diff --git a/recipes-wifi/linux-mt76/files/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch b/recipes-wifi/linux-mt76/files/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch
index 113b411..2486ace 100644
--- a/recipes-wifi/linux-mt76/files/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch
@@ -1,4 +1,4 @@
-From 09ef6b695a93055d885869222614a936ed309dc2 Mon Sep 17 00:00:00 2001
+From 479f0201a71ac4d3d7fac187fe7b0eeb4bf490ae Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 6 Jun 2022 19:46:26 +0800
 Subject: [PATCH 1/3] mt76: mt7915: rework testmode init registers
@@ -11,10 +11,10 @@
  4 files changed, 55 insertions(+), 18 deletions(-)
 
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 3c840853..813d6f40 100644
+index 3b4ede3b..19518cb5 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -113,6 +113,7 @@ static const u32 mt7986_reg[] = {
+@@ -118,6 +118,7 @@ static const u32 mt7986_reg[] = {
  };
  
  static const u32 mt7915_offs[] = {
@@ -22,7 +22,7 @@
  	[TMAC_CDTR]		= 0x090,
  	[TMAC_ODTR]		= 0x094,
  	[TMAC_ATCR]		= 0x098,
-@@ -187,6 +188,7 @@ static const u32 mt7915_offs[] = {
+@@ -192,6 +193,7 @@ static const u32 mt7915_offs[] = {
  };
  
  static const u32 mt7916_offs[] = {
@@ -31,10 +31,10 @@
  	[TMAC_ODTR]		= 0x0cc,
  	[TMAC_ATCR]		= 0x00c,
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 0c61f125..947f02f2 100644
+index aca1b2f1..688f7dee 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -47,6 +47,7 @@ enum reg_rev {
+@@ -48,6 +48,7 @@ enum reg_rev {
  };
  
  enum offs_rev {
@@ -42,7 +42,7 @@
  	TMAC_CDTR,
  	TMAC_ODTR,
  	TMAC_ATCR,
-@@ -197,6 +198,12 @@ enum offs_rev {
+@@ -198,6 +199,12 @@ enum offs_rev {
  #define MT_TRB_RXPSR0_RX_WTBL_PTR	GENMASK(25, 16)
  #define MT_TRB_RXPSR0_RX_RMAC_PTR	GENMASK(9, 0)
  
@@ -55,7 +55,7 @@
  /* TMAC: band 0(0x820e4000), band 1(0x820f4000) */
  #define MT_WF_TMAC_BASE(_band)		((_band) ? 0x820f4000 : 0x820e4000)
  #define MT_WF_TMAC(_band, ofs)		(MT_WF_TMAC_BASE(_band) + (ofs))
-@@ -205,6 +212,9 @@ enum offs_rev {
+@@ -206,6 +213,9 @@ enum offs_rev {
  #define MT_TMAC_TCR0_TX_BLINK		GENMASK(7, 6)
  #define MT_TMAC_TCR0_TBTT_STOP_CTRL	BIT(25)
  
@@ -65,7 +65,7 @@
  #define MT_TMAC_CDTR(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_CDTR))
   #define MT_TMAC_ODTR(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_ODTR))
  #define MT_TIMEOUT_VAL_PLCP		GENMASK(15, 0)
-@@ -484,8 +494,10 @@ enum offs_rev {
+@@ -485,8 +495,10 @@ enum offs_rev {
  #define MT_AGG_PCR0_VHT_PROT		BIT(13)
  #define MT_AGG_PCR0_PTA_WIN_DIS		BIT(15)
  
@@ -79,7 +79,7 @@
  #define MT_AGG_ACR0(_band)		MT_WF_AGG(_band, __OFFS(AGG_ACR0))
  #define MT_AGG_ACR_CFEND_RATE		GENMASK(13, 0)
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index a979460f..819fafe4 100644
+index 7ace05e0..f7aacea7 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -30,7 +30,7 @@ struct reg_band {
diff --git a/recipes-wifi/linux-mt76/files/patches/0002-mt76-mt7915-rework-rx-testmode-stats.patch b/recipes-wifi/linux-mt76/files/patches/0002-mt76-mt7915-rework-rx-testmode-stats.patch
index 080285a..3195054 100644
--- a/recipes-wifi/linux-mt76/files/patches/0002-mt76-mt7915-rework-rx-testmode-stats.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0002-mt76-mt7915-rework-rx-testmode-stats.patch
@@ -1,4 +1,4 @@
-From 2e3e45da59fc715a8d6b4771d3773536944cb480 Mon Sep 17 00:00:00 2001
+From 3de6b1807318a65e6f586c01a30c9b50d5fe7594 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 3 Jan 2022 17:09:53 +0800
 Subject: [PATCH 2/3] mt76: mt7915: rework rx testmode stats
@@ -15,10 +15,10 @@
  8 files changed, 109 insertions(+), 17 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 30c1bc56..e5d8f45b 100644
+index acac04ef..9a908c9a 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -756,7 +756,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
+@@ -761,7 +761,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
  	}
  
  #ifdef CONFIG_NL80211_TESTMODE
@@ -29,10 +29,10 @@
  		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
  			phy->test.rx_stats.fcs_error[q]++;
 diff --git a/mt76.h b/mt76.h
-index a2bccf6b..1b468ccc 100644
+index 33f87e51..66059d2e 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -626,6 +626,8 @@ struct mt76_testmode_ops {
+@@ -637,6 +637,8 @@ struct mt76_testmode_ops {
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
  };
  
@@ -41,7 +41,7 @@
  struct mt76_testmode_data {
  	enum mt76_testmode_state state;
  
-@@ -657,6 +659,8 @@ struct mt76_testmode_data {
+@@ -668,6 +670,8 @@ struct mt76_testmode_data {
  
  	u8 addr[3][ETH_ALEN];
  
@@ -50,7 +50,7 @@
  	u32 tx_pending;
  	u32 tx_queued;
  	u16 tx_queued_limit;
-@@ -664,6 +668,7 @@ struct mt76_testmode_data {
+@@ -675,6 +679,7 @@ struct mt76_testmode_data {
  	struct {
  		u64 packets[__MT_RXQ_MAX];
  		u64 fcs_error[__MT_RXQ_MAX];
@@ -59,10 +59,10 @@
  };
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 87c65d25..b27a62aa 100644
+index 72d235a1..46584e6f 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1143,6 +1143,7 @@ enum {
+@@ -1169,6 +1169,7 @@ enum {
  	MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
  	MCU_EXT_CMD_SET_RDD_TH = 0x9d,
  	MCU_EXT_CMD_MURU_CTRL = 0x9f,
@@ -71,7 +71,7 @@
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index c19b5d66..a788277c 100644
+index 46c517e5..ff3eedab 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -9,6 +9,7 @@
@@ -83,7 +83,7 @@
  	MCU_ATE_CLEAN_TXQUEUE = 0x1c,
  };
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 819fafe4..8d99edcb 100644
+index f7aacea7..931d1db2 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -133,6 +133,21 @@ mt7915_tm_clean_hwq(struct mt7915_phy *phy, u8 wcid)
@@ -174,7 +174,7 @@
  		mt7915_tm_update_channel(phy);
  
  		/* read-clear */
--		mt76_rr(dev, MT_MIB_SDR3(phy != &dev->phy));
+-		mt76_rr(dev, MT_MIB_SDR3(phy->band_idx));
 +		mt7915_tm_get_rx_stats(phy, true);
 +
 +		/* clear fw count */
diff --git a/recipes-wifi/linux-mt76/files/patches/0003-mt76-mt7915-drop-undefined-action-frame.patch b/recipes-wifi/linux-mt76/files/patches/0003-mt76-mt7915-drop-undefined-action-frame.patch
index 6e9b9cf..eee92c7 100644
--- a/recipes-wifi/linux-mt76/files/patches/0003-mt76-mt7915-drop-undefined-action-frame.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0003-mt76-mt7915-drop-undefined-action-frame.patch
@@ -1,4 +1,4 @@
-From 6a6b3db016a9279fed1a0bf82ca22c8da4372f36 Mon Sep 17 00:00:00 2001
+From 7b6cdc212a271ba909f8ff569db4da70280606ee Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 14 Apr 2022 15:18:02 +0800
 Subject: [PATCH 3/3] mt76: mt7915: drop undefined action frame
@@ -8,10 +8,10 @@
  1 file changed, 6 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 99123e77..3e4033e7 100644
+index 97a19bdb..30b44b53 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -717,6 +717,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -749,6 +749,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  			  struct mt76_tx_info *tx_info)
  {
  	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx_info->skb->data;
@@ -20,7 +20,7 @@
  	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
  	struct ieee80211_key_conf *key = info->control.hw_key;
-@@ -747,6 +749,10 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -779,6 +781,10 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size);
  	t->skb = tx_info->skb;
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch b/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
index 4b47ac2..9cb4900 100644
--- a/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
@@ -1,7 +1,7 @@
-From 28fa372d1081e899eb59f776a3fbb27ed7105682 Mon Sep 17 00:00:00 2001
+From a1e88291d8d20a423b9975359d2196491e58b500 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 22 Jun 2022 10:39:47 +0800
-Subject: [PATCH] mt76: mt7915: add mtk internal debug tools for mt76
+Subject: [PATCH 1001/1008] mt76: mt7915: add mtk internal debug tools for mt76
 
 ---
  mt76_connac_mcu.h     |    7 +
@@ -22,10 +22,10 @@
  create mode 100644 mt7915/mtk_mcu.c
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index b27a62aa..f7d00726 100644
+index 46584e6f..c0fa2334 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1109,6 +1109,7 @@ enum {
+@@ -1135,6 +1135,7 @@ enum {
  	MCU_EXT_CMD_SET_TX_POWER_CTRL = 0x11,
  	MCU_EXT_CMD_FW_LOG_2_HOST = 0x13,
  	MCU_EXT_CMD_TXBF_ACTION = 0x1e,
@@ -33,7 +33,7 @@
  	MCU_EXT_CMD_EFUSE_BUFFER_MODE = 0x21,
  	MCU_EXT_CMD_THERMAL_PROT = 0x23,
  	MCU_EXT_CMD_STA_REC_UPDATE = 0x25,
-@@ -1132,6 +1133,12 @@ enum {
+@@ -1158,6 +1159,12 @@ enum {
  	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
  	MCU_EXT_CMD_RXDCOC_CAL = 0x59,
  	MCU_EXT_CMD_GET_MIB_INFO = 0x5a,
@@ -60,7 +60,7 @@
  mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 766e6208..21407030 100644
+index 30f8f18b..092d8434 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -8,6 +8,9 @@
@@ -137,7 +137,7 @@
  	return mt7915_fw_debug_wm_set(dev, dev->fw.debug_wm);
  }
  
-@@ -1090,6 +1120,11 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+@@ -1103,6 +1133,11 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
  	if (!ext_phy)
  		dev->debugfs_dir = dir;
  
@@ -149,7 +149,7 @@
  	return 0;
  }
  
-@@ -1130,17 +1165,53 @@ void mt7915_debugfs_rx_fw_monitor(struct mt7915_dev *dev, const void *data, int
+@@ -1143,17 +1178,53 @@ void mt7915_debugfs_rx_fw_monitor(struct mt7915_dev *dev, const void *data, int
  		.msg_type = cpu_to_le16(PKT_TYPE_RX_FW_MONITOR),
  	};
  
@@ -204,10 +204,10 @@
  
  	if (dev->relay_fwlog)
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 3e4033e7..931a3a14 100644
+index 30b44b53..609f10d4 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -271,6 +271,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -301,6 +301,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
  	__le16 fc = 0;
  	int idx;
  
@@ -218,7 +218,7 @@
  	memset(status, 0, sizeof(*status));
  
  	if ((rxd1 & MT_RXD1_NORMAL_BAND_IDX) && !phy->band_idx) {
-@@ -454,6 +458,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -484,6 +488,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
  	}
  
  	hdr_gap = (u8 *)rxd - skb->data + 2 * remove_pad;
@@ -229,7 +229,7 @@
  	if (hdr_trans && ieee80211_has_morefrags(fc)) {
  		struct ieee80211_vif *vif;
  		int err;
-@@ -795,6 +803,12 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -827,6 +835,12 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	tx_info->buf[1].skip_unmap = true;
  	tx_info->nbuf = MT_CT_DMA_BUF_NUM;
  
@@ -243,7 +243,7 @@
  }
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index fe5ec166..16ae61e5 100644
+index 2505fa7e..b6e5f97c 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -58,7 +58,11 @@ int mt7915_run(struct ieee80211_hw *hw)
@@ -259,10 +259,10 @@
  		goto out;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 09e3dd8e..9cd06a0c 100644
+index 36c21596..5af6de5d 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -195,6 +195,11 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
+@@ -199,6 +199,11 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
  	else
  		qid = MT_MCUQ_WM;
  
@@ -274,7 +274,7 @@
  	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
  }
  
-@@ -3199,6 +3204,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+@@ -3307,6 +3312,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
  		.sku_enable = enable,
  	};
  
@@ -283,7 +283,7 @@
  	return mt76_mcu_send_msg(&dev->mt76,
  				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
  				 sizeof(req), true);
-@@ -3474,6 +3481,43 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3744,6 +3751,43 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -327,7 +327,7 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  {
  	struct {
-@@ -3502,3 +3546,22 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
+@@ -3772,3 +3816,22 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  
  	return 0;
  }
@@ -351,10 +351,10 @@
 +}
 +#endif
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index a788277c..7f1216fe 100644
+index ff3eedab..2d057279 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -261,6 +261,10 @@ enum {
+@@ -272,6 +272,10 @@ enum {
  	MCU_WA_PARAM_PDMA_RX = 0x04,
  	MCU_WA_PARAM_CPU_UTIL = 0x0b,
  	MCU_WA_PARAM_RED = 0x0e,
@@ -366,7 +366,7 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 9cb680e7..25bec88f 100644
+index 42f21343..2f91020c 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -9,6 +9,7 @@
@@ -377,7 +377,7 @@
  #define MT7915_MAX_INTERFACES		19
  #define MT7915_WTBL_SIZE		288
  #define MT7916_WTBL_SIZE		544
-@@ -366,6 +367,29 @@ struct mt7915_dev {
+@@ -368,6 +369,29 @@ struct mt7915_dev {
  	struct reset_control *rstc;
  	void __iomem *dcm;
  	void __iomem *sku;
@@ -407,7 +407,7 @@
  };
  
  enum {
-@@ -638,4 +662,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -645,4 +669,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch b/recipes-wifi/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
index 654af4f..8af2b3a 100644
--- a/recipes-wifi/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
@@ -17,18 +17,18 @@
  create mode 100644 mt7915/vendor.h
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index f7d00726..dc1a2ef7 100644
+index c0fa2334..3ad59e53 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -984,6 +984,7 @@ enum {
+@@ -987,6 +987,7 @@ enum {
  	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
  	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
  	MCU_EXT_EVENT_MURU_CTRL = 0x9f,
 +	MCU_EXT_EVENT_CSI_REPORT = 0xc2,
  };
  
- enum {
-@@ -1155,6 +1156,7 @@ enum {
+ /* unified event table */
+@@ -1181,6 +1182,7 @@ enum {
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
@@ -37,7 +37,7 @@
  
  enum {
 diff --git a/mt7915/Makefile b/mt7915/Makefile
-index c663ceb1..830589d0 100644
+index a42866e9..14ce98a6 100644
 --- a/mt7915/Makefile
 +++ b/mt7915/Makefile
 @@ -1,9 +1,9 @@
@@ -52,12 +52,11 @@
  
  mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
- mt7915e-$(CONFIG_DEV_COREDUMP) += coredump.o
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 0a5f7d85..c3c4b97e 100644
+index 9e69ab82..34ace7c9 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -571,6 +571,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
+@@ -574,6 +574,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
  	/* init wiphy according to mphy and phy */
  	mt7915_init_wiphy(mphy->hw);
  
@@ -70,7 +69,7 @@
  	ret = mt76_register_phy(mphy, true, mt76_rates,
  				ARRAY_SIZE(mt76_rates));
  	if (ret)
-@@ -1076,6 +1082,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
+@@ -1079,6 +1085,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
  	}
  }
  
@@ -96,7 +95,7 @@
  static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  {
  	struct mt7915_phy *phy = mt7915_ext_phy(dev);
-@@ -1084,6 +1109,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
+@@ -1087,6 +1112,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  	if (!phy)
  		return;
  
@@ -107,7 +106,7 @@
  	mt7915_unregister_thermal(phy);
  	mt76_unregister_phy(mphy);
  	ieee80211_free_hw(mphy->hw);
-@@ -1096,6 +1125,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
+@@ -1099,6 +1128,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
  	mt7915_dma_cleanup(dev);
  	tasklet_disable(&dev->irq_tasklet);
  
@@ -118,7 +117,7 @@
  	if (is_mt7986(&dev->mt76))
  		mt7986_wmac_disable(dev);
  }
-@@ -1138,6 +1171,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
+@@ -1141,6 +1174,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
  	dev->mt76.test_ops = &mt7915_testmode_ops;
  #endif
  
@@ -132,12 +131,12 @@
  	if (IS_ENABLED(CONFIG_MT76_LEDS)) {
  		dev->mt76.led_cdev.brightness_set = mt7915_led_set_brightness;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 9cd06a0c..f49f9fa5 100644
+index 5af6de5d..e6cd1e2c 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -32,6 +32,10 @@
- #define HE_PHY(p, c)			u8_get_bits(c, IEEE80211_HE_PHY_##p)
- #define HE_MAC(m, c)			u8_get_bits(c, IEEE80211_HE_MAC_##m)
+@@ -36,6 +36,10 @@ static bool sr_scene_detect = true;
+ module_param(sr_scene_detect, bool, 0644);
+ MODULE_PARM_DESC(sr_scene_detect, "Enable firmware scene detection algorithm");
  
 +#ifdef CONFIG_MTK_VENDOR
 +static int mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb);
@@ -146,7 +145,7 @@
  static u8
  mt7915_mcu_get_sta_nss(u16 mcs_map)
  {
-@@ -351,6 +355,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -355,6 +359,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	case MCU_EXT_EVENT_FW_LOG_2_HOST:
  		mt7915_mcu_rx_log_message(dev, skb);
  		break;
@@ -158,7 +157,7 @@
  	case MCU_EXT_EVENT_BCC_NOTIFY:
  		mt7915_mcu_rx_bcc_notify(dev, skb);
  		break;
-@@ -3481,6 +3490,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3751,6 +3760,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -268,10 +267,10 @@
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 7f1216fe..974cd13c 100644
+index 2d057279..8ec15c22 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -484,4 +484,80 @@ enum {
+@@ -514,4 +514,80 @@ enum {
  					 sizeof(struct bss_info_bcn_cont) + \
  					 sizeof(struct bss_info_inband_discovery))
  
@@ -353,10 +352,10 @@
 +
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 25bec88f..46704b39 100644
+index 2f91020c..8b6c95ef 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -287,6 +287,20 @@ struct mt7915_phy {
+@@ -289,6 +289,20 @@ struct mt7915_phy {
  		u8 spe_idx;
  	} test;
  #endif
@@ -377,7 +376,7 @@
  };
  
  struct mt7915_dev {
-@@ -662,6 +676,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -669,6 +683,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch b/recipes-wifi/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
index f438876..cae715d 100644
--- a/recipes-wifi/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
@@ -1,4 +1,4 @@
-From 626ab5ee837d42274bea8476d9c59b7c9f736084 Mon Sep 17 00:00:00 2001
+From c8b66728e0b61207699caff87ab24b2be004297c Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Tue, 11 Jan 2022 12:03:23 +0800
 Subject: [PATCH 1003/1008] mt76: mt7915: air monitor support
@@ -13,10 +13,10 @@
  6 files changed, 440 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index dc1a2ef7..e4a3d9dd 100644
+index 3ad59e53..7b76e7b2 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1156,6 +1156,8 @@ enum {
+@@ -1182,6 +1182,8 @@ enum {
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
@@ -26,10 +26,10 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 931a3a14..45c71c85 100644
+index 609f10d4..ea834d6c 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -519,6 +519,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -549,6 +549,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
  			seq_ctrl = le16_to_cpu(hdr->seq_ctrl);
  			qos_ctl = *ieee80211_get_qos_ctl(hdr);
  		}
@@ -39,12 +39,12 @@
 +#endif
  	} else {
  		status->flag |= RX_FLAG_8023;
- 	}
+ 		mt7915_wed_check_ppe(dev, &dev->mt76.q_rx[q], msta, skb,
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 16ae61e5..8068cab2 100644
+index b6e5f97c..11efcadc 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -688,6 +688,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -686,6 +686,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (ret)
  		return ret;
  
@@ -55,10 +55,10 @@
  }
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 46704b39..f13263c7 100644
+index 8b6c95ef..bb21433a 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -242,6 +242,35 @@ struct mt7915_hif {
+@@ -244,6 +244,35 @@ struct mt7915_hif {
  	int irq;
  };
  
@@ -94,7 +94,7 @@
  struct mt7915_phy {
  	struct mt76_phy *mt76;
  	struct mt7915_dev *dev;
-@@ -300,6 +329,8 @@ struct mt7915_phy {
+@@ -302,6 +331,8 @@ struct mt7915_phy {
  		u32 interval;
  		u32 last_record;
  	} csi;
@@ -103,7 +103,7 @@
  #endif
  };
  
-@@ -680,6 +711,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -687,6 +718,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
diff --git a/recipes-wifi/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch b/recipes-wifi/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
index c3a3e7a..cc05970 100644
--- a/recipes-wifi/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
@@ -1,4 +1,4 @@
-From e607646c35843a60f23bf5c05e385899feaf24ff Mon Sep 17 00:00:00 2001
+From 1fc0f6e115502d8b3c779349d9420108e0aadae0 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:45:53 +0800
 Subject: [PATCH 1004/1008] mt76: mt7915: add support for muru_onoff via
@@ -12,10 +12,10 @@
  4 files changed, 47 insertions(+), 2 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index c3c4b97e..442e19e8 100644
+index 34ace7c9..d4105835 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -606,6 +606,7 @@ static void mt7915_init_work(struct work_struct *work)
+@@ -609,6 +609,7 @@ static void mt7915_init_work(struct work_struct *work)
  	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
  	mt7915_init_txpower(dev, &dev->mphy.sband_6g.sband);
  	mt7915_txbf_init(dev);
@@ -24,10 +24,10 @@
  
  void mt7915_wfsys_reset(struct mt7915_dev *dev)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index f49f9fa5..59fadcd4 100644
+index e6cd1e2c..2ee4afe9 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -856,13 +856,18 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -860,13 +860,18 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  
  	muru = (struct sta_rec_muru *)tlv;
  
@@ -49,10 +49,10 @@
  		muru->mimo_dl.vht_mu_bfee =
  			!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 974cd13c..c514cd6a 100644
+index 8ec15c22..e655438f 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -560,4 +560,10 @@ struct csi_data {
+@@ -590,4 +590,10 @@ struct csi_data {
  };
  #endif
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1005-mt76-certification-patches.patch b/recipes-wifi/linux-mt76/files/patches/1005-mt76-certification-patches.patch
index 218edee..17d5d5b 100644
--- a/recipes-wifi/linux-mt76/files/patches/1005-mt76-certification-patches.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1005-mt76-certification-patches.patch
@@ -16,10 +16,10 @@
  9 files changed, 956 insertions(+), 5 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index e4a3d9dd..c4262f39 100644
+index 7b76e7b2..172a926a 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1158,6 +1158,7 @@ enum {
+@@ -1184,6 +1184,7 @@ enum {
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
@@ -28,7 +28,7 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 45c71c85..d0aa305a 100644
+index ea834d6c..28c6ab35 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -8,6 +8,7 @@
@@ -39,7 +39,7 @@
  
  #define to_rssi(field, rcpi)	((FIELD_GET(field, rcpi) - 220) / 2)
  
-@@ -1996,6 +1997,21 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
+@@ -2026,6 +2027,21 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
  	phy->trb_ts = trb;
  }
  
@@ -61,7 +61,7 @@
  void mt7915_mac_sta_rc_work(struct work_struct *work)
  {
  	struct mt7915_dev *dev = container_of(work, struct mt7915_dev, rc_work);
-@@ -2018,6 +2034,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
+@@ -2048,6 +2064,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
  		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
  		vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
  
@@ -76,10 +76,10 @@
  			       IEEE80211_RC_NSS_CHANGED |
  			       IEEE80211_RC_BW_CHANGED))
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 8068cab2..97bf5117 100644
+index 11efcadc..75073363 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -664,6 +664,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -662,6 +662,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	bool ext_phy = mvif->phy != &dev->phy;
@@ -89,7 +89,7 @@
  	int ret, idx;
  
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
-@@ -691,7 +694,17 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -689,7 +692,17 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  #ifdef CONFIG_MTK_VENDOR
  	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
  #endif
@@ -109,10 +109,10 @@
  
  void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 59fadcd4..1bd46cc4 100644
+index 2ee4afe9..fe314bf2 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3595,6 +3595,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -3865,6 +3865,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
  
  	return 0;
  }
@@ -586,10 +586,10 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index c514cd6a..c45486fd 100644
+index e655438f..14481725 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -398,10 +398,14 @@ enum {
+@@ -409,10 +409,14 @@ enum {
  	RATE_PARAM_FIXED = 3,
  	RATE_PARAM_MMPS_UPDATE = 5,
  	RATE_PARAM_FIXED_HE_LTF = 7,
@@ -605,7 +605,7 @@
  };
  
  #define RATE_CFG_MCS			GENMASK(3, 0)
-@@ -413,6 +417,9 @@ enum {
+@@ -424,6 +428,9 @@ enum {
  #define RATE_CFG_PHY_TYPE		GENMASK(27, 24)
  #define RATE_CFG_HE_LTF			GENMASK(31, 28)
  
@@ -613,9 +613,9 @@
 +#define RATE_CFG_VAL			GENMASK(7, 0)
 +
  enum {
- 	THERMAL_PROTECT_PARAMETER_CTRL,
- 	THERMAL_PROTECT_BASIC_INFO,
-@@ -565,5 +572,203 @@ struct csi_data {
+ 	TX_POWER_LIMIT_ENABLE,
+ 	TX_POWER_LIMIT_TABLE = 0x4,
+@@ -595,5 +602,203 @@ struct csi_data {
  #define OFDMA_UL                       BIT(1)
  #define MUMIMO_DL                      BIT(2)
  #define MUMIMO_UL                      BIT(3)
@@ -820,10 +820,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index f13263c7..6458e356 100644
+index bb21433a..e6c000a7 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -708,6 +708,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -715,6 +715,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
  #ifdef CONFIG_MTK_VENDOR
diff --git a/recipes-wifi/linux-mt76/files/patches/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch b/recipes-wifi/linux-mt76/files/patches/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
index 68d31f7..c11c130 100644
--- a/recipes-wifi/linux-mt76/files/patches/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
@@ -1,4 +1,4 @@
-From 310c3bf59cf9eea521ee8d75bb4603af0e97a9d9 Mon Sep 17 00:00:00 2001
+From 8db2e922135d4c217bdf6279f19f65e2b849c7e1 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Fri, 27 May 2022 15:51:48 +0800
 Subject: [PATCH 1006/1008] mt76: mt7915:add support for runtime set in-band
@@ -10,10 +10,10 @@
  1 file changed, 2 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 1bd46cc4..9117c9e2 100644
+index fe314bf2..cb6195f6 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -1951,8 +1951,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+@@ -1977,8 +1977,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
  	u8 *buf, interval;
  	int len;
  
@@ -23,7 +23,7 @@
  		interval = vif->bss_conf.fils_discovery.max_interval;
  		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
  	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
-@@ -1987,7 +1986,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+@@ -2013,7 +2012,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
  	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
  	discov->tx_interval = interval;
  	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
diff --git a/recipes-wifi/linux-mt76/files/patches/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch b/recipes-wifi/linux-mt76/files/patches/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
index f6045cf..af41769 100644
--- a/recipes-wifi/linux-mt76/files/patches/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
@@ -1,4 +1,4 @@
-From 3258b1f670c506b036cab0d06d87708933f7cd83 Mon Sep 17 00:00:00 2001
+From a998c8e0ec699a4465a5ba77f00fa799b2f8d99e Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:53:43 +0800
 Subject: [PATCH 1007/1008] mt76: mt7915: add mt76 vendor muru onoff command
@@ -11,10 +11,10 @@
  4 files changed, 63 insertions(+)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 9117c9e2..2a18dd53 100644
+index cb6195f6..696ca11b 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3614,6 +3614,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -3884,6 +3884,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  		if (val == 0)
  			dev->dbg.muru_onoff = MUMIMO_DL_CERT | MUMIMO_DL;
  		break;
@@ -29,10 +29,10 @@
  }
  
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index c45486fd..8eaf984a 100644
+index 14481725..6a145aef 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -405,6 +405,7 @@ enum {
+@@ -416,6 +416,7 @@ enum {
  #ifdef CONFIG_MTK_VENDOR
  	RATE_PARAM_FIXED_MIMO = 30,
  	RATE_PARAM_FIXED_OFDMA = 31,
diff --git a/recipes-wifi/linux-mt76/files/patches/1008-mt76-mt7915-add-fw_version-dump.patch b/recipes-wifi/linux-mt76/files/patches/1008-mt76-mt7915-add-fw_version-dump.patch
index 145822e..25f8139 100644
--- a/recipes-wifi/linux-mt76/files/patches/1008-mt76-mt7915-add-fw_version-dump.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1008-mt76-mt7915-add-fw_version-dump.patch
@@ -1,4 +1,4 @@
-From 05dd4dcaf63a2026f920cd4936c0a12c8b6303ae Mon Sep 17 00:00:00 2001
+From 0c600cffb7f89ad45e0f631623632f36cbe8bf81 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 17 Aug 2022 13:40:24 +0800
 Subject: [PATCH 1008/1008] mt76: mt7915: add fw_version dump
@@ -10,10 +10,10 @@
  3 files changed, 32 insertions(+)
 
 diff --git a/mt76.h b/mt76.h
-index 1b468ccc..3a177fff 100644
+index 66059d2e..0d87f135 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -823,6 +823,10 @@ struct mt76_dev {
+@@ -840,6 +840,10 @@ struct mt76_dev {
  		struct mt76_usb usb;
  		struct mt76_sdio sdio;
  	};
@@ -25,10 +25,10 @@
  
  struct mt76_power_limits {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index dfec416e..7ab491d6 100644
+index c65267b4..a48903ca 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -2904,6 +2904,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
+@@ -2927,6 +2927,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
  		 sizeof(dev->hw->wiphy->fw_version),
  		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
  
@@ -38,7 +38,7 @@
  	release_firmware(fw);
  
  	if (!fw_wa)
-@@ -2929,6 +2932,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
+@@ -2952,6 +2955,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
  		goto out;
  	}
  
@@ -48,7 +48,7 @@
  	snprintf(dev->hw->wiphy->fw_version,
  		 sizeof(dev->hw->wiphy->fw_version),
  		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
-@@ -2999,6 +3005,9 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
+@@ -3022,6 +3028,9 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
  	dev_info(dev->dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
  		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1111-mt76-testmode-additional-supports.patch b/recipes-wifi/linux-mt76/files/patches/1111-mt76-testmode-additional-supports.patch
index 3ca4b85..78ab5ee 100644
--- a/recipes-wifi/linux-mt76/files/patches/1111-mt76-testmode-additional-supports.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1111-mt76-testmode-additional-supports.patch
@@ -1,7 +1,7 @@
-From 8758539453946b5e3941f2e46d7ae4f933823dd2 Mon Sep 17 00:00:00 2001
+From b30eb7fc2770ee278bfcf775dc8eca0710cf9d65 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Apr 2022 15:43:19 +0800
-Subject: [PATCH 1111/1128] mt76: testmode: additional supports
+Subject: [PATCH 1111/1127] mt76: testmode: additional supports
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
@@ -18,19 +18,19 @@
  mt7915/mmio.c     |    2 +
  mt7915/mt7915.h   |   14 +-
  mt7915/regs.h     |    3 +
- mt7915/testmode.c | 1171 ++++++++++++++++++++++++++++++++++++++++++---
+ mt7915/testmode.c | 1170 ++++++++++++++++++++++++++++++++++++++++++---
  mt7915/testmode.h |  278 +++++++++++
  testmode.c        |  275 +++++++++--
  testmode.h        |   75 +++
  tools/fields.c    |   80 ++++
  tx.c              |    3 +-
- 19 files changed, 1962 insertions(+), 147 deletions(-)
+ 19 files changed, 1962 insertions(+), 146 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 4b181305..82b4da26 100644
+index ae22b959..d2891c64 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -426,8 +426,7 @@ free:
+@@ -535,8 +535,7 @@ free:
  	if (mt76_is_testmode_skb(dev, skb, &hw)) {
  		struct mt76_phy *phy = hw->priv;
  
@@ -41,7 +41,7 @@
  #endif
  
 diff --git a/mac80211.c b/mac80211.c
-index e5d8f45b..4b63ec69 100644
+index 9a908c9a..f8ca7ba1 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -55,6 +55,13 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
@@ -71,10 +71,10 @@
  
  static const struct ieee80211_channel mt76_channels_6ghz[] = {
 diff --git a/mt76.h b/mt76.h
-index 3a177fff..e79d74a4 100644
+index 0d87f135..32e2dea0 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -624,6 +624,21 @@ struct mt76_testmode_ops {
+@@ -635,6 +635,21 @@ struct mt76_testmode_ops {
  	int (*set_params)(struct mt76_phy *phy, struct nlattr **tb,
  			  enum mt76_testmode_state new_state);
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
@@ -96,7 +96,7 @@
  };
  
  #define MT_TM_FW_RX_COUNT	BIT(0)
-@@ -632,16 +647,11 @@ struct mt76_testmode_data {
+@@ -643,16 +658,11 @@ struct mt76_testmode_data {
  	enum mt76_testmode_state state;
  
  	u32 param_set[DIV_ROUND_UP(NUM_MT76_TM_ATTRS, 32)];
@@ -113,7 +113,7 @@
  	u8 tx_rate_stbc;
  	u8 tx_ltf;
  
-@@ -657,10 +667,37 @@ struct mt76_testmode_data {
+@@ -668,10 +678,37 @@ struct mt76_testmode_data {
  	u8 tx_power[4];
  	u8 tx_power_control;
  
@@ -152,7 +152,7 @@
  	u32 tx_pending;
  	u32 tx_queued;
  	u16 tx_queued_limit;
-@@ -1115,6 +1152,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
+@@ -1132,6 +1169,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
  #endif
  }
  
@@ -212,7 +212,7 @@
  static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
  					struct sk_buff *skb,
  					struct ieee80211_hw **hw)
-@@ -1125,7 +1215,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
+@@ -1142,7 +1232,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
  	for (i = 0; i < ARRAY_SIZE(dev->phys); i++) {
  		struct mt76_phy *phy = dev->phys[i];
  
@@ -222,7 +222,7 @@
  			*hw = dev->phys[i]->hw;
  			return true;
  		}
-@@ -1227,7 +1318,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1244,7 +1335,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
  		       struct netlink_callback *cb, void *data, int len);
  int mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state);
@@ -233,10 +233,10 @@
  static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
  {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 7ab491d6..afdd42ff 100644
+index a48903ca..4f17954e 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -393,6 +393,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
+@@ -394,6 +394,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
  	switch (vif->type) {
  	case NL80211_IFTYPE_MESH_POINT:
  	case NL80211_IFTYPE_AP:
@@ -244,7 +244,7 @@
  		if (vif->p2p)
  			conn_type = CONNECTION_P2P_GC;
  		else
-@@ -574,6 +575,9 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
+@@ -575,6 +576,9 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
  	rx->rca2 = 1;
  	rx->rv = 1;
  
@@ -255,10 +255,10 @@
  		return;
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index c4262f39..858a2676 100644
+index 172a926a..e10e92b6 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -980,6 +980,7 @@ enum {
+@@ -983,6 +983,7 @@ enum {
  	MCU_EXT_EVENT_FW_LOG_2_HOST = 0x13,
  	MCU_EXT_EVENT_THERMAL_PROTECT = 0x22,
  	MCU_EXT_EVENT_ASSERT_DUMP = 0x23,
@@ -266,7 +266,7 @@
  	MCU_EXT_EVENT_RDD_REPORT = 0x3a,
  	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
  	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
-@@ -1158,6 +1159,7 @@ enum {
+@@ -1184,6 +1185,7 @@ enum {
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
@@ -275,10 +275,10 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  };
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 442e19e8..69465dd0 100644
+index d4105835..2f3453b0 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -600,7 +600,7 @@ static void mt7915_init_work(struct work_struct *work)
+@@ -603,7 +603,7 @@ static void mt7915_init_work(struct work_struct *work)
  	struct mt7915_dev *dev = container_of(work, struct mt7915_dev,
  				 init_work);
  
@@ -288,10 +288,10 @@
  	mt7915_init_txpower(dev, &dev->mphy.sband_2g.sband);
  	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index d0aa305a..9af86163 100644
+index 28c6ab35..3b144ad0 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -597,16 +597,38 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+@@ -629,16 +629,38 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
  {
  #ifdef CONFIG_NL80211_TESTMODE
  	struct mt76_testmode_data *td = &phy->mt76->test;
@@ -333,7 +333,7 @@
  
  	switch (td->tx_rate_mode) {
  	case MT76_TM_TX_MODE_HT:
-@@ -696,13 +718,14 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+@@ -728,13 +750,14 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
  	if (mode >= MT_PHY_TYPE_HE_SU)
  		val |= FIELD_PREP(MT_TXD6_HELTF, td->tx_ltf);
  
@@ -351,7 +351,7 @@
  #endif
  }
  
-@@ -1452,7 +1475,7 @@ mt7915_mac_restart(struct mt7915_dev *dev)
+@@ -1483,7 +1506,7 @@ mt7915_mac_restart(struct mt7915_dev *dev)
  		goto out;
  
  	/* set the necessary init items */
@@ -361,7 +361,7 @@
  		goto out;
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 97bf5117..b4564e33 100644
+index 75073363..e84d6132 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -223,7 +223,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
@@ -374,10 +374,10 @@
  		mvif->mt76.wmm_idx += 2;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 2a18dd53..adc14d53 100644
+index 696ca11b..5687e136 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -363,6 +363,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -367,6 +367,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	case MCU_EXT_EVENT_BCC_NOTIFY:
  		mt7915_mcu_rx_bcc_notify(dev, skb);
  		break;
@@ -389,7 +389,7 @@
  	default:
  		break;
  	}
-@@ -394,6 +399,7 @@ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -398,6 +403,7 @@ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
  	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
  	    rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
@@ -397,7 +397,7 @@
  	    !rxd->seq)
  		mt7915_mcu_rx_unsolicited_event(dev, skb);
  	else
-@@ -2755,14 +2761,14 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
+@@ -2781,14 +2787,14 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
  	return 0;
  }
  
@@ -415,7 +415,7 @@
  
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 8eaf984a..1388eda0 100644
+index 6a145aef..4bc58c98 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -8,10 +8,15 @@
@@ -434,7 +434,7 @@
  };
  
  struct mt7915_mcu_thermal_ctrl {
-@@ -434,6 +439,12 @@ enum {
+@@ -464,6 +469,12 @@ enum {
  
  enum {
  	MT_BF_SOUNDING_ON = 1,
@@ -447,7 +447,7 @@
  	MT_BF_TYPE_UPDATE = 20,
  	MT_BF_MODULE_UPDATE = 25
  };
-@@ -668,10 +679,19 @@ struct mt7915_muru {
+@@ -698,10 +709,19 @@ struct mt7915_muru {
  #define MURU_OFDMA_SCH_TYPE_UL          BIT(1)
  
  /* Common Config */
@@ -472,10 +472,10 @@
  
  enum {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 813d6f40..63b66e40 100644
+index 19518cb5..fef4b126 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -127,6 +127,7 @@ static const u32 mt7915_offs[] = {
+@@ -132,6 +132,7 @@ static const u32 mt7915_offs[] = {
  	[ARB_DRNGR0]		= 0x194,
  	[ARB_SCR]		= 0x080,
  	[RMAC_MIB_AIRTIME14]	= 0x3b8,
@@ -483,7 +483,7 @@
  	[AGG_AWSCR0]		= 0x05c,
  	[AGG_PCR0]		= 0x06c,
  	[AGG_ACR0]		= 0x084,
-@@ -202,6 +203,7 @@ static const u32 mt7916_offs[] = {
+@@ -207,6 +208,7 @@ static const u32 mt7916_offs[] = {
  	[ARB_DRNGR0]		= 0x1e0,
  	[ARB_SCR]		= 0x000,
  	[RMAC_MIB_AIRTIME14]	= 0x0398,
@@ -492,10 +492,10 @@
  	[AGG_PCR0]		= 0x040,
  	[AGG_ACR0]		= 0x054,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 6458e356..0217c6c3 100644
+index e6c000a7..cf7fcdfc 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -314,6 +314,9 @@ struct mt7915_phy {
+@@ -316,6 +316,9 @@ struct mt7915_phy {
  		u8 last_snr;
  
  		u8 spe_idx;
@@ -505,7 +505,7 @@
  	} test;
  #endif
  
-@@ -413,6 +416,14 @@ struct mt7915_dev {
+@@ -415,6 +418,14 @@ struct mt7915_dev {
  	void __iomem *dcm;
  	void __iomem *sku;
  
@@ -520,7 +520,7 @@
  #ifdef MTK_DEBUG
  	u16 wlan_idx;
  	struct {
-@@ -584,7 +595,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -586,7 +597,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  				   struct ieee80211_vif *vif,
  				   struct ieee80211_sta *sta,
  				   void *data, u32 field);
@@ -529,7 +529,7 @@
  int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset);
  int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num);
  int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
-@@ -617,6 +628,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+@@ -623,6 +634,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
@@ -538,10 +538,10 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 947f02f2..3bf9e150 100644
+index 688f7dee..ae4695ae 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -61,6 +61,7 @@ enum offs_rev {
+@@ -62,6 +62,7 @@ enum offs_rev {
  	ARB_DRNGR0,
  	ARB_SCR,
  	RMAC_MIB_AIRTIME14,
@@ -549,7 +549,7 @@
  	AGG_AWSCR0,
  	AGG_PCR0,
  	AGG_ACR0,
-@@ -481,6 +482,8 @@ enum offs_rev {
+@@ -482,6 +483,8 @@ enum offs_rev {
  #define MT_WF_AGG_BASE(_band)		((_band) ? 0x820f2000 : 0x820e2000)
  #define MT_WF_AGG(_band, ofs)		(MT_WF_AGG_BASE(_band) + (ofs))
  
@@ -559,7 +559,7 @@
  							  (_n) * 4))
  #define MT_AGG_PCR0(_band, _n)		MT_WF_AGG(_band, (__OFFS(AGG_PCR0) +	\
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 8d99edcb..8f250db1 100644
+index 931d1db2..d9d43cb7 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -9,6 +9,9 @@
@@ -635,7 +635,7 @@
  		.testmode_en = 1,
  		.param_idx = MCU_ATE_CLEAN_TXQUEUE,
 -		.param.clean.wcid = wcid,
- 		.param.clean.band = phy != &dev->phy,
+ 		.param.clean.band = phy->band_idx,
  	};
  
 -	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
@@ -1762,11 +1762,10 @@
  }
  
  static int
-@@ -613,35 +1598,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
- 	tx_cont->center_ch = freq1;
+@@ -614,34 +1599,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
  	tx_cont->tx_ant = td->tx_antenna_mask;
- 	tx_cont->band = phy != &dev->phy;
--
+ 	tx_cont->band = phy->band_idx;
+ 
 -	switch (chandef->width) {
 -	case NL80211_CHAN_WIDTH_40:
 -		tx_cont->bw = CMD_CBW_40MHZ;
@@ -1798,8 +1797,8 @@
 +	tx_cont->bw = mt7915_tm_chan_bw(chandef->width);
  
  	if (!en) {
- 		req.op.rf.param.func_data = cpu_to_le32(phy != &dev->phy);
-@@ -725,6 +1682,12 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
+ 		req.op.rf.param.func_data = cpu_to_le32(phy->band_idx);
+@@ -725,6 +1683,12 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
  		mt7915_tm_set_freq_offset(phy, en, en ? td->freq_offset : 0);
  	if (changed & BIT(TM_CHANGED_TXPOWER))
  		mt7915_tm_set_tx_power(phy);
@@ -1812,7 +1811,7 @@
  }
  
  static int
-@@ -804,6 +1767,7 @@ static int
+@@ -804,6 +1768,7 @@ static int
  mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  {
  	struct mt7915_phy *phy = mphy->priv;
@@ -1820,7 +1819,7 @@
  	void *rx, *rssi;
  	int i;
  
-@@ -849,11 +1813,68 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+@@ -849,11 +1814,68 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  
  	nla_nest_end(msg, rx);
  
@@ -2903,7 +2902,7 @@
  };
  
 diff --git a/tx.c b/tx.c
-index 65e2b7c1..8b33186b 100644
+index c8d78b0a..c7cd842c 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -245,8 +245,7 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
diff --git a/recipes-wifi/linux-mt76/files/patches/1112-mt76-testmode-add-pre-cal-support.patch b/recipes-wifi/linux-mt76/files/patches/1112-mt76-testmode-add-pre-cal-support.patch
index bde5241..7a81afe 100644
--- a/recipes-wifi/linux-mt76/files/patches/1112-mt76-testmode-add-pre-cal-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1112-mt76-testmode-add-pre-cal-support.patch
@@ -1,7 +1,7 @@
-From cefbd5d7c2c8c2986ed7344e71e6d949d4744da9 Mon Sep 17 00:00:00 2001
+From de6933ebbc092c3fb1902afb5de74db4fb6cdfa4 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 31 Aug 2022 20:06:52 +0800
-Subject: [PATCH 1112/1128] mt76: testmode: add pre-cal support
+Subject: [PATCH 1112/1127] mt76: testmode: add pre-cal support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Change-Id: Ibfbbc3443de994eeb4daa5e364b0a90f5d7d3bcd
@@ -20,7 +20,7 @@
  11 files changed, 562 insertions(+), 13 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 25f67760..4c50bfe6 100644
+index 1e41b94d..e083964b 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -89,8 +89,10 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len)
@@ -37,10 +37,10 @@
  
  out_put_node:
 diff --git a/mt76.h b/mt76.h
-index e79d74a4..c08b8a47 100644
+index 32e2dea0..2beb1056 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -625,6 +625,7 @@ struct mt76_testmode_ops {
+@@ -636,6 +636,7 @@ struct mt76_testmode_ops {
  			  enum mt76_testmode_state new_state);
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
  	int (*set_eeprom)(struct mt76_phy *phy, u32 offset, u8 *val, u8 action);
@@ -49,10 +49,10 @@
  
  struct mt76_testmode_entry_data {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 858a2676..c510b5d4 100644
+index e10e92b6..4e489244 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -976,6 +976,7 @@ enum {
+@@ -979,6 +979,7 @@ enum {
  
  /* ext event table */
  enum {
@@ -114,10 +114,10 @@
  
  #endif
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index adc14d53..f4285994 100644
+index 5687e136..d1ff73a9 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -367,6 +367,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -371,6 +371,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	case MCU_EXT_EVENT_BF_STATUS_READ:
  		mt7915_tm_txbf_status_read(dev, skb);
  		break;
@@ -127,7 +127,7 @@
  #endif
  	default:
  		break;
-@@ -2856,7 +2859,7 @@ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
+@@ -2882,7 +2885,7 @@ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
  	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
  	u32 total = MT_EE_CAL_GROUP_SIZE;
  
@@ -136,7 +136,7 @@
  		return 0;
  
  	/*
-@@ -2936,11 +2939,29 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+@@ -2962,11 +2965,29 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
  {
  	struct mt7915_dev *dev = phy->dev;
  	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
@@ -169,10 +169,10 @@
  
  	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 0217c6c3..e801fa30 100644
+index cf7fcdfc..cafd4389 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -400,6 +400,10 @@ struct mt7915_dev {
+@@ -402,6 +402,10 @@ struct mt7915_dev {
  	struct rchan *relay_fwlog;
  
  	void *cal;
@@ -183,7 +183,7 @@
  
  	struct {
  		u8 debug_wm;
-@@ -629,6 +633,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
+@@ -635,6 +639,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
  int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
@@ -192,7 +192,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 8f250db1..b1ce2991 100644
+index d9d43cb7..c6a5837e 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -5,6 +5,7 @@
@@ -223,7 +223,7 @@
  		.icap_len = 120,
  		.op.rf.func_idx = cpu_to_le32(func_idx),
  	};
-@@ -1672,6 +1671,316 @@ out:
+@@ -1673,6 +1672,316 @@ out:
  				 sizeof(req), true);
  }
  
@@ -540,7 +540,7 @@
  static void
  mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
  {
-@@ -1711,6 +2020,10 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
+@@ -1712,6 +2021,10 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
  	else if (prev_state == MT76_TM_STATE_OFF ||
  		 state == MT76_TM_STATE_OFF)
  		mt7915_tm_init(phy, !(state == MT76_TM_STATE_OFF));
@@ -551,7 +551,7 @@
  
  	if ((state == MT76_TM_STATE_IDLE &&
  	     prev_state == MT76_TM_STATE_OFF) ||
-@@ -1872,9 +2185,113 @@ mt7915_tm_set_eeprom(struct mt76_phy *mphy, u32 offset, u8 *val, u8 action)
+@@ -1873,9 +2186,113 @@ mt7915_tm_set_eeprom(struct mt76_phy *mphy, u32 offset, u8 *val, u8 action)
  	return ret;
  }
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1113-mt76-testmode-add-iBF-command-mode-support.patch b/recipes-wifi/linux-mt76/files/patches/1113-mt76-testmode-add-iBF-command-mode-support.patch
index 7adbf9a..c019c31 100644
--- a/recipes-wifi/linux-mt76/files/patches/1113-mt76-testmode-add-iBF-command-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1113-mt76-testmode-add-iBF-command-mode-support.patch
@@ -1,7 +1,7 @@
-From 9e9c62bb30cbfb1c5d65cbe7a7a29b4ddbefcfca Mon Sep 17 00:00:00 2001
+From 7a1f91e3def399d726726a0623e9f9caa6a9cd8c Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 12 Sep 2022 18:16:54 +0800
-Subject: [PATCH 1113/1128] mt76: testmode: add iBF command mode support
+Subject: [PATCH 1113/1127] mt76: testmode: add iBF command mode support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Change-Id: I7eea1d6412563f889e5774e787e58ce9eba001bd
@@ -13,7 +13,7 @@
  4 files changed, 85 insertions(+), 7 deletions(-)
 
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index b1ce2991..f735ed69 100644
+index c6a5837e..9de11e98 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -701,6 +701,7 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
diff --git a/recipes-wifi/linux-mt76/files/patches/1114-mt76-testmode-add-ZWDFS-test-mode-support.patch b/recipes-wifi/linux-mt76/files/patches/1114-mt76-testmode-add-ZWDFS-test-mode-support.patch
index a06ebcd..08a404e 100644
--- a/recipes-wifi/linux-mt76/files/patches/1114-mt76-testmode-add-ZWDFS-test-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1114-mt76-testmode-add-ZWDFS-test-mode-support.patch
@@ -1,7 +1,7 @@
-From d4325a391a9e7ce10af23810f138c982e4e387ec Mon Sep 17 00:00:00 2001
+From f2a6f16bb0a584a0fb7e7dab8cb47e2870b040e9 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 27 Oct 2022 17:42:07 +0800
-Subject: [PATCH 1114/1128] mt76: testmode: add ZWDFS test mode support
+Subject: [PATCH 1114/1127] mt76: testmode: add ZWDFS test mode support
 
 Change-Id: I14d104b7158a35acf6b0595357d07fb87f5a9d94
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -19,10 +19,10 @@
  10 files changed, 452 insertions(+), 1 deletion(-)
 
 diff --git a/mt76.h b/mt76.h
-index c08b8a47..0a9552b5 100644
+index 2beb1056..8139b4ad 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -708,6 +708,15 @@ struct mt76_testmode_data {
+@@ -719,6 +719,15 @@ struct mt76_testmode_data {
  		u64 fcs_error[__MT_RXQ_MAX];
  		u64 len_mismatch;
  	} rx_stats;
@@ -39,10 +39,10 @@
  
  struct mt76_vif {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index c510b5d4..a31b85f0 100644
+index 4e489244..c353341e 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1153,6 +1153,7 @@ enum {
+@@ -1179,6 +1179,7 @@ enum {
  	MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
  	MCU_EXT_CMD_SET_RDD_TH = 0x9d,
  	MCU_EXT_CMD_MURU_CTRL = 0x9f,
@@ -50,7 +50,7 @@
  	MCU_EXT_CMD_RX_STAT = 0xa4,
  	MCU_EXT_CMD_SET_SPR = 0xa8,
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
-@@ -1163,6 +1164,7 @@ enum {
+@@ -1189,6 +1190,7 @@ enum {
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
  	MCU_EXT_CMD_CERT_CFG = 0xb7,
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
@@ -59,18 +59,18 @@
  
  enum {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index f4285994..0e66291d 100644
+index d1ff73a9..51ec151b 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2594,6 +2594,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
+@@ -2620,6 +2620,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
  		req.monitor_chan = chandef->chan->hw_value;
  		req.monitor_central_chan =
  			ieee80211_frequency_to_channel(chandef->center_freq1);
 +		req.monitor_bw = mt76_connac_chan_bw(chandef);
- 		req.band_idx = phy != &dev->phy;
+ 		req.band_idx = phy->band_idx;
  		req.scan_mode = 2;
  		break;
-@@ -4180,3 +4181,68 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
+@@ -4450,3 +4451,68 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MEC_CTRL), &req, sizeof(req), true);
  }
  #endif
@@ -140,10 +140,10 @@
 +	return 0;
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 1388eda0..0a79fe04 100644
+index 4bc58c98..300b7834 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -579,6 +579,52 @@ struct csi_data {
+@@ -609,6 +609,52 @@ struct csi_data {
  };
  #endif
  
@@ -197,10 +197,10 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e801fa30..dcf64bff 100644
+index cafd4389..0cbd02e2 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -302,6 +302,7 @@ struct mt7915_phy {
+@@ -304,6 +304,7 @@ struct mt7915_phy {
  
  	struct mib_stats mib;
  	struct mt76_channel_state state_ts;
@@ -208,7 +208,7 @@
  
  #ifdef CONFIG_NL80211_TESTMODE
  	struct {
-@@ -746,6 +747,9 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+@@ -753,6 +754,9 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
  
@@ -219,10 +219,10 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 3bf9e150..9b6266c1 100644
+index ae4695ae..6aa98812 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -1180,6 +1180,8 @@ enum offs_rev {
+@@ -1187,6 +1187,8 @@ enum offs_rev {
  #define MT_WF_IRPI_NSS(phy, nss)	MT_WF_IRPI(0x6000 + ((phy) << 20) + ((nss) << 16))
  #define MT_WF_IRPI_NSS_MT7916(phy, nss)	MT_WF_IRPI(0x1000 + ((phy) << 20) + ((nss) << 16))
  
@@ -232,7 +232,7 @@
  #define MT_WF_PHY_BASE			0x83080000
  #define MT_WF_PHY(ofs)			(MT_WF_PHY_BASE + (ofs))
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index f735ed69..b3462bcc 100644
+index 9de11e98..6ce2c0e6 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -13,6 +13,12 @@ enum {
@@ -487,7 +487,7 @@
  	}
  }
  
-@@ -2004,6 +2228,14 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
+@@ -2005,6 +2229,14 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
  		mt7915_tm_set_cfg(phy);
  	if (changed & BIT(TM_CHANGED_TXBF_ACT))
  		mt7915_tm_set_txbf(phy);
diff --git a/recipes-wifi/linux-mt76/files/patches/1115-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch b/recipes-wifi/linux-mt76/files/patches/1115-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
index 5143732..96aaf15 100644
--- a/recipes-wifi/linux-mt76/files/patches/1115-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1115-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
@@ -1,17 +1,17 @@
-From 2d9d53d38c1228b6daed13ab3bccd2fcbe6b6d63 Mon Sep 17 00:00:00 2001
+From 7b4d2270752e46865585471b89c1ddad40ac46ea Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Sun, 24 Apr 2022 10:07:00 +0800
-Subject: [PATCH 1115/1128] mt76: mt7915: init rssi in WTBL when add station
+Subject: [PATCH 1115/1127] mt76: mt7915: init rssi in WTBL when add station
 
 ---
  mt7915/main.c | 4 ++++
  1 file changed, 4 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index b4564e33..1864f241 100644
+index e84d6132..9180689e 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -668,6 +668,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -666,6 +666,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_phy *phy;
  #endif
  	int ret, idx;
@@ -19,7 +19,7 @@
  
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
  	if (idx < 0)
-@@ -691,6 +692,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -689,6 +690,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (ret)
  		return ret;
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1116-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch b/recipes-wifi/linux-mt76/files/patches/1116-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
index 4d39539..18b5c06 100644
--- a/recipes-wifi/linux-mt76/files/patches/1116-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1116-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
@@ -1,7 +1,7 @@
-From ebdd3b7cd18ab5f28072f7ff625654097737dc8c Mon Sep 17 00:00:00 2001
+From a13dbc3ffa989467b9c9618153aef11b3a7203ba Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 4 Aug 2022 14:08:11 +0800
-Subject: [PATCH 1116/1128] mt76: mt7915: reduce TWT SP sent to FW for cert
+Subject: [PATCH 1116/1127] mt76: mt7915: reduce TWT SP sent to FW for cert
 
 Set TWT SP duration to 88 percent to prevent HW sends PPDU over TWT SP.
 
@@ -11,10 +11,10 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 0e66291d..042b6c18 100644
+index 51ec151b..8ebe38f0 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3503,7 +3503,7 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3773,7 +3773,7 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  		.own_mac_idx = mvif->mt76.omac_idx,
  		.flowid = flow->id,
  		.peer_id = cpu_to_le16(flow->wcid),
diff --git a/recipes-wifi/linux-mt76/files/patches/1117-mt76-airtime-fairness-feature-off-in-mac80211.patch b/recipes-wifi/linux-mt76/files/patches/1117-mt76-airtime-fairness-feature-off-in-mac80211.patch
index 02a1d63..9bf3d19 100644
--- a/recipes-wifi/linux-mt76/files/patches/1117-mt76-airtime-fairness-feature-off-in-mac80211.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1117-mt76-airtime-fairness-feature-off-in-mac80211.patch
@@ -1,14 +1,14 @@
-From 5d3268e0d55b6bfaa88397d19ded51c13ebd8fac Mon Sep 17 00:00:00 2001
+From dbe1f9d95163ed0651bb404946f2fabf8de62923 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 6 May 2022 15:58:42 +0800
-Subject: [PATCH 1117/1128] mt76: airtime fairness feature off in mac80211
+Subject: [PATCH 1117/1127] mt76: airtime fairness feature off in mac80211
 
 ---
  mac80211.c | 1 -
  1 file changed, 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 4b63ec69..b378231c 100644
+index f8ca7ba1..7e0f0e0e 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -429,7 +429,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
diff --git a/recipes-wifi/linux-mt76/files/patches/1118-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch b/recipes-wifi/linux-mt76/files/patches/1118-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
index 58fb0fd..4538369 100644
--- a/recipes-wifi/linux-mt76/files/patches/1118-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1118-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
@@ -1,7 +1,7 @@
-From 91e341ee0145c32a0ee05feb45bb45162622e17f Mon Sep 17 00:00:00 2001
+From 369a0d926e282d38bb98a62ac97d474a856b7a36 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 20 May 2022 19:19:25 +0800
-Subject: [PATCH 1118/1128] mt76: mt7915: add mt7986 and mt7916 pre-calibration
+Subject: [PATCH 1118/1127] mt76: mt7915: add mt7986 and mt7916 pre-calibration
 
 Add pre-calibration for mt7986 and mt7916. It has different data size
 with mt7915. Group cal needs 54k and 94k for 2G + 5G and 2G + 6G,
@@ -62,10 +62,10 @@
  	MT_EE_RATE_DELTA_5G =	0x29d,
  	MT_EE_TX0_POWER_2G =	0x2fc,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 042b6c18..e03ec9e3 100644
+index 8ebe38f0..97b1cf3b 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2858,7 +2858,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
+@@ -2884,7 +2884,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
  int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
  {
  	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
@@ -75,7 +75,7 @@
  
  	if (!(eep[offs] & MT_EE_WIFI_CAL_GROUP))
  		return 0;
-@@ -2896,9 +2897,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
+@@ -2922,9 +2923,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
  	return -1;
  }
  
@@ -87,7 +87,7 @@
  		5180, 5200, 5220, 5240,
  		5260, 5280, 5300, 5320,
  		5500, 5520, 5540, 5560,
-@@ -2906,34 +2907,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
+@@ -2932,34 +2933,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
  		5660, 5680, 5700, 5745,
  		5765, 5785, 5805, 5825
  	};
@@ -167,7 +167,7 @@
  }
  
  int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
-@@ -2965,24 +3001,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+@@ -2991,24 +3027,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
  	if (!(eep[offs] & dpd_mask))
  		return 0;
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1119-mt76-mt7915-add-phy-capability-vendor-command.patch b/recipes-wifi/linux-mt76/files/patches/1119-mt76-mt7915-add-phy-capability-vendor-command.patch
index f2e7a99..ab053c9 100644
--- a/recipes-wifi/linux-mt76/files/patches/1119-mt76-mt7915-add-phy-capability-vendor-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1119-mt76-mt7915-add-phy-capability-vendor-command.patch
@@ -1,7 +1,7 @@
-From 75cc0d6bfdbb54291917044fb0c778d2729758f6 Mon Sep 17 00:00:00 2001
+From 0aa90f5e1c0adb58c603fde51a2da51943a5fd25 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
 Date: Tue, 12 Jul 2022 10:04:35 -0700
-Subject: [PATCH 1119/1128] mt76: mt7915: add phy capability vendor command
+Subject: [PATCH 1119/1127] mt76: mt7915: add phy capability vendor command
 
 ---
  mt7915/mt7915.h |  1 +
@@ -10,7 +10,7 @@
  3 files changed, 78 insertions(+)
 
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index dcf64bff..5023cfcb 100644
+index 0cbd02e2..69f1b6b4 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -11,6 +11,7 @@
diff --git a/recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch b/recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
index d1c487a..abbc2c5 100644
--- a/recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
@@ -1,7 +1,7 @@
-From a7682d61851c686f78273df7a9926203c8e17ee9 Mon Sep 17 00:00:00 2001
+From 022be7646ae36e7cb6c12ac55e0eae88e738de06 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 24 Jun 2022 11:15:45 +0800
-Subject: [PATCH] mt76: mt7915: add vendor subcmd EDCCA ctrl
+Subject: [PATCH 1120/1127] mt76: mt7915: add vendor subcmd EDCCA ctrl
  enable/threshold/compensation
 
 Change-Id: I06a3f94d5e444be894200e2b6588d76ed38d09d0
@@ -16,10 +16,10 @@
  7 files changed, 266 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index a31b85f0..bceb6799 100644
+index c353341e..9339b711 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1163,6 +1163,7 @@ enum {
+@@ -1189,6 +1189,7 @@ enum {
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
  	MCU_EXT_CMD_CERT_CFG = 0xb7,
@@ -28,10 +28,10 @@
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
  };
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 1864f241..2b4e122b 100644
+index 9180689e..83b97d23 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -455,6 +455,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
+@@ -454,6 +454,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
  			mutex_unlock(&dev->mt76.mutex);
  		}
  #endif
@@ -42,10 +42,10 @@
  		ret = mt7915_set_channel(phy);
  		if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index e03ec9e3..67304c84 100644
+index 97b1cf3b..cd6f3292 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4282,3 +4282,75 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
+@@ -4552,3 +4552,75 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
  
  	return 0;
  }
@@ -122,10 +122,10 @@
 +	return 0;
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 0a79fe04..b608cb6a 100644
+index 300b7834..de265d15 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -836,6 +836,27 @@ enum {
+@@ -866,6 +866,27 @@ enum {
     MURU_DL_INIT,
     MURU_UL_INIT,
  };
@@ -154,10 +154,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 5023cfcb..2b56692d 100644
+index 69f1b6b4..aaab5f7a 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -747,7 +747,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
+@@ -754,7 +754,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
  int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
diff --git a/recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-implement-bin-file-mode.patch b/recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-implement-bin-file-mode.patch
index 5dc8a54..1260c1e 100644
--- a/recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-implement-bin-file-mode.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-implement-bin-file-mode.patch
@@ -1,7 +1,7 @@
-From ee7302c84173d00af165f8aa2330e8f11607e5d7 Mon Sep 17 00:00:00 2001
+From 8f789d7adea84ad0ed06b1b593841037fd059fb1 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 7 Jul 2022 11:09:59 +0800
-Subject: [PATCH] mt76: mt7915: implement bin file mode
+Subject: [PATCH 1121/1127] mt76: mt7915: implement bin file mode
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -14,7 +14,7 @@
  6 files changed, 141 insertions(+), 32 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index e083964..5b9faf7 100644
+index e083964b..5b9faf7e 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -104,6 +104,24 @@ out_put_node:
@@ -43,10 +43,10 @@
  mt76_eeprom_override(struct mt76_phy *phy)
  {
 diff --git a/mt76.h b/mt76.h
-index 0a9552b..e29f490 100644
+index 8139b4ad..db2075c3 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1010,6 +1010,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
+@@ -1027,6 +1027,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
  int mt76_eeprom_init(struct mt76_dev *dev, int len);
  void mt76_eeprom_override(struct mt76_phy *phy);
  int mt76_get_of_eeprom(struct mt76_dev *dev, void *data, int offset, int len);
@@ -55,7 +55,7 @@
  struct mt76_queue *
  mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 0f5862e..4d2d9ca 100644
+index 0f5862e3..4d2d9ca2 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -42,33 +42,6 @@ static int mt7915_check_eeprom(struct mt7915_dev *dev)
@@ -151,7 +151,7 @@
  		if (ret)
  			return ret;
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index fdae347..f228926 100644
+index fdae347e..f228926b 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
 @@ -108,6 +108,13 @@ enum mt7915_sku_rate_group {
@@ -213,7 +213,7 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 1cfa6f0..9b72f41 100644
+index aaab5f7a..5a206f7a 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -42,15 +42,24 @@
@@ -244,7 +244,7 @@
  #define MT7915_EEPROM_SIZE		3584
  #define MT7916_EEPROM_SIZE		4096
  
-@@ -395,6 +404,8 @@ struct mt7915_dev {
+@@ -397,6 +406,8 @@ struct mt7915_dev {
  
  	bool dbdc_support;
  	bool flash_mode;
@@ -254,7 +254,7 @@
  	bool ibf;
  
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 9de5b0f..e14b52c 100644
+index 9de5b0f6..e14b52c1 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -3,6 +3,7 @@
diff --git a/recipes-wifi/linux-mt76/files/patches/1122-mt76-mt7915-initialize-wcid.patch b/recipes-wifi/linux-mt76/files/patches/1122-mt76-mt7915-initialize-wcid.patch
index f0e0d3c..f4100fd 100644
--- a/recipes-wifi/linux-mt76/files/patches/1122-mt76-mt7915-initialize-wcid.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1122-mt76-mt7915-initialize-wcid.patch
@@ -1,7 +1,7 @@
-From 202e4428abd4d55ee3bb1b3e692a257269ec68c3 Mon Sep 17 00:00:00 2001
+From 3a3aee4807250c8364a97ab167ea092df6fea720 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 12 Jul 2022 13:56:07 +0800
-Subject: [PATCH 1122/1128] mt76 mt7915 initialize wcid
+Subject: [PATCH 1122/1127] mt76 mt7915 initialize wcid
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -9,10 +9,10 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 9af8616..acc9871 100644
+index 3b144ad0..dc4c6eb3 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -999,7 +999,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1031,7 +1031,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  		info = le32_to_cpu(*cur_info);
  		if (info & MT_TX_FREE_PAIR) {
  			struct mt7915_sta *msta;
diff --git a/recipes-wifi/linux-mt76/files/patches/1123-mt76-HEMU-Add-dump-support.patch b/recipes-wifi/linux-mt76/files/patches/1123-mt76-HEMU-Add-dump-support.patch
index dd3830e..92cd0a7 100644
--- a/recipes-wifi/linux-mt76/files/patches/1123-mt76-HEMU-Add-dump-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1123-mt76-HEMU-Add-dump-support.patch
@@ -1,7 +1,7 @@
-From 32c6671d000c26212b3c6894467392a7b2061f92 Mon Sep 17 00:00:00 2001
+From cf6ba9d0fb09e2c7975b15ede8a5389b700e1f1a Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Thu, 11 Aug 2022 18:09:45 -0700
-Subject: [PATCH 1123/1128] mt76: HEMU: Add dump support
+Subject: [PATCH 1123/1127] mt76: HEMU: Add dump support
 
 Change-Id: I521214f3feb6f0d528a9f550255050ffd1ec96d2
 ---
@@ -10,7 +10,7 @@
  2 files changed, 27 insertions(+)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 5a28a55..7acb330 100644
+index cd5c3b83..5e34b852 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -37,6 +37,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -21,7 +21,7 @@
  };
  
  static const struct nla_policy
-@@ -997,6 +998,30 @@ static int mt7915_vendor_hemu_ctrl(struct wiphy *wiphy,
+@@ -1004,6 +1005,30 @@ static int mt7915_vendor_hemu_ctrl(struct wiphy *wiphy,
  	return 0;
  }
  
@@ -52,7 +52,7 @@
  static int
  mt7915_vendor_phy_capa_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  			     struct sk_buff *skb, const void *data, int data_len,
-@@ -1122,6 +1147,7 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1192,6 +1217,7 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
  			WIPHY_VENDOR_CMD_NEED_RUNNING,
  		.doit = mt7915_vendor_hemu_ctrl,
@@ -61,10 +61,10 @@
  		.maxattr = MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
  	},
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 83c41bc..57f52f3 100644
+index 72319717..c19ffe72 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
-@@ -58,6 +58,7 @@ enum mtk_vendor_attr_hemu_ctrl {
+@@ -72,6 +72,7 @@ enum mtk_vendor_attr_hemu_ctrl {
  	MTK_VENDOR_ATTR_HEMU_CTRL_UNSPEC,
  
  	MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF,
diff --git a/recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch b/recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
index 7d42880..e030a1c 100644
--- a/recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
@@ -1,7 +1,8 @@
-From 5f2097d8515e59239f365b2a9f73e7f6e580149d Mon Sep 17 00:00:00 2001
+From 7393d279dc1edb9e807cfc3e8d4dca25500102e3 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 28 Oct 2022 10:15:56 +0800
-Subject: [PATCH] mt76: mt7915: add vendor subcmd three wire (PTA) ctrl
+Subject: [PATCH 1124/1127] mt76: mt7915: add vendor subcmd three wire (PTA)
+ ctrl
 
 Change-Id: Ic1044698f294455594a0c6254f55326fdab90580
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -15,10 +16,10 @@
  6 files changed, 111 insertions(+), 29 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index bceb6799..86a8688e 100644
+index 9339b711..131257c7 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1162,7 +1162,7 @@ enum {
+@@ -1188,7 +1188,7 @@ enum {
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
@@ -28,10 +29,10 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index a6c84c2f..3caa5996 100644
+index cd6f3292..4e7bc982 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3964,37 +3964,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
+@@ -4234,37 +4234,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
  			&req, sizeof(req), false);
  }
  
@@ -93,10 +94,10 @@
  
  void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index b608cb6a..2172d491 100644
+index de265d15..9780f128 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -625,6 +625,35 @@ struct mt7915_mcu_rdd_ipi_scan {
+@@ -655,6 +655,35 @@ struct mt7915_mcu_rdd_ipi_scan {
  	u8 tx_assert_time;						/* unit: us */
  } __packed;
  
@@ -133,10 +134,10 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index d979950f..28a2f684 100644
+index 5a206f7a..626b2634 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -749,6 +749,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
+@@ -757,6 +757,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
  void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable);
  int mt7915_mcu_set_mu_edca(struct mt7915_phy *phy, u8 val);
  void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type);
@@ -145,7 +146,7 @@
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index b95a1582..84e088c9 100644
+index 5e34b852..6b86b77a 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -40,6 +40,11 @@ hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL] = {
@@ -177,7 +178,7 @@
  static int
  mt7915_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  			     struct sk_buff *skb, const void *data, int data_len,
-@@ -1164,6 +1170,31 @@ mt7915_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
+@@ -1162,6 +1168,31 @@ mt7915_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  	return len;
  }
  
@@ -209,7 +210,7 @@
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
  		.info = {
-@@ -1245,6 +1276,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1243,6 +1274,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.dumpit = mt7915_vendor_edcca_ctrl_dump,
  		.policy = edcca_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_EDCCA_CTRL_MAX,
diff --git a/recipes-wifi/linux-mt76/files/patches/1125-mt76-add-ibf-control-vendor-cmd.patch b/recipes-wifi/linux-mt76/files/patches/1125-mt76-add-ibf-control-vendor-cmd.patch
index b5be350..4a19217 100644
--- a/recipes-wifi/linux-mt76/files/patches/1125-mt76-add-ibf-control-vendor-cmd.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1125-mt76-add-ibf-control-vendor-cmd.patch
@@ -1,7 +1,7 @@
-From 6de06b0f652673f2db19060161dcc94d47ff4ce3 Mon Sep 17 00:00:00 2001
+From fb4a764b80826bd6ba3afd0d015168a460124d9e Mon Sep 17 00:00:00 2001
 From: mtk27835 <shurong.wen@mediatek.com>
 Date: Wed, 7 Sep 2022 14:01:29 -0700
-Subject: [PATCH] mt76: add ibf control vendor cmd
+Subject: [PATCH 1125/1127] mt76: add ibf control vendor cmd
 
 Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
 ---
@@ -10,7 +10,7 @@
  2 files changed, 95 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 84e088c9..648d2dfb 100644
+index 6b86b77a..e4915623 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -86,6 +86,17 @@ edcca_dump_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP] = {
@@ -31,7 +31,7 @@
  struct csi_null_tone {
  	u8 start;
  	u8 end;
-@@ -1194,6 +1205,54 @@ static int mt7915_vendor_3wire_ctrl(struct wiphy *wiphy,
+@@ -1192,6 +1203,54 @@ static int mt7915_vendor_3wire_ctrl(struct wiphy *wiphy,
  	return mt7915_mcu_set_cfg(phy, CFGINFO_3WIRE_EN_CFG, three_wire_mode);
  }
  
@@ -86,7 +86,7 @@
  
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
-@@ -1287,6 +1346,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1285,6 +1344,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.doit = mt7915_vendor_3wire_ctrl,
  		.policy = three_wire_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_3WIRE_CTRL_MAX,
diff --git a/recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch b/recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
index 9780db3..b1337a3 100644
--- a/recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
@@ -1,7 +1,7 @@
-From ba976379e903eb0a26276037718d5679ae95051a Mon Sep 17 00:00:00 2001
+From 33ed87389f2f190aaf298a617d2bdc737b216485 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 13 Oct 2022 13:22:05 +0800
-Subject: [PATCH 1127/1128] mt76: mt7915: add E3 re-bonding for low yield rate
+Subject: [PATCH 1126/1127] mt76: mt7915: add E3 re-bonding for low yield rate
  issue
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -12,7 +12,7 @@
  3 files changed, 38 insertions(+), 5 deletions(-)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 4d2d9ca..b3d2bbc 100644
+index 4d2d9ca2..b3d2bbc5 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -97,7 +97,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
@@ -64,10 +64,10 @@
  	if (ret)
  		return ret;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 39c8e2c..fad3559 100644
+index 4e7bc982..dfb1ee69 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2779,7 +2779,7 @@ int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode)
+@@ -2805,7 +2805,7 @@ int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode)
  				 &req, sizeof(req), true);
  }
  
@@ -76,7 +76,7 @@
  {
  	struct mt7915_mcu_eeprom_info req = {
  		.addr = cpu_to_le32(round_down(offset,
-@@ -2796,8 +2796,15 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
+@@ -2822,8 +2822,15 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
  		return ret;
  
  	res = (struct mt7915_mcu_eeprom_info *)skb->data;
@@ -95,10 +95,10 @@
  
  	return 0;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 4cdcb63..dbd634a 100644
+index 626b2634..701e5c86 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -560,6 +560,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
+@@ -562,6 +562,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
  
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
@@ -106,7 +106,7 @@
  int mt7915_eeprom_init(struct mt7915_dev *dev);
  void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
  				struct mt7915_phy *phy);
-@@ -613,7 +614,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -615,7 +616,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  				   struct ieee80211_sta *sta,
  				   void *data, u32 field);
  int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode);
diff --git a/recipes-wifi/linux-mt76/files/patches/1127-mt76-support-on-off-SW-ACI-through-debugfs.patch b/recipes-wifi/linux-mt76/files/patches/1127-mt76-support-on-off-SW-ACI-through-debugfs.patch
index 94cf85c..e853cb4 100644
--- a/recipes-wifi/linux-mt76/files/patches/1127-mt76-support-on-off-SW-ACI-through-debugfs.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1127-mt76-support-on-off-SW-ACI-through-debugfs.patch
@@ -1,7 +1,7 @@
-From 03db7df14e4b8fcf9cf69725ee3baf74656293dc Mon Sep 17 00:00:00 2001
+From 29102c6d02cdd6699881a7daa1be345719810c59 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 14 Oct 2022 11:15:13 +0800
-Subject: [PATCH 1128/1128] mt76: support on off SW ACI through debugfs
+Subject: [PATCH 1127/1127] mt76: support on off SW ACI through debugfs
 
 Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Change-Id: I8a9c277c41d1ba76f9737d8af6f42e5e8f00ba64
@@ -11,10 +11,10 @@
  2 files changed, 22 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 86a8688..a368b65 100644
+index 131257c7..3b789d75 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1164,6 +1164,7 @@ enum {
+@@ -1190,6 +1190,7 @@ enum {
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
  	MCU_EXT_CMD_SET_CFG = 0xb7,
  	MCU_EXT_CMD_EDCCA = 0xba,
@@ -23,10 +23,10 @@
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
  };
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 36cb6f0..facdd69 100644
+index e14b52c1..8c8a3ca5 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2927,6 +2927,25 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
+@@ -2932,6 +2932,25 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -52,7 +52,7 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  {
  	struct mt7915_dev *dev = phy->dev;
-@@ -3009,6 +3028,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3014,6 +3033,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  
  	debugfs_create_devm_seqfile(dev->mt76.dev, "eeprom_mode", dir,
  				    mt7915_show_eeprom_mode);
diff --git a/recipes-wifi/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch b/recipes-wifi/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch
index 5f853a4..3f85428 100644
--- a/recipes-wifi/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch
@@ -1,18 +1,18 @@
-From 457a54d92f80cb1a24cbde87e7bf2b49a65d4321 Mon Sep 17 00:00:00 2001
+From fd87002de206b299e0962d2935c5f3ab0813cfa0 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Sun, 12 Jun 2022 16:38:45 +0800
-Subject: [PATCH 3001/3011] mt76 add wed tx support
+Date: Fri, 25 Nov 2022 10:38:53 +0800
+Subject: [PATCH 3001/3010] mt76 add wed tx support
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
  mt76_connac.h |  1 +
  mt7915/mac.c  | 11 +++++++----
  mt7915/main.c |  4 ++--
- mt7915/mmio.c | 12 ++++++++++--
- 4 files changed, 20 insertions(+), 8 deletions(-)
+ mt7915/mmio.c |  5 +++--
+ 4 files changed, 13 insertions(+), 8 deletions(-)
 
 diff --git a/mt76_connac.h b/mt76_connac.h
-index 0915eb5..9a46887 100644
+index 8ba883b0..f70987dd 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -116,6 +116,7 @@ struct mt76_connac_sta_key_conf {
@@ -24,10 +24,10 @@
  struct mt76_connac_fw_txp {
  	__le16 flags;
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 5a809c2..20e5b70 100644
+index dc4c6eb3..d07bf790 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -858,9 +858,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
+@@ -890,9 +890,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
  
  	txp->token = cpu_to_le16(token_id);
  	txp->nbuf = 1;
@@ -39,7 +39,7 @@
  }
  
  static void
-@@ -976,6 +976,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1008,6 +1008,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  	LIST_HEAD(free_list);
  	void *end = data + len;
  	bool v3, wake = false;
@@ -47,7 +47,7 @@
  	u16 total, count = 0;
  	u32 txd = le32_to_cpu(free->txd);
  	__le32 *cur_info;
-@@ -1031,12 +1032,14 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1063,12 +1064,14 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  			txwi = mt76_token_release(mdev, msdu, &wake);
  			if (!txwi)
  				continue;
@@ -65,10 +65,10 @@
  
  static void
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 2b4e122..f9b2c1e 100644
+index 83b97d23..2d237abf 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1466,14 +1466,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1505,14 +1505,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	if (!mtk_wed_device_active(wed))
  		return -ENODEV;
  
@@ -86,19 +86,19 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 63b66e4..f76f896 100644
+index fef4b126..7a50aa11 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -10,7 +10,7 @@
- #include "mac.h"
+@@ -11,7 +11,7 @@
  #include "../trace.h"
+ #include "../dma.h"
  
 -static bool wed_enable;
 +static bool wed_enable = true;
  module_param(wed_enable, bool, 0644);
+ MODULE_PARM_DESC(wed_enable, "Enable Wireless Ethernet Dispatch support");
  
- static const u32 mt7915_reg[] = {
-@@ -575,7 +575,7 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
+@@ -580,7 +580,7 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
  	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
  
  	spin_lock_bh(&dev->mt76.token_lock);
@@ -107,39 +107,7 @@
  	spin_unlock_bh(&dev->mt76.token_lock);
  
  	/* MT_TXD5_TX_STATUS_HOST (MPDU format) has higher priority than
-@@ -606,6 +606,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 
- 		wed->wlan.pci_dev = pci_dev;
- 		wed->wlan.bus_type = MTK_WED_BUS_PCIE;
-+		wed->wlan.base = (void __iomem *)ioremap(
-+				 pci_resource_start(pci_dev, 0),
-+				 pci_resource_len(pci_dev, 0));
- 		wed->wlan.wpdma_int = pci_resource_start(pci_dev, 0) +
- 				      MT_INT_WED_SOURCE_CSR;
- 		wed->wlan.wpdma_mask = pci_resource_start(pci_dev, 0) +
-@@ -616,6 +619,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 				     MT_TXQ_WED_RING_BASE;
- 		wed->wlan.wpdma_txfree = pci_resource_start(pci_dev, 0) +
- 					 MT_RXQ_WED_RING_BASE;
-+		wed->wlan.phy_base = pci_resource_start(pci_dev, 0);
- 	} else {
- 		struct platform_device *plat_dev = pdev_ptr;
- 		struct resource *res;
-@@ -626,10 +630,13 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 
- 		wed->wlan.platform_dev = plat_dev;
- 		wed->wlan.bus_type = MTK_WED_BUS_AXI;
-+		wed->wlan.base = (void __iomem *)ioremap(res->start,
-+				 resource_size(res));
- 		wed->wlan.wpdma_int = res->start + MT_INT_SOURCE_CSR;
- 		wed->wlan.wpdma_mask = res->start + MT_INT_MASK_CSR;
- 		wed->wlan.wpdma_tx = res->start + MT_TXQ_WED_RING_BASE;
- 		wed->wlan.wpdma_txfree = res->start + MT_RXQ_WED_RING_BASE;
-+		wed->wlan.phy_base = res->start;
- 	}
- 	wed->wlan.nbuf = 4096;
- 	wed->wlan.tx_tbit[0] = is_mt7915(&dev->mt76) ? 4 : 30;
-@@ -645,6 +652,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -783,6 +783,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  
  	*irq = wed->irq;
  	dev->mt76.dma_dev = wed->dev;
diff --git a/recipes-wifi/linux-mt76/files/patches/3002-mt76-mt7915-add-wed-tx-wds-support-on-mt7986.patch b/recipes-wifi/linux-mt76/files/patches/3002-mt76-mt7915-add-wed-tx-wds-support-on-mt7986.patch
index 2443604..062e883 100644
--- a/recipes-wifi/linux-mt76/files/patches/3002-mt76-mt7915-add-wed-tx-wds-support-on-mt7986.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3002-mt76-mt7915-add-wed-tx-wds-support-on-mt7986.patch
@@ -1,7 +1,7 @@
-From ad8a906f3ee37375a9f2ad9b57d0eeaff90c8f14 Mon Sep 17 00:00:00 2001
+From fceca885342128a2c335e05c0517b1357bf2dc05 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Sat, 10 Sep 2022 17:09:21 +0800
-Subject: [PATCH 3002/3011] mt76: mt7915: add-wed-tx-wds-support-on-mt7986
+Subject: [PATCH 3002/3010] mt76: mt7915: add-wed-tx-wds-support-on-mt7986
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -11,15 +11,15 @@
  mt7915/main.c   | 45 +++++++++++++++++++++++++++++++++++++++++++--
  mt7915/mcu.c    | 12 ++++++++++--
  mt7915/mcu.h    |  1 +
- mt7915/mmio.c   |  3 +++
+ mt7915/mmio.c   |  1 +
  mt7915/mt7915.h |  4 ++++
- 8 files changed, 76 insertions(+), 5 deletions(-)
+ 8 files changed, 74 insertions(+), 5 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index b378231..c84c9ef 100644
+index 7e0f0e0e..f0ffbd0c 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -1363,7 +1363,10 @@ void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,
+@@ -1371,7 +1371,10 @@ void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,
  
  	mt76_packet_id_flush(dev, wcid);
  
@@ -32,10 +32,10 @@
  }
  EXPORT_SYMBOL_GPL(__mt76_sta_remove);
 diff --git a/mt76.h b/mt76.h
-index e29f490..b86c835 100644
+index db2075c3..bb0433b2 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -454,6 +454,7 @@ struct mt76_driver_ops {
+@@ -465,6 +465,7 @@ struct mt76_driver_ops {
  
  	void (*sta_remove)(struct mt76_dev *dev, struct ieee80211_vif *vif,
  			   struct ieee80211_sta *sta);
@@ -43,7 +43,7 @@
  };
  
  struct mt76_channel_state {
-@@ -825,6 +826,7 @@ struct mt76_dev {
+@@ -842,6 +843,7 @@ struct mt76_dev {
  	spinlock_t status_lock;
  
  	u32 wcid_mask[DIV_ROUND_UP(MT76_N_WCIDS, 32)];
@@ -52,10 +52,10 @@
  
  	u64 vif_mask;
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 69465dd..039a5b0 100644
+index 2f3453b0..8f32b6a8 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -719,6 +719,15 @@ mt7915_init_hardware(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+@@ -722,6 +722,15 @@ mt7915_init_hardware(struct mt7915_dev *dev, struct mt7915_phy *phy2)
  			return ret;
  	}
  
@@ -72,10 +72,10 @@
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
  	if (idx)
 diff --git a/mt7915/main.c b/mt7915/main.c
-index f9b2c1e..c061786 100644
+index 2d237abf..8813e3c5 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -660,6 +660,24 @@ mt7915_channel_switch_beacon(struct ieee80211_hw *hw,
+@@ -658,6 +658,24 @@ mt7915_channel_switch_beacon(struct ieee80211_hw *hw,
  	mutex_unlock(&dev->mt76.mutex);
  }
  
@@ -100,7 +100,7 @@
  int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  		       struct ieee80211_sta *sta)
  {
-@@ -672,8 +690,18 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -670,8 +688,18 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  #endif
  	int ret, idx;
  	u32 addr;
@@ -120,7 +120,7 @@
  	if (idx < 0)
  		return -ENOSPC;
  
-@@ -1135,6 +1163,15 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
+@@ -1141,6 +1169,15 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
  	else
  		clear_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
  
@@ -136,7 +136,7 @@
  	mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
  }
  
-@@ -1473,7 +1510,11 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1512,7 +1549,11 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	path->dev = ctx->dev;
  	path->mtk_wdma.wdma_idx = wed->wdma_idx;
  	path->mtk_wdma.bss = mvif->mt76.idx;
@@ -150,10 +150,10 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index fad3559..eb9343c 100644
+index dfb1ee69..03fd8c50 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2279,6 +2279,7 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
+@@ -2305,6 +2305,7 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
  int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  {
  	int ret;
@@ -161,7 +161,7 @@
  
  	/* force firmware operation mode into normal state,
  	 * which should be set before firmware download stage.
-@@ -2308,8 +2309,15 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2334,8 +2335,15 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -180,10 +180,10 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index b2e4032..42d5e39 100644
+index 9780f128..5fcac90f 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -270,6 +270,7 @@ enum {
+@@ -281,6 +281,7 @@ enum {
  	MCU_WA_PARAM_RED_SHOW_STA = 0xf,
  	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
  #endif
@@ -192,19 +192,10 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index f76f896..e45cd2d 100644
+index 7a50aa11..f348a779 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -646,6 +646,8 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 	wed->wlan.init_buf = mt7915_wed_init_buf;
- 	wed->wlan.offload_enable = mt7915_mmio_wed_offload_enable;
- 	wed->wlan.offload_disable = mt7915_mmio_wed_offload_disable;
-+	if (!is_mt7915(mdev))
-+		wed->wlan.wcid_512 = true;
- 
- 	if (mtk_wed_device_attach(wed))
- 		return 0;
-@@ -860,6 +862,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
+@@ -991,6 +991,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
  		.sta_add = mt7915_mac_sta_add,
  		.sta_remove = mt7915_mac_sta_remove,
  		.update_survey = mt7915_update_channel,
@@ -213,7 +204,7 @@
  	struct mt7915_dev *dev;
  	struct mt76_dev *mdev;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index dbd634a..06b98b7 100644
+index 701e5c86..6bc33f21 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -18,6 +18,9 @@
@@ -226,9 +217,9 @@
  #define MT7915_WATCHDOG_TIME		(HZ / 10)
  #define MT7915_RESET_TIMEOUT		(30 * HZ)
  
-@@ -719,6 +722,7 @@ void mt7915_tx_token_put(struct mt7915_dev *dev);
+@@ -725,6 +728,7 @@ void mt7915_tx_token_put(struct mt7915_dev *dev);
  void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
- 			 struct sk_buff *skb);
+ 			 struct sk_buff *skb, u32 *info);
  bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len);
 +bool mt7915_wed_wds_check(struct mt76_dev *mdev, struct ieee80211_sta *sta);
  void mt7915_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
diff --git a/recipes-wifi/linux-mt76/files/patches/3003-mt76-add-wed-rx-copy-skb.patch b/recipes-wifi/linux-mt76/files/patches/3003-mt76-add-wed-rx-copy-skb.patch
new file mode 100644
index 0000000..cee1e63
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/3003-mt76-add-wed-rx-copy-skb.patch
@@ -0,0 +1,70 @@
+From bcd2e7f4520fa16b90fb7e4d98e0590d3e70fe11 Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Fri, 25 Nov 2022 12:05:06 +0800
+Subject: [PATCH 32/39] mt76: add wed rx copy skb
+
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+---
+ dma.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/dma.c b/dma.c
+index d2891c64..929816b7 100644
+--- a/dma.c
++++ b/dma.c
+@@ -382,9 +382,12 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+ 				 SKB_WITH_OVERHEAD(q->buf_size),
+ 				 DMA_FROM_DEVICE);
+ 
+-		buf = t->ptr;
++		buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
++		if (!buf)
++			return NULL;
++
++		memcpy(buf, t->ptr, SKB_WITH_OVERHEAD(q->buf_size));
+ 		t->dma_addr = 0;
+-		t->ptr = NULL;
+ 
+ 		mt76_put_rxwi(dev, t);
+ 
+@@ -578,6 +581,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+ 	while (q->queued < q->ndesc - 1) {
+ 		struct mt76_txwi_cache *t = NULL;
+ 		struct mt76_queue_buf qbuf;
++		bool skip_alloc = false;
+ 		void *buf = NULL;
+ 
+ 		if ((q->flags & MT_QFLAG_WED) &&
+@@ -585,11 +589,18 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+ 			t = mt76_get_rxwi(dev);
+ 			if (!t)
+ 				break;
++
++			if (t->ptr) {
++				skip_alloc = true;
++				buf = t->ptr;
++			}
+ 		}
+ 
+-		buf = page_frag_alloc(rx_page, q->buf_size, GFP_ATOMIC);
+-		if (!buf)
+-			break;
++		if (!skip_alloc) {
++			buf = page_frag_alloc(rx_page, q->buf_size, GFP_ATOMIC);
++			if (!buf)
++				break;
++		}
+ 
+ 		addr = dma_map_single(dev->dma_dev, buf, len, DMA_FROM_DEVICE);
+ 		if (unlikely(dma_mapping_error(dev->dma_dev, addr))) {
+@@ -954,5 +965,7 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
+ 
+ 	if (mtk_wed_device_active(&dev->mmio.wed))
+ 		mtk_wed_device_detach(&dev->mmio.wed);
++
++	mt76_free_pending_rxwi(dev);
+ }
+ EXPORT_SYMBOL_GPL(mt76_dma_cleanup);
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/3003-mt76-add-wed-rx-support.patch b/recipes-wifi/linux-mt76/files/patches/3003-mt76-add-wed-rx-support.patch
deleted file mode 100644
index 0cb1c16..0000000
--- a/recipes-wifi/linux-mt76/files/patches/3003-mt76-add-wed-rx-support.patch
+++ /dev/null
@@ -1,1202 +0,0 @@
-From bc9cac100bb95aa89b6ded079f1065fbb739c90c Mon Sep 17 00:00:00 2001
-From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Tue, 5 Jul 2022 19:42:55 +0800
-Subject: [PATCH 3003/3011] mt76 add wed rx support
-
-Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
----
- dma.c             | 250 ++++++++++++++++++++++++++++++++++++++--------
- dma.h             |  10 ++
- mac80211.c        |   8 +-
- mt76.h            |  24 ++++-
- mt7603/dma.c      |   2 +-
- mt7603/mt7603.h   |   2 +-
- mt7615/mac.c      |   2 +-
- mt7615/mt7615.h   |   2 +-
- mt76_connac_mcu.c |   9 ++
- mt76x02.h         |   2 +-
- mt76x02_txrx.c    |   2 +-
- mt7915/dma.c      |  17 +++-
- mt7915/mac.c      | 101 ++++++++++++++++++-
- mt7915/mcu.c      |   3 +
- mt7915/mmio.c     |  30 ++++--
- mt7915/mt7915.h   |   7 +-
- mt7915/regs.h     |   6 ++
- mt7921/mac.c      |   2 +-
- mt7921/mt7921.h   |   2 +-
- tx.c              |  34 +++++++
- 20 files changed, 448 insertions(+), 67 deletions(-)
-
-diff --git a/dma.c b/dma.c
-index 82b4da2..a8739eb 100644
---- a/dma.c
-+++ b/dma.c
-@@ -98,6 +98,63 @@ mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t)
- }
- EXPORT_SYMBOL_GPL(mt76_put_txwi);
- 
-+static struct mt76_txwi_cache *
-+mt76_alloc_rxwi(struct mt76_dev *dev)
-+{
-+	struct mt76_txwi_cache *r;
-+	int size;
-+
-+	size = L1_CACHE_ALIGN(sizeof(*r));
-+	r = kzalloc(size, GFP_ATOMIC);
-+	if (!r)
-+		return NULL;
-+
-+	r->buf = NULL;
-+
-+	return r;
-+}
-+
-+static struct mt76_txwi_cache *
-+__mt76_get_rxwi(struct mt76_dev *dev)
-+{
-+	struct mt76_txwi_cache *r = NULL;
-+
-+	spin_lock(&dev->wed_lock);
-+	if (!list_empty(&dev->rxwi_cache)) {
-+		r = list_first_entry(&dev->rxwi_cache, struct mt76_txwi_cache,
-+				     list);
-+		if(r)
-+			list_del(&r->list);
-+	}
-+	spin_unlock(&dev->wed_lock);
-+
-+	return r;
-+}
-+
-+struct mt76_txwi_cache *
-+mt76_get_rxwi(struct mt76_dev *dev)
-+{
-+	struct mt76_txwi_cache *r = __mt76_get_rxwi(dev);
-+
-+	if (r)
-+		return r;
-+
-+	return mt76_alloc_rxwi(dev);
-+}
-+EXPORT_SYMBOL_GPL(mt76_get_rxwi);
-+
-+void
-+mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *r)
-+{
-+	if (!r)
-+		return;
-+
-+	spin_lock(&dev->wed_lock);
-+	list_add(&r->list, &dev->rxwi_cache);
-+	spin_unlock(&dev->wed_lock);
-+}
-+EXPORT_SYMBOL_GPL(mt76_put_rxwi);
-+
- static void
- mt76_free_pending_txwi(struct mt76_dev *dev)
- {
-@@ -112,6 +169,21 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
- 	local_bh_enable();
- }
- 
-+static void
-+mt76_free_pending_rxwi(struct mt76_dev *dev)
-+{
-+	struct mt76_txwi_cache *r;
-+
-+	local_bh_disable();
-+	while ((r = __mt76_get_rxwi(dev)) != NULL) {
-+		if (r->buf)
-+			skb_free_frag(r->buf);
-+
-+		kfree(r);
-+	}
-+	local_bh_enable();
-+}
-+
- static void
- mt76_dma_sync_idx(struct mt76_dev *dev, struct mt76_queue *q)
- {
-@@ -141,12 +213,15 @@ mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q)
- static int
- mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
- 		 struct mt76_queue_buf *buf, int nbufs, u32 info,
--		 struct sk_buff *skb, void *txwi)
-+		 struct sk_buff *skb, void *txwi, void *rxwi)
- {
-+	struct mtk_wed_device *wed = &dev->mmio.wed;
-+
- 	struct mt76_queue_entry *entry;
- 	struct mt76_desc *desc;
- 	u32 ctrl;
- 	int i, idx = -1;
-+	int type;
- 
- 	if (txwi) {
- 		q->entry[q->head].txwi = DMA_DUMMY_DATA;
-@@ -162,28 +237,42 @@ mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
- 		desc = &q->desc[idx];
- 		entry = &q->entry[idx];
- 
--		if (buf[0].skip_unmap)
--			entry->skip_buf0 = true;
--		entry->skip_buf1 = i == nbufs - 1;
--
--		entry->dma_addr[0] = buf[0].addr;
--		entry->dma_len[0] = buf[0].len;
--
--		ctrl = FIELD_PREP(MT_DMA_CTL_SD_LEN0, buf[0].len);
--		if (i < nbufs - 1) {
--			entry->dma_addr[1] = buf[1].addr;
--			entry->dma_len[1] = buf[1].len;
--			buf1 = buf[1].addr;
--			ctrl |= FIELD_PREP(MT_DMA_CTL_SD_LEN1, buf[1].len);
--			if (buf[1].skip_unmap)
--				entry->skip_buf1 = true;
-+		type = FIELD_GET(MT_QFLAG_WED_TYPE, q->flags);
-+		if (mtk_wed_device_active(wed) && type == MT76_WED_Q_RX) {
-+			struct mt76_txwi_cache *r = rxwi;
-+			int rx_token;
-+
-+			if (!r)
-+				return -ENOMEM;
-+
-+			rx_token = mt76_rx_token_consume(dev, (void *)skb, r, buf[0].addr);
-+
-+			buf1 |= FIELD_PREP(MT_DMA_CTL_TOKEN, rx_token);
-+			ctrl = FIELD_PREP(MT_DMA_CTL_SD_LEN0, MTK_WED_RX_PKT_SIZE);
-+			ctrl |= MT_DMA_CTL_TO_HOST;
-+		} else {
-+			if (buf[0].skip_unmap)
-+				entry->skip_buf0 = true;
-+			entry->skip_buf1 = i == nbufs - 1;
-+
-+			entry->dma_addr[0] = buf[0].addr;
-+			entry->dma_len[0] = buf[0].len;
-+
-+			ctrl = FIELD_PREP(MT_DMA_CTL_SD_LEN0, buf[0].len);
-+			if (i < nbufs - 1) {
-+				entry->dma_addr[1] = buf[1].addr;
-+				entry->dma_len[1] = buf[1].len;
-+				buf1 = buf[1].addr;
-+				ctrl |= FIELD_PREP(MT_DMA_CTL_SD_LEN1, buf[1].len);
-+				if (buf[1].skip_unmap)
-+					entry->skip_buf1 = true;
-+			}
-+			if (i == nbufs - 1)
-+				ctrl |= MT_DMA_CTL_LAST_SEC0;
-+			else if (i == nbufs - 2)
-+				ctrl |= MT_DMA_CTL_LAST_SEC1;
- 		}
- 
--		if (i == nbufs - 1)
--			ctrl |= MT_DMA_CTL_LAST_SEC0;
--		else if (i == nbufs - 2)
--			ctrl |= MT_DMA_CTL_LAST_SEC1;
--
- 		WRITE_ONCE(desc->buf0, cpu_to_le32(buf0));
- 		WRITE_ONCE(desc->buf1, cpu_to_le32(buf1));
- 		WRITE_ONCE(desc->info, cpu_to_le32(info));
-@@ -272,33 +361,65 @@ mt76_dma_tx_cleanup(struct mt76_dev *dev, struct mt76_queue *q, bool flush)
- 
- static void *
- mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
--		 int *len, u32 *info, bool *more)
-+		 int *len, u32 *info, bool *more, bool *drop)
- {
- 	struct mt76_queue_entry *e = &q->entry[idx];
- 	struct mt76_desc *desc = &q->desc[idx];
- 	dma_addr_t buf_addr;
--	void *buf = e->buf;
-+	void *buf = e->buf, *copy = NULL;
- 	int buf_len = SKB_WITH_OVERHEAD(q->buf_size);
-+	struct mtk_wed_device *wed = &dev->mmio.wed;
-+	int type;
- 
--	buf_addr = e->dma_addr[0];
- 	if (len) {
- 		u32 ctl = le32_to_cpu(READ_ONCE(desc->ctrl));
- 		*len = FIELD_GET(MT_DMA_CTL_SD_LEN0, ctl);
- 		*more = !(ctl & MT_DMA_CTL_LAST_SEC0);
- 	}
- 
--	if (info)
--		*info = le32_to_cpu(desc->info);
-+	type = FIELD_GET(MT_QFLAG_WED_TYPE, q->flags);
-+	if (mtk_wed_device_active(wed) && type == MT76_WED_Q_RX) {
-+		u32 token;
-+		struct mt76_txwi_cache *r;
-+
-+		token = FIELD_GET(MT_DMA_CTL_TOKEN, desc->buf1);
-+
-+		r = mt76_rx_token_release(dev, token);
-+		if (!r)
-+			return NULL;
-+
-+		buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
-+		if (!buf)
-+			return NULL;
-+
-+		copy = r->buf;
-+		buf_addr = r->dma_addr;
-+		buf_len = MTK_WED_RX_PKT_SIZE;
-+		r->dma_addr = 0;
-+
-+		mt76_put_rxwi(dev, r);
-+
-+		if (desc->ctrl & (MT_DMA_CTL_TO_HOST_A | MT_DMA_CTL_DROP))
-+			*drop = true;
-+	} else {
-+		buf_addr = e->dma_addr[0];
-+		e->buf = NULL;
-+	}
- 
- 	dma_unmap_single(dev->dma_dev, buf_addr, buf_len, DMA_FROM_DEVICE);
--	e->buf = NULL;
-+
-+	if (copy)
-+		memcpy(buf, copy, MTK_WED_RX_PKT_SIZE);
-+
-+	if (info)
-+		*info = le32_to_cpu(desc->info);
- 
- 	return buf;
- }
- 
- static void *
- mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
--		 int *len, u32 *info, bool *more)
-+		 int *len, u32 *info, bool *more, bool *drop)
- {
- 	int idx = q->tail;
- 
-@@ -314,7 +435,7 @@ mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
- 	q->tail = (q->tail + 1) % q->ndesc;
- 	q->queued--;
- 
--	return mt76_dma_get_buf(dev, q, idx, len, info, more);
-+	return mt76_dma_get_buf(dev, q, idx, len, info, more, drop);
- }
- 
- static int
-@@ -336,7 +457,7 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
- 	buf.len = skb->len;
- 
- 	spin_lock_bh(&q->lock);
--	mt76_dma_add_buf(dev, q, &buf, 1, tx_info, skb, NULL);
-+	mt76_dma_add_buf(dev, q, &buf, 1, tx_info, skb, NULL, NULL);
- 	mt76_dma_kick_queue(dev, q);
- 	spin_unlock_bh(&q->lock);
- 
-@@ -413,7 +534,7 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q,
- 		goto unmap;
- 
- 	return mt76_dma_add_buf(dev, q, tx_info.buf, tx_info.nbuf,
--				tx_info.info, tx_info.skb, t);
-+				tx_info.info, tx_info.skb, t, NULL);
- 
- unmap:
- 	for (n--; n > 0; n--)
-@@ -448,6 +569,8 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- 	int frames = 0;
- 	int len = SKB_WITH_OVERHEAD(q->buf_size);
- 	int offset = q->buf_offset;
-+	struct mtk_wed_device *wed = &dev->mmio.wed;
-+	struct page_frag_cache *rx_page;
- 
- 	if (!q->ndesc)
- 		return 0;
-@@ -456,10 +579,29 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- 
- 	while (q->queued < q->ndesc - 1) {
- 		struct mt76_queue_buf qbuf;
-+		int type = FIELD_GET(MT_QFLAG_WED_TYPE, q->flags);
-+		bool skip_alloc = false;
-+		struct mt76_txwi_cache *r = NULL;
-+
-+		rx_page = &q->rx_page;
-+		if (mtk_wed_device_active(wed) && type == MT76_WED_Q_RX) {
-+			rx_page = &wed->rx_page;
-+			r = mt76_get_rxwi(dev);
-+			if (!r)
-+				return -ENOMEM;
-+
-+			if (r->buf) {
-+				skip_alloc = true;
-+				len = MTK_WED_RX_PKT_SIZE;
-+				buf = r->buf;
-+			}
-+		}
- 
--		buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
--		if (!buf)
--			break;
-+		if (!skip_alloc) {
-+			buf = page_frag_alloc(rx_page, q->buf_size, GFP_ATOMIC);
-+			if (!buf)
-+				break;
-+		}
- 
- 		addr = dma_map_single(dev->dma_dev, buf, len, DMA_FROM_DEVICE);
- 		if (unlikely(dma_mapping_error(dev->dma_dev, addr))) {
-@@ -470,7 +612,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- 		qbuf.addr = addr + offset;
- 		qbuf.len = len - offset;
- 		qbuf.skip_unmap = false;
--		mt76_dma_add_buf(dev, q, &qbuf, 1, 0, buf, NULL);
-+		mt76_dma_add_buf(dev, q, &qbuf, 1, 0, buf, NULL, r);
- 		frames++;
- 	}
- 
-@@ -516,6 +658,11 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
- 		if (!ret)
- 			q->wed_regs = wed->txfree_ring.reg_base;
- 		break;
-+	case MT76_WED_Q_RX:
-+		ret = mtk_wed_device_rx_ring_setup(wed, ring, q->regs);
-+		if (!ret)
-+			q->wed_regs = wed->rx_ring[ring].reg_base;
-+		break;
- 	default:
- 		ret = -EINVAL;
- 	}
-@@ -531,7 +678,8 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
- 		     int idx, int n_desc, int bufsize,
- 		     u32 ring_base)
- {
--	int ret, size;
-+	int ret, size, type;
-+	struct mtk_wed_device *wed = &dev->mmio.wed;
- 
- 	spin_lock_init(&q->lock);
- 	spin_lock_init(&q->cleanup_lock);
-@@ -541,6 +689,11 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
- 	q->buf_size = bufsize;
- 	q->hw_idx = idx;
- 
-+	type = FIELD_GET(MT_QFLAG_WED_TYPE, q->flags);
-+	if (mtk_wed_device_active(wed) && type == MT76_WED_Q_RX)
-+		q->buf_size = SKB_DATA_ALIGN(NET_SKB_PAD + MTK_WED_RX_PKT_SIZE) +
-+					     SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
-+
- 	size = q->ndesc * sizeof(struct mt76_desc);
- 	q->desc = dmam_alloc_coherent(dev->dma_dev, size, &q->desc_dma, GFP_KERNEL);
- 	if (!q->desc)
-@@ -573,7 +726,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
- 
- 	spin_lock_bh(&q->lock);
- 	do {
--		buf = mt76_dma_dequeue(dev, q, true, NULL, NULL, &more);
-+		buf = mt76_dma_dequeue(dev, q, true, NULL, NULL, &more, NULL);
- 		if (!buf)
- 			break;
- 
-@@ -614,7 +767,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
- 
- static void
- mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
--		  int len, bool more)
-+		  int len, bool more, u32 info)
- {
- 	struct sk_buff *skb = q->rx_head;
- 	struct skb_shared_info *shinfo = skb_shinfo(skb);
-@@ -634,7 +787,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
- 
- 	q->rx_head = NULL;
- 	if (nr_frags < ARRAY_SIZE(shinfo->frags))
--		dev->drv->rx_skb(dev, q - dev->q_rx, skb);
-+		dev->drv->rx_skb(dev, q - dev->q_rx, skb, info);
- 	else
- 		dev_kfree_skb(skb);
- }
-@@ -655,6 +808,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
- 	}
- 
- 	while (done < budget) {
-+		bool drop = false;
- 		u32 info;
- 
- 		if (check_ddone) {
-@@ -665,10 +819,13 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
- 				break;
- 		}
- 
--		data = mt76_dma_dequeue(dev, q, false, &len, &info, &more);
-+		data = mt76_dma_dequeue(dev, q, false, &len, &info, &more, &drop);
- 		if (!data)
- 			break;
- 
-+		if (drop)
-+			goto free_frag;
-+
- 		if (q->rx_head)
- 			data_len = q->buf_size;
- 		else
-@@ -681,7 +838,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
- 		}
- 
- 		if (q->rx_head) {
--			mt76_add_fragment(dev, q, data, len, more);
-+			mt76_add_fragment(dev, q, data, len, more, info);
- 			continue;
- 		}
- 
-@@ -705,7 +862,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
- 			continue;
- 		}
- 
--		dev->drv->rx_skb(dev, q - dev->q_rx, skb);
-+		dev->drv->rx_skb(dev, q - dev->q_rx, skb, info);
- 		continue;
- 
- free_frag:
-@@ -782,7 +939,7 @@ EXPORT_SYMBOL_GPL(mt76_dma_attach);
- 
- void mt76_dma_cleanup(struct mt76_dev *dev)
- {
--	int i;
-+	int i, type;
- 
- 	mt76_worker_disable(&dev->tx_worker);
- 	netif_napi_del(&dev->tx_napi);
-@@ -803,12 +960,17 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
- 
- 	mt76_for_each_q_rx(dev, i) {
- 		netif_napi_del(&dev->napi[i]);
--		mt76_dma_rx_cleanup(dev, &dev->q_rx[i]);
-+		type = FIELD_GET(MT_QFLAG_WED_TYPE, dev->q_rx[i].flags);
-+		if (type != MT76_WED_Q_RX)
-+			mt76_dma_rx_cleanup(dev, &dev->q_rx[i]);
- 	}
- 
- 	mt76_free_pending_txwi(dev);
-+	mt76_free_pending_rxwi(dev);
- 
- 	if (mtk_wed_device_active(&dev->mmio.wed))
- 		mtk_wed_device_detach(&dev->mmio.wed);
-+
-+	mt76_free_pending_rxwi(dev);
- }
- EXPORT_SYMBOL_GPL(mt76_dma_cleanup);
-diff --git a/dma.h b/dma.h
-index fdf786f..90370d1 100644
---- a/dma.h
-+++ b/dma.h
-@@ -16,6 +16,16 @@
- #define MT_DMA_CTL_LAST_SEC0		BIT(30)
- #define MT_DMA_CTL_DMA_DONE		BIT(31)
- 
-+#define MT_DMA_CTL_TO_HOST		BIT(8)
-+#define MT_DMA_CTL_TO_HOST_A		BIT(12)
-+#define MT_DMA_CTL_DROP			BIT(14)
-+
-+#define MT_DMA_CTL_TOKEN		GENMASK(31, 16)
-+
-+#define MT_DMA_PPE_CPU_REASON		GENMASK(15, 11)
-+#define MT_DMA_PPE_ENTRY		GENMASK(30, 16)
-+#define MT_DMA_INFO_PPE_VLD 		BIT(31)
-+
- #define MT_DMA_HDR_LEN			4
- #define MT_RX_INFO_LEN			4
- #define MT_FCE_INFO_LEN			4
-diff --git a/mac80211.c b/mac80211.c
-index c84c9ef..32961b6 100644
---- a/mac80211.c
-+++ b/mac80211.c
-@@ -603,11 +603,14 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
- 		BIT(NL80211_IFTYPE_ADHOC);
- 
- 	spin_lock_init(&dev->token_lock);
-+	spin_lock_init(&dev->rx_token_lock);
- 	idr_init(&dev->token);
-+	idr_init(&dev->rx_token);
- 
- 	INIT_LIST_HEAD(&dev->wcid_list);
- 
- 	INIT_LIST_HEAD(&dev->txwi_cache);
-+	INIT_LIST_HEAD(&dev->rxwi_cache);
- 	dev->token_size = dev->drv->token_size;
- 
- 	for (i = 0; i < ARRAY_SIZE(dev->q_rx); i++)
-@@ -1304,7 +1307,10 @@ void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
- 
- 	while ((skb = __skb_dequeue(&dev->rx_skb[q])) != NULL) {
- 		mt76_check_sta(dev, skb);
--		mt76_rx_aggr_reorder(skb, &frames);
-+		if (mtk_wed_device_active(&dev->mmio.wed))
-+			__skb_queue_tail(&frames, skb);
-+		else
-+			mt76_rx_aggr_reorder(skb, &frames);
- 	}
- 
- 	mt76_rx_complete(dev, &frames, napi);
-diff --git a/mt76.h b/mt76.h
-index b86c835..627bcbf 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -20,6 +20,8 @@
- 
- #define MT_MCU_RING_SIZE	32
- #define MT_RX_BUF_SIZE		2048
-+#define MTK_WED_RX_PKT_SIZE	1700
-+
- #define MT_SKB_HEAD_LEN		256
- 
- #define MT_MAX_NON_AQL_PKT	16
-@@ -35,6 +37,7 @@
- 				 FIELD_PREP(MT_QFLAG_WED_TYPE, _type) | \
- 				 FIELD_PREP(MT_QFLAG_WED_RING, _n))
- #define MT_WED_Q_TX(_n)		__MT_WED_Q(MT76_WED_Q_TX, _n)
-+#define MT_WED_Q_RX(_n)		__MT_WED_Q(MT76_WED_Q_RX, _n)
- #define MT_WED_Q_TXFREE		__MT_WED_Q(MT76_WED_Q_TXFREE, 0)
- 
- struct mt76_dev;
-@@ -56,6 +59,7 @@ enum mt76_bus_type {
- enum mt76_wed_type {
- 	MT76_WED_Q_TX,
- 	MT76_WED_Q_TXFREE,
-+	MT76_WED_Q_RX,
- };
- 
- struct mt76_bus_ops {
-@@ -339,7 +343,10 @@ struct mt76_txwi_cache {
- 	struct list_head list;
- 	dma_addr_t dma_addr;
- 
--	struct sk_buff *skb;
-+	union {
-+		void *buf;
-+		struct sk_buff *skb;
-+	};
- };
- 
- struct mt76_rx_tid {
-@@ -439,7 +446,7 @@ struct mt76_driver_ops {
- 	bool (*rx_check)(struct mt76_dev *dev, void *data, int len);
- 
- 	void (*rx_skb)(struct mt76_dev *dev, enum mt76_rxq_id q,
--		       struct sk_buff *skb);
-+		       struct sk_buff *skb, u32 info);
- 
- 	void (*rx_poll_complete)(struct mt76_dev *dev, enum mt76_rxq_id q);
- 
-@@ -782,6 +789,7 @@ struct mt76_dev {
- 	struct ieee80211_hw *hw;
- 
- 	spinlock_t lock;
-+	spinlock_t wed_lock;
- 	spinlock_t cc_lock;
- 
- 	u32 cur_cc_bss_rx;
-@@ -807,6 +815,7 @@ struct mt76_dev {
- 	struct sk_buff_head rx_skb[__MT_RXQ_MAX];
- 
- 	struct list_head txwi_cache;
-+	struct list_head rxwi_cache;
- 	struct mt76_queue *q_mcu[__MT_MCUQ_MAX];
- 	struct mt76_queue q_rx[__MT_RXQ_MAX];
- 	const struct mt76_queue_ops *queue_ops;
-@@ -820,6 +829,9 @@ struct mt76_dev {
- 	u16 wed_token_count;
- 	u16 token_count;
- 	u16 token_size;
-+	u16 rx_token_size;
-+	spinlock_t rx_token_lock;
-+	struct idr rx_token;
- 
- 	wait_queue_head_t tx_wait;
- 	/* spinclock used to protect wcid pktid linked list */
-@@ -1361,6 +1373,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
- }
- 
- void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
-+void mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
-+struct mt76_txwi_cache *mt76_get_rxwi(struct mt76_dev *dev);
- void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
- 		      struct napi_struct *napi);
- void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
-@@ -1505,6 +1519,12 @@ struct mt76_txwi_cache *
- mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
- int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
- void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
-+int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
-+			struct mt76_txwi_cache *r, dma_addr_t phys);
-+void skb_trace(const struct sk_buff *skb, bool full_pkt);
-+
-+struct mt76_txwi_cache *
-+mt76_rx_token_release(struct mt76_dev *dev, int token);
- 
- static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
- {
-diff --git a/mt7603/dma.c b/mt7603/dma.c
-index 590cff9..2ff71c5 100644
---- a/mt7603/dma.c
-+++ b/mt7603/dma.c
-@@ -69,7 +69,7 @@ free:
- }
- 
- void mt7603_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb)
-+			 struct sk_buff *skb, u32 info)
- {
- 	struct mt7603_dev *dev = container_of(mdev, struct mt7603_dev, mt76);
- 	__le32 *rxd = (__le32 *)skb->data;
-diff --git a/mt7603/mt7603.h b/mt7603/mt7603.h
-index 0fd46d9..f2ce22a 100644
---- a/mt7603/mt7603.h
-+++ b/mt7603/mt7603.h
-@@ -244,7 +244,7 @@ int mt7603_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
- void mt7603_tx_complete_skb(struct mt76_dev *mdev, struct mt76_queue_entry *e);
- 
- void mt7603_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb);
-+			 struct sk_buff *skb, u32 info);
- void mt7603_rx_poll_complete(struct mt76_dev *mdev, enum mt76_rxq_id q);
- void mt7603_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
- int mt7603_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
-diff --git a/mt7615/mac.c b/mt7615/mac.c
-index 305bf18..4aed123 100644
---- a/mt7615/mac.c
-+++ b/mt7615/mac.c
-@@ -1666,7 +1666,7 @@ bool mt7615_rx_check(struct mt76_dev *mdev, void *data, int len)
- EXPORT_SYMBOL_GPL(mt7615_rx_check);
- 
- void mt7615_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb)
-+			 struct sk_buff *skb, u32 info)
- {
- 	struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
- 	__le32 *rxd = (__le32 *)skb->data;
-diff --git a/mt7615/mt7615.h b/mt7615/mt7615.h
-index 1080d20..91b3037 100644
---- a/mt7615/mt7615.h
-+++ b/mt7615/mt7615.h
-@@ -514,7 +514,7 @@ void mt7615_tx_worker(struct mt76_worker *w);
- void mt7615_tx_token_put(struct mt7615_dev *dev);
- bool mt7615_rx_check(struct mt76_dev *mdev, void *data, int len);
- void mt7615_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb);
-+			 struct sk_buff *skb, u32 info);
- void mt7615_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
- int mt7615_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 		       struct ieee80211_sta *sta);
-diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index afdd42f..1b01ef2 100644
---- a/mt76_connac_mcu.c
-+++ b/mt76_connac_mcu.c
-@@ -1192,6 +1192,7 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
- 			   int cmd, bool enable, bool tx)
- {
- 	struct mt76_wcid *wcid = (struct mt76_wcid *)params->sta->drv_priv;
-+	struct mtk_wed_device *wed = &dev->mmio.wed;
- 	struct wtbl_req_hdr *wtbl_hdr;
- 	struct tlv *sta_wtbl;
- 	struct sk_buff *skb;
-@@ -1212,6 +1213,8 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
- 	mt76_connac_mcu_wtbl_ba_tlv(dev, skb, params, enable, tx, sta_wtbl,
- 				    wtbl_hdr);
- 
-+	if (mtk_wed_device_active(wed) && wed->ver > MTK_WED_V1)
-+		mtk_wed_device_update_msg(wed, WED_WO_STA_REC, skb->data, skb->len);
- 	ret = mt76_mcu_skb_send_msg(dev, skb, cmd, true);
- 	if (ret)
- 		return ret;
-@@ -1222,6 +1225,8 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
- 
- 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, tx);
- 
-+	if (mtk_wed_device_active(wed) && wed->ver > MTK_WED_V1)
-+		mtk_wed_device_update_msg(wed, WED_WO_STA_REC, skb->data, skb->len);
- 	return mt76_mcu_skb_send_msg(dev, skb, cmd, true);
- }
- EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_ba);
-@@ -2651,6 +2656,7 @@ int mt76_connac_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
- 			    struct mt76_wcid *wcid, enum set_key_cmd cmd)
- {
- 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
-+	struct mtk_wed_device *wed = &dev->mmio.wed;
- 	struct sk_buff *skb;
- 	int ret;
- 
-@@ -2662,6 +2668,9 @@ int mt76_connac_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
- 	if (ret)
- 		return ret;
- 
-+	if (mtk_wed_device_active(wed) && wed->ver > MTK_WED_V1)
-+		mtk_wed_device_update_msg(wed, WED_WO_STA_REC, skb->data, skb->len);
-+
- 	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
- }
- EXPORT_SYMBOL_GPL(mt76_connac_mcu_add_key);
-diff --git a/mt76x02.h b/mt76x02.h
-index 849c264..49112ab 100644
---- a/mt76x02.h
-+++ b/mt76x02.h
-@@ -187,7 +187,7 @@ int mt76x02_set_rts_threshold(struct ieee80211_hw *hw, u32 val);
- void mt76x02_remove_hdr_pad(struct sk_buff *skb, int len);
- bool mt76x02_tx_status_data(struct mt76_dev *mdev, u8 *update);
- void mt76x02_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			  struct sk_buff *skb);
-+			  struct sk_buff *skb, u32 info);
- void mt76x02_rx_poll_complete(struct mt76_dev *mdev, enum mt76_rxq_id q);
- irqreturn_t mt76x02_irq_handler(int irq, void *dev_instance);
- void mt76x02_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
-diff --git a/mt76x02_txrx.c b/mt76x02_txrx.c
-index 3a31307..5d6c8f7 100644
---- a/mt76x02_txrx.c
-+++ b/mt76x02_txrx.c
-@@ -33,7 +33,7 @@ void mt76x02_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
- EXPORT_SYMBOL_GPL(mt76x02_tx);
- 
- void mt76x02_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			  struct sk_buff *skb)
-+			  struct sk_buff *skb, u32 info)
- {
- 	struct mt76x02_dev *dev = container_of(mdev, struct mt76x02_dev, mt76);
- 	void *rxwi = skb->data;
-diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 9a57ad8..6f6550f 100644
---- a/mt7915/dma.c
-+++ b/mt7915/dma.c
-@@ -365,7 +365,8 @@ static int mt7915_dma_enable(struct mt7915_dev *dev)
- 		wed_irq_mask |= MT_INT_TX_DONE_BAND0 | MT_INT_TX_DONE_BAND1;
- 		if (!is_mt7986(&dev->mt76))
- 			mt76_wr(dev, MT_INT_WED_MASK_CSR, wed_irq_mask);
--		mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask);
-+		else
-+			mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask);
- 		mtk_wed_device_start(&dev->mt76.mmio.wed, wed_irq_mask);
- 	}
- 
-@@ -377,6 +378,7 @@ static int mt7915_dma_enable(struct mt7915_dev *dev)
- int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- {
- 	struct mt76_dev *mdev = &dev->mt76;
-+	struct mtk_wed_device *wed = &mdev->mmio.wed;
- 	u32 wa_rx_base, wa_rx_idx;
- 	u32 hif1_ofs = 0;
- 	int ret;
-@@ -401,6 +403,9 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 				FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_TX1, 19) |
- 				FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_RX1,
- 					   wed_control_rx1));
-+			if(is_mt7915(mdev))
-+				mt76_rmw(dev, MT_WFDMA0_EXT0_CFG, MT_WFDMA0_EXT0_RXWB_KEEP,
-+					   MT_WFDMA0_EXT0_RXWB_KEEP);
- 		}
- 	} else {
- 		mt76_clear(dev, MT_WFDMA_HOST_CONFIG, MT_WFDMA_HOST_CONFIG_WED);
-@@ -473,6 +478,11 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 
- 	/* rx data queue for band0 */
- 	if (!dev->phy.band_idx) {
-+		if (mtk_wed_device_active(wed) && wed->ver > MTK_WED_V1) {
-+			dev->mt76.q_rx[MT_RXQ_MAIN].flags = MT_WED_Q_RX(MT7915_RXQ_BAND0);
-+			dev->mt76.rx_token_size += MT7915_RX_RING_SIZE;
-+		}
-+
- 		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_MAIN],
- 				       MT_RXQ_ID(MT_RXQ_MAIN),
- 				       MT7915_RX_RING_SIZE,
-@@ -503,6 +513,11 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 	}
- 
- 	if (dev->dbdc_support || dev->phy.band_idx) {
-+		if (mtk_wed_device_active(wed) && wed->ver > MTK_WED_V1) {
-+			dev->mt76.q_rx[MT_RXQ_BAND1].flags = MT_WED_Q_RX(MT7915_RXQ_BAND1);
-+			dev->mt76.rx_token_size += MT7915_RX_RING_SIZE;
-+		}
-+
- 		/* rx data queue for band1 */
- 		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_BAND1],
- 				       MT_RXQ_ID(MT_RXQ_BAND1),
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 20e5b70..eac4946 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -247,7 +247,7 @@ void mt7915_mac_enable_rtscts(struct mt7915_dev *dev,
- }
- 
- static int
--mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
-+mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb, enum mt76_rxq_id q, u32 info)
- {
- 	struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
- 	struct mt76_phy *mphy = &dev->mt76.phy;
-@@ -526,6 +526,27 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
- #endif
- 	} else {
- 		status->flag |= RX_FLAG_8023;
-+		if (msta && msta->vif) {
-+			struct mtk_wed_device *wed;
-+			int type;
-+
-+			wed = &dev->mt76.mmio.wed;
-+			type = FIELD_GET(MT_QFLAG_WED_TYPE, dev->mt76.q_rx[q].flags);
-+			if ((mtk_wed_device_active(wed) && type == MT76_WED_Q_RX) &&
-+			    (info & MT_DMA_INFO_PPE_VLD)) {
-+				struct ieee80211_vif *vif;
-+				u32 hash, reason;
-+
-+				vif = container_of((void *)msta->vif, struct ieee80211_vif,
-+						   drv_priv);
-+
-+				skb->dev = ieee80211_vif_to_netdev(vif);
-+				reason = FIELD_GET(MT_DMA_PPE_CPU_REASON, info);
-+				hash = FIELD_GET(MT_DMA_PPE_ENTRY, info);
-+
-+				mtk_wed_device_ppe_check(wed, skb, reason, hash);
-+			}
-+		}
- 	}
- 
- 	if (rxv && mode >= MT_PHY_TYPE_HE_SU && !(status->flag & RX_FLAG_8023))
-@@ -863,6 +884,80 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
- 	return MT_TXD_TXP_BUF_SIZE;
- }
- 
-+u32
-+mt7915_wed_init_rx_buf(struct mtk_wed_device *wed, int pkt_num)
-+{
-+	struct mtk_rxbm_desc *desc = wed->rx_buf_ring.desc;
-+	struct mt7915_dev *dev;
-+	dma_addr_t buf_phys;
-+	void *buf;
-+	int i, token, buf_size;
-+
-+	buf_size = SKB_DATA_ALIGN(NET_SKB_PAD + wed->wlan.rx_pkt_size) +
-+				  SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
-+
-+	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
-+	for (i = 0; i < pkt_num; i++) {
-+		struct mt76_txwi_cache *r = mt76_get_rxwi(&dev->mt76);
-+
-+		buf = page_frag_alloc(&wed->rx_page, buf_size, GFP_ATOMIC);
-+		if (!buf)
-+			return -ENOMEM;
-+
-+		buf_phys = dma_map_single(dev->mt76.dma_dev, buf, wed->wlan.rx_pkt_size,
-+					  DMA_TO_DEVICE);
-+
-+		if (unlikely(dma_mapping_error(dev->mt76.dev, buf_phys))) {
-+			skb_free_frag(buf);
-+			break;
-+		}
-+
-+		desc->buf0 = buf_phys;
-+
-+		token = mt76_rx_token_consume(&dev->mt76, buf, r, buf_phys);
-+
-+		desc->token |= FIELD_PREP(MT_DMA_CTL_TOKEN, token);
-+		desc++;
-+	}
-+
-+	return 0;
-+}
-+
-+void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed)
-+{
-+	struct mt76_txwi_cache *rxwi;
-+	struct mt7915_dev *dev;
-+	struct page *page;
-+	int token;
-+
-+	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
-+
-+	for(token = 0; token < dev->mt76.rx_token_size; token++) {
-+		rxwi = mt76_rx_token_release(&dev->mt76, token);
-+		if(!rxwi)
-+			continue;
-+
-+		if(!rxwi->buf)
-+			continue;
-+
-+		dma_unmap_single(dev->mt76.dma_dev, rxwi->dma_addr,
-+			 wed->wlan.rx_pkt_size, DMA_FROM_DEVICE);
-+		skb_free_frag(rxwi->buf);
-+		rxwi->buf = NULL;
-+
-+		mt76_put_rxwi(&dev->mt76, rxwi);
-+	}
-+
-+	if (wed->rx_page.va)
-+		return;
-+
-+	page = virt_to_page(wed->rx_page.va);
-+	__page_frag_cache_drain(page, wed->rx_page.pagecnt_bias);
-+	memset(&wed->rx_page, 0, sizeof(wed->rx_page));
-+
-+	return;
-+}
-+
- static void
- mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
- {
-@@ -1147,7 +1242,7 @@ bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len)
- }
- 
- void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb)
-+			 struct sk_buff *skb, u32 info)
- {
- 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
- 	__le32 *rxd = (__le32 *)skb->data;
-@@ -1181,7 +1276,7 @@ void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
- 		dev_kfree_skb(skb);
- 		break;
- 	case PKT_TYPE_NORMAL:
--		if (!mt7915_mac_fill_rx(dev, skb)) {
-+		if (!mt7915_mac_fill_rx(dev, skb, q, info)) {
- 			mt76_rx(&dev->mt76, q, skb);
- 			return;
- 		}
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index eb9343c..c11e575 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -1653,6 +1653,7 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
- 		       struct ieee80211_sta *sta, bool enable)
- {
- 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
-+	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
- 	struct mt7915_sta *msta;
- 	struct sk_buff *skb;
- 	int ret;
-@@ -1705,6 +1706,8 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
- 		return ret;
- 	}
- out:
-+	if (mtk_wed_device_active(wed) && wed->ver > MTK_WED_V1)
-+		mtk_wed_device_update_msg(wed, WED_WO_STA_REC, skb->data, skb->len);
- 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
- 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
- }
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index e45cd2d..1e22ec9 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -44,6 +44,7 @@ static const u32 mt7915_reg[] = {
- 	[SWDEF_BASE_ADDR]	= 0x41f200,
- 	[TXQ_WED_RING_BASE]	= 0xd7300,
- 	[RXQ_WED_RING_BASE]	= 0xd7410,
-+	[WED_RX_DATA_RING]	= 0xd4500,
- };
- 
- static const u32 mt7916_reg[] = {
-@@ -77,6 +78,7 @@ static const u32 mt7916_reg[] = {
- 	[SWDEF_BASE_ADDR]	= 0x411400,
- 	[TXQ_WED_RING_BASE]	= 0xd7300,
- 	[RXQ_WED_RING_BASE]	= 0xd7410,
-+	[WED_RX_DATA_RING]	= 0xd4540,
- };
- 
- static const u32 mt7986_reg[] = {
-@@ -110,6 +112,7 @@ static const u32 mt7986_reg[] = {
- 	[SWDEF_BASE_ADDR]	= 0x411400,
- 	[TXQ_WED_RING_BASE]	= 0x24420,
- 	[RXQ_WED_RING_BASE]	= 0x24520,
-+	[WED_RX_DATA_RING]	= 0x24540,
- };
- 
- static const u32 mt7915_offs[] = {
-@@ -605,7 +608,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 		struct pci_dev *pci_dev = pdev_ptr;
- 
- 		wed->wlan.pci_dev = pci_dev;
--		wed->wlan.bus_type = MTK_WED_BUS_PCIE;
-+		wed->wlan.bus_type = MTK_BUS_TYPE_PCIE;
- 		wed->wlan.base = (void __iomem *)ioremap(
- 				 pci_resource_start(pci_dev, 0),
- 				 pci_resource_len(pci_dev, 0));
-@@ -619,6 +622,10 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 				     MT_TXQ_WED_RING_BASE;
- 		wed->wlan.wpdma_txfree = pci_resource_start(pci_dev, 0) +
- 					 MT_RXQ_WED_RING_BASE;
-+		wed->wlan.wpdma_rx_glo = pci_resource_start(pci_dev, 0) +
-+					 MT_WPDMA_GLO_CFG;
-+		wed->wlan.wpdma_rx = pci_resource_start(pci_dev, 0) +
-+					 MT_RXQ_WED_DATA_RING_BASE;
- 		wed->wlan.phy_base = pci_resource_start(pci_dev, 0);
- 	} else {
- 		struct platform_device *plat_dev = pdev_ptr;
-@@ -628,27 +635,38 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 		if (!res)
- 			return -ENOMEM;
- 
--		wed->wlan.platform_dev = plat_dev;
--		wed->wlan.bus_type = MTK_WED_BUS_AXI;
-+		//wed->wlan.platform_dev = plat_dev;
-+		wed->wlan.bus_type = MTK_BUS_TYPE_AXI;
- 		wed->wlan.base = (void __iomem *)ioremap(res->start,
- 				 resource_size(res));
- 		wed->wlan.wpdma_int = res->start + MT_INT_SOURCE_CSR;
- 		wed->wlan.wpdma_mask = res->start + MT_INT_MASK_CSR;
- 		wed->wlan.wpdma_tx = res->start + MT_TXQ_WED_RING_BASE;
- 		wed->wlan.wpdma_txfree = res->start + MT_RXQ_WED_RING_BASE;
-+		wed->wlan.wpdma_rx_glo = res->start + MT_WPDMA_GLO_CFG;
-+		wed->wlan.wpdma_rx = res->start + MT_RXQ_WED_DATA_RING_BASE;
- 		wed->wlan.phy_base = res->start;
- 	}
--	wed->wlan.nbuf = 4096;
-+	wed->wlan.rx_pkt = MT7915_WED_RX_TOKEN_SIZE;
-+	wed->wlan.nbuf = 7168;
- 	wed->wlan.tx_tbit[0] = is_mt7915(&dev->mt76) ? 4 : 30;
- 	wed->wlan.tx_tbit[1] = is_mt7915(&dev->mt76) ? 5 : 31;
--	wed->wlan.txfree_tbit = is_mt7915(&dev->mt76) ? 1 : 2;
-+	wed->wlan.txfree_tbit = (is_mt7986(&dev->mt76) ? 2 : 1);
-+	wed->wlan.rx_tbit[0] = (is_mt7915(&dev->mt76) ? 16 : (is_mt7986(&dev->mt76) ? 22 : 18));
-+	wed->wlan.rx_tbit[1] = (is_mt7915(&dev->mt76) ? 17 : (is_mt7986(&dev->mt76) ? 23 : 19));
- 	wed->wlan.token_start = MT7915_TOKEN_SIZE - wed->wlan.nbuf;
- 	wed->wlan.init_buf = mt7915_wed_init_buf;
- 	wed->wlan.offload_enable = mt7915_mmio_wed_offload_enable;
- 	wed->wlan.offload_disable = mt7915_mmio_wed_offload_disable;
--	if (!is_mt7915(mdev))
-+	if (!is_mt7915(&dev->mt76))
- 		wed->wlan.wcid_512 = true;
- 
-+	wed->wlan.rx_nbuf = 65536;
-+	wed->wlan.rx_pkt_size = MTK_WED_RX_PKT_SIZE;
-+	wed->wlan.init_rx_buf = mt7915_wed_init_rx_buf;
-+	wed->wlan.release_rx_buf = mt7915_wed_release_rx_buf;
-+
-+	dev->mt76.rx_token_size = wed->wlan.rx_pkt;
- 	if (mtk_wed_device_attach(wed))
- 		return 0;
- 
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 06b98b7..6952825 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -81,6 +81,7 @@
- #define MT7915_MAX_STA_TWT_AGRT		8
- #define MT7915_MIN_TWT_DUR 64
- #define MT7915_MAX_QUEUE		(MT_RXQ_BAND2 + __MT_MCUQ_MAX + 2)
-+#define MT7915_WED_RX_TOKEN_SIZE	12288
- 
- struct mt7915_vif;
- struct mt7915_sta;
-@@ -560,7 +561,9 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
- irqreturn_t mt7915_irq_handler(int irq, void *dev_instance);
- u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif);
- u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
--
-+u32 mt7915_wed_init_rx_buf(struct mtk_wed_device *wed,
-+				int pkt_num);
-+void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed);
- int mt7915_register_device(struct mt7915_dev *dev);
- void mt7915_unregister_device(struct mt7915_dev *dev);
- void mt7915_eeprom_rebonding(struct mt7915_dev *dev);
-@@ -720,7 +723,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
- 			  struct mt76_tx_info *tx_info);
- void mt7915_tx_token_put(struct mt7915_dev *dev);
- void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb);
-+			 struct sk_buff *skb, u32 info);
- bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len);
- bool mt7915_wed_wds_check(struct mt76_dev *mdev, struct ieee80211_sta *sta);
- void mt7915_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
-diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 9b6266c..faaac08 100644
---- a/mt7915/regs.h
-+++ b/mt7915/regs.h
-@@ -43,6 +43,7 @@ enum reg_rev {
- 	SWDEF_BASE_ADDR,
- 	TXQ_WED_RING_BASE,
- 	RXQ_WED_RING_BASE,
-+	WED_RX_DATA_RING,
- 	__MT_REG_MAX,
- };
- 
-@@ -603,9 +604,13 @@ enum offs_rev {
- #define MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2	BIT(21)
- 
- #define MT_WFDMA0_RST_DTX_PTR		MT_WFDMA0(0x20c)
-+#define MT_WFDMA0_EXT0_CFG		MT_WFDMA0(0x2b0)
-+#define MT_WFDMA0_EXT0_RXWB_KEEP	BIT(10)
-+
- #define MT_WFDMA0_PRI_DLY_INT_CFG0	MT_WFDMA0(0x2f0)
- #define MT_WFDMA0_PRI_DLY_INT_CFG1	MT_WFDMA0(0x2f4)
- #define MT_WFDMA0_PRI_DLY_INT_CFG2	MT_WFDMA0(0x2f8)
-+#define MT_WPDMA_GLO_CFG		MT_WFDMA0(0x208)
- 
- /* WFDMA1 */
- #define MT_WFDMA1_BASE			0xd5000
-@@ -701,6 +706,7 @@ enum offs_rev {
- 
- #define MT_TXQ_WED_RING_BASE		__REG(TXQ_WED_RING_BASE)
- #define MT_RXQ_WED_RING_BASE		__REG(RXQ_WED_RING_BASE)
-+#define MT_RXQ_WED_DATA_RING_BASE	__REG(WED_RX_DATA_RING)
- 
- #define MT_INT_SOURCE_CSR		__REG(INT_SOURCE_CSR)
- #define MT_INT_MASK_CSR			__REG(INT_MASK_CSR)
-diff --git a/mt7921/mac.c b/mt7921/mac.c
-index 7b15193..ea6dd95 100644
---- a/mt7921/mac.c
-+++ b/mt7921/mac.c
-@@ -692,7 +692,7 @@ bool mt7921_rx_check(struct mt76_dev *mdev, void *data, int len)
- EXPORT_SYMBOL_GPL(mt7921_rx_check);
- 
- void mt7921_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb)
-+			 struct sk_buff *skb, u32 info)
- {
- 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
- 	__le32 *rxd = (__le32 *)skb->data;
-diff --git a/mt7921/mt7921.h b/mt7921/mt7921.h
-index d9d78f6..0c9924a 100644
---- a/mt7921/mt7921.h
-+++ b/mt7921/mt7921.h
-@@ -422,7 +422,7 @@ void mt7921_tx_worker(struct mt76_worker *w);
- void mt7921_tx_token_put(struct mt7921_dev *dev);
- bool mt7921_rx_check(struct mt76_dev *mdev, void *data, int len);
- void mt7921_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb);
-+			 struct sk_buff *skb, u32 info);
- void mt7921_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
- void mt7921_stats_work(struct work_struct *work);
- void mt7921_set_stream_he_caps(struct mt7921_phy *phy);
-diff --git a/tx.c b/tx.c
-index 8b33186..b812d06 100644
---- a/tx.c
-+++ b/tx.c
-@@ -778,3 +778,37 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
- 	return txwi;
- }
- EXPORT_SYMBOL_GPL(mt76_token_release);
-+
-+int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
-+			struct mt76_txwi_cache *r, dma_addr_t phys)
-+{
-+	int token;
-+
-+	spin_lock_bh(&dev->rx_token_lock);
-+
-+	token = idr_alloc(&dev->rx_token, r, 0, dev->rx_token_size, GFP_ATOMIC);
-+
-+	spin_unlock_bh(&dev->rx_token_lock);
-+
-+	r->buf = ptr;
-+	r->dma_addr = phys;
-+
-+	return token;
-+}
-+EXPORT_SYMBOL_GPL(mt76_rx_token_consume);
-+
-+struct mt76_txwi_cache *
-+mt76_rx_token_release(struct mt76_dev *dev, int token)
-+{
-+
-+	struct mt76_txwi_cache *rxwi;
-+
-+	spin_lock_bh(&dev->rx_token_lock);
-+
-+	rxwi = idr_remove(&dev->rx_token, token);
-+
-+	spin_unlock_bh(&dev->rx_token_lock);
-+
-+	return rxwi;
-+}
-+EXPORT_SYMBOL_GPL(mt76_rx_token_release);
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/3004-mt76-add-fill-receive-path-to-report-wed-idx.patch b/recipes-wifi/linux-mt76/files/patches/3004-mt76-add-fill-receive-path-to-report-wed-idx.patch
index 8b29384..9ac5937 100644
--- a/recipes-wifi/linux-mt76/files/patches/3004-mt76-add-fill-receive-path-to-report-wed-idx.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3004-mt76-add-fill-receive-path-to-report-wed-idx.patch
@@ -1,7 +1,7 @@
-From 5adc8023e3287208bb2ea04a20d0724b6264842d Mon Sep 17 00:00:00 2001
+From a48066bee44c4be864a2ec08724e6b5cd70e6d6c Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 19 May 2022 13:44:42 +0800
-Subject: [PATCH 3004/3011] mt76: add fill receive path to report wed idx
+Subject: [PATCH 3004/3010] mt76: add fill receive path to report wed idx
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -9,10 +9,10 @@
  1 file changed, 19 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index c061786..84b9001 100644
+index 8813e3c5..52aab3d1 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1521,6 +1521,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1560,6 +1560,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  
  	return 0;
  }
@@ -37,7 +37,7 @@
  #endif
  
  const struct ieee80211_ops mt7915_ops = {
-@@ -1572,5 +1590,6 @@ const struct ieee80211_ops mt7915_ops = {
+@@ -1612,5 +1630,6 @@ const struct ieee80211_ops mt7915_ops = {
  	.set_radar_background = mt7915_set_radar_background,
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
  	.net_fill_forward_path = mt7915_net_fill_forward_path,
diff --git a/recipes-wifi/linux-mt76/files/patches/3005-mt76-add-ser-spport-when-wed-on.patch b/recipes-wifi/linux-mt76/files/patches/3005-mt76-mt7915-add-ser-support-when-wed-on.patch
similarity index 74%
rename from recipes-wifi/linux-mt76/files/patches/3005-mt76-add-ser-spport-when-wed-on.patch
rename to recipes-wifi/linux-mt76/files/patches/3005-mt76-mt7915-add-ser-support-when-wed-on.patch
index 62ee299..4e29ecb 100644
--- a/recipes-wifi/linux-mt76/files/patches/3005-mt76-add-ser-spport-when-wed-on.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3005-mt76-mt7915-add-ser-support-when-wed-on.patch
@@ -1,24 +1,24 @@
-From 5362658103f2059a16ad626ab2f075b9279877e5 Mon Sep 17 00:00:00 2001
+From 4808621f5b154d3972f59ab2ee3a40d328a84ce0 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Thu, 28 Jul 2022 11:16:15 +0800
-Subject: [PATCH 3005/3011] mt76 add ser spport when wed on
+Date: Fri, 25 Nov 2022 14:07:46 +0800
+Subject: [PATCH 3005/3010] mt76: mt7915: add ser support when wed on
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
  dma.c           | 29 ++++++++++++++++++++---------
- dma.h           |  2 +-
+ dma.h           |  1 +
  mt76.h          |  1 +
  mt7915/dma.c    | 36 +++++++++++++++++++++++++++++++-----
- mt7915/mac.c    | 20 ++++++++++++++++++++
- mt7915/mmio.c   |  2 ++
+ mt7915/mac.c    | 18 ++++++++++++++++++
+ mt7915/mmio.c   |  3 +++
  mt7915/mt7915.h |  1 +
- 7 files changed, 76 insertions(+), 15 deletions(-)
+ 7 files changed, 75 insertions(+), 14 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index a8739eb..d63b02f 100644
+index 929816b7..8987c35f 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -169,7 +169,7 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
+@@ -165,7 +165,7 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
  	local_bh_enable();
  }
  
@@ -26,8 +26,8 @@
 +void
  mt76_free_pending_rxwi(struct mt76_dev *dev)
  {
- 	struct mt76_txwi_cache *r;
-@@ -183,6 +183,7 @@ mt76_free_pending_rxwi(struct mt76_dev *dev)
+ 	struct mt76_txwi_cache *t;
+@@ -178,6 +178,7 @@ mt76_free_pending_rxwi(struct mt76_dev *dev)
  	}
  	local_bh_enable();
  }
@@ -35,7 +35,7 @@
  
  static void
  mt76_dma_sync_idx(struct mt76_dev *dev, struct mt76_queue *q)
-@@ -624,14 +625,18 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -623,14 +624,18 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  	return frames;
  }
  
@@ -57,7 +57,7 @@
  	if (!mtk_wed_device_active(wed))
  		q->flags &= ~MT_QFLAG_WED;
  
-@@ -643,7 +648,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -642,7 +647,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
  
  	switch (type) {
  	case MT76_WED_Q_TX:
@@ -66,7 +66,7 @@
  		if (!ret)
  			q->wed_regs = wed->tx_ring[ring].reg_base;
  		break;
-@@ -659,7 +664,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -658,7 +663,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
  			q->wed_regs = wed->txfree_ring.reg_base;
  		break;
  	case MT76_WED_Q_RX:
@@ -75,7 +75,7 @@
  		if (!ret)
  			q->wed_regs = wed->rx_ring[ring].reg_base;
  		break;
-@@ -672,6 +677,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -671,6 +676,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
  	return 0;
  #endif
  }
@@ -83,7 +83,7 @@
  
  static int
  mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
-@@ -704,7 +710,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -697,7 +703,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  	if (!q->entry)
  		return -ENOMEM;
  
@@ -92,7 +92,7 @@
  	if (ret)
  		return ret;
  
-@@ -755,8 +761,13 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
+@@ -748,8 +754,13 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
  		q->desc[i].ctrl = cpu_to_le32(MT_DMA_CTL_DMA_DONE);
  
  	mt76_dma_rx_cleanup(dev, q);
@@ -109,21 +109,21 @@
  	if (!q->rx_head)
  		return;
 diff --git a/dma.h b/dma.h
-index 90370d1..083cbca 100644
+index 53c6ce25..4b9bc7f4 100644
 --- a/dma.h
 +++ b/dma.h
-@@ -58,5 +58,5 @@ enum mt76_mcu_evt_type {
+@@ -56,5 +56,6 @@ enum mt76_mcu_evt_type {
  int mt76_dma_rx_poll(struct napi_struct *napi, int budget);
  void mt76_dma_attach(struct mt76_dev *dev);
  void mt76_dma_cleanup(struct mt76_dev *dev);
--
 +int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset);
+ 
  #endif
 diff --git a/mt76.h b/mt76.h
-index 627bcbf..f22e96e 100644
+index bb0433b2..cca8986f 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1375,6 +1375,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1380,6 +1380,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  void mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  struct mt76_txwi_cache *mt76_get_rxwi(struct mt76_dev *dev);
@@ -132,10 +132,10 @@
  		      struct napi_struct *napi);
  void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 6f6550f..8edfa46 100644
+index 27b67800..03563919 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
-@@ -553,6 +553,7 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+@@ -562,6 +562,7 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
  int mt7915_dma_reset(struct mt7915_dev *dev, bool force)
  {
  	struct mt76_phy *mphy_ext = dev->mt76.phys[MT_BAND1];
@@ -143,7 +143,7 @@
  	int i;
  
  	/* clean up hw queues */
-@@ -572,28 +573,53 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force)
+@@ -581,28 +582,53 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force)
  	if (force)
  		mt7915_wfsys_reset(dev);
  
@@ -203,20 +203,11 @@
  }
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index eac4946..cbdabea 100644
+index d07bf790..f72e2bc2 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -948,6 +948,8 @@ void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed)
- 		mt76_put_rxwi(&dev->mt76, rxwi);
- 	}
- 
-+	mt76_free_pending_rxwi(&dev->mt76);
-+
- 	if (wed->rx_page.va)
- 		return;
- 
-@@ -958,6 +960,18 @@ void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed)
- 	return;
+@@ -895,6 +895,18 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
+ 	return MT_TXD_TXP_BUF_SIZE;
  }
  
 +void mt7915_wed_trigger_ser(struct mtk_wed_device *wed)
@@ -234,7 +225,7 @@
  static void
  mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  {
-@@ -1697,6 +1711,12 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1633,6 +1645,12 @@ void mt7915_mac_reset_work(struct work_struct *work)
  	if (!(READ_ONCE(dev->recovery.state) & MT_MCU_CMD_STOP_DMA))
  		return;
  
@@ -248,30 +239,38 @@
  	if (ext_phy)
  		ieee80211_stop_queues(ext_phy->hw);
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 1e22ec9..60b7886 100644
+index f348a779..f5dfee37 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -666,6 +666,8 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -617,6 +617,8 @@ static void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed)
+ 		mt76_put_rxwi(&dev->mt76, t);
+ 	}
+ 
++	mt76_free_pending_rxwi(&dev->mt76);
++
+ 	if (!wed->rx_buf_ring.rx_page.va)
+ 		return;
+ 
+@@ -775,6 +777,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  	wed->wlan.init_rx_buf = mt7915_wed_init_rx_buf;
  	wed->wlan.release_rx_buf = mt7915_wed_release_rx_buf;
- 
+ 	wed->wlan.update_wo_rx_stats = mt7915_mmio_wed_update_rx_stats;
 +	wed->wlan.ser_trigger = mt7915_wed_trigger_ser;
-+
- 	dev->mt76.rx_token_size = wed->wlan.rx_pkt;
- 	if (mtk_wed_device_attach(wed))
- 		return 0;
+ 
+ 	dev->mt76.rx_token_size = wed->wlan.rx_npkt;
+ 
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 6952825..36d1d86 100644
+index 6bc33f21..ec61941e 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -564,6 +564,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
- u32 mt7915_wed_init_rx_buf(struct mtk_wed_device *wed,
- 				int pkt_num);
- void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed);
+@@ -562,6 +562,7 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
+ irqreturn_t mt7915_irq_handler(int irq, void *dev_instance);
+ u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif);
+ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
 +void mt7915_wed_trigger_ser(struct mtk_wed_device *wed);
+ 
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
- void mt7915_eeprom_rebonding(struct mt7915_dev *dev);
 -- 
 2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-add-statistic-for-H-W-Rx-Path.patch b/recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-add-statistic-for-H-W-Rx-Path.patch
deleted file mode 100644
index f80fc8c..0000000
--- a/recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-add-statistic-for-H-W-Rx-Path.patch
+++ /dev/null
@@ -1,150 +0,0 @@
-From ca3fdfbb27f8d7c4c57164276e0220a7825fa61c Mon Sep 17 00:00:00 2001
-From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
-Date: Fri, 5 Aug 2022 13:58:11 -0700
-Subject: [PATCH 3006/3011] mt76: mt7915: add statistic for H/W Rx Path
-
-Change-Id: Id94d663f08e91c83d296bd57e5e9b65a505ae1c7
----
- mt76.h          |  4 ++++
- mt7915/mac.c    | 25 +++++++++++++++++++++++++
- mt7915/main.c   |  9 ++++++++-
- mt7915/mmio.c   | 17 +++++++++++++++++
- mt7915/mt7915.h |  2 ++
- 5 files changed, 56 insertions(+), 1 deletion(-)
-
-diff --git a/mt76.h b/mt76.h
-index f22e96e..8011d4c 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -278,6 +278,10 @@ struct mt76_sta_stats {
- 	u32 tx_packets;
- 	u32 tx_retries;
- 	u32 tx_failed;
-+	u64 rx_bytes;
-+	u32 rx_packets;
-+	u32 rx_error;
-+	u32 rx_drop;
- };
- 
- enum mt76_wcid_flags {
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index cbdabea..f1d15d8 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -972,6 +972,31 @@ void mt7915_wed_trigger_ser(struct mtk_wed_device *wed)
- 	return;
- }
- 
-+void mt7915_wed_update_wo_rxcnt(struct mtk_wed_device *wed,
-+				    struct wo_cmd_rxcnt_t *rxcnt)
-+{
-+	struct mt7915_dev *dev;
-+	struct mt76_wcid *wcid;
-+
-+	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
-+	if (rxcnt->wlan_idx >= mt7915_wtbl_size(dev))
-+		return;
-+
-+	rcu_read_lock();
-+
-+	wcid = rcu_dereference(dev->mt76.wcid[rxcnt->wlan_idx]);
-+	if (!wcid)
-+		goto out;
-+
-+	wcid->stats.rx_bytes += rxcnt->rx_byte_cnt;
-+	wcid->stats.rx_packets += rxcnt->rx_pkt_cnt;
-+	wcid->stats.rx_error += rxcnt->rx_err_cnt;
-+	wcid->stats.rx_drop += rxcnt->rx_drop_cnt;
-+
-+out:
-+	rcu_read_unlock();
-+}
-+
- static void
- mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
- {
-diff --git a/mt7915/main.c b/mt7915/main.c
-index 84b9001..4ac5259 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -1054,7 +1054,8 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
- 	struct rate_info *txrate = &msta->wcid.rate;
- 	struct rate_info rxrate = {};
- 
--	if (is_mt7915(&phy->dev->mt76) &&
-+	if ((is_mt7915(&phy->dev->mt76) ||
-+	    mtk_wed_device_active(&phy->dev->mt76.mmio.wed)) &&
- 	    !mt7915_mcu_get_rx_rate(phy, vif, sta, &rxrate)) {
- 		sinfo->rxrate = rxrate;
- 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
-@@ -1091,6 +1092,12 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
- 
- 		sinfo->tx_retries = msta->wcid.stats.tx_retries;
- 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
-+
-+		sinfo->rx_bytes = msta->wcid.stats.rx_bytes;
-+		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES64);
-+
-+		sinfo->rx_packets = msta->wcid.stats.rx_packets;
-+		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS);
- 	}
- 
- 	sinfo->ack_signal = (s8)msta->ack_signal;
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 60b7886..f3144d1 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -9,6 +9,7 @@
- #include "mt7915.h"
- #include "mac.h"
- #include "../trace.h"
-+#include "../mt76_connac_mcu.h"
- 
- static bool wed_enable = true;
- module_param(wed_enable, bool, 0644);
-@@ -668,6 +669,8 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 
- 	wed->wlan.ser_trigger = mt7915_wed_trigger_ser;
- 
-+	wed->wlan.update_wo_rxcnt = mt7915_wed_update_wo_rxcnt;
-+
- 	dev->mt76.rx_token_size = wed->wlan.rx_pkt;
- 	if (mtk_wed_device_attach(wed))
- 		return 0;
-@@ -680,6 +683,20 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 	if (ret)
- 		return ret;
- 
-+	if (wed->ver != 1) {
-+		struct {
-+		__le32 args[2];
-+		} req = {
-+			.args = {
-+				cpu_to_le32(1),
-+				cpu_to_le32(6),
-+			},
-+		};
-+
-+		mtk_wed_device_update_msg(wed, WED_WO_RXCNT_CTRL,
-+					  (void *)&req, sizeof(req));
-+	}
-+
- 	return 1;
- #else
- 	return 0;
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 36d1d86..7165273 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -565,6 +565,8 @@ u32 mt7915_wed_init_rx_buf(struct mtk_wed_device *wed,
- 				int pkt_num);
- void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed);
- void mt7915_wed_trigger_ser(struct mtk_wed_device *wed);
-+void mt7915_wed_update_wo_rxcnt(struct mtk_wed_device *wed,
-+				struct wo_cmd_rxcnt_t *rxcnt);
- int mt7915_register_device(struct mt7915_dev *dev);
- void mt7915_unregister_device(struct mt7915_dev *dev);
- void mt7915_eeprom_rebonding(struct mt7915_dev *dev);
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch b/recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch
similarity index 86%
rename from recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch
rename to recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch
index 16d9e8f..1d7c14b 100644
--- a/recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch
@@ -1,7 +1,8 @@
-From 8a932d446bb0da8b7aa4cc7ea8ed541e002cf015 Mon Sep 17 00:00:00 2001
+From f5eebefad9ec570614e439a2398049c307851c6f Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 2 Sep 2022 14:40:40 +0800
-Subject: [PATCH] mt76: mt7915: enable red per-band token drop for HW Path
+Subject: [PATCH 3006/3010] mt76: mt7915: enable red per-band token drop for HW
+ Path
 
 Limit the number of token used by each band. If a band uses too many token,
 it may hurt the throughput of the other band. The SW path can solve this
@@ -15,10 +16,10 @@
  3 files changed, 46 insertions(+), 11 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 16349c58..2ef353b2 100644
+index 03fd8c50..e6826c60 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2320,8 +2320,13 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2343,8 +2343,13 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  			mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
  					  MCU_WA_PARAM_WED_VERSION,
  					  wed->rev_id, 0);
@@ -32,7 +33,7 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
  		return ret;
-@@ -2331,12 +2336,7 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2354,12 +2359,7 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -46,7 +47,7 @@
  }
  
  int mt7915_mcu_init(struct mt7915_dev *dev)
-@@ -4162,6 +4162,35 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
+@@ -4429,6 +4429,35 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
  
  	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), wait_resp);
  }
@@ -82,7 +83,7 @@
  
  int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
  {
-@@ -4172,17 +4201,21 @@ int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
+@@ -4439,17 +4468,21 @@ int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
  	u32 red_type = enabled > 0 ? RED_BY_WA_ENABLE : RED_DISABLE;
  	__le32 req = cpu_to_le32(red_type);
  
@@ -109,10 +110,10 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 4ae8d532..14a0972b 100644
+index 5fcac90f..f9fb4137 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -271,6 +271,7 @@ enum {
+@@ -282,6 +282,7 @@ enum {
  	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
  #endif
  	MCU_WA_PARAM_WED_VERSION = 0x32,
@@ -121,10 +122,10 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 46670de4..d8765041 100644
+index ec61941e..3930c441 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -773,13 +773,14 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+@@ -774,13 +774,14 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  #endif
  int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value, s8 compensation);
  int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
diff --git a/recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch b/recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch
similarity index 95%
rename from recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch
rename to recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch
index 52f3e79..d8e90e4 100644
--- a/recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch
@@ -1,7 +1,7 @@
-From 2723beedc39c16ab67c7008779ebed4cf210e7ef Mon Sep 17 00:00:00 2001
+From 9f56f839a050fc71b8fd9a7b8eb0ed62615948db Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 22 Sep 2022 09:54:53 +0800
-Subject: [PATCH 3008/3011] mt76: mt7915: update mt7916 trinfo when hw path
+Subject: [PATCH 3007/3010] mt76: mt7915: update mt7916 trinfo when hw path
  enable
 
 ---
@@ -10,7 +10,7 @@
  2 files changed, 23 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mt7915_debug.h b/mt7915/mt7915_debug.h
-index ecdc02a..0a1ee80 100644
+index ecdc02ab..0a1ee808 100644
 --- a/mt7915/mt7915_debug.h
 +++ b/mt7915/mt7915_debug.h
 @@ -133,6 +133,8 @@ enum dbg_reg_rev {
@@ -57,7 +57,7 @@
  #define MT_DBG_INT_SOURCE_CSR			__DBG_REG(dev, DBG_INT_SOURCE_CSR)
  #define MT_DBG_INT_MASK_CSR			__DBG_REG(dev, DBG_INT_MASK_CSR)
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index facdd69..f25f9c6 100644
+index 8c8a3ca5..a75e6d1a 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -856,12 +856,22 @@ mt7986_show_host_dma_info(struct seq_file *s, struct mt7915_dev *dev)
diff --git a/recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-find-rx-token-by-physical-address.patch b/recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-find-rx-token-by-physical-address.patch
new file mode 100644
index 0000000..ff4656b
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-find-rx-token-by-physical-address.patch
@@ -0,0 +1,51 @@
+From b563403b2ca597970fda5a912433108b3b364349 Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Fri, 25 Nov 2022 14:32:35 +0800
+Subject: [PATCH 3008/3010] mt76: mt7915: find rx token by physical address
+
+The token id in RxDMAD may be incorrect when it is not the last frame due to
+WED HW bug. Lookup correct token id by physical address in sdp0.
+
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+---
+ dma.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/dma.c b/dma.c
+index 8987c35f..c3adec5f 100644
+--- a/dma.c
++++ b/dma.c
+@@ -372,10 +372,29 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+ 
+ 	if ((q->flags & MT_QFLAG_WED) &&
+ 	    FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
++		u32 id, find = 0;
+ 		u32 token = FIELD_GET(MT_DMA_CTL_TOKEN,
+ 				      le32_to_cpu(desc->buf1));
+-		struct mt76_txwi_cache *t = mt76_rx_token_release(dev, token);
++		struct mt76_txwi_cache *t;
++
++		if (*more) {
++			spin_lock_bh(&dev->rx_token_lock);
++
++			idr_for_each_entry(&dev->rx_token, t, id) {
++				if (t->dma_addr == le32_to_cpu(desc->buf0)) {
++					find = 1;
++					desc->buf1 = FIELD_PREP(MT_DMA_CTL_TOKEN, id);
++					token = id;
++					break;
++				}
++			}
++
++			spin_unlock_bh(&dev->rx_token_lock);
++			if (!find)
++				return NULL;
++		}
+ 
++		t = mt76_rx_token_release(dev, token);
+ 		if (!t)
+ 			return NULL;
+ 
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-drop-scatter-and-gather-frame.patch b/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-drop-scatter-and-gather-frame.patch
new file mode 100644
index 0000000..33f1251
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-drop-scatter-and-gather-frame.patch
@@ -0,0 +1,58 @@
+From 11e42a1e092b3eefd941813e96ec28df370fa1c7 Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Fri, 25 Nov 2022 14:37:58 +0800
+Subject: [PATCH 3009/3010] mt76: mt7915: drop scatter and gather frame
+
+The scatter and gather frame may be incorrect because WED and WO may
+send frames to host driver interleaved.
+
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+---
+ dma.c  | 5 +++++
+ dma.h  | 1 +
+ mt76.h | 1 +
+ 3 files changed, 7 insertions(+)
+
+diff --git a/dma.c b/dma.c
+index c3adec5f..bba64aef 100644
+--- a/dma.c
++++ b/dma.c
+@@ -416,6 +416,11 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+ 
+ 			*drop = !!(ctrl & (MT_DMA_CTL_TO_HOST_A |
+ 					   MT_DMA_CTL_DROP));
++
++			if (!(*more) && FIELD_GET(MT_DMA_CTL_WO, desc->buf1))
++				q->flags &= ~MT_QFLAG_WED_FRAG;
++			else
++				q->flags |= MT_QFLAG_WED_FRAG;
+ 		}
+ 	} else {
+ 		buf = e->buf;
+diff --git a/dma.h b/dma.h
+index 4b9bc7f4..ce8ac426 100644
+--- a/dma.h
++++ b/dma.h
+@@ -19,6 +19,7 @@
+ #define MT_DMA_CTL_TO_HOST_A		BIT(12)
+ #define MT_DMA_CTL_DROP			BIT(14)
+ #define MT_DMA_CTL_TOKEN		GENMASK(31, 16)
++#define MT_DMA_CTL_WO			BIT(8)
+ 
+ #define MT_DMA_PPE_CPU_REASON		GENMASK(15, 11)
+ #define MT_DMA_PPE_ENTRY		GENMASK(30, 16)
+diff --git a/mt76.h b/mt76.h
+index cca8986f..43594102 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -30,6 +30,7 @@
+ #define MT_QFLAG_WED_RING	GENMASK(1, 0)
+ #define MT_QFLAG_WED_TYPE	GENMASK(3, 2)
+ #define MT_QFLAG_WED		BIT(4)
++#define MT_QFLAG_WED_FRAG	BIT(5)
+ 
+ #define __MT_WED_Q(_type, _n)	(MT_QFLAG_WED | \
+ 				 FIELD_PREP(MT_QFLAG_WED_TYPE, _type) | \
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-find-rx-token-by-physical-address.patch b/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-find-rx-token-by-physical-address.patch
deleted file mode 100644
index 872c4bc..0000000
--- a/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-find-rx-token-by-physical-address.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 3a759e4352a6aebba5c39993c9042d37e25677e8 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Tue, 27 Sep 2022 16:34:26 +0800
-Subject: [PATCH 3009/3011] mt76: mt7915: find rx token by physical address
-
-The token id in RxDMAD may be incorrect when it is not the last frame due to
-WED HW bug. Lookup correct token id by physical address in sdp0.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- dma.c | 19 ++++++++++++++++++-
- 1 file changed, 18 insertions(+), 1 deletion(-)
-
-diff --git a/dma.c b/dma.c
-index d63b02f..a7a4538 100644
---- a/dma.c
-+++ b/dma.c
-@@ -380,11 +380,28 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
- 
- 	type = FIELD_GET(MT_QFLAG_WED_TYPE, q->flags);
- 	if (mtk_wed_device_active(wed) && type == MT76_WED_Q_RX) {
--		u32 token;
-+		u32 token, id, find = 0;
- 		struct mt76_txwi_cache *r;
- 
- 		token = FIELD_GET(MT_DMA_CTL_TOKEN, desc->buf1);
- 
-+		if (*more) {
-+			spin_lock_bh(&dev->rx_token_lock);
-+
-+			idr_for_each_entry(&dev->rx_token, r, id) {
-+				if (r->dma_addr == le32_to_cpu(desc->buf0)) {
-+					find = 1;
-+					desc->buf1 = FIELD_PREP(MT_DMA_CTL_TOKEN, id);
-+					token = id;
-+					break;
-+				}
-+			}
-+
-+			spin_unlock_bh(&dev->rx_token_lock);
-+			if (!find)
-+				return NULL;
-+
-+		}
- 		r = mt76_rx_token_release(dev, token);
- 		if (!r)
- 			return NULL;
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/3011-mt76-HW-ATF-support-for-mt7986.patch b/recipes-wifi/linux-mt76/files/patches/3010-mt76-HW-ATF-support-for-mt7986.patch
similarity index 96%
rename from recipes-wifi/linux-mt76/files/patches/3011-mt76-HW-ATF-support-for-mt7986.patch
rename to recipes-wifi/linux-mt76/files/patches/3010-mt76-HW-ATF-support-for-mt7986.patch
index 86b01bb..2386682 100644
--- a/recipes-wifi/linux-mt76/files/patches/3011-mt76-HW-ATF-support-for-mt7986.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3010-mt76-HW-ATF-support-for-mt7986.patch
@@ -1,7 +1,7 @@
-From 49dd3f3791d2b28bc28225d09c6455722d96489d Mon Sep 17 00:00:00 2001
+From 2f63aedb6f87a4f46a5af6a98093c7c87f6f8cd1 Mon Sep 17 00:00:00 2001
 From: Lian Chen <lian.chen@mediatek.com>
 Date: Mon, 7 Nov 2022 14:47:44 +0800
-Subject: [PATCH 3011/3011] mt76: HW ATF support for mt7986
+Subject: [PATCH 3010/3010] mt76: HW ATF support for mt7986
 
 Signed-off-by: Lian Chen <lian.chen@mediatek.com>
 ---
@@ -16,10 +16,10 @@
  mode change 100644 => 100755 mt7915/init.c
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index a368b65..2cb498f 100644
+index 3b789d75..eb17a015 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1122,6 +1122,7 @@ enum {
+@@ -1148,6 +1148,7 @@ enum {
  	MCU_EXT_CMD_THERMAL_CTRL = 0x2c,
  	MCU_EXT_CMD_WTBL_UPDATE = 0x32,
  	MCU_EXT_CMD_SET_DRR_CTRL = 0x36,
@@ -27,7 +27,7 @@
  	MCU_EXT_CMD_SET_RDD_CTRL = 0x3a,
  	MCU_EXT_CMD_ATE_CTRL = 0x3d,
  	MCU_EXT_CMD_PROTECT_CTRL = 0x3e,
-@@ -1131,6 +1132,7 @@ enum {
+@@ -1157,6 +1158,7 @@ enum {
  	MCU_EXT_CMD_MUAR_UPDATE = 0x48,
  	MCU_EXT_CMD_BCN_OFFLOAD = 0x49,
  	MCU_EXT_CMD_RX_AIRTIME_CTRL = 0x4a,
@@ -36,7 +36,7 @@
  	MCU_EXT_CMD_EFUSE_FREE_BLOCK = 0x4f,
  	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 2140703..85468cd 100644
+index 092d8434..79a29ee8 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -12,6 +12,10 @@
@@ -457,7 +457,7 @@
  static int
  mt7915_radar_trigger(void *data, u64 val)
  {
-@@ -1107,6 +1511,7 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+@@ -1120,6 +1524,7 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
  	debugfs_create_devm_seqfile(dev->mt76.dev, "twt_stats", dir,
  				    mt7915_twt_stats);
  	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
@@ -468,10 +468,10 @@
 diff --git a/mt7915/init.c b/mt7915/init.c
 old mode 100644
 new mode 100755
-index 039a5b0..5a7fdb5
+index 8f32b6a8..f62a9dae
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -473,10 +473,46 @@ mt7915_mac_init_band(struct mt7915_dev *dev, u8 band)
+@@ -476,10 +476,46 @@ mt7915_mac_init_band(struct mt7915_dev *dev, u8 band)
  	mt76_rmw(dev, MT_WTBLOFF_TOP_RSCR(band), mask, set);
  }
  
@@ -518,7 +518,7 @@
  
  	/* config pse qid6 wfdma port selection */
  	if (!is_mt7915(&dev->mt76) && dev->hif2)
-@@ -501,6 +537,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
+@@ -504,6 +540,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
  		i = dev->mt76.led_pin ? MT_LED_GPIO_MUX3 : MT_LED_GPIO_MUX2;
  		mt76_rmw_field(dev, i, MT_LED_GPIO_SEL_MASK, 4);
  	}
@@ -529,7 +529,7 @@
  
  int mt7915_txbf_init(struct mt7915_dev *dev)
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 4ac5259..6c910cf 100644
+index 52aab3d1..ece28aa0 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -195,6 +195,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
@@ -551,7 +551,7 @@
  out:
  	mutex_unlock(&dev->mt76.mutex);
  
-@@ -685,6 +690,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -683,6 +688,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	bool ext_phy = mvif->phy != &dev->phy;
@@ -559,7 +559,7 @@
  #ifdef CONFIG_MTK_VENDOR
  	struct mt7915_phy *phy;
  #endif
-@@ -739,6 +745,16 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -737,6 +743,16 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  		mt7915_mcu_set_mimo(phy, 0);
  	}
  #endif
@@ -577,10 +577,10 @@
  }
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index ad2d6a3..4728d84 100644
+index e6826c60..4d3def95 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3323,6 +3323,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
+@@ -3428,6 +3428,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
  				 &req, sizeof(req), false);
  }
  
@@ -753,10 +753,10 @@
  {
  	struct {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 8567415..872b0e7 100644
+index 3930c441..890e329e 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -131,6 +131,58 @@ struct mt7915_twt_flow {
+@@ -132,6 +132,58 @@ struct mt7915_twt_flow {
  
  DECLARE_EWMA(avg_signal, 10, 8)
  
@@ -815,7 +815,7 @@
  struct mt7915_sta {
  	struct mt76_wcid wcid; /* must be first */
  
-@@ -152,6 +204,7 @@ struct mt7915_sta {
+@@ -153,6 +205,7 @@ struct mt7915_sta {
  		u8 flowid_mask;
  		struct mt7915_twt_flow flow[MT7915_MAX_STA_TWT_AGRT];
  	} twt;
@@ -823,7 +823,7 @@
  };
  
  struct mt7915_vif_cap {
-@@ -467,6 +520,8 @@ struct mt7915_dev {
+@@ -468,6 +521,8 @@ struct mt7915_dev {
  	} dbg;
  	const struct mt7915_dbg_reg_desc *dbg_reg;
  #endif
@@ -832,7 +832,7 @@
  };
  
  enum {
-@@ -499,6 +554,15 @@ enum mt7915_rdd_cmd {
+@@ -500,6 +555,15 @@ enum mt7915_rdd_cmd {
  	RDD_IRQ_OFF,
  };
  
@@ -848,7 +848,7 @@
  static inline struct mt7915_phy *
  mt7915_hw_phy(struct ieee80211_hw *hw)
  {
-@@ -630,6 +694,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
+@@ -627,6 +691,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
  int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
  			      u8 en);
  int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
@@ -860,7 +860,7 @@
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
  int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index f25f9c6..c638d29 100644
+index a75e6d1a..900b6b57 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -1301,7 +1301,6 @@ static EMPTY_QUEUE_INFO_T ple_txcmd_queue_empty_info[] = {
diff --git a/recipes-wifi/linux-mt76/files/patches/3010-mt76-mt7915-drop-scatter-and-gather-frame.patch b/recipes-wifi/linux-mt76/files/patches/3010-mt76-mt7915-drop-scatter-and-gather-frame.patch
deleted file mode 100644
index ef6e990..0000000
--- a/recipes-wifi/linux-mt76/files/patches/3010-mt76-mt7915-drop-scatter-and-gather-frame.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From 50d41085e1f54e1cb308bd615052aaf5e317c8c5 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Wed, 28 Sep 2022 18:52:54 +0800
-Subject: [PATCH 3010/3011] mt76: mt7915: drop scatter and gather frame
-
-The scatter and gather frame may be incorrect because WED and WO may
-send frames to host driver interleaved.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- dma.c  | 9 +++++++++
- dma.h  | 1 +
- mt76.h | 1 +
- 3 files changed, 11 insertions(+)
-
-diff --git a/dma.c b/dma.c
-index a7a4538..c106ae4 100644
---- a/dma.c
-+++ b/dma.c
-@@ -419,6 +419,15 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
- 
- 		if (desc->ctrl & (MT_DMA_CTL_TO_HOST_A | MT_DMA_CTL_DROP))
- 			*drop = true;
-+
-+		if (*more || (q->flags & MT_QFLAG_WED_FRAG)) {
-+			*drop = true;
-+
-+			if (!(*more) && FIELD_GET(MT_DMA_CTL_WO, desc->buf1))
-+				q->flags &= ~MT_QFLAG_WED_FRAG;
-+			else
-+				q->flags |= MT_QFLAG_WED_FRAG;
-+		}
- 	} else {
- 		buf_addr = e->dma_addr[0];
- 		e->buf = NULL;
-diff --git a/dma.h b/dma.h
-index 083cbca..221fcc8 100644
---- a/dma.h
-+++ b/dma.h
-@@ -21,6 +21,7 @@
- #define MT_DMA_CTL_DROP			BIT(14)
- 
- #define MT_DMA_CTL_TOKEN		GENMASK(31, 16)
-+#define MT_DMA_CTL_WO			BIT(8)
- 
- #define MT_DMA_PPE_CPU_REASON		GENMASK(15, 11)
- #define MT_DMA_PPE_ENTRY		GENMASK(30, 16)
-diff --git a/mt76.h b/mt76.h
-index 8011d4c..9b22551 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -32,6 +32,7 @@
- #define MT_QFLAG_WED_RING	GENMASK(1, 0)
- #define MT_QFLAG_WED_TYPE	GENMASK(3, 2)
- #define MT_QFLAG_WED		BIT(4)
-+#define MT_QFLAG_WED_FRAG	BIT(5)
- 
- #define __MT_WED_Q(_type, _n)	(MT_QFLAG_WED | \
- 				 FIELD_PREP(MT_QFLAG_WED_TYPE, _type) | \
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/patches.inc b/recipes-wifi/linux-mt76/files/patches/patches.inc
index fcc6800..cf04d5e 100644
--- a/recipes-wifi/linux-mt76/files/patches/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches/patches.inc
@@ -31,13 +31,12 @@
     file://1127-mt76-support-on-off-SW-ACI-through-debugfs.patch \
     file://3001-mt76-add-wed-tx-support.patch \
     file://3002-mt76-mt7915-add-wed-tx-wds-support-on-mt7986.patch \
-    file://3003-mt76-add-wed-rx-support.patch \
+    file://3003-mt76-add-wed-rx-copy-skb.patch \
     file://3004-mt76-add-fill-receive-path-to-report-wed-idx.patch \
-    file://3005-mt76-add-ser-spport-when-wed-on.patch \
-    file://3006-mt76-mt7915-add-statistic-for-H-W-Rx-Path.patch \
-    file://3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch \
-    file://3008-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch \
-    file://3009-mt76-mt7915-find-rx-token-by-physical-address.patch \
-    file://3010-mt76-mt7915-drop-scatter-and-gather-frame.patch \
-    file://3011-mt76-HW-ATF-support-for-mt7986.patch \
+    file://3005-mt76-mt7915-add-ser-support-when-wed-on.patch \
+    file://3006-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch \
+    file://3007-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch \
+    file://3008-mt76-mt7915-find-rx-token-by-physical-address.patch \
+    file://3009-mt76-mt7915-drop-scatter-and-gather-frame.patch \
+    file://3010-mt76-HW-ATF-support-for-mt7986.patch \
     "