+ 	      FIELD_PREP(MT_LED_TX_BLINK_OFF_MASK, delay_off);
+-	mt76_wr(dev, MT_LED_TX_BLINK(0), val);
++	mt76_wr(dev, MT_LED_TX_BLINK(mphy->band_idx), val);
++
++	/* turn LED off */
++	if (delay_off == 0xff && delay_on == 0x0)
++		val = MT_LED_CTRL_POLARITY | MT_LED_CTRL_KICK;
++	else {
++		/* control LED */
++		val = MT_LED_CTRL_BLINK_MODE | MT_LED_CTRL_KICK;
++		if (mphy->band_idx == MT_BAND1)
++			val |= MT_LED_CTRL_BLINK_BAND_SEL;
++	}
+ 
+-	/* control LED */
+-	val = MT_LED_CTRL_BLINK_MODE | MT_LED_CTRL_KICK;
+ 	if (mphy->leds.al)
+ 		val |= MT_LED_CTRL_POLARITY;
+ 
+-	mt76_wr(dev, MT_LED_CTRL(0), val);
+-	mt76_clear(dev, MT_LED_CTRL(0), MT_LED_CTRL_KICK);
++	mt76_wr(dev, MT_LED_CTRL(mphy->band_idx), val);
++	mt76_clear(dev, MT_LED_CTRL(mphy->band_idx), MT_LED_CTRL_KICK);
+ }
+ 
+ static int mt7996_led_set_blink(struct led_classdev *led_cdev,
+@@ -400,6 +408,12 @@ mt7996_init_wiphy(struct ieee80211_hw *hw)
+ 		ieee80211_hw_set(hw, SUPPORTS_VHT_EXT_NSS_BW);
+ 	}
+ 
++	/* init led callbacks */
++	if (IS_ENABLED(CONFIG_MT76_LEDS)) {
++		phy->mt76->leds.cdev.brightness_set = mt7996_led_set_brightness;
++		phy->mt76->leds.cdev.blink_set = mt7996_led_set_blink;
++	}
++
+ 	mt76_set_stream_caps(phy->mt76, true);
+ 	mt7996_set_stream_vht_txbf_caps(phy);
+ 	mt7996_set_stream_he_eht_caps(phy);
+@@ -1063,11 +1077,6 @@ int mt7996_register_device(struct mt7996_dev *dev)
+ #ifdef CONFIG_NL80211_TESTMODE
+ 	dev->mt76.test_ops = &mt7996_testmode_ops;
+ #endif
+-	/* init led callbacks */
+-	if (IS_ENABLED(CONFIG_MT76_LEDS)) {
+-		dev->mphy.leds.cdev.brightness_set = mt7996_led_set_brightness;
+-		dev->mphy.leds.cdev.blink_set = mt7996_led_set_blink;
+-	}
+ 
+ 	ret = mt76_register_device(&dev->mt76, true, mt76_rates,
+ 				   ARRAY_SIZE(mt76_rates));
+diff --git a/mt7996/regs.h b/mt7996/regs.h
+index d1d3d15..86da1bf 100644
+--- a/mt7996/regs.h
++++ b/mt7996/regs.h
+@@ -509,6 +509,7 @@ enum base_rev {
+ 
+ #define MT_LED_CTRL(_n)				MT_LED_PHYS(0x00 + ((_n) * 4))
+ #define MT_LED_CTRL_KICK			BIT(7)
++#define MT_LED_CTRL_BLINK_BAND_SEL		BIT(4)
+ #define MT_LED_CTRL_BLINK_MODE			BIT(2)
+ #define MT_LED_CTRL_POLARITY			BIT(1)
+ 
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0027-wifi-mt76-mt7996-fix-twt-mcu-command.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0027-wifi-mt76-mt7996-fix-twt-mcu-command.patch
new file mode 100644
index 0000000..2e938b7
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0027-wifi-mt76-mt7996-fix-twt-mcu-command.patch
@@ -0,0 +1,60 @@
+From e503dbe84bc2b46907a792e11c196018b274647a Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Tue, 28 Mar 2023 20:20:57 +0800
+Subject: [PATCH 27/39] wifi: mt76: mt7996: fix twt mcu command
+
+Update unified command for twt.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+---
+ mt7915/mcu.h | 1 -
+ mt7996/mcu.c | 7 +++++--
+ 2 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index b9ea297..e7a5395 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -264,7 +264,6 @@ enum {
+ 	MCU_TWT_AGRT_MODIFY,
+ 	MCU_TWT_AGRT_DELETE,
+ 	MCU_TWT_AGRT_TEARDOWN,
+-	MCU_TWT_AGRT_GET_TSF,
+ };
+ 
+ enum {
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index a6d8235..6bcb33e 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -3823,7 +3823,9 @@ int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
+ 			       int cmd)
+ {
+ 	struct {
+-		u8 _rsv[4];
++		/* fixed field */
++		u8 bss;
++		u8 _rsv[3];
+ 
+ 		__le16 tag;
+ 		__le16 len;
+@@ -3841,7 +3843,7 @@ int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
+ 		u8 exponent;
+ 		u8 is_ap;
+ 		u8 agrt_params;
+-		u8 __rsv2[135];
++		u8 __rsv2[23];
+ 	} __packed req = {
+ 		.tag = cpu_to_le16(UNI_CMD_TWT_ARGT_UPDATE),
+ 		.len = cpu_to_le16(sizeof(req) - 4),
+@@ -3851,6 +3853,7 @@ int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
+ 		.flowid = flow->id,
+ 		.peer_id = cpu_to_le16(flow->wcid),
+ 		.duration = flow->duration,
++		.bss = mvif->mt76.idx,
+ 		.bss_idx = mvif->mt76.idx,
+ 		.start_tsf = cpu_to_le64(flow->tsf),
+ 		.mantissa = flow->mantissa,
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0028-wifi-mt76-mt7996-add-11v-mbss-support-for-mt76.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0028-wifi-mt76-mt7996-add-11v-mbss-support-for-mt76.patch
new file mode 100644
index 0000000..bf724c8
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0028-wifi-mt76-mt7996-add-11v-mbss-support-for-mt76.patch
@@ -0,0 +1,181 @@
+From 0449694e4e963d0b48354ae2c52016c34899fba6 Mon Sep 17 00:00:00 2001
+From: mtk20656 <chank.chen@mediatek.com>
+Date: Wed, 8 Mar 2023 14:18:29 +0800
+Subject: [PATCH 28/39] wifi: mt76: mt7996: add 11v mbss support for mt76
+
+Signed-off-by: mtk20656 <chank.chen@mediatek.com>
+---
+ mt76_connac_mcu.h | 10 ++++++
+ mt7996/init.c     |  2 ++
+ mt7996/mcu.c      | 79 ++++++++++++++++++++++++++++++++++++++++++++++-
+ 3 files changed, 90 insertions(+), 1 deletion(-)
+
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 724a48a..97f874b 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1281,6 +1281,7 @@ enum {
+ 	UNI_BSS_INFO_RLM = 2,
+ 	UNI_BSS_INFO_BSS_COLOR = 4,
+ 	UNI_BSS_INFO_HE_BASIC = 5,
++	UNI_BSS_INFO_11V_MBSSID = 6,
+ 	UNI_BSS_INFO_BCN_CONTENT = 7,
+ 	UNI_BSS_INFO_BCN_CSA = 8,
+ 	UNI_BSS_INFO_BCN_BCC = 9,
+@@ -1551,6 +1552,15 @@ struct bss_info_uni_he {
+ 	u8 rsv[2];
+ } __packed;
+ 
++struct bss_info_uni_mbssid {
++	__le16 tag;
++	__le16 len;
++	u8 max_indicator;
++	u8 mbss_idx;
++	u8 tx_bss_omac_idx;
++	u8 rsv[1];
++} __packed;
++
+ struct mt76_connac_gtk_rekey_tlv {
+ 	__le16 tag;
+ 	__le16 len;
+diff --git a/mt7996/init.c b/mt7996/init.c
+index 192af3f..0562439 100644
+--- a/mt7996/init.c
++++ b/mt7996/init.c
+@@ -359,6 +359,7 @@ mt7996_init_wiphy(struct ieee80211_hw *hw)
+ 	wiphy->n_iface_combinations = ARRAY_SIZE(if_comb);
+ 	wiphy->reg_notifier = mt7996_regd_notifier;
+ 	wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
++	wiphy->mbssid_max_interfaces = 16;
+ 
+ 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BSS_COLOR);
+ 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_VHT_IBSS);
+@@ -381,6 +382,7 @@ mt7996_init_wiphy(struct ieee80211_hw *hw)
+ 	ieee80211_hw_set(hw, SUPPORTS_TX_ENCAP_OFFLOAD);
+ 	ieee80211_hw_set(hw, SUPPORTS_RX_DECAP_OFFLOAD);
+ 	ieee80211_hw_set(hw, WANT_MONITOR_VIF);
++	ieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);
+ 
+ 	hw->max_tx_fragments = 4;
+ 
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index 6bcb33e..a369a08 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -631,6 +631,24 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+ 	he->max_nss_mcs[CMD_HE_MCS_BW8080] = cap->he_mcs_nss_supp.tx_mcs_80p80;
+ }
+ 
++static void
++mt7996_mcu_bss_mbssid_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
++		      struct mt7996_phy *phy)
++{
++	struct bss_info_uni_mbssid *mbssid;
++	struct tlv *tlv;
++
++	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_11V_MBSSID, sizeof(*mbssid));
++
++	mbssid = (struct bss_info_uni_mbssid *)tlv;
++
++	mbssid->max_indicator = vif->bss_conf.bssid_indicator;
++	mbssid->mbss_idx = vif->bss_conf.bssid_index;
++	mbssid->tx_bss_omac_idx = 0;
++
++	return;
++}
++
+ static void
+ mt7996_mcu_bss_bmc_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+ 		       struct mt7996_phy *phy)
+@@ -895,6 +913,9 @@ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
+ 		if (vif->bss_conf.he_support)
+ 			mt7996_mcu_bss_he_tlv(skb, vif, phy);
+ 
++		if (vif->bss_conf.bssid_indicator)
++			mt7996_mcu_bss_mbssid_tlv(skb, vif, phy);
++
+ 		/* this tag is necessary no matter if the vif is MLD */
+ 		mt7996_mcu_bss_mld_tlv(skb, vif);
+ 	}
+@@ -2162,6 +2183,59 @@ mt7996_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
+ 	info->cnt = skb->data[offs->cntdwn_counter_offs[0]];
+ }
+ 
++static void
++mt7996_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
++			struct ieee80211_vif *vif, struct bss_bcn_content_tlv *bcn,
++			struct ieee80211_mutable_offsets *offs)
++{
++	struct bss_bcn_mbss_tlv *mbss;
++	const struct element *elem;
++	struct tlv *tlv;
++
++	if (!vif->bss_conf.bssid_indicator)
++		return;
++
++	tlv = mt7996_mcu_add_uni_tlv(rskb, UNI_BSS_INFO_BCN_MBSSID, sizeof(*mbss));
++
++	mbss = (struct bss_bcn_mbss_tlv *)tlv;
++	mbss->offset[0] = cpu_to_le16(offs->tim_offset);
++	mbss->bitmap = cpu_to_le32(1);
++
++	for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID,
++			&skb->data[offs->mbssid_off],
++			skb->len - offs->mbssid_off) {
++		const struct element *sub_elem;
++
++		if (elem->datalen < 2)
++			continue;
++
++		for_each_element(sub_elem, elem->data + 1, elem->datalen - 1) {
++			const struct ieee80211_bssid_index *idx;
++			const u8 *idx_ie;
++
++			if (sub_elem->id || sub_elem->datalen < 4)
++				 continue; /* not a valid BSS profile */
++
++			/* Find WLAN_EID_MULTI_BSSID_IDX
++			 * in the merged nontransmitted profile
++			 */
++			idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX,
++						sub_elem->data,
++						sub_elem->datalen);
++			if (!idx_ie || idx_ie[1] < sizeof(*idx))
++				 continue;
++
++			idx = (void *)(idx_ie + 2);
++			if (!idx->bssid_index || idx->bssid_index > 31)
++				continue;
++
++			mbss->offset[idx->bssid_index] =
++				cpu_to_le16(idx_ie - skb->data);
++			mbss->bitmap |= cpu_to_le32(BIT(idx->bssid_index));
++		}
++	}
++}
++
+ static void
+ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+ 		       struct sk_buff *rskb, struct sk_buff *skb,
+@@ -2202,6 +2276,9 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
+ 	struct tlv *tlv;
+ 	struct bss_bcn_content_tlv *bcn;
+ 
++	if (vif->bss_conf.nontransmitted)
++		return 0;
++
+ 	rskb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76,
+ 					  MT7996_BEACON_UPDATE_SIZE);
+ 	if (IS_ERR(rskb))
+@@ -2229,7 +2306,7 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
+ 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, phy->mt76->band_idx);
+ 
+ 	mt7996_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
+-	/* TODO: subtag - 11v MBSSID */
++	mt7996_mcu_beacon_mbss(rskb, skb, vif, bcn, &offs);
+ 	mt7996_mcu_beacon_cntdwn(vif, rskb, skb, &offs);
+ 	dev_kfree_skb(skb);
+ out:
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0029-wifi-mt76-mt7996-Update-beacon-size-limitation-for-1.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0029-wifi-mt76-mt7996-Update-beacon-size-limitation-for-1.patch
new file mode 100644
index 0000000..67e5c6c
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0029-wifi-mt76-mt7996-Update-beacon-size-limitation-for-1.patch
@@ -0,0 +1,188 @@
+From 8b591f425b1bb71ebde4a1eb9c926f0c9017fe28 Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+Date: Mon, 27 Mar 2023 09:47:44 +0800
+Subject: [PATCH 29/39] wifi: mt76: mt7996: Update beacon size limitation for
+ 11v
+
+The TLV size limitation for these two has been expanded to
+accommodate 11v MBSSID IE.
+
+Co-developed-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Co-developed-by: Money Wang <Money.Wang@mediatek.com>
+Signed-off-by: Money Wang <Money.Wang@mediatek.com>
+Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
+---
+ mt7996/main.c |  4 ++--
+ mt7996/mcu.c  | 39 +++++++++++++++++++++++----------------
+ mt7996/mcu.h  | 11 ++++-------
+ 3 files changed, 29 insertions(+), 25 deletions(-)
+
+diff --git a/mt7996/main.c b/mt7996/main.c
+index 6c38993..520f250 100644
+--- a/mt7996/main.c
++++ b/mt7996/main.c
+@@ -618,8 +618,8 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
+ 		mt7996_mcu_add_beacon(hw, vif, info->enable_beacon);
+ 	}
+ 
+-	if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP ||
+-	    changed & BSS_CHANGED_FILS_DISCOVERY)
++	if (changed & (BSS_CHANGED_UNSOL_BCAST_PROBE_RESP |
++		       BSS_CHANGED_FILS_DISCOVERY))
+ 		mt7996_mcu_beacon_inband_discov(dev, vif, changed);
+ 
+ 	mutex_unlock(&dev->mt76.mutex);
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index a369a08..7b8f883 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -2257,7 +2257,7 @@ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+ 			bcn->bcc_ie_pos = cpu_to_le16(offset - 3);
+ 	}
+ 
+-	buf = (u8 *)bcn + sizeof(*bcn) - MAX_BEACON_SIZE;
++	buf = (u8 *)bcn + sizeof(*bcn);
+ 	mt7996_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, NULL, 0, 0,
+ 			      BSS_CHANGED_BEACON);
+ 
+@@ -2275,28 +2275,21 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
+ 	struct sk_buff *skb, *rskb;
+ 	struct tlv *tlv;
+ 	struct bss_bcn_content_tlv *bcn;
++	int len;
+ 
+ 	if (vif->bss_conf.nontransmitted)
+ 		return 0;
+ 
+ 	rskb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76,
+-					  MT7996_BEACON_UPDATE_SIZE);
++					  MT7996_MAX_BSS_OFFLOAD_SIZE);
+ 	if (IS_ERR(rskb))
+ 		return PTR_ERR(rskb);
+ 
+-	tlv = mt7996_mcu_add_uni_tlv(rskb,
+-				     UNI_BSS_INFO_BCN_CONTENT, sizeof(*bcn));
+-	bcn = (struct bss_bcn_content_tlv *)tlv;
+-	bcn->enable = en;
+-
+-	if (!en)
+-		goto out;
+-
+ 	skb = ieee80211_beacon_get_template(hw, vif, &offs, 0);
+ 	if (!skb)
+ 		return -EINVAL;
+ 
+-	if (skb->len > MAX_BEACON_SIZE - MT_TXD_SIZE) {
++	if (skb->len > MT7996_MAX_BEACON_SIZE) {
+ 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
+ 		dev_kfree_skb(skb);
+ 		return -EINVAL;
+@@ -2305,11 +2298,19 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
+ 	info = IEEE80211_SKB_CB(skb);
+ 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, phy->mt76->band_idx);
+ 
++	len = sizeof(*bcn) + MT_TXD_SIZE + skb->len;
++	tlv = mt7996_mcu_add_uni_tlv(rskb,
++				     UNI_BSS_INFO_BCN_CONTENT, len);
++	bcn = (struct bss_bcn_content_tlv *)tlv;
++	bcn->enable = en;
++	if (!en)
++		goto out;
++
+ 	mt7996_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
+ 	mt7996_mcu_beacon_mbss(rskb, skb, vif, bcn, &offs);
+ 	mt7996_mcu_beacon_cntdwn(vif, rskb, skb, &offs);
+-	dev_kfree_skb(skb);
+ out:
++	dev_kfree_skb(skb);
+ 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
+ 				     MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), true);
+ }
+@@ -2330,9 +2331,13 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
+ 	struct sk_buff *rskb, *skb = NULL;
+ 	struct tlv *tlv;
+ 	u8 *buf, interval;
++	int len;
++
++	if (vif->bss_conf.nontransmitted)
++		return 0;
+ 
+ 	rskb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76,
+-					  MT7996_INBAND_FRAME_SIZE);
++					  MT7996_MAX_BSS_OFFLOAD_SIZE);
+ 	if (IS_ERR(rskb))
+ 		return PTR_ERR(rskb);
+ 
+@@ -2349,7 +2354,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
+ 	if (!skb)
+ 		return -EINVAL;
+ 
+-	if (skb->len > MAX_INBAND_FRAME_SIZE - MT_TXD_SIZE) {
++	if (skb->len > MT7996_MAX_BEACON_SIZE) {
+ 		dev_err(dev->mt76.dev, "inband discovery size limit exceed\n");
+ 		dev_kfree_skb(skb);
+ 		return -EINVAL;
+@@ -2360,7 +2365,9 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
+ 	info->band = band;
+ 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, phy->mt76->band_idx);
+ 
+-	tlv = mt7996_mcu_add_uni_tlv(rskb, UNI_BSS_INFO_OFFLOAD, sizeof(*discov));
++	len = sizeof(*discov) + MT_TXD_SIZE + skb->len;
++
++	tlv = mt7996_mcu_add_uni_tlv(rskb, UNI_BSS_INFO_OFFLOAD, len);
+ 
+ 	discov = (struct bss_inband_discovery_tlv *)tlv;
+ 	discov->tx_mode = OFFLOAD_TX_MODE_SU;
+@@ -2371,7 +2378,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
+ 	discov->enable = true;
+ 	discov->wcid = cpu_to_le16(MT7996_WTBL_RESERVED);
+ 
+-	buf = (u8 *)tlv + sizeof(*discov) - MAX_INBAND_FRAME_SIZE;
++	buf = (u8 *)tlv + sizeof(*discov);
+ 
+ 	mt7996_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, NULL, 0, 0, changed);
+ 
+diff --git a/mt7996/mcu.h b/mt7996/mcu.h
+index 4ba06d9..eed7371 100644
+--- a/mt7996/mcu.h
++++ b/mt7996/mcu.h
+@@ -308,8 +308,6 @@ struct bss_inband_discovery_tlv {
+ 	u8 enable;
+ 	__le16 wcid;
+ 	__le16 prob_rsp_len;
+-#define MAX_INBAND_FRAME_SIZE 512
+-	u8 pkt[MAX_INBAND_FRAME_SIZE];
+ } __packed;
+ 
+ struct bss_bcn_content_tlv {
+@@ -321,8 +319,6 @@ struct bss_bcn_content_tlv {
+ 	u8 enable;
+ 	u8 type;
+ 	__le16 pkt_len;
+-#define MAX_BEACON_SIZE 512
+-	u8 pkt[MAX_BEACON_SIZE];
+ } __packed;
+ 
+ struct bss_bcn_cntdwn_tlv {
+@@ -629,13 +625,14 @@ enum {
+ 					 sizeof(struct sta_rec_hdr_trans) +	\
+ 					 sizeof(struct tlv))
+ 
++#define MT7996_MAX_BEACON_SIZE		1342
+ #define MT7996_BEACON_UPDATE_SIZE	(sizeof(struct bss_req_hdr) +		\
+ 					 sizeof(struct bss_bcn_content_tlv) +	\
++					 MT_TXD_SIZE +				\
+ 					 sizeof(struct bss_bcn_cntdwn_tlv) +	\
+ 					 sizeof(struct bss_bcn_mbss_tlv))
+-
+-#define MT7996_INBAND_FRAME_SIZE	(sizeof(struct bss_req_hdr) +		\
+-					 sizeof(struct bss_inband_discovery_tlv))
++#define MT7996_MAX_BSS_OFFLOAD_SIZE	(MT7996_MAX_BEACON_SIZE +		\
++					 MT7996_BEACON_UPDATE_SIZE)
+ 
+ enum {
+ 	UNI_BAND_CONFIG_RADIO_ENABLE,
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7996-add-support-for-auxiliary-path.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0030-wifi-mt76-mt7996-add-support-for-auxiliary-path.patch
similarity index 87%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7996-add-support-for-auxiliary-path.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0030-wifi-mt76-mt7996-add-support-for-auxiliary-path.patch
index 0478681..798eb69 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7996-add-support-for-auxiliary-path.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0030-wifi-mt76-mt7996-add-support-for-auxiliary-path.patch
@@ -1,7 +1,7 @@
-From 2327076bc0ae52d057204b337d7b1503f097dfbf Mon Sep 17 00:00:00 2001
+From 7390e5db3745febd580026e723b2ca806e308008 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 14 Apr 2023 16:51:59 +0800
-Subject: [PATCH 02/22] wifi: mt76: mt7996: add support for auxiliary path
+Subject: [PATCH 30/39] wifi: mt76: mt7996: add support for auxiliary path
 
 Add support to correctly configure the setting of variants that have
 additional TX or RX path.
@@ -17,10 +17,10 @@
  4 files changed, 35 insertions(+), 5 deletions(-)
 
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 544b6c6f1..9db7e5310 100644
+index f5e9546..9840c77 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -148,36 +148,49 @@ static int mt7996_eeprom_parse_band_config(struct mt7996_phy *phy)
+@@ -171,36 +171,49 @@ static int mt7996_eeprom_parse_band_config(struct mt7996_phy *phy)
  
  int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy)
  {
@@ -75,10 +75,10 @@
  	mphy->antenna_mask = BIT(nss) - 1;
  	mphy->chainmask = (BIT(path) - 1) << dev->chainshift[band_idx];
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 0c749774f..412d6e2f8 100644
+index 0f8f0cd..9ea3667 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
-@@ -33,6 +33,9 @@ enum mt7996_eeprom_field {
+@@ -34,6 +34,9 @@ enum mt7996_eeprom_field {
  #define MT_EE_WIFI_CONF1_TX_PATH_BAND0		GENMASK(5, 3)
  #define MT_EE_WIFI_CONF2_TX_PATH_BAND1		GENMASK(2, 0)
  #define MT_EE_WIFI_CONF2_TX_PATH_BAND2		GENMASK(5, 3)
@@ -89,10 +89,10 @@
  #define MT_EE_WIFI_CONF5_STREAM_NUM_BAND1	GENMASK(2, 0)
  #define MT_EE_WIFI_CONF5_STREAM_NUM_BAND2	GENMASK(5, 3)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 12bf4e503..d422214e2 100644
+index 7b8f883..a2c1e43 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3179,7 +3179,7 @@ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag)
+@@ -3198,7 +3198,7 @@ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag)
  		.center_ch = ieee80211_frequency_to_channel(freq1),
  		.bw = mt76_connac_chan_bw(chandef),
  		.tx_path_num = hweight16(phy->mt76->chainmask),
@@ -102,19 +102,19 @@
  		.channel_band = ch_band[chandef->chan->band],
  	};
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 7354e5cf8..25a563f74 100644
+index f7d6580..8e5b3c3 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -170,6 +170,8 @@ struct mt7996_phy {
- 
- 	struct mt76_mib_stats mib;
+@@ -248,6 +248,8 @@ struct mt7996_phy {
+ 	struct mib_stats mib;
  	struct mt76_channel_state state_ts;
-+
-+	bool has_aux_rx;
- };
  
- struct mt7996_dev {
-@@ -437,6 +439,18 @@ static inline void mt7996_irq_disable(struct mt7996_dev *dev, u32 mask)
++	bool has_aux_rx;
++
+ #ifdef CONFIG_NL80211_TESTMODE
+ 	struct {
+ 		u32 *reg_backup;
+@@ -551,6 +553,18 @@ static inline void mt7996_irq_disable(struct mt7996_dev *dev, u32 mask)
  void mt7996_memcpy_fromio(struct mt7996_dev *dev, void *buf, u32 offset,
  			  size_t len);
  
@@ -134,5 +134,5 @@
  u32 mt7996_mac_wtbl_lmac_addr(struct mt7996_dev *dev, u16 wcid, u8 dw);
  bool mt7996_mac_wtbl_update(struct mt7996_dev *dev, int idx, u32 mask);
 -- 
-2.39.2
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0031-wifi-mt76-mt7996-fix-memory-leak.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0031-wifi-mt76-mt7996-fix-memory-leak.patch
new file mode 100644
index 0000000..0669836
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0031-wifi-mt76-mt7996-fix-memory-leak.patch
@@ -0,0 +1,49 @@
+From 80a4f15fa3077ef5a340a4af5b12fda8d958c337 Mon Sep 17 00:00:00 2001
+From: Bo Jiao <Bo.Jiao@mediatek.com>
+Date: Tue, 18 Apr 2023 19:49:45 +0800
+Subject: [PATCH 31/39] wifi: mt76: mt7996: fix memory leak.
+
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+---
+ mt7996/mcu.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index a2c1e43..f98a48d 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -2286,11 +2286,14 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
+ 		return PTR_ERR(rskb);
+ 
+ 	skb = ieee80211_beacon_get_template(hw, vif, &offs, 0);
+-	if (!skb)
++	if (!skb) {
++		dev_kfree_skb(rskb);
+ 		return -EINVAL;
++	}
+ 
+ 	if (skb->len > MT7996_MAX_BEACON_SIZE) {
+ 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
++		dev_kfree_skb(rskb);
+ 		dev_kfree_skb(skb);
+ 		return -EINVAL;
+ 	}
+@@ -2351,11 +2354,14 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
+ 		skb = ieee80211_get_unsol_bcast_probe_resp_tmpl(hw, vif);
+ 	}
+ 
+-	if (!skb)
++	if (!skb) {
++		dev_kfree_skb(rskb);
+ 		return -EINVAL;
++	}
+ 
+ 	if (skb->len > MT7996_MAX_BEACON_SIZE) {
+ 		dev_err(dev->mt76.dev, "inband discovery size limit exceed\n");
++		dev_kfree_skb(rskb);
+ 		dev_kfree_skb(skb);
+ 		return -EINVAL;
+ 	}
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7996-add-eht-mode-tx-stats.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0032-wifi-mt76-mt7996-add-eht-mode-tx-stats.patch
similarity index 70%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7996-add-eht-mode-tx-stats.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0032-wifi-mt76-mt7996-add-eht-mode-tx-stats.patch
index e6be9b8..ba0e378 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7996-add-eht-mode-tx-stats.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0032-wifi-mt76-mt7996-add-eht-mode-tx-stats.patch
@@ -1,7 +1,7 @@
-From 55edd1cc06062fc6a71426e062a253eafc48d575 Mon Sep 17 00:00:00 2001
+From fd7730026ccef8b0d5a52ac07ddb21af48def17d Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 20 Apr 2023 16:34:47 +0800
-Subject: [PATCH 03/22] wifi: mt76: mt7996: add eht mode tx stats
+Subject: [PATCH 32/39] wifi: mt76: mt7996: add eht mode tx stats
 
 Add eht mode bf fbk stats and bw320 through debugfs tx_stats command
 
@@ -11,19 +11,19 @@
  1 file changed, 3 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 4d40ec7ff..9bd953586 100644
+index 0422018..ca4d615 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
-@@ -476,7 +476,7 @@ mt7996_txbf_stat_read_phy(struct mt7996_phy *phy, struct seq_file *s)
+@@ -481,7 +481,7 @@ static void
+ mt7996_txbf_stat_read_phy(struct mt7996_phy *phy, struct seq_file *s)
  {
- 	struct mt76_mib_stats *mib = &phy->mib;
  	static const char * const bw[] = {
 -		"BW20", "BW40", "BW80", "BW160"
 +		"BW20", "BW40", "BW80", "BW160", "BW320"
  	};
+ 	struct mib_stats *mib = &phy->mib;
  
- 	/* Tx Beamformer monitor */
-@@ -489,8 +489,9 @@ mt7996_txbf_stat_read_phy(struct mt7996_phy *phy, struct seq_file *s)
+@@ -495,8 +495,9 @@ mt7996_txbf_stat_read_phy(struct mt7996_phy *phy, struct seq_file *s)
  	/* Tx Beamformer Rx feedback monitor */
  	seq_puts(s, "Tx Beamformer Rx feedback statistics: ");
  
@@ -35,5 +35,5 @@
  		   mib->tx_bf_rx_fb_vht_cnt,
  		   mib->tx_bf_rx_fb_ht_cnt);
 -- 
-2.39.2
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0033-wifi-mt76-mt7996-disable-wfdma-tx-rx-during-SER.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0033-wifi-mt76-mt7996-disable-wfdma-tx-rx-during-SER.patch
new file mode 100644
index 0000000..a88d36a
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0033-wifi-mt76-mt7996-disable-wfdma-tx-rx-during-SER.patch
@@ -0,0 +1,219 @@
+From d246d8300bcbf7dea19919d61df9d7553e21bd1b Mon Sep 17 00:00:00 2001
+From: "sujuan.chen" <sujuan.chen@mediatek.com>
+Date: Wed, 26 Apr 2023 15:37:23 +0800
+Subject: [PATCH 33/39] wifi: mt76: mt7996: disable wfdma tx/rx during SER
+
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+---
+ dma.c           |  6 ++++
+ mt7996/dma.c    | 79 ++++++++++++++++++++++++++++++-------------------
+ mt7996/mac.c    | 13 ++++++--
+ mt7996/mt7996.h |  1 +
+ 4 files changed, 65 insertions(+), 34 deletions(-)
+
+diff --git a/dma.c b/dma.c
+index 465190e..f2b1b2a 100644
+--- a/dma.c
++++ b/dma.c
+@@ -466,6 +466,9 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
+ 	struct mt76_queue_buf buf = {};
+ 	dma_addr_t addr;
+ 
++	if (test_bit(MT76_MCU_RESET, &dev->phy.state))
++		goto error;
++
+ 	if (q->queued + 1 >= q->ndesc - 1)
+ 		goto error;
+ 
+@@ -507,6 +510,9 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q,
+ 	dma_addr_t addr;
+ 	u8 *txwi;
+ 
++	if (test_bit(MT76_MCU_RESET, &dev->phy.state))
++		goto free_skb;
++
+ 	t = mt76_get_txwi(dev);
+ 	if (!t)
+ 		goto free_skb;
+diff --git a/mt7996/dma.c b/mt7996/dma.c
+index fbedaac..6a21e3e 100644
+--- a/mt7996/dma.c
++++ b/mt7996/dma.c
+@@ -128,11 +128,55 @@ static void mt7996_dma_disable(struct mt7996_dev *dev, bool reset)
+ 	}
+ }
+ 
+-static int mt7996_dma_enable(struct mt7996_dev *dev)
++void __mt7996_dma_enable(struct mt7996_dev *dev, bool reset)
+ {
+ 	u32 hif1_ofs = 0;
+ 	u32 irq_mask;
+ 
++	if (dev->hif2)
++		hif1_ofs = MT_WFDMA0_PCIE1(0) - MT_WFDMA0(0);
++
++	/* enable wpdma tx/rx */
++	if (!reset) {
++		mt76_set(dev, MT_WFDMA0_GLO_CFG,
++			 MT_WFDMA0_GLO_CFG_TX_DMA_EN |
++			 MT_WFDMA0_GLO_CFG_RX_DMA_EN |
++			 MT_WFDMA0_GLO_CFG_OMIT_TX_INFO |
++			 MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2);
++
++		if (dev->hif2)
++			mt76_set(dev, MT_WFDMA0_GLO_CFG + hif1_ofs,
++				 MT_WFDMA0_GLO_CFG_TX_DMA_EN |
++				 MT_WFDMA0_GLO_CFG_RX_DMA_EN |
++				 MT_WFDMA0_GLO_CFG_OMIT_TX_INFO |
++				 MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2);
++	}
++
++	/* enable interrupts for TX/RX rings */
++	irq_mask = MT_INT_MCU_CMD;
++	if (reset)
++		goto done;
++
++	irq_mask |= (MT_INT_RX_DONE_MCU | MT_INT_TX_DONE_MCU);
++
++	if (!dev->mphy.band_idx)
++		irq_mask |= MT_INT_BAND0_RX_DONE;
++
++	if (dev->dbdc_support)
++		irq_mask |= MT_INT_BAND1_RX_DONE;
++
++	if (dev->tbtc_support)
++		irq_mask |= MT_INT_BAND2_RX_DONE;
++
++done:
++	mt7996_irq_enable(dev, irq_mask);
++	mt7996_irq_disable(dev, 0);
++}
++
++static int mt7996_dma_enable(struct mt7996_dev *dev, bool reset)
++{
++	u32 hif1_ofs = 0;
++
+ 	if (dev->hif2)
+ 		hif1_ofs = MT_WFDMA0_PCIE1(0) - MT_WFDMA0(0);
+ 
+@@ -170,13 +214,6 @@ static int mt7996_dma_enable(struct mt7996_dev *dev)
+ 	mt76_poll(dev, MT_WFDMA_EXT_CSR_HIF_MISC,
+ 		  MT_WFDMA_EXT_CSR_HIF_MISC_BUSY, 0, 1000);
+ 
+-	/* set WFDMA Tx/Rx */
+-	mt76_set(dev, MT_WFDMA0_GLO_CFG,
+-		 MT_WFDMA0_GLO_CFG_TX_DMA_EN |
+-		 MT_WFDMA0_GLO_CFG_RX_DMA_EN |
+-		 MT_WFDMA0_GLO_CFG_OMIT_TX_INFO |
+-		 MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2);
+-
+ 	/* GLO_CFG_EXT0 */
+ 	mt76_set(dev, WF_WFDMA0_GLO_CFG_EXT0,
+ 		 WF_WFDMA0_GLO_CFG_EXT0_RX_WB_RXD |
+@@ -187,12 +224,6 @@ static int mt7996_dma_enable(struct mt7996_dev *dev)
+ 		 WF_WFDMA0_GLO_CFG_EXT1_TX_FCTRL_MODE);
+ 
+ 	if (dev->hif2) {
+-		mt76_set(dev, MT_WFDMA0_GLO_CFG + hif1_ofs,
+-			 MT_WFDMA0_GLO_CFG_TX_DMA_EN |
+-			 MT_WFDMA0_GLO_CFG_RX_DMA_EN |
+-			 MT_WFDMA0_GLO_CFG_OMIT_TX_INFO |
+-			 MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2);
+-
+ 		/* GLO_CFG_EXT0 */
+ 		mt76_set(dev, WF_WFDMA0_GLO_CFG_EXT0 + hif1_ofs,
+ 			 WF_WFDMA0_GLO_CFG_EXT0_RX_WB_RXD |
+@@ -216,21 +247,7 @@ static int mt7996_dma_enable(struct mt7996_dev *dev)
+ 		/* TODO: redirect rx ring6 interrupt to pcie0 for wed function */
+ 	}
+ 
+-	/* enable interrupts for TX/RX rings */
+-	irq_mask = MT_INT_RX_DONE_MCU |
+-		   MT_INT_TX_DONE_MCU |
+-		   MT_INT_MCU_CMD;
+-
+-	if (!dev->mphy.band_idx)
+-		irq_mask |= MT_INT_BAND0_RX_DONE;
+-
+-	if (dev->dbdc_support)
+-		irq_mask |= MT_INT_BAND1_RX_DONE;
+-
+-	if (dev->tbtc_support)
+-		irq_mask |= MT_INT_BAND2_RX_DONE;
+-
+-	mt7996_irq_enable(dev, irq_mask);
++	__mt7996_dma_enable(dev, reset);
+ 
+ 	return 0;
+ }
+@@ -347,7 +364,7 @@ int mt7996_dma_init(struct mt7996_dev *dev)
+ 			  mt7996_poll_tx);
+ 	napi_enable(&dev->mt76.tx_napi);
+ 
+-	mt7996_dma_enable(dev);
++	mt7996_dma_enable(dev, false);
+ 
+ 	return 0;
+ }
+@@ -413,7 +430,7 @@ void mt7996_dma_reset(struct mt7996_dev *dev, bool force)
+ 	mt76_for_each_q_rx(&dev->mt76, i)
+ 		mt76_queue_rx_reset(dev, i);
+ 
+-	mt7996_dma_enable(dev);
++	mt7996_dma_enable(dev, !force);
+ }
+ 
+ void mt7996_dma_cleanup(struct mt7996_dev *dev)
+diff --git a/mt7996/mac.c b/mt7996/mac.c
+index bddb84f..986031f 100644
+--- a/mt7996/mac.c
++++ b/mt7996/mac.c
+@@ -2028,6 +2028,12 @@ void mt7996_mac_reset_work(struct work_struct *work)
+ 		mt7996_wait_reset_state(dev, MT_MCU_CMD_RECOVERY_DONE);
+ 	}
+ 
++	mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_RESET_DONE);
++	mt7996_wait_reset_state(dev, MT_MCU_CMD_NORMAL_STATE);
++
++	/* enable dma tx/rx and interrupt */
++	__mt7996_dma_enable(dev, false);
++
+ 	clear_bit(MT76_MCU_RESET, &dev->mphy.state);
+ 	clear_bit(MT76_RESET, &dev->mphy.state);
+ 	if (phy2)
+@@ -2044,9 +2050,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
+ 
+ 	tasklet_schedule(&dev->mt76.irq_tasklet);
+ 
+-	mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_RESET_DONE);
+-	mt7996_wait_reset_state(dev, MT_MCU_CMD_NORMAL_STATE);
+-
+ 	mt76_worker_enable(&dev->mt76.tx_worker);
+ 
+ 	local_bh_disable();
+@@ -2149,6 +2152,10 @@ skip_coredump:
+ 
+ void mt7996_reset(struct mt7996_dev *dev)
+ {
++	dev_info(dev->mt76.dev, "%s SER recovery state: 0x%08x\n",
++			 wiphy_name(dev->mt76.hw->wiphy),
++			 READ_ONCE(dev->recovery.state));
++
+ 	if (!dev->recovery.hw_init_done)
+ 		return;
+ 
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index 8e5b3c3..561c1cd 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -448,6 +448,7 @@ int mt7996_dma_init(struct mt7996_dev *dev);
+ void mt7996_dma_reset(struct mt7996_dev *dev, bool force);
+ void mt7996_dma_prefetch(struct mt7996_dev *dev);
+ void mt7996_dma_cleanup(struct mt7996_dev *dev);
++void __mt7996_dma_enable(struct mt7996_dev *dev, bool reset);
+ void mt7996_init_txpower(struct mt7996_dev *dev,
+ 			 struct ieee80211_supported_band *sband);
+ int mt7996_txbf_init(struct mt7996_dev *dev);
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0015-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0034-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0015-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0034-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch
index ada5073..3d4d1c0 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0015-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0034-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch
@@ -1,7 +1,7 @@
-From 92894504b24036f011244a5e270b045c1617156c Mon Sep 17 00:00:00 2001
+From cf66e6fc90e7a12209bd0a3d9b687b37f7324718 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Fri, 19 May 2023 14:16:50 +0800
-Subject: [PATCH 15/22] wifi: mt76: mt7996: add firmware WA's coredump.
+Subject: [PATCH] wifi: mt76: mt7996: add firmware WA's coredump.
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 Change-Id: I51f115b4ae15bc0f871f93652570d72511dbf880
@@ -15,7 +15,7 @@
  6 files changed, 182 insertions(+), 83 deletions(-)
 
 diff --git a/mt7996/coredump.c b/mt7996/coredump.c
-index ccab0d7b9..60b88085c 100644
+index ccab0d7b..60b88085 100644
 --- a/mt7996/coredump.c
 +++ b/mt7996/coredump.c
 @@ -7,11 +7,11 @@
@@ -336,7 +336,7 @@
  }
  
 diff --git a/mt7996/coredump.h b/mt7996/coredump.h
-index af2ba219b..01ed3731c 100644
+index af2ba219..01ed3731 100644
 --- a/mt7996/coredump.h
 +++ b/mt7996/coredump.h
 @@ -6,10 +6,13 @@
@@ -429,10 +429,10 @@
  	return NULL;
  }
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index fd1edf140..0aabded63 100644
+index 986031f5..724af82a 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1902,28 +1902,25 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2082,28 +2082,25 @@ void mt7996_mac_reset_work(struct work_struct *work)
  }
  
  /* firmware coredump */
@@ -465,7 +465,7 @@
  	if (!mem_region || !crash_data->memdump_buf_len) {
  		mutex_unlock(&dev->dump_mutex);
  		goto skip_memdump;
-@@ -1933,6 +1930,9 @@ void mt7996_mac_dump_work(struct work_struct *work)
+@@ -2113,6 +2110,9 @@ void mt7996_mac_dump_work(struct work_struct *work)
  	buf_len = crash_data->memdump_buf_len;
  
  	/* dumping memory content... */
@@ -475,7 +475,7 @@
  	memset(buf, 0, buf_len);
  	for (i = 0; i < num; i++) {
  		if (mem_region->len > buf_len) {
-@@ -1949,6 +1949,7 @@ void mt7996_mac_dump_work(struct work_struct *work)
+@@ -2129,6 +2129,7 @@ void mt7996_mac_dump_work(struct work_struct *work)
  		mt7996_memcpy_fromio(dev, buf, mem_region->start,
  				     mem_region->len);
  
@@ -483,7 +483,7 @@
  		hdr->start = mem_region->start;
  		hdr->len = mem_region->len;
  
-@@ -1965,8 +1966,20 @@ void mt7996_mac_dump_work(struct work_struct *work)
+@@ -2145,8 +2146,20 @@ void mt7996_mac_dump_work(struct work_struct *work)
  	mutex_unlock(&dev->dump_mutex);
  
  skip_memdump:
@@ -507,10 +507,10 @@
  }
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 9dfee8292..56b2bbc69 100644
+index 38292da3..14f7a43f 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2459,6 +2459,8 @@ static int mt7996_load_patch(struct mt7996_dev *dev)
+@@ -2458,6 +2458,8 @@ static int mt7996_load_patch(struct mt7996_dev *dev)
  
  	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
  		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
@@ -519,7 +519,7 @@
  
  	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
  		struct mt7996_patch_sec *sec;
-@@ -2585,6 +2587,9 @@ static int __mt7996_load_ram(struct mt7996_dev *dev, const char *fw_type,
+@@ -2584,6 +2586,9 @@ static int __mt7996_load_ram(struct mt7996_dev *dev, const char *fw_type,
  	}
  
  	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
@@ -530,10 +530,10 @@
  		 fw_type, hdr->fw_ver, hdr->build_date);
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index ea1104845..3ac354b18 100644
+index 561c1cdc..f59dce77 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -56,6 +56,8 @@
+@@ -58,6 +58,8 @@
  #define MT7996_CRIT_TEMP		110
  #define MT7996_MAX_TEMP			120
  
@@ -542,15 +542,15 @@
  struct mt7996_vif;
  struct mt7996_sta;
  struct mt7996_dfs_pulse;
-@@ -65,6 +67,7 @@ enum mt7996_ram_type {
- 	MT7996_RAM_TYPE_WM,
+@@ -68,6 +70,7 @@ enum mt7996_ram_type {
+ 	MT7996_RAM_TYPE_WM_TM = MT7996_RAM_TYPE_WM,
  	MT7996_RAM_TYPE_WA,
  	MT7996_RAM_TYPE_DSP,
 +	__MT7996_RAM_TYPE_MAX,
  };
  
  enum mt7996_txq_id {
-@@ -229,9 +232,11 @@ struct mt7996_dev {
+@@ -306,9 +309,11 @@ struct mt7996_dev {
  	struct mutex dump_mutex;
  #ifdef CONFIG_DEV_COREDUMP
  	struct {
@@ -562,12 +562,12 @@
 +	char ram_build_date[__MT7996_RAM_TYPE_MAX][MT7996_BUILD_TIME_LEN];
  
  	struct list_head sta_rc_list;
- 	struct list_head twt_list;
+ 	struct list_head sta_poll_list;
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index a5b370d1d..b5c363a6f 100644
+index 86da1bf8..c054586d 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
-@@ -491,7 +491,8 @@ enum base_rev {
+@@ -482,7 +482,8 @@ enum base_rev {
  
  /* FW MODE SYNC */
  #define MT_FW_ASSERT_CNT			0x02208274
@@ -577,7 +577,7 @@
  
  #define MT_SWDEF_BASE				0x00401400
  
-@@ -599,11 +600,15 @@ enum base_rev {
+@@ -580,11 +581,15 @@ enum base_rev {
  #define MT_WF_PHYRX_CSD_BAND_RXTD12_IRPI_SW_CLR		BIT(29)
  
  /* CONN MCU EXCP CON */
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0006-wifi-mt76-mt7996-make-band-capability-init-flexible.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0035-wifi-mt76-mt7996-make-band-capability-init-flexible.patch
similarity index 81%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0006-wifi-mt76-mt7996-make-band-capability-init-flexible.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0035-wifi-mt76-mt7996-make-band-capability-init-flexible.patch
index d6e7363..6864e26 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0006-wifi-mt76-mt7996-make-band-capability-init-flexible.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0035-wifi-mt76-mt7996-make-band-capability-init-flexible.patch
@@ -1,7 +1,7 @@
-From 3121e46d58e1fe871e2940c9b2e38e448a07585e Mon Sep 17 00:00:00 2001
+From 18ed969cf7bfdaa059ed946f5bacd62a2ebf9ffe Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 23 May 2023 15:49:03 +0800
-Subject: [PATCH 06/22] wifi: mt76: mt7996: make band capability init flexible
+Subject: [PATCH 35/39] wifi: mt76: mt7996: make band capability init flexible
 
 There're some variations of mt7996 chipset which only support two-band,
 so parse the adie combination to correctly set band capability.
@@ -17,12 +17,12 @@
  5 files changed, 41 insertions(+), 23 deletions(-)
 
 diff --git a/mt7996/dma.c b/mt7996/dma.c
-index 586e247a1..f5118d054 100644
+index 6a21e3e..f01cea5 100644
 --- a/mt7996/dma.c
 +++ b/mt7996/dma.c
-@@ -159,13 +159,13 @@ void mt7996_dma_start(struct mt7996_dev *dev, bool reset)
+@@ -159,13 +159,13 @@ void __mt7996_dma_enable(struct mt7996_dev *dev, bool reset)
  
- 	irq_mask = MT_INT_RX_DONE_MCU | MT_INT_TX_DONE_MCU;
+ 	irq_mask |= (MT_INT_RX_DONE_MCU | MT_INT_TX_DONE_MCU);
  
 -	if (!dev->mphy.band_idx)
 +	if (mt7996_band_valid(dev, MT_BAND0))
@@ -37,7 +37,7 @@
  		irq_mask |= MT_INT_BAND2_RX_DONE;
  
  done:
-@@ -332,7 +332,7 @@ int mt7996_dma_init(struct mt7996_dev *dev)
+@@ -334,7 +334,7 @@ int mt7996_dma_init(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
@@ -47,10 +47,10 @@
  		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_BAND2],
  				       MT_RXQ_ID(MT_RXQ_BAND2),
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 5f10d87bb..c86c70c22 100644
+index 0562439..0825e0b 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -530,11 +530,7 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
+@@ -529,11 +529,7 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
  	u32 mac_ofs, hif1_ofs = 0;
  	int ret;
  
@@ -63,7 +63,7 @@
  		return 0;
  
  	if (phy)
-@@ -649,8 +645,10 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
+@@ -648,8 +644,10 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
  
  	INIT_WORK(&dev->init_work, mt7996_init_work);
  
@@ -76,7 +76,7 @@
  
  	ret = mt7996_dma_init(dev);
  	if (ret)
-@@ -1080,8 +1078,6 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1089,8 +1087,6 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
@@ -85,7 +85,7 @@
  	ret = mt7996_register_phy(dev, mt7996_phy2(dev), MT_BAND1);
  	if (ret)
  		return ret;
-@@ -1090,13 +1086,24 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1099,13 +1095,24 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
@@ -113,10 +113,10 @@
  
  void mt7996_unregister_device(struct mt7996_dev *dev)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index c3666c925..49bd398a2 100644
+index c647979..9fb800a 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2768,7 +2768,7 @@ mt7996_mcu_init_rx_airtime(struct mt7996_dev *dev)
+@@ -2767,7 +2767,7 @@ mt7996_mcu_init_rx_airtime(struct mt7996_dev *dev)
  {
  	struct uni_header hdr = {};
  	struct sk_buff *skb;
@@ -125,7 +125,7 @@
  
  	num = 2 + 2 * (dev->dbdc_support + dev->tbtc_support);
  	len = sizeof(hdr) + num * sizeof(struct vow_rx_airtime);
-@@ -2778,13 +2778,10 @@ mt7996_mcu_init_rx_airtime(struct mt7996_dev *dev)
+@@ -2777,13 +2777,10 @@ mt7996_mcu_init_rx_airtime(struct mt7996_dev *dev)
  
  	skb_put_data(skb, &hdr, sizeof(hdr));
  
@@ -144,10 +144,10 @@
  	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
  				     MCU_WM_UNI_CMD(VOW), true);
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 810a472ea..230d9ee79 100644
+index f59dce7..488f59c 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -329,6 +329,17 @@ mt7996_phy3(struct mt7996_dev *dev)
+@@ -431,6 +431,17 @@ mt7996_phy3(struct mt7996_dev *dev)
  	return __mt7996_phy(dev, MT_BAND2);
  }
  
@@ -166,10 +166,10 @@
  extern struct pci_driver mt7996_pci_driver;
  extern struct pci_driver mt7996_hif_driver;
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index 570229062..3d32f1e9a 100644
+index c054586..3a5914c 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
-@@ -545,6 +545,9 @@ enum base_rev {
+@@ -546,6 +546,9 @@ enum base_rev {
  #define MT_TOP_MISC				MT_TOP(0xf0)
  #define MT_TOP_MISC_FW_STATE			GENMASK(2, 0)
  
@@ -180,5 +180,5 @@
  #define MT_WF_SUBSYS_RST			0x70028600
  
 -- 
-2.39.2
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1005-wifi-mt76-mt7996-enable-SCS-feature-for-mt7996-drive.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0036-wifi-mt76-mt7996-enable-SCS-feature-for-mt7996-drive.patch
similarity index 88%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1005-wifi-mt76-mt7996-enable-SCS-feature-for-mt7996-drive.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0036-wifi-mt76-mt7996-enable-SCS-feature-for-mt7996-drive.patch
index 71a05fb..c0ce85d 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1005-wifi-mt76-mt7996-enable-SCS-feature-for-mt7996-drive.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0036-wifi-mt76-mt7996-enable-SCS-feature-for-mt7996-drive.patch
@@ -1,7 +1,7 @@
-From d7700431ea080cc79002cad62384ea66054f9905 Mon Sep 17 00:00:00 2001
+From 18f990de206c3301d3ae72cfeef40dfb3b361fb0 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 8 May 2023 09:03:50 +0800
-Subject: [PATCH 1005/1024] wifi: mt76: mt7996: enable SCS feature for mt7996
+Subject: [PATCH 36/39] wifi: mt76: mt7996: enable SCS feature for mt7996
  driver
 
 Enable Smart Carrier Sense algorithn by default to improve performance
@@ -18,31 +18,31 @@
  6 files changed, 154 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 7e859da65..25b467e5d 100644
+index 97f874b..bfec420 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1230,6 +1230,7 @@ enum {
- 	MCU_UNI_CMD_GET_STAT_INFO = 0x23,
+@@ -1213,6 +1213,7 @@ enum {
+ 	MCU_UNI_CMD_GET_MIB_INFO = 0x22,
  	MCU_UNI_CMD_SNIFFER = 0x24,
  	MCU_UNI_CMD_SR = 0x25,
 +	MCU_UNI_CMD_SCS = 0x26,
  	MCU_UNI_CMD_ROC = 0x27,
- 	MCU_UNI_CMD_SET_DBDC_PARMS = 0x28,
  	MCU_UNI_CMD_TXPOWER = 0x2b,
+ 	MCU_UNI_CMD_EFUSE_CTRL = 0x2d,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index aebdc0df8..f76fe6ea7 100644
+index 0825e0b..1072874 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -1070,6 +1070,7 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1058,6 +1058,7 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	dev->mt76.phy.priv = &dev->phy;
  	INIT_WORK(&dev->rc_work, mt7996_mac_sta_rc_work);
  	INIT_DELAYED_WORK(&dev->mphy.mac_work, mt7996_mac_work);
 +	INIT_DELAYED_WORK(&dev->scs_work, mt7996_mcu_scs_sta_poll);
  	INIT_LIST_HEAD(&dev->sta_rc_list);
+ 	INIT_LIST_HEAD(&dev->sta_poll_list);
  	INIT_LIST_HEAD(&dev->twt_list);
- 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 3336602f1..ab5693e4f 100644
+index 520f250..20b89a7 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -73,11 +73,17 @@ int mt7996_run(struct ieee80211_hw *hw)
@@ -72,10 +72,10 @@
  	mutex_lock(&dev->mt76.mutex);
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 837cf1b30..db3cab39c 100644
+index 9fb800a..a5c473a 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -4354,3 +4354,126 @@ int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 da
+@@ -4190,3 +4190,126 @@ int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 da
  	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(TXPOWER),
  				 &req, sizeof(req), false);
  }
@@ -203,10 +203,10 @@
 +				 &req, sizeof(req), false);
 +}
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 86701c3f6..3b2536601 100644
+index eed7371..eb63441 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
-@@ -875,6 +875,12 @@ enum {
+@@ -757,6 +757,12 @@ enum {
  	MT7996_SEC_MODE_MAX,
  };
  
@@ -220,10 +220,10 @@
  #define MT7996_PATCH_SCRAMBLE_KEY	GENMASK(15, 8)
  #define MT7996_PATCH_AES_KEY		GENMASK(7, 0)
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index d65adac41..7b7dc9b33 100644
+index 488f59c..f78f1fd 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -165,6 +165,17 @@ struct mt7996_hif {
+@@ -222,6 +222,17 @@ struct mt7996_hif {
  	int irq;
  };
  
@@ -241,7 +241,7 @@
  struct mt7996_phy {
  	struct mt76_phy *mt76;
  	struct mt7996_dev *dev;
-@@ -198,6 +209,8 @@ struct mt7996_phy {
+@@ -253,6 +264,8 @@ struct mt7996_phy {
  
  	bool has_aux_rx;
  
@@ -250,7 +250,7 @@
  #ifdef CONFIG_NL80211_TESTMODE
  	struct {
  		u32 *reg_backup;
-@@ -243,6 +256,7 @@ struct mt7996_dev {
+@@ -295,6 +308,7 @@ struct mt7996_dev {
  	struct work_struct rc_work;
  	struct work_struct dump_work;
  	struct work_struct reset_work;
@@ -258,7 +258,7 @@
  	wait_queue_head_t reset_wait;
  	struct {
  		u32 state;
-@@ -497,6 +511,8 @@ int mt7996_mcu_trigger_assert(struct mt7996_dev *dev);
+@@ -535,6 +549,8 @@ int mt7996_mcu_trigger_assert(struct mt7996_dev *dev);
  void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
  void mt7996_mcu_exit(struct mt7996_dev *dev);
  int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 data);
@@ -268,5 +268,5 @@
  static inline u8 mt7996_max_interface_num(struct mt7996_dev *dev)
  {
 -- 
-2.39.2
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0007-wifi-mt76-mt7996-add-beacon-duplicate-tx-mode-suppor.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0037-wifi-mt76-mt7996-add-beacon-duplicate-tx-mode-suppor.patch
similarity index 83%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0007-wifi-mt76-mt7996-add-beacon-duplicate-tx-mode-suppor.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0037-wifi-mt76-mt7996-add-beacon-duplicate-tx-mode-suppor.patch
index 36a2f62..5dc8109 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0007-wifi-mt76-mt7996-add-beacon-duplicate-tx-mode-suppor.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0037-wifi-mt76-mt7996-add-beacon-duplicate-tx-mode-suppor.patch
@@ -1,7 +1,7 @@
-From 907b2a98a0bae4db421767e9f52668f4534c337a Mon Sep 17 00:00:00 2001
+From de92f88f5c00cf1069df00bb89f50281b0b2d05e Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 12 May 2023 16:24:53 +0800
-Subject: [PATCH 07/22] wifi: mt76: mt7996: add beacon duplicate tx mode
+Subject: [PATCH 37/39] wifi: mt76: mt7996: add beacon duplicate tx mode
  support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -16,19 +16,19 @@
  7 files changed, 69 insertions(+), 25 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 99077f1fc..90c08d276 100644
+index bfec420..4bb9508 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1239,6 +1239,7 @@ enum {
+@@ -1224,6 +1224,7 @@ enum {
  	MCU_UNI_CMD_CHANNEL_SWITCH = 0x34,
  	MCU_UNI_CMD_THERMAL = 0x35,
  	MCU_UNI_CMD_VOW = 0x37,
 +	MCU_UNI_CMD_FIXED_RATE_TABLE = 0x40,
+ 	MCU_UNI_CMD_TESTMODE_CTRL = 0x46,
  	MCU_UNI_CMD_RRO = 0x57,
  	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
- 	MCU_UNI_CMD_ASSERT_DUMP = 0x6f,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index c86c70c22..a8a60a8c9 100644
+index 1072874..9eba689 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -351,6 +351,7 @@ mt7996_init_wiphy(struct ieee80211_hw *hw)
@@ -39,7 +39,7 @@
  
  	hw->sta_data_size = sizeof(struct mt7996_sta);
  	hw->vif_data_size = sizeof(struct mt7996_vif);
-@@ -460,11 +461,12 @@ static void mt7996_mac_init_basic_rates(struct mt7996_dev *dev)
+@@ -459,11 +460,12 @@ static void mt7996_mac_init_basic_rates(struct mt7996_dev *dev)
  
  	for (i = 0; i < ARRAY_SIZE(mt76_rates); i++) {
  		u16 rate = mt76_rates[i].hw_value;
@@ -55,10 +55,10 @@
  }
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 1a1e21872..c20a6affc 100644
+index 724af82..05269e7 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -248,17 +248,6 @@ void mt7996_mac_enable_rtscts(struct mt7996_dev *dev,
+@@ -252,17 +252,6 @@ void mt7996_mac_enable_rtscts(struct mt7996_dev *dev,
  		mt76_clear(dev, addr, BIT(5));
  }
  
@@ -73,15 +73,15 @@
 -	mt76_wr(dev, MT_WTBL_ITCR, ctrl);
 -}
 -
- /* The HW does not translate the mac header to 802.3 for mesh point */
- static int mt7996_reverse_frag0_hdr_trans(struct sk_buff *skb, u16 hdr_gap)
- {
+ static void
+ mt7996_mac_decode_he_radiotap_ru(struct mt76_rx_status *status,
+ 				 struct ieee80211_radiotap_he *he,
 diff --git a/mt7996/main.c b/mt7996/main.c
-index ec25351cc..d8fd8191c 100644
+index 20b89a7..2ed66e6 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -522,24 +522,25 @@ mt7996_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
+@@ -544,24 +544,25 @@ mt7996_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt76_phy *mphy = hw->priv;
  	u16 rate;
 -	u8 i, idx, ht;
@@ -101,7 +101,7 @@
 +			mt7996_mcu_set_fixed_rate_table(phy, idx, rate, beacon);
  
 -		/* must odd index */
--		idx = MT7996_BEACON_RATES_TBL + 2 * (mvif->idx % 20);
+-		idx = MT7996_BEACON_RATES_TBL + 2 * (mvif->mt76.idx % 20);
 -		mt7996_mac_set_fixed_rate_table(dev, idx, rate);
  		return idx;
  	}
@@ -114,7 +114,7 @@
  
  	return mvif->basic_rates_idx;
  }
-@@ -966,7 +967,6 @@ mt7996_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
+@@ -965,7 +966,6 @@ mt7996_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
  	mt7996_set_stream_vht_txbf_caps(phy);
  	mt7996_set_stream_he_eht_caps(phy);
  
@@ -123,10 +123,10 @@
  
  	return 0;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 49bd398a2..653c1d2b7 100644
+index a5c473a..b34c6b7 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -4057,6 +4057,36 @@ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
+@@ -4056,6 +4056,36 @@ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
  				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
  }
  
@@ -164,10 +164,10 @@
  {
  	struct {
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index f1528df82..c20a94788 100644
+index eb63441..e32767e 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
-@@ -738,4 +738,24 @@ enum {
+@@ -771,4 +771,24 @@ enum {
  #define MT7996_SEC_KEY_IDX		GENMASK(2, 1)
  #define MT7996_SEC_IV			BIT(3)
  
@@ -193,10 +193,10 @@
 +
  #endif
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 230d9ee79..56e2cef1a 100644
+index f78f1fd..286fc1e 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -46,7 +46,7 @@
+@@ -48,7 +48,7 @@
  #define MT7996_MAX_QUEUE		(__MT_RXQ_MAX +	__MT_MCUQ_MAX + 3)
  
  /* NOTE: used to map mt76_rates. idx may change if firmware expands table */
@@ -205,7 +205,7 @@
  #define MT7996_BEACON_RATES_TBL		25
  
  #define MT7996_THERMAL_THROTTLE_MAX	100
-@@ -177,6 +177,8 @@ struct mt7996_phy {
+@@ -256,6 +256,8 @@ struct mt7996_phy {
  
  	u8 rdd_state;
  
@@ -214,7 +214,7 @@
  	u32 rx_ampdu_ts;
  	u32 ampdu_ref;
  
-@@ -421,6 +423,8 @@ int mt7996_mcu_rdd_cmd(struct mt7996_dev *dev, int cmd, u8 index,
+@@ -539,6 +541,8 @@ int mt7996_mcu_rdd_cmd(struct mt7996_dev *dev, int cmd, u8 index,
  		       u8 rx_sel, u8 val);
  int mt7996_mcu_rdd_background_enable(struct mt7996_phy *phy,
  				     struct cfg80211_chan_def *chandef);
@@ -223,7 +223,7 @@
  int mt7996_mcu_rf_regval(struct mt7996_dev *dev, u32 regidx, u32 *val, bool set);
  int mt7996_mcu_set_hdr_trans(struct mt7996_dev *dev, bool hdr_trans);
  int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u8 val);
-@@ -485,8 +489,6 @@ void mt7996_mac_cca_stats_reset(struct mt7996_phy *phy);
+@@ -606,8 +610,6 @@ void mt7996_mac_cca_stats_reset(struct mt7996_phy *phy);
  void mt7996_mac_enable_nf(struct mt7996_dev *dev, u8 band);
  void mt7996_mac_enable_rtscts(struct mt7996_dev *dev,
  			      struct ieee80211_vif *vif, bool enable);
@@ -233,5 +233,5 @@
  			   struct sk_buff *skb, struct mt76_wcid *wcid,
  			   struct ieee80211_key_conf *key, int pid,
 -- 
-2.39.2
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0038-wifi-mt76-mt7996-fix-DFS-CAC-tx-emission-issue-after.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0038-wifi-mt76-mt7996-fix-DFS-CAC-tx-emission-issue-after.patch
new file mode 100644
index 0000000..10bbe3a
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0038-wifi-mt76-mt7996-fix-DFS-CAC-tx-emission-issue-after.patch
@@ -0,0 +1,40 @@
+From 39893cc863213984a9ab0ae279dbfe433a6fe90e Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Tue, 23 May 2023 21:18:59 +0800
+Subject: [PATCH 38/39] wifi: mt76: mt7996: fix DFS CAC tx emission issue after
+ 2nd interface up
+
+FW's channel state is set during the first wifi interface setup. If the switch reason for
+setting the tx/rx path during second-time wifi interface setup is CH_SWITCH_NORMAL,
+then the FW would perform runtime dpd channel calibration during DFS CAC, which leads to
+tx emission. Therefore, in order to bypass tx calibration during DFS CAC, set the switch reason
+to CH_SWITCH_DFS whenever chandef is set to DFS channel.
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt7996/mcu.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index b34c6b7..be5c908 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -3211,12 +3211,12 @@ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag)
+ 		.channel_band = ch_band[chandef->chan->band],
+ 	};
+ 
+-	if (tag == UNI_CHANNEL_RX_PATH ||
+-	    dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
++	if (dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
+ 		req.switch_reason = CH_SWITCH_NORMAL;
+ 	else if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
+ 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
+-	else if (!cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
++	else if (cfg80211_chandef_valid(chandef) &&
++		 !cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
+ 					  NL80211_IFTYPE_AP))
+ 		req.switch_reason = CH_SWITCH_DFS;
+ 	else
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0008-wifi-mt76-mt7996-fix-bss-rate-tlv-to-sync-firmware-c.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0039-wifi-mt76-mt7996-fix-bss-rate-tlv-to-sync-firmware-c.patch
similarity index 74%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0008-wifi-mt76-mt7996-fix-bss-rate-tlv-to-sync-firmware-c.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0039-wifi-mt76-mt7996-fix-bss-rate-tlv-to-sync-firmware-c.patch
index bf8d858..c2fed58 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0008-wifi-mt76-mt7996-fix-bss-rate-tlv-to-sync-firmware-c.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0039-wifi-mt76-mt7996-fix-bss-rate-tlv-to-sync-firmware-c.patch
@@ -1,7 +1,7 @@
-From f1efd2608cbdf962d18652e37522ab50e235c539 Mon Sep 17 00:00:00 2001
+From affb48f4b09fca1e4df1e2291c78ee01b877e40f Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Tue, 30 May 2023 11:27:01 +0800
-Subject: [PATCH 08/22] wifi: mt76: mt7996: fix bss rate tlv to sync firmware
+Subject: [PATCH 39/39] wifi: mt76: mt7996: fix bss rate tlv to sync firmware
  change
 
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
@@ -10,7 +10,7 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index c20a94788..78ecd757e 100644
+index e32767e..549007f 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -259,7 +259,7 @@ struct bss_rate_tlv {
@@ -23,5 +23,5 @@
  
  struct bss_ra_tlv {
 -- 
-2.39.2
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0040-wifi-mt76-mt7996-fix-beamformee-ss-subfield-in-EHT-P.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0040-wifi-mt76-mt7996-fix-beamformee-ss-subfield-in-EHT-P.patch
new file mode 100644
index 0000000..b5a49a5
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0040-wifi-mt76-mt7996-fix-beamformee-ss-subfield-in-EHT-P.patch
@@ -0,0 +1,43 @@
+From da1c93b8c6480cfcd605cd8c19111a6df8c9f8b4 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Fri, 2 Jun 2023 15:12:34 +0800
+Subject: [PATCH] wifi: mt76: mt7996: fix beamformee ss subfield in EHT PHY
+ caps IE
+
+According to P802.11be_D2.1 Table 9-401I, the minimum value of Beamformee SS shall
+be 3. Fix it to ensure that the value of Beamformee SS subfield is at least 3.
+
+Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
+---
+ mt7996/init.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/mt7996/init.c b/mt7996/init.c
+index 9eba689a..96c4bb01 100644
+--- a/mt7996/init.c
++++ b/mt7996/init.c
+@@ -936,16 +936,17 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,
+ 		IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
+ 		IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE;
+ 
++	val = max_t(u8, sts - 1, 3);
+ 	eht_cap_elem->phy_cap_info[0] |=
+-		u8_encode_bits(u8_get_bits(sts - 1, BIT(0)),
++		u8_encode_bits(u8_get_bits(val, BIT(0)),
+ 			       IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK);
+ 
+ 	eht_cap_elem->phy_cap_info[1] =
+-		u8_encode_bits(u8_get_bits(sts - 1, GENMASK(2, 1)),
++		u8_encode_bits(u8_get_bits(val, GENMASK(2, 1)),
+ 			       IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK) |
+-		u8_encode_bits(sts - 1,
++		u8_encode_bits(val,
+ 			       IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK) |
+-		u8_encode_bits(sts - 1,
++		u8_encode_bits(val,
+ 			       IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK);
+ 
+ 	eht_cap_elem->phy_cap_info[2] =
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0009-wifi-mt76-mt7996-adjust-wfdma-setting-to-enhance-thr.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0041-wifi-mt76-mt7996-adjust-wfdma-setting-to-enhance-thr.patch
similarity index 92%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0009-wifi-mt76-mt7996-adjust-wfdma-setting-to-enhance-thr.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0041-wifi-mt76-mt7996-adjust-wfdma-setting-to-enhance-thr.patch
index 607fabd..f6e14b7 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0009-wifi-mt76-mt7996-adjust-wfdma-setting-to-enhance-thr.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0041-wifi-mt76-mt7996-adjust-wfdma-setting-to-enhance-thr.patch
@@ -1,7 +1,7 @@
-From 65b539b6e2d62f038c1a93f443a59f7457f91aab Mon Sep 17 00:00:00 2001
+From 78bc83a6a4dc69f135c6a32756e8acb96c64b1bf Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Tue, 13 Jun 2023 09:04:43 +0800
-Subject: [PATCH 09/22] wifi: mt76: mt7996: adjust wfdma setting to enhance
+Subject: [PATCH] wifi: mt76: mt7996: adjust wfdma setting to enhance
  throughput
 
 1. Set band 1 traffic to pcie1.
@@ -15,7 +15,7 @@
  2 files changed, 52 insertions(+), 14 deletions(-)
 
 diff --git a/mt7996/dma.c b/mt7996/dma.c
-index f5118d054..d4bbe9fb4 100644
+index f01cea5e..bb390517 100644
 --- a/mt7996/dma.c
 +++ b/mt7996/dma.c
 @@ -56,22 +56,34 @@ static void mt7996_dma_config(struct mt7996_dev *dev)
@@ -66,7 +66,7 @@
  
  	mt76_set(dev, WF_WFDMA0_GLO_CFG_EXT1 + ofs, WF_WFDMA0_GLO_CFG_EXT1_CALC_MODE);
  }
-@@ -223,6 +235,12 @@ static void mt7996_dma_enable(struct mt7996_dev *dev, bool reset)
+@@ -223,6 +235,12 @@ static int mt7996_dma_enable(struct mt7996_dev *dev, bool reset)
  	mt76_set(dev, WF_WFDMA0_GLO_CFG_EXT1,
  		 WF_WFDMA0_GLO_CFG_EXT1_TX_FCTRL_MODE);
  
@@ -79,7 +79,7 @@
  	if (dev->hif2) {
  		/* GLO_CFG_EXT0 */
  		mt76_set(dev, WF_WFDMA0_GLO_CFG_EXT0 + hif1_ofs,
-@@ -234,7 +252,18 @@ static void mt7996_dma_enable(struct mt7996_dev *dev, bool reset)
+@@ -234,7 +252,18 @@ static int mt7996_dma_enable(struct mt7996_dev *dev, bool reset)
  			 WF_WFDMA0_GLO_CFG_EXT1_TX_FCTRL_MODE);
  
  		mt76_set(dev, MT_WFDMA_HOST_CONFIG,
@@ -100,7 +100,7 @@
  
  	if (dev->hif2) {
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index 3d32f1e9a..a5b370d1d 100644
+index 3a5914c4..5917ba1a 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -333,6 +333,11 @@ enum base_rev {
@@ -131,5 +131,5 @@
  #define MT_PCIE_RECOG_ID_MASK			GENMASK(30, 0)
  #define MT_PCIE_RECOG_ID_SEM			BIT(31)
 -- 
-2.39.2
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0999-wifi-mt76-mt7996-for-build-pass.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0999-wifi-mt76-mt7996-for-build-pass.patch
index 011ba0f..cb5d3bb 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0999-wifi-mt76-mt7996-for-build-pass.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0999-wifi-mt76-mt7996-for-build-pass.patch
@@ -1,7 +1,7 @@
-From bb7ab509be8e0cf9c9f10efa2fdd4c9c9b4d25b0 Mon Sep 17 00:00:00 2001
+From 83bb8ec37f85161b08f4eb2abf6a9a0530cfc189 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 3 Nov 2022 00:27:17 +0800
-Subject: [PATCH 0999/1024] wifi: mt76: mt7996: for build pass
+Subject: [PATCH 0999/1015] wifi: mt76: mt7996: for build pass
 
 Change-Id: Ieb44c33ee6e6a2e6058c1ef528404c1a1cbcfdaf
 ---
@@ -18,7 +18,7 @@
  10 files changed, 19 insertions(+), 4 deletions(-)
 
 diff --git a/debugfs.c b/debugfs.c
-index c4649ba04..ac5207e5e 100644
+index 79064a4d..e10d4cbc 100644
 --- a/debugfs.c
 +++ b/debugfs.c
 @@ -33,8 +33,11 @@ mt76_napi_threaded_set(void *data, u64 val)
@@ -34,10 +34,10 @@
  	return 0;
  }
 diff --git a/dma.c b/dma.c
-index 643e18ebb..f5091a35b 100644
+index f2b1b2ac..e1e9062b 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -861,7 +861,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+@@ -859,7 +859,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  		    !(dev->drv->rx_check(dev, data, len)))
  			goto free_frag;
  
@@ -47,10 +47,10 @@
  			goto free_frag;
  
 diff --git a/eeprom.c b/eeprom.c
-index 2558788f7..a07ca8440 100644
+index 263e5089..aa889258 100644
 --- a/eeprom.c
 +++ b/eeprom.c
-@@ -161,9 +161,15 @@ void
+@@ -108,9 +108,15 @@ void
  mt76_eeprom_override(struct mt76_phy *phy)
  {
  	struct mt76_dev *dev = phy->dev;
@@ -68,7 +68,7 @@
  	if (!is_valid_ether_addr(phy->macaddr)) {
  		eth_random_addr(phy->macaddr);
 diff --git a/mcu.c b/mcu.c
-index a8cafa39a..fa4b05441 100644
+index a8cafa39..fa4b0544 100644
 --- a/mcu.c
 +++ b/mcu.c
 @@ -4,6 +4,7 @@
@@ -80,7 +80,7 @@
  struct sk_buff *
  __mt76_mcu_msg_alloc(struct mt76_dev *dev, const void *data,
 diff --git a/mt7615/mcu.c b/mt7615/mcu.c
-index 955974a82..db337aada 100644
+index 8d745c97..86061e95 100644
 --- a/mt7615/mcu.c
 +++ b/mt7615/mcu.c
 @@ -10,6 +10,7 @@
@@ -92,7 +92,7 @@
  static bool prefer_offload_fw = true;
  module_param(prefer_offload_fw, bool, 0644);
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index bb570f252..236cfea6a 100644
+index 5fab6772..c24dac10 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -4,6 +4,7 @@
@@ -104,7 +104,7 @@
  int mt76_connac_mcu_start_firmware(struct mt76_dev *dev, u32 addr, u32 option)
  {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index b6fba1ae1..dee01e03f 100644
+index aa706ff6..e8c1e572 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -6,6 +6,7 @@
@@ -116,10 +116,10 @@
  #define fw_name(_dev, name, ...)	({			\
  	char *_fw;						\
 diff --git a/mt7996/dma.c b/mt7996/dma.c
-index d4bbe9fb4..2e75d2794 100644
+index f01cea5e..b8f253d0 100644
 --- a/mt7996/dma.c
 +++ b/mt7996/dma.c
-@@ -387,8 +387,8 @@ int mt7996_dma_init(struct mt7996_dev *dev)
+@@ -360,8 +360,8 @@ int mt7996_dma_init(struct mt7996_dev *dev)
  	if (ret < 0)
  		return ret;
  
@@ -131,10 +131,10 @@
  
  	mt7996_dma_enable(dev, false);
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 9db7e5310..1d98d99eb 100644
+index 9840c77d..b81ed64c 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -98,6 +98,7 @@ static int mt7996_eeprom_parse_efuse_hw_cap(struct mt7996_dev *dev)
+@@ -121,6 +121,7 @@ static int mt7996_eeprom_parse_efuse_hw_cap(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
@@ -143,7 +143,7 @@
  		dev->has_eht = !(cap & MODE_HE_ONLY);
  		dev->wtbl_size_group = u32_get_bits(cap, WTBL_SIZE_GROUP);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 181be911b..3d6792259 100644
+index 871d32a4..58893348 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -5,6 +5,7 @@
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1000-wifi-mt76-mt7996-add-debug-tool.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1000-wifi-mt76-mt7996-add-debug-tool.patch
index 2db6d00..fcc450e 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1000-wifi-mt76-mt7996-add-debug-tool.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1000-wifi-mt76-mt7996-add-debug-tool.patch
@@ -1,46 +1,45 @@
-From 36a71ed07925573d2eff73f7be91c86763151470 Mon Sep 17 00:00:00 2001
+From 16ea1c12d369ea1f315edcc7a8525efc6d78403a Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 24 Mar 2023 14:02:32 +0800
-Subject: [PATCH 1000/1024] wifi: mt76: mt7996: add debug tool
+Subject: [PATCH] wifi: mt76: mt7996: add debug tool
 
 Change-Id: Ie10390b01f17db893dbfbf3221bf63a4bd1fe38f
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
- mt7996/Makefile      |    4 +
+ mt7996/Makefile      |    3 +
  mt7996/coredump.c    |   10 +-
  mt7996/coredump.h    |    7 +
- mt7996/debugfs.c     |   34 +-
+ mt7996/debugfs.c     |   24 +-
  mt7996/mt7996.h      |   14 +
- mt7996/mtk_debug.h   | 2147 ++++++++++++++++++++++++++++++++++++++
- mt7996/mtk_debugfs.c | 2379 ++++++++++++++++++++++++++++++++++++++++++
+ mt7996/mtk_debug.h   | 2165 ++++++++++++++++++++++++++++++++++++++
+ mt7996/mtk_debugfs.c | 2353 ++++++++++++++++++++++++++++++++++++++++++
  mt7996/mtk_mcu.c     |   18 +
  mt7996/mtk_mcu.h     |   16 +
  tools/fwlog.c        |   25 +-
- 10 files changed, 4634 insertions(+), 20 deletions(-)
+ 10 files changed, 4617 insertions(+), 18 deletions(-)
  create mode 100644 mt7996/mtk_debug.h
  create mode 100644 mt7996/mtk_debugfs.c
  create mode 100644 mt7996/mtk_mcu.c
  create mode 100644 mt7996/mtk_mcu.h
 
 diff --git a/mt7996/Makefile b/mt7996/Makefile
-index 07c8b555c..a056b40e0 100644
+index 7c2514a6..df131869 100644
 --- a/mt7996/Makefile
 +++ b/mt7996/Makefile
-@@ -1,4 +1,6 @@
+@@ -1,5 +1,6 @@
  # SPDX-License-Identifier: ISC
-+EXTRA_CFLAGS += -DCONFIG_MT76_LEDS
+ EXTRA_CFLAGS += -DCONFIG_MT76_LEDS
 +EXTRA_CFLAGS += -DCONFIG_MTK_DEBUG
  
  obj-$(CONFIG_MT7996E) += mt7996e.o
  
-@@ -6,3 +8,5 @@ mt7996e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \
- 	     debugfs.o mmio.o
- 
+@@ -9,3 +10,5 @@ mt7996e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \
  mt7996e-$(CONFIG_DEV_COREDUMP) += coredump.o
+ 
+ mt7996e-$(CONFIG_NL80211_TESTMODE) += testmode.o
 +
 +mt7996e-y += mtk_debugfs.o mtk_mcu.o
 diff --git a/mt7996/coredump.c b/mt7996/coredump.c
-index 60b88085c..a7f91b56d 100644
+index 60b88085..a7f91b56 100644
 --- a/mt7996/coredump.c
 +++ b/mt7996/coredump.c
 @@ -195,7 +195,7 @@ mt7996_coredump_fw_stack(struct mt7996_dev *dev, u8 type, struct mt7996_coredump
@@ -89,7 +88,7 @@
  		dev_warn(dev->mt76.dev, "no crash dump data found\n");
  		return -ENODATA;
 diff --git a/mt7996/coredump.h b/mt7996/coredump.h
-index 01ed3731c..93cd84a03 100644
+index 01ed3731..93cd84a0 100644
 --- a/mt7996/coredump.h
 +++ b/mt7996/coredump.h
 @@ -75,6 +75,7 @@ struct mt7996_mem_region {
@@ -114,21 +113,10 @@
  mt7996_crash_data *mt7996_coredump_new(struct mt7996_dev *dev, u8 type)
  {
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 9bd953586..92aa1644f 100644
+index ca4d615d..93581fef 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
-@@ -290,11 +290,20 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
- 		DEBUG_SPL,
- 		DEBUG_RPT_RX,
- 		DEBUG_RPT_RA = 68,
-+		DEBUG_IDS_PP = 93,
-+		DEBUG_IDS_RA = 94,
-+		DEBUG_IDS_BF = 95,
-+		DEBUG_IDS_SR = 96,
-+		DEBUG_IDS_RU = 97,
-+		DEBUG_IDS_MUMIMO = 98,
- 	} debug;
- 	bool tx, rx, en;
+@@ -301,6 +301,9 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
  	int ret;
  
  	dev->fw_debug_wm = val ? MCU_FW_LOG_TO_HOST : 0;
@@ -138,18 +126,7 @@
  
  	if (dev->fw_debug_bin)
  		val = MCU_FW_LOG_RELAY;
-@@ -309,8 +318,8 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
- 	if (ret)
- 		return ret;
- 
--	for (debug = DEBUG_TXCMD; debug <= DEBUG_RPT_RA; debug++) {
--		if (debug == 67)
-+	for (debug = DEBUG_TXCMD; debug <= DEBUG_IDS_MUMIMO; debug++) {
-+		if (debug == 67 || (debug > DEBUG_RPT_RA && debug < DEBUG_IDS_PP))
- 			continue;
- 
- 		if (debug == DEBUG_RPT_RX)
-@@ -401,11 +410,12 @@ mt7996_fw_debug_bin_set(void *data, u64 val)
+@@ -407,11 +410,12 @@ mt7996_fw_debug_bin_set(void *data, u64 val)
  	};
  	struct mt7996_dev *dev = data;
  
@@ -165,7 +142,7 @@
  
  	dev->fw_debug_bin = val;
  
-@@ -819,6 +829,11 @@ int mt7996_init_debugfs(struct mt7996_phy *phy)
+@@ -825,6 +829,11 @@ int mt7996_init_debugfs(struct mt7996_phy *phy)
  	if (phy == &dev->phy)
  		dev->debugfs_dir = dir;
  
@@ -177,7 +154,7 @@
  	return 0;
  }
  
-@@ -831,6 +846,12 @@ mt7996_debugfs_write_fwlog(struct mt7996_dev *dev, const void *hdr, int hdrlen,
+@@ -837,6 +846,12 @@ mt7996_debugfs_write_fwlog(struct mt7996_dev *dev, const void *hdr, int hdrlen,
  	void *dest;
  
  	spin_lock_irqsave(&lock, flags);
@@ -190,7 +167,7 @@
  	dest = relay_reserve(dev->relay_fwlog, hdrlen + len + 4);
  	if (dest) {
  		*(u32 *)dest = hdrlen + len;
-@@ -863,9 +884,6 @@ void mt7996_debugfs_rx_fw_monitor(struct mt7996_dev *dev, const void *data, int
+@@ -869,9 +884,6 @@ void mt7996_debugfs_rx_fw_monitor(struct mt7996_dev *dev, const void *data, int
  		.msg_type = cpu_to_le16(PKT_TYPE_RX_FW_MONITOR),
  	};
  
@@ -201,11 +178,11 @@
  	hdr.timestamp = cpu_to_le32(mt76_rr(dev, MT_LPON_FRCR(0)));
  	hdr.len = *(__le16 *)data;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 4477b95d6..8aa124a0c 100644
+index 286fc1eb..6c76ec20 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -264,6 +264,16 @@ struct mt7996_dev {
- 	spinlock_t reg_lock;
+@@ -363,6 +363,16 @@ struct mt7996_dev {
+ 	u32 reg_l2_backup;
  
  	u8 wtbl_size_group;
 +
@@ -221,7 +198,7 @@
  };
  
  enum {
-@@ -544,4 +554,8 @@ void mt7996_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -659,4 +669,8 @@ void mt7996_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			    struct ieee80211_sta *sta, struct dentry *dir);
  #endif
  
@@ -232,10 +209,10 @@
  #endif
 diff --git a/mt7996/mtk_debug.h b/mt7996/mtk_debug.h
 new file mode 100644
-index 000000000..368f0bcf0
+index 00000000..eb40f9cb
 --- /dev/null
 +++ b/mt7996/mtk_debug.h
-@@ -0,0 +1,2147 @@
+@@ -0,0 +1,2165 @@
 +#ifndef __MTK_DEBUG_H
 +#define __MTK_DEBUG_H
 +
@@ -312,23 +289,23 @@
 +#define BN0_WF_AGG_TOP_TWTEDTB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xe4) // 20E4
 +#define BN0_WF_AGG_TOP_TWTEETB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xe8) // 20E8
 +#define BN0_WF_AGG_TOP_TWTEFTB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xec) // 20EC
++#define BN0_WF_AGG_TOP_AALCR2_ADDR                             (BN0_WF_AGG_TOP_BASE + 0xf0) // 20F0
++#define BN0_WF_AGG_TOP_AALCR3_ADDR                             (BN0_WF_AGG_TOP_BASE + 0xf4) // 20F4
++#define BN0_WF_AGG_TOP_AALCR4_ADDR                             (BN0_WF_AGG_TOP_BASE + 0xf8) // 20F8
++#define BN0_WF_AGG_TOP_AALCR5_ADDR                             (BN0_WF_AGG_TOP_BASE + 0xfc) // 20FC
++#define BN0_WF_AGG_TOP_AALCR6_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x100) // 2100
++#define BN0_WF_AGG_TOP_AALCR7_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x104) // 2104
 +#define BN0_WF_AGG_TOP_ATCR0_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x108) // 2108
 +#define BN0_WF_AGG_TOP_ATCR1_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x10c) // 210C
 +#define BN0_WF_AGG_TOP_TCCR_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x110) // 2110
 +#define BN0_WF_AGG_TOP_TFCR_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x114) // 2114
 +#define BN0_WF_AGG_TOP_MUCR0_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x118) // 2118
 +#define BN0_WF_AGG_TOP_MUCR1_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x11c) // 211C
-+#define BN0_WF_AGG_TOP_AALCR2_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x128) // 2128
-+#define BN0_WF_AGG_TOP_AALCR3_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x12c) // 212C
-+#define BN0_WF_AGG_TOP_AALCR4_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x130) // 2130
-+#define BN0_WF_AGG_TOP_AALCR5_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x134) // 2134
-+#define BN0_WF_AGG_TOP_AALCR6_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x138) // 2138
-+#define BN0_WF_AGG_TOP_AALCR7_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x13c) // 213C
-+#define BN0_WF_AGG_TOP_CSDCR0_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x150) // 2150
-+#define BN0_WF_AGG_TOP_CSDCR1_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x154) // 2154
-+#define BN0_WF_AGG_TOP_CSDCR2_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x158) // 2158
-+#define BN0_WF_AGG_TOP_CSDCR3_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x15c) // 215C
-+#define BN0_WF_AGG_TOP_CSDCR4_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x160) // 2160
++#define BN0_WF_AGG_TOP_CSDCR0_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x120) // 2120
++#define BN0_WF_AGG_TOP_CSDCR1_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x124) // 2124
++#define BN0_WF_AGG_TOP_CSDCR2_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x128) // 2128
++#define BN0_WF_AGG_TOP_CSDCR3_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x12c) // 212C
++#define BN0_WF_AGG_TOP_CSDCR4_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x130) // 2130
 +#define BN0_WF_AGG_TOP_DYNSCR_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x178) // 2178
 +#define BN0_WF_AGG_TOP_DYNSSCR_ADDR                            (BN0_WF_AGG_TOP_BASE + 0x198) // 2198
 +#define BN0_WF_AGG_TOP_TCDCNT0_ADDR                            (BN0_WF_AGG_TOP_BASE + 0x2c8) // 22C8
@@ -935,22 +912,22 @@
 +#define BN0_WF_MIB_TOP_TRARC6_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x0C8) // D0C8
 +#define BN0_WF_MIB_TOP_TRARC7_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x0CC) // D0CC
 +
-+#define BN0_WF_MIB_TOP_TRDR0_ADDR                              (BN0_WF_MIB_TOP_BASE + 0xA24) // DA24
-+#define BN0_WF_MIB_TOP_TRDR1_ADDR                              (BN0_WF_MIB_TOP_BASE + 0xA28) // DA28
-+#define BN0_WF_MIB_TOP_TRDR2_ADDR                              (BN0_WF_MIB_TOP_BASE + 0xA2C) // DA2C
-+#define BN0_WF_MIB_TOP_TRDR3_ADDR                              (BN0_WF_MIB_TOP_BASE + 0xA30) // DA30
-+#define BN0_WF_MIB_TOP_TRDR4_ADDR                              (BN0_WF_MIB_TOP_BASE + 0xA34) // DA34
-+#define BN0_WF_MIB_TOP_TRDR5_ADDR                              (BN0_WF_MIB_TOP_BASE + 0xA38) // DA38
-+#define BN0_WF_MIB_TOP_TRDR6_ADDR                              (BN0_WF_MIB_TOP_BASE + 0xA3C) // DA3C
-+#define BN0_WF_MIB_TOP_TRDR7_ADDR                              (BN0_WF_MIB_TOP_BASE + 0xA40) // DA40
-+#define BN0_WF_MIB_TOP_TRDR8_ADDR                              (BN0_WF_MIB_TOP_BASE + 0xA44) // DA44
-+#define BN0_WF_MIB_TOP_TRDR9_ADDR                              (BN0_WF_MIB_TOP_BASE + 0xA48) // DA48
-+#define BN0_WF_MIB_TOP_TRDR10_ADDR                             (BN0_WF_MIB_TOP_BASE + 0xA4C) // DA4C
-+#define BN0_WF_MIB_TOP_TRDR11_ADDR                             (BN0_WF_MIB_TOP_BASE + 0xA50) // DA50
-+#define BN0_WF_MIB_TOP_TRDR12_ADDR                             (BN0_WF_MIB_TOP_BASE + 0xA54) // DA54
-+#define BN0_WF_MIB_TOP_TRDR13_ADDR                             (BN0_WF_MIB_TOP_BASE + 0xA58) // DA58
-+#define BN0_WF_MIB_TOP_TRDR14_ADDR                             (BN0_WF_MIB_TOP_BASE + 0xA5C) // DA5C
-+#define BN0_WF_MIB_TOP_TRDR15_ADDR                             (BN0_WF_MIB_TOP_BASE + 0xA60) // DA60
++#define BN0_WF_MIB_TOP_TRDR0_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9B4) // D9B4
++#define BN0_WF_MIB_TOP_TRDR1_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9B8) // D9B8
++#define BN0_WF_MIB_TOP_TRDR2_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9BC) // D9BC
++#define BN0_WF_MIB_TOP_TRDR3_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9C0) // D9C0
++#define BN0_WF_MIB_TOP_TRDR4_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9C4) // D9C4
++#define BN0_WF_MIB_TOP_TRDR5_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9C8) // D9C8
++#define BN0_WF_MIB_TOP_TRDR6_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9CC) // D9CC
++#define BN0_WF_MIB_TOP_TRDR7_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9D0) // D9D0
++#define BN0_WF_MIB_TOP_TRDR8_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9D4) // D9D4
++#define BN0_WF_MIB_TOP_TRDR9_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9D8) // D9D8
++#define BN0_WF_MIB_TOP_TRDR10_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x9DC) // D9DC
++#define BN0_WF_MIB_TOP_TRDR11_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x9E0) // D9E0
++#define BN0_WF_MIB_TOP_TRDR12_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x9E4) // D9E4
++#define BN0_WF_MIB_TOP_TRDR13_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x9E8) // D9E8
++#define BN0_WF_MIB_TOP_TRDR14_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x9EC) // D9EC
++#define BN0_WF_MIB_TOP_TRDR15_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x9F0) // D9F0
 +
 +#define BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_1_ADDR              BN0_WF_MIB_TOP_TRARC0_ADDR
 +#define BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_1_MASK              0x03FF0000                // AGG_RANG_SEL_1[25..16]
@@ -1201,10 +1178,6 @@
 +#define WF_UWTBL_AMSDU_CFG_ADDR                                     32
 +#define WF_UWTBL_AMSDU_CFG_MASK                                     0x00000fff // 11- 0
 +#define WF_UWTBL_AMSDU_CFG_SHIFT                                    0
-+#define WF_UWTBL_SEC_ADDR_MODE_DW                                   8
-+#define WF_UWTBL_SEC_ADDR_MODE_ADDR                                 32
-+#define WF_UWTBL_SEC_ADDR_MODE_MASK                                 0x00300000 // 21-20
-+#define WF_UWTBL_SEC_ADDR_MODE_SHIFT                                20
 +#define WF_UWTBL_WMM_Q_DW                                           8
 +#define WF_UWTBL_WMM_Q_ADDR                                         32
 +#define WF_UWTBL_WMM_Q_MASK                                         0x06000000 // 26-25
@@ -1432,11 +1405,6 @@
 +#define WF_LWTBL_ULPF_MASK \
 +	0x02000000 // 25-25
 +#define WF_LWTBL_ULPF_SHIFT                                         25
-+#define WF_LWTBL_BYPASS_TXSMM_DW                                    3
-+#define WF_LWTBL_BYPASS_TXSMM_ADDR                                  12
-+#define WF_LWTBL_BYPASS_TXSMM_MASK \
-+	0x04000000 // 26-26
-+#define WF_LWTBL_BYPASS_TXSMM_SHIFT                                 26
 +#define WF_LWTBL_TBF_HT_DW                                          3
 +#define WF_LWTBL_TBF_HT_ADDR                                        12
 +#define WF_LWTBL_TBF_HT_MASK \
@@ -1463,46 +1431,46 @@
 +	0x80000000 // 31-31
 +#define WF_LWTBL_IGN_FBK_SHIFT                                      31
 +// DW4
-+#define WF_LWTBL_NEGOTIATED_WINSIZE0_DW                             4
-+#define WF_LWTBL_NEGOTIATED_WINSIZE0_ADDR                           16
-+#define WF_LWTBL_NEGOTIATED_WINSIZE0_MASK \
++#define WF_LWTBL_ANT_ID0_DW                                         4
++#define WF_LWTBL_ANT_ID0_ADDR                                       16
++#define WF_LWTBL_ANT_ID0_MASK \
 +	0x00000007 // 2- 0
-+#define WF_LWTBL_NEGOTIATED_WINSIZE0_SHIFT                          0
-+#define WF_LWTBL_NEGOTIATED_WINSIZE1_DW                             4
-+#define WF_LWTBL_NEGOTIATED_WINSIZE1_ADDR                           16
-+#define WF_LWTBL_NEGOTIATED_WINSIZE1_MASK \
++#define WF_LWTBL_ANT_ID0_SHIFT                                      0
++#define WF_LWTBL_ANT_ID1_DW                                         4
++#define WF_LWTBL_ANT_ID1_ADDR                                       16
++#define WF_LWTBL_ANT_ID1_MASK \
 +	0x00000038 // 5- 3
-+#define WF_LWTBL_NEGOTIATED_WINSIZE1_SHIFT                          3
-+#define WF_LWTBL_NEGOTIATED_WINSIZE2_DW                             4
-+#define WF_LWTBL_NEGOTIATED_WINSIZE2_ADDR                           16
-+#define WF_LWTBL_NEGOTIATED_WINSIZE2_MASK \
++#define WF_LWTBL_ANT_ID1_SHIFT                                      3
++#define WF_LWTBL_ANT_ID2_DW                                         4
++#define WF_LWTBL_ANT_ID2_ADDR                                       16
++#define WF_LWTBL_ANT_ID2_MASK \
 +	0x000001c0 // 8- 6
-+#define WF_LWTBL_NEGOTIATED_WINSIZE2_SHIFT                          6
-+#define WF_LWTBL_NEGOTIATED_WINSIZE3_DW                             4
-+#define WF_LWTBL_NEGOTIATED_WINSIZE3_ADDR                           16
-+#define WF_LWTBL_NEGOTIATED_WINSIZE3_MASK \
++#define WF_LWTBL_ANT_ID2_SHIFT                                      6
++#define WF_LWTBL_ANT_ID3_DW                                         4
++#define WF_LWTBL_ANT_ID3_ADDR                                       16
++#define WF_LWTBL_ANT_ID3_MASK \
 +	0x00000e00 // 11- 9
-+#define WF_LWTBL_NEGOTIATED_WINSIZE3_SHIFT                          9
-+#define WF_LWTBL_NEGOTIATED_WINSIZE4_DW                             4
-+#define WF_LWTBL_NEGOTIATED_WINSIZE4_ADDR                           16
-+#define WF_LWTBL_NEGOTIATED_WINSIZE4_MASK \
++#define WF_LWTBL_ANT_ID3_SHIFT                                      9
++#define WF_LWTBL_ANT_ID4_DW                                         4
++#define WF_LWTBL_ANT_ID4_ADDR                                       16
++#define WF_LWTBL_ANT_ID4_MASK \
 +	0x00007000 // 14-12
-+#define WF_LWTBL_NEGOTIATED_WINSIZE4_SHIFT                          12
-+#define WF_LWTBL_NEGOTIATED_WINSIZE5_DW                             4
-+#define WF_LWTBL_NEGOTIATED_WINSIZE5_ADDR                           16
-+#define WF_LWTBL_NEGOTIATED_WINSIZE5_MASK \
++#define WF_LWTBL_ANT_ID4_SHIFT                                      12
++#define WF_LWTBL_ANT_ID5_DW                                         4
++#define WF_LWTBL_ANT_ID5_ADDR                                       16
++#define WF_LWTBL_ANT_ID5_MASK \
 +	0x00038000 // 17-15
-+#define WF_LWTBL_NEGOTIATED_WINSIZE5_SHIFT                          15
-+#define WF_LWTBL_NEGOTIATED_WINSIZE6_DW                             4
-+#define WF_LWTBL_NEGOTIATED_WINSIZE6_ADDR                           16
-+#define WF_LWTBL_NEGOTIATED_WINSIZE6_MASK \
++#define WF_LWTBL_ANT_ID5_SHIFT                                      15
++#define WF_LWTBL_ANT_ID6_DW                                         4
++#define WF_LWTBL_ANT_ID6_ADDR                                       16
++#define WF_LWTBL_ANT_ID6_MASK \
 +	0x001c0000 // 20-18
-+#define WF_LWTBL_NEGOTIATED_WINSIZE6_SHIFT                          18
-+#define WF_LWTBL_NEGOTIATED_WINSIZE7_DW                             4
-+#define WF_LWTBL_NEGOTIATED_WINSIZE7_ADDR                           16
-+#define WF_LWTBL_NEGOTIATED_WINSIZE7_MASK \
++#define WF_LWTBL_ANT_ID6_SHIFT                                      18
++#define WF_LWTBL_ANT_ID7_DW                                         4
++#define WF_LWTBL_ANT_ID7_ADDR                                       16
++#define WF_LWTBL_ANT_ID7_MASK \
 +	0x00e00000 // 23-21
-+#define WF_LWTBL_NEGOTIATED_WINSIZE7_SHIFT                          21
++#define WF_LWTBL_ANT_ID7_SHIFT                                      21
 +#define WF_LWTBL_PE_DW                                              4
 +#define WF_LWTBL_PE_ADDR                                            16
 +#define WF_LWTBL_PE_MASK \
@@ -1533,11 +1501,6 @@
 +#define WF_LWTBL_LDPC_EHT_MASK \
 +	0x40000000 // 30-30
 +#define WF_LWTBL_LDPC_EHT_SHIFT                                     30
-+#define WF_LWTBL_BA_MODE_DW                                         4
-+#define WF_LWTBL_BA_MODE_ADDR                                       16
-+#define WF_LWTBL_BA_MODE_MASK \
-+	0x80000000 // 31-31
-+#define WF_LWTBL_BA_MODE_SHIFT                                      31
 +// DW5
 +#define WF_LWTBL_AF_DW                                              5
 +#define WF_LWTBL_AF_ADDR                                            20
@@ -2124,15 +2087,46 @@
 +	0xffff0000 // 31-16
 +#define WF_LWTBL_LINK_MGF_SHIFT                                     16
 +// DW31
-+#define WF_LWTBL_BFTX_TB_DW                                         31
-+#define WF_LWTBL_BFTX_TB_ADDR                                       124
-+#define WF_LWTBL_BFTX_TB_MASK \
-+	0x00800000 // 23-23
-+#define WF_LWTBL_DROP_DW                                            31
-+#define WF_LWTBL_DROP_ADDR                                          124
-+#define WF_LWTBL_DROP_MASK \
-+	0x01000000 // 24-24
-+#define WF_LWTBL_DROP_SHIFT                                         24
++#define WF_LWTBL_NEGOTIATED_WINSIZE0_DW                             31
++#define WF_LWTBL_NEGOTIATED_WINSIZE0_ADDR                           124
++#define WF_LWTBL_NEGOTIATED_WINSIZE0_MASK \
++	0x00000007 // 2- 0
++#define WF_LWTBL_NEGOTIATED_WINSIZE0_SHIFT                          0
++#define WF_LWTBL_NEGOTIATED_WINSIZE1_DW                             31
++#define WF_LWTBL_NEGOTIATED_WINSIZE1_ADDR                           124
++#define WF_LWTBL_NEGOTIATED_WINSIZE1_MASK \
++	0x00000038 // 5- 3
++#define WF_LWTBL_NEGOTIATED_WINSIZE1_SHIFT                          3
++#define WF_LWTBL_NEGOTIATED_WINSIZE2_DW                             31
++#define WF_LWTBL_NEGOTIATED_WINSIZE2_ADDR                           124
++#define WF_LWTBL_NEGOTIATED_WINSIZE2_MASK \
++	0x000001c0 // 8- 6
++#define WF_LWTBL_NEGOTIATED_WINSIZE2_SHIFT                          6
++#define WF_LWTBL_NEGOTIATED_WINSIZE3_DW                             31
++#define WF_LWTBL_NEGOTIATED_WINSIZE3_ADDR                           124
++#define WF_LWTBL_NEGOTIATED_WINSIZE3_MASK \
++	0x00000e00 // 11- 9
++#define WF_LWTBL_NEGOTIATED_WINSIZE3_SHIFT                          9
++#define WF_LWTBL_NEGOTIATED_WINSIZE4_DW                             31
++#define WF_LWTBL_NEGOTIATED_WINSIZE4_ADDR                           124
++#define WF_LWTBL_NEGOTIATED_WINSIZE4_MASK \
++	0x00007000 // 14-12
++#define WF_LWTBL_NEGOTIATED_WINSIZE4_SHIFT                          12
++#define WF_LWTBL_NEGOTIATED_WINSIZE5_DW                             31
++#define WF_LWTBL_NEGOTIATED_WINSIZE5_ADDR                           124
++#define WF_LWTBL_NEGOTIATED_WINSIZE5_MASK \
++	0x00038000 // 17-15
++#define WF_LWTBL_NEGOTIATED_WINSIZE5_SHIFT                          15
++#define WF_LWTBL_NEGOTIATED_WINSIZE6_DW                             31
++#define WF_LWTBL_NEGOTIATED_WINSIZE6_ADDR                           124
++#define WF_LWTBL_NEGOTIATED_WINSIZE6_MASK \
++	0x001c0000 // 20-18
++#define WF_LWTBL_NEGOTIATED_WINSIZE6_SHIFT                          18
++#define WF_LWTBL_NEGOTIATED_WINSIZE7_DW                             31
++#define WF_LWTBL_NEGOTIATED_WINSIZE7_ADDR                           124
++#define WF_LWTBL_NEGOTIATED_WINSIZE7_MASK \
++	0x00e00000 // 23-21
++#define WF_LWTBL_NEGOTIATED_WINSIZE7_SHIFT                          21
 +#define WF_LWTBL_CASCAD_DW                                          31
 +#define WF_LWTBL_CASCAD_ADDR                                        124
 +#define WF_LWTBL_CASCAD_MASK \
@@ -2148,37 +2142,42 @@
 +#define WF_LWTBL_MPDU_SIZE_MASK \
 +	0x18000000 // 28-27
 +#define WF_LWTBL_MPDU_SIZE_SHIFT                                    27
-+#define WF_LWTBL_RXD_DUP_MODE_DW                                    31
-+#define WF_LWTBL_RXD_DUP_MODE_ADDR                                  124
-+#define WF_LWTBL_RXD_DUP_MODE_MASK \
-+	0x60000000 // 30-29
-+#define WF_LWTBL_RXD_DUP_MODE_SHIFT                                 29
-+#define WF_LWTBL_ACK_EN_DW                                          31
-+#define WF_LWTBL_ACK_EN_ADDR                                        128
-+#define WF_LWTBL_ACK_EN_MASK \
-+	0x80000000 // 31-31
-+#define WF_LWTBL_ACK_EN_SHIFT                                       31
++#define WF_LWTBL_BA_MODE_DW                                         31
++#define WF_LWTBL_BA_MODE_ADDR                                       124
++#define WF_LWTBL_BA_MODE_MASK \
++	0xe0000000 // 31-29
++#define WF_LWTBL_BA_MODE_SHIFT                                      29
 +// DW32
 +#define WF_LWTBL_OM_INFO_DW                                         32
 +#define WF_LWTBL_OM_INFO_ADDR                                       128
 +#define WF_LWTBL_OM_INFO_MASK \
 +	0x00000fff // 11- 0
 +#define WF_LWTBL_OM_INFO_SHIFT                                      0
-+#define WF_LWTBL_OM_INFO_EHT_DW                                     32
-+#define WF_LWTBL_OM_INFO_EHT_ADDR                                   128
-+#define WF_LWTBL_OM_INFO_EHT_MASK \
-+	0x0000f000 // 15-12
-+#define WF_LWTBL_OM_INFO_EHT_SHIFT                                  12
 +#define WF_LWTBL_RXD_DUP_FOR_OM_CHG_DW                              32
 +#define WF_LWTBL_RXD_DUP_FOR_OM_CHG_ADDR                            128
 +#define WF_LWTBL_RXD_DUP_FOR_OM_CHG_MASK \
-+	0x00010000 // 16-16
-+#define WF_LWTBL_RXD_DUP_FOR_OM_CHG_SHIFT                           16
++	0x00001000 // 12-12
++#define WF_LWTBL_RXD_DUP_FOR_OM_CHG_SHIFT                           12
 +#define WF_LWTBL_RXD_DUP_WHITE_LIST_DW                              32
 +#define WF_LWTBL_RXD_DUP_WHITE_LIST_ADDR                            128
 +#define WF_LWTBL_RXD_DUP_WHITE_LIST_MASK \
-+	0x1ffe0000 // 28-17
-+#define WF_LWTBL_RXD_DUP_WHITE_LIST_SHIFT                           17
++	0x01ffe000 // 24-13
++#define WF_LWTBL_RXD_DUP_WHITE_LIST_SHIFT                           13
++#define WF_LWTBL_RXD_DUP_MODE_DW                                    32
++#define WF_LWTBL_RXD_DUP_MODE_ADDR                                  128
++#define WF_LWTBL_RXD_DUP_MODE_MASK \
++	0x06000000 // 26-25
++#define WF_LWTBL_RXD_DUP_MODE_SHIFT                                 25
++#define WF_LWTBL_DROP_DW                                            32
++#define WF_LWTBL_DROP_ADDR                                          128
++#define WF_LWTBL_DROP_MASK \
++	0x40000000 // 30-30
++#define WF_LWTBL_DROP_SHIFT                                         30
++#define WF_LWTBL_ACK_EN_DW                                          32
++#define WF_LWTBL_ACK_EN_ADDR                                        128
++#define WF_LWTBL_ACK_EN_MASK \
++	0x80000000 // 31-31
++#define WF_LWTBL_ACK_EN_SHIFT                                       31
 +// DW33
 +#define WF_LWTBL_USER_RSSI_DW                                       33
 +#define WF_LWTBL_USER_RSSI_ADDR                                     132
@@ -2289,10 +2288,6 @@
 +#define WTBL_AMSDU_EN_MASK              BIT(11)
 +#define WTBL_AMSDU_EN_OFFSET            11
 +
-+/* UWTBL DW 8 */
-+#define WTBL_SEC_ADDR_MODE_MASK		BITS(20, 21)
-+#define WTBL_SEC_ADDR_MODE_OFFSET	20
-+
 +/* LWTBL Rate field */
 +#define WTBL_RATE_TX_RATE_MASK          BITS(0, 5)
 +#define WTBL_RATE_TX_RATE_OFFSET        0
@@ -2385,10 +2380,10 @@
 +#endif
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
 new file mode 100644
-index 000000000..5aa5c94f3
+index 00000000..f04c300f
 --- /dev/null
 +++ b/mt7996/mtk_debugfs.c
-@@ -0,0 +1,2379 @@
+@@ -0,0 +1,2353 @@
 +// SPDX-License-Identifier: ISC
 +/*
 + * Copyright (C) 2023 MediaTek Inc.
@@ -2411,7 +2406,7 @@
 +	struct mt7996_dev *dev = dev_get_drvdata(s->private);
 +	u64 total_burst, total_ampdu, ampdu_cnt[16];
 +	u32 value, idx, row_idx, col_idx, start_range, agg_rang_sel[16], burst_cnt[16], band_offset = 0;
-+	u8 partial_str[16] = {}, full_str[64] = {};
++	u8 readFW = 0, partial_str[16] = {}, full_str[64] = {};
 +
 +	switch (band_idx) {
 +	case 0:
@@ -2470,46 +2465,50 @@
 +
 +	seq_printf(s, "===AMPDU Related Counters===\n");
 +
-+	value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC0_ADDR + band_offset);
-+	agg_rang_sel[0] = (value & BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_0_MASK) >> BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_0_SHFT;
-+	agg_rang_sel[1] = (value & BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_1_MASK) >> BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_1_SHFT;
-+	value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC1_ADDR + band_offset);
-+	agg_rang_sel[2] = (value & BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_2_MASK) >> BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_2_SHFT;
-+	agg_rang_sel[3] = (value & BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_3_MASK) >> BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_3_SHFT;
-+	value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC2_ADDR + band_offset);
-+	agg_rang_sel[4] = (value & BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_4_MASK) >> BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_4_SHFT;
-+	agg_rang_sel[5] = (value & BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_5_MASK) >> BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_5_SHFT;
-+	value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC3_ADDR + band_offset);
-+	agg_rang_sel[6] = (value & BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_6_MASK) >> BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_6_SHFT;
-+	agg_rang_sel[7] = (value & BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_7_MASK) >> BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_7_SHFT;
-+	value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC4_ADDR + band_offset);
-+	agg_rang_sel[8] = (value & BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_8_MASK) >> BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_8_SHFT;
-+	agg_rang_sel[9] = (value & BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_9_MASK) >> BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_9_SHFT;
-+	value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC5_ADDR + band_offset);
-+	agg_rang_sel[10] = (value & BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_10_MASK) >> BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_10_SHFT;
-+	agg_rang_sel[11] = (value & BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_11_MASK) >> BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_11_SHFT;
-+	value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC6_ADDR + band_offset);
-+	agg_rang_sel[12] = (value & BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_12_MASK) >> BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_12_SHFT;
-+	agg_rang_sel[13] = (value & BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_13_MASK) >> BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_13_SHFT;
-+	value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC7_ADDR + band_offset);
-+	agg_rang_sel[14] = (value & BN0_WF_MIB_TOP_TRARC7_AGG_RANG_SEL_14_MASK) >> BN0_WF_MIB_TOP_TRARC7_AGG_RANG_SEL_14_SHFT;
++	if (readFW) {
++		/* BELLWETHER TODO: Wait MIB counter API implement complete */
++	} else {
++		value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC0_ADDR + band_offset);
++		agg_rang_sel[0] = (value & BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_0_MASK) >> BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_0_SHFT;
++		agg_rang_sel[1] = (value & BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_1_MASK) >> BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_1_SHFT;
++		value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC1_ADDR + band_offset);
++		agg_rang_sel[2] = (value & BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_2_MASK) >> BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_2_SHFT;
++		agg_rang_sel[3] = (value & BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_3_MASK) >> BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_3_SHFT;
++		value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC2_ADDR + band_offset);
++		agg_rang_sel[4] = (value & BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_4_MASK) >> BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_4_SHFT;
++		agg_rang_sel[5] = (value & BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_5_MASK) >> BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_5_SHFT;
++		value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC3_ADDR + band_offset);
++		agg_rang_sel[6] = (value & BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_6_MASK) >> BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_6_SHFT;
++		agg_rang_sel[7] = (value & BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_7_MASK) >> BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_7_SHFT;
++		value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC4_ADDR + band_offset);
++		agg_rang_sel[8] = (value & BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_8_MASK) >> BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_8_SHFT;
++		agg_rang_sel[9] = (value & BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_9_MASK) >> BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_9_SHFT;
++		value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC5_ADDR + band_offset);
++		agg_rang_sel[10] = (value & BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_10_MASK) >> BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_10_SHFT;
++		agg_rang_sel[11] = (value & BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_11_MASK) >> BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_11_SHFT;
++		value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC6_ADDR + band_offset);
++		agg_rang_sel[12] = (value & BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_12_MASK) >> BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_12_SHFT;
++		agg_rang_sel[13] = (value & BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_13_MASK) >> BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_13_SHFT;
++		value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC7_ADDR + band_offset);
++		agg_rang_sel[14] = (value & BN0_WF_MIB_TOP_TRARC7_AGG_RANG_SEL_14_MASK) >> BN0_WF_MIB_TOP_TRARC7_AGG_RANG_SEL_14_SHFT;
 +
-+	burst_cnt[0] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR0_ADDR + band_offset);
-+	burst_cnt[1] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR1_ADDR + band_offset);
-+	burst_cnt[2] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR2_ADDR + band_offset);
-+	burst_cnt[3] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR3_ADDR + band_offset);
-+	burst_cnt[4] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR4_ADDR + band_offset);
-+	burst_cnt[5] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR5_ADDR + band_offset);
-+	burst_cnt[6] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR6_ADDR + band_offset);
-+	burst_cnt[7] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR7_ADDR + band_offset);
-+	burst_cnt[8] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR8_ADDR + band_offset);
-+	burst_cnt[9] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR9_ADDR + band_offset);
-+	burst_cnt[10] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR10_ADDR + band_offset);
-+	burst_cnt[11] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR11_ADDR + band_offset);
-+	burst_cnt[12] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR12_ADDR + band_offset);
-+	burst_cnt[13] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR13_ADDR + band_offset);
-+	burst_cnt[14] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR14_ADDR + band_offset);
-+	burst_cnt[15] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR15_ADDR + band_offset);
++		burst_cnt[0] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR0_ADDR + band_offset);
++		burst_cnt[1] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR1_ADDR + band_offset);
++		burst_cnt[2] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR2_ADDR + band_offset);
++		burst_cnt[3] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR3_ADDR + band_offset);
++		burst_cnt[4] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR4_ADDR + band_offset);
++		burst_cnt[5] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR5_ADDR + band_offset);
++		burst_cnt[6] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR6_ADDR + band_offset);
++		burst_cnt[7] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR7_ADDR + band_offset);
++		burst_cnt[8] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR8_ADDR + band_offset);
++		burst_cnt[9] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR9_ADDR + band_offset);
++		burst_cnt[10] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR10_ADDR + band_offset);
++		burst_cnt[11] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR11_ADDR + band_offset);
++		burst_cnt[12] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR12_ADDR + band_offset);
++		burst_cnt[13] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR13_ADDR + band_offset);
++		burst_cnt[14] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR14_ADDR + band_offset);
++		burst_cnt[15] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR15_ADDR + band_offset);
++	}
 +
 +	start_range = 1;
 +	total_burst = 0;
@@ -3456,8 +3455,7 @@
 +	{"PFMU_IDX",	    WF_LWTBL_PFMU_IDX_MASK,		WF_LWTBL_PFMU_IDX_SHIFT,	false},
 +	{"ULPF_IDX",	    WF_LWTBL_ULPF_IDX_MASK,		WF_LWTBL_ULPF_IDX_SHIFT,	false},
 +	{"RIBF",	    WF_LWTBL_RIBF_MASK,			NO_SHIFT_DEFINE,		false},
-+	{"ULPF",	    WF_LWTBL_ULPF_MASK,			NO_SHIFT_DEFINE,		false},
-+	{"BYPASS_TXSMM",    WF_LWTBL_BYPASS_TXSMM_MASK,         NO_SHIFT_DEFINE,		true},
++	{"ULPF",	    WF_LWTBL_ULPF_MASK,			NO_SHIFT_DEFINE,		true},
 +	{"TBF_HT",          WF_LWTBL_TBF_HT_MASK,		NO_SHIFT_DEFINE,		false},
 +	{"TBF_VHT",         WF_LWTBL_TBF_VHT_MASK,		NO_SHIFT_DEFINE,		false},
 +	{"TBF_HE",          WF_LWTBL_TBF_HE_MASK,		NO_SHIFT_DEFINE,		false},
@@ -3491,21 +3489,20 @@
 +}
 +
 +static const struct berse_wtbl_parse WTBL_LMAC_DW4[] = {
-+	{"NEGOTIATED_WINSIZE0",	WF_LWTBL_NEGOTIATED_WINSIZE0_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE0_SHIFT,    false},
-+	{"WINSIZE1",	WF_LWTBL_NEGOTIATED_WINSIZE1_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE1_SHIFT,    false},
-+	{"WINSIZE2",	WF_LWTBL_NEGOTIATED_WINSIZE2_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE2_SHIFT,    false},
-+	{"WINSIZE3",	WF_LWTBL_NEGOTIATED_WINSIZE3_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE3_SHIFT,    true},
-+	{"WINSIZE4",	WF_LWTBL_NEGOTIATED_WINSIZE4_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE4_SHIFT,    false},
-+	{"WINSIZE5",	WF_LWTBL_NEGOTIATED_WINSIZE5_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE5_SHIFT,    false},
-+	{"WINSIZE6",	WF_LWTBL_NEGOTIATED_WINSIZE6_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE6_SHIFT,    false},
-+	{"WINSIZE7",	WF_LWTBL_NEGOTIATED_WINSIZE7_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE7_SHIFT,    true},
++	{"ANT_ID_STS0",     WF_LWTBL_ANT_ID0_MASK,      WF_LWTBL_ANT_ID0_SHIFT,	false},
++	{"STS1",            WF_LWTBL_ANT_ID1_MASK,      WF_LWTBL_ANT_ID1_SHIFT,	false},
++	{"STS2",            WF_LWTBL_ANT_ID2_MASK,      WF_LWTBL_ANT_ID2_SHIFT,	false},
++	{"STS3",            WF_LWTBL_ANT_ID3_MASK,      WF_LWTBL_ANT_ID3_SHIFT,	true},
++	{"ANT_ID_STS4",     WF_LWTBL_ANT_ID4_MASK,      WF_LWTBL_ANT_ID4_SHIFT,	false},
++	{"STS5",            WF_LWTBL_ANT_ID5_MASK,      WF_LWTBL_ANT_ID5_SHIFT,	false},
++	{"STS6",            WF_LWTBL_ANT_ID6_MASK,      WF_LWTBL_ANT_ID6_SHIFT,	false},
++	{"STS7",            WF_LWTBL_ANT_ID7_MASK,      WF_LWTBL_ANT_ID7_SHIFT,	true},
 +	{"PE",              WF_LWTBL_PE_MASK,           WF_LWTBL_PE_SHIFT,	false},
 +	{"DIS_RHTR",        WF_LWTBL_DIS_RHTR_MASK,     NO_SHIFT_DEFINE,	false},
 +	{"LDPC_HT",         WF_LWTBL_LDPC_HT_MASK,      NO_SHIFT_DEFINE,	false},
 +	{"LDPC_VHT",        WF_LWTBL_LDPC_VHT_MASK,     NO_SHIFT_DEFINE,	false},
 +	{"LDPC_HE",         WF_LWTBL_LDPC_HE_MASK,      NO_SHIFT_DEFINE,	false},
 +	{"LDPC_EHT",	    WF_LWTBL_LDPC_EHT_MASK,	NO_SHIFT_DEFINE,	true},
-+	{"BA_MODE",	    WF_LWTBL_BA_MODE_MASK,	NO_SHIFT_DEFINE,	true},
 +	{NULL,}
 +};
 +
@@ -3891,12 +3888,6 @@
 +	{NULL,}
 +};
 +
-+static const struct berse_wtbl_parse WTBL_LMAC_DW14[] = {
-+	{"RATE1_TX_CNT",      WF_LWTBL_RATE1_TX_CNT_MASK,     WF_LWTBL_RATE1_TX_CNT_SHIFT,   false},
-+	{"RATE1_FAIL_CNT",    WF_LWTBL_RATE1_FAIL_CNT_MASK,   WF_LWTBL_RATE1_FAIL_CNT_SHIFT, true},
-+	{NULL,}
-+};
-+
 +static void parse_fmac_lwtbl_dw14(struct seq_file *s, u8 *lwtbl)
 +{
 +	u32 *addr, *muar_addr = 0;
@@ -3915,29 +3906,9 @@
 +		dw_value = *addr;
 +
 +		while (WTBL_LMAC_DW14_BMC[i].name) {
-+			if (WTBL_LMAC_DW14_BMC[i].shift == NO_SHIFT_DEFINE)
-+				seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW14_BMC[i].name,
-+					(dw_value & WTBL_LMAC_DW14_BMC[i].mask) ? 1 : 0);
-+			else
-+				seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW14_BMC[i].name,
-+					(dw_value & WTBL_LMAC_DW14_BMC[i].mask) >> WTBL_LMAC_DW14_BMC[i].shift);
++			parse_rate(s, i+6, (dw_value & WTBL_LMAC_DW14_BMC[i].mask) >> WTBL_LMAC_DW14_BMC[i].shift);
 +			i++;
 +		}
-+	} else {
-+		seq_printf(s, "\t\n");
-+		seq_printf(s, "LWTBL DW 14\n");
-+		addr = (u32 *)&(lwtbl[WF_LWTBL_CIPHER_SUIT_IGTK_DW*4]);
-+		dw_value = *addr;
-+
-+		while (WTBL_LMAC_DW14[i].name) {
-+			if (WTBL_LMAC_DW14[i].shift == NO_SHIFT_DEFINE)
-+				seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW14[i].name,
-+					(dw_value & WTBL_LMAC_DW14[i].mask) ? 1 : 0);
-+			else
-+				seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW14[i].name,
-+					(dw_value & WTBL_LMAC_DW14[i].mask) >> WTBL_LMAC_DW14[i].shift);
-+			i++;
-+		}
 +	}
 +}
 +
@@ -3945,7 +3916,7 @@
 +	{"RELATED_IDX0",	WF_LWTBL_RELATED_IDX0_MASK,		WF_LWTBL_RELATED_IDX0_SHIFT,	false},
 +	{"RELATED_BAND0",	WF_LWTBL_RELATED_BAND0_MASK,		WF_LWTBL_RELATED_BAND0_SHIFT,	false},
 +	{"PRI_MLD_BAND",    WF_LWTBL_PRIMARY_MLD_BAND_MASK,		WF_LWTBL_PRIMARY_MLD_BAND_SHIFT,	true},
-+	{"RELATED_IDX1",	WF_LWTBL_RELATED_IDX1_MASK,		WF_LWTBL_RELATED_IDX1_SHIFT,	false},
++	{"RELATED_IDX0",	WF_LWTBL_RELATED_IDX1_MASK,		WF_LWTBL_RELATED_IDX1_SHIFT,	false},
 +	{"RELATED_BAND1",   WF_LWTBL_RELATED_BAND1_MASK,		WF_LWTBL_RELATED_BAND1_SHIFT,	false},
 +	{"SEC_MLD_BAND",	WF_LWTBL_SECONDARY_MLD_BAND_MASK,	WF_LWTBL_SECONDARY_MLD_BAND_SHIFT,	true},
 +	{NULL,}
@@ -4051,13 +4022,18 @@
 +}
 +
 +static const struct berse_wtbl_parse WTBL_LMAC_DW31[] = {
-+	{"BFTX_TB",          WF_LWTBL_BFTX_TB_MASK,                 NO_SHIFT_DEFINE,    false},
-+	{"DROP",          WF_LWTBL_DROP_MASK,                 NO_SHIFT_DEFINE,    false},
++	{"NEGO_WINSIZE0",	WF_LWTBL_NEGOTIATED_WINSIZE0_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE0_SHIFT,    false},
++	{"WINSIZE1",	WF_LWTBL_NEGOTIATED_WINSIZE1_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE1_SHIFT,    false},
++	{"WINSIZE2",	WF_LWTBL_NEGOTIATED_WINSIZE2_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE2_SHIFT,    false},
++	{"WINSIZE3",	WF_LWTBL_NEGOTIATED_WINSIZE3_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE3_SHIFT,    true},
++	{"WINSIZE4",	WF_LWTBL_NEGOTIATED_WINSIZE4_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE4_SHIFT,    false},
++	{"WINSIZE5",	WF_LWTBL_NEGOTIATED_WINSIZE5_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE5_SHIFT,    false},
++	{"WINSIZE6",	WF_LWTBL_NEGOTIATED_WINSIZE6_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE6_SHIFT,    false},
++	{"WINSIZE7",	WF_LWTBL_NEGOTIATED_WINSIZE7_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE7_SHIFT,    true},
 +	{"CASCAD",	        WF_LWTBL_CASCAD_MASK,			NO_SHIFT_DEFINE,    false},
 +	{"ALL_ACK",	        WF_LWTBL_ALL_ACK_MASK,			NO_SHIFT_DEFINE,    false},
 +	{"MPDU_SIZE",	WF_LWTBL_MPDU_SIZE_MASK,		WF_LWTBL_MPDU_SIZE_SHIFT,  false},
-+	{"RXD_DUP_MODE",	WF_LWTBL_RXD_DUP_MODE_MASK,			WF_LWTBL_RXD_DUP_MODE_SHIFT,  true},
-+	{"ACK_EN",		WF_LWTBL_ACK_EN_MASK,			NO_SHIFT_DEFINE,		true},
++	{"BA_MODE",		WF_LWTBL_BA_MODE_MASK,			WF_LWTBL_BA_MODE_SHIFT,  true},
 +	{NULL,}
 +};
 +
@@ -4087,9 +4063,11 @@
 +
 +static const struct berse_wtbl_parse WTBL_LMAC_DW32[] = {
 +	{"OM_INFO",			WF_LWTBL_OM_INFO_MASK,			WF_LWTBL_OM_INFO_SHIFT,		false},
-+	{"OM_INFO_EHT",         WF_LWTBL_OM_INFO_EHT_MASK,         WF_LWTBL_OM_INFO_EHT_SHIFT,  false},
-+	{"RXD_DUP_FOR_OM_CHG",		WF_LWTBL_RXD_DUP_FOR_OM_CHG_MASK,	NO_SHIFT_DEFINE,		false},
++	{"OM_RXD_DUP_MODE",		WF_LWTBL_RXD_DUP_FOR_OM_CHG_MASK,	NO_SHIFT_DEFINE,		false},
 +	{"RXD_DUP_WHITE_LIST",	WF_LWTBL_RXD_DUP_WHITE_LIST_MASK,	WF_LWTBL_RXD_DUP_WHITE_LIST_SHIFT,	false},
++	{"RXD_DUP_MODE",		WF_LWTBL_RXD_DUP_MODE_MASK,		WF_LWTBL_RXD_DUP_MODE_SHIFT,	false},
++	{"DROP",			WF_LWTBL_DROP_MASK,			NO_SHIFT_DEFINE,		false},
++	{"ACK_EN",			WF_LWTBL_ACK_EN_MASK,			NO_SHIFT_DEFINE,		true},
 +	{NULL,}
 +};
 +
@@ -4234,7 +4212,7 @@
 +	{"RELATED_IDX0",	WF_UWTBL_RELATED_IDX0_MASK,		WF_UWTBL_RELATED_IDX0_SHIFT,	false},
 +	{"RELATED_BAND0",	WF_UWTBL_RELATED_BAND0_MASK,		WF_UWTBL_RELATED_BAND0_SHIFT,	false},
 +	{"PRI_MLD_BAND",    WF_UWTBL_PRIMARY_MLD_BAND_MASK,		WF_UWTBL_PRIMARY_MLD_BAND_SHIFT,	true},
-+	{"RELATED_IDX1",	WF_UWTBL_RELATED_IDX1_MASK,		WF_UWTBL_RELATED_IDX1_SHIFT,	false},
++	{"RELATED_IDX0",	WF_UWTBL_RELATED_IDX1_MASK,		WF_UWTBL_RELATED_IDX1_SHIFT,	false},
 +	{"RELATED_BAND1",   WF_UWTBL_RELATED_BAND1_MASK,		WF_UWTBL_RELATED_BAND1_SHIFT,	false},
 +	{"SEC_MLD_BAND",	WF_UWTBL_SECONDARY_MLD_BAND_MASK,	WF_UWTBL_SECONDARY_MLD_BAND_SHIFT,	true},
 +	{NULL,}
@@ -4309,7 +4287,6 @@
 +static const struct berse_wtbl_parse WTBL_UMAC_DW3[] = {
 +	{"PN4",     WTBL_PN4_MASK,      WTBL_PN4_OFFSET,	false},
 +	{"PN5",     WTBL_PN5_MASK,      WTBL_PN5_OFFSET,	true},
-+	{"COM_SN",     WF_UWTBL_COM_SN_MASK,     WF_UWTBL_COM_SN_SHIFT,	true},
 +	{NULL,}
 +};
 +
@@ -4322,8 +4299,8 @@
 +};
 +
 +static const struct berse_wtbl_parse WTBL_UMAC_DW5_BIPN[] = {
-+	{"BIPN4",	WTBL_BIPN4_MASK,	WTBL_BIPN4_OFFSET,	false},
-+	{"BIPN5",	WTBL_BIPN5_MASK,	WTBL_BIPN5_OFFSET,	true},
++	{"BIPN4",	WTBL_BIPN0_MASK,	WTBL_BIPN0_OFFSET,	false},
++	{"BIPN5",	WTBL_BIPN1_MASK,	WTBL_BIPN1_OFFSET,	true},
 +	{NULL,}
 +};
 +
@@ -4538,8 +4515,6 @@
 +
 +	/* UMAC WTBL DW 6 for BIGTK */
 +	if (is_wtbl_bigtk_exist(lwtbl) == true) {
-+		addr = (u32 *)&(uwtbl[WF_UWTBL_KEY_LOC2_DW*4]);
-+		dw_value = *addr;
 +		keyloc2 = (dw_value & WF_UWTBL_KEY_LOC2_MASK) >>
 +			WF_UWTBL_KEY_LOC2_SHIFT;
 +		seq_printf(s, "\t%s:%u\n", "Key Loc 2", keyloc2);
@@ -4583,12 +4558,6 @@
 +		i++;
 +	}
 +
-+	/* UMAC WTBL DW 8 - SEC_ADDR_MODE */
-+	addr = (u32 *)&(uwtbl[WF_UWTBL_SEC_ADDR_MODE_DW*4]);
-+	dw_value = *addr;
-+	seq_printf(s, "\t%s:%lu\n", "SEC_ADDR_MODE",
-+		(dw_value & WTBL_SEC_ADDR_MODE_MASK) >> WTBL_SEC_ADDR_MODE_OFFSET);
-+
 +	/* UMAC WTBL DW 8 - AMSDU_CFG */
 +	seq_printf(s, "\t%s:%d\n", "HW AMSDU Enable",
 +				(dw_value & WTBL_AMSDU_EN_MASK) ? 1 : 0);
@@ -4770,7 +4739,7 @@
 +#endif
 diff --git a/mt7996/mtk_mcu.c b/mt7996/mtk_mcu.c
 new file mode 100644
-index 000000000..e88701667
+index 00000000..e8870166
 --- /dev/null
 +++ b/mt7996/mtk_mcu.c
 @@ -0,0 +1,18 @@
@@ -4794,7 +4763,7 @@
 +#endif
 diff --git a/mt7996/mtk_mcu.h b/mt7996/mtk_mcu.h
 new file mode 100644
-index 000000000..e741aa278
+index 00000000..e741aa27
 --- /dev/null
 +++ b/mt7996/mtk_mcu.h
 @@ -0,0 +1,16 @@
@@ -4815,7 +4784,7 @@
 +
 +#endif
 diff --git a/tools/fwlog.c b/tools/fwlog.c
-index e5d4a1051..3c6a61d71 100644
+index e5d4a105..3c6a61d7 100644
 --- a/tools/fwlog.c
 +++ b/tools/fwlog.c
 @@ -26,7 +26,7 @@ static const char *debugfs_path(const char *phyname, const char *file)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1001-wifi-mt76-mt7996-add-check-for-hostapd-config-he_ldp.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1001-wifi-mt76-mt7996-add-check-for-hostapd-config-he_ldp.patch
deleted file mode 100644
index a7a8038..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1001-wifi-mt76-mt7996-add-check-for-hostapd-config-he_ldp.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From 9db4d791dab1d0500c13475ee704965aa0d779ab Mon Sep 17 00:00:00 2001
-From: "Allen.Ye" <allen.ye@mediatek.com>
-Date: Thu, 8 Jun 2023 17:32:33 +0800
-Subject: [PATCH 1001/1024] wifi: mt76: mt7996: add check for hostapd config
- he_ldpc
-
-Add check for hostapd config he_ldpc.
-This capabilities is checked in mcu_beacon_check_caps in 7915.
-
-Signed-off-by: Allen.Ye <allen.ye@mediatek.com>
-Change-Id: I6d6f59df8897e3c00f2e0a1e3c6e5701e31c5e4b
----
- mt7996/mcu.c | 11 ++++++++---
- 1 file changed, 8 insertions(+), 3 deletions(-)
-
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 3d6792259..867818825 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -1097,7 +1097,8 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
- }
- 
- static void
--mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
-+mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
-+		      struct ieee80211_sta *sta)
- {
- 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
- 	struct ieee80211_he_mcs_nss_supp mcs_map;
-@@ -1117,6 +1118,10 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
- 		he->he_phy_cap[i] = elem->phy_cap_info[i];
- 	}
- 
-+	if (vif->type == NL80211_IFTYPE_AP)
-+		u8p_replace_bits(&he->he_phy_cap[1], vif->bss_conf.he_ldpc,
-+				 IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD);
-+
- 	mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
- 	switch (sta->deflink.bandwidth) {
- 	case IEEE80211_STA_RX_BW_160:
-@@ -2029,7 +2034,7 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
- 	 * update sta_rec_he here.
- 	 */
- 	if (changed)
--		mt7996_mcu_sta_he_tlv(skb, sta);
-+		mt7996_mcu_sta_he_tlv(skb, vif, sta);
- 
- 	/* sta_rec_ra accommodates BW, NSS and only MCS range format
- 	 * i.e 0-{7,8,9} for VHT.
-@@ -2117,7 +2122,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
- 		/* starec amsdu */
- 		mt7996_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
- 		/* starec he */
--		mt7996_mcu_sta_he_tlv(skb, sta);
-+		mt7996_mcu_sta_he_tlv(skb, vif, sta);
- 		/* starec he 6g*/
- 		mt7996_mcu_sta_he_6g_tlv(skb, sta);
- 		/* starec eht */
--- 
-2.39.2
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1006-wifi-mt76-mt7996-add-txpower-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1001-wifi-mt76-mt7996-add-txpower-support.patch
similarity index 88%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1006-wifi-mt76-mt7996-add-txpower-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1001-wifi-mt76-mt7996-add-txpower-support.patch
index 17045c2..75fa826 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1006-wifi-mt76-mt7996-add-txpower-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1001-wifi-mt76-mt7996-add-txpower-support.patch
@@ -1,7 +1,7 @@
-From bcc8b3bec7555dfd5d1960ee9139f152af8aa9c7 Mon Sep 17 00:00:00 2001
+From b729a28ee5895d921e8df1a371e114dee7724595 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 24 Mar 2023 23:35:30 +0800
-Subject: [PATCH 1006/1024] wifi: mt76: mt7996: add txpower support
+Subject: [PATCH 1001/1015] wifi: mt76: mt7996: add txpower support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Change-Id: Ic3e7b17f3664fa7f774137572f885359fa2ec93b
@@ -13,14 +13,14 @@
  mt7996/mtk_debugfs.c | 229 +++++++++++++++++++++++++++++++++++++++++++
  mt7996/mtk_mcu.c     |  23 +++++
  mt7996/mtk_mcu.h     |  78 +++++++++++++++
- mt7996/regs.h        |  29 +++---
- 8 files changed, 429 insertions(+), 11 deletions(-)
+ mt7996/regs.h        |  17 +++-
+ 8 files changed, 423 insertions(+), 5 deletions(-)
 
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index c4d51a439..bdb81018b 100644
+index b81ed64c..be0a34ae 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -295,3 +295,37 @@ s8 mt7996_eeprom_get_power_delta(struct mt7996_dev *dev, int band)
+@@ -293,3 +293,37 @@ s8 mt7996_eeprom_get_power_delta(struct mt7996_dev *dev, int band)
  
  	return val & MT_EE_RATE_DELTA_SIGN ? delta : -delta;
  }
@@ -59,7 +59,7 @@
 +	[SKU_EHT3x996_484] = 16,
 +};
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 9ea3667f1..343e65e18 100644
+index 9ea3667f..343e65e1 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -75,4 +75,46 @@ mt7996_get_channel_group_6g(int channel)
@@ -110,10 +110,10 @@
 +
  #endif
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 3b2536601..3a1b957c4 100644
+index 549007f9..5d52b0b7 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
-@@ -830,6 +830,7 @@ struct tx_power_ctrl {
+@@ -712,6 +712,7 @@ struct tx_power_ctrl {
  		bool ate_mode_enable;
  		bool percentage_ctrl_enable;
  		bool bf_backoff_enable;
@@ -121,7 +121,7 @@
  		u8 power_drop_level;
  	};
  	u8 band_idx;
-@@ -843,6 +844,7 @@ enum {
+@@ -725,6 +726,7 @@ enum {
  	UNI_TXPOWER_BACKOFF_POWER_LIMIT_CTRL = 3,
  	UNI_TXPOWER_POWER_LIMIT_TABLE_CTRL = 4,
  	UNI_TXPOWER_ATE_MODE_CTRL = 6,
@@ -130,10 +130,10 @@
  
  enum {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 7b7dc9b33..7bd8abe79 100644
+index 6c76ec20..085307ab 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -61,6 +61,8 @@
+@@ -60,6 +60,8 @@
  
  #define MT7996_BUILD_TIME_LEN		24
  
@@ -142,7 +142,7 @@
  struct mt7996_vif;
  struct mt7996_sta;
  struct mt7996_dfs_pulse;
-@@ -511,6 +513,7 @@ int mt7996_mcu_trigger_assert(struct mt7996_dev *dev);
+@@ -563,6 +565,7 @@ int mt7996_mcu_trigger_assert(struct mt7996_dev *dev);
  void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
  void mt7996_mcu_exit(struct mt7996_dev *dev);
  int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 data);
@@ -151,10 +151,10 @@
  void mt7996_mcu_scs_sta_poll(struct work_struct *work);
  
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 5aa5c94f3..57fcbab35 100644
+index f04c300f..2aee3ab0 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -2325,6 +2325,232 @@ static int mt7996_sta_info(struct seq_file *s, void *data)
+@@ -2299,6 +2299,232 @@ static int mt7996_sta_info(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -387,7 +387,7 @@
  int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  {
  	struct mt7996_dev *dev = phy->dev;
-@@ -2367,6 +2593,9 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -2341,6 +2567,9 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  
  	debugfs_create_devm_seqfile(dev->mt76.dev, "tr_info", dir,
  				    mt7996_trinfo_read);
@@ -398,7 +398,7 @@
  	debugfs_create_devm_seqfile(dev->mt76.dev, "wtbl_info", dir,
  				    mt7996_wtbl_read);
 diff --git a/mt7996/mtk_mcu.c b/mt7996/mtk_mcu.c
-index e88701667..f772243b8 100644
+index e8870166..f772243b 100644
 --- a/mt7996/mtk_mcu.c
 +++ b/mt7996/mtk_mcu.c
 @@ -12,7 +12,30 @@
@@ -433,7 +433,7 @@
  
  #endif
 diff --git a/mt7996/mtk_mcu.h b/mt7996/mtk_mcu.h
-index e741aa278..beb1aba24 100644
+index e741aa27..1fa449ea 100644
 --- a/mt7996/mtk_mcu.h
 +++ b/mt7996/mtk_mcu.h
 @@ -10,6 +10,84 @@
@@ -454,22 +454,22 @@
 +
 +	/* power percentage info */
 +	bool percentage_ctrl_enable;
-+	s8 power_drop_level;
++	u8 power_drop_level;
 +
 +	/* frond-end loss TX info */
-+	s8 front_end_loss_tx[4];
++	u8 front_end_loss_tx[4];
 +
 +	/* frond-end loss RX info */
-+	s8 front_end_loss_rx[4];
++	u8 front_end_loss_rx[4];
 +
 +	/* thermal info */
 +	bool thermal_compensate_enable;
-+	s8 thermal_compensate_value;
++	u8 thermal_compensate_value;
 +	u8 rsv2;
 +
 +	/* TX power max/min limit info */
-+	s8 max_power_bound;
-+	s8 min_power_bound;
++	u8 max_power_bound;
++	u8 min_power_bound;
 +
 +	/* power limit info */
 +	bool sku_enable;
@@ -477,8 +477,8 @@
 +
 +	/* MU TX power info */
 +	bool mu_tx_power_manual_enable;
-+	s8 mu_tx_power_auto;
-+	s8 mu_tx_power_manual;
++	u8 mu_tx_power_auto;
++	u8 mu_tx_power_manual;
 +	u8 rsv3;
 +};
 +
@@ -522,12 +522,12 @@
  #endif
  
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index 5b7b8babb..e0b51b5df 100644
+index 3a5914c4..6ef905a9 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
-@@ -585,24 +585,31 @@ enum base_rev {
- 						 ((_wf) << 16) + (ofs))
- #define MT_WF_PHYRX_CSD_IRPI(_band, _wf)	MT_WF_PHYRX_CSD(_band, _wf, 0x1000)
+@@ -562,15 +562,22 @@ enum base_rev {
+ 
+ #define MT_PCIE1_MAC_INT_ENABLE			MT_PCIE1_MAC(0x188)
  
 -/* PHYRX CTRL */
 -#define MT_WF_PHYRX_BAND_BASE			0x83080000
@@ -537,19 +537,6 @@
 +#define MT_WF_PHY_BAND(_band, ofs)		(MT_WF_PHY_BAND_BASE + \
  						 ((_band) << 20) + (ofs))
  
--#define MT_WF_PHYRX_BAND_GID_TAB_VLD0(_band)	MT_WF_PHYRX_BAND(_band, 0x1054)
--#define MT_WF_PHYRX_BAND_GID_TAB_VLD1(_band)	MT_WF_PHYRX_BAND(_band, 0x1058)
--#define MT_WF_PHYRX_BAND_GID_TAB_POS0(_band)	MT_WF_PHYRX_BAND(_band, 0x105c)
--#define MT_WF_PHYRX_BAND_GID_TAB_POS1(_band)	MT_WF_PHYRX_BAND(_band, 0x1060)
--#define MT_WF_PHYRX_BAND_GID_TAB_POS2(_band)	MT_WF_PHYRX_BAND(_band, 0x1064)
--#define MT_WF_PHYRX_BAND_GID_TAB_POS3(_band)	MT_WF_PHYRX_BAND(_band, 0x1068)
-+#define MT_WF_PHYRX_BAND_GID_TAB_VLD0(_band)	MT_WF_PHY_BAND(_band, 0x1054)
-+#define MT_WF_PHYRX_BAND_GID_TAB_VLD1(_band)	MT_WF_PHY_BAND(_band, 0x1058)
-+#define MT_WF_PHYRX_BAND_GID_TAB_POS0(_band)	MT_WF_PHY_BAND(_band, 0x105c)
-+#define MT_WF_PHYRX_BAND_GID_TAB_POS1(_band)	MT_WF_PHY_BAND(_band, 0x1060)
-+#define MT_WF_PHYRX_BAND_GID_TAB_POS2(_band)	MT_WF_PHY_BAND(_band, 0x1064)
-+#define MT_WF_PHYRX_BAND_GID_TAB_POS3(_band)	MT_WF_PHY_BAND(_band, 0x1068)
- 
 -#define MT_WF_PHYRX_BAND_RX_CTRL1(_band)	MT_WF_PHYRX_BAND(_band, 0x2004)
 +/* PHYRX CTRL */
 +#define MT_WF_PHYRX_BAND_RX_CTRL1(_band)	MT_WF_PHY_BAND(_band, 0x2004)
@@ -562,6 +549,12 @@
 +#define MT_WF_PHY_TPC_POWER_RMAC		GENMASK(23, 16)
 +#define MT_WF_PHY_TPC_POWER_TSSI		GENMASK(31, 24)
 +
+ /* PHYRX CSD */
+ #define MT_WF_PHYRX_CSD_BASE			0x83000000
+ #define MT_WF_PHYRX_CSD(_band, _wf, ofs)	(MT_WF_PHYRX_CSD_BASE + \
+@@ -579,7 +586,7 @@ enum base_rev {
+ #define MT_WF_PHYRX_CSD_IRPI(_band, _wf)	MT_WF_PHYRX_CSD(_band, _wf, 0x1000)
+ 
  /* PHYRX CSD BAND */
 -#define MT_WF_PHYRX_CSD_BAND_RXTD12(_band)		MT_WF_PHYRX_BAND(_band, 0x8230)
 +#define MT_WF_PHYRX_CSD_BAND_RXTD12(_band)		MT_WF_PHY_BAND(_band, 0x8230)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1007-wifi-mt76-mt7996-add-mu-vendor-command-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1002-wifi-mt76-mt7996-add-mu-vendor-command-support.patch
similarity index 85%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1007-wifi-mt76-mt7996-add-mu-vendor-command-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1002-wifi-mt76-mt7996-add-mu-vendor-command-support.patch
index 2e967b5..fe75034 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1007-wifi-mt76-mt7996-add-mu-vendor-command-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1002-wifi-mt76-mt7996-add-mu-vendor-command-support.patch
@@ -1,23 +1,23 @@
-From 10d7c82abb8af232334700ded00d7ee4bb580077 Mon Sep 17 00:00:00 2001
+From 55619fa44187b6ed841f94c2bedbc4779457e3f9 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 13 Dec 2022 15:17:43 +0800
-Subject: [PATCH 1007/1024] wifi: mt76: mt7996: add mu vendor command support
+Subject: [PATCH 1002/1015] wifi: mt76: mt7996: add mu vendor command support
 
 Change-Id: I4599bd97917651aaea51d7ff186ffff73a07e4ce
 ---
  mt7996/Makefile |  3 +-
- mt7996/init.c   |  9 ++++++
- mt7996/mcu.c    | 37 ++++++++++++++++++---
+ mt7996/init.c   |  8 +++++
+ mt7996/mcu.c    | 37 +++++++++++++++++++---
  mt7996/mcu.h    | 12 +++++++
- mt7996/mt7996.h |  6 ++++
- mt7996/vendor.c | 85 +++++++++++++++++++++++++++++++++++++++++++++++++
+ mt7996/mt7996.h |  7 +++++
+ mt7996/vendor.c | 84 +++++++++++++++++++++++++++++++++++++++++++++++++
  mt7996/vendor.h | 22 +++++++++++++
- 7 files changed, 168 insertions(+), 6 deletions(-)
+ 7 files changed, 167 insertions(+), 6 deletions(-)
  create mode 100644 mt7996/vendor.c
  create mode 100644 mt7996/vendor.h
 
 diff --git a/mt7996/Makefile b/mt7996/Makefile
-index 7bb17f440..6643c7a38 100644
+index df131869..8dbbc34c 100644
 --- a/mt7996/Makefile
 +++ b/mt7996/Makefile
 @@ -1,11 +1,12 @@
@@ -33,12 +33,12 @@
 +	     debugfs.o mmio.o vendor.o
  
  mt7996e-$(CONFIG_DEV_COREDUMP) += coredump.o
- mt7996e-$(CONFIG_NL80211_TESTMODE) += testmode.o
+ 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index f76fe6ea7..5644bba4a 100644
+index 96c4bb01..1d4359f0 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -585,6 +585,10 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
+@@ -579,6 +579,10 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
  	if (ret)
  		goto error;
  
@@ -49,11 +49,10 @@
  	ret = mt76_register_phy(mphy, true, mt76_rates,
  				ARRAY_SIZE(mt76_rates));
  	if (ret)
-@@ -1088,6 +1092,11 @@ int mt7996_register_device(struct mt7996_dev *dev)
- #ifdef CONFIG_NL80211_TESTMODE
+@@ -1082,6 +1086,10 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	dev->mt76.test_ops = &mt7996_testmode_ops;
  #endif
-+
+ 
 +#ifdef CONFIG_MTK_VENDOR
 +	mt7996_vendor_register(&dev->phy);
 +#endif
@@ -62,10 +61,10 @@
  				   ARRAY_SIZE(mt76_rates));
  	if (ret)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index db3cab39c..554f40ca2 100644
+index 58893348..91f3103a 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1263,6 +1263,8 @@ static void
+@@ -1158,6 +1158,8 @@ static void
  mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
  {
@@ -74,7 +73,7 @@
  	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
  	struct sta_rec_muru *muru;
  	struct tlv *tlv;
-@@ -1274,11 +1276,14 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1169,11 +1171,14 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
  
  	muru = (struct sta_rec_muru *)tlv;
@@ -94,7 +93,7 @@
  
  	if (sta->deflink.vht_cap.vht_supported)
  		muru->mimo_dl.vht_mu_bfee =
-@@ -4477,3 +4482,25 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
+@@ -4353,3 +4358,25 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
  	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_WM_UNI_CMD(SCS),
  				 &req, sizeof(req), false);
  }
@@ -121,10 +120,10 @@
 +}
 +#endif
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 3a1b957c4..1d7748771 100644
+index 5d52b0b7..baffbcd7 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
-@@ -686,8 +686,20 @@ enum {
+@@ -568,8 +568,20 @@ enum {
  	RATE_PARAM_FIXED_MCS,
  	RATE_PARAM_FIXED_GI = 11,
  	RATE_PARAM_AUTO = 20,
@@ -146,18 +145,19 @@
  	BF_SOUNDING_ON = 1,
  	BF_HW_EN_UPDATE = 17,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 7bd8abe79..88ccb3060 100644
+index 085307ab..b9f3dd8e 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -213,6 +213,7 @@ struct mt7996_phy {
- 
- 	struct mt7996_scs_ctrl scs_ctrl;
+@@ -263,6 +263,8 @@ struct mt7996_phy {
+ 	u32 rx_ampdu_ts;
+ 	u32 ampdu_ref;
  
 +	u8 muru_onoff;
- #ifdef CONFIG_NL80211_TESTMODE
- 	struct {
- 		u32 *reg_backup;
-@@ -620,6 +621,11 @@ void mt7996_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
++
+ 	struct mib_stats mib;
+ 	struct mt76_channel_state state_ts;
+ 
+@@ -672,6 +674,11 @@ void mt7996_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			    struct ieee80211_sta *sta, struct dentry *dir);
  #endif
  
@@ -171,10 +171,10 @@
  #endif
 diff --git a/mt7996/vendor.c b/mt7996/vendor.c
 new file mode 100644
-index 000000000..b5ecbdf1d
+index 00000000..08ecc2b3
 --- /dev/null
 +++ b/mt7996/vendor.c
-@@ -0,0 +1,85 @@
+@@ -0,0 +1,84 @@
 +// SPDX-License-Identifier: ISC
 +/*
 + * Copyright (C) 2020, MediaTek Inc. All rights reserved.
@@ -185,7 +185,6 @@
 +#include "mt7996.h"
 +#include "mcu.h"
 +#include "vendor.h"
-+#include "mtk_mcu.h"
 +
 +static const struct nla_policy
 +mu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_MU_CTRL] = {
@@ -262,7 +261,7 @@
 +}
 diff --git a/mt7996/vendor.h b/mt7996/vendor.h
 new file mode 100644
-index 000000000..8ac3ba8ed
+index 00000000..8ac3ba8e
 --- /dev/null
 +++ b/mt7996/vendor.h
 @@ -0,0 +1,22 @@
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1008-wifi-mt76-mt7996-Add-air-monitor-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1003-wifi-mt76-mt7996-Add-air-monitor-support.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1008-wifi-mt76-mt7996-Add-air-monitor-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1003-wifi-mt76-mt7996-Add-air-monitor-support.patch
index e416ffa..d83c3f9 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1008-wifi-mt76-mt7996-Add-air-monitor-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1003-wifi-mt76-mt7996-Add-air-monitor-support.patch
@@ -1,7 +1,7 @@
-From 83c8cdffd598cdc0be7efab551e9d7942247cb25 Mon Sep 17 00:00:00 2001
+From 2637da59e92d101889cf3680e57f0594c6b349ec Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 26 Apr 2023 04:40:05 +0800
-Subject: [PATCH 1008/1024] wifi: mt76: mt7996: Add air monitor support
+Subject: [PATCH 1003/1015] wifi: mt76: mt7996: Add air monitor support
 
 ---
  mt76_connac_mcu.h |   1 +
@@ -13,10 +13,10 @@
  6 files changed, 445 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 25b467e5d..6d9b0df2d 100644
+index 4bb9508a..e62f17ad 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1220,6 +1220,7 @@ enum {
+@@ -1206,6 +1206,7 @@ enum {
  	MCU_UNI_CMD_REG_ACCESS = 0x0d,
  	MCU_UNI_CMD_CHIP_CONFIG = 0x0e,
  	MCU_UNI_CMD_POWER_CTRL = 0x0f,
@@ -25,10 +25,10 @@
  	MCU_UNI_CMD_SER = 0x13,
  	MCU_UNI_CMD_TWT = 0x14,
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index f00133489..6b8000303 100644
+index 05269e7f..3dc5cdae 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -650,6 +650,10 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -865,6 +865,10 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, struct sk_buff *skb)
  			if (ieee80211_has_a4(fc) && is_mesh && status->amsdu)
  				*qos &= ~IEEE80211_QOS_CTL_A_MSDU_PRESENT;
  		}
@@ -40,10 +40,10 @@
  		status->flag |= RX_FLAG_8023;
  	}
 diff --git a/mt7996/main.c b/mt7996/main.c
-index ab5693e4f..c1d4b3805 100644
+index 2ed66e6c..e5627c96 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -696,6 +696,10 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -672,6 +672,10 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	mt7996_mac_wtbl_update(dev, idx,
  			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
  
@@ -55,10 +55,10 @@
  	if (ret)
  		return ret;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 88ccb3060..2f4bbee70 100644
+index b9f3dd8e..dc44edc1 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -178,6 +178,34 @@ enum {
+@@ -235,6 +235,34 @@ enum {
  	SCS_ENABLE,
  };
  
@@ -93,7 +93,7 @@
  struct mt7996_phy {
  	struct mt76_phy *mt76;
  	struct mt7996_dev *dev;
-@@ -228,6 +256,10 @@ struct mt7996_phy {
+@@ -285,6 +313,10 @@ struct mt7996_phy {
  		u8 spe_idx;
  	} test;
  #endif
@@ -104,7 +104,7 @@
  };
  
  struct mt7996_dev {
-@@ -624,6 +656,9 @@ void mt7996_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -677,6 +709,9 @@ void mt7996_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  #ifdef CONFIG_MTK_VENDOR
  void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif);
  void mt7996_vendor_register(struct mt7996_phy *phy);
@@ -115,10 +115,10 @@
  
  #ifdef CONFIG_MTK_DEBUG
 diff --git a/mt7996/vendor.c b/mt7996/vendor.c
-index b5ecbdf1d..f3b089d72 100644
+index 08ecc2b3..8a021324 100644
 --- a/mt7996/vendor.c
 +++ b/mt7996/vendor.c
-@@ -16,6 +16,32 @@ mu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_MU_CTRL] = {
+@@ -15,6 +15,32 @@ mu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_MU_CTRL] = {
  	[MTK_VENDOR_ATTR_MU_CTRL_DUMP] = {.type = NLA_U8 },
  };
  
@@ -151,7 +151,7 @@
  static int mt7996_vendor_mu_ctrl(struct wiphy *wiphy,
  				 struct wireless_dev *wdev,
  				 const void *data,
-@@ -63,6 +89,328 @@ mt7996_vendor_mu_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
+@@ -62,6 +88,328 @@ mt7996_vendor_mu_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  	return len;
  }
  
@@ -480,7 +480,7 @@
  static const struct wiphy_vendor_command mt7996_vendor_commands[] = {
  	{
  		.info = {
-@@ -76,10 +424,24 @@ static const struct wiphy_vendor_command mt7996_vendor_commands[] = {
+@@ -75,10 +423,24 @@ static const struct wiphy_vendor_command mt7996_vendor_commands[] = {
  		.policy = mu_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_MU_CTRL_MAX,
  	},
@@ -506,7 +506,7 @@
 +	spin_lock_init(&phy->amnt_lock);
  }
 diff --git a/mt7996/vendor.h b/mt7996/vendor.h
-index 8ac3ba8ed..2078cafaf 100644
+index 8ac3ba8e..2078cafa 100644
 --- a/mt7996/vendor.h
 +++ b/mt7996/vendor.h
 @@ -4,6 +4,7 @@
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1009-wifi-mt76-mt7996-add-driver-support-for-wpa3-ocv-and.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1004-wifi-mt76-mt7996-add-driver-support-for-wpa3-ocv-and.patch
similarity index 69%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1009-wifi-mt76-mt7996-add-driver-support-for-wpa3-ocv-and.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1004-wifi-mt76-mt7996-add-driver-support-for-wpa3-ocv-and.patch
index 84d1834..50db576 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1009-wifi-mt76-mt7996-add-driver-support-for-wpa3-ocv-and.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1004-wifi-mt76-mt7996-add-driver-support-for-wpa3-ocv-and.patch
@@ -1,7 +1,7 @@
-From 953b2c0c19abfbb13e2445857b71ab4a999fe6cb Mon Sep 17 00:00:00 2001
+From 75b684d04d569b5e83780d2296bed12d3785836c Mon Sep 17 00:00:00 2001
 From: mtk23510 <rudra.shahi@mediatek.com>
 Date: Fri, 24 Mar 2023 19:18:53 +0800
-Subject: [PATCH 1009/1024] wifi: mt76: mt7996: add driver support for wpa3 ocv
+Subject: [PATCH 1004/1015] wifi: mt76: mt7996: add driver support for wpa3 ocv
  and bp mt76
 
 Signed-off-by: mtk23510 <rudra.shahi@mediatek.com>
@@ -10,12 +10,12 @@
  1 file changed, 2 insertions(+)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 5644bba4a..70af2f964 100644
+index 1d4359f0..40d610ae 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -374,6 +374,8 @@ mt7996_init_wiphy(struct ieee80211_hw *hw)
+@@ -373,6 +373,8 @@ mt7996_init_wiphy(struct ieee80211_hw *hw)
+ 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CAN_REPLACE_PTK0);
- 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER);
  
 +	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_OPERATING_CHANNEL_VALIDATION);
 +	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_PROTECTION);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1004-wifi-mt76-mt7996-add-eagle-default-bin-of-different-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1004-wifi-mt76-mt7996-add-eagle-default-bin-of-different-.patch
deleted file mode 100644
index d6b30ae..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1004-wifi-mt76-mt7996-add-eagle-default-bin-of-different-.patch
+++ /dev/null
@@ -1,108 +0,0 @@
-From 2de4c7cb583e687e644be8050ab2cd2ba7802ed3 Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Thu, 20 Jul 2023 17:27:22 +0800
-Subject: [PATCH 1004/1024] wifi: mt76: mt7996: add eagle default bin of
- different sku variants
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- mt7996/eeprom.c |  2 ++
- mt7996/init.c   |  4 ++++
- mt7996/mt7996.h | 28 ++++++++++++++++++++++++++--
- 3 files changed, 32 insertions(+), 2 deletions(-)
-
-diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index b81ed64ce..c4d51a439 100644
---- a/mt7996/eeprom.c
-+++ b/mt7996/eeprom.c
-@@ -30,6 +30,8 @@ static char *mt7996_eeprom_name(struct mt7996_dev *dev)
- 	/* reserve for future variants */
- 	if (dev->testmode_enable)
- 		return MT7996_EEPROM_DEFAULT_TM;
-+	else if (dev->chip_sku == MT7996_SKU_404)
-+		return MT7996_EEPROM_DEFAULT_404;
- 	else
- 		return MT7996_EEPROM_DEFAULT;
- }
-diff --git a/mt7996/init.c b/mt7996/init.c
-index f41e4e5eb..aebdc0df8 100644
---- a/mt7996/init.c
-+++ b/mt7996/init.c
-@@ -652,6 +652,10 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
- 
- 	INIT_WORK(&dev->init_work, mt7996_init_work);
- 
-+	ret = mt7996_get_chip_sku(dev);
-+	if (ret)
-+		return ret;
-+
- 	dev->dbdc_support = mt7996_band_valid(dev, MT_BAND1) ||
- 			    mt7996_band_valid(dev, MT_BAND2);
- 	dev->tbtc_support = mt7996_band_valid(dev, MT_BAND1) &&
-diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 18208388b..d65adac41 100644
---- a/mt7996/mt7996.h
-+++ b/mt7996/mt7996.h
-@@ -35,6 +35,7 @@
- #define MT7996_ROM_PATCH		"mediatek/mt7996/mt7996_rom_patch.bin"
- 
- #define MT7996_EEPROM_DEFAULT		"mediatek/mt7996/mt7996_eeprom.bin"
-+#define MT7996_EEPROM_DEFAULT_404	"mediatek/mt7996/mt7996_eeprom_dual_404.bin"
- #define MT7996_EEPROM_DEFAULT_TM	"mediatek/mt7996/mt7996_eeprom_tm.bin"
- #define MT7996_EEPROM_SIZE		7680
- #define MT7996_EEPROM_BLOCK_SIZE	16
-@@ -65,6 +66,11 @@ struct mt7996_sta;
- struct mt7996_dfs_pulse;
- struct mt7996_dfs_pattern;
- 
-+enum mt7996_sku_type {
-+	MT7996_SKU_404,
-+	MT7996_SKU_444,
-+};
-+
- enum mt7996_ram_type {
- 	MT7996_RAM_TYPE_WM,
- 	MT7996_RAM_TYPE_WM_TM = MT7996_RAM_TYPE_WM,
-@@ -227,6 +233,8 @@ struct mt7996_dev {
- 	struct cfg80211_chan_def rdd2_chandef;
- 	struct mt7996_phy *rdd2_phy;
- 
-+	u8 chip_sku;
-+
- 	u16 chainmask;
- 	u8 chainshift[__MT_MAX_BAND];
- 	u32 hif_idx;
-@@ -364,12 +372,28 @@ mt7996_phy3(struct mt7996_dev *dev)
- 	return __mt7996_phy(dev, MT_BAND2);
- }
- 
-+static inline int
-+mt7996_get_chip_sku(struct mt7996_dev *dev)
-+{
-+	u32 val = mt76_rr(dev, MT_PAD_GPIO);
-+
-+	/* reserve for future variants */
-+	switch (mt76_chip(&dev->mt76)) {
-+	case 0x7990:
-+		dev->chip_sku = FIELD_GET(MT_PAD_GPIO_ADIE_COMB, val) <= 1;
-+		break;
-+	default:
-+		return -EINVAL;
-+	}
-+
-+	return 0;
-+}
-+
- static inline bool
- mt7996_band_valid(struct mt7996_dev *dev, u8 band)
- {
- 	/* tri-band support */
--	if (band <= MT_BAND2 &&
--	    mt76_get_field(dev, MT_PAD_GPIO, MT_PAD_GPIO_ADIE_COMB) <= 1)
-+	if (band <= MT_BAND2 && dev->chip_sku)
- 		return true;
- 
- 	return band == MT_BAND0 || band == MT_BAND2;
--- 
-2.39.2
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1005-wifi-mt76-mt7996-add-U-NII-4-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1005-wifi-mt76-mt7996-add-U-NII-4-support.patch
new file mode 100644
index 0000000..8eaf2d5
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1005-wifi-mt76-mt7996-add-U-NII-4-support.patch
@@ -0,0 +1,25 @@
+From 09b50cf201ede70688619366c31aa2ddd57d5cb2 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Fri, 31 Mar 2023 11:26:27 +0800
+Subject: [PATCH 1005/1015] wifi: mt76: mt7996: add U-NII-4 support
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mac80211.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/mac80211.c b/mac80211.c
+index d1cdaee8..501325e9 100644
+--- a/mac80211.c
++++ b/mac80211.c
+@@ -76,6 +76,7 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
+ 	CHAN5G(165, 5825),
+ 	CHAN5G(169, 5845),
+ 	CHAN5G(173, 5865),
++	CHAN5G(177, 5885),
+ };
+ 
+ static const struct ieee80211_channel mt76_channels_6ghz[] = {
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1010-wifi-mt76-testmode-add-testmode-pre-calibration-supp.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1006-wifi-mt76-testmode-add-testmode-pre-calibration-supp.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1010-wifi-mt76-testmode-add-testmode-pre-calibration-supp.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1006-wifi-mt76-testmode-add-testmode-pre-calibration-supp.patch
index e7f7a34..e185c11 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1010-wifi-mt76-testmode-add-testmode-pre-calibration-supp.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1006-wifi-mt76-testmode-add-testmode-pre-calibration-supp.patch
@@ -1,7 +1,7 @@
-From 8cbf5b49e3ecfa038198362d6141c195d12753bd Mon Sep 17 00:00:00 2001
+From 47c64d6cac5ed78fab15cd4173ae8935605a3fca Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 31 Mar 2023 11:27:24 +0800
-Subject: [PATCH 1010/1024] wifi: mt76: testmode: add testmode pre-calibration
+Subject: [PATCH 1006/1015] wifi: mt76: testmode: add testmode pre-calibration
  support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -22,7 +22,7 @@
  12 files changed, 632 insertions(+), 23 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 5740ba061..ef4b83244 100644
+index 501325e9..6430e6ee 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -7,27 +7,6 @@
@@ -54,7 +54,7 @@
  	CHAN2G(1, 2412),
  	CHAN2G(2, 2417),
 diff --git a/mt76.h b/mt76.h
-index ad1123c4a..f58a955d6 100644
+index 31d5dc37..3341720c 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -18,6 +18,27 @@
@@ -85,7 +85,7 @@
  #define MT_MCU_RING_SIZE	32
  #define MT_RX_BUF_SIZE		2048
  #define MT_SKB_HEAD_LEN		256
-@@ -660,6 +681,7 @@ struct mt76_testmode_ops {
+@@ -654,6 +675,7 @@ struct mt76_testmode_ops {
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
  	void (*reset_rx_stats)(struct mt76_phy *phy);
  	void (*tx_stop)(struct mt76_phy *phy);
@@ -94,22 +94,20 @@
  
  #define MT_TM_FW_RX_COUNT	BIT(0)
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 6d9b0df2d..b2c22568d 100644
+index e62f17ad..262abf88 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1021,8 +1021,10 @@ enum {
+@@ -1011,6 +1011,8 @@ enum {
+ 	MCU_UNI_EVENT_IE_COUNTDOWN = 0x09,
  	MCU_UNI_EVENT_RDD_REPORT = 0x11,
- 	MCU_UNI_EVENT_ROC = 0x27,
- 	MCU_UNI_EVENT_TX_DONE = 0x2d,
-+	MCU_UNI_EVENT_BF = 0x33,
  	MCU_UNI_EVENT_THERMAL = 0x35,
- 	MCU_UNI_EVENT_NIC_CAPAB = 0x43,
++	MCU_UNI_EVENT_BF = 0x33,
 +	MCU_UNI_EVENT_TESTMODE_CTRL = 0x46,
- 	MCU_UNI_EVENT_PER_STA_INFO = 0x6d,
- 	MCU_UNI_EVENT_ALL_STA_INFO = 0x6e,
  };
+ 
+ #define MCU_UNI_CMD_EVENT			BIT(1)
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index bdb81018b..374f0e558 100644
+index be0a34ae..60e98463 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -12,6 +12,42 @@ static bool testmode_enable;
@@ -155,7 +153,7 @@
  static int mt7996_check_eeprom(struct mt7996_dev *dev)
  {
  	u8 *eeprom = dev->mt76.eeprom.data;
-@@ -36,6 +72,36 @@ static char *mt7996_eeprom_name(struct mt7996_dev *dev)
+@@ -34,6 +70,36 @@ static char *mt7996_eeprom_name(struct mt7996_dev *dev)
  		return MT7996_EEPROM_DEFAULT;
  }
  
@@ -193,7 +191,7 @@
  mt7996_eeprom_load_default(struct mt7996_dev *dev)
  {
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 343e65e18..7ff290f40 100644
+index 343e65e1..7ff290f4 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -14,6 +14,7 @@ enum mt7996_eeprom_field {
@@ -258,12 +256,12 @@
  #define MT_EE_WIFI_CONF2_TX_PATH_BAND1		GENMASK(2, 0)
  #define MT_EE_WIFI_CONF2_TX_PATH_BAND2		GENMASK(5, 3)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 554f40ca2..dd3374a99 100644
+index 91f3103a..1fb7bae1 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -623,6 +623,11 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
- 	case MCU_UNI_EVENT_ALL_STA_INFO:
- 		mt7996_mcu_rx_all_sta_info_event(dev, skb);
+@@ -523,6 +523,11 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
+ 	case MCU_UNI_EVENT_THERMAL:
+ 		mt7996_mcu_rx_thermal_notify(dev, skb);
  		break;
 +#ifdef CONFIG_NL80211_TESTMODE
 +	case MCU_UNI_EVENT_TESTMODE_CTRL:
@@ -274,10 +272,10 @@
  		break;
  	}
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 2f4bbee70..91d759ec4 100644
+index dc44edc1..9ab86eaf 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -333,6 +333,9 @@ struct mt7996_dev {
+@@ -390,6 +390,9 @@ struct mt7996_dev {
  	struct dentry *debugfs_dir;
  	struct rchan *relay_fwlog;
  
@@ -287,7 +285,7 @@
  	struct {
  		u8 table_mask;
  		u8 n_agrt;
-@@ -466,6 +469,7 @@ int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy);
+@@ -522,6 +525,7 @@ int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy);
  int mt7996_eeprom_get_target_power(struct mt7996_dev *dev,
  				   struct ieee80211_channel *chan);
  s8 mt7996_eeprom_get_power_delta(struct mt7996_dev *dev, int band);
@@ -295,7 +293,7 @@
  int mt7996_dma_init(struct mt7996_dev *dev);
  void mt7996_dma_reset(struct mt7996_dev *dev, bool force);
  void mt7996_dma_prefetch(struct mt7996_dev *dev);
-@@ -549,6 +553,9 @@ int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 da
+@@ -602,6 +606,9 @@ int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 da
  int mt7996_mcu_get_tx_power_info(struct mt7996_phy *phy, u8 category, void *event);
  int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable);
  void mt7996_mcu_scs_sta_poll(struct work_struct *work);
@@ -306,7 +304,7 @@
  static inline u8 mt7996_max_interface_num(struct mt7996_dev *dev)
  {
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index fb041c336..8ceea00b1 100644
+index 43eca4ef..7d36902e 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
 @@ -7,6 +7,8 @@
@@ -318,7 +316,7 @@
  
  enum {
  	TM_CHANGED_TXPOWER,
-@@ -396,6 +398,436 @@ mt7996_tm_set_tx_cont(struct mt7996_phy *phy, bool en)
+@@ -397,6 +399,436 @@ mt7996_tm_set_tx_cont(struct mt7996_phy *phy, bool en)
  	}
  }
  
@@ -755,7 +753,7 @@
  static void
  mt7996_tm_update_params(struct mt7996_phy *phy, u32 changed)
  {
-@@ -452,6 +884,10 @@ mt7996_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
+@@ -447,6 +879,10 @@ mt7996_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
  	else if (prev_state == MT76_TM_STATE_OFF ||
  		 state == MT76_TM_STATE_OFF)
  		mt7996_tm_init(phy, !(state == MT76_TM_STATE_OFF));
@@ -766,14 +764,14 @@
  
  	if ((state == MT76_TM_STATE_IDLE &&
  	     prev_state == MT76_TM_STATE_OFF) ||
-@@ -671,4 +1107,5 @@ const struct mt76_testmode_ops mt7996_testmode_ops = {
+@@ -655,4 +1091,5 @@ const struct mt76_testmode_ops mt7996_testmode_ops = {
  	.dump_stats = mt7996_tm_dump_stats,
  	.reset_rx_stats = mt7996_tm_reset_trx_stats,
  	.tx_stop = mt7996_tm_tx_stop,
 +	.dump_precal = mt7996_tm_dump_precal,
  };
 diff --git a/mt7996/testmode.h b/mt7996/testmode.h
-index e4d55a61a..17c1456d3 100644
+index f00e51f4..778c9bc6 100644
 --- a/mt7996/testmode.h
 +++ b/mt7996/testmode.h
 @@ -34,6 +34,12 @@ enum bw_mapping_method {
@@ -835,10 +833,10 @@
  	RF_OPER_NORMAL,
  	RF_OPER_RF_TEST,
 diff --git a/testmode.c b/testmode.c
-index bbe8230fd..e66b54ae5 100644
+index fc68c2af..74bb26fa 100644
 --- a/testmode.c
 +++ b/testmode.c
-@@ -631,6 +631,18 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+@@ -626,6 +626,18 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
  
  	mutex_lock(&dev->mutex);
  
@@ -858,10 +856,10 @@
  		err = -EINVAL;
  
 diff --git a/testmode.h b/testmode.h
-index 141bb8625..db8ff53db 100644
+index 8d0b9702..0c3b1393 100644
 --- a/testmode.h
 +++ b/testmode.h
-@@ -219,6 +219,14 @@ enum mt76_testmode_state {
+@@ -215,6 +215,14 @@ enum mt76_testmode_state {
  	MT76_TM_STATE_TX_FRAMES,
  	MT76_TM_STATE_RX_FRAMES,
  	MT76_TM_STATE_TX_CONT,
@@ -877,7 +875,7 @@
  
  	/* keep last */
 diff --git a/tools/fields.c b/tools/fields.c
-index 055f90f3c..b01227638 100644
+index e5cf7c53..b22b3fc8 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -11,6 +11,14 @@ static const char * const testmode_state[] = {
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1011-wifi-mt76-mt7996-add-binfile-mode-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1007-wifi-mt76-mt7996-add-binfile-mode-support.patch
similarity index 87%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1011-wifi-mt76-mt7996-add-binfile-mode-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1007-wifi-mt76-mt7996-add-binfile-mode-support.patch
index 26b8f02..549344f 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1011-wifi-mt76-mt7996-add-binfile-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1007-wifi-mt76-mt7996-add-binfile-mode-support.patch
@@ -1,7 +1,7 @@
-From bc410b015f16893931f9be037140642cfe38ac88 Mon Sep 17 00:00:00 2001
+From 2cf8a9517919b39318eb1e878ca69418a499126a Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 31 Mar 2023 11:36:34 +0800
-Subject: [PATCH 1011/1024] wifi: mt76: mt7996: add binfile mode support
+Subject: [PATCH 1007/1015] wifi: mt76: mt7996: add binfile mode support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -14,10 +14,10 @@
  6 files changed, 112 insertions(+), 3 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 437d8ca24..89bb91335 100644
+index aa889258..412740f0 100644
 --- a/eeprom.c
 +++ b/eeprom.c
-@@ -159,6 +159,26 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len)
+@@ -104,6 +104,26 @@ out_put_node:
  }
  EXPORT_SYMBOL_GPL(mt76_get_of_eeprom);
  
@@ -45,10 +45,10 @@
  mt76_eeprom_override(struct mt76_phy *phy)
  {
 diff --git a/mt76.h b/mt76.h
-index f58a955d6..e6604de45 100644
+index 3341720c..7d6e3241 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -911,6 +911,8 @@ struct mt76_dev {
+@@ -894,6 +894,8 @@ struct mt76_dev {
  		struct mt76_usb usb;
  		struct mt76_sdio sdio;
  	};
@@ -56,8 +56,8 @@
 +	const char *bin_file_name;
  };
  
- /* per-phy stats.  */
-@@ -1143,6 +1145,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
+ struct mt76_power_limits {
+@@ -1030,6 +1032,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
  int mt76_eeprom_init(struct mt76_dev *dev, int len);
  void mt76_eeprom_override(struct mt76_phy *phy);
  int mt76_get_of_eeprom(struct mt76_dev *dev, void *data, int offset, int len);
@@ -66,7 +66,7 @@
  struct mt76_queue *
  mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 374f0e558..4e50460be 100644
+index 60e98463..85d9e057 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -61,8 +61,11 @@ static int mt7996_check_eeprom(struct mt7996_dev *dev)
@@ -82,7 +82,7 @@
  	/* reserve for future variants */
  	if (dev->testmode_enable)
  		return MT7996_EEPROM_DEFAULT_TM;
-@@ -114,7 +117,10 @@ mt7996_eeprom_load_default(struct mt7996_dev *dev)
+@@ -112,7 +115,10 @@ mt7996_eeprom_load_default(struct mt7996_dev *dev)
  		return ret;
  
  	if (!fw || !fw->data) {
@@ -94,7 +94,7 @@
  		ret = -EINVAL;
  		goto out;
  	}
-@@ -128,18 +134,45 @@ out:
+@@ -126,18 +132,45 @@ out:
  	return ret;
  }
  
@@ -141,7 +141,7 @@
  		eeprom = dev->mt76.eeprom.data;
  		/* testmode enable priority: eeprom field > module parameter */
  		dev->testmode_enable = !mt7996_check_eeprom(dev) ? eeprom[MT_EE_TESTMODE_EN] :
-@@ -173,6 +206,7 @@ static int mt7996_eeprom_load(struct mt7996_dev *dev)
+@@ -171,6 +204,7 @@ static int mt7996_eeprom_load(struct mt7996_dev *dev)
  			if (ret < 0)
  				return ret;
  		}
@@ -149,7 +149,7 @@
  	}
  
  	return mt7996_check_eeprom(dev);
-@@ -308,6 +342,8 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
+@@ -306,6 +340,8 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
  			return ret;
  
  		dev_warn(dev->mt76.dev, "eeprom load fail, use default bin\n");
@@ -159,7 +159,7 @@
  		if (ret)
  			return ret;
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 7ff290f40..20dd87714 100644
+index 7ff290f4..20dd8771 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -99,6 +99,13 @@ enum mt7996_eeprom_band {
@@ -177,10 +177,10 @@
  mt7996_get_channel_group_5g(int channel)
  {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 91d759ec4..64e1bebf7 100644
+index 9ab86eaf..6ef6bad9 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -323,6 +323,8 @@ struct mt7996_dev {
+@@ -380,6 +380,8 @@ struct mt7996_dev {
  	bool has_eht:1;
  
  	bool testmode_enable;
@@ -189,7 +189,7 @@
  
  	bool ibf;
  	u8 fw_debug_wm;
-@@ -463,6 +465,7 @@ irqreturn_t mt7996_irq_handler(int irq, void *dev_instance);
+@@ -519,6 +521,7 @@ irqreturn_t mt7996_irq_handler(int irq, void *dev_instance);
  u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif);
  int mt7996_register_device(struct mt7996_dev *dev);
  void mt7996_unregister_device(struct mt7996_dev *dev);
@@ -198,10 +198,10 @@
  int mt7996_eeprom_check_fw_mode(struct mt7996_dev *dev);
  int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy);
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 57fcbab35..82b2785bd 100644
+index 2aee3ab0..2ab2a8a8 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -2551,6 +2551,44 @@ static const struct file_operations mt7996_txpower_sku_fops = {
+@@ -2525,6 +2525,44 @@ static const struct file_operations mt7996_txpower_sku_fops = {
  	.llseek = default_llseek,
  };
  
@@ -246,7 +246,7 @@
  int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  {
  	struct mt7996_dev *dev = phy->dev;
-@@ -2596,6 +2634,8 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -2570,6 +2608,8 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  	debugfs_create_file("txpower_level", 0600, dir, phy, &fops_txpower_level);
  	debugfs_create_file("txpower_info", 0600, dir, phy, &mt7996_txpower_info_fops);
  	debugfs_create_file("txpower_sku", 0600, dir, phy, &mt7996_txpower_sku_fops);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1012-wifi-mt76-mt7996-add-normal-mode-pre-calibration-sup.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1008-wifi-mt76-mt7996-add-normal-mode-pre-calibration-sup.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1012-wifi-mt76-mt7996-add-normal-mode-pre-calibration-sup.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1008-wifi-mt76-mt7996-add-normal-mode-pre-calibration-sup.patch
index 07f0518..6b18fb0 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1012-wifi-mt76-mt7996-add-normal-mode-pre-calibration-sup.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1008-wifi-mt76-mt7996-add-normal-mode-pre-calibration-sup.patch
@@ -1,7 +1,7 @@
-From 43266cd8b1ba9bedd0541e994435017bb1bcbec6 Mon Sep 17 00:00:00 2001
+From f3ff5d5029a0a589e797dd2536070d3a3e4e30a6 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 1 Mar 2023 12:12:51 +0800
-Subject: [PATCH 1012/1024] wifi: mt76: mt7996: add normal mode pre-calibration
+Subject: [PATCH 1008/1015] wifi: mt76: mt7996: add normal mode pre-calibration
  support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -16,22 +16,22 @@
  7 files changed, 206 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index b2c22568d..196b4921d 100644
+index 262abf88..42246fb9 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1248,6 +1248,7 @@ enum {
+@@ -1229,6 +1229,7 @@ enum {
  	MCU_UNI_CMD_VOW = 0x37,
  	MCU_UNI_CMD_FIXED_RATE_TABLE = 0x40,
  	MCU_UNI_CMD_TESTMODE_CTRL = 0x46,
 +	MCU_UNI_CMD_PRECAL_RESULT = 0x47,
  	MCU_UNI_CMD_RRO = 0x57,
  	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
- 	MCU_UNI_CMD_PER_STA_INFO = 0x6d,
+ 	MCU_UNI_CMD_ASSERT_DUMP = 0x6f,
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 4e50460be..ac8e229a8 100644
+index 85d9e057..bee4a4b5 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -332,6 +332,25 @@ int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy)
+@@ -330,6 +330,25 @@ int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy)
  	return mt7996_eeprom_parse_band_config(phy);
  }
  
@@ -57,7 +57,7 @@
  int mt7996_eeprom_init(struct mt7996_dev *dev)
  {
  	int ret;
-@@ -349,6 +368,10 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
+@@ -347,6 +366,10 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
  			return ret;
  	}
  
@@ -69,7 +69,7 @@
  	if (ret < 0)
  		return ret;
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 20dd87714..0f3f31d8f 100644
+index 20dd8771..0f3f31d8 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -25,6 +25,8 @@ enum mt7996_eeprom_field {
@@ -82,10 +82,10 @@
  
  #define MT_EE_WIFI_CONF0_TX_PATH		GENMASK(2, 0)
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 70af2f964..06e6f30f3 100644
+index 40d610ae..31695090 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -685,6 +685,12 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
+@@ -675,6 +675,12 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
  	if (ret < 0)
  		return ret;
  
@@ -99,7 +99,7 @@
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7996_WTBL_STA);
  	if (idx)
 diff --git a/mt7996/main.c b/mt7996/main.c
-index c1d4b3805..f2e2de850 100644
+index e5627c96..d40d3047 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -312,6 +312,12 @@ int mt7996_set_channel(struct mt7996_phy *phy)
@@ -116,10 +116,10 @@
  	if (ret)
  		goto out;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index dd3374a99..802b21685 100644
+index 1fb7bae1..6add77da 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3493,6 +3493,172 @@ int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num)
+@@ -3386,6 +3386,172 @@ int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num)
  	return 0;
  }
  
@@ -293,10 +293,10 @@
  {
  #define NIC_CAP	3
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 64e1bebf7..99d4659f1 100644
+index 6ef6bad9..c16bc8b4 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -554,6 +554,8 @@ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
+@@ -607,6 +607,8 @@ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
  void mt7996_mcu_exit(struct mt7996_dev *dev);
  int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 data);
  int mt7996_mcu_get_tx_power_info(struct mt7996_phy *phy, u8 category, void *event);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1009-wifi-mt76-mt7996-Beacon-protection-feature-added.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1009-wifi-mt76-mt7996-Beacon-protection-feature-added.patch
new file mode 100644
index 0000000..7ddc56f
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1009-wifi-mt76-mt7996-Beacon-protection-feature-added.patch
@@ -0,0 +1,220 @@
+From b99c942620576c63baffd687090febea5ab2973d Mon Sep 17 00:00:00 2001
+From: mtk23510 <rudra.shahi@mediatek.com>
+Date: Wed, 26 Apr 2023 20:08:10 +0800
+Subject: [PATCH 1009/1015] wifi: mt76: mt7996: Beacon protection feature added
+
+Signed-off-by: mtk23510 <rudra.shahi@mediatek.com>
+Change-Id: I0149a65f71d844fc395c2827a54f9360492d181e
+---
+ mt76_connac_mcu.h | 16 +++++++++
+ mt7996/main.c     |  4 +++
+ mt7996/mcu.c      | 86 +++++++++++++++++++++++++++++++++++++++++++++++
+ mt7996/mcu.h      | 11 ++++++
+ mt7996/mt7996.h   |  2 ++
+ 5 files changed, 119 insertions(+)
+
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 42246fb9..a53fa138 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -415,6 +415,14 @@ struct sta_rec_he_6g_capa {
+ 	u8 rsv[2];
+ } __packed;
+ 
++struct sta_rec_pn_info {
++	__le16 tag;
++	__le16 len;
++	u8 pn[6];
++	u8 tsc_type;
++	u8 rsv;
++} __packed;
++
+ struct sec_key {
+ 	u8 cipher_id;
+ 	u8 cipher_len;
+@@ -767,6 +775,7 @@ struct wtbl_raw {
+ 					 sizeof(struct sta_rec_sec) +	\
+ 					 sizeof(struct sta_rec_ra_fixed) + \
+ 					 sizeof(struct sta_rec_he_6g_capa) + \
++					 sizeof(struct sta_rec_pn_info) + \
+ 					 sizeof(struct tlv) +		\
+ 					 MT76_CONNAC_WTBL_UPDATE_MAX_SIZE)
+ 
+@@ -796,6 +805,7 @@ enum {
+ 	STA_REC_HE_6G = 0x17,
+ 	STA_REC_HE_V2 = 0x19,
+ 	STA_REC_EHT = 0x22,
++	STA_REC_PN_INFO = 0x26,
+ 	STA_REC_HDRT = 0x28,
+ 	STA_REC_HDR_TRANS = 0x2B,
+ 	STA_REC_MAX_NUM
+@@ -1077,6 +1087,11 @@ enum mcu_cipher_type {
+ 	MCU_CIPHER_GCMP_256,
+ 	MCU_CIPHER_WAPI,
+ 	MCU_CIPHER_BIP_CMAC_128,
++	MCU_CIPHER_BIP_CMAC_256,
++	MCU_CIPHER_BCN_PROT_CMAC_128,
++	MCU_CIPHER_BCN_PROT_CMAC_256,
++	MCU_CIPHER_BCN_PROT_GMAC_128,
++	MCU_CIPHER_BCN_PROT_GMAC_256,
+ };
+ 
+ enum {
+@@ -1295,6 +1310,7 @@ enum {
+ 	UNI_BSS_INFO_RATE = 11,
+ 	UNI_BSS_INFO_QBSS = 15,
+ 	UNI_BSS_INFO_SEC = 16,
++	UNI_BSS_INFO_BCN_PROT = 17,
+ 	UNI_BSS_INFO_TXCMD = 18,
+ 	UNI_BSS_INFO_UAPSD = 19,
+ 	UNI_BSS_INFO_PS = 21,
+diff --git a/mt7996/main.c b/mt7996/main.c
+index d40d3047..d3d10fab 100644
+--- a/mt7996/main.c
++++ b/mt7996/main.c
+@@ -400,6 +400,10 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ 	}
+ 
+ 	mt76_wcid_key_setup(&dev->mt76, wcid, key);
++
++	if (key->keyidx == 6 || key->keyidx == 7)
++		mt7996_mcu_bcn_prot_enable(dev, vif, key);
++
+ 	err = mt7996_mcu_add_key(&dev->mt76, vif, &msta->bip,
+ 				 key, MCU_WMWA_UNI_CMD(STA_REC_UPDATE),
+ 				 &msta->wcid, cmd);
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index 6add77da..53d2fc73 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -2133,6 +2133,92 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
+ 	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
+ }
+ 
++static int mt7996_mcu_get_pn(struct mt7996_dev *dev, struct ieee80211_vif *vif,
++			    u8 *pn)
++{
++#define TSC_TYPE_BIGTK_PN 2
++	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++	struct sta_rec_pn_info *pn_info;
++	struct sk_buff *skb, *rskb;
++	struct tlv *tlv;
++	int ret;
++
++	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, &mvif->sta.wcid);
++	if (IS_ERR(skb))
++		return PTR_ERR(skb);
++
++	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_PN_INFO, sizeof(*pn_info));
++	pn_info = (struct sta_rec_pn_info *)tlv;
++
++	pn_info->tsc_type = TSC_TYPE_BIGTK_PN;
++	ret = mt76_mcu_skb_send_and_get_msg(&dev->mt76, skb,
++				MCU_WM_UNI_CMD_QUERY(STA_REC_UPDATE), true, &rskb);
++	if (ret)
++		return ret;
++
++	skb_pull(rskb, 4);
++
++	pn_info = (struct sta_rec_pn_info *)rskb->data;
++	if (le16_to_cpu(pn_info->tag) == STA_REC_PN_INFO)
++		memcpy(pn, pn_info->pn, 6);
++
++	dev_kfree_skb(rskb);
++	return 0;
++}
++
++int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif,
++		       struct ieee80211_key_conf *key)
++{
++#define WPA_BIGTK_MAX_LEN 32
++	int len = sizeof(struct bss_req_hdr) + sizeof(struct mt7996_mcu_bcn_prot_tlv);
++	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++	int ret;
++	struct mt7996_mcu_bcn_prot_tlv *bcn_prot;
++	struct sk_buff *skb;
++	struct tlv *tlv;
++	u8 pn[6] = {0};
++
++	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76, len);
++	if (IS_ERR(skb))
++		return PTR_ERR(skb);
++
++	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BCN_PROT,
++				sizeof(*bcn_prot));
++
++	bcn_prot = (struct mt7996_mcu_bcn_prot_tlv *)tlv;
++
++	ret = mt7996_mcu_get_pn(dev, vif, pn);
++	if (ret) {
++		dev_kfree_skb(skb);
++		return ret;
++	}
++
++	switch(key->cipher){
++	case WLAN_CIPHER_SUITE_AES_CMAC:
++		bcn_prot->cipher_id = MCU_CIPHER_BCN_PROT_CMAC_128;
++		break;
++	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
++		bcn_prot->cipher_id = MCU_CIPHER_BCN_PROT_GMAC_128;
++		break;
++	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
++		bcn_prot->cipher_id = MCU_CIPHER_BCN_PROT_GMAC_256;
++		break;
++	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
++	default:
++		dev_err(dev->mt76.dev, "Not supported Bigtk Cipher\n");
++		dev_kfree_skb(skb);
++		return -EOPNOTSUPP;
++	}
++
++	pn[0]++;
++	memcpy(bcn_prot->pn, pn, 6);
++	bcn_prot->enable = 1;
++	memcpy(bcn_prot->key, key->key, WPA_BIGTK_MAX_LEN);
++	bcn_prot->key_id = key->keyidx;
++
++	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
++				   MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), true);
++}
+ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
+ 			    struct ieee80211_vif *vif, bool enable)
+ {
+diff --git a/mt7996/mcu.h b/mt7996/mcu.h
+index baffbcd7..f32ac153 100644
+--- a/mt7996/mcu.h
++++ b/mt7996/mcu.h
+@@ -262,6 +262,17 @@ struct bss_rate_tlv {
+ 	u8 __rsv2[9];
+ } __packed;
+ 
++struct mt7996_mcu_bcn_prot_tlv {
++	__le16 tag;
++	__le16 len;
++	u8 pn[6];
++	u8 enable;
++	u8 cipher_id;
++	u8 key[32];
++	u8 key_id;
++	u8 __rsv[3];
++} __packed;
++
+ struct bss_ra_tlv {
+ 	__le16 tag;
+ 	__le16 len;
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index c16bc8b4..94b62211 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -710,6 +710,8 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
+ 		       struct mt76_connac_sta_key_conf *sta_key_conf,
+ 		       struct ieee80211_key_conf *key, int mcu_cmd,
+ 		       struct mt76_wcid *wcid, enum set_key_cmd cmd);
++int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif,
++		       struct ieee80211_key_conf *key);
+ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
+ 				     struct ieee80211_vif *vif,
+ 				     struct ieee80211_sta *sta);
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1014-wifi-mt76-testmode-add-testmode-ZWDFS-verification-s.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1010-wifi-mt76-testmode-add-testmode-ZWDFS-verification-s.patch
similarity index 93%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1014-wifi-mt76-testmode-add-testmode-ZWDFS-verification-s.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1010-wifi-mt76-testmode-add-testmode-ZWDFS-verification-s.patch
index d9f4bf5..999d9ba 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1014-wifi-mt76-testmode-add-testmode-ZWDFS-verification-s.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1010-wifi-mt76-testmode-add-testmode-ZWDFS-verification-s.patch
@@ -1,7 +1,7 @@
-From f6c3798a8abc8c28a509ed11b024ada9153820eb Mon Sep 17 00:00:00 2001
+From 639385416a573ae5ce631a0323c5541dea3e406c Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 22 Mar 2023 11:19:52 +0800
-Subject: [PATCH 1014/1024] wifi: mt76: testmode: add testmode ZWDFS
+Subject: [PATCH 1010/1015] wifi: mt76: testmode: add testmode ZWDFS
  verification support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -15,10 +15,10 @@
  6 files changed, 326 insertions(+), 12 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index e6604de45..0946a3bfb 100644
+index 7d6e3241..5b442691 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -740,6 +740,14 @@ struct mt76_testmode_data {
+@@ -732,6 +732,14 @@ struct mt76_testmode_data {
  	} cfg;
  
  	u8 aid;
@@ -34,22 +34,22 @@
  
  struct mt76_vif {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index b75523ff4..e3b014889 100644
+index 94b62211..abdbb1ef 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -236,6 +236,7 @@ struct mt7996_phy {
+@@ -295,6 +295,7 @@ struct mt7996_phy {
  
- 	struct mt76_mib_stats mib;
+ 	struct mib_stats mib;
  	struct mt76_channel_state state_ts;
 +	struct delayed_work ipi_work;
  
  	bool has_aux_rx;
  
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index 8ceea00b1..c52bf41bd 100644
+index 7d36902e..ba3cd802 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
-@@ -17,6 +17,12 @@ enum {
+@@ -16,6 +16,12 @@ enum {
  	TM_CHANGED_TX_LENGTH,
  	TM_CHANGED_TX_TIME,
  	TM_CHANGED_CFG,
@@ -62,7 +62,7 @@
  
  	/* must be last */
  	NUM_TM_CHANGED
-@@ -29,20 +35,31 @@ static const u8 tm_change_map[] = {
+@@ -27,20 +33,31 @@ static const u8 tm_change_map[] = {
  	[TM_CHANGED_TX_LENGTH] = MT76_TM_ATTR_TX_LENGTH,
  	[TM_CHANGED_TX_TIME] = MT76_TM_ATTR_TX_TIME,
  	[TM_CHANGED_CFG] = MT76_TM_ATTR_CFG,
@@ -105,7 +105,7 @@
  	};
  
  	if (width >= ARRAY_SIZE(width_to_bw))
-@@ -216,6 +233,9 @@ mt7996_tm_init(struct mt7996_phy *phy, bool en)
+@@ -217,6 +234,9 @@ mt7996_tm_init(struct mt7996_phy *phy, bool en)
  
  	/* use firmware counter for RX stats */
  	phy->mt76->test.flag |= MT_TM_FW_RX_COUNT;
@@ -115,7 +115,7 @@
  }
  
  static void
-@@ -828,6 +848,204 @@ void mt7996_tm_rf_test_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -829,6 +849,204 @@ void mt7996_tm_rf_test_event(struct mt7996_dev *dev, struct sk_buff *skb)
  	}
  }
  
@@ -320,7 +320,7 @@
  static void
  mt7996_tm_update_params(struct mt7996_phy *phy, u32 changed)
  {
-@@ -858,6 +1076,14 @@ mt7996_tm_update_params(struct mt7996_phy *phy, u32 changed)
+@@ -853,6 +1071,14 @@ mt7996_tm_update_params(struct mt7996_phy *phy, u32 changed)
  
  		mt7996_tm_set(dev, func_idx, td->cfg.type);
  	}
@@ -336,7 +336,7 @@
  
  static int
 diff --git a/mt7996/testmode.h b/mt7996/testmode.h
-index 17c1456d3..57fde8c0a 100644
+index 778c9bc6..09f81d39 100644
 --- a/mt7996/testmode.h
 +++ b/mt7996/testmode.h
 @@ -27,9 +27,15 @@ enum {
@@ -355,7 +355,7 @@
  
  	NUM_BW_MAP,
  };
-@@ -310,4 +316,42 @@ struct mt7996_tm_rx_event {
+@@ -308,4 +314,42 @@ struct mt7996_tm_rx_event {
  	};
  } __packed;
  
@@ -399,10 +399,10 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index e66b54ae5..bce3a9c1a 100644
+index 74bb26fa..22d6afd4 100644
 --- a/testmode.c
 +++ b/testmode.c
-@@ -27,6 +27,13 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
+@@ -25,6 +25,13 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
  	[MT76_TM_ATTR_TX_TIME] = { .type = NLA_U32 },
  	[MT76_TM_ATTR_FREQ_OFFSET] = { .type = NLA_U32 },
  	[MT76_TM_ATTR_DRV_DATA] = { .type = NLA_NESTED },
@@ -416,7 +416,7 @@
  };
  EXPORT_SYMBOL_GPL(mt76_tm_policy);
  
-@@ -456,6 +463,9 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -451,6 +458,9 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	if (tb[MT76_TM_ATTR_TX_RATE_IDX])
  		td->tx_rate_idx = nla_get_u8(tb[MT76_TM_ATTR_TX_RATE_IDX]);
  
@@ -426,7 +426,7 @@
  	if (mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_MODE], &td->tx_rate_mode,
  			   0, MT76_TM_TX_MODE_MAX) ||
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_NSS], &td->tx_rate_nss,
-@@ -471,7 +481,14 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -466,7 +476,14 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			   &td->tx_duty_cycle, 0, 99) ||
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_POWER_CONTROL],
  			   &td->tx_power_control, 0, 1) ||
@@ -442,9 +442,9 @@
  		goto out;
  
  	if (tb[MT76_TM_ATTR_TX_LENGTH]) {
-@@ -677,6 +694,9 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+@@ -671,6 +688,9 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+ 	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_LDPC, td->tx_rate_ldpc) ||
  	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_STBC, td->tx_rate_stbc) ||
- 	    nla_put_u8(msg, MT76_TM_ATTR_SKU_EN, td->sku_en) ||
  	    nla_put_u8(msg, MT76_TM_ATTR_AID, td->aid) ||
 +	    nla_put_u8(msg, MT76_TM_ATTR_OFF_CH_SCAN_CH, td->offchan_ch) ||
 +	    nla_put_u8(msg, MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH, td->offchan_center_ch) ||
@@ -453,7 +453,7 @@
  	     nla_put_u8(msg, MT76_TM_ATTR_TX_LTF, td->tx_ltf)) ||
  	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_ANTENNA) &&
 diff --git a/tools/fields.c b/tools/fields.c
-index b01227638..77696ce7b 100644
+index b22b3fc8..55854a6f 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -35,6 +35,15 @@ static const char * const testmode_tx_mode[] = {
@@ -472,7 +472,7 @@
  static void print_enum(const struct tm_field *field, struct nlattr *attr)
  {
  	unsigned int i = nla_get_u8(attr);
-@@ -390,6 +399,12 @@ static const struct tm_field testdata_fields[NUM_MT76_TM_ATTRS] = {
+@@ -387,6 +396,12 @@ static const struct tm_field testdata_fields[NUM_MT76_TM_ATTRS] = {
  	FIELD(u8, AID, "aid"),
  	FIELD(u8, RU_ALLOC, "ru_alloc"),
  	FIELD(u8, RU_IDX, "ru_idx"),
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1015-wifi-mt76-mt7996-add-single-sku.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1011-wifi-mt76-mt7996-add-single-sku.patch
similarity index 78%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1015-wifi-mt76-mt7996-add-single-sku.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1011-wifi-mt76-mt7996-add-single-sku.patch
index 8970f81..0fcae6a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1015-wifi-mt76-mt7996-add-single-sku.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1011-wifi-mt76-mt7996-add-single-sku.patch
@@ -1,27 +1,27 @@
-From 31ab01539098f7f093da92fd1e2052b4eb4951ce Mon Sep 17 00:00:00 2001
+From 0d9ff0aa7afe37146c6015e416d9b944b4bb16f5 Mon Sep 17 00:00:00 2001
 From: "Allen.Ye" <allen.ye@mediatek.com>
-Date: Mon, 10 Jul 2023 19:56:16 +0800
-Subject: [PATCH 1015/1024] wifi: mt76: mt7996: add single sku
+Date: Tue, 18 Apr 2023 15:56:22 +0800
+Subject: [PATCH 1011/1015] wifi: mt76: mt7996: add single sku
 
 Add single sku and default enable sku.
 
 Signed-off-by: Allen.Ye <allen.ye@mediatek.com>
 ---
- eeprom.c          | 50 +++++++++++++++++++++++---
- mt76.h            |  9 +++++
+ eeprom.c          | 38 ++++++++++++++++++--
+ mt76.h            | 10 ++++++
  mt76_connac_mcu.c |  2 +-
  mt7996/init.c     |  2 ++
- mt7996/main.c     | 16 +++++++++
+ mt7996/main.c     | 15 ++++++++
  mt7996/mcu.c      | 92 +++++++++++++++++++++++++++++++++++++++++++++++
  mt7996/mcu.h      | 12 +++++++
  mt7996/mt7996.h   |  2 ++
- 8 files changed, 179 insertions(+), 6 deletions(-)
+ 8 files changed, 169 insertions(+), 4 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 89bb91335..bd662dd4d 100644
+index 412740f0..3abefb5a 100644
 --- a/eeprom.c
 +++ b/eeprom.c
-@@ -356,6 +356,7 @@ mt76_apply_multi_array_limit(s8 *pwr, size_t pwr_len, s8 pwr_num,
+@@ -301,6 +301,7 @@ mt76_apply_multi_array_limit(s8 *pwr, size_t pwr_len, s8 pwr_num,
  s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
  			      struct ieee80211_channel *chan,
  			      struct mt76_power_limits *dest,
@@ -29,19 +29,15 @@
  			      s8 target_power)
  {
  	struct mt76_dev *dev = phy->dev;
-@@ -363,16 +364,20 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
+@@ -308,16 +309,17 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
  	const __be32 *val;
  	char name[16];
  	u32 mcs_rates = dev->drv->mcs_rates;
 -	u32 ru_rates = ARRAY_SIZE(dest->ru[0]);
  	char band;
  	size_t len;
--	s8 max_power = 0;
-+	s8 max_power = -127;
-+	s8 max_power_backoff = -127;
+ 	s8 max_power = 0;
  	s8 txs_delta;
-+	int n_chains = hweight8(phy->antenna_mask);
-+	s8 target_power_combine = target_power + mt76_tx_power_nss_delta(n_chains);
  
  	if (!mcs_rates)
 -		mcs_rates = 10;
@@ -53,7 +49,7 @@
  
  	if (!IS_ENABLED(CONFIG_OF))
  		return target_power;
-@@ -420,12 +425,47 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
+@@ -365,11 +367,41 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
  				     ARRAY_SIZE(dest->mcs), val, len,
  				     target_power, txs_delta, &max_power);
  
@@ -63,66 +59,60 @@
  				     ARRAY_SIZE(dest->ru), val, len,
  				     target_power, txs_delta, &max_power);
  
--	return max_power;
-+	val = mt76_get_of_array(np, "rates-eht", &len, ARRAY_SIZE(dest->eht[0]) + 1);
-+	mt76_apply_multi_array_limit(dest->eht[0], ARRAY_SIZE(dest->eht[0]),
-+				     ARRAY_SIZE(dest->eht), val, len,
++	val = mt76_get_of_array(np, "rates-eht-ru", &len, ARRAY_SIZE(dest->eht_ru[0]) + 1);
++	mt76_apply_multi_array_limit(dest->eht_ru[0], ARRAY_SIZE(dest->eht_ru[0]),
++				     ARRAY_SIZE(dest->eht_ru), val, len,
 +				     target_power, txs_delta, &max_power);
 +
 +	if (dest_path == NULL)
 +		return max_power;
 +
-+	max_power_backoff = max_power;
-+
 +	val = mt76_get_of_array(np, "paths-cck", &len, ARRAY_SIZE(dest_path->cck));
 +	mt76_apply_array_limit(dest_path->cck, ARRAY_SIZE(dest_path->cck), val,
-+			       target_power_combine, txs_delta, &max_power_backoff);
++			       target_power, txs_delta, &max_power);
 +
 +	val = mt76_get_of_array(np, "paths-ofdm", &len, ARRAY_SIZE(dest_path->ofdm));
 +	mt76_apply_array_limit(dest_path->ofdm, ARRAY_SIZE(dest_path->ofdm), val,
-+			       target_power_combine, txs_delta, &max_power_backoff);
++			       target_power, txs_delta, &max_power);
 +
 +	val = mt76_get_of_array(np, "paths-ofdm-bf", &len, ARRAY_SIZE(dest_path->ofdm_bf));
 +	mt76_apply_array_limit(dest_path->ofdm_bf, ARRAY_SIZE(dest_path->ofdm_bf), val,
-+			       target_power_combine, txs_delta, &max_power_backoff);
++			       target_power, txs_delta, &max_power);
 +
 +	val = mt76_get_of_array(np, "paths-ru", &len, ARRAY_SIZE(dest_path->ru[0]) + 1);
 +	mt76_apply_multi_array_limit(dest_path->ru[0], ARRAY_SIZE(dest_path->ru[0]),
 +				     ARRAY_SIZE(dest_path->ru), val, len,
-+				     target_power_combine, txs_delta, &max_power_backoff);
++				     target_power, txs_delta, &max_power);
 +
 +	val = mt76_get_of_array(np, "paths-ru-bf", &len, ARRAY_SIZE(dest_path->ru_bf[0]) + 1);
 +	mt76_apply_multi_array_limit(dest_path->ru_bf[0], ARRAY_SIZE(dest_path->ru_bf[0]),
 +				     ARRAY_SIZE(dest_path->ru_bf), val, len,
-+				     target_power_combine, txs_delta, &max_power_backoff);
-+
-+	if (max_power_backoff == target_power_combine)
-+		return max_power;
++				     target_power, txs_delta, &max_power);
 +
-+	return max_power_backoff;
+ 	return max_power;
  }
  EXPORT_SYMBOL_GPL(mt76_get_rate_power_limits);
- 
 diff --git a/mt76.h b/mt76.h
-index 0946a3bfb..9f84389b7 100644
+index 5b442691..8abb6f41 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1026,6 +1026,14 @@ struct mt76_power_limits {
- 	s8 eht[16][16];
- };
- 
+@@ -911,6 +911,15 @@ struct mt76_power_limits {
+ 	s8 ofdm[8];
+ 	s8 mcs[4][10];
+ 	s8 ru[7][12];
++	s8 eht_ru[16][16];
++};
++
 +struct mt76_power_path_limits {
 +	s8 cck[5];
 +	s8 ofdm[5];
 +	s8 ofdm_bf[4];
 +	s8 ru[16][15];
 +	s8 ru_bf[16][15];
-+};
-+
+ };
+ 
  struct mt76_ethtool_worker_info {
- 	u64 *data;
- 	int idx;
-@@ -1607,6 +1615,7 @@ void mt76_set_irq_mask(struct mt76_dev *dev, u32 addr, u32 clear, u32 set);
+@@ -1493,6 +1502,7 @@ void mt76_set_irq_mask(struct mt76_dev *dev, u32 addr, u32 clear, u32 set);
  s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
  			      struct ieee80211_channel *chan,
  			      struct mt76_power_limits *dest,
@@ -131,20 +121,20 @@
  
  static inline bool mt76_queue_is_wed_rx(struct mt76_queue *q)
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 236cfea6a..214a526f0 100644
+index c24dac10..ca7b6a6f 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -2269,7 +2269,7 @@ mt76_connac_mcu_rate_txpower_band(struct mt76_phy *phy,
+@@ -2235,7 +2235,7 @@ mt76_connac_mcu_rate_txpower_band(struct mt76_phy *phy,
  			sar_power = mt76_get_sar_power(phy, &chan, reg_power);
  
- 			mt76_get_rate_power_limits(phy, &chan, limits,
+ 			mt76_get_rate_power_limits(phy, &chan, &limits,
 -						   sar_power);
 +						   NULL, sar_power);
  
  			tx_power_tlv.last_msg = ch_list[idx] == last_ch;
  			sku_tlbv.channel = ch_list[idx];
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 06e6f30f3..5d8ecf038 100644
+index 31695090..a6caf4f1 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -294,6 +294,7 @@ void mt7996_init_txpower(struct mt7996_dev *dev,
@@ -164,7 +154,7 @@
  		target_power += nss_delta;
  		target_power = DIV_ROUND_UP(target_power, 2);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index d8c8a5fac..b97483b6f 100644
+index d3d10fab..71c346cb 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -77,6 +77,15 @@ int mt7996_run(struct ieee80211_hw *hw)
@@ -183,7 +173,7 @@
  	set_bit(MT76_STATE_RUNNING, &phy->mt76->state);
  
  	ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work,
-@@ -429,6 +438,12 @@ static int mt7996_config(struct ieee80211_hw *hw, u32 changed)
+@@ -427,6 +436,12 @@ static int mt7996_config(struct ieee80211_hw *hw, u32 changed)
  		ieee80211_wake_queues(hw);
  	}
  
@@ -196,19 +186,11 @@
  	mutex_lock(&dev->mt76.mutex);
  
  	if (changed & IEEE80211_CONF_CHANGE_MONITOR) {
-@@ -1005,6 +1020,7 @@ mt7996_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
- 	mt76_set_stream_caps(phy->mt76, true);
- 	mt7996_set_stream_vht_txbf_caps(phy);
- 	mt7996_set_stream_he_eht_caps(phy);
-+	mt7996_mcu_set_txpower_sku(phy);
- 
- 	mutex_unlock(&dev->mt76.mutex);
- 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 22417e410..8260604ac 100644
+index 53d2fc73..aefbdca6 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -4716,6 +4716,98 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
+@@ -4616,6 +4616,98 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
  				 &req, sizeof(req), false);
  }
  
@@ -267,7 +249,7 @@
 +	skb_put_data(skb, &la.ru[0], sizeof(la.ru));
 +
 +	/* eht */
-+	skb_put_data(skb, &la.eht[0], sizeof(la.eht));
++	skb_put_data(skb, &la.eht_ru[0], sizeof(la.eht_ru));
 +
 +	/* padding */
 +	skb_put_zero(skb, MT7996_SKU_PATH_NUM - MT7996_SKU_RATE_NUM);
@@ -308,10 +290,10 @@
  void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  {
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 512d8543b..f6a8ee348 100644
+index f32ac153..1d2b7c58 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
-@@ -781,6 +781,18 @@ enum {
+@@ -657,6 +657,18 @@ enum {
  #define MT7996_MAX_BSS_OFFLOAD_SIZE	(MT7996_MAX_BEACON_SIZE +		\
  					 MT7996_BEACON_UPDATE_SIZE)
  
@@ -331,10 +313,10 @@
  	UNI_BAND_CONFIG_RADIO_ENABLE,
  	UNI_BAND_CONFIG_RTS_THRESHOLD = 0x08,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index e3b014889..a5f97b55b 100644
+index abdbb1ef..d15bd950 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -62,6 +62,7 @@
+@@ -61,6 +61,7 @@
  #define MT7996_BUILD_TIME_LEN		24
  
  #define MT7996_SKU_RATE_NUM		417
@@ -342,7 +324,7 @@
  
  struct mt7996_vif;
  struct mt7996_sta;
-@@ -557,6 +558,7 @@ int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 da
+@@ -610,6 +611,7 @@ int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 da
  int mt7996_mcu_get_tx_power_info(struct mt7996_phy *phy, u8 category, void *event);
  int mt7996_mcu_apply_group_cal(struct mt7996_dev *dev);
  int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1016-wifi-mt76-mt7996-add-vendor-cmd-to-get-available-col.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1012-wifi-mt76-mt7996-add-vendor-cmd-to-get-available-col.patch
similarity index 87%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1016-wifi-mt76-mt7996-add-vendor-cmd-to-get-available-col.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1012-wifi-mt76-mt7996-add-vendor-cmd-to-get-available-col.patch
index 5f40900..c5ea448 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1016-wifi-mt76-mt7996-add-vendor-cmd-to-get-available-col.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1012-wifi-mt76-mt7996-add-vendor-cmd-to-get-available-col.patch
@@ -1,7 +1,7 @@
-From 0295315c5ff56a9bb731d2186cbf85bd7100ac4c Mon Sep 17 00:00:00 2001
+From a048ff567915954ca9cc68ef94c9a7786542b5d9 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Wed, 3 May 2023 05:08:07 +0800
-Subject: [PATCH 1016/1024] wifi: mt76: mt7996: add vendor cmd to get available
+Subject: [PATCH 1012/1015] wifi: mt76: mt7996: add vendor cmd to get available
  color bitmap
 
 Add a vendor cmd to notify user space available color bitmap.
@@ -14,10 +14,10 @@
  2 files changed, 47 insertions(+)
 
 diff --git a/mt7996/vendor.c b/mt7996/vendor.c
-index f3b089d72..391015777 100644
+index 8a021324..73f613aa 100644
 --- a/mt7996/vendor.c
 +++ b/mt7996/vendor.c
-@@ -35,6 +35,11 @@ amnt_dump_policy[NUM_MTK_VENDOR_ATTRS_AMNT_DUMP] = {
+@@ -34,6 +34,11 @@ amnt_dump_policy[NUM_MTK_VENDOR_ATTRS_AMNT_DUMP] = {
  	[MTK_VENDOR_ATTR_AMNT_DUMP_RESULT] = { .type = NLA_NESTED },
  };
  
@@ -29,7 +29,7 @@
  struct mt7996_amnt_data {
  	u8 idx;
  	u8 addr[ETH_ALEN];
-@@ -410,6 +415,26 @@ mt7966_vendor_amnt_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
+@@ -409,6 +414,26 @@ mt7966_vendor_amnt_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  	return len + 1;
  }
  
@@ -56,7 +56,7 @@
  
  static const struct wiphy_vendor_command mt7996_vendor_commands[] = {
  	{
-@@ -436,6 +461,17 @@ static const struct wiphy_vendor_command mt7996_vendor_commands[] = {
+@@ -435,6 +460,17 @@ static const struct wiphy_vendor_command mt7996_vendor_commands[] = {
  		.policy = amnt_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_AMNT_CTRL_MAX,
  	},
@@ -75,7 +75,7 @@
  
  void mt7996_vendor_register(struct mt7996_phy *phy)
 diff --git a/mt7996/vendor.h b/mt7996/vendor.h
-index 2078cafaf..eec9e74a2 100644
+index 2078cafa..eec9e74a 100644
 --- a/mt7996/vendor.h
 +++ b/mt7996/vendor.h
 @@ -6,6 +6,7 @@
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1013-wifi-mt76-mt7996-Beacon-protection-feature-added.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1013-wifi-mt76-mt7996-Beacon-protection-feature-added.patch
deleted file mode 100644
index 9c6e4cb..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1013-wifi-mt76-mt7996-Beacon-protection-feature-added.patch
+++ /dev/null
@@ -1,343 +0,0 @@
-From fe8bcf023b97cb281774611d95745bd2b1c14d9c Mon Sep 17 00:00:00 2001
-From: mtk23510 <rudra.shahi@mediatek.com>
-Date: Wed, 26 Apr 2023 20:08:10 +0800
-Subject: [PATCH 1013/1024] wifi: mt76: mt7996: Beacon protection feature added
-
-Signed-off-by: mtk23510 <rudra.shahi@mediatek.com>
-Signed-off-by: Allen.Ye <allen.ye@mediatek.com>
----
- mt76_connac_mcu.h |  24 ++++++++
- mt7996/main.c     |  14 +++--
- mt7996/mcu.c      | 138 +++++++++++++++++++++++++++++++++-------------
- mt7996/mcu.h      |  17 ++++++
- mt7996/mt7996.h   |   3 +-
- 5 files changed, 153 insertions(+), 43 deletions(-)
-
-diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 196b4921d..21cae4bf4 100644
---- a/mt76_connac_mcu.h
-+++ b/mt76_connac_mcu.h
-@@ -416,6 +416,14 @@ struct sta_rec_he_6g_capa {
- 	u8 rsv[2];
- } __packed;
- 
-+struct sta_rec_pn_info {
-+	__le16 tag;
-+	__le16 len;
-+	u8 pn[6];
-+	u8 tsc_type;
-+	u8 rsv;
-+} __packed;
-+
- struct sec_key {
- 	u8 cipher_id;
- 	u8 cipher_len;
-@@ -768,6 +776,7 @@ struct wtbl_raw {
- 					 sizeof(struct sta_rec_sec) +	\
- 					 sizeof(struct sta_rec_ra_fixed) + \
- 					 sizeof(struct sta_rec_he_6g_capa) + \
-+					 sizeof(struct sta_rec_pn_info) + \
- 					 sizeof(struct tlv) +		\
- 					 MT76_CONNAC_WTBL_UPDATE_MAX_SIZE)
- 
-@@ -798,6 +807,7 @@ enum {
- 	STA_REC_HE_V2 = 0x19,
- 	STA_REC_MLD = 0x20,
- 	STA_REC_EHT = 0x22,
-+	STA_REC_PN_INFO = 0x26,
- 	STA_REC_HDRT = 0x28,
- 	STA_REC_HDR_TRANS = 0x2B,
- 	STA_REC_MAX_NUM
-@@ -1091,6 +1101,13 @@ enum mcu_cipher_type {
- 	MCU_CIPHER_GCMP_256,
- 	MCU_CIPHER_WAPI,
- 	MCU_CIPHER_BIP_CMAC_128,
-+	MCU_CIPHER_BIP_CMAC_256,
-+	MCU_CIPHER_BCN_PROT_CMAC_128,
-+	MCU_CIPHER_BCN_PROT_CMAC_256,
-+	MCU_CIPHER_BCN_PROT_GMAC_128,
-+	MCU_CIPHER_BCN_PROT_GMAC_256,
-+	MCU_CIPHER_BIP_GMAC_128,
-+	MCU_CIPHER_BIP_GMAC_256,
- };
- 
- enum {
-@@ -1316,6 +1333,7 @@ enum {
- 	UNI_BSS_INFO_RATE = 11,
- 	UNI_BSS_INFO_QBSS = 15,
- 	UNI_BSS_INFO_SEC = 16,
-+	UNI_BSS_INFO_BCN_PROT = 17,
- 	UNI_BSS_INFO_TXCMD = 18,
- 	UNI_BSS_INFO_UAPSD = 19,
- 	UNI_BSS_INFO_PS = 21,
-@@ -1776,6 +1794,12 @@ mt76_connac_mcu_get_cipher(int cipher)
- 		return MCU_CIPHER_GCMP;
- 	case WLAN_CIPHER_SUITE_GCMP_256:
- 		return MCU_CIPHER_GCMP_256;
-+	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
-+		return MCU_CIPHER_BIP_GMAC_128;
-+	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
-+		return MCU_CIPHER_BIP_GMAC_256;
-+	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
-+		return MCU_CIPHER_BIP_CMAC_256;
- 	case WLAN_CIPHER_SUITE_SMS4:
- 		return MCU_CIPHER_WAPI;
- 	default:
-diff --git a/mt7996/main.c b/mt7996/main.c
-index f2e2de850..d8c8a5fac 100644
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -368,8 +368,10 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
- 	/* fall back to sw encryption for unsupported ciphers */
- 	switch (key->cipher) {
- 	case WLAN_CIPHER_SUITE_AES_CMAC:
--		wcid_keyidx = &wcid->hw_key_idx2;
- 		key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIE;
-+	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
-+	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
-+		wcid_keyidx = &wcid->hw_key_idx2;
- 		break;
- 	case WLAN_CIPHER_SUITE_TKIP:
- 	case WLAN_CIPHER_SUITE_CCMP:
-@@ -400,9 +402,13 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
- 	}
- 
- 	mt76_wcid_key_setup(&dev->mt76, wcid, key);
--	err = mt7996_mcu_add_key(&dev->mt76, vif, &msta->bip,
--				 key, MCU_WMWA_UNI_CMD(STA_REC_UPDATE),
--				 &msta->wcid, cmd);
-+
-+	if (key->keyidx == 6 || key->keyidx == 7)
-+		err = mt7996_mcu_bcn_prot_enable(dev, vif, key);
-+	else
-+		err = mt7996_mcu_add_key(&dev->mt76, vif, key,
-+					 MCU_WMWA_UNI_CMD(STA_REC_UPDATE),
-+					 &msta->wcid, cmd);
- out:
- 	mutex_unlock(&dev->mt76.mutex);
- 
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 802b21685..22417e410 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -2155,7 +2155,6 @@ out:
- 
- static int
- mt7996_mcu_sta_key_tlv(struct mt76_wcid *wcid,
--		       struct mt76_connac_sta_key_conf *sta_key_conf,
- 		       struct sk_buff *skb,
- 		       struct ieee80211_key_conf *key,
- 		       enum set_key_cmd cmd)
-@@ -2176,43 +2175,22 @@ mt7996_mcu_sta_key_tlv(struct mt76_wcid *wcid,
- 			return -EOPNOTSUPP;
- 
- 		sec_key = &sec->key[0];
-+		sec_key->wlan_idx = cpu_to_le16(wcid->idx);
-+		sec_key->mgmt_prot = 0;
-+		sec_key->cipher_id = cipher;
- 		sec_key->cipher_len = sizeof(*sec_key);
--
--		if (cipher == MCU_CIPHER_BIP_CMAC_128) {
--			sec_key->wlan_idx = cpu_to_le16(wcid->idx);
--			sec_key->cipher_id = MCU_CIPHER_AES_CCMP;
--			sec_key->key_id = sta_key_conf->keyidx;
--			sec_key->key_len = 16;
--			memcpy(sec_key->key, sta_key_conf->key, 16);
--
--			sec_key = &sec->key[1];
--			sec_key->wlan_idx = cpu_to_le16(wcid->idx);
--			sec_key->cipher_id = MCU_CIPHER_BIP_CMAC_128;
--			sec_key->cipher_len = sizeof(*sec_key);
--			sec_key->key_len = 16;
--			memcpy(sec_key->key, key->key, 16);
--			sec->n_cipher = 2;
--		} else {
--			sec_key->wlan_idx = cpu_to_le16(wcid->idx);
--			sec_key->cipher_id = cipher;
--			sec_key->key_id = key->keyidx;
--			sec_key->key_len = key->keylen;
--			memcpy(sec_key->key, key->key, key->keylen);
--
--			if (cipher == MCU_CIPHER_TKIP) {
--				/* Rx/Tx MIC keys are swapped */
--				memcpy(sec_key->key + 16, key->key + 24, 8);
--				memcpy(sec_key->key + 24, key->key + 16, 8);
--			}
--
--			/* store key_conf for BIP batch update */
--			if (cipher == MCU_CIPHER_AES_CCMP) {
--				memcpy(sta_key_conf->key, key->key, key->keylen);
--				sta_key_conf->keyidx = key->keyidx;
--			}
--
--			sec->n_cipher = 1;
-+		sec_key->key_id = key->keyidx;
-+		sec_key->key_len = key->keylen;
-+		sec_key->need_resp = 0;
-+		memcpy(sec_key->key, key->key, key->keylen);
-+
-+		if (cipher == MCU_CIPHER_TKIP) {
-+			/* Rx/Tx MIC keys are swapped */
-+			memcpy(sec_key->key + 16, key->key + 24, 8);
-+			memcpy(sec_key->key + 24, key->key + 16, 8);
- 		}
-+
-+		sec->n_cipher = 1;
- 	} else {
- 		sec->n_cipher = 0;
- 	}
-@@ -2221,7 +2199,6 @@ mt7996_mcu_sta_key_tlv(struct mt76_wcid *wcid,
- }
- 
- int mt7996_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
--		       struct mt76_connac_sta_key_conf *sta_key_conf,
- 		       struct ieee80211_key_conf *key, int mcu_cmd,
- 		       struct mt76_wcid *wcid, enum set_key_cmd cmd)
- {
-@@ -2234,13 +2211,98 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
- 	if (IS_ERR(skb))
- 		return PTR_ERR(skb);
- 
--	ret = mt7996_mcu_sta_key_tlv(wcid, sta_key_conf, skb, key, cmd);
-+	ret = mt7996_mcu_sta_key_tlv(wcid, skb, key, cmd);
- 	if (ret)
- 		return ret;
- 
- 	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
- }
- 
-+static int mt7996_mcu_get_pn(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-+			    u8 *pn)
-+{
-+#define TSC_TYPE_BIGTK_PN 2
-+	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
-+	struct sta_rec_pn_info *pn_info;
-+	struct sk_buff *skb, *rskb;
-+	struct tlv *tlv;
-+	int ret;
-+
-+	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, &mvif->sta.wcid);
-+	if (IS_ERR(skb))
-+		return PTR_ERR(skb);
-+
-+	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_PN_INFO, sizeof(*pn_info));
-+	pn_info = (struct sta_rec_pn_info *)tlv;
-+
-+	pn_info->tsc_type = TSC_TYPE_BIGTK_PN;
-+	ret = mt76_mcu_skb_send_and_get_msg(&dev->mt76, skb,
-+				MCU_WM_UNI_CMD_QUERY(STA_REC_UPDATE), true, &rskb);
-+	if (ret)
-+		return ret;
-+
-+	skb_pull(rskb, 4);
-+
-+	pn_info = (struct sta_rec_pn_info *)rskb->data;
-+	if (le16_to_cpu(pn_info->tag) == STA_REC_PN_INFO)
-+		memcpy(pn, pn_info->pn, 6);
-+
-+	dev_kfree_skb(rskb);
-+	return 0;
-+}
-+
-+int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-+		       struct ieee80211_key_conf *key)
-+{
-+	int len = sizeof(struct bss_req_hdr) + sizeof(struct mt7996_mcu_bcn_prot_tlv);
-+	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
-+	int ret;
-+	struct mt7996_mcu_bcn_prot_tlv *bcn_prot;
-+	struct sk_buff *skb;
-+	struct tlv *tlv;
-+	u8 pn[6] = {0};
-+
-+	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76, len);
-+	if (IS_ERR(skb))
-+		return PTR_ERR(skb);
-+
-+	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BCN_PROT,
-+				sizeof(*bcn_prot));
-+
-+	bcn_prot = (struct mt7996_mcu_bcn_prot_tlv *)tlv;
-+
-+	ret = mt7996_mcu_get_pn(dev, vif, pn);
-+	if (ret) {
-+		dev_kfree_skb(skb);
-+		return ret;
-+	}
-+
-+	switch (key->cipher) {
-+	case WLAN_CIPHER_SUITE_AES_CMAC:
-+		bcn_prot->cipher_id = MCU_CIPHER_BCN_PROT_CMAC_128;
-+		break;
-+	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
-+		bcn_prot->cipher_id = MCU_CIPHER_BCN_PROT_GMAC_128;
-+		break;
-+	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
-+		bcn_prot->cipher_id = MCU_CIPHER_BCN_PROT_GMAC_256;
-+		break;
-+	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
-+	default:
-+		dev_err(dev->mt76.dev, "Not supported Bigtk Cipher\n");
-+		dev_kfree_skb(skb);
-+		return -EOPNOTSUPP;
-+	}
-+
-+	pn[0]++;
-+	memcpy(bcn_prot->pn, pn, 6);
-+	bcn_prot->enable = BP_SW_MODE;
-+	memcpy(bcn_prot->key, key->key, WLAN_MAX_KEY_LEN);
-+	bcn_prot->key_id = key->keyidx;
-+
-+	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
-+				   MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), true);
-+}
- int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
- 			    struct ieee80211_vif *vif, bool enable)
- {
-diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 1d7748771..512d8543b 100644
---- a/mt7996/mcu.h
-+++ b/mt7996/mcu.h
-@@ -313,6 +313,23 @@ struct bss_rate_tlv {
- 	u8 __rsv2[9];
- } __packed;
- 
-+enum {
-+	BP_DISABLE,
-+	BP_SW_MODE,
-+	BP_HW_MODE,
-+};
-+
-+struct mt7996_mcu_bcn_prot_tlv {
-+	__le16 tag;
-+	__le16 len;
-+	u8 pn[6];
-+	u8 enable;
-+	u8 cipher_id;
-+	u8 key[WLAN_MAX_KEY_LEN];
-+	u8 key_id;
-+	u8 __rsv[3];
-+} __packed;
-+
- struct bss_ra_tlv {
- 	__le16 tag;
- 	__le16 len;
-diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 99d4659f1..b75523ff4 100644
---- a/mt7996/mt7996.h
-+++ b/mt7996/mt7996.h
-@@ -654,9 +654,10 @@ int mt7996_init_debugfs(struct mt7996_phy *phy);
- void mt7996_debugfs_rx_fw_monitor(struct mt7996_dev *dev, const void *data, int len);
- bool mt7996_debugfs_rx_log(struct mt7996_dev *dev, const void *data, int len);
- int mt7996_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
--		       struct mt76_connac_sta_key_conf *sta_key_conf,
- 		       struct ieee80211_key_conf *key, int mcu_cmd,
- 		       struct mt76_wcid *wcid, enum set_key_cmd cmd);
-+int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-+		       struct ieee80211_key_conf *key);
- int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
- 				     struct ieee80211_vif *vif,
- 				     struct ieee80211_sta *sta);
--- 
-2.39.2
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1013-wifi-mt76-mt7996-get-tx_retries-and-tx_fails-from-tx.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1013-wifi-mt76-mt7996-get-tx_retries-and-tx_fails-from-tx.patch
new file mode 100644
index 0000000..c01b398
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1013-wifi-mt76-mt7996-get-tx_retries-and-tx_fails-from-tx.patch
@@ -0,0 +1,109 @@
+From 3a58791cef81709963d654d520fab9f1b7987e7b Mon Sep 17 00:00:00 2001
+From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
+Date: Thu, 11 May 2023 09:14:28 +0800
+Subject: [PATCH 1013/1015] wifi: mt76: mt7996: get tx_retries and tx_fails
+ from txfree
+
+Signed-off-by: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
+---
+ mt7996/mac.c  | 20 +++++++++++++++-----
+ mt7996/mac.h  |  6 ++++--
+ mt7996/main.c |  6 ++++++
+ 3 files changed, 25 insertions(+), 7 deletions(-)
+
+diff --git a/mt7996/mac.c b/mt7996/mac.c
+index 3dc5cdae..bee4a8ae 100644
+--- a/mt7996/mac.c
++++ b/mt7996/mac.c
+@@ -1240,6 +1240,7 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+ 	struct mt76_phy *phy3 = mdev->phys[MT_BAND2];
+ 	struct mt76_txwi_cache *txwi;
+ 	struct ieee80211_sta *sta = NULL;
++	struct mt76_wcid *wcid;
+ 	LIST_HEAD(free_list);
+ 	struct sk_buff *skb, *tmp;
+ 	void *end = data + len;
+@@ -1258,7 +1259,7 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+ 		mt76_queue_tx_cleanup(dev, phy3->q_tx[MT_TXQ_BE], false);
+ 	}
+ 
+-	if (WARN_ON_ONCE(le32_get_bits(tx_free[1], MT_TXFREE1_VER) < 4))
++	if (WARN_ON_ONCE(le32_get_bits(tx_free[1], MT_TXFREE1_VER) < 5))
+ 		return;
+ 
+ 	total = le32_get_bits(tx_free[0], MT_TXFREE0_MSDU_CNT);
+@@ -1274,10 +1275,9 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+ 		info = le32_to_cpu(*cur_info);
+ 		if (info & MT_TXFREE_INFO_PAIR) {
+ 			struct mt7996_sta *msta;
+-			struct mt76_wcid *wcid;
+ 			u16 idx;
+ 
+-			idx = FIELD_GET(MT_TXFREE_INFO_WLAN_ID, info);
++			idx = FIELD_GET(MT_TXFREE_INFO_MLD_ID, info);
+ 			wcid = rcu_dereference(dev->mt76.wcid[idx]);
+ 			sta = wcid_to_sta(wcid);
+ 			if (!sta)
+@@ -1289,10 +1289,20 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+ 				list_add_tail(&msta->poll_list, &dev->sta_poll_list);
+ 			spin_unlock_bh(&dev->sta_poll_lock);
+ 			continue;
+-		}
++		} else if (info & MT_TXFREE_INFO_HEADER) {
++			if (!mtk_wed_device_active(&mdev->mmio.wed) && wcid) {
++				u32 tx_retries = 0, tx_failed = 0;
++
++				tx_retries =
++					FIELD_GET(MT_TXFREE_INFO_TX_COUNT, info) - 1;
++				tx_failed = tx_retries +
++					!!FIELD_GET(MT_TXFREE_INFO_STAT, info);
+ 
+-		if (info & MT_TXFREE_INFO_HEADER)
++				wcid->stats.tx_retries += tx_retries;
++				wcid->stats.tx_failed += tx_failed;
++			}
+ 			continue;
++		}
+ 
+ 		for (i = 0; i < 2; i++) {
+ 			msdu = (info >> (15 * i)) & MT_TXFREE_INFO_MSDU_ID;
+diff --git a/mt7996/mac.h b/mt7996/mac.h
+index bc4e6c55..74ad1e81 100644
+--- a/mt7996/mac.h
++++ b/mt7996/mac.h
+@@ -256,11 +256,13 @@ enum tx_mgnt_type {
+ #define MT_TXFREE0_MSDU_CNT		GENMASK(25, 16)
+ #define MT_TXFREE0_RX_BYTE		GENMASK(15, 0)
+ 
+-#define MT_TXFREE1_VER			GENMASK(18, 16)
++#define MT_TXFREE1_VER			GENMASK(19, 16)
+ 
+ #define MT_TXFREE_INFO_PAIR		BIT(31)
+ #define MT_TXFREE_INFO_HEADER		BIT(30)
+-#define MT_TXFREE_INFO_WLAN_ID		GENMASK(23, 12)
++#define MT_TXFREE_INFO_TX_COUNT		GENMASK(27, 24)
++#define MT_TXFREE_INFO_STAT		GENMASK(29, 28)
++#define MT_TXFREE_INFO_MLD_ID		GENMASK(23, 12)
+ #define MT_TXFREE_INFO_MSDU_ID		GENMASK(14, 0)
+ 
+ #define MT_TXS0_BW			GENMASK(31, 29)
+diff --git a/mt7996/main.c b/mt7996/main.c
+index 71c346cb..f0bdec6b 100644
+--- a/mt7996/main.c
++++ b/mt7996/main.c
+@@ -1024,6 +1024,12 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
+ 	sinfo->txrate.flags = txrate->flags;
+ 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
+ 
++	sinfo->tx_failed = msta->wcid.stats.tx_failed;
++	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
++
++	sinfo->tx_retries = msta->wcid.stats.tx_retries;
++	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
++
+ 	sinfo->ack_signal = (s8)msta->ack_signal;
+ 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_ACK_SIGNAL);
+ 
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1017-wifi-mt76-mt7996-add-debugfs-for-fw-coredump.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1014-wifi-mt76-mt7996-add-debugfs-for-fw-coredump.patch
similarity index 88%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1017-wifi-mt76-mt7996-add-debugfs-for-fw-coredump.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1014-wifi-mt76-mt7996-add-debugfs-for-fw-coredump.patch
index 6786b59..1b22e9a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1017-wifi-mt76-mt7996-add-debugfs-for-fw-coredump.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1014-wifi-mt76-mt7996-add-debugfs-for-fw-coredump.patch
@@ -1,7 +1,7 @@
-From 5b806ed8a6d74c27ff9752af8a2a92ce2d141427 Mon Sep 17 00:00:00 2001
+From 97144fb0d20ba67ec6c3a022ed5a39bc95ed40e9 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Fri, 19 May 2023 14:56:07 +0800
-Subject: [PATCH 1017/1024] wifi: mt76: mt7996: add debugfs for fw coredump.
+Subject: [PATCH 1014/1015] wifi: mt76: mt7996: add debugfs for fw coredump.
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
@@ -12,7 +12,7 @@
  4 files changed, 56 insertions(+), 5 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 92aa1644f..2c1183723 100644
+index 8a513f46..49c815a5 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -84,6 +84,8 @@ mt7996_sys_recovery_set(struct file *file, const char __user *user_buf,
@@ -64,10 +64,10 @@
  	desc += scnprintf(buff + desc, bufsz - desc,
  			  "\nlet's dump firmware SER statistics...\n");
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 6b8000303..6e79be8de 100644
+index bee4a8ae..993b43ce 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1961,15 +1961,36 @@ void mt7996_mac_dump_work(struct work_struct *work)
+@@ -2157,15 +2157,36 @@ void mt7996_mac_dump_work(struct work_struct *work)
  	struct mt7996_dev *dev;
  
  	dev = container_of(work, struct mt7996_dev, dump_work);
@@ -106,8 +106,8 @@
 +
  void mt7996_reset(struct mt7996_dev *dev)
  {
- 	if (!dev->recovery.hw_init_done)
-@@ -1987,6 +2008,7 @@ void mt7996_reset(struct mt7996_dev *dev)
+ 	dev_info(dev->mt76.dev, "%s SER recovery state: 0x%08x\n",
+@@ -2187,6 +2208,7 @@ void mt7996_reset(struct mt7996_dev *dev)
  
  		mt7996_irq_disable(dev, MT_INT_MCU_CMD);
  		queue_work(dev->mt76.wq, &dev->dump_work);
@@ -116,10 +116,10 @@
  	}
  
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index f6a8ee348..1b1f605d1 100644
+index 1d2b7c58..a0cbf922 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
-@@ -904,7 +904,11 @@ enum {
+@@ -780,7 +780,11 @@ enum {
  	UNI_CMD_SER_SET_RECOVER_L3_BF,
  	UNI_CMD_SER_SET_RECOVER_L4_MDP,
  	UNI_CMD_SER_SET_RECOVER_FULL,
@@ -132,10 +132,10 @@
  	UNI_CMD_SER_ENABLE = 1,
  	UNI_CMD_SER_SET,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index a5f97b55b..43154e542 100644
+index d15bd950..e371964b 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -82,6 +82,14 @@ enum mt7996_ram_type {
+@@ -76,6 +76,14 @@ enum mt7996_ram_type {
  	__MT7996_RAM_TYPE_MAX,
  };
  
@@ -150,7 +150,7 @@
  enum mt7996_txq_id {
  	MT7996_TXQ_FWDL = 16,
  	MT7996_TXQ_MCU_WM,
-@@ -306,6 +314,7 @@ struct mt7996_dev {
+@@ -361,6 +369,7 @@ struct mt7996_dev {
  
  	/* protects coredump data */
  	struct mutex dump_mutex;
@@ -158,7 +158,7 @@
  #ifdef CONFIG_DEV_COREDUMP
  	struct {
  		struct mt7996_crash_data *crash_data[__MT7996_RAM_TYPE_MAX];
-@@ -484,6 +493,7 @@ void mt7996_init_txpower(struct mt7996_dev *dev,
+@@ -540,6 +549,7 @@ void mt7996_init_txpower(struct mt7996_dev *dev,
  			 struct ieee80211_supported_band *sband);
  int mt7996_txbf_init(struct mt7996_dev *dev);
  void mt7996_reset(struct mt7996_dev *dev);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1018-wifi-mt76-mt7996-add-support-for-runtime-set-in-band.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1015-wifi-mt76-mt7996-add-support-for-runtime-set-in-band.patch
similarity index 82%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1018-wifi-mt76-mt7996-add-support-for-runtime-set-in-band.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1015-wifi-mt76-mt7996-add-support-for-runtime-set-in-band.patch
index e0ed32b..33432ff 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1018-wifi-mt76-mt7996-add-support-for-runtime-set-in-band.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1015-wifi-mt76-mt7996-add-support-for-runtime-set-in-band.patch
@@ -1,7 +1,7 @@
-From 84cb12629e944fdc2731efc4944c0fcd8c233087 Mon Sep 17 00:00:00 2001
+From 0d4c8fc47472e0acb7f823f483bc8b83c8a9f235 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 6 Jun 2023 16:57:10 +0800
-Subject: [PATCH 1018/1024] wifi: mt76: mt7996: add support for runtime set
+Subject: [PATCH 1015/1015] wifi: mt76: mt7996: add support for runtime set
  in-band discovery
 
 with this patch, AP can runtime set inband discovery via hostapd_cli
@@ -17,10 +17,10 @@
  1 file changed, 2 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 8260604ac..7c40b8bb6 100644
+index aefbdca6..59f22f6d 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2521,8 +2521,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
+@@ -2438,8 +2438,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
  	if (IS_ERR(rskb))
  		return PTR_ERR(rskb);
  
@@ -30,7 +30,7 @@
  		interval = vif->bss_conf.fils_discovery.max_interval;
  		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
  	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
-@@ -2558,7 +2557,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
+@@ -2475,7 +2474,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
  	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
  	discov->tx_interval = interval;
  	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1019-wifi-mt76-mt7996-add-vendor-subcmd-EDCCA-ctrl-enable.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1019-wifi-mt76-mt7996-add-vendor-subcmd-EDCCA-ctrl-enable.patch
deleted file mode 100644
index b013595..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1019-wifi-mt76-mt7996-add-vendor-subcmd-EDCCA-ctrl-enable.patch
+++ /dev/null
@@ -1,393 +0,0 @@
-From d94e9301ccfd6ffd35ead052ebaa89afaefb9a88 Mon Sep 17 00:00:00 2001
-From: mtk27745 <rex.lu@mediatek.com>
-Date: Thu, 8 Jun 2023 20:21:04 +0800
-Subject: [PATCH 1019/1024] wifi: mt76: mt7996: add vendor subcmd EDCCA ctrl
- enable
-
----
- mt7996/main.c    |   3 ++
- mt7996/mcu.h     |   2 +
- mt7996/mt7996.h  |  11 ++++
- mt7996/mtk_mcu.c |  86 ++++++++++++++++++++++++++++++
- mt7996/mtk_mcu.h |  15 ++++++
- mt7996/vendor.c  | 132 +++++++++++++++++++++++++++++++++++++++++++++++
- mt7996/vendor.h  |  33 ++++++++++++
- 7 files changed, 282 insertions(+)
-
-diff --git a/mt7996/main.c b/mt7996/main.c
-index b97483b6f..3ce31786a 100644
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -431,6 +431,9 @@ static int mt7996_config(struct ieee80211_hw *hw, u32 changed)
- 	int ret;
- 
- 	if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
-+		ret = mt7996_mcu_edcca_enable(phy, true);
-+		if (ret)
-+			return ret;
- 		ieee80211_stop_queues(hw);
- 		ret = mt7996_set_channel(phy);
- 		if (ret)
-diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 1b1f605d1..47fd1874d 100644
---- a/mt7996/mcu.h
-+++ b/mt7996/mcu.h
-@@ -795,6 +795,8 @@ mt7996_get_power_bound(struct mt7996_phy *phy, s8 txpower)
- 
- enum {
- 	UNI_BAND_CONFIG_RADIO_ENABLE,
-+	UNI_BAND_CONFIG_EDCCA_ENABLE = 0x05,
-+	UNI_BAND_CONFIG_EDCCA_THRESHOLD = 0x06,
- 	UNI_BAND_CONFIG_RTS_THRESHOLD = 0x08,
- };
- 
-diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 43154e542..eda74f7a9 100644
---- a/mt7996/mt7996.h
-+++ b/mt7996/mt7996.h
-@@ -687,6 +687,17 @@ int mt7996_vendor_amnt_sta_remove(struct mt7996_phy *phy,
- 				  struct ieee80211_sta *sta);
- #endif
- 
-+int mt7996_mcu_edcca_enable(struct mt7996_phy *phy, bool enable);
-+int mt7996_mcu_edcca_threshold_ctrl(struct mt7996_phy *phy, u8 *value, bool set);
-+
-+enum edcca_bw_id {
-+	EDCCA_BW_20 = 0,
-+	EDCCA_BW_40,
-+	EDCCA_BW_80,
-+	EDCCA_BW_160,
-+	EDCCA_MAX_BW_NUM,
-+};
-+
- #ifdef CONFIG_MTK_DEBUG
- int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir);
- #endif
-diff --git a/mt7996/mtk_mcu.c b/mt7996/mtk_mcu.c
-index f772243b8..048c53475 100644
---- a/mt7996/mtk_mcu.c
-+++ b/mt7996/mtk_mcu.c
-@@ -38,4 +38,90 @@ int mt7996_mcu_get_tx_power_info(struct mt7996_phy *phy, u8 category, void *even
- 	return 0;
- }
- 
-+int mt7996_mcu_edcca_enable(struct mt7996_phy *phy, bool enable)
-+{
-+	struct mt7996_dev *dev = phy->dev;
-+	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
-+	enum nl80211_band band = chandef->chan->band;
-+	struct {
-+		u8 band_idx;
-+		u8 _rsv[3];
-+
-+		__le16 tag;
-+		__le16 len;
-+		u8 enable;
-+		u8 std;
-+		u8 _rsv2[2];
-+	} __packed req = {
-+		.band_idx = phy->mt76->band_idx,
-+		.tag = cpu_to_le16(UNI_BAND_CONFIG_EDCCA_ENABLE),
-+		.len = cpu_to_le16(sizeof(req) - 4),
-+		.enable = enable,
-+		.std = EDCCA_DEFAULT,
-+	};
-+
-+	switch (dev->mt76.region) {
-+	case NL80211_DFS_JP:
-+		req.std = EDCCA_JAPAN;
-+		break;
-+	case NL80211_DFS_FCC:
-+		if (band == NL80211_BAND_6GHZ)
-+			req.std = EDCCA_FCC;
-+		break;
-+	case NL80211_DFS_ETSI:
-+		if (band == NL80211_BAND_6GHZ)
-+			req.std = EDCCA_ETSI;
-+		break;
-+	default:
-+		break;
-+	}
-+
-+	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_WM_UNI_CMD(BAND_CONFIG),
-+				 &req, sizeof(req), true);
-+}
-+
-+int mt7996_mcu_edcca_threshold_ctrl(struct mt7996_phy *phy, u8 *value, bool set)
-+{
-+	struct {
-+		u8 band_idx;
-+		u8 _rsv[3];
-+
-+		__le16 tag;
-+		__le16 len;
-+		u8 threshold[4];
-+		bool init;
-+	} __packed *res, req = {
-+		.band_idx = phy->mt76->band_idx,
-+		.tag = cpu_to_le16(UNI_BAND_CONFIG_EDCCA_THRESHOLD),
-+		.len = cpu_to_le16(sizeof(req) - 4),
-+		.init = false,
-+	};
-+	struct sk_buff *skb;
-+	int ret;
-+	int i;
-+
-+	for (i = 0; i < EDCCA_MAX_BW_NUM; i++)
-+		req.threshold[i] = value[i];
-+
-+	if (set)
-+		return mt76_mcu_send_msg(&phy->dev->mt76, MCU_WM_UNI_CMD(BAND_CONFIG),
-+					 &req, sizeof(req), true);
-+
-+	ret = mt76_mcu_send_and_get_msg(&phy->dev->mt76,
-+					MCU_WM_UNI_CMD_QUERY(BAND_CONFIG),
-+					&req, sizeof(req), true, &skb);
-+
-+	if (ret)
-+		return ret;
-+
-+	res = (void *)skb->data;
-+
-+	for (i = 0; i < EDCCA_MAX_BW_NUM; i++)
-+		value[i] = res->threshold[i];
-+
-+	dev_kfree_skb(skb);
-+
-+	return 0;
-+}
-+
- #endif
-diff --git a/mt7996/mtk_mcu.h b/mt7996/mtk_mcu.h
-index beb1aba24..9c0db87bb 100644
---- a/mt7996/mtk_mcu.h
-+++ b/mt7996/mtk_mcu.h
-@@ -89,6 +89,21 @@ enum txpower_event {
- 	UNI_TXPOWER_PHY_RATE_INFO = 5,
- };
- 
-+enum {
-+	EDCCA_CTRL_SET_EN = 0,
-+	EDCCA_CTRL_SET_THRES,
-+	EDCCA_CTRL_GET_EN,
-+	EDCCA_CTRL_GET_THRES,
-+	EDCCA_CTRL_NUM,
-+};
-+
-+enum {
-+	EDCCA_DEFAULT = 0,
-+	EDCCA_FCC = 1,
-+	EDCCA_ETSI = 2,
-+	EDCCA_JAPAN = 3
-+};
-+
- #endif
- 
- #endif
-diff --git a/mt7996/vendor.c b/mt7996/vendor.c
-index 391015777..9f333d0ee 100644
---- a/mt7996/vendor.c
-+++ b/mt7996/vendor.c
-@@ -40,6 +40,26 @@ bss_color_ctrl_policy[NUM_MTK_VENDOR_ATTRS_BSS_COLOR_CTRL] = {
- 	[MTK_VENDOR_ATTR_AVAL_BSS_COLOR_BMP] = { .type = NLA_U64 },
- };
- 
-+static const struct nla_policy
-+edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
-+	[MTK_VENDOR_ATTR_EDCCA_CTRL_MODE] = { .type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] = { .type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC20_VAL] = { .type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL] = { .type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL] = { .type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE] = { .type = NLA_S8 },
-+	[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC160_VAL] = { .type = NLA_U8 },
-+};
-+
-+static const struct nla_policy
-+edcca_dump_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP] = {
-+	[MTK_VENDOR_ATTR_EDCCA_DUMP_MODE] = { .type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL] = { .type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL] = { .type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL] = { .type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_EDCCA_DUMP_SEC160_VAL] = { .type = NLA_U8 },
-+};
-+
- struct mt7996_amnt_data {
- 	u8 idx;
- 	u8 addr[ETH_ALEN];
-@@ -436,6 +456,106 @@ mt7996_vendor_bss_color_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev
- 	return len;
- }
- 
-+static int mt7996_vendor_edcca_ctrl(struct wiphy *wiphy, struct wireless_dev *wdev,
-+				    const void *data, int data_len)
-+{
-+	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
-+	struct mt7996_phy *phy = mt7996_hw_phy(hw);
-+	struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL];
-+	int err;
-+	u8 edcca_mode;
-+	u8 edcca_value[EDCCA_MAX_BW_NUM];
-+
-+	err = nla_parse(tb, MTK_VENDOR_ATTR_EDCCA_CTRL_MAX, data, data_len,
-+			edcca_ctrl_policy, NULL);
-+	if (err)
-+		return err;
-+
-+	if (!tb[MTK_VENDOR_ATTR_EDCCA_CTRL_MODE])
-+		return -EINVAL;
-+
-+	edcca_mode = nla_get_u8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_MODE]);
-+	if (edcca_mode == EDCCA_CTRL_SET_EN) {
-+		if (!tb[MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL])
-+			return -EINVAL;
-+
-+		edcca_value[0] =
-+			nla_get_u8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL]);
-+
-+		err = mt7996_mcu_edcca_enable(phy, !!edcca_value[0]);
-+		if (err)
-+			return err;
-+	} else if (edcca_mode == EDCCA_CTRL_SET_THRES) {
-+		if (!tb[MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] ||
-+		    !tb[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL] ||
-+		    !tb[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL] ||
-+		    !tb[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC160_VAL]) {
-+			return -EINVAL;
-+		}
-+		edcca_value[EDCCA_BW_20] =
-+			nla_get_u8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL]);
-+		edcca_value[EDCCA_BW_40] =
-+			nla_get_u8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL]);
-+		edcca_value[EDCCA_BW_80] =
-+			nla_get_u8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL]);
-+		edcca_value[EDCCA_BW_160] =
-+			nla_get_u8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC160_VAL]);
-+
-+		err = mt7996_mcu_edcca_threshold_ctrl(phy, edcca_value, true);
-+
-+		if (err)
-+			return err;
-+	} else {
-+		return -EINVAL;
-+	}
-+
-+	return 0;
-+}
-+
-+
-+static int
-+mt7996_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
-+			     struct sk_buff *skb, const void *data, int data_len,
-+			     unsigned long *storage)
-+{
-+	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
-+	struct mt7996_phy *phy = mt7996_hw_phy(hw);
-+	struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL];
-+	int err;
-+	u8 edcca_mode;
-+	u8 value[EDCCA_MAX_BW_NUM];
-+
-+	if (*storage == 1)
-+		return -ENOENT;
-+	*storage = 1;
-+
-+	err = nla_parse(tb, MTK_VENDOR_ATTR_EDCCA_CTRL_MAX, data, data_len,
-+			edcca_ctrl_policy, NULL);
-+	if (err)
-+		return err;
-+
-+	if (!tb[MTK_VENDOR_ATTR_EDCCA_CTRL_MODE])
-+		return -EINVAL;
-+
-+	edcca_mode = nla_get_u8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_MODE]);
-+
-+	if (edcca_mode != EDCCA_CTRL_GET_THRES)
-+		return -EINVAL;
-+
-+	err = mt7996_mcu_edcca_threshold_ctrl(phy, value, false);
-+
-+	if (err)
-+		return err;
-+
-+	if (nla_put_u8(skb, MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL, value[EDCCA_BW_20]) ||
-+	    nla_put_u8(skb, MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL, value[EDCCA_BW_40]) ||
-+	    nla_put_u8(skb, MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL, value[EDCCA_BW_80]) ||
-+	    nla_put_u8(skb, MTK_VENDOR_ATTR_EDCCA_DUMP_SEC160_VAL, value[EDCCA_BW_160]))
-+		return -ENOMEM;
-+
-+	return EDCCA_MAX_BW_NUM;
-+}
-+
- static const struct wiphy_vendor_command mt7996_vendor_commands[] = {
- 	{
- 		.info = {
-@@ -472,6 +592,18 @@ static const struct wiphy_vendor_command mt7996_vendor_commands[] = {
- 		.policy = bss_color_ctrl_policy,
- 		.maxattr = MTK_VENDOR_ATTR_BSS_COLOR_CTRL_MAX,
- 	},
-+	{
-+		.info = {
-+			.vendor_id = MTK_NL80211_VENDOR_ID,
-+			.subcmd = MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL,
-+		},
-+		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
-+			 WIPHY_VENDOR_CMD_NEED_RUNNING,
-+		.doit = mt7996_vendor_edcca_ctrl,
-+		.dumpit = mt7996_vendor_edcca_ctrl_dump,
-+		.policy = edcca_ctrl_policy,
-+		.maxattr = MTK_VENDOR_ATTR_EDCCA_CTRL_MAX,
-+	},
- };
- 
- void mt7996_vendor_register(struct mt7996_phy *phy)
-diff --git a/mt7996/vendor.h b/mt7996/vendor.h
-index eec9e74a2..4465bc9df 100644
---- a/mt7996/vendor.h
-+++ b/mt7996/vendor.h
-@@ -6,9 +6,42 @@
- enum mtk_nl80211_vendor_subcmds {
- 	MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL = 0xae,
- 	MTK_NL80211_VENDOR_SUBCMD_MU_CTRL = 0xc5,
-+	MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
- 	MTK_NL80211_VENDOR_SUBCMD_BSS_COLOR_CTRL = 0xca,
- };
- 
-+enum mtk_vendor_attr_edcca_ctrl {
-+	MTK_VENDOR_ATTR_EDCCA_THRESHOLD_INVALID = 0,
-+
-+	MTK_VENDOR_ATTR_EDCCA_CTRL_MODE,
-+	MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL,
-+	MTK_VENDOR_ATTR_EDCCA_CTRL_SEC20_VAL,
-+	MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL,
-+	MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL,
-+	MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE,
-+	MTK_VENDOR_ATTR_EDCCA_CTRL_SEC160_VAL,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL,
-+	MTK_VENDOR_ATTR_EDCCA_CTRL_MAX =
-+		NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL - 1
-+};
-+
-+enum mtk_vendor_attr_edcca_dump {
-+	MTK_VENDOR_ATTR_EDCCA_DUMP_UNSPEC = 0,
-+
-+	MTK_VENDOR_ATTR_EDCCA_DUMP_MODE,
-+	MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL,
-+	MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL,
-+	MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL,
-+	MTK_VENDOR_ATTR_EDCCA_DUMP_SEC160_VAL,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP,
-+	MTK_VENDOR_ATTR_EDCCA_DUMP_MAX =
-+		NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP - 1
-+};
-+
- enum mtk_vendor_attr_mu_ctrl {
- 	MTK_VENDOR_ATTR_MU_CTRL_UNSPEC,
- 
--- 
-2.39.2
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1020-wifi-mt76-mt7996-Fix-incorrect-UWTBL_LEN_IN_DW-param.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1020-wifi-mt76-mt7996-Fix-incorrect-UWTBL_LEN_IN_DW-param.patch
deleted file mode 100644
index 61106fc..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1020-wifi-mt76-mt7996-Fix-incorrect-UWTBL_LEN_IN_DW-param.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 1443f908c6eb33e33413fd20016be92f24557ce4 Mon Sep 17 00:00:00 2001
-From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
-Date: Wed, 28 Jun 2023 05:07:43 +0800
-Subject: [PATCH 1020/1024] wifi: mt76: mt7996: Fix incorrect UWTBL_LEN_IN_DW
- parameter
-
-The UWTBL length is 16 DW. Correct the len to 16 so that we can
-see full UWTBL when checking wtbl with debugfs.
-
-Signed-off-by: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
----
- mt7996/mtk_debug.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/mt7996/mtk_debug.h b/mt7996/mtk_debug.h
-index 368f0bcf0..9718c2cbe 100644
---- a/mt7996/mtk_debug.h
-+++ b/mt7996/mtk_debug.h
-@@ -834,7 +834,7 @@ enum cipher_suit {
- };
- 
- #define LWTBL_LEN_IN_DW			36
--#define UWTBL_LEN_IN_DW			10
-+#define UWTBL_LEN_IN_DW			16
- 
- #define MT_DBG_WTBL_BASE		0x820D8000
- 
--- 
-2.39.2
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1021-wifi-mt76-mt7996-add-support-spatial-reuse-debug-com.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1021-wifi-mt76-mt7996-add-support-spatial-reuse-debug-com.patch
deleted file mode 100644
index b201ac8..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1021-wifi-mt76-mt7996-add-support-spatial-reuse-debug-com.patch
+++ /dev/null
@@ -1,393 +0,0 @@
-From 980b02284098c3cb3555ae7ec586918c94b6d51d Mon Sep 17 00:00:00 2001
-From: Howard Hsu <howard-yh.hsu@mediatek.com>
-Date: Mon, 10 Jul 2023 11:47:29 +0800
-Subject: [PATCH 1021/1024] wifi: mt76: mt7996: add support spatial reuse debug
- commands
-
-This commit adds the following debug commands in debugfs:
-1. sr_enable: enable/disable spatial reuse feature. Default is on.
-2. sr_enhanced_enable: enable/disable enhanced spatial reuse feature.
-Default is on. This feature is mtk proprietary feature.
-3. sr_stats: Check the Spatial reuse tx statistics.
-4. sr_scene_cond: Check the result of mtk scene detection algorithm. Mtk
-scene detection algorithm in firmware may decide whether current
-environment can SR Tx or not.
-
-To learn more details of these commands, please check:
-https://wiki.mediatek.inc/display/APKB/mt76+Phy+feature+debug+Cheetsheet#mt76PhyfeaturedebugCheetsheet-SpatialReuse
----
- mt76_connac_mcu.h    |   1 +
- mt7996/main.c        |   6 +++
- mt7996/mcu.c         |   5 ++
- mt7996/mt7996.h      |   6 +++
- mt7996/mtk_debugfs.c |  82 ++++++++++++++++++++++++++++++++
- mt7996/mtk_mcu.c     | 111 +++++++++++++++++++++++++++++++++++++++++++
- mt7996/mtk_mcu.h     |  56 ++++++++++++++++++++++
- 7 files changed, 267 insertions(+)
-
-diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 21cae4bf4..1d01b2b89 100644
---- a/mt76_connac_mcu.h
-+++ b/mt76_connac_mcu.h
-@@ -1029,6 +1029,7 @@ enum {
- 	MCU_UNI_EVENT_BSS_BEACON_LOSS = 0x0c,
- 	MCU_UNI_EVENT_SCAN_DONE = 0x0e,
- 	MCU_UNI_EVENT_RDD_REPORT = 0x11,
-+	MCU_UNI_EVENT_SR = 0x25,
- 	MCU_UNI_EVENT_ROC = 0x27,
- 	MCU_UNI_EVENT_TX_DONE = 0x2d,
- 	MCU_UNI_EVENT_BF = 0x33,
-diff --git a/mt7996/main.c b/mt7996/main.c
-index 3ce31786a..bae25ceda 100644
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -6,6 +6,9 @@
- #include "mt7996.h"
- #include "mcu.h"
- #include "mac.h"
-+#ifdef CONFIG_MTK_DEBUG
-+#include "mtk_mcu.h"
-+#endif
- 
- static bool mt7996_dev_running(struct mt7996_dev *dev)
- {
-@@ -78,6 +81,9 @@ int mt7996_run(struct ieee80211_hw *hw)
- 		goto out;
- 
- #ifdef CONFIG_MTK_DEBUG
-+	phy->sr_enable = true;
-+	phy->enhanced_sr_enable = true;
-+
- 	ret = mt7996_mcu_set_tx_power_ctrl(phy, UNI_TXPOWER_SKU_POWER_LIMIT_CTRL,
- 					   !dev->dbg.sku_disable);
- #else
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 7c40b8bb6..76788907a 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -617,6 +617,11 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
- 	case MCU_UNI_EVENT_RDD_REPORT:
- 		mt7996_mcu_rx_radar_detected(dev, skb);
- 		break;
-+#ifdef CONFIG_MTK_DEBUG
-+	case MCU_UNI_EVENT_SR:
-+		mt7996_mcu_rx_sr_event(dev, skb);
-+		break;
-+#endif
- 	case MCU_UNI_EVENT_THERMAL:
- 		mt7996_mcu_rx_thermal_notify(dev, skb);
- 		break;
-diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index eda74f7a9..feb82e440 100644
---- a/mt7996/mt7996.h
-+++ b/mt7996/mt7996.h
-@@ -270,6 +270,10 @@ struct mt7996_phy {
- 	spinlock_t amnt_lock;
- 	struct mt7996_air_monitor_ctrl amnt_ctrl;
- #endif
-+#ifdef CONFIG_MTK_DEBUG
-+	bool sr_enable:1;
-+	bool enhanced_sr_enable:1;
-+#endif
- };
- 
- struct mt7996_dev {
-@@ -700,6 +704,8 @@ enum edcca_bw_id {
- 
- #ifdef CONFIG_MTK_DEBUG
- int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir);
-+int mt7996_mcu_set_sr_enable(struct mt7996_phy *phy, u8 action, u64 val, bool set);
-+void mt7996_mcu_rx_sr_event(struct mt7996_dev *dev, struct sk_buff *skb);
- #endif
- 
- #endif
-diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 82b2785bd..f56ad88df 100644
---- a/mt7996/mtk_debugfs.c
-+++ b/mt7996/mtk_debugfs.c
-@@ -2589,6 +2589,83 @@ static int mt7996_show_eeprom_mode(struct seq_file *s, void *data)
- 	return 0;
- }
- 
-+static int
-+mt7996_sr_enable_get(void *data, u64 *val)
-+{
-+	struct mt7996_phy *phy = data;
-+
-+	*val = phy->sr_enable;
-+
-+	return 0;
-+}
-+
-+static int
-+mt7996_sr_enable_set(void *data, u64 val)
-+{
-+	struct mt7996_phy *phy = data;
-+	int ret;
-+
-+	if (!!val == phy->sr_enable)
-+		return 0;
-+
-+	ret = mt7996_mcu_set_sr_enable(phy, UNI_CMD_SR_CFG_SR_ENABLE, val, true);
-+	if (ret)
-+		return ret;
-+
-+	return mt7996_mcu_set_sr_enable(phy, UNI_CMD_SR_CFG_SR_ENABLE, 0, false);
-+}
-+DEFINE_DEBUGFS_ATTRIBUTE(fops_sr_enable, mt7996_sr_enable_get,
-+			 mt7996_sr_enable_set, "%lld\n");
-+static int
-+mt7996_sr_enhanced_enable_get(void *data, u64 *val)
-+{
-+	struct mt7996_phy *phy = data;
-+
-+	*val = phy->enhanced_sr_enable;
-+
-+	return 0;
-+}
-+
-+static int
-+mt7996_sr_enhanced_enable_set(void *data, u64 val)
-+{
-+	struct mt7996_phy *phy = data;
-+	int ret;
-+
-+	if (!!val == phy->enhanced_sr_enable)
-+		return 0;
-+
-+	ret = mt7996_mcu_set_sr_enable(phy, UNI_CMD_SR_HW_ENHANCE_SR_ENABLE, val, true);
-+	if (ret)
-+		return ret;
-+
-+	return mt7996_mcu_set_sr_enable(phy, UNI_CMD_SR_HW_ENHANCE_SR_ENABLE, 0, false);
-+}
-+DEFINE_DEBUGFS_ATTRIBUTE(fops_sr_enhanced_enable, mt7996_sr_enhanced_enable_get,
-+			 mt7996_sr_enhanced_enable_set, "%lld\n");
-+
-+static int
-+mt7996_sr_stats_show(struct seq_file *file, void *data)
-+{
-+	struct mt7996_phy *phy = file->private;
-+
-+	mt7996_mcu_set_sr_enable(phy, UNI_CMD_SR_HW_IND, 0, false);
-+
-+	return 0;
-+}
-+DEFINE_SHOW_ATTRIBUTE(mt7996_sr_stats);
-+
-+static int
-+mt7996_sr_scene_cond_show(struct seq_file *file, void *data)
-+{
-+	struct mt7996_phy *phy = file->private;
-+
-+	mt7996_mcu_set_sr_enable(phy, UNI_CMD_SR_SW_SD, 0, false);
-+
-+	return 0;
-+}
-+DEFINE_SHOW_ATTRIBUTE(mt7996_sr_scene_cond);
-+
- int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
- {
- 	struct mt7996_dev *dev = phy->dev;
-@@ -2642,6 +2719,11 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
- 
- 	debugfs_create_u8("sku_disable", 0600, dir, &dev->dbg.sku_disable);
- 
-+	debugfs_create_file("sr_enable", 0600, dir, phy, &fops_sr_enable);
-+	debugfs_create_file("sr_enhanced_enable", 0600, dir, phy, &fops_sr_enhanced_enable);
-+	debugfs_create_file("sr_stats", 0400, dir, phy, &mt7996_sr_stats_fops);
-+	debugfs_create_file("sr_scene_cond", 0400, dir, phy, &mt7996_sr_scene_cond_fops);
-+
- 	return 0;
- }
- 
-diff --git a/mt7996/mtk_mcu.c b/mt7996/mtk_mcu.c
-index 048c53475..3256de7f5 100644
---- a/mt7996/mtk_mcu.c
-+++ b/mt7996/mtk_mcu.c
-@@ -124,4 +124,115 @@ int mt7996_mcu_edcca_threshold_ctrl(struct mt7996_phy *phy, u8 *value, bool set)
- 	return 0;
- }
- 
-+int mt7996_mcu_set_sr_enable(struct mt7996_phy *phy, u8 action, u64 val, bool set)
-+{
-+	struct {
-+		u8 band_idx;
-+		u8 _rsv[3];
-+
-+		__le16 tag;
-+		__le16 len;
-+
-+		__le32 val;
-+
-+	} __packed req = {
-+		.band_idx = phy->mt76->band_idx,
-+
-+		.tag = cpu_to_le16(action),
-+		.len = cpu_to_le16(sizeof(req) - 4),
-+
-+		.val = cpu_to_le32((u32) val),
-+	};
-+
-+	if (set)
-+		return mt76_mcu_send_msg(&phy->dev->mt76, MCU_WM_UNI_CMD(SR), &req,
-+					 sizeof(req), false);
-+	else
-+		return mt76_mcu_send_msg(&phy->dev->mt76, MCU_WM_UNI_CMD_QUERY(SR), &req,
-+					 sizeof(req), false);
-+}
-+
-+void mt7996_mcu_rx_sr_swsd(struct mt7996_dev *dev, struct sk_buff *skb)
-+{
-+#define SR_SCENE_DETECTION_TIMER_PERIOD_MS 500
-+	struct mt7996_mcu_sr_swsd_event *event;
-+	static const char * const rules[] = {"1 - NO CONNECTED", "2 - NO CONGESTION",
-+					     "3 - NO INTERFERENCE", "4 - SR ON"};
-+	u8 idx;
-+
-+	event = (struct mt7996_mcu_sr_swsd_event *)skb->data;
-+	idx = event->basic.band_idx;
-+
-+	dev_info(dev->mt76.dev, "Band index = %u\n", le16_to_cpu(event->basic.band_idx));
-+	dev_info(dev->mt76.dev, "Hit Rule = %s\n", rules[event->tlv[idx].rule]);
-+	dev_info(dev->mt76.dev, "Timer Period = %d(us)\n"
-+		 "Congestion Ratio  = %d.%1d%%\n",
-+		 SR_SCENE_DETECTION_TIMER_PERIOD_MS * 1000,
-+		 le32_to_cpu(event->tlv[idx].total_airtime_ratio) / 10,
-+		 le32_to_cpu(event->tlv[idx].total_airtime_ratio) % 10);
-+	dev_info(dev->mt76.dev,
-+		 "Total Airtime = %d(us)\n"
-+		 "ChBusy = %d\n"
-+		 "SrTx = %d\n"
-+		 "OBSS = %d\n"
-+		 "MyTx = %d\n"
-+		 "MyRx = %d\n"
-+		 "Interference Ratio = %d.%1d%%\n",
-+		 le32_to_cpu(event->tlv[idx].total_airtime),
-+		 le32_to_cpu(event->tlv[idx].channel_busy_time),
-+		 le32_to_cpu(event->tlv[idx].sr_tx_airtime),
-+		 le32_to_cpu(event->tlv[idx].obss_airtime),
-+		 le32_to_cpu(event->tlv[idx].my_tx_airtime),
-+		 le32_to_cpu(event->tlv[idx].my_rx_airtime),
-+		 le32_to_cpu(event->tlv[idx].obss_airtime_ratio) / 10,
-+		 le32_to_cpu(event->tlv[idx].obss_airtime_ratio) % 10);
-+}
-+
-+void mt7996_mcu_rx_sr_hw_indicator(struct mt7996_dev *dev, struct sk_buff *skb)
-+{
-+	struct mt7996_mcu_sr_hw_ind_event *event;
-+
-+	event = (struct mt7996_mcu_sr_hw_ind_event *)skb->data;
-+
-+	dev_info(dev->mt76.dev, "Inter PPDU Count = %u\n",
-+		 le16_to_cpu(event->inter_bss_ppdu_cnt));
-+	dev_info(dev->mt76.dev, "SR Valid Count = %u\n",
-+		 le16_to_cpu(event->non_srg_valid_cnt));
-+	dev_info(dev->mt76.dev, "SR Tx Count = %u\n",
-+		 le32_to_cpu(event->sr_ampdu_mpdu_cnt));
-+	dev_info(dev->mt76.dev, "SR Tx Acked Count = %u\n",
-+		 le32_to_cpu(event->sr_ampdu_mpdu_acked_cnt));
-+}
-+
-+void mt7996_mcu_rx_sr_event(struct mt7996_dev *dev, struct sk_buff *skb)
-+{
-+	struct mt76_phy *mphy = &dev->mt76.phy;
-+	struct mt7996_phy *phy;
-+	struct mt7996_mcu_sr_common_event *event;
-+
-+	event = (struct mt7996_mcu_sr_common_event *)skb->data;
-+	mphy = dev->mt76.phys[event->basic.band_idx];
-+	if (!mphy)
-+		return;
-+
-+	phy = (struct mt7996_phy *)mphy->priv;
-+
-+	switch (le16_to_cpu(event->basic.tag)) {
-+	case UNI_EVENT_SR_CFG_SR_ENABLE:
-+		phy->sr_enable = le32_to_cpu(event->value) ? true : false;
-+		break;
-+	case UNI_EVENT_SR_HW_ESR_ENABLE:
-+		phy->enhanced_sr_enable = le32_to_cpu(event->value) ? true : false;
-+		break;
-+	case UNI_EVENT_SR_SW_SD:
-+		mt7996_mcu_rx_sr_swsd(dev, skb);
-+		break;
-+	case UNI_EVENT_SR_HW_IND:
-+		mt7996_mcu_rx_sr_hw_indicator(dev, skb);
-+		break;
-+	default:
-+		dev_info(dev->mt76.dev, "Unknown SR event tag %d\n",
-+			 le16_to_cpu(event->basic.tag));
-+	}
-+}
- #endif
-diff --git a/mt7996/mtk_mcu.h b/mt7996/mtk_mcu.h
-index 9c0db87bb..a5bdb8831 100644
---- a/mt7996/mtk_mcu.h
-+++ b/mt7996/mtk_mcu.h
-@@ -104,6 +104,62 @@ enum {
- 	EDCCA_JAPAN = 3
- };
- 
-+enum {
-+	UNI_EVENT_SR_CFG_SR_ENABLE = 0x1,
-+	UNI_EVENT_SR_SW_SD = 0x83,
-+	UNI_EVENT_SR_HW_IND = 0xC9,
-+	UNI_EVENT_SR_HW_ESR_ENABLE = 0xD8,
-+};
-+enum {
-+	UNI_CMD_SR_CFG_SR_ENABLE = 0x1,
-+	UNI_CMD_SR_SW_SD = 0x84,
-+	UNI_CMD_SR_HW_IND = 0xCB,
-+	UNI_CMD_SR_HW_ENHANCE_SR_ENABLE = 0xDA,
-+};
-+
-+struct mt7996_mcu_sr_basic_event {
-+	struct mt7996_mcu_rxd rxd;
-+
-+	u8 band_idx;
-+	u8 _rsv[3];
-+
-+	__le16 tag;
-+	__le16 len;
-+};
-+
-+struct sr_sd_tlv {
-+	u8 _rsv[16];
-+	__le32 sr_tx_airtime;
-+	__le32 obss_airtime;
-+	__le32 my_tx_airtime;
-+	__le32 my_rx_airtime;
-+	__le32 channel_busy_time;
-+	__le32 total_airtime;
-+	__le32 total_airtime_ratio;
-+	__le32 obss_airtime_ratio;
-+	u8 rule;
-+	u8 _rsv2[59];
-+} __packed;
-+
-+struct mt7996_mcu_sr_swsd_event {
-+	struct mt7996_mcu_sr_basic_event basic;
-+	struct sr_sd_tlv tlv[3];
-+} __packed;
-+
-+struct mt7996_mcu_sr_common_event {
-+	struct mt7996_mcu_sr_basic_event basic;
-+	__le32 value;
-+};
-+
-+struct mt7996_mcu_sr_hw_ind_event {
-+	struct mt7996_mcu_sr_basic_event basic;
-+	__le16 non_srg_valid_cnt;
-+	u8 _rsv[4];
-+	__le16 inter_bss_ppdu_cnt;
-+	u8 _rsv2[4];
-+	__le32 sr_ampdu_mpdu_cnt;
-+	__le32 sr_ampdu_mpdu_acked_cnt;
-+};
- #endif
- 
- #endif
--- 
-2.39.2
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1022-wifi-mt76-mt7996-Establish-BA-in-VO-queue.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1022-wifi-mt76-mt7996-Establish-BA-in-VO-queue.patch
deleted file mode 100644
index c9f5a19..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1022-wifi-mt76-mt7996-Establish-BA-in-VO-queue.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 279016e3f3eece9baf69c60dfcb907679788d948 Mon Sep 17 00:00:00 2001
-From: MeiChia Chiu <meichia.chiu@mediatek.com>
-Date: Tue, 1 Aug 2023 16:02:28 +0800
-Subject: [PATCH 1022/1024] wifi: mt76: mt7996: Establish BA in VO queue
-
----
- mt7996/mac.c | 2 --
- 1 file changed, 2 deletions(-)
-
-diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 6e79be8de..04e14fa30 100644
---- a/mt7996/mac.c
-+++ b/mt7996/mac.c
-@@ -963,8 +963,6 @@ mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb)
- 		return;
- 
- 	tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
--	if (tid >= 6) /* skip VO queue */
--		return;
- 
- 	if (is_8023)
- 		fc = IEEE80211_FTYPE_DATA |
--- 
-2.39.2
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1023-wifi-mt76-mt7996-add-eagle-iFEM-HWITS-ZWDFS-SW-worka.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1023-wifi-mt76-mt7996-add-eagle-iFEM-HWITS-ZWDFS-SW-worka.patch
deleted file mode 100644
index fe1520e..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1023-wifi-mt76-mt7996-add-eagle-iFEM-HWITS-ZWDFS-SW-worka.patch
+++ /dev/null
@@ -1,141 +0,0 @@
-From a94962822a9df3869525ec040e2698be0c39c1e6 Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Wed, 5 Jul 2023 10:00:17 +0800
-Subject: [PATCH 1023/1024] wifi: mt76: mt7996: add eagle iFEM HWITS ZWDFS SW
- workaround
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- mt7996/main.c   | 55 ++++++++++++++++++++++++++++++++++++++++++++++---
- mt7996/mcu.c    |  6 ++++--
- mt7996/mt7996.h |  1 +
- 3 files changed, 57 insertions(+), 5 deletions(-)
-
-diff --git a/mt7996/main.c b/mt7996/main.c
-index bae25ceda..a00ebf9e6 100644
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -1410,6 +1410,51 @@ mt7996_twt_teardown_request(struct ieee80211_hw *hw,
- 	mutex_unlock(&dev->mt76.mutex);
- }
- 
-+static void
-+mt7996_background_radar_handle_7975_ifem(struct ieee80211_hw *hw,
-+					 struct cfg80211_chan_def *user_chandef,
-+					 struct cfg80211_chan_def *fw_chandef)
-+{
-+	struct mt7996_phy *phy = mt7996_hw_phy(hw);
-+	struct mt7996_dev *dev = phy->dev;
-+	struct cfg80211_chan_def *c = user_chandef;
-+	bool is_ifem_adie, expand = false;
-+	u32 origin_control;
-+
-+	is_ifem_adie = is_mt7996(&dev->mt76) &&
-+		       !!(mt76_get_field(dev, MT_PAD_GPIO, MT_PAD_GPIO_ADIE_COMB) % 2);
-+	if (!user_chandef || !is_ifem_adie)
-+		goto out;
-+
-+	if (user_chandef->width == NL80211_CHAN_WIDTH_160) {
-+		origin_control = user_chandef->chan->center_freq;
-+		if (dev->bg_nxt_freq)
-+			goto out;
-+
-+		if (user_chandef->chan->flags & IEEE80211_CHAN_RADAR)
-+			dev->bg_nxt_freq = origin_control;
-+		else
-+			c = fw_chandef;
-+
-+		c->chan = ieee80211_get_channel(hw->wiphy, origin_control + 80);
-+	} else {
-+		if (!dev->bg_nxt_freq)
-+			goto out;
-+
-+		c->chan = ieee80211_get_channel(hw->wiphy, dev->bg_nxt_freq);
-+		dev->bg_nxt_freq = 0;
-+		expand = true;
-+	}
-+	c->width = NL80211_CHAN_WIDTH_80;
-+	c->center_freq1 = c->chan->center_freq + 30;
-+
-+	if (c == user_chandef)
-+		cfg80211_background_radar_update_channel(hw->wiphy, c, expand);
-+	return;
-+out:
-+	dev->bg_nxt_freq = 0;
-+}
-+
- static int
- mt7996_set_radar_background(struct ieee80211_hw *hw,
- 			    struct cfg80211_chan_def *chandef)
-@@ -1418,6 +1463,7 @@ mt7996_set_radar_background(struct ieee80211_hw *hw,
- 	struct mt7996_dev *dev = phy->dev;
- 	int ret = -EINVAL;
- 	bool running;
-+	struct cfg80211_chan_def ifem_chandef = {};
- 
- 	mutex_lock(&dev->mt76.mutex);
- 
-@@ -1430,13 +1476,14 @@ mt7996_set_radar_background(struct ieee80211_hw *hw,
- 		goto out;
- 	}
- 
-+	mt7996_background_radar_handle_7975_ifem(hw, chandef, &ifem_chandef);
-+
- 	/* rdd2 already configured on a radar channel */
- 	running = dev->rdd2_phy &&
- 		  cfg80211_chandef_valid(&dev->rdd2_chandef) &&
- 		  !!(dev->rdd2_chandef.chan->flags & IEEE80211_CHAN_RADAR);
- 
--	if (!chandef || running ||
--	    !(chandef->chan->flags & IEEE80211_CHAN_RADAR)) {
-+	if (!chandef || running) {
- 		ret = mt7996_mcu_rdd_background_enable(phy, NULL);
- 		if (ret)
- 			goto out;
-@@ -1445,7 +1492,9 @@ mt7996_set_radar_background(struct ieee80211_hw *hw,
- 			goto update_phy;
- 	}
- 
--	ret = mt7996_mcu_rdd_background_enable(phy, chandef);
-+	ret = mt7996_mcu_rdd_background_enable(phy,
-+					       ifem_chandef.chan ?
-+					       &ifem_chandef : chandef);
- 	if (ret)
- 		goto out;
- 
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 76788907a..f9387ea56 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -350,12 +350,14 @@ mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb)
- 	if (!mphy)
- 		return;
- 
--	if (r->band_idx == MT_RX_SEL2)
-+	if (r->band_idx == MT_RX_SEL2) {
-+		dev->bg_nxt_freq = 0;
- 		cfg80211_background_radar_event(mphy->hw->wiphy,
- 						&dev->rdd2_chandef,
- 						GFP_ATOMIC);
--	else
-+	} else {
- 		ieee80211_radar_detected(mphy->hw);
-+	}
- 	dev->hw_pattern++;
- }
- 
-diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index feb82e440..6447b2c90 100644
---- a/mt7996/mt7996.h
-+++ b/mt7996/mt7996.h
-@@ -340,6 +340,7 @@ struct mt7996_dev {
- 	bool testmode_enable;
- 	bool bin_file_mode;
- 	u8 eeprom_mode;
-+	u32 bg_nxt_freq;
- 
- 	bool ibf;
- 	u8 fw_debug_wm;
--- 
-2.39.2
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1024-wifi-mt76-mt7996-report-tx-and-rx-byte-to-tpt_led.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1024-wifi-mt76-mt7996-report-tx-and-rx-byte-to-tpt_led.patch
deleted file mode 100644
index f029716..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1024-wifi-mt76-mt7996-report-tx-and-rx-byte-to-tpt_led.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 9debb7a31a3db9f8dd48a48d5705a2e8819d9d6a Mon Sep 17 00:00:00 2001
-From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
-Date: Sat, 12 Aug 2023 04:17:22 +0800
-Subject: [PATCH 1024/1024] wifi: mt76: mt7996: report tx and rx byte to
- tpt_led
-
----
- mt7996/mcu.c | 15 +++++++++++----
- 1 file changed, 11 insertions(+), 4 deletions(-)
-
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index f9387ea56..5f18de031 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -531,6 +531,8 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
- 		u8 ac;
- 		u16 wlan_idx;
- 		struct mt76_wcid *wcid;
-+		struct mt76_phy *mphy;
-+		u32 tx_bytes, rx_bytes;
- 
- 		switch (le16_to_cpu(res->tag)) {
- 		case UNI_ALL_STA_TXRX_RATE:
-@@ -550,11 +552,16 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
- 			if (!wcid)
- 				break;
- 
-+			mphy = mt76_dev_phy(&dev->mt76, wcid->phy_idx);
- 			for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
--				wcid->stats.tx_bytes +=
--					le32_to_cpu(res->adm_stat[i].tx_bytes[ac]);
--				wcid->stats.rx_bytes +=
--					le32_to_cpu(res->adm_stat[i].rx_bytes[ac]);
-+				tx_bytes = le32_to_cpu(res->adm_stat[i].tx_bytes[ac]);
-+				rx_bytes = le32_to_cpu(res->adm_stat[i].rx_bytes[ac]);
-+
-+				wcid->stats.tx_bytes += tx_bytes;
-+				wcid->stats.rx_bytes += rx_bytes;
-+
-+				ieee80211_tpt_led_trig_tx(mphy->hw, tx_bytes);
-+				ieee80211_tpt_led_trig_rx(mphy->hw, rx_bytes);
- 			}
- 			break;
- 		case UNI_ALL_STA_TXRX_MSDU_COUNT:
--- 
-2.39.2
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1025-wifi-mt76-mt7996-support-dup-wtbl.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1025-wifi-mt76-mt7996-support-dup-wtbl.patch
deleted file mode 100644
index 8a9b045..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1025-wifi-mt76-mt7996-support-dup-wtbl.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-From 0b429d84b4fe85431a273899e89bcbb65ae3df38 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Thu, 21 Sep 2023 00:52:46 +0800
-Subject: [PATCH] wifi: mt76: mt7996: support dup wtbl
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
-Change-Id: I14ba41ace8341c23c1cfb6e9c4fbb2d5e93a5714
----
- mt7996/init.c    |  1 +
- mt7996/mt7996.h  |  1 +
- mt7996/mtk_mcu.c | 23 +++++++++++++++++++++++
- 3 files changed, 25 insertions(+)
-
-diff --git a/mt7996/init.c b/mt7996/init.c
-index 5d8ecf038..3001db325 100644
---- a/mt7996/init.c
-+++ b/mt7996/init.c
-@@ -641,6 +641,7 @@ static void mt7996_init_work(struct work_struct *work)
- 	mt7996_init_txpower(dev, &dev->mphy.sband_5g.sband);
- 	mt7996_init_txpower(dev, &dev->mphy.sband_6g.sband);
- 	mt7996_txbf_init(dev);
-+	mt7996_mcu_set_dup_wtbl(dev);
- }
- 
- void mt7996_wfsys_reset(struct mt7996_dev *dev)
-diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 6447b2c90..d1633494c 100644
---- a/mt7996/mt7996.h
-+++ b/mt7996/mt7996.h
-@@ -707,6 +707,7 @@ enum edcca_bw_id {
- int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir);
- int mt7996_mcu_set_sr_enable(struct mt7996_phy *phy, u8 action, u64 val, bool set);
- void mt7996_mcu_rx_sr_event(struct mt7996_dev *dev, struct sk_buff *skb);
-+int mt7996_mcu_set_dup_wtbl(struct mt7996_dev *dev);
- #endif
- 
- #endif
-diff --git a/mt7996/mtk_mcu.c b/mt7996/mtk_mcu.c
-index 3256de7f5..149694c19 100644
---- a/mt7996/mtk_mcu.c
-+++ b/mt7996/mtk_mcu.c
-@@ -235,4 +235,27 @@ void mt7996_mcu_rx_sr_event(struct mt7996_dev *dev, struct sk_buff *skb)
- 			 le16_to_cpu(event->basic.tag));
- 	}
- }
-+
-+int mt7996_mcu_set_dup_wtbl(struct mt7996_dev *dev)
-+{
-+#define CHIP_CONFIG_DUP_WTBL	4
-+#define DUP_WTBL_NUM	80
-+	struct {
-+		u8 _rsv[4];
-+
-+		__le16 tag;
-+		__le16 len;
-+		__le16 base;
-+		__le16 num;
-+		u8 _rsv2[4];
-+	} __packed req = {
-+		.tag = cpu_to_le16(CHIP_CONFIG_DUP_WTBL),
-+		.len = cpu_to_le16(sizeof(req) - 4),
-+		.base = cpu_to_le16(MT7996_WTBL_STA - DUP_WTBL_NUM + 1),
-+		.num = cpu_to_le16(DUP_WTBL_NUM),
-+	};
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(CHIP_CONFIG), &req,
-+				 sizeof(req), true);
-+}
- #endif
--- 
-2.39.2
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2000-wifi-mt76-rework-wed-rx-flow.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2000-wifi-mt76-rework-wed-rx-flow.patch
index 2b0701a..050c6f2 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2000-wifi-mt76-rework-wed-rx-flow.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2000-wifi-mt76-rework-wed-rx-flow.patch
@@ -1,7 +1,7 @@
-From 0d65df1371fce544fe40c7458ed572a9cb813a48 Mon Sep 17 00:00:00 2001
+From 06c6ad7b99c07aedc5403506c91cbb8e11cf95df Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Feb 2023 13:37:23 +0800
-Subject: [PATCH 2000/2012] wifi: mt76: rework wed rx flow
+Subject: [PATCH 2000/2008] wifi: mt76: rework wed rx flow
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 Change-Id: Icd787345c811cb5ad30d9c7c1c5f9e5298bd3be6
@@ -16,10 +16,10 @@
  7 files changed, 90 insertions(+), 70 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index f5091a35b..8182f6dc4 100644
+index e1e9062b..35db73b9 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -64,17 +64,17 @@ mt76_alloc_txwi(struct mt76_dev *dev)
+@@ -59,17 +59,17 @@ mt76_alloc_txwi(struct mt76_dev *dev)
  	return t;
  }
  
@@ -43,7 +43,7 @@
  }
  
  static struct mt76_txwi_cache *
-@@ -93,20 +93,20 @@ __mt76_get_txwi(struct mt76_dev *dev)
+@@ -88,20 +88,20 @@ __mt76_get_txwi(struct mt76_dev *dev)
  	return t;
  }
  
@@ -71,7 +71,7 @@
  }
  
  static struct mt76_txwi_cache *
-@@ -120,13 +120,13 @@ mt76_get_txwi(struct mt76_dev *dev)
+@@ -115,13 +115,13 @@ mt76_get_txwi(struct mt76_dev *dev)
  	return mt76_alloc_txwi(dev);
  }
  
@@ -89,7 +89,7 @@
  
  	return mt76_alloc_rxwi(dev);
  }
-@@ -145,14 +145,14 @@ mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t)
+@@ -140,14 +140,14 @@ mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t)
  EXPORT_SYMBOL_GPL(mt76_put_txwi);
  
  void
@@ -109,7 +109,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_put_rxwi);
  
-@@ -173,13 +173,13 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
+@@ -168,13 +168,13 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
  void
  mt76_free_pending_rxwi(struct mt76_dev *dev)
  {
@@ -128,7 +128,7 @@
  	}
  	local_bh_enable();
  }
-@@ -217,7 +217,7 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -212,7 +212,7 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
  {
  	struct mt76_desc *desc = &q->desc[q->head];
  	struct mt76_queue_entry *entry = &q->entry[q->head];
@@ -137,7 +137,7 @@
  	u32 buf1 = 0, ctrl;
  	int idx = q->head;
  	int rx_token;
-@@ -225,13 +225,13 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -220,13 +220,13 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
  	ctrl = FIELD_PREP(MT_DMA_CTL_SD_LEN0, buf[0].len);
  
  	if (mt76_queue_is_wed_rx(q)) {
@@ -155,7 +155,7 @@
  			return -ENOMEM;
  		}
  
-@@ -246,7 +246,7 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -241,7 +241,7 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
  
  	entry->dma_addr[0] = buf->addr;
  	entry->dma_len[0] = buf->len;
@@ -164,7 +164,7 @@
  	entry->buf = data;
  	entry->wcid = 0xffff;
  	entry->skip_buf1 = true;
-@@ -406,20 +406,20 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -404,20 +404,20 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  	if (mt76_queue_is_wed_rx(q)) {
  		u32 buf1 = le32_to_cpu(desc->buf1);
  		u32 token = FIELD_GET(MT_DMA_CTL_TOKEN, buf1);
@@ -192,7 +192,7 @@
  
  		if (drop) {
  			u32 ctrl = le32_to_cpu(READ_ONCE(desc->ctrl));
-@@ -979,16 +979,19 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
+@@ -977,16 +977,19 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
  	mt76_for_each_q_rx(dev, i) {
  		struct mt76_queue *q = &dev->q_rx[i];
  
@@ -216,10 +216,10 @@
  }
  EXPORT_SYMBOL_GPL(mt76_dma_cleanup);
 diff --git a/mac80211.c b/mac80211.c
-index ef4b83244..abad16f31 100644
+index 6430e6ee..5a203d31 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -617,7 +617,6 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
+@@ -613,7 +613,6 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
  	spin_lock_init(&dev->lock);
  	spin_lock_init(&dev->cc_lock);
  	spin_lock_init(&dev->status_lock);
@@ -227,7 +227,7 @@
  	mutex_init(&dev->mutex);
  	init_waitqueue_head(&dev->tx_wait);
  
-@@ -650,6 +649,7 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
+@@ -644,6 +643,7 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
  	INIT_LIST_HEAD(&dev->txwi_cache);
  	INIT_LIST_HEAD(&dev->rxwi_cache);
  	dev->token_size = dev->drv->token_size;
@@ -236,7 +236,7 @@
  	for (i = 0; i < ARRAY_SIZE(dev->q_rx); i++)
  		skb_queue_head_init(&dev->rx_skb[i]);
 diff --git a/mt76.h b/mt76.h
-index 9f84389b7..99756dce2 100644
+index 8abb6f41..72c3eb8f 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -180,6 +180,7 @@ struct mt76_queue_entry {
@@ -247,7 +247,7 @@
  		struct urb *urb;
  		int buf_sz;
  	};
-@@ -377,10 +378,14 @@ struct mt76_txwi_cache {
+@@ -371,10 +372,14 @@ struct mt76_txwi_cache {
  	struct list_head list;
  	dma_addr_t dma_addr;
  
@@ -266,7 +266,7 @@
  };
  
  struct mt76_rx_tid {
-@@ -466,6 +471,7 @@ struct mt76_driver_ops {
+@@ -460,6 +465,7 @@ struct mt76_driver_ops {
  	u16 txwi_size;
  	u16 token_size;
  	u8 mcs_rates;
@@ -274,7 +274,7 @@
  
  	void (*update_survey)(struct mt76_phy *phy);
  
-@@ -824,7 +830,6 @@ struct mt76_dev {
+@@ -810,7 +816,6 @@ struct mt76_dev {
  
  	struct ieee80211_hw *hw;
  
@@ -282,7 +282,7 @@
  	spinlock_t lock;
  	spinlock_t cc_lock;
  
-@@ -1473,8 +1478,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1360,8 +1365,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  }
  
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
@@ -293,7 +293,7 @@
  void mt76_free_pending_rxwi(struct mt76_dev *dev);
  void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
  		      struct napi_struct *napi);
-@@ -1628,9 +1633,9 @@ struct mt76_txwi_cache *
+@@ -1515,9 +1520,9 @@ struct mt76_txwi_cache *
  mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
  int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
  void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
@@ -306,10 +306,10 @@
  static inline void mt76_put_page_pool_buf(void *buf, bool allow_direct)
  {
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 59a44d79a..326c8c8c1 100644
+index 86a93ded..848e9843 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
-@@ -509,7 +509,6 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+@@ -493,7 +493,6 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
  		    mtk_wed_get_rx_capa(&mdev->mmio.wed)) {
  			dev->mt76.q_rx[MT_RXQ_MAIN].flags =
  				MT_WED_Q_RX(MT7915_RXQ_BAND0);
@@ -317,7 +317,7 @@
  		}
  
  		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_MAIN],
-@@ -546,7 +545,6 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+@@ -530,7 +529,6 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
  		    mtk_wed_get_rx_capa(&mdev->mmio.wed)) {
  			dev->mt76.q_rx[MT_RXQ_BAND1].flags =
  				MT_WED_Q_RX(MT7915_RXQ_BAND1);
@@ -326,10 +326,10 @@
  
  		/* rx data queue for band1 */
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index fc7ace638..a38109497 100644
+index 984b5f60..46256842 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -574,16 +574,28 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
+@@ -600,16 +600,28 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
  
  	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
  	for (i = 0; i < dev->mt76.rx_token_size; i++) {
@@ -364,7 +364,7 @@
  	}
  
  	mt76_free_pending_rxwi(&dev->mt76);
-@@ -786,7 +798,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -812,7 +824,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  	wed->wlan.reset = mt7915_mmio_wed_reset;
  	wed->wlan.reset_complete = mt7915_mmio_wed_reset_complete;
  
@@ -373,7 +373,7 @@
  
  	if (mtk_wed_device_attach(wed))
  		return 0;
-@@ -992,6 +1004,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
+@@ -1018,6 +1030,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
  				SURVEY_INFO_TIME_RX |
  				SURVEY_INFO_TIME_BSS_RX,
  		.token_size = MT7915_TOKEN_SIZE,
@@ -382,7 +382,7 @@
  		.tx_complete_skb = mt76_connac_tx_complete_skb,
  		.rx_skb = mt7915_queue_rx_skb,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index d317c523b..91eb5ad0f 100644
+index 103cd0d7..8ee62f63 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -62,6 +62,7 @@
@@ -394,10 +394,10 @@
  #define MT7915_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
  #define MT7915_CFEND_RATE_11B		0x03	/* 11B LP, 11M */
 diff --git a/tx.c b/tx.c
-index 1809b0329..74bf0de12 100644
+index 72b3ec71..6cb71f34 100644
 --- a/tx.c
 +++ b/tx.c
-@@ -843,16 +843,16 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
+@@ -761,16 +761,16 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
  EXPORT_SYMBOL_GPL(mt76_token_consume);
  
  int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
@@ -418,7 +418,7 @@
  	}
  	spin_unlock_bh(&dev->rx_token_lock);
  
-@@ -889,15 +889,15 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
+@@ -807,15 +807,15 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
  }
  EXPORT_SYMBOL_GPL(mt76_token_release);
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2001-wifi-mt76-revert-page_poll-for-kernel-5.4.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2001-wifi-mt76-revert-page_poll-for-kernel-5.4.patch
index bcd1fe8..58605d3 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2001-wifi-mt76-revert-page_poll-for-kernel-5.4.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2001-wifi-mt76-revert-page_poll-for-kernel-5.4.patch
@@ -1,7 +1,7 @@
-From 43dacb36843a57b2c42ab7846ff853c3c04260b7 Mon Sep 17 00:00:00 2001
+From 15b04fc966aa8f30492726132a6b81466b187581 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Feb 2023 19:49:22 +0800
-Subject: [PATCH 2001/2012] wifi: mt76: revert page_poll for kernel 5.4
+Subject: [PATCH 2001/2008] wifi: mt76: revert page_poll for kernel 5.4
 
 This reverts commit e8c10835cf062c577ddf426913788c39d30b4bd7.
 
@@ -12,14 +12,15 @@
  mt76.h        | 22 +--------------
  mt7915/main.c | 26 +++++++----------
  mt7915/mmio.c | 55 ++++++++++++++++++++++--------------
+ mt7921/main.c | 31 +++-----------------
  usb.c         | 43 ++++++++++++++--------------
- 6 files changed, 111 insertions(+), 170 deletions(-)
+ 7 files changed, 115 insertions(+), 197 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 8182f6dc4..3785425b4 100644
+index 35db73b9..7153be47 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -178,7 +178,7 @@ mt76_free_pending_rxwi(struct mt76_dev *dev)
+@@ -173,7 +173,7 @@ mt76_free_pending_rxwi(struct mt76_dev *dev)
  	local_bh_disable();
  	while ((r = __mt76_get_rxwi(dev)) != NULL) {
  		if (r->ptr)
@@ -28,7 +29,7 @@
  		kfree(r);
  	}
  	local_bh_enable();
-@@ -411,9 +411,9 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -409,9 +409,9 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  		if (!r)
  			return NULL;
  
@@ -41,7 +42,7 @@
  
  		buf = r->ptr;
  		r->dma_addr = 0;
-@@ -432,9 +432,9 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -430,9 +430,9 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  	} else {
  		buf = e->buf;
  		e->buf = NULL;
@@ -54,7 +55,7 @@
  	}
  
  	return buf;
-@@ -594,11 +594,11 @@ free_skb:
+@@ -592,11 +592,11 @@ free_skb:
  }
  
  static int
@@ -69,7 +70,7 @@
  
  	if (!q->ndesc)
  		return 0;
-@@ -606,25 +606,26 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -604,25 +604,26 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
  	spin_lock_bh(&q->lock);
  
  	while (q->queued < q->ndesc - 1) {
@@ -106,7 +107,7 @@
  			break;
  		}
  		frames++;
-@@ -668,7 +669,7 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
+@@ -666,7 +667,7 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
  		/* WED txfree queue needs ring to be initialized before setup */
  		q->flags = 0;
  		mt76_dma_queue_reset(dev, q);
@@ -115,7 +116,7 @@
  		q->flags = flags;
  
  		ret = mtk_wed_device_txfree_ring_setup(wed, q->regs);
-@@ -716,10 +717,6 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -714,10 +715,6 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  	if (!q->entry)
  		return -ENOMEM;
  
@@ -126,7 +127,7 @@
  	ret = mt76_dma_wed_setup(dev, q, false);
  	if (ret)
  		return ret;
-@@ -733,6 +730,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -731,6 +728,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  static void
  mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  {
@@ -134,7 +135,7 @@
  	void *buf;
  	bool more;
  
-@@ -746,7 +744,10 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -744,7 +742,10 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  		if (!buf)
  			break;
  
@@ -146,7 +147,7 @@
  	} while (1);
  
  	if (q->rx_head) {
-@@ -755,6 +756,18 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -753,6 +754,18 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  	}
  
  	spin_unlock_bh(&q->lock);
@@ -165,7 +166,7 @@
  }
  
  static void
-@@ -775,7 +788,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
+@@ -773,7 +786,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
  	mt76_dma_wed_setup(dev, q, true);
  	if (q->flags != MT_WED_Q_TXFREE) {
  		mt76_dma_sync_idx(dev, q);
@@ -174,7 +175,7 @@
  	}
  }
  
-@@ -793,7 +806,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
+@@ -791,7 +804,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
  
  		skb_add_rx_frag(skb, nr_frags, page, offset, len, q->buf_size);
  	} else {
@@ -183,7 +184,7 @@
  	}
  
  	if (more)
-@@ -866,7 +879,6 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+@@ -864,7 +877,6 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  			goto free_frag;
  
  		skb_reserve(skb, q->buf_offset);
@@ -191,7 +192,7 @@
  
  		*(u32 *)skb->cb = info;
  
-@@ -882,10 +894,10 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+@@ -880,10 +892,10 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  		continue;
  
  free_frag:
@@ -204,7 +205,7 @@
  	return done;
  }
  
-@@ -930,7 +942,7 @@ mt76_dma_init(struct mt76_dev *dev,
+@@ -928,7 +940,7 @@ mt76_dma_init(struct mt76_dev *dev,
  
  	mt76_for_each_q_rx(dev, i) {
  		netif_napi_add(&dev->napi_dev, &dev->napi[i], poll);
@@ -213,7 +214,7 @@
  		napi_enable(&dev->napi[i]);
  	}
  
-@@ -984,8 +996,6 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
+@@ -982,8 +994,6 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
  
  		netif_napi_del(&dev->napi[i]);
  		mt76_dma_rx_cleanup(dev, q);
@@ -223,7 +224,7 @@
  
  	if (mtk_wed_device_active(&dev->mmio.wed))
 diff --git a/mac80211.c b/mac80211.c
-index abad16f31..7cd9b6fc7 100644
+index 5a203d31..f7578308 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -4,7 +4,6 @@
@@ -234,7 +235,7 @@
  #include "mt76.h"
  
  static const struct ieee80211_channel mt76_channels_2ghz[] = {
-@@ -546,47 +545,6 @@ void mt76_unregister_phy(struct mt76_phy *phy)
+@@ -542,47 +541,6 @@ void mt76_unregister_phy(struct mt76_phy *phy)
  }
  EXPORT_SYMBOL_GPL(mt76_unregister_phy);
  
@@ -282,7 +283,7 @@
  struct mt76_dev *
  mt76_alloc_device(struct device *pdev, unsigned int size,
  		  const struct ieee80211_ops *ops,
-@@ -1785,21 +1743,6 @@ void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
+@@ -1728,21 +1686,6 @@ void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
  }
  EXPORT_SYMBOL_GPL(mt76_ethtool_worker);
  
@@ -305,7 +306,7 @@
  {
  	struct ieee80211_hw *hw = phy->hw;
 diff --git a/mt76.h b/mt76.h
-index 99756dce2..5243741b5 100644
+index 72c3eb8f..a0c20d36 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -224,7 +224,7 @@ struct mt76_queue {
@@ -317,7 +318,7 @@
  };
  
  struct mt76_mcu_ops {
-@@ -1523,7 +1523,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
+@@ -1410,7 +1410,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
  	return usb_bulk_msg(udev, pipe, data, len, actual_len, timeout);
  }
  
@@ -325,7 +326,7 @@
  void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
  			 struct mt76_sta_stats *stats, bool eht);
  int mt76_skb_adjust_pad(struct sk_buff *skb, int pad);
-@@ -1636,25 +1635,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
+@@ -1523,25 +1522,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
  struct mt76_rxwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
  int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
  			  struct mt76_rxwi_cache *r, dma_addr_t phys);
@@ -352,21 +353,21 @@
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
 diff --git a/mt7915/main.c b/mt7915/main.c
-index a3fd54cc1..796cd5f04 100644
+index 8ce7b1c5..fbff908f 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1397,22 +1397,19 @@ void mt7915_get_et_strings(struct ieee80211_hw *hw,
+@@ -1289,22 +1289,19 @@ void mt7915_get_et_strings(struct ieee80211_hw *hw,
  			   struct ieee80211_vif *vif,
  			   u32 sset, u8 *data)
  {
 -	if (sset != ETH_SS_STATS)
 -		return;
 -
--	memcpy(data, mt7915_gstrings_stats, sizeof(mt7915_gstrings_stats));
+-	memcpy(data, *mt7915_gstrings_stats, sizeof(mt7915_gstrings_stats));
 -	data += sizeof(mt7915_gstrings_stats);
 -	page_pool_ethtool_stats_get_strings(data);
 +	if (sset == ETH_SS_STATS)
-+		memcpy(data, mt7915_gstrings_stats,
++		memcpy(data, *mt7915_gstrings_stats,
 +		       sizeof(mt7915_gstrings_stats));
  }
  
@@ -384,16 +385,16 @@
  }
  
  static void mt7915_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
-@@ -1440,7 +1437,7 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
- 		.idx = mvif->mt76.idx,
+@@ -1332,7 +1329,7 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
  	};
+ 	struct mib_stats *mib = &phy->mib;
  	/* See mt7915_ampdu_stat_read_phy, etc */
 -	int i, ei = 0, stats_size;
 +	int i, ei = 0;
  
  	mutex_lock(&dev->mt76.mutex);
  
-@@ -1552,12 +1549,9 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
+@@ -1413,12 +1410,9 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
  		return;
  
  	ei += wi.worker_stat_count;
@@ -410,10 +411,10 @@
  
  static void
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index a38109497..a28ab0290 100644
+index 46256842..8ff2c70c 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -570,9 +570,13 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
+@@ -596,9 +596,13 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
  static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
  {
  	struct mt7915_dev *dev;
@@ -427,7 +428,7 @@
  	for (i = 0; i < dev->mt76.rx_token_size; i++) {
  		struct mt76_rxwi_cache *r;
  
-@@ -580,7 +584,9 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
+@@ -606,7 +610,9 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
  		if (!r || !r->ptr)
  			continue;
  
@@ -438,7 +439,7 @@
  		r->ptr = NULL;
  
  		mt76_put_rxwi(&dev->mt76, r);
-@@ -604,38 +610,47 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
+@@ -630,38 +636,47 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
  static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
  {
  	struct mtk_rxbm_desc *desc = wed->rx_buf_ring.desc;
@@ -504,7 +505,7 @@
  			goto unmap;
  		}
  
-@@ -647,8 +662,6 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+@@ -673,8 +688,6 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
  	return 0;
  
  unmap:
@@ -513,8 +514,74 @@
  	mt7915_mmio_wed_release_rx_buf(wed);
  	return -ENOMEM;
  }
+diff --git a/mt7921/main.c b/mt7921/main.c
+index 3b6adb29..47eb38e4 100644
+--- a/mt7921/main.c
++++ b/mt7921/main.c
+@@ -1083,34 +1083,17 @@ static void
+ mt7921_get_et_strings(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		      u32 sset, u8 *data)
+ {
+-	struct mt7921_dev *dev = mt7921_hw_dev(hw);
+-
+ 	if (sset != ETH_SS_STATS)
+ 		return;
+ 
+ 	memcpy(data, *mt7921_gstrings_stats, sizeof(mt7921_gstrings_stats));
+-
+-	if (mt76_is_sdio(&dev->mt76))
+-		return;
+-
+-	data += sizeof(mt7921_gstrings_stats);
+-	page_pool_ethtool_stats_get_strings(data);
+ }
+ 
+ static int
+ mt7921_get_et_sset_count(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 			 int sset)
+ {
+-	struct mt7921_dev *dev = mt7921_hw_dev(hw);
+-
+-	if (sset != ETH_SS_STATS)
+-		return 0;
+-
+-	if (mt76_is_sdio(&dev->mt76))
+-		return ARRAY_SIZE(mt7921_gstrings_stats);
+-
+-	return ARRAY_SIZE(mt7921_gstrings_stats) +
+-	       page_pool_ethtool_stats_get_count();
++	return sset == ETH_SS_STATS ? ARRAY_SIZE(mt7921_gstrings_stats) : 0;
+ }
+ 
+ static void
+@@ -1130,7 +1113,6 @@ void mt7921_get_et_stats(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 			 struct ethtool_stats *stats, u64 *data)
+ {
+ 	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
+-	int stats_size = ARRAY_SIZE(mt7921_gstrings_stats);
+ 	struct mt7921_phy *phy = mt7921_hw_phy(hw);
+ 	struct mt7921_dev *dev = phy->dev;
+ 	struct mib_stats *mib = &phy->mib;
+@@ -1186,14 +1168,9 @@ void mt7921_get_et_stats(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		return;
+ 
+ 	ei += wi.worker_stat_count;
+-
+-	if (!mt76_is_sdio(&dev->mt76)) {
+-		mt76_ethtool_page_pool_stats(&dev->mt76, &data[ei], &ei);
+-		stats_size += page_pool_ethtool_stats_get_count();
+-	}
+-
+-	if (ei != stats_size)
+-		dev_err(dev->mt76.dev, "ei: %d  SSTATS_LEN: %d", ei, stats_size);
++	if (ei != ARRAY_SIZE(mt7921_gstrings_stats))
++		dev_err(dev->mt76.dev, "ei: %d  SSTATS_LEN: %zu",
++			ei, ARRAY_SIZE(mt7921_gstrings_stats));
+ }
+ 
+ static u64
 diff --git a/usb.c b/usb.c
-index 5e5c7bf51..3e281715f 100644
+index 5e5c7bf5..3e281715 100644
 --- a/usb.c
 +++ b/usb.c
 @@ -319,27 +319,29 @@ mt76u_set_endpoints(struct usb_interface *intf,
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2002-wifi-mt76-wed-change-wed-token-init-size-to-adapt-we.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2002-wifi-mt76-wed-change-wed-token-init-size-to-adapt-we.patch
index 0cd7322..21f5e83 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2002-wifi-mt76-wed-change-wed-token-init-size-to-adapt-we.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2002-wifi-mt76-wed-change-wed-token-init-size-to-adapt-we.patch
@@ -1,7 +1,7 @@
-From 522991328e51d164645d002c0b51d010a31a05df Mon Sep 17 00:00:00 2001
+From 2ced3e3d33ef919332226f09a214ef2b04555a6d Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Wed, 19 Apr 2023 17:13:41 +0800
-Subject: [PATCH 2002/2012] wifi: mt76: wed: change wed token init size to
+Subject: [PATCH 2002/2008] wifi: mt76: wed: change wed token init size to
  adapt wed3.0
 
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 7 insertions(+), 3 deletions(-)
 
 diff --git a/tx.c b/tx.c
-index 74bf0de12..3857c2af6 100644
+index 6cb71f34..618c99a1 100644
 --- a/tx.c
 +++ b/tx.c
-@@ -819,12 +819,16 @@ EXPORT_SYMBOL_GPL(__mt76_set_tx_blocked);
+@@ -737,12 +737,16 @@ EXPORT_SYMBOL_GPL(__mt76_set_tx_blocked);
  
  int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
  {
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2003-wifi-mt76-mt7996-wed-add-wed3.0-tx-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2003-wifi-mt76-mt7996-wed-add-wed3.0-tx-support.patch
index 335c634..feb77a6 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2003-wifi-mt76-mt7996-wed-add-wed3.0-tx-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2003-wifi-mt76-mt7996-wed-add-wed3.0-tx-support.patch
@@ -1,24 +1,24 @@
-From fce79d49d2edfd81d8db74e0093b993cb2aff1ca Mon Sep 17 00:00:00 2001
+From d9167faacb2a8466e2d19993f29b2c0770c5164e Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
-Date: Mon, 7 Aug 2023 20:05:49 +0800
-Subject: [PATCH 2003/2012] wifi: mt76: mt7996: wed: add wed3.0 tx support
+Date: Wed, 26 Apr 2023 16:44:57 +0800
+Subject: [PATCH 2003/2008] wifi: mt76: mt7996: wed: add wed3.0 tx support
 
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
 ---
  dma.c           |  17 ++-
  mt76.h          |   7 ++
- mt7996/dma.c    | 126 ++++++++++++++++++---
+ mt7996/dma.c    | 128 ++++++++++++++++++---
  mt7996/init.c   |  21 +++-
  mt7996/mac.c    |  29 ++++-
  mt7996/main.c   |  46 ++++++++
  mt7996/mmio.c   | 295 +++++++++++++++++++++++++++++++++++++++++++++---
- mt7996/mt7996.h |   9 +-
- mt7996/pci.c    |  46 ++++++--
+ mt7996/mt7996.h |   8 +-
+ mt7996/pci.c    |  72 +++++++++---
  mt7996/regs.h   |   5 +
- 10 files changed, 546 insertions(+), 55 deletions(-)
+ 10 files changed, 567 insertions(+), 61 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 3785425b4..c2dbe6f6b 100644
+index 7153be47..930ec768 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -13,6 +13,11 @@
@@ -45,7 +45,7 @@
  		mtk_wed_device_reg_write(&(_dev)->mmio.wed,		\
  					 ((_q)->wed_regs + _offset),	\
  					 _val);				\
-@@ -656,6 +666,9 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
+@@ -654,6 +664,9 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
  	if (!(q->flags & MT_QFLAG_WED))
  		return 0;
  
@@ -55,7 +55,7 @@
  	type = FIELD_GET(MT_QFLAG_WED_TYPE, q->flags);
  	ring = FIELD_GET(MT_QFLAG_WED_RING, q->flags);
  
-@@ -721,7 +734,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -719,7 +732,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  	if (ret)
  		return ret;
  
@@ -64,7 +64,7 @@
  		mt76_dma_queue_reset(dev, q);
  
  	return 0;
-@@ -1001,6 +1014,8 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
+@@ -999,6 +1012,8 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
  	if (mtk_wed_device_active(&dev->mmio.wed))
  		mtk_wed_device_detach(&dev->mmio.wed);
  
@@ -74,7 +74,7 @@
  	mt76_free_pending_rxwi(dev);
  }
 diff --git a/mt76.h b/mt76.h
-index 5243741b5..3b2a658db 100644
+index a0c20d36..ee0dbdd7 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -51,6 +51,7 @@
@@ -85,7 +85,7 @@
  
  #define __MT_WED_Q(_type, _n)	(MT_QFLAG_WED | \
  				 FIELD_PREP(MT_QFLAG_WED_TYPE, _type) | \
-@@ -629,6 +630,7 @@ struct mt76_mmio {
+@@ -623,6 +624,7 @@ struct mt76_mmio {
  	u32 irqmask;
  
  	struct mtk_wed_device wed;
@@ -93,7 +93,7 @@
  	struct completion wed_reset;
  	struct completion wed_reset_complete;
  };
-@@ -1627,6 +1629,11 @@ static inline bool mt76_queue_is_wed_rx(struct mt76_queue *q)
+@@ -1514,6 +1516,11 @@ static inline bool mt76_queue_is_wed_rx(struct mt76_queue *q)
  	return (q->flags & MT_QFLAG_WED) &&
  	       FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX;
  }
@@ -106,7 +106,7 @@
  struct mt76_txwi_cache *
  mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
 diff --git a/mt7996/dma.c b/mt7996/dma.c
-index 2e75d2794..3c8f617e0 100644
+index b8f253d0..673b08bb 100644
 --- a/mt7996/dma.c
 +++ b/mt7996/dma.c
 @@ -7,6 +7,25 @@
@@ -135,16 +135,16 @@
  static int mt7996_poll_tx(struct napi_struct *napi, int budget)
  {
  	struct mt7996_dev *dev;
-@@ -140,7 +159,7 @@ static void mt7996_dma_disable(struct mt7996_dev *dev, bool reset)
+@@ -128,7 +147,7 @@ static void mt7996_dma_disable(struct mt7996_dev *dev, bool reset)
  	}
  }
  
--void mt7996_dma_start(struct mt7996_dev *dev, bool reset)
-+void mt7996_dma_start(struct mt7996_dev *dev, bool reset, bool wed_reset)
+-void __mt7996_dma_enable(struct mt7996_dev *dev, bool reset)
++void __mt7996_dma_enable(struct mt7996_dev *dev, bool reset, bool wed_reset)
  {
  	u32 hif1_ofs = 0;
  	u32 irq_mask;
-@@ -165,11 +184,7 @@ void mt7996_dma_start(struct mt7996_dev *dev, bool reset)
+@@ -153,11 +172,9 @@ void __mt7996_dma_enable(struct mt7996_dev *dev, bool reset)
  	}
  
  	/* enable interrupts for TX/RX rings */
@@ -152,12 +152,14 @@
 -	if (reset)
 -		goto done;
 -
--	irq_mask = MT_INT_RX_DONE_MCU | MT_INT_TX_DONE_MCU;
-+	irq_mask = MT_INT_MCU_CMD | MT_INT_RX_DONE_MCU | MT_INT_TX_DONE_MCU;
+-	irq_mask |= (MT_INT_RX_DONE_MCU | MT_INT_TX_DONE_MCU);
++	irq_mask = MT_INT_MCU_CMD |
++			   MT_INT_RX_DONE_MCU |
++			   MT_INT_TX_DONE_MCU;
  
  	if (mt7996_band_valid(dev, MT_BAND0))
  		irq_mask |= MT_INT_BAND0_RX_DONE;
-@@ -180,7 +195,18 @@ void mt7996_dma_start(struct mt7996_dev *dev, bool reset)
+@@ -168,7 +185,18 @@ void __mt7996_dma_enable(struct mt7996_dev *dev, bool reset)
  	if (mt7996_band_valid(dev, MT_BAND2))
  		irq_mask |= MT_INT_BAND2_RX_DONE;
  
@@ -177,7 +179,7 @@
  	mt7996_irq_enable(dev, irq_mask);
  	mt7996_irq_disable(dev, 0);
  }
-@@ -270,17 +296,22 @@ static void mt7996_dma_enable(struct mt7996_dev *dev, bool reset)
+@@ -241,19 +269,24 @@ static int mt7996_dma_enable(struct mt7996_dev *dev, bool reset)
  		/* fix hardware limitation, pcie1's rx ring3 is not available
  		 * so, redirect pcie0 rx ring3 interrupt to pcie1
  		 */
@@ -193,8 +195,10 @@
 +				 MT_WFDMA0_RX_INT_SEL_RING3);
  	}
  
--	mt7996_dma_start(dev, reset);
-+	mt7996_dma_start(dev, reset, true);
+-	__mt7996_dma_enable(dev, reset);
++	__mt7996_dma_enable(dev, reset, true);
+ 
+ 	return 0;
  }
  
  int mt7996_dma_init(struct mt7996_dev *dev)
@@ -205,7 +209,7 @@
  	u32 hif1_ofs = 0;
  	int ret;
  
-@@ -294,10 +325,11 @@ int mt7996_dma_init(struct mt7996_dev *dev)
+@@ -267,10 +300,11 @@ int mt7996_dma_init(struct mt7996_dev *dev)
  	mt7996_dma_disable(dev, true);
  
  	/* init tx queue */
@@ -221,7 +225,7 @@
  	if (ret)
  		return ret;
  
-@@ -353,6 +385,9 @@ int mt7996_dma_init(struct mt7996_dev *dev)
+@@ -326,6 +360,9 @@ int mt7996_dma_init(struct mt7996_dev *dev)
  		return ret;
  
  	/* tx free notify event from WA for band0 */
@@ -231,7 +235,7 @@
  	ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_MAIN_WA],
  			       MT_RXQ_ID(MT_RXQ_MAIN_WA),
  			       MT7996_RX_MCU_RING_SIZE,
-@@ -363,17 +398,24 @@ int mt7996_dma_init(struct mt7996_dev *dev)
+@@ -336,17 +373,24 @@ int mt7996_dma_init(struct mt7996_dev *dev)
  
  	if (mt7996_band_valid(dev, MT_BAND2)) {
  		/* rx data queue for band2 */
@@ -257,7 +261,7 @@
  		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_BAND2_WA],
  				       MT_RXQ_ID(MT_RXQ_BAND2_WA),
  				       MT7996_RX_MCU_RING_SIZE,
-@@ -383,6 +425,56 @@ int mt7996_dma_init(struct mt7996_dev *dev)
+@@ -356,6 +400,56 @@ int mt7996_dma_init(struct mt7996_dev *dev)
  			return ret;
  	}
  
@@ -315,10 +319,10 @@
  	if (ret < 0)
  		return ret;
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 5d8ecf038..f2d43d3dc 100644
+index a6caf4f1..6cfbc50d 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -540,6 +540,7 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
+@@ -534,6 +534,7 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
  	struct mt76_phy *mphy;
  	u32 mac_ofs, hif1_ofs = 0;
  	int ret;
@@ -326,7 +330,7 @@
  
  	if (!mt7996_band_valid(dev, band) || band == MT_BAND0)
  		return 0;
-@@ -547,8 +548,10 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
+@@ -541,8 +542,10 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
  	if (phy)
  		return 0;
  
@@ -338,7 +342,7 @@
  
  	mphy = mt76_alloc_phy(&dev->mt76, sizeof(*phy), &mt7996_ops, band);
  	if (!mphy)
-@@ -582,10 +585,11 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
+@@ -576,10 +579,11 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
  
  	/* init wiphy according to mphy and phy */
  	mt7996_init_wiphy(mphy->hw);
@@ -354,7 +358,7 @@
  	if (ret)
  		goto error;
  
-@@ -1126,6 +1130,13 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1119,6 +1123,13 @@ int mt7996_register_device(struct mt7996_dev *dev)
  
  	ieee80211_queue_work(mt76_hw(dev), &dev->init_work);
  
@@ -369,11 +373,11 @@
  
  	ret = mt7996_init_debugfs(&dev->phy);
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 04e14fa30..e57bdee21 100644
+index 993b43ce..fc2d9269 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1019,6 +1019,29 @@ out:
- 	mt76_put_txwi(mdev, t);
+@@ -1175,6 +1175,29 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 	return 0;
  }
  
 +u32 mt7996_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
@@ -400,9 +404,9 @@
 +}
 +
  static void
- mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+ mt7996_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  {
-@@ -1363,6 +1386,10 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+@@ -1561,6 +1584,10 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  
  	switch (type) {
  	case PKT_TYPE_TXRX_NOTIFY:
@@ -413,20 +417,20 @@
  		mt7996_mac_tx_free(dev, skb->data, skb->len);
  		napi_consume_skb(skb, 1);
  		break;
-@@ -1837,7 +1864,7 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2035,7 +2062,7 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	mt7996_wait_reset_state(dev, MT_MCU_CMD_NORMAL_STATE);
  
- 	/* enable DMA Tx/Tx and interrupt */
--	mt7996_dma_start(dev, false);
-+	mt7996_dma_start(dev, false, false);
+ 	/* enable dma tx/rx and interrupt */
+-	__mt7996_dma_enable(dev, false);
++	__mt7996_dma_enable(dev, false, false);
  
  	clear_bit(MT76_MCU_RESET, &dev->mphy.state);
  	clear_bit(MT76_RESET, &dev->mphy.state);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index a00ebf9e6..e6be05656 100644
+index f0bdec6b..50fa6523 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -1508,6 +1508,49 @@ out:
+@@ -1405,6 +1405,49 @@ out:
  	return ret;
  }
  
@@ -476,7 +480,7 @@
  const struct ieee80211_ops mt7996_ops = {
  	.tx = mt7996_tx,
  	.start = mt7996_start,
-@@ -1554,4 +1597,7 @@ const struct ieee80211_ops mt7996_ops = {
+@@ -1451,4 +1494,7 @@ const struct ieee80211_ops mt7996_ops = {
  	.sta_add_debugfs = mt7996_sta_add_debugfs,
  #endif
  	.set_radar_background = mt7996_set_radar_background,
@@ -485,7 +489,7 @@
 +#endif
  };
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index d5eaa1bcf..ad2482ef2 100644
+index 3a591a7b..b9e47e73 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
 @@ -10,6 +10,11 @@
@@ -500,8 +504,8 @@
  
  static const struct __base mt7996_reg_base[] = {
  	[WF_AGG_BASE]		= { { 0x820e2000, 0x820f2000, 0x830e2000 } },
-@@ -214,6 +219,228 @@ static u32 mt7996_rmw(struct mt76_dev *mdev, u32 offset, u32 mask, u32 val)
- 	return val;
+@@ -191,6 +196,228 @@ static u32 mt7996_rmw(struct mt76_dev *mdev, u32 offset, u32 mask, u32 val)
+ 	return dev->bus_ops->rmw(mdev, __mt7996_reg_addr(dev, offset), mask, val);
  }
  
 +#ifdef CONFIG_NET_MEDIATEK_SOC_WED
@@ -664,9 +668,9 @@
 +
 +		wed->wlan.wpdma_rx_glo = wed->wlan.phy_base + MT_WFDMA0_GLO_CFG;
 +
-+		wed->wlan.wpdma_rx[0] = wed->wlan.phy_base +
-+					MT_RXQ_RING_BASE(MT7996_RXQ_BAND0) +
-+					MT7996_RXQ_BAND0 * MT_RING_SIZE;
++		wed->wlan.wpdma_rx = wed->wlan.phy_base +
++				     MT_RXQ_RING_BASE(MT7996_RXQ_BAND0) +
++				     MT7996_RXQ_BAND0 * MT_RING_SIZE;
 +
 +		wed->wlan.rx_nbuf = 65536;
 +		wed->wlan.rx_npkt = 24576;
@@ -688,7 +692,7 @@
 +		}
 +	}
 +
-+	wed->wlan.nbuf = MT7996_TOKEN_SIZE;
++	wed->wlan.nbuf = 16384;
 +
 +	wed->wlan.token_start = 0;
 +
@@ -710,7 +714,7 @@
 +	*irq = wed->irq;
 +	dev->mt76.dma_dev = wed->dev;
 +
-+	dev->mt76.token_size = MT7996_SW_TOKEN_SIZE;
++	dev->mt76.token_size = 1024;
 +
 +	ret = dma_set_mask(wed->dev, DMA_BIT_MASK(32));
 +	if (ret)
@@ -729,7 +733,7 @@
  static int mt7996_mmio_init(struct mt76_dev *mdev,
  			    void __iomem *mem_base,
  			    u32 device_id)
-@@ -265,8 +492,17 @@ void mt7996_dual_hif_set_irq_mask(struct mt7996_dev *dev, bool write_reg,
+@@ -241,8 +468,17 @@ void mt7996_dual_hif_set_irq_mask(struct mt7996_dev *dev, bool write_reg,
  	mdev->mmio.irqmask |= set;
  
  	if (write_reg) {
@@ -749,7 +753,7 @@
  	}
  
  	spin_unlock_irqrestore(&mdev->mmio.irq_lock, flags);
-@@ -284,22 +520,36 @@ static void mt7996_rx_poll_complete(struct mt76_dev *mdev,
+@@ -260,22 +496,36 @@ static void mt7996_rx_poll_complete(struct mt76_dev *mdev,
  static void mt7996_irq_tasklet(struct tasklet_struct *t)
  {
  	struct mt7996_dev *dev = from_tasklet(dev, t, mt76.irq_tasklet);
@@ -799,7 +803,7 @@
  	}
  
  	trace_dev_irq(&dev->mt76, intr, dev->mt76.mmio.irqmask);
-@@ -331,10 +581,19 @@ static void mt7996_irq_tasklet(struct tasklet_struct *t)
+@@ -307,10 +557,19 @@ static void mt7996_irq_tasklet(struct tasklet_struct *t)
  irqreturn_t mt7996_irq_handler(int irq, void *dev_instance)
  {
  	struct mt7996_dev *dev = dev_instance;
@@ -823,29 +827,21 @@
  	if (!test_bit(MT76_STATE_INITIALIZED, &dev->mphy.state))
  		return IRQ_NONE;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 6447b2c90..d09358305 100644
+index e371964b..43f20da4 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -40,6 +40,7 @@
- #define MT7996_EEPROM_SIZE		7680
- #define MT7996_EEPROM_BLOCK_SIZE	16
- #define MT7996_TOKEN_SIZE		16384
-+#define MT7996_SW_TOKEN_SIZE		1024
- 
- #define MT7996_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
- #define MT7996_CFEND_RATE_11B		0x03	/* 11B LP, 11M */
-@@ -493,7 +494,9 @@ int mt7996_dma_init(struct mt7996_dev *dev);
+@@ -544,7 +544,9 @@ int mt7996_dma_init(struct mt7996_dev *dev);
  void mt7996_dma_reset(struct mt7996_dev *dev, bool force);
  void mt7996_dma_prefetch(struct mt7996_dev *dev);
  void mt7996_dma_cleanup(struct mt7996_dev *dev);
--void mt7996_dma_start(struct mt7996_dev *dev, bool reset);
+-void __mt7996_dma_enable(struct mt7996_dev *dev, bool reset);
 +int mt7996_init_tx_queues(struct mt7996_phy *phy, int idx,
 +			  int n_desc, int ring_base, struct mtk_wed_device *wed);
-+void mt7996_dma_start(struct mt7996_dev *dev, bool reset, bool wed_reset);
++void __mt7996_dma_enable(struct mt7996_dev *dev, bool reset, bool wed_reset);
  void mt7996_init_txpower(struct mt7996_dev *dev,
  			 struct ieee80211_supported_band *sband);
  int mt7996_txbf_init(struct mt7996_dev *dev);
-@@ -683,7 +686,9 @@ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
+@@ -732,7 +734,9 @@ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
  void mt7996_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			    struct ieee80211_sta *sta, struct dentry *dir);
  #endif
@@ -857,10 +853,10 @@
  void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif);
  void mt7996_vendor_register(struct mt7996_phy *phy);
 diff --git a/mt7996/pci.c b/mt7996/pci.c
-index c5301050f..085408571 100644
+index c5301050..869f32ac 100644
 --- a/mt7996/pci.c
 +++ b/mt7996/pci.c
-@@ -125,15 +125,22 @@ static int mt7996_pci_probe(struct pci_dev *pdev,
+@@ -125,15 +125,26 @@ static int mt7996_pci_probe(struct pci_dev *pdev,
  	mt7996_wfsys_reset(dev);
  	hif2 = mt7996_pci_init_hif2(pdev);
  
@@ -869,25 +865,30 @@
  	if (ret < 0)
 -		goto free_device;
 +		goto free_wed_or_irq_vector;
-+
+ 
+-	irq = pdev->irq;
+-	ret = devm_request_irq(mdev->dev, irq, mt7996_irq_handler,
 +	if (!ret) {
 +		ret = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_ALL_TYPES);
 +		if (ret < 0)
 +			goto free_device;
-+
-+		irq = pdev->irq;
 +	}
- 
--	irq = pdev->irq;
- 	ret = devm_request_irq(mdev->dev, irq, mt7996_irq_handler,
++	ret = devm_request_irq(mdev->dev, pdev->irq, mt7996_irq_handler,
  			       IRQF_SHARED, KBUILD_MODNAME, dev);
  	if (ret)
 -		goto free_irq_vector;
 +		goto free_wed_or_irq_vector;
++
++	if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
++		ret = devm_request_irq(mdev->dev, irq, mt7996_irq_handler,
++				       IRQF_SHARED, KBUILD_MODNAME "-wed", dev);
++		if (ret)
++			goto free_irq;
++	}
  
  	mt76_wr(dev, MT_INT_MASK_CSR, 0);
  	/* master switch of PCIe tnterrupt enable */
-@@ -143,11 +150,20 @@ static int mt7996_pci_probe(struct pci_dev *pdev,
+@@ -143,16 +154,30 @@ static int mt7996_pci_probe(struct pci_dev *pdev,
  		hif2_dev = container_of(hif2->dev, struct pci_dev, dev);
  		dev->hif2 = hif2;
  
@@ -895,25 +896,42 @@
 +		ret = mt7996_mmio_wed_init(dev, hif2_dev, true, &irq);
  		if (ret < 0)
 -			goto free_hif2;
-+			goto free_wed_or_irq_vector;
++			goto free_irq;
 +
 +		if (!ret) {
 +			ret = pci_alloc_irq_vectors(hif2_dev, 1, 1, PCI_IRQ_ALL_TYPES);
 +			if (ret < 0)
 +				goto free_hif2;
-+
+ 
+-		dev->hif2->irq = hif2_dev->irq;
+-		ret = devm_request_irq(mdev->dev, dev->hif2->irq,
+-				       mt7996_irq_handler, IRQF_SHARED,
+-				       KBUILD_MODNAME "-hif", dev);
 +			dev->hif2->irq = hif2_dev->irq;
-+		} else {
-+			dev->hif2->irq = irq;
++		}
++
++		ret = devm_request_irq(mdev->dev, hif2_dev->irq, mt7996_irq_handler,
++					IRQF_SHARED, KBUILD_MODNAME "-hif", dev);
+ 		if (ret)
+-			goto free_hif2_irq_vector;
++			goto free_hif2;
++
++		if (mtk_wed_device_active(&dev->mt76.mmio.wed_ext)) {
++			ret = devm_request_irq(mdev->dev, irq,
++					       mt7996_irq_handler, IRQF_SHARED,
++					       KBUILD_MODNAME "-wed-hif", dev);
++			if (ret)
++				goto free_hif2_irq_vector;
 +		}
  
--		dev->hif2->irq = hif2_dev->irq;
- 		ret = devm_request_irq(mdev->dev, dev->hif2->irq,
- 				       mt7996_irq_handler, IRQF_SHARED,
- 				       KBUILD_MODNAME "-hif", dev);
-@@ -169,14 +185,22 @@ free_hif2_irq:
+ 		mt76_wr(dev, MT_INT1_MASK_CSR, 0);
+ 		/* master switch of PCIe tnterrupt enable */
+@@ -168,15 +193,28 @@ static int mt7996_pci_probe(struct pci_dev *pdev,
+ free_hif2_irq:
  	if (dev->hif2)
  		devm_free_irq(mdev->dev, dev->hif2->irq, dev);
++	if (mtk_wed_device_active(&dev->mt76.mmio.wed_ext))
++		devm_free_irq(mdev->dev, dev->mt76.mmio.wed_ext.irq, dev);
  free_hif2_irq_vector:
 -	if (dev->hif2)
 -		pci_free_irq_vectors(hif2_dev);
@@ -926,9 +944,13 @@
  free_hif2:
  	if (dev->hif2)
  		put_device(dev->hif2->dev);
- 	devm_free_irq(mdev->dev, irq, dev);
+-	devm_free_irq(mdev->dev, irq, dev);
 -free_irq_vector:
 -	pci_free_irq_vectors(pdev);
++	if (mtk_wed_device_active(&dev->mt76.mmio.wed))
++		devm_free_irq(mdev->dev, dev->mt76.mmio.wed.irq, dev);
++free_irq:
++	devm_free_irq(mdev->dev, pdev->irq, dev);
 +free_wed_or_irq_vector:
 +	if (mtk_wed_device_active(&dev->mt76.mmio.wed))
 +		mtk_wed_device_detach(&dev->mt76.mmio.wed);
@@ -939,10 +961,10 @@
  	mt76_free_device(&dev->mt76);
  
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index e0b51b5df..ca7c2a811 100644
+index 6ef905a9..04658639 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
-@@ -330,6 +330,7 @@ enum base_rev {
+@@ -323,6 +323,7 @@ enum base_rev {
  
  #define MT_WFDMA0_RX_INT_PCIE_SEL		MT_WFDMA0(0x154)
  #define MT_WFDMA0_RX_INT_SEL_RING3		BIT(3)
@@ -950,7 +972,7 @@
  
  #define MT_WFDMA0_MCU_HOST_INT_ENA		MT_WFDMA0(0x1f4)
  
-@@ -383,6 +384,9 @@ enum base_rev {
+@@ -367,6 +368,9 @@ enum base_rev {
  #define MT_WFDMA0_PCIE1_BASE			0xd8000
  #define MT_WFDMA0_PCIE1(ofs)			(MT_WFDMA0_PCIE1_BASE + (ofs))
  
@@ -960,7 +982,7 @@
  #define MT_WFDMA0_PCIE1_BUSY_ENA		MT_WFDMA0_PCIE1(0x13c)
  #define MT_WFDMA0_PCIE1_BUSY_ENA_TX_FIFO0	BIT(0)
  #define MT_WFDMA0_PCIE1_BUSY_ENA_TX_FIFO1	BIT(1)
-@@ -428,6 +432,7 @@ enum base_rev {
+@@ -412,6 +416,7 @@ enum base_rev {
  #define MT_INT_RX_TXFREE_MAIN			BIT(17)
  #define MT_INT_RX_TXFREE_TRI			BIT(15)
  #define MT_INT_MCU_CMD				BIT(29)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2004-wifi-mt76-mt7996-wed-add-wed3.0-rx-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2004-wifi-mt76-mt7996-wed-add-wed3.0-rx-support.patch
index 2dc5574..9a003d7 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2004-wifi-mt76-mt7996-wed-add-wed3.0-rx-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2004-wifi-mt76-mt7996-wed-add-wed3.0-rx-support.patch
@@ -1,7 +1,7 @@
-From c9cbe5b9cc6e0d17352814aafe6514a6623bbd12 Mon Sep 17 00:00:00 2001
+From 017ed7925cbdfb41d3d85fed54a97cff9fcf2f78 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Feb 2023 13:50:56 +0800
-Subject: [PATCH 2004/2012] wifi: mt76: mt7996: wed: add wed3.0 rx support
+Subject: [PATCH] wifi: mt76: mt7996: wed: add wed3.0 rx support
 
 add hardware rro support, This is the preliminary patch for WED3.0 support.
 
@@ -9,25 +9,24 @@
 Change-Id: I7e113b1392bcf085ec02c8a44ffbb7cf7c3fa027
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
 ---
- dma.c           | 197 +++++++++++++++++++++++++++++++++++++-----------
+ dma.c           | 205 +++++++++++++++++++++++++++++++++++++-----------
  dma.h           |  12 +++
  mac80211.c      |   1 +
- mt76.h          |  63 ++++++++++++++--
- mt7996/dma.c    | 161 ++++++++++++++++++++++++++++++++++-----
- mt7996/init.c   | 130 ++++++++++++++++++++++++++++++--
- mt7996/mac.c    |  42 +++++++++--
+ mt76.h          |  63 +++++++++++++--
+ mt7996/dma.c    | 163 ++++++++++++++++++++++++++++++++------
+ mt7996/init.c   | 124 ++++++++++++++++++++++++++++-
+ mt7996/mac.c    |  42 ++++++++--
  mt7996/mcu.c    |   8 +-
- mt7996/mmio.c   |  44 +++++++++--
+ mt7996/mmio.c   |  36 +++++++--
  mt7996/mt7996.h |  58 ++++++++++++++
- mt7996/pci.c    |   3 +-
- mt7996/regs.h   |  69 ++++++++++++++++-
- 12 files changed, 693 insertions(+), 95 deletions(-)
+ mt7996/regs.h   |  63 ++++++++++++++-
+ 11 files changed, 683 insertions(+), 92 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index c2dbe6f6b..8097a3121 100644
+index 930ec768..e5b4d898 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -198,46 +198,65 @@ EXPORT_SYMBOL_GPL(mt76_free_pending_rxwi);
+@@ -193,46 +193,68 @@ EXPORT_SYMBOL_GPL(mt76_free_pending_rxwi);
  static void
  mt76_dma_sync_idx(struct mt76_dev *dev, struct mt76_queue *q)
  {
@@ -82,10 +81,13 @@
  	u32 buf1 = 0, ctrl;
  	int idx = q->head;
  	int rx_token;
- 
-+	if (mt76_queue_is_rro_ind(q))
-+		goto done;
++	void *e_buf = data;
 +
++	if (mt76_queue_is_rro_ind(q)) {
++		e_buf = &q->rro_desc[q->head];
++		goto done;
++	}
+ 
 +	desc = &q->desc[q->head];
  	ctrl = FIELD_PREP(MT_DMA_CTL_SD_LEN0, buf[0].len);
  
@@ -101,7 +103,7 @@
  
  		rx_token = mt76_rx_token_consume(dev, data, rxwi, buf->addr);
  		if (rx_token < 0) {
-@@ -254,6 +273,7 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -249,10 +271,11 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
  	WRITE_ONCE(desc->ctrl, cpu_to_le32(ctrl));
  	WRITE_ONCE(desc->info, 0);
  
@@ -109,7 +111,12 @@
  	entry->dma_addr[0] = buf->addr;
  	entry->dma_len[0] = buf->len;
  	entry->rxwi = rxwi;
-@@ -398,14 +418,15 @@ mt76_dma_tx_cleanup(struct mt76_dev *dev, struct mt76_queue *q, bool flush)
+-	entry->buf = data;
++	entry->buf = e_buf;
+ 	entry->wcid = 0xffff;
+ 	entry->skip_buf1 = true;
+ 	q->head = (q->head + 1) % q->ndesc;
+@@ -396,14 +419,18 @@ mt76_dma_tx_cleanup(struct mt76_dev *dev, struct mt76_queue *q, bool flush)
  
  static void *
  mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
@@ -118,16 +125,20 @@
  {
  	struct mt76_queue_entry *e = &q->entry[idx];
  	struct mt76_desc *desc = &q->desc[idx];
- 	void *buf;
+-	void *buf;
++	void *buf = e->buf;
 +	u32 ctrl;
  
++	if (mt76_queue_is_rro_ind(q))
++		goto done;
++
 +	ctrl = le32_to_cpu(READ_ONCE(desc->ctrl));
  	if (len) {
 -		u32 ctrl = le32_to_cpu(READ_ONCE(desc->ctrl));
  		*len = FIELD_GET(MT_DMA_CTL_SD_LEN0, ctrl);
  		*more = !(ctrl & MT_DMA_CTL_LAST_SEC0);
  	}
-@@ -413,6 +434,12 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -411,6 +438,12 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  	if (info)
  		*info = le32_to_cpu(desc->info);
  
@@ -140,7 +151,7 @@
  	if (mt76_queue_is_wed_rx(q)) {
  		u32 buf1 = le32_to_cpu(desc->buf1);
  		u32 token = FIELD_GET(MT_DMA_CTL_TOKEN, buf1);
-@@ -425,20 +452,46 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -423,28 +456,54 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  				 SKB_WITH_OVERHEAD(q->buf_size),
  				 DMA_FROM_DEVICE);
  
@@ -197,18 +208,29 @@
  			*drop |= !!(buf1 & MT_DMA_CTL_WO_DROP);
 -		}
  	} else {
- 		buf = e->buf;
- 		e->buf = NULL;
-@@ -460,15 +513,20 @@ mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
+-		buf = e->buf;
+-		e->buf = NULL;
+ 		dma_unmap_single(dev->dma_dev, e->dma_addr[0],
+ 				 SKB_WITH_OVERHEAD(q->buf_size),
+ 				 DMA_FROM_DEVICE);
+ 	}
+ 
++done:
++	e->buf = NULL;
+ 	return buf;
+ }
+ 
+@@ -458,15 +517,22 @@ mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
  	if (!q->queued)
  		return NULL;
  
 -	if (flush)
 -		q->desc[idx].ctrl |= cpu_to_le32(MT_DMA_CTL_DMA_DONE);
 -	else if (!(q->desc[idx].ctrl & cpu_to_le32(MT_DMA_CTL_DMA_DONE)))
--		return NULL;
-+	if (q->flags & MT_QFLAG_RRO) {
++	if (mt76_queue_is_rro_ind(q)) {
 +		goto done;
++	} else if (q->flags & MT_QFLAG_RRO) {
+ 		return NULL;
 +	} else {
 +		if (flush)
 +			q->desc[idx].ctrl |= cpu_to_le32(MT_DMA_CTL_DMA_DONE);
@@ -225,7 +247,7 @@
  }
  
  static int
-@@ -617,7 +675,10 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -615,7 +681,10 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  
  	while (q->queued < q->ndesc - 1) {
  		struct mt76_queue_buf qbuf;
@@ -237,7 +259,7 @@
  
  		buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
  		if (!buf)
-@@ -629,10 +690,11 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -627,10 +696,11 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  			break;
  		}
  
@@ -250,7 +272,7 @@
  			dma_unmap_single(dev->dma_dev, addr, len,
  					 DMA_FROM_DEVICE);
  			skb_free_frag(buf);
-@@ -641,7 +703,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -639,7 +709,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  		frames++;
  	}
  
@@ -259,7 +281,7 @@
  		mt76_dma_kick_queue(dev, q);
  
  	spin_unlock_bh(&q->lock);
-@@ -654,7 +716,7 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
+@@ -652,7 +722,7 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
  	struct mtk_wed_device *wed = &dev->mmio.wed;
  	int ret, type, ring;
@@ -268,7 +290,7 @@
  
  	if (!q || !q->ndesc)
  		return -EINVAL;
-@@ -681,7 +743,7 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
+@@ -679,7 +749,7 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
  	case MT76_WED_Q_TXFREE:
  		/* WED txfree queue needs ring to be initialized before setup */
  		q->flags = 0;
@@ -277,7 +299,7 @@
  		mt76_dma_rx_fill(dev, q);
  		q->flags = flags;
  
-@@ -690,9 +752,31 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
+@@ -688,9 +758,31 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
  			q->wed_regs = wed->txfree_ring.reg_base;
  		break;
  	case MT76_WED_Q_RX:
@@ -312,7 +334,7 @@
  		break;
  	default:
  		ret = -EINVAL;
-@@ -721,10 +805,25 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -719,10 +811,25 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  	q->hw_idx = idx;
  
  	size = q->ndesc * sizeof(struct mt76_desc);
@@ -338,7 +360,7 @@
  	size = q->ndesc * sizeof(*q->entry);
  	q->entry = devm_kzalloc(dev->dev, size, GFP_KERNEL);
  	if (!q->entry)
-@@ -734,8 +833,11 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -732,8 +839,11 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  	if (ret)
  		return ret;
  
@@ -352,24 +374,7 @@
  
  	return 0;
  }
-@@ -753,13 +855,13 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
- 	spin_lock_bh(&q->lock);
- 
- 	do {
-+		if (q->flags & MT_QFLAG_RRO)
-+			break;
-+
- 		buf = mt76_dma_dequeue(dev, q, true, NULL, NULL, &more, NULL);
- 		if (!buf)
- 			break;
- 
--		if (q->flags & MT_QFLAG_RRO)
--			continue;
--
- 		skb_free_frag(buf);
- 	} while (1);
- 
-@@ -770,8 +872,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -768,8 +878,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  
  	spin_unlock_bh(&q->lock);
  
@@ -379,7 +384,7 @@
  	    (q->flags & MT_QFLAG_RRO))
  		return;
  
-@@ -792,9 +893,13 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
+@@ -790,9 +899,13 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
  	if (!q->ndesc)
  		return;
  
@@ -393,7 +398,7 @@
  	mt76_dma_rx_cleanup(dev, q);
  
  	/* reset WED rx queues */
-@@ -841,8 +946,8 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+@@ -839,8 +952,8 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  	bool check_ddone = false;
  	bool more;
  
@@ -404,7 +409,7 @@
  		dma_idx = Q_READ(dev, q, dma_idx);
  		check_ddone = true;
  	}
-@@ -1004,7 +1109,8 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
+@@ -1002,7 +1115,8 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
  	mt76_for_each_q_rx(dev, i) {
  		struct mt76_queue *q = &dev->q_rx[i];
  
@@ -414,7 +419,7 @@
  			continue;
  
  		netif_napi_del(&dev->napi[i]);
-@@ -1016,6 +1122,7 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
+@@ -1014,6 +1128,7 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
  
  	if (mtk_wed_device_active(&dev->mmio.wed_ext))
  		mtk_wed_device_detach(&dev->mmio.wed_ext);
@@ -423,7 +428,7 @@
  	mt76_free_pending_rxwi(dev);
  }
 diff --git a/dma.h b/dma.h
-index 1b090d78c..480370928 100644
+index 1b090d78..48037092 100644
 --- a/dma.h
 +++ b/dma.h
 @@ -25,6 +25,13 @@
@@ -453,10 +458,10 @@
  	MT_QSEL_MGMT,
  	MT_QSEL_HCCA,
 diff --git a/mac80211.c b/mac80211.c
-index 7cd9b6fc7..3070321d5 100644
+index f7578308..3a5755f9 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -735,6 +735,7 @@ static void mt76_rx_release_amsdu(struct mt76_phy *phy, enum mt76_rxq_id q)
+@@ -727,6 +727,7 @@ static void mt76_rx_release_amsdu(struct mt76_phy *phy, enum mt76_rxq_id q)
  			return;
  		}
  	}
@@ -465,7 +470,7 @@
  }
  
 diff --git a/mt76.h b/mt76.h
-index 3b2a658db..3954d01c5 100644
+index ee0dbdd7..e4351338 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -48,6 +48,18 @@
@@ -545,7 +550,7 @@
  };
  
  enum mt76_phy_type {
-@@ -375,6 +404,17 @@ struct mt76_txq {
+@@ -369,6 +398,17 @@ struct mt76_txq {
  	bool aggr;
  };
  
@@ -563,7 +568,7 @@
  struct mt76_txwi_cache {
  	struct list_head list;
  	dma_addr_t dma_addr;
-@@ -1629,12 +1669,19 @@ static inline bool mt76_queue_is_wed_rx(struct mt76_queue *q)
+@@ -1516,12 +1556,19 @@ static inline bool mt76_queue_is_wed_rx(struct mt76_queue *q)
  	return (q->flags & MT_QFLAG_WED) &&
  	       FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX;
  }
@@ -584,7 +589,7 @@
  struct mt76_txwi_cache *
  mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
  int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
-@@ -1653,10 +1700,14 @@ static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
+@@ -1540,10 +1587,14 @@ static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  static inline int
  mt76_token_get(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
  {
@@ -602,7 +607,7 @@
  
  	return token;
 diff --git a/mt7996/dma.c b/mt7996/dma.c
-index 3c8f617e0..309cc242e 100644
+index 428f3d08..45ccc7b5 100644
 --- a/mt7996/dma.c
 +++ b/mt7996/dma.c
 @@ -64,6 +64,29 @@ static void mt7996_dma_config(struct mt7996_dev *dev)
@@ -660,15 +665,15 @@
  	mt76_set(dev, WF_WFDMA0_GLO_CFG_EXT1 + ofs, WF_WFDMA0_GLO_CFG_EXT1_CALC_MODE);
 @@ -161,6 +200,7 @@ static void mt7996_dma_disable(struct mt7996_dev *dev, bool reset)
  
- void mt7996_dma_start(struct mt7996_dev *dev, bool reset, bool wed_reset)
+ void __mt7996_dma_enable(struct mt7996_dev *dev, bool reset, bool wed_reset)
  {
 +	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
  	u32 hif1_ofs = 0;
  	u32 irq_mask;
  
-@@ -169,11 +209,16 @@ void mt7996_dma_start(struct mt7996_dev *dev, bool reset, bool wed_reset)
+@@ -169,11 +209,16 @@ void __mt7996_dma_enable(struct mt7996_dev *dev, bool reset, bool wed_reset)
  
- 	/* enable WFDMA Tx/Rx */
+ 	/* enable wpdma tx/rx */
  	if (!reset) {
 -		mt76_set(dev, MT_WFDMA0_GLO_CFG,
 -			 MT_WFDMA0_GLO_CFG_TX_DMA_EN |
@@ -688,7 +693,18 @@
  
  		if (dev->hif2)
  			mt76_set(dev, MT_WFDMA0_GLO_CFG + hif1_ofs,
-@@ -195,14 +240,14 @@ void mt7996_dma_start(struct mt7996_dev *dev, bool reset, bool wed_reset)
+@@ -185,8 +230,8 @@ void __mt7996_dma_enable(struct mt7996_dev *dev, bool reset, bool wed_reset)
+ 
+ 	/* enable interrupts for TX/RX rings */
+ 	irq_mask = MT_INT_MCU_CMD |
+-			   MT_INT_RX_DONE_MCU |
+-			   MT_INT_TX_DONE_MCU;
++		   MT_INT_RX_DONE_MCU |
++		   MT_INT_TX_DONE_MCU;
+ 
+ 	if (mt7996_band_valid(dev, MT_BAND0))
+ 		irq_mask |= MT_INT_BAND0_RX_DONE;
+@@ -197,14 +242,14 @@ void __mt7996_dma_enable(struct mt7996_dev *dev, bool reset, bool wed_reset)
  	if (mt7996_band_valid(dev, MT_BAND2))
  		irq_mask |= MT_INT_BAND2_RX_DONE;
  
@@ -705,7 +721,7 @@
  	}
  
  	irq_mask = reset ? MT_INT_MCU_CMD : irq_mask;
-@@ -296,7 +341,8 @@ static void mt7996_dma_enable(struct mt7996_dev *dev, bool reset)
+@@ -298,7 +343,8 @@ static int mt7996_dma_enable(struct mt7996_dev *dev, bool reset)
  		/* fix hardware limitation, pcie1's rx ring3 is not available
  		 * so, redirect pcie0 rx ring3 interrupt to pcie1
  		 */
@@ -715,8 +731,8 @@
  			mt76_set(dev, MT_WFDMA0_RX_INT_PCIE_SEL + hif1_ofs,
  				 MT_WFDMA0_RX_INT_SEL_RING6);
  		else
-@@ -307,6 +353,78 @@ static void mt7996_dma_enable(struct mt7996_dev *dev, bool reset)
- 	mt7996_dma_start(dev, reset, true);
+@@ -311,6 +357,78 @@ static int mt7996_dma_enable(struct mt7996_dev *dev, bool reset)
+ 	return 0;
  }
  
 +int mt7996_dma_rro_init(struct mt7996_dev *dev)
@@ -794,7 +810,7 @@
  int mt7996_dma_init(struct mt7996_dev *dev)
  {
  	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
-@@ -376,6 +494,9 @@ int mt7996_dma_init(struct mt7996_dev *dev)
+@@ -380,6 +498,9 @@ int mt7996_dma_init(struct mt7996_dev *dev)
  		return ret;
  
  	/* rx data queue for band0 and band1 */
@@ -804,19 +820,17 @@
  	ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_MAIN],
  			       MT_RXQ_ID(MT_RXQ_MAIN),
  			       MT7996_RX_RING_SIZE,
-@@ -399,8 +520,9 @@ int mt7996_dma_init(struct mt7996_dev *dev)
+@@ -403,9 +524,6 @@ int mt7996_dma_init(struct mt7996_dev *dev)
  	if (mt7996_band_valid(dev, MT_BAND2)) {
  		/* rx data queue for band2 */
  		rx_base = MT_RXQ_RING_BASE(MT_RXQ_BAND2) + hif1_ofs;
 -		if (mtk_wed_device_active(wed))
 -			rx_base = MT_RXQ_RING_BASE(MT_RXQ_BAND2);
-+		if (mtk_wed_device_active(wed_ext) && mtk_wed_get_rx_capa(wed_ext))
-+			dev->mt76.q_rx[MT_RXQ_BAND2].flags = MT_WED_Q_RX(0) |
-+							     MT_QFLAG_WED_EXT;
- 
+-
  		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_BAND2],
  				       MT_RXQ_ID(MT_RXQ_BAND2),
-@@ -425,11 +547,12 @@ int mt7996_dma_init(struct mt7996_dev *dev)
+ 				       MT7996_RX_RING_SIZE,
+@@ -429,11 +547,12 @@ int mt7996_dma_init(struct mt7996_dev *dev)
  			return ret;
  	}
  
@@ -831,7 +845,7 @@
  		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_RRO_BAND0],
  				       MT_RXQ_ID(MT_RXQ_RRO_BAND0),
  				       MT7996_RX_RING_SIZE,
-@@ -439,8 +562,7 @@ int mt7996_dma_init(struct mt7996_dev *dev)
+@@ -443,8 +562,7 @@ int mt7996_dma_init(struct mt7996_dev *dev)
  			return ret;
  
  		/* tx free notify event from WA for band0 */
@@ -841,7 +855,7 @@
  		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_TXFREE_BAND0],
  				       MT_RXQ_ID(MT_RXQ_TXFREE_BAND0),
  				       MT7996_RX_MCU_RING_SIZE,
-@@ -453,6 +575,7 @@ int mt7996_dma_init(struct mt7996_dev *dev)
+@@ -457,6 +575,7 @@ int mt7996_dma_init(struct mt7996_dev *dev)
  			/* rx rro data queue for band2 */
  			dev->mt76.q_rx[MT_RXQ_RRO_BAND2].flags = MT_RRO_Q_DATA(1);
  			dev->mt76.q_rx[MT_RXQ_RRO_BAND2].flags |= MT_QFLAG_MAGIC;
@@ -849,7 +863,7 @@
  			ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_RRO_BAND2],
  					       MT_RXQ_ID(MT_RXQ_RRO_BAND2),
  					       MT7996_RX_RING_SIZE,
-@@ -530,18 +653,18 @@ void mt7996_dma_reset(struct mt7996_dev *dev, bool force)
+@@ -534,18 +653,18 @@ void mt7996_dma_reset(struct mt7996_dev *dev, bool force)
  
  	/* reset hw queues */
  	for (i = 0; i < __MT_TXQ_MAX; i++) {
@@ -874,10 +888,10 @@
  
  	mt76_tx_status_check(&dev->mt76, true);
 diff --git a/mt7996/init.c b/mt7996/init.c
-index f2d43d3dc..3a749475e 100644
+index 6cfbc50d..d70dcf9f 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -502,8 +502,13 @@ void mt7996_mac_init(struct mt7996_dev *dev)
+@@ -496,8 +496,13 @@ void mt7996_mac_init(struct mt7996_dev *dev)
  
  	/* rro module init */
  	mt7996_mcu_set_rro(dev, UNI_RRO_SET_PLATFORM_TYPE, 2);
@@ -893,7 +907,7 @@
  
  	mt7996_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
  			  MCU_WA_PARAM_HW_PATH_HIF_VER,
-@@ -656,6 +661,114 @@ void mt7996_wfsys_reset(struct mt7996_dev *dev)
+@@ -650,6 +655,114 @@ void mt7996_wfsys_reset(struct mt7996_dev *dev)
  	msleep(20);
  }
  
@@ -1008,7 +1022,7 @@
  static int mt7996_init_hardware(struct mt7996_dev *dev)
  {
  	int ret, idx;
-@@ -687,6 +800,13 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
+@@ -677,6 +790,13 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
@@ -1022,25 +1036,11 @@
  	ret = mt7996_eeprom_init(dev);
  	if (ret < 0)
  		return ret;
-@@ -1131,10 +1251,10 @@ int mt7996_register_device(struct mt7996_dev *dev)
- 	ieee80211_queue_work(mt76_hw(dev), &dev->init_work);
- 
- 	if (mtk_wed_device_active(&dev->mt76.mmio.wed_ext)) {
--		mt76_wr(dev, MT_INT1_MASK_CSR,
--			dev->mt76.mmio.irqmask|MT_INT_TX_DONE_BAND2);
-+		mt76_wr(dev, MT_INT_PCIE1_MASK_CSR,
-+			MT_INT_TRX_DONE_EXT);
- 		mtk_wed_device_start(&dev->mt76.mmio.wed_ext,
--				     dev->mt76.mmio.irqmask |MT_INT_TX_DONE_BAND2);
-+				     MT_INT_TRX_DONE_EXT);
- 	}
- 
- 	dev->recovery.hw_init_done = true;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index e57bdee21..08a32195b 100644
+index fc2d9269..4fbbc077 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -393,8 +393,37 @@ mt7996_mac_fill_rx_rate(struct mt7996_dev *dev,
+@@ -614,8 +614,37 @@ mt7996_mac_fill_rx_rate(struct mt7996_dev *dev,
  	return 0;
  }
  
@@ -1079,7 +1079,7 @@
  {
  	struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
  	struct mt76_phy *mphy = &dev->mt76.phy;
-@@ -419,7 +448,10 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -640,7 +669,10 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, struct sk_buff *skb)
  	u16 seq_ctrl = 0;
  	__le16 fc = 0;
  	int idx;
@@ -1090,16 +1090,16 @@
  	memset(status, 0, sizeof(*status));
  
  	band_idx = FIELD_GET(MT_RXD1_NORMAL_BAND_IDX, rxd1);
-@@ -446,8 +478,6 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -667,8 +699,6 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, struct sk_buff *skb)
  	status->wcid = mt7996_rx_get_wcid(dev, idx, unicast);
  
  	if (status->wcid) {
 -		struct mt7996_sta *msta;
 -
  		msta = container_of(status->wcid, struct mt7996_sta, wcid);
- 		spin_lock_bh(&dev->mt76.sta_poll_lock);
- 		if (list_empty(&msta->wcid.poll_list))
-@@ -656,13 +686,15 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, struct sk_buff *skb)
+ 		spin_lock_bh(&dev->sta_poll_lock);
+ 		if (list_empty(&msta->poll_list))
+@@ -871,12 +901,14 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, struct sk_buff *skb)
  #endif
  	} else {
  		status->flag |= RX_FLAG_8023;
@@ -1107,16 +1107,15 @@
 +				     *info);
  	}
  
- 	if (rxv && mode >= MT_PHY_TYPE_HE_SU && mode < MT_PHY_TYPE_EHT_SU &&
- 	    !(status->flag & RX_FLAG_8023))
- 		mt76_connac3_mac_decode_he_radiotap(skb, rxv, mode);
+ 	if (rxv && mode >= MT_PHY_TYPE_HE_SU && !(status->flag & RX_FLAG_8023))
+ 		mt7996_mac_decode_he_radiotap(skb, rxv, mode);
  
 -	if (!status->wcid || !ieee80211_is_data_qos(fc))
 +	if (!status->wcid || !ieee80211_is_data_qos(fc) || hw_aggr)
  		return 0;
  
  	status->aggr = unicast &&
-@@ -1406,7 +1438,7 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+@@ -1604,7 +1636,7 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  		dev_kfree_skb(skb);
  		break;
  	case PKT_TYPE_NORMAL:
@@ -1126,10 +1125,10 @@
  			return;
  		}
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 5f18de031..2fc22d576 100644
+index 59f22f6d..1891c0d7 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1063,7 +1063,7 @@ int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct ieee80211_vif *vif)
+@@ -949,7 +949,7 @@ int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct ieee80211_vif *vif)
  static int
  mt7996_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
  		  struct ieee80211_ampdu_params *params,
@@ -1138,7 +1137,7 @@
  {
  	struct mt76_wcid *wcid = (struct mt76_wcid *)params->sta->drv_priv;
  	struct sta_rec_ba_uni *ba;
-@@ -1084,6 +1084,8 @@ mt7996_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
+@@ -970,6 +970,8 @@ mt7996_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
  	ba->ba_en = enable << params->tid;
  	ba->amsdu = params->amsdu;
  	ba->tid = params->tid;
@@ -1147,7 +1146,7 @@
  
  	return mt76_mcu_skb_send_msg(dev, skb,
  				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
-@@ -1101,7 +1103,7 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
+@@ -987,7 +989,7 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
  		msta->wcid.amsdu = false;
  
  	return mt7996_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
@@ -1156,7 +1155,7 @@
  }
  
  int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
-@@ -1112,7 +1114,7 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
+@@ -998,7 +1000,7 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
  	struct mt7996_vif *mvif = msta->vif;
  
  	return mt7996_mcu_sta_ba(&dev->mt76, &mvif->mt76, params,
@@ -1166,27 +1165,17 @@
  
  static void
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index ad2482ef2..1805d892f 100644
+index b9e47e73..9960dca7 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
-@@ -336,7 +336,8 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
- 
- 	dev->rro_support = true;
- 
--	hif1_ofs = MT_WFDMA0_PCIE1(0) - MT_WFDMA0(0);
-+	if (dev->hif2)
-+		hif1_ofs = MT_WFDMA0_PCIE1(0) - MT_WFDMA0(0);
- 
- 	if (hif2)
- 		wed = &dev->mt76.mmio.wed_ext;
-@@ -369,9 +370,15 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
+@@ -346,9 +346,15 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
  			wed->wlan.txfree_tbit = ffs(MT_INT_RX_DONE_WA_TRI) - 1;
  		}
  
 +		wed->wlan.wpdma_rx_glo = wed->wlan.phy_base + hif1_ofs + MT_WFDMA0_GLO_CFG;
-+		wed->wlan.wpdma_rx[0] = wed->wlan.phy_base + hif1_ofs +
-+					MT_RXQ_RING_BASE(MT7996_RXQ_BAND2) +
-+					MT7996_RXQ_BAND2 * MT_RING_SIZE;
++		wed->wlan.wpdma_rx = wed->wlan.phy_base + hif1_ofs +
++				     MT_RXQ_RING_BASE(MT7996_RXQ_BAND0) +
++				     MT7996_RXQ_BAND0 * MT_RING_SIZE;
 +
  		wed->wlan.chip_id = 0x7991;
  		wed->wlan.tx_tbit[0] = ffs(MT_INT_TX_DONE_BAND2) - 1;
@@ -1195,9 +1184,9 @@
  		wed->wlan.wpdma_int = wed->wlan.phy_base + MT_INT_SOURCE_CSR;
  		wed->wlan.wpdma_mask = wed->wlan.phy_base + MT_INT_MASK_CSR;
  		wed->wlan.wpdma_tx = wed->wlan.phy_base + MT_TXQ_RING_BASE(0) +
-@@ -383,13 +390,33 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
- 					MT_RXQ_RING_BASE(MT7996_RXQ_BAND0) +
- 					MT7996_RXQ_BAND0 * MT_RING_SIZE;
+@@ -360,13 +366,33 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
+ 				     MT_RXQ_RING_BASE(MT7996_RXQ_BAND0) +
+ 				     MT7996_RXQ_BAND0 * MT_RING_SIZE;
  
 +		wed->wlan.wpdma_rx_rro[0] = wed->wlan.phy_base +
 +					    MT_RXQ_RING_BASE(MT7996_RXQ_RRO_BAND0) +
@@ -1229,7 +1218,7 @@
  		wed->wlan.tx_tbit[0] = ffs(MT_INT_TX_DONE_BAND0) - 1;
  		wed->wlan.tx_tbit[1] = ffs(MT_INT_TX_DONE_BAND1) - 1;
  		if (dev->rro_support) {
-@@ -401,6 +428,8 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
+@@ -378,6 +404,8 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
  			wed->wlan.wpdma_txfree = wed->wlan.phy_base + MT_RXQ_RING_BASE(0) +
  						  MT7996_RXQ_MCU_WA_MAIN * MT_RING_SIZE;
  		}
@@ -1237,8 +1226,8 @@
 +		dev->mt76.rx_token_size += wed->wlan.rx_npkt;
  	}
  
- 	wed->wlan.nbuf = MT7996_TOKEN_SIZE;
-@@ -417,8 +446,6 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
+ 	wed->wlan.nbuf = 16384;
+@@ -394,8 +422,6 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
  	wed->wlan.release_rx_buf = mt7996_mmio_wed_release_rx_buf;
  	wed->wlan.update_wo_rx_stats = NULL;
  
@@ -1247,24 +1236,7 @@
  	if (mtk_wed_device_attach(wed))
  		return 0;
  
-@@ -530,12 +557,15 @@ static void mt7996_irq_tasklet(struct tasklet_struct *t)
- 					       dev->mt76.mmio.irqmask);
- 		if (intr1 & MT_INT_RX_TXFREE_EXT)
- 			napi_schedule(&dev->mt76.napi[MT_RXQ_TXFREE_BAND2]);
-+
-+		if (intr1 & MT_INT_RX_DONE_BAND2_EXT)
-+			napi_schedule(&dev->mt76.napi[MT_RXQ_BAND2]);
- 	}
- 
- 	if (mtk_wed_device_active(wed)) {
- 		mtk_wed_device_irq_set_mask(wed, 0);
- 		intr = mtk_wed_device_irq_get(wed, dev->mt76.mmio.irqmask);
--		intr |= (intr1 & ~MT_INT_RX_TXFREE_EXT);
-+		intr |= (intr1 & ~MT_INT_TRX_DONE_EXT);
- 	} else {
- 		mt76_wr(dev, MT_INT_MASK_CSR, 0);
- 		if (dev->hif2)
-@@ -581,10 +611,9 @@ static void mt7996_irq_tasklet(struct tasklet_struct *t)
+@@ -557,10 +583,9 @@ static void mt7996_irq_tasklet(struct tasklet_struct *t)
  irqreturn_t mt7996_irq_handler(int irq, void *dev_instance)
  {
  	struct mt7996_dev *dev = dev_instance;
@@ -1277,7 +1249,7 @@
  	else
  		mt76_wr(dev, MT_INT_MASK_CSR, 0);
  
-@@ -616,6 +645,7 @@ struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
+@@ -592,6 +617,7 @@ struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
  				SURVEY_INFO_TIME_RX |
  				SURVEY_INFO_TIME_BSS_RX,
  		.token_size = MT7996_TOKEN_SIZE,
@@ -1286,18 +1258,18 @@
  		.tx_complete_skb = mt76_connac_tx_complete_skb,
  		.rx_skb = mt7996_queue_rx_skb,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index d09358305..cf2a66df2 100644
+index 43f20da4..836c7db7 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -40,6 +40,7 @@
+@@ -39,6 +39,7 @@
  #define MT7996_EEPROM_SIZE		7680
  #define MT7996_EEPROM_BLOCK_SIZE	16
  #define MT7996_TOKEN_SIZE		16384
 +#define MT7996_RX_TOKEN_SIZE		16384
- #define MT7996_SW_TOKEN_SIZE		1024
  
  #define MT7996_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
-@@ -65,6 +66,24 @@
+ #define MT7996_CFEND_RATE_11B		0x03	/* 11B LP, 11M */
+@@ -63,6 +64,24 @@
  #define MT7996_SKU_RATE_NUM		417
  #define MT7996_SKU_PATH_NUM		494
  
@@ -1322,7 +1294,7 @@
  struct mt7996_vif;
  struct mt7996_sta;
  struct mt7996_dfs_pulse;
-@@ -109,6 +128,16 @@ enum mt7996_rxq_id {
+@@ -102,6 +121,16 @@ enum mt7996_rxq_id {
  	MT7996_RXQ_BAND0 = 4,
  	MT7996_RXQ_BAND1 = 4,/* unused */
  	MT7996_RXQ_BAND2 = 5,
@@ -1339,7 +1311,7 @@
  };
  
  struct mt7996_twt_flow {
-@@ -216,6 +245,31 @@ struct mt7996_air_monitor_ctrl {
+@@ -272,6 +301,31 @@ struct mt7996_air_monitor_ctrl {
  };
  #endif
  
@@ -1371,7 +1343,7 @@
  struct mt7996_phy {
  	struct mt76_phy *mt76;
  	struct mt7996_dev *dev;
-@@ -338,6 +392,9 @@ struct mt7996_dev {
+@@ -390,6 +444,9 @@ struct mt7996_dev {
  	bool flash_mode:1;
  	bool has_eht:1;
  
@@ -1381,7 +1353,7 @@
  	bool testmode_enable;
  	bool bin_file_mode;
  	u8 eeprom_mode;
-@@ -662,6 +719,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -709,6 +766,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  			  struct ieee80211_sta *sta,
  			  struct mt76_tx_info *tx_info);
  void mt7996_tx_token_put(struct mt7996_dev *dev);
@@ -1389,29 +1361,8 @@
  void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  			 struct sk_buff *skb, u32 *info);
  bool mt7996_rx_check(struct mt76_dev *mdev, void *data, int len);
-diff --git a/mt7996/pci.c b/mt7996/pci.c
-index 085408571..9a134fcab 100644
---- a/mt7996/pci.c
-+++ b/mt7996/pci.c
-@@ -124,6 +124,8 @@ static int mt7996_pci_probe(struct pci_dev *pdev,
- 	mdev = &dev->mt76;
- 	mt7996_wfsys_reset(dev);
- 	hif2 = mt7996_pci_init_hif2(pdev);
-+	if (hif2)
-+		dev->hif2 = hif2;
- 
- 	ret = mt7996_mmio_wed_init(dev, pdev, false, &irq);
- 	if (ret < 0)
-@@ -148,7 +150,6 @@ static int mt7996_pci_probe(struct pci_dev *pdev,
- 
- 	if (hif2) {
- 		hif2_dev = container_of(hif2->dev, struct pci_dev, dev);
--		dev->hif2 = hif2;
- 
- 		ret = mt7996_mmio_wed_init(dev, hif2_dev, true, &irq);
- 		if (ret < 0)
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index ca7c2a811..c34357c3e 100644
+index 5ed7bcca..47fa965f 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -39,6 +39,40 @@ enum base_rev {
@@ -1455,7 +1406,7 @@
  #define MT_MCU_INT_EVENT			0x2108
  #define MT_MCU_INT_EVENT_DMA_STOPPED		BIT(0)
  #define MT_MCU_INT_EVENT_DMA_INIT		BIT(1)
-@@ -407,6 +441,7 @@ enum base_rev {
+@@ -400,6 +434,7 @@ enum base_rev {
  #define MT_MCUQ_RING_BASE(q)			(MT_Q_BASE(q) + 0x300)
  #define MT_TXQ_RING_BASE(q)			(MT_Q_BASE(__TXQ(q)) + 0x300)
  #define MT_RXQ_RING_BASE(q)			(MT_Q_BASE(__RXQ(q)) + 0x500)
@@ -1463,12 +1414,8 @@
  
  #define MT_MCUQ_EXT_CTRL(q)			(MT_Q_BASE(q) +	0x600 +	\
  						 MT_MCUQ_ID(q) * 0x4)
-@@ -432,8 +467,19 @@ enum base_rev {
- #define MT_INT_RX_TXFREE_MAIN			BIT(17)
- #define MT_INT_RX_TXFREE_TRI			BIT(15)
+@@ -427,6 +462,15 @@ enum base_rev {
  #define MT_INT_MCU_CMD				BIT(29)
-+
-+#define MT_INT_RX_DONE_BAND2_EXT		BIT(23)
  #define MT_INT_RX_TXFREE_EXT			BIT(26)
  
 +#define MT_INT_RX_DONE_RRO_BAND0		BIT(16)
@@ -1483,7 +1430,7 @@
  #define MT_INT_RX(q)				(dev->q_int_mask[__RXQ(q)])
  #define MT_INT_TX_MCU(q)			(dev->q_int_mask[(q)])
  
-@@ -441,20 +487,31 @@ enum base_rev {
+@@ -434,20 +478,31 @@ enum base_rev {
  						 MT_INT_RX(MT_RXQ_MCU_WA))
  
  #define MT_INT_BAND0_RX_DONE			(MT_INT_RX(MT_RXQ_MAIN) |	\
@@ -1519,17 +1466,6 @@
  
  #define MT_INT_TX_DONE_FWDL			BIT(26)
  #define MT_INT_TX_DONE_MCU_WM			BIT(27)
-@@ -463,6 +520,10 @@ enum base_rev {
- #define MT_INT_TX_DONE_BAND1			BIT(31)
- #define MT_INT_TX_DONE_BAND2			BIT(15)
- 
-+#define MT_INT_TRX_DONE_EXT			(MT_INT_TX_DONE_BAND2 |	\
-+						 MT_INT_RX_DONE_BAND2_EXT |	\
-+						 MT_INT_RX_TXFREE_EXT)
-+
- #define MT_INT_TX_DONE_MCU			(MT_INT_TX_MCU(MT_MCUQ_WA) |	\
- 						 MT_INT_TX_MCU(MT_MCUQ_WM) |	\
- 						 MT_INT_TX_MCU(MT_MCUQ_FWDL))
 -- 
-2.39.2
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2005-wifi-mt76-mt7996-wed-add-mt7996_net_setup_tc-to-supp.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2005-wifi-mt76-mt7996-wed-add-mt7996_net_setup_tc-to-supp.patch
index e62d01c..7fdee4c 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2005-wifi-mt76-mt7996-wed-add-mt7996_net_setup_tc-to-supp.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2005-wifi-mt76-mt7996-wed-add-mt7996_net_setup_tc-to-supp.patch
@@ -1,7 +1,7 @@
-From 15e621e5bc992bf2a40f1897ca76fb63e93ba394 Mon Sep 17 00:00:00 2001
+From e5136e5f940adf55f1e7604960dba89e24a187bb Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Thu, 13 Apr 2023 14:12:16 +0800
-Subject: [PATCH 2005/2012] wifi: mt76: mt7996: wed: add mt7996_net_setup_tc to
+Subject: [PATCH 2005/2008] wifi: mt76: mt7996: wed: add mt7996_net_setup_tc to
  support wifi2wifi offload
 
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 19 insertions(+)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index e6be05656..1ccd07802 100644
+index 50fa6523..cebac4ab 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -1549,6 +1549,24 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1446,6 +1446,24 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
  	return 0;
  }
  
@@ -38,7 +38,7 @@
  #endif
  
  const struct ieee80211_ops mt7996_ops = {
-@@ -1599,5 +1617,6 @@ const struct ieee80211_ops mt7996_ops = {
+@@ -1496,5 +1514,6 @@ const struct ieee80211_ops mt7996_ops = {
  	.set_radar_background = mt7996_set_radar_background,
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
  	.net_fill_forward_path = mt7996_net_fill_forward_path,
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2006-wifi-mt76-add-random-early-drop-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2006-wifi-mt76-add-random-early-drop-support.patch
index 6b7206c..7902639 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2006-wifi-mt76-add-random-early-drop-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2006-wifi-mt76-add-random-early-drop-support.patch
@@ -1,19 +1,19 @@
-From f314682c17e80faa3a2e59f3c16108ad746b450e Mon Sep 17 00:00:00 2001
+From fba98d69dcbbbcbd4cbf61e997637ecead9e55a3 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Wed, 19 Apr 2023 18:32:41 +0800
-Subject: [PATCH 2006/2012] wifi: mt76: add random early drop support
+Subject: [PATCH 2006/2008] wifi: mt76: add random early drop support
 
 ---
- mt7996/mcu.c    | 81 +++++++++++++++++++++++++++++++++++++++++++++++--
+ mt7996/mcu.c    | 77 +++++++++++++++++++++++++++++++++++++++++++++++--
  mt7996/mcu.h    |  4 ++-
  mt7996/mt7996.h |  1 +
- 3 files changed, 83 insertions(+), 3 deletions(-)
+ 3 files changed, 79 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 2fc22d576..b4d8e9c7f 100644
+index 1891c0d7..0c01e90b 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3030,8 +3030,8 @@ int mt7996_mcu_init_firmware(struct mt7996_dev *dev)
+@@ -2933,8 +2933,8 @@ int mt7996_mcu_init_firmware(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
@@ -24,7 +24,7 @@
  }
  
  int mt7996_mcu_init(struct mt7996_dev *dev)
-@@ -3063,6 +3063,83 @@ out:
+@@ -2966,6 +2966,79 @@ out:
  	skb_queue_purge(&dev->mt76.mcu.res_q);
  }
  
@@ -64,10 +64,6 @@
 +		req.token_thr_per_src[i] = cpu_to_le16(MT7996_TOKEN_SIZE);
 +	}
 +
-+	if (!mtk_wed_device_active(&dev->mt76.mmio.wed))
-+		req.token_per_src[RED_TOKEN_SRC_CNT - 1] =
-+			cpu_to_le16(MT7996_SW_TOKEN_SIZE);
-+
 +	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_PARAM_CMD(SET),
 +				 &req, sizeof(req), false);
 +}
@@ -109,10 +105,10 @@
  {
  	struct {
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 47fd1874d..7ab84029e 100644
+index a0cbf922..ec074bc6 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
-@@ -290,8 +290,9 @@ enum {
+@@ -239,8 +239,9 @@ enum {
  enum {
  	MCU_WA_PARAM_PDMA_RX = 0x04,
  	MCU_WA_PARAM_CPU_UTIL = 0x0b,
@@ -123,7 +119,7 @@
  };
  
  enum mcu_mmps_mode {
-@@ -821,6 +822,7 @@ enum {
+@@ -695,6 +696,7 @@ enum {
  	UNI_VOW_DRR_CTRL,
  	UNI_VOW_RX_AT_AIRTIME_EN = 0x0b,
  	UNI_VOW_RX_AT_AIRTIME_CLR_EN = 0x0e,
@@ -132,10 +128,10 @@
  
  enum {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index cf2a66df2..c15e926a7 100644
+index 836c7db7..b239c44c 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -624,6 +624,7 @@ int mt7996_mcu_rf_regval(struct mt7996_dev *dev, u32 regidx, u32 *val, bool set)
+@@ -671,6 +671,7 @@ int mt7996_mcu_rf_regval(struct mt7996_dev *dev, u32 regidx, u32 *val, bool set)
  int mt7996_mcu_set_hdr_trans(struct mt7996_dev *dev, bool hdr_trans);
  int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u8 val);
  int mt7996_mcu_wa_cmd(struct mt7996_dev *dev, int cmd, u32 a1, u32 a2, u32 a3);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2007-wifi-mt76-mt7996-reset-addr_elem-when-delete-ba.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2007-wifi-mt76-mt7996-reset-addr_elem-when-delete-ba.patch
index 7ed734a..5897422 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2007-wifi-mt76-mt7996-reset-addr_elem-when-delete-ba.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2007-wifi-mt76-mt7996-reset-addr_elem-when-delete-ba.patch
@@ -1,7 +1,7 @@
-From 3751850a855b377433c54118e283322aded240ee Mon Sep 17 00:00:00 2001
+From cc7283ecc1da9d4f62803062466fb5420d2ea766 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Thu, 18 May 2023 15:01:47 +0800
-Subject: [PATCH 2007/2012] wifi: mt76: mt7996: reset addr_elem when delete ba
+Subject: [PATCH 2007/2008] wifi: mt76: mt7996: reset addr_elem when delete ba
 
 The old addr element info may be used when the signature is not equel to
 0xff, and sta will find error SDP cause the SDP/SDL=0 issue.
@@ -13,17 +13,17 @@
  mt7996/init.c     |   3 +
  mt7996/mac.c      | 140 ++++++++++++++++++++++++++++++++++++++++++++++
  mt7996/main.c     |   7 +++
- mt7996/mcu.c      |  63 +++++++++++++++++++++
+ mt7996/mcu.c      |  64 +++++++++++++++++++++
  mt7996/mcu.h      |  34 +++++++++++
  mt7996/mt7996.h   |  32 +++++++++++
  mt7996/regs.h     |   5 ++
- 9 files changed, 286 insertions(+)
+ 9 files changed, 287 insertions(+)
 
 diff --git a/mt76.h b/mt76.h
-index 3954d01c5..14d59ab94 100644
+index e4351338..7ebcf432 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -442,6 +442,7 @@ struct mt76_rx_tid {
+@@ -436,6 +436,7 @@ struct mt76_rx_tid {
  	u16 nframes;
  
  	u8 num;
@@ -32,22 +32,22 @@
  	u8 started:1, stopped:1, timer_pending:1;
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 1d01b2b89..9fa978d5a 100644
+index a53fa138..d74fd2dd 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1036,6 +1036,7 @@ enum {
+@@ -1023,6 +1023,7 @@ enum {
  	MCU_UNI_EVENT_THERMAL = 0x35,
- 	MCU_UNI_EVENT_NIC_CAPAB = 0x43,
+ 	MCU_UNI_EVENT_BF = 0x33,
  	MCU_UNI_EVENT_TESTMODE_CTRL = 0x46,
 +	MCU_UNI_EVENT_RRO = 0x57,
- 	MCU_UNI_EVENT_PER_STA_INFO = 0x6d,
- 	MCU_UNI_EVENT_ALL_STA_INFO = 0x6e,
  };
+ 
+ #define MCU_UNI_CMD_EVENT			BIT(1)
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 3a749475e..43a49d42a 100644
+index d70dcf9f..93262297 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -765,6 +765,9 @@ static int mt7996_rro_init(struct mt7996_dev *dev)
+@@ -759,6 +759,9 @@ static int mt7996_rro_init(struct mt7996_dev *dev)
  	mt76_wr(dev, MT_RRO_HOST_INT_ENA,
  		MT_RRO_HOST_INT_ENA_HOST_RRO_DONE_ENA);
  
@@ -58,10 +58,10 @@
  	return mt7996_dma_rro_init(dev);
  }
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 08a32195b..e331594d3 100644
+index 4fbbc077..3a89013c 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1449,6 +1449,139 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+@@ -1647,6 +1647,139 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  	}
  }
  
@@ -97,7 +97,7 @@
 +
 +	if (sid & 0x1) {
 +		value[0] = mt76_rr(dev, MT_RRO_DBG_RDAT_DW(2));
-+		value[1] = mt76_rr(dev, MT_RRO_DBG_RDAT_DW(3));
++		value[1] = mt76_rr(dev, MT_RRO_DBG_RDAT_DW(2));
 +	} else {
 +		value[0] = mt76_rr(dev, MT_RRO_DBG_RDAT_DW(0));
 +		value[1] = mt76_rr(dev, MT_RRO_DBG_RDAT_DW(1));
@@ -201,7 +201,7 @@
  void mt7996_mac_cca_stats_reset(struct mt7996_phy *phy)
  {
  	struct mt7996_dev *dev = phy->dev;
-@@ -1773,6 +1906,9 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
+@@ -1971,6 +2104,9 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
  	if (phy3)
  		ieee80211_stop_queues(phy3->mt76->hw);
  
@@ -211,7 +211,7 @@
  	cancel_delayed_work_sync(&dev->mphy.mac_work);
  	if (phy2)
  		cancel_delayed_work_sync(&phy2->mt76->mac_work);
-@@ -1864,6 +2000,10 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2062,6 +2198,10 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	set_bit(MT76_RESET, &dev->mphy.state);
  	set_bit(MT76_MCU_RESET, &dev->mphy.state);
  	wake_up(&dev->mt76.mcu.wait);
@@ -223,10 +223,10 @@
  	if (phy2) {
  		set_bit(MT76_RESET, &phy2->mt76->state);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 1ccd07802..52e9666ef 100644
+index cebac4ab..4cb72220 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -125,6 +125,9 @@ static void mt7996_stop(struct ieee80211_hw *hw)
+@@ -119,6 +119,9 @@ static void mt7996_stop(struct ieee80211_hw *hw)
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
  
@@ -236,7 +236,7 @@
  	cancel_delayed_work_sync(&phy->mt76->mac_work);
  	cancel_delayed_work_sync(&dev->scs_work);
  
-@@ -832,6 +835,10 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -797,6 +800,10 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  		ret = mt7996_mcu_add_rx_ba(dev, params, true);
  		break;
  	case IEEE80211_AMPDU_RX_STOP:
@@ -248,11 +248,11 @@
  		ret = mt7996_mcu_add_rx_ba(dev, params, false);
  		break;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index b4d8e9c7f..6c106d8cf 100644
+index 0c01e90b..094f3656 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -517,6 +517,41 @@ mt7996_mcu_update_tx_gi(struct rate_info *rate, struct all_sta_trx_rate *mcu_rat
- 	return 0;
+@@ -476,6 +476,41 @@ mt7996_mcu_rx_thermal_notify(struct mt7996_dev *dev, struct sk_buff *skb)
+ 	phy->throttle_state = n->duty_percent;
  }
  
 +static void mt7996_mcu_rx_rro(struct mt7996_dev *dev, struct sk_buff *skb)
@@ -291,9 +291,9 @@
 +}
 +
  static void
- mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
+ mt7996_mcu_rx_ext_event(struct mt7996_dev *dev, struct sk_buff *skb)
  {
-@@ -642,6 +677,9 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -528,6 +563,9 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
  		mt7996_tm_rf_test_event(dev, skb);
  		break;
  #endif
@@ -303,8 +303,8 @@
  	default:
  		break;
  	}
-@@ -4651,6 +4689,31 @@ int mt7996_mcu_get_all_sta_info(struct mt7996_phy *phy, u16 tag)
- 				 &req, sizeof(req), false);
+@@ -4533,6 +4571,32 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u8 val)
+ 				 sizeof(req), true);
  }
  
 +int mt7996_mcu_reset_rro_sessions(struct mt7996_dev *dev,
@@ -332,15 +332,16 @@
 +				 &req, sizeof(req), true);
 +}
 +
++
  int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 data)
  {
  	struct mt7996_dev *dev = phy->dev;
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 7ab84029e..660823402 100644
+index ec074bc6..10e3799f 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
-@@ -242,6 +242,38 @@ struct mt7996_mcu_all_sta_info_event {
- 	};
+@@ -191,6 +191,38 @@ struct mt7996_mcu_thermal_notify {
+ 	u8 __rsv2[4];
  } __packed;
  
 +struct mt7996_mcu_rro_event {
@@ -378,7 +379,7 @@
  enum mt7996_chan_mib_offs {
  	UNI_MIB_OBSS_AIRTIME = 26,
  	UNI_MIB_NON_WIFI_TIME = 27,
-@@ -844,6 +876,8 @@ enum {
+@@ -718,6 +750,8 @@ enum {
  	UNI_RRO_GET_BA_SESSION_TABLE,
  	UNI_RRO_SET_BYPASS_MODE,
  	UNI_RRO_SET_TXFREE_PATH,
@@ -388,10 +389,10 @@
  
  enum{
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index c15e926a7..eb4b315a0 100644
+index b239c44c..88d42c3a 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -254,6 +254,28 @@ struct mt7996_rro_addr {
+@@ -310,6 +310,28 @@ struct mt7996_rro_addr {
  	u32 signature	: 8;
  };
  
@@ -420,7 +421,7 @@
  struct mt7996_rro_cfg {
  	u32 ind_signature;
  	void *ba_bitmap_cache_va[MT7996_RRO_BA_BITMAP_CR_CNT];
-@@ -268,6 +290,11 @@ struct mt7996_rro_cfg {
+@@ -324,6 +346,11 @@ struct mt7996_rro_cfg {
  	spinlock_t lock;
  	struct list_head pg_addr_cache;
  	struct list_head pg_hash_head[MT7996_RRO_MSDU_PG_HASH_SIZE];
@@ -432,7 +433,7 @@
  };
  
  struct mt7996_phy {
-@@ -623,6 +650,8 @@ int mt7996_mcu_set_fixed_rate_table(struct mt7996_phy *phy, u8 table_idx,
+@@ -670,6 +697,8 @@ int mt7996_mcu_set_fixed_rate_table(struct mt7996_phy *phy, u8 table_idx,
  int mt7996_mcu_rf_regval(struct mt7996_dev *dev, u32 regidx, u32 *val, bool set);
  int mt7996_mcu_set_hdr_trans(struct mt7996_dev *dev, bool hdr_trans);
  int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u8 val);
@@ -441,7 +442,7 @@
  int mt7996_mcu_wa_cmd(struct mt7996_dev *dev, int cmd, u32 a1, u32 a2, u32 a3);
  int mt7996_mcu_red_config(struct mt7996_dev *dev, bool enable);
  int mt7996_mcu_fw_log_2_host(struct mt7996_dev *dev, u8 type, u8 ctrl);
-@@ -721,6 +750,9 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -768,6 +797,9 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  			  struct mt76_tx_info *tx_info);
  void mt7996_tx_token_put(struct mt7996_dev *dev);
  int mt7996_dma_rro_init(struct mt7996_dev *dev);
@@ -452,7 +453,7 @@
  			 struct sk_buff *skb, u32 *info);
  bool mt7996_rx_check(struct mt76_dev *mdev, void *data, int len);
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index c34357c3e..5577c9348 100644
+index 6624685e..f97c87c9 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -72,6 +72,11 @@ enum base_rev {
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2008-wifi-mt76-add-SER-support-for-wed3.0.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2008-wifi-mt76-add-SER-support-for-wed3.0.patch
index c7f8dac..3d25c27 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2008-wifi-mt76-add-SER-support-for-wed3.0.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2008-wifi-mt76-add-SER-support-for-wed3.0.patch
@@ -1,21 +1,21 @@
-From e13a81689d5df310915182b8b7f2858ac65a0472 Mon Sep 17 00:00:00 2001
+From 5df084a32eac68dd66a3b833cf5f718118850b08 Mon Sep 17 00:00:00 2001
 From: mtk27745 <rex.lu@mediatek.com>
 Date: Tue, 23 May 2023 12:06:29 +0800
-Subject: [PATCH 2008/2012] wifi: mt76: add SER support for wed3.0
+Subject: [PATCH 2008/2008] wifi: mt76: add SER support for wed3.0
 
 Change-Id: I2711b9dc336fca9a1ae32a8fbf27810a7e27b1e3
 ---
  dma.c         |  7 +++++--
- mt7996/dma.c  | 42 +++++++++++++++++++++++++++++++++++++++---
+ mt7996/dma.c  | 48 +++++++++++++++++++++++++++++++++++++++++++++---
  mt7996/mac.c  | 49 ++++++++++++++++++++++++++++++++++++++++++++++++-
  mt7996/mmio.c | 47 +++++++++++++++++++++++++++++++++++++++++++++++
- 4 files changed, 139 insertions(+), 6 deletions(-)
+ 4 files changed, 145 insertions(+), 6 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 8097a3121..bfe188134 100644
+index e5b4d898..e31f6390 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -772,8 +772,9 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
+@@ -778,8 +778,9 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
  				q->head = q->ndesc - 1;
  				q->queued = q->ndesc - 1;
  			}
@@ -26,7 +26,7 @@
  			if (!ret)
  				q->wed_regs = wed->rx_ring[ring].reg_base;
  		}
-@@ -904,7 +905,9 @@ done:
+@@ -910,7 +911,9 @@ done:
  
  	/* reset WED rx queues */
  	mt76_dma_wed_setup(dev, q, true);
@@ -38,10 +38,23 @@
  		mt76_dma_rx_fill(dev, q);
  	}
 diff --git a/mt7996/dma.c b/mt7996/dma.c
-index 309cc242e..9416d7947 100644
+index c5c7f160..471ae81c 100644
 --- a/mt7996/dma.c
 +++ b/mt7996/dma.c
-@@ -611,11 +611,35 @@ int mt7996_dma_init(struct mt7996_dev *dev)
+@@ -524,6 +524,12 @@ int mt7996_dma_init(struct mt7996_dev *dev)
+ 	if (mt7996_band_valid(dev, MT_BAND2)) {
+ 		/* rx data queue for band2 */
+ 		rx_base = MT_RXQ_RING_BASE(MT_RXQ_BAND2) + hif1_ofs;
++		if (mtk_wed_device_active(wed)) {
++			rx_base = MT_RXQ_RING_BASE(MT_RXQ_BAND2);
++			if (mtk_wed_get_rx_capa(wed))
++				dev->mt76.q_rx[MT_RXQ_BAND2].flags = MT_WED_Q_RX(1);
++		}
++
+ 		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_BAND2],
+ 				       MT_RXQ_ID(MT_RXQ_BAND2),
+ 				       MT7996_RX_RING_SIZE,
+@@ -611,11 +617,35 @@ int mt7996_dma_init(struct mt7996_dev *dev)
  	return 0;
  }
  
@@ -77,7 +90,7 @@
  	int i;
  
  	mt76_clear(dev, MT_WFDMA0_GLO_CFG,
-@@ -649,21 +673,33 @@ void mt7996_dma_reset(struct mt7996_dev *dev, bool force)
+@@ -649,21 +679,33 @@ void mt7996_dma_reset(struct mt7996_dev *dev, bool force)
  	if (force)
  		mt7996_wfsys_reset(dev);
  
@@ -115,10 +128,10 @@
  	}
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index e331594d3..f994203aa 100644
+index 3a89013c..d1082e89 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1804,6 +1804,10 @@ mt7996_mac_restart(struct mt7996_dev *dev)
+@@ -2002,6 +2002,10 @@ mt7996_mac_restart(struct mt7996_dev *dev)
  	/* disable all tx/rx napi */
  	mt76_worker_disable(&dev->mt76.tx_worker);
  	mt76_for_each_q_rx(mdev, i) {
@@ -129,7 +142,7 @@
  		if (mdev->q_rx[i].ndesc)
  			napi_disable(&dev->mt76.napi[i]);
  	}
-@@ -1817,6 +1821,10 @@ mt7996_mac_restart(struct mt7996_dev *dev)
+@@ -2015,6 +2019,10 @@ mt7996_mac_restart(struct mt7996_dev *dev)
  
  	local_bh_disable();
  	mt76_for_each_q_rx(mdev, i) {
@@ -140,7 +153,7 @@
  		if (mdev->q_rx[i].ndesc) {
  			napi_enable(&dev->mt76.napi[i]);
  			napi_schedule(&dev->mt76.napi[i]);
-@@ -1991,6 +1999,13 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2189,6 +2197,13 @@ void mt7996_mac_reset_work(struct work_struct *work)
  
  	dev_info(dev->mt76.dev,"\n%s L1 SER recovery start.",
  		 wiphy_name(dev->mt76.hw->wiphy));
@@ -154,7 +167,7 @@
  	ieee80211_stop_queues(mt76_hw(dev));
  	if (phy2)
  		ieee80211_stop_queues(phy2->mt76->hw);
-@@ -2014,8 +2029,13 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2212,8 +2227,13 @@ void mt7996_mac_reset_work(struct work_struct *work)
  		cancel_delayed_work_sync(&phy3->mt76->mac_work);
  	}
  	mt76_worker_disable(&dev->mt76.tx_worker);
@@ -169,9 +182,9 @@
  	napi_disable(&dev->mt76.tx_napi);
  
  	mutex_lock(&dev->mt76.mutex);
-@@ -2038,6 +2058,29 @@ void mt7996_mac_reset_work(struct work_struct *work)
- 	/* enable DMA Tx/Tx and interrupt */
- 	mt7996_dma_start(dev, false, false);
+@@ -2236,6 +2256,29 @@ void mt7996_mac_reset_work(struct work_struct *work)
+ 	/* enable dma tx/rx and interrupt */
+ 	__mt7996_dma_enable(dev, false, false);
  
 +
 +	if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
@@ -199,7 +212,7 @@
  	clear_bit(MT76_MCU_RESET, &dev->mphy.state);
  	clear_bit(MT76_RESET, &dev->mphy.state);
  	if (phy2)
-@@ -2047,6 +2090,10 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2245,6 +2288,10 @@ void mt7996_mac_reset_work(struct work_struct *work)
  
  	local_bh_disable();
  	mt76_for_each_q_rx(&dev->mt76, i) {
@@ -211,7 +224,7 @@
  		napi_schedule(&dev->mt76.napi[i]);
  	}
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index 1805d892f..940f94998 100644
+index 9960dca7..fe34bb7d 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
 @@ -6,9 +6,11 @@
@@ -226,7 +239,7 @@
  #include "../trace.h"
  #include "../dma.h"
  
-@@ -320,6 +322,43 @@ unmap:
+@@ -297,6 +299,43 @@ unmap:
  	mt7996_mmio_wed_release_rx_buf(wed);
  	return -ENOMEM;
  }
@@ -270,7 +283,7 @@
  #endif
  
  int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
-@@ -445,6 +484,14 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
+@@ -421,6 +460,14 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
  	wed->wlan.init_rx_buf = mt7996_mmio_wed_init_rx_buf;
  	wed->wlan.release_rx_buf = mt7996_mmio_wed_release_rx_buf;
  	wed->wlan.update_wo_rx_stats = NULL;
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2009-wifi-mt76-mt7915-wed-find-rx-token-by-physical-addre.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2009-wifi-mt76-mt7915-wed-find-rx-token-by-physical-addre.patch
deleted file mode 100644
index 45262ae..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2009-wifi-mt76-mt7915-wed-find-rx-token-by-physical-addre.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From aa5ba9b452355d0bd7d76868753c66a88464318c Mon Sep 17 00:00:00 2001
-From: "sujuan.chen" <sujuan.chen@mediatek.com>
-Date: Wed, 19 Jul 2023 10:55:09 +0800
-Subject: [PATCH 2009/2012] wifi: mt76: mt7915: wed: find rx token by physical
- address
-
-The token id in RxDMAD may be incorrect when it is not the last frame due to
-WED HW bug. Lookup correct token id by physical address in sdp0.
-Add len == 0 check to drop garbage frames
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- dma.c | 27 +++++++++++++++++++++++++--
- 1 file changed, 25 insertions(+), 2 deletions(-)
-
-diff --git a/dma.c b/dma.c
-index bfe188134..415121f74 100644
---- a/dma.c
-+++ b/dma.c
-@@ -441,10 +441,33 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
- 	}
- 
- 	if (mt76_queue_is_wed_rx(q)) {
-+		u32 id, find = 0;
- 		u32 buf1 = le32_to_cpu(desc->buf1);
- 		u32 token = FIELD_GET(MT_DMA_CTL_TOKEN, buf1);
--		struct mt76_rxwi_cache *r = mt76_rx_token_release(dev, token);
-+		struct mt76_rxwi_cache *r;
-+
-+		if (*more) {
-+			spin_lock_bh(&dev->rx_token_lock);
-+
-+			idr_for_each_entry(&dev->rx_token, r, id) {
-+				if (r->dma_addr == le32_to_cpu(desc->buf0)) {
-+					find = 1;
-+					token = id;
-+
-+					/* Write correct id back to DMA*/
-+					u32p_replace_bits(&buf1, id,
-+							  MT_DMA_CTL_TOKEN);
-+					WRITE_ONCE(desc->buf1, cpu_to_le32(buf1));
-+					break;
-+				}
-+			}
- 
-+			spin_unlock_bh(&dev->rx_token_lock);
-+			if (!find)
-+				return NULL;
-+		}
-+
-+		r = mt76_rx_token_release(dev, token);
- 		if (!r)
- 			return NULL;
- 
-@@ -972,7 +995,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
- 		if (!data)
- 			break;
- 
--		if (drop)
-+		if (drop || (len == 0))
- 			goto free_frag;
- 
- 		if (q->rx_head)
--- 
-2.39.2
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2010-wifi-mt76-drop-packet-based-on-ind_reason.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2010-wifi-mt76-drop-packet-based-on-ind_reason.patch
deleted file mode 100644
index 2e80514..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2010-wifi-mt76-drop-packet-based-on-ind_reason.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-From 508070a74e55bbdc06b8865736301f568feb8e9f Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Wed, 26 Jul 2023 16:33:43 +0800
-Subject: [PATCH 2010/2012] wifi: mt76: drop packet based on ind_reason
-
-Driver should drop packet which ind_reason is REPEAT and OLDPKT.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
-Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
----
- dma.c | 15 +++++++++++++--
- dma.h |  9 +++++++++
- 2 files changed, 22 insertions(+), 2 deletions(-)
-
-diff --git a/dma.c b/dma.c
-index 415121f74..7e3d0393b 100644
---- a/dma.c
-+++ b/dma.c
-@@ -436,8 +436,19 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
- 
- 	if (drop) {
- 		*drop = !!(ctrl & (MT_DMA_CTL_TO_HOST_A | MT_DMA_CTL_DROP));
--		if (ctrl & MT_DMA_CTL_VER_MASK)
--			*drop = !!(ctrl & MT_DMA_CTL_PN_CHK_FAIL);
-+		if (ctrl & MT_DMA_CTL_VER_MASK) {
-+			switch (le32_get_bits(desc->buf1, MT_DMA_IND_REASON)) {
-+			case IND_REASON_REPEAT:
-+				*drop = true;
-+				break;
-+			case IND_REASON_OLDPKT:
-+				*drop = !le32_get_bits(desc->info, MT_DMA_INFO_DMA_FRAG);
-+				break;
-+			default:
-+				*drop = !!(ctrl & MT_DMA_CTL_PN_CHK_FAIL);
-+				break;
-+			}
-+		}
- 	}
- 
- 	if (mt76_queue_is_wed_rx(q)) {
-diff --git a/dma.h b/dma.h
-index 480370928..f83604537 100644
---- a/dma.h
-+++ b/dma.h
-@@ -23,6 +23,7 @@
- 
- #define MT_DMA_PPE_CPU_REASON		GENMASK(15, 11)
- #define MT_DMA_PPE_ENTRY		GENMASK(30, 16)
-+#define MT_DMA_INFO_DMA_FRAG		BIT(9)
- #define MT_DMA_INFO_PPE_VLD		BIT(31)
- 
- #define MT_DMA_CTL_PN_CHK_FAIL		BIT(13)
-@@ -31,6 +32,7 @@
- #define MT_DMA_MAGIC_EN		BIT(13)
- 
- #define MT_DMA_IND_CMD_MAGIC_CNT	8
-+#define MT_DMA_IND_REASON		GENMASK(15, 12)
- 
- #define MT_DMA_HDR_LEN			4
- #define MT_RX_INFO_LEN			4
-@@ -66,6 +68,13 @@ enum mt76_mcu_evt_type {
- 	EVT_EVENT_DFS_DETECT_RSP,
- };
- 
-+enum ind_reason {
-+	IND_REASON_NORMAL,
-+	IND_REASON_REPEAT,
-+	IND_REASON_OLDPKT,
-+	IND_REASON_MAX
-+};
-+
- int mt76_dma_rx_poll(struct napi_struct *napi, int budget);
- void mt76_dma_attach(struct mt76_dev *dev);
- void mt76_dma_cleanup(struct mt76_dev *dev);
--- 
-2.39.2
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2011-wifi-mt76-mt7996-add-rro-timeout-setting.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2011-wifi-mt76-mt7996-add-rro-timeout-setting.patch
deleted file mode 100644
index 5a34171..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2011-wifi-mt76-mt7996-add-rro-timeout-setting.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-From 5bf92814ff8cf9e78b5b72db73dc3271097a236d Mon Sep 17 00:00:00 2001
-From: "sujuan.chen" <sujuan.chen@mediatek.com>
-Date: Fri, 11 Aug 2023 18:26:39 +0800
-Subject: [PATCH 2011/2012] wifi: mt76: mt7996: add rro timeout setting
-
-Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
----
- mt7996/init.c   |  5 +++++
- mt7996/mcu.c    | 11 ++++++++++-
- mt7996/mt7996.h |  2 +-
- mt7996/regs.h   |  2 ++
- 4 files changed, 18 insertions(+), 2 deletions(-)
-
-diff --git a/mt7996/init.c b/mt7996/init.c
-index 43a49d42a..8a415fb34 100644
---- a/mt7996/init.c
-+++ b/mt7996/init.c
-@@ -503,6 +503,11 @@ void mt7996_mac_init(struct mt7996_dev *dev)
- 	/* rro module init */
- 	mt7996_mcu_set_rro(dev, UNI_RRO_SET_PLATFORM_TYPE, 2);
- 	if (dev->rro_support) {
-+		u16 timeout;
-+
-+		timeout = mt76_rr(dev, MT_HW_REV) == MT_HW_VER1 ? 512 : 128;
-+
-+		mt7996_mcu_set_rro(dev, UNI_RRO_SET_FLUSH_TIMEOUT, timeout);
- 		mt7996_mcu_set_rro(dev, UNI_RRO_SET_BYPASS_MODE, 1);
- 		mt7996_mcu_set_rro(dev, UNI_RRO_SET_TXFREE_PATH, 0);
- 	} else {
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 6c106d8cf..a4c6cd5cf 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -4626,7 +4626,7 @@ int mt7996_mcu_trigger_assert(struct mt7996_dev *dev)
- 				 &req, sizeof(req), false);
- }
- 
--int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u8 val)
-+int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u16 val)
- {
- 	struct {
- 		u8 __rsv1[4];
-@@ -4648,6 +4648,11 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u8 val)
- 				u8 path;
- 				u8 __rsv2[3];
- 			} __packed txfree_path;
-+			struct {
-+				u16 flush_one;
-+				u16 flush_all;
-+				u8 __rsv2[4];
-+			}  __packed timeout;
- 		};
- 	} __packed req = {
- 		.tag = cpu_to_le16(tag),
-@@ -4664,6 +4669,10 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u8 val)
- 	case UNI_RRO_SET_TXFREE_PATH:
- 		req.txfree_path.path = val;
- 		break;
-+	case UNI_RRO_SET_FLUSH_TIMEOUT:
-+		req.timeout.flush_one = val;
-+		req.timeout.flush_all = val * 2;
-+		break;
- 	default:
- 		return -EINVAL;
- 	}
-diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index eb4b315a0..6278d3045 100644
---- a/mt7996/mt7996.h
-+++ b/mt7996/mt7996.h
-@@ -649,7 +649,7 @@ int mt7996_mcu_set_fixed_rate_table(struct mt7996_phy *phy, u8 table_idx,
- 				    u16 rate_idx, bool beacon);
- int mt7996_mcu_rf_regval(struct mt7996_dev *dev, u32 regidx, u32 *val, bool set);
- int mt7996_mcu_set_hdr_trans(struct mt7996_dev *dev, bool hdr_trans);
--int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u8 val);
-+int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u16 val);
- int mt7996_mcu_reset_rro_sessions(struct mt7996_dev *dev,
- 				     u16 wcid, u8 tid, u8 pid);
- int mt7996_mcu_wa_cmd(struct mt7996_dev *dev, int cmd, u32 a1, u32 a2, u32 a3);
-diff --git a/mt7996/regs.h b/mt7996/regs.h
-index 5577c9348..37d24b9b6 100644
---- a/mt7996/regs.h
-+++ b/mt7996/regs.h
-@@ -637,6 +637,8 @@ enum base_rev {
- #define MT_PAD_GPIO_ADIE_COMB			GENMASK(16, 15)
- 
- #define MT_HW_REV				0x70010204
-+#define MT_HW_VER1				0x8a00
-+
- #define MT_WF_SUBSYS_RST			0x70028600
- 
- /* PCIE MAC */
--- 
-2.39.2
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2012-wifi-mt76-mt7996-add-dma-mask-limitation.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2012-wifi-mt76-mt7996-add-dma-mask-limitation.patch
deleted file mode 100644
index 5ff3139..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2012-wifi-mt76-mt7996-add-dma-mask-limitation.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-From 655b23a24e07980cecd4f09e8779dfc9f69bff51 Mon Sep 17 00:00:00 2001
-From: "sujuan.chen" <sujuan.chen@mediatek.com>
-Date: Thu, 20 Jul 2023 10:25:50 +0800
-Subject: [PATCH 2012/2012] wifi: mt76: mt7996: add dma mask limitation
-
-Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
----
- dma.c         |  4 ++--
- mt7996/mmio.c | 10 +---------
- mt7996/pci.c  |  2 +-
- 3 files changed, 4 insertions(+), 12 deletions(-)
-
-diff --git a/dma.c b/dma.c
-index 7e3d0393b..81412deb1 100644
---- a/dma.c
-+++ b/dma.c
-@@ -495,7 +495,7 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
- 		} else {
- 			struct mt76_queue_buf qbuf;
- 
--			buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
-+			buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC | GFP_DMA32);
- 			if (!buf)
- 				return NULL;
- 
-@@ -714,7 +714,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- 		if (mt76_queue_is_rro_ind(q))
- 			goto done;
- 
--		buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
-+		buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC | GFP_DMA32);
- 		if (!buf)
- 			break;
- 
-diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index 940f94998..7a1d81447 100644
---- a/mt7996/mmio.c
-+++ b/mt7996/mmio.c
-@@ -286,7 +286,7 @@ static u32 mt7996_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
- 		void *ptr;
- 
- 		ptr = page_frag_alloc(&wed->rx_buf_ring.rx_page, length,
--				      GFP_KERNEL);
-+				      GFP_ATOMIC | GFP_DMA32);
- 		if (!ptr) {
- 			mt76_put_rxwi(&dev->mt76, r);
- 			goto unmap;
-@@ -501,14 +501,6 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
- 
- 	dev->mt76.token_size = MT7996_SW_TOKEN_SIZE;
- 
--	ret = dma_set_mask(wed->dev, DMA_BIT_MASK(32));
--	if (ret)
--		return ret;
--
--	ret = dma_set_coherent_mask(wed->dev, DMA_BIT_MASK(32));
--	if (ret)
--		return ret;
--
- 	return 1;
- #else
- 	return 0;
-diff --git a/mt7996/pci.c b/mt7996/pci.c
-index 9a134fcab..993e53817 100644
---- a/mt7996/pci.c
-+++ b/mt7996/pci.c
-@@ -107,7 +107,7 @@ static int mt7996_pci_probe(struct pci_dev *pdev,
- 
- 	pci_set_master(pdev);
- 
--	ret = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32));
-+	ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
- 	if (ret)
- 		return ret;
- 
--- 
-2.39.2
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2013-wifi-mt76-mt7996-add-per-bss-statistic-info.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2013-wifi-mt76-mt7996-add-per-bss-statistic-info.patch
deleted file mode 100644
index fe8d166..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2013-wifi-mt76-mt7996-add-per-bss-statistic-info.patch
+++ /dev/null
@@ -1,122 +0,0 @@
-From 3cee39db21222ca86581819f72fcc4839dfea429 Mon Sep 17 00:00:00 2001
-From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
-Date: Fri, 18 Aug 2023 10:17:08 +0800
-Subject: [PATCH] wifi: mt76: mt7996: add per bss statistic info
-
-Whenever WED is enabled, unicast traffic might run through HW path.
-As a result, we need to count them using WM event.
-Broadcast and multicast traffic on the other hand, will be counted in mac80211
-as they always go through SW path and thus mac80211 can always see and count them.
-
-|         | Tx                             | Rx                        |
-|---------|--------------------------------|---------------------------|
-| Unicast | mt76                           | mt76                      |
-|         | __mt7996_stat_to_netdev()      | __mt7996_stat_to_netdev() |
-|---------|--------------------------------|---------------------------|
-| BMCast  | mac80211                       | mac80211                  |
-|         | __ieee80211_subif_start_xmit() | ieee80211_deliver_skb()   |
----
- mt7996/init.c |  1 +
- mt7996/main.c |  1 +
- mt7996/mcu.c  | 40 +++++++++++++++++++++++++++++++++++-----
- 3 files changed, 37 insertions(+), 5 deletions(-)
-
-diff --git a/mt7996/init.c b/mt7996/init.c
-index 1cdf81a..6b30820 100644
---- a/mt7996/init.c
-+++ b/mt7996/init.c
-@@ -375,6 +375,7 @@ mt7996_init_wiphy(struct ieee80211_hw *hw)
- 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
- 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CAN_REPLACE_PTK0);
- 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER);
-+	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_STAS_COUNT);
- 
- 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_OPERATING_CHANNEL_VALIDATION);
- 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_PROTECTION);
-diff --git a/mt7996/main.c b/mt7996/main.c
-index 52e9666..a8ed204 100644
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -254,6 +254,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
- 	mvif->sta.wcid.phy_idx = band_idx;
- 	mvif->sta.wcid.hw_key_idx = -1;
- 	mvif->sta.wcid.tx_info |= MT_WCID_TX_INFO_SET;
-+	mvif->sta.vif = mvif;
- 	mt76_wcid_init(&mvif->sta.wcid);
- 
- 	mt7996_mac_wtbl_update(dev, idx,
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index a4c6cd5..0653882 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -552,6 +552,27 @@ static void mt7996_mcu_rx_rro(struct mt7996_dev *dev, struct sk_buff *skb)
- 
- }
- 
-+static inline void __mt7996_stat_to_netdev(struct mt76_phy *mphy,
-+					   struct mt76_wcid *wcid,
-+					   u32 tx_bytes, u32 rx_bytes,
-+					   u32 tx_packets, u32 rx_packets)
-+{
-+	struct mt7996_sta *msta;
-+	struct ieee80211_vif *vif;
-+	struct wireless_dev *wdev;
-+
-+	if (wiphy_ext_feature_isset(mphy->hw->wiphy,
-+				    NL80211_EXT_FEATURE_STAS_COUNT)) {
-+		msta = container_of(wcid, struct mt7996_sta, wcid);
-+		vif = container_of((void *)msta->vif, struct ieee80211_vif,
-+				   drv_priv);
-+		wdev = ieee80211_vif_to_wdev(vif);
-+
-+		dev_sw_netstats_tx_add(wdev->netdev, tx_packets, tx_bytes);
-+		dev_sw_netstats_rx_add(wdev->netdev, rx_packets, rx_bytes);
-+	}
-+}
-+
- static void
- mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
- {
-@@ -567,7 +588,7 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
- 		u16 wlan_idx;
- 		struct mt76_wcid *wcid;
- 		struct mt76_phy *mphy;
--		u32 tx_bytes, rx_bytes;
-+		u32 tx_bytes, rx_bytes, tx_packets, rx_packets;
- 
- 		switch (le16_to_cpu(res->tag)) {
- 		case UNI_ALL_STA_TXRX_RATE:
-@@ -595,6 +616,9 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
- 				wcid->stats.tx_bytes += tx_bytes;
- 				wcid->stats.rx_bytes += rx_bytes;
- 
-+				__mt7996_stat_to_netdev(mphy, wcid,
-+							tx_bytes, rx_bytes, 0, 0);
-+
- 				ieee80211_tpt_led_trig_tx(mphy->hw, tx_bytes);
- 				ieee80211_tpt_led_trig_rx(mphy->hw, rx_bytes);
- 			}
-@@ -606,10 +630,16 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
- 			if (!wcid)
- 				break;
- 
--			wcid->stats.tx_packets +=
--				le32_to_cpu(res->msdu_cnt[i].tx_msdu_cnt);
--			wcid->stats.rx_packets +=
--				le32_to_cpu(res->msdu_cnt[i].rx_msdu_cnt);
-+			mphy = mt76_dev_phy(&dev->mt76, wcid->phy_idx);
-+
-+			tx_packets = le32_to_cpu(res->msdu_cnt[i].tx_msdu_cnt);
-+			rx_packets = le32_to_cpu(res->msdu_cnt[i].rx_msdu_cnt);
-+
-+			wcid->stats.tx_packets += tx_packets;
-+			wcid->stats.rx_packets += rx_packets;
-+
-+			__mt7996_stat_to_netdev(mphy, wcid, 0, 0,
-+						tx_packets, rx_packets);
- 			break;
- 		default:
- 			break;
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc b/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
index 15a88b2..dda4d93 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
@@ -1,54 +1,60 @@
 #patch patches (come from openwrt/lede/target/linux/mediatek)
 SRC_URI_append = " \
-    file://0001-Revert-wifi-mt76-mt7996-fill-txd-by-host-driver.patch \
-    file://0002-wifi-mt76-mt7996-add-support-for-auxiliary-path.patch \
-    file://0003-wifi-mt76-mt7996-add-eht-mode-tx-stats.patch \
-    file://0004-wifi-mt76-mt7996-add-thermal-protection-support.patch \
-    file://0005-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch \
-    file://0006-wifi-mt76-mt7996-make-band-capability-init-flexible.patch \
-    file://0007-wifi-mt76-mt7996-add-beacon-duplicate-tx-mode-suppor.patch \
-    file://0008-wifi-mt76-mt7996-fix-bss-rate-tlv-to-sync-firmware-c.patch \
-    file://0009-wifi-mt76-mt7996-adjust-wfdma-setting-to-enhance-thr.patch \
-    file://0010-wifi-mt76-mt7996-fill-txd-bandwidth-filed-value-for-.patch \
-    file://0011-wifi-mt76-mt7996-add-IEEE80211_RC_SMPS_CHANGED-handl.patch \
-    file://0012-wifi-mt76-mt7996-fix-mcu-command-format-to-align-fir.patch \
-    file://0013-wifi-mt76-mt7996-add-lock-for-indirect-register-acce.patch \
-    file://0014-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch \
-    file://0015-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch \
-    file://0016-wifi-mt76-mt7996-get-tx_retries-and-tx_failed-from-t.patch \
-    file://0017-wifi-mt76-mt7996-Add-mcu-commands-for-getting-sta-tx.patch \
-    file://0018-wifi-mt76-mt7996-enable-PPDU-TxS-to-host.patch \
-    file://0019-wifi-mt76-mt7996-fix-incorrect-report-of-TX-GI.patch \
-    file://0020-wifi-mt76-mt7996-remove-periodic-MPDU-TXS-request.patch \
-    file://0021-wifi-mt76-connac-use-peer-address-for-station-BMC-en.patch \
-    file://0022-wifi-mt76-mt7996-disable-rx-header-translation-for-B.patch \
+    file://0001-wifi-mt76-mt7996-add-eht-rx-rate-support.patch \
+    file://0002-wifi-mt76-mt7996-move-radio-ctrl-commands-to-proper-.patch \
+    file://0003-wifi-mt76-connac-add-support-for-dsp-firmware-downlo.patch \
+    file://0004-wifi-mt76-mt7996-fix-bss-wlan_idx-when-sending-bss_i.patch \
+    file://0005-wifi-mt76-mt7996-init-he-and-eht-cap-for-AP_VLAN.patch \
+    file://0006-wifi-mt76-mt7996-enable-VHT-extended-NSS-BW-feature.patch \
+    file://0007-wifi-mt76-connac-add-support-to-set-ifs-time-by-mcu-.patch \
+    file://0008-wifi-mt76-mt7996-use-correct-phy-for-background-rada.patch \
+    file://0009-wifi-mt76-mt7996-fix-WA-event-ring-size.patch \
+    file://0010-wifi-mt76-mt7996-add-muru-support.patch \
+    file://0011-wifi-mt76-mt7996-increase-tx-token-size.patch \
+    file://0014-wifi-mt76-mt7996-set-wcid-in-txp.patch \
+    file://0015-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch \
+    file://0016-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch \
+    file://0017-wifi-mt76-mt7996-add-thermal-protection-support.patch \
+    file://0018-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch \
+    file://0019-wifi-mt76-mt7996-fix-beamform-mcu-cmd-configuration.patch \
+    file://0020-wifi-mt76-mt7996-support-more-options-in-.set_bitrat.patch \
+    file://0021-wifi-mt76-mt7996-update-wmm-queue-mapping.patch \
+    file://0022-wifi-mt76-mt7996-enable-IDS-debug-log.patch \
+    file://0023-wifi-mt76-testmode-add-atenl-support-in-mt7996.patch \
+    file://0024-wifi-mt76-testmode-add-basic-testmode-support.patch \
+    file://0026-wifi-mt76-mt7996-add-led-feature-support.patch \
+    file://0027-wifi-mt76-mt7996-fix-twt-mcu-command.patch \
+    file://0028-wifi-mt76-mt7996-add-11v-mbss-support-for-mt76.patch \
+    file://0029-wifi-mt76-mt7996-Update-beacon-size-limitation-for-1.patch \
+    file://0030-wifi-mt76-mt7996-add-support-for-auxiliary-path.patch \
+    file://0031-wifi-mt76-mt7996-fix-memory-leak.patch \
+    file://0032-wifi-mt76-mt7996-add-eht-mode-tx-stats.patch \
+    file://0033-wifi-mt76-mt7996-disable-wfdma-tx-rx-during-SER.patch \
+    file://0034-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch \
+    file://0035-wifi-mt76-mt7996-make-band-capability-init-flexible.patch \
+    file://0036-wifi-mt76-mt7996-enable-SCS-feature-for-mt7996-drive.patch \
+    file://0037-wifi-mt76-mt7996-add-beacon-duplicate-tx-mode-suppor.patch \
+    file://0038-wifi-mt76-mt7996-fix-DFS-CAC-tx-emission-issue-after.patch \
+    file://0039-wifi-mt76-mt7996-fix-bss-rate-tlv-to-sync-firmware-c.patch \
+    file://0040-wifi-mt76-mt7996-fix-beamformee-ss-subfield-in-EHT-P.patch \
+    file://0041-wifi-mt76-mt7996-adjust-wfdma-setting-to-enhance-thr.patch \
     file://0999-wifi-mt76-mt7996-for-build-pass.patch \
     file://1000-wifi-mt76-mt7996-add-debug-tool.patch \
-    file://1001-wifi-mt76-mt7996-add-check-for-hostapd-config-he_ldp.patch \
-    file://1002-wifi-mt76-testmode-add-atenl-support-in-mt7996.patch \
-    file://1003-wifi-mt76-testmode-add-basic-testmode-support.patch \
-    file://1004-wifi-mt76-mt7996-add-eagle-default-bin-of-different-.patch \
-    file://1005-wifi-mt76-mt7996-enable-SCS-feature-for-mt7996-drive.patch \
-    file://1006-wifi-mt76-mt7996-add-txpower-support.patch \
-    file://1007-wifi-mt76-mt7996-add-mu-vendor-command-support.patch \
-    file://1008-wifi-mt76-mt7996-Add-air-monitor-support.patch \
-    file://1009-wifi-mt76-mt7996-add-driver-support-for-wpa3-ocv-and.patch \
-    file://1010-wifi-mt76-testmode-add-testmode-pre-calibration-supp.patch \
-    file://1011-wifi-mt76-mt7996-add-binfile-mode-support.patch \
-    file://1012-wifi-mt76-mt7996-add-normal-mode-pre-calibration-sup.patch \
-    file://1013-wifi-mt76-mt7996-Beacon-protection-feature-added.patch \
-    file://1014-wifi-mt76-testmode-add-testmode-ZWDFS-verification-s.patch \
-    file://1015-wifi-mt76-mt7996-add-single-sku.patch \
-    file://1016-wifi-mt76-mt7996-add-vendor-cmd-to-get-available-col.patch \
-    file://1017-wifi-mt76-mt7996-add-debugfs-for-fw-coredump.patch \
-    file://1018-wifi-mt76-mt7996-add-support-for-runtime-set-in-band.patch \
-    file://1019-wifi-mt76-mt7996-add-vendor-subcmd-EDCCA-ctrl-enable.patch \
-    file://1020-wifi-mt76-mt7996-Fix-incorrect-UWTBL_LEN_IN_DW-param.patch \
-    file://1021-wifi-mt76-mt7996-add-support-spatial-reuse-debug-com.patch \
-    file://1022-wifi-mt76-mt7996-Establish-BA-in-VO-queue.patch \
-    file://1023-wifi-mt76-mt7996-add-eagle-iFEM-HWITS-ZWDFS-SW-worka.patch \
-    file://1024-wifi-mt76-mt7996-report-tx-and-rx-byte-to-tpt_led.patch \
-    file://1025-wifi-mt76-mt7996-support-dup-wtbl.patch \
+    file://1001-wifi-mt76-mt7996-add-txpower-support.patch \
+    file://1002-wifi-mt76-mt7996-add-mu-vendor-command-support.patch \
+    file://1003-wifi-mt76-mt7996-Add-air-monitor-support.patch \
+    file://1004-wifi-mt76-mt7996-add-driver-support-for-wpa3-ocv-and.patch \
+    file://1005-wifi-mt76-mt7996-add-U-NII-4-support.patch \
+    file://1006-wifi-mt76-testmode-add-testmode-pre-calibration-supp.patch \
+    file://1007-wifi-mt76-mt7996-add-binfile-mode-support.patch \
+    file://1008-wifi-mt76-mt7996-add-normal-mode-pre-calibration-sup.patch \
+    file://1009-wifi-mt76-mt7996-Beacon-protection-feature-added.patch \
+    file://1010-wifi-mt76-testmode-add-testmode-ZWDFS-verification-s.patch \
+    file://1011-wifi-mt76-mt7996-add-single-sku.patch \
+    file://1012-wifi-mt76-mt7996-add-vendor-cmd-to-get-available-col.patch \
+    file://1013-wifi-mt76-mt7996-get-tx_retries-and-tx_fails-from-tx.patch \
+    file://1014-wifi-mt76-mt7996-add-debugfs-for-fw-coredump.patch \
+    file://1015-wifi-mt76-mt7996-add-support-for-runtime-set-in-band.patch \
     file://2000-wifi-mt76-rework-wed-rx-flow.patch \
     file://2001-wifi-mt76-revert-page_poll-for-kernel-5.4.patch \
     file://2002-wifi-mt76-wed-change-wed-token-init-size-to-adapt-we.patch \
@@ -58,9 +64,4 @@
     file://2006-wifi-mt76-add-random-early-drop-support.patch \
     file://2007-wifi-mt76-mt7996-reset-addr_elem-when-delete-ba.patch \
     file://2008-wifi-mt76-add-SER-support-for-wed3.0.patch \
-    file://2009-wifi-mt76-mt7915-wed-find-rx-token-by-physical-addre.patch \
-    file://2010-wifi-mt76-drop-packet-based-on-ind_reason.patch \
-    file://2011-wifi-mt76-mt7996-add-rro-timeout-setting.patch \
-    file://2012-wifi-mt76-mt7996-add-dma-mask-limitation.patch \
-    file://2013-wifi-mt76-mt7996-add-per-bss-statistic-info.patch \
     "
diff --git a/recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-mt7915-update-beacon-size-limitation.patch b/recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-mt7915-update-beacon-size-limitation.patch
new file mode 100644
index 0000000..b426ae9
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-mt7915-update-beacon-size-limitation.patch
@@ -0,0 +1,214 @@
+From 5205d81a06d556463a50b163bc6ceb6a6fb2bdeb Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+Date: Thu, 23 Mar 2023 08:49:48 +0800
+Subject: [PATCH 01/15] wifi: mt76: mt7915: update beacon size limitation
+
+To accommodate 11v MBSSID IE and support maximum 16 MBSSIDs, expand the
+beacon size limitation for beacon and inband discovery commands.
+
+Co-developed-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Co-developed-by: Money Wang <Money.Wang@mediatek.com>
+Signed-off-by: Money Wang <Money.Wang@mediatek.com>
+Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ mt7915/main.c   |  8 +++++---
+ mt7915/mcu.c    | 49 +++++++++++++++++++++++++++++--------------------
+ mt7915/mcu.h    | 18 ++++++++----------
+ mt7915/mt7915.h |  2 ++
+ 4 files changed, 44 insertions(+), 33 deletions(-)
+
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 9b79e915..de994ea7 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -646,11 +646,13 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
+ 		mt7915_update_bss_color(hw, vif, &info->he_bss_color);
+ 
+ 	if (changed & (BSS_CHANGED_BEACON |
+-		       BSS_CHANGED_BEACON_ENABLED |
+-		       BSS_CHANGED_UNSOL_BCAST_PROBE_RESP |
+-		       BSS_CHANGED_FILS_DISCOVERY))
++		       BSS_CHANGED_BEACON_ENABLED))
+ 		mt7915_mcu_add_beacon(hw, vif, info->enable_beacon, changed);
+ 
++	if (changed & (BSS_CHANGED_UNSOL_BCAST_PROBE_RESP |
++		       BSS_CHANGED_FILS_DISCOVERY))
++		mt7915_mcu_add_inband_discov(dev, vif, changed);
++
+ 	if (set_bss_info == 0)
+ 		mt7915_mcu_add_bss_info(phy, vif, false);
+ 	if (set_sta == 0)
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 8224f8be..6d000841 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -1882,10 +1882,9 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+ 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
+ }
+ 
+-static void
+-mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+-				struct sk_buff *rskb, struct bss_info_bcn *bcn,
+-				u32 changed)
++int
++mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
++			     u32 changed)
+ {
+ #define OFFLOAD_TX_MODE_SU	BIT(0)
+ #define OFFLOAD_TX_MODE_MU	BIT(1)
+@@ -1895,14 +1894,27 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+ 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
+ 	enum nl80211_band band = chandef->chan->band;
+ 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
++	struct bss_info_bcn *bcn;
+ 	struct bss_info_inband_discovery *discov;
+ 	struct ieee80211_tx_info *info;
+-	struct sk_buff *skb = NULL;
+-	struct tlv *tlv;
++	struct sk_buff *rskb, *skb = NULL;
++	struct tlv *tlv, *sub_tlv;
+ 	bool ext_phy = phy != &dev->phy;
+ 	u8 *buf, interval;
+ 	int len;
+ 
++	if (vif->bss_conf.nontransmitted)
++		return 0;
++
++	rskb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL,
++					       MT7915_MAX_BSS_OFFLOAD_SIZE);
++	if (IS_ERR(rskb))
++		return PTR_ERR(rskb);
++
++	tlv = mt76_connac_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
++	bcn = (struct bss_info_bcn *)tlv;
++	bcn->enable = true;
++
+ 	if (changed & BSS_CHANGED_FILS_DISCOVERY &&
+ 	    vif->bss_conf.fils_discovery.max_interval) {
+ 		interval = vif->bss_conf.fils_discovery.max_interval;
+@@ -1914,26 +1926,25 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+ 	}
+ 
+ 	if (!skb)
+-		return;
++		return -EINVAL;
+ 
+ 	info = IEEE80211_SKB_CB(skb);
+ 	info->control.vif = vif;
+ 	info->band = band;
+-
+ 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, ext_phy);
+ 
+ 	len = sizeof(*discov) + MT_TXD_SIZE + skb->len;
+ 	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
+ 
+-	if (len > (MT7915_MAX_BSS_OFFLOAD_SIZE - rskb->len)) {
++	if (skb->len > MT7915_MAX_BEACON_SIZE) {
+ 		dev_err(dev->mt76.dev, "inband discovery size limit exceed\n");
+ 		dev_kfree_skb(skb);
+-		return;
++		return -EINVAL;
+ 	}
+ 
+-	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_DISCOV,
+-					   len, &bcn->sub_ntlv, &bcn->len);
+-	discov = (struct bss_info_inband_discovery *)tlv;
++	sub_tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_DISCOV,
++					       len, &bcn->sub_ntlv, &bcn->len);
++	discov = (struct bss_info_inband_discovery *)sub_tlv;
+ 	discov->tx_mode = OFFLOAD_TX_MODE_SU;
+ 	/* 0: UNSOL PROBE RESP, 1: FILS DISCOV */
+ 	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
+@@ -1941,13 +1952,16 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+ 	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
+ 	discov->enable = true;
+ 
+-	buf = (u8 *)tlv + sizeof(*discov);
++	buf = (u8 *)sub_tlv + sizeof(*discov);
+ 
+ 	mt7915_mac_write_txwi(&dev->mt76, (__le32 *)buf, skb, wcid, 0, NULL,
+ 			      0, changed);
+ 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
+ 
+ 	dev_kfree_skb(skb);
++
++	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
++				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
+ }
+ 
+ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1983,7 +1997,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	if (!skb)
+ 		return -EINVAL;
+ 
+-	if (skb->len > MT7915_MAX_BEACON_SIZE - MT_TXD_SIZE) {
++	if (skb->len > MT7915_MAX_BEACON_SIZE) {
+ 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
+ 		dev_kfree_skb(skb);
+ 		return -EINVAL;
+@@ -1997,11 +2011,6 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
+ 	dev_kfree_skb(skb);
+ 
+-	if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP ||
+-	    changed & BSS_CHANGED_FILS_DISCOVERY)
+-		mt7915_mcu_beacon_inband_discov(dev, vif, rskb,
+-						bcn, changed);
+-
+ out:
+ 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
+ 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index b9ea297f..1592b5d6 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -495,10 +495,14 @@ enum {
+ 	SER_RECOVER
+ };
+ 
+-#define MT7915_MAX_BEACON_SIZE		512
+-#define MT7915_MAX_INBAND_FRAME_SIZE	256
+-#define MT7915_MAX_BSS_OFFLOAD_SIZE	(MT7915_MAX_BEACON_SIZE +	  \
+-					 MT7915_MAX_INBAND_FRAME_SIZE +	  \
++#define MT7915_MAX_BEACON_SIZE		1308
++#define MT7915_BEACON_UPDATE_SIZE	(sizeof(struct sta_req_hdr) +	\
++					 sizeof(struct bss_info_bcn) +	\
++					 sizeof(struct bss_info_bcn_cntdwn) +	\
++					 sizeof(struct bss_info_bcn_mbss) +	\
++					 MT_TXD_SIZE +	\
++					 sizeof(struct bss_info_bcn_cont))
++#define MT7915_MAX_BSS_OFFLOAD_SIZE	(MT7915_MAX_BEACON_SIZE +	\
+ 					 MT7915_BEACON_UPDATE_SIZE)
+ 
+ #define MT7915_BSS_UPDATE_MAX_SIZE	(sizeof(struct sta_req_hdr) +	\
+@@ -511,12 +515,6 @@ enum {
+ 					 sizeof(struct bss_info_bmc_rate) +\
+ 					 sizeof(struct bss_info_ext_bss))
+ 
+-#define MT7915_BEACON_UPDATE_SIZE	(sizeof(struct sta_req_hdr) +	\
+-					 sizeof(struct bss_info_bcn_cntdwn) + \
+-					 sizeof(struct bss_info_bcn_mbss) + \
+-					 sizeof(struct bss_info_bcn_cont) + \
+-					 sizeof(struct bss_info_inband_discovery))
+-
+ static inline s8
+ mt7915_get_power_bound(struct mt7915_phy *phy, s8 txpower)
+ {
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 0456e56f..21984e97 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -447,6 +447,8 @@ int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
+ 			 bool add);
+ int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+ 				struct cfg80211_he_bss_color *he_bss_color);
++int mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
++				 u32 changed);
+ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 			  int enable, u32 changed);
+ int mt7915_mcu_add_obss_spr(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-check-sta-rx-control-frame-to-multi.patch b/recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-check-sta-rx-control-frame-to-multi.patch
new file mode 100644
index 0000000..0d2b350
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-check-sta-rx-control-frame-to-multi.patch
@@ -0,0 +1,32 @@
+From a8a4d23f21cf56ca5d23a2ba15981b1f6459f19b Mon Sep 17 00:00:00 2001
+From: Allen Ye <allen.ye@mediatek.com>
+Date: Wed, 30 Aug 2023 18:34:47 +0800
+Subject: [PATCH 02/15] wifi: mt76: mt7915: check sta rx control frame to
+ multibss capability
+
+Add CAP3_RX_CTRL_FRAME_TO_MULTIBSS check when setting sta_muru_tlv,
+which is used to get stations's capability of receving control frames
+when running OFDMA with MBSSIDs.
+
+Signed-off-by: Allen Ye <allen.ye@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ mt7915/mcu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 6d000841..35cd4fb0 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -906,6 +906,8 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+ 		HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
+ 	muru->ofdma_ul.uo_ra =
+ 		HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
++	muru->ofdma_ul.rx_ctrl_frame_to_mbss =
++		HE_MAC(CAP3_RX_CTRL_FRAME_TO_MULTIBSS, elem->mac_cap_info[3]);
+ }
+ 
+ static void
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches/0003-wifi-mt76-mt7915-fix-potential-memory-leak-of-beacon.patch b/recipes-wifi/linux-mt76/files/patches/0003-wifi-mt76-mt7915-fix-potential-memory-leak-of-beacon.patch
new file mode 100644
index 0000000..fd0a117
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/0003-wifi-mt76-mt7915-fix-potential-memory-leak-of-beacon.patch
@@ -0,0 +1,58 @@
+From b63b83d4a4af7c51cd4cac1616863829b9308fd4 Mon Sep 17 00:00:00 2001
+From: Bo Jiao <Bo.Jiao@mediatek.com>
+Date: Wed, 30 Aug 2023 18:44:01 +0800
+Subject: [PATCH 03/15] wifi: mt76: mt7915: fix potential memory leak of beacon
+ commands
+
+Fix potential memory leak when setting beacon and inband discovery
+commands.
+
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ mt7915/mcu.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 35cd4fb0..74fafedb 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -1927,8 +1927,10 @@ mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+ 		skb = ieee80211_get_unsol_bcast_probe_resp_tmpl(hw, vif);
+ 	}
+ 
+-	if (!skb)
++	if (!skb) {
++		dev_kfree_skb(rskb);
+ 		return -EINVAL;
++	}
+ 
+ 	info = IEEE80211_SKB_CB(skb);
+ 	info->control.vif = vif;
+@@ -1940,6 +1942,7 @@ mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+ 
+ 	if (skb->len > MT7915_MAX_BEACON_SIZE) {
+ 		dev_err(dev->mt76.dev, "inband discovery size limit exceed\n");
++		dev_kfree_skb(rskb);
+ 		dev_kfree_skb(skb);
+ 		return -EINVAL;
+ 	}
+@@ -1996,11 +1999,14 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		goto out;
+ 
+ 	skb = ieee80211_beacon_get_template(hw, vif, &offs, 0);
+-	if (!skb)
++	if (!skb) {
++		dev_kfree_skb(rskb);
+ 		return -EINVAL;
++	}
+ 
+ 	if (skb->len > MT7915_MAX_BEACON_SIZE) {
+ 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
++		dev_kfree_skb(rskb);
+ 		dev_kfree_skb(skb);
+ 		return -EINVAL;
+ 	}
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches/0004-wifi-mt76-mt7915-get-rid-of-false-alamrs-of-tx-emiss.patch b/recipes-wifi/linux-mt76/files/patches/0004-wifi-mt76-mt7915-get-rid-of-false-alamrs-of-tx-emiss.patch
new file mode 100644
index 0000000..80f8e1d
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/0004-wifi-mt76-mt7915-get-rid-of-false-alamrs-of-tx-emiss.patch
@@ -0,0 +1,40 @@
+From c521ab8836a3e1a4e4f71896e364802c3cf2d6e7 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Wed, 17 May 2023 17:34:55 +0800
+Subject: [PATCH 04/15] wifi: mt76: mt7915: get rid of false alamrs of tx
+ emission issues
+
+When mt7915_mcu_set_chan_info() is set with CH_SWITCH_NORMAL reason,
+even if the action is UNI_CHANNEL_RX_PATH, it'll still generate some
+unexpected tones, which might confuse DFS CAC tests that there are some
+tone leakages. To get rid of these kinds of false alarms, always bypass
+DPD calibration when IEEE80211_CONF_IDLE is set.
+
+Reviewed-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ mt7915/mcu.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 74fafedb..9ee65fa5 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -2742,10 +2742,10 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
+ 	if (mt76_connac_spe_idx(phy->mt76->antenna_mask))
+ 		req.tx_path_num = fls(phy->mt76->antenna_mask);
+ 
+-	if (cmd == MCU_EXT_CMD(SET_RX_PATH) ||
+-	    dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
++	if (dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
+ 		req.switch_reason = CH_SWITCH_NORMAL;
+-	else if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
++	else if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL ||
++		 phy->mt76->hw->conf.flags & IEEE80211_CONF_IDLE)
+ 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
+ 	else if (!cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
+ 					  NL80211_IFTYPE_AP))
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches/0005-wifi-mt76-mt7915-fix-per-band-IEEE80211_CONF_MONITOR.patch b/recipes-wifi/linux-mt76/files/patches/0005-wifi-mt76-mt7915-fix-per-band-IEEE80211_CONF_MONITOR.patch
new file mode 100644
index 0000000..e5bab73
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/0005-wifi-mt76-mt7915-fix-per-band-IEEE80211_CONF_MONITOR.patch
@@ -0,0 +1,30 @@
+From 5119f4b1da53dfd34e73803a35adf80831db176e Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Wed, 30 Aug 2023 18:51:08 +0800
+Subject: [PATCH 05/15] wifi: mt76: mt7915: fix per-band IEEE80211_CONF_MONITOR
+ flag comparison
+
+Use the correct ieee80211_conf on each band for IEEE80211_CONF_MONITOR
+comparison.
+
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ mt7915/mcu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 9ee65fa5..eae62b9c 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -2742,7 +2742,7 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
+ 	if (mt76_connac_spe_idx(phy->mt76->antenna_mask))
+ 		req.tx_path_num = fls(phy->mt76->antenna_mask);
+ 
+-	if (dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
++	if (phy->mt76->hw->conf.flags & IEEE80211_CONF_MONITOR)
+ 		req.switch_reason = CH_SWITCH_NORMAL;
+ 	else if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL ||
+ 		 phy->mt76->hw->conf.flags & IEEE80211_CONF_IDLE)
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches/0006-wifi-mt76-mt7915-check-vif-type-before-reporting-cca.patch b/recipes-wifi/linux-mt76/files/patches/0006-wifi-mt76-mt7915-check-vif-type-before-reporting-cca.patch
new file mode 100644
index 0000000..22f8981
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/0006-wifi-mt76-mt7915-check-vif-type-before-reporting-cca.patch
@@ -0,0 +1,40 @@
+From 18d25338da14f4b7de5aabd86ebb066b45d7e916 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Mon, 28 Aug 2023 10:59:23 +0800
+Subject: [PATCH 06/15] wifi: mt76: mt7915: check vif type before reporting cca
+ and csa
+
+Don't report cca and csa finish to upper layer on station type vif to
+prevent warnings caused by setting beacon.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ mt7915/mcu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index eae62b9c..cdd1f847 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -225,7 +225,7 @@ int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
+ static void
+ mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
+ {
+-	if (vif->bss_conf.csa_active)
++	if (vif->bss_conf.csa_active && vif->type != NL80211_IFTYPE_STATION)
+ 		ieee80211_csa_finish(vif);
+ }
+ 
+@@ -326,7 +326,7 @@ mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
+ static void
+ mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
+ {
+-	if (!vif->bss_conf.color_change_active)
++	if (!vif->bss_conf.color_change_active || vif->type == NL80211_IFTYPE_STATION)
+ 		return;
+ 
+ 	ieee80211_color_change_finish(vif);
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches/0007-wifi-mt76-mt7915-update-mpdu-density-capability.patch b/recipes-wifi/linux-mt76/files/patches/0007-wifi-mt76-mt7915-update-mpdu-density-capability.patch
new file mode 100644
index 0000000..b87db29
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/0007-wifi-mt76-mt7915-update-mpdu-density-capability.patch
@@ -0,0 +1,60 @@
+From cb7c72bdaee4dedeea85377f120e12efb070e835 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Wed, 24 May 2023 10:17:38 +0800
+Subject: [PATCH 07/15] wifi: mt76: mt7915: update mpdu density capability
+
+Set mpdu density to 2 usec for non-mt7915 Wi-Fi 6 generation chipsets
+to align to the hardware capability which improves the throughput.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ mt7915/init.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/mt7915/init.c b/mt7915/init.c
+index 688e6bc6..004f41bf 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -398,8 +398,12 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
+ 		phy->mt76->sband_2g.sband.ht_cap.cap |=
+ 			IEEE80211_HT_CAP_LDPC_CODING |
+ 			IEEE80211_HT_CAP_MAX_AMSDU;
+-		phy->mt76->sband_2g.sband.ht_cap.ampdu_density =
+-			IEEE80211_HT_MPDU_DENSITY_4;
++		if (is_mt7915(&dev->mt76))
++			phy->mt76->sband_2g.sband.ht_cap.ampdu_density =
++				IEEE80211_HT_MPDU_DENSITY_4;
++		else
++			phy->mt76->sband_2g.sband.ht_cap.ampdu_density =
++				IEEE80211_HT_MPDU_DENSITY_2;
+ 	}
+ 
+ 	if (phy->mt76->cap.has_5ghz) {
+@@ -409,10 +413,11 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
+ 		phy->mt76->sband_5g.sband.ht_cap.cap |=
+ 			IEEE80211_HT_CAP_LDPC_CODING |
+ 			IEEE80211_HT_CAP_MAX_AMSDU;
+-		phy->mt76->sband_5g.sband.ht_cap.ampdu_density =
+-			IEEE80211_HT_MPDU_DENSITY_4;
+ 
+ 		if (is_mt7915(&dev->mt76)) {
++			phy->mt76->sband_5g.sband.ht_cap.ampdu_density =
++				IEEE80211_HT_MPDU_DENSITY_4;
++
+ 			vht_cap->cap |=
+ 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991 |
+ 				IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
+@@ -422,6 +427,9 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
+ 					IEEE80211_VHT_CAP_SHORT_GI_160 |
+ 					FIELD_PREP(IEEE80211_VHT_CAP_EXT_NSS_BW_MASK, 1);
+ 		} else {
++			phy->mt76->sband_5g.sband.ht_cap.ampdu_density =
++				IEEE80211_HT_MPDU_DENSITY_2;
++
+ 			vht_cap->cap |=
+ 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454 |
+ 				IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches/0008-wifi-mt76-mt7915-fix-beamforming-availability-check.patch b/recipes-wifi/linux-mt76/files/patches/0008-wifi-mt76-mt7915-fix-beamforming-availability-check.patch
new file mode 100644
index 0000000..d3d52fd
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/0008-wifi-mt76-mt7915-fix-beamforming-availability-check.patch
@@ -0,0 +1,37 @@
+From 47a2c8faf86bd3b3f3e7e0495015eebee53de0e9 Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+Date: Wed, 12 Apr 2023 15:53:42 +0800
+Subject: [PATCH 08/15] wifi: mt76: mt7915: fix beamforming availability check
+
+Without this patch, when ap sets the tx stream number to 2,
+ap won't send any beamforming packet.
+
+Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ mt7915/mcu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index cdd1f847..5c4a275c 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -1017,13 +1017,13 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+ 			struct ieee80211_sta *sta, bool bfee)
+ {
+ 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
+-	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
++	int sts = hweight16(phy->mt76->chainmask);
+ 
+ 	if (vif->type != NL80211_IFTYPE_STATION &&
+ 	    vif->type != NL80211_IFTYPE_AP)
+ 		return false;
+ 
+-	if (!bfee && tx_ant < 2)
++	if (!bfee && sts < 2)
+ 		return false;
+ 
+ 	if (sta->deflink.he_cap.has_he) {
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-fix-incorrect-HE-TX-GI-report.patch b/recipes-wifi/linux-mt76/files/patches/0009-wifi-mt76-fix-incorrect-HE-TX-GI-report.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-fix-incorrect-HE-TX-GI-report.patch
rename to recipes-wifi/linux-mt76/files/patches/0009-wifi-mt76-fix-incorrect-HE-TX-GI-report.patch
index 39ad5d0..b752c0e 100644
--- a/recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-fix-incorrect-HE-TX-GI-report.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0009-wifi-mt76-fix-incorrect-HE-TX-GI-report.patch
@@ -1,7 +1,7 @@
-From 5b47f914de6c0fb2d4a8494bb4c05a6f7d729135 Mon Sep 17 00:00:00 2001
+From 809ef0860a8e3f3fe223cd2842d882e203124639 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Thu, 18 May 2023 18:11:37 +0800
-Subject: [PATCH 1/7] wifi: mt76: fix incorrect HE TX GI report
+Subject: [PATCH 09/15] wifi: mt76: fix incorrect HE TX GI report
 
 Change GI reporting source from static capability to rate-tuning module.
 
@@ -17,7 +17,7 @@
  7 files changed, 282 insertions(+), 22 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index a238216..0609b4a 100644
+index 034ab90c..1ca23c90 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -254,12 +254,16 @@ struct mt76_queue_ops {
@@ -38,10 +38,10 @@
  	MT_PHY_TYPE_HE_EXT_SU,
  	MT_PHY_TYPE_HE_TB,
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 9312c35..c1f234e 100644
+index 004f41bf..2eec451f 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -660,6 +660,8 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
+@@ -663,6 +663,8 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
  	struct mt76_phy *mphy = phy->mt76;
  	int ret;
  
@@ -50,7 +50,7 @@
  	INIT_DELAYED_WORK(&mphy->mac_work, mt7915_mac_work);
  
  	mt7915_eeprom_parse_hw_cap(dev, phy);
-@@ -1192,6 +1194,8 @@ int mt7915_register_device(struct mt7915_dev *dev)
+@@ -1195,6 +1197,8 @@ int mt7915_register_device(struct mt7915_dev *dev)
  	dev->phy.dev = dev;
  	dev->phy.mt76 = &dev->mt76.phy;
  	dev->mt76.phy.priv = &dev->phy;
@@ -60,7 +60,7 @@
  	INIT_DELAYED_WORK(&dev->mphy.mac_work, mt7915_mac_work);
  	INIT_LIST_HEAD(&dev->sta_rc_list);
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 2222fb9..99a770e 100644
+index b8b0c0fd..789f86a1 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -173,15 +173,7 @@ static void mt7915_mac_sta_poll(struct mt7915_dev *dev)
@@ -188,10 +188,10 @@
  
  	mt76_tx_status_check(mphy->dev, false);
 diff --git a/mt7915/main.c b/mt7915/main.c
-index a3fd54c..449c2ee 100644
+index de994ea7..33813259 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -751,6 +751,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -739,6 +739,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  
  	INIT_LIST_HEAD(&msta->rc_list);
  	INIT_LIST_HEAD(&msta->wcid.poll_list);
@@ -199,7 +199,7 @@
  	msta->vif = mvif;
  	msta->wcid.sta = 1;
  	msta->wcid.idx = idx;
-@@ -775,6 +776,7 @@ void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -763,6 +764,7 @@ void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  {
  	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
@@ -207,7 +207,7 @@
  	int i;
  
  	mt7915_mcu_add_sta(dev, vif, sta, false);
-@@ -791,6 +793,11 @@ void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -779,6 +781,11 @@ void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (!list_empty(&msta->rc_list))
  		list_del_init(&msta->rc_list);
  	spin_unlock_bh(&mdev->sta_poll_lock);
@@ -220,10 +220,10 @@
  
  static void mt7915_tx(struct ieee80211_hw *hw,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index b6fba1a..9996c08 100644
+index 5c4a275c..0660843c 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3723,6 +3723,167 @@ out:
+@@ -3721,6 +3721,167 @@ out:
  	return ret;
  }
  
@@ -392,7 +392,7 @@
  				struct cfg80211_he_bss_color *he_bss_color)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 1592b5d..aebacc7 100644
+index 1592b5d6..aebacc7d 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -152,6 +152,61 @@ struct mt7915_mcu_eeprom_info {
@@ -466,7 +466,7 @@
 +};
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index d317c52..900ba09 100644
+index 21984e97..3510dbcc 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -137,6 +137,7 @@ struct mt7915_sta {
@@ -488,7 +488,7 @@
  #ifdef CONFIG_NL80211_TESTMODE
  	struct {
  		u32 *reg_backup;
-@@ -495,6 +500,7 @@ int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch);
+@@ -493,6 +498,7 @@ int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch);
  int mt7915_mcu_get_temperature(struct mt7915_phy *phy);
  int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state);
  int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy);
@@ -497,5 +497,5 @@
  			   struct ieee80211_sta *sta, struct rate_info *rate);
  int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-add-pc-stack-dump-for-WM-s-coredump.patch b/recipes-wifi/linux-mt76/files/patches/0010-wifi-mt76-mt7915-add-pc-stack-dump-for-WM-s-coredump.patch
similarity index 96%
rename from recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-add-pc-stack-dump-for-WM-s-coredump.patch
rename to recipes-wifi/linux-mt76/files/patches/0010-wifi-mt76-mt7915-add-pc-stack-dump-for-WM-s-coredump.patch
index f269b5c..70ca901 100644
--- a/recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-add-pc-stack-dump-for-WM-s-coredump.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0010-wifi-mt76-mt7915-add-pc-stack-dump-for-WM-s-coredump.patch
@@ -1,7 +1,8 @@
-From 395824a77010ab860cb20141105dc61a4feacbc9 Mon Sep 17 00:00:00 2001
+From 5f92b4ac9dd583b733b95455d8d3bf88b14a95b5 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 22 May 2023 13:49:37 +0800
-Subject: [PATCH 2/7] wifi: mt76: mt7915: add pc stack dump for WM's coredump.
+Subject: [PATCH 10/15] wifi: mt76: mt7915: add pc stack dump for WM's
+ coredump.
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
@@ -15,7 +16,7 @@
  7 files changed, 207 insertions(+), 71 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 0609b4a..0d864fe 100644
+index 1ca23c90..a4cf9b62 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -27,6 +27,8 @@
@@ -40,7 +41,7 @@
  enum mt76_wed_type {
  	MT76_WED_Q_TX,
  	MT76_WED_Q_TXFREE,
-@@ -798,6 +806,9 @@ struct mt76_dev {
+@@ -782,6 +790,9 @@ struct mt76_dev {
  	struct device *dma_dev;
  
  	struct mt76_mcu mcu;
@@ -51,10 +52,10 @@
  	struct net_device napi_dev;
  	struct net_device tx_napi_dev;
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index bcd6c20..3aef23a 100644
+index 0f0a519f..cd6ce3c0 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -3049,6 +3049,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
+@@ -3020,6 +3020,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
  		goto out;
  	}
  
@@ -64,7 +65,7 @@
  	snprintf(dev->hw->wiphy->fw_version,
  		 sizeof(dev->hw->wiphy->fw_version),
  		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
-@@ -3078,6 +3081,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
+@@ -3049,6 +3052,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
  		goto out;
  	}
  
@@ -74,7 +75,7 @@
  	snprintf(dev->hw->wiphy->fw_version,
  		 sizeof(dev->hw->wiphy->fw_version),
  		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
-@@ -3148,6 +3154,9 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
+@@ -3119,6 +3125,9 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
  	dev_info(dev->dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
  		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
  
@@ -85,7 +86,7 @@
  		struct mt76_connac2_patch_sec *sec;
  		u32 len, addr, mode;
 diff --git a/mt7915/coredump.c b/mt7915/coredump.c
-index 5daf225..298c1ca 100644
+index 5daf2258..298c1cad 100644
 --- a/mt7915/coredump.c
 +++ b/mt7915/coredump.c
 @@ -7,7 +7,7 @@
@@ -413,7 +414,7 @@
  }
  
 diff --git a/mt7915/coredump.h b/mt7915/coredump.h
-index 709f8e9..809ccbd 100644
+index 709f8e9c..809ccbdf 100644
 --- a/mt7915/coredump.h
 +++ b/mt7915/coredump.h
 @@ -4,6 +4,7 @@
@@ -513,7 +514,7 @@
  	return NULL;
  }
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 99a770e..d81fae9 100644
+index 789f86a1..67e7b264 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -1595,28 +1595,31 @@ void mt7915_mac_reset_work(struct work_struct *work)
@@ -594,7 +595,7 @@
  }
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 900ba09..2c5d929 100644
+index 3510dbcc..eb66fcda 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -286,7 +286,7 @@ struct mt7915_dev {
@@ -607,10 +608,10 @@
  #endif
  
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 89ac8e6..7515b23 100644
+index 588cd87e..d01b9ea9 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -1219,4 +1219,24 @@ enum offs_rev {
+@@ -1218,4 +1218,24 @@ enum offs_rev {
  #define MT_MCU_WM_CIRQ_EINT_MASK_CLR_ADDR	MT_MCU_WM_CIRQ(0x108)
  #define MT_MCU_WM_CIRQ_EINT_SOFT_ADDR		MT_MCU_WM_CIRQ(0x118)
  
@@ -636,5 +637,5 @@
 +
  #endif
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/0003-wifi-mt76-mt7915-move-temperature-margin-check-to-mt.patch b/recipes-wifi/linux-mt76/files/patches/0011-wifi-mt76-mt7915-move-temperature-margin-check-to-mt.patch
similarity index 87%
rename from recipes-wifi/linux-mt76/files/patches/0003-wifi-mt76-mt7915-move-temperature-margin-check-to-mt.patch
rename to recipes-wifi/linux-mt76/files/patches/0011-wifi-mt76-mt7915-move-temperature-margin-check-to-mt.patch
index 9e2ce35..1e17d22 100644
--- a/recipes-wifi/linux-mt76/files/patches/0003-wifi-mt76-mt7915-move-temperature-margin-check-to-mt.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0011-wifi-mt76-mt7915-move-temperature-margin-check-to-mt.patch
@@ -1,7 +1,7 @@
-From b5829fc76a9451651a8710a6c8b8f74b93d0a1cf Mon Sep 17 00:00:00 2001
+From b7d4a039b0f828dfc7758a364c72c389cc500093 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 13 Jul 2023 15:50:00 +0800
-Subject: [PATCH 3/7] wifi: mt76: mt7915: move temperature margin check to
+Subject: [PATCH 11/15] wifi: mt76: mt7915: move temperature margin check to
  mt7915_thermal_temp_store()
 
 Originally, we would reduce the 10-degree margin to the restore
@@ -17,7 +17,7 @@
  2 files changed, 5 insertions(+), 5 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index c1f234e..294876a 100644
+index 2eec451f..bcd37172 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -83,12 +83,13 @@ static ssize_t mt7915_thermal_temp_store(struct device *dev,
@@ -38,10 +38,10 @@
  		return -EINVAL;
  	}
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 9996c08..9a79119 100644
+index 0660843c..ae488039 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3156,8 +3156,7 @@ int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy)
+@@ -3154,8 +3154,7 @@ int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy)
  
  	/* set high-temperature trigger threshold */
  	req.ctrl.ctrl_id = THERMAL_PROTECT_ENABLE;
@@ -52,5 +52,5 @@
  	req.sustain_time = cpu_to_le16(10);
  
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/0004-wifi-mt76-mt7915-fix-txpower-issues.patch b/recipes-wifi/linux-mt76/files/patches/0012-wifi-mt76-mt7915-fix-txpower-issues.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches/0004-wifi-mt76-mt7915-fix-txpower-issues.patch
rename to recipes-wifi/linux-mt76/files/patches/0012-wifi-mt76-mt7915-fix-txpower-issues.patch
index 31fcb9e..d0665af 100644
--- a/recipes-wifi/linux-mt76/files/patches/0004-wifi-mt76-mt7915-fix-txpower-issues.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0012-wifi-mt76-mt7915-fix-txpower-issues.patch
@@ -1,7 +1,7 @@
-From 6cb2b319acc161e61dd875536bb2c8ee86efcad8 Mon Sep 17 00:00:00 2001
+From 285ce41898a1c7c49e89681a31cd7daa1d8b6ad3 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Sat, 29 Jul 2023 04:53:47 +0800
-Subject: [PATCH 4/7] wifi: mt76: mt7915: fix txpower issues
+Subject: [PATCH 12/15] wifi: mt76: mt7915: fix txpower issues
 
 ---
  eeprom.c         |  4 ++--
@@ -13,7 +13,7 @@
  6 files changed, 32 insertions(+), 27 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 2558788..750e031 100644
+index 2558788f..750e031d 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -338,7 +338,7 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
@@ -35,10 +35,10 @@
  	val = mt76_get_of_array(np, "rates-cck", &len, ARRAY_SIZE(dest->cck));
  	mt76_apply_array_limit(dest->cck, ARRAY_SIZE(dest->cck), val,
 diff --git a/mac80211.c b/mac80211.c
-index 12fcb2b..aaaf6a9 100644
+index 85407387..0a081613 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -1538,7 +1538,7 @@ int mt76_get_txpower(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1486,7 +1486,7 @@ int mt76_get_txpower(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  		     int *dbm)
  {
  	struct mt76_phy *phy = hw->priv;
@@ -48,7 +48,7 @@
  
  	*dbm = DIV_ROUND_UP(phy->txpower_cur + delta, 2);
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 6c3696c..93e549c 100644
+index 6c3696c8..93e549c3 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -950,9 +950,9 @@ mt7915_xmit_queues_show(struct seq_file *file, void *data)
@@ -132,10 +132,10 @@
  	reg = is_mt7915(&dev->mt76) ? MT_WF_PHY_TPC_CTRL_STAT(band) :
  	      MT_WF_PHY_TPC_CTRL_STAT_MT7916(band);
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 294876a..d8fd8d6 100644
+index bcd37172..15b719fa 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -278,7 +278,7 @@ static void mt7915_led_set_brightness(struct led_classdev *led_cdev,
+@@ -281,7 +281,7 @@ static void mt7915_led_set_brightness(struct led_classdev *led_cdev,
  void mt7915_init_txpower(struct mt7915_dev *dev,
  			 struct ieee80211_supported_band *sband)
  {
@@ -145,10 +145,10 @@
  	int pwr_delta = mt7915_eeprom_get_power_delta(dev, sband->band);
  	struct mt76_power_limits limits;
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 449c2ee..96336b6 100644
+index 33813259..a90ac456 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1075,6 +1075,7 @@ mt7915_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
+@@ -1063,6 +1063,7 @@ mt7915_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
  	mt76_set_stream_caps(phy->mt76, true);
  	mt7915_set_stream_vht_txbf_caps(phy);
  	mt7915_set_stream_he_caps(phy);
@@ -157,7 +157,7 @@
  	mutex_unlock(&dev->mt76.mutex);
  
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index aebacc7..8f36546 100644
+index aebacc7d..8f365461 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -574,7 +574,7 @@ static inline s8
@@ -170,5 +170,5 @@
  	txpower = mt76_get_sar_power(mphy, mphy->chandef.chan, txpower * 2);
  	txpower -= mt76_tx_power_nss_delta(n_chains);
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/0005-wifi-mt76-mt7915-rework-init-txpower.patch b/recipes-wifi/linux-mt76/files/patches/0013-wifi-mt76-mt7915-rework-init-txpower.patch
similarity index 84%
rename from recipes-wifi/linux-mt76/files/patches/0005-wifi-mt76-mt7915-rework-init-txpower.patch
rename to recipes-wifi/linux-mt76/files/patches/0013-wifi-mt76-mt7915-rework-init-txpower.patch
index e6ddc58..75c90b7 100644
--- a/recipes-wifi/linux-mt76/files/patches/0005-wifi-mt76-mt7915-rework-init-txpower.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0013-wifi-mt76-mt7915-rework-init-txpower.patch
@@ -1,7 +1,7 @@
-From 5fe1dd7724e7af4cb508af3147ddc9e1f12d2dc7 Mon Sep 17 00:00:00 2001
+From 738d720905afdf9abcb85cb6d6e8cd48a69cb82f Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 31 Jul 2023 11:07:35 +0800
-Subject: [PATCH 5/7] wifi: mt76: mt7915: rework init txpower
+Subject: [PATCH 13/15] wifi: mt76: mt7915: rework init txpower
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
@@ -11,10 +11,10 @@
  3 files changed, 23 insertions(+), 14 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index d8fd8d6..0d2587c 100644
+index 15b719fa..5ac1f995 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -275,10 +275,11 @@ static void mt7915_led_set_brightness(struct led_classdev *led_cdev,
+@@ -278,10 +278,11 @@ static void mt7915_led_set_brightness(struct led_classdev *led_cdev,
  		mt7915_led_set_config(led_cdev, 0xff, 0);
  }
  
@@ -29,7 +29,7 @@
  	int nss_delta = mt76_tx_power_nss_delta(n_chains);
  	int pwr_delta = mt7915_eeprom_get_power_delta(dev, sband->band);
  	struct mt76_power_limits limits;
-@@ -296,7 +297,7 @@ void mt7915_init_txpower(struct mt7915_dev *dev,
+@@ -299,7 +300,7 @@ void mt7915_init_txpower(struct mt7915_dev *dev,
  		}
  
  		target_power += pwr_delta;
@@ -38,7 +38,7 @@
  							  &limits,
  							  target_power);
  		target_power += nss_delta;
-@@ -307,6 +308,19 @@ void mt7915_init_txpower(struct mt7915_dev *dev,
+@@ -310,6 +311,19 @@ void mt7915_init_txpower(struct mt7915_dev *dev,
  	}
  }
  
@@ -58,7 +58,7 @@
  static void
  mt7915_regd_notifier(struct wiphy *wiphy,
  		     struct regulatory_request *request)
-@@ -322,9 +336,7 @@ mt7915_regd_notifier(struct wiphy *wiphy,
+@@ -325,9 +339,7 @@ mt7915_regd_notifier(struct wiphy *wiphy,
  	if (dev->mt76.region == NL80211_DFS_UNSET)
  		mt7915_mcu_rdd_background_enable(phy, NULL);
  
@@ -69,7 +69,7 @@
  
  	mphy->dfs_state = MT_DFS_STATE_UNKNOWN;
  	mt7915_dfs_init_radar_detector(phy);
-@@ -445,6 +457,7 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
+@@ -448,6 +460,7 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
  	mt76_set_stream_caps(phy->mt76, true);
  	mt7915_set_stream_vht_txbf_caps(phy);
  	mt7915_set_stream_he_caps(phy);
@@ -77,7 +77,7 @@
  
  	wiphy->available_antennas_rx = phy->mt76->antenna_mask;
  	wiphy->available_antennas_tx = phy->mt76->antenna_mask;
-@@ -708,9 +721,6 @@ static void mt7915_init_work(struct work_struct *work)
+@@ -711,9 +724,6 @@ static void mt7915_init_work(struct work_struct *work)
  
  	mt7915_mcu_set_eeprom(dev);
  	mt7915_mac_init(dev);
@@ -88,7 +88,7 @@
  }
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index d81fae9..a9bdb65 100644
+index 67e7b264..d9d5aad4 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -1395,8 +1395,8 @@ mt7915_mac_restart(struct mt7915_dev *dev)
@@ -103,10 +103,10 @@
  
  	if (test_bit(MT76_STATE_RUNNING, &dev->mphy.state)) {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 2c5d929..4293385 100644
+index eb66fcda..f0809291 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -430,8 +430,7 @@ void mt7915_dma_cleanup(struct mt7915_dev *dev);
+@@ -428,8 +428,7 @@ void mt7915_dma_cleanup(struct mt7915_dev *dev);
  int mt7915_dma_reset(struct mt7915_dev *dev, bool force);
  int mt7915_dma_start(struct mt7915_dev *dev, bool reset, bool wed_reset);
  int mt7915_txbf_init(struct mt7915_dev *dev);
@@ -117,5 +117,5 @@
  int mt7915_run(struct ieee80211_hw *hw);
  int mt7915_mcu_init(struct mt7915_dev *dev);
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/0006-wifi-mt76-mt7915-rework-mmio-access-flow.patch b/recipes-wifi/linux-mt76/files/patches/0014-wifi-mt76-mt7915-rework-mmio-access-flow.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches/0006-wifi-mt76-mt7915-rework-mmio-access-flow.patch
rename to recipes-wifi/linux-mt76/files/patches/0014-wifi-mt76-mt7915-rework-mmio-access-flow.patch
index 0521fec..9ee551a 100644
--- a/recipes-wifi/linux-mt76/files/patches/0006-wifi-mt76-mt7915-rework-mmio-access-flow.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0014-wifi-mt76-mt7915-rework-mmio-access-flow.patch
@@ -1,7 +1,7 @@
-From 441383b3fc8140bdff89d50861fd753b56154cba Mon Sep 17 00:00:00 2001
+From bee24c603808a54783adea0afbb0332eb9726f5f Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 15 Aug 2023 17:28:30 +0800
-Subject: [PATCH 6/7] wifi: mt76: mt7915: rework mmio access flow
+Subject: [PATCH 14/15] wifi: mt76: mt7915: rework mmio access flow
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
@@ -11,7 +11,7 @@
  2 files changed, 45 insertions(+), 5 deletions(-)
 
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index fc7ace6..5509661 100644
+index fc7ace63..55096616 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -490,6 +490,11 @@ static u32 __mt7915_reg_addr(struct mt7915_dev *dev, u32 addr)
@@ -106,7 +106,7 @@
  	switch (device_id) {
  	case 0x7915:
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 4293385..35458ec 100644
+index f0809291..24d8da28 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -292,6 +292,7 @@ struct mt7915_dev {
@@ -118,5 +118,5 @@
  	u32 hw_pattern;
  
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/0007-wifi-mt76-disable-HW-AMSDU-when-using-fixed-rate.patch b/recipes-wifi/linux-mt76/files/patches/0015-wifi-mt76-disable-HW-AMSDU-when-using-fixed-rate.patch
similarity index 76%
rename from recipes-wifi/linux-mt76/files/patches/0007-wifi-mt76-disable-HW-AMSDU-when-using-fixed-rate.patch
rename to recipes-wifi/linux-mt76/files/patches/0015-wifi-mt76-disable-HW-AMSDU-when-using-fixed-rate.patch
index 93f2945..c5e2934 100644
--- a/recipes-wifi/linux-mt76/files/patches/0007-wifi-mt76-disable-HW-AMSDU-when-using-fixed-rate.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0015-wifi-mt76-disable-HW-AMSDU-when-using-fixed-rate.patch
@@ -1,7 +1,7 @@
-From 42bd7d9fbb234b9765983a0fc30926a0df2d1c51 Mon Sep 17 00:00:00 2001
+From 96656c8856b6e386608b67b15ef4ab10f60af666 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Wed, 6 Sep 2023 16:27:25 +0800
-Subject: [PATCH 7/7] wifi: mt76: disable HW AMSDU when using fixed rate
+Subject: [PATCH] wifi: mt76: disable HW AMSDU when using fixed rate
 
 When using fixed rate, HW uses txd DW9 to store tx arrivial time if VTA
 is ture. It would overwrite the msdu_id in txd and lead to token pending
@@ -13,10 +13,10 @@
  1 file changed, 3 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index 93402d2..e26fcf8 100644
+index ee5177fd..1ece8754 100644
 --- a/mt76_connac_mac.c
 +++ b/mt76_connac_mac.c
-@@ -543,7 +543,7 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
+@@ -557,7 +557,7 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
  	val = FIELD_PREP(MT_TXD5_PID, pid);
  	if (pid >= MT_PACKET_ID_FIRST) {
  		val |= MT_TXD5_TX_STATUS_HOST;
@@ -25,7 +25,7 @@
  	}
  
  	txwi[5] = cpu_to_le32(val);
-@@ -578,6 +578,8 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
+@@ -592,6 +592,8 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
  				spe_idx = 24 + phy_idx;
  			txwi[7] |= cpu_to_le32(FIELD_PREP(MT_TXD7_SPE_IDX, spe_idx));
  		}
diff --git a/recipes-wifi/linux-mt76/files/patches/0999-wifi-mt76-mt7915-build-pass-for-Linux-Kernel-5.4-fix.patch b/recipes-wifi/linux-mt76/files/patches/0999-wifi-mt76-mt7915-build-pass-for-Linux-Kernel-5.4-fix.patch
index 8ccddd2..c874e7a 100644
--- a/recipes-wifi/linux-mt76/files/patches/0999-wifi-mt76-mt7915-build-pass-for-Linux-Kernel-5.4-fix.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0999-wifi-mt76-mt7915-build-pass-for-Linux-Kernel-5.4-fix.patch
@@ -1,7 +1,7 @@
-From ed118d36cb5185ef0bc31725c973998edfc6969f Mon Sep 17 00:00:00 2001
+From 96d8883e50abdbe6261de3a0aac64e5e7edbb248 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Sat, 1 Apr 2023 08:18:17 +0800
-Subject: [PATCH 0999/1040] wifi: mt76: mt7915: build pass for Linux Kernel 5.4
+Subject: [PATCH 0999/1034] wifi: mt76: mt7915: build pass for Linux Kernel 5.4
  fixes
 
 ---
@@ -15,14 +15,14 @@
  mt76_connac.h     |  2 --
  mt76_connac_mcu.c | 47 +-----------------------------
  mt76_connac_mcu.h |  4 ---
- mt7915/main.c     | 25 +++++++---------
+ mt7915/main.c     | 26 +++++++----------
  mt7915/mcu.c      |  1 +
  mt7915/mmio.c     | 55 +++++++++++++++++++++--------------
  usb.c             | 43 +++++++++++++--------------
- 14 files changed, 118 insertions(+), 224 deletions(-)
+ 14 files changed, 118 insertions(+), 225 deletions(-)
 
 diff --git a/debugfs.c b/debugfs.c
-index c4649ba..1c8328d 100644
+index 79064a4d..4a8e1864 100644
 --- a/debugfs.c
 +++ b/debugfs.c
 @@ -33,8 +33,10 @@ mt76_napi_threaded_set(void *data, u64 val)
@@ -37,10 +37,10 @@
  	return 0;
  }
 diff --git a/dma.c b/dma.c
-index 643e18e..24b44e7 100644
+index 05d9ab3c..c9d2671d 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -178,7 +178,7 @@ mt76_free_pending_rxwi(struct mt76_dev *dev)
+@@ -173,7 +173,7 @@ mt76_free_pending_rxwi(struct mt76_dev *dev)
  	local_bh_disable();
  	while ((t = __mt76_get_rxwi(dev)) != NULL) {
  		if (t->ptr)
@@ -49,7 +49,7 @@
  		kfree(t);
  	}
  	local_bh_enable();
-@@ -411,9 +411,9 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -409,9 +409,9 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  		if (!t)
  			return NULL;
  
@@ -62,7 +62,7 @@
  
  		buf = t->ptr;
  		t->dma_addr = 0;
-@@ -432,9 +432,9 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -430,9 +430,9 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  	} else {
  		buf = e->buf;
  		e->buf = NULL;
@@ -75,7 +75,7 @@
  	}
  
  	return buf;
-@@ -594,11 +594,11 @@ free_skb:
+@@ -592,11 +592,11 @@ free_skb:
  }
  
  static int
@@ -90,7 +90,7 @@
  
  	if (!q->ndesc)
  		return 0;
-@@ -606,25 +606,26 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -604,25 +604,26 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
  	spin_lock_bh(&q->lock);
  
  	while (q->queued < q->ndesc - 1) {
@@ -128,7 +128,7 @@
  			break;
  		}
  		frames++;
-@@ -668,7 +669,7 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
+@@ -666,7 +667,7 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
  		/* WED txfree queue needs ring to be initialized before setup */
  		q->flags = 0;
  		mt76_dma_queue_reset(dev, q);
@@ -137,7 +137,7 @@
  		q->flags = flags;
  
  		ret = mtk_wed_device_txfree_ring_setup(wed, q->regs);
-@@ -716,10 +717,6 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -714,10 +715,6 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  	if (!q->entry)
  		return -ENOMEM;
  
@@ -148,7 +148,7 @@
  	ret = mt76_dma_wed_setup(dev, q, false);
  	if (ret)
  		return ret;
-@@ -733,6 +730,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -731,6 +728,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  static void
  mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  {
@@ -156,7 +156,7 @@
  	void *buf;
  	bool more;
  
-@@ -746,7 +744,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -744,7 +742,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  		if (!buf)
  			break;
  
@@ -165,7 +165,7 @@
  	} while (1);
  
  	if (q->rx_head) {
-@@ -755,6 +753,13 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -753,6 +751,13 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  	}
  
  	spin_unlock_bh(&q->lock);
@@ -179,7 +179,7 @@
  }
  
  static void
-@@ -775,7 +780,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
+@@ -773,7 +778,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
  	mt76_dma_wed_setup(dev, q, true);
  	if (q->flags != MT_WED_Q_TXFREE) {
  		mt76_dma_sync_idx(dev, q);
@@ -188,7 +188,7 @@
  	}
  }
  
-@@ -793,7 +798,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
+@@ -791,7 +796,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
  
  		skb_add_rx_frag(skb, nr_frags, page, offset, len, q->buf_size);
  	} else {
@@ -197,7 +197,7 @@
  	}
  
  	if (more)
-@@ -861,12 +866,11 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+@@ -859,12 +864,11 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  		    !(dev->drv->rx_check(dev, data, len)))
  			goto free_frag;
  
@@ -211,7 +211,7 @@
  
  		*(u32 *)skb->cb = info;
  
-@@ -882,10 +886,10 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+@@ -880,10 +884,10 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  		continue;
  
  free_frag:
@@ -224,7 +224,7 @@
  	return done;
  }
  
-@@ -930,7 +934,7 @@ mt76_dma_init(struct mt76_dev *dev,
+@@ -928,7 +932,7 @@ mt76_dma_init(struct mt76_dev *dev,
  
  	mt76_for_each_q_rx(dev, i) {
  		netif_napi_add(&dev->napi_dev, &dev->napi[i], poll);
@@ -233,7 +233,7 @@
  		napi_enable(&dev->napi[i]);
  	}
  
-@@ -981,8 +985,6 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
+@@ -979,8 +983,6 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
  
  		netif_napi_del(&dev->napi[i]);
  		mt76_dma_rx_cleanup(dev, q);
@@ -243,7 +243,7 @@
  
  	mt76_free_pending_txwi(dev);
 diff --git a/eeprom.c b/eeprom.c
-index 750e031..ff8dc93 100644
+index 750e031d..ff8dc939 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -161,9 +161,15 @@ void
@@ -264,7 +264,7 @@
  	if (!is_valid_ether_addr(phy->macaddr)) {
  		eth_random_addr(phy->macaddr);
 diff --git a/mac80211.c b/mac80211.c
-index aaaf6a9..647f74c 100644
+index 0a081613..638405df 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -4,7 +4,6 @@
@@ -275,7 +275,7 @@
  #include "mt76.h"
  
  #define CHAN2G(_idx, _freq) {			\
-@@ -567,47 +566,6 @@ void mt76_unregister_phy(struct mt76_phy *phy)
+@@ -563,47 +562,6 @@ void mt76_unregister_phy(struct mt76_phy *phy)
  }
  EXPORT_SYMBOL_GPL(mt76_unregister_phy);
  
@@ -323,7 +323,7 @@
  struct mt76_dev *
  mt76_alloc_device(struct device *pdev, unsigned int size,
  		  const struct ieee80211_ops *ops,
-@@ -1805,21 +1763,6 @@ void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
+@@ -1748,21 +1706,6 @@ void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
  }
  EXPORT_SYMBOL_GPL(mt76_ethtool_worker);
  
@@ -346,7 +346,7 @@
  {
  	struct ieee80211_hw *hw = phy->hw;
 diff --git a/mcu.c b/mcu.c
-index a8cafa3..fa4b054 100644
+index a8cafa39..fa4b0544 100644
 --- a/mcu.c
 +++ b/mcu.c
 @@ -4,6 +4,7 @@
@@ -358,7 +358,7 @@
  struct sk_buff *
  __mt76_mcu_msg_alloc(struct mt76_dev *dev, const void *data,
 diff --git a/mt76.h b/mt76.h
-index 0d864fe..97ced84 100644
+index a4cf9b62..35bf19fb 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -210,7 +210,7 @@ struct mt76_queue {
@@ -370,7 +370,7 @@
  };
  
  struct mt76_mcu_ops {
-@@ -1457,7 +1457,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
+@@ -1439,7 +1439,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
  	return usb_bulk_msg(udev, pipe, data, len, actual_len, timeout);
  }
  
@@ -378,7 +378,7 @@
  void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
  			 struct mt76_sta_stats *stats, bool eht);
  int mt76_skb_adjust_pad(struct sk_buff *skb, int pad);
-@@ -1569,25 +1568,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
+@@ -1551,25 +1550,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
  struct mt76_txwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
  int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
  			  struct mt76_txwi_cache *r, dma_addr_t phys);
@@ -405,7 +405,7 @@
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
 diff --git a/mt7615/mcu.c b/mt7615/mcu.c
-index 955974a..db337aa 100644
+index 8d745c97..86061e95 100644
 --- a/mt7615/mcu.c
 +++ b/mt7615/mcu.c
 @@ -10,6 +10,7 @@
@@ -417,7 +417,7 @@
  static bool prefer_offload_fw = true;
  module_param(prefer_offload_fw, bool, 0644);
 diff --git a/mt76_connac.h b/mt76_connac.h
-index 1f29d8c..6f5cf18 100644
+index 22878f08..4560ab79 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -56,7 +56,6 @@ enum {
@@ -428,7 +428,7 @@
  
  	CMD_HE_MCS_BW80 = 0,
  	CMD_HE_MCS_BW160,
-@@ -270,7 +269,6 @@ static inline u8 mt76_connac_chan_bw(struct cfg80211_chan_def *chandef)
+@@ -264,7 +263,6 @@ static inline u8 mt76_connac_chan_bw(struct cfg80211_chan_def *chandef)
  		[NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
  		[NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
  		[NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
@@ -437,7 +437,7 @@
  
  	if (chandef->width >= ARRAY_SIZE(width_to_bw))
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 3aef23a..f06a81d 100644
+index cd6ce3c0..a558c68c 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -4,6 +4,7 @@
@@ -448,7 +448,7 @@
  
  int mt76_connac_mcu_start_firmware(struct mt76_dev *dev, u32 addr, u32 option)
  {
-@@ -1346,40 +1347,6 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
+@@ -1332,40 +1333,6 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
  }
  EXPORT_SYMBOL_GPL(mt76_connac_get_phy_mode);
  
@@ -489,7 +489,7 @@
  const struct ieee80211_sta_he_cap *
  mt76_connac_get_he_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif)
  {
-@@ -1395,18 +1362,6 @@ mt76_connac_get_he_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif)
+@@ -1378,18 +1345,6 @@ mt76_connac_get_he_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif)
  }
  EXPORT_SYMBOL_GPL(mt76_connac_get_he_phy_cap);
  
@@ -509,10 +509,10 @@
  #define DEFAULT_HE_DURATION_RTS_THRES	1023
  static void
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 6064973..ddf901a 100644
+index fe729bbf..bd0bf4bb 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1928,12 +1928,8 @@ void mt76_connac_mcu_reg_wr(struct mt76_dev *dev, u32 offset, u32 val);
+@@ -1887,12 +1887,8 @@ void mt76_connac_mcu_reg_wr(struct mt76_dev *dev, u32 offset, u32 val);
  
  const struct ieee80211_sta_he_cap *
  mt76_connac_get_he_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif);
@@ -526,22 +526,22 @@
  int mt76_connac_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
  			    struct mt76_connac_sta_key_conf *sta_key_conf,
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 96336b6..95ad05d 100644
+index e18cc93b..48970349 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1405,22 +1405,20 @@ void mt7915_get_et_strings(struct ieee80211_hw *hw,
+@@ -1393,22 +1393,19 @@ void mt7915_get_et_strings(struct ieee80211_hw *hw,
  			   struct ieee80211_vif *vif,
  			   u32 sset, u8 *data)
  {
 -	if (sset != ETH_SS_STATS)
 -		return;
+-
+-	memcpy(data, *mt7915_gstrings_stats, sizeof(mt7915_gstrings_stats));
+-	data += sizeof(mt7915_gstrings_stats);
+-	page_pool_ethtool_stats_get_strings(data);
 +	if (sset == ETH_SS_STATS)
 +		memcpy(data, *mt7915_gstrings_stats,
 +		       sizeof(mt7915_gstrings_stats));
- 
--	memcpy(data, mt7915_gstrings_stats, sizeof(mt7915_gstrings_stats));
--	data += sizeof(mt7915_gstrings_stats);
--	page_pool_ethtool_stats_get_strings(data);
  }
  
  static
@@ -558,7 +558,7 @@
  }
  
  static void mt7915_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
-@@ -1448,7 +1446,7 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
+@@ -1436,7 +1433,7 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
  		.idx = mvif->mt76.idx,
  	};
  	/* See mt7915_ampdu_stat_read_phy, etc */
@@ -567,7 +567,7 @@
  
  	mutex_lock(&dev->mt76.mutex);
  
-@@ -1560,12 +1558,9 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
+@@ -1548,12 +1545,9 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
  		return;
  
  	ei += wi.worker_stat_count;
@@ -584,7 +584,7 @@
  
  static void
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 9a79119..e9d7f20 100644
+index a34b75dc..50b49e54 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -6,6 +6,7 @@
@@ -596,10 +596,10 @@
  #define fw_name(_dev, name, ...)	({			\
  	char *_fw;						\
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 5509661..10f4e66 100644
+index fc7ace63..8d92e76d 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -608,9 +608,13 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
+@@ -570,9 +570,13 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
  static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
  {
  	struct mt7915_dev *dev;
@@ -613,7 +613,7 @@
  	for (i = 0; i < dev->mt76.rx_token_size; i++) {
  		struct mt76_txwi_cache *t;
  
-@@ -618,7 +622,9 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
+@@ -580,7 +584,9 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
  		if (!t || !t->ptr)
  			continue;
  
@@ -624,7 +624,7 @@
  		t->ptr = NULL;
  
  		mt76_put_rxwi(&dev->mt76, t);
-@@ -630,38 +636,47 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
+@@ -592,38 +598,47 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
  static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
  {
  	struct mtk_rxbm_desc *desc = wed->rx_buf_ring.desc;
@@ -690,7 +690,7 @@
  			goto unmap;
  		}
  
-@@ -673,8 +688,6 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+@@ -635,8 +650,6 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
  	return 0;
  
  unmap:
@@ -700,7 +700,7 @@
  	return -ENOMEM;
  }
 diff --git a/usb.c b/usb.c
-index 5e5c7bf..3e28171 100644
+index 5e5c7bf5..3e281715 100644
 --- a/usb.c
 +++ b/usb.c
 @@ -319,27 +319,29 @@ mt76u_set_endpoints(struct usb_interface *intf,
@@ -834,5 +834,5 @@
  
  static void mt76u_free_rx(struct mt76_dev *dev)
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch b/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch
index 8d1c0da..0e55e52 100644
--- a/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch
@@ -1,15 +1,14 @@
-From 87ad4633e89e1573f4238ecdfd6680dd78481722 Mon Sep 17 00:00:00 2001
+From 11e837febd8092b39d13b74c76d9134496c6e9d4 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 22 Jun 2022 10:39:47 +0800
-Subject: [PATCH 1000/1040] wifi: mt76: mt7915: add mtk internal debug tools
- for mt76
+Subject: [PATCH] wifi: mt76: mt7915: add mtk internal debug tools for mt76
 
 ---
  mt76_connac_mcu.h     |    6 +
  mt7915/Makefile       |    2 +-
  mt7915/debugfs.c      |   89 +-
  mt7915/mac.c          |   14 +
- mt7915/main.c         |    4 +
+ mt7915/main.c         |    5 +
  mt7915/mcu.c          |   48 +-
  mt7915/mcu.h          |    4 +
  mt7915/mt7915.h       |   43 +
@@ -17,16 +16,16 @@
  mt7915/mtk_debugfs.c  | 3622 +++++++++++++++++++++++++++++++++++++++++
  mt7915/mtk_mcu.c      |   51 +
  tools/fwlog.c         |   44 +-
- 12 files changed, 5326 insertions(+), 19 deletions(-)
+ 12 files changed, 5327 insertions(+), 19 deletions(-)
  create mode 100644 mt7915/mt7915_debug.h
  create mode 100644 mt7915/mtk_debugfs.c
  create mode 100644 mt7915/mtk_mcu.c
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index ddf901a..8b3b7c0 100644
+index bd0bf4bb..ab3b58e1 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1162,6 +1162,7 @@ enum {
+@@ -1151,6 +1151,7 @@ enum {
  	MCU_EXT_CMD_SET_TX_POWER_CTRL = 0x11,
  	MCU_EXT_CMD_FW_LOG_2_HOST = 0x13,
  	MCU_EXT_CMD_TXBF_ACTION = 0x1e,
@@ -34,7 +33,7 @@
  	MCU_EXT_CMD_EFUSE_BUFFER_MODE = 0x21,
  	MCU_EXT_CMD_THERMAL_PROT = 0x23,
  	MCU_EXT_CMD_STA_REC_UPDATE = 0x25,
-@@ -1185,6 +1186,11 @@ enum {
+@@ -1174,6 +1175,11 @@ enum {
  	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
  	MCU_EXT_CMD_RXDCOC_CAL = 0x59,
  	MCU_EXT_CMD_GET_MIB_INFO = 0x5a,
@@ -47,7 +46,7 @@
  	MCU_EXT_CMD_CAL_CACHE = 0x67,
  	MCU_EXT_CMD_RED_ENABLE = 0x68,
 diff --git a/mt7915/Makefile b/mt7915/Makefile
-index c4dca9c..fd71141 100644
+index c4dca9c1..fd711416 100644
 --- a/mt7915/Makefile
 +++ b/mt7915/Makefile
 @@ -4,7 +4,7 @@ EXTRA_CFLAGS += -DCONFIG_MT76_LEDS
@@ -60,7 +59,7 @@
  mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
  mt7915e-$(CONFIG_MT798X_WMAC) += soc.o
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 93e549c..f181377 100644
+index 93e549c3..f1813776 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -8,6 +8,9 @@
@@ -232,7 +231,7 @@
  
  	if (dev->relay_fwlog)
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index a9bdb65..2650b87 100644
+index d9d5aad4..d22a4079 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -275,6 +275,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
@@ -271,7 +270,7 @@
  }
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 95ad05d..b4dfe4b 100644
+index 4e5c138f..b6dc9513 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -73,7 +73,11 @@ int mt7915_run(struct ieee80211_hw *hw)
@@ -286,8 +285,16 @@
  	if (ret)
  		goto out;
  
+@@ -253,6 +257,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+ 	mvif->sta.wcid.phy_idx = ext_phy;
+ 	mvif->sta.wcid.hw_key_idx = -1;
+ 	mvif->sta.wcid.tx_info |= MT_WCID_TX_INFO_SET;
++	mvif->sta.vif = mvif;
+ 	mt76_packet_id_init(&mvif->sta.wcid);
+ 
+ 	mt7915_mac_wtbl_update(dev, idx,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index e9d7f20..47e178f 100644
+index 03f84343..6b19af74 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -205,6 +205,11 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -302,7 +309,7 @@
  	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
  }
  
-@@ -2297,7 +2302,10 @@ static int mt7915_red_set_watermark(struct mt7915_dev *dev)
+@@ -2288,7 +2293,10 @@ static int mt7915_red_set_watermark(struct mt7915_dev *dev)
  				 sizeof(req), false);
  }
  
@@ -314,7 +321,7 @@
  {
  #define RED_DISABLE		0
  #define RED_BY_WA_ENABLE	2
-@@ -3360,6 +3368,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+@@ -3352,6 +3360,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
  		.sku_enable = enable,
  	};
  
@@ -323,7 +330,7 @@
  	return mt76_mcu_send_msg(&dev->mt76,
  				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
  				 sizeof(req), true);
-@@ -4014,6 +4024,23 @@ out:
+@@ -4006,6 +4016,23 @@ out:
  	return ret;
  }
  
@@ -347,7 +354,7 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  {
  	struct {
-@@ -4042,3 +4069,22 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
+@@ -4034,3 +4061,22 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  
  	return 0;
  }
@@ -371,7 +378,7 @@
 +}
 +#endif
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 8f36546..dd3b506 100644
+index 8f365461..dd3b5062 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -333,6 +333,10 @@ enum {
@@ -386,7 +393,7 @@
  };
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 35458ec..887c4a5 100644
+index 24d8da28..f9e6917c 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -9,6 +9,7 @@
@@ -397,7 +404,7 @@
  #define MT7915_MAX_INTERFACES		19
  #define MT7915_WTBL_SIZE		288
  #define MT7916_WTBL_SIZE		544
-@@ -322,6 +323,28 @@ struct mt7915_dev {
+@@ -320,6 +321,28 @@ struct mt7915_dev {
  	struct reset_control *rstc;
  	void __iomem *dcm;
  	void __iomem *sku;
@@ -426,7 +433,7 @@
  };
  
  enum {
-@@ -601,4 +624,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -599,4 +622,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
@@ -453,7 +460,7 @@
  #endif
 diff --git a/mt7915/mt7915_debug.h b/mt7915/mt7915_debug.h
 new file mode 100644
-index 0000000..fa8794f
+index 00000000..fa8794fd
 --- /dev/null
 +++ b/mt7915/mt7915_debug.h
 @@ -0,0 +1,1418 @@
@@ -1877,7 +1884,7 @@
 +#endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
 new file mode 100644
-index 0000000..275acc6
+index 00000000..275acc61
 --- /dev/null
 +++ b/mt7915/mtk_debugfs.c
 @@ -0,0 +1,3622 @@
@@ -5505,7 +5512,7 @@
 +#endif
 diff --git a/mt7915/mtk_mcu.c b/mt7915/mtk_mcu.c
 new file mode 100644
-index 0000000..143dae2
+index 00000000..143dae26
 --- /dev/null
 +++ b/mt7915/mtk_mcu.c
 @@ -0,0 +1,51 @@
@@ -5561,7 +5568,7 @@
 +				 sizeof(req), true);
 +}
 diff --git a/tools/fwlog.c b/tools/fwlog.c
-index e5d4a10..3d51d9e 100644
+index e5d4a105..3d51d9ec 100644
 --- a/tools/fwlog.c
 +++ b/tools/fwlog.c
 @@ -26,7 +26,7 @@ static const char *debugfs_path(const char *phyname, const char *file)
diff --git a/recipes-wifi/linux-mt76/files/patches/1001-wifi-mt76-mt7915-csi-implement-csi-support.patch b/recipes-wifi/linux-mt76/files/patches/1001-wifi-mt76-mt7915-csi-implement-csi-support.patch
index 900672a..1e40fba 100644
--- a/recipes-wifi/linux-mt76/files/patches/1001-wifi-mt76-mt7915-csi-implement-csi-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1001-wifi-mt76-mt7915-csi-implement-csi-support.patch
@@ -1,7 +1,7 @@
-From e6ccf89484d41dbd38992cf60150ef0db4bbafb2 Mon Sep 17 00:00:00 2001
+From 3f62c2657a17715114869a4fa27bc32818bd2ad7 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Jun 2022 20:13:02 +0800
-Subject: [PATCH 1001/1040] wifi: mt76: mt7915: csi: implement csi support
+Subject: [PATCH 1001/1034] wifi: mt76: mt7915: csi: implement csi support
 
 ---
  mt76_connac_mcu.h |   2 +
@@ -17,10 +17,10 @@
  create mode 100644 mt7915/vendor.h
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 8b3b7c0..8a377dd 100644
+index ab3b58e1..f6738bc6 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1007,6 +1007,7 @@ enum {
+@@ -1003,6 +1003,7 @@ enum {
  	MCU_EXT_EVENT_WA_TX_STAT = 0x74,
  	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
  	MCU_EXT_EVENT_MURU_CTRL = 0x9f,
@@ -28,7 +28,7 @@
  };
  
  /* unified event table */
-@@ -1207,6 +1208,7 @@ enum {
+@@ -1196,6 +1197,7 @@ enum {
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
@@ -37,7 +37,7 @@
  
  enum {
 diff --git a/mt7915/Makefile b/mt7915/Makefile
-index fd71141..65129b4 100644
+index fd711416..65129b4f 100644
 --- a/mt7915/Makefile
 +++ b/mt7915/Makefile
 @@ -1,10 +1,10 @@
@@ -54,10 +54,10 @@
  mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
  mt7915e-$(CONFIG_MT798X_WMAC) += soc.o
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 0d2587c..607d881 100644
+index 5ac1f995..0ea2af17 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -696,6 +696,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
+@@ -699,6 +699,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
  	/* init wiphy according to mphy and phy */
  	mt7915_init_wiphy(phy);
  
@@ -70,7 +70,7 @@
  	ret = mt76_register_phy(mphy, true, mt76_rates,
  				ARRAY_SIZE(mt76_rates));
  	if (ret)
-@@ -1173,6 +1179,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
+@@ -1176,6 +1182,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
  	}
  }
  
@@ -96,7 +96,7 @@
  static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  {
  	struct mt7915_phy *phy = mt7915_ext_phy(dev);
-@@ -1181,6 +1206,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
+@@ -1184,6 +1209,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  	if (!phy)
  		return;
  
@@ -107,7 +107,7 @@
  	mt7915_unregister_thermal(phy);
  	mt76_unregister_phy(mphy);
  	ieee80211_free_hw(mphy->hw);
-@@ -1193,6 +1222,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
+@@ -1196,6 +1225,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
  	mt7915_dma_cleanup(dev);
  	tasklet_disable(&dev->mt76.irq_tasklet);
  
@@ -118,7 +118,7 @@
  	if (is_mt798x(&dev->mt76))
  		mt7986_wmac_disable(dev);
  }
-@@ -1233,6 +1266,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
+@@ -1236,6 +1269,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
  	dev->mt76.test_ops = &mt7915_testmode_ops;
  #endif
  
@@ -132,7 +132,7 @@
  				   ARRAY_SIZE(mt76_rates));
  	if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 47e178f..729a41d 100644
+index 897e0dd9..8994ea6a 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -40,6 +40,10 @@ static bool sr_scene_detect = true;
@@ -146,7 +146,7 @@
  static u8
  mt7915_mcu_get_sta_nss(u16 mcs_map)
  {
-@@ -379,6 +383,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -377,6 +381,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	case MCU_EXT_EVENT_FW_LOG_2_HOST:
  		mt7915_mcu_rx_log_message(dev, skb);
  		break;
@@ -158,7 +158,7 @@
  	case MCU_EXT_EVENT_BCC_NOTIFY:
  		mt7915_mcu_rx_bcc_notify(dev, skb);
  		break;
-@@ -4024,6 +4033,108 @@ out:
+@@ -4015,6 +4024,108 @@ out:
  	return ret;
  }
  
@@ -268,7 +268,7 @@
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index dd3b506..67eac5c 100644
+index dd3b5062..67eac5c9 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -589,4 +589,81 @@ mt7915_get_power_bound(struct mt7915_phy *phy, s8 txpower)
@@ -354,7 +354,7 @@
 +
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 887c4a5..6a96996 100644
+index 00476647..23119d0d 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -243,6 +243,20 @@ struct mt7915_phy {
@@ -378,7 +378,7 @@
  };
  
  struct mt7915_dev {
-@@ -624,6 +638,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -621,6 +635,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
@@ -393,7 +393,7 @@
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
 new file mode 100644
-index 0000000..98fd9c2
+index 00000000..98fd9c2d
 --- /dev/null
 +++ b/mt7915/vendor.c
 @@ -0,0 +1,452 @@
@@ -851,7 +851,7 @@
 +}
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
 new file mode 100644
-index 0000000..9d3db2a
+index 00000000..9d3db2a7
 --- /dev/null
 +++ b/mt7915/vendor.h
 @@ -0,0 +1,60 @@
@@ -916,5 +916,5 @@
 +
 +#endif
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1002-wifi-mt76-mt7915-air-monitor-support.patch b/recipes-wifi/linux-mt76/files/patches/1002-wifi-mt76-mt7915-air-monitor-support.patch
index cd80105..2e58f8b 100644
--- a/recipes-wifi/linux-mt76/files/patches/1002-wifi-mt76-mt7915-air-monitor-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1002-wifi-mt76-mt7915-air-monitor-support.patch
@@ -1,7 +1,7 @@
-From 9887703630f6949fffbbca476a121a38afc2d558 Mon Sep 17 00:00:00 2001
+From c13fe2649dddd5f918ab7d93a13e839c11e258a1 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Tue, 11 Jan 2022 12:03:23 +0800
-Subject: [PATCH 1002/1040] wifi: mt76: mt7915: air monitor support
+Subject: [PATCH 1002/1034] wifi: mt76: mt7915: air monitor support
 
 ---
  mt76_connac_mcu.h |   2 +
@@ -13,10 +13,10 @@
  6 files changed, 442 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 8a377dd..c1d9191 100644
+index f6738bc6..c24fa8e8 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1208,6 +1208,8 @@ enum {
+@@ -1197,6 +1197,8 @@ enum {
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
@@ -26,7 +26,7 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 2650b87..f171e97 100644
+index d22a4079..0e74c0d4 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -524,6 +524,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
@@ -41,10 +41,10 @@
  		status->flag |= RX_FLAG_8023;
  		mt7915_wed_check_ppe(dev, &dev->mt76.q_rx[q], msta, skb,
 diff --git a/mt7915/main.c b/mt7915/main.c
-index b4dfe4b..d667b44 100644
+index df506b01..7896c824 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -772,6 +772,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -760,6 +760,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (ret)
  		return ret;
  
@@ -55,7 +55,7 @@
  }
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 6a96996..6192e81 100644
+index 23119d0d..c733035b 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -195,6 +195,35 @@ struct mt7915_hif {
@@ -103,7 +103,7 @@
  #endif
  };
  
-@@ -642,6 +673,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -639,6 +670,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
@@ -114,7 +114,7 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 98fd9c2..43f9690 100644
+index 98fd9c2d..43f96903 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -430,6 +430,355 @@ out:
@@ -493,7 +493,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 9d3db2a..976817f 100644
+index 9d3db2a7..976817f3 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -4,6 +4,7 @@
@@ -547,5 +547,5 @@
 +
  #endif
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1003-wifi-mt76-mt7915-add-support-for-muru_onoff-via.patch b/recipes-wifi/linux-mt76/files/patches/1003-wifi-mt76-mt7915-add-support-for-muru_onoff-via.patch
index 831ac6c..3473003 100644
--- a/recipes-wifi/linux-mt76/files/patches/1003-wifi-mt76-mt7915-add-support-for-muru_onoff-via.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1003-wifi-mt76-mt7915-add-support-for-muru_onoff-via.patch
@@ -1,7 +1,7 @@
-From 74fffd688572bd2f2f9633f0acb0da2dba249aa7 Mon Sep 17 00:00:00 2001
+From a5abc630e8bf65e4ca21bc1cf1b74db7df6cd6d1 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Tue, 4 Apr 2023 02:23:57 +0800
-Subject: [PATCH 1003/1040] wifi: mt76: mt7915: add support for muru_onoff via
+Subject: [PATCH 1003/1034] wifi: mt76: mt7915: add support for muru_onoff via
 
 ---
  mt7915/mcu.c         | 10 ++++++++--
@@ -11,10 +11,10 @@
  4 files changed, 49 insertions(+), 2 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 729a41d..66ec469 100644
+index 8994ea6..fdb6bc5 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -875,6 +875,7 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -873,6 +873,7 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
@@ -22,7 +22,7 @@
  	struct sta_rec_muru *muru;
  	struct tlv *tlv;
  
-@@ -886,13 +887,18 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -884,13 +885,18 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  
  	muru = (struct sta_rec_muru *)tlv;
  
@@ -59,7 +59,7 @@
 +
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 6192e81..e45e2fb 100644
+index c733035..bd5543b 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -252,6 +252,8 @@ struct mt7915_phy {
@@ -72,10 +72,10 @@
  	struct mt76_channel_state state_ts;
  
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 275acc6..b7c54cc 100644
+index e6796bc..e1758ed 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2556,6 +2556,38 @@ static int mt7915_token_txd_read(struct seq_file *s, void *data)
+@@ -2558,6 +2558,38 @@ static int mt7915_token_txd_read(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -114,7 +114,7 @@
  static int mt7915_amsduinfo_read(struct seq_file *s, void *data)
  {
  	struct mt7915_dev *dev = dev_get_drvdata(s->private);
-@@ -3552,6 +3584,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3554,6 +3586,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  
  	mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
  
@@ -123,5 +123,5 @@
  			    &fops_fw_debug_module);
  	debugfs_create_file("fw_debug_level", 0600, dir, dev,
 -- 
-2.18.0
+2.39.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1004-wifi-mt76-mt7915-certification-patches.patch b/recipes-wifi/linux-mt76/files/patches/1004-wifi-mt76-mt7915-certification-patches.patch
index b8198c4..52d665b 100644
--- a/recipes-wifi/linux-mt76/files/patches/1004-wifi-mt76-mt7915-certification-patches.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1004-wifi-mt76-mt7915-certification-patches.patch
@@ -1,7 +1,7 @@
-From d35da7aef3ecc8b64605277374e676dcf3bffd94 Mon Sep 17 00:00:00 2001
+From 8f6f793835431b195cde1379b19640c550de2caa Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 6 Jun 2022 20:15:51 +0800
-Subject: [PATCH 1004/1040] wifi: mt76: mt7915: certification patches
+Subject: [PATCH 1004/1034] wifi: mt76: mt7915: certification patches
 
 ---
  mt76_connac_mcu.h    |   1 +
@@ -16,10 +16,10 @@
  9 files changed, 954 insertions(+), 5 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index c1d9191..9b065f3 100644
+index c24fa8e8..7b96feb2 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1210,6 +1210,7 @@ enum {
+@@ -1199,6 +1199,7 @@ enum {
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
@@ -28,7 +28,7 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index f171e97..8d1eeef 100644
+index 0e74c0d4..20b9b99f 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -8,6 +8,7 @@
@@ -76,10 +76,10 @@
  			       IEEE80211_RC_NSS_CHANGED |
  			       IEEE80211_RC_BW_CHANGED))
 diff --git a/mt7915/main.c b/mt7915/main.c
-index d667b44..ce5dcb3 100644
+index 7896c824..9b54ba1c 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -747,6 +747,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -735,6 +735,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	bool ext_phy = mvif->phy != &dev->phy;
@@ -89,7 +89,7 @@
  	int ret, idx;
  
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
-@@ -775,7 +778,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -763,7 +766,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  #ifdef CONFIG_MTK_VENDOR
  	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
  #endif
@@ -107,10 +107,10 @@
  
  void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 66ec469..92fa560 100644
+index fdb6bc5f..929f9bbe 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4139,6 +4139,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -4130,6 +4130,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
  
  	return 0;
  }
@@ -584,7 +584,7 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 84c52d9..7b7c2d1 100644
+index 84c52d9b..7b7c2d1d 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -471,10 +471,14 @@ enum {
@@ -818,10 +818,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e45e2fb..ab3c8f7 100644
+index bd5543b5..bf0f7dee 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -672,6 +672,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -669,6 +669,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
  #ifdef CONFIG_MTK_VENDOR
@@ -842,10 +842,10 @@
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index b7c54cc..96655db 100644
+index e1758edb..9bb6dd05 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2562,7 +2562,8 @@ static int mt7915_muru_onoff_get(void *data, u64 *val)
+@@ -2564,7 +2564,8 @@ static int mt7915_muru_onoff_get(void *data, u64 *val)
  
  	*val = phy->muru_onoff;
  
@@ -855,7 +855,7 @@
  		    !!(phy->muru_onoff & MUMIMO_UL),
  		    !!(phy->muru_onoff & MUMIMO_DL),
  		    !!(phy->muru_onoff & OFDMA_UL),
-@@ -2575,8 +2576,8 @@ static int mt7915_muru_onoff_set(void *data, u64 val)
+@@ -2577,8 +2578,8 @@ static int mt7915_muru_onoff_set(void *data, u64 val)
  {
  	struct mt7915_phy *phy = data;
  
@@ -867,7 +867,7 @@
  	}
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 43f9690..5a1cce1 100644
+index 43f96903..5a1cce13 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -22,6 +22,29 @@ csi_ctrl_policy[NUM_MTK_VENDOR_ATTRS_CSI_CTRL] = {
@@ -1079,7 +1079,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 976817f..1b08321 100644
+index 976817f3..1b08321c 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -6,6 +6,48 @@
@@ -1132,5 +1132,5 @@
  
  enum mtk_vendor_attr_csi_ctrl {
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1005-wifi-mt76-mt7915-add-support-for-runtime-set-in-band.patch b/recipes-wifi/linux-mt76/files/patches/1005-wifi-mt76-mt7915-add-support-for-runtime-set-in-band.patch
index 92ce23e..a8cae10 100644
--- a/recipes-wifi/linux-mt76/files/patches/1005-wifi-mt76-mt7915-add-support-for-runtime-set-in-band.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1005-wifi-mt76-mt7915-add-support-for-runtime-set-in-band.patch
@@ -1,7 +1,7 @@
-From e1fb54da7217b4c2c88666cf1b782669632a795c Mon Sep 17 00:00:00 2001
+From 7d26aa2de5124be98341720a87ffae9e5b4453d6 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Thu, 23 Mar 2023 09:55:50 +0800
-Subject: [PATCH 1005/1040] wifi: mt76: mt7915: add support for runtime set
+Subject: [PATCH 1005/1034] wifi: mt76: mt7915: add support for runtime set
  in-band discovery
 
 Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 2 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 92fa560..f2ab2e3 100644
+index 929f9bbe..d5420cb5 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -1940,8 +1940,7 @@ mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1937,8 +1937,7 @@ mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  	bcn = (struct bss_info_bcn *)tlv;
  	bcn->enable = true;
  
@@ -23,7 +23,7 @@
  		interval = vif->bss_conf.fils_discovery.max_interval;
  		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
  	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
-@@ -1978,7 +1977,7 @@ mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1972,7 +1971,7 @@ mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
  	discov->tx_interval = interval;
  	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
@@ -33,5 +33,5 @@
  	buf = (u8 *)sub_tlv + sizeof(*discov);
  
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1006-wifi-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch b/recipes-wifi/linux-mt76/files/patches/1006-wifi-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
index 5b0bacc..9c926db 100644
--- a/recipes-wifi/linux-mt76/files/patches/1006-wifi-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1006-wifi-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
@@ -1,7 +1,7 @@
-From 1a9f08c9d8dfb8c2f1c06f8bd52d6e08c0df7e8d Mon Sep 17 00:00:00 2001
+From f606394c86514dd140cb4ab0d7065c3c1ff584f5 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Tue, 4 Apr 2023 02:27:44 +0800
-Subject: [PATCH 1006/1040] wifi: mt76: mt7915: add mt76 vendor muru onoff
+Subject: [PATCH 1006/1034] wifi: mt76: mt7915: add mt76 vendor muru onoff
  command
 
 ---
@@ -12,10 +12,10 @@
  4 files changed, 63 insertions(+)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index f2ab2e3..7b3c70e 100644
+index d5420cb5..1f5f938e 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4158,6 +4158,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -4149,6 +4149,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  		if (val == 0)
  			phy->muru_onoff = MUMIMO_DL_CERT | MUMIMO_DL;
  		break;
@@ -30,7 +30,7 @@
  }
  
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 7b7c2d1..b6e2136 100644
+index 7b7c2d1d..b6e21369 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -478,6 +478,7 @@ enum {
@@ -42,7 +42,7 @@
  };
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 5a1cce1..df1cac3 100644
+index 5a1cce13..df1cac3f 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -34,6 +34,11 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -110,7 +110,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 1b08321..2be5fc8 100644
+index 1b08321c..2be5fc89 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -8,6 +8,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -140,5 +140,5 @@
  	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
  
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1007-wifi-mt76-mt7915-drop-undefined-action-frame.patch b/recipes-wifi/linux-mt76/files/patches/1007-wifi-mt76-mt7915-drop-undefined-action-frame.patch
index a08e7de..5c2ffb7 100644
--- a/recipes-wifi/linux-mt76/files/patches/1007-wifi-mt76-mt7915-drop-undefined-action-frame.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1007-wifi-mt76-mt7915-drop-undefined-action-frame.patch
@@ -1,14 +1,14 @@
-From 86b11ceef3db1601919f54f5cc73b3e301094223 Mon Sep 17 00:00:00 2001
+From 27cd55caaf8ce2e8bb5c9bd82160ee4d32e95a3d Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 14 Apr 2022 15:18:02 +0800
-Subject: [PATCH 1007/1040] wifi: mt76: mt7915: drop undefined action frame
+Subject: [PATCH 1007/1034] wifi: mt76: mt7915: drop undefined action frame
 
 ---
  mt7915/mac.c | 6 ++++++
  1 file changed, 6 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 8d1eeef..f1c78ec 100644
+index 20b9b99f..7ae34b77 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -737,6 +737,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
@@ -32,5 +32,5 @@
  	if (id < 0)
  		return id;
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1008-wifi-mt76-testmode-rework-testmode-init-registers.patch b/recipes-wifi/linux-mt76/files/patches/1008-wifi-mt76-testmode-rework-testmode-init-registers.patch
index 1ad2d4a..0f4ed45 100644
--- a/recipes-wifi/linux-mt76/files/patches/1008-wifi-mt76-testmode-rework-testmode-init-registers.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1008-wifi-mt76-testmode-rework-testmode-init-registers.patch
@@ -1,7 +1,7 @@
-From db7a7f8f00bf19913b153a377a7808900bafeb20 Mon Sep 17 00:00:00 2001
+From a7090a0aa6c95315fc9356708c2db0222b494a7d Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 6 Jun 2022 19:46:26 +0800
-Subject: [PATCH 1008/1040] wifi: mt76: testmode: rework testmode init
+Subject: [PATCH 1008/1034] wifi: mt76: testmode: rework testmode init
  registers
 
 ---
@@ -18,10 +18,10 @@
  10 files changed, 164 insertions(+), 35 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 647f74c..430ed1c 100644
+index 638405df..eac90b3e 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -793,7 +793,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
+@@ -787,7 +787,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
  	}
  
  #ifdef CONFIG_NL80211_TESTMODE
@@ -32,10 +32,10 @@
  		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
  			phy->test.rx_stats.fcs_error[q]++;
 diff --git a/mt76.h b/mt76.h
-index 97ced84..d66f4d0 100644
+index 35bf19fb..c2ad06a2 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -672,6 +672,8 @@ struct mt76_testmode_ops {
+@@ -659,6 +659,8 @@ struct mt76_testmode_ops {
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
  };
  
@@ -44,7 +44,7 @@
  struct mt76_testmode_data {
  	enum mt76_testmode_state state;
  
-@@ -703,6 +705,8 @@ struct mt76_testmode_data {
+@@ -690,6 +692,8 @@ struct mt76_testmode_data {
  
  	u8 addr[3][ETH_ALEN];
  
@@ -53,7 +53,7 @@
  	u32 tx_pending;
  	u32 tx_queued;
  	u16 tx_queued_limit;
-@@ -710,6 +714,7 @@ struct mt76_testmode_data {
+@@ -697,6 +701,7 @@ struct mt76_testmode_data {
  	struct {
  		u64 packets[__MT_RXQ_MAX];
  		u64 fcs_error[__MT_RXQ_MAX];
@@ -62,10 +62,10 @@
  };
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 9b065f3..cb68141 100644
+index 7b96feb2..92e0b912 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1204,6 +1204,7 @@ enum {
+@@ -1193,6 +1193,7 @@ enum {
  	MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
  	MCU_EXT_CMD_SET_RDD_TH = 0x9d,
  	MCU_EXT_CMD_MURU_CTRL = 0x9f,
@@ -74,7 +74,7 @@
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index b6e2136..c15b4b7 100644
+index b6e21369..c15b4b74 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -9,6 +9,7 @@
@@ -86,7 +86,7 @@
  	MCU_ATE_CLEAN_TXQUEUE = 0x1c,
  };
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 10f4e66..10c2c7d 100644
+index 8d92e76d..b23679ac 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -120,6 +120,7 @@ static const u32 mt7986_reg[] = {
@@ -106,7 +106,7 @@
  	[TMAC_ODTR]		= 0x0cc,
  	[TMAC_ATCR]		= 0x00c,
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 7515b23..2a9e50b 100644
+index d01b9ea9..038596c3 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -48,6 +48,7 @@ enum reg_rev {
@@ -117,7 +117,7 @@
  	TMAC_CDTR,
  	TMAC_ODTR,
  	TMAC_ATCR,
-@@ -202,6 +203,12 @@ enum offs_rev {
+@@ -201,6 +202,12 @@ enum offs_rev {
  #define MT_TRB_RXPSR0_RX_WTBL_PTR	GENMASK(25, 16)
  #define MT_TRB_RXPSR0_RX_RMAC_PTR	GENMASK(9, 0)
  
@@ -130,7 +130,7 @@
  /* TMAC: band 0(0x820e4000), band 1(0x820f4000) */
  #define MT_WF_TMAC_BASE(_band)		((_band) ? 0x820f4000 : 0x820e4000)
  #define MT_WF_TMAC(_band, ofs)		(MT_WF_TMAC_BASE(_band) + (ofs))
-@@ -210,6 +217,9 @@ enum offs_rev {
+@@ -209,6 +216,9 @@ enum offs_rev {
  #define MT_TMAC_TCR0_TX_BLINK		GENMASK(7, 6)
  #define MT_TMAC_TCR0_TBTT_STOP_CTRL	BIT(25)
  
@@ -140,7 +140,7 @@
  #define MT_TMAC_CDTR(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_CDTR))
   #define MT_TMAC_ODTR(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_ODTR))
  #define MT_TIMEOUT_VAL_PLCP		GENMASK(15, 0)
-@@ -489,8 +499,10 @@ enum offs_rev {
+@@ -488,8 +498,10 @@ enum offs_rev {
  #define MT_AGG_PCR0_VHT_PROT		BIT(13)
  #define MT_AGG_PCR0_PTA_WIN_DIS		BIT(15)
  
@@ -154,7 +154,7 @@
  #define MT_AGG_ACR0(_band)		MT_WF_AGG(_band, __OFFS(AGG_ACR0))
  #define MT_AGG_ACR_CFEND_RATE		GENMASK(13, 0)
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 0d76ae3..4693919 100644
+index 0d76ae31..46939191 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -30,7 +30,7 @@ struct reg_band {
@@ -379,7 +379,7 @@
  
  const struct mt76_testmode_ops mt7915_testmode_ops = {
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index 5573ac3..a1c54c8 100644
+index 5573ac30..a1c54c89 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -33,6 +33,12 @@ struct mt7915_tm_clean_txq {
@@ -430,7 +430,7 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index 4644dac..1b37392 100644
+index 4644dace..1b37392c 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -448,8 +448,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -454,7 +454,7 @@
  		return -EMSGSIZE;
  
 diff --git a/testmode.h b/testmode.h
-index 5e2792d..8961326 100644
+index 5e2792d8..89613266 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -101,6 +101,8 @@ enum mt76_testmode_attr {
@@ -475,5 +475,5 @@
  	/* keep last */
  	NUM_MT76_TM_STATS_ATTRS,
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1009-wifi-mt76-testmode-additional-supports.patch b/recipes-wifi/linux-mt76/files/patches/1009-wifi-mt76-testmode-additional-supports.patch
index ca61e6e..73fd048 100644
--- a/recipes-wifi/linux-mt76/files/patches/1009-wifi-mt76-testmode-additional-supports.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1009-wifi-mt76-testmode-additional-supports.patch
@@ -1,4 +1,4 @@
-From 555abaed13e0426eb3295c7f7b02de57320a63e6 Mon Sep 17 00:00:00 2001
+From 8f1bea09505a143e4922d4230bf7ad1181c53893 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Apr 2022 15:43:19 +0800
 Subject: [PATCH] wifi: mt76: testmode: additional supports
@@ -8,31 +8,31 @@
 ---
  dma.c             |    3 +-
  mac80211.c        |   12 +
- mt76.h            |  110 +++-
+ mt76.h            |  108 +++-
  mt76_connac_mcu.c |    4 +
  mt76_connac_mcu.h |    2 +
  mt7915/eeprom.c   |    2 +-
  mt7915/init.c     |    2 +-
- mt7915/mac.c      |   40 +-
+ mt7915/mac.c      |   39 +-
  mt7915/main.c     |    2 +-
  mt7915/mcu.c      |   22 +-
  mt7915/mcu.h      |   29 +-
  mt7915/mmio.c     |    2 +
- mt7915/mt7915.h   |   17 +-
+ mt7915/mt7915.h   |   16 +-
  mt7915/regs.h     |    3 +
- mt7915/testmode.c | 1238 ++++++++++++++++++++++++++++++++++++++++++---
- mt7915/testmode.h |  278 ++++++++++
- testmode.c        |  287 +++++++++--
- testmode.h        |   79 +++
- tools/fields.c    |   90 +++-
+ mt7915/testmode.c | 1222 ++++++++++++++++++++++++++++++++++++++++++---
+ mt7915/testmode.h |  278 +++++++++++
+ testmode.c        |  282 +++++++++--
+ testmode.h        |   75 +++
+ tools/fields.c    |   84 +++-
  tx.c              |    3 +-
- 20 files changed, 2058 insertions(+), 167 deletions(-)
+ 20 files changed, 2024 insertions(+), 166 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 24b44e7..8049830 100644
+index c9d2671d..fc92e391 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -576,8 +576,7 @@ free:
+@@ -574,8 +574,7 @@ free:
  	if (mt76_is_testmode_skb(dev, skb, &hw)) {
  		struct mt76_phy *phy = hw->priv;
  
@@ -43,7 +43,7 @@
  #endif
  
 diff --git a/mac80211.c b/mac80211.c
-index 430ed1c..fccf26d 100644
+index eac90b3e..ed1d659b 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -55,6 +55,13 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
@@ -73,10 +73,10 @@
  
  static const struct ieee80211_channel mt76_channels_6ghz[] = {
 diff --git a/mt76.h b/mt76.h
-index d66f4d0..597488d 100644
+index c2ad06a2..a5908de4 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -670,6 +670,21 @@ struct mt76_testmode_ops {
+@@ -657,6 +657,21 @@ struct mt76_testmode_ops {
  	int (*set_params)(struct mt76_phy *phy, struct nlattr **tb,
  			  enum mt76_testmode_state new_state);
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
@@ -98,13 +98,11 @@
  };
  
  #define MT_TM_FW_RX_COUNT	BIT(0)
-@@ -678,16 +693,13 @@ struct mt76_testmode_data {
+@@ -665,16 +680,11 @@ struct mt76_testmode_data {
  	enum mt76_testmode_state state;
  
  	u32 param_set[DIV_ROUND_UP(NUM_MT76_TM_ATTRS, 32)];
 -	struct sk_buff *tx_skb;
-+
-+	u8 sku_en;
  
  	u32 tx_count;
 -	u16 tx_mpdu_len;
@@ -117,7 +115,7 @@
  	u8 tx_rate_stbc;
  	u8 tx_ltf;
  
-@@ -703,10 +715,37 @@ struct mt76_testmode_data {
+@@ -690,10 +700,37 @@ struct mt76_testmode_data {
  	u8 tx_power[4];
  	u8 tx_power_control;
  
@@ -156,7 +154,7 @@
  	u32 tx_pending;
  	u32 tx_queued;
  	u16 tx_queued_limit;
-@@ -1276,6 +1315,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
+@@ -1258,6 +1295,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
  #endif
  }
  
@@ -216,7 +214,7 @@
  static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
  					struct sk_buff *skb,
  					struct ieee80211_hw **hw)
-@@ -1286,7 +1378,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
+@@ -1268,7 +1358,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
  	for (i = 0; i < ARRAY_SIZE(dev->phys); i++) {
  		struct mt76_phy *phy = dev->phys[i];
  
@@ -226,7 +224,7 @@
  			*hw = dev->phys[i]->hw;
  			return true;
  		}
-@@ -1388,7 +1481,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1370,7 +1461,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
  		       struct netlink_callback *cb, void *data, int len);
  int mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state);
@@ -237,10 +235,10 @@
  static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
  {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index f06a81d..60e159c 100644
+index 80a5cbc0..18812aff 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -396,6 +396,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -402,6 +402,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  	switch (vif->type) {
  	case NL80211_IFTYPE_MESH_POINT:
  	case NL80211_IFTYPE_AP:
@@ -248,7 +246,7 @@
  		if (vif->p2p && !is_mt7921(dev))
  			conn_type = CONNECTION_P2P_GC;
  		else
-@@ -577,6 +578,9 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
+@@ -583,6 +584,9 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
  	rx->rca2 = 1;
  	rx->rv = 1;
  
@@ -259,10 +257,10 @@
  		return;
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index cb68141..7a7dbf4 100644
+index 92e0b912..e3980c37 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1002,6 +1002,7 @@ enum {
+@@ -998,6 +998,7 @@ enum {
  	MCU_EXT_EVENT_FW_LOG_2_HOST = 0x13,
  	MCU_EXT_EVENT_THERMAL_PROTECT = 0x22,
  	MCU_EXT_EVENT_ASSERT_DUMP = 0x23,
@@ -270,7 +268,7 @@
  	MCU_EXT_EVENT_RDD_REPORT = 0x3a,
  	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
  	MCU_EXT_EVENT_WA_TX_STAT = 0x74,
-@@ -1211,6 +1212,7 @@ enum {
+@@ -1200,6 +1201,7 @@ enum {
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
@@ -279,7 +277,7 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  };
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 76be730..f5ab331 100644
+index 76be7308..f5ab3319 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -131,7 +131,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
@@ -292,10 +290,10 @@
  				return ret;
  		}
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 607d881..d908a58 100644
+index 0ea2af17..c54c1f33 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -725,7 +725,7 @@ static void mt7915_init_work(struct work_struct *work)
+@@ -728,7 +728,7 @@ static void mt7915_init_work(struct work_struct *work)
  	struct mt7915_dev *dev = container_of(work, struct mt7915_dev,
  				 init_work);
  
@@ -305,18 +303,10 @@
  	mt7915_txbf_init(dev);
  }
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index f1c78ec..06a5fb1 100644
+index 7ae34b77..6c9401dd 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -579,6 +579,7 @@ mt7915_mac_fill_rx_vector(struct mt7915_dev *dev, struct sk_buff *skb)
- 			wb_rssi = le32_to_cpu(rxv[9]);
- 
- 		phy->test.last_rcpi[i] = rcpi & 0xff;
-+		phy->test.last_rssi[i] = to_rssi(GENMASK(7, 0), rcpi);
- 		phy->test.last_ib_rssi[i] = ib_rssi & 0xff;
- 		phy->test.last_wb_rssi[i] = wb_rssi & 0xff;
- 	}
-@@ -604,16 +605,38 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+@@ -604,16 +604,38 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
  {
  #ifdef CONFIG_NL80211_TESTMODE
  	struct mt76_testmode_data *td = &phy->mt76->test;
@@ -358,7 +348,7 @@
  
  	switch (td->tx_rate_mode) {
  	case MT76_TM_TX_MODE_HT:
-@@ -644,7 +667,7 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+@@ -644,7 +666,7 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
  			rate_idx += 4;
  
  		r = &phy->mt76->hw->wiphy->bands[band]->bitrates[rate_idx];
@@ -367,7 +357,7 @@
  
  		mode = val >> 8;
  		rate_idx = val & 0xff;
-@@ -703,13 +726,14 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+@@ -703,13 +725,14 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
  	if (mode >= MT_PHY_TYPE_HE_SU)
  		val |= FIELD_PREP(MT_TXD6_HELTF, td->tx_ltf);
  
@@ -385,7 +375,7 @@
  #endif
  }
  
-@@ -1415,7 +1439,7 @@ mt7915_mac_restart(struct mt7915_dev *dev)
+@@ -1415,7 +1438,7 @@ mt7915_mac_restart(struct mt7915_dev *dev)
  		goto out;
  
  	/* set the necessary init items */
@@ -395,7 +385,7 @@
  		goto out;
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index ce5dcb3..3b18c95 100644
+index bb7075ed..60639fe0 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -238,7 +238,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
@@ -408,10 +398,10 @@
  		mvif->mt76.wmm_idx += 2;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 7b3c70e..0d1e09c 100644
+index 8a77d7ff..18eaf687 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -391,6 +391,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -389,6 +389,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	case MCU_EXT_EVENT_BCC_NOTIFY:
  		mt7915_mcu_rx_bcc_notify(dev, skb);
  		break;
@@ -423,7 +413,7 @@
  	default:
  		break;
  	}
-@@ -422,6 +427,7 @@ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -420,6 +425,7 @@ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	     rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
  	     rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
  	     rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
@@ -431,7 +421,7 @@
  	     !rxd->seq) &&
  	     !(rxd->eid == MCU_CMD_EXT_CID &&
  	       rxd->ext_eid == MCU_EXT_EVENT_WA_TX_STAT))
-@@ -2764,7 +2770,8 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
+@@ -2763,7 +2769,8 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
  	}
  #endif
  
@@ -489,7 +479,7 @@
  
  	return 0;
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index c15b4b7..9982735 100644
+index c15b4b74..99827354 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -8,10 +8,15 @@
@@ -547,7 +537,7 @@
  
  enum {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 10c2c7d..87a5c5c 100644
+index 10c2c7d8..87a5c5c4 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -134,6 +134,7 @@ static const u32 mt7915_offs[] = {
@@ -567,16 +557,10 @@
  	[AGG_PCR0]		= 0x040,
  	[AGG_ACR0]		= 0x054,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index ab3c8f7..b91af94 100644
+index f1c9a9bc..d0a8a99e 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -267,11 +267,15 @@ struct mt7915_phy {
- 
- 		s32 last_freq_offset;
- 		u8 last_rcpi[4];
-+		s8 last_rssi[4];
- 		s8 last_ib_rssi[4];
- 		s8 last_wb_rssi[4];
+@@ -272,6 +272,9 @@ struct mt7915_phy {
  		u8 last_snr;
  
  		u8 spe_idx;
@@ -586,7 +570,7 @@
  	} test;
  #endif
  
-@@ -371,6 +375,14 @@ struct mt7915_dev {
+@@ -369,6 +372,14 @@ struct mt7915_dev {
  	void __iomem *dcm;
  	void __iomem *sku;
  
@@ -601,7 +585,7 @@
  #ifdef MTK_DEBUG
  	u16 wlan_idx;
  	struct {
-@@ -542,8 +554,8 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -540,8 +551,8 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  				   struct ieee80211_vif *vif,
  				   struct ieee80211_sta *sta,
  				   void *data, u32 field);
@@ -612,7 +596,7 @@
  int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num);
  int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
  		       bool hdr_trans);
-@@ -582,6 +594,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+@@ -580,6 +591,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
@@ -621,7 +605,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 2a9e50b..6783797 100644
+index 038596c3..428f4820 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -62,6 +62,7 @@ enum offs_rev {
@@ -632,7 +616,7 @@
  	AGG_AWSCR0,
  	AGG_PCR0,
  	AGG_ACR0,
-@@ -486,6 +487,8 @@ enum offs_rev {
+@@ -485,6 +486,8 @@ enum offs_rev {
  #define MT_WF_AGG_BASE(_band)		((_band) ? 0x820f2000 : 0x820e2000)
  #define MT_WF_AGG(_band, ofs)		(MT_WF_AGG_BASE(_band) + (ofs))
  
@@ -642,32 +626,30 @@
  							  (_n) * 4))
  #define MT_AGG_PCR0(_band, _n)		MT_WF_AGG(_band, (__OFFS(AGG_PCR0) +	\
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 4693919..8367204 100644
+index 46939191..e5d0ef9b 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
-@@ -9,6 +9,10 @@
+@@ -9,6 +9,9 @@
  enum {
  	TM_CHANGED_TXPOWER,
  	TM_CHANGED_FREQ_OFFSET,
-+	TM_CHANGED_SKU_EN,
 +	TM_CHANGED_AID,
 +	TM_CHANGED_CFG,
 +	TM_CHANGED_TXBF_ACT,
  
  	/* must be last */
  	NUM_TM_CHANGED
-@@ -17,6 +21,10 @@ enum {
+@@ -17,6 +20,9 @@ enum {
  static const u8 tm_change_map[] = {
  	[TM_CHANGED_TXPOWER] = MT76_TM_ATTR_TX_POWER,
  	[TM_CHANGED_FREQ_OFFSET] = MT76_TM_ATTR_FREQ_OFFSET,
-+	[TM_CHANGED_SKU_EN] = MT76_TM_ATTR_SKU_EN,
 +	[TM_CHANGED_AID] = MT76_TM_ATTR_AID,
 +	[TM_CHANGED_CFG] = MT76_TM_ATTR_CFG,
 +	[TM_CHANGED_TXBF_ACT] = MT76_TM_ATTR_TXBF_ACT,
  };
  
  struct reg_band {
-@@ -33,6 +41,57 @@ struct reg_band {
+@@ -33,6 +39,57 @@ struct reg_band {
  #define TM_REG_MAX_ID	20
  static struct reg_band reg_backup_list[TM_REG_MAX_ID];
  
@@ -725,7 +707,7 @@
  
  static int
  mt7915_tm_set_tx_power(struct mt7915_phy *phy)
-@@ -119,18 +178,28 @@ mt7915_tm_set_trx(struct mt7915_phy *phy, int type, bool en)
+@@ -119,18 +176,28 @@ mt7915_tm_set_trx(struct mt7915_phy *phy, int type, bool en)
  }
  
  static int
@@ -758,7 +740,7 @@
  }
  
  static int
-@@ -141,7 +210,7 @@ mt7915_tm_set_phy_count(struct mt7915_phy *phy, u8 control)
+@@ -141,7 +208,7 @@ mt7915_tm_set_phy_count(struct mt7915_phy *phy, u8 control)
  		.testmode_en = 1,
  		.param_idx = MCU_ATE_SET_PHY_COUNT,
  		.param.cfg.enable = control,
@@ -767,7 +749,7 @@
  	};
  
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
-@@ -182,12 +251,739 @@ mt7915_tm_set_tam_arb(struct mt7915_phy *phy, bool enable, bool mu)
+@@ -182,12 +249,739 @@ mt7915_tm_set_tam_arb(struct mt7915_phy *phy, bool enable, bool mu)
  	return mt7915_mcu_set_muru_ctrl(dev, MURU_SET_ARB_OP_MODE, op_mode);
  }
  
@@ -1509,7 +1491,7 @@
  	struct edca *e = &req.edca[0];
  
  	e->queue = qid + mvif->mt76.wmm_idx * MT76_CONNAC_MAX_WMM_SETS;
-@@ -263,7 +1059,8 @@ done:
+@@ -263,7 +1057,8 @@ done:
  
  	return mt7915_tm_set_wmm_qid(phy,
  				     mt76_connac_lmac_mapping(IEEE80211_AC_BE),
@@ -1519,7 +1501,7 @@
  }
  
  static int
-@@ -339,7 +1136,7 @@ mt7915_tm_set_tx_len(struct mt7915_phy *phy, u32 tx_time)
+@@ -339,7 +1134,7 @@ mt7915_tm_set_tx_len(struct mt7915_phy *phy, u32 tx_time)
  	bitrate = cfg80211_calculate_bitrate(&rate);
  	tx_len = bitrate * tx_time / 10 / 8;
  
@@ -1528,7 +1510,7 @@
  	if (ret)
  		return ret;
  
-@@ -458,64 +1255,227 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
+@@ -458,64 +1253,227 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
  
  	phy->mt76->test.flag |= MT_TM_FW_RX_COUNT;
  
@@ -1787,7 +1769,7 @@
  
  	mt7915_tm_set_trx(phy, TM_MAC_TX, en);
  }
-@@ -544,10 +1504,6 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
+@@ -544,10 +1502,6 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
  		return ret;
  
  	rs_band = (struct mt7915_tm_rx_stat_band *)skb->data;
@@ -1798,7 +1780,7 @@
  
  	if (!clear) {
  		enum mt76_rxq_id q = req.band ? MT_RXQ_BAND1 : MT_RXQ_MAIN;
-@@ -562,13 +1518,61 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
+@@ -562,13 +1516,61 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
  	return 0;
  }
  
@@ -1861,7 +1843,7 @@
  
  		/* read-clear */
  		mt7915_tm_get_rx_stats(phy, true);
-@@ -576,9 +1580,12 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
+@@ -576,9 +1578,12 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
  		/* clear fw count */
  		mt7915_tm_set_phy_count(phy, 0);
  		mt7915_tm_set_phy_count(phy, 1);
@@ -1876,7 +1858,7 @@
  }
  
  static int
-@@ -617,34 +1624,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
+@@ -617,34 +1622,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
  	tx_cont->tx_ant = td->tx_antenna_mask;
  	tx_cont->band = band;
  
@@ -1912,14 +1894,10 @@
  
  	if (!en) {
  		req.op.rf.param.func_data = cpu_to_le32(band);
-@@ -728,6 +1708,16 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
+@@ -728,6 +1706,12 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
  		mt7915_tm_set_freq_offset(phy, en, en ? td->freq_offset : 0);
  	if (changed & BIT(TM_CHANGED_TXPOWER))
  		mt7915_tm_set_tx_power(phy);
-+	if (changed & BIT(TM_CHANGED_SKU_EN)) {
-+		mt7915_mcu_set_sku_en(phy, td->sku_en);
-+		mt7915_mcu_set_txpower_sku(phy);
-+	}
 +	if (changed & BIT(TM_CHANGED_AID))
 +		mt7915_tm_set_entry(phy);
 +	if (changed & BIT(TM_CHANGED_CFG))
@@ -1929,7 +1907,7 @@
  }
  
  static int
-@@ -737,6 +1727,11 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
+@@ -737,6 +1721,11 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
  	struct mt7915_phy *phy = mphy->priv;
  	enum mt76_testmode_state prev_state = td->state;
  
@@ -1941,7 +1919,7 @@
  	mphy->test.state = state;
  
  	if (prev_state == MT76_TM_STATE_TX_FRAMES ||
-@@ -757,7 +1752,7 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
+@@ -757,7 +1746,7 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
  	    (state == MT76_TM_STATE_OFF &&
  	     prev_state == MT76_TM_STATE_IDLE)) {
  		u32 changed = 0;
@@ -1950,7 +1928,7 @@
  
  		for (i = 0; i < ARRAY_SIZE(tm_change_map); i++) {
  			u16 cur = tm_change_map[i];
-@@ -766,6 +1761,10 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
+@@ -766,6 +1755,10 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
  				changed |= BIT(i);
  		}
  
@@ -1961,7 +1939,7 @@
  		mt7915_tm_update_params(phy, changed);
  	}
  
-@@ -778,10 +1777,8 @@ mt7915_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
+@@ -778,10 +1771,8 @@ mt7915_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
  {
  	struct mt76_testmode_data *td = &mphy->test;
  	struct mt7915_phy *phy = mphy->priv;
@@ -1974,7 +1952,7 @@
  
  	BUILD_BUG_ON(NUM_TM_CHANGED >= 32);
  
-@@ -789,9 +1786,9 @@ mt7915_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
+@@ -789,9 +1780,9 @@ mt7915_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
  	    td->state == MT76_TM_STATE_OFF)
  		return 0;
  
@@ -1987,7 +1965,7 @@
  
  	for (i = 0; i < ARRAY_SIZE(tm_change_map); i++) {
  		if (tb[tm_change_map[i]])
-@@ -807,6 +1804,7 @@ static int
+@@ -807,6 +1798,7 @@ static int
  mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  {
  	struct mt7915_phy *phy = mphy->priv;
@@ -1995,24 +1973,7 @@
  	void *rx, *rssi;
  	int i;
  
-@@ -827,6 +1825,16 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
- 
- 	nla_nest_end(msg, rssi);
- 
-+	rssi = nla_nest_start(msg, MT76_TM_RX_ATTR_RSSI);
-+	if (!rssi)
-+		return -ENOMEM;
-+
-+	for (i = 0; i < ARRAY_SIZE(phy->test.last_rssi); i++)
-+		if (nla_put_s8(msg, i, phy->test.last_rssi[i]))
-+			return -ENOMEM;
-+
-+	nla_nest_end(msg, rssi);
-+
- 	rssi = nla_nest_start(msg, MT76_TM_RX_ATTR_IB_RSSI);
- 	if (!rssi)
- 		return -ENOMEM;
-@@ -852,11 +1860,75 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+@@ -852,11 +1844,75 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  
  	nla_nest_end(msg, rx);
  
@@ -2089,7 +2050,7 @@
 +	.set_eeprom = mt7915_tm_set_eeprom,
  };
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index a1c54c8..eb0e043 100644
+index a1c54c89..eb0e0432 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -4,6 +4,8 @@
@@ -2404,18 +2365,10 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index 1b37392..b39fef4 100644
+index 1b37392c..d2cef5b9 100644
 --- a/testmode.c
 +++ b/testmode.c
-@@ -8,6 +8,7 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
- 	[MT76_TM_ATTR_RESET] = { .type = NLA_FLAG },
- 	[MT76_TM_ATTR_STATE] = { .type = NLA_U8 },
- 	[MT76_TM_ATTR_TX_COUNT] = { .type = NLA_U32 },
-+	[MT76_TM_ATTR_SKU_EN] = { .type = NLA_U8 },
- 	[MT76_TM_ATTR_TX_LENGTH] = { .type = NLA_U32 },
- 	[MT76_TM_ATTR_TX_RATE_MODE] = { .type = NLA_U8 },
- 	[MT76_TM_ATTR_TX_RATE_NSS] = { .type = NLA_U8 },
-@@ -28,28 +29,16 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
+@@ -28,28 +28,16 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
  };
  EXPORT_SYMBOL_GPL(mt76_tm_policy);
  
@@ -2450,7 +2403,7 @@
  	       q->queued < q->ndesc / 2) {
  		int ret;
  
-@@ -58,13 +47,68 @@ void mt76_testmode_tx_pending(struct mt76_phy *phy)
+@@ -58,13 +46,68 @@ void mt76_testmode_tx_pending(struct mt76_phy *phy)
  		if (ret < 0)
  			break;
  
@@ -2520,7 +2473,7 @@
  }
  
  static u32
-@@ -90,15 +134,31 @@ mt76_testmode_max_mpdu_len(struct mt76_phy *phy, u8 tx_rate_mode)
+@@ -90,15 +133,31 @@ mt76_testmode_max_mpdu_len(struct mt76_phy *phy, u8 tx_rate_mode)
  }
  
  static void
@@ -2556,7 +2509,7 @@
  {
  #define MT_TXP_MAX_LEN	4095
  	u16 fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA |
-@@ -119,7 +179,8 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
+@@ -119,7 +178,8 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
  	nfrags = len / MT_TXP_MAX_LEN;
  	head_len = nfrags ? MT_TXP_MAX_LEN : len;
  
@@ -2566,7 +2519,7 @@
  		fc |= IEEE80211_STYPE_QOS_DATA;
  
  	head = alloc_skb(head_len, GFP_KERNEL);
-@@ -128,9 +189,9 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
+@@ -128,9 +188,9 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
  
  	hdr = __skb_put_zero(head, sizeof(*hdr));
  	hdr->frame_control = cpu_to_le16(fc);
@@ -2579,7 +2532,7 @@
  	skb_set_queue_mapping(head, IEEE80211_AC_BE);
  	get_random_bytes(__skb_put(head, head_len - sizeof(*hdr)),
  			 head_len - sizeof(*hdr));
-@@ -154,7 +215,7 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
+@@ -154,7 +214,7 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
  
  		frag = alloc_skb(frag_len, GFP_KERNEL);
  		if (!frag) {
@@ -2588,7 +2541,7 @@
  			dev_kfree_skb(head);
  			return -ENOMEM;
  		}
-@@ -167,15 +228,14 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
+@@ -167,15 +227,14 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
  		frag_tail = &(*frag_tail)->next;
  	}
  
@@ -2608,7 +2561,7 @@
  {
  	struct mt76_testmode_data *td = &phy->test;
  	struct ieee80211_tx_info *info;
-@@ -183,7 +243,7 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
+@@ -183,7 +242,7 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
  	u8 max_nss = hweight8(phy->antenna_mask);
  	int ret;
  
@@ -2617,7 +2570,7 @@
  	if (ret)
  		return ret;
  
-@@ -193,7 +253,7 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
+@@ -193,7 +252,7 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
  	if (td->tx_antenna_mask)
  		max_nss = min_t(u8, max_nss, hweight8(td->tx_antenna_mask));
  
@@ -2626,7 +2579,7 @@
  	rate = &info->control.rates[0];
  	rate->count = 1;
  	rate->idx = td->tx_rate_idx;
-@@ -265,6 +325,25 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
+@@ -265,6 +324,25 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
  out:
  	return 0;
  }
@@ -2652,7 +2605,7 @@
  
  static void
  mt76_testmode_tx_start(struct mt76_phy *phy)
-@@ -275,6 +354,14 @@ mt76_testmode_tx_start(struct mt76_phy *phy)
+@@ -275,6 +353,14 @@ mt76_testmode_tx_start(struct mt76_phy *phy)
  	td->tx_queued = 0;
  	td->tx_done = 0;
  	td->tx_pending = td->tx_count;
@@ -2667,7 +2620,7 @@
  	mt76_worker_schedule(&dev->tx_worker);
  }
  
-@@ -293,7 +380,7 @@ mt76_testmode_tx_stop(struct mt76_phy *phy)
+@@ -293,7 +379,7 @@ mt76_testmode_tx_stop(struct mt76_phy *phy)
  	wait_event_timeout(dev->tx_wait, td->tx_done == td->tx_queued,
  			   MT76_TM_TIMEOUT * HZ);
  
@@ -2676,7 +2629,7 @@
  }
  
  static inline void
-@@ -324,6 +411,8 @@ mt76_testmode_init_defaults(struct mt76_phy *phy)
+@@ -324,6 +410,8 @@ mt76_testmode_init_defaults(struct mt76_phy *phy)
  	memcpy(td->addr[0], phy->macaddr, ETH_ALEN);
  	memcpy(td->addr[1], phy->macaddr, ETH_ALEN);
  	memcpy(td->addr[2], phy->macaddr, ETH_ALEN);
@@ -2685,7 +2638,7 @@
  }
  
  static int
-@@ -333,8 +422,12 @@ __mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state)
+@@ -333,8 +421,12 @@ __mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state)
  	struct mt76_dev *dev = phy->dev;
  	int err;
  
@@ -2699,7 +2652,7 @@
  
  	if (state == MT76_TM_STATE_TX_FRAMES) {
  		err = mt76_testmode_tx_init(phy);
-@@ -404,6 +497,44 @@ mt76_tm_get_u8(struct nlattr *attr, u8 *dest, u8 min, u8 max)
+@@ -404,6 +496,44 @@ mt76_tm_get_u8(struct nlattr *attr, u8 *dest, u8 min, u8 max)
  	return 0;
  }
  
@@ -2744,7 +2697,7 @@
  int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  		      void *data, int len)
  {
-@@ -427,6 +558,11 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -427,6 +557,11 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  
  	mutex_lock(&dev->mutex);
  
@@ -2756,17 +2709,7 @@
  	if (tb[MT76_TM_ATTR_RESET]) {
  		mt76_testmode_set_state(phy, MT76_TM_STATE_OFF);
  		memset(td, 0, sizeof(*td));
-@@ -434,6 +570,9 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 
- 	mt76_testmode_init_defaults(phy);
- 
-+	if (tb[MT76_TM_ATTR_SKU_EN])
-+		td->sku_en = nla_get_u8(tb[MT76_TM_ATTR_SKU_EN]);
-+
- 	if (tb[MT76_TM_ATTR_TX_COUNT])
- 		td->tx_count = nla_get_u32(tb[MT76_TM_ATTR_TX_COUNT]);
- 
-@@ -453,7 +592,10 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -453,7 +588,10 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_DUTY_CYCLE],
  			   &td->tx_duty_cycle, 0, 99) ||
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_POWER_CONTROL],
@@ -2778,7 +2721,7 @@
  		goto out;
  
  	if (tb[MT76_TM_ATTR_TX_LENGTH]) {
-@@ -485,8 +627,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -485,8 +623,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  
  	if (tb[MT76_TM_ATTR_TX_POWER]) {
  		struct nlattr *cur;
@@ -2788,7 +2731,7 @@
  
  		nla_for_each_nested(cur, tb[MT76_TM_ATTR_TX_POWER], rem) {
  			if (nla_len(cur) != 1 ||
-@@ -506,11 +647,45 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -506,11 +643,45 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			if (nla_len(cur) != ETH_ALEN || idx >= 3)
  				goto out;
  
@@ -2835,7 +2778,7 @@
  	if (dev->test_ops->set_params) {
  		err = dev->test_ops->set_params(phy, tb, state);
  		if (err)
-@@ -575,6 +750,7 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+@@ -575,6 +746,7 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
  	struct mt76_phy *phy = hw->priv;
  	struct mt76_dev *dev = phy->dev;
  	struct mt76_testmode_data *td = &phy->test;
@@ -2843,7 +2786,7 @@
  	struct nlattr *tb[NUM_MT76_TM_ATTRS] = {};
  	int err = 0;
  	void *a;
-@@ -607,6 +783,19 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+@@ -607,6 +779,19 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
  		goto out;
  	}
  
@@ -2863,12 +2806,11 @@
  	mt76_testmode_init_defaults(phy);
  
  	err = -EMSGSIZE;
-@@ -619,12 +808,9 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+@@ -619,12 +804,8 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
  		goto out;
  
  	if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
 -	    nla_put_u32(msg, MT76_TM_ATTR_TX_LENGTH, td->tx_mpdu_len) ||
-+	    nla_put_u8(msg, MT76_TM_ATTR_SKU_EN, td->sku_en) ||
  	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_MODE, td->tx_rate_mode) ||
 -	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_NSS, td->tx_rate_nss) ||
 -	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_IDX, td->tx_rate_idx) ||
@@ -2877,7 +2819,7 @@
  	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_STBC, td->tx_rate_stbc) ||
  	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_LTF) &&
  	     nla_put_u8(msg, MT76_TM_ATTR_TX_LTF, td->tx_ltf)) ||
-@@ -641,7 +827,16 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+@@ -641,7 +822,16 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
  	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_POWER_CONTROL) &&
  	     nla_put_u8(msg, MT76_TM_ATTR_TX_POWER_CONTROL, td->tx_power_control)) ||
  	    (mt76_testmode_param_present(td, MT76_TM_ATTR_FREQ_OFFSET) &&
@@ -2896,7 +2838,7 @@
  
  	if (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_POWER)) {
 diff --git a/testmode.h b/testmode.h
-index 8961326..7a68625 100644
+index 89613266..8c55fa0f 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -6,6 +6,8 @@
@@ -2908,15 +2850,7 @@
  
  /**
   * enum mt76_testmode_attr - testmode attributes inside NL80211_ATTR_TESTDATA
-@@ -18,6 +20,7 @@
-  * @MT76_TM_ATTR_MTD_PART: mtd partition used for eeprom data (string)
-  * @MT76_TM_ATTR_MTD_OFFSET: offset of eeprom data within the partition (u32)
-  *
-+ * @MT76_TM_ATTR_SKU_EN: config txpower sku is enabled or disabled in testmode (u8)
-  * @MT76_TM_ATTR_TX_COUNT: configured number of frames to send when setting
-  *	state to MT76_TM_STATE_TX_FRAMES (u32)
-  * @MT76_TM_ATTR_TX_PENDING: pending frames during MT76_TM_STATE_TX_FRAMES (u32)
-@@ -47,6 +50,15 @@
+@@ -47,6 +49,15 @@
   * @MT76_TM_ATTR_DRV_DATA: driver specific netlink attrs (nested)
   *
   * @MT76_TM_ATTR_MAC_ADDRS: array of nested MAC addresses (nested)
@@ -2932,15 +2866,7 @@
   */
  enum mt76_testmode_attr {
  	MT76_TM_ATTR_UNSPEC,
-@@ -57,6 +69,7 @@ enum mt76_testmode_attr {
- 	MT76_TM_ATTR_MTD_PART,
- 	MT76_TM_ATTR_MTD_OFFSET,
- 
-+	MT76_TM_ATTR_SKU_EN,
- 	MT76_TM_ATTR_TX_COUNT,
- 	MT76_TM_ATTR_TX_LENGTH,
- 	MT76_TM_ATTR_TX_RATE_MODE,
-@@ -84,6 +97,17 @@ enum mt76_testmode_attr {
+@@ -84,6 +95,17 @@ enum mt76_testmode_attr {
  	MT76_TM_ATTR_DRV_DATA,
  
  	MT76_TM_ATTR_MAC_ADDRS,
@@ -2958,23 +2884,7 @@
  
  	/* keep last */
  	NUM_MT76_TM_ATTRS,
-@@ -128,6 +152,7 @@ enum mt76_testmode_stats_attr {
-  *
-  * @MT76_TM_RX_ATTR_FREQ_OFFSET: frequency offset (s32)
-  * @MT76_TM_RX_ATTR_RCPI: received channel power indicator (array, u8)
-+ * @MT76_TM_RX_ATTR_RSSI: received signal strength indicator (array, s8)
-  * @MT76_TM_RX_ATTR_IB_RSSI: internal inband RSSI (array, s8)
-  * @MT76_TM_RX_ATTR_WB_RSSI: internal wideband RSSI (array, s8)
-  * @MT76_TM_RX_ATTR_SNR: signal-to-noise ratio (u8)
-@@ -137,6 +162,7 @@ enum mt76_testmode_rx_attr {
- 
- 	MT76_TM_RX_ATTR_FREQ_OFFSET,
- 	MT76_TM_RX_ATTR_RCPI,
-+	MT76_TM_RX_ATTR_RSSI,
- 	MT76_TM_RX_ATTR_IB_RSSI,
- 	MT76_TM_RX_ATTR_WB_RSSI,
- 	MT76_TM_RX_ATTR_SNR,
-@@ -198,4 +224,57 @@ enum mt76_testmode_tx_mode {
+@@ -198,4 +220,57 @@ enum mt76_testmode_tx_mode {
  
  extern const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS];
  
@@ -3033,7 +2943,7 @@
 +
  #endif
 diff --git a/tools/fields.c b/tools/fields.c
-index e3f6908..406ba77 100644
+index e3f69089..7e564a3b 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -10,6 +10,7 @@ static const char * const testmode_state[] = {
@@ -3044,15 +2954,6 @@
  };
  
  static const char * const testmode_tx_mode[] = {
-@@ -65,7 +66,7 @@ static bool parse_u8(const struct tm_field *field, int idx,
- 
- static void print_u8(const struct tm_field *field, struct nlattr *attr)
- {
--	printf("%d", nla_get_u8(attr));
-+	printf("%u", nla_get_u8(attr));
- }
- 
- static void print_s8(const struct tm_field *field, struct nlattr *attr)
 @@ -86,12 +87,12 @@ static void print_s32(const struct tm_field *field, struct nlattr *attr)
  
  static void print_u32(const struct tm_field *field, struct nlattr *attr)
@@ -3132,7 +3033,7 @@
  
  #define FIELD_GENERIC(_field, _name, ...)	\
  	[FIELD_NAME(_field)] = {			\
-@@ -250,10 +308,18 @@ static void print_extra_stats(const struct tm_field *field, struct nlattr **tb)
+@@ -250,6 +308,13 @@ static void print_extra_stats(const struct tm_field *field, struct nlattr **tb)
  		 ##__VA_ARGS__				\
  	)
  
@@ -3146,28 +3047,7 @@
  #define FIELD_NAME(_field) MT76_TM_RX_ATTR_##_field
  static const struct tm_field rx_fields[NUM_MT76_TM_RX_ATTRS] = {
  	FIELD_RO(s32, FREQ_OFFSET, "freq_offset"),
- 	FIELD_ARRAY_RO(u8, RCPI, "rcpi"),
-+	FIELD_ARRAY_RO(s8, RSSI, "rssi"),
- 	FIELD_ARRAY_RO(s8, IB_RSSI, "ib_rssi"),
- 	FIELD_ARRAY_RO(s8, WB_RSSI, "wb_rssi"),
- 	FIELD_RO(s8, SNR, "snr"),
-@@ -261,6 +327,7 @@ static const struct tm_field rx_fields[NUM_MT76_TM_RX_ATTRS] = {
- static struct nla_policy rx_policy[NUM_MT76_TM_RX_ATTRS] = {
- 	[MT76_TM_RX_ATTR_FREQ_OFFSET] = { .type = NLA_U32 },
- 	[MT76_TM_RX_ATTR_RCPI] = { .type = NLA_NESTED },
-+	[MT76_TM_RX_ATTR_RSSI] = { .type = NLA_NESTED },
- 	[MT76_TM_RX_ATTR_IB_RSSI] = { .type = NLA_NESTED },
- 	[MT76_TM_RX_ATTR_WB_RSSI] = { .type = NLA_NESTED },
- 	[MT76_TM_RX_ATTR_SNR] = { .type = NLA_U8 },
-@@ -291,6 +358,7 @@ static const struct tm_field testdata_fields[NUM_MT76_TM_ATTRS] = {
- 	FIELD_ENUM(STATE, "state", testmode_state),
- 	FIELD_RO(string, MTD_PART, "mtd_part"),
- 	FIELD_RO(u32, MTD_OFFSET, "mtd_offset"),
-+	FIELD(u8, SKU_EN, "sku_en"),
- 	FIELD(u32, TX_COUNT, "tx_count"),
- 	FIELD(u32, TX_LENGTH, "tx_length"),
- 	FIELD_ENUM(TX_RATE_MODE, "tx_rate_mode", testmode_tx_mode),
-@@ -300,10 +368,18 @@ static const struct tm_field testdata_fields[NUM_MT76_TM_ATTRS] = {
+@@ -300,10 +365,18 @@ static const struct tm_field testdata_fields[NUM_MT76_TM_ATTRS] = {
  	FIELD(u8, TX_RATE_LDPC, "tx_rate_ldpc"),
  	FIELD(u8, TX_RATE_STBC, "tx_rate_stbc"),
  	FIELD(u8, TX_LTF, "tx_ltf"),
@@ -3186,15 +3066,7 @@
  	FIELD_NESTED_RO(STATS, stats, "",
  			.print_extra = print_extra_stats),
  };
-@@ -313,6 +389,7 @@ static struct nla_policy testdata_policy[NUM_MT76_TM_ATTRS] = {
- 	[MT76_TM_ATTR_STATE] = { .type = NLA_U8 },
- 	[MT76_TM_ATTR_MTD_PART] = { .type = NLA_STRING },
- 	[MT76_TM_ATTR_MTD_OFFSET] = { .type = NLA_U32 },
-+	[MT76_TM_ATTR_SKU_EN] = { .type = NLA_U8 },
- 	[MT76_TM_ATTR_TX_COUNT] = { .type = NLA_U32 },
- 	[MT76_TM_ATTR_TX_LENGTH] = { .type = NLA_U32 },
- 	[MT76_TM_ATTR_TX_RATE_MODE] = { .type = NLA_U8 },
-@@ -322,9 +399,16 @@ static struct nla_policy testdata_policy[NUM_MT76_TM_ATTRS] = {
+@@ -322,9 +395,16 @@ static struct nla_policy testdata_policy[NUM_MT76_TM_ATTRS] = {
  	[MT76_TM_ATTR_TX_RATE_LDPC] = { .type = NLA_U8 },
  	[MT76_TM_ATTR_TX_RATE_STBC] = { .type = NLA_U8 },
  	[MT76_TM_ATTR_TX_LTF] = { .type = NLA_U8 },
@@ -3212,7 +3084,7 @@
  };
  
 diff --git a/tx.c b/tx.c
-index 1809b03..f1dd9f6 100644
+index 6cc26cc6..5d7bf340 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -259,8 +259,7 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
@@ -3226,5 +3098,5 @@
  			wake_up(&dev->tx_wait);
  
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1010-wifi-mt76-testmode-add-pre-cal-support.patch b/recipes-wifi/linux-mt76/files/patches/1010-wifi-mt76-testmode-add-pre-cal-support.patch
index 40ecb9f..dff4e09 100644
--- a/recipes-wifi/linux-mt76/files/patches/1010-wifi-mt76-testmode-add-pre-cal-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1010-wifi-mt76-testmode-add-pre-cal-support.patch
@@ -1,7 +1,7 @@
-From cb5c539882d13499bbddb54666b201e7793e3b64 Mon Sep 17 00:00:00 2001
+From 431feba8fc3c13f6181fce8da33d4df29ce626a2 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 31 Aug 2022 20:06:52 +0800
-Subject: [PATCH 1010/1040] wifi: mt76: testmode: add pre-cal support
+Subject: [PATCH 1010/1034] wifi: mt76: testmode: add pre-cal support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -19,7 +19,7 @@
  11 files changed, 562 insertions(+), 13 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index ff8dc93..9b63799 100644
+index ff8dc939..9b637992 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -94,8 +94,10 @@ static int mt76_get_of_epprom_from_mtd(struct mt76_dev *dev, void *eep, int offs
@@ -36,10 +36,10 @@
  
  out_put_node:
 diff --git a/mt76.h b/mt76.h
-index 3d86702..ed1c864 100644
+index a5908de4..7d83d406 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -671,6 +671,7 @@ struct mt76_testmode_ops {
+@@ -658,6 +658,7 @@ struct mt76_testmode_ops {
  			  enum mt76_testmode_state new_state);
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
  	int (*set_eeprom)(struct mt76_phy *phy, u32 offset, u8 *val, u8 action);
@@ -48,10 +48,10 @@
  
  struct mt76_testmode_entry_data {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 7a7dbf4..a6449d1 100644
+index e3980c37..acbc07da 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -998,6 +998,7 @@ enum {
+@@ -994,6 +994,7 @@ enum {
  
  /* ext event table */
  enum {
@@ -60,7 +60,7 @@
  	MCU_EXT_EVENT_FW_LOG_2_HOST = 0x13,
  	MCU_EXT_EVENT_THERMAL_PROTECT = 0x22,
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index f3e5681..88aaa16 100644
+index f3e56817..88aaa16a 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
 @@ -39,10 +39,18 @@ enum mt7915_eeprom_field {
@@ -113,10 +113,10 @@
  
  #endif
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 0d1e09c..474bed1 100644
+index 6a5f204c..b6f50daf 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -395,6 +395,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -393,6 +393,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	case MCU_EXT_EVENT_BF_STATUS_READ:
  		mt7915_tm_txbf_status_read(dev, skb);
  		break;
@@ -126,7 +126,7 @@
  #endif
  	default:
  		break;
-@@ -2939,7 +2942,7 @@ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
+@@ -2930,7 +2933,7 @@ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
  	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
  	u32 total = MT_EE_CAL_GROUP_SIZE;
  
@@ -135,7 +135,7 @@
  		return 0;
  
  	/*
-@@ -3019,11 +3022,29 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+@@ -3010,11 +3013,29 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
  {
  	struct mt7915_dev *dev = phy->dev;
  	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
@@ -168,10 +168,10 @@
  
  	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 7526a8f..18881c0 100644
+index c91415f7..863624f4 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -358,6 +358,10 @@ struct mt7915_dev {
+@@ -355,6 +355,10 @@ struct mt7915_dev {
  	struct rchan *relay_fwlog;
  
  	void *cal;
@@ -182,7 +182,7 @@
  
  	struct {
  		u8 debug_wm;
-@@ -594,6 +598,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
+@@ -591,6 +595,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
  int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
@@ -191,7 +191,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index e5d0ef9..5ff183a 100644
+index 1e72bf2a..7d285ebc 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -5,6 +5,7 @@
@@ -202,7 +202,7 @@
  
  enum {
  	TM_CHANGED_TXPOWER,
-@@ -1600,18 +1601,16 @@ mt7915_tm_rf_switch_mode(struct mt7915_dev *dev, u32 oper)
+@@ -1599,18 +1600,16 @@ mt7915_tm_rf_switch_mode(struct mt7915_dev *dev, u32 oper)
  static int
  mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
  {
@@ -223,7 +223,7 @@
  		.icap_len = 120,
  		.op.rf.func_idx = cpu_to_le32(func_idx),
  	};
-@@ -1696,6 +1695,316 @@ out:
+@@ -1695,6 +1694,316 @@ out:
  				 sizeof(req), true);
  }
  
@@ -540,7 +540,7 @@
  static void
  mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
  {
-@@ -1740,6 +2049,10 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
+@@ -1739,6 +2048,10 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
  	else if (prev_state == MT76_TM_STATE_OFF ||
  		 state == MT76_TM_STATE_OFF)
  		mt7915_tm_init(phy, !(state == MT76_TM_STATE_OFF));
@@ -551,7 +551,7 @@
  
  	if ((state == MT76_TM_STATE_IDLE &&
  	     prev_state == MT76_TM_STATE_OFF) ||
-@@ -1910,9 +2223,113 @@ mt7915_tm_set_eeprom(struct mt76_phy *mphy, u32 offset, u8 *val, u8 action)
+@@ -1909,9 +2222,113 @@ mt7915_tm_set_eeprom(struct mt76_phy *mphy, u32 offset, u8 *val, u8 action)
  	return ret;
  }
  
@@ -666,7 +666,7 @@
 +	.dump_precal = mt7915_tm_dump_precal,
  };
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index eb0e043..7569826 100644
+index eb0e0432..75698261 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -81,6 +81,11 @@ struct tm_tx_cont {
@@ -734,7 +734,7 @@
  	TAM_ARB_OP_MODE_NORMAL = 1,
  	TAM_ARB_OP_MODE_TEST,
 diff --git a/testmode.c b/testmode.c
-index d2cef5b..b1b643c 100644
+index d2cef5b9..b1b643c3 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -767,6 +767,18 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
@@ -767,7 +767,7 @@
  
  	if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
 diff --git a/testmode.h b/testmode.h
-index 8c55fa0..109a556 100644
+index 8c55fa0f..109a556a 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -19,6 +19,7 @@
@@ -823,7 +823,7 @@
  
  	/* keep last */
 diff --git a/tools/fields.c b/tools/fields.c
-index 7e564a3..3ca5cd1 100644
+index 7e564a3b..3ca5cd1f 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -11,6 +11,14 @@ static const char * const testmode_state[] = {
@@ -842,5 +842,5 @@
  
  static const char * const testmode_tx_mode[] = {
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1011-wifi-mt76-testmode-add-iBF-command-mode-support.patch b/recipes-wifi/linux-mt76/files/patches/1011-wifi-mt76-testmode-add-iBF-command-mode-support.patch
index b476e79..67b3062 100644
--- a/recipes-wifi/linux-mt76/files/patches/1011-wifi-mt76-testmode-add-iBF-command-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1011-wifi-mt76-testmode-add-iBF-command-mode-support.patch
@@ -1,7 +1,7 @@
-From bc3169129e2978e3ec2e1a630023a30e78d18237 Mon Sep 17 00:00:00 2001
+From 439452d1e6ee75c69c94292b50e065b2f1ee0112 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 12 Sep 2022 18:16:54 +0800
-Subject: [PATCH 1011/1040] wifi: mt76: testmode: add iBF command mode support
+Subject: [PATCH 1011/1034] wifi: mt76: testmode: add iBF command mode support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -12,7 +12,7 @@
  4 files changed, 85 insertions(+), 7 deletions(-)
 
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 5ff183a..86deae6 100644
+index 7d285ebc..f735cae8 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -720,6 +720,7 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
@@ -50,7 +50,7 @@
  			break;
  		case IBF_PHASE_CAL_VERIFY:
  		case IBF_PHASE_CAL_VERIFY_INSTRUMENT:
-@@ -885,7 +888,6 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
+@@ -884,7 +887,6 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
  	pfmu_data->phi11 = cpu_to_le16(phi11);
  	pfmu_data->phi21 = cpu_to_le16(phi21);
  	pfmu_data->phi31 = cpu_to_le16(phi31);
@@ -58,7 +58,7 @@
  	if (subc_id == 63) {
  		struct mt7915_dev *dev = phy->dev;
  		struct {
-@@ -943,8 +945,8 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
+@@ -942,8 +944,8 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
  	struct mt76_testmode_data *td = &phy->mt76->test;
  	u16 *val = td->txbf_param;
  
@@ -69,7 +69,7 @@
  
  	switch (td->txbf_act) {
  	case MT76_TM_TXBF_ACT_INIT:
-@@ -962,10 +964,17 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
+@@ -961,10 +963,17 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
  		return mt7915_tm_txbf_profile_update(phy, val, true);
  	case MT76_TM_TXBF_ACT_PHASE_CAL:
  		return mt7915_tm_txbf_phase_cal(phy, val);
@@ -87,7 +87,7 @@
  	default:
  		break;
  	};
-@@ -1092,7 +1101,6 @@ mt7915_tm_set_tx_len(struct mt7915_phy *phy, u32 tx_time)
+@@ -1091,7 +1100,6 @@ mt7915_tm_set_tx_len(struct mt7915_phy *phy, u32 tx_time)
  		rate.legacy = sband->bitrates[rate.mcs].bitrate;
  		break;
  	case MT76_TM_TX_MODE_HT:
@@ -95,7 +95,7 @@
  		flags |= RATE_INFO_FLAGS_MCS;
  
  		if (td->tx_rate_sgi)
-@@ -1457,7 +1465,6 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+@@ -1456,7 +1464,6 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
  			if (duty_cycle < 100)
  				tx_time = duty_cycle * ipg / (100 - duty_cycle);
  		}
@@ -104,7 +104,7 @@
  		mt7915_tm_set_tx_len(phy, tx_time);
  
 diff --git a/testmode.c b/testmode.c
-index b1b643c..f415bec 100644
+index b1b643c3..f415beca 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -534,6 +534,42 @@ out:
@@ -163,7 +163,7 @@
  		nla_for_each_nested(cur, tb[MT76_TM_ATTR_TXBF_PARAM], rem) {
  			if (nla_len(cur) != 2 ||
 diff --git a/testmode.h b/testmode.h
-index 109a556..d2675dd 100644
+index 109a556a..d2675ddc 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -281,8 +281,10 @@ enum mt76_testmode_txbf_act {
@@ -178,7 +178,7 @@
  
  	/* keep last */
 diff --git a/tools/fields.c b/tools/fields.c
-index 3ca5cd1..6bf4c04 100644
+index 3ca5cd1f..6bf4c046 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -32,6 +32,20 @@ static const char * const testmode_tx_mode[] = {
@@ -238,5 +238,5 @@
  
  const struct tm_field msg_field = {
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch b/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch
index abeb149..c0b9eba 100644
--- a/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch
@@ -1,7 +1,7 @@
-From 1334f63638dc3cfc7bbcd8f14ee72d2b9847dd6d Mon Sep 17 00:00:00 2001
+From ddb1f053f52c744d0bcbf10563c8e904f6bffa17 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 27 Oct 2022 17:42:07 +0800
-Subject: [PATCH 1012/1040] wifi: mt76: testmode: add ZWDFS test mode support
+Subject: [PATCH 1012/1034] wifi: mt76: testmode: add ZWDFS test mode support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -18,10 +18,10 @@
  10 files changed, 508 insertions(+), 1 deletion(-)
 
 diff --git a/mt76.h b/mt76.h
-index ed1c864..ed69106 100644
+index 7d83d406..75b28748 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -754,6 +754,15 @@ struct mt76_testmode_data {
+@@ -741,6 +741,15 @@ struct mt76_testmode_data {
  		u64 fcs_error[__MT_RXQ_MAX];
  		u64 len_mismatch;
  	} rx_stats;
@@ -38,10 +38,10 @@
  
  struct mt76_vif {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index a6449d1..2848179 100644
+index acbc07da..e55e548e 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1206,6 +1206,7 @@ enum {
+@@ -1195,6 +1195,7 @@ enum {
  	MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
  	MCU_EXT_CMD_SET_RDD_TH = 0x9d,
  	MCU_EXT_CMD_MURU_CTRL = 0x9f,
@@ -49,7 +49,7 @@
  	MCU_EXT_CMD_RX_STAT = 0xa4,
  	MCU_EXT_CMD_SET_SPR = 0xa8,
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
-@@ -1216,6 +1217,7 @@ enum {
+@@ -1205,6 +1206,7 @@ enum {
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
  	MCU_EXT_CMD_CERT_CFG = 0xb7,
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
@@ -58,10 +58,10 @@
  
  enum {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 474bed1..2cd772b 100644
+index b6f50daf..020780d3 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2670,6 +2670,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
+@@ -2661,6 +2661,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
  		req.monitor_chan = chandef->chan->hw_value;
  		req.monitor_central_chan =
  			ieee80211_frequency_to_channel(chandef->center_freq1);
@@ -69,7 +69,7 @@
  		req.band_idx = phy->mt76->band_idx;
  		req.scan_mode = 2;
  		break;
-@@ -4708,3 +4709,68 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
+@@ -4699,3 +4700,68 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MEC_CTRL), &req, sizeof(req), true);
  }
  #endif
@@ -139,7 +139,7 @@
 +	return 0;
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 9982735..f4c3bf4 100644
+index 99827354..f4c3bf4e 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -686,6 +686,52 @@ struct csi_data {
@@ -196,7 +196,7 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 18881c0..33ac2d2 100644
+index 863624f4..88e45298 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -256,6 +256,7 @@ struct mt7915_phy {
@@ -207,7 +207,7 @@
  
  	u8 stats_work_count;
  	struct list_head stats_list;
-@@ -710,6 +711,9 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+@@ -707,6 +708,9 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
  
@@ -218,10 +218,10 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 6783797..44863e8 100644
+index 428f4820..482b3fee 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -1209,6 +1209,8 @@ enum offs_rev {
+@@ -1208,6 +1208,8 @@ enum offs_rev {
  #define MT_WF_IRPI_NSS(phy, nss)	MT_WF_IRPI(0x6000 + ((phy) << 20) + ((nss) << 16))
  #define MT_WF_IRPI_NSS_MT7916(phy, nss)	MT_WF_IRPI(0x1000 + ((phy) << 20) + ((nss) << 16))
  
@@ -231,7 +231,7 @@
  #define MT_WF_PHY_BASE			0x83080000
  #define MT_WF_PHY(ofs)			(MT_WF_PHY_BASE + (ofs))
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 86deae6..e321848 100644
+index f735cae8..2e51dcd5 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -13,6 +13,12 @@ enum {
@@ -260,7 +260,7 @@
  };
  
  struct reg_band {
-@@ -982,6 +994,272 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
+@@ -981,6 +993,272 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
  	return 0;
  }
  
@@ -533,7 +533,7 @@
  static int
  mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
  		      u16 cw_max, u16 txop, u8 tx_cmd)
-@@ -1269,6 +1547,8 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
+@@ -1268,6 +1546,8 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
  		phy->mt76->test.tx_mpdu_len = 0;
  		phy->test.bf_en = 0;
  		mt7915_tm_set_entry(phy);
@@ -542,7 +542,7 @@
  	}
  }
  
-@@ -2028,6 +2308,14 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
+@@ -2027,6 +2307,14 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
  		mt7915_tm_set_cfg(phy);
  	if (changed & BIT(TM_CHANGED_TXBF_ACT))
  		mt7915_tm_set_txbf(phy);
@@ -558,7 +558,7 @@
  
  static int
 diff --git a/testmode.c b/testmode.c
-index f415bec..babae8d 100644
+index f415beca..babae8d4 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -25,6 +25,13 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
@@ -622,7 +622,7 @@
  	     nla_put_u8(msg, MT76_TM_ATTR_TX_LTF, td->tx_ltf)) ||
  	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_ANTENNA) &&
 diff --git a/testmode.h b/testmode.h
-index d2675dd..97e7596 100644
+index d2675ddc..97e75964 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -63,6 +63,20 @@
@@ -690,7 +690,7 @@
 +
  #endif
 diff --git a/tools/fields.c b/tools/fields.c
-index 6bf4c04..fc01043 100644
+index 6bf4c046..fc01043e 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -46,6 +46,14 @@ static const char * const testmode_txbf_act[] = {
@@ -737,5 +737,5 @@
  
  const struct tm_field msg_field = {
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch b/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
index e6f1971..f88823a 100644
--- a/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
@@ -1,8 +1,8 @@
-From ea0393c4c9076db02c3ebe34b87dc381c34e5a3d Mon Sep 17 00:00:00 2001
+From 7598ccc4626d9d41807a59fa8304649a7260b9ed Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 15 Dec 2022 19:45:18 +0800
-Subject: [PATCH 1013/1040] wifi: mt76: testmode: add iBF/eBF cal and cert
- commands with golden
+Subject: [PATCH] wifi: mt76: testmode: add iBF/eBF cal and cert commands with
+ golden
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -25,10 +25,10 @@
  16 files changed, 857 insertions(+), 324 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index ed69106..fa9c6a4 100644
+index 75b2874..af29bde 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -716,6 +716,7 @@ struct mt76_testmode_data {
+@@ -703,6 +703,7 @@ struct mt76_testmode_data {
  
  	struct list_head tm_entry_list;
  	struct mt76_wcid *cur_entry;
@@ -36,7 +36,7 @@
  	u8 entry_num;
  	union {
  		struct mt76_testmode_entry_data ed;
-@@ -744,6 +745,9 @@ struct mt76_testmode_data {
+@@ -731,6 +732,9 @@ struct mt76_testmode_data {
  
  	u8 txbf_act;
  	u16 txbf_param[8];
@@ -47,10 +47,10 @@
  	u32 tx_pending;
  	u32 tx_queued;
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 60e159c..07bd57b 100644
+index 74b63f0..e6b468c 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -2796,6 +2796,7 @@ int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -2767,6 +2767,7 @@ int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
  	u32 type = vif->p2p ? NETWORK_P2P : NETWORK_INFRA;
  	struct bss_info_basic *bss;
  	struct tlv *tlv;
@@ -58,7 +58,7 @@
  
  	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
  	bss = (struct bss_info_basic *)tlv;
-@@ -2855,6 +2856,8 @@ int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -2826,6 +2827,8 @@ int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
  		bss->dtim_period = vif->bss_conf.dtim_period;
  		bss->phy_mode = mt76_connac_get_phy_mode(phy, vif,
  							 chandef->chan->band, NULL);
@@ -68,7 +68,7 @@
  		memcpy(bss->bssid, phy->macaddr, ETH_ALEN);
  	}
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index bd0efd5..4244177 100644
+index 6c9401d..1e0bee7 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -729,8 +729,10 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
@@ -84,7 +84,7 @@
  	txwi[6] |= cpu_to_le32(val);
  #endif
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 3b18c95..169d597 100644
+index d7bcd5f..9694bd7 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -205,46 +205,37 @@ static void mt7915_init_bitrate_mask(struct ieee80211_vif *vif)
@@ -175,7 +175,7 @@
  
  	return ret;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 2cd772b..83d974c 100644
+index 020780d..c8b97e8 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -199,6 +199,7 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -186,7 +186,7 @@
  	if (ret)
  		return ret;
  
-@@ -391,10 +392,12 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -389,10 +390,12 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	case MCU_EXT_EVENT_BCC_NOTIFY:
  		mt7915_mcu_rx_bcc_notify(dev, skb);
  		break;
@@ -201,7 +201,7 @@
  	case MCU_EXT_EVENT_RF_TEST:
  		mt7915_tm_rf_test_event(dev, skb);
  		break;
-@@ -683,11 +686,22 @@ int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
+@@ -681,11 +684,22 @@ int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
  	if (enable)
  		mt76_connac_mcu_bss_omac_tlv(skb, vif);
  
@@ -227,7 +227,7 @@
  
  	if (enable) {
  		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
-@@ -3440,6 +3454,7 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
+@@ -3431,6 +3445,7 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
  
  int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
  {
@@ -235,7 +235,7 @@
  	struct {
  		u8 action;
  		union {
-@@ -3466,7 +3481,6 @@ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
+@@ -3457,7 +3472,6 @@ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
  		.action = action,
  	};
  
@@ -243,7 +243,7 @@
  	switch (action) {
  	case MT_BF_SOUNDING_ON:
  		req.snd.snd_mode = MT_BF_PROCESSING;
-@@ -4601,6 +4615,9 @@ int mt7915_mcu_set_txbf_sound_info(struct mt7915_phy *phy, u8 action,
+@@ -4592,6 +4606,9 @@ int mt7915_mcu_set_txbf_sound_info(struct mt7915_phy *phy, u8 action,
  		req.he_opt = v2;
  		req.glo_opt = v3;
  		break;
@@ -448,7 +448,7 @@
  	MURU_SET_ARB_OP_MODE = 14,
  	MURU_SET_PLATFORM_TYPE = 25,
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 87a5c5c..6dd6eca 100644
+index 6505d76..25c3fe2 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -133,6 +133,7 @@ static const u32 mt7915_offs[] = {
@@ -468,7 +468,7 @@
  	[AGG_AALCR0]		= 0x028,
  	[AGG_AWSCR0]		= 0x030,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 33ac2d2..135b39b 100644
+index 88e4529..4572066 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -274,7 +274,6 @@ struct mt7915_phy {
@@ -479,7 +479,7 @@
  		bool bf_ever_en;
  	} test;
  #endif
-@@ -379,7 +378,7 @@ struct mt7915_dev {
+@@ -376,7 +375,7 @@ struct mt7915_dev {
  	void __iomem *dcm;
  	void __iomem *sku;
  
@@ -488,7 +488,7 @@
  	struct {
  		void *txbf_phase_cal;
  		void *txbf_pfmu_data;
-@@ -518,6 +517,7 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force);
+@@ -515,6 +514,7 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force);
  int mt7915_dma_start(struct mt7915_dev *dev, bool reset, bool wed_reset);
  int mt7915_txbf_init(struct mt7915_dev *dev);
  void mt7915_init_txpower(struct mt7915_phy *phy);
@@ -496,7 +496,7 @@
  void mt7915_reset(struct mt7915_dev *dev);
  int mt7915_run(struct ieee80211_hw *hw);
  int mt7915_mcu_init(struct mt7915_dev *dev);
-@@ -598,8 +598,10 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+@@ -595,8 +595,10 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
@@ -508,7 +508,7 @@
  
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
-@@ -734,4 +736,10 @@ enum {
+@@ -731,4 +733,10 @@ enum {
  
  #endif
  
@@ -520,10 +520,10 @@
 +
  #endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 96655db..7fc6a3f 100644
+index 9bb6dd0..6d9d009 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2890,6 +2890,36 @@ mt7915_txpower_level_set(void *data, u64 val)
+@@ -2892,6 +2892,36 @@ mt7915_txpower_level_set(void *data, u64 val)
  DEFINE_DEBUGFS_ATTRIBUTE(fops_txpower_level, NULL,
  			 mt7915_txpower_level_set, "%lld\n");
  
@@ -560,7 +560,7 @@
  /* usage: echo 0x[arg3][arg2][arg1] > fw_wa_set */
  static int
  mt7915_wa_set(void *data, u64 val)
-@@ -3649,6 +3679,11 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3651,6 +3681,11 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  	debugfs_create_file("txpower_level", 0400, dir, dev,
  			    &fops_txpower_level);
  
@@ -836,7 +836,7 @@
 +}
 +#endif
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 44863e8..1f1f8b9 100644
+index 482b3fe..44da7b8 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -61,6 +61,7 @@ enum offs_rev {
@@ -847,7 +847,7 @@
  	RMAC_MIB_AIRTIME14,
  	AGG_AALCR0,
  	AGG_AWSCR0,
-@@ -534,6 +535,9 @@ enum offs_rev {
+@@ -533,6 +534,9 @@ enum offs_rev {
  #define MT_ARB_DRNGR0(_band, _n)	MT_WF_ARB(_band, (__OFFS(ARB_DRNGR0) +	\
  							  (_n) * 4))
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1014-wifi-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch b/recipes-wifi/linux-mt76/files/patches/1014-wifi-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
index ce08209..704b730 100644
--- a/recipes-wifi/linux-mt76/files/patches/1014-wifi-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1014-wifi-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
@@ -1,7 +1,7 @@
-From 6f767bac12cec3502c3760984abffcf2d806b70f Mon Sep 17 00:00:00 2001
+From 0d52f2e48810848f5e9203551554fc893d04ecbf Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Sun, 24 Apr 2022 10:07:00 +0800
-Subject: [PATCH 1014/1040] wifi: mt76: mt7915: init rssi in WTBL when add
+Subject: [PATCH 1014/1034] wifi: mt76: mt7915: init rssi in WTBL when add
  station
 
 ---
@@ -9,10 +9,10 @@
  1 file changed, 4 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 169d597..e11ae9f 100644
+index 9694bd71..d43dd584 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -761,6 +761,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -749,6 +749,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_phy *phy = ext_phy ? mt7915_ext_phy(dev) : &dev->phy;
  #endif
  	int ret, idx;
@@ -20,7 +20,7 @@
  
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
  	if (idx < 0)
-@@ -785,6 +786,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -773,6 +774,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (ret)
  		return ret;
  
@@ -31,5 +31,5 @@
  	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
  #endif
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1015-wifi-mt76-connac-airtime-fairness-feature-off-in-mac.patch b/recipes-wifi/linux-mt76/files/patches/1015-wifi-mt76-connac-airtime-fairness-feature-off-in-mac.patch
index f7936c9..afa2b05 100644
--- a/recipes-wifi/linux-mt76/files/patches/1015-wifi-mt76-connac-airtime-fairness-feature-off-in-mac.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1015-wifi-mt76-connac-airtime-fairness-feature-off-in-mac.patch
@@ -1,7 +1,7 @@
-From c1864400a5aa6b60aebe412f8625109b61db04c0 Mon Sep 17 00:00:00 2001
+From 1d14e8d3170e8cad4b0a03a94231f720f8b8938c Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 6 May 2022 15:58:42 +0800
-Subject: [PATCH 1015/1040] wifi: mt76: connac: airtime fairness feature off in
+Subject: [PATCH 1015/1034] wifi: mt76: connac: airtime fairness feature off in
  mac80211
 
 ---
@@ -9,10 +9,10 @@
  1 file changed, 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index fccf26d..ad3a5e2 100644
+index ed1d659b..25ec4330 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -440,7 +440,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
+@@ -437,7 +437,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
  			WIPHY_FLAG_AP_UAPSD;
  
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
@@ -21,5 +21,5 @@
  
  	wiphy->available_antennas_tx = phy->antenna_mask;
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1016-wifi-mt76-mt7915-add-mt7986-and-mt7916-pre-calibrati.patch b/recipes-wifi/linux-mt76/files/patches/1016-wifi-mt76-mt7915-add-mt7986-and-mt7916-pre-calibrati.patch
index c018337..0536615 100644
--- a/recipes-wifi/linux-mt76/files/patches/1016-wifi-mt76-mt7915-add-mt7986-and-mt7916-pre-calibrati.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1016-wifi-mt76-mt7915-add-mt7986-and-mt7916-pre-calibrati.patch
@@ -1,7 +1,7 @@
-From c30637769e5ab91210b3ef958fb5e27212ed89e4 Mon Sep 17 00:00:00 2001
+From 68772db4cdffdeceb9c65823ec060b4ec0642136 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 20 May 2022 19:19:25 +0800
-Subject: [PATCH 1016/1040] wifi: mt76: mt7915: add mt7986 and mt7916
+Subject: [PATCH 1016/1034] wifi: mt76: mt7915: add mt7986 and mt7916
  pre-calibration
 
 Add pre-calibration for mt7986 and mt7916. It has different data size
@@ -16,7 +16,7 @@
  3 files changed, 62 insertions(+), 26 deletions(-)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index f5ab331..a5c99a5 100644
+index f5ab3319..a5c99a5e 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -9,23 +9,22 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
@@ -51,7 +51,7 @@
  
  static int mt7915_check_eeprom(struct mt7915_dev *dev)
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index 88aaa16..fdae347 100644
+index 88aaa16a..fdae347e 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
 @@ -19,6 +19,7 @@ enum mt7915_eeprom_field {
@@ -63,10 +63,10 @@
  	MT_EE_RATE_DELTA_5G =	0x29d,
  	MT_EE_TX0_POWER_2G =	0x2fc,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 83d974c..8202a4e 100644
+index c8b97e89..fa2c6919 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2955,7 +2955,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
+@@ -2946,7 +2946,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
  int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
  {
  	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
@@ -76,7 +76,7 @@
  
  	if (!(eep[offs] & MT_EE_WIFI_CAL_GROUP))
  		return 0;
-@@ -2993,9 +2994,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
+@@ -2984,9 +2985,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
  	return -1;
  }
  
@@ -88,7 +88,7 @@
  		5180, 5200, 5220, 5240,
  		5260, 5280, 5300, 5320,
  		5500, 5520, 5540, 5560,
-@@ -3003,34 +3004,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
+@@ -2994,34 +2995,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
  		5660, 5680, 5700, 5745,
  		5765, 5785, 5805, 5825
  	};
@@ -168,7 +168,7 @@
  }
  
  int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
-@@ -3062,24 +3098,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+@@ -3053,24 +3089,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
  	if (!(eep[offs] & dpd_mask))
  		return 0;
  
@@ -199,5 +199,5 @@
  
  	return 0;
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1017-wifi-mt76-mt7915-add-phy-capability-vendor-command.patch b/recipes-wifi/linux-mt76/files/patches/1017-wifi-mt76-mt7915-add-phy-capability-vendor-command.patch
index 3562374..91dd627 100644
--- a/recipes-wifi/linux-mt76/files/patches/1017-wifi-mt76-mt7915-add-phy-capability-vendor-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1017-wifi-mt76-mt7915-add-phy-capability-vendor-command.patch
@@ -1,7 +1,7 @@
-From 4bca02444e44f948a9d8d26fb155c7c1f1304f31 Mon Sep 17 00:00:00 2001
+From cb99b4cd73793df9da8e7723cef7c2c125a5d012 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
 Date: Tue, 12 Jul 2022 10:04:35 -0700
-Subject: [PATCH 1017/1040] wifi: mt76: mt7915: add phy capability vendor
+Subject: [PATCH 1017/1034] wifi: mt76: mt7915: add phy capability vendor
  command
 
 ---
@@ -11,7 +11,7 @@
  3 files changed, 78 insertions(+)
 
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 135b39b..b41c96b 100644
+index 4572066b..a3575b66 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -11,6 +11,7 @@
@@ -23,7 +23,7 @@
  #define MT7916_WTBL_SIZE		544
  #define MT7915_WTBL_RESERVED		(mt7915_wtbl_size(dev) - 1)
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index df1cac3..3dbbd32 100644
+index df1cac3f..3dbbd326 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -50,6 +50,18 @@ rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
@@ -100,7 +100,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 2be5fc8..ffdb466 100644
+index 2be5fc89..ffdb466b 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -9,6 +9,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -141,5 +141,5 @@
 +
  #endif
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1018-wifi-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable.patch b/recipes-wifi/linux-mt76/files/patches/1018-wifi-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable.patch
index b7ed3aa..c03b8b8 100644
--- a/recipes-wifi/linux-mt76/files/patches/1018-wifi-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1018-wifi-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable.patch
@@ -1,7 +1,7 @@
-From fb237147a73b10808a651273198583b938003338 Mon Sep 17 00:00:00 2001
+From 77df44ad45a75af9eb84e40fc81a57b39776cb17 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 24 Jun 2022 11:15:45 +0800
-Subject: [PATCH 1018/1040] wifi: mt76: mt7915: add vendor subcmd EDCCA ctrl
+Subject: [PATCH 1018/1034] wifi: mt76: mt7915: add vendor subcmd EDCCA ctrl
  enable/threshold/compensation
 
 Change-Id: I06a3f94d5e444be894200e2b6588d76ed38d09d0
@@ -16,10 +16,10 @@
  7 files changed, 265 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 2848179..4905411 100644
+index e55e548e..da2f5dd0 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1216,6 +1216,7 @@ enum {
+@@ -1205,6 +1205,7 @@ enum {
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
  	MCU_EXT_CMD_CERT_CFG = 0xb7,
@@ -28,7 +28,7 @@
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
  };
 diff --git a/mt7915/main.c b/mt7915/main.c
-index e11ae9f..287ca99 100644
+index d43dd584..85524e91 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -478,6 +478,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
@@ -42,10 +42,10 @@
  		ret = mt7915_set_channel(phy);
  		if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 8202a4e..83ceb2e 100644
+index fa2c6919..96c47273 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4827,3 +4827,76 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
+@@ -4818,3 +4818,76 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
  
  	return 0;
  }
@@ -123,7 +123,7 @@
 +	return 0;
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index c95d990..d271e2b 100644
+index c95d9900..d271e2be 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -1116,6 +1116,27 @@ enum {
@@ -155,10 +155,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index b41c96b..c5f4e94 100644
+index a3575b66..c01e0522 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -713,7 +713,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
+@@ -710,7 +710,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
  int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
@@ -169,7 +169,7 @@
  int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 3dbbd32..afba18e 100644
+index 3dbbd326..afba18e4 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -62,6 +62,24 @@ phy_capa_dump_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP] = {
@@ -326,7 +326,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index ffdb466..0c96377 100644
+index ffdb466b..0c96377f 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -2,6 +2,7 @@
@@ -377,5 +377,5 @@
  
  enum mtk_capi_control_changed {
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1019-wifi-mt76-mt7915-implement-bin-file-mode.patch b/recipes-wifi/linux-mt76/files/patches/1019-wifi-mt76-mt7915-implement-bin-file-mode.patch
index 9ab86d5..8b25711 100644
--- a/recipes-wifi/linux-mt76/files/patches/1019-wifi-mt76-mt7915-implement-bin-file-mode.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1019-wifi-mt76-mt7915-implement-bin-file-mode.patch
@@ -1,7 +1,7 @@
-From 21c0d49738d105ad23e248a213da069e4e57dd21 Mon Sep 17 00:00:00 2001
+From 9d3a10ebaa4a56d53182845525098e878b5df462 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 7 Jul 2022 11:09:59 +0800
-Subject: [PATCH 1019/1040] wifi: mt76: mt7915: implement bin file mode
+Subject: [PATCH 1019/1034] wifi: mt76: mt7915: implement bin file mode
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
@@ -15,7 +15,7 @@
  6 files changed, 111 insertions(+), 3 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 9b63799..eb532c7 100644
+index 9b637992..eb532c77 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -159,6 +159,26 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len)
@@ -46,10 +46,10 @@
  mt76_eeprom_override(struct mt76_phy *phy)
  {
 diff --git a/mt76.h b/mt76.h
-index fa9c6a4..13796ad 100644
+index af29bdeb..b4e34296 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -941,6 +941,9 @@ struct mt76_dev {
+@@ -925,6 +925,9 @@ struct mt76_dev {
  		struct mt76_usb usb;
  		struct mt76_sdio sdio;
  	};
@@ -59,7 +59,7 @@
  };
  
  /* per-phy stats.  */
-@@ -1173,6 +1176,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
+@@ -1156,6 +1159,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
  int mt76_eeprom_init(struct mt76_dev *dev, int len);
  void mt76_eeprom_override(struct mt76_phy *phy);
  int mt76_get_of_eeprom(struct mt76_dev *dev, void *data, int offset, int len);
@@ -68,7 +68,7 @@
  struct mt76_queue *
  mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index a5c99a5..fd08d42 100644
+index a5c99a5e..fd08d42a 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -47,8 +47,11 @@ static int mt7915_check_eeprom(struct mt7915_dev *dev)
@@ -149,7 +149,7 @@
  		if (ret)
  			return ret;
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index fdae347..9056d78 100644
+index fdae347e..9056d786 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
 @@ -108,6 +108,13 @@ enum mt7915_sku_rate_group {
@@ -167,10 +167,10 @@
  mt7915_get_channel_group_5g(int channel, bool is_7976)
  {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index c5f4e94..b6a564e 100644
+index c01e0522..6c4f407b 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -350,6 +350,8 @@ struct mt7915_dev {
+@@ -349,6 +349,8 @@ struct mt7915_dev {
  
  	bool dbdc_support;
  	bool flash_mode;
@@ -179,7 +179,7 @@
  	bool muru_debug;
  	bool ibf;
  
-@@ -726,6 +728,7 @@ void mt7915_dump_tmac_info(u8 *tmac_info);
+@@ -723,6 +725,7 @@ void mt7915_dump_tmac_info(u8 *tmac_info);
  int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level);
  void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len);
  int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable);
@@ -188,7 +188,7 @@
  #define PKT_BIN_DEBUG_MAGIC	0xc8763123
  enum {
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 7fc6a3f..b949ad7 100644
+index 6d9d009d..bc683db8 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -3,6 +3,7 @@
@@ -199,7 +199,7 @@
  
  #ifdef MTK_DEBUG
  #define LWTBL_IDX2BASE_ID		GENMASK(14, 8)
-@@ -3600,6 +3601,47 @@ static int mt7915_fw_wm_info_read(struct seq_file *s, void *data)
+@@ -3602,6 +3603,47 @@ static int mt7915_fw_wm_info_read(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -247,7 +247,7 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  {
  	struct mt7915_dev *dev = phy->dev;
-@@ -3686,6 +3728,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3688,6 +3730,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  
  	debugfs_create_u8("sku_disable", 0600, dir, &dev->dbg.sku_disable);
  
@@ -257,5 +257,5 @@
  }
  #endif
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1020-wifi-mt76-mt7915-Add-mu-dump-support.patch b/recipes-wifi/linux-mt76/files/patches/1020-wifi-mt76-mt7915-Add-mu-dump-support.patch
index 013b88f..d7f07bf 100644
--- a/recipes-wifi/linux-mt76/files/patches/1020-wifi-mt76-mt7915-Add-mu-dump-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1020-wifi-mt76-mt7915-Add-mu-dump-support.patch
@@ -1,7 +1,7 @@
-From ffa6ac27f043615593e71b38734e47521cb066c0 Mon Sep 17 00:00:00 2001
+From 7f2833b672a467aa6684b100b00bfbd6d0c4d07f Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Thu, 11 Aug 2022 18:09:45 -0700
-Subject: [PATCH 1020/1040] wifi: mt76: mt7915: Add mu dump support
+Subject: [PATCH 1020/1034] wifi: mt76: mt7915: Add mu dump support
 
 Change-Id: I521214f3feb6f0d528a9f550255050ffd1ec96d2
 ---
@@ -10,7 +10,7 @@
  2 files changed, 25 insertions(+)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index afba18e..0c0b47e 100644
+index afba18e4..0c0b47e7 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -37,6 +37,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -59,7 +59,7 @@
  		.maxattr = MTK_VENDOR_ATTR_MU_CTRL_MAX,
  	},
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 0c96377..d8e23d3 100644
+index 0c96377f..d8e23d34 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -72,6 +72,7 @@ enum mtk_vendor_attr_mu_ctrl {
@@ -71,5 +71,5 @@
  	/* keep last */
  	NUM_MTK_VENDOR_ATTRS_MU_CTRL,
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1021-wifi-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ct.patch b/recipes-wifi/linux-mt76/files/patches/1021-wifi-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ct.patch
index 7f0aff5..7abb63f 100644
--- a/recipes-wifi/linux-mt76/files/patches/1021-wifi-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ct.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1021-wifi-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ct.patch
@@ -1,7 +1,7 @@
-From fc0376cf18d75e6691d1c1dee207a0a7536a8d4f Mon Sep 17 00:00:00 2001
+From 07c6e8cd0e8ad51a294d4d2d3747f62dd22124ab Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 28 Oct 2022 10:15:56 +0800
-Subject: [PATCH 1021/1040] wifi: mt76: mt7915: add vendor subcmd three wire
+Subject: [PATCH 1021/1034] wifi: mt76: mt7915: add vendor subcmd three wire
  (PTA) ctrl
 
 Change-Id: Ic1044698f294455594a0c6254f55326fdab90580
@@ -16,10 +16,10 @@
  6 files changed, 111 insertions(+), 29 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 4905411..3b5c58b 100644
+index da2f5dd0..daeec01f 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1215,7 +1215,7 @@ enum {
+@@ -1204,7 +1204,7 @@ enum {
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
@@ -29,10 +29,10 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 83ceb2e..7e33386 100644
+index 96c47273..4aee1268 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4526,37 +4526,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
+@@ -4517,37 +4517,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
  			&req, sizeof(req), false);
  }
  
@@ -94,7 +94,7 @@
  
  void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index d271e2b..5fc4e2e 100644
+index d271e2be..5fc4e2ef 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -904,6 +904,35 @@ struct mt7915_mcu_rdd_ipi_scan {
@@ -134,10 +134,10 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index b6a564e..febe070 100644
+index 6c4f407b..b5f76a32 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -707,6 +707,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
+@@ -704,6 +704,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
  void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable);
  int mt7915_mcu_set_mu_edca(struct mt7915_phy *phy, u8 val);
  void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type);
@@ -146,7 +146,7 @@
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 0c0b47e..b651cea 100644
+index 0c0b47e7..b651cea2 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -40,6 +40,11 @@ mu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_MU_CTRL] = {
@@ -229,7 +229,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index d8e23d3..de3cbe2 100644
+index d8e23d34..de3cbe2c 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -12,6 +12,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -268,5 +268,5 @@
  	CAPI_RFEATURE_CHANGED		= BIT(16),
  	CAPI_WIRELESS_CHANGED		= BIT(17),
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1022-wifi-mt76-mt7915-add-ibf-control-vendor-cmd.patch b/recipes-wifi/linux-mt76/files/patches/1022-wifi-mt76-mt7915-add-ibf-control-vendor-cmd.patch
index 479b39f..bece1c8 100644
--- a/recipes-wifi/linux-mt76/files/patches/1022-wifi-mt76-mt7915-add-ibf-control-vendor-cmd.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1022-wifi-mt76-mt7915-add-ibf-control-vendor-cmd.patch
@@ -1,7 +1,7 @@
-From a16d1b2e363994a284d5542c4f980a693fdbe326 Mon Sep 17 00:00:00 2001
+From 68d1ed6b4959520cab2864c81f9322e983d1adee Mon Sep 17 00:00:00 2001
 From: mtk27835 <shurong.wen@mediatek.com>
 Date: Wed, 7 Sep 2022 14:01:29 -0700
-Subject: [PATCH 1022/1040] wifi: mt76: mt7915: add ibf control vendor cmd
+Subject: [PATCH 1022/1034] wifi: mt76: mt7915: add ibf control vendor cmd
 
 Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
 ---
@@ -10,7 +10,7 @@
  2 files changed, 89 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index b651cea..b661ea4 100644
+index b651cea2..b661ea4e 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -86,6 +86,11 @@ edcca_dump_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP] = {
@@ -100,7 +100,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index de3cbe2..a6309a3 100644
+index de3cbe2c..a6309a32 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -12,7 +12,8 @@ enum mtk_nl80211_vendor_subcmds {
@@ -141,5 +141,5 @@
 +
  #endif
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1023-wifi-mt76-mt7915-add-E3-re-bonding-for-low-yield-rat.patch b/recipes-wifi/linux-mt76/files/patches/1023-wifi-mt76-mt7915-add-E3-re-bonding-for-low-yield-rat.patch
index 408e5b6..60261c6 100644
--- a/recipes-wifi/linux-mt76/files/patches/1023-wifi-mt76-mt7915-add-E3-re-bonding-for-low-yield-rat.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1023-wifi-mt76-mt7915-add-E3-re-bonding-for-low-yield-rat.patch
@@ -1,7 +1,7 @@
-From 81ddde34a61e2a320cf1af73cc91e0465e92cad8 Mon Sep 17 00:00:00 2001
+From a3c96bd2d17ffd8777dd7c3afe429daa3aada222 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 30 Mar 2023 15:12:37 +0800
-Subject: [PATCH 1023/1040] wifi: mt76: mt7915: add E3 re-bonding for low yield
+Subject: [PATCH 1023/1034] wifi: mt76: mt7915: add E3 re-bonding for low yield
  rate issue
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -11,7 +11,7 @@
  2 files changed, 29 insertions(+)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index fd08d42..3b44a9d 100644
+index fd08d42a..3b44a9d7 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -244,6 +244,32 @@ void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
@@ -57,10 +57,10 @@
  	if (ret)
  		return ret;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index febe070..a3d7b4b 100644
+index b5f76a32..851caa99 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -506,6 +506,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
+@@ -503,6 +503,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
  
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
@@ -69,5 +69,5 @@
  void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
  				struct mt7915_phy *phy);
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1024-wifi-mt76-mt7915-support-on-off-SW-ACI-through-debug.patch b/recipes-wifi/linux-mt76/files/patches/1024-wifi-mt76-mt7915-support-on-off-SW-ACI-through-debug.patch
index 0ac0f94..f42e269 100644
--- a/recipes-wifi/linux-mt76/files/patches/1024-wifi-mt76-mt7915-support-on-off-SW-ACI-through-debug.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1024-wifi-mt76-mt7915-support-on-off-SW-ACI-through-debug.patch
@@ -1,7 +1,7 @@
-From bf55d4819b6c12dd7c6e13a51f8ee28636265345 Mon Sep 17 00:00:00 2001
+From ea7179a6774f9ca965731738b4e171f26767ae4e Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 14 Oct 2022 11:15:13 +0800
-Subject: [PATCH 1024/1040] wifi: mt76: mt7915: support on off SW ACI through
+Subject: [PATCH 1024/1034] wifi: mt76: mt7915: support on off SW ACI through
  debugfs
 
 Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
@@ -12,10 +12,10 @@
  2 files changed, 22 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 3b5c58b..4925890 100644
+index daeec01f..8228bbb1 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1217,6 +1217,7 @@ enum {
+@@ -1206,6 +1206,7 @@ enum {
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
  	MCU_EXT_CMD_SET_CFG = 0xb7,
  	MCU_EXT_CMD_EDCCA = 0xba,
@@ -24,10 +24,10 @@
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
  };
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index b949ad7..ef5d581 100644
+index bc683db8..48e2edcf 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -3642,6 +3642,25 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
+@@ -3644,6 +3644,25 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -53,7 +53,7 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  {
  	struct mt7915_dev *dev = phy->dev;
-@@ -3730,6 +3749,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3732,6 +3751,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  
  	debugfs_create_devm_seqfile(dev->mt76.dev, "eeprom_mode", dir,
  				    mt7915_show_eeprom_mode);
@@ -63,5 +63,5 @@
  }
  #endif
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1025-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch b/recipes-wifi/linux-mt76/files/patches/1025-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch
index 17d289a..38f5d75 100644
--- a/recipes-wifi/linux-mt76/files/patches/1025-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1025-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch
@@ -1,7 +1,7 @@
-From f793f54b26302abc942574b2e6f19f609b3a1c0e Mon Sep 17 00:00:00 2001
+From de4b50e7a8564367603e5de2e967315fd13ffb82 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 5 Dec 2022 18:21:51 +0800
-Subject: [PATCH 1025/1040] wifi: mt76: mt7915: add bf backoff limit table
+Subject: [PATCH 1025/1034] wifi: mt76: mt7915: add bf backoff limit table
  support
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
@@ -16,7 +16,7 @@
  7 files changed, 220 insertions(+), 39 deletions(-)
 
 diff --git a/debugfs.c b/debugfs.c
-index 1c8328d..19a835c 100644
+index 4a8e1864..4bb46799 100644
 --- a/debugfs.c
 +++ b/debugfs.c
 @@ -95,7 +95,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
@@ -29,7 +29,7 @@
  		seq_printf(file, " %2d", val[i]);
  	seq_puts(file, "\n");
 diff --git a/eeprom.c b/eeprom.c
-index eb532c7..4189525 100644
+index eb532c77..41895252 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -367,12 +367,16 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
@@ -86,13 +86,13 @@
  EXPORT_SYMBOL_GPL(mt76_get_rate_power_limits);
  
 diff --git a/mt76.h b/mt76.h
-index 13796ad..05c1874 100644
+index b4e34296..2f801de4 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1047,6 +1047,14 @@ struct mt76_power_limits {
+@@ -1030,6 +1030,14 @@ struct mt76_power_limits {
+ 	s8 ofdm[8];
  	s8 mcs[4][10];
  	s8 ru[7][12];
- 	s8 eht[16][16];
 +
 +	struct {
 +		s8 cck[4];
@@ -105,7 +105,7 @@
  
  struct mt76_ethtool_worker_info {
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index f181377..19a37b5 100644
+index f1813776..19a37b53 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -1019,7 +1019,7 @@ mt7915_rate_txpower_get(struct file *file, char __user *user_buf,
@@ -217,10 +217,10 @@
  				    mt7915_twt_stats);
  	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 7e33386..f65f0ec 100644
+index 4aee1268..10fade27 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3311,7 +3311,8 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3302,7 +3302,8 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  	int ret;
  	s8 txpower_sku[MT7915_SKU_RATE_NUM];
  
@@ -230,7 +230,7 @@
  	if (ret)
  		return ret;
  
-@@ -3353,51 +3354,106 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3344,51 +3345,106 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
  {
@@ -362,7 +362,7 @@
  	struct mt7915_dev *dev = phy->dev;
  	struct {
  		u8 format_id;
-@@ -3406,10 +3462,9 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
+@@ -3397,10 +3453,9 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
  		u8 _rsv;
  	} __packed req = {
  		.format_id = TX_POWER_LIMIT_INFO,
@@ -374,7 +374,7 @@
  	struct sk_buff *skb;
  	int ret, i;
  
-@@ -3419,9 +3474,15 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
+@@ -3410,9 +3465,15 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
  	if (ret)
  		return ret;
  
@@ -393,7 +393,7 @@
  
  	dev_kfree_skb(skb);
  
-@@ -3463,9 +3524,18 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+@@ -3454,9 +3515,18 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
  		.band_idx = phy->mt76->band_idx,
  		.sku_enable = enable,
  	};
@@ -413,7 +413,7 @@
  				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
  				 sizeof(req), true);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 5fc4e2e..142bfc1 100644
+index 5fc4e2ef..142bfc1f 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -502,12 +502,18 @@ enum {
@@ -436,7 +436,7 @@
  	SPR_ENABLE = 0x1,
  	SPR_ENABLE_SD = 0x3,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index a3d7b4b..4dc3825 100644
+index 851caa99..04cf2dc3 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -72,6 +72,7 @@
@@ -447,7 +447,7 @@
  
  #define MT7915_MAX_TWT_AGRT		16
  #define MT7915_MAX_STA_TWT_AGRT		8
-@@ -572,7 +573,8 @@ int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
+@@ -569,7 +570,8 @@ int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
  int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
  int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable);
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
@@ -458,5 +458,5 @@
  int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  				 struct ieee80211_vif *vif,
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1026-wifi-mt76-mt7915-amsdu-set-and-get-control.patch b/recipes-wifi/linux-mt76/files/patches/1026-wifi-mt76-mt7915-amsdu-set-and-get-control.patch
index 4dd0383..06e99af 100644
--- a/recipes-wifi/linux-mt76/files/patches/1026-wifi-mt76-mt7915-amsdu-set-and-get-control.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1026-wifi-mt76-mt7915-amsdu-set-and-get-control.patch
@@ -1,7 +1,7 @@
-From ff2283c46ffd78340efabfe1e614dfd69405bd6d Mon Sep 17 00:00:00 2001
+From 061bb8523b47ea25999e64469237fea3091097b8 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Wed, 14 Dec 2022 00:44:07 -0800
-Subject: [PATCH 1026/1040] wifi: mt76: mt7915: amsdu set and get control
+Subject: [PATCH 1026/1034] wifi: mt76: mt7915: amsdu set and get control
 
 ---
  mt7915/mac.c    |  7 +++++++
@@ -11,7 +11,7 @@
  4 files changed, 50 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 4244177..51073ab 100644
+index 1e0bee7b..fe2e2d65 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -2032,6 +2032,13 @@ static void mt7915_mac_sta_stats_work(struct mt7915_phy *phy)
@@ -29,10 +29,10 @@
  void mt7915_capi_sta_rc_work(void *data, struct ieee80211_sta *sta)
  {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 4dc3825..75967f9 100644
+index 04cf2dc3..b4727082 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -698,6 +698,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -695,6 +695,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
  #ifdef CONFIG_MTK_VENDOR
@@ -41,7 +41,7 @@
  void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif);
  void mt7915_mcu_set_rfeature_starec(void *data, struct mt7915_dev *dev,
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index b661ea4..0105d2f 100644
+index b661ea4e..0105d2f0 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -30,10 +30,16 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -105,7 +105,7 @@
  		.maxattr = MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX,
  	},
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index a6309a3..33c75dc 100644
+index a6309a32..33c75dc9 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -74,6 +74,7 @@ enum mtk_vendor_attr_wireless_ctrl {
@@ -135,5 +135,5 @@
  	MTK_VENDOR_ATTR_MU_CTRL_UNSPEC,
  
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1027-wifi-mt76-mt7915-Add-vendor-command-attribute-for-RT.patch b/recipes-wifi/linux-mt76/files/patches/1027-wifi-mt76-mt7915-Add-vendor-command-attribute-for-RT.patch
index cf5d9b7..9077694 100644
--- a/recipes-wifi/linux-mt76/files/patches/1027-wifi-mt76-mt7915-Add-vendor-command-attribute-for-RT.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1027-wifi-mt76-mt7915-Add-vendor-command-attribute-for-RT.patch
@@ -1,7 +1,7 @@
-From 7bf557aff6961e6d224f599b1be6068393c68bfc Mon Sep 17 00:00:00 2001
+From b3ecd93f877b8ec4577996607a5d884979062b48 Mon Sep 17 00:00:00 2001
 From: "himanshu.goyal" <himanshu.goyal@mediatek.com>
 Date: Tue, 24 Jan 2023 14:32:08 +0800
-Subject: [PATCH 1027/1040] wifi: mt76: mt7915: Add vendor command attribute
+Subject: [PATCH 1027/1034] wifi: mt76: mt7915: Add vendor command attribute
  for RTS BW signaling.
 
 Signed-off-by: himanshu.goyal <himanshu.goyal@mediatek.com>
@@ -13,10 +13,10 @@
  4 files changed, 20 insertions(+)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index f65f0ec..12ee063 100644
+index 10fade27..15915c97 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4612,6 +4612,12 @@ int mt7915_mcu_set_cfg(struct mt7915_phy *phy, u8 cfg_info, u8 type)
+@@ -4603,6 +4603,12 @@ int mt7915_mcu_set_cfg(struct mt7915_phy *phy, u8 cfg_info, u8 type)
  		req.cert.length = cpu_to_le16(tlv_len);
  		req.cert.cert_program = type;
  		break;
@@ -30,7 +30,7 @@
  		tlv_len = sizeof(struct three_wire_cfg);
  		req.three_wire.tag = cpu_to_le16(cfg_info);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 142bfc1..286f7a5 100644
+index 142bfc1f..286f7a59 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -924,6 +924,13 @@ struct three_wire_cfg {
@@ -62,7 +62,7 @@
  };
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 0105d2f..fb2fe82 100644
+index 0105d2f0..fb2fe829 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -33,6 +33,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -84,7 +84,7 @@
  
  	return 0;
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 33c75dc..6001ce4 100644
+index 33c75dc9..6001ce4a 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -76,6 +76,7 @@ enum mtk_vendor_attr_wireless_ctrl {
@@ -96,5 +96,5 @@
  	MTK_VENDOR_ATTR_WIRELESS_CTRL_MU_EDCA, /* reserve */
  	/* keep last */
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1028-wifi-mt76-mt7915-add-vendor-cmd-to-get-available-col.patch b/recipes-wifi/linux-mt76/files/patches/1028-wifi-mt76-mt7915-add-vendor-cmd-to-get-available-col.patch
index 2dd5226..96e5f45 100644
--- a/recipes-wifi/linux-mt76/files/patches/1028-wifi-mt76-mt7915-add-vendor-cmd-to-get-available-col.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1028-wifi-mt76-mt7915-add-vendor-cmd-to-get-available-col.patch
@@ -1,7 +1,7 @@
-From cbfad5aeabda8196ffa1e21f23ebdeb3864b9860 Mon Sep 17 00:00:00 2001
+From 60bfaa45b94737dd895da224677411beceef97bc Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Thu, 26 Jan 2023 08:50:47 +0800
-Subject: [PATCH 1028/1040] wifi: mt76: mt7915: add vendor cmd to get available
+Subject: [PATCH 1028/1034] wifi: mt76: mt7915: add vendor cmd to get available
  color bitmap
 
 Add a vendor cmd to notify user space available color bitmap.
@@ -14,7 +14,7 @@
  2 files changed, 48 insertions(+)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index fb2fe82..94c4aad 100644
+index fb2fe829..94c4aad5 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -98,6 +98,11 @@ ibf_ctrl_policy[NUM_MTK_VENDOR_ATTRS_IBF_CTRL] = {
@@ -76,7 +76,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 6001ce4..358a16f 100644
+index 6001ce4a..358a16f2 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -14,6 +14,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -103,5 +103,5 @@
 +};
  #endif
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1029-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch b/recipes-wifi/linux-mt76/files/patches/1029-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch
index 1e0c6d6..1829e95 100644
--- a/recipes-wifi/linux-mt76/files/patches/1029-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1029-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch
@@ -1,7 +1,7 @@
-From 9720802e9abc886c7676d3994e3735aa440ed78e Mon Sep 17 00:00:00 2001
+From 99a9068d0e73d70b9587febcb6763882eecc0fba Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 24 Feb 2023 16:29:42 +0800
-Subject: [PATCH 1029/1040] wifi: mt76: mt7915: disable SW-ACI by default
+Subject: [PATCH 1029/1034] wifi: mt76: mt7915: disable SW-ACI by default
 
 Support to enable/disable SW-ACI by module parameter "sw_aci_enable".
 SW-ACI feature is disable by default.
@@ -13,7 +13,7 @@
  4 files changed, 29 insertions(+), 9 deletions(-)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 287ca99..5b4581c 100644
+index 85524e91..9011d69b 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -8,6 +8,10 @@
@@ -39,10 +39,10 @@
  
  	if (phy != &dev->phy) {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 12ee063..fe00519 100644
+index 15915c97..a542031b 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4972,3 +4972,18 @@ int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value)
+@@ -4963,3 +4963,18 @@ int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value)
  
  	return 0;
  }
@@ -62,10 +62,10 @@
 +				 sizeof(req), NULL);
 +}
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 75967f9..722f3bc 100644
+index b4727082..38486776 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -722,6 +722,7 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+@@ -719,6 +719,7 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  #endif
  int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value, s8 compensation);
  int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
@@ -74,10 +74,10 @@
  int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
  
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index ef5d581..80b7bc1 100644
+index 48e2edcf..55c54436 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -3645,16 +3645,12 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
+@@ -3647,16 +3647,12 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
  static int
  mt7915_sw_aci_set(void *data, u64 val)
  {
@@ -100,5 +100,5 @@
  
  
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1030-wifi-mt76-mt7915-add-muru-user-number-debug-command.patch b/recipes-wifi/linux-mt76/files/patches/1030-wifi-mt76-mt7915-add-muru-user-number-debug-command.patch
index 3503c08..2bab8a5 100644
--- a/recipes-wifi/linux-mt76/files/patches/1030-wifi-mt76-mt7915-add-muru-user-number-debug-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1030-wifi-mt76-mt7915-add-muru-user-number-debug-command.patch
@@ -1,7 +1,7 @@
-From babeb3948faef2769f838dd35050eb71c7194175 Mon Sep 17 00:00:00 2001
+From 6c3d6f5f7af8213f2262c19b18de9973f157f99a Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Thu, 27 Apr 2023 15:37:33 +0800
-Subject: [PATCH 1030/1040] wifi: mt76: mt7915: add muru user number debug
+Subject: [PATCH 1030/1034] wifi: mt76: mt7915: add muru user number debug
  command
 
 ---
@@ -11,10 +11,10 @@
  3 files changed, 17 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 722f3bc..9f62e5e 100644
+index 38486776..4c0e1ac1 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -586,6 +586,7 @@ int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
+@@ -583,6 +583,7 @@ int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
  int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
  			    const struct mt7915_dfs_pattern *pattern);
  int mt7915_mcu_set_muru_ctrl(struct mt7915_dev *dev, u32 cmd, u32 val);
@@ -23,7 +23,7 @@
  int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy);
  int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch);
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 94c4aad..b450808 100644
+index 94c4aad5..b4508088 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -45,6 +45,8 @@ static const struct nla_policy
@@ -65,7 +65,7 @@
  
  	return 0;
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 358a16f..20526ea 100644
+index 358a16f2..20526eae 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -102,6 +102,8 @@ enum mtk_vendor_attr_mu_ctrl {
@@ -78,5 +78,5 @@
  	/* keep last */
  	NUM_MTK_VENDOR_ATTRS_MU_CTRL,
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1031-wifi-mt76-mt7915-add-debugfs-for-fw-coredump.patch b/recipes-wifi/linux-mt76/files/patches/1031-wifi-mt76-mt7915-add-debugfs-for-fw-coredump.patch
index a194c24..d3f44b3 100644
--- a/recipes-wifi/linux-mt76/files/patches/1031-wifi-mt76-mt7915-add-debugfs-for-fw-coredump.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1031-wifi-mt76-mt7915-add-debugfs-for-fw-coredump.patch
@@ -1,7 +1,7 @@
-From 0b6b1f1ab13a801b23459161251b54ee94e41562 Mon Sep 17 00:00:00 2001
+From 5d876ac0a3bcd35368d35122d63d7d35b62822fe Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 22 May 2023 15:30:21 +0800
-Subject: [PATCH 1031/1040] wifi: mt76: mt7915: add debugfs for fw coredump.
+Subject: [PATCH 1031/1034] wifi: mt76: mt7915: add debugfs for fw coredump.
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
@@ -12,7 +12,7 @@
  4 files changed, 58 insertions(+), 9 deletions(-)
 
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 19a37b5..ae291a3 100644
+index 19a37b53..ae291a3f 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -82,8 +82,10 @@ mt7915_sys_recovery_set(struct file *file, const char __user *user_buf,
@@ -67,7 +67,7 @@
  	/* SER statistics */
  	desc += scnprintf(buff + desc, bufsz - desc,
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 51073ab..e4f46e0 100644
+index fe2e2d65..21e8383a 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -1725,10 +1725,34 @@ void mt7915_mac_dump_work(struct work_struct *work)
@@ -117,7 +117,7 @@
  	}
  
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 286f7a5..583caca 100644
+index 286f7a59..583caca7 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -745,8 +745,12 @@ enum {
@@ -135,7 +135,7 @@
  	SER_ENABLE = 2,
  	SER_RECOVER
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 9f62e5e..16f2661 100644
+index 4c0e1ac1..d8a321b6 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -91,6 +91,13 @@ struct mt7915_sta;
@@ -160,7 +160,7 @@
  #ifdef CONFIG_DEV_COREDUMP
  	struct {
  		struct mt7915_crash_data *crash_data[__MT76_RAM_TYPE_MAX];
-@@ -524,6 +532,7 @@ int mt7915_txbf_init(struct mt7915_dev *dev);
+@@ -521,6 +529,7 @@ int mt7915_txbf_init(struct mt7915_dev *dev);
  void mt7915_init_txpower(struct mt7915_phy *phy);
  int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_en);
  void mt7915_reset(struct mt7915_dev *dev);
@@ -169,5 +169,5 @@
  int mt7915_mcu_init(struct mt7915_dev *dev);
  int mt7915_mcu_init_firmware(struct mt7915_dev *dev);
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1032-wifi-mt76-mt7915-remove-BW160-support.patch b/recipes-wifi/linux-mt76/files/patches/1032-wifi-mt76-mt7915-remove-BW160-support.patch
index cad5964..9e96c1e 100644
--- a/recipes-wifi/linux-mt76/files/patches/1032-wifi-mt76-mt7915-remove-BW160-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1032-wifi-mt76-mt7915-remove-BW160-support.patch
@@ -1,7 +1,7 @@
-From 45e1cac480f32d75ec7f13389594768eb471ca66 Mon Sep 17 00:00:00 2001
+From c89f91b82e1b1516ee6c6bd150c6c0dda29de573 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 24 May 2023 22:35:54 +0800
-Subject: [PATCH 1032/1040] wifi: mt76: mt7915: remove BW160 support
+Subject: [PATCH 1032/1034] wifi: mt76: mt7915: remove BW160 support
 
 Remove BW160 capability in mt7915.
 ---
@@ -9,10 +9,10 @@
  1 file changed, 6 insertions(+), 20 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index d908a58..a942bc2 100644
+index 6d1c0f71..ac61febb 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -431,11 +431,6 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
+@@ -434,11 +434,6 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
  			vht_cap->cap |=
  				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991 |
  				IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
@@ -24,7 +24,7 @@
  		} else {
  			phy->mt76->sband_5g.sband.ht_cap.ampdu_density =
  				IEEE80211_HT_MPDU_DENSITY_2;
-@@ -891,13 +886,9 @@ mt7915_set_stream_he_txbf_caps(struct mt7915_phy *phy,
+@@ -896,13 +891,9 @@ mt7915_set_stream_he_txbf_caps(struct mt7915_phy *phy,
  	int sts = hweight8(phy->mt76->chainmask);
  	u8 c, sts_160 = sts;
  
@@ -41,7 +41,7 @@
  
  #ifdef CONFIG_MAC80211_MESH
  	if (vif == NL80211_IFTYPE_MESH_POINT)
-@@ -977,15 +968,10 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
+@@ -982,15 +973,10 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
  	int i, idx = 0, nss = hweight8(phy->mt76->antenna_mask);
  	u16 mcs_map = 0;
  	u16 mcs_map_160 = 0;
@@ -61,5 +61,5 @@
  
  	for (i = 0; i < 8; i++) {
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1033-wifi-mt76-mt7915-add-txpower-info-dump-support.patch b/recipes-wifi/linux-mt76/files/patches/1033-wifi-mt76-mt7915-add-txpower-info-dump-support.patch
index 78dba54..f59ad29 100644
--- a/recipes-wifi/linux-mt76/files/patches/1033-wifi-mt76-mt7915-add-txpower-info-dump-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1033-wifi-mt76-mt7915-add-txpower-info-dump-support.patch
@@ -1,7 +1,7 @@
-From a8a300579541b1e29f498d887e4711c481af1809 Mon Sep 17 00:00:00 2001
+From f2174e027d82494ec89c81d896f9b13284f1add8 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Tue, 11 Jul 2023 17:06:04 +0800
-Subject: [PATCH 1033/1040] wifi: mt76: mt7915: add txpower info dump support
+Subject: [PATCH 1033/1034] wifi: mt76: mt7915: add txpower info dump support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -11,7 +11,7 @@
  3 files changed, 91 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index ae291a3..2bf907c 100644
+index ae291a3f..2bf907c0 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -1258,6 +1258,91 @@ mt7915_txpower_path_show(struct seq_file *file, void *data)
@@ -116,10 +116,10 @@
  				    mt7915_twt_stats);
  	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index fe00519..344ba85 100644
+index a542031b..d2e3e82b 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3482,6 +3482,8 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
+@@ -3473,6 +3473,8 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
  			txpower[i] = res[i][req.band_idx];
  	} else if (category == TX_POWER_INFO_PATH) {
  		memcpy(txpower, skb->data + 4, len);
@@ -129,7 +129,7 @@
  
  	dev_kfree_skb(skb);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 583caca..6e6f320 100644
+index 583caca7..6e6f320b 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -510,7 +510,8 @@ enum {
@@ -143,5 +143,5 @@
  };
  
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1034-wifi-mt76-mt7915-report-tx-and-rx-byte-to-tpt_led-wh.patch b/recipes-wifi/linux-mt76/files/patches/1034-wifi-mt76-mt7915-report-tx-and-rx-byte-to-tpt_led-wh.patch
index d987346..197a473 100644
--- a/recipes-wifi/linux-mt76/files/patches/1034-wifi-mt76-mt7915-report-tx-and-rx-byte-to-tpt_led-wh.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1034-wifi-mt76-mt7915-report-tx-and-rx-byte-to-tpt_led-wh.patch
@@ -1,7 +1,7 @@
-From 1118417f6ad1e37fe5031701522f1287dfd38491 Mon Sep 17 00:00:00 2001
+From a6806476cc67d25ab77a3b0aef4fbc4870f12cbe Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Fri, 23 Jun 2023 06:06:21 +0800
-Subject: [PATCH 1034/1040] wifi: mt76: mt7915: report tx and rx byte to
+Subject: [PATCH 1034/1034] wifi: mt76: mt7915: report tx and rx byte to
  tpt_led when wed is enabled
 
 Signed-off-by: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
@@ -11,10 +11,10 @@
  2 files changed, 11 insertions(+), 4 deletions(-)
 
 diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index e26fcf8..c2f31bf 100644
+index ee5177fd..ff3cefad 100644
 --- a/mt76_connac_mac.c
 +++ b/mt76_connac_mac.c
-@@ -596,9 +596,15 @@ bool mt76_connac2_mac_fill_txs(struct mt76_dev *dev, struct mt76_wcid *wcid,
+@@ -608,9 +608,15 @@ bool mt76_connac2_mac_fill_txs(struct mt76_dev *dev, struct mt76_wcid *wcid,
  
  	txs = le32_to_cpu(txs_data[0]);
  
@@ -30,7 +30,7 @@
  		stats->tx_bytes +=
  			le32_get_bits(txs_data[5], MT_TXS5_MPDU_TX_BYTE) -
  			le32_get_bits(txs_data[7], MT_TXS7_MPDU_RETRY_BYTE);
-@@ -639,10 +645,6 @@ bool mt76_connac2_mac_fill_txs(struct mt76_dev *dev, struct mt76_wcid *wcid,
+@@ -651,10 +657,6 @@ bool mt76_connac2_mac_fill_txs(struct mt76_dev *dev, struct mt76_wcid *wcid,
  		cck = true;
  		fallthrough;
  	case MT_PHY_TYPE_OFDM:
@@ -42,10 +42,10 @@
  			sband = &mphy->sband_5g.sband;
  		else if (mphy->chandef.chan->band == NL80211_BAND_6GHZ)
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 6dd6eca..b47bfff 100644
+index 25c3fe2b..57dfda3a 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -704,6 +704,7 @@ static void mt7915_mmio_wed_update_rx_stats(struct mtk_wed_device *wed,
+@@ -666,6 +666,7 @@ static void mt7915_mmio_wed_update_rx_stats(struct mtk_wed_device *wed,
  	int idx = le16_to_cpu(stats->wlan_idx);
  	struct mt7915_dev *dev;
  	struct mt76_wcid *wcid;
@@ -53,7 +53,7 @@
  
  	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
  
-@@ -714,6 +715,10 @@ static void mt7915_mmio_wed_update_rx_stats(struct mtk_wed_device *wed,
+@@ -676,6 +677,10 @@ static void mt7915_mmio_wed_update_rx_stats(struct mtk_wed_device *wed,
  
  	wcid = rcu_dereference(dev->mt76.wcid[idx]);
  	if (wcid) {
@@ -65,5 +65,5 @@
  		wcid->stats.rx_packets += le32_to_cpu(stats->rx_pkt_cnt);
  		wcid->stats.rx_errors += le32_to_cpu(stats->rx_err_cnt);
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1035-wifi-mt76-mt7915-Establish-BA-in-VO-queue.patch b/recipes-wifi/linux-mt76/files/patches/1035-wifi-mt76-mt7915-Establish-BA-in-VO-queue.patch
index 8de22b4..a6eb593 100644
--- a/recipes-wifi/linux-mt76/files/patches/1035-wifi-mt76-mt7915-Establish-BA-in-VO-queue.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1035-wifi-mt76-mt7915-Establish-BA-in-VO-queue.patch
@@ -1,17 +1,17 @@
-From 170d9117dbf1f31f9a5ccc1f5824c547b6209533 Mon Sep 17 00:00:00 2001
+From faa6a52a5f0429d401b7615cc34734c6f5b8fe01 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 8 Aug 2023 11:20:58 +0800
-Subject: [PATCH 1035/1040] wifi: mt76: mt7915: Establish BA in VO queue
+Subject: [PATCH] wifi: mt76: mt7915: Establish BA in VO queue
 
 ---
  mt76_connac_mac.c | 2 --
  1 file changed, 2 deletions(-)
 
 diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index c2f31bf..02d5232 100644
+index ff3cefa..b87b733 100644
 --- a/mt76_connac_mac.c
 +++ b/mt76_connac_mac.c
-@@ -1114,8 +1114,6 @@ void mt76_connac2_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
+@@ -1126,8 +1126,6 @@ void mt76_connac2_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  		return;
  
  	tid = le32_get_bits(txwi[1], MT_TXD1_TID);
@@ -21,5 +21,5 @@
  	val = le32_to_cpu(txwi[2]);
  	fc = FIELD_GET(MT_TXD2_FRAME_TYPE, val) << 2 |
 -- 
-2.18.0
+2.39.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1036-wifi-mt76-mt7915-Disable-RegDB-when-enable-single-sk.patch b/recipes-wifi/linux-mt76/files/patches/1036-wifi-mt76-mt7915-Disable-RegDB-when-enable-single-sk.patch
index 47b364d..2ce9ef0 100644
--- a/recipes-wifi/linux-mt76/files/patches/1036-wifi-mt76-mt7915-Disable-RegDB-when-enable-single-sk.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1036-wifi-mt76-mt7915-Disable-RegDB-when-enable-single-sk.patch
@@ -1,16 +1,15 @@
-From c499d09d496d723dab109aee2e3af8a28278a54c Mon Sep 17 00:00:00 2001
+From 4cb59dc3fc13de7cfb32800927cb586036f9ec7b Mon Sep 17 00:00:00 2001
 From: "Allen.Ye" <allen.ye@mediatek.com>
 Date: Fri, 11 Aug 2023 16:46:53 +0800
-Subject: [PATCH 1036/1040] wifi: mt76: mt7915: Disable RegDB when enable
+Subject: [PATCH 1035/1035] wifi: mt76: mt7915: Disable RegDB when enable
  single sku
 
 ---
  eeprom.c         |  3 ++-
  mt76.h           |  3 +++
- mt7915/debugfs.c | 49 +++++++++++++++++++++++++++++++++++++++++++-----
+ mt7915/debugfs.c | 43 +++++++++++++++++++++++++++++++++++++++++--
  mt7915/init.c    |  9 ++++++++-
- mt7915/regs.h    |  8 ++++----
- 5 files changed, 61 insertions(+), 11 deletions(-)
+ 4 files changed, 54 insertions(+), 4 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
 index 4189525..38b0a58 100644
@@ -34,10 +33,10 @@
  static const __be32 *
  mt76_get_of_array(struct device_node *np, char *name, size_t *len, int min)
 diff --git a/mt76.h b/mt76.h
-index 05c1874..91da8c5 100644
+index 2f801de..aece4ec 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1673,6 +1673,9 @@ mt76_mcu_skb_send_msg(struct mt76_dev *dev, struct sk_buff *skb, int cmd,
+@@ -1655,6 +1655,9 @@ mt76_mcu_skb_send_msg(struct mt76_dev *dev, struct sk_buff *skb, int cmd,
  
  void mt76_set_irq_mask(struct mt76_dev *dev, u32 addr, u32 clear, u32 set);
  
@@ -48,7 +47,7 @@
  			      struct ieee80211_channel *chan,
  			      struct mt76_power_limits *dest,
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 2bf907c..6dcee10 100644
+index 2bf907c..bb312ee 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -1019,10 +1019,16 @@ mt7915_rate_txpower_get(struct file *file, char __user *user_buf,
@@ -69,20 +68,14 @@
  	ssize_t ret;
  	char *buf;
  	u32 reg;
-@@ -1081,11 +1087,38 @@ mt7915_rate_txpower_get(struct file *file, char __user *user_buf,
- 	len += scnprintf(buf + len, sz - len, "BW160/");
- 	mt7915_txpower_puts(HE_RU2x996, 17);
- 
--	reg = is_mt7915(&dev->mt76) ? MT_WF_PHY_TPC_CTRL_STAT(band) :
--	      MT_WF_PHY_TPC_CTRL_STAT_MT7916(band);
-+	reg = is_mt7915(&dev->mt76) ? MT_WF_IRPI_TPC_CTRL_STAT(band) :
-+	      MT_WF_IRPI_TPC_CTRL_STAT_MT7916(band);
+@@ -1084,9 +1090,36 @@ mt7915_rate_txpower_get(struct file *file, char __user *user_buf,
+ 	reg = is_mt7915(&dev->mt76) ? MT_WF_PHY_TPC_CTRL_STAT(band) :
+ 	      MT_WF_PHY_TPC_CTRL_STAT_MT7916(band);
  
 -	len += scnprintf(buf + len, sz - len, "\nTx power (bbp)  : %6ld\n",
--			 mt76_get_field(dev, reg, MT_WF_PHY_TPC_POWER));
 +	len += scnprintf(buf + len, sz - len, "\nTx power (bbp)  : %6ld [0.5 dBm]\n",
-+			 mt76_get_field(dev, reg, MT_WF_IRPI_TPC_POWER));
-+
+ 			 mt76_get_field(dev, reg, MT_WF_PHY_TPC_POWER));
+ 
 +	len += scnprintf(buf + len, sz - len, "RegDB maximum power:\t%d [dBm]\n",
 +			 chan->max_reg_power);
 +
@@ -109,9 +102,10 @@
 +
 +	len += scnprintf(buf + len, sz - len, "nss_delta:\t%d [0.5 dBm]\n",
 +			 nss_delta);
- 
++
  	ret = simple_read_from_buffer(user_buf, count, ppos, buf, len);
  
+ out:
 @@ -1262,6 +1295,8 @@ static int
  mt7915_txpower_info_show(struct seq_file *file, void *data)
  {
@@ -140,10 +134,10 @@
  	return ret;
  }
 diff --git a/mt7915/init.c b/mt7915/init.c
-index a942bc2..82fe443 100644
+index f8ecaf3..623b070 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -283,7 +283,9 @@ void __mt7915_init_txpower(struct mt7915_phy *phy,
+@@ -286,7 +286,9 @@ void __mt7915_init_txpower(struct mt7915_phy *phy,
  	int nss_delta = mt76_tx_power_nss_delta(n_chains);
  	int pwr_delta = mt7915_eeprom_get_power_delta(dev, sband->band);
  	struct mt76_power_limits limits;
@@ -153,7 +147,7 @@
  	for (i = 0; i < sband->n_channels; i++) {
  		struct ieee80211_channel *chan = &sband->channels[i];
  		u32 target_power = 0;
-@@ -302,8 +304,13 @@ void __mt7915_init_txpower(struct mt7915_phy *phy,
+@@ -305,8 +307,13 @@ void __mt7915_init_txpower(struct mt7915_phy *phy,
  							  target_power);
  		target_power += nss_delta;
  		target_power = DIV_ROUND_UP(target_power, 2);
@@ -168,32 +162,6 @@
  		chan->orig_mpwr = target_power;
  	}
  }
-diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 1f1f8b9..3c2fd2d 100644
---- a/mt7915/regs.h
-+++ b/mt7915/regs.h
-@@ -1213,6 +1213,10 @@ enum offs_rev {
- #define MT_WF_IRPI_NSS(phy, nss)	MT_WF_IRPI(0x6000 + ((phy) << 20) + ((nss) << 16))
- #define MT_WF_IRPI_NSS_MT7916(phy, nss)	MT_WF_IRPI(0x1000 + ((phy) << 20) + ((nss) << 16))
- 
-+#define MT_WF_IRPI_TPC_CTRL_STAT(_phy)		MT_WF_IRPI(0xc794 + ((_phy) << 16))
-+#define MT_WF_IRPI_TPC_CTRL_STAT_MT7916(_phy)	MT_WF_IRPI(0xc794 + ((_phy) << 20))
-+#define MT_WF_IRPI_TPC_POWER			GENMASK(31, 24)
-+
- #define MT_WF_IPI_RESET			0x831a3008
- 
- /* PHY */
-@@ -1229,10 +1233,6 @@ enum offs_rev {
- #define MT_WF_PHY_RXTD12_IRPI_SW_CLR_ONLY	BIT(18)
- #define MT_WF_PHY_RXTD12_IRPI_SW_CLR		BIT(29)
- 
--#define MT_WF_PHY_TPC_CTRL_STAT(_phy)		MT_WF_PHY(0xe7a0 + ((_phy) << 16))
--#define MT_WF_PHY_TPC_CTRL_STAT_MT7916(_phy)	MT_WF_PHY(0xe7a0 + ((_phy) << 20))
--#define MT_WF_PHY_TPC_POWER			GENMASK(15, 8)
--
- #define MT_MCU_WM_CIRQ_BASE			0x89010000
- #define MT_MCU_WM_CIRQ(ofs)			(MT_MCU_WM_CIRQ_BASE + (ofs))
- #define MT_MCU_WM_CIRQ_IRQ_MASK_CLR_ADDR	MT_MCU_WM_CIRQ(0x80)
 -- 
 2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1037-wifi-mt76-mt7915-enable-the-mac80211-hw-bmc-ps-buffe.patch b/recipes-wifi/linux-mt76/files/patches/1037-wifi-mt76-mt7915-enable-the-mac80211-hw-bmc-ps-buffe.patch
index 0258ff1..776c24d 100644
--- a/recipes-wifi/linux-mt76/files/patches/1037-wifi-mt76-mt7915-enable-the-mac80211-hw-bmc-ps-buffe.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1037-wifi-mt76-mt7915-enable-the-mac80211-hw-bmc-ps-buffe.patch
@@ -1,7 +1,7 @@
-From d7300215f0c2ca425ee97339618051a5e810608d Mon Sep 17 00:00:00 2001
+From dda8d4eb5890b402eec2ace7b4e05f4f45fa416c Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Thu, 24 Aug 2023 03:01:27 +0800
-Subject: [PATCH 1037/1040] wifi: mt76: mt7915: enable the mac80211 hw bmc ps
+Subject: [PATCH 01/11] wifi: mt76: mt7915: enable the mac80211 hw bmc ps
  buffer function.
 
 ---
@@ -9,10 +9,10 @@
  1 file changed, 1 insertion(+)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 82fe443..36621ad 100644
+index 623b070..be6eb54 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -405,6 +405,7 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
+@@ -408,6 +408,7 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
  	ieee80211_hw_set(hw, SUPPORTS_RX_DECAP_OFFLOAD);
  	ieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);
  	ieee80211_hw_set(hw, WANT_MONITOR_VIF);
diff --git a/recipes-wifi/linux-mt76/files/patches/1038-wifi-mt76-update-debugfs-knob-to-dump-token-pending-.patch b/recipes-wifi/linux-mt76/files/patches/1038-wifi-mt76-update-debugfs-knob-to-dump-token-pending-.patch
index ebaf572..e05e710 100644
--- a/recipes-wifi/linux-mt76/files/patches/1038-wifi-mt76-update-debugfs-knob-to-dump-token-pending-.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1038-wifi-mt76-update-debugfs-knob-to-dump-token-pending-.patch
@@ -1,8 +1,7 @@
-From e4019ba63d7bb60ac0b56618e3fd9421c97ce474 Mon Sep 17 00:00:00 2001
+From 47058b5552a9597c2dad3e45b3d0396a5b69dfd7 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Tue, 29 Aug 2023 09:22:18 +0800
-Subject: [PATCH 1038/1040] wifi: mt76: update debugfs knob to dump token
- pending time
+Subject: [PATCH] wifi: mt76: update debugfs knob to dump token pending time
 
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
@@ -12,10 +11,10 @@
  3 files changed, 10 insertions(+), 4 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 91da8c5..ad1402a 100644
+index aece4eca..9237b22e 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -368,6 +368,8 @@ struct mt76_txwi_cache {
+@@ -365,6 +365,8 @@ struct mt76_txwi_cache {
  	struct list_head list;
  	dma_addr_t dma_addr;
  
@@ -25,7 +24,7 @@
  		struct sk_buff *skb;
  		void *ptr;
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index e4f46e0..817763a 100644
+index 21e8383a..67b42006 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -802,6 +802,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
@@ -56,7 +55,7 @@
  	}
  
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 80b7bc1..46f1b0b 100644
+index 80b7bc1a..46f1b0b6 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2211,10 +2211,8 @@ static int mt7915_token_read(struct seq_file *s, void *data)
diff --git a/recipes-wifi/linux-mt76/files/patches/1039-wifi-mt76-mt7915-support-enable-disable-spatial-reus.patch b/recipes-wifi/linux-mt76/files/patches/1039-wifi-mt76-mt7915-support-enable-disable-spatial-reus.patch
index 5b0a6bc..646fb60 100644
--- a/recipes-wifi/linux-mt76/files/patches/1039-wifi-mt76-mt7915-support-enable-disable-spatial-reus.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1039-wifi-mt76-mt7915-support-enable-disable-spatial-reus.patch
@@ -1,8 +1,8 @@
-From ac7a0356360173149824d63e9f5803adb7c94ae4 Mon Sep 17 00:00:00 2001
+From f8b4b17a84bf10198c67434b246de4a05e3e54dd Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 5 Sep 2023 20:17:19 +0800
-Subject: [PATCH 1039/1040] wifi: mt76: mt7915: support enable/disable spatial
- reuse through debugfs
+Subject: [PATCH] wifi: mt76: mt7915: support enable/disable spatial reuse
+ through debugfs
 
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
 ---
@@ -12,10 +12,10 @@
  3 files changed, 14 insertions(+), 2 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 344ba85..cd4f472 100644
+index f6ba2d5..e8e563e 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3609,8 +3609,7 @@ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
+@@ -3607,8 +3607,7 @@ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
  				 sizeof(req), true);
  }
  
@@ -26,10 +26,10 @@
  	struct mt7915_dev *dev = phy->dev;
  	struct mt7915_mcu_sr_ctrl req = {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 16f2661..72d6cc0 100644
+index 1c2f113..12049d1 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -735,6 +735,7 @@ int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
+@@ -733,6 +733,7 @@ int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
  int mt7915_mcu_sw_aci_set(struct mt7915_dev *dev, bool val);
  int mt7915_mcu_ipi_hist_ctrl(struct mt7915_phy *phy, void *data, u8 cmd, bool wait_resp);
  int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
diff --git a/recipes-wifi/linux-mt76/files/patches/1040-wifi-mt76-mt7915-add-debug-log-for-SER-flow.patch b/recipes-wifi/linux-mt76/files/patches/1040-wifi-mt76-mt7915-add-debug-log-for-SER-flow.patch
deleted file mode 100644
index 378596d..0000000
--- a/recipes-wifi/linux-mt76/files/patches/1040-wifi-mt76-mt7915-add-debug-log-for-SER-flow.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From b010edba440f66a02eb9b72fb55831befb60107f Mon Sep 17 00:00:00 2001
-From: Bo Jiao <Bo.Jiao@mediatek.com>
-Date: Mon, 11 Sep 2023 17:11:24 +0800
-Subject: [PATCH 1040/1040] wifi: mt76: mt7915: add debug log for SER flow.
-
-Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
----
- mt7915/mac.c | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 817763a..e51440d 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -1570,6 +1570,9 @@ void mt7915_mac_reset_work(struct work_struct *work)
- 	if (!(READ_ONCE(dev->recovery.state) & MT_MCU_CMD_STOP_DMA))
- 		return;
- 
-+	dev_info(dev->mt76.dev,"\n%s L1 SER recovery start.",
-+		 wiphy_name(dev->mt76.hw->wiphy));
-+
- 	if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
- 		mtk_wed_device_stop(&dev->mt76.mmio.wed);
- 		if (!is_mt798x(&dev->mt76))
-@@ -1648,6 +1651,9 @@ void mt7915_mac_reset_work(struct work_struct *work)
- 		ieee80211_queue_delayed_work(ext_phy->hw,
- 					     &phy2->mt76->mac_work,
- 					     MT7915_WATCHDOG_TIME);
-+
-+	dev_info(dev->mt76.dev,"\n%s L1 SER recovery completed.",
-+		 wiphy_name(dev->mt76.hw->wiphy));
- }
- 
- /* firmware coredump */
-@@ -1763,6 +1769,9 @@ void mt7915_coredump(struct mt7915_dev *dev, u8 state)
- 
- void mt7915_reset(struct mt7915_dev *dev)
- {
-+	dev_info(dev->mt76.dev, "%s SER recovery state: 0x%08x\n",
-+		 wiphy_name(dev->mt76.hw->wiphy), READ_ONCE(dev->recovery.state));
-+
- 	if (!dev->recovery.hw_init_done)
- 		return;
- 
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/1041-wifi-mt76-mt7915-add-additional-chain-signal-info-to.patch b/recipes-wifi/linux-mt76/files/patches/1041-wifi-mt76-mt7915-add-additional-chain-signal-info-to.patch
deleted file mode 100644
index 705bd74..0000000
--- a/recipes-wifi/linux-mt76/files/patches/1041-wifi-mt76-mt7915-add-additional-chain-signal-info-to.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 134bea3d6ba955e2dcccad2b2af144e163d4b2c1 Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Wed, 20 Sep 2023 11:10:57 +0800
-Subject: [PATCH] wifi: mt76: mt7915: add additional chain signal info to
- station dump
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- mt7915/mac.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index ec0de9b..b696f02 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -435,7 +435,7 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
- 		if (v0 & MT_PRXV_HT_AD_CODE)
- 			status->enc_flags |= RX_ENC_FLAG_LDPC;
- 
--		status->chains = mphy->antenna_mask;
-+		status->chains = mphy->chainmask >> (status->phy_idx * dev->chainshift);
- 		status->chain_signal[0] = to_rssi(MT_PRXV_RCPI0, v1);
- 		status->chain_signal[1] = to_rssi(MT_PRXV_RCPI1, v1);
- 		status->chain_signal[2] = to_rssi(MT_PRXV_RCPI2, v1);
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/2000-wifi-mt76-mt7915-wed-add-wed-tx-support.patch b/recipes-wifi/linux-mt76/files/patches/2000-wifi-mt76-mt7915-wed-add-wed-tx-support.patch
index 4a0e51b..fa412b8 100644
--- a/recipes-wifi/linux-mt76/files/patches/2000-wifi-mt76-mt7915-wed-add-wed-tx-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2000-wifi-mt76-mt7915-wed-add-wed-tx-support.patch
@@ -1,7 +1,7 @@
-From 9ea9f8159f6d14dd41c65bf437cde772efcbb8ea Mon Sep 17 00:00:00 2001
+From 5874aad8bb03d3e8d568dca2f0df74b2591eaf55 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 10:38:53 +0800
-Subject: [PATCH 2000/2011] wifi: mt76: mt7915: wed: add wed tx support
+Subject: [PATCH] wifi: mt76: mt7915: wed: add wed tx support
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -13,7 +13,7 @@
  5 files changed, 14 insertions(+), 8 deletions(-)
 
 diff --git a/mt76_connac.h b/mt76_connac.h
-index 6f5cf18..76f9555 100644
+index 4560ab79..431e4d79 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -130,6 +130,7 @@ struct mt76_connac_sta_key_conf {
@@ -25,7 +25,7 @@
  struct mt76_connac_fw_txp {
  	__le16 flags;
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index e51440d..3c6b308 100644
+index 67b42006..94cfab61 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -869,9 +869,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
@@ -68,10 +68,10 @@
  
  static void
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 5b4581c..7274b5d 100644
+index 6b3b9e06..0032f463 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1685,14 +1685,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1673,14 +1673,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	if (!mtk_wed_device_active(wed))
  		return -ENODEV;
  
@@ -89,7 +89,7 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index b47bfff..cae8b81 100644
+index b47bfffc..cae8b810 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -13,7 +13,7 @@
@@ -119,7 +119,7 @@
  	ret = dma_set_mask(wed->dev, DMA_BIT_MASK(32));
  	if (ret)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 72d6cc0..af9e3ae 100644
+index 1c2f1132..dded050a 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -62,7 +62,7 @@
diff --git a/recipes-wifi/linux-mt76/files/patches/2001-wifi-mt76-mt7915-wed-add-wds-support-when-wed-is-ena.patch b/recipes-wifi/linux-mt76/files/patches/2001-wifi-mt76-mt7915-wed-add-wds-support-when-wed-is-ena.patch
index da1686e..a288041 100644
--- a/recipes-wifi/linux-mt76/files/patches/2001-wifi-mt76-mt7915-wed-add-wds-support-when-wed-is-ena.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2001-wifi-mt76-mt7915-wed-add-wds-support-when-wed-is-ena.patch
@@ -1,7 +1,7 @@
-From 3256ae03ed8d4b0c9aca091c7c183b91ca595db7 Mon Sep 17 00:00:00 2001
+From b02c433e89bae9520bf37eae1f40dda3f5fe3944 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 13 Dec 2022 17:51:26 +0800
-Subject: [PATCH 2001/2011] wifi: mt76: mt7915: wed: add wds support when wed
+Subject: [PATCH 2001/2010] wifi: mt76: mt7915: wed: add wds support when wed
  is enabled
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
@@ -15,7 +15,7 @@
  6 files changed, 82 insertions(+), 10 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index ad1402a..d00ef21 100644
+index 2f801de4..e315fc1e 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -68,6 +68,12 @@ enum mt76_wed_type {
@@ -32,10 +32,10 @@
  	u32 (*rr)(struct mt76_dev *dev, u32 offset);
  	void (*wr)(struct mt76_dev *dev, u32 offset, u32 val);
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 7274b5d..e274f02 100644
+index 89e994f9..2f4677ec 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -773,8 +773,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -761,8 +761,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  #endif
  	int ret, idx;
  	u32 addr;
@@ -52,7 +52,7 @@
  	if (idx < 0)
  		return -ENOSPC;
  
-@@ -1253,6 +1260,13 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
+@@ -1241,6 +1248,13 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
  	else
  		clear_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
  
@@ -66,7 +66,7 @@
  	mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
  }
  
-@@ -1692,8 +1706,12 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1679,8 +1693,12 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	path->dev = ctx->dev;
  	path->mtk_wdma.wdma_idx = wed->wdma_idx;
  	path->mtk_wdma.bss = mvif->mt76.idx;
@@ -81,10 +81,10 @@
  	ctx->dev = NULL;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index cd4f472..d8b9318 100644
+index d2e3e82b..4eaeed68 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2397,10 +2397,18 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2388,10 +2388,18 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -108,7 +108,7 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 6e6f320..825bb7d 100644
+index 6e6f320b..825bb7df 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -339,6 +339,7 @@ enum {
@@ -120,7 +120,7 @@
  	MCU_WA_PARAM_RED_SHOW_STA = 0xf,
  	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
 diff --git a/util.c b/util.c
-index fc76c66..61b2d30 100644
+index fc76c66f..61b2d30a 100644
 --- a/util.c
 +++ b/util.c
 @@ -42,9 +42,14 @@ bool ____mt76_poll_msec(struct mt76_dev *dev, u32 offset, u32 mask, u32 val,
@@ -188,7 +188,7 @@
  int mt76_get_min_avg_rssi(struct mt76_dev *dev, bool ext_phy)
  {
 diff --git a/util.h b/util.h
-index 260965d..99b7263 100644
+index 260965dd..99b7263c 100644
 --- a/util.h
 +++ b/util.h
 @@ -27,7 +27,12 @@ enum {
@@ -206,5 +206,5 @@
  static inline void
  mt76_wcid_mask_set(u32 *mask, int idx)
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/2002-wifi-mt76-mt7915-wed-add-fill-receive-path-to-report.patch b/recipes-wifi/linux-mt76/files/patches/2002-wifi-mt76-mt7915-wed-add-fill-receive-path-to-report.patch
index a3eadce..a41a99f 100644
--- a/recipes-wifi/linux-mt76/files/patches/2002-wifi-mt76-mt7915-wed-add-fill-receive-path-to-report.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2002-wifi-mt76-mt7915-wed-add-fill-receive-path-to-report.patch
@@ -1,7 +1,7 @@
-From db9a693311a05bb9df09d59b940b0006953ea93f Mon Sep 17 00:00:00 2001
+From dd879c2a2e307c09f356fbf47cd4ae7451fb3bf4 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 19 May 2023 07:05:22 +0800
-Subject: [PATCH 2002/2011] wifi: mt76: mt7915: wed: add fill receive path to
+Subject: [PATCH 2002/2010] wifi: mt76: mt7915: wed: add fill receive path to
  report wed idx
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 18 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index e274f02..f08fb2d 100644
+index 2f4677ec..00c66000 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1718,6 +1718,23 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1705,6 +1705,23 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	return 0;
  }
  
@@ -37,7 +37,7 @@
  static int
  mt7915_net_setup_tc(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  		    struct net_device *netdev, enum tc_setup_type type,
-@@ -1785,6 +1802,7 @@ const struct ieee80211_ops mt7915_ops = {
+@@ -1772,6 +1789,7 @@ const struct ieee80211_ops mt7915_ops = {
  	.set_radar_background = mt7915_set_radar_background,
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
  	.net_fill_forward_path = mt7915_net_fill_forward_path,
@@ -46,5 +46,5 @@
  #endif
  };
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/2003-wifi-mt76-mt7915-wed-find-rx-token-by-physical-addre.patch b/recipes-wifi/linux-mt76/files/patches/2003-wifi-mt76-mt7915-wed-find-rx-token-by-physical-addre.patch
index 16b9a1a..70230bc 100644
--- a/recipes-wifi/linux-mt76/files/patches/2003-wifi-mt76-mt7915-wed-find-rx-token-by-physical-addre.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2003-wifi-mt76-mt7915-wed-find-rx-token-by-physical-addre.patch
@@ -1,7 +1,7 @@
-From 51125c922550f392c705ef3aa1151eb92105e88a Mon Sep 17 00:00:00 2001
+From 2423861357760af2716618d87d65a8d1dff7319c Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 14:32:35 +0800
-Subject: [PATCH 2003/2011] wifi: mt76: mt7915: wed: find rx token by physical
+Subject: [PATCH 2003/2010] wifi: mt76: mt7915: wed: find rx token by physical
  address
 
 The token id in RxDMAD may be incorrect when it is not the last frame due to
@@ -13,10 +13,10 @@
  1 file changed, 24 insertions(+), 1 deletion(-)
 
 diff --git a/dma.c b/dma.c
-index 8049830..e877d26 100644
+index fc92e391..3047f8ba 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -405,9 +405,32 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -403,9 +403,32 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  
  	if (mt76_queue_is_wed_rx(q)) {
  		u32 buf1 = le32_to_cpu(desc->buf1);
@@ -51,5 +51,5 @@
  			return NULL;
  
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/2004-wifi-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch b/recipes-wifi/linux-mt76/files/patches/2004-wifi-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
index 0cc54b4..0df2d7b 100644
--- a/recipes-wifi/linux-mt76/files/patches/2004-wifi-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2004-wifi-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
@@ -1,7 +1,7 @@
-From 47c204c6a21ab052388c35ba53b9e792ed9343c0 Mon Sep 17 00:00:00 2001
+From e2b7b9b7d48b69eed36443ce889efba749da9347 Mon Sep 17 00:00:00 2001
 From: Lian Chen <lian.chen@mediatek.com>
 Date: Mon, 7 Nov 2022 14:47:44 +0800
-Subject: [PATCH 2004/2011] wifi: mt76: mt7915: wed: HW ATF support for mt7986
+Subject: [PATCH] wifi: mt76: mt7915: wed: HW ATF support for mt7986
 
 Signed-off-by: Lian Chen <lian.chen@mediatek.com>
 ---
@@ -9,16 +9,16 @@
  mt7915/debugfs.c     | 405 +++++++++++++++++++++++++++++++++++++++++++
  mt7915/init.c        |  39 +++++
  mt7915/main.c        |  15 ++
- mt7915/mcu.c         | 164 ++++++++++++++++++
+ mt7915/mcu.c         | 165 ++++++++++++++++++
  mt7915/mt7915.h      |  68 ++++++++
  mt7915/mtk_debugfs.c | 131 +++++++++++++-
- 7 files changed, 823 insertions(+), 1 deletion(-)
+ 7 files changed, 824 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 4925890..9ad1883 100644
+index 8228bbb1..1257dfa1 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1175,6 +1175,7 @@ enum {
+@@ -1164,6 +1164,7 @@ enum {
  	MCU_EXT_CMD_THERMAL_CTRL = 0x2c,
  	MCU_EXT_CMD_WTBL_UPDATE = 0x32,
  	MCU_EXT_CMD_SET_DRR_CTRL = 0x36,
@@ -26,7 +26,7 @@
  	MCU_EXT_CMD_SET_RDD_CTRL = 0x3a,
  	MCU_EXT_CMD_ATE_CTRL = 0x3d,
  	MCU_EXT_CMD_PROTECT_CTRL = 0x3e,
-@@ -1184,6 +1185,7 @@ enum {
+@@ -1173,6 +1174,7 @@ enum {
  	MCU_EXT_CMD_MUAR_UPDATE = 0x48,
  	MCU_EXT_CMD_BCN_OFFLOAD = 0x49,
  	MCU_EXT_CMD_RX_AIRTIME_CTRL = 0x4a,
@@ -35,7 +35,7 @@
  	MCU_EXT_CMD_EFUSE_FREE_BLOCK = 0x4f,
  	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 6dcee10..ca42b69 100644
+index bb312eeb..fefa4540 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -12,6 +12,10 @@
@@ -465,10 +465,10 @@
  	if (!dev->dbdc_support || phy->mt76->band_idx) {
  		debugfs_create_u32("dfs_hw_pattern", 0400, dir,
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 36621ad..2100820 100644
+index 623b0703..bfcdf3eb 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -600,10 +600,46 @@ mt7915_init_led_mux(struct mt7915_dev *dev)
+@@ -602,10 +602,46 @@ mt7915_init_led_mux(struct mt7915_dev *dev)
  	}
  }
  
@@ -515,7 +515,7 @@
  
  	/* config pse qid6 wfdma port selection */
  	if (!is_mt7915(&dev->mt76) && dev->hif2)
-@@ -627,6 +663,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
+@@ -629,6 +665,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
  		mt7915_mac_init_band(dev, i);
  
  	mt7915_init_led_mux(dev);
@@ -526,7 +526,7 @@
  
  int mt7915_txbf_init(struct mt7915_dev *dev)
 diff --git a/mt7915/main.c b/mt7915/main.c
-index f08fb2d..8784a02 100644
+index 7a853825..deef1bb6 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -217,6 +217,7 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
@@ -537,7 +537,7 @@
  	struct mt76_txq *mtxq;
  	bool ext_phy = phy != &dev->phy;
  	int idx, ret = 0;
-@@ -278,6 +279,9 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
+@@ -279,6 +280,9 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
  	mt7915_mcu_add_sta(dev, vif, NULL, true);
  	rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
  
@@ -547,7 +547,7 @@
  	return ret;
  }
  
-@@ -768,6 +772,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -757,6 +761,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	bool ext_phy = mvif->phy != &dev->phy;
@@ -555,7 +555,7 @@
  #ifdef CONFIG_MTK_VENDOR
  	struct mt7915_phy *phy = ext_phy ? mt7915_ext_phy(dev) : &dev->phy;
  #endif
-@@ -818,6 +823,16 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -807,6 +812,16 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (phy->muru_onoff & MUMIMO_DL_CERT)
  		mt7915_mcu_set_mimo(phy, 0);
  #endif
@@ -573,10 +573,10 @@
  }
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d8b9318..b2b5c76 100644
+index 490058df..06b8acdf 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3568,6 +3568,170 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
+@@ -3560,6 +3560,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
  				 &req, sizeof(req), false);
  }
  
@@ -608,6 +608,7 @@
 +	switch (subcmd) {
 +		case VOW_DRR_STA_ALL:{
 +			setting |= 0x00;
++			setting |= msta->vif->mt76.idx;
 +			setting |= msta->vow_sta_cfg.ac_change_rule << 4;
 +			setting |= (msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_VO] << 8);
 +			setting |= (msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_VI] << 12);
@@ -748,7 +749,7 @@
  {
  #define MT_BF_PROCESSING	4
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index af9e3ae..764edc5 100644
+index dded050a..c60521b1 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -141,6 +141,58 @@ struct mt7915_twt_flow {
@@ -818,7 +819,7 @@
  };
  
  struct mt7915_vif_cap {
-@@ -419,6 +472,8 @@ struct mt7915_dev {
+@@ -417,6 +470,8 @@ struct mt7915_dev {
  	} dbg;
  	const struct mt7915_dbg_reg_desc *dbg_reg;
  #endif
@@ -827,7 +828,7 @@
  };
  
  enum {
-@@ -451,6 +506,15 @@ enum mt7915_rdd_cmd {
+@@ -449,6 +504,15 @@ enum mt7915_rdd_cmd {
  	RDD_IRQ_OFF,
  };
  
@@ -843,7 +844,7 @@
  static inline struct mt7915_phy *
  mt7915_hw_phy(struct ieee80211_hw *hw)
  {
-@@ -580,6 +644,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
+@@ -578,6 +642,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
  int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
  			      u8 en);
  int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
@@ -855,7 +856,7 @@
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
  int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index c58a2d1..928bb50 100644
+index 80b7bc1a..b12aff80 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -1368,7 +1368,6 @@ static EMPTY_QUEUE_INFO_T ple_txcmd_queue_empty_info[] = {
diff --git a/recipes-wifi/linux-mt76/files/patches/2005-wifi-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rr.patch b/recipes-wifi/linux-mt76/files/patches/2005-wifi-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rr.patch
index ecffb76..5a29596 100644
--- a/recipes-wifi/linux-mt76/files/patches/2005-wifi-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rr.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2005-wifi-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rr.patch
@@ -1,8 +1,7 @@
-From a71cacc640b5c4ddacdb4e3ce7c3571a08a2daa4 Mon Sep 17 00:00:00 2001
+From cc7a9202984360cdc476d3aa860bebd9fc248a16 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 6 Jan 2023 18:18:50 +0800
-Subject: [PATCH 2005/2011] wifi: mt76: mt7915: wed: add rxwi for further in
- chip rro
+Subject: [PATCH] wifi: mt76: mt7915: wed: add rxwi for further in chip rro
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -16,10 +15,10 @@
  7 files changed, 87 insertions(+), 80 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index e877d26..e3e2f38 100644
+index 3047f8ba..b210e39c 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -64,17 +64,17 @@ mt76_alloc_txwi(struct mt76_dev *dev)
+@@ -59,17 +59,17 @@ mt76_alloc_txwi(struct mt76_dev *dev)
  	return t;
  }
  
@@ -43,7 +42,7 @@
  }
  
  static struct mt76_txwi_cache *
-@@ -93,20 +93,20 @@ __mt76_get_txwi(struct mt76_dev *dev)
+@@ -88,20 +88,20 @@ __mt76_get_txwi(struct mt76_dev *dev)
  	return t;
  }
  
@@ -71,7 +70,7 @@
  }
  
  static struct mt76_txwi_cache *
-@@ -120,13 +120,13 @@ mt76_get_txwi(struct mt76_dev *dev)
+@@ -115,13 +115,13 @@ mt76_get_txwi(struct mt76_dev *dev)
  	return mt76_alloc_txwi(dev);
  }
  
@@ -89,7 +88,7 @@
  
  	return mt76_alloc_rxwi(dev);
  }
-@@ -145,14 +145,14 @@ mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t)
+@@ -140,14 +140,14 @@ mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t)
  EXPORT_SYMBOL_GPL(mt76_put_txwi);
  
  void
@@ -109,7 +108,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_put_rxwi);
  
-@@ -173,13 +173,13 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
+@@ -168,13 +168,13 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
  void
  mt76_free_pending_rxwi(struct mt76_dev *dev)
  {
@@ -128,7 +127,7 @@
  	}
  	local_bh_enable();
  }
-@@ -217,7 +217,7 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -212,7 +212,7 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
  {
  	struct mt76_desc *desc = &q->desc[q->head];
  	struct mt76_queue_entry *entry = &q->entry[q->head];
@@ -137,7 +136,7 @@
  	u32 buf1 = 0, ctrl;
  	int idx = q->head;
  	int rx_token;
-@@ -225,13 +225,13 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -220,13 +220,13 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
  	ctrl = FIELD_PREP(MT_DMA_CTL_SD_LEN0, buf[0].len);
  
  	if (mt76_queue_is_wed_rx(q)) {
@@ -155,7 +154,7 @@
  			return -ENOMEM;
  		}
  
-@@ -246,7 +246,7 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -241,7 +241,7 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
  
  	entry->dma_addr[0] = buf->addr;
  	entry->dma_len[0] = buf->len;
@@ -164,7 +163,7 @@
  	entry->buf = data;
  	entry->wcid = 0xffff;
  	entry->skip_buf1 = true;
-@@ -259,7 +259,7 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -254,7 +254,7 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
  static int
  mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
  		 struct mt76_queue_buf *buf, int nbufs, u32 info,
@@ -173,7 +172,7 @@
  {
  	struct mt76_queue_entry *entry;
  	struct mt76_desc *desc;
-@@ -312,6 +312,7 @@ mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -307,6 +307,7 @@ mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
  	}
  
  	q->entry[idx].txwi = txwi;
@@ -181,7 +180,7 @@
  	q->entry[idx].skb = skb;
  	q->entry[idx].wcid = 0xffff;
  
-@@ -407,13 +408,13 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -405,13 +406,13 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  		u32 buf1 = le32_to_cpu(desc->buf1);
  		u32 id, find = 0;
  		u32 token = FIELD_GET(MT_DMA_CTL_TOKEN, buf1);
@@ -198,7 +197,7 @@
  					find = 1;
  					token = id;
  
-@@ -430,19 +431,19 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -428,19 +429,19 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  				return NULL;
  		}
  
@@ -225,7 +224,7 @@
  
  		if (drop) {
  			u32 ctrl = le32_to_cpu(READ_ONCE(desc->ctrl));
-@@ -506,7 +507,7 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -504,7 +505,7 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
  	buf.len = skb->len;
  
  	spin_lock_bh(&q->lock);
@@ -234,7 +233,7 @@
  	mt76_dma_kick_queue(dev, q);
  	spin_unlock_bh(&q->lock);
  
-@@ -586,7 +587,7 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -584,7 +585,7 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q,
  		goto unmap;
  
  	return mt76_dma_add_buf(dev, q, tx_info.buf, tx_info.nbuf,
@@ -244,10 +243,10 @@
  unmap:
  	for (n--; n > 0; n--)
 diff --git a/mac80211.c b/mac80211.c
-index ad3a5e2..6232534 100644
+index 25ec4330..35cd297c 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -607,7 +607,6 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
+@@ -603,7 +603,6 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
  	spin_lock_init(&dev->lock);
  	spin_lock_init(&dev->cc_lock);
  	spin_lock_init(&dev->status_lock);
@@ -255,7 +254,7 @@
  	mutex_init(&dev->mutex);
  	init_waitqueue_head(&dev->tx_wait);
  
-@@ -640,6 +639,7 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
+@@ -636,6 +635,7 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
  	INIT_LIST_HEAD(&dev->txwi_cache);
  	INIT_LIST_HEAD(&dev->rxwi_cache);
  	dev->token_size = dev->drv->token_size;
@@ -264,7 +263,7 @@
  	for (i = 0; i < ARRAY_SIZE(dev->q_rx); i++)
  		skb_queue_head_init(&dev->rx_skb[i]);
 diff --git a/mt76.h b/mt76.h
-index d00ef21..968bf08 100644
+index 70146064..828d3e8b 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -173,6 +173,7 @@ struct mt76_queue_entry {
@@ -275,7 +274,7 @@
  		struct urb *urb;
  		int buf_sz;
  	};
-@@ -376,10 +377,15 @@ struct mt76_txwi_cache {
+@@ -373,10 +374,15 @@ struct mt76_txwi_cache {
  
  	unsigned long jiffies;
  
@@ -295,7 +294,7 @@
  };
  
  struct mt76_rx_tid {
-@@ -465,6 +471,7 @@ struct mt76_driver_ops {
+@@ -462,6 +468,7 @@ struct mt76_driver_ops {
  	u16 txwi_size;
  	u16 token_size;
  	u8 mcs_rates;
@@ -303,7 +302,7 @@
  
  	void (*update_survey)(struct mt76_phy *phy);
  
-@@ -851,7 +858,6 @@ struct mt76_dev {
+@@ -835,7 +842,6 @@ struct mt76_dev {
  
  	struct ieee80211_hw *hw;
  
@@ -311,7 +310,7 @@
  	spinlock_t lock;
  	spinlock_t cc_lock;
  
-@@ -1543,8 +1549,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1525,8 +1531,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  }
  
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
@@ -322,7 +321,7 @@
  void mt76_free_pending_rxwi(struct mt76_dev *dev);
  void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
  		      struct napi_struct *napi);
-@@ -1699,9 +1705,9 @@ struct mt76_txwi_cache *
+@@ -1681,9 +1687,9 @@ struct mt76_txwi_cache *
  mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
  int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
  void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
@@ -335,7 +334,7 @@
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 59a44d7..326c8c8 100644
+index 59a44d79..326c8c8c 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -509,7 +509,6 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -355,7 +354,7 @@
  
  		/* rx data queue for band1 */
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index cae8b81..d739390 100644
+index cae8b810..d7393901 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -622,18 +622,18 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
@@ -445,7 +444,7 @@
  		.tx_complete_skb = mt76_connac_tx_complete_skb,
  		.rx_skb = mt7915_queue_rx_skb,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 764edc5..c1f3a0a 100644
+index c60521b1..4d3ff13b 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -64,6 +64,7 @@
@@ -457,10 +456,10 @@
  #define MT7915_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
  #define MT7915_CFEND_RATE_11B		0x03	/* 11B LP, 11M */
 diff --git a/tx.c b/tx.c
-index f1dd9f6..e290aef 100644
+index 5d7bf340..2594a625 100644
 --- a/tx.c
 +++ b/tx.c
-@@ -842,16 +842,16 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
+@@ -774,16 +774,16 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
  EXPORT_SYMBOL_GPL(mt76_token_consume);
  
  int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
@@ -481,7 +480,7 @@
  	}
  	spin_unlock_bh(&dev->rx_token_lock);
  
-@@ -888,15 +888,15 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
+@@ -820,15 +820,15 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
  }
  EXPORT_SYMBOL_GPL(mt76_token_release);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/2006-wifi-mt76-add-debugfs-knob-to-show-packet-error-rate.patch b/recipes-wifi/linux-mt76/files/patches/2006-wifi-mt76-add-debugfs-knob-to-show-packet-error-rate.patch
index ac5bfb1..36e68cc 100644
--- a/recipes-wifi/linux-mt76/files/patches/2006-wifi-mt76-add-debugfs-knob-to-show-packet-error-rate.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2006-wifi-mt76-add-debugfs-knob-to-show-packet-error-rate.patch
@@ -1,8 +1,7 @@
-From 999021989ad387b46c8ff4ffed43cc0017322c5e Mon Sep 17 00:00:00 2001
+From 99ebe10c9bc4259528c225fd6ab64edaa02d9d15 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Wed, 11 Jan 2023 10:56:27 +0800
-Subject: [PATCH 2006/2011] wifi: mt76: add debugfs knob to show packet error
- rate
+Subject: [PATCH] wifi: mt76: add debugfs knob to show packet error rate
 
 Get tx count and tx failed from mcu command
 ---
@@ -15,7 +14,7 @@
  6 files changed, 194 insertions(+), 1 deletion(-)
 
 diff --git a/mt76.h b/mt76.h
-index 968bf08..3032cdd 100644
+index 828d3e8..3fbe02a 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -297,8 +297,10 @@ struct mt76_sta_stats {
@@ -30,10 +29,10 @@
  	u64 rx_bytes;
  	u32 rx_packets;
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 9ad1883..2d6e610 100644
+index 1257dfa..cfdee7c 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1173,6 +1173,7 @@ enum {
+@@ -1162,6 +1162,7 @@ enum {
  	MCU_EXT_CMD_EDCA_UPDATE = 0x27,
  	MCU_EXT_CMD_DEV_INFO_UPDATE = 0x2A,
  	MCU_EXT_CMD_THERMAL_CTRL = 0x2c,
@@ -42,10 +41,10 @@
  	MCU_EXT_CMD_SET_DRR_CTRL = 0x36,
  	MCU_EXT_CMD_SET_FEATURE_CTRL = 0x38,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index b2b5c76..d4b0617 100644
+index 170b3f1..148a687 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4233,6 +4233,114 @@ int mt7915_mcu_get_tx_rate(struct mt7915_phy *phy, u16 wcidx)
+@@ -4232,6 +4232,114 @@ int mt7915_mcu_get_tx_rate(struct mt7915_phy *phy, u16 wcidx)
  		return mt7915_mcu_get_tx_rate_v2(phy, wcidx);
  }
  
@@ -200,10 +199,10 @@
     CAPI_SU,
     CAPI_MU,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index c1f3a0a..d47abcf 100644
+index e36fb84..e8f7ca5 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -677,6 +677,7 @@ int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -675,6 +675,7 @@ int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
  				     struct cfg80211_chan_def *chandef);
  int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wcid);
diff --git a/recipes-wifi/linux-mt76/files/patches/2007-wifi-mt76-mt7915-add-ctxd-support-for-mt7916.patch b/recipes-wifi/linux-mt76/files/patches/2007-wifi-mt76-mt7915-add-ctxd-support-for-mt7916.patch
index 83cda65..a4e9fa7 100644
--- a/recipes-wifi/linux-mt76/files/patches/2007-wifi-mt76-mt7915-add-ctxd-support-for-mt7916.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2007-wifi-mt76-mt7915-add-ctxd-support-for-mt7916.patch
@@ -1,7 +1,7 @@
-From 1d021dcf4503c9003919b805f5ead1d78b50ad7a Mon Sep 17 00:00:00 2001
+From 8011cfeea1db4876c4d2775d203c03854334b013 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Thu, 6 Apr 2023 17:50:52 +0800
-Subject: [PATCH 2007/2011] wifi: mt76: mt7915: add ctxd support for mt7916
+Subject: [PATCH 2007/2010] wifi: mt76: mt7915: add ctxd support for mt7916
 
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
 ---
@@ -10,7 +10,7 @@
  2 files changed, 35 insertions(+)
 
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 326c8c8..f71ec55 100644
+index 326c8c8c..f71ec55b 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -433,6 +433,26 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -41,10 +41,10 @@
  	} else {
  		mt76_clear(dev, MT_WFDMA_HOST_CONFIG, MT_WFDMA_HOST_CONFIG_WED);
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 3c2fd2d..32d1f1e 100644
+index 44da7b82..bc963ac8 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -607,6 +607,7 @@ enum offs_rev {
+@@ -606,6 +606,7 @@ enum offs_rev {
  #define MT_WFDMA0_GLO_CFG		MT_WFDMA0(0x208)
  #define MT_WFDMA0_GLO_CFG_TX_DMA_EN	BIT(0)
  #define MT_WFDMA0_GLO_CFG_RX_DMA_EN	BIT(2)
@@ -52,7 +52,7 @@
  #define MT_WFDMA0_GLO_CFG_OMIT_TX_INFO	BIT(28)
  #define MT_WFDMA0_GLO_CFG_OMIT_RX_INFO	BIT(27)
  #define MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2	BIT(21)
-@@ -616,6 +617,17 @@ enum offs_rev {
+@@ -615,6 +616,17 @@ enum offs_rev {
  #define MT_WFDMA0_EXT0_CFG		MT_WFDMA0(0x2b0)
  #define MT_WFDMA0_EXT0_RXWB_KEEP	BIT(10)
  
@@ -70,7 +70,7 @@
  #define MT_WFDMA0_PRI_DLY_INT_CFG0	MT_WFDMA0(0x2f0)
  #define MT_WFDMA0_PRI_DLY_INT_CFG1	MT_WFDMA0(0x2f4)
  #define MT_WFDMA0_PRI_DLY_INT_CFG2	MT_WFDMA0(0x2f8)
-@@ -659,6 +671,8 @@ enum offs_rev {
+@@ -658,6 +670,8 @@ enum offs_rev {
  #define MT_WFDMA_WED_RING_CONTROL_TX1	GENMASK(12, 8)
  #define MT_WFDMA_WED_RING_CONTROL_RX1	GENMASK(20, 16)
  
@@ -79,7 +79,7 @@
  #define MT_WFDMA_EXT_CSR_HIF_MISC	MT_WFDMA_EXT_CSR_PHYS(0x44)
  #define MT_WFDMA_EXT_CSR_HIF_MISC_BUSY	BIT(0)
  
-@@ -1187,6 +1201,7 @@ enum offs_rev {
+@@ -1186,6 +1200,7 @@ enum offs_rev {
  
  #define MT_HW_BOUND			0x70010020
  #define MT_HW_REV			0x70010204
@@ -88,5 +88,5 @@
  
  /* PCIE MAC */
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/2008-wifi-mt76-connac-wed-add-wed-rx-copy-skb.patch b/recipes-wifi/linux-mt76/files/patches/2008-wifi-mt76-connac-wed-add-wed-rx-copy-skb.patch
index a50ea6c..db22ea4 100644
--- a/recipes-wifi/linux-mt76/files/patches/2008-wifi-mt76-connac-wed-add-wed-rx-copy-skb.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2008-wifi-mt76-connac-wed-add-wed-rx-copy-skb.patch
@@ -1,7 +1,7 @@
-From 7a963d92dd37bb16d00cc9ba7684f131d3331a78 Mon Sep 17 00:00:00 2001
+From 5a6a17438c96f92e7fa27123467384ad6e8dbd7f Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 5 Jan 2023 16:43:57 +0800
-Subject: [PATCH 2008/2011] wifi: mt76: connac: wed: add wed rx copy skb
+Subject: [PATCH 2008/2010] wifi: mt76: connac: wed: add wed rx copy skb
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -10,10 +10,10 @@
  2 files changed, 85 insertions(+), 26 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index e3e2f38..7c5e623 100644
+index b210e39c..4daa64da 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -213,11 +213,11 @@ mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -208,11 +208,11 @@ mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q)
  
  static int
  mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
@@ -27,7 +27,7 @@
  	u32 buf1 = 0, ctrl;
  	int idx = q->head;
  	int rx_token;
-@@ -225,9 +225,11 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -220,9 +220,11 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
  	ctrl = FIELD_PREP(MT_DMA_CTL_SD_LEN0, buf[0].len);
  
  	if (mt76_queue_is_wed_rx(q)) {
@@ -42,7 +42,7 @@
  
  		rx_token = mt76_rx_token_consume(dev, data, rxwi, buf->addr);
  		if (rx_token < 0) {
-@@ -389,7 +391,7 @@ mt76_dma_tx_cleanup(struct mt76_dev *dev, struct mt76_queue *q, bool flush)
+@@ -387,7 +389,7 @@ mt76_dma_tx_cleanup(struct mt76_dev *dev, struct mt76_queue *q, bool flush)
  
  static void *
  mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
@@ -51,7 +51,7 @@
  {
  	struct mt76_queue_entry *e = &q->entry[idx];
  	struct mt76_desc *desc = &q->desc[idx];
-@@ -439,11 +441,43 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -437,11 +439,43 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  				 SKB_WITH_OVERHEAD(q->buf_size),
  				 DMA_FROM_DEVICE);
  
@@ -99,7 +99,7 @@
  
  		if (drop) {
  			u32 ctrl = le32_to_cpu(READ_ONCE(desc->ctrl));
-@@ -482,7 +516,7 @@ mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
+@@ -480,7 +514,7 @@ mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
  	q->tail = (q->tail + 1) % q->ndesc;
  	q->queued--;
  
@@ -108,7 +108,7 @@
  }
  
  static int
-@@ -622,6 +656,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -620,6 +654,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  	int len = SKB_WITH_OVERHEAD(q->buf_size);
  	int frames = 0, offset = q->buf_offset;
  	dma_addr_t addr;
@@ -116,7 +116,7 @@
  
  	if (!q->ndesc)
  		return 0;
-@@ -645,7 +680,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -643,7 +678,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  		qbuf.addr = addr + offset;
  		qbuf.len = len - offset;
  		qbuf.skip_unmap = false;
@@ -125,7 +125,7 @@
  			dma_unmap_single(dev->dma_dev, addr, len,
  					 DMA_FROM_DEVICE);
  			skb_free_frag(buf);
-@@ -654,7 +689,10 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -652,7 +687,10 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  		frames++;
  	}
  
@@ -137,7 +137,7 @@
  		mt76_dma_kick_queue(dev, q);
  
  	spin_unlock_bh(&q->lock);
-@@ -777,12 +815,14 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -775,12 +813,14 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  
  	spin_unlock_bh(&q->lock);
  
@@ -158,10 +158,10 @@
  
  static void
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index d739390..aa5c5dd 100644
+index a59e3118..89523a52 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -614,6 +614,7 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
+@@ -576,6 +576,7 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
  static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
  {
  	struct mt7915_dev *dev;
@@ -169,7 +169,7 @@
  	u32 length;
  	int i;
  
-@@ -630,13 +631,33 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
+@@ -592,13 +593,33 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
  
  		dma_unmap_single(dev->mt76.dma_dev, r->dma_addr,
  				 wed->wlan.rx_size, DMA_FROM_DEVICE);
@@ -204,7 +204,7 @@
  }
  
  static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
-@@ -653,35 +674,33 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+@@ -615,35 +636,33 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
  	for (i = 0; i < size; i++) {
  		struct mt76_rxwi_cache *r = mt76_get_rxwi(&dev->mt76);
  		dma_addr_t phy_addr;
@@ -246,5 +246,5 @@
  			goto unmap;
  		}
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/2009-wifi-mt76-mt7915-enable-wa-log-to-uart.patch b/recipes-wifi/linux-mt76/files/patches/2009-wifi-mt76-mt7915-enable-wa-log-to-uart.patch
deleted file mode 100644
index 97e343a..0000000
--- a/recipes-wifi/linux-mt76/files/patches/2009-wifi-mt76-mt7915-enable-wa-log-to-uart.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 8b5f1f9d44e11290d97dbae675457d1cf5030374 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Fri, 8 Sep 2023 18:26:21 +0800
-Subject: [PATCH 2009/2011] wifi: mt76: mt7915: enable wa log to uart
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7915/debugfs.c | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index ca42b69..fd35b57 100644
---- a/mt7915/debugfs.c
-+++ b/mt7915/debugfs.c
-@@ -988,7 +988,11 @@ mt7915_fw_debug_wa_set(void *data, u64 val)
- 	struct mt7915_dev *dev = data;
- 	int ret;
- 
--	dev->fw.debug_wa = val ? MCU_FW_LOG_TO_HOST : 0;
-+	/* bit 0: log to uart, bit 1: log to Host */
-+	if (val > 3)
-+		return -EINVAL;
-+
-+	dev->fw.debug_wa = val;
- 
- 	ret = mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WA, dev->fw.debug_wa);
- 	if (ret)
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/2010-wifi-mt76-mt7915-add-error-message-when-driver-recei.patch b/recipes-wifi/linux-mt76/files/patches/2010-wifi-mt76-mt7915-add-error-message-when-driver-recei.patch
deleted file mode 100644
index d004b61..0000000
--- a/recipes-wifi/linux-mt76/files/patches/2010-wifi-mt76-mt7915-add-error-message-when-driver-recei.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 7dabeeff8a38468359c857c5df6da076faa95444 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Fri, 8 Sep 2023 18:29:32 +0800
-Subject: [PATCH 2010/2011] wifi: mt76: mt7915: add error message when driver
- receive invalid token id
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7915/mac.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 3c6b308..a5369ea 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -998,6 +998,12 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
- 			} else {
- 				msdu = FIELD_GET(MT_TX_FREE_MSDU_ID, info);
- 			}
-+
-+			/* Todo: check if msdu is sw token */
-+			if (msdu > MT7915_TOKEN_SIZE)
-+				dev_err(mdev->dev, "Receive invalid token id(%d)\n",
-+					msdu);
-+
- 			count++;
- 			txwi = mt76_token_release(mdev, msdu, &wake);
- 			if (!txwi)
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/2011-mt76-wifi-mt7915-wed-setting-wed-hw-tx-token-to-8192.patch b/recipes-wifi/linux-mt76/files/patches/2011-mt76-wifi-mt7915-wed-setting-wed-hw-tx-token-to-8192.patch
deleted file mode 100644
index 13d1f48..0000000
--- a/recipes-wifi/linux-mt76/files/patches/2011-mt76-wifi-mt7915-wed-setting-wed-hw-tx-token-to-8192.patch
+++ /dev/null
@@ -1,122 +0,0 @@
-From 467bdd35a3ec4603761f1a7e2281a78a3776a0bb Mon Sep 17 00:00:00 2001
-From: "sujuan.chen" <sujuan.chen@mediatek.com>
-Date: Mon, 11 Sep 2023 17:57:32 +0800
-Subject: [PATCH 2011/2011] mt76: wifi: mt7915: wed: setting wed hw tx token to
- 8192
-
-Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
----
- mt7915/mmio.c   |  8 ++++----
- mt7915/mt7915.h |  4 ++--
- tx.c            | 26 ++++++++------------------
- 3 files changed, 14 insertions(+), 24 deletions(-)
-
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index aa5c5dd..b677947 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -593,7 +593,7 @@ static int mt7915_mmio_wed_offload_enable(struct mtk_wed_device *wed)
- 	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
- 
- 	spin_lock_bh(&dev->mt76.token_lock);
--	dev->mt76.token_size = wed->wlan.token_start;
-+	dev->mt76.token_size = MT7915_TOKEN_SIZE - MT7915_HW_TOKEN_SIZE;
- 	spin_unlock_bh(&dev->mt76.token_lock);
- 
- 	return !wait_event_timeout(dev->mt76.tx_wait,
-@@ -607,7 +607,7 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
- 	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
- 
- 	spin_lock_bh(&dev->mt76.token_lock);
--	dev->mt76.token_size = wed->wlan.token_start;//MT7915_TOKEN_SIZE
-+	dev->mt76.token_size = MT7915_TOKEN_SIZE - MT7915_HW_TOKEN_SIZE;
- 	spin_unlock_bh(&dev->mt76.token_lock);
- }
- 
-@@ -841,7 +841,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 	wed->wlan.tx_tbit[0] = is_mt7915(&dev->mt76) ? 4 : 30;
- 	wed->wlan.tx_tbit[1] = is_mt7915(&dev->mt76) ? 5 : 31;
- 	wed->wlan.txfree_tbit = is_mt798x(&dev->mt76) ? 2 : 1;
--	wed->wlan.token_start = MT7915_TOKEN_SIZE - wed->wlan.nbuf;
-+	wed->wlan.token_start = 0;
- 	wed->wlan.wcid_512 = !is_mt7915(&dev->mt76);
- 
- 	wed->wlan.rx_nbuf = 65536;
-@@ -874,7 +874,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 
- 	*irq = wed->irq;
- 	dev->mt76.dma_dev = wed->dev;
--	dev->mt76.token_size = wed->wlan.token_start;
-+	dev->mt76.token_size = MT7915_TOKEN_SIZE - MT7915_HW_TOKEN_SIZE;
- 
- 	ret = dma_set_mask(wed->dev, DMA_BIT_MASK(32));
- 	if (ret)
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index d47abcf..5f3b84e 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -62,8 +62,8 @@
- #define MT7916_EEPROM_SIZE		4096
- 
- #define MT7915_EEPROM_BLOCK_SIZE	16
--#define MT7915_HW_TOKEN_SIZE		7168
--#define MT7915_TOKEN_SIZE		8192
-+#define MT7915_HW_TOKEN_SIZE		8192
-+#define MT7915_TOKEN_SIZE		9216
- #define MT7915_RX_TOKEN_SIZE		4096
- 
- #define MT7915_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
-diff --git a/tx.c b/tx.c
-index e290aef..96f9009 100644
---- a/tx.c
-+++ b/tx.c
-@@ -818,20 +818,18 @@ EXPORT_SYMBOL_GPL(__mt76_set_tx_blocked);
- 
- int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
- {
--	int token;
-+	int token, start = 0;
-+
-+	if (mtk_wed_device_active(&dev->mmio.wed))
-+		start = dev->mmio.wed.wlan.nbuf;
- 
- 	spin_lock_bh(&dev->token_lock);
- 
--	token = idr_alloc(&dev->token, *ptxwi, 0, dev->token_size, GFP_ATOMIC);
--	if (token >= 0)
-+	token = idr_alloc(&dev->token, *ptxwi, start, start + dev->token_size,
-+			  GFP_ATOMIC);
-+	if (token >= start)
- 		dev->token_count++;
- 
--#ifdef CONFIG_NET_MEDIATEK_SOC_WED
--	if (mtk_wed_device_active(&dev->mmio.wed) &&
--	    token >= dev->mmio.wed.wlan.token_start)
--		dev->wed_token_count++;
--#endif
--
- 	if (dev->token_count >= dev->token_size - MT76_TOKEN_FREE_THR)
- 		__mt76_set_tx_blocked(dev, true);
- 
-@@ -867,17 +865,9 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
- 	spin_lock_bh(&dev->token_lock);
- 
- 	txwi = idr_remove(&dev->token, token);
--	if (txwi) {
-+	if (txwi)
- 		dev->token_count--;
- 
--#ifdef CONFIG_NET_MEDIATEK_SOC_WED
--		if (mtk_wed_device_active(&dev->mmio.wed) &&
--		    token >= dev->mmio.wed.wlan.token_start &&
--		    --dev->wed_token_count == 0)
--			wake_up(&dev->tx_wait);
--#endif
--	}
--
- 	if (dev->token_count < dev->token_size - MT76_TOKEN_FREE_THR &&
- 	    dev->phy.q_tx[0]->blocked)
- 		*wake = true;
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/9999-mt76-revert-for-backports-5.15-wireless-stack.patch b/recipes-wifi/linux-mt76/files/patches/9999-mt76-revert-for-backports-5.15-wireless-stack.patch
index bfdccbe..95eeb1e 100644
--- a/recipes-wifi/linux-mt76/files/patches/9999-mt76-revert-for-backports-5.15-wireless-stack.patch
+++ b/recipes-wifi/linux-mt76/files/patches/9999-mt76-revert-for-backports-5.15-wireless-stack.patch
@@ -1,4 +1,4 @@
-From f3bff74b5e1bb3a1d3b6f82c0f9a13f45f99fd56 Mon Sep 17 00:00:00 2001
+From 7b82a7ca86e377e26747dd57ec4cd5badc9d4bcb Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 5 Apr 2023 08:29:19 +0800
 Subject: [PATCH] mt76: revert for backports-5.15 wireless stack
@@ -6,12 +6,12 @@
 wifi: mt76: mt7915: add support for he ldpc control from hostapd
 ---
  dma.c             |   2 +-
- mac80211.c        |  15 +--
+ mac80211.c        |   4 +-
  mt7615/dma.c      |   4 +-
  mt7615/main.c     |   6 +-
  mt7615/mcu.c      |   8 +-
  mt76_connac_mac.c |   2 +-
- mt76_connac_mcu.c | 117 ++++++++++------------
+ mt76_connac_mcu.c | 108 ++++++++++----------
  mt76x02_mac.c     |   6 +-
  mt7915/debugfs.c  |   4 +-
  mt7915/dma.c      |   4 +-
@@ -21,13 +21,13 @@
  mt7915/mmio.c     |   2 +-
  mt7915/testmode.c |   8 +-
  tx.c              |  22 ++---
- 16 files changed, 259 insertions(+), 226 deletions(-)
+ 16 files changed, 256 insertions(+), 209 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 7c5e623..908852c 100644
+index 4daa64da..220e684a 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -996,7 +996,7 @@ mt76_dma_init(struct mt76_dev *dev,
+@@ -994,7 +994,7 @@ mt76_dma_init(struct mt76_dev *dev,
  	init_completion(&dev->mmio.wed_reset_complete);
  
  	mt76_for_each_q_rx(dev, i) {
@@ -37,28 +37,10 @@
  		napi_enable(&dev->napi[i]);
  	}
 diff --git a/mac80211.c b/mac80211.c
-index 6232534..137c520 100644
+index 35cd297c..629770c0 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -1046,14 +1046,9 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb,
- 	status->enc_flags = mstat.enc_flags;
- 	status->encoding = mstat.encoding;
- 	status->bw = mstat.bw;
--	if (status->encoding == RX_ENC_EHT) {
--		status->eht.ru = mstat.eht.ru;
--		status->eht.gi = mstat.eht.gi;
--	} else {
--		status->he_ru = mstat.he_ru;
--		status->he_gi = mstat.he_gi;
--		status->he_dcm = mstat.he_dcm;
--	}
-+	status->he_ru = mstat.he_ru;
-+	status->he_gi = mstat.he_gi;
-+	status->he_dcm = mstat.he_dcm;
- 	status->rate_idx = mstat.rate_idx;
- 	status->nss = mstat.nss;
- 	status->band = mstat.band;
-@@ -1573,7 +1568,7 @@ EXPORT_SYMBOL_GPL(mt76_get_sar_power);
+@@ -1521,7 +1521,7 @@ EXPORT_SYMBOL_GPL(mt76_get_sar_power);
  static void
  __mt76_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -67,7 +49,7 @@
  		ieee80211_csa_finish(vif);
  }
  
-@@ -1595,7 +1590,7 @@ __mt76_csa_check(void *priv, u8 *mac, struct ieee80211_vif *vif)
+@@ -1543,7 +1543,7 @@ __mt76_csa_check(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
  	struct mt76_dev *dev = priv;
  
@@ -77,7 +59,7 @@
  
  	dev->csa_complete |= ieee80211_beacon_cntdwn_is_complete(vif);
 diff --git a/mt7615/dma.c b/mt7615/dma.c
-index 0ce01cc..ad32485 100644
+index 0ce01ccc..ad324850 100644
 --- a/mt7615/dma.c
 +++ b/mt7615/dma.c
 @@ -282,8 +282,8 @@ int mt7615_dma_init(struct mt7615_dev *dev)
@@ -92,7 +74,7 @@
  
  	mt76_poll(dev, MT_WPDMA_GLO_CFG,
 diff --git a/mt7615/main.c b/mt7615/main.c
-index dab16b5..d32a752 100644
+index 200b1752..53f30a0f 100644
 --- a/mt7615/main.c
 +++ b/mt7615/main.c
 @@ -473,7 +473,7 @@ static int mt7615_config(struct ieee80211_hw *hw, u32 changed)
@@ -123,7 +105,7 @@
  	if (changed & BSS_CHANGED_MU_GROUPS)
  		 mt7615_update_mu_group(hw, vif, info);
 diff --git a/mt7615/mcu.c b/mt7615/mcu.c
-index db337aa..c4d9743 100644
+index 86061e95..a79308b6 100644
 --- a/mt7615/mcu.c
 +++ b/mt7615/mcu.c
 @@ -353,7 +353,7 @@ out:
@@ -163,10 +145,10 @@
  		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
  	};
 diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index 02d5232..faeae26 100644
+index b87b7335..08a92ace 100644
 --- a/mt76_connac_mac.c
 +++ b/mt76_connac_mac.c
-@@ -1110,7 +1110,7 @@ void mt76_connac2_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
+@@ -1122,7 +1122,7 @@ void mt76_connac2_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  	u32 val;
  
  	if (!sta ||
@@ -176,10 +158,10 @@
  
  	tid = le32_get_bits(txwi[1], MT_TXD1_TID);
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 07bd57b..aa99bd7 100644
+index e6b468c4..220c1335 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -198,7 +198,7 @@ int mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif)
+@@ -197,7 +197,7 @@ int mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif)
  			      */
  	} req = {
  		.bss_idx = mvif->idx,
@@ -188,7 +170,7 @@
  	};
  
  	if (vif->type != NL80211_IFTYPE_STATION)
-@@ -410,7 +410,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -409,7 +409,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  		else
  			conn_type = CONNECTION_INFRA_AP;
  		basic->conn_type = cpu_to_le32(conn_type);
@@ -197,7 +179,7 @@
  		break;
  	case NL80211_IFTYPE_ADHOC:
  		basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
-@@ -554,7 +554,7 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
+@@ -553,7 +553,7 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
  
  	if (sta) {
  		if (vif->type == NL80211_IFTYPE_STATION)
@@ -206,7 +188,7 @@
  		else
  			generic->partial_aid = cpu_to_le16(sta->aid);
  		memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
-@@ -603,14 +603,14 @@ mt76_connac_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -602,14 +602,14 @@ mt76_connac_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  	    vif->type != NL80211_IFTYPE_STATION)
  		return;
  
@@ -223,7 +205,7 @@
  			       IEEE80211_MAX_MPDU_LEN_VHT_7991;
  
  	wcid->amsdu = true;
-@@ -621,7 +621,7 @@ mt76_connac_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -620,7 +620,7 @@ mt76_connac_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  static void
  mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  {
@@ -232,7 +214,7 @@
  	struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
  	struct sta_rec_he *he;
  	struct tlv *tlv;
-@@ -709,7 +709,7 @@ mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -708,7 +708,7 @@ mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  
  	he->he_cap = cpu_to_le32(cap);
  
@@ -241,8 +223,8 @@
  	case IEEE80211_STA_RX_BW_160:
  		if (elem->phy_cap_info[0] &
  		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
-@@ -754,7 +754,7 @@ mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
- void
+@@ -753,7 +753,7 @@ mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+ static void
  mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
  {
 -	struct ieee80211_sta_he_cap *he_cap = &sta->deflink.he_cap;
@@ -250,7 +232,7 @@
  	struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
  	struct sta_rec_he_v2 *he;
  	struct tlv *tlv;
-@@ -765,7 +765,7 @@ mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -764,7 +764,7 @@ mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
  	memcpy(he->he_phy_cap, elem->phy_cap_info, sizeof(he->he_phy_cap));
  	memcpy(he->he_mac_cap, elem->mac_cap_info, sizeof(he->he_mac_cap));
  
@@ -259,62 +241,29 @@
  	case IEEE80211_STA_RX_BW_160:
  		if (elem->phy_cap_info[0] &
  		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
-@@ -781,7 +781,7 @@ mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -780,7 +780,7 @@ mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
  		break;
  	}
  
 -	he->pkt_ext = IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_16US;
 +	he->pkt_ext = IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_16US;
  }
- EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_he_tlv_v2);
  
-@@ -792,14 +792,12 @@ mt76_connac_get_phy_mode_v2(struct mt76_phy *mphy, struct ieee80211_vif *vif,
- 	struct ieee80211_sta_ht_cap *ht_cap;
- 	struct ieee80211_sta_vht_cap *vht_cap;
- 	const struct ieee80211_sta_he_cap *he_cap;
--	const struct ieee80211_sta_eht_cap *eht_cap;
+ static u8
+@@ -793,9 +793,9 @@ mt76_connac_get_phy_mode_v2(struct mt76_phy *mphy, struct ieee80211_vif *vif,
  	u8 mode = 0;
  
  	if (sta) {
 -		ht_cap = &sta->deflink.ht_cap;
 -		vht_cap = &sta->deflink.vht_cap;
 -		he_cap = &sta->deflink.he_cap;
--		eht_cap = &sta->deflink.eht_cap;
 +		ht_cap = &sta->ht_cap;
 +		vht_cap = &sta->vht_cap;
 +		he_cap = &sta->he_cap;
  	} else {
  		struct ieee80211_supported_band *sband;
  
-@@ -807,7 +805,6 @@ mt76_connac_get_phy_mode_v2(struct mt76_phy *mphy, struct ieee80211_vif *vif,
- 		ht_cap = &sband->ht_cap;
- 		vht_cap = &sband->vht_cap;
- 		he_cap = ieee80211_get_he_iftype_cap(sband, vif->type);
--		eht_cap = ieee80211_get_eht_iftype_cap(sband, vif->type);
- 	}
- 
- 	if (band == NL80211_BAND_2GHZ) {
-@@ -818,9 +815,6 @@ mt76_connac_get_phy_mode_v2(struct mt76_phy *mphy, struct ieee80211_vif *vif,
- 
- 		if (he_cap && he_cap->has_he)
- 			mode |= PHY_TYPE_BIT_HE;
--
--		if (eht_cap && eht_cap->has_eht)
--			mode |= PHY_TYPE_BIT_BE;
- 	} else if (band == NL80211_BAND_5GHZ || band == NL80211_BAND_6GHZ) {
- 		mode |= PHY_TYPE_BIT_OFDM;
- 
-@@ -832,9 +826,6 @@ mt76_connac_get_phy_mode_v2(struct mt76_phy *mphy, struct ieee80211_vif *vif,
- 
- 		if (he_cap && he_cap->has_he)
- 			mode |= PHY_TYPE_BIT_HE;
--
--		if (eht_cap && eht_cap->has_eht)
--			mode |= PHY_TYPE_BIT_BE;
- 	}
- 
- 	return mode;
-@@ -858,25 +849,25 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -844,25 +844,25 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  	u16 supp_rates;
  
  	/* starec ht */
@@ -346,7 +295,7 @@
  	}
  
  	/* starec uapsd */
-@@ -885,11 +876,11 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -871,11 +871,11 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  	if (!is_mt7921(dev))
  		return;
  
@@ -360,7 +309,7 @@
  		mt76_connac_mcu_sta_he_tlv(skb, sta);
  		mt76_connac_mcu_sta_he_tlv_v2(skb, sta);
  		if (band == NL80211_BAND_6GHZ &&
-@@ -899,7 +890,7 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -885,7 +885,7 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  			tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G,
  						      sizeof(*he_6g_capa));
  			he_6g_capa = (struct sta_rec_he_6g_capa *)tlv;
@@ -369,7 +318,7 @@
  		}
  	}
  
-@@ -909,14 +900,14 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -895,14 +895,14 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  	phy->basic_rate = cpu_to_le16((u16)vif->bss_conf.basic_rates);
  	phy->rcpi = rcpi;
  	phy->ampdu = FIELD_PREP(IEEE80211_HT_AMPDU_PARM_FACTOR,
@@ -387,7 +336,7 @@
  	if (band == NL80211_BAND_2GHZ)
  		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates >> 4) |
  			     FIELD_PREP(RA_LEGACY_CCK, supp_rates & 0xf);
-@@ -925,18 +916,18 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -911,18 +911,18 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  
  	ra_info->legacy = cpu_to_le16(supp_rates);
  
@@ -411,7 +360,7 @@
  			IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
  	}
  }
-@@ -952,7 +943,7 @@ void mt76_connac_mcu_wtbl_smps_tlv(struct sk_buff *skb,
+@@ -938,7 +938,7 @@ void mt76_connac_mcu_wtbl_smps_tlv(struct sk_buff *skb,
  	tlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
  					     wtbl_tlv, sta_wtbl);
  	smps = (struct wtbl_smps *)tlv;
@@ -420,7 +369,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_connac_mcu_wtbl_smps_tlv);
  
-@@ -964,27 +955,27 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -950,27 +950,27 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  	struct tlv *tlv;
  	u32 flags = 0;
  
@@ -456,7 +405,7 @@
  		struct wtbl_vht *vht;
  		u8 af;
  
-@@ -993,18 +984,18 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -979,18 +979,18 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  						     sta_wtbl);
  		vht = (struct wtbl_vht *)tlv;
  		vht->ldpc = vht_ldpc &&
@@ -478,7 +427,7 @@
  		/* sgi */
  		u32 msk = MT_WTBL_W5_SHORT_GI_20 | MT_WTBL_W5_SHORT_GI_40 |
  			  MT_WTBL_W5_SHORT_GI_80 | MT_WTBL_W5_SHORT_GI_160;
-@@ -1014,15 +1005,15 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -1000,15 +1000,15 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  						     sizeof(*raw), wtbl_tlv,
  						     sta_wtbl);
  
@@ -499,7 +448,7 @@
  				flags |= MT_WTBL_W5_SHORT_GI_160;
  		}
  		raw = (struct wtbl_raw *)tlv;
-@@ -1311,9 +1302,9 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
+@@ -1297,9 +1297,9 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
  		return 0x38;
  
  	if (sta) {
@@ -512,7 +461,7 @@
  	} else {
  		struct ieee80211_supported_band *sband;
  
-@@ -1636,7 +1627,6 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
+@@ -1619,7 +1619,6 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
  	for (i = 0; i < sreq->n_ssids; i++) {
  		if (!sreq->ssids[i].ssid_len)
  			continue;
@@ -520,7 +469,7 @@
  		req->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
  		memcpy(req->ssids[i].ssid, sreq->ssids[i].ssid,
  		       sreq->ssids[i].ssid_len);
-@@ -1776,7 +1766,6 @@ int mt76_connac_mcu_sched_scan_req(struct mt76_phy *phy,
+@@ -1759,7 +1758,6 @@ int mt76_connac_mcu_sched_scan_req(struct mt76_phy *phy,
  		memcpy(req->ssids[i].ssid, ssid->ssid, ssid->ssid_len);
  		req->ssids[i].ssid_len = cpu_to_le32(ssid->ssid_len);
  	}
@@ -528,7 +477,7 @@
  	req->match_num = sreq->n_match_sets;
  	for (i = 0; i < req->match_num; i++) {
  		match = &sreq->match_sets[i];
-@@ -2272,10 +2261,8 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
+@@ -2246,10 +2244,8 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
  				      struct mt76_vif *vif,
  				      struct ieee80211_bss_conf *info)
  {
@@ -540,7 +489,7 @@
  			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
  	struct {
  		struct {
-@@ -2303,7 +2290,7 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
+@@ -2277,7 +2273,7 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
  
  	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
  	for (i = 0; i < len; i++)
@@ -550,7 +499,7 @@
  	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(OFFLOAD), true);
  }
 diff --git a/mt76x02_mac.c b/mt76x02_mac.c
-index d5db6ff..fec3d10 100644
+index d5db6ffd..fec3d10d 100644
 --- a/mt76x02_mac.c
 +++ b/mt76x02_mac.c
 @@ -404,7 +404,7 @@ void mt76x02_mac_write_txwi(struct mt76x02_dev *dev, struct mt76x02_txwi *txwi,
@@ -575,10 +524,10 @@
  		if (info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)
  			ba_size = 0;
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index fd35b57..117ebb5 100644
+index fefa4540..848ba4ee 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
-@@ -2049,8 +2049,8 @@ static ssize_t mt7915_sta_fixed_rate_set(struct file *file,
+@@ -2045,8 +2045,8 @@ static ssize_t mt7915_sta_fixed_rate_set(struct file *file,
  
  	phy.ldpc = (phy.bw || phy.ldpc) * GENMASK(2, 0);
  	for (i = 0; i <= phy.bw; i++) {
@@ -590,7 +539,7 @@
  	field = RATE_PARAM_FIXED;
  
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index f71ec55..b4e231b 100644
+index f71ec55b..b4e231b7 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -590,8 +590,8 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -605,10 +554,10 @@
  
  	mt7915_dma_enable(dev, false);
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 2100820..9327b02 100644
+index 2e9c94fb..b30aaea2 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -1154,8 +1154,7 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
+@@ -1157,8 +1157,7 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
  			mt76_connac_gen_ppe_thresh(he_cap->ppe_thres, nss);
  		} else {
  			he_cap_elem->phy_cap_info[9] |=
@@ -619,10 +568,10 @@
  
  		if (band == NL80211_BAND_6GHZ) {
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 8784a02..7108620 100644
+index deef1bb6..14b691a2 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -537,7 +537,7 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
+@@ -532,7 +532,7 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
  
  static int
  mt7915_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -631,7 +580,7 @@
  	       const struct ieee80211_tx_queue_params *params)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
-@@ -638,7 +638,7 @@ mt7915_update_bss_color(struct ieee80211_hw *hw,
+@@ -627,7 +627,7 @@ mt7915_update_bss_color(struct ieee80211_hw *hw,
  static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
  				    struct ieee80211_vif *vif,
  				    struct ieee80211_bss_conf *info,
@@ -640,7 +589,7 @@
  {
  	struct mt7915_phy *phy = mt7915_hw_phy(hw);
  	struct mt7915_dev *dev = mt7915_hw_dev(hw);
-@@ -654,7 +654,7 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
+@@ -643,7 +643,7 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
  	    vif->type == NL80211_IFTYPE_STATION)
  		set_bss_info = set_sta = !is_zero_ether_addr(info->bssid);
  	if (changed & BSS_CHANGED_ASSOC)
@@ -649,7 +598,7 @@
  	if (changed & BSS_CHANGED_BEACON_ENABLED &&
  	    vif->type != NL80211_IFTYPE_AP)
  		set_bss_info = set_sta = info->enable_beacon;
-@@ -702,27 +702,8 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
+@@ -691,27 +691,8 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
  	mutex_unlock(&dev->mt76.mutex);
  }
  
@@ -678,7 +627,7 @@
  {
  	struct mt7915_phy *phy = mt7915_hw_phy(hw);
  	struct mt7915_dev *dev = mt7915_hw_dev(hw);
-@@ -730,8 +711,6 @@ mt7915_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -719,8 +700,6 @@ mt7915_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  
  	mutex_lock(&dev->mt76.mutex);
  
@@ -687,7 +636,7 @@
  	err = mt7915_mcu_add_bss_info(phy, vif, true);
  	if (err)
  		goto out;
-@@ -743,8 +722,7 @@ out:
+@@ -732,8 +711,7 @@ out:
  }
  
  static void
@@ -697,7 +646,7 @@
  {
  	struct mt7915_dev *dev = mt7915_hw_dev(hw);
  
-@@ -1307,10 +1285,10 @@ static int mt7915_sta_set_txpwr(struct ieee80211_hw *hw,
+@@ -1296,10 +1274,10 @@ static int mt7915_sta_set_txpwr(struct ieee80211_hw *hw,
  {
  	struct mt7915_phy *phy = mt7915_hw_phy(hw);
  	struct mt7915_dev *dev = mt7915_hw_dev(hw);
@@ -711,7 +660,7 @@
  
  	mutex_lock(&dev->mt76.mutex);
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d4b0617..7f0e525 100644
+index 7c3e25c6..8dce1dea 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -67,7 +67,7 @@ mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
@@ -769,12 +718,12 @@
  static void
  mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
--	if (!vif->bss_conf.csa_active || vif->type == NL80211_IFTYPE_STATION)
+-	if (vif->bss_conf.csa_active && vif->type != NL80211_IFTYPE_STATION)
 +	if (vif->csa_active && vif->type != NL80211_IFTYPE_STATION)
- 		return;
+ 		ieee80211_csa_finish(vif);
+ }
  
- 	ieee80211_csa_finish(vif);
-@@ -339,7 +339,7 @@ mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -337,7 +337,7 @@ mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
  static void
  mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -783,7 +732,7 @@
  		return;
  
  	ieee80211_color_change_finish(vif);
-@@ -754,13 +754,13 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -752,13 +752,13 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  		      struct ieee80211_vif *vif)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
@@ -799,7 +748,7 @@
  		return;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
-@@ -846,8 +846,8 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -844,8 +844,8 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  
  	he->he_cap = cpu_to_le32(cap);
  
@@ -810,7 +759,7 @@
  	case IEEE80211_STA_RX_BW_160:
  		if (elem->phy_cap_info[0] &
  		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
-@@ -897,7 +897,7 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -895,7 +895,7 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  			struct ieee80211_sta *sta, struct ieee80211_vif *vif)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
@@ -819,7 +768,7 @@
  	struct mt7915_phy *phy = mvif->phy;
  	struct sta_rec_muru *muru;
  	struct tlv *tlv;
-@@ -922,11 +922,11 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -920,11 +920,11 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	muru->cfg.ofdma_dl_en = !!(phy->muru_onoff & OFDMA_DL);
  	muru->cfg.ofdma_ul_en = !!(phy->muru_onoff & OFDMA_UL);
  
@@ -834,7 +783,7 @@
  		return;
  
  	muru->mimo_dl.partial_bw_dl_mimo =
-@@ -962,13 +962,13 @@ mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -960,13 +960,13 @@ mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	struct sta_rec_ht *ht;
  	struct tlv *tlv;
  
@@ -850,7 +799,7 @@
  }
  
  static void
-@@ -977,15 +977,15 @@ mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -975,15 +975,15 @@ mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	struct sta_rec_vht *vht;
  	struct tlv *tlv;
  
@@ -870,7 +819,7 @@
  }
  
  static void
-@@ -1000,7 +1000,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -998,7 +998,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	    vif->type != NL80211_IFTYPE_AP)
  		return;
  
@@ -879,7 +828,7 @@
  	    return;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
-@@ -1009,7 +1009,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1007,7 +1007,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	amsdu->amsdu_en = true;
  	msta->wcid.amsdu = true;
  
@@ -888,7 +837,7 @@
  	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
  		if (!is_mt7915(&dev->mt76)) {
  			amsdu->max_mpdu_size =
-@@ -1072,8 +1072,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -1070,8 +1070,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  	if (!bfee && sts < 2)
  		return false;
  
@@ -899,7 +848,7 @@
  
  		if (bfee)
  			return mvif->cap.he_su_ebfee &&
-@@ -1083,8 +1083,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -1081,8 +1081,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
  	}
  
@@ -910,7 +859,7 @@
  
  		if (bfee)
  			return mvif->cap.vht_su_ebfee &&
-@@ -1110,7 +1110,7 @@ static void
+@@ -1108,7 +1108,7 @@ static void
  mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
  		       struct sta_rec_bf *bf)
  {
@@ -919,7 +868,7 @@
  	u8 n = 0;
  
  	bf->tx_mode = MT_PHY_TYPE_HT;
-@@ -1135,7 +1135,7 @@ static void
+@@ -1133,7 +1133,7 @@ static void
  mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
  			struct sta_rec_bf *bf, bool explicit)
  {
@@ -928,7 +877,7 @@
  	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
  	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
  	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
-@@ -1156,14 +1156,14 @@ mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
+@@ -1154,14 +1154,14 @@ mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
  		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
  		bf->ibf_ncol = bf->ncol;
  
@@ -945,7 +894,7 @@
  			bf->ibf_nrow = 1;
  	}
  }
-@@ -1172,7 +1172,7 @@ static void
+@@ -1170,7 +1170,7 @@ static void
  mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
  {
@@ -954,7 +903,7 @@
  	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
  	const struct ieee80211_sta_he_cap *vc =
  		mt76_connac_get_he_phy_cap(phy->mt76, vif);
-@@ -1197,7 +1197,7 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+@@ -1195,7 +1195,7 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
  	bf->ibf_ncol = bf->ncol;
  
@@ -963,7 +912,7 @@
  		return;
  
  	/* go over for 160MHz and 80p80 */
-@@ -1245,7 +1245,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1243,7 +1243,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	};
  	bool ebf;
  
@@ -972,7 +921,7 @@
  		return;
  
  	ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
-@@ -1259,21 +1259,21 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1257,21 +1257,21 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	 * vht: support eBF and iBF
  	 * ht: iBF only, since mac80211 lacks of eBF support
  	 */
@@ -1000,7 +949,7 @@
  		bf->ibf_timeout = 0x48;
  	else
  		bf->ibf_timeout = 0x18;
-@@ -1283,7 +1283,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1281,7 +1281,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	else
  		bf->mem_20m = matrix[bf->nrow][bf->ncol];
  
@@ -1009,7 +958,7 @@
  	case IEEE80211_STA_RX_BW_160:
  	case IEEE80211_STA_RX_BW_80:
  		bf->mem_total = bf->mem_20m * 2;
-@@ -1308,7 +1308,7 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1306,7 +1306,7 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	struct tlv *tlv;
  	u8 nrow = 0;
  
@@ -1018,7 +967,7 @@
  		return;
  
  	if (!mt7915_is_ebf_supported(phy, vif, sta, true))
-@@ -1317,13 +1317,13 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1315,13 +1315,13 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
  	bfee = (struct sta_rec_bfee *)tlv;
  
@@ -1036,7 +985,7 @@
  
  		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
  				 pc->cap);
-@@ -1379,7 +1379,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -1377,7 +1377,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  			ra->phy = *phy;
  		break;
  	case RATE_PARAM_MMPS_UPDATE:
@@ -1045,7 +994,7 @@
  		break;
  	case RATE_PARAM_SPE_UPDATE:
  		ra->spe_idx = *(u8 *)data;
-@@ -1454,7 +1454,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1452,7 +1452,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  	do {									\
  		u8 i, gi = mask->control[band]._gi;				\
  		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
@@ -1054,7 +1003,7 @@
  			phy.sgi |= gi << (i << (_he));				\
  			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
  		}								\
-@@ -1468,11 +1468,11 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1466,11 +1466,11 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  		}								\
  	} while (0)
  
@@ -1069,7 +1018,7 @@
  		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
  	} else {
  		nrates = hweight32(mask->control[band].legacy);
-@@ -1506,7 +1506,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1504,7 +1504,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  		 * actual txrate hardware sends out.
  		 */
  		addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
@@ -1078,7 +1027,7 @@
  			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
  		else
  			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
-@@ -1539,7 +1539,7 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1537,7 +1537,7 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  	enum nl80211_band band = chandef->chan->band;
  	struct sta_rec_ra *ra;
  	struct tlv *tlv;
@@ -1087,7 +1036,7 @@
  	u32 cap = sta->wme ? STA_CAP_WMM : 0;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
-@@ -1549,9 +1549,9 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1547,9 +1547,9 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  	ra->auto_rate = true;
  	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
  	ra->channel = chandef->chan->hw_value;
@@ -1100,7 +1049,7 @@
  
  	if (supp_rate) {
  		supp_rate &= mask->control[band].legacy;
-@@ -1571,22 +1571,22 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1569,22 +1569,22 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  		}
  	}
  
@@ -1131,7 +1080,7 @@
  			cap |= STA_CAP_LDPC;
  
  		mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
-@@ -1594,37 +1594,37 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1592,37 +1592,37 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
  	}
  
@@ -1179,7 +1128,7 @@
  					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
  	}
  
-@@ -1833,7 +1833,7 @@ mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
+@@ -1831,7 +1831,7 @@ mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
  	if (!offs->cntdwn_counter_offs[0])
  		return;
  
@@ -1188,7 +1137,7 @@
  	tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
  					   &bcn->sub_ntlv, &bcn->len);
  	info = (struct bss_info_bcn_cntdwn *)tlv;
-@@ -1918,9 +1918,9 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1916,9 +1916,9 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  	if (offs->cntdwn_counter_offs[0]) {
  		u16 offset = offs->cntdwn_counter_offs[0];
  
@@ -1200,7 +1149,7 @@
  			cont->bcc_ofs = cpu_to_le16(offset - 3);
  	}
  
-@@ -1930,6 +1930,85 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1928,6 +1928,85 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
  }
  
@@ -1286,7 +1235,7 @@
  int
  mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  			     u32 changed)
-@@ -2043,7 +2122,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2041,7 +2120,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	if (!en)
  		goto out;
  
@@ -1295,7 +1244,7 @@
  	if (!skb) {
  		dev_kfree_skb(rskb);
  		return -EINVAL;
-@@ -2059,6 +2138,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2057,6 +2136,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	info = IEEE80211_SKB_CB(skb);
  	info->hw_queue = FIELD_PREP(MT_TX_HW_QUEUE_PHY, ext_phy);
  
@@ -1303,7 +1252,7 @@
  	mt7915_mcu_beacon_cntdwn(vif, rskb, skb, bcn, &offs);
  	mt7915_mcu_beacon_mbss(rskb, skb, vif, bcn, &offs);
  	mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
-@@ -3331,17 +3411,17 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3329,17 +3409,17 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  	if (txpower) {
  		u32 offs, len, i;
  
@@ -1325,7 +1274,7 @@
  					len = sku_len[SKU_HE_RU242] * 4;
  				}
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index b677947..1e99811 100644
+index aa5c5dd6..08e7c52f 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -689,7 +689,7 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
@@ -1338,7 +1287,7 @@
  			skb_free_frag(ptr);
  			mt76_put_rxwi(&dev->mt76, r);
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index d5c74df..38ac79d 100644
+index d5c74dfd..38ac79d6 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -416,12 +416,12 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
@@ -1359,7 +1308,7 @@
  	sta->wme = 1;
  
 diff --git a/tx.c b/tx.c
-index 96f9009..23a1e4e 100644
+index 2594a625..26fa6650 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -60,20 +60,15 @@ mt76_tx_status_unlock(struct mt76_dev *dev, struct sk_buff_head *list)
@@ -1415,5 +1364,5 @@
  		ieee80211_tx_status_ext(hw, &status);
  		spin_unlock_bh(&dev->rx_lock);
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/patches.inc b/recipes-wifi/linux-mt76/files/patches/patches.inc
index abc13f5..167020d 100644
--- a/recipes-wifi/linux-mt76/files/patches/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches/patches.inc
@@ -1,12 +1,20 @@
 #patch patches (come from openwrt/lede/target/linux/mediatek)
 SRC_URI_append = " \
-    file://0001-wifi-mt76-fix-incorrect-HE-TX-GI-report.patch \
-    file://0002-wifi-mt76-mt7915-add-pc-stack-dump-for-WM-s-coredump.patch \
-    file://0003-wifi-mt76-mt7915-move-temperature-margin-check-to-mt.patch \
-    file://0004-wifi-mt76-mt7915-fix-txpower-issues.patch \
-    file://0005-wifi-mt76-mt7915-rework-init-txpower.patch \
-    file://0006-wifi-mt76-mt7915-rework-mmio-access-flow.patch \
-    file://0007-wifi-mt76-disable-HW-AMSDU-when-using-fixed-rate.patch \
+    file://0001-wifi-mt76-mt7915-update-beacon-size-limitation.patch \
+    file://0002-wifi-mt76-mt7915-check-sta-rx-control-frame-to-multi.patch \
+    file://0003-wifi-mt76-mt7915-fix-potential-memory-leak-of-beacon.patch \
+    file://0004-wifi-mt76-mt7915-get-rid-of-false-alamrs-of-tx-emiss.patch \
+    file://0005-wifi-mt76-mt7915-fix-per-band-IEEE80211_CONF_MONITOR.patch \
+    file://0006-wifi-mt76-mt7915-check-vif-type-before-reporting-cca.patch \
+    file://0007-wifi-mt76-mt7915-update-mpdu-density-capability.patch \
+    file://0008-wifi-mt76-mt7915-fix-beamforming-availability-check.patch \
+    file://0009-wifi-mt76-fix-incorrect-HE-TX-GI-report.patch \
+    file://0010-wifi-mt76-mt7915-add-pc-stack-dump-for-WM-s-coredump.patch \
+    file://0011-wifi-mt76-mt7915-move-temperature-margin-check-to-mt.patch \
+    file://0012-wifi-mt76-mt7915-fix-txpower-issues.patch \
+    file://0013-wifi-mt76-mt7915-rework-init-txpower.patch \
+    file://0014-wifi-mt76-mt7915-rework-mmio-access-flow.patch \
+    file://0015-wifi-mt76-disable-HW-AMSDU-when-using-fixed-rate.patch \
     file://0999-wifi-mt76-mt7915-build-pass-for-Linux-Kernel-5.4-fix.patch \
     file://1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch \
     file://1001-wifi-mt76-mt7915-csi-implement-csi-support.patch \
@@ -48,8 +56,6 @@
     file://1037-wifi-mt76-mt7915-enable-the-mac80211-hw-bmc-ps-buffe.patch \
     file://1038-wifi-mt76-update-debugfs-knob-to-dump-token-pending-.patch \
     file://1039-wifi-mt76-mt7915-support-enable-disable-spatial-reus.patch \
-    file://1040-wifi-mt76-mt7915-add-debug-log-for-SER-flow.patch \
-    file://1041-wifi-mt76-mt7915-add-additional-chain-signal-info-to.patch \
     file://2000-wifi-mt76-mt7915-wed-add-wed-tx-support.patch \
     file://2001-wifi-mt76-mt7915-wed-add-wds-support-when-wed-is-ena.patch \
     file://2002-wifi-mt76-mt7915-wed-add-fill-receive-path-to-report.patch \
@@ -59,8 +65,5 @@
     file://2006-wifi-mt76-add-debugfs-knob-to-show-packet-error-rate.patch \
     file://2007-wifi-mt76-mt7915-add-ctxd-support-for-mt7916.patch \
     file://2008-wifi-mt76-connac-wed-add-wed-rx-copy-skb.patch \
-    file://2009-wifi-mt76-mt7915-enable-wa-log-to-uart.patch \
-    file://2010-wifi-mt76-mt7915-add-error-message-when-driver-recei.patch \
-    file://2011-mt76-wifi-mt7915-wed-setting-wed-hw-tx-token-to-8192.patch \
     file://9999-mt76-revert-for-backports-5.15-wireless-stack.patch \
     "
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7981_eeprom.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7981_eeprom.bin
deleted file mode 100644
index 109fe88..0000000
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7981_eeprom.bin
+++ /dev/null
Binary files differ
diff --git a/recipes-wifi/linux-mt76/linux-mt76_3.x.bb b/recipes-wifi/linux-mt76/linux-mt76_3.x.bb
index b9a69c7..e77841d 100644
--- a/recipes-wifi/linux-mt76/linux-mt76_3.x.bb
+++ b/recipes-wifi/linux-mt76/linux-mt76_3.x.bb
@@ -5,7 +5,7 @@
 
 inherit module
 
-require mt76.inc
+require mt76-3x.inc
 SRC_URI = " \
     git://git@github.com/openwrt/mt76.git;protocol=https \
     file://COPYING;subdir=git \
diff --git a/recipes-wifi/linux-mt76/mt76-3x.inc b/recipes-wifi/linux-mt76/mt76-3x.inc
new file mode 100644
index 0000000..2cb6ffc
--- /dev/null
+++ b/recipes-wifi/linux-mt76/mt76-3x.inc
@@ -0,0 +1 @@
+SRCREV_mt7990 = "969b7b5ebd129068ca56e4b0d831593a2f92382f"
diff --git a/recipes-wifi/linux-mt76/mt76-test.bb b/recipes-wifi/linux-mt76/mt76-test.bb
index db836fc..63e8e3e 100644
--- a/recipes-wifi/linux-mt76/mt76-test.bb
+++ b/recipes-wifi/linux-mt76/mt76-test.bb
@@ -10,6 +10,7 @@
 PV = "1.0"
 
 require mt76.inc
+require mt76-3x.inc
 
 SRC_URI = " \
     git://git@github.com/openwrt/mt76.git;protocol=https \
diff --git a/recipes-wifi/linux-mt76/mt76.inc b/recipes-wifi/linux-mt76/mt76.inc
index b025358..b81583a 100644
--- a/recipes-wifi/linux-mt76/mt76.inc
+++ b/recipes-wifi/linux-mt76/mt76.inc
@@ -1 +1 @@
-SRCREV ?= "2afc7285f75dca5a0583fd917285bf33f1429cc6"
+SRCREV ?= "b14c2351ddb8601c322576d84029e463d456caef"